diff --git a/.changelog/10036.txt b/.archive/changelog/10036.txt
similarity index 100%
rename from .changelog/10036.txt
rename to .archive/changelog/10036.txt
diff --git a/.changelog/10210.txt b/.archive/changelog/10210.txt
similarity index 100%
rename from .changelog/10210.txt
rename to .archive/changelog/10210.txt
diff --git a/.changelog/10213.txt b/.archive/changelog/10213.txt
similarity index 100%
rename from .changelog/10213.txt
rename to .archive/changelog/10213.txt
diff --git a/.changelog/10498.txt b/.archive/changelog/10498.txt
similarity index 100%
rename from .changelog/10498.txt
rename to .archive/changelog/10498.txt
diff --git a/.changelog/10539.txt b/.archive/changelog/10539.txt
similarity index 100%
rename from .changelog/10539.txt
rename to .archive/changelog/10539.txt
diff --git a/.changelog/10563.txt b/.archive/changelog/10563.txt
similarity index 100%
rename from .changelog/10563.txt
rename to .archive/changelog/10563.txt
diff --git a/.changelog/10672.txt b/.archive/changelog/10672.txt
similarity index 100%
rename from .changelog/10672.txt
rename to .archive/changelog/10672.txt
diff --git a/.changelog/10693.txt b/.archive/changelog/10693.txt
similarity index 100%
rename from .changelog/10693.txt
rename to .archive/changelog/10693.txt
diff --git a/.changelog/10807.txt b/.archive/changelog/10807.txt
similarity index 100%
rename from .changelog/10807.txt
rename to .archive/changelog/10807.txt
diff --git a/.changelog/10817.txt b/.archive/changelog/10817.txt
similarity index 100%
rename from .changelog/10817.txt
rename to .archive/changelog/10817.txt
diff --git a/.changelog/10962.txt b/.archive/changelog/10962.txt
similarity index 100%
rename from .changelog/10962.txt
rename to .archive/changelog/10962.txt
diff --git a/.changelog/10969.txt b/.archive/changelog/10969.txt
similarity index 100%
rename from .changelog/10969.txt
rename to .archive/changelog/10969.txt
diff --git a/.changelog/11195.txt b/.archive/changelog/11195.txt
similarity index 100%
rename from .changelog/11195.txt
rename to .archive/changelog/11195.txt
diff --git a/.changelog/11229.txt b/.archive/changelog/11229.txt
similarity index 100%
rename from .changelog/11229.txt
rename to .archive/changelog/11229.txt
diff --git a/.changelog/11487.txt b/.archive/changelog/11487.txt
similarity index 100%
rename from .changelog/11487.txt
rename to .archive/changelog/11487.txt
diff --git a/.changelog/11522.txt b/.archive/changelog/11522.txt
similarity index 100%
rename from .changelog/11522.txt
rename to .archive/changelog/11522.txt
diff --git a/.changelog/11560.txt b/.archive/changelog/11560.txt
similarity index 100%
rename from .changelog/11560.txt
rename to .archive/changelog/11560.txt
diff --git a/.changelog/11600.txt b/.archive/changelog/11600.txt
similarity index 100%
rename from .changelog/11600.txt
rename to .archive/changelog/11600.txt
diff --git a/.changelog/11687.txt b/.archive/changelog/11687.txt
similarity index 100%
rename from .changelog/11687.txt
rename to .archive/changelog/11687.txt
diff --git a/.changelog/11770.txt b/.archive/changelog/11770.txt
similarity index 100%
rename from .changelog/11770.txt
rename to .archive/changelog/11770.txt
diff --git a/.changelog/11772.txt b/.archive/changelog/11772.txt
similarity index 100%
rename from .changelog/11772.txt
rename to .archive/changelog/11772.txt
diff --git a/.changelog/11774.txt b/.archive/changelog/11774.txt
similarity index 100%
rename from .changelog/11774.txt
rename to .archive/changelog/11774.txt
diff --git a/.changelog/11795.txt b/.archive/changelog/11795.txt
similarity index 100%
rename from .changelog/11795.txt
rename to .archive/changelog/11795.txt
diff --git a/.changelog/11857.txt b/.archive/changelog/11857.txt
similarity index 100%
rename from .changelog/11857.txt
rename to .archive/changelog/11857.txt
diff --git a/.changelog/11879.txt b/.archive/changelog/11879.txt
similarity index 100%
rename from .changelog/11879.txt
rename to .archive/changelog/11879.txt
diff --git a/.changelog/11936.txt b/.archive/changelog/11936.txt
similarity index 100%
rename from .changelog/11936.txt
rename to .archive/changelog/11936.txt
diff --git a/.changelog/11937.txt b/.archive/changelog/11937.txt
similarity index 100%
rename from .changelog/11937.txt
rename to .archive/changelog/11937.txt
diff --git a/.changelog/11938.txt b/.archive/changelog/11938.txt
similarity index 100%
rename from .changelog/11938.txt
rename to .archive/changelog/11938.txt
diff --git a/.changelog/11939.txt b/.archive/changelog/11939.txt
similarity index 100%
rename from .changelog/11939.txt
rename to .archive/changelog/11939.txt
diff --git a/.changelog/11941.txt b/.archive/changelog/11941.txt
similarity index 100%
rename from .changelog/11941.txt
rename to .archive/changelog/11941.txt
diff --git a/.changelog/11967.txt b/.archive/changelog/11967.txt
similarity index 100%
rename from .changelog/11967.txt
rename to .archive/changelog/11967.txt
diff --git a/.changelog/11997.txt b/.archive/changelog/11997.txt
similarity index 100%
rename from .changelog/11997.txt
rename to .archive/changelog/11997.txt
diff --git a/.changelog/12018.txt b/.archive/changelog/12018.txt
similarity index 100%
rename from .changelog/12018.txt
rename to .archive/changelog/12018.txt
diff --git a/.changelog/12055.txt b/.archive/changelog/12055.txt
similarity index 100%
rename from .changelog/12055.txt
rename to .archive/changelog/12055.txt
diff --git a/.changelog/12103.txt b/.archive/changelog/12103.txt
similarity index 100%
rename from .changelog/12103.txt
rename to .archive/changelog/12103.txt
diff --git a/.changelog/12108.txt b/.archive/changelog/12108.txt
similarity index 100%
rename from .changelog/12108.txt
rename to .archive/changelog/12108.txt
diff --git a/.changelog/12130.txt b/.archive/changelog/12130.txt
similarity index 100%
rename from .changelog/12130.txt
rename to .archive/changelog/12130.txt
diff --git a/.changelog/12141.txt b/.archive/changelog/12141.txt
similarity index 100%
rename from .changelog/12141.txt
rename to .archive/changelog/12141.txt
diff --git a/.changelog/12200.txt b/.archive/changelog/12200.txt
similarity index 100%
rename from .changelog/12200.txt
rename to .archive/changelog/12200.txt
diff --git a/.changelog/12310.txt b/.archive/changelog/12310.txt
similarity index 100%
rename from .changelog/12310.txt
rename to .archive/changelog/12310.txt
diff --git a/.changelog/12311.txt b/.archive/changelog/12311.txt
similarity index 100%
rename from .changelog/12311.txt
rename to .archive/changelog/12311.txt
diff --git a/.changelog/12370.txt b/.archive/changelog/12370.txt
similarity index 100%
rename from .changelog/12370.txt
rename to .archive/changelog/12370.txt
diff --git a/.changelog/12384.txt b/.archive/changelog/12384.txt
similarity index 100%
rename from .changelog/12384.txt
rename to .archive/changelog/12384.txt
diff --git a/.changelog/12409.txt b/.archive/changelog/12409.txt
similarity index 100%
rename from .changelog/12409.txt
rename to .archive/changelog/12409.txt
diff --git a/.changelog/12423.txt b/.archive/changelog/12423.txt
similarity index 100%
rename from .changelog/12423.txt
rename to .archive/changelog/12423.txt
diff --git a/.changelog/12433.txt b/.archive/changelog/12433.txt
similarity index 100%
rename from .changelog/12433.txt
rename to .archive/changelog/12433.txt
diff --git a/.changelog/12436.txt b/.archive/changelog/12436.txt
similarity index 100%
rename from .changelog/12436.txt
rename to .archive/changelog/12436.txt
diff --git a/.changelog/12482.txt b/.archive/changelog/12482.txt
similarity index 100%
rename from .changelog/12482.txt
rename to .archive/changelog/12482.txt
diff --git a/.changelog/12485.txt b/.archive/changelog/12485.txt
similarity index 100%
rename from .changelog/12485.txt
rename to .archive/changelog/12485.txt
diff --git a/.changelog/12495.txt b/.archive/changelog/12495.txt
similarity index 100%
rename from .changelog/12495.txt
rename to .archive/changelog/12495.txt
diff --git a/.changelog/12509.txt b/.archive/changelog/12509.txt
similarity index 100%
rename from .changelog/12509.txt
rename to .archive/changelog/12509.txt
diff --git a/.changelog/12548.txt b/.archive/changelog/12548.txt
similarity index 100%
rename from .changelog/12548.txt
rename to .archive/changelog/12548.txt
diff --git a/.changelog/12578.txt b/.archive/changelog/12578.txt
similarity index 100%
rename from .changelog/12578.txt
rename to .archive/changelog/12578.txt
diff --git a/.changelog/12625.txt b/.archive/changelog/12625.txt
similarity index 100%
rename from .changelog/12625.txt
rename to .archive/changelog/12625.txt
diff --git a/.changelog/12642.txt b/.archive/changelog/12642.txt
similarity index 100%
rename from .changelog/12642.txt
rename to .archive/changelog/12642.txt
diff --git a/.changelog/12645.txt b/.archive/changelog/12645.txt
similarity index 100%
rename from .changelog/12645.txt
rename to .archive/changelog/12645.txt
diff --git a/.changelog/12684.txt b/.archive/changelog/12684.txt
similarity index 100%
rename from .changelog/12684.txt
rename to .archive/changelog/12684.txt
diff --git a/.changelog/12711.txt b/.archive/changelog/12711.txt
similarity index 100%
rename from .changelog/12711.txt
rename to .archive/changelog/12711.txt
diff --git a/.changelog/12758.txt b/.archive/changelog/12758.txt
similarity index 100%
rename from .changelog/12758.txt
rename to .archive/changelog/12758.txt
diff --git a/.changelog/12787.txt b/.archive/changelog/12787.txt
similarity index 100%
rename from .changelog/12787.txt
rename to .archive/changelog/12787.txt
diff --git a/.changelog/12817.txt b/.archive/changelog/12817.txt
similarity index 100%
rename from .changelog/12817.txt
rename to .archive/changelog/12817.txt
diff --git a/.changelog/12868.txt b/.archive/changelog/12868.txt
similarity index 100%
rename from .changelog/12868.txt
rename to .archive/changelog/12868.txt
diff --git a/.changelog/12949.txt b/.archive/changelog/12949.txt
similarity index 100%
rename from .changelog/12949.txt
rename to .archive/changelog/12949.txt
diff --git a/.changelog/13000.txt b/.archive/changelog/13000.txt
similarity index 100%
rename from .changelog/13000.txt
rename to .archive/changelog/13000.txt
diff --git a/.changelog/13018.txt b/.archive/changelog/13018.txt
similarity index 100%
rename from .changelog/13018.txt
rename to .archive/changelog/13018.txt
diff --git a/.changelog/13127.txt b/.archive/changelog/13127.txt
similarity index 100%
rename from .changelog/13127.txt
rename to .archive/changelog/13127.txt
diff --git a/.changelog/13139.txt b/.archive/changelog/13139.txt
similarity index 100%
rename from .changelog/13139.txt
rename to .archive/changelog/13139.txt
diff --git a/.changelog/13140.txt b/.archive/changelog/13140.txt
similarity index 100%
rename from .changelog/13140.txt
rename to .archive/changelog/13140.txt
diff --git a/.changelog/13203.txt b/.archive/changelog/13203.txt
similarity index 100%
rename from .changelog/13203.txt
rename to .archive/changelog/13203.txt
diff --git a/.changelog/13251.txt b/.archive/changelog/13251.txt
similarity index 100%
rename from .changelog/13251.txt
rename to .archive/changelog/13251.txt
diff --git a/.changelog/13366.txt b/.archive/changelog/13366.txt
similarity index 100%
rename from .changelog/13366.txt
rename to .archive/changelog/13366.txt
diff --git a/.changelog/13371.txt b/.archive/changelog/13371.txt
similarity index 100%
rename from .changelog/13371.txt
rename to .archive/changelog/13371.txt
diff --git a/.changelog/13392.txt b/.archive/changelog/13392.txt
similarity index 100%
rename from .changelog/13392.txt
rename to .archive/changelog/13392.txt
diff --git a/.changelog/13420.txt b/.archive/changelog/13420.txt
similarity index 100%
rename from .changelog/13420.txt
rename to .archive/changelog/13420.txt
diff --git a/.changelog/13453.txt b/.archive/changelog/13453.txt
similarity index 100%
rename from .changelog/13453.txt
rename to .archive/changelog/13453.txt
diff --git a/.changelog/13467.txt b/.archive/changelog/13467.txt
similarity index 100%
rename from .changelog/13467.txt
rename to .archive/changelog/13467.txt
diff --git a/.changelog/13474.txt b/.archive/changelog/13474.txt
similarity index 100%
rename from .changelog/13474.txt
rename to .archive/changelog/13474.txt
diff --git a/.changelog/13476.txt b/.archive/changelog/13476.txt
similarity index 100%
rename from .changelog/13476.txt
rename to .archive/changelog/13476.txt
diff --git a/.changelog/13477.txt b/.archive/changelog/13477.txt
similarity index 100%
rename from .changelog/13477.txt
rename to .archive/changelog/13477.txt
diff --git a/.changelog/13554.txt b/.archive/changelog/13554.txt
similarity index 100%
rename from .changelog/13554.txt
rename to .archive/changelog/13554.txt
diff --git a/.changelog/13564.txt b/.archive/changelog/13564.txt
similarity index 100%
rename from .changelog/13564.txt
rename to .archive/changelog/13564.txt
diff --git a/.changelog/13737.txt b/.archive/changelog/13737.txt
similarity index 100%
rename from .changelog/13737.txt
rename to .archive/changelog/13737.txt
diff --git a/.changelog/13783.txt b/.archive/changelog/13783.txt
similarity index 100%
rename from .changelog/13783.txt
rename to .archive/changelog/13783.txt
diff --git a/.changelog/13850.txt b/.archive/changelog/13850.txt
similarity index 100%
rename from .changelog/13850.txt
rename to .archive/changelog/13850.txt
diff --git a/.changelog/13883.txt b/.archive/changelog/13883.txt
similarity index 100%
rename from .changelog/13883.txt
rename to .archive/changelog/13883.txt
diff --git a/.changelog/13938.txt b/.archive/changelog/13938.txt
similarity index 100%
rename from .changelog/13938.txt
rename to .archive/changelog/13938.txt
diff --git a/.changelog/13944.txt b/.archive/changelog/13944.txt
similarity index 100%
rename from .changelog/13944.txt
rename to .archive/changelog/13944.txt
diff --git a/.changelog/13948.txt b/.archive/changelog/13948.txt
similarity index 100%
rename from .changelog/13948.txt
rename to .archive/changelog/13948.txt
diff --git a/.changelog/13949.txt b/.archive/changelog/13949.txt
similarity index 100%
rename from .changelog/13949.txt
rename to .archive/changelog/13949.txt
diff --git a/.changelog/13960.txt b/.archive/changelog/13960.txt
similarity index 100%
rename from .changelog/13960.txt
rename to .archive/changelog/13960.txt
diff --git a/.changelog/13962.txt b/.archive/changelog/13962.txt
similarity index 100%
rename from .changelog/13962.txt
rename to .archive/changelog/13962.txt
diff --git a/.changelog/13963.txt b/.archive/changelog/13963.txt
similarity index 100%
rename from .changelog/13963.txt
rename to .archive/changelog/13963.txt
diff --git a/.changelog/13964.txt b/.archive/changelog/13964.txt
similarity index 100%
rename from .changelog/13964.txt
rename to .archive/changelog/13964.txt
diff --git a/.changelog/13971.txt b/.archive/changelog/13971.txt
similarity index 100%
rename from .changelog/13971.txt
rename to .archive/changelog/13971.txt
diff --git a/.changelog/13972.txt b/.archive/changelog/13972.txt
similarity index 100%
rename from .changelog/13972.txt
rename to .archive/changelog/13972.txt
diff --git a/.changelog/13973.txt b/.archive/changelog/13973.txt
similarity index 100%
rename from .changelog/13973.txt
rename to .archive/changelog/13973.txt
diff --git a/.changelog/13974.txt b/.archive/changelog/13974.txt
similarity index 100%
rename from .changelog/13974.txt
rename to .archive/changelog/13974.txt
diff --git a/.changelog/14045.txt b/.archive/changelog/14045.txt
similarity index 100%
rename from .changelog/14045.txt
rename to .archive/changelog/14045.txt
diff --git a/.changelog/14075.txt b/.archive/changelog/14075.txt
similarity index 100%
rename from .changelog/14075.txt
rename to .archive/changelog/14075.txt
diff --git a/.changelog/14101.txt b/.archive/changelog/14101.txt
similarity index 100%
rename from .changelog/14101.txt
rename to .archive/changelog/14101.txt
diff --git a/.changelog/14123.txt b/.archive/changelog/14123.txt
similarity index 100%
rename from .changelog/14123.txt
rename to .archive/changelog/14123.txt
diff --git a/.changelog/14128.txt b/.archive/changelog/14128.txt
similarity index 100%
rename from .changelog/14128.txt
rename to .archive/changelog/14128.txt
diff --git a/.changelog/14193.txt b/.archive/changelog/14193.txt
similarity index 100%
rename from .changelog/14193.txt
rename to .archive/changelog/14193.txt
diff --git a/.changelog/14218.txt b/.archive/changelog/14218.txt
similarity index 100%
rename from .changelog/14218.txt
rename to .archive/changelog/14218.txt
diff --git a/.changelog/14247.txt b/.archive/changelog/14247.txt
similarity index 100%
rename from .changelog/14247.txt
rename to .archive/changelog/14247.txt
diff --git a/.changelog/14255.txt b/.archive/changelog/14255.txt
similarity index 100%
rename from .changelog/14255.txt
rename to .archive/changelog/14255.txt
diff --git a/.changelog/14319.txt b/.archive/changelog/14319.txt
similarity index 100%
rename from .changelog/14319.txt
rename to .archive/changelog/14319.txt
diff --git a/.changelog/14452.txt b/.archive/changelog/14452.txt
similarity index 100%
rename from .changelog/14452.txt
rename to .archive/changelog/14452.txt
diff --git a/.changelog/14462.txt b/.archive/changelog/14462.txt
similarity index 100%
rename from .changelog/14462.txt
rename to .archive/changelog/14462.txt
diff --git a/.changelog/14534.txt b/.archive/changelog/14534.txt
similarity index 100%
rename from .changelog/14534.txt
rename to .archive/changelog/14534.txt
diff --git a/.changelog/14578.txt b/.archive/changelog/14578.txt
similarity index 100%
rename from .changelog/14578.txt
rename to .archive/changelog/14578.txt
diff --git a/.changelog/14627.txt b/.archive/changelog/14627.txt
similarity index 100%
rename from .changelog/14627.txt
rename to .archive/changelog/14627.txt
diff --git a/.changelog/14671.txt b/.archive/changelog/14671.txt
similarity index 100%
rename from .changelog/14671.txt
rename to .archive/changelog/14671.txt
diff --git a/.changelog/14673.txt b/.archive/changelog/14673.txt
similarity index 100%
rename from .changelog/14673.txt
rename to .archive/changelog/14673.txt
diff --git a/.changelog/14710.txt b/.archive/changelog/14710.txt
similarity index 100%
rename from .changelog/14710.txt
rename to .archive/changelog/14710.txt
diff --git a/.changelog/14714.txt b/.archive/changelog/14714.txt
similarity index 100%
rename from .changelog/14714.txt
rename to .archive/changelog/14714.txt
diff --git a/.changelog/14746.txt b/.archive/changelog/14746.txt
similarity index 100%
rename from .changelog/14746.txt
rename to .archive/changelog/14746.txt
diff --git a/.changelog/14764.txt b/.archive/changelog/14764.txt
similarity index 100%
rename from .changelog/14764.txt
rename to .archive/changelog/14764.txt
diff --git a/.changelog/14765.txt b/.archive/changelog/14765.txt
similarity index 100%
rename from .changelog/14765.txt
rename to .archive/changelog/14765.txt
diff --git a/.changelog/14786.txt b/.archive/changelog/14786.txt
similarity index 100%
rename from .changelog/14786.txt
rename to .archive/changelog/14786.txt
diff --git a/.changelog/14905.txt b/.archive/changelog/14905.txt
similarity index 100%
rename from .changelog/14905.txt
rename to .archive/changelog/14905.txt
diff --git a/.changelog/14923.txt b/.archive/changelog/14923.txt
similarity index 100%
rename from .changelog/14923.txt
rename to .archive/changelog/14923.txt
diff --git a/.changelog/14935.txt b/.archive/changelog/14935.txt
similarity index 100%
rename from .changelog/14935.txt
rename to .archive/changelog/14935.txt
diff --git a/.changelog/14974.txt b/.archive/changelog/14974.txt
similarity index 100%
rename from .changelog/14974.txt
rename to .archive/changelog/14974.txt
diff --git a/.changelog/15011.txt b/.archive/changelog/15011.txt
similarity index 100%
rename from .changelog/15011.txt
rename to .archive/changelog/15011.txt
diff --git a/.changelog/15033.txt b/.archive/changelog/15033.txt
similarity index 100%
rename from .changelog/15033.txt
rename to .archive/changelog/15033.txt
diff --git a/.changelog/15038.txt b/.archive/changelog/15038.txt
similarity index 100%
rename from .changelog/15038.txt
rename to .archive/changelog/15038.txt
diff --git a/.changelog/15112.txt b/.archive/changelog/15112.txt
similarity index 100%
rename from .changelog/15112.txt
rename to .archive/changelog/15112.txt
diff --git a/.changelog/15167.txt b/.archive/changelog/15167.txt
similarity index 100%
rename from .changelog/15167.txt
rename to .archive/changelog/15167.txt
diff --git a/.changelog/15213.txt b/.archive/changelog/15213.txt
similarity index 100%
rename from .changelog/15213.txt
rename to .archive/changelog/15213.txt
diff --git a/.changelog/15241.txt b/.archive/changelog/15241.txt
similarity index 100%
rename from .changelog/15241.txt
rename to .archive/changelog/15241.txt
diff --git a/.changelog/15348.txt b/.archive/changelog/15348.txt
similarity index 100%
rename from .changelog/15348.txt
rename to .archive/changelog/15348.txt
diff --git a/.changelog/15355.txt b/.archive/changelog/15355.txt
similarity index 100%
rename from .changelog/15355.txt
rename to .archive/changelog/15355.txt
diff --git a/.changelog/15360.txt b/.archive/changelog/15360.txt
similarity index 100%
rename from .changelog/15360.txt
rename to .archive/changelog/15360.txt
diff --git a/.changelog/15375.txt b/.archive/changelog/15375.txt
similarity index 100%
rename from .changelog/15375.txt
rename to .archive/changelog/15375.txt
diff --git a/.changelog/15387.txt b/.archive/changelog/15387.txt
similarity index 100%
rename from .changelog/15387.txt
rename to .archive/changelog/15387.txt
diff --git a/.changelog/15406.txt b/.archive/changelog/15406.txt
similarity index 100%
rename from .changelog/15406.txt
rename to .archive/changelog/15406.txt
diff --git a/.changelog/15434.txt b/.archive/changelog/15434.txt
similarity index 100%
rename from .changelog/15434.txt
rename to .archive/changelog/15434.txt
diff --git a/.changelog/15442.txt b/.archive/changelog/15442.txt
similarity index 100%
rename from .changelog/15442.txt
rename to .archive/changelog/15442.txt
diff --git a/.changelog/15461.txt b/.archive/changelog/15461.txt
similarity index 100%
rename from .changelog/15461.txt
rename to .archive/changelog/15461.txt
diff --git a/.changelog/15463.txt b/.archive/changelog/15463.txt
similarity index 100%
rename from .changelog/15463.txt
rename to .archive/changelog/15463.txt
diff --git a/.changelog/15661.txt b/.archive/changelog/15661.txt
similarity index 100%
rename from .changelog/15661.txt
rename to .archive/changelog/15661.txt
diff --git a/.changelog/15785.txt b/.archive/changelog/15785.txt
similarity index 100%
rename from .changelog/15785.txt
rename to .archive/changelog/15785.txt
diff --git a/.changelog/15806.txt b/.archive/changelog/15806.txt
similarity index 100%
rename from .changelog/15806.txt
rename to .archive/changelog/15806.txt
diff --git a/.changelog/15828.txt b/.archive/changelog/15828.txt
similarity index 100%
rename from .changelog/15828.txt
rename to .archive/changelog/15828.txt
diff --git a/.changelog/15829.txt b/.archive/changelog/15829.txt
similarity index 100%
rename from .changelog/15829.txt
rename to .archive/changelog/15829.txt
diff --git a/.changelog/15885.txt b/.archive/changelog/15885.txt
similarity index 100%
rename from .changelog/15885.txt
rename to .archive/changelog/15885.txt
diff --git a/.changelog/15966.txt b/.archive/changelog/15966.txt
similarity index 100%
rename from .changelog/15966.txt
rename to .archive/changelog/15966.txt
diff --git a/.changelog/16010.txt b/.archive/changelog/16010.txt
similarity index 100%
rename from .changelog/16010.txt
rename to .archive/changelog/16010.txt
diff --git a/.changelog/16049.txt b/.archive/changelog/16049.txt
similarity index 100%
rename from .changelog/16049.txt
rename to .archive/changelog/16049.txt
diff --git a/.changelog/16087.txt b/.archive/changelog/16087.txt
similarity index 100%
rename from .changelog/16087.txt
rename to .archive/changelog/16087.txt
diff --git a/.changelog/16108.txt b/.archive/changelog/16108.txt
similarity index 100%
rename from .changelog/16108.txt
rename to .archive/changelog/16108.txt
diff --git a/.changelog/16113.txt b/.archive/changelog/16113.txt
similarity index 100%
rename from .changelog/16113.txt
rename to .archive/changelog/16113.txt
diff --git a/.changelog/16120.txt b/.archive/changelog/16120.txt
similarity index 100%
rename from .changelog/16120.txt
rename to .archive/changelog/16120.txt
diff --git a/.changelog/16185.txt b/.archive/changelog/16185.txt
similarity index 100%
rename from .changelog/16185.txt
rename to .archive/changelog/16185.txt
diff --git a/.changelog/16188.txt b/.archive/changelog/16188.txt
similarity index 100%
rename from .changelog/16188.txt
rename to .archive/changelog/16188.txt
diff --git a/.changelog/16192.txt b/.archive/changelog/16192.txt
similarity index 100%
rename from .changelog/16192.txt
rename to .archive/changelog/16192.txt
diff --git a/.changelog/16203.txt b/.archive/changelog/16203.txt
similarity index 100%
rename from .changelog/16203.txt
rename to .archive/changelog/16203.txt
diff --git a/.changelog/16204.txt b/.archive/changelog/16204.txt
similarity index 100%
rename from .changelog/16204.txt
rename to .archive/changelog/16204.txt
diff --git a/.changelog/16207.txt b/.archive/changelog/16207.txt
similarity index 100%
rename from .changelog/16207.txt
rename to .archive/changelog/16207.txt
diff --git a/.changelog/16325.txt b/.archive/changelog/16325.txt
similarity index 100%
rename from .changelog/16325.txt
rename to .archive/changelog/16325.txt
diff --git a/.changelog/16373.txt b/.archive/changelog/16373.txt
similarity index 100%
rename from .changelog/16373.txt
rename to .archive/changelog/16373.txt
diff --git a/.changelog/16386.txt b/.archive/changelog/16386.txt
similarity index 100%
rename from .changelog/16386.txt
rename to .archive/changelog/16386.txt
diff --git a/.changelog/16393.txt b/.archive/changelog/16393.txt
similarity index 100%
rename from .changelog/16393.txt
rename to .archive/changelog/16393.txt
diff --git a/.changelog/16471.txt b/.archive/changelog/16471.txt
similarity index 100%
rename from .changelog/16471.txt
rename to .archive/changelog/16471.txt
diff --git a/.changelog/16474.txt b/.archive/changelog/16474.txt
similarity index 100%
rename from .changelog/16474.txt
rename to .archive/changelog/16474.txt
diff --git a/.changelog/16489.txt b/.archive/changelog/16489.txt
similarity index 100%
rename from .changelog/16489.txt
rename to .archive/changelog/16489.txt
diff --git a/.changelog/16502.txt b/.archive/changelog/16502.txt
similarity index 100%
rename from .changelog/16502.txt
rename to .archive/changelog/16502.txt
diff --git a/.changelog/16504.txt b/.archive/changelog/16504.txt
similarity index 100%
rename from .changelog/16504.txt
rename to .archive/changelog/16504.txt
diff --git a/.changelog/16581.txt b/.archive/changelog/16581.txt
similarity index 100%
rename from .changelog/16581.txt
rename to .archive/changelog/16581.txt
diff --git a/.changelog/16616.txt b/.archive/changelog/16616.txt
similarity index 100%
rename from .changelog/16616.txt
rename to .archive/changelog/16616.txt
diff --git a/.changelog/16618.txt b/.archive/changelog/16618.txt
similarity index 100%
rename from .changelog/16618.txt
rename to .archive/changelog/16618.txt
diff --git a/.changelog/16629.txt b/.archive/changelog/16629.txt
similarity index 100%
rename from .changelog/16629.txt
rename to .archive/changelog/16629.txt
diff --git a/.changelog/16640.txt b/.archive/changelog/16640.txt
similarity index 100%
rename from .changelog/16640.txt
rename to .archive/changelog/16640.txt
diff --git a/.changelog/16656.txt b/.archive/changelog/16656.txt
similarity index 100%
rename from .changelog/16656.txt
rename to .archive/changelog/16656.txt
diff --git a/.changelog/16676.txt b/.archive/changelog/16676.txt
similarity index 100%
rename from .changelog/16676.txt
rename to .archive/changelog/16676.txt
diff --git a/.changelog/16704.txt b/.archive/changelog/16704.txt
similarity index 100%
rename from .changelog/16704.txt
rename to .archive/changelog/16704.txt
diff --git a/.changelog/16709.txt b/.archive/changelog/16709.txt
similarity index 100%
rename from .changelog/16709.txt
rename to .archive/changelog/16709.txt
diff --git a/.changelog/16710.txt b/.archive/changelog/16710.txt
similarity index 100%
rename from .changelog/16710.txt
rename to .archive/changelog/16710.txt
diff --git a/.changelog/16734.txt b/.archive/changelog/16734.txt
similarity index 100%
rename from .changelog/16734.txt
rename to .archive/changelog/16734.txt
diff --git a/.changelog/16743.txt b/.archive/changelog/16743.txt
similarity index 100%
rename from .changelog/16743.txt
rename to .archive/changelog/16743.txt
diff --git a/.changelog/16815.txt b/.archive/changelog/16815.txt
similarity index 100%
rename from .changelog/16815.txt
rename to .archive/changelog/16815.txt
diff --git a/.changelog/16819.txt b/.archive/changelog/16819.txt
similarity index 100%
rename from .changelog/16819.txt
rename to .archive/changelog/16819.txt
diff --git a/.changelog/16823.txt b/.archive/changelog/16823.txt
similarity index 100%
rename from .changelog/16823.txt
rename to .archive/changelog/16823.txt
diff --git a/.changelog/16831.txt b/.archive/changelog/16831.txt
similarity index 100%
rename from .changelog/16831.txt
rename to .archive/changelog/16831.txt
diff --git a/.changelog/16835.txt b/.archive/changelog/16835.txt
similarity index 100%
rename from .changelog/16835.txt
rename to .archive/changelog/16835.txt
diff --git a/.changelog/16840.txt b/.archive/changelog/16840.txt
similarity index 100%
rename from .changelog/16840.txt
rename to .archive/changelog/16840.txt
diff --git a/.changelog/16850.txt b/.archive/changelog/16850.txt
similarity index 100%
rename from .changelog/16850.txt
rename to .archive/changelog/16850.txt
diff --git a/.changelog/16853.txt b/.archive/changelog/16853.txt
similarity index 100%
rename from .changelog/16853.txt
rename to .archive/changelog/16853.txt
diff --git a/.changelog/16854.txt b/.archive/changelog/16854.txt
similarity index 100%
rename from .changelog/16854.txt
rename to .archive/changelog/16854.txt
diff --git a/.changelog/16865.txt b/.archive/changelog/16865.txt
similarity index 100%
rename from .changelog/16865.txt
rename to .archive/changelog/16865.txt
diff --git a/.changelog/16874.txt b/.archive/changelog/16874.txt
similarity index 100%
rename from .changelog/16874.txt
rename to .archive/changelog/16874.txt
diff --git a/.changelog/16882.txt b/.archive/changelog/16882.txt
similarity index 100%
rename from .changelog/16882.txt
rename to .archive/changelog/16882.txt
diff --git a/.changelog/16901.txt b/.archive/changelog/16901.txt
similarity index 100%
rename from .changelog/16901.txt
rename to .archive/changelog/16901.txt
diff --git a/.changelog/16908.txt b/.archive/changelog/16908.txt
similarity index 100%
rename from .changelog/16908.txt
rename to .archive/changelog/16908.txt
diff --git a/.changelog/16916.txt b/.archive/changelog/16916.txt
similarity index 100%
rename from .changelog/16916.txt
rename to .archive/changelog/16916.txt
diff --git a/.changelog/16918.txt b/.archive/changelog/16918.txt
similarity index 100%
rename from .changelog/16918.txt
rename to .archive/changelog/16918.txt
diff --git a/.changelog/16930.txt b/.archive/changelog/16930.txt
similarity index 100%
rename from .changelog/16930.txt
rename to .archive/changelog/16930.txt
diff --git a/.changelog/16936.txt b/.archive/changelog/16936.txt
similarity index 100%
rename from .changelog/16936.txt
rename to .archive/changelog/16936.txt
diff --git a/.changelog/16941.txt b/.archive/changelog/16941.txt
similarity index 100%
rename from .changelog/16941.txt
rename to .archive/changelog/16941.txt
diff --git a/.changelog/16942.txt b/.archive/changelog/16942.txt
similarity index 100%
rename from .changelog/16942.txt
rename to .archive/changelog/16942.txt
diff --git a/.changelog/16961.txt b/.archive/changelog/16961.txt
similarity index 100%
rename from .changelog/16961.txt
rename to .archive/changelog/16961.txt
diff --git a/.changelog/16963.txt b/.archive/changelog/16963.txt
similarity index 100%
rename from .changelog/16963.txt
rename to .archive/changelog/16963.txt
diff --git a/.changelog/16972.txt b/.archive/changelog/16972.txt
similarity index 100%
rename from .changelog/16972.txt
rename to .archive/changelog/16972.txt
diff --git a/.changelog/16979.txt b/.archive/changelog/16979.txt
similarity index 100%
rename from .changelog/16979.txt
rename to .archive/changelog/16979.txt
diff --git a/.changelog/17001.txt b/.archive/changelog/17001.txt
similarity index 100%
rename from .changelog/17001.txt
rename to .archive/changelog/17001.txt
diff --git a/.changelog/17002.txt b/.archive/changelog/17002.txt
similarity index 100%
rename from .changelog/17002.txt
rename to .archive/changelog/17002.txt
diff --git a/.changelog/17030.txt b/.archive/changelog/17030.txt
similarity index 100%
rename from .changelog/17030.txt
rename to .archive/changelog/17030.txt
diff --git a/.changelog/17031.txt b/.archive/changelog/17031.txt
similarity index 100%
rename from .changelog/17031.txt
rename to .archive/changelog/17031.txt
diff --git a/.changelog/17032.txt b/.archive/changelog/17032.txt
similarity index 100%
rename from .changelog/17032.txt
rename to .archive/changelog/17032.txt
diff --git a/.changelog/17039.txt b/.archive/changelog/17039.txt
similarity index 100%
rename from .changelog/17039.txt
rename to .archive/changelog/17039.txt
diff --git a/.changelog/17040.txt b/.archive/changelog/17040.txt
similarity index 100%
rename from .changelog/17040.txt
rename to .archive/changelog/17040.txt
diff --git a/.changelog/17041.txt b/.archive/changelog/17041.txt
similarity index 100%
rename from .changelog/17041.txt
rename to .archive/changelog/17041.txt
diff --git a/.changelog/17044.txt b/.archive/changelog/17044.txt
similarity index 100%
rename from .changelog/17044.txt
rename to .archive/changelog/17044.txt
diff --git a/.changelog/17046.txt b/.archive/changelog/17046.txt
similarity index 100%
rename from .changelog/17046.txt
rename to .archive/changelog/17046.txt
diff --git a/.changelog/17082.txt b/.archive/changelog/17082.txt
similarity index 100%
rename from .changelog/17082.txt
rename to .archive/changelog/17082.txt
diff --git a/.changelog/17111.txt b/.archive/changelog/17111.txt
similarity index 100%
rename from .changelog/17111.txt
rename to .archive/changelog/17111.txt
diff --git a/.changelog/17129.txt b/.archive/changelog/17129.txt
similarity index 100%
rename from .changelog/17129.txt
rename to .archive/changelog/17129.txt
diff --git a/.changelog/17134.txt b/.archive/changelog/17134.txt
similarity index 100%
rename from .changelog/17134.txt
rename to .archive/changelog/17134.txt
diff --git a/.changelog/17142.txt b/.archive/changelog/17142.txt
similarity index 100%
rename from .changelog/17142.txt
rename to .archive/changelog/17142.txt
diff --git a/.changelog/17149.txt b/.archive/changelog/17149.txt
similarity index 100%
rename from .changelog/17149.txt
rename to .archive/changelog/17149.txt
diff --git a/.changelog/17151.txt b/.archive/changelog/17151.txt
similarity index 100%
rename from .changelog/17151.txt
rename to .archive/changelog/17151.txt
diff --git a/.changelog/17156.txt b/.archive/changelog/17156.txt
similarity index 100%
rename from .changelog/17156.txt
rename to .archive/changelog/17156.txt
diff --git a/.changelog/17160.txt b/.archive/changelog/17160.txt
similarity index 100%
rename from .changelog/17160.txt
rename to .archive/changelog/17160.txt
diff --git a/.changelog/17163.txt b/.archive/changelog/17163.txt
similarity index 100%
rename from .changelog/17163.txt
rename to .archive/changelog/17163.txt
diff --git a/.changelog/17164.txt b/.archive/changelog/17164.txt
similarity index 100%
rename from .changelog/17164.txt
rename to .archive/changelog/17164.txt
diff --git a/.changelog/17189.txt b/.archive/changelog/17189.txt
similarity index 100%
rename from .changelog/17189.txt
rename to .archive/changelog/17189.txt
diff --git a/.changelog/17201.txt b/.archive/changelog/17201.txt
similarity index 100%
rename from .changelog/17201.txt
rename to .archive/changelog/17201.txt
diff --git a/.changelog/17203.txt b/.archive/changelog/17203.txt
similarity index 100%
rename from .changelog/17203.txt
rename to .archive/changelog/17203.txt
diff --git a/.changelog/17204.txt b/.archive/changelog/17204.txt
similarity index 100%
rename from .changelog/17204.txt
rename to .archive/changelog/17204.txt
diff --git a/.changelog/17219.txt b/.archive/changelog/17219.txt
similarity index 100%
rename from .changelog/17219.txt
rename to .archive/changelog/17219.txt
diff --git a/.changelog/17221.txt b/.archive/changelog/17221.txt
similarity index 100%
rename from .changelog/17221.txt
rename to .archive/changelog/17221.txt
diff --git a/.changelog/17226.txt b/.archive/changelog/17226.txt
similarity index 100%
rename from .changelog/17226.txt
rename to .archive/changelog/17226.txt
diff --git a/.changelog/17234.txt b/.archive/changelog/17234.txt
similarity index 100%
rename from .changelog/17234.txt
rename to .archive/changelog/17234.txt
diff --git a/.changelog/17236.txt b/.archive/changelog/17236.txt
similarity index 100%
rename from .changelog/17236.txt
rename to .archive/changelog/17236.txt
diff --git a/.changelog/17238.txt b/.archive/changelog/17238.txt
similarity index 100%
rename from .changelog/17238.txt
rename to .archive/changelog/17238.txt
diff --git a/.changelog/17241.txt b/.archive/changelog/17241.txt
similarity index 100%
rename from .changelog/17241.txt
rename to .archive/changelog/17241.txt
diff --git a/.changelog/17243.txt b/.archive/changelog/17243.txt
similarity index 100%
rename from .changelog/17243.txt
rename to .archive/changelog/17243.txt
diff --git a/.changelog/17251.txt b/.archive/changelog/17251.txt
similarity index 100%
rename from .changelog/17251.txt
rename to .archive/changelog/17251.txt
diff --git a/.changelog/17254.txt b/.archive/changelog/17254.txt
similarity index 100%
rename from .changelog/17254.txt
rename to .archive/changelog/17254.txt
diff --git a/.changelog/17256.txt b/.archive/changelog/17256.txt
similarity index 100%
rename from .changelog/17256.txt
rename to .archive/changelog/17256.txt
diff --git a/.changelog/17262.txt b/.archive/changelog/17262.txt
similarity index 100%
rename from .changelog/17262.txt
rename to .archive/changelog/17262.txt
diff --git a/.changelog/17268.txt b/.archive/changelog/17268.txt
similarity index 100%
rename from .changelog/17268.txt
rename to .archive/changelog/17268.txt
diff --git a/.changelog/17270.txt b/.archive/changelog/17270.txt
similarity index 100%
rename from .changelog/17270.txt
rename to .archive/changelog/17270.txt
diff --git a/.changelog/17286.txt b/.archive/changelog/17286.txt
similarity index 100%
rename from .changelog/17286.txt
rename to .archive/changelog/17286.txt
diff --git a/.changelog/17291.txt b/.archive/changelog/17291.txt
similarity index 100%
rename from .changelog/17291.txt
rename to .archive/changelog/17291.txt
diff --git a/.changelog/17295.txt b/.archive/changelog/17295.txt
similarity index 100%
rename from .changelog/17295.txt
rename to .archive/changelog/17295.txt
diff --git a/.changelog/17298.txt b/.archive/changelog/17298.txt
similarity index 100%
rename from .changelog/17298.txt
rename to .archive/changelog/17298.txt
diff --git a/.changelog/17301.txt b/.archive/changelog/17301.txt
similarity index 100%
rename from .changelog/17301.txt
rename to .archive/changelog/17301.txt
diff --git a/.changelog/17313.txt b/.archive/changelog/17313.txt
similarity index 100%
rename from .changelog/17313.txt
rename to .archive/changelog/17313.txt
diff --git a/.changelog/17318.txt b/.archive/changelog/17318.txt
similarity index 100%
rename from .changelog/17318.txt
rename to .archive/changelog/17318.txt
diff --git a/.changelog/17319.txt b/.archive/changelog/17319.txt
similarity index 100%
rename from .changelog/17319.txt
rename to .archive/changelog/17319.txt
diff --git a/.changelog/17320.txt b/.archive/changelog/17320.txt
similarity index 100%
rename from .changelog/17320.txt
rename to .archive/changelog/17320.txt
diff --git a/.changelog/17321.txt b/.archive/changelog/17321.txt
similarity index 100%
rename from .changelog/17321.txt
rename to .archive/changelog/17321.txt
diff --git a/.changelog/17322.txt b/.archive/changelog/17322.txt
similarity index 100%
rename from .changelog/17322.txt
rename to .archive/changelog/17322.txt
diff --git a/.changelog/17335.txt b/.archive/changelog/17335.txt
similarity index 100%
rename from .changelog/17335.txt
rename to .archive/changelog/17335.txt
diff --git a/.changelog/17336.txt b/.archive/changelog/17336.txt
similarity index 100%
rename from .changelog/17336.txt
rename to .archive/changelog/17336.txt
diff --git a/.changelog/17338.txt b/.archive/changelog/17338.txt
similarity index 100%
rename from .changelog/17338.txt
rename to .archive/changelog/17338.txt
diff --git a/.changelog/17340.txt b/.archive/changelog/17340.txt
similarity index 100%
rename from .changelog/17340.txt
rename to .archive/changelog/17340.txt
diff --git a/.changelog/17344.txt b/.archive/changelog/17344.txt
similarity index 100%
rename from .changelog/17344.txt
rename to .archive/changelog/17344.txt
diff --git a/.changelog/17347.txt b/.archive/changelog/17347.txt
similarity index 100%
rename from .changelog/17347.txt
rename to .archive/changelog/17347.txt
diff --git a/.changelog/17366.txt b/.archive/changelog/17366.txt
similarity index 100%
rename from .changelog/17366.txt
rename to .archive/changelog/17366.txt
diff --git a/.changelog/17380.txt b/.archive/changelog/17380.txt
similarity index 100%
rename from .changelog/17380.txt
rename to .archive/changelog/17380.txt
diff --git a/.changelog/17382.txt b/.archive/changelog/17382.txt
similarity index 100%
rename from .changelog/17382.txt
rename to .archive/changelog/17382.txt
diff --git a/.changelog/17387.txt b/.archive/changelog/17387.txt
similarity index 100%
rename from .changelog/17387.txt
rename to .archive/changelog/17387.txt
diff --git a/.changelog/17418.txt b/.archive/changelog/17418.txt
similarity index 100%
rename from .changelog/17418.txt
rename to .archive/changelog/17418.txt
diff --git a/.changelog/17423.txt b/.archive/changelog/17423.txt
similarity index 100%
rename from .changelog/17423.txt
rename to .archive/changelog/17423.txt
diff --git a/.changelog/17447.txt b/.archive/changelog/17447.txt
similarity index 100%
rename from .changelog/17447.txt
rename to .archive/changelog/17447.txt
diff --git a/.changelog/17465.txt b/.archive/changelog/17465.txt
similarity index 100%
rename from .changelog/17465.txt
rename to .archive/changelog/17465.txt
diff --git a/.changelog/17469.txt b/.archive/changelog/17469.txt
similarity index 100%
rename from .changelog/17469.txt
rename to .archive/changelog/17469.txt
diff --git a/.changelog/17474.txt b/.archive/changelog/17474.txt
similarity index 100%
rename from .changelog/17474.txt
rename to .archive/changelog/17474.txt
diff --git a/.changelog/17486.txt b/.archive/changelog/17486.txt
similarity index 100%
rename from .changelog/17486.txt
rename to .archive/changelog/17486.txt
diff --git a/.changelog/17488.txt b/.archive/changelog/17488.txt
similarity index 100%
rename from .changelog/17488.txt
rename to .archive/changelog/17488.txt
diff --git a/.changelog/17489.txt b/.archive/changelog/17489.txt
similarity index 100%
rename from .changelog/17489.txt
rename to .archive/changelog/17489.txt
diff --git a/.changelog/17498.txt b/.archive/changelog/17498.txt
similarity index 100%
rename from .changelog/17498.txt
rename to .archive/changelog/17498.txt
diff --git a/.changelog/17501.txt b/.archive/changelog/17501.txt
similarity index 100%
rename from .changelog/17501.txt
rename to .archive/changelog/17501.txt
diff --git a/.changelog/17534.txt b/.archive/changelog/17534.txt
similarity index 100%
rename from .changelog/17534.txt
rename to .archive/changelog/17534.txt
diff --git a/.changelog/17539.txt b/.archive/changelog/17539.txt
similarity index 100%
rename from .changelog/17539.txt
rename to .archive/changelog/17539.txt
diff --git a/.changelog/17545.txt b/.archive/changelog/17545.txt
similarity index 100%
rename from .changelog/17545.txt
rename to .archive/changelog/17545.txt
diff --git a/.changelog/17571.txt b/.archive/changelog/17571.txt
similarity index 100%
rename from .changelog/17571.txt
rename to .archive/changelog/17571.txt
diff --git a/.changelog/17573.txt b/.archive/changelog/17573.txt
similarity index 100%
rename from .changelog/17573.txt
rename to .archive/changelog/17573.txt
diff --git a/.changelog/17579.txt b/.archive/changelog/17579.txt
similarity index 100%
rename from .changelog/17579.txt
rename to .archive/changelog/17579.txt
diff --git a/.changelog/17582.txt b/.archive/changelog/17582.txt
similarity index 100%
rename from .changelog/17582.txt
rename to .archive/changelog/17582.txt
diff --git a/.changelog/17585.txt b/.archive/changelog/17585.txt
similarity index 100%
rename from .changelog/17585.txt
rename to .archive/changelog/17585.txt
diff --git a/.changelog/17589.txt b/.archive/changelog/17589.txt
similarity index 100%
rename from .changelog/17589.txt
rename to .archive/changelog/17589.txt
diff --git a/.changelog/17591.txt b/.archive/changelog/17591.txt
similarity index 100%
rename from .changelog/17591.txt
rename to .archive/changelog/17591.txt
diff --git a/.changelog/17595.txt b/.archive/changelog/17595.txt
similarity index 100%
rename from .changelog/17595.txt
rename to .archive/changelog/17595.txt
diff --git a/.changelog/17596.txt b/.archive/changelog/17596.txt
similarity index 100%
rename from .changelog/17596.txt
rename to .archive/changelog/17596.txt
diff --git a/.changelog/17608.txt b/.archive/changelog/17608.txt
similarity index 100%
rename from .changelog/17608.txt
rename to .archive/changelog/17608.txt
diff --git a/.changelog/17610.txt b/.archive/changelog/17610.txt
similarity index 100%
rename from .changelog/17610.txt
rename to .archive/changelog/17610.txt
diff --git a/.changelog/17611.txt b/.archive/changelog/17611.txt
similarity index 100%
rename from .changelog/17611.txt
rename to .archive/changelog/17611.txt
diff --git a/.changelog/17612.txt b/.archive/changelog/17612.txt
similarity index 100%
rename from .changelog/17612.txt
rename to .archive/changelog/17612.txt
diff --git a/.changelog/17621.txt b/.archive/changelog/17621.txt
similarity index 100%
rename from .changelog/17621.txt
rename to .archive/changelog/17621.txt
diff --git a/.changelog/17627.txt b/.archive/changelog/17627.txt
similarity index 100%
rename from .changelog/17627.txt
rename to .archive/changelog/17627.txt
diff --git a/.changelog/17641.txt b/.archive/changelog/17641.txt
similarity index 100%
rename from .changelog/17641.txt
rename to .archive/changelog/17641.txt
diff --git a/.changelog/17645.txt b/.archive/changelog/17645.txt
similarity index 100%
rename from .changelog/17645.txt
rename to .archive/changelog/17645.txt
diff --git a/.changelog/17646.txt b/.archive/changelog/17646.txt
similarity index 100%
rename from .changelog/17646.txt
rename to .archive/changelog/17646.txt
diff --git a/.changelog/17654.txt b/.archive/changelog/17654.txt
similarity index 100%
rename from .changelog/17654.txt
rename to .archive/changelog/17654.txt
diff --git a/.changelog/17655.txt b/.archive/changelog/17655.txt
similarity index 100%
rename from .changelog/17655.txt
rename to .archive/changelog/17655.txt
diff --git a/.changelog/17657.txt b/.archive/changelog/17657.txt
similarity index 100%
rename from .changelog/17657.txt
rename to .archive/changelog/17657.txt
diff --git a/.changelog/17689.txt b/.archive/changelog/17689.txt
similarity index 100%
rename from .changelog/17689.txt
rename to .archive/changelog/17689.txt
diff --git a/.changelog/17692.txt b/.archive/changelog/17692.txt
similarity index 100%
rename from .changelog/17692.txt
rename to .archive/changelog/17692.txt
diff --git a/.changelog/17695.txt b/.archive/changelog/17695.txt
similarity index 100%
rename from .changelog/17695.txt
rename to .archive/changelog/17695.txt
diff --git a/.changelog/17702.txt b/.archive/changelog/17702.txt
similarity index 100%
rename from .changelog/17702.txt
rename to .archive/changelog/17702.txt
diff --git a/.changelog/17704.txt b/.archive/changelog/17704.txt
similarity index 100%
rename from .changelog/17704.txt
rename to .archive/changelog/17704.txt
diff --git a/.changelog/17706.txt b/.archive/changelog/17706.txt
similarity index 100%
rename from .changelog/17706.txt
rename to .archive/changelog/17706.txt
diff --git a/.changelog/17723.txt b/.archive/changelog/17723.txt
similarity index 100%
rename from .changelog/17723.txt
rename to .archive/changelog/17723.txt
diff --git a/.changelog/17725.txt b/.archive/changelog/17725.txt
similarity index 100%
rename from .changelog/17725.txt
rename to .archive/changelog/17725.txt
diff --git a/.changelog/17726.txt b/.archive/changelog/17726.txt
similarity index 100%
rename from .changelog/17726.txt
rename to .archive/changelog/17726.txt
diff --git a/.changelog/17727.txt b/.archive/changelog/17727.txt
similarity index 100%
rename from .changelog/17727.txt
rename to .archive/changelog/17727.txt
diff --git a/.changelog/17731.txt b/.archive/changelog/17731.txt
similarity index 100%
rename from .changelog/17731.txt
rename to .archive/changelog/17731.txt
diff --git a/.changelog/17732.txt b/.archive/changelog/17732.txt
similarity index 100%
rename from .changelog/17732.txt
rename to .archive/changelog/17732.txt
diff --git a/.changelog/17733.txt b/.archive/changelog/17733.txt
similarity index 100%
rename from .changelog/17733.txt
rename to .archive/changelog/17733.txt
diff --git a/.changelog/17734.txt b/.archive/changelog/17734.txt
similarity index 100%
rename from .changelog/17734.txt
rename to .archive/changelog/17734.txt
diff --git a/.changelog/17735.txt b/.archive/changelog/17735.txt
similarity index 100%
rename from .changelog/17735.txt
rename to .archive/changelog/17735.txt
diff --git a/.changelog/17738.txt b/.archive/changelog/17738.txt
similarity index 100%
rename from .changelog/17738.txt
rename to .archive/changelog/17738.txt
diff --git a/.changelog/17739.txt b/.archive/changelog/17739.txt
similarity index 100%
rename from .changelog/17739.txt
rename to .archive/changelog/17739.txt
diff --git a/.changelog/17752.txt b/.archive/changelog/17752.txt
similarity index 100%
rename from .changelog/17752.txt
rename to .archive/changelog/17752.txt
diff --git a/.changelog/17754.txt b/.archive/changelog/17754.txt
similarity index 100%
rename from .changelog/17754.txt
rename to .archive/changelog/17754.txt
diff --git a/.changelog/17755.txt b/.archive/changelog/17755.txt
similarity index 100%
rename from .changelog/17755.txt
rename to .archive/changelog/17755.txt
diff --git a/.changelog/17764.txt b/.archive/changelog/17764.txt
similarity index 100%
rename from .changelog/17764.txt
rename to .archive/changelog/17764.txt
diff --git a/.changelog/17784.txt b/.archive/changelog/17784.txt
similarity index 100%
rename from .changelog/17784.txt
rename to .archive/changelog/17784.txt
diff --git a/.changelog/17801.txt b/.archive/changelog/17801.txt
similarity index 100%
rename from .changelog/17801.txt
rename to .archive/changelog/17801.txt
diff --git a/.changelog/17804.txt b/.archive/changelog/17804.txt
similarity index 100%
rename from .changelog/17804.txt
rename to .archive/changelog/17804.txt
diff --git a/.changelog/17830.txt b/.archive/changelog/17830.txt
similarity index 100%
rename from .changelog/17830.txt
rename to .archive/changelog/17830.txt
diff --git a/.changelog/17836.txt b/.archive/changelog/17836.txt
similarity index 100%
rename from .changelog/17836.txt
rename to .archive/changelog/17836.txt
diff --git a/.changelog/17845.txt b/.archive/changelog/17845.txt
similarity index 100%
rename from .changelog/17845.txt
rename to .archive/changelog/17845.txt
diff --git a/.changelog/17846.txt b/.archive/changelog/17846.txt
similarity index 100%
rename from .changelog/17846.txt
rename to .archive/changelog/17846.txt
diff --git a/.changelog/17850.txt b/.archive/changelog/17850.txt
similarity index 100%
rename from .changelog/17850.txt
rename to .archive/changelog/17850.txt
diff --git a/.changelog/17852.txt b/.archive/changelog/17852.txt
similarity index 100%
rename from .changelog/17852.txt
rename to .archive/changelog/17852.txt
diff --git a/.changelog/17859.txt b/.archive/changelog/17859.txt
similarity index 100%
rename from .changelog/17859.txt
rename to .archive/changelog/17859.txt
diff --git a/.changelog/17864.txt b/.archive/changelog/17864.txt
similarity index 100%
rename from .changelog/17864.txt
rename to .archive/changelog/17864.txt
diff --git a/.changelog/17869.txt b/.archive/changelog/17869.txt
similarity index 100%
rename from .changelog/17869.txt
rename to .archive/changelog/17869.txt
diff --git a/.changelog/17872.txt b/.archive/changelog/17872.txt
similarity index 100%
rename from .changelog/17872.txt
rename to .archive/changelog/17872.txt
diff --git a/.changelog/17876.txt b/.archive/changelog/17876.txt
similarity index 100%
rename from .changelog/17876.txt
rename to .archive/changelog/17876.txt
diff --git a/.changelog/17880.txt b/.archive/changelog/17880.txt
similarity index 100%
rename from .changelog/17880.txt
rename to .archive/changelog/17880.txt
diff --git a/.changelog/17885.txt b/.archive/changelog/17885.txt
similarity index 100%
rename from .changelog/17885.txt
rename to .archive/changelog/17885.txt
diff --git a/.changelog/17897.txt b/.archive/changelog/17897.txt
similarity index 100%
rename from .changelog/17897.txt
rename to .archive/changelog/17897.txt
diff --git a/.changelog/17899.txt b/.archive/changelog/17899.txt
similarity index 100%
rename from .changelog/17899.txt
rename to .archive/changelog/17899.txt
diff --git a/.changelog/17901.txt b/.archive/changelog/17901.txt
similarity index 100%
rename from .changelog/17901.txt
rename to .archive/changelog/17901.txt
diff --git a/.changelog/17909.txt b/.archive/changelog/17909.txt
similarity index 100%
rename from .changelog/17909.txt
rename to .archive/changelog/17909.txt
diff --git a/.changelog/17933.txt b/.archive/changelog/17933.txt
similarity index 100%
rename from .changelog/17933.txt
rename to .archive/changelog/17933.txt
diff --git a/.changelog/17934.txt b/.archive/changelog/17934.txt
similarity index 100%
rename from .changelog/17934.txt
rename to .archive/changelog/17934.txt
diff --git a/.changelog/17958.txt b/.archive/changelog/17958.txt
similarity index 100%
rename from .changelog/17958.txt
rename to .archive/changelog/17958.txt
diff --git a/.changelog/17959.txt b/.archive/changelog/17959.txt
similarity index 100%
rename from .changelog/17959.txt
rename to .archive/changelog/17959.txt
diff --git a/.changelog/17962.txt b/.archive/changelog/17962.txt
similarity index 100%
rename from .changelog/17962.txt
rename to .archive/changelog/17962.txt
diff --git a/.changelog/17964.txt b/.archive/changelog/17964.txt
similarity index 100%
rename from .changelog/17964.txt
rename to .archive/changelog/17964.txt
diff --git a/.changelog/17965.txt b/.archive/changelog/17965.txt
similarity index 100%
rename from .changelog/17965.txt
rename to .archive/changelog/17965.txt
diff --git a/.changelog/17967.txt b/.archive/changelog/17967.txt
similarity index 100%
rename from .changelog/17967.txt
rename to .archive/changelog/17967.txt
diff --git a/.changelog/17968.txt b/.archive/changelog/17968.txt
similarity index 100%
rename from .changelog/17968.txt
rename to .archive/changelog/17968.txt
diff --git a/.changelog/17969.txt b/.archive/changelog/17969.txt
similarity index 100%
rename from .changelog/17969.txt
rename to .archive/changelog/17969.txt
diff --git a/.changelog/17974.txt b/.archive/changelog/17974.txt
similarity index 100%
rename from .changelog/17974.txt
rename to .archive/changelog/17974.txt
diff --git a/.changelog/17982.txt b/.archive/changelog/17982.txt
similarity index 100%
rename from .changelog/17982.txt
rename to .archive/changelog/17982.txt
diff --git a/.changelog/17985.txt b/.archive/changelog/17985.txt
similarity index 100%
rename from .changelog/17985.txt
rename to .archive/changelog/17985.txt
diff --git a/.changelog/17987.txt b/.archive/changelog/17987.txt
similarity index 100%
rename from .changelog/17987.txt
rename to .archive/changelog/17987.txt
diff --git a/.changelog/17991.txt b/.archive/changelog/17991.txt
similarity index 100%
rename from .changelog/17991.txt
rename to .archive/changelog/17991.txt
diff --git a/.changelog/17992.txt b/.archive/changelog/17992.txt
similarity index 100%
rename from .changelog/17992.txt
rename to .archive/changelog/17992.txt
diff --git a/.changelog/18006.txt b/.archive/changelog/18006.txt
similarity index 100%
rename from .changelog/18006.txt
rename to .archive/changelog/18006.txt
diff --git a/.changelog/18013.txt b/.archive/changelog/18013.txt
similarity index 100%
rename from .changelog/18013.txt
rename to .archive/changelog/18013.txt
diff --git a/.changelog/18042.txt b/.archive/changelog/18042.txt
similarity index 100%
rename from .changelog/18042.txt
rename to .archive/changelog/18042.txt
diff --git a/.changelog/18043.txt b/.archive/changelog/18043.txt
similarity index 100%
rename from .changelog/18043.txt
rename to .archive/changelog/18043.txt
diff --git a/.changelog/18056.txt b/.archive/changelog/18056.txt
similarity index 100%
rename from .changelog/18056.txt
rename to .archive/changelog/18056.txt
diff --git a/.changelog/18070.txt b/.archive/changelog/18070.txt
similarity index 100%
rename from .changelog/18070.txt
rename to .archive/changelog/18070.txt
diff --git a/.changelog/18076.txt b/.archive/changelog/18076.txt
similarity index 100%
rename from .changelog/18076.txt
rename to .archive/changelog/18076.txt
diff --git a/.changelog/18079.txt b/.archive/changelog/18079.txt
similarity index 100%
rename from .changelog/18079.txt
rename to .archive/changelog/18079.txt
diff --git a/.changelog/18081.txt b/.archive/changelog/18081.txt
similarity index 100%
rename from .changelog/18081.txt
rename to .archive/changelog/18081.txt
diff --git a/.changelog/18082.txt b/.archive/changelog/18082.txt
similarity index 100%
rename from .changelog/18082.txt
rename to .archive/changelog/18082.txt
diff --git a/.changelog/18083.txt b/.archive/changelog/18083.txt
similarity index 100%
rename from .changelog/18083.txt
rename to .archive/changelog/18083.txt
diff --git a/.changelog/18085.txt b/.archive/changelog/18085.txt
similarity index 100%
rename from .changelog/18085.txt
rename to .archive/changelog/18085.txt
diff --git a/.changelog/18088.txt b/.archive/changelog/18088.txt
similarity index 100%
rename from .changelog/18088.txt
rename to .archive/changelog/18088.txt
diff --git a/.changelog/18102.txt b/.archive/changelog/18102.txt
similarity index 100%
rename from .changelog/18102.txt
rename to .archive/changelog/18102.txt
diff --git a/.changelog/18106.txt b/.archive/changelog/18106.txt
similarity index 100%
rename from .changelog/18106.txt
rename to .archive/changelog/18106.txt
diff --git a/.changelog/18115.txt b/.archive/changelog/18115.txt
similarity index 100%
rename from .changelog/18115.txt
rename to .archive/changelog/18115.txt
diff --git a/.changelog/18117.txt b/.archive/changelog/18117.txt
similarity index 100%
rename from .changelog/18117.txt
rename to .archive/changelog/18117.txt
diff --git a/.changelog/18127.txt b/.archive/changelog/18127.txt
similarity index 100%
rename from .changelog/18127.txt
rename to .archive/changelog/18127.txt
diff --git a/.changelog/18129.txt b/.archive/changelog/18129.txt
similarity index 100%
rename from .changelog/18129.txt
rename to .archive/changelog/18129.txt
diff --git a/.changelog/18203.txt b/.archive/changelog/18203.txt
similarity index 100%
rename from .changelog/18203.txt
rename to .archive/changelog/18203.txt
diff --git a/.changelog/18215.txt b/.archive/changelog/18215.txt
similarity index 100%
rename from .changelog/18215.txt
rename to .archive/changelog/18215.txt
diff --git a/.changelog/18276.txt b/.archive/changelog/18276.txt
similarity index 100%
rename from .changelog/18276.txt
rename to .archive/changelog/18276.txt
diff --git a/.changelog/18281.txt b/.archive/changelog/18281.txt
similarity index 100%
rename from .changelog/18281.txt
rename to .archive/changelog/18281.txt
diff --git a/.changelog/18305.txt b/.archive/changelog/18305.txt
similarity index 100%
rename from .changelog/18305.txt
rename to .archive/changelog/18305.txt
diff --git a/.changelog/18313.txt b/.archive/changelog/18313.txt
similarity index 100%
rename from .changelog/18313.txt
rename to .archive/changelog/18313.txt
diff --git a/.changelog/18314.txt b/.archive/changelog/18314.txt
similarity index 100%
rename from .changelog/18314.txt
rename to .archive/changelog/18314.txt
diff --git a/.changelog/18315.txt b/.archive/changelog/18315.txt
similarity index 100%
rename from .changelog/18315.txt
rename to .archive/changelog/18315.txt
diff --git a/.changelog/18319.txt b/.archive/changelog/18319.txt
similarity index 100%
rename from .changelog/18319.txt
rename to .archive/changelog/18319.txt
diff --git a/.changelog/18320.txt b/.archive/changelog/18320.txt
similarity index 100%
rename from .changelog/18320.txt
rename to .archive/changelog/18320.txt
diff --git a/.changelog/18336.txt b/.archive/changelog/18336.txt
similarity index 100%
rename from .changelog/18336.txt
rename to .archive/changelog/18336.txt
diff --git a/.changelog/18341.txt b/.archive/changelog/18341.txt
similarity index 100%
rename from .changelog/18341.txt
rename to .archive/changelog/18341.txt
diff --git a/.changelog/18351.txt b/.archive/changelog/18351.txt
similarity index 100%
rename from .changelog/18351.txt
rename to .archive/changelog/18351.txt
diff --git a/.changelog/18361.txt b/.archive/changelog/18361.txt
similarity index 100%
rename from .changelog/18361.txt
rename to .archive/changelog/18361.txt
diff --git a/.changelog/18373.txt b/.archive/changelog/18373.txt
similarity index 100%
rename from .changelog/18373.txt
rename to .archive/changelog/18373.txt
diff --git a/.changelog/18382.txt b/.archive/changelog/18382.txt
similarity index 100%
rename from .changelog/18382.txt
rename to .archive/changelog/18382.txt
diff --git a/.changelog/18384.txt b/.archive/changelog/18384.txt
similarity index 100%
rename from .changelog/18384.txt
rename to .archive/changelog/18384.txt
diff --git a/.changelog/18388.txt b/.archive/changelog/18388.txt
similarity index 100%
rename from .changelog/18388.txt
rename to .archive/changelog/18388.txt
diff --git a/.changelog/18391.txt b/.archive/changelog/18391.txt
similarity index 100%
rename from .changelog/18391.txt
rename to .archive/changelog/18391.txt
diff --git a/.changelog/18392.txt b/.archive/changelog/18392.txt
similarity index 100%
rename from .changelog/18392.txt
rename to .archive/changelog/18392.txt
diff --git a/.changelog/18404.txt b/.archive/changelog/18404.txt
similarity index 100%
rename from .changelog/18404.txt
rename to .archive/changelog/18404.txt
diff --git a/.changelog/18410.txt b/.archive/changelog/18410.txt
similarity index 100%
rename from .changelog/18410.txt
rename to .archive/changelog/18410.txt
diff --git a/.changelog/18435.txt b/.archive/changelog/18435.txt
similarity index 100%
rename from .changelog/18435.txt
rename to .archive/changelog/18435.txt
diff --git a/.changelog/18445.txt b/.archive/changelog/18445.txt
similarity index 100%
rename from .changelog/18445.txt
rename to .archive/changelog/18445.txt
diff --git a/.changelog/18451.txt b/.archive/changelog/18451.txt
similarity index 100%
rename from .changelog/18451.txt
rename to .archive/changelog/18451.txt
diff --git a/.changelog/18454.txt b/.archive/changelog/18454.txt
similarity index 100%
rename from .changelog/18454.txt
rename to .archive/changelog/18454.txt
diff --git a/.changelog/18458.txt b/.archive/changelog/18458.txt
similarity index 100%
rename from .changelog/18458.txt
rename to .archive/changelog/18458.txt
diff --git a/.changelog/18459.txt b/.archive/changelog/18459.txt
similarity index 100%
rename from .changelog/18459.txt
rename to .archive/changelog/18459.txt
diff --git a/.changelog/18462.txt b/.archive/changelog/18462.txt
similarity index 100%
rename from .changelog/18462.txt
rename to .archive/changelog/18462.txt
diff --git a/.changelog/18464.txt b/.archive/changelog/18464.txt
similarity index 100%
rename from .changelog/18464.txt
rename to .archive/changelog/18464.txt
diff --git a/.changelog/18465.txt b/.archive/changelog/18465.txt
similarity index 100%
rename from .changelog/18465.txt
rename to .archive/changelog/18465.txt
diff --git a/.changelog/18466.txt b/.archive/changelog/18466.txt
similarity index 100%
rename from .changelog/18466.txt
rename to .archive/changelog/18466.txt
diff --git a/.changelog/18470.txt b/.archive/changelog/18470.txt
similarity index 100%
rename from .changelog/18470.txt
rename to .archive/changelog/18470.txt
diff --git a/.changelog/18472.txt b/.archive/changelog/18472.txt
similarity index 100%
rename from .changelog/18472.txt
rename to .archive/changelog/18472.txt
diff --git a/.changelog/18473.txt b/.archive/changelog/18473.txt
similarity index 100%
rename from .changelog/18473.txt
rename to .archive/changelog/18473.txt
diff --git a/.changelog/18475.txt b/.archive/changelog/18475.txt
similarity index 100%
rename from .changelog/18475.txt
rename to .archive/changelog/18475.txt
diff --git a/.changelog/18486.txt b/.archive/changelog/18486.txt
similarity index 100%
rename from .changelog/18486.txt
rename to .archive/changelog/18486.txt
diff --git a/.changelog/18491.txt b/.archive/changelog/18491.txt
similarity index 100%
rename from .changelog/18491.txt
rename to .archive/changelog/18491.txt
diff --git a/.changelog/18494.txt b/.archive/changelog/18494.txt
similarity index 100%
rename from .changelog/18494.txt
rename to .archive/changelog/18494.txt
diff --git a/.changelog/18505.txt b/.archive/changelog/18505.txt
similarity index 100%
rename from .changelog/18505.txt
rename to .archive/changelog/18505.txt
diff --git a/.changelog/18512.txt b/.archive/changelog/18512.txt
similarity index 100%
rename from .changelog/18512.txt
rename to .archive/changelog/18512.txt
diff --git a/.changelog/18529.txt b/.archive/changelog/18529.txt
similarity index 100%
rename from .changelog/18529.txt
rename to .archive/changelog/18529.txt
diff --git a/.changelog/18547.txt b/.archive/changelog/18547.txt
similarity index 100%
rename from .changelog/18547.txt
rename to .archive/changelog/18547.txt
diff --git a/.changelog/18558.txt b/.archive/changelog/18558.txt
similarity index 100%
rename from .changelog/18558.txt
rename to .archive/changelog/18558.txt
diff --git a/.changelog/18560.txt b/.archive/changelog/18560.txt
similarity index 100%
rename from .changelog/18560.txt
rename to .archive/changelog/18560.txt
diff --git a/.changelog/18561.txt b/.archive/changelog/18561.txt
similarity index 100%
rename from .changelog/18561.txt
rename to .archive/changelog/18561.txt
diff --git a/.changelog/18562.txt b/.archive/changelog/18562.txt
similarity index 100%
rename from .changelog/18562.txt
rename to .archive/changelog/18562.txt
diff --git a/.changelog/18564.txt b/.archive/changelog/18564.txt
similarity index 100%
rename from .changelog/18564.txt
rename to .archive/changelog/18564.txt
diff --git a/.changelog/18579.txt b/.archive/changelog/18579.txt
similarity index 100%
rename from .changelog/18579.txt
rename to .archive/changelog/18579.txt
diff --git a/.changelog/18580.txt b/.archive/changelog/18580.txt
similarity index 100%
rename from .changelog/18580.txt
rename to .archive/changelog/18580.txt
diff --git a/.changelog/18585.txt b/.archive/changelog/18585.txt
similarity index 100%
rename from .changelog/18585.txt
rename to .archive/changelog/18585.txt
diff --git a/.changelog/18588.txt b/.archive/changelog/18588.txt
similarity index 100%
rename from .changelog/18588.txt
rename to .archive/changelog/18588.txt
diff --git a/.changelog/18598.txt b/.archive/changelog/18598.txt
similarity index 100%
rename from .changelog/18598.txt
rename to .archive/changelog/18598.txt
diff --git a/.changelog/18600.txt b/.archive/changelog/18600.txt
similarity index 100%
rename from .changelog/18600.txt
rename to .archive/changelog/18600.txt
diff --git a/.changelog/18610.txt b/.archive/changelog/18610.txt
similarity index 100%
rename from .changelog/18610.txt
rename to .archive/changelog/18610.txt
diff --git a/.changelog/18611.txt b/.archive/changelog/18611.txt
similarity index 100%
rename from .changelog/18611.txt
rename to .archive/changelog/18611.txt
diff --git a/.changelog/18634.txt b/.archive/changelog/18634.txt
similarity index 100%
rename from .changelog/18634.txt
rename to .archive/changelog/18634.txt
diff --git a/.changelog/18635.txt b/.archive/changelog/18635.txt
similarity index 100%
rename from .changelog/18635.txt
rename to .archive/changelog/18635.txt
diff --git a/.changelog/18640.txt b/.archive/changelog/18640.txt
similarity index 100%
rename from .changelog/18640.txt
rename to .archive/changelog/18640.txt
diff --git a/.changelog/18644.txt b/.archive/changelog/18644.txt
similarity index 100%
rename from .changelog/18644.txt
rename to .archive/changelog/18644.txt
diff --git a/.changelog/18663.txt b/.archive/changelog/18663.txt
similarity index 100%
rename from .changelog/18663.txt
rename to .archive/changelog/18663.txt
diff --git a/.changelog/18667.txt b/.archive/changelog/18667.txt
similarity index 100%
rename from .changelog/18667.txt
rename to .archive/changelog/18667.txt
diff --git a/.changelog/18712.txt b/.archive/changelog/18712.txt
similarity index 100%
rename from .changelog/18712.txt
rename to .archive/changelog/18712.txt
diff --git a/.changelog/18716.txt b/.archive/changelog/18716.txt
similarity index 100%
rename from .changelog/18716.txt
rename to .archive/changelog/18716.txt
diff --git a/.changelog/18733.txt b/.archive/changelog/18733.txt
similarity index 100%
rename from .changelog/18733.txt
rename to .archive/changelog/18733.txt
diff --git a/.changelog/18734.txt b/.archive/changelog/18734.txt
similarity index 100%
rename from .changelog/18734.txt
rename to .archive/changelog/18734.txt
diff --git a/.changelog/18802.txt b/.archive/changelog/18802.txt
similarity index 100%
rename from .changelog/18802.txt
rename to .archive/changelog/18802.txt
diff --git a/.changelog/18803.txt b/.archive/changelog/18803.txt
similarity index 100%
rename from .changelog/18803.txt
rename to .archive/changelog/18803.txt
diff --git a/.changelog/18807.txt b/.archive/changelog/18807.txt
similarity index 100%
rename from .changelog/18807.txt
rename to .archive/changelog/18807.txt
diff --git a/.changelog/18818.txt b/.archive/changelog/18818.txt
similarity index 100%
rename from .changelog/18818.txt
rename to .archive/changelog/18818.txt
diff --git a/.changelog/18841.txt b/.archive/changelog/18841.txt
similarity index 100%
rename from .changelog/18841.txt
rename to .archive/changelog/18841.txt
diff --git a/.changelog/18843.txt b/.archive/changelog/18843.txt
similarity index 100%
rename from .changelog/18843.txt
rename to .archive/changelog/18843.txt
diff --git a/.changelog/18855.txt b/.archive/changelog/18855.txt
similarity index 100%
rename from .changelog/18855.txt
rename to .archive/changelog/18855.txt
diff --git a/.changelog/18861.txt b/.archive/changelog/18861.txt
similarity index 100%
rename from .changelog/18861.txt
rename to .archive/changelog/18861.txt
diff --git a/.changelog/18870.txt b/.archive/changelog/18870.txt
similarity index 100%
rename from .changelog/18870.txt
rename to .archive/changelog/18870.txt
diff --git a/.changelog/18873.txt b/.archive/changelog/18873.txt
similarity index 100%
rename from .changelog/18873.txt
rename to .archive/changelog/18873.txt
diff --git a/.changelog/18880.txt b/.archive/changelog/18880.txt
similarity index 100%
rename from .changelog/18880.txt
rename to .archive/changelog/18880.txt
diff --git a/.changelog/18881.txt b/.archive/changelog/18881.txt
similarity index 100%
rename from .changelog/18881.txt
rename to .archive/changelog/18881.txt
diff --git a/.changelog/18882.txt b/.archive/changelog/18882.txt
similarity index 100%
rename from .changelog/18882.txt
rename to .archive/changelog/18882.txt
diff --git a/.changelog/18905.txt b/.archive/changelog/18905.txt
similarity index 100%
rename from .changelog/18905.txt
rename to .archive/changelog/18905.txt
diff --git a/.changelog/18909.txt b/.archive/changelog/18909.txt
similarity index 100%
rename from .changelog/18909.txt
rename to .archive/changelog/18909.txt
diff --git a/.changelog/18918.txt b/.archive/changelog/18918.txt
similarity index 100%
rename from .changelog/18918.txt
rename to .archive/changelog/18918.txt
diff --git a/.changelog/18920.txt b/.archive/changelog/18920.txt
similarity index 100%
rename from .changelog/18920.txt
rename to .archive/changelog/18920.txt
diff --git a/.changelog/18932.txt b/.archive/changelog/18932.txt
similarity index 100%
rename from .changelog/18932.txt
rename to .archive/changelog/18932.txt
diff --git a/.changelog/18958.txt b/.archive/changelog/18958.txt
similarity index 100%
rename from .changelog/18958.txt
rename to .archive/changelog/18958.txt
diff --git a/.changelog/19051.txt b/.archive/changelog/19051.txt
similarity index 100%
rename from .changelog/19051.txt
rename to .archive/changelog/19051.txt
diff --git a/.changelog/19059.txt b/.archive/changelog/19059.txt
similarity index 100%
rename from .changelog/19059.txt
rename to .archive/changelog/19059.txt
diff --git a/.changelog/19060.txt b/.archive/changelog/19060.txt
similarity index 100%
rename from .changelog/19060.txt
rename to .archive/changelog/19060.txt
diff --git a/.changelog/19065.txt b/.archive/changelog/19065.txt
similarity index 100%
rename from .changelog/19065.txt
rename to .archive/changelog/19065.txt
diff --git a/.changelog/19069.txt b/.archive/changelog/19069.txt
similarity index 100%
rename from .changelog/19069.txt
rename to .archive/changelog/19069.txt
diff --git a/.changelog/19072.txt b/.archive/changelog/19072.txt
similarity index 100%
rename from .changelog/19072.txt
rename to .archive/changelog/19072.txt
diff --git a/.changelog/19077.txt b/.archive/changelog/19077.txt
similarity index 100%
rename from .changelog/19077.txt
rename to .archive/changelog/19077.txt
diff --git a/.changelog/19078.txt b/.archive/changelog/19078.txt
similarity index 100%
rename from .changelog/19078.txt
rename to .archive/changelog/19078.txt
diff --git a/.changelog/19083.txt b/.archive/changelog/19083.txt
similarity index 100%
rename from .changelog/19083.txt
rename to .archive/changelog/19083.txt
diff --git a/.changelog/19084.txt b/.archive/changelog/19084.txt
similarity index 100%
rename from .changelog/19084.txt
rename to .archive/changelog/19084.txt
diff --git a/.changelog/19095.txt b/.archive/changelog/19095.txt
similarity index 100%
rename from .changelog/19095.txt
rename to .archive/changelog/19095.txt
diff --git a/.changelog/19100.txt b/.archive/changelog/19100.txt
similarity index 100%
rename from .changelog/19100.txt
rename to .archive/changelog/19100.txt
diff --git a/.changelog/19108.txt b/.archive/changelog/19108.txt
similarity index 100%
rename from .changelog/19108.txt
rename to .archive/changelog/19108.txt
diff --git a/.changelog/19116.txt b/.archive/changelog/19116.txt
similarity index 100%
rename from .changelog/19116.txt
rename to .archive/changelog/19116.txt
diff --git a/.changelog/19119.txt b/.archive/changelog/19119.txt
similarity index 100%
rename from .changelog/19119.txt
rename to .archive/changelog/19119.txt
diff --git a/.changelog/19121.txt b/.archive/changelog/19121.txt
similarity index 100%
rename from .changelog/19121.txt
rename to .archive/changelog/19121.txt
diff --git a/.changelog/19122.txt b/.archive/changelog/19122.txt
similarity index 100%
rename from .changelog/19122.txt
rename to .archive/changelog/19122.txt
diff --git a/.changelog/19144.txt b/.archive/changelog/19144.txt
similarity index 100%
rename from .changelog/19144.txt
rename to .archive/changelog/19144.txt
diff --git a/.changelog/19160.txt b/.archive/changelog/19160.txt
similarity index 100%
rename from .changelog/19160.txt
rename to .archive/changelog/19160.txt
diff --git a/.changelog/19164.txt b/.archive/changelog/19164.txt
similarity index 100%
rename from .changelog/19164.txt
rename to .archive/changelog/19164.txt
diff --git a/.changelog/19165.txt b/.archive/changelog/19165.txt
similarity index 100%
rename from .changelog/19165.txt
rename to .archive/changelog/19165.txt
diff --git a/.changelog/19168.txt b/.archive/changelog/19168.txt
similarity index 100%
rename from .changelog/19168.txt
rename to .archive/changelog/19168.txt
diff --git a/.changelog/19172.txt b/.archive/changelog/19172.txt
similarity index 100%
rename from .changelog/19172.txt
rename to .archive/changelog/19172.txt
diff --git a/.changelog/19175.txt b/.archive/changelog/19175.txt
similarity index 100%
rename from .changelog/19175.txt
rename to .archive/changelog/19175.txt
diff --git a/.changelog/19176.txt b/.archive/changelog/19176.txt
similarity index 100%
rename from .changelog/19176.txt
rename to .archive/changelog/19176.txt
diff --git a/.changelog/19190.txt b/.archive/changelog/19190.txt
similarity index 100%
rename from .changelog/19190.txt
rename to .archive/changelog/19190.txt
diff --git a/.changelog/19195.txt b/.archive/changelog/19195.txt
similarity index 100%
rename from .changelog/19195.txt
rename to .archive/changelog/19195.txt
diff --git a/.changelog/19205.txt b/.archive/changelog/19205.txt
similarity index 100%
rename from .changelog/19205.txt
rename to .archive/changelog/19205.txt
diff --git a/.changelog/19207.txt b/.archive/changelog/19207.txt
similarity index 100%
rename from .changelog/19207.txt
rename to .archive/changelog/19207.txt
diff --git a/.changelog/19216.txt b/.archive/changelog/19216.txt
similarity index 100%
rename from .changelog/19216.txt
rename to .archive/changelog/19216.txt
diff --git a/.changelog/19219.txt b/.archive/changelog/19219.txt
similarity index 100%
rename from .changelog/19219.txt
rename to .archive/changelog/19219.txt
diff --git a/.changelog/19251.txt b/.archive/changelog/19251.txt
similarity index 100%
rename from .changelog/19251.txt
rename to .archive/changelog/19251.txt
diff --git a/.changelog/19253.txt b/.archive/changelog/19253.txt
similarity index 100%
rename from .changelog/19253.txt
rename to .archive/changelog/19253.txt
diff --git a/.changelog/19254.txt b/.archive/changelog/19254.txt
similarity index 100%
rename from .changelog/19254.txt
rename to .archive/changelog/19254.txt
diff --git a/.changelog/19256.txt b/.archive/changelog/19256.txt
similarity index 100%
rename from .changelog/19256.txt
rename to .archive/changelog/19256.txt
diff --git a/.changelog/19262.txt b/.archive/changelog/19262.txt
similarity index 100%
rename from .changelog/19262.txt
rename to .archive/changelog/19262.txt
diff --git a/.changelog/19266.txt b/.archive/changelog/19266.txt
similarity index 100%
rename from .changelog/19266.txt
rename to .archive/changelog/19266.txt
diff --git a/.changelog/19277.txt b/.archive/changelog/19277.txt
similarity index 100%
rename from .changelog/19277.txt
rename to .archive/changelog/19277.txt
diff --git a/.changelog/19278.txt b/.archive/changelog/19278.txt
similarity index 100%
rename from .changelog/19278.txt
rename to .archive/changelog/19278.txt
diff --git a/.changelog/19283.txt b/.archive/changelog/19283.txt
similarity index 100%
rename from .changelog/19283.txt
rename to .archive/changelog/19283.txt
diff --git a/.changelog/19284.txt b/.archive/changelog/19284.txt
similarity index 100%
rename from .changelog/19284.txt
rename to .archive/changelog/19284.txt
diff --git a/.changelog/19285.txt b/.archive/changelog/19285.txt
similarity index 100%
rename from .changelog/19285.txt
rename to .archive/changelog/19285.txt
diff --git a/.changelog/19286.txt b/.archive/changelog/19286.txt
similarity index 100%
rename from .changelog/19286.txt
rename to .archive/changelog/19286.txt
diff --git a/.changelog/19292.txt b/.archive/changelog/19292.txt
similarity index 100%
rename from .changelog/19292.txt
rename to .archive/changelog/19292.txt
diff --git a/.changelog/19294.txt b/.archive/changelog/19294.txt
similarity index 100%
rename from .changelog/19294.txt
rename to .archive/changelog/19294.txt
diff --git a/.changelog/19297.txt b/.archive/changelog/19297.txt
similarity index 100%
rename from .changelog/19297.txt
rename to .archive/changelog/19297.txt
diff --git a/.changelog/19300.txt b/.archive/changelog/19300.txt
similarity index 100%
rename from .changelog/19300.txt
rename to .archive/changelog/19300.txt
diff --git a/.changelog/19303.txt b/.archive/changelog/19303.txt
similarity index 100%
rename from .changelog/19303.txt
rename to .archive/changelog/19303.txt
diff --git a/.changelog/19304.txt b/.archive/changelog/19304.txt
similarity index 100%
rename from .changelog/19304.txt
rename to .archive/changelog/19304.txt
diff --git a/.changelog/19307.txt b/.archive/changelog/19307.txt
similarity index 100%
rename from .changelog/19307.txt
rename to .archive/changelog/19307.txt
diff --git a/.changelog/19311.txt b/.archive/changelog/19311.txt
similarity index 100%
rename from .changelog/19311.txt
rename to .archive/changelog/19311.txt
diff --git a/.changelog/19315.txt b/.archive/changelog/19315.txt
similarity index 100%
rename from .changelog/19315.txt
rename to .archive/changelog/19315.txt
diff --git a/.changelog/19316.txt b/.archive/changelog/19316.txt
similarity index 100%
rename from .changelog/19316.txt
rename to .archive/changelog/19316.txt
diff --git a/.changelog/19320.txt b/.archive/changelog/19320.txt
similarity index 100%
rename from .changelog/19320.txt
rename to .archive/changelog/19320.txt
diff --git a/.changelog/19323.txt b/.archive/changelog/19323.txt
similarity index 100%
rename from .changelog/19323.txt
rename to .archive/changelog/19323.txt
diff --git a/.changelog/19324.txt b/.archive/changelog/19324.txt
similarity index 100%
rename from .changelog/19324.txt
rename to .archive/changelog/19324.txt
diff --git a/.changelog/19337.txt b/.archive/changelog/19337.txt
similarity index 100%
rename from .changelog/19337.txt
rename to .archive/changelog/19337.txt
diff --git a/.changelog/19354.txt b/.archive/changelog/19354.txt
similarity index 100%
rename from .changelog/19354.txt
rename to .archive/changelog/19354.txt
diff --git a/.changelog/19359.txt b/.archive/changelog/19359.txt
similarity index 100%
rename from .changelog/19359.txt
rename to .archive/changelog/19359.txt
diff --git a/.changelog/19361.txt b/.archive/changelog/19361.txt
similarity index 100%
rename from .changelog/19361.txt
rename to .archive/changelog/19361.txt
diff --git a/.changelog/19368.txt b/.archive/changelog/19368.txt
similarity index 100%
rename from .changelog/19368.txt
rename to .archive/changelog/19368.txt
diff --git a/.changelog/19369.txt b/.archive/changelog/19369.txt
similarity index 100%
rename from .changelog/19369.txt
rename to .archive/changelog/19369.txt
diff --git a/.changelog/19371.txt b/.archive/changelog/19371.txt
similarity index 100%
rename from .changelog/19371.txt
rename to .archive/changelog/19371.txt
diff --git a/.changelog/19372.txt b/.archive/changelog/19372.txt
similarity index 100%
rename from .changelog/19372.txt
rename to .archive/changelog/19372.txt
diff --git a/.changelog/19375.txt b/.archive/changelog/19375.txt
similarity index 100%
rename from .changelog/19375.txt
rename to .archive/changelog/19375.txt
diff --git a/.changelog/19385.txt b/.archive/changelog/19385.txt
similarity index 100%
rename from .changelog/19385.txt
rename to .archive/changelog/19385.txt
diff --git a/.changelog/19386.txt b/.archive/changelog/19386.txt
similarity index 100%
rename from .changelog/19386.txt
rename to .archive/changelog/19386.txt
diff --git a/.changelog/19389.txt b/.archive/changelog/19389.txt
similarity index 100%
rename from .changelog/19389.txt
rename to .archive/changelog/19389.txt
diff --git a/.changelog/19391.txt b/.archive/changelog/19391.txt
similarity index 100%
rename from .changelog/19391.txt
rename to .archive/changelog/19391.txt
diff --git a/.changelog/19394.txt b/.archive/changelog/19394.txt
similarity index 100%
rename from .changelog/19394.txt
rename to .archive/changelog/19394.txt
diff --git a/.changelog/19404.txt b/.archive/changelog/19404.txt
similarity index 100%
rename from .changelog/19404.txt
rename to .archive/changelog/19404.txt
diff --git a/.changelog/19407.txt b/.archive/changelog/19407.txt
similarity index 100%
rename from .changelog/19407.txt
rename to .archive/changelog/19407.txt
diff --git a/.changelog/19415.txt b/.archive/changelog/19415.txt
similarity index 100%
rename from .changelog/19415.txt
rename to .archive/changelog/19415.txt
diff --git a/.changelog/19423.txt b/.archive/changelog/19423.txt
similarity index 100%
rename from .changelog/19423.txt
rename to .archive/changelog/19423.txt
diff --git a/.changelog/19425.txt b/.archive/changelog/19425.txt
similarity index 100%
rename from .changelog/19425.txt
rename to .archive/changelog/19425.txt
diff --git a/.changelog/19426.txt b/.archive/changelog/19426.txt
similarity index 100%
rename from .changelog/19426.txt
rename to .archive/changelog/19426.txt
diff --git a/.changelog/19430.txt b/.archive/changelog/19430.txt
similarity index 100%
rename from .changelog/19430.txt
rename to .archive/changelog/19430.txt
diff --git a/.changelog/19432.txt b/.archive/changelog/19432.txt
similarity index 100%
rename from .changelog/19432.txt
rename to .archive/changelog/19432.txt
diff --git a/.changelog/19447.txt b/.archive/changelog/19447.txt
similarity index 100%
rename from .changelog/19447.txt
rename to .archive/changelog/19447.txt
diff --git a/.changelog/19448.txt b/.archive/changelog/19448.txt
similarity index 100%
rename from .changelog/19448.txt
rename to .archive/changelog/19448.txt
diff --git a/.changelog/19452.txt b/.archive/changelog/19452.txt
similarity index 100%
rename from .changelog/19452.txt
rename to .archive/changelog/19452.txt
diff --git a/.changelog/19454.txt b/.archive/changelog/19454.txt
similarity index 100%
rename from .changelog/19454.txt
rename to .archive/changelog/19454.txt
diff --git a/.changelog/19459.txt b/.archive/changelog/19459.txt
similarity index 100%
rename from .changelog/19459.txt
rename to .archive/changelog/19459.txt
diff --git a/.changelog/19470.txt b/.archive/changelog/19470.txt
similarity index 100%
rename from .changelog/19470.txt
rename to .archive/changelog/19470.txt
diff --git a/.changelog/19471.txt b/.archive/changelog/19471.txt
similarity index 100%
rename from .changelog/19471.txt
rename to .archive/changelog/19471.txt
diff --git a/.changelog/19482.txt b/.archive/changelog/19482.txt
similarity index 100%
rename from .changelog/19482.txt
rename to .archive/changelog/19482.txt
diff --git a/.changelog/19483.txt b/.archive/changelog/19483.txt
similarity index 100%
rename from .changelog/19483.txt
rename to .archive/changelog/19483.txt
diff --git a/.changelog/19488.txt b/.archive/changelog/19488.txt
similarity index 100%
rename from .changelog/19488.txt
rename to .archive/changelog/19488.txt
diff --git a/.changelog/19492.txt b/.archive/changelog/19492.txt
similarity index 100%
rename from .changelog/19492.txt
rename to .archive/changelog/19492.txt
diff --git a/.changelog/19496.txt b/.archive/changelog/19496.txt
similarity index 100%
rename from .changelog/19496.txt
rename to .archive/changelog/19496.txt
diff --git a/.changelog/19497.txt b/.archive/changelog/19497.txt
similarity index 100%
rename from .changelog/19497.txt
rename to .archive/changelog/19497.txt
diff --git a/.changelog/19499.txt b/.archive/changelog/19499.txt
similarity index 100%
rename from .changelog/19499.txt
rename to .archive/changelog/19499.txt
diff --git a/.changelog/19500.txt b/.archive/changelog/19500.txt
similarity index 100%
rename from .changelog/19500.txt
rename to .archive/changelog/19500.txt
diff --git a/.changelog/19502.txt b/.archive/changelog/19502.txt
similarity index 100%
rename from .changelog/19502.txt
rename to .archive/changelog/19502.txt
diff --git a/.changelog/19503.txt b/.archive/changelog/19503.txt
similarity index 100%
rename from .changelog/19503.txt
rename to .archive/changelog/19503.txt
diff --git a/.changelog/19504.txt b/.archive/changelog/19504.txt
similarity index 100%
rename from .changelog/19504.txt
rename to .archive/changelog/19504.txt
diff --git a/.changelog/19505.txt b/.archive/changelog/19505.txt
similarity index 100%
rename from .changelog/19505.txt
rename to .archive/changelog/19505.txt
diff --git a/.changelog/19515.txt b/.archive/changelog/19515.txt
similarity index 100%
rename from .changelog/19515.txt
rename to .archive/changelog/19515.txt
diff --git a/.changelog/19517.txt b/.archive/changelog/19517.txt
similarity index 100%
rename from .changelog/19517.txt
rename to .archive/changelog/19517.txt
diff --git a/.changelog/19523.txt b/.archive/changelog/19523.txt
similarity index 100%
rename from .changelog/19523.txt
rename to .archive/changelog/19523.txt
diff --git a/.changelog/19528.txt b/.archive/changelog/19528.txt
similarity index 100%
rename from .changelog/19528.txt
rename to .archive/changelog/19528.txt
diff --git a/.changelog/19532.txt b/.archive/changelog/19532.txt
similarity index 100%
rename from .changelog/19532.txt
rename to .archive/changelog/19532.txt
diff --git a/.changelog/19533.txt b/.archive/changelog/19533.txt
similarity index 100%
rename from .changelog/19533.txt
rename to .archive/changelog/19533.txt
diff --git a/.changelog/19535.txt b/.archive/changelog/19535.txt
similarity index 100%
rename from .changelog/19535.txt
rename to .archive/changelog/19535.txt
diff --git a/.changelog/19551.txt b/.archive/changelog/19551.txt
similarity index 100%
rename from .changelog/19551.txt
rename to .archive/changelog/19551.txt
diff --git a/.changelog/19554.txt b/.archive/changelog/19554.txt
similarity index 100%
rename from .changelog/19554.txt
rename to .archive/changelog/19554.txt
diff --git a/.changelog/19555.txt b/.archive/changelog/19555.txt
similarity index 100%
rename from .changelog/19555.txt
rename to .archive/changelog/19555.txt
diff --git a/.changelog/19557.txt b/.archive/changelog/19557.txt
similarity index 100%
rename from .changelog/19557.txt
rename to .archive/changelog/19557.txt
diff --git a/.changelog/19559.txt b/.archive/changelog/19559.txt
similarity index 100%
rename from .changelog/19559.txt
rename to .archive/changelog/19559.txt
diff --git a/.changelog/19568.txt b/.archive/changelog/19568.txt
similarity index 100%
rename from .changelog/19568.txt
rename to .archive/changelog/19568.txt
diff --git a/.changelog/19571.txt b/.archive/changelog/19571.txt
similarity index 100%
rename from .changelog/19571.txt
rename to .archive/changelog/19571.txt
diff --git a/.changelog/19572.txt b/.archive/changelog/19572.txt
similarity index 100%
rename from .changelog/19572.txt
rename to .archive/changelog/19572.txt
diff --git a/.changelog/19574.txt b/.archive/changelog/19574.txt
similarity index 100%
rename from .changelog/19574.txt
rename to .archive/changelog/19574.txt
diff --git a/.changelog/19576.txt b/.archive/changelog/19576.txt
similarity index 100%
rename from .changelog/19576.txt
rename to .archive/changelog/19576.txt
diff --git a/.changelog/19577.txt b/.archive/changelog/19577.txt
similarity index 100%
rename from .changelog/19577.txt
rename to .archive/changelog/19577.txt
diff --git a/.changelog/19578.txt b/.archive/changelog/19578.txt
similarity index 100%
rename from .changelog/19578.txt
rename to .archive/changelog/19578.txt
diff --git a/.changelog/19579.txt b/.archive/changelog/19579.txt
similarity index 100%
rename from .changelog/19579.txt
rename to .archive/changelog/19579.txt
diff --git a/.changelog/19594.txt b/.archive/changelog/19594.txt
similarity index 100%
rename from .changelog/19594.txt
rename to .archive/changelog/19594.txt
diff --git a/.changelog/19606.txt b/.archive/changelog/19606.txt
similarity index 100%
rename from .changelog/19606.txt
rename to .archive/changelog/19606.txt
diff --git a/.changelog/19615.txt b/.archive/changelog/19615.txt
similarity index 100%
rename from .changelog/19615.txt
rename to .archive/changelog/19615.txt
diff --git a/.changelog/19625.txt b/.archive/changelog/19625.txt
similarity index 100%
rename from .changelog/19625.txt
rename to .archive/changelog/19625.txt
diff --git a/.changelog/19632.txt b/.archive/changelog/19632.txt
similarity index 100%
rename from .changelog/19632.txt
rename to .archive/changelog/19632.txt
diff --git a/.changelog/19639.txt b/.archive/changelog/19639.txt
similarity index 100%
rename from .changelog/19639.txt
rename to .archive/changelog/19639.txt
diff --git a/.changelog/19647.txt b/.archive/changelog/19647.txt
similarity index 100%
rename from .changelog/19647.txt
rename to .archive/changelog/19647.txt
diff --git a/.changelog/19648.txt b/.archive/changelog/19648.txt
similarity index 100%
rename from .changelog/19648.txt
rename to .archive/changelog/19648.txt
diff --git a/.changelog/19654.txt b/.archive/changelog/19654.txt
similarity index 100%
rename from .changelog/19654.txt
rename to .archive/changelog/19654.txt
diff --git a/.changelog/19656.txt b/.archive/changelog/19656.txt
similarity index 100%
rename from .changelog/19656.txt
rename to .archive/changelog/19656.txt
diff --git a/.changelog/19664.txt b/.archive/changelog/19664.txt
similarity index 100%
rename from .changelog/19664.txt
rename to .archive/changelog/19664.txt
diff --git a/.changelog/19666.txt b/.archive/changelog/19666.txt
similarity index 100%
rename from .changelog/19666.txt
rename to .archive/changelog/19666.txt
diff --git a/.changelog/19668.txt b/.archive/changelog/19668.txt
similarity index 100%
rename from .changelog/19668.txt
rename to .archive/changelog/19668.txt
diff --git a/.changelog/19670.txt b/.archive/changelog/19670.txt
similarity index 100%
rename from .changelog/19670.txt
rename to .archive/changelog/19670.txt
diff --git a/.changelog/19677.txt b/.archive/changelog/19677.txt
similarity index 100%
rename from .changelog/19677.txt
rename to .archive/changelog/19677.txt
diff --git a/.changelog/19681.txt b/.archive/changelog/19681.txt
similarity index 100%
rename from .changelog/19681.txt
rename to .archive/changelog/19681.txt
diff --git a/.changelog/19691.txt b/.archive/changelog/19691.txt
similarity index 100%
rename from .changelog/19691.txt
rename to .archive/changelog/19691.txt
diff --git a/.changelog/19693.txt b/.archive/changelog/19693.txt
similarity index 100%
rename from .changelog/19693.txt
rename to .archive/changelog/19693.txt
diff --git a/.changelog/19694.txt b/.archive/changelog/19694.txt
similarity index 100%
rename from .changelog/19694.txt
rename to .archive/changelog/19694.txt
diff --git a/.changelog/19697.txt b/.archive/changelog/19697.txt
similarity index 100%
rename from .changelog/19697.txt
rename to .archive/changelog/19697.txt
diff --git a/.changelog/19702.txt b/.archive/changelog/19702.txt
similarity index 100%
rename from .changelog/19702.txt
rename to .archive/changelog/19702.txt
diff --git a/.changelog/19703.txt b/.archive/changelog/19703.txt
similarity index 100%
rename from .changelog/19703.txt
rename to .archive/changelog/19703.txt
diff --git a/.changelog/19704.txt b/.archive/changelog/19704.txt
similarity index 100%
rename from .changelog/19704.txt
rename to .archive/changelog/19704.txt
diff --git a/.changelog/19705.txt b/.archive/changelog/19705.txt
similarity index 100%
rename from .changelog/19705.txt
rename to .archive/changelog/19705.txt
diff --git a/.changelog/19713.txt b/.archive/changelog/19713.txt
similarity index 100%
rename from .changelog/19713.txt
rename to .archive/changelog/19713.txt
diff --git a/.changelog/19718.txt b/.archive/changelog/19718.txt
similarity index 100%
rename from .changelog/19718.txt
rename to .archive/changelog/19718.txt
diff --git a/.changelog/19722.txt b/.archive/changelog/19722.txt
similarity index 100%
rename from .changelog/19722.txt
rename to .archive/changelog/19722.txt
diff --git a/.changelog/19741.txt b/.archive/changelog/19741.txt
similarity index 100%
rename from .changelog/19741.txt
rename to .archive/changelog/19741.txt
diff --git a/.changelog/19742.txt b/.archive/changelog/19742.txt
similarity index 100%
rename from .changelog/19742.txt
rename to .archive/changelog/19742.txt
diff --git a/.changelog/19743.txt b/.archive/changelog/19743.txt
similarity index 100%
rename from .changelog/19743.txt
rename to .archive/changelog/19743.txt
diff --git a/.changelog/19749.txt b/.archive/changelog/19749.txt
similarity index 100%
rename from .changelog/19749.txt
rename to .archive/changelog/19749.txt
diff --git a/.changelog/19753.txt b/.archive/changelog/19753.txt
similarity index 100%
rename from .changelog/19753.txt
rename to .archive/changelog/19753.txt
diff --git a/.changelog/19758.txt b/.archive/changelog/19758.txt
similarity index 100%
rename from .changelog/19758.txt
rename to .archive/changelog/19758.txt
diff --git a/.changelog/19764.txt b/.archive/changelog/19764.txt
similarity index 100%
rename from .changelog/19764.txt
rename to .archive/changelog/19764.txt
diff --git a/.changelog/19765.txt b/.archive/changelog/19765.txt
similarity index 100%
rename from .changelog/19765.txt
rename to .archive/changelog/19765.txt
diff --git a/.changelog/19767.txt b/.archive/changelog/19767.txt
similarity index 100%
rename from .changelog/19767.txt
rename to .archive/changelog/19767.txt
diff --git a/.changelog/19772.txt b/.archive/changelog/19772.txt
similarity index 100%
rename from .changelog/19772.txt
rename to .archive/changelog/19772.txt
diff --git a/.changelog/19774.txt b/.archive/changelog/19774.txt
similarity index 100%
rename from .changelog/19774.txt
rename to .archive/changelog/19774.txt
diff --git a/.changelog/19785.txt b/.archive/changelog/19785.txt
similarity index 100%
rename from .changelog/19785.txt
rename to .archive/changelog/19785.txt
diff --git a/.changelog/19804.txt b/.archive/changelog/19804.txt
similarity index 100%
rename from .changelog/19804.txt
rename to .archive/changelog/19804.txt
diff --git a/.changelog/19810.txt b/.archive/changelog/19810.txt
similarity index 100%
rename from .changelog/19810.txt
rename to .archive/changelog/19810.txt
diff --git a/.changelog/19813.txt b/.archive/changelog/19813.txt
similarity index 100%
rename from .changelog/19813.txt
rename to .archive/changelog/19813.txt
diff --git a/.changelog/19817.txt b/.archive/changelog/19817.txt
similarity index 100%
rename from .changelog/19817.txt
rename to .archive/changelog/19817.txt
diff --git a/.changelog/19819.txt b/.archive/changelog/19819.txt
similarity index 100%
rename from .changelog/19819.txt
rename to .archive/changelog/19819.txt
diff --git a/.changelog/19820.txt b/.archive/changelog/19820.txt
similarity index 100%
rename from .changelog/19820.txt
rename to .archive/changelog/19820.txt
diff --git a/.changelog/19827.txt b/.archive/changelog/19827.txt
similarity index 100%
rename from .changelog/19827.txt
rename to .archive/changelog/19827.txt
diff --git a/.changelog/19829.txt b/.archive/changelog/19829.txt
similarity index 100%
rename from .changelog/19829.txt
rename to .archive/changelog/19829.txt
diff --git a/.changelog/19831.txt b/.archive/changelog/19831.txt
similarity index 100%
rename from .changelog/19831.txt
rename to .archive/changelog/19831.txt
diff --git a/.changelog/19834.txt b/.archive/changelog/19834.txt
similarity index 100%
rename from .changelog/19834.txt
rename to .archive/changelog/19834.txt
diff --git a/.changelog/19837.txt b/.archive/changelog/19837.txt
similarity index 100%
rename from .changelog/19837.txt
rename to .archive/changelog/19837.txt
diff --git a/.changelog/19854.txt b/.archive/changelog/19854.txt
similarity index 100%
rename from .changelog/19854.txt
rename to .archive/changelog/19854.txt
diff --git a/.changelog/19856.txt b/.archive/changelog/19856.txt
similarity index 100%
rename from .changelog/19856.txt
rename to .archive/changelog/19856.txt
diff --git a/.changelog/19859.txt b/.archive/changelog/19859.txt
similarity index 100%
rename from .changelog/19859.txt
rename to .archive/changelog/19859.txt
diff --git a/.changelog/19898.txt b/.archive/changelog/19898.txt
similarity index 100%
rename from .changelog/19898.txt
rename to .archive/changelog/19898.txt
diff --git a/.changelog/19899.txt b/.archive/changelog/19899.txt
similarity index 100%
rename from .changelog/19899.txt
rename to .archive/changelog/19899.txt
diff --git a/.changelog/19919.txt b/.archive/changelog/19919.txt
similarity index 100%
rename from .changelog/19919.txt
rename to .archive/changelog/19919.txt
diff --git a/.changelog/19944.txt b/.archive/changelog/19944.txt
similarity index 100%
rename from .changelog/19944.txt
rename to .archive/changelog/19944.txt
diff --git a/.changelog/19946.txt b/.archive/changelog/19946.txt
similarity index 100%
rename from .changelog/19946.txt
rename to .archive/changelog/19946.txt
diff --git a/.changelog/19954.txt b/.archive/changelog/19954.txt
similarity index 100%
rename from .changelog/19954.txt
rename to .archive/changelog/19954.txt
diff --git a/.changelog/19957.txt b/.archive/changelog/19957.txt
similarity index 100%
rename from .changelog/19957.txt
rename to .archive/changelog/19957.txt
diff --git a/.changelog/19967.txt b/.archive/changelog/19967.txt
similarity index 100%
rename from .changelog/19967.txt
rename to .archive/changelog/19967.txt
diff --git a/.changelog/19970.txt b/.archive/changelog/19970.txt
similarity index 100%
rename from .changelog/19970.txt
rename to .archive/changelog/19970.txt
diff --git a/.changelog/19975.txt b/.archive/changelog/19975.txt
similarity index 100%
rename from .changelog/19975.txt
rename to .archive/changelog/19975.txt
diff --git a/.changelog/19986.txt b/.archive/changelog/19986.txt
similarity index 100%
rename from .changelog/19986.txt
rename to .archive/changelog/19986.txt
diff --git a/.changelog/19994.txt b/.archive/changelog/19994.txt
similarity index 100%
rename from .changelog/19994.txt
rename to .archive/changelog/19994.txt
diff --git a/.changelog/20003.txt b/.archive/changelog/20003.txt
similarity index 100%
rename from .changelog/20003.txt
rename to .archive/changelog/20003.txt
diff --git a/.changelog/20009.txt b/.archive/changelog/20009.txt
similarity index 100%
rename from .changelog/20009.txt
rename to .archive/changelog/20009.txt
diff --git a/.changelog/20031.txt b/.archive/changelog/20031.txt
similarity index 100%
rename from .changelog/20031.txt
rename to .archive/changelog/20031.txt
diff --git a/.changelog/20054.txt b/.archive/changelog/20054.txt
similarity index 100%
rename from .changelog/20054.txt
rename to .archive/changelog/20054.txt
diff --git a/.changelog/20058.txt b/.archive/changelog/20058.txt
similarity index 100%
rename from .changelog/20058.txt
rename to .archive/changelog/20058.txt
diff --git a/.changelog/20065.txt b/.archive/changelog/20065.txt
similarity index 100%
rename from .changelog/20065.txt
rename to .archive/changelog/20065.txt
diff --git a/.changelog/20066.txt b/.archive/changelog/20066.txt
similarity index 100%
rename from .changelog/20066.txt
rename to .archive/changelog/20066.txt
diff --git a/.changelog/20068.txt b/.archive/changelog/20068.txt
similarity index 100%
rename from .changelog/20068.txt
rename to .archive/changelog/20068.txt
diff --git a/.changelog/20073.txt b/.archive/changelog/20073.txt
similarity index 100%
rename from .changelog/20073.txt
rename to .archive/changelog/20073.txt
diff --git a/.changelog/20082.txt b/.archive/changelog/20082.txt
similarity index 100%
rename from .changelog/20082.txt
rename to .archive/changelog/20082.txt
diff --git a/.changelog/20084.txt b/.archive/changelog/20084.txt
similarity index 100%
rename from .changelog/20084.txt
rename to .archive/changelog/20084.txt
diff --git a/.changelog/20108.txt b/.archive/changelog/20108.txt
similarity index 100%
rename from .changelog/20108.txt
rename to .archive/changelog/20108.txt
diff --git a/.changelog/20111.txt b/.archive/changelog/20111.txt
similarity index 100%
rename from .changelog/20111.txt
rename to .archive/changelog/20111.txt
diff --git a/.changelog/20122.txt b/.archive/changelog/20122.txt
similarity index 100%
rename from .changelog/20122.txt
rename to .archive/changelog/20122.txt
diff --git a/.changelog/20137.txt b/.archive/changelog/20137.txt
similarity index 100%
rename from .changelog/20137.txt
rename to .archive/changelog/20137.txt
diff --git a/.changelog/20149.txt b/.archive/changelog/20149.txt
similarity index 100%
rename from .changelog/20149.txt
rename to .archive/changelog/20149.txt
diff --git a/.changelog/20172.txt b/.archive/changelog/20172.txt
similarity index 100%
rename from .changelog/20172.txt
rename to .archive/changelog/20172.txt
diff --git a/.changelog/20179.txt b/.archive/changelog/20179.txt
similarity index 100%
rename from .changelog/20179.txt
rename to .archive/changelog/20179.txt
diff --git a/.changelog/20203.txt b/.archive/changelog/20203.txt
similarity index 100%
rename from .changelog/20203.txt
rename to .archive/changelog/20203.txt
diff --git a/.changelog/20207.txt b/.archive/changelog/20207.txt
similarity index 100%
rename from .changelog/20207.txt
rename to .archive/changelog/20207.txt
diff --git a/.changelog/20211.txt b/.archive/changelog/20211.txt
similarity index 100%
rename from .changelog/20211.txt
rename to .archive/changelog/20211.txt
diff --git a/.changelog/20222.txt b/.archive/changelog/20222.txt
similarity index 100%
rename from .changelog/20222.txt
rename to .archive/changelog/20222.txt
diff --git a/.changelog/20229.txt b/.archive/changelog/20229.txt
similarity index 100%
rename from .changelog/20229.txt
rename to .archive/changelog/20229.txt
diff --git a/.changelog/20232.txt b/.archive/changelog/20232.txt
similarity index 100%
rename from .changelog/20232.txt
rename to .archive/changelog/20232.txt
diff --git a/.changelog/20234.txt b/.archive/changelog/20234.txt
similarity index 100%
rename from .changelog/20234.txt
rename to .archive/changelog/20234.txt
diff --git a/.changelog/20254.txt b/.archive/changelog/20254.txt
similarity index 100%
rename from .changelog/20254.txt
rename to .archive/changelog/20254.txt
diff --git a/.changelog/20256.txt b/.archive/changelog/20256.txt
similarity index 100%
rename from .changelog/20256.txt
rename to .archive/changelog/20256.txt
diff --git a/.changelog/20265.txt b/.archive/changelog/20265.txt
similarity index 100%
rename from .changelog/20265.txt
rename to .archive/changelog/20265.txt
diff --git a/.changelog/20288.txt b/.archive/changelog/20288.txt
similarity index 100%
rename from .changelog/20288.txt
rename to .archive/changelog/20288.txt
diff --git a/.changelog/20293.txt b/.archive/changelog/20293.txt
similarity index 100%
rename from .changelog/20293.txt
rename to .archive/changelog/20293.txt
diff --git a/.changelog/20294.txt b/.archive/changelog/20294.txt
similarity index 100%
rename from .changelog/20294.txt
rename to .archive/changelog/20294.txt
diff --git a/.changelog/20302.txt b/.archive/changelog/20302.txt
similarity index 100%
rename from .changelog/20302.txt
rename to .archive/changelog/20302.txt
diff --git a/.changelog/20312.txt b/.archive/changelog/20312.txt
similarity index 100%
rename from .changelog/20312.txt
rename to .archive/changelog/20312.txt
diff --git a/.changelog/20315.txt b/.archive/changelog/20315.txt
similarity index 100%
rename from .changelog/20315.txt
rename to .archive/changelog/20315.txt
diff --git a/.changelog/20329.txt b/.archive/changelog/20329.txt
similarity index 100%
rename from .changelog/20329.txt
rename to .archive/changelog/20329.txt
diff --git a/.changelog/20336.txt b/.archive/changelog/20336.txt
similarity index 100%
rename from .changelog/20336.txt
rename to .archive/changelog/20336.txt
diff --git a/.changelog/20339.txt b/.archive/changelog/20339.txt
similarity index 100%
rename from .changelog/20339.txt
rename to .archive/changelog/20339.txt
diff --git a/.changelog/20342.txt b/.archive/changelog/20342.txt
similarity index 100%
rename from .changelog/20342.txt
rename to .archive/changelog/20342.txt
diff --git a/.changelog/20357.txt b/.archive/changelog/20357.txt
similarity index 100%
rename from .changelog/20357.txt
rename to .archive/changelog/20357.txt
diff --git a/.changelog/20364.txt b/.archive/changelog/20364.txt
similarity index 100%
rename from .changelog/20364.txt
rename to .archive/changelog/20364.txt
diff --git a/.changelog/20383.txt b/.archive/changelog/20383.txt
similarity index 100%
rename from .changelog/20383.txt
rename to .archive/changelog/20383.txt
diff --git a/.changelog/20406.txt b/.archive/changelog/20406.txt
similarity index 100%
rename from .changelog/20406.txt
rename to .archive/changelog/20406.txt
diff --git a/.changelog/20409.txt b/.archive/changelog/20409.txt
similarity index 100%
rename from .changelog/20409.txt
rename to .archive/changelog/20409.txt
diff --git a/.changelog/20420.txt b/.archive/changelog/20420.txt
similarity index 100%
rename from .changelog/20420.txt
rename to .archive/changelog/20420.txt
diff --git a/.changelog/20426.txt b/.archive/changelog/20426.txt
similarity index 100%
rename from .changelog/20426.txt
rename to .archive/changelog/20426.txt
diff --git a/.changelog/20437.txt b/.archive/changelog/20437.txt
similarity index 100%
rename from .changelog/20437.txt
rename to .archive/changelog/20437.txt
diff --git a/.changelog/20441.txt b/.archive/changelog/20441.txt
similarity index 100%
rename from .changelog/20441.txt
rename to .archive/changelog/20441.txt
diff --git a/.changelog/20457.txt b/.archive/changelog/20457.txt
similarity index 100%
rename from .changelog/20457.txt
rename to .archive/changelog/20457.txt
diff --git a/.changelog/20462.txt b/.archive/changelog/20462.txt
similarity index 100%
rename from .changelog/20462.txt
rename to .archive/changelog/20462.txt
diff --git a/.changelog/20463.txt b/.archive/changelog/20463.txt
similarity index 100%
rename from .changelog/20463.txt
rename to .archive/changelog/20463.txt
diff --git a/.changelog/20464.txt b/.archive/changelog/20464.txt
similarity index 100%
rename from .changelog/20464.txt
rename to .archive/changelog/20464.txt
diff --git a/.changelog/20467.txt b/.archive/changelog/20467.txt
similarity index 100%
rename from .changelog/20467.txt
rename to .archive/changelog/20467.txt
diff --git a/.changelog/20480.txt b/.archive/changelog/20480.txt
similarity index 100%
rename from .changelog/20480.txt
rename to .archive/changelog/20480.txt
diff --git a/.changelog/20482.txt b/.archive/changelog/20482.txt
similarity index 100%
rename from .changelog/20482.txt
rename to .archive/changelog/20482.txt
diff --git a/.changelog/20491.txt b/.archive/changelog/20491.txt
similarity index 100%
rename from .changelog/20491.txt
rename to .archive/changelog/20491.txt
diff --git a/.changelog/20526.txt b/.archive/changelog/20526.txt
similarity index 100%
rename from .changelog/20526.txt
rename to .archive/changelog/20526.txt
diff --git a/.changelog/20530.txt b/.archive/changelog/20530.txt
similarity index 100%
rename from .changelog/20530.txt
rename to .archive/changelog/20530.txt
diff --git a/.changelog/20533.txt b/.archive/changelog/20533.txt
similarity index 100%
rename from .changelog/20533.txt
rename to .archive/changelog/20533.txt
diff --git a/.changelog/20541.txt b/.archive/changelog/20541.txt
similarity index 100%
rename from .changelog/20541.txt
rename to .archive/changelog/20541.txt
diff --git a/.changelog/20543.txt b/.archive/changelog/20543.txt
similarity index 100%
rename from .changelog/20543.txt
rename to .archive/changelog/20543.txt
diff --git a/.changelog/20547.txt b/.archive/changelog/20547.txt
similarity index 100%
rename from .changelog/20547.txt
rename to .archive/changelog/20547.txt
diff --git a/.changelog/20555.txt b/.archive/changelog/20555.txt
similarity index 100%
rename from .changelog/20555.txt
rename to .archive/changelog/20555.txt
diff --git a/.changelog/20560.txt b/.archive/changelog/20560.txt
similarity index 100%
rename from .changelog/20560.txt
rename to .archive/changelog/20560.txt
diff --git a/.changelog/20561.txt b/.archive/changelog/20561.txt
similarity index 100%
rename from .changelog/20561.txt
rename to .archive/changelog/20561.txt
diff --git a/.changelog/20562.txt b/.archive/changelog/20562.txt
similarity index 100%
rename from .changelog/20562.txt
rename to .archive/changelog/20562.txt
diff --git a/.changelog/20564.txt b/.archive/changelog/20564.txt
similarity index 100%
rename from .changelog/20564.txt
rename to .archive/changelog/20564.txt
diff --git a/.changelog/20565.txt b/.archive/changelog/20565.txt
similarity index 100%
rename from .changelog/20565.txt
rename to .archive/changelog/20565.txt
diff --git a/.changelog/20568.txt b/.archive/changelog/20568.txt
similarity index 100%
rename from .changelog/20568.txt
rename to .archive/changelog/20568.txt
diff --git a/.changelog/20569.txt b/.archive/changelog/20569.txt
similarity index 100%
rename from .changelog/20569.txt
rename to .archive/changelog/20569.txt
diff --git a/.changelog/20570.txt b/.archive/changelog/20570.txt
similarity index 100%
rename from .changelog/20570.txt
rename to .archive/changelog/20570.txt
diff --git a/.changelog/20575.txt b/.archive/changelog/20575.txt
similarity index 100%
rename from .changelog/20575.txt
rename to .archive/changelog/20575.txt
diff --git a/.changelog/20579.txt b/.archive/changelog/20579.txt
similarity index 100%
rename from .changelog/20579.txt
rename to .archive/changelog/20579.txt
diff --git a/.changelog/20587.txt b/.archive/changelog/20587.txt
similarity index 100%
rename from .changelog/20587.txt
rename to .archive/changelog/20587.txt
diff --git a/.changelog/20593.txt b/.archive/changelog/20593.txt
similarity index 100%
rename from .changelog/20593.txt
rename to .archive/changelog/20593.txt
diff --git a/.changelog/20600.txt b/.archive/changelog/20600.txt
similarity index 100%
rename from .changelog/20600.txt
rename to .archive/changelog/20600.txt
diff --git a/.changelog/20614.txt b/.archive/changelog/20614.txt
similarity index 100%
rename from .changelog/20614.txt
rename to .archive/changelog/20614.txt
diff --git a/.changelog/20615.txt b/.archive/changelog/20615.txt
similarity index 100%
rename from .changelog/20615.txt
rename to .archive/changelog/20615.txt
diff --git a/.changelog/20625.txt b/.archive/changelog/20625.txt
similarity index 100%
rename from .changelog/20625.txt
rename to .archive/changelog/20625.txt
diff --git a/.changelog/20629.txt b/.archive/changelog/20629.txt
similarity index 100%
rename from .changelog/20629.txt
rename to .archive/changelog/20629.txt
diff --git a/.changelog/20638.txt b/.archive/changelog/20638.txt
similarity index 100%
rename from .changelog/20638.txt
rename to .archive/changelog/20638.txt
diff --git a/.changelog/20642.txt b/.archive/changelog/20642.txt
similarity index 100%
rename from .changelog/20642.txt
rename to .archive/changelog/20642.txt
diff --git a/.changelog/20643.txt b/.archive/changelog/20643.txt
similarity index 100%
rename from .changelog/20643.txt
rename to .archive/changelog/20643.txt
diff --git a/.changelog/20652.txt b/.archive/changelog/20652.txt
similarity index 100%
rename from .changelog/20652.txt
rename to .archive/changelog/20652.txt
diff --git a/.changelog/20653.txt b/.archive/changelog/20653.txt
similarity index 100%
rename from .changelog/20653.txt
rename to .archive/changelog/20653.txt
diff --git a/.changelog/20658.txt b/.archive/changelog/20658.txt
similarity index 100%
rename from .changelog/20658.txt
rename to .archive/changelog/20658.txt
diff --git a/.changelog/20661.txt b/.archive/changelog/20661.txt
similarity index 100%
rename from .changelog/20661.txt
rename to .archive/changelog/20661.txt
diff --git a/.changelog/20664.txt b/.archive/changelog/20664.txt
similarity index 100%
rename from .changelog/20664.txt
rename to .archive/changelog/20664.txt
diff --git a/.changelog/20666.txt b/.archive/changelog/20666.txt
similarity index 100%
rename from .changelog/20666.txt
rename to .archive/changelog/20666.txt
diff --git a/.changelog/20667.txt b/.archive/changelog/20667.txt
similarity index 100%
rename from .changelog/20667.txt
rename to .archive/changelog/20667.txt
diff --git a/.changelog/20671.txt b/.archive/changelog/20671.txt
similarity index 100%
rename from .changelog/20671.txt
rename to .archive/changelog/20671.txt
diff --git a/.changelog/20676.txt b/.archive/changelog/20676.txt
similarity index 100%
rename from .changelog/20676.txt
rename to .archive/changelog/20676.txt
diff --git a/.changelog/20677.txt b/.archive/changelog/20677.txt
similarity index 100%
rename from .changelog/20677.txt
rename to .archive/changelog/20677.txt
diff --git a/.changelog/20687.txt b/.archive/changelog/20687.txt
similarity index 100%
rename from .changelog/20687.txt
rename to .archive/changelog/20687.txt
diff --git a/.changelog/20688.txt b/.archive/changelog/20688.txt
similarity index 100%
rename from .changelog/20688.txt
rename to .archive/changelog/20688.txt
diff --git a/.changelog/20689.txt b/.archive/changelog/20689.txt
similarity index 100%
rename from .changelog/20689.txt
rename to .archive/changelog/20689.txt
diff --git a/.changelog/20691.txt b/.archive/changelog/20691.txt
similarity index 100%
rename from .changelog/20691.txt
rename to .archive/changelog/20691.txt
diff --git a/.changelog/20707.txt b/.archive/changelog/20707.txt
similarity index 100%
rename from .changelog/20707.txt
rename to .archive/changelog/20707.txt
diff --git a/.changelog/20708.txt b/.archive/changelog/20708.txt
similarity index 100%
rename from .changelog/20708.txt
rename to .archive/changelog/20708.txt
diff --git a/.changelog/20709.txt b/.archive/changelog/20709.txt
similarity index 100%
rename from .changelog/20709.txt
rename to .archive/changelog/20709.txt
diff --git a/.changelog/20710.txt b/.archive/changelog/20710.txt
similarity index 100%
rename from .changelog/20710.txt
rename to .archive/changelog/20710.txt
diff --git a/.changelog/20711.txt b/.archive/changelog/20711.txt
similarity index 100%
rename from .changelog/20711.txt
rename to .archive/changelog/20711.txt
diff --git a/.changelog/20720.txt b/.archive/changelog/20720.txt
similarity index 100%
rename from .changelog/20720.txt
rename to .archive/changelog/20720.txt
diff --git a/.changelog/20731.txt b/.archive/changelog/20731.txt
similarity index 100%
rename from .changelog/20731.txt
rename to .archive/changelog/20731.txt
diff --git a/.changelog/20769.txt b/.archive/changelog/20769.txt
similarity index 100%
rename from .changelog/20769.txt
rename to .archive/changelog/20769.txt
diff --git a/.changelog/20775.txt b/.archive/changelog/20775.txt
similarity index 100%
rename from .changelog/20775.txt
rename to .archive/changelog/20775.txt
diff --git a/.changelog/20777.txt b/.archive/changelog/20777.txt
similarity index 100%
rename from .changelog/20777.txt
rename to .archive/changelog/20777.txt
diff --git a/.changelog/20779.txt b/.archive/changelog/20779.txt
similarity index 100%
rename from .changelog/20779.txt
rename to .archive/changelog/20779.txt
diff --git a/.changelog/20785.txt b/.archive/changelog/20785.txt
similarity index 100%
rename from .changelog/20785.txt
rename to .archive/changelog/20785.txt
diff --git a/.changelog/20791.txt b/.archive/changelog/20791.txt
similarity index 100%
rename from .changelog/20791.txt
rename to .archive/changelog/20791.txt
diff --git a/.changelog/20795.txt b/.archive/changelog/20795.txt
similarity index 100%
rename from .changelog/20795.txt
rename to .archive/changelog/20795.txt
diff --git a/.changelog/20796.txt b/.archive/changelog/20796.txt
similarity index 100%
rename from .changelog/20796.txt
rename to .archive/changelog/20796.txt
diff --git a/.changelog/20797.txt b/.archive/changelog/20797.txt
similarity index 100%
rename from .changelog/20797.txt
rename to .archive/changelog/20797.txt
diff --git a/.changelog/20806.txt b/.archive/changelog/20806.txt
similarity index 100%
rename from .changelog/20806.txt
rename to .archive/changelog/20806.txt
diff --git a/.changelog/20809.txt b/.archive/changelog/20809.txt
similarity index 100%
rename from .changelog/20809.txt
rename to .archive/changelog/20809.txt
diff --git a/.changelog/20812.txt b/.archive/changelog/20812.txt
similarity index 100%
rename from .changelog/20812.txt
rename to .archive/changelog/20812.txt
diff --git a/.changelog/20819.txt b/.archive/changelog/20819.txt
similarity index 100%
rename from .changelog/20819.txt
rename to .archive/changelog/20819.txt
diff --git a/.changelog/20825.txt b/.archive/changelog/20825.txt
similarity index 100%
rename from .changelog/20825.txt
rename to .archive/changelog/20825.txt
diff --git a/.changelog/20838.txt b/.archive/changelog/20838.txt
similarity index 100%
rename from .changelog/20838.txt
rename to .archive/changelog/20838.txt
diff --git a/.changelog/20842.txt b/.archive/changelog/20842.txt
similarity index 100%
rename from .changelog/20842.txt
rename to .archive/changelog/20842.txt
diff --git a/.changelog/20857.txt b/.archive/changelog/20857.txt
similarity index 100%
rename from .changelog/20857.txt
rename to .archive/changelog/20857.txt
diff --git a/.changelog/20861.txt b/.archive/changelog/20861.txt
similarity index 100%
rename from .changelog/20861.txt
rename to .archive/changelog/20861.txt
diff --git a/.changelog/20863.txt b/.archive/changelog/20863.txt
similarity index 100%
rename from .changelog/20863.txt
rename to .archive/changelog/20863.txt
diff --git a/.changelog/20871.txt b/.archive/changelog/20871.txt
similarity index 100%
rename from .changelog/20871.txt
rename to .archive/changelog/20871.txt
diff --git a/.changelog/20874.txt b/.archive/changelog/20874.txt
similarity index 100%
rename from .changelog/20874.txt
rename to .archive/changelog/20874.txt
diff --git a/.changelog/20877.txt b/.archive/changelog/20877.txt
similarity index 100%
rename from .changelog/20877.txt
rename to .archive/changelog/20877.txt
diff --git a/.changelog/20891.txt b/.archive/changelog/20891.txt
similarity index 100%
rename from .changelog/20891.txt
rename to .archive/changelog/20891.txt
diff --git a/.changelog/20892.txt b/.archive/changelog/20892.txt
similarity index 100%
rename from .changelog/20892.txt
rename to .archive/changelog/20892.txt
diff --git a/.changelog/20904.txt b/.archive/changelog/20904.txt
similarity index 100%
rename from .changelog/20904.txt
rename to .archive/changelog/20904.txt
diff --git a/.changelog/20912.txt b/.archive/changelog/20912.txt
similarity index 100%
rename from .changelog/20912.txt
rename to .archive/changelog/20912.txt
diff --git a/.changelog/20913.txt b/.archive/changelog/20913.txt
similarity index 100%
rename from .changelog/20913.txt
rename to .archive/changelog/20913.txt
diff --git a/.changelog/20914.txt b/.archive/changelog/20914.txt
similarity index 100%
rename from .changelog/20914.txt
rename to .archive/changelog/20914.txt
diff --git a/.changelog/20926.txt b/.archive/changelog/20926.txt
similarity index 100%
rename from .changelog/20926.txt
rename to .archive/changelog/20926.txt
diff --git a/.changelog/20933.txt b/.archive/changelog/20933.txt
similarity index 100%
rename from .changelog/20933.txt
rename to .archive/changelog/20933.txt
diff --git a/.changelog/20951.txt b/.archive/changelog/20951.txt
similarity index 100%
rename from .changelog/20951.txt
rename to .archive/changelog/20951.txt
diff --git a/.changelog/20952.txt b/.archive/changelog/20952.txt
similarity index 100%
rename from .changelog/20952.txt
rename to .archive/changelog/20952.txt
diff --git a/.changelog/20971.txt b/.archive/changelog/20971.txt
similarity index 100%
rename from .changelog/20971.txt
rename to .archive/changelog/20971.txt
diff --git a/.changelog/20978.txt b/.archive/changelog/20978.txt
similarity index 100%
rename from .changelog/20978.txt
rename to .archive/changelog/20978.txt
diff --git a/.changelog/21005.txt b/.archive/changelog/21005.txt
similarity index 100%
rename from .changelog/21005.txt
rename to .archive/changelog/21005.txt
diff --git a/.changelog/21008.txt b/.archive/changelog/21008.txt
similarity index 100%
rename from .changelog/21008.txt
rename to .archive/changelog/21008.txt
diff --git a/.changelog/21015.txt b/.archive/changelog/21015.txt
similarity index 100%
rename from .changelog/21015.txt
rename to .archive/changelog/21015.txt
diff --git a/.changelog/21025.txt b/.archive/changelog/21025.txt
similarity index 100%
rename from .changelog/21025.txt
rename to .archive/changelog/21025.txt
diff --git a/.changelog/21034.txt b/.archive/changelog/21034.txt
similarity index 100%
rename from .changelog/21034.txt
rename to .archive/changelog/21034.txt
diff --git a/.changelog/21036.txt b/.archive/changelog/21036.txt
similarity index 100%
rename from .changelog/21036.txt
rename to .archive/changelog/21036.txt
diff --git a/.changelog/21037.txt b/.archive/changelog/21037.txt
similarity index 100%
rename from .changelog/21037.txt
rename to .archive/changelog/21037.txt
diff --git a/.changelog/21041.txt b/.archive/changelog/21041.txt
similarity index 100%
rename from .changelog/21041.txt
rename to .archive/changelog/21041.txt
diff --git a/.changelog/21053.txt b/.archive/changelog/21053.txt
similarity index 100%
rename from .changelog/21053.txt
rename to .archive/changelog/21053.txt
diff --git a/.changelog/21054.txt b/.archive/changelog/21054.txt
similarity index 100%
rename from .changelog/21054.txt
rename to .archive/changelog/21054.txt
diff --git a/.changelog/21060.txt b/.archive/changelog/21060.txt
similarity index 100%
rename from .changelog/21060.txt
rename to .archive/changelog/21060.txt
diff --git a/.changelog/21062.txt b/.archive/changelog/21062.txt
similarity index 100%
rename from .changelog/21062.txt
rename to .archive/changelog/21062.txt
diff --git a/.changelog/21076.txt b/.archive/changelog/21076.txt
similarity index 100%
rename from .changelog/21076.txt
rename to .archive/changelog/21076.txt
diff --git a/.changelog/21077.txt b/.archive/changelog/21077.txt
similarity index 100%
rename from .changelog/21077.txt
rename to .archive/changelog/21077.txt
diff --git a/.changelog/21085.txt b/.archive/changelog/21085.txt
similarity index 100%
rename from .changelog/21085.txt
rename to .archive/changelog/21085.txt
diff --git a/.changelog/21091.txt b/.archive/changelog/21091.txt
similarity index 100%
rename from .changelog/21091.txt
rename to .archive/changelog/21091.txt
diff --git a/.changelog/21094.txt b/.archive/changelog/21094.txt
similarity index 100%
rename from .changelog/21094.txt
rename to .archive/changelog/21094.txt
diff --git a/.changelog/21097.txt b/.archive/changelog/21097.txt
similarity index 100%
rename from .changelog/21097.txt
rename to .archive/changelog/21097.txt
diff --git a/.changelog/21110.txt b/.archive/changelog/21110.txt
similarity index 100%
rename from .changelog/21110.txt
rename to .archive/changelog/21110.txt
diff --git a/.changelog/21122.txt b/.archive/changelog/21122.txt
similarity index 100%
rename from .changelog/21122.txt
rename to .archive/changelog/21122.txt
diff --git a/.changelog/21125.txt b/.archive/changelog/21125.txt
similarity index 100%
rename from .changelog/21125.txt
rename to .archive/changelog/21125.txt
diff --git a/.changelog/21130.txt b/.archive/changelog/21130.txt
similarity index 100%
rename from .changelog/21130.txt
rename to .archive/changelog/21130.txt
diff --git a/.changelog/21144.txt b/.archive/changelog/21144.txt
similarity index 100%
rename from .changelog/21144.txt
rename to .archive/changelog/21144.txt
diff --git a/.changelog/21161.txt b/.archive/changelog/21161.txt
similarity index 100%
rename from .changelog/21161.txt
rename to .archive/changelog/21161.txt
diff --git a/.changelog/21162.txt b/.archive/changelog/21162.txt
similarity index 100%
rename from .changelog/21162.txt
rename to .archive/changelog/21162.txt
diff --git a/.changelog/21163.txt b/.archive/changelog/21163.txt
similarity index 100%
rename from .changelog/21163.txt
rename to .archive/changelog/21163.txt
diff --git a/.changelog/21174.txt b/.archive/changelog/21174.txt
similarity index 100%
rename from .changelog/21174.txt
rename to .archive/changelog/21174.txt
diff --git a/.changelog/21176.txt b/.archive/changelog/21176.txt
similarity index 100%
rename from .changelog/21176.txt
rename to .archive/changelog/21176.txt
diff --git a/.changelog/21185.txt b/.archive/changelog/21185.txt
similarity index 100%
rename from .changelog/21185.txt
rename to .archive/changelog/21185.txt
diff --git a/.changelog/21187.txt b/.archive/changelog/21187.txt
similarity index 100%
rename from .changelog/21187.txt
rename to .archive/changelog/21187.txt
diff --git a/.changelog/21188.txt b/.archive/changelog/21188.txt
similarity index 100%
rename from .changelog/21188.txt
rename to .archive/changelog/21188.txt
diff --git a/.changelog/21193.txt b/.archive/changelog/21193.txt
similarity index 100%
rename from .changelog/21193.txt
rename to .archive/changelog/21193.txt
diff --git a/.changelog/21201.txt b/.archive/changelog/21201.txt
similarity index 100%
rename from .changelog/21201.txt
rename to .archive/changelog/21201.txt
diff --git a/.changelog/21219.txt b/.archive/changelog/21219.txt
similarity index 100%
rename from .changelog/21219.txt
rename to .archive/changelog/21219.txt
diff --git a/.changelog/21226.txt b/.archive/changelog/21226.txt
similarity index 100%
rename from .changelog/21226.txt
rename to .archive/changelog/21226.txt
diff --git a/.changelog/21227.txt b/.archive/changelog/21227.txt
similarity index 100%
rename from .changelog/21227.txt
rename to .archive/changelog/21227.txt
diff --git a/.changelog/21231.txt b/.archive/changelog/21231.txt
similarity index 100%
rename from .changelog/21231.txt
rename to .archive/changelog/21231.txt
diff --git a/.changelog/21234.txt b/.archive/changelog/21234.txt
similarity index 100%
rename from .changelog/21234.txt
rename to .archive/changelog/21234.txt
diff --git a/.changelog/21239.txt b/.archive/changelog/21239.txt
similarity index 100%
rename from .changelog/21239.txt
rename to .archive/changelog/21239.txt
diff --git a/.changelog/21250.txt b/.archive/changelog/21250.txt
similarity index 100%
rename from .changelog/21250.txt
rename to .archive/changelog/21250.txt
diff --git a/.changelog/21254.txt b/.archive/changelog/21254.txt
similarity index 100%
rename from .changelog/21254.txt
rename to .archive/changelog/21254.txt
diff --git a/.changelog/21265.txt b/.archive/changelog/21265.txt
similarity index 100%
rename from .changelog/21265.txt
rename to .archive/changelog/21265.txt
diff --git a/.changelog/21276.txt b/.archive/changelog/21276.txt
similarity index 100%
rename from .changelog/21276.txt
rename to .archive/changelog/21276.txt
diff --git a/.changelog/21285.txt b/.archive/changelog/21285.txt
similarity index 100%
rename from .changelog/21285.txt
rename to .archive/changelog/21285.txt
diff --git a/.changelog/21293.txt b/.archive/changelog/21293.txt
similarity index 100%
rename from .changelog/21293.txt
rename to .archive/changelog/21293.txt
diff --git a/.changelog/21295.txt b/.archive/changelog/21295.txt
similarity index 100%
rename from .changelog/21295.txt
rename to .archive/changelog/21295.txt
diff --git a/.changelog/21299.txt b/.archive/changelog/21299.txt
similarity index 100%
rename from .changelog/21299.txt
rename to .archive/changelog/21299.txt
diff --git a/.changelog/21303.txt b/.archive/changelog/21303.txt
similarity index 100%
rename from .changelog/21303.txt
rename to .archive/changelog/21303.txt
diff --git a/.changelog/21315.txt b/.archive/changelog/21315.txt
similarity index 100%
rename from .changelog/21315.txt
rename to .archive/changelog/21315.txt
diff --git a/.changelog/21334.txt b/.archive/changelog/21334.txt
similarity index 100%
rename from .changelog/21334.txt
rename to .archive/changelog/21334.txt
diff --git a/.changelog/21335.txt b/.archive/changelog/21335.txt
similarity index 100%
rename from .changelog/21335.txt
rename to .archive/changelog/21335.txt
diff --git a/.changelog/21337.txt b/.archive/changelog/21337.txt
similarity index 100%
rename from .changelog/21337.txt
rename to .archive/changelog/21337.txt
diff --git a/.changelog/21338.txt b/.archive/changelog/21338.txt
similarity index 100%
rename from .changelog/21338.txt
rename to .archive/changelog/21338.txt
diff --git a/.changelog/21341.txt b/.archive/changelog/21341.txt
similarity index 100%
rename from .changelog/21341.txt
rename to .archive/changelog/21341.txt
diff --git a/.changelog/21362.txt b/.archive/changelog/21362.txt
similarity index 100%
rename from .changelog/21362.txt
rename to .archive/changelog/21362.txt
diff --git a/.changelog/21363.txt b/.archive/changelog/21363.txt
similarity index 100%
rename from .changelog/21363.txt
rename to .archive/changelog/21363.txt
diff --git a/.changelog/21369.txt b/.archive/changelog/21369.txt
similarity index 100%
rename from .changelog/21369.txt
rename to .archive/changelog/21369.txt
diff --git a/.changelog/21373.txt b/.archive/changelog/21373.txt
similarity index 100%
rename from .changelog/21373.txt
rename to .archive/changelog/21373.txt
diff --git a/.changelog/21404.txt b/.archive/changelog/21404.txt
similarity index 100%
rename from .changelog/21404.txt
rename to .archive/changelog/21404.txt
diff --git a/.changelog/21431.txt b/.archive/changelog/21431.txt
similarity index 100%
rename from .changelog/21431.txt
rename to .archive/changelog/21431.txt
diff --git a/.changelog/21434.txt b/.archive/changelog/21434.txt
similarity index 100%
rename from .changelog/21434.txt
rename to .archive/changelog/21434.txt
diff --git a/.changelog/21452.txt b/.archive/changelog/21452.txt
similarity index 100%
rename from .changelog/21452.txt
rename to .archive/changelog/21452.txt
diff --git a/.changelog/21458.txt b/.archive/changelog/21458.txt
similarity index 100%
rename from .changelog/21458.txt
rename to .archive/changelog/21458.txt
diff --git a/.changelog/21459.txt b/.archive/changelog/21459.txt
similarity index 100%
rename from .changelog/21459.txt
rename to .archive/changelog/21459.txt
diff --git a/.changelog/21461.txt b/.archive/changelog/21461.txt
similarity index 100%
rename from .changelog/21461.txt
rename to .archive/changelog/21461.txt
diff --git a/.changelog/21465.txt b/.archive/changelog/21465.txt
similarity index 100%
rename from .changelog/21465.txt
rename to .archive/changelog/21465.txt
diff --git a/.changelog/21467.txt b/.archive/changelog/21467.txt
similarity index 100%
rename from .changelog/21467.txt
rename to .archive/changelog/21467.txt
diff --git a/.changelog/21470.txt b/.archive/changelog/21470.txt
similarity index 100%
rename from .changelog/21470.txt
rename to .archive/changelog/21470.txt
diff --git a/.changelog/21480.txt b/.archive/changelog/21480.txt
similarity index 100%
rename from .changelog/21480.txt
rename to .archive/changelog/21480.txt
diff --git a/.changelog/21482.txt b/.archive/changelog/21482.txt
similarity index 100%
rename from .changelog/21482.txt
rename to .archive/changelog/21482.txt
diff --git a/.changelog/21484.txt b/.archive/changelog/21484.txt
similarity index 100%
rename from .changelog/21484.txt
rename to .archive/changelog/21484.txt
diff --git a/.changelog/21485.txt b/.archive/changelog/21485.txt
similarity index 100%
rename from .changelog/21485.txt
rename to .archive/changelog/21485.txt
diff --git a/.changelog/21505.txt b/.archive/changelog/21505.txt
similarity index 100%
rename from .changelog/21505.txt
rename to .archive/changelog/21505.txt
diff --git a/.changelog/21508.txt b/.archive/changelog/21508.txt
similarity index 100%
rename from .changelog/21508.txt
rename to .archive/changelog/21508.txt
diff --git a/.changelog/21509.txt b/.archive/changelog/21509.txt
similarity index 100%
rename from .changelog/21509.txt
rename to .archive/changelog/21509.txt
diff --git a/.changelog/21531.txt b/.archive/changelog/21531.txt
similarity index 100%
rename from .changelog/21531.txt
rename to .archive/changelog/21531.txt
diff --git a/.changelog/21534.txt b/.archive/changelog/21534.txt
similarity index 100%
rename from .changelog/21534.txt
rename to .archive/changelog/21534.txt
diff --git a/.changelog/21542.txt b/.archive/changelog/21542.txt
similarity index 100%
rename from .changelog/21542.txt
rename to .archive/changelog/21542.txt
diff --git a/.changelog/21555.txt b/.archive/changelog/21555.txt
similarity index 100%
rename from .changelog/21555.txt
rename to .archive/changelog/21555.txt
diff --git a/.changelog/21556.txt b/.archive/changelog/21556.txt
similarity index 100%
rename from .changelog/21556.txt
rename to .archive/changelog/21556.txt
diff --git a/.changelog/21560.txt b/.archive/changelog/21560.txt
similarity index 100%
rename from .changelog/21560.txt
rename to .archive/changelog/21560.txt
diff --git a/.changelog/21565.txt b/.archive/changelog/21565.txt
similarity index 100%
rename from .changelog/21565.txt
rename to .archive/changelog/21565.txt
diff --git a/.changelog/21616.txt b/.archive/changelog/21616.txt
similarity index 100%
rename from .changelog/21616.txt
rename to .archive/changelog/21616.txt
diff --git a/.changelog/21620.txt b/.archive/changelog/21620.txt
similarity index 100%
rename from .changelog/21620.txt
rename to .archive/changelog/21620.txt
diff --git a/.changelog/21639.txt b/.archive/changelog/21639.txt
similarity index 100%
rename from .changelog/21639.txt
rename to .archive/changelog/21639.txt
diff --git a/.changelog/21641.txt b/.archive/changelog/21641.txt
similarity index 100%
rename from .changelog/21641.txt
rename to .archive/changelog/21641.txt
diff --git a/.changelog/21652.txt b/.archive/changelog/21652.txt
similarity index 100%
rename from .changelog/21652.txt
rename to .archive/changelog/21652.txt
diff --git a/.changelog/21657.txt b/.archive/changelog/21657.txt
similarity index 100%
rename from .changelog/21657.txt
rename to .archive/changelog/21657.txt
diff --git a/.changelog/21661.txt b/.archive/changelog/21661.txt
similarity index 100%
rename from .changelog/21661.txt
rename to .archive/changelog/21661.txt
diff --git a/.changelog/21669.txt b/.archive/changelog/21669.txt
similarity index 100%
rename from .changelog/21669.txt
rename to .archive/changelog/21669.txt
diff --git a/.changelog/21694.txt b/.archive/changelog/21694.txt
similarity index 100%
rename from .changelog/21694.txt
rename to .archive/changelog/21694.txt
diff --git a/.changelog/21702.txt b/.archive/changelog/21702.txt
similarity index 100%
rename from .changelog/21702.txt
rename to .archive/changelog/21702.txt
diff --git a/.changelog/21710.txt b/.archive/changelog/21710.txt
similarity index 100%
rename from .changelog/21710.txt
rename to .archive/changelog/21710.txt
diff --git a/.changelog/21717.txt b/.archive/changelog/21717.txt
similarity index 100%
rename from .changelog/21717.txt
rename to .archive/changelog/21717.txt
diff --git a/.changelog/21727.txt b/.archive/changelog/21727.txt
similarity index 100%
rename from .changelog/21727.txt
rename to .archive/changelog/21727.txt
diff --git a/.changelog/21732.txt b/.archive/changelog/21732.txt
similarity index 100%
rename from .changelog/21732.txt
rename to .archive/changelog/21732.txt
diff --git a/.changelog/21737.txt b/.archive/changelog/21737.txt
similarity index 100%
rename from .changelog/21737.txt
rename to .archive/changelog/21737.txt
diff --git a/.changelog/21738.txt b/.archive/changelog/21738.txt
similarity index 100%
rename from .changelog/21738.txt
rename to .archive/changelog/21738.txt
diff --git a/.changelog/21743.txt b/.archive/changelog/21743.txt
similarity index 100%
rename from .changelog/21743.txt
rename to .archive/changelog/21743.txt
diff --git a/.changelog/21760.txt b/.archive/changelog/21760.txt
similarity index 100%
rename from .changelog/21760.txt
rename to .archive/changelog/21760.txt
diff --git a/.changelog/21763.txt b/.archive/changelog/21763.txt
similarity index 100%
rename from .changelog/21763.txt
rename to .archive/changelog/21763.txt
diff --git a/.changelog/21765.txt b/.archive/changelog/21765.txt
similarity index 100%
rename from .changelog/21765.txt
rename to .archive/changelog/21765.txt
diff --git a/.changelog/21766.txt b/.archive/changelog/21766.txt
similarity index 100%
rename from .changelog/21766.txt
rename to .archive/changelog/21766.txt
diff --git a/.changelog/21767.txt b/.archive/changelog/21767.txt
similarity index 100%
rename from .changelog/21767.txt
rename to .archive/changelog/21767.txt
diff --git a/.changelog/21769.txt b/.archive/changelog/21769.txt
similarity index 100%
rename from .changelog/21769.txt
rename to .archive/changelog/21769.txt
diff --git a/.changelog/21773.txt b/.archive/changelog/21773.txt
similarity index 100%
rename from .changelog/21773.txt
rename to .archive/changelog/21773.txt
diff --git a/.changelog/21776.txt b/.archive/changelog/21776.txt
similarity index 100%
rename from .changelog/21776.txt
rename to .archive/changelog/21776.txt
diff --git a/.changelog/21777.txt b/.archive/changelog/21777.txt
similarity index 100%
rename from .changelog/21777.txt
rename to .archive/changelog/21777.txt
diff --git a/.changelog/21780.txt b/.archive/changelog/21780.txt
similarity index 100%
rename from .changelog/21780.txt
rename to .archive/changelog/21780.txt
diff --git a/.changelog/21789.txt b/.archive/changelog/21789.txt
similarity index 100%
rename from .changelog/21789.txt
rename to .archive/changelog/21789.txt
diff --git a/.changelog/21793.txt b/.archive/changelog/21793.txt
similarity index 100%
rename from .changelog/21793.txt
rename to .archive/changelog/21793.txt
diff --git a/.changelog/21794.txt b/.archive/changelog/21794.txt
similarity index 100%
rename from .changelog/21794.txt
rename to .archive/changelog/21794.txt
diff --git a/.changelog/21797.txt b/.archive/changelog/21797.txt
similarity index 100%
rename from .changelog/21797.txt
rename to .archive/changelog/21797.txt
diff --git a/.changelog/21799.txt b/.archive/changelog/21799.txt
similarity index 100%
rename from .changelog/21799.txt
rename to .archive/changelog/21799.txt
diff --git a/.changelog/21803.txt b/.archive/changelog/21803.txt
similarity index 100%
rename from .changelog/21803.txt
rename to .archive/changelog/21803.txt
diff --git a/.changelog/21814.txt b/.archive/changelog/21814.txt
similarity index 100%
rename from .changelog/21814.txt
rename to .archive/changelog/21814.txt
diff --git a/.changelog/21825.txt b/.archive/changelog/21825.txt
similarity index 100%
rename from .changelog/21825.txt
rename to .archive/changelog/21825.txt
diff --git a/.changelog/21831.txt b/.archive/changelog/21831.txt
similarity index 100%
rename from .changelog/21831.txt
rename to .archive/changelog/21831.txt
diff --git a/.changelog/21837.txt b/.archive/changelog/21837.txt
similarity index 100%
rename from .changelog/21837.txt
rename to .archive/changelog/21837.txt
diff --git a/.changelog/21838.txt b/.archive/changelog/21838.txt
similarity index 100%
rename from .changelog/21838.txt
rename to .archive/changelog/21838.txt
diff --git a/.changelog/21846.txt b/.archive/changelog/21846.txt
similarity index 100%
rename from .changelog/21846.txt
rename to .archive/changelog/21846.txt
diff --git a/.changelog/21850.txt b/.archive/changelog/21850.txt
similarity index 100%
rename from .changelog/21850.txt
rename to .archive/changelog/21850.txt
diff --git a/.changelog/21855.txt b/.archive/changelog/21855.txt
similarity index 100%
rename from .changelog/21855.txt
rename to .archive/changelog/21855.txt
diff --git a/.changelog/21856.txt b/.archive/changelog/21856.txt
similarity index 100%
rename from .changelog/21856.txt
rename to .archive/changelog/21856.txt
diff --git a/.changelog/21881.txt b/.archive/changelog/21881.txt
similarity index 100%
rename from .changelog/21881.txt
rename to .archive/changelog/21881.txt
diff --git a/.changelog/21882.txt b/.archive/changelog/21882.txt
similarity index 100%
rename from .changelog/21882.txt
rename to .archive/changelog/21882.txt
diff --git a/.changelog/21884.txt b/.archive/changelog/21884.txt
similarity index 100%
rename from .changelog/21884.txt
rename to .archive/changelog/21884.txt
diff --git a/.changelog/21888.txt b/.archive/changelog/21888.txt
similarity index 100%
rename from .changelog/21888.txt
rename to .archive/changelog/21888.txt
diff --git a/.changelog/21889.txt b/.archive/changelog/21889.txt
similarity index 100%
rename from .changelog/21889.txt
rename to .archive/changelog/21889.txt
diff --git a/.changelog/21900.txt b/.archive/changelog/21900.txt
similarity index 100%
rename from .changelog/21900.txt
rename to .archive/changelog/21900.txt
diff --git a/.changelog/21901.txt b/.archive/changelog/21901.txt
similarity index 100%
rename from .changelog/21901.txt
rename to .archive/changelog/21901.txt
diff --git a/.changelog/21916.txt b/.archive/changelog/21916.txt
similarity index 100%
rename from .changelog/21916.txt
rename to .archive/changelog/21916.txt
diff --git a/.changelog/21934.txt b/.archive/changelog/21934.txt
similarity index 100%
rename from .changelog/21934.txt
rename to .archive/changelog/21934.txt
diff --git a/.changelog/21937.txt b/.archive/changelog/21937.txt
similarity index 100%
rename from .changelog/21937.txt
rename to .archive/changelog/21937.txt
diff --git a/.changelog/21941.txt b/.archive/changelog/21941.txt
similarity index 100%
rename from .changelog/21941.txt
rename to .archive/changelog/21941.txt
diff --git a/.changelog/21943.txt b/.archive/changelog/21943.txt
similarity index 100%
rename from .changelog/21943.txt
rename to .archive/changelog/21943.txt
diff --git a/.changelog/21954.txt b/.archive/changelog/21954.txt
similarity index 100%
rename from .changelog/21954.txt
rename to .archive/changelog/21954.txt
diff --git a/.changelog/21955.txt b/.archive/changelog/21955.txt
similarity index 100%
rename from .changelog/21955.txt
rename to .archive/changelog/21955.txt
diff --git a/.changelog/21960.txt b/.archive/changelog/21960.txt
similarity index 100%
rename from .changelog/21960.txt
rename to .archive/changelog/21960.txt
diff --git a/.changelog/21963.txt b/.archive/changelog/21963.txt
similarity index 100%
rename from .changelog/21963.txt
rename to .archive/changelog/21963.txt
diff --git a/.changelog/21966.txt b/.archive/changelog/21966.txt
similarity index 100%
rename from .changelog/21966.txt
rename to .archive/changelog/21966.txt
diff --git a/.changelog/21969.txt b/.archive/changelog/21969.txt
similarity index 100%
rename from .changelog/21969.txt
rename to .archive/changelog/21969.txt
diff --git a/.changelog/21983.txt b/.archive/changelog/21983.txt
similarity index 100%
rename from .changelog/21983.txt
rename to .archive/changelog/21983.txt
diff --git a/.changelog/21990.txt b/.archive/changelog/21990.txt
similarity index 100%
rename from .changelog/21990.txt
rename to .archive/changelog/21990.txt
diff --git a/.changelog/21993.txt b/.archive/changelog/21993.txt
similarity index 100%
rename from .changelog/21993.txt
rename to .archive/changelog/21993.txt
diff --git a/.changelog/21997.txt b/.archive/changelog/21997.txt
similarity index 100%
rename from .changelog/21997.txt
rename to .archive/changelog/21997.txt
diff --git a/.changelog/21998.txt b/.archive/changelog/21998.txt
similarity index 100%
rename from .changelog/21998.txt
rename to .archive/changelog/21998.txt
diff --git a/.changelog/22002.txt b/.archive/changelog/22002.txt
similarity index 100%
rename from .changelog/22002.txt
rename to .archive/changelog/22002.txt
diff --git a/.changelog/22004.txt b/.archive/changelog/22004.txt
similarity index 100%
rename from .changelog/22004.txt
rename to .archive/changelog/22004.txt
diff --git a/.changelog/22016.txt b/.archive/changelog/22016.txt
similarity index 100%
rename from .changelog/22016.txt
rename to .archive/changelog/22016.txt
diff --git a/.changelog/22021.txt b/.archive/changelog/22021.txt
similarity index 100%
rename from .changelog/22021.txt
rename to .archive/changelog/22021.txt
diff --git a/.changelog/22026.txt b/.archive/changelog/22026.txt
similarity index 100%
rename from .changelog/22026.txt
rename to .archive/changelog/22026.txt
diff --git a/.changelog/22039.txt b/.archive/changelog/22039.txt
similarity index 100%
rename from .changelog/22039.txt
rename to .archive/changelog/22039.txt
diff --git a/.changelog/22042.txt b/.archive/changelog/22042.txt
similarity index 100%
rename from .changelog/22042.txt
rename to .archive/changelog/22042.txt
diff --git a/.changelog/22043.txt b/.archive/changelog/22043.txt
similarity index 100%
rename from .changelog/22043.txt
rename to .archive/changelog/22043.txt
diff --git a/.changelog/22045.txt b/.archive/changelog/22045.txt
similarity index 100%
rename from .changelog/22045.txt
rename to .archive/changelog/22045.txt
diff --git a/.changelog/22051.txt b/.archive/changelog/22051.txt
similarity index 100%
rename from .changelog/22051.txt
rename to .archive/changelog/22051.txt
diff --git a/.changelog/22066.txt b/.archive/changelog/22066.txt
similarity index 100%
rename from .changelog/22066.txt
rename to .archive/changelog/22066.txt
diff --git a/.changelog/22067.txt b/.archive/changelog/22067.txt
similarity index 100%
rename from .changelog/22067.txt
rename to .archive/changelog/22067.txt
diff --git a/.changelog/22072.txt b/.archive/changelog/22072.txt
similarity index 100%
rename from .changelog/22072.txt
rename to .archive/changelog/22072.txt
diff --git a/.changelog/22074.txt b/.archive/changelog/22074.txt
similarity index 100%
rename from .changelog/22074.txt
rename to .archive/changelog/22074.txt
diff --git a/.changelog/22077.txt b/.archive/changelog/22077.txt
similarity index 100%
rename from .changelog/22077.txt
rename to .archive/changelog/22077.txt
diff --git a/.changelog/22080.txt b/.archive/changelog/22080.txt
similarity index 100%
rename from .changelog/22080.txt
rename to .archive/changelog/22080.txt
diff --git a/.changelog/22096.txt b/.archive/changelog/22096.txt
similarity index 100%
rename from .changelog/22096.txt
rename to .archive/changelog/22096.txt
diff --git a/.changelog/22097.txt b/.archive/changelog/22097.txt
similarity index 100%
rename from .changelog/22097.txt
rename to .archive/changelog/22097.txt
diff --git a/.changelog/22099.txt b/.archive/changelog/22099.txt
similarity index 100%
rename from .changelog/22099.txt
rename to .archive/changelog/22099.txt
diff --git a/.changelog/22100.txt b/.archive/changelog/22100.txt
similarity index 100%
rename from .changelog/22100.txt
rename to .archive/changelog/22100.txt
diff --git a/.changelog/22104.txt b/.archive/changelog/22104.txt
similarity index 100%
rename from .changelog/22104.txt
rename to .archive/changelog/22104.txt
diff --git a/.changelog/22110.txt b/.archive/changelog/22110.txt
similarity index 100%
rename from .changelog/22110.txt
rename to .archive/changelog/22110.txt
diff --git a/.changelog/22115.txt b/.archive/changelog/22115.txt
similarity index 100%
rename from .changelog/22115.txt
rename to .archive/changelog/22115.txt
diff --git a/.changelog/22119.txt b/.archive/changelog/22119.txt
similarity index 100%
rename from .changelog/22119.txt
rename to .archive/changelog/22119.txt
diff --git a/.changelog/22130.txt b/.archive/changelog/22130.txt
similarity index 100%
rename from .changelog/22130.txt
rename to .archive/changelog/22130.txt
diff --git a/.changelog/22135.txt b/.archive/changelog/22135.txt
similarity index 100%
rename from .changelog/22135.txt
rename to .archive/changelog/22135.txt
diff --git a/.changelog/22136.txt b/.archive/changelog/22136.txt
similarity index 100%
rename from .changelog/22136.txt
rename to .archive/changelog/22136.txt
diff --git a/.changelog/22137.txt b/.archive/changelog/22137.txt
similarity index 100%
rename from .changelog/22137.txt
rename to .archive/changelog/22137.txt
diff --git a/.changelog/22140.txt b/.archive/changelog/22140.txt
similarity index 100%
rename from .changelog/22140.txt
rename to .archive/changelog/22140.txt
diff --git a/.changelog/22142.txt b/.archive/changelog/22142.txt
similarity index 100%
rename from .changelog/22142.txt
rename to .archive/changelog/22142.txt
diff --git a/.changelog/22157.txt b/.archive/changelog/22157.txt
similarity index 100%
rename from .changelog/22157.txt
rename to .archive/changelog/22157.txt
diff --git a/.changelog/22160.txt b/.archive/changelog/22160.txt
similarity index 100%
rename from .changelog/22160.txt
rename to .archive/changelog/22160.txt
diff --git a/.changelog/22163.txt b/.archive/changelog/22163.txt
similarity index 100%
rename from .changelog/22163.txt
rename to .archive/changelog/22163.txt
diff --git a/.changelog/22165.txt b/.archive/changelog/22165.txt
similarity index 100%
rename from .changelog/22165.txt
rename to .archive/changelog/22165.txt
diff --git a/.changelog/22166.txt b/.archive/changelog/22166.txt
similarity index 100%
rename from .changelog/22166.txt
rename to .archive/changelog/22166.txt
diff --git a/.changelog/22167.txt b/.archive/changelog/22167.txt
similarity index 100%
rename from .changelog/22167.txt
rename to .archive/changelog/22167.txt
diff --git a/.changelog/22169.txt b/.archive/changelog/22169.txt
similarity index 100%
rename from .changelog/22169.txt
rename to .archive/changelog/22169.txt
diff --git a/.changelog/22170.txt b/.archive/changelog/22170.txt
similarity index 100%
rename from .changelog/22170.txt
rename to .archive/changelog/22170.txt
diff --git a/.changelog/22171.txt b/.archive/changelog/22171.txt
similarity index 100%
rename from .changelog/22171.txt
rename to .archive/changelog/22171.txt
diff --git a/.changelog/22172.txt b/.archive/changelog/22172.txt
similarity index 100%
rename from .changelog/22172.txt
rename to .archive/changelog/22172.txt
diff --git a/.changelog/22178.txt b/.archive/changelog/22178.txt
similarity index 100%
rename from .changelog/22178.txt
rename to .archive/changelog/22178.txt
diff --git a/.changelog/22179.txt b/.archive/changelog/22179.txt
similarity index 100%
rename from .changelog/22179.txt
rename to .archive/changelog/22179.txt
diff --git a/.changelog/22181.txt b/.archive/changelog/22181.txt
similarity index 100%
rename from .changelog/22181.txt
rename to .archive/changelog/22181.txt
diff --git a/.changelog/22185.txt b/.archive/changelog/22185.txt
similarity index 100%
rename from .changelog/22185.txt
rename to .archive/changelog/22185.txt
diff --git a/.changelog/22189.txt b/.archive/changelog/22189.txt
similarity index 100%
rename from .changelog/22189.txt
rename to .archive/changelog/22189.txt
diff --git a/.changelog/22192.txt b/.archive/changelog/22192.txt
similarity index 100%
rename from .changelog/22192.txt
rename to .archive/changelog/22192.txt
diff --git a/.changelog/22193.txt b/.archive/changelog/22193.txt
similarity index 100%
rename from .changelog/22193.txt
rename to .archive/changelog/22193.txt
diff --git a/.changelog/22194.txt b/.archive/changelog/22194.txt
similarity index 100%
rename from .changelog/22194.txt
rename to .archive/changelog/22194.txt
diff --git a/.changelog/22196.txt b/.archive/changelog/22196.txt
similarity index 100%
rename from .changelog/22196.txt
rename to .archive/changelog/22196.txt
diff --git a/.changelog/22207.txt b/.archive/changelog/22207.txt
similarity index 100%
rename from .changelog/22207.txt
rename to .archive/changelog/22207.txt
diff --git a/.changelog/22211.txt b/.archive/changelog/22211.txt
similarity index 100%
rename from .changelog/22211.txt
rename to .archive/changelog/22211.txt
diff --git a/.changelog/22213.txt b/.archive/changelog/22213.txt
similarity index 100%
rename from .changelog/22213.txt
rename to .archive/changelog/22213.txt
diff --git a/.changelog/22214.txt b/.archive/changelog/22214.txt
similarity index 100%
rename from .changelog/22214.txt
rename to .archive/changelog/22214.txt
diff --git a/.changelog/22217.txt b/.archive/changelog/22217.txt
similarity index 100%
rename from .changelog/22217.txt
rename to .archive/changelog/22217.txt
diff --git a/.changelog/22221.txt b/.archive/changelog/22221.txt
similarity index 100%
rename from .changelog/22221.txt
rename to .archive/changelog/22221.txt
diff --git a/.changelog/22222.txt b/.archive/changelog/22222.txt
similarity index 100%
rename from .changelog/22222.txt
rename to .archive/changelog/22222.txt
diff --git a/.changelog/22227.txt b/.archive/changelog/22227.txt
similarity index 100%
rename from .changelog/22227.txt
rename to .archive/changelog/22227.txt
diff --git a/.changelog/22234.txt b/.archive/changelog/22234.txt
similarity index 100%
rename from .changelog/22234.txt
rename to .archive/changelog/22234.txt
diff --git a/.changelog/22246.txt b/.archive/changelog/22246.txt
similarity index 100%
rename from .changelog/22246.txt
rename to .archive/changelog/22246.txt
diff --git a/.changelog/22250.txt b/.archive/changelog/22250.txt
similarity index 100%
rename from .changelog/22250.txt
rename to .archive/changelog/22250.txt
diff --git a/.changelog/22253.txt b/.archive/changelog/22253.txt
similarity index 100%
rename from .changelog/22253.txt
rename to .archive/changelog/22253.txt
diff --git a/.changelog/22255.txt b/.archive/changelog/22255.txt
similarity index 100%
rename from .changelog/22255.txt
rename to .archive/changelog/22255.txt
diff --git a/.changelog/22256.txt b/.archive/changelog/22256.txt
similarity index 100%
rename from .changelog/22256.txt
rename to .archive/changelog/22256.txt
diff --git a/.changelog/22259.txt b/.archive/changelog/22259.txt
similarity index 100%
rename from .changelog/22259.txt
rename to .archive/changelog/22259.txt
diff --git a/.changelog/22261.txt b/.archive/changelog/22261.txt
similarity index 100%
rename from .changelog/22261.txt
rename to .archive/changelog/22261.txt
diff --git a/.changelog/22262.txt b/.archive/changelog/22262.txt
similarity index 100%
rename from .changelog/22262.txt
rename to .archive/changelog/22262.txt
diff --git a/.changelog/22269.txt b/.archive/changelog/22269.txt
similarity index 100%
rename from .changelog/22269.txt
rename to .archive/changelog/22269.txt
diff --git a/.changelog/22277.txt b/.archive/changelog/22277.txt
similarity index 100%
rename from .changelog/22277.txt
rename to .archive/changelog/22277.txt
diff --git a/.changelog/22281.txt b/.archive/changelog/22281.txt
similarity index 100%
rename from .changelog/22281.txt
rename to .archive/changelog/22281.txt
diff --git a/.changelog/22284.txt b/.archive/changelog/22284.txt
similarity index 100%
rename from .changelog/22284.txt
rename to .archive/changelog/22284.txt
diff --git a/.changelog/22285.txt b/.archive/changelog/22285.txt
similarity index 100%
rename from .changelog/22285.txt
rename to .archive/changelog/22285.txt
diff --git a/.changelog/22289.txt b/.archive/changelog/22289.txt
similarity index 100%
rename from .changelog/22289.txt
rename to .archive/changelog/22289.txt
diff --git a/.changelog/22291.txt b/.archive/changelog/22291.txt
similarity index 100%
rename from .changelog/22291.txt
rename to .archive/changelog/22291.txt
diff --git a/.changelog/22295.txt b/.archive/changelog/22295.txt
similarity index 100%
rename from .changelog/22295.txt
rename to .archive/changelog/22295.txt
diff --git a/.changelog/22298.txt b/.archive/changelog/22298.txt
similarity index 100%
rename from .changelog/22298.txt
rename to .archive/changelog/22298.txt
diff --git a/.changelog/22300.txt b/.archive/changelog/22300.txt
similarity index 100%
rename from .changelog/22300.txt
rename to .archive/changelog/22300.txt
diff --git a/.changelog/22302.txt b/.archive/changelog/22302.txt
similarity index 100%
rename from .changelog/22302.txt
rename to .archive/changelog/22302.txt
diff --git a/.changelog/22303.txt b/.archive/changelog/22303.txt
similarity index 100%
rename from .changelog/22303.txt
rename to .archive/changelog/22303.txt
diff --git a/.changelog/22304.txt b/.archive/changelog/22304.txt
similarity index 100%
rename from .changelog/22304.txt
rename to .archive/changelog/22304.txt
diff --git a/.changelog/22310.txt b/.archive/changelog/22310.txt
similarity index 100%
rename from .changelog/22310.txt
rename to .archive/changelog/22310.txt
diff --git a/.changelog/22315.txt b/.archive/changelog/22315.txt
similarity index 100%
rename from .changelog/22315.txt
rename to .archive/changelog/22315.txt
diff --git a/.changelog/22321.txt b/.archive/changelog/22321.txt
similarity index 100%
rename from .changelog/22321.txt
rename to .archive/changelog/22321.txt
diff --git a/.changelog/22333.txt b/.archive/changelog/22333.txt
similarity index 100%
rename from .changelog/22333.txt
rename to .archive/changelog/22333.txt
diff --git a/.changelog/22335.txt b/.archive/changelog/22335.txt
similarity index 100%
rename from .changelog/22335.txt
rename to .archive/changelog/22335.txt
diff --git a/.changelog/22337.txt b/.archive/changelog/22337.txt
similarity index 100%
rename from .changelog/22337.txt
rename to .archive/changelog/22337.txt
diff --git a/.changelog/22339.txt b/.archive/changelog/22339.txt
similarity index 100%
rename from .changelog/22339.txt
rename to .archive/changelog/22339.txt
diff --git a/.changelog/22342.txt b/.archive/changelog/22342.txt
similarity index 100%
rename from .changelog/22342.txt
rename to .archive/changelog/22342.txt
diff --git a/.changelog/22345.txt b/.archive/changelog/22345.txt
similarity index 100%
rename from .changelog/22345.txt
rename to .archive/changelog/22345.txt
diff --git a/.changelog/22346.txt b/.archive/changelog/22346.txt
similarity index 100%
rename from .changelog/22346.txt
rename to .archive/changelog/22346.txt
diff --git a/.changelog/22347.txt b/.archive/changelog/22347.txt
similarity index 100%
rename from .changelog/22347.txt
rename to .archive/changelog/22347.txt
diff --git a/.changelog/22348.txt b/.archive/changelog/22348.txt
similarity index 100%
rename from .changelog/22348.txt
rename to .archive/changelog/22348.txt
diff --git a/.changelog/22349.txt b/.archive/changelog/22349.txt
similarity index 100%
rename from .changelog/22349.txt
rename to .archive/changelog/22349.txt
diff --git a/.changelog/22350.txt b/.archive/changelog/22350.txt
similarity index 100%
rename from .changelog/22350.txt
rename to .archive/changelog/22350.txt
diff --git a/.changelog/22355.txt b/.archive/changelog/22355.txt
similarity index 100%
rename from .changelog/22355.txt
rename to .archive/changelog/22355.txt
diff --git a/.changelog/22359.txt b/.archive/changelog/22359.txt
similarity index 100%
rename from .changelog/22359.txt
rename to .archive/changelog/22359.txt
diff --git a/.changelog/22363.txt b/.archive/changelog/22363.txt
similarity index 100%
rename from .changelog/22363.txt
rename to .archive/changelog/22363.txt
diff --git a/.changelog/22369.txt b/.archive/changelog/22369.txt
similarity index 100%
rename from .changelog/22369.txt
rename to .archive/changelog/22369.txt
diff --git a/.changelog/22371.txt b/.archive/changelog/22371.txt
similarity index 100%
rename from .changelog/22371.txt
rename to .archive/changelog/22371.txt
diff --git a/.changelog/22375.txt b/.archive/changelog/22375.txt
similarity index 100%
rename from .changelog/22375.txt
rename to .archive/changelog/22375.txt
diff --git a/.changelog/22388.txt b/.archive/changelog/22388.txt
similarity index 100%
rename from .changelog/22388.txt
rename to .archive/changelog/22388.txt
diff --git a/.changelog/22394.txt b/.archive/changelog/22394.txt
similarity index 100%
rename from .changelog/22394.txt
rename to .archive/changelog/22394.txt
diff --git a/.changelog/22395.txt b/.archive/changelog/22395.txt
similarity index 100%
rename from .changelog/22395.txt
rename to .archive/changelog/22395.txt
diff --git a/.changelog/22396.txt b/.archive/changelog/22396.txt
similarity index 100%
rename from .changelog/22396.txt
rename to .archive/changelog/22396.txt
diff --git a/.changelog/22402.txt b/.archive/changelog/22402.txt
similarity index 100%
rename from .changelog/22402.txt
rename to .archive/changelog/22402.txt
diff --git a/.changelog/22406.txt b/.archive/changelog/22406.txt
similarity index 100%
rename from .changelog/22406.txt
rename to .archive/changelog/22406.txt
diff --git a/.changelog/22411.txt b/.archive/changelog/22411.txt
similarity index 100%
rename from .changelog/22411.txt
rename to .archive/changelog/22411.txt
diff --git a/.changelog/22414.txt b/.archive/changelog/22414.txt
similarity index 100%
rename from .changelog/22414.txt
rename to .archive/changelog/22414.txt
diff --git a/.changelog/22418.txt b/.archive/changelog/22418.txt
similarity index 100%
rename from .changelog/22418.txt
rename to .archive/changelog/22418.txt
diff --git a/.changelog/22420.txt b/.archive/changelog/22420.txt
similarity index 100%
rename from .changelog/22420.txt
rename to .archive/changelog/22420.txt
diff --git a/.changelog/22427.txt b/.archive/changelog/22427.txt
similarity index 100%
rename from .changelog/22427.txt
rename to .archive/changelog/22427.txt
diff --git a/.changelog/22435.txt b/.archive/changelog/22435.txt
similarity index 100%
rename from .changelog/22435.txt
rename to .archive/changelog/22435.txt
diff --git a/.changelog/22438.txt b/.archive/changelog/22438.txt
similarity index 100%
rename from .changelog/22438.txt
rename to .archive/changelog/22438.txt
diff --git a/.changelog/22439.txt b/.archive/changelog/22439.txt
similarity index 100%
rename from .changelog/22439.txt
rename to .archive/changelog/22439.txt
diff --git a/.changelog/22440.txt b/.archive/changelog/22440.txt
similarity index 100%
rename from .changelog/22440.txt
rename to .archive/changelog/22440.txt
diff --git a/.changelog/22443.txt b/.archive/changelog/22443.txt
similarity index 100%
rename from .changelog/22443.txt
rename to .archive/changelog/22443.txt
diff --git a/.changelog/22448.txt b/.archive/changelog/22448.txt
similarity index 100%
rename from .changelog/22448.txt
rename to .archive/changelog/22448.txt
diff --git a/.changelog/22451.txt b/.archive/changelog/22451.txt
similarity index 100%
rename from .changelog/22451.txt
rename to .archive/changelog/22451.txt
diff --git a/.changelog/22452.txt b/.archive/changelog/22452.txt
similarity index 100%
rename from .changelog/22452.txt
rename to .archive/changelog/22452.txt
diff --git a/.changelog/22453.txt b/.archive/changelog/22453.txt
similarity index 100%
rename from .changelog/22453.txt
rename to .archive/changelog/22453.txt
diff --git a/.changelog/22455.txt b/.archive/changelog/22455.txt
similarity index 100%
rename from .changelog/22455.txt
rename to .archive/changelog/22455.txt
diff --git a/.changelog/22458.txt b/.archive/changelog/22458.txt
similarity index 100%
rename from .changelog/22458.txt
rename to .archive/changelog/22458.txt
diff --git a/.changelog/22460.txt b/.archive/changelog/22460.txt
similarity index 100%
rename from .changelog/22460.txt
rename to .archive/changelog/22460.txt
diff --git a/.changelog/22461.txt b/.archive/changelog/22461.txt
similarity index 100%
rename from .changelog/22461.txt
rename to .archive/changelog/22461.txt
diff --git a/.changelog/22462.txt b/.archive/changelog/22462.txt
similarity index 100%
rename from .changelog/22462.txt
rename to .archive/changelog/22462.txt
diff --git a/.changelog/22463.txt b/.archive/changelog/22463.txt
similarity index 100%
rename from .changelog/22463.txt
rename to .archive/changelog/22463.txt
diff --git a/.changelog/22470.txt b/.archive/changelog/22470.txt
similarity index 100%
rename from .changelog/22470.txt
rename to .archive/changelog/22470.txt
diff --git a/.changelog/22472.txt b/.archive/changelog/22472.txt
similarity index 100%
rename from .changelog/22472.txt
rename to .archive/changelog/22472.txt
diff --git a/.changelog/22477.txt b/.archive/changelog/22477.txt
similarity index 100%
rename from .changelog/22477.txt
rename to .archive/changelog/22477.txt
diff --git a/.changelog/22480.txt b/.archive/changelog/22480.txt
similarity index 100%
rename from .changelog/22480.txt
rename to .archive/changelog/22480.txt
diff --git a/.changelog/22484.txt b/.archive/changelog/22484.txt
similarity index 100%
rename from .changelog/22484.txt
rename to .archive/changelog/22484.txt
diff --git a/.changelog/22485.txt b/.archive/changelog/22485.txt
similarity index 100%
rename from .changelog/22485.txt
rename to .archive/changelog/22485.txt
diff --git a/.changelog/22486.txt b/.archive/changelog/22486.txt
similarity index 100%
rename from .changelog/22486.txt
rename to .archive/changelog/22486.txt
diff --git a/.changelog/22487.txt b/.archive/changelog/22487.txt
similarity index 100%
rename from .changelog/22487.txt
rename to .archive/changelog/22487.txt
diff --git a/.changelog/22489.txt b/.archive/changelog/22489.txt
similarity index 100%
rename from .changelog/22489.txt
rename to .archive/changelog/22489.txt
diff --git a/.changelog/22490.txt b/.archive/changelog/22490.txt
similarity index 100%
rename from .changelog/22490.txt
rename to .archive/changelog/22490.txt
diff --git a/.changelog/22501.txt b/.archive/changelog/22501.txt
similarity index 100%
rename from .changelog/22501.txt
rename to .archive/changelog/22501.txt
diff --git a/.changelog/22510.txt b/.archive/changelog/22510.txt
similarity index 100%
rename from .changelog/22510.txt
rename to .archive/changelog/22510.txt
diff --git a/.changelog/22511.txt b/.archive/changelog/22511.txt
similarity index 100%
rename from .changelog/22511.txt
rename to .archive/changelog/22511.txt
diff --git a/.changelog/22514.txt b/.archive/changelog/22514.txt
similarity index 100%
rename from .changelog/22514.txt
rename to .archive/changelog/22514.txt
diff --git a/.changelog/22516.txt b/.archive/changelog/22516.txt
similarity index 100%
rename from .changelog/22516.txt
rename to .archive/changelog/22516.txt
diff --git a/.changelog/22518.txt b/.archive/changelog/22518.txt
similarity index 100%
rename from .changelog/22518.txt
rename to .archive/changelog/22518.txt
diff --git a/.changelog/22522.txt b/.archive/changelog/22522.txt
similarity index 100%
rename from .changelog/22522.txt
rename to .archive/changelog/22522.txt
diff --git a/.changelog/22527.txt b/.archive/changelog/22527.txt
similarity index 100%
rename from .changelog/22527.txt
rename to .archive/changelog/22527.txt
diff --git a/.changelog/22529.txt b/.archive/changelog/22529.txt
similarity index 100%
rename from .changelog/22529.txt
rename to .archive/changelog/22529.txt
diff --git a/.changelog/22531.txt b/.archive/changelog/22531.txt
similarity index 100%
rename from .changelog/22531.txt
rename to .archive/changelog/22531.txt
diff --git a/.changelog/22535.txt b/.archive/changelog/22535.txt
similarity index 100%
rename from .changelog/22535.txt
rename to .archive/changelog/22535.txt
diff --git a/.changelog/22537.txt b/.archive/changelog/22537.txt
similarity index 100%
rename from .changelog/22537.txt
rename to .archive/changelog/22537.txt
diff --git a/.changelog/22538.txt b/.archive/changelog/22538.txt
similarity index 100%
rename from .changelog/22538.txt
rename to .archive/changelog/22538.txt
diff --git a/.changelog/22544.txt b/.archive/changelog/22544.txt
similarity index 100%
rename from .changelog/22544.txt
rename to .archive/changelog/22544.txt
diff --git a/.changelog/22547.txt b/.archive/changelog/22547.txt
similarity index 100%
rename from .changelog/22547.txt
rename to .archive/changelog/22547.txt
diff --git a/.changelog/22550.txt b/.archive/changelog/22550.txt
similarity index 100%
rename from .changelog/22550.txt
rename to .archive/changelog/22550.txt
diff --git a/.changelog/22551.txt b/.archive/changelog/22551.txt
similarity index 100%
rename from .changelog/22551.txt
rename to .archive/changelog/22551.txt
diff --git a/.changelog/22552.txt b/.archive/changelog/22552.txt
similarity index 100%
rename from .changelog/22552.txt
rename to .archive/changelog/22552.txt
diff --git a/.changelog/22556.txt b/.archive/changelog/22556.txt
similarity index 100%
rename from .changelog/22556.txt
rename to .archive/changelog/22556.txt
diff --git a/.changelog/22566.txt b/.archive/changelog/22566.txt
similarity index 100%
rename from .changelog/22566.txt
rename to .archive/changelog/22566.txt
diff --git a/.changelog/22572.txt b/.archive/changelog/22572.txt
similarity index 100%
rename from .changelog/22572.txt
rename to .archive/changelog/22572.txt
diff --git a/.changelog/22575.txt b/.archive/changelog/22575.txt
similarity index 100%
rename from .changelog/22575.txt
rename to .archive/changelog/22575.txt
diff --git a/.changelog/22578.txt b/.archive/changelog/22578.txt
similarity index 100%
rename from .changelog/22578.txt
rename to .archive/changelog/22578.txt
diff --git a/.changelog/22579.txt b/.archive/changelog/22579.txt
similarity index 100%
rename from .changelog/22579.txt
rename to .archive/changelog/22579.txt
diff --git a/.changelog/22580.txt b/.archive/changelog/22580.txt
similarity index 100%
rename from .changelog/22580.txt
rename to .archive/changelog/22580.txt
diff --git a/.changelog/22581.txt b/.archive/changelog/22581.txt
similarity index 100%
rename from .changelog/22581.txt
rename to .archive/changelog/22581.txt
diff --git a/.changelog/22597.txt b/.archive/changelog/22597.txt
similarity index 100%
rename from .changelog/22597.txt
rename to .archive/changelog/22597.txt
diff --git a/.changelog/22599.txt b/.archive/changelog/22599.txt
similarity index 100%
rename from .changelog/22599.txt
rename to .archive/changelog/22599.txt
diff --git a/.changelog/22604.txt b/.archive/changelog/22604.txt
similarity index 100%
rename from .changelog/22604.txt
rename to .archive/changelog/22604.txt
diff --git a/.changelog/22605.txt b/.archive/changelog/22605.txt
similarity index 100%
rename from .changelog/22605.txt
rename to .archive/changelog/22605.txt
diff --git a/.changelog/22606.txt b/.archive/changelog/22606.txt
similarity index 100%
rename from .changelog/22606.txt
rename to .archive/changelog/22606.txt
diff --git a/.changelog/22608.txt b/.archive/changelog/22608.txt
similarity index 100%
rename from .changelog/22608.txt
rename to .archive/changelog/22608.txt
diff --git a/.changelog/22609.txt b/.archive/changelog/22609.txt
similarity index 100%
rename from .changelog/22609.txt
rename to .archive/changelog/22609.txt
diff --git a/.changelog/22610.txt b/.archive/changelog/22610.txt
similarity index 100%
rename from .changelog/22610.txt
rename to .archive/changelog/22610.txt
diff --git a/.changelog/22611.txt b/.archive/changelog/22611.txt
similarity index 100%
rename from .changelog/22611.txt
rename to .archive/changelog/22611.txt
diff --git a/.changelog/22612.txt b/.archive/changelog/22612.txt
similarity index 100%
rename from .changelog/22612.txt
rename to .archive/changelog/22612.txt
diff --git a/.changelog/22613.txt b/.archive/changelog/22613.txt
similarity index 100%
rename from .changelog/22613.txt
rename to .archive/changelog/22613.txt
diff --git a/.changelog/22614.txt b/.archive/changelog/22614.txt
similarity index 100%
rename from .changelog/22614.txt
rename to .archive/changelog/22614.txt
diff --git a/.changelog/22615.txt b/.archive/changelog/22615.txt
similarity index 100%
rename from .changelog/22615.txt
rename to .archive/changelog/22615.txt
diff --git a/.changelog/22617.txt b/.archive/changelog/22617.txt
similarity index 100%
rename from .changelog/22617.txt
rename to .archive/changelog/22617.txt
diff --git a/.changelog/22620.txt b/.archive/changelog/22620.txt
similarity index 100%
rename from .changelog/22620.txt
rename to .archive/changelog/22620.txt
diff --git a/.changelog/22630.txt b/.archive/changelog/22630.txt
similarity index 100%
rename from .changelog/22630.txt
rename to .archive/changelog/22630.txt
diff --git a/.changelog/22632.txt b/.archive/changelog/22632.txt
similarity index 100%
rename from .changelog/22632.txt
rename to .archive/changelog/22632.txt
diff --git a/.changelog/22636.txt b/.archive/changelog/22636.txt
similarity index 100%
rename from .changelog/22636.txt
rename to .archive/changelog/22636.txt
diff --git a/.changelog/22643.txt b/.archive/changelog/22643.txt
similarity index 100%
rename from .changelog/22643.txt
rename to .archive/changelog/22643.txt
diff --git a/.changelog/22644.txt b/.archive/changelog/22644.txt
similarity index 100%
rename from .changelog/22644.txt
rename to .archive/changelog/22644.txt
diff --git a/.changelog/22646.txt b/.archive/changelog/22646.txt
similarity index 100%
rename from .changelog/22646.txt
rename to .archive/changelog/22646.txt
diff --git a/.changelog/22648.txt b/.archive/changelog/22648.txt
similarity index 100%
rename from .changelog/22648.txt
rename to .archive/changelog/22648.txt
diff --git a/.changelog/22649.txt b/.archive/changelog/22649.txt
similarity index 100%
rename from .changelog/22649.txt
rename to .archive/changelog/22649.txt
diff --git a/.changelog/22662.txt b/.archive/changelog/22662.txt
similarity index 100%
rename from .changelog/22662.txt
rename to .archive/changelog/22662.txt
diff --git a/.changelog/22663.txt b/.archive/changelog/22663.txt
similarity index 100%
rename from .changelog/22663.txt
rename to .archive/changelog/22663.txt
diff --git a/.changelog/22664.txt b/.archive/changelog/22664.txt
similarity index 100%
rename from .changelog/22664.txt
rename to .archive/changelog/22664.txt
diff --git a/.changelog/22665.txt b/.archive/changelog/22665.txt
similarity index 100%
rename from .changelog/22665.txt
rename to .archive/changelog/22665.txt
diff --git a/.changelog/22666.txt b/.archive/changelog/22666.txt
similarity index 100%
rename from .changelog/22666.txt
rename to .archive/changelog/22666.txt
diff --git a/.changelog/22667.txt b/.archive/changelog/22667.txt
similarity index 100%
rename from .changelog/22667.txt
rename to .archive/changelog/22667.txt
diff --git a/.changelog/22668.txt b/.archive/changelog/22668.txt
similarity index 100%
rename from .changelog/22668.txt
rename to .archive/changelog/22668.txt
diff --git a/.changelog/22672.txt b/.archive/changelog/22672.txt
similarity index 100%
rename from .changelog/22672.txt
rename to .archive/changelog/22672.txt
diff --git a/.changelog/22688.txt b/.archive/changelog/22688.txt
similarity index 100%
rename from .changelog/22688.txt
rename to .archive/changelog/22688.txt
diff --git a/.changelog/22693.txt b/.archive/changelog/22693.txt
similarity index 100%
rename from .changelog/22693.txt
rename to .archive/changelog/22693.txt
diff --git a/.changelog/22697.txt b/.archive/changelog/22697.txt
similarity index 100%
rename from .changelog/22697.txt
rename to .archive/changelog/22697.txt
diff --git a/.changelog/22713.txt b/.archive/changelog/22713.txt
similarity index 100%
rename from .changelog/22713.txt
rename to .archive/changelog/22713.txt
diff --git a/.changelog/22717.txt b/.archive/changelog/22717.txt
similarity index 100%
rename from .changelog/22717.txt
rename to .archive/changelog/22717.txt
diff --git a/.changelog/22719.txt b/.archive/changelog/22719.txt
similarity index 100%
rename from .changelog/22719.txt
rename to .archive/changelog/22719.txt
diff --git a/.changelog/22722.txt b/.archive/changelog/22722.txt
similarity index 100%
rename from .changelog/22722.txt
rename to .archive/changelog/22722.txt
diff --git a/.changelog/22723.txt b/.archive/changelog/22723.txt
similarity index 100%
rename from .changelog/22723.txt
rename to .archive/changelog/22723.txt
diff --git a/.changelog/22724.txt b/.archive/changelog/22724.txt
similarity index 100%
rename from .changelog/22724.txt
rename to .archive/changelog/22724.txt
diff --git a/.changelog/22727.txt b/.archive/changelog/22727.txt
similarity index 100%
rename from .changelog/22727.txt
rename to .archive/changelog/22727.txt
diff --git a/.changelog/22731.txt b/.archive/changelog/22731.txt
similarity index 100%
rename from .changelog/22731.txt
rename to .archive/changelog/22731.txt
diff --git a/.changelog/22732.txt b/.archive/changelog/22732.txt
similarity index 100%
rename from .changelog/22732.txt
rename to .archive/changelog/22732.txt
diff --git a/.changelog/22733.txt b/.archive/changelog/22733.txt
similarity index 100%
rename from .changelog/22733.txt
rename to .archive/changelog/22733.txt
diff --git a/.changelog/22743.txt b/.archive/changelog/22743.txt
similarity index 100%
rename from .changelog/22743.txt
rename to .archive/changelog/22743.txt
diff --git a/.changelog/22756.txt b/.archive/changelog/22756.txt
similarity index 100%
rename from .changelog/22756.txt
rename to .archive/changelog/22756.txt
diff --git a/.changelog/22757.txt b/.archive/changelog/22757.txt
similarity index 100%
rename from .changelog/22757.txt
rename to .archive/changelog/22757.txt
diff --git a/.changelog/22758.txt b/.archive/changelog/22758.txt
similarity index 100%
rename from .changelog/22758.txt
rename to .archive/changelog/22758.txt
diff --git a/.changelog/22761.txt b/.archive/changelog/22761.txt
similarity index 100%
rename from .changelog/22761.txt
rename to .archive/changelog/22761.txt
diff --git a/.changelog/22768.txt b/.archive/changelog/22768.txt
similarity index 100%
rename from .changelog/22768.txt
rename to .archive/changelog/22768.txt
diff --git a/.changelog/22780.txt b/.archive/changelog/22780.txt
similarity index 100%
rename from .changelog/22780.txt
rename to .archive/changelog/22780.txt
diff --git a/.changelog/22783.txt b/.archive/changelog/22783.txt
similarity index 100%
rename from .changelog/22783.txt
rename to .archive/changelog/22783.txt
diff --git a/.changelog/22793.txt b/.archive/changelog/22793.txt
similarity index 100%
rename from .changelog/22793.txt
rename to .archive/changelog/22793.txt
diff --git a/.changelog/22796.txt b/.archive/changelog/22796.txt
similarity index 100%
rename from .changelog/22796.txt
rename to .archive/changelog/22796.txt
diff --git a/.changelog/22803.txt b/.archive/changelog/22803.txt
similarity index 100%
rename from .changelog/22803.txt
rename to .archive/changelog/22803.txt
diff --git a/.changelog/22804.txt b/.archive/changelog/22804.txt
similarity index 100%
rename from .changelog/22804.txt
rename to .archive/changelog/22804.txt
diff --git a/.changelog/22805.txt b/.archive/changelog/22805.txt
similarity index 100%
rename from .changelog/22805.txt
rename to .archive/changelog/22805.txt
diff --git a/.changelog/22806.txt b/.archive/changelog/22806.txt
similarity index 100%
rename from .changelog/22806.txt
rename to .archive/changelog/22806.txt
diff --git a/.changelog/22813.txt b/.archive/changelog/22813.txt
similarity index 100%
rename from .changelog/22813.txt
rename to .archive/changelog/22813.txt
diff --git a/.changelog/22821.txt b/.archive/changelog/22821.txt
similarity index 100%
rename from .changelog/22821.txt
rename to .archive/changelog/22821.txt
diff --git a/.changelog/22836.txt b/.archive/changelog/22836.txt
similarity index 100%
rename from .changelog/22836.txt
rename to .archive/changelog/22836.txt
diff --git a/.changelog/22837.txt b/.archive/changelog/22837.txt
similarity index 100%
rename from .changelog/22837.txt
rename to .archive/changelog/22837.txt
diff --git a/.changelog/22838.txt b/.archive/changelog/22838.txt
similarity index 100%
rename from .changelog/22838.txt
rename to .archive/changelog/22838.txt
diff --git a/.changelog/22840.txt b/.archive/changelog/22840.txt
similarity index 100%
rename from .changelog/22840.txt
rename to .archive/changelog/22840.txt
diff --git a/.changelog/22842.txt b/.archive/changelog/22842.txt
similarity index 100%
rename from .changelog/22842.txt
rename to .archive/changelog/22842.txt
diff --git a/.changelog/22844.txt b/.archive/changelog/22844.txt
similarity index 100%
rename from .changelog/22844.txt
rename to .archive/changelog/22844.txt
diff --git a/.changelog/22850.txt b/.archive/changelog/22850.txt
similarity index 100%
rename from .changelog/22850.txt
rename to .archive/changelog/22850.txt
diff --git a/.changelog/22853.txt b/.archive/changelog/22853.txt
similarity index 100%
rename from .changelog/22853.txt
rename to .archive/changelog/22853.txt
diff --git a/.changelog/22856.txt b/.archive/changelog/22856.txt
similarity index 100%
rename from .changelog/22856.txt
rename to .archive/changelog/22856.txt
diff --git a/.changelog/22859.txt b/.archive/changelog/22859.txt
similarity index 100%
rename from .changelog/22859.txt
rename to .archive/changelog/22859.txt
diff --git a/.changelog/22863.txt b/.archive/changelog/22863.txt
similarity index 100%
rename from .changelog/22863.txt
rename to .archive/changelog/22863.txt
diff --git a/.changelog/22874.txt b/.archive/changelog/22874.txt
similarity index 100%
rename from .changelog/22874.txt
rename to .archive/changelog/22874.txt
diff --git a/.changelog/22877.txt b/.archive/changelog/22877.txt
similarity index 100%
rename from .changelog/22877.txt
rename to .archive/changelog/22877.txt
diff --git a/.changelog/22878.txt b/.archive/changelog/22878.txt
similarity index 100%
rename from .changelog/22878.txt
rename to .archive/changelog/22878.txt
diff --git a/.changelog/22882.txt b/.archive/changelog/22882.txt
similarity index 100%
rename from .changelog/22882.txt
rename to .archive/changelog/22882.txt
diff --git a/.changelog/22884.txt b/.archive/changelog/22884.txt
similarity index 100%
rename from .changelog/22884.txt
rename to .archive/changelog/22884.txt
diff --git a/.changelog/22887.txt b/.archive/changelog/22887.txt
similarity index 100%
rename from .changelog/22887.txt
rename to .archive/changelog/22887.txt
diff --git a/.changelog/22888.txt b/.archive/changelog/22888.txt
similarity index 100%
rename from .changelog/22888.txt
rename to .archive/changelog/22888.txt
diff --git a/.changelog/22889.txt b/.archive/changelog/22889.txt
similarity index 100%
rename from .changelog/22889.txt
rename to .archive/changelog/22889.txt
diff --git a/.changelog/22890.txt b/.archive/changelog/22890.txt
similarity index 100%
rename from .changelog/22890.txt
rename to .archive/changelog/22890.txt
diff --git a/.changelog/22891.txt b/.archive/changelog/22891.txt
similarity index 100%
rename from .changelog/22891.txt
rename to .archive/changelog/22891.txt
diff --git a/.changelog/22898.txt b/.archive/changelog/22898.txt
similarity index 100%
rename from .changelog/22898.txt
rename to .archive/changelog/22898.txt
diff --git a/.changelog/22911.txt b/.archive/changelog/22911.txt
similarity index 100%
rename from .changelog/22911.txt
rename to .archive/changelog/22911.txt
diff --git a/.changelog/22915.txt b/.archive/changelog/22915.txt
similarity index 100%
rename from .changelog/22915.txt
rename to .archive/changelog/22915.txt
diff --git a/.changelog/22926.txt b/.archive/changelog/22926.txt
similarity index 100%
rename from .changelog/22926.txt
rename to .archive/changelog/22926.txt
diff --git a/.changelog/22927.txt b/.archive/changelog/22927.txt
similarity index 100%
rename from .changelog/22927.txt
rename to .archive/changelog/22927.txt
diff --git a/.changelog/22928.txt b/.archive/changelog/22928.txt
similarity index 100%
rename from .changelog/22928.txt
rename to .archive/changelog/22928.txt
diff --git a/.changelog/22931.txt b/.archive/changelog/22931.txt
similarity index 100%
rename from .changelog/22931.txt
rename to .archive/changelog/22931.txt
diff --git a/.changelog/22933.txt b/.archive/changelog/22933.txt
similarity index 100%
rename from .changelog/22933.txt
rename to .archive/changelog/22933.txt
diff --git a/.changelog/22935.txt b/.archive/changelog/22935.txt
similarity index 100%
rename from .changelog/22935.txt
rename to .archive/changelog/22935.txt
diff --git a/.changelog/22939.txt b/.archive/changelog/22939.txt
similarity index 100%
rename from .changelog/22939.txt
rename to .archive/changelog/22939.txt
diff --git a/.changelog/22941.txt b/.archive/changelog/22941.txt
similarity index 100%
rename from .changelog/22941.txt
rename to .archive/changelog/22941.txt
diff --git a/.changelog/22942.txt b/.archive/changelog/22942.txt
similarity index 100%
rename from .changelog/22942.txt
rename to .archive/changelog/22942.txt
diff --git a/.changelog/22946.txt b/.archive/changelog/22946.txt
similarity index 100%
rename from .changelog/22946.txt
rename to .archive/changelog/22946.txt
diff --git a/.changelog/22948.txt b/.archive/changelog/22948.txt
similarity index 100%
rename from .changelog/22948.txt
rename to .archive/changelog/22948.txt
diff --git a/.changelog/22954.txt b/.archive/changelog/22954.txt
similarity index 100%
rename from .changelog/22954.txt
rename to .archive/changelog/22954.txt
diff --git a/.changelog/22960.txt b/.archive/changelog/22960.txt
similarity index 100%
rename from .changelog/22960.txt
rename to .archive/changelog/22960.txt
diff --git a/.changelog/22963.txt b/.archive/changelog/22963.txt
similarity index 100%
rename from .changelog/22963.txt
rename to .archive/changelog/22963.txt
diff --git a/.changelog/22964.txt b/.archive/changelog/22964.txt
similarity index 100%
rename from .changelog/22964.txt
rename to .archive/changelog/22964.txt
diff --git a/.changelog/22965.txt b/.archive/changelog/22965.txt
similarity index 100%
rename from .changelog/22965.txt
rename to .archive/changelog/22965.txt
diff --git a/.changelog/22966.txt b/.archive/changelog/22966.txt
similarity index 100%
rename from .changelog/22966.txt
rename to .archive/changelog/22966.txt
diff --git a/.changelog/22967.txt b/.archive/changelog/22967.txt
similarity index 100%
rename from .changelog/22967.txt
rename to .archive/changelog/22967.txt
diff --git a/.changelog/22968.txt b/.archive/changelog/22968.txt
similarity index 100%
rename from .changelog/22968.txt
rename to .archive/changelog/22968.txt
diff --git a/.changelog/22972.txt b/.archive/changelog/22972.txt
similarity index 100%
rename from .changelog/22972.txt
rename to .archive/changelog/22972.txt
diff --git a/.changelog/22977.txt b/.archive/changelog/22977.txt
similarity index 100%
rename from .changelog/22977.txt
rename to .archive/changelog/22977.txt
diff --git a/.changelog/22978.txt b/.archive/changelog/22978.txt
similarity index 100%
rename from .changelog/22978.txt
rename to .archive/changelog/22978.txt
diff --git a/.changelog/22988.txt b/.archive/changelog/22988.txt
similarity index 100%
rename from .changelog/22988.txt
rename to .archive/changelog/22988.txt
diff --git a/.changelog/22996.txt b/.archive/changelog/22996.txt
similarity index 100%
rename from .changelog/22996.txt
rename to .archive/changelog/22996.txt
diff --git a/.changelog/23030.txt b/.archive/changelog/23030.txt
similarity index 100%
rename from .changelog/23030.txt
rename to .archive/changelog/23030.txt
diff --git a/.changelog/23035.txt b/.archive/changelog/23035.txt
similarity index 100%
rename from .changelog/23035.txt
rename to .archive/changelog/23035.txt
diff --git a/.changelog/23039.txt b/.archive/changelog/23039.txt
similarity index 100%
rename from .changelog/23039.txt
rename to .archive/changelog/23039.txt
diff --git a/.changelog/23040.txt b/.archive/changelog/23040.txt
similarity index 100%
rename from .changelog/23040.txt
rename to .archive/changelog/23040.txt
diff --git a/.changelog/23052.txt b/.archive/changelog/23052.txt
similarity index 100%
rename from .changelog/23052.txt
rename to .archive/changelog/23052.txt
diff --git a/.changelog/23055.txt b/.archive/changelog/23055.txt
similarity index 100%
rename from .changelog/23055.txt
rename to .archive/changelog/23055.txt
diff --git a/.changelog/23059.txt b/.archive/changelog/23059.txt
similarity index 100%
rename from .changelog/23059.txt
rename to .archive/changelog/23059.txt
diff --git a/.changelog/23060.txt b/.archive/changelog/23060.txt
similarity index 100%
rename from .changelog/23060.txt
rename to .archive/changelog/23060.txt
diff --git a/.changelog/23077.txt b/.archive/changelog/23077.txt
similarity index 100%
rename from .changelog/23077.txt
rename to .archive/changelog/23077.txt
diff --git a/.changelog/23080.txt b/.archive/changelog/23080.txt
similarity index 100%
rename from .changelog/23080.txt
rename to .archive/changelog/23080.txt
diff --git a/.changelog/23086.txt b/.archive/changelog/23086.txt
similarity index 100%
rename from .changelog/23086.txt
rename to .archive/changelog/23086.txt
diff --git a/.changelog/23091.txt b/.archive/changelog/23091.txt
similarity index 100%
rename from .changelog/23091.txt
rename to .archive/changelog/23091.txt
diff --git a/.changelog/23098.txt b/.archive/changelog/23098.txt
similarity index 100%
rename from .changelog/23098.txt
rename to .archive/changelog/23098.txt
diff --git a/.changelog/23111.txt b/.archive/changelog/23111.txt
similarity index 100%
rename from .changelog/23111.txt
rename to .archive/changelog/23111.txt
diff --git a/.changelog/23113.txt b/.archive/changelog/23113.txt
similarity index 100%
rename from .changelog/23113.txt
rename to .archive/changelog/23113.txt
diff --git a/.changelog/23120.txt b/.archive/changelog/23120.txt
similarity index 100%
rename from .changelog/23120.txt
rename to .archive/changelog/23120.txt
diff --git a/.changelog/23126.txt b/.archive/changelog/23126.txt
similarity index 100%
rename from .changelog/23126.txt
rename to .archive/changelog/23126.txt
diff --git a/.changelog/23127.txt b/.archive/changelog/23127.txt
similarity index 100%
rename from .changelog/23127.txt
rename to .archive/changelog/23127.txt
diff --git a/.changelog/23130.txt b/.archive/changelog/23130.txt
similarity index 100%
rename from .changelog/23130.txt
rename to .archive/changelog/23130.txt
diff --git a/.changelog/23134.txt b/.archive/changelog/23134.txt
similarity index 100%
rename from .changelog/23134.txt
rename to .archive/changelog/23134.txt
diff --git a/.changelog/23144.txt b/.archive/changelog/23144.txt
similarity index 100%
rename from .changelog/23144.txt
rename to .archive/changelog/23144.txt
diff --git a/.changelog/23146.txt b/.archive/changelog/23146.txt
similarity index 100%
rename from .changelog/23146.txt
rename to .archive/changelog/23146.txt
diff --git a/.changelog/23147.txt b/.archive/changelog/23147.txt
similarity index 100%
rename from .changelog/23147.txt
rename to .archive/changelog/23147.txt
diff --git a/.changelog/23151.txt b/.archive/changelog/23151.txt
similarity index 100%
rename from .changelog/23151.txt
rename to .archive/changelog/23151.txt
diff --git a/.changelog/23152.txt b/.archive/changelog/23152.txt
similarity index 100%
rename from .changelog/23152.txt
rename to .archive/changelog/23152.txt
diff --git a/.changelog/23154.txt b/.archive/changelog/23154.txt
similarity index 100%
rename from .changelog/23154.txt
rename to .archive/changelog/23154.txt
diff --git a/.changelog/23156.txt b/.archive/changelog/23156.txt
similarity index 100%
rename from .changelog/23156.txt
rename to .archive/changelog/23156.txt
diff --git a/.changelog/23157.txt b/.archive/changelog/23157.txt
similarity index 100%
rename from .changelog/23157.txt
rename to .archive/changelog/23157.txt
diff --git a/.changelog/23161.txt b/.archive/changelog/23161.txt
similarity index 100%
rename from .changelog/23161.txt
rename to .archive/changelog/23161.txt
diff --git a/.changelog/23162.txt b/.archive/changelog/23162.txt
similarity index 100%
rename from .changelog/23162.txt
rename to .archive/changelog/23162.txt
diff --git a/.changelog/23173.txt b/.archive/changelog/23173.txt
similarity index 100%
rename from .changelog/23173.txt
rename to .archive/changelog/23173.txt
diff --git a/.changelog/23175.txt b/.archive/changelog/23175.txt
similarity index 100%
rename from .changelog/23175.txt
rename to .archive/changelog/23175.txt
diff --git a/.changelog/23187.txt b/.archive/changelog/23187.txt
similarity index 100%
rename from .changelog/23187.txt
rename to .archive/changelog/23187.txt
diff --git a/.changelog/23191.txt b/.archive/changelog/23191.txt
similarity index 100%
rename from .changelog/23191.txt
rename to .archive/changelog/23191.txt
diff --git a/.changelog/23193.txt b/.archive/changelog/23193.txt
similarity index 100%
rename from .changelog/23193.txt
rename to .archive/changelog/23193.txt
diff --git a/.changelog/23195.txt b/.archive/changelog/23195.txt
similarity index 100%
rename from .changelog/23195.txt
rename to .archive/changelog/23195.txt
diff --git a/.changelog/23202.txt b/.archive/changelog/23202.txt
similarity index 100%
rename from .changelog/23202.txt
rename to .archive/changelog/23202.txt
diff --git a/.changelog/23212.txt b/.archive/changelog/23212.txt
similarity index 100%
rename from .changelog/23212.txt
rename to .archive/changelog/23212.txt
diff --git a/.changelog/23232.txt b/.archive/changelog/23232.txt
similarity index 100%
rename from .changelog/23232.txt
rename to .archive/changelog/23232.txt
diff --git a/.changelog/23235.txt b/.archive/changelog/23235.txt
similarity index 100%
rename from .changelog/23235.txt
rename to .archive/changelog/23235.txt
diff --git a/.changelog/23240.txt b/.archive/changelog/23240.txt
similarity index 100%
rename from .changelog/23240.txt
rename to .archive/changelog/23240.txt
diff --git a/.changelog/23252.txt b/.archive/changelog/23252.txt
similarity index 100%
rename from .changelog/23252.txt
rename to .archive/changelog/23252.txt
diff --git a/.changelog/23254.txt b/.archive/changelog/23254.txt
similarity index 100%
rename from .changelog/23254.txt
rename to .archive/changelog/23254.txt
diff --git a/.changelog/23256.txt b/.archive/changelog/23256.txt
similarity index 100%
rename from .changelog/23256.txt
rename to .archive/changelog/23256.txt
diff --git a/.changelog/23270.txt b/.archive/changelog/23270.txt
similarity index 100%
rename from .changelog/23270.txt
rename to .archive/changelog/23270.txt
diff --git a/.changelog/23275.txt b/.archive/changelog/23275.txt
similarity index 100%
rename from .changelog/23275.txt
rename to .archive/changelog/23275.txt
diff --git a/.changelog/23278.txt b/.archive/changelog/23278.txt
similarity index 100%
rename from .changelog/23278.txt
rename to .archive/changelog/23278.txt
diff --git a/.changelog/23279.txt b/.archive/changelog/23279.txt
similarity index 100%
rename from .changelog/23279.txt
rename to .archive/changelog/23279.txt
diff --git a/.changelog/23280.txt b/.archive/changelog/23280.txt
similarity index 100%
rename from .changelog/23280.txt
rename to .archive/changelog/23280.txt
diff --git a/.changelog/23282.txt b/.archive/changelog/23282.txt
similarity index 100%
rename from .changelog/23282.txt
rename to .archive/changelog/23282.txt
diff --git a/.changelog/23283.txt b/.archive/changelog/23283.txt
similarity index 100%
rename from .changelog/23283.txt
rename to .archive/changelog/23283.txt
diff --git a/.changelog/23293.txt b/.archive/changelog/23293.txt
similarity index 100%
rename from .changelog/23293.txt
rename to .archive/changelog/23293.txt
diff --git a/.changelog/23304.txt b/.archive/changelog/23304.txt
similarity index 100%
rename from .changelog/23304.txt
rename to .archive/changelog/23304.txt
diff --git a/.changelog/23317.txt b/.archive/changelog/23317.txt
similarity index 100%
rename from .changelog/23317.txt
rename to .archive/changelog/23317.txt
diff --git a/.changelog/23322.txt b/.archive/changelog/23322.txt
similarity index 100%
rename from .changelog/23322.txt
rename to .archive/changelog/23322.txt
diff --git a/.changelog/23325.txt b/.archive/changelog/23325.txt
similarity index 100%
rename from .changelog/23325.txt
rename to .archive/changelog/23325.txt
diff --git a/.changelog/23328.txt b/.archive/changelog/23328.txt
similarity index 100%
rename from .changelog/23328.txt
rename to .archive/changelog/23328.txt
diff --git a/.changelog/23330.txt b/.archive/changelog/23330.txt
similarity index 100%
rename from .changelog/23330.txt
rename to .archive/changelog/23330.txt
diff --git a/.changelog/23339.txt b/.archive/changelog/23339.txt
similarity index 100%
rename from .changelog/23339.txt
rename to .archive/changelog/23339.txt
diff --git a/.changelog/23341.txt b/.archive/changelog/23341.txt
similarity index 100%
rename from .changelog/23341.txt
rename to .archive/changelog/23341.txt
diff --git a/.changelog/23362.txt b/.archive/changelog/23362.txt
similarity index 100%
rename from .changelog/23362.txt
rename to .archive/changelog/23362.txt
diff --git a/.changelog/23365.txt b/.archive/changelog/23365.txt
similarity index 100%
rename from .changelog/23365.txt
rename to .archive/changelog/23365.txt
diff --git a/.changelog/23366.txt b/.archive/changelog/23366.txt
similarity index 100%
rename from .changelog/23366.txt
rename to .archive/changelog/23366.txt
diff --git a/.changelog/23368.txt b/.archive/changelog/23368.txt
similarity index 100%
rename from .changelog/23368.txt
rename to .archive/changelog/23368.txt
diff --git a/.changelog/23384.txt b/.archive/changelog/23384.txt
similarity index 100%
rename from .changelog/23384.txt
rename to .archive/changelog/23384.txt
diff --git a/.changelog/23388.txt b/.archive/changelog/23388.txt
similarity index 100%
rename from .changelog/23388.txt
rename to .archive/changelog/23388.txt
diff --git a/.changelog/23394.txt b/.archive/changelog/23394.txt
similarity index 100%
rename from .changelog/23394.txt
rename to .archive/changelog/23394.txt
diff --git a/.changelog/23397.txt b/.archive/changelog/23397.txt
similarity index 100%
rename from .changelog/23397.txt
rename to .archive/changelog/23397.txt
diff --git a/.changelog/23398.txt b/.archive/changelog/23398.txt
similarity index 100%
rename from .changelog/23398.txt
rename to .archive/changelog/23398.txt
diff --git a/.changelog/23401.txt b/.archive/changelog/23401.txt
similarity index 100%
rename from .changelog/23401.txt
rename to .archive/changelog/23401.txt
diff --git a/.changelog/23426.txt b/.archive/changelog/23426.txt
similarity index 100%
rename from .changelog/23426.txt
rename to .archive/changelog/23426.txt
diff --git a/.changelog/23427.txt b/.archive/changelog/23427.txt
similarity index 100%
rename from .changelog/23427.txt
rename to .archive/changelog/23427.txt
diff --git a/.changelog/23440.txt b/.archive/changelog/23440.txt
similarity index 100%
rename from .changelog/23440.txt
rename to .archive/changelog/23440.txt
diff --git a/.changelog/23441.txt b/.archive/changelog/23441.txt
similarity index 100%
rename from .changelog/23441.txt
rename to .archive/changelog/23441.txt
diff --git a/.changelog/23443.txt b/.archive/changelog/23443.txt
similarity index 100%
rename from .changelog/23443.txt
rename to .archive/changelog/23443.txt
diff --git a/.changelog/23444.txt b/.archive/changelog/23444.txt
similarity index 100%
rename from .changelog/23444.txt
rename to .archive/changelog/23444.txt
diff --git a/.changelog/23452.txt b/.archive/changelog/23452.txt
similarity index 100%
rename from .changelog/23452.txt
rename to .archive/changelog/23452.txt
diff --git a/.changelog/23485.txt b/.archive/changelog/23485.txt
similarity index 100%
rename from .changelog/23485.txt
rename to .archive/changelog/23485.txt
diff --git a/.changelog/23510.txt b/.archive/changelog/23510.txt
similarity index 100%
rename from .changelog/23510.txt
rename to .archive/changelog/23510.txt
diff --git a/.changelog/23516.txt b/.archive/changelog/23516.txt
similarity index 100%
rename from .changelog/23516.txt
rename to .archive/changelog/23516.txt
diff --git a/.changelog/23517.txt b/.archive/changelog/23517.txt
similarity index 100%
rename from .changelog/23517.txt
rename to .archive/changelog/23517.txt
diff --git a/.changelog/23518.txt b/.archive/changelog/23518.txt
similarity index 100%
rename from .changelog/23518.txt
rename to .archive/changelog/23518.txt
diff --git a/.changelog/23524.txt b/.archive/changelog/23524.txt
similarity index 100%
rename from .changelog/23524.txt
rename to .archive/changelog/23524.txt
diff --git a/.changelog/23525.txt b/.archive/changelog/23525.txt
similarity index 100%
rename from .changelog/23525.txt
rename to .archive/changelog/23525.txt
diff --git a/.changelog/23527.txt b/.archive/changelog/23527.txt
similarity index 100%
rename from .changelog/23527.txt
rename to .archive/changelog/23527.txt
diff --git a/.changelog/23531.txt b/.archive/changelog/23531.txt
similarity index 100%
rename from .changelog/23531.txt
rename to .archive/changelog/23531.txt
diff --git a/.changelog/23532.txt b/.archive/changelog/23532.txt
similarity index 100%
rename from .changelog/23532.txt
rename to .archive/changelog/23532.txt
diff --git a/.changelog/23535.txt b/.archive/changelog/23535.txt
similarity index 100%
rename from .changelog/23535.txt
rename to .archive/changelog/23535.txt
diff --git a/.changelog/23544.txt b/.archive/changelog/23544.txt
similarity index 100%
rename from .changelog/23544.txt
rename to .archive/changelog/23544.txt
diff --git a/.changelog/23556.txt b/.archive/changelog/23556.txt
similarity index 100%
rename from .changelog/23556.txt
rename to .archive/changelog/23556.txt
diff --git a/.changelog/23560.txt b/.archive/changelog/23560.txt
similarity index 100%
rename from .changelog/23560.txt
rename to .archive/changelog/23560.txt
diff --git a/.changelog/23574.txt b/.archive/changelog/23574.txt
similarity index 100%
rename from .changelog/23574.txt
rename to .archive/changelog/23574.txt
diff --git a/.changelog/23579.txt b/.archive/changelog/23579.txt
similarity index 100%
rename from .changelog/23579.txt
rename to .archive/changelog/23579.txt
diff --git a/.changelog/23580.txt b/.archive/changelog/23580.txt
similarity index 100%
rename from .changelog/23580.txt
rename to .archive/changelog/23580.txt
diff --git a/.changelog/23586.txt b/.archive/changelog/23586.txt
similarity index 100%
rename from .changelog/23586.txt
rename to .archive/changelog/23586.txt
diff --git a/.changelog/23593.txt b/.archive/changelog/23593.txt
similarity index 100%
rename from .changelog/23593.txt
rename to .archive/changelog/23593.txt
diff --git a/.changelog/23600.txt b/.archive/changelog/23600.txt
similarity index 100%
rename from .changelog/23600.txt
rename to .archive/changelog/23600.txt
diff --git a/.changelog/23602.txt b/.archive/changelog/23602.txt
similarity index 100%
rename from .changelog/23602.txt
rename to .archive/changelog/23602.txt
diff --git a/.changelog/23604.txt b/.archive/changelog/23604.txt
similarity index 100%
rename from .changelog/23604.txt
rename to .archive/changelog/23604.txt
diff --git a/.changelog/23606.txt b/.archive/changelog/23606.txt
similarity index 100%
rename from .changelog/23606.txt
rename to .archive/changelog/23606.txt
diff --git a/.changelog/23607.txt b/.archive/changelog/23607.txt
similarity index 100%
rename from .changelog/23607.txt
rename to .archive/changelog/23607.txt
diff --git a/.changelog/23624.txt b/.archive/changelog/23624.txt
similarity index 100%
rename from .changelog/23624.txt
rename to .archive/changelog/23624.txt
diff --git a/.changelog/23631.txt b/.archive/changelog/23631.txt
similarity index 100%
rename from .changelog/23631.txt
rename to .archive/changelog/23631.txt
diff --git a/.changelog/23647.txt b/.archive/changelog/23647.txt
similarity index 100%
rename from .changelog/23647.txt
rename to .archive/changelog/23647.txt
diff --git a/.changelog/23662.txt b/.archive/changelog/23662.txt
similarity index 100%
rename from .changelog/23662.txt
rename to .archive/changelog/23662.txt
diff --git a/.changelog/23666.txt b/.archive/changelog/23666.txt
similarity index 100%
rename from .changelog/23666.txt
rename to .archive/changelog/23666.txt
diff --git a/.changelog/23672.txt b/.archive/changelog/23672.txt
similarity index 100%
rename from .changelog/23672.txt
rename to .archive/changelog/23672.txt
diff --git a/.changelog/23678.txt b/.archive/changelog/23678.txt
similarity index 100%
rename from .changelog/23678.txt
rename to .archive/changelog/23678.txt
diff --git a/.changelog/23684.txt b/.archive/changelog/23684.txt
similarity index 100%
rename from .changelog/23684.txt
rename to .archive/changelog/23684.txt
diff --git a/.changelog/23687.txt b/.archive/changelog/23687.txt
similarity index 100%
rename from .changelog/23687.txt
rename to .archive/changelog/23687.txt
diff --git a/.changelog/23691.txt b/.archive/changelog/23691.txt
similarity index 100%
rename from .changelog/23691.txt
rename to .archive/changelog/23691.txt
diff --git a/.changelog/23692.txt b/.archive/changelog/23692.txt
similarity index 100%
rename from .changelog/23692.txt
rename to .archive/changelog/23692.txt
diff --git a/.changelog/23703.txt b/.archive/changelog/23703.txt
similarity index 100%
rename from .changelog/23703.txt
rename to .archive/changelog/23703.txt
diff --git a/.changelog/23712.txt b/.archive/changelog/23712.txt
similarity index 100%
rename from .changelog/23712.txt
rename to .archive/changelog/23712.txt
diff --git a/.changelog/23719.txt b/.archive/changelog/23719.txt
similarity index 100%
rename from .changelog/23719.txt
rename to .archive/changelog/23719.txt
diff --git a/.changelog/23723.txt b/.archive/changelog/23723.txt
similarity index 100%
rename from .changelog/23723.txt
rename to .archive/changelog/23723.txt
diff --git a/.changelog/23734.txt b/.archive/changelog/23734.txt
similarity index 100%
rename from .changelog/23734.txt
rename to .archive/changelog/23734.txt
diff --git a/.changelog/23741.txt b/.archive/changelog/23741.txt
similarity index 100%
rename from .changelog/23741.txt
rename to .archive/changelog/23741.txt
diff --git a/.changelog/23745.txt b/.archive/changelog/23745.txt
similarity index 100%
rename from .changelog/23745.txt
rename to .archive/changelog/23745.txt
diff --git a/.changelog/23746.txt b/.archive/changelog/23746.txt
similarity index 100%
rename from .changelog/23746.txt
rename to .archive/changelog/23746.txt
diff --git a/.changelog/23748.txt b/.archive/changelog/23748.txt
similarity index 100%
rename from .changelog/23748.txt
rename to .archive/changelog/23748.txt
diff --git a/.changelog/23754.txt b/.archive/changelog/23754.txt
similarity index 100%
rename from .changelog/23754.txt
rename to .archive/changelog/23754.txt
diff --git a/.changelog/23756.txt b/.archive/changelog/23756.txt
similarity index 100%
rename from .changelog/23756.txt
rename to .archive/changelog/23756.txt
diff --git a/.changelog/23757.txt b/.archive/changelog/23757.txt
similarity index 100%
rename from .changelog/23757.txt
rename to .archive/changelog/23757.txt
diff --git a/.changelog/23759.txt b/.archive/changelog/23759.txt
similarity index 100%
rename from .changelog/23759.txt
rename to .archive/changelog/23759.txt
diff --git a/.changelog/23760.txt b/.archive/changelog/23760.txt
similarity index 100%
rename from .changelog/23760.txt
rename to .archive/changelog/23760.txt
diff --git a/.changelog/23765.txt b/.archive/changelog/23765.txt
similarity index 100%
rename from .changelog/23765.txt
rename to .archive/changelog/23765.txt
diff --git a/.changelog/23767.txt b/.archive/changelog/23767.txt
similarity index 100%
rename from .changelog/23767.txt
rename to .archive/changelog/23767.txt
diff --git a/.changelog/23768.txt b/.archive/changelog/23768.txt
similarity index 100%
rename from .changelog/23768.txt
rename to .archive/changelog/23768.txt
diff --git a/.changelog/23769.txt b/.archive/changelog/23769.txt
similarity index 100%
rename from .changelog/23769.txt
rename to .archive/changelog/23769.txt
diff --git a/.changelog/23770.txt b/.archive/changelog/23770.txt
similarity index 100%
rename from .changelog/23770.txt
rename to .archive/changelog/23770.txt
diff --git a/.changelog/23772.txt b/.archive/changelog/23772.txt
similarity index 100%
rename from .changelog/23772.txt
rename to .archive/changelog/23772.txt
diff --git a/.changelog/23786.txt b/.archive/changelog/23786.txt
similarity index 100%
rename from .changelog/23786.txt
rename to .archive/changelog/23786.txt
diff --git a/.changelog/23792.txt b/.archive/changelog/23792.txt
similarity index 100%
rename from .changelog/23792.txt
rename to .archive/changelog/23792.txt
diff --git a/.changelog/23796.txt b/.archive/changelog/23796.txt
similarity index 100%
rename from .changelog/23796.txt
rename to .archive/changelog/23796.txt
diff --git a/.changelog/23798.txt b/.archive/changelog/23798.txt
similarity index 100%
rename from .changelog/23798.txt
rename to .archive/changelog/23798.txt
diff --git a/.changelog/23804.txt b/.archive/changelog/23804.txt
similarity index 100%
rename from .changelog/23804.txt
rename to .archive/changelog/23804.txt
diff --git a/.changelog/23814.txt b/.archive/changelog/23814.txt
similarity index 100%
rename from .changelog/23814.txt
rename to .archive/changelog/23814.txt
diff --git a/.changelog/23815.txt b/.archive/changelog/23815.txt
similarity index 100%
rename from .changelog/23815.txt
rename to .archive/changelog/23815.txt
diff --git a/.changelog/23816.txt b/.archive/changelog/23816.txt
similarity index 100%
rename from .changelog/23816.txt
rename to .archive/changelog/23816.txt
diff --git a/.changelog/23817.txt b/.archive/changelog/23817.txt
similarity index 100%
rename from .changelog/23817.txt
rename to .archive/changelog/23817.txt
diff --git a/.changelog/23818.txt b/.archive/changelog/23818.txt
similarity index 100%
rename from .changelog/23818.txt
rename to .archive/changelog/23818.txt
diff --git a/.changelog/23819.txt b/.archive/changelog/23819.txt
similarity index 100%
rename from .changelog/23819.txt
rename to .archive/changelog/23819.txt
diff --git a/.changelog/23820.txt b/.archive/changelog/23820.txt
similarity index 100%
rename from .changelog/23820.txt
rename to .archive/changelog/23820.txt
diff --git a/.changelog/23821.txt b/.archive/changelog/23821.txt
similarity index 100%
rename from .changelog/23821.txt
rename to .archive/changelog/23821.txt
diff --git a/.changelog/23822.txt b/.archive/changelog/23822.txt
similarity index 100%
rename from .changelog/23822.txt
rename to .archive/changelog/23822.txt
diff --git a/.changelog/23839.txt b/.archive/changelog/23839.txt
similarity index 100%
rename from .changelog/23839.txt
rename to .archive/changelog/23839.txt
diff --git a/.changelog/23842.txt b/.archive/changelog/23842.txt
similarity index 100%
rename from .changelog/23842.txt
rename to .archive/changelog/23842.txt
diff --git a/.changelog/23843.txt b/.archive/changelog/23843.txt
similarity index 100%
rename from .changelog/23843.txt
rename to .archive/changelog/23843.txt
diff --git a/.changelog/23844.txt b/.archive/changelog/23844.txt
similarity index 100%
rename from .changelog/23844.txt
rename to .archive/changelog/23844.txt
diff --git a/.changelog/23859.txt b/.archive/changelog/23859.txt
similarity index 100%
rename from .changelog/23859.txt
rename to .archive/changelog/23859.txt
diff --git a/.changelog/23862.txt b/.archive/changelog/23862.txt
similarity index 100%
rename from .changelog/23862.txt
rename to .archive/changelog/23862.txt
diff --git a/.changelog/23873.txt b/.archive/changelog/23873.txt
similarity index 100%
rename from .changelog/23873.txt
rename to .archive/changelog/23873.txt
diff --git a/.changelog/23879.txt b/.archive/changelog/23879.txt
similarity index 100%
rename from .changelog/23879.txt
rename to .archive/changelog/23879.txt
diff --git a/.changelog/23880.txt b/.archive/changelog/23880.txt
similarity index 100%
rename from .changelog/23880.txt
rename to .archive/changelog/23880.txt
diff --git a/.changelog/23890.txt b/.archive/changelog/23890.txt
similarity index 100%
rename from .changelog/23890.txt
rename to .archive/changelog/23890.txt
diff --git a/.changelog/23891.txt b/.archive/changelog/23891.txt
similarity index 100%
rename from .changelog/23891.txt
rename to .archive/changelog/23891.txt
diff --git a/.changelog/23892.txt b/.archive/changelog/23892.txt
similarity index 100%
rename from .changelog/23892.txt
rename to .archive/changelog/23892.txt
diff --git a/.changelog/23893.txt b/.archive/changelog/23893.txt
similarity index 100%
rename from .changelog/23893.txt
rename to .archive/changelog/23893.txt
diff --git a/.changelog/23902.txt b/.archive/changelog/23902.txt
similarity index 100%
rename from .changelog/23902.txt
rename to .archive/changelog/23902.txt
diff --git a/.changelog/23904.txt b/.archive/changelog/23904.txt
similarity index 100%
rename from .changelog/23904.txt
rename to .archive/changelog/23904.txt
diff --git a/.changelog/23908.txt b/.archive/changelog/23908.txt
similarity index 100%
rename from .changelog/23908.txt
rename to .archive/changelog/23908.txt
diff --git a/.changelog/23924.txt b/.archive/changelog/23924.txt
similarity index 100%
rename from .changelog/23924.txt
rename to .archive/changelog/23924.txt
diff --git a/.changelog/23930.txt b/.archive/changelog/23930.txt
similarity index 100%
rename from .changelog/23930.txt
rename to .archive/changelog/23930.txt
diff --git a/.changelog/23947.txt b/.archive/changelog/23947.txt
similarity index 100%
rename from .changelog/23947.txt
rename to .archive/changelog/23947.txt
diff --git a/.changelog/23952.txt b/.archive/changelog/23952.txt
similarity index 100%
rename from .changelog/23952.txt
rename to .archive/changelog/23952.txt
diff --git a/.changelog/23967.txt b/.archive/changelog/23967.txt
similarity index 100%
rename from .changelog/23967.txt
rename to .archive/changelog/23967.txt
diff --git a/.changelog/23972.txt b/.archive/changelog/23972.txt
similarity index 100%
rename from .changelog/23972.txt
rename to .archive/changelog/23972.txt
diff --git a/.changelog/23973.txt b/.archive/changelog/23973.txt
similarity index 100%
rename from .changelog/23973.txt
rename to .archive/changelog/23973.txt
diff --git a/.changelog/23979.txt b/.archive/changelog/23979.txt
similarity index 100%
rename from .changelog/23979.txt
rename to .archive/changelog/23979.txt
diff --git a/.changelog/23984.txt b/.archive/changelog/23984.txt
similarity index 100%
rename from .changelog/23984.txt
rename to .archive/changelog/23984.txt
diff --git a/.changelog/23985.txt b/.archive/changelog/23985.txt
similarity index 100%
rename from .changelog/23985.txt
rename to .archive/changelog/23985.txt
diff --git a/.changelog/23990.txt b/.archive/changelog/23990.txt
similarity index 100%
rename from .changelog/23990.txt
rename to .archive/changelog/23990.txt
diff --git a/.changelog/23991.txt b/.archive/changelog/23991.txt
similarity index 100%
rename from .changelog/23991.txt
rename to .archive/changelog/23991.txt
diff --git a/.changelog/23993.txt b/.archive/changelog/23993.txt
similarity index 100%
rename from .changelog/23993.txt
rename to .archive/changelog/23993.txt
diff --git a/.changelog/23996.txt b/.archive/changelog/23996.txt
similarity index 100%
rename from .changelog/23996.txt
rename to .archive/changelog/23996.txt
diff --git a/.changelog/24001.txt b/.archive/changelog/24001.txt
similarity index 100%
rename from .changelog/24001.txt
rename to .archive/changelog/24001.txt
diff --git a/.changelog/24002.txt b/.archive/changelog/24002.txt
similarity index 100%
rename from .changelog/24002.txt
rename to .archive/changelog/24002.txt
diff --git a/.changelog/24011.txt b/.archive/changelog/24011.txt
similarity index 100%
rename from .changelog/24011.txt
rename to .archive/changelog/24011.txt
diff --git a/.changelog/24017.txt b/.archive/changelog/24017.txt
similarity index 100%
rename from .changelog/24017.txt
rename to .archive/changelog/24017.txt
diff --git a/.changelog/24020.txt b/.archive/changelog/24020.txt
similarity index 100%
rename from .changelog/24020.txt
rename to .archive/changelog/24020.txt
diff --git a/.changelog/24021.txt b/.archive/changelog/24021.txt
similarity index 100%
rename from .changelog/24021.txt
rename to .archive/changelog/24021.txt
diff --git a/.changelog/24024.txt b/.archive/changelog/24024.txt
similarity index 100%
rename from .changelog/24024.txt
rename to .archive/changelog/24024.txt
diff --git a/.changelog/24028.txt b/.archive/changelog/24028.txt
similarity index 100%
rename from .changelog/24028.txt
rename to .archive/changelog/24028.txt
diff --git a/.changelog/24038.txt b/.archive/changelog/24038.txt
similarity index 100%
rename from .changelog/24038.txt
rename to .archive/changelog/24038.txt
diff --git a/.changelog/24047.txt b/.archive/changelog/24047.txt
similarity index 100%
rename from .changelog/24047.txt
rename to .archive/changelog/24047.txt
diff --git a/.changelog/24053.txt b/.archive/changelog/24053.txt
similarity index 100%
rename from .changelog/24053.txt
rename to .archive/changelog/24053.txt
diff --git a/.changelog/24057.txt b/.archive/changelog/24057.txt
similarity index 100%
rename from .changelog/24057.txt
rename to .archive/changelog/24057.txt
diff --git a/.changelog/24064.txt b/.archive/changelog/24064.txt
similarity index 100%
rename from .changelog/24064.txt
rename to .archive/changelog/24064.txt
diff --git a/.changelog/24148.txt b/.archive/changelog/24148.txt
similarity index 100%
rename from .changelog/24148.txt
rename to .archive/changelog/24148.txt
diff --git a/.changelog/24154.txt b/.archive/changelog/24154.txt
similarity index 100%
rename from .changelog/24154.txt
rename to .archive/changelog/24154.txt
diff --git a/.changelog/24170.txt b/.archive/changelog/24170.txt
similarity index 100%
rename from .changelog/24170.txt
rename to .archive/changelog/24170.txt
diff --git a/.changelog/24172.txt b/.archive/changelog/24172.txt
similarity index 100%
rename from .changelog/24172.txt
rename to .archive/changelog/24172.txt
diff --git a/.changelog/24188.txt b/.archive/changelog/24188.txt
similarity index 100%
rename from .changelog/24188.txt
rename to .archive/changelog/24188.txt
diff --git a/.changelog/24190.txt b/.archive/changelog/24190.txt
similarity index 100%
rename from .changelog/24190.txt
rename to .archive/changelog/24190.txt
diff --git a/.changelog/24198.txt b/.archive/changelog/24198.txt
similarity index 100%
rename from .changelog/24198.txt
rename to .archive/changelog/24198.txt
diff --git a/.changelog/24200.txt b/.archive/changelog/24200.txt
similarity index 100%
rename from .changelog/24200.txt
rename to .archive/changelog/24200.txt
diff --git a/.changelog/24202.txt b/.archive/changelog/24202.txt
similarity index 100%
rename from .changelog/24202.txt
rename to .archive/changelog/24202.txt
diff --git a/.changelog/24204.txt b/.archive/changelog/24204.txt
similarity index 100%
rename from .changelog/24204.txt
rename to .archive/changelog/24204.txt
diff --git a/.changelog/24218.txt b/.archive/changelog/24218.txt
similarity index 100%
rename from .changelog/24218.txt
rename to .archive/changelog/24218.txt
diff --git a/.changelog/24220.txt b/.archive/changelog/24220.txt
similarity index 100%
rename from .changelog/24220.txt
rename to .archive/changelog/24220.txt
diff --git a/.changelog/24222.txt b/.archive/changelog/24222.txt
similarity index 100%
rename from .changelog/24222.txt
rename to .archive/changelog/24222.txt
diff --git a/.changelog/24223.txt b/.archive/changelog/24223.txt
similarity index 100%
rename from .changelog/24223.txt
rename to .archive/changelog/24223.txt
diff --git a/.changelog/24237.txt b/.archive/changelog/24237.txt
similarity index 100%
rename from .changelog/24237.txt
rename to .archive/changelog/24237.txt
diff --git a/.changelog/24248.txt b/.archive/changelog/24248.txt
similarity index 100%
rename from .changelog/24248.txt
rename to .archive/changelog/24248.txt
diff --git a/.changelog/24250.txt b/.archive/changelog/24250.txt
similarity index 100%
rename from .changelog/24250.txt
rename to .archive/changelog/24250.txt
diff --git a/.changelog/24263.txt b/.archive/changelog/24263.txt
similarity index 100%
rename from .changelog/24263.txt
rename to .archive/changelog/24263.txt
diff --git a/.changelog/24264.txt b/.archive/changelog/24264.txt
similarity index 100%
rename from .changelog/24264.txt
rename to .archive/changelog/24264.txt
diff --git a/.changelog/24266.txt b/.archive/changelog/24266.txt
similarity index 100%
rename from .changelog/24266.txt
rename to .archive/changelog/24266.txt
diff --git a/.changelog/24274.txt b/.archive/changelog/24274.txt
similarity index 100%
rename from .changelog/24274.txt
rename to .archive/changelog/24274.txt
diff --git a/.changelog/24275.txt b/.archive/changelog/24275.txt
similarity index 100%
rename from .changelog/24275.txt
rename to .archive/changelog/24275.txt
diff --git a/.changelog/24278.txt b/.archive/changelog/24278.txt
similarity index 100%
rename from .changelog/24278.txt
rename to .archive/changelog/24278.txt
diff --git a/.changelog/24280.txt b/.archive/changelog/24280.txt
similarity index 100%
rename from .changelog/24280.txt
rename to .archive/changelog/24280.txt
diff --git a/.changelog/24283.txt b/.archive/changelog/24283.txt
similarity index 100%
rename from .changelog/24283.txt
rename to .archive/changelog/24283.txt
diff --git a/.changelog/24284.txt b/.archive/changelog/24284.txt
similarity index 100%
rename from .changelog/24284.txt
rename to .archive/changelog/24284.txt
diff --git a/.changelog/24285.txt b/.archive/changelog/24285.txt
similarity index 100%
rename from .changelog/24285.txt
rename to .archive/changelog/24285.txt
diff --git a/.changelog/24286.txt b/.archive/changelog/24286.txt
similarity index 100%
rename from .changelog/24286.txt
rename to .archive/changelog/24286.txt
diff --git a/.changelog/24296.txt b/.archive/changelog/24296.txt
similarity index 100%
rename from .changelog/24296.txt
rename to .archive/changelog/24296.txt
diff --git a/.changelog/24298.txt b/.archive/changelog/24298.txt
similarity index 100%
rename from .changelog/24298.txt
rename to .archive/changelog/24298.txt
diff --git a/.changelog/24299.txt b/.archive/changelog/24299.txt
similarity index 100%
rename from .changelog/24299.txt
rename to .archive/changelog/24299.txt
diff --git a/.changelog/24300.txt b/.archive/changelog/24300.txt
similarity index 100%
rename from .changelog/24300.txt
rename to .archive/changelog/24300.txt
diff --git a/.changelog/24302.txt b/.archive/changelog/24302.txt
similarity index 100%
rename from .changelog/24302.txt
rename to .archive/changelog/24302.txt
diff --git a/.changelog/24303.txt b/.archive/changelog/24303.txt
similarity index 100%
rename from .changelog/24303.txt
rename to .archive/changelog/24303.txt
diff --git a/.changelog/24304.txt b/.archive/changelog/24304.txt
similarity index 100%
rename from .changelog/24304.txt
rename to .archive/changelog/24304.txt
diff --git a/.changelog/24312.txt b/.archive/changelog/24312.txt
similarity index 100%
rename from .changelog/24312.txt
rename to .archive/changelog/24312.txt
diff --git a/.changelog/24334.txt b/.archive/changelog/24334.txt
similarity index 100%
rename from .changelog/24334.txt
rename to .archive/changelog/24334.txt
diff --git a/.changelog/24340.txt b/.archive/changelog/24340.txt
similarity index 100%
rename from .changelog/24340.txt
rename to .archive/changelog/24340.txt
diff --git a/.changelog/24350.txt b/.archive/changelog/24350.txt
similarity index 100%
rename from .changelog/24350.txt
rename to .archive/changelog/24350.txt
diff --git a/.changelog/24351.txt b/.archive/changelog/24351.txt
similarity index 100%
rename from .changelog/24351.txt
rename to .archive/changelog/24351.txt
diff --git a/.changelog/24358.txt b/.archive/changelog/24358.txt
similarity index 100%
rename from .changelog/24358.txt
rename to .archive/changelog/24358.txt
diff --git a/.changelog/24363.txt b/.archive/changelog/24363.txt
similarity index 100%
rename from .changelog/24363.txt
rename to .archive/changelog/24363.txt
diff --git a/.changelog/24368.txt b/.archive/changelog/24368.txt
similarity index 100%
rename from .changelog/24368.txt
rename to .archive/changelog/24368.txt
diff --git a/.changelog/24377.txt b/.archive/changelog/24377.txt
similarity index 100%
rename from .changelog/24377.txt
rename to .archive/changelog/24377.txt
diff --git a/.changelog/24379.txt b/.archive/changelog/24379.txt
similarity index 100%
rename from .changelog/24379.txt
rename to .archive/changelog/24379.txt
diff --git a/.changelog/24382.txt b/.archive/changelog/24382.txt
similarity index 100%
rename from .changelog/24382.txt
rename to .archive/changelog/24382.txt
diff --git a/.changelog/24383.txt b/.archive/changelog/24383.txt
similarity index 100%
rename from .changelog/24383.txt
rename to .archive/changelog/24383.txt
diff --git a/.changelog/24385.txt b/.archive/changelog/24385.txt
similarity index 100%
rename from .changelog/24385.txt
rename to .archive/changelog/24385.txt
diff --git a/.changelog/24394.txt b/.archive/changelog/24394.txt
similarity index 100%
rename from .changelog/24394.txt
rename to .archive/changelog/24394.txt
diff --git a/.changelog/24395.txt b/.archive/changelog/24395.txt
similarity index 100%
rename from .changelog/24395.txt
rename to .archive/changelog/24395.txt
diff --git a/.changelog/24401.txt b/.archive/changelog/24401.txt
similarity index 100%
rename from .changelog/24401.txt
rename to .archive/changelog/24401.txt
diff --git a/.changelog/24402.txt b/.archive/changelog/24402.txt
similarity index 100%
rename from .changelog/24402.txt
rename to .archive/changelog/24402.txt
diff --git a/.changelog/24422.txt b/.archive/changelog/24422.txt
similarity index 100%
rename from .changelog/24422.txt
rename to .archive/changelog/24422.txt
diff --git a/.changelog/24423.txt b/.archive/changelog/24423.txt
similarity index 100%
rename from .changelog/24423.txt
rename to .archive/changelog/24423.txt
diff --git a/.changelog/24441.txt b/.archive/changelog/24441.txt
similarity index 100%
rename from .changelog/24441.txt
rename to .archive/changelog/24441.txt
diff --git a/.changelog/24447.txt b/.archive/changelog/24447.txt
similarity index 100%
rename from .changelog/24447.txt
rename to .archive/changelog/24447.txt
diff --git a/.changelog/24448.txt b/.archive/changelog/24448.txt
similarity index 100%
rename from .changelog/24448.txt
rename to .archive/changelog/24448.txt
diff --git a/.changelog/24450.txt b/.archive/changelog/24450.txt
similarity index 100%
rename from .changelog/24450.txt
rename to .archive/changelog/24450.txt
diff --git a/.changelog/24453.txt b/.archive/changelog/24453.txt
similarity index 100%
rename from .changelog/24453.txt
rename to .archive/changelog/24453.txt
diff --git a/.changelog/24469.txt b/.archive/changelog/24469.txt
similarity index 100%
rename from .changelog/24469.txt
rename to .archive/changelog/24469.txt
diff --git a/.changelog/24489.txt b/.archive/changelog/24489.txt
similarity index 100%
rename from .changelog/24489.txt
rename to .archive/changelog/24489.txt
diff --git a/.changelog/24507.txt b/.archive/changelog/24507.txt
similarity index 100%
rename from .changelog/24507.txt
rename to .archive/changelog/24507.txt
diff --git a/.changelog/24510.txt b/.archive/changelog/24510.txt
similarity index 100%
rename from .changelog/24510.txt
rename to .archive/changelog/24510.txt
diff --git a/.changelog/24514.txt b/.archive/changelog/24514.txt
similarity index 100%
rename from .changelog/24514.txt
rename to .archive/changelog/24514.txt
diff --git a/.changelog/24530.txt b/.archive/changelog/24530.txt
similarity index 100%
rename from .changelog/24530.txt
rename to .archive/changelog/24530.txt
diff --git a/.changelog/24537.txt b/.archive/changelog/24537.txt
similarity index 100%
rename from .changelog/24537.txt
rename to .archive/changelog/24537.txt
diff --git a/.changelog/24541.txt b/.archive/changelog/24541.txt
similarity index 100%
rename from .changelog/24541.txt
rename to .archive/changelog/24541.txt
diff --git a/.changelog/24543.txt b/.archive/changelog/24543.txt
similarity index 100%
rename from .changelog/24543.txt
rename to .archive/changelog/24543.txt
diff --git a/.changelog/24579.txt b/.archive/changelog/24579.txt
similarity index 100%
rename from .changelog/24579.txt
rename to .archive/changelog/24579.txt
diff --git a/.changelog/24582.txt b/.archive/changelog/24582.txt
similarity index 100%
rename from .changelog/24582.txt
rename to .archive/changelog/24582.txt
diff --git a/.changelog/24593.txt b/.archive/changelog/24593.txt
similarity index 100%
rename from .changelog/24593.txt
rename to .archive/changelog/24593.txt
diff --git a/.changelog/24682.txt b/.archive/changelog/24682.txt
similarity index 100%
rename from .changelog/24682.txt
rename to .archive/changelog/24682.txt
diff --git a/.changelog/24685.txt b/.archive/changelog/24685.txt
similarity index 100%
rename from .changelog/24685.txt
rename to .archive/changelog/24685.txt
diff --git a/.changelog/24687.txt b/.archive/changelog/24687.txt
similarity index 100%
rename from .changelog/24687.txt
rename to .archive/changelog/24687.txt
diff --git a/.changelog/24688.txt b/.archive/changelog/24688.txt
similarity index 100%
rename from .changelog/24688.txt
rename to .archive/changelog/24688.txt
diff --git a/.changelog/24691.txt b/.archive/changelog/24691.txt
similarity index 100%
rename from .changelog/24691.txt
rename to .archive/changelog/24691.txt
diff --git a/.changelog/24693.txt b/.archive/changelog/24693.txt
similarity index 100%
rename from .changelog/24693.txt
rename to .archive/changelog/24693.txt
diff --git a/.changelog/24695.txt b/.archive/changelog/24695.txt
similarity index 100%
rename from .changelog/24695.txt
rename to .archive/changelog/24695.txt
diff --git a/.changelog/24697.txt b/.archive/changelog/24697.txt
similarity index 100%
rename from .changelog/24697.txt
rename to .archive/changelog/24697.txt
diff --git a/.changelog/24708.txt b/.archive/changelog/24708.txt
similarity index 100%
rename from .changelog/24708.txt
rename to .archive/changelog/24708.txt
diff --git a/.changelog/24732.txt b/.archive/changelog/24732.txt
similarity index 100%
rename from .changelog/24732.txt
rename to .archive/changelog/24732.txt
diff --git a/.changelog/24745.txt b/.archive/changelog/24745.txt
similarity index 100%
rename from .changelog/24745.txt
rename to .archive/changelog/24745.txt
diff --git a/.changelog/24748.txt b/.archive/changelog/24748.txt
similarity index 100%
rename from .changelog/24748.txt
rename to .archive/changelog/24748.txt
diff --git a/.changelog/24749.txt b/.archive/changelog/24749.txt
similarity index 100%
rename from .changelog/24749.txt
rename to .archive/changelog/24749.txt
diff --git a/.changelog/24758.txt b/.archive/changelog/24758.txt
similarity index 100%
rename from .changelog/24758.txt
rename to .archive/changelog/24758.txt
diff --git a/.changelog/24764.txt b/.archive/changelog/24764.txt
similarity index 100%
rename from .changelog/24764.txt
rename to .archive/changelog/24764.txt
diff --git a/.changelog/24766.txt b/.archive/changelog/24766.txt
similarity index 100%
rename from .changelog/24766.txt
rename to .archive/changelog/24766.txt
diff --git a/.changelog/24767.txt b/.archive/changelog/24767.txt
similarity index 100%
rename from .changelog/24767.txt
rename to .archive/changelog/24767.txt
diff --git a/.changelog/24768.txt b/.archive/changelog/24768.txt
similarity index 100%
rename from .changelog/24768.txt
rename to .archive/changelog/24768.txt
diff --git a/.changelog/24772.txt b/.archive/changelog/24772.txt
similarity index 100%
rename from .changelog/24772.txt
rename to .archive/changelog/24772.txt
diff --git a/.changelog/24777.txt b/.archive/changelog/24777.txt
similarity index 100%
rename from .changelog/24777.txt
rename to .archive/changelog/24777.txt
diff --git a/.changelog/24787.txt b/.archive/changelog/24787.txt
similarity index 100%
rename from .changelog/24787.txt
rename to .archive/changelog/24787.txt
diff --git a/.changelog/24795.txt b/.archive/changelog/24795.txt
similarity index 100%
rename from .changelog/24795.txt
rename to .archive/changelog/24795.txt
diff --git a/.changelog/24804.txt b/.archive/changelog/24804.txt
similarity index 100%
rename from .changelog/24804.txt
rename to .archive/changelog/24804.txt
diff --git a/.changelog/24821.txt b/.archive/changelog/24821.txt
similarity index 100%
rename from .changelog/24821.txt
rename to .archive/changelog/24821.txt
diff --git a/.changelog/24832.txt b/.archive/changelog/24832.txt
similarity index 100%
rename from .changelog/24832.txt
rename to .archive/changelog/24832.txt
diff --git a/.changelog/24846.txt b/.archive/changelog/24846.txt
similarity index 100%
rename from .changelog/24846.txt
rename to .archive/changelog/24846.txt
diff --git a/.changelog/24849.txt b/.archive/changelog/24849.txt
similarity index 100%
rename from .changelog/24849.txt
rename to .archive/changelog/24849.txt
diff --git a/.changelog/24856.txt b/.archive/changelog/24856.txt
similarity index 100%
rename from .changelog/24856.txt
rename to .archive/changelog/24856.txt
diff --git a/.changelog/24861.txt b/.archive/changelog/24861.txt
similarity index 100%
rename from .changelog/24861.txt
rename to .archive/changelog/24861.txt
diff --git a/.changelog/24864.txt b/.archive/changelog/24864.txt
similarity index 100%
rename from .changelog/24864.txt
rename to .archive/changelog/24864.txt
diff --git a/.changelog/24875.txt b/.archive/changelog/24875.txt
similarity index 100%
rename from .changelog/24875.txt
rename to .archive/changelog/24875.txt
diff --git a/.changelog/24882.txt b/.archive/changelog/24882.txt
similarity index 100%
rename from .changelog/24882.txt
rename to .archive/changelog/24882.txt
diff --git a/.changelog/24886.txt b/.archive/changelog/24886.txt
similarity index 100%
rename from .changelog/24886.txt
rename to .archive/changelog/24886.txt
diff --git a/.changelog/24889.txt b/.archive/changelog/24889.txt
similarity index 100%
rename from .changelog/24889.txt
rename to .archive/changelog/24889.txt
diff --git a/.changelog/24899.txt b/.archive/changelog/24899.txt
similarity index 100%
rename from .changelog/24899.txt
rename to .archive/changelog/24899.txt
diff --git a/.changelog/24906.txt b/.archive/changelog/24906.txt
similarity index 100%
rename from .changelog/24906.txt
rename to .archive/changelog/24906.txt
diff --git a/.changelog/24907.txt b/.archive/changelog/24907.txt
similarity index 100%
rename from .changelog/24907.txt
rename to .archive/changelog/24907.txt
diff --git a/.changelog/24909.txt b/.archive/changelog/24909.txt
similarity index 100%
rename from .changelog/24909.txt
rename to .archive/changelog/24909.txt
diff --git a/.changelog/24913.txt b/.archive/changelog/24913.txt
similarity index 100%
rename from .changelog/24913.txt
rename to .archive/changelog/24913.txt
diff --git a/.changelog/24915.txt b/.archive/changelog/24915.txt
similarity index 100%
rename from .changelog/24915.txt
rename to .archive/changelog/24915.txt
diff --git a/.changelog/24916.txt b/.archive/changelog/24916.txt
similarity index 100%
rename from .changelog/24916.txt
rename to .archive/changelog/24916.txt
diff --git a/.changelog/24920.txt b/.archive/changelog/24920.txt
similarity index 100%
rename from .changelog/24920.txt
rename to .archive/changelog/24920.txt
diff --git a/.changelog/24941.txt b/.archive/changelog/24941.txt
similarity index 100%
rename from .changelog/24941.txt
rename to .archive/changelog/24941.txt
diff --git a/.changelog/24951.txt b/.archive/changelog/24951.txt
similarity index 100%
rename from .changelog/24951.txt
rename to .archive/changelog/24951.txt
diff --git a/.changelog/24965.txt b/.archive/changelog/24965.txt
similarity index 100%
rename from .changelog/24965.txt
rename to .archive/changelog/24965.txt
diff --git a/.changelog/24980.txt b/.archive/changelog/24980.txt
similarity index 100%
rename from .changelog/24980.txt
rename to .archive/changelog/24980.txt
diff --git a/.changelog/24982.txt b/.archive/changelog/24982.txt
similarity index 100%
rename from .changelog/24982.txt
rename to .archive/changelog/24982.txt
diff --git a/.changelog/25045.txt b/.archive/changelog/25045.txt
similarity index 100%
rename from .changelog/25045.txt
rename to .archive/changelog/25045.txt
diff --git a/.changelog/25046.txt b/.archive/changelog/25046.txt
similarity index 100%
rename from .changelog/25046.txt
rename to .archive/changelog/25046.txt
diff --git a/.changelog/25053.txt b/.archive/changelog/25053.txt
similarity index 100%
rename from .changelog/25053.txt
rename to .archive/changelog/25053.txt
diff --git a/.changelog/25060.txt b/.archive/changelog/25060.txt
similarity index 100%
rename from .changelog/25060.txt
rename to .archive/changelog/25060.txt
diff --git a/.changelog/25062.txt b/.archive/changelog/25062.txt
similarity index 100%
rename from .changelog/25062.txt
rename to .archive/changelog/25062.txt
diff --git a/.changelog/25072.txt b/.archive/changelog/25072.txt
similarity index 100%
rename from .changelog/25072.txt
rename to .archive/changelog/25072.txt
diff --git a/.changelog/25073.txt b/.archive/changelog/25073.txt
similarity index 100%
rename from .changelog/25073.txt
rename to .archive/changelog/25073.txt
diff --git a/.changelog/25077.txt b/.archive/changelog/25077.txt
similarity index 100%
rename from .changelog/25077.txt
rename to .archive/changelog/25077.txt
diff --git a/.changelog/25080.txt b/.archive/changelog/25080.txt
similarity index 100%
rename from .changelog/25080.txt
rename to .archive/changelog/25080.txt
diff --git a/.changelog/25092.txt b/.archive/changelog/25092.txt
similarity index 100%
rename from .changelog/25092.txt
rename to .archive/changelog/25092.txt
diff --git a/.changelog/25093.txt b/.archive/changelog/25093.txt
similarity index 100%
rename from .changelog/25093.txt
rename to .archive/changelog/25093.txt
diff --git a/.changelog/25096.txt b/.archive/changelog/25096.txt
similarity index 100%
rename from .changelog/25096.txt
rename to .archive/changelog/25096.txt
diff --git a/.changelog/25097.txt b/.archive/changelog/25097.txt
similarity index 100%
rename from .changelog/25097.txt
rename to .archive/changelog/25097.txt
diff --git a/.changelog/25098.txt b/.archive/changelog/25098.txt
similarity index 100%
rename from .changelog/25098.txt
rename to .archive/changelog/25098.txt
diff --git a/.changelog/25104.txt b/.archive/changelog/25104.txt
similarity index 100%
rename from .changelog/25104.txt
rename to .archive/changelog/25104.txt
diff --git a/.changelog/25109.txt b/.archive/changelog/25109.txt
similarity index 100%
rename from .changelog/25109.txt
rename to .archive/changelog/25109.txt
diff --git a/.changelog/25113.txt b/.archive/changelog/25113.txt
similarity index 100%
rename from .changelog/25113.txt
rename to .archive/changelog/25113.txt
diff --git a/.changelog/25130.txt b/.archive/changelog/25130.txt
similarity index 100%
rename from .changelog/25130.txt
rename to .archive/changelog/25130.txt
diff --git a/.changelog/25131.txt b/.archive/changelog/25131.txt
similarity index 100%
rename from .changelog/25131.txt
rename to .archive/changelog/25131.txt
diff --git a/.changelog/25135.txt b/.archive/changelog/25135.txt
similarity index 100%
rename from .changelog/25135.txt
rename to .archive/changelog/25135.txt
diff --git a/.changelog/25140.txt b/.archive/changelog/25140.txt
similarity index 100%
rename from .changelog/25140.txt
rename to .archive/changelog/25140.txt
diff --git a/.changelog/25144.txt b/.archive/changelog/25144.txt
similarity index 100%
rename from .changelog/25144.txt
rename to .archive/changelog/25144.txt
diff --git a/.changelog/25145.txt b/.archive/changelog/25145.txt
similarity index 100%
rename from .changelog/25145.txt
rename to .archive/changelog/25145.txt
diff --git a/.changelog/25158.txt b/.archive/changelog/25158.txt
similarity index 100%
rename from .changelog/25158.txt
rename to .archive/changelog/25158.txt
diff --git a/.changelog/25159.txt b/.archive/changelog/25159.txt
similarity index 100%
rename from .changelog/25159.txt
rename to .archive/changelog/25159.txt
diff --git a/.changelog/25161.txt b/.archive/changelog/25161.txt
similarity index 100%
rename from .changelog/25161.txt
rename to .archive/changelog/25161.txt
diff --git a/.changelog/25162.txt b/.archive/changelog/25162.txt
similarity index 100%
rename from .changelog/25162.txt
rename to .archive/changelog/25162.txt
diff --git a/.changelog/25174.txt b/.archive/changelog/25174.txt
similarity index 100%
rename from .changelog/25174.txt
rename to .archive/changelog/25174.txt
diff --git a/.changelog/25177.txt b/.archive/changelog/25177.txt
similarity index 100%
rename from .changelog/25177.txt
rename to .archive/changelog/25177.txt
diff --git a/.changelog/25180.txt b/.archive/changelog/25180.txt
similarity index 100%
rename from .changelog/25180.txt
rename to .archive/changelog/25180.txt
diff --git a/.changelog/25181.txt b/.archive/changelog/25181.txt
similarity index 100%
rename from .changelog/25181.txt
rename to .archive/changelog/25181.txt
diff --git a/.changelog/25182.txt b/.archive/changelog/25182.txt
similarity index 100%
rename from .changelog/25182.txt
rename to .archive/changelog/25182.txt
diff --git a/.changelog/25184.txt b/.archive/changelog/25184.txt
similarity index 100%
rename from .changelog/25184.txt
rename to .archive/changelog/25184.txt
diff --git a/.changelog/25185.txt b/.archive/changelog/25185.txt
similarity index 100%
rename from .changelog/25185.txt
rename to .archive/changelog/25185.txt
diff --git a/.changelog/25187.txt b/.archive/changelog/25187.txt
similarity index 100%
rename from .changelog/25187.txt
rename to .archive/changelog/25187.txt
diff --git a/.changelog/25189.txt b/.archive/changelog/25189.txt
similarity index 100%
rename from .changelog/25189.txt
rename to .archive/changelog/25189.txt
diff --git a/.changelog/25190.txt b/.archive/changelog/25190.txt
similarity index 100%
rename from .changelog/25190.txt
rename to .archive/changelog/25190.txt
diff --git a/.changelog/25195.txt b/.archive/changelog/25195.txt
similarity index 100%
rename from .changelog/25195.txt
rename to .archive/changelog/25195.txt
diff --git a/.changelog/25198.txt b/.archive/changelog/25198.txt
similarity index 100%
rename from .changelog/25198.txt
rename to .archive/changelog/25198.txt
diff --git a/.changelog/25199.txt b/.archive/changelog/25199.txt
similarity index 100%
rename from .changelog/25199.txt
rename to .archive/changelog/25199.txt
diff --git a/.changelog/25218.txt b/.archive/changelog/25218.txt
similarity index 100%
rename from .changelog/25218.txt
rename to .archive/changelog/25218.txt
diff --git a/.changelog/25224.txt b/.archive/changelog/25224.txt
similarity index 100%
rename from .changelog/25224.txt
rename to .archive/changelog/25224.txt
diff --git a/.changelog/25230.txt b/.archive/changelog/25230.txt
similarity index 100%
rename from .changelog/25230.txt
rename to .archive/changelog/25230.txt
diff --git a/.changelog/25236.txt b/.archive/changelog/25236.txt
similarity index 100%
rename from .changelog/25236.txt
rename to .archive/changelog/25236.txt
diff --git a/.changelog/25245.txt b/.archive/changelog/25245.txt
similarity index 100%
rename from .changelog/25245.txt
rename to .archive/changelog/25245.txt
diff --git a/.changelog/25255.txt b/.archive/changelog/25255.txt
similarity index 100%
rename from .changelog/25255.txt
rename to .archive/changelog/25255.txt
diff --git a/.changelog/25257.txt b/.archive/changelog/25257.txt
similarity index 100%
rename from .changelog/25257.txt
rename to .archive/changelog/25257.txt
diff --git a/.changelog/25259.txt b/.archive/changelog/25259.txt
similarity index 100%
rename from .changelog/25259.txt
rename to .archive/changelog/25259.txt
diff --git a/.changelog/25260.txt b/.archive/changelog/25260.txt
similarity index 100%
rename from .changelog/25260.txt
rename to .archive/changelog/25260.txt
diff --git a/.changelog/25272.txt b/.archive/changelog/25272.txt
similarity index 100%
rename from .changelog/25272.txt
rename to .archive/changelog/25272.txt
diff --git a/.changelog/25275.txt b/.archive/changelog/25275.txt
similarity index 100%
rename from .changelog/25275.txt
rename to .archive/changelog/25275.txt
diff --git a/.changelog/25277.txt b/.archive/changelog/25277.txt
similarity index 100%
rename from .changelog/25277.txt
rename to .archive/changelog/25277.txt
diff --git a/.changelog/25282.txt b/.archive/changelog/25282.txt
similarity index 100%
rename from .changelog/25282.txt
rename to .archive/changelog/25282.txt
diff --git a/.changelog/25283.txt b/.archive/changelog/25283.txt
similarity index 100%
rename from .changelog/25283.txt
rename to .archive/changelog/25283.txt
diff --git a/.changelog/25284.txt b/.archive/changelog/25284.txt
similarity index 100%
rename from .changelog/25284.txt
rename to .archive/changelog/25284.txt
diff --git a/.changelog/25286.txt b/.archive/changelog/25286.txt
similarity index 100%
rename from .changelog/25286.txt
rename to .archive/changelog/25286.txt
diff --git a/.changelog/25287.txt b/.archive/changelog/25287.txt
similarity index 100%
rename from .changelog/25287.txt
rename to .archive/changelog/25287.txt
diff --git a/.changelog/25315.txt b/.archive/changelog/25315.txt
similarity index 100%
rename from .changelog/25315.txt
rename to .archive/changelog/25315.txt
diff --git a/.changelog/25326.txt b/.archive/changelog/25326.txt
similarity index 100%
rename from .changelog/25326.txt
rename to .archive/changelog/25326.txt
diff --git a/.changelog/25368.txt b/.archive/changelog/25368.txt
similarity index 100%
rename from .changelog/25368.txt
rename to .archive/changelog/25368.txt
diff --git a/.changelog/25370.txt b/.archive/changelog/25370.txt
similarity index 100%
rename from .changelog/25370.txt
rename to .archive/changelog/25370.txt
diff --git a/.changelog/25371.txt b/.archive/changelog/25371.txt
similarity index 100%
rename from .changelog/25371.txt
rename to .archive/changelog/25371.txt
diff --git a/.changelog/25372.txt b/.archive/changelog/25372.txt
similarity index 100%
rename from .changelog/25372.txt
rename to .archive/changelog/25372.txt
diff --git a/.changelog/25432.txt b/.archive/changelog/25432.txt
similarity index 100%
rename from .changelog/25432.txt
rename to .archive/changelog/25432.txt
diff --git a/.changelog/25450.txt b/.archive/changelog/25450.txt
similarity index 100%
rename from .changelog/25450.txt
rename to .archive/changelog/25450.txt
diff --git a/.changelog/25464.txt b/.archive/changelog/25464.txt
similarity index 100%
rename from .changelog/25464.txt
rename to .archive/changelog/25464.txt
diff --git a/.changelog/25466.txt b/.archive/changelog/25466.txt
similarity index 100%
rename from .changelog/25466.txt
rename to .archive/changelog/25466.txt
diff --git a/.changelog/25473.txt b/.archive/changelog/25473.txt
similarity index 100%
rename from .changelog/25473.txt
rename to .archive/changelog/25473.txt
diff --git a/.changelog/25474.txt b/.archive/changelog/25474.txt
similarity index 100%
rename from .changelog/25474.txt
rename to .archive/changelog/25474.txt
diff --git a/.changelog/25476.txt b/.archive/changelog/25476.txt
similarity index 100%
rename from .changelog/25476.txt
rename to .archive/changelog/25476.txt
diff --git a/.changelog/25488.txt b/.archive/changelog/25488.txt
similarity index 100%
rename from .changelog/25488.txt
rename to .archive/changelog/25488.txt
diff --git a/.changelog/25495.txt b/.archive/changelog/25495.txt
similarity index 100%
rename from .changelog/25495.txt
rename to .archive/changelog/25495.txt
diff --git a/.changelog/25496.txt b/.archive/changelog/25496.txt
similarity index 100%
rename from .changelog/25496.txt
rename to .archive/changelog/25496.txt
diff --git a/.changelog/25509.txt b/.archive/changelog/25509.txt
similarity index 100%
rename from .changelog/25509.txt
rename to .archive/changelog/25509.txt
diff --git a/.changelog/25511.txt b/.archive/changelog/25511.txt
similarity index 100%
rename from .changelog/25511.txt
rename to .archive/changelog/25511.txt
diff --git a/.changelog/25512.txt b/.archive/changelog/25512.txt
similarity index 100%
rename from .changelog/25512.txt
rename to .archive/changelog/25512.txt
diff --git a/.changelog/25514.txt b/.archive/changelog/25514.txt
similarity index 100%
rename from .changelog/25514.txt
rename to .archive/changelog/25514.txt
diff --git a/.changelog/25515.txt b/.archive/changelog/25515.txt
similarity index 100%
rename from .changelog/25515.txt
rename to .archive/changelog/25515.txt
diff --git a/.changelog/25523.txt b/.archive/changelog/25523.txt
similarity index 100%
rename from .changelog/25523.txt
rename to .archive/changelog/25523.txt
diff --git a/.changelog/25529.txt b/.archive/changelog/25529.txt
similarity index 100%
rename from .changelog/25529.txt
rename to .archive/changelog/25529.txt
diff --git a/.changelog/25535.txt b/.archive/changelog/25535.txt
similarity index 100%
rename from .changelog/25535.txt
rename to .archive/changelog/25535.txt
diff --git a/.changelog/25536.txt b/.archive/changelog/25536.txt
similarity index 100%
rename from .changelog/25536.txt
rename to .archive/changelog/25536.txt
diff --git a/.changelog/25538.txt b/.archive/changelog/25538.txt
similarity index 100%
rename from .changelog/25538.txt
rename to .archive/changelog/25538.txt
diff --git a/.changelog/25544.txt b/.archive/changelog/25544.txt
similarity index 100%
rename from .changelog/25544.txt
rename to .archive/changelog/25544.txt
diff --git a/.changelog/25549.txt b/.archive/changelog/25549.txt
similarity index 100%
rename from .changelog/25549.txt
rename to .archive/changelog/25549.txt
diff --git a/.changelog/25555.txt b/.archive/changelog/25555.txt
similarity index 100%
rename from .changelog/25555.txt
rename to .archive/changelog/25555.txt
diff --git a/.changelog/25557.txt b/.archive/changelog/25557.txt
similarity index 100%
rename from .changelog/25557.txt
rename to .archive/changelog/25557.txt
diff --git a/.changelog/25562.txt b/.archive/changelog/25562.txt
similarity index 100%
rename from .changelog/25562.txt
rename to .archive/changelog/25562.txt
diff --git a/.changelog/25565.txt b/.archive/changelog/25565.txt
similarity index 100%
rename from .changelog/25565.txt
rename to .archive/changelog/25565.txt
diff --git a/.changelog/25566.txt b/.archive/changelog/25566.txt
similarity index 100%
rename from .changelog/25566.txt
rename to .archive/changelog/25566.txt
diff --git a/.changelog/25591.txt b/.archive/changelog/25591.txt
similarity index 100%
rename from .changelog/25591.txt
rename to .archive/changelog/25591.txt
diff --git a/.changelog/25592.txt b/.archive/changelog/25592.txt
similarity index 100%
rename from .changelog/25592.txt
rename to .archive/changelog/25592.txt
diff --git a/.changelog/25601.txt b/.archive/changelog/25601.txt
similarity index 100%
rename from .changelog/25601.txt
rename to .archive/changelog/25601.txt
diff --git a/.changelog/25615.txt b/.archive/changelog/25615.txt
similarity index 100%
rename from .changelog/25615.txt
rename to .archive/changelog/25615.txt
diff --git a/.changelog/25620.txt b/.archive/changelog/25620.txt
similarity index 100%
rename from .changelog/25620.txt
rename to .archive/changelog/25620.txt
diff --git a/.changelog/25623.txt b/.archive/changelog/25623.txt
similarity index 100%
rename from .changelog/25623.txt
rename to .archive/changelog/25623.txt
diff --git a/.changelog/25638.txt b/.archive/changelog/25638.txt
similarity index 100%
rename from .changelog/25638.txt
rename to .archive/changelog/25638.txt
diff --git a/.changelog/25639.txt b/.archive/changelog/25639.txt
similarity index 100%
rename from .changelog/25639.txt
rename to .archive/changelog/25639.txt
diff --git a/.changelog/25641.txt b/.archive/changelog/25641.txt
similarity index 100%
rename from .changelog/25641.txt
rename to .archive/changelog/25641.txt
diff --git a/.changelog/25645.txt b/.archive/changelog/25645.txt
similarity index 100%
rename from .changelog/25645.txt
rename to .archive/changelog/25645.txt
diff --git a/.changelog/25656.txt b/.archive/changelog/25656.txt
similarity index 100%
rename from .changelog/25656.txt
rename to .archive/changelog/25656.txt
diff --git a/.changelog/25659.txt b/.archive/changelog/25659.txt
similarity index 100%
rename from .changelog/25659.txt
rename to .archive/changelog/25659.txt
diff --git a/.changelog/25668.txt b/.archive/changelog/25668.txt
similarity index 100%
rename from .changelog/25668.txt
rename to .archive/changelog/25668.txt
diff --git a/.changelog/25671.txt b/.archive/changelog/25671.txt
similarity index 100%
rename from .changelog/25671.txt
rename to .archive/changelog/25671.txt
diff --git a/.changelog/25673.txt b/.archive/changelog/25673.txt
similarity index 100%
rename from .changelog/25673.txt
rename to .archive/changelog/25673.txt
diff --git a/.changelog/25681.txt b/.archive/changelog/25681.txt
similarity index 100%
rename from .changelog/25681.txt
rename to .archive/changelog/25681.txt
diff --git a/.changelog/25684.txt b/.archive/changelog/25684.txt
similarity index 100%
rename from .changelog/25684.txt
rename to .archive/changelog/25684.txt
diff --git a/.changelog/25686.txt b/.archive/changelog/25686.txt
similarity index 100%
rename from .changelog/25686.txt
rename to .archive/changelog/25686.txt
diff --git a/.changelog/25689.txt b/.archive/changelog/25689.txt
similarity index 100%
rename from .changelog/25689.txt
rename to .archive/changelog/25689.txt
diff --git a/.changelog/25695.txt b/.archive/changelog/25695.txt
similarity index 100%
rename from .changelog/25695.txt
rename to .archive/changelog/25695.txt
diff --git a/.changelog/25697.txt b/.archive/changelog/25697.txt
similarity index 100%
rename from .changelog/25697.txt
rename to .archive/changelog/25697.txt
diff --git a/.changelog/25698.txt b/.archive/changelog/25698.txt
similarity index 100%
rename from .changelog/25698.txt
rename to .archive/changelog/25698.txt
diff --git a/.changelog/25704.txt b/.archive/changelog/25704.txt
similarity index 100%
rename from .changelog/25704.txt
rename to .archive/changelog/25704.txt
diff --git a/.changelog/25708.txt b/.archive/changelog/25708.txt
similarity index 100%
rename from .changelog/25708.txt
rename to .archive/changelog/25708.txt
diff --git a/.changelog/25718.txt b/.archive/changelog/25718.txt
similarity index 100%
rename from .changelog/25718.txt
rename to .archive/changelog/25718.txt
diff --git a/.changelog/25720.txt b/.archive/changelog/25720.txt
similarity index 100%
rename from .changelog/25720.txt
rename to .archive/changelog/25720.txt
diff --git a/.changelog/25721.txt b/.archive/changelog/25721.txt
similarity index 100%
rename from .changelog/25721.txt
rename to .archive/changelog/25721.txt
diff --git a/.changelog/25722.txt b/.archive/changelog/25722.txt
similarity index 100%
rename from .changelog/25722.txt
rename to .archive/changelog/25722.txt
diff --git a/.changelog/25723.txt b/.archive/changelog/25723.txt
similarity index 100%
rename from .changelog/25723.txt
rename to .archive/changelog/25723.txt
diff --git a/.changelog/25729.txt b/.archive/changelog/25729.txt
similarity index 100%
rename from .changelog/25729.txt
rename to .archive/changelog/25729.txt
diff --git a/.changelog/25738.txt b/.archive/changelog/25738.txt
similarity index 100%
rename from .changelog/25738.txt
rename to .archive/changelog/25738.txt
diff --git a/.changelog/25755.txt b/.archive/changelog/25755.txt
similarity index 100%
rename from .changelog/25755.txt
rename to .archive/changelog/25755.txt
diff --git a/.changelog/25762.txt b/.archive/changelog/25762.txt
similarity index 100%
rename from .changelog/25762.txt
rename to .archive/changelog/25762.txt
diff --git a/.changelog/25766.txt b/.archive/changelog/25766.txt
similarity index 100%
rename from .changelog/25766.txt
rename to .archive/changelog/25766.txt
diff --git a/.changelog/25768.txt b/.archive/changelog/25768.txt
similarity index 100%
rename from .changelog/25768.txt
rename to .archive/changelog/25768.txt
diff --git a/.changelog/25779.txt b/.archive/changelog/25779.txt
similarity index 100%
rename from .changelog/25779.txt
rename to .archive/changelog/25779.txt
diff --git a/.changelog/25781.txt b/.archive/changelog/25781.txt
similarity index 100%
rename from .changelog/25781.txt
rename to .archive/changelog/25781.txt
diff --git a/.changelog/25789.txt b/.archive/changelog/25789.txt
similarity index 100%
rename from .changelog/25789.txt
rename to .archive/changelog/25789.txt
diff --git a/.changelog/25790.txt b/.archive/changelog/25790.txt
similarity index 100%
rename from .changelog/25790.txt
rename to .archive/changelog/25790.txt
diff --git a/.changelog/25793.txt b/.archive/changelog/25793.txt
similarity index 100%
rename from .changelog/25793.txt
rename to .archive/changelog/25793.txt
diff --git a/.changelog/25796.txt b/.archive/changelog/25796.txt
similarity index 100%
rename from .changelog/25796.txt
rename to .archive/changelog/25796.txt
diff --git a/.changelog/25819.txt b/.archive/changelog/25819.txt
similarity index 100%
rename from .changelog/25819.txt
rename to .archive/changelog/25819.txt
diff --git a/.changelog/25822.txt b/.archive/changelog/25822.txt
similarity index 100%
rename from .changelog/25822.txt
rename to .archive/changelog/25822.txt
diff --git a/.changelog/25840.txt b/.archive/changelog/25840.txt
similarity index 100%
rename from .changelog/25840.txt
rename to .archive/changelog/25840.txt
diff --git a/.changelog/25841.txt b/.archive/changelog/25841.txt
similarity index 100%
rename from .changelog/25841.txt
rename to .archive/changelog/25841.txt
diff --git a/.changelog/25844.txt b/.archive/changelog/25844.txt
similarity index 100%
rename from .changelog/25844.txt
rename to .archive/changelog/25844.txt
diff --git a/.changelog/25845.txt b/.archive/changelog/25845.txt
similarity index 100%
rename from .changelog/25845.txt
rename to .archive/changelog/25845.txt
diff --git a/.changelog/25846.txt b/.archive/changelog/25846.txt
similarity index 100%
rename from .changelog/25846.txt
rename to .archive/changelog/25846.txt
diff --git a/.changelog/25849.txt b/.archive/changelog/25849.txt
similarity index 100%
rename from .changelog/25849.txt
rename to .archive/changelog/25849.txt
diff --git a/.changelog/25850.txt b/.archive/changelog/25850.txt
similarity index 100%
rename from .changelog/25850.txt
rename to .archive/changelog/25850.txt
diff --git a/.changelog/25863.txt b/.archive/changelog/25863.txt
similarity index 100%
rename from .changelog/25863.txt
rename to .archive/changelog/25863.txt
diff --git a/.changelog/25866.txt b/.archive/changelog/25866.txt
similarity index 100%
rename from .changelog/25866.txt
rename to .archive/changelog/25866.txt
diff --git a/.changelog/25889.txt b/.archive/changelog/25889.txt
similarity index 100%
rename from .changelog/25889.txt
rename to .archive/changelog/25889.txt
diff --git a/.changelog/25913.txt b/.archive/changelog/25913.txt
similarity index 100%
rename from .changelog/25913.txt
rename to .archive/changelog/25913.txt
diff --git a/.changelog/25915.txt b/.archive/changelog/25915.txt
similarity index 100%
rename from .changelog/25915.txt
rename to .archive/changelog/25915.txt
diff --git a/.changelog/25918.txt b/.archive/changelog/25918.txt
similarity index 100%
rename from .changelog/25918.txt
rename to .archive/changelog/25918.txt
diff --git a/.changelog/25922.txt b/.archive/changelog/25922.txt
similarity index 100%
rename from .changelog/25922.txt
rename to .archive/changelog/25922.txt
diff --git a/.changelog/25926.txt b/.archive/changelog/25926.txt
similarity index 100%
rename from .changelog/25926.txt
rename to .archive/changelog/25926.txt
diff --git a/.changelog/25929.txt b/.archive/changelog/25929.txt
similarity index 100%
rename from .changelog/25929.txt
rename to .archive/changelog/25929.txt
diff --git a/.changelog/25941.txt b/.archive/changelog/25941.txt
similarity index 100%
rename from .changelog/25941.txt
rename to .archive/changelog/25941.txt
diff --git a/.changelog/25961.txt b/.archive/changelog/25961.txt
similarity index 100%
rename from .changelog/25961.txt
rename to .archive/changelog/25961.txt
diff --git a/.changelog/25964.txt b/.archive/changelog/25964.txt
similarity index 100%
rename from .changelog/25964.txt
rename to .archive/changelog/25964.txt
diff --git a/.changelog/25987.txt b/.archive/changelog/25987.txt
similarity index 100%
rename from .changelog/25987.txt
rename to .archive/changelog/25987.txt
diff --git a/.changelog/25992.txt b/.archive/changelog/25992.txt
similarity index 100%
rename from .changelog/25992.txt
rename to .archive/changelog/25992.txt
diff --git a/.changelog/25994.txt b/.archive/changelog/25994.txt
similarity index 100%
rename from .changelog/25994.txt
rename to .archive/changelog/25994.txt
diff --git a/.changelog/26010.txt b/.archive/changelog/26010.txt
similarity index 100%
rename from .changelog/26010.txt
rename to .archive/changelog/26010.txt
diff --git a/.changelog/26011.txt b/.archive/changelog/26011.txt
similarity index 100%
rename from .changelog/26011.txt
rename to .archive/changelog/26011.txt
diff --git a/.changelog/26012.txt b/.archive/changelog/26012.txt
similarity index 100%
rename from .changelog/26012.txt
rename to .archive/changelog/26012.txt
diff --git a/.changelog/26025.txt b/.archive/changelog/26025.txt
similarity index 100%
rename from .changelog/26025.txt
rename to .archive/changelog/26025.txt
diff --git a/.changelog/26032.txt b/.archive/changelog/26032.txt
similarity index 100%
rename from .changelog/26032.txt
rename to .archive/changelog/26032.txt
diff --git a/.changelog/26045.txt b/.archive/changelog/26045.txt
similarity index 100%
rename from .changelog/26045.txt
rename to .archive/changelog/26045.txt
diff --git a/.changelog/26049.txt b/.archive/changelog/26049.txt
similarity index 100%
rename from .changelog/26049.txt
rename to .archive/changelog/26049.txt
diff --git a/.changelog/26051.txt b/.archive/changelog/26051.txt
similarity index 100%
rename from .changelog/26051.txt
rename to .archive/changelog/26051.txt
diff --git a/.changelog/26055.txt b/.archive/changelog/26055.txt
similarity index 100%
rename from .changelog/26055.txt
rename to .archive/changelog/26055.txt
diff --git a/.changelog/26056.txt b/.archive/changelog/26056.txt
similarity index 100%
rename from .changelog/26056.txt
rename to .archive/changelog/26056.txt
diff --git a/.changelog/26057.txt b/.archive/changelog/26057.txt
similarity index 100%
rename from .changelog/26057.txt
rename to .archive/changelog/26057.txt
diff --git a/.changelog/26060.txt b/.archive/changelog/26060.txt
similarity index 100%
rename from .changelog/26060.txt
rename to .archive/changelog/26060.txt
diff --git a/.changelog/26061.txt b/.archive/changelog/26061.txt
similarity index 100%
rename from .changelog/26061.txt
rename to .archive/changelog/26061.txt
diff --git a/.changelog/26082.txt b/.archive/changelog/26082.txt
similarity index 100%
rename from .changelog/26082.txt
rename to .archive/changelog/26082.txt
diff --git a/.changelog/26110.txt b/.archive/changelog/26110.txt
similarity index 100%
rename from .changelog/26110.txt
rename to .archive/changelog/26110.txt
diff --git a/.changelog/26120.txt b/.archive/changelog/26120.txt
similarity index 100%
rename from .changelog/26120.txt
rename to .archive/changelog/26120.txt
diff --git a/.changelog/26121.txt b/.archive/changelog/26121.txt
similarity index 100%
rename from .changelog/26121.txt
rename to .archive/changelog/26121.txt
diff --git a/.changelog/26123.txt b/.archive/changelog/26123.txt
similarity index 100%
rename from .changelog/26123.txt
rename to .archive/changelog/26123.txt
diff --git a/.changelog/26133.txt b/.archive/changelog/26133.txt
similarity index 100%
rename from .changelog/26133.txt
rename to .archive/changelog/26133.txt
diff --git a/.changelog/26151.txt b/.archive/changelog/26151.txt
similarity index 100%
rename from .changelog/26151.txt
rename to .archive/changelog/26151.txt
diff --git a/.changelog/26152.txt b/.archive/changelog/26152.txt
similarity index 100%
rename from .changelog/26152.txt
rename to .archive/changelog/26152.txt
diff --git a/.changelog/26154.txt b/.archive/changelog/26154.txt
similarity index 100%
rename from .changelog/26154.txt
rename to .archive/changelog/26154.txt
diff --git a/.changelog/26156.txt b/.archive/changelog/26156.txt
similarity index 100%
rename from .changelog/26156.txt
rename to .archive/changelog/26156.txt
diff --git a/.changelog/26158.txt b/.archive/changelog/26158.txt
similarity index 100%
rename from .changelog/26158.txt
rename to .archive/changelog/26158.txt
diff --git a/.changelog/26172.txt b/.archive/changelog/26172.txt
similarity index 100%
rename from .changelog/26172.txt
rename to .archive/changelog/26172.txt
diff --git a/.changelog/26184.txt b/.archive/changelog/26184.txt
similarity index 100%
rename from .changelog/26184.txt
rename to .archive/changelog/26184.txt
diff --git a/.changelog/26185.txt b/.archive/changelog/26185.txt
similarity index 100%
rename from .changelog/26185.txt
rename to .archive/changelog/26185.txt
diff --git a/.changelog/26188.txt b/.archive/changelog/26188.txt
similarity index 100%
rename from .changelog/26188.txt
rename to .archive/changelog/26188.txt
diff --git a/.changelog/26194.txt b/.archive/changelog/26194.txt
similarity index 100%
rename from .changelog/26194.txt
rename to .archive/changelog/26194.txt
diff --git a/.changelog/26199.txt b/.archive/changelog/26199.txt
similarity index 100%
rename from .changelog/26199.txt
rename to .archive/changelog/26199.txt
diff --git a/.changelog/26206.txt b/.archive/changelog/26206.txt
similarity index 100%
rename from .changelog/26206.txt
rename to .archive/changelog/26206.txt
diff --git a/.changelog/26220.txt b/.archive/changelog/26220.txt
similarity index 100%
rename from .changelog/26220.txt
rename to .archive/changelog/26220.txt
diff --git a/.changelog/26227.txt b/.archive/changelog/26227.txt
similarity index 100%
rename from .changelog/26227.txt
rename to .archive/changelog/26227.txt
diff --git a/.changelog/26240.txt b/.archive/changelog/26240.txt
similarity index 100%
rename from .changelog/26240.txt
rename to .archive/changelog/26240.txt
diff --git a/.changelog/26244.txt b/.archive/changelog/26244.txt
similarity index 100%
rename from .changelog/26244.txt
rename to .archive/changelog/26244.txt
diff --git a/.changelog/26250.txt b/.archive/changelog/26250.txt
similarity index 100%
rename from .changelog/26250.txt
rename to .archive/changelog/26250.txt
diff --git a/.changelog/26257.txt b/.archive/changelog/26257.txt
similarity index 100%
rename from .changelog/26257.txt
rename to .archive/changelog/26257.txt
diff --git a/.changelog/26264.txt b/.archive/changelog/26264.txt
similarity index 100%
rename from .changelog/26264.txt
rename to .archive/changelog/26264.txt
diff --git a/.changelog/26274.txt b/.archive/changelog/26274.txt
similarity index 100%
rename from .changelog/26274.txt
rename to .archive/changelog/26274.txt
diff --git a/.changelog/26278.txt b/.archive/changelog/26278.txt
similarity index 100%
rename from .changelog/26278.txt
rename to .archive/changelog/26278.txt
diff --git a/.changelog/26279.txt b/.archive/changelog/26279.txt
similarity index 100%
rename from .changelog/26279.txt
rename to .archive/changelog/26279.txt
diff --git a/.changelog/26281.txt b/.archive/changelog/26281.txt
similarity index 100%
rename from .changelog/26281.txt
rename to .archive/changelog/26281.txt
diff --git a/.changelog/26283.txt b/.archive/changelog/26283.txt
similarity index 100%
rename from .changelog/26283.txt
rename to .archive/changelog/26283.txt
diff --git a/.changelog/26284.txt b/.archive/changelog/26284.txt
similarity index 100%
rename from .changelog/26284.txt
rename to .archive/changelog/26284.txt
diff --git a/.changelog/26286.txt b/.archive/changelog/26286.txt
similarity index 100%
rename from .changelog/26286.txt
rename to .archive/changelog/26286.txt
diff --git a/.changelog/26289.txt b/.archive/changelog/26289.txt
similarity index 100%
rename from .changelog/26289.txt
rename to .archive/changelog/26289.txt
diff --git a/.changelog/26305.txt b/.archive/changelog/26305.txt
similarity index 100%
rename from .changelog/26305.txt
rename to .archive/changelog/26305.txt
diff --git a/.changelog/26308.txt b/.archive/changelog/26308.txt
similarity index 100%
rename from .changelog/26308.txt
rename to .archive/changelog/26308.txt
diff --git a/.changelog/26313.txt b/.archive/changelog/26313.txt
similarity index 100%
rename from .changelog/26313.txt
rename to .archive/changelog/26313.txt
diff --git a/.changelog/26317.txt b/.archive/changelog/26317.txt
similarity index 100%
rename from .changelog/26317.txt
rename to .archive/changelog/26317.txt
diff --git a/.changelog/26320.txt b/.archive/changelog/26320.txt
similarity index 100%
rename from .changelog/26320.txt
rename to .archive/changelog/26320.txt
diff --git a/.changelog/26334.txt b/.archive/changelog/26334.txt
similarity index 100%
rename from .changelog/26334.txt
rename to .archive/changelog/26334.txt
diff --git a/.changelog/26343.txt b/.archive/changelog/26343.txt
similarity index 100%
rename from .changelog/26343.txt
rename to .archive/changelog/26343.txt
diff --git a/.changelog/26364.txt b/.archive/changelog/26364.txt
similarity index 100%
rename from .changelog/26364.txt
rename to .archive/changelog/26364.txt
diff --git a/.changelog/26371.txt b/.archive/changelog/26371.txt
similarity index 100%
rename from .changelog/26371.txt
rename to .archive/changelog/26371.txt
diff --git a/.changelog/26404.txt b/.archive/changelog/26404.txt
similarity index 100%
rename from .changelog/26404.txt
rename to .archive/changelog/26404.txt
diff --git a/.changelog/26407.txt b/.archive/changelog/26407.txt
similarity index 100%
rename from .changelog/26407.txt
rename to .archive/changelog/26407.txt
diff --git a/.changelog/26411.txt b/.archive/changelog/26411.txt
similarity index 100%
rename from .changelog/26411.txt
rename to .archive/changelog/26411.txt
diff --git a/.changelog/26427.txt b/.archive/changelog/26427.txt
similarity index 100%
rename from .changelog/26427.txt
rename to .archive/changelog/26427.txt
diff --git a/.changelog/26439.txt b/.archive/changelog/26439.txt
similarity index 100%
rename from .changelog/26439.txt
rename to .archive/changelog/26439.txt
diff --git a/.changelog/26451.txt b/.archive/changelog/26451.txt
similarity index 100%
rename from .changelog/26451.txt
rename to .archive/changelog/26451.txt
diff --git a/.changelog/26454.txt b/.archive/changelog/26454.txt
similarity index 100%
rename from .changelog/26454.txt
rename to .archive/changelog/26454.txt
diff --git a/.changelog/26467.txt b/.archive/changelog/26467.txt
similarity index 100%
rename from .changelog/26467.txt
rename to .archive/changelog/26467.txt
diff --git a/.changelog/26472.txt b/.archive/changelog/26472.txt
similarity index 100%
rename from .changelog/26472.txt
rename to .archive/changelog/26472.txt
diff --git a/.changelog/26489.txt b/.archive/changelog/26489.txt
similarity index 100%
rename from .changelog/26489.txt
rename to .archive/changelog/26489.txt
diff --git a/.changelog/26493.txt b/.archive/changelog/26493.txt
similarity index 100%
rename from .changelog/26493.txt
rename to .archive/changelog/26493.txt
diff --git a/.changelog/26503.txt b/.archive/changelog/26503.txt
similarity index 100%
rename from .changelog/26503.txt
rename to .archive/changelog/26503.txt
diff --git a/.changelog/26506.txt b/.archive/changelog/26506.txt
similarity index 100%
rename from .changelog/26506.txt
rename to .archive/changelog/26506.txt
diff --git a/.changelog/26508.txt b/.archive/changelog/26508.txt
similarity index 100%
rename from .changelog/26508.txt
rename to .archive/changelog/26508.txt
diff --git a/.changelog/26510.txt b/.archive/changelog/26510.txt
similarity index 100%
rename from .changelog/26510.txt
rename to .archive/changelog/26510.txt
diff --git a/.changelog/26520.txt b/.archive/changelog/26520.txt
similarity index 100%
rename from .changelog/26520.txt
rename to .archive/changelog/26520.txt
diff --git a/.changelog/26521.txt b/.archive/changelog/26521.txt
similarity index 100%
rename from .changelog/26521.txt
rename to .archive/changelog/26521.txt
diff --git a/.changelog/26525.txt b/.archive/changelog/26525.txt
similarity index 100%
rename from .changelog/26525.txt
rename to .archive/changelog/26525.txt
diff --git a/.changelog/26532.txt b/.archive/changelog/26532.txt
similarity index 100%
rename from .changelog/26532.txt
rename to .archive/changelog/26532.txt
diff --git a/.changelog/26546.txt b/.archive/changelog/26546.txt
similarity index 100%
rename from .changelog/26546.txt
rename to .archive/changelog/26546.txt
diff --git a/.changelog/26550.txt b/.archive/changelog/26550.txt
similarity index 100%
rename from .changelog/26550.txt
rename to .archive/changelog/26550.txt
diff --git a/.changelog/26553.txt b/.archive/changelog/26553.txt
similarity index 100%
rename from .changelog/26553.txt
rename to .archive/changelog/26553.txt
diff --git a/.changelog/26555.txt b/.archive/changelog/26555.txt
similarity index 100%
rename from .changelog/26555.txt
rename to .archive/changelog/26555.txt
diff --git a/.changelog/26560.txt b/.archive/changelog/26560.txt
similarity index 100%
rename from .changelog/26560.txt
rename to .archive/changelog/26560.txt
diff --git a/.changelog/26572.txt b/.archive/changelog/26572.txt
similarity index 100%
rename from .changelog/26572.txt
rename to .archive/changelog/26572.txt
diff --git a/.changelog/26590.txt b/.archive/changelog/26590.txt
similarity index 100%
rename from .changelog/26590.txt
rename to .archive/changelog/26590.txt
diff --git a/.changelog/26608.txt b/.archive/changelog/26608.txt
similarity index 100%
rename from .changelog/26608.txt
rename to .archive/changelog/26608.txt
diff --git a/.changelog/26629.txt b/.archive/changelog/26629.txt
similarity index 100%
rename from .changelog/26629.txt
rename to .archive/changelog/26629.txt
diff --git a/.changelog/26631.txt b/.archive/changelog/26631.txt
similarity index 100%
rename from .changelog/26631.txt
rename to .archive/changelog/26631.txt
diff --git a/.changelog/26636.txt b/.archive/changelog/26636.txt
similarity index 100%
rename from .changelog/26636.txt
rename to .archive/changelog/26636.txt
diff --git a/.changelog/26637.txt b/.archive/changelog/26637.txt
similarity index 100%
rename from .changelog/26637.txt
rename to .archive/changelog/26637.txt
diff --git a/.changelog/26640.txt b/.archive/changelog/26640.txt
similarity index 100%
rename from .changelog/26640.txt
rename to .archive/changelog/26640.txt
diff --git a/.changelog/26643.txt b/.archive/changelog/26643.txt
similarity index 100%
rename from .changelog/26643.txt
rename to .archive/changelog/26643.txt
diff --git a/.changelog/26654.txt b/.archive/changelog/26654.txt
similarity index 100%
rename from .changelog/26654.txt
rename to .archive/changelog/26654.txt
diff --git a/.changelog/26657.txt b/.archive/changelog/26657.txt
similarity index 100%
rename from .changelog/26657.txt
rename to .archive/changelog/26657.txt
diff --git a/.changelog/26673.txt b/.archive/changelog/26673.txt
similarity index 100%
rename from .changelog/26673.txt
rename to .archive/changelog/26673.txt
diff --git a/.changelog/26674.txt b/.archive/changelog/26674.txt
similarity index 100%
rename from .changelog/26674.txt
rename to .archive/changelog/26674.txt
diff --git a/.changelog/26677.txt b/.archive/changelog/26677.txt
similarity index 100%
rename from .changelog/26677.txt
rename to .archive/changelog/26677.txt
diff --git a/.changelog/26683.txt b/.archive/changelog/26683.txt
similarity index 100%
rename from .changelog/26683.txt
rename to .archive/changelog/26683.txt
diff --git a/.changelog/26684.txt b/.archive/changelog/26684.txt
similarity index 100%
rename from .changelog/26684.txt
rename to .archive/changelog/26684.txt
diff --git a/.changelog/26694.txt b/.archive/changelog/26694.txt
similarity index 100%
rename from .changelog/26694.txt
rename to .archive/changelog/26694.txt
diff --git a/.changelog/26695.txt b/.archive/changelog/26695.txt
similarity index 100%
rename from .changelog/26695.txt
rename to .archive/changelog/26695.txt
diff --git a/.changelog/26696.txt b/.archive/changelog/26696.txt
similarity index 100%
rename from .changelog/26696.txt
rename to .archive/changelog/26696.txt
diff --git a/.changelog/26697.txt b/.archive/changelog/26697.txt
similarity index 100%
rename from .changelog/26697.txt
rename to .archive/changelog/26697.txt
diff --git a/.changelog/26711.txt b/.archive/changelog/26711.txt
similarity index 100%
rename from .changelog/26711.txt
rename to .archive/changelog/26711.txt
diff --git a/.changelog/26716.txt b/.archive/changelog/26716.txt
similarity index 100%
rename from .changelog/26716.txt
rename to .archive/changelog/26716.txt
diff --git a/.changelog/26727.txt b/.archive/changelog/26727.txt
similarity index 100%
rename from .changelog/26727.txt
rename to .archive/changelog/26727.txt
diff --git a/.changelog/26733.txt b/.archive/changelog/26733.txt
similarity index 100%
rename from .changelog/26733.txt
rename to .archive/changelog/26733.txt
diff --git a/.changelog/26744.txt b/.archive/changelog/26744.txt
similarity index 100%
rename from .changelog/26744.txt
rename to .archive/changelog/26744.txt
diff --git a/.changelog/26745.txt b/.archive/changelog/26745.txt
similarity index 100%
rename from .changelog/26745.txt
rename to .archive/changelog/26745.txt
diff --git a/.changelog/26746.txt b/.archive/changelog/26746.txt
similarity index 100%
rename from .changelog/26746.txt
rename to .archive/changelog/26746.txt
diff --git a/.changelog/26765.txt b/.archive/changelog/26765.txt
similarity index 100%
rename from .changelog/26765.txt
rename to .archive/changelog/26765.txt
diff --git a/.changelog/26766.txt b/.archive/changelog/26766.txt
similarity index 100%
rename from .changelog/26766.txt
rename to .archive/changelog/26766.txt
diff --git a/.changelog/26767.txt b/.archive/changelog/26767.txt
similarity index 100%
rename from .changelog/26767.txt
rename to .archive/changelog/26767.txt
diff --git a/.changelog/26768.txt b/.archive/changelog/26768.txt
similarity index 100%
rename from .changelog/26768.txt
rename to .archive/changelog/26768.txt
diff --git a/.changelog/26775.txt b/.archive/changelog/26775.txt
similarity index 100%
rename from .changelog/26775.txt
rename to .archive/changelog/26775.txt
diff --git a/.changelog/26784.txt b/.archive/changelog/26784.txt
similarity index 100%
rename from .changelog/26784.txt
rename to .archive/changelog/26784.txt
diff --git a/.changelog/26785.txt b/.archive/changelog/26785.txt
similarity index 100%
rename from .changelog/26785.txt
rename to .archive/changelog/26785.txt
diff --git a/.changelog/26792.txt b/.archive/changelog/26792.txt
similarity index 100%
rename from .changelog/26792.txt
rename to .archive/changelog/26792.txt
diff --git a/.changelog/26810.txt b/.archive/changelog/26810.txt
similarity index 100%
rename from .changelog/26810.txt
rename to .archive/changelog/26810.txt
diff --git a/.changelog/26812.txt b/.archive/changelog/26812.txt
similarity index 100%
rename from .changelog/26812.txt
rename to .archive/changelog/26812.txt
diff --git a/.changelog/26838.txt b/.archive/changelog/26838.txt
similarity index 100%
rename from .changelog/26838.txt
rename to .archive/changelog/26838.txt
diff --git a/.changelog/26843.txt b/.archive/changelog/26843.txt
similarity index 100%
rename from .changelog/26843.txt
rename to .archive/changelog/26843.txt
diff --git a/.changelog/26845.txt b/.archive/changelog/26845.txt
similarity index 100%
rename from .changelog/26845.txt
rename to .archive/changelog/26845.txt
diff --git a/.changelog/26857.txt b/.archive/changelog/26857.txt
similarity index 100%
rename from .changelog/26857.txt
rename to .archive/changelog/26857.txt
diff --git a/.changelog/26858.txt b/.archive/changelog/26858.txt
similarity index 100%
rename from .changelog/26858.txt
rename to .archive/changelog/26858.txt
diff --git a/.changelog/26866.txt b/.archive/changelog/26866.txt
similarity index 100%
rename from .changelog/26866.txt
rename to .archive/changelog/26866.txt
diff --git a/.changelog/26908.txt b/.archive/changelog/26908.txt
similarity index 100%
rename from .changelog/26908.txt
rename to .archive/changelog/26908.txt
diff --git a/.changelog/26923.txt b/.archive/changelog/26923.txt
similarity index 100%
rename from .changelog/26923.txt
rename to .archive/changelog/26923.txt
diff --git a/.changelog/26931.txt b/.archive/changelog/26931.txt
similarity index 100%
rename from .changelog/26931.txt
rename to .archive/changelog/26931.txt
diff --git a/.changelog/26934.txt b/.archive/changelog/26934.txt
similarity index 100%
rename from .changelog/26934.txt
rename to .archive/changelog/26934.txt
diff --git a/.changelog/26944.txt b/.archive/changelog/26944.txt
similarity index 100%
rename from .changelog/26944.txt
rename to .archive/changelog/26944.txt
diff --git a/.changelog/26948.txt b/.archive/changelog/26948.txt
similarity index 100%
rename from .changelog/26948.txt
rename to .archive/changelog/26948.txt
diff --git a/.changelog/26951.txt b/.archive/changelog/26951.txt
similarity index 100%
rename from .changelog/26951.txt
rename to .archive/changelog/26951.txt
diff --git a/.changelog/26977.txt b/.archive/changelog/26977.txt
similarity index 100%
rename from .changelog/26977.txt
rename to .archive/changelog/26977.txt
diff --git a/.changelog/26978.txt b/.archive/changelog/26978.txt
similarity index 100%
rename from .changelog/26978.txt
rename to .archive/changelog/26978.txt
diff --git a/.changelog/26980.txt b/.archive/changelog/26980.txt
similarity index 100%
rename from .changelog/26980.txt
rename to .archive/changelog/26980.txt
diff --git a/.changelog/26990.txt b/.archive/changelog/26990.txt
similarity index 100%
rename from .changelog/26990.txt
rename to .archive/changelog/26990.txt
diff --git a/.changelog/26992.txt b/.archive/changelog/26992.txt
similarity index 100%
rename from .changelog/26992.txt
rename to .archive/changelog/26992.txt
diff --git a/.changelog/26994.txt b/.archive/changelog/26994.txt
similarity index 100%
rename from .changelog/26994.txt
rename to .archive/changelog/26994.txt
diff --git a/.changelog/26997.txt b/.archive/changelog/26997.txt
similarity index 100%
rename from .changelog/26997.txt
rename to .archive/changelog/26997.txt
diff --git a/.changelog/27000.txt b/.archive/changelog/27000.txt
similarity index 100%
rename from .changelog/27000.txt
rename to .archive/changelog/27000.txt
diff --git a/.changelog/27004.txt b/.archive/changelog/27004.txt
similarity index 100%
rename from .changelog/27004.txt
rename to .archive/changelog/27004.txt
diff --git a/.changelog/27011.txt b/.archive/changelog/27011.txt
similarity index 100%
rename from .changelog/27011.txt
rename to .archive/changelog/27011.txt
diff --git a/.changelog/27031.txt b/.archive/changelog/27031.txt
similarity index 100%
rename from .changelog/27031.txt
rename to .archive/changelog/27031.txt
diff --git a/.changelog/27035.txt b/.archive/changelog/27035.txt
similarity index 100%
rename from .changelog/27035.txt
rename to .archive/changelog/27035.txt
diff --git a/.changelog/27038.txt b/.archive/changelog/27038.txt
similarity index 100%
rename from .changelog/27038.txt
rename to .archive/changelog/27038.txt
diff --git a/.changelog/27051.txt b/.archive/changelog/27051.txt
similarity index 100%
rename from .changelog/27051.txt
rename to .archive/changelog/27051.txt
diff --git a/.changelog/27053.txt b/.archive/changelog/27053.txt
similarity index 100%
rename from .changelog/27053.txt
rename to .archive/changelog/27053.txt
diff --git a/.changelog/27054.txt b/.archive/changelog/27054.txt
similarity index 100%
rename from .changelog/27054.txt
rename to .archive/changelog/27054.txt
diff --git a/.changelog/27055.txt b/.archive/changelog/27055.txt
similarity index 100%
rename from .changelog/27055.txt
rename to .archive/changelog/27055.txt
diff --git a/.changelog/27056.txt b/.archive/changelog/27056.txt
similarity index 100%
rename from .changelog/27056.txt
rename to .archive/changelog/27056.txt
diff --git a/.changelog/27057.txt b/.archive/changelog/27057.txt
similarity index 100%
rename from .changelog/27057.txt
rename to .archive/changelog/27057.txt
diff --git a/.changelog/27068.txt b/.archive/changelog/27068.txt
similarity index 100%
rename from .changelog/27068.txt
rename to .archive/changelog/27068.txt
diff --git a/.changelog/27073.txt b/.archive/changelog/27073.txt
similarity index 100%
rename from .changelog/27073.txt
rename to .archive/changelog/27073.txt
diff --git a/.changelog/27084.txt b/.archive/changelog/27084.txt
similarity index 100%
rename from .changelog/27084.txt
rename to .archive/changelog/27084.txt
diff --git a/.changelog/27097.txt b/.archive/changelog/27097.txt
similarity index 100%
rename from .changelog/27097.txt
rename to .archive/changelog/27097.txt
diff --git a/.changelog/27101.txt b/.archive/changelog/27101.txt
similarity index 100%
rename from .changelog/27101.txt
rename to .archive/changelog/27101.txt
diff --git a/.changelog/27102.txt b/.archive/changelog/27102.txt
similarity index 100%
rename from .changelog/27102.txt
rename to .archive/changelog/27102.txt
diff --git a/.changelog/27113.txt b/.archive/changelog/27113.txt
similarity index 100%
rename from .changelog/27113.txt
rename to .archive/changelog/27113.txt
diff --git a/.changelog/27129.txt b/.archive/changelog/27129.txt
similarity index 100%
rename from .changelog/27129.txt
rename to .archive/changelog/27129.txt
diff --git a/.changelog/27131.txt b/.archive/changelog/27131.txt
similarity index 100%
rename from .changelog/27131.txt
rename to .archive/changelog/27131.txt
diff --git a/.changelog/27134.txt b/.archive/changelog/27134.txt
similarity index 100%
rename from .changelog/27134.txt
rename to .archive/changelog/27134.txt
diff --git a/.changelog/27148.txt b/.archive/changelog/27148.txt
similarity index 100%
rename from .changelog/27148.txt
rename to .archive/changelog/27148.txt
diff --git a/.changelog/27159.txt b/.archive/changelog/27159.txt
similarity index 100%
rename from .changelog/27159.txt
rename to .archive/changelog/27159.txt
diff --git a/.changelog/27161.txt b/.archive/changelog/27161.txt
similarity index 100%
rename from .changelog/27161.txt
rename to .archive/changelog/27161.txt
diff --git a/.changelog/27165.txt b/.archive/changelog/27165.txt
similarity index 100%
rename from .changelog/27165.txt
rename to .archive/changelog/27165.txt
diff --git a/.changelog/27181.txt b/.archive/changelog/27181.txt
similarity index 100%
rename from .changelog/27181.txt
rename to .archive/changelog/27181.txt
diff --git a/.changelog/27184.txt b/.archive/changelog/27184.txt
similarity index 100%
rename from .changelog/27184.txt
rename to .archive/changelog/27184.txt
diff --git a/.changelog/27207.txt b/.archive/changelog/27207.txt
similarity index 100%
rename from .changelog/27207.txt
rename to .archive/changelog/27207.txt
diff --git a/.changelog/27213.txt b/.archive/changelog/27213.txt
similarity index 100%
rename from .changelog/27213.txt
rename to .archive/changelog/27213.txt
diff --git a/.changelog/27223.txt b/.archive/changelog/27223.txt
similarity index 100%
rename from .changelog/27223.txt
rename to .archive/changelog/27223.txt
diff --git a/.changelog/27229.txt b/.archive/changelog/27229.txt
similarity index 100%
rename from .changelog/27229.txt
rename to .archive/changelog/27229.txt
diff --git a/.changelog/27232.txt b/.archive/changelog/27232.txt
similarity index 100%
rename from .changelog/27232.txt
rename to .archive/changelog/27232.txt
diff --git a/.changelog/27233.txt b/.archive/changelog/27233.txt
similarity index 100%
rename from .changelog/27233.txt
rename to .archive/changelog/27233.txt
diff --git a/.changelog/27236.txt b/.archive/changelog/27236.txt
similarity index 100%
rename from .changelog/27236.txt
rename to .archive/changelog/27236.txt
diff --git a/.changelog/27238.txt b/.archive/changelog/27238.txt
similarity index 100%
rename from .changelog/27238.txt
rename to .archive/changelog/27238.txt
diff --git a/.changelog/27257.txt b/.archive/changelog/27257.txt
similarity index 100%
rename from .changelog/27257.txt
rename to .archive/changelog/27257.txt
diff --git a/.changelog/27260.txt b/.archive/changelog/27260.txt
similarity index 100%
rename from .changelog/27260.txt
rename to .archive/changelog/27260.txt
diff --git a/.changelog/27261.txt b/.archive/changelog/27261.txt
similarity index 100%
rename from .changelog/27261.txt
rename to .archive/changelog/27261.txt
diff --git a/.changelog/27263.txt b/.archive/changelog/27263.txt
similarity index 100%
rename from .changelog/27263.txt
rename to .archive/changelog/27263.txt
diff --git a/.changelog/27278.txt b/.archive/changelog/27278.txt
similarity index 100%
rename from .changelog/27278.txt
rename to .archive/changelog/27278.txt
diff --git a/.changelog/27293.txt b/.archive/changelog/27293.txt
similarity index 100%
rename from .changelog/27293.txt
rename to .archive/changelog/27293.txt
diff --git a/.changelog/27303.txt b/.archive/changelog/27303.txt
similarity index 100%
rename from .changelog/27303.txt
rename to .archive/changelog/27303.txt
diff --git a/.changelog/27305.txt b/.archive/changelog/27305.txt
similarity index 100%
rename from .changelog/27305.txt
rename to .archive/changelog/27305.txt
diff --git a/.changelog/27306.txt b/.archive/changelog/27306.txt
similarity index 100%
rename from .changelog/27306.txt
rename to .archive/changelog/27306.txt
diff --git a/.changelog/27308.txt b/.archive/changelog/27308.txt
similarity index 100%
rename from .changelog/27308.txt
rename to .archive/changelog/27308.txt
diff --git a/.changelog/27309.txt b/.archive/changelog/27309.txt
similarity index 100%
rename from .changelog/27309.txt
rename to .archive/changelog/27309.txt
diff --git a/.changelog/27329.txt b/.archive/changelog/27329.txt
similarity index 100%
rename from .changelog/27329.txt
rename to .archive/changelog/27329.txt
diff --git a/.changelog/27334.txt b/.archive/changelog/27334.txt
similarity index 100%
rename from .changelog/27334.txt
rename to .archive/changelog/27334.txt
diff --git a/.changelog/27335.txt b/.archive/changelog/27335.txt
similarity index 100%
rename from .changelog/27335.txt
rename to .archive/changelog/27335.txt
diff --git a/.changelog/27336.txt b/.archive/changelog/27336.txt
similarity index 100%
rename from .changelog/27336.txt
rename to .archive/changelog/27336.txt
diff --git a/.changelog/27337.txt b/.archive/changelog/27337.txt
similarity index 100%
rename from .changelog/27337.txt
rename to .archive/changelog/27337.txt
diff --git a/.changelog/27339.txt b/.archive/changelog/27339.txt
similarity index 100%
rename from .changelog/27339.txt
rename to .archive/changelog/27339.txt
diff --git a/.changelog/27340.txt b/.archive/changelog/27340.txt
similarity index 100%
rename from .changelog/27340.txt
rename to .archive/changelog/27340.txt
diff --git a/.changelog/27341.txt b/.archive/changelog/27341.txt
similarity index 100%
rename from .changelog/27341.txt
rename to .archive/changelog/27341.txt
diff --git a/.changelog/27345.txt b/.archive/changelog/27345.txt
similarity index 100%
rename from .changelog/27345.txt
rename to .archive/changelog/27345.txt
diff --git a/.changelog/27347.txt b/.archive/changelog/27347.txt
similarity index 100%
rename from .changelog/27347.txt
rename to .archive/changelog/27347.txt
diff --git a/.changelog/27351.txt b/.archive/changelog/27351.txt
similarity index 100%
rename from .changelog/27351.txt
rename to .archive/changelog/27351.txt
diff --git a/.changelog/27361.txt b/.archive/changelog/27361.txt
similarity index 100%
rename from .changelog/27361.txt
rename to .archive/changelog/27361.txt
diff --git a/.changelog/27364.txt b/.archive/changelog/27364.txt
similarity index 100%
rename from .changelog/27364.txt
rename to .archive/changelog/27364.txt
diff --git a/.changelog/27367.txt b/.archive/changelog/27367.txt
similarity index 100%
rename from .changelog/27367.txt
rename to .archive/changelog/27367.txt
diff --git a/.changelog/27377.txt b/.archive/changelog/27377.txt
similarity index 100%
rename from .changelog/27377.txt
rename to .archive/changelog/27377.txt
diff --git a/.changelog/27384.txt b/.archive/changelog/27384.txt
similarity index 100%
rename from .changelog/27384.txt
rename to .archive/changelog/27384.txt
diff --git a/.changelog/27387.txt b/.archive/changelog/27387.txt
similarity index 100%
rename from .changelog/27387.txt
rename to .archive/changelog/27387.txt
diff --git a/.changelog/27388.txt b/.archive/changelog/27388.txt
similarity index 100%
rename from .changelog/27388.txt
rename to .archive/changelog/27388.txt
diff --git a/.changelog/27390.txt b/.archive/changelog/27390.txt
similarity index 100%
rename from .changelog/27390.txt
rename to .archive/changelog/27390.txt
diff --git a/.changelog/27395.txt b/.archive/changelog/27395.txt
similarity index 100%
rename from .changelog/27395.txt
rename to .archive/changelog/27395.txt
diff --git a/.changelog/27433.txt b/.archive/changelog/27433.txt
similarity index 100%
rename from .changelog/27433.txt
rename to .archive/changelog/27433.txt
diff --git a/.changelog/27458.txt b/.archive/changelog/27458.txt
similarity index 100%
rename from .changelog/27458.txt
rename to .archive/changelog/27458.txt
diff --git a/.changelog/27462.txt b/.archive/changelog/27462.txt
similarity index 100%
rename from .changelog/27462.txt
rename to .archive/changelog/27462.txt
diff --git a/.changelog/27464.txt b/.archive/changelog/27464.txt
similarity index 100%
rename from .changelog/27464.txt
rename to .archive/changelog/27464.txt
diff --git a/.changelog/27472.txt b/.archive/changelog/27472.txt
similarity index 100%
rename from .changelog/27472.txt
rename to .archive/changelog/27472.txt
diff --git a/.changelog/27473.txt b/.archive/changelog/27473.txt
similarity index 100%
rename from .changelog/27473.txt
rename to .archive/changelog/27473.txt
diff --git a/.changelog/27474.txt b/.archive/changelog/27474.txt
similarity index 100%
rename from .changelog/27474.txt
rename to .archive/changelog/27474.txt
diff --git a/.changelog/27487.txt b/.archive/changelog/27487.txt
similarity index 100%
rename from .changelog/27487.txt
rename to .archive/changelog/27487.txt
diff --git a/.changelog/27496.txt b/.archive/changelog/27496.txt
similarity index 100%
rename from .changelog/27496.txt
rename to .archive/changelog/27496.txt
diff --git a/.changelog/27499.txt b/.archive/changelog/27499.txt
similarity index 100%
rename from .changelog/27499.txt
rename to .archive/changelog/27499.txt
diff --git a/.changelog/27500.txt b/.archive/changelog/27500.txt
similarity index 100%
rename from .changelog/27500.txt
rename to .archive/changelog/27500.txt
diff --git a/.changelog/27502.txt b/.archive/changelog/27502.txt
similarity index 100%
rename from .changelog/27502.txt
rename to .archive/changelog/27502.txt
diff --git a/.changelog/27504.txt b/.archive/changelog/27504.txt
similarity index 100%
rename from .changelog/27504.txt
rename to .archive/changelog/27504.txt
diff --git a/.changelog/27505.txt b/.archive/changelog/27505.txt
similarity index 100%
rename from .changelog/27505.txt
rename to .archive/changelog/27505.txt
diff --git a/.changelog/27512.txt b/.archive/changelog/27512.txt
similarity index 100%
rename from .changelog/27512.txt
rename to .archive/changelog/27512.txt
diff --git a/.changelog/27514.txt b/.archive/changelog/27514.txt
similarity index 100%
rename from .changelog/27514.txt
rename to .archive/changelog/27514.txt
diff --git a/.changelog/27517.txt b/.archive/changelog/27517.txt
similarity index 100%
rename from .changelog/27517.txt
rename to .archive/changelog/27517.txt
diff --git a/.changelog/27537.txt b/.archive/changelog/27537.txt
similarity index 100%
rename from .changelog/27537.txt
rename to .archive/changelog/27537.txt
diff --git a/.changelog/27538.txt b/.archive/changelog/27538.txt
similarity index 100%
rename from .changelog/27538.txt
rename to .archive/changelog/27538.txt
diff --git a/.changelog/27542.txt b/.archive/changelog/27542.txt
similarity index 100%
rename from .changelog/27542.txt
rename to .archive/changelog/27542.txt
diff --git a/.changelog/27545.txt b/.archive/changelog/27545.txt
similarity index 100%
rename from .changelog/27545.txt
rename to .archive/changelog/27545.txt
diff --git a/.changelog/27546.txt b/.archive/changelog/27546.txt
similarity index 100%
rename from .changelog/27546.txt
rename to .archive/changelog/27546.txt
diff --git a/.changelog/27548.txt b/.archive/changelog/27548.txt
similarity index 100%
rename from .changelog/27548.txt
rename to .archive/changelog/27548.txt
diff --git a/.changelog/27558.txt b/.archive/changelog/27558.txt
similarity index 100%
rename from .changelog/27558.txt
rename to .archive/changelog/27558.txt
diff --git a/.changelog/27561.txt b/.archive/changelog/27561.txt
similarity index 100%
rename from .changelog/27561.txt
rename to .archive/changelog/27561.txt
diff --git a/.changelog/27563.txt b/.archive/changelog/27563.txt
similarity index 100%
rename from .changelog/27563.txt
rename to .archive/changelog/27563.txt
diff --git a/.changelog/27565.txt b/.archive/changelog/27565.txt
similarity index 100%
rename from .changelog/27565.txt
rename to .archive/changelog/27565.txt
diff --git a/.changelog/27566.txt b/.archive/changelog/27566.txt
similarity index 100%
rename from .changelog/27566.txt
rename to .archive/changelog/27566.txt
diff --git a/.changelog/27574.txt b/.archive/changelog/27574.txt
similarity index 100%
rename from .changelog/27574.txt
rename to .archive/changelog/27574.txt
diff --git a/.changelog/27597.txt b/.archive/changelog/27597.txt
similarity index 100%
rename from .changelog/27597.txt
rename to .archive/changelog/27597.txt
diff --git a/.changelog/27598.txt b/.archive/changelog/27598.txt
similarity index 100%
rename from .changelog/27598.txt
rename to .archive/changelog/27598.txt
diff --git a/.changelog/27600.txt b/.archive/changelog/27600.txt
similarity index 100%
rename from .changelog/27600.txt
rename to .archive/changelog/27600.txt
diff --git a/.changelog/27610.txt b/.archive/changelog/27610.txt
similarity index 100%
rename from .changelog/27610.txt
rename to .archive/changelog/27610.txt
diff --git a/.changelog/27612.txt b/.archive/changelog/27612.txt
similarity index 100%
rename from .changelog/27612.txt
rename to .archive/changelog/27612.txt
diff --git a/.changelog/27616.txt b/.archive/changelog/27616.txt
similarity index 100%
rename from .changelog/27616.txt
rename to .archive/changelog/27616.txt
diff --git a/.changelog/27620.txt b/.archive/changelog/27620.txt
similarity index 100%
rename from .changelog/27620.txt
rename to .archive/changelog/27620.txt
diff --git a/.changelog/27640.txt b/.archive/changelog/27640.txt
similarity index 100%
rename from .changelog/27640.txt
rename to .archive/changelog/27640.txt
diff --git a/.changelog/27642.txt b/.archive/changelog/27642.txt
similarity index 100%
rename from .changelog/27642.txt
rename to .archive/changelog/27642.txt
diff --git a/.changelog/27654.txt b/.archive/changelog/27654.txt
similarity index 100%
rename from .changelog/27654.txt
rename to .archive/changelog/27654.txt
diff --git a/.changelog/27656.txt b/.archive/changelog/27656.txt
similarity index 100%
rename from .changelog/27656.txt
rename to .archive/changelog/27656.txt
diff --git a/.changelog/27663.txt b/.archive/changelog/27663.txt
similarity index 100%
rename from .changelog/27663.txt
rename to .archive/changelog/27663.txt
diff --git a/.changelog/27664.txt b/.archive/changelog/27664.txt
similarity index 100%
rename from .changelog/27664.txt
rename to .archive/changelog/27664.txt
diff --git a/.changelog/27665.txt b/.archive/changelog/27665.txt
similarity index 100%
rename from .changelog/27665.txt
rename to .archive/changelog/27665.txt
diff --git a/.changelog/27669.txt b/.archive/changelog/27669.txt
similarity index 100%
rename from .changelog/27669.txt
rename to .archive/changelog/27669.txt
diff --git a/.changelog/27670.txt b/.archive/changelog/27670.txt
similarity index 100%
rename from .changelog/27670.txt
rename to .archive/changelog/27670.txt
diff --git a/.changelog/27672.txt b/.archive/changelog/27672.txt
similarity index 100%
rename from .changelog/27672.txt
rename to .archive/changelog/27672.txt
diff --git a/.changelog/27678.txt b/.archive/changelog/27678.txt
similarity index 100%
rename from .changelog/27678.txt
rename to .archive/changelog/27678.txt
diff --git a/.changelog/27679.txt b/.archive/changelog/27679.txt
similarity index 100%
rename from .changelog/27679.txt
rename to .archive/changelog/27679.txt
diff --git a/.changelog/27682.txt b/.archive/changelog/27682.txt
similarity index 100%
rename from .changelog/27682.txt
rename to .archive/changelog/27682.txt
diff --git a/.changelog/27693.txt b/.archive/changelog/27693.txt
similarity index 100%
rename from .changelog/27693.txt
rename to .archive/changelog/27693.txt
diff --git a/.changelog/27699.txt b/.archive/changelog/27699.txt
similarity index 100%
rename from .changelog/27699.txt
rename to .archive/changelog/27699.txt
diff --git a/.changelog/27704.txt b/.archive/changelog/27704.txt
similarity index 100%
rename from .changelog/27704.txt
rename to .archive/changelog/27704.txt
diff --git a/.changelog/27705.txt b/.archive/changelog/27705.txt
similarity index 100%
rename from .changelog/27705.txt
rename to .archive/changelog/27705.txt
diff --git a/.changelog/27718.txt b/.archive/changelog/27718.txt
similarity index 100%
rename from .changelog/27718.txt
rename to .archive/changelog/27718.txt
diff --git a/.changelog/27726.txt b/.archive/changelog/27726.txt
similarity index 100%
rename from .changelog/27726.txt
rename to .archive/changelog/27726.txt
diff --git a/.changelog/27730.txt b/.archive/changelog/27730.txt
similarity index 100%
rename from .changelog/27730.txt
rename to .archive/changelog/27730.txt
diff --git a/.changelog/27734.txt b/.archive/changelog/27734.txt
similarity index 100%
rename from .changelog/27734.txt
rename to .archive/changelog/27734.txt
diff --git a/.changelog/27741.txt b/.archive/changelog/27741.txt
similarity index 100%
rename from .changelog/27741.txt
rename to .archive/changelog/27741.txt
diff --git a/.changelog/27744.txt b/.archive/changelog/27744.txt
similarity index 100%
rename from .changelog/27744.txt
rename to .archive/changelog/27744.txt
diff --git a/.changelog/27762.txt b/.archive/changelog/27762.txt
similarity index 100%
rename from .changelog/27762.txt
rename to .archive/changelog/27762.txt
diff --git a/.changelog/27763.txt b/.archive/changelog/27763.txt
similarity index 100%
rename from .changelog/27763.txt
rename to .archive/changelog/27763.txt
diff --git a/.changelog/27769.txt b/.archive/changelog/27769.txt
similarity index 100%
rename from .changelog/27769.txt
rename to .archive/changelog/27769.txt
diff --git a/.changelog/27778.txt b/.archive/changelog/27778.txt
similarity index 100%
rename from .changelog/27778.txt
rename to .archive/changelog/27778.txt
diff --git a/.changelog/27781.txt b/.archive/changelog/27781.txt
similarity index 100%
rename from .changelog/27781.txt
rename to .archive/changelog/27781.txt
diff --git a/.changelog/27784.txt b/.archive/changelog/27784.txt
similarity index 100%
rename from .changelog/27784.txt
rename to .archive/changelog/27784.txt
diff --git a/.changelog/27785.txt b/.archive/changelog/27785.txt
similarity index 100%
rename from .changelog/27785.txt
rename to .archive/changelog/27785.txt
diff --git a/.changelog/27787.txt b/.archive/changelog/27787.txt
similarity index 100%
rename from .changelog/27787.txt
rename to .archive/changelog/27787.txt
diff --git a/.changelog/27789.txt b/.archive/changelog/27789.txt
similarity index 100%
rename from .changelog/27789.txt
rename to .archive/changelog/27789.txt
diff --git a/.changelog/27790.txt b/.archive/changelog/27790.txt
similarity index 100%
rename from .changelog/27790.txt
rename to .archive/changelog/27790.txt
diff --git a/.changelog/27795.txt b/.archive/changelog/27795.txt
similarity index 100%
rename from .changelog/27795.txt
rename to .archive/changelog/27795.txt
diff --git a/.changelog/27798.txt b/.archive/changelog/27798.txt
similarity index 100%
rename from .changelog/27798.txt
rename to .archive/changelog/27798.txt
diff --git a/.changelog/27799.txt b/.archive/changelog/27799.txt
similarity index 100%
rename from .changelog/27799.txt
rename to .archive/changelog/27799.txt
diff --git a/.changelog/27800.txt b/.archive/changelog/27800.txt
similarity index 100%
rename from .changelog/27800.txt
rename to .archive/changelog/27800.txt
diff --git a/.changelog/27812.txt b/.archive/changelog/27812.txt
similarity index 100%
rename from .changelog/27812.txt
rename to .archive/changelog/27812.txt
diff --git a/.changelog/27814.txt b/.archive/changelog/27814.txt
similarity index 100%
rename from .changelog/27814.txt
rename to .archive/changelog/27814.txt
diff --git a/.changelog/27823.txt b/.archive/changelog/27823.txt
similarity index 100%
rename from .changelog/27823.txt
rename to .archive/changelog/27823.txt
diff --git a/.changelog/27828.txt b/.archive/changelog/27828.txt
similarity index 100%
rename from .changelog/27828.txt
rename to .archive/changelog/27828.txt
diff --git a/.changelog/27855.txt b/.archive/changelog/27855.txt
similarity index 100%
rename from .changelog/27855.txt
rename to .archive/changelog/27855.txt
diff --git a/.changelog/27856.txt b/.archive/changelog/27856.txt
similarity index 100%
rename from .changelog/27856.txt
rename to .archive/changelog/27856.txt
diff --git a/.changelog/27857.txt b/.archive/changelog/27857.txt
similarity index 100%
rename from .changelog/27857.txt
rename to .archive/changelog/27857.txt
diff --git a/.changelog/27860.txt b/.archive/changelog/27860.txt
similarity index 100%
rename from .changelog/27860.txt
rename to .archive/changelog/27860.txt
diff --git a/.changelog/27882.txt b/.archive/changelog/27882.txt
similarity index 100%
rename from .changelog/27882.txt
rename to .archive/changelog/27882.txt
diff --git a/.changelog/27890.txt b/.archive/changelog/27890.txt
similarity index 100%
rename from .changelog/27890.txt
rename to .archive/changelog/27890.txt
diff --git a/.changelog/27891.txt b/.archive/changelog/27891.txt
similarity index 100%
rename from .changelog/27891.txt
rename to .archive/changelog/27891.txt
diff --git a/.changelog/27892.txt b/.archive/changelog/27892.txt
similarity index 100%
rename from .changelog/27892.txt
rename to .archive/changelog/27892.txt
diff --git a/.changelog/27920.txt b/.archive/changelog/27920.txt
similarity index 100%
rename from .changelog/27920.txt
rename to .archive/changelog/27920.txt
diff --git a/.changelog/27923.txt b/.archive/changelog/27923.txt
similarity index 100%
rename from .changelog/27923.txt
rename to .archive/changelog/27923.txt
diff --git a/.changelog/27924.txt b/.archive/changelog/27924.txt
similarity index 100%
rename from .changelog/27924.txt
rename to .archive/changelog/27924.txt
diff --git a/.changelog/27925.txt b/.archive/changelog/27925.txt
similarity index 100%
rename from .changelog/27925.txt
rename to .archive/changelog/27925.txt
diff --git a/.changelog/27934.txt b/.archive/changelog/27934.txt
similarity index 100%
rename from .changelog/27934.txt
rename to .archive/changelog/27934.txt
diff --git a/.changelog/27935.txt b/.archive/changelog/27935.txt
similarity index 100%
rename from .changelog/27935.txt
rename to .archive/changelog/27935.txt
diff --git a/.changelog/27948.txt b/.archive/changelog/27948.txt
similarity index 100%
rename from .changelog/27948.txt
rename to .archive/changelog/27948.txt
diff --git a/.changelog/27949.txt b/.archive/changelog/27949.txt
similarity index 100%
rename from .changelog/27949.txt
rename to .archive/changelog/27949.txt
diff --git a/.changelog/27950.txt b/.archive/changelog/27950.txt
similarity index 100%
rename from .changelog/27950.txt
rename to .archive/changelog/27950.txt
diff --git a/.changelog/27953.txt b/.archive/changelog/27953.txt
similarity index 100%
rename from .changelog/27953.txt
rename to .archive/changelog/27953.txt
diff --git a/.changelog/27954.txt b/.archive/changelog/27954.txt
similarity index 100%
rename from .changelog/27954.txt
rename to .archive/changelog/27954.txt
diff --git a/.changelog/27972.txt b/.archive/changelog/27972.txt
similarity index 100%
rename from .changelog/27972.txt
rename to .archive/changelog/27972.txt
diff --git a/.changelog/27974.txt b/.archive/changelog/27974.txt
similarity index 100%
rename from .changelog/27974.txt
rename to .archive/changelog/27974.txt
diff --git a/.changelog/27975.txt b/.archive/changelog/27975.txt
similarity index 100%
rename from .changelog/27975.txt
rename to .archive/changelog/27975.txt
diff --git a/.changelog/27983.txt b/.archive/changelog/27983.txt
similarity index 100%
rename from .changelog/27983.txt
rename to .archive/changelog/27983.txt
diff --git a/.changelog/27985.txt b/.archive/changelog/27985.txt
similarity index 100%
rename from .changelog/27985.txt
rename to .archive/changelog/27985.txt
diff --git a/.changelog/27991.txt b/.archive/changelog/27991.txt
similarity index 100%
rename from .changelog/27991.txt
rename to .archive/changelog/27991.txt
diff --git a/.changelog/28004.txt b/.archive/changelog/28004.txt
similarity index 100%
rename from .changelog/28004.txt
rename to .archive/changelog/28004.txt
diff --git a/.changelog/28008.txt b/.archive/changelog/28008.txt
similarity index 100%
rename from .changelog/28008.txt
rename to .archive/changelog/28008.txt
diff --git a/.changelog/28018.txt b/.archive/changelog/28018.txt
similarity index 100%
rename from .changelog/28018.txt
rename to .archive/changelog/28018.txt
diff --git a/.changelog/28022.txt b/.archive/changelog/28022.txt
similarity index 100%
rename from .changelog/28022.txt
rename to .archive/changelog/28022.txt
diff --git a/.changelog/28025.txt b/.archive/changelog/28025.txt
similarity index 100%
rename from .changelog/28025.txt
rename to .archive/changelog/28025.txt
diff --git a/.changelog/28026.txt b/.archive/changelog/28026.txt
similarity index 100%
rename from .changelog/28026.txt
rename to .archive/changelog/28026.txt
diff --git a/.changelog/28027.txt b/.archive/changelog/28027.txt
similarity index 100%
rename from .changelog/28027.txt
rename to .archive/changelog/28027.txt
diff --git a/.changelog/28030.txt b/.archive/changelog/28030.txt
similarity index 100%
rename from .changelog/28030.txt
rename to .archive/changelog/28030.txt
diff --git a/.changelog/28046.txt b/.archive/changelog/28046.txt
similarity index 100%
rename from .changelog/28046.txt
rename to .archive/changelog/28046.txt
diff --git a/.changelog/28047.txt b/.archive/changelog/28047.txt
similarity index 100%
rename from .changelog/28047.txt
rename to .archive/changelog/28047.txt
diff --git a/.changelog/28048.txt b/.archive/changelog/28048.txt
similarity index 100%
rename from .changelog/28048.txt
rename to .archive/changelog/28048.txt
diff --git a/.changelog/28049.txt b/.archive/changelog/28049.txt
similarity index 100%
rename from .changelog/28049.txt
rename to .archive/changelog/28049.txt
diff --git a/.changelog/28051.txt b/.archive/changelog/28051.txt
similarity index 100%
rename from .changelog/28051.txt
rename to .archive/changelog/28051.txt
diff --git a/.changelog/28052.txt b/.archive/changelog/28052.txt
similarity index 100%
rename from .changelog/28052.txt
rename to .archive/changelog/28052.txt
diff --git a/.changelog/28054.txt b/.archive/changelog/28054.txt
similarity index 100%
rename from .changelog/28054.txt
rename to .archive/changelog/28054.txt
diff --git a/.changelog/28055.txt b/.archive/changelog/28055.txt
similarity index 100%
rename from .changelog/28055.txt
rename to .archive/changelog/28055.txt
diff --git a/.changelog/28057.txt b/.archive/changelog/28057.txt
similarity index 100%
rename from .changelog/28057.txt
rename to .archive/changelog/28057.txt
diff --git a/.changelog/28084.txt b/.archive/changelog/28084.txt
similarity index 100%
rename from .changelog/28084.txt
rename to .archive/changelog/28084.txt
diff --git a/.changelog/28085.txt b/.archive/changelog/28085.txt
similarity index 100%
rename from .changelog/28085.txt
rename to .archive/changelog/28085.txt
diff --git a/.changelog/28097.txt b/.archive/changelog/28097.txt
similarity index 100%
rename from .changelog/28097.txt
rename to .archive/changelog/28097.txt
diff --git a/.changelog/28099.txt b/.archive/changelog/28099.txt
similarity index 100%
rename from .changelog/28099.txt
rename to .archive/changelog/28099.txt
diff --git a/.changelog/28112.txt b/.archive/changelog/28112.txt
similarity index 100%
rename from .changelog/28112.txt
rename to .archive/changelog/28112.txt
diff --git a/.changelog/28114.txt b/.archive/changelog/28114.txt
similarity index 100%
rename from .changelog/28114.txt
rename to .archive/changelog/28114.txt
diff --git a/.changelog/28125.txt b/.archive/changelog/28125.txt
similarity index 100%
rename from .changelog/28125.txt
rename to .archive/changelog/28125.txt
diff --git a/.changelog/28127.txt b/.archive/changelog/28127.txt
similarity index 100%
rename from .changelog/28127.txt
rename to .archive/changelog/28127.txt
diff --git a/.changelog/28130.txt b/.archive/changelog/28130.txt
similarity index 100%
rename from .changelog/28130.txt
rename to .archive/changelog/28130.txt
diff --git a/.changelog/28142.txt b/.archive/changelog/28142.txt
similarity index 100%
rename from .changelog/28142.txt
rename to .archive/changelog/28142.txt
diff --git a/.changelog/28143.txt b/.archive/changelog/28143.txt
similarity index 100%
rename from .changelog/28143.txt
rename to .archive/changelog/28143.txt
diff --git a/.changelog/28144.txt b/.archive/changelog/28144.txt
similarity index 100%
rename from .changelog/28144.txt
rename to .archive/changelog/28144.txt
diff --git a/.changelog/28148.txt b/.archive/changelog/28148.txt
similarity index 100%
rename from .changelog/28148.txt
rename to .archive/changelog/28148.txt
diff --git a/.changelog/28150.txt b/.archive/changelog/28150.txt
similarity index 100%
rename from .changelog/28150.txt
rename to .archive/changelog/28150.txt
diff --git a/.changelog/28154.txt b/.archive/changelog/28154.txt
similarity index 100%
rename from .changelog/28154.txt
rename to .archive/changelog/28154.txt
diff --git a/.changelog/28155.txt b/.archive/changelog/28155.txt
similarity index 100%
rename from .changelog/28155.txt
rename to .archive/changelog/28155.txt
diff --git a/.changelog/28156.txt b/.archive/changelog/28156.txt
similarity index 100%
rename from .changelog/28156.txt
rename to .archive/changelog/28156.txt
diff --git a/.changelog/28159.txt b/.archive/changelog/28159.txt
similarity index 100%
rename from .changelog/28159.txt
rename to .archive/changelog/28159.txt
diff --git a/.changelog/28220.txt b/.archive/changelog/28220.txt
similarity index 100%
rename from .changelog/28220.txt
rename to .archive/changelog/28220.txt
diff --git a/.changelog/28241.txt b/.archive/changelog/28241.txt
similarity index 100%
rename from .changelog/28241.txt
rename to .archive/changelog/28241.txt
diff --git a/.changelog/28242.txt b/.archive/changelog/28242.txt
similarity index 100%
rename from .changelog/28242.txt
rename to .archive/changelog/28242.txt
diff --git a/.changelog/28243.txt b/.archive/changelog/28243.txt
similarity index 100%
rename from .changelog/28243.txt
rename to .archive/changelog/28243.txt
diff --git a/.changelog/28245.txt b/.archive/changelog/28245.txt
similarity index 100%
rename from .changelog/28245.txt
rename to .archive/changelog/28245.txt
diff --git a/.changelog/28253.txt b/.archive/changelog/28253.txt
similarity index 100%
rename from .changelog/28253.txt
rename to .archive/changelog/28253.txt
diff --git a/.changelog/28254.txt b/.archive/changelog/28254.txt
similarity index 100%
rename from .changelog/28254.txt
rename to .archive/changelog/28254.txt
diff --git a/.changelog/28257.txt b/.archive/changelog/28257.txt
similarity index 100%
rename from .changelog/28257.txt
rename to .archive/changelog/28257.txt
diff --git a/.changelog/28258.txt b/.archive/changelog/28258.txt
similarity index 100%
rename from .changelog/28258.txt
rename to .archive/changelog/28258.txt
diff --git a/.changelog/28272.txt b/.archive/changelog/28272.txt
similarity index 100%
rename from .changelog/28272.txt
rename to .archive/changelog/28272.txt
diff --git a/.changelog/28295.txt b/.archive/changelog/28295.txt
similarity index 100%
rename from .changelog/28295.txt
rename to .archive/changelog/28295.txt
diff --git a/.changelog/28303.txt b/.archive/changelog/28303.txt
similarity index 100%
rename from .changelog/28303.txt
rename to .archive/changelog/28303.txt
diff --git a/.changelog/28305.txt b/.archive/changelog/28305.txt
similarity index 100%
rename from .changelog/28305.txt
rename to .archive/changelog/28305.txt
diff --git a/.changelog/28308.txt b/.archive/changelog/28308.txt
similarity index 100%
rename from .changelog/28308.txt
rename to .archive/changelog/28308.txt
diff --git a/.changelog/28309.txt b/.archive/changelog/28309.txt
similarity index 100%
rename from .changelog/28309.txt
rename to .archive/changelog/28309.txt
diff --git a/.changelog/28310.txt b/.archive/changelog/28310.txt
similarity index 100%
rename from .changelog/28310.txt
rename to .archive/changelog/28310.txt
diff --git a/.changelog/28314.txt b/.archive/changelog/28314.txt
similarity index 100%
rename from .changelog/28314.txt
rename to .archive/changelog/28314.txt
diff --git a/.changelog/28335.txt b/.archive/changelog/28335.txt
similarity index 100%
rename from .changelog/28335.txt
rename to .archive/changelog/28335.txt
diff --git a/.changelog/28338.txt b/.archive/changelog/28338.txt
similarity index 100%
rename from .changelog/28338.txt
rename to .archive/changelog/28338.txt
diff --git a/.changelog/28359.txt b/.archive/changelog/28359.txt
similarity index 100%
rename from .changelog/28359.txt
rename to .archive/changelog/28359.txt
diff --git a/.changelog/28363.txt b/.archive/changelog/28363.txt
similarity index 100%
rename from .changelog/28363.txt
rename to .archive/changelog/28363.txt
diff --git a/.changelog/28373.txt b/.archive/changelog/28373.txt
similarity index 100%
rename from .changelog/28373.txt
rename to .archive/changelog/28373.txt
diff --git a/.changelog/28376.txt b/.archive/changelog/28376.txt
similarity index 100%
rename from .changelog/28376.txt
rename to .archive/changelog/28376.txt
diff --git a/.changelog/28384.txt b/.archive/changelog/28384.txt
similarity index 100%
rename from .changelog/28384.txt
rename to .archive/changelog/28384.txt
diff --git a/.changelog/28420.txt b/.archive/changelog/28420.txt
similarity index 100%
rename from .changelog/28420.txt
rename to .archive/changelog/28420.txt
diff --git a/.changelog/28424.txt b/.archive/changelog/28424.txt
similarity index 100%
rename from .changelog/28424.txt
rename to .archive/changelog/28424.txt
diff --git a/.changelog/28431.txt b/.archive/changelog/28431.txt
similarity index 100%
rename from .changelog/28431.txt
rename to .archive/changelog/28431.txt
diff --git a/.changelog/28432.txt b/.archive/changelog/28432.txt
similarity index 100%
rename from .changelog/28432.txt
rename to .archive/changelog/28432.txt
diff --git a/.changelog/28434.txt b/.archive/changelog/28434.txt
similarity index 100%
rename from .changelog/28434.txt
rename to .archive/changelog/28434.txt
diff --git a/.changelog/28435.txt b/.archive/changelog/28435.txt
similarity index 100%
rename from .changelog/28435.txt
rename to .archive/changelog/28435.txt
diff --git a/.changelog/28436.txt b/.archive/changelog/28436.txt
similarity index 100%
rename from .changelog/28436.txt
rename to .archive/changelog/28436.txt
diff --git a/.changelog/28437.txt b/.archive/changelog/28437.txt
similarity index 100%
rename from .changelog/28437.txt
rename to .archive/changelog/28437.txt
diff --git a/.changelog/28439.txt b/.archive/changelog/28439.txt
similarity index 100%
rename from .changelog/28439.txt
rename to .archive/changelog/28439.txt
diff --git a/.changelog/28444.txt b/.archive/changelog/28444.txt
similarity index 100%
rename from .changelog/28444.txt
rename to .archive/changelog/28444.txt
diff --git a/.changelog/28445.txt b/.archive/changelog/28445.txt
similarity index 100%
rename from .changelog/28445.txt
rename to .archive/changelog/28445.txt
diff --git a/.changelog/28450.txt b/.archive/changelog/28450.txt
similarity index 100%
rename from .changelog/28450.txt
rename to .archive/changelog/28450.txt
diff --git a/.changelog/28469.txt b/.archive/changelog/28469.txt
similarity index 100%
rename from .changelog/28469.txt
rename to .archive/changelog/28469.txt
diff --git a/.changelog/28489.txt b/.archive/changelog/28489.txt
similarity index 100%
rename from .changelog/28489.txt
rename to .archive/changelog/28489.txt
diff --git a/.changelog/28492.txt b/.archive/changelog/28492.txt
similarity index 100%
rename from .changelog/28492.txt
rename to .archive/changelog/28492.txt
diff --git a/.changelog/28512.txt b/.archive/changelog/28512.txt
similarity index 100%
rename from .changelog/28512.txt
rename to .archive/changelog/28512.txt
diff --git a/.changelog/28521.txt b/.archive/changelog/28521.txt
similarity index 100%
rename from .changelog/28521.txt
rename to .archive/changelog/28521.txt
diff --git a/.changelog/28530.txt b/.archive/changelog/28530.txt
similarity index 100%
rename from .changelog/28530.txt
rename to .archive/changelog/28530.txt
diff --git a/.changelog/28550.txt b/.archive/changelog/28550.txt
similarity index 100%
rename from .changelog/28550.txt
rename to .archive/changelog/28550.txt
diff --git a/.changelog/28560.txt b/.archive/changelog/28560.txt
similarity index 100%
rename from .changelog/28560.txt
rename to .archive/changelog/28560.txt
diff --git a/.changelog/28561.txt b/.archive/changelog/28561.txt
similarity index 100%
rename from .changelog/28561.txt
rename to .archive/changelog/28561.txt
diff --git a/.changelog/28564.txt b/.archive/changelog/28564.txt
similarity index 100%
rename from .changelog/28564.txt
rename to .archive/changelog/28564.txt
diff --git a/.changelog/28567.txt b/.archive/changelog/28567.txt
similarity index 100%
rename from .changelog/28567.txt
rename to .archive/changelog/28567.txt
diff --git a/.changelog/28568.txt b/.archive/changelog/28568.txt
similarity index 100%
rename from .changelog/28568.txt
rename to .archive/changelog/28568.txt
diff --git a/.changelog/28569.txt b/.archive/changelog/28569.txt
similarity index 100%
rename from .changelog/28569.txt
rename to .archive/changelog/28569.txt
diff --git a/.changelog/28572.txt b/.archive/changelog/28572.txt
similarity index 100%
rename from .changelog/28572.txt
rename to .archive/changelog/28572.txt
diff --git a/.changelog/28573.txt b/.archive/changelog/28573.txt
similarity index 100%
rename from .changelog/28573.txt
rename to .archive/changelog/28573.txt
diff --git a/.changelog/28574.txt b/.archive/changelog/28574.txt
similarity index 100%
rename from .changelog/28574.txt
rename to .archive/changelog/28574.txt
diff --git a/.changelog/28578.txt b/.archive/changelog/28578.txt
similarity index 100%
rename from .changelog/28578.txt
rename to .archive/changelog/28578.txt
diff --git a/.changelog/28579.txt b/.archive/changelog/28579.txt
similarity index 100%
rename from .changelog/28579.txt
rename to .archive/changelog/28579.txt
diff --git a/.changelog/28581.txt b/.archive/changelog/28581.txt
similarity index 100%
rename from .changelog/28581.txt
rename to .archive/changelog/28581.txt
diff --git a/.changelog/28583.txt b/.archive/changelog/28583.txt
similarity index 100%
rename from .changelog/28583.txt
rename to .archive/changelog/28583.txt
diff --git a/.changelog/28585.txt b/.archive/changelog/28585.txt
similarity index 100%
rename from .changelog/28585.txt
rename to .archive/changelog/28585.txt
diff --git a/.changelog/28586.txt b/.archive/changelog/28586.txt
similarity index 100%
rename from .changelog/28586.txt
rename to .archive/changelog/28586.txt
diff --git a/.changelog/28590.txt b/.archive/changelog/28590.txt
similarity index 100%
rename from .changelog/28590.txt
rename to .archive/changelog/28590.txt
diff --git a/.changelog/28593.txt b/.archive/changelog/28593.txt
similarity index 100%
rename from .changelog/28593.txt
rename to .archive/changelog/28593.txt
diff --git a/.changelog/28594.txt b/.archive/changelog/28594.txt
similarity index 100%
rename from .changelog/28594.txt
rename to .archive/changelog/28594.txt
diff --git a/.changelog/28596.txt b/.archive/changelog/28596.txt
similarity index 100%
rename from .changelog/28596.txt
rename to .archive/changelog/28596.txt
diff --git a/.changelog/28600.txt b/.archive/changelog/28600.txt
similarity index 100%
rename from .changelog/28600.txt
rename to .archive/changelog/28600.txt
diff --git a/.changelog/28602.txt b/.archive/changelog/28602.txt
similarity index 100%
rename from .changelog/28602.txt
rename to .archive/changelog/28602.txt
diff --git a/.changelog/28619.txt b/.archive/changelog/28619.txt
similarity index 100%
rename from .changelog/28619.txt
rename to .archive/changelog/28619.txt
diff --git a/.changelog/28620.txt b/.archive/changelog/28620.txt
similarity index 100%
rename from .changelog/28620.txt
rename to .archive/changelog/28620.txt
diff --git a/.changelog/28621.txt b/.archive/changelog/28621.txt
similarity index 100%
rename from .changelog/28621.txt
rename to .archive/changelog/28621.txt
diff --git a/.changelog/28622.txt b/.archive/changelog/28622.txt
similarity index 100%
rename from .changelog/28622.txt
rename to .archive/changelog/28622.txt
diff --git a/.changelog/28636.txt b/.archive/changelog/28636.txt
similarity index 100%
rename from .changelog/28636.txt
rename to .archive/changelog/28636.txt
diff --git a/.changelog/28639.txt b/.archive/changelog/28639.txt
similarity index 100%
rename from .changelog/28639.txt
rename to .archive/changelog/28639.txt
diff --git a/.changelog/28643.txt b/.archive/changelog/28643.txt
similarity index 100%
rename from .changelog/28643.txt
rename to .archive/changelog/28643.txt
diff --git a/.changelog/28658.txt b/.archive/changelog/28658.txt
similarity index 100%
rename from .changelog/28658.txt
rename to .archive/changelog/28658.txt
diff --git a/.changelog/28662.txt b/.archive/changelog/28662.txt
similarity index 100%
rename from .changelog/28662.txt
rename to .archive/changelog/28662.txt
diff --git a/.changelog/28663.txt b/.archive/changelog/28663.txt
similarity index 100%
rename from .changelog/28663.txt
rename to .archive/changelog/28663.txt
diff --git a/.changelog/28689.txt b/.archive/changelog/28689.txt
similarity index 100%
rename from .changelog/28689.txt
rename to .archive/changelog/28689.txt
diff --git a/.changelog/28699.txt b/.archive/changelog/28699.txt
similarity index 100%
rename from .changelog/28699.txt
rename to .archive/changelog/28699.txt
diff --git a/.changelog/28704.txt b/.archive/changelog/28704.txt
similarity index 100%
rename from .changelog/28704.txt
rename to .archive/changelog/28704.txt
diff --git a/.changelog/28736.txt b/.archive/changelog/28736.txt
similarity index 100%
rename from .changelog/28736.txt
rename to .archive/changelog/28736.txt
diff --git a/.changelog/28748.txt b/.archive/changelog/28748.txt
similarity index 100%
rename from .changelog/28748.txt
rename to .archive/changelog/28748.txt
diff --git a/.changelog/28751.txt b/.archive/changelog/28751.txt
similarity index 100%
rename from .changelog/28751.txt
rename to .archive/changelog/28751.txt
diff --git a/.changelog/28752.txt b/.archive/changelog/28752.txt
similarity index 100%
rename from .changelog/28752.txt
rename to .archive/changelog/28752.txt
diff --git a/.changelog/28766.txt b/.archive/changelog/28766.txt
similarity index 100%
rename from .changelog/28766.txt
rename to .archive/changelog/28766.txt
diff --git a/.changelog/28777.txt b/.archive/changelog/28777.txt
similarity index 100%
rename from .changelog/28777.txt
rename to .archive/changelog/28777.txt
diff --git a/.changelog/28778.txt b/.archive/changelog/28778.txt
similarity index 100%
rename from .changelog/28778.txt
rename to .archive/changelog/28778.txt
diff --git a/.changelog/28785.txt b/.archive/changelog/28785.txt
similarity index 100%
rename from .changelog/28785.txt
rename to .archive/changelog/28785.txt
diff --git a/.changelog/28788.txt b/.archive/changelog/28788.txt
similarity index 100%
rename from .changelog/28788.txt
rename to .archive/changelog/28788.txt
diff --git a/.changelog/28789.txt b/.archive/changelog/28789.txt
similarity index 100%
rename from .changelog/28789.txt
rename to .archive/changelog/28789.txt
diff --git a/.changelog/28790.txt b/.archive/changelog/28790.txt
similarity index 100%
rename from .changelog/28790.txt
rename to .archive/changelog/28790.txt
diff --git a/.changelog/28791.txt b/.archive/changelog/28791.txt
similarity index 100%
rename from .changelog/28791.txt
rename to .archive/changelog/28791.txt
diff --git a/.changelog/28792.txt b/.archive/changelog/28792.txt
similarity index 100%
rename from .changelog/28792.txt
rename to .archive/changelog/28792.txt
diff --git a/.changelog/28794.txt b/.archive/changelog/28794.txt
similarity index 100%
rename from .changelog/28794.txt
rename to .archive/changelog/28794.txt
diff --git a/.changelog/28796.txt b/.archive/changelog/28796.txt
similarity index 100%
rename from .changelog/28796.txt
rename to .archive/changelog/28796.txt
diff --git a/.changelog/28798.txt b/.archive/changelog/28798.txt
similarity index 100%
rename from .changelog/28798.txt
rename to .archive/changelog/28798.txt
diff --git a/.changelog/28799.txt b/.archive/changelog/28799.txt
similarity index 100%
rename from .changelog/28799.txt
rename to .archive/changelog/28799.txt
diff --git a/.changelog/28800.txt b/.archive/changelog/28800.txt
similarity index 100%
rename from .changelog/28800.txt
rename to .archive/changelog/28800.txt
diff --git a/.changelog/28801.txt b/.archive/changelog/28801.txt
similarity index 100%
rename from .changelog/28801.txt
rename to .archive/changelog/28801.txt
diff --git a/.changelog/28802.txt b/.archive/changelog/28802.txt
similarity index 100%
rename from .changelog/28802.txt
rename to .archive/changelog/28802.txt
diff --git a/.changelog/28804.txt b/.archive/changelog/28804.txt
similarity index 100%
rename from .changelog/28804.txt
rename to .archive/changelog/28804.txt
diff --git a/.changelog/28807.txt b/.archive/changelog/28807.txt
similarity index 100%
rename from .changelog/28807.txt
rename to .archive/changelog/28807.txt
diff --git a/.changelog/28810.txt b/.archive/changelog/28810.txt
similarity index 100%
rename from .changelog/28810.txt
rename to .archive/changelog/28810.txt
diff --git a/.changelog/28812.txt b/.archive/changelog/28812.txt
similarity index 100%
rename from .changelog/28812.txt
rename to .archive/changelog/28812.txt
diff --git a/.changelog/28813.txt b/.archive/changelog/28813.txt
similarity index 100%
rename from .changelog/28813.txt
rename to .archive/changelog/28813.txt
diff --git a/.changelog/28831.txt b/.archive/changelog/28831.txt
similarity index 100%
rename from .changelog/28831.txt
rename to .archive/changelog/28831.txt
diff --git a/.changelog/28836.txt b/.archive/changelog/28836.txt
similarity index 100%
rename from .changelog/28836.txt
rename to .archive/changelog/28836.txt
diff --git a/.changelog/28837.txt b/.archive/changelog/28837.txt
similarity index 100%
rename from .changelog/28837.txt
rename to .archive/changelog/28837.txt
diff --git a/.changelog/28838.txt b/.archive/changelog/28838.txt
similarity index 100%
rename from .changelog/28838.txt
rename to .archive/changelog/28838.txt
diff --git a/.changelog/28840.txt b/.archive/changelog/28840.txt
similarity index 100%
rename from .changelog/28840.txt
rename to .archive/changelog/28840.txt
diff --git a/.changelog/28841.txt b/.archive/changelog/28841.txt
similarity index 100%
rename from .changelog/28841.txt
rename to .archive/changelog/28841.txt
diff --git a/.changelog/28848.txt b/.archive/changelog/28848.txt
similarity index 100%
rename from .changelog/28848.txt
rename to .archive/changelog/28848.txt
diff --git a/.changelog/28853.txt b/.archive/changelog/28853.txt
similarity index 100%
rename from .changelog/28853.txt
rename to .archive/changelog/28853.txt
diff --git a/.changelog/28855.txt b/.archive/changelog/28855.txt
similarity index 100%
rename from .changelog/28855.txt
rename to .archive/changelog/28855.txt
diff --git a/.changelog/28859.txt b/.archive/changelog/28859.txt
similarity index 100%
rename from .changelog/28859.txt
rename to .archive/changelog/28859.txt
diff --git a/.changelog/28860.txt b/.archive/changelog/28860.txt
similarity index 100%
rename from .changelog/28860.txt
rename to .archive/changelog/28860.txt
diff --git a/.changelog/28861.txt b/.archive/changelog/28861.txt
similarity index 100%
rename from .changelog/28861.txt
rename to .archive/changelog/28861.txt
diff --git a/.changelog/28862.txt b/.archive/changelog/28862.txt
similarity index 100%
rename from .changelog/28862.txt
rename to .archive/changelog/28862.txt
diff --git a/.changelog/28863.txt b/.archive/changelog/28863.txt
similarity index 100%
rename from .changelog/28863.txt
rename to .archive/changelog/28863.txt
diff --git a/.changelog/28864.txt b/.archive/changelog/28864.txt
similarity index 100%
rename from .changelog/28864.txt
rename to .archive/changelog/28864.txt
diff --git a/.changelog/28865.txt b/.archive/changelog/28865.txt
similarity index 100%
rename from .changelog/28865.txt
rename to .archive/changelog/28865.txt
diff --git a/.changelog/28866.txt b/.archive/changelog/28866.txt
similarity index 100%
rename from .changelog/28866.txt
rename to .archive/changelog/28866.txt
diff --git a/.changelog/28868.txt b/.archive/changelog/28868.txt
similarity index 100%
rename from .changelog/28868.txt
rename to .archive/changelog/28868.txt
diff --git a/.changelog/28871.txt b/.archive/changelog/28871.txt
similarity index 100%
rename from .changelog/28871.txt
rename to .archive/changelog/28871.txt
diff --git a/.changelog/28876.txt b/.archive/changelog/28876.txt
similarity index 100%
rename from .changelog/28876.txt
rename to .archive/changelog/28876.txt
diff --git a/.changelog/28901.txt b/.archive/changelog/28901.txt
similarity index 100%
rename from .changelog/28901.txt
rename to .archive/changelog/28901.txt
diff --git a/.changelog/28905.txt b/.archive/changelog/28905.txt
similarity index 100%
rename from .changelog/28905.txt
rename to .archive/changelog/28905.txt
diff --git a/.changelog/28921.txt b/.archive/changelog/28921.txt
similarity index 100%
rename from .changelog/28921.txt
rename to .archive/changelog/28921.txt
diff --git a/.changelog/28922.txt b/.archive/changelog/28922.txt
similarity index 100%
rename from .changelog/28922.txt
rename to .archive/changelog/28922.txt
diff --git a/.changelog/28924.txt b/.archive/changelog/28924.txt
similarity index 100%
rename from .changelog/28924.txt
rename to .archive/changelog/28924.txt
diff --git a/.changelog/28928.txt b/.archive/changelog/28928.txt
similarity index 100%
rename from .changelog/28928.txt
rename to .archive/changelog/28928.txt
diff --git a/.changelog/28937.txt b/.archive/changelog/28937.txt
similarity index 100%
rename from .changelog/28937.txt
rename to .archive/changelog/28937.txt
diff --git a/.changelog/28940.txt b/.archive/changelog/28940.txt
similarity index 100%
rename from .changelog/28940.txt
rename to .archive/changelog/28940.txt
diff --git a/.changelog/28960.txt b/.archive/changelog/28960.txt
similarity index 100%
rename from .changelog/28960.txt
rename to .archive/changelog/28960.txt
diff --git a/.changelog/28961.txt b/.archive/changelog/28961.txt
similarity index 100%
rename from .changelog/28961.txt
rename to .archive/changelog/28961.txt
diff --git a/.changelog/28963.txt b/.archive/changelog/28963.txt
similarity index 100%
rename from .changelog/28963.txt
rename to .archive/changelog/28963.txt
diff --git a/.changelog/28967.txt b/.archive/changelog/28967.txt
similarity index 100%
rename from .changelog/28967.txt
rename to .archive/changelog/28967.txt
diff --git a/.changelog/28968.txt b/.archive/changelog/28968.txt
similarity index 100%
rename from .changelog/28968.txt
rename to .archive/changelog/28968.txt
diff --git a/.changelog/28989.txt b/.archive/changelog/28989.txt
similarity index 100%
rename from .changelog/28989.txt
rename to .archive/changelog/28989.txt
diff --git a/.changelog/29010.txt b/.archive/changelog/29010.txt
similarity index 100%
rename from .changelog/29010.txt
rename to .archive/changelog/29010.txt
diff --git a/.changelog/29016.txt b/.archive/changelog/29016.txt
similarity index 100%
rename from .changelog/29016.txt
rename to .archive/changelog/29016.txt
diff --git a/.changelog/29018.txt b/.archive/changelog/29018.txt
similarity index 100%
rename from .changelog/29018.txt
rename to .archive/changelog/29018.txt
diff --git a/.changelog/29022.txt b/.archive/changelog/29022.txt
similarity index 100%
rename from .changelog/29022.txt
rename to .archive/changelog/29022.txt
diff --git a/.changelog/29042.txt b/.archive/changelog/29042.txt
similarity index 100%
rename from .changelog/29042.txt
rename to .archive/changelog/29042.txt
diff --git a/.changelog/29047.txt b/.archive/changelog/29047.txt
similarity index 100%
rename from .changelog/29047.txt
rename to .archive/changelog/29047.txt
diff --git a/.changelog/29049.txt b/.archive/changelog/29049.txt
similarity index 100%
rename from .changelog/29049.txt
rename to .archive/changelog/29049.txt
diff --git a/.changelog/29051.txt b/.archive/changelog/29051.txt
similarity index 100%
rename from .changelog/29051.txt
rename to .archive/changelog/29051.txt
diff --git a/.changelog/29064.txt b/.archive/changelog/29064.txt
similarity index 100%
rename from .changelog/29064.txt
rename to .archive/changelog/29064.txt
diff --git a/.changelog/29082.txt b/.archive/changelog/29082.txt
similarity index 100%
rename from .changelog/29082.txt
rename to .archive/changelog/29082.txt
diff --git a/.changelog/29083.txt b/.archive/changelog/29083.txt
similarity index 100%
rename from .changelog/29083.txt
rename to .archive/changelog/29083.txt
diff --git a/.changelog/29086.txt b/.archive/changelog/29086.txt
similarity index 100%
rename from .changelog/29086.txt
rename to .archive/changelog/29086.txt
diff --git a/.changelog/29093.txt b/.archive/changelog/29093.txt
similarity index 100%
rename from .changelog/29093.txt
rename to .archive/changelog/29093.txt
diff --git a/.changelog/29097.txt b/.archive/changelog/29097.txt
similarity index 100%
rename from .changelog/29097.txt
rename to .archive/changelog/29097.txt
diff --git a/.changelog/29099.txt b/.archive/changelog/29099.txt
similarity index 100%
rename from .changelog/29099.txt
rename to .archive/changelog/29099.txt
diff --git a/.changelog/29102.txt b/.archive/changelog/29102.txt
similarity index 100%
rename from .changelog/29102.txt
rename to .archive/changelog/29102.txt
diff --git a/.changelog/29103.txt b/.archive/changelog/29103.txt
similarity index 100%
rename from .changelog/29103.txt
rename to .archive/changelog/29103.txt
diff --git a/.changelog/29111.txt b/.archive/changelog/29111.txt
similarity index 100%
rename from .changelog/29111.txt
rename to .archive/changelog/29111.txt
diff --git a/.changelog/29112.txt b/.archive/changelog/29112.txt
similarity index 100%
rename from .changelog/29112.txt
rename to .archive/changelog/29112.txt
diff --git a/.changelog/29140.txt b/.archive/changelog/29140.txt
similarity index 100%
rename from .changelog/29140.txt
rename to .archive/changelog/29140.txt
diff --git a/.changelog/29181.txt b/.archive/changelog/29181.txt
similarity index 100%
rename from .changelog/29181.txt
rename to .archive/changelog/29181.txt
diff --git a/.changelog/29202.txt b/.archive/changelog/29202.txt
similarity index 100%
rename from .changelog/29202.txt
rename to .archive/changelog/29202.txt
diff --git a/.changelog/29208.txt b/.archive/changelog/29208.txt
similarity index 100%
rename from .changelog/29208.txt
rename to .archive/changelog/29208.txt
diff --git a/.changelog/29216.txt b/.archive/changelog/29216.txt
similarity index 100%
rename from .changelog/29216.txt
rename to .archive/changelog/29216.txt
diff --git a/.changelog/29217.txt b/.archive/changelog/29217.txt
similarity index 100%
rename from .changelog/29217.txt
rename to .archive/changelog/29217.txt
diff --git a/.changelog/29223.txt b/.archive/changelog/29223.txt
similarity index 100%
rename from .changelog/29223.txt
rename to .archive/changelog/29223.txt
diff --git a/.changelog/29224.txt b/.archive/changelog/29224.txt
similarity index 100%
rename from .changelog/29224.txt
rename to .archive/changelog/29224.txt
diff --git a/.changelog/29226.txt b/.archive/changelog/29226.txt
similarity index 100%
rename from .changelog/29226.txt
rename to .archive/changelog/29226.txt
diff --git a/.changelog/29243.txt b/.archive/changelog/29243.txt
similarity index 100%
rename from .changelog/29243.txt
rename to .archive/changelog/29243.txt
diff --git a/.changelog/29245.txt b/.archive/changelog/29245.txt
similarity index 100%
rename from .changelog/29245.txt
rename to .archive/changelog/29245.txt
diff --git a/.changelog/29250.txt b/.archive/changelog/29250.txt
similarity index 100%
rename from .changelog/29250.txt
rename to .archive/changelog/29250.txt
diff --git a/.changelog/29254.txt b/.archive/changelog/29254.txt
similarity index 100%
rename from .changelog/29254.txt
rename to .archive/changelog/29254.txt
diff --git a/.changelog/29266.txt b/.archive/changelog/29266.txt
similarity index 100%
rename from .changelog/29266.txt
rename to .archive/changelog/29266.txt
diff --git a/.changelog/29269.txt b/.archive/changelog/29269.txt
similarity index 100%
rename from .changelog/29269.txt
rename to .archive/changelog/29269.txt
diff --git a/.changelog/29277.txt b/.archive/changelog/29277.txt
similarity index 100%
rename from .changelog/29277.txt
rename to .archive/changelog/29277.txt
diff --git a/.changelog/29278.txt b/.archive/changelog/29278.txt
similarity index 100%
rename from .changelog/29278.txt
rename to .archive/changelog/29278.txt
diff --git a/.changelog/29281.txt b/.archive/changelog/29281.txt
similarity index 100%
rename from .changelog/29281.txt
rename to .archive/changelog/29281.txt
diff --git a/.changelog/29289.txt b/.archive/changelog/29289.txt
similarity index 100%
rename from .changelog/29289.txt
rename to .archive/changelog/29289.txt
diff --git a/.changelog/29291.txt b/.archive/changelog/29291.txt
similarity index 100%
rename from .changelog/29291.txt
rename to .archive/changelog/29291.txt
diff --git a/.changelog/29294.txt b/.archive/changelog/29294.txt
similarity index 100%
rename from .changelog/29294.txt
rename to .archive/changelog/29294.txt
diff --git a/.changelog/29296.txt b/.archive/changelog/29296.txt
similarity index 100%
rename from .changelog/29296.txt
rename to .archive/changelog/29296.txt
diff --git a/.changelog/29315.txt b/.archive/changelog/29315.txt
similarity index 100%
rename from .changelog/29315.txt
rename to .archive/changelog/29315.txt
diff --git a/.changelog/29325.txt b/.archive/changelog/29325.txt
similarity index 100%
rename from .changelog/29325.txt
rename to .archive/changelog/29325.txt
diff --git a/.changelog/29329.txt b/.archive/changelog/29329.txt
similarity index 100%
rename from .changelog/29329.txt
rename to .archive/changelog/29329.txt
diff --git a/.changelog/29362.txt b/.archive/changelog/29362.txt
similarity index 100%
rename from .changelog/29362.txt
rename to .archive/changelog/29362.txt
diff --git a/.changelog/29371.txt b/.archive/changelog/29371.txt
similarity index 100%
rename from .changelog/29371.txt
rename to .archive/changelog/29371.txt
diff --git a/.changelog/29380.txt b/.archive/changelog/29380.txt
similarity index 100%
rename from .changelog/29380.txt
rename to .archive/changelog/29380.txt
diff --git a/.changelog/29382.txt b/.archive/changelog/29382.txt
similarity index 100%
rename from .changelog/29382.txt
rename to .archive/changelog/29382.txt
diff --git a/.changelog/29407.txt b/.archive/changelog/29407.txt
similarity index 100%
rename from .changelog/29407.txt
rename to .archive/changelog/29407.txt
diff --git a/.changelog/29426.txt b/.archive/changelog/29426.txt
similarity index 100%
rename from .changelog/29426.txt
rename to .archive/changelog/29426.txt
diff --git a/.changelog/29460.txt b/.archive/changelog/29460.txt
similarity index 100%
rename from .changelog/29460.txt
rename to .archive/changelog/29460.txt
diff --git a/.changelog/29462.txt b/.archive/changelog/29462.txt
similarity index 100%
rename from .changelog/29462.txt
rename to .archive/changelog/29462.txt
diff --git a/.changelog/29467.txt b/.archive/changelog/29467.txt
similarity index 100%
rename from .changelog/29467.txt
rename to .archive/changelog/29467.txt
diff --git a/.changelog/29482.txt b/.archive/changelog/29482.txt
similarity index 100%
rename from .changelog/29482.txt
rename to .archive/changelog/29482.txt
diff --git a/.changelog/29484.txt b/.archive/changelog/29484.txt
similarity index 100%
rename from .changelog/29484.txt
rename to .archive/changelog/29484.txt
diff --git a/.changelog/29499.txt b/.archive/changelog/29499.txt
similarity index 100%
rename from .changelog/29499.txt
rename to .archive/changelog/29499.txt
diff --git a/.changelog/29513.txt b/.archive/changelog/29513.txt
similarity index 100%
rename from .changelog/29513.txt
rename to .archive/changelog/29513.txt
diff --git a/.changelog/29550.txt b/.archive/changelog/29550.txt
similarity index 100%
rename from .changelog/29550.txt
rename to .archive/changelog/29550.txt
diff --git a/.changelog/29555.txt b/.archive/changelog/29555.txt
similarity index 100%
rename from .changelog/29555.txt
rename to .archive/changelog/29555.txt
diff --git a/.changelog/29559.txt b/.archive/changelog/29559.txt
similarity index 100%
rename from .changelog/29559.txt
rename to .archive/changelog/29559.txt
diff --git a/.changelog/29566.txt b/.archive/changelog/29566.txt
similarity index 100%
rename from .changelog/29566.txt
rename to .archive/changelog/29566.txt
diff --git a/.changelog/29575.txt b/.archive/changelog/29575.txt
similarity index 100%
rename from .changelog/29575.txt
rename to .archive/changelog/29575.txt
diff --git a/.changelog/29578.txt b/.archive/changelog/29578.txt
similarity index 100%
rename from .changelog/29578.txt
rename to .archive/changelog/29578.txt
diff --git a/.changelog/29607.txt b/.archive/changelog/29607.txt
similarity index 100%
rename from .changelog/29607.txt
rename to .archive/changelog/29607.txt
diff --git a/.changelog/29608.txt b/.archive/changelog/29608.txt
similarity index 100%
rename from .changelog/29608.txt
rename to .archive/changelog/29608.txt
diff --git a/.changelog/29613.txt b/.archive/changelog/29613.txt
similarity index 100%
rename from .changelog/29613.txt
rename to .archive/changelog/29613.txt
diff --git a/.changelog/29615.txt b/.archive/changelog/29615.txt
similarity index 100%
rename from .changelog/29615.txt
rename to .archive/changelog/29615.txt
diff --git a/.changelog/29623.txt b/.archive/changelog/29623.txt
similarity index 100%
rename from .changelog/29623.txt
rename to .archive/changelog/29623.txt
diff --git a/.changelog/29632.txt b/.archive/changelog/29632.txt
similarity index 100%
rename from .changelog/29632.txt
rename to .archive/changelog/29632.txt
diff --git a/.changelog/29635.txt b/.archive/changelog/29635.txt
similarity index 100%
rename from .changelog/29635.txt
rename to .archive/changelog/29635.txt
diff --git a/.changelog/29640.txt b/.archive/changelog/29640.txt
similarity index 100%
rename from .changelog/29640.txt
rename to .archive/changelog/29640.txt
diff --git a/.changelog/29642.txt b/.archive/changelog/29642.txt
similarity index 100%
rename from .changelog/29642.txt
rename to .archive/changelog/29642.txt
diff --git a/.changelog/29644.txt b/.archive/changelog/29644.txt
similarity index 100%
rename from .changelog/29644.txt
rename to .archive/changelog/29644.txt
diff --git a/.changelog/29646.txt b/.archive/changelog/29646.txt
similarity index 100%
rename from .changelog/29646.txt
rename to .archive/changelog/29646.txt
diff --git a/.changelog/29648.txt b/.archive/changelog/29648.txt
similarity index 100%
rename from .changelog/29648.txt
rename to .archive/changelog/29648.txt
diff --git a/.changelog/29656.txt b/.archive/changelog/29656.txt
similarity index 100%
rename from .changelog/29656.txt
rename to .archive/changelog/29656.txt
diff --git a/.changelog/29670.txt b/.archive/changelog/29670.txt
similarity index 100%
rename from .changelog/29670.txt
rename to .archive/changelog/29670.txt
diff --git a/.changelog/29690.txt b/.archive/changelog/29690.txt
similarity index 100%
rename from .changelog/29690.txt
rename to .archive/changelog/29690.txt
diff --git a/.changelog/29692.txt b/.archive/changelog/29692.txt
similarity index 100%
rename from .changelog/29692.txt
rename to .archive/changelog/29692.txt
diff --git a/.changelog/29721.txt b/.archive/changelog/29721.txt
similarity index 100%
rename from .changelog/29721.txt
rename to .archive/changelog/29721.txt
diff --git a/.changelog/29728.txt b/.archive/changelog/29728.txt
similarity index 100%
rename from .changelog/29728.txt
rename to .archive/changelog/29728.txt
diff --git a/.changelog/29735.txt b/.archive/changelog/29735.txt
similarity index 100%
rename from .changelog/29735.txt
rename to .archive/changelog/29735.txt
diff --git a/.changelog/29741.txt b/.archive/changelog/29741.txt
similarity index 100%
rename from .changelog/29741.txt
rename to .archive/changelog/29741.txt
diff --git a/.changelog/29763.txt b/.archive/changelog/29763.txt
similarity index 100%
rename from .changelog/29763.txt
rename to .archive/changelog/29763.txt
diff --git a/.changelog/29769.txt b/.archive/changelog/29769.txt
similarity index 100%
rename from .changelog/29769.txt
rename to .archive/changelog/29769.txt
diff --git a/.changelog/29772.txt b/.archive/changelog/29772.txt
similarity index 100%
rename from .changelog/29772.txt
rename to .archive/changelog/29772.txt
diff --git a/.changelog/29773.txt b/.archive/changelog/29773.txt
similarity index 100%
rename from .changelog/29773.txt
rename to .archive/changelog/29773.txt
diff --git a/.changelog/29783.txt b/.archive/changelog/29783.txt
similarity index 100%
rename from .changelog/29783.txt
rename to .archive/changelog/29783.txt
diff --git a/.changelog/29792.txt b/.archive/changelog/29792.txt
similarity index 100%
rename from .changelog/29792.txt
rename to .archive/changelog/29792.txt
diff --git a/.changelog/29793.txt b/.archive/changelog/29793.txt
similarity index 100%
rename from .changelog/29793.txt
rename to .archive/changelog/29793.txt
diff --git a/.changelog/29794.txt b/.archive/changelog/29794.txt
similarity index 100%
rename from .changelog/29794.txt
rename to .archive/changelog/29794.txt
diff --git a/.changelog/29807.txt b/.archive/changelog/29807.txt
similarity index 100%
rename from .changelog/29807.txt
rename to .archive/changelog/29807.txt
diff --git a/.changelog/29808.txt b/.archive/changelog/29808.txt
similarity index 100%
rename from .changelog/29808.txt
rename to .archive/changelog/29808.txt
diff --git a/.changelog/29809.txt b/.archive/changelog/29809.txt
similarity index 100%
rename from .changelog/29809.txt
rename to .archive/changelog/29809.txt
diff --git a/.changelog/29812.txt b/.archive/changelog/29812.txt
similarity index 100%
rename from .changelog/29812.txt
rename to .archive/changelog/29812.txt
diff --git a/.changelog/29814.txt b/.archive/changelog/29814.txt
similarity index 100%
rename from .changelog/29814.txt
rename to .archive/changelog/29814.txt
diff --git a/.changelog/29820.txt b/.archive/changelog/29820.txt
similarity index 100%
rename from .changelog/29820.txt
rename to .archive/changelog/29820.txt
diff --git a/.changelog/29824.txt b/.archive/changelog/29824.txt
similarity index 100%
rename from .changelog/29824.txt
rename to .archive/changelog/29824.txt
diff --git a/.changelog/29825.txt b/.archive/changelog/29825.txt
similarity index 100%
rename from .changelog/29825.txt
rename to .archive/changelog/29825.txt
diff --git a/.changelog/29839.txt b/.archive/changelog/29839.txt
similarity index 100%
rename from .changelog/29839.txt
rename to .archive/changelog/29839.txt
diff --git a/.changelog/29857.txt b/.archive/changelog/29857.txt
similarity index 100%
rename from .changelog/29857.txt
rename to .archive/changelog/29857.txt
diff --git a/.changelog/29859.txt b/.archive/changelog/29859.txt
similarity index 100%
rename from .changelog/29859.txt
rename to .archive/changelog/29859.txt
diff --git a/.changelog/29863.txt b/.archive/changelog/29863.txt
similarity index 100%
rename from .changelog/29863.txt
rename to .archive/changelog/29863.txt
diff --git a/.changelog/29867.txt b/.archive/changelog/29867.txt
similarity index 100%
rename from .changelog/29867.txt
rename to .archive/changelog/29867.txt
diff --git a/.changelog/29896.txt b/.archive/changelog/29896.txt
similarity index 100%
rename from .changelog/29896.txt
rename to .archive/changelog/29896.txt
diff --git a/.changelog/29903.txt b/.archive/changelog/29903.txt
similarity index 100%
rename from .changelog/29903.txt
rename to .archive/changelog/29903.txt
diff --git a/.changelog/29905.txt b/.archive/changelog/29905.txt
similarity index 100%
rename from .changelog/29905.txt
rename to .archive/changelog/29905.txt
diff --git a/.changelog/29915.txt b/.archive/changelog/29915.txt
similarity index 100%
rename from .changelog/29915.txt
rename to .archive/changelog/29915.txt
diff --git a/.changelog/29917.txt b/.archive/changelog/29917.txt
similarity index 100%
rename from .changelog/29917.txt
rename to .archive/changelog/29917.txt
diff --git a/.changelog/29920.txt b/.archive/changelog/29920.txt
similarity index 100%
rename from .changelog/29920.txt
rename to .archive/changelog/29920.txt
diff --git a/.changelog/29923.txt b/.archive/changelog/29923.txt
similarity index 100%
rename from .changelog/29923.txt
rename to .archive/changelog/29923.txt
diff --git a/.changelog/29924.txt b/.archive/changelog/29924.txt
similarity index 100%
rename from .changelog/29924.txt
rename to .archive/changelog/29924.txt
diff --git a/.changelog/29926.txt b/.archive/changelog/29926.txt
similarity index 100%
rename from .changelog/29926.txt
rename to .archive/changelog/29926.txt
diff --git a/.changelog/29968.txt b/.archive/changelog/29968.txt
similarity index 100%
rename from .changelog/29968.txt
rename to .archive/changelog/29968.txt
diff --git a/.changelog/29975.txt b/.archive/changelog/29975.txt
similarity index 100%
rename from .changelog/29975.txt
rename to .archive/changelog/29975.txt
diff --git a/.changelog/29976.txt b/.archive/changelog/29976.txt
similarity index 100%
rename from .changelog/29976.txt
rename to .archive/changelog/29976.txt
diff --git a/.changelog/29991.txt b/.archive/changelog/29991.txt
similarity index 100%
rename from .changelog/29991.txt
rename to .archive/changelog/29991.txt
diff --git a/.changelog/29994.txt b/.archive/changelog/29994.txt
similarity index 100%
rename from .changelog/29994.txt
rename to .archive/changelog/29994.txt
diff --git a/.changelog/29999.txt b/.archive/changelog/29999.txt
similarity index 100%
rename from .changelog/29999.txt
rename to .archive/changelog/29999.txt
diff --git a/.changelog/3538.txt b/.archive/changelog/3538.txt
similarity index 100%
rename from .changelog/3538.txt
rename to .archive/changelog/3538.txt
diff --git a/.changelog/3853.txt b/.archive/changelog/3853.txt
similarity index 100%
rename from .changelog/3853.txt
rename to .archive/changelog/3853.txt
diff --git a/.changelog/4563.txt b/.archive/changelog/4563.txt
similarity index 100%
rename from .changelog/4563.txt
rename to .archive/changelog/4563.txt
diff --git a/.changelog/5055.txt b/.archive/changelog/5055.txt
similarity index 100%
rename from .changelog/5055.txt
rename to .archive/changelog/5055.txt
diff --git a/.changelog/5132.txt b/.archive/changelog/5132.txt
similarity index 100%
rename from .changelog/5132.txt
rename to .archive/changelog/5132.txt
diff --git a/.changelog/5904.txt b/.archive/changelog/5904.txt
similarity index 100%
rename from .changelog/5904.txt
rename to .archive/changelog/5904.txt
diff --git a/.changelog/6084.txt b/.archive/changelog/6084.txt
similarity index 100%
rename from .changelog/6084.txt
rename to .archive/changelog/6084.txt
diff --git a/.changelog/6364.txt b/.archive/changelog/6364.txt
similarity index 100%
rename from .changelog/6364.txt
rename to .archive/changelog/6364.txt
diff --git a/.changelog/6458.txt b/.archive/changelog/6458.txt
similarity index 100%
rename from .changelog/6458.txt
rename to .archive/changelog/6458.txt
diff --git a/.changelog/6856.txt b/.archive/changelog/6856.txt
similarity index 100%
rename from .changelog/6856.txt
rename to .archive/changelog/6856.txt
diff --git a/.changelog/7537.txt b/.archive/changelog/7537.txt
similarity index 100%
rename from .changelog/7537.txt
rename to .archive/changelog/7537.txt
diff --git a/.changelog/7777.txt b/.archive/changelog/7777.txt
similarity index 100%
rename from .changelog/7777.txt
rename to .archive/changelog/7777.txt
diff --git a/.changelog/7983.txt b/.archive/changelog/7983.txt
similarity index 100%
rename from .changelog/7983.txt
rename to .archive/changelog/7983.txt
diff --git a/.changelog/8114.txt b/.archive/changelog/8114.txt
similarity index 100%
rename from .changelog/8114.txt
rename to .archive/changelog/8114.txt
diff --git a/.changelog/8123.txt b/.archive/changelog/8123.txt
similarity index 100%
rename from .changelog/8123.txt
rename to .archive/changelog/8123.txt
diff --git a/.changelog/8538.txt b/.archive/changelog/8538.txt
similarity index 100%
rename from .changelog/8538.txt
rename to .archive/changelog/8538.txt
diff --git a/.changelog/8611.txt b/.archive/changelog/8611.txt
similarity index 100%
rename from .changelog/8611.txt
rename to .archive/changelog/8611.txt
diff --git a/.changelog/8777.txt b/.archive/changelog/8777.txt
similarity index 100%
rename from .changelog/8777.txt
rename to .archive/changelog/8777.txt
diff --git a/.changelog/8876.txt b/.archive/changelog/8876.txt
similarity index 100%
rename from .changelog/8876.txt
rename to .archive/changelog/8876.txt
diff --git a/.changelog/9092.txt b/.archive/changelog/9092.txt
similarity index 100%
rename from .changelog/9092.txt
rename to .archive/changelog/9092.txt
diff --git a/.changelog/9615.txt b/.archive/changelog/9615.txt
similarity index 100%
rename from .changelog/9615.txt
rename to .archive/changelog/9615.txt
diff --git a/.changelog/9735.txt b/.archive/changelog/9735.txt
similarity index 100%
rename from .changelog/9735.txt
rename to .archive/changelog/9735.txt
diff --git a/.changelog/9886.txt b/.archive/changelog/9886.txt
similarity index 100%
rename from .changelog/9886.txt
rename to .archive/changelog/9886.txt
diff --git a/.changelog/9913.txt b/.archive/changelog/9913.txt
similarity index 100%
rename from .changelog/9913.txt
rename to .archive/changelog/9913.txt
diff --git a/.changelog/9929.txt b/.archive/changelog/9929.txt
similarity index 100%
rename from .changelog/9929.txt
rename to .archive/changelog/9929.txt
diff --git a/.changelog/19092.txt b/.changelog/19092.txt
new file mode 100644
index 00000000000..04b4ab8b48d
--- /dev/null
+++ b/.changelog/19092.txt
@@ -0,0 +1,11 @@
+```release-note:bug
+resource/aws_cloudformation_stack_set: Fix `Can only set RetainStacksOnAccountRemoval if AutoDeployment is enabled` errors
+```
+
+```release-note:enhancement
+resource/aws_cloudformation_stack_set: Support resource import with `call_as = "DELEGATED_ADMIN"` via _StackSetName_,_CallAs_ syntax for `import` block or `terraform import` command
+```
+
+```release-note:enhancement
+resource/aws_cloudformation_stack_set_instance: Support resource import with `call_as = "DELEGATED_ADMIN"` via _StackSetName_,_AccountID_,_Region_,_CallAs_ syntax for `import` block or `terraform import` command
+```
diff --git a/.changelog/21030.txt b/.changelog/21030.txt
new file mode 100644
index 00000000000..8b0aa9a536e
--- /dev/null
+++ b/.changelog/21030.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_guardduty_filter: Add plan-time validation of `name`
+```
\ No newline at end of file
diff --git a/.changelog/21734.txt b/.changelog/21734.txt
new file mode 100644
index 00000000000..f287428ed00
--- /dev/null
+++ b/.changelog/21734.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_efs_file_system_policy: Retry IAM eventual consistency errors
+```
\ No newline at end of file
diff --git a/.changelog/22591.txt b/.changelog/22591.txt
new file mode 100644
index 00000000000..1bd9dd1ab11
--- /dev/null
+++ b/.changelog/22591.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+data-source/aws_ram_resource_share: Add `resource_arns` attribute
+```
\ No newline at end of file
diff --git a/.changelog/23515.txt b/.changelog/23515.txt
new file mode 100644
index 00000000000..52aeb23c4f8
--- /dev/null
+++ b/.changelog/23515.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_ssm_association: Add `sync_compliance` attribute
+```
diff --git a/.changelog/24523.txt b/.changelog/24523.txt
new file mode 100644
index 00000000000..964f3ccc17e
--- /dev/null
+++ b/.changelog/24523.txt
@@ -0,0 +1,11 @@
+```release-note:bug
+resource/aws_cloudformation_stack_set_instance: Fix error when deploying to organizational units with no accounts.
+```
+
+```release-note:enhancement
+resource/aws_cloudformation_stack_set_instance: Changes to `deployment_targets` now force a new resource.
+```
+
+```release-note:enhancement
+resource/aws_cloudformation_stack_set_instance: Added the `stack_instance_summaries` attribute to track all account and stack IDs for deployments to organizational units.
+```
diff --git a/.changelog/24765.txt b/.changelog/24765.txt
new file mode 100644
index 00000000000..d192c96cef6
--- /dev/null
+++ b/.changelog/24765.txt
@@ -0,0 +1,3 @@
+```release-note:new-resource
+aws_iot_domain_configuration
+```
\ No newline at end of file
diff --git a/.changelog/25362.txt b/.changelog/25362.txt
new file mode 100644
index 00000000000..f64f98a73ee
--- /dev/null
+++ b/.changelog/25362.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_fms_policy: Add `policy_option` attribute for `security_service_policy_data` block
+```
\ No newline at end of file
diff --git a/.changelog/25433.txt b/.changelog/25433.txt
new file mode 100644
index 00000000000..4cd493916f3
--- /dev/null
+++ b/.changelog/25433.txt
@@ -0,0 +1,3 @@
+```release-note:new-resource
+ aws_ram_sharing_with_organization
+ ```
\ No newline at end of file
diff --git a/.changelog/26614.txt b/.changelog/26614.txt
new file mode 100644
index 00000000000..ade20f5247b
--- /dev/null
+++ b/.changelog/26614.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_appflow_flow: Fix tasks not updating properly due to empty task being processed
+```
diff --git a/.changelog/26859.txt b/.changelog/26859.txt
new file mode 100644
index 00000000000..6c87e08d227
--- /dev/null
+++ b/.changelog/26859.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_iot_indexing_configuration: Add `thing_indexing_configuration.filter` attribute, resolving `InvalidRequestException: NamedShadowNames Filter must not be empty for enabling NamedShadowIndexingMode` errors
+```
\ No newline at end of file
diff --git a/.changelog/26987.txt b/.changelog/26987.txt
new file mode 100644
index 00000000000..ec35b080f85
--- /dev/null
+++ b/.changelog/26987.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_elasticache_cluster: Add `transit_encryption_enabled` argument, enabling in-transit encryption for Memcached clusters inside a VPC
+```
diff --git a/.changelog/27075.txt b/.changelog/27075.txt
new file mode 100644
index 00000000000..d99a883f036
--- /dev/null
+++ b/.changelog/27075.txt
@@ -0,0 +1,3 @@
+```release-note:new-data-source
+aws_media_convert_queue
+```
\ No newline at end of file
diff --git a/.changelog/30242.txt b/.changelog/30242.txt
new file mode 100644
index 00000000000..62e2f21ee72
--- /dev/null
+++ b/.changelog/30242.txt
@@ -0,0 +1,7 @@
+```release-note:enhancement
+resource/aws_resourcegroups_group: `resource_query` no longer conflicts with `configuration`
+```
+
+```release-note:bug
+resource/aws_resourcegroups_resource: Fix crash when resource Create fails
+```
\ No newline at end of file
diff --git a/.changelog/30293.txt b/.changelog/30293.txt
new file mode 100644
index 00000000000..b62d3eacc31
--- /dev/null
+++ b/.changelog/30293.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_cloudwatch_event_rule: Fix ARN-based partner event bus rule ID parsing error
+```
diff --git a/.changelog/30438.txt b/.changelog/30438.txt
new file mode 100644
index 00000000000..a20695c4055
--- /dev/null
+++ b/.changelog/30438.txt
@@ -0,0 +1,4 @@
+```release-note:enhancement
+resource/aws_batch_compute_environment: `compute_resources.allocation_strategy`, `compute_resources.bid_percentage`, `compute_resources.ec2_configuration.image_id_override`, `compute_resources.ec2_configuration.image_type`, `compute_resources.ec2_key_pair`, `compute_resources.image_id`, `compute_resources.instance_role`, `compute_resources.launch_template.launch_template_id`
+, `compute_resources.launch_template.launch_template_name`, `compute_resources.tags` and `compute_resources.type` can now be updated in-place
+```
diff --git a/.changelog/35969.txt b/.changelog/30482.txt
similarity index 100%
rename from .changelog/35969.txt
rename to .changelog/30482.txt
diff --git a/.changelog/30771.txt b/.changelog/30771.txt
new file mode 100644
index 00000000000..9e7ddca2a9f
--- /dev/null
+++ b/.changelog/30771.txt
@@ -0,0 +1,3 @@
+```release-note:new-data-source
+aws_ec2_transit_gateway_route_table_routes
+```
diff --git a/.changelog/30817.txt b/.changelog/30817.txt
new file mode 100644
index 00000000000..9703205b81a
--- /dev/null
+++ b/.changelog/30817.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+data-source/aws_ssm_parameter: Add `insecure_value` attribute
+```
diff --git a/.changelog/30916.txt b/.changelog/30916.txt
new file mode 100644
index 00000000000..e2a3351e1a3
--- /dev/null
+++ b/.changelog/30916.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_s3_bucket_logging: Retry on empty read of logging config
+```
diff --git a/.changelog/35970.txt b/.changelog/30965.txt
similarity index 100%
rename from .changelog/35970.txt
rename to .changelog/30965.txt
diff --git a/.changelog/30996.txt b/.changelog/30996.txt
new file mode 100644
index 00000000000..fe1a8fc3c68
--- /dev/null
+++ b/.changelog/30996.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_rds_global_cluster: Add plan-time validation of `global_cluster_identifier`
+```
\ No newline at end of file
diff --git a/.changelog/31022.txt b/.changelog/31022.txt
new file mode 100644
index 00000000000..279299a7a89
--- /dev/null
+++ b/.changelog/31022.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_docdb_cluster_instance: Add `copy_tags_to_snapshot` argument
+```
\ No newline at end of file
diff --git a/.changelog/31062.txt b/.changelog/31062.txt
new file mode 100644
index 00000000000..1bc76973dbc
--- /dev/null
+++ b/.changelog/31062.txt
@@ -0,0 +1,15 @@
+```release-note:new-resource
+aws_msk_vpc_connection
+```
+
+```release-note:enhancement
+resource/aws_msk_broker: Add `vpc_connectivity` attribute to the `broker_node_group_info.connectivity_info` configuration block
+```
+
+```release-note:enhancement
+resource/aws_msk_broker: Add `bootstrap_brokers_vpc_connectivity_sasl_iam`, `bootstrap_brokers_vpc_connectivity_sasl_scram` and `bootstrap_brokers_vpc_connectivity_tls` attributes
+```
+
+```release-note:new-data-source
+aws_msk_vpc_connection
+```
\ No newline at end of file
diff --git a/.changelog/31111.txt b/.changelog/31111.txt
new file mode 100644
index 00000000000..d49ae66cf16
--- /dev/null
+++ b/.changelog/31111.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_wafv2_web_acl: Fixed error handling `response_inspection` parameters
+```
diff --git a/.changelog/31127.txt b/.changelog/31127.txt
new file mode 100644
index 00000000000..500abbc9831
--- /dev/null
+++ b/.changelog/31127.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_wafv2_web_acl: Adds `rule_group_reference_statement.rule_action_override.action_to_use.challenge` argument
+```
\ No newline at end of file
diff --git a/.changelog/31449.txt b/.changelog/31449.txt
new file mode 100644
index 00000000000..212065c70d7
--- /dev/null
+++ b/.changelog/31449.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_ecr_registry_scanning_configuration: Correctly delete rules on resource Update 
+```
\ No newline at end of file
diff --git a/.changelog/31463.txt b/.changelog/31463.txt
new file mode 100644
index 00000000000..8a5bf815242
--- /dev/null
+++ b/.changelog/31463.txt
@@ -0,0 +1,7 @@
+```release-note:new-resource
+aws_guardduty_detector_feature
+```
+
+```release-note:enhancement
+data-source/aws_guardduty_detector: Add `features` attribute
+```
\ No newline at end of file
diff --git a/.changelog/31600.txt b/.changelog/31600.txt
new file mode 100644
index 00000000000..8de19ef7780
--- /dev/null
+++ b/.changelog/31600.txt
@@ -0,0 +1,7 @@
+```release-note:enhancement
+data-source/aws_db_snapshot: Add `tags` argument
+```
+
+```release-note:bug
+resource/aws_db_instance_automated_backups_replication: Fix `unexpected state 'Pending'` errors on resource Create
+```
\ No newline at end of file
diff --git a/.changelog/31602.txt b/.changelog/31602.txt
new file mode 100644
index 00000000000..339f30e7902
--- /dev/null
+++ b/.changelog/31602.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+data-source/aws_db_cluster_snapshot: Add `tags` argument
+```
\ No newline at end of file
diff --git a/.changelog/31607.txt b/.changelog/31607.txt
new file mode 100644
index 00000000000..7344c3e368c
--- /dev/null
+++ b/.changelog/31607.txt
@@ -0,0 +1,11 @@
+```release-note:enhancement
+resource/aws_pipes_pipe: Add `enrichment_parameters` argument
+```
+
+```release-note:enhancement
+resource/aws_pipes_pipe: Add `activemq_broker_parameters`, `dynamodb_stream_parameters`, `kinesis_stream_parameters`, `managed_streaming_kafka_parameters`, `rabbitmq_broker_parameters`, `self_managed_kafka_parameters` and `sqs_queue_parameters` attributes to the `source_parameters` configuration block. NOTE: Because we cannot easily test all this functionality, it is best effort and we ask for community help in testing
+```
+
+```release-note:enhancement
+resource/aws_pipes_pipe: Add `batch_job_parameters`, `cloudwatch_logs_parameters`, `ecs_task_parameters`, `eventbridge_event_bus_parameters`, `http_parameters`, `kinesis_stream_parameters`, `lambda_function_parameters`, `redshift_data_parameters`, `sagemaker_pipeline_parameters`, `sqs_queue_parameters` and `step_function_state_machine_parameters` attributes to the `target_parameters` configuration block. NOTE: Because we cannot easily test all this functionality, it is best effort and we ask for community help in testing
+```
\ No newline at end of file
diff --git a/.changelog/31668.txt b/.changelog/31668.txt
new file mode 100644
index 00000000000..43798625187
--- /dev/null
+++ b/.changelog/31668.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_wafv2_web_acl: Add `association_config` argument
+```
diff --git a/.changelog/31680.txt b/.changelog/31680.txt
new file mode 100644
index 00000000000..e688a1b8785
--- /dev/null
+++ b/.changelog/31680.txt
@@ -0,0 +1,3 @@
+```release-note:new-resource
+aws_cleanrooms_collaboration
+```
diff --git a/.changelog/31757.txt b/.changelog/31757.txt
new file mode 100644
index 00000000000..d89f850f9ea
--- /dev/null
+++ b/.changelog/31757.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+data-source/aws_ecr_repository: Correctly set `most_recent_image_tags` when only a single image is found
+```
diff --git a/.changelog/31778.txt b/.changelog/31778.txt
new file mode 100644
index 00000000000..7feb9ce190f
--- /dev/null
+++ b/.changelog/31778.txt
@@ -0,0 +1,11 @@
+```release-note:enhancement
+resource/aws_nat_gateway: Add `secondary_allocation_ids`, `secondary_private_ip_addresses` and `secondary_private_ip_address_count` arguments
+```
+
+```release-note:enhancement
+resource/aws_nat_gateway: Add configurable timeouts
+```
+
+```release-note:enhancement
+data-source/aws_nat_gateway: Add `secondary_allocation_ids`, `secondary_private_ip_addresses` and `secondary_private_ip_address_count` attributes
+```
\ No newline at end of file
diff --git a/.changelog/31796.txt b/.changelog/31796.txt
new file mode 100644
index 00000000000..3fc42894896
--- /dev/null
+++ b/.changelog/31796.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_organizations_organization: Ensure that the Organization ID specified in `terraform import` is the current Organization
+```
\ No newline at end of file
diff --git a/.changelog/31858.txt b/.changelog/31858.txt
new file mode 100644
index 00000000000..a5282852e04
--- /dev/null
+++ b/.changelog/31858.txt
@@ -0,0 +1,3 @@
+```release-note:new-resource
+aws_ec2_instance_connect_endpoint
+```
\ No newline at end of file
diff --git a/.changelog/31915.txt b/.changelog/31915.txt
new file mode 100644
index 00000000000..7da2067aa2a
--- /dev/null
+++ b/.changelog/31915.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_secretsmanager_secret_rotation: Fix `InvalidParameterException: You cannot specify both rotation frequency and schedule expression together` errors on resource Update
+```
\ No newline at end of file
diff --git a/.changelog/31931.txt b/.changelog/31931.txt
new file mode 100644
index 00000000000..ec716eaa117
--- /dev/null
+++ b/.changelog/31931.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_lambda_event_source_mapping: The `queues` argument has changed from a set to a list with a maximum of one element.
+```
diff --git a/.changelog/32007.txt b/.changelog/32007.txt
new file mode 100644
index 00000000000..3fbc22f9ebb
--- /dev/null
+++ b/.changelog/32007.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_config_configuration_recorder: Add `exclusion_by_resource_types` and `recording_strategy` attributes to the `recording_group` configuration block
+```
\ No newline at end of file
diff --git a/.changelog/32026.txt b/.changelog/32026.txt
new file mode 100644
index 00000000000..d076a1345b5
--- /dev/null
+++ b/.changelog/32026.txt
@@ -0,0 +1,7 @@
+```release-note:new-data-source
+aws_sesv2_email_identity
+```
+
+```release-note:new-data-source
+aws_sesv2_email_identity_mail_from_attributes
+```
diff --git a/.changelog/32091.txt b/.changelog/32091.txt
new file mode 100644
index 00000000000..6c438c3baa0
--- /dev/null
+++ b/.changelog/32091.txt
@@ -0,0 +1,3 @@
+```release-note:new-resource
+aws_iam_security_token_service_preferences
+```
\ No newline at end of file
diff --git a/.changelog/32102.txt b/.changelog/32102.txt
new file mode 100644
index 00000000000..9cf866f750d
--- /dev/null
+++ b/.changelog/32102.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_fis_experiment_template: Add `log_configuration` configuration block
+```
\ No newline at end of file
diff --git a/.changelog/32108.txt b/.changelog/32108.txt
new file mode 100644
index 00000000000..f937fa38162
--- /dev/null
+++ b/.changelog/32108.txt
@@ -0,0 +1,11 @@
+```release-note:note
+provider: Updates to Go 1.20, the last release that will run on macOS 10.13 High Sierra or 10.14 Mojave. A future release will update to Go 1.21, and these platforms will no longer be supported.
+```
+
+```release-note:note
+provider: Updates to Go 1.20, the last release that will run on any release of Windows 7, 8, Server 2008 and Server 2012. A future release will update to Go 1.21, and these platforms will no longer be supported.
+```
+
+```release-note:note
+provider: Updates to Go 1.20. The provider will now notice the `trust-ad` option in `/etc/resolv.conf` and, if set, will set the "authentic data" option in outgoing DNS requests in order to better match the behavior of the GNU libc resolver.
+```
diff --git a/.changelog/32148.txt b/.changelog/32148.txt
new file mode 100644
index 00000000000..f1246f4ed3a
--- /dev/null
+++ b/.changelog/32148.txt
@@ -0,0 +1,7 @@
+```release-note:bug
+resource/aws_vpc_security_group_egress_rule: `security_group_id` is Required
+```
+
+```release-note:bug
+resource/aws_vpc_security_group_ingress_rule: `security_group_id` is Required
+```
diff --git a/.changelog/32152.txt b/.changelog/32152.txt
new file mode 100644
index 00000000000..73ae6532dbe
--- /dev/null
+++ b/.changelog/32152.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_fis_experiment_template: Add support for `Pods` and `Tasks` to `action.*.target`
+```
diff --git a/.changelog/32160.txt b/.changelog/32160.txt
new file mode 100644
index 00000000000..41a064ba6a4
--- /dev/null
+++ b/.changelog/32160.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_fis_experiment_template: Add `parameters` attribute to the `target` configuration block
+```
\ No newline at end of file
diff --git a/.changelog/32169.txt b/.changelog/32169.txt
new file mode 100644
index 00000000000..2abe2d405d2
--- /dev/null
+++ b/.changelog/32169.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_api_gateway_rest_api: Fix crash when `binary_media_types` is `null`
+```
\ No newline at end of file
diff --git a/.changelog/32171.txt b/.changelog/32171.txt
new file mode 100644
index 00000000000..bd2d89cdd7b
--- /dev/null
+++ b/.changelog/32171.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_storagegateway_smb_file_share: Fix update error when `kms_encrypted` is `true` but `kms_key_arn` is not sent in the request
+```
\ No newline at end of file
diff --git a/.changelog/32174.txt b/.changelog/32174.txt
new file mode 100644
index 00000000000..f3179d0b1fc
--- /dev/null
+++ b/.changelog/32174.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+provider: Mask all sensitive values that appear when `TF_LOG` level is `TRACE`
+```
\ No newline at end of file
diff --git a/.changelog/32176.txt b/.changelog/32176.txt
new file mode 100644
index 00000000000..c6d6e530605
--- /dev/null
+++ b/.changelog/32176.txt
@@ -0,0 +1,15 @@
+```release-note:new-resource
+aws_sfn_alias
+```
+
+```release-note:new-data-source
+aws_sfn_alias
+```
+
+```release-note:new-data-source
+aws_sfn_state_machine_versions
+```
+
+```release-note:enhancement
+resource/aws_sfn_state_machine: Add `description`, `publish`, `revision_id`, `state_machine_version_arn` and `version_description` attributes
+```
\ No newline at end of file
diff --git a/.changelog/32177.txt b/.changelog/32177.txt
new file mode 100644
index 00000000000..5bfd3ae1081
--- /dev/null
+++ b/.changelog/32177.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+data-source/aws_vpclattice_service: Add ability to find by `name`
+```
diff --git a/.changelog/32186.txt b/.changelog/32186.txt
new file mode 100644
index 00000000000..bcc76cb1521
--- /dev/null
+++ b/.changelog/32186.txt
@@ -0,0 +1,7 @@
+```release-note:bug
+resource/aws_vpclattice_access_log_subscription: Avoid recreating resource when passing an ARN as `resource_identifier`
+```
+
+```release-note:bug
+resource/aws_vpclattice_access_log_subscription: Avoid recreating resource when passing a non-wildcard CloudWatch Logs log group ARN as `destination_arn`
+```
\ No newline at end of file
diff --git a/.changelog/32196.txt b/.changelog/32196.txt
new file mode 100644
index 00000000000..67beca78654
--- /dev/null
+++ b/.changelog/32196.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_route: Fix `reading Route in Route Table (rtb-1234abcd) with destination (1.2.3.4/5): couldn't find resource` errors when reading new resource
+```
\ No newline at end of file
diff --git a/.changelog/32200.txt b/.changelog/32200.txt
new file mode 100644
index 00000000000..abf4dbd8780
--- /dev/null
+++ b/.changelog/32200.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_batch_compute_environment: Add `placement_group` attribute to the `compute_resources` configuration block
+```
\ No newline at end of file
diff --git a/.changelog/32203.txt b/.changelog/32203.txt
new file mode 100644
index 00000000000..a088dee0865
--- /dev/null
+++ b/.changelog/32203.txt
@@ -0,0 +1,15 @@
+```release-note:new-resource
+aws_transfer_profile
+```
+
+```release-note:new-resource
+aws_transfer_certificate
+```
+
+```release-note:new-resource
+aws_transfer_agreement
+```
+
+```release-note:new-resource
+aws_transfer_connector
+```
\ No newline at end of file
diff --git a/.changelog/32207.txt b/.changelog/32207.txt
new file mode 100644
index 00000000000..e0573a13f09
--- /dev/null
+++ b/.changelog/32207.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_codecommit_repository: Doesn't force replacement when renaming
+```
\ No newline at end of file
diff --git a/.changelog/32226.txt b/.changelog/32226.txt
new file mode 100644
index 00000000000..dcec0198a1d
--- /dev/null
+++ b/.changelog/32226.txt
@@ -0,0 +1,3 @@
+```release-note:new-data-source
+aws_opensearchserverless_security_policy
+```
\ No newline at end of file
diff --git a/.changelog/32231.txt b/.changelog/32231.txt
new file mode 100644
index 00000000000..a8a4c136a23
--- /dev/null
+++ b/.changelog/32231.txt
@@ -0,0 +1,3 @@
+```release-note:new-data-source
+aws_opensearchserverless_access_policy
+```
\ No newline at end of file
diff --git a/.changelog/32233.txt b/.changelog/32233.txt
new file mode 100644
index 00000000000..e46b496d537
--- /dev/null
+++ b/.changelog/32233.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_medialive_channel: Adds schemas for `caption_descriptions`, `global_configuration`, `motion_graphics_configuration`, and `nielsen_configuration` support to `encoder settings`
+```
\ No newline at end of file
diff --git a/.changelog/32234.txt b/.changelog/32234.txt
new file mode 100644
index 00000000000..8aeaaa9c525
--- /dev/null
+++ b/.changelog/32234.txt
@@ -0,0 +1,7 @@
+```release-note:enhancement
+resource/aws_opensearch_domain: Add `software_update_options` attribute
+```
+
+```release-note:enhancement
+data-source/aws_opensearch_domain: Add `software_update_options` attribute
+```
diff --git a/.changelog/32243.txt b/.changelog/32243.txt
new file mode 100644
index 00000000000..8953d713b7d
--- /dev/null
+++ b/.changelog/32243.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_servicecatalog_principal_portfolio_association: Fix `ResourceNotFoundException` errors on resource Delete when configured `principal_type` is `IAM_PATTERN`
+```
\ No newline at end of file
diff --git a/.changelog/32247.txt b/.changelog/32247.txt
new file mode 100644
index 00000000000..f59487ddd3a
--- /dev/null
+++ b/.changelog/32247.txt
@@ -0,0 +1,3 @@
+```release-note:new-data-source
+aws_opensearchserverless_collection
+```
\ No newline at end of file
diff --git a/.changelog/32276.txt b/.changelog/32276.txt
new file mode 100644
index 00000000000..8cb046fbcca
--- /dev/null
+++ b/.changelog/32276.txt
@@ -0,0 +1,3 @@
+```release-note:new-data-source
+aws_opensearchserverless_vpc_endpoint
+```
\ No newline at end of file
diff --git a/.changelog/32278.txt b/.changelog/32278.txt
new file mode 100644
index 00000000000..7ebd393ad8a
--- /dev/null
+++ b/.changelog/32278.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_emrserverless_application: Do not recreate the resource if `release_label` changes
+```
\ No newline at end of file
diff --git a/.changelog/32283.txt b/.changelog/32283.txt
new file mode 100644
index 00000000000..ead62dbb895
--- /dev/null
+++ b/.changelog/32283.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_glue_catalog_database: Add `target_database.region` argument
+```
\ No newline at end of file
diff --git a/.changelog/32285.txt b/.changelog/32285.txt
new file mode 100644
index 00000000000..feb868c248c
--- /dev/null
+++ b/.changelog/32285.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_quicksight_analysis: Correctly expand comparison method
+```
\ No newline at end of file
diff --git a/.changelog/32287.txt b/.changelog/32287.txt
new file mode 100644
index 00000000000..aa573ee6132
--- /dev/null
+++ b/.changelog/32287.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_db_instance: Fix resource Create returning instances not in the `available` state when `identifier_prefix` is specified
+```
diff --git a/.changelog/32297.txt b/.changelog/32297.txt
new file mode 100644
index 00000000000..49dcac6c5e2
--- /dev/null
+++ b/.changelog/32297.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+provider: Prevent resource recreation if `tags` or `tags_all` are updated
+```
\ No newline at end of file
diff --git a/.changelog/32317.txt b/.changelog/32317.txt
new file mode 100644
index 00000000000..c68807279da
--- /dev/null
+++ b/.changelog/32317.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_s3_bucket: Fix `InvalidArgument: Invalid attribute name specified` errors when listing S3 Bucket objects, caused by an [AWS SDK for Go regression](https://github.com/aws/aws-sdk-go/issues/4897)
+```
\ No newline at end of file
diff --git a/.changelog/32321.txt b/.changelog/32321.txt
new file mode 100644
index 00000000000..e0c67113799
--- /dev/null
+++ b/.changelog/32321.txt
@@ -0,0 +1,3 @@
+```release-note:new-data-source
+aws_opensearchserverless_security_config
+```
\ No newline at end of file
diff --git a/.changelog/32327.txt b/.changelog/32327.txt
new file mode 100644
index 00000000000..a25d270e978
--- /dev/null
+++ b/.changelog/32327.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_lambda_function: Support `code_signing_config_arn` in the `ap-east-1` AWS Region
+```
\ No newline at end of file
diff --git a/.changelog/32329.txt b/.changelog/32329.txt
new file mode 100644
index 00000000000..d69669f7cea
--- /dev/null
+++ b/.changelog/32329.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_wafregional_web_acl_association: Increase creation timeout value from 2 to 5 minutes to prevent WAFUnavailableEntityException
+```
diff --git a/.changelog/32332.txt b/.changelog/32332.txt
new file mode 100644
index 00000000000..bc261a76c3b
--- /dev/null
+++ b/.changelog/32332.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_glue_crawler: Add `iceberg_target` configuration block
+```
\ No newline at end of file
diff --git a/.changelog/32339.txt b/.changelog/32339.txt
new file mode 100644
index 00000000000..9d90109ec77
--- /dev/null
+++ b/.changelog/32339.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_aws_keyspaces_table: Add `client_side_timestamps` configuration block
+```
\ No newline at end of file
diff --git a/.changelog/32342.txt b/.changelog/32342.txt
new file mode 100644
index 00000000000..efb4e943c6e
--- /dev/null
+++ b/.changelog/32342.txt
@@ -0,0 +1,7 @@
+```release-note:enhancement
+resource/aws_service_discovery_private_dns_namespace: Allow `description` to be updated in-place
+```
+
+```release-note:enhancement
+resource/aws_service_discovery_public_dns_namespace: Allow `description` to be updated in-place
+```
\ No newline at end of file
diff --git a/.changelog/32343.txt b/.changelog/32343.txt
new file mode 100644
index 00000000000..15bda9ef708
--- /dev/null
+++ b/.changelog/32343.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_internetmonitor_monitor: Add `health_events_config` configuration block
+```
\ No newline at end of file
diff --git a/.changelog/32345.txt b/.changelog/32345.txt
new file mode 100644
index 00000000000..07c541efdd9
--- /dev/null
+++ b/.changelog/32345.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_qldb_stream: Add configurable Create and Delete timeouts
+```
\ No newline at end of file
diff --git a/.changelog/32352.txt b/.changelog/32352.txt
new file mode 100644
index 00000000000..2323a089913
--- /dev/null
+++ b/.changelog/32352.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+provider: Correctly handle `forbidden_account_ids`
+```
diff --git a/.changelog/32354.txt b/.changelog/32354.txt
new file mode 100644
index 00000000000..e635ab19be0
--- /dev/null
+++ b/.changelog/32354.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_timestreamwrite_table: Add `schema` configuration block
+```
\ No newline at end of file
diff --git a/.changelog/32355.txt b/.changelog/32355.txt
new file mode 100644
index 00000000000..d3dd2db718a
--- /dev/null
+++ b/.changelog/32355.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_vpc_endpoint: Fix `InvalidParameter: PrivateDnsOnlyForInboundResolverEndpoint not supported for this service` errors creating S3 _Interface_ VPC endpoints
+```
\ No newline at end of file
diff --git a/.changelog/32366.txt b/.changelog/32366.txt
new file mode 100644
index 00000000000..95d36f3f3b6
--- /dev/null
+++ b/.changelog/32366.txt
@@ -0,0 +1,7 @@
+```release-note:new-resource
+aws_codecatalyst_dev_environment
+```
+
+```release-note:note
+resource/aws_codecatalyst_dev_environment: Because we cannot easily test this functionality, it is best effort and we ask for community help in testing
+```
\ No newline at end of file
diff --git a/.changelog/32371.txt b/.changelog/32371.txt
new file mode 100644
index 00000000000..2de6f5655fb
--- /dev/null
+++ b/.changelog/32371.txt
@@ -0,0 +1,15 @@
+```release-note:bug
+resource/aws_kms_external_key: Correctly remove all tags
+```
+
+```release-note:bug
+resource/aws_kms_key: Correctly remove all tags
+```
+
+```release-note:bug
+resource/aws_kms_replica_external_key: Correctly remove all tags
+```
+
+```release-note:bug
+resource/aws_kms_replica_key: Correctly remove all tags
+```
diff --git a/.changelog/32372.txt b/.changelog/32372.txt
new file mode 100644
index 00000000000..2453cc73d35
--- /dev/null
+++ b/.changelog/32372.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_ssm_parameter: Skip Update if only `overwrite` parameter changes
+```
diff --git a/.changelog/32388.txt b/.changelog/32388.txt
new file mode 100644
index 00000000000..c1fe5dfa38a
--- /dev/null
+++ b/.changelog/32388.txt
@@ -0,0 +1,7 @@
+```release-note:enhancement
+resource/aws_ec2_host: Add `asset_id` argument
+```
+
+```release-note:enhancement
+data-source/aws_ec2_host: Add `asset_id` attribute
+```
\ No newline at end of file
diff --git a/.changelog/32393.txt b/.changelog/32393.txt
new file mode 100644
index 00000000000..38030d46963
--- /dev/null
+++ b/.changelog/32393.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_globalaccelerator_custom_routing_endpoint_group: Respect configured `endpoint_group_region` value on resource Create
+```
\ No newline at end of file
diff --git a/.changelog/32400.txt b/.changelog/32400.txt
new file mode 100644
index 00000000000..8211d9baea4
--- /dev/null
+++ b/.changelog/32400.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_networkfirewall_firewall_policy: Add `firewall_policy.policy_variables` configuration block to support Suricata HOME_NET variable override
+```
\ No newline at end of file
diff --git a/.changelog/32412.txt b/.changelog/32412.txt
new file mode 100644
index 00000000000..df2a032955c
--- /dev/null
+++ b/.changelog/32412.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_lb_listener_certificate: Remove from state when listener not found
+```
\ No newline at end of file
diff --git a/.changelog/32414.txt b/.changelog/32414.txt
new file mode 100644
index 00000000000..6c57ab5c95b
--- /dev/null
+++ b/.changelog/32414.txt
@@ -0,0 +1,7 @@
+```release-note:enhancement
+resource/aws_signer_signing_profile: Update `platform_id` validation.
+```
+
+```release-note:enhancement
+resource/aws_signer_signing_profile: Add `signing_material` attribute.
+```
\ No newline at end of file
diff --git a/.changelog/32416.txt b/.changelog/32416.txt
new file mode 100644
index 00000000000..f24767ea2fc
--- /dev/null
+++ b/.changelog/32416.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_emr_studio_session_mapping: Fix `InvalidRequestException: IdentityId is invalid` errors reading resources created with `identity_name`
+```
diff --git a/.changelog/32418.txt b/.changelog/32418.txt
new file mode 100644
index 00000000000..42db8c6377c
--- /dev/null
+++ b/.changelog/32418.txt
@@ -0,0 +1,7 @@
+```release-note:enhancement
+resource/aws_sagemaker_endpoint: Make `deployment_config.blue_green_update_policy` optional
+```
+
+```release-note:enhancement
+resource/aws_sagemaker_endpoint: Add `deployment_config.rolling_update_policy` argument
+```
\ No newline at end of file
diff --git a/.changelog/32432.txt b/.changelog/32432.txt
new file mode 100644
index 00000000000..af459e63aec
--- /dev/null
+++ b/.changelog/32432.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_pipes_pipe: Fix `Error: setting target_parameters: Invalid address to set` errors when creating pipes with ecs task targets
+```
\ No newline at end of file
diff --git a/.changelog/32435.txt b/.changelog/32435.txt
new file mode 100644
index 00000000000..68a15a63939
--- /dev/null
+++ b/.changelog/32435.txt
@@ -0,0 +1,3 @@
+```release-note:new-resource
+aws_opensearch_vpc_endpoint
+```
\ No newline at end of file
diff --git a/.changelog/32439.txt b/.changelog/32439.txt
new file mode 100644
index 00000000000..c4d8922ad95
--- /dev/null
+++ b/.changelog/32439.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_config_config_rule: Prevent crash on nil describe output
+```
diff --git a/.changelog/32445.txt b/.changelog/32445.txt
new file mode 100644
index 00000000000..6bca1e34840
--- /dev/null
+++ b/.changelog/32445.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_cognito_user_pool: Suppress diff when `schema.string_attribute_constraints` is omitted for `String` attribute types
+```
diff --git a/.changelog/32449.txt b/.changelog/32449.txt
new file mode 100644
index 00000000000..4a98b50390c
--- /dev/null
+++ b/.changelog/32449.txt
@@ -0,0 +1,7 @@
+```release-note:enhancement
+resource/aws_appmesh_gateway_route: Add `path` to the `spec.http_route.action.rewrite` and `spec.http2_route.action.rewrite` configuration blocks
+```
+
+```release-note:enhancement
+data-source/aws_appmesh_gateway_route: Add `path` to the `spec.http_route.action.rewrite` and `spec.http2_route.action.rewrite` configuration blocks
+```
diff --git a/.changelog/32454.txt b/.changelog/32454.txt
new file mode 100644
index 00000000000..094ccc8c54a
--- /dev/null
+++ b/.changelog/32454.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_mq_broker: default `replication_user` to `false`
+```
diff --git a/.changelog/32462.txt b/.changelog/32462.txt
new file mode 100644
index 00000000000..7ac8b9a0549
--- /dev/null
+++ b/.changelog/32462.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_iam_virtual_mfa_device: Add `enable_date` and `user_name` attributes
+```
diff --git a/.changelog/32464.txt b/.changelog/32464.txt
new file mode 100644
index 00000000000..7b7a95cfb70
--- /dev/null
+++ b/.changelog/32464.txt
@@ -0,0 +1,35 @@
+```release-note:bug
+resource/aws_quicksight_template: Fix exception thrown when specifying `definition.sheets.visuals.bar_chart_visual.chart_configuration.category_axis.scrollbar_options.visible_range`
+```
+
+```release-note:bug
+resource/aws_quicksight_template: Fix exception thrown when specifying `definition.sheets.visuals.pivot_table_visual.chart_configuration.field_options.selected_field_options.visibility`
+```
+
+```release-note:bug
+resource/aws_quicksight_template: Fix exception thrown when specifying `definition.sheets.visuals.pivot_table_visual.chart_configuration.field_wells.pivot_table_aggregated_field_wells.rows`
+```
+
+```release-note:bug
+resource/aws_quicksight_dashboard: Fix exception thrown when specifying `definition.sheets.visuals.bar_chart_visual.chart_configuration.category_axis.scrollbar_options.visible_range`
+```
+
+```release-note:bug
+resource/aws_quicksight_dashboard: Fix exception thrown when specifying `definition.sheets.visuals.pivot_table_visual.chart_configuration.field_options.selected_field_options.visibility`
+```
+
+```release-note:bug
+resource/aws_quicksight_dashboard: Fix exception thrown when specifying `definition.sheets.visuals.pivot_table_visual.chart_configuration.field_wells.pivot_table_aggregated_field_wells.rows`
+```
+
+```release-note:bug
+resource/aws_quicksight_analysis: Fix exception thrown when specifying `definition.sheets.visuals.bar_chart_visual.chart_configuration.category_axis.scrollbar_options.visible_range`
+```
+
+```release-note:bug
+resource/aws_quicksight_analysis: Fix exception thrown when specifying `definition.sheets.visuals.pivot_table_visual.chart_configuration.field_options.selected_field_options.visibility`
+```
+
+```release-note:bug
+resource/aws_quicksight_analysis: Fix exception thrown when specifying `definition.sheets.visuals.pivot_table_visual.chart_configuration.field_wells.pivot_table_aggregated_field_wells.rows`
+```
diff --git a/.changelog/32477.txt b/.changelog/32477.txt
new file mode 100644
index 00000000000..8ba0cdaa178
--- /dev/null
+++ b/.changelog/32477.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+data-source/aws_db_instance: Add `max_allocated_storage` attribute
+```
diff --git a/.changelog/32482.txt b/.changelog/32482.txt
new file mode 100644
index 00000000000..834c75c2ec0
--- /dev/null
+++ b/.changelog/32482.txt
@@ -0,0 +1,3 @@
+```release-note:new-resource
+aws_workspaces_connection_alias
+```
\ No newline at end of file
diff --git a/.changelog/32494.txt b/.changelog/32494.txt
new file mode 100644
index 00000000000..a84e4558470
--- /dev/null
+++ b/.changelog/32494.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_quicksight_group_membership: Allow non `default` value for namespace
+```
\ No newline at end of file
diff --git a/.changelog/32503.txt b/.changelog/32503.txt
new file mode 100644
index 00000000000..490c696103b
--- /dev/null
+++ b/.changelog/32503.txt
@@ -0,0 +1,3 @@
+```release-note:new-data-source
+aws_fsx_ontap_file_system
+```
diff --git a/.changelog/32517.txt b/.changelog/32517.txt
new file mode 100644
index 00000000000..19b0896af0c
--- /dev/null
+++ b/.changelog/32517.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+data-source/aws_vpc_endpoint: Add `dns_options.private_dns_only_for_inbound_resolver_endpoint`
+````
diff --git a/.changelog/32520.txt b/.changelog/32520.txt
new file mode 100644
index 00000000000..bdd7345e563
--- /dev/null
+++ b/.changelog/32520.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_config_config_rule: Prevent crash from unhandled read error
+```
diff --git a/.changelog/32526.txt b/.changelog/32526.txt
new file mode 100644
index 00000000000..3f98fa2d690
--- /dev/null
+++ b/.changelog/32526.txt
@@ -0,0 +1,7 @@
+```release-note:enhancement
+resource/aws_sagemaker_domain: Add `default_user_settings.canvas_app_settings.workspace_settings` attribute
+```
+
+```release-note:enhancement
+resource/aws_sagemaker_user_profile: Add `user_settings.canvas_app_settings.workspace_settings` attribute
+```
\ No newline at end of file
diff --git a/.changelog/32527.txt b/.changelog/32527.txt
new file mode 100644
index 00000000000..153f4ea0840
--- /dev/null
+++ b/.changelog/32527.txt
@@ -0,0 +1,3 @@
+```release-note:new-resource
+aws_sagemaker_pipeline
+```
\ No newline at end of file
diff --git a/.changelog/32528.txt b/.changelog/32528.txt
new file mode 100644
index 00000000000..69ec249f2a1
--- /dev/null
+++ b/.changelog/32528.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_glue_job: Add `command.runtime` attribute
+```
\ No newline at end of file
diff --git a/.changelog/32530.txt b/.changelog/32530.txt
new file mode 100644
index 00000000000..c092c4bd830
--- /dev/null
+++ b/.changelog/32530.txt
@@ -0,0 +1,11 @@
+```release-note:enhancement
+resource/aws_fsx_ontap_volume: Add `copy_tags_to_backups` and `snapshot_policy` arguments
+```
+
+```release-note:enhancement
+resource/aws_fsx_ontap_volume: Add `bypass_snaplock_enterprise_retention` argument and `snaplock_configuration` configuration block to support [SnapLock](https://docs.aws.amazon.com/fsx/latest/ONTAPGuide/snaplock.html)
+```
+
+```release-note:enhancement
+resource/aws_fsx_openzfs_volume: Add `delete_volume_options` argument
+```
\ No newline at end of file
diff --git a/.changelog/32535.txt b/.changelog/32535.txt
new file mode 100644
index 00000000000..4d576d4e462
--- /dev/null
+++ b/.changelog/32535.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_lambda_layer_version: Fix bug causing new version to be created on every apply when `source_code_hash` is used but not changed
+```
\ No newline at end of file
diff --git a/.changelog/32538.txt b/.changelog/32538.txt
new file mode 100644
index 00000000000..fc61baa295c
--- /dev/null
+++ b/.changelog/32538.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_connect_queue: add delete function
+```
\ No newline at end of file
diff --git a/.changelog/32540.txt b/.changelog/32540.txt
new file mode 100644
index 00000000000..c68ae0bd1dd
--- /dev/null
+++ b/.changelog/32540.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_connect_routing_profile: add delete function
+```
\ No newline at end of file
diff --git a/.changelog/32546.txt b/.changelog/32546.txt
new file mode 100644
index 00000000000..1aa9665ae50
--- /dev/null
+++ b/.changelog/32546.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_datasync_agent: Prevent persistent diffs when `private_link_endpoint` is not explicitly configured.
+```
diff --git a/.changelog/32551.txt b/.changelog/32551.txt
new file mode 100644
index 00000000000..b1b8f6c7245
--- /dev/null
+++ b/.changelog/32551.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+data-source/aws_dms_replication_instance: Fixed bug that caused `replication_instance_private_ips`, `replication_instance_public_ips`, and `vpc_security_group_ids` to always return `null`
+```
diff --git a/.changelog/32579.txt b/.changelog/32579.txt
new file mode 100644
index 00000000000..c150997fc71
--- /dev/null
+++ b/.changelog/32579.txt
@@ -0,0 +1,7 @@
+```release-note:bug
+resource/aws_finspace_kx_cluster: `database.cache_configurations` argument is now optional
+```
+
+```release-note:bug
+resource/aws_finspace_kx_cluster: `database.cache_configurations.db_paths` argument is now optional
+```
diff --git a/.changelog/32592.txt b/.changelog/32592.txt
new file mode 100644
index 00000000000..c94b1a9867e
--- /dev/null
+++ b/.changelog/32592.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_quicksight_folder: Fix misidentification of parent folder at grandchild level or deeper
+```
\ No newline at end of file
diff --git a/.changelog/32593.txt b/.changelog/32593.txt
new file mode 100644
index 00000000000..d44e5cdc76b
--- /dev/null
+++ b/.changelog/32593.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+data-source/aws_mq_broker: Fix `setting user: Invalid address to set` errors
+```
\ No newline at end of file
diff --git a/.changelog/32594.txt b/.changelog/32594.txt
new file mode 100644
index 00000000000..d514f0f3eb7
--- /dev/null
+++ b/.changelog/32594.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_ec2_traffic_mirror_filter_rule: Fix crash when updating `rule_number`
+```
\ No newline at end of file
diff --git a/.changelog/32595.txt b/.changelog/32595.txt
new file mode 100644
index 00000000000..52242975e15
--- /dev/null
+++ b/.changelog/32595.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_kms_grant: Allow usage of service principal as grantee and revoker
+```
diff --git a/.changelog/32596.txt b/.changelog/32596.txt
new file mode 100644
index 00000000000..9b57f5c2f6b
--- /dev/null
+++ b/.changelog/32596.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_route53_cidr_location: Fix `Value Conversion Error` errors
+```
\ No newline at end of file
diff --git a/.changelog/32606.txt b/.changelog/32606.txt
new file mode 100644
index 00000000000..1f159bfa674
--- /dev/null
+++ b/.changelog/32606.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_lightsail_key_pair: Add `tags` attribute
+```
\ No newline at end of file
diff --git a/.changelog/32609.txt b/.changelog/32609.txt
new file mode 100644
index 00000000000..aa128837f2e
--- /dev/null
+++ b/.changelog/32609.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_db_instance: Add `backup_target` attribute
+```
diff --git a/.changelog/32621.txt b/.changelog/32621.txt
new file mode 100644
index 00000000000..ec4c48e4000
--- /dev/null
+++ b/.changelog/32621.txt
@@ -0,0 +1,7 @@
+```release-note:new-data-source
+aws_fsx_ontap_storage_virtual_machine
+```
+
+```release-note:bug
+resource/aws_fsx_ontap_storage_virtual_machine: Change `file_system_id` to [ForceNew](https://developer.hashicorp.com/terraform/plugin/sdkv2/schemas/schema-behaviors#forcenew)
+```
\ No newline at end of file
diff --git a/.changelog/32622.txt b/.changelog/32622.txt
new file mode 100644
index 00000000000..589062eeb81
--- /dev/null
+++ b/.changelog/32622.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_pipes_pipe: Fix `ValidationException` errors when updating pipe
+```
\ No newline at end of file
diff --git a/.changelog/32624.txt b/.changelog/32624.txt
new file mode 100644
index 00000000000..866c4481df0
--- /dev/null
+++ b/.changelog/32624.txt
@@ -0,0 +1,3 @@
+```release-note:new-data-source
+aws_fsx_ontap_storage_virtual_machines
+```
diff --git a/.changelog/32629.txt b/.changelog/32629.txt
new file mode 100644
index 00000000000..e73152c0fc4
--- /dev/null
+++ b/.changelog/32629.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_apigatewayv2_authorizer: Skip setting authorizer TTL when there are no identity sources
+```
diff --git a/.changelog/32632.txt b/.changelog/32632.txt
new file mode 100644
index 00000000000..22debd09ed9
--- /dev/null
+++ b/.changelog/32632.txt
@@ -0,0 +1,7 @@
+```release-note:new-resource
+aws_datasync_location_fsx_ontap_file_system
+```
+
+```release-note:new-resource
+aws_datasync_location_azure_blob
+```
\ No newline at end of file
diff --git a/.changelog/32644.txt b/.changelog/32644.txt
new file mode 100644
index 00000000000..0c1568a79d3
--- /dev/null
+++ b/.changelog/32644.txt
@@ -0,0 +1,11 @@
+```release-note:bug
+resource/aws_quicksight_analysis: Grid layout `optimized_view_port_width` argument changed to Optional
+```
+
+```release-note:bug
+resource/aws_quicksight_dashboard: Grid layout `optimized_view_port_width` argument changed to Optional
+```
+
+```release-note:bug
+resource/aws_quicksight_template: Grid layout `optimized_view_port_width` argument changed to Optional
+```
diff --git a/.changelog/32654.txt b/.changelog/32654.txt
new file mode 100644
index 00000000000..38e0cbf1083
--- /dev/null
+++ b/.changelog/32654.txt
@@ -0,0 +1,7 @@
+```release-note:enhancement
+resource/aws_transfer_server: Add `structured_log_destinations` argument
+```
+
+```release-note:enhancement
+data-source/aws_transfer_server: Add `structured_log_destinations` attribute
+```
\ No newline at end of file
diff --git a/.changelog/32658.txt b/.changelog/32658.txt
new file mode 100644
index 00000000000..f58717ce93d
--- /dev/null
+++ b/.changelog/32658.txt
@@ -0,0 +1,7 @@
+```release-note:bug
+resource/aws_vpclattice_service_network_vpc_association: Avoid recreating resource when passing an ARN as `service_network_identifier`
+```
+
+```release-note:bug
+resource/aws_vpclattice_service_network_service_association: Avoid recreating resource when passing an ARN as `service_identifier` or `service_network_identifier`
+```
\ No newline at end of file
diff --git a/.changelog/32659.txt b/.changelog/32659.txt
new file mode 100644
index 00000000000..bc6faaf1915
--- /dev/null
+++ b/.changelog/32659.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_elasticsearch_domain: Omit `ebs_options.throughput` and `ebs_options.iops` for unsupported volume types
+```
diff --git a/.changelog/32661.txt b/.changelog/32661.txt
new file mode 100644
index 00000000000..ac2688ed5a0
--- /dev/null
+++ b/.changelog/32661.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_sagemaker_domain: Fix validation on `s3_kms_key_id` in `sharing_settings` and `kms_key_id`
+```
\ No newline at end of file
diff --git a/.changelog/32664.txt b/.changelog/32664.txt
new file mode 100644
index 00000000000..43a2781c69b
--- /dev/null
+++ b/.changelog/32664.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_lightsail_domain_entry: Add support for `AAAA` `type` value
+```
diff --git a/.changelog/32668.txt b/.changelog/32668.txt
new file mode 100644
index 00000000000..d50534e4225
--- /dev/null
+++ b/.changelog/32668.txt
@@ -0,0 +1,11 @@
+```release-note:bug
+resource/aws_quicksight_analysis: Fix exception thrown when setting the value for `definition.sheets.visuals.pie_chart_visual.chart_configuration.data_labels.measure_label_visibility`
+```
+
+```release-note:bug
+resource/aws_quicksight_dashboard: Fix exception thrown when setting the value for `definition.sheets.visuals.pie_chart_visual.chart_configuration.data_labels.measure_label_visibility`
+```
+
+```release-note:bug
+resource/aws_quicksight_template: Fix exception thrown when setting the value for `definition.sheets.visuals.pie_chart_visual.chart_configuration.data_labels.measure_label_visibility`
+```
diff --git a/.changelog/32669.txt b/.changelog/32669.txt
new file mode 100644
index 00000000000..fa34eff87c7
--- /dev/null
+++ b/.changelog/32669.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_elasticache_parameter_group: Remove from state on resource Read if deleted outside of Terraform
+```
\ No newline at end of file
diff --git a/.changelog/32679.txt b/.changelog/32679.txt
new file mode 100644
index 00000000000..f2d4e5088a0
--- /dev/null
+++ b/.changelog/32679.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_grafana_workspace: Allow `grafana_version` to be updated in-place
+```
\ No newline at end of file
diff --git a/.changelog/32706.txt b/.changelog/32706.txt
new file mode 100644
index 00000000000..89371d04edb
--- /dev/null
+++ b/.changelog/32706.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_lambda_invocation: Fix plan failing with deferred input values
+```
\ No newline at end of file
diff --git a/.changelog/32714.txt b/.changelog/32714.txt
new file mode 100644
index 00000000000..f10167bd659
--- /dev/null
+++ b/.changelog/32714.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_medialive_channel: Updates schemas for `selector_settings` for `audio_selector` and `selector_settings` for `caption_selector`
+```
diff --git a/.changelog/32715.txt b/.changelog/32715.txt
new file mode 100644
index 00000000000..1a274dd63d3
--- /dev/null
+++ b/.changelog/32715.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_account_primary_contact: Correct plan-time validation of `phone_number`
+```
\ No newline at end of file
diff --git a/.changelog/32716.txt b/.changelog/32716.txt
new file mode 100644
index 00000000000..ad36d9f986c
--- /dev/null
+++ b/.changelog/32716.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_opensearch_domain: Correctly handle `off_peak_window_options.off_peak_window.window_start_time` value of `00:00`
+```
\ No newline at end of file
diff --git a/.changelog/32729.txt b/.changelog/32729.txt
new file mode 100644
index 00000000000..7ab6a0bfc30
--- /dev/null
+++ b/.changelog/32729.txt
@@ -0,0 +1,7 @@
+```release-note:enhancement
+resource/aws_lambda_function: Add support for `python3.11` `runtime` value
+```
+
+```release-note:enhancement
+resource/aws_lambda_layer_version: Add support for `python3.11` `compatible_runtimes` value
+```
\ No newline at end of file
diff --git a/.changelog/32740.txt b/.changelog/32740.txt
new file mode 100644
index 00000000000..f1c96526b1b
--- /dev/null
+++ b/.changelog/32740.txt
@@ -0,0 +1,7 @@
+```release-note:enhancement
+data-source/aws_db_instances: Add ability to filter by `tags`
+```
+
+```release-note:enhancement
+data-source/aws_db_instance: Add ability to filter by `tags`
+```
\ No newline at end of file
diff --git a/.changelog/32741.txt b/.changelog/32741.txt
new file mode 100644
index 00000000000..c1860ed362f
--- /dev/null
+++ b/.changelog/32741.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_transfer_connector: Add `sftp_config` argument and make `as2_config` optional
+```
\ No newline at end of file
diff --git a/.changelog/32746.txt b/.changelog/32746.txt
new file mode 100644
index 00000000000..8c84ebf78c0
--- /dev/null
+++ b/.changelog/32746.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_networkfirewall_rule_group: Add support for `REJECT` action in stateful rule actions
+```
\ No newline at end of file
diff --git a/.changelog/32751.txt b/.changelog/32751.txt
new file mode 100644
index 00000000000..3922e7c6056
--- /dev/null
+++ b/.changelog/32751.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_cloudwatch_composite_alarm: Add `actions_suppressor` configuration block
+```
diff --git a/.changelog/32759.txt b/.changelog/32759.txt
new file mode 100644
index 00000000000..0b361006143
--- /dev/null
+++ b/.changelog/32759.txt
@@ -0,0 +1,7 @@
+```release-note:enhancement
+resource/aws_instance: Add `http_protocol_ipv6` attribute to `metadata_options` configuration block
+```
+
+```release-note:enhancement
+data-source/aws_instance: Add `metadata_options.http_protocol_ipv6` attribute
+```
\ No newline at end of file
diff --git a/.changelog/32791.txt b/.changelog/32791.txt
new file mode 100644
index 00000000000..c1660306e97
--- /dev/null
+++ b/.changelog/32791.txt
@@ -0,0 +1,11 @@
+```release-note:bug
+resource/aws_quicksight_analysis: Fix an error related to setting the value for `definition.sheets.visuals.insight_visual.insight_configuration.computation`
+```
+
+```release-note:bug
+resource/aws_quicksight_dashboard: Fix an error related to setting the value for `definition.sheets.visuals.insight_visual.insight_configuration.computation`
+```
+
+```release-note:bug
+resource/aws_quicksight_template: Fix an error related to setting the value for `definition.sheets.visuals.insight_visual.insight_configuration.computation`
+```
diff --git a/.changelog/32793.txt b/.changelog/32793.txt
new file mode 100644
index 00000000000..97f723710bb
--- /dev/null
+++ b/.changelog/32793.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+data-source/aws_ecs_task_execution: Fixed bug that incorrectly mapped the value of `container_overrides.memory` to `container_overrides.memory_reservation`
+```
diff --git a/.changelog/32794.txt b/.changelog/32794.txt
new file mode 100644
index 00000000000..088ea4117ca
--- /dev/null
+++ b/.changelog/32794.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_route_table: Allow an existing local route to be adopted or imported and the target to be updated
+```
\ No newline at end of file
diff --git a/.changelog/32800.txt b/.changelog/32800.txt
new file mode 100644
index 00000000000..0f106975100
--- /dev/null
+++ b/.changelog/32800.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_finspace_kx_cluster: Adjusted `savedown_storage_configuration.size` minimum value to `10` GB.
+```
diff --git a/.changelog/32821.txt b/.changelog/32821.txt
new file mode 100644
index 00000000000..68936682bfc
--- /dev/null
+++ b/.changelog/32821.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_ec2_transit_gateway_vpc_attachment: Change `transit_gateway_default_route_table_association` and `transit_gateway_default_route_table_propagation` to Computed
+```
\ No newline at end of file
diff --git a/.changelog/32822.txt b/.changelog/32822.txt
new file mode 100644
index 00000000000..b27dde3b0a1
--- /dev/null
+++ b/.changelog/32822.txt
@@ -0,0 +1,7 @@
+```release-note:bug
+resource/aws_quicksight_analysis: Fixed a bug that incorrectly determined the valid `select_all_options` values for `custom_filter_configuration`, `custom_filter_list_configuration`, `filter_list_configuration`, `numeric_equality_filter`, and `numeric_range_filter`
+```
+
+```release-note:bug
+resource/aws_quicksight_template: Fixed a bug that incorrectly determined the valid `select_all_options` values for `custom_filter_configuration`, `custom_filter_list_configuration`, `filter_list_configuration`, `numeric_equality_filter`, and `numeric_range_filter`
+```
diff --git a/.changelog/32840.txt b/.changelog/32840.txt
new file mode 100644
index 00000000000..e1abc5f5935
--- /dev/null
+++ b/.changelog/32840.txt
@@ -0,0 +1,15 @@
+```release-note:enhancement
+data-source/aws_cloudtrail_service_account: Add service account ID for `il-central-1` AWS Region
+```
+
+```release-note:enhancement
+data-source/aws_elb_hosted_zone_id: Add hosted zone ID for `il-central-1` AWS Region
+```
+
+```release-note:enhancement
+data-source/aws_lb_hosted_zone_id: Add hosted zone IDs for `il-central-1` AWS Region
+```
+
+```release-note:enhancement
+data-source/aws_s3_bucket: Add hosted zone ID for `il-central-1` AWS Region
+```
\ No newline at end of file
diff --git a/.changelog/32844.txt b/.changelog/32844.txt
new file mode 100644
index 00000000000..609c733a7bd
--- /dev/null
+++ b/.changelog/32844.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_sfn_state_machine: Fix `Provider produced inconsistent final plan` errors for `publish`
+```
\ No newline at end of file
diff --git a/.changelog/32845.txt b/.changelog/32845.txt
new file mode 100644
index 00000000000..6de8f2b2fb2
--- /dev/null
+++ b/.changelog/32845.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_licensemanager_license_configuration: Surface `InvalidParameterValueException` errors during resource Delete
+```
\ No newline at end of file
diff --git a/.changelog/32846.txt b/.changelog/32846.txt
new file mode 100644
index 00000000000..1532736e0ec
--- /dev/null
+++ b/.changelog/32846.txt
@@ -0,0 +1,15 @@
+```release-note:enhancement
+resource/aws_rds_cluster_instance: Add `custom_iam_instance_profile` argument to allow RDS Custom users to specify an IAM Instance Profile for the RDS Cluster Instance
+```
+
+```release-note:enhancement
+resource/aws_rds_cluster_instance: Update `engine` plan-time validation to allow for RDS Custom engine types
+```
+
+```release-note:enhancement
+resource/aws_rds_cluster: Add `db_system_id` argument to support RDS Custom engine types
+```
+
+```release-note:enhancement
+data-source/aws_rds_cluster: Add `db_system_id` attribute
+```
diff --git a/.changelog/32848.txt b/.changelog/32848.txt
new file mode 100644
index 00000000000..cfeb6add4c7
--- /dev/null
+++ b/.changelog/32848.txt
@@ -0,0 +1,3 @@
+```release-note:new-resource
+aws_msk_cluster_policy
+```
\ No newline at end of file
diff --git a/.changelog/32854.txt b/.changelog/32854.txt
new file mode 100644
index 00000000000..a8435eb3a0c
--- /dev/null
+++ b/.changelog/32854.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_instance: Fix `InvalidParameterCombination: Network interfaces and an instance-level security groups may not be specified on the same request` errors creating Instances with `subnet_id` configured and `launch_template` referencing an `aws_launch_template` with configured `vpc_security_group_ids`
+```
\ No newline at end of file
diff --git a/.changelog/32856.txt b/.changelog/32856.txt
new file mode 100644
index 00000000000..55a525a2601
--- /dev/null
+++ b/.changelog/32856.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_quicksight_analysis: Raise limit for maximum allowed `visuals` blocks per sheet to 50
+```
diff --git a/.changelog/32860.txt b/.changelog/32860.txt
new file mode 100644
index 00000000000..30aedd6841f
--- /dev/null
+++ b/.changelog/32860.txt
@@ -0,0 +1,7 @@
+```release-note:enhancement
+resource/aws_fms_admin_account: Add configurable timeouts
+```
+
+```release-note:bug
+resource/aws_fms_policy: Prevent erroneous diffs on `security_service_policy_data.managed_service_data`
+```
\ No newline at end of file
diff --git a/.changelog/32865.txt b/.changelog/32865.txt
new file mode 100644
index 00000000000..231a1a723d1
--- /dev/null
+++ b/.changelog/32865.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_cloudfront_distribution: Don't call `UpdateDistribution` API if only tags are updated
+```
\ No newline at end of file
diff --git a/.changelog/32866.txt b/.changelog/32866.txt
new file mode 100644
index 00000000000..a30875aaadd
--- /dev/null
+++ b/.changelog/32866.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_emr_instance_fleet: Fix fleet deletion failing for terminated clusters
+```
diff --git a/.changelog/32878.txt b/.changelog/32878.txt
new file mode 100644
index 00000000000..4b43d7f6195
--- /dev/null
+++ b/.changelog/32878.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+provider: Support `il-central-1` as a valid AWS Region
+```
\ No newline at end of file
diff --git a/.changelog/32882.txt b/.changelog/32882.txt
new file mode 100644
index 00000000000..505d1ad4251
--- /dev/null
+++ b/.changelog/32882.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_cloudwatch_events_target: Add `sagemaker_pipeline_target` argument
+```
\ No newline at end of file
diff --git a/.changelog/32883.txt b/.changelog/32883.txt
new file mode 100644
index 00000000000..c60a831a947
--- /dev/null
+++ b/.changelog/32883.txt
@@ -0,0 +1,7 @@
+```release-note:new-resource
+aws_codecatalyst_project
+```
+
+```release-note:note
+resource/aws_codecatalyst_project: Because we cannot easily test this functionality, it is best effort and we ask for community help in testing
+```
\ No newline at end of file
diff --git a/.changelog/32886.txt b/.changelog/32886.txt
new file mode 100644
index 00000000000..3cdca4819fb
--- /dev/null
+++ b/.changelog/32886.txt
@@ -0,0 +1,7 @@
+```release-note:new-data-source
+aws_codecatalyst_dev_environment
+```
+
+```release-note:note
+data-source/aws_codecatalyst_dev_environment: Because we cannot easily test this functionality, it is best effort and we ask for community help in testing
+```
\ No newline at end of file
diff --git a/.changelog/32890.txt b/.changelog/32890.txt
new file mode 100644
index 00000000000..d28642f7245
--- /dev/null
+++ b/.changelog/32890.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_lambda_event_source_mapping: Increased the maximum number of filters to 10
+```
diff --git a/.changelog/32896.txt b/.changelog/32896.txt
new file mode 100644
index 00000000000..601523982e1
--- /dev/null
+++ b/.changelog/32896.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_subnet: Fix allowing IPv6 to be enabled in an update after initial creation with IPv4 only
+```
\ No newline at end of file
diff --git a/.changelog/32898.txt b/.changelog/32898.txt
new file mode 100644
index 00000000000..bbd7bc58125
--- /dev/null
+++ b/.changelog/32898.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_glue_crawler: Add `hudi_target` argument
+```
\ No newline at end of file
diff --git a/.changelog/32899.txt b/.changelog/32899.txt
new file mode 100644
index 00000000000..4d2530af74b
--- /dev/null
+++ b/.changelog/32899.txt
@@ -0,0 +1,7 @@
+```release-note:new-resource
+aws_codecatalyst_source_repository
+```
+
+```release-note:note
+resource/aws_codecatalyst_source_repository: Because we cannot easily test this functionality, it is best effort and we ask for community help in testing
+```
diff --git a/.changelog/32908.txt b/.changelog/32908.txt
new file mode 100644
index 00000000000..2efeea10795
--- /dev/null
+++ b/.changelog/32908.txt
@@ -0,0 +1,3 @@
+```release-note:new-resource
+aws_dms_replication_config
+```
\ No newline at end of file
diff --git a/.changelog/32914.txt b/.changelog/32914.txt
new file mode 100644
index 00000000000..cc6ff9adf53
--- /dev/null
+++ b/.changelog/32914.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_autoscaling_group: Add `ignore_failed_scaling_activities` argument
+```
\ No newline at end of file
diff --git a/.changelog/32928.txt b/.changelog/32928.txt
new file mode 100644
index 00000000000..20f1c7bece4
--- /dev/null
+++ b/.changelog/32928.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_db_instance: Fix crash creating resource with empty `restore_to_point_in_time` configuration block
+```
\ No newline at end of file
diff --git a/.changelog/32933.txt b/.changelog/32933.txt
new file mode 100644
index 00000000000..6edd72b9cd9
--- /dev/null
+++ b/.changelog/32933.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_appstream_fleet: Increased upper limit of `max_user_duration_in_seconds` to 432000
+```
diff --git a/.changelog/32936.txt b/.changelog/32936.txt
new file mode 100644
index 00000000000..8abf1a6a107
--- /dev/null
+++ b/.changelog/32936.txt
@@ -0,0 +1,7 @@
+```release-note:new-resource
+aws_cloudfront_continuous_deployment_policy
+```
+
+```release-note:enhancement
+resource/aws_cloudfront_distribution: Add `continuous_deployment_policy_id` and `staging` arguments to support continuous deployments
+```
diff --git a/.changelog/32939.txt b/.changelog/32939.txt
new file mode 100644
index 00000000000..83318748897
--- /dev/null
+++ b/.changelog/32939.txt
@@ -0,0 +1,7 @@
+```release-note:bug
+data-source/aws_vpclattice_service_network: Avoid listing tags when the service network has been shared to the current account via AWS Resource Access Manager (RAM)
+```
+
+```release-note:bug
+data-source/aws_vpclattice_service: Avoid listing tags when the service has been shared to the current account via AWS Resource Access Manager (RAM)
+```
\ No newline at end of file
diff --git a/.changelog/32941.txt b/.changelog/32941.txt
new file mode 100644
index 00000000000..1a856dfc3d8
--- /dev/null
+++ b/.changelog/32941.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_lb: Fix to avoid creating a load balancer with same name as an existing load balancer
+```
\ No newline at end of file
diff --git a/.changelog/32956.txt b/.changelog/32956.txt
new file mode 100644
index 00000000000..8bb5ce0fee4
--- /dev/null
+++ b/.changelog/32956.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_emr_cluster: Fix to allow empty `args` for `bootstrap_action`
+```
\ No newline at end of file
diff --git a/.changelog/32958.txt b/.changelog/32958.txt
new file mode 100644
index 00000000000..3cec024918e
--- /dev/null
+++ b/.changelog/32958.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_appstream_fleet: Retry ConcurrentModificationException errors during creation
+```
diff --git a/.changelog/32975.txt b/.changelog/32975.txt
new file mode 100644
index 00000000000..abcf4332a19
--- /dev/null
+++ b/.changelog/32975.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_dms_endpoint: Add `babelfish` as an `engine_name` option
+```
\ No newline at end of file
diff --git a/.changelog/32984.txt b/.changelog/32984.txt
new file mode 100644
index 00000000000..616126af55c
--- /dev/null
+++ b/.changelog/32984.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_quicksight_data_set: Change permission attribute type from TypeList to TypeSet
+```
\ No newline at end of file
diff --git a/.changelog/32987.txt b/.changelog/32987.txt
new file mode 100644
index 00000000000..3f92144d57c
--- /dev/null
+++ b/.changelog/32987.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_lb: Changes to `security_groups` for Network Load Balancers force a new resource if either the old or new set of security group IDs is empty
+```
\ No newline at end of file
diff --git a/.changelog/32989.txt b/.changelog/32989.txt
new file mode 100644
index 00000000000..73e82414bbe
--- /dev/null
+++ b/.changelog/32989.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_s3_bucket_logging: Fix perpetual drift when `expected_bucket_owner` is configured
+```
\ No newline at end of file
diff --git a/.changelog/32990.txt b/.changelog/32990.txt
new file mode 100644
index 00000000000..221d331f512
--- /dev/null
+++ b/.changelog/32990.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_opensearch_outbound_connection: Add `connection_properties`, `connection_mode` and `accept_connection` arguments
+```
diff --git a/.changelog/33005.txt b/.changelog/33005.txt
new file mode 100644
index 00000000000..9761886315d
--- /dev/null
+++ b/.changelog/33005.txt
@@ -0,0 +1,7 @@
+```release-note:enhancement
+resource/aws_imagebuilder_image_pipeline: Add `image_scanning_configuration` configuration block
+```
+
+```release-note:enhancement
+data-source/aws_imagebuilder_image_pipeline: Add `image_scanning_configuration` attribute
+```
diff --git a/.changelog/33012.txt b/.changelog/33012.txt
new file mode 100644
index 00000000000..d0337acd5e1
--- /dev/null
+++ b/.changelog/33012.txt
@@ -0,0 +1,15 @@
+```release-note:bug
+resource/aws_quicksight_analysis: Adjust max length of `definition.*.calculated_fields.*.expression` to 32000 characters
+```
+
+```release-note:bug
+resource/aws_quicksight_dashboard: Adjust max length of `definition.*.calculated_fields.*.expression` to 32000 characters
+```
+
+```release-note:bug
+resource/aws_quicksight_template: Adjust max length of `definition.*.calculated_fields.*.expression` to 32000 characters
+```
+
+```release-note:bug
+resource/aws_quicksight_template: Adjust max items of `definition.*.calculated_fields` to 500
+```
diff --git a/.changelog/33015.txt b/.changelog/33015.txt
new file mode 100644
index 00000000000..c2334e9b358
--- /dev/null
+++ b/.changelog/33015.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_budgets_budget_action: No longer times out when creating a non-triggered action
+```
diff --git a/.changelog/33018.txt b/.changelog/33018.txt
new file mode 100644
index 00000000000..16b22a89e6a
--- /dev/null
+++ b/.changelog/33018.txt
@@ -0,0 +1,11 @@
+```release-note:bug
+resource/aws_quicksight_analysis: Enable `font_configuration` to be set for table header styles
+```
+
+```release-note:bug
+resource/aws_quicksight_analysis: Enable `font_configuration` to be set for table header styles
+```
+
+```release-note:bug
+resource/aws_quicksight_analysis: Enable `font_configuration` to be set for table header styles
+```
diff --git a/.changelog/33023.txt b/.changelog/33023.txt
new file mode 100644
index 00000000000..0dbf0c93954
--- /dev/null
+++ b/.changelog/33023.txt
@@ -0,0 +1,9 @@
+```release-note:bug
+resource/aws_quicksight_analysis: Convert `permissions` argument to TypeSet, preventing persistent differences
+```
+```release-note:bug
+resource/aws_quicksight_dashboard: Convert `permissions` argument to TypeSet, preventing persistent differences
+```
+```release-note:bug
+resource/aws_quicksight_template: Convert `permissions` argument to TypeSet, preventing persistent differences
+```
diff --git a/.changelog/33024.txt b/.changelog/33024.txt
new file mode 100644
index 00000000000..ea87592afc4
--- /dev/null
+++ b/.changelog/33024.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+provider: Adds the `s3_us_east_1_regional_endpoint` attribute to support using the regional S3 API endpoint in `us-east-1`.
+```
diff --git a/.changelog/33031.txt b/.changelog/33031.txt
new file mode 100644
index 00000000000..0b24a051015
--- /dev/null
+++ b/.changelog/33031.txt
@@ -0,0 +1,7 @@
+```release-note:enhancement
+resource/aws_opensearch_domain: Add `cluster_config.multi_az_with_standby_enabled` argument
+```
+
+```release-note:enhancement
+data-source/aws_opensearch_domain: Add `cluster_config.multi_az_with_standby_enabled` attribute
+```
\ No newline at end of file
diff --git a/.changelog/33040.txt b/.changelog/33040.txt
new file mode 100644
index 00000000000..f2e1f5ab5b6
--- /dev/null
+++ b/.changelog/33040.txt
@@ -0,0 +1,9 @@
+```release-note:bug
+resource/aws_quicksight_analysis: Convert `definition.*.calculated_fields` to a set type, preventing persistent differences
+```
+```release-note:bug
+resource/aws_quicksight_dashboard: Convert `definition.*.calculated_fields` to a set type, preventing persistent differences
+```
+```release-note:bug
+resource/aws_quicksight_template: Convert `definition.*.calculated_fields` to a set type, preventing persistent differences
+```
diff --git a/.changelog/33053.txt b/.changelog/33053.txt
new file mode 100644
index 00000000000..095f68e770a
--- /dev/null
+++ b/.changelog/33053.txt
@@ -0,0 +1,3 @@
+```release-note:new-data-source
+aws_cognito_identity_pool
+```
\ No newline at end of file
diff --git a/.changelog/33059.txt b/.changelog/33059.txt
new file mode 100644
index 00000000000..c9ded07c5f7
--- /dev/null
+++ b/.changelog/33059.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_cloudformation_stack: Marks `outputs` as Computed when there are potential changes.
+```
diff --git a/.changelog/33091.txt b/.changelog/33091.txt
new file mode 100644
index 00000000000..dc90d6387d2
--- /dev/null
+++ b/.changelog/33091.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_organizations_organization: Fix `current Organization ID (o-xxxxxxxxxx) does not match` errors on resource Read
+```
\ No newline at end of file
diff --git a/.changelog/33093.txt b/.changelog/33093.txt
new file mode 100644
index 00000000000..af3df40ef3a
--- /dev/null
+++ b/.changelog/33093.txt
@@ -0,0 +1,7 @@
+```release-note:bug
+data-source/aws_iam_policy_document: Fix inconsistent handling of `condition` blocks with duplicated `test` and `variable` arguments
+```
+
+```release-note:note
+data-source/aws_iam_policy_document: In some cases, `statement.*.condition` blocks with the same `test` and `variable` arguments were incorrectly handled by the provider. Since this results in unexpected IAM Policies being submitted to AWS, we have updated the logic to merge `values` lists in this case. This may cause existing IAM Policy documents to report a difference. However, those policies are likely not what was originally intended.
+```
diff --git a/.changelog/33095.txt b/.changelog/33095.txt
new file mode 100644
index 00000000000..36992055470
--- /dev/null
+++ b/.changelog/33095.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_securityhub_account: Remove default value (`SECURITY_CONTROL`) for `control_finding_generator` argument and mark as Computed
+```
\ No newline at end of file
diff --git a/.changelog/33097.txt b/.changelog/33097.txt
new file mode 100644
index 00000000000..bbbee8e6eb9
--- /dev/null
+++ b/.changelog/33097.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_lambda_layer_version: Change `source_code_hash` back to [ForceNew](https://developer.hashicorp.com/terraform/plugin/sdkv2/schemas/schema-behaviors#forcenew). This fixes `doesn't support update` errors
+```
\ No newline at end of file
diff --git a/.changelog/33101.txt b/.changelog/33101.txt
new file mode 100644
index 00000000000..c843b9c47a7
--- /dev/null
+++ b/.changelog/33101.txt
@@ -0,0 +1,7 @@
+```release-note:enhancement
+resource/aws_kinesis_firehose_delivery_stream: Add `opensearchserverless` as a valid `destination` value
+```
+
+```release-note:enhancement
+resource/aws_kinesis_firehose_delivery_stream: Add `opensearchserverless_configuration` and `msk_source_configuration` configuration blocks
+```
diff --git a/.changelog/33103.txt b/.changelog/33103.txt
new file mode 100644
index 00000000000..2751c2bfb92
--- /dev/null
+++ b/.changelog/33103.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_route53_zone: Skip disabling DNS SEC in unsupported partitions
+```
diff --git a/.changelog/33118.txt b/.changelog/33118.txt
new file mode 100644
index 00000000000..253379990a6
--- /dev/null
+++ b/.changelog/33118.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_msk_cluster_policy: Fix `Current cluster policy version needed for Update` errors
+```
diff --git a/.changelog/33120.txt b/.changelog/33120.txt
new file mode 100644
index 00000000000..229dedee4d3
--- /dev/null
+++ b/.changelog/33120.txt
@@ -0,0 +1,9 @@
+```release-note:bug
+resource/aws_quicksight_analysis: Change `definition.*.parameter_declarations` to a set type, preventing persistent differences
+```
+```release-note:bug
+resource/aws_quicksight_dashboard: Change `definition.*.parameter_declarations` to a set type, preventing persistent differences
+```
+```release-note:bug
+resource/aws_quicksight_template: Change `definition.*.parameter_declarations` to a set type, preventing persistent differences
+```
diff --git a/.changelog/33121.txt b/.changelog/33121.txt
new file mode 100644
index 00000000000..352d34430f9
--- /dev/null
+++ b/.changelog/33121.txt
@@ -0,0 +1,23 @@
+```release-note:enhancement
+resource/aws_ssoadmin_account_assignment: Add configurable timeouts
+```
+
+```release-note:enhancement
+resource/aws_ssoadmin_customer_managed_policy_attachment: Add configurable timeouts
+```
+
+```release-note:enhancement
+resource/aws_ssoadmin_managed_policy_attachment: Add configurable timeouts
+```
+
+```release-note:enhancement
+resource/aws_ssoadmin_permission_set_inline_policy: Add configurable timeouts
+```
+
+```release-note:enhancement
+resource/aws_ssoadmin_permissions_boundary_attachment: Add configurable timeouts
+```
+
+```release-note:enhancement
+resource/aws_ssoadmin_permission_set: Add configurable timeouts
+```
\ No newline at end of file
diff --git a/.changelog/33122.txt b/.changelog/33122.txt
new file mode 100644
index 00000000000..5039cbd31ba
--- /dev/null
+++ b/.changelog/33122.txt
@@ -0,0 +1,11 @@
+```release-note:bug
+resource/aws_quicksight_analysis: Fixed a bug that caused errors related to the `word_orientation` argument when using word cloud visuals.
+```
+
+```release-note:bug
+resource/aws_quicksight_dashboard: Fixed a bug that caused errors related to the `word_orientation` argument when using word cloud visuals.
+```
+
+```release-note:bug
+resource/aws_quicksight_template: Fixed a bug that caused errors related to the `word_orientation` argument when using word cloud visuals.
+```
\ No newline at end of file
diff --git a/.changelog/33123.txt b/.changelog/33123.txt
new file mode 100644
index 00000000000..f882fa8e054
--- /dev/null
+++ b/.changelog/33123.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_finspace_kx_environment: Add `transit_gateway_configuration.*.attachment_network_acl_configuration` argument.
+```
diff --git a/.changelog/33129.txt b/.changelog/33129.txt
new file mode 100644
index 00000000000..d4c7e62ce30
--- /dev/null
+++ b/.changelog/33129.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_medialive_channel: Implement expand/flatten functions for `automatic_input_failover_settings` in `input_attachments`
+```
diff --git a/.changelog/33138.txt b/.changelog/33138.txt
new file mode 100644
index 00000000000..61265f41170
--- /dev/null
+++ b/.changelog/33138.txt
@@ -0,0 +1,7 @@
+```release-note:bug
+resource/aws_s3_object: Mark `acl` as Computed. This suppresses the diffs shown when migrating resources with no configured `acl` attribute value from v4.67.0 (or earlier)
+```
+
+```release-note:bug
+resource/aws_s3_object_copy: Mark `acl` as Computed. This suppresses the diffs shown when migrating resources with no configured `acl` attribute value from v4.67.0 (or earlier)
+```
\ No newline at end of file
diff --git a/.changelog/33142.txt b/.changelog/33142.txt
new file mode 100644
index 00000000000..0b146e0c8b7
--- /dev/null
+++ b/.changelog/33142.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_ec2_host: Fixed a bug that caused resource recreation when specifying an `outpost_arn` without an `asset_id`
+```
diff --git a/.changelog/33158.txt b/.changelog/33158.txt
new file mode 100644
index 00000000000..9f28c19ed91
--- /dev/null
+++ b/.changelog/33158.txt
@@ -0,0 +1,11 @@
+```release-note:enhancement
+resource/aws_dms_replication_instance: Add `network_type` argument
+```
+
+```release-note:enhancement
+data-source/aws_dms_replication_instance: Add `network_type` attribute
+```
+
+```release-note:enhancement
+data-source/aws_dms_endpoint: Fix crash when specified endpoint not found
+```
\ No newline at end of file
diff --git a/.changelog/33161.txt b/.changelog/33161.txt
new file mode 100644
index 00000000000..212a9498e9a
--- /dev/null
+++ b/.changelog/33161.txt
@@ -0,0 +1,9 @@
+```release-note:bug
+resource/aws_quicksight_analysis: Skip setting `definition.*.parameter_declarations.*.*_parameter_declaration.static_values` when empty, preventing persistent differences.
+```
+```release-note:bug
+resource/aws_quicksight_dashboard: Skip setting `definition.*.parameter_declarations.*.*_parameter_declaration.static_values` when empty, preventing persistent differences.
+```
+```release-note:bug
+resource/aws_quicksight_template: Skip setting `definition.*.parameter_declarations.*.*_parameter_declaration.static_values` when empty, preventing persistent differences.
+```
diff --git a/.changelog/33167.txt b/.changelog/33167.txt
new file mode 100644
index 00000000000..e8cac68e115
--- /dev/null
+++ b/.changelog/33167.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_kms_key: Fix `tag propagation: timeout while waiting for state to become 'TRUE'` errors when [`ignore_tags`](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#ignore_tags) has been configured
+```
\ No newline at end of file
diff --git a/.changelog/33168.txt b/.changelog/33168.txt
new file mode 100644
index 00000000000..c87b865d503
--- /dev/null
+++ b/.changelog/33168.txt
@@ -0,0 +1,19 @@
+```release-note:bug
+resource/aws_ec2_network_insights_analysis: Fix `setting forward_path_components: Invalid address to set` errors
+```
+
+```release-note:enhancement
+resource/aws_ec2_network_insights_path: Add `destination_arn` and `source_arn` attributes
+```
+
+```release-note:enhancement
+data-source/aws_ec2_network_insights_path: Add `destination_arn` and `source_arn` attributes
+```
+
+```release-note:bug
+resource/aws_ec2_network_insights_path: Avoid recreating resource when passing an ARN as `source` or `destination`
+```
+
+```release-note:bug
+resource/aws_ec2_network_insights_path: Retry `AnalysisExistsForNetworkInsightsPath` errors on resource Delete
+```
\ No newline at end of file
diff --git a/.changelog/33189.txt b/.changelog/33189.txt
new file mode 100644
index 00000000000..e3e565b1a64
--- /dev/null
+++ b/.changelog/33189.txt
@@ -0,0 +1,7 @@
+```release-note:enhancement
+resource/aws_lakeformation_data_lake_settings: Add `read_only_admins` argument
+```
+
+```release-note:enhancement
+data-source/aws_lakeformation_data_lake_settings: Add `read_only_admins` attribute
+```
diff --git a/.changelog/33192.txt b/.changelog/33192.txt
new file mode 100644
index 00000000000..994a760da2c
--- /dev/null
+++ b/.changelog/33192.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_appflow_connector_profile: Fix validation on `oauth2` in `custom_connector_profile`
+```
diff --git a/.changelog/33195.txt b/.changelog/33195.txt
new file mode 100644
index 00000000000..09fecf08d9c
--- /dev/null
+++ b/.changelog/33195.txt
@@ -0,0 +1,3 @@
+```release-note:new-resource
+aws_verifiedaccess_trust_provider
+```
\ No newline at end of file
diff --git a/.changelog/33203.txt b/.changelog/33203.txt
new file mode 100644
index 00000000000..7e537b6c9c3
--- /dev/null
+++ b/.changelog/33203.txt
@@ -0,0 +1,7 @@
+```release-note:bug
+resource/aws_iot_thing_type: Fix error during plan when resource is manually deleted
+```
+
+```release-note:bug
+resource/aws_cloudwatch_event_bus_policy: Fix error during plan when the associated aws_cloudwatch_event_bus resource is manually deleted
+```
diff --git a/.changelog/33206.txt b/.changelog/33206.txt
new file mode 100644
index 00000000000..ba74cca6f90
--- /dev/null
+++ b/.changelog/33206.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_wafv2_rule_group: Add `name_prefix` argument
+```
diff --git a/.changelog/33216.txt b/.changelog/33216.txt
new file mode 100644
index 00000000000..91640fd7d4d
--- /dev/null
+++ b/.changelog/33216.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_wafv2_web_acl: Prevent deletion of the AWS-managed `ShieldMitigationRuleGroup` rule on resource Update
+```
\ No newline at end of file
diff --git a/.changelog/33217.txt b/.changelog/33217.txt
new file mode 100644
index 00000000000..68139f2afd3
--- /dev/null
+++ b/.changelog/33217.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_wafv2_web_acl: Add `statement.managed_rule_group_statement.managed_rule_group_configs.aws_managed_rules_atp_rule_set.enable_regex_in_path` argument
+```
\ No newline at end of file
diff --git a/.changelog/33220.txt b/.changelog/33220.txt
new file mode 100644
index 00000000000..3205d95145c
--- /dev/null
+++ b/.changelog/33220.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_codeartifact_domain: Change the type of asset_size_bytes to `TypeString` instead of `TypeInt` to prevent `value out of range` panic
+```
\ No newline at end of file
diff --git a/.changelog/33225.txt b/.changelog/33225.txt
new file mode 100644
index 00000000000..7fad6bec0cf
--- /dev/null
+++ b/.changelog/33225.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_datasync_location_fsx_openzfs_file_system: Fix `setting protocol: Invalid address to set` errors
+```
\ No newline at end of file
diff --git a/.changelog/33226.txt b/.changelog/33226.txt
new file mode 100644
index 00000000000..76c85698b8a
--- /dev/null
+++ b/.changelog/33226.txt
@@ -0,0 +1,7 @@
+```release-note:bug
+resource/aws_kms_key: Fix `tag propagation: timeout while waiting for state to become 'TRUE'` errors when any tag value is empty (`""`)
+```
+
+```release-note:bug
+provider: Correctly use old and new tag values when updating `tags` that are `computed`
+```
\ No newline at end of file
diff --git a/.changelog/33227.txt b/.changelog/33227.txt
new file mode 100644
index 00000000000..e46d348e946
--- /dev/null
+++ b/.changelog/33227.txt
@@ -0,0 +1,7 @@
+```release-note:new-resource
+aws_opensearch_package
+```
+
+```release-note:new-resource
+aws_opensearch_package_association
+```
diff --git a/.changelog/33243.txt b/.changelog/33243.txt
new file mode 100644
index 00000000000..83a18af2e8b
--- /dev/null
+++ b/.changelog/33243.txt
@@ -0,0 +1,7 @@
+```release-note:enhancement
+resource/aws_efs_file_system: Add `name` attribute
+```
+
+```release-note:enhancement
+data-source/aws_efs_file_system: Add `name` attribute
+```
\ No newline at end of file
diff --git a/.changelog/33245.txt b/.changelog/33245.txt
new file mode 100644
index 00000000000..09c04a33933
--- /dev/null
+++ b/.changelog/33245.txt
@@ -0,0 +1,7 @@
+```release-note:enhancement
+resource/aws_fsx_openzfs_file_system: Add `endpoint_ip_address_range`, `preferred_subnet_id` and `route_table_ids` arguments to support the [Multi-AZ deployment type](https://docs.aws.amazon.com/fsx/latest/OpenZFSGuide/availability-durability.html#choosing-single-or-multi)
+```
+
+```release-note:bug
+resource/aws_fsx_openzfs_file_system: Wait for administrative action completion when updating root volume
+```
\ No newline at end of file
diff --git a/.changelog/33263.txt b/.changelog/33263.txt
new file mode 100644
index 00000000000..d80cb7627e6
--- /dev/null
+++ b/.changelog/33263.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_fsx_ontap_file_system: Increase maximum value of `disk_iops_configuration.iops` to `160000`
+```
\ No newline at end of file
diff --git a/.changelog/33274.txt b/.changelog/33274.txt
new file mode 100644
index 00000000000..c67d425f200
--- /dev/null
+++ b/.changelog/33274.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_glue_catalog_table: Add `open_table_format_input` configuration block to support open table formats such as [Apache Iceberg](https://iceberg.apache.org/)
+```
\ No newline at end of file
diff --git a/.changelog/33279.txt b/.changelog/33279.txt
new file mode 100644
index 00000000000..0e5b9e8ac88
--- /dev/null
+++ b/.changelog/33279.txt
@@ -0,0 +1,7 @@
+```release-note:enhancement
+resource/aws_api_gateway_account: Add `api_key_version` and `features` attributes
+```
+
+```release-note:bug
+resource/aws_api_gateway_account: Allow setting `cloudwatch_role_arn` to an empty value and set it correctly on Read, allowing its value to be determined on import
+```
\ No newline at end of file
diff --git a/.changelog/33281.txt b/.changelog/33281.txt
new file mode 100644
index 00000000000..16a7ca5e3dd
--- /dev/null
+++ b/.changelog/33281.txt
@@ -0,0 +1,11 @@
+```release-note:enhancement
+resource/aws_api_gateway_api_key: Add `customer_id` argument
+```
+
+```release-note:enhancement
+resource/aws_api_gateway_api_key: Allow updating `name`
+```
+
+```release-note:enhancement
+data-source/aws_api_gateway_api_key: Add `customer_id` attribute
+```
\ No newline at end of file
diff --git a/.changelog/33285.txt b/.changelog/33285.txt
new file mode 100644
index 00000000000..2320fd04668
--- /dev/null
+++ b/.changelog/33285.txt
@@ -0,0 +1,3 @@
+```release-note:new-resource
+aws_rds_custom_db_engine_version
+```
diff --git a/.changelog/33297.txt b/.changelog/33297.txt
new file mode 100644
index 00000000000..708e1c260d8
--- /dev/null
+++ b/.changelog/33297.txt
@@ -0,0 +1,3 @@
+```release-note:new-resource
+aws_verifiedaccess_group
+```
diff --git a/.changelog/33303.txt b/.changelog/33303.txt
new file mode 100644
index 00000000000..6def8d61cab
--- /dev/null
+++ b/.changelog/33303.txt
@@ -0,0 +1,7 @@
+```release-note:enhancement
+resource/aws_fsx_windows_file_system: Add `disk_iops_configuration` configuration block
+```
+
+```release-note:enhancement
+data-source/aws_fsx_windows_file_system: Add `disk_iops_configuration` attribute
+```
\ No newline at end of file
diff --git a/.changelog/33304.txt b/.changelog/33304.txt
new file mode 100644
index 00000000000..427c147d3d9
--- /dev/null
+++ b/.changelog/33304.txt
@@ -0,0 +1,11 @@
+```release-note:enhancement
+data-source/aws_s3_objects: Add `request_payer` argument and `request_charged` attribute
+```
+
+```release-note:enhancement
+data-source/aws_s3_objects: Add plan-time validation of `encoding_type`
+```
+
+```release-note:bug
+data-source/aws_s3_objects: Respect configured `max_keys` value if it's greater than `1000`
+```
\ No newline at end of file
diff --git a/.changelog/33310.txt b/.changelog/33310.txt
new file mode 100644
index 00000000000..9f86339e308
--- /dev/null
+++ b/.changelog/33310.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_autoscaling_group: Add `scale_in_protected_instances` and `standby_instances` attributes to `instance_refresh.preferences` configuration block
+```
\ No newline at end of file
diff --git a/.changelog/33311.txt b/.changelog/33311.txt
new file mode 100644
index 00000000000..5cb9afcd5cd
--- /dev/null
+++ b/.changelog/33311.txt
@@ -0,0 +1,7 @@
+```release-note:bug
+data-source/aws_identitystore_group: Restore `filter` argument to prevent `UnknownOperationException` errors in certain Regions
+```
+
+```release-note:bug
+data-source/aws_identitystore_user: Restore `filter` argument to prevent `UnknownOperationException` errors in certain Regions
+```
\ No newline at end of file
diff --git a/.changelog/33316.txt b/.changelog/33316.txt
new file mode 100644
index 00000000000..d2d5538ff79
--- /dev/null
+++ b/.changelog/33316.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_dms_endpoint: Add `redshift-serverless` as valid value for `engine_name`
+```
diff --git a/.changelog/33317.txt b/.changelog/33317.txt
new file mode 100644
index 00000000000..58a9ef2ed22
--- /dev/null
+++ b/.changelog/33317.txt
@@ -0,0 +1,3 @@
+```release-note:note
+provider: Performance regression introduced in v5.14.0 should be largely mitigated
+```
\ No newline at end of file
diff --git a/.changelog/33328.txt b/.changelog/33328.txt
new file mode 100644
index 00000000000..edb5974d7bf
--- /dev/null
+++ b/.changelog/33328.txt
@@ -0,0 +1,7 @@
+```release-note:new-resource
+aws_shield_drt_access_log_bucket_association
+```
+
+```release-note:new-resource
+aws_shield_drt_access_role_arn_association
+```
diff --git a/.changelog/33336.txt b/.changelog/33336.txt
new file mode 100644
index 00000000000..a7e4424ac20
--- /dev/null
+++ b/.changelog/33336.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+data-source/aws_efs_file_system: Fix `Search returned 0 results` errors when there are more than 101 file systems in the configured Region
+```
\ No newline at end of file
diff --git a/.changelog/33348.txt b/.changelog/33348.txt
new file mode 100644
index 00000000000..90802ae4c6b
--- /dev/null
+++ b/.changelog/33348.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_inspector2_enabler: Fix `Value at 'resourceTypes' failed to satisfy constraint` errors
+```
diff --git a/.changelog/33358.txt b/.changelog/33358.txt
new file mode 100644
index 00000000000..1aad7087d09
--- /dev/null
+++ b/.changelog/33358.txt
@@ -0,0 +1,15 @@
+```release-note:enhancement
+resource/aws_s3_object: Add `checksum_algorithm` argument and `checksum_crc32`, `checksum_crc32c`, `checksum_sha1` and `checksum_sha256` attributes
+```
+
+```release-note:enhancement
+resource/aws_s3_object_copy: Add `checksum_algorithm` argument and `checksum_crc32`, `checksum_crc32c`, `checksum_sha1` and `checksum_sha256` attributes
+```
+
+```release-note:enhancement
+data-source/aws_s3_object: Add `checksum_mode` argument and `checksum_crc32`, `checksum_crc32c`, `checksum_sha1` and `checksum_sha256` attributes
+```
+
+```release-note:note
+data-source/aws_s3_object: Migration to [AWS SDK for Go v2](https://aws.github.io/aws-sdk-go-v2/) means that the edge case of specifying a single `/` as the value for `key` is no longer supported
+```
\ No newline at end of file
diff --git a/.changelog/33360.txt b/.changelog/33360.txt
new file mode 100644
index 00000000000..8e98cea8d93
--- /dev/null
+++ b/.changelog/33360.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_iot_topic_rule: Fix `InvalidParameter` errors on Update with Kafka destinations
+```
diff --git a/.changelog/33369.txt b/.changelog/33369.txt
new file mode 100644
index 00000000000..1cac72e209c
--- /dev/null
+++ b/.changelog/33369.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_db_instance_automated_backups_replication: Fix `unexpected state` errors on resource Create
+```
diff --git a/.changelog/33371.txt b/.changelog/33371.txt
new file mode 100644
index 00000000000..70fcdf37b85
--- /dev/null
+++ b/.changelog/33371.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_service_discovery_instance: Fix validation error "expected to match regular expression"
+```
\ No newline at end of file
diff --git a/.changelog/33374.txt b/.changelog/33374.txt
new file mode 100644
index 00000000000..57cf99a6271
--- /dev/null
+++ b/.changelog/33374.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_glue_catalog_table: Fix removal of `metadata_location` and `table_type` `parameters` when updating Iceberg tables
+```
\ No newline at end of file
diff --git a/.changelog/33375.txt b/.changelog/33375.txt
new file mode 100644
index 00000000000..00277df2952
--- /dev/null
+++ b/.changelog/33375.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_subnet: Fix destroy error when there is a lingering ENI for DMS
+```
\ No newline at end of file
diff --git a/.changelog/33382.txt b/.changelog/33382.txt
new file mode 100644
index 00000000000..7d68633f217
--- /dev/null
+++ b/.changelog/33382.txt
@@ -0,0 +1,7 @@
+```release-note:bug
+resource/aws_autoscaling_group: Fix `ValidationError` errors when starting Auto Scaling group instance refresh
+```
+
+```release-note:enhancement
+resource/aws_autoscaling_group: Change the default values of `instance_refresh.preferences.scale_in_protected_instances` and `instance_refresh.preferences.standby_instances` from `Wait` to the [Amazon EC2 Auto Scaling console recommended value](https://docs.aws.amazon.com/autoscaling/ec2/userguide/understand-instance-refresh-default-values.html) of `Ignore`
+```
\ No newline at end of file
diff --git a/.changelog/33388.txt b/.changelog/33388.txt
new file mode 100644
index 00000000000..b23faba2a6c
--- /dev/null
+++ b/.changelog/33388.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_s3control_object_lambda_access_point: Add `alias` attribute
+```
\ No newline at end of file
diff --git a/.changelog/33405.txt b/.changelog/33405.txt
new file mode 100644
index 00000000000..cbec46ab336
--- /dev/null
+++ b/.changelog/33405.txt
@@ -0,0 +1,39 @@
+```release-note:bug
+resource/aws_lightsail_certificate: Fix validation of `name`
+```
+
+```release-note:bug
+resource/aws_lightsail_database: Fix validation of `name`
+```
+
+```release-note:bug
+resource/aws_lightsail_disk: Fix validation of `name`
+```
+
+```release-note:bug
+resource/aws_lightsail_instance: Fix validation of `name`
+```
+
+```release-note:bug
+resource/aws_lightsail_lb: Fix validation of `lb_name`
+```
+
+```release-note:bug
+resource/aws_lightsail_lb_attachment: Fix validation of `lb_name`
+```
+
+```release-note:bug
+resource/aws_lightsail_lb_certificate: Fix validation of `lb_name`
+```
+
+```release-note:bug
+resource/aws_lightsail_lb_certificate_attachment: Fix validation of `lb_name`
+```
+
+```release-note:bug
+resource/aws_lightsail_lb_https_redirection_policy: Fix validation of `lb_name`
+```
+
+```release-note:bug
+resource/aws_lightsail_lb_stickiness_policy: Fix validation of `lb_name`
+```
diff --git a/.changelog/33408.txt b/.changelog/33408.txt
new file mode 100644
index 00000000000..78dde230d5b
--- /dev/null
+++ b/.changelog/33408.txt
@@ -0,0 +1,3 @@
+```release-note:new-data-source
+aws_organizations_organizational_unit
+```
diff --git a/.changelog/33413.txt b/.changelog/33413.txt
new file mode 100644
index 00000000000..663341ced46
--- /dev/null
+++ b/.changelog/33413.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_neptune_cluster: Fix ignored `kms_key_arn` on restore from DB cluster snapshot
+```
\ No newline at end of file
diff --git a/.changelog/33416.txt b/.changelog/33416.txt
new file mode 100644
index 00000000000..71f1faf437d
--- /dev/null
+++ b/.changelog/33416.txt
@@ -0,0 +1,11 @@
+```release-note:enhancement
+resource/aws_s3control_multi_region_access_point: Add `details.region.bucket_account_id` argument to support [cross-account Multi-Region Access Points](https://docs.aws.amazon.com/AmazonS3/latest/userguide/multi-region-access-point-buckets.html)
+```
+
+```release-note:enhancement
+resource/aws_s3control_multi_region_access_point: Add `details.region.region` attribute
+```
+
+```release-note:enhancement
+data-source/aws_s3control_multi_region_access_point: Add `details.region.bucket_account_id` attribute
+```
\ No newline at end of file
diff --git a/.changelog/33432.txt b/.changelog/33432.txt
new file mode 100644
index 00000000000..ef6d427aba8
--- /dev/null
+++ b/.changelog/33432.txt
@@ -0,0 +1,7 @@
+```release-note:new-resource
+aws_shield_application_layer_automatic_response
+```
+
+```release-note:enhancement
+resource/aws_wafv2_web_acl: Retry resource Update on `WAFOptimisticLockException` errors
+```
\ No newline at end of file
diff --git a/.changelog/33442.txt b/.changelog/33442.txt
new file mode 100644
index 00000000000..abca4bb2645
--- /dev/null
+++ b/.changelog/33442.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_schemas_schema: Add `JSONSchemaDraft4` schema type support
+```
diff --git a/.changelog/33448.txt b/.changelog/33448.txt
new file mode 100644
index 00000000000..c2891ab99d9
--- /dev/null
+++ b/.changelog/33448.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_servicecatalog_product: Allow import on `provisioning_artifact_parameters` attribute
+```
\ No newline at end of file
diff --git a/.changelog/33451.txt b/.changelog/33451.txt
new file mode 100644
index 00000000000..b7077973abc
--- /dev/null
+++ b/.changelog/33451.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_elasticache_cluster: Fix regression for `redis` engine types caused by the new `transit_encryption_enabled` argument
+```
diff --git a/.changelog/33456.txt b/.changelog/33456.txt
new file mode 100644
index 00000000000..0414c4ff9c6
--- /dev/null
+++ b/.changelog/33456.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_dms_replication_task: Fix error when `replication_task_settings` is `nil`
+```
\ No newline at end of file
diff --git a/.changelog/33459.txt b/.changelog/33459.txt
new file mode 100644
index 00000000000..6368cb02a3e
--- /dev/null
+++ b/.changelog/33459.txt
@@ -0,0 +1,3 @@
+```release-note:new-resource
+aws_verifiedaccess_instance
+```
\ No newline at end of file
diff --git a/.changelog/33466.txt b/.changelog/33466.txt
new file mode 100644
index 00000000000..af3005b7582
--- /dev/null
+++ b/.changelog/33466.txt
@@ -0,0 +1,7 @@
+```release-note:enhancement
+resource/aws_fsx_ontap_storage_virtual_machine: Remove [ForceNew](https://developer.hashicorp.com/terraform/plugin/sdkv2/schemas/schema-behaviors#forcenew) from `active_directory_configuration.self_managed_active_directory_configuration.domain_name`, `active_directory_configuration.self_managed_active_directory_configuration.file_system_administrators_group` and `active_directory_configuration.self_managed_active_directory_configuration.organizational_unit_distinguished_name` allowing an SVM to join AD after creation
+```
+
+```release-note:bug
+resource/aws_fsx_ontap_storage_virtual_machine: Avoid recreating resource when `active_directory_configuration.self_managed_active_directory_configuration.file_system_administrators_group` is configured
+```
\ No newline at end of file
diff --git a/.changelog/33475.txt b/.changelog/33475.txt
new file mode 100644
index 00000000000..e2ddae20a41
--- /dev/null
+++ b/.changelog/33475.txt
@@ -0,0 +1,3 @@
+```release-note:new-resource
+aws_lexv2models_bot
+```
\ No newline at end of file
diff --git a/.changelog/33477.txt b/.changelog/33477.txt
new file mode 100644
index 00000000000..1b29bf63fe9
--- /dev/null
+++ b/.changelog/33477.txt
@@ -0,0 +1,6 @@
+```release-note:bug
+resource/aws_sesv2_email_identity: Mark `dkim_signing_attributes.domain_signing_private_key` as sensitive
+```
+```release-note:bug
+data-source/aws_sesv2_email_identity: Mark `dkim_signing_attributes.domain_signing_private_key` as sensitive
+```
diff --git a/.changelog/33487.txt b/.changelog/33487.txt
new file mode 100644
index 00000000000..98b4b71ac67
--- /dev/null
+++ b/.changelog/33487.txt
@@ -0,0 +1,7 @@
+```release-note:bug
+resource/aws_neptune_cluster_instance: Remove [ForceNew](https://developer.hashicorp.com/terraform/plugin/sdkv2/schemas/schema-behaviors#forcenew) from `engine_version`
+```
+
+```release-note:bug
+resource/aws_neptune_cluster_parameter_group: Fix condition where defined cluster parameters with system default values are seen as updates
+```
diff --git a/.changelog/33511.txt b/.changelog/33511.txt
new file mode 100644
index 00000000000..8913bd9bb53
--- /dev/null
+++ b/.changelog/33511.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_db_option_group: Avoid erroneous differences being reported when an `option` `port` and/or `version` is not set
+```
\ No newline at end of file
diff --git a/.changelog/33529.txt b/.changelog/33529.txt
new file mode 100644
index 00000000000..8b384b10328
--- /dev/null
+++ b/.changelog/33529.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_db_instance: Fix so that `storage_throughput` can be changed when `iops` and `allocated_storage` are not changed
+```
\ No newline at end of file
diff --git a/.changelog/33531.txt b/.changelog/33531.txt
new file mode 100644
index 00000000000..1a2220e42b0
--- /dev/null
+++ b/.changelog/33531.txt
@@ -0,0 +1,11 @@
+```release-note:bug
+resource/aws_s3_bucket_policy: Retry resource Delete on `OperationAborted: A conflicting conditional operation is currently in progress against this resource` errors
+```
+
+```release-note:bug
+resource/aws_s3_bucket_versioning: Retry resource Delete on `OperationAborted: A conflicting conditional operation is currently in progress against this resource` errors
+```
+
+```release-note:bug
+resource/aws_s3_bucket_accelerate_configuration: Retry resource Delete on `OperationAborted: A conflicting conditional operation is currently in progress against this resource` errors
+```
\ No newline at end of file
diff --git a/.changelog/33537.txt b/.changelog/33537.txt
new file mode 100644
index 00000000000..39ec840fa83
--- /dev/null
+++ b/.changelog/33537.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_s3_bucket_policy: Fix intermittent `couldn't find resource` errors on resource Create
+```
\ No newline at end of file
diff --git a/.changelog/33558.txt b/.changelog/33558.txt
new file mode 100644
index 00000000000..acd04b96d83
--- /dev/null
+++ b/.changelog/33558.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_medialive_channel: Fix VPC settings flatten/expand/docs.
+```
diff --git a/.changelog/33570.txt b/.changelog/33570.txt
new file mode 100644
index 00000000000..1a44fa1d8de
--- /dev/null
+++ b/.changelog/33570.txt
@@ -0,0 +1,38 @@
+```release-note:note
+resource/aws_iam_*: This release introduces additional validation of IAM policy JSON arguments to detect duplicate keys. Previously, arguments with duplicated keys resulted in all but one of the key values being overwritten. Since this results in unexpected IAM policies being submitted to AWS, we have updated the validation logic to error in these cases. This may cause existing IAM policy arguments to fail validation, however, those policies are likely not what was originally intended.
+```
+
+```release-note:bug
+resource/aws_glacier_vault_lock: Fail validation if duplicated keys are found in `policy`
+```
+
+```release-note:bug
+resource/aws_iam_role: Fail validation if duplicated keys are found in `assume_role_policy`
+```
+```release-note:bug
+resource/aws_iam_policy: Fail validation if duplicated keys are found in `policy`
+```
+```release-note:bug
+resource/aws_iam_group_policy: Fail validation if duplicated keys are found in `policy`
+```
+```release-note:bug
+resource/aws_iam_user_policy: Fail validation if duplicated keys are found in `policy`
+```
+```release-note:bug
+resource/aws_iam_role_policy: Fail validation if duplicated keys are found in `policy`
+```
+
+```release-note:bug
+resource/aws_mediastore_container_policy: Fail validation if duplicated keys are found in `policy`
+```
+
+```release-note:bug
+resource/aws_ssoadmin_permission_set_inline_policy: Fail validation if duplicated keys are found in `inline_policy`
+```
+
+```release-note:bug
+resource/aws_transfer_access: Fail validation if duplicated keys are found in `policy`
+```
+```release-note:bug
+resource/aws_transfer_user: Fail validation if duplicated keys are found in `policy`
+```
diff --git a/.changelog/33577.txt b/.changelog/33577.txt
new file mode 100644
index 00000000000..cfa7d0bff6e
--- /dev/null
+++ b/.changelog/33577.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_batch_job_queue: Correctly validates elements of `compute_environments` as ARNs
+```
diff --git a/.changelog/33578.txt b/.changelog/33578.txt
new file mode 100644
index 00000000000..9f42ab17bec
--- /dev/null
+++ b/.changelog/33578.txt
@@ -0,0 +1,15 @@
+```release-note:bug
+resource/aws_cloudfront_distribution: Fix `IllegalUpdate` errors when updating a staging distribution associated with an `aws_cloudfront_continuous_deployment_policy`
+```
+
+```release-note:bug
+resource/aws_cloudfront_continuous_deployment_policy: Fix `IllegalUpdate` errors when updating a staging `aws_cloudfront_distribution` that is part of continuous deployment
+```
+
+```release-note:bug
+resource/aws_cloudfront_distribution: Fix `StagingDistributionInUse` errors when destroying a distribution associated with an `aws_cloudfront_continuous_deployment_policy`
+```
+
+```release-note:bug
+resource/aws_cloudfront_distribution: Fix `PreconditionFailed` errors when destroying a distribution associated with an `aws_cloudfront_continuous_deployment_policy`
+```
\ No newline at end of file
diff --git a/.changelog/33586.txt b/.changelog/33586.txt
new file mode 100644
index 00000000000..1fc696c0aaf
--- /dev/null
+++ b/.changelog/33586.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_lightsail_bucket: Add `force_delete` argument
+```
\ No newline at end of file
diff --git a/.changelog/33594.txt b/.changelog/33594.txt
new file mode 100644
index 00000000000..9c562be21c6
--- /dev/null
+++ b/.changelog/33594.txt
@@ -0,0 +1,7 @@
+```release-note:enhancement
+resource/aws_wafv2_web_acl: Add `rate_based_statement.custom_key` configuration block
+```
+
+```release-note:enhancement
+resource/aws_wafv2_rule_group: Add `rate_based_statement.custom_key` configuration block
+```
\ No newline at end of file
diff --git a/.changelog/33602.txt b/.changelog/33602.txt
new file mode 100644
index 00000000000..18baf949be9
--- /dev/null
+++ b/.changelog/33602.txt
@@ -0,0 +1,3 @@
+```release-note:new-resource
+aws_cleanrooms_configured_table
+```
\ No newline at end of file
diff --git a/.changelog/33630.txt b/.changelog/33630.txt
new file mode 100644
index 00000000000..2f9af376175
--- /dev/null
+++ b/.changelog/33630.txt
@@ -0,0 +1,3 @@
+```release-note:note
+documentation: Duplicate CDKTF guides with differing file extensions have been removed to resolve failures in the provider release workflow.
+```
diff --git a/.changelog/33641.txt b/.changelog/33641.txt
new file mode 100644
index 00000000000..ae2973973ae
--- /dev/null
+++ b/.changelog/33641.txt
@@ -0,0 +1,4 @@
+
+```release-note:bug
+resource/aws_datasync_location_fsx_ontap_file_system: Correct handling of `protocol.smb.domain`, `protocol.smb.user` and `protocol.smb.password`
+```
\ No newline at end of file
diff --git a/.changelog/33660.txt b/.changelog/33660.txt
new file mode 100644
index 00000000000..5b9afbf72a2
--- /dev/null
+++ b/.changelog/33660.txt
@@ -0,0 +1,15 @@
+```release-note:breaking-change
+data-source/aws_s3_object: Following migration to [AWS SDK for Go v2](https://aws.github.io/aws-sdk-go-v2/), the `metadata` attribute's [keys](https://developer.hashicorp.com/terraform/language/expressions/types#maps-objects) are always [returned in lowercase](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/service/s3#HeadObjectOutput)
+```
+
+```release-note:note
+data-source/aws_s3_object: The `metadata` attribute's keys are now always returned in lowercase. Please modify configurations as necessary
+```
+
+```release-note:breaking-change
+data-source/aws_s3_bucket_object: Following migration to [AWS SDK for Go v2](https://aws.github.io/aws-sdk-go-v2/), the `metadata` attribute's [keys](https://developer.hashicorp.com/terraform/language/expressions/types#maps-objects) are always [returned in lowercase](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/service/s3#HeadObjectOutput)
+```
+
+```release-note:note
+data-source/aws_s3_bucket_object: The `metadata` attribute's keys are now always returned in lowercase. Please modify configurations as necessary
+```
\ No newline at end of file
diff --git a/.changelog/33662.txt b/.changelog/33662.txt
new file mode 100644
index 00000000000..4854a3c349d
--- /dev/null
+++ b/.changelog/33662.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_cloud9_environment_ec2: Add `ubuntu-22.04-x86_64` and `resolve:ssm:/aws/service/cloud9/amis/ubuntu-22.04-x86_64` as valid values for `image_id`
+```
\ No newline at end of file
diff --git a/.changelog/33688.txt b/.changelog/33688.txt
new file mode 100644
index 00000000000..52c83b08de4
--- /dev/null
+++ b/.changelog/33688.txt
@@ -0,0 +1,3 @@
+```release-note:new-resource
+aws_servicequotas_template
+```
diff --git a/.changelog/33699.txt b/.changelog/33699.txt
new file mode 100644
index 00000000000..01bab98ee86
--- /dev/null
+++ b/.changelog/33699.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_db_instance: Creating resource from snapshot or point-in-time recovery now handles `manage_master_user_password` and `master_user_secret_kms_key_id` attributes correctly
+```
diff --git a/.changelog/33704.txt b/.changelog/33704.txt
new file mode 100644
index 00000000000..37d05782fbc
--- /dev/null
+++ b/.changelog/33704.txt
@@ -0,0 +1,6 @@
+```release-note:bug
+resource/aws_db_parameter_group: Group names containing periods (`.`) no longer fail validation
+```
+```release-note:bug
+resource/aws_rds_cluster_parameter_group: Group names containing periods (`.`) no longer fail validation
+```
diff --git a/.changelog/33705.txt b/.changelog/33705.txt
new file mode 100644
index 00000000000..e609ecc53e6
--- /dev/null
+++ b/.changelog/33705.txt
@@ -0,0 +1,3 @@
+```release-note:new-resource
+aws_sesv2_account_vdm_attributes
+```
\ No newline at end of file
diff --git a/.changelog/33712.txt b/.changelog/33712.txt
new file mode 100644
index 00000000000..abc57065e5d
--- /dev/null
+++ b/.changelog/33712.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_networkmanager_core_network: Add `base_policy_document` argument
+```
\ No newline at end of file
diff --git a/.changelog/33725.txt b/.changelog/33725.txt
new file mode 100644
index 00000000000..d1dc5df73b3
--- /dev/null
+++ b/.changelog/33725.txt
@@ -0,0 +1,3 @@
+```release-note:new-resource
+aws_servicequotas_template_association
+```
diff --git a/.changelog/33734.txt b/.changelog/33734.txt
new file mode 100644
index 00000000000..1e598ba314e
--- /dev/null
+++ b/.changelog/33734.txt
@@ -0,0 +1,3 @@
+```release-note:new-resource
+aws_verifiedaccess_instance_trust_provider_attachment
+```
\ No newline at end of file
diff --git a/.changelog/33743.txt b/.changelog/33743.txt
new file mode 100644
index 00000000000..c7840ef6e9a
--- /dev/null
+++ b/.changelog/33743.txt
@@ -0,0 +1,4 @@
+
+```release-note:bug
+resource/aws_vpc_endpoint: Set `dns_options.dns_record_ip_type` to `Computed` to prevent diffs
+```
diff --git a/.changelog/33745.txt b/.changelog/33745.txt
new file mode 100644
index 00000000000..3badadb9500
--- /dev/null
+++ b/.changelog/33745.txt
@@ -0,0 +1,7 @@
+```release-note:enhancement
+resource/aws_finspace_kx_environment: Increase default deletion timeout to 45 minutes
+```
+
+```release-note:enhancement
+resource/aws_finspace_kx_cluster: Increase default creation timeout to 45 minutes, default deletion timeout to 60 minutes
+```
diff --git a/.changelog/33765.txt b/.changelog/33765.txt
new file mode 100644
index 00000000000..dcff4fed113
--- /dev/null
+++ b/.changelog/33765.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_ec2_transit_gateway_route : Fix TGW route search filter to avoid routes being missed when more than 1,000 static routes are in a TGW route table
+```
\ No newline at end of file
diff --git a/.changelog/33778.txt b/.changelog/33778.txt
new file mode 100644
index 00000000000..239035d9cd2
--- /dev/null
+++ b/.changelog/33778.txt
@@ -0,0 +1,11 @@
+```release-note:enhancement
+resource/aws_dms_s3_endpoint: Add `glue_catalog_generation` attribute
+```
+
+```release-note:enhancement
+resource/aws_dms_endpoint: Add `s3_settings.glue_catalog_generation` attribute
+```
+
+```release-note:enhancement
+data-source/aws_dms_endpoint: Add `s3_settings.glue_catalog_generation` attribute
+```
\ No newline at end of file
diff --git a/.changelog/33790.txt b/.changelog/33790.txt
new file mode 100644
index 00000000000..dec831ae4c6
--- /dev/null
+++ b/.changelog/33790.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_docdb_cluster: Add `allow_major_version_upgrade` argument
+```
diff --git a/.changelog/33800.txt b/.changelog/33800.txt
new file mode 100644
index 00000000000..0c7a9685ddd
--- /dev/null
+++ b/.changelog/33800.txt
@@ -0,0 +1,7 @@
+```release-note:bug
+resource/aws_fsx_ontap_storage_virtual_machine: Fix crash when `active_directory_configuration.self_managed_active_directory_configuration.file_system_administrators_group` is not configured
+```
+
+```release-note:bug
+data-source/aws_fsx_ontap_storage_virtual_machine: Fix crash when `active_directory_configuration.self_managed_active_directory_configuration.file_system_administrators_group` is not configured
+```
\ No newline at end of file
diff --git a/.changelog/33802.txt b/.changelog/33802.txt
new file mode 100644
index 00000000000..4013ea25037
--- /dev/null
+++ b/.changelog/33802.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_dynamodb_table: Add `import_table` configuration block
+```
\ No newline at end of file
diff --git a/.changelog/33804.txt b/.changelog/33804.txt
new file mode 100644
index 00000000000..5d2cdfbce61
--- /dev/null
+++ b/.changelog/33804.txt
@@ -0,0 +1,7 @@
+```release-note:enhancement
+resource/aws_vpclattice_target_group: Add `config.lambda_event_structure_version` argument
+```
+
+```release-note:enhancement
+resource/aws_vpclattice_target_group: Make `config.port`, `config.protocol` and `config.vpc_identifier` optional
+```
\ No newline at end of file
diff --git a/.changelog/33805.txt b/.changelog/33805.txt
new file mode 100644
index 00000000000..1b7c042bd60
--- /dev/null
+++ b/.changelog/33805.txt
@@ -0,0 +1,11 @@
+```release-note:enhancement
+resource/aws_msk_cluster: Add `cluster_uuid` attribute
+```
+
+```release-note:enhancement
+data-source/aws_msk_cluster: Add `cluster_uuid` attribute
+```
+
+```release-note:enhancement
+resource/aws_msk_serverless_cluster: Add `cluster_uuid` attribute
+```
\ No newline at end of file
diff --git a/.changelog/33810.txt b/.changelog/33810.txt
new file mode 100644
index 00000000000..b97a03f4e17
--- /dev/null
+++ b/.changelog/33810.txt
@@ -0,0 +1,3 @@
+```release-note:new-resource
+aws_ec2_image_block_public_access
+```
diff --git a/.changelog/33844.txt b/.changelog/33844.txt
new file mode 100644
index 00000000000..d09470a4426
--- /dev/null
+++ b/.changelog/33844.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_codedeploy_deployment_group: Add `outdated_instances_strategy` argument
+```
\ No newline at end of file
diff --git a/.changelog/33845.txt b/.changelog/33845.txt
new file mode 100644
index 00000000000..e621e5b2663
--- /dev/null
+++ b/.changelog/33845.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_s3_bucket: Use configurable timeout for resource Delete
+```
\ No newline at end of file
diff --git a/.changelog/33852.txt b/.changelog/33852.txt
new file mode 100644
index 00000000000..11c30f16945
--- /dev/null
+++ b/.changelog/33852.txt
@@ -0,0 +1,99 @@
+```release-note:enhancement
+resource/aws_cloudfront_public_key: Support import of `name_prefix` argument
+```
+
+```release-note:enhancement
+resource/aws_docdb_cluster: Support import of `cluster_identifier_prefix` argument
+```
+
+```release-note:enhancement
+resource/aws_docdb_cluster_instance: Support import of `identifier_prefix` argument
+```
+
+```release-note:enhancement
+resource/aws_docdb_cluster_parameter_group: Support import of `name_prefix` argument
+```
+
+```release-note:enhancement
+resource/aws_docdb_subnet_group: Support import of `name_prefix` argument
+```
+
+```release-note:enhancement
+resource/aws_elb: Support import of `name_prefix` argument
+```
+
+```release-note:enhancement
+resource/aws_alb: Support import of `name_prefix` argument
+```
+
+```release-note:enhancement
+resource/aws_lb: Support import of `name_prefix` argument
+```
+
+```release-note:enhancement
+resource/aws_alb_target_group: Support import of `name_prefix` argument
+```
+
+```release-note:enhancement
+resource/aws_lb_target_group: Support import of `name_prefix` argument
+```
+
+```release-note:enhancement
+resource/aws_emr_security_configuration: Support import of `name_prefix` argument
+```
+
+```release-note:enhancement
+resource/aws_iam_group_policy: Support import of `name_prefix` argument
+```
+
+```release-note:enhancement
+resource/aws_iam_role_policy: Support import of `name_prefix` argument
+```
+
+```release-note:enhancement
+resource/aws_iam_user_policy: Support import of `name_prefix` argument
+```
+
+```release-note:enhancement
+resource/aws_neptune_cluster: Support import of `cluster_identifier_prefix` argument
+```
+
+```release-note:enhancement
+resource/aws_neptune_cluster_instance: Support import of `identifier_prefix` argument
+```
+
+```release-note:enhancement
+resource/aws_neptune_cluster_parameter_group: Support import of `name_prefix` argument
+```
+
+```release-note:enhancement
+resource/aws_neptune_event_subscription: Support import of `name_prefix` argument
+```
+
+```release-note:enhancement
+resource/aws_pinpoint_app: Support import of `name_prefix` argument
+```
+
+```release-note:enhancement
+resource/aws_db_option_group: Support import of `name_prefix` argument
+```
+
+```release-note:enhancement
+resource/aws_rds_cluster: Support import of `cluster_identifier_prefix` argument
+```
+
+```release-note:enhancement
+resource/aws_rds_cluster_instance: Support import of `identifier_prefix` argument
+```
+
+```release-note:enhancement
+resource/aws_signer_signing_profile: Support import of `name_prefix` argument
+```
+
+```release-note:enhancement
+resource/aws_signer_signing_profile_permission: Support import of `statement_id_prefix` argument
+```
+
+```release-note:enhancement
+resource/aws_signer_signing_profile_permission: Add `signer:SignPayload` as a valid `action` value
+```
\ No newline at end of file
diff --git a/.changelog/33856.txt b/.changelog/33856.txt
new file mode 100644
index 00000000000..bfeac4fde30
--- /dev/null
+++ b/.changelog/33856.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_appflow_connector_profile: Fix various crashes
+```
\ No newline at end of file
diff --git a/.changelog/33864.txt b/.changelog/33864.txt
new file mode 100644
index 00000000000..5bd482f2d17
--- /dev/null
+++ b/.changelog/33864.txt
@@ -0,0 +1,3 @@
+```release-note:new-resource
+aws_verifiedaccess_instance_logging_configuration
+```
\ No newline at end of file
diff --git a/.changelog/33871.txt b/.changelog/33871.txt
new file mode 100644
index 00000000000..9fa7dde8d7a
--- /dev/null
+++ b/.changelog/33871.txt
@@ -0,0 +1,3 @@
+```release-note:new-data-source
+aws_servicequotas_templates
+```
diff --git a/.changelog/33874.txt b/.changelog/33874.txt
new file mode 100644
index 00000000000..d69b4dd53f7
--- /dev/null
+++ b/.changelog/33874.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+provider: Respect valid values for the `AWS_S3_US_EAST_1_REGIONAL_ENDPOINT` environment variable when configuring the S3 API client
+```
diff --git a/.changelog/33880.txt b/.changelog/33880.txt
new file mode 100644
index 00000000000..1eba01b8cae
--- /dev/null
+++ b/.changelog/33880.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_verifiedaccess_instance: Add `fips_enabled` argument
+```
\ No newline at end of file
diff --git a/.changelog/33913.txt b/.changelog/33913.txt
new file mode 100644
index 00000000000..b81487af89c
--- /dev/null
+++ b/.changelog/33913.txt
@@ -0,0 +1,3 @@
+```release-note:new-resource
+aws_guardduty_organization_configuration_feature
+```
\ No newline at end of file
diff --git a/.changelog/33915.txt b/.changelog/33915.txt
new file mode 100644
index 00000000000..29ad42ee95a
--- /dev/null
+++ b/.changelog/33915.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_wafv2_web_acl: Add `aws_managed_rules_acfp_rule_set` to `managed_rule_group_configs` configuration block
+```
diff --git a/.changelog/33916.txt b/.changelog/33916.txt
new file mode 100644
index 00000000000..aa4f7b6be19
--- /dev/null
+++ b/.changelog/33916.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_redshiftserverless_workgroup: Allow `require_ssl` and `use_fips_ssl` `config_parameters` keys
+```
diff --git a/.changelog/33918.txt b/.changelog/33918.txt
new file mode 100644
index 00000000000..8eae4ed8220
--- /dev/null
+++ b/.changelog/33918.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_opensearchserverless_collection: Fix crash when error is returned
+```
\ No newline at end of file
diff --git a/.changelog/33925.txt b/.changelog/33925.txt
new file mode 100644
index 00000000000..631f69e712b
--- /dev/null
+++ b/.changelog/33925.txt
@@ -0,0 +1,4 @@
+
+```release-note:new-resource
+aws_elasticsearch_vpc_endpoint
+```
\ No newline at end of file
diff --git a/.changelog/33933.txt b/.changelog/33933.txt
new file mode 100644
index 00000000000..ae84f8196bc
--- /dev/null
+++ b/.changelog/33933.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_wafv2_web_acl: Add `ja3_fingerprint` to `field_to_match` configuration blocks
+```
\ No newline at end of file
diff --git a/.changelog/33937.txt b/.changelog/33937.txt
new file mode 100644
index 00000000000..67342be9cb0
--- /dev/null
+++ b/.changelog/33937.txt
@@ -0,0 +1,4 @@
+```release-note:enhancement
+resource/aws_transfer_server: Change `pre_authentication_login_banner` and `post_authentication_login_banner` length limits to 4096
+```
+
diff --git a/.changelog/33950.txt b/.changelog/33950.txt
new file mode 100644
index 00000000000..fc22443c978
--- /dev/null
+++ b/.changelog/33950.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_iot_provisioning_template: Add `type` attribute
+```
\ No newline at end of file
diff --git a/.changelog/33954.txt b/.changelog/33954.txt
new file mode 100644
index 00000000000..458477ca0ca
--- /dev/null
+++ b/.changelog/33954.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_elasticache_replication_group: Fix error when switching `engine_version` from `6.x` to a specific `6.<digit>` version number
+```
diff --git a/.changelog/33963.txt b/.changelog/33963.txt
new file mode 100644
index 00000000000..bafa61b0450
--- /dev/null
+++ b/.changelog/33963.txt
@@ -0,0 +1,7 @@
+```release-note:bug
+resource/aws_iam_role: Fix refreshing `permission_boundary` when deleted outside of Terraform
+```
+
+```release-note:bug
+resource/aws_iam_user: Fix refreshing `permission_boundary` when deleted outside of Terraform
+```
diff --git a/.changelog/33966.txt b/.changelog/33966.txt
new file mode 100644
index 00000000000..a53d73bf191
--- /dev/null
+++ b/.changelog/33966.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_s3_bucket_object_lock_configuration: Fix `found resource` errors on Delete
+```
diff --git a/.changelog/33969.txt b/.changelog/33969.txt
new file mode 100644
index 00000000000..afdd99e9128
--- /dev/null
+++ b/.changelog/33969.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_cloudformation_stack: Fix error when `computed` values are not set when there is no update
+```
\ No newline at end of file
diff --git a/.changelog/33973.txt b/.changelog/33973.txt
new file mode 100644
index 00000000000..ca6cdd3ba44
--- /dev/null
+++ b/.changelog/33973.txt
@@ -0,0 +1,3 @@
+```release-note:new-resource
+aws_msk_replicator
+```
\ No newline at end of file
diff --git a/.changelog/33992.txt b/.changelog/33992.txt
new file mode 100644
index 00000000000..d6eb2c9dbd7
--- /dev/null
+++ b/.changelog/33992.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_lb: Add `dns_record_client_routing_policy` attribute to configure Availability Zonal DNS affinity on Network Load Balancer (NLB)
+```
diff --git a/.changelog/34007.txt b/.changelog/34007.txt
new file mode 100644
index 00000000000..64c1402696a
--- /dev/null
+++ b/.changelog/34007.txt
@@ -0,0 +1,7 @@
+```release-note:enhancement
+data-source/aws_ec2_client_vpn_endpoint: Add `self_service_portal_url` attribute
+```
+
+```release-note:enhancement
+resource/aws_ec2_client_vpn_endpoint: Add `self_service_portal_url` attribute
+```
\ No newline at end of file
diff --git a/.changelog/34012.txt b/.changelog/34012.txt
new file mode 100644
index 00000000000..0d16df1a65c
--- /dev/null
+++ b/.changelog/34012.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+data-source/aws_dms_certificate: Fix crash when certificate not found
+```
\ No newline at end of file
diff --git a/.changelog/34015.txt b/.changelog/34015.txt
new file mode 100644
index 00000000000..4f2a7cb2b07
--- /dev/null
+++ b/.changelog/34015.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_storagegateway_gateway: Support the value `0` (representing Sunday) for `maintenance_start_time.day_of_week`
+```
\ No newline at end of file
diff --git a/.changelog/34019.txt b/.changelog/34019.txt
new file mode 100644
index 00000000000..b7335d5f5af
--- /dev/null
+++ b/.changelog/34019.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_elasticache_replication_group: Add `ip_discovery` and `network_type` arguments
+```
diff --git a/.changelog/34020.txt b/.changelog/34020.txt
new file mode 100644
index 00000000000..0b46df1f9d2
--- /dev/null
+++ b/.changelog/34020.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_ecs_task_definition: Add `0` as a valid value for `volume.efs_volume_configuration.transit_encryption_port`, preventing unexpected drift
+```
diff --git a/.changelog/34033.txt b/.changelog/34033.txt
new file mode 100644
index 00000000000..b70fc1105d7
--- /dev/null
+++ b/.changelog/34033.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_config_config_rule: Add `evaluation_mode` attribute
+```
diff --git a/.changelog/34037.txt b/.changelog/34037.txt
new file mode 100644
index 00000000000..a9553fc41a8
--- /dev/null
+++ b/.changelog/34037.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_identitystore_group: Fix updating `description` attribute when it is changed
+```
diff --git a/.changelog/34045.txt b/.changelog/34045.txt
new file mode 100644
index 00000000000..2a48dd03b3a
--- /dev/null
+++ b/.changelog/34045.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_lambda_function: Add `vpc_config.ipv6_allowed_for_dual_stack` argument
+```
diff --git a/.changelog/34048.txt b/.changelog/34048.txt
new file mode 100644
index 00000000000..e558673ed90
--- /dev/null
+++ b/.changelog/34048.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_dms_s3_endpoint: Don't send the default value of `false` for `add_trailing_padding_character`, maintaining compatibility with older ([pre-3.4.7](https://docs.aws.amazon.com/dms/latest/userguide/CHAP_ReleaseNotes.html#CHAP_ReleaseNotes.DMS347)) DMS engine versions
+```
diff --git a/.changelog/34049.txt b/.changelog/34049.txt
new file mode 100644
index 00000000000..66f8750f909
--- /dev/null
+++ b/.changelog/34049.txt
@@ -0,0 +1,7 @@
+```release-note:enhancement
+resource/aws_imagebuilder_image: Add `image_scanning_configuration` configuration block
+```
+
+```release-note:enhancement
+data-source/aws_imagebuilder_image: Add `image_scanning_configuration` attribute
+```
diff --git a/.changelog/34053.txt b/.changelog/34053.txt
new file mode 100644
index 00000000000..b401240f7f1
--- /dev/null
+++ b/.changelog/34053.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_neptune_cluster: Add `slowquery` as a valid `enable_cloudwatch_logs_exports` value
+```
\ No newline at end of file
diff --git a/.changelog/34054.txt b/.changelog/34054.txt
new file mode 100644
index 00000000000..0d6b2f2db53
--- /dev/null
+++ b/.changelog/34054.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_verifiedaccess_group: Fix `InvalidParameterValue: Policy Document cannot be provided when Policy Enabled is false or missing` errors when updating `policy_document`
+```
\ No newline at end of file
diff --git a/.changelog/34070.txt b/.changelog/34070.txt
new file mode 100644
index 00000000000..d95439d5778
--- /dev/null
+++ b/.changelog/34070.txt
@@ -0,0 +1,7 @@
+```release-note:enhancement
+resource/aws_lb_target_group: Add `target_health_state` configuration block
+```
+
+```release-note:enhancement
+resource/aws_lb_target_group: Remove default value (`false`) for `connection_termination` argument and mark as Computed, to support new default behavior for UDP/TCP_UDP target groups
+```
diff --git a/.changelog/34073.txt b/.changelog/34073.txt
new file mode 100644
index 00000000000..46fcda6d5a2
--- /dev/null
+++ b/.changelog/34073.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+provider/tags: Prevent crash when `tags_all` is null
+```
\ No newline at end of file
diff --git a/.changelog/34086.txt b/.changelog/34086.txt
new file mode 100644
index 00000000000..30c2b1ab274
--- /dev/null
+++ b/.changelog/34086.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_autoscaling_group: Fix error when `launch_template` name is updated.
+```
\ No newline at end of file
diff --git a/.changelog/34096.txt b/.changelog/34096.txt
new file mode 100644
index 00000000000..e75b945c010
--- /dev/null
+++ b/.changelog/34096.txt
@@ -0,0 +1,3 @@
+```release-note:note
+provider: This release includes an update to the AWS SDK for Go v2 with breaking type changes to several services: `finspace`, `kafka`, `medialive`, `rds`, `s3control`, `timestreamwrite`, and `xray`. These changes primarily affect how arguments with default values are serialized for outbound requests, changing scalar types to pointers. See [this AWS SDK for Go V2 issue](https://github.com/aws/aws-sdk-go-v2/issues/2162) for additional context. The corresponding provider changes should make this breakfix transparent to users, but as with any breaking change there is the potential for missed edge cases. If errors are observed in the impacted resources, please link to this dependency update pull request in the bug report.
+```
diff --git a/.changelog/34109.txt b/.changelog/34109.txt
new file mode 100644
index 00000000000..30a4fe1af04
--- /dev/null
+++ b/.changelog/34109.txt
@@ -0,0 +1,11 @@
+```release-note:enhancement
+resource/aws_networkmanager_connect_attachment: Add `NO_ENCAP` as a valid `options.protocol` value
+```
+
+```release-note:enhancement
+resource/aws_networkmanager_connect_peer: Add `subnet_arn` argument to support [Tunnel-less Connect attachments](https://docs.aws.amazon.com/network-manager/latest/cloudwan/cloudwan-connect-attachment.html#cloudwan-connect-tlc)
+```
+
+```release-note:enhancement
+resource/aws_networkmanager_connect_peer: `inside_cidr_blocks` is Optional
+```
\ No newline at end of file
diff --git a/.changelog/34112.txt b/.changelog/34112.txt
new file mode 100644
index 00000000000..b6c505d854d
--- /dev/null
+++ b/.changelog/34112.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_kms_key: Add configurable timeouts
+```
\ No newline at end of file
diff --git a/.changelog/34134.txt b/.changelog/34134.txt
new file mode 100644
index 00000000000..805d6b092af
--- /dev/null
+++ b/.changelog/34134.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+data-source/aws_lambda_function: Add `vpc_config.ipv6_allowed_for_dual_stack` attribute, fixing `Invalid address to set: []string{"vpc_config", "0", "ipv6_allowed_for_dual_stack"}` errors
+```
\ No newline at end of file
diff --git a/.ci/.golangci.yml b/.ci/.golangci.yml
index 253c47dd00a..250b46e0e4e 100644
--- a/.ci/.golangci.yml
+++ b/.ci/.golangci.yml
@@ -8,4 +8,4 @@ linters:
     - gofmt
 
 run:
-  timeout: 10m
+  timeout: 30m
diff --git a/.ci/.golangci2.yml b/.ci/.golangci2.yml
index adb1c7804f5..81350b4bfe0 100644
--- a/.ci/.golangci2.yml
+++ b/.ci/.golangci2.yml
@@ -38,6 +38,10 @@ issues:
         - staticcheck
       path: internal/service/batch/
       text: "SA1019: apiObject.ImageId is deprecated: This field is deprecated"
+    - linters:
+        - staticcheck
+      path: internal/service/chime/
+      text: "SA1019: conn.\\w+ is deprecated: Replaced by \\w+ in the Amazon Chime SDK Voice Namespace"
     - linters:
         - staticcheck
       path: "internal/service/cloudfront"
diff --git a/.ci/.markdownlinkcheck.json b/.ci/.markdownlinkcheck.json
index 37d1bf95cfe..e1814c8fc9e 100644
--- a/.ci/.markdownlinkcheck.json
+++ b/.ci/.markdownlinkcheck.json
@@ -26,19 +26,11 @@
         },
         {
             "pattern": "^(custom-service-endpoints|resource-tagging|version-2-upgrade|version-3-upgrade).html.markdown(#.*)?$",
-            "replacement": "file:///github/workspace/website/docs/guides/$1.html.md$2"
+            "replacement": "file:///github/workspace/website/docs/guides/$1.html.markdown$2"
         },
         {
             "pattern": "^file:///github/workspace/website/docs/guides/(.*)\\.markdown(#.*)?$",
-            "replacement": "file:///github/workspace/website/docs/guides/$1.md$2"
-        },
-        {
-            "pattern": "^file:///github/workspace/website/docs/d/(cognito_user_pools)\\.html\\.markdown(#.*)?$",
-            "replacement": "file:///github/workspace/website/docs/d/$1.markdown$2"
-        },
-        {
-            "pattern": "^file:///github/workspace/website/docs/r/(cognito_identity_pool|cognito_user_pool|iam_role_policy_attachment|iam_user_policy_attachment|network_interface|ram_principal_association|ram_resource_share|ram_resource_share_accepter)\\.html\\.markdown(#.*)?$",
-            "replacement": "file:///github/workspace/website/docs/r/$1.markdown$2"
+            "replacement": "file:///github/workspace/website/docs/guides/$1.markdown$2"
         }
     ]
 }
\ No newline at end of file
diff --git a/.ci/.semgrep-configs.yml b/.ci/.semgrep-configs.yml
index 6aa39013090..821176b03bc 100644
--- a/.ci/.semgrep-configs.yml
+++ b/.ci/.semgrep-configs.yml
@@ -17,7 +17,7 @@ rules:
       - metavariable-pattern:
           metavariable: "$VALUE"
           patterns:
-            - pattern-not-regex: "testAcc[a-zA-Z0-9]+Config(_[a-zA-Z0-9_]+_|_)[a-z0-9].*"
+            - pattern-not-regex: "testAcc[0-9A-Za-z]+Config(_[0-9A-Za-z_]+_|_)[0-9a-z].*"
             - pattern-not: acctest.ConfigCompose(...)
             - pattern-not: "..."
     severity: WARNING
@@ -39,7 +39,7 @@ rules:
       - metavariable-pattern:
           metavariable: "$VALUE"
           patterns:
-            - pattern-not-regex: "testAcc[a-zA-Z0-9]+Config(_[a-zA-Z0-9_]+_|_)[a-z0-9].*"
+            - pattern-not-regex: "testAcc[0-9A-Za-z]+Config(_[0-9A-Za-z_]+_|_)[0-9a-z].*"
             - pattern-not-regex: "acctest\\..*"
     severity: WARNING
 
diff --git a/.ci/.semgrep-service-name0.yml b/.ci/.semgrep-service-name0.yml
index 0664a0f9d87..ff04073339a 100644
--- a/.ci/.semgrep-service-name0.yml
+++ b/.ci/.semgrep-service-name0.yml
@@ -1506,6 +1506,64 @@ rules:
           patterns:
             - pattern-regex: "(?i)beanstalk"
     severity: WARNING
+  - id: bedrock-in-func-name
+    languages:
+      - go
+    message: Do not use "Bedrock" in func name inside bedrock package
+    paths:
+      include:
+        - internal/service/bedrock
+    patterns:
+      - pattern: func $NAME( ... ) { ... }
+      - metavariable-pattern:
+          metavariable: $NAME
+          patterns:
+            - pattern-regex: "(?i)Bedrock"
+            - pattern-not-regex: ^TestAcc.*
+    severity: WARNING
+  - id: bedrock-in-test-name
+    languages:
+      - go
+    message: Include "Bedrock" in test name
+    paths:
+      include:
+        - internal/service/bedrock/*_test.go
+    patterns:
+      - pattern: func $NAME( ... ) { ... }
+      - metavariable-pattern:
+          metavariable: $NAME
+          patterns:
+            - pattern-not-regex: "^TestAccBedrock"
+            - pattern-regex: ^TestAcc.*
+    severity: WARNING
+  - id: bedrock-in-const-name
+    languages:
+      - go
+    message: Do not use "Bedrock" in const name inside bedrock package
+    paths:
+      include:
+        - internal/service/bedrock
+    patterns:
+      - pattern: const $NAME = ...
+      - metavariable-pattern:
+          metavariable: $NAME
+          patterns:
+            - pattern-regex: "(?i)Bedrock"
+    severity: WARNING
+  - id: bedrock-in-var-name
+    languages:
+      - go
+    message: Do not use "Bedrock" in var name inside bedrock package
+    paths:
+      include:
+        - internal/service/bedrock
+    patterns:
+      - pattern: var $NAME = ...
+      - metavariable-pattern:
+          metavariable: $NAME
+          patterns:
+            - pattern-regex: "(?i)Bedrock"
+    severity: WARNING
   - id: budgets-in-func-name
     languages:
       - go
@@ -2782,6 +2840,64 @@ rules:
           patterns:
             - pattern-regex: "(?i)CodeBuild"
     severity: WARNING
+  - id: codecatalyst-in-func-name
+    languages:
+      - go
+    message: Do not use "CodeCatalyst" in func name inside codecatalyst package
+    paths:
+      include:
+        - internal/service/codecatalyst
+    patterns:
+      - pattern: func $NAME( ... ) { ... }
+      - metavariable-pattern:
+          metavariable: $NAME
+          patterns:
+            - pattern-regex: "(?i)CodeCatalyst"
+            - pattern-not-regex: ^TestAcc.*
+    severity: WARNING
+  - id: codecatalyst-in-test-name
+    languages:
+      - go
+    message: Include "CodeCatalyst" in test name
+    paths:
+      include:
+        - internal/service/codecatalyst/*_test.go
+    patterns:
+      - pattern: func $NAME( ... ) { ... }
+      - metavariable-pattern:
+          metavariable: $NAME
+          patterns:
+            - pattern-not-regex: "^TestAccCodeCatalyst"
+            - pattern-regex: ^TestAcc.*
+    severity: WARNING
+  - id: codecatalyst-in-const-name
+    languages:
+      - go
+    message: Do not use "CodeCatalyst" in const name inside codecatalyst package
+    paths:
+      include:
+        - internal/service/codecatalyst
+    patterns:
+      - pattern: const $NAME = ...
+      - metavariable-pattern:
+          metavariable: $NAME
+          patterns:
+            - pattern-regex: "(?i)CodeCatalyst"
+    severity: WARNING
+  - id: codecatalyst-in-var-name
+    languages:
+      - go
+    message: Do not use "CodeCatalyst" in var name inside codecatalyst package
+    paths:
+      include:
+        - internal/service/codecatalyst
+    patterns:
+      - pattern: var $NAME = ...
+      - metavariable-pattern:
+          metavariable: $NAME
+          patterns:
+            - pattern-regex: "(?i)CodeCatalyst"
+    severity: WARNING
   - id: codecommit-in-func-name
     languages:
       - go
@@ -3362,61 +3478,3 @@ rules:
             - pattern-not-regex: "^TestAccComputeOptimizer"
             - pattern-regex: ^TestAcc.*
     severity: WARNING
-  - id: computeoptimizer-in-const-name
-    languages:
-      - go
-    message: Do not use "ComputeOptimizer" in const name inside computeoptimizer package
-    paths:
-      include:
-        - internal/service/computeoptimizer
-    patterns:
-      - pattern: const $NAME = ...
-      - metavariable-pattern:
-          metavariable: $NAME
-          patterns:
-            - pattern-regex: "(?i)ComputeOptimizer"
-    severity: WARNING
-  - id: computeoptimizer-in-var-name
-    languages:
-      - go
-    message: Do not use "ComputeOptimizer" in var name inside computeoptimizer package
-    paths:
-      include:
-        - internal/service/computeoptimizer
-    patterns:
-      - pattern: var $NAME = ...
-      - metavariable-pattern:
-          metavariable: $NAME
-          patterns:
-            - pattern-regex: "(?i)ComputeOptimizer"
-    severity: WARNING
-  - id: configservice-in-func-name
-    languages:
-      - go
-    message: Do not use "ConfigService" in func name inside configservice package
-    paths:
-      include:
-        - internal/service/configservice
-    patterns:
-      - pattern: func $NAME( ... ) { ... }
-      - metavariable-pattern:
-          metavariable: $NAME
-          patterns:
-            - pattern-regex: "(?i)ConfigService"
-            - pattern-not-regex: ^TestAcc.*
-    severity: WARNING
-  - id: configservice-in-test-name
-    languages:
-      - go
-    message: Include "ConfigService" in test name
-    paths:
-      include:
-        - internal/service/configservice/*_test.go
-    patterns:
-      - pattern: func $NAME( ... ) { ... }
-      - metavariable-pattern:
-          metavariable: $NAME
-          patterns:
-            - pattern-not-regex: "^TestAccConfigService"
-            - pattern-regex: ^TestAcc.*
-    severity: WARNING
diff --git a/.ci/.semgrep-service-name1.yml b/.ci/.semgrep-service-name1.yml
index cfe64401012..b8f55074178 100644
--- a/.ci/.semgrep-service-name1.yml
+++ b/.ci/.semgrep-service-name1.yml
@@ -1,5 +1,63 @@
 # Generated by internal/generate/servicesemgrep/main.go; DO NOT EDIT.
 rules:
+  - id: computeoptimizer-in-const-name
+    languages:
+      - go
+    message: Do not use "ComputeOptimizer" in const name inside computeoptimizer package
+    paths:
+      include:
+        - internal/service/computeoptimizer
+    patterns:
+      - pattern: const $NAME = ...
+      - metavariable-pattern:
+          metavariable: $NAME
+          patterns:
+            - pattern-regex: "(?i)ComputeOptimizer"
+    severity: WARNING
+  - id: computeoptimizer-in-var-name
+    languages:
+      - go
+    message: Do not use "ComputeOptimizer" in var name inside computeoptimizer package
+    paths:
+      include:
+        - internal/service/computeoptimizer
+    patterns:
+      - pattern: var $NAME = ...
+      - metavariable-pattern:
+          metavariable: $NAME
+          patterns:
+            - pattern-regex: "(?i)ComputeOptimizer"
+    severity: WARNING
+  - id: configservice-in-func-name
+    languages:
+      - go
+    message: Do not use "ConfigService" in func name inside configservice package
+    paths:
+      include:
+        - internal/service/configservice
+    patterns:
+      - pattern: func $NAME( ... ) { ... }
+      - metavariable-pattern:
+          metavariable: $NAME
+          patterns:
+            - pattern-regex: "(?i)ConfigService"
+            - pattern-not-regex: ^TestAcc.*
+    severity: WARNING
+  - id: configservice-in-test-name
+    languages:
+      - go
+    message: Include "ConfigService" in test name
+    paths:
+      include:
+        - internal/service/configservice/*_test.go
+    patterns:
+      - pattern: func $NAME( ... ) { ... }
+      - metavariable-pattern:
+          metavariable: $NAME
+          patterns:
+            - pattern-not-regex: "^TestAccConfigService"
+            - pattern-regex: ^TestAcc.*
+    severity: WARNING
   - id: configservice-in-const-name
     languages:
       - go
@@ -3394,3 +3452,31 @@ rules:
             - pattern-not-regex: "^TestAccInspector2"
             - pattern-regex: ^TestAcc.*
     severity: WARNING
+  - id: inspector2-in-const-name
+    languages:
+      - go
+    message: Do not use "Inspector2" in const name inside inspector2 package
+    paths:
+      include:
+        - internal/service/inspector2
+    patterns:
+      - pattern: const $NAME = ...
+      - metavariable-pattern:
+          metavariable: $NAME
+          patterns:
+            - pattern-regex: "(?i)Inspector2"
+    severity: WARNING
+  - id: inspector2-in-var-name
+    languages:
+      - go
+    message: Do not use "Inspector2" in var name inside inspector2 package
+    paths:
+      include:
+        - internal/service/inspector2
+    patterns:
+      - pattern: var $NAME = ...
+      - metavariable-pattern:
+          metavariable: $NAME
+          patterns:
+            - pattern-regex: "(?i)Inspector2"
+    severity: WARNING
diff --git a/.ci/.semgrep-service-name2.yml b/.ci/.semgrep-service-name2.yml
index 23810f093d8..00b7ab6e7d6 100644
--- a/.ci/.semgrep-service-name2.yml
+++ b/.ci/.semgrep-service-name2.yml
@@ -1,33 +1,5 @@
 # Generated by internal/generate/servicesemgrep/main.go; DO NOT EDIT.
 rules:
-  - id: inspector2-in-const-name
-    languages:
-      - go
-    message: Do not use "Inspector2" in const name inside inspector2 package
-    paths:
-      include:
-        - internal/service/inspector2
-    patterns:
-      - pattern: const $NAME = ...
-      - metavariable-pattern:
-          metavariable: $NAME
-          patterns:
-            - pattern-regex: "(?i)Inspector2"
-    severity: WARNING
-  - id: inspector2-in-var-name
-    languages:
-      - go
-    message: Do not use "Inspector2" in var name inside inspector2 package
-    paths:
-      include:
-        - internal/service/inspector2
-    patterns:
-      - pattern: var $NAME = ...
-      - metavariable-pattern:
-          metavariable: $NAME
-          patterns:
-            - pattern-regex: "(?i)Inspector2"
-    severity: WARNING
   - id: inspectorv2-in-func-name
     languages:
       - go
@@ -1259,6 +1231,107 @@ rules:
           patterns:
             - pattern-regex: "(?i)LexModels"
     severity: WARNING
+  - id: lexmodelsv2-in-func-name
+    languages:
+      - go
+    message: Do not use "lexmodelsv2" in func name inside lexv2models package
+    paths:
+      include:
+        - internal/service/lexv2models
+    patterns:
+      - pattern: func $NAME( ... ) { ... }
+      - metavariable-pattern:
+          metavariable: $NAME
+          patterns:
+            - pattern-regex: "(?i)lexmodelsv2"
+            - pattern-not-regex: ^TestAcc.*
+    severity: WARNING
+  - id: lexmodelsv2-in-const-name
+    languages:
+      - go
+    message: Do not use "lexmodelsv2" in const name inside lexv2models package
+    paths:
+      include:
+        - internal/service/lexv2models
+    patterns:
+      - pattern: const $NAME = ...
+      - metavariable-pattern:
+          metavariable: $NAME
+          patterns:
+            - pattern-regex: "(?i)lexmodelsv2"
+    severity: WARNING
+  - id: lexmodelsv2-in-var-name
+    languages:
+      - go
+    message: Do not use "lexmodelsv2" in var name inside lexv2models package
+    paths:
+      include:
+        - internal/service/lexv2models
+    patterns:
+      - pattern: var $NAME = ...
+      - metavariable-pattern:
+          metavariable: $NAME
+          patterns:
+            - pattern-regex: "(?i)lexmodelsv2"
+    severity: WARNING
+  - id: lexv2models-in-func-name
+    languages:
+      - go
+    message: Do not use "LexV2Models" in func name inside lexv2models package
+    paths:
+      include:
+        - internal/service/lexv2models
+    patterns:
+      - pattern: func $NAME( ... ) { ... }
+      - metavariable-pattern:
+          metavariable: $NAME
+          patterns:
+            - pattern-regex: "(?i)LexV2Models"
+            - pattern-not-regex: ^TestAcc.*
+    severity: WARNING
+  - id: lexv2models-in-test-name
+    languages:
+      - go
+    message: Include "LexV2Models" in test name
+    paths:
+      include:
+        - internal/service/lexv2models/*_test.go
+    patterns:
+      - pattern: func $NAME( ... ) { ... }
+      - metavariable-pattern:
+          metavariable: $NAME
+          patterns:
+            - pattern-not-regex: "^TestAccLexV2Models"
+            - pattern-regex: ^TestAcc.*
+    severity: WARNING
+  - id: lexv2models-in-const-name
+    languages:
+      - go
+    message: Do not use "LexV2Models" in const name inside lexv2models package
+    paths:
+      include:
+        - internal/service/lexv2models
+    patterns:
+      - pattern: const $NAME = ...
+      - metavariable-pattern:
+          metavariable: $NAME
+          patterns:
+            - pattern-regex: "(?i)LexV2Models"
+    severity: WARNING
+  - id: lexv2models-in-var-name
+    languages:
+      - go
+    message: Do not use "LexV2Models" in var name inside lexv2models package
+    paths:
+      include:
+        - internal/service/lexv2models
+    patterns:
+      - pattern: var $NAME = ...
+      - metavariable-pattern:
+          metavariable: $NAME
+          patterns:
+            - pattern-regex: "(?i)LexV2Models"
+    severity: WARNING
   - id: licensemanager-in-func-name
     languages:
       - go
diff --git a/.ci/.semgrep-service-name3.yml b/.ci/.semgrep-service-name3.yml
index fdc623c690e..b6c146a3970 100644
--- a/.ci/.semgrep-service-name3.yml
+++ b/.ci/.semgrep-service-name3.yml
@@ -2942,6 +2942,64 @@ rules:
             - pattern-not-regex: "^TestAccVerifiedAccess"
             - pattern-regex: ^TestAcc.*
     severity: WARNING
+  - id: verifiedpermissions-in-func-name
+    languages:
+      - go
+    message: Do not use "VerifiedPermissions" in func name inside verifiedpermissions package
+    paths:
+      include:
+        - internal/service/verifiedpermissions
+    patterns:
+      - pattern: func $NAME( ... ) { ... }
+      - metavariable-pattern:
+          metavariable: $NAME
+          patterns:
+            - pattern-regex: "(?i)VerifiedPermissions"
+            - pattern-not-regex: ^TestAcc.*
+    severity: WARNING
+  - id: verifiedpermissions-in-test-name
+    languages:
+      - go
+    message: Include "VerifiedPermissions" in test name
+    paths:
+      include:
+        - internal/service/verifiedpermissions/*_test.go
+    patterns:
+      - pattern: func $NAME( ... ) { ... }
+      - metavariable-pattern:
+          metavariable: $NAME
+          patterns:
+            - pattern-not-regex: "^TestAccVerifiedPermissions"
+            - pattern-regex: ^TestAcc.*
+    severity: WARNING
+  - id: verifiedpermissions-in-const-name
+    languages:
+      - go
+    message: Do not use "VerifiedPermissions" in const name inside verifiedpermissions package
+    paths:
+      include:
+        - internal/service/verifiedpermissions
+    patterns:
+      - pattern: const $NAME = ...
+      - metavariable-pattern:
+          metavariable: $NAME
+          patterns:
+            - pattern-regex: "(?i)VerifiedPermissions"
+    severity: WARNING
+  - id: verifiedpermissions-in-var-name
+    languages:
+      - go
+    message: Do not use "VerifiedPermissions" in var name inside verifiedpermissions package
+    paths:
+      include:
+        - internal/service/verifiedpermissions
+    patterns:
+      - pattern: var $NAME = ...
+      - metavariable-pattern:
+          metavariable: $NAME
+          patterns:
+            - pattern-regex: "(?i)VerifiedPermissions"
+    severity: WARNING
   - id: vpc-in-test-name
     languages:
       - go
diff --git a/.ci/.semgrep.yml b/.ci/.semgrep.yml
index 79b047015cb..4ddce8038f0 100644
--- a/.ci/.semgrep.yml
+++ b/.ci/.semgrep.yml
@@ -397,6 +397,19 @@ rules:
               fmt.Println(...)
     severity: WARNING
 
+  - id: calling-regexp.MustCompile-directly
+    languages: [go]
+    message: Do not call `regexp.MustCompile` directly, use `regexache.MustCompile` instead
+    paths:
+      include:
+        - internal/
+      exclude:
+        - .ci/providerlint/vendor/
+    patterns:
+      - pattern: 'regexp.MustCompile($X)'
+    severity: WARNING
+    fix: "regexache.MustCompile($X)"
+
   - id: domain-names
     languages: [go]
     message: Domain names should be in the namespaces defined in RFC 6761 (https://datatracker.ietf.org/doc/html/rfc6761) as reserved for testing
diff --git a/.ci/.tflint.hcl b/.ci/.tflint.hcl
index 82ce377b904..77821358b44 100644
--- a/.ci/.tflint.hcl
+++ b/.ci/.tflint.hcl
@@ -1,13 +1,9 @@
 plugin "aws" {
   enabled = true
-  version = "0.17.1"
+  version = "0.23.1"
   source  = "github.com/terraform-linters/tflint-ruleset-aws"
 }
 
 rule "aws_acm_certificate_lifecycle" {
   enabled = false
 }
-
-rule "aws_route_not_specified_target" {
-  enabled = false
-}
diff --git a/.ci/providerlint/go.mod b/.ci/providerlint/go.mod
index bc238ab57dc..0333bd2d17e 100644
--- a/.ci/providerlint/go.mod
+++ b/.ci/providerlint/go.mod
@@ -1,39 +1,41 @@
 module github.com/hashicorp/terraform-provider-aws/ci/providerlint
 
-go 1.19
+go 1.20
 
 require (
-	github.com/aws/aws-sdk-go v1.44.285
+	github.com/aws/aws-sdk-go v1.46.6
 	github.com/bflad/tfproviderlint v0.29.0
-	github.com/hashicorp/terraform-plugin-sdk/v2 v2.26.1
+	github.com/hashicorp/terraform-plugin-sdk/v2 v2.29.0
 	golang.org/x/tools v0.8.0
 )
 
 require (
+	github.com/ProtonMail/go-crypto v0.0.0-20230717121422-5aa5874ade95 // indirect
 	github.com/agext/levenshtein v1.2.2 // indirect
-	github.com/apparentlymart/go-textseg/v13 v13.0.0 // indirect
+	github.com/apparentlymart/go-textseg/v15 v15.0.0 // indirect
 	github.com/bflad/gopaniccheck v0.1.0 // indirect
+	github.com/cloudflare/circl v1.3.3 // indirect
 	github.com/fatih/color v1.13.0 // indirect
-	github.com/golang/protobuf v1.5.2 // indirect
+	github.com/golang/protobuf v1.5.3 // indirect
 	github.com/google/go-cmp v0.5.9 // indirect
 	github.com/hashicorp/errwrap v1.0.0 // indirect
 	github.com/hashicorp/go-checkpoint v0.5.0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
 	github.com/hashicorp/go-cty v1.4.1-0.20200414143053-d3edf31b6320 // indirect
-	github.com/hashicorp/go-hclog v1.4.0 // indirect
+	github.com/hashicorp/go-hclog v1.5.0 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
-	github.com/hashicorp/go-plugin v1.4.8 // indirect
+	github.com/hashicorp/go-plugin v1.5.1 // indirect
 	github.com/hashicorp/go-uuid v1.0.3 // indirect
 	github.com/hashicorp/go-version v1.6.0 // indirect
-	github.com/hashicorp/hc-install v0.5.0 // indirect
-	github.com/hashicorp/hcl/v2 v2.16.2 // indirect
+	github.com/hashicorp/hc-install v0.6.0 // indirect
+	github.com/hashicorp/hcl/v2 v2.18.0 // indirect
 	github.com/hashicorp/logutils v1.0.0 // indirect
-	github.com/hashicorp/terraform-exec v0.18.1 // indirect
-	github.com/hashicorp/terraform-json v0.16.0 // indirect
-	github.com/hashicorp/terraform-plugin-go v0.14.3 // indirect
-	github.com/hashicorp/terraform-plugin-log v0.8.0 // indirect
-	github.com/hashicorp/terraform-registry-address v0.1.0 // indirect
-	github.com/hashicorp/terraform-svchost v0.0.0-20200729002733-f050f53b9734 // indirect
+	github.com/hashicorp/terraform-exec v0.19.0 // indirect
+	github.com/hashicorp/terraform-json v0.17.1 // indirect
+	github.com/hashicorp/terraform-plugin-go v0.19.0 // indirect
+	github.com/hashicorp/terraform-plugin-log v0.9.0 // indirect
+	github.com/hashicorp/terraform-registry-address v0.2.2 // indirect
+	github.com/hashicorp/terraform-svchost v0.1.1 // indirect
 	github.com/hashicorp/yamux v0.0.0-20181012175058-2f1d1f20f75d // indirect
 	github.com/mattn/go-colorable v0.1.12 // indirect
 	github.com/mattn/go-isatty v0.0.14 // indirect
@@ -44,16 +46,16 @@ require (
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
 	github.com/oklog/run v1.0.0 // indirect
 	github.com/vmihailenco/msgpack v4.0.4+incompatible // indirect
-	github.com/vmihailenco/msgpack/v4 v4.3.12 // indirect
-	github.com/vmihailenco/tagparser v0.1.1 // indirect
-	github.com/zclconf/go-cty v1.13.1 // indirect
-	golang.org/x/crypto v0.8.0 // indirect
-	golang.org/x/mod v0.10.0 // indirect
-	golang.org/x/net v0.9.0 // indirect
-	golang.org/x/sys v0.7.0 // indirect
-	golang.org/x/text v0.9.0 // indirect
-	google.golang.org/appengine v1.6.6 // indirect
-	google.golang.org/genproto v0.0.0-20200904004341-0bd0a958aa1d // indirect
-	google.golang.org/grpc v1.51.0 // indirect
-	google.golang.org/protobuf v1.28.1 // indirect
+	github.com/vmihailenco/msgpack/v5 v5.3.5 // indirect
+	github.com/vmihailenco/tagparser/v2 v2.0.0 // indirect
+	github.com/zclconf/go-cty v1.14.0 // indirect
+	golang.org/x/crypto v0.14.0 // indirect
+	golang.org/x/mod v0.12.0 // indirect
+	golang.org/x/net v0.17.0 // indirect
+	golang.org/x/sys v0.13.0 // indirect
+	golang.org/x/text v0.13.0 // indirect
+	google.golang.org/appengine v1.6.7 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20230525234030-28d5490b6b19 // indirect
+	google.golang.org/grpc v1.57.0 // indirect
+	google.golang.org/protobuf v1.31.0 // indirect
 )
diff --git a/.ci/providerlint/go.sum b/.ci/providerlint/go.sum
index 604605b17cd..063446c153e 100644
--- a/.ci/providerlint/go.sum
+++ b/.ci/providerlint/go.sum
@@ -1,270 +1,169 @@
-cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
-cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
-github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
-github.com/Masterminds/goutils v1.1.1/go.mod h1:8cTjp+g8YejhMuvIA5y2vz3BpJxksy863GQaJW2MFNU=
-github.com/Masterminds/semver/v3 v3.1.1/go.mod h1:VPu/7SZ7ePZ3QOrcuXROw5FAcLl4a0cBrbBpGY/8hQs=
-github.com/Masterminds/sprig/v3 v3.2.1/go.mod h1:UoaO7Yp8KlPnJIYWTFkMaqPUYKTfGFPhxNuwnnxkKlk=
-github.com/Microsoft/go-winio v0.4.14/go.mod h1:qXqCSQ3Xa7+6tgxaGTIe4Kpcdsi+P8jBhyzoq1bpyYA=
-github.com/Microsoft/go-winio v0.4.16 h1:FtSW/jqD+l4ba5iPBj9CODVtgfYAD8w2wS923g/cFDk=
-github.com/Microsoft/go-winio v0.4.16/go.mod h1:XB6nPKklQyQ7GC9LdcBEcBl8PF76WugXOPRXwdLnMv0=
-github.com/ProtonMail/go-crypto v0.0.0-20210428141323-04723f9f07d7 h1:YoJbenK9C67SkzkDfmQuVln04ygHj3vjZfd9FL+GmQQ=
-github.com/ProtonMail/go-crypto v0.0.0-20210428141323-04723f9f07d7/go.mod h1:z4/9nQmJSSwwds7ejkxaJwO37dru3geImFUdJlaLzQo=
-github.com/acomagu/bufpipe v1.0.3 h1:fxAGrHZTgQ9w5QqVItgzwj235/uYZYgbXitB+dLupOk=
-github.com/acomagu/bufpipe v1.0.3/go.mod h1:mxdxdup/WdsKVreO5GpW4+M/1CE2sMG4jeGJ2sYmHc4=
+dario.cat/mergo v1.0.0 h1:AGCNq9Evsj31mOgNPcLyXc+4PNABt905YmuqPYYpBWk=
+github.com/Microsoft/go-winio v0.6.1 h1:9/kr64B9VUZrLm5YYwbGtUJnMgqWVOdUAXu6Migciow=
+github.com/ProtonMail/go-crypto v0.0.0-20230717121422-5aa5874ade95 h1:KLq8BE0KwCL+mmXnjLWEAOYO+2l2AE4YMmqG1ZpZHBs=
+github.com/ProtonMail/go-crypto v0.0.0-20230717121422-5aa5874ade95/go.mod h1:EjAoLdwvbIOoOQr3ihjnSoLZRtE8azugULFRteWMNc0=
+github.com/acomagu/bufpipe v1.0.4 h1:e3H4WUzM3npvo5uv95QuJM3cQspFNtFBzvJ2oNjKIDQ=
 github.com/agext/levenshtein v1.2.2 h1:0S/Yg6LYmFJ5stwQeRp6EeOcCbj7xiqQSdNelsXvaqE=
 github.com/agext/levenshtein v1.2.2/go.mod h1:JEDfjyjHDjOF/1e4FlBE/PkbqA9OfWu2ki2W0IB5558=
-github.com/anmitsu/go-shlex v0.0.0-20161002113705-648efa622239/go.mod h1:2FmKhYUyUczH0OGQWaF5ceTx0UBShxjsH6f8oGKYe2c=
-github.com/apparentlymart/go-textseg v1.0.0/go.mod h1:z96Txxhf3xSFMPmb5X/1W05FF/Nj9VFpLOpjS5yuumk=
 github.com/apparentlymart/go-textseg/v12 v12.0.0/go.mod h1:S/4uRK2UtaQttw1GenVJEynmyUenKwP++x/+DdGV/Ec=
-github.com/apparentlymart/go-textseg/v13 v13.0.0 h1:Y+KvPE1NYz0xl601PVImeQfFyEy6iT90AvPUL1NNfNw=
-github.com/apparentlymart/go-textseg/v13 v13.0.0/go.mod h1:ZK2fH7c4NqDTLtiYLvIkEghdlcqw7yxLeM89kiTRPUo=
-github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
-github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs=
-github.com/aws/aws-sdk-go v1.44.285 h1:rgoWYl+NdmKzRgoi/fZLEtGXOjCkcWIa5jPH02Uahdo=
-github.com/aws/aws-sdk-go v1.44.285/go.mod h1:aVsgQcEevwlmQ7qHE9I3h+dtQgpqhFB+i8Phjh7fkwI=
+github.com/apparentlymart/go-textseg/v15 v15.0.0 h1:uYvfpb3DyLSCGWnctWKGj857c6ew1u1fNQOlOtuGxQY=
+github.com/apparentlymart/go-textseg/v15 v15.0.0/go.mod h1:K8XmNZdhEBkdlyDdvbmmsvpAG721bKi0joRfFdHIWJ4=
+github.com/aws/aws-sdk-go v1.46.6 h1:6wFnNC9hETIZLMf6SOTN7IcclrOGwp/n9SLp8Pjt6E8=
+github.com/aws/aws-sdk-go v1.46.6/go.mod h1:aVsgQcEevwlmQ7qHE9I3h+dtQgpqhFB+i8Phjh7fkwI=
 github.com/bflad/gopaniccheck v0.1.0 h1:tJftp+bv42ouERmUMWLoUn/5bi/iQZjHPznM00cP/bU=
 github.com/bflad/gopaniccheck v0.1.0/go.mod h1:ZCj2vSr7EqVeDaqVsWN4n2MwdROx1YL+LFo47TSWtsA=
 github.com/bflad/tfproviderlint v0.29.0 h1:zxKYAAM6IZ4ace1a3LX+uzMRIMP8L+iOtEc+FP2Yoow=
 github.com/bflad/tfproviderlint v0.29.0/go.mod h1:ErKVd+GRA2tXKr8T7zC0EDSrtALJL25wj0ZJ/v/klqQ=
-github.com/bgentry/speakeasy v0.1.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs=
-github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
-github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
-github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
+github.com/bufbuild/protocompile v0.4.0 h1:LbFKd2XowZvQ/kajzguUp2DC9UEIQhIq77fZZlaQsNA=
+github.com/bwesterb/go-ristretto v1.2.3/go.mod h1:fUIoIZaG73pV5biE2Blr2xEzDoMj7NFEuV9ekS419A0=
+github.com/cloudflare/circl v1.3.3 h1:fE/Qz0QdIGqeWfnwq0RE0R7MI51s0M2E4Ga9kq5AEMs=
+github.com/cloudflare/circl v1.3.3/go.mod h1:5XYMA4rFBvNIrhs50XuiBJ15vF2pZn4nnUKZrLbUZFA=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/emirpasic/gods v1.12.0 h1:QAUIPSaCu4G+POclxeqb3F+WPpdKqFGlw36+yOzGlrg=
-github.com/emirpasic/gods v1.12.0/go.mod h1:YfzfFFoVP/catgzJb4IKIqXjX78Ha8FMSDh3ymbK86o=
-github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
-github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
-github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
+github.com/emirpasic/gods v1.18.1 h1:FXtiHYKDGKCW2KzwZKx0iC0PQmdlorYgdFG9jPXJ1Bc=
 github.com/fatih/color v1.13.0 h1:8LOYc1KYPPmyKMuN8QV2DNRWNbLo6LZ0iLs8+mlH53w=
 github.com/fatih/color v1.13.0/go.mod h1:kLAiJbzzSOZDVNGyDpeOxJ47H46qBXwg5ILebYFFOfk=
-github.com/flynn/go-shlex v0.0.0-20150515145356-3f9db97f8568/go.mod h1:xEzjJPgXI435gkrCt3MPfRiAkVrwSbHsst4LCFVfpJc=
-github.com/gliderlabs/ssh v0.2.2/go.mod h1:U7qILu1NlMHj9FlMhZLlkCdDnU1DBEAqr0aevW3Awn0=
-github.com/go-git/gcfg v1.5.0 h1:Q5ViNfGF8zFgyJWPqYwA7qGFoMTEiBmdlkcfRmpIMa4=
-github.com/go-git/gcfg v1.5.0/go.mod h1:5m20vg6GwYabIxaOonVkTdrILxQMpEShl1xiMF4ua+E=
-github.com/go-git/go-billy/v5 v5.2.0/go.mod h1:pmpqyWchKfYfrkb/UVH4otLvyi/5gJlGI4Hb3ZqZ3W0=
-github.com/go-git/go-billy/v5 v5.3.1 h1:CPiOUAzKtMRvolEKw+bG1PLRpT7D3LIs3/3ey4Aiu34=
-github.com/go-git/go-billy/v5 v5.3.1/go.mod h1:pmpqyWchKfYfrkb/UVH4otLvyi/5gJlGI4Hb3ZqZ3W0=
-github.com/go-git/go-git-fixtures/v4 v4.2.1/go.mod h1:K8zd3kDUAykwTdDCr+I0per6Y6vMiRR/nnVTBtavnB0=
-github.com/go-git/go-git/v5 v5.4.2 h1:BXyZu9t0VkbiHtqrsvdq39UDhGJTl1h55VW6CSC4aY4=
-github.com/go-git/go-git/v5 v5.4.2/go.mod h1:gQ1kArt6d+n+BGd+/B/I74HwRTLhth2+zti4ihgckDc=
+github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 h1:+zs/tPmkDkHx3U66DAb0lQFJrpS6731Oaa12ikc+DiI=
+github.com/go-git/go-billy/v5 v5.4.1 h1:Uwp5tDRkPr+l/TnbHOQzp+tmJfLceOlbVucgpTz8ix4=
+github.com/go-git/go-git/v5 v5.8.1 h1:Zo79E4p7TRk0xoRgMq0RShiTHGKcKI4+DI6BfJc/Q+A=
 github.com/go-test/deep v1.0.3 h1:ZrJSEWsXzPOxaZnFteGEfooLba+ju3FYIbOrS+rQd68=
-github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
-github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
+github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da h1:oI5xCqsCo564l8iNU+DwB5epxmsaqB+rhGL0m5jtYqE=
 github.com/golang/protobuf v1.1.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.3.4/go.mod h1:vzj43D7+SQXF/4pzW/hwtAqwc6iTitCiVSaWz5lYuqw=
-github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8=
-github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA=
-github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrUpVNzEA03Pprs=
-github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:WU3c8KckQ9AFe+yFwt9sWVRKCVIyN9cPHBJSNnbL67w=
-github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0=
-github.com/golang/protobuf v1.4.1/go.mod h1:U8fpvMrcmy5pZrNK1lt4xCsGvpyWQ/VVv6QDs8UjoX8=
 github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
-github.com/golang/protobuf v1.5.2 h1:ROPKBNFfQgOUMifHyP+KYbvpjbdoFNs+aK7DXlji0Tw=
-github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
-github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
-github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
+github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg=
+github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
 github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
-github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
 github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
-github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/hashicorp/errwrap v1.0.0 h1:hLrqtEDnRye3+sgx6z4qVLNuviH3MR5aQ0ykNJa/UYA=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/go-checkpoint v0.5.0 h1:MFYpPZCnQqQTE18jFwSII6eUQrD/oxMFp3mlgcqk5mU=
 github.com/hashicorp/go-checkpoint v0.5.0/go.mod h1:7nfLNL10NsxqO4iWuW6tWW0HjZuDrwkBuEQsVcpCOgg=
 github.com/hashicorp/go-cleanhttp v0.5.0/go.mod h1:JpRdi6/HCYpAwUzNwuwqhbovhLtngrth3wmdIIUrZ80=
-github.com/hashicorp/go-cleanhttp v0.5.1/go.mod h1:JpRdi6/HCYpAwUzNwuwqhbovhLtngrth3wmdIIUrZ80=
 github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ=
 github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48=
 github.com/hashicorp/go-cty v1.4.1-0.20200414143053-d3edf31b6320 h1:1/D3zfFHttUKaCaGKZ/dR2roBXv0vKbSCnssIldfQdI=
 github.com/hashicorp/go-cty v1.4.1-0.20200414143053-d3edf31b6320/go.mod h1:EiZBMaudVLy8fmjf9Npq1dq9RalhveqZG5w/yz3mHWs=
-github.com/hashicorp/go-hclog v1.4.0 h1:ctuWFGrhFha8BnnzxqeRGidlEcQkDyL5u8J8t5eA11I=
-github.com/hashicorp/go-hclog v1.4.0/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M=
-github.com/hashicorp/go-multierror v1.0.0/go.mod h1:dHtQlpGsu+cZNNAkkCN/P3hoUDHhCYQXV3UM06sGGrk=
+github.com/hashicorp/go-hclog v1.5.0 h1:bI2ocEMgcVlz55Oj1xZNBsVi900c7II+fWDyV9o+13c=
+github.com/hashicorp/go-hclog v1.5.0/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M=
 github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
-github.com/hashicorp/go-plugin v1.4.8 h1:CHGwpxYDOttQOY7HOWgETU9dyVjOXzniXDqJcYJE1zM=
-github.com/hashicorp/go-plugin v1.4.8/go.mod h1:viDMjcLJuDui6pXb8U4HVfb8AamCWhHGUjr2IrTF67s=
+github.com/hashicorp/go-plugin v1.5.1 h1:oGm7cWBaYIp3lJpx1RUEfLWophprE2EV/KUeqBYo+6k=
+github.com/hashicorp/go-plugin v1.5.1/go.mod h1:w1sAEES3g3PuV/RzUrgow20W2uErMly84hhD3um1WL4=
 github.com/hashicorp/go-uuid v1.0.0/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
 github.com/hashicorp/go-uuid v1.0.3 h1:2gKiV6YVmrJ1i2CKKa9obLvRieoRGviZFL26PcT/Co8=
 github.com/hashicorp/go-uuid v1.0.3/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
-github.com/hashicorp/go-version v1.2.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
 github.com/hashicorp/go-version v1.6.0 h1:feTTfFNnjP967rlCxM/I9g701jU+RN74YKx2mOkIeek=
 github.com/hashicorp/go-version v1.6.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
-github.com/hashicorp/hc-install v0.5.0 h1:D9bl4KayIYKEeJ4vUDe9L5huqxZXczKaykSRcmQ0xY0=
-github.com/hashicorp/hc-install v0.5.0/go.mod h1:JyzMfbzfSBSjoDCRPna1vi/24BEDxFaCPfdHtM5SCdo=
-github.com/hashicorp/hcl/v2 v2.16.2 h1:mpkHZh/Tv+xet3sy3F9Ld4FyI2tUpWe9x3XtPx9f1a0=
-github.com/hashicorp/hcl/v2 v2.16.2/go.mod h1:JRmR89jycNkrrqnMmvPDMd56n1rQJ2Q6KocSLCMCXng=
+github.com/hashicorp/hc-install v0.6.0 h1:fDHnU7JNFNSQebVKYhHZ0va1bC6SrPQ8fpebsvNr2w4=
+github.com/hashicorp/hc-install v0.6.0/go.mod h1:10I912u3nntx9Umo1VAeYPUUuehk0aRQJYpMwbX5wQA=
+github.com/hashicorp/hcl/v2 v2.18.0 h1:wYnG7Lt31t2zYkcquwgKo6MWXzRUDIeIVU5naZwHLl8=
+github.com/hashicorp/hcl/v2 v2.18.0/go.mod h1:ThLC89FV4p9MPW804KVbe/cEXoQ8NZEh+JtMeeGErHE=
 github.com/hashicorp/logutils v1.0.0 h1:dLEQVugN8vlakKOUE3ihGLTZJRB4j+M2cdTm/ORI65Y=
 github.com/hashicorp/logutils v1.0.0/go.mod h1:QIAnNjmIWmVIIkWDTG1z5v++HQmx9WQRO+LraFDTW64=
-github.com/hashicorp/terraform-exec v0.18.1 h1:LAbfDvNQU1l0NOQlTuudjczVhHj061fNX5H8XZxHlH4=
-github.com/hashicorp/terraform-exec v0.18.1/go.mod h1:58wg4IeuAJ6LVsLUeD2DWZZoc/bYi6dzhLHzxM41980=
-github.com/hashicorp/terraform-json v0.16.0 h1:UKkeWRWb23do5LNAFlh/K3N0ymn1qTOO8c+85Albo3s=
-github.com/hashicorp/terraform-json v0.16.0/go.mod h1:v0Ufk9jJnk6tcIZvScHvetlKfiNTC+WS21mnXIlc0B0=
-github.com/hashicorp/terraform-plugin-go v0.14.3 h1:nlnJ1GXKdMwsC8g1Nh05tK2wsC3+3BL/DBBxFEki+j0=
-github.com/hashicorp/terraform-plugin-go v0.14.3/go.mod h1:7ees7DMZ263q8wQ6E4RdIdR6nHHJtrdt4ogX5lPkX1A=
-github.com/hashicorp/terraform-plugin-log v0.8.0 h1:pX2VQ/TGKu+UU1rCay0OlzosNKe4Nz1pepLXj95oyy0=
-github.com/hashicorp/terraform-plugin-log v0.8.0/go.mod h1:1myFrhVsBLeylQzYYEV17VVjtG8oYPRFdaZs7xdW2xs=
-github.com/hashicorp/terraform-plugin-sdk/v2 v2.26.1 h1:G9WAfb8LHeCxu7Ae8nc1agZlQOSCUWsb610iAogBhCs=
-github.com/hashicorp/terraform-plugin-sdk/v2 v2.26.1/go.mod h1:xcOSYlRVdPLmDUoqPhO9fiO/YCN/l6MGYeTzGt5jgkQ=
-github.com/hashicorp/terraform-registry-address v0.1.0 h1:W6JkV9wbum+m516rCl5/NjKxCyTVaaUBbzYcMzBDO3U=
-github.com/hashicorp/terraform-registry-address v0.1.0/go.mod h1:EnyO2jYO6j29DTHbJcm00E5nQTFeTtyZH3H5ycydQ5A=
-github.com/hashicorp/terraform-svchost v0.0.0-20200729002733-f050f53b9734 h1:HKLsbzeOsfXmKNpr3GiT18XAblV0BjCbzL8KQAMZGa0=
-github.com/hashicorp/terraform-svchost v0.0.0-20200729002733-f050f53b9734/go.mod h1:kNDNcF7sN4DocDLBkQYz73HGKwN1ANB1blq4lIYLYvg=
+github.com/hashicorp/terraform-exec v0.19.0 h1:FpqZ6n50Tk95mItTSS9BjeOVUb4eg81SpgVtZNNtFSM=
+github.com/hashicorp/terraform-exec v0.19.0/go.mod h1:tbxUpe3JKruE9Cuf65mycSIT8KiNPZ0FkuTE3H4urQg=
+github.com/hashicorp/terraform-json v0.17.1 h1:eMfvh/uWggKmY7Pmb3T85u86E2EQg6EQHgyRwf3RkyA=
+github.com/hashicorp/terraform-json v0.17.1/go.mod h1:Huy6zt6euxaY9knPAFKjUITn8QxUFIe9VuSzb4zn/0o=
+github.com/hashicorp/terraform-plugin-go v0.19.0 h1:BuZx/6Cp+lkmiG0cOBk6Zps0Cb2tmqQpDM3iAtnhDQU=
+github.com/hashicorp/terraform-plugin-go v0.19.0/go.mod h1:EhRSkEPNoylLQntYsk5KrDHTZJh9HQoumZXbOGOXmec=
+github.com/hashicorp/terraform-plugin-log v0.9.0 h1:i7hOA+vdAItN1/7UrfBqBwvYPQ9TFvymaRGZED3FCV0=
+github.com/hashicorp/terraform-plugin-log v0.9.0/go.mod h1:rKL8egZQ/eXSyDqzLUuwUYLVdlYeamldAHSxjUFADow=
+github.com/hashicorp/terraform-plugin-sdk/v2 v2.29.0 h1:wcOKYwPI9IorAJEBLzgclh3xVolO7ZorYd6U1vnok14=
+github.com/hashicorp/terraform-plugin-sdk/v2 v2.29.0/go.mod h1:qH/34G25Ugdj5FcM95cSoXzUgIbgfhVLXCcEcYaMwq8=
+github.com/hashicorp/terraform-registry-address v0.2.2 h1:lPQBg403El8PPicg/qONZJDC6YlgCVbWDtNmmZKtBno=
+github.com/hashicorp/terraform-registry-address v0.2.2/go.mod h1:LtwNbCihUoUZ3RYriyS2wF/lGPB6gF9ICLRtuDk7hSo=
+github.com/hashicorp/terraform-svchost v0.1.1 h1:EZZimZ1GxdqFRinZ1tpJwVxxt49xc/S52uzrw4x0jKQ=
+github.com/hashicorp/terraform-svchost v0.1.1/go.mod h1:mNsjQfZyf/Jhz35v6/0LWcv26+X7JPS+buii2c9/ctc=
 github.com/hashicorp/yamux v0.0.0-20181012175058-2f1d1f20f75d h1:kJCB4vdITiW1eC1vq2e6IsrXKrZit1bv/TDYFGMp4BQ=
 github.com/hashicorp/yamux v0.0.0-20181012175058-2f1d1f20f75d/go.mod h1:+NfK9FKeTrX5uv1uIXGdwYDTeHna2qgaIlx54MXqjAM=
-github.com/huandu/xstrings v1.3.1/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE=
-github.com/huandu/xstrings v1.3.2/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE=
-github.com/imdario/mergo v0.3.11/go.mod h1:jmQim1M+e3UYxmgPu/WyfjB3N3VflVyUjjjwH0dnCYA=
-github.com/imdario/mergo v0.3.12 h1:b6R2BslTbIEToALKP7LxUvijTsNI9TAe80pLWN2g/HU=
-github.com/imdario/mergo v0.3.12/go.mod h1:jmQim1M+e3UYxmgPu/WyfjB3N3VflVyUjjjwH0dnCYA=
 github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 h1:BQSFePA1RWJOlocH6Fxy8MmwDt+yVQYULKfN0RoTN8A=
-github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99/go.mod h1:1lJo3i6rXxKeerYnT8Nvf0QmHCRC1n8sfWVwXF2Frvo=
-github.com/jessevdk/go-flags v1.5.0/go.mod h1:Fw0T6WPc1dYxT4mKEZRfG5kJhaTDP9pj1c2EWnYs/m4=
-github.com/jhump/protoreflect v1.6.0 h1:h5jfMVslIg6l29nsMs0D8Wj17RDVdNYti0vDN/PZZoE=
+github.com/jhump/protoreflect v1.15.1 h1:HUMERORf3I3ZdX05WaQ6MIpd/NJ434hTp5YiKgfCL6c=
 github.com/jmespath/go-jmespath v0.4.0 h1:BEgLn5cpjn8UN1mAw4NjwDrS35OdebyEtFe+9YPoQUg=
 github.com/jmespath/go-jmespath v0.4.0/go.mod h1:T8mJZnbsbmF+m6zOOFylbeCJqk5+pHWvzYPziyZiYoo=
 github.com/jmespath/go-jmespath/internal/testify v1.5.1/go.mod h1:L3OGu8Wl2/fWfCI6z80xFu9LTZmf1ZRjMHUOPmWr69U=
-github.com/kevinburke/ssh_config v0.0.0-20201106050909-4977a11b4351 h1:DowS9hvgyYSX4TO5NpyC606/Z4SxnNYbT+WX27or6Ck=
-github.com/kevinburke/ssh_config v0.0.0-20201106050909-4977a11b4351/go.mod h1:CT57kijsi8u/K/BOFA39wgDQJ9CxiF4nAY/ojJ6r6mM=
-github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
+github.com/kevinburke/ssh_config v1.2.0 h1:x584FjTGwHzMwvHx18PXxbBVzfnxogHaAReU4gf13a4=
+github.com/kr/pretty v0.1.0 h1:L/CwN0zerZDmRFUapSPitk6f+Q3+0za1rQkzVuMiMFI=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
-github.com/kr/pretty v0.2.1 h1:Fmg33tUaq4/8ym9TJN1x7sLJnHVwhP33CNkpYV/7rwI=
-github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
+github.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
-github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
-github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
-github.com/kylelemons/godebug v0.0.0-20170820004349-d65d576e9348/go.mod h1:B69LEHPfb2qLo0BaaOLcbitczOKLWTsrBG9LczfCD4k=
 github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
-github.com/matryer/is v1.2.0/go.mod h1:2fLPjFQM9rhQ15aVEtbuwhJinnOqrmgXPNdZsdwlWXA=
-github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU=
 github.com/mattn/go-colorable v0.1.9/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
 github.com/mattn/go-colorable v0.1.12 h1:jF+Du6AlPIjs2BiUiQlKOX0rt3SujHxPnksPKZbaA40=
 github.com/mattn/go-colorable v0.1.12/go.mod h1:u5H1YNBxpqRaxsYJYSkiCWKzEfiAb1Gb520KVy5xxl4=
-github.com/mattn/go-isatty v0.0.3/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
 github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU=
 github.com/mattn/go-isatty v0.0.14 h1:yVuAays6BHfxijgZPzw+3Zlu5yQgKGP2/hcQbHb7S9Y=
 github.com/mattn/go-isatty v0.0.14/go.mod h1:7GGIvUiUoEMVVmxf/4nioHXj79iQHKdU27kJ6hsGG94=
-github.com/mitchellh/cli v1.1.5/go.mod h1:v8+iFts2sPIKUV1ltktPXMCC8fumSKFItNcD2cLtRR4=
-github.com/mitchellh/copystructure v1.0.0/go.mod h1:SNtv71yrdKgLRyLFxmLdkAbkKEFWgYaq1OVrnRcwhnw=
 github.com/mitchellh/copystructure v1.2.0 h1:vpKXTN4ewci03Vljg/q9QvCGUDttBOGBIa15WveJJGw=
 github.com/mitchellh/copystructure v1.2.0/go.mod h1:qLl+cE2AmVv+CoeAwDPye/v+N2HKCj9FbZEVFJRxO9s=
-github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
-github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
 github.com/mitchellh/go-testing-interface v1.14.1 h1:jrgshOhYAUVNMAJiKbEu7EqAwgJJ2JqpQmpLJOu07cU=
 github.com/mitchellh/go-testing-interface v1.14.1/go.mod h1:gfgS7OtZj6MA4U1UrDRp04twqAjfvlZyCfX3sDjEym8=
 github.com/mitchellh/go-wordwrap v1.0.0 h1:6GlHJ/LTGMrIJbwgdqdl2eEH8o+Exx/0m8ir9Gns0u4=
 github.com/mitchellh/go-wordwrap v1.0.0/go.mod h1:ZXFpozHsX6DPmq2I0TCekCxypsnAUbP2oI0UX1GXzOo=
 github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
 github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
-github.com/mitchellh/reflectwalk v1.0.0/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
 github.com/mitchellh/reflectwalk v1.0.2 h1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zxSIeXaQ=
 github.com/mitchellh/reflectwalk v1.0.2/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
-github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno=
 github.com/oklog/run v1.0.0 h1:Ru7dDtJNOyC66gQ5dQmaCa0qIsAUFY3sFpK1Xk8igrw=
 github.com/oklog/run v1.0.0/go.mod h1:dlhp/R75TPv97u0XWUtDeV/lRKWPKSdTuV0TZvrmrQA=
-github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pjbgf/sha1cd v0.3.0 h1:4D5XXmUUBUl/xQ6IjCkEAbqXskkq/4O7LmGn0AqMDs4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/posener/complete v1.1.1/go.mod h1:em0nMJCgc9GFtwrmVmEMR/ZL6WyhyjMBndrE9hABlRI=
-github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
-github.com/sergi/go-diff v1.1.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
 github.com/sergi/go-diff v1.2.0 h1:XU+rvMAioB0UC3q1MFrIQy4Vo5/4VsRDQQXHsEya6xQ=
-github.com/shopspring/decimal v1.2.0/go.mod h1:DKyhrW/HYNuLGql+MJL6WCR6knT2jwCFRcu2hWCYk4o=
-github.com/sirupsen/logrus v1.4.1/go.mod h1:ni0Sbl8bgC9z8RoU9G6nDWqqs/fq4eDPysMBDgk/93Q=
-github.com/spf13/cast v1.3.1/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE=
+github.com/skeema/knownhosts v1.2.0 h1:h9r9cf0+u7wSE+M183ZtMGgOJKiL96brpaz5ekfJCpM=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
-github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
-github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
 github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.2 h1:4jaiDzPyXQvSd7D0EjG45355tLlV3VOECpq10pLC+8s=
 github.com/stretchr/testify v1.7.2/go.mod h1:R6va5+xMeoiuVRoj+gSkQ7d3FALtqAAGI1FQKckRals=
 github.com/vmihailenco/msgpack v3.3.3+incompatible/go.mod h1:fy3FlTQTDXWkZ7Bh6AcGMlsjHatGryHQYUTf1ShIgkk=
 github.com/vmihailenco/msgpack v4.0.4+incompatible h1:dSLoQfGFAo3F6OoNhwUmLwVgaUXK79GlxNBwueZn0xI=
 github.com/vmihailenco/msgpack v4.0.4+incompatible/go.mod h1:fy3FlTQTDXWkZ7Bh6AcGMlsjHatGryHQYUTf1ShIgkk=
-github.com/vmihailenco/msgpack/v4 v4.3.12 h1:07s4sz9IReOgdikxLTKNbBdqDMLsjPKXwvCazn8G65U=
-github.com/vmihailenco/msgpack/v4 v4.3.12/go.mod h1:gborTTJjAo/GWTqqRjrLCn9pgNN+NXzzngzBKDPIqw4=
-github.com/vmihailenco/tagparser v0.1.1 h1:quXMXlA39OCbd2wAdTsGDlK9RkOk6Wuw+x37wVyIuWY=
-github.com/vmihailenco/tagparser v0.1.1/go.mod h1:OeAg3pn3UbLjkWt+rN9oFYB6u/cQgqMEUPoW2WPyhdI=
-github.com/xanzy/ssh-agent v0.3.0 h1:wUMzuKtKilRgBAD1sUb8gOwwRr2FGoBVumcjoOACClI=
-github.com/xanzy/ssh-agent v0.3.0/go.mod h1:3s9xbODqPuuhK9JV1R321M/FlMZSBvE5aY6eAcqrDh0=
+github.com/vmihailenco/msgpack/v5 v5.3.5 h1:5gO0H1iULLWGhs2H5tbAHIZTV8/cYafcFOr9znI5mJU=
+github.com/vmihailenco/msgpack/v5 v5.3.5/go.mod h1:7xyJ9e+0+9SaZT0Wt1RGleJXzli6Q/V5KbhBonMG9jc=
+github.com/vmihailenco/tagparser/v2 v2.0.0 h1:y09buUbR+b5aycVFQs/g70pqKVZNBmxwAhO7/IwNM9g=
+github.com/vmihailenco/tagparser/v2 v2.0.0/go.mod h1:Wri+At7QHww0WTrCBeu4J6bNtoV6mEfg5OIWRZA9qds=
+github.com/xanzy/ssh-agent v0.3.3 h1:+/15pJfg/RsTxqYcX6fHqOXZwwMP+2VyYWJeWM2qQFM=
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
-github.com/zclconf/go-cty v1.1.0/go.mod h1:xnAOWiHeOqg2nWS62VtQ7pbOu17FtxJNW8RLEih+O3s=
-github.com/zclconf/go-cty v1.13.1 h1:0a6bRwuiSHtAmqCqNOE+c2oHgepv0ctoxU4FUe43kwc=
-github.com/zclconf/go-cty v1.13.1/go.mod h1:YKQzy/7pZ7iq2jNFzy5go57xdxdWoLLpaEp4u238AE0=
-golang.org/x/crypto v0.0.0-20190219172222-a4c6cb3142f2/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
+github.com/zclconf/go-cty v1.14.0 h1:/Xrd39K7DXbHzlisFP9c4pHao4yyf+/Ug9LEz+Y/yhc=
+github.com/zclconf/go-cty v1.14.0/go.mod h1:VvMs5i0vgZdhYawQNq5kePSpLAoz8u1xvZgrPIxfnZE=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20200414173820-0848c9571904/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.0.0-20200820211705-5c72a883971a/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.0.0-20210322153248-0c34fe9e7dc2/go.mod h1:T9bdIzuCu7OtxOm1hfPfRQxPLYneinmdGuTeoZ9dtd4=
-golang.org/x/crypto v0.0.0-20210421170649-83a5a9bb288b/go.mod h1:T9bdIzuCu7OtxOm1hfPfRQxPLYneinmdGuTeoZ9dtd4=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/crypto v0.5.0/go.mod h1:NK/OQwhpMQP3MwtdjgLlYHnH9ebylxKWv3e0fK+mkQU=
-golang.org/x/crypto v0.8.0 h1:pd9TJtTueMTVQXzk8E2XESSMQDj/U7OUu0PqJqPXQjQ=
-golang.org/x/crypto v0.8.0/go.mod h1:mRqEX+O9/h5TFCrQhkgjo2yKi0yYA+9ecGkdQoHrywE=
-golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
-golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
-golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
-golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
+golang.org/x/crypto v0.3.1-0.20221117191849-2c476679df9a/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
+golang.org/x/crypto v0.7.0/go.mod h1:pYwdfH91IfpZVANVyUOhSIPZaFoJGxTFbZhFTx+dXZU=
+golang.org/x/crypto v0.14.0 h1:wBqGXzWJW6m1XrIKlAH0Hs1JJ7+9KBwnIO8v66Q9cHc=
+golang.org/x/crypto v0.14.0/go.mod h1:MVFd36DqK4CsrnJYDkBA3VC4m2GkXAM0PvzMCn4JQf4=
 golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
-golang.org/x/mod v0.7.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/mod v0.10.0 h1:lFO9qtOdlre5W1jxS3r/4szv2/6iXxScdzjoBMXNhYk=
-golang.org/x/mod v0.10.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20180811021610-c39426892332/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/mod v0.12.0 h1:rmsUpXtvNzj340zd98LZ4KntptpfRHwpFOHG188oHXc=
+golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20191009170851-d66e71096ffb/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200301022130-244492dfa37a/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20210119194325-5f4716e94777/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/net v0.0.0-20210326060303-6b1517762897/go.mod h1:uSPa2vr4CLtc/ILN5odXGNXS6mhrKVzTaCXzk9m6W3k=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.1.0/go.mod h1:Cx3nUiGt4eDBEyega/BKRp+/AlGL8hYe7U9odMt2Cco=
-golang.org/x/net v0.5.0/go.mod h1:DivGGAXEgPSlEBzxGzZI+ZLohi+xUj054jfeKui00ws=
-golang.org/x/net v0.9.0 h1:aWJ/m6xSmxWBx+V0XRHTlrYrPG56jKsLdTFmsSsCzOM=
-golang.org/x/net v0.9.0/go.mod h1:d48xBJpPfHeWQsugry2m+kC02ZBRGRgulfHnEXEuWns=
-golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
-golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
+golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY=
+golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
+golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc=
+golang.org/x/net v0.17.0 h1:pVaXccu2ozPjCXewfr1S7xza/zcXTity9cCdXQYSjIM=
+golang.org/x/net v0.17.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.1.0 h1:wsuoTGHzEhffawBOhz5CYhcrV4IdKZbEyZjBMuTp12o=
-golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190507160741-ecd444e8653b/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200116001909-b77594299b42/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200302150141-5c8b2ff67527/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210320140829-1e4c9ba3b0c4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210324051608-47abb6519492/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210502180810-71e4cd670f79/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210927094055-39ccf1dd6fa6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
@@ -272,76 +171,53 @@ golang.org/x/sys v0.0.0-20220503163025-988cb79eb6c6/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.4.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.7.0 h1:3jlCCIQZPdOYu1h8BkNvLz8Kgwtae2cagcG/VamtZRU=
-golang.org/x/sys v0.7.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.3.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.13.0 h1:Af8nKPmuFypiUBjVoU9V20FiaFXOcuZI21p0ycVYYGE=
+golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.1.0/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.4.0/go.mod h1:9P2UbLfCdcvo3p/nzKvsmas4TnlujnuoV9hGgYzW1lQ=
+golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
+golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
+golang.org/x/term v0.6.0/go.mod h1:m6U89DPEgQRMq3DNkDClhWw02AUbt2daBVO4cn4Hv9U=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.6.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.9.0 h1:2sjJmO8cDvYveuX97RDLsxlyUxLl+GHoLxBiRdHllBE=
-golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
+golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
+golang.org/x/text v0.8.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
+golang.org/x/text v0.13.0 h1:ablQoSUd0tRdKxZewP80B+BaqeKJuVhuRxj/dkrun3k=
+golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
-golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
-golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20200214201135-548b770e2dfa/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
+golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
 golang.org/x/tools v0.8.0 h1:vSDcovVPld282ceKgDimkRSC8kpaH1dgyc9UMzlt84Y=
 golang.org/x/tools v0.8.0/go.mod h1:JxBZ99ISMI5ViVkT1tr6tdNmXeTrcpVSD3vZ1RsRdN4=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
-google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
-google.golang.org/appengine v1.6.5/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
-google.golang.org/appengine v1.6.6 h1:lMO5rYAqUxkmaj76jAkRUvt5JZgFymx/+Q5Mzfivuhc=
-google.golang.org/appengine v1.6.6/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
-google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
-google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
-google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
-google.golang.org/genproto v0.0.0-20200904004341-0bd0a958aa1d h1:92D1fum1bJLKSdr11OJ+54YeCMCGYIygTA7R/YZxH5M=
-google.golang.org/genproto v0.0.0-20200904004341-0bd0a958aa1d/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
-google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
-google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
-google.golang.org/grpc v1.51.0 h1:E1eGv1FTqoLIdnBCZufiSHgKjlqG6fKFf6pPWtMTh8U=
-google.golang.org/grpc v1.51.0/go.mod h1:wgNDFcnuBGmxLKI/qn4T+m5BtEBYXJPvibbUPsAIPww=
-google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
-google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
-google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
-google.golang.org/protobuf v1.20.1-0.20200309200217-e05f789c0967/go.mod h1:A+miEFZTKqfCUM6K7xSMQL9OKL/b6hQv+e19PK+JZNE=
-google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzikPIcrTAo=
-google.golang.org/protobuf v1.22.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
-google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
-google.golang.org/protobuf v1.24.0/go.mod h1:r/3tXBNzIEhYS9I1OUVjXDlt8tc493IdKGjtUeSXeh4=
+google.golang.org/appengine v1.6.7 h1:FZR1q0exgwxzPzp/aF+VccGrSfxfPpkBqjIIEq3ru6c=
+google.golang.org/appengine v1.6.7/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20230525234030-28d5490b6b19 h1:0nDDozoAU19Qb2HwhXadU8OcsiO/09cnTqhUtq2MEOM=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20230525234030-28d5490b6b19/go.mod h1:66JfowdXAEgad5O9NnYcsNPLCPZJD++2L9X0PCMODrA=
+google.golang.org/grpc v1.57.0 h1:kfzNeI/klCGD2YPMUlaGNT3pxvYfga7smW3Vth8Zsiw=
+google.golang.org/grpc v1.57.0/go.mod h1:Sd+9RMTACXwmub0zcNY2c4arhtrbBYD1AUHI/dt16Mo=
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.28.1 h1:d0NfwRgPtno5B1Wa6L2DAG+KivqkdutMf1UhdNx175w=
-google.golang.org/protobuf v1.28.1/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
+google.golang.org/protobuf v1.31.0 h1:g0LDEJHgrBl9N9r17Ru3sqWhkIx2NB67okBHPwC7hs8=
+google.golang.org/protobuf v1.31.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127 h1:qIbj1fsPNlZgppZ+VLlY7N33q108Sa+fhmuc+sWQYwY=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
-gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
 gopkg.in/warnings.v0 v0.1.2 h1:wFXVbFY8DY5/xOe1ECiWdKCzZlxgshcYVNkBHstARME=
-gopkg.in/warnings.v0 v0.1.2/go.mod h1:jksf8JmL6Qr/oQM2OXTHunEvvTAsrWBLb6OOjuVWRNI=
-gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
diff --git a/.ci/providerlint/passes/AWSAT001/README.md b/.ci/providerlint/passes/AWSAT001/README.md
index 2c71f9dc51e..755f7529443 100644
--- a/.ci/providerlint/passes/AWSAT001/README.md
+++ b/.ci/providerlint/passes/AWSAT001/README.md
@@ -24,7 +24,7 @@ Otherwise, available ARN testing check functions include:
 ## Flagged Code
 
 ```go
-resource.TestMatchResourceAttr("aws_lb_listener.test", "certificate_arn", regexp.MustCompile(`^arn:[^:]+:acm:[^:]+:[^:]+:certificate/.+$`))
+resource.TestMatchResourceAttr("aws_lb_listener.test", "certificate_arn", regexache.MustCompile(`^arn:[^:]+:acm:[^:]+:[^:]+:certificate/.+$`))
 ```
 
 ## Passing Code
@@ -32,7 +32,7 @@ resource.TestMatchResourceAttr("aws_lb_listener.test", "certificate_arn", regexp
 ```go
 resource.TestCheckResourceAttrPair("aws_lb_listener.test", "certificate_arn", "aws_acm_certificate.test", "arn")
 
-acctest.MatchResourceAttrRegionalARN("aws_lb_listener.test", "certificate_arn", "acm", regexp.MustCompile(`certificate/.+`))
+acctest.MatchResourceAttrRegionalARN("aws_lb_listener.test", "certificate_arn", "acm", regexache.MustCompile(`certificate/.+`))
 ```
 
 ## Ignoring Check
@@ -41,5 +41,5 @@ The check can be ignored for a certain line via a `//lintignore:AWSAT001` commen
 
 ```go
 //lintignore:AWSAT001
-resource.TestMatchResourceAttr("aws_lb_listener.test", "certificate_arn", regexp.MustCompile(`^arn:[^:]+:acm:[^:]+:[^:]+:certificate/.+$`))
+resource.TestMatchResourceAttr("aws_lb_listener.test", "certificate_arn", regexache.MustCompile(`^arn:[^:]+:acm:[^:]+:[^:]+:certificate/.+$`))
 ```
diff --git a/.ci/providerlint/passes/AWSAT001/testdata/src/a/main.go b/.ci/providerlint/passes/AWSAT001/testdata/src/a/main.go
index c68c8187ef5..bde768f9f55 100644
--- a/.ci/providerlint/passes/AWSAT001/testdata/src/a/main.go
+++ b/.ci/providerlint/passes/AWSAT001/testdata/src/a/main.go
@@ -1,14 +1,13 @@
 package a
 
 import (
-	"regexp"
-
+	"github.com/YakDriver/regexache"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
 )
 
 const resourceName = `aws_example_thing.test`
 
-var testRegexp = regexp.MustCompile(`.*`)
+var testRegexp = regexache.MustCompile(`.*`)
 
 func f() {
 	/* Passing cases */
diff --git a/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/AUTHORS b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/AUTHORS
new file mode 100644
index 00000000000..2b00ddba0df
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/AUTHORS
@@ -0,0 +1,3 @@
+# This source code refers to The Go Authors for copyright purposes.
+# The master list of authors is in the main Go distribution,
+# visible at https://tip.golang.org/AUTHORS.
diff --git a/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/CONTRIBUTORS b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/CONTRIBUTORS
new file mode 100644
index 00000000000..1fbd3e976fa
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/CONTRIBUTORS
@@ -0,0 +1,3 @@
+# This source code was written by the Go contributors.
+# The master list of contributors is in the main Go distribution,
+# visible at https://tip.golang.org/CONTRIBUTORS.
diff --git a/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/LICENSE b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/LICENSE
new file mode 100644
index 00000000000..6a66aea5eaf
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/LICENSE
@@ -0,0 +1,27 @@
+Copyright (c) 2009 The Go Authors. All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are
+met:
+
+   * Redistributions of source code must retain the above copyright
+notice, this list of conditions and the following disclaimer.
+   * Redistributions in binary form must reproduce the above
+copyright notice, this list of conditions and the following disclaimer
+in the documentation and/or other materials provided with the
+distribution.
+   * Neither the name of Google Inc. nor the names of its
+contributors may be used to endorse or promote products derived from
+this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
diff --git a/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/PATENTS b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/PATENTS
new file mode 100644
index 00000000000..733099041f8
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/PATENTS
@@ -0,0 +1,22 @@
+Additional IP Rights Grant (Patents)
+
+"This implementation" means the copyrightable works distributed by
+Google as part of the Go project.
+
+Google hereby grants to You a perpetual, worldwide, non-exclusive,
+no-charge, royalty-free, irrevocable (except as stated in this section)
+patent license to make, have made, use, offer to sell, sell, import,
+transfer and otherwise run, modify and propagate the contents of this
+implementation of Go, where such license applies only to those patent
+claims, both currently owned or controlled by Google and acquired in
+the future, licensable by Google that are necessarily infringed by this
+implementation of Go.  This grant does not include claims that would be
+infringed only as a consequence of further modification of this
+implementation.  If you or your agent or exclusive licensee institute or
+order or agree to the institution of patent litigation against any
+entity (including a cross-claim or counterclaim in a lawsuit) alleging
+that this implementation of Go or any code incorporated within this
+implementation of Go constitutes direct or contributory patent
+infringement, or inducement of patent infringement, then any patent
+rights granted to you under this License for this implementation of Go
+shall terminate as of the date such litigation is filed.
diff --git a/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/bitcurves/bitcurve.go b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/bitcurves/bitcurve.go
new file mode 100644
index 00000000000..c85e6befeca
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/bitcurves/bitcurve.go
@@ -0,0 +1,381 @@
+package bitcurves
+
+// Copyright 2010 The Go Authors. All rights reserved.
+// Copyright 2011 ThePiachu. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// Package bitelliptic implements several Koblitz elliptic curves over prime
+// fields.
+
+// This package operates, internally, on Jacobian coordinates. For a given
+// (x, y) position on the curve, the Jacobian coordinates are (x1, y1, z1)
+// where x = x1/z1² and y = y1/z1³. The greatest speedups come when the whole
+// calculation can be performed within the transform (as in ScalarMult and
+// ScalarBaseMult). But even for Add and Double, it's faster to apply and
+// reverse the transform than to operate in affine coordinates.
+
+import (
+	"crypto/elliptic"
+	"io"
+	"math/big"
+	"sync"
+)
+
+// A BitCurve represents a Koblitz Curve with a=0.
+// See http://www.hyperelliptic.org/EFD/g1p/auto-shortw.html
+type BitCurve struct {
+	Name    string
+	P       *big.Int // the order of the underlying field
+	N       *big.Int // the order of the base point
+	B       *big.Int // the constant of the BitCurve equation
+	Gx, Gy  *big.Int // (x,y) of the base point
+	BitSize int      // the size of the underlying field
+}
+
+// Params returns the parameters of the given BitCurve (see BitCurve struct)
+func (bitCurve *BitCurve) Params() (cp *elliptic.CurveParams) {
+	cp = new(elliptic.CurveParams)
+	cp.Name = bitCurve.Name
+	cp.P = bitCurve.P
+	cp.N = bitCurve.N
+	cp.Gx = bitCurve.Gx
+	cp.Gy = bitCurve.Gy
+	cp.BitSize = bitCurve.BitSize
+	return cp
+}
+
+// IsOnCurve returns true if the given (x,y) lies on the BitCurve.
+func (bitCurve *BitCurve) IsOnCurve(x, y *big.Int) bool {
+	// y² = x³ + b
+	y2 := new(big.Int).Mul(y, y) //y²
+	y2.Mod(y2, bitCurve.P)       //y²%P
+
+	x3 := new(big.Int).Mul(x, x) //x²
+	x3.Mul(x3, x)                //x³
+
+	x3.Add(x3, bitCurve.B) //x³+B
+	x3.Mod(x3, bitCurve.P) //(x³+B)%P
+
+	return x3.Cmp(y2) == 0
+}
+
+// affineFromJacobian reverses the Jacobian transform. See the comment at the
+// top of the file.
+func (bitCurve *BitCurve) affineFromJacobian(x, y, z *big.Int) (xOut, yOut *big.Int) {
+	if z.Cmp(big.NewInt(0)) == 0 {
+		panic("bitcurve: Can't convert to affine with Jacobian Z = 0")
+	}
+	// x = YZ^2 mod P
+	zinv := new(big.Int).ModInverse(z, bitCurve.P)
+	zinvsq := new(big.Int).Mul(zinv, zinv)
+
+	xOut = new(big.Int).Mul(x, zinvsq)
+	xOut.Mod(xOut, bitCurve.P)
+	// y = YZ^3 mod P
+	zinvsq.Mul(zinvsq, zinv)
+	yOut = new(big.Int).Mul(y, zinvsq)
+	yOut.Mod(yOut, bitCurve.P)
+	return xOut, yOut
+}
+
+// Add returns the sum of (x1,y1) and (x2,y2)
+func (bitCurve *BitCurve) Add(x1, y1, x2, y2 *big.Int) (*big.Int, *big.Int) {
+	z := new(big.Int).SetInt64(1)
+	x, y, z := bitCurve.addJacobian(x1, y1, z, x2, y2, z)
+	return bitCurve.affineFromJacobian(x, y, z)
+}
+
+// addJacobian takes two points in Jacobian coordinates, (x1, y1, z1) and
+// (x2, y2, z2) and returns their sum, also in Jacobian form.
+func (bitCurve *BitCurve) addJacobian(x1, y1, z1, x2, y2, z2 *big.Int) (*big.Int, *big.Int, *big.Int) {
+	// See http://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-0.html#addition-add-2007-bl
+	z1z1 := new(big.Int).Mul(z1, z1)
+	z1z1.Mod(z1z1, bitCurve.P)
+	z2z2 := new(big.Int).Mul(z2, z2)
+	z2z2.Mod(z2z2, bitCurve.P)
+
+	u1 := new(big.Int).Mul(x1, z2z2)
+	u1.Mod(u1, bitCurve.P)
+	u2 := new(big.Int).Mul(x2, z1z1)
+	u2.Mod(u2, bitCurve.P)
+	h := new(big.Int).Sub(u2, u1)
+	if h.Sign() == -1 {
+		h.Add(h, bitCurve.P)
+	}
+	i := new(big.Int).Lsh(h, 1)
+	i.Mul(i, i)
+	j := new(big.Int).Mul(h, i)
+
+	s1 := new(big.Int).Mul(y1, z2)
+	s1.Mul(s1, z2z2)
+	s1.Mod(s1, bitCurve.P)
+	s2 := new(big.Int).Mul(y2, z1)
+	s2.Mul(s2, z1z1)
+	s2.Mod(s2, bitCurve.P)
+	r := new(big.Int).Sub(s2, s1)
+	if r.Sign() == -1 {
+		r.Add(r, bitCurve.P)
+	}
+	r.Lsh(r, 1)
+	v := new(big.Int).Mul(u1, i)
+
+	x3 := new(big.Int).Set(r)
+	x3.Mul(x3, x3)
+	x3.Sub(x3, j)
+	x3.Sub(x3, v)
+	x3.Sub(x3, v)
+	x3.Mod(x3, bitCurve.P)
+
+	y3 := new(big.Int).Set(r)
+	v.Sub(v, x3)
+	y3.Mul(y3, v)
+	s1.Mul(s1, j)
+	s1.Lsh(s1, 1)
+	y3.Sub(y3, s1)
+	y3.Mod(y3, bitCurve.P)
+
+	z3 := new(big.Int).Add(z1, z2)
+	z3.Mul(z3, z3)
+	z3.Sub(z3, z1z1)
+	if z3.Sign() == -1 {
+		z3.Add(z3, bitCurve.P)
+	}
+	z3.Sub(z3, z2z2)
+	if z3.Sign() == -1 {
+		z3.Add(z3, bitCurve.P)
+	}
+	z3.Mul(z3, h)
+	z3.Mod(z3, bitCurve.P)
+
+	return x3, y3, z3
+}
+
+// Double returns 2*(x,y)
+func (bitCurve *BitCurve) Double(x1, y1 *big.Int) (*big.Int, *big.Int) {
+	z1 := new(big.Int).SetInt64(1)
+	return bitCurve.affineFromJacobian(bitCurve.doubleJacobian(x1, y1, z1))
+}
+
+// doubleJacobian takes a point in Jacobian coordinates, (x, y, z), and
+// returns its double, also in Jacobian form.
+func (bitCurve *BitCurve) doubleJacobian(x, y, z *big.Int) (*big.Int, *big.Int, *big.Int) {
+	// See http://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-0.html#doubling-dbl-2009-l
+
+	a := new(big.Int).Mul(x, x) //X1²
+	b := new(big.Int).Mul(y, y) //Y1²
+	c := new(big.Int).Mul(b, b) //B²
+
+	d := new(big.Int).Add(x, b) //X1+B
+	d.Mul(d, d)                 //(X1+B)²
+	d.Sub(d, a)                 //(X1+B)²-A
+	d.Sub(d, c)                 //(X1+B)²-A-C
+	d.Mul(d, big.NewInt(2))     //2*((X1+B)²-A-C)
+
+	e := new(big.Int).Mul(big.NewInt(3), a) //3*A
+	f := new(big.Int).Mul(e, e)             //E²
+
+	x3 := new(big.Int).Mul(big.NewInt(2), d) //2*D
+	x3.Sub(f, x3)                            //F-2*D
+	x3.Mod(x3, bitCurve.P)
+
+	y3 := new(big.Int).Sub(d, x3)                  //D-X3
+	y3.Mul(e, y3)                                  //E*(D-X3)
+	y3.Sub(y3, new(big.Int).Mul(big.NewInt(8), c)) //E*(D-X3)-8*C
+	y3.Mod(y3, bitCurve.P)
+
+	z3 := new(big.Int).Mul(y, z) //Y1*Z1
+	z3.Mul(big.NewInt(2), z3)    //3*Y1*Z1
+	z3.Mod(z3, bitCurve.P)
+
+	return x3, y3, z3
+}
+
+// TODO: double check if it is okay
+// ScalarMult returns k*(Bx,By) where k is a number in big-endian form.
+func (bitCurve *BitCurve) ScalarMult(Bx, By *big.Int, k []byte) (*big.Int, *big.Int) {
+	// We have a slight problem in that the identity of the group (the
+	// point at infinity) cannot be represented in (x, y) form on a finite
+	// machine. Thus the standard add/double algorithm has to be tweaked
+	// slightly: our initial state is not the identity, but x, and we
+	// ignore the first true bit in |k|.  If we don't find any true bits in
+	// |k|, then we return nil, nil, because we cannot return the identity
+	// element.
+
+	Bz := new(big.Int).SetInt64(1)
+	x := Bx
+	y := By
+	z := Bz
+
+	seenFirstTrue := false
+	for _, byte := range k {
+		for bitNum := 0; bitNum < 8; bitNum++ {
+			if seenFirstTrue {
+				x, y, z = bitCurve.doubleJacobian(x, y, z)
+			}
+			if byte&0x80 == 0x80 {
+				if !seenFirstTrue {
+					seenFirstTrue = true
+				} else {
+					x, y, z = bitCurve.addJacobian(Bx, By, Bz, x, y, z)
+				}
+			}
+			byte <<= 1
+		}
+	}
+
+	if !seenFirstTrue {
+		return nil, nil
+	}
+
+	return bitCurve.affineFromJacobian(x, y, z)
+}
+
+// ScalarBaseMult returns k*G, where G is the base point of the group and k is
+// an integer in big-endian form.
+func (bitCurve *BitCurve) ScalarBaseMult(k []byte) (*big.Int, *big.Int) {
+	return bitCurve.ScalarMult(bitCurve.Gx, bitCurve.Gy, k)
+}
+
+var mask = []byte{0xff, 0x1, 0x3, 0x7, 0xf, 0x1f, 0x3f, 0x7f}
+
+// TODO: double check if it is okay
+// GenerateKey returns a public/private key pair. The private key is generated
+// using the given reader, which must return random data.
+func (bitCurve *BitCurve) GenerateKey(rand io.Reader) (priv []byte, x, y *big.Int, err error) {
+	byteLen := (bitCurve.BitSize + 7) >> 3
+	priv = make([]byte, byteLen)
+
+	for x == nil {
+		_, err = io.ReadFull(rand, priv)
+		if err != nil {
+			return
+		}
+		// We have to mask off any excess bits in the case that the size of the
+		// underlying field is not a whole number of bytes.
+		priv[0] &= mask[bitCurve.BitSize%8]
+		// This is because, in tests, rand will return all zeros and we don't
+		// want to get the point at infinity and loop forever.
+		priv[1] ^= 0x42
+		x, y = bitCurve.ScalarBaseMult(priv)
+	}
+	return
+}
+
+// Marshal converts a point into the form specified in section 4.3.6 of ANSI
+// X9.62.
+func (bitCurve *BitCurve) Marshal(x, y *big.Int) []byte {
+	byteLen := (bitCurve.BitSize + 7) >> 3
+
+	ret := make([]byte, 1+2*byteLen)
+	ret[0] = 4 // uncompressed point
+
+	xBytes := x.Bytes()
+	copy(ret[1+byteLen-len(xBytes):], xBytes)
+	yBytes := y.Bytes()
+	copy(ret[1+2*byteLen-len(yBytes):], yBytes)
+	return ret
+}
+
+// Unmarshal converts a point, serialised by Marshal, into an x, y pair. On
+// error, x = nil.
+func (bitCurve *BitCurve) Unmarshal(data []byte) (x, y *big.Int) {
+	byteLen := (bitCurve.BitSize + 7) >> 3
+	if len(data) != 1+2*byteLen {
+		return
+	}
+	if data[0] != 4 { // uncompressed form
+		return
+	}
+	x = new(big.Int).SetBytes(data[1 : 1+byteLen])
+	y = new(big.Int).SetBytes(data[1+byteLen:])
+	return
+}
+
+//curve parameters taken from:
+//http://www.secg.org/collateral/sec2_final.pdf
+
+var initonce sync.Once
+var secp160k1 *BitCurve
+var secp192k1 *BitCurve
+var secp224k1 *BitCurve
+var secp256k1 *BitCurve
+
+func initAll() {
+	initS160()
+	initS192()
+	initS224()
+	initS256()
+}
+
+func initS160() {
+	// See SEC 2 section 2.4.1
+	secp160k1 = new(BitCurve)
+	secp160k1.Name = "secp160k1"
+	secp160k1.P, _ = new(big.Int).SetString("FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFAC73", 16)
+	secp160k1.N, _ = new(big.Int).SetString("0100000000000000000001B8FA16DFAB9ACA16B6B3", 16)
+	secp160k1.B, _ = new(big.Int).SetString("0000000000000000000000000000000000000007", 16)
+	secp160k1.Gx, _ = new(big.Int).SetString("3B4C382CE37AA192A4019E763036F4F5DD4D7EBB", 16)
+	secp160k1.Gy, _ = new(big.Int).SetString("938CF935318FDCED6BC28286531733C3F03C4FEE", 16)
+	secp160k1.BitSize = 160
+}
+
+func initS192() {
+	// See SEC 2 section 2.5.1
+	secp192k1 = new(BitCurve)
+	secp192k1.Name = "secp192k1"
+	secp192k1.P, _ = new(big.Int).SetString("FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFEE37", 16)
+	secp192k1.N, _ = new(big.Int).SetString("FFFFFFFFFFFFFFFFFFFFFFFE26F2FC170F69466A74DEFD8D", 16)
+	secp192k1.B, _ = new(big.Int).SetString("000000000000000000000000000000000000000000000003", 16)
+	secp192k1.Gx, _ = new(big.Int).SetString("DB4FF10EC057E9AE26B07D0280B7F4341DA5D1B1EAE06C7D", 16)
+	secp192k1.Gy, _ = new(big.Int).SetString("9B2F2F6D9C5628A7844163D015BE86344082AA88D95E2F9D", 16)
+	secp192k1.BitSize = 192
+}
+
+func initS224() {
+	// See SEC 2 section 2.6.1
+	secp224k1 = new(BitCurve)
+	secp224k1.Name = "secp224k1"
+	secp224k1.P, _ = new(big.Int).SetString("FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFE56D", 16)
+	secp224k1.N, _ = new(big.Int).SetString("010000000000000000000000000001DCE8D2EC6184CAF0A971769FB1F7", 16)
+	secp224k1.B, _ = new(big.Int).SetString("00000000000000000000000000000000000000000000000000000005", 16)
+	secp224k1.Gx, _ = new(big.Int).SetString("A1455B334DF099DF30FC28A169A467E9E47075A90F7E650EB6B7A45C", 16)
+	secp224k1.Gy, _ = new(big.Int).SetString("7E089FED7FBA344282CAFBD6F7E319F7C0B0BD59E2CA4BDB556D61A5", 16)
+	secp224k1.BitSize = 224
+}
+
+func initS256() {
+	// See SEC 2 section 2.7.1
+	secp256k1 = new(BitCurve)
+	secp256k1.Name = "secp256k1"
+	secp256k1.P, _ = new(big.Int).SetString("FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFC2F", 16)
+	secp256k1.N, _ = new(big.Int).SetString("FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141", 16)
+	secp256k1.B, _ = new(big.Int).SetString("0000000000000000000000000000000000000000000000000000000000000007", 16)
+	secp256k1.Gx, _ = new(big.Int).SetString("79BE667EF9DCBBAC55A06295CE870B07029BFCDB2DCE28D959F2815B16F81798", 16)
+	secp256k1.Gy, _ = new(big.Int).SetString("483ADA7726A3C4655DA4FBFC0E1108A8FD17B448A68554199C47D08FFB10D4B8", 16)
+	secp256k1.BitSize = 256
+}
+
+// S160 returns a BitCurve which implements secp160k1 (see SEC 2 section 2.4.1)
+func S160() *BitCurve {
+	initonce.Do(initAll)
+	return secp160k1
+}
+
+// S192 returns a BitCurve which implements secp192k1 (see SEC 2 section 2.5.1)
+func S192() *BitCurve {
+	initonce.Do(initAll)
+	return secp192k1
+}
+
+// S224 returns a BitCurve which implements secp224k1 (see SEC 2 section 2.6.1)
+func S224() *BitCurve {
+	initonce.Do(initAll)
+	return secp224k1
+}
+
+// S256 returns a BitCurve which implements bitcurves (see SEC 2 section 2.7.1)
+func S256() *BitCurve {
+	initonce.Do(initAll)
+	return secp256k1
+}
diff --git a/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/brainpool/brainpool.go b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/brainpool/brainpool.go
new file mode 100644
index 00000000000..cb6676de24b
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/brainpool/brainpool.go
@@ -0,0 +1,134 @@
+// Package brainpool implements Brainpool elliptic curves.
+// Implementation of rcurves is from github.com/ebfe/brainpool
+// Note that these curves are implemented with naive, non-constant time operations
+// and are likely not suitable for environments where timing attacks are a concern.
+package brainpool
+
+import (
+	"crypto/elliptic"
+	"math/big"
+	"sync"
+)
+
+var (
+	once                   sync.Once
+	p256t1, p384t1, p512t1 *elliptic.CurveParams
+	p256r1, p384r1, p512r1 *rcurve
+)
+
+func initAll() {
+	initP256t1()
+	initP384t1()
+	initP512t1()
+	initP256r1()
+	initP384r1()
+	initP512r1()
+}
+
+func initP256t1() {
+	p256t1 = &elliptic.CurveParams{Name: "brainpoolP256t1"}
+	p256t1.P, _ = new(big.Int).SetString("A9FB57DBA1EEA9BC3E660A909D838D726E3BF623D52620282013481D1F6E5377", 16)
+	p256t1.N, _ = new(big.Int).SetString("A9FB57DBA1EEA9BC3E660A909D838D718C397AA3B561A6F7901E0E82974856A7", 16)
+	p256t1.B, _ = new(big.Int).SetString("662C61C430D84EA4FE66A7733D0B76B7BF93EBC4AF2F49256AE58101FEE92B04", 16)
+	p256t1.Gx, _ = new(big.Int).SetString("A3E8EB3CC1CFE7B7732213B23A656149AFA142C47AAFBC2B79A191562E1305F4", 16)
+	p256t1.Gy, _ = new(big.Int).SetString("2D996C823439C56D7F7B22E14644417E69BCB6DE39D027001DABE8F35B25C9BE", 16)
+	p256t1.BitSize = 256
+}
+
+func initP256r1() {
+	twisted := p256t1
+	params := &elliptic.CurveParams{
+		Name:    "brainpoolP256r1",
+		P:       twisted.P,
+		N:       twisted.N,
+		BitSize: twisted.BitSize,
+	}
+	params.Gx, _ = new(big.Int).SetString("8BD2AEB9CB7E57CB2C4B482FFC81B7AFB9DE27E1E3BD23C23A4453BD9ACE3262", 16)
+	params.Gy, _ = new(big.Int).SetString("547EF835C3DAC4FD97F8461A14611DC9C27745132DED8E545C1D54C72F046997", 16)
+	z, _ := new(big.Int).SetString("3E2D4BD9597B58639AE7AA669CAB9837CF5CF20A2C852D10F655668DFC150EF0", 16)
+	p256r1 = newrcurve(twisted, params, z)
+}
+
+func initP384t1() {
+	p384t1 = &elliptic.CurveParams{Name: "brainpoolP384t1"}
+	p384t1.P, _ = new(big.Int).SetString("8CB91E82A3386D280F5D6F7E50E641DF152F7109ED5456B412B1DA197FB71123ACD3A729901D1A71874700133107EC53", 16)
+	p384t1.N, _ = new(big.Int).SetString("8CB91E82A3386D280F5D6F7E50E641DF152F7109ED5456B31F166E6CAC0425A7CF3AB6AF6B7FC3103B883202E9046565", 16)
+	p384t1.B, _ = new(big.Int).SetString("7F519EADA7BDA81BD826DBA647910F8C4B9346ED8CCDC64E4B1ABD11756DCE1D2074AA263B88805CED70355A33B471EE", 16)
+	p384t1.Gx, _ = new(big.Int).SetString("18DE98B02DB9A306F2AFCD7235F72A819B80AB12EBD653172476FECD462AABFFC4FF191B946A5F54D8D0AA2F418808CC", 16)
+	p384t1.Gy, _ = new(big.Int).SetString("25AB056962D30651A114AFD2755AD336747F93475B7A1FCA3B88F2B6A208CCFE469408584DC2B2912675BF5B9E582928", 16)
+	p384t1.BitSize = 384
+}
+
+func initP384r1() {
+	twisted := p384t1
+	params := &elliptic.CurveParams{
+		Name:    "brainpoolP384r1",
+		P:       twisted.P,
+		N:       twisted.N,
+		BitSize: twisted.BitSize,
+	}
+	params.Gx, _ = new(big.Int).SetString("1D1C64F068CF45FFA2A63A81B7C13F6B8847A3E77EF14FE3DB7FCAFE0CBD10E8E826E03436D646AAEF87B2E247D4AF1E", 16)
+	params.Gy, _ = new(big.Int).SetString("8ABE1D7520F9C2A45CB1EB8E95CFD55262B70B29FEEC5864E19C054FF99129280E4646217791811142820341263C5315", 16)
+	z, _ := new(big.Int).SetString("41DFE8DD399331F7166A66076734A89CD0D2BCDB7D068E44E1F378F41ECBAE97D2D63DBC87BCCDDCCC5DA39E8589291C", 16)
+	p384r1 = newrcurve(twisted, params, z)
+}
+
+func initP512t1() {
+	p512t1 = &elliptic.CurveParams{Name: "brainpoolP512t1"}
+	p512t1.P, _ = new(big.Int).SetString("AADD9DB8DBE9C48B3FD4E6AE33C9FC07CB308DB3B3C9D20ED6639CCA703308717D4D9B009BC66842AECDA12AE6A380E62881FF2F2D82C68528AA6056583A48F3", 16)
+	p512t1.N, _ = new(big.Int).SetString("AADD9DB8DBE9C48B3FD4E6AE33C9FC07CB308DB3B3C9D20ED6639CCA70330870553E5C414CA92619418661197FAC10471DB1D381085DDADDB58796829CA90069", 16)
+	p512t1.B, _ = new(big.Int).SetString("7CBBBCF9441CFAB76E1890E46884EAE321F70C0BCB4981527897504BEC3E36A62BCDFA2304976540F6450085F2DAE145C22553B465763689180EA2571867423E", 16)
+	p512t1.Gx, _ = new(big.Int).SetString("640ECE5C12788717B9C1BA06CBC2A6FEBA85842458C56DDE9DB1758D39C0313D82BA51735CDB3EA499AA77A7D6943A64F7A3F25FE26F06B51BAA2696FA9035DA", 16)
+	p512t1.Gy, _ = new(big.Int).SetString("5B534BD595F5AF0FA2C892376C84ACE1BB4E3019B71634C01131159CAE03CEE9D9932184BEEF216BD71DF2DADF86A627306ECFF96DBB8BACE198B61E00F8B332", 16)
+	p512t1.BitSize = 512
+}
+
+func initP512r1() {
+	twisted := p512t1
+	params := &elliptic.CurveParams{
+		Name:    "brainpoolP512r1",
+		P:       twisted.P,
+		N:       twisted.N,
+		BitSize: twisted.BitSize,
+	}
+	params.Gx, _ = new(big.Int).SetString("81AEE4BDD82ED9645A21322E9C4C6A9385ED9F70B5D916C1B43B62EEF4D0098EFF3B1F78E2D0D48D50D1687B93B97D5F7C6D5047406A5E688B352209BCB9F822", 16)
+	params.Gy, _ = new(big.Int).SetString("7DDE385D566332ECC0EABFA9CF7822FDF209F70024A57B1AA000C55B881F8111B2DCDE494A5F485E5BCA4BD88A2763AED1CA2B2FA8F0540678CD1E0F3AD80892", 16)
+	z, _ := new(big.Int).SetString("12EE58E6764838B69782136F0F2D3BA06E27695716054092E60A80BEDB212B64E585D90BCE13761F85C3F1D2A64E3BE8FEA2220F01EBA5EEB0F35DBD29D922AB", 16)
+	p512r1 = newrcurve(twisted, params, z)
+}
+
+// P256t1 returns a Curve which implements Brainpool P256t1 (see RFC 5639, section 3.4)
+func P256t1() elliptic.Curve {
+	once.Do(initAll)
+	return p256t1
+}
+
+// P256r1 returns a Curve which implements Brainpool P256r1 (see RFC 5639, section 3.4)
+func P256r1() elliptic.Curve {
+	once.Do(initAll)
+	return p256r1
+}
+
+// P384t1 returns a Curve which implements Brainpool P384t1 (see RFC 5639, section 3.6)
+func P384t1() elliptic.Curve {
+	once.Do(initAll)
+	return p384t1
+}
+
+// P384r1 returns a Curve which implements Brainpool P384r1 (see RFC 5639, section 3.6)
+func P384r1() elliptic.Curve {
+	once.Do(initAll)
+	return p384r1
+}
+
+// P512t1 returns a Curve which implements Brainpool P512t1 (see RFC 5639, section 3.7)
+func P512t1() elliptic.Curve {
+	once.Do(initAll)
+	return p512t1
+}
+
+// P512r1 returns a Curve which implements Brainpool P512r1 (see RFC 5639, section 3.7)
+func P512r1() elliptic.Curve {
+	once.Do(initAll)
+	return p512r1
+}
diff --git a/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/brainpool/rcurve.go b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/brainpool/rcurve.go
new file mode 100644
index 00000000000..7e291d6aa4e
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/brainpool/rcurve.go
@@ -0,0 +1,83 @@
+package brainpool
+
+import (
+	"crypto/elliptic"
+	"math/big"
+)
+
+var _ elliptic.Curve = (*rcurve)(nil)
+
+type rcurve struct {
+	twisted elliptic.Curve
+	params  *elliptic.CurveParams
+	z       *big.Int
+	zinv    *big.Int
+	z2      *big.Int
+	z3      *big.Int
+	zinv2   *big.Int
+	zinv3   *big.Int
+}
+
+var (
+	two   = big.NewInt(2)
+	three = big.NewInt(3)
+)
+
+func newrcurve(twisted elliptic.Curve, params *elliptic.CurveParams, z *big.Int) *rcurve {
+	zinv := new(big.Int).ModInverse(z, params.P)
+	return &rcurve{
+		twisted: twisted,
+		params:  params,
+		z:       z,
+		zinv:    zinv,
+		z2:      new(big.Int).Exp(z, two, params.P),
+		z3:      new(big.Int).Exp(z, three, params.P),
+		zinv2:   new(big.Int).Exp(zinv, two, params.P),
+		zinv3:   new(big.Int).Exp(zinv, three, params.P),
+	}
+}
+
+func (curve *rcurve) toTwisted(x, y *big.Int) (*big.Int, *big.Int) {
+	var tx, ty big.Int
+	tx.Mul(x, curve.z2)
+	tx.Mod(&tx, curve.params.P)
+	ty.Mul(y, curve.z3)
+	ty.Mod(&ty, curve.params.P)
+	return &tx, &ty
+}
+
+func (curve *rcurve) fromTwisted(tx, ty *big.Int) (*big.Int, *big.Int) {
+	var x, y big.Int
+	x.Mul(tx, curve.zinv2)
+	x.Mod(&x, curve.params.P)
+	y.Mul(ty, curve.zinv3)
+	y.Mod(&y, curve.params.P)
+	return &x, &y
+}
+
+func (curve *rcurve) Params() *elliptic.CurveParams {
+	return curve.params
+}
+
+func (curve *rcurve) IsOnCurve(x, y *big.Int) bool {
+	return curve.twisted.IsOnCurve(curve.toTwisted(x, y))
+}
+
+func (curve *rcurve) Add(x1, y1, x2, y2 *big.Int) (x, y *big.Int) {
+	tx1, ty1 := curve.toTwisted(x1, y1)
+	tx2, ty2 := curve.toTwisted(x2, y2)
+	return curve.fromTwisted(curve.twisted.Add(tx1, ty1, tx2, ty2))
+}
+
+func (curve *rcurve) Double(x1, y1 *big.Int) (x, y *big.Int) {
+	return curve.fromTwisted(curve.twisted.Double(curve.toTwisted(x1, y1)))
+}
+
+func (curve *rcurve) ScalarMult(x1, y1 *big.Int, scalar []byte) (x, y *big.Int) {
+	tx1, ty1 := curve.toTwisted(x1, y1)
+	return curve.fromTwisted(curve.twisted.ScalarMult(tx1, ty1, scalar))
+}
+
+func (curve *rcurve) ScalarBaseMult(scalar []byte) (x, y *big.Int) {
+	return curve.fromTwisted(curve.twisted.ScalarBaseMult(scalar))
+}
diff --git a/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/eax/eax.go b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/eax/eax.go
new file mode 100644
index 00000000000..3ae91d594cd
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/eax/eax.go
@@ -0,0 +1,162 @@
+// Copyright (C) 2019 ProtonTech AG
+
+// Package eax provides an implementation of the EAX
+// (encrypt-authenticate-translate) mode of operation, as described in
+// Bellare, Rogaway, and Wagner "THE EAX MODE OF OPERATION: A TWO-PASS
+// AUTHENTICATED-ENCRYPTION SCHEME OPTIMIZED FOR SIMPLICITY AND EFFICIENCY."
+// In FSE'04, volume 3017 of LNCS, 2004
+package eax
+
+import (
+	"crypto/cipher"
+	"crypto/subtle"
+	"errors"
+	"github.com/ProtonMail/go-crypto/internal/byteutil"
+)
+
+const (
+	defaultTagSize   = 16
+	defaultNonceSize = 16
+)
+
+type eax struct {
+	block     cipher.Block // Only AES-{128, 192, 256} supported
+	tagSize   int          // At least 12 bytes recommended
+	nonceSize int
+}
+
+func (e *eax) NonceSize() int {
+	return e.nonceSize
+}
+
+func (e *eax) Overhead() int {
+	return e.tagSize
+}
+
+// NewEAX returns an EAX instance with AES-{KEYLENGTH} and default nonce and
+// tag lengths. Supports {128, 192, 256}- bit key length.
+func NewEAX(block cipher.Block) (cipher.AEAD, error) {
+	return NewEAXWithNonceAndTagSize(block, defaultNonceSize, defaultTagSize)
+}
+
+// NewEAXWithNonceAndTagSize returns an EAX instance with AES-{keyLength} and
+// given nonce and tag lengths in bytes. Panics on zero nonceSize and
+// exceedingly long tags.
+//
+// It is recommended to use at least 12 bytes as tag length (see, for instance,
+// NIST SP 800-38D).
+//
+// Only to be used for compatibility with existing cryptosystems with
+// non-standard parameters. For all other cases, prefer NewEAX.
+func NewEAXWithNonceAndTagSize(
+	block cipher.Block, nonceSize, tagSize int) (cipher.AEAD, error) {
+	if nonceSize < 1 {
+		return nil, eaxError("Cannot initialize EAX with nonceSize = 0")
+	}
+	if tagSize > block.BlockSize() {
+		return nil, eaxError("Custom tag length exceeds blocksize")
+	}
+	return &eax{
+		block:     block,
+		tagSize:   tagSize,
+		nonceSize: nonceSize,
+	}, nil
+}
+
+func (e *eax) Seal(dst, nonce, plaintext, adata []byte) []byte {
+	if len(nonce) > e.nonceSize {
+		panic("crypto/eax: Nonce too long for this instance")
+	}
+	ret, out := byteutil.SliceForAppend(dst, len(plaintext)+e.tagSize)
+	omacNonce := e.omacT(0, nonce)
+	omacAdata := e.omacT(1, adata)
+
+	// Encrypt message using CTR mode and omacNonce as IV
+	ctr := cipher.NewCTR(e.block, omacNonce)
+	ciphertextData := out[:len(plaintext)]
+	ctr.XORKeyStream(ciphertextData, plaintext)
+
+	omacCiphertext := e.omacT(2, ciphertextData)
+
+	tag := out[len(plaintext):]
+	for i := 0; i < e.tagSize; i++ {
+		tag[i] = omacCiphertext[i] ^ omacNonce[i] ^ omacAdata[i]
+	}
+	return ret
+}
+
+func (e *eax) Open(dst, nonce, ciphertext, adata []byte) ([]byte, error) {
+	if len(nonce) > e.nonceSize {
+		panic("crypto/eax: Nonce too long for this instance")
+	}
+	if len(ciphertext) < e.tagSize {
+		return nil, eaxError("Ciphertext shorter than tag length")
+	}
+	sep := len(ciphertext) - e.tagSize
+
+	// Compute tag
+	omacNonce := e.omacT(0, nonce)
+	omacAdata := e.omacT(1, adata)
+	omacCiphertext := e.omacT(2, ciphertext[:sep])
+
+	tag := make([]byte, e.tagSize)
+	for i := 0; i < e.tagSize; i++ {
+		tag[i] = omacCiphertext[i] ^ omacNonce[i] ^ omacAdata[i]
+	}
+
+	// Compare tags
+	if subtle.ConstantTimeCompare(ciphertext[sep:], tag) != 1 {
+		return nil, eaxError("Tag authentication failed")
+	}
+
+	// Decrypt ciphertext
+	ret, out := byteutil.SliceForAppend(dst, len(ciphertext))
+	ctr := cipher.NewCTR(e.block, omacNonce)
+	ctr.XORKeyStream(out, ciphertext[:sep])
+
+	return ret[:sep], nil
+}
+
+// Tweakable OMAC - Calls OMAC_K([t]_n || plaintext)
+func (e *eax) omacT(t byte, plaintext []byte) []byte {
+	blockSize := e.block.BlockSize()
+	byteT := make([]byte, blockSize)
+	byteT[blockSize-1] = t
+	concat := append(byteT, plaintext...)
+	return e.omac(concat)
+}
+
+func (e *eax) omac(plaintext []byte) []byte {
+	blockSize := e.block.BlockSize()
+	// L ← E_K(0^n); B ← 2L; P ← 4L
+	L := make([]byte, blockSize)
+	e.block.Encrypt(L, L)
+	B := byteutil.GfnDouble(L)
+	P := byteutil.GfnDouble(B)
+
+	// CBC with IV = 0
+	cbc := cipher.NewCBCEncrypter(e.block, make([]byte, blockSize))
+	padded := e.pad(plaintext, B, P)
+	cbcCiphertext := make([]byte, len(padded))
+	cbc.CryptBlocks(cbcCiphertext, padded)
+
+	return cbcCiphertext[len(cbcCiphertext)-blockSize:]
+}
+
+func (e *eax) pad(plaintext, B, P []byte) []byte {
+	// if |M| in {n, 2n, 3n, ...}
+	blockSize := e.block.BlockSize()
+	if len(plaintext) != 0 && len(plaintext)%blockSize == 0 {
+		return byteutil.RightXor(plaintext, B)
+	}
+
+	// else return (M || 1 || 0^(n−1−(|M| % n))) xor→ P
+	ending := make([]byte, blockSize-len(plaintext)%blockSize)
+	ending[0] = 0x80
+	padded := append(plaintext, ending...)
+	return byteutil.RightXor(padded, P)
+}
+
+func eaxError(err string) error {
+	return errors.New("crypto/eax: " + err)
+}
diff --git a/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/eax/eax_test_vectors.go b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/eax/eax_test_vectors.go
new file mode 100644
index 00000000000..ddb53d07905
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/eax/eax_test_vectors.go
@@ -0,0 +1,58 @@
+package eax
+
+// Test vectors from
+// https://web.cs.ucdavis.edu/~rogaway/papers/eax.pdf
+var testVectors = []struct {
+	msg, key, nonce, header, ciphertext string
+}{
+	{"",
+		"233952DEE4D5ED5F9B9C6D6FF80FF478",
+		"62EC67F9C3A4A407FCB2A8C49031A8B3",
+		"6BFB914FD07EAE6B",
+		"E037830E8389F27B025A2D6527E79D01"},
+	{"F7FB",
+		"91945D3F4DCBEE0BF45EF52255F095A4",
+		"BECAF043B0A23D843194BA972C66DEBD",
+		"FA3BFD4806EB53FA",
+		"19DD5C4C9331049D0BDAB0277408F67967E5"},
+	{"1A47CB4933",
+		"01F74AD64077F2E704C0F60ADA3DD523",
+		"70C3DB4F0D26368400A10ED05D2BFF5E",
+		"234A3463C1264AC6",
+		"D851D5BAE03A59F238A23E39199DC9266626C40F80"},
+	{"481C9E39B1",
+		"D07CF6CBB7F313BDDE66B727AFD3C5E8",
+		"8408DFFF3C1A2B1292DC199E46B7D617",
+		"33CCE2EABFF5A79D",
+		"632A9D131AD4C168A4225D8E1FF755939974A7BEDE"},
+	{"40D0C07DA5E4",
+		"35B6D0580005BBC12B0587124557D2C2",
+		"FDB6B06676EEDC5C61D74276E1F8E816",
+		"AEB96EAEBE2970E9",
+		"071DFE16C675CB0677E536F73AFE6A14B74EE49844DD"},
+	{"4DE3B35C3FC039245BD1FB7D",
+		"BD8E6E11475E60B268784C38C62FEB22",
+		"6EAC5C93072D8E8513F750935E46DA1B",
+		"D4482D1CA78DCE0F",
+		"835BB4F15D743E350E728414ABB8644FD6CCB86947C5E10590210A4F"},
+	{"8B0A79306C9CE7ED99DAE4F87F8DD61636",
+		"7C77D6E813BED5AC98BAA417477A2E7D",
+		"1A8C98DCD73D38393B2BF1569DEEFC19",
+		"65D2017990D62528",
+		"02083E3979DA014812F59F11D52630DA30137327D10649B0AA6E1C181DB617D7F2"},
+	{"1BDA122BCE8A8DBAF1877D962B8592DD2D56",
+		"5FFF20CAFAB119CA2FC73549E20F5B0D",
+		"DDE59B97D722156D4D9AFF2BC7559826",
+		"54B9F04E6A09189A",
+		"2EC47B2C4954A489AFC7BA4897EDCDAE8CC33B60450599BD02C96382902AEF7F832A"},
+	{"6CF36720872B8513F6EAB1A8A44438D5EF11",
+		"A4A4782BCFFD3EC5E7EF6D8C34A56123",
+		"B781FCF2F75FA5A8DE97A9CA48E522EC",
+		"899A175897561D7E",
+		"0DE18FD0FDD91E7AF19F1D8EE8733938B1E8E7F6D2231618102FDB7FE55FF1991700"},
+	{"CA40D7446E545FFAED3BD12A740A659FFBBB3CEAB7",
+		"8395FCF1E95BEBD697BD010BC766AAC3",
+		"22E7ADD93CFC6393C57EC0B3C17D6B44",
+		"126735FCC320D25A",
+		"CB8920F87A6C75CFF39627B56E3ED197C552D295A7CFC46AFC253B4652B1AF3795B124AB6E"},
+}
diff --git a/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/eax/random_vectors.go b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/eax/random_vectors.go
new file mode 100644
index 00000000000..4eb19f28d9c
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/eax/random_vectors.go
@@ -0,0 +1,131 @@
+// These vectors include key length in {128, 192, 256}, tag size 128, and
+// random nonce, header, and plaintext lengths.
+
+// This file was automatically generated.
+
+package eax
+
+var randomVectors = []struct {
+	key, nonce, header, plaintext, ciphertext string
+}{
+	{"DFDE093F36B0356E5A81F609786982E3",
+		"1D8AC604419001816905BA72B14CED7E",
+		"152A1517A998D7A24163FCDD146DE81AC347C8B97088F502093C1ABB8F6E33D9A219C34D7603A18B1F5ABE02E56661B7D7F67E81EC08C1302EF38D80A859486D450E94A4F26AD9E68EEBBC0C857A0FC5CF9E641D63D565A7E361BC8908F5A8DC8FD6",
+		"1C8EAAB71077FE18B39730A3156ADE29C5EE824C7EE86ED2A253B775603FB237116E654F6FEC588DD27F523A0E01246FE73FE348491F2A8E9ABC6CA58D663F71CDBCF4AD798BE46C42AE6EE8B599DB44A1A48D7BBBBA0F7D2750181E1C5E66967F7D57CBD30AFBDA5727",
+		"79E7E150934BBEBF7013F61C60462A14D8B15AF7A248AFB8A344EF021C1500E16666891D6E973D8BB56B71A371F12CA34660C4410C016982B20F547E3762A58B7BF4F20236CADCF559E2BE7D783B13723B2741FC7CDC8997D839E39A3DDD2BADB96743DD7049F1BDB0516A262869915B3F70498AFB7B191BF960"},
+	{"F10619EF02E5D94D7550EB84ED364A21",
+		"8DC0D4F2F745BBAE835CC5574B942D20",
+		"FE561358F2E8DF7E1024FF1AE9A8D36EBD01352214505CB99D644777A8A1F6027FA2BDBFC529A9B91136D5F2416CFC5F0F4EC3A1AFD32BDDA23CA504C5A5CB451785FABF4DFE4CD50D817491991A60615B30286361C100A95D1712F2A45F8E374461F4CA2B",
+		"D7B5A971FC219631D30EFC3664AE3127D9CF3097DAD9C24AC7905D15E8D9B25B026B31D68CAE00975CDB81EB1FD96FD5E1A12E2BB83FA25F1B1D91363457657FC03875C27F2946C5",
+		"2F336ED42D3CC38FC61660C4CD60BA4BD438B05F5965D8B7B399D2E7167F5D34F792D318F94DB15D67463AC449E13D568CC09BFCE32A35EE3EE96A041927680AE329811811E27F2D1E8E657707AF99BA96D13A478D695D59"},
+	{"429F514EFC64D98A698A9247274CFF45",
+		"976AA5EB072F912D126ACEBC954FEC38",
+		"A71D89DC5B6CEDBB7451A27C3C2CAE09126DB4C421",
+		"5632FE62AB1DC549D54D3BC3FC868ACCEDEFD9ECF5E9F8",
+		"848AE4306CA8C7F416F8707625B7F55881C0AB430353A5C967CDA2DA787F581A70E34DBEBB2385"},
+	{"398138F309085F47F8457CDF53895A63",
+		"F8A8A7F2D28E5FFF7BBC2F24353F7A36",
+		"5D633C21BA7764B8855CAB586F3746E236AD486039C83C6B56EFA9C651D38A41D6B20DAEE3418BFEA44B8BD6",
+		"A3BBAA91920AF5E10659818B1B3B300AC79BFC129C8329E75251F73A66D3AE0128EB91D5031E0A65C329DB7D1E9C0493E268",
+		"D078097267606E5FB07CFB7E2B4B718172A82C6A4CEE65D549A4DFB9838003BD2FBF64A7A66988AC1A632FD88F9E9FBB57C5A78AD2E086EACBA3DB68511D81C2970A"},
+	{"7A4151EBD3901B42CBA45DAFB2E931BA",
+		"0FC88ACEE74DD538040321C330974EB8",
+		"250464FB04733BAB934C59E6AD2D6AE8D662CBCFEFBE61E5A308D4211E58C4C25935B72C69107722E946BFCBF416796600542D76AEB73F2B25BF53BAF97BDEB36ED3A7A51C31E7F170EB897457E7C17571D1BA0A908954E9",
+		"88C41F3EBEC23FAB8A362D969CAC810FAD4F7CA6A7F7D0D44F060F92E37E1183768DD4A8C733F71C96058D362A39876D183B86C103DE",
+		"74A25B2182C51096D48A870D80F18E1CE15867778E34FCBA6BD7BFB3739FDCD42AD0F2D9F4EBA29085285C6048C15BCE5E5166F1F962D3337AA88E6062F05523029D0A7F0BF9"},
+	{"BFB147E1CD5459424F8C0271FC0E0DC5",
+		"EABCC126442BF373969EA3015988CC45",
+		"4C0880E1D71AA2C7",
+		"BE1B5EC78FBF73E7A6682B21BA7E0E5D2D1C7ABE",
+		"5660D7C1380E2F306895B1402CB2D6C37876504276B414D120F4CF92FDDDBB293A238EA0"},
+	{"595DD6F52D18BC2CA8EB4EDAA18D9FA3",
+		"0F84B5D36CF4BC3B863313AF3B4D2E97",
+		"30AE6CC5F99580F12A779D98BD379A60948020C0B6FBD5746B30BA3A15C6CD33DAF376C70A9F15B6C0EB410A93161F7958AE23",
+		"8EF3687A1642B070970B0B91462229D1D76ABC154D18211F7152AA9FF368",
+		"317C1DDB11417E5A9CC4DDE7FDFF6659A5AC4B31DE025212580A05CDAC6024D3E4AE7C2966E52B9129E9ECDBED86"},
+	{"44E6F2DC8FDC778AD007137D11410F50",
+		"270A237AD977F7187AA6C158A0BAB24F",
+		"509B0F0EB12E2AA5C5BA2DE553C07FAF4CE0C9E926531AA709A3D6224FCB783ACCF1559E10B1123EBB7D52E8AB54E6B5352A9ED0D04124BF0E9D9BACFD7E32B817B2E625F5EE94A64EDE9E470DE7FE6886C19B294F9F828209FE257A78",
+		"8B3D7815DF25618A5D0C55A601711881483878F113A12EC36CF64900549A3199555528559DC118F789788A55FAFD944E6E99A9CA3F72F238CD3F4D88223F7A745992B3FAED1848",
+		"1CC00D79F7AD82FDA71B58D286E5F34D0CC4CEF30704E771CC1E50746BDF83E182B078DB27149A42BAE619DF0F85B0B1090AD55D3B4471B0D6F6ECCD09C8F876B30081F0E7537A9624F8AAF29DA85E324122EFB4D68A56"},
+	{"BB7BC352A03044B4428D8DBB4B0701FDEC4649FD17B81452",
+		"8B4BBE26CCD9859DCD84884159D6B0A4",
+		"2212BEB0E78E0F044A86944CF33C8D5C80D9DBE1034BF3BCF73611835C7D3A52F5BD2D81B68FD681B68540A496EE5DA16FD8AC8824E60E1EC2042BE28FB0BFAD4E4B03596446BDD8C37D936D9B3D5295BE19F19CF5ACE1D33A46C952CE4DE5C12F92C1DD051E04AEED",
+		"9037234CC44FFF828FABED3A7084AF40FA7ABFF8E0C0EFB57A1CC361E18FC4FAC1AB54F3ABFE9FF77263ACE16C3A",
+		"A9391B805CCD956081E0B63D282BEA46E7025126F1C1631239C33E92AA6F92CD56E5A4C56F00FF9658E93D48AF4EF0EF81628E34AD4DB0CDAEDCD2A17EE7"},
+	{"99C0AD703196D2F60A74E6B378B838B31F82EA861F06FC4E",
+		"92745C018AA708ECFEB1667E9F3F1B01",
+		"828C69F376C0C0EC651C67749C69577D589EE39E51404D80EBF70C8660A8F5FD375473F4A7C611D59CB546A605D67446CE2AA844135FCD78BB5FBC90222A00D42920BB1D7EEDFB0C4672554F583EF23184F89063CDECBE482367B5F9AF3ACBC3AF61392BD94CBCD9B64677",
+		"A879214658FD0A5B0E09836639BF82E05EC7A5EF71D4701934BDA228435C68AC3D5CEB54997878B06A655EEACEFB1345C15867E7FE6C6423660C8B88DF128EBD6BCD85118DBAE16E9252FFB204324E5C8F38CA97759BDBF3CB0083",
+		"51FE87996F194A2585E438B023B345439EA60D1AEBED4650CDAF48A4D4EEC4FC77DC71CC4B09D3BEEF8B7B7AF716CE2B4EFFB3AC9E6323C18AC35E0AA6E2BBBC8889490EB6226C896B0D105EAB42BFE7053CCF00ED66BA94C1BA09A792AA873F0C3B26C5C5F9A936E57B25"},
+	{"7086816D00D648FB8304AA8C9E552E1B69A9955FB59B25D1",
+		"0F45CF7F0BF31CCEB85D9DA10F4D749F",
+		"93F27C60A417D9F0669E86ACC784FC8917B502DAF30A6338F11B30B94D74FEFE2F8BE1BBE2EAD10FAB7EED3C6F72B7C3ECEE1937C32ED4970A6404E139209C05",
+		"877F046601F3CBE4FB1491943FA29487E738F94B99AF206262A1D6FF856C9AA0B8D4D08A54370C98F8E88FA3DCC2B14C1F76D71B2A4C7963AEE8AF960464C5BEC8357AD00DC8",
+		"FE96906B895CE6A8E72BC72344E2C8BB3C63113D70EAFA26C299BAFE77A8A6568172EB447FB3E86648A0AF3512DEB1AAC0819F3EC553903BF28A9FB0F43411237A774BF9EE03E445D280FBB9CD12B9BAAB6EF5E52691"},
+	{"062F65A896D5BF1401BADFF70E91B458E1F9BD4888CB2E4D",
+		"5B11EA1D6008EBB41CF892FCA5B943D1",
+		"BAF4FF5C8242",
+		"A8870E091238355984EB2F7D61A865B9170F440BFF999A5993DD41A10F4440D21FF948DDA2BF663B2E03AC3324492DC5E40262ECC6A65C07672353BE23E7FB3A9D79FF6AA38D97960905A38DECC312CB6A59E5467ECF06C311CD43ADC0B543EDF34FE8BE611F176460D5627CA51F8F8D9FED71F55C",
+		"B10E127A632172CF8AA7539B140D2C9C2590E6F28C3CB892FC498FCE56A34F732FBFF32E79C7B9747D9094E8635A0C084D6F0247F9768FB5FF83493799A9BEC6C39572120C40E9292C8C947AE8573462A9108C36D9D7112E6995AE5867E6C8BB387D1C5D4BEF524F391B9FD9F0A3B4BFA079E915BCD920185CFD38D114C558928BD7D47877"},
+	{"38A8E45D6D705A11AF58AED5A1344896998EACF359F2E26A",
+		"FD82B5B31804FF47D44199B533D0CF84",
+		"DE454D4E62FE879F2050EE3E25853623D3E9AC52EEC1A1779A48CFAF5ECA0BFDE44749391866D1",
+		"B804",
+		"164BB965C05EBE0931A1A63293EDF9C38C27"},
+	{"34C33C97C6D7A0850DA94D78A58DC61EC717CD7574833068",
+		"343BE00DA9483F05C14F2E9EB8EA6AE8",
+		"78312A43EFDE3CAE34A65796FF059A3FE15304EEA5CF1D9306949FE5BF3349D4977D4EBE76C040FE894C5949E4E4D6681153DA87FB9AC5062063CA2EA183566343362370944CE0362D25FC195E124FD60E8682E665D13F2229DDA3E4B2CB1DCA",
+		"CC11BB284B1153578E4A5ED9D937B869DAF00F5B1960C23455CA9CC43F486A3BE0B66254F1041F04FDF459C8640465B6E1D2CF899A381451E8E7FCB50CF87823BE77E24B132BBEEDC72E53369B275E1D8F49ECE59F4F215230AC4FE133FC80E4F634EE80BA4682B62C86",
+		"E7F703DC31A95E3A4919FF957836CB76C063D81702AEA4703E1C2BF30831E58C4609D626EC6810E12EAA5B930F049FF9EFC22C3E3F1EBD4A1FB285CB02A1AC5AD46B425199FC0A85670A5C4E3DAA9636C8F64C199F42F18AAC8EA7457FD377F322DD7752D7D01B946C8F0A97E6113F0D50106F319AFD291AAACE"},
+	{"C6ECF7F053573E403E61B83052A343D93CBCC179D1E835BE",
+		"E280E13D7367042E3AA09A80111B6184",
+		"21486C9D7A9647",
+		"5F2639AFA6F17931853791CD8C92382BBB677FD72D0AB1A080D0E49BFAA21810E963E4FACD422E92F65CBFAD5884A60CD94740DF31AF02F95AA57DA0C4401B0ED906",
+		"5C51DB20755302070C45F52E50128A67C8B2E4ED0EACB7E29998CCE2E8C289DD5655913EC1A51CC3AABE5CDC2402B2BE7D6D4BF6945F266FBD70BA9F37109067157AE7530678B45F64475D4EBFCB5FFF46A5"},
+	{"5EC6CF7401BC57B18EF154E8C38ACCA8959E57D2F3975FF5",
+		"656B41CB3F9CF8C08BAD7EBFC80BD225",
+		"6B817C2906E2AF425861A7EF59BA5801F143EE2A139EE72697CDE168B4",
+		"2C0E1DDC9B1E5389BA63845B18B1F8A1DB062037151BCC56EF7C21C0BB4DAE366636BBA975685D7CC5A94AFBE89C769016388C56FB7B57CE750A12B718A8BDCF70E80E8659A8330EFC8F86640F21735E8C80E23FE43ABF23507CE3F964AE4EC99D",
+		"ED780CF911E6D1AA8C979B889B0B9DC1ABE261832980BDBFB576901D9EF5AB8048998E31A15BE54B3E5845A4D136AD24D0BDA1C3006168DF2F8AC06729CB0818867398150020131D8F04EDF1923758C9EABB5F735DE5EA1758D4BC0ACFCA98AFD202E9839B8720253693B874C65586C6F0"},
+	{"C92F678EB2208662F5BCF3403EC05F5961E957908A3E79421E1D25FC19054153",
+		"DA0F3A40983D92F2D4C01FED33C7A192",
+		"2B6E9D26DB406A0FAB47608657AA10EFC2B4AA5F459B29FF85AC9A40BFFE7AEB04F77E9A11FAAA116D7F6D4DA417671A9AB02C588E0EF59CB1BFB4B1CC931B63A3B3A159FCEC97A04D1E6F0C7E6A9CEF6B0ABB04758A69F1FE754DF4C2610E8C46B6CF413BDB31351D55BEDCB7B4A13A1C98E10984475E0F2F957853",
+		"F37326A80E08",
+		"83519E53E321D334F7C10B568183775C0E9AAE55F806"},
+	{"6847E0491BE57E72995D186D50094B0B3593957A5146798FCE68B287B2FB37B5",
+		"3EE1182AEBB19A02B128F28E1D5F7F99",
+		"D9F35ABB16D776CE",
+		"DB7566ED8EA95BDF837F23DB277BAFBC5E70D1105ADFD0D9EF15475051B1EF94709C67DCA9F8D5",
+		"2CDCED0C9EBD6E2A508822A685F7DCD1CDD99E7A5FCA786C234E7F7F1D27EC49751AD5DCFA30C5EDA87C43CAE3B919B6BBCFE34C8EDA59"},
+	{"82B019673642C08388D3E42075A4D5D587558C229E4AB8F660E37650C4C41A0A",
+		"336F5D681E0410FAE7B607246092C6DC",
+		"D430CBD8FE435B64214E9E9CDC5DE99D31CFCFB8C10AA0587A49DF276611",
+		"998404153AD77003E1737EDE93ED79859EE6DCCA93CB40C4363AA817ABF2DBBD46E42A14A7183B6CC01E12A577888141363D0AE011EB6E8D28C0B235",
+		"9BEF69EEB60BD3D6065707B7557F25292A8872857CFBD24F2F3C088E4450995333088DA50FD9121221C504DF1D0CD5EFE6A12666C5D5BB12282CF4C19906E9CFAB97E9BDF7F49DC17CFC384B"},
+	{"747B2E269B1859F0622C15C8BAD6A725028B1F94B8DB7326948D1E6ED663A8BC",
+		"AB91F7245DDCE3F1C747872D47BE0A8A",
+		"3B03F786EF1DDD76E1D42646DA4CD2A5165DC5383CE86D1A0B5F13F910DC278A4E451EE0192CBA178E13B3BA27FDC7840DF73D2E104B",
+		"6B803F4701114F3E5FE21718845F8416F70F626303F545BE197189E0A2BA396F37CE06D389EB2658BC7D56D67868708F6D0D32",
+		"1570DDB0BCE75AA25D1957A287A2C36B1A5F2270186DA81BA6112B7F43B0F3D1D0ED072591DCF1F1C99BBB25621FC39B896FF9BD9413A2845363A9DCD310C32CF98E57"},
+	{"02E59853FB29AEDA0FE1C5F19180AD99A12FF2F144670BB2B8BADF09AD812E0A",
+		"C691294EF67CD04D1B9242AF83DD1421",
+		"879334DAE3",
+		"1E17F46A98FEF5CBB40759D95354",
+		"FED8C3FF27DDF6313AED444A2985B36CBA268AAD6AAC563C0BA28F6DB5DB"},
+	{"F6C1FB9B4188F2288FF03BD716023198C3582CF2A037FC2F29760916C2B7FCDB",
+		"4228DA0678CA3534588859E77DFF014C",
+		"D8153CAF35539A61DD8D05B3C9B44F01E564FB9348BCD09A1C23B84195171308861058F0A3CD2A55B912A3AAEE06FF4D356C77275828F2157C2FC7C115DA39E443210CCC56BEDB0CC99BBFB227ABD5CC454F4E7F547C7378A659EEB6A7E809101A84F866503CB18D4484E1FA09B3EC7FC75EB2E35270800AA7",
+		"23B660A779AD285704B12EC1C580387A47BEC7B00D452C6570",
+		"5AA642BBABA8E49849002A2FAF31DB8FC7773EFDD656E469CEC19B3206D4174C9A263D0A05484261F6"},
+	{"8FF6086F1FADB9A3FBE245EAC52640C43B39D43F89526BB5A6EBA47710931446",
+		"943188480C99437495958B0AE4831AA9",
+		"AD5CD0BDA426F6EBA23C8EB23DC73FF9FEC173355EDBD6C9344C4C4383F211888F7CE6B29899A6801DF6B38651A7C77150941A",
+		"80CD5EA8D7F81DDF5070B934937912E8F541A5301877528EB41AB60C020968D459960ED8FB73083329841A",
+		"ABAE8EB7F36FCA2362551E72DAC890BA1BB6794797E0FC3B67426EC9372726ED4725D379EA0AC9147E48DCD0005C502863C2C5358A38817C8264B5"},
+	{"A083B54E6B1FE01B65D42FCD248F97BB477A41462BBFE6FD591006C022C8FD84",
+		"B0490F5BD68A52459556B3749ACDF40E",
+		"8892E047DA5CFBBDF7F3CFCBD1BD21C6D4C80774B1826999234394BD3E513CC7C222BB40E1E3140A152F19B3802F0D036C24A590512AD0E8",
+		"D7B15752789DC94ED0F36778A5C7BBB207BEC32BAC66E702B39966F06E381E090C6757653C3D26A81EC6AD6C364D66867A334C91BB0B8A8A4B6EACDF0783D09010AEBA2DD2062308FE99CC1F",
+		"C071280A732ADC93DF272BF1E613B2BB7D46FC6665EF2DC1671F3E211D6BDE1D6ADDD28DF3AA2E47053FC8BB8AE9271EC8BC8B2CFFA320D225B451685B6D23ACEFDD241FE284F8ADC8DB07F456985B14330BBB66E0FB212213E05B3E"},
+}
diff --git a/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/internal/byteutil/byteutil.go b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/internal/byteutil/byteutil.go
new file mode 100644
index 00000000000..affb74a764d
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/internal/byteutil/byteutil.go
@@ -0,0 +1,90 @@
+// Copyright (C) 2019 ProtonTech AG
+// This file contains necessary tools for the aex and ocb packages.
+//
+// These functions SHOULD NOT be used elsewhere, since they are optimized for
+// specific input nature in the EAX and OCB modes of operation.
+
+package byteutil
+
+// GfnDouble computes 2 * input in the field of 2^n elements.
+// The irreducible polynomial in the finite field for n=128 is
+// x^128 + x^7 + x^2 + x + 1 (equals 0x87)
+// Constant-time execution in order to avoid side-channel attacks
+func GfnDouble(input []byte) []byte {
+	if len(input) != 16 {
+		panic("Doubling in GFn only implemented for n = 128")
+	}
+	// If the first bit is zero, return 2L = L << 1
+	// Else return (L << 1) xor 0^120 10000111
+	shifted := ShiftBytesLeft(input)
+	shifted[15] ^= ((input[0] >> 7) * 0x87)
+	return shifted
+}
+
+// ShiftBytesLeft outputs the byte array corresponding to x << 1 in binary.
+func ShiftBytesLeft(x []byte) []byte {
+	l := len(x)
+	dst := make([]byte, l)
+	for i := 0; i < l-1; i++ {
+		dst[i] = (x[i] << 1) | (x[i+1] >> 7)
+	}
+	dst[l-1] = x[l-1] << 1
+	return dst
+}
+
+// ShiftNBytesLeft puts in dst the byte array corresponding to x << n in binary.
+func ShiftNBytesLeft(dst, x []byte, n int) {
+	// Erase first n / 8 bytes
+	copy(dst, x[n/8:])
+
+	// Shift the remaining n % 8 bits
+	bits := uint(n % 8)
+	l := len(dst)
+	for i := 0; i < l-1; i++ {
+		dst[i] = (dst[i] << bits) | (dst[i+1] >> uint(8-bits))
+	}
+	dst[l-1] = dst[l-1] << bits
+
+	// Append trailing zeroes
+	dst = append(dst, make([]byte, n/8)...)
+}
+
+// XorBytesMut assumes equal input length, replaces X with X XOR Y
+func XorBytesMut(X, Y []byte) {
+	for i := 0; i < len(X); i++ {
+		X[i] ^= Y[i]
+	}
+}
+
+// XorBytes assumes equal input length, puts X XOR Y into Z
+func XorBytes(Z, X, Y []byte) {
+	for i := 0; i < len(X); i++ {
+		Z[i] = X[i] ^ Y[i]
+	}
+}
+
+// RightXor XORs smaller input (assumed Y) at the right of the larger input (assumed X)
+func RightXor(X, Y []byte) []byte {
+	offset := len(X) - len(Y)
+	xored := make([]byte, len(X))
+	copy(xored, X)
+	for i := 0; i < len(Y); i++ {
+		xored[offset+i] ^= Y[i]
+	}
+	return xored
+}
+
+// SliceForAppend takes a slice and a requested number of bytes. It returns a
+// slice with the contents of the given slice followed by that many bytes and a
+// second slice that aliases into it and contains only the extra bytes. If the
+// original slice has sufficient capacity then no allocation is performed.
+func SliceForAppend(in []byte, n int) (head, tail []byte) {
+	if total := len(in) + n; cap(in) >= total {
+		head = in[:total]
+	} else {
+		head = make([]byte, total)
+		copy(head, in)
+	}
+	tail = head[len(in):]
+	return
+}
diff --git a/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/ocb/ocb.go b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/ocb/ocb.go
new file mode 100644
index 00000000000..1a6f73502e6
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/ocb/ocb.go
@@ -0,0 +1,317 @@
+// Copyright (C) 2019 ProtonTech AG
+
+// Package ocb provides an implementation of the OCB (offset codebook) mode of
+// operation, as described in RFC-7253 of the IRTF and in Rogaway, Bellare,
+// Black and Krovetz - OCB: A BLOCK-CIPHER MODE OF OPERATION FOR EFFICIENT
+// AUTHENTICATED ENCRYPTION (2003).
+// Security considerations (from RFC-7253): A private key MUST NOT be used to
+// encrypt more than 2^48 blocks. Tag length should be at least 12 bytes (a
+// brute-force forging adversary succeeds after 2^{tag length} attempts). A
+// single key SHOULD NOT be used to decrypt ciphertext with different tag
+// lengths. Nonces need not be secret, but MUST NOT be reused.
+// This package only supports underlying block ciphers with 128-bit blocks,
+// such as AES-{128, 192, 256}, but may be extended to other sizes.
+package ocb
+
+import (
+	"bytes"
+	"crypto/cipher"
+	"crypto/subtle"
+	"errors"
+	"github.com/ProtonMail/go-crypto/internal/byteutil"
+	"math/bits"
+)
+
+type ocb struct {
+	block     cipher.Block
+	tagSize   int
+	nonceSize int
+	mask      mask
+	// Optimized en/decrypt: For each nonce N used to en/decrypt, the 'Ktop'
+	// internal variable can be reused for en/decrypting with nonces sharing
+	// all but the last 6 bits with N. The prefix of the first nonce used to
+	// compute the new Ktop, and the Ktop value itself, are stored in
+	// reusableKtop. If using incremental nonces, this saves one block cipher
+	// call every 63 out of 64 OCB encryptions, and stores one nonce and one
+	// output of the block cipher in memory only.
+	reusableKtop reusableKtop
+}
+
+type mask struct {
+	// L_*, L_$, (L_i)_{i ∈ N}
+	lAst []byte
+	lDol []byte
+	L    [][]byte
+}
+
+type reusableKtop struct {
+	noncePrefix []byte
+	Ktop        []byte
+}
+
+const (
+	defaultTagSize   = 16
+	defaultNonceSize = 15
+)
+
+const (
+	enc = iota
+	dec
+)
+
+func (o *ocb) NonceSize() int {
+	return o.nonceSize
+}
+
+func (o *ocb) Overhead() int {
+	return o.tagSize
+}
+
+// NewOCB returns an OCB instance with the given block cipher and default
+// tag and nonce sizes.
+func NewOCB(block cipher.Block) (cipher.AEAD, error) {
+	return NewOCBWithNonceAndTagSize(block, defaultNonceSize, defaultTagSize)
+}
+
+// NewOCBWithNonceAndTagSize returns an OCB instance with the given block
+// cipher, nonce length, and tag length. Panics on zero nonceSize and
+// exceedingly long tag size.
+//
+// It is recommended to use at least 12 bytes as tag length.
+func NewOCBWithNonceAndTagSize(
+	block cipher.Block, nonceSize, tagSize int) (cipher.AEAD, error) {
+	if block.BlockSize() != 16 {
+		return nil, ocbError("Block cipher must have 128-bit blocks")
+	}
+	if nonceSize < 1 {
+		return nil, ocbError("Incorrect nonce length")
+	}
+	if nonceSize >= block.BlockSize() {
+		return nil, ocbError("Nonce length exceeds blocksize - 1")
+	}
+	if tagSize > block.BlockSize() {
+		return nil, ocbError("Custom tag length exceeds blocksize")
+	}
+	return &ocb{
+		block:     block,
+		tagSize:   tagSize,
+		nonceSize: nonceSize,
+		mask:      initializeMaskTable(block),
+		reusableKtop: reusableKtop{
+			noncePrefix: nil,
+			Ktop:        nil,
+		},
+	}, nil
+}
+
+func (o *ocb) Seal(dst, nonce, plaintext, adata []byte) []byte {
+	if len(nonce) > o.nonceSize {
+		panic("crypto/ocb: Incorrect nonce length given to OCB")
+	}
+	ret, out := byteutil.SliceForAppend(dst, len(plaintext)+o.tagSize)
+	o.crypt(enc, out, nonce, adata, plaintext)
+	return ret
+}
+
+func (o *ocb) Open(dst, nonce, ciphertext, adata []byte) ([]byte, error) {
+	if len(nonce) > o.nonceSize {
+		panic("Nonce too long for this instance")
+	}
+	if len(ciphertext) < o.tagSize {
+		return nil, ocbError("Ciphertext shorter than tag length")
+	}
+	sep := len(ciphertext) - o.tagSize
+	ret, out := byteutil.SliceForAppend(dst, len(ciphertext))
+	ciphertextData := ciphertext[:sep]
+	tag := ciphertext[sep:]
+	o.crypt(dec, out, nonce, adata, ciphertextData)
+	if subtle.ConstantTimeCompare(ret[sep:], tag) == 1 {
+		ret = ret[:sep]
+		return ret, nil
+	}
+	for i := range out {
+		out[i] = 0
+	}
+	return nil, ocbError("Tag authentication failed")
+}
+
+// On instruction enc (resp. dec), crypt is the encrypt (resp. decrypt)
+// function. It returns the resulting plain/ciphertext with the tag appended.
+func (o *ocb) crypt(instruction int, Y, nonce, adata, X []byte) []byte {
+	//
+	// Consider X as a sequence of 128-bit blocks
+	//
+	// Note: For encryption (resp. decryption), X is the plaintext (resp., the
+	// ciphertext without the tag).
+	blockSize := o.block.BlockSize()
+
+	//
+	// Nonce-dependent and per-encryption variables
+	//
+	// Zero out the last 6 bits of the nonce into truncatedNonce to see if Ktop
+	// is already computed.
+	truncatedNonce := make([]byte, len(nonce))
+	copy(truncatedNonce, nonce)
+	truncatedNonce[len(truncatedNonce)-1] &= 192
+	Ktop := make([]byte, blockSize)
+	if bytes.Equal(truncatedNonce, o.reusableKtop.noncePrefix) {
+		Ktop = o.reusableKtop.Ktop
+	} else {
+		// Nonce = num2str(TAGLEN mod 128, 7) || zeros(120 - bitlen(N)) || 1 || N
+		paddedNonce := append(make([]byte, blockSize-1-len(nonce)), 1)
+		paddedNonce = append(paddedNonce, truncatedNonce...)
+		paddedNonce[0] |= byte(((8 * o.tagSize) % (8 * blockSize)) << 1)
+		// Last 6 bits of paddedNonce are already zero. Encrypt into Ktop
+		paddedNonce[blockSize-1] &= 192
+		Ktop = paddedNonce
+		o.block.Encrypt(Ktop, Ktop)
+		o.reusableKtop.noncePrefix = truncatedNonce
+		o.reusableKtop.Ktop = Ktop
+	}
+
+	// Stretch = Ktop || ((lower half of Ktop) XOR (lower half of Ktop << 8))
+	xorHalves := make([]byte, blockSize/2)
+	byteutil.XorBytes(xorHalves, Ktop[:blockSize/2], Ktop[1:1+blockSize/2])
+	stretch := append(Ktop, xorHalves...)
+	bottom := int(nonce[len(nonce)-1] & 63)
+	offset := make([]byte, len(stretch))
+	byteutil.ShiftNBytesLeft(offset, stretch, bottom)
+	offset = offset[:blockSize]
+
+	//
+	// Process any whole blocks
+	//
+	// Note: For encryption Y is ciphertext || tag, for decryption Y is
+	// plaintext || tag.
+	checksum := make([]byte, blockSize)
+	m := len(X) / blockSize
+	for i := 0; i < m; i++ {
+		index := bits.TrailingZeros(uint(i + 1))
+		if len(o.mask.L)-1 < index {
+			o.mask.extendTable(index)
+		}
+		byteutil.XorBytesMut(offset, o.mask.L[bits.TrailingZeros(uint(i+1))])
+		blockX := X[i*blockSize : (i+1)*blockSize]
+		blockY := Y[i*blockSize : (i+1)*blockSize]
+		byteutil.XorBytes(blockY, blockX, offset)
+		switch instruction {
+		case enc:
+			o.block.Encrypt(blockY, blockY)
+			byteutil.XorBytesMut(blockY, offset)
+			byteutil.XorBytesMut(checksum, blockX)
+		case dec:
+			o.block.Decrypt(blockY, blockY)
+			byteutil.XorBytesMut(blockY, offset)
+			byteutil.XorBytesMut(checksum, blockY)
+		}
+	}
+	//
+	// Process any final partial block and compute raw tag
+	//
+	tag := make([]byte, blockSize)
+	if len(X)%blockSize != 0 {
+		byteutil.XorBytesMut(offset, o.mask.lAst)
+		pad := make([]byte, blockSize)
+		o.block.Encrypt(pad, offset)
+		chunkX := X[blockSize*m:]
+		chunkY := Y[blockSize*m : len(X)]
+		byteutil.XorBytes(chunkY, chunkX, pad[:len(chunkX)])
+		// P_* || bit(1) || zeroes(127) - len(P_*)
+		switch instruction {
+		case enc:
+			paddedY := append(chunkX, byte(128))
+			paddedY = append(paddedY, make([]byte, blockSize-len(chunkX)-1)...)
+			byteutil.XorBytesMut(checksum, paddedY)
+		case dec:
+			paddedX := append(chunkY, byte(128))
+			paddedX = append(paddedX, make([]byte, blockSize-len(chunkY)-1)...)
+			byteutil.XorBytesMut(checksum, paddedX)
+		}
+		byteutil.XorBytes(tag, checksum, offset)
+		byteutil.XorBytesMut(tag, o.mask.lDol)
+		o.block.Encrypt(tag, tag)
+		byteutil.XorBytesMut(tag, o.hash(adata))
+		copy(Y[blockSize*m+len(chunkY):], tag[:o.tagSize])
+	} else {
+		byteutil.XorBytes(tag, checksum, offset)
+		byteutil.XorBytesMut(tag, o.mask.lDol)
+		o.block.Encrypt(tag, tag)
+		byteutil.XorBytesMut(tag, o.hash(adata))
+		copy(Y[blockSize*m:], tag[:o.tagSize])
+	}
+	return Y
+}
+
+// This hash function is used to compute the tag. Per design, on empty input it
+// returns a slice of zeros, of the same length as the underlying block cipher
+// block size.
+func (o *ocb) hash(adata []byte) []byte {
+	//
+	// Consider A as a sequence of 128-bit blocks
+	//
+	A := make([]byte, len(adata))
+	copy(A, adata)
+	blockSize := o.block.BlockSize()
+
+	//
+	// Process any whole blocks
+	//
+	sum := make([]byte, blockSize)
+	offset := make([]byte, blockSize)
+	m := len(A) / blockSize
+	for i := 0; i < m; i++ {
+		chunk := A[blockSize*i : blockSize*(i+1)]
+		index := bits.TrailingZeros(uint(i + 1))
+		// If the mask table is too short
+		if len(o.mask.L)-1 < index {
+			o.mask.extendTable(index)
+		}
+		byteutil.XorBytesMut(offset, o.mask.L[index])
+		byteutil.XorBytesMut(chunk, offset)
+		o.block.Encrypt(chunk, chunk)
+		byteutil.XorBytesMut(sum, chunk)
+	}
+
+	//
+	// Process any final partial block; compute final hash value
+	//
+	if len(A)%blockSize != 0 {
+		byteutil.XorBytesMut(offset, o.mask.lAst)
+		// Pad block with 1 || 0 ^ 127 - bitlength(a)
+		ending := make([]byte, blockSize-len(A)%blockSize)
+		ending[0] = 0x80
+		encrypted := append(A[blockSize*m:], ending...)
+		byteutil.XorBytesMut(encrypted, offset)
+		o.block.Encrypt(encrypted, encrypted)
+		byteutil.XorBytesMut(sum, encrypted)
+	}
+	return sum
+}
+
+func initializeMaskTable(block cipher.Block) mask {
+	//
+	// Key-dependent variables
+	//
+	lAst := make([]byte, block.BlockSize())
+	block.Encrypt(lAst, lAst)
+	lDol := byteutil.GfnDouble(lAst)
+	L := make([][]byte, 1)
+	L[0] = byteutil.GfnDouble(lDol)
+
+	return mask{
+		lAst: lAst,
+		lDol: lDol,
+		L:    L,
+	}
+}
+
+// Extends the L array of mask m up to L[limit], with L[i] = GfnDouble(L[i-1])
+func (m *mask) extendTable(limit int) {
+	for i := len(m.L); i <= limit; i++ {
+		m.L = append(m.L, byteutil.GfnDouble(m.L[i-1]))
+	}
+}
+
+func ocbError(err string) error {
+	return errors.New("crypto/ocb: " + err)
+}
diff --git a/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/ocb/random_vectors.go b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/ocb/random_vectors.go
new file mode 100644
index 00000000000..0efaf344fd5
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/ocb/random_vectors.go
@@ -0,0 +1,136 @@
+// In the test vectors provided by RFC 7253, the "bottom"
+// internal variable, which defines "offset" for the first time, does not
+// exceed 15. However, it can attain values up to 63.
+
+// These vectors include key length in {128, 192, 256}, tag size 128, and
+// random nonce, header, and plaintext lengths.
+
+// This file was automatically generated.
+
+package ocb
+
+var randomVectors = []struct {
+	key, nonce, header, plaintext, ciphertext string
+}{
+
+	{"9438C5D599308EAF13F800D2D31EA7F0",
+		"C38EE4801BEBFFA1CD8635BE",
+		"0E507B7DADD8A98CDFE272D3CB6B3E8332B56AE583FB049C0874D4200BED16BD1A044182434E9DA0E841F182DFD5B3016B34641CED0784F1745F63AB3D0DA22D3351C9EF9A658B8081E24498EBF61FCE40DA6D8E184536",
+		"962D227786FB8913A8BAD5DC3250",
+		"EEDEF5FFA5986D1E3BF86DDD33EF9ADC79DCA06E215FA772CCBA814F63AD"},
+	{"BA7DE631C7D6712167C6724F5B9A2B1D",
+		"35263EBDA05765DC0E71F1F5",
+		"0103257B4224507C0242FEFE821EA7FA42E0A82863E5F8B68F7D881B4B44FA428A2B6B21D2F591260802D8AB6D83",
+		"9D6D1FC93AE8A64E7889B7B2E3521EFA9B920A8DDB692E6F833DDC4A38AFA535E5E2A3ED82CB7E26404AB86C54D01C4668F28398C2DF33D5D561CBA1C8DCFA7A912F5048E545B59483C0E3221F54B14DAA2E4EB657B3BEF9554F34CAD69B2724AE962D3D8A",
+		"E93852D1985C5E775655E937FA79CE5BF28A585F2AF53A5018853B9634BE3C84499AC0081918FDCE0624494D60E25F76ACD6853AC7576E3C350F332249BFCABD4E73CEABC36BE4EDDA40914E598AE74174A0D7442149B26990899491BDDFE8FC54D6C18E83AE9E9A6FFBF5D376565633862EEAD88D"},
+	{"2E74B25289F6FD3E578C24866E9C72A5",
+		"FD912F15025AF8414642BA1D1D",
+		"FB5FB8C26F365EEDAB5FE260C6E3CCD27806729C8335F146063A7F9EA93290E56CF84576EB446350D22AD730547C267B1F0BBB97EB34E1E2C41A",
+		"6C092EBF78F76EE8C1C6E592277D9545BA16EDB67BC7D8480B9827702DC2F8A129E2B08A2CE710CA7E1DA45CE162BB6CD4B512E632116E2211D3C90871EFB06B8D4B902681C7FB",
+		"6AC0A77F26531BF4F354A1737F99E49BE32ECD909A7A71AD69352906F54B08A9CE9B8CA5D724CBFFC5673437F23F630697F3B84117A1431D6FA8CC13A974FB4AD360300522E09511B99E71065D5AC4BBCB1D791E864EF4"},
+	{"E7EC507C802528F790AFF5303A017B17",
+		"4B97A7A568940A9E3CE7A99E93031E",
+		"28349BDC5A09390C480F9B8AA3EDEA3DDB8B9D64BCA322C570B8225DF0E31190DAB25A4014BA39519E02ABFB12B89AA28BBFD29E486E7FB28734258C817B63CED9912DBAFEBB93E2798AB2890DE3B0ACFCFF906AB15563EF7823CE83D27CDB251195E22BD1337BCBDE65E7C2C427321C463C2777BFE5AEAA",
+		"9455B3EA706B74",
+		"7F33BA3EA848D48A96B9530E26888F43EBD4463C9399B6"},
+	{"6C928AA3224736F28EE7378DE0090191",
+		"8936138E2E4C6A13280017A1622D",
+		"6202717F2631565BDCDC57C6584543E72A7C8BD444D0D108ED35069819633C",
+		"DA0691439E5F035F3E455269D14FE5C201C8C9B0A3FE2D3F86BCC59387C868FE65733D388360B31E3CE28B4BF6A8BE636706B536D5720DB66B47CF1C7A5AFD6F61E0EF90F1726D6B0E169F9A768B2B7AE4EE00A17F630AC905FCAAA1B707FFF25B3A1AAE83B504837C64A5639B2A34002B300EC035C9B43654DA55",
+		"B8804D182AB0F0EEB464FA7BD1329AD6154F982013F3765FEDFE09E26DAC078C9C1439BFC1159D6C02A25E3FF83EF852570117B315852AD5EE20E0FA3AA0A626B0E43BC0CEA38B44579DD36803455FB46989B90E6D229F513FD727AF8372517E9488384C515D6067704119C931299A0982EDDFB9C2E86A90C450C077EB222511EC9CCABC9FCFDB19F70088"},
+	{"ECEA315CA4B3F425B0C9957A17805EA4",
+		"664CDAE18403F4F9BA13015A44FC",
+		"642AFB090D6C6DB46783F08B01A3EF2A8FEB5736B531EAC226E7888FCC8505F396818F83105065FACB3267485B9E5E4A0261F621041C08FCCB2A809A49AB5252A91D0971BCC620B9D614BD77E57A0EED2FA5",
+		"6852C31F8083E20E364CEA21BB7854D67CEE812FE1C9ED2425C0932A90D3780728D1BB",
+		"2ECEF962A9695A463ADABB275BDA9FF8B2BA57AEC2F52EFFB700CD9271A74D2A011C24AEA946051BD6291776429B7E681BA33E"},
+	{"4EE616C4A58AAA380878F71A373461F6",
+		"91B8C9C176D9C385E9C47E52",
+		"CDA440B7F9762C572A718AC754EDEECC119E5EE0CCB9FEA4FFB22EEE75087C032EBF3DA9CDD8A28CC010B99ED45143B41A4BA50EA2A005473F89639237838867A57F23B0F0ED3BF22490E4501DAC9C658A9B9F",
+		"D6E645FA9AE410D15B8123FD757FA356A8DBE9258DDB5BE88832E615910993F497EC",
+		"B70ED7BF959FB2AAED4F36174A2A99BFB16992C8CDF369C782C4DB9C73DE78C5DB8E0615F647243B97ACDB24503BC9CADC48"},
+	{"DCD475773136C830D5E3D0C5FE05B7FF",
+		"BB8E1FBB483BE7616A922C4A",
+		"36FEF2E1CB29E76A6EA663FC3AF66ECD7404F466382F7B040AABED62293302B56E8783EF7EBC21B4A16C3E78A7483A0A403F253A2CDC5BBF79DC3DAE6C73F39A961D8FBBE8D41B",
+		"441E886EA38322B2437ECA7DEB5282518865A66780A454E510878E61BFEC3106A3CD93D2A02052E6F9E1832F9791053E3B76BF4C07EFDD6D4106E3027FABB752E60C1AA425416A87D53938163817A1051EBA1D1DEEB4B9B25C7E97368B52E5911A31810B0EC5AF547559B6142D9F4C4A6EF24A4CF75271BF9D48F62B",
+		"1BE4DD2F4E25A6512C2CC71D24BBB07368589A94C2714962CD0ACE5605688F06342587521E75F0ACAFFD86212FB5C34327D238DB36CF2B787794B9A4412E7CD1410EA5DDD2450C265F29CF96013CD213FD2880657694D718558964BC189B4A84AFCF47EB012935483052399DBA5B088B0A0477F20DFE0E85DCB735E21F22A439FB837DD365A93116D063E607"},
+	{"3FBA2B3D30177FFE15C1C59ED2148BB2C091F5615FBA7C07",
+		"FACF804A4BEBF998505FF9DE",
+		"8213B9263B2971A5BDA18DBD02208EE1",
+		"15B323926993B326EA19F892D704439FC478828322AF72118748284A1FD8A6D814E641F70512FD706980337379F31DC63355974738D7FEA87AD2858C0C2EBBFBE74371C21450072373C7B651B334D7C4D43260B9D7CCD3AF9EDB",
+		"6D35DC1469B26E6AAB26272A41B46916397C24C485B61162E640A062D9275BC33DDCFD3D9E1A53B6C8F51AC89B66A41D59B3574197A40D9B6DCF8A4E2A001409C8112F16B9C389E0096179DB914E05D6D11ED0005AD17E1CE105A2F0BAB8F6B1540DEB968B7A5428FF44"},
+	{"53B52B8D4D748BCDF1DDE68857832FA46227FA6E2F32EFA1",
+		"0B0EF53D4606B28D1398355F",
+		"F23882436349094AF98BCACA8218E81581A043B19009E28EFBF2DE37883E04864148CC01D240552CA8844EC1456F42034653067DA67E80F87105FD06E14FF771246C9612867BE4D215F6D761",
+		"F15030679BD4088D42CAC9BF2E9606EAD4798782FA3ED8C57EBE7F84A53236F51B25967C6489D0CD20C9EEA752F9BC",
+		"67B96E2D67C3729C96DAEAEDF821D61C17E648643A2134C5621FEC621186915AD80864BFD1EB5B238BF526A679385E012A457F583AFA78134242E9D9C1B4E4"},
+	{"0272DD80F23399F49BFC320381A5CD8225867245A49A7D41",
+		"5C83F4896D0738E1366B1836",
+		"69B0337289B19F73A12BAEEA857CCAF396C11113715D9500CCCF48BA08CFF12BC8B4BADB3084E63B85719DB5058FA7C2C11DEB096D7943CFA7CAF5",
+		"C01AD10FC8B562CD17C7BC2FAB3E26CBDFF8D7F4DEA816794BBCC12336991712972F52816AABAB244EB43B0137E2BAC1DD413CE79531E78BEF782E6B439612BB3AEF154DE3502784F287958EBC159419F9EBA27916A28D6307324129F506B1DE80C1755A929F87",
+		"FEFE52DD7159C8DD6E8EC2D3D3C0F37AB6CB471A75A071D17EC4ACDD8F3AA4D7D4F7BB559F3C09099E3D9003E5E8AA1F556B79CECDE66F85B08FA5955E6976BF2695EA076388A62D2AD5BAB7CBF1A7F3F4C8D5CDF37CDE99BD3E30B685D9E5EEE48C7C89118EF4878EB89747F28271FA2CC45F8E9E7601"},
+	{"3EEAED04A455D6E5E5AB53CFD5AFD2F2BC625C7BF4BE49A5",
+		"36B88F63ADBB5668588181D774",
+		"D367E3CB3703E762D23C6533188EF7028EFF9D935A3977150361997EC9DEAF1E4794BDE26AA8B53C124980B1362EC86FCDDFC7A90073171C1BAEE351A53234B86C66E8AB92FAE99EC6967A6D3428892D80",
+		"573454C719A9A55E04437BF7CBAAF27563CCCD92ADD5E515CD63305DFF0687E5EEF790C5DCA5C0033E9AB129505E2775438D92B38F08F3B0356BA142C6F694",
+		"E9F79A5B432D9E682C9AAA5661CFC2E49A0FCB81A431E54B42EB73DD3BED3F377FEC556ABA81624BA64A5D739AD41467460088F8D4F442180A9382CA635745473794C382FCDDC49BA4EB6D8A44AE3C"},
+	{"B695C691538F8CBD60F039D0E28894E3693CC7C36D92D79D",
+		"BC099AEB637361BAC536B57618",
+		"BFFF1A65AE38D1DC142C71637319F5F6508E2CB33C9DCB94202B359ED5A5ED8042E7F4F09231D32A7242976677E6F4C549BF65FADC99E5AF43F7A46FD95E16C2",
+		"081DF3FD85B415D803F0BE5AC58CFF0023FDDED99788296C3731D8",
+		"E50C64E3614D94FE69C47092E46ACC9957C6FEA2CCBF96BC62FBABE7424753C75F9C147C42AE26FE171531"},
+	{"C9ACBD2718F0689A1BE9802A551B6B8D9CF5614DAF5E65ED",
+		"B1B0AAF373B8B026EB80422051D8",
+		"6648C0E61AC733C76119D23FB24548D637751387AA2EAE9D80E912B7BD486CAAD9EAF4D7A5FE2B54AAD481E8EC94BB4D558000896E2010462B70C9FED1E7273080D1",
+		"189F591F6CB6D59AFEDD14C341741A8F1037DC0DF00FC57CE65C30F49E860255CEA5DC6019380CC0FE8880BC1A9E685F41C239C38F36E3F2A1388865C5C311059C0A",
+		"922A5E949B61D03BE34AB5F4E58607D4504EA14017BB363DAE3C873059EA7A1C77A746FB78981671D26C2CF6D9F24952D510044CE02A10177E9DB42D0145211DFE6E84369C5E3BC2669EAB4147B2822895F9"},
+	{"7A832BD2CF5BF4919F353CE2A8C86A5E406DA2D52BE16A72",
+		"2F2F17CECF7E5A756D10785A3CB9DB",
+		"61DA05E3788CC2D8405DBA70C7A28E5AF699863C9F72E6C6770126929F5D6FA267F005EBCF49495CB46400958A3AE80D1289D1C671",
+		"44E91121195A41AF14E8CFDBD39A4B517BE0DF1A72977ED8A3EEF8EEDA1166B2EB6DB2C4AE2E74FA0F0C74537F659BFBD141E5DDEC67E64EDA85AABD3F52C85A785B9FB3CECD70E7DF",
+		"BEDF596EA21288D2B84901E188F6EE1468B14D5161D3802DBFE00D60203A24E2AB62714BF272A45551489838C3A7FEAADC177B591836E73684867CCF4E12901DCF2064058726BBA554E84ADC5136F507E961188D4AF06943D3"},
+	{"1508E8AE9079AA15F1CEC4F776B4D11BCCB061B58AA56C18",
+		"BCA625674F41D1E3AB47672DC0C3",
+		"8B12CF84F16360F0EAD2A41BC021530FFCEC7F3579CAE658E10E2D3D81870F65AFCED0C77C6C4C6E6BA424FF23088C796BA6195ABA35094BF1829E089662E7A95FC90750AE16D0C8AFA55DAC789D7735B970B58D4BE7CEC7341DA82A0179A01929C27A59C5063215B859EA43",
+		"E525422519ECE070E82C",
+		"B47BC07C3ED1C0A43BA52C43CBACBCDBB29CAF1001E09FDF7107"},
+	{"7550C2761644E911FE9ADD119BAC07376BEA442845FEAD876D7E7AC1B713E464",
+		"36D2EC25ADD33CDEDF495205BBC923",
+		"7FCFE81A3790DE97FFC3DE160C470847EA7E841177C2F759571CBD837EA004A6CA8C6F4AEBFF2E9FD552D73EB8A30705D58D70C0B67AEEA280CBBF0A477358ACEF1E7508F2735CD9A0E4F9AC92B8C008F575D3B6278F1C18BD01227E3502E5255F3AB1893632AD00C717C588EF652A51A43209E7EE90",
+		"2B1A62F8FDFAA3C16470A21AD307C9A7D03ADE8EF72C69B06F8D738CDE578D7AEFD0D40BD9C022FB9F580DF5394C998ACCCEFC5471A3996FB8F1045A81FDC6F32D13502EA65A211390C8D882B8E0BEFD8DD8CBEF51D1597B124E9F7F",
+		"C873E02A22DB89EB0787DB6A60B99F7E4A0A085D5C4232A81ADCE2D60AA36F92DDC33F93DD8640AC0E08416B187FB382B3EC3EE85A64B0E6EE41C1366A5AD2A282F66605E87031CCBA2FA7B2DA201D975994AADE3DD1EE122AE09604AD489B84BF0C1AB7129EE16C6934850E"},
+	{"A51300285E554FDBDE7F771A9A9A80955639DD87129FAEF74987C91FB9687C71",
+		"81691D5D20EC818FCFF24B33DECC",
+		"C948093218AA9EB2A8E44A87EEA73FC8B6B75A196819A14BD83709EA323E8DF8B491045220E1D88729A38DBCFFB60D3056DAD4564498FD6574F74512945DEB34B69329ACED9FFC05D5D59DFCD5B973E2ACAFE6AD1EF8BBBC49351A2DD12508ED89ED",
+		"EB861165DAF7625F827C6B574ED703F03215",
+		"C6CD1CE76D2B3679C1B5AA1CFD67CCB55444B6BFD3E22C81CBC9BB738796B83E54E3"},
+	{"8CE0156D26FAEB7E0B9B800BBB2E9D4075B5EAC5C62358B0E7F6FCE610223282",
+		"D2A7B94DD12CDACA909D3AD7",
+		"E021A78F374FC271389AB9A3E97077D755",
+		"7C26000B58929F5095E1CEE154F76C2A299248E299F9B5ADE6C403AA1FD4A67FD4E0232F214CE7B919EE7A1027D2B76C57475715CD078461",
+		"C556FB38DF069B56F337B5FF5775CE6EAA16824DFA754F20B78819028EA635C3BB7AA731DE8776B2DCB67DCA2D33EEDF3C7E52EA450013722A41755A0752433ED17BDD5991AAE77A"},
+	{"1E8000A2CE00A561C9920A30BF0D7B983FEF8A1014C8F04C35CA6970E6BA02BD",
+		"65ED3D63F79F90BBFD19775E",
+		"336A8C0B7243582A46B221AA677647FCAE91",
+		"134A8B34824A290E7B",
+		"914FBEF80D0E6E17F8BDBB6097EBF5FBB0554952DC2B9E5151"},
+	{"53D5607BBE690B6E8D8F6D97F3DF2BA853B682597A214B8AA0EA6E598650AF15",
+		"C391A856B9FE234E14BA1AC7BB40FF",
+		"479682BC21349C4BE1641D5E78FE2C79EC1B9CF5470936DCAD9967A4DCD7C4EFADA593BC9EDE71E6A08829B8580901B61E274227E9D918502DE3",
+		"EAD154DC09C5E26C5D26FF33ED148B27120C7F2C23225CC0D0631B03E1F6C6D96FEB88C1A4052ACB4CE746B884B6502931F407021126C6AAB8C514C077A5A38438AE88EE",
+		"938821286EBB671D999B87C032E1D6055392EB564E57970D55E545FC5E8BAB90E6E3E3C0913F6320995FC636D72CD9919657CC38BD51552F4A502D8D1FE56DB33EBAC5092630E69EBB986F0E15CEE9FC8C052501"},
+	{"294362FCC984F440CEA3E9F7D2C06AF20C53AAC1B3738CA2186C914A6E193ABB",
+		"B15B61C8BB39261A8F55AB178EC3",
+		"D0729B6B75BB",
+		"2BD089ADCE9F334BAE3B065996C7D616DD0C27DF4218DCEEA0FBCA0F968837CE26B0876083327E25681FDDD620A32EC0DA12F73FAE826CC94BFF2B90A54D2651",
+		"AC94B25E4E21DE2437B806966CCD5D9385EF0CD4A51AB9FA6DE675C7B8952D67802E9FEC1FDE9F5D1EAB06057498BC0EEA454804FC9D2068982A3E24182D9AC2E7AB9994DDC899A604264583F63D066B"},
+	{"959DBFEB039B1A5B8CE6A44649B602AAA5F98A906DB96143D202CD2024F749D9",
+		"01D7BDB1133E9C347486C1EFA6",
+		"F3843955BD741F379DD750585EDC55E2CDA05CCBA8C1F4622AC2FE35214BC3A019B8BD12C4CC42D9213D1E1556941E8D8450830287FFB3B763A13722DD4140ED9846FB5FFF745D7B0B967D810A068222E10B259AF1D392035B0D83DC1498A6830B11B2418A840212599171E0258A1C203B05362978",
+		"A21811232C950FA8B12237C2EBD6A7CD2C3A155905E9E0C7C120",
+		"63C1CE397B22F1A03F1FA549B43178BC405B152D3C95E977426D519B3DFCA28498823240592B6EEE7A14"},
+	{"096AE499F5294173F34FF2B375F0E5D5AB79D0D03B33B1A74D7D576826345DF4",
+		"0C52B3D11D636E5910A4DD76D32C",
+		"229E9ECA3053789E937447BC719467075B6138A142DA528DA8F0CF8DDF022FD9AF8E74779BA3AC306609",
+		"8B7A00038783E8BAF6EDEAE0C4EAB48FC8FD501A588C7E4A4DB71E3604F2155A97687D3D2FFF8569261375A513CF4398CE0F87CA1658A1050F6EF6C4EA3E25",
+		"C20B6CF8D3C8241825FD90B2EDAC7593600646E579A8D8DAAE9E2E40C3835FE801B2BE4379131452BC5182C90307B176DFBE2049544222FE7783147B690774F6D9D7CEF52A91E61E298E9AA15464AC"},
+}
diff --git a/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/ocb/rfc7253_test_vectors_suite_a.go b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/ocb/rfc7253_test_vectors_suite_a.go
new file mode 100644
index 00000000000..330309ff5f8
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/ocb/rfc7253_test_vectors_suite_a.go
@@ -0,0 +1,78 @@
+package ocb
+
+import (
+	"encoding/hex"
+)
+
+// Test vectors from https://tools.ietf.org/html/rfc7253. Note that key is
+// shared across tests.
+var testKey, _ = hex.DecodeString("000102030405060708090A0B0C0D0E0F")
+
+var rfc7253testVectors = []struct {
+	nonce, header, plaintext, ciphertext string
+}{
+	{"BBAA99887766554433221100",
+		"",
+		"",
+		"785407BFFFC8AD9EDCC5520AC9111EE6"},
+	{"BBAA99887766554433221101",
+		"0001020304050607",
+		"0001020304050607",
+		"6820B3657B6F615A5725BDA0D3B4EB3A257C9AF1F8F03009"},
+	{"BBAA99887766554433221102",
+		"0001020304050607",
+		"",
+		"81017F8203F081277152FADE694A0A00"},
+	{"BBAA99887766554433221103",
+		"",
+		"0001020304050607",
+		"45DD69F8F5AAE72414054CD1F35D82760B2CD00D2F99BFA9"},
+	{"BBAA99887766554433221104",
+		"000102030405060708090A0B0C0D0E0F",
+		"000102030405060708090A0B0C0D0E0F",
+		"571D535B60B277188BE5147170A9A22C3AD7A4FF3835B8C5701C1CCEC8FC3358"},
+	{"BBAA99887766554433221105",
+		"000102030405060708090A0B0C0D0E0F",
+		"",
+		"8CF761B6902EF764462AD86498CA6B97"},
+	{"BBAA99887766554433221106",
+		"",
+		"000102030405060708090A0B0C0D0E0F",
+		"5CE88EC2E0692706A915C00AEB8B2396F40E1C743F52436BDF06D8FA1ECA343D"},
+	{"BBAA99887766554433221107",
+		"000102030405060708090A0B0C0D0E0F1011121314151617",
+		"000102030405060708090A0B0C0D0E0F1011121314151617",
+		"1CA2207308C87C010756104D8840CE1952F09673A448A122C92C62241051F57356D7F3C90BB0E07F"},
+	{"BBAA99887766554433221108",
+		"000102030405060708090A0B0C0D0E0F1011121314151617",
+		"",
+		"6DC225A071FC1B9F7C69F93B0F1E10DE"},
+	{"BBAA99887766554433221109",
+		"",
+		"000102030405060708090A0B0C0D0E0F1011121314151617",
+		"221BD0DE7FA6FE993ECCD769460A0AF2D6CDED0C395B1C3CE725F32494B9F914D85C0B1EB38357FF"},
+	{"BBAA9988776655443322110A",
+		"000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F",
+		"000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F",
+		"BD6F6C496201C69296C11EFD138A467ABD3C707924B964DEAFFC40319AF5A48540FBBA186C5553C68AD9F592A79A4240"},
+	{"BBAA9988776655443322110B",
+		"000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F",
+		"",
+		"FE80690BEE8A485D11F32965BC9D2A32"},
+	{"BBAA9988776655443322110C",
+		"",
+		"000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F",
+		"2942BFC773BDA23CABC6ACFD9BFD5835BD300F0973792EF46040C53F1432BCDFB5E1DDE3BC18A5F840B52E653444D5DF"},
+	{"BBAA9988776655443322110D",
+		"000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F2021222324252627",
+		"000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F2021222324252627",
+		"D5CA91748410C1751FF8A2F618255B68A0A12E093FF454606E59F9C1D0DDC54B65E8628E568BAD7AED07BA06A4A69483A7035490C5769E60"},
+	{"BBAA9988776655443322110E",
+		"000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F2021222324252627",
+		"",
+		"C5CD9D1850C141E358649994EE701B68"},
+	{"BBAA9988776655443322110F",
+		"",
+		"000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F2021222324252627",
+		"4412923493C57D5DE0D700F753CCE0D1D2D95060122E9F15A5DDBFC5787E50B5CC55EE507BCB084E479AD363AC366B95A98CA5F3000B1479"},
+}
diff --git a/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/ocb/rfc7253_test_vectors_suite_b.go b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/ocb/rfc7253_test_vectors_suite_b.go
new file mode 100644
index 00000000000..14a3c336fbc
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/ocb/rfc7253_test_vectors_suite_b.go
@@ -0,0 +1,25 @@
+package ocb
+
+// Second set of test vectors from https://tools.ietf.org/html/rfc7253
+var rfc7253TestVectorTaglen96 = struct {
+	key, nonce, header, plaintext, ciphertext string
+}{"0F0E0D0C0B0A09080706050403020100",
+	"BBAA9988776655443322110D",
+	"000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F2021222324252627",
+	"000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F2021222324252627",
+	"1792A4E31E0755FB03E31B22116E6C2DDF9EFD6E33D536F1A0124B0A55BAE884ED93481529C76B6AD0C515F4D1CDD4FDAC4F02AA"}
+
+var rfc7253AlgorithmTest = []struct {
+	KEYLEN, TAGLEN int
+	OUTPUT         string
+}{
+	{128, 128, "67E944D23256C5E0B6C61FA22FDF1EA2"},
+	{192, 128, "F673F2C3E7174AAE7BAE986CA9F29E17"},
+	{256, 128, "D90EB8E9C977C88B79DD793D7FFA161C"},
+	{128, 96, "77A3D8E73589158D25D01209"},
+	{192, 96, "05D56EAD2752C86BE6932C5E"},
+	{256, 96, "5458359AC23B0CBA9E6330DD"},
+	{128, 64, "192C9B7BD90BA06A"},
+	{192, 64, "0066BC6E0EF34E24"},
+	{256, 64, "7D4EA5D445501CBE"},
+}
diff --git a/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/aes/keywrap/keywrap.go b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/aes/keywrap/keywrap.go
new file mode 100644
index 00000000000..3c6251d1ce6
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/aes/keywrap/keywrap.go
@@ -0,0 +1,153 @@
+// Copyright 2014 Matthew Endsley
+// All rights reserved
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted providing that the following conditions
+// are met:
+// 1. Redistributions of source code must retain the above copyright
+//    notice, this list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright
+//    notice, this list of conditions and the following disclaimer in the
+//    documentation and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+// IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+// WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+// ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+// DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+// DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+// OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+// HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+// STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+// IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+// POSSIBILITY OF SUCH DAMAGE.
+
+// Package keywrap is an implementation of the RFC 3394 AES key wrapping
+// algorithm. This is used in OpenPGP with elliptic curve keys.
+package keywrap
+
+import (
+	"crypto/aes"
+	"encoding/binary"
+	"errors"
+)
+
+var (
+	// ErrWrapPlaintext is returned if the plaintext is not a multiple
+	// of 64 bits.
+	ErrWrapPlaintext = errors.New("keywrap: plainText must be a multiple of 64 bits")
+
+	// ErrUnwrapCiphertext is returned if the ciphertext is not a
+	// multiple of 64 bits.
+	ErrUnwrapCiphertext = errors.New("keywrap: cipherText must by a multiple of 64 bits")
+
+	// ErrUnwrapFailed is returned if unwrapping a key fails.
+	ErrUnwrapFailed = errors.New("keywrap: failed to unwrap key")
+
+	// NB: the AES NewCipher call only fails if the key is an invalid length.
+
+	// ErrInvalidKey is returned when the AES key is invalid.
+	ErrInvalidKey = errors.New("keywrap: invalid AES key")
+)
+
+// Wrap a key using the RFC 3394 AES Key Wrap Algorithm.
+func Wrap(key, plainText []byte) ([]byte, error) {
+	if len(plainText)%8 != 0 {
+		return nil, ErrWrapPlaintext
+	}
+
+	c, err := aes.NewCipher(key)
+	if err != nil {
+		return nil, ErrInvalidKey
+	}
+
+	nblocks := len(plainText) / 8
+
+	// 1) Initialize variables.
+	var block [aes.BlockSize]byte
+	// - Set A = IV, an initial value (see 2.2.3)
+	for ii := 0; ii < 8; ii++ {
+		block[ii] = 0xA6
+	}
+
+	// - For i = 1 to n
+	// -   Set R[i] = P[i]
+	intermediate := make([]byte, len(plainText))
+	copy(intermediate, plainText)
+
+	// 2) Calculate intermediate values.
+	for ii := 0; ii < 6; ii++ {
+		for jj := 0; jj < nblocks; jj++ {
+			// - B = AES(K, A | R[i])
+			copy(block[8:], intermediate[jj*8:jj*8+8])
+			c.Encrypt(block[:], block[:])
+
+			// - A = MSB(64, B) ^ t where t = (n*j)+1
+			t := uint64(ii*nblocks + jj + 1)
+			val := binary.BigEndian.Uint64(block[:8]) ^ t
+			binary.BigEndian.PutUint64(block[:8], val)
+
+			// - R[i] = LSB(64, B)
+			copy(intermediate[jj*8:jj*8+8], block[8:])
+		}
+	}
+
+	// 3) Output results.
+	// - Set C[0] = A
+	// - For i = 1 to n
+	// -   C[i] = R[i]
+	return append(block[:8], intermediate...), nil
+}
+
+// Unwrap a key using the RFC 3394 AES Key Wrap Algorithm.
+func Unwrap(key, cipherText []byte) ([]byte, error) {
+	if len(cipherText)%8 != 0 {
+		return nil, ErrUnwrapCiphertext
+	}
+
+	c, err := aes.NewCipher(key)
+	if err != nil {
+		return nil, ErrInvalidKey
+	}
+
+	nblocks := len(cipherText)/8 - 1
+
+	// 1) Initialize variables.
+	var block [aes.BlockSize]byte
+	// - Set A = C[0]
+	copy(block[:8], cipherText[:8])
+
+	// - For i = 1 to n
+	// -   Set R[i] = C[i]
+	intermediate := make([]byte, len(cipherText)-8)
+	copy(intermediate, cipherText[8:])
+
+	// 2) Compute intermediate values.
+	for jj := 5; jj >= 0; jj-- {
+		for ii := nblocks - 1; ii >= 0; ii-- {
+			// - B = AES-1(K, (A ^ t) | R[i]) where t = n*j+1
+			// - A = MSB(64, B)
+			t := uint64(jj*nblocks + ii + 1)
+			val := binary.BigEndian.Uint64(block[:8]) ^ t
+			binary.BigEndian.PutUint64(block[:8], val)
+
+			copy(block[8:], intermediate[ii*8:ii*8+8])
+			c.Decrypt(block[:], block[:])
+
+			// - R[i] = LSB(B, 64)
+			copy(intermediate[ii*8:ii*8+8], block[8:])
+		}
+	}
+
+	// 3) Output results.
+	// - If A is an appropriate initial value (see 2.2.3),
+	for ii := 0; ii < 8; ii++ {
+		if block[ii] != 0xA6 {
+			return nil, ErrUnwrapFailed
+		}
+	}
+
+	// - For i = 1 to n
+	// -   P[i] = R[i]
+	return intermediate, nil
+}
diff --git a/.ci/providerlint/vendor/golang.org/x/crypto/openpgp/armor/armor.go b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/armor/armor.go
similarity index 89%
rename from .ci/providerlint/vendor/golang.org/x/crypto/openpgp/armor/armor.go
rename to .ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/armor/armor.go
index 8907183ec0a..d7af9141e36 100644
--- a/.ci/providerlint/vendor/golang.org/x/crypto/openpgp/armor/armor.go
+++ b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/armor/armor.go
@@ -4,20 +4,15 @@
 
 // Package armor implements OpenPGP ASCII Armor, see RFC 4880. OpenPGP Armor is
 // very similar to PEM except that it has an additional CRC checksum.
-//
-// Deprecated: this package is unmaintained except for security fixes. New
-// applications should consider a more focused, modern alternative to OpenPGP
-// for their specific task. If you are required to interoperate with OpenPGP
-// systems and need a maintained package, consider a community fork.
-// See https://golang.org/issue/44226.
-package armor // import "golang.org/x/crypto/openpgp/armor"
+package armor // import "github.com/ProtonMail/go-crypto/openpgp/armor"
 
 import (
 	"bufio"
 	"bytes"
 	"encoding/base64"
-	"golang.org/x/crypto/openpgp/errors"
 	"io"
+
+	"github.com/ProtonMail/go-crypto/openpgp/errors"
 )
 
 // A Block represents an OpenPGP armored structure.
@@ -156,7 +151,7 @@ func (r *openpgpReader) Read(p []byte) (n int, err error) {
 	n, err = r.b64Reader.Read(p)
 	r.currentCRC = crc24(r.currentCRC, p[:n])
 
-	if err == io.EOF && r.lReader.crcSet && r.lReader.crc != r.currentCRC&crc24Mask {
+	if err == io.EOF && r.lReader.crcSet && r.lReader.crc != uint32(r.currentCRC&crc24Mask) {
 		return 0, ArmorCorrupt
 	}
 
@@ -214,12 +209,16 @@ TryNextBlock:
 			break
 		}
 
-		i := bytes.Index(line, []byte(": "))
+		i := bytes.Index(line, []byte(":"))
 		if i == -1 {
 			goto TryNextBlock
 		}
 		lastKey = string(line[:i])
-		p.Header[lastKey] = string(line[i+2:])
+		var value string
+		if len(line) > i+2 {
+			value = string(line[i+2:])
+		}
+		p.Header[lastKey] = value
 	}
 
 	p.lReader.in = r
diff --git a/.ci/providerlint/vendor/golang.org/x/crypto/openpgp/armor/encode.go b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/armor/encode.go
similarity index 100%
rename from .ci/providerlint/vendor/golang.org/x/crypto/openpgp/armor/encode.go
rename to .ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/armor/encode.go
diff --git a/.ci/providerlint/vendor/golang.org/x/crypto/openpgp/canonical_text.go b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/canonical_text.go
similarity index 80%
rename from .ci/providerlint/vendor/golang.org/x/crypto/openpgp/canonical_text.go
rename to .ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/canonical_text.go
index e601e389f12..a94f6150c4b 100644
--- a/.ci/providerlint/vendor/golang.org/x/crypto/openpgp/canonical_text.go
+++ b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/canonical_text.go
@@ -4,7 +4,10 @@
 
 package openpgp
 
-import "hash"
+import (
+	"hash"
+	"io"
+)
 
 // NewCanonicalTextHash reformats text written to it into the canonical
 // form and then applies the hash h.  See RFC 4880, section 5.2.1.
@@ -19,28 +22,31 @@ type canonicalTextHash struct {
 
 var newline = []byte{'\r', '\n'}
 
-func (cth *canonicalTextHash) Write(buf []byte) (int, error) {
+func writeCanonical(cw io.Writer, buf []byte, s *int) (int, error) {
 	start := 0
-
 	for i, c := range buf {
-		switch cth.s {
+		switch *s {
 		case 0:
 			if c == '\r' {
-				cth.s = 1
+				*s = 1
 			} else if c == '\n' {
-				cth.h.Write(buf[start:i])
-				cth.h.Write(newline)
+				cw.Write(buf[start:i])
+				cw.Write(newline)
 				start = i + 1
 			}
 		case 1:
-			cth.s = 0
+			*s = 0
 		}
 	}
 
-	cth.h.Write(buf[start:])
+	cw.Write(buf[start:])
 	return len(buf), nil
 }
 
+func (cth *canonicalTextHash) Write(buf []byte) (int, error) {
+	return writeCanonical(cth.h, buf, &cth.s)
+}
+
 func (cth *canonicalTextHash) Sum(in []byte) []byte {
 	return cth.h.Sum(in)
 }
diff --git a/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/ecdh/ecdh.go b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/ecdh/ecdh.go
new file mode 100644
index 00000000000..c895bad6bbc
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/ecdh/ecdh.go
@@ -0,0 +1,210 @@
+// Copyright 2017 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// Package ecdh implements ECDH encryption, suitable for OpenPGP,
+// as specified in RFC 6637, section 8.
+package ecdh
+
+import (
+	"bytes"
+	"errors"
+	"io"
+
+	"github.com/ProtonMail/go-crypto/openpgp/aes/keywrap"
+	"github.com/ProtonMail/go-crypto/openpgp/internal/algorithm"
+	"github.com/ProtonMail/go-crypto/openpgp/internal/ecc"
+)
+
+type KDF struct {
+	Hash   algorithm.Hash
+	Cipher algorithm.Cipher
+}
+
+type PublicKey struct {
+	curve ecc.ECDHCurve
+	Point []byte
+	KDF
+}
+
+type PrivateKey struct {
+	PublicKey
+	D []byte
+}
+
+func NewPublicKey(curve ecc.ECDHCurve, kdfHash algorithm.Hash, kdfCipher algorithm.Cipher) *PublicKey {
+	return &PublicKey{
+		curve: curve,
+		KDF: KDF{
+			Hash:   kdfHash,
+			Cipher: kdfCipher,
+		},
+	}
+}
+
+func NewPrivateKey(key PublicKey) *PrivateKey {
+	return &PrivateKey{
+		PublicKey: key,
+	}
+}
+
+func (pk *PublicKey) GetCurve() ecc.ECDHCurve {
+	return pk.curve
+}
+
+func (pk *PublicKey) MarshalPoint() []byte {
+	return pk.curve.MarshalBytePoint(pk.Point)
+}
+
+func (pk *PublicKey) UnmarshalPoint(p []byte) error {
+	pk.Point = pk.curve.UnmarshalBytePoint(p)
+	if pk.Point == nil {
+		return errors.New("ecdh: failed to parse EC point")
+	}
+	return nil
+}
+
+func (sk *PrivateKey) MarshalByteSecret() []byte {
+	return sk.curve.MarshalByteSecret(sk.D)
+}
+
+func (sk *PrivateKey) UnmarshalByteSecret(d []byte) error {
+	sk.D = sk.curve.UnmarshalByteSecret(d)
+
+	if sk.D == nil {
+		return errors.New("ecdh: failed to parse scalar")
+	}
+	return nil
+}
+
+func GenerateKey(rand io.Reader, c ecc.ECDHCurve, kdf KDF) (priv *PrivateKey, err error) {
+	priv = new(PrivateKey)
+	priv.PublicKey.curve = c
+	priv.PublicKey.KDF = kdf
+	priv.PublicKey.Point, priv.D, err = c.GenerateECDH(rand)
+	return
+}
+
+func Encrypt(random io.Reader, pub *PublicKey, msg, curveOID, fingerprint []byte) (vsG, c []byte, err error) {
+	if len(msg) > 40 {
+		return nil, nil, errors.New("ecdh: message too long")
+	}
+	// the sender MAY use 21, 13, and 5 bytes of padding for AES-128,
+	// AES-192, and AES-256, respectively, to provide the same number of
+	// octets, 40 total, as an input to the key wrapping method.
+	padding := make([]byte, 40-len(msg))
+	for i := range padding {
+		padding[i] = byte(40 - len(msg))
+	}
+	m := append(msg, padding...)
+
+	ephemeral, zb, err := pub.curve.Encaps(random, pub.Point)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	vsG = pub.curve.MarshalBytePoint(ephemeral)
+
+	z, err := buildKey(pub, zb, curveOID, fingerprint, false, false)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	if c, err = keywrap.Wrap(z, m); err != nil {
+		return nil, nil, err
+	}
+
+	return vsG, c, nil
+
+}
+
+func Decrypt(priv *PrivateKey, vsG, c, curveOID, fingerprint []byte) (msg []byte, err error) {
+	var m []byte
+	zb, err := priv.PublicKey.curve.Decaps(priv.curve.UnmarshalBytePoint(vsG), priv.D)
+
+	// Try buildKey three times to workaround an old bug, see comments in buildKey.
+	for i := 0; i < 3; i++ {
+		var z []byte
+		// RFC6637 §8: "Compute Z = KDF( S, Z_len, Param );"
+		z, err = buildKey(&priv.PublicKey, zb, curveOID, fingerprint, i == 1, i == 2)
+		if err != nil {
+			return nil, err
+		}
+
+		// RFC6637 §8: "Compute C = AESKeyWrap( Z, c ) as per [RFC3394]"
+		m, err = keywrap.Unwrap(z, c)
+		if err == nil {
+			break
+		}
+	}
+
+	// Only return an error after we've tried all (required) variants of buildKey.
+	if err != nil {
+		return nil, err
+	}
+
+	// RFC6637 §8: "m = symm_alg_ID || session key || checksum || pkcs5_padding"
+	// The last byte should be the length of the padding, as per PKCS5; strip it off.
+	return m[:len(m)-int(m[len(m)-1])], nil
+}
+
+func buildKey(pub *PublicKey, zb []byte, curveOID, fingerprint []byte, stripLeading, stripTrailing bool) ([]byte, error) {
+	// Param = curve_OID_len || curve_OID || public_key_alg_ID || 03
+	//         || 01 || KDF_hash_ID || KEK_alg_ID for AESKeyWrap
+	//         || "Anonymous Sender    " || recipient_fingerprint;
+	param := new(bytes.Buffer)
+	if _, err := param.Write(curveOID); err != nil {
+		return nil, err
+	}
+	algKDF := []byte{18, 3, 1, pub.KDF.Hash.Id(), pub.KDF.Cipher.Id()}
+	if _, err := param.Write(algKDF); err != nil {
+		return nil, err
+	}
+	if _, err := param.Write([]byte("Anonymous Sender    ")); err != nil {
+		return nil, err
+	}
+	// For v5 keys, the 20 leftmost octets of the fingerprint are used.
+	if _, err := param.Write(fingerprint[:20]); err != nil {
+		return nil, err
+	}
+	if param.Len()-len(curveOID) != 45 {
+		return nil, errors.New("ecdh: malformed KDF Param")
+	}
+
+	// MB = Hash ( 00 || 00 || 00 || 01 || ZB || Param );
+	h := pub.KDF.Hash.New()
+	if _, err := h.Write([]byte{0x0, 0x0, 0x0, 0x1}); err != nil {
+		return nil, err
+	}
+	zbLen := len(zb)
+	i := 0
+	j := zbLen - 1
+	if stripLeading {
+		// Work around old go crypto bug where the leading zeros are missing.
+		for i < zbLen && zb[i] == 0 {
+			i++
+		}
+	}
+	if stripTrailing {
+		// Work around old OpenPGP.js bug where insignificant trailing zeros in
+		// this little-endian number are missing.
+		// (See https://github.com/openpgpjs/openpgpjs/pull/853.)
+		for j >= 0 && zb[j] == 0 {
+			j--
+		}
+	}
+	if _, err := h.Write(zb[i : j+1]); err != nil {
+		return nil, err
+	}
+	if _, err := h.Write(param.Bytes()); err != nil {
+		return nil, err
+	}
+	mb := h.Sum(nil)
+
+	return mb[:pub.KDF.Cipher.KeySize()], nil // return oBits leftmost bits of MB.
+
+}
+
+func Validate(priv *PrivateKey) error {
+	return priv.curve.ValidateECDH(priv.Point, priv.D)
+}
diff --git a/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/ecdsa/ecdsa.go b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/ecdsa/ecdsa.go
new file mode 100644
index 00000000000..f94ae1b2f50
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/ecdsa/ecdsa.go
@@ -0,0 +1,80 @@
+// Package ecdsa implements ECDSA signature, suitable for OpenPGP,
+// as specified in RFC 6637, section 5.
+package ecdsa
+
+import (
+	"errors"
+	"github.com/ProtonMail/go-crypto/openpgp/internal/ecc"
+	"io"
+	"math/big"
+)
+
+type PublicKey struct {
+	X, Y  *big.Int
+	curve ecc.ECDSACurve
+}
+
+type PrivateKey struct {
+	PublicKey
+	D *big.Int
+}
+
+func NewPublicKey(curve ecc.ECDSACurve) *PublicKey {
+	return &PublicKey{
+		curve: curve,
+	}
+}
+
+func NewPrivateKey(key PublicKey) *PrivateKey {
+	return &PrivateKey{
+		PublicKey: key,
+	}
+}
+
+func (pk *PublicKey) GetCurve() ecc.ECDSACurve {
+	return pk.curve
+}
+
+func (pk *PublicKey) MarshalPoint() []byte {
+	return pk.curve.MarshalIntegerPoint(pk.X, pk.Y)
+}
+
+func (pk *PublicKey) UnmarshalPoint(p []byte) error {
+	pk.X, pk.Y = pk.curve.UnmarshalIntegerPoint(p)
+	if pk.X == nil {
+		return errors.New("ecdsa: failed to parse EC point")
+	}
+	return nil
+}
+
+func (sk *PrivateKey) MarshalIntegerSecret() []byte {
+	return sk.curve.MarshalIntegerSecret(sk.D)
+}
+
+func (sk *PrivateKey) UnmarshalIntegerSecret(d []byte) error {
+	sk.D = sk.curve.UnmarshalIntegerSecret(d)
+
+	if sk.D == nil {
+		return errors.New("ecdsa: failed to parse scalar")
+	}
+	return nil
+}
+
+func GenerateKey(rand io.Reader, c ecc.ECDSACurve) (priv *PrivateKey, err error) {
+	priv = new(PrivateKey)
+	priv.PublicKey.curve = c
+	priv.PublicKey.X, priv.PublicKey.Y, priv.D, err = c.GenerateECDSA(rand)
+	return
+}
+
+func Sign(rand io.Reader, priv *PrivateKey, hash []byte) (r, s *big.Int, err error) {
+	return priv.PublicKey.curve.Sign(rand, priv.X, priv.Y, priv.D, hash)
+}
+
+func Verify(pub *PublicKey, hash []byte, r, s *big.Int) bool {
+	return pub.curve.Verify(pub.X, pub.Y, hash, r, s)
+}
+
+func Validate(priv *PrivateKey) error {
+	return priv.curve.ValidateECDSA(priv.X, priv.Y, priv.D.Bytes())
+}
diff --git a/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/eddsa/eddsa.go b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/eddsa/eddsa.go
new file mode 100644
index 00000000000..99ecfc7f12d
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/eddsa/eddsa.go
@@ -0,0 +1,91 @@
+// Package eddsa implements EdDSA signature, suitable for OpenPGP, as specified in
+// https://datatracker.ietf.org/doc/html/draft-ietf-openpgp-crypto-refresh-06#section-13.7
+package eddsa
+
+import (
+	"errors"
+	"github.com/ProtonMail/go-crypto/openpgp/internal/ecc"
+	"io"
+)
+
+type PublicKey struct {
+	X     []byte
+	curve ecc.EdDSACurve
+}
+
+type PrivateKey struct {
+	PublicKey
+	D []byte
+}
+
+func NewPublicKey(curve ecc.EdDSACurve) *PublicKey {
+	return &PublicKey{
+		curve: curve,
+	}
+}
+
+func NewPrivateKey(key PublicKey) *PrivateKey {
+	return &PrivateKey{
+		PublicKey: key,
+	}
+}
+
+func (pk *PublicKey) GetCurve() ecc.EdDSACurve {
+	return pk.curve
+}
+
+func (pk *PublicKey) MarshalPoint() []byte {
+	return pk.curve.MarshalBytePoint(pk.X)
+}
+
+func (pk *PublicKey) UnmarshalPoint(x []byte) error {
+	pk.X = pk.curve.UnmarshalBytePoint(x)
+
+	if pk.X == nil {
+		return errors.New("eddsa: failed to parse EC point")
+	}
+	return nil
+}
+
+func (sk *PrivateKey) MarshalByteSecret() []byte {
+	return sk.curve.MarshalByteSecret(sk.D)
+}
+
+func (sk *PrivateKey) UnmarshalByteSecret(d []byte) error {
+	sk.D = sk.curve.UnmarshalByteSecret(d)
+
+	if sk.D == nil {
+		return errors.New("eddsa: failed to parse scalar")
+	}
+	return nil
+}
+
+func GenerateKey(rand io.Reader, c ecc.EdDSACurve) (priv *PrivateKey, err error) {
+	priv = new(PrivateKey)
+	priv.PublicKey.curve = c
+	priv.PublicKey.X, priv.D, err = c.GenerateEdDSA(rand)
+	return
+}
+
+func Sign(priv *PrivateKey, message []byte) (r, s []byte, err error) {
+	sig, err := priv.PublicKey.curve.Sign(priv.PublicKey.X, priv.D, message)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	r, s = priv.PublicKey.curve.MarshalSignature(sig)
+	return
+}
+
+func Verify(pub *PublicKey, message, r, s []byte) bool {
+	sig := pub.curve.UnmarshalSignature(r, s)
+	if sig == nil {
+		return false
+	}
+
+	return pub.curve.Verify(pub.X, message, sig)
+}
+
+func Validate(priv *PrivateKey) error {
+	return priv.curve.ValidateEdDSA(priv.PublicKey.X, priv.D)
+}
diff --git a/.ci/providerlint/vendor/golang.org/x/crypto/openpgp/elgamal/elgamal.go b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/elgamal/elgamal.go
similarity index 88%
rename from .ci/providerlint/vendor/golang.org/x/crypto/openpgp/elgamal/elgamal.go
rename to .ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/elgamal/elgamal.go
index 743b35a1204..bad27743445 100644
--- a/.ci/providerlint/vendor/golang.org/x/crypto/openpgp/elgamal/elgamal.go
+++ b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/elgamal/elgamal.go
@@ -10,13 +10,7 @@
 // This form of ElGamal embeds PKCS#1 v1.5 padding, which may make it
 // unsuitable for other protocols. RSA should be used in preference in any
 // case.
-//
-// Deprecated: this package was only provided to support ElGamal encryption in
-// OpenPGP. The golang.org/x/crypto/openpgp package is now deprecated (see
-// https://golang.org/issue/44226), and ElGamal in the OpenPGP ecosystem has
-// compatibility and security issues (see https://eprint.iacr.org/2021/923).
-// Moreover, this package doesn't protect against side-channel attacks.
-package elgamal // import "golang.org/x/crypto/openpgp/elgamal"
+package elgamal // import "github.com/ProtonMail/go-crypto/openpgp/elgamal"
 
 import (
 	"crypto/rand"
diff --git a/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/errors/errors.go b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/errors/errors.go
new file mode 100644
index 00000000000..17e2bcfed20
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/errors/errors.go
@@ -0,0 +1,116 @@
+// Copyright 2010 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// Package errors contains common error types for the OpenPGP packages.
+package errors // import "github.com/ProtonMail/go-crypto/openpgp/errors"
+
+import (
+	"strconv"
+)
+
+// A StructuralError is returned when OpenPGP data is found to be syntactically
+// invalid.
+type StructuralError string
+
+func (s StructuralError) Error() string {
+	return "openpgp: invalid data: " + string(s)
+}
+
+// UnsupportedError indicates that, although the OpenPGP data is valid, it
+// makes use of currently unimplemented features.
+type UnsupportedError string
+
+func (s UnsupportedError) Error() string {
+	return "openpgp: unsupported feature: " + string(s)
+}
+
+// InvalidArgumentError indicates that the caller is in error and passed an
+// incorrect value.
+type InvalidArgumentError string
+
+func (i InvalidArgumentError) Error() string {
+	return "openpgp: invalid argument: " + string(i)
+}
+
+// SignatureError indicates that a syntactically valid signature failed to
+// validate.
+type SignatureError string
+
+func (b SignatureError) Error() string {
+	return "openpgp: invalid signature: " + string(b)
+}
+
+var ErrMDCHashMismatch error = SignatureError("MDC hash mismatch")
+var ErrMDCMissing error = SignatureError("MDC packet not found")
+
+type signatureExpiredError int
+
+func (se signatureExpiredError) Error() string {
+	return "openpgp: signature expired"
+}
+
+var ErrSignatureExpired error = signatureExpiredError(0)
+
+type keyExpiredError int
+
+func (ke keyExpiredError) Error() string {
+	return "openpgp: key expired"
+}
+
+var ErrKeyExpired error = keyExpiredError(0)
+
+type keyIncorrectError int
+
+func (ki keyIncorrectError) Error() string {
+	return "openpgp: incorrect key"
+}
+
+var ErrKeyIncorrect error = keyIncorrectError(0)
+
+// KeyInvalidError indicates that the public key parameters are invalid
+// as they do not match the private ones
+type KeyInvalidError string
+
+func (e KeyInvalidError) Error() string {
+	return "openpgp: invalid key: " + string(e)
+}
+
+type unknownIssuerError int
+
+func (unknownIssuerError) Error() string {
+	return "openpgp: signature made by unknown entity"
+}
+
+var ErrUnknownIssuer error = unknownIssuerError(0)
+
+type keyRevokedError int
+
+func (keyRevokedError) Error() string {
+	return "openpgp: signature made by revoked key"
+}
+
+var ErrKeyRevoked error = keyRevokedError(0)
+
+type UnknownPacketTypeError uint8
+
+func (upte UnknownPacketTypeError) Error() string {
+	return "openpgp: unknown packet type: " + strconv.Itoa(int(upte))
+}
+
+// AEADError indicates that there is a problem when initializing or using a
+// AEAD instance, configuration struct, nonces or index values.
+type AEADError string
+
+func (ae AEADError) Error() string {
+	return "openpgp: aead error: " + string(ae)
+}
+
+// ErrDummyPrivateKey results when operations are attempted on a private key
+// that is just a dummy key. See
+// https://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=blob;f=doc/DETAILS;h=fe55ae16ab4e26d8356dc574c9e8bc935e71aef1;hb=23191d7851eae2217ecdac6484349849a24fd94a#l1109
+type ErrDummyPrivateKey string
+
+func (dke ErrDummyPrivateKey) Error() string {
+	return "openpgp: s2k GNU dummy key: " + string(dke)
+}
diff --git a/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/hash.go b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/hash.go
new file mode 100644
index 00000000000..526bd7777f8
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/hash.go
@@ -0,0 +1,24 @@
+package openpgp
+
+import (
+	"crypto"
+
+	"github.com/ProtonMail/go-crypto/openpgp/internal/algorithm"
+)
+
+// HashIdToHash returns a crypto.Hash which corresponds to the given OpenPGP
+// hash id.
+func HashIdToHash(id byte) (h crypto.Hash, ok bool) {
+	return algorithm.HashIdToHash(id)
+}
+
+// HashIdToString returns the name of the hash function corresponding to the
+// given OpenPGP hash id.
+func HashIdToString(id byte) (name string, ok bool) {
+	return algorithm.HashIdToString(id)
+}
+
+// HashToHashId returns an OpenPGP hash id which corresponds the given Hash.
+func HashToHashId(h crypto.Hash) (id byte, ok bool) {
+	return algorithm.HashToHashId(h)
+}
diff --git a/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/internal/algorithm/aead.go b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/internal/algorithm/aead.go
new file mode 100644
index 00000000000..d0670651866
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/internal/algorithm/aead.go
@@ -0,0 +1,65 @@
+// Copyright (C) 2019 ProtonTech AG
+
+package algorithm
+
+import (
+	"crypto/cipher"
+	"github.com/ProtonMail/go-crypto/eax"
+	"github.com/ProtonMail/go-crypto/ocb"
+)
+
+// AEADMode defines the Authenticated Encryption with Associated Data mode of
+// operation.
+type AEADMode uint8
+
+// Supported modes of operation (see RFC4880bis [EAX] and RFC7253)
+const (
+	AEADModeEAX = AEADMode(1)
+	AEADModeOCB = AEADMode(2)
+	AEADModeGCM = AEADMode(3)
+)
+
+// TagLength returns the length in bytes of authentication tags.
+func (mode AEADMode) TagLength() int {
+	switch mode {
+	case AEADModeEAX:
+		return 16
+	case AEADModeOCB:
+		return 16
+	case AEADModeGCM:
+		return 16
+	default:
+		return 0
+	}
+}
+
+// NonceLength returns the length in bytes of nonces.
+func (mode AEADMode) NonceLength() int {
+	switch mode {
+	case AEADModeEAX:
+		return 16
+	case AEADModeOCB:
+		return 15
+	case AEADModeGCM:
+		return 12
+	default:
+		return 0
+	}
+}
+
+// New returns a fresh instance of the given mode
+func (mode AEADMode) New(block cipher.Block) (alg cipher.AEAD) {
+	var err error
+	switch mode {
+	case AEADModeEAX:
+		alg, err = eax.NewEAX(block)
+	case AEADModeOCB:
+		alg, err = ocb.NewOCB(block)
+	case AEADModeGCM:
+		alg, err = cipher.NewGCM(block)
+	}
+	if err != nil {
+		panic(err.Error())
+	}
+	return alg
+}
diff --git a/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/internal/algorithm/cipher.go b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/internal/algorithm/cipher.go
new file mode 100644
index 00000000000..5760cff80ea
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/internal/algorithm/cipher.go
@@ -0,0 +1,107 @@
+// Copyright 2017 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package algorithm
+
+import (
+	"crypto/aes"
+	"crypto/cipher"
+	"crypto/des"
+
+	"golang.org/x/crypto/cast5"
+)
+
+// Cipher is an official symmetric key cipher algorithm. See RFC 4880,
+// section 9.2.
+type Cipher interface {
+	// Id returns the algorithm ID, as a byte, of the cipher.
+	Id() uint8
+	// KeySize returns the key size, in bytes, of the cipher.
+	KeySize() int
+	// BlockSize returns the block size, in bytes, of the cipher.
+	BlockSize() int
+	// New returns a fresh instance of the given cipher.
+	New(key []byte) cipher.Block
+}
+
+// The following constants mirror the OpenPGP standard (RFC 4880).
+const (
+	TripleDES = CipherFunction(2)
+	CAST5     = CipherFunction(3)
+	AES128    = CipherFunction(7)
+	AES192    = CipherFunction(8)
+	AES256    = CipherFunction(9)
+)
+
+// CipherById represents the different block ciphers specified for OpenPGP. See
+// http://www.iana.org/assignments/pgp-parameters/pgp-parameters.xhtml#pgp-parameters-13
+var CipherById = map[uint8]Cipher{
+	TripleDES.Id(): TripleDES,
+	CAST5.Id():     CAST5,
+	AES128.Id():    AES128,
+	AES192.Id():    AES192,
+	AES256.Id():    AES256,
+}
+
+type CipherFunction uint8
+
+// ID returns the algorithm Id, as a byte, of cipher.
+func (sk CipherFunction) Id() uint8 {
+	return uint8(sk)
+}
+
+var keySizeByID = map[uint8]int{
+	TripleDES.Id(): 24,
+	CAST5.Id():     cast5.KeySize,
+	AES128.Id():    16,
+	AES192.Id():    24,
+	AES256.Id():    32,
+}
+
+// KeySize returns the key size, in bytes, of cipher.
+func (cipher CipherFunction) KeySize() int {
+	switch cipher {
+	case TripleDES:
+		return 24
+	case CAST5:
+		return cast5.KeySize
+	case AES128:
+		return 16
+	case AES192:
+		return 24
+	case AES256:
+		return 32
+	}
+	return 0
+}
+
+// BlockSize returns the block size, in bytes, of cipher.
+func (cipher CipherFunction) BlockSize() int {
+	switch cipher {
+	case TripleDES:
+		return des.BlockSize
+	case CAST5:
+		return 8
+	case AES128, AES192, AES256:
+		return 16
+	}
+	return 0
+}
+
+// New returns a fresh instance of the given cipher.
+func (cipher CipherFunction) New(key []byte) (block cipher.Block) {
+	var err error
+	switch cipher {
+	case TripleDES:
+		block, err = des.NewTripleDESCipher(key)
+	case CAST5:
+		block, err = cast5.NewCipher(key)
+	case AES128, AES192, AES256:
+		block, err = aes.NewCipher(key)
+	}
+	if err != nil {
+		panic(err.Error())
+	}
+	return
+}
diff --git a/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/internal/algorithm/hash.go b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/internal/algorithm/hash.go
new file mode 100644
index 00000000000..d1a00fc7495
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/internal/algorithm/hash.go
@@ -0,0 +1,143 @@
+// Copyright 2017 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package algorithm
+
+import (
+	"crypto"
+	"fmt"
+	"hash"
+)
+
+// Hash is an official hash function algorithm. See RFC 4880, section 9.4.
+type Hash interface {
+	// Id returns the algorithm ID, as a byte, of Hash.
+	Id() uint8
+	// Available reports whether the given hash function is linked into the binary.
+	Available() bool
+	// HashFunc simply returns the value of h so that Hash implements SignerOpts.
+	HashFunc() crypto.Hash
+	// New returns a new hash.Hash calculating the given hash function. New
+	// panics if the hash function is not linked into the binary.
+	New() hash.Hash
+	// Size returns the length, in bytes, of a digest resulting from the given
+	// hash function. It doesn't require that the hash function in question be
+	// linked into the program.
+	Size() int
+	// String is the name of the hash function corresponding to the given
+	// OpenPGP hash id.
+	String() string
+}
+
+// The following vars mirror the crypto/Hash supported hash functions.
+var (
+	SHA1     Hash = cryptoHash{2, crypto.SHA1}
+	SHA256   Hash = cryptoHash{8, crypto.SHA256}
+	SHA384   Hash = cryptoHash{9, crypto.SHA384}
+	SHA512   Hash = cryptoHash{10, crypto.SHA512}
+	SHA224   Hash = cryptoHash{11, crypto.SHA224}
+	SHA3_256 Hash = cryptoHash{12, crypto.SHA3_256}
+	SHA3_512 Hash = cryptoHash{14, crypto.SHA3_512}
+)
+
+// HashById represents the different hash functions specified for OpenPGP. See
+// http://www.iana.org/assignments/pgp-parameters/pgp-parameters.xhtml#pgp-parameters-14
+var (
+	HashById = map[uint8]Hash{
+		SHA256.Id():   SHA256,
+		SHA384.Id():   SHA384,
+		SHA512.Id():   SHA512,
+		SHA224.Id():   SHA224,
+		SHA3_256.Id(): SHA3_256,
+		SHA3_512.Id(): SHA3_512,
+	}
+)
+
+// cryptoHash contains pairs relating OpenPGP's hash identifier with
+// Go's crypto.Hash type. See RFC 4880, section 9.4.
+type cryptoHash struct {
+	id uint8
+	crypto.Hash
+}
+
+// Id returns the algorithm ID, as a byte, of cryptoHash.
+func (h cryptoHash) Id() uint8 {
+	return h.id
+}
+
+var hashNames = map[uint8]string{
+	SHA256.Id():   "SHA256",
+	SHA384.Id():   "SHA384",
+	SHA512.Id():   "SHA512",
+	SHA224.Id():   "SHA224",
+	SHA3_256.Id(): "SHA3-256",
+	SHA3_512.Id(): "SHA3-512",
+}
+
+func (h cryptoHash) String() string {
+	s, ok := hashNames[h.id]
+	if !ok {
+		panic(fmt.Sprintf("Unsupported hash function %d", h.id))
+	}
+	return s
+}
+
+// HashIdToHash returns a crypto.Hash which corresponds to the given OpenPGP
+// hash id.
+func HashIdToHash(id byte) (h crypto.Hash, ok bool) {
+	if hash, ok := HashById[id]; ok {
+		return hash.HashFunc(), true
+	}
+	return 0, false
+}
+
+// HashIdToHashWithSha1 returns a crypto.Hash which corresponds to the given OpenPGP
+// hash id, allowing sha1.
+func HashIdToHashWithSha1(id byte) (h crypto.Hash, ok bool) {
+	if hash, ok := HashById[id]; ok {
+		return hash.HashFunc(), true
+	}
+
+	if id == SHA1.Id() {
+		return SHA1.HashFunc(), true
+	}
+
+	return 0, false
+}
+
+// HashIdToString returns the name of the hash function corresponding to the
+// given OpenPGP hash id.
+func HashIdToString(id byte) (name string, ok bool) {
+	if hash, ok := HashById[id]; ok {
+		return hash.String(), true
+	}
+	return "", false
+}
+
+// HashToHashId returns an OpenPGP hash id which corresponds the given Hash.
+func HashToHashId(h crypto.Hash) (id byte, ok bool) {
+	for id, hash := range HashById {
+		if hash.HashFunc() == h {
+			return id, true
+		}
+	}
+
+	return 0, false
+}
+
+// HashToHashIdWithSha1 returns an OpenPGP hash id which corresponds the given Hash,
+// allowing instances of SHA1
+func HashToHashIdWithSha1(h crypto.Hash) (id byte, ok bool) {
+	for id, hash := range HashById {
+		if hash.HashFunc() == h {
+			return id, true
+		}
+	}
+
+	if h == SHA1.HashFunc() {
+		return SHA1.Id(), true
+	}
+
+	return 0, false
+}
diff --git a/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/internal/ecc/curve25519.go b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/internal/ecc/curve25519.go
new file mode 100644
index 00000000000..888767c4e43
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/internal/ecc/curve25519.go
@@ -0,0 +1,171 @@
+// Package ecc implements a generic interface for ECDH, ECDSA, and EdDSA.
+package ecc
+
+import (
+	"crypto/subtle"
+	"io"
+
+	"github.com/ProtonMail/go-crypto/openpgp/errors"
+	x25519lib "github.com/cloudflare/circl/dh/x25519"
+)
+
+type curve25519 struct{}
+
+func NewCurve25519() *curve25519 {
+	return &curve25519{}
+}
+
+func (c *curve25519) GetCurveName() string {
+	return "curve25519"
+}
+
+// MarshalBytePoint encodes the public point from native format, adding the prefix.
+// See https://datatracker.ietf.org/doc/html/draft-ietf-openpgp-crypto-refresh-06#section-5.5.5.6
+func (c *curve25519) MarshalBytePoint(point []byte) []byte {
+	return append([]byte{0x40}, point...)
+}
+
+// UnmarshalBytePoint decodes the public point to native format, removing the prefix.
+// See https://datatracker.ietf.org/doc/html/draft-ietf-openpgp-crypto-refresh-06#section-5.5.5.6
+func (c *curve25519) UnmarshalBytePoint(point []byte) []byte {
+	if len(point) != x25519lib.Size+1 {
+		return nil
+	}
+
+	// Remove prefix
+	return point[1:]
+}
+
+// MarshalByteSecret encodes the secret scalar from native format.
+// Note that the EC secret scalar differs from the definition of public keys in
+// [Curve25519] in two ways: (1) the byte-ordering is big-endian, which is
+// more uniform with how big integers are represented in OpenPGP, and (2) the
+// leading zeros are truncated.
+// See https://datatracker.ietf.org/doc/html/draft-ietf-openpgp-crypto-refresh-06#section-5.5.5.6.1.1
+// Note that leading zero bytes are stripped later when encoding as an MPI.
+func (c *curve25519) MarshalByteSecret(secret []byte) []byte {
+	d := make([]byte, x25519lib.Size)
+	copyReversed(d, secret)
+
+	// The following ensures that the private key is a number of the form
+	// 2^{254} + 8 * [0, 2^{251}), in order to avoid the small subgroup of
+	// the curve.
+	//
+	// This masking is done internally in the underlying lib and so is unnecessary
+	// for security, but OpenPGP implementations require that private keys be
+	// pre-masked.
+	d[0] &= 127
+	d[0] |= 64
+	d[31] &= 248
+
+	return d
+}
+
+// UnmarshalByteSecret decodes the secret scalar from native format.
+// Note that the EC secret scalar differs from the definition of public keys in
+// [Curve25519] in two ways: (1) the byte-ordering is big-endian, which is
+// more uniform with how big integers are represented in OpenPGP, and (2) the
+// leading zeros are truncated.
+// See https://datatracker.ietf.org/doc/html/draft-ietf-openpgp-crypto-refresh-06#section-5.5.5.6.1.1
+func (c *curve25519) UnmarshalByteSecret(d []byte) []byte {
+	if len(d) > x25519lib.Size {
+		return nil
+	}
+
+	// Ensure truncated leading bytes are re-added
+	secret := make([]byte, x25519lib.Size)
+	copyReversed(secret, d)
+
+	return secret
+}
+
+// generateKeyPairBytes Generates a private-public key-pair.
+// 'priv' is a private key; a little-endian scalar belonging to the set
+// 2^{254} + 8 * [0, 2^{251}), in order to avoid the small subgroup of the
+// curve. 'pub' is simply 'priv' * G where G is the base point.
+// See https://cr.yp.to/ecdh.html and RFC7748, sec 5.
+func (c *curve25519) generateKeyPairBytes(rand io.Reader) (priv, pub x25519lib.Key, err error) {
+	_, err = io.ReadFull(rand, priv[:])
+	if err != nil {
+		return
+	}
+
+	x25519lib.KeyGen(&pub, &priv)
+	return
+}
+
+func (c *curve25519) GenerateECDH(rand io.Reader) (point []byte, secret []byte, err error) {
+	priv, pub, err := c.generateKeyPairBytes(rand)
+	if err != nil {
+		return
+	}
+
+	return pub[:], priv[:], nil
+}
+
+func (c *genericCurve) MaskSecret(secret []byte) []byte {
+	return secret
+}
+
+func (c *curve25519) Encaps(rand io.Reader, point []byte) (ephemeral, sharedSecret []byte, err error) {
+	// RFC6637 §8: "Generate an ephemeral key pair {v, V=vG}"
+	// ephemeralPrivate corresponds to `v`.
+	// ephemeralPublic corresponds to `V`.
+	ephemeralPrivate, ephemeralPublic, err := c.generateKeyPairBytes(rand)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	// RFC6637 §8: "Obtain the authenticated recipient public key R"
+	// pubKey corresponds to `R`.
+	var pubKey x25519lib.Key
+	copy(pubKey[:], point)
+
+	// RFC6637 §8: "Compute the shared point S = vR"
+	//	"VB = convert point V to the octet string"
+	// sharedPoint corresponds to `VB`.
+	var sharedPoint x25519lib.Key
+	x25519lib.Shared(&sharedPoint, &ephemeralPrivate, &pubKey)
+
+	return ephemeralPublic[:], sharedPoint[:], nil
+}
+
+func (c *curve25519) Decaps(vsG, secret []byte) (sharedSecret []byte, err error) {
+	var ephemeralPublic, decodedPrivate, sharedPoint x25519lib.Key
+	// RFC6637 §8: "The decryption is the inverse of the method given."
+	// All quoted descriptions in comments below describe encryption, and
+	// the reverse is performed.
+	// vsG corresponds to `VB` in RFC6637 §8 .
+
+	// RFC6637 §8: "VB = convert point V to the octet string"
+	copy(ephemeralPublic[:], vsG)
+
+	// decodedPrivate corresponds to `r` in RFC6637 §8 .
+	copy(decodedPrivate[:], secret)
+
+	// RFC6637 §8: "Note that the recipient obtains the shared secret by calculating
+	//   S = rV = rvG, where (r,R) is the recipient's key pair."
+	// sharedPoint corresponds to `S`.
+	x25519lib.Shared(&sharedPoint, &decodedPrivate, &ephemeralPublic)
+
+	return sharedPoint[:], nil
+}
+
+func (c *curve25519) ValidateECDH(point []byte, secret []byte) (err error) {
+	var pk, sk x25519lib.Key
+	copy(sk[:], secret)
+	x25519lib.KeyGen(&pk, &sk)
+
+	if subtle.ConstantTimeCompare(point, pk[:]) == 0 {
+		return errors.KeyInvalidError("ecc: invalid curve25519 public point")
+	}
+
+	return nil
+}
+
+func copyReversed(out []byte, in []byte) {
+	l := len(in)
+	for i := 0; i < l; i++ {
+		out[i] = in[l-i-1]
+	}
+}
diff --git a/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/internal/ecc/curve_info.go b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/internal/ecc/curve_info.go
new file mode 100644
index 00000000000..35751034dda
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/internal/ecc/curve_info.go
@@ -0,0 +1,140 @@
+// Package ecc implements a generic interface for ECDH, ECDSA, and EdDSA.
+package ecc
+
+import (
+	"bytes"
+	"crypto/elliptic"
+	"github.com/ProtonMail/go-crypto/bitcurves"
+	"github.com/ProtonMail/go-crypto/brainpool"
+	"github.com/ProtonMail/go-crypto/openpgp/internal/encoding"
+)
+
+type CurveInfo struct {
+	GenName string
+	Oid     *encoding.OID
+	Curve   Curve
+}
+
+var Curves = []CurveInfo{
+	{
+		// NIST P-256
+		GenName: "P256",
+		Oid:     encoding.NewOID([]byte{0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x03, 0x01, 0x07}),
+		Curve:   NewGenericCurve(elliptic.P256()),
+	},
+	{
+		// NIST P-384
+		GenName: "P384",
+		Oid:     encoding.NewOID([]byte{0x2B, 0x81, 0x04, 0x00, 0x22}),
+		Curve:   NewGenericCurve(elliptic.P384()),
+	},
+	{
+		// NIST P-521
+		GenName: "P521",
+		Oid:     encoding.NewOID([]byte{0x2B, 0x81, 0x04, 0x00, 0x23}),
+		Curve:   NewGenericCurve(elliptic.P521()),
+	},
+	{
+		// SecP256k1
+		GenName: "SecP256k1",
+		Oid:     encoding.NewOID([]byte{0x2B, 0x81, 0x04, 0x00, 0x0A}),
+		Curve:   NewGenericCurve(bitcurves.S256()),
+	},
+	{
+		// Curve25519
+		GenName: "Curve25519",
+		Oid:     encoding.NewOID([]byte{0x2B, 0x06, 0x01, 0x04, 0x01, 0x97, 0x55, 0x01, 0x05, 0x01}),
+		Curve:   NewCurve25519(),
+	},
+	{
+		// X448
+		GenName: "Curve448",
+		Oid:     encoding.NewOID([]byte{0x2B, 0x65, 0x6F}),
+		Curve:   NewX448(),
+	},
+	{
+		// Ed25519
+		GenName: "Curve25519",
+		Oid:     encoding.NewOID([]byte{0x2B, 0x06, 0x01, 0x04, 0x01, 0xDA, 0x47, 0x0F, 0x01}),
+		Curve:   NewEd25519(),
+	},
+	{
+		// Ed448
+		GenName: "Curve448",
+		Oid:     encoding.NewOID([]byte{0x2B, 0x65, 0x71}),
+		Curve:   NewEd448(),
+	},
+	{
+		// BrainpoolP256r1
+		GenName: "BrainpoolP256",
+		Oid:     encoding.NewOID([]byte{0x2B, 0x24, 0x03, 0x03, 0x02, 0x08, 0x01, 0x01, 0x07}),
+		Curve:   NewGenericCurve(brainpool.P256r1()),
+	},
+	{
+		// BrainpoolP384r1
+		GenName: "BrainpoolP384",
+		Oid:     encoding.NewOID([]byte{0x2B, 0x24, 0x03, 0x03, 0x02, 0x08, 0x01, 0x01, 0x0B}),
+		Curve:   NewGenericCurve(brainpool.P384r1()),
+	},
+	{
+		// BrainpoolP512r1
+		GenName: "BrainpoolP512",
+		Oid:     encoding.NewOID([]byte{0x2B, 0x24, 0x03, 0x03, 0x02, 0x08, 0x01, 0x01, 0x0D}),
+		Curve:   NewGenericCurve(brainpool.P512r1()),
+	},
+}
+
+func FindByCurve(curve Curve) *CurveInfo {
+	for _, curveInfo := range Curves {
+		if curveInfo.Curve.GetCurveName() == curve.GetCurveName() {
+			return &curveInfo
+		}
+	}
+	return nil
+}
+
+func FindByOid(oid encoding.Field) *CurveInfo {
+	var rawBytes = oid.Bytes()
+	for _, curveInfo := range Curves {
+		if bytes.Equal(curveInfo.Oid.Bytes(), rawBytes) {
+			return &curveInfo
+		}
+	}
+	return nil
+}
+
+func FindEdDSAByGenName(curveGenName string) EdDSACurve {
+	for _, curveInfo := range Curves {
+		if curveInfo.GenName == curveGenName {
+			curve, ok := curveInfo.Curve.(EdDSACurve)
+			if ok {
+				return curve
+			}
+		}
+	}
+	return nil
+}
+
+func FindECDSAByGenName(curveGenName string) ECDSACurve {
+	for _, curveInfo := range Curves {
+		if curveInfo.GenName == curveGenName {
+			curve, ok := curveInfo.Curve.(ECDSACurve)
+			if ok {
+				return curve
+			}
+		}
+	}
+	return nil
+}
+
+func FindECDHByGenName(curveGenName string) ECDHCurve {
+	for _, curveInfo := range Curves {
+		if curveInfo.GenName == curveGenName {
+			curve, ok := curveInfo.Curve.(ECDHCurve)
+			if ok {
+				return curve
+			}
+		}
+	}
+	return nil
+}
diff --git a/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/internal/ecc/curves.go b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/internal/ecc/curves.go
new file mode 100644
index 00000000000..5ed9c93b3d6
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/internal/ecc/curves.go
@@ -0,0 +1,48 @@
+// Package ecc implements a generic interface for ECDH, ECDSA, and EdDSA.
+package ecc
+
+import (
+	"io"
+	"math/big"
+)
+
+type Curve interface {
+	GetCurveName() string
+}
+
+type ECDSACurve interface {
+	Curve
+	MarshalIntegerPoint(x, y *big.Int) []byte
+	UnmarshalIntegerPoint([]byte) (x, y *big.Int)
+	MarshalIntegerSecret(d *big.Int) []byte
+	UnmarshalIntegerSecret(d []byte) *big.Int
+	GenerateECDSA(rand io.Reader) (x, y, secret *big.Int, err error)
+	Sign(rand io.Reader, x, y, d *big.Int, hash []byte) (r, s *big.Int, err error)
+	Verify(x, y *big.Int, hash []byte, r, s *big.Int) bool
+	ValidateECDSA(x, y *big.Int, secret []byte) error
+}
+
+type EdDSACurve interface {
+	Curve
+	MarshalBytePoint(x []byte) []byte
+	UnmarshalBytePoint([]byte) (x []byte)
+	MarshalByteSecret(d []byte) []byte
+	UnmarshalByteSecret(d []byte) []byte
+	MarshalSignature(sig []byte) (r, s []byte)
+	UnmarshalSignature(r, s []byte) (sig []byte)
+	GenerateEdDSA(rand io.Reader) (pub, priv []byte, err error)
+	Sign(publicKey, privateKey, message []byte) (sig []byte, err error)
+	Verify(publicKey, message, sig []byte) bool
+	ValidateEdDSA(publicKey, privateKey []byte) (err error)
+}
+type ECDHCurve interface {
+	Curve
+	MarshalBytePoint([]byte) (encoded []byte)
+	UnmarshalBytePoint(encoded []byte) []byte
+	MarshalByteSecret(d []byte) []byte
+	UnmarshalByteSecret(d []byte) []byte
+	GenerateECDH(rand io.Reader) (point []byte, secret []byte, err error)
+	Encaps(rand io.Reader, point []byte) (ephemeral, sharedSecret []byte, err error)
+	Decaps(ephemeral, secret []byte) (sharedSecret []byte, err error)
+	ValidateECDH(public []byte, secret []byte) error
+}
diff --git a/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/internal/ecc/ed25519.go b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/internal/ecc/ed25519.go
new file mode 100644
index 00000000000..54a08a8a38f
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/internal/ecc/ed25519.go
@@ -0,0 +1,112 @@
+// Package ecc implements a generic interface for ECDH, ECDSA, and EdDSA.
+package ecc
+
+import (
+	"crypto/subtle"
+	"io"
+
+	"github.com/ProtonMail/go-crypto/openpgp/errors"
+	ed25519lib "github.com/cloudflare/circl/sign/ed25519"
+)
+
+const ed25519Size = 32
+
+type ed25519 struct{}
+
+func NewEd25519() *ed25519 {
+	return &ed25519{}
+}
+
+func (c *ed25519) GetCurveName() string {
+	return "ed25519"
+}
+
+// MarshalBytePoint encodes the public point from native format, adding the prefix.
+// See https://datatracker.ietf.org/doc/html/draft-ietf-openpgp-crypto-refresh-06#section-5.5.5.5
+func (c *ed25519) MarshalBytePoint(x []byte) []byte {
+	return append([]byte{0x40}, x...)
+}
+
+// UnmarshalBytePoint decodes a point from prefixed format to native.
+// See https://datatracker.ietf.org/doc/html/draft-ietf-openpgp-crypto-refresh-06#section-5.5.5.5
+func (c *ed25519) UnmarshalBytePoint(point []byte) (x []byte) {
+	if len(point) != ed25519lib.PublicKeySize+1 {
+		return nil
+	}
+
+	// Return unprefixed
+	return point[1:]
+}
+
+// MarshalByteSecret encodes a scalar in native format.
+// See https://datatracker.ietf.org/doc/html/draft-ietf-openpgp-crypto-refresh-06#section-5.5.5.5
+func (c *ed25519) MarshalByteSecret(d []byte) []byte {
+	return d
+}
+
+// UnmarshalByteSecret decodes a scalar in native format and re-adds the stripped leading zeroes
+// See https://datatracker.ietf.org/doc/html/draft-ietf-openpgp-crypto-refresh-06#section-5.5.5.5
+func (c *ed25519) UnmarshalByteSecret(s []byte) (d []byte) {
+	if len(s) > ed25519lib.SeedSize {
+		return nil
+	}
+
+	// Handle stripped leading zeroes
+	d = make([]byte, ed25519lib.SeedSize)
+	copy(d[ed25519lib.SeedSize-len(s):], s)
+	return
+}
+
+// MarshalSignature splits a signature in R and S.
+// See https://datatracker.ietf.org/doc/html/draft-ietf-openpgp-crypto-refresh-06#section-5.2.3.3.1
+func (c *ed25519) MarshalSignature(sig []byte) (r, s []byte) {
+	return sig[:ed25519Size], sig[ed25519Size:]
+}
+
+// UnmarshalSignature decodes R and S in the native format, re-adding the stripped leading zeroes
+// See https://datatracker.ietf.org/doc/html/draft-ietf-openpgp-crypto-refresh-06#section-5.2.3.3.1
+func (c *ed25519) UnmarshalSignature(r, s []byte) (sig []byte) {
+	// Check size
+	if len(r) > 32 || len(s) > 32 {
+		return nil
+	}
+
+	sig = make([]byte, ed25519lib.SignatureSize)
+
+	// Handle stripped leading zeroes
+	copy(sig[ed25519Size-len(r):ed25519Size], r)
+	copy(sig[ed25519lib.SignatureSize-len(s):], s)
+	return sig
+}
+
+func (c *ed25519) GenerateEdDSA(rand io.Reader) (pub, priv []byte, err error) {
+	pk, sk, err := ed25519lib.GenerateKey(rand)
+
+	if err != nil {
+		return nil, nil, err
+	}
+
+	return pk, sk[:ed25519lib.SeedSize], nil
+}
+
+func getEd25519Sk(publicKey, privateKey []byte) ed25519lib.PrivateKey {
+	return append(privateKey, publicKey...)
+}
+
+func (c *ed25519) Sign(publicKey, privateKey, message []byte) (sig []byte, err error) {
+	sig = ed25519lib.Sign(getEd25519Sk(publicKey, privateKey), message)
+	return sig, nil
+}
+
+func (c *ed25519) Verify(publicKey, message, sig []byte) bool {
+	return ed25519lib.Verify(publicKey, message, sig)
+}
+
+func (c *ed25519) ValidateEdDSA(publicKey, privateKey []byte) (err error) {
+	priv := getEd25519Sk(publicKey, privateKey)
+	expectedPriv := ed25519lib.NewKeyFromSeed(priv.Seed())
+	if subtle.ConstantTimeCompare(priv, expectedPriv) == 0 {
+		return errors.KeyInvalidError("ecc: invalid ed25519 secret")
+	}
+	return nil
+}
diff --git a/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/internal/ecc/ed448.go b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/internal/ecc/ed448.go
new file mode 100644
index 00000000000..18cd80434b6
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/internal/ecc/ed448.go
@@ -0,0 +1,111 @@
+// Package ecc implements a generic interface for ECDH, ECDSA, and EdDSA.
+package ecc
+
+import (
+	"crypto/subtle"
+	"io"
+
+	"github.com/ProtonMail/go-crypto/openpgp/errors"
+	ed448lib "github.com/cloudflare/circl/sign/ed448"
+)
+
+type ed448 struct{}
+
+func NewEd448() *ed448 {
+	return &ed448{}
+}
+
+func (c *ed448) GetCurveName() string {
+	return "ed448"
+}
+
+// MarshalBytePoint encodes the public point from native format, adding the prefix.
+// See https://datatracker.ietf.org/doc/html/draft-ietf-openpgp-crypto-refresh-06#section-5.5.5.5
+func (c *ed448) MarshalBytePoint(x []byte) []byte {
+	// Return prefixed
+	return append([]byte{0x40}, x...)
+}
+
+// UnmarshalBytePoint decodes a point from prefixed format to native.
+// See https://datatracker.ietf.org/doc/html/draft-ietf-openpgp-crypto-refresh-06#section-5.5.5.5
+func (c *ed448) UnmarshalBytePoint(point []byte) (x []byte) {
+	if len(point) != ed448lib.PublicKeySize+1 {
+		return nil
+	}
+
+	// Strip prefix
+	return point[1:]
+}
+
+// MarshalByteSecret encoded a scalar from native format to prefixed.
+// See https://datatracker.ietf.org/doc/html/draft-ietf-openpgp-crypto-refresh-06#section-5.5.5.5
+func (c *ed448) MarshalByteSecret(d []byte) []byte {
+	// Return prefixed
+	return append([]byte{0x40}, d...)
+}
+
+// UnmarshalByteSecret decodes a scalar from prefixed format to native.
+// See https://datatracker.ietf.org/doc/html/draft-ietf-openpgp-crypto-refresh-06#section-5.5.5.5
+func (c *ed448) UnmarshalByteSecret(s []byte) (d []byte) {
+	// Check prefixed size
+	if len(s) != ed448lib.SeedSize+1 {
+		return nil
+	}
+
+	// Strip prefix
+	return s[1:]
+}
+
+// MarshalSignature splits a signature in R and S, where R is in prefixed native format and
+// S is an MPI with value zero.
+// See https://datatracker.ietf.org/doc/html/draft-ietf-openpgp-crypto-refresh-06#section-5.2.3.3.2
+func (c *ed448) MarshalSignature(sig []byte) (r, s []byte) {
+	return append([]byte{0x40}, sig...), []byte{}
+}
+
+// UnmarshalSignature decodes R and S in the native format. Only R is used, in prefixed native format.
+// See https://datatracker.ietf.org/doc/html/draft-ietf-openpgp-crypto-refresh-06#section-5.2.3.3.2
+func (c *ed448) UnmarshalSignature(r, s []byte) (sig []byte) {
+	if len(r) != ed448lib.SignatureSize+1 {
+		return nil
+	}
+
+	return r[1:]
+}
+
+func (c *ed448) GenerateEdDSA(rand io.Reader) (pub, priv []byte, err error) {
+	pk, sk, err := ed448lib.GenerateKey(rand)
+
+	if err != nil {
+		return nil, nil, err
+	}
+
+	return pk, sk[:ed448lib.SeedSize], nil
+}
+
+func getEd448Sk(publicKey, privateKey []byte) ed448lib.PrivateKey {
+	return append(privateKey, publicKey...)
+}
+
+func (c *ed448) Sign(publicKey, privateKey, message []byte) (sig []byte, err error) {
+	// Ed448 is used with the empty string as a context string.
+	// See https://datatracker.ietf.org/doc/html/draft-ietf-openpgp-crypto-refresh-06#section-13.7
+	sig = ed448lib.Sign(getEd448Sk(publicKey, privateKey), message, "")
+
+	return sig, nil
+}
+
+func (c *ed448) Verify(publicKey, message, sig []byte) bool {
+	// Ed448 is used with the empty string as a context string.
+	// See https://datatracker.ietf.org/doc/html/draft-ietf-openpgp-crypto-refresh-06#section-13.7
+	return ed448lib.Verify(publicKey, message, sig, "")
+}
+
+func (c *ed448) ValidateEdDSA(publicKey, privateKey []byte) (err error) {
+	priv := getEd448Sk(publicKey, privateKey)
+	expectedPriv := ed448lib.NewKeyFromSeed(priv.Seed())
+	if subtle.ConstantTimeCompare(priv, expectedPriv) == 0 {
+		return errors.KeyInvalidError("ecc: invalid ed448 secret")
+	}
+	return nil
+}
diff --git a/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/internal/ecc/generic.go b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/internal/ecc/generic.go
new file mode 100644
index 00000000000..e28d7c7106a
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/internal/ecc/generic.go
@@ -0,0 +1,149 @@
+// Package ecc implements a generic interface for ECDH, ECDSA, and EdDSA.
+package ecc
+
+import (
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"fmt"
+	"github.com/ProtonMail/go-crypto/openpgp/errors"
+	"io"
+	"math/big"
+)
+
+type genericCurve struct {
+	Curve elliptic.Curve
+}
+
+func NewGenericCurve(c elliptic.Curve) *genericCurve {
+	return &genericCurve{
+		Curve: c,
+	}
+}
+
+func (c *genericCurve) GetCurveName() string {
+	return c.Curve.Params().Name
+}
+
+func (c *genericCurve) MarshalBytePoint(point []byte) []byte {
+	return point
+}
+
+func (c *genericCurve) UnmarshalBytePoint(point []byte) []byte {
+	return point
+}
+
+func (c *genericCurve) MarshalIntegerPoint(x, y *big.Int) []byte {
+	return elliptic.Marshal(c.Curve, x, y)
+}
+
+func (c *genericCurve) UnmarshalIntegerPoint(point []byte) (x, y *big.Int) {
+	return elliptic.Unmarshal(c.Curve, point)
+}
+
+func (c *genericCurve) MarshalByteSecret(d []byte) []byte {
+	return d
+}
+
+func (c *genericCurve) UnmarshalByteSecret(d []byte) []byte {
+	return d
+}
+
+func (c *genericCurve) MarshalIntegerSecret(d *big.Int) []byte {
+	return d.Bytes()
+}
+
+func (c *genericCurve) UnmarshalIntegerSecret(d []byte) *big.Int {
+	return new(big.Int).SetBytes(d)
+}
+
+func (c *genericCurve) GenerateECDH(rand io.Reader) (point, secret []byte, err error) {
+	secret, x, y, err := elliptic.GenerateKey(c.Curve, rand)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	point = elliptic.Marshal(c.Curve, x, y)
+	return point, secret, nil
+}
+
+func (c *genericCurve) GenerateECDSA(rand io.Reader) (x, y, secret *big.Int, err error) {
+	priv, err := ecdsa.GenerateKey(c.Curve, rand)
+	if err != nil {
+		return
+	}
+
+	return priv.X, priv.Y, priv.D, nil
+}
+
+func (c *genericCurve) Encaps(rand io.Reader, point []byte) (ephemeral, sharedSecret []byte, err error) {
+	xP, yP := elliptic.Unmarshal(c.Curve, point)
+	if xP == nil {
+		panic("invalid point")
+	}
+
+	d, x, y, err := elliptic.GenerateKey(c.Curve, rand)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	vsG := elliptic.Marshal(c.Curve, x, y)
+	zbBig, _ := c.Curve.ScalarMult(xP, yP, d)
+
+	byteLen := (c.Curve.Params().BitSize + 7) >> 3
+	zb := make([]byte, byteLen)
+	zbBytes := zbBig.Bytes()
+	copy(zb[byteLen-len(zbBytes):], zbBytes)
+
+	return vsG, zb, nil
+}
+
+func (c *genericCurve) Decaps(ephemeral, secret []byte) (sharedSecret []byte, err error) {
+	x, y := elliptic.Unmarshal(c.Curve, ephemeral)
+	zbBig, _ := c.Curve.ScalarMult(x, y, secret)
+	byteLen := (c.Curve.Params().BitSize + 7) >> 3
+	zb := make([]byte, byteLen)
+	zbBytes := zbBig.Bytes()
+	copy(zb[byteLen-len(zbBytes):], zbBytes)
+
+	return zb, nil
+}
+
+func (c *genericCurve) Sign(rand io.Reader, x, y, d *big.Int, hash []byte) (r, s *big.Int, err error) {
+	priv := &ecdsa.PrivateKey{D: d, PublicKey: ecdsa.PublicKey{X: x, Y: y, Curve: c.Curve}}
+	return ecdsa.Sign(rand, priv, hash)
+}
+
+func (c *genericCurve) Verify(x, y *big.Int, hash []byte, r, s *big.Int) bool {
+	pub := &ecdsa.PublicKey{X: x, Y: y, Curve: c.Curve}
+	return ecdsa.Verify(pub, hash, r, s)
+}
+
+func (c *genericCurve) validate(xP, yP *big.Int, secret []byte) error {
+	// the public point should not be at infinity (0,0)
+	zero := new(big.Int)
+	if xP.Cmp(zero) == 0 && yP.Cmp(zero) == 0 {
+		return errors.KeyInvalidError(fmt.Sprintf("ecc (%s): infinity point", c.Curve.Params().Name))
+	}
+
+	// re-derive the public point Q' = (X,Y) = dG
+	// to compare to declared Q in public key
+	expectedX, expectedY := c.Curve.ScalarBaseMult(secret)
+	if xP.Cmp(expectedX) != 0 || yP.Cmp(expectedY) != 0 {
+		return errors.KeyInvalidError(fmt.Sprintf("ecc (%s): invalid point", c.Curve.Params().Name))
+	}
+
+	return nil
+}
+
+func (c *genericCurve) ValidateECDSA(xP, yP *big.Int, secret []byte) error {
+	return c.validate(xP, yP, secret)
+}
+
+func (c *genericCurve) ValidateECDH(point []byte, secret []byte) error {
+	xP, yP := elliptic.Unmarshal(c.Curve, point)
+	if xP == nil {
+		return errors.KeyInvalidError(fmt.Sprintf("ecc (%s): invalid point", c.Curve.Params().Name))
+	}
+
+	return c.validate(xP, yP, secret)
+}
diff --git a/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/internal/ecc/x448.go b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/internal/ecc/x448.go
new file mode 100644
index 00000000000..ffdd51513b4
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/internal/ecc/x448.go
@@ -0,0 +1,105 @@
+// Package ecc implements a generic interface for ECDH, ECDSA, and EdDSA.
+package ecc
+
+import (
+	"crypto/subtle"
+	"io"
+
+	"github.com/ProtonMail/go-crypto/openpgp/errors"
+	x448lib "github.com/cloudflare/circl/dh/x448"
+)
+
+type x448 struct{}
+
+func NewX448() *x448 {
+	return &x448{}
+}
+
+func (c *x448) GetCurveName() string {
+	return "x448"
+}
+
+// MarshalBytePoint encodes the public point from native format, adding the prefix.
+// See https://datatracker.ietf.org/doc/html/draft-ietf-openpgp-crypto-refresh-06#section-5.5.5.6
+func (c *x448) MarshalBytePoint(point []byte) []byte {
+	return append([]byte{0x40}, point...)
+}
+
+// UnmarshalBytePoint decodes a point from prefixed format to native.
+// See https://datatracker.ietf.org/doc/html/draft-ietf-openpgp-crypto-refresh-06#section-5.5.5.6
+func (c *x448) UnmarshalBytePoint(point []byte) []byte {
+	if len(point) != x448lib.Size+1 {
+		return nil
+	}
+
+	return point[1:]
+}
+
+// MarshalByteSecret encoded a scalar from native format to prefixed.
+// See https://datatracker.ietf.org/doc/html/draft-ietf-openpgp-crypto-refresh-06#section-5.5.5.6.1.2
+func (c *x448) MarshalByteSecret(d []byte) []byte {
+	return append([]byte{0x40}, d...)
+}
+
+// UnmarshalByteSecret decodes a scalar from prefixed format to native.
+// See https://datatracker.ietf.org/doc/html/draft-ietf-openpgp-crypto-refresh-06#section-5.5.5.6.1.2
+func (c *x448) UnmarshalByteSecret(d []byte) []byte {
+	if len(d) != x448lib.Size+1 {
+		return nil
+	}
+
+	// Store without prefix
+	return d[1:]
+}
+
+func (c *x448) generateKeyPairBytes(rand io.Reader) (sk, pk x448lib.Key, err error) {
+	if _, err = rand.Read(sk[:]); err != nil {
+		return
+	}
+
+	x448lib.KeyGen(&pk, &sk)
+	return
+}
+
+func (c *x448) GenerateECDH(rand io.Reader) (point []byte, secret []byte, err error) {
+	priv, pub, err := c.generateKeyPairBytes(rand)
+	if err != nil {
+		return
+	}
+
+	return pub[:], priv[:], nil
+}
+
+func (c *x448) Encaps(rand io.Reader, point []byte) (ephemeral, sharedSecret []byte, err error) {
+	var pk, ss x448lib.Key
+	seed, e, err := c.generateKeyPairBytes(rand)
+
+	copy(pk[:], point)
+	x448lib.Shared(&ss, &seed, &pk)
+
+	return e[:], ss[:], nil
+}
+
+func (c *x448) Decaps(ephemeral, secret []byte) (sharedSecret []byte, err error) {
+	var ss, sk, e x448lib.Key
+
+	copy(sk[:], secret)
+	copy(e[:], ephemeral)
+	x448lib.Shared(&ss, &sk, &e)
+
+	return ss[:], nil
+}
+
+func (c *x448) ValidateECDH(point []byte, secret []byte) error {
+	var sk, pk, expectedPk x448lib.Key
+
+	copy(pk[:], point)
+	copy(sk[:], secret)
+	x448lib.KeyGen(&expectedPk, &sk)
+
+	if subtle.ConstantTimeCompare(expectedPk[:], pk[:]) == 0 {
+		return errors.KeyInvalidError("ecc: invalid curve25519 public point")
+	}
+
+	return nil
+}
diff --git a/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/internal/encoding/encoding.go b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/internal/encoding/encoding.go
new file mode 100644
index 00000000000..6c921481b7b
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/internal/encoding/encoding.go
@@ -0,0 +1,27 @@
+// Copyright 2017 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// Package encoding implements openpgp packet field encodings as specified in
+// RFC 4880 and 6637.
+package encoding
+
+import "io"
+
+// Field is an encoded field of an openpgp packet.
+type Field interface {
+	// Bytes returns the decoded data.
+	Bytes() []byte
+
+	// BitLength is the size in bits of the decoded data.
+	BitLength() uint16
+
+	// EncodedBytes returns the encoded data.
+	EncodedBytes() []byte
+
+	// EncodedLength is the size in bytes of the encoded data.
+	EncodedLength() uint16
+
+	// ReadFrom reads the next Field from r.
+	ReadFrom(r io.Reader) (int64, error)
+}
diff --git a/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/internal/encoding/mpi.go b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/internal/encoding/mpi.go
new file mode 100644
index 00000000000..02e5e695c38
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/internal/encoding/mpi.go
@@ -0,0 +1,91 @@
+// Copyright 2017 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package encoding
+
+import (
+	"io"
+	"math/big"
+	"math/bits"
+)
+
+// An MPI is used to store the contents of a big integer, along with the bit
+// length that was specified in the original input. This allows the MPI to be
+// reserialized exactly.
+type MPI struct {
+	bytes     []byte
+	bitLength uint16
+}
+
+// NewMPI returns a MPI initialized with bytes.
+func NewMPI(bytes []byte) *MPI {
+	for len(bytes) != 0 && bytes[0] == 0 {
+		bytes = bytes[1:]
+	}
+	if len(bytes) == 0 {
+		bitLength := uint16(0)
+		return &MPI{bytes, bitLength}
+	}
+	bitLength := 8*uint16(len(bytes)-1) + uint16(bits.Len8(bytes[0]))
+	return &MPI{bytes, bitLength}
+}
+
+// Bytes returns the decoded data.
+func (m *MPI) Bytes() []byte {
+	return m.bytes
+}
+
+// BitLength is the size in bits of the decoded data.
+func (m *MPI) BitLength() uint16 {
+	return m.bitLength
+}
+
+// EncodedBytes returns the encoded data.
+func (m *MPI) EncodedBytes() []byte {
+	return append([]byte{byte(m.bitLength >> 8), byte(m.bitLength)}, m.bytes...)
+}
+
+// EncodedLength is the size in bytes of the encoded data.
+func (m *MPI) EncodedLength() uint16 {
+	return uint16(2 + len(m.bytes))
+}
+
+// ReadFrom reads into m the next MPI from r.
+func (m *MPI) ReadFrom(r io.Reader) (int64, error) {
+	var buf [2]byte
+	n, err := io.ReadFull(r, buf[0:])
+	if err != nil {
+		if err == io.EOF {
+			err = io.ErrUnexpectedEOF
+		}
+		return int64(n), err
+	}
+
+	m.bitLength = uint16(buf[0])<<8 | uint16(buf[1])
+	m.bytes = make([]byte, (int(m.bitLength)+7)/8)
+
+	nn, err := io.ReadFull(r, m.bytes)
+	if err == io.EOF {
+		err = io.ErrUnexpectedEOF
+	}
+
+	// remove leading zero bytes from malformed GnuPG encoded MPIs:
+	// https://bugs.gnupg.org/gnupg/issue1853
+	// for _, b := range m.bytes {
+	// 	if b != 0 {
+	// 		break
+	// 	}
+	// 	m.bytes = m.bytes[1:]
+	// 	m.bitLength -= 8
+	// }
+
+	return int64(n) + int64(nn), err
+}
+
+// SetBig initializes m with the bits from n.
+func (m *MPI) SetBig(n *big.Int) *MPI {
+	m.bytes = n.Bytes()
+	m.bitLength = uint16(n.BitLen())
+	return m
+}
diff --git a/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/internal/encoding/oid.go b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/internal/encoding/oid.go
new file mode 100644
index 00000000000..c9df9fe2322
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/internal/encoding/oid.go
@@ -0,0 +1,88 @@
+// Copyright 2017 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package encoding
+
+import (
+	"io"
+
+	"github.com/ProtonMail/go-crypto/openpgp/errors"
+)
+
+// OID is used to store a variable-length field with a one-octet size
+// prefix. See https://tools.ietf.org/html/rfc6637#section-9.
+type OID struct {
+	bytes []byte
+}
+
+const (
+	// maxOID is the maximum number of bytes in a OID.
+	maxOID = 254
+	// reservedOIDLength1 and reservedOIDLength2 are OID lengths that the RFC
+	// specifies are reserved.
+	reservedOIDLength1 = 0
+	reservedOIDLength2 = 0xff
+)
+
+// NewOID returns a OID initialized with bytes.
+func NewOID(bytes []byte) *OID {
+	switch len(bytes) {
+	case reservedOIDLength1, reservedOIDLength2:
+		panic("encoding: NewOID argument length is reserved")
+	default:
+		if len(bytes) > maxOID {
+			panic("encoding: NewOID argument too large")
+		}
+	}
+
+	return &OID{
+		bytes: bytes,
+	}
+}
+
+// Bytes returns the decoded data.
+func (o *OID) Bytes() []byte {
+	return o.bytes
+}
+
+// BitLength is the size in bits of the decoded data.
+func (o *OID) BitLength() uint16 {
+	return uint16(len(o.bytes) * 8)
+}
+
+// EncodedBytes returns the encoded data.
+func (o *OID) EncodedBytes() []byte {
+	return append([]byte{byte(len(o.bytes))}, o.bytes...)
+}
+
+// EncodedLength is the size in bytes of the encoded data.
+func (o *OID) EncodedLength() uint16 {
+	return uint16(1 + len(o.bytes))
+}
+
+// ReadFrom reads into b the next OID from r.
+func (o *OID) ReadFrom(r io.Reader) (int64, error) {
+	var buf [1]byte
+	n, err := io.ReadFull(r, buf[:])
+	if err != nil {
+		if err == io.EOF {
+			err = io.ErrUnexpectedEOF
+		}
+		return int64(n), err
+	}
+
+	switch buf[0] {
+	case reservedOIDLength1, reservedOIDLength2:
+		return int64(n), errors.UnsupportedError("reserved for future extensions")
+	}
+
+	o.bytes = make([]byte, buf[0])
+
+	nn, err := io.ReadFull(r, o.bytes)
+	if err == io.EOF {
+		err = io.ErrUnexpectedEOF
+	}
+
+	return int64(n) + int64(nn), err
+}
diff --git a/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/key_generation.go b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/key_generation.go
new file mode 100644
index 00000000000..0e71934cd90
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/key_generation.go
@@ -0,0 +1,389 @@
+// Copyright 2011 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package openpgp
+
+import (
+	"crypto"
+	"crypto/rand"
+	"crypto/rsa"
+	goerrors "errors"
+	"io"
+	"math/big"
+	"time"
+
+	"github.com/ProtonMail/go-crypto/openpgp/ecdh"
+	"github.com/ProtonMail/go-crypto/openpgp/ecdsa"
+	"github.com/ProtonMail/go-crypto/openpgp/eddsa"
+	"github.com/ProtonMail/go-crypto/openpgp/errors"
+	"github.com/ProtonMail/go-crypto/openpgp/internal/algorithm"
+	"github.com/ProtonMail/go-crypto/openpgp/internal/ecc"
+	"github.com/ProtonMail/go-crypto/openpgp/packet"
+)
+
+// NewEntity returns an Entity that contains a fresh RSA/RSA keypair with a
+// single identity composed of the given full name, comment and email, any of
+// which may be empty but must not contain any of "()<>\x00".
+// If config is nil, sensible defaults will be used.
+func NewEntity(name, comment, email string, config *packet.Config) (*Entity, error) {
+	creationTime := config.Now()
+	keyLifetimeSecs := config.KeyLifetime()
+
+	// Generate a primary signing key
+	primaryPrivRaw, err := newSigner(config)
+	if err != nil {
+		return nil, err
+	}
+	primary := packet.NewSignerPrivateKey(creationTime, primaryPrivRaw)
+	if config != nil && config.V5Keys {
+		primary.UpgradeToV5()
+	}
+
+	e := &Entity{
+		PrimaryKey: &primary.PublicKey,
+		PrivateKey: primary,
+		Identities: make(map[string]*Identity),
+		Subkeys:    []Subkey{},
+	}
+
+	err = e.addUserId(name, comment, email, config, creationTime, keyLifetimeSecs)
+	if err != nil {
+		return nil, err
+	}
+
+	// NOTE: No key expiry here, but we will not return this subkey in EncryptionKey()
+	// if the primary/master key has expired.
+	err = e.addEncryptionSubkey(config, creationTime, 0)
+	if err != nil {
+		return nil, err
+	}
+
+	return e, nil
+}
+
+func (t *Entity) AddUserId(name, comment, email string, config *packet.Config) error {
+	creationTime := config.Now()
+	keyLifetimeSecs := config.KeyLifetime()
+	return t.addUserId(name, comment, email, config, creationTime, keyLifetimeSecs)
+}
+
+func (t *Entity) addUserId(name, comment, email string, config *packet.Config, creationTime time.Time, keyLifetimeSecs uint32) error {
+	uid := packet.NewUserId(name, comment, email)
+	if uid == nil {
+		return errors.InvalidArgumentError("user id field contained invalid characters")
+	}
+
+	if _, ok := t.Identities[uid.Id]; ok {
+		return errors.InvalidArgumentError("user id exist")
+	}
+
+	primary := t.PrivateKey
+
+	isPrimaryId := len(t.Identities) == 0
+
+	selfSignature := createSignaturePacket(&primary.PublicKey, packet.SigTypePositiveCert, config)
+	selfSignature.CreationTime = creationTime
+	selfSignature.KeyLifetimeSecs = &keyLifetimeSecs
+	selfSignature.IsPrimaryId = &isPrimaryId
+	selfSignature.FlagsValid = true
+	selfSignature.FlagSign = true
+	selfSignature.FlagCertify = true
+	selfSignature.SEIPDv1 = true // true by default, see 5.8 vs. 5.14
+	selfSignature.SEIPDv2 = config.AEAD() != nil
+
+	// Set the PreferredHash for the SelfSignature from the packet.Config.
+	// If it is not the must-implement algorithm from rfc4880bis, append that.
+	hash, ok := algorithm.HashToHashId(config.Hash())
+	if !ok {
+		return errors.UnsupportedError("unsupported preferred hash function")
+	}
+
+	selfSignature.PreferredHash = []uint8{hash}
+	if config.Hash() != crypto.SHA256 {
+		selfSignature.PreferredHash = append(selfSignature.PreferredHash, hashToHashId(crypto.SHA256))
+	}
+
+	// Likewise for DefaultCipher.
+	selfSignature.PreferredSymmetric = []uint8{uint8(config.Cipher())}
+	if config.Cipher() != packet.CipherAES128 {
+		selfSignature.PreferredSymmetric = append(selfSignature.PreferredSymmetric, uint8(packet.CipherAES128))
+	}
+
+	// We set CompressionNone as the preferred compression algorithm because
+	// of compression side channel attacks, then append the configured
+	// DefaultCompressionAlgo if any is set (to signal support for cases
+	// where the application knows that using compression is safe).
+	selfSignature.PreferredCompression = []uint8{uint8(packet.CompressionNone)}
+	if config.Compression() != packet.CompressionNone {
+		selfSignature.PreferredCompression = append(selfSignature.PreferredCompression, uint8(config.Compression()))
+	}
+
+	// And for DefaultMode.
+	modes := []uint8{uint8(config.AEAD().Mode())}
+	if config.AEAD().Mode() != packet.AEADModeOCB {
+		modes = append(modes, uint8(packet.AEADModeOCB))
+	}
+
+	// For preferred (AES256, GCM), we'll generate (AES256, GCM), (AES256, OCB), (AES128, GCM), (AES128, OCB)
+	for _, cipher := range selfSignature.PreferredSymmetric {
+		for _, mode := range modes {
+			selfSignature.PreferredCipherSuites = append(selfSignature.PreferredCipherSuites, [2]uint8{cipher, mode})
+		}
+	}
+
+	// User ID binding signature
+	err := selfSignature.SignUserId(uid.Id, &primary.PublicKey, primary, config)
+	if err != nil {
+		return err
+	}
+	t.Identities[uid.Id] = &Identity{
+		Name:          uid.Id,
+		UserId:        uid,
+		SelfSignature: selfSignature,
+		Signatures:    []*packet.Signature{selfSignature},
+	}
+	return nil
+}
+
+// AddSigningSubkey adds a signing keypair as a subkey to the Entity.
+// If config is nil, sensible defaults will be used.
+func (e *Entity) AddSigningSubkey(config *packet.Config) error {
+	creationTime := config.Now()
+	keyLifetimeSecs := config.KeyLifetime()
+
+	subPrivRaw, err := newSigner(config)
+	if err != nil {
+		return err
+	}
+	sub := packet.NewSignerPrivateKey(creationTime, subPrivRaw)
+	sub.IsSubkey = true
+	if config != nil && config.V5Keys {
+		sub.UpgradeToV5()
+	}
+
+	subkey := Subkey{
+		PublicKey:  &sub.PublicKey,
+		PrivateKey: sub,
+	}
+	subkey.Sig = createSignaturePacket(e.PrimaryKey, packet.SigTypeSubkeyBinding, config)
+	subkey.Sig.CreationTime = creationTime
+	subkey.Sig.KeyLifetimeSecs = &keyLifetimeSecs
+	subkey.Sig.FlagsValid = true
+	subkey.Sig.FlagSign = true
+	subkey.Sig.EmbeddedSignature = createSignaturePacket(subkey.PublicKey, packet.SigTypePrimaryKeyBinding, config)
+	subkey.Sig.EmbeddedSignature.CreationTime = creationTime
+
+	err = subkey.Sig.EmbeddedSignature.CrossSignKey(subkey.PublicKey, e.PrimaryKey, subkey.PrivateKey, config)
+	if err != nil {
+		return err
+	}
+
+	err = subkey.Sig.SignKey(subkey.PublicKey, e.PrivateKey, config)
+	if err != nil {
+		return err
+	}
+
+	e.Subkeys = append(e.Subkeys, subkey)
+	return nil
+}
+
+// AddEncryptionSubkey adds an encryption keypair as a subkey to the Entity.
+// If config is nil, sensible defaults will be used.
+func (e *Entity) AddEncryptionSubkey(config *packet.Config) error {
+	creationTime := config.Now()
+	keyLifetimeSecs := config.KeyLifetime()
+	return e.addEncryptionSubkey(config, creationTime, keyLifetimeSecs)
+}
+
+func (e *Entity) addEncryptionSubkey(config *packet.Config, creationTime time.Time, keyLifetimeSecs uint32) error {
+	subPrivRaw, err := newDecrypter(config)
+	if err != nil {
+		return err
+	}
+	sub := packet.NewDecrypterPrivateKey(creationTime, subPrivRaw)
+	sub.IsSubkey = true
+	if config != nil && config.V5Keys {
+		sub.UpgradeToV5()
+	}
+
+	subkey := Subkey{
+		PublicKey:  &sub.PublicKey,
+		PrivateKey: sub,
+	}
+	subkey.Sig = createSignaturePacket(e.PrimaryKey, packet.SigTypeSubkeyBinding, config)
+	subkey.Sig.CreationTime = creationTime
+	subkey.Sig.KeyLifetimeSecs = &keyLifetimeSecs
+	subkey.Sig.FlagsValid = true
+	subkey.Sig.FlagEncryptStorage = true
+	subkey.Sig.FlagEncryptCommunications = true
+
+	err = subkey.Sig.SignKey(subkey.PublicKey, e.PrivateKey, config)
+	if err != nil {
+		return err
+	}
+
+	e.Subkeys = append(e.Subkeys, subkey)
+	return nil
+}
+
+// Generates a signing key
+func newSigner(config *packet.Config) (signer interface{}, err error) {
+	switch config.PublicKeyAlgorithm() {
+	case packet.PubKeyAlgoRSA:
+		bits := config.RSAModulusBits()
+		if bits < 1024 {
+			return nil, errors.InvalidArgumentError("bits must be >= 1024")
+		}
+		if config != nil && len(config.RSAPrimes) >= 2 {
+			primes := config.RSAPrimes[0:2]
+			config.RSAPrimes = config.RSAPrimes[2:]
+			return generateRSAKeyWithPrimes(config.Random(), 2, bits, primes)
+		}
+		return rsa.GenerateKey(config.Random(), bits)
+	case packet.PubKeyAlgoEdDSA:
+		curve := ecc.FindEdDSAByGenName(string(config.CurveName()))
+		if curve == nil {
+			return nil, errors.InvalidArgumentError("unsupported curve")
+		}
+
+		priv, err := eddsa.GenerateKey(config.Random(), curve)
+		if err != nil {
+			return nil, err
+		}
+		return priv, nil
+	case packet.PubKeyAlgoECDSA:
+		curve := ecc.FindECDSAByGenName(string(config.CurveName()))
+		if curve == nil {
+			return nil, errors.InvalidArgumentError("unsupported curve")
+		}
+
+		priv, err := ecdsa.GenerateKey(config.Random(), curve)
+		if err != nil {
+			return nil, err
+		}
+		return priv, nil
+	default:
+		return nil, errors.InvalidArgumentError("unsupported public key algorithm")
+	}
+}
+
+// Generates an encryption/decryption key
+func newDecrypter(config *packet.Config) (decrypter interface{}, err error) {
+	switch config.PublicKeyAlgorithm() {
+	case packet.PubKeyAlgoRSA:
+		bits := config.RSAModulusBits()
+		if bits < 1024 {
+			return nil, errors.InvalidArgumentError("bits must be >= 1024")
+		}
+		if config != nil && len(config.RSAPrimes) >= 2 {
+			primes := config.RSAPrimes[0:2]
+			config.RSAPrimes = config.RSAPrimes[2:]
+			return generateRSAKeyWithPrimes(config.Random(), 2, bits, primes)
+		}
+		return rsa.GenerateKey(config.Random(), bits)
+	case packet.PubKeyAlgoEdDSA, packet.PubKeyAlgoECDSA:
+		fallthrough // When passing EdDSA or ECDSA, we generate an ECDH subkey
+	case packet.PubKeyAlgoECDH:
+		var kdf = ecdh.KDF{
+			Hash:   algorithm.SHA512,
+			Cipher: algorithm.AES256,
+		}
+		curve := ecc.FindECDHByGenName(string(config.CurveName()))
+		if curve == nil {
+			return nil, errors.InvalidArgumentError("unsupported curve")
+		}
+		return ecdh.GenerateKey(config.Random(), curve, kdf)
+	default:
+		return nil, errors.InvalidArgumentError("unsupported public key algorithm")
+	}
+}
+
+var bigOne = big.NewInt(1)
+
+// generateRSAKeyWithPrimes generates a multi-prime RSA keypair of the
+// given bit size, using the given random source and prepopulated primes.
+func generateRSAKeyWithPrimes(random io.Reader, nprimes int, bits int, prepopulatedPrimes []*big.Int) (*rsa.PrivateKey, error) {
+	priv := new(rsa.PrivateKey)
+	priv.E = 65537
+
+	if nprimes < 2 {
+		return nil, goerrors.New("generateRSAKeyWithPrimes: nprimes must be >= 2")
+	}
+
+	if bits < 1024 {
+		return nil, goerrors.New("generateRSAKeyWithPrimes: bits must be >= 1024")
+	}
+
+	primes := make([]*big.Int, nprimes)
+
+NextSetOfPrimes:
+	for {
+		todo := bits
+		// crypto/rand should set the top two bits in each prime.
+		// Thus each prime has the form
+		//   p_i = 2^bitlen(p_i) × 0.11... (in base 2).
+		// And the product is:
+		//   P = 2^todo × α
+		// where α is the product of nprimes numbers of the form 0.11...
+		//
+		// If α < 1/2 (which can happen for nprimes > 2), we need to
+		// shift todo to compensate for lost bits: the mean value of 0.11...
+		// is 7/8, so todo + shift - nprimes * log2(7/8) ~= bits - 1/2
+		// will give good results.
+		if nprimes >= 7 {
+			todo += (nprimes - 2) / 5
+		}
+		for i := 0; i < nprimes; i++ {
+			var err error
+			if len(prepopulatedPrimes) == 0 {
+				primes[i], err = rand.Prime(random, todo/(nprimes-i))
+				if err != nil {
+					return nil, err
+				}
+			} else {
+				primes[i] = prepopulatedPrimes[0]
+				prepopulatedPrimes = prepopulatedPrimes[1:]
+			}
+
+			todo -= primes[i].BitLen()
+		}
+
+		// Make sure that primes is pairwise unequal.
+		for i, prime := range primes {
+			for j := 0; j < i; j++ {
+				if prime.Cmp(primes[j]) == 0 {
+					continue NextSetOfPrimes
+				}
+			}
+		}
+
+		n := new(big.Int).Set(bigOne)
+		totient := new(big.Int).Set(bigOne)
+		pminus1 := new(big.Int)
+		for _, prime := range primes {
+			n.Mul(n, prime)
+			pminus1.Sub(prime, bigOne)
+			totient.Mul(totient, pminus1)
+		}
+		if n.BitLen() != bits {
+			// This should never happen for nprimes == 2 because
+			// crypto/rand should set the top two bits in each prime.
+			// For nprimes > 2 we hope it does not happen often.
+			continue NextSetOfPrimes
+		}
+
+		priv.D = new(big.Int)
+		e := big.NewInt(int64(priv.E))
+		ok := priv.D.ModInverse(e, totient)
+
+		if ok != nil {
+			priv.Primes = primes
+			priv.N = n
+			break
+		}
+	}
+
+	priv.Precompute()
+	return priv, nil
+}
diff --git a/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/keys.go b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/keys.go
new file mode 100644
index 00000000000..2d7b0cf3737
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/keys.go
@@ -0,0 +1,842 @@
+// Copyright 2011 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package openpgp
+
+import (
+	goerrors "errors"
+	"io"
+	"time"
+
+	"github.com/ProtonMail/go-crypto/openpgp/armor"
+	"github.com/ProtonMail/go-crypto/openpgp/errors"
+	"github.com/ProtonMail/go-crypto/openpgp/packet"
+)
+
+// PublicKeyType is the armor type for a PGP public key.
+var PublicKeyType = "PGP PUBLIC KEY BLOCK"
+
+// PrivateKeyType is the armor type for a PGP private key.
+var PrivateKeyType = "PGP PRIVATE KEY BLOCK"
+
+// An Entity represents the components of an OpenPGP key: a primary public key
+// (which must be a signing key), one or more identities claimed by that key,
+// and zero or more subkeys, which may be encryption keys.
+type Entity struct {
+	PrimaryKey  *packet.PublicKey
+	PrivateKey  *packet.PrivateKey
+	Identities  map[string]*Identity // indexed by Identity.Name
+	Revocations []*packet.Signature
+	Subkeys     []Subkey
+}
+
+// An Identity represents an identity claimed by an Entity and zero or more
+// assertions by other entities about that claim.
+type Identity struct {
+	Name          string // by convention, has the form "Full Name (comment) <email@example.com>"
+	UserId        *packet.UserId
+	SelfSignature *packet.Signature
+	Revocations   []*packet.Signature
+	Signatures    []*packet.Signature // all (potentially unverified) self-signatures, revocations, and third-party signatures
+}
+
+// A Subkey is an additional public key in an Entity. Subkeys can be used for
+// encryption.
+type Subkey struct {
+	PublicKey   *packet.PublicKey
+	PrivateKey  *packet.PrivateKey
+	Sig         *packet.Signature
+	Revocations []*packet.Signature
+}
+
+// A Key identifies a specific public key in an Entity. This is either the
+// Entity's primary key or a subkey.
+type Key struct {
+	Entity        *Entity
+	PublicKey     *packet.PublicKey
+	PrivateKey    *packet.PrivateKey
+	SelfSignature *packet.Signature
+	Revocations   []*packet.Signature
+}
+
+// A KeyRing provides access to public and private keys.
+type KeyRing interface {
+	// KeysById returns the set of keys that have the given key id.
+	KeysById(id uint64) []Key
+	// KeysByIdAndUsage returns the set of keys with the given id
+	// that also meet the key usage given by requiredUsage.
+	// The requiredUsage is expressed as the bitwise-OR of
+	// packet.KeyFlag* values.
+	KeysByIdUsage(id uint64, requiredUsage byte) []Key
+	// DecryptionKeys returns all private keys that are valid for
+	// decryption.
+	DecryptionKeys() []Key
+}
+
+// PrimaryIdentity returns an Identity, preferring non-revoked identities,
+// identities marked as primary, or the latest-created identity, in that order.
+func (e *Entity) PrimaryIdentity() *Identity {
+	var primaryIdentity *Identity
+	for _, ident := range e.Identities {
+		if shouldPreferIdentity(primaryIdentity, ident) {
+			primaryIdentity = ident
+		}
+	}
+	return primaryIdentity
+}
+
+func shouldPreferIdentity(existingId, potentialNewId *Identity) bool {
+	if existingId == nil {
+		return true
+	}
+
+	if len(existingId.Revocations) > len(potentialNewId.Revocations) {
+		return true
+	}
+
+	if len(existingId.Revocations) < len(potentialNewId.Revocations) {
+		return false
+	}
+
+	if existingId.SelfSignature == nil {
+		return true
+	}
+
+	if existingId.SelfSignature.IsPrimaryId != nil && *existingId.SelfSignature.IsPrimaryId &&
+		!(potentialNewId.SelfSignature.IsPrimaryId != nil && *potentialNewId.SelfSignature.IsPrimaryId) {
+		return false
+	}
+
+	if !(existingId.SelfSignature.IsPrimaryId != nil && *existingId.SelfSignature.IsPrimaryId) &&
+		potentialNewId.SelfSignature.IsPrimaryId != nil && *potentialNewId.SelfSignature.IsPrimaryId {
+		return true
+	}
+
+	return potentialNewId.SelfSignature.CreationTime.After(existingId.SelfSignature.CreationTime)
+}
+
+// EncryptionKey returns the best candidate Key for encrypting a message to the
+// given Entity.
+func (e *Entity) EncryptionKey(now time.Time) (Key, bool) {
+	// Fail to find any encryption key if the...
+	i := e.PrimaryIdentity()
+	if e.PrimaryKey.KeyExpired(i.SelfSignature, now) || // primary key has expired
+		i.SelfSignature == nil || // user ID has no self-signature
+		i.SelfSignature.SigExpired(now) || // user ID self-signature has expired
+		e.Revoked(now) || // primary key has been revoked
+		i.Revoked(now) { // user ID has been revoked
+		return Key{}, false
+	}
+
+	// Iterate the keys to find the newest, unexpired one
+	candidateSubkey := -1
+	var maxTime time.Time
+	for i, subkey := range e.Subkeys {
+		if subkey.Sig.FlagsValid &&
+			subkey.Sig.FlagEncryptCommunications &&
+			subkey.PublicKey.PubKeyAlgo.CanEncrypt() &&
+			!subkey.PublicKey.KeyExpired(subkey.Sig, now) &&
+			!subkey.Sig.SigExpired(now) &&
+			!subkey.Revoked(now) &&
+			(maxTime.IsZero() || subkey.Sig.CreationTime.After(maxTime)) {
+			candidateSubkey = i
+			maxTime = subkey.Sig.CreationTime
+		}
+	}
+
+	if candidateSubkey != -1 {
+		subkey := e.Subkeys[candidateSubkey]
+		return Key{e, subkey.PublicKey, subkey.PrivateKey, subkey.Sig, subkey.Revocations}, true
+	}
+
+	// If we don't have any subkeys for encryption and the primary key
+	// is marked as OK to encrypt with, then we can use it.
+	if i.SelfSignature.FlagsValid && i.SelfSignature.FlagEncryptCommunications &&
+		e.PrimaryKey.PubKeyAlgo.CanEncrypt() {
+		return Key{e, e.PrimaryKey, e.PrivateKey, i.SelfSignature, e.Revocations}, true
+	}
+
+	return Key{}, false
+}
+
+// CertificationKey return the best candidate Key for certifying a key with this
+// Entity.
+func (e *Entity) CertificationKey(now time.Time) (Key, bool) {
+	return e.CertificationKeyById(now, 0)
+}
+
+// CertificationKeyById return the Key for key certification with this
+// Entity and keyID.
+func (e *Entity) CertificationKeyById(now time.Time, id uint64) (Key, bool) {
+	return e.signingKeyByIdUsage(now, id, packet.KeyFlagCertify)
+}
+
+// SigningKey return the best candidate Key for signing a message with this
+// Entity.
+func (e *Entity) SigningKey(now time.Time) (Key, bool) {
+	return e.SigningKeyById(now, 0)
+}
+
+// SigningKeyById return the Key for signing a message with this
+// Entity and keyID.
+func (e *Entity) SigningKeyById(now time.Time, id uint64) (Key, bool) {
+	return e.signingKeyByIdUsage(now, id, packet.KeyFlagSign)
+}
+
+func (e *Entity) signingKeyByIdUsage(now time.Time, id uint64, flags int) (Key, bool) {
+	// Fail to find any signing key if the...
+	i := e.PrimaryIdentity()
+	if e.PrimaryKey.KeyExpired(i.SelfSignature, now) || // primary key has expired
+		i.SelfSignature == nil || // user ID has no self-signature
+		i.SelfSignature.SigExpired(now) || // user ID self-signature has expired
+		e.Revoked(now) || // primary key has been revoked
+		i.Revoked(now) { // user ID has been revoked
+		return Key{}, false
+	}
+
+	// Iterate the keys to find the newest, unexpired one
+	candidateSubkey := -1
+	var maxTime time.Time
+	for idx, subkey := range e.Subkeys {
+		if subkey.Sig.FlagsValid &&
+			(flags&packet.KeyFlagCertify == 0 || subkey.Sig.FlagCertify) &&
+			(flags&packet.KeyFlagSign == 0 || subkey.Sig.FlagSign) &&
+			subkey.PublicKey.PubKeyAlgo.CanSign() &&
+			!subkey.PublicKey.KeyExpired(subkey.Sig, now) &&
+			!subkey.Sig.SigExpired(now) &&
+			!subkey.Revoked(now) &&
+			(maxTime.IsZero() || subkey.Sig.CreationTime.After(maxTime)) &&
+			(id == 0 || subkey.PublicKey.KeyId == id) {
+			candidateSubkey = idx
+			maxTime = subkey.Sig.CreationTime
+		}
+	}
+
+	if candidateSubkey != -1 {
+		subkey := e.Subkeys[candidateSubkey]
+		return Key{e, subkey.PublicKey, subkey.PrivateKey, subkey.Sig, subkey.Revocations}, true
+	}
+
+	// If we don't have any subkeys for signing and the primary key
+	// is marked as OK to sign with, then we can use it.
+	if i.SelfSignature.FlagsValid &&
+		(flags&packet.KeyFlagCertify == 0 || i.SelfSignature.FlagCertify) &&
+		(flags&packet.KeyFlagSign == 0 || i.SelfSignature.FlagSign) &&
+		e.PrimaryKey.PubKeyAlgo.CanSign() &&
+		(id == 0 || e.PrimaryKey.KeyId == id) {
+		return Key{e, e.PrimaryKey, e.PrivateKey, i.SelfSignature, e.Revocations}, true
+	}
+
+	// No keys with a valid Signing Flag or no keys matched the id passed in
+	return Key{}, false
+}
+
+func revoked(revocations []*packet.Signature, now time.Time) bool {
+	for _, revocation := range revocations {
+		if revocation.RevocationReason != nil && *revocation.RevocationReason == packet.KeyCompromised {
+			// If the key is compromised, the key is considered revoked even before the revocation date.
+			return true
+		}
+		if !revocation.SigExpired(now) {
+			return true
+		}
+	}
+	return false
+}
+
+// Revoked returns whether the entity has any direct key revocation signatures.
+// Note that third-party revocation signatures are not supported.
+// Note also that Identity and Subkey revocation should be checked separately.
+func (e *Entity) Revoked(now time.Time) bool {
+	return revoked(e.Revocations, now)
+}
+
+// EncryptPrivateKeys encrypts all non-encrypted keys in the entity with the same key
+// derived from the provided passphrase. Public keys and dummy keys are ignored,
+// and don't cause an error to be returned.
+func (e *Entity) EncryptPrivateKeys(passphrase []byte, config *packet.Config) error {
+	var keysToEncrypt []*packet.PrivateKey
+	// Add entity private key to encrypt.
+	if e.PrivateKey != nil && !e.PrivateKey.Dummy() && !e.PrivateKey.Encrypted {
+		keysToEncrypt = append(keysToEncrypt,  e.PrivateKey)
+	}
+
+	// Add subkeys to encrypt.
+	for _, sub := range e.Subkeys {
+		if sub.PrivateKey != nil && !sub.PrivateKey.Dummy() && !sub.PrivateKey.Encrypted {
+			keysToEncrypt = append(keysToEncrypt, sub.PrivateKey)
+		}
+	}
+	return packet.EncryptPrivateKeys(keysToEncrypt, passphrase, config)
+}
+
+// DecryptPrivateKeys decrypts all encrypted keys in the entitiy with the given passphrase.
+// Avoids recomputation of similar s2k key derivations. Public keys and dummy keys are ignored,
+// and don't cause an error to be returned.
+func (e *Entity) DecryptPrivateKeys(passphrase []byte) error {
+	var keysToDecrypt []*packet.PrivateKey
+	// Add entity private key to decrypt.
+	if e.PrivateKey != nil && !e.PrivateKey.Dummy() && e.PrivateKey.Encrypted {
+		keysToDecrypt = append(keysToDecrypt, e.PrivateKey)
+	}
+
+	// Add subkeys to decrypt.
+	for _, sub := range e.Subkeys {
+		if sub.PrivateKey != nil && !sub.PrivateKey.Dummy() && sub.PrivateKey.Encrypted {
+			keysToDecrypt = append(keysToDecrypt,  sub.PrivateKey)
+		}
+	}
+	return packet.DecryptPrivateKeys(keysToDecrypt, passphrase)
+}
+
+// Revoked returns whether the identity has been revoked by a self-signature.
+// Note that third-party revocation signatures are not supported.
+func (i *Identity) Revoked(now time.Time) bool {
+	return revoked(i.Revocations, now)
+}
+
+// Revoked returns whether the subkey has been revoked by a self-signature.
+// Note that third-party revocation signatures are not supported.
+func (s *Subkey) Revoked(now time.Time) bool {
+	return revoked(s.Revocations, now)
+}
+
+// Revoked returns whether the key or subkey has been revoked by a self-signature.
+// Note that third-party revocation signatures are not supported.
+// Note also that Identity revocation should be checked separately.
+// Normally, it's not necessary to call this function, except on keys returned by
+// KeysById or KeysByIdUsage.
+func (key *Key) Revoked(now time.Time) bool {
+	return revoked(key.Revocations, now)
+}
+
+// An EntityList contains one or more Entities.
+type EntityList []*Entity
+
+// KeysById returns the set of keys that have the given key id.
+func (el EntityList) KeysById(id uint64) (keys []Key) {
+	for _, e := range el {
+		if e.PrimaryKey.KeyId == id {
+			ident := e.PrimaryIdentity()
+			selfSig := ident.SelfSignature
+			keys = append(keys, Key{e, e.PrimaryKey, e.PrivateKey, selfSig, e.Revocations})
+		}
+
+		for _, subKey := range e.Subkeys {
+			if subKey.PublicKey.KeyId == id {
+				keys = append(keys, Key{e, subKey.PublicKey, subKey.PrivateKey, subKey.Sig, subKey.Revocations})
+			}
+		}
+	}
+	return
+}
+
+// KeysByIdAndUsage returns the set of keys with the given id that also meet
+// the key usage given by requiredUsage.  The requiredUsage is expressed as
+// the bitwise-OR of packet.KeyFlag* values.
+func (el EntityList) KeysByIdUsage(id uint64, requiredUsage byte) (keys []Key) {
+	for _, key := range el.KeysById(id) {
+		if requiredUsage != 0 {
+			if key.SelfSignature == nil || !key.SelfSignature.FlagsValid {
+				continue
+			}
+
+			var usage byte
+			if key.SelfSignature.FlagCertify {
+				usage |= packet.KeyFlagCertify
+			}
+			if key.SelfSignature.FlagSign {
+				usage |= packet.KeyFlagSign
+			}
+			if key.SelfSignature.FlagEncryptCommunications {
+				usage |= packet.KeyFlagEncryptCommunications
+			}
+			if key.SelfSignature.FlagEncryptStorage {
+				usage |= packet.KeyFlagEncryptStorage
+			}
+			if usage&requiredUsage != requiredUsage {
+				continue
+			}
+		}
+
+		keys = append(keys, key)
+	}
+	return
+}
+
+// DecryptionKeys returns all private keys that are valid for decryption.
+func (el EntityList) DecryptionKeys() (keys []Key) {
+	for _, e := range el {
+		for _, subKey := range e.Subkeys {
+			if subKey.PrivateKey != nil && subKey.Sig.FlagsValid && (subKey.Sig.FlagEncryptStorage || subKey.Sig.FlagEncryptCommunications) {
+				keys = append(keys, Key{e, subKey.PublicKey, subKey.PrivateKey, subKey.Sig, subKey.Revocations})
+			}
+		}
+	}
+	return
+}
+
+// ReadArmoredKeyRing reads one or more public/private keys from an armor keyring file.
+func ReadArmoredKeyRing(r io.Reader) (EntityList, error) {
+	block, err := armor.Decode(r)
+	if err == io.EOF {
+		return nil, errors.InvalidArgumentError("no armored data found")
+	}
+	if err != nil {
+		return nil, err
+	}
+	if block.Type != PublicKeyType && block.Type != PrivateKeyType {
+		return nil, errors.InvalidArgumentError("expected public or private key block, got: " + block.Type)
+	}
+
+	return ReadKeyRing(block.Body)
+}
+
+// ReadKeyRing reads one or more public/private keys. Unsupported keys are
+// ignored as long as at least a single valid key is found.
+func ReadKeyRing(r io.Reader) (el EntityList, err error) {
+	packets := packet.NewReader(r)
+	var lastUnsupportedError error
+
+	for {
+		var e *Entity
+		e, err = ReadEntity(packets)
+		if err != nil {
+			// TODO: warn about skipped unsupported/unreadable keys
+			if _, ok := err.(errors.UnsupportedError); ok {
+				lastUnsupportedError = err
+				err = readToNextPublicKey(packets)
+			} else if _, ok := err.(errors.StructuralError); ok {
+				// Skip unreadable, badly-formatted keys
+				lastUnsupportedError = err
+				err = readToNextPublicKey(packets)
+			}
+			if err == io.EOF {
+				err = nil
+				break
+			}
+			if err != nil {
+				el = nil
+				break
+			}
+		} else {
+			el = append(el, e)
+		}
+	}
+
+	if len(el) == 0 && err == nil {
+		err = lastUnsupportedError
+	}
+	return
+}
+
+// readToNextPublicKey reads packets until the start of the entity and leaves
+// the first packet of the new entity in the Reader.
+func readToNextPublicKey(packets *packet.Reader) (err error) {
+	var p packet.Packet
+	for {
+		p, err = packets.Next()
+		if err == io.EOF {
+			return
+		} else if err != nil {
+			if _, ok := err.(errors.UnsupportedError); ok {
+				err = nil
+				continue
+			}
+			return
+		}
+
+		if pk, ok := p.(*packet.PublicKey); ok && !pk.IsSubkey {
+			packets.Unread(p)
+			return
+		}
+	}
+}
+
+// ReadEntity reads an entity (public key, identities, subkeys etc) from the
+// given Reader.
+func ReadEntity(packets *packet.Reader) (*Entity, error) {
+	e := new(Entity)
+	e.Identities = make(map[string]*Identity)
+
+	p, err := packets.Next()
+	if err != nil {
+		return nil, err
+	}
+
+	var ok bool
+	if e.PrimaryKey, ok = p.(*packet.PublicKey); !ok {
+		if e.PrivateKey, ok = p.(*packet.PrivateKey); !ok {
+			packets.Unread(p)
+			return nil, errors.StructuralError("first packet was not a public/private key")
+		}
+		e.PrimaryKey = &e.PrivateKey.PublicKey
+	}
+
+	if !e.PrimaryKey.PubKeyAlgo.CanSign() {
+		return nil, errors.StructuralError("primary key cannot be used for signatures")
+	}
+
+	var revocations []*packet.Signature
+EachPacket:
+	for {
+		p, err := packets.Next()
+		if err == io.EOF {
+			break
+		} else if err != nil {
+			return nil, err
+		}
+
+		switch pkt := p.(type) {
+		case *packet.UserId:
+			if err := addUserID(e, packets, pkt); err != nil {
+				return nil, err
+			}
+		case *packet.Signature:
+			if pkt.SigType == packet.SigTypeKeyRevocation {
+				revocations = append(revocations, pkt)
+			} else if pkt.SigType == packet.SigTypeDirectSignature {
+				// TODO: RFC4880 5.2.1 permits signatures
+				// directly on keys (eg. to bind additional
+				// revocation keys).
+			}
+			// Else, ignoring the signature as it does not follow anything
+			// we would know to attach it to.
+		case *packet.PrivateKey:
+			if !pkt.IsSubkey {
+				packets.Unread(p)
+				break EachPacket
+			}
+			err = addSubkey(e, packets, &pkt.PublicKey, pkt)
+			if err != nil {
+				return nil, err
+			}
+		case *packet.PublicKey:
+			if !pkt.IsSubkey {
+				packets.Unread(p)
+				break EachPacket
+			}
+			err = addSubkey(e, packets, pkt, nil)
+			if err != nil {
+				return nil, err
+			}
+		default:
+			// we ignore unknown packets
+		}
+	}
+
+	if len(e.Identities) == 0 {
+		return nil, errors.StructuralError("entity without any identities")
+	}
+
+	for _, revocation := range revocations {
+		err = e.PrimaryKey.VerifyRevocationSignature(revocation)
+		if err == nil {
+			e.Revocations = append(e.Revocations, revocation)
+		} else {
+			// TODO: RFC 4880 5.2.3.15 defines revocation keys.
+			return nil, errors.StructuralError("revocation signature signed by alternate key")
+		}
+	}
+
+	return e, nil
+}
+
+func addUserID(e *Entity, packets *packet.Reader, pkt *packet.UserId) error {
+	// Make a new Identity object, that we might wind up throwing away.
+	// We'll only add it if we get a valid self-signature over this
+	// userID.
+	identity := new(Identity)
+	identity.Name = pkt.Id
+	identity.UserId = pkt
+
+	for {
+		p, err := packets.Next()
+		if err == io.EOF {
+			break
+		} else if err != nil {
+			return err
+		}
+
+		sig, ok := p.(*packet.Signature)
+		if !ok {
+			packets.Unread(p)
+			break
+		}
+
+		if sig.SigType != packet.SigTypeGenericCert &&
+			sig.SigType != packet.SigTypePersonaCert &&
+			sig.SigType != packet.SigTypeCasualCert &&
+			sig.SigType != packet.SigTypePositiveCert &&
+			sig.SigType != packet.SigTypeCertificationRevocation {
+			return errors.StructuralError("user ID signature with wrong type")
+		}
+
+		if sig.CheckKeyIdOrFingerprint(e.PrimaryKey) {
+			if err = e.PrimaryKey.VerifyUserIdSignature(pkt.Id, e.PrimaryKey, sig); err != nil {
+				return errors.StructuralError("user ID self-signature invalid: " + err.Error())
+			}
+			if sig.SigType == packet.SigTypeCertificationRevocation {
+				identity.Revocations = append(identity.Revocations, sig)
+			} else if identity.SelfSignature == nil || sig.CreationTime.After(identity.SelfSignature.CreationTime) {
+				identity.SelfSignature = sig
+			}
+			identity.Signatures = append(identity.Signatures, sig)
+			e.Identities[pkt.Id] = identity
+		} else {
+			identity.Signatures = append(identity.Signatures, sig)
+		}
+	}
+
+	return nil
+}
+
+func addSubkey(e *Entity, packets *packet.Reader, pub *packet.PublicKey, priv *packet.PrivateKey) error {
+	var subKey Subkey
+	subKey.PublicKey = pub
+	subKey.PrivateKey = priv
+
+	for {
+		p, err := packets.Next()
+		if err == io.EOF {
+			break
+		} else if err != nil {
+			return errors.StructuralError("subkey signature invalid: " + err.Error())
+		}
+
+		sig, ok := p.(*packet.Signature)
+		if !ok {
+			packets.Unread(p)
+			break
+		}
+
+		if sig.SigType != packet.SigTypeSubkeyBinding && sig.SigType != packet.SigTypeSubkeyRevocation {
+			return errors.StructuralError("subkey signature with wrong type")
+		}
+
+		if err := e.PrimaryKey.VerifyKeySignature(subKey.PublicKey, sig); err != nil {
+			return errors.StructuralError("subkey signature invalid: " + err.Error())
+		}
+
+		switch sig.SigType {
+		case packet.SigTypeSubkeyRevocation:
+			subKey.Revocations = append(subKey.Revocations, sig)
+		case packet.SigTypeSubkeyBinding:
+			if subKey.Sig == nil || sig.CreationTime.After(subKey.Sig.CreationTime) {
+				subKey.Sig = sig
+			}
+		}
+	}
+
+	if subKey.Sig == nil {
+		return errors.StructuralError("subkey packet not followed by signature")
+	}
+
+	e.Subkeys = append(e.Subkeys, subKey)
+
+	return nil
+}
+
+// SerializePrivate serializes an Entity, including private key material, but
+// excluding signatures from other entities, to the given Writer.
+// Identities and subkeys are re-signed in case they changed since NewEntry.
+// If config is nil, sensible defaults will be used.
+func (e *Entity) SerializePrivate(w io.Writer, config *packet.Config) (err error) {
+	if e.PrivateKey.Dummy() {
+		return errors.ErrDummyPrivateKey("dummy private key cannot re-sign identities")
+	}
+	return e.serializePrivate(w, config, true)
+}
+
+// SerializePrivateWithoutSigning serializes an Entity, including private key
+// material, but excluding signatures from other entities, to the given Writer.
+// Self-signatures of identities and subkeys are not re-signed. This is useful
+// when serializing GNU dummy keys, among other things.
+// If config is nil, sensible defaults will be used.
+func (e *Entity) SerializePrivateWithoutSigning(w io.Writer, config *packet.Config) (err error) {
+	return e.serializePrivate(w, config, false)
+}
+
+func (e *Entity) serializePrivate(w io.Writer, config *packet.Config, reSign bool) (err error) {
+	if e.PrivateKey == nil {
+		return goerrors.New("openpgp: private key is missing")
+	}
+	err = e.PrivateKey.Serialize(w)
+	if err != nil {
+		return
+	}
+	for _, revocation := range e.Revocations {
+		err := revocation.Serialize(w)
+		if err != nil {
+			return err
+		}
+	}
+	for _, ident := range e.Identities {
+		err = ident.UserId.Serialize(w)
+		if err != nil {
+			return
+		}
+		if reSign {
+			if ident.SelfSignature == nil {
+				return goerrors.New("openpgp: can't re-sign identity without valid self-signature")
+			}
+			err = ident.SelfSignature.SignUserId(ident.UserId.Id, e.PrimaryKey, e.PrivateKey, config)
+			if err != nil {
+				return
+			}
+		}
+		for _, sig := range ident.Signatures {
+			err = sig.Serialize(w)
+			if err != nil {
+				return err
+			}
+		}
+	}
+	for _, subkey := range e.Subkeys {
+		err = subkey.PrivateKey.Serialize(w)
+		if err != nil {
+			return
+		}
+		if reSign {
+			err = subkey.Sig.SignKey(subkey.PublicKey, e.PrivateKey, config)
+			if err != nil {
+				return
+			}
+			if subkey.Sig.EmbeddedSignature != nil {
+				err = subkey.Sig.EmbeddedSignature.CrossSignKey(subkey.PublicKey, e.PrimaryKey,
+					subkey.PrivateKey, config)
+				if err != nil {
+					return
+				}
+			}
+		}
+		for _, revocation := range subkey.Revocations {
+			err := revocation.Serialize(w)
+			if err != nil {
+				return err
+			}
+		}
+		err = subkey.Sig.Serialize(w)
+		if err != nil {
+			return
+		}
+	}
+	return nil
+}
+
+// Serialize writes the public part of the given Entity to w, including
+// signatures from other entities. No private key material will be output.
+func (e *Entity) Serialize(w io.Writer) error {
+	err := e.PrimaryKey.Serialize(w)
+	if err != nil {
+		return err
+	}
+	for _, revocation := range e.Revocations {
+		err := revocation.Serialize(w)
+		if err != nil {
+			return err
+		}
+	}
+	for _, ident := range e.Identities {
+		err = ident.UserId.Serialize(w)
+		if err != nil {
+			return err
+		}
+		for _, sig := range ident.Signatures {
+			err = sig.Serialize(w)
+			if err != nil {
+				return err
+			}
+		}
+	}
+	for _, subkey := range e.Subkeys {
+		err = subkey.PublicKey.Serialize(w)
+		if err != nil {
+			return err
+		}
+		for _, revocation := range subkey.Revocations {
+			err := revocation.Serialize(w)
+			if err != nil {
+				return err
+			}
+		}
+		err = subkey.Sig.Serialize(w)
+		if err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// SignIdentity adds a signature to e, from signer, attesting that identity is
+// associated with e. The provided identity must already be an element of
+// e.Identities and the private key of signer must have been decrypted if
+// necessary.
+// If config is nil, sensible defaults will be used.
+func (e *Entity) SignIdentity(identity string, signer *Entity, config *packet.Config) error {
+	certificationKey, ok := signer.CertificationKey(config.Now())
+	if !ok {
+		return errors.InvalidArgumentError("no valid certification key found")
+	}
+
+	if certificationKey.PrivateKey.Encrypted {
+		return errors.InvalidArgumentError("signing Entity's private key must be decrypted")
+	}
+
+	ident, ok := e.Identities[identity]
+	if !ok {
+		return errors.InvalidArgumentError("given identity string not found in Entity")
+	}
+
+	sig := createSignaturePacket(certificationKey.PublicKey, packet.SigTypeGenericCert, config)
+
+	signingUserID := config.SigningUserId()
+	if signingUserID != "" {
+		if _, ok := signer.Identities[signingUserID]; !ok {
+			return errors.InvalidArgumentError("signer identity string not found in signer Entity")
+		}
+		sig.SignerUserId = &signingUserID
+	}
+
+	if err := sig.SignUserId(identity, e.PrimaryKey, certificationKey.PrivateKey, config); err != nil {
+		return err
+	}
+	ident.Signatures = append(ident.Signatures, sig)
+	return nil
+}
+
+// RevokeKey generates a key revocation signature (packet.SigTypeKeyRevocation) with the
+// specified reason code and text (RFC4880 section-5.2.3.23).
+// If config is nil, sensible defaults will be used.
+func (e *Entity) RevokeKey(reason packet.ReasonForRevocation, reasonText string, config *packet.Config) error {
+	revSig := createSignaturePacket(e.PrimaryKey, packet.SigTypeKeyRevocation, config)
+	revSig.RevocationReason = &reason
+	revSig.RevocationReasonText = reasonText
+
+	if err := revSig.RevokeKey(e.PrimaryKey, e.PrivateKey, config); err != nil {
+		return err
+	}
+	e.Revocations = append(e.Revocations, revSig)
+	return nil
+}
+
+// RevokeSubkey generates a subkey revocation signature (packet.SigTypeSubkeyRevocation) for
+// a subkey with the specified reason code and text (RFC4880 section-5.2.3.23).
+// If config is nil, sensible defaults will be used.
+func (e *Entity) RevokeSubkey(sk *Subkey, reason packet.ReasonForRevocation, reasonText string, config *packet.Config) error {
+	if err := e.PrimaryKey.VerifyKeySignature(sk.PublicKey, sk.Sig); err != nil {
+		return errors.InvalidArgumentError("given subkey is not associated with this key")
+	}
+
+	revSig := createSignaturePacket(e.PrimaryKey, packet.SigTypeSubkeyRevocation, config)
+	revSig.RevocationReason = &reason
+	revSig.RevocationReasonText = reasonText
+
+	if err := revSig.RevokeSubkey(sk.PublicKey, e.PrivateKey, config); err != nil {
+		return err
+	}
+
+	sk.Revocations = append(sk.Revocations, revSig)
+	return nil
+}
diff --git a/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/keys_test_data.go b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/keys_test_data.go
new file mode 100644
index 00000000000..108fd096f3c
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/keys_test_data.go
@@ -0,0 +1,538 @@
+package openpgp
+
+const expiringKeyHex = "c6c04d0451d0c680010800abbb021fd03ffc4e96618901180c3fdcb060ee69eeead97b91256d11420d80b5f1b51930248044130bd300605cf8a05b7a40d3d8cfb0a910be2e3db50dcd50a9c54064c2a5550801daa834ff4480b33d3d3ca495ff8a4e84a886977d17d998f881241a874083d8b995beab555b6d22b8a4817ab17ac3e7304f7d4d2c05c495fb2218348d3bc13651db1d92732e368a9dd7dcefa6eddff30b94706a9aaee47e9d39321460b740c59c6fc3c2fd8ab6c0fb868cb87c0051f0321301fe0f0e1820b15e7fb7063395769b525005c7e30a7ce85984f5cac00504e7b4fdc45d74958de8388436fd5c7ba9ea121f1c851b5911dd1b47a14d81a09e92ef37721e2325b6790011010001cd00c2c07b041001080025050251d0c680050900278d00060b09070803020415080a0203160201021901021b03021e01000a0910e7b484133a890a35ae4b0800a1beb82e7f28eaf5273d6af9d3391314f6280b2b624eaca2851f89a9ebcaf80ac589ebd509f168bc4322106ca2e2ce77a76e071a3c7444787d65216b5f05e82c77928860b92aace3b7d0327db59492f422eb9dfab7249266d37429870b091a98aba8724c2259ebf8f85093f21255eafa75aa841e31d94f2ac891b9755fed455e539044ee69fc47950b80e003fc9f298d695660f28329eaa38037c367efde1727458e514faf990d439a21461b719edaddf9296d3d0647b43ca56cb8dbf63b4fcf8b9968e7928c463470fab3b98e44d0d95645062f94b2d04fe56bd52822b71934db8ce845622c40b92fcbe765a142e7f38b61a6aa9606c8e8858dcd3b6eb1894acec04d0451d1f06b01080088bea67444e1789390e7c0335c86775502d58ec783d99c8ef4e06de235ed3dd4b0467f6f358d818c7d8989d43ec6d69fcbc8c32632d5a1b605e3fa8e41d695fcdcaa535936cd0157f9040dce362519803b908eafe838bb13216c885c6f93e9e8d5745607f0d062322085d6bdc760969149a8ff8dd9f5c18d9bfe2e6f63a06e17694cf1f67587c6fb70e9aebf90ffc528ca3b615ac7c9d4a21ea4f7c06f2e98fbbd90a859b8608bf9ea638e3a54289ce44c283110d0c45fa458de6251cd6e7baf71f80f12c8978340490fd90c92b81736ae902ed958e478dceae2835953d189c45d182aff02ea2be61b81d8e94430f041d638647b43e2fcb45fd512fbf5068b810011010001c2c06504180108000f050251d1f06b050900081095021b0c000a0910e7b484133a890a35e63407fe2ec88d6d1e6c9ce7553ece0cb2524747217bad29f251d33df84599ffcc900141a355abd62126800744068a5e05dc167056aa9205273dc7765a2ed49db15c2a83b8d6e6429c902136f1e12229086c1c10c0053242c2a4ae1930db58163387a48cad64607ff2153c320e42843dec28e3fce90e7399d63ac0affa2fee1f0adc0953c89eb3f46ef1d6c04328ed13b491669d5120a3782e3ffb7c69575fb77eebd108794f4dda9d34be2bae57e8e59ec8ebfda2f6f06104b2321be408ea146e2db482b00c5055c8618de36ac9716f80da2617e225556d0fce61b01c8cea2d1e0ea982c31711060ca370f2739366e1e708f38405d784b49d16a26cf62d152eae734327cec04d0451d1f07b010800d5af91c5e7c2fd8951c8d254eab0c97cdcb66822f868b79b78c366255059a68fd74ebca9adb9b970cd9e586690e6e0756705432306878c897b10a4b4ca0005966f99ac8fa4e6f9caf54bf8e53844544beee9872a7ac64c119cf1393d96e674254b661f61ee975633d0e8a8672531edb6bb8e211204e7754a9efa802342118eee850beea742bac95a3f706cc2024cf6037a308bb68162b2f53b9a6346a96e6d31871a2456186e24a1c7a82b82ac04afdfd57cd7fb9ba77a9c760d40b76a170f7be525e5fb6a9848cc726e806187710d9b190387df28700f321f988a392899f93815cc937f309129eb94d5299c5547cb2c085898e6639496e70d746c9d3fb9881d0011010001c2c06504180108000f050251d1f07b050900266305021b0c000a0910e7b484133a890a35bff207fd10dfe8c4a6ea1dd30568012b6fd6891a763c87ad0f7a1d112aad9e8e3239378a3b85588c235865bac2e614348cb4f216d7217f53b3ef48c192e0a4d31d64d7bfa5faccf21155965fa156e887056db644a05ad08a85cc6152d1377d9e37b46f4ff462bbe68ace2dc586ef90070314576c985d8037c2ba63f0a7dc17a62e15bd77e88bc61d9d00858979709f12304264a4cf4225c5cf86f12c8e19486cb9cdcc69f18f027e5f16f4ca8b50e28b3115eaff3a345acd21f624aef81f6ede515c1b55b26b84c1e32264754eab672d5489b287e7277ea855e0a5ff2aa9e8b8c76d579a964ec225255f4d57bf66639ccb34b64798846943e162a41096a7002ca21c7f56"
+const subkeyUsageHex = "988d04533a52bc010400d26af43085558f65b9e7dbc90cb9238015259aed5e954637adcfa2181548b2d0b60c65f1f42ec5081cbf1bc0a8aa4900acfb77070837c58f26012fbce297d70afe96e759ad63531f0037538e70dbf8e384569b9720d99d8eb39d8d0a2947233ed242436cb6ac7dfe74123354b3d0119b5c235d3dd9c9d6c004f8ffaf67ad8583001101000188b7041f010200210502533b8552170c8001ce094aa433f7040bb2ddf0be3893cb843d0fe70c020700000a0910a42704b92866382aa98404009d63d916a27543da4221c60087c33f1c44bec9998c5438018ed370cca4962876c748e94b73eb39c58eb698063f3fd6346d58dd2a11c0247934c4a9d71f24754f7468f96fb24c3e791dd2392b62f626148ad724189498cbf993db2df7c0cdc2d677c35da0f16cb16c9ce7c33b4de65a4a91b1d21a130ae9cc26067718910ef8e2b417556d627261203c756d627261407379642e65642e61753e88b80413010200220502533a52bc021b03060b090807030206150802090a0b0416020301021e01021780000a0910a42704b92866382a47840400c0c2bd04f5fca586de408b395b3c280a278259c93eaaa8b79a53b97003f8ed502a8a00446dd9947fb462677e4fcac0dac2f0701847d15130aadb6cd9e0705ea0cf5f92f129136c7be21a718d46c8e641eb7f044f2adae573e11ae423a0a9ca51324f03a8a2f34b91fa40c3cc764bee4dccadedb54c768ba0469b683ea53f1c29b88d04533a52bc01040099c92a5d6f8b744224da27bc2369127c35269b58bec179de6bbc038f749344222f85a31933224f26b70243c4e4b2d242f0c4777eaef7b5502f9dad6d8bf3aaeb471210674b74de2d7078af497d55f5cdad97c7bedfbc1b41e8065a97c9c3d344b21fc81d27723af8e374bc595da26ea242dccb6ae497be26eea57e563ed517e90011010001889f0418010200090502533a52bc021b0c000a0910a42704b92866382afa1403ff70284c2de8a043ff51d8d29772602fa98009b7861c540535f874f2c230af8caf5638151a636b21f8255003997ccd29747fdd06777bb24f9593bd7d98a3e887689bf902f999915fcc94625ae487e5d13e6616f89090ebc4fdc7eb5cad8943e4056995bb61c6af37f8043016876a958ec7ebf39c43d20d53b7f546cfa83e8d2604b88d04533b8283010400c0b529316dbdf58b4c54461e7e669dc11c09eb7f73819f178ccd4177b9182b91d138605fcf1e463262fabefa73f94a52b5e15d1904635541c7ea540f07050ce0fb51b73e6f88644cec86e91107c957a114f69554548a85295d2b70bd0b203992f76eb5d493d86d9eabcaa7ef3fc7db7e458438db3fcdb0ca1cc97c638439a9170011010001889f0418010200090502533b8283021b0c000a0910a42704b92866382adc6d0400cfff6258485a21675adb7a811c3e19ebca18851533f75a7ba317950b9997fda8d1a4c8c76505c08c04b6c2cc31dc704d33da36a21273f2b388a1a706f7c3378b66d887197a525936ed9a69acb57fe7f718133da85ec742001c5d1864e9c6c8ea1b94f1c3759cebfd93b18606066c063a63be86085b7e37bdbc65f9a915bf084bb901a204533b85cd110400aed3d2c52af2b38b5b67904b0ef73d6dd7aef86adb770e2b153cd22489654dcc91730892087bb9856ae2d9f7ed1eb48f214243fe86bfe87b349ebd7c30e630e49c07b21fdabf78b7a95c8b7f969e97e3d33f2e074c63552ba64a2ded7badc05ce0ea2be6d53485f6900c7860c7aa76560376ce963d7271b9b54638a4028b573f00a0d8854bfcdb04986141568046202192263b9b67350400aaa1049dbc7943141ef590a70dcb028d730371d92ea4863de715f7f0f16d168bd3dc266c2450457d46dcbbf0b071547e5fbee7700a820c3750b236335d8d5848adb3c0da010e998908dfd93d961480084f3aea20b247034f8988eccb5546efaa35a92d0451df3aaf1aee5aa36a4c4d462c760ecd9cebcabfbe1412b1f21450f203fd126687cd486496e971a87fd9e1a8a765fe654baa219a6871ab97768596ab05c26c1aeea8f1a2c72395a58dbc12ef9640d2b95784e974a4d2d5a9b17c25fedacfe551bda52602de8f6d2e48443f5dd1a2a2a8e6a5e70ecdb88cd6e766ad9745c7ee91d78cc55c3d06536b49c3fee6c3d0b6ff0fb2bf13a314f57c953b8f4d93bf88e70418010200090502533b85cd021b0200520910a42704b92866382a47200419110200060502533b85cd000a091042ce2c64bc0ba99214b2009e26b26852c8b13b10c35768e40e78fbbb48bd084100a0c79d9ea0844fa5853dd3c85ff3ecae6f2c9dd6c557aa04008bbbc964cd65b9b8299d4ebf31f41cc7264b8cf33a00e82c5af022331fac79efc9563a822497ba012953cefe2629f1242fcdcb911dbb2315985bab060bfd58261ace3c654bdbbe2e8ed27a46e836490145c86dc7bae15c011f7e1ffc33730109b9338cd9f483e7cef3d2f396aab5bd80efb6646d7e778270ee99d934d187dd98"
+const revokedKeyHex = "988d045331ce82010400c4fdf7b40a5477f206e6ee278eaef888ca73bf9128a9eef9f2f1ddb8b7b71a4c07cfa241f028a04edb405e4d916c61d6beabc333813dc7b484d2b3c52ee233c6a79b1eea4e9cc51596ba9cd5ac5aeb9df62d86ea051055b79d03f8a4fa9f38386f5bd17529138f3325d46801514ea9047977e0829ed728e68636802796801be10011010001889f04200102000905025331d0e3021d03000a0910a401d9f09a34f7c042aa040086631196405b7e6af71026b88e98012eab44aa9849f6ef3fa930c7c9f23deaedba9db1538830f8652fb7648ec3fcade8dbcbf9eaf428e83c6cbcc272201bfe2fbb90d41963397a7c0637a1a9d9448ce695d9790db2dc95433ad7be19eb3de72dacf1d6db82c3644c13eae2a3d072b99bb341debba012c5ce4006a7d34a1f4b94b444526567205265766f6b657220283c52656727732022424d204261726973746122204b657920262530305c303e5c29203c72656740626d626172697374612e636f2e61753e88b704130102002205025331ce82021b03060b090807030206150802090a0b0416020301021e01021780000a0910a401d9f09a34f7c0019c03f75edfbeb6a73e7225ad3cc52724e2872e04260d7daf0d693c170d8c4b243b8767bc7785763533febc62ec2600c30603c433c095453ede59ff2fcabeb84ce32e0ed9d5cf15ffcbc816202b64370d4d77c1e9077d74e94a16fb4fa2e5bec23a56d7a73cf275f91691ae1801a976fcde09e981a2f6327ac27ea1fecf3185df0d56889c04100102000605025331cfb5000a0910fe9645554e8266b64b4303fc084075396674fb6f778d302ac07cef6bc0b5d07b66b2004c44aef711cbac79617ef06d836b4957522d8772dd94bf41a2f4ac8b1ee6d70c57503f837445a74765a076d07b829b8111fc2a918423ddb817ead7ca2a613ef0bfb9c6b3562aec6c3cf3c75ef3031d81d95f6563e4cdcc9960bcb386c5d757b104fcca5fe11fc709df884604101102000605025331cfe7000a09107b15a67f0b3ddc0317f6009e360beea58f29c1d963a22b962b80788c3fa6c84e009d148cfde6b351469b8eae91187eff07ad9d08fcaab88d045331ce820104009f25e20a42b904f3fa555530fe5c46737cf7bd076c35a2a0d22b11f7e0b61a69320b768f4a80fe13980ce380d1cfc4a0cd8fbe2d2e2ef85416668b77208baa65bf973fe8e500e78cc310d7c8705cdb34328bf80e24f0385fce5845c33bc7943cf6b11b02348a23da0bf6428e57c05135f2dc6bd7c1ce325d666d5a5fd2fd5e410011010001889f04180102000905025331ce82021b0c000a0910a401d9f09a34f7c0418003fe34feafcbeaef348a800a0d908a7a6809cc7304017d820f70f0474d5e23cb17e38b67dc6dca282c6ca00961f4ec9edf2738d0f087b1d81e4871ef08e1798010863afb4eac4c44a376cb343be929c5be66a78cfd4456ae9ec6a99d97f4e1c3ff3583351db2147a65c0acef5c003fb544ab3a2e2dc4d43646f58b811a6c3a369d1f"
+const revokedSubkeyHex = "988d04533121f6010400aefc803a3e4bb1a61c86e8a86d2726c6a43e0079e9f2713f1fa017e9854c83877f4aced8e331d675c67ea83ddab80aacbfa0b9040bb12d96f5a3d6be09455e2a76546cbd21677537db941cab710216b6d24ec277ee0bd65b910f416737ed120f6b93a9d3b306245c8cfd8394606fdb462e5cf43c551438d2864506c63367fc890011010001b41d416c696365203c616c69636540626d626172697374612e636f2e61753e88bb041301020025021b03060b090807030206150802090a0b0416020301021e01021780050253312798021901000a09104ef7e4beccde97f015a803ff5448437780f63263b0df8442a995e7f76c221351a51edd06f2063d8166cf3157aada4923dfc44aa0f2a6a4da5cf83b7fe722ba8ab416c976e77c6b5682e7f1069026673bd0de56ba06fd5d7a9f177607f277d9b55ff940a638c3e68525c67517e2b3d976899b93ca267f705b3e5efad7d61220e96b618a4497eab8d04403d23f8846041011020006050253312910000a09107b15a67f0b3ddc03d96e009f50b6365d86c4be5d5e9d0ea42d5e56f5794c617700a0ab274e19c2827780016d23417ce89e0a2c0d987d889c04100102000605025331cf7a000a0910a401d9f09a34f7c0ee970400aca292f213041c9f3b3fc49148cbda9d84afee6183c8dd6c5ff2600b29482db5fecd4303797be1ee6d544a20a858080fec43412061c9a71fae4039fd58013b4ae341273e6c66ad4c7cdd9e68245bedb260562e7b166f2461a1032f2b38c0e0e5715fb3d1656979e052b55ca827a76f872b78a9fdae64bc298170bfcebedc1271b41a416c696365203c616c696365407379646973702e6f722e61753e88b804130102002205025331278b021b03060b090807030206150802090a0b0416020301021e01021780000a09104ef7e4beccde97f06a7003fa03c3af68d272ebc1fa08aa72a03b02189c26496a2833d90450801c4e42c5b5f51ad96ce2d2c9cef4b7c02a6a2fcf1412d6a2d486098eb762f5010a201819c17fd2888aec8eda20c65a3b75744de7ee5cc8ac7bfc470cbe3cb982720405a27a3c6a8c229cfe36905f881b02ed5680f6a8f05866efb9d6c5844897e631deb949ca8846041011020006050253312910000a09107b15a67f0b3ddc0347bc009f7fa35db59147469eb6f2c5aaf6428accb138b22800a0caa2f5f0874bacc5909c652a57a31beda65eddd5889c04100102000605025331cf7a000a0910a401d9f09a34f7c0316403ff46f2a5c101256627f16384d34a38fb47a6c88ba60506843e532d91614339fccae5f884a5741e7582ffaf292ba38ee10a270a05f139bde3814b6a077e8cd2db0f105ebea2a83af70d385f13b507fac2ad93ff79d84950328bb86f3074745a8b7f9b64990fb142e2a12976e27e8d09a28dc5621f957ac49091116da410ac3cbde1b88d04533121f6010400cbd785b56905e4192e2fb62a720727d43c4fa487821203cf72138b884b78b701093243e1d8c92a0248a6c0203a5a88693da34af357499abacaf4b3309c640797d03093870a323b4b6f37865f6eaa2838148a67df4735d43a90ca87942554cdf1c4a751b1e75f9fd4ce4e97e278d6c1c7ed59d33441df7d084f3f02beb68896c70011010001889f0418010200090502533121f6021b0c000a09104ef7e4beccde97f0b98b03fc0a5ccf6a372995835a2f5da33b282a7d612c0ab2a97f59cf9fff73e9110981aac2858c41399afa29624a7fd8a0add11654e3d882c0fd199e161bdad65e5e2548f7b68a437ea64293db1246e3011cbb94dc1bcdeaf0f2539bd88ff16d95547144d97cead6a8c5927660a91e6db0d16eb36b7b49a3525b54d1644e65599b032b7eb901a204533127a0110400bd3edaa09eff9809c4edc2c2a0ebe52e53c50a19c1e49ab78e6167bf61473bb08f2050d78a5cbbc6ed66aff7b42cd503f16b4a0b99fa1609681fca9b7ce2bbb1a5b3864d6cdda4d7ef7849d156d534dea30fb0efb9e4cf8959a2b2ce623905882d5430b995a15c3b9fe92906086788b891002924f94abe139b42cbbfaaabe42f00a0b65dc1a1ad27d798adbcb5b5ad02d2688c89477b03ff4eebb6f7b15a73b96a96bed201c0e5e4ea27e4c6e2dd1005b94d4b90137a5b1cf5e01c6226c070c4cc999938101578877ee76d296b9aab8246d57049caacf489e80a3f40589cade790a020b1ac146d6f7a6241184b8c7fcde680eae3188f5dcbe846d7f7bdad34f6fcfca08413e19c1d5df83fc7c7c627d493492e009c2f52a80400a2fe82de87136fd2e8845888c4431b032ba29d9a29a804277e31002a8201fb8591a3e55c7a0d0881496caf8b9fb07544a5a4879291d0dc026a0ea9e5bd88eb4aa4947bbd694b25012e208a250d65ddc6f1eea59d3aed3b4ec15fcab85e2afaa23a40ab1ef9ce3e11e1bc1c34a0e758e7aa64deb8739276df0af7d4121f834a9b88e70418010200090502533127a0021b02005209104ef7e4beccde97f047200419110200060502533127a0000a0910dbce4ee19529437fe045009c0b32f5ead48ee8a7e98fac0dea3d3e6c0e2c552500a0ad71fadc5007cfaf842d9b7db3335a8cdad15d3d1a6404009b08e2c68fe8f3b45c1bb72a4b3278cdf3012aa0f229883ad74aa1f6000bb90b18301b2f85372ca5d6b9bf478d235b733b1b197d19ccca48e9daf8e890cb64546b4ce1b178faccfff07003c172a2d4f5ebaba9f57153955f3f61a9b80a4f5cb959908f8b211b03b7026a8a82fc612bfedd3794969bcf458c4ce92be215a1176ab88d045331d144010400a5063000c5aaf34953c1aa3bfc95045b3aab9882b9a8027fecfe2142dc6b47ba8aca667399990244d513dd0504716908c17d92c65e74219e004f7b83fc125e575dd58efec3ab6dd22e3580106998523dea42ec75bf9aa111734c82df54630bebdff20fe981cfc36c76f865eb1c2fb62c9e85bc3a6e5015a361a2eb1c8431578d0011010001889f04280102000905025331d433021d03000a09104ef7e4beccde97f02e5503ff5e0630d1b65291f4882b6d40a29da4616bb5088717d469fbcc3648b8276de04a04988b1f1b9f3e18f52265c1f8b6c85861691c1a6b8a3a25a1809a0b32ad330aec5667cb4262f4450649184e8113849b05e5ad06a316ea80c001e8e71838190339a6e48bbde30647bcf245134b9a97fa875c1d83a9862cae87ffd7e2c4ce3a1b89013d04180102000905025331d144021b0200a809104ef7e4beccde97f09d2004190102000605025331d144000a0910677815e371c2fd23522203fe22ab62b8e7a151383cea3edd3a12995693911426f8ccf125e1f6426388c0010f88d9ca7da2224aee8d1c12135998640c5e1813d55a93df472faae75bef858457248db41b4505827590aeccf6f9eb646da7f980655dd3050c6897feddddaca90676dee856d66db8923477d251712bb9b3186b4d0114daf7d6b59272b53218dd1da94a03ff64006fcbe71211e5daecd9961fba66cdb6de3f914882c58ba5beddeba7dcb950c1156d7fba18c19ea880dccc800eae335deec34e3b84ac75ffa24864f782f87815cda1c0f634b3dd2fa67cea30811d21723d21d9551fa12ccbcfa62b6d3a15d01307b99925707992556d50065505b090aadb8579083a20fe65bd2a270da9b011"
+
+const missingCrossSignatureKey = `-----BEGIN PGP PUBLIC KEY BLOCK-----
+Charset: UTF-8
+
+mQENBFMYynYBCACVOZ3/e8Bm2b9KH9QyIlHGo/i1bnkpqsgXj8tpJ2MIUOnXMMAY
+ztW7kKFLCmgVdLIC0vSoLA4yhaLcMojznh/2CcUglZeb6Ao8Gtelr//Rd5DRfPpG
+zqcfUo+m+eO1co2Orabw0tZDfGpg5p3AYl0hmxhUyYSc/xUq93xL1UJzBFgYXY54
+QsM8dgeQgFseSk/YvdP5SMx1ev+eraUyiiUtWzWrWC1TdyRa5p4UZg6Rkoppf+WJ
+QrW6BWrhAtqATHc8ozV7uJjeONjUEq24roRc/OFZdmQQGK6yrzKnnbA6MdHhqpdo
+9kWDcXYb7pSE63Lc+OBa5X2GUVvXJLS/3nrtABEBAAG0F2ludmFsaWQtc2lnbmlu
+Zy1zdWJrZXlziQEoBBMBAgASBQJTnKB5AhsBAgsHAhUIAh4BAAoJEO3UDQUIHpI/
+dN4H/idX4FQ1LIZCnpHS/oxoWQWfpRgdKAEM0qCqjMgiipJeEwSQbqjTCynuh5/R
+JlODDz85ABR06aoF4l5ebGLQWFCYifPnJZ/Yf5OYcMGtb7dIbqxWVFL9iLMO/oDL
+ioI3dotjPui5e+2hI9pVH1UHB/bZ/GvMGo6Zg0XxLPolKQODMVjpjLAQ0YJ3spew
+RAmOGre6tIvbDsMBnm8qREt7a07cBJ6XK7xjxYaZHQBiHVxyEWDa6gyANONx8duW
+/fhQ/zDTnyVM/ik6VO0Ty9BhPpcEYLFwh5c1ilFari1ta3e6qKo6ZGa9YMk/REhu
+yBHd9nTkI+0CiQUmbckUiVjDKKe5AQ0EUxjKdgEIAJcXQeP+NmuciE99YcJoffxv
+2gVLU4ZXBNHEaP0mgaJ1+tmMD089vUQAcyGRvw8jfsNsVZQIOAuRxY94aHQhIRHR
+bUzBN28ofo/AJJtfx62C15xt6fDKRV6HXYqAiygrHIpEoRLyiN69iScUsjIJeyFL
+C8wa72e8pSL6dkHoaV1N9ZH/xmrJ+k0vsgkQaAh9CzYufncDxcwkoP+aOlGtX1gP
+WwWoIbz0JwLEMPHBWvDDXQcQPQTYQyj+LGC9U6f9VZHN25E94subM1MjuT9OhN9Y
+MLfWaaIc5WyhLFyQKW2Upofn9wSFi8ubyBnv640Dfd0rVmaWv7LNTZpoZ/GbJAMA
+EQEAAYkBHwQYAQIACQUCU5ygeQIbAgAKCRDt1A0FCB6SP0zCB/sEzaVR38vpx+OQ
+MMynCBJrakiqDmUZv9xtplY7zsHSQjpd6xGflbU2n+iX99Q+nav0ETQZifNUEd4N
+1ljDGQejcTyKD6Pkg6wBL3x9/RJye7Zszazm4+toJXZ8xJ3800+BtaPoI39akYJm
++ijzbskvN0v/j5GOFJwQO0pPRAFtdHqRs9Kf4YanxhedB4dIUblzlIJuKsxFit6N
+lgGRblagG3Vv2eBszbxzPbJjHCgVLR3RmrVezKOsZjr/2i7X+xLWIR0uD3IN1qOW
+CXQxLBizEEmSNVNxsp7KPGTLnqO3bPtqFirxS9PJLIMPTPLNBY7ZYuPNTMqVIUWF
+4artDmrG
+=7FfJ
+-----END PGP PUBLIC KEY BLOCK-----`
+
+const invalidCrossSignatureKey = `-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQENBFMYynYBCACVOZ3/e8Bm2b9KH9QyIlHGo/i1bnkpqsgXj8tpJ2MIUOnXMMAY
+ztW7kKFLCmgVdLIC0vSoLA4yhaLcMojznh/2CcUglZeb6Ao8Gtelr//Rd5DRfPpG
+zqcfUo+m+eO1co2Orabw0tZDfGpg5p3AYl0hmxhUyYSc/xUq93xL1UJzBFgYXY54
+QsM8dgeQgFseSk/YvdP5SMx1ev+eraUyiiUtWzWrWC1TdyRa5p4UZg6Rkoppf+WJ
+QrW6BWrhAtqATHc8ozV7uJjeONjUEq24roRc/OFZdmQQGK6yrzKnnbA6MdHhqpdo
+9kWDcXYb7pSE63Lc+OBa5X2GUVvXJLS/3nrtABEBAAG0F2ludmFsaWQtc2lnbmlu
+Zy1zdWJrZXlziQEoBBMBAgASBQJTnKB5AhsBAgsHAhUIAh4BAAoJEO3UDQUIHpI/
+dN4H/idX4FQ1LIZCnpHS/oxoWQWfpRgdKAEM0qCqjMgiipJeEwSQbqjTCynuh5/R
+JlODDz85ABR06aoF4l5ebGLQWFCYifPnJZ/Yf5OYcMGtb7dIbqxWVFL9iLMO/oDL
+ioI3dotjPui5e+2hI9pVH1UHB/bZ/GvMGo6Zg0XxLPolKQODMVjpjLAQ0YJ3spew
+RAmOGre6tIvbDsMBnm8qREt7a07cBJ6XK7xjxYaZHQBiHVxyEWDa6gyANONx8duW
+/fhQ/zDTnyVM/ik6VO0Ty9BhPpcEYLFwh5c1ilFari1ta3e6qKo6ZGa9YMk/REhu
+yBHd9nTkI+0CiQUmbckUiVjDKKe5AQ0EUxjKdgEIAIINDqlj7X6jYKc6DjwrOkjQ
+UIRWbQQar0LwmNilehmt70g5DCL1SYm9q4LcgJJ2Nhxj0/5qqsYib50OSWMcKeEe
+iRXpXzv1ObpcQtI5ithp0gR53YPXBib80t3bUzomQ5UyZqAAHzMp3BKC54/vUrSK
+FeRaxDzNLrCeyI00+LHNUtwghAqHvdNcsIf8VRumK8oTm3RmDh0TyjASWYbrt9c8
+R1Um3zuoACOVy+mEIgIzsfHq0u7dwYwJB5+KeM7ZLx+HGIYdUYzHuUE1sLwVoELh
++SHIGHI1HDicOjzqgajShuIjj5hZTyQySVprrsLKiXS6NEwHAP20+XjayJ/R3tEA
+EQEAAYkCPgQYAQIBKAUCU5ygeQIbAsBdIAQZAQIABgUCU5ygeQAKCRCpVlnFZmhO
+52RJB/9uD1MSa0wjY6tHOIgquZcP3bHBvHmrHNMw9HR2wRCMO91ZkhrpdS3ZHtgb
+u3/55etj0FdvDo1tb8P8FGSVtO5Vcwf5APM8sbbqoi8L951Q3i7qt847lfhu6sMl
+w0LWFvPTOLHrliZHItPRjOltS1WAWfr2jUYhsU9ytaDAJmvf9DujxEOsN5G1YJep
+54JCKVCkM/y585Zcnn+yxk/XwqoNQ0/iJUT9qRrZWvoeasxhl1PQcwihCwss44A+
+YXaAt3hbk+6LEQuZoYS73yR3WHj+42tfm7YxRGeubXfgCEz/brETEWXMh4pe0vCL
+bfWrmfSPq2rDegYcAybxRQz0lF8PAAoJEO3UDQUIHpI/exkH/0vQfdHA8g/N4T6E
+i6b1CUVBAkvtdJpCATZjWPhXmShOw62gkDw306vHPilL4SCvEEi4KzG72zkp6VsB
+DSRcpxCwT4mHue+duiy53/aRMtSJ+vDfiV1Vhq+3sWAck/yUtfDU9/u4eFaiNok1
+8/Gd7reyuZt5CiJnpdPpjCwelK21l2w7sHAnJF55ITXdOxI8oG3BRKufz0z5lyDY
+s2tXYmhhQIggdgelN8LbcMhWs/PBbtUr6uZlNJG2lW1yscD4aI529VjwJlCeo745
+U7pO4eF05VViUJ2mmfoivL3tkhoTUWhx8xs8xCUcCg8DoEoSIhxtOmoTPR22Z9BL
+6LCg2mg=
+=Dhm4
+-----END PGP PUBLIC KEY BLOCK-----`
+
+const goodCrossSignatureKey = `-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: GnuPG v1
+
+mI0EVUqeVwEEAMufHRrMPWK3gyvi0O0tABCs/oON9zV9KDZlr1a1M91ShCSFwCPo
+7r80PxdWVWcj0V5h50/CJYtpN3eE/mUIgW2z1uDYQF1OzrQ8ubrksfsJvpAhENom
+lTQEppv9mV8qhcM278teb7TX0pgrUHLYF5CfPdp1L957JLLXoQR/lwLVABEBAAG0
+E2dvb2Qtc2lnbmluZy1zdWJrZXmIuAQTAQIAIgUCVUqeVwIbAwYLCQgHAwIGFQgC
+CQoLBBYCAwECHgECF4AACgkQNRjL95IRWP69XQQAlH6+eyXJN4DZTLX78KGjHrsw
+6FCvxxClEPtPUjcJy/1KCRQmtLAt9PbbA78dvgzjDeZMZqRAwdjyJhjyg/fkU2OH
+7wq4ktjUu+dLcOBb+BFMEY+YjKZhf6EJuVfxoTVr5f82XNPbYHfTho9/OABKH6kv
+X70PaKZhbwnwij8Nts65AaIEVUqftREEAJ3WxZfqAX0bTDbQPf2CMT2IVMGDfhK7
+GyubOZgDFFjwUJQvHNvsrbeGLZ0xOBumLINyPO1amIfTgJNm1iiWFWfmnHReGcDl
+y5mpYG60Mb79Whdcer7CMm3AqYh/dW4g6IB02NwZMKoUHo3PXmFLxMKXnWyJ0clw
+R0LI/Qn509yXAKDh1SO20rqrBM+EAP2c5bfI98kyNwQAi3buu94qo3RR1ZbvfxgW
+CKXDVm6N99jdZGNK7FbRifXqzJJDLcXZKLnstnC4Sd3uyfyf1uFhmDLIQRryn5m+
+LBYHfDBPN3kdm7bsZDDq9GbTHiFZUfm/tChVKXWxkhpAmHhU/tH6GGzNSMXuIWSO
+aOz3Rqq0ED4NXyNKjdF9MiwD/i83S0ZBc0LmJYt4Z10jtH2B6tYdqnAK29uQaadx
+yZCX2scE09UIm32/w7pV77CKr1Cp/4OzAXS1tmFzQ+bX7DR+Gl8t4wxr57VeEMvl
+BGw4Vjh3X8//m3xynxycQU18Q1zJ6PkiMyPw2owZ/nss3hpSRKFJsxMLhW3fKmKr
+Ey2KiOcEGAECAAkFAlVKn7UCGwIAUgkQNRjL95IRWP5HIAQZEQIABgUCVUqftQAK
+CRD98VjDN10SqkWrAKDTpEY8D8HC02E/KVC5YUI01B30wgCgurpILm20kXEDCeHp
+C5pygfXw1DJrhAP+NyPJ4um/bU1I+rXaHHJYroYJs8YSweiNcwiHDQn0Engh/mVZ
+SqLHvbKh2dL/RXymC3+rjPvQf5cup9bPxNMa6WagdYBNAfzWGtkVISeaQW+cTEp/
+MtgVijRGXR/lGLGETPg2X3Afwn9N9bLMBkBprKgbBqU7lpaoPupxT61bL70=
+=vtbN
+-----END PGP PUBLIC KEY BLOCK-----`
+
+const revokedUserIDKey = `-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQENBFsgO5EBCADhREPmcjsPkXe1z7ctvyWL0S7oa9JaoGZ9oPDHFDlQxd0qlX2e
+DZJZDg0qYvVixmaULIulApq1puEsaJCn3lHUbHlb4PYKwLEywYXM28JN91KtLsz/
+uaEX2KC5WqeP40utmzkNLq+oRX/xnRMgwbO7yUNVG2UlEa6eI+xOXO3YtLdmJMBW
+ClQ066ZnOIzEo1JxnIwha1CDBMWLLfOLrg6l8InUqaXbtEBbnaIYO6fXVXELUjkx
+nmk7t/QOk0tXCy8muH9UDqJkwDUESY2l79XwBAcx9riX8vY7vwC34pm22fAUVLCJ
+x1SJx0J8bkeNp38jKM2Zd9SUQqSbfBopQ4pPABEBAAG0I0dvbGFuZyBHb3BoZXIg
+PG5vLXJlcGx5QGdvbGFuZy5jb20+iQFUBBMBCgA+FiEE5Ik5JLcNx6l6rZfw1oFy
+9I6cUoMFAlsgO5ECGwMFCQPCZwAFCwkIBwMFFQoJCAsFFgIDAQACHgECF4AACgkQ
+1oFy9I6cUoMIkwf8DNPeD23i4jRwd/pylbvxwZintZl1fSwTJW1xcOa1emXaEtX2
+depuqhP04fjlRQGfsYAQh7X9jOJxAHjTmhqFBi5sD7QvKU00cPFYbJ/JTx0B41bl
+aXnSbGhRPh63QtEZL7ACAs+shwvvojJqysx7kyVRu0EW2wqjXdHwR/SJO6nhNBa2
+DXzSiOU/SUA42mmG+5kjF8Aabq9wPwT9wjraHShEweNerNMmOqJExBOy3yFeyDpa
+XwEZFzBfOKoxFNkIaVf5GSdIUGhFECkGvBMB935khftmgR8APxdU4BE7XrXexFJU
+8RCuPXonm4WQOwTWR0vQg64pb2WKAzZ8HhwTGbQiR29sYW5nIEdvcGhlciA8cmV2
+b2tlZEBnb2xhbmcuY29tPokBNgQwAQoAIBYhBOSJOSS3Dcepeq2X8NaBcvSOnFKD
+BQJbIDv3Ah0AAAoJENaBcvSOnFKDfWMIAKhI/Tvu3h8fSUxp/gSAcduT6bC1JttG
+0lYQ5ilKB/58lBUA5CO3ZrKDKlzW3M8VEcvohVaqeTMKeoQd5rCZq8KxHn/KvN6N
+s85REfXfniCKfAbnGgVXX3kDmZ1g63pkxrFu0fDZjVDXC6vy+I0sGyI/Inro0Pzb
+tvn0QCsxjapKK15BtmSrpgHgzVqVg0cUp8vqZeKFxarYbYB2idtGRci4b9tObOK0
+BSTVFy26+I/mrFGaPrySYiy2Kz5NMEcRhjmTxJ8jSwEr2O2sUR0yjbgUAXbTxDVE
+/jg5fQZ1ACvBRQnB7LvMHcInbzjyeTM3FazkkSYQD6b97+dkWwb1iWG5AQ0EWyA7
+kQEIALkg04REDZo1JgdYV4x8HJKFS4xAYWbIva1ZPqvDNmZRUbQZR2+gpJGEwn7z
+VofGvnOYiGW56AS5j31SFf5kro1+1bZQ5iOONBng08OOo58/l1hRseIIVGB5TGSa
+PCdChKKHreJI6hS3mShxH6hdfFtiZuB45rwoaArMMsYcjaezLwKeLc396cpUwwcZ
+snLUNd1Xu5EWEF2OdFkZ2a1qYdxBvAYdQf4+1Nr+NRIx1u1NS9c8jp3PuMOkrQEi
+bNtc1v6v0Jy52mKLG4y7mC/erIkvkQBYJdxPaP7LZVaPYc3/xskcyijrJ/5ufoD8
+K71/ShtsZUXSQn9jlRaYR0EbojMAEQEAAYkBPAQYAQoAJhYhBOSJOSS3Dcepeq2X
+8NaBcvSOnFKDBQJbIDuRAhsMBQkDwmcAAAoJENaBcvSOnFKDkFMIAIt64bVZ8x7+
+TitH1bR4pgcNkaKmgKoZz6FXu80+SnbuEt2NnDyf1cLOSimSTILpwLIuv9Uft5Pb
+OraQbYt3xi9yrqdKqGLv80bxqK0NuryNkvh9yyx5WoG1iKqMj9/FjGghuPrRaT4l
+QinNAghGVkEy1+aXGFrG2DsOC1FFI51CC2WVTzZ5RwR2GpiNRfESsU1rZAUqf/2V
+yJl9bD5R4SUNy8oQmhOxi+gbhD4Ao34e4W0ilibslI/uawvCiOwlu5NGd8zv5n+U
+heiQvzkApQup5c+BhH5zFDFdKJ2CBByxw9+7QjMFI/wgLixKuE0Ob2kAokXf7RlB
+7qTZOahrETw=
+=IKnw
+-----END PGP PUBLIC KEY BLOCK-----`
+
+const keyWithFirstUserIDRevoked = `-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: OpenPGP.js v4.10.10
+Comment: https://openpgpjs.org
+
+xsBNBFsgO5EBCADhREPmcjsPkXe1z7ctvyWL0S7oa9JaoGZ9oPDHFDlQxd0q
+lX2eDZJZDg0qYvVixmaULIulApq1puEsaJCn3lHUbHlb4PYKwLEywYXM28JN
+91KtLsz/uaEX2KC5WqeP40utmzkNLq+oRX/xnRMgwbO7yUNVG2UlEa6eI+xO
+XO3YtLdmJMBWClQ066ZnOIzEo1JxnIwha1CDBMWLLfOLrg6l8InUqaXbtEBb
+naIYO6fXVXELUjkxnmk7t/QOk0tXCy8muH9UDqJkwDUESY2l79XwBAcx9riX
+8vY7vwC34pm22fAUVLCJx1SJx0J8bkeNp38jKM2Zd9SUQqSbfBopQ4pPABEB
+AAHNIkdvbGFuZyBHb3BoZXIgPHJldm9rZWRAZ29sYW5nLmNvbT7CwI0EMAEK
+ACAWIQTkiTkktw3HqXqtl/DWgXL0jpxSgwUCWyA79wIdAAAhCRDWgXL0jpxS
+gxYhBOSJOSS3Dcepeq2X8NaBcvSOnFKDfWMIAKhI/Tvu3h8fSUxp/gSAcduT
+6bC1JttG0lYQ5ilKB/58lBUA5CO3ZrKDKlzW3M8VEcvohVaqeTMKeoQd5rCZ
+q8KxHn/KvN6Ns85REfXfniCKfAbnGgVXX3kDmZ1g63pkxrFu0fDZjVDXC6vy
++I0sGyI/Inro0Pzbtvn0QCsxjapKK15BtmSrpgHgzVqVg0cUp8vqZeKFxarY
+bYB2idtGRci4b9tObOK0BSTVFy26+I/mrFGaPrySYiy2Kz5NMEcRhjmTxJ8j
+SwEr2O2sUR0yjbgUAXbTxDVE/jg5fQZ1ACvBRQnB7LvMHcInbzjyeTM3Fazk
+kSYQD6b97+dkWwb1iWHNI0dvbGFuZyBHb3BoZXIgPG5vLXJlcGx5QGdvbGFu
+Zy5jb20+wsCrBBMBCgA+FiEE5Ik5JLcNx6l6rZfw1oFy9I6cUoMFAlsgO5EC
+GwMFCQPCZwAFCwkIBwMFFQoJCAsFFgIDAQACHgECF4AAIQkQ1oFy9I6cUoMW
+IQTkiTkktw3HqXqtl/DWgXL0jpxSgwiTB/wM094PbeLiNHB3+nKVu/HBmKe1
+mXV9LBMlbXFw5rV6ZdoS1fZ16m6qE/Th+OVFAZ+xgBCHtf2M4nEAeNOaGoUG
+LmwPtC8pTTRw8Vhsn8lPHQHjVuVpedJsaFE+HrdC0RkvsAICz6yHC++iMmrK
+zHuTJVG7QRbbCqNd0fBH9Ik7qeE0FrYNfNKI5T9JQDjaaYb7mSMXwBpur3A/
+BP3COtodKETB416s0yY6okTEE7LfIV7IOlpfARkXMF84qjEU2QhpV/kZJ0hQ
+aEUQKQa8EwH3fmSF+2aBHwA/F1TgETtetd7EUlTxEK49eiebhZA7BNZHS9CD
+rilvZYoDNnweHBMZzsBNBFsgO5EBCAC5INOERA2aNSYHWFeMfByShUuMQGFm
+yL2tWT6rwzZmUVG0GUdvoKSRhMJ+81aHxr5zmIhluegEuY99UhX+ZK6NftW2
+UOYjjjQZ4NPDjqOfP5dYUbHiCFRgeUxkmjwnQoSih63iSOoUt5kocR+oXXxb
+YmbgeOa8KGgKzDLGHI2nsy8Cni3N/enKVMMHGbJy1DXdV7uRFhBdjnRZGdmt
+amHcQbwGHUH+PtTa/jUSMdbtTUvXPI6dz7jDpK0BImzbXNb+r9CcudpiixuM
+u5gv3qyJL5EAWCXcT2j+y2VWj2HN/8bJHMoo6yf+bn6A/Cu9f0obbGVF0kJ/
+Y5UWmEdBG6IzABEBAAHCwJMEGAEKACYWIQTkiTkktw3HqXqtl/DWgXL0jpxS
+gwUCWyA7kQIbDAUJA8JnAAAhCRDWgXL0jpxSgxYhBOSJOSS3Dcepeq2X8NaB
+cvSOnFKDkFMIAIt64bVZ8x7+TitH1bR4pgcNkaKmgKoZz6FXu80+SnbuEt2N
+nDyf1cLOSimSTILpwLIuv9Uft5PbOraQbYt3xi9yrqdKqGLv80bxqK0NuryN
+kvh9yyx5WoG1iKqMj9/FjGghuPrRaT4lQinNAghGVkEy1+aXGFrG2DsOC1FF
+I51CC2WVTzZ5RwR2GpiNRfESsU1rZAUqf/2VyJl9bD5R4SUNy8oQmhOxi+gb
+hD4Ao34e4W0ilibslI/uawvCiOwlu5NGd8zv5n+UheiQvzkApQup5c+BhH5z
+FDFdKJ2CBByxw9+7QjMFI/wgLixKuE0Ob2kAokXf7RlB7qTZOahrETw=
+=+2T8
+-----END PGP PUBLIC KEY BLOCK-----
+`
+
+const keyWithOnlyUserIDRevoked = `-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mDMEYYwB7RYJKwYBBAHaRw8BAQdARimqhPPzyGAXmfQJjcqM1QVPzLtURJSzNVll
+JV4tEaW0KVJldm9rZWQgUHJpbWFyeSBVc2VyIElEIDxyZXZva2VkQGtleS5jb20+
+iHgEMBYIACAWIQSpyJZAXYqVEFkjyKutFcS0yeB0LQUCYYwCtgIdAAAKCRCtFcS0
+yeB0LbSsAQD8OYMaaBjrdzzpwIkP1stgmPd4/kzN/ZG28Ywl6a5F5QEA5Xg7aq4e
+/t6Fsb4F5iqB956kSPe6YJrikobD/tBbMwSIkAQTFggAOBYhBKnIlkBdipUQWSPI
+q60VxLTJ4HQtBQJhjAHtAhsDBQsJCAcCBhUKCQgLAgQWAgMBAh4BAheAAAoJEK0V
+xLTJ4HQtBaoBAPZL7luTCji+Tqhn7XNfFE/0QIahCt8k9wfO1cGlB3inAQDf8Tzw
+ZGR5fNluUcNoVxQT7bUSFStbaGo3k0BaOYPbCLg4BGGMAe0SCisGAQQBl1UBBQEB
+B0DLwSpveSrbIO/IVZD13yrs1XuB3FURZUnafGrRq7+jUAMBCAeIeAQYFggAIBYh
+BKnIlkBdipUQWSPIq60VxLTJ4HQtBQJhjAHtAhsMAAoJEK0VxLTJ4HQtZ1oA/j9u
+8+p3xTNzsmabTL6BkNbMeB/RUKCrlm6woM6AV+vxAQCcXTn3JC2sNoNrLoXuVzaA
+mcG3/TwG5GSQUUPkrDsGDA==
+=mFWy
+-----END PGP PUBLIC KEY BLOCK-----
+`
+
+const keyWithSubKey = `-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mI0EWyKwKQEEALwXhKBnyaaNFeK3ljfc/qn9X/QFw+28EUfgZPHjRmHubuXLE2uR
+s3ZoSXY2z7Dkv+NyHYMt8p+X8q5fR7JvUjK2XbPyKoiJVnHINll83yl67DaWfKNL
+EjNoO0kIfbXfCkZ7EG6DL+iKtuxniGTcnGT47e+HJSqb/STpLMnWwXjBABEBAAG0
+I0dvbGFuZyBHb3BoZXIgPG5vLXJlcGx5QGdvbGFuZy5jb20+iM4EEwEKADgWIQQ/
+lRafP/p9PytHbwxMvYJsOQdOOAUCWyKwKQIbAwULCQgHAwUVCgkICwUWAgMBAAIe
+AQIXgAAKCRBMvYJsOQdOOOsFBAC62mXww8XuqvYLcVOvHkWLT6mhxrQOJXnlfpn7
+2uBV9CMhoG/Ycd43NONsJrB95Apr9TDIqWnVszNbqPCuBhZQSGLdbiDKjxnCWBk0
+69qv4RNtkpOhYB7jK4s8F5oQZqId6JasT/PmJTH92mhBYhhTQr0GYFuPX2UJdkw9
+Sn9C67iNBFsisDUBBAC3A+Yo9lgCnxi/pfskyLrweYif6kIXWLAtLTsM6g/6jt7b
+wTrknuCPyTv0QKGXsAEe/cK/Xq3HvX9WfXPGIHc/X56ZIsHQ+RLowbZV/Lhok1IW
+FAuQm8axr/by80cRwFnzhfPc/ukkAq2Qyj4hLsGblu6mxeAhzcp8aqmWOO2H9QAR
+AQABiLYEKAEKACAWIQQ/lRafP/p9PytHbwxMvYJsOQdOOAUCWyK16gIdAAAKCRBM
+vYJsOQdOOB1vA/4u4uLONsE+2GVOyBsHyy7uTdkuxaR9b54A/cz6jT/tzUbeIzgx
+22neWhgvIEghnUZd0vEyK9k1wy5vbDlEo6nKzHso32N1QExGr5upRERAxweDxGOj
+7luDwNypI7QcifE64lS/JmlnunwRCdRWMKc0Fp+7jtRc5mpwyHN/Suf5RokBagQY
+AQoAIBYhBD+VFp8/+n0/K0dvDEy9gmw5B044BQJbIrA1AhsCAL8JEEy9gmw5B044
+tCAEGQEKAB0WIQSNdnkaWY6t62iX336UXbGvYdhXJwUCWyKwNQAKCRCUXbGvYdhX
+JxJSA/9fCPHP6sUtGF1o3G1a3yvOUDGr1JWcct9U+QpbCt1mZoNopCNDDQAJvDWl
+mvDgHfuogmgNJRjOMznvahbF+wpTXmB7LS0SK412gJzl1fFIpK4bgnhu0TwxNsO1
+8UkCZWqxRMgcNUn9z6XWONK8dgt5JNvHSHrwF4CxxwjL23AAtK+FA/UUoi3U4kbC
+0XnSr1Sl+mrzQi1+H7xyMe7zjqe+gGANtskqexHzwWPUJCPZ5qpIa2l8ghiUim6b
+4ymJ+N8/T8Yva1FaPEqfMzzqJr8McYFm0URioXJPvOAlRxdHPteZ0qUopt/Jawxl
+Xt6B9h1YpeLoJwjwsvbi98UTRs0jXwoY
+=3fWu
+-----END PGP PUBLIC KEY BLOCK-----`
+
+const keyWithSubKeyAndBadSelfSigOrder = `-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mI0EWyLLDQEEAOqIOpJ/ha1OYAGduu9tS3rBz5vyjbNgJO4sFveEM0mgsHQ0X9/L
+plonW+d0gRoO1dhJ8QICjDAc6+cna1DE3tEb5m6JtQ30teLZuqrR398Cf6w7NNVz
+r3lrlmnH9JaKRuXl7tZciwyovneBfZVCdtsRZjaLI1uMQCz/BToiYe3DABEBAAG0
+I0dvbGFuZyBHb3BoZXIgPG5vLXJlcGx5QGdvbGFuZy5jb20+iM4EEwEKADgWIQRZ
+sixZOfQcZdW0wUqmgmdsv1O9xgUCWyLLDQIbAwULCQgHAwUVCgkICwUWAgMBAAIe
+AQIXgAAKCRCmgmdsv1O9xql2A/4pix98NxjhdsXtazA9agpAKeADf9tG4Za27Gj+
+3DCww/E4iP2X35jZimSm/30QRB6j08uGCqd9vXkkJxtOt63y/IpVOtWX6vMWSTUm
+k8xKkaYMP0/IzKNJ1qC/qYEUYpwERBKg9Z+k99E2Ql4kRHdxXUHq6OzY79H18Y+s
+GdeM/riNBFsiyxsBBAC54Pxg/8ZWaZX1phGdwfe5mek27SOYpC0AxIDCSOdMeQ6G
+HPk38pywl1d+S+KmF/F4Tdi+kWro62O4eG2uc/T8JQuRDUhSjX0Qa51gPzJrUOVT
+CFyUkiZ/3ZDhtXkgfuso8ua2ChBgR9Ngr4v43tSqa9y6AK7v0qjxD1x+xMrjXQAR
+AQABiQFxBBgBCgAmAhsCFiEEWbIsWTn0HGXVtMFKpoJnbL9TvcYFAlsizTIFCQAN
+MRcAv7QgBBkBCgAdFiEEJcoVUVJIk5RWj1c/o62jUpRPICQFAlsiyxsACgkQo62j
+UpRPICQq5gQApoWIigZxXFoM0uw4uJBS5JFZtirTANvirZV5RhndwHeMN6JttaBS
+YnjyA4+n1D+zB2VqliD2QrsX12KJN6rGOehCtEIClQ1Hodo9nC6kMzzAwW1O8bZs
+nRJmXV+bsvD4sidLZLjdwOVa3Cxh6pvq4Uur6a7/UYx121hEY0Qx0s8JEKaCZ2y/
+U73GGi0D/i20VW8AWYAPACm2zMlzExKTOAV01YTQH/3vW0WLrOse53WcIVZga6es
+HuO4So0SOEAvxKMe5HpRIu2dJxTvd99Bo9xk9xJU0AoFrO0vNCRnL+5y68xMlODK
+lEw5/kl0jeaTBp6xX0HDQOEVOpPGUwWV4Ij2EnvfNDXaE1vK1kffiQFrBBgBCgAg
+AhsCFiEEWbIsWTn0HGXVtMFKpoJnbL9TvcYFAlsi0AYAv7QgBBkBCgAdFiEEJcoV
+UVJIk5RWj1c/o62jUpRPICQFAlsiyxsACgkQo62jUpRPICQq5gQApoWIigZxXFoM
+0uw4uJBS5JFZtirTANvirZV5RhndwHeMN6JttaBSYnjyA4+n1D+zB2VqliD2QrsX
+12KJN6rGOehCtEIClQ1Hodo9nC6kMzzAwW1O8bZsnRJmXV+bsvD4sidLZLjdwOVa
+3Cxh6pvq4Uur6a7/UYx121hEY0Qx0s8JEKaCZ2y/U73GRl0EAJokkXmy4zKDHWWi
+wvK9gi2gQgRkVnu2AiONxJb5vjeLhM/07BRmH6K1o+w3fOeEQp4FjXj1eQ5fPSM6
+Hhwx2CTl9SDnPSBMiKXsEFRkmwQ2AAsQZLmQZvKBkLZYeBiwf+IY621eYDhZfo+G
+1dh1WoUCyREZsJQg2YoIpWIcvw+a
+=bNRo
+-----END PGP PUBLIC KEY BLOCK-----
+`
+
+const onlySubkeyNoPrivateKey = `-----BEGIN PGP PRIVATE KEY BLOCK-----
+Version: GnuPG v1
+
+lQCVBFggvocBBAC7vBsHn7MKmS6IiiZNTXdciplVgS9cqVd+RTdIAoyNTcsiV1H0
+GQ3QtodOPeDlQDNoqinqaobd7R9g3m3hS53Nor7yBZkCWQ5x9v9JxRtoAq0sklh1
+I1X2zEqZk2l6YrfBF/64zWrhjnW3j23szkrAIVu0faQXbQ4z56tmZrw11wARAQAB
+/gdlAkdOVQG0CUdOVSBEdW1teYi4BBMBAgAiBQJYIL6HAhsDBgsJCAcDAgYVCAIJ
+CgsEFgIDAQIeAQIXgAAKCRCd1xxWp1CYAnjGA/9synn6ZXJUKAXQzySgmCZvCIbl
+rqBfEpxwLG4Q/lONhm5vthAE0z49I8hj5Gc5e2tLYUtq0o0OCRdCrYHa/efOYWpJ
+6RsK99bePOisVzmOABLIgZkcr022kHoMCmkPgv9CUGKP1yqbGl+zzAwQfUjRUmvD
+ZIcWLHi2ge4GzPMPi50B2ARYIL6cAQQAxWHnicKejAFcFcF1/3gUSgSH7eiwuBPX
+M7vDdgGzlve1o1jbV4tzrjN9jsCl6r0nJPDMfBSzgLr1auNTRG6HpJ4abcOx86ED
+Ad+avDcQPZb7z3dPhH/gb2lQejZsHh7bbeOS8WMSzHV3RqCLd8J/xwWPNR5zKn1f
+yp4IGfopidMAEQEAAQAD+wQOelnR82+dxyM2IFmZdOB9wSXQeCVOvxSaNMh6Y3lk
+UOOkO8Nlic4x0ungQRvjoRs4wBmCuwFK/MII6jKui0B7dn/NDf51i7rGdNGuJXDH
+e676By1sEY/NGkc74jr74T+5GWNU64W0vkpfgVmjSAzsUtpmhJMXsc7beBhJdnVl
+AgDKCb8hZqj1alcdmLoNvb7ibA3K/V8J462CPD7bMySPBa/uayoFhNxibpoXml2r
+oOtHa5izF3b0/9JY97F6rqkdAgD6GdTJ+xmlCoz1Sewoif1I6krq6xoa7gOYpIXo
+UL1Afr+LiJeyAnF/M34j/kjIVmPanZJjry0kkjHE5ILjH3uvAf4/6n9np+Th8ujS
+YDCIzKwR7639+H+qccOaddCep8Y6KGUMVdD/vTKEx1rMtK+hK/CDkkkxnFslifMJ
+kqoqv3WUqCWJAT0EGAECAAkFAlggvpwCGwIAqAkQndccVqdQmAKdIAQZAQIABgUC
+WCC+nAAKCRDmGUholQPwvQk+A/9latnSsR5s5/1A9TFki11GzSEnfLbx46FYOdkW
+n3YBxZoPQGxNA1vIn8GmouxZInw9CF4jdOJxEdzLlYQJ9YLTLtN5tQEMl/19/bR8
+/qLacAZ9IOezYRWxxZsyn6//jfl7A0Y+FV59d4YajKkEfItcIIlgVBSW6T+TNQT3
+R+EH5HJ/A/4/AN0CmBhhE2vGzTnVU0VPrE4V64pjn1rufFdclgpixNZCuuqpKpoE
+VVHn6mnBf4njKjZrAGPs5kfQ+H4NsM7v3Zz4yV6deu9FZc4O6E+V1WJ38rO8eBix
+7G2jko106CC6vtxsCPVIzY7aaG3H5pjRtomw+pX7SzrQ7FUg2PGumg==
+=F/T0
+-----END PGP PRIVATE KEY BLOCK-----`
+
+const ecdsaPrivateKey = `-----BEGIN PGP PRIVATE KEY BLOCK-----
+
+xaUEX1KsSRMIKoZIzj0DAQcCAwTpYqJsnJiFhKKh+8TulWD+lVmerBFNS+Ii
+B+nlG3T0xQQ4Sy5eIjJ0CExIQQzi3EElF/Z2l4F3WC5taFA11NgA/gkDCHSS
+PThf1M2K4LN8F1MRcvR+sb7i0nH55ojkwuVB1DE6jqIT9m9i+mX1tzjSAS+6
+lPQiweCJvG7xTC7Hs3AzRapf/r1At4TB+v+5G2/CKynNFEJpbGwgPGJpbGxA
+aG9tZS5jb20+wncEEBMIAB8FAl9SrEkGCwkHCAMCBBUICgIDFgIBAhkBAhsD
+Ah4BAAoJEMpwT3+q3+xqw5UBAMebZN9isEZ1ML+R/jWAAWMwa/knMugrEZ1v
+Bl9+ZwM0AQCZdf80/wYY4Nve01qSRFv8OmKswLli3TvDv6FKc4cLz8epBF9S
+rEkSCCqGSM49AwEHAgMEAjKnT9b5wY2bf9TpAV3d7OUfPOxKj9c4VzeVzSrH
+AtQgo/MuI1cdYVURicV4i76DNjFhQHQFTk7BrC+C2u1yqQMBCAf+CQMIHImA
+iYfzQtjgQWSFZYUkCFpbbwhNF0ch+3HNaZkaHCnZRIsWsRnc6FCb6lRQyK9+
+Dq59kHlduE5QgY40894jfmP2JdJHU6nBdYrivbEdbMJhBBgTCAAJBQJfUqxJ
+AhsMAAoJEMpwT3+q3+xqUI0BAMykhV08kQ4Ip9Qlbss6Jdufv7YrU0Vd5hou
+b5TmiPd0APoDBh3qIic+aLLUcAuG3+Gt1P1AbUlmqV61ozn1WfHxfw==
+=KLN8
+-----END PGP PRIVATE KEY BLOCK-----`
+
+const dsaPrivateKeyWithElGamalSubkey = `-----BEGIN PGP PRIVATE KEY BLOCK-----
+
+lQOBBF9/MLsRCACeaF6BI0jTgDAs86t8/kXPfwlPvR2MCYzB0BCqAdcq1hV/GTYd
+oNmJRna/ZJfsI/vf+d8Nv+EYOQkPheFS1MJVBitkAXjQPgm8i1tQWen1FCWZxqGk
+/vwZYF4yo8GhZ+Wxi3w09W9Cp9QM/CTmyE1Xe7wpPBGe+oD+me8Zxjyt8JBS4Qx+
+gvWbfHxfHnggh4pz7U8QkItlLsBNQEdX4R5+zwRN66g2ZSX/shaa/EkVnihUhD7r
+njP9I51ORWucTQD6OvgooaNQZCkQ/Se9TzdakwWKS2XSIFXiY/e2E5ZgKI/pfKDU
+iA/KessxddPb7nP/05OIJqg9AoDrD4vmehLzAQD+zsUS3LDU1m9/cG4LMsQbT2VK
+Te4HqbGIAle+eu/asQf8DDJMrbZpiJZvADum9j0TJ0oep6VdMbzo9RSDKvlLKT9m
+kG63H8oDWnCZm1a+HmGq9YIX+JHWmsLXXsFLeEouLzHO+mZo0X28eji3V2T87hyR
+MmUM0wFo4k7jK8uVmkDXv3XwNp2uByWxUKZd7EnWmcEZWqIiexJ7XpCS0Pg3tRaI
+zxve0SRe/dxfUPnTk/9KQ9hS6DWroBKquL182zx1Fggh4LIWWE2zq+UYn8BI0E8A
+rmIDFJdF8ymFQGRrEy6g79NnkPmkrZWsgMRYY65P6v4zLVmqohJKkpm3/Uxa6QAP
+CCoPh/JTOvPeCP2bOJH8z4Z9Py3ouMIjofQW8sXqRgf/RIHbh0KsINHrwwZ4gVIr
+MK3RofpaYxw1ztPIWb4cMWoWZHH1Pxh7ggTGSBpAhKXkiWw2Rxat8QF5aA7e962c
+bLvVv8dqsPrD/RnVJHag89cbPTzjn7gY9elE8EM8ithV3oQkwHTr4avYlpDZsgNd
+hUW3YgRwGo31tdzxoG04AcpV2t+07P8XMPr9hsfWs4rHohXPi38Hseu1Ji+dBoWQ
+3+1w/HH3o55s+jy4Ruaz78AIrjbmAJq+6rA2mIcCgrhw3DnzuwQAKeBvSeqn9zfS
+ZC812osMBVmkycwelpaIh64WZ0vWL3GvdXDctV2kXM+qVpDTLEny0LuiXxrwCKQL
+Ev4HAwK9uQBcreDEEud7pfRb8EYP5lzO2ZA7RaIvje6EWAGBvJGMRT0QQE5SGqc7
+Fw5geigBdt+vVyRuNNhg3c2fdn/OBQaYu0J/8AiOogG8EaM8tCFlbGdhbWFsQGRz
+YS5jb20gPGVsZ2FtYWxAZHNhLmNvbT6IkAQTEQgAOBYhBI+gnfiHQxB35/Dp0XAQ
+aE/rsWC5BQJffzC7AhsDBQsJCAcCBhUKCQgLAgQWAgMBAh4BAheAAAoJEHAQaE/r
+sWC5A4EA/0GcJmyPtN+Klc7b9sVT3JgKTRnB/URxOJfYJofP0hZLAQCkqyMO+adV
+JvbgDH0zaITQWZSSXPqpgMpCA6juTrDsd50CawRffzC7EAgAxFFFSAAEQzWTgKU5
+EBtpxxoPzHqcChawTHRxHxjcELXzmUBS5PzfA1HXSPnNqK/x3Ut5ycC3CsW41Fnt
+Gm3706Wu9VFbFZVn55F9lPiplUo61n5pqMvOr1gmuQsdXiTa0t5FRa4TZ2VSiHFw
+vdAVSPTUsT4ZxJ1rPyFYRtq1n3pQcvdZowd07r0JnzTMjLLMFYCKhwIowoOC4zqJ
+iB8enjwOlpaqBATRm9xpVF7SJkroPF6/B1vdhj7E3c1aJyHlo0PYBAg756sSHWHg
+UuLyUQ4TA0hcCVenn/L/aSY2LnbdZB1EBhlYjA7dTCgwIqsQhfQmPkjz6g64A7+Y
+HbbrLwADBQgAk14QIEQ+J/VHetpQV/jt2pNsFK1kVK7mXK0spTExaC2yj2sXlHjL
+Ie3bO5T/KqmIaBEB5db5fA5xK9cZt79qrQHDKsEqUetUeMUWLBx77zBsus3grIgy
+bwDZKseRzQ715pwxquxQlScGoDIBKEh08HpwHkq140eIj3w+MAIfndaZaSCNaxaP
+Snky7BQmJ7Wc7qrIwoQP6yrnUqyW2yNi81nJYUhxjChqaFSlwzLs/iNGryBKo0ic
+BqVIRjikKHBlwBng6WyrltQo/Vt9GG8w+lqaAVXbJRlaBZJUR+2NKi/YhP3qQse3
+v8fi4kns0gh5LK+2C01RvdX4T49QSExuIf4HAwLJqYIGwadA2uem5v7/765ZtFWV
+oL0iZ0ueTJDby4wTFDpLVzzDi/uVcB0ZRFrGOp7w6OYcNYTtV8n3xmli2Q5Trw0c
+wZVzvg+ABKWiv7faBjMczIFF8y6WZKOIeAQYEQgAIBYhBI+gnfiHQxB35/Dp0XAQ
+aE/rsWC5BQJffzC7AhsMAAoJEHAQaE/rsWC5ZmIA/jhS4r4lClbvjuPWt0Yqdn7R
+fss2SPMYvMrrDh42aE0OAQD8xn4G6CN8UtW9xihXOY6FpxiJ/sMc2VaneeUd34oa
+4g==
+=XZm8
+-----END PGP PRIVATE KEY BLOCK-----`
+
+// https://tests.sequoia-pgp.org/#Certificate_expiration
+// P _ U p
+const expiringPrimaryUIDKey = `-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+xsDNBF2lnPIBDAC5cL9PQoQLTMuhjbYvb4Ncuuo0bfmgPRFywX53jPhoFf4Zg6mv
+/seOXpgecTdOcVttfzC8ycIKrt3aQTiwOG/ctaR4Bk/t6ayNFfdUNxHWk4WCKzdz
+/56fW2O0F23qIRd8UUJp5IIlN4RDdRCtdhVQIAuzvp2oVy/LaS2kxQoKvph/5pQ/
+5whqsyroEWDJoSV0yOb25B/iwk/pLUFoyhDG9bj0kIzDxrEqW+7Ba8nocQlecMF3
+X5KMN5kp2zraLv9dlBBpWW43XktjcCZgMy20SouraVma8Je/ECwUWYUiAZxLIlMv
+9CurEOtxUw6N3RdOtLmYZS9uEnn5y1UkF88o8Nku890uk6BrewFzJyLAx5wRZ4F0
+qV/yq36UWQ0JB/AUGhHVPdFf6pl6eaxBwT5GXvbBUibtf8YI2og5RsgTWtXfU7eb
+SGXrl5ZMpbA6mbfhd0R8aPxWfmDWiIOhBufhMCvUHh1sApMKVZnvIff9/0Dca3wb
+vLIwa3T4CyshfT0AEQEAAc0hQm9iIEJhYmJhZ2UgPGJvYkBvcGVucGdwLmV4YW1w
+bGU+wsFcBBMBCgCQBYJhesp/BYkEWQPJBQsJCAcCCRD7/MgqAV5zMEcUAAAAAAAe
+ACBzYWx0QG5vdGF0aW9ucy5zZXF1b2lhLXBncC5vcmeEOQlNyTLFkc9I/elp+BpY
+495V7KatqtDmsyDr+zDAdwYVCgkICwIEFgIDAQIXgAIbAwIeARYhBNGmbhojsYLJ
+mA94jPv8yCoBXnMwAABSCQv/av8hKyynMtXVKFuWOGJw0mR8auDm84WdhMFRZg8t
+yTJ1L88+Ny4WUAFeqo2j7DU2yPGrm5rmuvzlEedFYFeOWt+A4adz+oumgRd0nsgG
+Lf3QYUWQhLWVlz+H7zubgKqSB2A2RqV65S7mTTVro42nb2Mng6rvGWiqeKG5nrXN
+/01p1mIBQGR/KnZSqYLzA2Pw2PiJoSkXT26PDz/kiEMXpjKMR6sicV4bKVlEdUvm
+pIImIPBHZq1EsKXEyWtWC41w/pc+FofGE+uSFs2aef1vvEHFkj3BHSK8gRcH3kfR
+eFroTET8C2q9V1AOELWm+Ys6PzGzF72URK1MKXlThuL4t4LjvXWGNA78IKW+/RQH
+DzK4U0jqSO0mL6qxqVS5Ij6jjL6OTrVEGdtDf5n0vI8tcUTBKtVqYAYk+t2YGT05
+ayxALtb7viVKo8f10WEcCuKshn0gdsEFMRZQzJ89uQIY3R3FbsdRCaE6OEaDgKMQ
+UTFROyfhthgzRKbRxfcplMUCzsDNBF2lnPIBDADWML9cbGMrp12CtF9b2P6z9TTT
+74S8iyBOzaSvdGDQY/sUtZXRg21HWamXnn9sSXvIDEINOQ6A9QxdxoqWdCHrOuW3
+ofneYXoG+zeKc4dC86wa1TR2q9vW+RMXSO4uImA+Uzula/6k1DogDf28qhCxMwG/
+i/m9g1c/0aApuDyKdQ1PXsHHNlgd/Dn6rrd5y2AObaifV7wIhEJnvqgFXDN2RXGj
+LeCOHV4Q2WTYPg/S4k1nMXVDwZXrvIsA0YwIMgIT86Rafp1qKlgPNbiIlC1g9RY/
+iFaGN2b4Ir6GDohBQSfZW2+LXoPZuVE/wGlQ01rh827KVZW4lXvqsge+wtnWlszc
+selGATyzqOK9LdHPdZGzROZYI2e8c+paLNDdVPL6vdRBUnkCaEkOtl1mr2JpQi5n
+TU+gTX4IeInC7E+1a9UDF/Y85ybUz8XV8rUnR76UqVC7KidNepdHbZjjXCt8/Zo+
+Tec9JNbYNQB/e9ExmDntmlHEsSEQzFwzj8sxH48AEQEAAcLA9gQYAQoAIBYhBNGm
+bhojsYLJmA94jPv8yCoBXnMwBQJdpZzyAhsMAAoJEPv8yCoBXnMw6f8L/26C34dk
+jBffTzMj5Bdzm8MtF67OYneJ4TQMw7+41IL4rVcSKhIhk/3Ud5knaRtP2ef1+5F6
+6h9/RPQOJ5+tvBwhBAcUWSupKnUrdVaZQanYmtSxcVV2PL9+QEiNN3tzluhaWO//
+rACxJ+K/ZXQlIzwQVTpNhfGzAaMVV9zpf3u0k14itcv6alKY8+rLZvO1wIIeRZLm
+U0tZDD5HtWDvUV7rIFI1WuoLb+KZgbYn3OWjCPHVdTrdZ2CqnZbG3SXw6awH9bzR
+LV9EXkbhIMez0deCVdeo+wFFklh8/5VK2b0vk/+wqMJxfpa1lHvJLobzOP9fvrsw
+sr92MA2+k901WeISR7qEzcI0Fdg8AyFAExaEK6VyjP7SXGLwvfisw34OxuZr3qmx
+1Sufu4toH3XrB7QJN8XyqqbsGxUCBqWif9RSK4xjzRTe56iPeiSJJOIciMP9i2ld
+I+KgLycyeDvGoBj0HCLO3gVaBe4ubVrj5KjhX2PVNEJd3XZRzaXZE2aAMQ==
+=AmgT
+-----END PGP PUBLIC KEY BLOCK-----`
+
+const rsa2048PrivateKey = `-----BEGIN PGP PRIVATE KEY BLOCK-----
+Comment: gpg (GnuPG) 2.2.27 with libgcrypt 1.9.4
+
+lQPGBGL07P0BCADL0etN8efyAXA6sL2WfQvHe5wEKYXPWeN2+jiqSppfeRZAOlzP
+kZ3U+cloeJriplYvVJwI3ID2aw52Z/TRn8iKRP5eOUFrEgcgl06lazLtOndK7o7p
+oBV5mLtHEirFHm6W61fNt10jzM0jx0PV6nseLhFB2J42F1cmU/aBgFo41wjLSZYr
+owR+v+O9S5sUXblQF6sEDcY01sBEu09zrIgT49VFwQ1Cvdh9XZEOTQBfdiugoj5a
+DS3fAqAka3r1VoQK4eR7/upnYSgSACGeaQ4pUelKku5rpm50gdWTY8ppq0k9e1eT
+y2x0OQcW3hWE+j4os1ca0ZEADMdqr/99MOxrABEBAAH+BwMCJWxU4VOZOJ7/I6vX
+FxdfBhIBEXlJ52FM3S/oYtXqLhkGyrtmZOeEazVvUtuCe3M3ScHI8xCthcmE8E0j
+bi+ZEHPS2NiBZtgHFF27BLn7zZuTc+oD5WKduZdK3463egnyThTqIIMl25WZBuab
+k5ycwYrWwBH0jfA4gwJ13ai4pufKC2RM8qIu6YAVPglYBKFLKGvvJHa5vI+LuA0E
+K+k35hIic7yVUcQneNnAF2598X5yWiieYnOZpmHlRw1zfbMwOJr3ZNj2v94u7b+L
+sTa/1Uv9887Vb6sJp0c2Sh4cwEccoPYkvMqFn3ZrJUr3UdDu1K2vWohPtswzhrYV
++RdPZE5RLoCQufKvlPezk0Pzhzb3bBU7XjUbdGY1nH/EyQeBNp+Gw6qldKvzcBaB
+cyOK1c6hPSszpJX93m5UxCN55IeifmcNjmbDh8vGCCdajy6d56qV2n4F3k7vt1J1
+0UlxIGhqijJoaTCX66xjLMC6VXkSz6aHQ35rnXosm/cqPcQshsZTdlfSyWkorfdr
+4Hj8viBER26mjYurTMLBKDtUN724ZrR0Ev5jorX9uoKlgl87bDZHty2Ku2S+vR68
+VAvnj6Fi1BYNclnDoqxdRB2z5T9JbWE52HuG83/QsplhEqXxESDxriTyTHMbNxEe
+88soVCDh4tgflZFa2ucUr6gEKJKij7jgahARnyaXfPZlQBUAS1YUeILYmN+VR+M/
+sHENpwDWc7TInn8VN638nJV+ScZGMih3AwWZTIoiLju3MMt1K0YZ3NuiqwGH4Jwg
+/BbEdTWeCci9y3NEQHQ3uZZ5p6j2CwFVlK11idemCMvAiTVxF+gKdaLMkeCwKxru
+J3YzhKEo+iDVYbPYBYizx/EHBn2U5kITQ5SBXzjTaaFMNZJEf9JYsL1ybPB6HOFY
+VNVB2KT8CGVwtCJHb2xhbmcgR29waGVyIDxnb2xhbmdAZXhhbXBsZS5vcmc+iQFO
+BBMBCgA4FiEEC6K7U7f4qesybTnqSkra7gHusm0FAmL07P0CGwMFCwkIBwIGFQoJ
+CAsCBBYCAwECHgECF4AACgkQSkra7gHusm1MvwgAxpClWkeSqIhMQfbiuz0+lOkE
+89y1DCFw8bHjZoUf4/4K8hFA3dGkk+q72XFgiyaCpfXxMt6Gi+dN47t+tTv9NIqC
+sukbaoJBmJDhN6+djmJOgOYy+FWsW2LAk2LOwKYulpnBZdcA5rlMAhBg7gevQpF+
+ruSU69P7UUaFJl/DC7hDmaIcj+4cjBE/HO26SnVQjoTfjZT82rDh1Wsuf8LnkJUk
+b3wezBLpXKjDvdHikdv4gdlR4AputVM38aZntYYglh/EASo5TneyZ7ZscdLNRdcF
+r5O2fKqrOJLOdaoYRFZZWOvP5GtEVFDU7WGivOSVfiszBE0wZR3dgZRJipHCXJ0D
+xgRi9Oz9AQgAtMJcJqLLVANJHl90tWuoizDkm+Imcwq2ubQAjpclnNrODnDK+7o4
+pBsWmXbZSdkC4gY+LhOQA6bPDD0JEHM58DOnrm49BddxXAyK0HPsk4sGGt2SS86B
+OawWNdfJVyqw4bAiHWDmQg4PcjBbt3ocOIxAR6I5kBSiQVxuGQs9T+Zvg3G1r3Or
+fS6DzlgY3HFUML5YsGH4lOxNSOoKAP68GIH/WNdUZ+feiRg9knIib6I3Hgtf5eO8
+JRH7aWE/TD7eNu36bLLjT5TZPq5r6xaD2plbtPOyXbNPWs9qI1yG+VnErfaLY0w8
+Qo0aqzbgID+CTZVomXSOpOcQseaFKw8ZfQARAQAB/gcDArha6+/+d4OY/w9N32K9
+hFNYt4LufTETMQ+k/sBeaMuAVzmT47DlAXzkrZhGW4dZOtXMu1rXaUwHlqkhEyzL
+L4MYEWVXfD+LbZNEK3MEFss6RK+UAMeT/PTV9aA8cXQVPcSJYzfBXHQ1U1hnOgrO
+apn92MN8RmkhX8wJLyeWTMMuP4lXByJMmmGo8WvifeRD2kFY4y0WVBDAXJAV4Ljf
+Di/bBiwoc5a+gxHuZT2W9ZSxBQJNXdt4Un2IlyZuo58s5MLx2N0EaNJ8PwRUE6fM
+RZYO8aZCEPUtINE4njbvsWOMCtrblsMPwZ1B0SiIaWmLaNyGdCNKea+fCIW7kasC
+JYMhnLumpUTXg5HNexkCsl7ABWj0PYBflOE61h8EjWpnQ7JBBVKS2ua4lMjwHRX7
+5o5yxym9k5UZNFdGoXVL7xpizCcdGawxTJvwhs3vBqu1ZWYCegOAZWDrOkCyhUpq
+8uKMROZFbn+FwE+7tjt+v2ed62FVEvD6g4V3ThCA6mQqeOARfJWN8GZY8BDm8lht
+crOXriUkrx+FlrgGtm2CkwjW5/9Xd7AhFpHnQdFeozOHyq1asNSgJF9sNi9Lz94W
+skQSVRi0IExxSXYGI3Y0nnAZUe2BAQflYPJdEveSr3sKlUqXiETTA1VXsTPK3kOC
+92CbLzj/Hz199jZvywwyu53I+GKMpF42rMq7zxr2oa61YWY4YE/GDezwwys/wLx/
+QpCW4X3ppI7wJjCSSqEV0baYZSSli1ayheS6dxi8QnSpX1Bmpz6gU7m/M9Sns+hl
+J7ZvgpjCAiV7KJTjtclr5/S02zP78LTVkoTWoz/6MOTROwaP63VBUXX8pbJhf/vu
+DLmNnDk8joMJxoDXWeNU0EnNl4hP7Z/jExRBOEO4oAnUf/Sf6gCWQhL5qcajtg6w
+tGv7vx3f2IkBNgQYAQoAIBYhBAuiu1O3+KnrMm056kpK2u4B7rJtBQJi9Oz9AhsM
+AAoJEEpK2u4B7rJt6lgIAMBWqP4BCOGnQXBbgJ0+ACVghpkFUXZTb/tXJc8UUvTM
+8uov6k/RsqDGZrvhhufD7Wwt7j9v7dD7VPp7bPyjVWyimglQzWguTUUqLDGlstYH
+5uYv1pzma0ZsAGNqFeGlTLsKOSGKFMH4rB2KfN2n51L8POvtp1y7GKZQbWIWneaB
+cZr3BINU5GMvYYU7pAYcoR+mJPdJx5Up3Ocn+bn8Tu1sy9C/ArtCQucazGnoE9u1
+HhNLrh0CdzzX7TNH6TQ8LwPOvq0K5l/WqbN9lE0WBBhMv2HydxhluO8AhU+A5GqC
+C+wET7nVDnhoOm/fstIeb7/LN7OYejKPeHdFBJEL9GA=
+=u442
+-----END PGP PRIVATE KEY BLOCK-----`
+
+const curve25519PrivateKey = `-----BEGIN PGP PRIVATE KEY BLOCK-----
+Comment: gpg (GnuPG) 2.2.27 with libgcrypt 1.9.4
+
+lFgEYvTtQBYJKwYBBAHaRw8BAQdAxsNXLbrk5xOjpO24VhOMvQ0/F+JcyIkckMDH
+X3FIGxcAAQDFOlunZWYuPsCx5JLp78vKqUTfgef9TGG4oD6I/Sa0zBMstCJHb2xh
+bmcgR29waGVyIDxnb2xhbmdAZXhhbXBsZS5vcmc+iJAEExYIADgWIQSFQHEOazmo
+h1ldII4MvfnLQ4JBNwUCYvTtQAIbAwULCQgHAgYVCgkICwIEFgIDAQIeAQIXgAAK
+CRAMvfnLQ4JBN5yeAQCKdry8B5ScCPrev2+UByMCss7Sdu5RhomCFsHdNPLcKAEA
+8ugei+1owHsV+3cGwWWzKk6sLa8ZN87i3SKuOGp9DQycXQRi9O1AEgorBgEEAZdV
+AQUBAQdA5CubPp8l7lrVQ25h7Hx5XN2C8xanRnnpcjzEooCaEA0DAQgHAAD/Rpc+
+sOZUXrFk9HOWB1XU41LoWbDBoG8sP8RWAVYwD5AQRYh4BBgWCAAgFiEEhUBxDms5
+qIdZXSCODL35y0OCQTcFAmL07UACGwwACgkQDL35y0OCQTcvdwEA7lb5g/YisrEf
+iq660uwMGoepLUfvtqKzuQ6heYe83y0BAN65Ffg5HYOJzUEi0kZQRf7OhdtuL2kJ
+SRXn8DmCTfEB
+=cELM
+-----END PGP PRIVATE KEY BLOCK-----`
+
+const curve448PrivateKey = `-----BEGIN PGP PRIVATE KEY BLOCK-----
+Comment: C1DB 65D5 80D7 B922 7254  4B1E A699 9895 FABA CE52
+
+xYUEYV2UmRYDK2VxAc9AFyxgh5xnSbyt50TWl558mw9xdMN+/UBLr5+UMP8IsrvV
+MdXuTIE8CyaUQKSotHtH2RkYEXj5nsMAAAHPQIbTMSzjIWug8UFECzAex5FHgAgH
+gYF3RK+TS8D24wX8kOu2C/NoVxwGY+p+i0JHaB+7yljriSKAGxs6wsBEBB8WCgCD
+BYJhXZSZBYkFpI+9AwsJBwkQppmYlfq6zlJHFAAAAAAAHgAgc2FsdEBub3RhdGlv
+bnMuc2VxdW9pYS1wZ3Aub3Jn5wSpIutJ5HncJWk4ruUV8GzQF390rR5+qWEAnAoY
+akcDFQoIApsBAh4BFiEEwdtl1YDXuSJyVEseppmYlfq6zlIAALzdA5dA/fsgYg/J
+qaQriYKaPUkyHL7EB3BXhV2d1h/gk+qJLvXQuU2WEJ/XSs3GrsBRiiZwvPH4o+7b
+mleAxjy5wpS523vqrrBR2YZ5FwIku7WS4litSdn4AtVam/TlLdMNIf41CtFeZKBe
+c5R5VNdQy8y7qy8AAADNEUN1cnZlNDQ4IE9wdGlvbiA4wsBHBBMWCgCGBYJhXZSZ
+BYkFpI+9AwsJBwkQppmYlfq6zlJHFAAAAAAAHgAgc2FsdEBub3RhdGlvbnMuc2Vx
+dW9pYS1wZ3Aub3JnD55UsYMzE6OACP+mgw5zvT+BBgol8/uFQjHg4krjUCMDFQoI
+ApkBApsBAh4BFiEEwdtl1YDXuSJyVEseppmYlfq6zlIAAPQJA5dA0Xqwzn/0uwCq
+RlsOVCB3f5NOj1exKnlBvRw0xT1VBee1yxvlUt5eIAoCxWoRlWBJob3TTkhm9AEA
+8dyhwPmyGfWHzPw5NFG3xsXrZdNXNvit9WMVAPcmsyR7teXuDlJItxRAdJJc/qfJ
+YVbBFoaNrhYAAADHhQRhXZSZFgMrZXEBz0BL7THZ9MnCLfSPJ1FMLim9eGkQ3Bfn
+M3he5rOwO3t14QI1LjI96OjkeJipMgcFAmEP1Bq/ZHGO7oAAAc9AFnE8iNBaT3OU
+EFtxkmWHXtdaYMmGGRdopw9JPXr/UxuunDln5o9dxPxf7q7z26zXrZen+qed/Isa
+HsDCwSwEGBYKAWsFgmFdlJkFiQWkj70JEKaZmJX6us5SRxQAAAAAAB4AIHNhbHRA
+bm90YXRpb25zLnNlcXVvaWEtcGdwLm9yZxREUizdTcepBzgSMOv2VWQCWbl++3CZ
+EbgAWDryvSsyApsCwDGgBBkWCgBvBYJhXZSZCRBKo3SL4S5djkcUAAAAAAAeACBz
+YWx0QG5vdGF0aW9ucy5zZXF1b2lhLXBncC5vcmemoGTDjmNQiIzw6HOEddvS0OB7
+UZ/P07jM/EVmnYxTlBYhBAxsnkGpx1UCiH6gUUqjdIvhLl2OAAALYQOXQAMB1oKq
+OWxSFmvmgCKNcbAAyA3piF5ERIqs4z07oJvqDYrOWt75UsEIH/04gU/vHc4EmfG2
+JDLJgOLlyTUPkL/08f0ydGZPofFQBhn8HkuFFjnNtJ5oz3GIP4cdWMQFaUw0uvjb
+PM9Tm3ptENGd6Ts1AAAAFiEEwdtl1YDXuSJyVEseppmYlfq6zlIAAGpTA5dATR6i
+U2GrpUcQgpG+JqfAsGmF4yAOhgFxc1UfidFk3nTup3fLgjipkYY170WLRNbyKkVO
+Sodx93GAs58rizO1acDAWiLq3cyEPBFXbyFThbcNPcLl+/77Uk/mgkYrPQFAQWdK
+1kSRm4SizDBK37K8ChAAAADHhwRhXZSZEgMrZW8Bx0DMhzvhQo+OsXeqQ6QVw4sF
+CaexHh6rLohh7TzL3hQSjoJ27fV6JBkIWdn0LfrMlJIDbSv2SLdlgQMBCgkAAcdA
+MO7Dc1myF6Co1fAH+EuP+OxhxP/7V6ljuSCZENDfA49tQkzTta+PniG+pOVB2LHb
+huyaKBkqiaogo8LAOQQYFgoAeAWCYV2UmQWJBaSPvQkQppmYlfq6zlJHFAAAAAAA
+HgAgc2FsdEBub3RhdGlvbnMuc2VxdW9pYS1wZ3Aub3JnEjBMQAmc/2u45u5FQGmB
+QAytjSG2LM3JQN+PPVl5vEkCmwwWIQTB22XVgNe5InJUSx6mmZiV+rrOUgAASdYD
+l0DXEHQ9ykNP2rZP35ET1dmiFagFtTj/hLQcWlg16LqvJNGqOgYXuqTerbiOOt02
+XLCBln+wdewpU4ChEffMUDRBfqfQco/YsMqWV7bHJHAO0eC/DMKCjyU90xdH7R/d
+QgqsfguR1PqPuJxpXV4bSr6CGAAAAA==
+=MSvh
+-----END PGP PRIVATE KEY BLOCK-----`
+
+const keyWithNotation = `-----BEGIN PGP PRIVATE KEY BLOCK-----
+
+xVgEY9gIshYJKwYBBAHaRw8BAQdAF25fSM8OpFlXZhop4Qpqo5ywGZ4jgWlR
+ppjhIKDthREAAQC+LFpzFcMJYcjxGKzBGHN0Px2jU4d04YSRnFAik+lVVQ6u
+zRdUZXN0IDx0ZXN0QGV4YW1wbGUuY29tPsLACgQQFgoAfAUCY9gIsgQLCQcI
+CRD/utJOCym8pR0UgAAAAAAQAAR0ZXh0QGV4YW1wbGUuY29tdGVzdB8UAAAA
+AAASAARiaW5hcnlAZXhhbXBsZS5jb20AAQIDAxUICgQWAAIBAhkBAhsDAh4B
+FiEEEMCQTUVGKgCX5rDQ/7rSTgspvKUAAPl5AP9Npz90LxzrB97Qr2DrGwfG
+wuYn4FSYwtuPfZHHeoIabwD/QEbvpQJ/NBb9EAZuow4Rirlt1yv19mmnF+j5
+8yUzhQjHXQRj2AiyEgorBgEEAZdVAQUBAQdARXAo30DmKcyUg6co7OUm0RNT
+z9iqFbDBzA8A47JEt1MDAQgHAAD/XKK3lBm0SqMR558HLWdBrNG6NqKuqb5X
+joCML987ZNgRD8J4BBgWCAAqBQJj2AiyCRD/utJOCym8pQIbDBYhBBDAkE1F
+RioAl+aw0P+60k4LKbylAADRxgEAg7UfBDiDPp5LHcW9D+SgFHk6+GyEU4ev
+VppQxdtxPvAA/34snHBX7Twnip1nMt7P4e2hDiw/hwQ7oqioOvc6jMkP
+=Z8YJ
+-----END PGP PRIVATE KEY BLOCK-----
+`
diff --git a/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/packet/aead_config.go b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/packet/aead_config.go
new file mode 100644
index 00000000000..fec41a0e73f
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/packet/aead_config.go
@@ -0,0 +1,67 @@
+// Copyright (C) 2019 ProtonTech AG
+
+package packet
+
+import "math/bits"
+
+// CipherSuite contains a combination of Cipher and Mode
+type CipherSuite struct {
+	// The cipher function
+	Cipher CipherFunction
+	// The AEAD mode of operation.
+	Mode AEADMode
+}
+
+// AEADConfig collects a number of AEAD parameters along with sensible defaults.
+// A nil AEADConfig is valid and results in all default values.
+type AEADConfig struct {
+	// The AEAD mode of operation.
+	DefaultMode AEADMode
+	// Amount of octets in each chunk of data
+	ChunkSize uint64
+}
+
+// Mode returns the AEAD mode of operation.
+func (conf *AEADConfig) Mode() AEADMode {
+	// If no preference is specified, OCB is used (which is mandatory to implement).
+	if conf == nil || conf.DefaultMode == 0 {
+		return AEADModeOCB
+	}
+
+	mode := conf.DefaultMode
+	if mode != AEADModeEAX && mode != AEADModeOCB && mode != AEADModeGCM {
+		panic("AEAD mode unsupported")
+	}
+	return mode
+}
+
+// ChunkSizeByte returns the byte indicating the chunk size. The effective
+// chunk size is computed with the formula uint64(1) << (chunkSizeByte + 6)
+// limit to 16 = 4 MiB
+// https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-07.html#section-5.13.2
+func (conf *AEADConfig) ChunkSizeByte() byte {
+	if conf == nil || conf.ChunkSize == 0 {
+		return 12 // 1 << (12 + 6) == 262144 bytes
+	}
+
+	chunkSize := conf.ChunkSize
+	exponent := bits.Len64(chunkSize) - 1
+	switch {
+	case exponent < 6:
+		exponent = 6
+	case exponent > 16:
+		exponent = 16
+	}
+
+	return byte(exponent - 6)
+}
+
+// decodeAEADChunkSize returns the effective chunk size. In 32-bit systems, the
+// maximum returned value is 1 << 30.
+func decodeAEADChunkSize(c byte) int {
+	size := uint64(1 << (c + 6))
+	if size != uint64(int(size)) {
+		return 1 << 30
+	}
+	return int(size)
+}
diff --git a/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/packet/aead_crypter.go b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/packet/aead_crypter.go
new file mode 100644
index 00000000000..cee83bdc7a1
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/packet/aead_crypter.go
@@ -0,0 +1,264 @@
+// Copyright (C) 2019 ProtonTech AG
+
+package packet
+
+import (
+	"bytes"
+	"crypto/cipher"
+	"encoding/binary"
+	"io"
+
+	"github.com/ProtonMail/go-crypto/openpgp/errors"
+)
+
+// aeadCrypter is an AEAD opener/sealer, its configuration, and data for en/decryption.
+type aeadCrypter struct {
+	aead           cipher.AEAD
+	chunkSize      int
+	initialNonce   []byte
+	associatedData []byte       // Chunk-independent associated data
+	chunkIndex     []byte       // Chunk counter
+	packetTag      packetType   // SEIP packet (v2) or AEAD Encrypted Data packet
+	bytesProcessed int          // Amount of plaintext bytes encrypted/decrypted
+	buffer         bytes.Buffer // Buffered bytes across chunks
+}
+
+// computeNonce takes the incremental index and computes an eXclusive OR with
+// the least significant 8 bytes of the receivers' initial nonce (see sec.
+// 5.16.1 and 5.16.2). It returns the resulting nonce.
+func (wo *aeadCrypter) computeNextNonce() (nonce []byte) {
+	if wo.packetTag == packetTypeSymmetricallyEncryptedIntegrityProtected {
+		return append(wo.initialNonce, wo.chunkIndex...)
+	}
+
+	nonce = make([]byte, len(wo.initialNonce))
+	copy(nonce, wo.initialNonce)
+	offset := len(wo.initialNonce) - 8
+	for i := 0; i < 8; i++ {
+		nonce[i+offset] ^= wo.chunkIndex[i]
+	}
+	return
+}
+
+// incrementIndex performs an integer increment by 1 of the integer represented by the
+// slice, modifying it accordingly.
+func (wo *aeadCrypter) incrementIndex() error {
+	index := wo.chunkIndex
+	if len(index) == 0 {
+		return errors.AEADError("Index has length 0")
+	}
+	for i := len(index) - 1; i >= 0; i-- {
+		if index[i] < 255 {
+			index[i]++
+			return nil
+		}
+		index[i] = 0
+	}
+	return errors.AEADError("cannot further increment index")
+}
+
+// aeadDecrypter reads and decrypts bytes. It buffers extra decrypted bytes when
+// necessary, similar to aeadEncrypter.
+type aeadDecrypter struct {
+	aeadCrypter           // Embedded ciphertext opener
+	reader      io.Reader // 'reader' is a partialLengthReader
+	peekedBytes []byte    // Used to detect last chunk
+	eof         bool
+}
+
+// Read decrypts bytes and reads them into dst. It decrypts when necessary and
+// buffers extra decrypted bytes. It returns the number of bytes copied into dst
+// and an error.
+func (ar *aeadDecrypter) Read(dst []byte) (n int, err error) {
+	// Return buffered plaintext bytes from previous calls
+	if ar.buffer.Len() > 0 {
+		return ar.buffer.Read(dst)
+	}
+
+	// Return EOF if we've previously validated the final tag
+	if ar.eof {
+		return 0, io.EOF
+	}
+
+	// Read a chunk
+	tagLen := ar.aead.Overhead()
+	cipherChunkBuf := new(bytes.Buffer)
+	_, errRead := io.CopyN(cipherChunkBuf, ar.reader, int64(ar.chunkSize+tagLen))
+	cipherChunk := cipherChunkBuf.Bytes()
+	if errRead != nil && errRead != io.EOF {
+		return 0, errRead
+	}
+	decrypted, errChunk := ar.openChunk(cipherChunk)
+	if errChunk != nil {
+		return 0, errChunk
+	}
+
+	// Return decrypted bytes, buffering if necessary
+	if len(dst) < len(decrypted) {
+		n = copy(dst, decrypted[:len(dst)])
+		ar.buffer.Write(decrypted[len(dst):])
+	} else {
+		n = copy(dst, decrypted)
+	}
+
+	// Check final authentication tag
+	if errRead == io.EOF {
+		errChunk := ar.validateFinalTag(ar.peekedBytes)
+		if errChunk != nil {
+			return n, errChunk
+		}
+		ar.eof = true // Mark EOF for when we've returned all buffered data
+	}
+	return
+}
+
+// Close is noOp. The final authentication tag of the stream was already
+// checked in the last Read call. In the future, this function could be used to
+// wipe the reader and peeked, decrypted bytes, if necessary.
+func (ar *aeadDecrypter) Close() (err error) {
+	return nil
+}
+
+// openChunk decrypts and checks integrity of an encrypted chunk, returning
+// the underlying plaintext and an error. It accesses peeked bytes from next
+// chunk, to identify the last chunk and decrypt/validate accordingly.
+func (ar *aeadDecrypter) openChunk(data []byte) ([]byte, error) {
+	tagLen := ar.aead.Overhead()
+	// Restore carried bytes from last call
+	chunkExtra := append(ar.peekedBytes, data...)
+	// 'chunk' contains encrypted bytes, followed by an authentication tag.
+	chunk := chunkExtra[:len(chunkExtra)-tagLen]
+	ar.peekedBytes = chunkExtra[len(chunkExtra)-tagLen:]
+
+	adata := ar.associatedData
+	if ar.aeadCrypter.packetTag == packetTypeAEADEncrypted {
+		adata = append(ar.associatedData, ar.chunkIndex...)
+	}
+
+	nonce := ar.computeNextNonce()
+	plainChunk, err := ar.aead.Open(nil, nonce, chunk, adata)
+	if err != nil {
+		return nil, err
+	}
+	ar.bytesProcessed += len(plainChunk)
+	if err = ar.aeadCrypter.incrementIndex(); err != nil {
+		return nil, err
+	}
+	return plainChunk, nil
+}
+
+// Checks the summary tag. It takes into account the total decrypted bytes into
+// the associated data. It returns an error, or nil if the tag is valid.
+func (ar *aeadDecrypter) validateFinalTag(tag []byte) error {
+	// Associated: tag, version, cipher, aead, chunk size, ...
+	amountBytes := make([]byte, 8)
+	binary.BigEndian.PutUint64(amountBytes, uint64(ar.bytesProcessed))
+
+	adata := ar.associatedData
+	if ar.aeadCrypter.packetTag == packetTypeAEADEncrypted {
+		// ... index ...
+		adata = append(ar.associatedData, ar.chunkIndex...)
+	}
+
+	// ... and total number of encrypted octets
+	adata = append(adata, amountBytes...)
+	nonce := ar.computeNextNonce()
+	_, err := ar.aead.Open(nil, nonce, tag, adata)
+	if err != nil {
+		return err
+	}
+	return nil
+}
+
+// aeadEncrypter encrypts and writes bytes. It encrypts when necessary according
+// to the AEAD block size, and buffers the extra encrypted bytes for next write.
+type aeadEncrypter struct {
+	aeadCrypter                // Embedded plaintext sealer
+	writer      io.WriteCloser // 'writer' is a partialLengthWriter
+}
+
+// Write encrypts and writes bytes. It encrypts when necessary and buffers extra
+// plaintext bytes for next call. When the stream is finished, Close() MUST be
+// called to append the final tag.
+func (aw *aeadEncrypter) Write(plaintextBytes []byte) (n int, err error) {
+	// Append plaintextBytes to existing buffered bytes
+	n, err = aw.buffer.Write(plaintextBytes)
+	if err != nil {
+		return n, err
+	}
+	// Encrypt and write chunks
+	for aw.buffer.Len() >= aw.chunkSize {
+		plainChunk := aw.buffer.Next(aw.chunkSize)
+		encryptedChunk, err := aw.sealChunk(plainChunk)
+		if err != nil {
+			return n, err
+		}
+		_, err = aw.writer.Write(encryptedChunk)
+		if err != nil {
+			return n, err
+		}
+	}
+	return
+}
+
+// Close encrypts and writes the remaining buffered plaintext if any, appends
+// the final authentication tag, and closes the embedded writer. This function
+// MUST be called at the end of a stream.
+func (aw *aeadEncrypter) Close() (err error) {
+	// Encrypt and write a chunk if there's buffered data left, or if we haven't
+	// written any chunks yet.
+	if aw.buffer.Len() > 0 || aw.bytesProcessed == 0 {
+		plainChunk := aw.buffer.Bytes()
+		lastEncryptedChunk, err := aw.sealChunk(plainChunk)
+		if err != nil {
+			return err
+		}
+		_, err = aw.writer.Write(lastEncryptedChunk)
+		if err != nil {
+			return err
+		}
+	}
+	// Compute final tag (associated data: packet tag, version, cipher, aead,
+	// chunk size...
+	adata := aw.associatedData
+
+	if aw.aeadCrypter.packetTag == packetTypeAEADEncrypted {
+		// ... index ...
+		adata = append(aw.associatedData, aw.chunkIndex...)
+	}
+
+	// ... and total number of encrypted octets
+	amountBytes := make([]byte, 8)
+	binary.BigEndian.PutUint64(amountBytes, uint64(aw.bytesProcessed))
+	adata = append(adata, amountBytes...)
+
+	nonce := aw.computeNextNonce()
+	finalTag := aw.aead.Seal(nil, nonce, nil, adata)
+	_, err = aw.writer.Write(finalTag)
+	if err != nil {
+		return err
+	}
+	return aw.writer.Close()
+}
+
+// sealChunk Encrypts and authenticates the given chunk.
+func (aw *aeadEncrypter) sealChunk(data []byte) ([]byte, error) {
+	if len(data) > aw.chunkSize {
+		return nil, errors.AEADError("chunk exceeds maximum length")
+	}
+	if aw.associatedData == nil {
+		return nil, errors.AEADError("can't seal without headers")
+	}
+	adata := aw.associatedData
+	if aw.aeadCrypter.packetTag == packetTypeAEADEncrypted {
+		adata = append(aw.associatedData, aw.chunkIndex...)
+	}
+
+	nonce := aw.computeNextNonce()
+	encrypted := aw.aead.Seal(nil, nonce, data, adata)
+	aw.bytesProcessed += len(data)
+	if err := aw.aeadCrypter.incrementIndex(); err != nil {
+		return nil, err
+	}
+	return encrypted, nil
+}
diff --git a/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/packet/aead_encrypted.go b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/packet/aead_encrypted.go
new file mode 100644
index 00000000000..98bd876bf29
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/packet/aead_encrypted.go
@@ -0,0 +1,96 @@
+// Copyright (C) 2019 ProtonTech AG
+
+package packet
+
+import (
+	"io"
+
+	"github.com/ProtonMail/go-crypto/openpgp/errors"
+	"github.com/ProtonMail/go-crypto/openpgp/internal/algorithm"
+)
+
+// AEADEncrypted represents an AEAD Encrypted Packet.
+// See https://www.ietf.org/archive/id/draft-koch-openpgp-2015-rfc4880bis-00.html#name-aead-encrypted-data-packet-t
+type AEADEncrypted struct {
+	cipher        CipherFunction
+	mode          AEADMode
+	chunkSizeByte byte
+	Contents      io.Reader // Encrypted chunks and tags
+	initialNonce  []byte    // Referred to as IV in RFC4880-bis
+}
+
+// Only currently defined version
+const aeadEncryptedVersion = 1
+
+func (ae *AEADEncrypted) parse(buf io.Reader) error {
+	headerData := make([]byte, 4)
+	if n, err := io.ReadFull(buf, headerData); n < 4 {
+		return errors.AEADError("could not read aead header:" + err.Error())
+	}
+	// Read initial nonce
+	mode := AEADMode(headerData[2])
+	nonceLen := mode.IvLength()
+
+	// This packet supports only EAX and OCB
+	// https://www.ietf.org/archive/id/draft-koch-openpgp-2015-rfc4880bis-00.html#name-aead-encrypted-data-packet-t
+	if nonceLen == 0 || mode > AEADModeOCB {
+		return errors.AEADError("unknown mode")
+	}
+
+	initialNonce := make([]byte, nonceLen)
+	if n, err := io.ReadFull(buf, initialNonce); n < nonceLen {
+		return errors.AEADError("could not read aead nonce:" + err.Error())
+	}
+	ae.Contents = buf
+	ae.initialNonce = initialNonce
+	c := headerData[1]
+	if _, ok := algorithm.CipherById[c]; !ok {
+		return errors.UnsupportedError("unknown cipher: " + string(c))
+	}
+	ae.cipher = CipherFunction(c)
+	ae.mode = mode
+	ae.chunkSizeByte = headerData[3]
+	return nil
+}
+
+// Decrypt returns a io.ReadCloser from which decrypted bytes can be read, or
+// an error.
+func (ae *AEADEncrypted) Decrypt(ciph CipherFunction, key []byte) (io.ReadCloser, error) {
+	return ae.decrypt(key)
+}
+
+// decrypt prepares an aeadCrypter and returns a ReadCloser from which
+// decrypted bytes can be read (see aeadDecrypter.Read()).
+func (ae *AEADEncrypted) decrypt(key []byte) (io.ReadCloser, error) {
+	blockCipher := ae.cipher.new(key)
+	aead := ae.mode.new(blockCipher)
+	// Carry the first tagLen bytes
+	tagLen := ae.mode.TagLength()
+	peekedBytes := make([]byte, tagLen)
+	n, err := io.ReadFull(ae.Contents, peekedBytes)
+	if n < tagLen || (err != nil && err != io.EOF) {
+		return nil, errors.AEADError("Not enough data to decrypt:" + err.Error())
+	}
+	chunkSize := decodeAEADChunkSize(ae.chunkSizeByte)
+	return &aeadDecrypter{
+		aeadCrypter: aeadCrypter{
+			aead:           aead,
+			chunkSize:      chunkSize,
+			initialNonce:   ae.initialNonce,
+			associatedData: ae.associatedData(),
+			chunkIndex:     make([]byte, 8),
+			packetTag:      packetTypeAEADEncrypted,
+		},
+		reader:      ae.Contents,
+		peekedBytes: peekedBytes}, nil
+}
+
+// associatedData for chunks: tag, version, cipher, mode, chunk size byte
+func (ae *AEADEncrypted) associatedData() []byte {
+	return []byte{
+		0xD4,
+		aeadEncryptedVersion,
+		byte(ae.cipher),
+		byte(ae.mode),
+		ae.chunkSizeByte}
+}
diff --git a/.ci/providerlint/vendor/golang.org/x/crypto/openpgp/packet/compressed.go b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/packet/compressed.go
similarity index 95%
rename from .ci/providerlint/vendor/golang.org/x/crypto/openpgp/packet/compressed.go
rename to .ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/packet/compressed.go
index 353f945247c..2f5cad71dab 100644
--- a/.ci/providerlint/vendor/golang.org/x/crypto/openpgp/packet/compressed.go
+++ b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/packet/compressed.go
@@ -8,7 +8,7 @@ import (
 	"compress/bzip2"
 	"compress/flate"
 	"compress/zlib"
-	"golang.org/x/crypto/openpgp/errors"
+	"github.com/ProtonMail/go-crypto/openpgp/errors"
 	"io"
 	"strconv"
 )
@@ -47,6 +47,8 @@ func (c *Compressed) parse(r io.Reader) error {
 	}
 
 	switch buf[0] {
+	case 0:
+		c.Body = r
 	case 1:
 		c.Body = flate.NewReader(r)
 	case 2:
@@ -60,7 +62,7 @@ func (c *Compressed) parse(r io.Reader) error {
 	return err
 }
 
-// compressedWriteCloser represents the serialized compression stream
+// compressedWriterCloser represents the serialized compression stream
 // header and the compressor. Its Close() method ensures that both the
 // compressor and serialized stream header are closed. Its Write()
 // method writes to the compressor.
diff --git a/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/packet/config.go b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/packet/config.go
new file mode 100644
index 00000000000..04994bec97b
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/packet/config.go
@@ -0,0 +1,248 @@
+// Copyright 2012 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package packet
+
+import (
+	"crypto"
+	"crypto/rand"
+	"io"
+	"math/big"
+	"time"
+
+	"github.com/ProtonMail/go-crypto/openpgp/s2k"
+)
+
+// Config collects a number of parameters along with sensible defaults.
+// A nil *Config is valid and results in all default values.
+type Config struct {
+	// Rand provides the source of entropy.
+	// If nil, the crypto/rand Reader is used.
+	Rand io.Reader
+	// DefaultHash is the default hash function to be used.
+	// If zero, SHA-256 is used.
+	DefaultHash crypto.Hash
+	// DefaultCipher is the cipher to be used.
+	// If zero, AES-128 is used.
+	DefaultCipher CipherFunction
+	// Time returns the current time as the number of seconds since the
+	// epoch. If Time is nil, time.Now is used.
+	Time func() time.Time
+	// DefaultCompressionAlgo is the compression algorithm to be
+	// applied to the plaintext before encryption. If zero, no
+	// compression is done.
+	DefaultCompressionAlgo CompressionAlgo
+	// CompressionConfig configures the compression settings.
+	CompressionConfig *CompressionConfig
+	// S2K (String to Key) config, used for key derivation in the context of secret key encryption
+	// and password-encrypted data.
+	// If nil, the default configuration is used
+	S2KConfig *s2k.Config
+	// Iteration count for Iterated S2K (String to Key).
+	// Only used if sk2.Mode is nil.
+	// This value is duplicated here from s2k.Config for backwards compatibility.
+	// It determines the strength of the passphrase stretching when
+	// the said passphrase is hashed to produce a key. S2KCount
+	// should be between 65536 and 65011712, inclusive. If Config
+	// is nil or S2KCount is 0, the value 16777216 used. Not all
+	// values in the above range can be represented. S2KCount will
+	// be rounded up to the next representable value if it cannot
+	// be encoded exactly. When set, it is strongly encrouraged to
+	// use a value that is at least 65536. See RFC 4880 Section
+	// 3.7.1.3.
+	//
+	// Deprecated: SK2Count should be configured in S2KConfig instead.
+	S2KCount int
+	// RSABits is the number of bits in new RSA keys made with NewEntity.
+	// If zero, then 2048 bit keys are created.
+	RSABits int
+	// The public key algorithm to use - will always create a signing primary
+	// key and encryption subkey.
+	Algorithm PublicKeyAlgorithm
+	// Some known primes that are optionally prepopulated by the caller
+	RSAPrimes []*big.Int
+	// Curve configures the desired packet.Curve if the Algorithm is PubKeyAlgoECDSA,
+	// PubKeyAlgoEdDSA, or PubKeyAlgoECDH. If empty Curve25519 is used.
+	Curve Curve
+	// AEADConfig configures the use of the new AEAD Encrypted Data Packet,
+	// defined in the draft of the next version of the OpenPGP specification.
+	// If a non-nil AEADConfig is passed, usage of this packet is enabled. By
+	// default, it is disabled. See the documentation of AEADConfig for more
+	// configuration options related to AEAD.
+	// **Note: using this option may break compatibility with other OpenPGP
+	// implementations, as well as future versions of this library.**
+	AEADConfig *AEADConfig
+	// V5Keys configures version 5 key generation. If false, this package still
+	// supports version 5 keys, but produces version 4 keys.
+	V5Keys bool
+	// "The validity period of the key.  This is the number of seconds after
+	// the key creation time that the key expires.  If this is not present
+	// or has a value of zero, the key never expires.  This is found only on
+	// a self-signature.""
+	// https://tools.ietf.org/html/rfc4880#section-5.2.3.6
+	KeyLifetimeSecs uint32
+	// "The validity period of the signature.  This is the number of seconds
+	// after the signature creation time that the signature expires.  If
+	// this is not present or has a value of zero, it never expires."
+	// https://tools.ietf.org/html/rfc4880#section-5.2.3.10
+	SigLifetimeSecs uint32
+	// SigningKeyId is used to specify the signing key to use (by Key ID).
+	// By default, the signing key is selected automatically, preferring
+	// signing subkeys if available.
+	SigningKeyId uint64
+	// SigningIdentity is used to specify a user ID (packet Signer's User ID, type 28)
+	// when producing a generic certification signature onto an existing user ID.
+	// The identity must be present in the signer Entity.
+	SigningIdentity string
+	// InsecureAllowUnauthenticatedMessages controls, whether it is tolerated to read
+	// encrypted messages without Modification Detection Code (MDC).
+	// MDC is mandated by the IETF OpenPGP Crypto Refresh draft and has long been implemented
+	// in most OpenPGP implementations. Messages without MDC are considered unnecessarily
+	// insecure and should be prevented whenever possible.
+	// In case one needs to deal with messages from very old OpenPGP implementations, there
+	// might be no other way than to tolerate the missing MDC. Setting this flag, allows this
+	// mode of operation. It should be considered a measure of last resort.
+	InsecureAllowUnauthenticatedMessages bool
+	// KnownNotations is a map of Notation Data names to bools, which controls
+	// the notation names that are allowed to be present in critical Notation Data
+	// signature subpackets.
+	KnownNotations map[string]bool
+	// SignatureNotations is a list of Notations to be added to any signatures.
+	SignatureNotations []*Notation
+}
+
+func (c *Config) Random() io.Reader {
+	if c == nil || c.Rand == nil {
+		return rand.Reader
+	}
+	return c.Rand
+}
+
+func (c *Config) Hash() crypto.Hash {
+	if c == nil || uint(c.DefaultHash) == 0 {
+		return crypto.SHA256
+	}
+	return c.DefaultHash
+}
+
+func (c *Config) Cipher() CipherFunction {
+	if c == nil || uint8(c.DefaultCipher) == 0 {
+		return CipherAES128
+	}
+	return c.DefaultCipher
+}
+
+func (c *Config) Now() time.Time {
+	if c == nil || c.Time == nil {
+		return time.Now().Truncate(time.Second)
+	}
+	return c.Time().Truncate(time.Second)
+}
+
+// KeyLifetime returns the validity period of the key.
+func (c *Config) KeyLifetime() uint32 {
+	if c == nil {
+		return 0
+	}
+	return c.KeyLifetimeSecs
+}
+
+// SigLifetime returns the validity period of the signature.
+func (c *Config) SigLifetime() uint32 {
+	if c == nil {
+		return 0
+	}
+	return c.SigLifetimeSecs
+}
+
+func (c *Config) Compression() CompressionAlgo {
+	if c == nil {
+		return CompressionNone
+	}
+	return c.DefaultCompressionAlgo
+}
+
+func (c *Config) RSAModulusBits() int {
+	if c == nil || c.RSABits == 0 {
+		return 2048
+	}
+	return c.RSABits
+}
+
+func (c *Config) PublicKeyAlgorithm() PublicKeyAlgorithm {
+	if c == nil || c.Algorithm == 0 {
+		return PubKeyAlgoRSA
+	}
+	return c.Algorithm
+}
+
+func (c *Config) CurveName() Curve {
+	if c == nil || c.Curve == "" {
+		return Curve25519
+	}
+	return c.Curve
+}
+
+// Deprecated: The hash iterations should now be queried via the S2K() method.
+func (c *Config) PasswordHashIterations() int {
+	if c == nil || c.S2KCount == 0 {
+		return 0
+	}
+	return c.S2KCount
+}
+
+func (c *Config) S2K() *s2k.Config {
+	if c == nil {
+		return nil
+	}
+	// for backwards compatibility
+	if c != nil && c.S2KCount > 0 && c.S2KConfig == nil {
+		return &s2k.Config{
+			S2KCount: c.S2KCount,
+		}
+	}
+	return c.S2KConfig
+}
+
+func (c *Config) AEAD() *AEADConfig {
+	if c == nil {
+		return nil
+	}
+	return c.AEADConfig
+}
+
+func (c *Config) SigningKey() uint64 {
+	if c == nil {
+		return 0
+	}
+	return c.SigningKeyId
+}
+
+func (c *Config) SigningUserId() string {
+	if c == nil {
+		return ""
+	}
+	return c.SigningIdentity
+}
+
+func (c *Config) AllowUnauthenticatedMessages() bool {
+	if c == nil {
+		return false
+	}
+	return c.InsecureAllowUnauthenticatedMessages
+}
+
+func (c *Config) KnownNotation(notationName string) bool {
+	if c == nil {
+		return false
+	}
+	return c.KnownNotations[notationName]
+}
+
+func (c *Config) Notations() []*Notation {
+	if c == nil {
+		return nil
+	}
+	return c.SignatureNotations
+}
diff --git a/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/packet/encrypted_key.go b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/packet/encrypted_key.go
new file mode 100644
index 00000000000..eeff2902c12
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/packet/encrypted_key.go
@@ -0,0 +1,286 @@
+// Copyright 2011 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package packet
+
+import (
+	"crypto"
+	"crypto/rsa"
+	"encoding/binary"
+	"io"
+	"math/big"
+	"strconv"
+
+	"github.com/ProtonMail/go-crypto/openpgp/ecdh"
+	"github.com/ProtonMail/go-crypto/openpgp/elgamal"
+	"github.com/ProtonMail/go-crypto/openpgp/errors"
+	"github.com/ProtonMail/go-crypto/openpgp/internal/encoding"
+)
+
+const encryptedKeyVersion = 3
+
+// EncryptedKey represents a public-key encrypted session key. See RFC 4880,
+// section 5.1.
+type EncryptedKey struct {
+	KeyId      uint64
+	Algo       PublicKeyAlgorithm
+	CipherFunc CipherFunction // only valid after a successful Decrypt for a v3 packet
+	Key        []byte         // only valid after a successful Decrypt
+
+	encryptedMPI1, encryptedMPI2 encoding.Field
+}
+
+func (e *EncryptedKey) parse(r io.Reader) (err error) {
+	var buf [10]byte
+	_, err = readFull(r, buf[:])
+	if err != nil {
+		return
+	}
+	if buf[0] != encryptedKeyVersion {
+		return errors.UnsupportedError("unknown EncryptedKey version " + strconv.Itoa(int(buf[0])))
+	}
+	e.KeyId = binary.BigEndian.Uint64(buf[1:9])
+	e.Algo = PublicKeyAlgorithm(buf[9])
+	switch e.Algo {
+	case PubKeyAlgoRSA, PubKeyAlgoRSAEncryptOnly:
+		e.encryptedMPI1 = new(encoding.MPI)
+		if _, err = e.encryptedMPI1.ReadFrom(r); err != nil {
+			return
+		}
+	case PubKeyAlgoElGamal:
+		e.encryptedMPI1 = new(encoding.MPI)
+		if _, err = e.encryptedMPI1.ReadFrom(r); err != nil {
+			return
+		}
+
+		e.encryptedMPI2 = new(encoding.MPI)
+		if _, err = e.encryptedMPI2.ReadFrom(r); err != nil {
+			return
+		}
+	case PubKeyAlgoECDH:
+		e.encryptedMPI1 = new(encoding.MPI)
+		if _, err = e.encryptedMPI1.ReadFrom(r); err != nil {
+			return
+		}
+
+		e.encryptedMPI2 = new(encoding.OID)
+		if _, err = e.encryptedMPI2.ReadFrom(r); err != nil {
+			return
+		}
+	}
+	_, err = consumeAll(r)
+	return
+}
+
+func checksumKeyMaterial(key []byte) uint16 {
+	var checksum uint16
+	for _, v := range key {
+		checksum += uint16(v)
+	}
+	return checksum
+}
+
+// Decrypt decrypts an encrypted session key with the given private key. The
+// private key must have been decrypted first.
+// If config is nil, sensible defaults will be used.
+func (e *EncryptedKey) Decrypt(priv *PrivateKey, config *Config) error {
+	if e.KeyId != 0 && e.KeyId != priv.KeyId {
+		return errors.InvalidArgumentError("cannot decrypt encrypted session key for key id " + strconv.FormatUint(e.KeyId, 16) + " with private key id " + strconv.FormatUint(priv.KeyId, 16))
+	}
+	if e.Algo != priv.PubKeyAlgo {
+		return errors.InvalidArgumentError("cannot decrypt encrypted session key of type " + strconv.Itoa(int(e.Algo)) + " with private key of type " + strconv.Itoa(int(priv.PubKeyAlgo)))
+	}
+	if priv.Dummy() {
+		return errors.ErrDummyPrivateKey("dummy key found")
+	}
+
+	var err error
+	var b []byte
+
+	// TODO(agl): use session key decryption routines here to avoid
+	// padding oracle attacks.
+	switch priv.PubKeyAlgo {
+	case PubKeyAlgoRSA, PubKeyAlgoRSAEncryptOnly:
+		// Supports both *rsa.PrivateKey and crypto.Decrypter
+		k := priv.PrivateKey.(crypto.Decrypter)
+		b, err = k.Decrypt(config.Random(), padToKeySize(k.Public().(*rsa.PublicKey), e.encryptedMPI1.Bytes()), nil)
+	case PubKeyAlgoElGamal:
+		c1 := new(big.Int).SetBytes(e.encryptedMPI1.Bytes())
+		c2 := new(big.Int).SetBytes(e.encryptedMPI2.Bytes())
+		b, err = elgamal.Decrypt(priv.PrivateKey.(*elgamal.PrivateKey), c1, c2)
+	case PubKeyAlgoECDH:
+		vsG := e.encryptedMPI1.Bytes()
+		m := e.encryptedMPI2.Bytes()
+		oid := priv.PublicKey.oid.EncodedBytes()
+		b, err = ecdh.Decrypt(priv.PrivateKey.(*ecdh.PrivateKey), vsG, m, oid, priv.PublicKey.Fingerprint[:])
+	default:
+		err = errors.InvalidArgumentError("cannot decrypt encrypted session key with private key of type " + strconv.Itoa(int(priv.PubKeyAlgo)))
+	}
+
+	if err != nil {
+		return err
+	}
+
+	e.CipherFunc = CipherFunction(b[0])
+	if !e.CipherFunc.IsSupported() {
+		return errors.UnsupportedError("unsupported encryption function")
+	}
+
+	e.Key = b[1 : len(b)-2]
+	expectedChecksum := uint16(b[len(b)-2])<<8 | uint16(b[len(b)-1])
+	checksum := checksumKeyMaterial(e.Key)
+	if checksum != expectedChecksum {
+		return errors.StructuralError("EncryptedKey checksum incorrect")
+	}
+
+	return nil
+}
+
+// Serialize writes the encrypted key packet, e, to w.
+func (e *EncryptedKey) Serialize(w io.Writer) error {
+	var mpiLen int
+	switch e.Algo {
+	case PubKeyAlgoRSA, PubKeyAlgoRSAEncryptOnly:
+		mpiLen = int(e.encryptedMPI1.EncodedLength())
+	case PubKeyAlgoElGamal:
+		mpiLen = int(e.encryptedMPI1.EncodedLength()) + int(e.encryptedMPI2.EncodedLength())
+	case PubKeyAlgoECDH:
+		mpiLen = int(e.encryptedMPI1.EncodedLength()) + int(e.encryptedMPI2.EncodedLength())
+	default:
+		return errors.InvalidArgumentError("don't know how to serialize encrypted key type " + strconv.Itoa(int(e.Algo)))
+	}
+
+	err := serializeHeader(w, packetTypeEncryptedKey, 1 /* version */ +8 /* key id */ +1 /* algo */ +mpiLen)
+	if err != nil {
+		return err
+	}
+
+	w.Write([]byte{encryptedKeyVersion})
+	binary.Write(w, binary.BigEndian, e.KeyId)
+	w.Write([]byte{byte(e.Algo)})
+
+	switch e.Algo {
+	case PubKeyAlgoRSA, PubKeyAlgoRSAEncryptOnly:
+		_, err := w.Write(e.encryptedMPI1.EncodedBytes())
+		return err
+	case PubKeyAlgoElGamal:
+		if _, err := w.Write(e.encryptedMPI1.EncodedBytes()); err != nil {
+			return err
+		}
+		_, err := w.Write(e.encryptedMPI2.EncodedBytes())
+		return err
+	case PubKeyAlgoECDH:
+		if _, err := w.Write(e.encryptedMPI1.EncodedBytes()); err != nil {
+			return err
+		}
+		_, err := w.Write(e.encryptedMPI2.EncodedBytes())
+		return err
+	default:
+		panic("internal error")
+	}
+}
+
+// SerializeEncryptedKey serializes an encrypted key packet to w that contains
+// key, encrypted to pub.
+// If config is nil, sensible defaults will be used.
+func SerializeEncryptedKey(w io.Writer, pub *PublicKey, cipherFunc CipherFunction, key []byte, config *Config) error {
+	var buf [10]byte
+	buf[0] = encryptedKeyVersion
+	binary.BigEndian.PutUint64(buf[1:9], pub.KeyId)
+	buf[9] = byte(pub.PubKeyAlgo)
+
+	keyBlock := make([]byte, 1 /* cipher type */ +len(key)+2 /* checksum */)
+	keyBlock[0] = byte(cipherFunc)
+	copy(keyBlock[1:], key)
+	checksum := checksumKeyMaterial(key)
+	keyBlock[1+len(key)] = byte(checksum >> 8)
+	keyBlock[1+len(key)+1] = byte(checksum)
+
+	switch pub.PubKeyAlgo {
+	case PubKeyAlgoRSA, PubKeyAlgoRSAEncryptOnly:
+		return serializeEncryptedKeyRSA(w, config.Random(), buf, pub.PublicKey.(*rsa.PublicKey), keyBlock)
+	case PubKeyAlgoElGamal:
+		return serializeEncryptedKeyElGamal(w, config.Random(), buf, pub.PublicKey.(*elgamal.PublicKey), keyBlock)
+	case PubKeyAlgoECDH:
+		return serializeEncryptedKeyECDH(w, config.Random(), buf, pub.PublicKey.(*ecdh.PublicKey), keyBlock, pub.oid, pub.Fingerprint)
+	case PubKeyAlgoDSA, PubKeyAlgoRSASignOnly:
+		return errors.InvalidArgumentError("cannot encrypt to public key of type " + strconv.Itoa(int(pub.PubKeyAlgo)))
+	}
+
+	return errors.UnsupportedError("encrypting a key to public key of type " + strconv.Itoa(int(pub.PubKeyAlgo)))
+}
+
+func serializeEncryptedKeyRSA(w io.Writer, rand io.Reader, header [10]byte, pub *rsa.PublicKey, keyBlock []byte) error {
+	cipherText, err := rsa.EncryptPKCS1v15(rand, pub, keyBlock)
+	if err != nil {
+		return errors.InvalidArgumentError("RSA encryption failed: " + err.Error())
+	}
+
+	cipherMPI := encoding.NewMPI(cipherText)
+	packetLen := 10 /* header length */ + int(cipherMPI.EncodedLength())
+
+	err = serializeHeader(w, packetTypeEncryptedKey, packetLen)
+	if err != nil {
+		return err
+	}
+	_, err = w.Write(header[:])
+	if err != nil {
+		return err
+	}
+	_, err = w.Write(cipherMPI.EncodedBytes())
+	return err
+}
+
+func serializeEncryptedKeyElGamal(w io.Writer, rand io.Reader, header [10]byte, pub *elgamal.PublicKey, keyBlock []byte) error {
+	c1, c2, err := elgamal.Encrypt(rand, pub, keyBlock)
+	if err != nil {
+		return errors.InvalidArgumentError("ElGamal encryption failed: " + err.Error())
+	}
+
+	packetLen := 10 /* header length */
+	packetLen += 2 /* mpi size */ + (c1.BitLen()+7)/8
+	packetLen += 2 /* mpi size */ + (c2.BitLen()+7)/8
+
+	err = serializeHeader(w, packetTypeEncryptedKey, packetLen)
+	if err != nil {
+		return err
+	}
+	_, err = w.Write(header[:])
+	if err != nil {
+		return err
+	}
+	if _, err = w.Write(new(encoding.MPI).SetBig(c1).EncodedBytes()); err != nil {
+		return err
+	}
+	_, err = w.Write(new(encoding.MPI).SetBig(c2).EncodedBytes())
+	return err
+}
+
+func serializeEncryptedKeyECDH(w io.Writer, rand io.Reader, header [10]byte, pub *ecdh.PublicKey, keyBlock []byte, oid encoding.Field, fingerprint []byte) error {
+	vsG, c, err := ecdh.Encrypt(rand, pub, keyBlock, oid.EncodedBytes(), fingerprint)
+	if err != nil {
+		return errors.InvalidArgumentError("ECDH encryption failed: " + err.Error())
+	}
+
+	g := encoding.NewMPI(vsG)
+	m := encoding.NewOID(c)
+
+	packetLen := 10 /* header length */
+	packetLen += int(g.EncodedLength()) + int(m.EncodedLength())
+
+	err = serializeHeader(w, packetTypeEncryptedKey, packetLen)
+	if err != nil {
+		return err
+	}
+
+	_, err = w.Write(header[:])
+	if err != nil {
+		return err
+	}
+	if _, err = w.Write(g.EncodedBytes()); err != nil {
+		return err
+	}
+	_, err = w.Write(m.EncodedBytes())
+	return err
+}
diff --git a/.ci/providerlint/vendor/golang.org/x/crypto/openpgp/packet/literal.go b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/packet/literal.go
similarity index 96%
rename from .ci/providerlint/vendor/golang.org/x/crypto/openpgp/packet/literal.go
rename to .ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/packet/literal.go
index 1a9ec6e51e8..4be987609be 100644
--- a/.ci/providerlint/vendor/golang.org/x/crypto/openpgp/packet/literal.go
+++ b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/packet/literal.go
@@ -11,6 +11,7 @@ import (
 
 // LiteralData represents an encrypted file. See RFC 4880, section 5.9.
 type LiteralData struct {
+	Format   uint8
 	IsBinary bool
 	FileName string
 	Time     uint32 // Unix epoch time. Either creation time or modification time. 0 means undefined.
@@ -31,7 +32,8 @@ func (l *LiteralData) parse(r io.Reader) (err error) {
 		return
 	}
 
-	l.IsBinary = buf[0] == 'b'
+	l.Format = buf[0]
+	l.IsBinary = l.Format == 'b'
 	fileNameLen := int(buf[1])
 
 	_, err = readFull(r, buf[:fileNameLen])
diff --git a/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/packet/notation.go b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/packet/notation.go
new file mode 100644
index 00000000000..2c3e3f50b25
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/packet/notation.go
@@ -0,0 +1,29 @@
+package packet
+
+// Notation type represents a Notation Data subpacket
+// see https://tools.ietf.org/html/rfc4880#section-5.2.3.16
+type Notation struct {
+	Name            string
+	Value           []byte
+	IsCritical      bool
+	IsHumanReadable bool
+}
+
+func (notation *Notation) getData() []byte {
+	nameData := []byte(notation.Name)
+	nameLen := len(nameData)
+	valueLen := len(notation.Value)
+
+	data := make([]byte, 8+nameLen+valueLen)
+	if notation.IsHumanReadable {
+		data[0] = 0x80
+	}
+
+	data[4] = byte(nameLen >> 8)
+	data[5] = byte(nameLen)
+	data[6] = byte(valueLen >> 8)
+	data[7] = byte(valueLen)
+	copy(data[8:8+nameLen], nameData)
+	copy(data[8+nameLen:], notation.Value)
+	return data
+}
diff --git a/.ci/providerlint/vendor/golang.org/x/crypto/openpgp/packet/ocfb.go b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/packet/ocfb.go
similarity index 92%
rename from .ci/providerlint/vendor/golang.org/x/crypto/openpgp/packet/ocfb.go
rename to .ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/packet/ocfb.go
index ce2a33a547c..4f26d0a00b7 100644
--- a/.ci/providerlint/vendor/golang.org/x/crypto/openpgp/packet/ocfb.go
+++ b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/packet/ocfb.go
@@ -85,8 +85,7 @@ type ocfbDecrypter struct {
 // NewOCFBDecrypter returns a cipher.Stream which decrypts data with OpenPGP's
 // cipher feedback mode using the given cipher.Block. Prefix must be the first
 // blockSize + 2 bytes of the ciphertext, where blockSize is the cipher.Block's
-// block size. If an incorrect key is detected then nil is returned. On
-// successful exit, blockSize+2 bytes of decrypted data are written into
+// block size. On successful exit, blockSize+2 bytes of decrypted data are written into
 // prefix. Resync determines if the "resynchronization step" from RFC 4880,
 // 13.9 step 7 is performed. Different parts of OpenPGP vary on this point.
 func NewOCFBDecrypter(block cipher.Block, prefix []byte, resync OCFBResyncOption) cipher.Stream {
@@ -112,11 +111,6 @@ func NewOCFBDecrypter(block cipher.Block, prefix []byte, resync OCFBResyncOption
 	prefixCopy[blockSize] ^= x.fre[0]
 	prefixCopy[blockSize+1] ^= x.fre[1]
 
-	if prefixCopy[blockSize-2] != prefixCopy[blockSize] ||
-		prefixCopy[blockSize-1] != prefixCopy[blockSize+1] {
-		return nil
-	}
-
 	if resync {
 		block.Encrypt(x.fre, prefix[2:])
 	} else {
diff --git a/.ci/providerlint/vendor/golang.org/x/crypto/openpgp/packet/one_pass_signature.go b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/packet/one_pass_signature.go
similarity index 87%
rename from .ci/providerlint/vendor/golang.org/x/crypto/openpgp/packet/one_pass_signature.go
rename to .ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/packet/one_pass_signature.go
index 1713503395e..033fb2d7e8c 100644
--- a/.ci/providerlint/vendor/golang.org/x/crypto/openpgp/packet/one_pass_signature.go
+++ b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/packet/one_pass_signature.go
@@ -7,8 +7,8 @@ package packet
 import (
 	"crypto"
 	"encoding/binary"
-	"golang.org/x/crypto/openpgp/errors"
-	"golang.org/x/crypto/openpgp/s2k"
+	"github.com/ProtonMail/go-crypto/openpgp/errors"
+	"github.com/ProtonMail/go-crypto/openpgp/internal/algorithm"
 	"io"
 	"strconv"
 )
@@ -37,7 +37,7 @@ func (ops *OnePassSignature) parse(r io.Reader) (err error) {
 	}
 
 	var ok bool
-	ops.Hash, ok = s2k.HashIdToHash(buf[2])
+	ops.Hash, ok = algorithm.HashIdToHashWithSha1(buf[2])
 	if !ok {
 		return errors.UnsupportedError("hash function: " + strconv.Itoa(int(buf[2])))
 	}
@@ -55,7 +55,7 @@ func (ops *OnePassSignature) Serialize(w io.Writer) error {
 	buf[0] = onePassSignatureVersion
 	buf[1] = uint8(ops.SigType)
 	var ok bool
-	buf[2], ok = s2k.HashToHashId(ops.Hash)
+	buf[2], ok = algorithm.HashToHashIdWithSha1(ops.Hash)
 	if !ok {
 		return errors.UnsupportedError("hash type: " + strconv.Itoa(int(ops.Hash)))
 	}
diff --git a/.ci/providerlint/vendor/golang.org/x/crypto/openpgp/packet/opaque.go b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/packet/opaque.go
similarity index 89%
rename from .ci/providerlint/vendor/golang.org/x/crypto/openpgp/packet/opaque.go
rename to .ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/packet/opaque.go
index 3984477310f..4f8204079f2 100644
--- a/.ci/providerlint/vendor/golang.org/x/crypto/openpgp/packet/opaque.go
+++ b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/packet/opaque.go
@@ -7,8 +7,9 @@ package packet
 import (
 	"bytes"
 	"io"
+	"io/ioutil"
 
-	"golang.org/x/crypto/openpgp/errors"
+	"github.com/ProtonMail/go-crypto/openpgp/errors"
 )
 
 // OpaquePacket represents an OpenPGP packet as raw, unparsed data. This is
@@ -25,7 +26,7 @@ type OpaquePacket struct {
 }
 
 func (op *OpaquePacket) parse(r io.Reader) (err error) {
-	op.Contents, err = io.ReadAll(r)
+	op.Contents, err = ioutil.ReadAll(r)
 	return
 }
 
@@ -83,8 +84,9 @@ func (or *OpaqueReader) Next() (op *OpaquePacket, err error) {
 // OpaqueSubpacket represents an unparsed OpenPGP subpacket,
 // as found in signature and user attribute packets.
 type OpaqueSubpacket struct {
-	SubType  uint8
-	Contents []byte
+	SubType       uint8
+	EncodedLength []byte // Store the original encoded length for signature verifications.
+	Contents      []byte
 }
 
 // OpaqueSubpackets extracts opaque, unparsed OpenPGP subpackets from
@@ -108,6 +110,7 @@ func OpaqueSubpackets(contents []byte) (result []*OpaqueSubpacket, err error) {
 func nextSubpacket(contents []byte) (subHeaderLen int, subPacket *OpaqueSubpacket, err error) {
 	// RFC 4880, section 5.2.3.1
 	var subLen uint32
+	var encodedLength []byte
 	if len(contents) < 1 {
 		goto Truncated
 	}
@@ -118,6 +121,7 @@ func nextSubpacket(contents []byte) (subHeaderLen int, subPacket *OpaqueSubpacke
 		if len(contents) < subHeaderLen {
 			goto Truncated
 		}
+		encodedLength = contents[0:1]
 		subLen = uint32(contents[0])
 		contents = contents[1:]
 	case contents[0] < 255:
@@ -125,6 +129,7 @@ func nextSubpacket(contents []byte) (subHeaderLen int, subPacket *OpaqueSubpacke
 		if len(contents) < subHeaderLen {
 			goto Truncated
 		}
+		encodedLength = contents[0:2]
 		subLen = uint32(contents[0]-192)<<8 + uint32(contents[1]) + 192
 		contents = contents[2:]
 	default:
@@ -132,16 +137,19 @@ func nextSubpacket(contents []byte) (subHeaderLen int, subPacket *OpaqueSubpacke
 		if len(contents) < subHeaderLen {
 			goto Truncated
 		}
+		encodedLength = contents[0:5]
 		subLen = uint32(contents[1])<<24 |
 			uint32(contents[2])<<16 |
 			uint32(contents[3])<<8 |
 			uint32(contents[4])
 		contents = contents[5:]
+
 	}
 	if subLen > uint32(len(contents)) || subLen == 0 {
 		goto Truncated
 	}
 	subPacket.SubType = contents[0]
+	subPacket.EncodedLength = encodedLength
 	subPacket.Contents = contents[1:subLen]
 	return
 Truncated:
@@ -151,7 +159,9 @@ Truncated:
 
 func (osp *OpaqueSubpacket) Serialize(w io.Writer) (err error) {
 	buf := make([]byte, 6)
-	n := serializeSubpacketLength(buf, len(osp.Contents)+1)
+	copy(buf, osp.EncodedLength)
+	n := len(osp.EncodedLength)
+
 	buf[n] = osp.SubType
 	if _, err = w.Write(buf[:n+1]); err != nil {
 		return
diff --git a/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/packet/packet.go b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/packet/packet.go
new file mode 100644
index 00000000000..4d86a7da826
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/packet/packet.go
@@ -0,0 +1,551 @@
+// Copyright 2011 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// Package packet implements parsing and serialization of OpenPGP packets, as
+// specified in RFC 4880.
+package packet // import "github.com/ProtonMail/go-crypto/openpgp/packet"
+
+import (
+	"bytes"
+	"crypto/cipher"
+	"crypto/rsa"
+	"io"
+
+	"github.com/ProtonMail/go-crypto/openpgp/errors"
+	"github.com/ProtonMail/go-crypto/openpgp/internal/algorithm"
+)
+
+// readFull is the same as io.ReadFull except that reading zero bytes returns
+// ErrUnexpectedEOF rather than EOF.
+func readFull(r io.Reader, buf []byte) (n int, err error) {
+	n, err = io.ReadFull(r, buf)
+	if err == io.EOF {
+		err = io.ErrUnexpectedEOF
+	}
+	return
+}
+
+// readLength reads an OpenPGP length from r. See RFC 4880, section 4.2.2.
+func readLength(r io.Reader) (length int64, isPartial bool, err error) {
+	var buf [4]byte
+	_, err = readFull(r, buf[:1])
+	if err != nil {
+		return
+	}
+	switch {
+	case buf[0] < 192:
+		length = int64(buf[0])
+	case buf[0] < 224:
+		length = int64(buf[0]-192) << 8
+		_, err = readFull(r, buf[0:1])
+		if err != nil {
+			return
+		}
+		length += int64(buf[0]) + 192
+	case buf[0] < 255:
+		length = int64(1) << (buf[0] & 0x1f)
+		isPartial = true
+	default:
+		_, err = readFull(r, buf[0:4])
+		if err != nil {
+			return
+		}
+		length = int64(buf[0])<<24 |
+			int64(buf[1])<<16 |
+			int64(buf[2])<<8 |
+			int64(buf[3])
+	}
+	return
+}
+
+// partialLengthReader wraps an io.Reader and handles OpenPGP partial lengths.
+// The continuation lengths are parsed and removed from the stream and EOF is
+// returned at the end of the packet. See RFC 4880, section 4.2.2.4.
+type partialLengthReader struct {
+	r         io.Reader
+	remaining int64
+	isPartial bool
+}
+
+func (r *partialLengthReader) Read(p []byte) (n int, err error) {
+	for r.remaining == 0 {
+		if !r.isPartial {
+			return 0, io.EOF
+		}
+		r.remaining, r.isPartial, err = readLength(r.r)
+		if err != nil {
+			return 0, err
+		}
+	}
+
+	toRead := int64(len(p))
+	if toRead > r.remaining {
+		toRead = r.remaining
+	}
+
+	n, err = r.r.Read(p[:int(toRead)])
+	r.remaining -= int64(n)
+	if n < int(toRead) && err == io.EOF {
+		err = io.ErrUnexpectedEOF
+	}
+	return
+}
+
+// partialLengthWriter writes a stream of data using OpenPGP partial lengths.
+// See RFC 4880, section 4.2.2.4.
+type partialLengthWriter struct {
+	w          io.WriteCloser
+	buf        bytes.Buffer
+	lengthByte [1]byte
+}
+
+func (w *partialLengthWriter) Write(p []byte) (n int, err error) {
+	bufLen := w.buf.Len()
+	if bufLen > 512 {
+		for power := uint(30); ; power-- {
+			l := 1 << power
+			if bufLen >= l {
+				w.lengthByte[0] = 224 + uint8(power)
+				_, err = w.w.Write(w.lengthByte[:])
+				if err != nil {
+					return
+				}
+				var m int
+				m, err = w.w.Write(w.buf.Next(l))
+				if err != nil {
+					return
+				}
+				if m != l {
+					return 0, io.ErrShortWrite
+				}
+				break
+			}
+		}
+	}
+	return w.buf.Write(p)
+}
+
+func (w *partialLengthWriter) Close() (err error) {
+	len := w.buf.Len()
+	err = serializeLength(w.w, len)
+	if err != nil {
+		return err
+	}
+	_, err = w.buf.WriteTo(w.w)
+	if err != nil {
+		return err
+	}
+	return w.w.Close()
+}
+
+// A spanReader is an io.LimitReader, but it returns ErrUnexpectedEOF if the
+// underlying Reader returns EOF before the limit has been reached.
+type spanReader struct {
+	r io.Reader
+	n int64
+}
+
+func (l *spanReader) Read(p []byte) (n int, err error) {
+	if l.n <= 0 {
+		return 0, io.EOF
+	}
+	if int64(len(p)) > l.n {
+		p = p[0:l.n]
+	}
+	n, err = l.r.Read(p)
+	l.n -= int64(n)
+	if l.n > 0 && err == io.EOF {
+		err = io.ErrUnexpectedEOF
+	}
+	return
+}
+
+// readHeader parses a packet header and returns an io.Reader which will return
+// the contents of the packet. See RFC 4880, section 4.2.
+func readHeader(r io.Reader) (tag packetType, length int64, contents io.Reader, err error) {
+	var buf [4]byte
+	_, err = io.ReadFull(r, buf[:1])
+	if err != nil {
+		return
+	}
+	if buf[0]&0x80 == 0 {
+		err = errors.StructuralError("tag byte does not have MSB set")
+		return
+	}
+	if buf[0]&0x40 == 0 {
+		// Old format packet
+		tag = packetType((buf[0] & 0x3f) >> 2)
+		lengthType := buf[0] & 3
+		if lengthType == 3 {
+			length = -1
+			contents = r
+			return
+		}
+		lengthBytes := 1 << lengthType
+		_, err = readFull(r, buf[0:lengthBytes])
+		if err != nil {
+			return
+		}
+		for i := 0; i < lengthBytes; i++ {
+			length <<= 8
+			length |= int64(buf[i])
+		}
+		contents = &spanReader{r, length}
+		return
+	}
+
+	// New format packet
+	tag = packetType(buf[0] & 0x3f)
+	length, isPartial, err := readLength(r)
+	if err != nil {
+		return
+	}
+	if isPartial {
+		contents = &partialLengthReader{
+			remaining: length,
+			isPartial: true,
+			r:         r,
+		}
+		length = -1
+	} else {
+		contents = &spanReader{r, length}
+	}
+	return
+}
+
+// serializeHeader writes an OpenPGP packet header to w. See RFC 4880, section
+// 4.2.
+func serializeHeader(w io.Writer, ptype packetType, length int) (err error) {
+	err = serializeType(w, ptype)
+	if err != nil {
+		return
+	}
+	return serializeLength(w, length)
+}
+
+// serializeType writes an OpenPGP packet type to w. See RFC 4880, section
+// 4.2.
+func serializeType(w io.Writer, ptype packetType) (err error) {
+	var buf [1]byte
+	buf[0] = 0x80 | 0x40 | byte(ptype)
+	_, err = w.Write(buf[:])
+	return
+}
+
+// serializeLength writes an OpenPGP packet length to w. See RFC 4880, section
+// 4.2.2.
+func serializeLength(w io.Writer, length int) (err error) {
+	var buf [5]byte
+	var n int
+
+	if length < 192 {
+		buf[0] = byte(length)
+		n = 1
+	} else if length < 8384 {
+		length -= 192
+		buf[0] = 192 + byte(length>>8)
+		buf[1] = byte(length)
+		n = 2
+	} else {
+		buf[0] = 255
+		buf[1] = byte(length >> 24)
+		buf[2] = byte(length >> 16)
+		buf[3] = byte(length >> 8)
+		buf[4] = byte(length)
+		n = 5
+	}
+
+	_, err = w.Write(buf[:n])
+	return
+}
+
+// serializeStreamHeader writes an OpenPGP packet header to w where the
+// length of the packet is unknown. It returns a io.WriteCloser which can be
+// used to write the contents of the packet. See RFC 4880, section 4.2.
+func serializeStreamHeader(w io.WriteCloser, ptype packetType) (out io.WriteCloser, err error) {
+	err = serializeType(w, ptype)
+	if err != nil {
+		return
+	}
+	out = &partialLengthWriter{w: w}
+	return
+}
+
+// Packet represents an OpenPGP packet. Users are expected to try casting
+// instances of this interface to specific packet types.
+type Packet interface {
+	parse(io.Reader) error
+}
+
+// consumeAll reads from the given Reader until error, returning the number of
+// bytes read.
+func consumeAll(r io.Reader) (n int64, err error) {
+	var m int
+	var buf [1024]byte
+
+	for {
+		m, err = r.Read(buf[:])
+		n += int64(m)
+		if err == io.EOF {
+			err = nil
+			return
+		}
+		if err != nil {
+			return
+		}
+	}
+}
+
+// packetType represents the numeric ids of the different OpenPGP packet types. See
+// http://www.iana.org/assignments/pgp-parameters/pgp-parameters.xhtml#pgp-parameters-2
+type packetType uint8
+
+const (
+	packetTypeEncryptedKey                             packetType = 1
+	packetTypeSignature                                packetType = 2
+	packetTypeSymmetricKeyEncrypted                    packetType = 3
+	packetTypeOnePassSignature                         packetType = 4
+	packetTypePrivateKey                               packetType = 5
+	packetTypePublicKey                                packetType = 6
+	packetTypePrivateSubkey                            packetType = 7
+	packetTypeCompressed                               packetType = 8
+	packetTypeSymmetricallyEncrypted                   packetType = 9
+	packetTypeLiteralData                              packetType = 11
+	packetTypeUserId                                   packetType = 13
+	packetTypePublicSubkey                             packetType = 14
+	packetTypeUserAttribute                            packetType = 17
+	packetTypeSymmetricallyEncryptedIntegrityProtected packetType = 18
+	packetTypeAEADEncrypted                            packetType = 20
+)
+
+// EncryptedDataPacket holds encrypted data. It is currently implemented by
+// SymmetricallyEncrypted and AEADEncrypted.
+type EncryptedDataPacket interface {
+	Decrypt(CipherFunction, []byte) (io.ReadCloser, error)
+}
+
+// Read reads a single OpenPGP packet from the given io.Reader. If there is an
+// error parsing a packet, the whole packet is consumed from the input.
+func Read(r io.Reader) (p Packet, err error) {
+	tag, _, contents, err := readHeader(r)
+	if err != nil {
+		return
+	}
+
+	switch tag {
+	case packetTypeEncryptedKey:
+		p = new(EncryptedKey)
+	case packetTypeSignature:
+		p = new(Signature)
+	case packetTypeSymmetricKeyEncrypted:
+		p = new(SymmetricKeyEncrypted)
+	case packetTypeOnePassSignature:
+		p = new(OnePassSignature)
+	case packetTypePrivateKey, packetTypePrivateSubkey:
+		pk := new(PrivateKey)
+		if tag == packetTypePrivateSubkey {
+			pk.IsSubkey = true
+		}
+		p = pk
+	case packetTypePublicKey, packetTypePublicSubkey:
+		isSubkey := tag == packetTypePublicSubkey
+		p = &PublicKey{IsSubkey: isSubkey}
+	case packetTypeCompressed:
+		p = new(Compressed)
+	case packetTypeSymmetricallyEncrypted:
+		p = new(SymmetricallyEncrypted)
+	case packetTypeLiteralData:
+		p = new(LiteralData)
+	case packetTypeUserId:
+		p = new(UserId)
+	case packetTypeUserAttribute:
+		p = new(UserAttribute)
+	case packetTypeSymmetricallyEncryptedIntegrityProtected:
+		se := new(SymmetricallyEncrypted)
+		se.IntegrityProtected = true
+		p = se
+	case packetTypeAEADEncrypted:
+		p = new(AEADEncrypted)
+	default:
+		err = errors.UnknownPacketTypeError(tag)
+	}
+	if p != nil {
+		err = p.parse(contents)
+	}
+	if err != nil {
+		consumeAll(contents)
+	}
+	return
+}
+
+// SignatureType represents the different semantic meanings of an OpenPGP
+// signature. See RFC 4880, section 5.2.1.
+type SignatureType uint8
+
+const (
+	SigTypeBinary                  SignatureType = 0x00
+	SigTypeText                                  = 0x01
+	SigTypeGenericCert                           = 0x10
+	SigTypePersonaCert                           = 0x11
+	SigTypeCasualCert                            = 0x12
+	SigTypePositiveCert                          = 0x13
+	SigTypeSubkeyBinding                         = 0x18
+	SigTypePrimaryKeyBinding                     = 0x19
+	SigTypeDirectSignature                       = 0x1F
+	SigTypeKeyRevocation                         = 0x20
+	SigTypeSubkeyRevocation                      = 0x28
+	SigTypeCertificationRevocation               = 0x30
+)
+
+// PublicKeyAlgorithm represents the different public key system specified for
+// OpenPGP. See
+// http://www.iana.org/assignments/pgp-parameters/pgp-parameters.xhtml#pgp-parameters-12
+type PublicKeyAlgorithm uint8
+
+const (
+	PubKeyAlgoRSA     PublicKeyAlgorithm = 1
+	PubKeyAlgoElGamal PublicKeyAlgorithm = 16
+	PubKeyAlgoDSA     PublicKeyAlgorithm = 17
+	// RFC 6637, Section 5.
+	PubKeyAlgoECDH  PublicKeyAlgorithm = 18
+	PubKeyAlgoECDSA PublicKeyAlgorithm = 19
+	// https://www.ietf.org/archive/id/draft-koch-eddsa-for-openpgp-04.txt
+	PubKeyAlgoEdDSA PublicKeyAlgorithm = 22
+
+	// Deprecated in RFC 4880, Section 13.5. Use key flags instead.
+	PubKeyAlgoRSAEncryptOnly PublicKeyAlgorithm = 2
+	PubKeyAlgoRSASignOnly    PublicKeyAlgorithm = 3
+)
+
+// CanEncrypt returns true if it's possible to encrypt a message to a public
+// key of the given type.
+func (pka PublicKeyAlgorithm) CanEncrypt() bool {
+	switch pka {
+	case PubKeyAlgoRSA, PubKeyAlgoRSAEncryptOnly, PubKeyAlgoElGamal, PubKeyAlgoECDH:
+		return true
+	}
+	return false
+}
+
+// CanSign returns true if it's possible for a public key of the given type to
+// sign a message.
+func (pka PublicKeyAlgorithm) CanSign() bool {
+	switch pka {
+	case PubKeyAlgoRSA, PubKeyAlgoRSASignOnly, PubKeyAlgoDSA, PubKeyAlgoECDSA, PubKeyAlgoEdDSA:
+		return true
+	}
+	return false
+}
+
+// CipherFunction represents the different block ciphers specified for OpenPGP. See
+// http://www.iana.org/assignments/pgp-parameters/pgp-parameters.xhtml#pgp-parameters-13
+type CipherFunction algorithm.CipherFunction
+
+const (
+	Cipher3DES   CipherFunction = 2
+	CipherCAST5  CipherFunction = 3
+	CipherAES128 CipherFunction = 7
+	CipherAES192 CipherFunction = 8
+	CipherAES256 CipherFunction = 9
+)
+
+// KeySize returns the key size, in bytes, of cipher.
+func (cipher CipherFunction) KeySize() int {
+	return algorithm.CipherFunction(cipher).KeySize()
+}
+
+// IsSupported returns true if the cipher is supported from the library
+func (cipher CipherFunction) IsSupported() bool {
+	return algorithm.CipherFunction(cipher).KeySize() > 0
+}
+
+// blockSize returns the block size, in bytes, of cipher.
+func (cipher CipherFunction) blockSize() int {
+	return algorithm.CipherFunction(cipher).BlockSize()
+}
+
+// new returns a fresh instance of the given cipher.
+func (cipher CipherFunction) new(key []byte) (block cipher.Block) {
+	return algorithm.CipherFunction(cipher).New(key)
+}
+
+// padToKeySize left-pads a MPI with zeroes to match the length of the
+// specified RSA public.
+func padToKeySize(pub *rsa.PublicKey, b []byte) []byte {
+	k := (pub.N.BitLen() + 7) / 8
+	if len(b) >= k {
+		return b
+	}
+	bb := make([]byte, k)
+	copy(bb[len(bb)-len(b):], b)
+	return bb
+}
+
+// CompressionAlgo Represents the different compression algorithms
+// supported by OpenPGP (except for BZIP2, which is not currently
+// supported). See Section 9.3 of RFC 4880.
+type CompressionAlgo uint8
+
+const (
+	CompressionNone CompressionAlgo = 0
+	CompressionZIP  CompressionAlgo = 1
+	CompressionZLIB CompressionAlgo = 2
+)
+
+// AEADMode represents the different Authenticated Encryption with Associated
+// Data specified for OpenPGP.
+// See https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-07.html#section-9.6
+type AEADMode algorithm.AEADMode
+
+const (
+	AEADModeEAX AEADMode = 1
+	AEADModeOCB AEADMode = 2
+	AEADModeGCM AEADMode = 3
+)
+
+func (mode AEADMode) IvLength() int {
+	return algorithm.AEADMode(mode).NonceLength()
+}
+
+func (mode AEADMode) TagLength() int {
+	return algorithm.AEADMode(mode).TagLength()
+}
+
+// new returns a fresh instance of the given mode.
+func (mode AEADMode) new(block cipher.Block) cipher.AEAD {
+	return algorithm.AEADMode(mode).New(block)
+}
+
+// ReasonForRevocation represents a revocation reason code as per RFC4880
+// section 5.2.3.23.
+type ReasonForRevocation uint8
+
+const (
+	NoReason       ReasonForRevocation = 0
+	KeySuperseded  ReasonForRevocation = 1
+	KeyCompromised ReasonForRevocation = 2
+	KeyRetired     ReasonForRevocation = 3
+)
+
+// Curve is a mapping to supported ECC curves for key generation.
+// See https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-06.html#name-curve-specific-wire-formats
+type Curve string
+
+const (
+	Curve25519         Curve = "Curve25519"
+	Curve448           Curve = "Curve448"
+	CurveNistP256      Curve = "P256"
+	CurveNistP384      Curve = "P384"
+	CurveNistP521      Curve = "P521"
+	CurveSecP256k1     Curve = "SecP256k1"
+	CurveBrainpoolP256 Curve = "BrainpoolP256"
+	CurveBrainpoolP384 Curve = "BrainpoolP384"
+	CurveBrainpoolP512 Curve = "BrainpoolP512"
+)
+
+// TrustLevel represents a trust level per RFC4880 5.2.3.13
+type TrustLevel uint8
+
+// TrustAmount represents a trust amount per RFC4880 5.2.3.13
+type TrustAmount uint8
diff --git a/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/packet/private_key.go b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/packet/private_key.go
new file mode 100644
index 00000000000..2fc4386437c
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/packet/private_key.go
@@ -0,0 +1,837 @@
+// Copyright 2011 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package packet
+
+import (
+	"bytes"
+	"crypto"
+	"crypto/cipher"
+	"crypto/dsa"
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/sha1"
+	"io"
+	"io/ioutil"
+	"math/big"
+	"strconv"
+	"time"
+
+	"github.com/ProtonMail/go-crypto/openpgp/ecdh"
+	"github.com/ProtonMail/go-crypto/openpgp/ecdsa"
+	"github.com/ProtonMail/go-crypto/openpgp/eddsa"
+	"github.com/ProtonMail/go-crypto/openpgp/elgamal"
+	"github.com/ProtonMail/go-crypto/openpgp/errors"
+	"github.com/ProtonMail/go-crypto/openpgp/internal/encoding"
+	"github.com/ProtonMail/go-crypto/openpgp/s2k"
+)
+
+// PrivateKey represents a possibly encrypted private key. See RFC 4880,
+// section 5.5.3.
+type PrivateKey struct {
+	PublicKey
+	Encrypted     bool // if true then the private key is unavailable until Decrypt has been called.
+	encryptedData []byte
+	cipher        CipherFunction
+	s2k           func(out, in []byte)
+	// An *{rsa|dsa|elgamal|ecdh|ecdsa|ed25519}.PrivateKey or
+	// crypto.Signer/crypto.Decrypter (Decryptor RSA only).
+	PrivateKey   interface{}
+	sha1Checksum bool
+	iv           []byte
+
+	// Type of encryption of the S2K packet
+	// Allowed values are 0 (Not encrypted), 254 (SHA1), or
+	// 255 (2-byte checksum)
+	s2kType S2KType
+	// Full parameters of the S2K packet
+	s2kParams *s2k.Params
+}
+
+// S2KType s2k packet type
+type S2KType uint8
+
+const (
+	// S2KNON unencrypt
+	S2KNON S2KType = 0
+	// S2KSHA1 sha1 sum check
+	S2KSHA1 S2KType = 254
+	// S2KCHECKSUM sum check
+	S2KCHECKSUM S2KType = 255
+)
+
+func NewRSAPrivateKey(creationTime time.Time, priv *rsa.PrivateKey) *PrivateKey {
+	pk := new(PrivateKey)
+	pk.PublicKey = *NewRSAPublicKey(creationTime, &priv.PublicKey)
+	pk.PrivateKey = priv
+	return pk
+}
+
+func NewDSAPrivateKey(creationTime time.Time, priv *dsa.PrivateKey) *PrivateKey {
+	pk := new(PrivateKey)
+	pk.PublicKey = *NewDSAPublicKey(creationTime, &priv.PublicKey)
+	pk.PrivateKey = priv
+	return pk
+}
+
+func NewElGamalPrivateKey(creationTime time.Time, priv *elgamal.PrivateKey) *PrivateKey {
+	pk := new(PrivateKey)
+	pk.PublicKey = *NewElGamalPublicKey(creationTime, &priv.PublicKey)
+	pk.PrivateKey = priv
+	return pk
+}
+
+func NewECDSAPrivateKey(creationTime time.Time, priv *ecdsa.PrivateKey) *PrivateKey {
+	pk := new(PrivateKey)
+	pk.PublicKey = *NewECDSAPublicKey(creationTime, &priv.PublicKey)
+	pk.PrivateKey = priv
+	return pk
+}
+
+func NewEdDSAPrivateKey(creationTime time.Time, priv *eddsa.PrivateKey) *PrivateKey {
+	pk := new(PrivateKey)
+	pk.PublicKey = *NewEdDSAPublicKey(creationTime, &priv.PublicKey)
+	pk.PrivateKey = priv
+	return pk
+}
+
+func NewECDHPrivateKey(creationTime time.Time, priv *ecdh.PrivateKey) *PrivateKey {
+	pk := new(PrivateKey)
+	pk.PublicKey = *NewECDHPublicKey(creationTime, &priv.PublicKey)
+	pk.PrivateKey = priv
+	return pk
+}
+
+// NewSignerPrivateKey creates a PrivateKey from a crypto.Signer that
+// implements RSA, ECDSA or EdDSA.
+func NewSignerPrivateKey(creationTime time.Time, signer interface{}) *PrivateKey {
+	pk := new(PrivateKey)
+	// In general, the public Keys should be used as pointers. We still
+	// type-switch on the values, for backwards-compatibility.
+	switch pubkey := signer.(type) {
+	case *rsa.PrivateKey:
+		pk.PublicKey = *NewRSAPublicKey(creationTime, &pubkey.PublicKey)
+	case rsa.PrivateKey:
+		pk.PublicKey = *NewRSAPublicKey(creationTime, &pubkey.PublicKey)
+	case *ecdsa.PrivateKey:
+		pk.PublicKey = *NewECDSAPublicKey(creationTime, &pubkey.PublicKey)
+	case ecdsa.PrivateKey:
+		pk.PublicKey = *NewECDSAPublicKey(creationTime, &pubkey.PublicKey)
+	case *eddsa.PrivateKey:
+		pk.PublicKey = *NewEdDSAPublicKey(creationTime, &pubkey.PublicKey)
+	case eddsa.PrivateKey:
+		pk.PublicKey = *NewEdDSAPublicKey(creationTime, &pubkey.PublicKey)
+	default:
+		panic("openpgp: unknown signer type in NewSignerPrivateKey")
+	}
+	pk.PrivateKey = signer
+	return pk
+}
+
+// NewDecrypterPrivateKey creates a PrivateKey from a *{rsa|elgamal|ecdh}.PrivateKey.
+func NewDecrypterPrivateKey(creationTime time.Time, decrypter interface{}) *PrivateKey {
+	pk := new(PrivateKey)
+	switch priv := decrypter.(type) {
+	case *rsa.PrivateKey:
+		pk.PublicKey = *NewRSAPublicKey(creationTime, &priv.PublicKey)
+	case *elgamal.PrivateKey:
+		pk.PublicKey = *NewElGamalPublicKey(creationTime, &priv.PublicKey)
+	case *ecdh.PrivateKey:
+		pk.PublicKey = *NewECDHPublicKey(creationTime, &priv.PublicKey)
+	default:
+		panic("openpgp: unknown decrypter type in NewDecrypterPrivateKey")
+	}
+	pk.PrivateKey = decrypter
+	return pk
+}
+
+func (pk *PrivateKey) parse(r io.Reader) (err error) {
+	err = (&pk.PublicKey).parse(r)
+	if err != nil {
+		return
+	}
+	v5 := pk.PublicKey.Version == 5
+
+	var buf [1]byte
+	_, err = readFull(r, buf[:])
+	if err != nil {
+		return
+	}
+	pk.s2kType = S2KType(buf[0])
+	var optCount [1]byte
+	if v5 {
+		if _, err = readFull(r, optCount[:]); err != nil {
+			return
+		}
+	}
+
+	switch pk.s2kType {
+	case S2KNON:
+		pk.s2k = nil
+		pk.Encrypted = false
+	case S2KSHA1, S2KCHECKSUM:
+		if v5 && pk.s2kType == S2KCHECKSUM {
+			return errors.StructuralError("wrong s2k identifier for version 5")
+		}
+		_, err = readFull(r, buf[:])
+		if err != nil {
+			return
+		}
+		pk.cipher = CipherFunction(buf[0])
+		if pk.cipher != 0 && !pk.cipher.IsSupported() {
+			return errors.UnsupportedError("unsupported cipher function in private key")
+		}
+		pk.s2kParams, err = s2k.ParseIntoParams(r)
+		if err != nil {
+			return
+		}
+		if pk.s2kParams.Dummy() {
+			return
+		}
+		pk.s2k, err = pk.s2kParams.Function()
+		if err != nil {
+			return
+		}
+		pk.Encrypted = true
+		if pk.s2kType == S2KSHA1 {
+			pk.sha1Checksum = true
+		}
+	default:
+		return errors.UnsupportedError("deprecated s2k function in private key")
+	}
+
+	if pk.Encrypted {
+		blockSize := pk.cipher.blockSize()
+		if blockSize == 0 {
+			return errors.UnsupportedError("unsupported cipher in private key: " + strconv.Itoa(int(pk.cipher)))
+		}
+		pk.iv = make([]byte, blockSize)
+		_, err = readFull(r, pk.iv)
+		if err != nil {
+			return
+		}
+	}
+
+	var privateKeyData []byte
+	if v5 {
+		var n [4]byte /* secret material four octet count */
+		_, err = readFull(r, n[:])
+		if err != nil {
+			return
+		}
+		count := uint32(uint32(n[0])<<24 | uint32(n[1])<<16 | uint32(n[2])<<8 | uint32(n[3]))
+		if !pk.Encrypted {
+			count = count + 2 /* two octet checksum */
+		}
+		privateKeyData = make([]byte, count)
+		_, err = readFull(r, privateKeyData)
+		if err != nil {
+			return
+		}
+	} else {
+		privateKeyData, err = ioutil.ReadAll(r)
+		if err != nil {
+			return
+		}
+	}
+	if !pk.Encrypted {
+		if len(privateKeyData) < 2 {
+			return errors.StructuralError("truncated private key data")
+		}
+		var sum uint16
+		for i := 0; i < len(privateKeyData)-2; i++ {
+			sum += uint16(privateKeyData[i])
+		}
+		if privateKeyData[len(privateKeyData)-2] != uint8(sum>>8) ||
+			privateKeyData[len(privateKeyData)-1] != uint8(sum) {
+			return errors.StructuralError("private key checksum failure")
+		}
+		privateKeyData = privateKeyData[:len(privateKeyData)-2]
+		return pk.parsePrivateKey(privateKeyData)
+	}
+
+	pk.encryptedData = privateKeyData
+	return
+}
+
+// Dummy returns true if the private key is a dummy key. This is a GNU extension.
+func (pk *PrivateKey) Dummy() bool {
+	return pk.s2kParams.Dummy()
+}
+
+func mod64kHash(d []byte) uint16 {
+	var h uint16
+	for _, b := range d {
+		h += uint16(b)
+	}
+	return h
+}
+
+func (pk *PrivateKey) Serialize(w io.Writer) (err error) {
+	contents := bytes.NewBuffer(nil)
+	err = pk.PublicKey.serializeWithoutHeaders(contents)
+	if err != nil {
+		return
+	}
+	if _, err = contents.Write([]byte{uint8(pk.s2kType)}); err != nil {
+		return
+	}
+
+	optional := bytes.NewBuffer(nil)
+	if pk.Encrypted || pk.Dummy() {
+		optional.Write([]byte{uint8(pk.cipher)})
+		if err := pk.s2kParams.Serialize(optional); err != nil {
+			return err
+		}
+		if pk.Encrypted {
+			optional.Write(pk.iv)
+		}
+	}
+	if pk.Version == 5 {
+		contents.Write([]byte{uint8(optional.Len())})
+	}
+	io.Copy(contents, optional)
+
+	if !pk.Dummy() {
+		l := 0
+		var priv []byte
+		if !pk.Encrypted {
+			buf := bytes.NewBuffer(nil)
+			err = pk.serializePrivateKey(buf)
+			if err != nil {
+				return err
+			}
+			l = buf.Len()
+			checksum := mod64kHash(buf.Bytes())
+			buf.Write([]byte{byte(checksum >> 8), byte(checksum)})
+			priv = buf.Bytes()
+		} else {
+			priv, l = pk.encryptedData, len(pk.encryptedData)
+		}
+
+		if pk.Version == 5 {
+			contents.Write([]byte{byte(l >> 24), byte(l >> 16), byte(l >> 8), byte(l)})
+		}
+		contents.Write(priv)
+	}
+
+	ptype := packetTypePrivateKey
+	if pk.IsSubkey {
+		ptype = packetTypePrivateSubkey
+	}
+	err = serializeHeader(w, ptype, contents.Len())
+	if err != nil {
+		return
+	}
+	_, err = io.Copy(w, contents)
+	if err != nil {
+		return
+	}
+	return
+}
+
+func serializeRSAPrivateKey(w io.Writer, priv *rsa.PrivateKey) error {
+	if _, err := w.Write(new(encoding.MPI).SetBig(priv.D).EncodedBytes()); err != nil {
+		return err
+	}
+	if _, err := w.Write(new(encoding.MPI).SetBig(priv.Primes[1]).EncodedBytes()); err != nil {
+		return err
+	}
+	if _, err := w.Write(new(encoding.MPI).SetBig(priv.Primes[0]).EncodedBytes()); err != nil {
+		return err
+	}
+	_, err := w.Write(new(encoding.MPI).SetBig(priv.Precomputed.Qinv).EncodedBytes())
+	return err
+}
+
+func serializeDSAPrivateKey(w io.Writer, priv *dsa.PrivateKey) error {
+	_, err := w.Write(new(encoding.MPI).SetBig(priv.X).EncodedBytes())
+	return err
+}
+
+func serializeElGamalPrivateKey(w io.Writer, priv *elgamal.PrivateKey) error {
+	_, err := w.Write(new(encoding.MPI).SetBig(priv.X).EncodedBytes())
+	return err
+}
+
+func serializeECDSAPrivateKey(w io.Writer, priv *ecdsa.PrivateKey) error {
+	_, err := w.Write(encoding.NewMPI(priv.MarshalIntegerSecret()).EncodedBytes())
+	return err
+}
+
+func serializeEdDSAPrivateKey(w io.Writer, priv *eddsa.PrivateKey) error {
+	_, err := w.Write(encoding.NewMPI(priv.MarshalByteSecret()).EncodedBytes())
+	return err
+}
+
+func serializeECDHPrivateKey(w io.Writer, priv *ecdh.PrivateKey) error {
+	_, err := w.Write(encoding.NewMPI(priv.MarshalByteSecret()).EncodedBytes())
+	return err
+}
+
+// decrypt decrypts an encrypted private key using a decryption key.
+func (pk *PrivateKey) decrypt(decryptionKey []byte) error {
+	if pk.Dummy() {
+		return errors.ErrDummyPrivateKey("dummy key found")
+	}
+	if !pk.Encrypted {
+		return nil
+	}
+
+	block := pk.cipher.new(decryptionKey)
+	cfb := cipher.NewCFBDecrypter(block, pk.iv)
+
+	data := make([]byte, len(pk.encryptedData))
+	cfb.XORKeyStream(data, pk.encryptedData)
+
+	if pk.sha1Checksum {
+		if len(data) < sha1.Size {
+			return errors.StructuralError("truncated private key data")
+		}
+		h := sha1.New()
+		h.Write(data[:len(data)-sha1.Size])
+		sum := h.Sum(nil)
+		if !bytes.Equal(sum, data[len(data)-sha1.Size:]) {
+			return errors.StructuralError("private key checksum failure")
+		}
+		data = data[:len(data)-sha1.Size]
+	} else {
+		if len(data) < 2 {
+			return errors.StructuralError("truncated private key data")
+		}
+		var sum uint16
+		for i := 0; i < len(data)-2; i++ {
+			sum += uint16(data[i])
+		}
+		if data[len(data)-2] != uint8(sum>>8) ||
+			data[len(data)-1] != uint8(sum) {
+			return errors.StructuralError("private key checksum failure")
+		}
+		data = data[:len(data)-2]
+	}
+
+	err := pk.parsePrivateKey(data)
+	if _, ok := err.(errors.KeyInvalidError); ok {
+		return errors.KeyInvalidError("invalid key parameters")
+	}
+	if err != nil {
+		return err
+	}
+
+	// Mark key as unencrypted
+	pk.s2kType = S2KNON
+	pk.s2k = nil
+	pk.Encrypted = false
+	pk.encryptedData = nil
+
+	return nil
+}
+
+func (pk *PrivateKey) decryptWithCache(passphrase []byte, keyCache *s2k.Cache) error {
+	if pk.Dummy() {
+		return errors.ErrDummyPrivateKey("dummy key found")
+	}
+	if !pk.Encrypted {
+		return nil
+	}
+
+	key, err := keyCache.GetOrComputeDerivedKey(passphrase, pk.s2kParams, pk.cipher.KeySize())
+	if err != nil {
+		return err
+	}
+	return pk.decrypt(key)
+}
+
+// Decrypt decrypts an encrypted private key using a passphrase.
+func (pk *PrivateKey) Decrypt(passphrase []byte) error {
+	if pk.Dummy() {
+		return errors.ErrDummyPrivateKey("dummy key found")
+	}
+	if !pk.Encrypted {
+		return nil
+	}
+
+	key := make([]byte, pk.cipher.KeySize())
+	pk.s2k(key, passphrase)
+	return pk.decrypt(key)
+}
+
+// DecryptPrivateKeys decrypts all encrypted keys with the given config and passphrase.
+// Avoids recomputation of similar s2k key derivations. 
+func DecryptPrivateKeys(keys []*PrivateKey, passphrase []byte) error {
+	// Create a cache to avoid recomputation of key derviations for the same passphrase.
+	s2kCache := &s2k.Cache{}
+	for _, key := range keys {
+		if key != nil && !key.Dummy() && key.Encrypted {
+			err := key.decryptWithCache(passphrase, s2kCache)
+			if err != nil {
+				return err
+			}
+		}
+	}
+	return nil
+}
+
+// encrypt encrypts an unencrypted private key.
+func (pk *PrivateKey) encrypt(key []byte, params *s2k.Params, cipherFunction CipherFunction) error {
+	if pk.Dummy() {
+		return errors.ErrDummyPrivateKey("dummy key found")
+	}
+	if pk.Encrypted {
+		return nil
+	}
+	// check if encryptionKey has the correct size
+	if len(key) != cipherFunction.KeySize() {
+		return errors.InvalidArgumentError("supplied encryption key has the wrong size")
+	}
+	
+	priv := bytes.NewBuffer(nil)
+	err := pk.serializePrivateKey(priv)
+	if err != nil {
+		return err
+	}
+
+	pk.cipher = cipherFunction
+	pk.s2kParams = params
+	pk.s2k, err = pk.s2kParams.Function()
+	if err != nil {
+		return err
+	} 
+
+	privateKeyBytes := priv.Bytes()
+	pk.sha1Checksum = true
+	block := pk.cipher.new(key)
+	pk.iv = make([]byte, pk.cipher.blockSize())
+	_, err = rand.Read(pk.iv)
+	if err != nil {
+		return err
+	}
+	cfb := cipher.NewCFBEncrypter(block, pk.iv)
+
+	if pk.sha1Checksum {
+		pk.s2kType = S2KSHA1
+		h := sha1.New()
+		h.Write(privateKeyBytes)
+		sum := h.Sum(nil)
+		privateKeyBytes = append(privateKeyBytes, sum...)
+	} else {
+		pk.s2kType = S2KCHECKSUM
+		var sum uint16
+		for _, b := range privateKeyBytes {
+			sum += uint16(b)
+		}
+		priv.Write([]byte{uint8(sum >> 8), uint8(sum)})
+	}
+
+	pk.encryptedData = make([]byte, len(privateKeyBytes))
+	cfb.XORKeyStream(pk.encryptedData, privateKeyBytes)
+	pk.Encrypted = true
+	pk.PrivateKey = nil
+	return err
+}
+
+// EncryptWithConfig encrypts an unencrypted private key using the passphrase and the config.
+func (pk *PrivateKey) EncryptWithConfig(passphrase []byte, config *Config) error {
+	params, err := s2k.Generate(config.Random(), config.S2K())
+	if err != nil {
+		return err
+	}
+	// Derive an encryption key with the configured s2k function.
+	key := make([]byte, config.Cipher().KeySize())
+	s2k, err := params.Function()
+	if err != nil {
+		return err
+	}
+	s2k(key, passphrase)
+	// Encrypt the private key with the derived encryption key.
+	return pk.encrypt(key, params, config.Cipher())
+}
+
+// EncryptPrivateKeys encrypts all unencrypted keys with the given config and passphrase.
+// Only derives one key from the passphrase, which is then used to encrypt each key.
+func EncryptPrivateKeys(keys []*PrivateKey, passphrase []byte, config *Config) error {
+	params, err := s2k.Generate(config.Random(), config.S2K())
+	if err != nil {
+		return err
+	}
+	// Derive an encryption key with the configured s2k function.
+	encryptionKey := make([]byte, config.Cipher().KeySize())
+	s2k, err := params.Function()
+	if err != nil {
+		return err
+	}
+	s2k(encryptionKey, passphrase)
+	for _, key := range keys {
+		if key != nil && !key.Dummy() && !key.Encrypted {
+			err = key.encrypt(encryptionKey, params, config.Cipher())
+			if err != nil {
+				return err
+			}
+		}
+	}
+	return nil
+}
+
+// Encrypt encrypts an unencrypted private key using a passphrase.
+func (pk *PrivateKey) Encrypt(passphrase []byte) error {
+	// Default config of private key encryption
+	config := &Config{
+		S2KConfig: &s2k.Config{
+			S2KMode:  s2k.IteratedSaltedS2K,
+			S2KCount: 65536,
+			Hash:     crypto.SHA256,
+		} ,
+		DefaultCipher: CipherAES256,
+	}
+	return pk.EncryptWithConfig(passphrase, config)
+}
+
+func (pk *PrivateKey) serializePrivateKey(w io.Writer) (err error) {
+	switch priv := pk.PrivateKey.(type) {
+	case *rsa.PrivateKey:
+		err = serializeRSAPrivateKey(w, priv)
+	case *dsa.PrivateKey:
+		err = serializeDSAPrivateKey(w, priv)
+	case *elgamal.PrivateKey:
+		err = serializeElGamalPrivateKey(w, priv)
+	case *ecdsa.PrivateKey:
+		err = serializeECDSAPrivateKey(w, priv)
+	case *eddsa.PrivateKey:
+		err = serializeEdDSAPrivateKey(w, priv)
+	case *ecdh.PrivateKey:
+		err = serializeECDHPrivateKey(w, priv)
+	default:
+		err = errors.InvalidArgumentError("unknown private key type")
+	}
+	return
+}
+
+func (pk *PrivateKey) parsePrivateKey(data []byte) (err error) {
+	switch pk.PublicKey.PubKeyAlgo {
+	case PubKeyAlgoRSA, PubKeyAlgoRSASignOnly, PubKeyAlgoRSAEncryptOnly:
+		return pk.parseRSAPrivateKey(data)
+	case PubKeyAlgoDSA:
+		return pk.parseDSAPrivateKey(data)
+	case PubKeyAlgoElGamal:
+		return pk.parseElGamalPrivateKey(data)
+	case PubKeyAlgoECDSA:
+		return pk.parseECDSAPrivateKey(data)
+	case PubKeyAlgoECDH:
+		return pk.parseECDHPrivateKey(data)
+	case PubKeyAlgoEdDSA:
+		return pk.parseEdDSAPrivateKey(data)
+	}
+	panic("impossible")
+}
+
+func (pk *PrivateKey) parseRSAPrivateKey(data []byte) (err error) {
+	rsaPub := pk.PublicKey.PublicKey.(*rsa.PublicKey)
+	rsaPriv := new(rsa.PrivateKey)
+	rsaPriv.PublicKey = *rsaPub
+
+	buf := bytes.NewBuffer(data)
+	d := new(encoding.MPI)
+	if _, err := d.ReadFrom(buf); err != nil {
+		return err
+	}
+
+	p := new(encoding.MPI)
+	if _, err := p.ReadFrom(buf); err != nil {
+		return err
+	}
+
+	q := new(encoding.MPI)
+	if _, err := q.ReadFrom(buf); err != nil {
+		return err
+	}
+
+	rsaPriv.D = new(big.Int).SetBytes(d.Bytes())
+	rsaPriv.Primes = make([]*big.Int, 2)
+	rsaPriv.Primes[0] = new(big.Int).SetBytes(p.Bytes())
+	rsaPriv.Primes[1] = new(big.Int).SetBytes(q.Bytes())
+	if err := rsaPriv.Validate(); err != nil {
+		return errors.KeyInvalidError(err.Error())
+	}
+	rsaPriv.Precompute()
+	pk.PrivateKey = rsaPriv
+
+	return nil
+}
+
+func (pk *PrivateKey) parseDSAPrivateKey(data []byte) (err error) {
+	dsaPub := pk.PublicKey.PublicKey.(*dsa.PublicKey)
+	dsaPriv := new(dsa.PrivateKey)
+	dsaPriv.PublicKey = *dsaPub
+
+	buf := bytes.NewBuffer(data)
+	x := new(encoding.MPI)
+	if _, err := x.ReadFrom(buf); err != nil {
+		return err
+	}
+
+	dsaPriv.X = new(big.Int).SetBytes(x.Bytes())
+	if err := validateDSAParameters(dsaPriv); err != nil {
+		return err
+	}
+	pk.PrivateKey = dsaPriv
+
+	return nil
+}
+
+func (pk *PrivateKey) parseElGamalPrivateKey(data []byte) (err error) {
+	pub := pk.PublicKey.PublicKey.(*elgamal.PublicKey)
+	priv := new(elgamal.PrivateKey)
+	priv.PublicKey = *pub
+
+	buf := bytes.NewBuffer(data)
+	x := new(encoding.MPI)
+	if _, err := x.ReadFrom(buf); err != nil {
+		return err
+	}
+
+	priv.X = new(big.Int).SetBytes(x.Bytes())
+	if err := validateElGamalParameters(priv); err != nil {
+		return err
+	}
+	pk.PrivateKey = priv
+
+	return nil
+}
+
+func (pk *PrivateKey) parseECDSAPrivateKey(data []byte) (err error) {
+	ecdsaPub := pk.PublicKey.PublicKey.(*ecdsa.PublicKey)
+	ecdsaPriv := ecdsa.NewPrivateKey(*ecdsaPub)
+
+	buf := bytes.NewBuffer(data)
+	d := new(encoding.MPI)
+	if _, err := d.ReadFrom(buf); err != nil {
+		return err
+	}
+
+	if err := ecdsaPriv.UnmarshalIntegerSecret(d.Bytes()); err != nil {
+		return err
+	}
+	if err := ecdsa.Validate(ecdsaPriv); err != nil {
+		return err
+	}
+	pk.PrivateKey = ecdsaPriv
+
+	return nil
+}
+
+func (pk *PrivateKey) parseECDHPrivateKey(data []byte) (err error) {
+	ecdhPub := pk.PublicKey.PublicKey.(*ecdh.PublicKey)
+	ecdhPriv := ecdh.NewPrivateKey(*ecdhPub)
+
+	buf := bytes.NewBuffer(data)
+	d := new(encoding.MPI)
+	if _, err := d.ReadFrom(buf); err != nil {
+		return err
+	}
+
+	if err := ecdhPriv.UnmarshalByteSecret(d.Bytes()); err != nil {
+		return err
+	}
+
+	if err := ecdh.Validate(ecdhPriv); err != nil {
+		return err
+	}
+
+	pk.PrivateKey = ecdhPriv
+
+	return nil
+}
+
+func (pk *PrivateKey) parseEdDSAPrivateKey(data []byte) (err error) {
+	eddsaPub := pk.PublicKey.PublicKey.(*eddsa.PublicKey)
+	eddsaPriv := eddsa.NewPrivateKey(*eddsaPub)
+	eddsaPriv.PublicKey = *eddsaPub
+
+	buf := bytes.NewBuffer(data)
+	d := new(encoding.MPI)
+	if _, err := d.ReadFrom(buf); err != nil {
+		return err
+	}
+
+	if err = eddsaPriv.UnmarshalByteSecret(d.Bytes()); err != nil {
+		return err
+	}
+
+	if err := eddsa.Validate(eddsaPriv); err != nil {
+		return err
+	}
+
+	pk.PrivateKey = eddsaPriv
+
+	return nil
+}
+
+func validateDSAParameters(priv *dsa.PrivateKey) error {
+	p := priv.P // group prime
+	q := priv.Q // subgroup order
+	g := priv.G // g has order q mod p
+	x := priv.X // secret
+	y := priv.Y // y == g**x mod p
+	one := big.NewInt(1)
+	// expect g, y >= 2 and g < p
+	if g.Cmp(one) <= 0 || y.Cmp(one) <= 0 || g.Cmp(p) > 0 {
+		return errors.KeyInvalidError("dsa: invalid group")
+	}
+	// expect p > q
+	if p.Cmp(q) <= 0 {
+		return errors.KeyInvalidError("dsa: invalid group prime")
+	}
+	// q should be large enough and divide p-1
+	pSub1 := new(big.Int).Sub(p, one)
+	if q.BitLen() < 150 || new(big.Int).Mod(pSub1, q).Cmp(big.NewInt(0)) != 0 {
+		return errors.KeyInvalidError("dsa: invalid order")
+	}
+	// confirm that g has order q mod p
+	if !q.ProbablyPrime(32) || new(big.Int).Exp(g, q, p).Cmp(one) != 0 {
+		return errors.KeyInvalidError("dsa: invalid order")
+	}
+	// check y
+	if new(big.Int).Exp(g, x, p).Cmp(y) != 0 {
+		return errors.KeyInvalidError("dsa: mismatching values")
+	}
+
+	return nil
+}
+
+func validateElGamalParameters(priv *elgamal.PrivateKey) error {
+	p := priv.P // group prime
+	g := priv.G // g has order p-1 mod p
+	x := priv.X // secret
+	y := priv.Y // y == g**x mod p
+	one := big.NewInt(1)
+	// Expect g, y >= 2 and g < p
+	if g.Cmp(one) <= 0 || y.Cmp(one) <= 0 || g.Cmp(p) > 0 {
+		return errors.KeyInvalidError("elgamal: invalid group")
+	}
+	if p.BitLen() < 1024 {
+		return errors.KeyInvalidError("elgamal: group order too small")
+	}
+	pSub1 := new(big.Int).Sub(p, one)
+	if new(big.Int).Exp(g, pSub1, p).Cmp(one) != 0 {
+		return errors.KeyInvalidError("elgamal: invalid group")
+	}
+	// Since p-1 is not prime, g might have a smaller order that divides p-1.
+	// We cannot confirm the exact order of g, but we make sure it is not too small.
+	gExpI := new(big.Int).Set(g)
+	i := 1
+	threshold := 2 << 17 // we want order > threshold
+	for i < threshold {
+		i++ // we check every order to make sure key validation is not easily bypassed by guessing y'
+		gExpI.Mod(new(big.Int).Mul(gExpI, g), p)
+		if gExpI.Cmp(one) == 0 {
+			return errors.KeyInvalidError("elgamal: order too small")
+		}
+	}
+	// Check y
+	if new(big.Int).Exp(g, x, p).Cmp(y) != 0 {
+		return errors.KeyInvalidError("elgamal: mismatching values")
+	}
+
+	return nil
+}
diff --git a/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/packet/private_key_test_data.go b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/packet/private_key_test_data.go
new file mode 100644
index 00000000000..029b8f1aab2
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/packet/private_key_test_data.go
@@ -0,0 +1,12 @@
+package packet
+
+// Generated with `gpg --export-secret-keys "Test Key 2"`
+const privKeyRSAHex = "9501fe044cc349a8010400b70ca0010e98c090008d45d1ee8f9113bd5861fd57b88bacb7c68658747663f1e1a3b5a98f32fda6472373c024b97359cd2efc88ff60f77751adfbf6af5e615e6a1408cfad8bf0cea30b0d5f53aa27ad59089ba9b15b7ebc2777a25d7b436144027e3bcd203909f147d0e332b240cf63d3395f5dfe0df0a6c04e8655af7eacdf0011010001fe0303024a252e7d475fd445607de39a265472aa74a9320ba2dac395faa687e9e0336aeb7e9a7397e511b5afd9dc84557c80ac0f3d4d7bfec5ae16f20d41c8c84a04552a33870b930420e230e179564f6d19bb153145e76c33ae993886c388832b0fa042ddda7f133924f3854481533e0ede31d51278c0519b29abc3bf53da673e13e3e1214b52413d179d7f66deee35cac8eacb060f78379d70ef4af8607e68131ff529439668fc39c9ce6dfef8a5ac234d234802cbfb749a26107db26406213ae5c06d4673253a3cbee1fcbae58d6ab77e38d6e2c0e7c6317c48e054edadb5a40d0d48acb44643d998139a8a66bb820be1f3f80185bc777d14b5954b60effe2448a036d565c6bc0b915fcea518acdd20ab07bc1529f561c58cd044f723109b93f6fd99f876ff891d64306b5d08f48bab59f38695e9109c4dec34013ba3153488ce070268381ba923ee1eb77125b36afcb4347ec3478c8f2735b06ef17351d872e577fa95d0c397c88c71b59629a36aec"
+
+// Generated by `gpg --export-secret-keys` followed by a manual extraction of
+// the ElGamal subkey from the packets.
+const privKeyElGamalHex = "9d0157044df9ee1a100400eb8e136a58ec39b582629cdadf830bc64e0a94ed8103ca8bb247b27b11b46d1d25297ef4bcc3071785ba0c0bedfe89eabc5287fcc0edf81ab5896c1c8e4b20d27d79813c7aede75320b33eaeeaa586edc00fd1036c10133e6ba0ff277245d0d59d04b2b3421b7244aca5f4a8d870c6f1c1fbff9e1c26699a860b9504f35ca1d700030503fd1ededd3b840795be6d9ccbe3c51ee42e2f39233c432b831ddd9c4e72b7025a819317e47bf94f9ee316d7273b05d5fcf2999c3a681f519b1234bbfa6d359b4752bd9c3f77d6b6456cde152464763414ca130f4e91d91041432f90620fec0e6d6b5116076c2985d5aeaae13be492b9b329efcaf7ee25120159a0a30cd976b42d7afe030302dae7eb80db744d4960c4df930d57e87fe81412eaace9f900e6c839817a614ddb75ba6603b9417c33ea7b6c93967dfa2bcff3fa3c74a5ce2c962db65b03aece14c96cbd0038fc"
+
+// pkcs1PrivKeyHex is a PKCS#1, RSA private key.
+// Generated by `openssl genrsa 1024 | openssl rsa -outform DER  | xxd -p`
+const pkcs1PrivKeyHex = "3082025d02010002818100e98edfa1c3b35884a54d0b36a6a603b0290fa85e49e30fa23fc94fef9c6790bc4849928607aa48d809da326fb42a969d06ad756b98b9c1a90f5d4a2b6d0ac05953c97f4da3120164a21a679793ce181c906dc01d235cc085ddcdf6ea06c389b6ab8885dfd685959e693138856a68a7e5db263337ff82a088d583a897cf2d59e9020301000102818100b6d5c9eb70b02d5369b3ee5b520a14490b5bde8a317d36f7e4c74b7460141311d1e5067735f8f01d6f5908b2b96fbd881f7a1ab9a84d82753e39e19e2d36856be960d05ac9ef8e8782ea1b6d65aee28fdfe1d61451e8cff0adfe84322f12cf455028b581cf60eb9e0e140ba5d21aeba6c2634d7c65318b9a665fc01c3191ca21024100fa5e818da3705b0fa33278bb28d4b6f6050388af2d4b75ec9375dd91ccf2e7d7068086a8b82a8f6282e4fbbdb8a7f2622eb97295249d87acea7f5f816f54d347024100eecf9406d7dc49cdfb95ab1eff4064de84c7a30f64b2798936a0d2018ba9eb52e4b636f82e96c49cc63b80b675e91e40d1b2e4017d4b9adaf33ab3d9cf1c214f024100c173704ace742c082323066226a4655226819a85304c542b9dacbeacbf5d1881ee863485fcf6f59f3a604f9b42289282067447f2b13dfeed3eab7851fc81e0550240741fc41f3fc002b382eed8730e33c5d8de40256e4accee846667f536832f711ab1d4590e7db91a8a116ac5bff3be13d3f9243ff2e976662aa9b395d907f8e9c9024046a5696c9ef882363e06c9fa4e2f5b580906452befba03f4a99d0f873697ef1f851d2226ca7934b30b7c3e80cb634a67172bbbf4781735fe3e09263e2dd723e7"
diff --git a/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/packet/public_key.go b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/packet/public_key.go
new file mode 100644
index 00000000000..3402b8c140c
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/packet/public_key.go
@@ -0,0 +1,806 @@
+// Copyright 2011 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package packet
+
+import (
+	"crypto"
+	"crypto/dsa"
+	"crypto/rsa"
+	"crypto/sha1"
+	"crypto/sha256"
+	_ "crypto/sha512"
+	"encoding/binary"
+	"fmt"
+	"hash"
+	"io"
+	"math/big"
+	"strconv"
+	"time"
+
+	"github.com/ProtonMail/go-crypto/openpgp/ecdh"
+	"github.com/ProtonMail/go-crypto/openpgp/ecdsa"
+	"github.com/ProtonMail/go-crypto/openpgp/eddsa"
+	"github.com/ProtonMail/go-crypto/openpgp/elgamal"
+	"github.com/ProtonMail/go-crypto/openpgp/errors"
+	"github.com/ProtonMail/go-crypto/openpgp/internal/algorithm"
+	"github.com/ProtonMail/go-crypto/openpgp/internal/ecc"
+	"github.com/ProtonMail/go-crypto/openpgp/internal/encoding"
+)
+
+type kdfHashFunction byte
+type kdfAlgorithm byte
+
+// PublicKey represents an OpenPGP public key. See RFC 4880, section 5.5.2.
+type PublicKey struct {
+	Version      int
+	CreationTime time.Time
+	PubKeyAlgo   PublicKeyAlgorithm
+	PublicKey    interface{} // *rsa.PublicKey, *dsa.PublicKey, *ecdsa.PublicKey or *eddsa.PublicKey
+	Fingerprint  []byte
+	KeyId        uint64
+	IsSubkey     bool
+
+	// RFC 4880 fields
+	n, e, p, q, g, y encoding.Field
+
+	// RFC 6637 fields
+	// oid contains the OID byte sequence identifying the elliptic curve used
+	oid encoding.Field
+
+	// kdf stores key derivation function parameters
+	// used for ECDH encryption. See RFC 6637, Section 9.
+	kdf encoding.Field
+}
+
+// UpgradeToV5 updates the version of the key to v5, and updates all necessary
+// fields.
+func (pk *PublicKey) UpgradeToV5() {
+	pk.Version = 5
+	pk.setFingerprintAndKeyId()
+}
+
+// signingKey provides a convenient abstraction over signature verification
+// for v3 and v4 public keys.
+type signingKey interface {
+	SerializeForHash(io.Writer) error
+	SerializeSignaturePrefix(io.Writer)
+	serializeWithoutHeaders(io.Writer) error
+}
+
+// NewRSAPublicKey returns a PublicKey that wraps the given rsa.PublicKey.
+func NewRSAPublicKey(creationTime time.Time, pub *rsa.PublicKey) *PublicKey {
+	pk := &PublicKey{
+		Version:      4,
+		CreationTime: creationTime,
+		PubKeyAlgo:   PubKeyAlgoRSA,
+		PublicKey:    pub,
+		n:            new(encoding.MPI).SetBig(pub.N),
+		e:            new(encoding.MPI).SetBig(big.NewInt(int64(pub.E))),
+	}
+
+	pk.setFingerprintAndKeyId()
+	return pk
+}
+
+// NewDSAPublicKey returns a PublicKey that wraps the given dsa.PublicKey.
+func NewDSAPublicKey(creationTime time.Time, pub *dsa.PublicKey) *PublicKey {
+	pk := &PublicKey{
+		Version:      4,
+		CreationTime: creationTime,
+		PubKeyAlgo:   PubKeyAlgoDSA,
+		PublicKey:    pub,
+		p:            new(encoding.MPI).SetBig(pub.P),
+		q:            new(encoding.MPI).SetBig(pub.Q),
+		g:            new(encoding.MPI).SetBig(pub.G),
+		y:            new(encoding.MPI).SetBig(pub.Y),
+	}
+
+	pk.setFingerprintAndKeyId()
+	return pk
+}
+
+// NewElGamalPublicKey returns a PublicKey that wraps the given elgamal.PublicKey.
+func NewElGamalPublicKey(creationTime time.Time, pub *elgamal.PublicKey) *PublicKey {
+	pk := &PublicKey{
+		Version:      4,
+		CreationTime: creationTime,
+		PubKeyAlgo:   PubKeyAlgoElGamal,
+		PublicKey:    pub,
+		p:            new(encoding.MPI).SetBig(pub.P),
+		g:            new(encoding.MPI).SetBig(pub.G),
+		y:            new(encoding.MPI).SetBig(pub.Y),
+	}
+
+	pk.setFingerprintAndKeyId()
+	return pk
+}
+
+func NewECDSAPublicKey(creationTime time.Time, pub *ecdsa.PublicKey) *PublicKey {
+	pk := &PublicKey{
+		Version:      4,
+		CreationTime: creationTime,
+		PubKeyAlgo:   PubKeyAlgoECDSA,
+		PublicKey:    pub,
+		p:            encoding.NewMPI(pub.MarshalPoint()),
+	}
+
+	curveInfo := ecc.FindByCurve(pub.GetCurve())
+	if curveInfo == nil {
+		panic("unknown elliptic curve")
+	}
+	pk.oid = curveInfo.Oid
+	pk.setFingerprintAndKeyId()
+	return pk
+}
+
+func NewECDHPublicKey(creationTime time.Time, pub *ecdh.PublicKey) *PublicKey {
+	var pk *PublicKey
+	var kdf = encoding.NewOID([]byte{0x1, pub.Hash.Id(), pub.Cipher.Id()})
+	pk = &PublicKey{
+		Version:      4,
+		CreationTime: creationTime,
+		PubKeyAlgo:   PubKeyAlgoECDH,
+		PublicKey:    pub,
+		p:            encoding.NewMPI(pub.MarshalPoint()),
+		kdf:          kdf,
+	}
+
+	curveInfo := ecc.FindByCurve(pub.GetCurve())
+
+	if curveInfo == nil {
+		panic("unknown elliptic curve")
+	}
+
+	pk.oid = curveInfo.Oid
+	pk.setFingerprintAndKeyId()
+	return pk
+}
+
+func NewEdDSAPublicKey(creationTime time.Time, pub *eddsa.PublicKey) *PublicKey {
+	curveInfo := ecc.FindByCurve(pub.GetCurve())
+	pk := &PublicKey{
+		Version:      4,
+		CreationTime: creationTime,
+		PubKeyAlgo:   PubKeyAlgoEdDSA,
+		PublicKey:    pub,
+		oid:          curveInfo.Oid,
+		// Native point format, see draft-koch-eddsa-for-openpgp-04, Appendix B
+		p: encoding.NewMPI(pub.MarshalPoint()),
+	}
+
+	pk.setFingerprintAndKeyId()
+	return pk
+}
+
+func (pk *PublicKey) parse(r io.Reader) (err error) {
+	// RFC 4880, section 5.5.2
+	var buf [6]byte
+	_, err = readFull(r, buf[:])
+	if err != nil {
+		return
+	}
+	if buf[0] != 4 && buf[0] != 5 {
+		return errors.UnsupportedError("public key version " + strconv.Itoa(int(buf[0])))
+	}
+
+	pk.Version = int(buf[0])
+	if pk.Version == 5 {
+		var n [4]byte
+		_, err = readFull(r, n[:])
+		if err != nil {
+			return
+		}
+	}
+	pk.CreationTime = time.Unix(int64(uint32(buf[1])<<24|uint32(buf[2])<<16|uint32(buf[3])<<8|uint32(buf[4])), 0)
+	pk.PubKeyAlgo = PublicKeyAlgorithm(buf[5])
+	switch pk.PubKeyAlgo {
+	case PubKeyAlgoRSA, PubKeyAlgoRSAEncryptOnly, PubKeyAlgoRSASignOnly:
+		err = pk.parseRSA(r)
+	case PubKeyAlgoDSA:
+		err = pk.parseDSA(r)
+	case PubKeyAlgoElGamal:
+		err = pk.parseElGamal(r)
+	case PubKeyAlgoECDSA:
+		err = pk.parseECDSA(r)
+	case PubKeyAlgoECDH:
+		err = pk.parseECDH(r)
+	case PubKeyAlgoEdDSA:
+		err = pk.parseEdDSA(r)
+	default:
+		err = errors.UnsupportedError("public key type: " + strconv.Itoa(int(pk.PubKeyAlgo)))
+	}
+	if err != nil {
+		return
+	}
+
+	pk.setFingerprintAndKeyId()
+	return
+}
+
+func (pk *PublicKey) setFingerprintAndKeyId() {
+	// RFC 4880, section 12.2
+	if pk.Version == 5 {
+		fingerprint := sha256.New()
+		pk.SerializeForHash(fingerprint)
+		pk.Fingerprint = make([]byte, 32)
+		copy(pk.Fingerprint, fingerprint.Sum(nil))
+		pk.KeyId = binary.BigEndian.Uint64(pk.Fingerprint[:8])
+	} else {
+		fingerprint := sha1.New()
+		pk.SerializeForHash(fingerprint)
+		pk.Fingerprint = make([]byte, 20)
+		copy(pk.Fingerprint, fingerprint.Sum(nil))
+		pk.KeyId = binary.BigEndian.Uint64(pk.Fingerprint[12:20])
+	}
+}
+
+// parseRSA parses RSA public key material from the given Reader. See RFC 4880,
+// section 5.5.2.
+func (pk *PublicKey) parseRSA(r io.Reader) (err error) {
+	pk.n = new(encoding.MPI)
+	if _, err = pk.n.ReadFrom(r); err != nil {
+		return
+	}
+	pk.e = new(encoding.MPI)
+	if _, err = pk.e.ReadFrom(r); err != nil {
+		return
+	}
+
+	if len(pk.e.Bytes()) > 3 {
+		err = errors.UnsupportedError("large public exponent")
+		return
+	}
+	rsa := &rsa.PublicKey{
+		N: new(big.Int).SetBytes(pk.n.Bytes()),
+		E: 0,
+	}
+	for i := 0; i < len(pk.e.Bytes()); i++ {
+		rsa.E <<= 8
+		rsa.E |= int(pk.e.Bytes()[i])
+	}
+	pk.PublicKey = rsa
+	return
+}
+
+// parseDSA parses DSA public key material from the given Reader. See RFC 4880,
+// section 5.5.2.
+func (pk *PublicKey) parseDSA(r io.Reader) (err error) {
+	pk.p = new(encoding.MPI)
+	if _, err = pk.p.ReadFrom(r); err != nil {
+		return
+	}
+	pk.q = new(encoding.MPI)
+	if _, err = pk.q.ReadFrom(r); err != nil {
+		return
+	}
+	pk.g = new(encoding.MPI)
+	if _, err = pk.g.ReadFrom(r); err != nil {
+		return
+	}
+	pk.y = new(encoding.MPI)
+	if _, err = pk.y.ReadFrom(r); err != nil {
+		return
+	}
+
+	dsa := new(dsa.PublicKey)
+	dsa.P = new(big.Int).SetBytes(pk.p.Bytes())
+	dsa.Q = new(big.Int).SetBytes(pk.q.Bytes())
+	dsa.G = new(big.Int).SetBytes(pk.g.Bytes())
+	dsa.Y = new(big.Int).SetBytes(pk.y.Bytes())
+	pk.PublicKey = dsa
+	return
+}
+
+// parseElGamal parses ElGamal public key material from the given Reader. See
+// RFC 4880, section 5.5.2.
+func (pk *PublicKey) parseElGamal(r io.Reader) (err error) {
+	pk.p = new(encoding.MPI)
+	if _, err = pk.p.ReadFrom(r); err != nil {
+		return
+	}
+	pk.g = new(encoding.MPI)
+	if _, err = pk.g.ReadFrom(r); err != nil {
+		return
+	}
+	pk.y = new(encoding.MPI)
+	if _, err = pk.y.ReadFrom(r); err != nil {
+		return
+	}
+
+	elgamal := new(elgamal.PublicKey)
+	elgamal.P = new(big.Int).SetBytes(pk.p.Bytes())
+	elgamal.G = new(big.Int).SetBytes(pk.g.Bytes())
+	elgamal.Y = new(big.Int).SetBytes(pk.y.Bytes())
+	pk.PublicKey = elgamal
+	return
+}
+
+// parseECDSA parses ECDSA public key material from the given Reader. See
+// RFC 6637, Section 9.
+func (pk *PublicKey) parseECDSA(r io.Reader) (err error) {
+	pk.oid = new(encoding.OID)
+	if _, err = pk.oid.ReadFrom(r); err != nil {
+		return
+	}
+	pk.p = new(encoding.MPI)
+	if _, err = pk.p.ReadFrom(r); err != nil {
+		return
+	}
+
+	curveInfo := ecc.FindByOid(pk.oid)
+	if curveInfo == nil {
+		return errors.UnsupportedError(fmt.Sprintf("unknown oid: %x", pk.oid))
+	}
+
+	c, ok := curveInfo.Curve.(ecc.ECDSACurve)
+	if !ok {
+		return errors.UnsupportedError(fmt.Sprintf("unsupported oid: %x", pk.oid))
+	}
+
+	ecdsaKey := ecdsa.NewPublicKey(c)
+	err = ecdsaKey.UnmarshalPoint(pk.p.Bytes())
+	pk.PublicKey = ecdsaKey
+
+	return
+}
+
+// parseECDH parses ECDH public key material from the given Reader. See
+// RFC 6637, Section 9.
+func (pk *PublicKey) parseECDH(r io.Reader) (err error) {
+	pk.oid = new(encoding.OID)
+	if _, err = pk.oid.ReadFrom(r); err != nil {
+		return
+	}
+	pk.p = new(encoding.MPI)
+	if _, err = pk.p.ReadFrom(r); err != nil {
+		return
+	}
+	pk.kdf = new(encoding.OID)
+	if _, err = pk.kdf.ReadFrom(r); err != nil {
+		return
+	}
+
+	curveInfo := ecc.FindByOid(pk.oid)
+
+	if curveInfo == nil {
+		return errors.UnsupportedError(fmt.Sprintf("unknown oid: %x", pk.oid))
+	}
+
+	c, ok := curveInfo.Curve.(ecc.ECDHCurve)
+	if !ok {
+		return errors.UnsupportedError(fmt.Sprintf("unsupported oid: %x", pk.oid))
+	}
+
+	if kdfLen := len(pk.kdf.Bytes()); kdfLen < 3 {
+		return errors.UnsupportedError("unsupported ECDH KDF length: " + strconv.Itoa(kdfLen))
+	}
+	if reserved := pk.kdf.Bytes()[0]; reserved != 0x01 {
+		return errors.UnsupportedError("unsupported KDF reserved field: " + strconv.Itoa(int(reserved)))
+	}
+	kdfHash, ok := algorithm.HashById[pk.kdf.Bytes()[1]]
+	if !ok {
+		return errors.UnsupportedError("unsupported ECDH KDF hash: " + strconv.Itoa(int(pk.kdf.Bytes()[1])))
+	}
+	kdfCipher, ok := algorithm.CipherById[pk.kdf.Bytes()[2]]
+	if !ok {
+		return errors.UnsupportedError("unsupported ECDH KDF cipher: " + strconv.Itoa(int(pk.kdf.Bytes()[2])))
+	}
+
+	ecdhKey := ecdh.NewPublicKey(c, kdfHash, kdfCipher)
+	err = ecdhKey.UnmarshalPoint(pk.p.Bytes())
+	pk.PublicKey = ecdhKey
+
+	return
+}
+
+func (pk *PublicKey) parseEdDSA(r io.Reader) (err error) {
+	pk.oid = new(encoding.OID)
+	if _, err = pk.oid.ReadFrom(r); err != nil {
+		return
+	}
+	curveInfo := ecc.FindByOid(pk.oid)
+	if curveInfo == nil {
+		return errors.UnsupportedError(fmt.Sprintf("unknown oid: %x", pk.oid))
+	}
+
+	c, ok := curveInfo.Curve.(ecc.EdDSACurve)
+	if !ok {
+		return errors.UnsupportedError(fmt.Sprintf("unsupported oid: %x", pk.oid))
+	}
+
+	pk.p = new(encoding.MPI)
+	if _, err = pk.p.ReadFrom(r); err != nil {
+		return
+	}
+
+	if len(pk.p.Bytes()) == 0 {
+		return errors.StructuralError("empty EdDSA public key")
+	}
+
+	pub := eddsa.NewPublicKey(c)
+
+	switch flag := pk.p.Bytes()[0]; flag {
+	case 0x04:
+		// TODO: see _grcy_ecc_eddsa_ensure_compact in grcypt
+		return errors.UnsupportedError("unsupported EdDSA compression: " + strconv.Itoa(int(flag)))
+	case 0x40:
+		err = pub.UnmarshalPoint(pk.p.Bytes())
+	default:
+		return errors.UnsupportedError("unsupported EdDSA compression: " + strconv.Itoa(int(flag)))
+	}
+
+	pk.PublicKey = pub
+	return
+}
+
+// SerializeForHash serializes the PublicKey to w with the special packet
+// header format needed for hashing.
+func (pk *PublicKey) SerializeForHash(w io.Writer) error {
+	pk.SerializeSignaturePrefix(w)
+	return pk.serializeWithoutHeaders(w)
+}
+
+// SerializeSignaturePrefix writes the prefix for this public key to the given Writer.
+// The prefix is used when calculating a signature over this public key. See
+// RFC 4880, section 5.2.4.
+func (pk *PublicKey) SerializeSignaturePrefix(w io.Writer) {
+	var pLength = pk.algorithmSpecificByteCount()
+	if pk.Version == 5 {
+		pLength += 10 // version, timestamp (4), algorithm, key octet count (4).
+		w.Write([]byte{
+			0x9A,
+			byte(pLength >> 24),
+			byte(pLength >> 16),
+			byte(pLength >> 8),
+			byte(pLength),
+		})
+		return
+	}
+	pLength += 6
+	w.Write([]byte{0x99, byte(pLength >> 8), byte(pLength)})
+}
+
+func (pk *PublicKey) Serialize(w io.Writer) (err error) {
+	length := 6 // 6 byte header
+	length += pk.algorithmSpecificByteCount()
+	if pk.Version == 5 {
+		length += 4 // octet key count
+	}
+	packetType := packetTypePublicKey
+	if pk.IsSubkey {
+		packetType = packetTypePublicSubkey
+	}
+	err = serializeHeader(w, packetType, length)
+	if err != nil {
+		return
+	}
+	return pk.serializeWithoutHeaders(w)
+}
+
+func (pk *PublicKey) algorithmSpecificByteCount() int {
+	length := 0
+	switch pk.PubKeyAlgo {
+	case PubKeyAlgoRSA, PubKeyAlgoRSAEncryptOnly, PubKeyAlgoRSASignOnly:
+		length += int(pk.n.EncodedLength())
+		length += int(pk.e.EncodedLength())
+	case PubKeyAlgoDSA:
+		length += int(pk.p.EncodedLength())
+		length += int(pk.q.EncodedLength())
+		length += int(pk.g.EncodedLength())
+		length += int(pk.y.EncodedLength())
+	case PubKeyAlgoElGamal:
+		length += int(pk.p.EncodedLength())
+		length += int(pk.g.EncodedLength())
+		length += int(pk.y.EncodedLength())
+	case PubKeyAlgoECDSA:
+		length += int(pk.oid.EncodedLength())
+		length += int(pk.p.EncodedLength())
+	case PubKeyAlgoECDH:
+		length += int(pk.oid.EncodedLength())
+		length += int(pk.p.EncodedLength())
+		length += int(pk.kdf.EncodedLength())
+	case PubKeyAlgoEdDSA:
+		length += int(pk.oid.EncodedLength())
+		length += int(pk.p.EncodedLength())
+	default:
+		panic("unknown public key algorithm")
+	}
+	return length
+}
+
+// serializeWithoutHeaders marshals the PublicKey to w in the form of an
+// OpenPGP public key packet, not including the packet header.
+func (pk *PublicKey) serializeWithoutHeaders(w io.Writer) (err error) {
+	t := uint32(pk.CreationTime.Unix())
+	if _, err = w.Write([]byte{
+		byte(pk.Version),
+		byte(t >> 24), byte(t >> 16), byte(t >> 8), byte(t),
+		byte(pk.PubKeyAlgo),
+	}); err != nil {
+		return
+	}
+
+	if pk.Version == 5 {
+		n := pk.algorithmSpecificByteCount()
+		if _, err = w.Write([]byte{
+			byte(n >> 24), byte(n >> 16), byte(n >> 8), byte(n),
+		}); err != nil {
+			return
+		}
+	}
+
+	switch pk.PubKeyAlgo {
+	case PubKeyAlgoRSA, PubKeyAlgoRSAEncryptOnly, PubKeyAlgoRSASignOnly:
+		if _, err = w.Write(pk.n.EncodedBytes()); err != nil {
+			return
+		}
+		_, err = w.Write(pk.e.EncodedBytes())
+		return
+	case PubKeyAlgoDSA:
+		if _, err = w.Write(pk.p.EncodedBytes()); err != nil {
+			return
+		}
+		if _, err = w.Write(pk.q.EncodedBytes()); err != nil {
+			return
+		}
+		if _, err = w.Write(pk.g.EncodedBytes()); err != nil {
+			return
+		}
+		_, err = w.Write(pk.y.EncodedBytes())
+		return
+	case PubKeyAlgoElGamal:
+		if _, err = w.Write(pk.p.EncodedBytes()); err != nil {
+			return
+		}
+		if _, err = w.Write(pk.g.EncodedBytes()); err != nil {
+			return
+		}
+		_, err = w.Write(pk.y.EncodedBytes())
+		return
+	case PubKeyAlgoECDSA:
+		if _, err = w.Write(pk.oid.EncodedBytes()); err != nil {
+			return
+		}
+		_, err = w.Write(pk.p.EncodedBytes())
+		return
+	case PubKeyAlgoECDH:
+		if _, err = w.Write(pk.oid.EncodedBytes()); err != nil {
+			return
+		}
+		if _, err = w.Write(pk.p.EncodedBytes()); err != nil {
+			return
+		}
+		_, err = w.Write(pk.kdf.EncodedBytes())
+		return
+	case PubKeyAlgoEdDSA:
+		if _, err = w.Write(pk.oid.EncodedBytes()); err != nil {
+			return
+		}
+		_, err = w.Write(pk.p.EncodedBytes())
+		return
+	}
+	return errors.InvalidArgumentError("bad public-key algorithm")
+}
+
+// CanSign returns true iff this public key can generate signatures
+func (pk *PublicKey) CanSign() bool {
+	return pk.PubKeyAlgo != PubKeyAlgoRSAEncryptOnly && pk.PubKeyAlgo != PubKeyAlgoElGamal && pk.PubKeyAlgo != PubKeyAlgoECDH
+}
+
+// VerifySignature returns nil iff sig is a valid signature, made by this
+// public key, of the data hashed into signed. signed is mutated by this call.
+func (pk *PublicKey) VerifySignature(signed hash.Hash, sig *Signature) (err error) {
+	if !pk.CanSign() {
+		return errors.InvalidArgumentError("public key cannot generate signatures")
+	}
+	if sig.Version == 5 && (sig.SigType == 0x00 || sig.SigType == 0x01) {
+		sig.AddMetadataToHashSuffix()
+	}
+	signed.Write(sig.HashSuffix)
+	hashBytes := signed.Sum(nil)
+	if sig.Version == 5 && (hashBytes[0] != sig.HashTag[0] || hashBytes[1] != sig.HashTag[1]) {
+		return errors.SignatureError("hash tag doesn't match")
+	}
+
+	if pk.PubKeyAlgo != sig.PubKeyAlgo {
+		return errors.InvalidArgumentError("public key and signature use different algorithms")
+	}
+
+	switch pk.PubKeyAlgo {
+	case PubKeyAlgoRSA, PubKeyAlgoRSASignOnly:
+		rsaPublicKey, _ := pk.PublicKey.(*rsa.PublicKey)
+		err = rsa.VerifyPKCS1v15(rsaPublicKey, sig.Hash, hashBytes, padToKeySize(rsaPublicKey, sig.RSASignature.Bytes()))
+		if err != nil {
+			return errors.SignatureError("RSA verification failure")
+		}
+		return nil
+	case PubKeyAlgoDSA:
+		dsaPublicKey, _ := pk.PublicKey.(*dsa.PublicKey)
+		// Need to truncate hashBytes to match FIPS 186-3 section 4.6.
+		subgroupSize := (dsaPublicKey.Q.BitLen() + 7) / 8
+		if len(hashBytes) > subgroupSize {
+			hashBytes = hashBytes[:subgroupSize]
+		}
+		if !dsa.Verify(dsaPublicKey, hashBytes, new(big.Int).SetBytes(sig.DSASigR.Bytes()), new(big.Int).SetBytes(sig.DSASigS.Bytes())) {
+			return errors.SignatureError("DSA verification failure")
+		}
+		return nil
+	case PubKeyAlgoECDSA:
+		ecdsaPublicKey := pk.PublicKey.(*ecdsa.PublicKey)
+		if !ecdsa.Verify(ecdsaPublicKey, hashBytes, new(big.Int).SetBytes(sig.ECDSASigR.Bytes()), new(big.Int).SetBytes(sig.ECDSASigS.Bytes())) {
+			return errors.SignatureError("ECDSA verification failure")
+		}
+		return nil
+	case PubKeyAlgoEdDSA:
+		eddsaPublicKey := pk.PublicKey.(*eddsa.PublicKey)
+		if !eddsa.Verify(eddsaPublicKey, hashBytes, sig.EdDSASigR.Bytes(), sig.EdDSASigS.Bytes()) {
+			return errors.SignatureError("EdDSA verification failure")
+		}
+		return nil
+	default:
+		return errors.SignatureError("Unsupported public key algorithm used in signature")
+	}
+}
+
+// keySignatureHash returns a Hash of the message that needs to be signed for
+// pk to assert a subkey relationship to signed.
+func keySignatureHash(pk, signed signingKey, hashFunc crypto.Hash) (h hash.Hash, err error) {
+	if !hashFunc.Available() {
+		return nil, errors.UnsupportedError("hash function")
+	}
+	h = hashFunc.New()
+
+	// RFC 4880, section 5.2.4
+	err = pk.SerializeForHash(h)
+	if err != nil {
+		return nil, err
+	}
+
+	err = signed.SerializeForHash(h)
+	return
+}
+
+// VerifyKeySignature returns nil iff sig is a valid signature, made by this
+// public key, of signed.
+func (pk *PublicKey) VerifyKeySignature(signed *PublicKey, sig *Signature) error {
+	h, err := keySignatureHash(pk, signed, sig.Hash)
+	if err != nil {
+		return err
+	}
+	if err = pk.VerifySignature(h, sig); err != nil {
+		return err
+	}
+
+	if sig.FlagSign {
+		// Signing subkeys must be cross-signed. See
+		// https://www.gnupg.org/faq/subkey-cross-certify.html.
+		if sig.EmbeddedSignature == nil {
+			return errors.StructuralError("signing subkey is missing cross-signature")
+		}
+		// Verify the cross-signature. This is calculated over the same
+		// data as the main signature, so we cannot just recursively
+		// call signed.VerifyKeySignature(...)
+		if h, err = keySignatureHash(pk, signed, sig.EmbeddedSignature.Hash); err != nil {
+			return errors.StructuralError("error while hashing for cross-signature: " + err.Error())
+		}
+		if err := signed.VerifySignature(h, sig.EmbeddedSignature); err != nil {
+			return errors.StructuralError("error while verifying cross-signature: " + err.Error())
+		}
+	}
+
+	return nil
+}
+
+func keyRevocationHash(pk signingKey, hashFunc crypto.Hash) (h hash.Hash, err error) {
+	if !hashFunc.Available() {
+		return nil, errors.UnsupportedError("hash function")
+	}
+	h = hashFunc.New()
+
+	// RFC 4880, section 5.2.4
+	err = pk.SerializeForHash(h)
+
+	return
+}
+
+// VerifyRevocationSignature returns nil iff sig is a valid signature, made by this
+// public key.
+func (pk *PublicKey) VerifyRevocationSignature(sig *Signature) (err error) {
+	h, err := keyRevocationHash(pk, sig.Hash)
+	if err != nil {
+		return err
+	}
+	return pk.VerifySignature(h, sig)
+}
+
+// VerifySubkeyRevocationSignature returns nil iff sig is a valid subkey revocation signature,
+// made by this public key, of signed.
+func (pk *PublicKey) VerifySubkeyRevocationSignature(sig *Signature, signed *PublicKey) (err error) {
+	h, err := keySignatureHash(pk, signed, sig.Hash)
+	if err != nil {
+		return err
+	}
+	return pk.VerifySignature(h, sig)
+}
+
+// userIdSignatureHash returns a Hash of the message that needs to be signed
+// to assert that pk is a valid key for id.
+func userIdSignatureHash(id string, pk *PublicKey, hashFunc crypto.Hash) (h hash.Hash, err error) {
+	if !hashFunc.Available() {
+		return nil, errors.UnsupportedError("hash function")
+	}
+	h = hashFunc.New()
+
+	// RFC 4880, section 5.2.4
+	pk.SerializeSignaturePrefix(h)
+	pk.serializeWithoutHeaders(h)
+
+	var buf [5]byte
+	buf[0] = 0xb4
+	buf[1] = byte(len(id) >> 24)
+	buf[2] = byte(len(id) >> 16)
+	buf[3] = byte(len(id) >> 8)
+	buf[4] = byte(len(id))
+	h.Write(buf[:])
+	h.Write([]byte(id))
+
+	return
+}
+
+// VerifyUserIdSignature returns nil iff sig is a valid signature, made by this
+// public key, that id is the identity of pub.
+func (pk *PublicKey) VerifyUserIdSignature(id string, pub *PublicKey, sig *Signature) (err error) {
+	h, err := userIdSignatureHash(id, pub, sig.Hash)
+	if err != nil {
+		return err
+	}
+	return pk.VerifySignature(h, sig)
+}
+
+// KeyIdString returns the public key's fingerprint in capital hex
+// (e.g. "6C7EE1B8621CC013").
+func (pk *PublicKey) KeyIdString() string {
+	return fmt.Sprintf("%X", pk.Fingerprint[12:20])
+}
+
+// KeyIdShortString returns the short form of public key's fingerprint
+// in capital hex, as shown by gpg --list-keys (e.g. "621CC013").
+func (pk *PublicKey) KeyIdShortString() string {
+	return fmt.Sprintf("%X", pk.Fingerprint[16:20])
+}
+
+// BitLength returns the bit length for the given public key.
+func (pk *PublicKey) BitLength() (bitLength uint16, err error) {
+	switch pk.PubKeyAlgo {
+	case PubKeyAlgoRSA, PubKeyAlgoRSAEncryptOnly, PubKeyAlgoRSASignOnly:
+		bitLength = pk.n.BitLength()
+	case PubKeyAlgoDSA:
+		bitLength = pk.p.BitLength()
+	case PubKeyAlgoElGamal:
+		bitLength = pk.p.BitLength()
+	case PubKeyAlgoECDSA:
+		bitLength = pk.p.BitLength()
+	case PubKeyAlgoECDH:
+		bitLength = pk.p.BitLength()
+	case PubKeyAlgoEdDSA:
+		bitLength = pk.p.BitLength()
+	default:
+		err = errors.InvalidArgumentError("bad public-key algorithm")
+	}
+	return
+}
+
+// KeyExpired returns whether sig is a self-signature of a key that has
+// expired or is created in the future.
+func (pk *PublicKey) KeyExpired(sig *Signature, currentTime time.Time) bool {
+	if pk.CreationTime.After(currentTime) {
+		return true
+	}
+	if sig.KeyLifetimeSecs == nil || *sig.KeyLifetimeSecs == 0 {
+		return false
+	}
+	expiry := pk.CreationTime.Add(time.Duration(*sig.KeyLifetimeSecs) * time.Second)
+	return currentTime.After(expiry)
+}
diff --git a/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/packet/public_key_test_data.go b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/packet/public_key_test_data.go
new file mode 100644
index 00000000000..b255f1f6f8f
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/packet/public_key_test_data.go
@@ -0,0 +1,24 @@
+package packet
+
+const rsaFingerprintHex = "5fb74b1d03b1e3cb31bc2f8aa34d7e18c20c31bb"
+
+const rsaPkDataHex = "988d044d3c5c10010400b1d13382944bd5aba23a4312968b5095d14f947f600eb478e14a6fcb16b0e0cac764884909c020bc495cfcc39a935387c661507bdb236a0612fb582cac3af9b29cc2c8c70090616c41b662f4da4c1201e195472eb7f4ae1ccbcbf9940fe21d985e379a5563dde5b9a23d35f1cfaa5790da3b79db26f23695107bfaca8e7b5bcd0011010001"
+
+const dsaFingerprintHex = "eece4c094db002103714c63c8e8fbe54062f19ed"
+
+const dsaPkDataHex = "9901a2044d432f89110400cd581334f0d7a1e1bdc8b9d6d8c0baf68793632735d2bb0903224cbaa1dfbf35a60ee7a13b92643421e1eb41aa8d79bea19a115a677f6b8ba3c7818ce53a6c2a24a1608bd8b8d6e55c5090cbde09dd26e356267465ae25e69ec8bdd57c7bbb2623e4d73336f73a0a9098f7f16da2e25252130fd694c0e8070c55a812a423ae7f00a0ebf50e70c2f19c3520a551bd4b08d30f23530d3d03ff7d0bf4a53a64a09dc5e6e6e35854b7d70c882b0c60293401958b1bd9e40abec3ea05ba87cf64899299d4bd6aa7f459c201d3fbbd6c82004bdc5e8a9eb8082d12054cc90fa9d4ec251a843236a588bf49552441817436c4f43326966fe85447d4e6d0acf8fa1ef0f014730770603ad7634c3088dc52501c237328417c31c89ed70400b2f1a98b0bf42f11fefc430704bebbaa41d9f355600c3facee1e490f64208e0e094ea55e3a598a219a58500bf78ac677b670a14f4e47e9cf8eab4f368cc1ddcaa18cc59309d4cc62dd4f680e73e6cc3e1ce87a84d0925efbcb26c575c093fc42eecf45135fabf6403a25c2016e1774c0484e440a18319072c617cc97ac0a3bb0"
+
+const ecdsaFingerprintHex = "9892270b38b8980b05c8d56d43fe956c542ca00b"
+
+const ecdsaPkDataHex = "9893045071c29413052b8104002304230401f4867769cedfa52c325018896245443968e52e51d0c2df8d939949cb5b330f2921711fbee1c9b9dddb95d15cb0255e99badeddda7cc23d9ddcaacbc290969b9f24019375d61c2e4e3b36953a28d8b2bc95f78c3f1d592fb24499be348656a7b17e3963187b4361afe497bc5f9f81213f04069f8e1fb9e6a6290ae295ca1a92b894396cb4"
+
+const ecdhFingerprintHex = "722354df2475a42164d1d49faa8b938f9a201946"
+
+const ecdhPkDataHex = "b90073044d53059212052b810400220303042faa84024a20b6735c4897efa5bfb41bf85b7eefeab5ca0cb9ffc8ea04a46acb25534a577694f9e25340a4ab5223a9dd1eda530c8aa2e6718db10d7e672558c7736fe09369ea5739a2a3554bf16d41faa50562f11c6d39bbd5dffb6b9a9ec91803010909"
+
+const eddsaFingerprintHex = "b2d5e5ec0e6deca6bc8eeeb00907e75e1dd99ad8"
+
+const eddsaPkDataHex = "98330456e2132b16092b06010401da470f01010740bbda39266affa511a8c2d02edf690fb784b0499c4406185811a163539ef11dc1b41d74657374696e67203c74657374696e674074657374696e672e636f6d3e8879041316080021050256e2132b021b03050b09080702061508090a0b020416020301021e01021780000a09100907e75e1dd99ad86d0c00fe39d2008359352782bc9b61ac382584cd8eff3f57a18c2287e3afeeb05d1f04ba00fe2d0bc1ddf3ff8adb9afa3e7d9287244b4ec567f3db4d60b74a9b5465ed528203"
+
+// Source: https://sites.google.com/site/brainhub/pgpecckeys#TOC-ECC-NIST-P-384-key
+const ecc384PubHex = `99006f044d53059213052b81040022030304f6b8c5aced5b84ef9f4a209db2e4a9dfb70d28cb8c10ecd57674a9fa5a67389942b62d5e51367df4c7bfd3f8e500feecf07ed265a621a8ebbbe53e947ec78c677eba143bd1533c2b350e1c29f82313e1e1108eba063be1e64b10e6950e799c2db42465635f6473615f64685f333834203c6f70656e70677040627261696e6875622e6f72673e8900cb04101309005305024d530592301480000000002000077072656665727265642d656d61696c2d656e636f64696e67407067702e636f6d7067706d696d65040b090807021901051b03000000021602051e010000000415090a08000a0910098033880f54719fca2b0180aa37350968bd5f115afd8ce7bc7b103822152dbff06d0afcda835329510905b98cb469ba208faab87c7412b799e7b633017f58364ea480e8a1a3f253a0c5f22c446e8be9a9fce6210136ee30811abbd49139de28b5bdf8dc36d06ae748579e9ff503b90073044d53059212052b810400220303042faa84024a20b6735c4897efa5bfb41bf85b7eefeab5ca0cb9ffc8ea04a46acb25534a577694f9e25340a4ab5223a9dd1eda530c8aa2e6718db10d7e672558c7736fe09369ea5739a2a3554bf16d41faa50562f11c6d39bbd5dffb6b9a9ec9180301090989008404181309000c05024d530592051b0c000000000a0910098033880f54719f80970180eee7a6d8fcee41ee4f9289df17f9bcf9d955dca25c583b94336f3a2b2d4986dc5cf417b8d2dc86f741a9e1a6d236c0e3017d1c76575458a0cfb93ae8a2b274fcc65ceecd7a91eec83656ba13219969f06945b48c56bd04152c3a0553c5f2f4bd1267`
diff --git a/.ci/providerlint/vendor/golang.org/x/crypto/openpgp/packet/reader.go b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/packet/reader.go
similarity index 83%
rename from .ci/providerlint/vendor/golang.org/x/crypto/openpgp/packet/reader.go
rename to .ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/packet/reader.go
index 34bc7c613e6..10215fe5f23 100644
--- a/.ci/providerlint/vendor/golang.org/x/crypto/openpgp/packet/reader.go
+++ b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/packet/reader.go
@@ -5,8 +5,9 @@
 package packet
 
 import (
-	"golang.org/x/crypto/openpgp/errors"
 	"io"
+
+	"github.com/ProtonMail/go-crypto/openpgp/errors"
 )
 
 // Reader reads packets from an io.Reader and allows packets to be 'unread' so
@@ -42,9 +43,18 @@ func (r *Reader) Next() (p Packet, err error) {
 			r.readers = r.readers[:len(r.readers)-1]
 			continue
 		}
-		if _, ok := err.(errors.UnknownPacketTypeError); !ok {
-			return nil, err
+		// TODO: Add strict mode that rejects unknown packets, instead of ignoring them.
+		if _, ok := err.(errors.UnknownPacketTypeError); ok {
+			continue
+		}
+		if _, ok := err.(errors.UnsupportedError); ok {
+			switch p.(type) {
+			case *SymmetricallyEncrypted, *AEADEncrypted, *Compressed, *LiteralData:
+				return nil, err
+			}
+			continue
 		}
+		return nil, err
 	}
 
 	return nil, io.EOF
diff --git a/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/packet/signature.go b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/packet/signature.go
new file mode 100644
index 00000000000..80d0bb98e0f
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/packet/signature.go
@@ -0,0 +1,1084 @@
+// Copyright 2011 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package packet
+
+import (
+	"bytes"
+	"crypto"
+	"crypto/dsa"
+	"encoding/binary"
+	"hash"
+	"io"
+	"strconv"
+	"time"
+
+	"github.com/ProtonMail/go-crypto/openpgp/ecdsa"
+	"github.com/ProtonMail/go-crypto/openpgp/eddsa"
+	"github.com/ProtonMail/go-crypto/openpgp/errors"
+	"github.com/ProtonMail/go-crypto/openpgp/internal/algorithm"
+	"github.com/ProtonMail/go-crypto/openpgp/internal/encoding"
+)
+
+const (
+	// See RFC 4880, section 5.2.3.21 for details.
+	KeyFlagCertify = 1 << iota
+	KeyFlagSign
+	KeyFlagEncryptCommunications
+	KeyFlagEncryptStorage
+	KeyFlagSplitKey
+	KeyFlagAuthenticate
+	_
+	KeyFlagGroupKey
+)
+
+// Signature represents a signature. See RFC 4880, section 5.2.
+type Signature struct {
+	Version    int
+	SigType    SignatureType
+	PubKeyAlgo PublicKeyAlgorithm
+	Hash       crypto.Hash
+
+	// HashSuffix is extra data that is hashed in after the signed data.
+	HashSuffix []byte
+	// HashTag contains the first two bytes of the hash for fast rejection
+	// of bad signed data.
+	HashTag [2]byte
+
+	// Metadata includes format, filename and time, and is protected by v5
+	// signatures of type 0x00 or 0x01. This metadata is included into the hash
+	// computation; if nil, six 0x00 bytes are used instead. See section 5.2.4.
+	Metadata *LiteralData
+
+	CreationTime time.Time
+
+	RSASignature         encoding.Field
+	DSASigR, DSASigS     encoding.Field
+	ECDSASigR, ECDSASigS encoding.Field
+	EdDSASigR, EdDSASigS encoding.Field
+
+	// rawSubpackets contains the unparsed subpackets, in order.
+	rawSubpackets []outputSubpacket
+
+	// The following are optional so are nil when not included in the
+	// signature.
+
+	SigLifetimeSecs, KeyLifetimeSecs                        *uint32
+	PreferredSymmetric, PreferredHash, PreferredCompression []uint8
+	PreferredCipherSuites                                   [][2]uint8
+	IssuerKeyId                                             *uint64
+	IssuerFingerprint                                       []byte
+	SignerUserId                                            *string
+	IsPrimaryId                                             *bool
+	Notations                                               []*Notation
+
+	// TrustLevel and TrustAmount can be set by the signer to assert that
+	// the key is not only valid but also trustworthy at the specified
+	// level.
+	// See RFC 4880, section 5.2.3.13 for details.
+	TrustLevel  TrustLevel
+	TrustAmount TrustAmount
+
+	// TrustRegularExpression can be used in conjunction with trust Signature
+	// packets to limit the scope of the trust that is extended.
+	// See RFC 4880, section 5.2.3.14 for details.
+	TrustRegularExpression *string
+
+	// PolicyURI can be set to the URI of a document that describes the
+	// policy under which the signature was issued. See RFC 4880, section
+	// 5.2.3.20 for details.
+	PolicyURI string
+
+	// FlagsValid is set if any flags were given. See RFC 4880, section
+	// 5.2.3.21 for details.
+	FlagsValid                                                                                                         bool
+	FlagCertify, FlagSign, FlagEncryptCommunications, FlagEncryptStorage, FlagSplitKey, FlagAuthenticate, FlagGroupKey bool
+
+	// RevocationReason is set if this signature has been revoked.
+	// See RFC 4880, section 5.2.3.23 for details.
+	RevocationReason     *ReasonForRevocation
+	RevocationReasonText string
+
+	// In a self-signature, these flags are set there is a features subpacket
+	// indicating that the issuer implementation supports these features
+	// see https://datatracker.ietf.org/doc/html/draft-ietf-openpgp-crypto-refresh#features-subpacket
+	SEIPDv1, SEIPDv2 bool
+
+	// EmbeddedSignature, if non-nil, is a signature of the parent key, by
+	// this key. This prevents an attacker from claiming another's signing
+	// subkey as their own.
+	EmbeddedSignature *Signature
+
+	outSubpackets []outputSubpacket
+}
+
+func (sig *Signature) parse(r io.Reader) (err error) {
+	// RFC 4880, section 5.2.3
+	var buf [5]byte
+	_, err = readFull(r, buf[:1])
+	if err != nil {
+		return
+	}
+	if buf[0] != 4 && buf[0] != 5 {
+		err = errors.UnsupportedError("signature packet version " + strconv.Itoa(int(buf[0])))
+		return
+	}
+	sig.Version = int(buf[0])
+	_, err = readFull(r, buf[:5])
+	if err != nil {
+		return
+	}
+	sig.SigType = SignatureType(buf[0])
+	sig.PubKeyAlgo = PublicKeyAlgorithm(buf[1])
+	switch sig.PubKeyAlgo {
+	case PubKeyAlgoRSA, PubKeyAlgoRSASignOnly, PubKeyAlgoDSA, PubKeyAlgoECDSA, PubKeyAlgoEdDSA:
+	default:
+		err = errors.UnsupportedError("public key algorithm " + strconv.Itoa(int(sig.PubKeyAlgo)))
+		return
+	}
+
+	var ok bool
+
+	if sig.Version < 5 {
+		sig.Hash, ok = algorithm.HashIdToHashWithSha1(buf[2])
+	} else {
+		sig.Hash, ok = algorithm.HashIdToHash(buf[2])
+	}
+
+	if !ok {
+		return errors.UnsupportedError("hash function " + strconv.Itoa(int(buf[2])))
+	}
+
+	hashedSubpacketsLength := int(buf[3])<<8 | int(buf[4])
+	hashedSubpackets := make([]byte, hashedSubpacketsLength)
+	_, err = readFull(r, hashedSubpackets)
+	if err != nil {
+		return
+	}
+	err = sig.buildHashSuffix(hashedSubpackets)
+	if err != nil {
+		return
+	}
+
+	err = parseSignatureSubpackets(sig, hashedSubpackets, true)
+	if err != nil {
+		return
+	}
+
+	_, err = readFull(r, buf[:2])
+	if err != nil {
+		return
+	}
+	unhashedSubpacketsLength := int(buf[0])<<8 | int(buf[1])
+	unhashedSubpackets := make([]byte, unhashedSubpacketsLength)
+	_, err = readFull(r, unhashedSubpackets)
+	if err != nil {
+		return
+	}
+	err = parseSignatureSubpackets(sig, unhashedSubpackets, false)
+	if err != nil {
+		return
+	}
+
+	_, err = readFull(r, sig.HashTag[:2])
+	if err != nil {
+		return
+	}
+
+	switch sig.PubKeyAlgo {
+	case PubKeyAlgoRSA, PubKeyAlgoRSASignOnly:
+		sig.RSASignature = new(encoding.MPI)
+		_, err = sig.RSASignature.ReadFrom(r)
+	case PubKeyAlgoDSA:
+		sig.DSASigR = new(encoding.MPI)
+		if _, err = sig.DSASigR.ReadFrom(r); err != nil {
+			return
+		}
+
+		sig.DSASigS = new(encoding.MPI)
+		_, err = sig.DSASigS.ReadFrom(r)
+	case PubKeyAlgoECDSA:
+		sig.ECDSASigR = new(encoding.MPI)
+		if _, err = sig.ECDSASigR.ReadFrom(r); err != nil {
+			return
+		}
+
+		sig.ECDSASigS = new(encoding.MPI)
+		_, err = sig.ECDSASigS.ReadFrom(r)
+	case PubKeyAlgoEdDSA:
+		sig.EdDSASigR = new(encoding.MPI)
+		if _, err = sig.EdDSASigR.ReadFrom(r); err != nil {
+			return
+		}
+
+		sig.EdDSASigS = new(encoding.MPI)
+		if _, err = sig.EdDSASigS.ReadFrom(r); err != nil {
+			return
+		}
+	default:
+		panic("unreachable")
+	}
+	return
+}
+
+// parseSignatureSubpackets parses subpackets of the main signature packet. See
+// RFC 4880, section 5.2.3.1.
+func parseSignatureSubpackets(sig *Signature, subpackets []byte, isHashed bool) (err error) {
+	for len(subpackets) > 0 {
+		subpackets, err = parseSignatureSubpacket(sig, subpackets, isHashed)
+		if err != nil {
+			return
+		}
+	}
+
+	if sig.CreationTime.IsZero() {
+		err = errors.StructuralError("no creation time in signature")
+	}
+
+	return
+}
+
+type signatureSubpacketType uint8
+
+const (
+	creationTimeSubpacket        signatureSubpacketType = 2
+	signatureExpirationSubpacket signatureSubpacketType = 3
+	trustSubpacket               signatureSubpacketType = 5
+	regularExpressionSubpacket   signatureSubpacketType = 6
+	keyExpirationSubpacket       signatureSubpacketType = 9
+	prefSymmetricAlgosSubpacket  signatureSubpacketType = 11
+	issuerSubpacket              signatureSubpacketType = 16
+	notationDataSubpacket        signatureSubpacketType = 20
+	prefHashAlgosSubpacket       signatureSubpacketType = 21
+	prefCompressionSubpacket     signatureSubpacketType = 22
+	primaryUserIdSubpacket       signatureSubpacketType = 25
+	policyUriSubpacket           signatureSubpacketType = 26
+	keyFlagsSubpacket            signatureSubpacketType = 27
+	signerUserIdSubpacket        signatureSubpacketType = 28
+	reasonForRevocationSubpacket signatureSubpacketType = 29
+	featuresSubpacket            signatureSubpacketType = 30
+	embeddedSignatureSubpacket   signatureSubpacketType = 32
+	issuerFingerprintSubpacket   signatureSubpacketType = 33
+	prefCipherSuitesSubpacket    signatureSubpacketType = 39
+)
+
+// parseSignatureSubpacket parses a single subpacket. len(subpacket) is >= 1.
+func parseSignatureSubpacket(sig *Signature, subpacket []byte, isHashed bool) (rest []byte, err error) {
+	// RFC 4880, section 5.2.3.1
+	var (
+		length     uint32
+		packetType signatureSubpacketType
+		isCritical bool
+	)
+	if len(subpacket) == 0 {
+		err = errors.StructuralError("zero length signature subpacket")
+		return
+	}
+	switch {
+	case subpacket[0] < 192:
+		length = uint32(subpacket[0])
+		subpacket = subpacket[1:]
+	case subpacket[0] < 255:
+		if len(subpacket) < 2 {
+			goto Truncated
+		}
+		length = uint32(subpacket[0]-192)<<8 + uint32(subpacket[1]) + 192
+		subpacket = subpacket[2:]
+	default:
+		if len(subpacket) < 5 {
+			goto Truncated
+		}
+		length = uint32(subpacket[1])<<24 |
+			uint32(subpacket[2])<<16 |
+			uint32(subpacket[3])<<8 |
+			uint32(subpacket[4])
+		subpacket = subpacket[5:]
+	}
+	if length > uint32(len(subpacket)) {
+		goto Truncated
+	}
+	rest = subpacket[length:]
+	subpacket = subpacket[:length]
+	if len(subpacket) == 0 {
+		err = errors.StructuralError("zero length signature subpacket")
+		return
+	}
+	packetType = signatureSubpacketType(subpacket[0] & 0x7f)
+	isCritical = subpacket[0]&0x80 == 0x80
+	subpacket = subpacket[1:]
+	sig.rawSubpackets = append(sig.rawSubpackets, outputSubpacket{isHashed, packetType, isCritical, subpacket})
+	if !isHashed &&
+		packetType != issuerSubpacket &&
+		packetType != issuerFingerprintSubpacket &&
+		packetType != embeddedSignatureSubpacket {
+		return
+	}
+	switch packetType {
+	case creationTimeSubpacket:
+		if len(subpacket) != 4 {
+			err = errors.StructuralError("signature creation time not four bytes")
+			return
+		}
+		t := binary.BigEndian.Uint32(subpacket)
+		sig.CreationTime = time.Unix(int64(t), 0)
+	case signatureExpirationSubpacket:
+		// Signature expiration time, section 5.2.3.10
+		if len(subpacket) != 4 {
+			err = errors.StructuralError("expiration subpacket with bad length")
+			return
+		}
+		sig.SigLifetimeSecs = new(uint32)
+		*sig.SigLifetimeSecs = binary.BigEndian.Uint32(subpacket)
+	case trustSubpacket:
+		if len(subpacket) != 2 {
+			err = errors.StructuralError("trust subpacket with bad length")
+			return
+		}
+		// Trust level and amount, section 5.2.3.13
+		sig.TrustLevel = TrustLevel(subpacket[0])
+		sig.TrustAmount = TrustAmount(subpacket[1])
+	case regularExpressionSubpacket:
+		if len(subpacket) == 0 {
+			err = errors.StructuralError("regexp subpacket with bad length")
+			return
+		}
+		// Trust regular expression, section 5.2.3.14
+		// RFC specifies the string should be null-terminated; remove a null byte from the end
+		if subpacket[len(subpacket)-1] != 0x00 {
+			err = errors.StructuralError("expected regular expression to be null-terminated")
+			return
+		}
+		trustRegularExpression := string(subpacket[:len(subpacket)-1])
+		sig.TrustRegularExpression = &trustRegularExpression
+	case keyExpirationSubpacket:
+		// Key expiration time, section 5.2.3.6
+		if len(subpacket) != 4 {
+			err = errors.StructuralError("key expiration subpacket with bad length")
+			return
+		}
+		sig.KeyLifetimeSecs = new(uint32)
+		*sig.KeyLifetimeSecs = binary.BigEndian.Uint32(subpacket)
+	case prefSymmetricAlgosSubpacket:
+		// Preferred symmetric algorithms, section 5.2.3.7
+		sig.PreferredSymmetric = make([]byte, len(subpacket))
+		copy(sig.PreferredSymmetric, subpacket)
+	case issuerSubpacket:
+		// Issuer, section 5.2.3.5
+		if sig.Version > 4 {
+			err = errors.StructuralError("issuer subpacket found in v5 key")
+			return
+		}
+		if len(subpacket) != 8 {
+			err = errors.StructuralError("issuer subpacket with bad length")
+			return
+		}
+		sig.IssuerKeyId = new(uint64)
+		*sig.IssuerKeyId = binary.BigEndian.Uint64(subpacket)
+	case notationDataSubpacket:
+		// Notation data, section 5.2.3.16
+		if len(subpacket) < 8 {
+			err = errors.StructuralError("notation data subpacket with bad length")
+			return
+		}
+
+		nameLength := uint32(subpacket[4])<<8 | uint32(subpacket[5])
+		valueLength := uint32(subpacket[6])<<8 | uint32(subpacket[7])
+		if len(subpacket) != int(nameLength)+int(valueLength)+8 {
+			err = errors.StructuralError("notation data subpacket with bad length")
+			return
+		}
+
+		notation := Notation{
+			IsHumanReadable: (subpacket[0] & 0x80) == 0x80,
+			Name:            string(subpacket[8:(nameLength + 8)]),
+			Value:           subpacket[(nameLength + 8):(valueLength + nameLength + 8)],
+			IsCritical:      isCritical,
+		}
+
+		sig.Notations = append(sig.Notations, &notation)
+	case prefHashAlgosSubpacket:
+		// Preferred hash algorithms, section 5.2.3.8
+		sig.PreferredHash = make([]byte, len(subpacket))
+		copy(sig.PreferredHash, subpacket)
+	case prefCompressionSubpacket:
+		// Preferred compression algorithms, section 5.2.3.9
+		sig.PreferredCompression = make([]byte, len(subpacket))
+		copy(sig.PreferredCompression, subpacket)
+	case primaryUserIdSubpacket:
+		// Primary User ID, section 5.2.3.19
+		if len(subpacket) != 1 {
+			err = errors.StructuralError("primary user id subpacket with bad length")
+			return
+		}
+		sig.IsPrimaryId = new(bool)
+		if subpacket[0] > 0 {
+			*sig.IsPrimaryId = true
+		}
+	case keyFlagsSubpacket:
+		// Key flags, section 5.2.3.21
+		if len(subpacket) == 0 {
+			err = errors.StructuralError("empty key flags subpacket")
+			return
+		}
+		sig.FlagsValid = true
+		if subpacket[0]&KeyFlagCertify != 0 {
+			sig.FlagCertify = true
+		}
+		if subpacket[0]&KeyFlagSign != 0 {
+			sig.FlagSign = true
+		}
+		if subpacket[0]&KeyFlagEncryptCommunications != 0 {
+			sig.FlagEncryptCommunications = true
+		}
+		if subpacket[0]&KeyFlagEncryptStorage != 0 {
+			sig.FlagEncryptStorage = true
+		}
+		if subpacket[0]&KeyFlagSplitKey != 0 {
+			sig.FlagSplitKey = true
+		}
+		if subpacket[0]&KeyFlagAuthenticate != 0 {
+			sig.FlagAuthenticate = true
+		}
+		if subpacket[0]&KeyFlagGroupKey != 0 {
+			sig.FlagGroupKey = true
+		}
+	case signerUserIdSubpacket:
+		userId := string(subpacket)
+		sig.SignerUserId = &userId
+	case reasonForRevocationSubpacket:
+		// Reason For Revocation, section 5.2.3.23
+		if len(subpacket) == 0 {
+			err = errors.StructuralError("empty revocation reason subpacket")
+			return
+		}
+		sig.RevocationReason = new(ReasonForRevocation)
+		*sig.RevocationReason = ReasonForRevocation(subpacket[0])
+		sig.RevocationReasonText = string(subpacket[1:])
+	case featuresSubpacket:
+		// Features subpacket, section 5.2.3.24 specifies a very general
+		// mechanism for OpenPGP implementations to signal support for new
+		// features.
+		if len(subpacket) > 0 {
+			if subpacket[0]&0x01 != 0 {
+				sig.SEIPDv1 = true
+			}
+			// 0x02 and 0x04 are reserved
+			if subpacket[0]&0x08 != 0 {
+				sig.SEIPDv2 = true
+			}
+		}
+	case embeddedSignatureSubpacket:
+		// Only usage is in signatures that cross-certify
+		// signing subkeys. section 5.2.3.26 describes the
+		// format, with its usage described in section 11.1
+		if sig.EmbeddedSignature != nil {
+			err = errors.StructuralError("Cannot have multiple embedded signatures")
+			return
+		}
+		sig.EmbeddedSignature = new(Signature)
+		// Embedded signatures are required to be v4 signatures see
+		// section 12.1. However, we only parse v4 signatures in this
+		// file anyway.
+		if err := sig.EmbeddedSignature.parse(bytes.NewBuffer(subpacket)); err != nil {
+			return nil, err
+		}
+		if sigType := sig.EmbeddedSignature.SigType; sigType != SigTypePrimaryKeyBinding {
+			return nil, errors.StructuralError("cross-signature has unexpected type " + strconv.Itoa(int(sigType)))
+		}
+	case policyUriSubpacket:
+		// Policy URI, section 5.2.3.20
+		sig.PolicyURI = string(subpacket)
+	case issuerFingerprintSubpacket:
+		if len(subpacket) == 0 {
+			err = errors.StructuralError("empty issuer fingerprint subpacket")
+			return
+		}
+		v, l := subpacket[0], len(subpacket[1:])
+		if v == 5 && l != 32 || v != 5 && l != 20 {
+			return nil, errors.StructuralError("bad fingerprint length")
+		}
+		sig.IssuerFingerprint = make([]byte, l)
+		copy(sig.IssuerFingerprint, subpacket[1:])
+		sig.IssuerKeyId = new(uint64)
+		if v == 5 {
+			*sig.IssuerKeyId = binary.BigEndian.Uint64(subpacket[1:9])
+		} else {
+			*sig.IssuerKeyId = binary.BigEndian.Uint64(subpacket[13:21])
+		}
+	case prefCipherSuitesSubpacket:
+		// Preferred AEAD cipher suites
+		// See https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-07.html#name-preferred-aead-ciphersuites
+		if len(subpacket)%2 != 0 {
+			err = errors.StructuralError("invalid aead cipher suite length")
+			return
+		}
+
+		sig.PreferredCipherSuites = make([][2]byte, len(subpacket)/2)
+
+		for i := 0; i < len(subpacket)/2; i++ {
+			sig.PreferredCipherSuites[i] = [2]uint8{subpacket[2*i], subpacket[2*i+1]}
+		}
+	default:
+		if isCritical {
+			err = errors.UnsupportedError("unknown critical signature subpacket type " + strconv.Itoa(int(packetType)))
+			return
+		}
+	}
+	return
+
+Truncated:
+	err = errors.StructuralError("signature subpacket truncated")
+	return
+}
+
+// subpacketLengthLength returns the length, in bytes, of an encoded length value.
+func subpacketLengthLength(length int) int {
+	if length < 192 {
+		return 1
+	}
+	if length < 16320 {
+		return 2
+	}
+	return 5
+}
+
+func (sig *Signature) CheckKeyIdOrFingerprint(pk *PublicKey) bool {
+	if sig.IssuerFingerprint != nil && len(sig.IssuerFingerprint) >= 20 {
+		return bytes.Equal(sig.IssuerFingerprint, pk.Fingerprint)
+	}
+	return sig.IssuerKeyId != nil && *sig.IssuerKeyId == pk.KeyId
+}
+
+// serializeSubpacketLength marshals the given length into to.
+func serializeSubpacketLength(to []byte, length int) int {
+	// RFC 4880, Section 4.2.2.
+	if length < 192 {
+		to[0] = byte(length)
+		return 1
+	}
+	if length < 16320 {
+		length -= 192
+		to[0] = byte((length >> 8) + 192)
+		to[1] = byte(length)
+		return 2
+	}
+	to[0] = 255
+	to[1] = byte(length >> 24)
+	to[2] = byte(length >> 16)
+	to[3] = byte(length >> 8)
+	to[4] = byte(length)
+	return 5
+}
+
+// subpacketsLength returns the serialized length, in bytes, of the given
+// subpackets.
+func subpacketsLength(subpackets []outputSubpacket, hashed bool) (length int) {
+	for _, subpacket := range subpackets {
+		if subpacket.hashed == hashed {
+			length += subpacketLengthLength(len(subpacket.contents) + 1)
+			length += 1 // type byte
+			length += len(subpacket.contents)
+		}
+	}
+	return
+}
+
+// serializeSubpackets marshals the given subpackets into to.
+func serializeSubpackets(to []byte, subpackets []outputSubpacket, hashed bool) {
+	for _, subpacket := range subpackets {
+		if subpacket.hashed == hashed {
+			n := serializeSubpacketLength(to, len(subpacket.contents)+1)
+			to[n] = byte(subpacket.subpacketType)
+			if subpacket.isCritical {
+				to[n] |= 0x80
+			}
+			to = to[1+n:]
+			n = copy(to, subpacket.contents)
+			to = to[n:]
+		}
+	}
+	return
+}
+
+// SigExpired returns whether sig is a signature that has expired or is created
+// in the future.
+func (sig *Signature) SigExpired(currentTime time.Time) bool {
+	if sig.CreationTime.After(currentTime) {
+		return true
+	}
+	if sig.SigLifetimeSecs == nil || *sig.SigLifetimeSecs == 0 {
+		return false
+	}
+	expiry := sig.CreationTime.Add(time.Duration(*sig.SigLifetimeSecs) * time.Second)
+	return currentTime.After(expiry)
+}
+
+// buildHashSuffix constructs the HashSuffix member of sig in preparation for signing.
+func (sig *Signature) buildHashSuffix(hashedSubpackets []byte) (err error) {
+	var hashId byte
+	var ok bool
+
+	if sig.Version < 5 {
+		hashId, ok = algorithm.HashToHashIdWithSha1(sig.Hash)
+	} else {
+		hashId, ok = algorithm.HashToHashId(sig.Hash)
+	}
+
+	if !ok {
+		sig.HashSuffix = nil
+		return errors.InvalidArgumentError("hash cannot be represented in OpenPGP: " + strconv.Itoa(int(sig.Hash)))
+	}
+
+	hashedFields := bytes.NewBuffer([]byte{
+		uint8(sig.Version),
+		uint8(sig.SigType),
+		uint8(sig.PubKeyAlgo),
+		uint8(hashId),
+		uint8(len(hashedSubpackets) >> 8),
+		uint8(len(hashedSubpackets)),
+	})
+	hashedFields.Write(hashedSubpackets)
+
+	var l uint64 = uint64(6 + len(hashedSubpackets))
+	if sig.Version == 5 {
+		hashedFields.Write([]byte{0x05, 0xff})
+		hashedFields.Write([]byte{
+			uint8(l >> 56), uint8(l >> 48), uint8(l >> 40), uint8(l >> 32),
+			uint8(l >> 24), uint8(l >> 16), uint8(l >> 8), uint8(l),
+		})
+	} else {
+		hashedFields.Write([]byte{0x04, 0xff})
+		hashedFields.Write([]byte{
+			uint8(l >> 24), uint8(l >> 16), uint8(l >> 8), uint8(l),
+		})
+	}
+	sig.HashSuffix = make([]byte, hashedFields.Len())
+	copy(sig.HashSuffix, hashedFields.Bytes())
+	return
+}
+
+func (sig *Signature) signPrepareHash(h hash.Hash) (digest []byte, err error) {
+	hashedSubpacketsLen := subpacketsLength(sig.outSubpackets, true)
+	hashedSubpackets := make([]byte, hashedSubpacketsLen)
+	serializeSubpackets(hashedSubpackets, sig.outSubpackets, true)
+	err = sig.buildHashSuffix(hashedSubpackets)
+	if err != nil {
+		return
+	}
+	if sig.Version == 5 && (sig.SigType == 0x00 || sig.SigType == 0x01) {
+		sig.AddMetadataToHashSuffix()
+	}
+
+	h.Write(sig.HashSuffix)
+	digest = h.Sum(nil)
+	copy(sig.HashTag[:], digest)
+	return
+}
+
+// Sign signs a message with a private key. The hash, h, must contain
+// the hash of the message to be signed and will be mutated by this function.
+// On success, the signature is stored in sig. Call Serialize to write it out.
+// If config is nil, sensible defaults will be used.
+func (sig *Signature) Sign(h hash.Hash, priv *PrivateKey, config *Config) (err error) {
+	if priv.Dummy() {
+		return errors.ErrDummyPrivateKey("dummy key found")
+	}
+	sig.Version = priv.PublicKey.Version
+	sig.IssuerFingerprint = priv.PublicKey.Fingerprint
+	sig.outSubpackets, err = sig.buildSubpackets(priv.PublicKey)
+	if err != nil {
+		return err
+	}
+	digest, err := sig.signPrepareHash(h)
+	if err != nil {
+		return
+	}
+	switch priv.PubKeyAlgo {
+	case PubKeyAlgoRSA, PubKeyAlgoRSASignOnly:
+		// supports both *rsa.PrivateKey and crypto.Signer
+		sigdata, err := priv.PrivateKey.(crypto.Signer).Sign(config.Random(), digest, sig.Hash)
+		if err == nil {
+			sig.RSASignature = encoding.NewMPI(sigdata)
+		}
+	case PubKeyAlgoDSA:
+		dsaPriv := priv.PrivateKey.(*dsa.PrivateKey)
+
+		// Need to truncate hashBytes to match FIPS 186-3 section 4.6.
+		subgroupSize := (dsaPriv.Q.BitLen() + 7) / 8
+		if len(digest) > subgroupSize {
+			digest = digest[:subgroupSize]
+		}
+		r, s, err := dsa.Sign(config.Random(), dsaPriv, digest)
+		if err == nil {
+			sig.DSASigR = new(encoding.MPI).SetBig(r)
+			sig.DSASigS = new(encoding.MPI).SetBig(s)
+		}
+	case PubKeyAlgoECDSA:
+		sk := priv.PrivateKey.(*ecdsa.PrivateKey)
+		r, s, err := ecdsa.Sign(config.Random(), sk, digest)
+
+		if err == nil {
+			sig.ECDSASigR = new(encoding.MPI).SetBig(r)
+			sig.ECDSASigS = new(encoding.MPI).SetBig(s)
+		}
+	case PubKeyAlgoEdDSA:
+		sk := priv.PrivateKey.(*eddsa.PrivateKey)
+		r, s, err := eddsa.Sign(sk, digest)
+		if err == nil {
+			sig.EdDSASigR = encoding.NewMPI(r)
+			sig.EdDSASigS = encoding.NewMPI(s)
+		}
+	default:
+		err = errors.UnsupportedError("public key algorithm: " + strconv.Itoa(int(sig.PubKeyAlgo)))
+	}
+
+	return
+}
+
+// SignUserId computes a signature from priv, asserting that pub is a valid
+// key for the identity id.  On success, the signature is stored in sig. Call
+// Serialize to write it out.
+// If config is nil, sensible defaults will be used.
+func (sig *Signature) SignUserId(id string, pub *PublicKey, priv *PrivateKey, config *Config) error {
+	if priv.Dummy() {
+		return errors.ErrDummyPrivateKey("dummy key found")
+	}
+	h, err := userIdSignatureHash(id, pub, sig.Hash)
+	if err != nil {
+		return err
+	}
+	return sig.Sign(h, priv, config)
+}
+
+// CrossSignKey computes a signature from signingKey on pub hashed using hashKey. On success,
+// the signature is stored in sig. Call Serialize to write it out.
+// If config is nil, sensible defaults will be used.
+func (sig *Signature) CrossSignKey(pub *PublicKey, hashKey *PublicKey, signingKey *PrivateKey,
+	config *Config) error {
+	h, err := keySignatureHash(hashKey, pub, sig.Hash)
+	if err != nil {
+		return err
+	}
+	return sig.Sign(h, signingKey, config)
+}
+
+// SignKey computes a signature from priv, asserting that pub is a subkey. On
+// success, the signature is stored in sig. Call Serialize to write it out.
+// If config is nil, sensible defaults will be used.
+func (sig *Signature) SignKey(pub *PublicKey, priv *PrivateKey, config *Config) error {
+	if priv.Dummy() {
+		return errors.ErrDummyPrivateKey("dummy key found")
+	}
+	h, err := keySignatureHash(&priv.PublicKey, pub, sig.Hash)
+	if err != nil {
+		return err
+	}
+	return sig.Sign(h, priv, config)
+}
+
+// RevokeKey computes a revocation signature of pub using priv. On success, the signature is
+// stored in sig. Call Serialize to write it out.
+// If config is nil, sensible defaults will be used.
+func (sig *Signature) RevokeKey(pub *PublicKey, priv *PrivateKey, config *Config) error {
+	h, err := keyRevocationHash(pub, sig.Hash)
+	if err != nil {
+		return err
+	}
+	return sig.Sign(h, priv, config)
+}
+
+// RevokeSubkey computes a subkey revocation signature of pub using priv.
+// On success, the signature is stored in sig. Call Serialize to write it out.
+// If config is nil, sensible defaults will be used.
+func (sig *Signature) RevokeSubkey(pub *PublicKey, priv *PrivateKey, config *Config) error {
+	// Identical to a subkey binding signature
+	return sig.SignKey(pub, priv, config)
+}
+
+// Serialize marshals sig to w. Sign, SignUserId or SignKey must have been
+// called first.
+func (sig *Signature) Serialize(w io.Writer) (err error) {
+	if len(sig.outSubpackets) == 0 {
+		sig.outSubpackets = sig.rawSubpackets
+	}
+	if sig.RSASignature == nil && sig.DSASigR == nil && sig.ECDSASigR == nil && sig.EdDSASigR == nil {
+		return errors.InvalidArgumentError("Signature: need to call Sign, SignUserId or SignKey before Serialize")
+	}
+
+	sigLength := 0
+	switch sig.PubKeyAlgo {
+	case PubKeyAlgoRSA, PubKeyAlgoRSASignOnly:
+		sigLength = int(sig.RSASignature.EncodedLength())
+	case PubKeyAlgoDSA:
+		sigLength = int(sig.DSASigR.EncodedLength())
+		sigLength += int(sig.DSASigS.EncodedLength())
+	case PubKeyAlgoECDSA:
+		sigLength = int(sig.ECDSASigR.EncodedLength())
+		sigLength += int(sig.ECDSASigS.EncodedLength())
+	case PubKeyAlgoEdDSA:
+		sigLength = int(sig.EdDSASigR.EncodedLength())
+		sigLength += int(sig.EdDSASigS.EncodedLength())
+	default:
+		panic("impossible")
+	}
+
+	unhashedSubpacketsLen := subpacketsLength(sig.outSubpackets, false)
+	length := len(sig.HashSuffix) - 6 /* trailer not included */ +
+		2 /* length of unhashed subpackets */ + unhashedSubpacketsLen +
+		2 /* hash tag */ + sigLength
+	if sig.Version == 5 {
+		length -= 4 // eight-octet instead of four-octet big endian
+	}
+	err = serializeHeader(w, packetTypeSignature, length)
+	if err != nil {
+		return
+	}
+	err = sig.serializeBody(w)
+	if err != nil {
+		return err
+	}
+	return
+}
+
+func (sig *Signature) serializeBody(w io.Writer) (err error) {
+	hashedSubpacketsLen := uint16(uint16(sig.HashSuffix[4])<<8) | uint16(sig.HashSuffix[5])
+	fields := sig.HashSuffix[:6+hashedSubpacketsLen]
+	_, err = w.Write(fields)
+	if err != nil {
+		return
+	}
+
+	unhashedSubpacketsLen := subpacketsLength(sig.outSubpackets, false)
+	unhashedSubpackets := make([]byte, 2+unhashedSubpacketsLen)
+	unhashedSubpackets[0] = byte(unhashedSubpacketsLen >> 8)
+	unhashedSubpackets[1] = byte(unhashedSubpacketsLen)
+	serializeSubpackets(unhashedSubpackets[2:], sig.outSubpackets, false)
+
+	_, err = w.Write(unhashedSubpackets)
+	if err != nil {
+		return
+	}
+	_, err = w.Write(sig.HashTag[:])
+	if err != nil {
+		return
+	}
+
+	switch sig.PubKeyAlgo {
+	case PubKeyAlgoRSA, PubKeyAlgoRSASignOnly:
+		_, err = w.Write(sig.RSASignature.EncodedBytes())
+	case PubKeyAlgoDSA:
+		if _, err = w.Write(sig.DSASigR.EncodedBytes()); err != nil {
+			return
+		}
+		_, err = w.Write(sig.DSASigS.EncodedBytes())
+	case PubKeyAlgoECDSA:
+		if _, err = w.Write(sig.ECDSASigR.EncodedBytes()); err != nil {
+			return
+		}
+		_, err = w.Write(sig.ECDSASigS.EncodedBytes())
+	case PubKeyAlgoEdDSA:
+		if _, err = w.Write(sig.EdDSASigR.EncodedBytes()); err != nil {
+			return
+		}
+		_, err = w.Write(sig.EdDSASigS.EncodedBytes())
+	default:
+		panic("impossible")
+	}
+	return
+}
+
+// outputSubpacket represents a subpacket to be marshaled.
+type outputSubpacket struct {
+	hashed        bool // true if this subpacket is in the hashed area.
+	subpacketType signatureSubpacketType
+	isCritical    bool
+	contents      []byte
+}
+
+func (sig *Signature) buildSubpackets(issuer PublicKey) (subpackets []outputSubpacket, err error) {
+	creationTime := make([]byte, 4)
+	binary.BigEndian.PutUint32(creationTime, uint32(sig.CreationTime.Unix()))
+	subpackets = append(subpackets, outputSubpacket{true, creationTimeSubpacket, false, creationTime})
+
+	if sig.IssuerKeyId != nil && sig.Version == 4 {
+		keyId := make([]byte, 8)
+		binary.BigEndian.PutUint64(keyId, *sig.IssuerKeyId)
+		subpackets = append(subpackets, outputSubpacket{true, issuerSubpacket, false, keyId})
+	}
+	if sig.IssuerFingerprint != nil {
+		contents := append([]uint8{uint8(issuer.Version)}, sig.IssuerFingerprint...)
+		subpackets = append(subpackets, outputSubpacket{true, issuerFingerprintSubpacket, sig.Version == 5, contents})
+	}
+	if sig.SignerUserId != nil {
+		subpackets = append(subpackets, outputSubpacket{true, signerUserIdSubpacket, false, []byte(*sig.SignerUserId)})
+	}
+	if sig.SigLifetimeSecs != nil && *sig.SigLifetimeSecs != 0 {
+		sigLifetime := make([]byte, 4)
+		binary.BigEndian.PutUint32(sigLifetime, *sig.SigLifetimeSecs)
+		subpackets = append(subpackets, outputSubpacket{true, signatureExpirationSubpacket, true, sigLifetime})
+	}
+
+	// Key flags may only appear in self-signatures or certification signatures.
+
+	if sig.FlagsValid {
+		var flags byte
+		if sig.FlagCertify {
+			flags |= KeyFlagCertify
+		}
+		if sig.FlagSign {
+			flags |= KeyFlagSign
+		}
+		if sig.FlagEncryptCommunications {
+			flags |= KeyFlagEncryptCommunications
+		}
+		if sig.FlagEncryptStorage {
+			flags |= KeyFlagEncryptStorage
+		}
+		if sig.FlagSplitKey {
+			flags |= KeyFlagSplitKey
+		}
+		if sig.FlagAuthenticate {
+			flags |= KeyFlagAuthenticate
+		}
+		if sig.FlagGroupKey {
+			flags |= KeyFlagGroupKey
+		}
+		subpackets = append(subpackets, outputSubpacket{true, keyFlagsSubpacket, false, []byte{flags}})
+	}
+
+	for _, notation := range sig.Notations {
+		subpackets = append(
+			subpackets,
+			outputSubpacket{
+				true,
+				notationDataSubpacket,
+				notation.IsCritical,
+				notation.getData(),
+			})
+	}
+
+	// The following subpackets may only appear in self-signatures.
+
+	var features = byte(0x00)
+	if sig.SEIPDv1 {
+		features |= 0x01
+	}
+	if sig.SEIPDv2 {
+		features |= 0x08
+	}
+
+	if features != 0x00 {
+		subpackets = append(subpackets, outputSubpacket{true, featuresSubpacket, false, []byte{features}})
+	}
+
+	if sig.TrustLevel != 0 {
+		subpackets = append(subpackets, outputSubpacket{true, trustSubpacket, true, []byte{byte(sig.TrustLevel), byte(sig.TrustAmount)}})
+	}
+
+	if sig.TrustRegularExpression != nil {
+		// RFC specifies the string should be null-terminated; add a null byte to the end
+		subpackets = append(subpackets, outputSubpacket{true, regularExpressionSubpacket, true, []byte(*sig.TrustRegularExpression + "\000")})
+	}
+
+	if sig.KeyLifetimeSecs != nil && *sig.KeyLifetimeSecs != 0 {
+		keyLifetime := make([]byte, 4)
+		binary.BigEndian.PutUint32(keyLifetime, *sig.KeyLifetimeSecs)
+		subpackets = append(subpackets, outputSubpacket{true, keyExpirationSubpacket, true, keyLifetime})
+	}
+
+	if sig.IsPrimaryId != nil && *sig.IsPrimaryId {
+		subpackets = append(subpackets, outputSubpacket{true, primaryUserIdSubpacket, false, []byte{1}})
+	}
+
+	if len(sig.PreferredSymmetric) > 0 {
+		subpackets = append(subpackets, outputSubpacket{true, prefSymmetricAlgosSubpacket, false, sig.PreferredSymmetric})
+	}
+
+	if len(sig.PreferredHash) > 0 {
+		subpackets = append(subpackets, outputSubpacket{true, prefHashAlgosSubpacket, false, sig.PreferredHash})
+	}
+
+	if len(sig.PreferredCompression) > 0 {
+		subpackets = append(subpackets, outputSubpacket{true, prefCompressionSubpacket, false, sig.PreferredCompression})
+	}
+
+	if len(sig.PolicyURI) > 0 {
+		subpackets = append(subpackets, outputSubpacket{true, policyUriSubpacket, false, []uint8(sig.PolicyURI)})
+	}
+
+	if len(sig.PreferredCipherSuites) > 0 {
+		serialized := make([]byte, len(sig.PreferredCipherSuites)*2)
+		for i, cipherSuite := range sig.PreferredCipherSuites {
+			serialized[2*i] = cipherSuite[0]
+			serialized[2*i+1] = cipherSuite[1]
+		}
+		subpackets = append(subpackets, outputSubpacket{true, prefCipherSuitesSubpacket, false, serialized})
+	}
+
+	// Revocation reason appears only in revocation signatures and is serialized as per section 5.2.3.23.
+	if sig.RevocationReason != nil {
+		subpackets = append(subpackets, outputSubpacket{true, reasonForRevocationSubpacket, true,
+			append([]uint8{uint8(*sig.RevocationReason)}, []uint8(sig.RevocationReasonText)...)})
+	}
+
+	// EmbeddedSignature appears only in subkeys capable of signing and is serialized as per section 5.2.3.26.
+	if sig.EmbeddedSignature != nil {
+		var buf bytes.Buffer
+		err = sig.EmbeddedSignature.serializeBody(&buf)
+		if err != nil {
+			return
+		}
+		subpackets = append(subpackets, outputSubpacket{true, embeddedSignatureSubpacket, true, buf.Bytes()})
+	}
+
+	return
+}
+
+// AddMetadataToHashSuffix modifies the current hash suffix to include metadata
+// (format, filename, and time). Version 5 keys protect this data including it
+// in the hash computation. See section 5.2.4.
+func (sig *Signature) AddMetadataToHashSuffix() {
+	if sig == nil || sig.Version != 5 {
+		return
+	}
+	if sig.SigType != 0x00 && sig.SigType != 0x01 {
+		return
+	}
+	lit := sig.Metadata
+	if lit == nil {
+		// This will translate into six 0x00 bytes.
+		lit = &LiteralData{}
+	}
+
+	// Extract the current byte count
+	n := sig.HashSuffix[len(sig.HashSuffix)-8:]
+	l := uint64(
+		uint64(n[0])<<56 | uint64(n[1])<<48 | uint64(n[2])<<40 | uint64(n[3])<<32 |
+			uint64(n[4])<<24 | uint64(n[5])<<16 | uint64(n[6])<<8 | uint64(n[7]))
+
+	suffix := bytes.NewBuffer(nil)
+	suffix.Write(sig.HashSuffix[:l])
+
+	// Add the metadata
+	var buf [4]byte
+	buf[0] = lit.Format
+	fileName := lit.FileName
+	if len(lit.FileName) > 255 {
+		fileName = fileName[:255]
+	}
+	buf[1] = byte(len(fileName))
+	suffix.Write(buf[:2])
+	suffix.Write([]byte(lit.FileName))
+	binary.BigEndian.PutUint32(buf[:], lit.Time)
+	suffix.Write(buf[:])
+
+	// Update the counter and restore trailing bytes
+	l = uint64(suffix.Len())
+	suffix.Write([]byte{0x05, 0xff})
+	suffix.Write([]byte{
+		uint8(l >> 56), uint8(l >> 48), uint8(l >> 40), uint8(l >> 32),
+		uint8(l >> 24), uint8(l >> 16), uint8(l >> 8), uint8(l),
+	})
+	sig.HashSuffix = suffix.Bytes()
+}
diff --git a/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/packet/symmetric_key_encrypted.go b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/packet/symmetric_key_encrypted.go
new file mode 100644
index 00000000000..bac2b132ea2
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/packet/symmetric_key_encrypted.go
@@ -0,0 +1,276 @@
+// Copyright 2011 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package packet
+
+import (
+	"bytes"
+	"crypto/cipher"
+	"io"
+	"strconv"
+
+	"github.com/ProtonMail/go-crypto/openpgp/errors"
+	"github.com/ProtonMail/go-crypto/openpgp/s2k"
+)
+
+// This is the largest session key that we'll support. Since at most 256-bit cipher
+// is supported in OpenPGP, this is large enough to contain also the auth tag.
+const maxSessionKeySizeInBytes = 64
+
+// SymmetricKeyEncrypted represents a passphrase protected session key. See RFC
+// 4880, section 5.3.
+type SymmetricKeyEncrypted struct {
+	Version      int
+	CipherFunc   CipherFunction
+	Mode         AEADMode
+	s2k          func(out, in []byte)
+	iv           []byte
+	encryptedKey []byte // Contains also the authentication tag for AEAD
+}
+
+// parse parses an SymmetricKeyEncrypted packet as specified in
+// https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-07.html#name-symmetric-key-encrypted-ses
+func (ske *SymmetricKeyEncrypted) parse(r io.Reader) error {
+	var buf [1]byte
+
+	// Version
+	if _, err := readFull(r, buf[:]); err != nil {
+		return err
+	}
+	ske.Version = int(buf[0])
+	if ske.Version != 4 && ske.Version != 5 {
+		return errors.UnsupportedError("unknown SymmetricKeyEncrypted version")
+	}
+
+	// Cipher function
+	if _, err := readFull(r, buf[:]); err != nil {
+		return err
+	}
+	ske.CipherFunc = CipherFunction(buf[0])
+	if !ske.CipherFunc.IsSupported() {
+		return errors.UnsupportedError("unknown cipher: " + strconv.Itoa(int(buf[0])))
+	}
+
+	if ske.Version == 5 {
+		// AEAD mode
+		if _, err := readFull(r, buf[:]); err != nil {
+			return errors.StructuralError("cannot read AEAD octet from packet")
+		}
+		ske.Mode = AEADMode(buf[0])
+	}
+
+	var err error
+	if ske.s2k, err = s2k.Parse(r); err != nil {
+		if _, ok := err.(errors.ErrDummyPrivateKey); ok {
+			return errors.UnsupportedError("missing key GNU extension in session key")
+		}
+		return err
+	}
+
+	if ske.Version == 5 {
+		// AEAD IV
+		iv := make([]byte, ske.Mode.IvLength())
+		_, err := readFull(r, iv)
+		if err != nil {
+			return errors.StructuralError("cannot read AEAD IV")
+		}
+
+		ske.iv = iv
+	}
+
+	encryptedKey := make([]byte, maxSessionKeySizeInBytes)
+	// The session key may follow. We just have to try and read to find
+	// out. If it exists then we limit it to maxSessionKeySizeInBytes.
+	n, err := readFull(r, encryptedKey)
+	if err != nil && err != io.ErrUnexpectedEOF {
+		return err
+	}
+
+	if n != 0 {
+		if n == maxSessionKeySizeInBytes {
+			return errors.UnsupportedError("oversized encrypted session key")
+		}
+		ske.encryptedKey = encryptedKey[:n]
+	}
+	return nil
+}
+
+// Decrypt attempts to decrypt an encrypted session key and returns the key and
+// the cipher to use when decrypting a subsequent Symmetrically Encrypted Data
+// packet.
+func (ske *SymmetricKeyEncrypted) Decrypt(passphrase []byte) ([]byte, CipherFunction, error) {
+	key := make([]byte, ske.CipherFunc.KeySize())
+	ske.s2k(key, passphrase)
+	if len(ske.encryptedKey) == 0 {
+		return key, ske.CipherFunc, nil
+	}
+	switch ske.Version {
+	case 4:
+		plaintextKey, cipherFunc, err := ske.decryptV4(key)
+		return plaintextKey, cipherFunc, err
+	case 5:
+		plaintextKey, err := ske.decryptV5(key)
+		return plaintextKey, CipherFunction(0), err
+	}
+	err := errors.UnsupportedError("unknown SymmetricKeyEncrypted version")
+	return nil, CipherFunction(0), err
+}
+
+func (ske *SymmetricKeyEncrypted) decryptV4(key []byte) ([]byte, CipherFunction, error) {
+	// the IV is all zeros
+	iv := make([]byte, ske.CipherFunc.blockSize())
+	c := cipher.NewCFBDecrypter(ske.CipherFunc.new(key), iv)
+	plaintextKey := make([]byte, len(ske.encryptedKey))
+	c.XORKeyStream(plaintextKey, ske.encryptedKey)
+	cipherFunc := CipherFunction(plaintextKey[0])
+	if cipherFunc.blockSize() == 0 {
+		return nil, ske.CipherFunc, errors.UnsupportedError(
+			"unknown cipher: " + strconv.Itoa(int(cipherFunc)))
+	}
+	plaintextKey = plaintextKey[1:]
+	if len(plaintextKey) != cipherFunc.KeySize() {
+		return nil, cipherFunc, errors.StructuralError(
+			"length of decrypted key not equal to cipher keysize")
+	}
+	return plaintextKey, cipherFunc, nil
+}
+
+func (ske *SymmetricKeyEncrypted) decryptV5(key []byte) ([]byte, error) {
+	adata := []byte{0xc3, byte(5), byte(ske.CipherFunc), byte(ske.Mode)}
+	aead := getEncryptedKeyAeadInstance(ske.CipherFunc, ske.Mode, key, adata)
+
+	plaintextKey, err := aead.Open(nil, ske.iv, ske.encryptedKey, adata)
+	if err != nil {
+		return nil, err
+	}
+	return plaintextKey, nil
+}
+
+// SerializeSymmetricKeyEncrypted serializes a symmetric key packet to w.
+// The packet contains a random session key, encrypted by a key derived from
+// the given passphrase. The session key is returned and must be passed to
+// SerializeSymmetricallyEncrypted.
+// If config is nil, sensible defaults will be used.
+func SerializeSymmetricKeyEncrypted(w io.Writer, passphrase []byte, config *Config) (key []byte, err error) {
+	cipherFunc := config.Cipher()
+
+	sessionKey := make([]byte, cipherFunc.KeySize())
+	_, err = io.ReadFull(config.Random(), sessionKey)
+	if err != nil {
+		return
+	}
+
+	err = SerializeSymmetricKeyEncryptedReuseKey(w, sessionKey, passphrase, config)
+	if err != nil {
+		return
+	}
+
+	key = sessionKey
+	return
+}
+
+// SerializeSymmetricKeyEncryptedReuseKey serializes a symmetric key packet to w.
+// The packet contains the given session key, encrypted by a key derived from
+// the given passphrase. The returned session key must be passed to
+// SerializeSymmetricallyEncrypted.
+// If config is nil, sensible defaults will be used.
+func SerializeSymmetricKeyEncryptedReuseKey(w io.Writer, sessionKey []byte, passphrase []byte, config *Config) (err error) {
+	var version int
+	if config.AEAD() != nil {
+		version = 5
+	} else {
+		version = 4
+	}
+	cipherFunc := config.Cipher()
+	// cipherFunc must be AES
+	if !cipherFunc.IsSupported() || cipherFunc < CipherAES128 || cipherFunc > CipherAES256 {
+		return errors.UnsupportedError("unsupported cipher: " + strconv.Itoa(int(cipherFunc)))
+	}
+
+	keySize := cipherFunc.KeySize()
+	s2kBuf := new(bytes.Buffer)
+	keyEncryptingKey := make([]byte, keySize)
+	// s2k.Serialize salts and stretches the passphrase, and writes the
+	// resulting key to keyEncryptingKey and the s2k descriptor to s2kBuf.
+	err = s2k.Serialize(s2kBuf, keyEncryptingKey, config.Random(), passphrase, config.S2K())
+	if err != nil {
+		return
+	}
+	s2kBytes := s2kBuf.Bytes()
+
+	var packetLength int
+	switch version {
+	case 4:
+		packetLength = 2 /* header */ + len(s2kBytes) + 1 /* cipher type */ + keySize
+	case 5:
+		ivLen := config.AEAD().Mode().IvLength()
+		tagLen := config.AEAD().Mode().TagLength()
+		packetLength = 3 + len(s2kBytes) + ivLen + keySize + tagLen
+	}
+	err = serializeHeader(w, packetTypeSymmetricKeyEncrypted, packetLength)
+	if err != nil {
+		return
+	}
+
+	// Symmetric Key Encrypted Version
+	buf := []byte{byte(version)}
+
+	// Cipher function
+	buf = append(buf, byte(cipherFunc))
+
+	if version == 5 {
+		// AEAD mode
+		buf = append(buf, byte(config.AEAD().Mode()))
+	}
+	_, err = w.Write(buf)
+	if err != nil {
+		return
+	}
+	_, err = w.Write(s2kBytes)
+	if err != nil {
+		return
+	}
+
+	switch version {
+	case 4:
+		iv := make([]byte, cipherFunc.blockSize())
+		c := cipher.NewCFBEncrypter(cipherFunc.new(keyEncryptingKey), iv)
+		encryptedCipherAndKey := make([]byte, keySize+1)
+		c.XORKeyStream(encryptedCipherAndKey, buf[1:])
+		c.XORKeyStream(encryptedCipherAndKey[1:], sessionKey)
+		_, err = w.Write(encryptedCipherAndKey)
+		if err != nil {
+			return
+		}
+	case 5:
+		mode := config.AEAD().Mode()
+		adata := []byte{0xc3, byte(5), byte(cipherFunc), byte(mode)}
+		aead := getEncryptedKeyAeadInstance(cipherFunc, mode, keyEncryptingKey, adata)
+
+		// Sample iv using random reader
+		iv := make([]byte, config.AEAD().Mode().IvLength())
+		_, err = io.ReadFull(config.Random(), iv)
+		if err != nil {
+			return
+		}
+		// Seal and write (encryptedData includes auth. tag)
+
+		encryptedData := aead.Seal(nil, iv, sessionKey, adata)
+		_, err = w.Write(iv)
+		if err != nil {
+			return
+		}
+		_, err = w.Write(encryptedData)
+		if err != nil {
+			return
+		}
+	}
+
+	return
+}
+
+func getEncryptedKeyAeadInstance(c CipherFunction, mode AEADMode, inputKey, associatedData []byte) (aead cipher.AEAD) {
+	blockCipher := c.new(inputKey)
+	return mode.new(blockCipher)
+}
diff --git a/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/packet/symmetrically_encrypted.go b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/packet/symmetrically_encrypted.go
new file mode 100644
index 00000000000..609e9fc1fbf
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/packet/symmetrically_encrypted.go
@@ -0,0 +1,90 @@
+// Copyright 2011 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package packet
+
+import (
+	"io"
+
+	"github.com/ProtonMail/go-crypto/openpgp/errors"
+)
+
+const aeadSaltSize = 32
+
+// SymmetricallyEncrypted represents a symmetrically encrypted byte string. The
+// encrypted Contents will consist of more OpenPGP packets. See RFC 4880,
+// sections 5.7 and 5.13.
+type SymmetricallyEncrypted struct {
+	Version            int
+	Contents           io.Reader // contains tag for version 2
+	IntegrityProtected bool      // If true it is type 18 (with MDC or AEAD). False is packet type 9
+
+	// Specific to version 1
+	prefix []byte
+
+	// Specific to version 2
+	cipher        CipherFunction
+	mode          AEADMode
+	chunkSizeByte byte
+	salt          [aeadSaltSize]byte
+}
+
+const (
+	symmetricallyEncryptedVersionMdc  = 1
+	symmetricallyEncryptedVersionAead = 2
+)
+
+func (se *SymmetricallyEncrypted) parse(r io.Reader) error {
+	if se.IntegrityProtected {
+		// See RFC 4880, section 5.13.
+		var buf [1]byte
+		_, err := readFull(r, buf[:])
+		if err != nil {
+			return err
+		}
+
+		switch buf[0] {
+		case symmetricallyEncryptedVersionMdc:
+			se.Version = symmetricallyEncryptedVersionMdc
+		case symmetricallyEncryptedVersionAead:
+			se.Version = symmetricallyEncryptedVersionAead
+			if err := se.parseAead(r); err != nil {
+				return err
+			}
+		default:
+			return errors.UnsupportedError("unknown SymmetricallyEncrypted version")
+		}
+	}
+	se.Contents = r
+	return nil
+}
+
+// Decrypt returns a ReadCloser, from which the decrypted Contents of the
+// packet can be read. An incorrect key will only be detected after trying
+// to decrypt the entire data.
+func (se *SymmetricallyEncrypted) Decrypt(c CipherFunction, key []byte) (io.ReadCloser, error) {
+	if se.Version == symmetricallyEncryptedVersionAead {
+		return se.decryptAead(key)
+	}
+
+	return se.decryptMdc(c, key)
+}
+
+// SerializeSymmetricallyEncrypted serializes a symmetrically encrypted packet
+// to w and returns a WriteCloser to which the to-be-encrypted packets can be
+// written.
+// If config is nil, sensible defaults will be used.
+func SerializeSymmetricallyEncrypted(w io.Writer, c CipherFunction, aeadSupported bool, cipherSuite CipherSuite, key []byte, config *Config) (Contents io.WriteCloser, err error) {
+	writeCloser := noOpCloser{w}
+	ciphertext, err := serializeStreamHeader(writeCloser, packetTypeSymmetricallyEncryptedIntegrityProtected)
+	if err != nil {
+		return
+	}
+
+	if aeadSupported {
+		return serializeSymmetricallyEncryptedAead(ciphertext, cipherSuite, config.AEADConfig.ChunkSizeByte(), config.Random(), key)
+	}
+
+	return serializeSymmetricallyEncryptedMdc(ciphertext, c, key, config)
+}
diff --git a/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/packet/symmetrically_encrypted_aead.go b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/packet/symmetrically_encrypted_aead.go
new file mode 100644
index 00000000000..969c4223697
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/packet/symmetrically_encrypted_aead.go
@@ -0,0 +1,155 @@
+// Copyright 2023 Proton AG. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package packet
+
+import (
+	"crypto/cipher"
+	"crypto/sha256"
+	"github.com/ProtonMail/go-crypto/openpgp/errors"
+	"golang.org/x/crypto/hkdf"
+	"io"
+)
+
+// parseAead parses a V2 SEIPD packet (AEAD) as specified in
+// https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-07.html#section-5.13.2
+func (se *SymmetricallyEncrypted) parseAead(r io.Reader) error {
+	headerData := make([]byte, 3)
+	if n, err := io.ReadFull(r, headerData); n < 3 {
+		return errors.StructuralError("could not read aead header: " + err.Error())
+	}
+
+	// Cipher
+	se.cipher = CipherFunction(headerData[0])
+	// cipherFunc must have block size 16 to use AEAD
+	if se.cipher.blockSize() != 16 {
+		return errors.UnsupportedError("invalid aead cipher: " + string(se.cipher))
+	}
+
+	// Mode
+	se.mode = AEADMode(headerData[1])
+	if se.mode.TagLength() == 0 {
+		return errors.UnsupportedError("unknown aead mode: " + string(se.mode))
+	}
+
+	// Chunk size
+	se.chunkSizeByte = headerData[2]
+	if se.chunkSizeByte > 16 {
+		return errors.UnsupportedError("invalid aead chunk size byte: " + string(se.chunkSizeByte))
+	}
+
+	// Salt
+	if n, err := io.ReadFull(r, se.salt[:]); n < aeadSaltSize {
+		return errors.StructuralError("could not read aead salt: " + err.Error())
+	}
+
+	return nil
+}
+
+// associatedData for chunks: tag, version, cipher, mode, chunk size byte
+func (se *SymmetricallyEncrypted) associatedData() []byte {
+	return []byte{
+		0xD2,
+		symmetricallyEncryptedVersionAead,
+		byte(se.cipher),
+		byte(se.mode),
+		se.chunkSizeByte,
+	}
+}
+
+// decryptAead decrypts a V2 SEIPD packet (AEAD) as specified in
+// https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-07.html#section-5.13.2
+func (se *SymmetricallyEncrypted) decryptAead(inputKey []byte) (io.ReadCloser, error) {
+	aead, nonce := getSymmetricallyEncryptedAeadInstance(se.cipher, se.mode, inputKey, se.salt[:], se.associatedData())
+
+	// Carry the first tagLen bytes
+	tagLen := se.mode.TagLength()
+	peekedBytes := make([]byte, tagLen)
+	n, err := io.ReadFull(se.Contents, peekedBytes)
+	if n < tagLen || (err != nil && err != io.EOF) {
+		return nil, errors.StructuralError("not enough data to decrypt:" + err.Error())
+	}
+
+	return &aeadDecrypter{
+		aeadCrypter: aeadCrypter{
+			aead:           aead,
+			chunkSize:      decodeAEADChunkSize(se.chunkSizeByte),
+			initialNonce:   nonce,
+			associatedData: se.associatedData(),
+			chunkIndex:     make([]byte, 8),
+			packetTag:      packetTypeSymmetricallyEncryptedIntegrityProtected,
+		},
+		reader:      se.Contents,
+		peekedBytes: peekedBytes,
+	}, nil
+}
+
+// serializeSymmetricallyEncryptedAead encrypts to a writer a V2 SEIPD packet (AEAD) as specified in
+// https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-07.html#section-5.13.2
+func serializeSymmetricallyEncryptedAead(ciphertext io.WriteCloser, cipherSuite CipherSuite, chunkSizeByte byte, rand io.Reader, inputKey []byte) (Contents io.WriteCloser, err error) {
+	// cipherFunc must have block size 16 to use AEAD
+	if cipherSuite.Cipher.blockSize() != 16 {
+		return nil, errors.InvalidArgumentError("invalid aead cipher function")
+	}
+
+	if cipherSuite.Cipher.KeySize() != len(inputKey) {
+		return nil, errors.InvalidArgumentError("error in aead serialization: bad key length")
+	}
+
+	// Data for en/decryption: tag, version, cipher, aead mode, chunk size
+	prefix := []byte{
+		0xD2,
+		symmetricallyEncryptedVersionAead,
+		byte(cipherSuite.Cipher),
+		byte(cipherSuite.Mode),
+		chunkSizeByte,
+	}
+
+	// Write header (that correspond to prefix except first byte)
+	n, err := ciphertext.Write(prefix[1:])
+	if err != nil || n < 4 {
+		return nil, err
+	}
+
+	// Random salt
+	salt := make([]byte, aeadSaltSize)
+	if _, err := rand.Read(salt); err != nil {
+		return nil, err
+	}
+
+	if _, err := ciphertext.Write(salt); err != nil {
+		return nil, err
+	}
+
+	aead, nonce := getSymmetricallyEncryptedAeadInstance(cipherSuite.Cipher, cipherSuite.Mode, inputKey, salt, prefix)
+
+	return &aeadEncrypter{
+		aeadCrypter: aeadCrypter{
+			aead:           aead,
+			chunkSize:      decodeAEADChunkSize(chunkSizeByte),
+			associatedData: prefix,
+			chunkIndex:     make([]byte, 8),
+			initialNonce:   nonce,
+			packetTag:      packetTypeSymmetricallyEncryptedIntegrityProtected,
+		},
+		writer: ciphertext,
+	}, nil
+}
+
+func getSymmetricallyEncryptedAeadInstance(c CipherFunction, mode AEADMode, inputKey, salt, associatedData []byte) (aead cipher.AEAD, nonce []byte) {
+	hkdfReader := hkdf.New(sha256.New, inputKey, salt, associatedData)
+
+	encryptionKey := make([]byte, c.KeySize())
+	_, _ = readFull(hkdfReader, encryptionKey)
+
+	// Last 64 bits of nonce are the counter
+	nonce = make([]byte, mode.IvLength()-8)
+
+	_, _ = readFull(hkdfReader, nonce)
+
+	blockCipher := c.new(encryptionKey)
+	aead = mode.new(blockCipher)
+
+	return
+}
diff --git a/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/packet/symmetrically_encrypted_mdc.go b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/packet/symmetrically_encrypted_mdc.go
new file mode 100644
index 00000000000..fa26bebe382
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/packet/symmetrically_encrypted_mdc.go
@@ -0,0 +1,256 @@
+// Copyright 2011 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package packet
+
+import (
+	"crypto/cipher"
+	"crypto/sha1"
+	"crypto/subtle"
+	"hash"
+	"io"
+	"strconv"
+
+	"github.com/ProtonMail/go-crypto/openpgp/errors"
+)
+
+// seMdcReader wraps an io.Reader with a no-op Close method.
+type seMdcReader struct {
+	in io.Reader
+}
+
+func (ser seMdcReader) Read(buf []byte) (int, error) {
+	return ser.in.Read(buf)
+}
+
+func (ser seMdcReader) Close() error {
+	return nil
+}
+
+func (se *SymmetricallyEncrypted) decryptMdc(c CipherFunction, key []byte) (io.ReadCloser, error) {
+	if !c.IsSupported() {
+		return nil, errors.UnsupportedError("unsupported cipher: " + strconv.Itoa(int(c)))
+	}
+
+	if len(key) != c.KeySize() {
+		return nil, errors.InvalidArgumentError("SymmetricallyEncrypted: incorrect key length")
+	}
+
+	if se.prefix == nil {
+		se.prefix = make([]byte, c.blockSize()+2)
+		_, err := readFull(se.Contents, se.prefix)
+		if err != nil {
+			return nil, err
+		}
+	} else if len(se.prefix) != c.blockSize()+2 {
+		return nil, errors.InvalidArgumentError("can't try ciphers with different block lengths")
+	}
+
+	ocfbResync := OCFBResync
+	if se.IntegrityProtected {
+		// MDC packets use a different form of OCFB mode.
+		ocfbResync = OCFBNoResync
+	}
+
+	s := NewOCFBDecrypter(c.new(key), se.prefix, ocfbResync)
+
+	plaintext := cipher.StreamReader{S: s, R: se.Contents}
+
+	if se.IntegrityProtected {
+		// IntegrityProtected packets have an embedded hash that we need to check.
+		h := sha1.New()
+		h.Write(se.prefix)
+		return &seMDCReader{in: plaintext, h: h}, nil
+	}
+
+	// Otherwise, we just need to wrap plaintext so that it's a valid ReadCloser.
+	return seMdcReader{plaintext}, nil
+}
+
+const mdcTrailerSize = 1 /* tag byte */ + 1 /* length byte */ + sha1.Size
+
+// An seMDCReader wraps an io.Reader, maintains a running hash and keeps hold
+// of the most recent 22 bytes (mdcTrailerSize). Upon EOF, those bytes form an
+// MDC packet containing a hash of the previous Contents which is checked
+// against the running hash. See RFC 4880, section 5.13.
+type seMDCReader struct {
+	in          io.Reader
+	h           hash.Hash
+	trailer     [mdcTrailerSize]byte
+	scratch     [mdcTrailerSize]byte
+	trailerUsed int
+	error       bool
+	eof         bool
+}
+
+func (ser *seMDCReader) Read(buf []byte) (n int, err error) {
+	if ser.error {
+		err = io.ErrUnexpectedEOF
+		return
+	}
+	if ser.eof {
+		err = io.EOF
+		return
+	}
+
+	// If we haven't yet filled the trailer buffer then we must do that
+	// first.
+	for ser.trailerUsed < mdcTrailerSize {
+		n, err = ser.in.Read(ser.trailer[ser.trailerUsed:])
+		ser.trailerUsed += n
+		if err == io.EOF {
+			if ser.trailerUsed != mdcTrailerSize {
+				n = 0
+				err = io.ErrUnexpectedEOF
+				ser.error = true
+				return
+			}
+			ser.eof = true
+			n = 0
+			return
+		}
+
+		if err != nil {
+			n = 0
+			return
+		}
+	}
+
+	// If it's a short read then we read into a temporary buffer and shift
+	// the data into the caller's buffer.
+	if len(buf) <= mdcTrailerSize {
+		n, err = readFull(ser.in, ser.scratch[:len(buf)])
+		copy(buf, ser.trailer[:n])
+		ser.h.Write(buf[:n])
+		copy(ser.trailer[:], ser.trailer[n:])
+		copy(ser.trailer[mdcTrailerSize-n:], ser.scratch[:])
+		if n < len(buf) {
+			ser.eof = true
+			err = io.EOF
+		}
+		return
+	}
+
+	n, err = ser.in.Read(buf[mdcTrailerSize:])
+	copy(buf, ser.trailer[:])
+	ser.h.Write(buf[:n])
+	copy(ser.trailer[:], buf[n:])
+
+	if err == io.EOF {
+		ser.eof = true
+	}
+	return
+}
+
+// This is a new-format packet tag byte for a type 19 (Integrity Protected) packet.
+const mdcPacketTagByte = byte(0x80) | 0x40 | 19
+
+func (ser *seMDCReader) Close() error {
+	if ser.error {
+		return errors.ErrMDCMissing
+	}
+
+	for !ser.eof {
+		// We haven't seen EOF so we need to read to the end
+		var buf [1024]byte
+		_, err := ser.Read(buf[:])
+		if err == io.EOF {
+			break
+		}
+		if err != nil {
+			return errors.ErrMDCMissing
+		}
+	}
+
+	ser.h.Write(ser.trailer[:2])
+
+	final := ser.h.Sum(nil)
+	if subtle.ConstantTimeCompare(final, ser.trailer[2:]) != 1 {
+		return errors.ErrMDCHashMismatch
+	}
+	// The hash already includes the MDC header, but we still check its value
+	// to confirm encryption correctness
+	if ser.trailer[0] != mdcPacketTagByte || ser.trailer[1] != sha1.Size {
+		return errors.ErrMDCMissing
+	}
+	return nil
+}
+
+// An seMDCWriter writes through to an io.WriteCloser while maintains a running
+// hash of the data written. On close, it emits an MDC packet containing the
+// running hash.
+type seMDCWriter struct {
+	w io.WriteCloser
+	h hash.Hash
+}
+
+func (w *seMDCWriter) Write(buf []byte) (n int, err error) {
+	w.h.Write(buf)
+	return w.w.Write(buf)
+}
+
+func (w *seMDCWriter) Close() (err error) {
+	var buf [mdcTrailerSize]byte
+
+	buf[0] = mdcPacketTagByte
+	buf[1] = sha1.Size
+	w.h.Write(buf[:2])
+	digest := w.h.Sum(nil)
+	copy(buf[2:], digest)
+
+	_, err = w.w.Write(buf[:])
+	if err != nil {
+		return
+	}
+	return w.w.Close()
+}
+
+// noOpCloser is like an ioutil.NopCloser, but for an io.Writer.
+type noOpCloser struct {
+	w io.Writer
+}
+
+func (c noOpCloser) Write(data []byte) (n int, err error) {
+	return c.w.Write(data)
+}
+
+func (c noOpCloser) Close() error {
+	return nil
+}
+
+func serializeSymmetricallyEncryptedMdc(ciphertext io.WriteCloser, c CipherFunction, key []byte, config *Config) (Contents io.WriteCloser, err error) {
+	// Disallow old cipher suites
+	if !c.IsSupported() || c < CipherAES128 {
+		return nil, errors.InvalidArgumentError("invalid mdc cipher function")
+	}
+
+	if c.KeySize() != len(key) {
+		return nil, errors.InvalidArgumentError("error in mdc serialization: bad key length")
+	}
+
+	_, err = ciphertext.Write([]byte{symmetricallyEncryptedVersionMdc})
+	if err != nil {
+		return
+	}
+
+	block := c.new(key)
+	blockSize := block.BlockSize()
+	iv := make([]byte, blockSize)
+	_, err = config.Random().Read(iv)
+	if err != nil {
+		return
+	}
+	s, prefix := NewOCFBEncrypter(block, iv, OCFBNoResync)
+	_, err = ciphertext.Write(prefix)
+	if err != nil {
+		return
+	}
+	plaintext := cipher.StreamWriter{S: s, W: ciphertext}
+
+	h := sha1.New()
+	h.Write(iv)
+	h.Write(iv[blockSize-2:])
+	Contents = &seMDCWriter{w: plaintext, h: h}
+	return
+}
diff --git a/.ci/providerlint/vendor/golang.org/x/crypto/openpgp/packet/userattribute.go b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/packet/userattribute.go
similarity index 87%
rename from .ci/providerlint/vendor/golang.org/x/crypto/openpgp/packet/userattribute.go
rename to .ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/packet/userattribute.go
index ff7ef530755..88ec72c6c4a 100644
--- a/.ci/providerlint/vendor/golang.org/x/crypto/openpgp/packet/userattribute.go
+++ b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/packet/userattribute.go
@@ -9,6 +9,7 @@ import (
 	"image"
 	"image/jpeg"
 	"io"
+	"io/ioutil"
 )
 
 const UserAttrImageSubpacket = 1
@@ -41,9 +42,16 @@ func NewUserAttributePhoto(photos ...image.Image) (uat *UserAttribute, err error
 		if err = jpeg.Encode(&buf, photo, nil); err != nil {
 			return
 		}
+
+		lengthBuf := make([]byte, 5)
+		n := serializeSubpacketLength(lengthBuf, len(buf.Bytes())+1)
+		lengthBuf = lengthBuf[:n]
+
 		uat.Contents = append(uat.Contents, &OpaqueSubpacket{
-			SubType:  UserAttrImageSubpacket,
-			Contents: buf.Bytes()})
+			SubType:       UserAttrImageSubpacket,
+			EncodedLength: lengthBuf,
+			Contents:      buf.Bytes(),
+		})
 	}
 	return
 }
@@ -55,7 +63,7 @@ func NewUserAttribute(contents ...*OpaqueSubpacket) *UserAttribute {
 
 func (uat *UserAttribute) parse(r io.Reader) (err error) {
 	// RFC 4880, section 5.13
-	b, err := io.ReadAll(r)
+	b, err := ioutil.ReadAll(r)
 	if err != nil {
 		return
 	}
@@ -68,7 +76,10 @@ func (uat *UserAttribute) parse(r io.Reader) (err error) {
 func (uat *UserAttribute) Serialize(w io.Writer) (err error) {
 	var buf bytes.Buffer
 	for _, sp := range uat.Contents {
-		sp.Serialize(&buf)
+		err = sp.Serialize(&buf)
+		if err != nil {
+			return err
+		}
 	}
 	if err = serializeHeader(w, packetTypeUserAttribute, buf.Len()); err != nil {
 		return err
diff --git a/.ci/providerlint/vendor/golang.org/x/crypto/openpgp/packet/userid.go b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/packet/userid.go
similarity index 95%
rename from .ci/providerlint/vendor/golang.org/x/crypto/openpgp/packet/userid.go
rename to .ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/packet/userid.go
index 359a462eb8a..614fbafd5e1 100644
--- a/.ci/providerlint/vendor/golang.org/x/crypto/openpgp/packet/userid.go
+++ b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/packet/userid.go
@@ -6,6 +6,7 @@ package packet
 
 import (
 	"io"
+	"io/ioutil"
 	"strings"
 )
 
@@ -65,7 +66,7 @@ func NewUserId(name, comment, email string) *UserId {
 
 func (uid *UserId) parse(r io.Reader) (err error) {
 	// RFC 4880, section 5.11
-	b, err := io.ReadAll(r)
+	b, err := ioutil.ReadAll(r)
 	if err != nil {
 		return
 	}
@@ -155,5 +156,12 @@ func parseUserId(id string) (name, comment, email string) {
 	name = strings.TrimSpace(id[n.start:n.end])
 	comment = strings.TrimSpace(id[c.start:c.end])
 	email = strings.TrimSpace(id[e.start:e.end])
+
+	// RFC 2822 3.4: alternate simple form of a mailbox
+	if email == "" && strings.ContainsRune(name, '@') {
+		email = name
+		name = ""
+	}
+
 	return
 }
diff --git a/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/read.go b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/read.go
new file mode 100644
index 00000000000..8499c73790d
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/read.go
@@ -0,0 +1,592 @@
+// Copyright 2011 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// Package openpgp implements high level operations on OpenPGP messages.
+package openpgp // import "github.com/ProtonMail/go-crypto/openpgp"
+
+import (
+	"crypto"
+	_ "crypto/sha256"
+	_ "crypto/sha512"
+	"hash"
+	"io"
+	"strconv"
+
+	"github.com/ProtonMail/go-crypto/openpgp/armor"
+	"github.com/ProtonMail/go-crypto/openpgp/errors"
+	"github.com/ProtonMail/go-crypto/openpgp/internal/algorithm"
+	"github.com/ProtonMail/go-crypto/openpgp/packet"
+	_ "golang.org/x/crypto/sha3"
+)
+
+// SignatureType is the armor type for a PGP signature.
+var SignatureType = "PGP SIGNATURE"
+
+// readArmored reads an armored block with the given type.
+func readArmored(r io.Reader, expectedType string) (body io.Reader, err error) {
+	block, err := armor.Decode(r)
+	if err != nil {
+		return
+	}
+
+	if block.Type != expectedType {
+		return nil, errors.InvalidArgumentError("expected '" + expectedType + "', got: " + block.Type)
+	}
+
+	return block.Body, nil
+}
+
+// MessageDetails contains the result of parsing an OpenPGP encrypted and/or
+// signed message.
+type MessageDetails struct {
+	IsEncrypted              bool                // true if the message was encrypted.
+	EncryptedToKeyIds        []uint64            // the list of recipient key ids.
+	IsSymmetricallyEncrypted bool                // true if a passphrase could have decrypted the message.
+	DecryptedWith            Key                 // the private key used to decrypt the message, if any.
+	IsSigned                 bool                // true if the message is signed.
+	SignedByKeyId            uint64              // the key id of the signer, if any.
+	SignedBy                 *Key                // the key of the signer, if available.
+	LiteralData              *packet.LiteralData // the metadata of the contents
+	UnverifiedBody           io.Reader           // the contents of the message.
+
+	// If IsSigned is true and SignedBy is non-zero then the signature will
+	// be verified as UnverifiedBody is read. The signature cannot be
+	// checked until the whole of UnverifiedBody is read so UnverifiedBody
+	// must be consumed until EOF before the data can be trusted. Even if a
+	// message isn't signed (or the signer is unknown) the data may contain
+	// an authentication code that is only checked once UnverifiedBody has
+	// been consumed. Once EOF has been seen, the following fields are
+	// valid. (An authentication code failure is reported as a
+	// SignatureError error when reading from UnverifiedBody.)
+	Signature            *packet.Signature   // the signature packet itself.
+	SignatureError       error               // nil if the signature is good.
+	UnverifiedSignatures []*packet.Signature // all other unverified signature packets.
+
+	decrypted io.ReadCloser
+}
+
+// A PromptFunction is used as a callback by functions that may need to decrypt
+// a private key, or prompt for a passphrase. It is called with a list of
+// acceptable, encrypted private keys and a boolean that indicates whether a
+// passphrase is usable. It should either decrypt a private key or return a
+// passphrase to try. If the decrypted private key or given passphrase isn't
+// correct, the function will be called again, forever. Any error returned will
+// be passed up.
+type PromptFunction func(keys []Key, symmetric bool) ([]byte, error)
+
+// A keyEnvelopePair is used to store a private key with the envelope that
+// contains a symmetric key, encrypted with that key.
+type keyEnvelopePair struct {
+	key          Key
+	encryptedKey *packet.EncryptedKey
+}
+
+// ReadMessage parses an OpenPGP message that may be signed and/or encrypted.
+// The given KeyRing should contain both public keys (for signature
+// verification) and, possibly encrypted, private keys for decrypting.
+// If config is nil, sensible defaults will be used.
+func ReadMessage(r io.Reader, keyring KeyRing, prompt PromptFunction, config *packet.Config) (md *MessageDetails, err error) {
+	var p packet.Packet
+
+	var symKeys []*packet.SymmetricKeyEncrypted
+	var pubKeys []keyEnvelopePair
+	// Integrity protected encrypted packet: SymmetricallyEncrypted or AEADEncrypted
+	var edp packet.EncryptedDataPacket
+
+	packets := packet.NewReader(r)
+	md = new(MessageDetails)
+	md.IsEncrypted = true
+
+	// The message, if encrypted, starts with a number of packets
+	// containing an encrypted decryption key. The decryption key is either
+	// encrypted to a public key, or with a passphrase. This loop
+	// collects these packets.
+ParsePackets:
+	for {
+		p, err = packets.Next()
+		if err != nil {
+			return nil, err
+		}
+		switch p := p.(type) {
+		case *packet.SymmetricKeyEncrypted:
+			// This packet contains the decryption key encrypted with a passphrase.
+			md.IsSymmetricallyEncrypted = true
+			symKeys = append(symKeys, p)
+		case *packet.EncryptedKey:
+			// This packet contains the decryption key encrypted to a public key.
+			md.EncryptedToKeyIds = append(md.EncryptedToKeyIds, p.KeyId)
+			switch p.Algo {
+			case packet.PubKeyAlgoRSA, packet.PubKeyAlgoRSAEncryptOnly, packet.PubKeyAlgoElGamal, packet.PubKeyAlgoECDH:
+				break
+			default:
+				continue
+			}
+			if keyring != nil {
+				var keys []Key
+				if p.KeyId == 0 {
+					keys = keyring.DecryptionKeys()
+				} else {
+					keys = keyring.KeysById(p.KeyId)
+				}
+				for _, k := range keys {
+					pubKeys = append(pubKeys, keyEnvelopePair{k, p})
+				}
+			}
+		case *packet.SymmetricallyEncrypted:
+			if !p.IntegrityProtected && !config.AllowUnauthenticatedMessages() {
+				return nil, errors.UnsupportedError("message is not integrity protected")
+			}
+			edp = p
+			break ParsePackets
+		case *packet.AEADEncrypted:
+			edp = p
+			break ParsePackets
+		case *packet.Compressed, *packet.LiteralData, *packet.OnePassSignature:
+			// This message isn't encrypted.
+			if len(symKeys) != 0 || len(pubKeys) != 0 {
+				return nil, errors.StructuralError("key material not followed by encrypted message")
+			}
+			packets.Unread(p)
+			return readSignedMessage(packets, nil, keyring, config)
+		}
+	}
+
+	var candidates []Key
+	var decrypted io.ReadCloser
+
+	// Now that we have the list of encrypted keys we need to decrypt at
+	// least one of them or, if we cannot, we need to call the prompt
+	// function so that it can decrypt a key or give us a passphrase.
+FindKey:
+	for {
+		// See if any of the keys already have a private key available
+		candidates = candidates[:0]
+		candidateFingerprints := make(map[string]bool)
+
+		for _, pk := range pubKeys {
+			if pk.key.PrivateKey == nil {
+				continue
+			}
+			if !pk.key.PrivateKey.Encrypted {
+				if len(pk.encryptedKey.Key) == 0 {
+					errDec := pk.encryptedKey.Decrypt(pk.key.PrivateKey, config)
+					if errDec != nil {
+						continue
+					}
+				}
+				// Try to decrypt symmetrically encrypted
+				decrypted, err = edp.Decrypt(pk.encryptedKey.CipherFunc, pk.encryptedKey.Key)
+				if err != nil && err != errors.ErrKeyIncorrect {
+					return nil, err
+				}
+				if decrypted != nil {
+					md.DecryptedWith = pk.key
+					break FindKey
+				}
+			} else {
+				fpr := string(pk.key.PublicKey.Fingerprint[:])
+				if v := candidateFingerprints[fpr]; v {
+					continue
+				}
+				candidates = append(candidates, pk.key)
+				candidateFingerprints[fpr] = true
+			}
+		}
+
+		if len(candidates) == 0 && len(symKeys) == 0 {
+			return nil, errors.ErrKeyIncorrect
+		}
+
+		if prompt == nil {
+			return nil, errors.ErrKeyIncorrect
+		}
+
+		passphrase, err := prompt(candidates, len(symKeys) != 0)
+		if err != nil {
+			return nil, err
+		}
+
+		// Try the symmetric passphrase first
+		if len(symKeys) != 0 && passphrase != nil {
+			for _, s := range symKeys {
+				key, cipherFunc, err := s.Decrypt(passphrase)
+				// In v4, on wrong passphrase, session key decryption is very likely to result in an invalid cipherFunc:
+				// only for < 5% of cases we will proceed to decrypt the data
+				if err == nil {
+					decrypted, err = edp.Decrypt(cipherFunc, key)
+					if err != nil {
+						return nil, err
+					}
+					if decrypted != nil {
+						break FindKey
+					}
+				}
+			}
+		}
+	}
+
+	md.decrypted = decrypted
+	if err := packets.Push(decrypted); err != nil {
+		return nil, err
+	}
+	mdFinal, sensitiveParsingErr := readSignedMessage(packets, md, keyring, config)
+	if sensitiveParsingErr != nil {
+		return nil, errors.StructuralError("parsing error")
+	}
+	return mdFinal, nil
+}
+
+// readSignedMessage reads a possibly signed message if mdin is non-zero then
+// that structure is updated and returned. Otherwise a fresh MessageDetails is
+// used.
+func readSignedMessage(packets *packet.Reader, mdin *MessageDetails, keyring KeyRing, config *packet.Config) (md *MessageDetails, err error) {
+	if mdin == nil {
+		mdin = new(MessageDetails)
+	}
+	md = mdin
+
+	var p packet.Packet
+	var h hash.Hash
+	var wrappedHash hash.Hash
+	var prevLast bool
+FindLiteralData:
+	for {
+		p, err = packets.Next()
+		if err != nil {
+			return nil, err
+		}
+		switch p := p.(type) {
+		case *packet.Compressed:
+			if err := packets.Push(p.Body); err != nil {
+				return nil, err
+			}
+		case *packet.OnePassSignature:
+			if prevLast {
+				return nil, errors.UnsupportedError("nested signature packets")
+			}
+
+			if p.IsLast {
+				prevLast = true
+			}
+
+			h, wrappedHash, err = hashForSignature(p.Hash, p.SigType)
+			if err != nil {
+				md.SignatureError = err
+			}
+
+			md.IsSigned = true
+			md.SignedByKeyId = p.KeyId
+			if keyring != nil {
+				keys := keyring.KeysByIdUsage(p.KeyId, packet.KeyFlagSign)
+				if len(keys) > 0 {
+					md.SignedBy = &keys[0]
+				}
+			}
+		case *packet.LiteralData:
+			md.LiteralData = p
+			break FindLiteralData
+		}
+	}
+
+	if md.IsSigned && md.SignatureError == nil {
+		md.UnverifiedBody = &signatureCheckReader{packets, h, wrappedHash, md, config}
+	} else if md.decrypted != nil {
+		md.UnverifiedBody = checkReader{md}
+	} else {
+		md.UnverifiedBody = md.LiteralData.Body
+	}
+
+	return md, nil
+}
+
+// hashForSignature returns a pair of hashes that can be used to verify a
+// signature. The signature may specify that the contents of the signed message
+// should be preprocessed (i.e. to normalize line endings). Thus this function
+// returns two hashes. The second should be used to hash the message itself and
+// performs any needed preprocessing.
+func hashForSignature(hashFunc crypto.Hash, sigType packet.SignatureType) (hash.Hash, hash.Hash, error) {
+	if _, ok := algorithm.HashToHashIdWithSha1(hashFunc); !ok {
+		return nil, nil, errors.UnsupportedError("unsupported hash function")
+	}
+	if !hashFunc.Available() {
+		return nil, nil, errors.UnsupportedError("hash not available: " + strconv.Itoa(int(hashFunc)))
+	}
+	h := hashFunc.New()
+
+	switch sigType {
+	case packet.SigTypeBinary:
+		return h, h, nil
+	case packet.SigTypeText:
+		return h, NewCanonicalTextHash(h), nil
+	}
+
+	return nil, nil, errors.UnsupportedError("unsupported signature type: " + strconv.Itoa(int(sigType)))
+}
+
+// checkReader wraps an io.Reader from a LiteralData packet. When it sees EOF
+// it closes the ReadCloser from any SymmetricallyEncrypted packet to trigger
+// MDC checks.
+type checkReader struct {
+	md *MessageDetails
+}
+
+func (cr checkReader) Read(buf []byte) (int, error) {
+	n, sensitiveParsingError := cr.md.LiteralData.Body.Read(buf)
+	if sensitiveParsingError == io.EOF {
+		mdcErr := cr.md.decrypted.Close()
+		if mdcErr != nil {
+			return n, mdcErr
+		}
+		return n, io.EOF
+	}
+
+	if sensitiveParsingError != nil {
+		return n, errors.StructuralError("parsing error")
+	}
+
+	return n, nil
+}
+
+// signatureCheckReader wraps an io.Reader from a LiteralData packet and hashes
+// the data as it is read. When it sees an EOF from the underlying io.Reader
+// it parses and checks a trailing Signature packet and triggers any MDC checks.
+type signatureCheckReader struct {
+	packets        *packet.Reader
+	h, wrappedHash hash.Hash
+	md             *MessageDetails
+	config         *packet.Config
+}
+
+func (scr *signatureCheckReader) Read(buf []byte) (int, error) {
+	n, sensitiveParsingError := scr.md.LiteralData.Body.Read(buf)
+
+	// Hash only if required
+	if scr.md.SignedBy != nil {
+		scr.wrappedHash.Write(buf[:n])
+	}
+
+	if sensitiveParsingError == io.EOF {
+		var p packet.Packet
+		var readError error
+		var sig *packet.Signature
+
+		p, readError = scr.packets.Next()
+		for readError == nil {
+			var ok bool
+			if sig, ok = p.(*packet.Signature); ok {
+				if sig.Version == 5 && (sig.SigType == 0x00 || sig.SigType == 0x01) {
+					sig.Metadata = scr.md.LiteralData
+				}
+
+				// If signature KeyID matches
+				if scr.md.SignedBy != nil && *sig.IssuerKeyId == scr.md.SignedByKeyId {
+					key := scr.md.SignedBy
+					signatureError := key.PublicKey.VerifySignature(scr.h, sig)
+					if signatureError == nil {
+						signatureError = checkSignatureDetails(key, sig, scr.config)
+					}
+					scr.md.Signature = sig
+					scr.md.SignatureError = signatureError
+				} else {
+					scr.md.UnverifiedSignatures = append(scr.md.UnverifiedSignatures, sig)
+				}
+			}
+
+			p, readError = scr.packets.Next()
+		}
+
+		if scr.md.SignedBy != nil && scr.md.Signature == nil {
+			if scr.md.UnverifiedSignatures == nil {
+				scr.md.SignatureError = errors.StructuralError("LiteralData not followed by signature")
+			} else {
+				scr.md.SignatureError = errors.StructuralError("No matching signature found")
+			}
+		}
+
+		// The SymmetricallyEncrypted packet, if any, might have an
+		// unsigned hash of its own. In order to check this we need to
+		// close that Reader.
+		if scr.md.decrypted != nil {
+			mdcErr := scr.md.decrypted.Close()
+			if mdcErr != nil {
+				return n, mdcErr
+			}
+		}
+		return n, io.EOF
+	}
+
+	if sensitiveParsingError != nil {
+		return n, errors.StructuralError("parsing error")
+	}
+
+	return n, nil
+}
+
+// VerifyDetachedSignature takes a signed file and a detached signature and
+// returns the signature packet and the entity the signature was signed by,
+// if any, and a possible signature verification error.
+// If the signer isn't known, ErrUnknownIssuer is returned.
+func VerifyDetachedSignature(keyring KeyRing, signed, signature io.Reader, config *packet.Config) (sig *packet.Signature, signer *Entity, err error) {
+	var expectedHashes []crypto.Hash
+	return verifyDetachedSignature(keyring, signed, signature, expectedHashes, config)
+}
+
+// VerifyDetachedSignatureAndHash performs the same actions as
+// VerifyDetachedSignature and checks that the expected hash functions were used.
+func VerifyDetachedSignatureAndHash(keyring KeyRing, signed, signature io.Reader, expectedHashes []crypto.Hash, config *packet.Config) (sig *packet.Signature, signer *Entity, err error) {
+	return verifyDetachedSignature(keyring, signed, signature, expectedHashes, config)
+}
+
+// CheckDetachedSignature takes a signed file and a detached signature and
+// returns the entity the signature was signed by, if any, and a possible
+// signature verification error. If the signer isn't known,
+// ErrUnknownIssuer is returned.
+func CheckDetachedSignature(keyring KeyRing, signed, signature io.Reader, config *packet.Config) (signer *Entity, err error) {
+	var expectedHashes []crypto.Hash
+	return CheckDetachedSignatureAndHash(keyring, signed, signature, expectedHashes, config)
+}
+
+// CheckDetachedSignatureAndHash performs the same actions as
+// CheckDetachedSignature and checks that the expected hash functions were used.
+func CheckDetachedSignatureAndHash(keyring KeyRing, signed, signature io.Reader, expectedHashes []crypto.Hash, config *packet.Config) (signer *Entity, err error) {
+	_, signer, err = verifyDetachedSignature(keyring, signed, signature, expectedHashes, config)
+	return
+}
+
+func verifyDetachedSignature(keyring KeyRing, signed, signature io.Reader, expectedHashes []crypto.Hash, config *packet.Config) (sig *packet.Signature, signer *Entity, err error) {
+	var issuerKeyId uint64
+	var hashFunc crypto.Hash
+	var sigType packet.SignatureType
+	var keys []Key
+	var p packet.Packet
+
+	expectedHashesLen := len(expectedHashes)
+	packets := packet.NewReader(signature)
+	for {
+		p, err = packets.Next()
+		if err == io.EOF {
+			return nil, nil, errors.ErrUnknownIssuer
+		}
+		if err != nil {
+			return nil, nil, err
+		}
+
+		var ok bool
+		sig, ok = p.(*packet.Signature)
+		if !ok {
+			return nil, nil, errors.StructuralError("non signature packet found")
+		}
+		if sig.IssuerKeyId == nil {
+			return nil, nil, errors.StructuralError("signature doesn't have an issuer")
+		}
+		issuerKeyId = *sig.IssuerKeyId
+		hashFunc = sig.Hash
+		sigType = sig.SigType
+
+		for i, expectedHash := range expectedHashes {
+			if hashFunc == expectedHash {
+				break
+			}
+			if i+1 == expectedHashesLen {
+				return nil, nil, errors.StructuralError("hash algorithm mismatch with cleartext message headers")
+			}
+		}
+
+		keys = keyring.KeysByIdUsage(issuerKeyId, packet.KeyFlagSign)
+		if len(keys) > 0 {
+			break
+		}
+	}
+
+	if len(keys) == 0 {
+		panic("unreachable")
+	}
+
+	h, wrappedHash, err := hashForSignature(hashFunc, sigType)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	if _, err := io.Copy(wrappedHash, signed); err != nil && err != io.EOF {
+		return nil, nil, err
+	}
+
+	for _, key := range keys {
+		err = key.PublicKey.VerifySignature(h, sig)
+		if err == nil {
+			return sig, key.Entity, checkSignatureDetails(&key, sig, config)
+		}
+	}
+
+	return nil, nil, err
+}
+
+// CheckArmoredDetachedSignature performs the same actions as
+// CheckDetachedSignature but expects the signature to be armored.
+func CheckArmoredDetachedSignature(keyring KeyRing, signed, signature io.Reader, config *packet.Config) (signer *Entity, err error) {
+	body, err := readArmored(signature, SignatureType)
+	if err != nil {
+		return
+	}
+
+	return CheckDetachedSignature(keyring, signed, body, config)
+}
+
+// checkSignatureDetails returns an error if:
+//   - The signature (or one of the binding signatures mentioned below)
+//     has a unknown critical notation data subpacket
+//   - The primary key of the signing entity is revoked
+//   - The primary identity is revoked
+//   - The signature is expired
+//   - The primary key of the signing entity is expired according to the
+//     primary identity binding signature
+//
+// ... or, if the signature was signed by a subkey and:
+//   - The signing subkey is revoked
+//   - The signing subkey is expired according to the subkey binding signature
+//   - The signing subkey binding signature is expired
+//   - The signing subkey cross-signature is expired
+//
+// NOTE: The order of these checks is important, as the caller may choose to
+// ignore ErrSignatureExpired or ErrKeyExpired errors, but should never
+// ignore any other errors.
+//
+// TODO: Also return an error if:
+// - The primary key is expired according to a direct-key signature
+// - (For V5 keys only:) The direct-key signature (exists and) is expired
+func checkSignatureDetails(key *Key, signature *packet.Signature, config *packet.Config) error {
+	now := config.Now()
+	primaryIdentity := key.Entity.PrimaryIdentity()
+	signedBySubKey := key.PublicKey != key.Entity.PrimaryKey
+	sigsToCheck := []*packet.Signature{signature, primaryIdentity.SelfSignature}
+	if signedBySubKey {
+		sigsToCheck = append(sigsToCheck, key.SelfSignature, key.SelfSignature.EmbeddedSignature)
+	}
+	for _, sig := range sigsToCheck {
+		for _, notation := range sig.Notations {
+			if notation.IsCritical && !config.KnownNotation(notation.Name) {
+				return errors.SignatureError("unknown critical notation: " + notation.Name)
+			}
+		}
+	}
+	if key.Entity.Revoked(now) || // primary key is revoked
+		(signedBySubKey && key.Revoked(now)) || // subkey is revoked
+		primaryIdentity.Revoked(now) { // primary identity is revoked
+		return errors.ErrKeyRevoked
+	}
+	if key.Entity.PrimaryKey.KeyExpired(primaryIdentity.SelfSignature, now) { // primary key is expired
+		return errors.ErrKeyExpired
+	}
+	if signedBySubKey {
+		if key.PublicKey.KeyExpired(key.SelfSignature, now) { // subkey is expired
+			return errors.ErrKeyExpired
+		}
+	}
+	for _, sig := range sigsToCheck {
+		if sig.SigExpired(now) { // any of the relevant signatures are expired
+			return errors.ErrSignatureExpired
+		}
+	}
+	return nil
+}
diff --git a/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/read_write_test_data.go b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/read_write_test_data.go
new file mode 100644
index 00000000000..db6dad5c0b7
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/read_write_test_data.go
@@ -0,0 +1,274 @@
+package openpgp
+
+const testKey1KeyId uint64 = 0xA34D7E18C20C31BB
+const testKey3KeyId uint64 = 0x338934250CCC0360
+const testKeyP256KeyId uint64 = 0xd44a2c495918513e
+
+const signedInput = "Signed message\nline 2\nline 3\n"
+const signedTextInput = "Signed message\r\nline 2\r\nline 3\r\n"
+
+const recipientUnspecifiedHex = "848c0300000000000000000103ff62d4d578d03cf40c3da998dfe216c074fa6ddec5e31c197c9666ba292830d91d18716a80f699f9d897389a90e6d62d0238f5f07a5248073c0f24920e4bc4a30c2d17ee4e0cae7c3d4aaa4e8dced50e3010a80ee692175fa0385f62ecca4b56ee6e9980aa3ec51b61b077096ac9e800edaf161268593eedb6cc7027ff5cb32745d250010d407a6221ae22ef18469b444f2822478c4d190b24d36371a95cb40087cdd42d9399c3d06a53c0673349bfb607927f20d1e122bde1e2bf3aa6cae6edf489629bcaa0689539ae3b718914d88ededc3b"
+
+const detachedSignatureHex = "889c04000102000605024d449cd1000a0910a34d7e18c20c31bb167603ff57718d09f28a519fdc7b5a68b6a3336da04df85e38c5cd5d5bd2092fa4629848a33d85b1729402a2aab39c3ac19f9d573f773cc62c264dc924c067a79dfd8a863ae06c7c8686120760749f5fd9b1e03a64d20a7df3446ddc8f0aeadeaeba7cbaee5c1e366d65b6a0c6cc749bcb912d2f15013f812795c2e29eb7f7b77f39ce77"
+
+const detachedSignatureTextHex = "889c04010102000605024d449d21000a0910a34d7e18c20c31bbc8c60400a24fbef7342603a41cb1165767bd18985d015fb72fe05db42db36cfb2f1d455967f1e491194fbf6cf88146222b23bf6ffbd50d17598d976a0417d3192ff9cc0034fd00f287b02e90418bbefe609484b09231e4e7a5f3562e199bf39909ab5276c4d37382fe088f6b5c3426fc1052865da8b3ab158672d58b6264b10823dc4b39"
+
+const detachedSignatureDSAHex = "884604001102000605024d6c4eac000a0910338934250ccc0360f18d00a087d743d6405ed7b87755476629600b8b694a39e900a0abff8126f46faf1547c1743c37b21b4ea15b8f83"
+
+const detachedSignatureP256Hex = "885e0400130a0006050256e5bb00000a0910d44a2c495918513edef001009841a4f792beb0befccb35c8838a6a87d9b936beaa86db6745ddc7b045eee0cf00fd1ac1f78306b17e965935dd3f8bae4587a76587e4af231efe19cc4011a8434817"
+
+// The plaintext is https://www.gutenberg.org/cache/epub/1080/pg1080.txt
+const modestProposalSha512 = "lbbrB1+WP3T9AaC9OQqBdOcCjgeEQadlulXsNPgVx0tyqPzDHwUugZ2gE7V0ESKAw6kAVfgkcuvfgxAAGaeHtw=="
+
+const testKeys1And2Hex = "988d044d3c5c10010400b1d13382944bd5aba23a4312968b5095d14f947f600eb478e14a6fcb16b0e0cac764884909c020bc495cfcc39a935387c661507bdb236a0612fb582cac3af9b29cc2c8c70090616c41b662f4da4c1201e195472eb7f4ae1ccbcbf9940fe21d985e379a5563dde5b9a23d35f1cfaa5790da3b79db26f23695107bfaca8e7b5bcd0011010001b41054657374204b6579203120285253412988b804130102002205024d3c5c10021b03060b090807030206150802090a0b0416020301021e01021780000a0910a34d7e18c20c31bbb5b304009cc45fe610b641a2c146331be94dade0a396e73ca725e1b25c21708d9cab46ecca5ccebc23055879df8f99eea39b377962a400f2ebdc36a7c99c333d74aeba346315137c3ff9d0a09b0273299090343048afb8107cf94cbd1400e3026f0ccac7ecebbc4d78588eb3e478fe2754d3ca664bcf3eac96ca4a6b0c8d7df5102f60f6b0020003b88d044d3c5c10010400b201df61d67487301f11879d514f4248ade90c8f68c7af1284c161098de4c28c2850f1ec7b8e30f959793e571542ffc6532189409cb51c3d30dad78c4ad5165eda18b20d9826d8707d0f742e2ab492103a85bbd9ddf4f5720f6de7064feb0d39ee002219765bb07bcfb8b877f47abe270ddeda4f676108cecb6b9bb2ad484a4f0011010001889f04180102000905024d3c5c10021b0c000a0910a34d7e18c20c31bb1a03040085c8d62e16d05dc4e9dad64953c8a2eed8b6c12f92b1575eeaa6dcf7be9473dd5b24b37b6dffbb4e7c99ed1bd3cb11634be19b3e6e207bed7505c7ca111ccf47cb323bf1f8851eb6360e8034cbff8dd149993c959de89f8f77f38e7e98b8e3076323aa719328e2b408db5ec0d03936efd57422ba04f925cdc7b4c1af7590e40ab0020003988d044d3c5c33010400b488c3e5f83f4d561f317817538d9d0397981e9aef1321ca68ebfae1cf8b7d388e19f4b5a24a82e2fbbf1c6c26557a6c5845307a03d815756f564ac7325b02bc83e87d5480a8fae848f07cb891f2d51ce7df83dcafdc12324517c86d472cc0ee10d47a68fd1d9ae49a6c19bbd36d82af597a0d88cc9c49de9df4e696fc1f0b5d0011010001b42754657374204b6579203220285253412c20656e637279707465642070726976617465206b65792988b804130102002205024d3c5c33021b03060b090807030206150802090a0b0416020301021e01021780000a0910d4984f961e35246b98940400908a73b6a6169f700434f076c6c79015a49bee37130eaf23aaa3cfa9ce60bfe4acaa7bc95f1146ada5867e0079babb38804891f4f0b8ebca57a86b249dee786161a755b7a342e68ccf3f78ed6440a93a6626beb9a37aa66afcd4f888790cb4bb46d94a4ae3eb3d7d3e6b00f6bfec940303e89ec5b32a1eaaacce66497d539328b0020003b88d044d3c5c33010400a4e913f9442abcc7f1804ccab27d2f787ffa592077ca935a8bb23165bd8d57576acac647cc596b2c3f814518cc8c82953c7a4478f32e0cf645630a5ba38d9618ef2bc3add69d459ae3dece5cab778938d988239f8c5ae437807075e06c828019959c644ff05ef6a5a1dab72227c98e3a040b0cf219026640698d7a13d8538a570011010001889f04180102000905024d3c5c33021b0c000a0910d4984f961e35246b26c703ff7ee29ef53bc1ae1ead533c408fa136db508434e233d6e62be621e031e5940bbd4c08142aed0f82217e7c3e1ec8de574bc06ccf3c36633be41ad78a9eacd209f861cae7b064100758545cc9dd83db71806dc1cfd5fb9ae5c7474bba0c19c44034ae61bae5eca379383339dece94ff56ff7aa44a582f3e5c38f45763af577c0934b0020003"
+
+const testKeys1And2PrivateHex = "9501d8044d3c5c10010400b1d13382944bd5aba23a4312968b5095d14f947f600eb478e14a6fcb16b0e0cac764884909c020bc495cfcc39a935387c661507bdb236a0612fb582cac3af9b29cc2c8c70090616c41b662f4da4c1201e195472eb7f4ae1ccbcbf9940fe21d985e379a5563dde5b9a23d35f1cfaa5790da3b79db26f23695107bfaca8e7b5bcd00110100010003ff4d91393b9a8e3430b14d6209df42f98dc927425b881f1209f319220841273a802a97c7bdb8b3a7740b3ab5866c4d1d308ad0d3a79bd1e883aacf1ac92dfe720285d10d08752a7efe3c609b1d00f17f2805b217be53999a7da7e493bfc3e9618fd17018991b8128aea70a05dbce30e4fbe626aa45775fa255dd9177aabf4df7cf0200c1ded12566e4bc2bb590455e5becfb2e2c9796482270a943343a7835de41080582c2be3caf5981aa838140e97afa40ad652a0b544f83eb1833b0957dce26e47b0200eacd6046741e9ce2ec5beb6fb5e6335457844fb09477f83b050a96be7da043e17f3a9523567ed40e7a521f818813a8b8a72209f1442844843ccc7eb9805442570200bdafe0438d97ac36e773c7162028d65844c4d463e2420aa2228c6e50dc2743c3d6c72d0d782a5173fe7be2169c8a9f4ef8a7cf3e37165e8c61b89c346cdc6c1799d2b41054657374204b6579203120285253412988b804130102002205024d3c5c10021b03060b090807030206150802090a0b0416020301021e01021780000a0910a34d7e18c20c31bbb5b304009cc45fe610b641a2c146331be94dade0a396e73ca725e1b25c21708d9cab46ecca5ccebc23055879df8f99eea39b377962a400f2ebdc36a7c99c333d74aeba346315137c3ff9d0a09b0273299090343048afb8107cf94cbd1400e3026f0ccac7ecebbc4d78588eb3e478fe2754d3ca664bcf3eac96ca4a6b0c8d7df5102f60f6b00200009d01d8044d3c5c10010400b201df61d67487301f11879d514f4248ade90c8f68c7af1284c161098de4c28c2850f1ec7b8e30f959793e571542ffc6532189409cb51c3d30dad78c4ad5165eda18b20d9826d8707d0f742e2ab492103a85bbd9ddf4f5720f6de7064feb0d39ee002219765bb07bcfb8b877f47abe270ddeda4f676108cecb6b9bb2ad484a4f00110100010003fd17a7490c22a79c59281fb7b20f5e6553ec0c1637ae382e8adaea295f50241037f8997cf42c1ce26417e015091451b15424b2c59eb8d4161b0975630408e394d3b00f88d4b4e18e2cc85e8251d4753a27c639c83f5ad4a571c4f19d7cd460b9b73c25ade730c99df09637bd173d8e3e981ac64432078263bb6dc30d3e974150dd0200d0ee05be3d4604d2146fb0457f31ba17c057560785aa804e8ca5530a7cd81d3440d0f4ba6851efcfd3954b7e68908fc0ba47f7ac37bf559c6c168b70d3a7c8cd0200da1c677c4bce06a068070f2b3733b0a714e88d62aa3f9a26c6f5216d48d5c2b5624144f3807c0df30be66b3268eeeca4df1fbded58faf49fc95dc3c35f134f8b01fd1396b6c0fc1b6c4f0eb8f5e44b8eace1e6073e20d0b8bc5385f86f1cf3f050f66af789f3ef1fc107b7f4421e19e0349c730c68f0a226981f4e889054fdb4dc149e8e889f04180102000905024d3c5c10021b0c000a0910a34d7e18c20c31bb1a03040085c8d62e16d05dc4e9dad64953c8a2eed8b6c12f92b1575eeaa6dcf7be9473dd5b24b37b6dffbb4e7c99ed1bd3cb11634be19b3e6e207bed7505c7ca111ccf47cb323bf1f8851eb6360e8034cbff8dd149993c959de89f8f77f38e7e98b8e3076323aa719328e2b408db5ec0d03936efd57422ba04f925cdc7b4c1af7590e40ab00200009501fe044d3c5c33010400b488c3e5f83f4d561f317817538d9d0397981e9aef1321ca68ebfae1cf8b7d388e19f4b5a24a82e2fbbf1c6c26557a6c5845307a03d815756f564ac7325b02bc83e87d5480a8fae848f07cb891f2d51ce7df83dcafdc12324517c86d472cc0ee10d47a68fd1d9ae49a6c19bbd36d82af597a0d88cc9c49de9df4e696fc1f0b5d0011010001fe030302e9030f3c783e14856063f16938530e148bc57a7aa3f3e4f90df9dceccdc779bc0835e1ad3d006e4a8d7b36d08b8e0de5a0d947254ecfbd22037e6572b426bcfdc517796b224b0036ff90bc574b5509bede85512f2eefb520fb4b02aa523ba739bff424a6fe81c5041f253f8d757e69a503d3563a104d0d49e9e890b9d0c26f96b55b743883b472caa7050c4acfd4a21f875bdf1258d88bd61224d303dc9df77f743137d51e6d5246b88c406780528fd9a3e15bab5452e5b93970d9dcc79f48b38651b9f15bfbcf6da452837e9cc70683d1bdca94507870f743e4ad902005812488dd342f836e72869afd00ce1850eea4cfa53ce10e3608e13d3c149394ee3cbd0e23d018fcbcb6e2ec5a1a22972d1d462ca05355d0d290dd2751e550d5efb38c6c89686344df64852bf4ff86638708f644e8ec6bd4af9b50d8541cb91891a431326ab2e332faa7ae86cfb6e0540aa63160c1e5cdd5a4add518b303fff0a20117c6bc77f7cfbaf36b04c865c6c2b42754657374204b6579203220285253412c20656e637279707465642070726976617465206b65792988b804130102002205024d3c5c33021b03060b090807030206150802090a0b0416020301021e01021780000a0910d4984f961e35246b98940400908a73b6a6169f700434f076c6c79015a49bee37130eaf23aaa3cfa9ce60bfe4acaa7bc95f1146ada5867e0079babb38804891f4f0b8ebca57a86b249dee786161a755b7a342e68ccf3f78ed6440a93a6626beb9a37aa66afcd4f888790cb4bb46d94a4ae3eb3d7d3e6b00f6bfec940303e89ec5b32a1eaaacce66497d539328b00200009d01fe044d3c5c33010400a4e913f9442abcc7f1804ccab27d2f787ffa592077ca935a8bb23165bd8d57576acac647cc596b2c3f814518cc8c82953c7a4478f32e0cf645630a5ba38d9618ef2bc3add69d459ae3dece5cab778938d988239f8c5ae437807075e06c828019959c644ff05ef6a5a1dab72227c98e3a040b0cf219026640698d7a13d8538a570011010001fe030302e9030f3c783e148560f936097339ae381d63116efcf802ff8b1c9360767db5219cc987375702a4123fd8657d3e22700f23f95020d1b261eda5257e9a72f9a918e8ef22dd5b3323ae03bbc1923dd224db988cadc16acc04b120a9f8b7e84da9716c53e0334d7b66586ddb9014df604b41be1e960dcfcbc96f4ed150a1a0dd070b9eb14276b9b6be413a769a75b519a53d3ecc0c220e85cd91ca354d57e7344517e64b43b6e29823cbd87eae26e2b2e78e6dedfbb76e3e9f77bcb844f9a8932eb3db2c3f9e44316e6f5d60e9e2a56e46b72abe6b06dc9a31cc63f10023d1f5e12d2a3ee93b675c96f504af0001220991c88db759e231b3320dcedf814dcf723fd9857e3d72d66a0f2af26950b915abdf56c1596f46a325bf17ad4810d3535fb02a259b247ac3dbd4cc3ecf9c51b6c07cebb009c1506fba0a89321ec8683e3fd009a6e551d50243e2d5092fefb3321083a4bad91320dc624bd6b5dddf93553e3d53924c05bfebec1fb4bd47e89a1a889f04180102000905024d3c5c33021b0c000a0910d4984f961e35246b26c703ff7ee29ef53bc1ae1ead533c408fa136db508434e233d6e62be621e031e5940bbd4c08142aed0f82217e7c3e1ec8de574bc06ccf3c36633be41ad78a9eacd209f861cae7b064100758545cc9dd83db71806dc1cfd5fb9ae5c7474bba0c19c44034ae61bae5eca379383339dece94ff56ff7aa44a582f3e5c38f45763af577c0934b0020000"
+
+const dsaElGamalTestKeysHex = "9501e1044dfcb16a110400aa3e5c1a1f43dd28c2ffae8abf5cfce555ee874134d8ba0a0f7b868ce2214beddc74e5e1e21ded354a95d18acdaf69e5e342371a71fbb9093162e0c5f3427de413a7f2c157d83f5cd2f9d791256dc4f6f0e13f13c3302af27f2384075ab3021dff7a050e14854bbde0a1094174855fc02f0bae8e00a340d94a1f22b32e48485700a0cec672ac21258fb95f61de2ce1af74b2c4fa3e6703ff698edc9be22c02ae4d916e4fa223f819d46582c0516235848a77b577ea49018dcd5e9e15cff9dbb4663a1ae6dd7580fa40946d40c05f72814b0f88481207e6c0832c3bded4853ebba0a7e3bd8e8c66df33d5a537cd4acf946d1080e7a3dcea679cb2b11a72a33a2b6a9dc85f466ad2ddf4c3db6283fa645343286971e3dd700703fc0c4e290d45767f370831a90187e74e9972aae5bff488eeff7d620af0362bfb95c1a6c3413ab5d15a2e4139e5d07a54d72583914661ed6a87cce810be28a0aa8879a2dd39e52fb6fe800f4f181ac7e328f740cde3d09a05cecf9483e4cca4253e60d4429ffd679d9996a520012aad119878c941e3cf151459873bdfc2a9563472fe0303027a728f9feb3b864260a1babe83925ce794710cfd642ee4ae0e5b9d74cee49e9c67b6cd0ea5dfbb582132195a121356a1513e1bca73e5b80c58c7ccb4164453412f456c47616d616c2054657374204b65792031886204131102002205024dfcb16a021b03060b090807030206150802090a0b0416020301021e01021780000a091033af447ccd759b09fadd00a0b8fd6f5a790bad7e9f2dbb7632046dc4493588db009c087c6a9ba9f7f49fab221587a74788c00db4889ab00200009d0157044dfcb16a1004008dec3f9291205255ccff8c532318133a6840739dd68b03ba942676f9038612071447bf07d00d559c5c0875724ea16a4c774f80d8338b55fca691a0522e530e604215b467bbc9ccfd483a1da99d7bc2648b4318fdbd27766fc8bfad3fddb37c62b8ae7ccfe9577e9b8d1e77c1d417ed2c2ef02d52f4da11600d85d3229607943700030503ff506c94c87c8cab778e963b76cf63770f0a79bf48fb49d3b4e52234620fc9f7657f9f8d56c96a2b7c7826ae6b57ebb2221a3fe154b03b6637cea7e6d98e3e45d87cf8dc432f723d3d71f89c5192ac8d7290684d2c25ce55846a80c9a7823f6acd9bb29fa6cd71f20bc90eccfca20451d0c976e460e672b000df49466408d527affe0303027a728f9feb3b864260abd761730327bca2aaa4ea0525c175e92bf240682a0e83b226f97ecb2e935b62c9a133858ce31b271fa8eb41f6a1b3cd72a63025ce1a75ee4180dcc284884904181102000905024dfcb16a021b0c000a091033af447ccd759b09dd0b009e3c3e7296092c81bee5a19929462caaf2fff3ae26009e218c437a2340e7ea628149af1ec98ec091a43992b00200009501e1044dfcb1be1104009f61faa61aa43df75d128cbe53de528c4aec49ce9360c992e70c77072ad5623de0a3a6212771b66b39a30dad6781799e92608316900518ec01184a85d872365b7d2ba4bacfb5882ea3c2473d3750dc6178cc1cf82147fb58caa28b28e9f12f6d1efcb0534abed644156c91cca4ab78834268495160b2400bc422beb37d237c2300a0cac94911b6d493bda1e1fbc6feeca7cb7421d34b03fe22cec6ccb39675bb7b94a335c2b7be888fd3906a1125f33301d8aa6ec6ee6878f46f73961c8d57a3e9544d8ef2a2cbfd4d52da665b1266928cfe4cb347a58c412815f3b2d2369dec04b41ac9a71cc9547426d5ab941cccf3b18575637ccfb42df1a802df3cfe0a999f9e7109331170e3a221991bf868543960f8c816c28097e503fe319db10fb98049f3a57d7c80c420da66d56f3644371631fad3f0ff4040a19a4fedc2d07727a1b27576f75a4d28c47d8246f27071e12d7a8de62aad216ddbae6aa02efd6b8a3e2818cda48526549791ab277e447b3a36c57cefe9b592f5eab73959743fcc8e83cbefec03a329b55018b53eec196765ae40ef9e20521a603c551efe0303020950d53a146bf9c66034d00c23130cce95576a2ff78016ca471276e8227fb30b1ffbd92e61804fb0c3eff9e30b1a826ee8f3e4730b4d86273ca977b4164453412f456c47616d616c2054657374204b65792032886204131102002205024dfcb1be021b03060b090807030206150802090a0b0416020301021e01021780000a0910a86bf526325b21b22bd9009e34511620415c974750a20df5cb56b182f3b48e6600a0a9466cb1a1305a84953445f77d461593f1d42bc1b00200009d0157044dfcb1be1004009565a951da1ee87119d600c077198f1c1bceb0f7aa54552489298e41ff788fa8f0d43a69871f0f6f77ebdfb14a4260cf9fbeb65d5844b4272a1904dd95136d06c3da745dc46327dd44a0f16f60135914368c8039a34033862261806bb2c5ce1152e2840254697872c85441ccb7321431d75a747a4bfb1d2c66362b51ce76311700030503fc0ea76601c196768070b7365a200e6ddb09307f262d5f39eec467b5f5784e22abdf1aa49226f59ab37cb49969d8f5230ea65caf56015abda62604544ed526c5c522bf92bed178a078789f6c807b6d34885688024a5bed9e9f8c58d11d4b82487b44c5f470c5606806a0443b79cadb45e0f897a561a53f724e5349b9267c75ca17fe0303020950d53a146bf9c660bc5f4ce8f072465e2d2466434320c1e712272fafc20e342fe7608101580fa1a1a367e60486a7cd1246b7ef5586cf5e10b32762b710a30144f12dd17dd4884904181102000905024dfcb1be021b0c000a0910a86bf526325b21b2904c00a0b2b66b4b39ccffda1d10f3ea8d58f827e30a8b8e009f4255b2d8112a184e40cde43a34e8655ca7809370b0020000"
+
+const signedMessageHex = "a3019bc0cbccc0c4b8d8b74ee2108fe16ec6d3ca490cbe362d3f8333d3f352531472538b8b13d353b97232f352158c20943157c71c16064626063656269052062e4e01987e9b6fccff4b7df3a34c534b23e679cbec3bc0f8f6e64dfb4b55fe3f8efa9ce110ddb5cd79faf1d753c51aecfa669f7e7aa043436596cccc3359cb7dd6bbe9ecaa69e5989d9e57209571edc0b2fa7f57b9b79a64ee6e99ce1371395fee92fec2796f7b15a77c386ff668ee27f6d38f0baa6c438b561657377bf6acff3c5947befd7bf4c196252f1d6e5c524d0300"
+
+const signedTextMessageHex = "a3019bc0cbccc8c4b8d8b74ee2108fe16ec6d36a250cbece0c178233d3f352531472538b8b13d35379b97232f352158ca0b4312f57c71c1646462606365626906a062e4e019811591798ff99bf8afee860b0d8a8c2a85c3387e3bcf0bb3b17987f2bbcfab2aa526d930cbfd3d98757184df3995c9f3e7790e36e3e9779f06089d4c64e9e47dd6202cb6e9bc73c5d11bb59fbaf89d22d8dc7cf199ddf17af96e77c5f65f9bbed56f427bd8db7af37f6c9984bf9385efaf5f184f986fb3e6adb0ecfe35bbf92d16a7aa2a344fb0bc52fb7624f0200"
+
+const signedEncryptedMessageHex = "c18c032a67d68660df41c70103ff5a84c9a72f80e74ef0384c2d6a9ebfe2b09e06a8f298394f6d2abf174e40934ab0ec01fb2d0ddf21211c6fe13eb238563663b017a6b44edca552eb4736c4b7dc6ed907dd9e12a21b51b64b46f902f76fb7aaf805c1db8070574d8d0431a23e324a750f77fb72340a17a42300ee4ca8207301e95a731da229a63ab9c6b44541fbd2c11d016d810b3b3b2b38f15b5b40f0a4910332829c2062f1f7cc61f5b03677d73c54cafa1004ced41f315d46444946faae571d6f426e6dbd45d9780eb466df042005298adabf7ce0ef766dfeb94cd449c7ed0046c880339599c4711af073ce649b1e237c40b50a5536283e03bdbb7afad78bd08707715c67fb43295f905b4c479178809d429a8e167a9a8c6dfd8ab20b4edebdc38d6dec879a3202e1b752690d9bb5b0c07c5a227c79cc200e713a99251a4219d62ad5556900cf69bd384b6c8e726c7be267471d0d23af956da165af4af757246c2ebcc302b39e8ef2fccb4971b234fcda22d759ddb20e27269ee7f7fe67898a9de721bfa02ab0becaa046d00ea16cb1afc4e2eab40d0ac17121c565686e5cbd0cbdfbd9d6db5c70278b9c9db5a83176d04f61fbfbc4471d721340ede2746e5c312ded4f26787985af92b64fae3f253dbdde97f6a5e1996fd4d865599e32ff76325d3e9abe93184c02988ee89a4504356a4ef3b9b7a57cbb9637ca90af34a7676b9ef559325c3cca4e29d69fec1887f5440bb101361d744ad292a8547f22b4f22b419a42aa836169b89190f46d9560824cb2ac6e8771de8223216a5e647e132ab9eebcba89569ab339cb1c3d70fe806b31f4f4c600b4103b8d7583ebff16e43dcda551e6530f975122eb8b29"
+
+const verifiedSignatureEncryptedMessageHex = "c2b304000108000605026048f6d600210910a34d7e18c20c31bb1621045fb74b1d03b1e3cb31bc2f8aa34d7e18c20c31bb9a3b0400a32ddac1af259c1b0abab0041327ea04970944401978fb647dd1cf9aba4f164e43f0d8a9389501886474bdd4a6e77f6aea945c07dfbf87743835b44cc2c39a1f9aeecfa83135abc92e18e50396f2e6a06c44e0188b0081effbfb4160d28f118d4ff73dd199a102e47cffd8c7ff2bacd83ae72b5820c021a486766dd587b5da61"
+
+const unverifiedSignatureEncryptedMessageHex = "c2b304000108000605026048f6d600210910a34d7e18c20c31bb1621045fb74b1d03b1e3cb31bc2f8aa34d7e18c20c31bb9a3b0400a32ddac1af259c1b0abab0041327ea04970944401978fb647dd1cf9aba4f164e43f0d8a9389501886474bdd4a6e77f6aea945c07dfbf87743835b44cc2c39a1f9aeecfa83135abc92e18e50396f2e6a06c44e0188b0081effbfb4160d28f118d4ff73dd199a102e47cffd8c7ff2bacd83ae72b5820c021a486766dd587b5da61"
+
+const signedEncryptedMessage2Hex = "85010e03cf6a7abcd43e36731003fb057f5495b79db367e277cdbe4ab90d924ddee0c0381494112ff8c1238fb0184af35d1731573b01bc4c55ecacd2aafbe2003d36310487d1ecc9ac994f3fada7f9f7f5c3a64248ab7782906c82c6ff1303b69a84d9a9529c31ecafbcdb9ba87e05439897d87e8a2a3dec55e14df19bba7f7bd316291c002ae2efd24f83f9e3441203fc081c0c23dc3092a454ca8a082b27f631abf73aca341686982e8fbda7e0e7d863941d68f3de4a755c2964407f4b5e0477b3196b8c93d551dd23c8beef7d0f03fbb1b6066f78907faf4bf1677d8fcec72651124080e0b7feae6b476e72ab207d38d90b958759fdedfc3c6c35717c9dbfc979b3cfbbff0a76d24a5e57056bb88acbd2a901ef64bc6e4db02adc05b6250ff378de81dca18c1910ab257dff1b9771b85bb9bbe0a69f5989e6d1710a35e6dfcceb7d8fb5ccea8db3932b3d9ff3fe0d327597c68b3622aec8e3716c83a6c93f497543b459b58ba504ed6bcaa747d37d2ca746fe49ae0a6ce4a8b694234e941b5159ff8bd34b9023da2814076163b86f40eed7c9472f81b551452d5ab87004a373c0172ec87ea6ce42ccfa7dbdad66b745496c4873d8019e8c28d6b3"
+
+const signatureEncryptedMessage2Hex = "c24604001102000605024dfd0166000a091033af447ccd759b09bae600a096ec5e63ecf0a403085e10f75cc3bab327663282009f51fad9df457ed8d2b70d8a73c76e0443eac0f377"
+
+const symmetricallyEncryptedCompressedHex = "c32e040903085a357c1a7b5614ed00cc0d1d92f428162058b3f558a0fb0980d221ebac6c97d5eda4e0fe32f6e706e94dd263012d6ca1ef8c4bbd324098225e603a10c85ebf09cbf7b5aeeb5ce46381a52edc51038b76a8454483be74e6dcd1e50d5689a8ae7eceaeefed98a0023d49b22eb1f65c2aa1ef1783bb5e1995713b0457102ec3c3075fe871267ffa4b686ad5d52000d857"
+
+const dsaTestKeyHex = "9901a2044d6c49de110400cb5ce438cf9250907ac2ba5bf6547931270b89f7c4b53d9d09f4d0213a5ef2ec1f26806d3d259960f872a4a102ef1581ea3f6d6882d15134f21ef6a84de933cc34c47cc9106efe3bd84c6aec12e78523661e29bc1a61f0aab17fa58a627fd5fd33f5149153fbe8cd70edf3d963bc287ef875270ff14b5bfdd1bca4483793923b00a0fe46d76cb6e4cbdc568435cd5480af3266d610d303fe33ae8273f30a96d4d34f42fa28ce1112d425b2e3bf7ea553d526e2db6b9255e9dc7419045ce817214d1a0056dbc8d5289956a4b1b69f20f1105124096e6a438f41f2e2495923b0f34b70642607d45559595c7fe94d7fa85fc41bf7d68c1fd509ebeaa5f315f6059a446b9369c277597e4f474a9591535354c7e7f4fd98a08aa60400b130c24ff20bdfbf683313f5daebf1c9b34b3bdadfc77f2ddd72ee1fb17e56c473664bc21d66467655dd74b9005e3a2bacce446f1920cd7017231ae447b67036c9b431b8179deacd5120262d894c26bc015bffe3d827ba7087ad9b700d2ca1f6d16cc1786581e5dd065f293c31209300f9b0afcc3f7c08dd26d0a22d87580b4db41054657374204b65792033202844534129886204131102002205024d6c49de021b03060b090807030206150802090a0b0416020301021e01021780000a0910338934250ccc03607e0400a0bdb9193e8a6b96fc2dfc108ae848914b504481f100a09c4dc148cb693293a67af24dd40d2b13a9e36794"
+
+const dsaTestKeyPrivateHex = "9501bb044d6c49de110400cb5ce438cf9250907ac2ba5bf6547931270b89f7c4b53d9d09f4d0213a5ef2ec1f26806d3d259960f872a4a102ef1581ea3f6d6882d15134f21ef6a84de933cc34c47cc9106efe3bd84c6aec12e78523661e29bc1a61f0aab17fa58a627fd5fd33f5149153fbe8cd70edf3d963bc287ef875270ff14b5bfdd1bca4483793923b00a0fe46d76cb6e4cbdc568435cd5480af3266d610d303fe33ae8273f30a96d4d34f42fa28ce1112d425b2e3bf7ea553d526e2db6b9255e9dc7419045ce817214d1a0056dbc8d5289956a4b1b69f20f1105124096e6a438f41f2e2495923b0f34b70642607d45559595c7fe94d7fa85fc41bf7d68c1fd509ebeaa5f315f6059a446b9369c277597e4f474a9591535354c7e7f4fd98a08aa60400b130c24ff20bdfbf683313f5daebf1c9b34b3bdadfc77f2ddd72ee1fb17e56c473664bc21d66467655dd74b9005e3a2bacce446f1920cd7017231ae447b67036c9b431b8179deacd5120262d894c26bc015bffe3d827ba7087ad9b700d2ca1f6d16cc1786581e5dd065f293c31209300f9b0afcc3f7c08dd26d0a22d87580b4d00009f592e0619d823953577d4503061706843317e4fee083db41054657374204b65792033202844534129886204131102002205024d6c49de021b03060b090807030206150802090a0b0416020301021e01021780000a0910338934250ccc03607e0400a0bdb9193e8a6b96fc2dfc108ae848914b504481f100a09c4dc148cb693293a67af24dd40d2b13a9e36794"
+
+const p256TestKeyHex = "98520456e5b83813082a8648ce3d030107020304a2072cd6d21321266c758cc5b83fab0510f751cb8d91897cddb7047d8d6f185546e2107111b0a95cb8ef063c33245502af7a65f004d5919d93ee74eb71a66253b424502d3235362054657374204b6579203c696e76616c6964406578616d706c652e636f6d3e8879041313080021050256e5b838021b03050b09080702061508090a0b020416020301021e01021780000a0910d44a2c495918513e54e50100dfa64f97d9b47766fc1943c6314ba3f2b2a103d71ad286dc5b1efb96a345b0c80100dbc8150b54241f559da6ef4baacea6d31902b4f4b1bdc09b34bf0502334b7754b8560456e5b83812082a8648ce3d030107020304bfe3cea9cee13486f8d518aa487fecab451f25467d2bf08e58f63e5fa525d5482133e6a79299c274b068ef0be448152ad65cf11cf764348588ca4f6a0bcf22b6030108078861041813080009050256e5b838021b0c000a0910d44a2c495918513e4a4800ff49d589fa64024ad30be363a032e3a0e0e6f5db56ba4c73db850518bf0121b8f20100fd78e065f4c70ea5be9df319ea67e493b936fc78da834a71828043d3154af56e"
+
+const p256TestKeyPrivateHex = "94a50456e5b83813082a8648ce3d030107020304a2072cd6d21321266c758cc5b83fab0510f751cb8d91897cddb7047d8d6f185546e2107111b0a95cb8ef063c33245502af7a65f004d5919d93ee74eb71a66253fe070302f0c2bfb0b6c30f87ee1599472b8636477eab23ced13b271886a4b50ed34c9d8436af5af5b8f88921f0efba6ef8c37c459bbb88bc1c6a13bbd25c4ce9b1e97679569ee77645d469bf4b43de637f5561b424502d3235362054657374204b6579203c696e76616c6964406578616d706c652e636f6d3e8879041313080021050256e5b838021b03050b09080702061508090a0b020416020301021e01021780000a0910d44a2c495918513e54e50100dfa64f97d9b47766fc1943c6314ba3f2b2a103d71ad286dc5b1efb96a345b0c80100dbc8150b54241f559da6ef4baacea6d31902b4f4b1bdc09b34bf0502334b77549ca90456e5b83812082a8648ce3d030107020304bfe3cea9cee13486f8d518aa487fecab451f25467d2bf08e58f63e5fa525d5482133e6a79299c274b068ef0be448152ad65cf11cf764348588ca4f6a0bcf22b603010807fe0703027510012471a603cfee2968dce19f732721ddf03e966fd133b4e3c7a685b788705cbc46fb026dc94724b830c9edbaecd2fb2c662f23169516cacd1fe423f0475c364ecc10abcabcfd4bbbda1a36a1bd8861041813080009050256e5b838021b0c000a0910d44a2c495918513e4a4800ff49d589fa64024ad30be363a032e3a0e0e6f5db56ba4c73db850518bf0121b8f20100fd78e065f4c70ea5be9df319ea67e493b936fc78da834a71828043d3154af56e"
+
+const armoredPrivateKeyBlock = `-----BEGIN PGP PRIVATE KEY BLOCK-----
+Version: GnuPG v1.4.10 (GNU/Linux)
+
+lQHYBE2rFNoBBADFwqWQIW/DSqcB4yCQqnAFTJ27qS5AnB46ccAdw3u4Greeu3Bp
+idpoHdjULy7zSKlwR1EA873dO/k/e11Ml3dlAFUinWeejWaK2ugFP6JjiieSsrKn
+vWNicdCS4HTWn0X4sjl0ZiAygw6GNhqEQ3cpLeL0g8E9hnYzJKQ0LWJa0QARAQAB
+AAP/TB81EIo2VYNmTq0pK1ZXwUpxCrvAAIG3hwKjEzHcbQznsjNvPUihZ+NZQ6+X
+0HCfPAdPkGDCLCb6NavcSW+iNnLTrdDnSI6+3BbIONqWWdRDYJhqZCkqmG6zqSfL
+IdkJgCw94taUg5BWP/AAeQrhzjChvpMQTVKQL5mnuZbUCeMCAN5qrYMP2S9iKdnk
+VANIFj7656ARKt/nf4CBzxcpHTyB8+d2CtPDKCmlJP6vL8t58Jmih+kHJMvC0dzn
+gr5f5+sCAOOe5gt9e0am7AvQWhdbHVfJU0TQJx+m2OiCJAqGTB1nvtBLHdJnfdC9
+TnXXQ6ZXibqLyBies/xeY2sCKL5qtTMCAKnX9+9d/5yQxRyrQUHt1NYhaXZnJbHx
+q4ytu0eWz+5i68IYUSK69jJ1NWPM0T6SkqpB3KCAIv68VFm9PxqG1KmhSrQIVGVz
+dCBLZXmIuAQTAQIAIgUCTasU2gIbAwYLCQgHAwIGFQgCCQoLBBYCAwECHgECF4AA
+CgkQO9o98PRieSoLhgQAkLEZex02Qt7vGhZzMwuN0R22w3VwyYyjBx+fM3JFETy1
+ut4xcLJoJfIaF5ZS38UplgakHG0FQ+b49i8dMij0aZmDqGxrew1m4kBfjXw9B/v+
+eIqpODryb6cOSwyQFH0lQkXC040pjq9YqDsO5w0WYNXYKDnzRV0p4H1pweo2VDid
+AdgETasU2gEEAN46UPeWRqKHvA99arOxee38fBt2CI08iiWyI8T3J6ivtFGixSqV
+bRcPxYO/qLpVe5l84Nb3X71GfVXlc9hyv7CD6tcowL59hg1E/DC5ydI8K8iEpUmK
+/UnHdIY5h8/kqgGxkY/T/hgp5fRQgW1ZoZxLajVlMRZ8W4tFtT0DeA+JABEBAAEA
+A/0bE1jaaZKj6ndqcw86jd+QtD1SF+Cf21CWRNeLKnUds4FRRvclzTyUMuWPkUeX
+TaNNsUOFqBsf6QQ2oHUBBK4VCHffHCW4ZEX2cd6umz7mpHW6XzN4DECEzOVksXtc
+lUC1j4UB91DC/RNQqwX1IV2QLSwssVotPMPqhOi0ZLNY7wIA3n7DWKInxYZZ4K+6
+rQ+POsz6brEoRHwr8x6XlHenq1Oki855pSa1yXIARoTrSJkBtn5oI+f8AzrnN0BN
+oyeQAwIA/7E++3HDi5aweWrViiul9cd3rcsS0dEnksPhvS0ozCJiHsq/6GFmy7J8
+QSHZPteedBnZyNp5jR+H7cIfVN3KgwH/Skq4PsuPhDq5TKK6i8Pc1WW8MA6DXTdU
+nLkX7RGmMwjC0DBf7KWAlPjFaONAX3a8ndnz//fy1q7u2l9AZwrj1qa1iJ8EGAEC
+AAkFAk2rFNoCGwwACgkQO9o98PRieSo2/QP/WTzr4ioINVsvN1akKuekmEMI3LAp
+BfHwatufxxP1U+3Si/6YIk7kuPB9Hs+pRqCXzbvPRrI8NHZBmc8qIGthishdCYad
+AHcVnXjtxrULkQFGbGvhKURLvS9WnzD/m1K2zzwxzkPTzT9/Yf06O6Mal5AdugPL
+VrM0m72/jnpKo04=
+=zNCn
+-----END PGP PRIVATE KEY BLOCK-----`
+
+const e2ePublicKey = `-----BEGIN PGP PUBLIC KEY BLOCK-----
+Charset: UTF-8
+
+xv8AAABSBAAAAAATCCqGSM49AwEHAgME1LRoXSpOxtHXDUdmuvzchyg6005qIBJ4
+sfaSxX7QgH9RV2ONUhC+WiayCNADq+UMzuR/vunSr4aQffXvuGnR383/AAAAFDxk
+Z2lsQHlhaG9vLWluYy5jb20+wv8AAACGBBATCAA4/wAAAAWCVGvAG/8AAAACiwn/
+AAAACZC2VkQCOjdvYf8AAAAFlQgJCgv/AAAAA5YBAv8AAAACngEAAE1BAP0X8veD
+24IjmI5/C6ZAfVNXxgZZFhTAACFX75jUA3oD6AEAzoSwKf1aqH6oq62qhCN/pekX
++WAsVMBhNwzLpqtCRjLO/wAAAFYEAAAAABIIKoZIzj0DAQcCAwT50ain7vXiIRv8
+B1DO3x3cE/aattZ5sHNixJzRCXi2vQIA5QmOxZ6b5jjUekNbdHG3SZi1a2Ak5mfX
+fRxC/5VGAwEIB8L/AAAAZQQYEwgAGP8AAAAFglRrwBz/AAAACZC2VkQCOjdvYQAA
+FJAA9isX3xtGyMLYwp2F3nXm7QEdY5bq5VUcD/RJlj792VwA/1wH0pCzVLl4Q9F9
+ex7En5r7rHR5xwX82Msc+Rq9dSyO
+=7MrZ
+-----END PGP PUBLIC KEY BLOCK-----`
+
+const dsaKeyWithSHA512 = `9901a2044f04b07f110400db244efecc7316553ee08d179972aab87bb1214de7692593fcf5b6feb1c80fba268722dd464748539b85b81d574cd2d7ad0ca2444de4d849b8756bad7768c486c83a824f9bba4af773d11742bdfb4ac3b89ef8cc9452d4aad31a37e4b630d33927bff68e879284a1672659b8b298222fc68f370f3e24dccacc4a862442b9438b00a0ea444a24088dc23e26df7daf8f43cba3bffc4fe703fe3d6cd7fdca199d54ed8ae501c30e3ec7871ea9cdd4cf63cfe6fc82281d70a5b8bb493f922cd99fba5f088935596af087c8d818d5ec4d0b9afa7f070b3d7c1dd32a84fca08d8280b4890c8da1dde334de8e3cad8450eed2a4a4fcc2db7b8e5528b869a74a7f0189e11ef097ef1253582348de072bb07a9fa8ab838e993cef0ee203ff49298723e2d1f549b00559f886cd417a41692ce58d0ac1307dc71d85a8af21b0cf6eaa14baf2922d3a70389bedf17cc514ba0febbd107675a372fe84b90162a9e88b14d4b1c6be855b96b33fb198c46f058568817780435b6936167ebb3724b680f32bf27382ada2e37a879b3d9de2abe0c3f399350afd1ad438883f4791e2e3b4184453412068617368207472756e636174696f6e207465737488620413110a002205024f04b07f021b03060b090807030206150802090a0b0416020301021e01021780000a0910ef20e0cefca131581318009e2bf3bf047a44d75a9bacd00161ee04d435522397009a03a60d51bd8a568c6c021c8d7cf1be8d990d6417b0020003`
+
+const unknownHashFunctionHex = `8a00000040040001990006050253863c24000a09103b4fe6acc0b21f32ffff0101010101010101010101010101010101010101010101010101010101010101010101010101`
+
+const rsaSignatureBadMPIlength = `8a00000040040001030006050253863c24000a09103b4fe6acc0b21f32ffff0101010101010101010101010101010101010101010101010101010101010101010101010101`
+
+const missingHashFunctionHex = `8a00000040040001030006050253863c24000a09103b4fe6acc0b21f32ffff0101010101010101010101010101010101010101010101010101010101010101010101010101`
+
+const campbellQuine = `a0b001000300fcffa0b001000d00f2ff000300fcffa0b001000d00f2ff8270a01c00000500faff8270a01c00000500faff000500faff001400ebff8270a01c00000500faff000500faff001400ebff428821c400001400ebff428821c400001400ebff428821c400001400ebff428821c400001400ebff428821c400000000ffff000000ffff000b00f4ff428821c400000000ffff000000ffff000b00f4ff0233214c40000100feff000233214c40000100feff0000`
+
+const keyV4forVerifyingSignedMessageV3 = `-----BEGIN PGP PUBLIC KEY BLOCK-----
+Comment: GPGTools - https://gpgtools.org
+
+mI0EVfxoFQEEAMBIqmbDfYygcvP6Phr1wr1XI41IF7Qixqybs/foBF8qqblD9gIY
+BKpXjnBOtbkcVOJ0nljd3/sQIfH4E0vQwK5/4YRQSI59eKOqd6Fx+fWQOLG+uu6z
+tewpeCj9LLHvibx/Sc7VWRnrznia6ftrXxJ/wHMezSab3tnGC0YPVdGNABEBAAG0
+JEdvY3J5cHRvIFRlc3QgS2V5IDx0aGVtYXhAZ21haWwuY29tPoi5BBMBCgAjBQJV
+/GgVAhsDBwsJCAcDAgEGFQgCCQoLBBYCAwECHgECF4AACgkQeXnQmhdGW9PFVAP+
+K7TU0qX5ArvIONIxh/WAweyOk884c5cE8f+3NOPOOCRGyVy0FId5A7MmD5GOQh4H
+JseOZVEVCqlmngEvtHZb3U1VYtVGE5WZ+6rQhGsMcWP5qaT4soYwMBlSYxgYwQcx
+YhN9qOr292f9j2Y//TTIJmZT4Oa+lMxhWdqTfX+qMgG4jQRV/GgVAQQArhFSiij1
+b+hT3dnapbEU+23Z1yTu1DfF6zsxQ4XQWEV3eR8v+8mEDDNcz8oyyF56k6UQ3rXi
+UMTIwRDg4V6SbZmaFbZYCOwp/EmXJ3rfhm7z7yzXj2OFN22luuqbyVhuL7LRdB0M
+pxgmjXb4tTvfgKd26x34S+QqUJ7W6uprY4sAEQEAAYifBBgBCgAJBQJV/GgVAhsM
+AAoJEHl50JoXRlvT7y8D/02ckx4OMkKBZo7viyrBw0MLG92i+DC2bs35PooHR6zz
+786mitjOp5z2QWNLBvxC70S0qVfCIz8jKupO1J6rq6Z8CcbLF3qjm6h1omUBf8Nd
+EfXKD2/2HV6zMKVknnKzIEzauh+eCKS2CeJUSSSryap/QLVAjRnckaES/OsEWhNB
+=RZia
+-----END PGP PUBLIC KEY BLOCK-----
+`
+
+const signedMessageV3 = `-----BEGIN PGP MESSAGE-----
+Comment: GPGTools - https://gpgtools.org
+
+owGbwMvMwMVYWXlhlrhb9GXG03JJDKF/MtxDMjKLFYAoUaEktbhEITe1uDgxPVWP
+q5NhKjMrWAVcC9evD8z/bF/uWNjqtk/X3y5/38XGRQHm/57rrDRYuGnTw597Xqka
+uM3137/hH3Os+Jf2dc0fXOITKwJvXJvecPVs0ta+Vg7ZO1MLn8w58Xx+6L58mbka
+DGHyU9yTueZE8D+QF/Tz28Y78dqtF56R1VPn9Xw4uJqrWYdd7b3vIZ1V6R4Nh05d
+iT57d/OhWwA=
+=hG7R
+-----END PGP MESSAGE-----
+`
+
+// https://mailarchive.ietf.org/arch/msg/openpgp/9SheW_LENE0Kxf7haNllovPyAdY/
+const v5PrivKey = `-----BEGIN PGP PRIVATE KEY BLOCK-----
+
+lGEFXJH05BYAAAAtCSsGAQQB2kcPAQEHQFhZlVcVVtwf+21xNQPX+ecMJJBL0MPd
+fj75iux+my8QAAAAAAAiAQCHZ1SnSUmWqxEsoI6facIVZQu6mph3cBFzzTvcm5lA
+Ng5ctBhlbW1hLmdvbGRtYW5AZXhhbXBsZS5uZXSIlgUTFggASCIhBRk0e8mHJGQC
+X5nfPsLgAA7ZiEiS4fez6kyUAJFZVptUBQJckfTkAhsDBQsJCAcCAyICAQYVCgkI
+CwIEFgIDAQIeBwIXgAAA9cAA/jiR3yMsZMeEQ40u6uzEoXa6UXeV/S3wwJAXRJy9
+M8s0AP9vuL/7AyTfFXwwzSjDnYmzS0qAhbLDQ643N+MXGBJ2BZxmBVyR9OQSAAAA
+MgorBgEEAZdVAQUBAQdA+nysrzml2UCweAqtpDuncSPlvrcBWKU0yfU0YvYWWAoD
+AQgHAAAAAAAiAP9OdAPppjU1WwpqjIItkxr+VPQRT8Zm/Riw7U3F6v3OiBFHiHoF
+GBYIACwiIQUZNHvJhyRkAl+Z3z7C4AAO2YhIkuH3s+pMlACRWVabVAUCXJH05AIb
+DAAAOSQBAP4BOOIR/sGLNMOfeb5fPs/02QMieoiSjIBnijhob2U5AQC+RtOHCHx7
+TcIYl5/Uyoi+FOvPLcNw4hOv2nwUzSSVAw==
+=IiS2
+-----END PGP PRIVATE KEY BLOCK-----`
+
+// Generated with the above private key
+const v5PrivKeyMsg = `-----BEGIN PGP MESSAGE-----
+Version: OpenPGP.js v4.10.7
+Comment: https://openpgpjs.org
+
+xA0DAQoWGTR7yYckZAIByxF1B21zZy50eHRfbIGSdGVzdMJ3BQEWCgAGBQJf
+bIGSACMiIQUZNHvJhyRkAl+Z3z7C4AAO2YhIkuH3s+pMlACRWVabVDQvAP9G
+y29VPonFXqi2zKkpZrvyvZxg+n5e8Nt9wNbuxeCd3QD/TtO2s+JvjrE4Siwv
+UQdl5MlBka1QSNbMq2Bz7XwNPg4=
+=6lbM
+-----END PGP MESSAGE-----`
+
+const keyWithExpiredCrossSig = `-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+xsDNBF2lnPIBDAC5cL9PQoQLTMuhjbYvb4Ncuuo0bfmgPRFywX53jPhoFf4Zg6mv
+/seOXpgecTdOcVttfzC8ycIKrt3aQTiwOG/ctaR4Bk/t6ayNFfdUNxHWk4WCKzdz
+/56fW2O0F23qIRd8UUJp5IIlN4RDdRCtdhVQIAuzvp2oVy/LaS2kxQoKvph/5pQ/
+5whqsyroEWDJoSV0yOb25B/iwk/pLUFoyhDG9bj0kIzDxrEqW+7Ba8nocQlecMF3
+X5KMN5kp2zraLv9dlBBpWW43XktjcCZgMy20SouraVma8Je/ECwUWYUiAZxLIlMv
+9CurEOtxUw6N3RdOtLmYZS9uEnn5y1UkF88o8Nku890uk6BrewFzJyLAx5wRZ4F0
+qV/yq36UWQ0JB/AUGhHVPdFf6pl6eaxBwT5GXvbBUibtf8YI2og5RsgTWtXfU7eb
+SGXrl5ZMpbA6mbfhd0R8aPxWfmDWiIOhBufhMCvUHh1sApMKVZnvIff9/0Dca3wb
+vLIwa3T4CyshfT0AEQEAAc0hQm9iIEJhYmJhZ2UgPGJvYkBvcGVucGdwLmV4YW1w
+bGU+wsEABBMBCgATBYJeO2eVAgsJAxUICgKbAQIeAQAhCRD7/MgqAV5zMBYhBNGm
+bhojsYLJmA94jPv8yCoBXnMwKWUMAJ3FKZfJ2mXvh+GFqgymvK4NoKkDRPB0CbUN
+aDdG7ZOizQrWXo7Da2MYIZ6eZUDqBKLdhZ5gZfVnisDfu/yeCgpENaKib1MPHpA8
+nZQjnPejbBDomNqY8HRzr5jvXNlwywBpjWGtegCKUY9xbSynjbfzIlMrWL4S+Rfl
++bOOQKRyYJWXmECmVyqY8cz2VUYmETjNcwC8VCDUxQnhtcCJ7Aej22hfYwVEPb/J
+BsJBPq8WECCiGfJ9Y2y6TF+62KzG9Kfs5hqUeHhQy8V4TSi479ewwL7DH86XmIIK
+chSANBS+7iyMtctjNZfmF9zYdGJFvjI/mbBR/lK66E515Inuf75XnL8hqlXuwqvG
+ni+i03Aet1DzULZEIio4uIU6ioc1lGO9h7K2Xn4S7QQH1QoISNMWqXibUR0RCGjw
+FsEDTt2QwJl8XXxoJCooM7BCcCQo+rMNVUHDjIwrdoQjPld3YZsUQQRcqH6bLuln
+cfn5ufl8zTGWKydoj/iTz8KcjZ7w187AzQRdpZzyAQwA1jC/XGxjK6ddgrRfW9j+
+s/U00++EvIsgTs2kr3Rg0GP7FLWV0YNtR1mpl55/bEl7yAxCDTkOgPUMXcaKlnQh
+6zrlt6H53mF6Bvs3inOHQvOsGtU0dqvb1vkTF0juLiJgPlM7pWv+pNQ6IA39vKoQ
+sTMBv4v5vYNXP9GgKbg8inUNT17BxzZYHfw5+q63ectgDm2on1e8CIRCZ76oBVwz
+dkVxoy3gjh1eENlk2D4P0uJNZzF1Q8GV67yLANGMCDICE/OkWn6daipYDzW4iJQt
+YPUWP4hWhjdm+CK+hg6IQUEn2Vtvi16D2blRP8BpUNNa4fNuylWVuJV76rIHvsLZ
+1pbM3LHpRgE8s6jivS3Rz3WRs0TmWCNnvHPqWizQ3VTy+r3UQVJ5AmhJDrZdZq9i
+aUIuZ01PoE1+CHiJwuxPtWvVAxf2POcm1M/F1fK1J0e+lKlQuyonTXqXR22Y41wr
+fP2aPk3nPSTW2DUAf3vRMZg57ZpRxLEhEMxcM4/LMR+PABEBAAHCwrIEGAEKAAkF
+gl8sAVYCmwIB3QkQ+/zIKgFeczDA+qAEGQEKAAwFgl47Z5UFgwB4TOAAIQkQfC+q
+Tfk8N7IWIQQd3OFfCSF87i87N2B8L6pN+Tw3st58C/0exp0X2U4LqicSHEOSqHZj
+jiysdqIELHGyo5DSPv92UFPp36aqjF9OFgtNNwSa56fmAVCD4+hor/fKARRIeIjF
+qdIC5Y/9a4B10NQFJa5lsvB38x/d39LI2kEoglZnqWgdJskROo3vNQF4KlIcm6FH
+dn4WI8UkC5oUUcrpZVMSKoacIaxLwqnXT42nIVgYYuqrd/ZagZZjG5WlrTOd5+NI
+zi/l0fWProcPHGLjmAh4Thu8i7omtVw1nQaMnq9I77ffg3cPDgXknYrLL+q8xXh/
+0mEJyIhnmPwllWCSZuLv9DrD5pOexFfdlwXhf6cLzNpW6QhXD/Tf5KrqIPr9aOv8
+9xaEEXWh0vEby2kIsI2++ft+vfdIyxYw/wKqx0awTSnuBV1rG3z1dswX4BfoY66x
+Bz3KOVqlz9+mG/FTRQwrgPvR+qgLCHbuotxoGN7fzW+PI75hQG5JQAqhsC9sHjQH
+UrI21/VUNwzfw3v5pYsWuFb5bdQ3ASJetICQiMy7IW8WIQTRpm4aI7GCyZgPeIz7
+/MgqAV5zMG6/C/wLpPl/9e6Hf5wmXIUwpZNQbNZvpiCcyx9sXsHXaycOQVxn3McZ
+nYOUP9/mobl1tIeDQyTNbkxWjU0zzJl8XQsDZerb5098pg+x7oGIL7M1vn5s5JMl
+owROourqF88JEtOBxLMxlAM7X4hB48xKQ3Hu9hS1GdnqLKki4MqRGl4l5FUwyGOM
+GjyS3TzkfiDJNwQxybQiC9n57ij20ieNyLfuWCMLcNNnZUgZtnF6wCctoq/0ZIWu
+a7nvuA/XC2WW9YjEJJiWdy5109pqac+qWiY11HWy/nms4gpMdxVpT0RhrKGWq4o0
+M5q3ZElOoeN70UO3OSbU5EVrG7gB1GuwF9mTHUVlV0veSTw0axkta3FGT//XfSpD
+lRrCkyLzwq0M+UUHQAuYpAfobDlDdnxxOD2jm5GyTzak3GSVFfjW09QFVO6HlGp5
+01/jtzkUiS6nwoHHkfnyn0beZuR8X6KlcrzLB0VFgQFLmkSM9cSOgYhD0PTu9aHb
+hW1Hj9AO8lzggBQ=
+=Nt+N
+-----END PGP PUBLIC KEY BLOCK-----
+`
+
+const sigFromKeyWithExpiredCrossSig = `-----BEGIN PGP SIGNATURE-----
+
+wsDzBAABCgAGBYJfLAFsACEJEHwvqk35PDeyFiEEHdzhXwkhfO4vOzdgfC+qTfk8
+N7KiqwwAts4QGB7v9bABCC2qkTxJhmStC0wQMcHRcjL/qAiVnmasQWmvE9KVsdm3
+AaXd8mIx4a37/RRvr9dYrY2eE4uw72cMqPxNja2tvVXkHQvk1oEUqfkvbXs4ypKI
+NyeTWjXNOTZEbg0hbm3nMy+Wv7zgB1CEvAsEboLDJlhGqPcD+X8a6CJGrBGUBUrv
+KVmZr3U6vEzClz3DBLpoddCQseJRhT4YM1nKmBlZ5quh2LFgTSpajv5OsZheqt9y
+EZAPbqmLhDmWRQwGzkWHKceKS7nZ/ox2WK6OS7Ob8ZGZkM64iPo6/EGj5Yc19vQN
+AGiIaPEGszBBWlOpHTPhNm0LB0nMWqqaT87oNYwP8CQuuxDb6rKJ2lffCmZH27Lb
+UbQZcH8J+0UhpeaiadPZxH5ATJAcenmVtVVMLVOFnm+eIlxzov9ntpgGYt8hLdXB
+ITEG9mMgp3TGS9ZzSifMZ8UGtHdp9QdBg8NEVPFzDOMGxpc/Bftav7RRRuPiAER+
+7A5CBid5
+=aQkm
+-----END PGP SIGNATURE-----
+`
+
+const signedMessageWithCriticalNotation = `-----BEGIN PGP MESSAGE-----
+
+owGbwMvMwMH4oOW7S46CznTG09xJDDE3Wl1KUotLuDousDAwcjBYiSmyXL+48d6x
+U1PSGUxcj8IUszKBVMpMaWAAAgEGZpAeh9SKxNyCnFS95PzcytRiBi5OAZjyXXzM
+f8WYLqv7TXP61Sa4rqT12CI3xaN73YS2pt089f96odCKaEPnWJ3iSGmzJaW/ug10
+2Zo8Wj2k4s7t8wt4H3HtTu+y5UZfV3VOO+l//sdE/o+Lsub8FZH7/eOq7OnbNp4n
+vwjE8mqJXetNMfj8r2SCyvkEnlVRYR+/mnge+ib56FdJ8uKtqSxyvgA=
+=fRXs
+-----END PGP MESSAGE-----`
+
+const criticalNotationSigner = `-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mI0EUmEvTgEEANyWtQQMOybQ9JltDqmaX0WnNPJeLILIM36sw6zL0nfTQ5zXSS3+
+fIF6P29lJFxpblWk02PSID5zX/DYU9/zjM2xPO8Oa4xo0cVTOTLj++Ri5mtr//f5
+GLsIXxFrBJhD/ghFsL3Op0GXOeLJ9A5bsOn8th7x6JucNKuaRB6bQbSPABEBAAG0
+JFRlc3QgTWNUZXN0aW5ndG9uIDx0ZXN0QGV4YW1wbGUuY29tPoi5BBMBAgAjBQJS
+YS9OAhsvBwsJCAcDAgEGFQgCCQoLBBYCAwECHgECF4AACgkQSmNhOk1uQJQwDAP6
+AgrTyqkRlJVqz2pb46TfbDM2TDF7o9CBnBzIGoxBhlRwpqALz7z2kxBDmwpQa+ki
+Bq3jZN/UosY9y8bhwMAlnrDY9jP1gdCo+H0sD48CdXybblNwaYpwqC8VSpDdTndf
+9j2wE/weihGp/DAdy/2kyBCaiOY1sjhUfJ1GogF49rC4jQRSYS9OAQQA6R/PtBFa
+JaT4jq10yqASk4sqwVMsc6HcifM5lSdxzExFP74naUMMyEsKHP53QxTF0Grqusag
+Qg/ZtgT0CN1HUM152y7ACOdp1giKjpMzOTQClqCoclyvWOFB+L/SwGEIJf7LSCEr
+woBuJifJc8xAVr0XX0JthoW+uP91eTQ3XpsAEQEAAYkBPQQYAQIACQUCUmEvTgIb
+LgCoCRBKY2E6TW5AlJ0gBBkBAgAGBQJSYS9OAAoJEOCE90RsICyXuqIEANmmiRCA
+SF7YK7PvFkieJNwzeK0V3F2lGX+uu6Y3Q/Zxdtwc4xR+me/CSBmsURyXTO29OWhP
+GLszPH9zSJU9BdDi6v0yNprmFPX/1Ng0Abn/sCkwetvjxC1YIvTLFwtUL/7v6NS2
+bZpsUxRTg9+cSrMWWSNjiY9qUKajm1tuzPDZXAUEAMNmAN3xXN/Kjyvj2OK2ck0X
+W748sl/tc3qiKPMJ+0AkMF7Pjhmh9nxqE9+QCEl7qinFqqBLjuzgUhBU4QlwX1GD
+AtNTq6ihLMD5v1d82ZC7tNatdlDMGWnIdvEMCv2GZcuIqDQ9rXWs49e7tq1NncLY
+hz3tYjKhoFTKEIq3y3Pp
+=h/aX
+-----END PGP PUBLIC KEY BLOCK-----`
diff --git a/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/s2k/s2k.go b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/s2k/s2k.go
new file mode 100644
index 00000000000..a43695964b2
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/s2k/s2k.go
@@ -0,0 +1,407 @@
+// Copyright 2011 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// Package s2k implements the various OpenPGP string-to-key transforms as
+// specified in RFC 4800 section 3.7.1, and Argon2 specified in
+// draft-ietf-openpgp-crypto-refresh-08 section 3.7.1.4.
+package s2k // import "github.com/ProtonMail/go-crypto/openpgp/s2k"
+
+import (
+	"crypto"
+	"hash"
+	"io"
+	"strconv"
+
+	"github.com/ProtonMail/go-crypto/openpgp/errors"
+	"github.com/ProtonMail/go-crypto/openpgp/internal/algorithm"
+	"golang.org/x/crypto/argon2"
+)
+
+type Mode uint8
+
+// Defines the default S2KMode constants
+//
+//	0 (simple), 1(salted), 3(iterated), 4(argon2)
+const (
+	SimpleS2K         Mode = 0
+	SaltedS2K         Mode = 1
+	IteratedSaltedS2K Mode = 3
+	Argon2S2K         Mode = 4
+	GnuS2K            Mode = 101
+)
+
+const Argon2SaltSize int = 16
+
+// Params contains all the parameters of the s2k packet
+type Params struct {
+	// mode is the mode of s2k function.
+	// It can be 0 (simple), 1(salted), 3(iterated)
+	// 2(reserved) 100-110(private/experimental).
+	mode Mode
+	// hashId is the ID of the hash function used in any of the modes
+	hashId byte
+	// salt is a byte array to use as a salt in hashing process or argon2
+	saltBytes [Argon2SaltSize]byte
+	// countByte is used to determine how many rounds of hashing are to
+	// be performed in s2k mode 3. See RFC 4880 Section 3.7.1.3.
+	countByte byte
+	// passes is a parameter in Argon2 to determine the number of iterations
+	// See RFC the crypto refresh Section 3.7.1.4.
+	passes byte
+	// parallelism is a parameter in Argon2 to determine the degree of paralellism
+	// See RFC the crypto refresh Section 3.7.1.4.
+	parallelism byte
+	// memoryExp is a parameter in Argon2 to determine the memory usage
+	// i.e., 2 ** memoryExp kibibytes
+	// See RFC the crypto refresh Section 3.7.1.4.
+	memoryExp byte
+}
+
+// encodeCount converts an iterative "count" in the range 1024 to
+// 65011712, inclusive, to an encoded count. The return value is the
+// octet that is actually stored in the GPG file. encodeCount panics
+// if i is not in the above range (encodedCount above takes care to
+// pass i in the correct range). See RFC 4880 Section 3.7.7.1.
+func encodeCount(i int) uint8 {
+	if i < 65536 || i > 65011712 {
+		panic("count arg i outside the required range")
+	}
+
+	for encoded := 96; encoded < 256; encoded++ {
+		count := decodeCount(uint8(encoded))
+		if count >= i {
+			return uint8(encoded)
+		}
+	}
+
+	return 255
+}
+
+// decodeCount returns the s2k mode 3 iterative "count" corresponding to
+// the encoded octet c.
+func decodeCount(c uint8) int {
+	return (16 + int(c&15)) << (uint32(c>>4) + 6)
+}
+
+// encodeMemory converts the Argon2 "memory" in the range parallelism*8 to
+// 2**31, inclusive, to an encoded memory. The return value is the
+// octet that is actually stored in the GPG file. encodeMemory panics
+// if is not in the above range 
+// See OpenPGP crypto refresh Section 3.7.1.4.
+func encodeMemory(memory uint32, parallelism uint8) uint8 {
+	if memory < (8 * uint32(parallelism)) || memory > uint32(2147483648) {
+		panic("Memory argument memory is outside the required range")
+	}
+
+	for exp := 3; exp < 31; exp++ {
+		compare := decodeMemory(uint8(exp))
+		if compare >= memory {
+			return uint8(exp)
+		}
+	}
+
+	return 31
+}
+
+// decodeMemory computes the decoded memory in kibibytes as 2**memoryExponent
+func decodeMemory(memoryExponent uint8) uint32 {
+	return uint32(1) << memoryExponent
+}
+
+// Simple writes to out the result of computing the Simple S2K function (RFC
+// 4880, section 3.7.1.1) using the given hash and input passphrase.
+func Simple(out []byte, h hash.Hash, in []byte) {
+	Salted(out, h, in, nil)
+}
+
+var zero [1]byte
+
+// Salted writes to out the result of computing the Salted S2K function (RFC
+// 4880, section 3.7.1.2) using the given hash, input passphrase and salt.
+func Salted(out []byte, h hash.Hash, in []byte, salt []byte) {
+	done := 0
+	var digest []byte
+
+	for i := 0; done < len(out); i++ {
+		h.Reset()
+		for j := 0; j < i; j++ {
+			h.Write(zero[:])
+		}
+		h.Write(salt)
+		h.Write(in)
+		digest = h.Sum(digest[:0])
+		n := copy(out[done:], digest)
+		done += n
+	}
+}
+
+// Iterated writes to out the result of computing the Iterated and Salted S2K
+// function (RFC 4880, section 3.7.1.3) using the given hash, input passphrase,
+// salt and iteration count.
+func Iterated(out []byte, h hash.Hash, in []byte, salt []byte, count int) {
+	combined := make([]byte, len(in)+len(salt))
+	copy(combined, salt)
+	copy(combined[len(salt):], in)
+
+	if count < len(combined) {
+		count = len(combined)
+	}
+
+	done := 0
+	var digest []byte
+	for i := 0; done < len(out); i++ {
+		h.Reset()
+		for j := 0; j < i; j++ {
+			h.Write(zero[:])
+		}
+		written := 0
+		for written < count {
+			if written+len(combined) > count {
+				todo := count - written
+				h.Write(combined[:todo])
+				written = count
+			} else {
+				h.Write(combined)
+				written += len(combined)
+			}
+		}
+		digest = h.Sum(digest[:0])
+		n := copy(out[done:], digest)
+		done += n
+	}
+}
+
+// Argon2 writes to out the key derived from the password (in) with the Argon2
+// function (the crypto refresh, section 3.7.1.4)
+func Argon2(out []byte, in []byte, salt []byte, passes uint8, paralellism uint8, memoryExp uint8) {
+	key := argon2.IDKey(in, salt, uint32(passes), decodeMemory(memoryExp), paralellism, uint32(len(out)))
+	copy(out[:], key)
+}
+
+// Generate generates valid parameters from given configuration.
+// It will enforce the Iterated and Salted or Argon2 S2K method.
+func Generate(rand io.Reader, c *Config) (*Params, error) {
+	var params *Params
+	if c != nil && c.Mode() == Argon2S2K {
+		// handle Argon2 case
+		argonConfig := c.Argon2()
+		params = &Params{
+			mode:        Argon2S2K,
+			passes:      argonConfig.Passes(),
+			parallelism: argonConfig.Parallelism(),
+			memoryExp:   argonConfig.EncodedMemory(),
+		}
+	} else if c != nil && c.PassphraseIsHighEntropy && c.Mode() == SaltedS2K { // Allow SaltedS2K if PassphraseIsHighEntropy
+		hashId, ok := algorithm.HashToHashId(c.hash())
+		if !ok {
+			return nil, errors.UnsupportedError("no such hash")
+		}
+
+		params = &Params{
+			mode:      SaltedS2K,
+			hashId:    hashId,
+		}
+	} else { // Enforce IteratedSaltedS2K method otherwise
+		hashId, ok := algorithm.HashToHashId(c.hash())
+		if !ok {
+			return nil, errors.UnsupportedError("no such hash")
+		}
+		if c != nil {
+			c.S2KMode = IteratedSaltedS2K
+		}
+		params = &Params{
+			mode:      IteratedSaltedS2K, 
+			hashId:    hashId,
+			countByte: c.EncodedCount(),
+		}
+	}
+	if _, err := io.ReadFull(rand, params.salt()); err != nil {
+		return nil, err
+	}
+	return params, nil
+}
+
+// Parse reads a binary specification for a string-to-key transformation from r
+// and returns a function which performs that transform. If the S2K is a special
+// GNU extension that indicates that the private key is missing, then the error
+// returned is errors.ErrDummyPrivateKey.
+func Parse(r io.Reader) (f func(out, in []byte), err error) {
+	params, err := ParseIntoParams(r)
+	if err != nil {
+		return nil, err
+	}
+
+	return params.Function()
+}
+
+// ParseIntoParams reads a binary specification for a string-to-key
+// transformation from r and returns a struct describing the s2k parameters.
+func ParseIntoParams(r io.Reader) (params *Params, err error) {
+	var buf [Argon2SaltSize + 3]byte
+
+	_, err = io.ReadFull(r, buf[:1])
+	if err != nil {
+		return
+	}
+
+	params = &Params{
+		mode: Mode(buf[0]),
+	}
+
+	switch params.mode {
+	case SimpleS2K:
+		_, err = io.ReadFull(r, buf[:1])
+		if err != nil {
+			return nil, err
+		}
+		params.hashId = buf[0]
+		return params, nil
+	case SaltedS2K:
+		_, err = io.ReadFull(r, buf[:9])
+		if err != nil {
+			return nil, err
+		}
+		params.hashId = buf[0]
+		copy(params.salt(), buf[1:9])
+		return params, nil
+	case IteratedSaltedS2K:
+		_, err = io.ReadFull(r, buf[:10])
+		if err != nil {
+			return nil, err
+		}
+		params.hashId = buf[0]
+		copy(params.salt(), buf[1:9])
+		params.countByte = buf[9]
+		return params, nil
+	case Argon2S2K:
+		_, err = io.ReadFull(r, buf[:Argon2SaltSize+3])
+		if err != nil {
+			return nil, err
+		}
+		copy(params.salt(), buf[:Argon2SaltSize])
+		params.passes = buf[Argon2SaltSize]
+		params.parallelism = buf[Argon2SaltSize+1]
+		params.memoryExp = buf[Argon2SaltSize+2]
+		return params, nil
+	case GnuS2K:
+		// This is a GNU extension. See
+		// https://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=blob;f=doc/DETAILS;h=fe55ae16ab4e26d8356dc574c9e8bc935e71aef1;hb=23191d7851eae2217ecdac6484349849a24fd94a#l1109
+		if _, err = io.ReadFull(r, buf[:5]); err != nil {
+			return nil, err
+		}
+		params.hashId = buf[0]
+		if buf[1] == 'G' && buf[2] == 'N' && buf[3] == 'U' && buf[4] == 1 {
+			return params, nil
+		}
+		return nil, errors.UnsupportedError("GNU S2K extension")
+	}
+
+	return nil, errors.UnsupportedError("S2K function")
+}
+
+func (params *Params) Dummy() bool {
+	return params != nil && params.mode == GnuS2K
+}
+
+func (params *Params) salt() []byte {
+	switch params.mode {
+		case SaltedS2K, IteratedSaltedS2K: return params.saltBytes[:8]
+		case Argon2S2K: return params.saltBytes[:Argon2SaltSize]
+		default: return nil
+	}
+}
+
+func (params *Params) Function() (f func(out, in []byte), err error) {
+	if params.Dummy() {
+		return nil, errors.ErrDummyPrivateKey("dummy key found")
+	}
+	var hashObj crypto.Hash
+	if params.mode != Argon2S2K {
+		var ok bool
+		hashObj, ok = algorithm.HashIdToHashWithSha1(params.hashId)
+		if !ok {
+			return nil, errors.UnsupportedError("hash for S2K function: " + strconv.Itoa(int(params.hashId)))
+		}
+		if !hashObj.Available() {
+			return nil, errors.UnsupportedError("hash not available: " + strconv.Itoa(int(hashObj)))
+		}
+	}
+
+	switch params.mode {
+	case SimpleS2K:
+		f := func(out, in []byte) {
+			Simple(out, hashObj.New(), in)
+		}
+
+		return f, nil
+	case SaltedS2K:
+		f := func(out, in []byte) {
+			Salted(out, hashObj.New(), in, params.salt())
+		}
+
+		return f, nil
+	case IteratedSaltedS2K:
+		f := func(out, in []byte) {
+			Iterated(out, hashObj.New(), in, params.salt(), decodeCount(params.countByte))
+		}
+
+		return f, nil
+	case Argon2S2K:
+		f := func(out, in []byte) {
+			Argon2(out, in, params.salt(), params.passes, params.parallelism, params.memoryExp)
+		}
+		return f, nil
+	}
+
+	return nil, errors.UnsupportedError("S2K function")
+}
+
+func (params *Params) Serialize(w io.Writer) (err error) {
+	if _, err = w.Write([]byte{uint8(params.mode)}); err != nil {
+		return
+	}
+	if params.mode != Argon2S2K {
+		if _, err = w.Write([]byte{params.hashId}); err != nil {
+			return
+		}
+	}
+	if params.Dummy() {
+		_, err = w.Write(append([]byte("GNU"), 1))
+		return
+	}
+	if params.mode > 0 {
+		if _, err = w.Write(params.salt()); err != nil {
+			return
+		}
+		if params.mode == IteratedSaltedS2K {
+			_, err = w.Write([]byte{params.countByte})
+		}
+		if params.mode == Argon2S2K {
+			_, err = w.Write([]byte{params.passes, params.parallelism, params.memoryExp})
+		}
+	}
+	return
+}
+
+// Serialize salts and stretches the given passphrase and writes the
+// resulting key into key. It also serializes an S2K descriptor to
+// w. The key stretching can be configured with c, which may be
+// nil. In that case, sensible defaults will be used.
+func Serialize(w io.Writer, key []byte, rand io.Reader, passphrase []byte, c *Config) error {
+	params, err := Generate(rand, c)
+	if err != nil {
+		return err
+	}
+	err = params.Serialize(w)
+	if err != nil {
+		return err
+	}
+
+	f, err := params.Function()
+	if err != nil {
+		return err
+	}
+	f(key, passphrase)
+	return nil
+}
diff --git a/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/s2k/s2k_cache.go b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/s2k/s2k_cache.go
new file mode 100644
index 00000000000..25a4442dfbd
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/s2k/s2k_cache.go
@@ -0,0 +1,26 @@
+package s2k
+
+// Cache stores keys derived with s2k functions from one passphrase
+// to avoid recomputation if multiple items are encrypted with
+// the same parameters.
+type Cache map[Params][]byte
+
+// GetOrComputeDerivedKey tries to retrieve the key 
+// for the given s2k parameters from the cache.
+// If there is no hit, it derives the key with the s2k function from the passphrase,
+// updates the cache, and returns the key.
+func (c *Cache) GetOrComputeDerivedKey(passphrase []byte, params *Params, expectedKeySize int) ([]byte, error) {
+	key, found := (*c)[*params]
+	if !found || len(key) != expectedKeySize {
+		var err error
+		derivedKey := make([]byte, expectedKeySize)
+		s2k, err := params.Function()
+		if err != nil {
+			return nil, err
+		}
+		s2k(derivedKey, passphrase)
+		(*c)[*params] = key
+		return derivedKey, nil
+	}
+	return key, nil
+}
diff --git a/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/s2k/s2k_config.go b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/s2k/s2k_config.go
new file mode 100644
index 00000000000..b40be5228fc
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/s2k/s2k_config.go
@@ -0,0 +1,129 @@
+package s2k
+
+import "crypto"
+
+// Config collects configuration parameters for s2k key-stretching
+// transformations. A nil *Config is valid and results in all default
+// values.
+type Config struct {
+	// S2K (String to Key) mode, used for key derivation in the context of secret key encryption
+	// and passphrase-encrypted data. Either s2k.Argon2S2K or s2k.IteratedSaltedS2K may be used.
+	// If the passphrase is a high-entropy key, indicated by setting PassphraseIsHighEntropy to true,
+	// s2k.SaltedS2K can also be used.
+	// Note: Argon2 is the strongest option but not all OpenPGP implementations are compatible with it
+	//(pending standardisation).
+	// 0 (simple), 1(salted), 3(iterated), 4(argon2)
+	// 2(reserved) 100-110(private/experimental).
+	S2KMode Mode
+	// Only relevant if S2KMode is not set to s2k.Argon2S2K.
+	// Hash is the default hash function to be used. If
+	// nil, SHA256 is used.
+	Hash crypto.Hash
+	// Argon2 parameters for S2K (String to Key).
+	// Only relevant if S2KMode is set to s2k.Argon2S2K.
+	// If nil, default parameters are used.
+	// For more details on the choice of parameters, see https://tools.ietf.org/html/rfc9106#section-4.
+	Argon2Config *Argon2Config
+	// Only relevant if S2KMode is set to s2k.IteratedSaltedS2K.
+	// Iteration count for Iterated S2K (String to Key). It
+	// determines the strength of the passphrase stretching when
+	// the said passphrase is hashed to produce a key. S2KCount
+	// should be between 65536 and 65011712, inclusive. If Config
+	// is nil or S2KCount is 0, the value 16777216 used. Not all
+	// values in the above range can be represented. S2KCount will
+	// be rounded up to the next representable value if it cannot
+	// be encoded exactly. When set, it is strongly encrouraged to
+	// use a value that is at least 65536. See RFC 4880 Section
+	// 3.7.1.3.
+	S2KCount int
+	// Indicates whether the passphrase passed by the application is a
+	// high-entropy key (e.g. it's randomly generated or derived from
+	// another passphrase using a strong key derivation function).
+	// When true, allows the S2KMode to be s2k.SaltedS2K.
+	// When the passphrase is not a high-entropy key, using SaltedS2K is
+	// insecure, and not allowed by draft-ietf-openpgp-crypto-refresh-08.
+	PassphraseIsHighEntropy bool
+}
+
+// Argon2Config stores the Argon2 parameters
+// A nil *Argon2Config is valid and results in all default
+type Argon2Config struct {
+	NumberOfPasses      uint8
+	DegreeOfParallelism uint8
+	// The memory parameter for Argon2 specifies desired memory usage in kibibytes. 
+	// For example memory=64*1024 sets the memory cost to ~64 MB.
+	Memory      	    uint32 
+}
+
+func (c *Config) Mode() Mode {
+	if c == nil {
+		return IteratedSaltedS2K
+	}
+	return c.S2KMode
+}
+
+func (c *Config) hash() crypto.Hash {
+	if c == nil || uint(c.Hash) == 0 {
+		return crypto.SHA256
+	}
+
+	return c.Hash
+}
+
+func (c *Config) Argon2() *Argon2Config {
+	if c == nil || c.Argon2Config == nil {
+		return nil
+	}
+	return c.Argon2Config
+}
+
+// EncodedCount get encoded count
+func (c *Config) EncodedCount() uint8 {
+	if c == nil || c.S2KCount == 0 {
+		return 224 // The common case. Corresponding to 16777216
+	}
+
+	i := c.S2KCount
+
+	switch {
+	case i < 65536:
+		i = 65536
+	case i > 65011712:
+		i = 65011712
+	}
+
+	return encodeCount(i)
+}
+
+func (c *Argon2Config) Passes() uint8 {
+	if c == nil || c.NumberOfPasses == 0 {
+		return 3
+	}
+	return c.NumberOfPasses
+}
+
+func (c *Argon2Config) Parallelism() uint8 {
+	if c == nil || c.DegreeOfParallelism == 0 {
+		return 4
+	}
+	return c.DegreeOfParallelism
+}
+
+func (c *Argon2Config) EncodedMemory() uint8 {
+	if c == nil || c.Memory == 0 {
+		return 16 // 64 MiB of RAM
+	}
+
+	memory := c.Memory
+	lowerBound := uint32(c.Parallelism())*8
+	upperBound := uint32(2147483648)
+
+	switch {
+	case memory < lowerBound:
+		memory = lowerBound
+	case memory > upperBound:
+		memory = upperBound
+	}
+
+	return encodeMemory(memory, c.Parallelism())
+}
diff --git a/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/write.go b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/write.go
new file mode 100644
index 00000000000..7fdd13a3dd3
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/ProtonMail/go-crypto/openpgp/write.go
@@ -0,0 +1,583 @@
+// Copyright 2011 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package openpgp
+
+import (
+	"crypto"
+	"hash"
+	"io"
+	"strconv"
+	"time"
+
+	"github.com/ProtonMail/go-crypto/openpgp/armor"
+	"github.com/ProtonMail/go-crypto/openpgp/errors"
+	"github.com/ProtonMail/go-crypto/openpgp/internal/algorithm"
+	"github.com/ProtonMail/go-crypto/openpgp/packet"
+)
+
+// DetachSign signs message with the private key from signer (which must
+// already have been decrypted) and writes the signature to w.
+// If config is nil, sensible defaults will be used.
+func DetachSign(w io.Writer, signer *Entity, message io.Reader, config *packet.Config) error {
+	return detachSign(w, signer, message, packet.SigTypeBinary, config)
+}
+
+// ArmoredDetachSign signs message with the private key from signer (which
+// must already have been decrypted) and writes an armored signature to w.
+// If config is nil, sensible defaults will be used.
+func ArmoredDetachSign(w io.Writer, signer *Entity, message io.Reader, config *packet.Config) (err error) {
+	return armoredDetachSign(w, signer, message, packet.SigTypeBinary, config)
+}
+
+// DetachSignText signs message (after canonicalising the line endings) with
+// the private key from signer (which must already have been decrypted) and
+// writes the signature to w.
+// If config is nil, sensible defaults will be used.
+func DetachSignText(w io.Writer, signer *Entity, message io.Reader, config *packet.Config) error {
+	return detachSign(w, signer, message, packet.SigTypeText, config)
+}
+
+// ArmoredDetachSignText signs message (after canonicalising the line endings)
+// with the private key from signer (which must already have been decrypted)
+// and writes an armored signature to w.
+// If config is nil, sensible defaults will be used.
+func ArmoredDetachSignText(w io.Writer, signer *Entity, message io.Reader, config *packet.Config) error {
+	return armoredDetachSign(w, signer, message, packet.SigTypeText, config)
+}
+
+func armoredDetachSign(w io.Writer, signer *Entity, message io.Reader, sigType packet.SignatureType, config *packet.Config) (err error) {
+	out, err := armor.Encode(w, SignatureType, nil)
+	if err != nil {
+		return
+	}
+	err = detachSign(out, signer, message, sigType, config)
+	if err != nil {
+		return
+	}
+	return out.Close()
+}
+
+func detachSign(w io.Writer, signer *Entity, message io.Reader, sigType packet.SignatureType, config *packet.Config) (err error) {
+	signingKey, ok := signer.SigningKeyById(config.Now(), config.SigningKey())
+	if !ok {
+		return errors.InvalidArgumentError("no valid signing keys")
+	}
+	if signingKey.PrivateKey == nil {
+		return errors.InvalidArgumentError("signing key doesn't have a private key")
+	}
+	if signingKey.PrivateKey.Encrypted {
+		return errors.InvalidArgumentError("signing key is encrypted")
+	}
+	if _, ok := algorithm.HashToHashId(config.Hash()); !ok {
+		return errors.InvalidArgumentError("invalid hash function")
+	}
+
+	sig := createSignaturePacket(signingKey.PublicKey, sigType, config)
+
+	h, wrappedHash, err := hashForSignature(sig.Hash, sig.SigType)
+	if err != nil {
+		return
+	}
+	if _, err = io.Copy(wrappedHash, message); err != nil {
+		return err
+	}
+
+	err = sig.Sign(h, signingKey.PrivateKey, config)
+	if err != nil {
+		return
+	}
+
+	return sig.Serialize(w)
+}
+
+// FileHints contains metadata about encrypted files. This metadata is, itself,
+// encrypted.
+type FileHints struct {
+	// IsBinary can be set to hint that the contents are binary data.
+	IsBinary bool
+	// FileName hints at the name of the file that should be written. It's
+	// truncated to 255 bytes if longer. It may be empty to suggest that the
+	// file should not be written to disk. It may be equal to "_CONSOLE" to
+	// suggest the data should not be written to disk.
+	FileName string
+	// ModTime contains the modification time of the file, or the zero time if not applicable.
+	ModTime time.Time
+}
+
+// SymmetricallyEncrypt acts like gpg -c: it encrypts a file with a passphrase.
+// The resulting WriteCloser must be closed after the contents of the file have
+// been written.
+// If config is nil, sensible defaults will be used.
+func SymmetricallyEncrypt(ciphertext io.Writer, passphrase []byte, hints *FileHints, config *packet.Config) (plaintext io.WriteCloser, err error) {
+	if hints == nil {
+		hints = &FileHints{}
+	}
+
+	key, err := packet.SerializeSymmetricKeyEncrypted(ciphertext, passphrase, config)
+	if err != nil {
+		return
+	}
+
+	var w io.WriteCloser
+	cipherSuite := packet.CipherSuite{
+		Cipher: config.Cipher(),
+		Mode:   config.AEAD().Mode(),
+	}
+	w, err = packet.SerializeSymmetricallyEncrypted(ciphertext, config.Cipher(), config.AEAD() != nil, cipherSuite, key, config)
+	if err != nil {
+		return
+	}
+
+	literalData := w
+	if algo := config.Compression(); algo != packet.CompressionNone {
+		var compConfig *packet.CompressionConfig
+		if config != nil {
+			compConfig = config.CompressionConfig
+		}
+		literalData, err = packet.SerializeCompressed(w, algo, compConfig)
+		if err != nil {
+			return
+		}
+	}
+
+	var epochSeconds uint32
+	if !hints.ModTime.IsZero() {
+		epochSeconds = uint32(hints.ModTime.Unix())
+	}
+	return packet.SerializeLiteral(literalData, hints.IsBinary, hints.FileName, epochSeconds)
+}
+
+// intersectPreferences mutates and returns a prefix of a that contains only
+// the values in the intersection of a and b. The order of a is preserved.
+func intersectPreferences(a []uint8, b []uint8) (intersection []uint8) {
+	var j int
+	for _, v := range a {
+		for _, v2 := range b {
+			if v == v2 {
+				a[j] = v
+				j++
+				break
+			}
+		}
+	}
+
+	return a[:j]
+}
+
+// intersectPreferences mutates and returns a prefix of a that contains only
+// the values in the intersection of a and b. The order of a is preserved.
+func intersectCipherSuites(a [][2]uint8, b [][2]uint8) (intersection [][2]uint8) {
+	var j int
+	for _, v := range a {
+		for _, v2 := range b {
+			if v[0] == v2[0] && v[1] == v2[1] {
+				a[j] = v
+				j++
+				break
+			}
+		}
+	}
+
+	return a[:j]
+}
+
+func hashToHashId(h crypto.Hash) uint8 {
+	v, ok := algorithm.HashToHashId(h)
+	if !ok {
+		panic("tried to convert unknown hash")
+	}
+	return v
+}
+
+// EncryptText encrypts a message to a number of recipients and, optionally,
+// signs it. Optional information is contained in 'hints', also encrypted, that
+// aids the recipients in processing the message. The resulting WriteCloser
+// must be closed after the contents of the file have been written. If config
+// is nil, sensible defaults will be used. The signing is done in text mode.
+func EncryptText(ciphertext io.Writer, to []*Entity, signed *Entity, hints *FileHints, config *packet.Config) (plaintext io.WriteCloser, err error) {
+	return encrypt(ciphertext, ciphertext, to, signed, hints, packet.SigTypeText, config)
+}
+
+// Encrypt encrypts a message to a number of recipients and, optionally, signs
+// it. hints contains optional information, that is also encrypted, that aids
+// the recipients in processing the message. The resulting WriteCloser must
+// be closed after the contents of the file have been written.
+// If config is nil, sensible defaults will be used.
+func Encrypt(ciphertext io.Writer, to []*Entity, signed *Entity, hints *FileHints, config *packet.Config) (plaintext io.WriteCloser, err error) {
+	return encrypt(ciphertext, ciphertext, to, signed, hints, packet.SigTypeBinary, config)
+}
+
+// EncryptSplit encrypts a message to a number of recipients and, optionally, signs
+// it. hints contains optional information, that is also encrypted, that aids
+// the recipients in processing the message. The resulting WriteCloser must
+// be closed after the contents of the file have been written.
+// If config is nil, sensible defaults will be used.
+func EncryptSplit(keyWriter io.Writer, dataWriter io.Writer, to []*Entity, signed *Entity, hints *FileHints, config *packet.Config) (plaintext io.WriteCloser, err error) {
+	return encrypt(keyWriter, dataWriter, to, signed, hints, packet.SigTypeBinary, config)
+}
+
+// EncryptTextSplit encrypts a message to a number of recipients and, optionally, signs
+// it. hints contains optional information, that is also encrypted, that aids
+// the recipients in processing the message. The resulting WriteCloser must
+// be closed after the contents of the file have been written.
+// If config is nil, sensible defaults will be used.
+func EncryptTextSplit(keyWriter io.Writer, dataWriter io.Writer, to []*Entity, signed *Entity, hints *FileHints, config *packet.Config) (plaintext io.WriteCloser, err error) {
+	return encrypt(keyWriter, dataWriter, to, signed, hints, packet.SigTypeText, config)
+}
+
+// writeAndSign writes the data as a payload package and, optionally, signs
+// it. hints contains optional information, that is also encrypted,
+// that aids the recipients in processing the message. The resulting
+// WriteCloser must be closed after the contents of the file have been
+// written. If config is nil, sensible defaults will be used.
+func writeAndSign(payload io.WriteCloser, candidateHashes []uint8, signed *Entity, hints *FileHints, sigType packet.SignatureType, config *packet.Config) (plaintext io.WriteCloser, err error) {
+	var signer *packet.PrivateKey
+	if signed != nil {
+		signKey, ok := signed.SigningKeyById(config.Now(), config.SigningKey())
+		if !ok {
+			return nil, errors.InvalidArgumentError("no valid signing keys")
+		}
+		signer = signKey.PrivateKey
+		if signer == nil {
+			return nil, errors.InvalidArgumentError("no private key in signing key")
+		}
+		if signer.Encrypted {
+			return nil, errors.InvalidArgumentError("signing key must be decrypted")
+		}
+	}
+
+	var hash crypto.Hash
+	for _, hashId := range candidateHashes {
+		if h, ok := algorithm.HashIdToHash(hashId); ok && h.Available() {
+			hash = h
+			break
+		}
+	}
+
+	// If the hash specified by config is a candidate, we'll use that.
+	if configuredHash := config.Hash(); configuredHash.Available() {
+		for _, hashId := range candidateHashes {
+			if h, ok := algorithm.HashIdToHash(hashId); ok && h == configuredHash {
+				hash = h
+				break
+			}
+		}
+	}
+
+	if hash == 0 {
+		hashId := candidateHashes[0]
+		name, ok := algorithm.HashIdToString(hashId)
+		if !ok {
+			name = "#" + strconv.Itoa(int(hashId))
+		}
+		return nil, errors.InvalidArgumentError("cannot encrypt because no candidate hash functions are compiled in. (Wanted " + name + " in this case.)")
+	}
+
+	if signer != nil {
+		ops := &packet.OnePassSignature{
+			SigType:    sigType,
+			Hash:       hash,
+			PubKeyAlgo: signer.PubKeyAlgo,
+			KeyId:      signer.KeyId,
+			IsLast:     true,
+		}
+		if err := ops.Serialize(payload); err != nil {
+			return nil, err
+		}
+	}
+
+	if hints == nil {
+		hints = &FileHints{}
+	}
+
+	w := payload
+	if signer != nil {
+		// If we need to write a signature packet after the literal
+		// data then we need to stop literalData from closing
+		// encryptedData.
+		w = noOpCloser{w}
+
+	}
+	var epochSeconds uint32
+	if !hints.ModTime.IsZero() {
+		epochSeconds = uint32(hints.ModTime.Unix())
+	}
+	literalData, err := packet.SerializeLiteral(w, hints.IsBinary, hints.FileName, epochSeconds)
+	if err != nil {
+		return nil, err
+	}
+
+	if signer != nil {
+		h, wrappedHash, err := hashForSignature(hash, sigType)
+		if err != nil {
+			return nil, err
+		}
+		metadata := &packet.LiteralData{
+			Format:   't',
+			FileName: hints.FileName,
+			Time:     epochSeconds,
+		}
+		if hints.IsBinary {
+			metadata.Format = 'b'
+		}
+		return signatureWriter{payload, literalData, hash, wrappedHash, h, signer, sigType, config, metadata}, nil
+	}
+	return literalData, nil
+}
+
+// encrypt encrypts a message to a number of recipients and, optionally, signs
+// it. hints contains optional information, that is also encrypted, that aids
+// the recipients in processing the message. The resulting WriteCloser must
+// be closed after the contents of the file have been written.
+// If config is nil, sensible defaults will be used.
+func encrypt(keyWriter io.Writer, dataWriter io.Writer, to []*Entity, signed *Entity, hints *FileHints, sigType packet.SignatureType, config *packet.Config) (plaintext io.WriteCloser, err error) {
+	if len(to) == 0 {
+		return nil, errors.InvalidArgumentError("no encryption recipient provided")
+	}
+
+	// These are the possible ciphers that we'll use for the message.
+	candidateCiphers := []uint8{
+		uint8(packet.CipherAES256),
+		uint8(packet.CipherAES128),
+	}
+
+	// These are the possible hash functions that we'll use for the signature.
+	candidateHashes := []uint8{
+		hashToHashId(crypto.SHA256),
+		hashToHashId(crypto.SHA384),
+		hashToHashId(crypto.SHA512),
+		hashToHashId(crypto.SHA3_256),
+		hashToHashId(crypto.SHA3_512),
+	}
+
+	// Prefer GCM if everyone supports it
+	candidateCipherSuites := [][2]uint8{
+		{uint8(packet.CipherAES256), uint8(packet.AEADModeGCM)},
+		{uint8(packet.CipherAES256), uint8(packet.AEADModeEAX)},
+		{uint8(packet.CipherAES256), uint8(packet.AEADModeOCB)},
+		{uint8(packet.CipherAES128), uint8(packet.AEADModeGCM)},
+		{uint8(packet.CipherAES128), uint8(packet.AEADModeEAX)},
+		{uint8(packet.CipherAES128), uint8(packet.AEADModeOCB)},
+	}
+
+	candidateCompression := []uint8{
+		uint8(packet.CompressionNone),
+		uint8(packet.CompressionZIP),
+		uint8(packet.CompressionZLIB),
+	}
+
+	encryptKeys := make([]Key, len(to))
+
+	// AEAD is used only if config enables it and every key supports it
+	aeadSupported := config.AEAD() != nil
+
+	for i := range to {
+		var ok bool
+		encryptKeys[i], ok = to[i].EncryptionKey(config.Now())
+		if !ok {
+			return nil, errors.InvalidArgumentError("cannot encrypt a message to key id " + strconv.FormatUint(to[i].PrimaryKey.KeyId, 16) + " because it has no valid encryption keys")
+		}
+
+		sig := to[i].PrimaryIdentity().SelfSignature
+		if !sig.SEIPDv2 {
+			aeadSupported = false
+		}
+
+		candidateCiphers = intersectPreferences(candidateCiphers, sig.PreferredSymmetric)
+		candidateHashes = intersectPreferences(candidateHashes, sig.PreferredHash)
+		candidateCipherSuites = intersectCipherSuites(candidateCipherSuites, sig.PreferredCipherSuites)
+		candidateCompression = intersectPreferences(candidateCompression, sig.PreferredCompression)
+	}
+
+	// In the event that the intersection of supported algorithms is empty we use the ones
+	// labelled as MUST that every implementation supports.
+	if len(candidateCiphers) == 0 {
+		// https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-07.html#section-9.3
+		candidateCiphers = []uint8{uint8(packet.CipherAES128)}
+	}
+	if len(candidateHashes) == 0 {
+		// https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-07.html#hash-algos
+		candidateHashes = []uint8{hashToHashId(crypto.SHA256)}
+	}
+	if len(candidateCipherSuites) == 0 {
+		// https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-07.html#section-9.6
+		candidateCipherSuites = [][2]uint8{{uint8(packet.CipherAES128), uint8(packet.AEADModeOCB)}}
+	}
+
+	cipher := packet.CipherFunction(candidateCiphers[0])
+	aeadCipherSuite := packet.CipherSuite{
+		Cipher: packet.CipherFunction(candidateCipherSuites[0][0]),
+		Mode:   packet.AEADMode(candidateCipherSuites[0][1]),
+	}
+
+	// If the cipher specified by config is a candidate, we'll use that.
+	configuredCipher := config.Cipher()
+	for _, c := range candidateCiphers {
+		cipherFunc := packet.CipherFunction(c)
+		if cipherFunc == configuredCipher {
+			cipher = cipherFunc
+			break
+		}
+	}
+
+	symKey := make([]byte, cipher.KeySize())
+	if _, err := io.ReadFull(config.Random(), symKey); err != nil {
+		return nil, err
+	}
+
+	for _, key := range encryptKeys {
+		if err := packet.SerializeEncryptedKey(keyWriter, key.PublicKey, cipher, symKey, config); err != nil {
+			return nil, err
+		}
+	}
+
+	var payload io.WriteCloser
+	payload, err = packet.SerializeSymmetricallyEncrypted(dataWriter, cipher, aeadSupported, aeadCipherSuite, symKey, config)
+	if err != nil {
+		return
+	}
+
+	payload, err = handleCompression(payload, candidateCompression, config)
+	if err != nil {
+		return nil, err
+	}
+
+	return writeAndSign(payload, candidateHashes, signed, hints, sigType, config)
+}
+
+// Sign signs a message. The resulting WriteCloser must be closed after the
+// contents of the file have been written.  hints contains optional information
+// that aids the recipients in processing the message.
+// If config is nil, sensible defaults will be used.
+func Sign(output io.Writer, signed *Entity, hints *FileHints, config *packet.Config) (input io.WriteCloser, err error) {
+	if signed == nil {
+		return nil, errors.InvalidArgumentError("no signer provided")
+	}
+
+	// These are the possible hash functions that we'll use for the signature.
+	candidateHashes := []uint8{
+		hashToHashId(crypto.SHA256),
+		hashToHashId(crypto.SHA384),
+		hashToHashId(crypto.SHA512),
+		hashToHashId(crypto.SHA3_256),
+		hashToHashId(crypto.SHA3_512),
+	}
+	defaultHashes := candidateHashes[0:1]
+	preferredHashes := signed.PrimaryIdentity().SelfSignature.PreferredHash
+	if len(preferredHashes) == 0 {
+		preferredHashes = defaultHashes
+	}
+	candidateHashes = intersectPreferences(candidateHashes, preferredHashes)
+	if len(candidateHashes) == 0 {
+		return nil, errors.InvalidArgumentError("cannot sign because signing key shares no common algorithms with candidate hashes")
+	}
+
+	return writeAndSign(noOpCloser{output}, candidateHashes, signed, hints, packet.SigTypeBinary, config)
+}
+
+// signatureWriter hashes the contents of a message while passing it along to
+// literalData. When closed, it closes literalData, writes a signature packet
+// to encryptedData and then also closes encryptedData.
+type signatureWriter struct {
+	encryptedData io.WriteCloser
+	literalData   io.WriteCloser
+	hashType      crypto.Hash
+	wrappedHash   hash.Hash
+	h             hash.Hash
+	signer        *packet.PrivateKey
+	sigType       packet.SignatureType
+	config        *packet.Config
+	metadata      *packet.LiteralData // V5 signatures protect document metadata
+}
+
+func (s signatureWriter) Write(data []byte) (int, error) {
+	s.wrappedHash.Write(data)
+	switch s.sigType {
+	case packet.SigTypeBinary:
+		return s.literalData.Write(data)
+	case packet.SigTypeText:
+		flag := 0
+		return writeCanonical(s.literalData, data, &flag)
+	}
+	return 0, errors.UnsupportedError("unsupported signature type: " + strconv.Itoa(int(s.sigType)))
+}
+
+func (s signatureWriter) Close() error {
+	sig := createSignaturePacket(&s.signer.PublicKey, s.sigType, s.config)
+	sig.Hash = s.hashType
+	sig.Metadata = s.metadata
+
+	if err := sig.Sign(s.h, s.signer, s.config); err != nil {
+		return err
+	}
+	if err := s.literalData.Close(); err != nil {
+		return err
+	}
+	if err := sig.Serialize(s.encryptedData); err != nil {
+		return err
+	}
+	return s.encryptedData.Close()
+}
+
+func createSignaturePacket(signer *packet.PublicKey, sigType packet.SignatureType, config *packet.Config) *packet.Signature {
+	sigLifetimeSecs := config.SigLifetime()
+	return &packet.Signature{
+		Version:           signer.Version,
+		SigType:           sigType,
+		PubKeyAlgo:        signer.PubKeyAlgo,
+		Hash:              config.Hash(),
+		CreationTime:      config.Now(),
+		IssuerKeyId:       &signer.KeyId,
+		IssuerFingerprint: signer.Fingerprint,
+		Notations:         config.Notations(),
+		SigLifetimeSecs:   &sigLifetimeSecs,
+	}
+}
+
+// noOpCloser is like an ioutil.NopCloser, but for an io.Writer.
+// TODO: we have two of these in OpenPGP packages alone. This probably needs
+// to be promoted somewhere more common.
+type noOpCloser struct {
+	w io.Writer
+}
+
+func (c noOpCloser) Write(data []byte) (n int, err error) {
+	return c.w.Write(data)
+}
+
+func (c noOpCloser) Close() error {
+	return nil
+}
+
+func handleCompression(compressed io.WriteCloser, candidateCompression []uint8, config *packet.Config) (data io.WriteCloser, err error) {
+	data = compressed
+	confAlgo := config.Compression()
+	if confAlgo == packet.CompressionNone {
+		return
+	}
+
+	// Set algorithm labelled as MUST as fallback
+	// https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-07.html#section-9.4
+	finalAlgo := packet.CompressionNone
+	// if compression specified by config available we will use it
+	for _, c := range candidateCompression {
+		if uint8(confAlgo) == c {
+			finalAlgo = confAlgo
+			break
+		}
+	}
+
+	if finalAlgo != packet.CompressionNone {
+		var compConfig *packet.CompressionConfig
+		if config != nil {
+			compConfig = config.CompressionConfig
+		}
+		data, err = packet.SerializeCompressed(compressed, finalAlgo, compConfig)
+		if err != nil {
+			return
+		}
+	}
+	return data, nil
+}
diff --git a/.ci/providerlint/vendor/github.com/apparentlymart/go-textseg/v13/textseg/generate.go b/.ci/providerlint/vendor/github.com/apparentlymart/go-textseg/v13/textseg/generate.go
deleted file mode 100644
index 3c41a07e182..00000000000
--- a/.ci/providerlint/vendor/github.com/apparentlymart/go-textseg/v13/textseg/generate.go
+++ /dev/null
@@ -1,8 +0,0 @@
-package textseg
-
-//go:generate go run make_tables.go -output tables.go
-//go:generate go run make_test_tables.go -output tables_test.go
-//go:generate ruby unicode2ragel.rb --url=https://www.unicode.org/Public/13.0.0/ucd/auxiliary/GraphemeBreakProperty.txt -m GraphemeCluster -p "Prepend,CR,LF,Control,Extend,Regional_Indicator,SpacingMark,L,V,T,LV,LVT,ZWJ" -o grapheme_clusters_table.rl
-//go:generate ruby unicode2ragel.rb --url=https://www.unicode.org/Public/13.0.0/ucd/emoji/emoji-data.txt -m Emoji -p "Extended_Pictographic" -o emoji_table.rl
-//go:generate ragel -Z grapheme_clusters.rl
-//go:generate gofmt -w grapheme_clusters.go
diff --git a/.ci/providerlint/vendor/github.com/apparentlymart/go-textseg/v13/textseg/grapheme_clusters.go b/.ci/providerlint/vendor/github.com/apparentlymart/go-textseg/v13/textseg/grapheme_clusters.go
deleted file mode 100644
index 7ad1c799f3f..00000000000
--- a/.ci/providerlint/vendor/github.com/apparentlymart/go-textseg/v13/textseg/grapheme_clusters.go
+++ /dev/null
@@ -1,4138 +0,0 @@
-//line grapheme_clusters.rl:1
-package textseg
-
-import (
-	"errors"
-	"unicode/utf8"
-)
-
-// Generated from grapheme_clusters.rl. DO NOT EDIT
-
-//line grapheme_clusters.go:13
-var _graphclust_actions []byte = []byte{
-	0, 1, 0, 1, 4, 1, 10, 1, 11,
-	1, 12, 1, 13, 1, 14, 1, 15,
-	1, 16, 1, 17, 1, 18, 1, 19,
-	1, 20, 1, 21, 1, 22, 2, 1,
-	8, 2, 1, 9, 2, 2, 3, 2,
-	5, 1, 3, 0, 1, 9, 3, 5,
-	0, 1, 3, 5, 1, 6, 3, 5,
-	1, 7,
-}
-
-var _graphclust_key_offsets []int16 = []int16{
-	0, 0, 1, 3, 5, 7, 10, 15,
-	17, 20, 28, 31, 33, 35, 38, 68,
-	76, 78, 82, 85, 90, 95, 107, 119,
-	127, 132, 142, 145, 152, 156, 164, 174,
-	180, 188, 190, 198, 201, 203, 206, 208,
-	215, 217, 225, 226, 248, 252, 258, 263,
-	265, 269, 273, 275, 279, 281, 284, 288,
-	290, 297, 299, 301, 305, 309, 313, 315,
-	317, 325, 329, 334, 336, 338, 340, 341,
-	343, 345, 347, 349, 364, 368, 370, 372,
-	378, 382, 388, 390, 392, 396, 400, 402,
-	406, 413, 418, 422, 425, 426, 430, 437,
-	445, 446, 447, 449, 458, 460, 462, 464,
-	466, 500, 504, 506, 510, 514, 517, 521,
-	526, 529, 531, 537, 550, 552, 555, 557,
-	561, 565, 567, 569, 571, 577, 580, 585,
-	591, 594, 596, 600, 604, 611, 614, 620,
-	622, 627, 629, 631, 634, 638, 641, 642,
-	644, 650, 656, 662, 664, 668, 672, 677,
-	682, 692, 694, 696, 698, 699, 701, 702,
-	708, 710, 712, 712, 714, 721, 723, 725,
-	727, 730, 735, 737, 740, 748, 751, 753,
-	755, 758, 788, 796, 798, 802, 805, 810,
-	815, 827, 839, 847, 852, 862, 865, 872,
-	876, 884, 894, 900, 908, 910, 918, 921,
-	923, 926, 928, 935, 937, 945, 946, 968,
-	972, 978, 983, 985, 989, 993, 995, 999,
-	1001, 1004, 1008, 1010, 1017, 1019, 1021, 1025,
-	1029, 1033, 1035, 1037, 1045, 1049, 1054, 1056,
-	1058, 1082, 1085, 1086, 1088, 1090, 1094, 1097,
-	1098, 1103, 1104, 1107, 1110, 1116, 1118, 1122,
-	1122, 1136, 1145, 1150, 1152, 1156, 1158, 1160,
-	1161, 1163, 1166, 1169, 1171, 1173, 1188, 1192,
-	1194, 1196, 1202, 1206, 1212, 1214, 1216, 1220,
-	1224, 1226, 1230, 1237, 1242, 1246, 1249, 1250,
-	1254, 1261, 1269, 1270, 1271, 1273, 1282, 1284,
-	1286, 1288, 1290, 1324, 1328, 1330, 1334, 1338,
-	1341, 1345, 1350, 1353, 1355, 1361, 1374, 1376,
-	1379, 1381, 1385, 1389, 1391, 1393, 1395, 1401,
-	1404, 1409, 1415, 1418, 1420, 1424, 1428, 1435,
-	1438, 1444, 1446, 1451, 1453, 1455, 1458, 1462,
-	1465, 1466, 1468, 1474, 1480, 1486, 1488, 1492,
-	1496, 1501, 1506, 1516, 1518, 1520, 1522, 1562,
-	1564, 1567, 1571, 1576, 1578, 1586, 1588, 1590,
-	1592, 1594, 1596, 1598, 1600, 1604, 1608, 1612,
-	1616, 1617, 1623, 1625, 1627, 1629, 1636, 1637,
-	1639, 1644, 1646, 1648, 1650, 1653, 1658, 1660,
-	1663, 1671, 1674, 1676, 1678, 1681, 1711, 1719,
-	1721, 1725, 1728, 1733, 1738, 1750, 1762, 1770,
-	1775, 1785, 1788, 1795, 1799, 1807, 1817, 1823,
-	1831, 1833, 1841, 1844, 1846, 1849, 1851, 1858,
-	1860, 1868, 1869, 1891, 1895, 1901, 1906, 1908,
-	1912, 1916, 1918, 1922, 1924, 1927, 1931, 1933,
-	1940, 1942, 1944, 1948, 1952, 1956, 1958, 1960,
-	1968, 1972, 1977, 1979, 1981, 1983, 1984, 1986,
-	1988, 1990, 1992, 2007, 2011, 2013, 2015, 2021,
-	2025, 2031, 2033, 2035, 2039, 2043, 2045, 2049,
-	2056, 2061, 2065, 2068, 2069, 2073, 2080, 2088,
-	2089, 2090, 2092, 2101, 2103, 2105, 2107, 2109,
-	2143, 2147, 2149, 2153, 2157, 2160, 2164, 2169,
-	2172, 2174, 2180, 2193, 2195, 2198, 2200, 2204,
-	2208, 2210, 2212, 2214, 2220, 2223, 2228, 2234,
-	2237, 2239, 2243, 2247, 2254, 2257, 2263, 2265,
-	2270, 2272, 2274, 2277, 2281, 2284, 2285, 2287,
-	2293, 2299, 2305, 2307, 2311, 2315, 2320, 2325,
-	2335, 2337, 2339, 2341, 2342, 2344, 2345, 2351,
-	2353, 2355, 2355, 2357, 2363, 2365, 2367, 2369,
-	2372, 2377, 2379, 2382, 2390, 2393, 2395, 2397,
-	2400, 2430, 2438, 2440, 2444, 2447, 2452, 2457,
-	2469, 2481, 2489, 2494, 2504, 2507, 2514, 2518,
-	2526, 2536, 2542, 2550, 2552, 2560, 2563, 2565,
-	2568, 2570, 2577, 2579, 2587, 2588, 2610, 2614,
-	2620, 2625, 2627, 2631, 2635, 2637, 2641, 2643,
-	2646, 2650, 2652, 2659, 2661, 2663, 2667, 2671,
-	2675, 2677, 2679, 2687, 2691, 2696, 2698, 2700,
-	2724, 2727, 2728, 2730, 2732, 2736, 2739, 2740,
-	2745, 2746, 2749, 2752, 2758, 2760, 2764, 2764,
-	2778, 2787, 2792, 2794, 2798, 2800, 2802, 2803,
-	2805, 2808, 2811, 2813, 2815, 2830, 2834, 2836,
-	2838, 2844, 2848, 2854, 2856, 2858, 2862, 2866,
-	2868, 2872, 2879, 2884, 2888, 2891, 2892, 2896,
-	2903, 2911, 2912, 2913, 2915, 2924, 2926, 2928,
-	2930, 2932, 2966, 2970, 2972, 2976, 2980, 2983,
-	2987, 2992, 2995, 2997, 3003, 3016, 3018, 3021,
-	3023, 3027, 3031, 3033, 3035, 3037, 3043, 3046,
-	3051, 3057, 3060, 3062, 3066, 3070, 3077, 3080,
-	3086, 3088, 3093, 3095, 3097, 3100, 3104, 3107,
-	3108, 3110, 3116, 3122, 3128, 3130, 3134, 3138,
-	3143, 3148, 3158, 3160, 3162, 3164, 3204, 3206,
-	3209, 3213, 3218, 3220, 3228, 3230, 3232, 3234,
-	3236, 3238, 3240, 3242, 3246, 3250, 3254, 3258,
-	3259, 3265, 3267, 3269, 3271, 3278, 3279, 3281,
-	3287, 3290, 3293, 3297, 3300, 3303, 3310, 3312,
-	3337, 3339, 3364, 3366, 3368, 3392, 3394, 3396,
-	3397, 3399, 3401, 3403, 3409, 3411, 3443, 3447,
-	3452, 3476, 3478, 3480, 3482, 3484, 3487, 3489,
-	3491, 3495, 3495, 3551, 3607, 3638, 3643, 3647,
-	3669, 3678, 3683, 3687, 3697, 3704, 3707, 3718,
-	3721, 3728, 3734, 3738, 3744, 3760, 3775, 3784,
-	3790, 3800, 3804, 3808, 3812, 3816, 3818, 3838,
-	3844, 3849, 3851, 3853, 3856, 3858, 3860, 3864,
-	3920, 3976, 4009, 4014, 4022, 4026, 4028, 4033,
-	4040, 4050, 4053, 4056, 4062, 4065, 4068, 4071,
-	4077, 4080, 4083, 4087, 4090, 4094, 4097, 4101,
-	4143, 4150, 4158, 4167, 4171, 4178, 4180, 4182,
-	4192, 4196, 4200, 4204, 4208, 4212, 4216, 4220,
-	4226, 4236, 4244, 4249, 4252, 4254, 4257, 4262,
-	4264, 4267, 4270, 4274, 4277, 4280, 4287, 4289,
-	4291, 4293, 4295, 4298, 4303, 4305, 4308, 4316,
-	4319, 4321, 4323, 4326, 4356, 4364, 4366, 4370,
-	4373, 4378, 4383, 4395, 4407, 4415, 4420, 4430,
-	4433, 4440, 4444, 4452, 4462, 4468, 4476, 4478,
-	4486, 4489, 4491, 4494, 4496, 4503, 4505, 4513,
-	4514, 4536, 4540, 4546, 4551, 4553, 4557, 4561,
-	4563, 4567, 4569, 4572, 4576, 4578, 4585, 4587,
-	4589, 4593, 4597, 4601, 4603, 4605, 4613, 4617,
-	4622, 4624, 4626, 4650, 4653, 4654, 4656, 4658,
-	4662, 4665, 4666, 4671, 4672, 4675, 4678, 4684,
-	4686, 4690, 4690, 4704, 4713, 4718, 4720, 4724,
-	4726, 4728, 4729, 4731, 4734, 4737, 4739, 4741,
-	4756, 4760, 4762, 4764, 4770, 4774, 4780, 4782,
-	4784, 4788, 4792, 4794, 4798, 4805, 4810, 4814,
-	4817, 4818, 4822, 4829, 4837, 4838, 4839, 4841,
-	4850, 4852, 4854, 4856, 4858, 4892, 4896, 4898,
-	4902, 4906, 4909, 4913, 4918, 4921, 4923, 4929,
-	4942, 4944, 4947, 4949, 4953, 4957, 4959, 4961,
-	4963, 4969, 4972, 4977, 4983, 4986, 4988, 4992,
-	4996, 5003, 5006, 5012, 5014, 5019, 5021, 5023,
-	5026, 5030, 5033, 5034, 5036, 5042, 5048, 5054,
-	5056, 5060, 5064, 5069, 5074, 5084, 5086, 5088,
-	5090, 5130, 5132, 5135, 5139, 5144, 5146, 5154,
-	5156, 5158, 5160, 5162, 5164, 5166, 5168, 5172,
-	5176, 5180, 5184, 5185, 5191, 5193, 5195, 5197,
-	5204, 5205, 5207, 5232, 5234, 5259, 5261, 5263,
-	5287, 5289, 5291, 5292, 5294, 5296, 5298, 5304,
-	5306, 5338, 5342, 5347, 5371, 5373, 5375, 5377,
-	5379, 5382, 5384, 5386, 5390, 5390, 5446, 5502,
-	5533, 5538, 5541, 5563, 5576, 5578, 5580, 5582,
-	5585, 5590, 5592, 5595, 5603, 5606, 5608, 5610,
-	5613, 5643, 5651, 5653, 5657, 5660, 5665, 5670,
-	5682, 5694, 5702, 5707, 5717, 5720, 5727, 5731,
-	5739, 5749, 5755, 5763, 5765, 5773, 5776, 5778,
-	5781, 5783, 5790, 5792, 5800, 5801, 5823, 5827,
-	5833, 5838, 5840, 5844, 5848, 5850, 5854, 5856,
-	5859, 5863, 5865, 5872, 5874, 5876, 5880, 5884,
-	5888, 5890, 5892, 5900, 5904, 5909, 5911, 5913,
-	5915, 5916, 5918, 5920, 5922, 5924, 5939, 5943,
-	5945, 5947, 5953, 5957, 5963, 5965, 5967, 5971,
-	5975, 5977, 5981, 5988, 5993, 5997, 6000, 6001,
-	6005, 6012, 6020, 6021, 6022, 6024, 6033, 6035,
-	6037, 6039, 6041, 6075, 6079, 6081, 6085, 6089,
-	6092, 6096, 6101, 6104, 6106, 6112, 6125, 6127,
-	6130, 6132, 6136, 6140, 6142, 6144, 6146, 6152,
-	6155, 6160, 6166, 6169, 6171, 6175, 6179, 6186,
-	6189, 6195, 6197, 6202, 6204, 6206, 6209, 6213,
-	6216, 6217, 6219, 6225, 6231, 6237, 6239, 6243,
-	6247, 6252, 6257, 6267, 6269, 6271, 6273, 6274,
-	6276, 6277, 6283, 6285, 6287, 6287, 6294, 6298,
-	6308, 6315, 6318, 6329, 6332, 6339, 6345, 6349,
-	6355, 6371, 6386, 6395, 6401, 6411, 6415, 6419,
-	6423, 6427, 6429, 6449, 6455, 6460, 6462, 6464,
-	6467, 6469, 6471, 6475, 6531, 6587, 6620, 6625,
-	6633, 6637, 6640, 6647, 6654, 6664, 6667, 6670,
-	6676, 6679, 6682, 6685, 6691, 6694, 6697, 6703,
-	6706, 6712, 6715, 6721, 6763, 6770, 6778, 6787,
-	6791, 6793, 6795, 6797, 6800, 6805, 6807, 6810,
-	6818, 6821, 6823, 6825, 6828, 6858, 6866, 6868,
-	6872, 6875, 6880, 6885, 6897, 6909, 6917, 6922,
-	6932, 6935, 6942, 6946, 6954, 6964, 6970, 6978,
-	6980, 6988, 6991, 6993, 6996, 6998, 7005, 7007,
-	7015, 7016, 7038, 7042, 7048, 7053, 7055, 7059,
-	7063, 7065, 7069, 7071, 7074, 7078, 7080, 7087,
-	7089, 7091, 7095, 7099, 7103, 7105, 7107, 7115,
-	7119, 7124, 7126, 7128, 7152, 7155, 7156, 7158,
-	7160, 7164, 7167, 7168, 7173, 7174, 7177, 7180,
-	7186, 7188, 7192, 7192, 7206, 7215, 7220, 7222,
-	7226, 7228, 7230, 7231, 7233, 7236, 7239, 7241,
-	7243, 7258, 7262, 7264, 7266, 7272, 7276, 7282,
-	7284, 7286, 7290, 7294, 7296, 7300, 7307, 7312,
-	7316, 7319, 7320, 7324, 7331, 7339, 7340, 7341,
-	7343, 7352, 7354, 7356, 7358, 7360, 7394, 7398,
-	7400, 7404, 7408, 7411, 7415, 7420, 7423, 7425,
-	7431, 7444, 7446, 7449, 7451, 7455, 7459, 7461,
-	7463, 7465, 7471, 7474, 7479, 7485, 7488, 7490,
-	7494, 7498, 7505, 7508, 7514, 7516, 7521, 7523,
-	7525, 7528, 7532, 7535, 7536, 7538, 7544, 7550,
-	7556, 7558, 7562, 7566, 7571, 7576, 7586, 7588,
-	7590, 7592, 7632, 7634, 7637, 7641, 7646, 7648,
-	7656, 7658, 7660, 7662, 7664, 7666, 7668, 7670,
-	7674, 7678, 7682, 7686, 7687, 7693, 7695, 7697,
-	7699, 7706, 7707, 7709, 7716, 7718, 7720, 7730,
-	7734, 7738, 7742, 7746, 7750, 7754, 7758, 7764,
-	7774, 7782, 7787, 7790, 7792, 7795, 7804, 7808,
-	7810, 7812, 7816, 7816, 7846, 7866, 7886, 7907,
-	7930, 7950, 7970, 7991, 8014, 8035, 8056, 8077,
-	8097, 8120, 8140, 8161, 8182, 8203, 8224, 8244,
-	8264, 8284,
-}
-
-var _graphclust_trans_keys []byte = []byte{
-	10, 128, 255, 176, 255, 131, 137, 191,
-	145, 189, 135, 129, 130, 132, 133, 144,
-	154, 176, 139, 159, 150, 156, 159, 164,
-	167, 168, 170, 173, 145, 176, 255, 139,
-	255, 166, 176, 189, 171, 179, 160, 161,
-	163, 164, 165, 167, 169, 171, 173, 174,
-	175, 176, 177, 179, 180, 181, 182, 183,
-	184, 185, 186, 187, 188, 189, 190, 191,
-	166, 170, 172, 178, 150, 153, 155, 163,
-	165, 167, 169, 173, 153, 155, 147, 161,
-	163, 255, 189, 132, 185, 144, 152, 161,
-	164, 255, 188, 129, 131, 190, 255, 133,
-	134, 137, 138, 142, 150, 152, 161, 164,
-	189, 191, 255, 131, 134, 137, 138, 142,
-	144, 146, 175, 178, 180, 182, 255, 134,
-	138, 142, 161, 164, 185, 192, 255, 188,
-	129, 131, 190, 191, 128, 132, 135, 136,
-	139, 141, 149, 151, 162, 163, 130, 190,
-	191, 151, 128, 130, 134, 136, 138, 141,
-	128, 132, 190, 255, 133, 137, 142, 148,
-	151, 161, 164, 255, 128, 132, 134, 136,
-	138, 141, 149, 150, 162, 163, 128, 131,
-	187, 188, 190, 255, 133, 137, 142, 150,
-	152, 161, 164, 255, 129, 131, 138, 150,
-	143, 148, 152, 159, 178, 179, 177, 179,
-	186, 135, 142, 177, 179, 188, 136, 141,
-	181, 183, 185, 152, 153, 190, 191, 177,
-	191, 128, 132, 134, 135, 141, 151, 153,
-	188, 134, 128, 129, 130, 141, 156, 157,
-	158, 159, 160, 162, 164, 168, 169, 170,
-	171, 172, 173, 174, 175, 176, 179, 183,
-	173, 183, 185, 190, 150, 153, 158, 160,
-	177, 180, 130, 141, 157, 132, 134, 157,
-	159, 146, 148, 178, 180, 146, 147, 178,
-	179, 180, 255, 148, 156, 158, 255, 139,
-	141, 169, 133, 134, 160, 171, 176, 187,
-	151, 155, 160, 162, 191, 149, 158, 165,
-	188, 176, 255, 129, 255, 128, 132, 180,
-	255, 133, 170, 180, 255, 128, 130, 161,
-	173, 166, 179, 164, 183, 173, 180, 144,
-	146, 148, 168, 183, 185, 128, 185, 187,
-	191, 128, 131, 179, 181, 183, 140, 141,
-	144, 176, 175, 177, 191, 160, 191, 128,
-	130, 170, 175, 153, 154, 153, 154, 155,
-	160, 162, 163, 164, 165, 166, 167, 168,
-	169, 170, 171, 175, 175, 178, 180, 189,
-	158, 159, 176, 177, 130, 134, 139, 172,
-	163, 167, 128, 129, 180, 255, 134, 159,
-	178, 190, 192, 255, 166, 173, 135, 147,
-	128, 131, 179, 255, 129, 164, 166, 255,
-	169, 182, 131, 188, 140, 141, 176, 178,
-	180, 183, 184, 190, 191, 129, 171, 175,
-	181, 182, 163, 170, 172, 173, 172, 184,
-	190, 158, 128, 143, 160, 175, 144, 145,
-	150, 155, 157, 158, 159, 135, 139, 141,
-	168, 171, 180, 186, 189, 189, 160, 182,
-	186, 191, 129, 131, 133, 134, 140, 143,
-	184, 186, 165, 166, 164, 167, 171, 172,
-	134, 144, 128, 129, 130, 132, 133, 134,
-	135, 136, 139, 140, 141, 144, 145, 146,
-	147, 150, 151, 152, 153, 154, 156, 160,
-	164, 165, 167, 168, 169, 170, 176, 178,
-	180, 181, 182, 187, 128, 130, 184, 255,
-	135, 190, 131, 175, 187, 255, 128, 130,
-	167, 180, 179, 133, 134, 128, 130, 179,
-	255, 141, 129, 136, 144, 255, 190, 172,
-	183, 159, 170, 128, 131, 187, 188, 190,
-	191, 151, 128, 132, 135, 136, 139, 141,
-	162, 163, 166, 172, 176, 180, 181, 191,
-	158, 128, 134, 132, 255, 175, 181, 184,
-	255, 129, 155, 158, 255, 171, 183, 157,
-	171, 172, 186, 176, 181, 183, 184, 187,
-	190, 128, 130, 131, 164, 145, 151, 154,
-	160, 129, 138, 179, 185, 187, 190, 135,
-	145, 155, 138, 153, 175, 182, 184, 191,
-	146, 167, 169, 182, 186, 177, 182, 188,
-	189, 191, 255, 134, 136, 255, 138, 142,
-	144, 145, 147, 151, 179, 182, 171, 172,
-	189, 190, 191, 176, 180, 176, 182, 143,
-	145, 255, 136, 142, 147, 255, 164, 176,
-	177, 178, 157, 158, 133, 134, 137, 168,
-	169, 170, 165, 169, 173, 178, 187, 255,
-	131, 132, 140, 169, 174, 255, 130, 132,
-	128, 182, 187, 255, 173, 180, 182, 255,
-	132, 155, 159, 161, 175, 128, 132, 139,
-	163, 165, 128, 134, 136, 152, 155, 161,
-	163, 164, 166, 170, 172, 175, 144, 150,
-	132, 138, 143, 187, 191, 160, 128, 129,
-	132, 135, 133, 134, 160, 255, 192, 255,
-	128, 191, 169, 173, 174, 128, 159, 160,
-	191, 0, 127, 176, 255, 131, 137, 191,
-	145, 189, 135, 129, 130, 132, 133, 144,
-	154, 176, 139, 159, 150, 156, 159, 164,
-	167, 168, 170, 173, 145, 176, 255, 139,
-	255, 166, 176, 189, 171, 179, 160, 161,
-	163, 164, 165, 167, 169, 171, 173, 174,
-	175, 176, 177, 179, 180, 181, 182, 183,
-	184, 185, 186, 187, 188, 189, 190, 191,
-	166, 170, 172, 178, 150, 153, 155, 163,
-	165, 167, 169, 173, 153, 155, 147, 161,
-	163, 255, 189, 132, 185, 144, 152, 161,
-	164, 255, 188, 129, 131, 190, 255, 133,
-	134, 137, 138, 142, 150, 152, 161, 164,
-	189, 191, 255, 131, 134, 137, 138, 142,
-	144, 146, 175, 178, 180, 182, 255, 134,
-	138, 142, 161, 164, 185, 192, 255, 188,
-	129, 131, 190, 191, 128, 132, 135, 136,
-	139, 141, 149, 151, 162, 163, 130, 190,
-	191, 151, 128, 130, 134, 136, 138, 141,
-	128, 132, 190, 255, 133, 137, 142, 148,
-	151, 161, 164, 255, 128, 132, 134, 136,
-	138, 141, 149, 150, 162, 163, 128, 131,
-	187, 188, 190, 255, 133, 137, 142, 150,
-	152, 161, 164, 255, 129, 131, 138, 150,
-	143, 148, 152, 159, 178, 179, 177, 179,
-	186, 135, 142, 177, 179, 188, 136, 141,
-	181, 183, 185, 152, 153, 190, 191, 177,
-	191, 128, 132, 134, 135, 141, 151, 153,
-	188, 134, 128, 129, 130, 141, 156, 157,
-	158, 159, 160, 162, 164, 168, 169, 170,
-	171, 172, 173, 174, 175, 176, 179, 183,
-	173, 183, 185, 190, 150, 153, 158, 160,
-	177, 180, 130, 141, 157, 132, 134, 157,
-	159, 146, 148, 178, 180, 146, 147, 178,
-	179, 180, 255, 148, 156, 158, 255, 139,
-	141, 169, 133, 134, 160, 171, 176, 187,
-	151, 155, 160, 162, 191, 149, 158, 165,
-	188, 176, 255, 129, 255, 128, 132, 180,
-	255, 133, 170, 180, 255, 128, 130, 161,
-	173, 166, 179, 164, 183, 173, 180, 144,
-	146, 148, 168, 183, 185, 128, 185, 187,
-	191, 128, 131, 179, 181, 183, 140, 141,
-	169, 174, 128, 129, 131, 132, 134, 140,
-	142, 143, 147, 150, 151, 152, 153, 154,
-	155, 156, 157, 158, 164, 172, 173, 179,
-	181, 183, 140, 141, 188, 137, 144, 176,
-	162, 185, 148, 153, 169, 170, 168, 154,
-	155, 136, 143, 169, 179, 184, 186, 130,
-	182, 170, 171, 128, 187, 190, 128, 133,
-	135, 146, 148, 191, 128, 191, 128, 133,
-	144, 255, 147, 149, 134, 135, 151, 156,
-	158, 160, 162, 167, 169, 178, 181, 255,
-	132, 135, 140, 142, 151, 147, 149, 163,
-	167, 161, 176, 191, 149, 151, 180, 181,
-	133, 135, 155, 156, 144, 149, 175, 177,
-	191, 160, 191, 128, 130, 138, 189, 170,
-	176, 153, 154, 151, 153, 153, 154, 155,
-	160, 162, 163, 164, 165, 166, 167, 168,
-	169, 170, 171, 175, 175, 178, 180, 189,
-	158, 159, 176, 177, 130, 134, 139, 172,
-	163, 167, 128, 129, 180, 255, 134, 159,
-	178, 190, 192, 255, 166, 173, 135, 147,
-	128, 131, 179, 255, 129, 164, 166, 255,
-	169, 182, 131, 188, 140, 141, 176, 178,
-	180, 183, 184, 190, 191, 129, 171, 175,
-	181, 182, 163, 170, 172, 173, 172, 184,
-	190, 158, 128, 143, 160, 175, 144, 145,
-	150, 155, 157, 158, 159, 135, 139, 141,
-	168, 171, 180, 186, 189, 189, 160, 182,
-	186, 191, 129, 131, 133, 134, 140, 143,
-	184, 186, 165, 166, 164, 167, 171, 172,
-	134, 144, 128, 129, 130, 132, 133, 134,
-	135, 136, 139, 140, 141, 144, 145, 146,
-	147, 150, 151, 152, 153, 154, 156, 160,
-	164, 165, 167, 168, 169, 170, 176, 178,
-	180, 181, 182, 187, 128, 130, 184, 255,
-	135, 190, 131, 175, 187, 255, 128, 130,
-	167, 180, 179, 133, 134, 128, 130, 179,
-	255, 141, 129, 136, 144, 255, 190, 172,
-	183, 159, 170, 128, 131, 187, 188, 190,
-	191, 151, 128, 132, 135, 136, 139, 141,
-	162, 163, 166, 172, 176, 180, 181, 191,
-	158, 128, 134, 132, 255, 175, 181, 184,
-	255, 129, 155, 158, 255, 171, 183, 157,
-	171, 172, 186, 176, 181, 183, 184, 187,
-	190, 128, 130, 131, 164, 145, 151, 154,
-	160, 129, 138, 179, 185, 187, 190, 135,
-	145, 155, 138, 153, 175, 182, 184, 191,
-	146, 167, 169, 182, 186, 177, 182, 188,
-	189, 191, 255, 134, 136, 255, 138, 142,
-	144, 145, 147, 151, 179, 182, 171, 172,
-	189, 190, 191, 176, 180, 176, 182, 143,
-	145, 255, 136, 142, 147, 255, 164, 176,
-	177, 178, 157, 158, 133, 134, 137, 168,
-	169, 170, 165, 169, 173, 178, 187, 255,
-	131, 132, 140, 169, 174, 255, 130, 132,
-	128, 182, 187, 255, 173, 180, 182, 255,
-	132, 155, 159, 161, 175, 128, 132, 139,
-	163, 165, 128, 134, 136, 152, 155, 161,
-	163, 164, 166, 170, 172, 175, 144, 150,
-	132, 138, 128, 131, 132, 133, 134, 135,
-	136, 137, 139, 140, 141, 142, 143, 144,
-	145, 148, 149, 151, 152, 153, 157, 159,
-	160, 161, 162, 163, 164, 165, 168, 169,
-	176, 191, 129, 150, 154, 155, 166, 171,
-	177, 190, 192, 255, 175, 141, 143, 172,
-	177, 190, 191, 142, 145, 154, 173, 255,
-	166, 255, 154, 175, 129, 143, 178, 186,
-	188, 191, 137, 255, 190, 255, 134, 255,
-	144, 255, 180, 191, 149, 191, 140, 143,
-	136, 143, 154, 159, 136, 143, 174, 255,
-	140, 186, 188, 191, 128, 133, 135, 191,
-	160, 128, 129, 132, 135, 133, 134, 160,
-	255, 128, 130, 170, 175, 144, 145, 150,
-	155, 157, 158, 159, 143, 187, 191, 156,
-	128, 133, 134, 191, 128, 255, 176, 255,
-	131, 137, 191, 145, 189, 135, 129, 130,
-	132, 133, 144, 154, 176, 139, 159, 150,
-	156, 159, 164, 167, 168, 170, 173, 145,
-	176, 255, 139, 255, 166, 176, 189, 171,
-	179, 160, 161, 163, 164, 165, 167, 169,
-	171, 173, 174, 175, 176, 177, 179, 180,
-	181, 182, 183, 184, 185, 186, 187, 188,
-	189, 190, 191, 166, 170, 172, 178, 150,
-	153, 155, 163, 165, 167, 169, 173, 153,
-	155, 147, 161, 163, 255, 189, 132, 185,
-	144, 152, 161, 164, 255, 188, 129, 131,
-	190, 255, 133, 134, 137, 138, 142, 150,
-	152, 161, 164, 189, 191, 255, 131, 134,
-	137, 138, 142, 144, 146, 175, 178, 180,
-	182, 255, 134, 138, 142, 161, 164, 185,
-	192, 255, 188, 129, 131, 190, 191, 128,
-	132, 135, 136, 139, 141, 149, 151, 162,
-	163, 130, 190, 191, 151, 128, 130, 134,
-	136, 138, 141, 128, 132, 190, 255, 133,
-	137, 142, 148, 151, 161, 164, 255, 128,
-	132, 134, 136, 138, 141, 149, 150, 162,
-	163, 128, 131, 187, 188, 190, 255, 133,
-	137, 142, 150, 152, 161, 164, 255, 129,
-	131, 138, 150, 143, 148, 152, 159, 178,
-	179, 177, 179, 186, 135, 142, 177, 179,
-	188, 136, 141, 181, 183, 185, 152, 153,
-	190, 191, 177, 191, 128, 132, 134, 135,
-	141, 151, 153, 188, 134, 128, 129, 130,
-	141, 156, 157, 158, 159, 160, 162, 164,
-	168, 169, 170, 171, 172, 173, 174, 175,
-	176, 179, 183, 173, 183, 185, 190, 150,
-	153, 158, 160, 177, 180, 130, 141, 157,
-	132, 134, 157, 159, 146, 148, 178, 180,
-	146, 147, 178, 179, 180, 255, 148, 156,
-	158, 255, 139, 141, 169, 133, 134, 160,
-	171, 176, 187, 151, 155, 160, 162, 191,
-	149, 158, 165, 188, 176, 255, 129, 255,
-	128, 132, 180, 255, 133, 170, 180, 255,
-	128, 130, 161, 173, 166, 179, 164, 183,
-	173, 180, 144, 146, 148, 168, 183, 185,
-	128, 185, 187, 191, 128, 131, 179, 181,
-	183, 140, 141, 144, 176, 175, 177, 191,
-	160, 191, 128, 130, 170, 175, 153, 154,
-	153, 154, 155, 160, 162, 163, 164, 165,
-	166, 167, 168, 169, 170, 171, 175, 175,
-	178, 180, 189, 158, 159, 176, 177, 130,
-	134, 139, 172, 163, 167, 128, 129, 180,
-	255, 134, 159, 178, 190, 192, 255, 166,
-	173, 135, 147, 128, 131, 179, 255, 129,
-	164, 166, 255, 169, 182, 131, 188, 140,
-	141, 176, 178, 180, 183, 184, 190, 191,
-	129, 171, 175, 181, 182, 163, 170, 172,
-	173, 172, 184, 190, 158, 128, 143, 160,
-	175, 144, 145, 150, 155, 157, 158, 159,
-	135, 139, 141, 168, 171, 180, 186, 189,
-	189, 160, 182, 186, 191, 129, 131, 133,
-	134, 140, 143, 184, 186, 165, 166, 164,
-	167, 171, 172, 134, 144, 128, 129, 130,
-	132, 133, 134, 135, 136, 139, 140, 141,
-	144, 145, 146, 147, 150, 151, 152, 153,
-	154, 156, 160, 164, 165, 167, 168, 169,
-	170, 176, 178, 180, 181, 182, 187, 128,
-	130, 184, 255, 135, 190, 131, 175, 187,
-	255, 128, 130, 167, 180, 179, 133, 134,
-	128, 130, 179, 255, 141, 129, 136, 144,
-	255, 190, 172, 183, 159, 170, 128, 131,
-	187, 188, 190, 191, 151, 128, 132, 135,
-	136, 139, 141, 162, 163, 166, 172, 176,
-	180, 181, 191, 158, 128, 134, 132, 255,
-	175, 181, 184, 255, 129, 155, 158, 255,
-	171, 183, 157, 171, 172, 186, 176, 181,
-	183, 184, 187, 190, 128, 130, 131, 164,
-	145, 151, 154, 160, 129, 138, 179, 185,
-	187, 190, 135, 145, 155, 138, 153, 175,
-	182, 184, 191, 146, 167, 169, 182, 186,
-	177, 182, 188, 189, 191, 255, 134, 136,
-	255, 138, 142, 144, 145, 147, 151, 179,
-	182, 171, 172, 189, 190, 191, 176, 180,
-	176, 182, 143, 145, 255, 136, 142, 147,
-	255, 164, 176, 177, 178, 157, 158, 133,
-	134, 137, 168, 169, 170, 165, 169, 173,
-	178, 187, 255, 131, 132, 140, 169, 174,
-	255, 130, 132, 128, 182, 187, 255, 173,
-	180, 182, 255, 132, 155, 159, 161, 175,
-	128, 132, 139, 163, 165, 128, 134, 136,
-	152, 155, 161, 163, 164, 166, 170, 172,
-	175, 144, 150, 132, 138, 143, 187, 191,
-	160, 128, 129, 132, 135, 133, 134, 160,
-	255, 192, 255, 128, 191, 169, 174, 160,
-	172, 175, 191, 128, 255, 176, 255, 131,
-	137, 191, 145, 189, 135, 129, 130, 132,
-	133, 144, 154, 176, 139, 159, 150, 156,
-	159, 164, 167, 168, 170, 173, 145, 176,
-	255, 139, 255, 166, 176, 189, 171, 179,
-	160, 161, 163, 164, 165, 167, 169, 171,
-	173, 174, 175, 176, 177, 179, 180, 181,
-	182, 183, 184, 185, 186, 187, 188, 189,
-	190, 191, 166, 170, 172, 178, 150, 153,
-	155, 163, 165, 167, 169, 173, 153, 155,
-	147, 161, 163, 255, 189, 132, 185, 144,
-	152, 161, 164, 255, 188, 129, 131, 190,
-	255, 133, 134, 137, 138, 142, 150, 152,
-	161, 164, 189, 191, 255, 131, 134, 137,
-	138, 142, 144, 146, 175, 178, 180, 182,
-	255, 134, 138, 142, 161, 164, 185, 192,
-	255, 188, 129, 131, 190, 191, 128, 132,
-	135, 136, 139, 141, 149, 151, 162, 163,
-	130, 190, 191, 151, 128, 130, 134, 136,
-	138, 141, 128, 132, 190, 255, 133, 137,
-	142, 148, 151, 161, 164, 255, 128, 132,
-	134, 136, 138, 141, 149, 150, 162, 163,
-	128, 131, 187, 188, 190, 255, 133, 137,
-	142, 150, 152, 161, 164, 255, 129, 131,
-	138, 150, 143, 148, 152, 159, 178, 179,
-	177, 179, 186, 135, 142, 177, 179, 188,
-	136, 141, 181, 183, 185, 152, 153, 190,
-	191, 177, 191, 128, 132, 134, 135, 141,
-	151, 153, 188, 134, 128, 129, 130, 141,
-	156, 157, 158, 159, 160, 162, 164, 168,
-	169, 170, 171, 172, 173, 174, 175, 176,
-	179, 183, 173, 183, 185, 190, 150, 153,
-	158, 160, 177, 180, 130, 141, 157, 132,
-	134, 157, 159, 146, 148, 178, 180, 146,
-	147, 178, 179, 180, 255, 148, 156, 158,
-	255, 139, 141, 169, 133, 134, 160, 171,
-	176, 187, 151, 155, 160, 162, 191, 149,
-	158, 165, 188, 176, 255, 129, 255, 128,
-	132, 180, 255, 133, 170, 180, 255, 128,
-	130, 161, 173, 166, 179, 164, 183, 173,
-	180, 144, 146, 148, 168, 183, 185, 128,
-	185, 187, 191, 128, 131, 179, 181, 183,
-	140, 141, 169, 174, 128, 129, 131, 132,
-	134, 140, 142, 143, 147, 150, 151, 152,
-	153, 154, 155, 156, 157, 158, 164, 172,
-	173, 179, 181, 183, 140, 141, 188, 137,
-	144, 176, 162, 185, 148, 153, 169, 170,
-	168, 154, 155, 136, 143, 169, 179, 184,
-	186, 130, 182, 170, 171, 128, 187, 190,
-	128, 133, 135, 146, 148, 191, 128, 191,
-	128, 133, 144, 255, 147, 149, 134, 135,
-	151, 156, 158, 160, 162, 167, 169, 178,
-	181, 255, 132, 135, 140, 142, 151, 147,
-	149, 163, 167, 161, 176, 191, 149, 151,
-	180, 181, 133, 135, 155, 156, 144, 149,
-	175, 177, 191, 160, 191, 128, 130, 138,
-	189, 170, 176, 153, 154, 151, 153, 153,
-	154, 155, 160, 162, 163, 164, 165, 166,
-	167, 168, 169, 170, 171, 175, 175, 178,
-	180, 189, 158, 159, 176, 177, 130, 134,
-	139, 172, 163, 167, 128, 129, 180, 255,
-	134, 159, 178, 190, 192, 255, 166, 173,
-	135, 147, 128, 131, 179, 255, 129, 164,
-	166, 255, 169, 182, 131, 188, 140, 141,
-	176, 178, 180, 183, 184, 190, 191, 129,
-	171, 175, 181, 182, 163, 170, 172, 173,
-	172, 184, 190, 158, 128, 143, 160, 175,
-	144, 145, 150, 155, 157, 158, 159, 135,
-	139, 141, 168, 171, 180, 186, 189, 189,
-	160, 182, 186, 191, 129, 131, 133, 134,
-	140, 143, 184, 186, 165, 166, 164, 167,
-	171, 172, 134, 144, 128, 129, 130, 132,
-	133, 134, 135, 136, 139, 140, 141, 144,
-	145, 146, 147, 150, 151, 152, 153, 154,
-	156, 160, 164, 165, 167, 168, 169, 170,
-	176, 178, 180, 181, 182, 187, 128, 130,
-	184, 255, 135, 190, 131, 175, 187, 255,
-	128, 130, 167, 180, 179, 133, 134, 128,
-	130, 179, 255, 141, 129, 136, 144, 255,
-	190, 172, 183, 159, 170, 128, 131, 187,
-	188, 190, 191, 151, 128, 132, 135, 136,
-	139, 141, 162, 163, 166, 172, 176, 180,
-	181, 191, 158, 128, 134, 132, 255, 175,
-	181, 184, 255, 129, 155, 158, 255, 171,
-	183, 157, 171, 172, 186, 176, 181, 183,
-	184, 187, 190, 128, 130, 131, 164, 145,
-	151, 154, 160, 129, 138, 179, 185, 187,
-	190, 135, 145, 155, 138, 153, 175, 182,
-	184, 191, 146, 167, 169, 182, 186, 177,
-	182, 188, 189, 191, 255, 134, 136, 255,
-	138, 142, 144, 145, 147, 151, 179, 182,
-	171, 172, 189, 190, 191, 176, 180, 176,
-	182, 143, 145, 255, 136, 142, 147, 255,
-	164, 176, 177, 178, 157, 158, 133, 134,
-	137, 168, 169, 170, 165, 169, 173, 178,
-	187, 255, 131, 132, 140, 169, 174, 255,
-	130, 132, 128, 182, 187, 255, 173, 180,
-	182, 255, 132, 155, 159, 161, 175, 128,
-	132, 139, 163, 165, 128, 134, 136, 152,
-	155, 161, 163, 164, 166, 170, 172, 175,
-	144, 150, 132, 138, 128, 131, 132, 133,
-	134, 135, 136, 137, 139, 140, 141, 142,
-	143, 144, 145, 148, 149, 151, 152, 153,
-	157, 159, 160, 161, 162, 163, 164, 165,
-	168, 169, 176, 191, 129, 150, 154, 155,
-	166, 171, 177, 190, 192, 255, 175, 141,
-	143, 172, 177, 190, 191, 142, 145, 154,
-	173, 255, 166, 255, 154, 175, 129, 143,
-	178, 186, 188, 191, 137, 255, 190, 255,
-	134, 255, 144, 255, 180, 191, 149, 191,
-	140, 143, 136, 143, 154, 159, 136, 143,
-	174, 255, 140, 186, 188, 191, 128, 133,
-	135, 191, 160, 128, 129, 132, 135, 133,
-	134, 160, 255, 128, 130, 170, 175, 144,
-	145, 150, 155, 157, 158, 159, 143, 187,
-	191, 128, 133, 134, 155, 157, 191, 157,
-	128, 191, 143, 128, 191, 163, 181, 128,
-	191, 162, 128, 191, 142, 128, 191, 132,
-	133, 134, 135, 160, 128, 191, 128, 255,
-	128, 129, 130, 132, 133, 134, 141, 156,
-	157, 158, 159, 160, 162, 164, 168, 169,
-	170, 171, 172, 173, 174, 175, 176, 179,
-	183, 160, 255, 128, 129, 130, 133, 134,
-	135, 141, 156, 157, 158, 159, 160, 162,
-	164, 168, 169, 170, 171, 172, 173, 174,
-	175, 176, 179, 183, 160, 255, 168, 255,
-	128, 129, 130, 134, 135, 141, 156, 157,
-	158, 159, 160, 162, 164, 168, 169, 170,
-	171, 172, 173, 174, 175, 176, 179, 183,
-	168, 255, 192, 255, 159, 139, 187, 158,
-	159, 176, 255, 135, 138, 139, 187, 188,
-	255, 168, 255, 153, 154, 155, 160, 162,
-	163, 164, 165, 166, 167, 168, 169, 170,
-	171, 175, 177, 178, 179, 180, 181, 182,
-	184, 185, 186, 187, 188, 189, 191, 176,
-	190, 192, 255, 135, 147, 160, 188, 128,
-	156, 184, 129, 255, 128, 129, 130, 133,
-	134, 141, 156, 157, 158, 159, 160, 162,
-	164, 168, 169, 170, 171, 172, 173, 174,
-	175, 176, 179, 183, 158, 159, 135, 255,
-	148, 176, 140, 168, 132, 160, 188, 152,
-	180, 144, 172, 136, 164, 192, 255, 129,
-	130, 131, 132, 133, 134, 136, 137, 138,
-	139, 140, 141, 143, 144, 145, 146, 147,
-	148, 150, 151, 152, 153, 154, 155, 157,
-	158, 159, 160, 161, 162, 164, 165, 166,
-	167, 168, 169, 171, 172, 173, 174, 175,
-	176, 178, 179, 180, 181, 182, 183, 185,
-	186, 187, 188, 189, 190, 128, 191, 129,
-	130, 131, 132, 133, 134, 136, 137, 138,
-	139, 140, 141, 143, 144, 145, 146, 147,
-	148, 150, 151, 152, 153, 154, 155, 157,
-	158, 159, 160, 161, 162, 164, 165, 166,
-	167, 168, 169, 171, 172, 173, 174, 175,
-	176, 178, 179, 180, 181, 182, 183, 185,
-	186, 187, 188, 189, 190, 128, 191, 129,
-	130, 131, 132, 133, 134, 136, 137, 138,
-	139, 140, 141, 143, 144, 145, 146, 147,
-	148, 150, 151, 152, 153, 154, 155, 157,
-	158, 159, 128, 156, 160, 255, 136, 164,
-	175, 176, 255, 128, 141, 143, 191, 128,
-	129, 132, 134, 140, 142, 143, 147, 150,
-	151, 152, 153, 154, 155, 156, 157, 158,
-	164, 172, 173, 130, 191, 188, 128, 138,
-	140, 141, 144, 167, 175, 191, 137, 128,
-	159, 176, 191, 162, 185, 128, 191, 128,
-	147, 148, 153, 154, 168, 169, 170, 171,
-	191, 168, 128, 153, 154, 155, 156, 191,
-	136, 128, 191, 143, 128, 168, 169, 179,
-	180, 183, 184, 186, 187, 191, 130, 128,
-	191, 182, 128, 169, 170, 171, 172, 191,
-	128, 191, 129, 186, 187, 190, 134, 147,
-	128, 191, 128, 133, 134, 143, 144, 255,
-	147, 149, 134, 135, 151, 156, 158, 160,
-	162, 167, 169, 178, 181, 191, 192, 255,
-	132, 135, 140, 142, 150, 128, 146, 147,
-	151, 152, 162, 163, 167, 168, 191, 161,
-	176, 191, 128, 148, 149, 151, 152, 190,
-	128, 179, 180, 181, 182, 191, 128, 132,
-	133, 135, 136, 154, 155, 156, 157, 191,
-	144, 149, 128, 191, 128, 138, 129, 191,
-	176, 189, 128, 191, 151, 153, 128, 191,
-	128, 191, 165, 177, 178, 179, 180, 181,
-	182, 184, 185, 186, 187, 188, 189, 191,
-	128, 175, 176, 190, 192, 255, 128, 159,
-	160, 188, 189, 191, 128, 156, 184, 129,
-	255, 148, 176, 140, 168, 132, 160, 188,
-	152, 180, 144, 172, 136, 164, 192, 255,
-	129, 130, 131, 132, 133, 134, 136, 137,
-	138, 139, 140, 141, 143, 144, 145, 146,
-	147, 148, 150, 151, 152, 153, 154, 155,
-	157, 158, 159, 160, 161, 162, 164, 165,
-	166, 167, 168, 169, 171, 172, 173, 174,
-	175, 176, 178, 179, 180, 181, 182, 183,
-	185, 186, 187, 188, 189, 190, 128, 191,
-	129, 130, 131, 132, 133, 134, 136, 137,
-	138, 139, 140, 141, 143, 144, 145, 146,
-	147, 148, 150, 151, 152, 153, 154, 155,
-	157, 158, 159, 160, 161, 162, 164, 165,
-	166, 167, 168, 169, 171, 172, 173, 174,
-	175, 176, 178, 179, 180, 181, 182, 183,
-	185, 186, 187, 188, 189, 190, 128, 191,
-	129, 130, 131, 132, 133, 134, 136, 137,
-	138, 139, 140, 141, 143, 144, 145, 146,
-	147, 148, 150, 151, 152, 153, 154, 155,
-	157, 158, 159, 128, 156, 160, 191, 192,
-	255, 136, 164, 175, 176, 255, 135, 138,
-	139, 187, 188, 191, 192, 255, 187, 191,
-	128, 190, 128, 190, 188, 128, 175, 190,
-	191, 145, 147, 155, 157, 159, 128, 191,
-	130, 131, 135, 164, 165, 168, 170, 181,
-	128, 191, 189, 128, 191, 141, 128, 191,
-	128, 129, 130, 131, 132, 191, 191, 128,
-	190, 129, 128, 191, 186, 128, 191, 128,
-	131, 132, 137, 138, 191, 134, 128, 191,
-	144, 128, 191, 128, 175, 185, 191, 178,
-	128, 191, 128, 159, 164, 191, 133, 128,
-	191, 128, 178, 187, 191, 128, 131, 132,
-	133, 134, 135, 136, 137, 139, 140, 141,
-	142, 143, 144, 145, 148, 149, 151, 152,
-	153, 156, 157, 158, 159, 160, 161, 162,
-	163, 164, 165, 168, 169, 176, 191, 129,
-	150, 154, 171, 172, 175, 177, 190, 175,
-	128, 140, 141, 143, 144, 191, 128, 171,
-	172, 177, 178, 189, 190, 191, 142, 128,
-	144, 145, 154, 155, 172, 173, 255, 166,
-	191, 192, 255, 144, 145, 150, 155, 157,
-	158, 159, 135, 143, 166, 191, 128, 154,
-	175, 187, 129, 143, 144, 177, 178, 191,
-	128, 136, 137, 255, 187, 191, 192, 255,
-	190, 191, 192, 255, 128, 133, 134, 255,
-	144, 191, 192, 255, 128, 179, 180, 191,
-	128, 148, 149, 191, 128, 139, 140, 143,
-	144, 191, 128, 135, 136, 143, 144, 153,
-	154, 159, 160, 191, 128, 135, 136, 143,
-	144, 173, 174, 255, 187, 128, 139, 140,
-	191, 134, 128, 191, 128, 191, 160, 128,
-	191, 128, 129, 135, 132, 134, 128, 175,
-	157, 128, 191, 143, 128, 191, 163, 181,
-	128, 191, 162, 128, 191, 142, 128, 191,
-	132, 133, 134, 135, 160, 128, 191, 128,
-	255, 128, 255, 176, 255, 131, 137, 191,
-	145, 189, 135, 129, 130, 132, 133, 144,
-	154, 176, 139, 159, 150, 156, 159, 164,
-	167, 168, 170, 173, 145, 176, 255, 139,
-	255, 166, 176, 189, 171, 179, 160, 161,
-	163, 164, 165, 167, 169, 171, 173, 174,
-	175, 176, 177, 179, 180, 181, 182, 183,
-	184, 185, 186, 187, 188, 189, 190, 191,
-	166, 170, 172, 178, 150, 153, 155, 163,
-	165, 167, 169, 173, 153, 155, 147, 161,
-	163, 255, 189, 132, 185, 144, 152, 161,
-	164, 255, 188, 129, 131, 190, 255, 133,
-	134, 137, 138, 142, 150, 152, 161, 164,
-	189, 191, 255, 131, 134, 137, 138, 142,
-	144, 146, 175, 178, 180, 182, 255, 134,
-	138, 142, 161, 164, 185, 192, 255, 188,
-	129, 131, 190, 191, 128, 132, 135, 136,
-	139, 141, 149, 151, 162, 163, 130, 190,
-	191, 151, 128, 130, 134, 136, 138, 141,
-	128, 132, 190, 255, 133, 137, 142, 148,
-	151, 161, 164, 255, 128, 132, 134, 136,
-	138, 141, 149, 150, 162, 163, 128, 131,
-	187, 188, 190, 255, 133, 137, 142, 150,
-	152, 161, 164, 255, 129, 131, 138, 150,
-	143, 148, 152, 159, 178, 179, 177, 179,
-	186, 135, 142, 177, 179, 188, 136, 141,
-	181, 183, 185, 152, 153, 190, 191, 177,
-	191, 128, 132, 134, 135, 141, 151, 153,
-	188, 134, 128, 129, 130, 141, 156, 157,
-	158, 159, 160, 162, 164, 168, 169, 170,
-	171, 172, 173, 174, 175, 176, 179, 183,
-	173, 183, 185, 190, 150, 153, 158, 160,
-	177, 180, 130, 141, 157, 132, 134, 157,
-	159, 146, 148, 178, 180, 146, 147, 178,
-	179, 180, 255, 148, 156, 158, 255, 139,
-	141, 169, 133, 134, 160, 171, 176, 187,
-	151, 155, 160, 162, 191, 149, 158, 165,
-	188, 176, 255, 129, 255, 128, 132, 180,
-	255, 133, 170, 180, 255, 128, 130, 161,
-	173, 166, 179, 164, 183, 173, 180, 144,
-	146, 148, 168, 183, 185, 128, 185, 187,
-	191, 128, 131, 179, 181, 183, 140, 141,
-	169, 174, 128, 129, 131, 132, 134, 140,
-	142, 143, 147, 150, 151, 152, 153, 154,
-	155, 156, 157, 158, 164, 172, 173, 179,
-	181, 183, 140, 141, 188, 137, 144, 176,
-	162, 185, 148, 153, 169, 170, 168, 154,
-	155, 136, 143, 169, 179, 184, 186, 130,
-	182, 170, 171, 128, 187, 190, 128, 133,
-	135, 146, 148, 191, 128, 191, 128, 133,
-	144, 255, 147, 149, 134, 135, 151, 156,
-	158, 160, 162, 167, 169, 178, 181, 255,
-	132, 135, 140, 142, 151, 147, 149, 163,
-	167, 161, 176, 191, 149, 151, 180, 181,
-	133, 135, 155, 156, 144, 149, 175, 177,
-	191, 160, 191, 128, 130, 138, 189, 170,
-	176, 153, 154, 151, 153, 153, 154, 155,
-	160, 162, 163, 164, 165, 166, 167, 168,
-	169, 170, 171, 175, 175, 178, 180, 189,
-	158, 159, 176, 177, 130, 134, 139, 172,
-	163, 167, 128, 129, 180, 255, 134, 159,
-	178, 190, 192, 255, 166, 173, 135, 147,
-	128, 131, 179, 255, 129, 164, 166, 255,
-	169, 182, 131, 188, 140, 141, 176, 178,
-	180, 183, 184, 190, 191, 129, 171, 175,
-	181, 182, 163, 170, 172, 173, 172, 184,
-	190, 158, 128, 143, 160, 175, 144, 145,
-	150, 155, 157, 158, 159, 135, 139, 141,
-	168, 171, 180, 186, 189, 189, 160, 182,
-	186, 191, 129, 131, 133, 134, 140, 143,
-	184, 186, 165, 166, 164, 167, 171, 172,
-	134, 144, 128, 129, 130, 132, 133, 134,
-	135, 136, 139, 140, 141, 144, 145, 146,
-	147, 150, 151, 152, 153, 154, 156, 160,
-	164, 165, 167, 168, 169, 170, 176, 178,
-	180, 181, 182, 187, 128, 130, 184, 255,
-	135, 190, 131, 175, 187, 255, 128, 130,
-	167, 180, 179, 133, 134, 128, 130, 179,
-	255, 141, 129, 136, 144, 255, 190, 172,
-	183, 159, 170, 128, 131, 187, 188, 190,
-	191, 151, 128, 132, 135, 136, 139, 141,
-	162, 163, 166, 172, 176, 180, 181, 191,
-	158, 128, 134, 132, 255, 175, 181, 184,
-	255, 129, 155, 158, 255, 171, 183, 157,
-	171, 172, 186, 176, 181, 183, 184, 187,
-	190, 128, 130, 131, 164, 145, 151, 154,
-	160, 129, 138, 179, 185, 187, 190, 135,
-	145, 155, 138, 153, 175, 182, 184, 191,
-	146, 167, 169, 182, 186, 177, 182, 188,
-	189, 191, 255, 134, 136, 255, 138, 142,
-	144, 145, 147, 151, 179, 182, 171, 172,
-	189, 190, 191, 176, 180, 176, 182, 143,
-	145, 255, 136, 142, 147, 255, 164, 176,
-	177, 178, 157, 158, 133, 134, 137, 168,
-	169, 170, 165, 169, 173, 178, 187, 255,
-	131, 132, 140, 169, 174, 255, 130, 132,
-	128, 182, 187, 255, 173, 180, 182, 255,
-	132, 155, 159, 161, 175, 128, 132, 139,
-	163, 165, 128, 134, 136, 152, 155, 161,
-	163, 164, 166, 170, 172, 175, 144, 150,
-	132, 138, 128, 131, 132, 133, 134, 135,
-	136, 137, 139, 140, 141, 142, 143, 144,
-	145, 148, 149, 151, 152, 153, 157, 159,
-	160, 161, 162, 163, 164, 165, 168, 169,
-	176, 191, 129, 150, 154, 155, 166, 171,
-	177, 190, 192, 255, 175, 141, 143, 172,
-	177, 190, 191, 142, 145, 154, 173, 255,
-	166, 255, 154, 175, 129, 143, 178, 186,
-	188, 191, 137, 255, 190, 255, 134, 255,
-	144, 255, 180, 191, 149, 191, 140, 143,
-	136, 143, 154, 159, 136, 143, 174, 255,
-	140, 186, 188, 191, 128, 133, 135, 191,
-	160, 128, 129, 132, 135, 133, 134, 160,
-	255, 128, 130, 170, 175, 144, 145, 150,
-	155, 157, 158, 159, 143, 187, 191, 128,
-	129, 130, 132, 133, 134, 141, 156, 157,
-	158, 159, 160, 162, 164, 168, 169, 170,
-	171, 172, 173, 174, 175, 176, 179, 183,
-	160, 255, 128, 129, 130, 133, 134, 135,
-	141, 156, 157, 158, 159, 160, 162, 164,
-	168, 169, 170, 171, 172, 173, 174, 175,
-	176, 179, 183, 160, 255, 168, 255, 128,
-	129, 130, 134, 135, 141, 156, 157, 158,
-	159, 160, 162, 164, 168, 169, 170, 171,
-	172, 173, 174, 175, 176, 179, 183, 168,
-	255, 192, 255, 159, 139, 187, 158, 159,
-	176, 255, 135, 138, 139, 187, 188, 255,
-	168, 255, 153, 154, 155, 160, 162, 163,
-	164, 165, 166, 167, 168, 169, 170, 171,
-	175, 177, 178, 179, 180, 181, 182, 184,
-	185, 186, 187, 188, 189, 191, 176, 190,
-	192, 255, 135, 147, 160, 188, 128, 156,
-	184, 129, 255, 128, 129, 130, 133, 134,
-	141, 156, 157, 158, 159, 160, 162, 164,
-	168, 169, 170, 171, 172, 173, 174, 175,
-	176, 179, 183, 158, 159, 135, 255, 148,
-	176, 140, 168, 132, 160, 188, 152, 180,
-	144, 172, 136, 164, 192, 255, 129, 130,
-	131, 132, 133, 134, 136, 137, 138, 139,
-	140, 141, 143, 144, 145, 146, 147, 148,
-	150, 151, 152, 153, 154, 155, 157, 158,
-	159, 160, 161, 162, 164, 165, 166, 167,
-	168, 169, 171, 172, 173, 174, 175, 176,
-	178, 179, 180, 181, 182, 183, 185, 186,
-	187, 188, 189, 190, 128, 191, 129, 130,
-	131, 132, 133, 134, 136, 137, 138, 139,
-	140, 141, 143, 144, 145, 146, 147, 148,
-	150, 151, 152, 153, 154, 155, 157, 158,
-	159, 160, 161, 162, 164, 165, 166, 167,
-	168, 169, 171, 172, 173, 174, 175, 176,
-	178, 179, 180, 181, 182, 183, 185, 186,
-	187, 188, 189, 190, 128, 191, 129, 130,
-	131, 132, 133, 134, 136, 137, 138, 139,
-	140, 141, 143, 144, 145, 146, 147, 148,
-	150, 151, 152, 153, 154, 155, 157, 158,
-	159, 128, 156, 160, 255, 136, 164, 175,
-	176, 255, 142, 128, 191, 128, 129, 132,
-	134, 140, 142, 143, 147, 150, 151, 152,
-	153, 154, 155, 156, 157, 158, 164, 172,
-	173, 130, 191, 139, 141, 188, 128, 140,
-	142, 143, 144, 167, 168, 174, 175, 191,
-	128, 255, 176, 255, 131, 137, 191, 145,
-	189, 135, 129, 130, 132, 133, 144, 154,
-	176, 139, 159, 150, 156, 159, 164, 167,
-	168, 170, 173, 145, 176, 255, 139, 255,
-	166, 176, 189, 171, 179, 160, 161, 163,
-	164, 165, 167, 169, 171, 173, 174, 175,
-	176, 177, 179, 180, 181, 182, 183, 184,
-	185, 186, 187, 188, 189, 190, 191, 166,
-	170, 172, 178, 150, 153, 155, 163, 165,
-	167, 169, 173, 153, 155, 147, 161, 163,
-	255, 189, 132, 185, 144, 152, 161, 164,
-	255, 188, 129, 131, 190, 255, 133, 134,
-	137, 138, 142, 150, 152, 161, 164, 189,
-	191, 255, 131, 134, 137, 138, 142, 144,
-	146, 175, 178, 180, 182, 255, 134, 138,
-	142, 161, 164, 185, 192, 255, 188, 129,
-	131, 190, 191, 128, 132, 135, 136, 139,
-	141, 149, 151, 162, 163, 130, 190, 191,
-	151, 128, 130, 134, 136, 138, 141, 128,
-	132, 190, 255, 133, 137, 142, 148, 151,
-	161, 164, 255, 128, 132, 134, 136, 138,
-	141, 149, 150, 162, 163, 128, 131, 187,
-	188, 190, 255, 133, 137, 142, 150, 152,
-	161, 164, 255, 129, 131, 138, 150, 143,
-	148, 152, 159, 178, 179, 177, 179, 186,
-	135, 142, 177, 179, 188, 136, 141, 181,
-	183, 185, 152, 153, 190, 191, 177, 191,
-	128, 132, 134, 135, 141, 151, 153, 188,
-	134, 128, 129, 130, 141, 156, 157, 158,
-	159, 160, 162, 164, 168, 169, 170, 171,
-	172, 173, 174, 175, 176, 179, 183, 173,
-	183, 185, 190, 150, 153, 158, 160, 177,
-	180, 130, 141, 157, 132, 134, 157, 159,
-	146, 148, 178, 180, 146, 147, 178, 179,
-	180, 255, 148, 156, 158, 255, 139, 141,
-	169, 133, 134, 160, 171, 176, 187, 151,
-	155, 160, 162, 191, 149, 158, 165, 188,
-	176, 255, 129, 255, 128, 132, 180, 255,
-	133, 170, 180, 255, 128, 130, 161, 173,
-	166, 179, 164, 183, 173, 180, 144, 146,
-	148, 168, 183, 185, 128, 185, 187, 191,
-	128, 131, 179, 181, 183, 140, 141, 144,
-	176, 175, 177, 191, 160, 191, 128, 130,
-	170, 175, 153, 154, 153, 154, 155, 160,
-	162, 163, 164, 165, 166, 167, 168, 169,
-	170, 171, 175, 175, 178, 180, 189, 158,
-	159, 176, 177, 130, 134, 139, 172, 163,
-	167, 128, 129, 180, 255, 134, 159, 178,
-	190, 192, 255, 166, 173, 135, 147, 128,
-	131, 179, 255, 129, 164, 166, 255, 169,
-	182, 131, 188, 140, 141, 176, 178, 180,
-	183, 184, 190, 191, 129, 171, 175, 181,
-	182, 163, 170, 172, 173, 172, 184, 190,
-	158, 128, 143, 160, 175, 144, 145, 150,
-	155, 157, 158, 159, 135, 139, 141, 168,
-	171, 180, 186, 189, 189, 160, 182, 186,
-	191, 129, 131, 133, 134, 140, 143, 184,
-	186, 165, 166, 164, 167, 171, 172, 134,
-	144, 128, 129, 130, 132, 133, 134, 135,
-	136, 139, 140, 141, 144, 145, 146, 147,
-	150, 151, 152, 153, 154, 156, 160, 164,
-	165, 167, 168, 169, 170, 176, 178, 180,
-	181, 182, 187, 128, 130, 184, 255, 135,
-	190, 131, 175, 187, 255, 128, 130, 167,
-	180, 179, 133, 134, 128, 130, 179, 255,
-	141, 129, 136, 144, 255, 190, 172, 183,
-	159, 170, 128, 131, 187, 188, 190, 191,
-	151, 128, 132, 135, 136, 139, 141, 162,
-	163, 166, 172, 176, 180, 181, 191, 158,
-	128, 134, 132, 255, 175, 181, 184, 255,
-	129, 155, 158, 255, 171, 183, 157, 171,
-	172, 186, 176, 181, 183, 184, 187, 190,
-	128, 130, 131, 164, 145, 151, 154, 160,
-	129, 138, 179, 185, 187, 190, 135, 145,
-	155, 138, 153, 175, 182, 184, 191, 146,
-	167, 169, 182, 186, 177, 182, 188, 189,
-	191, 255, 134, 136, 255, 138, 142, 144,
-	145, 147, 151, 179, 182, 171, 172, 189,
-	190, 191, 176, 180, 176, 182, 143, 145,
-	255, 136, 142, 147, 255, 164, 176, 177,
-	178, 157, 158, 133, 134, 137, 168, 169,
-	170, 165, 169, 173, 178, 187, 255, 131,
-	132, 140, 169, 174, 255, 130, 132, 128,
-	182, 187, 255, 173, 180, 182, 255, 132,
-	155, 159, 161, 175, 128, 132, 139, 163,
-	165, 128, 134, 136, 152, 155, 161, 163,
-	164, 166, 170, 172, 175, 144, 150, 132,
-	138, 143, 187, 191, 160, 128, 129, 132,
-	135, 133, 134, 160, 255, 192, 255, 137,
-	128, 159, 160, 175, 176, 191, 162, 185,
-	128, 191, 128, 147, 148, 153, 154, 168,
-	169, 170, 171, 191, 168, 128, 153, 154,
-	155, 156, 191, 136, 128, 191, 143, 128,
-	168, 169, 179, 180, 183, 184, 186, 187,
-	191, 130, 128, 191, 182, 128, 169, 170,
-	171, 172, 191, 128, 191, 129, 186, 187,
-	190, 134, 147, 128, 191, 128, 133, 134,
-	143, 144, 255, 147, 149, 134, 135, 151,
-	156, 158, 160, 162, 167, 169, 178, 181,
-	191, 192, 255, 132, 135, 140, 142, 150,
-	128, 146, 147, 151, 152, 162, 163, 167,
-	168, 191, 161, 176, 191, 128, 148, 149,
-	151, 152, 190, 128, 179, 180, 181, 182,
-	191, 128, 132, 133, 135, 136, 154, 155,
-	156, 157, 191, 144, 149, 128, 191, 128,
-	138, 129, 191, 176, 189, 128, 191, 151,
-	153, 128, 191, 128, 191, 165, 177, 178,
-	179, 180, 181, 182, 184, 185, 186, 187,
-	188, 189, 191, 128, 175, 176, 190, 192,
-	255, 128, 159, 160, 188, 189, 191, 128,
-	156, 184, 129, 255, 148, 176, 140, 168,
-	132, 160, 188, 152, 180, 144, 172, 136,
-	164, 192, 255, 129, 130, 131, 132, 133,
-	134, 136, 137, 138, 139, 140, 141, 143,
-	144, 145, 146, 147, 148, 150, 151, 152,
-	153, 154, 155, 157, 158, 159, 160, 161,
-	162, 164, 165, 166, 167, 168, 169, 171,
-	172, 173, 174, 175, 176, 178, 179, 180,
-	181, 182, 183, 185, 186, 187, 188, 189,
-	190, 128, 191, 129, 130, 131, 132, 133,
-	134, 136, 137, 138, 139, 140, 141, 143,
-	144, 145, 146, 147, 148, 150, 151, 152,
-	153, 154, 155, 157, 158, 159, 160, 161,
-	162, 164, 165, 166, 167, 168, 169, 171,
-	172, 173, 174, 175, 176, 178, 179, 180,
-	181, 182, 183, 185, 186, 187, 188, 189,
-	190, 128, 191, 129, 130, 131, 132, 133,
-	134, 136, 137, 138, 139, 140, 141, 143,
-	144, 145, 146, 147, 148, 150, 151, 152,
-	153, 154, 155, 157, 158, 159, 128, 156,
-	160, 191, 192, 255, 136, 164, 175, 176,
-	255, 135, 138, 139, 187, 188, 191, 192,
-	255, 187, 191, 128, 190, 191, 128, 190,
-	188, 128, 175, 176, 189, 190, 191, 145,
-	147, 155, 157, 159, 128, 191, 130, 131,
-	135, 164, 165, 168, 170, 181, 128, 191,
-	189, 128, 191, 141, 128, 191, 128, 129,
-	130, 131, 132, 191, 191, 128, 190, 129,
-	128, 191, 186, 128, 191, 128, 131, 132,
-	137, 138, 191, 134, 128, 191, 144, 128,
-	191, 128, 175, 176, 184, 185, 191, 178,
-	128, 191, 128, 159, 160, 163, 164, 191,
-	133, 128, 191, 128, 178, 179, 186, 187,
-	191, 128, 131, 132, 133, 134, 135, 136,
-	137, 139, 140, 141, 142, 143, 144, 145,
-	148, 149, 151, 152, 153, 156, 157, 158,
-	159, 160, 161, 162, 163, 164, 165, 168,
-	169, 176, 191, 129, 150, 154, 171, 172,
-	175, 177, 190, 175, 128, 140, 141, 143,
-	144, 191, 128, 171, 172, 177, 178, 189,
-	190, 191, 142, 128, 144, 145, 154, 155,
-	172, 173, 255, 166, 191, 192, 255, 128,
-	255, 176, 255, 131, 137, 191, 145, 189,
-	135, 129, 130, 132, 133, 144, 154, 176,
-	139, 159, 150, 156, 159, 164, 167, 168,
-	170, 173, 145, 176, 255, 139, 255, 166,
-	176, 189, 171, 179, 160, 161, 163, 164,
-	165, 167, 169, 171, 173, 174, 175, 176,
-	177, 179, 180, 181, 182, 183, 184, 185,
-	186, 187, 188, 189, 190, 191, 166, 170,
-	172, 178, 150, 153, 155, 163, 165, 167,
-	169, 173, 153, 155, 147, 161, 163, 255,
-	189, 132, 185, 144, 152, 161, 164, 255,
-	188, 129, 131, 190, 255, 133, 134, 137,
-	138, 142, 150, 152, 161, 164, 189, 191,
-	255, 131, 134, 137, 138, 142, 144, 146,
-	175, 178, 180, 182, 255, 134, 138, 142,
-	161, 164, 185, 192, 255, 188, 129, 131,
-	190, 191, 128, 132, 135, 136, 139, 141,
-	149, 151, 162, 163, 130, 190, 191, 151,
-	128, 130, 134, 136, 138, 141, 128, 132,
-	190, 255, 133, 137, 142, 148, 151, 161,
-	164, 255, 128, 132, 134, 136, 138, 141,
-	149, 150, 162, 163, 128, 131, 187, 188,
-	190, 255, 133, 137, 142, 150, 152, 161,
-	164, 255, 129, 131, 138, 150, 143, 148,
-	152, 159, 178, 179, 177, 179, 186, 135,
-	142, 177, 179, 188, 136, 141, 181, 183,
-	185, 152, 153, 190, 191, 177, 191, 128,
-	132, 134, 135, 141, 151, 153, 188, 134,
-	128, 129, 130, 141, 156, 157, 158, 159,
-	160, 162, 164, 168, 169, 170, 171, 172,
-	173, 174, 175, 176, 179, 183, 173, 183,
-	185, 190, 150, 153, 158, 160, 177, 180,
-	130, 141, 157, 132, 134, 157, 159, 146,
-	148, 178, 180, 146, 147, 178, 179, 180,
-	255, 148, 156, 158, 255, 139, 141, 169,
-	133, 134, 160, 171, 176, 187, 151, 155,
-	160, 162, 191, 149, 158, 165, 188, 176,
-	255, 129, 255, 128, 132, 180, 255, 133,
-	170, 180, 255, 128, 130, 161, 173, 166,
-	179, 164, 183, 173, 180, 144, 146, 148,
-	168, 183, 185, 128, 185, 187, 191, 128,
-	131, 179, 181, 183, 140, 141, 169, 174,
-	128, 129, 131, 132, 134, 140, 142, 143,
-	147, 150, 151, 152, 153, 154, 155, 156,
-	157, 158, 164, 172, 173, 179, 181, 183,
-	140, 141, 188, 137, 144, 176, 162, 185,
-	148, 153, 169, 170, 168, 154, 155, 136,
-	143, 169, 179, 184, 186, 130, 182, 170,
-	171, 128, 187, 190, 128, 133, 135, 146,
-	148, 191, 128, 191, 128, 133, 144, 255,
-	147, 149, 134, 135, 151, 156, 158, 160,
-	162, 167, 169, 178, 181, 255, 132, 135,
-	140, 142, 151, 147, 149, 163, 167, 161,
-	176, 191, 149, 151, 180, 181, 133, 135,
-	155, 156, 144, 149, 175, 177, 191, 160,
-	191, 128, 130, 138, 189, 170, 176, 153,
-	154, 151, 153, 153, 154, 155, 160, 162,
-	163, 164, 165, 166, 167, 168, 169, 170,
-	171, 175, 175, 178, 180, 189, 158, 159,
-	176, 177, 130, 134, 139, 172, 163, 167,
-	128, 129, 180, 255, 134, 159, 178, 190,
-	192, 255, 166, 173, 135, 147, 128, 131,
-	179, 255, 129, 164, 166, 255, 169, 182,
-	131, 188, 140, 141, 176, 178, 180, 183,
-	184, 190, 191, 129, 171, 175, 181, 182,
-	163, 170, 172, 173, 172, 184, 190, 158,
-	128, 143, 160, 175, 144, 145, 150, 155,
-	157, 158, 159, 135, 139, 141, 168, 171,
-	180, 186, 189, 189, 160, 182, 186, 191,
-	129, 131, 133, 134, 140, 143, 184, 186,
-	165, 166, 164, 167, 171, 172, 134, 144,
-	128, 129, 130, 132, 133, 134, 135, 136,
-	139, 140, 141, 144, 145, 146, 147, 150,
-	151, 152, 153, 154, 156, 160, 164, 165,
-	167, 168, 169, 170, 176, 178, 180, 181,
-	182, 187, 128, 130, 184, 255, 135, 190,
-	131, 175, 187, 255, 128, 130, 167, 180,
-	179, 133, 134, 128, 130, 179, 255, 141,
-	129, 136, 144, 255, 190, 172, 183, 159,
-	170, 128, 131, 187, 188, 190, 191, 151,
-	128, 132, 135, 136, 139, 141, 162, 163,
-	166, 172, 176, 180, 181, 191, 158, 128,
-	134, 132, 255, 175, 181, 184, 255, 129,
-	155, 158, 255, 171, 183, 157, 171, 172,
-	186, 176, 181, 183, 184, 187, 190, 128,
-	130, 131, 164, 145, 151, 154, 160, 129,
-	138, 179, 185, 187, 190, 135, 145, 155,
-	138, 153, 175, 182, 184, 191, 146, 167,
-	169, 182, 186, 177, 182, 188, 189, 191,
-	255, 134, 136, 255, 138, 142, 144, 145,
-	147, 151, 179, 182, 171, 172, 189, 190,
-	191, 176, 180, 176, 182, 143, 145, 255,
-	136, 142, 147, 255, 164, 176, 177, 178,
-	157, 158, 133, 134, 137, 168, 169, 170,
-	165, 169, 173, 178, 187, 255, 131, 132,
-	140, 169, 174, 255, 130, 132, 128, 182,
-	187, 255, 173, 180, 182, 255, 132, 155,
-	159, 161, 175, 128, 132, 139, 163, 165,
-	128, 134, 136, 152, 155, 161, 163, 164,
-	166, 170, 172, 175, 144, 150, 132, 138,
-	128, 131, 132, 133, 134, 135, 136, 137,
-	139, 140, 141, 142, 143, 144, 145, 148,
-	149, 151, 152, 153, 157, 159, 160, 161,
-	162, 163, 164, 165, 168, 169, 176, 191,
-	129, 150, 154, 155, 166, 171, 177, 190,
-	192, 255, 175, 141, 143, 172, 177, 190,
-	191, 142, 145, 154, 173, 255, 166, 255,
-	154, 175, 129, 143, 178, 186, 188, 191,
-	137, 255, 190, 255, 134, 255, 144, 255,
-	180, 191, 149, 191, 140, 143, 136, 143,
-	154, 159, 136, 143, 174, 255, 140, 186,
-	188, 191, 128, 133, 135, 191, 160, 128,
-	129, 132, 135, 133, 134, 160, 255, 128,
-	130, 170, 175, 144, 145, 150, 155, 157,
-	158, 159, 143, 187, 191, 144, 145, 150,
-	155, 157, 158, 159, 135, 143, 166, 191,
-	128, 154, 175, 187, 129, 143, 144, 177,
-	178, 191, 128, 136, 137, 255, 187, 191,
-	192, 255, 190, 191, 192, 255, 128, 133,
-	134, 255, 144, 191, 192, 255, 128, 179,
-	180, 191, 128, 148, 149, 191, 128, 139,
-	140, 143, 144, 191, 128, 135, 136, 143,
-	144, 153, 154, 159, 160, 191, 128, 135,
-	136, 143, 144, 173, 174, 255, 187, 128,
-	139, 140, 191, 134, 128, 191, 128, 191,
-	160, 128, 191, 128, 130, 131, 135, 191,
-	129, 134, 136, 190, 128, 159, 160, 191,
-	0, 127, 192, 255, 128, 175, 176, 255,
-	10, 13, 127, 194, 216, 219, 220, 224,
-	225, 226, 227, 234, 235, 236, 237, 239,
-	240, 243, 0, 31, 128, 191, 192, 223,
-	228, 238, 241, 247, 248, 255, 204, 205,
-	210, 214, 215, 216, 217, 219, 220, 221,
-	222, 223, 224, 225, 226, 227, 234, 239,
-	240, 243, 204, 205, 210, 214, 215, 216,
-	217, 219, 220, 221, 222, 223, 224, 225,
-	226, 227, 234, 239, 240, 243, 194, 204,
-	205, 210, 214, 215, 216, 217, 219, 220,
-	221, 222, 223, 224, 225, 226, 227, 234,
-	239, 240, 243, 194, 216, 219, 220, 224,
-	225, 226, 227, 234, 235, 236, 237, 239,
-	240, 243, 32, 126, 192, 223, 228, 238,
-	241, 247, 204, 205, 210, 214, 215, 216,
-	217, 219, 220, 221, 222, 223, 224, 225,
-	226, 227, 234, 239, 240, 243, 204, 205,
-	210, 214, 215, 216, 217, 219, 220, 221,
-	222, 223, 224, 225, 226, 227, 234, 239,
-	240, 243, 194, 204, 205, 210, 214, 215,
-	216, 217, 219, 220, 221, 222, 223, 224,
-	225, 226, 227, 234, 239, 240, 243, 204,
-	205, 210, 214, 215, 216, 217, 219, 220,
-	221, 222, 223, 224, 225, 226, 227, 234,
-	235, 236, 237, 239, 240, 243, 204, 205,
-	210, 214, 215, 216, 217, 219, 220, 221,
-	222, 223, 224, 225, 226, 227, 234, 237,
-	239, 240, 243, 204, 205, 210, 214, 215,
-	216, 217, 219, 220, 221, 222, 223, 224,
-	225, 226, 227, 234, 237, 239, 240, 243,
-	204, 205, 210, 214, 215, 216, 217, 219,
-	220, 221, 222, 223, 224, 225, 226, 227,
-	234, 237, 239, 240, 243, 204, 205, 210,
-	214, 215, 216, 217, 219, 220, 221, 222,
-	223, 224, 225, 226, 227, 234, 239, 240,
-	243, 204, 205, 210, 214, 215, 216, 217,
-	219, 220, 221, 222, 223, 224, 225, 226,
-	227, 234, 235, 236, 237, 239, 240, 243,
-	204, 205, 210, 214, 215, 216, 217, 219,
-	220, 221, 222, 223, 224, 225, 226, 227,
-	234, 239, 240, 243, 194, 204, 205, 210,
-	214, 215, 216, 217, 219, 220, 221, 222,
-	223, 224, 225, 226, 227, 234, 239, 240,
-	243, 204, 205, 210, 214, 215, 216, 217,
-	219, 220, 221, 222, 223, 224, 225, 226,
-	227, 234, 237, 239, 240, 243, 204, 205,
-	210, 214, 215, 216, 217, 219, 220, 221,
-	222, 223, 224, 225, 226, 227, 234, 237,
-	239, 240, 243, 204, 205, 210, 214, 215,
-	216, 217, 219, 220, 221, 222, 223, 224,
-	225, 226, 227, 234, 237, 239, 240, 243,
-	204, 205, 210, 214, 215, 216, 217, 219,
-	220, 221, 222, 223, 224, 225, 226, 227,
-	234, 239, 240, 243, 204, 205, 210, 214,
-	215, 216, 217, 219, 220, 221, 222, 223,
-	224, 225, 226, 227, 234, 239, 240, 243,
-	204, 205, 210, 214, 215, 216, 217, 219,
-	220, 221, 222, 223, 224, 225, 226, 227,
-	234, 239, 240, 243, 194, 204, 205, 210,
-	214, 215, 216, 217, 219, 220, 221, 222,
-	223, 224, 225, 226, 227, 234, 239, 240,
-	243,
-}
-
-var _graphclust_single_lengths []byte = []byte{
-	0, 1, 0, 0, 0, 1, 1, 0,
-	1, 0, 1, 0, 0, 1, 26, 0,
-	0, 0, 1, 1, 1, 0, 0, 2,
-	1, 0, 1, 1, 0, 2, 0, 0,
-	2, 0, 2, 1, 0, 1, 0, 3,
-	0, 0, 1, 22, 0, 0, 3, 0,
-	0, 0, 0, 0, 0, 1, 0, 0,
-	3, 0, 0, 0, 0, 0, 0, 0,
-	2, 0, 5, 0, 0, 0, 1, 0,
-	2, 0, 0, 15, 0, 0, 0, 4,
-	0, 0, 0, 0, 0, 0, 0, 2,
-	1, 1, 0, 3, 1, 0, 7, 8,
-	1, 1, 0, 1, 0, 0, 0, 0,
-	34, 0, 0, 0, 0, 1, 0, 1,
-	1, 0, 0, 1, 0, 1, 0, 0,
-	0, 0, 0, 0, 0, 1, 1, 0,
-	1, 0, 0, 0, 1, 1, 0, 0,
-	5, 0, 0, 1, 0, 1, 1, 0,
-	6, 0, 0, 0, 0, 0, 1, 5,
-	0, 0, 0, 0, 1, 0, 1, 4,
-	0, 0, 0, 0, 3, 0, 0, 0,
-	1, 1, 0, 1, 0, 1, 0, 0,
-	1, 26, 0, 0, 0, 1, 1, 1,
-	0, 0, 2, 1, 0, 1, 1, 0,
-	2, 0, 0, 2, 0, 2, 1, 0,
-	1, 0, 3, 0, 0, 1, 22, 0,
-	0, 3, 0, 0, 0, 0, 0, 0,
-	1, 0, 0, 3, 0, 0, 0, 0,
-	0, 0, 0, 2, 0, 5, 2, 2,
-	24, 3, 1, 0, 2, 0, 1, 1,
-	1, 1, 1, 1, 0, 0, 0, 0,
-	2, 5, 3, 0, 0, 2, 0, 1,
-	0, 3, 1, 0, 2, 15, 0, 0,
-	0, 4, 0, 0, 0, 0, 0, 0,
-	0, 2, 1, 1, 0, 3, 1, 0,
-	7, 8, 1, 1, 0, 1, 0, 0,
-	0, 0, 34, 0, 0, 0, 0, 1,
-	0, 1, 1, 0, 0, 1, 0, 1,
-	0, 0, 0, 0, 0, 0, 0, 1,
-	1, 0, 1, 0, 0, 0, 1, 1,
-	0, 0, 5, 0, 0, 1, 0, 1,
-	1, 0, 6, 0, 0, 0, 0, 0,
-	1, 5, 0, 0, 0, 0, 32, 0,
-	1, 0, 1, 0, 2, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	1, 4, 0, 2, 0, 7, 1, 0,
-	1, 0, 0, 0, 1, 1, 0, 1,
-	0, 1, 0, 0, 1, 26, 0, 0,
-	0, 1, 1, 1, 0, 0, 2, 1,
-	0, 1, 1, 0, 2, 0, 0, 2,
-	0, 2, 1, 0, 1, 0, 3, 0,
-	0, 1, 22, 0, 0, 3, 0, 0,
-	0, 0, 0, 0, 1, 0, 0, 3,
-	0, 0, 0, 0, 0, 0, 0, 2,
-	0, 5, 0, 0, 0, 1, 0, 2,
-	0, 0, 15, 0, 0, 0, 4, 0,
-	0, 0, 0, 0, 0, 0, 2, 1,
-	1, 0, 3, 1, 0, 7, 8, 1,
-	1, 0, 1, 0, 0, 0, 0, 34,
-	0, 0, 0, 0, 1, 0, 1, 1,
-	0, 0, 1, 0, 1, 0, 0, 0,
-	0, 0, 0, 0, 1, 1, 0, 1,
-	0, 0, 0, 1, 1, 0, 0, 5,
-	0, 0, 1, 0, 1, 1, 0, 6,
-	0, 0, 0, 0, 0, 1, 5, 0,
-	0, 0, 0, 1, 0, 1, 4, 0,
-	0, 0, 0, 2, 0, 0, 0, 1,
-	1, 0, 1, 0, 1, 0, 0, 1,
-	26, 0, 0, 0, 1, 1, 1, 0,
-	0, 2, 1, 0, 1, 1, 0, 2,
-	0, 0, 2, 0, 2, 1, 0, 1,
-	0, 3, 0, 0, 1, 22, 0, 0,
-	3, 0, 0, 0, 0, 0, 0, 1,
-	0, 0, 3, 0, 0, 0, 0, 0,
-	0, 0, 2, 0, 5, 2, 2, 24,
-	3, 1, 0, 2, 0, 1, 1, 1,
-	1, 1, 1, 0, 0, 0, 0, 2,
-	5, 3, 0, 0, 2, 0, 1, 0,
-	3, 1, 0, 2, 15, 0, 0, 0,
-	4, 0, 0, 0, 0, 0, 0, 0,
-	2, 1, 1, 0, 3, 1, 0, 7,
-	8, 1, 1, 0, 1, 0, 0, 0,
-	0, 34, 0, 0, 0, 0, 1, 0,
-	1, 1, 0, 0, 1, 0, 1, 0,
-	0, 0, 0, 0, 0, 0, 1, 1,
-	0, 1, 0, 0, 0, 1, 1, 0,
-	0, 5, 0, 0, 1, 0, 1, 1,
-	0, 6, 0, 0, 0, 0, 0, 1,
-	5, 0, 0, 0, 0, 32, 0, 1,
-	0, 1, 0, 2, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 1,
-	4, 0, 2, 0, 7, 1, 0, 0,
-	1, 1, 2, 1, 1, 5, 0, 25,
-	0, 25, 0, 0, 24, 0, 0, 1,
-	0, 2, 0, 0, 0, 28, 0, 3,
-	24, 2, 0, 2, 2, 3, 2, 2,
-	2, 0, 54, 54, 27, 1, 0, 20,
-	1, 1, 2, 0, 1, 1, 1, 1,
-	1, 2, 2, 0, 2, 5, 3, 0,
-	0, 2, 2, 2, 2, 0, 14, 0,
-	3, 2, 2, 3, 2, 2, 2, 54,
-	54, 27, 1, 0, 2, 0, 1, 5,
-	8, 1, 1, 0, 1, 1, 1, 0,
-	1, 1, 0, 1, 0, 1, 0, 34,
-	1, 0, 1, 0, 7, 2, 0, 4,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 1, 1, 0, 1, 3, 0,
-	1, 1, 2, 1, 1, 5, 0, 0,
-	0, 0, 1, 1, 0, 1, 0, 1,
-	0, 0, 1, 26, 0, 0, 0, 1,
-	1, 1, 0, 0, 2, 1, 0, 1,
-	1, 0, 2, 0, 0, 2, 0, 2,
-	1, 0, 1, 0, 3, 0, 0, 1,
-	22, 0, 0, 3, 0, 0, 0, 0,
-	0, 0, 1, 0, 0, 3, 0, 0,
-	0, 0, 0, 0, 0, 2, 0, 5,
-	2, 2, 24, 3, 1, 0, 2, 0,
-	1, 1, 1, 1, 1, 1, 0, 0,
-	0, 0, 2, 5, 3, 0, 0, 2,
-	0, 1, 0, 3, 1, 0, 2, 15,
-	0, 0, 0, 4, 0, 0, 0, 0,
-	0, 0, 0, 2, 1, 1, 0, 3,
-	1, 0, 7, 8, 1, 1, 0, 1,
-	0, 0, 0, 0, 34, 0, 0, 0,
-	0, 1, 0, 1, 1, 0, 0, 1,
-	0, 1, 0, 0, 0, 0, 0, 0,
-	0, 1, 1, 0, 1, 0, 0, 0,
-	1, 1, 0, 0, 5, 0, 0, 1,
-	0, 1, 1, 0, 6, 0, 0, 0,
-	0, 0, 1, 5, 0, 0, 0, 0,
-	32, 0, 1, 0, 1, 0, 2, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 1, 4, 0, 2, 0, 7,
-	1, 0, 25, 0, 25, 0, 0, 24,
-	0, 0, 1, 0, 2, 0, 0, 0,
-	28, 0, 3, 24, 2, 0, 2, 2,
-	3, 2, 2, 2, 0, 54, 54, 27,
-	1, 1, 20, 3, 0, 0, 0, 1,
-	1, 0, 1, 0, 1, 0, 0, 1,
-	26, 0, 0, 0, 1, 1, 1, 0,
-	0, 2, 1, 0, 1, 1, 0, 2,
-	0, 0, 2, 0, 2, 1, 0, 1,
-	0, 3, 0, 0, 1, 22, 0, 0,
-	3, 0, 0, 0, 0, 0, 0, 1,
-	0, 0, 3, 0, 0, 0, 0, 0,
-	0, 0, 2, 0, 5, 0, 0, 0,
-	1, 0, 2, 0, 0, 15, 0, 0,
-	0, 4, 0, 0, 0, 0, 0, 0,
-	0, 2, 1, 1, 0, 3, 1, 0,
-	7, 8, 1, 1, 0, 1, 0, 0,
-	0, 0, 34, 0, 0, 0, 0, 1,
-	0, 1, 1, 0, 0, 1, 0, 1,
-	0, 0, 0, 0, 0, 0, 0, 1,
-	1, 0, 1, 0, 0, 0, 1, 1,
-	0, 0, 5, 0, 0, 1, 0, 1,
-	1, 0, 6, 0, 0, 0, 0, 0,
-	1, 5, 0, 0, 0, 0, 1, 0,
-	1, 4, 0, 0, 0, 1, 2, 0,
-	1, 1, 1, 1, 1, 2, 2, 0,
-	2, 5, 3, 0, 0, 2, 2, 2,
-	2, 0, 14, 0, 3, 2, 2, 3,
-	2, 2, 2, 54, 54, 27, 1, 0,
-	2, 1, 1, 5, 8, 1, 1, 0,
-	1, 1, 1, 0, 1, 1, 0, 1,
-	0, 1, 0, 34, 1, 0, 1, 0,
-	0, 0, 0, 1, 1, 0, 1, 0,
-	1, 0, 0, 1, 26, 0, 0, 0,
-	1, 1, 1, 0, 0, 2, 1, 0,
-	1, 1, 0, 2, 0, 0, 2, 0,
-	2, 1, 0, 1, 0, 3, 0, 0,
-	1, 22, 0, 0, 3, 0, 0, 0,
-	0, 0, 0, 1, 0, 0, 3, 0,
-	0, 0, 0, 0, 0, 0, 2, 0,
-	5, 2, 2, 24, 3, 1, 0, 2,
-	0, 1, 1, 1, 1, 1, 1, 0,
-	0, 0, 0, 2, 5, 3, 0, 0,
-	2, 0, 1, 0, 3, 1, 0, 2,
-	15, 0, 0, 0, 4, 0, 0, 0,
-	0, 0, 0, 0, 2, 1, 1, 0,
-	3, 1, 0, 7, 8, 1, 1, 0,
-	1, 0, 0, 0, 0, 34, 0, 0,
-	0, 0, 1, 0, 1, 1, 0, 0,
-	1, 0, 1, 0, 0, 0, 0, 0,
-	0, 0, 1, 1, 0, 1, 0, 0,
-	0, 1, 1, 0, 0, 5, 0, 0,
-	1, 0, 1, 1, 0, 6, 0, 0,
-	0, 0, 0, 1, 5, 0, 0, 0,
-	0, 32, 0, 1, 0, 1, 0, 2,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 1, 4, 0, 2, 0,
-	7, 1, 0, 7, 2, 0, 4, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 1, 1, 0, 1, 5, 0, 0,
-	0, 0, 0, 18, 20, 20, 21, 15,
-	20, 20, 21, 23, 21, 21, 21, 20,
-	23, 20, 21, 21, 21, 21, 20, 20,
-	20, 21,
-}
-
-var _graphclust_range_lengths []byte = []byte{
-	0, 0, 1, 1, 1, 1, 2, 1,
-	1, 4, 1, 1, 1, 1, 2, 4,
-	1, 2, 1, 2, 2, 6, 6, 3,
-	2, 5, 1, 3, 2, 3, 5, 3,
-	3, 1, 3, 1, 1, 1, 1, 2,
-	1, 4, 0, 0, 2, 3, 1, 1,
-	2, 2, 1, 2, 1, 1, 2, 1,
-	2, 1, 1, 2, 2, 2, 1, 1,
-	3, 2, 0, 1, 1, 1, 0, 1,
-	0, 1, 1, 0, 2, 1, 1, 1,
-	2, 3, 1, 1, 2, 2, 1, 1,
-	3, 2, 2, 0, 0, 2, 0, 0,
-	0, 0, 1, 4, 1, 1, 1, 1,
-	0, 2, 1, 2, 2, 1, 2, 2,
-	1, 1, 3, 6, 1, 1, 1, 2,
-	2, 1, 1, 1, 3, 1, 2, 3,
-	1, 1, 2, 2, 3, 1, 3, 1,
-	0, 1, 1, 1, 2, 1, 0, 1,
-	0, 3, 3, 1, 2, 2, 2, 0,
-	5, 1, 1, 1, 0, 1, 0, 1,
-	1, 1, 0, 1, 2, 1, 1, 1,
-	1, 2, 1, 1, 4, 1, 1, 1,
-	1, 2, 4, 1, 2, 1, 2, 2,
-	6, 6, 3, 2, 5, 1, 3, 2,
-	3, 5, 3, 3, 1, 3, 1, 1,
-	1, 1, 2, 1, 4, 0, 0, 2,
-	3, 1, 1, 2, 2, 1, 2, 1,
-	1, 2, 1, 2, 1, 1, 2, 2,
-	2, 1, 1, 3, 2, 0, 0, 0,
-	0, 0, 0, 1, 0, 2, 1, 0,
-	2, 0, 1, 1, 3, 1, 2, 0,
-	6, 2, 1, 1, 2, 0, 1, 0,
-	1, 0, 1, 1, 0, 0, 2, 1,
-	1, 1, 2, 3, 1, 1, 2, 2,
-	1, 1, 3, 2, 2, 0, 0, 2,
-	0, 0, 0, 0, 1, 4, 1, 1,
-	1, 1, 0, 2, 1, 2, 2, 1,
-	2, 2, 1, 1, 3, 6, 1, 1,
-	1, 2, 2, 1, 1, 1, 3, 1,
-	2, 3, 1, 1, 2, 2, 3, 1,
-	3, 1, 0, 1, 1, 1, 2, 1,
-	0, 1, 0, 3, 3, 1, 2, 2,
-	2, 0, 5, 1, 1, 1, 4, 1,
-	1, 2, 2, 1, 3, 1, 1, 1,
-	1, 1, 1, 1, 2, 2, 2, 2,
-	0, 1, 1, 0, 1, 0, 0, 1,
-	2, 1, 1, 1, 1, 2, 1, 1,
-	4, 1, 1, 1, 1, 2, 4, 1,
-	2, 1, 2, 2, 6, 6, 3, 2,
-	5, 1, 3, 2, 3, 5, 3, 3,
-	1, 3, 1, 1, 1, 1, 2, 1,
-	4, 0, 0, 2, 3, 1, 1, 2,
-	2, 1, 2, 1, 1, 2, 1, 2,
-	1, 1, 2, 2, 2, 1, 1, 3,
-	2, 0, 1, 1, 1, 0, 1, 0,
-	1, 1, 0, 2, 1, 1, 1, 2,
-	3, 1, 1, 2, 2, 1, 1, 3,
-	2, 2, 0, 0, 2, 0, 0, 0,
-	0, 1, 4, 1, 1, 1, 1, 0,
-	2, 1, 2, 2, 1, 2, 2, 1,
-	1, 3, 6, 1, 1, 1, 2, 2,
-	1, 1, 1, 3, 1, 2, 3, 1,
-	1, 2, 2, 3, 1, 3, 1, 0,
-	1, 1, 1, 2, 1, 0, 1, 0,
-	3, 3, 1, 2, 2, 2, 0, 5,
-	1, 1, 1, 0, 1, 0, 1, 1,
-	1, 0, 1, 2, 1, 1, 1, 1,
-	2, 1, 1, 4, 1, 1, 1, 1,
-	2, 4, 1, 2, 1, 2, 2, 6,
-	6, 3, 2, 5, 1, 3, 2, 3,
-	5, 3, 3, 1, 3, 1, 1, 1,
-	1, 2, 1, 4, 0, 0, 2, 3,
-	1, 1, 2, 2, 1, 2, 1, 1,
-	2, 1, 2, 1, 1, 2, 2, 2,
-	1, 1, 3, 2, 0, 0, 0, 0,
-	0, 0, 1, 0, 2, 1, 0, 2,
-	0, 1, 1, 3, 1, 2, 0, 6,
-	2, 1, 1, 2, 0, 1, 0, 1,
-	0, 1, 1, 0, 0, 2, 1, 1,
-	1, 2, 3, 1, 1, 2, 2, 1,
-	1, 3, 2, 2, 0, 0, 2, 0,
-	0, 0, 0, 1, 4, 1, 1, 1,
-	1, 0, 2, 1, 2, 2, 1, 2,
-	2, 1, 1, 3, 6, 1, 1, 1,
-	2, 2, 1, 1, 1, 3, 1, 2,
-	3, 1, 1, 2, 2, 3, 1, 3,
-	1, 0, 1, 1, 1, 2, 1, 0,
-	1, 0, 3, 3, 1, 2, 2, 2,
-	0, 5, 1, 1, 1, 4, 1, 1,
-	2, 2, 1, 3, 1, 1, 1, 1,
-	1, 1, 1, 2, 2, 2, 2, 0,
-	1, 1, 0, 1, 0, 0, 1, 3,
-	1, 1, 1, 1, 1, 1, 1, 0,
-	1, 0, 1, 1, 0, 1, 1, 0,
-	1, 0, 1, 3, 1, 2, 2, 1,
-	0, 0, 1, 0, 0, 0, 0, 0,
-	1, 0, 1, 1, 2, 2, 2, 1,
-	4, 2, 1, 5, 3, 1, 5, 1,
-	3, 2, 1, 3, 7, 5, 3, 3,
-	5, 1, 1, 1, 1, 1, 3, 3,
-	1, 0, 0, 0, 0, 0, 1, 1,
-	1, 3, 2, 4, 1, 1, 2, 1,
-	1, 1, 1, 3, 1, 1, 1, 3,
-	1, 1, 2, 1, 2, 1, 2, 4,
-	3, 4, 4, 2, 0, 0, 1, 3,
-	2, 2, 2, 2, 2, 2, 2, 3,
-	5, 4, 2, 1, 1, 1, 1, 1,
-	1, 1, 1, 1, 1, 1, 1, 1,
-	1, 1, 1, 2, 1, 1, 4, 1,
-	1, 1, 1, 2, 4, 1, 2, 1,
-	2, 2, 6, 6, 3, 2, 5, 1,
-	3, 2, 3, 5, 3, 3, 1, 3,
-	1, 1, 1, 1, 2, 1, 4, 0,
-	0, 2, 3, 1, 1, 2, 2, 1,
-	2, 1, 1, 2, 1, 2, 1, 1,
-	2, 2, 2, 1, 1, 3, 2, 0,
-	0, 0, 0, 0, 0, 1, 0, 2,
-	1, 0, 2, 0, 1, 1, 3, 1,
-	2, 0, 6, 2, 1, 1, 2, 0,
-	1, 0, 1, 0, 1, 1, 0, 0,
-	2, 1, 1, 1, 2, 3, 1, 1,
-	2, 2, 1, 1, 3, 2, 2, 0,
-	0, 2, 0, 0, 0, 0, 1, 4,
-	1, 1, 1, 1, 0, 2, 1, 2,
-	2, 1, 2, 2, 1, 1, 3, 6,
-	1, 1, 1, 2, 2, 1, 1, 1,
-	3, 1, 2, 3, 1, 1, 2, 2,
-	3, 1, 3, 1, 0, 1, 1, 1,
-	2, 1, 0, 1, 0, 3, 3, 1,
-	2, 2, 2, 0, 5, 1, 1, 1,
-	4, 1, 1, 2, 2, 1, 3, 1,
-	1, 1, 1, 1, 1, 1, 2, 2,
-	2, 2, 0, 1, 1, 0, 1, 0,
-	0, 1, 0, 1, 0, 1, 1, 0,
-	1, 1, 0, 1, 0, 1, 3, 1,
-	2, 2, 1, 0, 0, 1, 0, 0,
-	0, 0, 0, 1, 0, 1, 1, 2,
-	2, 1, 1, 5, 1, 1, 1, 1,
-	2, 1, 1, 4, 1, 1, 1, 1,
-	2, 4, 1, 2, 1, 2, 2, 6,
-	6, 3, 2, 5, 1, 3, 2, 3,
-	5, 3, 3, 1, 3, 1, 1, 1,
-	1, 2, 1, 4, 0, 0, 2, 3,
-	1, 1, 2, 2, 1, 2, 1, 1,
-	2, 1, 2, 1, 1, 2, 2, 2,
-	1, 1, 3, 2, 0, 1, 1, 1,
-	0, 1, 0, 1, 1, 0, 2, 1,
-	1, 1, 2, 3, 1, 1, 2, 2,
-	1, 1, 3, 2, 2, 0, 0, 2,
-	0, 0, 0, 0, 1, 4, 1, 1,
-	1, 1, 0, 2, 1, 2, 2, 1,
-	2, 2, 1, 1, 3, 6, 1, 1,
-	1, 2, 2, 1, 1, 1, 3, 1,
-	2, 3, 1, 1, 2, 2, 3, 1,
-	3, 1, 0, 1, 1, 1, 2, 1,
-	0, 1, 0, 3, 3, 1, 2, 2,
-	2, 0, 5, 1, 1, 1, 0, 1,
-	0, 1, 1, 1, 0, 3, 1, 5,
-	3, 1, 5, 1, 3, 2, 1, 3,
-	7, 5, 3, 3, 5, 1, 1, 1,
-	1, 1, 3, 3, 1, 0, 0, 0,
-	0, 0, 1, 1, 1, 3, 2, 4,
-	1, 1, 3, 1, 1, 1, 1, 3,
-	1, 1, 1, 3, 1, 1, 3, 1,
-	3, 1, 3, 4, 3, 4, 4, 2,
-	1, 1, 1, 1, 2, 1, 1, 4,
-	1, 1, 1, 1, 2, 4, 1, 2,
-	1, 2, 2, 6, 6, 3, 2, 5,
-	1, 3, 2, 3, 5, 3, 3, 1,
-	3, 1, 1, 1, 1, 2, 1, 4,
-	0, 0, 2, 3, 1, 1, 2, 2,
-	1, 2, 1, 1, 2, 1, 2, 1,
-	1, 2, 2, 2, 1, 1, 3, 2,
-	0, 0, 0, 0, 0, 0, 1, 0,
-	2, 1, 0, 2, 0, 1, 1, 3,
-	1, 2, 0, 6, 2, 1, 1, 2,
-	0, 1, 0, 1, 0, 1, 1, 0,
-	0, 2, 1, 1, 1, 2, 3, 1,
-	1, 2, 2, 1, 1, 3, 2, 2,
-	0, 0, 2, 0, 0, 0, 0, 1,
-	4, 1, 1, 1, 1, 0, 2, 1,
-	2, 2, 1, 2, 2, 1, 1, 3,
-	6, 1, 1, 1, 2, 2, 1, 1,
-	1, 3, 1, 2, 3, 1, 1, 2,
-	2, 3, 1, 3, 1, 0, 1, 1,
-	1, 2, 1, 0, 1, 0, 3, 3,
-	1, 2, 2, 2, 0, 5, 1, 1,
-	1, 4, 1, 1, 2, 2, 1, 3,
-	1, 1, 1, 1, 1, 1, 1, 2,
-	2, 2, 2, 0, 1, 1, 0, 1,
-	0, 0, 1, 0, 0, 1, 3, 2,
-	2, 2, 2, 2, 2, 2, 3, 5,
-	4, 2, 1, 1, 1, 2, 2, 1,
-	1, 2, 0, 6, 0, 0, 0, 4,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0,
-}
-
-var _graphclust_index_offsets []int16 = []int16{
-	0, 0, 2, 4, 6, 8, 11, 15,
-	17, 20, 25, 28, 30, 32, 35, 64,
-	69, 71, 74, 77, 81, 85, 92, 99,
-	105, 109, 115, 118, 123, 126, 132, 138,
-	142, 148, 150, 156, 159, 161, 164, 166,
-	172, 174, 179, 181, 204, 207, 211, 216,
-	218, 221, 224, 226, 229, 231, 234, 237,
-	239, 245, 247, 249, 252, 255, 258, 260,
-	262, 268, 271, 277, 279, 281, 283, 285,
-	287, 290, 292, 294, 310, 313, 315, 317,
-	323, 326, 330, 332, 334, 337, 340, 342,
-	346, 351, 355, 358, 362, 364, 367, 375,
-	384, 386, 388, 390, 396, 398, 400, 402,
-	404, 439, 442, 444, 447, 450, 453, 456,
-	460, 463, 465, 469, 477, 479, 482, 484,
-	487, 490, 492, 494, 496, 500, 503, 507,
-	511, 514, 516, 519, 522, 527, 530, 534,
-	536, 542, 544, 546, 549, 552, 555, 557,
-	559, 566, 570, 574, 576, 579, 582, 586,
-	592, 598, 600, 602, 604, 606, 608, 610,
-	616, 618, 620, 621, 623, 629, 631, 633,
-	635, 638, 642, 644, 647, 652, 655, 657,
-	659, 662, 691, 696, 698, 701, 704, 708,
-	712, 719, 726, 732, 736, 742, 745, 750,
-	753, 759, 765, 769, 775, 777, 783, 786,
-	788, 791, 793, 799, 801, 806, 808, 831,
-	834, 838, 843, 845, 848, 851, 853, 856,
-	858, 861, 864, 866, 872, 874, 876, 879,
-	882, 885, 887, 889, 895, 898, 904, 907,
-	910, 935, 939, 941, 943, 946, 949, 952,
-	954, 958, 960, 963, 966, 970, 972, 975,
-	976, 985, 993, 998, 1000, 1003, 1006, 1008,
-	1010, 1012, 1016, 1019, 1021, 1024, 1040, 1043,
-	1045, 1047, 1053, 1056, 1060, 1062, 1064, 1067,
-	1070, 1072, 1076, 1081, 1085, 1088, 1092, 1094,
-	1097, 1105, 1114, 1116, 1118, 1120, 1126, 1128,
-	1130, 1132, 1134, 1169, 1172, 1174, 1177, 1180,
-	1183, 1186, 1190, 1193, 1195, 1199, 1207, 1209,
-	1212, 1214, 1217, 1220, 1222, 1224, 1226, 1230,
-	1233, 1237, 1241, 1244, 1246, 1249, 1252, 1257,
-	1260, 1264, 1266, 1272, 1274, 1276, 1279, 1282,
-	1285, 1287, 1289, 1296, 1300, 1304, 1306, 1309,
-	1312, 1316, 1322, 1328, 1330, 1332, 1334, 1371,
-	1373, 1376, 1379, 1383, 1385, 1391, 1393, 1395,
-	1397, 1399, 1401, 1403, 1405, 1408, 1411, 1414,
-	1417, 1419, 1425, 1427, 1430, 1432, 1440, 1442,
-	1444, 1448, 1450, 1452, 1454, 1457, 1461, 1463,
-	1466, 1471, 1474, 1476, 1478, 1481, 1510, 1515,
-	1517, 1520, 1523, 1527, 1531, 1538, 1545, 1551,
-	1555, 1561, 1564, 1569, 1572, 1578, 1584, 1588,
-	1594, 1596, 1602, 1605, 1607, 1610, 1612, 1618,
-	1620, 1625, 1627, 1650, 1653, 1657, 1662, 1664,
-	1667, 1670, 1672, 1675, 1677, 1680, 1683, 1685,
-	1691, 1693, 1695, 1698, 1701, 1704, 1706, 1708,
-	1714, 1717, 1723, 1725, 1727, 1729, 1731, 1733,
-	1736, 1738, 1740, 1756, 1759, 1761, 1763, 1769,
-	1772, 1776, 1778, 1780, 1783, 1786, 1788, 1792,
-	1797, 1801, 1804, 1808, 1810, 1813, 1821, 1830,
-	1832, 1834, 1836, 1842, 1844, 1846, 1848, 1850,
-	1885, 1888, 1890, 1893, 1896, 1899, 1902, 1906,
-	1909, 1911, 1915, 1923, 1925, 1928, 1930, 1933,
-	1936, 1938, 1940, 1942, 1946, 1949, 1953, 1957,
-	1960, 1962, 1965, 1968, 1973, 1976, 1980, 1982,
-	1988, 1990, 1992, 1995, 1998, 2001, 2003, 2005,
-	2012, 2016, 2020, 2022, 2025, 2028, 2032, 2038,
-	2044, 2046, 2048, 2050, 2052, 2054, 2056, 2062,
-	2064, 2066, 2067, 2069, 2074, 2076, 2078, 2080,
-	2083, 2087, 2089, 2092, 2097, 2100, 2102, 2104,
-	2107, 2136, 2141, 2143, 2146, 2149, 2153, 2157,
-	2164, 2171, 2177, 2181, 2187, 2190, 2195, 2198,
-	2204, 2210, 2214, 2220, 2222, 2228, 2231, 2233,
-	2236, 2238, 2244, 2246, 2251, 2253, 2276, 2279,
-	2283, 2288, 2290, 2293, 2296, 2298, 2301, 2303,
-	2306, 2309, 2311, 2317, 2319, 2321, 2324, 2327,
-	2330, 2332, 2334, 2340, 2343, 2349, 2352, 2355,
-	2380, 2384, 2386, 2388, 2391, 2394, 2397, 2399,
-	2403, 2405, 2408, 2411, 2415, 2417, 2420, 2421,
-	2430, 2438, 2443, 2445, 2448, 2451, 2453, 2455,
-	2457, 2461, 2464, 2466, 2469, 2485, 2488, 2490,
-	2492, 2498, 2501, 2505, 2507, 2509, 2512, 2515,
-	2517, 2521, 2526, 2530, 2533, 2537, 2539, 2542,
-	2550, 2559, 2561, 2563, 2565, 2571, 2573, 2575,
-	2577, 2579, 2614, 2617, 2619, 2622, 2625, 2628,
-	2631, 2635, 2638, 2640, 2644, 2652, 2654, 2657,
-	2659, 2662, 2665, 2667, 2669, 2671, 2675, 2678,
-	2682, 2686, 2689, 2691, 2694, 2697, 2702, 2705,
-	2709, 2711, 2717, 2719, 2721, 2724, 2727, 2730,
-	2732, 2734, 2741, 2745, 2749, 2751, 2754, 2757,
-	2761, 2767, 2773, 2775, 2777, 2779, 2816, 2818,
-	2821, 2824, 2828, 2830, 2836, 2838, 2840, 2842,
-	2844, 2846, 2848, 2850, 2853, 2856, 2859, 2862,
-	2864, 2870, 2872, 2875, 2877, 2885, 2887, 2889,
-	2893, 2896, 2899, 2903, 2906, 2909, 2916, 2918,
-	2944, 2946, 2972, 2974, 2976, 3001, 3003, 3005,
-	3007, 3009, 3012, 3014, 3018, 3020, 3051, 3054,
-	3059, 3084, 3087, 3089, 3092, 3095, 3099, 3102,
-	3105, 3109, 3110, 3166, 3222, 3252, 3256, 3259,
-	3281, 3287, 3291, 3295, 3301, 3306, 3309, 3316,
-	3319, 3324, 3329, 3333, 3337, 3347, 3358, 3365,
-	3369, 3375, 3379, 3383, 3387, 3391, 3393, 3411,
-	3415, 3420, 3423, 3426, 3430, 3433, 3436, 3440,
-	3496, 3552, 3583, 3587, 3592, 3596, 3598, 3602,
-	3609, 3619, 3622, 3625, 3629, 3632, 3635, 3638,
-	3642, 3645, 3648, 3651, 3654, 3657, 3660, 3663,
-	3702, 3707, 3712, 3718, 3721, 3729, 3732, 3734,
-	3742, 3745, 3748, 3751, 3754, 3757, 3760, 3763,
-	3767, 3773, 3778, 3782, 3785, 3787, 3790, 3795,
-	3797, 3800, 3803, 3807, 3810, 3813, 3820, 3822,
-	3824, 3826, 3828, 3831, 3835, 3837, 3840, 3845,
-	3848, 3850, 3852, 3855, 3884, 3889, 3891, 3894,
-	3897, 3901, 3905, 3912, 3919, 3925, 3929, 3935,
-	3938, 3943, 3946, 3952, 3958, 3962, 3968, 3970,
-	3976, 3979, 3981, 3984, 3986, 3992, 3994, 3999,
-	4001, 4024, 4027, 4031, 4036, 4038, 4041, 4044,
-	4046, 4049, 4051, 4054, 4057, 4059, 4065, 4067,
-	4069, 4072, 4075, 4078, 4080, 4082, 4088, 4091,
-	4097, 4100, 4103, 4128, 4132, 4134, 4136, 4139,
-	4142, 4145, 4147, 4151, 4153, 4156, 4159, 4163,
-	4165, 4168, 4169, 4178, 4186, 4191, 4193, 4196,
-	4199, 4201, 4203, 4205, 4209, 4212, 4214, 4217,
-	4233, 4236, 4238, 4240, 4246, 4249, 4253, 4255,
-	4257, 4260, 4263, 4265, 4269, 4274, 4278, 4281,
-	4285, 4287, 4290, 4298, 4307, 4309, 4311, 4313,
-	4319, 4321, 4323, 4325, 4327, 4362, 4365, 4367,
-	4370, 4373, 4376, 4379, 4383, 4386, 4388, 4392,
-	4400, 4402, 4405, 4407, 4410, 4413, 4415, 4417,
-	4419, 4423, 4426, 4430, 4434, 4437, 4439, 4442,
-	4445, 4450, 4453, 4457, 4459, 4465, 4467, 4469,
-	4472, 4475, 4478, 4480, 4482, 4489, 4493, 4497,
-	4499, 4502, 4505, 4509, 4515, 4521, 4523, 4525,
-	4527, 4564, 4566, 4569, 4572, 4576, 4578, 4584,
-	4586, 4588, 4590, 4592, 4594, 4596, 4598, 4601,
-	4604, 4607, 4610, 4612, 4618, 4620, 4623, 4625,
-	4633, 4635, 4637, 4663, 4665, 4691, 4693, 4695,
-	4720, 4722, 4724, 4726, 4728, 4731, 4733, 4737,
-	4739, 4770, 4773, 4778, 4803, 4806, 4808, 4811,
-	4814, 4818, 4821, 4824, 4828, 4829, 4885, 4941,
-	4971, 4975, 4978, 5000, 5009, 5011, 5013, 5015,
-	5018, 5022, 5024, 5027, 5032, 5035, 5037, 5039,
-	5042, 5071, 5076, 5078, 5081, 5084, 5088, 5092,
-	5099, 5106, 5112, 5116, 5122, 5125, 5130, 5133,
-	5139, 5145, 5149, 5155, 5157, 5163, 5166, 5168,
-	5171, 5173, 5179, 5181, 5186, 5188, 5211, 5214,
-	5218, 5223, 5225, 5228, 5231, 5233, 5236, 5238,
-	5241, 5244, 5246, 5252, 5254, 5256, 5259, 5262,
-	5265, 5267, 5269, 5275, 5278, 5284, 5286, 5288,
-	5290, 5292, 5294, 5297, 5299, 5301, 5317, 5320,
-	5322, 5324, 5330, 5333, 5337, 5339, 5341, 5344,
-	5347, 5349, 5353, 5358, 5362, 5365, 5369, 5371,
-	5374, 5382, 5391, 5393, 5395, 5397, 5403, 5405,
-	5407, 5409, 5411, 5446, 5449, 5451, 5454, 5457,
-	5460, 5463, 5467, 5470, 5472, 5476, 5484, 5486,
-	5489, 5491, 5494, 5497, 5499, 5501, 5503, 5507,
-	5510, 5514, 5518, 5521, 5523, 5526, 5529, 5534,
-	5537, 5541, 5543, 5549, 5551, 5553, 5556, 5559,
-	5562, 5564, 5566, 5573, 5577, 5581, 5583, 5586,
-	5589, 5593, 5599, 5605, 5607, 5609, 5611, 5613,
-	5615, 5617, 5623, 5625, 5627, 5628, 5633, 5637,
-	5643, 5648, 5651, 5658, 5661, 5666, 5671, 5675,
-	5679, 5689, 5700, 5707, 5711, 5717, 5721, 5725,
-	5729, 5733, 5735, 5753, 5757, 5762, 5765, 5768,
-	5772, 5775, 5778, 5782, 5838, 5894, 5925, 5929,
-	5934, 5938, 5941, 5946, 5953, 5963, 5966, 5969,
-	5973, 5976, 5979, 5982, 5986, 5989, 5992, 5996,
-	5999, 6003, 6006, 6010, 6049, 6054, 6059, 6065,
-	6068, 6070, 6072, 6074, 6077, 6081, 6083, 6086,
-	6091, 6094, 6096, 6098, 6101, 6130, 6135, 6137,
-	6140, 6143, 6147, 6151, 6158, 6165, 6171, 6175,
-	6181, 6184, 6189, 6192, 6198, 6204, 6208, 6214,
-	6216, 6222, 6225, 6227, 6230, 6232, 6238, 6240,
-	6245, 6247, 6270, 6273, 6277, 6282, 6284, 6287,
-	6290, 6292, 6295, 6297, 6300, 6303, 6305, 6311,
-	6313, 6315, 6318, 6321, 6324, 6326, 6328, 6334,
-	6337, 6343, 6346, 6349, 6374, 6378, 6380, 6382,
-	6385, 6388, 6391, 6393, 6397, 6399, 6402, 6405,
-	6409, 6411, 6414, 6415, 6424, 6432, 6437, 6439,
-	6442, 6445, 6447, 6449, 6451, 6455, 6458, 6460,
-	6463, 6479, 6482, 6484, 6486, 6492, 6495, 6499,
-	6501, 6503, 6506, 6509, 6511, 6515, 6520, 6524,
-	6527, 6531, 6533, 6536, 6544, 6553, 6555, 6557,
-	6559, 6565, 6567, 6569, 6571, 6573, 6608, 6611,
-	6613, 6616, 6619, 6622, 6625, 6629, 6632, 6634,
-	6638, 6646, 6648, 6651, 6653, 6656, 6659, 6661,
-	6663, 6665, 6669, 6672, 6676, 6680, 6683, 6685,
-	6688, 6691, 6696, 6699, 6703, 6705, 6711, 6713,
-	6715, 6718, 6721, 6724, 6726, 6728, 6735, 6739,
-	6743, 6745, 6748, 6751, 6755, 6761, 6767, 6769,
-	6771, 6773, 6810, 6812, 6815, 6818, 6822, 6824,
-	6830, 6832, 6834, 6836, 6838, 6840, 6842, 6844,
-	6847, 6850, 6853, 6856, 6858, 6864, 6866, 6869,
-	6871, 6879, 6881, 6883, 6891, 6894, 6896, 6904,
-	6907, 6910, 6913, 6916, 6919, 6922, 6925, 6929,
-	6935, 6940, 6944, 6947, 6949, 6952, 6960, 6963,
-	6965, 6967, 6970, 6971, 6996, 7017, 7038, 7060,
-	7080, 7101, 7122, 7144, 7168, 7190, 7212, 7234,
-	7255, 7279, 7300, 7322, 7344, 7366, 7388, 7409,
-	7430, 7451,
-}
-
-var _graphclust_indicies []int16 = []int16{
-	0, 1, 3, 2, 2, 3, 3, 2,
-	3, 3, 2, 3, 3, 3, 2, 3,
-	2, 3, 3, 2, 3, 3, 3, 3,
-	2, 3, 3, 2, 2, 3, 3, 2,
-	3, 3, 2, 4, 5, 6, 7, 8,
-	10, 11, 12, 14, 15, 16, 17, 18,
-	19, 20, 21, 22, 23, 24, 25, 26,
-	27, 28, 29, 30, 31, 9, 13, 2,
-	3, 3, 3, 3, 2, 3, 2, 3,
-	3, 2, 2, 2, 3, 2, 2, 2,
-	3, 3, 3, 3, 2, 2, 2, 2,
-	2, 2, 2, 3, 2, 2, 2, 2,
-	2, 2, 3, 2, 2, 2, 2, 2,
-	3, 3, 3, 3, 2, 3, 3, 3,
-	3, 3, 2, 3, 3, 2, 3, 3,
-	3, 3, 2, 3, 3, 2, 2, 2,
-	2, 2, 2, 3, 3, 3, 3, 3,
-	3, 2, 3, 3, 3, 2, 2, 2,
-	2, 2, 2, 3, 3, 2, 3, 3,
-	3, 3, 3, 2, 3, 3, 2, 3,
-	2, 3, 3, 2, 3, 2, 3, 3,
-	3, 3, 3, 2, 3, 2, 3, 3,
-	3, 3, 2, 3, 2, 32, 33, 34,
-	35, 36, 37, 38, 39, 40, 41, 42,
-	43, 44, 45, 46, 47, 48, 49, 50,
-	51, 52, 53, 2, 3, 3, 2, 3,
-	3, 3, 2, 3, 3, 3, 3, 2,
-	3, 2, 3, 3, 2, 3, 3, 2,
-	3, 2, 2, 2, 3, 3, 2, 3,
-	3, 2, 3, 3, 2, 3, 2, 3,
-	3, 3, 3, 3, 2, 3, 2, 2,
-	3, 3, 3, 2, 2, 2, 3, 3,
-	3, 2, 3, 2, 3, 2, 3, 3,
-	3, 3, 3, 2, 3, 3, 2, 54,
-	55, 56, 57, 58, 2, 3, 2, 3,
-	2, 3, 2, 3, 2, 3, 2, 59,
-	60, 2, 3, 2, 3, 2, 61, 62,
-	63, 64, 65, 66, 67, 68, 69, 70,
-	71, 72, 73, 74, 75, 2, 3, 3,
-	2, 3, 2, 3, 2, 3, 3, 3,
-	3, 3, 2, 3, 3, 2, 2, 2,
-	2, 3, 3, 2, 3, 2, 3, 3,
-	2, 2, 2, 3, 3, 2, 3, 3,
-	3, 2, 3, 3, 3, 3, 2, 3,
-	3, 3, 2, 3, 3, 2, 76, 77,
-	62, 2, 3, 2, 3, 3, 2, 78,
-	79, 80, 81, 82, 83, 84, 2, 85,
-	86, 87, 88, 89, 90, 91, 92, 2,
-	3, 2, 3, 2, 3, 2, 3, 3,
-	3, 3, 3, 2, 3, 2, 3, 2,
-	3, 2, 3, 2, 93, 94, 95, 96,
-	97, 98, 99, 100, 101, 102, 103, 104,
-	105, 45, 106, 107, 108, 45, 46, 109,
-	110, 111, 112, 113, 114, 115, 116, 117,
-	118, 119, 120, 121, 122, 123, 2, 3,
-	3, 2, 2, 3, 2, 2, 3, 3,
-	3, 2, 3, 3, 2, 3, 3, 2,
-	2, 2, 2, 3, 3, 3, 2, 3,
-	2, 3, 3, 3, 2, 3, 3, 3,
-	3, 3, 3, 3, 2, 3, 2, 3,
-	3, 2, 2, 3, 3, 3, 2, 2,
-	2, 3, 3, 2, 3, 2, 3, 2,
-	3, 3, 3, 2, 3, 3, 2, 3,
-	3, 3, 2, 3, 3, 3, 2, 3,
-	3, 2, 3, 2, 3, 3, 2, 3,
-	3, 2, 3, 3, 3, 3, 2, 2,
-	2, 3, 3, 3, 3, 2, 3, 2,
-	124, 125, 126, 127, 128, 2, 3, 2,
-	3, 2, 3, 3, 2, 2, 2, 3,
-	3, 3, 2, 129, 2, 3, 2, 130,
-	131, 132, 133, 134, 135, 2, 3, 3,
-	3, 2, 2, 2, 2, 3, 3, 2,
-	3, 3, 2, 2, 2, 3, 3, 3,
-	3, 2, 136, 125, 137, 138, 139, 2,
-	3, 3, 3, 3, 3, 2, 3, 2,
-	3, 2, 3, 2, 140, 2, 3, 2,
-	141, 2, 142, 143, 144, 146, 145, 2,
-	3, 2, 2, 3, 3, 3, 1, 148,
-	147, 148, 147, 3, 1, 149, 148, 150,
-	148, 148, 150, 148, 148, 150, 148, 148,
-	148, 150, 148, 150, 148, 148, 150, 148,
-	148, 148, 148, 150, 148, 148, 150, 150,
-	148, 148, 150, 148, 148, 150, 151, 152,
-	153, 154, 155, 157, 158, 159, 161, 162,
-	163, 164, 165, 166, 167, 168, 169, 170,
-	171, 172, 173, 174, 175, 176, 177, 178,
-	156, 160, 150, 148, 148, 148, 148, 150,
-	148, 150, 148, 148, 150, 150, 150, 148,
-	150, 150, 150, 148, 148, 148, 148, 150,
-	150, 150, 150, 150, 150, 150, 148, 150,
-	150, 150, 150, 150, 150, 148, 150, 150,
-	150, 150, 150, 148, 148, 148, 148, 150,
-	148, 148, 148, 148, 148, 150, 148, 148,
-	150, 148, 148, 148, 148, 150, 148, 148,
-	150, 150, 150, 150, 150, 150, 148, 148,
-	148, 148, 148, 148, 150, 148, 148, 148,
-	150, 150, 150, 150, 150, 150, 148, 148,
-	150, 148, 148, 148, 148, 148, 150, 148,
-	148, 150, 148, 150, 148, 148, 150, 148,
-	150, 148, 148, 148, 148, 148, 150, 148,
-	150, 148, 148, 148, 148, 150, 148, 150,
-	179, 180, 181, 182, 183, 184, 185, 186,
-	187, 188, 189, 190, 191, 192, 193, 194,
-	195, 196, 197, 198, 199, 200, 150, 148,
-	148, 150, 148, 148, 148, 150, 148, 148,
-	148, 148, 150, 148, 150, 148, 148, 150,
-	148, 148, 150, 148, 150, 150, 150, 148,
-	148, 150, 148, 148, 150, 148, 148, 150,
-	148, 150, 148, 148, 148, 148, 148, 150,
-	148, 150, 150, 148, 148, 148, 150, 150,
-	150, 148, 148, 148, 150, 148, 150, 148,
-	150, 148, 148, 148, 148, 148, 150, 148,
-	148, 150, 201, 202, 203, 204, 205, 150,
-	148, 206, 150, 148, 148, 150, 207, 208,
-	202, 209, 210, 211, 212, 213, 214, 215,
-	216, 217, 218, 219, 220, 221, 222, 223,
-	224, 225, 226, 203, 204, 205, 150, 148,
-	206, 148, 150, 148, 150, 148, 150, 148,
-	148, 150, 148, 148, 150, 148, 148, 150,
-	148, 150, 148, 148, 148, 150, 148, 150,
-	148, 148, 150, 148, 148, 150, 148, 148,
-	148, 150, 148, 149, 148, 148, 150, 148,
-	150, 150, 150, 150, 150, 150, 150, 150,
-	148, 148, 148, 148, 148, 148, 148, 148,
-	150, 148, 148, 148, 148, 150, 148, 150,
-	148, 148, 150, 148, 148, 150, 148, 150,
-	148, 150, 148, 150, 227, 228, 229, 150,
-	148, 148, 150, 148, 150, 148, 148, 150,
-	230, 231, 232, 233, 234, 235, 236, 237,
-	238, 239, 240, 241, 242, 243, 244, 150,
-	148, 148, 150, 148, 150, 148, 150, 148,
-	148, 148, 148, 148, 150, 148, 148, 150,
-	150, 150, 150, 148, 148, 150, 148, 150,
-	148, 148, 150, 150, 150, 148, 148, 150,
-	148, 148, 148, 150, 148, 148, 148, 148,
-	150, 148, 148, 148, 150, 148, 148, 150,
-	245, 246, 231, 150, 148, 150, 148, 148,
-	150, 247, 248, 249, 250, 251, 252, 253,
-	150, 254, 255, 256, 257, 258, 259, 260,
-	261, 150, 148, 150, 148, 150, 148, 150,
-	148, 148, 148, 148, 148, 150, 148, 150,
-	148, 150, 148, 150, 148, 150, 262, 263,
-	264, 265, 266, 267, 268, 269, 270, 271,
-	272, 273, 274, 192, 275, 276, 277, 192,
-	193, 278, 279, 280, 281, 282, 283, 284,
-	285, 286, 287, 288, 289, 290, 291, 292,
-	150, 148, 148, 150, 150, 148, 150, 150,
-	148, 148, 148, 150, 148, 148, 150, 148,
-	148, 150, 150, 150, 150, 148, 148, 148,
-	150, 148, 150, 148, 148, 148, 150, 148,
-	148, 148, 148, 148, 148, 148, 150, 148,
-	150, 148, 148, 150, 150, 148, 148, 148,
-	150, 150, 150, 148, 148, 150, 148, 150,
-	148, 150, 148, 148, 148, 150, 148, 148,
-	150, 148, 148, 148, 150, 148, 148, 148,
-	150, 148, 148, 150, 148, 150, 148, 148,
-	150, 148, 148, 150, 148, 148, 148, 148,
-	150, 150, 150, 148, 148, 148, 148, 150,
-	148, 150, 293, 294, 295, 296, 297, 150,
-	148, 150, 148, 150, 148, 148, 150, 150,
-	150, 148, 148, 148, 150, 298, 150, 148,
-	150, 299, 300, 301, 302, 303, 304, 150,
-	148, 148, 148, 150, 150, 150, 150, 148,
-	148, 150, 148, 148, 150, 150, 150, 148,
-	148, 148, 148, 150, 305, 294, 306, 307,
-	308, 150, 148, 148, 148, 148, 148, 150,
-	148, 150, 148, 150, 148, 150, 309, 310,
-	311, 312, 313, 314, 315, 316, 310, 309,
-	310, 309, 310, 218, 309, 317, 318, 310,
-	309, 319, 320, 321, 322, 323, 324, 310,
-	325, 326, 309, 310, 309, 317, 220, 218,
-	218, 220, 150, 149, 148, 148, 148, 150,
-	148, 148, 150, 148, 148, 148, 150, 150,
-	148, 148, 148, 148, 148, 148, 150, 148,
-	150, 150, 148, 148, 150, 150, 148, 148,
-	150, 148, 150, 148, 150, 148, 148, 150,
-	148, 148, 150, 148, 148, 150, 148, 148,
-	150, 327, 150, 328, 310, 309, 329, 220,
-	150, 148, 150, 330, 228, 150, 148, 150,
-	247, 248, 249, 250, 251, 252, 331, 150,
-	332, 150, 148, 150, 147, 333, 3, 1,
-	335, 334, 334, 335, 335, 334, 335, 335,
-	334, 335, 335, 335, 334, 335, 334, 335,
-	335, 334, 335, 335, 335, 335, 334, 335,
-	335, 334, 334, 335, 335, 334, 335, 335,
-	334, 336, 337, 338, 339, 340, 342, 343,
-	344, 346, 347, 348, 349, 350, 351, 352,
-	353, 354, 355, 356, 357, 358, 359, 360,
-	361, 362, 363, 341, 345, 334, 335, 335,
-	335, 335, 334, 335, 334, 335, 335, 334,
-	334, 334, 335, 334, 334, 334, 335, 335,
-	335, 335, 334, 334, 334, 334, 334, 334,
-	334, 335, 334, 334, 334, 334, 334, 334,
-	335, 334, 334, 334, 334, 334, 335, 335,
-	335, 335, 334, 335, 335, 335, 335, 335,
-	334, 335, 335, 334, 335, 335, 335, 335,
-	334, 335, 335, 334, 334, 334, 334, 334,
-	334, 335, 335, 335, 335, 335, 335, 334,
-	335, 335, 335, 334, 334, 334, 334, 334,
-	334, 335, 335, 334, 335, 335, 335, 335,
-	335, 334, 335, 335, 334, 335, 334, 335,
-	335, 334, 335, 334, 335, 335, 335, 335,
-	335, 334, 335, 334, 335, 335, 335, 335,
-	334, 335, 334, 364, 365, 366, 367, 368,
-	369, 370, 371, 372, 373, 374, 375, 376,
-	377, 378, 379, 380, 381, 382, 383, 384,
-	385, 334, 335, 335, 334, 335, 335, 335,
-	334, 335, 335, 335, 335, 334, 335, 334,
-	335, 335, 334, 335, 335, 334, 335, 334,
-	334, 334, 335, 335, 334, 335, 335, 334,
-	335, 335, 334, 335, 334, 335, 335, 335,
-	335, 335, 334, 335, 334, 334, 335, 335,
-	335, 334, 334, 334, 335, 335, 335, 334,
-	335, 334, 335, 334, 335, 335, 335, 335,
-	335, 334, 335, 335, 334, 386, 387, 388,
-	389, 390, 334, 335, 334, 335, 334, 335,
-	334, 335, 334, 335, 334, 391, 392, 334,
-	335, 334, 335, 334, 393, 394, 395, 396,
-	397, 398, 399, 400, 401, 402, 403, 404,
-	405, 406, 407, 334, 335, 335, 334, 335,
-	334, 335, 334, 335, 335, 335, 335, 335,
-	334, 335, 335, 334, 334, 334, 334, 335,
-	335, 334, 335, 334, 335, 335, 334, 334,
-	334, 335, 335, 334, 335, 335, 335, 334,
-	335, 335, 335, 335, 334, 335, 335, 335,
-	334, 335, 335, 334, 408, 409, 394, 334,
-	335, 334, 335, 335, 334, 410, 411, 412,
-	413, 414, 415, 416, 334, 417, 418, 419,
-	420, 421, 422, 423, 424, 334, 335, 334,
-	335, 334, 335, 334, 335, 335, 335, 335,
-	335, 334, 335, 334, 335, 334, 335, 334,
-	335, 334, 425, 426, 427, 428, 429, 430,
-	431, 432, 433, 434, 435, 436, 437, 377,
-	438, 439, 440, 377, 378, 441, 442, 443,
-	444, 445, 446, 447, 448, 449, 450, 451,
-	452, 453, 454, 455, 334, 335, 335, 334,
-	334, 335, 334, 334, 335, 335, 335, 334,
-	335, 335, 334, 335, 335, 334, 334, 334,
-	334, 335, 335, 335, 334, 335, 334, 335,
-	335, 335, 334, 335, 335, 335, 335, 335,
-	335, 335, 334, 335, 334, 335, 335, 334,
-	334, 335, 335, 335, 334, 334, 334, 335,
-	335, 334, 335, 334, 335, 334, 335, 335,
-	335, 334, 335, 335, 334, 335, 335, 335,
-	334, 335, 335, 335, 334, 335, 335, 334,
-	335, 334, 335, 335, 334, 335, 335, 334,
-	335, 335, 335, 335, 334, 334, 334, 335,
-	335, 335, 335, 334, 335, 334, 456, 457,
-	458, 459, 460, 334, 335, 334, 335, 334,
-	335, 335, 334, 334, 334, 335, 335, 335,
-	334, 461, 334, 335, 334, 462, 463, 464,
-	465, 466, 467, 334, 335, 335, 335, 334,
-	334, 334, 334, 335, 335, 334, 335, 335,
-	334, 334, 334, 335, 335, 335, 335, 334,
-	468, 457, 469, 470, 471, 334, 335, 335,
-	335, 335, 335, 334, 335, 334, 335, 334,
-	335, 334, 472, 334, 335, 334, 473, 334,
-	474, 475, 476, 478, 477, 334, 335, 334,
-	334, 335, 335, 335, 334, 479, 479, 335,
-	335, 334, 479, 334, 334, 479, 479, 334,
-	479, 479, 334, 479, 479, 479, 334, 479,
-	334, 479, 479, 334, 479, 479, 479, 479,
-	334, 479, 479, 334, 334, 479, 479, 334,
-	479, 479, 334, 480, 481, 482, 483, 484,
-	486, 487, 488, 490, 491, 492, 493, 494,
-	495, 496, 497, 498, 499, 500, 501, 502,
-	503, 504, 505, 506, 507, 485, 489, 334,
-	479, 479, 479, 479, 334, 479, 334, 479,
-	479, 334, 334, 334, 479, 334, 334, 334,
-	479, 479, 479, 479, 334, 334, 334, 334,
-	334, 334, 334, 479, 334, 334, 334, 334,
-	334, 334, 479, 334, 334, 334, 334, 334,
-	479, 479, 479, 479, 334, 479, 479, 479,
-	479, 479, 334, 479, 479, 334, 479, 479,
-	479, 479, 334, 479, 479, 334, 334, 334,
-	334, 334, 334, 479, 479, 479, 479, 479,
-	479, 334, 479, 479, 479, 334, 334, 334,
-	334, 334, 334, 479, 479, 334, 479, 479,
-	479, 479, 479, 334, 479, 479, 334, 479,
-	334, 479, 479, 334, 479, 334, 479, 479,
-	479, 479, 479, 334, 479, 334, 479, 479,
-	479, 479, 334, 479, 334, 508, 509, 510,
-	511, 512, 513, 514, 515, 516, 517, 518,
-	519, 520, 521, 522, 523, 524, 525, 526,
-	527, 528, 529, 334, 479, 479, 334, 479,
-	479, 479, 334, 479, 479, 479, 479, 334,
-	479, 334, 479, 479, 334, 479, 479, 334,
-	479, 334, 334, 334, 479, 479, 334, 479,
-	479, 334, 479, 479, 334, 479, 334, 479,
-	479, 479, 479, 479, 334, 479, 334, 334,
-	479, 479, 479, 334, 334, 334, 479, 479,
-	479, 334, 479, 334, 479, 334, 479, 479,
-	479, 479, 479, 334, 479, 479, 334, 530,
-	531, 532, 533, 534, 334, 479, 535, 334,
-	479, 479, 334, 536, 537, 531, 538, 539,
-	540, 541, 542, 543, 544, 545, 546, 547,
-	548, 549, 550, 551, 552, 553, 554, 555,
-	532, 533, 534, 334, 479, 535, 479, 334,
-	479, 334, 479, 334, 479, 479, 334, 479,
-	479, 334, 479, 479, 334, 479, 334, 479,
-	479, 479, 334, 479, 334, 479, 479, 334,
-	479, 479, 334, 479, 479, 479, 334, 479,
-	334, 479, 479, 334, 479, 334, 334, 334,
-	334, 334, 334, 334, 334, 479, 479, 479,
-	479, 479, 479, 479, 479, 334, 479, 479,
-	479, 479, 334, 479, 334, 479, 479, 334,
-	479, 479, 334, 479, 334, 479, 334, 479,
-	334, 556, 557, 558, 334, 479, 479, 334,
-	479, 334, 479, 479, 334, 559, 560, 561,
-	562, 563, 564, 565, 566, 567, 568, 569,
-	570, 571, 572, 573, 334, 479, 479, 334,
-	479, 334, 479, 334, 479, 479, 479, 479,
-	479, 334, 479, 479, 334, 334, 334, 334,
-	479, 479, 334, 479, 334, 479, 479, 334,
-	334, 334, 479, 479, 334, 479, 479, 479,
-	334, 479, 479, 479, 479, 334, 479, 479,
-	479, 334, 479, 479, 334, 574, 575, 560,
-	334, 479, 334, 479, 479, 334, 576, 577,
-	578, 579, 580, 581, 582, 334, 583, 584,
-	585, 586, 587, 588, 589, 590, 334, 479,
-	334, 479, 334, 479, 334, 479, 479, 479,
-	479, 479, 334, 479, 334, 479, 334, 479,
-	334, 479, 334, 591, 592, 593, 594, 595,
-	596, 597, 598, 599, 600, 601, 602, 603,
-	521, 604, 605, 606, 521, 522, 607, 608,
-	609, 610, 611, 612, 613, 614, 615, 616,
-	617, 618, 619, 620, 621, 334, 479, 479,
-	334, 334, 479, 334, 334, 479, 479, 479,
-	334, 479, 479, 334, 479, 479, 334, 334,
-	334, 334, 479, 479, 479, 334, 479, 334,
-	479, 479, 479, 334, 479, 479, 479, 479,
-	479, 479, 479, 334, 479, 334, 479, 479,
-	334, 334, 479, 479, 479, 334, 334, 334,
-	479, 479, 334, 479, 334, 479, 334, 479,
-	479, 479, 334, 479, 479, 334, 479, 479,
-	479, 334, 479, 479, 479, 334, 479, 479,
-	334, 479, 334, 479, 479, 334, 479, 479,
-	334, 479, 479, 479, 479, 334, 334, 334,
-	479, 479, 479, 479, 334, 479, 334, 622,
-	623, 624, 625, 626, 334, 479, 334, 479,
-	334, 479, 479, 334, 334, 334, 479, 479,
-	479, 334, 627, 334, 479, 334, 628, 629,
-	630, 631, 632, 633, 334, 479, 479, 479,
-	334, 334, 334, 334, 479, 479, 334, 479,
-	479, 334, 334, 334, 479, 479, 479, 479,
-	334, 634, 623, 635, 636, 637, 334, 479,
-	479, 479, 479, 479, 334, 479, 334, 479,
-	334, 479, 334, 638, 639, 640, 641, 642,
-	643, 644, 645, 639, 638, 639, 638, 639,
-	547, 638, 646, 647, 639, 638, 648, 649,
-	650, 651, 652, 653, 639, 654, 655, 638,
-	639, 638, 646, 549, 547, 547, 549, 334,
-	334, 479, 479, 479, 334, 479, 479, 334,
-	479, 479, 479, 334, 334, 479, 479, 479,
-	479, 479, 479, 334, 479, 334, 334, 479,
-	479, 334, 334, 479, 479, 334, 479, 334,
-	479, 334, 479, 479, 334, 479, 479, 334,
-	479, 479, 334, 479, 479, 334, 656, 334,
-	657, 639, 638, 658, 549, 334, 479, 334,
-	659, 557, 334, 479, 334, 576, 577, 578,
-	579, 580, 581, 660, 334, 661, 334, 479,
-	334, 333, 335, 335, 334, 333, 335, 334,
-	333, 335, 334, 663, 664, 662, 334, 333,
-	335, 334, 333, 335, 334, 665, 666, 667,
-	668, 669, 662, 334, 670, 334, 508, 509,
-	510, 665, 666, 671, 511, 512, 513, 514,
-	515, 516, 517, 518, 519, 520, 521, 522,
-	523, 524, 525, 526, 527, 528, 529, 334,
-	672, 670, 508, 509, 510, 673, 667, 668,
-	511, 512, 513, 514, 515, 516, 517, 518,
-	519, 520, 521, 522, 523, 524, 525, 526,
-	527, 528, 529, 334, 672, 334, 674, 672,
-	508, 509, 510, 675, 668, 511, 512, 513,
-	514, 515, 516, 517, 518, 519, 520, 521,
-	522, 523, 524, 525, 526, 527, 528, 529,
-	334, 674, 334, 334, 674, 676, 334, 674,
-	334, 677, 678, 334, 672, 334, 334, 674,
-	334, 672, 334, 672, 559, 560, 561, 562,
-	563, 564, 565, 679, 567, 568, 569, 570,
-	571, 572, 573, 681, 682, 683, 684, 685,
-	686, 681, 682, 683, 684, 685, 686, 681,
-	680, 687, 334, 479, 670, 334, 688, 688,
-	688, 674, 334, 508, 509, 510, 673, 671,
-	511, 512, 513, 514, 515, 516, 517, 518,
-	519, 520, 521, 522, 523, 524, 525, 526,
-	527, 528, 529, 334, 677, 689, 334, 334,
-	672, 688, 688, 674, 688, 688, 674, 688,
-	688, 688, 674, 688, 688, 674, 688, 688,
-	674, 688, 688, 334, 674, 674, 683, 684,
-	685, 686, 680, 681, 683, 684, 685, 686,
-	680, 681, 683, 684, 685, 686, 680, 681,
-	683, 684, 685, 686, 680, 681, 683, 684,
-	685, 686, 680, 681, 683, 684, 685, 686,
-	680, 681, 683, 684, 685, 686, 680, 681,
-	683, 684, 685, 686, 680, 681, 683, 684,
-	685, 686, 680, 681, 682, 687, 684, 685,
-	686, 680, 681, 682, 684, 685, 686, 680,
-	681, 682, 684, 685, 686, 680, 681, 682,
-	684, 685, 686, 680, 681, 682, 684, 685,
-	686, 680, 681, 682, 684, 685, 686, 680,
-	681, 682, 684, 685, 686, 680, 681, 682,
-	684, 685, 686, 680, 681, 682, 684, 685,
-	686, 680, 681, 682, 683, 687, 685, 686,
-	680, 681, 682, 683, 685, 686, 680, 681,
-	682, 683, 685, 686, 680, 681, 682, 683,
-	685, 686, 680, 681, 682, 683, 685, 690,
-	689, 684, 334, 687, 688, 334, 672, 674,
-	335, 335, 334, 691, 692, 693, 694, 695,
-	696, 697, 698, 699, 700, 701, 547, 702,
-	549, 703, 704, 705, 706, 707, 708, 662,
-	334, 479, 335, 335, 335, 335, 334, 479,
-	335, 335, 334, 479, 479, 335, 334, 335,
-	479, 335, 479, 335, 334, 479, 335, 479,
-	335, 334, 479, 335, 334, 479, 335, 479,
-	335, 479, 335, 334, 479, 335, 334, 479,
-	335, 479, 335, 334, 479, 335, 335, 479,
-	334, 335, 335, 479, 334, 479, 335, 479,
-	334, 335, 335, 335, 335, 335, 335, 335,
-	335, 334, 479, 479, 479, 479, 479, 335,
-	335, 479, 335, 479, 335, 334, 479, 479,
-	479, 335, 479, 335, 334, 335, 479, 335,
-	334, 335, 479, 335, 479, 335, 334, 479,
-	479, 335, 334, 709, 710, 662, 334, 479,
-	479, 335, 334, 479, 479, 335, 334, 662,
-	334, 711, 713, 714, 715, 716, 717, 718,
-	713, 714, 715, 716, 717, 718, 713, 662,
-	712, 687, 334, 335, 670, 335, 334, 672,
-	672, 672, 674, 334, 672, 672, 674, 672,
-	672, 674, 672, 672, 672, 674, 672, 672,
-	674, 672, 672, 674, 672, 672, 334, 674,
-	715, 716, 717, 718, 712, 713, 715, 716,
-	717, 718, 712, 713, 715, 716, 717, 718,
-	712, 713, 715, 716, 717, 718, 712, 713,
-	715, 716, 717, 718, 712, 713, 715, 716,
-	717, 718, 712, 713, 715, 716, 717, 718,
-	712, 713, 715, 716, 717, 718, 712, 713,
-	715, 716, 717, 718, 712, 713, 714, 687,
-	716, 717, 718, 712, 713, 714, 716, 717,
-	718, 712, 713, 714, 716, 717, 718, 712,
-	713, 714, 716, 717, 718, 712, 713, 714,
-	716, 717, 718, 712, 713, 714, 716, 717,
-	718, 712, 713, 714, 716, 717, 718, 712,
-	713, 714, 716, 717, 718, 712, 713, 714,
-	716, 717, 718, 712, 713, 714, 715, 687,
-	717, 718, 712, 713, 714, 715, 717, 718,
-	712, 713, 714, 715, 717, 718, 712, 713,
-	714, 715, 717, 718, 712, 713, 714, 715,
-	717, 719, 720, 716, 662, 334, 687, 672,
-	335, 672, 674, 335, 674, 335, 334, 672,
-	721, 722, 662, 334, 335, 334, 335, 335,
-	335, 334, 724, 725, 726, 727, 728, 723,
-	334, 729, 730, 731, 732, 733, 734, 735,
-	736, 662, 334, 333, 335, 334, 333, 335,
-	334, 335, 333, 335, 334, 333, 335, 334,
-	333, 335, 334, 333, 335, 334, 335, 333,
-	335, 334, 333, 335, 334, 737, 662, 334,
-	335, 335, 334, 738, 662, 334, 335, 335,
-	334, 739, 662, 334, 335, 335, 334, 638,
-	639, 740, 741, 742, 743, 744, 745, 639,
-	638, 639, 638, 746, 547, 638, 747, 748,
-	639, 638, 749, 662, 750, 662, 751, 752,
-	753, 754, 639, 755, 756, 638, 639, 638,
-	747, 549, 547, 662, 549, 334, 479, 335,
-	479, 335, 334, 335, 479, 335, 479, 334,
-	479, 335, 479, 335, 479, 334, 757, 334,
-	479, 576, 577, 578, 579, 580, 581, 758,
-	334, 759, 661, 334, 479, 334, 335, 479,
-	479, 335, 479, 335, 479, 334, 335, 479,
-	334, 335, 334, 479, 335, 334, 479, 335,
-	479, 334, 335, 334, 479, 335, 479, 334,
-	335, 479, 334, 335, 479, 335, 334, 335,
-	479, 335, 479, 335, 334, 335, 479, 335,
-	479, 334, 335, 335, 479, 334, 335, 479,
-	334, 723, 334, 760, 723, 334, 390, 662,
-	761, 662, 334, 335, 334, 333, 3, 1,
-	333, 3, 1, 763, 764, 762, 1, 333,
-	3, 1, 333, 3, 1, 765, 766, 767,
-	768, 769, 762, 1, 770, 149, 772, 771,
-	771, 772, 772, 771, 772, 772, 771, 772,
-	772, 772, 771, 772, 771, 772, 772, 771,
-	772, 772, 772, 772, 771, 772, 772, 771,
-	771, 772, 772, 771, 772, 772, 771, 773,
-	774, 775, 776, 777, 779, 780, 781, 783,
-	784, 785, 786, 787, 788, 789, 790, 791,
-	792, 793, 794, 795, 796, 797, 798, 799,
-	800, 778, 782, 771, 772, 772, 772, 772,
-	771, 772, 771, 772, 772, 771, 771, 771,
-	772, 771, 771, 771, 772, 772, 772, 772,
-	771, 771, 771, 771, 771, 771, 771, 772,
-	771, 771, 771, 771, 771, 771, 772, 771,
-	771, 771, 771, 771, 772, 772, 772, 772,
-	771, 772, 772, 772, 772, 772, 771, 772,
-	772, 771, 772, 772, 772, 772, 771, 772,
-	772, 771, 771, 771, 771, 771, 771, 772,
-	772, 772, 772, 772, 772, 771, 772, 772,
-	772, 771, 771, 771, 771, 771, 771, 772,
-	772, 771, 772, 772, 772, 772, 772, 771,
-	772, 772, 771, 772, 771, 772, 772, 771,
-	772, 771, 772, 772, 772, 772, 772, 771,
-	772, 771, 772, 772, 772, 772, 771, 772,
-	771, 801, 802, 803, 804, 805, 806, 807,
-	808, 809, 810, 811, 812, 813, 814, 815,
-	816, 817, 818, 819, 820, 821, 822, 771,
-	772, 772, 771, 772, 772, 772, 771, 772,
-	772, 772, 772, 771, 772, 771, 772, 772,
-	771, 772, 772, 771, 772, 771, 771, 771,
-	772, 772, 771, 772, 772, 771, 772, 772,
-	771, 772, 771, 772, 772, 772, 772, 772,
-	771, 772, 771, 771, 772, 772, 772, 771,
-	771, 771, 772, 772, 772, 771, 772, 771,
-	772, 771, 772, 772, 772, 772, 772, 771,
-	772, 772, 771, 823, 824, 825, 826, 827,
-	771, 772, 828, 771, 772, 772, 771, 829,
-	830, 824, 831, 832, 833, 834, 835, 836,
-	837, 838, 839, 840, 841, 842, 843, 844,
-	845, 846, 847, 848, 825, 826, 827, 771,
-	772, 828, 772, 771, 772, 771, 772, 771,
-	772, 772, 771, 772, 772, 771, 772, 772,
-	771, 772, 771, 772, 772, 772, 771, 772,
-	771, 772, 772, 771, 772, 772, 771, 772,
-	772, 772, 771, 772, 771, 772, 772, 771,
-	772, 771, 771, 771, 771, 771, 771, 771,
-	771, 772, 772, 772, 772, 772, 772, 772,
-	772, 771, 772, 772, 772, 772, 771, 772,
-	771, 772, 772, 771, 772, 772, 771, 772,
-	771, 772, 771, 772, 771, 849, 850, 851,
-	771, 772, 772, 771, 772, 771, 772, 772,
-	771, 852, 853, 854, 855, 856, 857, 858,
-	859, 860, 861, 862, 863, 864, 865, 866,
-	771, 772, 772, 771, 772, 771, 772, 771,
-	772, 772, 772, 772, 772, 771, 772, 772,
-	771, 771, 771, 771, 772, 772, 771, 772,
-	771, 772, 772, 771, 771, 771, 772, 772,
-	771, 772, 772, 772, 771, 772, 772, 772,
-	772, 771, 772, 772, 772, 771, 772, 772,
-	771, 867, 868, 853, 771, 772, 771, 772,
-	772, 771, 869, 870, 871, 872, 873, 874,
-	875, 771, 876, 877, 878, 879, 880, 881,
-	882, 883, 771, 772, 771, 772, 771, 772,
-	771, 772, 772, 772, 772, 772, 771, 772,
-	771, 772, 771, 772, 771, 772, 771, 884,
-	885, 886, 887, 888, 889, 890, 891, 892,
-	893, 894, 895, 896, 814, 897, 898, 899,
-	814, 815, 900, 901, 902, 903, 904, 905,
-	906, 907, 908, 909, 910, 911, 912, 913,
-	914, 771, 772, 772, 771, 771, 772, 771,
-	771, 772, 772, 772, 771, 772, 772, 771,
-	772, 772, 771, 771, 771, 771, 772, 772,
-	772, 771, 772, 771, 772, 772, 772, 771,
-	772, 772, 772, 772, 772, 772, 772, 771,
-	772, 771, 772, 772, 771, 771, 772, 772,
-	772, 771, 771, 771, 772, 772, 771, 772,
-	771, 772, 771, 772, 772, 772, 771, 772,
-	772, 771, 772, 772, 772, 771, 772, 772,
-	772, 771, 772, 772, 771, 772, 771, 772,
-	772, 771, 772, 772, 771, 772, 772, 772,
-	772, 771, 771, 771, 772, 772, 772, 772,
-	771, 772, 771, 915, 916, 917, 918, 919,
-	771, 772, 771, 772, 771, 772, 772, 771,
-	771, 771, 772, 772, 772, 771, 920, 771,
-	772, 771, 921, 922, 923, 924, 925, 926,
-	771, 772, 772, 772, 771, 771, 771, 771,
-	772, 772, 771, 772, 772, 771, 771, 771,
-	772, 772, 772, 772, 771, 927, 916, 928,
-	929, 930, 771, 772, 772, 772, 772, 772,
-	771, 772, 771, 772, 771, 772, 771, 931,
-	932, 933, 934, 935, 936, 937, 938, 932,
-	931, 932, 931, 932, 840, 931, 939, 940,
-	932, 931, 941, 942, 943, 944, 945, 946,
-	932, 947, 948, 931, 932, 931, 939, 842,
-	840, 840, 842, 771, 771, 772, 772, 772,
-	771, 772, 772, 771, 772, 772, 772, 771,
-	771, 772, 772, 772, 772, 772, 772, 771,
-	772, 771, 771, 772, 772, 771, 771, 772,
-	772, 771, 772, 771, 772, 771, 772, 772,
-	771, 772, 772, 771, 772, 772, 771, 772,
-	772, 771, 949, 771, 950, 932, 931, 951,
-	842, 771, 772, 771, 952, 850, 771, 772,
-	771, 869, 870, 871, 872, 873, 874, 953,
-	771, 954, 771, 772, 771, 801, 802, 803,
-	765, 766, 955, 804, 805, 806, 807, 808,
-	809, 810, 811, 812, 813, 814, 815, 816,
-	817, 818, 819, 820, 821, 822, 771, 956,
-	770, 801, 802, 803, 957, 767, 768, 804,
-	805, 806, 807, 808, 809, 810, 811, 812,
-	813, 814, 815, 816, 817, 818, 819, 820,
-	821, 822, 771, 956, 771, 958, 956, 801,
-	802, 803, 959, 768, 804, 805, 806, 807,
-	808, 809, 810, 811, 812, 813, 814, 815,
-	816, 817, 818, 819, 820, 821, 822, 771,
-	958, 771, 149, 958, 960, 771, 958, 771,
-	961, 962, 771, 956, 771, 771, 958, 771,
-	956, 771, 956, 852, 853, 854, 855, 856,
-	857, 858, 963, 860, 861, 862, 863, 864,
-	865, 866, 965, 966, 967, 968, 969, 970,
-	965, 966, 967, 968, 969, 970, 965, 964,
-	971, 771, 772, 770, 771, 972, 972, 972,
-	958, 771, 801, 802, 803, 957, 955, 804,
-	805, 806, 807, 808, 809, 810, 811, 812,
-	813, 814, 815, 816, 817, 818, 819, 820,
-	821, 822, 771, 961, 973, 771, 771, 956,
-	972, 972, 958, 972, 972, 958, 972, 972,
-	972, 958, 972, 972, 958, 972, 972, 958,
-	972, 972, 771, 958, 958, 967, 968, 969,
-	970, 964, 965, 967, 968, 969, 970, 964,
-	965, 967, 968, 969, 970, 964, 965, 967,
-	968, 969, 970, 964, 965, 967, 968, 969,
-	970, 964, 965, 967, 968, 969, 970, 964,
-	965, 967, 968, 969, 970, 964, 965, 967,
-	968, 969, 970, 964, 965, 967, 968, 969,
-	970, 964, 965, 966, 971, 968, 969, 970,
-	964, 965, 966, 968, 969, 970, 964, 965,
-	966, 968, 969, 970, 964, 965, 966, 968,
-	969, 970, 964, 965, 966, 968, 969, 970,
-	964, 965, 966, 968, 969, 970, 964, 965,
-	966, 968, 969, 970, 964, 965, 966, 968,
-	969, 970, 964, 965, 966, 968, 969, 970,
-	964, 965, 966, 967, 971, 969, 970, 964,
-	965, 966, 967, 969, 970, 964, 965, 966,
-	967, 969, 970, 964, 965, 966, 967, 969,
-	970, 964, 965, 966, 967, 969, 974, 973,
-	968, 771, 971, 972, 771, 956, 958, 147,
-	3, 1, 975, 976, 977, 978, 979, 980,
-	981, 982, 983, 984, 985, 218, 986, 220,
-	987, 988, 989, 990, 991, 992, 762, 1,
-	147, 993, 148, 3, 147, 3, 147, 3,
-	1, 993, 994, 994, 993, 993, 994, 993,
-	993, 994, 993, 993, 993, 994, 993, 994,
-	993, 993, 994, 993, 993, 993, 993, 994,
-	993, 993, 994, 994, 993, 993, 994, 993,
-	993, 994, 995, 996, 997, 998, 999, 1001,
-	1002, 1003, 1005, 1006, 1007, 1008, 1009, 1010,
-	1011, 1012, 1013, 1014, 1015, 1016, 1017, 1018,
-	1019, 1020, 1021, 1022, 1000, 1004, 994, 993,
-	993, 993, 993, 994, 993, 994, 993, 993,
-	994, 994, 994, 993, 994, 994, 994, 993,
-	993, 993, 993, 994, 994, 994, 994, 994,
-	994, 994, 993, 994, 994, 994, 994, 994,
-	994, 993, 994, 994, 994, 994, 994, 993,
-	993, 993, 993, 994, 993, 993, 993, 993,
-	993, 994, 993, 993, 994, 993, 993, 993,
-	993, 994, 993, 993, 994, 994, 994, 994,
-	994, 994, 993, 993, 993, 993, 993, 993,
-	994, 993, 993, 993, 994, 994, 994, 994,
-	994, 994, 993, 993, 994, 993, 993, 993,
-	993, 993, 994, 993, 993, 994, 993, 994,
-	993, 993, 994, 993, 994, 993, 993, 993,
-	993, 993, 994, 993, 994, 993, 993, 993,
-	993, 994, 993, 994, 1023, 1024, 1025, 1026,
-	1027, 1028, 1029, 1030, 1031, 1032, 1033, 1034,
-	1035, 1036, 1037, 1038, 1039, 1040, 1041, 1042,
-	1043, 1044, 994, 993, 993, 994, 993, 993,
-	993, 994, 993, 993, 993, 993, 994, 993,
-	994, 993, 993, 994, 993, 993, 994, 993,
-	994, 994, 994, 993, 993, 994, 993, 993,
-	994, 993, 993, 994, 993, 994, 993, 993,
-	993, 993, 993, 994, 993, 994, 994, 993,
-	993, 993, 994, 994, 994, 993, 993, 993,
-	994, 993, 994, 993, 994, 993, 993, 993,
-	993, 993, 994, 993, 993, 994, 1045, 1046,
-	1047, 1048, 1049, 994, 993, 994, 993, 994,
-	993, 994, 993, 994, 993, 994, 1050, 1051,
-	994, 993, 994, 993, 994, 1052, 1053, 1054,
-	1055, 1056, 1057, 1058, 1059, 1060, 1061, 1062,
-	1063, 1064, 1065, 1066, 994, 993, 993, 994,
-	993, 994, 993, 994, 993, 993, 993, 993,
-	993, 994, 993, 993, 994, 994, 994, 994,
-	993, 993, 994, 993, 994, 993, 993, 994,
-	994, 994, 993, 993, 994, 993, 993, 993,
-	994, 993, 993, 993, 993, 994, 993, 993,
-	993, 994, 993, 993, 994, 1067, 1068, 1053,
-	994, 993, 994, 993, 993, 994, 1069, 1070,
-	1071, 1072, 1073, 1074, 1075, 994, 1076, 1077,
-	1078, 1079, 1080, 1081, 1082, 1083, 994, 993,
-	994, 993, 994, 993, 994, 993, 993, 993,
-	993, 993, 994, 993, 994, 993, 994, 993,
-	994, 993, 994, 1084, 1085, 1086, 1087, 1088,
-	1089, 1090, 1091, 1092, 1093, 1094, 1095, 1096,
-	1036, 1097, 1098, 1099, 1036, 1037, 1100, 1101,
-	1102, 1103, 1104, 1105, 1106, 1107, 1108, 1109,
-	1110, 1111, 1112, 1113, 1114, 994, 993, 993,
-	994, 994, 993, 994, 994, 993, 993, 993,
-	994, 993, 993, 994, 993, 993, 994, 994,
-	994, 994, 993, 993, 993, 994, 993, 994,
-	993, 993, 993, 994, 993, 993, 993, 993,
-	993, 993, 993, 994, 993, 994, 993, 993,
-	994, 994, 993, 993, 993, 994, 994, 994,
-	993, 993, 994, 993, 994, 993, 994, 993,
-	993, 993, 994, 993, 993, 994, 993, 993,
-	993, 994, 993, 993, 993, 994, 993, 993,
-	994, 993, 994, 993, 993, 994, 993, 993,
-	994, 993, 993, 993, 993, 994, 994, 994,
-	993, 993, 993, 993, 994, 993, 994, 1115,
-	1116, 1117, 1118, 1119, 994, 993, 994, 993,
-	994, 993, 993, 994, 994, 994, 993, 993,
-	993, 994, 1120, 994, 993, 994, 1121, 1122,
-	1123, 1124, 1125, 1126, 994, 993, 993, 993,
-	994, 994, 994, 994, 993, 993, 994, 993,
-	993, 994, 994, 994, 993, 993, 993, 993,
-	994, 1127, 1116, 1128, 1129, 1130, 994, 993,
-	993, 993, 993, 993, 994, 993, 994, 993,
-	994, 993, 994, 1131, 994, 993, 994, 1132,
-	994, 1133, 1134, 1135, 1137, 1136, 994, 993,
-	994, 994, 993, 993, 148, 3, 147, 3,
-	1, 148, 148, 3, 1, 3, 148, 3,
-	148, 3, 1, 148, 3, 148, 3, 1,
-	148, 3, 1, 148, 3, 148, 3, 148,
-	3, 1, 148, 3, 1, 148, 3, 148,
-	3, 1, 148, 3, 3, 148, 1, 3,
-	3, 148, 1, 148, 3, 148, 1, 3,
-	3, 3, 3, 3, 3, 3, 3, 1,
-	148, 148, 148, 148, 148, 3, 3, 148,
-	3, 148, 3, 1, 148, 148, 148, 3,
-	148, 3, 1, 3, 148, 3, 1, 3,
-	148, 3, 148, 3, 1, 148, 148, 3,
-	1, 1138, 1139, 762, 1, 148, 148, 3,
-	1, 148, 148, 3, 1, 762, 1, 1140,
-	1142, 1143, 1144, 1145, 1146, 1147, 1142, 1143,
-	1144, 1145, 1146, 1147, 1142, 762, 1141, 971,
-	1, 3, 770, 3, 1, 956, 956, 956,
-	958, 1, 956, 956, 958, 956, 956, 958,
-	956, 956, 956, 958, 956, 956, 958, 956,
-	956, 958, 956, 956, 1, 958, 1144, 1145,
-	1146, 1147, 1141, 1142, 1144, 1145, 1146, 1147,
-	1141, 1142, 1144, 1145, 1146, 1147, 1141, 1142,
-	1144, 1145, 1146, 1147, 1141, 1142, 1144, 1145,
-	1146, 1147, 1141, 1142, 1144, 1145, 1146, 1147,
-	1141, 1142, 1144, 1145, 1146, 1147, 1141, 1142,
-	1144, 1145, 1146, 1147, 1141, 1142, 1144, 1145,
-	1146, 1147, 1141, 1142, 1143, 971, 1145, 1146,
-	1147, 1141, 1142, 1143, 1145, 1146, 1147, 1141,
-	1142, 1143, 1145, 1146, 1147, 1141, 1142, 1143,
-	1145, 1146, 1147, 1141, 1142, 1143, 1145, 1146,
-	1147, 1141, 1142, 1143, 1145, 1146, 1147, 1141,
-	1142, 1143, 1145, 1146, 1147, 1141, 1142, 1143,
-	1145, 1146, 1147, 1141, 1142, 1143, 1145, 1146,
-	1147, 1141, 1142, 1143, 1144, 971, 1146, 1147,
-	1141, 1142, 1143, 1144, 1146, 1147, 1141, 1142,
-	1143, 1144, 1146, 1147, 1141, 1142, 1143, 1144,
-	1146, 1147, 1141, 1142, 1143, 1144, 1146, 1148,
-	1149, 1145, 762, 1, 971, 956, 3, 956,
-	958, 3, 958, 3, 1, 956, 1150, 1151,
-	762, 1, 147, 3, 1, 3, 3, 147,
-	3, 1, 1153, 1154, 1155, 1156, 1157, 1152,
-	1, 1158, 1159, 1160, 1161, 1162, 1163, 1164,
-	1165, 762, 1, 333, 3, 1, 333, 3,
-	1, 3, 333, 3, 1, 333, 3, 1,
-	333, 3, 1, 333, 3, 1, 3, 333,
-	3, 1, 333, 3, 1, 1166, 762, 1,
-	3, 147, 3, 1, 1167, 762, 1, 3,
-	147, 3, 1, 1168, 762, 1, 3, 147,
-	3, 1, 309, 310, 1169, 1170, 1171, 1172,
-	1173, 1174, 310, 309, 310, 309, 1175, 218,
-	309, 1176, 1177, 310, 309, 1178, 762, 1179,
-	762, 1180, 1181, 1182, 1183, 310, 1184, 1185,
-	309, 310, 309, 1176, 220, 218, 762, 220,
-	1, 148, 3, 148, 3, 1, 3, 148,
-	3, 148, 1, 148, 3, 148, 3, 148,
-	1, 1186, 1, 148, 1188, 1187, 1187, 1188,
-	1188, 1187, 1188, 1188, 1187, 1188, 1188, 1188,
-	1187, 1188, 1187, 1188, 1188, 1187, 1188, 1188,
-	1188, 1188, 1187, 1188, 1188, 1187, 1187, 1188,
-	1188, 1187, 1188, 1188, 1187, 1189, 1190, 1191,
-	1192, 1193, 1195, 1196, 1197, 1199, 1200, 1201,
-	1202, 1203, 1204, 1205, 1206, 1207, 1208, 1209,
-	1210, 1211, 1212, 1213, 1214, 1215, 1216, 1194,
-	1198, 1187, 1188, 1188, 1188, 1188, 1187, 1188,
-	1187, 1188, 1188, 1187, 1187, 1187, 1188, 1187,
-	1187, 1187, 1188, 1188, 1188, 1188, 1187, 1187,
-	1187, 1187, 1187, 1187, 1187, 1188, 1187, 1187,
-	1187, 1187, 1187, 1187, 1188, 1187, 1187, 1187,
-	1187, 1187, 1188, 1188, 1188, 1188, 1187, 1188,
-	1188, 1188, 1188, 1188, 1187, 1188, 1188, 1187,
-	1188, 1188, 1188, 1188, 1187, 1188, 1188, 1187,
-	1187, 1187, 1187, 1187, 1187, 1188, 1188, 1188,
-	1188, 1188, 1188, 1187, 1188, 1188, 1188, 1187,
-	1187, 1187, 1187, 1187, 1187, 1188, 1188, 1187,
-	1188, 1188, 1188, 1188, 1188, 1187, 1188, 1188,
-	1187, 1188, 1187, 1188, 1188, 1187, 1188, 1187,
-	1188, 1188, 1188, 1188, 1188, 1187, 1188, 1187,
-	1188, 1188, 1188, 1188, 1187, 1188, 1187, 1217,
-	1218, 1219, 1220, 1221, 1222, 1223, 1224, 1225,
-	1226, 1227, 1228, 1229, 1230, 1231, 1232, 1233,
-	1234, 1235, 1236, 1237, 1238, 1187, 1188, 1188,
-	1187, 1188, 1188, 1188, 1187, 1188, 1188, 1188,
-	1188, 1187, 1188, 1187, 1188, 1188, 1187, 1188,
-	1188, 1187, 1188, 1187, 1187, 1187, 1188, 1188,
-	1187, 1188, 1188, 1187, 1188, 1188, 1187, 1188,
-	1187, 1188, 1188, 1188, 1188, 1188, 1187, 1188,
-	1187, 1187, 1188, 1188, 1188, 1187, 1187, 1187,
-	1188, 1188, 1188, 1187, 1188, 1187, 1188, 1187,
-	1188, 1188, 1188, 1188, 1188, 1187, 1188, 1188,
-	1187, 1239, 1240, 1241, 1242, 1243, 1187, 1188,
-	1244, 1187, 1188, 1188, 1187, 1245, 1246, 1240,
-	1247, 1248, 1249, 1250, 1251, 1252, 1253, 1254,
-	1255, 1256, 1257, 1258, 1259, 1260, 1261, 1262,
-	1263, 1264, 1241, 1242, 1243, 1187, 1188, 1244,
-	1188, 1187, 1188, 1187, 1188, 1187, 1188, 1188,
-	1187, 1188, 1188, 1187, 1188, 1188, 1187, 1188,
-	1187, 1188, 1188, 1188, 1187, 1188, 1187, 1188,
-	1188, 1187, 1188, 1188, 1187, 1188, 1188, 1188,
-	1187, 1188, 1187, 1188, 1188, 1187, 1188, 1187,
-	1187, 1187, 1187, 1187, 1187, 1187, 1187, 1188,
-	1188, 1188, 1188, 1188, 1188, 1188, 1188, 1187,
-	1188, 1188, 1188, 1188, 1187, 1188, 1187, 1188,
-	1188, 1187, 1188, 1188, 1187, 1188, 1187, 1188,
-	1187, 1188, 1187, 1265, 1266, 1267, 1187, 1188,
-	1188, 1187, 1188, 1187, 1188, 1188, 1187, 1268,
-	1269, 1270, 1271, 1272, 1273, 1274, 1275, 1276,
-	1277, 1278, 1279, 1280, 1281, 1282, 1187, 1188,
-	1188, 1187, 1188, 1187, 1188, 1187, 1188, 1188,
-	1188, 1188, 1188, 1187, 1188, 1188, 1187, 1187,
-	1187, 1187, 1188, 1188, 1187, 1188, 1187, 1188,
-	1188, 1187, 1187, 1187, 1188, 1188, 1187, 1188,
-	1188, 1188, 1187, 1188, 1188, 1188, 1188, 1187,
-	1188, 1188, 1188, 1187, 1188, 1188, 1187, 1283,
-	1284, 1269, 1187, 1188, 1187, 1188, 1188, 1187,
-	1285, 1286, 1287, 1288, 1289, 1290, 1291, 1187,
-	1292, 1293, 1294, 1295, 1296, 1297, 1298, 1299,
-	1187, 1188, 1187, 1188, 1187, 1188, 1187, 1188,
-	1188, 1188, 1188, 1188, 1187, 1188, 1187, 1188,
-	1187, 1188, 1187, 1188, 1187, 1300, 1301, 1302,
-	1303, 1304, 1305, 1306, 1307, 1308, 1309, 1310,
-	1311, 1312, 1230, 1313, 1314, 1315, 1230, 1231,
-	1316, 1317, 1318, 1319, 1320, 1321, 1322, 1323,
-	1324, 1325, 1326, 1327, 1328, 1329, 1330, 1187,
-	1188, 1188, 1187, 1187, 1188, 1187, 1187, 1188,
-	1188, 1188, 1187, 1188, 1188, 1187, 1188, 1188,
-	1187, 1187, 1187, 1187, 1188, 1188, 1188, 1187,
-	1188, 1187, 1188, 1188, 1188, 1187, 1188, 1188,
-	1188, 1188, 1188, 1188, 1188, 1187, 1188, 1187,
-	1188, 1188, 1187, 1187, 1188, 1188, 1188, 1187,
-	1187, 1187, 1188, 1188, 1187, 1188, 1187, 1188,
-	1187, 1188, 1188, 1188, 1187, 1188, 1188, 1187,
-	1188, 1188, 1188, 1187, 1188, 1188, 1188, 1187,
-	1188, 1188, 1187, 1188, 1187, 1188, 1188, 1187,
-	1188, 1188, 1187, 1188, 1188, 1188, 1188, 1187,
-	1187, 1187, 1188, 1188, 1188, 1188, 1187, 1188,
-	1187, 1331, 1332, 1333, 1334, 1335, 1187, 1188,
-	1187, 1188, 1187, 1188, 1188, 1187, 1187, 1187,
-	1188, 1188, 1188, 1187, 1336, 1187, 1188, 1187,
-	1337, 1338, 1339, 1340, 1341, 1342, 1187, 1188,
-	1188, 1188, 1187, 1187, 1187, 1187, 1188, 1188,
-	1187, 1188, 1188, 1187, 1187, 1187, 1188, 1188,
-	1188, 1188, 1187, 1343, 1332, 1344, 1345, 1346,
-	1187, 1188, 1188, 1188, 1188, 1188, 1187, 1188,
-	1187, 1188, 1187, 1188, 1187, 1347, 1348, 1349,
-	1350, 1351, 1352, 1353, 1354, 1348, 1347, 1348,
-	1347, 1348, 1256, 1347, 1355, 1356, 1348, 1347,
-	1357, 1358, 1359, 1360, 1361, 1362, 1348, 1363,
-	1364, 1347, 1348, 1347, 1355, 1258, 1256, 1256,
-	1258, 1187, 1187, 1188, 1188, 1188, 1187, 1188,
-	1188, 1187, 1188, 1188, 1188, 1187, 1187, 1188,
-	1188, 1188, 1188, 1188, 1188, 1187, 1188, 1187,
-	1187, 1188, 1188, 1187, 1187, 1188, 1188, 1187,
-	1188, 1187, 1188, 1187, 1188, 1188, 1187, 1188,
-	1188, 1187, 1188, 1188, 1187, 1188, 1188, 1187,
-	1365, 1187, 1366, 1348, 1347, 1367, 1258, 1187,
-	1188, 1187, 1368, 1266, 1187, 1188, 1187, 1285,
-	1286, 1287, 1288, 1289, 1290, 1369, 1187, 1370,
-	1187, 1188, 1187, 1285, 1286, 1287, 1288, 1289,
-	1290, 1371, 1187, 1372, 1370, 1187, 1188, 1187,
-	3, 148, 148, 3, 148, 3, 148, 1,
-	3, 148, 1, 3, 1, 148, 3, 1,
-	148, 3, 148, 1, 3, 1, 148, 3,
-	148, 1, 3, 148, 1, 3, 148, 3,
-	1, 3, 148, 3, 148, 3, 1, 3,
-	148, 3, 148, 1, 3, 3, 148, 1,
-	3, 148, 1, 1152, 1, 1373, 1152, 1,
-	1374, 1375, 1376, 1377, 1376, 762, 1378, 1,
-	147, 3, 1, 1, 147, 1, 147, 3,
-	147, 1, 147, 1, 1380, 1379, 1383, 1384,
-	1385, 1386, 1387, 1388, 1389, 1390, 1392, 1393,
-	1394, 1395, 1396, 1397, 1399, 1379, 1, 1382,
-	1391, 1398, 1, 1381, 144, 146, 1401, 1402,
-	1403, 1404, 1405, 1406, 1407, 1408, 1409, 1410,
-	1411, 1412, 1413, 1414, 1415, 1416, 1417, 1418,
-	1400, 309, 329, 1420, 1421, 1422, 1423, 1424,
-	1425, 1426, 1427, 1428, 1429, 1430, 1431, 1432,
-	1433, 1434, 1435, 1436, 1437, 1419, 1438, 309,
-	329, 1420, 1421, 1422, 1423, 1424, 1425, 1426,
-	1427, 1428, 1429, 1430, 1431, 1439, 1440, 1434,
-	1435, 1441, 1437, 1419, 1443, 1444, 1445, 1446,
-	1447, 1448, 1449, 1450, 1451, 1452, 1453, 1454,
-	1455, 1456, 1458, 335, 662, 723, 1457, 1442,
-	476, 478, 1459, 1460, 1461, 1462, 1463, 1464,
-	1465, 1466, 1467, 1468, 1469, 1470, 1471, 1472,
-	1473, 1474, 1475, 1476, 1442, 638, 658, 1477,
-	1478, 1479, 1480, 1481, 1482, 1483, 1484, 1485,
-	1486, 1487, 1488, 1489, 1490, 1491, 1492, 1493,
-	1494, 1442, 1495, 638, 658, 1477, 1478, 1479,
-	1480, 1481, 1482, 1483, 1484, 1485, 1486, 1487,
-	1488, 1496, 1497, 1491, 1492, 1498, 1494, 1442,
-	638, 658, 1477, 1478, 1479, 1480, 1481, 1482,
-	1483, 1484, 1485, 1486, 1487, 1499, 1489, 1490,
-	1500, 1501, 1502, 1503, 1492, 1493, 1494, 1442,
-	638, 658, 1477, 1478, 1479, 1480, 1481, 1482,
-	1483, 1484, 1485, 1486, 1487, 1504, 1489, 1490,
-	1491, 1505, 1492, 1493, 1494, 1442, 638, 658,
-	1477, 1478, 1479, 1480, 1481, 1482, 1483, 1484,
-	1485, 1486, 1487, 1506, 1489, 1490, 1491, 1507,
-	1492, 1493, 1494, 1442, 638, 658, 1477, 1478,
-	1479, 1480, 1481, 1482, 1483, 1484, 1485, 1486,
-	1487, 1508, 1489, 1490, 1491, 1509, 1492, 1493,
-	1494, 1442, 638, 658, 1477, 1478, 1479, 1480,
-	1481, 1482, 1483, 1484, 1485, 1486, 1487, 1488,
-	1489, 1490, 1491, 1492, 1510, 1494, 1442, 931,
-	951, 1512, 1513, 1514, 1515, 1516, 1517, 1518,
-	1519, 1520, 1521, 1522, 1523, 1524, 1525, 1526,
-	1527, 1528, 1529, 1530, 1531, 1532, 1511, 931,
-	951, 1512, 1513, 1514, 1515, 1516, 1517, 1518,
-	1519, 1520, 1521, 1522, 1533, 1524, 1525, 1534,
-	1530, 1531, 1532, 1511, 1535, 931, 951, 1512,
-	1513, 1514, 1515, 1516, 1517, 1518, 1519, 1520,
-	1521, 1522, 1533, 1536, 1537, 1534, 1530, 1538,
-	1532, 1511, 931, 951, 1512, 1513, 1514, 1515,
-	1516, 1517, 1518, 1519, 1520, 1521, 1522, 1539,
-	1524, 1525, 1534, 1540, 1530, 1531, 1532, 1511,
-	931, 951, 1512, 1513, 1514, 1515, 1516, 1517,
-	1518, 1519, 1520, 1521, 1522, 1541, 1524, 1525,
-	1534, 1542, 1530, 1531, 1532, 1511, 931, 951,
-	1512, 1513, 1514, 1515, 1516, 1517, 1518, 1519,
-	1520, 1521, 1522, 1543, 1524, 1525, 1534, 1544,
-	1530, 1531, 1532, 1511, 1135, 1137, 1546, 1547,
-	1548, 1549, 1550, 1551, 1552, 1553, 1554, 1555,
-	1556, 1557, 1558, 1559, 1560, 1561, 1562, 1563,
-	1545, 1347, 1367, 1565, 1566, 1567, 1568, 1569,
-	1570, 1571, 1572, 1573, 1574, 1575, 1576, 1577,
-	1578, 1579, 1580, 1581, 1582, 1564, 1347, 1367,
-	1565, 1566, 1567, 1568, 1569, 1570, 1571, 1572,
-	1573, 1574, 1575, 1576, 1577, 1578, 1579, 1580,
-	1583, 1582, 1564, 1584, 1347, 1367, 1565, 1566,
-	1567, 1568, 1569, 1570, 1571, 1572, 1573, 1574,
-	1575, 1576, 1585, 1586, 1579, 1580, 1587, 1582,
-	1564,
-}
-
-var _graphclust_trans_targs []int16 = []int16{
-	1547, 0, 1547, 1548, 15, 16, 17, 18,
-	19, 20, 21, 22, 23, 24, 25, 26,
-	27, 28, 29, 30, 31, 32, 33, 34,
-	35, 36, 37, 38, 39, 40, 41, 42,
-	44, 45, 46, 47, 48, 49, 50, 51,
-	52, 53, 54, 55, 56, 57, 58, 59,
-	60, 61, 62, 63, 64, 65, 67, 68,
-	69, 70, 71, 73, 74, 76, 77, 78,
-	79, 80, 81, 82, 83, 84, 85, 86,
-	87, 88, 89, 90, 92, 93, 95, 104,
-	136, 142, 144, 151, 156, 96, 97, 98,
-	99, 100, 101, 102, 103, 105, 106, 107,
-	108, 109, 110, 111, 112, 113, 114, 115,
-	116, 117, 118, 119, 120, 121, 122, 123,
-	124, 125, 126, 127, 128, 129, 130, 131,
-	132, 133, 134, 135, 137, 138, 139, 140,
-	141, 143, 145, 146, 147, 148, 149, 150,
-	152, 153, 154, 155, 157, 159, 160, 161,
-	2, 162, 3, 1547, 1549, 1547, 1547, 178,
-	179, 180, 181, 182, 183, 184, 185, 186,
-	187, 188, 189, 190, 191, 192, 193, 194,
-	195, 196, 197, 198, 199, 200, 201, 202,
-	203, 204, 205, 207, 208, 209, 210, 211,
-	212, 213, 214, 215, 216, 217, 218, 219,
-	220, 221, 222, 223, 224, 225, 226, 227,
-	228, 230, 235, 254, 255, 256, 1550, 233,
-	234, 236, 237, 238, 239, 240, 241, 242,
-	243, 244, 245, 246, 247, 248, 249, 250,
-	251, 252, 253, 258, 259, 260, 262, 263,
-	264, 265, 266, 267, 268, 269, 270, 271,
-	272, 273, 274, 275, 276, 278, 279, 281,
-	290, 322, 328, 330, 337, 342, 282, 283,
-	284, 285, 286, 287, 288, 289, 291, 292,
-	293, 294, 295, 296, 297, 298, 299, 300,
-	301, 302, 303, 304, 305, 306, 307, 308,
-	309, 310, 311, 312, 313, 314, 315, 316,
-	317, 318, 319, 320, 321, 323, 324, 325,
-	326, 327, 329, 331, 332, 333, 334, 335,
-	336, 338, 339, 340, 341, 165, 343, 344,
-	345, 346, 347, 348, 349, 350, 351, 352,
-	353, 354, 355, 356, 357, 358, 359, 361,
-	362, 166, 364, 366, 367, 1551, 1547, 1552,
-	382, 383, 384, 385, 386, 387, 388, 389,
-	390, 391, 392, 393, 394, 395, 396, 397,
-	398, 399, 400, 401, 402, 403, 404, 405,
-	406, 407, 408, 409, 411, 412, 413, 414,
-	415, 416, 417, 418, 419, 420, 421, 422,
-	423, 424, 425, 426, 427, 428, 429, 430,
-	431, 432, 434, 435, 436, 437, 438, 440,
-	441, 443, 444, 445, 446, 447, 448, 449,
-	450, 451, 452, 453, 454, 455, 456, 457,
-	459, 460, 462, 471, 503, 509, 511, 518,
-	523, 463, 464, 465, 466, 467, 468, 469,
-	470, 472, 473, 474, 475, 476, 477, 478,
-	479, 480, 481, 482, 483, 484, 485, 486,
-	487, 488, 489, 490, 491, 492, 493, 494,
-	495, 496, 497, 498, 499, 500, 501, 502,
-	504, 505, 506, 507, 508, 510, 512, 513,
-	514, 515, 516, 517, 519, 520, 521, 522,
-	524, 526, 527, 528, 369, 529, 370, 1553,
-	545, 546, 547, 548, 549, 550, 551, 552,
-	553, 554, 555, 556, 557, 558, 559, 560,
-	561, 562, 563, 564, 565, 566, 567, 568,
-	569, 570, 571, 572, 574, 575, 576, 577,
-	578, 579, 580, 581, 582, 583, 584, 585,
-	586, 587, 588, 589, 590, 591, 592, 593,
-	594, 595, 597, 602, 621, 622, 623, 1554,
-	600, 601, 603, 604, 605, 606, 607, 608,
-	609, 610, 611, 612, 613, 614, 615, 616,
-	617, 618, 619, 620, 625, 626, 627, 629,
-	630, 631, 632, 633, 634, 635, 636, 637,
-	638, 639, 640, 641, 642, 643, 645, 646,
-	648, 657, 689, 695, 697, 704, 709, 649,
-	650, 651, 652, 653, 654, 655, 656, 658,
-	659, 660, 661, 662, 663, 664, 665, 666,
-	667, 668, 669, 670, 671, 672, 673, 674,
-	675, 676, 677, 678, 679, 680, 681, 682,
-	683, 684, 685, 686, 687, 688, 690, 691,
-	692, 693, 694, 696, 698, 699, 700, 701,
-	702, 703, 705, 706, 707, 708, 532, 710,
-	711, 712, 713, 714, 715, 716, 717, 718,
-	719, 720, 721, 722, 723, 724, 725, 726,
-	728, 729, 533, 731, 733, 734, 530, 739,
-	740, 742, 744, 747, 750, 774, 1555, 756,
-	1556, 746, 1557, 749, 752, 754, 755, 758,
-	759, 763, 764, 765, 766, 767, 768, 769,
-	1558, 762, 773, 776, 777, 778, 779, 780,
-	781, 782, 783, 784, 785, 786, 787, 788,
-	789, 790, 791, 792, 793, 795, 796, 799,
-	800, 801, 802, 803, 804, 805, 806, 810,
-	811, 813, 814, 797, 816, 825, 827, 829,
-	831, 817, 818, 819, 820, 821, 822, 823,
-	824, 826, 828, 830, 832, 833, 834, 835,
-	839, 840, 841, 842, 843, 844, 845, 846,
-	847, 848, 849, 850, 851, 1559, 837, 838,
-	854, 855, 163, 859, 860, 862, 1067, 1070,
-	1073, 1097, 1560, 1547, 1561, 876, 877, 878,
-	879, 880, 881, 882, 883, 884, 885, 886,
-	887, 888, 889, 890, 891, 892, 893, 894,
-	895, 896, 897, 898, 899, 900, 901, 902,
-	903, 905, 906, 907, 908, 909, 910, 911,
-	912, 913, 914, 915, 916, 917, 918, 919,
-	920, 921, 922, 923, 924, 925, 926, 928,
-	933, 952, 953, 954, 1562, 931, 932, 934,
-	935, 936, 937, 938, 939, 940, 941, 942,
-	943, 944, 945, 946, 947, 948, 949, 950,
-	951, 956, 957, 958, 960, 961, 962, 963,
-	964, 965, 966, 967, 968, 969, 970, 971,
-	972, 973, 974, 976, 977, 979, 988, 1020,
-	1026, 1028, 1035, 1040, 980, 981, 982, 983,
-	984, 985, 986, 987, 989, 990, 991, 992,
-	993, 994, 995, 996, 997, 998, 999, 1000,
-	1001, 1002, 1003, 1004, 1005, 1006, 1007, 1008,
-	1009, 1010, 1011, 1012, 1013, 1014, 1015, 1016,
-	1017, 1018, 1019, 1021, 1022, 1023, 1024, 1025,
-	1027, 1029, 1030, 1031, 1032, 1033, 1034, 1036,
-	1037, 1038, 1039, 863, 1041, 1042, 1043, 1044,
-	1045, 1046, 1047, 1048, 1049, 1050, 1051, 1052,
-	1053, 1054, 1055, 1056, 1057, 1059, 1060, 864,
-	1062, 1064, 1065, 1079, 1563, 1069, 1564, 1072,
-	1075, 1077, 1078, 1081, 1082, 1086, 1087, 1088,
-	1089, 1090, 1091, 1092, 1565, 1085, 1096, 1099,
-	1261, 1262, 1263, 1264, 1265, 1266, 1267, 1268,
-	1269, 1270, 1271, 1272, 1273, 1274, 1275, 1276,
-	1277, 1566, 1547, 1113, 1114, 1115, 1116, 1117,
-	1118, 1119, 1120, 1121, 1122, 1123, 1124, 1125,
-	1126, 1127, 1128, 1129, 1130, 1131, 1132, 1133,
-	1134, 1135, 1136, 1137, 1138, 1139, 1140, 1142,
-	1143, 1144, 1145, 1146, 1147, 1148, 1149, 1150,
-	1151, 1152, 1153, 1154, 1155, 1156, 1157, 1158,
-	1159, 1160, 1161, 1162, 1163, 1165, 1166, 1167,
-	1168, 1169, 1171, 1172, 1174, 1175, 1176, 1177,
-	1178, 1179, 1180, 1181, 1182, 1183, 1184, 1185,
-	1186, 1187, 1188, 1190, 1191, 1193, 1202, 1234,
-	1240, 1242, 1249, 1254, 1194, 1195, 1196, 1197,
-	1198, 1199, 1200, 1201, 1203, 1204, 1205, 1206,
-	1207, 1208, 1209, 1210, 1211, 1212, 1213, 1214,
-	1215, 1216, 1217, 1218, 1219, 1220, 1221, 1222,
-	1223, 1224, 1225, 1226, 1227, 1228, 1229, 1230,
-	1231, 1232, 1233, 1235, 1236, 1237, 1238, 1239,
-	1241, 1243, 1244, 1245, 1246, 1247, 1248, 1250,
-	1251, 1252, 1253, 1255, 1257, 1258, 1259, 1100,
-	1260, 1101, 1279, 1280, 1283, 1284, 1285, 1286,
-	1287, 1288, 1289, 1290, 1294, 1295, 1297, 1298,
-	1281, 1300, 1309, 1311, 1313, 1315, 1301, 1302,
-	1303, 1304, 1305, 1306, 1307, 1308, 1310, 1312,
-	1314, 1316, 1317, 1318, 1319, 1526, 1527, 1528,
-	1529, 1530, 1531, 1532, 1533, 1534, 1535, 1536,
-	1537, 1538, 1567, 1547, 1568, 1333, 1334, 1335,
-	1336, 1337, 1338, 1339, 1340, 1341, 1342, 1343,
-	1344, 1345, 1346, 1347, 1348, 1349, 1350, 1351,
-	1352, 1353, 1354, 1355, 1356, 1357, 1358, 1359,
-	1360, 1362, 1363, 1364, 1365, 1366, 1367, 1368,
-	1369, 1370, 1371, 1372, 1373, 1374, 1375, 1376,
-	1377, 1378, 1379, 1380, 1381, 1382, 1383, 1385,
-	1390, 1409, 1410, 1411, 1569, 1388, 1389, 1391,
-	1392, 1393, 1394, 1395, 1396, 1397, 1398, 1399,
-	1400, 1401, 1402, 1403, 1404, 1405, 1406, 1407,
-	1408, 1413, 1414, 1415, 1417, 1418, 1419, 1420,
-	1421, 1422, 1423, 1424, 1425, 1426, 1427, 1428,
-	1429, 1430, 1431, 1433, 1434, 1436, 1445, 1477,
-	1483, 1485, 1492, 1497, 1437, 1438, 1439, 1440,
-	1441, 1442, 1443, 1444, 1446, 1447, 1448, 1449,
-	1450, 1451, 1452, 1453, 1454, 1455, 1456, 1457,
-	1458, 1459, 1460, 1461, 1462, 1463, 1464, 1465,
-	1466, 1467, 1468, 1469, 1470, 1471, 1472, 1473,
-	1474, 1475, 1476, 1478, 1479, 1480, 1481, 1482,
-	1484, 1486, 1487, 1488, 1489, 1490, 1491, 1493,
-	1494, 1495, 1496, 1320, 1498, 1499, 1500, 1501,
-	1502, 1503, 1504, 1505, 1506, 1507, 1508, 1509,
-	1510, 1511, 1512, 1513, 1514, 1516, 1517, 1321,
-	1519, 1521, 1522, 1524, 1525, 1541, 1542, 1543,
-	1544, 1545, 1546, 1547, 1, 1548, 163, 164,
-	368, 856, 857, 858, 861, 1098, 1278, 1281,
-	1282, 1291, 1292, 1293, 1296, 1299, 1539, 1540,
-	1547, 4, 5, 6, 7, 8, 9, 10,
-	11, 12, 13, 14, 43, 66, 72, 75,
-	91, 94, 158, 1547, 167, 168, 169, 170,
-	171, 172, 173, 174, 175, 176, 177, 206,
-	229, 363, 261, 277, 365, 360, 231, 232,
-	257, 280, 1547, 531, 735, 736, 737, 738,
-	741, 775, 794, 798, 807, 808, 809, 812,
-	815, 852, 853, 371, 372, 373, 374, 375,
-	376, 377, 378, 379, 380, 381, 410, 433,
-	439, 442, 458, 461, 525, 534, 535, 536,
-	537, 538, 539, 540, 541, 542, 543, 544,
-	573, 596, 730, 628, 644, 732, 727, 598,
-	599, 624, 647, 743, 757, 770, 771, 772,
-	745, 753, 748, 751, 760, 761, 836, 1547,
-	865, 866, 867, 868, 869, 870, 871, 872,
-	873, 874, 875, 1066, 927, 1061, 1080, 1093,
-	1094, 1095, 975, 1063, 1058, 904, 959, 929,
-	930, 955, 978, 1068, 1076, 1071, 1074, 1083,
-	1084, 1547, 1102, 1103, 1104, 1105, 1106, 1107,
-	1108, 1109, 1110, 1111, 1112, 1141, 1164, 1170,
-	1173, 1189, 1192, 1256, 1547, 1322, 1323, 1324,
-	1325, 1326, 1327, 1328, 1329, 1330, 1331, 1332,
-	1361, 1384, 1518, 1416, 1432, 1523, 1515, 1520,
-	1386, 1387, 1412, 1435,
-}
-
-var _graphclust_trans_actions []byte = []byte{
-	31, 0, 27, 40, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 34, 55, 29, 19, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 55, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 40, 25, 40,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 40,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 40,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 40, 0,
-	40, 0, 40, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	40, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 40, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 51, 17, 40, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 40, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 51, 0, 51, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 40, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 40, 21, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 40, 23, 40, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 40, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 43, 1, 47, 1, 1,
-	1, 1, 1, 1, 1, 1, 1, 1,
-	1, 1, 1, 1, 1, 1, 1, 1,
-	15, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 7, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 13, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 5,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 9, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 11, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0,
-}
-
-var _graphclust_to_state_actions []byte = []byte{
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 37, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0,
-}
-
-var _graphclust_from_state_actions []byte = []byte{
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 3, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0,
-}
-
-var _graphclust_eof_trans []int16 = []int16{
-	0, 0, 3, 3, 3, 3, 3, 3,
-	3, 3, 3, 3, 3, 3, 3, 3,
-	3, 3, 3, 3, 3, 3, 3, 3,
-	3, 3, 3, 3, 3, 3, 3, 3,
-	3, 3, 3, 3, 3, 3, 3, 3,
-	3, 3, 3, 3, 3, 3, 3, 3,
-	3, 3, 3, 3, 3, 3, 3, 3,
-	3, 3, 3, 3, 3, 3, 3, 3,
-	3, 3, 3, 3, 3, 3, 3, 3,
-	3, 3, 3, 3, 3, 3, 3, 3,
-	3, 3, 3, 3, 3, 3, 3, 3,
-	3, 3, 3, 3, 3, 3, 3, 3,
-	3, 3, 3, 3, 3, 3, 3, 3,
-	3, 3, 3, 3, 3, 3, 3, 3,
-	3, 3, 3, 3, 3, 3, 3, 3,
-	3, 3, 3, 3, 3, 3, 3, 3,
-	3, 3, 3, 3, 3, 3, 3, 3,
-	3, 3, 3, 3, 3, 3, 3, 3,
-	3, 3, 3, 3, 3, 3, 3, 3,
-	3, 3, 3, 3, 3, 3, 3, 3,
-	3, 3, 3, 0, 0, 150, 151, 151,
-	151, 151, 151, 151, 151, 151, 151, 151,
-	151, 151, 151, 151, 151, 151, 151, 151,
-	151, 151, 151, 151, 151, 151, 151, 151,
-	151, 151, 151, 151, 151, 151, 151, 151,
-	151, 151, 151, 151, 151, 151, 151, 151,
-	151, 151, 151, 151, 151, 151, 151, 151,
-	151, 151, 151, 151, 151, 151, 151, 151,
-	151, 151, 151, 151, 151, 151, 151, 151,
-	151, 151, 151, 151, 151, 151, 151, 151,
-	151, 151, 151, 151, 151, 150, 151, 150,
-	151, 151, 151, 151, 151, 151, 151, 151,
-	151, 151, 151, 151, 151, 151, 151, 151,
-	151, 151, 151, 151, 151, 151, 151, 151,
-	151, 151, 151, 151, 151, 151, 151, 151,
-	151, 151, 151, 151, 151, 151, 151, 151,
-	151, 151, 151, 151, 151, 151, 151, 151,
-	151, 151, 151, 151, 151, 151, 151, 151,
-	151, 151, 151, 151, 151, 151, 151, 151,
-	151, 151, 151, 151, 151, 151, 151, 151,
-	151, 151, 151, 151, 151, 151, 151, 151,
-	151, 151, 151, 151, 151, 151, 151, 151,
-	151, 151, 151, 151, 151, 151, 151, 150,
-	151, 151, 151, 151, 151, 151, 151, 151,
-	151, 151, 151, 151, 151, 151, 151, 151,
-	151, 151, 151, 151, 151, 151, 151, 151,
-	0, 335, 335, 335, 335, 335, 335, 335,
-	335, 335, 335, 335, 335, 335, 335, 335,
-	335, 335, 335, 335, 335, 335, 335, 335,
-	335, 335, 335, 335, 335, 335, 335, 335,
-	335, 335, 335, 335, 335, 335, 335, 335,
-	335, 335, 335, 335, 335, 335, 335, 335,
-	335, 335, 335, 335, 335, 335, 335, 335,
-	335, 335, 335, 335, 335, 335, 335, 335,
-	335, 335, 335, 335, 335, 335, 335, 335,
-	335, 335, 335, 335, 335, 335, 335, 335,
-	335, 335, 335, 335, 335, 335, 335, 335,
-	335, 335, 335, 335, 335, 335, 335, 335,
-	335, 335, 335, 335, 335, 335, 335, 335,
-	335, 335, 335, 335, 335, 335, 335, 335,
-	335, 335, 335, 335, 335, 335, 335, 335,
-	335, 335, 335, 335, 335, 335, 335, 335,
-	335, 335, 335, 335, 335, 335, 335, 335,
-	335, 335, 335, 335, 335, 335, 335, 335,
-	335, 335, 335, 335, 335, 335, 335, 335,
-	335, 335, 335, 335, 335, 335, 335, 335,
-	335, 335, 335, 335, 335, 335, 335, 335,
-	335, 335, 335, 335, 335, 335, 335, 335,
-	335, 335, 335, 335, 335, 335, 335, 335,
-	335, 335, 335, 335, 335, 335, 335, 335,
-	335, 335, 335, 335, 335, 335, 335, 335,
-	335, 335, 335, 335, 335, 335, 335, 335,
-	335, 335, 335, 335, 335, 335, 335, 335,
-	335, 335, 335, 335, 335, 335, 335, 335,
-	335, 335, 335, 335, 335, 335, 335, 335,
-	335, 335, 335, 335, 335, 335, 335, 335,
-	335, 335, 335, 335, 335, 335, 335, 335,
-	335, 335, 335, 335, 335, 335, 335, 335,
-	335, 335, 335, 335, 335, 335, 335, 335,
-	335, 335, 335, 335, 335, 335, 335, 335,
-	335, 335, 335, 335, 335, 335, 335, 335,
-	335, 335, 335, 335, 335, 335, 335, 335,
-	335, 335, 335, 335, 335, 335, 335, 335,
-	335, 335, 335, 335, 335, 335, 335, 335,
-	335, 335, 335, 335, 335, 335, 335, 335,
-	335, 335, 335, 335, 335, 335, 335, 335,
-	335, 335, 335, 335, 335, 335, 335, 335,
-	335, 335, 335, 335, 335, 335, 335, 335,
-	335, 335, 335, 335, 335, 335, 335, 335,
-	335, 335, 335, 335, 335, 335, 335, 335,
-	335, 335, 335, 335, 335, 335, 335, 335,
-	335, 335, 335, 335, 335, 335, 335, 335,
-	335, 335, 335, 335, 335, 335, 335, 335,
-	335, 335, 335, 335, 335, 335, 335, 335,
-	335, 335, 335, 335, 335, 335, 335, 335,
-	335, 335, 335, 335, 335, 335, 335, 335,
-	335, 335, 335, 335, 335, 335, 335, 335,
-	335, 335, 335, 335, 335, 335, 335, 335,
-	335, 335, 335, 335, 335, 335, 335, 335,
-	335, 335, 335, 335, 335, 335, 335, 335,
-	335, 335, 335, 335, 335, 335, 335, 335,
-	335, 335, 335, 335, 335, 335, 335, 335,
-	335, 335, 335, 335, 335, 335, 335, 335,
-	335, 335, 335, 335, 335, 335, 335, 335,
-	335, 335, 335, 335, 335, 335, 335, 335,
-	335, 335, 335, 335, 335, 335, 335, 335,
-	335, 335, 335, 335, 335, 335, 335, 335,
-	0, 0, 0, 0, 0, 0, 150, 772,
-	772, 772, 772, 772, 772, 772, 772, 772,
-	772, 772, 772, 772, 772, 772, 772, 772,
-	772, 772, 772, 772, 772, 772, 772, 772,
-	772, 772, 772, 772, 772, 772, 772, 772,
-	772, 772, 772, 772, 772, 772, 772, 772,
-	772, 772, 772, 772, 772, 772, 772, 772,
-	772, 772, 772, 772, 772, 772, 772, 772,
-	772, 772, 772, 772, 772, 772, 772, 772,
-	772, 772, 772, 772, 772, 772, 772, 772,
-	772, 772, 772, 772, 772, 772, 772, 772,
-	772, 772, 772, 772, 772, 772, 772, 772,
-	772, 772, 772, 772, 772, 772, 772, 772,
-	772, 772, 772, 772, 772, 772, 772, 772,
-	772, 772, 772, 772, 772, 772, 772, 772,
-	772, 772, 772, 772, 772, 772, 772, 772,
-	772, 772, 772, 772, 772, 772, 772, 772,
-	772, 772, 772, 772, 772, 772, 772, 772,
-	772, 772, 772, 772, 772, 772, 772, 772,
-	772, 772, 772, 772, 772, 772, 772, 772,
-	772, 772, 772, 772, 772, 772, 772, 772,
-	772, 772, 772, 772, 772, 772, 772, 772,
-	772, 772, 772, 772, 772, 772, 772, 772,
-	772, 772, 772, 772, 772, 772, 772, 772,
-	772, 772, 772, 772, 772, 772, 772, 772,
-	772, 772, 772, 772, 772, 772, 772, 772,
-	772, 772, 772, 150, 772, 772, 150, 772,
-	772, 150, 772, 772, 772, 772, 772, 772,
-	772, 772, 772, 772, 772, 772, 772, 772,
-	772, 772, 772, 772, 150, 772, 772, 772,
-	772, 0, 0, 0, 995, 995, 995, 995,
-	995, 995, 995, 995, 995, 995, 995, 995,
-	995, 995, 995, 995, 995, 995, 995, 995,
-	995, 995, 995, 995, 995, 995, 995, 995,
-	995, 995, 995, 995, 995, 995, 995, 995,
-	995, 995, 995, 995, 995, 995, 995, 995,
-	995, 995, 995, 995, 995, 995, 995, 995,
-	995, 995, 995, 995, 995, 995, 995, 995,
-	995, 995, 995, 995, 995, 995, 995, 995,
-	995, 995, 995, 995, 995, 995, 995, 995,
-	995, 995, 995, 995, 995, 995, 995, 995,
-	995, 995, 995, 995, 995, 995, 995, 995,
-	995, 995, 995, 995, 995, 995, 995, 995,
-	995, 995, 995, 995, 995, 995, 995, 995,
-	995, 995, 995, 995, 995, 995, 995, 995,
-	995, 995, 995, 995, 995, 995, 995, 995,
-	995, 995, 995, 995, 995, 995, 995, 995,
-	995, 995, 995, 995, 995, 995, 995, 995,
-	995, 995, 995, 995, 995, 995, 995, 995,
-	995, 995, 995, 995, 995, 995, 995, 995,
-	995, 995, 995, 995, 995, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	1188, 1188, 1188, 1188, 1188, 1188, 1188, 1188,
-	1188, 1188, 1188, 1188, 1188, 1188, 1188, 1188,
-	1188, 1188, 1188, 1188, 1188, 1188, 1188, 1188,
-	1188, 1188, 1188, 1188, 1188, 1188, 1188, 1188,
-	1188, 1188, 1188, 1188, 1188, 1188, 1188, 1188,
-	1188, 1188, 1188, 1188, 1188, 1188, 1188, 1188,
-	1188, 1188, 1188, 1188, 1188, 1188, 1188, 1188,
-	1188, 1188, 1188, 1188, 1188, 1188, 1188, 1188,
-	1188, 1188, 1188, 1188, 1188, 1188, 1188, 1188,
-	1188, 1188, 1188, 1188, 1188, 1188, 1188, 1188,
-	1188, 1188, 1188, 1188, 1188, 1188, 1188, 1188,
-	1188, 1188, 1188, 1188, 1188, 1188, 1188, 1188,
-	1188, 1188, 1188, 1188, 1188, 1188, 1188, 1188,
-	1188, 1188, 1188, 1188, 1188, 1188, 1188, 1188,
-	1188, 1188, 1188, 1188, 1188, 1188, 1188, 1188,
-	1188, 1188, 1188, 1188, 1188, 1188, 1188, 1188,
-	1188, 1188, 1188, 1188, 1188, 1188, 1188, 1188,
-	1188, 1188, 1188, 1188, 1188, 1188, 1188, 1188,
-	1188, 1188, 1188, 1188, 1188, 1188, 1188, 1188,
-	1188, 1188, 1188, 1188, 1188, 1188, 1188, 1188,
-	1188, 1188, 1188, 1188, 1188, 1188, 1188, 1188,
-	1188, 1188, 1188, 1188, 1188, 1188, 1188, 1188,
-	1188, 1188, 1188, 1188, 1188, 1188, 1188, 1188,
-	1188, 1188, 1188, 1188, 1188, 1188, 1188, 1188,
-	1188, 1188, 1188, 1188, 1188, 1188, 1188, 1188,
-	1188, 1188, 1188, 1188, 1188, 1188, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 1401, 1420, 1420, 1443,
-	1443, 1443, 1443, 1443, 1443, 1443, 1443, 1443,
-	1512, 1512, 1512, 1512, 1512, 1512, 1546, 1565,
-	1565, 1565,
-}
-
-const graphclust_start int = 1547
-const graphclust_first_final int = 1547
-const graphclust_error int = 0
-
-const graphclust_en_main int = 1547
-
-//line grapheme_clusters.rl:14
-
-var Error = errors.New("invalid UTF8 text")
-
-// ScanGraphemeClusters is a split function for bufio.Scanner that splits
-// on grapheme cluster boundaries.
-func ScanGraphemeClusters(data []byte, atEOF bool) (int, []byte, error) {
-	if len(data) == 0 {
-		return 0, nil, nil
-	}
-
-	// Ragel state
-	cs := 0         // Current State
-	p := 0          // "Pointer" into data
-	pe := len(data) // End-of-data "pointer"
-	ts := 0
-	te := 0
-	act := 0
-	eof := pe
-
-	// Make Go compiler happy
-	_ = ts
-	_ = te
-	_ = act
-	_ = eof
-
-	startPos := 0
-	endPos := 0
-
-//line grapheme_clusters.go:3847
-	{
-		cs = graphclust_start
-		ts = 0
-		te = 0
-		act = 0
-	}
-
-//line grapheme_clusters.go:3855
-	{
-		var _klen int
-		var _trans int
-		var _acts int
-		var _nacts uint
-		var _keys int
-		if p == pe {
-			goto _test_eof
-		}
-		if cs == 0 {
-			goto _out
-		}
-	_resume:
-		_acts = int(_graphclust_from_state_actions[cs])
-		_nacts = uint(_graphclust_actions[_acts])
-		_acts++
-		for ; _nacts > 0; _nacts-- {
-			_acts++
-			switch _graphclust_actions[_acts-1] {
-			case 4:
-//line NONE:1
-				ts = p
-
-//line grapheme_clusters.go:3878
-			}
-		}
-
-		_keys = int(_graphclust_key_offsets[cs])
-		_trans = int(_graphclust_index_offsets[cs])
-
-		_klen = int(_graphclust_single_lengths[cs])
-		if _klen > 0 {
-			_lower := int(_keys)
-			var _mid int
-			_upper := int(_keys + _klen - 1)
-			for {
-				if _upper < _lower {
-					break
-				}
-
-				_mid = _lower + ((_upper - _lower) >> 1)
-				switch {
-				case data[p] < _graphclust_trans_keys[_mid]:
-					_upper = _mid - 1
-				case data[p] > _graphclust_trans_keys[_mid]:
-					_lower = _mid + 1
-				default:
-					_trans += int(_mid - int(_keys))
-					goto _match
-				}
-			}
-			_keys += _klen
-			_trans += _klen
-		}
-
-		_klen = int(_graphclust_range_lengths[cs])
-		if _klen > 0 {
-			_lower := int(_keys)
-			var _mid int
-			_upper := int(_keys + (_klen << 1) - 2)
-			for {
-				if _upper < _lower {
-					break
-				}
-
-				_mid = _lower + (((_upper - _lower) >> 1) & ^1)
-				switch {
-				case data[p] < _graphclust_trans_keys[_mid]:
-					_upper = _mid - 2
-				case data[p] > _graphclust_trans_keys[_mid+1]:
-					_lower = _mid + 2
-				default:
-					_trans += int((_mid - int(_keys)) >> 1)
-					goto _match
-				}
-			}
-			_trans += _klen
-		}
-
-	_match:
-		_trans = int(_graphclust_indicies[_trans])
-	_eof_trans:
-		cs = int(_graphclust_trans_targs[_trans])
-
-		if _graphclust_trans_actions[_trans] == 0 {
-			goto _again
-		}
-
-		_acts = int(_graphclust_trans_actions[_trans])
-		_nacts = uint(_graphclust_actions[_acts])
-		_acts++
-		for ; _nacts > 0; _nacts-- {
-			_acts++
-			switch _graphclust_actions[_acts-1] {
-			case 0:
-//line grapheme_clusters.rl:47
-
-				startPos = p
-
-			case 1:
-//line grapheme_clusters.rl:51
-
-				endPos = p
-
-			case 5:
-//line NONE:1
-				te = p + 1
-
-			case 6:
-//line grapheme_clusters.rl:55
-				act = 3
-			case 7:
-//line grapheme_clusters.rl:55
-				act = 4
-			case 8:
-//line grapheme_clusters.rl:55
-				te = p + 1
-				{
-					return endPos + 1, data[startPos : endPos+1], nil
-				}
-			case 9:
-//line grapheme_clusters.rl:55
-				te = p + 1
-				{
-					return endPos + 1, data[startPos : endPos+1], nil
-				}
-			case 10:
-//line grapheme_clusters.rl:55
-				te = p
-				p--
-				{
-					return endPos + 1, data[startPos : endPos+1], nil
-				}
-			case 11:
-//line grapheme_clusters.rl:55
-				te = p
-				p--
-				{
-					return endPos + 1, data[startPos : endPos+1], nil
-				}
-			case 12:
-//line grapheme_clusters.rl:55
-				te = p
-				p--
-				{
-					return endPos + 1, data[startPos : endPos+1], nil
-				}
-			case 13:
-//line grapheme_clusters.rl:55
-				te = p
-				p--
-				{
-					return endPos + 1, data[startPos : endPos+1], nil
-				}
-			case 14:
-//line grapheme_clusters.rl:55
-				te = p
-				p--
-				{
-					return endPos + 1, data[startPos : endPos+1], nil
-				}
-			case 15:
-//line grapheme_clusters.rl:55
-				te = p
-				p--
-				{
-					return endPos + 1, data[startPos : endPos+1], nil
-				}
-			case 16:
-//line grapheme_clusters.rl:55
-				p = (te) - 1
-				{
-					return endPos + 1, data[startPos : endPos+1], nil
-				}
-			case 17:
-//line grapheme_clusters.rl:55
-				p = (te) - 1
-				{
-					return endPos + 1, data[startPos : endPos+1], nil
-				}
-			case 18:
-//line grapheme_clusters.rl:55
-				p = (te) - 1
-				{
-					return endPos + 1, data[startPos : endPos+1], nil
-				}
-			case 19:
-//line grapheme_clusters.rl:55
-				p = (te) - 1
-				{
-					return endPos + 1, data[startPos : endPos+1], nil
-				}
-			case 20:
-//line grapheme_clusters.rl:55
-				p = (te) - 1
-				{
-					return endPos + 1, data[startPos : endPos+1], nil
-				}
-			case 21:
-//line grapheme_clusters.rl:55
-				p = (te) - 1
-				{
-					return endPos + 1, data[startPos : endPos+1], nil
-				}
-			case 22:
-//line NONE:1
-				switch act {
-				case 0:
-					{
-						cs = 0
-						goto _again
-					}
-				case 3:
-					{
-						p = (te) - 1
-
-						return endPos + 1, data[startPos : endPos+1], nil
-					}
-				case 4:
-					{
-						p = (te) - 1
-
-						return endPos + 1, data[startPos : endPos+1], nil
-					}
-				}
-
-//line grapheme_clusters.go:4077
-			}
-		}
-
-	_again:
-		_acts = int(_graphclust_to_state_actions[cs])
-		_nacts = uint(_graphclust_actions[_acts])
-		_acts++
-		for ; _nacts > 0; _nacts-- {
-			_acts++
-			switch _graphclust_actions[_acts-1] {
-			case 2:
-//line NONE:1
-				ts = 0
-
-			case 3:
-//line NONE:1
-				act = 0
-
-//line grapheme_clusters.go:4095
-			}
-		}
-
-		if cs == 0 {
-			goto _out
-		}
-		p++
-		if p != pe {
-			goto _resume
-		}
-	_test_eof:
-		{
-		}
-		if p == eof {
-			if _graphclust_eof_trans[cs] > 0 {
-				_trans = int(_graphclust_eof_trans[cs] - 1)
-				goto _eof_trans
-			}
-		}
-
-	_out:
-		{
-		}
-	}
-
-//line grapheme_clusters.rl:117
-
-	// If we fall out here then we were unable to complete a sequence.
-	// If we weren't able to complete a sequence then either we've
-	// reached the end of a partial buffer (so there's more data to come)
-	// or we have an isolated symbol that would normally be part of a
-	// grapheme cluster but has appeared in isolation here.
-
-	if !atEOF {
-		// Request more
-		return 0, nil, nil
-	}
-
-	// Just take the first UTF-8 sequence and return that.
-	_, seqLen := utf8.DecodeRune(data)
-	return seqLen, data[:seqLen], nil
-}
diff --git a/.ci/providerlint/vendor/github.com/apparentlymart/go-textseg/v13/textseg/tables.go b/.ci/providerlint/vendor/github.com/apparentlymart/go-textseg/v13/textseg/tables.go
deleted file mode 100644
index b3f22ad432f..00000000000
--- a/.ci/providerlint/vendor/github.com/apparentlymart/go-textseg/v13/textseg/tables.go
+++ /dev/null
@@ -1,5833 +0,0 @@
-// Generated by running
-//      maketables --url=http://www.unicode.org/Public/12.0.0/ucd/auxiliary/
-// DO NOT EDIT
-
-package textseg
-
-import (
-	"unicode"
-)
-
-var _GraphemeCR = &unicode.RangeTable{
-	R16: []unicode.Range16{
-		unicode.Range16{Lo: 0xd, Hi: 0xd, Stride: 0x1},
-	},
-	LatinOffset: 1,
-}
-
-var _GraphemeControl = &unicode.RangeTable{
-	R16: []unicode.Range16{
-		unicode.Range16{Lo: 0x0, Hi: 0x9, Stride: 0x1},
-		unicode.Range16{Lo: 0xb, Hi: 0xc, Stride: 0x1},
-		unicode.Range16{Lo: 0xe, Hi: 0x1f, Stride: 0x1},
-		unicode.Range16{Lo: 0x7f, Hi: 0x9f, Stride: 0x1},
-		unicode.Range16{Lo: 0xad, Hi: 0xad, Stride: 0x1},
-		unicode.Range16{Lo: 0x61c, Hi: 0x61c, Stride: 0x1},
-		unicode.Range16{Lo: 0x180e, Hi: 0x180e, Stride: 0x1},
-		unicode.Range16{Lo: 0x200b, Hi: 0x200b, Stride: 0x1},
-		unicode.Range16{Lo: 0x200e, Hi: 0x200f, Stride: 0x1},
-		unicode.Range16{Lo: 0x2028, Hi: 0x2028, Stride: 0x1},
-		unicode.Range16{Lo: 0x2029, Hi: 0x2029, Stride: 0x1},
-		unicode.Range16{Lo: 0x202a, Hi: 0x202e, Stride: 0x1},
-		unicode.Range16{Lo: 0x2060, Hi: 0x2064, Stride: 0x1},
-		unicode.Range16{Lo: 0x2065, Hi: 0x2065, Stride: 0x1},
-		unicode.Range16{Lo: 0x2066, Hi: 0x206f, Stride: 0x1},
-		unicode.Range16{Lo: 0xfeff, Hi: 0xfeff, Stride: 0x1},
-		unicode.Range16{Lo: 0xfff0, Hi: 0xfff8, Stride: 0x1},
-		unicode.Range16{Lo: 0xfff9, Hi: 0xfffb, Stride: 0x1},
-	},
-	R32: []unicode.Range32{
-		unicode.Range32{Lo: 0x13430, Hi: 0x13438, Stride: 0x1},
-		unicode.Range32{Lo: 0x1bca0, Hi: 0x1bca3, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d173, Hi: 0x1d17a, Stride: 0x1},
-		unicode.Range32{Lo: 0xe0000, Hi: 0xe0000, Stride: 0x1},
-		unicode.Range32{Lo: 0xe0001, Hi: 0xe0001, Stride: 0x1},
-		unicode.Range32{Lo: 0xe0002, Hi: 0xe001f, Stride: 0x1},
-		unicode.Range32{Lo: 0xe0080, Hi: 0xe00ff, Stride: 0x1},
-		unicode.Range32{Lo: 0xe01f0, Hi: 0xe0fff, Stride: 0x1},
-	},
-	LatinOffset: 5,
-}
-
-var _GraphemeExtend = &unicode.RangeTable{
-	R16: []unicode.Range16{
-		unicode.Range16{Lo: 0x300, Hi: 0x36f, Stride: 0x1},
-		unicode.Range16{Lo: 0x483, Hi: 0x487, Stride: 0x1},
-		unicode.Range16{Lo: 0x488, Hi: 0x489, Stride: 0x1},
-		unicode.Range16{Lo: 0x591, Hi: 0x5bd, Stride: 0x1},
-		unicode.Range16{Lo: 0x5bf, Hi: 0x5bf, Stride: 0x1},
-		unicode.Range16{Lo: 0x5c1, Hi: 0x5c2, Stride: 0x1},
-		unicode.Range16{Lo: 0x5c4, Hi: 0x5c5, Stride: 0x1},
-		unicode.Range16{Lo: 0x5c7, Hi: 0x5c7, Stride: 0x1},
-		unicode.Range16{Lo: 0x610, Hi: 0x61a, Stride: 0x1},
-		unicode.Range16{Lo: 0x64b, Hi: 0x65f, Stride: 0x1},
-		unicode.Range16{Lo: 0x670, Hi: 0x670, Stride: 0x1},
-		unicode.Range16{Lo: 0x6d6, Hi: 0x6dc, Stride: 0x1},
-		unicode.Range16{Lo: 0x6df, Hi: 0x6e4, Stride: 0x1},
-		unicode.Range16{Lo: 0x6e7, Hi: 0x6e8, Stride: 0x1},
-		unicode.Range16{Lo: 0x6ea, Hi: 0x6ed, Stride: 0x1},
-		unicode.Range16{Lo: 0x711, Hi: 0x711, Stride: 0x1},
-		unicode.Range16{Lo: 0x730, Hi: 0x74a, Stride: 0x1},
-		unicode.Range16{Lo: 0x7a6, Hi: 0x7b0, Stride: 0x1},
-		unicode.Range16{Lo: 0x7eb, Hi: 0x7f3, Stride: 0x1},
-		unicode.Range16{Lo: 0x7fd, Hi: 0x7fd, Stride: 0x1},
-		unicode.Range16{Lo: 0x816, Hi: 0x819, Stride: 0x1},
-		unicode.Range16{Lo: 0x81b, Hi: 0x823, Stride: 0x1},
-		unicode.Range16{Lo: 0x825, Hi: 0x827, Stride: 0x1},
-		unicode.Range16{Lo: 0x829, Hi: 0x82d, Stride: 0x1},
-		unicode.Range16{Lo: 0x859, Hi: 0x85b, Stride: 0x1},
-		unicode.Range16{Lo: 0x8d3, Hi: 0x8e1, Stride: 0x1},
-		unicode.Range16{Lo: 0x8e3, Hi: 0x902, Stride: 0x1},
-		unicode.Range16{Lo: 0x93a, Hi: 0x93a, Stride: 0x1},
-		unicode.Range16{Lo: 0x93c, Hi: 0x93c, Stride: 0x1},
-		unicode.Range16{Lo: 0x941, Hi: 0x948, Stride: 0x1},
-		unicode.Range16{Lo: 0x94d, Hi: 0x94d, Stride: 0x1},
-		unicode.Range16{Lo: 0x951, Hi: 0x957, Stride: 0x1},
-		unicode.Range16{Lo: 0x962, Hi: 0x963, Stride: 0x1},
-		unicode.Range16{Lo: 0x981, Hi: 0x981, Stride: 0x1},
-		unicode.Range16{Lo: 0x9bc, Hi: 0x9bc, Stride: 0x1},
-		unicode.Range16{Lo: 0x9be, Hi: 0x9be, Stride: 0x1},
-		unicode.Range16{Lo: 0x9c1, Hi: 0x9c4, Stride: 0x1},
-		unicode.Range16{Lo: 0x9cd, Hi: 0x9cd, Stride: 0x1},
-		unicode.Range16{Lo: 0x9d7, Hi: 0x9d7, Stride: 0x1},
-		unicode.Range16{Lo: 0x9e2, Hi: 0x9e3, Stride: 0x1},
-		unicode.Range16{Lo: 0x9fe, Hi: 0x9fe, Stride: 0x1},
-		unicode.Range16{Lo: 0xa01, Hi: 0xa02, Stride: 0x1},
-		unicode.Range16{Lo: 0xa3c, Hi: 0xa3c, Stride: 0x1},
-		unicode.Range16{Lo: 0xa41, Hi: 0xa42, Stride: 0x1},
-		unicode.Range16{Lo: 0xa47, Hi: 0xa48, Stride: 0x1},
-		unicode.Range16{Lo: 0xa4b, Hi: 0xa4d, Stride: 0x1},
-		unicode.Range16{Lo: 0xa51, Hi: 0xa51, Stride: 0x1},
-		unicode.Range16{Lo: 0xa70, Hi: 0xa71, Stride: 0x1},
-		unicode.Range16{Lo: 0xa75, Hi: 0xa75, Stride: 0x1},
-		unicode.Range16{Lo: 0xa81, Hi: 0xa82, Stride: 0x1},
-		unicode.Range16{Lo: 0xabc, Hi: 0xabc, Stride: 0x1},
-		unicode.Range16{Lo: 0xac1, Hi: 0xac5, Stride: 0x1},
-		unicode.Range16{Lo: 0xac7, Hi: 0xac8, Stride: 0x1},
-		unicode.Range16{Lo: 0xacd, Hi: 0xacd, Stride: 0x1},
-		unicode.Range16{Lo: 0xae2, Hi: 0xae3, Stride: 0x1},
-		unicode.Range16{Lo: 0xafa, Hi: 0xaff, Stride: 0x1},
-		unicode.Range16{Lo: 0xb01, Hi: 0xb01, Stride: 0x1},
-		unicode.Range16{Lo: 0xb3c, Hi: 0xb3c, Stride: 0x1},
-		unicode.Range16{Lo: 0xb3e, Hi: 0xb3e, Stride: 0x1},
-		unicode.Range16{Lo: 0xb3f, Hi: 0xb3f, Stride: 0x1},
-		unicode.Range16{Lo: 0xb41, Hi: 0xb44, Stride: 0x1},
-		unicode.Range16{Lo: 0xb4d, Hi: 0xb4d, Stride: 0x1},
-		unicode.Range16{Lo: 0xb56, Hi: 0xb56, Stride: 0x1},
-		unicode.Range16{Lo: 0xb57, Hi: 0xb57, Stride: 0x1},
-		unicode.Range16{Lo: 0xb62, Hi: 0xb63, Stride: 0x1},
-		unicode.Range16{Lo: 0xb82, Hi: 0xb82, Stride: 0x1},
-		unicode.Range16{Lo: 0xbbe, Hi: 0xbbe, Stride: 0x1},
-		unicode.Range16{Lo: 0xbc0, Hi: 0xbc0, Stride: 0x1},
-		unicode.Range16{Lo: 0xbcd, Hi: 0xbcd, Stride: 0x1},
-		unicode.Range16{Lo: 0xbd7, Hi: 0xbd7, Stride: 0x1},
-		unicode.Range16{Lo: 0xc00, Hi: 0xc00, Stride: 0x1},
-		unicode.Range16{Lo: 0xc04, Hi: 0xc04, Stride: 0x1},
-		unicode.Range16{Lo: 0xc3e, Hi: 0xc40, Stride: 0x1},
-		unicode.Range16{Lo: 0xc46, Hi: 0xc48, Stride: 0x1},
-		unicode.Range16{Lo: 0xc4a, Hi: 0xc4d, Stride: 0x1},
-		unicode.Range16{Lo: 0xc55, Hi: 0xc56, Stride: 0x1},
-		unicode.Range16{Lo: 0xc62, Hi: 0xc63, Stride: 0x1},
-		unicode.Range16{Lo: 0xc81, Hi: 0xc81, Stride: 0x1},
-		unicode.Range16{Lo: 0xcbc, Hi: 0xcbc, Stride: 0x1},
-		unicode.Range16{Lo: 0xcbf, Hi: 0xcbf, Stride: 0x1},
-		unicode.Range16{Lo: 0xcc2, Hi: 0xcc2, Stride: 0x1},
-		unicode.Range16{Lo: 0xcc6, Hi: 0xcc6, Stride: 0x1},
-		unicode.Range16{Lo: 0xccc, Hi: 0xccd, Stride: 0x1},
-		unicode.Range16{Lo: 0xcd5, Hi: 0xcd6, Stride: 0x1},
-		unicode.Range16{Lo: 0xce2, Hi: 0xce3, Stride: 0x1},
-		unicode.Range16{Lo: 0xd00, Hi: 0xd01, Stride: 0x1},
-		unicode.Range16{Lo: 0xd3b, Hi: 0xd3c, Stride: 0x1},
-		unicode.Range16{Lo: 0xd3e, Hi: 0xd3e, Stride: 0x1},
-		unicode.Range16{Lo: 0xd41, Hi: 0xd44, Stride: 0x1},
-		unicode.Range16{Lo: 0xd4d, Hi: 0xd4d, Stride: 0x1},
-		unicode.Range16{Lo: 0xd57, Hi: 0xd57, Stride: 0x1},
-		unicode.Range16{Lo: 0xd62, Hi: 0xd63, Stride: 0x1},
-		unicode.Range16{Lo: 0xdca, Hi: 0xdca, Stride: 0x1},
-		unicode.Range16{Lo: 0xdcf, Hi: 0xdcf, Stride: 0x1},
-		unicode.Range16{Lo: 0xdd2, Hi: 0xdd4, Stride: 0x1},
-		unicode.Range16{Lo: 0xdd6, Hi: 0xdd6, Stride: 0x1},
-		unicode.Range16{Lo: 0xddf, Hi: 0xddf, Stride: 0x1},
-		unicode.Range16{Lo: 0xe31, Hi: 0xe31, Stride: 0x1},
-		unicode.Range16{Lo: 0xe34, Hi: 0xe3a, Stride: 0x1},
-		unicode.Range16{Lo: 0xe47, Hi: 0xe4e, Stride: 0x1},
-		unicode.Range16{Lo: 0xeb1, Hi: 0xeb1, Stride: 0x1},
-		unicode.Range16{Lo: 0xeb4, Hi: 0xebc, Stride: 0x1},
-		unicode.Range16{Lo: 0xec8, Hi: 0xecd, Stride: 0x1},
-		unicode.Range16{Lo: 0xf18, Hi: 0xf19, Stride: 0x1},
-		unicode.Range16{Lo: 0xf35, Hi: 0xf35, Stride: 0x1},
-		unicode.Range16{Lo: 0xf37, Hi: 0xf37, Stride: 0x1},
-		unicode.Range16{Lo: 0xf39, Hi: 0xf39, Stride: 0x1},
-		unicode.Range16{Lo: 0xf71, Hi: 0xf7e, Stride: 0x1},
-		unicode.Range16{Lo: 0xf80, Hi: 0xf84, Stride: 0x1},
-		unicode.Range16{Lo: 0xf86, Hi: 0xf87, Stride: 0x1},
-		unicode.Range16{Lo: 0xf8d, Hi: 0xf97, Stride: 0x1},
-		unicode.Range16{Lo: 0xf99, Hi: 0xfbc, Stride: 0x1},
-		unicode.Range16{Lo: 0xfc6, Hi: 0xfc6, Stride: 0x1},
-		unicode.Range16{Lo: 0x102d, Hi: 0x1030, Stride: 0x1},
-		unicode.Range16{Lo: 0x1032, Hi: 0x1037, Stride: 0x1},
-		unicode.Range16{Lo: 0x1039, Hi: 0x103a, Stride: 0x1},
-		unicode.Range16{Lo: 0x103d, Hi: 0x103e, Stride: 0x1},
-		unicode.Range16{Lo: 0x1058, Hi: 0x1059, Stride: 0x1},
-		unicode.Range16{Lo: 0x105e, Hi: 0x1060, Stride: 0x1},
-		unicode.Range16{Lo: 0x1071, Hi: 0x1074, Stride: 0x1},
-		unicode.Range16{Lo: 0x1082, Hi: 0x1082, Stride: 0x1},
-		unicode.Range16{Lo: 0x1085, Hi: 0x1086, Stride: 0x1},
-		unicode.Range16{Lo: 0x108d, Hi: 0x108d, Stride: 0x1},
-		unicode.Range16{Lo: 0x109d, Hi: 0x109d, Stride: 0x1},
-		unicode.Range16{Lo: 0x135d, Hi: 0x135f, Stride: 0x1},
-		unicode.Range16{Lo: 0x1712, Hi: 0x1714, Stride: 0x1},
-		unicode.Range16{Lo: 0x1732, Hi: 0x1734, Stride: 0x1},
-		unicode.Range16{Lo: 0x1752, Hi: 0x1753, Stride: 0x1},
-		unicode.Range16{Lo: 0x1772, Hi: 0x1773, Stride: 0x1},
-		unicode.Range16{Lo: 0x17b4, Hi: 0x17b5, Stride: 0x1},
-		unicode.Range16{Lo: 0x17b7, Hi: 0x17bd, Stride: 0x1},
-		unicode.Range16{Lo: 0x17c6, Hi: 0x17c6, Stride: 0x1},
-		unicode.Range16{Lo: 0x17c9, Hi: 0x17d3, Stride: 0x1},
-		unicode.Range16{Lo: 0x17dd, Hi: 0x17dd, Stride: 0x1},
-		unicode.Range16{Lo: 0x180b, Hi: 0x180d, Stride: 0x1},
-		unicode.Range16{Lo: 0x1885, Hi: 0x1886, Stride: 0x1},
-		unicode.Range16{Lo: 0x18a9, Hi: 0x18a9, Stride: 0x1},
-		unicode.Range16{Lo: 0x1920, Hi: 0x1922, Stride: 0x1},
-		unicode.Range16{Lo: 0x1927, Hi: 0x1928, Stride: 0x1},
-		unicode.Range16{Lo: 0x1932, Hi: 0x1932, Stride: 0x1},
-		unicode.Range16{Lo: 0x1939, Hi: 0x193b, Stride: 0x1},
-		unicode.Range16{Lo: 0x1a17, Hi: 0x1a18, Stride: 0x1},
-		unicode.Range16{Lo: 0x1a1b, Hi: 0x1a1b, Stride: 0x1},
-		unicode.Range16{Lo: 0x1a56, Hi: 0x1a56, Stride: 0x1},
-		unicode.Range16{Lo: 0x1a58, Hi: 0x1a5e, Stride: 0x1},
-		unicode.Range16{Lo: 0x1a60, Hi: 0x1a60, Stride: 0x1},
-		unicode.Range16{Lo: 0x1a62, Hi: 0x1a62, Stride: 0x1},
-		unicode.Range16{Lo: 0x1a65, Hi: 0x1a6c, Stride: 0x1},
-		unicode.Range16{Lo: 0x1a73, Hi: 0x1a7c, Stride: 0x1},
-		unicode.Range16{Lo: 0x1a7f, Hi: 0x1a7f, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ab0, Hi: 0x1abd, Stride: 0x1},
-		unicode.Range16{Lo: 0x1abe, Hi: 0x1abe, Stride: 0x1},
-		unicode.Range16{Lo: 0x1b00, Hi: 0x1b03, Stride: 0x1},
-		unicode.Range16{Lo: 0x1b34, Hi: 0x1b34, Stride: 0x1},
-		unicode.Range16{Lo: 0x1b35, Hi: 0x1b35, Stride: 0x1},
-		unicode.Range16{Lo: 0x1b36, Hi: 0x1b3a, Stride: 0x1},
-		unicode.Range16{Lo: 0x1b3c, Hi: 0x1b3c, Stride: 0x1},
-		unicode.Range16{Lo: 0x1b42, Hi: 0x1b42, Stride: 0x1},
-		unicode.Range16{Lo: 0x1b6b, Hi: 0x1b73, Stride: 0x1},
-		unicode.Range16{Lo: 0x1b80, Hi: 0x1b81, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ba2, Hi: 0x1ba5, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ba8, Hi: 0x1ba9, Stride: 0x1},
-		unicode.Range16{Lo: 0x1bab, Hi: 0x1bad, Stride: 0x1},
-		unicode.Range16{Lo: 0x1be6, Hi: 0x1be6, Stride: 0x1},
-		unicode.Range16{Lo: 0x1be8, Hi: 0x1be9, Stride: 0x1},
-		unicode.Range16{Lo: 0x1bed, Hi: 0x1bed, Stride: 0x1},
-		unicode.Range16{Lo: 0x1bef, Hi: 0x1bf1, Stride: 0x1},
-		unicode.Range16{Lo: 0x1c2c, Hi: 0x1c33, Stride: 0x1},
-		unicode.Range16{Lo: 0x1c36, Hi: 0x1c37, Stride: 0x1},
-		unicode.Range16{Lo: 0x1cd0, Hi: 0x1cd2, Stride: 0x1},
-		unicode.Range16{Lo: 0x1cd4, Hi: 0x1ce0, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ce2, Hi: 0x1ce8, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ced, Hi: 0x1ced, Stride: 0x1},
-		unicode.Range16{Lo: 0x1cf4, Hi: 0x1cf4, Stride: 0x1},
-		unicode.Range16{Lo: 0x1cf8, Hi: 0x1cf9, Stride: 0x1},
-		unicode.Range16{Lo: 0x1dc0, Hi: 0x1df9, Stride: 0x1},
-		unicode.Range16{Lo: 0x1dfb, Hi: 0x1dff, Stride: 0x1},
-		unicode.Range16{Lo: 0x200c, Hi: 0x200c, Stride: 0x1},
-		unicode.Range16{Lo: 0x20d0, Hi: 0x20dc, Stride: 0x1},
-		unicode.Range16{Lo: 0x20dd, Hi: 0x20e0, Stride: 0x1},
-		unicode.Range16{Lo: 0x20e1, Hi: 0x20e1, Stride: 0x1},
-		unicode.Range16{Lo: 0x20e2, Hi: 0x20e4, Stride: 0x1},
-		unicode.Range16{Lo: 0x20e5, Hi: 0x20f0, Stride: 0x1},
-		unicode.Range16{Lo: 0x2cef, Hi: 0x2cf1, Stride: 0x1},
-		unicode.Range16{Lo: 0x2d7f, Hi: 0x2d7f, Stride: 0x1},
-		unicode.Range16{Lo: 0x2de0, Hi: 0x2dff, Stride: 0x1},
-		unicode.Range16{Lo: 0x302a, Hi: 0x302d, Stride: 0x1},
-		unicode.Range16{Lo: 0x302e, Hi: 0x302f, Stride: 0x1},
-		unicode.Range16{Lo: 0x3099, Hi: 0x309a, Stride: 0x1},
-		unicode.Range16{Lo: 0xa66f, Hi: 0xa66f, Stride: 0x1},
-		unicode.Range16{Lo: 0xa670, Hi: 0xa672, Stride: 0x1},
-		unicode.Range16{Lo: 0xa674, Hi: 0xa67d, Stride: 0x1},
-		unicode.Range16{Lo: 0xa69e, Hi: 0xa69f, Stride: 0x1},
-		unicode.Range16{Lo: 0xa6f0, Hi: 0xa6f1, Stride: 0x1},
-		unicode.Range16{Lo: 0xa802, Hi: 0xa802, Stride: 0x1},
-		unicode.Range16{Lo: 0xa806, Hi: 0xa806, Stride: 0x1},
-		unicode.Range16{Lo: 0xa80b, Hi: 0xa80b, Stride: 0x1},
-		unicode.Range16{Lo: 0xa825, Hi: 0xa826, Stride: 0x1},
-		unicode.Range16{Lo: 0xa8c4, Hi: 0xa8c5, Stride: 0x1},
-		unicode.Range16{Lo: 0xa8e0, Hi: 0xa8f1, Stride: 0x1},
-		unicode.Range16{Lo: 0xa8ff, Hi: 0xa8ff, Stride: 0x1},
-		unicode.Range16{Lo: 0xa926, Hi: 0xa92d, Stride: 0x1},
-		unicode.Range16{Lo: 0xa947, Hi: 0xa951, Stride: 0x1},
-		unicode.Range16{Lo: 0xa980, Hi: 0xa982, Stride: 0x1},
-		unicode.Range16{Lo: 0xa9b3, Hi: 0xa9b3, Stride: 0x1},
-		unicode.Range16{Lo: 0xa9b6, Hi: 0xa9b9, Stride: 0x1},
-		unicode.Range16{Lo: 0xa9bc, Hi: 0xa9bd, Stride: 0x1},
-		unicode.Range16{Lo: 0xa9e5, Hi: 0xa9e5, Stride: 0x1},
-		unicode.Range16{Lo: 0xaa29, Hi: 0xaa2e, Stride: 0x1},
-		unicode.Range16{Lo: 0xaa31, Hi: 0xaa32, Stride: 0x1},
-		unicode.Range16{Lo: 0xaa35, Hi: 0xaa36, Stride: 0x1},
-		unicode.Range16{Lo: 0xaa43, Hi: 0xaa43, Stride: 0x1},
-		unicode.Range16{Lo: 0xaa4c, Hi: 0xaa4c, Stride: 0x1},
-		unicode.Range16{Lo: 0xaa7c, Hi: 0xaa7c, Stride: 0x1},
-		unicode.Range16{Lo: 0xaab0, Hi: 0xaab0, Stride: 0x1},
-		unicode.Range16{Lo: 0xaab2, Hi: 0xaab4, Stride: 0x1},
-		unicode.Range16{Lo: 0xaab7, Hi: 0xaab8, Stride: 0x1},
-		unicode.Range16{Lo: 0xaabe, Hi: 0xaabf, Stride: 0x1},
-		unicode.Range16{Lo: 0xaac1, Hi: 0xaac1, Stride: 0x1},
-		unicode.Range16{Lo: 0xaaec, Hi: 0xaaed, Stride: 0x1},
-		unicode.Range16{Lo: 0xaaf6, Hi: 0xaaf6, Stride: 0x1},
-		unicode.Range16{Lo: 0xabe5, Hi: 0xabe5, Stride: 0x1},
-		unicode.Range16{Lo: 0xabe8, Hi: 0xabe8, Stride: 0x1},
-		unicode.Range16{Lo: 0xabed, Hi: 0xabed, Stride: 0x1},
-		unicode.Range16{Lo: 0xfb1e, Hi: 0xfb1e, Stride: 0x1},
-		unicode.Range16{Lo: 0xfe00, Hi: 0xfe0f, Stride: 0x1},
-		unicode.Range16{Lo: 0xfe20, Hi: 0xfe2f, Stride: 0x1},
-		unicode.Range16{Lo: 0xff9e, Hi: 0xff9f, Stride: 0x1},
-	},
-	R32: []unicode.Range32{
-		unicode.Range32{Lo: 0x101fd, Hi: 0x101fd, Stride: 0x1},
-		unicode.Range32{Lo: 0x102e0, Hi: 0x102e0, Stride: 0x1},
-		unicode.Range32{Lo: 0x10376, Hi: 0x1037a, Stride: 0x1},
-		unicode.Range32{Lo: 0x10a01, Hi: 0x10a03, Stride: 0x1},
-		unicode.Range32{Lo: 0x10a05, Hi: 0x10a06, Stride: 0x1},
-		unicode.Range32{Lo: 0x10a0c, Hi: 0x10a0f, Stride: 0x1},
-		unicode.Range32{Lo: 0x10a38, Hi: 0x10a3a, Stride: 0x1},
-		unicode.Range32{Lo: 0x10a3f, Hi: 0x10a3f, Stride: 0x1},
-		unicode.Range32{Lo: 0x10ae5, Hi: 0x10ae6, Stride: 0x1},
-		unicode.Range32{Lo: 0x10d24, Hi: 0x10d27, Stride: 0x1},
-		unicode.Range32{Lo: 0x10f46, Hi: 0x10f50, Stride: 0x1},
-		unicode.Range32{Lo: 0x11001, Hi: 0x11001, Stride: 0x1},
-		unicode.Range32{Lo: 0x11038, Hi: 0x11046, Stride: 0x1},
-		unicode.Range32{Lo: 0x1107f, Hi: 0x11081, Stride: 0x1},
-		unicode.Range32{Lo: 0x110b3, Hi: 0x110b6, Stride: 0x1},
-		unicode.Range32{Lo: 0x110b9, Hi: 0x110ba, Stride: 0x1},
-		unicode.Range32{Lo: 0x11100, Hi: 0x11102, Stride: 0x1},
-		unicode.Range32{Lo: 0x11127, Hi: 0x1112b, Stride: 0x1},
-		unicode.Range32{Lo: 0x1112d, Hi: 0x11134, Stride: 0x1},
-		unicode.Range32{Lo: 0x11173, Hi: 0x11173, Stride: 0x1},
-		unicode.Range32{Lo: 0x11180, Hi: 0x11181, Stride: 0x1},
-		unicode.Range32{Lo: 0x111b6, Hi: 0x111be, Stride: 0x1},
-		unicode.Range32{Lo: 0x111c9, Hi: 0x111cc, Stride: 0x1},
-		unicode.Range32{Lo: 0x1122f, Hi: 0x11231, Stride: 0x1},
-		unicode.Range32{Lo: 0x11234, Hi: 0x11234, Stride: 0x1},
-		unicode.Range32{Lo: 0x11236, Hi: 0x11237, Stride: 0x1},
-		unicode.Range32{Lo: 0x1123e, Hi: 0x1123e, Stride: 0x1},
-		unicode.Range32{Lo: 0x112df, Hi: 0x112df, Stride: 0x1},
-		unicode.Range32{Lo: 0x112e3, Hi: 0x112ea, Stride: 0x1},
-		unicode.Range32{Lo: 0x11300, Hi: 0x11301, Stride: 0x1},
-		unicode.Range32{Lo: 0x1133b, Hi: 0x1133c, Stride: 0x1},
-		unicode.Range32{Lo: 0x1133e, Hi: 0x1133e, Stride: 0x1},
-		unicode.Range32{Lo: 0x11340, Hi: 0x11340, Stride: 0x1},
-		unicode.Range32{Lo: 0x11357, Hi: 0x11357, Stride: 0x1},
-		unicode.Range32{Lo: 0x11366, Hi: 0x1136c, Stride: 0x1},
-		unicode.Range32{Lo: 0x11370, Hi: 0x11374, Stride: 0x1},
-		unicode.Range32{Lo: 0x11438, Hi: 0x1143f, Stride: 0x1},
-		unicode.Range32{Lo: 0x11442, Hi: 0x11444, Stride: 0x1},
-		unicode.Range32{Lo: 0x11446, Hi: 0x11446, Stride: 0x1},
-		unicode.Range32{Lo: 0x1145e, Hi: 0x1145e, Stride: 0x1},
-		unicode.Range32{Lo: 0x114b0, Hi: 0x114b0, Stride: 0x1},
-		unicode.Range32{Lo: 0x114b3, Hi: 0x114b8, Stride: 0x1},
-		unicode.Range32{Lo: 0x114ba, Hi: 0x114ba, Stride: 0x1},
-		unicode.Range32{Lo: 0x114bd, Hi: 0x114bd, Stride: 0x1},
-		unicode.Range32{Lo: 0x114bf, Hi: 0x114c0, Stride: 0x1},
-		unicode.Range32{Lo: 0x114c2, Hi: 0x114c3, Stride: 0x1},
-		unicode.Range32{Lo: 0x115af, Hi: 0x115af, Stride: 0x1},
-		unicode.Range32{Lo: 0x115b2, Hi: 0x115b5, Stride: 0x1},
-		unicode.Range32{Lo: 0x115bc, Hi: 0x115bd, Stride: 0x1},
-		unicode.Range32{Lo: 0x115bf, Hi: 0x115c0, Stride: 0x1},
-		unicode.Range32{Lo: 0x115dc, Hi: 0x115dd, Stride: 0x1},
-		unicode.Range32{Lo: 0x11633, Hi: 0x1163a, Stride: 0x1},
-		unicode.Range32{Lo: 0x1163d, Hi: 0x1163d, Stride: 0x1},
-		unicode.Range32{Lo: 0x1163f, Hi: 0x11640, Stride: 0x1},
-		unicode.Range32{Lo: 0x116ab, Hi: 0x116ab, Stride: 0x1},
-		unicode.Range32{Lo: 0x116ad, Hi: 0x116ad, Stride: 0x1},
-		unicode.Range32{Lo: 0x116b0, Hi: 0x116b5, Stride: 0x1},
-		unicode.Range32{Lo: 0x116b7, Hi: 0x116b7, Stride: 0x1},
-		unicode.Range32{Lo: 0x1171d, Hi: 0x1171f, Stride: 0x1},
-		unicode.Range32{Lo: 0x11722, Hi: 0x11725, Stride: 0x1},
-		unicode.Range32{Lo: 0x11727, Hi: 0x1172b, Stride: 0x1},
-		unicode.Range32{Lo: 0x1182f, Hi: 0x11837, Stride: 0x1},
-		unicode.Range32{Lo: 0x11839, Hi: 0x1183a, Stride: 0x1},
-		unicode.Range32{Lo: 0x119d4, Hi: 0x119d7, Stride: 0x1},
-		unicode.Range32{Lo: 0x119da, Hi: 0x119db, Stride: 0x1},
-		unicode.Range32{Lo: 0x119e0, Hi: 0x119e0, Stride: 0x1},
-		unicode.Range32{Lo: 0x11a01, Hi: 0x11a0a, Stride: 0x1},
-		unicode.Range32{Lo: 0x11a33, Hi: 0x11a38, Stride: 0x1},
-		unicode.Range32{Lo: 0x11a3b, Hi: 0x11a3e, Stride: 0x1},
-		unicode.Range32{Lo: 0x11a47, Hi: 0x11a47, Stride: 0x1},
-		unicode.Range32{Lo: 0x11a51, Hi: 0x11a56, Stride: 0x1},
-		unicode.Range32{Lo: 0x11a59, Hi: 0x11a5b, Stride: 0x1},
-		unicode.Range32{Lo: 0x11a8a, Hi: 0x11a96, Stride: 0x1},
-		unicode.Range32{Lo: 0x11a98, Hi: 0x11a99, Stride: 0x1},
-		unicode.Range32{Lo: 0x11c30, Hi: 0x11c36, Stride: 0x1},
-		unicode.Range32{Lo: 0x11c38, Hi: 0x11c3d, Stride: 0x1},
-		unicode.Range32{Lo: 0x11c3f, Hi: 0x11c3f, Stride: 0x1},
-		unicode.Range32{Lo: 0x11c92, Hi: 0x11ca7, Stride: 0x1},
-		unicode.Range32{Lo: 0x11caa, Hi: 0x11cb0, Stride: 0x1},
-		unicode.Range32{Lo: 0x11cb2, Hi: 0x11cb3, Stride: 0x1},
-		unicode.Range32{Lo: 0x11cb5, Hi: 0x11cb6, Stride: 0x1},
-		unicode.Range32{Lo: 0x11d31, Hi: 0x11d36, Stride: 0x1},
-		unicode.Range32{Lo: 0x11d3a, Hi: 0x11d3a, Stride: 0x1},
-		unicode.Range32{Lo: 0x11d3c, Hi: 0x11d3d, Stride: 0x1},
-		unicode.Range32{Lo: 0x11d3f, Hi: 0x11d45, Stride: 0x1},
-		unicode.Range32{Lo: 0x11d47, Hi: 0x11d47, Stride: 0x1},
-		unicode.Range32{Lo: 0x11d90, Hi: 0x11d91, Stride: 0x1},
-		unicode.Range32{Lo: 0x11d95, Hi: 0x11d95, Stride: 0x1},
-		unicode.Range32{Lo: 0x11d97, Hi: 0x11d97, Stride: 0x1},
-		unicode.Range32{Lo: 0x11ef3, Hi: 0x11ef4, Stride: 0x1},
-		unicode.Range32{Lo: 0x16af0, Hi: 0x16af4, Stride: 0x1},
-		unicode.Range32{Lo: 0x16b30, Hi: 0x16b36, Stride: 0x1},
-		unicode.Range32{Lo: 0x16f4f, Hi: 0x16f4f, Stride: 0x1},
-		unicode.Range32{Lo: 0x16f8f, Hi: 0x16f92, Stride: 0x1},
-		unicode.Range32{Lo: 0x1bc9d, Hi: 0x1bc9e, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d165, Hi: 0x1d165, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d167, Hi: 0x1d169, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d16e, Hi: 0x1d172, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d17b, Hi: 0x1d182, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d185, Hi: 0x1d18b, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d1aa, Hi: 0x1d1ad, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d242, Hi: 0x1d244, Stride: 0x1},
-		unicode.Range32{Lo: 0x1da00, Hi: 0x1da36, Stride: 0x1},
-		unicode.Range32{Lo: 0x1da3b, Hi: 0x1da6c, Stride: 0x1},
-		unicode.Range32{Lo: 0x1da75, Hi: 0x1da75, Stride: 0x1},
-		unicode.Range32{Lo: 0x1da84, Hi: 0x1da84, Stride: 0x1},
-		unicode.Range32{Lo: 0x1da9b, Hi: 0x1da9f, Stride: 0x1},
-		unicode.Range32{Lo: 0x1daa1, Hi: 0x1daaf, Stride: 0x1},
-		unicode.Range32{Lo: 0x1e000, Hi: 0x1e006, Stride: 0x1},
-		unicode.Range32{Lo: 0x1e008, Hi: 0x1e018, Stride: 0x1},
-		unicode.Range32{Lo: 0x1e01b, Hi: 0x1e021, Stride: 0x1},
-		unicode.Range32{Lo: 0x1e023, Hi: 0x1e024, Stride: 0x1},
-		unicode.Range32{Lo: 0x1e026, Hi: 0x1e02a, Stride: 0x1},
-		unicode.Range32{Lo: 0x1e130, Hi: 0x1e136, Stride: 0x1},
-		unicode.Range32{Lo: 0x1e2ec, Hi: 0x1e2ef, Stride: 0x1},
-		unicode.Range32{Lo: 0x1e8d0, Hi: 0x1e8d6, Stride: 0x1},
-		unicode.Range32{Lo: 0x1e944, Hi: 0x1e94a, Stride: 0x1},
-		unicode.Range32{Lo: 0x1f3fb, Hi: 0x1f3ff, Stride: 0x1},
-		unicode.Range32{Lo: 0xe0020, Hi: 0xe007f, Stride: 0x1},
-		unicode.Range32{Lo: 0xe0100, Hi: 0xe01ef, Stride: 0x1},
-	},
-	LatinOffset: 0,
-}
-
-var _GraphemeL = &unicode.RangeTable{
-	R16: []unicode.Range16{
-		unicode.Range16{Lo: 0x1100, Hi: 0x115f, Stride: 0x1},
-		unicode.Range16{Lo: 0xa960, Hi: 0xa97c, Stride: 0x1},
-	},
-	LatinOffset: 0,
-}
-
-var _GraphemeLF = &unicode.RangeTable{
-	R16: []unicode.Range16{
-		unicode.Range16{Lo: 0xa, Hi: 0xa, Stride: 0x1},
-	},
-	LatinOffset: 1,
-}
-
-var _GraphemeLV = &unicode.RangeTable{
-	R16: []unicode.Range16{
-		unicode.Range16{Lo: 0xac00, Hi: 0xac00, Stride: 0x1},
-		unicode.Range16{Lo: 0xac1c, Hi: 0xac1c, Stride: 0x1},
-		unicode.Range16{Lo: 0xac38, Hi: 0xac38, Stride: 0x1},
-		unicode.Range16{Lo: 0xac54, Hi: 0xac54, Stride: 0x1},
-		unicode.Range16{Lo: 0xac70, Hi: 0xac70, Stride: 0x1},
-		unicode.Range16{Lo: 0xac8c, Hi: 0xac8c, Stride: 0x1},
-		unicode.Range16{Lo: 0xaca8, Hi: 0xaca8, Stride: 0x1},
-		unicode.Range16{Lo: 0xacc4, Hi: 0xacc4, Stride: 0x1},
-		unicode.Range16{Lo: 0xace0, Hi: 0xace0, Stride: 0x1},
-		unicode.Range16{Lo: 0xacfc, Hi: 0xacfc, Stride: 0x1},
-		unicode.Range16{Lo: 0xad18, Hi: 0xad18, Stride: 0x1},
-		unicode.Range16{Lo: 0xad34, Hi: 0xad34, Stride: 0x1},
-		unicode.Range16{Lo: 0xad50, Hi: 0xad50, Stride: 0x1},
-		unicode.Range16{Lo: 0xad6c, Hi: 0xad6c, Stride: 0x1},
-		unicode.Range16{Lo: 0xad88, Hi: 0xad88, Stride: 0x1},
-		unicode.Range16{Lo: 0xada4, Hi: 0xada4, Stride: 0x1},
-		unicode.Range16{Lo: 0xadc0, Hi: 0xadc0, Stride: 0x1},
-		unicode.Range16{Lo: 0xaddc, Hi: 0xaddc, Stride: 0x1},
-		unicode.Range16{Lo: 0xadf8, Hi: 0xadf8, Stride: 0x1},
-		unicode.Range16{Lo: 0xae14, Hi: 0xae14, Stride: 0x1},
-		unicode.Range16{Lo: 0xae30, Hi: 0xae30, Stride: 0x1},
-		unicode.Range16{Lo: 0xae4c, Hi: 0xae4c, Stride: 0x1},
-		unicode.Range16{Lo: 0xae68, Hi: 0xae68, Stride: 0x1},
-		unicode.Range16{Lo: 0xae84, Hi: 0xae84, Stride: 0x1},
-		unicode.Range16{Lo: 0xaea0, Hi: 0xaea0, Stride: 0x1},
-		unicode.Range16{Lo: 0xaebc, Hi: 0xaebc, Stride: 0x1},
-		unicode.Range16{Lo: 0xaed8, Hi: 0xaed8, Stride: 0x1},
-		unicode.Range16{Lo: 0xaef4, Hi: 0xaef4, Stride: 0x1},
-		unicode.Range16{Lo: 0xaf10, Hi: 0xaf10, Stride: 0x1},
-		unicode.Range16{Lo: 0xaf2c, Hi: 0xaf2c, Stride: 0x1},
-		unicode.Range16{Lo: 0xaf48, Hi: 0xaf48, Stride: 0x1},
-		unicode.Range16{Lo: 0xaf64, Hi: 0xaf64, Stride: 0x1},
-		unicode.Range16{Lo: 0xaf80, Hi: 0xaf80, Stride: 0x1},
-		unicode.Range16{Lo: 0xaf9c, Hi: 0xaf9c, Stride: 0x1},
-		unicode.Range16{Lo: 0xafb8, Hi: 0xafb8, Stride: 0x1},
-		unicode.Range16{Lo: 0xafd4, Hi: 0xafd4, Stride: 0x1},
-		unicode.Range16{Lo: 0xaff0, Hi: 0xaff0, Stride: 0x1},
-		unicode.Range16{Lo: 0xb00c, Hi: 0xb00c, Stride: 0x1},
-		unicode.Range16{Lo: 0xb028, Hi: 0xb028, Stride: 0x1},
-		unicode.Range16{Lo: 0xb044, Hi: 0xb044, Stride: 0x1},
-		unicode.Range16{Lo: 0xb060, Hi: 0xb060, Stride: 0x1},
-		unicode.Range16{Lo: 0xb07c, Hi: 0xb07c, Stride: 0x1},
-		unicode.Range16{Lo: 0xb098, Hi: 0xb098, Stride: 0x1},
-		unicode.Range16{Lo: 0xb0b4, Hi: 0xb0b4, Stride: 0x1},
-		unicode.Range16{Lo: 0xb0d0, Hi: 0xb0d0, Stride: 0x1},
-		unicode.Range16{Lo: 0xb0ec, Hi: 0xb0ec, Stride: 0x1},
-		unicode.Range16{Lo: 0xb108, Hi: 0xb108, Stride: 0x1},
-		unicode.Range16{Lo: 0xb124, Hi: 0xb124, Stride: 0x1},
-		unicode.Range16{Lo: 0xb140, Hi: 0xb140, Stride: 0x1},
-		unicode.Range16{Lo: 0xb15c, Hi: 0xb15c, Stride: 0x1},
-		unicode.Range16{Lo: 0xb178, Hi: 0xb178, Stride: 0x1},
-		unicode.Range16{Lo: 0xb194, Hi: 0xb194, Stride: 0x1},
-		unicode.Range16{Lo: 0xb1b0, Hi: 0xb1b0, Stride: 0x1},
-		unicode.Range16{Lo: 0xb1cc, Hi: 0xb1cc, Stride: 0x1},
-		unicode.Range16{Lo: 0xb1e8, Hi: 0xb1e8, Stride: 0x1},
-		unicode.Range16{Lo: 0xb204, Hi: 0xb204, Stride: 0x1},
-		unicode.Range16{Lo: 0xb220, Hi: 0xb220, Stride: 0x1},
-		unicode.Range16{Lo: 0xb23c, Hi: 0xb23c, Stride: 0x1},
-		unicode.Range16{Lo: 0xb258, Hi: 0xb258, Stride: 0x1},
-		unicode.Range16{Lo: 0xb274, Hi: 0xb274, Stride: 0x1},
-		unicode.Range16{Lo: 0xb290, Hi: 0xb290, Stride: 0x1},
-		unicode.Range16{Lo: 0xb2ac, Hi: 0xb2ac, Stride: 0x1},
-		unicode.Range16{Lo: 0xb2c8, Hi: 0xb2c8, Stride: 0x1},
-		unicode.Range16{Lo: 0xb2e4, Hi: 0xb2e4, Stride: 0x1},
-		unicode.Range16{Lo: 0xb300, Hi: 0xb300, Stride: 0x1},
-		unicode.Range16{Lo: 0xb31c, Hi: 0xb31c, Stride: 0x1},
-		unicode.Range16{Lo: 0xb338, Hi: 0xb338, Stride: 0x1},
-		unicode.Range16{Lo: 0xb354, Hi: 0xb354, Stride: 0x1},
-		unicode.Range16{Lo: 0xb370, Hi: 0xb370, Stride: 0x1},
-		unicode.Range16{Lo: 0xb38c, Hi: 0xb38c, Stride: 0x1},
-		unicode.Range16{Lo: 0xb3a8, Hi: 0xb3a8, Stride: 0x1},
-		unicode.Range16{Lo: 0xb3c4, Hi: 0xb3c4, Stride: 0x1},
-		unicode.Range16{Lo: 0xb3e0, Hi: 0xb3e0, Stride: 0x1},
-		unicode.Range16{Lo: 0xb3fc, Hi: 0xb3fc, Stride: 0x1},
-		unicode.Range16{Lo: 0xb418, Hi: 0xb418, Stride: 0x1},
-		unicode.Range16{Lo: 0xb434, Hi: 0xb434, Stride: 0x1},
-		unicode.Range16{Lo: 0xb450, Hi: 0xb450, Stride: 0x1},
-		unicode.Range16{Lo: 0xb46c, Hi: 0xb46c, Stride: 0x1},
-		unicode.Range16{Lo: 0xb488, Hi: 0xb488, Stride: 0x1},
-		unicode.Range16{Lo: 0xb4a4, Hi: 0xb4a4, Stride: 0x1},
-		unicode.Range16{Lo: 0xb4c0, Hi: 0xb4c0, Stride: 0x1},
-		unicode.Range16{Lo: 0xb4dc, Hi: 0xb4dc, Stride: 0x1},
-		unicode.Range16{Lo: 0xb4f8, Hi: 0xb4f8, Stride: 0x1},
-		unicode.Range16{Lo: 0xb514, Hi: 0xb514, Stride: 0x1},
-		unicode.Range16{Lo: 0xb530, Hi: 0xb530, Stride: 0x1},
-		unicode.Range16{Lo: 0xb54c, Hi: 0xb54c, Stride: 0x1},
-		unicode.Range16{Lo: 0xb568, Hi: 0xb568, Stride: 0x1},
-		unicode.Range16{Lo: 0xb584, Hi: 0xb584, Stride: 0x1},
-		unicode.Range16{Lo: 0xb5a0, Hi: 0xb5a0, Stride: 0x1},
-		unicode.Range16{Lo: 0xb5bc, Hi: 0xb5bc, Stride: 0x1},
-		unicode.Range16{Lo: 0xb5d8, Hi: 0xb5d8, Stride: 0x1},
-		unicode.Range16{Lo: 0xb5f4, Hi: 0xb5f4, Stride: 0x1},
-		unicode.Range16{Lo: 0xb610, Hi: 0xb610, Stride: 0x1},
-		unicode.Range16{Lo: 0xb62c, Hi: 0xb62c, Stride: 0x1},
-		unicode.Range16{Lo: 0xb648, Hi: 0xb648, Stride: 0x1},
-		unicode.Range16{Lo: 0xb664, Hi: 0xb664, Stride: 0x1},
-		unicode.Range16{Lo: 0xb680, Hi: 0xb680, Stride: 0x1},
-		unicode.Range16{Lo: 0xb69c, Hi: 0xb69c, Stride: 0x1},
-		unicode.Range16{Lo: 0xb6b8, Hi: 0xb6b8, Stride: 0x1},
-		unicode.Range16{Lo: 0xb6d4, Hi: 0xb6d4, Stride: 0x1},
-		unicode.Range16{Lo: 0xb6f0, Hi: 0xb6f0, Stride: 0x1},
-		unicode.Range16{Lo: 0xb70c, Hi: 0xb70c, Stride: 0x1},
-		unicode.Range16{Lo: 0xb728, Hi: 0xb728, Stride: 0x1},
-		unicode.Range16{Lo: 0xb744, Hi: 0xb744, Stride: 0x1},
-		unicode.Range16{Lo: 0xb760, Hi: 0xb760, Stride: 0x1},
-		unicode.Range16{Lo: 0xb77c, Hi: 0xb77c, Stride: 0x1},
-		unicode.Range16{Lo: 0xb798, Hi: 0xb798, Stride: 0x1},
-		unicode.Range16{Lo: 0xb7b4, Hi: 0xb7b4, Stride: 0x1},
-		unicode.Range16{Lo: 0xb7d0, Hi: 0xb7d0, Stride: 0x1},
-		unicode.Range16{Lo: 0xb7ec, Hi: 0xb7ec, Stride: 0x1},
-		unicode.Range16{Lo: 0xb808, Hi: 0xb808, Stride: 0x1},
-		unicode.Range16{Lo: 0xb824, Hi: 0xb824, Stride: 0x1},
-		unicode.Range16{Lo: 0xb840, Hi: 0xb840, Stride: 0x1},
-		unicode.Range16{Lo: 0xb85c, Hi: 0xb85c, Stride: 0x1},
-		unicode.Range16{Lo: 0xb878, Hi: 0xb878, Stride: 0x1},
-		unicode.Range16{Lo: 0xb894, Hi: 0xb894, Stride: 0x1},
-		unicode.Range16{Lo: 0xb8b0, Hi: 0xb8b0, Stride: 0x1},
-		unicode.Range16{Lo: 0xb8cc, Hi: 0xb8cc, Stride: 0x1},
-		unicode.Range16{Lo: 0xb8e8, Hi: 0xb8e8, Stride: 0x1},
-		unicode.Range16{Lo: 0xb904, Hi: 0xb904, Stride: 0x1},
-		unicode.Range16{Lo: 0xb920, Hi: 0xb920, Stride: 0x1},
-		unicode.Range16{Lo: 0xb93c, Hi: 0xb93c, Stride: 0x1},
-		unicode.Range16{Lo: 0xb958, Hi: 0xb958, Stride: 0x1},
-		unicode.Range16{Lo: 0xb974, Hi: 0xb974, Stride: 0x1},
-		unicode.Range16{Lo: 0xb990, Hi: 0xb990, Stride: 0x1},
-		unicode.Range16{Lo: 0xb9ac, Hi: 0xb9ac, Stride: 0x1},
-		unicode.Range16{Lo: 0xb9c8, Hi: 0xb9c8, Stride: 0x1},
-		unicode.Range16{Lo: 0xb9e4, Hi: 0xb9e4, Stride: 0x1},
-		unicode.Range16{Lo: 0xba00, Hi: 0xba00, Stride: 0x1},
-		unicode.Range16{Lo: 0xba1c, Hi: 0xba1c, Stride: 0x1},
-		unicode.Range16{Lo: 0xba38, Hi: 0xba38, Stride: 0x1},
-		unicode.Range16{Lo: 0xba54, Hi: 0xba54, Stride: 0x1},
-		unicode.Range16{Lo: 0xba70, Hi: 0xba70, Stride: 0x1},
-		unicode.Range16{Lo: 0xba8c, Hi: 0xba8c, Stride: 0x1},
-		unicode.Range16{Lo: 0xbaa8, Hi: 0xbaa8, Stride: 0x1},
-		unicode.Range16{Lo: 0xbac4, Hi: 0xbac4, Stride: 0x1},
-		unicode.Range16{Lo: 0xbae0, Hi: 0xbae0, Stride: 0x1},
-		unicode.Range16{Lo: 0xbafc, Hi: 0xbafc, Stride: 0x1},
-		unicode.Range16{Lo: 0xbb18, Hi: 0xbb18, Stride: 0x1},
-		unicode.Range16{Lo: 0xbb34, Hi: 0xbb34, Stride: 0x1},
-		unicode.Range16{Lo: 0xbb50, Hi: 0xbb50, Stride: 0x1},
-		unicode.Range16{Lo: 0xbb6c, Hi: 0xbb6c, Stride: 0x1},
-		unicode.Range16{Lo: 0xbb88, Hi: 0xbb88, Stride: 0x1},
-		unicode.Range16{Lo: 0xbba4, Hi: 0xbba4, Stride: 0x1},
-		unicode.Range16{Lo: 0xbbc0, Hi: 0xbbc0, Stride: 0x1},
-		unicode.Range16{Lo: 0xbbdc, Hi: 0xbbdc, Stride: 0x1},
-		unicode.Range16{Lo: 0xbbf8, Hi: 0xbbf8, Stride: 0x1},
-		unicode.Range16{Lo: 0xbc14, Hi: 0xbc14, Stride: 0x1},
-		unicode.Range16{Lo: 0xbc30, Hi: 0xbc30, Stride: 0x1},
-		unicode.Range16{Lo: 0xbc4c, Hi: 0xbc4c, Stride: 0x1},
-		unicode.Range16{Lo: 0xbc68, Hi: 0xbc68, Stride: 0x1},
-		unicode.Range16{Lo: 0xbc84, Hi: 0xbc84, Stride: 0x1},
-		unicode.Range16{Lo: 0xbca0, Hi: 0xbca0, Stride: 0x1},
-		unicode.Range16{Lo: 0xbcbc, Hi: 0xbcbc, Stride: 0x1},
-		unicode.Range16{Lo: 0xbcd8, Hi: 0xbcd8, Stride: 0x1},
-		unicode.Range16{Lo: 0xbcf4, Hi: 0xbcf4, Stride: 0x1},
-		unicode.Range16{Lo: 0xbd10, Hi: 0xbd10, Stride: 0x1},
-		unicode.Range16{Lo: 0xbd2c, Hi: 0xbd2c, Stride: 0x1},
-		unicode.Range16{Lo: 0xbd48, Hi: 0xbd48, Stride: 0x1},
-		unicode.Range16{Lo: 0xbd64, Hi: 0xbd64, Stride: 0x1},
-		unicode.Range16{Lo: 0xbd80, Hi: 0xbd80, Stride: 0x1},
-		unicode.Range16{Lo: 0xbd9c, Hi: 0xbd9c, Stride: 0x1},
-		unicode.Range16{Lo: 0xbdb8, Hi: 0xbdb8, Stride: 0x1},
-		unicode.Range16{Lo: 0xbdd4, Hi: 0xbdd4, Stride: 0x1},
-		unicode.Range16{Lo: 0xbdf0, Hi: 0xbdf0, Stride: 0x1},
-		unicode.Range16{Lo: 0xbe0c, Hi: 0xbe0c, Stride: 0x1},
-		unicode.Range16{Lo: 0xbe28, Hi: 0xbe28, Stride: 0x1},
-		unicode.Range16{Lo: 0xbe44, Hi: 0xbe44, Stride: 0x1},
-		unicode.Range16{Lo: 0xbe60, Hi: 0xbe60, Stride: 0x1},
-		unicode.Range16{Lo: 0xbe7c, Hi: 0xbe7c, Stride: 0x1},
-		unicode.Range16{Lo: 0xbe98, Hi: 0xbe98, Stride: 0x1},
-		unicode.Range16{Lo: 0xbeb4, Hi: 0xbeb4, Stride: 0x1},
-		unicode.Range16{Lo: 0xbed0, Hi: 0xbed0, Stride: 0x1},
-		unicode.Range16{Lo: 0xbeec, Hi: 0xbeec, Stride: 0x1},
-		unicode.Range16{Lo: 0xbf08, Hi: 0xbf08, Stride: 0x1},
-		unicode.Range16{Lo: 0xbf24, Hi: 0xbf24, Stride: 0x1},
-		unicode.Range16{Lo: 0xbf40, Hi: 0xbf40, Stride: 0x1},
-		unicode.Range16{Lo: 0xbf5c, Hi: 0xbf5c, Stride: 0x1},
-		unicode.Range16{Lo: 0xbf78, Hi: 0xbf78, Stride: 0x1},
-		unicode.Range16{Lo: 0xbf94, Hi: 0xbf94, Stride: 0x1},
-		unicode.Range16{Lo: 0xbfb0, Hi: 0xbfb0, Stride: 0x1},
-		unicode.Range16{Lo: 0xbfcc, Hi: 0xbfcc, Stride: 0x1},
-		unicode.Range16{Lo: 0xbfe8, Hi: 0xbfe8, Stride: 0x1},
-		unicode.Range16{Lo: 0xc004, Hi: 0xc004, Stride: 0x1},
-		unicode.Range16{Lo: 0xc020, Hi: 0xc020, Stride: 0x1},
-		unicode.Range16{Lo: 0xc03c, Hi: 0xc03c, Stride: 0x1},
-		unicode.Range16{Lo: 0xc058, Hi: 0xc058, Stride: 0x1},
-		unicode.Range16{Lo: 0xc074, Hi: 0xc074, Stride: 0x1},
-		unicode.Range16{Lo: 0xc090, Hi: 0xc090, Stride: 0x1},
-		unicode.Range16{Lo: 0xc0ac, Hi: 0xc0ac, Stride: 0x1},
-		unicode.Range16{Lo: 0xc0c8, Hi: 0xc0c8, Stride: 0x1},
-		unicode.Range16{Lo: 0xc0e4, Hi: 0xc0e4, Stride: 0x1},
-		unicode.Range16{Lo: 0xc100, Hi: 0xc100, Stride: 0x1},
-		unicode.Range16{Lo: 0xc11c, Hi: 0xc11c, Stride: 0x1},
-		unicode.Range16{Lo: 0xc138, Hi: 0xc138, Stride: 0x1},
-		unicode.Range16{Lo: 0xc154, Hi: 0xc154, Stride: 0x1},
-		unicode.Range16{Lo: 0xc170, Hi: 0xc170, Stride: 0x1},
-		unicode.Range16{Lo: 0xc18c, Hi: 0xc18c, Stride: 0x1},
-		unicode.Range16{Lo: 0xc1a8, Hi: 0xc1a8, Stride: 0x1},
-		unicode.Range16{Lo: 0xc1c4, Hi: 0xc1c4, Stride: 0x1},
-		unicode.Range16{Lo: 0xc1e0, Hi: 0xc1e0, Stride: 0x1},
-		unicode.Range16{Lo: 0xc1fc, Hi: 0xc1fc, Stride: 0x1},
-		unicode.Range16{Lo: 0xc218, Hi: 0xc218, Stride: 0x1},
-		unicode.Range16{Lo: 0xc234, Hi: 0xc234, Stride: 0x1},
-		unicode.Range16{Lo: 0xc250, Hi: 0xc250, Stride: 0x1},
-		unicode.Range16{Lo: 0xc26c, Hi: 0xc26c, Stride: 0x1},
-		unicode.Range16{Lo: 0xc288, Hi: 0xc288, Stride: 0x1},
-		unicode.Range16{Lo: 0xc2a4, Hi: 0xc2a4, Stride: 0x1},
-		unicode.Range16{Lo: 0xc2c0, Hi: 0xc2c0, Stride: 0x1},
-		unicode.Range16{Lo: 0xc2dc, Hi: 0xc2dc, Stride: 0x1},
-		unicode.Range16{Lo: 0xc2f8, Hi: 0xc2f8, Stride: 0x1},
-		unicode.Range16{Lo: 0xc314, Hi: 0xc314, Stride: 0x1},
-		unicode.Range16{Lo: 0xc330, Hi: 0xc330, Stride: 0x1},
-		unicode.Range16{Lo: 0xc34c, Hi: 0xc34c, Stride: 0x1},
-		unicode.Range16{Lo: 0xc368, Hi: 0xc368, Stride: 0x1},
-		unicode.Range16{Lo: 0xc384, Hi: 0xc384, Stride: 0x1},
-		unicode.Range16{Lo: 0xc3a0, Hi: 0xc3a0, Stride: 0x1},
-		unicode.Range16{Lo: 0xc3bc, Hi: 0xc3bc, Stride: 0x1},
-		unicode.Range16{Lo: 0xc3d8, Hi: 0xc3d8, Stride: 0x1},
-		unicode.Range16{Lo: 0xc3f4, Hi: 0xc3f4, Stride: 0x1},
-		unicode.Range16{Lo: 0xc410, Hi: 0xc410, Stride: 0x1},
-		unicode.Range16{Lo: 0xc42c, Hi: 0xc42c, Stride: 0x1},
-		unicode.Range16{Lo: 0xc448, Hi: 0xc448, Stride: 0x1},
-		unicode.Range16{Lo: 0xc464, Hi: 0xc464, Stride: 0x1},
-		unicode.Range16{Lo: 0xc480, Hi: 0xc480, Stride: 0x1},
-		unicode.Range16{Lo: 0xc49c, Hi: 0xc49c, Stride: 0x1},
-		unicode.Range16{Lo: 0xc4b8, Hi: 0xc4b8, Stride: 0x1},
-		unicode.Range16{Lo: 0xc4d4, Hi: 0xc4d4, Stride: 0x1},
-		unicode.Range16{Lo: 0xc4f0, Hi: 0xc4f0, Stride: 0x1},
-		unicode.Range16{Lo: 0xc50c, Hi: 0xc50c, Stride: 0x1},
-		unicode.Range16{Lo: 0xc528, Hi: 0xc528, Stride: 0x1},
-		unicode.Range16{Lo: 0xc544, Hi: 0xc544, Stride: 0x1},
-		unicode.Range16{Lo: 0xc560, Hi: 0xc560, Stride: 0x1},
-		unicode.Range16{Lo: 0xc57c, Hi: 0xc57c, Stride: 0x1},
-		unicode.Range16{Lo: 0xc598, Hi: 0xc598, Stride: 0x1},
-		unicode.Range16{Lo: 0xc5b4, Hi: 0xc5b4, Stride: 0x1},
-		unicode.Range16{Lo: 0xc5d0, Hi: 0xc5d0, Stride: 0x1},
-		unicode.Range16{Lo: 0xc5ec, Hi: 0xc5ec, Stride: 0x1},
-		unicode.Range16{Lo: 0xc608, Hi: 0xc608, Stride: 0x1},
-		unicode.Range16{Lo: 0xc624, Hi: 0xc624, Stride: 0x1},
-		unicode.Range16{Lo: 0xc640, Hi: 0xc640, Stride: 0x1},
-		unicode.Range16{Lo: 0xc65c, Hi: 0xc65c, Stride: 0x1},
-		unicode.Range16{Lo: 0xc678, Hi: 0xc678, Stride: 0x1},
-		unicode.Range16{Lo: 0xc694, Hi: 0xc694, Stride: 0x1},
-		unicode.Range16{Lo: 0xc6b0, Hi: 0xc6b0, Stride: 0x1},
-		unicode.Range16{Lo: 0xc6cc, Hi: 0xc6cc, Stride: 0x1},
-		unicode.Range16{Lo: 0xc6e8, Hi: 0xc6e8, Stride: 0x1},
-		unicode.Range16{Lo: 0xc704, Hi: 0xc704, Stride: 0x1},
-		unicode.Range16{Lo: 0xc720, Hi: 0xc720, Stride: 0x1},
-		unicode.Range16{Lo: 0xc73c, Hi: 0xc73c, Stride: 0x1},
-		unicode.Range16{Lo: 0xc758, Hi: 0xc758, Stride: 0x1},
-		unicode.Range16{Lo: 0xc774, Hi: 0xc774, Stride: 0x1},
-		unicode.Range16{Lo: 0xc790, Hi: 0xc790, Stride: 0x1},
-		unicode.Range16{Lo: 0xc7ac, Hi: 0xc7ac, Stride: 0x1},
-		unicode.Range16{Lo: 0xc7c8, Hi: 0xc7c8, Stride: 0x1},
-		unicode.Range16{Lo: 0xc7e4, Hi: 0xc7e4, Stride: 0x1},
-		unicode.Range16{Lo: 0xc800, Hi: 0xc800, Stride: 0x1},
-		unicode.Range16{Lo: 0xc81c, Hi: 0xc81c, Stride: 0x1},
-		unicode.Range16{Lo: 0xc838, Hi: 0xc838, Stride: 0x1},
-		unicode.Range16{Lo: 0xc854, Hi: 0xc854, Stride: 0x1},
-		unicode.Range16{Lo: 0xc870, Hi: 0xc870, Stride: 0x1},
-		unicode.Range16{Lo: 0xc88c, Hi: 0xc88c, Stride: 0x1},
-		unicode.Range16{Lo: 0xc8a8, Hi: 0xc8a8, Stride: 0x1},
-		unicode.Range16{Lo: 0xc8c4, Hi: 0xc8c4, Stride: 0x1},
-		unicode.Range16{Lo: 0xc8e0, Hi: 0xc8e0, Stride: 0x1},
-		unicode.Range16{Lo: 0xc8fc, Hi: 0xc8fc, Stride: 0x1},
-		unicode.Range16{Lo: 0xc918, Hi: 0xc918, Stride: 0x1},
-		unicode.Range16{Lo: 0xc934, Hi: 0xc934, Stride: 0x1},
-		unicode.Range16{Lo: 0xc950, Hi: 0xc950, Stride: 0x1},
-		unicode.Range16{Lo: 0xc96c, Hi: 0xc96c, Stride: 0x1},
-		unicode.Range16{Lo: 0xc988, Hi: 0xc988, Stride: 0x1},
-		unicode.Range16{Lo: 0xc9a4, Hi: 0xc9a4, Stride: 0x1},
-		unicode.Range16{Lo: 0xc9c0, Hi: 0xc9c0, Stride: 0x1},
-		unicode.Range16{Lo: 0xc9dc, Hi: 0xc9dc, Stride: 0x1},
-		unicode.Range16{Lo: 0xc9f8, Hi: 0xc9f8, Stride: 0x1},
-		unicode.Range16{Lo: 0xca14, Hi: 0xca14, Stride: 0x1},
-		unicode.Range16{Lo: 0xca30, Hi: 0xca30, Stride: 0x1},
-		unicode.Range16{Lo: 0xca4c, Hi: 0xca4c, Stride: 0x1},
-		unicode.Range16{Lo: 0xca68, Hi: 0xca68, Stride: 0x1},
-		unicode.Range16{Lo: 0xca84, Hi: 0xca84, Stride: 0x1},
-		unicode.Range16{Lo: 0xcaa0, Hi: 0xcaa0, Stride: 0x1},
-		unicode.Range16{Lo: 0xcabc, Hi: 0xcabc, Stride: 0x1},
-		unicode.Range16{Lo: 0xcad8, Hi: 0xcad8, Stride: 0x1},
-		unicode.Range16{Lo: 0xcaf4, Hi: 0xcaf4, Stride: 0x1},
-		unicode.Range16{Lo: 0xcb10, Hi: 0xcb10, Stride: 0x1},
-		unicode.Range16{Lo: 0xcb2c, Hi: 0xcb2c, Stride: 0x1},
-		unicode.Range16{Lo: 0xcb48, Hi: 0xcb48, Stride: 0x1},
-		unicode.Range16{Lo: 0xcb64, Hi: 0xcb64, Stride: 0x1},
-		unicode.Range16{Lo: 0xcb80, Hi: 0xcb80, Stride: 0x1},
-		unicode.Range16{Lo: 0xcb9c, Hi: 0xcb9c, Stride: 0x1},
-		unicode.Range16{Lo: 0xcbb8, Hi: 0xcbb8, Stride: 0x1},
-		unicode.Range16{Lo: 0xcbd4, Hi: 0xcbd4, Stride: 0x1},
-		unicode.Range16{Lo: 0xcbf0, Hi: 0xcbf0, Stride: 0x1},
-		unicode.Range16{Lo: 0xcc0c, Hi: 0xcc0c, Stride: 0x1},
-		unicode.Range16{Lo: 0xcc28, Hi: 0xcc28, Stride: 0x1},
-		unicode.Range16{Lo: 0xcc44, Hi: 0xcc44, Stride: 0x1},
-		unicode.Range16{Lo: 0xcc60, Hi: 0xcc60, Stride: 0x1},
-		unicode.Range16{Lo: 0xcc7c, Hi: 0xcc7c, Stride: 0x1},
-		unicode.Range16{Lo: 0xcc98, Hi: 0xcc98, Stride: 0x1},
-		unicode.Range16{Lo: 0xccb4, Hi: 0xccb4, Stride: 0x1},
-		unicode.Range16{Lo: 0xccd0, Hi: 0xccd0, Stride: 0x1},
-		unicode.Range16{Lo: 0xccec, Hi: 0xccec, Stride: 0x1},
-		unicode.Range16{Lo: 0xcd08, Hi: 0xcd08, Stride: 0x1},
-		unicode.Range16{Lo: 0xcd24, Hi: 0xcd24, Stride: 0x1},
-		unicode.Range16{Lo: 0xcd40, Hi: 0xcd40, Stride: 0x1},
-		unicode.Range16{Lo: 0xcd5c, Hi: 0xcd5c, Stride: 0x1},
-		unicode.Range16{Lo: 0xcd78, Hi: 0xcd78, Stride: 0x1},
-		unicode.Range16{Lo: 0xcd94, Hi: 0xcd94, Stride: 0x1},
-		unicode.Range16{Lo: 0xcdb0, Hi: 0xcdb0, Stride: 0x1},
-		unicode.Range16{Lo: 0xcdcc, Hi: 0xcdcc, Stride: 0x1},
-		unicode.Range16{Lo: 0xcde8, Hi: 0xcde8, Stride: 0x1},
-		unicode.Range16{Lo: 0xce04, Hi: 0xce04, Stride: 0x1},
-		unicode.Range16{Lo: 0xce20, Hi: 0xce20, Stride: 0x1},
-		unicode.Range16{Lo: 0xce3c, Hi: 0xce3c, Stride: 0x1},
-		unicode.Range16{Lo: 0xce58, Hi: 0xce58, Stride: 0x1},
-		unicode.Range16{Lo: 0xce74, Hi: 0xce74, Stride: 0x1},
-		unicode.Range16{Lo: 0xce90, Hi: 0xce90, Stride: 0x1},
-		unicode.Range16{Lo: 0xceac, Hi: 0xceac, Stride: 0x1},
-		unicode.Range16{Lo: 0xcec8, Hi: 0xcec8, Stride: 0x1},
-		unicode.Range16{Lo: 0xcee4, Hi: 0xcee4, Stride: 0x1},
-		unicode.Range16{Lo: 0xcf00, Hi: 0xcf00, Stride: 0x1},
-		unicode.Range16{Lo: 0xcf1c, Hi: 0xcf1c, Stride: 0x1},
-		unicode.Range16{Lo: 0xcf38, Hi: 0xcf38, Stride: 0x1},
-		unicode.Range16{Lo: 0xcf54, Hi: 0xcf54, Stride: 0x1},
-		unicode.Range16{Lo: 0xcf70, Hi: 0xcf70, Stride: 0x1},
-		unicode.Range16{Lo: 0xcf8c, Hi: 0xcf8c, Stride: 0x1},
-		unicode.Range16{Lo: 0xcfa8, Hi: 0xcfa8, Stride: 0x1},
-		unicode.Range16{Lo: 0xcfc4, Hi: 0xcfc4, Stride: 0x1},
-		unicode.Range16{Lo: 0xcfe0, Hi: 0xcfe0, Stride: 0x1},
-		unicode.Range16{Lo: 0xcffc, Hi: 0xcffc, Stride: 0x1},
-		unicode.Range16{Lo: 0xd018, Hi: 0xd018, Stride: 0x1},
-		unicode.Range16{Lo: 0xd034, Hi: 0xd034, Stride: 0x1},
-		unicode.Range16{Lo: 0xd050, Hi: 0xd050, Stride: 0x1},
-		unicode.Range16{Lo: 0xd06c, Hi: 0xd06c, Stride: 0x1},
-		unicode.Range16{Lo: 0xd088, Hi: 0xd088, Stride: 0x1},
-		unicode.Range16{Lo: 0xd0a4, Hi: 0xd0a4, Stride: 0x1},
-		unicode.Range16{Lo: 0xd0c0, Hi: 0xd0c0, Stride: 0x1},
-		unicode.Range16{Lo: 0xd0dc, Hi: 0xd0dc, Stride: 0x1},
-		unicode.Range16{Lo: 0xd0f8, Hi: 0xd0f8, Stride: 0x1},
-		unicode.Range16{Lo: 0xd114, Hi: 0xd114, Stride: 0x1},
-		unicode.Range16{Lo: 0xd130, Hi: 0xd130, Stride: 0x1},
-		unicode.Range16{Lo: 0xd14c, Hi: 0xd14c, Stride: 0x1},
-		unicode.Range16{Lo: 0xd168, Hi: 0xd168, Stride: 0x1},
-		unicode.Range16{Lo: 0xd184, Hi: 0xd184, Stride: 0x1},
-		unicode.Range16{Lo: 0xd1a0, Hi: 0xd1a0, Stride: 0x1},
-		unicode.Range16{Lo: 0xd1bc, Hi: 0xd1bc, Stride: 0x1},
-		unicode.Range16{Lo: 0xd1d8, Hi: 0xd1d8, Stride: 0x1},
-		unicode.Range16{Lo: 0xd1f4, Hi: 0xd1f4, Stride: 0x1},
-		unicode.Range16{Lo: 0xd210, Hi: 0xd210, Stride: 0x1},
-		unicode.Range16{Lo: 0xd22c, Hi: 0xd22c, Stride: 0x1},
-		unicode.Range16{Lo: 0xd248, Hi: 0xd248, Stride: 0x1},
-		unicode.Range16{Lo: 0xd264, Hi: 0xd264, Stride: 0x1},
-		unicode.Range16{Lo: 0xd280, Hi: 0xd280, Stride: 0x1},
-		unicode.Range16{Lo: 0xd29c, Hi: 0xd29c, Stride: 0x1},
-		unicode.Range16{Lo: 0xd2b8, Hi: 0xd2b8, Stride: 0x1},
-		unicode.Range16{Lo: 0xd2d4, Hi: 0xd2d4, Stride: 0x1},
-		unicode.Range16{Lo: 0xd2f0, Hi: 0xd2f0, Stride: 0x1},
-		unicode.Range16{Lo: 0xd30c, Hi: 0xd30c, Stride: 0x1},
-		unicode.Range16{Lo: 0xd328, Hi: 0xd328, Stride: 0x1},
-		unicode.Range16{Lo: 0xd344, Hi: 0xd344, Stride: 0x1},
-		unicode.Range16{Lo: 0xd360, Hi: 0xd360, Stride: 0x1},
-		unicode.Range16{Lo: 0xd37c, Hi: 0xd37c, Stride: 0x1},
-		unicode.Range16{Lo: 0xd398, Hi: 0xd398, Stride: 0x1},
-		unicode.Range16{Lo: 0xd3b4, Hi: 0xd3b4, Stride: 0x1},
-		unicode.Range16{Lo: 0xd3d0, Hi: 0xd3d0, Stride: 0x1},
-		unicode.Range16{Lo: 0xd3ec, Hi: 0xd3ec, Stride: 0x1},
-		unicode.Range16{Lo: 0xd408, Hi: 0xd408, Stride: 0x1},
-		unicode.Range16{Lo: 0xd424, Hi: 0xd424, Stride: 0x1},
-		unicode.Range16{Lo: 0xd440, Hi: 0xd440, Stride: 0x1},
-		unicode.Range16{Lo: 0xd45c, Hi: 0xd45c, Stride: 0x1},
-		unicode.Range16{Lo: 0xd478, Hi: 0xd478, Stride: 0x1},
-		unicode.Range16{Lo: 0xd494, Hi: 0xd494, Stride: 0x1},
-		unicode.Range16{Lo: 0xd4b0, Hi: 0xd4b0, Stride: 0x1},
-		unicode.Range16{Lo: 0xd4cc, Hi: 0xd4cc, Stride: 0x1},
-		unicode.Range16{Lo: 0xd4e8, Hi: 0xd4e8, Stride: 0x1},
-		unicode.Range16{Lo: 0xd504, Hi: 0xd504, Stride: 0x1},
-		unicode.Range16{Lo: 0xd520, Hi: 0xd520, Stride: 0x1},
-		unicode.Range16{Lo: 0xd53c, Hi: 0xd53c, Stride: 0x1},
-		unicode.Range16{Lo: 0xd558, Hi: 0xd558, Stride: 0x1},
-		unicode.Range16{Lo: 0xd574, Hi: 0xd574, Stride: 0x1},
-		unicode.Range16{Lo: 0xd590, Hi: 0xd590, Stride: 0x1},
-		unicode.Range16{Lo: 0xd5ac, Hi: 0xd5ac, Stride: 0x1},
-		unicode.Range16{Lo: 0xd5c8, Hi: 0xd5c8, Stride: 0x1},
-		unicode.Range16{Lo: 0xd5e4, Hi: 0xd5e4, Stride: 0x1},
-		unicode.Range16{Lo: 0xd600, Hi: 0xd600, Stride: 0x1},
-		unicode.Range16{Lo: 0xd61c, Hi: 0xd61c, Stride: 0x1},
-		unicode.Range16{Lo: 0xd638, Hi: 0xd638, Stride: 0x1},
-		unicode.Range16{Lo: 0xd654, Hi: 0xd654, Stride: 0x1},
-		unicode.Range16{Lo: 0xd670, Hi: 0xd670, Stride: 0x1},
-		unicode.Range16{Lo: 0xd68c, Hi: 0xd68c, Stride: 0x1},
-		unicode.Range16{Lo: 0xd6a8, Hi: 0xd6a8, Stride: 0x1},
-		unicode.Range16{Lo: 0xd6c4, Hi: 0xd6c4, Stride: 0x1},
-		unicode.Range16{Lo: 0xd6e0, Hi: 0xd6e0, Stride: 0x1},
-		unicode.Range16{Lo: 0xd6fc, Hi: 0xd6fc, Stride: 0x1},
-		unicode.Range16{Lo: 0xd718, Hi: 0xd718, Stride: 0x1},
-		unicode.Range16{Lo: 0xd734, Hi: 0xd734, Stride: 0x1},
-		unicode.Range16{Lo: 0xd750, Hi: 0xd750, Stride: 0x1},
-		unicode.Range16{Lo: 0xd76c, Hi: 0xd76c, Stride: 0x1},
-		unicode.Range16{Lo: 0xd788, Hi: 0xd788, Stride: 0x1},
-	},
-	LatinOffset: 0,
-}
-
-var _GraphemeLVT = &unicode.RangeTable{
-	R16: []unicode.Range16{
-		unicode.Range16{Lo: 0xac01, Hi: 0xac1b, Stride: 0x1},
-		unicode.Range16{Lo: 0xac1d, Hi: 0xac37, Stride: 0x1},
-		unicode.Range16{Lo: 0xac39, Hi: 0xac53, Stride: 0x1},
-		unicode.Range16{Lo: 0xac55, Hi: 0xac6f, Stride: 0x1},
-		unicode.Range16{Lo: 0xac71, Hi: 0xac8b, Stride: 0x1},
-		unicode.Range16{Lo: 0xac8d, Hi: 0xaca7, Stride: 0x1},
-		unicode.Range16{Lo: 0xaca9, Hi: 0xacc3, Stride: 0x1},
-		unicode.Range16{Lo: 0xacc5, Hi: 0xacdf, Stride: 0x1},
-		unicode.Range16{Lo: 0xace1, Hi: 0xacfb, Stride: 0x1},
-		unicode.Range16{Lo: 0xacfd, Hi: 0xad17, Stride: 0x1},
-		unicode.Range16{Lo: 0xad19, Hi: 0xad33, Stride: 0x1},
-		unicode.Range16{Lo: 0xad35, Hi: 0xad4f, Stride: 0x1},
-		unicode.Range16{Lo: 0xad51, Hi: 0xad6b, Stride: 0x1},
-		unicode.Range16{Lo: 0xad6d, Hi: 0xad87, Stride: 0x1},
-		unicode.Range16{Lo: 0xad89, Hi: 0xada3, Stride: 0x1},
-		unicode.Range16{Lo: 0xada5, Hi: 0xadbf, Stride: 0x1},
-		unicode.Range16{Lo: 0xadc1, Hi: 0xaddb, Stride: 0x1},
-		unicode.Range16{Lo: 0xaddd, Hi: 0xadf7, Stride: 0x1},
-		unicode.Range16{Lo: 0xadf9, Hi: 0xae13, Stride: 0x1},
-		unicode.Range16{Lo: 0xae15, Hi: 0xae2f, Stride: 0x1},
-		unicode.Range16{Lo: 0xae31, Hi: 0xae4b, Stride: 0x1},
-		unicode.Range16{Lo: 0xae4d, Hi: 0xae67, Stride: 0x1},
-		unicode.Range16{Lo: 0xae69, Hi: 0xae83, Stride: 0x1},
-		unicode.Range16{Lo: 0xae85, Hi: 0xae9f, Stride: 0x1},
-		unicode.Range16{Lo: 0xaea1, Hi: 0xaebb, Stride: 0x1},
-		unicode.Range16{Lo: 0xaebd, Hi: 0xaed7, Stride: 0x1},
-		unicode.Range16{Lo: 0xaed9, Hi: 0xaef3, Stride: 0x1},
-		unicode.Range16{Lo: 0xaef5, Hi: 0xaf0f, Stride: 0x1},
-		unicode.Range16{Lo: 0xaf11, Hi: 0xaf2b, Stride: 0x1},
-		unicode.Range16{Lo: 0xaf2d, Hi: 0xaf47, Stride: 0x1},
-		unicode.Range16{Lo: 0xaf49, Hi: 0xaf63, Stride: 0x1},
-		unicode.Range16{Lo: 0xaf65, Hi: 0xaf7f, Stride: 0x1},
-		unicode.Range16{Lo: 0xaf81, Hi: 0xaf9b, Stride: 0x1},
-		unicode.Range16{Lo: 0xaf9d, Hi: 0xafb7, Stride: 0x1},
-		unicode.Range16{Lo: 0xafb9, Hi: 0xafd3, Stride: 0x1},
-		unicode.Range16{Lo: 0xafd5, Hi: 0xafef, Stride: 0x1},
-		unicode.Range16{Lo: 0xaff1, Hi: 0xb00b, Stride: 0x1},
-		unicode.Range16{Lo: 0xb00d, Hi: 0xb027, Stride: 0x1},
-		unicode.Range16{Lo: 0xb029, Hi: 0xb043, Stride: 0x1},
-		unicode.Range16{Lo: 0xb045, Hi: 0xb05f, Stride: 0x1},
-		unicode.Range16{Lo: 0xb061, Hi: 0xb07b, Stride: 0x1},
-		unicode.Range16{Lo: 0xb07d, Hi: 0xb097, Stride: 0x1},
-		unicode.Range16{Lo: 0xb099, Hi: 0xb0b3, Stride: 0x1},
-		unicode.Range16{Lo: 0xb0b5, Hi: 0xb0cf, Stride: 0x1},
-		unicode.Range16{Lo: 0xb0d1, Hi: 0xb0eb, Stride: 0x1},
-		unicode.Range16{Lo: 0xb0ed, Hi: 0xb107, Stride: 0x1},
-		unicode.Range16{Lo: 0xb109, Hi: 0xb123, Stride: 0x1},
-		unicode.Range16{Lo: 0xb125, Hi: 0xb13f, Stride: 0x1},
-		unicode.Range16{Lo: 0xb141, Hi: 0xb15b, Stride: 0x1},
-		unicode.Range16{Lo: 0xb15d, Hi: 0xb177, Stride: 0x1},
-		unicode.Range16{Lo: 0xb179, Hi: 0xb193, Stride: 0x1},
-		unicode.Range16{Lo: 0xb195, Hi: 0xb1af, Stride: 0x1},
-		unicode.Range16{Lo: 0xb1b1, Hi: 0xb1cb, Stride: 0x1},
-		unicode.Range16{Lo: 0xb1cd, Hi: 0xb1e7, Stride: 0x1},
-		unicode.Range16{Lo: 0xb1e9, Hi: 0xb203, Stride: 0x1},
-		unicode.Range16{Lo: 0xb205, Hi: 0xb21f, Stride: 0x1},
-		unicode.Range16{Lo: 0xb221, Hi: 0xb23b, Stride: 0x1},
-		unicode.Range16{Lo: 0xb23d, Hi: 0xb257, Stride: 0x1},
-		unicode.Range16{Lo: 0xb259, Hi: 0xb273, Stride: 0x1},
-		unicode.Range16{Lo: 0xb275, Hi: 0xb28f, Stride: 0x1},
-		unicode.Range16{Lo: 0xb291, Hi: 0xb2ab, Stride: 0x1},
-		unicode.Range16{Lo: 0xb2ad, Hi: 0xb2c7, Stride: 0x1},
-		unicode.Range16{Lo: 0xb2c9, Hi: 0xb2e3, Stride: 0x1},
-		unicode.Range16{Lo: 0xb2e5, Hi: 0xb2ff, Stride: 0x1},
-		unicode.Range16{Lo: 0xb301, Hi: 0xb31b, Stride: 0x1},
-		unicode.Range16{Lo: 0xb31d, Hi: 0xb337, Stride: 0x1},
-		unicode.Range16{Lo: 0xb339, Hi: 0xb353, Stride: 0x1},
-		unicode.Range16{Lo: 0xb355, Hi: 0xb36f, Stride: 0x1},
-		unicode.Range16{Lo: 0xb371, Hi: 0xb38b, Stride: 0x1},
-		unicode.Range16{Lo: 0xb38d, Hi: 0xb3a7, Stride: 0x1},
-		unicode.Range16{Lo: 0xb3a9, Hi: 0xb3c3, Stride: 0x1},
-		unicode.Range16{Lo: 0xb3c5, Hi: 0xb3df, Stride: 0x1},
-		unicode.Range16{Lo: 0xb3e1, Hi: 0xb3fb, Stride: 0x1},
-		unicode.Range16{Lo: 0xb3fd, Hi: 0xb417, Stride: 0x1},
-		unicode.Range16{Lo: 0xb419, Hi: 0xb433, Stride: 0x1},
-		unicode.Range16{Lo: 0xb435, Hi: 0xb44f, Stride: 0x1},
-		unicode.Range16{Lo: 0xb451, Hi: 0xb46b, Stride: 0x1},
-		unicode.Range16{Lo: 0xb46d, Hi: 0xb487, Stride: 0x1},
-		unicode.Range16{Lo: 0xb489, Hi: 0xb4a3, Stride: 0x1},
-		unicode.Range16{Lo: 0xb4a5, Hi: 0xb4bf, Stride: 0x1},
-		unicode.Range16{Lo: 0xb4c1, Hi: 0xb4db, Stride: 0x1},
-		unicode.Range16{Lo: 0xb4dd, Hi: 0xb4f7, Stride: 0x1},
-		unicode.Range16{Lo: 0xb4f9, Hi: 0xb513, Stride: 0x1},
-		unicode.Range16{Lo: 0xb515, Hi: 0xb52f, Stride: 0x1},
-		unicode.Range16{Lo: 0xb531, Hi: 0xb54b, Stride: 0x1},
-		unicode.Range16{Lo: 0xb54d, Hi: 0xb567, Stride: 0x1},
-		unicode.Range16{Lo: 0xb569, Hi: 0xb583, Stride: 0x1},
-		unicode.Range16{Lo: 0xb585, Hi: 0xb59f, Stride: 0x1},
-		unicode.Range16{Lo: 0xb5a1, Hi: 0xb5bb, Stride: 0x1},
-		unicode.Range16{Lo: 0xb5bd, Hi: 0xb5d7, Stride: 0x1},
-		unicode.Range16{Lo: 0xb5d9, Hi: 0xb5f3, Stride: 0x1},
-		unicode.Range16{Lo: 0xb5f5, Hi: 0xb60f, Stride: 0x1},
-		unicode.Range16{Lo: 0xb611, Hi: 0xb62b, Stride: 0x1},
-		unicode.Range16{Lo: 0xb62d, Hi: 0xb647, Stride: 0x1},
-		unicode.Range16{Lo: 0xb649, Hi: 0xb663, Stride: 0x1},
-		unicode.Range16{Lo: 0xb665, Hi: 0xb67f, Stride: 0x1},
-		unicode.Range16{Lo: 0xb681, Hi: 0xb69b, Stride: 0x1},
-		unicode.Range16{Lo: 0xb69d, Hi: 0xb6b7, Stride: 0x1},
-		unicode.Range16{Lo: 0xb6b9, Hi: 0xb6d3, Stride: 0x1},
-		unicode.Range16{Lo: 0xb6d5, Hi: 0xb6ef, Stride: 0x1},
-		unicode.Range16{Lo: 0xb6f1, Hi: 0xb70b, Stride: 0x1},
-		unicode.Range16{Lo: 0xb70d, Hi: 0xb727, Stride: 0x1},
-		unicode.Range16{Lo: 0xb729, Hi: 0xb743, Stride: 0x1},
-		unicode.Range16{Lo: 0xb745, Hi: 0xb75f, Stride: 0x1},
-		unicode.Range16{Lo: 0xb761, Hi: 0xb77b, Stride: 0x1},
-		unicode.Range16{Lo: 0xb77d, Hi: 0xb797, Stride: 0x1},
-		unicode.Range16{Lo: 0xb799, Hi: 0xb7b3, Stride: 0x1},
-		unicode.Range16{Lo: 0xb7b5, Hi: 0xb7cf, Stride: 0x1},
-		unicode.Range16{Lo: 0xb7d1, Hi: 0xb7eb, Stride: 0x1},
-		unicode.Range16{Lo: 0xb7ed, Hi: 0xb807, Stride: 0x1},
-		unicode.Range16{Lo: 0xb809, Hi: 0xb823, Stride: 0x1},
-		unicode.Range16{Lo: 0xb825, Hi: 0xb83f, Stride: 0x1},
-		unicode.Range16{Lo: 0xb841, Hi: 0xb85b, Stride: 0x1},
-		unicode.Range16{Lo: 0xb85d, Hi: 0xb877, Stride: 0x1},
-		unicode.Range16{Lo: 0xb879, Hi: 0xb893, Stride: 0x1},
-		unicode.Range16{Lo: 0xb895, Hi: 0xb8af, Stride: 0x1},
-		unicode.Range16{Lo: 0xb8b1, Hi: 0xb8cb, Stride: 0x1},
-		unicode.Range16{Lo: 0xb8cd, Hi: 0xb8e7, Stride: 0x1},
-		unicode.Range16{Lo: 0xb8e9, Hi: 0xb903, Stride: 0x1},
-		unicode.Range16{Lo: 0xb905, Hi: 0xb91f, Stride: 0x1},
-		unicode.Range16{Lo: 0xb921, Hi: 0xb93b, Stride: 0x1},
-		unicode.Range16{Lo: 0xb93d, Hi: 0xb957, Stride: 0x1},
-		unicode.Range16{Lo: 0xb959, Hi: 0xb973, Stride: 0x1},
-		unicode.Range16{Lo: 0xb975, Hi: 0xb98f, Stride: 0x1},
-		unicode.Range16{Lo: 0xb991, Hi: 0xb9ab, Stride: 0x1},
-		unicode.Range16{Lo: 0xb9ad, Hi: 0xb9c7, Stride: 0x1},
-		unicode.Range16{Lo: 0xb9c9, Hi: 0xb9e3, Stride: 0x1},
-		unicode.Range16{Lo: 0xb9e5, Hi: 0xb9ff, Stride: 0x1},
-		unicode.Range16{Lo: 0xba01, Hi: 0xba1b, Stride: 0x1},
-		unicode.Range16{Lo: 0xba1d, Hi: 0xba37, Stride: 0x1},
-		unicode.Range16{Lo: 0xba39, Hi: 0xba53, Stride: 0x1},
-		unicode.Range16{Lo: 0xba55, Hi: 0xba6f, Stride: 0x1},
-		unicode.Range16{Lo: 0xba71, Hi: 0xba8b, Stride: 0x1},
-		unicode.Range16{Lo: 0xba8d, Hi: 0xbaa7, Stride: 0x1},
-		unicode.Range16{Lo: 0xbaa9, Hi: 0xbac3, Stride: 0x1},
-		unicode.Range16{Lo: 0xbac5, Hi: 0xbadf, Stride: 0x1},
-		unicode.Range16{Lo: 0xbae1, Hi: 0xbafb, Stride: 0x1},
-		unicode.Range16{Lo: 0xbafd, Hi: 0xbb17, Stride: 0x1},
-		unicode.Range16{Lo: 0xbb19, Hi: 0xbb33, Stride: 0x1},
-		unicode.Range16{Lo: 0xbb35, Hi: 0xbb4f, Stride: 0x1},
-		unicode.Range16{Lo: 0xbb51, Hi: 0xbb6b, Stride: 0x1},
-		unicode.Range16{Lo: 0xbb6d, Hi: 0xbb87, Stride: 0x1},
-		unicode.Range16{Lo: 0xbb89, Hi: 0xbba3, Stride: 0x1},
-		unicode.Range16{Lo: 0xbba5, Hi: 0xbbbf, Stride: 0x1},
-		unicode.Range16{Lo: 0xbbc1, Hi: 0xbbdb, Stride: 0x1},
-		unicode.Range16{Lo: 0xbbdd, Hi: 0xbbf7, Stride: 0x1},
-		unicode.Range16{Lo: 0xbbf9, Hi: 0xbc13, Stride: 0x1},
-		unicode.Range16{Lo: 0xbc15, Hi: 0xbc2f, Stride: 0x1},
-		unicode.Range16{Lo: 0xbc31, Hi: 0xbc4b, Stride: 0x1},
-		unicode.Range16{Lo: 0xbc4d, Hi: 0xbc67, Stride: 0x1},
-		unicode.Range16{Lo: 0xbc69, Hi: 0xbc83, Stride: 0x1},
-		unicode.Range16{Lo: 0xbc85, Hi: 0xbc9f, Stride: 0x1},
-		unicode.Range16{Lo: 0xbca1, Hi: 0xbcbb, Stride: 0x1},
-		unicode.Range16{Lo: 0xbcbd, Hi: 0xbcd7, Stride: 0x1},
-		unicode.Range16{Lo: 0xbcd9, Hi: 0xbcf3, Stride: 0x1},
-		unicode.Range16{Lo: 0xbcf5, Hi: 0xbd0f, Stride: 0x1},
-		unicode.Range16{Lo: 0xbd11, Hi: 0xbd2b, Stride: 0x1},
-		unicode.Range16{Lo: 0xbd2d, Hi: 0xbd47, Stride: 0x1},
-		unicode.Range16{Lo: 0xbd49, Hi: 0xbd63, Stride: 0x1},
-		unicode.Range16{Lo: 0xbd65, Hi: 0xbd7f, Stride: 0x1},
-		unicode.Range16{Lo: 0xbd81, Hi: 0xbd9b, Stride: 0x1},
-		unicode.Range16{Lo: 0xbd9d, Hi: 0xbdb7, Stride: 0x1},
-		unicode.Range16{Lo: 0xbdb9, Hi: 0xbdd3, Stride: 0x1},
-		unicode.Range16{Lo: 0xbdd5, Hi: 0xbdef, Stride: 0x1},
-		unicode.Range16{Lo: 0xbdf1, Hi: 0xbe0b, Stride: 0x1},
-		unicode.Range16{Lo: 0xbe0d, Hi: 0xbe27, Stride: 0x1},
-		unicode.Range16{Lo: 0xbe29, Hi: 0xbe43, Stride: 0x1},
-		unicode.Range16{Lo: 0xbe45, Hi: 0xbe5f, Stride: 0x1},
-		unicode.Range16{Lo: 0xbe61, Hi: 0xbe7b, Stride: 0x1},
-		unicode.Range16{Lo: 0xbe7d, Hi: 0xbe97, Stride: 0x1},
-		unicode.Range16{Lo: 0xbe99, Hi: 0xbeb3, Stride: 0x1},
-		unicode.Range16{Lo: 0xbeb5, Hi: 0xbecf, Stride: 0x1},
-		unicode.Range16{Lo: 0xbed1, Hi: 0xbeeb, Stride: 0x1},
-		unicode.Range16{Lo: 0xbeed, Hi: 0xbf07, Stride: 0x1},
-		unicode.Range16{Lo: 0xbf09, Hi: 0xbf23, Stride: 0x1},
-		unicode.Range16{Lo: 0xbf25, Hi: 0xbf3f, Stride: 0x1},
-		unicode.Range16{Lo: 0xbf41, Hi: 0xbf5b, Stride: 0x1},
-		unicode.Range16{Lo: 0xbf5d, Hi: 0xbf77, Stride: 0x1},
-		unicode.Range16{Lo: 0xbf79, Hi: 0xbf93, Stride: 0x1},
-		unicode.Range16{Lo: 0xbf95, Hi: 0xbfaf, Stride: 0x1},
-		unicode.Range16{Lo: 0xbfb1, Hi: 0xbfcb, Stride: 0x1},
-		unicode.Range16{Lo: 0xbfcd, Hi: 0xbfe7, Stride: 0x1},
-		unicode.Range16{Lo: 0xbfe9, Hi: 0xc003, Stride: 0x1},
-		unicode.Range16{Lo: 0xc005, Hi: 0xc01f, Stride: 0x1},
-		unicode.Range16{Lo: 0xc021, Hi: 0xc03b, Stride: 0x1},
-		unicode.Range16{Lo: 0xc03d, Hi: 0xc057, Stride: 0x1},
-		unicode.Range16{Lo: 0xc059, Hi: 0xc073, Stride: 0x1},
-		unicode.Range16{Lo: 0xc075, Hi: 0xc08f, Stride: 0x1},
-		unicode.Range16{Lo: 0xc091, Hi: 0xc0ab, Stride: 0x1},
-		unicode.Range16{Lo: 0xc0ad, Hi: 0xc0c7, Stride: 0x1},
-		unicode.Range16{Lo: 0xc0c9, Hi: 0xc0e3, Stride: 0x1},
-		unicode.Range16{Lo: 0xc0e5, Hi: 0xc0ff, Stride: 0x1},
-		unicode.Range16{Lo: 0xc101, Hi: 0xc11b, Stride: 0x1},
-		unicode.Range16{Lo: 0xc11d, Hi: 0xc137, Stride: 0x1},
-		unicode.Range16{Lo: 0xc139, Hi: 0xc153, Stride: 0x1},
-		unicode.Range16{Lo: 0xc155, Hi: 0xc16f, Stride: 0x1},
-		unicode.Range16{Lo: 0xc171, Hi: 0xc18b, Stride: 0x1},
-		unicode.Range16{Lo: 0xc18d, Hi: 0xc1a7, Stride: 0x1},
-		unicode.Range16{Lo: 0xc1a9, Hi: 0xc1c3, Stride: 0x1},
-		unicode.Range16{Lo: 0xc1c5, Hi: 0xc1df, Stride: 0x1},
-		unicode.Range16{Lo: 0xc1e1, Hi: 0xc1fb, Stride: 0x1},
-		unicode.Range16{Lo: 0xc1fd, Hi: 0xc217, Stride: 0x1},
-		unicode.Range16{Lo: 0xc219, Hi: 0xc233, Stride: 0x1},
-		unicode.Range16{Lo: 0xc235, Hi: 0xc24f, Stride: 0x1},
-		unicode.Range16{Lo: 0xc251, Hi: 0xc26b, Stride: 0x1},
-		unicode.Range16{Lo: 0xc26d, Hi: 0xc287, Stride: 0x1},
-		unicode.Range16{Lo: 0xc289, Hi: 0xc2a3, Stride: 0x1},
-		unicode.Range16{Lo: 0xc2a5, Hi: 0xc2bf, Stride: 0x1},
-		unicode.Range16{Lo: 0xc2c1, Hi: 0xc2db, Stride: 0x1},
-		unicode.Range16{Lo: 0xc2dd, Hi: 0xc2f7, Stride: 0x1},
-		unicode.Range16{Lo: 0xc2f9, Hi: 0xc313, Stride: 0x1},
-		unicode.Range16{Lo: 0xc315, Hi: 0xc32f, Stride: 0x1},
-		unicode.Range16{Lo: 0xc331, Hi: 0xc34b, Stride: 0x1},
-		unicode.Range16{Lo: 0xc34d, Hi: 0xc367, Stride: 0x1},
-		unicode.Range16{Lo: 0xc369, Hi: 0xc383, Stride: 0x1},
-		unicode.Range16{Lo: 0xc385, Hi: 0xc39f, Stride: 0x1},
-		unicode.Range16{Lo: 0xc3a1, Hi: 0xc3bb, Stride: 0x1},
-		unicode.Range16{Lo: 0xc3bd, Hi: 0xc3d7, Stride: 0x1},
-		unicode.Range16{Lo: 0xc3d9, Hi: 0xc3f3, Stride: 0x1},
-		unicode.Range16{Lo: 0xc3f5, Hi: 0xc40f, Stride: 0x1},
-		unicode.Range16{Lo: 0xc411, Hi: 0xc42b, Stride: 0x1},
-		unicode.Range16{Lo: 0xc42d, Hi: 0xc447, Stride: 0x1},
-		unicode.Range16{Lo: 0xc449, Hi: 0xc463, Stride: 0x1},
-		unicode.Range16{Lo: 0xc465, Hi: 0xc47f, Stride: 0x1},
-		unicode.Range16{Lo: 0xc481, Hi: 0xc49b, Stride: 0x1},
-		unicode.Range16{Lo: 0xc49d, Hi: 0xc4b7, Stride: 0x1},
-		unicode.Range16{Lo: 0xc4b9, Hi: 0xc4d3, Stride: 0x1},
-		unicode.Range16{Lo: 0xc4d5, Hi: 0xc4ef, Stride: 0x1},
-		unicode.Range16{Lo: 0xc4f1, Hi: 0xc50b, Stride: 0x1},
-		unicode.Range16{Lo: 0xc50d, Hi: 0xc527, Stride: 0x1},
-		unicode.Range16{Lo: 0xc529, Hi: 0xc543, Stride: 0x1},
-		unicode.Range16{Lo: 0xc545, Hi: 0xc55f, Stride: 0x1},
-		unicode.Range16{Lo: 0xc561, Hi: 0xc57b, Stride: 0x1},
-		unicode.Range16{Lo: 0xc57d, Hi: 0xc597, Stride: 0x1},
-		unicode.Range16{Lo: 0xc599, Hi: 0xc5b3, Stride: 0x1},
-		unicode.Range16{Lo: 0xc5b5, Hi: 0xc5cf, Stride: 0x1},
-		unicode.Range16{Lo: 0xc5d1, Hi: 0xc5eb, Stride: 0x1},
-		unicode.Range16{Lo: 0xc5ed, Hi: 0xc607, Stride: 0x1},
-		unicode.Range16{Lo: 0xc609, Hi: 0xc623, Stride: 0x1},
-		unicode.Range16{Lo: 0xc625, Hi: 0xc63f, Stride: 0x1},
-		unicode.Range16{Lo: 0xc641, Hi: 0xc65b, Stride: 0x1},
-		unicode.Range16{Lo: 0xc65d, Hi: 0xc677, Stride: 0x1},
-		unicode.Range16{Lo: 0xc679, Hi: 0xc693, Stride: 0x1},
-		unicode.Range16{Lo: 0xc695, Hi: 0xc6af, Stride: 0x1},
-		unicode.Range16{Lo: 0xc6b1, Hi: 0xc6cb, Stride: 0x1},
-		unicode.Range16{Lo: 0xc6cd, Hi: 0xc6e7, Stride: 0x1},
-		unicode.Range16{Lo: 0xc6e9, Hi: 0xc703, Stride: 0x1},
-		unicode.Range16{Lo: 0xc705, Hi: 0xc71f, Stride: 0x1},
-		unicode.Range16{Lo: 0xc721, Hi: 0xc73b, Stride: 0x1},
-		unicode.Range16{Lo: 0xc73d, Hi: 0xc757, Stride: 0x1},
-		unicode.Range16{Lo: 0xc759, Hi: 0xc773, Stride: 0x1},
-		unicode.Range16{Lo: 0xc775, Hi: 0xc78f, Stride: 0x1},
-		unicode.Range16{Lo: 0xc791, Hi: 0xc7ab, Stride: 0x1},
-		unicode.Range16{Lo: 0xc7ad, Hi: 0xc7c7, Stride: 0x1},
-		unicode.Range16{Lo: 0xc7c9, Hi: 0xc7e3, Stride: 0x1},
-		unicode.Range16{Lo: 0xc7e5, Hi: 0xc7ff, Stride: 0x1},
-		unicode.Range16{Lo: 0xc801, Hi: 0xc81b, Stride: 0x1},
-		unicode.Range16{Lo: 0xc81d, Hi: 0xc837, Stride: 0x1},
-		unicode.Range16{Lo: 0xc839, Hi: 0xc853, Stride: 0x1},
-		unicode.Range16{Lo: 0xc855, Hi: 0xc86f, Stride: 0x1},
-		unicode.Range16{Lo: 0xc871, Hi: 0xc88b, Stride: 0x1},
-		unicode.Range16{Lo: 0xc88d, Hi: 0xc8a7, Stride: 0x1},
-		unicode.Range16{Lo: 0xc8a9, Hi: 0xc8c3, Stride: 0x1},
-		unicode.Range16{Lo: 0xc8c5, Hi: 0xc8df, Stride: 0x1},
-		unicode.Range16{Lo: 0xc8e1, Hi: 0xc8fb, Stride: 0x1},
-		unicode.Range16{Lo: 0xc8fd, Hi: 0xc917, Stride: 0x1},
-		unicode.Range16{Lo: 0xc919, Hi: 0xc933, Stride: 0x1},
-		unicode.Range16{Lo: 0xc935, Hi: 0xc94f, Stride: 0x1},
-		unicode.Range16{Lo: 0xc951, Hi: 0xc96b, Stride: 0x1},
-		unicode.Range16{Lo: 0xc96d, Hi: 0xc987, Stride: 0x1},
-		unicode.Range16{Lo: 0xc989, Hi: 0xc9a3, Stride: 0x1},
-		unicode.Range16{Lo: 0xc9a5, Hi: 0xc9bf, Stride: 0x1},
-		unicode.Range16{Lo: 0xc9c1, Hi: 0xc9db, Stride: 0x1},
-		unicode.Range16{Lo: 0xc9dd, Hi: 0xc9f7, Stride: 0x1},
-		unicode.Range16{Lo: 0xc9f9, Hi: 0xca13, Stride: 0x1},
-		unicode.Range16{Lo: 0xca15, Hi: 0xca2f, Stride: 0x1},
-		unicode.Range16{Lo: 0xca31, Hi: 0xca4b, Stride: 0x1},
-		unicode.Range16{Lo: 0xca4d, Hi: 0xca67, Stride: 0x1},
-		unicode.Range16{Lo: 0xca69, Hi: 0xca83, Stride: 0x1},
-		unicode.Range16{Lo: 0xca85, Hi: 0xca9f, Stride: 0x1},
-		unicode.Range16{Lo: 0xcaa1, Hi: 0xcabb, Stride: 0x1},
-		unicode.Range16{Lo: 0xcabd, Hi: 0xcad7, Stride: 0x1},
-		unicode.Range16{Lo: 0xcad9, Hi: 0xcaf3, Stride: 0x1},
-		unicode.Range16{Lo: 0xcaf5, Hi: 0xcb0f, Stride: 0x1},
-		unicode.Range16{Lo: 0xcb11, Hi: 0xcb2b, Stride: 0x1},
-		unicode.Range16{Lo: 0xcb2d, Hi: 0xcb47, Stride: 0x1},
-		unicode.Range16{Lo: 0xcb49, Hi: 0xcb63, Stride: 0x1},
-		unicode.Range16{Lo: 0xcb65, Hi: 0xcb7f, Stride: 0x1},
-		unicode.Range16{Lo: 0xcb81, Hi: 0xcb9b, Stride: 0x1},
-		unicode.Range16{Lo: 0xcb9d, Hi: 0xcbb7, Stride: 0x1},
-		unicode.Range16{Lo: 0xcbb9, Hi: 0xcbd3, Stride: 0x1},
-		unicode.Range16{Lo: 0xcbd5, Hi: 0xcbef, Stride: 0x1},
-		unicode.Range16{Lo: 0xcbf1, Hi: 0xcc0b, Stride: 0x1},
-		unicode.Range16{Lo: 0xcc0d, Hi: 0xcc27, Stride: 0x1},
-		unicode.Range16{Lo: 0xcc29, Hi: 0xcc43, Stride: 0x1},
-		unicode.Range16{Lo: 0xcc45, Hi: 0xcc5f, Stride: 0x1},
-		unicode.Range16{Lo: 0xcc61, Hi: 0xcc7b, Stride: 0x1},
-		unicode.Range16{Lo: 0xcc7d, Hi: 0xcc97, Stride: 0x1},
-		unicode.Range16{Lo: 0xcc99, Hi: 0xccb3, Stride: 0x1},
-		unicode.Range16{Lo: 0xccb5, Hi: 0xcccf, Stride: 0x1},
-		unicode.Range16{Lo: 0xccd1, Hi: 0xcceb, Stride: 0x1},
-		unicode.Range16{Lo: 0xcced, Hi: 0xcd07, Stride: 0x1},
-		unicode.Range16{Lo: 0xcd09, Hi: 0xcd23, Stride: 0x1},
-		unicode.Range16{Lo: 0xcd25, Hi: 0xcd3f, Stride: 0x1},
-		unicode.Range16{Lo: 0xcd41, Hi: 0xcd5b, Stride: 0x1},
-		unicode.Range16{Lo: 0xcd5d, Hi: 0xcd77, Stride: 0x1},
-		unicode.Range16{Lo: 0xcd79, Hi: 0xcd93, Stride: 0x1},
-		unicode.Range16{Lo: 0xcd95, Hi: 0xcdaf, Stride: 0x1},
-		unicode.Range16{Lo: 0xcdb1, Hi: 0xcdcb, Stride: 0x1},
-		unicode.Range16{Lo: 0xcdcd, Hi: 0xcde7, Stride: 0x1},
-		unicode.Range16{Lo: 0xcde9, Hi: 0xce03, Stride: 0x1},
-		unicode.Range16{Lo: 0xce05, Hi: 0xce1f, Stride: 0x1},
-		unicode.Range16{Lo: 0xce21, Hi: 0xce3b, Stride: 0x1},
-		unicode.Range16{Lo: 0xce3d, Hi: 0xce57, Stride: 0x1},
-		unicode.Range16{Lo: 0xce59, Hi: 0xce73, Stride: 0x1},
-		unicode.Range16{Lo: 0xce75, Hi: 0xce8f, Stride: 0x1},
-		unicode.Range16{Lo: 0xce91, Hi: 0xceab, Stride: 0x1},
-		unicode.Range16{Lo: 0xcead, Hi: 0xcec7, Stride: 0x1},
-		unicode.Range16{Lo: 0xcec9, Hi: 0xcee3, Stride: 0x1},
-		unicode.Range16{Lo: 0xcee5, Hi: 0xceff, Stride: 0x1},
-		unicode.Range16{Lo: 0xcf01, Hi: 0xcf1b, Stride: 0x1},
-		unicode.Range16{Lo: 0xcf1d, Hi: 0xcf37, Stride: 0x1},
-		unicode.Range16{Lo: 0xcf39, Hi: 0xcf53, Stride: 0x1},
-		unicode.Range16{Lo: 0xcf55, Hi: 0xcf6f, Stride: 0x1},
-		unicode.Range16{Lo: 0xcf71, Hi: 0xcf8b, Stride: 0x1},
-		unicode.Range16{Lo: 0xcf8d, Hi: 0xcfa7, Stride: 0x1},
-		unicode.Range16{Lo: 0xcfa9, Hi: 0xcfc3, Stride: 0x1},
-		unicode.Range16{Lo: 0xcfc5, Hi: 0xcfdf, Stride: 0x1},
-		unicode.Range16{Lo: 0xcfe1, Hi: 0xcffb, Stride: 0x1},
-		unicode.Range16{Lo: 0xcffd, Hi: 0xd017, Stride: 0x1},
-		unicode.Range16{Lo: 0xd019, Hi: 0xd033, Stride: 0x1},
-		unicode.Range16{Lo: 0xd035, Hi: 0xd04f, Stride: 0x1},
-		unicode.Range16{Lo: 0xd051, Hi: 0xd06b, Stride: 0x1},
-		unicode.Range16{Lo: 0xd06d, Hi: 0xd087, Stride: 0x1},
-		unicode.Range16{Lo: 0xd089, Hi: 0xd0a3, Stride: 0x1},
-		unicode.Range16{Lo: 0xd0a5, Hi: 0xd0bf, Stride: 0x1},
-		unicode.Range16{Lo: 0xd0c1, Hi: 0xd0db, Stride: 0x1},
-		unicode.Range16{Lo: 0xd0dd, Hi: 0xd0f7, Stride: 0x1},
-		unicode.Range16{Lo: 0xd0f9, Hi: 0xd113, Stride: 0x1},
-		unicode.Range16{Lo: 0xd115, Hi: 0xd12f, Stride: 0x1},
-		unicode.Range16{Lo: 0xd131, Hi: 0xd14b, Stride: 0x1},
-		unicode.Range16{Lo: 0xd14d, Hi: 0xd167, Stride: 0x1},
-		unicode.Range16{Lo: 0xd169, Hi: 0xd183, Stride: 0x1},
-		unicode.Range16{Lo: 0xd185, Hi: 0xd19f, Stride: 0x1},
-		unicode.Range16{Lo: 0xd1a1, Hi: 0xd1bb, Stride: 0x1},
-		unicode.Range16{Lo: 0xd1bd, Hi: 0xd1d7, Stride: 0x1},
-		unicode.Range16{Lo: 0xd1d9, Hi: 0xd1f3, Stride: 0x1},
-		unicode.Range16{Lo: 0xd1f5, Hi: 0xd20f, Stride: 0x1},
-		unicode.Range16{Lo: 0xd211, Hi: 0xd22b, Stride: 0x1},
-		unicode.Range16{Lo: 0xd22d, Hi: 0xd247, Stride: 0x1},
-		unicode.Range16{Lo: 0xd249, Hi: 0xd263, Stride: 0x1},
-		unicode.Range16{Lo: 0xd265, Hi: 0xd27f, Stride: 0x1},
-		unicode.Range16{Lo: 0xd281, Hi: 0xd29b, Stride: 0x1},
-		unicode.Range16{Lo: 0xd29d, Hi: 0xd2b7, Stride: 0x1},
-		unicode.Range16{Lo: 0xd2b9, Hi: 0xd2d3, Stride: 0x1},
-		unicode.Range16{Lo: 0xd2d5, Hi: 0xd2ef, Stride: 0x1},
-		unicode.Range16{Lo: 0xd2f1, Hi: 0xd30b, Stride: 0x1},
-		unicode.Range16{Lo: 0xd30d, Hi: 0xd327, Stride: 0x1},
-		unicode.Range16{Lo: 0xd329, Hi: 0xd343, Stride: 0x1},
-		unicode.Range16{Lo: 0xd345, Hi: 0xd35f, Stride: 0x1},
-		unicode.Range16{Lo: 0xd361, Hi: 0xd37b, Stride: 0x1},
-		unicode.Range16{Lo: 0xd37d, Hi: 0xd397, Stride: 0x1},
-		unicode.Range16{Lo: 0xd399, Hi: 0xd3b3, Stride: 0x1},
-		unicode.Range16{Lo: 0xd3b5, Hi: 0xd3cf, Stride: 0x1},
-		unicode.Range16{Lo: 0xd3d1, Hi: 0xd3eb, Stride: 0x1},
-		unicode.Range16{Lo: 0xd3ed, Hi: 0xd407, Stride: 0x1},
-		unicode.Range16{Lo: 0xd409, Hi: 0xd423, Stride: 0x1},
-		unicode.Range16{Lo: 0xd425, Hi: 0xd43f, Stride: 0x1},
-		unicode.Range16{Lo: 0xd441, Hi: 0xd45b, Stride: 0x1},
-		unicode.Range16{Lo: 0xd45d, Hi: 0xd477, Stride: 0x1},
-		unicode.Range16{Lo: 0xd479, Hi: 0xd493, Stride: 0x1},
-		unicode.Range16{Lo: 0xd495, Hi: 0xd4af, Stride: 0x1},
-		unicode.Range16{Lo: 0xd4b1, Hi: 0xd4cb, Stride: 0x1},
-		unicode.Range16{Lo: 0xd4cd, Hi: 0xd4e7, Stride: 0x1},
-		unicode.Range16{Lo: 0xd4e9, Hi: 0xd503, Stride: 0x1},
-		unicode.Range16{Lo: 0xd505, Hi: 0xd51f, Stride: 0x1},
-		unicode.Range16{Lo: 0xd521, Hi: 0xd53b, Stride: 0x1},
-		unicode.Range16{Lo: 0xd53d, Hi: 0xd557, Stride: 0x1},
-		unicode.Range16{Lo: 0xd559, Hi: 0xd573, Stride: 0x1},
-		unicode.Range16{Lo: 0xd575, Hi: 0xd58f, Stride: 0x1},
-		unicode.Range16{Lo: 0xd591, Hi: 0xd5ab, Stride: 0x1},
-		unicode.Range16{Lo: 0xd5ad, Hi: 0xd5c7, Stride: 0x1},
-		unicode.Range16{Lo: 0xd5c9, Hi: 0xd5e3, Stride: 0x1},
-		unicode.Range16{Lo: 0xd5e5, Hi: 0xd5ff, Stride: 0x1},
-		unicode.Range16{Lo: 0xd601, Hi: 0xd61b, Stride: 0x1},
-		unicode.Range16{Lo: 0xd61d, Hi: 0xd637, Stride: 0x1},
-		unicode.Range16{Lo: 0xd639, Hi: 0xd653, Stride: 0x1},
-		unicode.Range16{Lo: 0xd655, Hi: 0xd66f, Stride: 0x1},
-		unicode.Range16{Lo: 0xd671, Hi: 0xd68b, Stride: 0x1},
-		unicode.Range16{Lo: 0xd68d, Hi: 0xd6a7, Stride: 0x1},
-		unicode.Range16{Lo: 0xd6a9, Hi: 0xd6c3, Stride: 0x1},
-		unicode.Range16{Lo: 0xd6c5, Hi: 0xd6df, Stride: 0x1},
-		unicode.Range16{Lo: 0xd6e1, Hi: 0xd6fb, Stride: 0x1},
-		unicode.Range16{Lo: 0xd6fd, Hi: 0xd717, Stride: 0x1},
-		unicode.Range16{Lo: 0xd719, Hi: 0xd733, Stride: 0x1},
-		unicode.Range16{Lo: 0xd735, Hi: 0xd74f, Stride: 0x1},
-		unicode.Range16{Lo: 0xd751, Hi: 0xd76b, Stride: 0x1},
-		unicode.Range16{Lo: 0xd76d, Hi: 0xd787, Stride: 0x1},
-		unicode.Range16{Lo: 0xd789, Hi: 0xd7a3, Stride: 0x1},
-	},
-	LatinOffset: 0,
-}
-
-var _GraphemePrepend = &unicode.RangeTable{
-	R16: []unicode.Range16{
-		unicode.Range16{Lo: 0x600, Hi: 0x605, Stride: 0x1},
-		unicode.Range16{Lo: 0x6dd, Hi: 0x6dd, Stride: 0x1},
-		unicode.Range16{Lo: 0x70f, Hi: 0x70f, Stride: 0x1},
-		unicode.Range16{Lo: 0x8e2, Hi: 0x8e2, Stride: 0x1},
-		unicode.Range16{Lo: 0xd4e, Hi: 0xd4e, Stride: 0x1},
-	},
-	R32: []unicode.Range32{
-		unicode.Range32{Lo: 0x110bd, Hi: 0x110bd, Stride: 0x1},
-		unicode.Range32{Lo: 0x110cd, Hi: 0x110cd, Stride: 0x1},
-		unicode.Range32{Lo: 0x111c2, Hi: 0x111c3, Stride: 0x1},
-		unicode.Range32{Lo: 0x11a3a, Hi: 0x11a3a, Stride: 0x1},
-		unicode.Range32{Lo: 0x11a84, Hi: 0x11a89, Stride: 0x1},
-		unicode.Range32{Lo: 0x11d46, Hi: 0x11d46, Stride: 0x1},
-	},
-	LatinOffset: 0,
-}
-
-var _GraphemeRegional_Indicator = &unicode.RangeTable{
-	R32: []unicode.Range32{
-		unicode.Range32{Lo: 0x1f1e6, Hi: 0x1f1ff, Stride: 0x1},
-	},
-	LatinOffset: 0,
-}
-
-var _GraphemeSpacingMark = &unicode.RangeTable{
-	R16: []unicode.Range16{
-		unicode.Range16{Lo: 0x903, Hi: 0x903, Stride: 0x1},
-		unicode.Range16{Lo: 0x93b, Hi: 0x93b, Stride: 0x1},
-		unicode.Range16{Lo: 0x93e, Hi: 0x940, Stride: 0x1},
-		unicode.Range16{Lo: 0x949, Hi: 0x94c, Stride: 0x1},
-		unicode.Range16{Lo: 0x94e, Hi: 0x94f, Stride: 0x1},
-		unicode.Range16{Lo: 0x982, Hi: 0x983, Stride: 0x1},
-		unicode.Range16{Lo: 0x9bf, Hi: 0x9c0, Stride: 0x1},
-		unicode.Range16{Lo: 0x9c7, Hi: 0x9c8, Stride: 0x1},
-		unicode.Range16{Lo: 0x9cb, Hi: 0x9cc, Stride: 0x1},
-		unicode.Range16{Lo: 0xa03, Hi: 0xa03, Stride: 0x1},
-		unicode.Range16{Lo: 0xa3e, Hi: 0xa40, Stride: 0x1},
-		unicode.Range16{Lo: 0xa83, Hi: 0xa83, Stride: 0x1},
-		unicode.Range16{Lo: 0xabe, Hi: 0xac0, Stride: 0x1},
-		unicode.Range16{Lo: 0xac9, Hi: 0xac9, Stride: 0x1},
-		unicode.Range16{Lo: 0xacb, Hi: 0xacc, Stride: 0x1},
-		unicode.Range16{Lo: 0xb02, Hi: 0xb03, Stride: 0x1},
-		unicode.Range16{Lo: 0xb40, Hi: 0xb40, Stride: 0x1},
-		unicode.Range16{Lo: 0xb47, Hi: 0xb48, Stride: 0x1},
-		unicode.Range16{Lo: 0xb4b, Hi: 0xb4c, Stride: 0x1},
-		unicode.Range16{Lo: 0xbbf, Hi: 0xbbf, Stride: 0x1},
-		unicode.Range16{Lo: 0xbc1, Hi: 0xbc2, Stride: 0x1},
-		unicode.Range16{Lo: 0xbc6, Hi: 0xbc8, Stride: 0x1},
-		unicode.Range16{Lo: 0xbca, Hi: 0xbcc, Stride: 0x1},
-		unicode.Range16{Lo: 0xc01, Hi: 0xc03, Stride: 0x1},
-		unicode.Range16{Lo: 0xc41, Hi: 0xc44, Stride: 0x1},
-		unicode.Range16{Lo: 0xc82, Hi: 0xc83, Stride: 0x1},
-		unicode.Range16{Lo: 0xcbe, Hi: 0xcbe, Stride: 0x1},
-		unicode.Range16{Lo: 0xcc0, Hi: 0xcc1, Stride: 0x1},
-		unicode.Range16{Lo: 0xcc3, Hi: 0xcc4, Stride: 0x1},
-		unicode.Range16{Lo: 0xcc7, Hi: 0xcc8, Stride: 0x1},
-		unicode.Range16{Lo: 0xcca, Hi: 0xccb, Stride: 0x1},
-		unicode.Range16{Lo: 0xd02, Hi: 0xd03, Stride: 0x1},
-		unicode.Range16{Lo: 0xd3f, Hi: 0xd40, Stride: 0x1},
-		unicode.Range16{Lo: 0xd46, Hi: 0xd48, Stride: 0x1},
-		unicode.Range16{Lo: 0xd4a, Hi: 0xd4c, Stride: 0x1},
-		unicode.Range16{Lo: 0xd82, Hi: 0xd83, Stride: 0x1},
-		unicode.Range16{Lo: 0xdd0, Hi: 0xdd1, Stride: 0x1},
-		unicode.Range16{Lo: 0xdd8, Hi: 0xdde, Stride: 0x1},
-		unicode.Range16{Lo: 0xdf2, Hi: 0xdf3, Stride: 0x1},
-		unicode.Range16{Lo: 0xe33, Hi: 0xe33, Stride: 0x1},
-		unicode.Range16{Lo: 0xeb3, Hi: 0xeb3, Stride: 0x1},
-		unicode.Range16{Lo: 0xf3e, Hi: 0xf3f, Stride: 0x1},
-		unicode.Range16{Lo: 0xf7f, Hi: 0xf7f, Stride: 0x1},
-		unicode.Range16{Lo: 0x1031, Hi: 0x1031, Stride: 0x1},
-		unicode.Range16{Lo: 0x103b, Hi: 0x103c, Stride: 0x1},
-		unicode.Range16{Lo: 0x1056, Hi: 0x1057, Stride: 0x1},
-		unicode.Range16{Lo: 0x1084, Hi: 0x1084, Stride: 0x1},
-		unicode.Range16{Lo: 0x17b6, Hi: 0x17b6, Stride: 0x1},
-		unicode.Range16{Lo: 0x17be, Hi: 0x17c5, Stride: 0x1},
-		unicode.Range16{Lo: 0x17c7, Hi: 0x17c8, Stride: 0x1},
-		unicode.Range16{Lo: 0x1923, Hi: 0x1926, Stride: 0x1},
-		unicode.Range16{Lo: 0x1929, Hi: 0x192b, Stride: 0x1},
-		unicode.Range16{Lo: 0x1930, Hi: 0x1931, Stride: 0x1},
-		unicode.Range16{Lo: 0x1933, Hi: 0x1938, Stride: 0x1},
-		unicode.Range16{Lo: 0x1a19, Hi: 0x1a1a, Stride: 0x1},
-		unicode.Range16{Lo: 0x1a55, Hi: 0x1a55, Stride: 0x1},
-		unicode.Range16{Lo: 0x1a57, Hi: 0x1a57, Stride: 0x1},
-		unicode.Range16{Lo: 0x1a6d, Hi: 0x1a72, Stride: 0x1},
-		unicode.Range16{Lo: 0x1b04, Hi: 0x1b04, Stride: 0x1},
-		unicode.Range16{Lo: 0x1b3b, Hi: 0x1b3b, Stride: 0x1},
-		unicode.Range16{Lo: 0x1b3d, Hi: 0x1b41, Stride: 0x1},
-		unicode.Range16{Lo: 0x1b43, Hi: 0x1b44, Stride: 0x1},
-		unicode.Range16{Lo: 0x1b82, Hi: 0x1b82, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ba1, Hi: 0x1ba1, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ba6, Hi: 0x1ba7, Stride: 0x1},
-		unicode.Range16{Lo: 0x1baa, Hi: 0x1baa, Stride: 0x1},
-		unicode.Range16{Lo: 0x1be7, Hi: 0x1be7, Stride: 0x1},
-		unicode.Range16{Lo: 0x1bea, Hi: 0x1bec, Stride: 0x1},
-		unicode.Range16{Lo: 0x1bee, Hi: 0x1bee, Stride: 0x1},
-		unicode.Range16{Lo: 0x1bf2, Hi: 0x1bf3, Stride: 0x1},
-		unicode.Range16{Lo: 0x1c24, Hi: 0x1c2b, Stride: 0x1},
-		unicode.Range16{Lo: 0x1c34, Hi: 0x1c35, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ce1, Hi: 0x1ce1, Stride: 0x1},
-		unicode.Range16{Lo: 0x1cf7, Hi: 0x1cf7, Stride: 0x1},
-		unicode.Range16{Lo: 0xa823, Hi: 0xa824, Stride: 0x1},
-		unicode.Range16{Lo: 0xa827, Hi: 0xa827, Stride: 0x1},
-		unicode.Range16{Lo: 0xa880, Hi: 0xa881, Stride: 0x1},
-		unicode.Range16{Lo: 0xa8b4, Hi: 0xa8c3, Stride: 0x1},
-		unicode.Range16{Lo: 0xa952, Hi: 0xa953, Stride: 0x1},
-		unicode.Range16{Lo: 0xa983, Hi: 0xa983, Stride: 0x1},
-		unicode.Range16{Lo: 0xa9b4, Hi: 0xa9b5, Stride: 0x1},
-		unicode.Range16{Lo: 0xa9ba, Hi: 0xa9bb, Stride: 0x1},
-		unicode.Range16{Lo: 0xa9be, Hi: 0xa9c0, Stride: 0x1},
-		unicode.Range16{Lo: 0xaa2f, Hi: 0xaa30, Stride: 0x1},
-		unicode.Range16{Lo: 0xaa33, Hi: 0xaa34, Stride: 0x1},
-		unicode.Range16{Lo: 0xaa4d, Hi: 0xaa4d, Stride: 0x1},
-		unicode.Range16{Lo: 0xaaeb, Hi: 0xaaeb, Stride: 0x1},
-		unicode.Range16{Lo: 0xaaee, Hi: 0xaaef, Stride: 0x1},
-		unicode.Range16{Lo: 0xaaf5, Hi: 0xaaf5, Stride: 0x1},
-		unicode.Range16{Lo: 0xabe3, Hi: 0xabe4, Stride: 0x1},
-		unicode.Range16{Lo: 0xabe6, Hi: 0xabe7, Stride: 0x1},
-		unicode.Range16{Lo: 0xabe9, Hi: 0xabea, Stride: 0x1},
-		unicode.Range16{Lo: 0xabec, Hi: 0xabec, Stride: 0x1},
-	},
-	R32: []unicode.Range32{
-		unicode.Range32{Lo: 0x11000, Hi: 0x11000, Stride: 0x1},
-		unicode.Range32{Lo: 0x11002, Hi: 0x11002, Stride: 0x1},
-		unicode.Range32{Lo: 0x11082, Hi: 0x11082, Stride: 0x1},
-		unicode.Range32{Lo: 0x110b0, Hi: 0x110b2, Stride: 0x1},
-		unicode.Range32{Lo: 0x110b7, Hi: 0x110b8, Stride: 0x1},
-		unicode.Range32{Lo: 0x1112c, Hi: 0x1112c, Stride: 0x1},
-		unicode.Range32{Lo: 0x11145, Hi: 0x11146, Stride: 0x1},
-		unicode.Range32{Lo: 0x11182, Hi: 0x11182, Stride: 0x1},
-		unicode.Range32{Lo: 0x111b3, Hi: 0x111b5, Stride: 0x1},
-		unicode.Range32{Lo: 0x111bf, Hi: 0x111c0, Stride: 0x1},
-		unicode.Range32{Lo: 0x1122c, Hi: 0x1122e, Stride: 0x1},
-		unicode.Range32{Lo: 0x11232, Hi: 0x11233, Stride: 0x1},
-		unicode.Range32{Lo: 0x11235, Hi: 0x11235, Stride: 0x1},
-		unicode.Range32{Lo: 0x112e0, Hi: 0x112e2, Stride: 0x1},
-		unicode.Range32{Lo: 0x11302, Hi: 0x11303, Stride: 0x1},
-		unicode.Range32{Lo: 0x1133f, Hi: 0x1133f, Stride: 0x1},
-		unicode.Range32{Lo: 0x11341, Hi: 0x11344, Stride: 0x1},
-		unicode.Range32{Lo: 0x11347, Hi: 0x11348, Stride: 0x1},
-		unicode.Range32{Lo: 0x1134b, Hi: 0x1134d, Stride: 0x1},
-		unicode.Range32{Lo: 0x11362, Hi: 0x11363, Stride: 0x1},
-		unicode.Range32{Lo: 0x11435, Hi: 0x11437, Stride: 0x1},
-		unicode.Range32{Lo: 0x11440, Hi: 0x11441, Stride: 0x1},
-		unicode.Range32{Lo: 0x11445, Hi: 0x11445, Stride: 0x1},
-		unicode.Range32{Lo: 0x114b1, Hi: 0x114b2, Stride: 0x1},
-		unicode.Range32{Lo: 0x114b9, Hi: 0x114b9, Stride: 0x1},
-		unicode.Range32{Lo: 0x114bb, Hi: 0x114bc, Stride: 0x1},
-		unicode.Range32{Lo: 0x114be, Hi: 0x114be, Stride: 0x1},
-		unicode.Range32{Lo: 0x114c1, Hi: 0x114c1, Stride: 0x1},
-		unicode.Range32{Lo: 0x115b0, Hi: 0x115b1, Stride: 0x1},
-		unicode.Range32{Lo: 0x115b8, Hi: 0x115bb, Stride: 0x1},
-		unicode.Range32{Lo: 0x115be, Hi: 0x115be, Stride: 0x1},
-		unicode.Range32{Lo: 0x11630, Hi: 0x11632, Stride: 0x1},
-		unicode.Range32{Lo: 0x1163b, Hi: 0x1163c, Stride: 0x1},
-		unicode.Range32{Lo: 0x1163e, Hi: 0x1163e, Stride: 0x1},
-		unicode.Range32{Lo: 0x116ac, Hi: 0x116ac, Stride: 0x1},
-		unicode.Range32{Lo: 0x116ae, Hi: 0x116af, Stride: 0x1},
-		unicode.Range32{Lo: 0x116b6, Hi: 0x116b6, Stride: 0x1},
-		unicode.Range32{Lo: 0x11720, Hi: 0x11721, Stride: 0x1},
-		unicode.Range32{Lo: 0x11726, Hi: 0x11726, Stride: 0x1},
-		unicode.Range32{Lo: 0x1182c, Hi: 0x1182e, Stride: 0x1},
-		unicode.Range32{Lo: 0x11838, Hi: 0x11838, Stride: 0x1},
-		unicode.Range32{Lo: 0x119d1, Hi: 0x119d3, Stride: 0x1},
-		unicode.Range32{Lo: 0x119dc, Hi: 0x119df, Stride: 0x1},
-		unicode.Range32{Lo: 0x119e4, Hi: 0x119e4, Stride: 0x1},
-		unicode.Range32{Lo: 0x11a39, Hi: 0x11a39, Stride: 0x1},
-		unicode.Range32{Lo: 0x11a57, Hi: 0x11a58, Stride: 0x1},
-		unicode.Range32{Lo: 0x11a97, Hi: 0x11a97, Stride: 0x1},
-		unicode.Range32{Lo: 0x11c2f, Hi: 0x11c2f, Stride: 0x1},
-		unicode.Range32{Lo: 0x11c3e, Hi: 0x11c3e, Stride: 0x1},
-		unicode.Range32{Lo: 0x11ca9, Hi: 0x11ca9, Stride: 0x1},
-		unicode.Range32{Lo: 0x11cb1, Hi: 0x11cb1, Stride: 0x1},
-		unicode.Range32{Lo: 0x11cb4, Hi: 0x11cb4, Stride: 0x1},
-		unicode.Range32{Lo: 0x11d8a, Hi: 0x11d8e, Stride: 0x1},
-		unicode.Range32{Lo: 0x11d93, Hi: 0x11d94, Stride: 0x1},
-		unicode.Range32{Lo: 0x11d96, Hi: 0x11d96, Stride: 0x1},
-		unicode.Range32{Lo: 0x11ef5, Hi: 0x11ef6, Stride: 0x1},
-		unicode.Range32{Lo: 0x16f51, Hi: 0x16f87, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d166, Hi: 0x1d166, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d16d, Hi: 0x1d16d, Stride: 0x1},
-	},
-	LatinOffset: 0,
-}
-
-var _GraphemeT = &unicode.RangeTable{
-	R16: []unicode.Range16{
-		unicode.Range16{Lo: 0x11a8, Hi: 0x11ff, Stride: 0x1},
-		unicode.Range16{Lo: 0xd7cb, Hi: 0xd7fb, Stride: 0x1},
-	},
-	LatinOffset: 0,
-}
-
-var _GraphemeV = &unicode.RangeTable{
-	R16: []unicode.Range16{
-		unicode.Range16{Lo: 0x1160, Hi: 0x11a7, Stride: 0x1},
-		unicode.Range16{Lo: 0xd7b0, Hi: 0xd7c6, Stride: 0x1},
-	},
-	LatinOffset: 0,
-}
-
-var _GraphemeZWJ = &unicode.RangeTable{
-	R16: []unicode.Range16{
-		unicode.Range16{Lo: 0x200d, Hi: 0x200d, Stride: 0x1},
-	},
-	LatinOffset: 0,
-}
-
-type _GraphemeRuneRange unicode.RangeTable
-
-func _GraphemeRuneType(r rune) *_GraphemeRuneRange {
-	switch {
-	case unicode.Is(_GraphemeCR, r):
-		return (*_GraphemeRuneRange)(_GraphemeCR)
-	case unicode.Is(_GraphemeControl, r):
-		return (*_GraphemeRuneRange)(_GraphemeControl)
-	case unicode.Is(_GraphemeExtend, r):
-		return (*_GraphemeRuneRange)(_GraphemeExtend)
-	case unicode.Is(_GraphemeL, r):
-		return (*_GraphemeRuneRange)(_GraphemeL)
-	case unicode.Is(_GraphemeLF, r):
-		return (*_GraphemeRuneRange)(_GraphemeLF)
-	case unicode.Is(_GraphemeLV, r):
-		return (*_GraphemeRuneRange)(_GraphemeLV)
-	case unicode.Is(_GraphemeLVT, r):
-		return (*_GraphemeRuneRange)(_GraphemeLVT)
-	case unicode.Is(_GraphemePrepend, r):
-		return (*_GraphemeRuneRange)(_GraphemePrepend)
-	case unicode.Is(_GraphemeRegional_Indicator, r):
-		return (*_GraphemeRuneRange)(_GraphemeRegional_Indicator)
-	case unicode.Is(_GraphemeSpacingMark, r):
-		return (*_GraphemeRuneRange)(_GraphemeSpacingMark)
-	case unicode.Is(_GraphemeT, r):
-		return (*_GraphemeRuneRange)(_GraphemeT)
-	case unicode.Is(_GraphemeV, r):
-		return (*_GraphemeRuneRange)(_GraphemeV)
-	case unicode.Is(_GraphemeZWJ, r):
-		return (*_GraphemeRuneRange)(_GraphemeZWJ)
-	default:
-		return nil
-	}
-}
-func (rng *_GraphemeRuneRange) String() string {
-	switch (*unicode.RangeTable)(rng) {
-	case _GraphemeCR:
-		return "CR"
-	case _GraphemeControl:
-		return "Control"
-	case _GraphemeExtend:
-		return "Extend"
-	case _GraphemeL:
-		return "L"
-	case _GraphemeLF:
-		return "LF"
-	case _GraphemeLV:
-		return "LV"
-	case _GraphemeLVT:
-		return "LVT"
-	case _GraphemePrepend:
-		return "Prepend"
-	case _GraphemeRegional_Indicator:
-		return "Regional_Indicator"
-	case _GraphemeSpacingMark:
-		return "SpacingMark"
-	case _GraphemeT:
-		return "T"
-	case _GraphemeV:
-		return "V"
-	case _GraphemeZWJ:
-		return "ZWJ"
-	default:
-		return "Other"
-	}
-}
-
-var _WordALetter = &unicode.RangeTable{
-	R16: []unicode.Range16{
-		unicode.Range16{Lo: 0x41, Hi: 0x5a, Stride: 0x1},
-		unicode.Range16{Lo: 0x61, Hi: 0x7a, Stride: 0x1},
-		unicode.Range16{Lo: 0xaa, Hi: 0xaa, Stride: 0x1},
-		unicode.Range16{Lo: 0xb5, Hi: 0xb5, Stride: 0x1},
-		unicode.Range16{Lo: 0xba, Hi: 0xba, Stride: 0x1},
-		unicode.Range16{Lo: 0xc0, Hi: 0xd6, Stride: 0x1},
-		unicode.Range16{Lo: 0xd8, Hi: 0xf6, Stride: 0x1},
-		unicode.Range16{Lo: 0xf8, Hi: 0x1ba, Stride: 0x1},
-		unicode.Range16{Lo: 0x1bb, Hi: 0x1bb, Stride: 0x1},
-		unicode.Range16{Lo: 0x1bc, Hi: 0x1bf, Stride: 0x1},
-		unicode.Range16{Lo: 0x1c0, Hi: 0x1c3, Stride: 0x1},
-		unicode.Range16{Lo: 0x1c4, Hi: 0x293, Stride: 0x1},
-		unicode.Range16{Lo: 0x294, Hi: 0x294, Stride: 0x1},
-		unicode.Range16{Lo: 0x295, Hi: 0x2af, Stride: 0x1},
-		unicode.Range16{Lo: 0x2b0, Hi: 0x2c1, Stride: 0x1},
-		unicode.Range16{Lo: 0x2c2, Hi: 0x2c5, Stride: 0x1},
-		unicode.Range16{Lo: 0x2c6, Hi: 0x2d1, Stride: 0x1},
-		unicode.Range16{Lo: 0x2d2, Hi: 0x2d7, Stride: 0x1},
-		unicode.Range16{Lo: 0x2de, Hi: 0x2df, Stride: 0x1},
-		unicode.Range16{Lo: 0x2e0, Hi: 0x2e4, Stride: 0x1},
-		unicode.Range16{Lo: 0x2ec, Hi: 0x2ec, Stride: 0x1},
-		unicode.Range16{Lo: 0x2ed, Hi: 0x2ed, Stride: 0x1},
-		unicode.Range16{Lo: 0x2ee, Hi: 0x2ee, Stride: 0x1},
-		unicode.Range16{Lo: 0x2ef, Hi: 0x2ff, Stride: 0x1},
-		unicode.Range16{Lo: 0x370, Hi: 0x373, Stride: 0x1},
-		unicode.Range16{Lo: 0x374, Hi: 0x374, Stride: 0x1},
-		unicode.Range16{Lo: 0x376, Hi: 0x377, Stride: 0x1},
-		unicode.Range16{Lo: 0x37a, Hi: 0x37a, Stride: 0x1},
-		unicode.Range16{Lo: 0x37b, Hi: 0x37d, Stride: 0x1},
-		unicode.Range16{Lo: 0x37f, Hi: 0x37f, Stride: 0x1},
-		unicode.Range16{Lo: 0x386, Hi: 0x386, Stride: 0x1},
-		unicode.Range16{Lo: 0x388, Hi: 0x38a, Stride: 0x1},
-		unicode.Range16{Lo: 0x38c, Hi: 0x38c, Stride: 0x1},
-		unicode.Range16{Lo: 0x38e, Hi: 0x3a1, Stride: 0x1},
-		unicode.Range16{Lo: 0x3a3, Hi: 0x3f5, Stride: 0x1},
-		unicode.Range16{Lo: 0x3f7, Hi: 0x481, Stride: 0x1},
-		unicode.Range16{Lo: 0x48a, Hi: 0x52f, Stride: 0x1},
-		unicode.Range16{Lo: 0x531, Hi: 0x556, Stride: 0x1},
-		unicode.Range16{Lo: 0x559, Hi: 0x559, Stride: 0x1},
-		unicode.Range16{Lo: 0x55b, Hi: 0x55c, Stride: 0x1},
-		unicode.Range16{Lo: 0x55e, Hi: 0x55e, Stride: 0x1},
-		unicode.Range16{Lo: 0x560, Hi: 0x588, Stride: 0x1},
-		unicode.Range16{Lo: 0x5f3, Hi: 0x5f3, Stride: 0x1},
-		unicode.Range16{Lo: 0x620, Hi: 0x63f, Stride: 0x1},
-		unicode.Range16{Lo: 0x640, Hi: 0x640, Stride: 0x1},
-		unicode.Range16{Lo: 0x641, Hi: 0x64a, Stride: 0x1},
-		unicode.Range16{Lo: 0x66e, Hi: 0x66f, Stride: 0x1},
-		unicode.Range16{Lo: 0x671, Hi: 0x6d3, Stride: 0x1},
-		unicode.Range16{Lo: 0x6d5, Hi: 0x6d5, Stride: 0x1},
-		unicode.Range16{Lo: 0x6e5, Hi: 0x6e6, Stride: 0x1},
-		unicode.Range16{Lo: 0x6ee, Hi: 0x6ef, Stride: 0x1},
-		unicode.Range16{Lo: 0x6fa, Hi: 0x6fc, Stride: 0x1},
-		unicode.Range16{Lo: 0x6ff, Hi: 0x6ff, Stride: 0x1},
-		unicode.Range16{Lo: 0x710, Hi: 0x710, Stride: 0x1},
-		unicode.Range16{Lo: 0x712, Hi: 0x72f, Stride: 0x1},
-		unicode.Range16{Lo: 0x74d, Hi: 0x7a5, Stride: 0x1},
-		unicode.Range16{Lo: 0x7b1, Hi: 0x7b1, Stride: 0x1},
-		unicode.Range16{Lo: 0x7ca, Hi: 0x7ea, Stride: 0x1},
-		unicode.Range16{Lo: 0x7f4, Hi: 0x7f5, Stride: 0x1},
-		unicode.Range16{Lo: 0x7fa, Hi: 0x7fa, Stride: 0x1},
-		unicode.Range16{Lo: 0x800, Hi: 0x815, Stride: 0x1},
-		unicode.Range16{Lo: 0x81a, Hi: 0x81a, Stride: 0x1},
-		unicode.Range16{Lo: 0x824, Hi: 0x824, Stride: 0x1},
-		unicode.Range16{Lo: 0x828, Hi: 0x828, Stride: 0x1},
-		unicode.Range16{Lo: 0x840, Hi: 0x858, Stride: 0x1},
-		unicode.Range16{Lo: 0x860, Hi: 0x86a, Stride: 0x1},
-		unicode.Range16{Lo: 0x8a0, Hi: 0x8b4, Stride: 0x1},
-		unicode.Range16{Lo: 0x8b6, Hi: 0x8bd, Stride: 0x1},
-		unicode.Range16{Lo: 0x904, Hi: 0x939, Stride: 0x1},
-		unicode.Range16{Lo: 0x93d, Hi: 0x93d, Stride: 0x1},
-		unicode.Range16{Lo: 0x950, Hi: 0x950, Stride: 0x1},
-		unicode.Range16{Lo: 0x958, Hi: 0x961, Stride: 0x1},
-		unicode.Range16{Lo: 0x971, Hi: 0x971, Stride: 0x1},
-		unicode.Range16{Lo: 0x972, Hi: 0x980, Stride: 0x1},
-		unicode.Range16{Lo: 0x985, Hi: 0x98c, Stride: 0x1},
-		unicode.Range16{Lo: 0x98f, Hi: 0x990, Stride: 0x1},
-		unicode.Range16{Lo: 0x993, Hi: 0x9a8, Stride: 0x1},
-		unicode.Range16{Lo: 0x9aa, Hi: 0x9b0, Stride: 0x1},
-		unicode.Range16{Lo: 0x9b2, Hi: 0x9b2, Stride: 0x1},
-		unicode.Range16{Lo: 0x9b6, Hi: 0x9b9, Stride: 0x1},
-		unicode.Range16{Lo: 0x9bd, Hi: 0x9bd, Stride: 0x1},
-		unicode.Range16{Lo: 0x9ce, Hi: 0x9ce, Stride: 0x1},
-		unicode.Range16{Lo: 0x9dc, Hi: 0x9dd, Stride: 0x1},
-		unicode.Range16{Lo: 0x9df, Hi: 0x9e1, Stride: 0x1},
-		unicode.Range16{Lo: 0x9f0, Hi: 0x9f1, Stride: 0x1},
-		unicode.Range16{Lo: 0x9fc, Hi: 0x9fc, Stride: 0x1},
-		unicode.Range16{Lo: 0xa05, Hi: 0xa0a, Stride: 0x1},
-		unicode.Range16{Lo: 0xa0f, Hi: 0xa10, Stride: 0x1},
-		unicode.Range16{Lo: 0xa13, Hi: 0xa28, Stride: 0x1},
-		unicode.Range16{Lo: 0xa2a, Hi: 0xa30, Stride: 0x1},
-		unicode.Range16{Lo: 0xa32, Hi: 0xa33, Stride: 0x1},
-		unicode.Range16{Lo: 0xa35, Hi: 0xa36, Stride: 0x1},
-		unicode.Range16{Lo: 0xa38, Hi: 0xa39, Stride: 0x1},
-		unicode.Range16{Lo: 0xa59, Hi: 0xa5c, Stride: 0x1},
-		unicode.Range16{Lo: 0xa5e, Hi: 0xa5e, Stride: 0x1},
-		unicode.Range16{Lo: 0xa72, Hi: 0xa74, Stride: 0x1},
-		unicode.Range16{Lo: 0xa85, Hi: 0xa8d, Stride: 0x1},
-		unicode.Range16{Lo: 0xa8f, Hi: 0xa91, Stride: 0x1},
-		unicode.Range16{Lo: 0xa93, Hi: 0xaa8, Stride: 0x1},
-		unicode.Range16{Lo: 0xaaa, Hi: 0xab0, Stride: 0x1},
-		unicode.Range16{Lo: 0xab2, Hi: 0xab3, Stride: 0x1},
-		unicode.Range16{Lo: 0xab5, Hi: 0xab9, Stride: 0x1},
-		unicode.Range16{Lo: 0xabd, Hi: 0xabd, Stride: 0x1},
-		unicode.Range16{Lo: 0xad0, Hi: 0xad0, Stride: 0x1},
-		unicode.Range16{Lo: 0xae0, Hi: 0xae1, Stride: 0x1},
-		unicode.Range16{Lo: 0xaf9, Hi: 0xaf9, Stride: 0x1},
-		unicode.Range16{Lo: 0xb05, Hi: 0xb0c, Stride: 0x1},
-		unicode.Range16{Lo: 0xb0f, Hi: 0xb10, Stride: 0x1},
-		unicode.Range16{Lo: 0xb13, Hi: 0xb28, Stride: 0x1},
-		unicode.Range16{Lo: 0xb2a, Hi: 0xb30, Stride: 0x1},
-		unicode.Range16{Lo: 0xb32, Hi: 0xb33, Stride: 0x1},
-		unicode.Range16{Lo: 0xb35, Hi: 0xb39, Stride: 0x1},
-		unicode.Range16{Lo: 0xb3d, Hi: 0xb3d, Stride: 0x1},
-		unicode.Range16{Lo: 0xb5c, Hi: 0xb5d, Stride: 0x1},
-		unicode.Range16{Lo: 0xb5f, Hi: 0xb61, Stride: 0x1},
-		unicode.Range16{Lo: 0xb71, Hi: 0xb71, Stride: 0x1},
-		unicode.Range16{Lo: 0xb83, Hi: 0xb83, Stride: 0x1},
-		unicode.Range16{Lo: 0xb85, Hi: 0xb8a, Stride: 0x1},
-		unicode.Range16{Lo: 0xb8e, Hi: 0xb90, Stride: 0x1},
-		unicode.Range16{Lo: 0xb92, Hi: 0xb95, Stride: 0x1},
-		unicode.Range16{Lo: 0xb99, Hi: 0xb9a, Stride: 0x1},
-		unicode.Range16{Lo: 0xb9c, Hi: 0xb9c, Stride: 0x1},
-		unicode.Range16{Lo: 0xb9e, Hi: 0xb9f, Stride: 0x1},
-		unicode.Range16{Lo: 0xba3, Hi: 0xba4, Stride: 0x1},
-		unicode.Range16{Lo: 0xba8, Hi: 0xbaa, Stride: 0x1},
-		unicode.Range16{Lo: 0xbae, Hi: 0xbb9, Stride: 0x1},
-		unicode.Range16{Lo: 0xbd0, Hi: 0xbd0, Stride: 0x1},
-		unicode.Range16{Lo: 0xc05, Hi: 0xc0c, Stride: 0x1},
-		unicode.Range16{Lo: 0xc0e, Hi: 0xc10, Stride: 0x1},
-		unicode.Range16{Lo: 0xc12, Hi: 0xc28, Stride: 0x1},
-		unicode.Range16{Lo: 0xc2a, Hi: 0xc39, Stride: 0x1},
-		unicode.Range16{Lo: 0xc3d, Hi: 0xc3d, Stride: 0x1},
-		unicode.Range16{Lo: 0xc58, Hi: 0xc5a, Stride: 0x1},
-		unicode.Range16{Lo: 0xc60, Hi: 0xc61, Stride: 0x1},
-		unicode.Range16{Lo: 0xc80, Hi: 0xc80, Stride: 0x1},
-		unicode.Range16{Lo: 0xc85, Hi: 0xc8c, Stride: 0x1},
-		unicode.Range16{Lo: 0xc8e, Hi: 0xc90, Stride: 0x1},
-		unicode.Range16{Lo: 0xc92, Hi: 0xca8, Stride: 0x1},
-		unicode.Range16{Lo: 0xcaa, Hi: 0xcb3, Stride: 0x1},
-		unicode.Range16{Lo: 0xcb5, Hi: 0xcb9, Stride: 0x1},
-		unicode.Range16{Lo: 0xcbd, Hi: 0xcbd, Stride: 0x1},
-		unicode.Range16{Lo: 0xcde, Hi: 0xcde, Stride: 0x1},
-		unicode.Range16{Lo: 0xce0, Hi: 0xce1, Stride: 0x1},
-		unicode.Range16{Lo: 0xcf1, Hi: 0xcf2, Stride: 0x1},
-		unicode.Range16{Lo: 0xd05, Hi: 0xd0c, Stride: 0x1},
-		unicode.Range16{Lo: 0xd0e, Hi: 0xd10, Stride: 0x1},
-		unicode.Range16{Lo: 0xd12, Hi: 0xd3a, Stride: 0x1},
-		unicode.Range16{Lo: 0xd3d, Hi: 0xd3d, Stride: 0x1},
-		unicode.Range16{Lo: 0xd4e, Hi: 0xd4e, Stride: 0x1},
-		unicode.Range16{Lo: 0xd54, Hi: 0xd56, Stride: 0x1},
-		unicode.Range16{Lo: 0xd5f, Hi: 0xd61, Stride: 0x1},
-		unicode.Range16{Lo: 0xd7a, Hi: 0xd7f, Stride: 0x1},
-		unicode.Range16{Lo: 0xd85, Hi: 0xd96, Stride: 0x1},
-		unicode.Range16{Lo: 0xd9a, Hi: 0xdb1, Stride: 0x1},
-		unicode.Range16{Lo: 0xdb3, Hi: 0xdbb, Stride: 0x1},
-		unicode.Range16{Lo: 0xdbd, Hi: 0xdbd, Stride: 0x1},
-		unicode.Range16{Lo: 0xdc0, Hi: 0xdc6, Stride: 0x1},
-		unicode.Range16{Lo: 0xf00, Hi: 0xf00, Stride: 0x1},
-		unicode.Range16{Lo: 0xf40, Hi: 0xf47, Stride: 0x1},
-		unicode.Range16{Lo: 0xf49, Hi: 0xf6c, Stride: 0x1},
-		unicode.Range16{Lo: 0xf88, Hi: 0xf8c, Stride: 0x1},
-		unicode.Range16{Lo: 0x10a0, Hi: 0x10c5, Stride: 0x1},
-		unicode.Range16{Lo: 0x10c7, Hi: 0x10c7, Stride: 0x1},
-		unicode.Range16{Lo: 0x10cd, Hi: 0x10cd, Stride: 0x1},
-		unicode.Range16{Lo: 0x10d0, Hi: 0x10fa, Stride: 0x1},
-		unicode.Range16{Lo: 0x10fc, Hi: 0x10fc, Stride: 0x1},
-		unicode.Range16{Lo: 0x10fd, Hi: 0x10ff, Stride: 0x1},
-		unicode.Range16{Lo: 0x1100, Hi: 0x1248, Stride: 0x1},
-		unicode.Range16{Lo: 0x124a, Hi: 0x124d, Stride: 0x1},
-		unicode.Range16{Lo: 0x1250, Hi: 0x1256, Stride: 0x1},
-		unicode.Range16{Lo: 0x1258, Hi: 0x1258, Stride: 0x1},
-		unicode.Range16{Lo: 0x125a, Hi: 0x125d, Stride: 0x1},
-		unicode.Range16{Lo: 0x1260, Hi: 0x1288, Stride: 0x1},
-		unicode.Range16{Lo: 0x128a, Hi: 0x128d, Stride: 0x1},
-		unicode.Range16{Lo: 0x1290, Hi: 0x12b0, Stride: 0x1},
-		unicode.Range16{Lo: 0x12b2, Hi: 0x12b5, Stride: 0x1},
-		unicode.Range16{Lo: 0x12b8, Hi: 0x12be, Stride: 0x1},
-		unicode.Range16{Lo: 0x12c0, Hi: 0x12c0, Stride: 0x1},
-		unicode.Range16{Lo: 0x12c2, Hi: 0x12c5, Stride: 0x1},
-		unicode.Range16{Lo: 0x12c8, Hi: 0x12d6, Stride: 0x1},
-		unicode.Range16{Lo: 0x12d8, Hi: 0x1310, Stride: 0x1},
-		unicode.Range16{Lo: 0x1312, Hi: 0x1315, Stride: 0x1},
-		unicode.Range16{Lo: 0x1318, Hi: 0x135a, Stride: 0x1},
-		unicode.Range16{Lo: 0x1380, Hi: 0x138f, Stride: 0x1},
-		unicode.Range16{Lo: 0x13a0, Hi: 0x13f5, Stride: 0x1},
-		unicode.Range16{Lo: 0x13f8, Hi: 0x13fd, Stride: 0x1},
-		unicode.Range16{Lo: 0x1401, Hi: 0x166c, Stride: 0x1},
-		unicode.Range16{Lo: 0x166f, Hi: 0x167f, Stride: 0x1},
-		unicode.Range16{Lo: 0x1681, Hi: 0x169a, Stride: 0x1},
-		unicode.Range16{Lo: 0x16a0, Hi: 0x16ea, Stride: 0x1},
-		unicode.Range16{Lo: 0x16ee, Hi: 0x16f0, Stride: 0x1},
-		unicode.Range16{Lo: 0x16f1, Hi: 0x16f8, Stride: 0x1},
-		unicode.Range16{Lo: 0x1700, Hi: 0x170c, Stride: 0x1},
-		unicode.Range16{Lo: 0x170e, Hi: 0x1711, Stride: 0x1},
-		unicode.Range16{Lo: 0x1720, Hi: 0x1731, Stride: 0x1},
-		unicode.Range16{Lo: 0x1740, Hi: 0x1751, Stride: 0x1},
-		unicode.Range16{Lo: 0x1760, Hi: 0x176c, Stride: 0x1},
-		unicode.Range16{Lo: 0x176e, Hi: 0x1770, Stride: 0x1},
-		unicode.Range16{Lo: 0x1820, Hi: 0x1842, Stride: 0x1},
-		unicode.Range16{Lo: 0x1843, Hi: 0x1843, Stride: 0x1},
-		unicode.Range16{Lo: 0x1844, Hi: 0x1878, Stride: 0x1},
-		unicode.Range16{Lo: 0x1880, Hi: 0x1884, Stride: 0x1},
-		unicode.Range16{Lo: 0x1887, Hi: 0x18a8, Stride: 0x1},
-		unicode.Range16{Lo: 0x18aa, Hi: 0x18aa, Stride: 0x1},
-		unicode.Range16{Lo: 0x18b0, Hi: 0x18f5, Stride: 0x1},
-		unicode.Range16{Lo: 0x1900, Hi: 0x191e, Stride: 0x1},
-		unicode.Range16{Lo: 0x1a00, Hi: 0x1a16, Stride: 0x1},
-		unicode.Range16{Lo: 0x1b05, Hi: 0x1b33, Stride: 0x1},
-		unicode.Range16{Lo: 0x1b45, Hi: 0x1b4b, Stride: 0x1},
-		unicode.Range16{Lo: 0x1b83, Hi: 0x1ba0, Stride: 0x1},
-		unicode.Range16{Lo: 0x1bae, Hi: 0x1baf, Stride: 0x1},
-		unicode.Range16{Lo: 0x1bba, Hi: 0x1be5, Stride: 0x1},
-		unicode.Range16{Lo: 0x1c00, Hi: 0x1c23, Stride: 0x1},
-		unicode.Range16{Lo: 0x1c4d, Hi: 0x1c4f, Stride: 0x1},
-		unicode.Range16{Lo: 0x1c5a, Hi: 0x1c77, Stride: 0x1},
-		unicode.Range16{Lo: 0x1c78, Hi: 0x1c7d, Stride: 0x1},
-		unicode.Range16{Lo: 0x1c80, Hi: 0x1c88, Stride: 0x1},
-		unicode.Range16{Lo: 0x1c90, Hi: 0x1cba, Stride: 0x1},
-		unicode.Range16{Lo: 0x1cbd, Hi: 0x1cbf, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ce9, Hi: 0x1cec, Stride: 0x1},
-		unicode.Range16{Lo: 0x1cee, Hi: 0x1cf3, Stride: 0x1},
-		unicode.Range16{Lo: 0x1cf5, Hi: 0x1cf6, Stride: 0x1},
-		unicode.Range16{Lo: 0x1cfa, Hi: 0x1cfa, Stride: 0x1},
-		unicode.Range16{Lo: 0x1d00, Hi: 0x1d2b, Stride: 0x1},
-		unicode.Range16{Lo: 0x1d2c, Hi: 0x1d6a, Stride: 0x1},
-		unicode.Range16{Lo: 0x1d6b, Hi: 0x1d77, Stride: 0x1},
-		unicode.Range16{Lo: 0x1d78, Hi: 0x1d78, Stride: 0x1},
-		unicode.Range16{Lo: 0x1d79, Hi: 0x1d9a, Stride: 0x1},
-		unicode.Range16{Lo: 0x1d9b, Hi: 0x1dbf, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e00, Hi: 0x1f15, Stride: 0x1},
-		unicode.Range16{Lo: 0x1f18, Hi: 0x1f1d, Stride: 0x1},
-		unicode.Range16{Lo: 0x1f20, Hi: 0x1f45, Stride: 0x1},
-		unicode.Range16{Lo: 0x1f48, Hi: 0x1f4d, Stride: 0x1},
-		unicode.Range16{Lo: 0x1f50, Hi: 0x1f57, Stride: 0x1},
-		unicode.Range16{Lo: 0x1f59, Hi: 0x1f59, Stride: 0x1},
-		unicode.Range16{Lo: 0x1f5b, Hi: 0x1f5b, Stride: 0x1},
-		unicode.Range16{Lo: 0x1f5d, Hi: 0x1f5d, Stride: 0x1},
-		unicode.Range16{Lo: 0x1f5f, Hi: 0x1f7d, Stride: 0x1},
-		unicode.Range16{Lo: 0x1f80, Hi: 0x1fb4, Stride: 0x1},
-		unicode.Range16{Lo: 0x1fb6, Hi: 0x1fbc, Stride: 0x1},
-		unicode.Range16{Lo: 0x1fbe, Hi: 0x1fbe, Stride: 0x1},
-		unicode.Range16{Lo: 0x1fc2, Hi: 0x1fc4, Stride: 0x1},
-		unicode.Range16{Lo: 0x1fc6, Hi: 0x1fcc, Stride: 0x1},
-		unicode.Range16{Lo: 0x1fd0, Hi: 0x1fd3, Stride: 0x1},
-		unicode.Range16{Lo: 0x1fd6, Hi: 0x1fdb, Stride: 0x1},
-		unicode.Range16{Lo: 0x1fe0, Hi: 0x1fec, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ff2, Hi: 0x1ff4, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ff6, Hi: 0x1ffc, Stride: 0x1},
-		unicode.Range16{Lo: 0x2071, Hi: 0x2071, Stride: 0x1},
-		unicode.Range16{Lo: 0x207f, Hi: 0x207f, Stride: 0x1},
-		unicode.Range16{Lo: 0x2090, Hi: 0x209c, Stride: 0x1},
-		unicode.Range16{Lo: 0x2102, Hi: 0x2102, Stride: 0x1},
-		unicode.Range16{Lo: 0x2107, Hi: 0x2107, Stride: 0x1},
-		unicode.Range16{Lo: 0x210a, Hi: 0x2113, Stride: 0x1},
-		unicode.Range16{Lo: 0x2115, Hi: 0x2115, Stride: 0x1},
-		unicode.Range16{Lo: 0x2119, Hi: 0x211d, Stride: 0x1},
-		unicode.Range16{Lo: 0x2124, Hi: 0x2124, Stride: 0x1},
-		unicode.Range16{Lo: 0x2126, Hi: 0x2126, Stride: 0x1},
-		unicode.Range16{Lo: 0x2128, Hi: 0x2128, Stride: 0x1},
-		unicode.Range16{Lo: 0x212a, Hi: 0x212d, Stride: 0x1},
-		unicode.Range16{Lo: 0x212f, Hi: 0x2134, Stride: 0x1},
-		unicode.Range16{Lo: 0x2135, Hi: 0x2138, Stride: 0x1},
-		unicode.Range16{Lo: 0x2139, Hi: 0x2139, Stride: 0x1},
-		unicode.Range16{Lo: 0x213c, Hi: 0x213f, Stride: 0x1},
-		unicode.Range16{Lo: 0x2145, Hi: 0x2149, Stride: 0x1},
-		unicode.Range16{Lo: 0x214e, Hi: 0x214e, Stride: 0x1},
-		unicode.Range16{Lo: 0x2160, Hi: 0x2182, Stride: 0x1},
-		unicode.Range16{Lo: 0x2183, Hi: 0x2184, Stride: 0x1},
-		unicode.Range16{Lo: 0x2185, Hi: 0x2188, Stride: 0x1},
-		unicode.Range16{Lo: 0x24b6, Hi: 0x24e9, Stride: 0x1},
-		unicode.Range16{Lo: 0x2c00, Hi: 0x2c2e, Stride: 0x1},
-		unicode.Range16{Lo: 0x2c30, Hi: 0x2c5e, Stride: 0x1},
-		unicode.Range16{Lo: 0x2c60, Hi: 0x2c7b, Stride: 0x1},
-		unicode.Range16{Lo: 0x2c7c, Hi: 0x2c7d, Stride: 0x1},
-		unicode.Range16{Lo: 0x2c7e, Hi: 0x2ce4, Stride: 0x1},
-		unicode.Range16{Lo: 0x2ceb, Hi: 0x2cee, Stride: 0x1},
-		unicode.Range16{Lo: 0x2cf2, Hi: 0x2cf3, Stride: 0x1},
-		unicode.Range16{Lo: 0x2d00, Hi: 0x2d25, Stride: 0x1},
-		unicode.Range16{Lo: 0x2d27, Hi: 0x2d27, Stride: 0x1},
-		unicode.Range16{Lo: 0x2d2d, Hi: 0x2d2d, Stride: 0x1},
-		unicode.Range16{Lo: 0x2d30, Hi: 0x2d67, Stride: 0x1},
-		unicode.Range16{Lo: 0x2d6f, Hi: 0x2d6f, Stride: 0x1},
-		unicode.Range16{Lo: 0x2d80, Hi: 0x2d96, Stride: 0x1},
-		unicode.Range16{Lo: 0x2da0, Hi: 0x2da6, Stride: 0x1},
-		unicode.Range16{Lo: 0x2da8, Hi: 0x2dae, Stride: 0x1},
-		unicode.Range16{Lo: 0x2db0, Hi: 0x2db6, Stride: 0x1},
-		unicode.Range16{Lo: 0x2db8, Hi: 0x2dbe, Stride: 0x1},
-		unicode.Range16{Lo: 0x2dc0, Hi: 0x2dc6, Stride: 0x1},
-		unicode.Range16{Lo: 0x2dc8, Hi: 0x2dce, Stride: 0x1},
-		unicode.Range16{Lo: 0x2dd0, Hi: 0x2dd6, Stride: 0x1},
-		unicode.Range16{Lo: 0x2dd8, Hi: 0x2dde, Stride: 0x1},
-		unicode.Range16{Lo: 0x2e2f, Hi: 0x2e2f, Stride: 0x1},
-		unicode.Range16{Lo: 0x3005, Hi: 0x3005, Stride: 0x1},
-		unicode.Range16{Lo: 0x303b, Hi: 0x303b, Stride: 0x1},
-		unicode.Range16{Lo: 0x303c, Hi: 0x303c, Stride: 0x1},
-		unicode.Range16{Lo: 0x3105, Hi: 0x312f, Stride: 0x1},
-		unicode.Range16{Lo: 0x3131, Hi: 0x318e, Stride: 0x1},
-		unicode.Range16{Lo: 0x31a0, Hi: 0x31ba, Stride: 0x1},
-		unicode.Range16{Lo: 0xa000, Hi: 0xa014, Stride: 0x1},
-		unicode.Range16{Lo: 0xa015, Hi: 0xa015, Stride: 0x1},
-		unicode.Range16{Lo: 0xa016, Hi: 0xa48c, Stride: 0x1},
-		unicode.Range16{Lo: 0xa4d0, Hi: 0xa4f7, Stride: 0x1},
-		unicode.Range16{Lo: 0xa4f8, Hi: 0xa4fd, Stride: 0x1},
-		unicode.Range16{Lo: 0xa500, Hi: 0xa60b, Stride: 0x1},
-		unicode.Range16{Lo: 0xa60c, Hi: 0xa60c, Stride: 0x1},
-		unicode.Range16{Lo: 0xa610, Hi: 0xa61f, Stride: 0x1},
-		unicode.Range16{Lo: 0xa62a, Hi: 0xa62b, Stride: 0x1},
-		unicode.Range16{Lo: 0xa640, Hi: 0xa66d, Stride: 0x1},
-		unicode.Range16{Lo: 0xa66e, Hi: 0xa66e, Stride: 0x1},
-		unicode.Range16{Lo: 0xa67f, Hi: 0xa67f, Stride: 0x1},
-		unicode.Range16{Lo: 0xa680, Hi: 0xa69b, Stride: 0x1},
-		unicode.Range16{Lo: 0xa69c, Hi: 0xa69d, Stride: 0x1},
-		unicode.Range16{Lo: 0xa6a0, Hi: 0xa6e5, Stride: 0x1},
-		unicode.Range16{Lo: 0xa6e6, Hi: 0xa6ef, Stride: 0x1},
-		unicode.Range16{Lo: 0xa717, Hi: 0xa71f, Stride: 0x1},
-		unicode.Range16{Lo: 0xa720, Hi: 0xa721, Stride: 0x1},
-		unicode.Range16{Lo: 0xa722, Hi: 0xa76f, Stride: 0x1},
-		unicode.Range16{Lo: 0xa770, Hi: 0xa770, Stride: 0x1},
-		unicode.Range16{Lo: 0xa771, Hi: 0xa787, Stride: 0x1},
-		unicode.Range16{Lo: 0xa788, Hi: 0xa788, Stride: 0x1},
-		unicode.Range16{Lo: 0xa789, Hi: 0xa78a, Stride: 0x1},
-		unicode.Range16{Lo: 0xa78b, Hi: 0xa78e, Stride: 0x1},
-		unicode.Range16{Lo: 0xa78f, Hi: 0xa78f, Stride: 0x1},
-		unicode.Range16{Lo: 0xa790, Hi: 0xa7bf, Stride: 0x1},
-		unicode.Range16{Lo: 0xa7c2, Hi: 0xa7c6, Stride: 0x1},
-		unicode.Range16{Lo: 0xa7f7, Hi: 0xa7f7, Stride: 0x1},
-		unicode.Range16{Lo: 0xa7f8, Hi: 0xa7f9, Stride: 0x1},
-		unicode.Range16{Lo: 0xa7fa, Hi: 0xa7fa, Stride: 0x1},
-		unicode.Range16{Lo: 0xa7fb, Hi: 0xa801, Stride: 0x1},
-		unicode.Range16{Lo: 0xa803, Hi: 0xa805, Stride: 0x1},
-		unicode.Range16{Lo: 0xa807, Hi: 0xa80a, Stride: 0x1},
-		unicode.Range16{Lo: 0xa80c, Hi: 0xa822, Stride: 0x1},
-		unicode.Range16{Lo: 0xa840, Hi: 0xa873, Stride: 0x1},
-		unicode.Range16{Lo: 0xa882, Hi: 0xa8b3, Stride: 0x1},
-		unicode.Range16{Lo: 0xa8f2, Hi: 0xa8f7, Stride: 0x1},
-		unicode.Range16{Lo: 0xa8fb, Hi: 0xa8fb, Stride: 0x1},
-		unicode.Range16{Lo: 0xa8fd, Hi: 0xa8fe, Stride: 0x1},
-		unicode.Range16{Lo: 0xa90a, Hi: 0xa925, Stride: 0x1},
-		unicode.Range16{Lo: 0xa930, Hi: 0xa946, Stride: 0x1},
-		unicode.Range16{Lo: 0xa960, Hi: 0xa97c, Stride: 0x1},
-		unicode.Range16{Lo: 0xa984, Hi: 0xa9b2, Stride: 0x1},
-		unicode.Range16{Lo: 0xa9cf, Hi: 0xa9cf, Stride: 0x1},
-		unicode.Range16{Lo: 0xaa00, Hi: 0xaa28, Stride: 0x1},
-		unicode.Range16{Lo: 0xaa40, Hi: 0xaa42, Stride: 0x1},
-		unicode.Range16{Lo: 0xaa44, Hi: 0xaa4b, Stride: 0x1},
-		unicode.Range16{Lo: 0xaae0, Hi: 0xaaea, Stride: 0x1},
-		unicode.Range16{Lo: 0xaaf2, Hi: 0xaaf2, Stride: 0x1},
-		unicode.Range16{Lo: 0xaaf3, Hi: 0xaaf4, Stride: 0x1},
-		unicode.Range16{Lo: 0xab01, Hi: 0xab06, Stride: 0x1},
-		unicode.Range16{Lo: 0xab09, Hi: 0xab0e, Stride: 0x1},
-		unicode.Range16{Lo: 0xab11, Hi: 0xab16, Stride: 0x1},
-		unicode.Range16{Lo: 0xab20, Hi: 0xab26, Stride: 0x1},
-		unicode.Range16{Lo: 0xab28, Hi: 0xab2e, Stride: 0x1},
-		unicode.Range16{Lo: 0xab30, Hi: 0xab5a, Stride: 0x1},
-		unicode.Range16{Lo: 0xab5b, Hi: 0xab5b, Stride: 0x1},
-		unicode.Range16{Lo: 0xab5c, Hi: 0xab5f, Stride: 0x1},
-		unicode.Range16{Lo: 0xab60, Hi: 0xab67, Stride: 0x1},
-		unicode.Range16{Lo: 0xab70, Hi: 0xabbf, Stride: 0x1},
-		unicode.Range16{Lo: 0xabc0, Hi: 0xabe2, Stride: 0x1},
-		unicode.Range16{Lo: 0xac00, Hi: 0xd7a3, Stride: 0x1},
-		unicode.Range16{Lo: 0xd7b0, Hi: 0xd7c6, Stride: 0x1},
-		unicode.Range16{Lo: 0xd7cb, Hi: 0xd7fb, Stride: 0x1},
-		unicode.Range16{Lo: 0xfb00, Hi: 0xfb06, Stride: 0x1},
-		unicode.Range16{Lo: 0xfb13, Hi: 0xfb17, Stride: 0x1},
-		unicode.Range16{Lo: 0xfb50, Hi: 0xfbb1, Stride: 0x1},
-		unicode.Range16{Lo: 0xfbd3, Hi: 0xfd3d, Stride: 0x1},
-		unicode.Range16{Lo: 0xfd50, Hi: 0xfd8f, Stride: 0x1},
-		unicode.Range16{Lo: 0xfd92, Hi: 0xfdc7, Stride: 0x1},
-		unicode.Range16{Lo: 0xfdf0, Hi: 0xfdfb, Stride: 0x1},
-		unicode.Range16{Lo: 0xfe70, Hi: 0xfe74, Stride: 0x1},
-		unicode.Range16{Lo: 0xfe76, Hi: 0xfefc, Stride: 0x1},
-		unicode.Range16{Lo: 0xff21, Hi: 0xff3a, Stride: 0x1},
-		unicode.Range16{Lo: 0xff41, Hi: 0xff5a, Stride: 0x1},
-		unicode.Range16{Lo: 0xffa0, Hi: 0xffbe, Stride: 0x1},
-		unicode.Range16{Lo: 0xffc2, Hi: 0xffc7, Stride: 0x1},
-		unicode.Range16{Lo: 0xffca, Hi: 0xffcf, Stride: 0x1},
-		unicode.Range16{Lo: 0xffd2, Hi: 0xffd7, Stride: 0x1},
-		unicode.Range16{Lo: 0xffda, Hi: 0xffdc, Stride: 0x1},
-	},
-	R32: []unicode.Range32{
-		unicode.Range32{Lo: 0x10000, Hi: 0x1000b, Stride: 0x1},
-		unicode.Range32{Lo: 0x1000d, Hi: 0x10026, Stride: 0x1},
-		unicode.Range32{Lo: 0x10028, Hi: 0x1003a, Stride: 0x1},
-		unicode.Range32{Lo: 0x1003c, Hi: 0x1003d, Stride: 0x1},
-		unicode.Range32{Lo: 0x1003f, Hi: 0x1004d, Stride: 0x1},
-		unicode.Range32{Lo: 0x10050, Hi: 0x1005d, Stride: 0x1},
-		unicode.Range32{Lo: 0x10080, Hi: 0x100fa, Stride: 0x1},
-		unicode.Range32{Lo: 0x10140, Hi: 0x10174, Stride: 0x1},
-		unicode.Range32{Lo: 0x10280, Hi: 0x1029c, Stride: 0x1},
-		unicode.Range32{Lo: 0x102a0, Hi: 0x102d0, Stride: 0x1},
-		unicode.Range32{Lo: 0x10300, Hi: 0x1031f, Stride: 0x1},
-		unicode.Range32{Lo: 0x1032d, Hi: 0x10340, Stride: 0x1},
-		unicode.Range32{Lo: 0x10341, Hi: 0x10341, Stride: 0x1},
-		unicode.Range32{Lo: 0x10342, Hi: 0x10349, Stride: 0x1},
-		unicode.Range32{Lo: 0x1034a, Hi: 0x1034a, Stride: 0x1},
-		unicode.Range32{Lo: 0x10350, Hi: 0x10375, Stride: 0x1},
-		unicode.Range32{Lo: 0x10380, Hi: 0x1039d, Stride: 0x1},
-		unicode.Range32{Lo: 0x103a0, Hi: 0x103c3, Stride: 0x1},
-		unicode.Range32{Lo: 0x103c8, Hi: 0x103cf, Stride: 0x1},
-		unicode.Range32{Lo: 0x103d1, Hi: 0x103d5, Stride: 0x1},
-		unicode.Range32{Lo: 0x10400, Hi: 0x1044f, Stride: 0x1},
-		unicode.Range32{Lo: 0x10450, Hi: 0x1049d, Stride: 0x1},
-		unicode.Range32{Lo: 0x104b0, Hi: 0x104d3, Stride: 0x1},
-		unicode.Range32{Lo: 0x104d8, Hi: 0x104fb, Stride: 0x1},
-		unicode.Range32{Lo: 0x10500, Hi: 0x10527, Stride: 0x1},
-		unicode.Range32{Lo: 0x10530, Hi: 0x10563, Stride: 0x1},
-		unicode.Range32{Lo: 0x10600, Hi: 0x10736, Stride: 0x1},
-		unicode.Range32{Lo: 0x10740, Hi: 0x10755, Stride: 0x1},
-		unicode.Range32{Lo: 0x10760, Hi: 0x10767, Stride: 0x1},
-		unicode.Range32{Lo: 0x10800, Hi: 0x10805, Stride: 0x1},
-		unicode.Range32{Lo: 0x10808, Hi: 0x10808, Stride: 0x1},
-		unicode.Range32{Lo: 0x1080a, Hi: 0x10835, Stride: 0x1},
-		unicode.Range32{Lo: 0x10837, Hi: 0x10838, Stride: 0x1},
-		unicode.Range32{Lo: 0x1083c, Hi: 0x1083c, Stride: 0x1},
-		unicode.Range32{Lo: 0x1083f, Hi: 0x10855, Stride: 0x1},
-		unicode.Range32{Lo: 0x10860, Hi: 0x10876, Stride: 0x1},
-		unicode.Range32{Lo: 0x10880, Hi: 0x1089e, Stride: 0x1},
-		unicode.Range32{Lo: 0x108e0, Hi: 0x108f2, Stride: 0x1},
-		unicode.Range32{Lo: 0x108f4, Hi: 0x108f5, Stride: 0x1},
-		unicode.Range32{Lo: 0x10900, Hi: 0x10915, Stride: 0x1},
-		unicode.Range32{Lo: 0x10920, Hi: 0x10939, Stride: 0x1},
-		unicode.Range32{Lo: 0x10980, Hi: 0x109b7, Stride: 0x1},
-		unicode.Range32{Lo: 0x109be, Hi: 0x109bf, Stride: 0x1},
-		unicode.Range32{Lo: 0x10a00, Hi: 0x10a00, Stride: 0x1},
-		unicode.Range32{Lo: 0x10a10, Hi: 0x10a13, Stride: 0x1},
-		unicode.Range32{Lo: 0x10a15, Hi: 0x10a17, Stride: 0x1},
-		unicode.Range32{Lo: 0x10a19, Hi: 0x10a35, Stride: 0x1},
-		unicode.Range32{Lo: 0x10a60, Hi: 0x10a7c, Stride: 0x1},
-		unicode.Range32{Lo: 0x10a80, Hi: 0x10a9c, Stride: 0x1},
-		unicode.Range32{Lo: 0x10ac0, Hi: 0x10ac7, Stride: 0x1},
-		unicode.Range32{Lo: 0x10ac9, Hi: 0x10ae4, Stride: 0x1},
-		unicode.Range32{Lo: 0x10b00, Hi: 0x10b35, Stride: 0x1},
-		unicode.Range32{Lo: 0x10b40, Hi: 0x10b55, Stride: 0x1},
-		unicode.Range32{Lo: 0x10b60, Hi: 0x10b72, Stride: 0x1},
-		unicode.Range32{Lo: 0x10b80, Hi: 0x10b91, Stride: 0x1},
-		unicode.Range32{Lo: 0x10c00, Hi: 0x10c48, Stride: 0x1},
-		unicode.Range32{Lo: 0x10c80, Hi: 0x10cb2, Stride: 0x1},
-		unicode.Range32{Lo: 0x10cc0, Hi: 0x10cf2, Stride: 0x1},
-		unicode.Range32{Lo: 0x10d00, Hi: 0x10d23, Stride: 0x1},
-		unicode.Range32{Lo: 0x10f00, Hi: 0x10f1c, Stride: 0x1},
-		unicode.Range32{Lo: 0x10f27, Hi: 0x10f27, Stride: 0x1},
-		unicode.Range32{Lo: 0x10f30, Hi: 0x10f45, Stride: 0x1},
-		unicode.Range32{Lo: 0x10fe0, Hi: 0x10ff6, Stride: 0x1},
-		unicode.Range32{Lo: 0x11003, Hi: 0x11037, Stride: 0x1},
-		unicode.Range32{Lo: 0x11083, Hi: 0x110af, Stride: 0x1},
-		unicode.Range32{Lo: 0x110d0, Hi: 0x110e8, Stride: 0x1},
-		unicode.Range32{Lo: 0x11103, Hi: 0x11126, Stride: 0x1},
-		unicode.Range32{Lo: 0x11144, Hi: 0x11144, Stride: 0x1},
-		unicode.Range32{Lo: 0x11150, Hi: 0x11172, Stride: 0x1},
-		unicode.Range32{Lo: 0x11176, Hi: 0x11176, Stride: 0x1},
-		unicode.Range32{Lo: 0x11183, Hi: 0x111b2, Stride: 0x1},
-		unicode.Range32{Lo: 0x111c1, Hi: 0x111c4, Stride: 0x1},
-		unicode.Range32{Lo: 0x111da, Hi: 0x111da, Stride: 0x1},
-		unicode.Range32{Lo: 0x111dc, Hi: 0x111dc, Stride: 0x1},
-		unicode.Range32{Lo: 0x11200, Hi: 0x11211, Stride: 0x1},
-		unicode.Range32{Lo: 0x11213, Hi: 0x1122b, Stride: 0x1},
-		unicode.Range32{Lo: 0x11280, Hi: 0x11286, Stride: 0x1},
-		unicode.Range32{Lo: 0x11288, Hi: 0x11288, Stride: 0x1},
-		unicode.Range32{Lo: 0x1128a, Hi: 0x1128d, Stride: 0x1},
-		unicode.Range32{Lo: 0x1128f, Hi: 0x1129d, Stride: 0x1},
-		unicode.Range32{Lo: 0x1129f, Hi: 0x112a8, Stride: 0x1},
-		unicode.Range32{Lo: 0x112b0, Hi: 0x112de, Stride: 0x1},
-		unicode.Range32{Lo: 0x11305, Hi: 0x1130c, Stride: 0x1},
-		unicode.Range32{Lo: 0x1130f, Hi: 0x11310, Stride: 0x1},
-		unicode.Range32{Lo: 0x11313, Hi: 0x11328, Stride: 0x1},
-		unicode.Range32{Lo: 0x1132a, Hi: 0x11330, Stride: 0x1},
-		unicode.Range32{Lo: 0x11332, Hi: 0x11333, Stride: 0x1},
-		unicode.Range32{Lo: 0x11335, Hi: 0x11339, Stride: 0x1},
-		unicode.Range32{Lo: 0x1133d, Hi: 0x1133d, Stride: 0x1},
-		unicode.Range32{Lo: 0x11350, Hi: 0x11350, Stride: 0x1},
-		unicode.Range32{Lo: 0x1135d, Hi: 0x11361, Stride: 0x1},
-		unicode.Range32{Lo: 0x11400, Hi: 0x11434, Stride: 0x1},
-		unicode.Range32{Lo: 0x11447, Hi: 0x1144a, Stride: 0x1},
-		unicode.Range32{Lo: 0x1145f, Hi: 0x1145f, Stride: 0x1},
-		unicode.Range32{Lo: 0x11480, Hi: 0x114af, Stride: 0x1},
-		unicode.Range32{Lo: 0x114c4, Hi: 0x114c5, Stride: 0x1},
-		unicode.Range32{Lo: 0x114c7, Hi: 0x114c7, Stride: 0x1},
-		unicode.Range32{Lo: 0x11580, Hi: 0x115ae, Stride: 0x1},
-		unicode.Range32{Lo: 0x115d8, Hi: 0x115db, Stride: 0x1},
-		unicode.Range32{Lo: 0x11600, Hi: 0x1162f, Stride: 0x1},
-		unicode.Range32{Lo: 0x11644, Hi: 0x11644, Stride: 0x1},
-		unicode.Range32{Lo: 0x11680, Hi: 0x116aa, Stride: 0x1},
-		unicode.Range32{Lo: 0x116b8, Hi: 0x116b8, Stride: 0x1},
-		unicode.Range32{Lo: 0x11800, Hi: 0x1182b, Stride: 0x1},
-		unicode.Range32{Lo: 0x118a0, Hi: 0x118df, Stride: 0x1},
-		unicode.Range32{Lo: 0x118ff, Hi: 0x118ff, Stride: 0x1},
-		unicode.Range32{Lo: 0x119a0, Hi: 0x119a7, Stride: 0x1},
-		unicode.Range32{Lo: 0x119aa, Hi: 0x119d0, Stride: 0x1},
-		unicode.Range32{Lo: 0x119e1, Hi: 0x119e1, Stride: 0x1},
-		unicode.Range32{Lo: 0x119e3, Hi: 0x119e3, Stride: 0x1},
-		unicode.Range32{Lo: 0x11a00, Hi: 0x11a00, Stride: 0x1},
-		unicode.Range32{Lo: 0x11a0b, Hi: 0x11a32, Stride: 0x1},
-		unicode.Range32{Lo: 0x11a3a, Hi: 0x11a3a, Stride: 0x1},
-		unicode.Range32{Lo: 0x11a50, Hi: 0x11a50, Stride: 0x1},
-		unicode.Range32{Lo: 0x11a5c, Hi: 0x11a89, Stride: 0x1},
-		unicode.Range32{Lo: 0x11a9d, Hi: 0x11a9d, Stride: 0x1},
-		unicode.Range32{Lo: 0x11ac0, Hi: 0x11af8, Stride: 0x1},
-		unicode.Range32{Lo: 0x11c00, Hi: 0x11c08, Stride: 0x1},
-		unicode.Range32{Lo: 0x11c0a, Hi: 0x11c2e, Stride: 0x1},
-		unicode.Range32{Lo: 0x11c40, Hi: 0x11c40, Stride: 0x1},
-		unicode.Range32{Lo: 0x11c72, Hi: 0x11c8f, Stride: 0x1},
-		unicode.Range32{Lo: 0x11d00, Hi: 0x11d06, Stride: 0x1},
-		unicode.Range32{Lo: 0x11d08, Hi: 0x11d09, Stride: 0x1},
-		unicode.Range32{Lo: 0x11d0b, Hi: 0x11d30, Stride: 0x1},
-		unicode.Range32{Lo: 0x11d46, Hi: 0x11d46, Stride: 0x1},
-		unicode.Range32{Lo: 0x11d60, Hi: 0x11d65, Stride: 0x1},
-		unicode.Range32{Lo: 0x11d67, Hi: 0x11d68, Stride: 0x1},
-		unicode.Range32{Lo: 0x11d6a, Hi: 0x11d89, Stride: 0x1},
-		unicode.Range32{Lo: 0x11d98, Hi: 0x11d98, Stride: 0x1},
-		unicode.Range32{Lo: 0x11ee0, Hi: 0x11ef2, Stride: 0x1},
-		unicode.Range32{Lo: 0x12000, Hi: 0x12399, Stride: 0x1},
-		unicode.Range32{Lo: 0x12400, Hi: 0x1246e, Stride: 0x1},
-		unicode.Range32{Lo: 0x12480, Hi: 0x12543, Stride: 0x1},
-		unicode.Range32{Lo: 0x13000, Hi: 0x1342e, Stride: 0x1},
-		unicode.Range32{Lo: 0x14400, Hi: 0x14646, Stride: 0x1},
-		unicode.Range32{Lo: 0x16800, Hi: 0x16a38, Stride: 0x1},
-		unicode.Range32{Lo: 0x16a40, Hi: 0x16a5e, Stride: 0x1},
-		unicode.Range32{Lo: 0x16ad0, Hi: 0x16aed, Stride: 0x1},
-		unicode.Range32{Lo: 0x16b00, Hi: 0x16b2f, Stride: 0x1},
-		unicode.Range32{Lo: 0x16b40, Hi: 0x16b43, Stride: 0x1},
-		unicode.Range32{Lo: 0x16b63, Hi: 0x16b77, Stride: 0x1},
-		unicode.Range32{Lo: 0x16b7d, Hi: 0x16b8f, Stride: 0x1},
-		unicode.Range32{Lo: 0x16e40, Hi: 0x16e7f, Stride: 0x1},
-		unicode.Range32{Lo: 0x16f00, Hi: 0x16f4a, Stride: 0x1},
-		unicode.Range32{Lo: 0x16f50, Hi: 0x16f50, Stride: 0x1},
-		unicode.Range32{Lo: 0x16f93, Hi: 0x16f9f, Stride: 0x1},
-		unicode.Range32{Lo: 0x16fe0, Hi: 0x16fe1, Stride: 0x1},
-		unicode.Range32{Lo: 0x16fe3, Hi: 0x16fe3, Stride: 0x1},
-		unicode.Range32{Lo: 0x1bc00, Hi: 0x1bc6a, Stride: 0x1},
-		unicode.Range32{Lo: 0x1bc70, Hi: 0x1bc7c, Stride: 0x1},
-		unicode.Range32{Lo: 0x1bc80, Hi: 0x1bc88, Stride: 0x1},
-		unicode.Range32{Lo: 0x1bc90, Hi: 0x1bc99, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d400, Hi: 0x1d454, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d456, Hi: 0x1d49c, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d49e, Hi: 0x1d49f, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d4a2, Hi: 0x1d4a2, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d4a5, Hi: 0x1d4a6, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d4a9, Hi: 0x1d4ac, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d4ae, Hi: 0x1d4b9, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d4bb, Hi: 0x1d4bb, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d4bd, Hi: 0x1d4c3, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d4c5, Hi: 0x1d505, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d507, Hi: 0x1d50a, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d50d, Hi: 0x1d514, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d516, Hi: 0x1d51c, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d51e, Hi: 0x1d539, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d53b, Hi: 0x1d53e, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d540, Hi: 0x1d544, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d546, Hi: 0x1d546, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d54a, Hi: 0x1d550, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d552, Hi: 0x1d6a5, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d6a8, Hi: 0x1d6c0, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d6c2, Hi: 0x1d6da, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d6dc, Hi: 0x1d6fa, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d6fc, Hi: 0x1d714, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d716, Hi: 0x1d734, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d736, Hi: 0x1d74e, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d750, Hi: 0x1d76e, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d770, Hi: 0x1d788, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d78a, Hi: 0x1d7a8, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d7aa, Hi: 0x1d7c2, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d7c4, Hi: 0x1d7cb, Stride: 0x1},
-		unicode.Range32{Lo: 0x1e100, Hi: 0x1e12c, Stride: 0x1},
-		unicode.Range32{Lo: 0x1e137, Hi: 0x1e13d, Stride: 0x1},
-		unicode.Range32{Lo: 0x1e14e, Hi: 0x1e14e, Stride: 0x1},
-		unicode.Range32{Lo: 0x1e2c0, Hi: 0x1e2eb, Stride: 0x1},
-		unicode.Range32{Lo: 0x1e800, Hi: 0x1e8c4, Stride: 0x1},
-		unicode.Range32{Lo: 0x1e900, Hi: 0x1e943, Stride: 0x1},
-		unicode.Range32{Lo: 0x1e94b, Hi: 0x1e94b, Stride: 0x1},
-		unicode.Range32{Lo: 0x1ee00, Hi: 0x1ee03, Stride: 0x1},
-		unicode.Range32{Lo: 0x1ee05, Hi: 0x1ee1f, Stride: 0x1},
-		unicode.Range32{Lo: 0x1ee21, Hi: 0x1ee22, Stride: 0x1},
-		unicode.Range32{Lo: 0x1ee24, Hi: 0x1ee24, Stride: 0x1},
-		unicode.Range32{Lo: 0x1ee27, Hi: 0x1ee27, Stride: 0x1},
-		unicode.Range32{Lo: 0x1ee29, Hi: 0x1ee32, Stride: 0x1},
-		unicode.Range32{Lo: 0x1ee34, Hi: 0x1ee37, Stride: 0x1},
-		unicode.Range32{Lo: 0x1ee39, Hi: 0x1ee39, Stride: 0x1},
-		unicode.Range32{Lo: 0x1ee3b, Hi: 0x1ee3b, Stride: 0x1},
-		unicode.Range32{Lo: 0x1ee42, Hi: 0x1ee42, Stride: 0x1},
-		unicode.Range32{Lo: 0x1ee47, Hi: 0x1ee47, Stride: 0x1},
-		unicode.Range32{Lo: 0x1ee49, Hi: 0x1ee49, Stride: 0x1},
-		unicode.Range32{Lo: 0x1ee4b, Hi: 0x1ee4b, Stride: 0x1},
-		unicode.Range32{Lo: 0x1ee4d, Hi: 0x1ee4f, Stride: 0x1},
-		unicode.Range32{Lo: 0x1ee51, Hi: 0x1ee52, Stride: 0x1},
-		unicode.Range32{Lo: 0x1ee54, Hi: 0x1ee54, Stride: 0x1},
-		unicode.Range32{Lo: 0x1ee57, Hi: 0x1ee57, Stride: 0x1},
-		unicode.Range32{Lo: 0x1ee59, Hi: 0x1ee59, Stride: 0x1},
-		unicode.Range32{Lo: 0x1ee5b, Hi: 0x1ee5b, Stride: 0x1},
-		unicode.Range32{Lo: 0x1ee5d, Hi: 0x1ee5d, Stride: 0x1},
-		unicode.Range32{Lo: 0x1ee5f, Hi: 0x1ee5f, Stride: 0x1},
-		unicode.Range32{Lo: 0x1ee61, Hi: 0x1ee62, Stride: 0x1},
-		unicode.Range32{Lo: 0x1ee64, Hi: 0x1ee64, Stride: 0x1},
-		unicode.Range32{Lo: 0x1ee67, Hi: 0x1ee6a, Stride: 0x1},
-		unicode.Range32{Lo: 0x1ee6c, Hi: 0x1ee72, Stride: 0x1},
-		unicode.Range32{Lo: 0x1ee74, Hi: 0x1ee77, Stride: 0x1},
-		unicode.Range32{Lo: 0x1ee79, Hi: 0x1ee7c, Stride: 0x1},
-		unicode.Range32{Lo: 0x1ee7e, Hi: 0x1ee7e, Stride: 0x1},
-		unicode.Range32{Lo: 0x1ee80, Hi: 0x1ee89, Stride: 0x1},
-		unicode.Range32{Lo: 0x1ee8b, Hi: 0x1ee9b, Stride: 0x1},
-		unicode.Range32{Lo: 0x1eea1, Hi: 0x1eea3, Stride: 0x1},
-		unicode.Range32{Lo: 0x1eea5, Hi: 0x1eea9, Stride: 0x1},
-		unicode.Range32{Lo: 0x1eeab, Hi: 0x1eebb, Stride: 0x1},
-		unicode.Range32{Lo: 0x1f130, Hi: 0x1f149, Stride: 0x1},
-		unicode.Range32{Lo: 0x1f150, Hi: 0x1f169, Stride: 0x1},
-		unicode.Range32{Lo: 0x1f170, Hi: 0x1f189, Stride: 0x1},
-	},
-	LatinOffset: 7,
-}
-
-var _WordCR = &unicode.RangeTable{
-	R16: []unicode.Range16{
-		unicode.Range16{Lo: 0xd, Hi: 0xd, Stride: 0x1},
-	},
-	LatinOffset: 1,
-}
-
-var _WordDouble_Quote = &unicode.RangeTable{
-	R16: []unicode.Range16{
-		unicode.Range16{Lo: 0x22, Hi: 0x22, Stride: 0x1},
-	},
-	LatinOffset: 1,
-}
-
-var _WordExtend = &unicode.RangeTable{
-	R16: []unicode.Range16{
-		unicode.Range16{Lo: 0x300, Hi: 0x36f, Stride: 0x1},
-		unicode.Range16{Lo: 0x483, Hi: 0x487, Stride: 0x1},
-		unicode.Range16{Lo: 0x488, Hi: 0x489, Stride: 0x1},
-		unicode.Range16{Lo: 0x591, Hi: 0x5bd, Stride: 0x1},
-		unicode.Range16{Lo: 0x5bf, Hi: 0x5bf, Stride: 0x1},
-		unicode.Range16{Lo: 0x5c1, Hi: 0x5c2, Stride: 0x1},
-		unicode.Range16{Lo: 0x5c4, Hi: 0x5c5, Stride: 0x1},
-		unicode.Range16{Lo: 0x5c7, Hi: 0x5c7, Stride: 0x1},
-		unicode.Range16{Lo: 0x610, Hi: 0x61a, Stride: 0x1},
-		unicode.Range16{Lo: 0x64b, Hi: 0x65f, Stride: 0x1},
-		unicode.Range16{Lo: 0x670, Hi: 0x670, Stride: 0x1},
-		unicode.Range16{Lo: 0x6d6, Hi: 0x6dc, Stride: 0x1},
-		unicode.Range16{Lo: 0x6df, Hi: 0x6e4, Stride: 0x1},
-		unicode.Range16{Lo: 0x6e7, Hi: 0x6e8, Stride: 0x1},
-		unicode.Range16{Lo: 0x6ea, Hi: 0x6ed, Stride: 0x1},
-		unicode.Range16{Lo: 0x711, Hi: 0x711, Stride: 0x1},
-		unicode.Range16{Lo: 0x730, Hi: 0x74a, Stride: 0x1},
-		unicode.Range16{Lo: 0x7a6, Hi: 0x7b0, Stride: 0x1},
-		unicode.Range16{Lo: 0x7eb, Hi: 0x7f3, Stride: 0x1},
-		unicode.Range16{Lo: 0x7fd, Hi: 0x7fd, Stride: 0x1},
-		unicode.Range16{Lo: 0x816, Hi: 0x819, Stride: 0x1},
-		unicode.Range16{Lo: 0x81b, Hi: 0x823, Stride: 0x1},
-		unicode.Range16{Lo: 0x825, Hi: 0x827, Stride: 0x1},
-		unicode.Range16{Lo: 0x829, Hi: 0x82d, Stride: 0x1},
-		unicode.Range16{Lo: 0x859, Hi: 0x85b, Stride: 0x1},
-		unicode.Range16{Lo: 0x8d3, Hi: 0x8e1, Stride: 0x1},
-		unicode.Range16{Lo: 0x8e3, Hi: 0x902, Stride: 0x1},
-		unicode.Range16{Lo: 0x903, Hi: 0x903, Stride: 0x1},
-		unicode.Range16{Lo: 0x93a, Hi: 0x93a, Stride: 0x1},
-		unicode.Range16{Lo: 0x93b, Hi: 0x93b, Stride: 0x1},
-		unicode.Range16{Lo: 0x93c, Hi: 0x93c, Stride: 0x1},
-		unicode.Range16{Lo: 0x93e, Hi: 0x940, Stride: 0x1},
-		unicode.Range16{Lo: 0x941, Hi: 0x948, Stride: 0x1},
-		unicode.Range16{Lo: 0x949, Hi: 0x94c, Stride: 0x1},
-		unicode.Range16{Lo: 0x94d, Hi: 0x94d, Stride: 0x1},
-		unicode.Range16{Lo: 0x94e, Hi: 0x94f, Stride: 0x1},
-		unicode.Range16{Lo: 0x951, Hi: 0x957, Stride: 0x1},
-		unicode.Range16{Lo: 0x962, Hi: 0x963, Stride: 0x1},
-		unicode.Range16{Lo: 0x981, Hi: 0x981, Stride: 0x1},
-		unicode.Range16{Lo: 0x982, Hi: 0x983, Stride: 0x1},
-		unicode.Range16{Lo: 0x9bc, Hi: 0x9bc, Stride: 0x1},
-		unicode.Range16{Lo: 0x9be, Hi: 0x9c0, Stride: 0x1},
-		unicode.Range16{Lo: 0x9c1, Hi: 0x9c4, Stride: 0x1},
-		unicode.Range16{Lo: 0x9c7, Hi: 0x9c8, Stride: 0x1},
-		unicode.Range16{Lo: 0x9cb, Hi: 0x9cc, Stride: 0x1},
-		unicode.Range16{Lo: 0x9cd, Hi: 0x9cd, Stride: 0x1},
-		unicode.Range16{Lo: 0x9d7, Hi: 0x9d7, Stride: 0x1},
-		unicode.Range16{Lo: 0x9e2, Hi: 0x9e3, Stride: 0x1},
-		unicode.Range16{Lo: 0x9fe, Hi: 0x9fe, Stride: 0x1},
-		unicode.Range16{Lo: 0xa01, Hi: 0xa02, Stride: 0x1},
-		unicode.Range16{Lo: 0xa03, Hi: 0xa03, Stride: 0x1},
-		unicode.Range16{Lo: 0xa3c, Hi: 0xa3c, Stride: 0x1},
-		unicode.Range16{Lo: 0xa3e, Hi: 0xa40, Stride: 0x1},
-		unicode.Range16{Lo: 0xa41, Hi: 0xa42, Stride: 0x1},
-		unicode.Range16{Lo: 0xa47, Hi: 0xa48, Stride: 0x1},
-		unicode.Range16{Lo: 0xa4b, Hi: 0xa4d, Stride: 0x1},
-		unicode.Range16{Lo: 0xa51, Hi: 0xa51, Stride: 0x1},
-		unicode.Range16{Lo: 0xa70, Hi: 0xa71, Stride: 0x1},
-		unicode.Range16{Lo: 0xa75, Hi: 0xa75, Stride: 0x1},
-		unicode.Range16{Lo: 0xa81, Hi: 0xa82, Stride: 0x1},
-		unicode.Range16{Lo: 0xa83, Hi: 0xa83, Stride: 0x1},
-		unicode.Range16{Lo: 0xabc, Hi: 0xabc, Stride: 0x1},
-		unicode.Range16{Lo: 0xabe, Hi: 0xac0, Stride: 0x1},
-		unicode.Range16{Lo: 0xac1, Hi: 0xac5, Stride: 0x1},
-		unicode.Range16{Lo: 0xac7, Hi: 0xac8, Stride: 0x1},
-		unicode.Range16{Lo: 0xac9, Hi: 0xac9, Stride: 0x1},
-		unicode.Range16{Lo: 0xacb, Hi: 0xacc, Stride: 0x1},
-		unicode.Range16{Lo: 0xacd, Hi: 0xacd, Stride: 0x1},
-		unicode.Range16{Lo: 0xae2, Hi: 0xae3, Stride: 0x1},
-		unicode.Range16{Lo: 0xafa, Hi: 0xaff, Stride: 0x1},
-		unicode.Range16{Lo: 0xb01, Hi: 0xb01, Stride: 0x1},
-		unicode.Range16{Lo: 0xb02, Hi: 0xb03, Stride: 0x1},
-		unicode.Range16{Lo: 0xb3c, Hi: 0xb3c, Stride: 0x1},
-		unicode.Range16{Lo: 0xb3e, Hi: 0xb3e, Stride: 0x1},
-		unicode.Range16{Lo: 0xb3f, Hi: 0xb3f, Stride: 0x1},
-		unicode.Range16{Lo: 0xb40, Hi: 0xb40, Stride: 0x1},
-		unicode.Range16{Lo: 0xb41, Hi: 0xb44, Stride: 0x1},
-		unicode.Range16{Lo: 0xb47, Hi: 0xb48, Stride: 0x1},
-		unicode.Range16{Lo: 0xb4b, Hi: 0xb4c, Stride: 0x1},
-		unicode.Range16{Lo: 0xb4d, Hi: 0xb4d, Stride: 0x1},
-		unicode.Range16{Lo: 0xb56, Hi: 0xb56, Stride: 0x1},
-		unicode.Range16{Lo: 0xb57, Hi: 0xb57, Stride: 0x1},
-		unicode.Range16{Lo: 0xb62, Hi: 0xb63, Stride: 0x1},
-		unicode.Range16{Lo: 0xb82, Hi: 0xb82, Stride: 0x1},
-		unicode.Range16{Lo: 0xbbe, Hi: 0xbbf, Stride: 0x1},
-		unicode.Range16{Lo: 0xbc0, Hi: 0xbc0, Stride: 0x1},
-		unicode.Range16{Lo: 0xbc1, Hi: 0xbc2, Stride: 0x1},
-		unicode.Range16{Lo: 0xbc6, Hi: 0xbc8, Stride: 0x1},
-		unicode.Range16{Lo: 0xbca, Hi: 0xbcc, Stride: 0x1},
-		unicode.Range16{Lo: 0xbcd, Hi: 0xbcd, Stride: 0x1},
-		unicode.Range16{Lo: 0xbd7, Hi: 0xbd7, Stride: 0x1},
-		unicode.Range16{Lo: 0xc00, Hi: 0xc00, Stride: 0x1},
-		unicode.Range16{Lo: 0xc01, Hi: 0xc03, Stride: 0x1},
-		unicode.Range16{Lo: 0xc04, Hi: 0xc04, Stride: 0x1},
-		unicode.Range16{Lo: 0xc3e, Hi: 0xc40, Stride: 0x1},
-		unicode.Range16{Lo: 0xc41, Hi: 0xc44, Stride: 0x1},
-		unicode.Range16{Lo: 0xc46, Hi: 0xc48, Stride: 0x1},
-		unicode.Range16{Lo: 0xc4a, Hi: 0xc4d, Stride: 0x1},
-		unicode.Range16{Lo: 0xc55, Hi: 0xc56, Stride: 0x1},
-		unicode.Range16{Lo: 0xc62, Hi: 0xc63, Stride: 0x1},
-		unicode.Range16{Lo: 0xc81, Hi: 0xc81, Stride: 0x1},
-		unicode.Range16{Lo: 0xc82, Hi: 0xc83, Stride: 0x1},
-		unicode.Range16{Lo: 0xcbc, Hi: 0xcbc, Stride: 0x1},
-		unicode.Range16{Lo: 0xcbe, Hi: 0xcbe, Stride: 0x1},
-		unicode.Range16{Lo: 0xcbf, Hi: 0xcbf, Stride: 0x1},
-		unicode.Range16{Lo: 0xcc0, Hi: 0xcc4, Stride: 0x1},
-		unicode.Range16{Lo: 0xcc6, Hi: 0xcc6, Stride: 0x1},
-		unicode.Range16{Lo: 0xcc7, Hi: 0xcc8, Stride: 0x1},
-		unicode.Range16{Lo: 0xcca, Hi: 0xccb, Stride: 0x1},
-		unicode.Range16{Lo: 0xccc, Hi: 0xccd, Stride: 0x1},
-		unicode.Range16{Lo: 0xcd5, Hi: 0xcd6, Stride: 0x1},
-		unicode.Range16{Lo: 0xce2, Hi: 0xce3, Stride: 0x1},
-		unicode.Range16{Lo: 0xd00, Hi: 0xd01, Stride: 0x1},
-		unicode.Range16{Lo: 0xd02, Hi: 0xd03, Stride: 0x1},
-		unicode.Range16{Lo: 0xd3b, Hi: 0xd3c, Stride: 0x1},
-		unicode.Range16{Lo: 0xd3e, Hi: 0xd40, Stride: 0x1},
-		unicode.Range16{Lo: 0xd41, Hi: 0xd44, Stride: 0x1},
-		unicode.Range16{Lo: 0xd46, Hi: 0xd48, Stride: 0x1},
-		unicode.Range16{Lo: 0xd4a, Hi: 0xd4c, Stride: 0x1},
-		unicode.Range16{Lo: 0xd4d, Hi: 0xd4d, Stride: 0x1},
-		unicode.Range16{Lo: 0xd57, Hi: 0xd57, Stride: 0x1},
-		unicode.Range16{Lo: 0xd62, Hi: 0xd63, Stride: 0x1},
-		unicode.Range16{Lo: 0xd82, Hi: 0xd83, Stride: 0x1},
-		unicode.Range16{Lo: 0xdca, Hi: 0xdca, Stride: 0x1},
-		unicode.Range16{Lo: 0xdcf, Hi: 0xdd1, Stride: 0x1},
-		unicode.Range16{Lo: 0xdd2, Hi: 0xdd4, Stride: 0x1},
-		unicode.Range16{Lo: 0xdd6, Hi: 0xdd6, Stride: 0x1},
-		unicode.Range16{Lo: 0xdd8, Hi: 0xddf, Stride: 0x1},
-		unicode.Range16{Lo: 0xdf2, Hi: 0xdf3, Stride: 0x1},
-		unicode.Range16{Lo: 0xe31, Hi: 0xe31, Stride: 0x1},
-		unicode.Range16{Lo: 0xe34, Hi: 0xe3a, Stride: 0x1},
-		unicode.Range16{Lo: 0xe47, Hi: 0xe4e, Stride: 0x1},
-		unicode.Range16{Lo: 0xeb1, Hi: 0xeb1, Stride: 0x1},
-		unicode.Range16{Lo: 0xeb4, Hi: 0xebc, Stride: 0x1},
-		unicode.Range16{Lo: 0xec8, Hi: 0xecd, Stride: 0x1},
-		unicode.Range16{Lo: 0xf18, Hi: 0xf19, Stride: 0x1},
-		unicode.Range16{Lo: 0xf35, Hi: 0xf35, Stride: 0x1},
-		unicode.Range16{Lo: 0xf37, Hi: 0xf37, Stride: 0x1},
-		unicode.Range16{Lo: 0xf39, Hi: 0xf39, Stride: 0x1},
-		unicode.Range16{Lo: 0xf3e, Hi: 0xf3f, Stride: 0x1},
-		unicode.Range16{Lo: 0xf71, Hi: 0xf7e, Stride: 0x1},
-		unicode.Range16{Lo: 0xf7f, Hi: 0xf7f, Stride: 0x1},
-		unicode.Range16{Lo: 0xf80, Hi: 0xf84, Stride: 0x1},
-		unicode.Range16{Lo: 0xf86, Hi: 0xf87, Stride: 0x1},
-		unicode.Range16{Lo: 0xf8d, Hi: 0xf97, Stride: 0x1},
-		unicode.Range16{Lo: 0xf99, Hi: 0xfbc, Stride: 0x1},
-		unicode.Range16{Lo: 0xfc6, Hi: 0xfc6, Stride: 0x1},
-		unicode.Range16{Lo: 0x102b, Hi: 0x102c, Stride: 0x1},
-		unicode.Range16{Lo: 0x102d, Hi: 0x1030, Stride: 0x1},
-		unicode.Range16{Lo: 0x1031, Hi: 0x1031, Stride: 0x1},
-		unicode.Range16{Lo: 0x1032, Hi: 0x1037, Stride: 0x1},
-		unicode.Range16{Lo: 0x1038, Hi: 0x1038, Stride: 0x1},
-		unicode.Range16{Lo: 0x1039, Hi: 0x103a, Stride: 0x1},
-		unicode.Range16{Lo: 0x103b, Hi: 0x103c, Stride: 0x1},
-		unicode.Range16{Lo: 0x103d, Hi: 0x103e, Stride: 0x1},
-		unicode.Range16{Lo: 0x1056, Hi: 0x1057, Stride: 0x1},
-		unicode.Range16{Lo: 0x1058, Hi: 0x1059, Stride: 0x1},
-		unicode.Range16{Lo: 0x105e, Hi: 0x1060, Stride: 0x1},
-		unicode.Range16{Lo: 0x1062, Hi: 0x1064, Stride: 0x1},
-		unicode.Range16{Lo: 0x1067, Hi: 0x106d, Stride: 0x1},
-		unicode.Range16{Lo: 0x1071, Hi: 0x1074, Stride: 0x1},
-		unicode.Range16{Lo: 0x1082, Hi: 0x1082, Stride: 0x1},
-		unicode.Range16{Lo: 0x1083, Hi: 0x1084, Stride: 0x1},
-		unicode.Range16{Lo: 0x1085, Hi: 0x1086, Stride: 0x1},
-		unicode.Range16{Lo: 0x1087, Hi: 0x108c, Stride: 0x1},
-		unicode.Range16{Lo: 0x108d, Hi: 0x108d, Stride: 0x1},
-		unicode.Range16{Lo: 0x108f, Hi: 0x108f, Stride: 0x1},
-		unicode.Range16{Lo: 0x109a, Hi: 0x109c, Stride: 0x1},
-		unicode.Range16{Lo: 0x109d, Hi: 0x109d, Stride: 0x1},
-		unicode.Range16{Lo: 0x135d, Hi: 0x135f, Stride: 0x1},
-		unicode.Range16{Lo: 0x1712, Hi: 0x1714, Stride: 0x1},
-		unicode.Range16{Lo: 0x1732, Hi: 0x1734, Stride: 0x1},
-		unicode.Range16{Lo: 0x1752, Hi: 0x1753, Stride: 0x1},
-		unicode.Range16{Lo: 0x1772, Hi: 0x1773, Stride: 0x1},
-		unicode.Range16{Lo: 0x17b4, Hi: 0x17b5, Stride: 0x1},
-		unicode.Range16{Lo: 0x17b6, Hi: 0x17b6, Stride: 0x1},
-		unicode.Range16{Lo: 0x17b7, Hi: 0x17bd, Stride: 0x1},
-		unicode.Range16{Lo: 0x17be, Hi: 0x17c5, Stride: 0x1},
-		unicode.Range16{Lo: 0x17c6, Hi: 0x17c6, Stride: 0x1},
-		unicode.Range16{Lo: 0x17c7, Hi: 0x17c8, Stride: 0x1},
-		unicode.Range16{Lo: 0x17c9, Hi: 0x17d3, Stride: 0x1},
-		unicode.Range16{Lo: 0x17dd, Hi: 0x17dd, Stride: 0x1},
-		unicode.Range16{Lo: 0x180b, Hi: 0x180d, Stride: 0x1},
-		unicode.Range16{Lo: 0x1885, Hi: 0x1886, Stride: 0x1},
-		unicode.Range16{Lo: 0x18a9, Hi: 0x18a9, Stride: 0x1},
-		unicode.Range16{Lo: 0x1920, Hi: 0x1922, Stride: 0x1},
-		unicode.Range16{Lo: 0x1923, Hi: 0x1926, Stride: 0x1},
-		unicode.Range16{Lo: 0x1927, Hi: 0x1928, Stride: 0x1},
-		unicode.Range16{Lo: 0x1929, Hi: 0x192b, Stride: 0x1},
-		unicode.Range16{Lo: 0x1930, Hi: 0x1931, Stride: 0x1},
-		unicode.Range16{Lo: 0x1932, Hi: 0x1932, Stride: 0x1},
-		unicode.Range16{Lo: 0x1933, Hi: 0x1938, Stride: 0x1},
-		unicode.Range16{Lo: 0x1939, Hi: 0x193b, Stride: 0x1},
-		unicode.Range16{Lo: 0x1a17, Hi: 0x1a18, Stride: 0x1},
-		unicode.Range16{Lo: 0x1a19, Hi: 0x1a1a, Stride: 0x1},
-		unicode.Range16{Lo: 0x1a1b, Hi: 0x1a1b, Stride: 0x1},
-		unicode.Range16{Lo: 0x1a55, Hi: 0x1a55, Stride: 0x1},
-		unicode.Range16{Lo: 0x1a56, Hi: 0x1a56, Stride: 0x1},
-		unicode.Range16{Lo: 0x1a57, Hi: 0x1a57, Stride: 0x1},
-		unicode.Range16{Lo: 0x1a58, Hi: 0x1a5e, Stride: 0x1},
-		unicode.Range16{Lo: 0x1a60, Hi: 0x1a60, Stride: 0x1},
-		unicode.Range16{Lo: 0x1a61, Hi: 0x1a61, Stride: 0x1},
-		unicode.Range16{Lo: 0x1a62, Hi: 0x1a62, Stride: 0x1},
-		unicode.Range16{Lo: 0x1a63, Hi: 0x1a64, Stride: 0x1},
-		unicode.Range16{Lo: 0x1a65, Hi: 0x1a6c, Stride: 0x1},
-		unicode.Range16{Lo: 0x1a6d, Hi: 0x1a72, Stride: 0x1},
-		unicode.Range16{Lo: 0x1a73, Hi: 0x1a7c, Stride: 0x1},
-		unicode.Range16{Lo: 0x1a7f, Hi: 0x1a7f, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ab0, Hi: 0x1abd, Stride: 0x1},
-		unicode.Range16{Lo: 0x1abe, Hi: 0x1abe, Stride: 0x1},
-		unicode.Range16{Lo: 0x1b00, Hi: 0x1b03, Stride: 0x1},
-		unicode.Range16{Lo: 0x1b04, Hi: 0x1b04, Stride: 0x1},
-		unicode.Range16{Lo: 0x1b34, Hi: 0x1b34, Stride: 0x1},
-		unicode.Range16{Lo: 0x1b35, Hi: 0x1b35, Stride: 0x1},
-		unicode.Range16{Lo: 0x1b36, Hi: 0x1b3a, Stride: 0x1},
-		unicode.Range16{Lo: 0x1b3b, Hi: 0x1b3b, Stride: 0x1},
-		unicode.Range16{Lo: 0x1b3c, Hi: 0x1b3c, Stride: 0x1},
-		unicode.Range16{Lo: 0x1b3d, Hi: 0x1b41, Stride: 0x1},
-		unicode.Range16{Lo: 0x1b42, Hi: 0x1b42, Stride: 0x1},
-		unicode.Range16{Lo: 0x1b43, Hi: 0x1b44, Stride: 0x1},
-		unicode.Range16{Lo: 0x1b6b, Hi: 0x1b73, Stride: 0x1},
-		unicode.Range16{Lo: 0x1b80, Hi: 0x1b81, Stride: 0x1},
-		unicode.Range16{Lo: 0x1b82, Hi: 0x1b82, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ba1, Hi: 0x1ba1, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ba2, Hi: 0x1ba5, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ba6, Hi: 0x1ba7, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ba8, Hi: 0x1ba9, Stride: 0x1},
-		unicode.Range16{Lo: 0x1baa, Hi: 0x1baa, Stride: 0x1},
-		unicode.Range16{Lo: 0x1bab, Hi: 0x1bad, Stride: 0x1},
-		unicode.Range16{Lo: 0x1be6, Hi: 0x1be6, Stride: 0x1},
-		unicode.Range16{Lo: 0x1be7, Hi: 0x1be7, Stride: 0x1},
-		unicode.Range16{Lo: 0x1be8, Hi: 0x1be9, Stride: 0x1},
-		unicode.Range16{Lo: 0x1bea, Hi: 0x1bec, Stride: 0x1},
-		unicode.Range16{Lo: 0x1bed, Hi: 0x1bed, Stride: 0x1},
-		unicode.Range16{Lo: 0x1bee, Hi: 0x1bee, Stride: 0x1},
-		unicode.Range16{Lo: 0x1bef, Hi: 0x1bf1, Stride: 0x1},
-		unicode.Range16{Lo: 0x1bf2, Hi: 0x1bf3, Stride: 0x1},
-		unicode.Range16{Lo: 0x1c24, Hi: 0x1c2b, Stride: 0x1},
-		unicode.Range16{Lo: 0x1c2c, Hi: 0x1c33, Stride: 0x1},
-		unicode.Range16{Lo: 0x1c34, Hi: 0x1c35, Stride: 0x1},
-		unicode.Range16{Lo: 0x1c36, Hi: 0x1c37, Stride: 0x1},
-		unicode.Range16{Lo: 0x1cd0, Hi: 0x1cd2, Stride: 0x1},
-		unicode.Range16{Lo: 0x1cd4, Hi: 0x1ce0, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ce1, Hi: 0x1ce1, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ce2, Hi: 0x1ce8, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ced, Hi: 0x1ced, Stride: 0x1},
-		unicode.Range16{Lo: 0x1cf4, Hi: 0x1cf4, Stride: 0x1},
-		unicode.Range16{Lo: 0x1cf7, Hi: 0x1cf7, Stride: 0x1},
-		unicode.Range16{Lo: 0x1cf8, Hi: 0x1cf9, Stride: 0x1},
-		unicode.Range16{Lo: 0x1dc0, Hi: 0x1df9, Stride: 0x1},
-		unicode.Range16{Lo: 0x1dfb, Hi: 0x1dff, Stride: 0x1},
-		unicode.Range16{Lo: 0x200c, Hi: 0x200c, Stride: 0x1},
-		unicode.Range16{Lo: 0x20d0, Hi: 0x20dc, Stride: 0x1},
-		unicode.Range16{Lo: 0x20dd, Hi: 0x20e0, Stride: 0x1},
-		unicode.Range16{Lo: 0x20e1, Hi: 0x20e1, Stride: 0x1},
-		unicode.Range16{Lo: 0x20e2, Hi: 0x20e4, Stride: 0x1},
-		unicode.Range16{Lo: 0x20e5, Hi: 0x20f0, Stride: 0x1},
-		unicode.Range16{Lo: 0x2cef, Hi: 0x2cf1, Stride: 0x1},
-		unicode.Range16{Lo: 0x2d7f, Hi: 0x2d7f, Stride: 0x1},
-		unicode.Range16{Lo: 0x2de0, Hi: 0x2dff, Stride: 0x1},
-		unicode.Range16{Lo: 0x302a, Hi: 0x302d, Stride: 0x1},
-		unicode.Range16{Lo: 0x302e, Hi: 0x302f, Stride: 0x1},
-		unicode.Range16{Lo: 0x3099, Hi: 0x309a, Stride: 0x1},
-		unicode.Range16{Lo: 0xa66f, Hi: 0xa66f, Stride: 0x1},
-		unicode.Range16{Lo: 0xa670, Hi: 0xa672, Stride: 0x1},
-		unicode.Range16{Lo: 0xa674, Hi: 0xa67d, Stride: 0x1},
-		unicode.Range16{Lo: 0xa69e, Hi: 0xa69f, Stride: 0x1},
-		unicode.Range16{Lo: 0xa6f0, Hi: 0xa6f1, Stride: 0x1},
-		unicode.Range16{Lo: 0xa802, Hi: 0xa802, Stride: 0x1},
-		unicode.Range16{Lo: 0xa806, Hi: 0xa806, Stride: 0x1},
-		unicode.Range16{Lo: 0xa80b, Hi: 0xa80b, Stride: 0x1},
-		unicode.Range16{Lo: 0xa823, Hi: 0xa824, Stride: 0x1},
-		unicode.Range16{Lo: 0xa825, Hi: 0xa826, Stride: 0x1},
-		unicode.Range16{Lo: 0xa827, Hi: 0xa827, Stride: 0x1},
-		unicode.Range16{Lo: 0xa880, Hi: 0xa881, Stride: 0x1},
-		unicode.Range16{Lo: 0xa8b4, Hi: 0xa8c3, Stride: 0x1},
-		unicode.Range16{Lo: 0xa8c4, Hi: 0xa8c5, Stride: 0x1},
-		unicode.Range16{Lo: 0xa8e0, Hi: 0xa8f1, Stride: 0x1},
-		unicode.Range16{Lo: 0xa8ff, Hi: 0xa8ff, Stride: 0x1},
-		unicode.Range16{Lo: 0xa926, Hi: 0xa92d, Stride: 0x1},
-		unicode.Range16{Lo: 0xa947, Hi: 0xa951, Stride: 0x1},
-		unicode.Range16{Lo: 0xa952, Hi: 0xa953, Stride: 0x1},
-		unicode.Range16{Lo: 0xa980, Hi: 0xa982, Stride: 0x1},
-		unicode.Range16{Lo: 0xa983, Hi: 0xa983, Stride: 0x1},
-		unicode.Range16{Lo: 0xa9b3, Hi: 0xa9b3, Stride: 0x1},
-		unicode.Range16{Lo: 0xa9b4, Hi: 0xa9b5, Stride: 0x1},
-		unicode.Range16{Lo: 0xa9b6, Hi: 0xa9b9, Stride: 0x1},
-		unicode.Range16{Lo: 0xa9ba, Hi: 0xa9bb, Stride: 0x1},
-		unicode.Range16{Lo: 0xa9bc, Hi: 0xa9bd, Stride: 0x1},
-		unicode.Range16{Lo: 0xa9be, Hi: 0xa9c0, Stride: 0x1},
-		unicode.Range16{Lo: 0xa9e5, Hi: 0xa9e5, Stride: 0x1},
-		unicode.Range16{Lo: 0xaa29, Hi: 0xaa2e, Stride: 0x1},
-		unicode.Range16{Lo: 0xaa2f, Hi: 0xaa30, Stride: 0x1},
-		unicode.Range16{Lo: 0xaa31, Hi: 0xaa32, Stride: 0x1},
-		unicode.Range16{Lo: 0xaa33, Hi: 0xaa34, Stride: 0x1},
-		unicode.Range16{Lo: 0xaa35, Hi: 0xaa36, Stride: 0x1},
-		unicode.Range16{Lo: 0xaa43, Hi: 0xaa43, Stride: 0x1},
-		unicode.Range16{Lo: 0xaa4c, Hi: 0xaa4c, Stride: 0x1},
-		unicode.Range16{Lo: 0xaa4d, Hi: 0xaa4d, Stride: 0x1},
-		unicode.Range16{Lo: 0xaa7b, Hi: 0xaa7b, Stride: 0x1},
-		unicode.Range16{Lo: 0xaa7c, Hi: 0xaa7c, Stride: 0x1},
-		unicode.Range16{Lo: 0xaa7d, Hi: 0xaa7d, Stride: 0x1},
-		unicode.Range16{Lo: 0xaab0, Hi: 0xaab0, Stride: 0x1},
-		unicode.Range16{Lo: 0xaab2, Hi: 0xaab4, Stride: 0x1},
-		unicode.Range16{Lo: 0xaab7, Hi: 0xaab8, Stride: 0x1},
-		unicode.Range16{Lo: 0xaabe, Hi: 0xaabf, Stride: 0x1},
-		unicode.Range16{Lo: 0xaac1, Hi: 0xaac1, Stride: 0x1},
-		unicode.Range16{Lo: 0xaaeb, Hi: 0xaaeb, Stride: 0x1},
-		unicode.Range16{Lo: 0xaaec, Hi: 0xaaed, Stride: 0x1},
-		unicode.Range16{Lo: 0xaaee, Hi: 0xaaef, Stride: 0x1},
-		unicode.Range16{Lo: 0xaaf5, Hi: 0xaaf5, Stride: 0x1},
-		unicode.Range16{Lo: 0xaaf6, Hi: 0xaaf6, Stride: 0x1},
-		unicode.Range16{Lo: 0xabe3, Hi: 0xabe4, Stride: 0x1},
-		unicode.Range16{Lo: 0xabe5, Hi: 0xabe5, Stride: 0x1},
-		unicode.Range16{Lo: 0xabe6, Hi: 0xabe7, Stride: 0x1},
-		unicode.Range16{Lo: 0xabe8, Hi: 0xabe8, Stride: 0x1},
-		unicode.Range16{Lo: 0xabe9, Hi: 0xabea, Stride: 0x1},
-		unicode.Range16{Lo: 0xabec, Hi: 0xabec, Stride: 0x1},
-		unicode.Range16{Lo: 0xabed, Hi: 0xabed, Stride: 0x1},
-		unicode.Range16{Lo: 0xfb1e, Hi: 0xfb1e, Stride: 0x1},
-		unicode.Range16{Lo: 0xfe00, Hi: 0xfe0f, Stride: 0x1},
-		unicode.Range16{Lo: 0xfe20, Hi: 0xfe2f, Stride: 0x1},
-		unicode.Range16{Lo: 0xff9e, Hi: 0xff9f, Stride: 0x1},
-	},
-	R32: []unicode.Range32{
-		unicode.Range32{Lo: 0x101fd, Hi: 0x101fd, Stride: 0x1},
-		unicode.Range32{Lo: 0x102e0, Hi: 0x102e0, Stride: 0x1},
-		unicode.Range32{Lo: 0x10376, Hi: 0x1037a, Stride: 0x1},
-		unicode.Range32{Lo: 0x10a01, Hi: 0x10a03, Stride: 0x1},
-		unicode.Range32{Lo: 0x10a05, Hi: 0x10a06, Stride: 0x1},
-		unicode.Range32{Lo: 0x10a0c, Hi: 0x10a0f, Stride: 0x1},
-		unicode.Range32{Lo: 0x10a38, Hi: 0x10a3a, Stride: 0x1},
-		unicode.Range32{Lo: 0x10a3f, Hi: 0x10a3f, Stride: 0x1},
-		unicode.Range32{Lo: 0x10ae5, Hi: 0x10ae6, Stride: 0x1},
-		unicode.Range32{Lo: 0x10d24, Hi: 0x10d27, Stride: 0x1},
-		unicode.Range32{Lo: 0x10f46, Hi: 0x10f50, Stride: 0x1},
-		unicode.Range32{Lo: 0x11000, Hi: 0x11000, Stride: 0x1},
-		unicode.Range32{Lo: 0x11001, Hi: 0x11001, Stride: 0x1},
-		unicode.Range32{Lo: 0x11002, Hi: 0x11002, Stride: 0x1},
-		unicode.Range32{Lo: 0x11038, Hi: 0x11046, Stride: 0x1},
-		unicode.Range32{Lo: 0x1107f, Hi: 0x11081, Stride: 0x1},
-		unicode.Range32{Lo: 0x11082, Hi: 0x11082, Stride: 0x1},
-		unicode.Range32{Lo: 0x110b0, Hi: 0x110b2, Stride: 0x1},
-		unicode.Range32{Lo: 0x110b3, Hi: 0x110b6, Stride: 0x1},
-		unicode.Range32{Lo: 0x110b7, Hi: 0x110b8, Stride: 0x1},
-		unicode.Range32{Lo: 0x110b9, Hi: 0x110ba, Stride: 0x1},
-		unicode.Range32{Lo: 0x11100, Hi: 0x11102, Stride: 0x1},
-		unicode.Range32{Lo: 0x11127, Hi: 0x1112b, Stride: 0x1},
-		unicode.Range32{Lo: 0x1112c, Hi: 0x1112c, Stride: 0x1},
-		unicode.Range32{Lo: 0x1112d, Hi: 0x11134, Stride: 0x1},
-		unicode.Range32{Lo: 0x11145, Hi: 0x11146, Stride: 0x1},
-		unicode.Range32{Lo: 0x11173, Hi: 0x11173, Stride: 0x1},
-		unicode.Range32{Lo: 0x11180, Hi: 0x11181, Stride: 0x1},
-		unicode.Range32{Lo: 0x11182, Hi: 0x11182, Stride: 0x1},
-		unicode.Range32{Lo: 0x111b3, Hi: 0x111b5, Stride: 0x1},
-		unicode.Range32{Lo: 0x111b6, Hi: 0x111be, Stride: 0x1},
-		unicode.Range32{Lo: 0x111bf, Hi: 0x111c0, Stride: 0x1},
-		unicode.Range32{Lo: 0x111c9, Hi: 0x111cc, Stride: 0x1},
-		unicode.Range32{Lo: 0x1122c, Hi: 0x1122e, Stride: 0x1},
-		unicode.Range32{Lo: 0x1122f, Hi: 0x11231, Stride: 0x1},
-		unicode.Range32{Lo: 0x11232, Hi: 0x11233, Stride: 0x1},
-		unicode.Range32{Lo: 0x11234, Hi: 0x11234, Stride: 0x1},
-		unicode.Range32{Lo: 0x11235, Hi: 0x11235, Stride: 0x1},
-		unicode.Range32{Lo: 0x11236, Hi: 0x11237, Stride: 0x1},
-		unicode.Range32{Lo: 0x1123e, Hi: 0x1123e, Stride: 0x1},
-		unicode.Range32{Lo: 0x112df, Hi: 0x112df, Stride: 0x1},
-		unicode.Range32{Lo: 0x112e0, Hi: 0x112e2, Stride: 0x1},
-		unicode.Range32{Lo: 0x112e3, Hi: 0x112ea, Stride: 0x1},
-		unicode.Range32{Lo: 0x11300, Hi: 0x11301, Stride: 0x1},
-		unicode.Range32{Lo: 0x11302, Hi: 0x11303, Stride: 0x1},
-		unicode.Range32{Lo: 0x1133b, Hi: 0x1133c, Stride: 0x1},
-		unicode.Range32{Lo: 0x1133e, Hi: 0x1133f, Stride: 0x1},
-		unicode.Range32{Lo: 0x11340, Hi: 0x11340, Stride: 0x1},
-		unicode.Range32{Lo: 0x11341, Hi: 0x11344, Stride: 0x1},
-		unicode.Range32{Lo: 0x11347, Hi: 0x11348, Stride: 0x1},
-		unicode.Range32{Lo: 0x1134b, Hi: 0x1134d, Stride: 0x1},
-		unicode.Range32{Lo: 0x11357, Hi: 0x11357, Stride: 0x1},
-		unicode.Range32{Lo: 0x11362, Hi: 0x11363, Stride: 0x1},
-		unicode.Range32{Lo: 0x11366, Hi: 0x1136c, Stride: 0x1},
-		unicode.Range32{Lo: 0x11370, Hi: 0x11374, Stride: 0x1},
-		unicode.Range32{Lo: 0x11435, Hi: 0x11437, Stride: 0x1},
-		unicode.Range32{Lo: 0x11438, Hi: 0x1143f, Stride: 0x1},
-		unicode.Range32{Lo: 0x11440, Hi: 0x11441, Stride: 0x1},
-		unicode.Range32{Lo: 0x11442, Hi: 0x11444, Stride: 0x1},
-		unicode.Range32{Lo: 0x11445, Hi: 0x11445, Stride: 0x1},
-		unicode.Range32{Lo: 0x11446, Hi: 0x11446, Stride: 0x1},
-		unicode.Range32{Lo: 0x1145e, Hi: 0x1145e, Stride: 0x1},
-		unicode.Range32{Lo: 0x114b0, Hi: 0x114b2, Stride: 0x1},
-		unicode.Range32{Lo: 0x114b3, Hi: 0x114b8, Stride: 0x1},
-		unicode.Range32{Lo: 0x114b9, Hi: 0x114b9, Stride: 0x1},
-		unicode.Range32{Lo: 0x114ba, Hi: 0x114ba, Stride: 0x1},
-		unicode.Range32{Lo: 0x114bb, Hi: 0x114be, Stride: 0x1},
-		unicode.Range32{Lo: 0x114bf, Hi: 0x114c0, Stride: 0x1},
-		unicode.Range32{Lo: 0x114c1, Hi: 0x114c1, Stride: 0x1},
-		unicode.Range32{Lo: 0x114c2, Hi: 0x114c3, Stride: 0x1},
-		unicode.Range32{Lo: 0x115af, Hi: 0x115b1, Stride: 0x1},
-		unicode.Range32{Lo: 0x115b2, Hi: 0x115b5, Stride: 0x1},
-		unicode.Range32{Lo: 0x115b8, Hi: 0x115bb, Stride: 0x1},
-		unicode.Range32{Lo: 0x115bc, Hi: 0x115bd, Stride: 0x1},
-		unicode.Range32{Lo: 0x115be, Hi: 0x115be, Stride: 0x1},
-		unicode.Range32{Lo: 0x115bf, Hi: 0x115c0, Stride: 0x1},
-		unicode.Range32{Lo: 0x115dc, Hi: 0x115dd, Stride: 0x1},
-		unicode.Range32{Lo: 0x11630, Hi: 0x11632, Stride: 0x1},
-		unicode.Range32{Lo: 0x11633, Hi: 0x1163a, Stride: 0x1},
-		unicode.Range32{Lo: 0x1163b, Hi: 0x1163c, Stride: 0x1},
-		unicode.Range32{Lo: 0x1163d, Hi: 0x1163d, Stride: 0x1},
-		unicode.Range32{Lo: 0x1163e, Hi: 0x1163e, Stride: 0x1},
-		unicode.Range32{Lo: 0x1163f, Hi: 0x11640, Stride: 0x1},
-		unicode.Range32{Lo: 0x116ab, Hi: 0x116ab, Stride: 0x1},
-		unicode.Range32{Lo: 0x116ac, Hi: 0x116ac, Stride: 0x1},
-		unicode.Range32{Lo: 0x116ad, Hi: 0x116ad, Stride: 0x1},
-		unicode.Range32{Lo: 0x116ae, Hi: 0x116af, Stride: 0x1},
-		unicode.Range32{Lo: 0x116b0, Hi: 0x116b5, Stride: 0x1},
-		unicode.Range32{Lo: 0x116b6, Hi: 0x116b6, Stride: 0x1},
-		unicode.Range32{Lo: 0x116b7, Hi: 0x116b7, Stride: 0x1},
-		unicode.Range32{Lo: 0x1171d, Hi: 0x1171f, Stride: 0x1},
-		unicode.Range32{Lo: 0x11720, Hi: 0x11721, Stride: 0x1},
-		unicode.Range32{Lo: 0x11722, Hi: 0x11725, Stride: 0x1},
-		unicode.Range32{Lo: 0x11726, Hi: 0x11726, Stride: 0x1},
-		unicode.Range32{Lo: 0x11727, Hi: 0x1172b, Stride: 0x1},
-		unicode.Range32{Lo: 0x1182c, Hi: 0x1182e, Stride: 0x1},
-		unicode.Range32{Lo: 0x1182f, Hi: 0x11837, Stride: 0x1},
-		unicode.Range32{Lo: 0x11838, Hi: 0x11838, Stride: 0x1},
-		unicode.Range32{Lo: 0x11839, Hi: 0x1183a, Stride: 0x1},
-		unicode.Range32{Lo: 0x119d1, Hi: 0x119d3, Stride: 0x1},
-		unicode.Range32{Lo: 0x119d4, Hi: 0x119d7, Stride: 0x1},
-		unicode.Range32{Lo: 0x119da, Hi: 0x119db, Stride: 0x1},
-		unicode.Range32{Lo: 0x119dc, Hi: 0x119df, Stride: 0x1},
-		unicode.Range32{Lo: 0x119e0, Hi: 0x119e0, Stride: 0x1},
-		unicode.Range32{Lo: 0x119e4, Hi: 0x119e4, Stride: 0x1},
-		unicode.Range32{Lo: 0x11a01, Hi: 0x11a0a, Stride: 0x1},
-		unicode.Range32{Lo: 0x11a33, Hi: 0x11a38, Stride: 0x1},
-		unicode.Range32{Lo: 0x11a39, Hi: 0x11a39, Stride: 0x1},
-		unicode.Range32{Lo: 0x11a3b, Hi: 0x11a3e, Stride: 0x1},
-		unicode.Range32{Lo: 0x11a47, Hi: 0x11a47, Stride: 0x1},
-		unicode.Range32{Lo: 0x11a51, Hi: 0x11a56, Stride: 0x1},
-		unicode.Range32{Lo: 0x11a57, Hi: 0x11a58, Stride: 0x1},
-		unicode.Range32{Lo: 0x11a59, Hi: 0x11a5b, Stride: 0x1},
-		unicode.Range32{Lo: 0x11a8a, Hi: 0x11a96, Stride: 0x1},
-		unicode.Range32{Lo: 0x11a97, Hi: 0x11a97, Stride: 0x1},
-		unicode.Range32{Lo: 0x11a98, Hi: 0x11a99, Stride: 0x1},
-		unicode.Range32{Lo: 0x11c2f, Hi: 0x11c2f, Stride: 0x1},
-		unicode.Range32{Lo: 0x11c30, Hi: 0x11c36, Stride: 0x1},
-		unicode.Range32{Lo: 0x11c38, Hi: 0x11c3d, Stride: 0x1},
-		unicode.Range32{Lo: 0x11c3e, Hi: 0x11c3e, Stride: 0x1},
-		unicode.Range32{Lo: 0x11c3f, Hi: 0x11c3f, Stride: 0x1},
-		unicode.Range32{Lo: 0x11c92, Hi: 0x11ca7, Stride: 0x1},
-		unicode.Range32{Lo: 0x11ca9, Hi: 0x11ca9, Stride: 0x1},
-		unicode.Range32{Lo: 0x11caa, Hi: 0x11cb0, Stride: 0x1},
-		unicode.Range32{Lo: 0x11cb1, Hi: 0x11cb1, Stride: 0x1},
-		unicode.Range32{Lo: 0x11cb2, Hi: 0x11cb3, Stride: 0x1},
-		unicode.Range32{Lo: 0x11cb4, Hi: 0x11cb4, Stride: 0x1},
-		unicode.Range32{Lo: 0x11cb5, Hi: 0x11cb6, Stride: 0x1},
-		unicode.Range32{Lo: 0x11d31, Hi: 0x11d36, Stride: 0x1},
-		unicode.Range32{Lo: 0x11d3a, Hi: 0x11d3a, Stride: 0x1},
-		unicode.Range32{Lo: 0x11d3c, Hi: 0x11d3d, Stride: 0x1},
-		unicode.Range32{Lo: 0x11d3f, Hi: 0x11d45, Stride: 0x1},
-		unicode.Range32{Lo: 0x11d47, Hi: 0x11d47, Stride: 0x1},
-		unicode.Range32{Lo: 0x11d8a, Hi: 0x11d8e, Stride: 0x1},
-		unicode.Range32{Lo: 0x11d90, Hi: 0x11d91, Stride: 0x1},
-		unicode.Range32{Lo: 0x11d93, Hi: 0x11d94, Stride: 0x1},
-		unicode.Range32{Lo: 0x11d95, Hi: 0x11d95, Stride: 0x1},
-		unicode.Range32{Lo: 0x11d96, Hi: 0x11d96, Stride: 0x1},
-		unicode.Range32{Lo: 0x11d97, Hi: 0x11d97, Stride: 0x1},
-		unicode.Range32{Lo: 0x11ef3, Hi: 0x11ef4, Stride: 0x1},
-		unicode.Range32{Lo: 0x11ef5, Hi: 0x11ef6, Stride: 0x1},
-		unicode.Range32{Lo: 0x16af0, Hi: 0x16af4, Stride: 0x1},
-		unicode.Range32{Lo: 0x16b30, Hi: 0x16b36, Stride: 0x1},
-		unicode.Range32{Lo: 0x16f4f, Hi: 0x16f4f, Stride: 0x1},
-		unicode.Range32{Lo: 0x16f51, Hi: 0x16f87, Stride: 0x1},
-		unicode.Range32{Lo: 0x16f8f, Hi: 0x16f92, Stride: 0x1},
-		unicode.Range32{Lo: 0x1bc9d, Hi: 0x1bc9e, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d165, Hi: 0x1d166, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d167, Hi: 0x1d169, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d16d, Hi: 0x1d172, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d17b, Hi: 0x1d182, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d185, Hi: 0x1d18b, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d1aa, Hi: 0x1d1ad, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d242, Hi: 0x1d244, Stride: 0x1},
-		unicode.Range32{Lo: 0x1da00, Hi: 0x1da36, Stride: 0x1},
-		unicode.Range32{Lo: 0x1da3b, Hi: 0x1da6c, Stride: 0x1},
-		unicode.Range32{Lo: 0x1da75, Hi: 0x1da75, Stride: 0x1},
-		unicode.Range32{Lo: 0x1da84, Hi: 0x1da84, Stride: 0x1},
-		unicode.Range32{Lo: 0x1da9b, Hi: 0x1da9f, Stride: 0x1},
-		unicode.Range32{Lo: 0x1daa1, Hi: 0x1daaf, Stride: 0x1},
-		unicode.Range32{Lo: 0x1e000, Hi: 0x1e006, Stride: 0x1},
-		unicode.Range32{Lo: 0x1e008, Hi: 0x1e018, Stride: 0x1},
-		unicode.Range32{Lo: 0x1e01b, Hi: 0x1e021, Stride: 0x1},
-		unicode.Range32{Lo: 0x1e023, Hi: 0x1e024, Stride: 0x1},
-		unicode.Range32{Lo: 0x1e026, Hi: 0x1e02a, Stride: 0x1},
-		unicode.Range32{Lo: 0x1e130, Hi: 0x1e136, Stride: 0x1},
-		unicode.Range32{Lo: 0x1e2ec, Hi: 0x1e2ef, Stride: 0x1},
-		unicode.Range32{Lo: 0x1e8d0, Hi: 0x1e8d6, Stride: 0x1},
-		unicode.Range32{Lo: 0x1e944, Hi: 0x1e94a, Stride: 0x1},
-		unicode.Range32{Lo: 0x1f3fb, Hi: 0x1f3ff, Stride: 0x1},
-		unicode.Range32{Lo: 0xe0020, Hi: 0xe007f, Stride: 0x1},
-		unicode.Range32{Lo: 0xe0100, Hi: 0xe01ef, Stride: 0x1},
-	},
-	LatinOffset: 0,
-}
-
-var _WordExtendNumLet = &unicode.RangeTable{
-	R16: []unicode.Range16{
-		unicode.Range16{Lo: 0x5f, Hi: 0x5f, Stride: 0x1},
-		unicode.Range16{Lo: 0x202f, Hi: 0x202f, Stride: 0x1},
-		unicode.Range16{Lo: 0x203f, Hi: 0x2040, Stride: 0x1},
-		unicode.Range16{Lo: 0x2054, Hi: 0x2054, Stride: 0x1},
-		unicode.Range16{Lo: 0xfe33, Hi: 0xfe34, Stride: 0x1},
-		unicode.Range16{Lo: 0xfe4d, Hi: 0xfe4f, Stride: 0x1},
-		unicode.Range16{Lo: 0xff3f, Hi: 0xff3f, Stride: 0x1},
-	},
-	LatinOffset: 1,
-}
-
-var _WordFormat = &unicode.RangeTable{
-	R16: []unicode.Range16{
-		unicode.Range16{Lo: 0xad, Hi: 0xad, Stride: 0x1},
-		unicode.Range16{Lo: 0x600, Hi: 0x605, Stride: 0x1},
-		unicode.Range16{Lo: 0x61c, Hi: 0x61c, Stride: 0x1},
-		unicode.Range16{Lo: 0x6dd, Hi: 0x6dd, Stride: 0x1},
-		unicode.Range16{Lo: 0x70f, Hi: 0x70f, Stride: 0x1},
-		unicode.Range16{Lo: 0x8e2, Hi: 0x8e2, Stride: 0x1},
-		unicode.Range16{Lo: 0x180e, Hi: 0x180e, Stride: 0x1},
-		unicode.Range16{Lo: 0x200e, Hi: 0x200f, Stride: 0x1},
-		unicode.Range16{Lo: 0x202a, Hi: 0x202e, Stride: 0x1},
-		unicode.Range16{Lo: 0x2060, Hi: 0x2064, Stride: 0x1},
-		unicode.Range16{Lo: 0x2066, Hi: 0x206f, Stride: 0x1},
-		unicode.Range16{Lo: 0xfeff, Hi: 0xfeff, Stride: 0x1},
-		unicode.Range16{Lo: 0xfff9, Hi: 0xfffb, Stride: 0x1},
-	},
-	R32: []unicode.Range32{
-		unicode.Range32{Lo: 0x110bd, Hi: 0x110bd, Stride: 0x1},
-		unicode.Range32{Lo: 0x110cd, Hi: 0x110cd, Stride: 0x1},
-		unicode.Range32{Lo: 0x13430, Hi: 0x13438, Stride: 0x1},
-		unicode.Range32{Lo: 0x1bca0, Hi: 0x1bca3, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d173, Hi: 0x1d17a, Stride: 0x1},
-		unicode.Range32{Lo: 0xe0001, Hi: 0xe0001, Stride: 0x1},
-	},
-	LatinOffset: 1,
-}
-
-var _WordHebrew_Letter = &unicode.RangeTable{
-	R16: []unicode.Range16{
-		unicode.Range16{Lo: 0x5d0, Hi: 0x5ea, Stride: 0x1},
-		unicode.Range16{Lo: 0x5ef, Hi: 0x5f2, Stride: 0x1},
-		unicode.Range16{Lo: 0xfb1d, Hi: 0xfb1d, Stride: 0x1},
-		unicode.Range16{Lo: 0xfb1f, Hi: 0xfb28, Stride: 0x1},
-		unicode.Range16{Lo: 0xfb2a, Hi: 0xfb36, Stride: 0x1},
-		unicode.Range16{Lo: 0xfb38, Hi: 0xfb3c, Stride: 0x1},
-		unicode.Range16{Lo: 0xfb3e, Hi: 0xfb3e, Stride: 0x1},
-		unicode.Range16{Lo: 0xfb40, Hi: 0xfb41, Stride: 0x1},
-		unicode.Range16{Lo: 0xfb43, Hi: 0xfb44, Stride: 0x1},
-		unicode.Range16{Lo: 0xfb46, Hi: 0xfb4f, Stride: 0x1},
-	},
-	LatinOffset: 0,
-}
-
-var _WordKatakana = &unicode.RangeTable{
-	R16: []unicode.Range16{
-		unicode.Range16{Lo: 0x3031, Hi: 0x3035, Stride: 0x1},
-		unicode.Range16{Lo: 0x309b, Hi: 0x309c, Stride: 0x1},
-		unicode.Range16{Lo: 0x30a0, Hi: 0x30a0, Stride: 0x1},
-		unicode.Range16{Lo: 0x30a1, Hi: 0x30fa, Stride: 0x1},
-		unicode.Range16{Lo: 0x30fc, Hi: 0x30fe, Stride: 0x1},
-		unicode.Range16{Lo: 0x30ff, Hi: 0x30ff, Stride: 0x1},
-		unicode.Range16{Lo: 0x31f0, Hi: 0x31ff, Stride: 0x1},
-		unicode.Range16{Lo: 0x32d0, Hi: 0x32fe, Stride: 0x1},
-		unicode.Range16{Lo: 0x3300, Hi: 0x3357, Stride: 0x1},
-		unicode.Range16{Lo: 0xff66, Hi: 0xff6f, Stride: 0x1},
-		unicode.Range16{Lo: 0xff70, Hi: 0xff70, Stride: 0x1},
-		unicode.Range16{Lo: 0xff71, Hi: 0xff9d, Stride: 0x1},
-	},
-	R32: []unicode.Range32{
-		unicode.Range32{Lo: 0x1b000, Hi: 0x1b000, Stride: 0x1},
-		unicode.Range32{Lo: 0x1b164, Hi: 0x1b167, Stride: 0x1},
-	},
-	LatinOffset: 0,
-}
-
-var _WordLF = &unicode.RangeTable{
-	R16: []unicode.Range16{
-		unicode.Range16{Lo: 0xa, Hi: 0xa, Stride: 0x1},
-	},
-	LatinOffset: 1,
-}
-
-var _WordMidLetter = &unicode.RangeTable{
-	R16: []unicode.Range16{
-		unicode.Range16{Lo: 0x3a, Hi: 0x3a, Stride: 0x1},
-		unicode.Range16{Lo: 0xb7, Hi: 0xb7, Stride: 0x1},
-		unicode.Range16{Lo: 0x387, Hi: 0x387, Stride: 0x1},
-		unicode.Range16{Lo: 0x5f4, Hi: 0x5f4, Stride: 0x1},
-		unicode.Range16{Lo: 0x2027, Hi: 0x2027, Stride: 0x1},
-		unicode.Range16{Lo: 0xfe13, Hi: 0xfe13, Stride: 0x1},
-		unicode.Range16{Lo: 0xfe55, Hi: 0xfe55, Stride: 0x1},
-		unicode.Range16{Lo: 0xff1a, Hi: 0xff1a, Stride: 0x1},
-	},
-	LatinOffset: 2,
-}
-
-var _WordMidNum = &unicode.RangeTable{
-	R16: []unicode.Range16{
-		unicode.Range16{Lo: 0x2c, Hi: 0x2c, Stride: 0x1},
-		unicode.Range16{Lo: 0x3b, Hi: 0x3b, Stride: 0x1},
-		unicode.Range16{Lo: 0x37e, Hi: 0x37e, Stride: 0x1},
-		unicode.Range16{Lo: 0x589, Hi: 0x589, Stride: 0x1},
-		unicode.Range16{Lo: 0x60c, Hi: 0x60d, Stride: 0x1},
-		unicode.Range16{Lo: 0x66c, Hi: 0x66c, Stride: 0x1},
-		unicode.Range16{Lo: 0x7f8, Hi: 0x7f8, Stride: 0x1},
-		unicode.Range16{Lo: 0x2044, Hi: 0x2044, Stride: 0x1},
-		unicode.Range16{Lo: 0xfe10, Hi: 0xfe10, Stride: 0x1},
-		unicode.Range16{Lo: 0xfe14, Hi: 0xfe14, Stride: 0x1},
-		unicode.Range16{Lo: 0xfe50, Hi: 0xfe50, Stride: 0x1},
-		unicode.Range16{Lo: 0xfe54, Hi: 0xfe54, Stride: 0x1},
-		unicode.Range16{Lo: 0xff0c, Hi: 0xff0c, Stride: 0x1},
-		unicode.Range16{Lo: 0xff1b, Hi: 0xff1b, Stride: 0x1},
-	},
-	LatinOffset: 2,
-}
-
-var _WordMidNumLet = &unicode.RangeTable{
-	R16: []unicode.Range16{
-		unicode.Range16{Lo: 0x2e, Hi: 0x2e, Stride: 0x1},
-		unicode.Range16{Lo: 0x2018, Hi: 0x2018, Stride: 0x1},
-		unicode.Range16{Lo: 0x2019, Hi: 0x2019, Stride: 0x1},
-		unicode.Range16{Lo: 0x2024, Hi: 0x2024, Stride: 0x1},
-		unicode.Range16{Lo: 0xfe52, Hi: 0xfe52, Stride: 0x1},
-		unicode.Range16{Lo: 0xff07, Hi: 0xff07, Stride: 0x1},
-		unicode.Range16{Lo: 0xff0e, Hi: 0xff0e, Stride: 0x1},
-	},
-	LatinOffset: 1,
-}
-
-var _WordNewline = &unicode.RangeTable{
-	R16: []unicode.Range16{
-		unicode.Range16{Lo: 0xb, Hi: 0xc, Stride: 0x1},
-		unicode.Range16{Lo: 0x85, Hi: 0x85, Stride: 0x1},
-		unicode.Range16{Lo: 0x2028, Hi: 0x2028, Stride: 0x1},
-		unicode.Range16{Lo: 0x2029, Hi: 0x2029, Stride: 0x1},
-	},
-	LatinOffset: 2,
-}
-
-var _WordNumeric = &unicode.RangeTable{
-	R16: []unicode.Range16{
-		unicode.Range16{Lo: 0x30, Hi: 0x39, Stride: 0x1},
-		unicode.Range16{Lo: 0x660, Hi: 0x669, Stride: 0x1},
-		unicode.Range16{Lo: 0x66b, Hi: 0x66b, Stride: 0x1},
-		unicode.Range16{Lo: 0x6f0, Hi: 0x6f9, Stride: 0x1},
-		unicode.Range16{Lo: 0x7c0, Hi: 0x7c9, Stride: 0x1},
-		unicode.Range16{Lo: 0x966, Hi: 0x96f, Stride: 0x1},
-		unicode.Range16{Lo: 0x9e6, Hi: 0x9ef, Stride: 0x1},
-		unicode.Range16{Lo: 0xa66, Hi: 0xa6f, Stride: 0x1},
-		unicode.Range16{Lo: 0xae6, Hi: 0xaef, Stride: 0x1},
-		unicode.Range16{Lo: 0xb66, Hi: 0xb6f, Stride: 0x1},
-		unicode.Range16{Lo: 0xbe6, Hi: 0xbef, Stride: 0x1},
-		unicode.Range16{Lo: 0xc66, Hi: 0xc6f, Stride: 0x1},
-		unicode.Range16{Lo: 0xce6, Hi: 0xcef, Stride: 0x1},
-		unicode.Range16{Lo: 0xd66, Hi: 0xd6f, Stride: 0x1},
-		unicode.Range16{Lo: 0xde6, Hi: 0xdef, Stride: 0x1},
-		unicode.Range16{Lo: 0xe50, Hi: 0xe59, Stride: 0x1},
-		unicode.Range16{Lo: 0xed0, Hi: 0xed9, Stride: 0x1},
-		unicode.Range16{Lo: 0xf20, Hi: 0xf29, Stride: 0x1},
-		unicode.Range16{Lo: 0x1040, Hi: 0x1049, Stride: 0x1},
-		unicode.Range16{Lo: 0x1090, Hi: 0x1099, Stride: 0x1},
-		unicode.Range16{Lo: 0x17e0, Hi: 0x17e9, Stride: 0x1},
-		unicode.Range16{Lo: 0x1810, Hi: 0x1819, Stride: 0x1},
-		unicode.Range16{Lo: 0x1946, Hi: 0x194f, Stride: 0x1},
-		unicode.Range16{Lo: 0x19d0, Hi: 0x19d9, Stride: 0x1},
-		unicode.Range16{Lo: 0x1a80, Hi: 0x1a89, Stride: 0x1},
-		unicode.Range16{Lo: 0x1a90, Hi: 0x1a99, Stride: 0x1},
-		unicode.Range16{Lo: 0x1b50, Hi: 0x1b59, Stride: 0x1},
-		unicode.Range16{Lo: 0x1bb0, Hi: 0x1bb9, Stride: 0x1},
-		unicode.Range16{Lo: 0x1c40, Hi: 0x1c49, Stride: 0x1},
-		unicode.Range16{Lo: 0x1c50, Hi: 0x1c59, Stride: 0x1},
-		unicode.Range16{Lo: 0xa620, Hi: 0xa629, Stride: 0x1},
-		unicode.Range16{Lo: 0xa8d0, Hi: 0xa8d9, Stride: 0x1},
-		unicode.Range16{Lo: 0xa900, Hi: 0xa909, Stride: 0x1},
-		unicode.Range16{Lo: 0xa9d0, Hi: 0xa9d9, Stride: 0x1},
-		unicode.Range16{Lo: 0xa9f0, Hi: 0xa9f9, Stride: 0x1},
-		unicode.Range16{Lo: 0xaa50, Hi: 0xaa59, Stride: 0x1},
-		unicode.Range16{Lo: 0xabf0, Hi: 0xabf9, Stride: 0x1},
-		unicode.Range16{Lo: 0xff10, Hi: 0xff19, Stride: 0x1},
-	},
-	R32: []unicode.Range32{
-		unicode.Range32{Lo: 0x104a0, Hi: 0x104a9, Stride: 0x1},
-		unicode.Range32{Lo: 0x10d30, Hi: 0x10d39, Stride: 0x1},
-		unicode.Range32{Lo: 0x11066, Hi: 0x1106f, Stride: 0x1},
-		unicode.Range32{Lo: 0x110f0, Hi: 0x110f9, Stride: 0x1},
-		unicode.Range32{Lo: 0x11136, Hi: 0x1113f, Stride: 0x1},
-		unicode.Range32{Lo: 0x111d0, Hi: 0x111d9, Stride: 0x1},
-		unicode.Range32{Lo: 0x112f0, Hi: 0x112f9, Stride: 0x1},
-		unicode.Range32{Lo: 0x11450, Hi: 0x11459, Stride: 0x1},
-		unicode.Range32{Lo: 0x114d0, Hi: 0x114d9, Stride: 0x1},
-		unicode.Range32{Lo: 0x11650, Hi: 0x11659, Stride: 0x1},
-		unicode.Range32{Lo: 0x116c0, Hi: 0x116c9, Stride: 0x1},
-		unicode.Range32{Lo: 0x11730, Hi: 0x11739, Stride: 0x1},
-		unicode.Range32{Lo: 0x118e0, Hi: 0x118e9, Stride: 0x1},
-		unicode.Range32{Lo: 0x11c50, Hi: 0x11c59, Stride: 0x1},
-		unicode.Range32{Lo: 0x11d50, Hi: 0x11d59, Stride: 0x1},
-		unicode.Range32{Lo: 0x11da0, Hi: 0x11da9, Stride: 0x1},
-		unicode.Range32{Lo: 0x16a60, Hi: 0x16a69, Stride: 0x1},
-		unicode.Range32{Lo: 0x16b50, Hi: 0x16b59, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d7ce, Hi: 0x1d7ff, Stride: 0x1},
-		unicode.Range32{Lo: 0x1e140, Hi: 0x1e149, Stride: 0x1},
-		unicode.Range32{Lo: 0x1e2f0, Hi: 0x1e2f9, Stride: 0x1},
-		unicode.Range32{Lo: 0x1e950, Hi: 0x1e959, Stride: 0x1},
-	},
-	LatinOffset: 1,
-}
-
-var _WordRegional_Indicator = &unicode.RangeTable{
-	R32: []unicode.Range32{
-		unicode.Range32{Lo: 0x1f1e6, Hi: 0x1f1ff, Stride: 0x1},
-	},
-	LatinOffset: 0,
-}
-
-var _WordSingle_Quote = &unicode.RangeTable{
-	R16: []unicode.Range16{
-		unicode.Range16{Lo: 0x27, Hi: 0x27, Stride: 0x1},
-	},
-	LatinOffset: 1,
-}
-
-var _WordWSegSpace = &unicode.RangeTable{
-	R16: []unicode.Range16{
-		unicode.Range16{Lo: 0x20, Hi: 0x20, Stride: 0x1},
-		unicode.Range16{Lo: 0x1680, Hi: 0x1680, Stride: 0x1},
-		unicode.Range16{Lo: 0x2000, Hi: 0x2006, Stride: 0x1},
-		unicode.Range16{Lo: 0x2008, Hi: 0x200a, Stride: 0x1},
-		unicode.Range16{Lo: 0x205f, Hi: 0x205f, Stride: 0x1},
-		unicode.Range16{Lo: 0x3000, Hi: 0x3000, Stride: 0x1},
-	},
-	LatinOffset: 1,
-}
-
-var _WordZWJ = &unicode.RangeTable{
-	R16: []unicode.Range16{
-		unicode.Range16{Lo: 0x200d, Hi: 0x200d, Stride: 0x1},
-	},
-	LatinOffset: 0,
-}
-
-type _WordRuneRange unicode.RangeTable
-
-func _WordRuneType(r rune) *_WordRuneRange {
-	switch {
-	case unicode.Is(_WordALetter, r):
-		return (*_WordRuneRange)(_WordALetter)
-	case unicode.Is(_WordCR, r):
-		return (*_WordRuneRange)(_WordCR)
-	case unicode.Is(_WordDouble_Quote, r):
-		return (*_WordRuneRange)(_WordDouble_Quote)
-	case unicode.Is(_WordExtend, r):
-		return (*_WordRuneRange)(_WordExtend)
-	case unicode.Is(_WordExtendNumLet, r):
-		return (*_WordRuneRange)(_WordExtendNumLet)
-	case unicode.Is(_WordFormat, r):
-		return (*_WordRuneRange)(_WordFormat)
-	case unicode.Is(_WordHebrew_Letter, r):
-		return (*_WordRuneRange)(_WordHebrew_Letter)
-	case unicode.Is(_WordKatakana, r):
-		return (*_WordRuneRange)(_WordKatakana)
-	case unicode.Is(_WordLF, r):
-		return (*_WordRuneRange)(_WordLF)
-	case unicode.Is(_WordMidLetter, r):
-		return (*_WordRuneRange)(_WordMidLetter)
-	case unicode.Is(_WordMidNum, r):
-		return (*_WordRuneRange)(_WordMidNum)
-	case unicode.Is(_WordMidNumLet, r):
-		return (*_WordRuneRange)(_WordMidNumLet)
-	case unicode.Is(_WordNewline, r):
-		return (*_WordRuneRange)(_WordNewline)
-	case unicode.Is(_WordNumeric, r):
-		return (*_WordRuneRange)(_WordNumeric)
-	case unicode.Is(_WordRegional_Indicator, r):
-		return (*_WordRuneRange)(_WordRegional_Indicator)
-	case unicode.Is(_WordSingle_Quote, r):
-		return (*_WordRuneRange)(_WordSingle_Quote)
-	case unicode.Is(_WordWSegSpace, r):
-		return (*_WordRuneRange)(_WordWSegSpace)
-	case unicode.Is(_WordZWJ, r):
-		return (*_WordRuneRange)(_WordZWJ)
-	default:
-		return nil
-	}
-}
-func (rng *_WordRuneRange) String() string {
-	switch (*unicode.RangeTable)(rng) {
-	case _WordALetter:
-		return "ALetter"
-	case _WordCR:
-		return "CR"
-	case _WordDouble_Quote:
-		return "Double_Quote"
-	case _WordExtend:
-		return "Extend"
-	case _WordExtendNumLet:
-		return "ExtendNumLet"
-	case _WordFormat:
-		return "Format"
-	case _WordHebrew_Letter:
-		return "Hebrew_Letter"
-	case _WordKatakana:
-		return "Katakana"
-	case _WordLF:
-		return "LF"
-	case _WordMidLetter:
-		return "MidLetter"
-	case _WordMidNum:
-		return "MidNum"
-	case _WordMidNumLet:
-		return "MidNumLet"
-	case _WordNewline:
-		return "Newline"
-	case _WordNumeric:
-		return "Numeric"
-	case _WordRegional_Indicator:
-		return "Regional_Indicator"
-	case _WordSingle_Quote:
-		return "Single_Quote"
-	case _WordWSegSpace:
-		return "WSegSpace"
-	case _WordZWJ:
-		return "ZWJ"
-	default:
-		return "Other"
-	}
-}
-
-var _SentenceATerm = &unicode.RangeTable{
-	R16: []unicode.Range16{
-		unicode.Range16{Lo: 0x2e, Hi: 0x2e, Stride: 0x1},
-		unicode.Range16{Lo: 0x2024, Hi: 0x2024, Stride: 0x1},
-		unicode.Range16{Lo: 0xfe52, Hi: 0xfe52, Stride: 0x1},
-		unicode.Range16{Lo: 0xff0e, Hi: 0xff0e, Stride: 0x1},
-	},
-	LatinOffset: 1,
-}
-
-var _SentenceCR = &unicode.RangeTable{
-	R16: []unicode.Range16{
-		unicode.Range16{Lo: 0xd, Hi: 0xd, Stride: 0x1},
-	},
-	LatinOffset: 1,
-}
-
-var _SentenceClose = &unicode.RangeTable{
-	R16: []unicode.Range16{
-		unicode.Range16{Lo: 0x22, Hi: 0x22, Stride: 0x1},
-		unicode.Range16{Lo: 0x27, Hi: 0x27, Stride: 0x1},
-		unicode.Range16{Lo: 0x28, Hi: 0x28, Stride: 0x1},
-		unicode.Range16{Lo: 0x29, Hi: 0x29, Stride: 0x1},
-		unicode.Range16{Lo: 0x5b, Hi: 0x5b, Stride: 0x1},
-		unicode.Range16{Lo: 0x5d, Hi: 0x5d, Stride: 0x1},
-		unicode.Range16{Lo: 0x7b, Hi: 0x7b, Stride: 0x1},
-		unicode.Range16{Lo: 0x7d, Hi: 0x7d, Stride: 0x1},
-		unicode.Range16{Lo: 0xab, Hi: 0xab, Stride: 0x1},
-		unicode.Range16{Lo: 0xbb, Hi: 0xbb, Stride: 0x1},
-		unicode.Range16{Lo: 0xf3a, Hi: 0xf3a, Stride: 0x1},
-		unicode.Range16{Lo: 0xf3b, Hi: 0xf3b, Stride: 0x1},
-		unicode.Range16{Lo: 0xf3c, Hi: 0xf3c, Stride: 0x1},
-		unicode.Range16{Lo: 0xf3d, Hi: 0xf3d, Stride: 0x1},
-		unicode.Range16{Lo: 0x169b, Hi: 0x169b, Stride: 0x1},
-		unicode.Range16{Lo: 0x169c, Hi: 0x169c, Stride: 0x1},
-		unicode.Range16{Lo: 0x2018, Hi: 0x2018, Stride: 0x1},
-		unicode.Range16{Lo: 0x2019, Hi: 0x2019, Stride: 0x1},
-		unicode.Range16{Lo: 0x201a, Hi: 0x201a, Stride: 0x1},
-		unicode.Range16{Lo: 0x201b, Hi: 0x201c, Stride: 0x1},
-		unicode.Range16{Lo: 0x201d, Hi: 0x201d, Stride: 0x1},
-		unicode.Range16{Lo: 0x201e, Hi: 0x201e, Stride: 0x1},
-		unicode.Range16{Lo: 0x201f, Hi: 0x201f, Stride: 0x1},
-		unicode.Range16{Lo: 0x2039, Hi: 0x2039, Stride: 0x1},
-		unicode.Range16{Lo: 0x203a, Hi: 0x203a, Stride: 0x1},
-		unicode.Range16{Lo: 0x2045, Hi: 0x2045, Stride: 0x1},
-		unicode.Range16{Lo: 0x2046, Hi: 0x2046, Stride: 0x1},
-		unicode.Range16{Lo: 0x207d, Hi: 0x207d, Stride: 0x1},
-		unicode.Range16{Lo: 0x207e, Hi: 0x207e, Stride: 0x1},
-		unicode.Range16{Lo: 0x208d, Hi: 0x208d, Stride: 0x1},
-		unicode.Range16{Lo: 0x208e, Hi: 0x208e, Stride: 0x1},
-		unicode.Range16{Lo: 0x2308, Hi: 0x2308, Stride: 0x1},
-		unicode.Range16{Lo: 0x2309, Hi: 0x2309, Stride: 0x1},
-		unicode.Range16{Lo: 0x230a, Hi: 0x230a, Stride: 0x1},
-		unicode.Range16{Lo: 0x230b, Hi: 0x230b, Stride: 0x1},
-		unicode.Range16{Lo: 0x2329, Hi: 0x2329, Stride: 0x1},
-		unicode.Range16{Lo: 0x232a, Hi: 0x232a, Stride: 0x1},
-		unicode.Range16{Lo: 0x275b, Hi: 0x2760, Stride: 0x1},
-		unicode.Range16{Lo: 0x2768, Hi: 0x2768, Stride: 0x1},
-		unicode.Range16{Lo: 0x2769, Hi: 0x2769, Stride: 0x1},
-		unicode.Range16{Lo: 0x276a, Hi: 0x276a, Stride: 0x1},
-		unicode.Range16{Lo: 0x276b, Hi: 0x276b, Stride: 0x1},
-		unicode.Range16{Lo: 0x276c, Hi: 0x276c, Stride: 0x1},
-		unicode.Range16{Lo: 0x276d, Hi: 0x276d, Stride: 0x1},
-		unicode.Range16{Lo: 0x276e, Hi: 0x276e, Stride: 0x1},
-		unicode.Range16{Lo: 0x276f, Hi: 0x276f, Stride: 0x1},
-		unicode.Range16{Lo: 0x2770, Hi: 0x2770, Stride: 0x1},
-		unicode.Range16{Lo: 0x2771, Hi: 0x2771, Stride: 0x1},
-		unicode.Range16{Lo: 0x2772, Hi: 0x2772, Stride: 0x1},
-		unicode.Range16{Lo: 0x2773, Hi: 0x2773, Stride: 0x1},
-		unicode.Range16{Lo: 0x2774, Hi: 0x2774, Stride: 0x1},
-		unicode.Range16{Lo: 0x2775, Hi: 0x2775, Stride: 0x1},
-		unicode.Range16{Lo: 0x27c5, Hi: 0x27c5, Stride: 0x1},
-		unicode.Range16{Lo: 0x27c6, Hi: 0x27c6, Stride: 0x1},
-		unicode.Range16{Lo: 0x27e6, Hi: 0x27e6, Stride: 0x1},
-		unicode.Range16{Lo: 0x27e7, Hi: 0x27e7, Stride: 0x1},
-		unicode.Range16{Lo: 0x27e8, Hi: 0x27e8, Stride: 0x1},
-		unicode.Range16{Lo: 0x27e9, Hi: 0x27e9, Stride: 0x1},
-		unicode.Range16{Lo: 0x27ea, Hi: 0x27ea, Stride: 0x1},
-		unicode.Range16{Lo: 0x27eb, Hi: 0x27eb, Stride: 0x1},
-		unicode.Range16{Lo: 0x27ec, Hi: 0x27ec, Stride: 0x1},
-		unicode.Range16{Lo: 0x27ed, Hi: 0x27ed, Stride: 0x1},
-		unicode.Range16{Lo: 0x27ee, Hi: 0x27ee, Stride: 0x1},
-		unicode.Range16{Lo: 0x27ef, Hi: 0x27ef, Stride: 0x1},
-		unicode.Range16{Lo: 0x2983, Hi: 0x2983, Stride: 0x1},
-		unicode.Range16{Lo: 0x2984, Hi: 0x2984, Stride: 0x1},
-		unicode.Range16{Lo: 0x2985, Hi: 0x2985, Stride: 0x1},
-		unicode.Range16{Lo: 0x2986, Hi: 0x2986, Stride: 0x1},
-		unicode.Range16{Lo: 0x2987, Hi: 0x2987, Stride: 0x1},
-		unicode.Range16{Lo: 0x2988, Hi: 0x2988, Stride: 0x1},
-		unicode.Range16{Lo: 0x2989, Hi: 0x2989, Stride: 0x1},
-		unicode.Range16{Lo: 0x298a, Hi: 0x298a, Stride: 0x1},
-		unicode.Range16{Lo: 0x298b, Hi: 0x298b, Stride: 0x1},
-		unicode.Range16{Lo: 0x298c, Hi: 0x298c, Stride: 0x1},
-		unicode.Range16{Lo: 0x298d, Hi: 0x298d, Stride: 0x1},
-		unicode.Range16{Lo: 0x298e, Hi: 0x298e, Stride: 0x1},
-		unicode.Range16{Lo: 0x298f, Hi: 0x298f, Stride: 0x1},
-		unicode.Range16{Lo: 0x2990, Hi: 0x2990, Stride: 0x1},
-		unicode.Range16{Lo: 0x2991, Hi: 0x2991, Stride: 0x1},
-		unicode.Range16{Lo: 0x2992, Hi: 0x2992, Stride: 0x1},
-		unicode.Range16{Lo: 0x2993, Hi: 0x2993, Stride: 0x1},
-		unicode.Range16{Lo: 0x2994, Hi: 0x2994, Stride: 0x1},
-		unicode.Range16{Lo: 0x2995, Hi: 0x2995, Stride: 0x1},
-		unicode.Range16{Lo: 0x2996, Hi: 0x2996, Stride: 0x1},
-		unicode.Range16{Lo: 0x2997, Hi: 0x2997, Stride: 0x1},
-		unicode.Range16{Lo: 0x2998, Hi: 0x2998, Stride: 0x1},
-		unicode.Range16{Lo: 0x29d8, Hi: 0x29d8, Stride: 0x1},
-		unicode.Range16{Lo: 0x29d9, Hi: 0x29d9, Stride: 0x1},
-		unicode.Range16{Lo: 0x29da, Hi: 0x29da, Stride: 0x1},
-		unicode.Range16{Lo: 0x29db, Hi: 0x29db, Stride: 0x1},
-		unicode.Range16{Lo: 0x29fc, Hi: 0x29fc, Stride: 0x1},
-		unicode.Range16{Lo: 0x29fd, Hi: 0x29fd, Stride: 0x1},
-		unicode.Range16{Lo: 0x2e00, Hi: 0x2e01, Stride: 0x1},
-		unicode.Range16{Lo: 0x2e02, Hi: 0x2e02, Stride: 0x1},
-		unicode.Range16{Lo: 0x2e03, Hi: 0x2e03, Stride: 0x1},
-		unicode.Range16{Lo: 0x2e04, Hi: 0x2e04, Stride: 0x1},
-		unicode.Range16{Lo: 0x2e05, Hi: 0x2e05, Stride: 0x1},
-		unicode.Range16{Lo: 0x2e06, Hi: 0x2e08, Stride: 0x1},
-		unicode.Range16{Lo: 0x2e09, Hi: 0x2e09, Stride: 0x1},
-		unicode.Range16{Lo: 0x2e0a, Hi: 0x2e0a, Stride: 0x1},
-		unicode.Range16{Lo: 0x2e0b, Hi: 0x2e0b, Stride: 0x1},
-		unicode.Range16{Lo: 0x2e0c, Hi: 0x2e0c, Stride: 0x1},
-		unicode.Range16{Lo: 0x2e0d, Hi: 0x2e0d, Stride: 0x1},
-		unicode.Range16{Lo: 0x2e1c, Hi: 0x2e1c, Stride: 0x1},
-		unicode.Range16{Lo: 0x2e1d, Hi: 0x2e1d, Stride: 0x1},
-		unicode.Range16{Lo: 0x2e20, Hi: 0x2e20, Stride: 0x1},
-		unicode.Range16{Lo: 0x2e21, Hi: 0x2e21, Stride: 0x1},
-		unicode.Range16{Lo: 0x2e22, Hi: 0x2e22, Stride: 0x1},
-		unicode.Range16{Lo: 0x2e23, Hi: 0x2e23, Stride: 0x1},
-		unicode.Range16{Lo: 0x2e24, Hi: 0x2e24, Stride: 0x1},
-		unicode.Range16{Lo: 0x2e25, Hi: 0x2e25, Stride: 0x1},
-		unicode.Range16{Lo: 0x2e26, Hi: 0x2e26, Stride: 0x1},
-		unicode.Range16{Lo: 0x2e27, Hi: 0x2e27, Stride: 0x1},
-		unicode.Range16{Lo: 0x2e28, Hi: 0x2e28, Stride: 0x1},
-		unicode.Range16{Lo: 0x2e29, Hi: 0x2e29, Stride: 0x1},
-		unicode.Range16{Lo: 0x2e42, Hi: 0x2e42, Stride: 0x1},
-		unicode.Range16{Lo: 0x3008, Hi: 0x3008, Stride: 0x1},
-		unicode.Range16{Lo: 0x3009, Hi: 0x3009, Stride: 0x1},
-		unicode.Range16{Lo: 0x300a, Hi: 0x300a, Stride: 0x1},
-		unicode.Range16{Lo: 0x300b, Hi: 0x300b, Stride: 0x1},
-		unicode.Range16{Lo: 0x300c, Hi: 0x300c, Stride: 0x1},
-		unicode.Range16{Lo: 0x300d, Hi: 0x300d, Stride: 0x1},
-		unicode.Range16{Lo: 0x300e, Hi: 0x300e, Stride: 0x1},
-		unicode.Range16{Lo: 0x300f, Hi: 0x300f, Stride: 0x1},
-		unicode.Range16{Lo: 0x3010, Hi: 0x3010, Stride: 0x1},
-		unicode.Range16{Lo: 0x3011, Hi: 0x3011, Stride: 0x1},
-		unicode.Range16{Lo: 0x3014, Hi: 0x3014, Stride: 0x1},
-		unicode.Range16{Lo: 0x3015, Hi: 0x3015, Stride: 0x1},
-		unicode.Range16{Lo: 0x3016, Hi: 0x3016, Stride: 0x1},
-		unicode.Range16{Lo: 0x3017, Hi: 0x3017, Stride: 0x1},
-		unicode.Range16{Lo: 0x3018, Hi: 0x3018, Stride: 0x1},
-		unicode.Range16{Lo: 0x3019, Hi: 0x3019, Stride: 0x1},
-		unicode.Range16{Lo: 0x301a, Hi: 0x301a, Stride: 0x1},
-		unicode.Range16{Lo: 0x301b, Hi: 0x301b, Stride: 0x1},
-		unicode.Range16{Lo: 0x301d, Hi: 0x301d, Stride: 0x1},
-		unicode.Range16{Lo: 0x301e, Hi: 0x301f, Stride: 0x1},
-		unicode.Range16{Lo: 0xfd3e, Hi: 0xfd3e, Stride: 0x1},
-		unicode.Range16{Lo: 0xfd3f, Hi: 0xfd3f, Stride: 0x1},
-		unicode.Range16{Lo: 0xfe17, Hi: 0xfe17, Stride: 0x1},
-		unicode.Range16{Lo: 0xfe18, Hi: 0xfe18, Stride: 0x1},
-		unicode.Range16{Lo: 0xfe35, Hi: 0xfe35, Stride: 0x1},
-		unicode.Range16{Lo: 0xfe36, Hi: 0xfe36, Stride: 0x1},
-		unicode.Range16{Lo: 0xfe37, Hi: 0xfe37, Stride: 0x1},
-		unicode.Range16{Lo: 0xfe38, Hi: 0xfe38, Stride: 0x1},
-		unicode.Range16{Lo: 0xfe39, Hi: 0xfe39, Stride: 0x1},
-		unicode.Range16{Lo: 0xfe3a, Hi: 0xfe3a, Stride: 0x1},
-		unicode.Range16{Lo: 0xfe3b, Hi: 0xfe3b, Stride: 0x1},
-		unicode.Range16{Lo: 0xfe3c, Hi: 0xfe3c, Stride: 0x1},
-		unicode.Range16{Lo: 0xfe3d, Hi: 0xfe3d, Stride: 0x1},
-		unicode.Range16{Lo: 0xfe3e, Hi: 0xfe3e, Stride: 0x1},
-		unicode.Range16{Lo: 0xfe3f, Hi: 0xfe3f, Stride: 0x1},
-		unicode.Range16{Lo: 0xfe40, Hi: 0xfe40, Stride: 0x1},
-		unicode.Range16{Lo: 0xfe41, Hi: 0xfe41, Stride: 0x1},
-		unicode.Range16{Lo: 0xfe42, Hi: 0xfe42, Stride: 0x1},
-		unicode.Range16{Lo: 0xfe43, Hi: 0xfe43, Stride: 0x1},
-		unicode.Range16{Lo: 0xfe44, Hi: 0xfe44, Stride: 0x1},
-		unicode.Range16{Lo: 0xfe47, Hi: 0xfe47, Stride: 0x1},
-		unicode.Range16{Lo: 0xfe48, Hi: 0xfe48, Stride: 0x1},
-		unicode.Range16{Lo: 0xfe59, Hi: 0xfe59, Stride: 0x1},
-		unicode.Range16{Lo: 0xfe5a, Hi: 0xfe5a, Stride: 0x1},
-		unicode.Range16{Lo: 0xfe5b, Hi: 0xfe5b, Stride: 0x1},
-		unicode.Range16{Lo: 0xfe5c, Hi: 0xfe5c, Stride: 0x1},
-		unicode.Range16{Lo: 0xfe5d, Hi: 0xfe5d, Stride: 0x1},
-		unicode.Range16{Lo: 0xfe5e, Hi: 0xfe5e, Stride: 0x1},
-		unicode.Range16{Lo: 0xff08, Hi: 0xff08, Stride: 0x1},
-		unicode.Range16{Lo: 0xff09, Hi: 0xff09, Stride: 0x1},
-		unicode.Range16{Lo: 0xff3b, Hi: 0xff3b, Stride: 0x1},
-		unicode.Range16{Lo: 0xff3d, Hi: 0xff3d, Stride: 0x1},
-		unicode.Range16{Lo: 0xff5b, Hi: 0xff5b, Stride: 0x1},
-		unicode.Range16{Lo: 0xff5d, Hi: 0xff5d, Stride: 0x1},
-		unicode.Range16{Lo: 0xff5f, Hi: 0xff5f, Stride: 0x1},
-		unicode.Range16{Lo: 0xff60, Hi: 0xff60, Stride: 0x1},
-		unicode.Range16{Lo: 0xff62, Hi: 0xff62, Stride: 0x1},
-		unicode.Range16{Lo: 0xff63, Hi: 0xff63, Stride: 0x1},
-	},
-	R32: []unicode.Range32{
-		unicode.Range32{Lo: 0x1f676, Hi: 0x1f678, Stride: 0x1},
-	},
-	LatinOffset: 10,
-}
-
-var _SentenceExtend = &unicode.RangeTable{
-	R16: []unicode.Range16{
-		unicode.Range16{Lo: 0x300, Hi: 0x36f, Stride: 0x1},
-		unicode.Range16{Lo: 0x483, Hi: 0x487, Stride: 0x1},
-		unicode.Range16{Lo: 0x488, Hi: 0x489, Stride: 0x1},
-		unicode.Range16{Lo: 0x591, Hi: 0x5bd, Stride: 0x1},
-		unicode.Range16{Lo: 0x5bf, Hi: 0x5bf, Stride: 0x1},
-		unicode.Range16{Lo: 0x5c1, Hi: 0x5c2, Stride: 0x1},
-		unicode.Range16{Lo: 0x5c4, Hi: 0x5c5, Stride: 0x1},
-		unicode.Range16{Lo: 0x5c7, Hi: 0x5c7, Stride: 0x1},
-		unicode.Range16{Lo: 0x610, Hi: 0x61a, Stride: 0x1},
-		unicode.Range16{Lo: 0x64b, Hi: 0x65f, Stride: 0x1},
-		unicode.Range16{Lo: 0x670, Hi: 0x670, Stride: 0x1},
-		unicode.Range16{Lo: 0x6d6, Hi: 0x6dc, Stride: 0x1},
-		unicode.Range16{Lo: 0x6df, Hi: 0x6e4, Stride: 0x1},
-		unicode.Range16{Lo: 0x6e7, Hi: 0x6e8, Stride: 0x1},
-		unicode.Range16{Lo: 0x6ea, Hi: 0x6ed, Stride: 0x1},
-		unicode.Range16{Lo: 0x711, Hi: 0x711, Stride: 0x1},
-		unicode.Range16{Lo: 0x730, Hi: 0x74a, Stride: 0x1},
-		unicode.Range16{Lo: 0x7a6, Hi: 0x7b0, Stride: 0x1},
-		unicode.Range16{Lo: 0x7eb, Hi: 0x7f3, Stride: 0x1},
-		unicode.Range16{Lo: 0x7fd, Hi: 0x7fd, Stride: 0x1},
-		unicode.Range16{Lo: 0x816, Hi: 0x819, Stride: 0x1},
-		unicode.Range16{Lo: 0x81b, Hi: 0x823, Stride: 0x1},
-		unicode.Range16{Lo: 0x825, Hi: 0x827, Stride: 0x1},
-		unicode.Range16{Lo: 0x829, Hi: 0x82d, Stride: 0x1},
-		unicode.Range16{Lo: 0x859, Hi: 0x85b, Stride: 0x1},
-		unicode.Range16{Lo: 0x8d3, Hi: 0x8e1, Stride: 0x1},
-		unicode.Range16{Lo: 0x8e3, Hi: 0x902, Stride: 0x1},
-		unicode.Range16{Lo: 0x903, Hi: 0x903, Stride: 0x1},
-		unicode.Range16{Lo: 0x93a, Hi: 0x93a, Stride: 0x1},
-		unicode.Range16{Lo: 0x93b, Hi: 0x93b, Stride: 0x1},
-		unicode.Range16{Lo: 0x93c, Hi: 0x93c, Stride: 0x1},
-		unicode.Range16{Lo: 0x93e, Hi: 0x940, Stride: 0x1},
-		unicode.Range16{Lo: 0x941, Hi: 0x948, Stride: 0x1},
-		unicode.Range16{Lo: 0x949, Hi: 0x94c, Stride: 0x1},
-		unicode.Range16{Lo: 0x94d, Hi: 0x94d, Stride: 0x1},
-		unicode.Range16{Lo: 0x94e, Hi: 0x94f, Stride: 0x1},
-		unicode.Range16{Lo: 0x951, Hi: 0x957, Stride: 0x1},
-		unicode.Range16{Lo: 0x962, Hi: 0x963, Stride: 0x1},
-		unicode.Range16{Lo: 0x981, Hi: 0x981, Stride: 0x1},
-		unicode.Range16{Lo: 0x982, Hi: 0x983, Stride: 0x1},
-		unicode.Range16{Lo: 0x9bc, Hi: 0x9bc, Stride: 0x1},
-		unicode.Range16{Lo: 0x9be, Hi: 0x9c0, Stride: 0x1},
-		unicode.Range16{Lo: 0x9c1, Hi: 0x9c4, Stride: 0x1},
-		unicode.Range16{Lo: 0x9c7, Hi: 0x9c8, Stride: 0x1},
-		unicode.Range16{Lo: 0x9cb, Hi: 0x9cc, Stride: 0x1},
-		unicode.Range16{Lo: 0x9cd, Hi: 0x9cd, Stride: 0x1},
-		unicode.Range16{Lo: 0x9d7, Hi: 0x9d7, Stride: 0x1},
-		unicode.Range16{Lo: 0x9e2, Hi: 0x9e3, Stride: 0x1},
-		unicode.Range16{Lo: 0x9fe, Hi: 0x9fe, Stride: 0x1},
-		unicode.Range16{Lo: 0xa01, Hi: 0xa02, Stride: 0x1},
-		unicode.Range16{Lo: 0xa03, Hi: 0xa03, Stride: 0x1},
-		unicode.Range16{Lo: 0xa3c, Hi: 0xa3c, Stride: 0x1},
-		unicode.Range16{Lo: 0xa3e, Hi: 0xa40, Stride: 0x1},
-		unicode.Range16{Lo: 0xa41, Hi: 0xa42, Stride: 0x1},
-		unicode.Range16{Lo: 0xa47, Hi: 0xa48, Stride: 0x1},
-		unicode.Range16{Lo: 0xa4b, Hi: 0xa4d, Stride: 0x1},
-		unicode.Range16{Lo: 0xa51, Hi: 0xa51, Stride: 0x1},
-		unicode.Range16{Lo: 0xa70, Hi: 0xa71, Stride: 0x1},
-		unicode.Range16{Lo: 0xa75, Hi: 0xa75, Stride: 0x1},
-		unicode.Range16{Lo: 0xa81, Hi: 0xa82, Stride: 0x1},
-		unicode.Range16{Lo: 0xa83, Hi: 0xa83, Stride: 0x1},
-		unicode.Range16{Lo: 0xabc, Hi: 0xabc, Stride: 0x1},
-		unicode.Range16{Lo: 0xabe, Hi: 0xac0, Stride: 0x1},
-		unicode.Range16{Lo: 0xac1, Hi: 0xac5, Stride: 0x1},
-		unicode.Range16{Lo: 0xac7, Hi: 0xac8, Stride: 0x1},
-		unicode.Range16{Lo: 0xac9, Hi: 0xac9, Stride: 0x1},
-		unicode.Range16{Lo: 0xacb, Hi: 0xacc, Stride: 0x1},
-		unicode.Range16{Lo: 0xacd, Hi: 0xacd, Stride: 0x1},
-		unicode.Range16{Lo: 0xae2, Hi: 0xae3, Stride: 0x1},
-		unicode.Range16{Lo: 0xafa, Hi: 0xaff, Stride: 0x1},
-		unicode.Range16{Lo: 0xb01, Hi: 0xb01, Stride: 0x1},
-		unicode.Range16{Lo: 0xb02, Hi: 0xb03, Stride: 0x1},
-		unicode.Range16{Lo: 0xb3c, Hi: 0xb3c, Stride: 0x1},
-		unicode.Range16{Lo: 0xb3e, Hi: 0xb3e, Stride: 0x1},
-		unicode.Range16{Lo: 0xb3f, Hi: 0xb3f, Stride: 0x1},
-		unicode.Range16{Lo: 0xb40, Hi: 0xb40, Stride: 0x1},
-		unicode.Range16{Lo: 0xb41, Hi: 0xb44, Stride: 0x1},
-		unicode.Range16{Lo: 0xb47, Hi: 0xb48, Stride: 0x1},
-		unicode.Range16{Lo: 0xb4b, Hi: 0xb4c, Stride: 0x1},
-		unicode.Range16{Lo: 0xb4d, Hi: 0xb4d, Stride: 0x1},
-		unicode.Range16{Lo: 0xb56, Hi: 0xb56, Stride: 0x1},
-		unicode.Range16{Lo: 0xb57, Hi: 0xb57, Stride: 0x1},
-		unicode.Range16{Lo: 0xb62, Hi: 0xb63, Stride: 0x1},
-		unicode.Range16{Lo: 0xb82, Hi: 0xb82, Stride: 0x1},
-		unicode.Range16{Lo: 0xbbe, Hi: 0xbbf, Stride: 0x1},
-		unicode.Range16{Lo: 0xbc0, Hi: 0xbc0, Stride: 0x1},
-		unicode.Range16{Lo: 0xbc1, Hi: 0xbc2, Stride: 0x1},
-		unicode.Range16{Lo: 0xbc6, Hi: 0xbc8, Stride: 0x1},
-		unicode.Range16{Lo: 0xbca, Hi: 0xbcc, Stride: 0x1},
-		unicode.Range16{Lo: 0xbcd, Hi: 0xbcd, Stride: 0x1},
-		unicode.Range16{Lo: 0xbd7, Hi: 0xbd7, Stride: 0x1},
-		unicode.Range16{Lo: 0xc00, Hi: 0xc00, Stride: 0x1},
-		unicode.Range16{Lo: 0xc01, Hi: 0xc03, Stride: 0x1},
-		unicode.Range16{Lo: 0xc04, Hi: 0xc04, Stride: 0x1},
-		unicode.Range16{Lo: 0xc3e, Hi: 0xc40, Stride: 0x1},
-		unicode.Range16{Lo: 0xc41, Hi: 0xc44, Stride: 0x1},
-		unicode.Range16{Lo: 0xc46, Hi: 0xc48, Stride: 0x1},
-		unicode.Range16{Lo: 0xc4a, Hi: 0xc4d, Stride: 0x1},
-		unicode.Range16{Lo: 0xc55, Hi: 0xc56, Stride: 0x1},
-		unicode.Range16{Lo: 0xc62, Hi: 0xc63, Stride: 0x1},
-		unicode.Range16{Lo: 0xc81, Hi: 0xc81, Stride: 0x1},
-		unicode.Range16{Lo: 0xc82, Hi: 0xc83, Stride: 0x1},
-		unicode.Range16{Lo: 0xcbc, Hi: 0xcbc, Stride: 0x1},
-		unicode.Range16{Lo: 0xcbe, Hi: 0xcbe, Stride: 0x1},
-		unicode.Range16{Lo: 0xcbf, Hi: 0xcbf, Stride: 0x1},
-		unicode.Range16{Lo: 0xcc0, Hi: 0xcc4, Stride: 0x1},
-		unicode.Range16{Lo: 0xcc6, Hi: 0xcc6, Stride: 0x1},
-		unicode.Range16{Lo: 0xcc7, Hi: 0xcc8, Stride: 0x1},
-		unicode.Range16{Lo: 0xcca, Hi: 0xccb, Stride: 0x1},
-		unicode.Range16{Lo: 0xccc, Hi: 0xccd, Stride: 0x1},
-		unicode.Range16{Lo: 0xcd5, Hi: 0xcd6, Stride: 0x1},
-		unicode.Range16{Lo: 0xce2, Hi: 0xce3, Stride: 0x1},
-		unicode.Range16{Lo: 0xd00, Hi: 0xd01, Stride: 0x1},
-		unicode.Range16{Lo: 0xd02, Hi: 0xd03, Stride: 0x1},
-		unicode.Range16{Lo: 0xd3b, Hi: 0xd3c, Stride: 0x1},
-		unicode.Range16{Lo: 0xd3e, Hi: 0xd40, Stride: 0x1},
-		unicode.Range16{Lo: 0xd41, Hi: 0xd44, Stride: 0x1},
-		unicode.Range16{Lo: 0xd46, Hi: 0xd48, Stride: 0x1},
-		unicode.Range16{Lo: 0xd4a, Hi: 0xd4c, Stride: 0x1},
-		unicode.Range16{Lo: 0xd4d, Hi: 0xd4d, Stride: 0x1},
-		unicode.Range16{Lo: 0xd57, Hi: 0xd57, Stride: 0x1},
-		unicode.Range16{Lo: 0xd62, Hi: 0xd63, Stride: 0x1},
-		unicode.Range16{Lo: 0xd82, Hi: 0xd83, Stride: 0x1},
-		unicode.Range16{Lo: 0xdca, Hi: 0xdca, Stride: 0x1},
-		unicode.Range16{Lo: 0xdcf, Hi: 0xdd1, Stride: 0x1},
-		unicode.Range16{Lo: 0xdd2, Hi: 0xdd4, Stride: 0x1},
-		unicode.Range16{Lo: 0xdd6, Hi: 0xdd6, Stride: 0x1},
-		unicode.Range16{Lo: 0xdd8, Hi: 0xddf, Stride: 0x1},
-		unicode.Range16{Lo: 0xdf2, Hi: 0xdf3, Stride: 0x1},
-		unicode.Range16{Lo: 0xe31, Hi: 0xe31, Stride: 0x1},
-		unicode.Range16{Lo: 0xe34, Hi: 0xe3a, Stride: 0x1},
-		unicode.Range16{Lo: 0xe47, Hi: 0xe4e, Stride: 0x1},
-		unicode.Range16{Lo: 0xeb1, Hi: 0xeb1, Stride: 0x1},
-		unicode.Range16{Lo: 0xeb4, Hi: 0xebc, Stride: 0x1},
-		unicode.Range16{Lo: 0xec8, Hi: 0xecd, Stride: 0x1},
-		unicode.Range16{Lo: 0xf18, Hi: 0xf19, Stride: 0x1},
-		unicode.Range16{Lo: 0xf35, Hi: 0xf35, Stride: 0x1},
-		unicode.Range16{Lo: 0xf37, Hi: 0xf37, Stride: 0x1},
-		unicode.Range16{Lo: 0xf39, Hi: 0xf39, Stride: 0x1},
-		unicode.Range16{Lo: 0xf3e, Hi: 0xf3f, Stride: 0x1},
-		unicode.Range16{Lo: 0xf71, Hi: 0xf7e, Stride: 0x1},
-		unicode.Range16{Lo: 0xf7f, Hi: 0xf7f, Stride: 0x1},
-		unicode.Range16{Lo: 0xf80, Hi: 0xf84, Stride: 0x1},
-		unicode.Range16{Lo: 0xf86, Hi: 0xf87, Stride: 0x1},
-		unicode.Range16{Lo: 0xf8d, Hi: 0xf97, Stride: 0x1},
-		unicode.Range16{Lo: 0xf99, Hi: 0xfbc, Stride: 0x1},
-		unicode.Range16{Lo: 0xfc6, Hi: 0xfc6, Stride: 0x1},
-		unicode.Range16{Lo: 0x102b, Hi: 0x102c, Stride: 0x1},
-		unicode.Range16{Lo: 0x102d, Hi: 0x1030, Stride: 0x1},
-		unicode.Range16{Lo: 0x1031, Hi: 0x1031, Stride: 0x1},
-		unicode.Range16{Lo: 0x1032, Hi: 0x1037, Stride: 0x1},
-		unicode.Range16{Lo: 0x1038, Hi: 0x1038, Stride: 0x1},
-		unicode.Range16{Lo: 0x1039, Hi: 0x103a, Stride: 0x1},
-		unicode.Range16{Lo: 0x103b, Hi: 0x103c, Stride: 0x1},
-		unicode.Range16{Lo: 0x103d, Hi: 0x103e, Stride: 0x1},
-		unicode.Range16{Lo: 0x1056, Hi: 0x1057, Stride: 0x1},
-		unicode.Range16{Lo: 0x1058, Hi: 0x1059, Stride: 0x1},
-		unicode.Range16{Lo: 0x105e, Hi: 0x1060, Stride: 0x1},
-		unicode.Range16{Lo: 0x1062, Hi: 0x1064, Stride: 0x1},
-		unicode.Range16{Lo: 0x1067, Hi: 0x106d, Stride: 0x1},
-		unicode.Range16{Lo: 0x1071, Hi: 0x1074, Stride: 0x1},
-		unicode.Range16{Lo: 0x1082, Hi: 0x1082, Stride: 0x1},
-		unicode.Range16{Lo: 0x1083, Hi: 0x1084, Stride: 0x1},
-		unicode.Range16{Lo: 0x1085, Hi: 0x1086, Stride: 0x1},
-		unicode.Range16{Lo: 0x1087, Hi: 0x108c, Stride: 0x1},
-		unicode.Range16{Lo: 0x108d, Hi: 0x108d, Stride: 0x1},
-		unicode.Range16{Lo: 0x108f, Hi: 0x108f, Stride: 0x1},
-		unicode.Range16{Lo: 0x109a, Hi: 0x109c, Stride: 0x1},
-		unicode.Range16{Lo: 0x109d, Hi: 0x109d, Stride: 0x1},
-		unicode.Range16{Lo: 0x135d, Hi: 0x135f, Stride: 0x1},
-		unicode.Range16{Lo: 0x1712, Hi: 0x1714, Stride: 0x1},
-		unicode.Range16{Lo: 0x1732, Hi: 0x1734, Stride: 0x1},
-		unicode.Range16{Lo: 0x1752, Hi: 0x1753, Stride: 0x1},
-		unicode.Range16{Lo: 0x1772, Hi: 0x1773, Stride: 0x1},
-		unicode.Range16{Lo: 0x17b4, Hi: 0x17b5, Stride: 0x1},
-		unicode.Range16{Lo: 0x17b6, Hi: 0x17b6, Stride: 0x1},
-		unicode.Range16{Lo: 0x17b7, Hi: 0x17bd, Stride: 0x1},
-		unicode.Range16{Lo: 0x17be, Hi: 0x17c5, Stride: 0x1},
-		unicode.Range16{Lo: 0x17c6, Hi: 0x17c6, Stride: 0x1},
-		unicode.Range16{Lo: 0x17c7, Hi: 0x17c8, Stride: 0x1},
-		unicode.Range16{Lo: 0x17c9, Hi: 0x17d3, Stride: 0x1},
-		unicode.Range16{Lo: 0x17dd, Hi: 0x17dd, Stride: 0x1},
-		unicode.Range16{Lo: 0x180b, Hi: 0x180d, Stride: 0x1},
-		unicode.Range16{Lo: 0x1885, Hi: 0x1886, Stride: 0x1},
-		unicode.Range16{Lo: 0x18a9, Hi: 0x18a9, Stride: 0x1},
-		unicode.Range16{Lo: 0x1920, Hi: 0x1922, Stride: 0x1},
-		unicode.Range16{Lo: 0x1923, Hi: 0x1926, Stride: 0x1},
-		unicode.Range16{Lo: 0x1927, Hi: 0x1928, Stride: 0x1},
-		unicode.Range16{Lo: 0x1929, Hi: 0x192b, Stride: 0x1},
-		unicode.Range16{Lo: 0x1930, Hi: 0x1931, Stride: 0x1},
-		unicode.Range16{Lo: 0x1932, Hi: 0x1932, Stride: 0x1},
-		unicode.Range16{Lo: 0x1933, Hi: 0x1938, Stride: 0x1},
-		unicode.Range16{Lo: 0x1939, Hi: 0x193b, Stride: 0x1},
-		unicode.Range16{Lo: 0x1a17, Hi: 0x1a18, Stride: 0x1},
-		unicode.Range16{Lo: 0x1a19, Hi: 0x1a1a, Stride: 0x1},
-		unicode.Range16{Lo: 0x1a1b, Hi: 0x1a1b, Stride: 0x1},
-		unicode.Range16{Lo: 0x1a55, Hi: 0x1a55, Stride: 0x1},
-		unicode.Range16{Lo: 0x1a56, Hi: 0x1a56, Stride: 0x1},
-		unicode.Range16{Lo: 0x1a57, Hi: 0x1a57, Stride: 0x1},
-		unicode.Range16{Lo: 0x1a58, Hi: 0x1a5e, Stride: 0x1},
-		unicode.Range16{Lo: 0x1a60, Hi: 0x1a60, Stride: 0x1},
-		unicode.Range16{Lo: 0x1a61, Hi: 0x1a61, Stride: 0x1},
-		unicode.Range16{Lo: 0x1a62, Hi: 0x1a62, Stride: 0x1},
-		unicode.Range16{Lo: 0x1a63, Hi: 0x1a64, Stride: 0x1},
-		unicode.Range16{Lo: 0x1a65, Hi: 0x1a6c, Stride: 0x1},
-		unicode.Range16{Lo: 0x1a6d, Hi: 0x1a72, Stride: 0x1},
-		unicode.Range16{Lo: 0x1a73, Hi: 0x1a7c, Stride: 0x1},
-		unicode.Range16{Lo: 0x1a7f, Hi: 0x1a7f, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ab0, Hi: 0x1abd, Stride: 0x1},
-		unicode.Range16{Lo: 0x1abe, Hi: 0x1abe, Stride: 0x1},
-		unicode.Range16{Lo: 0x1b00, Hi: 0x1b03, Stride: 0x1},
-		unicode.Range16{Lo: 0x1b04, Hi: 0x1b04, Stride: 0x1},
-		unicode.Range16{Lo: 0x1b34, Hi: 0x1b34, Stride: 0x1},
-		unicode.Range16{Lo: 0x1b35, Hi: 0x1b35, Stride: 0x1},
-		unicode.Range16{Lo: 0x1b36, Hi: 0x1b3a, Stride: 0x1},
-		unicode.Range16{Lo: 0x1b3b, Hi: 0x1b3b, Stride: 0x1},
-		unicode.Range16{Lo: 0x1b3c, Hi: 0x1b3c, Stride: 0x1},
-		unicode.Range16{Lo: 0x1b3d, Hi: 0x1b41, Stride: 0x1},
-		unicode.Range16{Lo: 0x1b42, Hi: 0x1b42, Stride: 0x1},
-		unicode.Range16{Lo: 0x1b43, Hi: 0x1b44, Stride: 0x1},
-		unicode.Range16{Lo: 0x1b6b, Hi: 0x1b73, Stride: 0x1},
-		unicode.Range16{Lo: 0x1b80, Hi: 0x1b81, Stride: 0x1},
-		unicode.Range16{Lo: 0x1b82, Hi: 0x1b82, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ba1, Hi: 0x1ba1, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ba2, Hi: 0x1ba5, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ba6, Hi: 0x1ba7, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ba8, Hi: 0x1ba9, Stride: 0x1},
-		unicode.Range16{Lo: 0x1baa, Hi: 0x1baa, Stride: 0x1},
-		unicode.Range16{Lo: 0x1bab, Hi: 0x1bad, Stride: 0x1},
-		unicode.Range16{Lo: 0x1be6, Hi: 0x1be6, Stride: 0x1},
-		unicode.Range16{Lo: 0x1be7, Hi: 0x1be7, Stride: 0x1},
-		unicode.Range16{Lo: 0x1be8, Hi: 0x1be9, Stride: 0x1},
-		unicode.Range16{Lo: 0x1bea, Hi: 0x1bec, Stride: 0x1},
-		unicode.Range16{Lo: 0x1bed, Hi: 0x1bed, Stride: 0x1},
-		unicode.Range16{Lo: 0x1bee, Hi: 0x1bee, Stride: 0x1},
-		unicode.Range16{Lo: 0x1bef, Hi: 0x1bf1, Stride: 0x1},
-		unicode.Range16{Lo: 0x1bf2, Hi: 0x1bf3, Stride: 0x1},
-		unicode.Range16{Lo: 0x1c24, Hi: 0x1c2b, Stride: 0x1},
-		unicode.Range16{Lo: 0x1c2c, Hi: 0x1c33, Stride: 0x1},
-		unicode.Range16{Lo: 0x1c34, Hi: 0x1c35, Stride: 0x1},
-		unicode.Range16{Lo: 0x1c36, Hi: 0x1c37, Stride: 0x1},
-		unicode.Range16{Lo: 0x1cd0, Hi: 0x1cd2, Stride: 0x1},
-		unicode.Range16{Lo: 0x1cd4, Hi: 0x1ce0, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ce1, Hi: 0x1ce1, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ce2, Hi: 0x1ce8, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ced, Hi: 0x1ced, Stride: 0x1},
-		unicode.Range16{Lo: 0x1cf4, Hi: 0x1cf4, Stride: 0x1},
-		unicode.Range16{Lo: 0x1cf7, Hi: 0x1cf7, Stride: 0x1},
-		unicode.Range16{Lo: 0x1cf8, Hi: 0x1cf9, Stride: 0x1},
-		unicode.Range16{Lo: 0x1dc0, Hi: 0x1df9, Stride: 0x1},
-		unicode.Range16{Lo: 0x1dfb, Hi: 0x1dff, Stride: 0x1},
-		unicode.Range16{Lo: 0x200c, Hi: 0x200d, Stride: 0x1},
-		unicode.Range16{Lo: 0x20d0, Hi: 0x20dc, Stride: 0x1},
-		unicode.Range16{Lo: 0x20dd, Hi: 0x20e0, Stride: 0x1},
-		unicode.Range16{Lo: 0x20e1, Hi: 0x20e1, Stride: 0x1},
-		unicode.Range16{Lo: 0x20e2, Hi: 0x20e4, Stride: 0x1},
-		unicode.Range16{Lo: 0x20e5, Hi: 0x20f0, Stride: 0x1},
-		unicode.Range16{Lo: 0x2cef, Hi: 0x2cf1, Stride: 0x1},
-		unicode.Range16{Lo: 0x2d7f, Hi: 0x2d7f, Stride: 0x1},
-		unicode.Range16{Lo: 0x2de0, Hi: 0x2dff, Stride: 0x1},
-		unicode.Range16{Lo: 0x302a, Hi: 0x302d, Stride: 0x1},
-		unicode.Range16{Lo: 0x302e, Hi: 0x302f, Stride: 0x1},
-		unicode.Range16{Lo: 0x3099, Hi: 0x309a, Stride: 0x1},
-		unicode.Range16{Lo: 0xa66f, Hi: 0xa66f, Stride: 0x1},
-		unicode.Range16{Lo: 0xa670, Hi: 0xa672, Stride: 0x1},
-		unicode.Range16{Lo: 0xa674, Hi: 0xa67d, Stride: 0x1},
-		unicode.Range16{Lo: 0xa69e, Hi: 0xa69f, Stride: 0x1},
-		unicode.Range16{Lo: 0xa6f0, Hi: 0xa6f1, Stride: 0x1},
-		unicode.Range16{Lo: 0xa802, Hi: 0xa802, Stride: 0x1},
-		unicode.Range16{Lo: 0xa806, Hi: 0xa806, Stride: 0x1},
-		unicode.Range16{Lo: 0xa80b, Hi: 0xa80b, Stride: 0x1},
-		unicode.Range16{Lo: 0xa823, Hi: 0xa824, Stride: 0x1},
-		unicode.Range16{Lo: 0xa825, Hi: 0xa826, Stride: 0x1},
-		unicode.Range16{Lo: 0xa827, Hi: 0xa827, Stride: 0x1},
-		unicode.Range16{Lo: 0xa880, Hi: 0xa881, Stride: 0x1},
-		unicode.Range16{Lo: 0xa8b4, Hi: 0xa8c3, Stride: 0x1},
-		unicode.Range16{Lo: 0xa8c4, Hi: 0xa8c5, Stride: 0x1},
-		unicode.Range16{Lo: 0xa8e0, Hi: 0xa8f1, Stride: 0x1},
-		unicode.Range16{Lo: 0xa8ff, Hi: 0xa8ff, Stride: 0x1},
-		unicode.Range16{Lo: 0xa926, Hi: 0xa92d, Stride: 0x1},
-		unicode.Range16{Lo: 0xa947, Hi: 0xa951, Stride: 0x1},
-		unicode.Range16{Lo: 0xa952, Hi: 0xa953, Stride: 0x1},
-		unicode.Range16{Lo: 0xa980, Hi: 0xa982, Stride: 0x1},
-		unicode.Range16{Lo: 0xa983, Hi: 0xa983, Stride: 0x1},
-		unicode.Range16{Lo: 0xa9b3, Hi: 0xa9b3, Stride: 0x1},
-		unicode.Range16{Lo: 0xa9b4, Hi: 0xa9b5, Stride: 0x1},
-		unicode.Range16{Lo: 0xa9b6, Hi: 0xa9b9, Stride: 0x1},
-		unicode.Range16{Lo: 0xa9ba, Hi: 0xa9bb, Stride: 0x1},
-		unicode.Range16{Lo: 0xa9bc, Hi: 0xa9bd, Stride: 0x1},
-		unicode.Range16{Lo: 0xa9be, Hi: 0xa9c0, Stride: 0x1},
-		unicode.Range16{Lo: 0xa9e5, Hi: 0xa9e5, Stride: 0x1},
-		unicode.Range16{Lo: 0xaa29, Hi: 0xaa2e, Stride: 0x1},
-		unicode.Range16{Lo: 0xaa2f, Hi: 0xaa30, Stride: 0x1},
-		unicode.Range16{Lo: 0xaa31, Hi: 0xaa32, Stride: 0x1},
-		unicode.Range16{Lo: 0xaa33, Hi: 0xaa34, Stride: 0x1},
-		unicode.Range16{Lo: 0xaa35, Hi: 0xaa36, Stride: 0x1},
-		unicode.Range16{Lo: 0xaa43, Hi: 0xaa43, Stride: 0x1},
-		unicode.Range16{Lo: 0xaa4c, Hi: 0xaa4c, Stride: 0x1},
-		unicode.Range16{Lo: 0xaa4d, Hi: 0xaa4d, Stride: 0x1},
-		unicode.Range16{Lo: 0xaa7b, Hi: 0xaa7b, Stride: 0x1},
-		unicode.Range16{Lo: 0xaa7c, Hi: 0xaa7c, Stride: 0x1},
-		unicode.Range16{Lo: 0xaa7d, Hi: 0xaa7d, Stride: 0x1},
-		unicode.Range16{Lo: 0xaab0, Hi: 0xaab0, Stride: 0x1},
-		unicode.Range16{Lo: 0xaab2, Hi: 0xaab4, Stride: 0x1},
-		unicode.Range16{Lo: 0xaab7, Hi: 0xaab8, Stride: 0x1},
-		unicode.Range16{Lo: 0xaabe, Hi: 0xaabf, Stride: 0x1},
-		unicode.Range16{Lo: 0xaac1, Hi: 0xaac1, Stride: 0x1},
-		unicode.Range16{Lo: 0xaaeb, Hi: 0xaaeb, Stride: 0x1},
-		unicode.Range16{Lo: 0xaaec, Hi: 0xaaed, Stride: 0x1},
-		unicode.Range16{Lo: 0xaaee, Hi: 0xaaef, Stride: 0x1},
-		unicode.Range16{Lo: 0xaaf5, Hi: 0xaaf5, Stride: 0x1},
-		unicode.Range16{Lo: 0xaaf6, Hi: 0xaaf6, Stride: 0x1},
-		unicode.Range16{Lo: 0xabe3, Hi: 0xabe4, Stride: 0x1},
-		unicode.Range16{Lo: 0xabe5, Hi: 0xabe5, Stride: 0x1},
-		unicode.Range16{Lo: 0xabe6, Hi: 0xabe7, Stride: 0x1},
-		unicode.Range16{Lo: 0xabe8, Hi: 0xabe8, Stride: 0x1},
-		unicode.Range16{Lo: 0xabe9, Hi: 0xabea, Stride: 0x1},
-		unicode.Range16{Lo: 0xabec, Hi: 0xabec, Stride: 0x1},
-		unicode.Range16{Lo: 0xabed, Hi: 0xabed, Stride: 0x1},
-		unicode.Range16{Lo: 0xfb1e, Hi: 0xfb1e, Stride: 0x1},
-		unicode.Range16{Lo: 0xfe00, Hi: 0xfe0f, Stride: 0x1},
-		unicode.Range16{Lo: 0xfe20, Hi: 0xfe2f, Stride: 0x1},
-		unicode.Range16{Lo: 0xff9e, Hi: 0xff9f, Stride: 0x1},
-	},
-	R32: []unicode.Range32{
-		unicode.Range32{Lo: 0x101fd, Hi: 0x101fd, Stride: 0x1},
-		unicode.Range32{Lo: 0x102e0, Hi: 0x102e0, Stride: 0x1},
-		unicode.Range32{Lo: 0x10376, Hi: 0x1037a, Stride: 0x1},
-		unicode.Range32{Lo: 0x10a01, Hi: 0x10a03, Stride: 0x1},
-		unicode.Range32{Lo: 0x10a05, Hi: 0x10a06, Stride: 0x1},
-		unicode.Range32{Lo: 0x10a0c, Hi: 0x10a0f, Stride: 0x1},
-		unicode.Range32{Lo: 0x10a38, Hi: 0x10a3a, Stride: 0x1},
-		unicode.Range32{Lo: 0x10a3f, Hi: 0x10a3f, Stride: 0x1},
-		unicode.Range32{Lo: 0x10ae5, Hi: 0x10ae6, Stride: 0x1},
-		unicode.Range32{Lo: 0x10d24, Hi: 0x10d27, Stride: 0x1},
-		unicode.Range32{Lo: 0x10f46, Hi: 0x10f50, Stride: 0x1},
-		unicode.Range32{Lo: 0x11000, Hi: 0x11000, Stride: 0x1},
-		unicode.Range32{Lo: 0x11001, Hi: 0x11001, Stride: 0x1},
-		unicode.Range32{Lo: 0x11002, Hi: 0x11002, Stride: 0x1},
-		unicode.Range32{Lo: 0x11038, Hi: 0x11046, Stride: 0x1},
-		unicode.Range32{Lo: 0x1107f, Hi: 0x11081, Stride: 0x1},
-		unicode.Range32{Lo: 0x11082, Hi: 0x11082, Stride: 0x1},
-		unicode.Range32{Lo: 0x110b0, Hi: 0x110b2, Stride: 0x1},
-		unicode.Range32{Lo: 0x110b3, Hi: 0x110b6, Stride: 0x1},
-		unicode.Range32{Lo: 0x110b7, Hi: 0x110b8, Stride: 0x1},
-		unicode.Range32{Lo: 0x110b9, Hi: 0x110ba, Stride: 0x1},
-		unicode.Range32{Lo: 0x11100, Hi: 0x11102, Stride: 0x1},
-		unicode.Range32{Lo: 0x11127, Hi: 0x1112b, Stride: 0x1},
-		unicode.Range32{Lo: 0x1112c, Hi: 0x1112c, Stride: 0x1},
-		unicode.Range32{Lo: 0x1112d, Hi: 0x11134, Stride: 0x1},
-		unicode.Range32{Lo: 0x11145, Hi: 0x11146, Stride: 0x1},
-		unicode.Range32{Lo: 0x11173, Hi: 0x11173, Stride: 0x1},
-		unicode.Range32{Lo: 0x11180, Hi: 0x11181, Stride: 0x1},
-		unicode.Range32{Lo: 0x11182, Hi: 0x11182, Stride: 0x1},
-		unicode.Range32{Lo: 0x111b3, Hi: 0x111b5, Stride: 0x1},
-		unicode.Range32{Lo: 0x111b6, Hi: 0x111be, Stride: 0x1},
-		unicode.Range32{Lo: 0x111bf, Hi: 0x111c0, Stride: 0x1},
-		unicode.Range32{Lo: 0x111c9, Hi: 0x111cc, Stride: 0x1},
-		unicode.Range32{Lo: 0x1122c, Hi: 0x1122e, Stride: 0x1},
-		unicode.Range32{Lo: 0x1122f, Hi: 0x11231, Stride: 0x1},
-		unicode.Range32{Lo: 0x11232, Hi: 0x11233, Stride: 0x1},
-		unicode.Range32{Lo: 0x11234, Hi: 0x11234, Stride: 0x1},
-		unicode.Range32{Lo: 0x11235, Hi: 0x11235, Stride: 0x1},
-		unicode.Range32{Lo: 0x11236, Hi: 0x11237, Stride: 0x1},
-		unicode.Range32{Lo: 0x1123e, Hi: 0x1123e, Stride: 0x1},
-		unicode.Range32{Lo: 0x112df, Hi: 0x112df, Stride: 0x1},
-		unicode.Range32{Lo: 0x112e0, Hi: 0x112e2, Stride: 0x1},
-		unicode.Range32{Lo: 0x112e3, Hi: 0x112ea, Stride: 0x1},
-		unicode.Range32{Lo: 0x11300, Hi: 0x11301, Stride: 0x1},
-		unicode.Range32{Lo: 0x11302, Hi: 0x11303, Stride: 0x1},
-		unicode.Range32{Lo: 0x1133b, Hi: 0x1133c, Stride: 0x1},
-		unicode.Range32{Lo: 0x1133e, Hi: 0x1133f, Stride: 0x1},
-		unicode.Range32{Lo: 0x11340, Hi: 0x11340, Stride: 0x1},
-		unicode.Range32{Lo: 0x11341, Hi: 0x11344, Stride: 0x1},
-		unicode.Range32{Lo: 0x11347, Hi: 0x11348, Stride: 0x1},
-		unicode.Range32{Lo: 0x1134b, Hi: 0x1134d, Stride: 0x1},
-		unicode.Range32{Lo: 0x11357, Hi: 0x11357, Stride: 0x1},
-		unicode.Range32{Lo: 0x11362, Hi: 0x11363, Stride: 0x1},
-		unicode.Range32{Lo: 0x11366, Hi: 0x1136c, Stride: 0x1},
-		unicode.Range32{Lo: 0x11370, Hi: 0x11374, Stride: 0x1},
-		unicode.Range32{Lo: 0x11435, Hi: 0x11437, Stride: 0x1},
-		unicode.Range32{Lo: 0x11438, Hi: 0x1143f, Stride: 0x1},
-		unicode.Range32{Lo: 0x11440, Hi: 0x11441, Stride: 0x1},
-		unicode.Range32{Lo: 0x11442, Hi: 0x11444, Stride: 0x1},
-		unicode.Range32{Lo: 0x11445, Hi: 0x11445, Stride: 0x1},
-		unicode.Range32{Lo: 0x11446, Hi: 0x11446, Stride: 0x1},
-		unicode.Range32{Lo: 0x1145e, Hi: 0x1145e, Stride: 0x1},
-		unicode.Range32{Lo: 0x114b0, Hi: 0x114b2, Stride: 0x1},
-		unicode.Range32{Lo: 0x114b3, Hi: 0x114b8, Stride: 0x1},
-		unicode.Range32{Lo: 0x114b9, Hi: 0x114b9, Stride: 0x1},
-		unicode.Range32{Lo: 0x114ba, Hi: 0x114ba, Stride: 0x1},
-		unicode.Range32{Lo: 0x114bb, Hi: 0x114be, Stride: 0x1},
-		unicode.Range32{Lo: 0x114bf, Hi: 0x114c0, Stride: 0x1},
-		unicode.Range32{Lo: 0x114c1, Hi: 0x114c1, Stride: 0x1},
-		unicode.Range32{Lo: 0x114c2, Hi: 0x114c3, Stride: 0x1},
-		unicode.Range32{Lo: 0x115af, Hi: 0x115b1, Stride: 0x1},
-		unicode.Range32{Lo: 0x115b2, Hi: 0x115b5, Stride: 0x1},
-		unicode.Range32{Lo: 0x115b8, Hi: 0x115bb, Stride: 0x1},
-		unicode.Range32{Lo: 0x115bc, Hi: 0x115bd, Stride: 0x1},
-		unicode.Range32{Lo: 0x115be, Hi: 0x115be, Stride: 0x1},
-		unicode.Range32{Lo: 0x115bf, Hi: 0x115c0, Stride: 0x1},
-		unicode.Range32{Lo: 0x115dc, Hi: 0x115dd, Stride: 0x1},
-		unicode.Range32{Lo: 0x11630, Hi: 0x11632, Stride: 0x1},
-		unicode.Range32{Lo: 0x11633, Hi: 0x1163a, Stride: 0x1},
-		unicode.Range32{Lo: 0x1163b, Hi: 0x1163c, Stride: 0x1},
-		unicode.Range32{Lo: 0x1163d, Hi: 0x1163d, Stride: 0x1},
-		unicode.Range32{Lo: 0x1163e, Hi: 0x1163e, Stride: 0x1},
-		unicode.Range32{Lo: 0x1163f, Hi: 0x11640, Stride: 0x1},
-		unicode.Range32{Lo: 0x116ab, Hi: 0x116ab, Stride: 0x1},
-		unicode.Range32{Lo: 0x116ac, Hi: 0x116ac, Stride: 0x1},
-		unicode.Range32{Lo: 0x116ad, Hi: 0x116ad, Stride: 0x1},
-		unicode.Range32{Lo: 0x116ae, Hi: 0x116af, Stride: 0x1},
-		unicode.Range32{Lo: 0x116b0, Hi: 0x116b5, Stride: 0x1},
-		unicode.Range32{Lo: 0x116b6, Hi: 0x116b6, Stride: 0x1},
-		unicode.Range32{Lo: 0x116b7, Hi: 0x116b7, Stride: 0x1},
-		unicode.Range32{Lo: 0x1171d, Hi: 0x1171f, Stride: 0x1},
-		unicode.Range32{Lo: 0x11720, Hi: 0x11721, Stride: 0x1},
-		unicode.Range32{Lo: 0x11722, Hi: 0x11725, Stride: 0x1},
-		unicode.Range32{Lo: 0x11726, Hi: 0x11726, Stride: 0x1},
-		unicode.Range32{Lo: 0x11727, Hi: 0x1172b, Stride: 0x1},
-		unicode.Range32{Lo: 0x1182c, Hi: 0x1182e, Stride: 0x1},
-		unicode.Range32{Lo: 0x1182f, Hi: 0x11837, Stride: 0x1},
-		unicode.Range32{Lo: 0x11838, Hi: 0x11838, Stride: 0x1},
-		unicode.Range32{Lo: 0x11839, Hi: 0x1183a, Stride: 0x1},
-		unicode.Range32{Lo: 0x119d1, Hi: 0x119d3, Stride: 0x1},
-		unicode.Range32{Lo: 0x119d4, Hi: 0x119d7, Stride: 0x1},
-		unicode.Range32{Lo: 0x119da, Hi: 0x119db, Stride: 0x1},
-		unicode.Range32{Lo: 0x119dc, Hi: 0x119df, Stride: 0x1},
-		unicode.Range32{Lo: 0x119e0, Hi: 0x119e0, Stride: 0x1},
-		unicode.Range32{Lo: 0x119e4, Hi: 0x119e4, Stride: 0x1},
-		unicode.Range32{Lo: 0x11a01, Hi: 0x11a0a, Stride: 0x1},
-		unicode.Range32{Lo: 0x11a33, Hi: 0x11a38, Stride: 0x1},
-		unicode.Range32{Lo: 0x11a39, Hi: 0x11a39, Stride: 0x1},
-		unicode.Range32{Lo: 0x11a3b, Hi: 0x11a3e, Stride: 0x1},
-		unicode.Range32{Lo: 0x11a47, Hi: 0x11a47, Stride: 0x1},
-		unicode.Range32{Lo: 0x11a51, Hi: 0x11a56, Stride: 0x1},
-		unicode.Range32{Lo: 0x11a57, Hi: 0x11a58, Stride: 0x1},
-		unicode.Range32{Lo: 0x11a59, Hi: 0x11a5b, Stride: 0x1},
-		unicode.Range32{Lo: 0x11a8a, Hi: 0x11a96, Stride: 0x1},
-		unicode.Range32{Lo: 0x11a97, Hi: 0x11a97, Stride: 0x1},
-		unicode.Range32{Lo: 0x11a98, Hi: 0x11a99, Stride: 0x1},
-		unicode.Range32{Lo: 0x11c2f, Hi: 0x11c2f, Stride: 0x1},
-		unicode.Range32{Lo: 0x11c30, Hi: 0x11c36, Stride: 0x1},
-		unicode.Range32{Lo: 0x11c38, Hi: 0x11c3d, Stride: 0x1},
-		unicode.Range32{Lo: 0x11c3e, Hi: 0x11c3e, Stride: 0x1},
-		unicode.Range32{Lo: 0x11c3f, Hi: 0x11c3f, Stride: 0x1},
-		unicode.Range32{Lo: 0x11c92, Hi: 0x11ca7, Stride: 0x1},
-		unicode.Range32{Lo: 0x11ca9, Hi: 0x11ca9, Stride: 0x1},
-		unicode.Range32{Lo: 0x11caa, Hi: 0x11cb0, Stride: 0x1},
-		unicode.Range32{Lo: 0x11cb1, Hi: 0x11cb1, Stride: 0x1},
-		unicode.Range32{Lo: 0x11cb2, Hi: 0x11cb3, Stride: 0x1},
-		unicode.Range32{Lo: 0x11cb4, Hi: 0x11cb4, Stride: 0x1},
-		unicode.Range32{Lo: 0x11cb5, Hi: 0x11cb6, Stride: 0x1},
-		unicode.Range32{Lo: 0x11d31, Hi: 0x11d36, Stride: 0x1},
-		unicode.Range32{Lo: 0x11d3a, Hi: 0x11d3a, Stride: 0x1},
-		unicode.Range32{Lo: 0x11d3c, Hi: 0x11d3d, Stride: 0x1},
-		unicode.Range32{Lo: 0x11d3f, Hi: 0x11d45, Stride: 0x1},
-		unicode.Range32{Lo: 0x11d47, Hi: 0x11d47, Stride: 0x1},
-		unicode.Range32{Lo: 0x11d8a, Hi: 0x11d8e, Stride: 0x1},
-		unicode.Range32{Lo: 0x11d90, Hi: 0x11d91, Stride: 0x1},
-		unicode.Range32{Lo: 0x11d93, Hi: 0x11d94, Stride: 0x1},
-		unicode.Range32{Lo: 0x11d95, Hi: 0x11d95, Stride: 0x1},
-		unicode.Range32{Lo: 0x11d96, Hi: 0x11d96, Stride: 0x1},
-		unicode.Range32{Lo: 0x11d97, Hi: 0x11d97, Stride: 0x1},
-		unicode.Range32{Lo: 0x11ef3, Hi: 0x11ef4, Stride: 0x1},
-		unicode.Range32{Lo: 0x11ef5, Hi: 0x11ef6, Stride: 0x1},
-		unicode.Range32{Lo: 0x16af0, Hi: 0x16af4, Stride: 0x1},
-		unicode.Range32{Lo: 0x16b30, Hi: 0x16b36, Stride: 0x1},
-		unicode.Range32{Lo: 0x16f4f, Hi: 0x16f4f, Stride: 0x1},
-		unicode.Range32{Lo: 0x16f51, Hi: 0x16f87, Stride: 0x1},
-		unicode.Range32{Lo: 0x16f8f, Hi: 0x16f92, Stride: 0x1},
-		unicode.Range32{Lo: 0x1bc9d, Hi: 0x1bc9e, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d165, Hi: 0x1d166, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d167, Hi: 0x1d169, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d16d, Hi: 0x1d172, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d17b, Hi: 0x1d182, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d185, Hi: 0x1d18b, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d1aa, Hi: 0x1d1ad, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d242, Hi: 0x1d244, Stride: 0x1},
-		unicode.Range32{Lo: 0x1da00, Hi: 0x1da36, Stride: 0x1},
-		unicode.Range32{Lo: 0x1da3b, Hi: 0x1da6c, Stride: 0x1},
-		unicode.Range32{Lo: 0x1da75, Hi: 0x1da75, Stride: 0x1},
-		unicode.Range32{Lo: 0x1da84, Hi: 0x1da84, Stride: 0x1},
-		unicode.Range32{Lo: 0x1da9b, Hi: 0x1da9f, Stride: 0x1},
-		unicode.Range32{Lo: 0x1daa1, Hi: 0x1daaf, Stride: 0x1},
-		unicode.Range32{Lo: 0x1e000, Hi: 0x1e006, Stride: 0x1},
-		unicode.Range32{Lo: 0x1e008, Hi: 0x1e018, Stride: 0x1},
-		unicode.Range32{Lo: 0x1e01b, Hi: 0x1e021, Stride: 0x1},
-		unicode.Range32{Lo: 0x1e023, Hi: 0x1e024, Stride: 0x1},
-		unicode.Range32{Lo: 0x1e026, Hi: 0x1e02a, Stride: 0x1},
-		unicode.Range32{Lo: 0x1e130, Hi: 0x1e136, Stride: 0x1},
-		unicode.Range32{Lo: 0x1e2ec, Hi: 0x1e2ef, Stride: 0x1},
-		unicode.Range32{Lo: 0x1e8d0, Hi: 0x1e8d6, Stride: 0x1},
-		unicode.Range32{Lo: 0x1e944, Hi: 0x1e94a, Stride: 0x1},
-		unicode.Range32{Lo: 0xe0020, Hi: 0xe007f, Stride: 0x1},
-		unicode.Range32{Lo: 0xe0100, Hi: 0xe01ef, Stride: 0x1},
-	},
-	LatinOffset: 0,
-}
-
-var _SentenceFormat = &unicode.RangeTable{
-	R16: []unicode.Range16{
-		unicode.Range16{Lo: 0xad, Hi: 0xad, Stride: 0x1},
-		unicode.Range16{Lo: 0x600, Hi: 0x605, Stride: 0x1},
-		unicode.Range16{Lo: 0x61c, Hi: 0x61c, Stride: 0x1},
-		unicode.Range16{Lo: 0x6dd, Hi: 0x6dd, Stride: 0x1},
-		unicode.Range16{Lo: 0x70f, Hi: 0x70f, Stride: 0x1},
-		unicode.Range16{Lo: 0x8e2, Hi: 0x8e2, Stride: 0x1},
-		unicode.Range16{Lo: 0x180e, Hi: 0x180e, Stride: 0x1},
-		unicode.Range16{Lo: 0x200b, Hi: 0x200b, Stride: 0x1},
-		unicode.Range16{Lo: 0x200e, Hi: 0x200f, Stride: 0x1},
-		unicode.Range16{Lo: 0x202a, Hi: 0x202e, Stride: 0x1},
-		unicode.Range16{Lo: 0x2060, Hi: 0x2064, Stride: 0x1},
-		unicode.Range16{Lo: 0x2066, Hi: 0x206f, Stride: 0x1},
-		unicode.Range16{Lo: 0xfeff, Hi: 0xfeff, Stride: 0x1},
-		unicode.Range16{Lo: 0xfff9, Hi: 0xfffb, Stride: 0x1},
-	},
-	R32: []unicode.Range32{
-		unicode.Range32{Lo: 0x110bd, Hi: 0x110bd, Stride: 0x1},
-		unicode.Range32{Lo: 0x110cd, Hi: 0x110cd, Stride: 0x1},
-		unicode.Range32{Lo: 0x13430, Hi: 0x13438, Stride: 0x1},
-		unicode.Range32{Lo: 0x1bca0, Hi: 0x1bca3, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d173, Hi: 0x1d17a, Stride: 0x1},
-		unicode.Range32{Lo: 0xe0001, Hi: 0xe0001, Stride: 0x1},
-	},
-	LatinOffset: 1,
-}
-
-var _SentenceLF = &unicode.RangeTable{
-	R16: []unicode.Range16{
-		unicode.Range16{Lo: 0xa, Hi: 0xa, Stride: 0x1},
-	},
-	LatinOffset: 1,
-}
-
-var _SentenceLower = &unicode.RangeTable{
-	R16: []unicode.Range16{
-		unicode.Range16{Lo: 0x61, Hi: 0x7a, Stride: 0x1},
-		unicode.Range16{Lo: 0xaa, Hi: 0xaa, Stride: 0x1},
-		unicode.Range16{Lo: 0xb5, Hi: 0xb5, Stride: 0x1},
-		unicode.Range16{Lo: 0xba, Hi: 0xba, Stride: 0x1},
-		unicode.Range16{Lo: 0xdf, Hi: 0xf6, Stride: 0x1},
-		unicode.Range16{Lo: 0xf8, Hi: 0xff, Stride: 0x1},
-		unicode.Range16{Lo: 0x101, Hi: 0x101, Stride: 0x1},
-		unicode.Range16{Lo: 0x103, Hi: 0x103, Stride: 0x1},
-		unicode.Range16{Lo: 0x105, Hi: 0x105, Stride: 0x1},
-		unicode.Range16{Lo: 0x107, Hi: 0x107, Stride: 0x1},
-		unicode.Range16{Lo: 0x109, Hi: 0x109, Stride: 0x1},
-		unicode.Range16{Lo: 0x10b, Hi: 0x10b, Stride: 0x1},
-		unicode.Range16{Lo: 0x10d, Hi: 0x10d, Stride: 0x1},
-		unicode.Range16{Lo: 0x10f, Hi: 0x10f, Stride: 0x1},
-		unicode.Range16{Lo: 0x111, Hi: 0x111, Stride: 0x1},
-		unicode.Range16{Lo: 0x113, Hi: 0x113, Stride: 0x1},
-		unicode.Range16{Lo: 0x115, Hi: 0x115, Stride: 0x1},
-		unicode.Range16{Lo: 0x117, Hi: 0x117, Stride: 0x1},
-		unicode.Range16{Lo: 0x119, Hi: 0x119, Stride: 0x1},
-		unicode.Range16{Lo: 0x11b, Hi: 0x11b, Stride: 0x1},
-		unicode.Range16{Lo: 0x11d, Hi: 0x11d, Stride: 0x1},
-		unicode.Range16{Lo: 0x11f, Hi: 0x11f, Stride: 0x1},
-		unicode.Range16{Lo: 0x121, Hi: 0x121, Stride: 0x1},
-		unicode.Range16{Lo: 0x123, Hi: 0x123, Stride: 0x1},
-		unicode.Range16{Lo: 0x125, Hi: 0x125, Stride: 0x1},
-		unicode.Range16{Lo: 0x127, Hi: 0x127, Stride: 0x1},
-		unicode.Range16{Lo: 0x129, Hi: 0x129, Stride: 0x1},
-		unicode.Range16{Lo: 0x12b, Hi: 0x12b, Stride: 0x1},
-		unicode.Range16{Lo: 0x12d, Hi: 0x12d, Stride: 0x1},
-		unicode.Range16{Lo: 0x12f, Hi: 0x12f, Stride: 0x1},
-		unicode.Range16{Lo: 0x131, Hi: 0x131, Stride: 0x1},
-		unicode.Range16{Lo: 0x133, Hi: 0x133, Stride: 0x1},
-		unicode.Range16{Lo: 0x135, Hi: 0x135, Stride: 0x1},
-		unicode.Range16{Lo: 0x137, Hi: 0x138, Stride: 0x1},
-		unicode.Range16{Lo: 0x13a, Hi: 0x13a, Stride: 0x1},
-		unicode.Range16{Lo: 0x13c, Hi: 0x13c, Stride: 0x1},
-		unicode.Range16{Lo: 0x13e, Hi: 0x13e, Stride: 0x1},
-		unicode.Range16{Lo: 0x140, Hi: 0x140, Stride: 0x1},
-		unicode.Range16{Lo: 0x142, Hi: 0x142, Stride: 0x1},
-		unicode.Range16{Lo: 0x144, Hi: 0x144, Stride: 0x1},
-		unicode.Range16{Lo: 0x146, Hi: 0x146, Stride: 0x1},
-		unicode.Range16{Lo: 0x148, Hi: 0x149, Stride: 0x1},
-		unicode.Range16{Lo: 0x14b, Hi: 0x14b, Stride: 0x1},
-		unicode.Range16{Lo: 0x14d, Hi: 0x14d, Stride: 0x1},
-		unicode.Range16{Lo: 0x14f, Hi: 0x14f, Stride: 0x1},
-		unicode.Range16{Lo: 0x151, Hi: 0x151, Stride: 0x1},
-		unicode.Range16{Lo: 0x153, Hi: 0x153, Stride: 0x1},
-		unicode.Range16{Lo: 0x155, Hi: 0x155, Stride: 0x1},
-		unicode.Range16{Lo: 0x157, Hi: 0x157, Stride: 0x1},
-		unicode.Range16{Lo: 0x159, Hi: 0x159, Stride: 0x1},
-		unicode.Range16{Lo: 0x15b, Hi: 0x15b, Stride: 0x1},
-		unicode.Range16{Lo: 0x15d, Hi: 0x15d, Stride: 0x1},
-		unicode.Range16{Lo: 0x15f, Hi: 0x15f, Stride: 0x1},
-		unicode.Range16{Lo: 0x161, Hi: 0x161, Stride: 0x1},
-		unicode.Range16{Lo: 0x163, Hi: 0x163, Stride: 0x1},
-		unicode.Range16{Lo: 0x165, Hi: 0x165, Stride: 0x1},
-		unicode.Range16{Lo: 0x167, Hi: 0x167, Stride: 0x1},
-		unicode.Range16{Lo: 0x169, Hi: 0x169, Stride: 0x1},
-		unicode.Range16{Lo: 0x16b, Hi: 0x16b, Stride: 0x1},
-		unicode.Range16{Lo: 0x16d, Hi: 0x16d, Stride: 0x1},
-		unicode.Range16{Lo: 0x16f, Hi: 0x16f, Stride: 0x1},
-		unicode.Range16{Lo: 0x171, Hi: 0x171, Stride: 0x1},
-		unicode.Range16{Lo: 0x173, Hi: 0x173, Stride: 0x1},
-		unicode.Range16{Lo: 0x175, Hi: 0x175, Stride: 0x1},
-		unicode.Range16{Lo: 0x177, Hi: 0x177, Stride: 0x1},
-		unicode.Range16{Lo: 0x17a, Hi: 0x17a, Stride: 0x1},
-		unicode.Range16{Lo: 0x17c, Hi: 0x17c, Stride: 0x1},
-		unicode.Range16{Lo: 0x17e, Hi: 0x180, Stride: 0x1},
-		unicode.Range16{Lo: 0x183, Hi: 0x183, Stride: 0x1},
-		unicode.Range16{Lo: 0x185, Hi: 0x185, Stride: 0x1},
-		unicode.Range16{Lo: 0x188, Hi: 0x188, Stride: 0x1},
-		unicode.Range16{Lo: 0x18c, Hi: 0x18d, Stride: 0x1},
-		unicode.Range16{Lo: 0x192, Hi: 0x192, Stride: 0x1},
-		unicode.Range16{Lo: 0x195, Hi: 0x195, Stride: 0x1},
-		unicode.Range16{Lo: 0x199, Hi: 0x19b, Stride: 0x1},
-		unicode.Range16{Lo: 0x19e, Hi: 0x19e, Stride: 0x1},
-		unicode.Range16{Lo: 0x1a1, Hi: 0x1a1, Stride: 0x1},
-		unicode.Range16{Lo: 0x1a3, Hi: 0x1a3, Stride: 0x1},
-		unicode.Range16{Lo: 0x1a5, Hi: 0x1a5, Stride: 0x1},
-		unicode.Range16{Lo: 0x1a8, Hi: 0x1a8, Stride: 0x1},
-		unicode.Range16{Lo: 0x1aa, Hi: 0x1ab, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ad, Hi: 0x1ad, Stride: 0x1},
-		unicode.Range16{Lo: 0x1b0, Hi: 0x1b0, Stride: 0x1},
-		unicode.Range16{Lo: 0x1b4, Hi: 0x1b4, Stride: 0x1},
-		unicode.Range16{Lo: 0x1b6, Hi: 0x1b6, Stride: 0x1},
-		unicode.Range16{Lo: 0x1b9, Hi: 0x1ba, Stride: 0x1},
-		unicode.Range16{Lo: 0x1bd, Hi: 0x1bf, Stride: 0x1},
-		unicode.Range16{Lo: 0x1c6, Hi: 0x1c6, Stride: 0x1},
-		unicode.Range16{Lo: 0x1c9, Hi: 0x1c9, Stride: 0x1},
-		unicode.Range16{Lo: 0x1cc, Hi: 0x1cc, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ce, Hi: 0x1ce, Stride: 0x1},
-		unicode.Range16{Lo: 0x1d0, Hi: 0x1d0, Stride: 0x1},
-		unicode.Range16{Lo: 0x1d2, Hi: 0x1d2, Stride: 0x1},
-		unicode.Range16{Lo: 0x1d4, Hi: 0x1d4, Stride: 0x1},
-		unicode.Range16{Lo: 0x1d6, Hi: 0x1d6, Stride: 0x1},
-		unicode.Range16{Lo: 0x1d8, Hi: 0x1d8, Stride: 0x1},
-		unicode.Range16{Lo: 0x1da, Hi: 0x1da, Stride: 0x1},
-		unicode.Range16{Lo: 0x1dc, Hi: 0x1dd, Stride: 0x1},
-		unicode.Range16{Lo: 0x1df, Hi: 0x1df, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e1, Hi: 0x1e1, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e3, Hi: 0x1e3, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e5, Hi: 0x1e5, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e7, Hi: 0x1e7, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e9, Hi: 0x1e9, Stride: 0x1},
-		unicode.Range16{Lo: 0x1eb, Hi: 0x1eb, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ed, Hi: 0x1ed, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ef, Hi: 0x1f0, Stride: 0x1},
-		unicode.Range16{Lo: 0x1f3, Hi: 0x1f3, Stride: 0x1},
-		unicode.Range16{Lo: 0x1f5, Hi: 0x1f5, Stride: 0x1},
-		unicode.Range16{Lo: 0x1f9, Hi: 0x1f9, Stride: 0x1},
-		unicode.Range16{Lo: 0x1fb, Hi: 0x1fb, Stride: 0x1},
-		unicode.Range16{Lo: 0x1fd, Hi: 0x1fd, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ff, Hi: 0x1ff, Stride: 0x1},
-		unicode.Range16{Lo: 0x201, Hi: 0x201, Stride: 0x1},
-		unicode.Range16{Lo: 0x203, Hi: 0x203, Stride: 0x1},
-		unicode.Range16{Lo: 0x205, Hi: 0x205, Stride: 0x1},
-		unicode.Range16{Lo: 0x207, Hi: 0x207, Stride: 0x1},
-		unicode.Range16{Lo: 0x209, Hi: 0x209, Stride: 0x1},
-		unicode.Range16{Lo: 0x20b, Hi: 0x20b, Stride: 0x1},
-		unicode.Range16{Lo: 0x20d, Hi: 0x20d, Stride: 0x1},
-		unicode.Range16{Lo: 0x20f, Hi: 0x20f, Stride: 0x1},
-		unicode.Range16{Lo: 0x211, Hi: 0x211, Stride: 0x1},
-		unicode.Range16{Lo: 0x213, Hi: 0x213, Stride: 0x1},
-		unicode.Range16{Lo: 0x215, Hi: 0x215, Stride: 0x1},
-		unicode.Range16{Lo: 0x217, Hi: 0x217, Stride: 0x1},
-		unicode.Range16{Lo: 0x219, Hi: 0x219, Stride: 0x1},
-		unicode.Range16{Lo: 0x21b, Hi: 0x21b, Stride: 0x1},
-		unicode.Range16{Lo: 0x21d, Hi: 0x21d, Stride: 0x1},
-		unicode.Range16{Lo: 0x21f, Hi: 0x21f, Stride: 0x1},
-		unicode.Range16{Lo: 0x221, Hi: 0x221, Stride: 0x1},
-		unicode.Range16{Lo: 0x223, Hi: 0x223, Stride: 0x1},
-		unicode.Range16{Lo: 0x225, Hi: 0x225, Stride: 0x1},
-		unicode.Range16{Lo: 0x227, Hi: 0x227, Stride: 0x1},
-		unicode.Range16{Lo: 0x229, Hi: 0x229, Stride: 0x1},
-		unicode.Range16{Lo: 0x22b, Hi: 0x22b, Stride: 0x1},
-		unicode.Range16{Lo: 0x22d, Hi: 0x22d, Stride: 0x1},
-		unicode.Range16{Lo: 0x22f, Hi: 0x22f, Stride: 0x1},
-		unicode.Range16{Lo: 0x231, Hi: 0x231, Stride: 0x1},
-		unicode.Range16{Lo: 0x233, Hi: 0x239, Stride: 0x1},
-		unicode.Range16{Lo: 0x23c, Hi: 0x23c, Stride: 0x1},
-		unicode.Range16{Lo: 0x23f, Hi: 0x240, Stride: 0x1},
-		unicode.Range16{Lo: 0x242, Hi: 0x242, Stride: 0x1},
-		unicode.Range16{Lo: 0x247, Hi: 0x247, Stride: 0x1},
-		unicode.Range16{Lo: 0x249, Hi: 0x249, Stride: 0x1},
-		unicode.Range16{Lo: 0x24b, Hi: 0x24b, Stride: 0x1},
-		unicode.Range16{Lo: 0x24d, Hi: 0x24d, Stride: 0x1},
-		unicode.Range16{Lo: 0x24f, Hi: 0x293, Stride: 0x1},
-		unicode.Range16{Lo: 0x295, Hi: 0x2af, Stride: 0x1},
-		unicode.Range16{Lo: 0x2b0, Hi: 0x2b8, Stride: 0x1},
-		unicode.Range16{Lo: 0x2c0, Hi: 0x2c1, Stride: 0x1},
-		unicode.Range16{Lo: 0x2e0, Hi: 0x2e4, Stride: 0x1},
-		unicode.Range16{Lo: 0x371, Hi: 0x371, Stride: 0x1},
-		unicode.Range16{Lo: 0x373, Hi: 0x373, Stride: 0x1},
-		unicode.Range16{Lo: 0x377, Hi: 0x377, Stride: 0x1},
-		unicode.Range16{Lo: 0x37a, Hi: 0x37a, Stride: 0x1},
-		unicode.Range16{Lo: 0x37b, Hi: 0x37d, Stride: 0x1},
-		unicode.Range16{Lo: 0x390, Hi: 0x390, Stride: 0x1},
-		unicode.Range16{Lo: 0x3ac, Hi: 0x3ce, Stride: 0x1},
-		unicode.Range16{Lo: 0x3d0, Hi: 0x3d1, Stride: 0x1},
-		unicode.Range16{Lo: 0x3d5, Hi: 0x3d7, Stride: 0x1},
-		unicode.Range16{Lo: 0x3d9, Hi: 0x3d9, Stride: 0x1},
-		unicode.Range16{Lo: 0x3db, Hi: 0x3db, Stride: 0x1},
-		unicode.Range16{Lo: 0x3dd, Hi: 0x3dd, Stride: 0x1},
-		unicode.Range16{Lo: 0x3df, Hi: 0x3df, Stride: 0x1},
-		unicode.Range16{Lo: 0x3e1, Hi: 0x3e1, Stride: 0x1},
-		unicode.Range16{Lo: 0x3e3, Hi: 0x3e3, Stride: 0x1},
-		unicode.Range16{Lo: 0x3e5, Hi: 0x3e5, Stride: 0x1},
-		unicode.Range16{Lo: 0x3e7, Hi: 0x3e7, Stride: 0x1},
-		unicode.Range16{Lo: 0x3e9, Hi: 0x3e9, Stride: 0x1},
-		unicode.Range16{Lo: 0x3eb, Hi: 0x3eb, Stride: 0x1},
-		unicode.Range16{Lo: 0x3ed, Hi: 0x3ed, Stride: 0x1},
-		unicode.Range16{Lo: 0x3ef, Hi: 0x3f3, Stride: 0x1},
-		unicode.Range16{Lo: 0x3f5, Hi: 0x3f5, Stride: 0x1},
-		unicode.Range16{Lo: 0x3f8, Hi: 0x3f8, Stride: 0x1},
-		unicode.Range16{Lo: 0x3fb, Hi: 0x3fc, Stride: 0x1},
-		unicode.Range16{Lo: 0x430, Hi: 0x45f, Stride: 0x1},
-		unicode.Range16{Lo: 0x461, Hi: 0x461, Stride: 0x1},
-		unicode.Range16{Lo: 0x463, Hi: 0x463, Stride: 0x1},
-		unicode.Range16{Lo: 0x465, Hi: 0x465, Stride: 0x1},
-		unicode.Range16{Lo: 0x467, Hi: 0x467, Stride: 0x1},
-		unicode.Range16{Lo: 0x469, Hi: 0x469, Stride: 0x1},
-		unicode.Range16{Lo: 0x46b, Hi: 0x46b, Stride: 0x1},
-		unicode.Range16{Lo: 0x46d, Hi: 0x46d, Stride: 0x1},
-		unicode.Range16{Lo: 0x46f, Hi: 0x46f, Stride: 0x1},
-		unicode.Range16{Lo: 0x471, Hi: 0x471, Stride: 0x1},
-		unicode.Range16{Lo: 0x473, Hi: 0x473, Stride: 0x1},
-		unicode.Range16{Lo: 0x475, Hi: 0x475, Stride: 0x1},
-		unicode.Range16{Lo: 0x477, Hi: 0x477, Stride: 0x1},
-		unicode.Range16{Lo: 0x479, Hi: 0x479, Stride: 0x1},
-		unicode.Range16{Lo: 0x47b, Hi: 0x47b, Stride: 0x1},
-		unicode.Range16{Lo: 0x47d, Hi: 0x47d, Stride: 0x1},
-		unicode.Range16{Lo: 0x47f, Hi: 0x47f, Stride: 0x1},
-		unicode.Range16{Lo: 0x481, Hi: 0x481, Stride: 0x1},
-		unicode.Range16{Lo: 0x48b, Hi: 0x48b, Stride: 0x1},
-		unicode.Range16{Lo: 0x48d, Hi: 0x48d, Stride: 0x1},
-		unicode.Range16{Lo: 0x48f, Hi: 0x48f, Stride: 0x1},
-		unicode.Range16{Lo: 0x491, Hi: 0x491, Stride: 0x1},
-		unicode.Range16{Lo: 0x493, Hi: 0x493, Stride: 0x1},
-		unicode.Range16{Lo: 0x495, Hi: 0x495, Stride: 0x1},
-		unicode.Range16{Lo: 0x497, Hi: 0x497, Stride: 0x1},
-		unicode.Range16{Lo: 0x499, Hi: 0x499, Stride: 0x1},
-		unicode.Range16{Lo: 0x49b, Hi: 0x49b, Stride: 0x1},
-		unicode.Range16{Lo: 0x49d, Hi: 0x49d, Stride: 0x1},
-		unicode.Range16{Lo: 0x49f, Hi: 0x49f, Stride: 0x1},
-		unicode.Range16{Lo: 0x4a1, Hi: 0x4a1, Stride: 0x1},
-		unicode.Range16{Lo: 0x4a3, Hi: 0x4a3, Stride: 0x1},
-		unicode.Range16{Lo: 0x4a5, Hi: 0x4a5, Stride: 0x1},
-		unicode.Range16{Lo: 0x4a7, Hi: 0x4a7, Stride: 0x1},
-		unicode.Range16{Lo: 0x4a9, Hi: 0x4a9, Stride: 0x1},
-		unicode.Range16{Lo: 0x4ab, Hi: 0x4ab, Stride: 0x1},
-		unicode.Range16{Lo: 0x4ad, Hi: 0x4ad, Stride: 0x1},
-		unicode.Range16{Lo: 0x4af, Hi: 0x4af, Stride: 0x1},
-		unicode.Range16{Lo: 0x4b1, Hi: 0x4b1, Stride: 0x1},
-		unicode.Range16{Lo: 0x4b3, Hi: 0x4b3, Stride: 0x1},
-		unicode.Range16{Lo: 0x4b5, Hi: 0x4b5, Stride: 0x1},
-		unicode.Range16{Lo: 0x4b7, Hi: 0x4b7, Stride: 0x1},
-		unicode.Range16{Lo: 0x4b9, Hi: 0x4b9, Stride: 0x1},
-		unicode.Range16{Lo: 0x4bb, Hi: 0x4bb, Stride: 0x1},
-		unicode.Range16{Lo: 0x4bd, Hi: 0x4bd, Stride: 0x1},
-		unicode.Range16{Lo: 0x4bf, Hi: 0x4bf, Stride: 0x1},
-		unicode.Range16{Lo: 0x4c2, Hi: 0x4c2, Stride: 0x1},
-		unicode.Range16{Lo: 0x4c4, Hi: 0x4c4, Stride: 0x1},
-		unicode.Range16{Lo: 0x4c6, Hi: 0x4c6, Stride: 0x1},
-		unicode.Range16{Lo: 0x4c8, Hi: 0x4c8, Stride: 0x1},
-		unicode.Range16{Lo: 0x4ca, Hi: 0x4ca, Stride: 0x1},
-		unicode.Range16{Lo: 0x4cc, Hi: 0x4cc, Stride: 0x1},
-		unicode.Range16{Lo: 0x4ce, Hi: 0x4cf, Stride: 0x1},
-		unicode.Range16{Lo: 0x4d1, Hi: 0x4d1, Stride: 0x1},
-		unicode.Range16{Lo: 0x4d3, Hi: 0x4d3, Stride: 0x1},
-		unicode.Range16{Lo: 0x4d5, Hi: 0x4d5, Stride: 0x1},
-		unicode.Range16{Lo: 0x4d7, Hi: 0x4d7, Stride: 0x1},
-		unicode.Range16{Lo: 0x4d9, Hi: 0x4d9, Stride: 0x1},
-		unicode.Range16{Lo: 0x4db, Hi: 0x4db, Stride: 0x1},
-		unicode.Range16{Lo: 0x4dd, Hi: 0x4dd, Stride: 0x1},
-		unicode.Range16{Lo: 0x4df, Hi: 0x4df, Stride: 0x1},
-		unicode.Range16{Lo: 0x4e1, Hi: 0x4e1, Stride: 0x1},
-		unicode.Range16{Lo: 0x4e3, Hi: 0x4e3, Stride: 0x1},
-		unicode.Range16{Lo: 0x4e5, Hi: 0x4e5, Stride: 0x1},
-		unicode.Range16{Lo: 0x4e7, Hi: 0x4e7, Stride: 0x1},
-		unicode.Range16{Lo: 0x4e9, Hi: 0x4e9, Stride: 0x1},
-		unicode.Range16{Lo: 0x4eb, Hi: 0x4eb, Stride: 0x1},
-		unicode.Range16{Lo: 0x4ed, Hi: 0x4ed, Stride: 0x1},
-		unicode.Range16{Lo: 0x4ef, Hi: 0x4ef, Stride: 0x1},
-		unicode.Range16{Lo: 0x4f1, Hi: 0x4f1, Stride: 0x1},
-		unicode.Range16{Lo: 0x4f3, Hi: 0x4f3, Stride: 0x1},
-		unicode.Range16{Lo: 0x4f5, Hi: 0x4f5, Stride: 0x1},
-		unicode.Range16{Lo: 0x4f7, Hi: 0x4f7, Stride: 0x1},
-		unicode.Range16{Lo: 0x4f9, Hi: 0x4f9, Stride: 0x1},
-		unicode.Range16{Lo: 0x4fb, Hi: 0x4fb, Stride: 0x1},
-		unicode.Range16{Lo: 0x4fd, Hi: 0x4fd, Stride: 0x1},
-		unicode.Range16{Lo: 0x4ff, Hi: 0x4ff, Stride: 0x1},
-		unicode.Range16{Lo: 0x501, Hi: 0x501, Stride: 0x1},
-		unicode.Range16{Lo: 0x503, Hi: 0x503, Stride: 0x1},
-		unicode.Range16{Lo: 0x505, Hi: 0x505, Stride: 0x1},
-		unicode.Range16{Lo: 0x507, Hi: 0x507, Stride: 0x1},
-		unicode.Range16{Lo: 0x509, Hi: 0x509, Stride: 0x1},
-		unicode.Range16{Lo: 0x50b, Hi: 0x50b, Stride: 0x1},
-		unicode.Range16{Lo: 0x50d, Hi: 0x50d, Stride: 0x1},
-		unicode.Range16{Lo: 0x50f, Hi: 0x50f, Stride: 0x1},
-		unicode.Range16{Lo: 0x511, Hi: 0x511, Stride: 0x1},
-		unicode.Range16{Lo: 0x513, Hi: 0x513, Stride: 0x1},
-		unicode.Range16{Lo: 0x515, Hi: 0x515, Stride: 0x1},
-		unicode.Range16{Lo: 0x517, Hi: 0x517, Stride: 0x1},
-		unicode.Range16{Lo: 0x519, Hi: 0x519, Stride: 0x1},
-		unicode.Range16{Lo: 0x51b, Hi: 0x51b, Stride: 0x1},
-		unicode.Range16{Lo: 0x51d, Hi: 0x51d, Stride: 0x1},
-		unicode.Range16{Lo: 0x51f, Hi: 0x51f, Stride: 0x1},
-		unicode.Range16{Lo: 0x521, Hi: 0x521, Stride: 0x1},
-		unicode.Range16{Lo: 0x523, Hi: 0x523, Stride: 0x1},
-		unicode.Range16{Lo: 0x525, Hi: 0x525, Stride: 0x1},
-		unicode.Range16{Lo: 0x527, Hi: 0x527, Stride: 0x1},
-		unicode.Range16{Lo: 0x529, Hi: 0x529, Stride: 0x1},
-		unicode.Range16{Lo: 0x52b, Hi: 0x52b, Stride: 0x1},
-		unicode.Range16{Lo: 0x52d, Hi: 0x52d, Stride: 0x1},
-		unicode.Range16{Lo: 0x52f, Hi: 0x52f, Stride: 0x1},
-		unicode.Range16{Lo: 0x560, Hi: 0x588, Stride: 0x1},
-		unicode.Range16{Lo: 0x13f8, Hi: 0x13fd, Stride: 0x1},
-		unicode.Range16{Lo: 0x1c80, Hi: 0x1c88, Stride: 0x1},
-		unicode.Range16{Lo: 0x1d00, Hi: 0x1d2b, Stride: 0x1},
-		unicode.Range16{Lo: 0x1d2c, Hi: 0x1d6a, Stride: 0x1},
-		unicode.Range16{Lo: 0x1d6b, Hi: 0x1d77, Stride: 0x1},
-		unicode.Range16{Lo: 0x1d78, Hi: 0x1d78, Stride: 0x1},
-		unicode.Range16{Lo: 0x1d79, Hi: 0x1d9a, Stride: 0x1},
-		unicode.Range16{Lo: 0x1d9b, Hi: 0x1dbf, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e01, Hi: 0x1e01, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e03, Hi: 0x1e03, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e05, Hi: 0x1e05, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e07, Hi: 0x1e07, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e09, Hi: 0x1e09, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e0b, Hi: 0x1e0b, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e0d, Hi: 0x1e0d, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e0f, Hi: 0x1e0f, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e11, Hi: 0x1e11, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e13, Hi: 0x1e13, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e15, Hi: 0x1e15, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e17, Hi: 0x1e17, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e19, Hi: 0x1e19, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e1b, Hi: 0x1e1b, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e1d, Hi: 0x1e1d, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e1f, Hi: 0x1e1f, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e21, Hi: 0x1e21, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e23, Hi: 0x1e23, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e25, Hi: 0x1e25, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e27, Hi: 0x1e27, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e29, Hi: 0x1e29, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e2b, Hi: 0x1e2b, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e2d, Hi: 0x1e2d, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e2f, Hi: 0x1e2f, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e31, Hi: 0x1e31, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e33, Hi: 0x1e33, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e35, Hi: 0x1e35, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e37, Hi: 0x1e37, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e39, Hi: 0x1e39, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e3b, Hi: 0x1e3b, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e3d, Hi: 0x1e3d, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e3f, Hi: 0x1e3f, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e41, Hi: 0x1e41, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e43, Hi: 0x1e43, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e45, Hi: 0x1e45, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e47, Hi: 0x1e47, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e49, Hi: 0x1e49, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e4b, Hi: 0x1e4b, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e4d, Hi: 0x1e4d, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e4f, Hi: 0x1e4f, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e51, Hi: 0x1e51, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e53, Hi: 0x1e53, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e55, Hi: 0x1e55, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e57, Hi: 0x1e57, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e59, Hi: 0x1e59, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e5b, Hi: 0x1e5b, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e5d, Hi: 0x1e5d, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e5f, Hi: 0x1e5f, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e61, Hi: 0x1e61, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e63, Hi: 0x1e63, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e65, Hi: 0x1e65, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e67, Hi: 0x1e67, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e69, Hi: 0x1e69, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e6b, Hi: 0x1e6b, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e6d, Hi: 0x1e6d, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e6f, Hi: 0x1e6f, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e71, Hi: 0x1e71, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e73, Hi: 0x1e73, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e75, Hi: 0x1e75, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e77, Hi: 0x1e77, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e79, Hi: 0x1e79, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e7b, Hi: 0x1e7b, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e7d, Hi: 0x1e7d, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e7f, Hi: 0x1e7f, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e81, Hi: 0x1e81, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e83, Hi: 0x1e83, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e85, Hi: 0x1e85, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e87, Hi: 0x1e87, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e89, Hi: 0x1e89, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e8b, Hi: 0x1e8b, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e8d, Hi: 0x1e8d, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e8f, Hi: 0x1e8f, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e91, Hi: 0x1e91, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e93, Hi: 0x1e93, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e95, Hi: 0x1e9d, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e9f, Hi: 0x1e9f, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ea1, Hi: 0x1ea1, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ea3, Hi: 0x1ea3, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ea5, Hi: 0x1ea5, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ea7, Hi: 0x1ea7, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ea9, Hi: 0x1ea9, Stride: 0x1},
-		unicode.Range16{Lo: 0x1eab, Hi: 0x1eab, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ead, Hi: 0x1ead, Stride: 0x1},
-		unicode.Range16{Lo: 0x1eaf, Hi: 0x1eaf, Stride: 0x1},
-		unicode.Range16{Lo: 0x1eb1, Hi: 0x1eb1, Stride: 0x1},
-		unicode.Range16{Lo: 0x1eb3, Hi: 0x1eb3, Stride: 0x1},
-		unicode.Range16{Lo: 0x1eb5, Hi: 0x1eb5, Stride: 0x1},
-		unicode.Range16{Lo: 0x1eb7, Hi: 0x1eb7, Stride: 0x1},
-		unicode.Range16{Lo: 0x1eb9, Hi: 0x1eb9, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ebb, Hi: 0x1ebb, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ebd, Hi: 0x1ebd, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ebf, Hi: 0x1ebf, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ec1, Hi: 0x1ec1, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ec3, Hi: 0x1ec3, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ec5, Hi: 0x1ec5, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ec7, Hi: 0x1ec7, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ec9, Hi: 0x1ec9, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ecb, Hi: 0x1ecb, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ecd, Hi: 0x1ecd, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ecf, Hi: 0x1ecf, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ed1, Hi: 0x1ed1, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ed3, Hi: 0x1ed3, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ed5, Hi: 0x1ed5, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ed7, Hi: 0x1ed7, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ed9, Hi: 0x1ed9, Stride: 0x1},
-		unicode.Range16{Lo: 0x1edb, Hi: 0x1edb, Stride: 0x1},
-		unicode.Range16{Lo: 0x1edd, Hi: 0x1edd, Stride: 0x1},
-		unicode.Range16{Lo: 0x1edf, Hi: 0x1edf, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ee1, Hi: 0x1ee1, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ee3, Hi: 0x1ee3, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ee5, Hi: 0x1ee5, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ee7, Hi: 0x1ee7, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ee9, Hi: 0x1ee9, Stride: 0x1},
-		unicode.Range16{Lo: 0x1eeb, Hi: 0x1eeb, Stride: 0x1},
-		unicode.Range16{Lo: 0x1eed, Hi: 0x1eed, Stride: 0x1},
-		unicode.Range16{Lo: 0x1eef, Hi: 0x1eef, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ef1, Hi: 0x1ef1, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ef3, Hi: 0x1ef3, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ef5, Hi: 0x1ef5, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ef7, Hi: 0x1ef7, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ef9, Hi: 0x1ef9, Stride: 0x1},
-		unicode.Range16{Lo: 0x1efb, Hi: 0x1efb, Stride: 0x1},
-		unicode.Range16{Lo: 0x1efd, Hi: 0x1efd, Stride: 0x1},
-		unicode.Range16{Lo: 0x1eff, Hi: 0x1f07, Stride: 0x1},
-		unicode.Range16{Lo: 0x1f10, Hi: 0x1f15, Stride: 0x1},
-		unicode.Range16{Lo: 0x1f20, Hi: 0x1f27, Stride: 0x1},
-		unicode.Range16{Lo: 0x1f30, Hi: 0x1f37, Stride: 0x1},
-		unicode.Range16{Lo: 0x1f40, Hi: 0x1f45, Stride: 0x1},
-		unicode.Range16{Lo: 0x1f50, Hi: 0x1f57, Stride: 0x1},
-		unicode.Range16{Lo: 0x1f60, Hi: 0x1f67, Stride: 0x1},
-		unicode.Range16{Lo: 0x1f70, Hi: 0x1f7d, Stride: 0x1},
-		unicode.Range16{Lo: 0x1f80, Hi: 0x1f87, Stride: 0x1},
-		unicode.Range16{Lo: 0x1f90, Hi: 0x1f97, Stride: 0x1},
-		unicode.Range16{Lo: 0x1fa0, Hi: 0x1fa7, Stride: 0x1},
-		unicode.Range16{Lo: 0x1fb0, Hi: 0x1fb4, Stride: 0x1},
-		unicode.Range16{Lo: 0x1fb6, Hi: 0x1fb7, Stride: 0x1},
-		unicode.Range16{Lo: 0x1fbe, Hi: 0x1fbe, Stride: 0x1},
-		unicode.Range16{Lo: 0x1fc2, Hi: 0x1fc4, Stride: 0x1},
-		unicode.Range16{Lo: 0x1fc6, Hi: 0x1fc7, Stride: 0x1},
-		unicode.Range16{Lo: 0x1fd0, Hi: 0x1fd3, Stride: 0x1},
-		unicode.Range16{Lo: 0x1fd6, Hi: 0x1fd7, Stride: 0x1},
-		unicode.Range16{Lo: 0x1fe0, Hi: 0x1fe7, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ff2, Hi: 0x1ff4, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ff6, Hi: 0x1ff7, Stride: 0x1},
-		unicode.Range16{Lo: 0x2071, Hi: 0x2071, Stride: 0x1},
-		unicode.Range16{Lo: 0x207f, Hi: 0x207f, Stride: 0x1},
-		unicode.Range16{Lo: 0x2090, Hi: 0x209c, Stride: 0x1},
-		unicode.Range16{Lo: 0x210a, Hi: 0x210a, Stride: 0x1},
-		unicode.Range16{Lo: 0x210e, Hi: 0x210f, Stride: 0x1},
-		unicode.Range16{Lo: 0x2113, Hi: 0x2113, Stride: 0x1},
-		unicode.Range16{Lo: 0x212f, Hi: 0x212f, Stride: 0x1},
-		unicode.Range16{Lo: 0x2134, Hi: 0x2134, Stride: 0x1},
-		unicode.Range16{Lo: 0x2139, Hi: 0x2139, Stride: 0x1},
-		unicode.Range16{Lo: 0x213c, Hi: 0x213d, Stride: 0x1},
-		unicode.Range16{Lo: 0x2146, Hi: 0x2149, Stride: 0x1},
-		unicode.Range16{Lo: 0x214e, Hi: 0x214e, Stride: 0x1},
-		unicode.Range16{Lo: 0x2170, Hi: 0x217f, Stride: 0x1},
-		unicode.Range16{Lo: 0x2184, Hi: 0x2184, Stride: 0x1},
-		unicode.Range16{Lo: 0x24d0, Hi: 0x24e9, Stride: 0x1},
-		unicode.Range16{Lo: 0x2c30, Hi: 0x2c5e, Stride: 0x1},
-		unicode.Range16{Lo: 0x2c61, Hi: 0x2c61, Stride: 0x1},
-		unicode.Range16{Lo: 0x2c65, Hi: 0x2c66, Stride: 0x1},
-		unicode.Range16{Lo: 0x2c68, Hi: 0x2c68, Stride: 0x1},
-		unicode.Range16{Lo: 0x2c6a, Hi: 0x2c6a, Stride: 0x1},
-		unicode.Range16{Lo: 0x2c6c, Hi: 0x2c6c, Stride: 0x1},
-		unicode.Range16{Lo: 0x2c71, Hi: 0x2c71, Stride: 0x1},
-		unicode.Range16{Lo: 0x2c73, Hi: 0x2c74, Stride: 0x1},
-		unicode.Range16{Lo: 0x2c76, Hi: 0x2c7b, Stride: 0x1},
-		unicode.Range16{Lo: 0x2c7c, Hi: 0x2c7d, Stride: 0x1},
-		unicode.Range16{Lo: 0x2c81, Hi: 0x2c81, Stride: 0x1},
-		unicode.Range16{Lo: 0x2c83, Hi: 0x2c83, Stride: 0x1},
-		unicode.Range16{Lo: 0x2c85, Hi: 0x2c85, Stride: 0x1},
-		unicode.Range16{Lo: 0x2c87, Hi: 0x2c87, Stride: 0x1},
-		unicode.Range16{Lo: 0x2c89, Hi: 0x2c89, Stride: 0x1},
-		unicode.Range16{Lo: 0x2c8b, Hi: 0x2c8b, Stride: 0x1},
-		unicode.Range16{Lo: 0x2c8d, Hi: 0x2c8d, Stride: 0x1},
-		unicode.Range16{Lo: 0x2c8f, Hi: 0x2c8f, Stride: 0x1},
-		unicode.Range16{Lo: 0x2c91, Hi: 0x2c91, Stride: 0x1},
-		unicode.Range16{Lo: 0x2c93, Hi: 0x2c93, Stride: 0x1},
-		unicode.Range16{Lo: 0x2c95, Hi: 0x2c95, Stride: 0x1},
-		unicode.Range16{Lo: 0x2c97, Hi: 0x2c97, Stride: 0x1},
-		unicode.Range16{Lo: 0x2c99, Hi: 0x2c99, Stride: 0x1},
-		unicode.Range16{Lo: 0x2c9b, Hi: 0x2c9b, Stride: 0x1},
-		unicode.Range16{Lo: 0x2c9d, Hi: 0x2c9d, Stride: 0x1},
-		unicode.Range16{Lo: 0x2c9f, Hi: 0x2c9f, Stride: 0x1},
-		unicode.Range16{Lo: 0x2ca1, Hi: 0x2ca1, Stride: 0x1},
-		unicode.Range16{Lo: 0x2ca3, Hi: 0x2ca3, Stride: 0x1},
-		unicode.Range16{Lo: 0x2ca5, Hi: 0x2ca5, Stride: 0x1},
-		unicode.Range16{Lo: 0x2ca7, Hi: 0x2ca7, Stride: 0x1},
-		unicode.Range16{Lo: 0x2ca9, Hi: 0x2ca9, Stride: 0x1},
-		unicode.Range16{Lo: 0x2cab, Hi: 0x2cab, Stride: 0x1},
-		unicode.Range16{Lo: 0x2cad, Hi: 0x2cad, Stride: 0x1},
-		unicode.Range16{Lo: 0x2caf, Hi: 0x2caf, Stride: 0x1},
-		unicode.Range16{Lo: 0x2cb1, Hi: 0x2cb1, Stride: 0x1},
-		unicode.Range16{Lo: 0x2cb3, Hi: 0x2cb3, Stride: 0x1},
-		unicode.Range16{Lo: 0x2cb5, Hi: 0x2cb5, Stride: 0x1},
-		unicode.Range16{Lo: 0x2cb7, Hi: 0x2cb7, Stride: 0x1},
-		unicode.Range16{Lo: 0x2cb9, Hi: 0x2cb9, Stride: 0x1},
-		unicode.Range16{Lo: 0x2cbb, Hi: 0x2cbb, Stride: 0x1},
-		unicode.Range16{Lo: 0x2cbd, Hi: 0x2cbd, Stride: 0x1},
-		unicode.Range16{Lo: 0x2cbf, Hi: 0x2cbf, Stride: 0x1},
-		unicode.Range16{Lo: 0x2cc1, Hi: 0x2cc1, Stride: 0x1},
-		unicode.Range16{Lo: 0x2cc3, Hi: 0x2cc3, Stride: 0x1},
-		unicode.Range16{Lo: 0x2cc5, Hi: 0x2cc5, Stride: 0x1},
-		unicode.Range16{Lo: 0x2cc7, Hi: 0x2cc7, Stride: 0x1},
-		unicode.Range16{Lo: 0x2cc9, Hi: 0x2cc9, Stride: 0x1},
-		unicode.Range16{Lo: 0x2ccb, Hi: 0x2ccb, Stride: 0x1},
-		unicode.Range16{Lo: 0x2ccd, Hi: 0x2ccd, Stride: 0x1},
-		unicode.Range16{Lo: 0x2ccf, Hi: 0x2ccf, Stride: 0x1},
-		unicode.Range16{Lo: 0x2cd1, Hi: 0x2cd1, Stride: 0x1},
-		unicode.Range16{Lo: 0x2cd3, Hi: 0x2cd3, Stride: 0x1},
-		unicode.Range16{Lo: 0x2cd5, Hi: 0x2cd5, Stride: 0x1},
-		unicode.Range16{Lo: 0x2cd7, Hi: 0x2cd7, Stride: 0x1},
-		unicode.Range16{Lo: 0x2cd9, Hi: 0x2cd9, Stride: 0x1},
-		unicode.Range16{Lo: 0x2cdb, Hi: 0x2cdb, Stride: 0x1},
-		unicode.Range16{Lo: 0x2cdd, Hi: 0x2cdd, Stride: 0x1},
-		unicode.Range16{Lo: 0x2cdf, Hi: 0x2cdf, Stride: 0x1},
-		unicode.Range16{Lo: 0x2ce1, Hi: 0x2ce1, Stride: 0x1},
-		unicode.Range16{Lo: 0x2ce3, Hi: 0x2ce4, Stride: 0x1},
-		unicode.Range16{Lo: 0x2cec, Hi: 0x2cec, Stride: 0x1},
-		unicode.Range16{Lo: 0x2cee, Hi: 0x2cee, Stride: 0x1},
-		unicode.Range16{Lo: 0x2cf3, Hi: 0x2cf3, Stride: 0x1},
-		unicode.Range16{Lo: 0x2d00, Hi: 0x2d25, Stride: 0x1},
-		unicode.Range16{Lo: 0x2d27, Hi: 0x2d27, Stride: 0x1},
-		unicode.Range16{Lo: 0x2d2d, Hi: 0x2d2d, Stride: 0x1},
-		unicode.Range16{Lo: 0xa641, Hi: 0xa641, Stride: 0x1},
-		unicode.Range16{Lo: 0xa643, Hi: 0xa643, Stride: 0x1},
-		unicode.Range16{Lo: 0xa645, Hi: 0xa645, Stride: 0x1},
-		unicode.Range16{Lo: 0xa647, Hi: 0xa647, Stride: 0x1},
-		unicode.Range16{Lo: 0xa649, Hi: 0xa649, Stride: 0x1},
-		unicode.Range16{Lo: 0xa64b, Hi: 0xa64b, Stride: 0x1},
-		unicode.Range16{Lo: 0xa64d, Hi: 0xa64d, Stride: 0x1},
-		unicode.Range16{Lo: 0xa64f, Hi: 0xa64f, Stride: 0x1},
-		unicode.Range16{Lo: 0xa651, Hi: 0xa651, Stride: 0x1},
-		unicode.Range16{Lo: 0xa653, Hi: 0xa653, Stride: 0x1},
-		unicode.Range16{Lo: 0xa655, Hi: 0xa655, Stride: 0x1},
-		unicode.Range16{Lo: 0xa657, Hi: 0xa657, Stride: 0x1},
-		unicode.Range16{Lo: 0xa659, Hi: 0xa659, Stride: 0x1},
-		unicode.Range16{Lo: 0xa65b, Hi: 0xa65b, Stride: 0x1},
-		unicode.Range16{Lo: 0xa65d, Hi: 0xa65d, Stride: 0x1},
-		unicode.Range16{Lo: 0xa65f, Hi: 0xa65f, Stride: 0x1},
-		unicode.Range16{Lo: 0xa661, Hi: 0xa661, Stride: 0x1},
-		unicode.Range16{Lo: 0xa663, Hi: 0xa663, Stride: 0x1},
-		unicode.Range16{Lo: 0xa665, Hi: 0xa665, Stride: 0x1},
-		unicode.Range16{Lo: 0xa667, Hi: 0xa667, Stride: 0x1},
-		unicode.Range16{Lo: 0xa669, Hi: 0xa669, Stride: 0x1},
-		unicode.Range16{Lo: 0xa66b, Hi: 0xa66b, Stride: 0x1},
-		unicode.Range16{Lo: 0xa66d, Hi: 0xa66d, Stride: 0x1},
-		unicode.Range16{Lo: 0xa681, Hi: 0xa681, Stride: 0x1},
-		unicode.Range16{Lo: 0xa683, Hi: 0xa683, Stride: 0x1},
-		unicode.Range16{Lo: 0xa685, Hi: 0xa685, Stride: 0x1},
-		unicode.Range16{Lo: 0xa687, Hi: 0xa687, Stride: 0x1},
-		unicode.Range16{Lo: 0xa689, Hi: 0xa689, Stride: 0x1},
-		unicode.Range16{Lo: 0xa68b, Hi: 0xa68b, Stride: 0x1},
-		unicode.Range16{Lo: 0xa68d, Hi: 0xa68d, Stride: 0x1},
-		unicode.Range16{Lo: 0xa68f, Hi: 0xa68f, Stride: 0x1},
-		unicode.Range16{Lo: 0xa691, Hi: 0xa691, Stride: 0x1},
-		unicode.Range16{Lo: 0xa693, Hi: 0xa693, Stride: 0x1},
-		unicode.Range16{Lo: 0xa695, Hi: 0xa695, Stride: 0x1},
-		unicode.Range16{Lo: 0xa697, Hi: 0xa697, Stride: 0x1},
-		unicode.Range16{Lo: 0xa699, Hi: 0xa699, Stride: 0x1},
-		unicode.Range16{Lo: 0xa69b, Hi: 0xa69b, Stride: 0x1},
-		unicode.Range16{Lo: 0xa69c, Hi: 0xa69d, Stride: 0x1},
-		unicode.Range16{Lo: 0xa723, Hi: 0xa723, Stride: 0x1},
-		unicode.Range16{Lo: 0xa725, Hi: 0xa725, Stride: 0x1},
-		unicode.Range16{Lo: 0xa727, Hi: 0xa727, Stride: 0x1},
-		unicode.Range16{Lo: 0xa729, Hi: 0xa729, Stride: 0x1},
-		unicode.Range16{Lo: 0xa72b, Hi: 0xa72b, Stride: 0x1},
-		unicode.Range16{Lo: 0xa72d, Hi: 0xa72d, Stride: 0x1},
-		unicode.Range16{Lo: 0xa72f, Hi: 0xa731, Stride: 0x1},
-		unicode.Range16{Lo: 0xa733, Hi: 0xa733, Stride: 0x1},
-		unicode.Range16{Lo: 0xa735, Hi: 0xa735, Stride: 0x1},
-		unicode.Range16{Lo: 0xa737, Hi: 0xa737, Stride: 0x1},
-		unicode.Range16{Lo: 0xa739, Hi: 0xa739, Stride: 0x1},
-		unicode.Range16{Lo: 0xa73b, Hi: 0xa73b, Stride: 0x1},
-		unicode.Range16{Lo: 0xa73d, Hi: 0xa73d, Stride: 0x1},
-		unicode.Range16{Lo: 0xa73f, Hi: 0xa73f, Stride: 0x1},
-		unicode.Range16{Lo: 0xa741, Hi: 0xa741, Stride: 0x1},
-		unicode.Range16{Lo: 0xa743, Hi: 0xa743, Stride: 0x1},
-		unicode.Range16{Lo: 0xa745, Hi: 0xa745, Stride: 0x1},
-		unicode.Range16{Lo: 0xa747, Hi: 0xa747, Stride: 0x1},
-		unicode.Range16{Lo: 0xa749, Hi: 0xa749, Stride: 0x1},
-		unicode.Range16{Lo: 0xa74b, Hi: 0xa74b, Stride: 0x1},
-		unicode.Range16{Lo: 0xa74d, Hi: 0xa74d, Stride: 0x1},
-		unicode.Range16{Lo: 0xa74f, Hi: 0xa74f, Stride: 0x1},
-		unicode.Range16{Lo: 0xa751, Hi: 0xa751, Stride: 0x1},
-		unicode.Range16{Lo: 0xa753, Hi: 0xa753, Stride: 0x1},
-		unicode.Range16{Lo: 0xa755, Hi: 0xa755, Stride: 0x1},
-		unicode.Range16{Lo: 0xa757, Hi: 0xa757, Stride: 0x1},
-		unicode.Range16{Lo: 0xa759, Hi: 0xa759, Stride: 0x1},
-		unicode.Range16{Lo: 0xa75b, Hi: 0xa75b, Stride: 0x1},
-		unicode.Range16{Lo: 0xa75d, Hi: 0xa75d, Stride: 0x1},
-		unicode.Range16{Lo: 0xa75f, Hi: 0xa75f, Stride: 0x1},
-		unicode.Range16{Lo: 0xa761, Hi: 0xa761, Stride: 0x1},
-		unicode.Range16{Lo: 0xa763, Hi: 0xa763, Stride: 0x1},
-		unicode.Range16{Lo: 0xa765, Hi: 0xa765, Stride: 0x1},
-		unicode.Range16{Lo: 0xa767, Hi: 0xa767, Stride: 0x1},
-		unicode.Range16{Lo: 0xa769, Hi: 0xa769, Stride: 0x1},
-		unicode.Range16{Lo: 0xa76b, Hi: 0xa76b, Stride: 0x1},
-		unicode.Range16{Lo: 0xa76d, Hi: 0xa76d, Stride: 0x1},
-		unicode.Range16{Lo: 0xa76f, Hi: 0xa76f, Stride: 0x1},
-		unicode.Range16{Lo: 0xa770, Hi: 0xa770, Stride: 0x1},
-		unicode.Range16{Lo: 0xa771, Hi: 0xa778, Stride: 0x1},
-		unicode.Range16{Lo: 0xa77a, Hi: 0xa77a, Stride: 0x1},
-		unicode.Range16{Lo: 0xa77c, Hi: 0xa77c, Stride: 0x1},
-		unicode.Range16{Lo: 0xa77f, Hi: 0xa77f, Stride: 0x1},
-		unicode.Range16{Lo: 0xa781, Hi: 0xa781, Stride: 0x1},
-		unicode.Range16{Lo: 0xa783, Hi: 0xa783, Stride: 0x1},
-		unicode.Range16{Lo: 0xa785, Hi: 0xa785, Stride: 0x1},
-		unicode.Range16{Lo: 0xa787, Hi: 0xa787, Stride: 0x1},
-		unicode.Range16{Lo: 0xa78c, Hi: 0xa78c, Stride: 0x1},
-		unicode.Range16{Lo: 0xa78e, Hi: 0xa78e, Stride: 0x1},
-		unicode.Range16{Lo: 0xa791, Hi: 0xa791, Stride: 0x1},
-		unicode.Range16{Lo: 0xa793, Hi: 0xa795, Stride: 0x1},
-		unicode.Range16{Lo: 0xa797, Hi: 0xa797, Stride: 0x1},
-		unicode.Range16{Lo: 0xa799, Hi: 0xa799, Stride: 0x1},
-		unicode.Range16{Lo: 0xa79b, Hi: 0xa79b, Stride: 0x1},
-		unicode.Range16{Lo: 0xa79d, Hi: 0xa79d, Stride: 0x1},
-		unicode.Range16{Lo: 0xa79f, Hi: 0xa79f, Stride: 0x1},
-		unicode.Range16{Lo: 0xa7a1, Hi: 0xa7a1, Stride: 0x1},
-		unicode.Range16{Lo: 0xa7a3, Hi: 0xa7a3, Stride: 0x1},
-		unicode.Range16{Lo: 0xa7a5, Hi: 0xa7a5, Stride: 0x1},
-		unicode.Range16{Lo: 0xa7a7, Hi: 0xa7a7, Stride: 0x1},
-		unicode.Range16{Lo: 0xa7a9, Hi: 0xa7a9, Stride: 0x1},
-		unicode.Range16{Lo: 0xa7af, Hi: 0xa7af, Stride: 0x1},
-		unicode.Range16{Lo: 0xa7b5, Hi: 0xa7b5, Stride: 0x1},
-		unicode.Range16{Lo: 0xa7b7, Hi: 0xa7b7, Stride: 0x1},
-		unicode.Range16{Lo: 0xa7b9, Hi: 0xa7b9, Stride: 0x1},
-		unicode.Range16{Lo: 0xa7bb, Hi: 0xa7bb, Stride: 0x1},
-		unicode.Range16{Lo: 0xa7bd, Hi: 0xa7bd, Stride: 0x1},
-		unicode.Range16{Lo: 0xa7bf, Hi: 0xa7bf, Stride: 0x1},
-		unicode.Range16{Lo: 0xa7c3, Hi: 0xa7c3, Stride: 0x1},
-		unicode.Range16{Lo: 0xa7f8, Hi: 0xa7f9, Stride: 0x1},
-		unicode.Range16{Lo: 0xa7fa, Hi: 0xa7fa, Stride: 0x1},
-		unicode.Range16{Lo: 0xab30, Hi: 0xab5a, Stride: 0x1},
-		unicode.Range16{Lo: 0xab5c, Hi: 0xab5f, Stride: 0x1},
-		unicode.Range16{Lo: 0xab60, Hi: 0xab67, Stride: 0x1},
-		unicode.Range16{Lo: 0xab70, Hi: 0xabbf, Stride: 0x1},
-		unicode.Range16{Lo: 0xfb00, Hi: 0xfb06, Stride: 0x1},
-		unicode.Range16{Lo: 0xfb13, Hi: 0xfb17, Stride: 0x1},
-		unicode.Range16{Lo: 0xff41, Hi: 0xff5a, Stride: 0x1},
-	},
-	R32: []unicode.Range32{
-		unicode.Range32{Lo: 0x10428, Hi: 0x1044f, Stride: 0x1},
-		unicode.Range32{Lo: 0x104d8, Hi: 0x104fb, Stride: 0x1},
-		unicode.Range32{Lo: 0x10cc0, Hi: 0x10cf2, Stride: 0x1},
-		unicode.Range32{Lo: 0x118c0, Hi: 0x118df, Stride: 0x1},
-		unicode.Range32{Lo: 0x16e60, Hi: 0x16e7f, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d41a, Hi: 0x1d433, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d44e, Hi: 0x1d454, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d456, Hi: 0x1d467, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d482, Hi: 0x1d49b, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d4b6, Hi: 0x1d4b9, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d4bb, Hi: 0x1d4bb, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d4bd, Hi: 0x1d4c3, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d4c5, Hi: 0x1d4cf, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d4ea, Hi: 0x1d503, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d51e, Hi: 0x1d537, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d552, Hi: 0x1d56b, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d586, Hi: 0x1d59f, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d5ba, Hi: 0x1d5d3, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d5ee, Hi: 0x1d607, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d622, Hi: 0x1d63b, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d656, Hi: 0x1d66f, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d68a, Hi: 0x1d6a5, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d6c2, Hi: 0x1d6da, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d6dc, Hi: 0x1d6e1, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d6fc, Hi: 0x1d714, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d716, Hi: 0x1d71b, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d736, Hi: 0x1d74e, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d750, Hi: 0x1d755, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d770, Hi: 0x1d788, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d78a, Hi: 0x1d78f, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d7aa, Hi: 0x1d7c2, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d7c4, Hi: 0x1d7c9, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d7cb, Hi: 0x1d7cb, Stride: 0x1},
-		unicode.Range32{Lo: 0x1e922, Hi: 0x1e943, Stride: 0x1},
-	},
-	LatinOffset: 6,
-}
-
-var _SentenceNumeric = &unicode.RangeTable{
-	R16: []unicode.Range16{
-		unicode.Range16{Lo: 0x30, Hi: 0x39, Stride: 0x1},
-		unicode.Range16{Lo: 0x660, Hi: 0x669, Stride: 0x1},
-		unicode.Range16{Lo: 0x66b, Hi: 0x66c, Stride: 0x1},
-		unicode.Range16{Lo: 0x6f0, Hi: 0x6f9, Stride: 0x1},
-		unicode.Range16{Lo: 0x7c0, Hi: 0x7c9, Stride: 0x1},
-		unicode.Range16{Lo: 0x966, Hi: 0x96f, Stride: 0x1},
-		unicode.Range16{Lo: 0x9e6, Hi: 0x9ef, Stride: 0x1},
-		unicode.Range16{Lo: 0xa66, Hi: 0xa6f, Stride: 0x1},
-		unicode.Range16{Lo: 0xae6, Hi: 0xaef, Stride: 0x1},
-		unicode.Range16{Lo: 0xb66, Hi: 0xb6f, Stride: 0x1},
-		unicode.Range16{Lo: 0xbe6, Hi: 0xbef, Stride: 0x1},
-		unicode.Range16{Lo: 0xc66, Hi: 0xc6f, Stride: 0x1},
-		unicode.Range16{Lo: 0xce6, Hi: 0xcef, Stride: 0x1},
-		unicode.Range16{Lo: 0xd66, Hi: 0xd6f, Stride: 0x1},
-		unicode.Range16{Lo: 0xde6, Hi: 0xdef, Stride: 0x1},
-		unicode.Range16{Lo: 0xe50, Hi: 0xe59, Stride: 0x1},
-		unicode.Range16{Lo: 0xed0, Hi: 0xed9, Stride: 0x1},
-		unicode.Range16{Lo: 0xf20, Hi: 0xf29, Stride: 0x1},
-		unicode.Range16{Lo: 0x1040, Hi: 0x1049, Stride: 0x1},
-		unicode.Range16{Lo: 0x1090, Hi: 0x1099, Stride: 0x1},
-		unicode.Range16{Lo: 0x17e0, Hi: 0x17e9, Stride: 0x1},
-		unicode.Range16{Lo: 0x1810, Hi: 0x1819, Stride: 0x1},
-		unicode.Range16{Lo: 0x1946, Hi: 0x194f, Stride: 0x1},
-		unicode.Range16{Lo: 0x19d0, Hi: 0x19d9, Stride: 0x1},
-		unicode.Range16{Lo: 0x1a80, Hi: 0x1a89, Stride: 0x1},
-		unicode.Range16{Lo: 0x1a90, Hi: 0x1a99, Stride: 0x1},
-		unicode.Range16{Lo: 0x1b50, Hi: 0x1b59, Stride: 0x1},
-		unicode.Range16{Lo: 0x1bb0, Hi: 0x1bb9, Stride: 0x1},
-		unicode.Range16{Lo: 0x1c40, Hi: 0x1c49, Stride: 0x1},
-		unicode.Range16{Lo: 0x1c50, Hi: 0x1c59, Stride: 0x1},
-		unicode.Range16{Lo: 0xa620, Hi: 0xa629, Stride: 0x1},
-		unicode.Range16{Lo: 0xa8d0, Hi: 0xa8d9, Stride: 0x1},
-		unicode.Range16{Lo: 0xa900, Hi: 0xa909, Stride: 0x1},
-		unicode.Range16{Lo: 0xa9d0, Hi: 0xa9d9, Stride: 0x1},
-		unicode.Range16{Lo: 0xa9f0, Hi: 0xa9f9, Stride: 0x1},
-		unicode.Range16{Lo: 0xaa50, Hi: 0xaa59, Stride: 0x1},
-		unicode.Range16{Lo: 0xabf0, Hi: 0xabf9, Stride: 0x1},
-		unicode.Range16{Lo: 0xff10, Hi: 0xff19, Stride: 0x1},
-	},
-	R32: []unicode.Range32{
-		unicode.Range32{Lo: 0x104a0, Hi: 0x104a9, Stride: 0x1},
-		unicode.Range32{Lo: 0x10d30, Hi: 0x10d39, Stride: 0x1},
-		unicode.Range32{Lo: 0x11066, Hi: 0x1106f, Stride: 0x1},
-		unicode.Range32{Lo: 0x110f0, Hi: 0x110f9, Stride: 0x1},
-		unicode.Range32{Lo: 0x11136, Hi: 0x1113f, Stride: 0x1},
-		unicode.Range32{Lo: 0x111d0, Hi: 0x111d9, Stride: 0x1},
-		unicode.Range32{Lo: 0x112f0, Hi: 0x112f9, Stride: 0x1},
-		unicode.Range32{Lo: 0x11450, Hi: 0x11459, Stride: 0x1},
-		unicode.Range32{Lo: 0x114d0, Hi: 0x114d9, Stride: 0x1},
-		unicode.Range32{Lo: 0x11650, Hi: 0x11659, Stride: 0x1},
-		unicode.Range32{Lo: 0x116c0, Hi: 0x116c9, Stride: 0x1},
-		unicode.Range32{Lo: 0x11730, Hi: 0x11739, Stride: 0x1},
-		unicode.Range32{Lo: 0x118e0, Hi: 0x118e9, Stride: 0x1},
-		unicode.Range32{Lo: 0x11c50, Hi: 0x11c59, Stride: 0x1},
-		unicode.Range32{Lo: 0x11d50, Hi: 0x11d59, Stride: 0x1},
-		unicode.Range32{Lo: 0x11da0, Hi: 0x11da9, Stride: 0x1},
-		unicode.Range32{Lo: 0x16a60, Hi: 0x16a69, Stride: 0x1},
-		unicode.Range32{Lo: 0x16b50, Hi: 0x16b59, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d7ce, Hi: 0x1d7ff, Stride: 0x1},
-		unicode.Range32{Lo: 0x1e140, Hi: 0x1e149, Stride: 0x1},
-		unicode.Range32{Lo: 0x1e2f0, Hi: 0x1e2f9, Stride: 0x1},
-		unicode.Range32{Lo: 0x1e950, Hi: 0x1e959, Stride: 0x1},
-	},
-	LatinOffset: 1,
-}
-
-var _SentenceOLetter = &unicode.RangeTable{
-	R16: []unicode.Range16{
-		unicode.Range16{Lo: 0x1bb, Hi: 0x1bb, Stride: 0x1},
-		unicode.Range16{Lo: 0x1c0, Hi: 0x1c3, Stride: 0x1},
-		unicode.Range16{Lo: 0x294, Hi: 0x294, Stride: 0x1},
-		unicode.Range16{Lo: 0x2b9, Hi: 0x2bf, Stride: 0x1},
-		unicode.Range16{Lo: 0x2c6, Hi: 0x2d1, Stride: 0x1},
-		unicode.Range16{Lo: 0x2ec, Hi: 0x2ec, Stride: 0x1},
-		unicode.Range16{Lo: 0x2ee, Hi: 0x2ee, Stride: 0x1},
-		unicode.Range16{Lo: 0x374, Hi: 0x374, Stride: 0x1},
-		unicode.Range16{Lo: 0x559, Hi: 0x559, Stride: 0x1},
-		unicode.Range16{Lo: 0x5d0, Hi: 0x5ea, Stride: 0x1},
-		unicode.Range16{Lo: 0x5ef, Hi: 0x5f2, Stride: 0x1},
-		unicode.Range16{Lo: 0x5f3, Hi: 0x5f3, Stride: 0x1},
-		unicode.Range16{Lo: 0x620, Hi: 0x63f, Stride: 0x1},
-		unicode.Range16{Lo: 0x640, Hi: 0x640, Stride: 0x1},
-		unicode.Range16{Lo: 0x641, Hi: 0x64a, Stride: 0x1},
-		unicode.Range16{Lo: 0x66e, Hi: 0x66f, Stride: 0x1},
-		unicode.Range16{Lo: 0x671, Hi: 0x6d3, Stride: 0x1},
-		unicode.Range16{Lo: 0x6d5, Hi: 0x6d5, Stride: 0x1},
-		unicode.Range16{Lo: 0x6e5, Hi: 0x6e6, Stride: 0x1},
-		unicode.Range16{Lo: 0x6ee, Hi: 0x6ef, Stride: 0x1},
-		unicode.Range16{Lo: 0x6fa, Hi: 0x6fc, Stride: 0x1},
-		unicode.Range16{Lo: 0x6ff, Hi: 0x6ff, Stride: 0x1},
-		unicode.Range16{Lo: 0x710, Hi: 0x710, Stride: 0x1},
-		unicode.Range16{Lo: 0x712, Hi: 0x72f, Stride: 0x1},
-		unicode.Range16{Lo: 0x74d, Hi: 0x7a5, Stride: 0x1},
-		unicode.Range16{Lo: 0x7b1, Hi: 0x7b1, Stride: 0x1},
-		unicode.Range16{Lo: 0x7ca, Hi: 0x7ea, Stride: 0x1},
-		unicode.Range16{Lo: 0x7f4, Hi: 0x7f5, Stride: 0x1},
-		unicode.Range16{Lo: 0x7fa, Hi: 0x7fa, Stride: 0x1},
-		unicode.Range16{Lo: 0x800, Hi: 0x815, Stride: 0x1},
-		unicode.Range16{Lo: 0x81a, Hi: 0x81a, Stride: 0x1},
-		unicode.Range16{Lo: 0x824, Hi: 0x824, Stride: 0x1},
-		unicode.Range16{Lo: 0x828, Hi: 0x828, Stride: 0x1},
-		unicode.Range16{Lo: 0x840, Hi: 0x858, Stride: 0x1},
-		unicode.Range16{Lo: 0x860, Hi: 0x86a, Stride: 0x1},
-		unicode.Range16{Lo: 0x8a0, Hi: 0x8b4, Stride: 0x1},
-		unicode.Range16{Lo: 0x8b6, Hi: 0x8bd, Stride: 0x1},
-		unicode.Range16{Lo: 0x904, Hi: 0x939, Stride: 0x1},
-		unicode.Range16{Lo: 0x93d, Hi: 0x93d, Stride: 0x1},
-		unicode.Range16{Lo: 0x950, Hi: 0x950, Stride: 0x1},
-		unicode.Range16{Lo: 0x958, Hi: 0x961, Stride: 0x1},
-		unicode.Range16{Lo: 0x971, Hi: 0x971, Stride: 0x1},
-		unicode.Range16{Lo: 0x972, Hi: 0x980, Stride: 0x1},
-		unicode.Range16{Lo: 0x985, Hi: 0x98c, Stride: 0x1},
-		unicode.Range16{Lo: 0x98f, Hi: 0x990, Stride: 0x1},
-		unicode.Range16{Lo: 0x993, Hi: 0x9a8, Stride: 0x1},
-		unicode.Range16{Lo: 0x9aa, Hi: 0x9b0, Stride: 0x1},
-		unicode.Range16{Lo: 0x9b2, Hi: 0x9b2, Stride: 0x1},
-		unicode.Range16{Lo: 0x9b6, Hi: 0x9b9, Stride: 0x1},
-		unicode.Range16{Lo: 0x9bd, Hi: 0x9bd, Stride: 0x1},
-		unicode.Range16{Lo: 0x9ce, Hi: 0x9ce, Stride: 0x1},
-		unicode.Range16{Lo: 0x9dc, Hi: 0x9dd, Stride: 0x1},
-		unicode.Range16{Lo: 0x9df, Hi: 0x9e1, Stride: 0x1},
-		unicode.Range16{Lo: 0x9f0, Hi: 0x9f1, Stride: 0x1},
-		unicode.Range16{Lo: 0x9fc, Hi: 0x9fc, Stride: 0x1},
-		unicode.Range16{Lo: 0xa05, Hi: 0xa0a, Stride: 0x1},
-		unicode.Range16{Lo: 0xa0f, Hi: 0xa10, Stride: 0x1},
-		unicode.Range16{Lo: 0xa13, Hi: 0xa28, Stride: 0x1},
-		unicode.Range16{Lo: 0xa2a, Hi: 0xa30, Stride: 0x1},
-		unicode.Range16{Lo: 0xa32, Hi: 0xa33, Stride: 0x1},
-		unicode.Range16{Lo: 0xa35, Hi: 0xa36, Stride: 0x1},
-		unicode.Range16{Lo: 0xa38, Hi: 0xa39, Stride: 0x1},
-		unicode.Range16{Lo: 0xa59, Hi: 0xa5c, Stride: 0x1},
-		unicode.Range16{Lo: 0xa5e, Hi: 0xa5e, Stride: 0x1},
-		unicode.Range16{Lo: 0xa72, Hi: 0xa74, Stride: 0x1},
-		unicode.Range16{Lo: 0xa85, Hi: 0xa8d, Stride: 0x1},
-		unicode.Range16{Lo: 0xa8f, Hi: 0xa91, Stride: 0x1},
-		unicode.Range16{Lo: 0xa93, Hi: 0xaa8, Stride: 0x1},
-		unicode.Range16{Lo: 0xaaa, Hi: 0xab0, Stride: 0x1},
-		unicode.Range16{Lo: 0xab2, Hi: 0xab3, Stride: 0x1},
-		unicode.Range16{Lo: 0xab5, Hi: 0xab9, Stride: 0x1},
-		unicode.Range16{Lo: 0xabd, Hi: 0xabd, Stride: 0x1},
-		unicode.Range16{Lo: 0xad0, Hi: 0xad0, Stride: 0x1},
-		unicode.Range16{Lo: 0xae0, Hi: 0xae1, Stride: 0x1},
-		unicode.Range16{Lo: 0xaf9, Hi: 0xaf9, Stride: 0x1},
-		unicode.Range16{Lo: 0xb05, Hi: 0xb0c, Stride: 0x1},
-		unicode.Range16{Lo: 0xb0f, Hi: 0xb10, Stride: 0x1},
-		unicode.Range16{Lo: 0xb13, Hi: 0xb28, Stride: 0x1},
-		unicode.Range16{Lo: 0xb2a, Hi: 0xb30, Stride: 0x1},
-		unicode.Range16{Lo: 0xb32, Hi: 0xb33, Stride: 0x1},
-		unicode.Range16{Lo: 0xb35, Hi: 0xb39, Stride: 0x1},
-		unicode.Range16{Lo: 0xb3d, Hi: 0xb3d, Stride: 0x1},
-		unicode.Range16{Lo: 0xb5c, Hi: 0xb5d, Stride: 0x1},
-		unicode.Range16{Lo: 0xb5f, Hi: 0xb61, Stride: 0x1},
-		unicode.Range16{Lo: 0xb71, Hi: 0xb71, Stride: 0x1},
-		unicode.Range16{Lo: 0xb83, Hi: 0xb83, Stride: 0x1},
-		unicode.Range16{Lo: 0xb85, Hi: 0xb8a, Stride: 0x1},
-		unicode.Range16{Lo: 0xb8e, Hi: 0xb90, Stride: 0x1},
-		unicode.Range16{Lo: 0xb92, Hi: 0xb95, Stride: 0x1},
-		unicode.Range16{Lo: 0xb99, Hi: 0xb9a, Stride: 0x1},
-		unicode.Range16{Lo: 0xb9c, Hi: 0xb9c, Stride: 0x1},
-		unicode.Range16{Lo: 0xb9e, Hi: 0xb9f, Stride: 0x1},
-		unicode.Range16{Lo: 0xba3, Hi: 0xba4, Stride: 0x1},
-		unicode.Range16{Lo: 0xba8, Hi: 0xbaa, Stride: 0x1},
-		unicode.Range16{Lo: 0xbae, Hi: 0xbb9, Stride: 0x1},
-		unicode.Range16{Lo: 0xbd0, Hi: 0xbd0, Stride: 0x1},
-		unicode.Range16{Lo: 0xc05, Hi: 0xc0c, Stride: 0x1},
-		unicode.Range16{Lo: 0xc0e, Hi: 0xc10, Stride: 0x1},
-		unicode.Range16{Lo: 0xc12, Hi: 0xc28, Stride: 0x1},
-		unicode.Range16{Lo: 0xc2a, Hi: 0xc39, Stride: 0x1},
-		unicode.Range16{Lo: 0xc3d, Hi: 0xc3d, Stride: 0x1},
-		unicode.Range16{Lo: 0xc58, Hi: 0xc5a, Stride: 0x1},
-		unicode.Range16{Lo: 0xc60, Hi: 0xc61, Stride: 0x1},
-		unicode.Range16{Lo: 0xc80, Hi: 0xc80, Stride: 0x1},
-		unicode.Range16{Lo: 0xc85, Hi: 0xc8c, Stride: 0x1},
-		unicode.Range16{Lo: 0xc8e, Hi: 0xc90, Stride: 0x1},
-		unicode.Range16{Lo: 0xc92, Hi: 0xca8, Stride: 0x1},
-		unicode.Range16{Lo: 0xcaa, Hi: 0xcb3, Stride: 0x1},
-		unicode.Range16{Lo: 0xcb5, Hi: 0xcb9, Stride: 0x1},
-		unicode.Range16{Lo: 0xcbd, Hi: 0xcbd, Stride: 0x1},
-		unicode.Range16{Lo: 0xcde, Hi: 0xcde, Stride: 0x1},
-		unicode.Range16{Lo: 0xce0, Hi: 0xce1, Stride: 0x1},
-		unicode.Range16{Lo: 0xcf1, Hi: 0xcf2, Stride: 0x1},
-		unicode.Range16{Lo: 0xd05, Hi: 0xd0c, Stride: 0x1},
-		unicode.Range16{Lo: 0xd0e, Hi: 0xd10, Stride: 0x1},
-		unicode.Range16{Lo: 0xd12, Hi: 0xd3a, Stride: 0x1},
-		unicode.Range16{Lo: 0xd3d, Hi: 0xd3d, Stride: 0x1},
-		unicode.Range16{Lo: 0xd4e, Hi: 0xd4e, Stride: 0x1},
-		unicode.Range16{Lo: 0xd54, Hi: 0xd56, Stride: 0x1},
-		unicode.Range16{Lo: 0xd5f, Hi: 0xd61, Stride: 0x1},
-		unicode.Range16{Lo: 0xd7a, Hi: 0xd7f, Stride: 0x1},
-		unicode.Range16{Lo: 0xd85, Hi: 0xd96, Stride: 0x1},
-		unicode.Range16{Lo: 0xd9a, Hi: 0xdb1, Stride: 0x1},
-		unicode.Range16{Lo: 0xdb3, Hi: 0xdbb, Stride: 0x1},
-		unicode.Range16{Lo: 0xdbd, Hi: 0xdbd, Stride: 0x1},
-		unicode.Range16{Lo: 0xdc0, Hi: 0xdc6, Stride: 0x1},
-		unicode.Range16{Lo: 0xe01, Hi: 0xe30, Stride: 0x1},
-		unicode.Range16{Lo: 0xe32, Hi: 0xe33, Stride: 0x1},
-		unicode.Range16{Lo: 0xe40, Hi: 0xe45, Stride: 0x1},
-		unicode.Range16{Lo: 0xe46, Hi: 0xe46, Stride: 0x1},
-		unicode.Range16{Lo: 0xe81, Hi: 0xe82, Stride: 0x1},
-		unicode.Range16{Lo: 0xe84, Hi: 0xe84, Stride: 0x1},
-		unicode.Range16{Lo: 0xe86, Hi: 0xe8a, Stride: 0x1},
-		unicode.Range16{Lo: 0xe8c, Hi: 0xea3, Stride: 0x1},
-		unicode.Range16{Lo: 0xea5, Hi: 0xea5, Stride: 0x1},
-		unicode.Range16{Lo: 0xea7, Hi: 0xeb0, Stride: 0x1},
-		unicode.Range16{Lo: 0xeb2, Hi: 0xeb3, Stride: 0x1},
-		unicode.Range16{Lo: 0xebd, Hi: 0xebd, Stride: 0x1},
-		unicode.Range16{Lo: 0xec0, Hi: 0xec4, Stride: 0x1},
-		unicode.Range16{Lo: 0xec6, Hi: 0xec6, Stride: 0x1},
-		unicode.Range16{Lo: 0xedc, Hi: 0xedf, Stride: 0x1},
-		unicode.Range16{Lo: 0xf00, Hi: 0xf00, Stride: 0x1},
-		unicode.Range16{Lo: 0xf40, Hi: 0xf47, Stride: 0x1},
-		unicode.Range16{Lo: 0xf49, Hi: 0xf6c, Stride: 0x1},
-		unicode.Range16{Lo: 0xf88, Hi: 0xf8c, Stride: 0x1},
-		unicode.Range16{Lo: 0x1000, Hi: 0x102a, Stride: 0x1},
-		unicode.Range16{Lo: 0x103f, Hi: 0x103f, Stride: 0x1},
-		unicode.Range16{Lo: 0x1050, Hi: 0x1055, Stride: 0x1},
-		unicode.Range16{Lo: 0x105a, Hi: 0x105d, Stride: 0x1},
-		unicode.Range16{Lo: 0x1061, Hi: 0x1061, Stride: 0x1},
-		unicode.Range16{Lo: 0x1065, Hi: 0x1066, Stride: 0x1},
-		unicode.Range16{Lo: 0x106e, Hi: 0x1070, Stride: 0x1},
-		unicode.Range16{Lo: 0x1075, Hi: 0x1081, Stride: 0x1},
-		unicode.Range16{Lo: 0x108e, Hi: 0x108e, Stride: 0x1},
-		unicode.Range16{Lo: 0x10d0, Hi: 0x10fa, Stride: 0x1},
-		unicode.Range16{Lo: 0x10fc, Hi: 0x10fc, Stride: 0x1},
-		unicode.Range16{Lo: 0x10fd, Hi: 0x10ff, Stride: 0x1},
-		unicode.Range16{Lo: 0x1100, Hi: 0x1248, Stride: 0x1},
-		unicode.Range16{Lo: 0x124a, Hi: 0x124d, Stride: 0x1},
-		unicode.Range16{Lo: 0x1250, Hi: 0x1256, Stride: 0x1},
-		unicode.Range16{Lo: 0x1258, Hi: 0x1258, Stride: 0x1},
-		unicode.Range16{Lo: 0x125a, Hi: 0x125d, Stride: 0x1},
-		unicode.Range16{Lo: 0x1260, Hi: 0x1288, Stride: 0x1},
-		unicode.Range16{Lo: 0x128a, Hi: 0x128d, Stride: 0x1},
-		unicode.Range16{Lo: 0x1290, Hi: 0x12b0, Stride: 0x1},
-		unicode.Range16{Lo: 0x12b2, Hi: 0x12b5, Stride: 0x1},
-		unicode.Range16{Lo: 0x12b8, Hi: 0x12be, Stride: 0x1},
-		unicode.Range16{Lo: 0x12c0, Hi: 0x12c0, Stride: 0x1},
-		unicode.Range16{Lo: 0x12c2, Hi: 0x12c5, Stride: 0x1},
-		unicode.Range16{Lo: 0x12c8, Hi: 0x12d6, Stride: 0x1},
-		unicode.Range16{Lo: 0x12d8, Hi: 0x1310, Stride: 0x1},
-		unicode.Range16{Lo: 0x1312, Hi: 0x1315, Stride: 0x1},
-		unicode.Range16{Lo: 0x1318, Hi: 0x135a, Stride: 0x1},
-		unicode.Range16{Lo: 0x1380, Hi: 0x138f, Stride: 0x1},
-		unicode.Range16{Lo: 0x1401, Hi: 0x166c, Stride: 0x1},
-		unicode.Range16{Lo: 0x166f, Hi: 0x167f, Stride: 0x1},
-		unicode.Range16{Lo: 0x1681, Hi: 0x169a, Stride: 0x1},
-		unicode.Range16{Lo: 0x16a0, Hi: 0x16ea, Stride: 0x1},
-		unicode.Range16{Lo: 0x16ee, Hi: 0x16f0, Stride: 0x1},
-		unicode.Range16{Lo: 0x16f1, Hi: 0x16f8, Stride: 0x1},
-		unicode.Range16{Lo: 0x1700, Hi: 0x170c, Stride: 0x1},
-		unicode.Range16{Lo: 0x170e, Hi: 0x1711, Stride: 0x1},
-		unicode.Range16{Lo: 0x1720, Hi: 0x1731, Stride: 0x1},
-		unicode.Range16{Lo: 0x1740, Hi: 0x1751, Stride: 0x1},
-		unicode.Range16{Lo: 0x1760, Hi: 0x176c, Stride: 0x1},
-		unicode.Range16{Lo: 0x176e, Hi: 0x1770, Stride: 0x1},
-		unicode.Range16{Lo: 0x1780, Hi: 0x17b3, Stride: 0x1},
-		unicode.Range16{Lo: 0x17d7, Hi: 0x17d7, Stride: 0x1},
-		unicode.Range16{Lo: 0x17dc, Hi: 0x17dc, Stride: 0x1},
-		unicode.Range16{Lo: 0x1820, Hi: 0x1842, Stride: 0x1},
-		unicode.Range16{Lo: 0x1843, Hi: 0x1843, Stride: 0x1},
-		unicode.Range16{Lo: 0x1844, Hi: 0x1878, Stride: 0x1},
-		unicode.Range16{Lo: 0x1880, Hi: 0x1884, Stride: 0x1},
-		unicode.Range16{Lo: 0x1887, Hi: 0x18a8, Stride: 0x1},
-		unicode.Range16{Lo: 0x18aa, Hi: 0x18aa, Stride: 0x1},
-		unicode.Range16{Lo: 0x18b0, Hi: 0x18f5, Stride: 0x1},
-		unicode.Range16{Lo: 0x1900, Hi: 0x191e, Stride: 0x1},
-		unicode.Range16{Lo: 0x1950, Hi: 0x196d, Stride: 0x1},
-		unicode.Range16{Lo: 0x1970, Hi: 0x1974, Stride: 0x1},
-		unicode.Range16{Lo: 0x1980, Hi: 0x19ab, Stride: 0x1},
-		unicode.Range16{Lo: 0x19b0, Hi: 0x19c9, Stride: 0x1},
-		unicode.Range16{Lo: 0x1a00, Hi: 0x1a16, Stride: 0x1},
-		unicode.Range16{Lo: 0x1a20, Hi: 0x1a54, Stride: 0x1},
-		unicode.Range16{Lo: 0x1aa7, Hi: 0x1aa7, Stride: 0x1},
-		unicode.Range16{Lo: 0x1b05, Hi: 0x1b33, Stride: 0x1},
-		unicode.Range16{Lo: 0x1b45, Hi: 0x1b4b, Stride: 0x1},
-		unicode.Range16{Lo: 0x1b83, Hi: 0x1ba0, Stride: 0x1},
-		unicode.Range16{Lo: 0x1bae, Hi: 0x1baf, Stride: 0x1},
-		unicode.Range16{Lo: 0x1bba, Hi: 0x1be5, Stride: 0x1},
-		unicode.Range16{Lo: 0x1c00, Hi: 0x1c23, Stride: 0x1},
-		unicode.Range16{Lo: 0x1c4d, Hi: 0x1c4f, Stride: 0x1},
-		unicode.Range16{Lo: 0x1c5a, Hi: 0x1c77, Stride: 0x1},
-		unicode.Range16{Lo: 0x1c78, Hi: 0x1c7d, Stride: 0x1},
-		unicode.Range16{Lo: 0x1c90, Hi: 0x1cba, Stride: 0x1},
-		unicode.Range16{Lo: 0x1cbd, Hi: 0x1cbf, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ce9, Hi: 0x1cec, Stride: 0x1},
-		unicode.Range16{Lo: 0x1cee, Hi: 0x1cf3, Stride: 0x1},
-		unicode.Range16{Lo: 0x1cf5, Hi: 0x1cf6, Stride: 0x1},
-		unicode.Range16{Lo: 0x1cfa, Hi: 0x1cfa, Stride: 0x1},
-		unicode.Range16{Lo: 0x2135, Hi: 0x2138, Stride: 0x1},
-		unicode.Range16{Lo: 0x2180, Hi: 0x2182, Stride: 0x1},
-		unicode.Range16{Lo: 0x2185, Hi: 0x2188, Stride: 0x1},
-		unicode.Range16{Lo: 0x2d30, Hi: 0x2d67, Stride: 0x1},
-		unicode.Range16{Lo: 0x2d6f, Hi: 0x2d6f, Stride: 0x1},
-		unicode.Range16{Lo: 0x2d80, Hi: 0x2d96, Stride: 0x1},
-		unicode.Range16{Lo: 0x2da0, Hi: 0x2da6, Stride: 0x1},
-		unicode.Range16{Lo: 0x2da8, Hi: 0x2dae, Stride: 0x1},
-		unicode.Range16{Lo: 0x2db0, Hi: 0x2db6, Stride: 0x1},
-		unicode.Range16{Lo: 0x2db8, Hi: 0x2dbe, Stride: 0x1},
-		unicode.Range16{Lo: 0x2dc0, Hi: 0x2dc6, Stride: 0x1},
-		unicode.Range16{Lo: 0x2dc8, Hi: 0x2dce, Stride: 0x1},
-		unicode.Range16{Lo: 0x2dd0, Hi: 0x2dd6, Stride: 0x1},
-		unicode.Range16{Lo: 0x2dd8, Hi: 0x2dde, Stride: 0x1},
-		unicode.Range16{Lo: 0x2e2f, Hi: 0x2e2f, Stride: 0x1},
-		unicode.Range16{Lo: 0x3005, Hi: 0x3005, Stride: 0x1},
-		unicode.Range16{Lo: 0x3006, Hi: 0x3006, Stride: 0x1},
-		unicode.Range16{Lo: 0x3007, Hi: 0x3007, Stride: 0x1},
-		unicode.Range16{Lo: 0x3021, Hi: 0x3029, Stride: 0x1},
-		unicode.Range16{Lo: 0x3031, Hi: 0x3035, Stride: 0x1},
-		unicode.Range16{Lo: 0x3038, Hi: 0x303a, Stride: 0x1},
-		unicode.Range16{Lo: 0x303b, Hi: 0x303b, Stride: 0x1},
-		unicode.Range16{Lo: 0x303c, Hi: 0x303c, Stride: 0x1},
-		unicode.Range16{Lo: 0x3041, Hi: 0x3096, Stride: 0x1},
-		unicode.Range16{Lo: 0x309d, Hi: 0x309e, Stride: 0x1},
-		unicode.Range16{Lo: 0x309f, Hi: 0x309f, Stride: 0x1},
-		unicode.Range16{Lo: 0x30a1, Hi: 0x30fa, Stride: 0x1},
-		unicode.Range16{Lo: 0x30fc, Hi: 0x30fe, Stride: 0x1},
-		unicode.Range16{Lo: 0x30ff, Hi: 0x30ff, Stride: 0x1},
-		unicode.Range16{Lo: 0x3105, Hi: 0x312f, Stride: 0x1},
-		unicode.Range16{Lo: 0x3131, Hi: 0x318e, Stride: 0x1},
-		unicode.Range16{Lo: 0x31a0, Hi: 0x31ba, Stride: 0x1},
-		unicode.Range16{Lo: 0x31f0, Hi: 0x31ff, Stride: 0x1},
-		unicode.Range16{Lo: 0x3400, Hi: 0x4db5, Stride: 0x1},
-		unicode.Range16{Lo: 0x4e00, Hi: 0x9fef, Stride: 0x1},
-		unicode.Range16{Lo: 0xa000, Hi: 0xa014, Stride: 0x1},
-		unicode.Range16{Lo: 0xa015, Hi: 0xa015, Stride: 0x1},
-		unicode.Range16{Lo: 0xa016, Hi: 0xa48c, Stride: 0x1},
-		unicode.Range16{Lo: 0xa4d0, Hi: 0xa4f7, Stride: 0x1},
-		unicode.Range16{Lo: 0xa4f8, Hi: 0xa4fd, Stride: 0x1},
-		unicode.Range16{Lo: 0xa500, Hi: 0xa60b, Stride: 0x1},
-		unicode.Range16{Lo: 0xa60c, Hi: 0xa60c, Stride: 0x1},
-		unicode.Range16{Lo: 0xa610, Hi: 0xa61f, Stride: 0x1},
-		unicode.Range16{Lo: 0xa62a, Hi: 0xa62b, Stride: 0x1},
-		unicode.Range16{Lo: 0xa66e, Hi: 0xa66e, Stride: 0x1},
-		unicode.Range16{Lo: 0xa67f, Hi: 0xa67f, Stride: 0x1},
-		unicode.Range16{Lo: 0xa6a0, Hi: 0xa6e5, Stride: 0x1},
-		unicode.Range16{Lo: 0xa6e6, Hi: 0xa6ef, Stride: 0x1},
-		unicode.Range16{Lo: 0xa717, Hi: 0xa71f, Stride: 0x1},
-		unicode.Range16{Lo: 0xa788, Hi: 0xa788, Stride: 0x1},
-		unicode.Range16{Lo: 0xa78f, Hi: 0xa78f, Stride: 0x1},
-		unicode.Range16{Lo: 0xa7f7, Hi: 0xa7f7, Stride: 0x1},
-		unicode.Range16{Lo: 0xa7fb, Hi: 0xa801, Stride: 0x1},
-		unicode.Range16{Lo: 0xa803, Hi: 0xa805, Stride: 0x1},
-		unicode.Range16{Lo: 0xa807, Hi: 0xa80a, Stride: 0x1},
-		unicode.Range16{Lo: 0xa80c, Hi: 0xa822, Stride: 0x1},
-		unicode.Range16{Lo: 0xa840, Hi: 0xa873, Stride: 0x1},
-		unicode.Range16{Lo: 0xa882, Hi: 0xa8b3, Stride: 0x1},
-		unicode.Range16{Lo: 0xa8f2, Hi: 0xa8f7, Stride: 0x1},
-		unicode.Range16{Lo: 0xa8fb, Hi: 0xa8fb, Stride: 0x1},
-		unicode.Range16{Lo: 0xa8fd, Hi: 0xa8fe, Stride: 0x1},
-		unicode.Range16{Lo: 0xa90a, Hi: 0xa925, Stride: 0x1},
-		unicode.Range16{Lo: 0xa930, Hi: 0xa946, Stride: 0x1},
-		unicode.Range16{Lo: 0xa960, Hi: 0xa97c, Stride: 0x1},
-		unicode.Range16{Lo: 0xa984, Hi: 0xa9b2, Stride: 0x1},
-		unicode.Range16{Lo: 0xa9cf, Hi: 0xa9cf, Stride: 0x1},
-		unicode.Range16{Lo: 0xa9e0, Hi: 0xa9e4, Stride: 0x1},
-		unicode.Range16{Lo: 0xa9e6, Hi: 0xa9e6, Stride: 0x1},
-		unicode.Range16{Lo: 0xa9e7, Hi: 0xa9ef, Stride: 0x1},
-		unicode.Range16{Lo: 0xa9fa, Hi: 0xa9fe, Stride: 0x1},
-		unicode.Range16{Lo: 0xaa00, Hi: 0xaa28, Stride: 0x1},
-		unicode.Range16{Lo: 0xaa40, Hi: 0xaa42, Stride: 0x1},
-		unicode.Range16{Lo: 0xaa44, Hi: 0xaa4b, Stride: 0x1},
-		unicode.Range16{Lo: 0xaa60, Hi: 0xaa6f, Stride: 0x1},
-		unicode.Range16{Lo: 0xaa70, Hi: 0xaa70, Stride: 0x1},
-		unicode.Range16{Lo: 0xaa71, Hi: 0xaa76, Stride: 0x1},
-		unicode.Range16{Lo: 0xaa7a, Hi: 0xaa7a, Stride: 0x1},
-		unicode.Range16{Lo: 0xaa7e, Hi: 0xaaaf, Stride: 0x1},
-		unicode.Range16{Lo: 0xaab1, Hi: 0xaab1, Stride: 0x1},
-		unicode.Range16{Lo: 0xaab5, Hi: 0xaab6, Stride: 0x1},
-		unicode.Range16{Lo: 0xaab9, Hi: 0xaabd, Stride: 0x1},
-		unicode.Range16{Lo: 0xaac0, Hi: 0xaac0, Stride: 0x1},
-		unicode.Range16{Lo: 0xaac2, Hi: 0xaac2, Stride: 0x1},
-		unicode.Range16{Lo: 0xaadb, Hi: 0xaadc, Stride: 0x1},
-		unicode.Range16{Lo: 0xaadd, Hi: 0xaadd, Stride: 0x1},
-		unicode.Range16{Lo: 0xaae0, Hi: 0xaaea, Stride: 0x1},
-		unicode.Range16{Lo: 0xaaf2, Hi: 0xaaf2, Stride: 0x1},
-		unicode.Range16{Lo: 0xaaf3, Hi: 0xaaf4, Stride: 0x1},
-		unicode.Range16{Lo: 0xab01, Hi: 0xab06, Stride: 0x1},
-		unicode.Range16{Lo: 0xab09, Hi: 0xab0e, Stride: 0x1},
-		unicode.Range16{Lo: 0xab11, Hi: 0xab16, Stride: 0x1},
-		unicode.Range16{Lo: 0xab20, Hi: 0xab26, Stride: 0x1},
-		unicode.Range16{Lo: 0xab28, Hi: 0xab2e, Stride: 0x1},
-		unicode.Range16{Lo: 0xabc0, Hi: 0xabe2, Stride: 0x1},
-		unicode.Range16{Lo: 0xac00, Hi: 0xd7a3, Stride: 0x1},
-		unicode.Range16{Lo: 0xd7b0, Hi: 0xd7c6, Stride: 0x1},
-		unicode.Range16{Lo: 0xd7cb, Hi: 0xd7fb, Stride: 0x1},
-		unicode.Range16{Lo: 0xf900, Hi: 0xfa6d, Stride: 0x1},
-		unicode.Range16{Lo: 0xfa70, Hi: 0xfad9, Stride: 0x1},
-		unicode.Range16{Lo: 0xfb1d, Hi: 0xfb1d, Stride: 0x1},
-		unicode.Range16{Lo: 0xfb1f, Hi: 0xfb28, Stride: 0x1},
-		unicode.Range16{Lo: 0xfb2a, Hi: 0xfb36, Stride: 0x1},
-		unicode.Range16{Lo: 0xfb38, Hi: 0xfb3c, Stride: 0x1},
-		unicode.Range16{Lo: 0xfb3e, Hi: 0xfb3e, Stride: 0x1},
-		unicode.Range16{Lo: 0xfb40, Hi: 0xfb41, Stride: 0x1},
-		unicode.Range16{Lo: 0xfb43, Hi: 0xfb44, Stride: 0x1},
-		unicode.Range16{Lo: 0xfb46, Hi: 0xfbb1, Stride: 0x1},
-		unicode.Range16{Lo: 0xfbd3, Hi: 0xfd3d, Stride: 0x1},
-		unicode.Range16{Lo: 0xfd50, Hi: 0xfd8f, Stride: 0x1},
-		unicode.Range16{Lo: 0xfd92, Hi: 0xfdc7, Stride: 0x1},
-		unicode.Range16{Lo: 0xfdf0, Hi: 0xfdfb, Stride: 0x1},
-		unicode.Range16{Lo: 0xfe70, Hi: 0xfe74, Stride: 0x1},
-		unicode.Range16{Lo: 0xfe76, Hi: 0xfefc, Stride: 0x1},
-		unicode.Range16{Lo: 0xff66, Hi: 0xff6f, Stride: 0x1},
-		unicode.Range16{Lo: 0xff70, Hi: 0xff70, Stride: 0x1},
-		unicode.Range16{Lo: 0xff71, Hi: 0xff9d, Stride: 0x1},
-		unicode.Range16{Lo: 0xffa0, Hi: 0xffbe, Stride: 0x1},
-		unicode.Range16{Lo: 0xffc2, Hi: 0xffc7, Stride: 0x1},
-		unicode.Range16{Lo: 0xffca, Hi: 0xffcf, Stride: 0x1},
-		unicode.Range16{Lo: 0xffd2, Hi: 0xffd7, Stride: 0x1},
-		unicode.Range16{Lo: 0xffda, Hi: 0xffdc, Stride: 0x1},
-	},
-	R32: []unicode.Range32{
-		unicode.Range32{Lo: 0x10000, Hi: 0x1000b, Stride: 0x1},
-		unicode.Range32{Lo: 0x1000d, Hi: 0x10026, Stride: 0x1},
-		unicode.Range32{Lo: 0x10028, Hi: 0x1003a, Stride: 0x1},
-		unicode.Range32{Lo: 0x1003c, Hi: 0x1003d, Stride: 0x1},
-		unicode.Range32{Lo: 0x1003f, Hi: 0x1004d, Stride: 0x1},
-		unicode.Range32{Lo: 0x10050, Hi: 0x1005d, Stride: 0x1},
-		unicode.Range32{Lo: 0x10080, Hi: 0x100fa, Stride: 0x1},
-		unicode.Range32{Lo: 0x10140, Hi: 0x10174, Stride: 0x1},
-		unicode.Range32{Lo: 0x10280, Hi: 0x1029c, Stride: 0x1},
-		unicode.Range32{Lo: 0x102a0, Hi: 0x102d0, Stride: 0x1},
-		unicode.Range32{Lo: 0x10300, Hi: 0x1031f, Stride: 0x1},
-		unicode.Range32{Lo: 0x1032d, Hi: 0x10340, Stride: 0x1},
-		unicode.Range32{Lo: 0x10341, Hi: 0x10341, Stride: 0x1},
-		unicode.Range32{Lo: 0x10342, Hi: 0x10349, Stride: 0x1},
-		unicode.Range32{Lo: 0x1034a, Hi: 0x1034a, Stride: 0x1},
-		unicode.Range32{Lo: 0x10350, Hi: 0x10375, Stride: 0x1},
-		unicode.Range32{Lo: 0x10380, Hi: 0x1039d, Stride: 0x1},
-		unicode.Range32{Lo: 0x103a0, Hi: 0x103c3, Stride: 0x1},
-		unicode.Range32{Lo: 0x103c8, Hi: 0x103cf, Stride: 0x1},
-		unicode.Range32{Lo: 0x103d1, Hi: 0x103d5, Stride: 0x1},
-		unicode.Range32{Lo: 0x10450, Hi: 0x1049d, Stride: 0x1},
-		unicode.Range32{Lo: 0x10500, Hi: 0x10527, Stride: 0x1},
-		unicode.Range32{Lo: 0x10530, Hi: 0x10563, Stride: 0x1},
-		unicode.Range32{Lo: 0x10600, Hi: 0x10736, Stride: 0x1},
-		unicode.Range32{Lo: 0x10740, Hi: 0x10755, Stride: 0x1},
-		unicode.Range32{Lo: 0x10760, Hi: 0x10767, Stride: 0x1},
-		unicode.Range32{Lo: 0x10800, Hi: 0x10805, Stride: 0x1},
-		unicode.Range32{Lo: 0x10808, Hi: 0x10808, Stride: 0x1},
-		unicode.Range32{Lo: 0x1080a, Hi: 0x10835, Stride: 0x1},
-		unicode.Range32{Lo: 0x10837, Hi: 0x10838, Stride: 0x1},
-		unicode.Range32{Lo: 0x1083c, Hi: 0x1083c, Stride: 0x1},
-		unicode.Range32{Lo: 0x1083f, Hi: 0x10855, Stride: 0x1},
-		unicode.Range32{Lo: 0x10860, Hi: 0x10876, Stride: 0x1},
-		unicode.Range32{Lo: 0x10880, Hi: 0x1089e, Stride: 0x1},
-		unicode.Range32{Lo: 0x108e0, Hi: 0x108f2, Stride: 0x1},
-		unicode.Range32{Lo: 0x108f4, Hi: 0x108f5, Stride: 0x1},
-		unicode.Range32{Lo: 0x10900, Hi: 0x10915, Stride: 0x1},
-		unicode.Range32{Lo: 0x10920, Hi: 0x10939, Stride: 0x1},
-		unicode.Range32{Lo: 0x10980, Hi: 0x109b7, Stride: 0x1},
-		unicode.Range32{Lo: 0x109be, Hi: 0x109bf, Stride: 0x1},
-		unicode.Range32{Lo: 0x10a00, Hi: 0x10a00, Stride: 0x1},
-		unicode.Range32{Lo: 0x10a10, Hi: 0x10a13, Stride: 0x1},
-		unicode.Range32{Lo: 0x10a15, Hi: 0x10a17, Stride: 0x1},
-		unicode.Range32{Lo: 0x10a19, Hi: 0x10a35, Stride: 0x1},
-		unicode.Range32{Lo: 0x10a60, Hi: 0x10a7c, Stride: 0x1},
-		unicode.Range32{Lo: 0x10a80, Hi: 0x10a9c, Stride: 0x1},
-		unicode.Range32{Lo: 0x10ac0, Hi: 0x10ac7, Stride: 0x1},
-		unicode.Range32{Lo: 0x10ac9, Hi: 0x10ae4, Stride: 0x1},
-		unicode.Range32{Lo: 0x10b00, Hi: 0x10b35, Stride: 0x1},
-		unicode.Range32{Lo: 0x10b40, Hi: 0x10b55, Stride: 0x1},
-		unicode.Range32{Lo: 0x10b60, Hi: 0x10b72, Stride: 0x1},
-		unicode.Range32{Lo: 0x10b80, Hi: 0x10b91, Stride: 0x1},
-		unicode.Range32{Lo: 0x10c00, Hi: 0x10c48, Stride: 0x1},
-		unicode.Range32{Lo: 0x10d00, Hi: 0x10d23, Stride: 0x1},
-		unicode.Range32{Lo: 0x10f00, Hi: 0x10f1c, Stride: 0x1},
-		unicode.Range32{Lo: 0x10f27, Hi: 0x10f27, Stride: 0x1},
-		unicode.Range32{Lo: 0x10f30, Hi: 0x10f45, Stride: 0x1},
-		unicode.Range32{Lo: 0x10fe0, Hi: 0x10ff6, Stride: 0x1},
-		unicode.Range32{Lo: 0x11003, Hi: 0x11037, Stride: 0x1},
-		unicode.Range32{Lo: 0x11083, Hi: 0x110af, Stride: 0x1},
-		unicode.Range32{Lo: 0x110d0, Hi: 0x110e8, Stride: 0x1},
-		unicode.Range32{Lo: 0x11103, Hi: 0x11126, Stride: 0x1},
-		unicode.Range32{Lo: 0x11144, Hi: 0x11144, Stride: 0x1},
-		unicode.Range32{Lo: 0x11150, Hi: 0x11172, Stride: 0x1},
-		unicode.Range32{Lo: 0x11176, Hi: 0x11176, Stride: 0x1},
-		unicode.Range32{Lo: 0x11183, Hi: 0x111b2, Stride: 0x1},
-		unicode.Range32{Lo: 0x111c1, Hi: 0x111c4, Stride: 0x1},
-		unicode.Range32{Lo: 0x111da, Hi: 0x111da, Stride: 0x1},
-		unicode.Range32{Lo: 0x111dc, Hi: 0x111dc, Stride: 0x1},
-		unicode.Range32{Lo: 0x11200, Hi: 0x11211, Stride: 0x1},
-		unicode.Range32{Lo: 0x11213, Hi: 0x1122b, Stride: 0x1},
-		unicode.Range32{Lo: 0x11280, Hi: 0x11286, Stride: 0x1},
-		unicode.Range32{Lo: 0x11288, Hi: 0x11288, Stride: 0x1},
-		unicode.Range32{Lo: 0x1128a, Hi: 0x1128d, Stride: 0x1},
-		unicode.Range32{Lo: 0x1128f, Hi: 0x1129d, Stride: 0x1},
-		unicode.Range32{Lo: 0x1129f, Hi: 0x112a8, Stride: 0x1},
-		unicode.Range32{Lo: 0x112b0, Hi: 0x112de, Stride: 0x1},
-		unicode.Range32{Lo: 0x11305, Hi: 0x1130c, Stride: 0x1},
-		unicode.Range32{Lo: 0x1130f, Hi: 0x11310, Stride: 0x1},
-		unicode.Range32{Lo: 0x11313, Hi: 0x11328, Stride: 0x1},
-		unicode.Range32{Lo: 0x1132a, Hi: 0x11330, Stride: 0x1},
-		unicode.Range32{Lo: 0x11332, Hi: 0x11333, Stride: 0x1},
-		unicode.Range32{Lo: 0x11335, Hi: 0x11339, Stride: 0x1},
-		unicode.Range32{Lo: 0x1133d, Hi: 0x1133d, Stride: 0x1},
-		unicode.Range32{Lo: 0x11350, Hi: 0x11350, Stride: 0x1},
-		unicode.Range32{Lo: 0x1135d, Hi: 0x11361, Stride: 0x1},
-		unicode.Range32{Lo: 0x11400, Hi: 0x11434, Stride: 0x1},
-		unicode.Range32{Lo: 0x11447, Hi: 0x1144a, Stride: 0x1},
-		unicode.Range32{Lo: 0x1145f, Hi: 0x1145f, Stride: 0x1},
-		unicode.Range32{Lo: 0x11480, Hi: 0x114af, Stride: 0x1},
-		unicode.Range32{Lo: 0x114c4, Hi: 0x114c5, Stride: 0x1},
-		unicode.Range32{Lo: 0x114c7, Hi: 0x114c7, Stride: 0x1},
-		unicode.Range32{Lo: 0x11580, Hi: 0x115ae, Stride: 0x1},
-		unicode.Range32{Lo: 0x115d8, Hi: 0x115db, Stride: 0x1},
-		unicode.Range32{Lo: 0x11600, Hi: 0x1162f, Stride: 0x1},
-		unicode.Range32{Lo: 0x11644, Hi: 0x11644, Stride: 0x1},
-		unicode.Range32{Lo: 0x11680, Hi: 0x116aa, Stride: 0x1},
-		unicode.Range32{Lo: 0x116b8, Hi: 0x116b8, Stride: 0x1},
-		unicode.Range32{Lo: 0x11700, Hi: 0x1171a, Stride: 0x1},
-		unicode.Range32{Lo: 0x11800, Hi: 0x1182b, Stride: 0x1},
-		unicode.Range32{Lo: 0x118ff, Hi: 0x118ff, Stride: 0x1},
-		unicode.Range32{Lo: 0x119a0, Hi: 0x119a7, Stride: 0x1},
-		unicode.Range32{Lo: 0x119aa, Hi: 0x119d0, Stride: 0x1},
-		unicode.Range32{Lo: 0x119e1, Hi: 0x119e1, Stride: 0x1},
-		unicode.Range32{Lo: 0x119e3, Hi: 0x119e3, Stride: 0x1},
-		unicode.Range32{Lo: 0x11a00, Hi: 0x11a00, Stride: 0x1},
-		unicode.Range32{Lo: 0x11a0b, Hi: 0x11a32, Stride: 0x1},
-		unicode.Range32{Lo: 0x11a3a, Hi: 0x11a3a, Stride: 0x1},
-		unicode.Range32{Lo: 0x11a50, Hi: 0x11a50, Stride: 0x1},
-		unicode.Range32{Lo: 0x11a5c, Hi: 0x11a89, Stride: 0x1},
-		unicode.Range32{Lo: 0x11a9d, Hi: 0x11a9d, Stride: 0x1},
-		unicode.Range32{Lo: 0x11ac0, Hi: 0x11af8, Stride: 0x1},
-		unicode.Range32{Lo: 0x11c00, Hi: 0x11c08, Stride: 0x1},
-		unicode.Range32{Lo: 0x11c0a, Hi: 0x11c2e, Stride: 0x1},
-		unicode.Range32{Lo: 0x11c40, Hi: 0x11c40, Stride: 0x1},
-		unicode.Range32{Lo: 0x11c72, Hi: 0x11c8f, Stride: 0x1},
-		unicode.Range32{Lo: 0x11d00, Hi: 0x11d06, Stride: 0x1},
-		unicode.Range32{Lo: 0x11d08, Hi: 0x11d09, Stride: 0x1},
-		unicode.Range32{Lo: 0x11d0b, Hi: 0x11d30, Stride: 0x1},
-		unicode.Range32{Lo: 0x11d46, Hi: 0x11d46, Stride: 0x1},
-		unicode.Range32{Lo: 0x11d60, Hi: 0x11d65, Stride: 0x1},
-		unicode.Range32{Lo: 0x11d67, Hi: 0x11d68, Stride: 0x1},
-		unicode.Range32{Lo: 0x11d6a, Hi: 0x11d89, Stride: 0x1},
-		unicode.Range32{Lo: 0x11d98, Hi: 0x11d98, Stride: 0x1},
-		unicode.Range32{Lo: 0x11ee0, Hi: 0x11ef2, Stride: 0x1},
-		unicode.Range32{Lo: 0x12000, Hi: 0x12399, Stride: 0x1},
-		unicode.Range32{Lo: 0x12400, Hi: 0x1246e, Stride: 0x1},
-		unicode.Range32{Lo: 0x12480, Hi: 0x12543, Stride: 0x1},
-		unicode.Range32{Lo: 0x13000, Hi: 0x1342e, Stride: 0x1},
-		unicode.Range32{Lo: 0x14400, Hi: 0x14646, Stride: 0x1},
-		unicode.Range32{Lo: 0x16800, Hi: 0x16a38, Stride: 0x1},
-		unicode.Range32{Lo: 0x16a40, Hi: 0x16a5e, Stride: 0x1},
-		unicode.Range32{Lo: 0x16ad0, Hi: 0x16aed, Stride: 0x1},
-		unicode.Range32{Lo: 0x16b00, Hi: 0x16b2f, Stride: 0x1},
-		unicode.Range32{Lo: 0x16b40, Hi: 0x16b43, Stride: 0x1},
-		unicode.Range32{Lo: 0x16b63, Hi: 0x16b77, Stride: 0x1},
-		unicode.Range32{Lo: 0x16b7d, Hi: 0x16b8f, Stride: 0x1},
-		unicode.Range32{Lo: 0x16f00, Hi: 0x16f4a, Stride: 0x1},
-		unicode.Range32{Lo: 0x16f50, Hi: 0x16f50, Stride: 0x1},
-		unicode.Range32{Lo: 0x16f93, Hi: 0x16f9f, Stride: 0x1},
-		unicode.Range32{Lo: 0x16fe0, Hi: 0x16fe1, Stride: 0x1},
-		unicode.Range32{Lo: 0x16fe3, Hi: 0x16fe3, Stride: 0x1},
-		unicode.Range32{Lo: 0x17000, Hi: 0x187f7, Stride: 0x1},
-		unicode.Range32{Lo: 0x18800, Hi: 0x18af2, Stride: 0x1},
-		unicode.Range32{Lo: 0x1b000, Hi: 0x1b11e, Stride: 0x1},
-		unicode.Range32{Lo: 0x1b150, Hi: 0x1b152, Stride: 0x1},
-		unicode.Range32{Lo: 0x1b164, Hi: 0x1b167, Stride: 0x1},
-		unicode.Range32{Lo: 0x1b170, Hi: 0x1b2fb, Stride: 0x1},
-		unicode.Range32{Lo: 0x1bc00, Hi: 0x1bc6a, Stride: 0x1},
-		unicode.Range32{Lo: 0x1bc70, Hi: 0x1bc7c, Stride: 0x1},
-		unicode.Range32{Lo: 0x1bc80, Hi: 0x1bc88, Stride: 0x1},
-		unicode.Range32{Lo: 0x1bc90, Hi: 0x1bc99, Stride: 0x1},
-		unicode.Range32{Lo: 0x1e100, Hi: 0x1e12c, Stride: 0x1},
-		unicode.Range32{Lo: 0x1e137, Hi: 0x1e13d, Stride: 0x1},
-		unicode.Range32{Lo: 0x1e14e, Hi: 0x1e14e, Stride: 0x1},
-		unicode.Range32{Lo: 0x1e2c0, Hi: 0x1e2eb, Stride: 0x1},
-		unicode.Range32{Lo: 0x1e800, Hi: 0x1e8c4, Stride: 0x1},
-		unicode.Range32{Lo: 0x1e94b, Hi: 0x1e94b, Stride: 0x1},
-		unicode.Range32{Lo: 0x1ee00, Hi: 0x1ee03, Stride: 0x1},
-		unicode.Range32{Lo: 0x1ee05, Hi: 0x1ee1f, Stride: 0x1},
-		unicode.Range32{Lo: 0x1ee21, Hi: 0x1ee22, Stride: 0x1},
-		unicode.Range32{Lo: 0x1ee24, Hi: 0x1ee24, Stride: 0x1},
-		unicode.Range32{Lo: 0x1ee27, Hi: 0x1ee27, Stride: 0x1},
-		unicode.Range32{Lo: 0x1ee29, Hi: 0x1ee32, Stride: 0x1},
-		unicode.Range32{Lo: 0x1ee34, Hi: 0x1ee37, Stride: 0x1},
-		unicode.Range32{Lo: 0x1ee39, Hi: 0x1ee39, Stride: 0x1},
-		unicode.Range32{Lo: 0x1ee3b, Hi: 0x1ee3b, Stride: 0x1},
-		unicode.Range32{Lo: 0x1ee42, Hi: 0x1ee42, Stride: 0x1},
-		unicode.Range32{Lo: 0x1ee47, Hi: 0x1ee47, Stride: 0x1},
-		unicode.Range32{Lo: 0x1ee49, Hi: 0x1ee49, Stride: 0x1},
-		unicode.Range32{Lo: 0x1ee4b, Hi: 0x1ee4b, Stride: 0x1},
-		unicode.Range32{Lo: 0x1ee4d, Hi: 0x1ee4f, Stride: 0x1},
-		unicode.Range32{Lo: 0x1ee51, Hi: 0x1ee52, Stride: 0x1},
-		unicode.Range32{Lo: 0x1ee54, Hi: 0x1ee54, Stride: 0x1},
-		unicode.Range32{Lo: 0x1ee57, Hi: 0x1ee57, Stride: 0x1},
-		unicode.Range32{Lo: 0x1ee59, Hi: 0x1ee59, Stride: 0x1},
-		unicode.Range32{Lo: 0x1ee5b, Hi: 0x1ee5b, Stride: 0x1},
-		unicode.Range32{Lo: 0x1ee5d, Hi: 0x1ee5d, Stride: 0x1},
-		unicode.Range32{Lo: 0x1ee5f, Hi: 0x1ee5f, Stride: 0x1},
-		unicode.Range32{Lo: 0x1ee61, Hi: 0x1ee62, Stride: 0x1},
-		unicode.Range32{Lo: 0x1ee64, Hi: 0x1ee64, Stride: 0x1},
-		unicode.Range32{Lo: 0x1ee67, Hi: 0x1ee6a, Stride: 0x1},
-		unicode.Range32{Lo: 0x1ee6c, Hi: 0x1ee72, Stride: 0x1},
-		unicode.Range32{Lo: 0x1ee74, Hi: 0x1ee77, Stride: 0x1},
-		unicode.Range32{Lo: 0x1ee79, Hi: 0x1ee7c, Stride: 0x1},
-		unicode.Range32{Lo: 0x1ee7e, Hi: 0x1ee7e, Stride: 0x1},
-		unicode.Range32{Lo: 0x1ee80, Hi: 0x1ee89, Stride: 0x1},
-		unicode.Range32{Lo: 0x1ee8b, Hi: 0x1ee9b, Stride: 0x1},
-		unicode.Range32{Lo: 0x1eea1, Hi: 0x1eea3, Stride: 0x1},
-		unicode.Range32{Lo: 0x1eea5, Hi: 0x1eea9, Stride: 0x1},
-		unicode.Range32{Lo: 0x1eeab, Hi: 0x1eebb, Stride: 0x1},
-		unicode.Range32{Lo: 0x20000, Hi: 0x2a6d6, Stride: 0x1},
-		unicode.Range32{Lo: 0x2a700, Hi: 0x2b734, Stride: 0x1},
-		unicode.Range32{Lo: 0x2b740, Hi: 0x2b81d, Stride: 0x1},
-		unicode.Range32{Lo: 0x2b820, Hi: 0x2cea1, Stride: 0x1},
-		unicode.Range32{Lo: 0x2ceb0, Hi: 0x2ebe0, Stride: 0x1},
-		unicode.Range32{Lo: 0x2f800, Hi: 0x2fa1d, Stride: 0x1},
-	},
-	LatinOffset: 0,
-}
-
-var _SentenceSContinue = &unicode.RangeTable{
-	R16: []unicode.Range16{
-		unicode.Range16{Lo: 0x2c, Hi: 0x2c, Stride: 0x1},
-		unicode.Range16{Lo: 0x2d, Hi: 0x2d, Stride: 0x1},
-		unicode.Range16{Lo: 0x3a, Hi: 0x3a, Stride: 0x1},
-		unicode.Range16{Lo: 0x55d, Hi: 0x55d, Stride: 0x1},
-		unicode.Range16{Lo: 0x60c, Hi: 0x60d, Stride: 0x1},
-		unicode.Range16{Lo: 0x7f8, Hi: 0x7f8, Stride: 0x1},
-		unicode.Range16{Lo: 0x1802, Hi: 0x1802, Stride: 0x1},
-		unicode.Range16{Lo: 0x1808, Hi: 0x1808, Stride: 0x1},
-		unicode.Range16{Lo: 0x2013, Hi: 0x2014, Stride: 0x1},
-		unicode.Range16{Lo: 0x3001, Hi: 0x3001, Stride: 0x1},
-		unicode.Range16{Lo: 0xfe10, Hi: 0xfe11, Stride: 0x1},
-		unicode.Range16{Lo: 0xfe13, Hi: 0xfe13, Stride: 0x1},
-		unicode.Range16{Lo: 0xfe31, Hi: 0xfe32, Stride: 0x1},
-		unicode.Range16{Lo: 0xfe50, Hi: 0xfe51, Stride: 0x1},
-		unicode.Range16{Lo: 0xfe55, Hi: 0xfe55, Stride: 0x1},
-		unicode.Range16{Lo: 0xfe58, Hi: 0xfe58, Stride: 0x1},
-		unicode.Range16{Lo: 0xfe63, Hi: 0xfe63, Stride: 0x1},
-		unicode.Range16{Lo: 0xff0c, Hi: 0xff0c, Stride: 0x1},
-		unicode.Range16{Lo: 0xff0d, Hi: 0xff0d, Stride: 0x1},
-		unicode.Range16{Lo: 0xff1a, Hi: 0xff1a, Stride: 0x1},
-		unicode.Range16{Lo: 0xff64, Hi: 0xff64, Stride: 0x1},
-	},
-	LatinOffset: 3,
-}
-
-var _SentenceSTerm = &unicode.RangeTable{
-	R16: []unicode.Range16{
-		unicode.Range16{Lo: 0x21, Hi: 0x21, Stride: 0x1},
-		unicode.Range16{Lo: 0x3f, Hi: 0x3f, Stride: 0x1},
-		unicode.Range16{Lo: 0x589, Hi: 0x589, Stride: 0x1},
-		unicode.Range16{Lo: 0x61e, Hi: 0x61f, Stride: 0x1},
-		unicode.Range16{Lo: 0x6d4, Hi: 0x6d4, Stride: 0x1},
-		unicode.Range16{Lo: 0x700, Hi: 0x702, Stride: 0x1},
-		unicode.Range16{Lo: 0x7f9, Hi: 0x7f9, Stride: 0x1},
-		unicode.Range16{Lo: 0x837, Hi: 0x837, Stride: 0x1},
-		unicode.Range16{Lo: 0x839, Hi: 0x839, Stride: 0x1},
-		unicode.Range16{Lo: 0x83d, Hi: 0x83e, Stride: 0x1},
-		unicode.Range16{Lo: 0x964, Hi: 0x965, Stride: 0x1},
-		unicode.Range16{Lo: 0x104a, Hi: 0x104b, Stride: 0x1},
-		unicode.Range16{Lo: 0x1362, Hi: 0x1362, Stride: 0x1},
-		unicode.Range16{Lo: 0x1367, Hi: 0x1368, Stride: 0x1},
-		unicode.Range16{Lo: 0x166e, Hi: 0x166e, Stride: 0x1},
-		unicode.Range16{Lo: 0x1735, Hi: 0x1736, Stride: 0x1},
-		unicode.Range16{Lo: 0x1803, Hi: 0x1803, Stride: 0x1},
-		unicode.Range16{Lo: 0x1809, Hi: 0x1809, Stride: 0x1},
-		unicode.Range16{Lo: 0x1944, Hi: 0x1945, Stride: 0x1},
-		unicode.Range16{Lo: 0x1aa8, Hi: 0x1aab, Stride: 0x1},
-		unicode.Range16{Lo: 0x1b5a, Hi: 0x1b5b, Stride: 0x1},
-		unicode.Range16{Lo: 0x1b5e, Hi: 0x1b5f, Stride: 0x1},
-		unicode.Range16{Lo: 0x1c3b, Hi: 0x1c3c, Stride: 0x1},
-		unicode.Range16{Lo: 0x1c7e, Hi: 0x1c7f, Stride: 0x1},
-		unicode.Range16{Lo: 0x203c, Hi: 0x203d, Stride: 0x1},
-		unicode.Range16{Lo: 0x2047, Hi: 0x2049, Stride: 0x1},
-		unicode.Range16{Lo: 0x2e2e, Hi: 0x2e2e, Stride: 0x1},
-		unicode.Range16{Lo: 0x2e3c, Hi: 0x2e3c, Stride: 0x1},
-		unicode.Range16{Lo: 0x3002, Hi: 0x3002, Stride: 0x1},
-		unicode.Range16{Lo: 0xa4ff, Hi: 0xa4ff, Stride: 0x1},
-		unicode.Range16{Lo: 0xa60e, Hi: 0xa60f, Stride: 0x1},
-		unicode.Range16{Lo: 0xa6f3, Hi: 0xa6f3, Stride: 0x1},
-		unicode.Range16{Lo: 0xa6f7, Hi: 0xa6f7, Stride: 0x1},
-		unicode.Range16{Lo: 0xa876, Hi: 0xa877, Stride: 0x1},
-		unicode.Range16{Lo: 0xa8ce, Hi: 0xa8cf, Stride: 0x1},
-		unicode.Range16{Lo: 0xa92f, Hi: 0xa92f, Stride: 0x1},
-		unicode.Range16{Lo: 0xa9c8, Hi: 0xa9c9, Stride: 0x1},
-		unicode.Range16{Lo: 0xaa5d, Hi: 0xaa5f, Stride: 0x1},
-		unicode.Range16{Lo: 0xaaf0, Hi: 0xaaf1, Stride: 0x1},
-		unicode.Range16{Lo: 0xabeb, Hi: 0xabeb, Stride: 0x1},
-		unicode.Range16{Lo: 0xfe56, Hi: 0xfe57, Stride: 0x1},
-		unicode.Range16{Lo: 0xff01, Hi: 0xff01, Stride: 0x1},
-		unicode.Range16{Lo: 0xff1f, Hi: 0xff1f, Stride: 0x1},
-		unicode.Range16{Lo: 0xff61, Hi: 0xff61, Stride: 0x1},
-	},
-	R32: []unicode.Range32{
-		unicode.Range32{Lo: 0x10a56, Hi: 0x10a57, Stride: 0x1},
-		unicode.Range32{Lo: 0x10f55, Hi: 0x10f59, Stride: 0x1},
-		unicode.Range32{Lo: 0x11047, Hi: 0x11048, Stride: 0x1},
-		unicode.Range32{Lo: 0x110be, Hi: 0x110c1, Stride: 0x1},
-		unicode.Range32{Lo: 0x11141, Hi: 0x11143, Stride: 0x1},
-		unicode.Range32{Lo: 0x111c5, Hi: 0x111c6, Stride: 0x1},
-		unicode.Range32{Lo: 0x111cd, Hi: 0x111cd, Stride: 0x1},
-		unicode.Range32{Lo: 0x111de, Hi: 0x111df, Stride: 0x1},
-		unicode.Range32{Lo: 0x11238, Hi: 0x11239, Stride: 0x1},
-		unicode.Range32{Lo: 0x1123b, Hi: 0x1123c, Stride: 0x1},
-		unicode.Range32{Lo: 0x112a9, Hi: 0x112a9, Stride: 0x1},
-		unicode.Range32{Lo: 0x1144b, Hi: 0x1144c, Stride: 0x1},
-		unicode.Range32{Lo: 0x115c2, Hi: 0x115c3, Stride: 0x1},
-		unicode.Range32{Lo: 0x115c9, Hi: 0x115d7, Stride: 0x1},
-		unicode.Range32{Lo: 0x11641, Hi: 0x11642, Stride: 0x1},
-		unicode.Range32{Lo: 0x1173c, Hi: 0x1173e, Stride: 0x1},
-		unicode.Range32{Lo: 0x11a42, Hi: 0x11a43, Stride: 0x1},
-		unicode.Range32{Lo: 0x11a9b, Hi: 0x11a9c, Stride: 0x1},
-		unicode.Range32{Lo: 0x11c41, Hi: 0x11c42, Stride: 0x1},
-		unicode.Range32{Lo: 0x11ef7, Hi: 0x11ef8, Stride: 0x1},
-		unicode.Range32{Lo: 0x16a6e, Hi: 0x16a6f, Stride: 0x1},
-		unicode.Range32{Lo: 0x16af5, Hi: 0x16af5, Stride: 0x1},
-		unicode.Range32{Lo: 0x16b37, Hi: 0x16b38, Stride: 0x1},
-		unicode.Range32{Lo: 0x16b44, Hi: 0x16b44, Stride: 0x1},
-		unicode.Range32{Lo: 0x16e98, Hi: 0x16e98, Stride: 0x1},
-		unicode.Range32{Lo: 0x1bc9f, Hi: 0x1bc9f, Stride: 0x1},
-		unicode.Range32{Lo: 0x1da88, Hi: 0x1da88, Stride: 0x1},
-	},
-	LatinOffset: 2,
-}
-
-var _SentenceSep = &unicode.RangeTable{
-	R16: []unicode.Range16{
-		unicode.Range16{Lo: 0x85, Hi: 0x85, Stride: 0x1},
-		unicode.Range16{Lo: 0x2028, Hi: 0x2028, Stride: 0x1},
-		unicode.Range16{Lo: 0x2029, Hi: 0x2029, Stride: 0x1},
-	},
-	LatinOffset: 1,
-}
-
-var _SentenceSp = &unicode.RangeTable{
-	R16: []unicode.Range16{
-		unicode.Range16{Lo: 0x9, Hi: 0x9, Stride: 0x1},
-		unicode.Range16{Lo: 0xb, Hi: 0xc, Stride: 0x1},
-		unicode.Range16{Lo: 0x20, Hi: 0x20, Stride: 0x1},
-		unicode.Range16{Lo: 0xa0, Hi: 0xa0, Stride: 0x1},
-		unicode.Range16{Lo: 0x1680, Hi: 0x1680, Stride: 0x1},
-		unicode.Range16{Lo: 0x2000, Hi: 0x200a, Stride: 0x1},
-		unicode.Range16{Lo: 0x202f, Hi: 0x202f, Stride: 0x1},
-		unicode.Range16{Lo: 0x205f, Hi: 0x205f, Stride: 0x1},
-		unicode.Range16{Lo: 0x3000, Hi: 0x3000, Stride: 0x1},
-	},
-	LatinOffset: 4,
-}
-
-var _SentenceUpper = &unicode.RangeTable{
-	R16: []unicode.Range16{
-		unicode.Range16{Lo: 0x41, Hi: 0x5a, Stride: 0x1},
-		unicode.Range16{Lo: 0xc0, Hi: 0xd6, Stride: 0x1},
-		unicode.Range16{Lo: 0xd8, Hi: 0xde, Stride: 0x1},
-		unicode.Range16{Lo: 0x100, Hi: 0x100, Stride: 0x1},
-		unicode.Range16{Lo: 0x102, Hi: 0x102, Stride: 0x1},
-		unicode.Range16{Lo: 0x104, Hi: 0x104, Stride: 0x1},
-		unicode.Range16{Lo: 0x106, Hi: 0x106, Stride: 0x1},
-		unicode.Range16{Lo: 0x108, Hi: 0x108, Stride: 0x1},
-		unicode.Range16{Lo: 0x10a, Hi: 0x10a, Stride: 0x1},
-		unicode.Range16{Lo: 0x10c, Hi: 0x10c, Stride: 0x1},
-		unicode.Range16{Lo: 0x10e, Hi: 0x10e, Stride: 0x1},
-		unicode.Range16{Lo: 0x110, Hi: 0x110, Stride: 0x1},
-		unicode.Range16{Lo: 0x112, Hi: 0x112, Stride: 0x1},
-		unicode.Range16{Lo: 0x114, Hi: 0x114, Stride: 0x1},
-		unicode.Range16{Lo: 0x116, Hi: 0x116, Stride: 0x1},
-		unicode.Range16{Lo: 0x118, Hi: 0x118, Stride: 0x1},
-		unicode.Range16{Lo: 0x11a, Hi: 0x11a, Stride: 0x1},
-		unicode.Range16{Lo: 0x11c, Hi: 0x11c, Stride: 0x1},
-		unicode.Range16{Lo: 0x11e, Hi: 0x11e, Stride: 0x1},
-		unicode.Range16{Lo: 0x120, Hi: 0x120, Stride: 0x1},
-		unicode.Range16{Lo: 0x122, Hi: 0x122, Stride: 0x1},
-		unicode.Range16{Lo: 0x124, Hi: 0x124, Stride: 0x1},
-		unicode.Range16{Lo: 0x126, Hi: 0x126, Stride: 0x1},
-		unicode.Range16{Lo: 0x128, Hi: 0x128, Stride: 0x1},
-		unicode.Range16{Lo: 0x12a, Hi: 0x12a, Stride: 0x1},
-		unicode.Range16{Lo: 0x12c, Hi: 0x12c, Stride: 0x1},
-		unicode.Range16{Lo: 0x12e, Hi: 0x12e, Stride: 0x1},
-		unicode.Range16{Lo: 0x130, Hi: 0x130, Stride: 0x1},
-		unicode.Range16{Lo: 0x132, Hi: 0x132, Stride: 0x1},
-		unicode.Range16{Lo: 0x134, Hi: 0x134, Stride: 0x1},
-		unicode.Range16{Lo: 0x136, Hi: 0x136, Stride: 0x1},
-		unicode.Range16{Lo: 0x139, Hi: 0x139, Stride: 0x1},
-		unicode.Range16{Lo: 0x13b, Hi: 0x13b, Stride: 0x1},
-		unicode.Range16{Lo: 0x13d, Hi: 0x13d, Stride: 0x1},
-		unicode.Range16{Lo: 0x13f, Hi: 0x13f, Stride: 0x1},
-		unicode.Range16{Lo: 0x141, Hi: 0x141, Stride: 0x1},
-		unicode.Range16{Lo: 0x143, Hi: 0x143, Stride: 0x1},
-		unicode.Range16{Lo: 0x145, Hi: 0x145, Stride: 0x1},
-		unicode.Range16{Lo: 0x147, Hi: 0x147, Stride: 0x1},
-		unicode.Range16{Lo: 0x14a, Hi: 0x14a, Stride: 0x1},
-		unicode.Range16{Lo: 0x14c, Hi: 0x14c, Stride: 0x1},
-		unicode.Range16{Lo: 0x14e, Hi: 0x14e, Stride: 0x1},
-		unicode.Range16{Lo: 0x150, Hi: 0x150, Stride: 0x1},
-		unicode.Range16{Lo: 0x152, Hi: 0x152, Stride: 0x1},
-		unicode.Range16{Lo: 0x154, Hi: 0x154, Stride: 0x1},
-		unicode.Range16{Lo: 0x156, Hi: 0x156, Stride: 0x1},
-		unicode.Range16{Lo: 0x158, Hi: 0x158, Stride: 0x1},
-		unicode.Range16{Lo: 0x15a, Hi: 0x15a, Stride: 0x1},
-		unicode.Range16{Lo: 0x15c, Hi: 0x15c, Stride: 0x1},
-		unicode.Range16{Lo: 0x15e, Hi: 0x15e, Stride: 0x1},
-		unicode.Range16{Lo: 0x160, Hi: 0x160, Stride: 0x1},
-		unicode.Range16{Lo: 0x162, Hi: 0x162, Stride: 0x1},
-		unicode.Range16{Lo: 0x164, Hi: 0x164, Stride: 0x1},
-		unicode.Range16{Lo: 0x166, Hi: 0x166, Stride: 0x1},
-		unicode.Range16{Lo: 0x168, Hi: 0x168, Stride: 0x1},
-		unicode.Range16{Lo: 0x16a, Hi: 0x16a, Stride: 0x1},
-		unicode.Range16{Lo: 0x16c, Hi: 0x16c, Stride: 0x1},
-		unicode.Range16{Lo: 0x16e, Hi: 0x16e, Stride: 0x1},
-		unicode.Range16{Lo: 0x170, Hi: 0x170, Stride: 0x1},
-		unicode.Range16{Lo: 0x172, Hi: 0x172, Stride: 0x1},
-		unicode.Range16{Lo: 0x174, Hi: 0x174, Stride: 0x1},
-		unicode.Range16{Lo: 0x176, Hi: 0x176, Stride: 0x1},
-		unicode.Range16{Lo: 0x178, Hi: 0x179, Stride: 0x1},
-		unicode.Range16{Lo: 0x17b, Hi: 0x17b, Stride: 0x1},
-		unicode.Range16{Lo: 0x17d, Hi: 0x17d, Stride: 0x1},
-		unicode.Range16{Lo: 0x181, Hi: 0x182, Stride: 0x1},
-		unicode.Range16{Lo: 0x184, Hi: 0x184, Stride: 0x1},
-		unicode.Range16{Lo: 0x186, Hi: 0x187, Stride: 0x1},
-		unicode.Range16{Lo: 0x189, Hi: 0x18b, Stride: 0x1},
-		unicode.Range16{Lo: 0x18e, Hi: 0x191, Stride: 0x1},
-		unicode.Range16{Lo: 0x193, Hi: 0x194, Stride: 0x1},
-		unicode.Range16{Lo: 0x196, Hi: 0x198, Stride: 0x1},
-		unicode.Range16{Lo: 0x19c, Hi: 0x19d, Stride: 0x1},
-		unicode.Range16{Lo: 0x19f, Hi: 0x1a0, Stride: 0x1},
-		unicode.Range16{Lo: 0x1a2, Hi: 0x1a2, Stride: 0x1},
-		unicode.Range16{Lo: 0x1a4, Hi: 0x1a4, Stride: 0x1},
-		unicode.Range16{Lo: 0x1a6, Hi: 0x1a7, Stride: 0x1},
-		unicode.Range16{Lo: 0x1a9, Hi: 0x1a9, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ac, Hi: 0x1ac, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ae, Hi: 0x1af, Stride: 0x1},
-		unicode.Range16{Lo: 0x1b1, Hi: 0x1b3, Stride: 0x1},
-		unicode.Range16{Lo: 0x1b5, Hi: 0x1b5, Stride: 0x1},
-		unicode.Range16{Lo: 0x1b7, Hi: 0x1b8, Stride: 0x1},
-		unicode.Range16{Lo: 0x1bc, Hi: 0x1bc, Stride: 0x1},
-		unicode.Range16{Lo: 0x1c4, Hi: 0x1c5, Stride: 0x1},
-		unicode.Range16{Lo: 0x1c7, Hi: 0x1c8, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ca, Hi: 0x1cb, Stride: 0x1},
-		unicode.Range16{Lo: 0x1cd, Hi: 0x1cd, Stride: 0x1},
-		unicode.Range16{Lo: 0x1cf, Hi: 0x1cf, Stride: 0x1},
-		unicode.Range16{Lo: 0x1d1, Hi: 0x1d1, Stride: 0x1},
-		unicode.Range16{Lo: 0x1d3, Hi: 0x1d3, Stride: 0x1},
-		unicode.Range16{Lo: 0x1d5, Hi: 0x1d5, Stride: 0x1},
-		unicode.Range16{Lo: 0x1d7, Hi: 0x1d7, Stride: 0x1},
-		unicode.Range16{Lo: 0x1d9, Hi: 0x1d9, Stride: 0x1},
-		unicode.Range16{Lo: 0x1db, Hi: 0x1db, Stride: 0x1},
-		unicode.Range16{Lo: 0x1de, Hi: 0x1de, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e0, Hi: 0x1e0, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e2, Hi: 0x1e2, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e4, Hi: 0x1e4, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e6, Hi: 0x1e6, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e8, Hi: 0x1e8, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ea, Hi: 0x1ea, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ec, Hi: 0x1ec, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ee, Hi: 0x1ee, Stride: 0x1},
-		unicode.Range16{Lo: 0x1f1, Hi: 0x1f2, Stride: 0x1},
-		unicode.Range16{Lo: 0x1f4, Hi: 0x1f4, Stride: 0x1},
-		unicode.Range16{Lo: 0x1f6, Hi: 0x1f8, Stride: 0x1},
-		unicode.Range16{Lo: 0x1fa, Hi: 0x1fa, Stride: 0x1},
-		unicode.Range16{Lo: 0x1fc, Hi: 0x1fc, Stride: 0x1},
-		unicode.Range16{Lo: 0x1fe, Hi: 0x1fe, Stride: 0x1},
-		unicode.Range16{Lo: 0x200, Hi: 0x200, Stride: 0x1},
-		unicode.Range16{Lo: 0x202, Hi: 0x202, Stride: 0x1},
-		unicode.Range16{Lo: 0x204, Hi: 0x204, Stride: 0x1},
-		unicode.Range16{Lo: 0x206, Hi: 0x206, Stride: 0x1},
-		unicode.Range16{Lo: 0x208, Hi: 0x208, Stride: 0x1},
-		unicode.Range16{Lo: 0x20a, Hi: 0x20a, Stride: 0x1},
-		unicode.Range16{Lo: 0x20c, Hi: 0x20c, Stride: 0x1},
-		unicode.Range16{Lo: 0x20e, Hi: 0x20e, Stride: 0x1},
-		unicode.Range16{Lo: 0x210, Hi: 0x210, Stride: 0x1},
-		unicode.Range16{Lo: 0x212, Hi: 0x212, Stride: 0x1},
-		unicode.Range16{Lo: 0x214, Hi: 0x214, Stride: 0x1},
-		unicode.Range16{Lo: 0x216, Hi: 0x216, Stride: 0x1},
-		unicode.Range16{Lo: 0x218, Hi: 0x218, Stride: 0x1},
-		unicode.Range16{Lo: 0x21a, Hi: 0x21a, Stride: 0x1},
-		unicode.Range16{Lo: 0x21c, Hi: 0x21c, Stride: 0x1},
-		unicode.Range16{Lo: 0x21e, Hi: 0x21e, Stride: 0x1},
-		unicode.Range16{Lo: 0x220, Hi: 0x220, Stride: 0x1},
-		unicode.Range16{Lo: 0x222, Hi: 0x222, Stride: 0x1},
-		unicode.Range16{Lo: 0x224, Hi: 0x224, Stride: 0x1},
-		unicode.Range16{Lo: 0x226, Hi: 0x226, Stride: 0x1},
-		unicode.Range16{Lo: 0x228, Hi: 0x228, Stride: 0x1},
-		unicode.Range16{Lo: 0x22a, Hi: 0x22a, Stride: 0x1},
-		unicode.Range16{Lo: 0x22c, Hi: 0x22c, Stride: 0x1},
-		unicode.Range16{Lo: 0x22e, Hi: 0x22e, Stride: 0x1},
-		unicode.Range16{Lo: 0x230, Hi: 0x230, Stride: 0x1},
-		unicode.Range16{Lo: 0x232, Hi: 0x232, Stride: 0x1},
-		unicode.Range16{Lo: 0x23a, Hi: 0x23b, Stride: 0x1},
-		unicode.Range16{Lo: 0x23d, Hi: 0x23e, Stride: 0x1},
-		unicode.Range16{Lo: 0x241, Hi: 0x241, Stride: 0x1},
-		unicode.Range16{Lo: 0x243, Hi: 0x246, Stride: 0x1},
-		unicode.Range16{Lo: 0x248, Hi: 0x248, Stride: 0x1},
-		unicode.Range16{Lo: 0x24a, Hi: 0x24a, Stride: 0x1},
-		unicode.Range16{Lo: 0x24c, Hi: 0x24c, Stride: 0x1},
-		unicode.Range16{Lo: 0x24e, Hi: 0x24e, Stride: 0x1},
-		unicode.Range16{Lo: 0x370, Hi: 0x370, Stride: 0x1},
-		unicode.Range16{Lo: 0x372, Hi: 0x372, Stride: 0x1},
-		unicode.Range16{Lo: 0x376, Hi: 0x376, Stride: 0x1},
-		unicode.Range16{Lo: 0x37f, Hi: 0x37f, Stride: 0x1},
-		unicode.Range16{Lo: 0x386, Hi: 0x386, Stride: 0x1},
-		unicode.Range16{Lo: 0x388, Hi: 0x38a, Stride: 0x1},
-		unicode.Range16{Lo: 0x38c, Hi: 0x38c, Stride: 0x1},
-		unicode.Range16{Lo: 0x38e, Hi: 0x38f, Stride: 0x1},
-		unicode.Range16{Lo: 0x391, Hi: 0x3a1, Stride: 0x1},
-		unicode.Range16{Lo: 0x3a3, Hi: 0x3ab, Stride: 0x1},
-		unicode.Range16{Lo: 0x3cf, Hi: 0x3cf, Stride: 0x1},
-		unicode.Range16{Lo: 0x3d2, Hi: 0x3d4, Stride: 0x1},
-		unicode.Range16{Lo: 0x3d8, Hi: 0x3d8, Stride: 0x1},
-		unicode.Range16{Lo: 0x3da, Hi: 0x3da, Stride: 0x1},
-		unicode.Range16{Lo: 0x3dc, Hi: 0x3dc, Stride: 0x1},
-		unicode.Range16{Lo: 0x3de, Hi: 0x3de, Stride: 0x1},
-		unicode.Range16{Lo: 0x3e0, Hi: 0x3e0, Stride: 0x1},
-		unicode.Range16{Lo: 0x3e2, Hi: 0x3e2, Stride: 0x1},
-		unicode.Range16{Lo: 0x3e4, Hi: 0x3e4, Stride: 0x1},
-		unicode.Range16{Lo: 0x3e6, Hi: 0x3e6, Stride: 0x1},
-		unicode.Range16{Lo: 0x3e8, Hi: 0x3e8, Stride: 0x1},
-		unicode.Range16{Lo: 0x3ea, Hi: 0x3ea, Stride: 0x1},
-		unicode.Range16{Lo: 0x3ec, Hi: 0x3ec, Stride: 0x1},
-		unicode.Range16{Lo: 0x3ee, Hi: 0x3ee, Stride: 0x1},
-		unicode.Range16{Lo: 0x3f4, Hi: 0x3f4, Stride: 0x1},
-		unicode.Range16{Lo: 0x3f7, Hi: 0x3f7, Stride: 0x1},
-		unicode.Range16{Lo: 0x3f9, Hi: 0x3fa, Stride: 0x1},
-		unicode.Range16{Lo: 0x3fd, Hi: 0x42f, Stride: 0x1},
-		unicode.Range16{Lo: 0x460, Hi: 0x460, Stride: 0x1},
-		unicode.Range16{Lo: 0x462, Hi: 0x462, Stride: 0x1},
-		unicode.Range16{Lo: 0x464, Hi: 0x464, Stride: 0x1},
-		unicode.Range16{Lo: 0x466, Hi: 0x466, Stride: 0x1},
-		unicode.Range16{Lo: 0x468, Hi: 0x468, Stride: 0x1},
-		unicode.Range16{Lo: 0x46a, Hi: 0x46a, Stride: 0x1},
-		unicode.Range16{Lo: 0x46c, Hi: 0x46c, Stride: 0x1},
-		unicode.Range16{Lo: 0x46e, Hi: 0x46e, Stride: 0x1},
-		unicode.Range16{Lo: 0x470, Hi: 0x470, Stride: 0x1},
-		unicode.Range16{Lo: 0x472, Hi: 0x472, Stride: 0x1},
-		unicode.Range16{Lo: 0x474, Hi: 0x474, Stride: 0x1},
-		unicode.Range16{Lo: 0x476, Hi: 0x476, Stride: 0x1},
-		unicode.Range16{Lo: 0x478, Hi: 0x478, Stride: 0x1},
-		unicode.Range16{Lo: 0x47a, Hi: 0x47a, Stride: 0x1},
-		unicode.Range16{Lo: 0x47c, Hi: 0x47c, Stride: 0x1},
-		unicode.Range16{Lo: 0x47e, Hi: 0x47e, Stride: 0x1},
-		unicode.Range16{Lo: 0x480, Hi: 0x480, Stride: 0x1},
-		unicode.Range16{Lo: 0x48a, Hi: 0x48a, Stride: 0x1},
-		unicode.Range16{Lo: 0x48c, Hi: 0x48c, Stride: 0x1},
-		unicode.Range16{Lo: 0x48e, Hi: 0x48e, Stride: 0x1},
-		unicode.Range16{Lo: 0x490, Hi: 0x490, Stride: 0x1},
-		unicode.Range16{Lo: 0x492, Hi: 0x492, Stride: 0x1},
-		unicode.Range16{Lo: 0x494, Hi: 0x494, Stride: 0x1},
-		unicode.Range16{Lo: 0x496, Hi: 0x496, Stride: 0x1},
-		unicode.Range16{Lo: 0x498, Hi: 0x498, Stride: 0x1},
-		unicode.Range16{Lo: 0x49a, Hi: 0x49a, Stride: 0x1},
-		unicode.Range16{Lo: 0x49c, Hi: 0x49c, Stride: 0x1},
-		unicode.Range16{Lo: 0x49e, Hi: 0x49e, Stride: 0x1},
-		unicode.Range16{Lo: 0x4a0, Hi: 0x4a0, Stride: 0x1},
-		unicode.Range16{Lo: 0x4a2, Hi: 0x4a2, Stride: 0x1},
-		unicode.Range16{Lo: 0x4a4, Hi: 0x4a4, Stride: 0x1},
-		unicode.Range16{Lo: 0x4a6, Hi: 0x4a6, Stride: 0x1},
-		unicode.Range16{Lo: 0x4a8, Hi: 0x4a8, Stride: 0x1},
-		unicode.Range16{Lo: 0x4aa, Hi: 0x4aa, Stride: 0x1},
-		unicode.Range16{Lo: 0x4ac, Hi: 0x4ac, Stride: 0x1},
-		unicode.Range16{Lo: 0x4ae, Hi: 0x4ae, Stride: 0x1},
-		unicode.Range16{Lo: 0x4b0, Hi: 0x4b0, Stride: 0x1},
-		unicode.Range16{Lo: 0x4b2, Hi: 0x4b2, Stride: 0x1},
-		unicode.Range16{Lo: 0x4b4, Hi: 0x4b4, Stride: 0x1},
-		unicode.Range16{Lo: 0x4b6, Hi: 0x4b6, Stride: 0x1},
-		unicode.Range16{Lo: 0x4b8, Hi: 0x4b8, Stride: 0x1},
-		unicode.Range16{Lo: 0x4ba, Hi: 0x4ba, Stride: 0x1},
-		unicode.Range16{Lo: 0x4bc, Hi: 0x4bc, Stride: 0x1},
-		unicode.Range16{Lo: 0x4be, Hi: 0x4be, Stride: 0x1},
-		unicode.Range16{Lo: 0x4c0, Hi: 0x4c1, Stride: 0x1},
-		unicode.Range16{Lo: 0x4c3, Hi: 0x4c3, Stride: 0x1},
-		unicode.Range16{Lo: 0x4c5, Hi: 0x4c5, Stride: 0x1},
-		unicode.Range16{Lo: 0x4c7, Hi: 0x4c7, Stride: 0x1},
-		unicode.Range16{Lo: 0x4c9, Hi: 0x4c9, Stride: 0x1},
-		unicode.Range16{Lo: 0x4cb, Hi: 0x4cb, Stride: 0x1},
-		unicode.Range16{Lo: 0x4cd, Hi: 0x4cd, Stride: 0x1},
-		unicode.Range16{Lo: 0x4d0, Hi: 0x4d0, Stride: 0x1},
-		unicode.Range16{Lo: 0x4d2, Hi: 0x4d2, Stride: 0x1},
-		unicode.Range16{Lo: 0x4d4, Hi: 0x4d4, Stride: 0x1},
-		unicode.Range16{Lo: 0x4d6, Hi: 0x4d6, Stride: 0x1},
-		unicode.Range16{Lo: 0x4d8, Hi: 0x4d8, Stride: 0x1},
-		unicode.Range16{Lo: 0x4da, Hi: 0x4da, Stride: 0x1},
-		unicode.Range16{Lo: 0x4dc, Hi: 0x4dc, Stride: 0x1},
-		unicode.Range16{Lo: 0x4de, Hi: 0x4de, Stride: 0x1},
-		unicode.Range16{Lo: 0x4e0, Hi: 0x4e0, Stride: 0x1},
-		unicode.Range16{Lo: 0x4e2, Hi: 0x4e2, Stride: 0x1},
-		unicode.Range16{Lo: 0x4e4, Hi: 0x4e4, Stride: 0x1},
-		unicode.Range16{Lo: 0x4e6, Hi: 0x4e6, Stride: 0x1},
-		unicode.Range16{Lo: 0x4e8, Hi: 0x4e8, Stride: 0x1},
-		unicode.Range16{Lo: 0x4ea, Hi: 0x4ea, Stride: 0x1},
-		unicode.Range16{Lo: 0x4ec, Hi: 0x4ec, Stride: 0x1},
-		unicode.Range16{Lo: 0x4ee, Hi: 0x4ee, Stride: 0x1},
-		unicode.Range16{Lo: 0x4f0, Hi: 0x4f0, Stride: 0x1},
-		unicode.Range16{Lo: 0x4f2, Hi: 0x4f2, Stride: 0x1},
-		unicode.Range16{Lo: 0x4f4, Hi: 0x4f4, Stride: 0x1},
-		unicode.Range16{Lo: 0x4f6, Hi: 0x4f6, Stride: 0x1},
-		unicode.Range16{Lo: 0x4f8, Hi: 0x4f8, Stride: 0x1},
-		unicode.Range16{Lo: 0x4fa, Hi: 0x4fa, Stride: 0x1},
-		unicode.Range16{Lo: 0x4fc, Hi: 0x4fc, Stride: 0x1},
-		unicode.Range16{Lo: 0x4fe, Hi: 0x4fe, Stride: 0x1},
-		unicode.Range16{Lo: 0x500, Hi: 0x500, Stride: 0x1},
-		unicode.Range16{Lo: 0x502, Hi: 0x502, Stride: 0x1},
-		unicode.Range16{Lo: 0x504, Hi: 0x504, Stride: 0x1},
-		unicode.Range16{Lo: 0x506, Hi: 0x506, Stride: 0x1},
-		unicode.Range16{Lo: 0x508, Hi: 0x508, Stride: 0x1},
-		unicode.Range16{Lo: 0x50a, Hi: 0x50a, Stride: 0x1},
-		unicode.Range16{Lo: 0x50c, Hi: 0x50c, Stride: 0x1},
-		unicode.Range16{Lo: 0x50e, Hi: 0x50e, Stride: 0x1},
-		unicode.Range16{Lo: 0x510, Hi: 0x510, Stride: 0x1},
-		unicode.Range16{Lo: 0x512, Hi: 0x512, Stride: 0x1},
-		unicode.Range16{Lo: 0x514, Hi: 0x514, Stride: 0x1},
-		unicode.Range16{Lo: 0x516, Hi: 0x516, Stride: 0x1},
-		unicode.Range16{Lo: 0x518, Hi: 0x518, Stride: 0x1},
-		unicode.Range16{Lo: 0x51a, Hi: 0x51a, Stride: 0x1},
-		unicode.Range16{Lo: 0x51c, Hi: 0x51c, Stride: 0x1},
-		unicode.Range16{Lo: 0x51e, Hi: 0x51e, Stride: 0x1},
-		unicode.Range16{Lo: 0x520, Hi: 0x520, Stride: 0x1},
-		unicode.Range16{Lo: 0x522, Hi: 0x522, Stride: 0x1},
-		unicode.Range16{Lo: 0x524, Hi: 0x524, Stride: 0x1},
-		unicode.Range16{Lo: 0x526, Hi: 0x526, Stride: 0x1},
-		unicode.Range16{Lo: 0x528, Hi: 0x528, Stride: 0x1},
-		unicode.Range16{Lo: 0x52a, Hi: 0x52a, Stride: 0x1},
-		unicode.Range16{Lo: 0x52c, Hi: 0x52c, Stride: 0x1},
-		unicode.Range16{Lo: 0x52e, Hi: 0x52e, Stride: 0x1},
-		unicode.Range16{Lo: 0x531, Hi: 0x556, Stride: 0x1},
-		unicode.Range16{Lo: 0x10a0, Hi: 0x10c5, Stride: 0x1},
-		unicode.Range16{Lo: 0x10c7, Hi: 0x10c7, Stride: 0x1},
-		unicode.Range16{Lo: 0x10cd, Hi: 0x10cd, Stride: 0x1},
-		unicode.Range16{Lo: 0x13a0, Hi: 0x13f5, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e00, Hi: 0x1e00, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e02, Hi: 0x1e02, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e04, Hi: 0x1e04, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e06, Hi: 0x1e06, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e08, Hi: 0x1e08, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e0a, Hi: 0x1e0a, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e0c, Hi: 0x1e0c, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e0e, Hi: 0x1e0e, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e10, Hi: 0x1e10, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e12, Hi: 0x1e12, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e14, Hi: 0x1e14, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e16, Hi: 0x1e16, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e18, Hi: 0x1e18, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e1a, Hi: 0x1e1a, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e1c, Hi: 0x1e1c, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e1e, Hi: 0x1e1e, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e20, Hi: 0x1e20, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e22, Hi: 0x1e22, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e24, Hi: 0x1e24, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e26, Hi: 0x1e26, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e28, Hi: 0x1e28, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e2a, Hi: 0x1e2a, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e2c, Hi: 0x1e2c, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e2e, Hi: 0x1e2e, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e30, Hi: 0x1e30, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e32, Hi: 0x1e32, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e34, Hi: 0x1e34, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e36, Hi: 0x1e36, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e38, Hi: 0x1e38, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e3a, Hi: 0x1e3a, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e3c, Hi: 0x1e3c, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e3e, Hi: 0x1e3e, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e40, Hi: 0x1e40, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e42, Hi: 0x1e42, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e44, Hi: 0x1e44, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e46, Hi: 0x1e46, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e48, Hi: 0x1e48, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e4a, Hi: 0x1e4a, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e4c, Hi: 0x1e4c, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e4e, Hi: 0x1e4e, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e50, Hi: 0x1e50, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e52, Hi: 0x1e52, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e54, Hi: 0x1e54, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e56, Hi: 0x1e56, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e58, Hi: 0x1e58, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e5a, Hi: 0x1e5a, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e5c, Hi: 0x1e5c, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e5e, Hi: 0x1e5e, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e60, Hi: 0x1e60, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e62, Hi: 0x1e62, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e64, Hi: 0x1e64, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e66, Hi: 0x1e66, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e68, Hi: 0x1e68, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e6a, Hi: 0x1e6a, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e6c, Hi: 0x1e6c, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e6e, Hi: 0x1e6e, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e70, Hi: 0x1e70, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e72, Hi: 0x1e72, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e74, Hi: 0x1e74, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e76, Hi: 0x1e76, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e78, Hi: 0x1e78, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e7a, Hi: 0x1e7a, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e7c, Hi: 0x1e7c, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e7e, Hi: 0x1e7e, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e80, Hi: 0x1e80, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e82, Hi: 0x1e82, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e84, Hi: 0x1e84, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e86, Hi: 0x1e86, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e88, Hi: 0x1e88, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e8a, Hi: 0x1e8a, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e8c, Hi: 0x1e8c, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e8e, Hi: 0x1e8e, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e90, Hi: 0x1e90, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e92, Hi: 0x1e92, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e94, Hi: 0x1e94, Stride: 0x1},
-		unicode.Range16{Lo: 0x1e9e, Hi: 0x1e9e, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ea0, Hi: 0x1ea0, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ea2, Hi: 0x1ea2, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ea4, Hi: 0x1ea4, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ea6, Hi: 0x1ea6, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ea8, Hi: 0x1ea8, Stride: 0x1},
-		unicode.Range16{Lo: 0x1eaa, Hi: 0x1eaa, Stride: 0x1},
-		unicode.Range16{Lo: 0x1eac, Hi: 0x1eac, Stride: 0x1},
-		unicode.Range16{Lo: 0x1eae, Hi: 0x1eae, Stride: 0x1},
-		unicode.Range16{Lo: 0x1eb0, Hi: 0x1eb0, Stride: 0x1},
-		unicode.Range16{Lo: 0x1eb2, Hi: 0x1eb2, Stride: 0x1},
-		unicode.Range16{Lo: 0x1eb4, Hi: 0x1eb4, Stride: 0x1},
-		unicode.Range16{Lo: 0x1eb6, Hi: 0x1eb6, Stride: 0x1},
-		unicode.Range16{Lo: 0x1eb8, Hi: 0x1eb8, Stride: 0x1},
-		unicode.Range16{Lo: 0x1eba, Hi: 0x1eba, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ebc, Hi: 0x1ebc, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ebe, Hi: 0x1ebe, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ec0, Hi: 0x1ec0, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ec2, Hi: 0x1ec2, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ec4, Hi: 0x1ec4, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ec6, Hi: 0x1ec6, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ec8, Hi: 0x1ec8, Stride: 0x1},
-		unicode.Range16{Lo: 0x1eca, Hi: 0x1eca, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ecc, Hi: 0x1ecc, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ece, Hi: 0x1ece, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ed0, Hi: 0x1ed0, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ed2, Hi: 0x1ed2, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ed4, Hi: 0x1ed4, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ed6, Hi: 0x1ed6, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ed8, Hi: 0x1ed8, Stride: 0x1},
-		unicode.Range16{Lo: 0x1eda, Hi: 0x1eda, Stride: 0x1},
-		unicode.Range16{Lo: 0x1edc, Hi: 0x1edc, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ede, Hi: 0x1ede, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ee0, Hi: 0x1ee0, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ee2, Hi: 0x1ee2, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ee4, Hi: 0x1ee4, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ee6, Hi: 0x1ee6, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ee8, Hi: 0x1ee8, Stride: 0x1},
-		unicode.Range16{Lo: 0x1eea, Hi: 0x1eea, Stride: 0x1},
-		unicode.Range16{Lo: 0x1eec, Hi: 0x1eec, Stride: 0x1},
-		unicode.Range16{Lo: 0x1eee, Hi: 0x1eee, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ef0, Hi: 0x1ef0, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ef2, Hi: 0x1ef2, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ef4, Hi: 0x1ef4, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ef6, Hi: 0x1ef6, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ef8, Hi: 0x1ef8, Stride: 0x1},
-		unicode.Range16{Lo: 0x1efa, Hi: 0x1efa, Stride: 0x1},
-		unicode.Range16{Lo: 0x1efc, Hi: 0x1efc, Stride: 0x1},
-		unicode.Range16{Lo: 0x1efe, Hi: 0x1efe, Stride: 0x1},
-		unicode.Range16{Lo: 0x1f08, Hi: 0x1f0f, Stride: 0x1},
-		unicode.Range16{Lo: 0x1f18, Hi: 0x1f1d, Stride: 0x1},
-		unicode.Range16{Lo: 0x1f28, Hi: 0x1f2f, Stride: 0x1},
-		unicode.Range16{Lo: 0x1f38, Hi: 0x1f3f, Stride: 0x1},
-		unicode.Range16{Lo: 0x1f48, Hi: 0x1f4d, Stride: 0x1},
-		unicode.Range16{Lo: 0x1f59, Hi: 0x1f59, Stride: 0x1},
-		unicode.Range16{Lo: 0x1f5b, Hi: 0x1f5b, Stride: 0x1},
-		unicode.Range16{Lo: 0x1f5d, Hi: 0x1f5d, Stride: 0x1},
-		unicode.Range16{Lo: 0x1f5f, Hi: 0x1f5f, Stride: 0x1},
-		unicode.Range16{Lo: 0x1f68, Hi: 0x1f6f, Stride: 0x1},
-		unicode.Range16{Lo: 0x1f88, Hi: 0x1f8f, Stride: 0x1},
-		unicode.Range16{Lo: 0x1f98, Hi: 0x1f9f, Stride: 0x1},
-		unicode.Range16{Lo: 0x1fa8, Hi: 0x1faf, Stride: 0x1},
-		unicode.Range16{Lo: 0x1fb8, Hi: 0x1fbc, Stride: 0x1},
-		unicode.Range16{Lo: 0x1fc8, Hi: 0x1fcc, Stride: 0x1},
-		unicode.Range16{Lo: 0x1fd8, Hi: 0x1fdb, Stride: 0x1},
-		unicode.Range16{Lo: 0x1fe8, Hi: 0x1fec, Stride: 0x1},
-		unicode.Range16{Lo: 0x1ff8, Hi: 0x1ffc, Stride: 0x1},
-		unicode.Range16{Lo: 0x2102, Hi: 0x2102, Stride: 0x1},
-		unicode.Range16{Lo: 0x2107, Hi: 0x2107, Stride: 0x1},
-		unicode.Range16{Lo: 0x210b, Hi: 0x210d, Stride: 0x1},
-		unicode.Range16{Lo: 0x2110, Hi: 0x2112, Stride: 0x1},
-		unicode.Range16{Lo: 0x2115, Hi: 0x2115, Stride: 0x1},
-		unicode.Range16{Lo: 0x2119, Hi: 0x211d, Stride: 0x1},
-		unicode.Range16{Lo: 0x2124, Hi: 0x2124, Stride: 0x1},
-		unicode.Range16{Lo: 0x2126, Hi: 0x2126, Stride: 0x1},
-		unicode.Range16{Lo: 0x2128, Hi: 0x2128, Stride: 0x1},
-		unicode.Range16{Lo: 0x212a, Hi: 0x212d, Stride: 0x1},
-		unicode.Range16{Lo: 0x2130, Hi: 0x2133, Stride: 0x1},
-		unicode.Range16{Lo: 0x213e, Hi: 0x213f, Stride: 0x1},
-		unicode.Range16{Lo: 0x2145, Hi: 0x2145, Stride: 0x1},
-		unicode.Range16{Lo: 0x2160, Hi: 0x216f, Stride: 0x1},
-		unicode.Range16{Lo: 0x2183, Hi: 0x2183, Stride: 0x1},
-		unicode.Range16{Lo: 0x24b6, Hi: 0x24cf, Stride: 0x1},
-		unicode.Range16{Lo: 0x2c00, Hi: 0x2c2e, Stride: 0x1},
-		unicode.Range16{Lo: 0x2c60, Hi: 0x2c60, Stride: 0x1},
-		unicode.Range16{Lo: 0x2c62, Hi: 0x2c64, Stride: 0x1},
-		unicode.Range16{Lo: 0x2c67, Hi: 0x2c67, Stride: 0x1},
-		unicode.Range16{Lo: 0x2c69, Hi: 0x2c69, Stride: 0x1},
-		unicode.Range16{Lo: 0x2c6b, Hi: 0x2c6b, Stride: 0x1},
-		unicode.Range16{Lo: 0x2c6d, Hi: 0x2c70, Stride: 0x1},
-		unicode.Range16{Lo: 0x2c72, Hi: 0x2c72, Stride: 0x1},
-		unicode.Range16{Lo: 0x2c75, Hi: 0x2c75, Stride: 0x1},
-		unicode.Range16{Lo: 0x2c7e, Hi: 0x2c80, Stride: 0x1},
-		unicode.Range16{Lo: 0x2c82, Hi: 0x2c82, Stride: 0x1},
-		unicode.Range16{Lo: 0x2c84, Hi: 0x2c84, Stride: 0x1},
-		unicode.Range16{Lo: 0x2c86, Hi: 0x2c86, Stride: 0x1},
-		unicode.Range16{Lo: 0x2c88, Hi: 0x2c88, Stride: 0x1},
-		unicode.Range16{Lo: 0x2c8a, Hi: 0x2c8a, Stride: 0x1},
-		unicode.Range16{Lo: 0x2c8c, Hi: 0x2c8c, Stride: 0x1},
-		unicode.Range16{Lo: 0x2c8e, Hi: 0x2c8e, Stride: 0x1},
-		unicode.Range16{Lo: 0x2c90, Hi: 0x2c90, Stride: 0x1},
-		unicode.Range16{Lo: 0x2c92, Hi: 0x2c92, Stride: 0x1},
-		unicode.Range16{Lo: 0x2c94, Hi: 0x2c94, Stride: 0x1},
-		unicode.Range16{Lo: 0x2c96, Hi: 0x2c96, Stride: 0x1},
-		unicode.Range16{Lo: 0x2c98, Hi: 0x2c98, Stride: 0x1},
-		unicode.Range16{Lo: 0x2c9a, Hi: 0x2c9a, Stride: 0x1},
-		unicode.Range16{Lo: 0x2c9c, Hi: 0x2c9c, Stride: 0x1},
-		unicode.Range16{Lo: 0x2c9e, Hi: 0x2c9e, Stride: 0x1},
-		unicode.Range16{Lo: 0x2ca0, Hi: 0x2ca0, Stride: 0x1},
-		unicode.Range16{Lo: 0x2ca2, Hi: 0x2ca2, Stride: 0x1},
-		unicode.Range16{Lo: 0x2ca4, Hi: 0x2ca4, Stride: 0x1},
-		unicode.Range16{Lo: 0x2ca6, Hi: 0x2ca6, Stride: 0x1},
-		unicode.Range16{Lo: 0x2ca8, Hi: 0x2ca8, Stride: 0x1},
-		unicode.Range16{Lo: 0x2caa, Hi: 0x2caa, Stride: 0x1},
-		unicode.Range16{Lo: 0x2cac, Hi: 0x2cac, Stride: 0x1},
-		unicode.Range16{Lo: 0x2cae, Hi: 0x2cae, Stride: 0x1},
-		unicode.Range16{Lo: 0x2cb0, Hi: 0x2cb0, Stride: 0x1},
-		unicode.Range16{Lo: 0x2cb2, Hi: 0x2cb2, Stride: 0x1},
-		unicode.Range16{Lo: 0x2cb4, Hi: 0x2cb4, Stride: 0x1},
-		unicode.Range16{Lo: 0x2cb6, Hi: 0x2cb6, Stride: 0x1},
-		unicode.Range16{Lo: 0x2cb8, Hi: 0x2cb8, Stride: 0x1},
-		unicode.Range16{Lo: 0x2cba, Hi: 0x2cba, Stride: 0x1},
-		unicode.Range16{Lo: 0x2cbc, Hi: 0x2cbc, Stride: 0x1},
-		unicode.Range16{Lo: 0x2cbe, Hi: 0x2cbe, Stride: 0x1},
-		unicode.Range16{Lo: 0x2cc0, Hi: 0x2cc0, Stride: 0x1},
-		unicode.Range16{Lo: 0x2cc2, Hi: 0x2cc2, Stride: 0x1},
-		unicode.Range16{Lo: 0x2cc4, Hi: 0x2cc4, Stride: 0x1},
-		unicode.Range16{Lo: 0x2cc6, Hi: 0x2cc6, Stride: 0x1},
-		unicode.Range16{Lo: 0x2cc8, Hi: 0x2cc8, Stride: 0x1},
-		unicode.Range16{Lo: 0x2cca, Hi: 0x2cca, Stride: 0x1},
-		unicode.Range16{Lo: 0x2ccc, Hi: 0x2ccc, Stride: 0x1},
-		unicode.Range16{Lo: 0x2cce, Hi: 0x2cce, Stride: 0x1},
-		unicode.Range16{Lo: 0x2cd0, Hi: 0x2cd0, Stride: 0x1},
-		unicode.Range16{Lo: 0x2cd2, Hi: 0x2cd2, Stride: 0x1},
-		unicode.Range16{Lo: 0x2cd4, Hi: 0x2cd4, Stride: 0x1},
-		unicode.Range16{Lo: 0x2cd6, Hi: 0x2cd6, Stride: 0x1},
-		unicode.Range16{Lo: 0x2cd8, Hi: 0x2cd8, Stride: 0x1},
-		unicode.Range16{Lo: 0x2cda, Hi: 0x2cda, Stride: 0x1},
-		unicode.Range16{Lo: 0x2cdc, Hi: 0x2cdc, Stride: 0x1},
-		unicode.Range16{Lo: 0x2cde, Hi: 0x2cde, Stride: 0x1},
-		unicode.Range16{Lo: 0x2ce0, Hi: 0x2ce0, Stride: 0x1},
-		unicode.Range16{Lo: 0x2ce2, Hi: 0x2ce2, Stride: 0x1},
-		unicode.Range16{Lo: 0x2ceb, Hi: 0x2ceb, Stride: 0x1},
-		unicode.Range16{Lo: 0x2ced, Hi: 0x2ced, Stride: 0x1},
-		unicode.Range16{Lo: 0x2cf2, Hi: 0x2cf2, Stride: 0x1},
-		unicode.Range16{Lo: 0xa640, Hi: 0xa640, Stride: 0x1},
-		unicode.Range16{Lo: 0xa642, Hi: 0xa642, Stride: 0x1},
-		unicode.Range16{Lo: 0xa644, Hi: 0xa644, Stride: 0x1},
-		unicode.Range16{Lo: 0xa646, Hi: 0xa646, Stride: 0x1},
-		unicode.Range16{Lo: 0xa648, Hi: 0xa648, Stride: 0x1},
-		unicode.Range16{Lo: 0xa64a, Hi: 0xa64a, Stride: 0x1},
-		unicode.Range16{Lo: 0xa64c, Hi: 0xa64c, Stride: 0x1},
-		unicode.Range16{Lo: 0xa64e, Hi: 0xa64e, Stride: 0x1},
-		unicode.Range16{Lo: 0xa650, Hi: 0xa650, Stride: 0x1},
-		unicode.Range16{Lo: 0xa652, Hi: 0xa652, Stride: 0x1},
-		unicode.Range16{Lo: 0xa654, Hi: 0xa654, Stride: 0x1},
-		unicode.Range16{Lo: 0xa656, Hi: 0xa656, Stride: 0x1},
-		unicode.Range16{Lo: 0xa658, Hi: 0xa658, Stride: 0x1},
-		unicode.Range16{Lo: 0xa65a, Hi: 0xa65a, Stride: 0x1},
-		unicode.Range16{Lo: 0xa65c, Hi: 0xa65c, Stride: 0x1},
-		unicode.Range16{Lo: 0xa65e, Hi: 0xa65e, Stride: 0x1},
-		unicode.Range16{Lo: 0xa660, Hi: 0xa660, Stride: 0x1},
-		unicode.Range16{Lo: 0xa662, Hi: 0xa662, Stride: 0x1},
-		unicode.Range16{Lo: 0xa664, Hi: 0xa664, Stride: 0x1},
-		unicode.Range16{Lo: 0xa666, Hi: 0xa666, Stride: 0x1},
-		unicode.Range16{Lo: 0xa668, Hi: 0xa668, Stride: 0x1},
-		unicode.Range16{Lo: 0xa66a, Hi: 0xa66a, Stride: 0x1},
-		unicode.Range16{Lo: 0xa66c, Hi: 0xa66c, Stride: 0x1},
-		unicode.Range16{Lo: 0xa680, Hi: 0xa680, Stride: 0x1},
-		unicode.Range16{Lo: 0xa682, Hi: 0xa682, Stride: 0x1},
-		unicode.Range16{Lo: 0xa684, Hi: 0xa684, Stride: 0x1},
-		unicode.Range16{Lo: 0xa686, Hi: 0xa686, Stride: 0x1},
-		unicode.Range16{Lo: 0xa688, Hi: 0xa688, Stride: 0x1},
-		unicode.Range16{Lo: 0xa68a, Hi: 0xa68a, Stride: 0x1},
-		unicode.Range16{Lo: 0xa68c, Hi: 0xa68c, Stride: 0x1},
-		unicode.Range16{Lo: 0xa68e, Hi: 0xa68e, Stride: 0x1},
-		unicode.Range16{Lo: 0xa690, Hi: 0xa690, Stride: 0x1},
-		unicode.Range16{Lo: 0xa692, Hi: 0xa692, Stride: 0x1},
-		unicode.Range16{Lo: 0xa694, Hi: 0xa694, Stride: 0x1},
-		unicode.Range16{Lo: 0xa696, Hi: 0xa696, Stride: 0x1},
-		unicode.Range16{Lo: 0xa698, Hi: 0xa698, Stride: 0x1},
-		unicode.Range16{Lo: 0xa69a, Hi: 0xa69a, Stride: 0x1},
-		unicode.Range16{Lo: 0xa722, Hi: 0xa722, Stride: 0x1},
-		unicode.Range16{Lo: 0xa724, Hi: 0xa724, Stride: 0x1},
-		unicode.Range16{Lo: 0xa726, Hi: 0xa726, Stride: 0x1},
-		unicode.Range16{Lo: 0xa728, Hi: 0xa728, Stride: 0x1},
-		unicode.Range16{Lo: 0xa72a, Hi: 0xa72a, Stride: 0x1},
-		unicode.Range16{Lo: 0xa72c, Hi: 0xa72c, Stride: 0x1},
-		unicode.Range16{Lo: 0xa72e, Hi: 0xa72e, Stride: 0x1},
-		unicode.Range16{Lo: 0xa732, Hi: 0xa732, Stride: 0x1},
-		unicode.Range16{Lo: 0xa734, Hi: 0xa734, Stride: 0x1},
-		unicode.Range16{Lo: 0xa736, Hi: 0xa736, Stride: 0x1},
-		unicode.Range16{Lo: 0xa738, Hi: 0xa738, Stride: 0x1},
-		unicode.Range16{Lo: 0xa73a, Hi: 0xa73a, Stride: 0x1},
-		unicode.Range16{Lo: 0xa73c, Hi: 0xa73c, Stride: 0x1},
-		unicode.Range16{Lo: 0xa73e, Hi: 0xa73e, Stride: 0x1},
-		unicode.Range16{Lo: 0xa740, Hi: 0xa740, Stride: 0x1},
-		unicode.Range16{Lo: 0xa742, Hi: 0xa742, Stride: 0x1},
-		unicode.Range16{Lo: 0xa744, Hi: 0xa744, Stride: 0x1},
-		unicode.Range16{Lo: 0xa746, Hi: 0xa746, Stride: 0x1},
-		unicode.Range16{Lo: 0xa748, Hi: 0xa748, Stride: 0x1},
-		unicode.Range16{Lo: 0xa74a, Hi: 0xa74a, Stride: 0x1},
-		unicode.Range16{Lo: 0xa74c, Hi: 0xa74c, Stride: 0x1},
-		unicode.Range16{Lo: 0xa74e, Hi: 0xa74e, Stride: 0x1},
-		unicode.Range16{Lo: 0xa750, Hi: 0xa750, Stride: 0x1},
-		unicode.Range16{Lo: 0xa752, Hi: 0xa752, Stride: 0x1},
-		unicode.Range16{Lo: 0xa754, Hi: 0xa754, Stride: 0x1},
-		unicode.Range16{Lo: 0xa756, Hi: 0xa756, Stride: 0x1},
-		unicode.Range16{Lo: 0xa758, Hi: 0xa758, Stride: 0x1},
-		unicode.Range16{Lo: 0xa75a, Hi: 0xa75a, Stride: 0x1},
-		unicode.Range16{Lo: 0xa75c, Hi: 0xa75c, Stride: 0x1},
-		unicode.Range16{Lo: 0xa75e, Hi: 0xa75e, Stride: 0x1},
-		unicode.Range16{Lo: 0xa760, Hi: 0xa760, Stride: 0x1},
-		unicode.Range16{Lo: 0xa762, Hi: 0xa762, Stride: 0x1},
-		unicode.Range16{Lo: 0xa764, Hi: 0xa764, Stride: 0x1},
-		unicode.Range16{Lo: 0xa766, Hi: 0xa766, Stride: 0x1},
-		unicode.Range16{Lo: 0xa768, Hi: 0xa768, Stride: 0x1},
-		unicode.Range16{Lo: 0xa76a, Hi: 0xa76a, Stride: 0x1},
-		unicode.Range16{Lo: 0xa76c, Hi: 0xa76c, Stride: 0x1},
-		unicode.Range16{Lo: 0xa76e, Hi: 0xa76e, Stride: 0x1},
-		unicode.Range16{Lo: 0xa779, Hi: 0xa779, Stride: 0x1},
-		unicode.Range16{Lo: 0xa77b, Hi: 0xa77b, Stride: 0x1},
-		unicode.Range16{Lo: 0xa77d, Hi: 0xa77e, Stride: 0x1},
-		unicode.Range16{Lo: 0xa780, Hi: 0xa780, Stride: 0x1},
-		unicode.Range16{Lo: 0xa782, Hi: 0xa782, Stride: 0x1},
-		unicode.Range16{Lo: 0xa784, Hi: 0xa784, Stride: 0x1},
-		unicode.Range16{Lo: 0xa786, Hi: 0xa786, Stride: 0x1},
-		unicode.Range16{Lo: 0xa78b, Hi: 0xa78b, Stride: 0x1},
-		unicode.Range16{Lo: 0xa78d, Hi: 0xa78d, Stride: 0x1},
-		unicode.Range16{Lo: 0xa790, Hi: 0xa790, Stride: 0x1},
-		unicode.Range16{Lo: 0xa792, Hi: 0xa792, Stride: 0x1},
-		unicode.Range16{Lo: 0xa796, Hi: 0xa796, Stride: 0x1},
-		unicode.Range16{Lo: 0xa798, Hi: 0xa798, Stride: 0x1},
-		unicode.Range16{Lo: 0xa79a, Hi: 0xa79a, Stride: 0x1},
-		unicode.Range16{Lo: 0xa79c, Hi: 0xa79c, Stride: 0x1},
-		unicode.Range16{Lo: 0xa79e, Hi: 0xa79e, Stride: 0x1},
-		unicode.Range16{Lo: 0xa7a0, Hi: 0xa7a0, Stride: 0x1},
-		unicode.Range16{Lo: 0xa7a2, Hi: 0xa7a2, Stride: 0x1},
-		unicode.Range16{Lo: 0xa7a4, Hi: 0xa7a4, Stride: 0x1},
-		unicode.Range16{Lo: 0xa7a6, Hi: 0xa7a6, Stride: 0x1},
-		unicode.Range16{Lo: 0xa7a8, Hi: 0xa7a8, Stride: 0x1},
-		unicode.Range16{Lo: 0xa7aa, Hi: 0xa7ae, Stride: 0x1},
-		unicode.Range16{Lo: 0xa7b0, Hi: 0xa7b4, Stride: 0x1},
-		unicode.Range16{Lo: 0xa7b6, Hi: 0xa7b6, Stride: 0x1},
-		unicode.Range16{Lo: 0xa7b8, Hi: 0xa7b8, Stride: 0x1},
-		unicode.Range16{Lo: 0xa7ba, Hi: 0xa7ba, Stride: 0x1},
-		unicode.Range16{Lo: 0xa7bc, Hi: 0xa7bc, Stride: 0x1},
-		unicode.Range16{Lo: 0xa7be, Hi: 0xa7be, Stride: 0x1},
-		unicode.Range16{Lo: 0xa7c2, Hi: 0xa7c2, Stride: 0x1},
-		unicode.Range16{Lo: 0xa7c4, Hi: 0xa7c6, Stride: 0x1},
-		unicode.Range16{Lo: 0xff21, Hi: 0xff3a, Stride: 0x1},
-	},
-	R32: []unicode.Range32{
-		unicode.Range32{Lo: 0x10400, Hi: 0x10427, Stride: 0x1},
-		unicode.Range32{Lo: 0x104b0, Hi: 0x104d3, Stride: 0x1},
-		unicode.Range32{Lo: 0x10c80, Hi: 0x10cb2, Stride: 0x1},
-		unicode.Range32{Lo: 0x118a0, Hi: 0x118bf, Stride: 0x1},
-		unicode.Range32{Lo: 0x16e40, Hi: 0x16e5f, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d400, Hi: 0x1d419, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d434, Hi: 0x1d44d, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d468, Hi: 0x1d481, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d49c, Hi: 0x1d49c, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d49e, Hi: 0x1d49f, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d4a2, Hi: 0x1d4a2, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d4a5, Hi: 0x1d4a6, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d4a9, Hi: 0x1d4ac, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d4ae, Hi: 0x1d4b5, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d4d0, Hi: 0x1d4e9, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d504, Hi: 0x1d505, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d507, Hi: 0x1d50a, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d50d, Hi: 0x1d514, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d516, Hi: 0x1d51c, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d538, Hi: 0x1d539, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d53b, Hi: 0x1d53e, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d540, Hi: 0x1d544, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d546, Hi: 0x1d546, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d54a, Hi: 0x1d550, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d56c, Hi: 0x1d585, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d5a0, Hi: 0x1d5b9, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d5d4, Hi: 0x1d5ed, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d608, Hi: 0x1d621, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d63c, Hi: 0x1d655, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d670, Hi: 0x1d689, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d6a8, Hi: 0x1d6c0, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d6e2, Hi: 0x1d6fa, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d71c, Hi: 0x1d734, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d756, Hi: 0x1d76e, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d790, Hi: 0x1d7a8, Stride: 0x1},
-		unicode.Range32{Lo: 0x1d7ca, Hi: 0x1d7ca, Stride: 0x1},
-		unicode.Range32{Lo: 0x1e900, Hi: 0x1e921, Stride: 0x1},
-		unicode.Range32{Lo: 0x1f130, Hi: 0x1f149, Stride: 0x1},
-		unicode.Range32{Lo: 0x1f150, Hi: 0x1f169, Stride: 0x1},
-		unicode.Range32{Lo: 0x1f170, Hi: 0x1f189, Stride: 0x1},
-	},
-	LatinOffset: 3,
-}
-
-type _SentenceRuneRange unicode.RangeTable
-
-func _SentenceRuneType(r rune) *_SentenceRuneRange {
-	switch {
-	case unicode.Is(_SentenceATerm, r):
-		return (*_SentenceRuneRange)(_SentenceATerm)
-	case unicode.Is(_SentenceCR, r):
-		return (*_SentenceRuneRange)(_SentenceCR)
-	case unicode.Is(_SentenceClose, r):
-		return (*_SentenceRuneRange)(_SentenceClose)
-	case unicode.Is(_SentenceExtend, r):
-		return (*_SentenceRuneRange)(_SentenceExtend)
-	case unicode.Is(_SentenceFormat, r):
-		return (*_SentenceRuneRange)(_SentenceFormat)
-	case unicode.Is(_SentenceLF, r):
-		return (*_SentenceRuneRange)(_SentenceLF)
-	case unicode.Is(_SentenceLower, r):
-		return (*_SentenceRuneRange)(_SentenceLower)
-	case unicode.Is(_SentenceNumeric, r):
-		return (*_SentenceRuneRange)(_SentenceNumeric)
-	case unicode.Is(_SentenceOLetter, r):
-		return (*_SentenceRuneRange)(_SentenceOLetter)
-	case unicode.Is(_SentenceSContinue, r):
-		return (*_SentenceRuneRange)(_SentenceSContinue)
-	case unicode.Is(_SentenceSTerm, r):
-		return (*_SentenceRuneRange)(_SentenceSTerm)
-	case unicode.Is(_SentenceSep, r):
-		return (*_SentenceRuneRange)(_SentenceSep)
-	case unicode.Is(_SentenceSp, r):
-		return (*_SentenceRuneRange)(_SentenceSp)
-	case unicode.Is(_SentenceUpper, r):
-		return (*_SentenceRuneRange)(_SentenceUpper)
-	default:
-		return nil
-	}
-}
-func (rng *_SentenceRuneRange) String() string {
-	switch (*unicode.RangeTable)(rng) {
-	case _SentenceATerm:
-		return "ATerm"
-	case _SentenceCR:
-		return "CR"
-	case _SentenceClose:
-		return "Close"
-	case _SentenceExtend:
-		return "Extend"
-	case _SentenceFormat:
-		return "Format"
-	case _SentenceLF:
-		return "LF"
-	case _SentenceLower:
-		return "Lower"
-	case _SentenceNumeric:
-		return "Numeric"
-	case _SentenceOLetter:
-		return "OLetter"
-	case _SentenceSContinue:
-		return "SContinue"
-	case _SentenceSTerm:
-		return "STerm"
-	case _SentenceSep:
-		return "Sep"
-	case _SentenceSp:
-		return "Sp"
-	case _SentenceUpper:
-		return "Upper"
-	default:
-		return "Other"
-	}
-}
diff --git a/.ci/providerlint/vendor/github.com/apparentlymart/go-textseg/v13/LICENSE b/.ci/providerlint/vendor/github.com/apparentlymart/go-textseg/v15/LICENSE
similarity index 100%
rename from .ci/providerlint/vendor/github.com/apparentlymart/go-textseg/v13/LICENSE
rename to .ci/providerlint/vendor/github.com/apparentlymart/go-textseg/v15/LICENSE
diff --git a/.ci/providerlint/vendor/github.com/apparentlymart/go-textseg/v13/textseg/all_tokens.go b/.ci/providerlint/vendor/github.com/apparentlymart/go-textseg/v15/textseg/all_tokens.go
similarity index 100%
rename from .ci/providerlint/vendor/github.com/apparentlymart/go-textseg/v13/textseg/all_tokens.go
rename to .ci/providerlint/vendor/github.com/apparentlymart/go-textseg/v15/textseg/all_tokens.go
diff --git a/.ci/providerlint/vendor/github.com/apparentlymart/go-textseg/v13/textseg/emoji_table.rl b/.ci/providerlint/vendor/github.com/apparentlymart/go-textseg/v15/textseg/emoji_table.rl
similarity index 93%
rename from .ci/providerlint/vendor/github.com/apparentlymart/go-textseg/v13/textseg/emoji_table.rl
rename to .ci/providerlint/vendor/github.com/apparentlymart/go-textseg/v15/textseg/emoji_table.rl
index f2cb484a3d7..10b93e474f2 100644
--- a/.ci/providerlint/vendor/github.com/apparentlymart/go-textseg/v13/textseg/emoji_table.rl
+++ b/.ci/providerlint/vendor/github.com/apparentlymart/go-textseg/v15/textseg/emoji_table.rl
@@ -1,5 +1,5 @@
 # The following Ragel file was autogenerated with unicode2ragel.rb 
-# from: https://www.unicode.org/Public/13.0.0/ucd/emoji/emoji-data.txt
+# from: https://www.unicode.org/Public/15.0.0/ucd/emoji/emoji-data.txt
 #
 # It defines ["Extended_Pictographic"].
 #
@@ -150,8 +150,8 @@
       | 0xE2 0x9D 0x87          #E0.6   [1] (❇️)       sparkle
       | 0xE2 0x9D 0x8C          #E0.6   [1] (❌)       cross mark
       | 0xE2 0x9D 0x8E          #E0.6   [1] (❎)       cross mark button
-      | 0xE2 0x9D 0x93..0x95    #E0.6   [3] (❓..❕)    question mark..white e...
-      | 0xE2 0x9D 0x97          #E0.6   [1] (❗)       exclamation mark
+      | 0xE2 0x9D 0x93..0x95    #E0.6   [3] (❓..❕)    red question mark..whi...
+      | 0xE2 0x9D 0x97          #E0.6   [1] (❗)       red exclamation mark
       | 0xE2 0x9D 0xA3          #E1.0   [1] (❣️)       heart exclamation
       | 0xE2 0x9D 0xA4          #E0.6   [1] (❤️)       red heart
       | 0xE2 0x9D 0xA5..0xA7    #E0.0   [3] (❥..❧)    ROTATED HEAVY BLACK HE...
@@ -299,7 +299,7 @@
       | 0xF0 0x9F 0x94 0x89     #E1.0   [1] (🔉)       speaker medium volume
       | 0xF0 0x9F 0x94 0x8A..0x94  #E0.6  [11] (🔊..🔔)    speaker high volume...
       | 0xF0 0x9F 0x94 0x95     #E1.0   [1] (🔕)       bell with slash
-      | 0xF0 0x9F 0x94 0x96..0xAB  #E0.6  [22] (🔖..🔫)    bookmark..pistol
+      | 0xF0 0x9F 0x94 0x96..0xAB  #E0.6  [22] (🔖..🔫)    bookmark..water pistol
       | 0xF0 0x9F 0x94 0xAC..0xAD  #E1.0   [2] (🔬..🔭)    microscope..telescope
       | 0xF0 0x9F 0x94 0xAE..0xBD  #E0.6  [16] (🔮..🔽)    crystal ball..downw...
       | 0xF0 0x9F 0x95 0x86..0x88  #E0.0   [3] (🕆..🕈)    WHITE LATIN CROSS.....
@@ -377,7 +377,7 @@
       | 0xF0 0x9F 0x98 0xAE..0xAF  #E1.0   [2] (😮..😯)    face with open mout...
       | 0xF0 0x9F 0x98 0xB0..0xB3  #E0.6   [4] (😰..😳)    anxious face with s...
       | 0xF0 0x9F 0x98 0xB4     #E1.0   [1] (😴)       sleeping face
-      | 0xF0 0x9F 0x98 0xB5     #E0.6   [1] (😵)       dizzy face
+      | 0xF0 0x9F 0x98 0xB5     #E0.6   [1] (😵)       face with crossed-out ...
       | 0xF0 0x9F 0x98 0xB6     #E1.0   [1] (😶)       face without mouth
       | 0xF0 0x9F 0x98 0xB7..0xFF  #E0.6  [10] (😷..🙀)    face with medical m...
       | 0xF0 0x9F 0x99 0x00..0x80  #
@@ -427,7 +427,9 @@
       | 0xF0 0x9F 0x9B 0x93..0x94  #E0.0   [2] (🛓..🛔)    STUPA..PAGODA
       | 0xF0 0x9F 0x9B 0x95     #E12.0  [1] (🛕)       hindu temple
       | 0xF0 0x9F 0x9B 0x96..0x97  #E13.0  [2] (🛖..🛗)    hut..elevator
-      | 0xF0 0x9F 0x9B 0x98..0x9F  #E0.0   [8] (🛘..🛟)    <reserved-1F6D8>..<...
+      | 0xF0 0x9F 0x9B 0x98..0x9B  #E0.0   [4] (🛘..🛛)    <reserved-1F6D8>..<...
+      | 0xF0 0x9F 0x9B 0x9C     #E15.0  [1] (🛜)       wireless
+      | 0xF0 0x9F 0x9B 0x9D..0x9F  #E14.0  [3] (🛝..🛟)    playground slide..r...
       | 0xF0 0x9F 0x9B 0xA0..0xA5  #E0.7   [6] (🛠️..🛥️)    hammer and wrench...
       | 0xF0 0x9F 0x9B 0xA6..0xA8  #E0.0   [3] (🛦..🛨)    UP-POINTING MILITAR...
       | 0xF0 0x9F 0x9B 0xA9     #E0.7   [1] (🛩️)       small airplane
@@ -443,10 +445,12 @@
       | 0xF0 0x9F 0x9B 0xBA     #E12.0  [1] (🛺)       auto rickshaw
       | 0xF0 0x9F 0x9B 0xBB..0xBC  #E13.0  [2] (🛻..🛼)    pickup truck..rolle...
       | 0xF0 0x9F 0x9B 0xBD..0xBF  #E0.0   [3] (🛽..🛿)    <reserved-1F6FD>..<...
-      | 0xF0 0x9F 0x9D 0xB4..0xBF  #E0.0  [12] (🝴..🝿)    <reserved-1F774>..<...
+      | 0xF0 0x9F 0x9D 0xB4..0xBF  #E0.0  [12] (🝴..🝿)    LOT OF FORTUNE..ORCUS
       | 0xF0 0x9F 0x9F 0x95..0x9F  #E0.0  [11] (🟕..🟟)    CIRCLED TRIANGLE..<...
       | 0xF0 0x9F 0x9F 0xA0..0xAB  #E12.0 [12] (🟠..🟫)    orange circle..brow...
-      | 0xF0 0x9F 0x9F 0xAC..0xBF  #E0.0  [20] (🟬..🟿)    <reserved-1F7EC>..<...
+      | 0xF0 0x9F 0x9F 0xAC..0xAF  #E0.0   [4] (🟬..🟯)    <reserved-1F7EC>..<...
+      | 0xF0 0x9F 0x9F 0xB0     #E14.0  [1] (🟰)       heavy equals sign
+      | 0xF0 0x9F 0x9F 0xB1..0xBF  #E0.0  [15] (🟱..🟿)    <reserved-1F7F1>..<...
       | 0xF0 0x9F 0xA0 0x8C..0x8F  #E0.0   [4] (🠌..🠏)    <reserved-1F80C>..<...
       | 0xF0 0x9F 0xA1 0x88..0x8F  #E0.0   [8] (🡈..🡏)    <reserved-1F848>..<...
       | 0xF0 0x9F 0xA1 0x9A..0x9F  #E0.0   [6] (🡚..🡟)    <reserved-1F85A>..<...
@@ -476,7 +480,7 @@
       | 0xF0 0x9F 0xA5 0xB2     #E13.0  [1] (🥲)       smiling face with tear
       | 0xF0 0x9F 0xA5 0xB3..0xB6  #E11.0  [4] (🥳..🥶)    partying face..cold...
       | 0xF0 0x9F 0xA5 0xB7..0xB8  #E13.0  [2] (🥷..🥸)    ninja..disguised face
-      | 0xF0 0x9F 0xA5 0xB9     #E0.0   [1] (🥹)       <reserved-1F979>
+      | 0xF0 0x9F 0xA5 0xB9     #E14.0  [1] (🥹)       face holding back tears
       | 0xF0 0x9F 0xA5 0xBA     #E11.0  [1] (🥺)       pleading face
       | 0xF0 0x9F 0xA5 0xBB     #E12.0  [1] (🥻)       sari
       | 0xF0 0x9F 0xA5 0xBC..0xBF  #E11.0  [4] (🥼..🥿)    lab coat..flat shoe
@@ -494,7 +498,7 @@
       | 0xF0 0x9F 0xA7 0x81..0x82  #E11.0  [2] (🧁..🧂)    cupcake..salt
       | 0xF0 0x9F 0xA7 0x83..0x8A  #E12.0  [8] (🧃..🧊)    beverage box..ice
       | 0xF0 0x9F 0xA7 0x8B     #E13.0  [1] (🧋)       bubble tea
-      | 0xF0 0x9F 0xA7 0x8C     #E0.0   [1] (🧌)       <reserved-1F9CC>
+      | 0xF0 0x9F 0xA7 0x8C     #E14.0  [1] (🧌)       troll
       | 0xF0 0x9F 0xA7 0x8D..0x8F  #E12.0  [3] (🧍..🧏)    person standing..de...
       | 0xF0 0x9F 0xA7 0x90..0xA6  #E5.0  [23] (🧐..🧦)    face with monocle.....
       | 0xF0 0x9F 0xA7 0xA7..0xBF  #E11.0 [25] (🧧..🧿)    red envelope..nazar...
@@ -502,21 +506,37 @@
       | 0xF0 0x9F 0xA9 0x00..0xAF  #
       | 0xF0 0x9F 0xA9 0xB0..0xB3  #E12.0  [4] (🩰..🩳)    ballet shoes..shorts
       | 0xF0 0x9F 0xA9 0xB4     #E13.0  [1] (🩴)       thong sandal
-      | 0xF0 0x9F 0xA9 0xB5..0xB7  #E0.0   [3] (🩵..🩷)    <reserved-1FA75>..<...
+      | 0xF0 0x9F 0xA9 0xB5..0xB7  #E15.0  [3] (🩵..🩷)    light blue heart..p...
       | 0xF0 0x9F 0xA9 0xB8..0xBA  #E12.0  [3] (🩸..🩺)    drop of blood..stet...
-      | 0xF0 0x9F 0xA9 0xBB..0xBF  #E0.0   [5] (🩻..🩿)    <reserved-1FA7B>..<...
+      | 0xF0 0x9F 0xA9 0xBB..0xBC  #E14.0  [2] (🩻..🩼)    x-ray..crutch
+      | 0xF0 0x9F 0xA9 0xBD..0xBF  #E0.0   [3] (🩽..🩿)    <reserved-1FA7D>..<...
       | 0xF0 0x9F 0xAA 0x80..0x82  #E12.0  [3] (🪀..🪂)    yo-yo..parachute
       | 0xF0 0x9F 0xAA 0x83..0x86  #E13.0  [4] (🪃..🪆)    boomerang..nesting ...
-      | 0xF0 0x9F 0xAA 0x87..0x8F  #E0.0   [9] (🪇..🪏)    <reserved-1FA87>..<...
+      | 0xF0 0x9F 0xAA 0x87..0x88  #E15.0  [2] (🪇..🪈)    maracas..flute
+      | 0xF0 0x9F 0xAA 0x89..0x8F  #E0.0   [7] (🪉..🪏)    <reserved-1FA89>..<...
       | 0xF0 0x9F 0xAA 0x90..0x95  #E12.0  [6] (🪐..🪕)    ringed planet..banjo
       | 0xF0 0x9F 0xAA 0x96..0xA8  #E13.0 [19] (🪖..🪨)    military helmet..rock
-      | 0xF0 0x9F 0xAA 0xA9..0xAF  #E0.0   [7] (🪩..🪯)    <reserved-1FAA9>..<...
+      | 0xF0 0x9F 0xAA 0xA9..0xAC  #E14.0  [4] (🪩..🪬)    mirror ball..hamsa
+      | 0xF0 0x9F 0xAA 0xAD..0xAF  #E15.0  [3] (🪭..🪯)    folding hand fan..k...
       | 0xF0 0x9F 0xAA 0xB0..0xB6  #E13.0  [7] (🪰..🪶)    fly..feather
-      | 0xF0 0x9F 0xAA 0xB7..0xBF  #E0.0   [9] (🪷..🪿)    <reserved-1FAB7>..<...
+      | 0xF0 0x9F 0xAA 0xB7..0xBA  #E14.0  [4] (🪷..🪺)    lotus..nest with eggs
+      | 0xF0 0x9F 0xAA 0xBB..0xBD  #E15.0  [3] (🪻..🪽)    hyacinth..wing
+      | 0xF0 0x9F 0xAA 0xBE     #E0.0   [1] (🪾)       <reserved-1FABE>
+      | 0xF0 0x9F 0xAA 0xBF     #E15.0  [1] (🪿)       goose
       | 0xF0 0x9F 0xAB 0x80..0x82  #E13.0  [3] (🫀..🫂)    anatomical heart..p...
-      | 0xF0 0x9F 0xAB 0x83..0x8F  #E0.0  [13] (🫃..🫏)    <reserved-1FAC3>..<...
+      | 0xF0 0x9F 0xAB 0x83..0x85  #E14.0  [3] (🫃..🫅)    pregnant man..perso...
+      | 0xF0 0x9F 0xAB 0x86..0x8D  #E0.0   [8] (🫆..🫍)    <reserved-1FAC6>..<...
+      | 0xF0 0x9F 0xAB 0x8E..0x8F  #E15.0  [2] (🫎..🫏)    moose..donkey
       | 0xF0 0x9F 0xAB 0x90..0x96  #E13.0  [7] (🫐..🫖)    blueberries..teapot
-      | 0xF0 0x9F 0xAB 0x97..0xBF  #E0.0  [41] (🫗..🫿)    <reserved-1FAD7>..<...
+      | 0xF0 0x9F 0xAB 0x97..0x99  #E14.0  [3] (🫗..🫙)    pouring liquid..jar
+      | 0xF0 0x9F 0xAB 0x9A..0x9B  #E15.0  [2] (🫚..🫛)    ginger root..pea pod
+      | 0xF0 0x9F 0xAB 0x9C..0x9F  #E0.0   [4] (🫜..🫟)    <reserved-1FADC>..<...
+      | 0xF0 0x9F 0xAB 0xA0..0xA7  #E14.0  [8] (🫠..🫧)    melting face..bubbles
+      | 0xF0 0x9F 0xAB 0xA8     #E15.0  [1] (🫨)       shaking face
+      | 0xF0 0x9F 0xAB 0xA9..0xAF  #E0.0   [7] (🫩..🫯)    <reserved-1FAE9>..<...
+      | 0xF0 0x9F 0xAB 0xB0..0xB6  #E14.0  [7] (🫰..🫶)    hand with index fin...
+      | 0xF0 0x9F 0xAB 0xB7..0xB8  #E15.0  [2] (🫷..🫸)    leftwards pushing h...
+      | 0xF0 0x9F 0xAB 0xB9..0xBF  #E0.0   [7] (🫹..🫿)    <reserved-1FAF9>..<...
       | 0xF0 0x9F 0xB0 0x80..0xFF        #E0.0[1022] (🰀..🿽)    <reserved-1FC...
       | 0xF0 0x9F 0xB1..0xBE 0x00..0xFF  #
       | 0xF0 0x9F 0xBF 0x00..0xBD        #
diff --git a/.ci/providerlint/vendor/github.com/apparentlymart/go-textseg/v15/textseg/generate.go b/.ci/providerlint/vendor/github.com/apparentlymart/go-textseg/v15/textseg/generate.go
new file mode 100644
index 00000000000..644faad5dbb
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/apparentlymart/go-textseg/v15/textseg/generate.go
@@ -0,0 +1,8 @@
+package textseg
+
+//go:generate go run make_tables.go -output tables.go
+//go:generate go run make_test_tables.go -output tables_test.go
+//go:generate ruby unicode2ragel.rb --url=https://www.unicode.org/Public/15.0.0/ucd/auxiliary/GraphemeBreakProperty.txt -m GraphemeCluster -p "Prepend,CR,LF,Control,Extend,Regional_Indicator,SpacingMark,L,V,T,LV,LVT,ZWJ" -o grapheme_clusters_table.rl
+//go:generate ruby unicode2ragel.rb --url=https://www.unicode.org/Public/15.0.0/ucd/emoji/emoji-data.txt -m Emoji -p "Extended_Pictographic" -o emoji_table.rl
+//go:generate ragel -Z grapheme_clusters.rl
+//go:generate gofmt -w grapheme_clusters.go
diff --git a/.ci/providerlint/vendor/github.com/apparentlymart/go-textseg/v15/textseg/grapheme_clusters.go b/.ci/providerlint/vendor/github.com/apparentlymart/go-textseg/v15/textseg/grapheme_clusters.go
new file mode 100644
index 00000000000..eef213dacb1
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/apparentlymart/go-textseg/v15/textseg/grapheme_clusters.go
@@ -0,0 +1,4349 @@
+//line grapheme_clusters.rl:1
+package textseg
+
+import (
+	"errors"
+	"unicode/utf8"
+)
+
+// Generated from grapheme_clusters.rl. DO NOT EDIT
+
+//line grapheme_clusters.go:13
+var _graphclust_actions []byte = []byte{
+	0, 1, 0, 1, 4, 1, 11, 1, 12,
+	1, 13, 1, 14, 1, 15, 1, 16,
+	1, 17, 1, 18, 1, 19, 1, 20,
+	1, 21, 1, 22, 1, 23, 2, 1,
+	9, 2, 1, 10, 2, 2, 3, 2,
+	5, 1, 3, 0, 1, 10, 3, 5,
+	1, 6, 3, 5, 1, 7, 3, 5,
+	1, 8, 4, 5, 0, 1, 8,
+}
+
+var _graphclust_key_offsets []int16 = []int16{
+	0, 0, 1, 3, 5, 7, 10, 15,
+	17, 20, 28, 31, 33, 35, 38, 69,
+	77, 79, 81, 85, 88, 93, 98, 110,
+	122, 130, 135, 145, 148, 155, 160, 168,
+	179, 185, 193, 195, 203, 206, 208, 211,
+	213, 220, 222, 230, 231, 253, 257, 263,
+	268, 270, 274, 278, 280, 284, 287, 290,
+	294, 296, 303, 305, 307, 311, 315, 319,
+	321, 323, 331, 333, 338, 340, 342, 344,
+	345, 347, 349, 351, 353, 368, 372, 374,
+	376, 382, 386, 392, 394, 396, 400, 404,
+	406, 410, 417, 422, 426, 429, 430, 434,
+	443, 453, 454, 455, 457, 466, 468, 470,
+	472, 474, 476, 478, 516, 520, 526, 530,
+	531, 535, 538, 542, 547, 550, 551, 553,
+	559, 572, 574, 577, 579, 583, 587, 589,
+	591, 595, 597, 603, 606, 611, 617, 620,
+	622, 626, 630, 637, 640, 646, 648, 655,
+	657, 658, 661, 666, 668, 670, 673, 677,
+	680, 681, 683, 685, 689, 691, 697, 703,
+	709, 711, 715, 719, 724, 732, 742, 743,
+	744, 746, 748, 750, 751, 753, 754, 760,
+	762, 764, 764, 771, 773, 775, 777, 780,
+	785, 787, 790, 798, 801, 803, 805, 808,
+	839, 847, 849, 851, 855, 858, 863, 868,
+	880, 892, 900, 905, 915, 918, 925, 930,
+	938, 949, 955, 963, 965, 973, 976, 978,
+	981, 983, 990, 992, 1000, 1001, 1023, 1027,
+	1033, 1038, 1040, 1044, 1048, 1050, 1054, 1057,
+	1060, 1064, 1066, 1073, 1075, 1077, 1081, 1085,
+	1089, 1091, 1093, 1101, 1103, 1108, 1110, 1112,
+	1136, 1139, 1140, 1142, 1144, 1148, 1151, 1152,
+	1157, 1158, 1161, 1164, 1170, 1174, 1174, 1188,
+	1197, 1202, 1204, 1208, 1210, 1212, 1213, 1215,
+	1218, 1221, 1223, 1225, 1240, 1244, 1246, 1248,
+	1254, 1258, 1264, 1266, 1268, 1272, 1276, 1278,
+	1282, 1289, 1294, 1298, 1301, 1302, 1306, 1315,
+	1325, 1326, 1327, 1329, 1338, 1340, 1342, 1344,
+	1346, 1348, 1350, 1388, 1392, 1398, 1402, 1406,
+	1409, 1413, 1418, 1421, 1422, 1424, 1430, 1443,
+	1445, 1448, 1450, 1454, 1458, 1460, 1462, 1466,
+	1468, 1474, 1477, 1482, 1488, 1491, 1493, 1497,
+	1501, 1508, 1511, 1517, 1519, 1526, 1528, 1529,
+	1532, 1537, 1539, 1541, 1544, 1548, 1551, 1552,
+	1554, 1556, 1560, 1562, 1568, 1574, 1580, 1582,
+	1586, 1590, 1595, 1603, 1613, 1614, 1615, 1617,
+	1619, 1621, 1661, 1663, 1666, 1670, 1675, 1677,
+	1685, 1687, 1689, 1691, 1693, 1695, 1697, 1699,
+	1703, 1707, 1711, 1715, 1716, 1722, 1724, 1726,
+	1728, 1737, 1738, 1740, 1745, 1747, 1749, 1751,
+	1754, 1759, 1761, 1764, 1772, 1775, 1777, 1779,
+	1782, 1813, 1821, 1823, 1825, 1829, 1832, 1837,
+	1842, 1854, 1866, 1874, 1879, 1889, 1892, 1899,
+	1904, 1912, 1923, 1929, 1937, 1939, 1947, 1950,
+	1952, 1955, 1957, 1964, 1966, 1974, 1975, 1997,
+	2001, 2007, 2012, 2014, 2018, 2022, 2024, 2028,
+	2031, 2034, 2038, 2040, 2047, 2049, 2051, 2055,
+	2059, 2063, 2065, 2067, 2075, 2077, 2082, 2084,
+	2086, 2088, 2089, 2091, 2093, 2095, 2097, 2112,
+	2116, 2118, 2120, 2126, 2130, 2136, 2138, 2140,
+	2144, 2148, 2150, 2154, 2161, 2166, 2170, 2173,
+	2174, 2178, 2187, 2197, 2198, 2199, 2201, 2210,
+	2212, 2214, 2216, 2218, 2220, 2222, 2260, 2264,
+	2270, 2274, 2275, 2279, 2282, 2286, 2291, 2294,
+	2295, 2297, 2303, 2316, 2318, 2321, 2323, 2327,
+	2331, 2333, 2335, 2339, 2341, 2347, 2350, 2355,
+	2361, 2364, 2366, 2370, 2374, 2381, 2384, 2390,
+	2392, 2399, 2401, 2402, 2405, 2410, 2412, 2414,
+	2417, 2421, 2424, 2425, 2427, 2429, 2433, 2435,
+	2441, 2447, 2453, 2455, 2459, 2463, 2468, 2476,
+	2486, 2487, 2488, 2490, 2492, 2494, 2495, 2497,
+	2498, 2504, 2506, 2508, 2508, 2514, 2516, 2518,
+	2520, 2523, 2528, 2530, 2533, 2541, 2544, 2546,
+	2548, 2551, 2582, 2590, 2592, 2594, 2598, 2601,
+	2606, 2611, 2623, 2635, 2643, 2648, 2658, 2661,
+	2668, 2673, 2681, 2692, 2698, 2706, 2708, 2716,
+	2719, 2721, 2724, 2726, 2733, 2735, 2743, 2744,
+	2766, 2770, 2776, 2781, 2783, 2787, 2791, 2793,
+	2797, 2800, 2803, 2807, 2809, 2816, 2818, 2820,
+	2824, 2828, 2832, 2834, 2836, 2844, 2846, 2851,
+	2853, 2855, 2879, 2882, 2883, 2885, 2887, 2891,
+	2894, 2895, 2900, 2901, 2904, 2907, 2913, 2917,
+	2917, 2931, 2940, 2945, 2947, 2951, 2953, 2955,
+	2956, 2958, 2961, 2964, 2966, 2968, 2983, 2987,
+	2989, 2991, 2997, 3001, 3007, 3009, 3011, 3015,
+	3019, 3021, 3025, 3032, 3037, 3041, 3044, 3045,
+	3049, 3058, 3068, 3069, 3070, 3072, 3081, 3083,
+	3085, 3087, 3089, 3091, 3093, 3131, 3135, 3141,
+	3145, 3149, 3152, 3156, 3161, 3164, 3165, 3167,
+	3173, 3186, 3188, 3191, 3193, 3197, 3201, 3203,
+	3205, 3209, 3211, 3217, 3220, 3225, 3231, 3234,
+	3236, 3240, 3244, 3251, 3254, 3260, 3262, 3269,
+	3271, 3272, 3275, 3280, 3282, 3284, 3287, 3291,
+	3294, 3295, 3297, 3299, 3303, 3305, 3311, 3317,
+	3323, 3325, 3329, 3333, 3338, 3346, 3356, 3357,
+	3358, 3360, 3362, 3364, 3404, 3406, 3409, 3413,
+	3418, 3420, 3428, 3430, 3432, 3434, 3436, 3438,
+	3440, 3442, 3446, 3450, 3454, 3458, 3459, 3465,
+	3467, 3469, 3471, 3480, 3481, 3483, 3489, 3492,
+	3495, 3500, 3506, 3509, 3512, 3519, 3521, 3546,
+	3548, 3573, 3575, 3577, 3601, 3603, 3605, 3606,
+	3608, 3610, 3612, 3618, 3620, 3652, 3656, 3661,
+	3685, 3687, 3689, 3691, 3693, 3696, 3698, 3700,
+	3704, 3704, 3760, 3816, 3847, 3852, 3856, 3878,
+	3887, 3892, 3896, 3906, 3913, 3916, 3927, 3930,
+	3937, 3943, 3947, 3953, 3969, 3984, 3993, 3999,
+	4009, 4013, 4017, 4021, 4025, 4027, 4047, 4053,
+	4058, 4060, 4062, 4065, 4067, 4069, 4073, 4129,
+	4185, 4218, 4223, 4231, 4235, 4237, 4242, 4249,
+	4260, 4263, 4266, 4272, 4275, 4278, 4281, 4287,
+	4290, 4293, 4296, 4298, 4301, 4305, 4308, 4312,
+	4354, 4361, 4369, 4378, 4382, 4391, 4393, 4395,
+	4405, 4409, 4413, 4417, 4421, 4425, 4429, 4433,
+	4439, 4449, 4457, 4462, 4465, 4467, 4470, 4475,
+	4478, 4481, 4486, 4492, 4495, 4498, 4505, 4507,
+	4509, 4511, 4513, 4516, 4521, 4523, 4526, 4534,
+	4537, 4539, 4541, 4544, 4575, 4583, 4585, 4587,
+	4591, 4594, 4599, 4604, 4616, 4628, 4636, 4641,
+	4651, 4654, 4661, 4666, 4674, 4685, 4691, 4699,
+	4701, 4709, 4712, 4714, 4717, 4719, 4726, 4728,
+	4736, 4737, 4759, 4763, 4769, 4774, 4776, 4780,
+	4784, 4786, 4790, 4793, 4796, 4800, 4802, 4809,
+	4811, 4813, 4817, 4821, 4825, 4827, 4829, 4837,
+	4839, 4844, 4846, 4848, 4872, 4875, 4876, 4878,
+	4880, 4884, 4887, 4888, 4893, 4894, 4897, 4900,
+	4906, 4910, 4910, 4924, 4933, 4938, 4940, 4944,
+	4946, 4948, 4949, 4951, 4954, 4957, 4959, 4961,
+	4976, 4980, 4982, 4984, 4990, 4994, 5000, 5002,
+	5004, 5008, 5012, 5014, 5018, 5025, 5030, 5034,
+	5037, 5038, 5042, 5051, 5061, 5062, 5063, 5065,
+	5074, 5076, 5078, 5080, 5082, 5084, 5086, 5124,
+	5128, 5134, 5138, 5142, 5145, 5149, 5154, 5157,
+	5158, 5160, 5166, 5179, 5181, 5184, 5186, 5190,
+	5194, 5196, 5198, 5202, 5204, 5210, 5213, 5218,
+	5224, 5227, 5229, 5233, 5237, 5244, 5247, 5253,
+	5255, 5262, 5264, 5265, 5268, 5273, 5275, 5277,
+	5280, 5284, 5287, 5288, 5290, 5292, 5296, 5298,
+	5304, 5310, 5316, 5318, 5322, 5326, 5331, 5339,
+	5349, 5350, 5351, 5353, 5355, 5357, 5397, 5399,
+	5402, 5406, 5411, 5413, 5421, 5423, 5425, 5427,
+	5429, 5431, 5433, 5435, 5439, 5443, 5447, 5451,
+	5452, 5458, 5460, 5462, 5464, 5473, 5474, 5476,
+	5501, 5503, 5528, 5530, 5532, 5556, 5558, 5560,
+	5561, 5563, 5565, 5567, 5573, 5575, 5607, 5611,
+	5616, 5640, 5642, 5644, 5646, 5648, 5651, 5653,
+	5655, 5659, 5659, 5715, 5771, 5802, 5807, 5810,
+	5832, 5845, 5847, 5849, 5851, 5854, 5859, 5861,
+	5864, 5872, 5875, 5877, 5879, 5882, 5913, 5921,
+	5923, 5925, 5929, 5932, 5937, 5942, 5954, 5966,
+	5974, 5979, 5989, 5992, 5999, 6004, 6012, 6023,
+	6029, 6037, 6039, 6047, 6050, 6052, 6055, 6057,
+	6064, 6066, 6074, 6075, 6097, 6101, 6107, 6112,
+	6114, 6118, 6122, 6124, 6128, 6131, 6134, 6138,
+	6140, 6147, 6149, 6151, 6155, 6159, 6163, 6165,
+	6167, 6175, 6177, 6182, 6184, 6186, 6188, 6189,
+	6191, 6193, 6195, 6197, 6212, 6216, 6218, 6220,
+	6226, 6230, 6236, 6238, 6240, 6244, 6248, 6250,
+	6254, 6261, 6266, 6270, 6273, 6274, 6278, 6287,
+	6297, 6298, 6299, 6301, 6310, 6312, 6314, 6316,
+	6318, 6320, 6322, 6360, 6364, 6370, 6374, 6375,
+	6379, 6382, 6386, 6391, 6394, 6395, 6397, 6403,
+	6416, 6418, 6421, 6423, 6427, 6431, 6433, 6435,
+	6439, 6441, 6447, 6450, 6455, 6461, 6464, 6466,
+	6470, 6474, 6481, 6484, 6490, 6492, 6499, 6501,
+	6502, 6505, 6510, 6512, 6514, 6517, 6521, 6524,
+	6525, 6527, 6529, 6533, 6535, 6541, 6547, 6553,
+	6555, 6559, 6563, 6568, 6576, 6586, 6587, 6588,
+	6590, 6592, 6594, 6595, 6597, 6598, 6604, 6606,
+	6608, 6608, 6615, 6619, 6629, 6636, 6639, 6650,
+	6653, 6660, 6666, 6670, 6676, 6692, 6707, 6716,
+	6722, 6732, 6736, 6740, 6744, 6748, 6750, 6770,
+	6776, 6781, 6783, 6785, 6788, 6790, 6792, 6796,
+	6852, 6908, 6941, 6946, 6954, 6958, 6961, 6968,
+	6975, 6986, 6989, 6992, 6998, 7001, 7004, 7007,
+	7013, 7016, 7019, 7022, 7026, 7029, 7035, 7038,
+	7044, 7086, 7093, 7101, 7110, 7114, 7116, 7118,
+	7120, 7123, 7128, 7130, 7133, 7141, 7144, 7146,
+	7148, 7151, 7182, 7190, 7192, 7194, 7198, 7201,
+	7206, 7211, 7223, 7235, 7243, 7248, 7258, 7261,
+	7268, 7273, 7281, 7292, 7298, 7306, 7308, 7316,
+	7319, 7321, 7324, 7326, 7333, 7335, 7343, 7344,
+	7366, 7370, 7376, 7381, 7383, 7387, 7391, 7393,
+	7397, 7400, 7403, 7407, 7409, 7416, 7418, 7420,
+	7424, 7428, 7432, 7434, 7436, 7444, 7446, 7451,
+	7453, 7455, 7479, 7482, 7483, 7485, 7487, 7491,
+	7494, 7495, 7500, 7501, 7504, 7507, 7513, 7517,
+	7517, 7531, 7540, 7545, 7547, 7551, 7553, 7555,
+	7556, 7558, 7561, 7564, 7566, 7568, 7583, 7587,
+	7589, 7591, 7597, 7601, 7607, 7609, 7611, 7615,
+	7619, 7621, 7625, 7632, 7637, 7641, 7644, 7645,
+	7649, 7658, 7668, 7669, 7670, 7672, 7681, 7683,
+	7685, 7687, 7689, 7691, 7693, 7731, 7735, 7741,
+	7745, 7749, 7752, 7756, 7761, 7764, 7765, 7767,
+	7773, 7786, 7788, 7791, 7793, 7797, 7801, 7803,
+	7805, 7809, 7811, 7817, 7820, 7825, 7831, 7834,
+	7836, 7840, 7844, 7851, 7854, 7860, 7862, 7869,
+	7871, 7872, 7875, 7880, 7882, 7884, 7887, 7891,
+	7894, 7895, 7897, 7899, 7903, 7905, 7911, 7917,
+	7923, 7925, 7929, 7933, 7938, 7946, 7956, 7957,
+	7958, 7960, 7962, 7964, 8004, 8006, 8009, 8013,
+	8018, 8020, 8028, 8030, 8032, 8034, 8036, 8038,
+	8040, 8042, 8046, 8050, 8054, 8058, 8059, 8065,
+	8067, 8069, 8071, 8080, 8081, 8083, 8092, 8094,
+	8096, 8106, 8110, 8114, 8118, 8122, 8126, 8130,
+	8134, 8140, 8150, 8158, 8163, 8166, 8168, 8171,
+	8180, 8184, 8186, 8188, 8192, 8192, 8222, 8242,
+	8262, 8283, 8306, 8326, 8346, 8367, 8390, 8411,
+	8432, 8453, 8473, 8496, 8516, 8537, 8558, 8579,
+	8600, 8620, 8640, 8660,
+}
+
+var _graphclust_trans_keys []byte = []byte{
+	10, 128, 255, 176, 255, 131, 137, 191,
+	145, 189, 135, 129, 130, 132, 133, 144,
+	154, 176, 139, 159, 150, 156, 159, 164,
+	167, 168, 170, 173, 145, 176, 255, 139,
+	255, 166, 176, 189, 171, 179, 160, 161,
+	162, 163, 164, 165, 167, 169, 171, 173,
+	174, 175, 176, 177, 179, 180, 181, 182,
+	183, 184, 185, 186, 187, 188, 189, 190,
+	191, 166, 170, 172, 178, 150, 153, 155,
+	163, 165, 167, 169, 173, 153, 155, 152,
+	159, 138, 161, 163, 255, 189, 132, 185,
+	144, 152, 161, 164, 255, 188, 129, 131,
+	190, 255, 133, 134, 137, 138, 142, 150,
+	152, 161, 164, 189, 191, 255, 131, 134,
+	137, 138, 142, 144, 146, 175, 178, 180,
+	182, 255, 134, 138, 142, 161, 164, 185,
+	192, 255, 188, 129, 131, 190, 191, 128,
+	132, 135, 136, 139, 141, 149, 151, 162,
+	163, 130, 190, 191, 151, 128, 130, 134,
+	136, 138, 141, 188, 128, 132, 190, 255,
+	133, 137, 142, 148, 151, 161, 164, 255,
+	179, 128, 132, 134, 136, 138, 141, 149,
+	150, 162, 163, 128, 131, 187, 188, 190,
+	255, 133, 137, 142, 150, 152, 161, 164,
+	255, 129, 131, 138, 150, 143, 148, 152,
+	159, 178, 179, 177, 179, 186, 135, 142,
+	177, 179, 188, 136, 142, 181, 183, 185,
+	152, 153, 190, 191, 177, 191, 128, 132,
+	134, 135, 141, 151, 153, 188, 134, 128,
+	129, 130, 141, 156, 157, 158, 159, 160,
+	162, 164, 168, 169, 170, 171, 172, 173,
+	174, 175, 176, 179, 183, 173, 183, 185,
+	190, 150, 153, 158, 160, 177, 180, 130,
+	141, 157, 132, 134, 157, 159, 146, 149,
+	178, 180, 146, 147, 178, 179, 180, 255,
+	148, 156, 158, 255, 143, 139, 141, 169,
+	133, 134, 160, 171, 176, 187, 151, 155,
+	160, 162, 191, 149, 158, 165, 188, 176,
+	255, 143, 255, 128, 132, 180, 255, 133,
+	170, 180, 255, 128, 130, 161, 173, 166,
+	179, 164, 183, 173, 180, 144, 146, 148,
+	168, 183, 185, 128, 191, 128, 131, 179,
+	181, 183, 140, 141, 144, 176, 175, 177,
+	191, 160, 191, 128, 130, 170, 175, 153,
+	154, 153, 154, 155, 160, 162, 163, 164,
+	165, 166, 167, 168, 169, 170, 171, 175,
+	175, 178, 180, 189, 158, 159, 176, 177,
+	130, 134, 139, 172, 163, 167, 128, 129,
+	180, 255, 134, 159, 178, 190, 192, 255,
+	166, 173, 135, 147, 128, 131, 179, 255,
+	129, 164, 166, 255, 169, 182, 131, 188,
+	140, 141, 176, 178, 180, 183, 184, 190,
+	191, 129, 171, 175, 181, 182, 163, 170,
+	172, 173, 172, 184, 190, 158, 128, 143,
+	160, 175, 144, 145, 147, 150, 155, 156,
+	157, 158, 159, 135, 139, 141, 168, 171,
+	180, 186, 187, 189, 190, 189, 160, 182,
+	186, 191, 129, 131, 133, 134, 140, 143,
+	184, 186, 165, 166, 164, 167, 171, 172,
+	189, 191, 134, 144, 130, 133, 128, 129,
+	130, 131, 132, 133, 134, 135, 136, 137,
+	139, 140, 141, 144, 145, 146, 147, 150,
+	151, 152, 153, 154, 156, 160, 164, 165,
+	167, 168, 169, 170, 176, 178, 180, 181,
+	182, 187, 188, 189, 128, 130, 184, 255,
+	135, 175, 177, 178, 181, 190, 131, 175,
+	187, 255, 130, 128, 130, 167, 180, 179,
+	133, 134, 128, 130, 179, 255, 141, 129,
+	136, 144, 255, 190, 172, 183, 129, 159,
+	170, 128, 131, 187, 188, 190, 191, 151,
+	128, 132, 135, 136, 139, 141, 162, 163,
+	166, 172, 176, 180, 181, 191, 158, 128,
+	134, 132, 255, 175, 181, 184, 255, 129,
+	155, 158, 255, 129, 255, 171, 183, 157,
+	159, 162, 171, 172, 186, 176, 181, 183,
+	184, 187, 190, 128, 130, 131, 164, 145,
+	151, 154, 160, 129, 138, 179, 185, 187,
+	190, 135, 145, 155, 138, 153, 175, 182,
+	184, 191, 146, 167, 169, 182, 186, 177,
+	182, 188, 189, 191, 255, 134, 136, 255,
+	138, 142, 144, 145, 147, 151, 179, 182,
+	131, 128, 129, 180, 186, 190, 191, 128,
+	130, 145, 128, 135, 149, 171, 172, 189,
+	190, 191, 176, 180, 176, 182, 143, 145,
+	255, 136, 142, 147, 255, 164, 176, 177,
+	178, 157, 158, 188, 189, 128, 173, 176,
+	255, 135, 255, 133, 134, 137, 168, 169,
+	170, 165, 169, 173, 178, 187, 255, 131,
+	132, 140, 169, 174, 255, 130, 132, 128,
+	182, 187, 255, 173, 180, 182, 255, 132,
+	155, 159, 161, 175, 128, 130, 132, 138,
+	139, 147, 163, 165, 128, 134, 136, 152,
+	155, 161, 163, 164, 166, 170, 143, 174,
+	172, 175, 144, 150, 132, 138, 143, 187,
+	191, 160, 128, 129, 132, 135, 133, 134,
+	160, 255, 192, 255, 169, 173, 174, 128,
+	159, 160, 191, 0, 127, 176, 255, 131,
+	137, 191, 145, 189, 135, 129, 130, 132,
+	133, 144, 154, 176, 139, 159, 150, 156,
+	159, 164, 167, 168, 170, 173, 145, 176,
+	255, 139, 255, 166, 176, 189, 171, 179,
+	160, 161, 162, 163, 164, 165, 167, 169,
+	171, 173, 174, 175, 176, 177, 179, 180,
+	181, 182, 183, 184, 185, 186, 187, 188,
+	189, 190, 191, 166, 170, 172, 178, 150,
+	153, 155, 163, 165, 167, 169, 173, 153,
+	155, 152, 159, 138, 161, 163, 255, 189,
+	132, 185, 144, 152, 161, 164, 255, 188,
+	129, 131, 190, 255, 133, 134, 137, 138,
+	142, 150, 152, 161, 164, 189, 191, 255,
+	131, 134, 137, 138, 142, 144, 146, 175,
+	178, 180, 182, 255, 134, 138, 142, 161,
+	164, 185, 192, 255, 188, 129, 131, 190,
+	191, 128, 132, 135, 136, 139, 141, 149,
+	151, 162, 163, 130, 190, 191, 151, 128,
+	130, 134, 136, 138, 141, 188, 128, 132,
+	190, 255, 133, 137, 142, 148, 151, 161,
+	164, 255, 179, 128, 132, 134, 136, 138,
+	141, 149, 150, 162, 163, 128, 131, 187,
+	188, 190, 255, 133, 137, 142, 150, 152,
+	161, 164, 255, 129, 131, 138, 150, 143,
+	148, 152, 159, 178, 179, 177, 179, 186,
+	135, 142, 177, 179, 188, 136, 142, 181,
+	183, 185, 152, 153, 190, 191, 177, 191,
+	128, 132, 134, 135, 141, 151, 153, 188,
+	134, 128, 129, 130, 141, 156, 157, 158,
+	159, 160, 162, 164, 168, 169, 170, 171,
+	172, 173, 174, 175, 176, 179, 183, 173,
+	183, 185, 190, 150, 153, 158, 160, 177,
+	180, 130, 141, 157, 132, 134, 157, 159,
+	146, 149, 178, 180, 146, 147, 178, 179,
+	180, 255, 148, 156, 158, 255, 143, 139,
+	141, 169, 133, 134, 160, 171, 176, 187,
+	151, 155, 160, 162, 191, 149, 158, 165,
+	188, 176, 255, 143, 255, 128, 132, 180,
+	255, 133, 170, 180, 255, 128, 130, 161,
+	173, 166, 179, 164, 183, 173, 180, 144,
+	146, 148, 168, 183, 185, 128, 191, 128,
+	131, 179, 181, 183, 140, 141, 169, 174,
+	128, 129, 131, 132, 134, 140, 142, 143,
+	147, 150, 151, 152, 153, 154, 155, 156,
+	157, 158, 164, 172, 173, 179, 181, 183,
+	140, 141, 188, 137, 144, 176, 162, 185,
+	148, 153, 169, 170, 168, 154, 155, 136,
+	143, 169, 179, 184, 186, 130, 182, 170,
+	171, 128, 187, 190, 128, 133, 135, 146,
+	148, 191, 128, 133, 144, 255, 147, 149,
+	134, 135, 151, 156, 158, 160, 162, 167,
+	169, 178, 181, 255, 132, 135, 140, 142,
+	151, 147, 149, 163, 167, 161, 176, 191,
+	149, 151, 180, 181, 133, 135, 155, 156,
+	144, 149, 175, 177, 191, 160, 191, 128,
+	130, 138, 189, 170, 176, 153, 154, 151,
+	153, 153, 154, 155, 160, 162, 163, 164,
+	165, 166, 167, 168, 169, 170, 171, 175,
+	175, 178, 180, 189, 158, 159, 176, 177,
+	130, 134, 139, 172, 163, 167, 128, 129,
+	180, 255, 134, 159, 178, 190, 192, 255,
+	166, 173, 135, 147, 128, 131, 179, 255,
+	129, 164, 166, 255, 169, 182, 131, 188,
+	140, 141, 176, 178, 180, 183, 184, 190,
+	191, 129, 171, 175, 181, 182, 163, 170,
+	172, 173, 172, 184, 190, 158, 128, 143,
+	160, 175, 144, 145, 147, 150, 155, 156,
+	157, 158, 159, 135, 139, 141, 168, 171,
+	180, 186, 187, 189, 190, 189, 160, 182,
+	186, 191, 129, 131, 133, 134, 140, 143,
+	184, 186, 165, 166, 164, 167, 171, 172,
+	189, 191, 134, 144, 130, 133, 128, 129,
+	130, 131, 132, 133, 134, 135, 136, 137,
+	139, 140, 141, 144, 145, 146, 147, 150,
+	151, 152, 153, 154, 156, 160, 164, 165,
+	167, 168, 169, 170, 176, 178, 180, 181,
+	182, 187, 188, 189, 128, 130, 184, 255,
+	135, 175, 177, 178, 181, 190, 131, 175,
+	187, 255, 128, 130, 167, 180, 179, 133,
+	134, 128, 130, 179, 255, 141, 129, 136,
+	144, 255, 190, 172, 183, 129, 159, 170,
+	128, 131, 187, 188, 190, 191, 151, 128,
+	132, 135, 136, 139, 141, 162, 163, 166,
+	172, 176, 180, 181, 191, 158, 128, 134,
+	132, 255, 175, 181, 184, 255, 129, 155,
+	158, 255, 129, 255, 171, 183, 157, 159,
+	162, 171, 172, 186, 176, 181, 183, 184,
+	187, 190, 128, 130, 131, 164, 145, 151,
+	154, 160, 129, 138, 179, 185, 187, 190,
+	135, 145, 155, 138, 153, 175, 182, 184,
+	191, 146, 167, 169, 182, 186, 177, 182,
+	188, 189, 191, 255, 134, 136, 255, 138,
+	142, 144, 145, 147, 151, 179, 182, 131,
+	128, 129, 180, 186, 190, 191, 128, 130,
+	145, 128, 135, 149, 171, 172, 189, 190,
+	191, 176, 180, 176, 182, 143, 145, 255,
+	136, 142, 147, 255, 164, 176, 177, 178,
+	157, 158, 188, 189, 128, 173, 176, 255,
+	135, 255, 133, 134, 137, 168, 169, 170,
+	165, 169, 173, 178, 187, 255, 131, 132,
+	140, 169, 174, 255, 130, 132, 128, 182,
+	187, 255, 173, 180, 182, 255, 132, 155,
+	159, 161, 175, 128, 130, 132, 138, 139,
+	147, 163, 165, 128, 134, 136, 152, 155,
+	161, 163, 164, 166, 170, 143, 174, 172,
+	175, 144, 150, 132, 138, 128, 131, 132,
+	133, 134, 135, 136, 137, 139, 140, 141,
+	142, 143, 144, 145, 148, 149, 151, 152,
+	153, 157, 159, 160, 161, 162, 163, 164,
+	165, 168, 169, 176, 191, 129, 150, 154,
+	155, 166, 171, 177, 190, 192, 255, 175,
+	141, 143, 172, 177, 190, 191, 142, 145,
+	154, 173, 255, 166, 255, 154, 175, 129,
+	143, 178, 186, 188, 191, 137, 255, 190,
+	255, 134, 255, 144, 255, 180, 191, 149,
+	191, 140, 143, 136, 143, 154, 159, 136,
+	143, 174, 255, 140, 186, 188, 191, 128,
+	133, 135, 191, 160, 128, 129, 132, 135,
+	133, 134, 160, 255, 128, 130, 170, 175,
+	144, 145, 147, 150, 155, 156, 157, 158,
+	159, 143, 187, 191, 156, 128, 133, 134,
+	191, 128, 255, 176, 255, 131, 137, 191,
+	145, 189, 135, 129, 130, 132, 133, 144,
+	154, 176, 139, 159, 150, 156, 159, 164,
+	167, 168, 170, 173, 145, 176, 255, 139,
+	255, 166, 176, 189, 171, 179, 160, 161,
+	162, 163, 164, 165, 167, 169, 171, 173,
+	174, 175, 176, 177, 179, 180, 181, 182,
+	183, 184, 185, 186, 187, 188, 189, 190,
+	191, 166, 170, 172, 178, 150, 153, 155,
+	163, 165, 167, 169, 173, 153, 155, 152,
+	159, 138, 161, 163, 255, 189, 132, 185,
+	144, 152, 161, 164, 255, 188, 129, 131,
+	190, 255, 133, 134, 137, 138, 142, 150,
+	152, 161, 164, 189, 191, 255, 131, 134,
+	137, 138, 142, 144, 146, 175, 178, 180,
+	182, 255, 134, 138, 142, 161, 164, 185,
+	192, 255, 188, 129, 131, 190, 191, 128,
+	132, 135, 136, 139, 141, 149, 151, 162,
+	163, 130, 190, 191, 151, 128, 130, 134,
+	136, 138, 141, 188, 128, 132, 190, 255,
+	133, 137, 142, 148, 151, 161, 164, 255,
+	179, 128, 132, 134, 136, 138, 141, 149,
+	150, 162, 163, 128, 131, 187, 188, 190,
+	255, 133, 137, 142, 150, 152, 161, 164,
+	255, 129, 131, 138, 150, 143, 148, 152,
+	159, 178, 179, 177, 179, 186, 135, 142,
+	177, 179, 188, 136, 142, 181, 183, 185,
+	152, 153, 190, 191, 177, 191, 128, 132,
+	134, 135, 141, 151, 153, 188, 134, 128,
+	129, 130, 141, 156, 157, 158, 159, 160,
+	162, 164, 168, 169, 170, 171, 172, 173,
+	174, 175, 176, 179, 183, 173, 183, 185,
+	190, 150, 153, 158, 160, 177, 180, 130,
+	141, 157, 132, 134, 157, 159, 146, 149,
+	178, 180, 146, 147, 178, 179, 180, 255,
+	148, 156, 158, 255, 143, 139, 141, 169,
+	133, 134, 160, 171, 176, 187, 151, 155,
+	160, 162, 191, 149, 158, 165, 188, 176,
+	255, 143, 255, 128, 132, 180, 255, 133,
+	170, 180, 255, 128, 130, 161, 173, 166,
+	179, 164, 183, 173, 180, 144, 146, 148,
+	168, 183, 185, 128, 191, 128, 131, 179,
+	181, 183, 140, 141, 144, 176, 175, 177,
+	191, 160, 191, 128, 130, 170, 175, 153,
+	154, 153, 154, 155, 160, 162, 163, 164,
+	165, 166, 167, 168, 169, 170, 171, 175,
+	175, 178, 180, 189, 158, 159, 176, 177,
+	130, 134, 139, 172, 163, 167, 128, 129,
+	180, 255, 134, 159, 178, 190, 192, 255,
+	166, 173, 135, 147, 128, 131, 179, 255,
+	129, 164, 166, 255, 169, 182, 131, 188,
+	140, 141, 176, 178, 180, 183, 184, 190,
+	191, 129, 171, 175, 181, 182, 163, 170,
+	172, 173, 172, 184, 190, 158, 128, 143,
+	160, 175, 144, 145, 147, 150, 155, 156,
+	157, 158, 159, 135, 139, 141, 168, 171,
+	180, 186, 187, 189, 190, 189, 160, 182,
+	186, 191, 129, 131, 133, 134, 140, 143,
+	184, 186, 165, 166, 164, 167, 171, 172,
+	189, 191, 134, 144, 130, 133, 128, 129,
+	130, 131, 132, 133, 134, 135, 136, 137,
+	139, 140, 141, 144, 145, 146, 147, 150,
+	151, 152, 153, 154, 156, 160, 164, 165,
+	167, 168, 169, 170, 176, 178, 180, 181,
+	182, 187, 188, 189, 128, 130, 184, 255,
+	135, 175, 177, 178, 181, 190, 131, 175,
+	187, 255, 130, 128, 130, 167, 180, 179,
+	133, 134, 128, 130, 179, 255, 141, 129,
+	136, 144, 255, 190, 172, 183, 129, 159,
+	170, 128, 131, 187, 188, 190, 191, 151,
+	128, 132, 135, 136, 139, 141, 162, 163,
+	166, 172, 176, 180, 181, 191, 158, 128,
+	134, 132, 255, 175, 181, 184, 255, 129,
+	155, 158, 255, 129, 255, 171, 183, 157,
+	159, 162, 171, 172, 186, 176, 181, 183,
+	184, 187, 190, 128, 130, 131, 164, 145,
+	151, 154, 160, 129, 138, 179, 185, 187,
+	190, 135, 145, 155, 138, 153, 175, 182,
+	184, 191, 146, 167, 169, 182, 186, 177,
+	182, 188, 189, 191, 255, 134, 136, 255,
+	138, 142, 144, 145, 147, 151, 179, 182,
+	131, 128, 129, 180, 186, 190, 191, 128,
+	130, 145, 128, 135, 149, 171, 172, 189,
+	190, 191, 176, 180, 176, 182, 143, 145,
+	255, 136, 142, 147, 255, 164, 176, 177,
+	178, 157, 158, 188, 189, 128, 173, 176,
+	255, 135, 255, 133, 134, 137, 168, 169,
+	170, 165, 169, 173, 178, 187, 255, 131,
+	132, 140, 169, 174, 255, 130, 132, 128,
+	182, 187, 255, 173, 180, 182, 255, 132,
+	155, 159, 161, 175, 128, 130, 132, 138,
+	139, 147, 163, 165, 128, 134, 136, 152,
+	155, 161, 163, 164, 166, 170, 143, 174,
+	172, 175, 144, 150, 132, 138, 143, 187,
+	191, 160, 128, 129, 132, 135, 133, 134,
+	160, 255, 192, 255, 169, 174, 160, 172,
+	175, 191, 128, 255, 176, 255, 131, 137,
+	191, 145, 189, 135, 129, 130, 132, 133,
+	144, 154, 176, 139, 159, 150, 156, 159,
+	164, 167, 168, 170, 173, 145, 176, 255,
+	139, 255, 166, 176, 189, 171, 179, 160,
+	161, 162, 163, 164, 165, 167, 169, 171,
+	173, 174, 175, 176, 177, 179, 180, 181,
+	182, 183, 184, 185, 186, 187, 188, 189,
+	190, 191, 166, 170, 172, 178, 150, 153,
+	155, 163, 165, 167, 169, 173, 153, 155,
+	152, 159, 138, 161, 163, 255, 189, 132,
+	185, 144, 152, 161, 164, 255, 188, 129,
+	131, 190, 255, 133, 134, 137, 138, 142,
+	150, 152, 161, 164, 189, 191, 255, 131,
+	134, 137, 138, 142, 144, 146, 175, 178,
+	180, 182, 255, 134, 138, 142, 161, 164,
+	185, 192, 255, 188, 129, 131, 190, 191,
+	128, 132, 135, 136, 139, 141, 149, 151,
+	162, 163, 130, 190, 191, 151, 128, 130,
+	134, 136, 138, 141, 188, 128, 132, 190,
+	255, 133, 137, 142, 148, 151, 161, 164,
+	255, 179, 128, 132, 134, 136, 138, 141,
+	149, 150, 162, 163, 128, 131, 187, 188,
+	190, 255, 133, 137, 142, 150, 152, 161,
+	164, 255, 129, 131, 138, 150, 143, 148,
+	152, 159, 178, 179, 177, 179, 186, 135,
+	142, 177, 179, 188, 136, 142, 181, 183,
+	185, 152, 153, 190, 191, 177, 191, 128,
+	132, 134, 135, 141, 151, 153, 188, 134,
+	128, 129, 130, 141, 156, 157, 158, 159,
+	160, 162, 164, 168, 169, 170, 171, 172,
+	173, 174, 175, 176, 179, 183, 173, 183,
+	185, 190, 150, 153, 158, 160, 177, 180,
+	130, 141, 157, 132, 134, 157, 159, 146,
+	149, 178, 180, 146, 147, 178, 179, 180,
+	255, 148, 156, 158, 255, 143, 139, 141,
+	169, 133, 134, 160, 171, 176, 187, 151,
+	155, 160, 162, 191, 149, 158, 165, 188,
+	176, 255, 143, 255, 128, 132, 180, 255,
+	133, 170, 180, 255, 128, 130, 161, 173,
+	166, 179, 164, 183, 173, 180, 144, 146,
+	148, 168, 183, 185, 128, 191, 128, 131,
+	179, 181, 183, 140, 141, 169, 174, 128,
+	129, 131, 132, 134, 140, 142, 143, 147,
+	150, 151, 152, 153, 154, 155, 156, 157,
+	158, 164, 172, 173, 179, 181, 183, 140,
+	141, 188, 137, 144, 176, 162, 185, 148,
+	153, 169, 170, 168, 154, 155, 136, 143,
+	169, 179, 184, 186, 130, 182, 170, 171,
+	128, 187, 190, 128, 133, 135, 146, 148,
+	191, 128, 133, 144, 255, 147, 149, 134,
+	135, 151, 156, 158, 160, 162, 167, 169,
+	178, 181, 255, 132, 135, 140, 142, 151,
+	147, 149, 163, 167, 161, 176, 191, 149,
+	151, 180, 181, 133, 135, 155, 156, 144,
+	149, 175, 177, 191, 160, 191, 128, 130,
+	138, 189, 170, 176, 153, 154, 151, 153,
+	153, 154, 155, 160, 162, 163, 164, 165,
+	166, 167, 168, 169, 170, 171, 175, 175,
+	178, 180, 189, 158, 159, 176, 177, 130,
+	134, 139, 172, 163, 167, 128, 129, 180,
+	255, 134, 159, 178, 190, 192, 255, 166,
+	173, 135, 147, 128, 131, 179, 255, 129,
+	164, 166, 255, 169, 182, 131, 188, 140,
+	141, 176, 178, 180, 183, 184, 190, 191,
+	129, 171, 175, 181, 182, 163, 170, 172,
+	173, 172, 184, 190, 158, 128, 143, 160,
+	175, 144, 145, 147, 150, 155, 156, 157,
+	158, 159, 135, 139, 141, 168, 171, 180,
+	186, 187, 189, 190, 189, 160, 182, 186,
+	191, 129, 131, 133, 134, 140, 143, 184,
+	186, 165, 166, 164, 167, 171, 172, 189,
+	191, 134, 144, 130, 133, 128, 129, 130,
+	131, 132, 133, 134, 135, 136, 137, 139,
+	140, 141, 144, 145, 146, 147, 150, 151,
+	152, 153, 154, 156, 160, 164, 165, 167,
+	168, 169, 170, 176, 178, 180, 181, 182,
+	187, 188, 189, 128, 130, 184, 255, 135,
+	175, 177, 178, 181, 190, 131, 175, 187,
+	255, 128, 130, 167, 180, 179, 133, 134,
+	128, 130, 179, 255, 141, 129, 136, 144,
+	255, 190, 172, 183, 129, 159, 170, 128,
+	131, 187, 188, 190, 191, 151, 128, 132,
+	135, 136, 139, 141, 162, 163, 166, 172,
+	176, 180, 181, 191, 158, 128, 134, 132,
+	255, 175, 181, 184, 255, 129, 155, 158,
+	255, 129, 255, 171, 183, 157, 159, 162,
+	171, 172, 186, 176, 181, 183, 184, 187,
+	190, 128, 130, 131, 164, 145, 151, 154,
+	160, 129, 138, 179, 185, 187, 190, 135,
+	145, 155, 138, 153, 175, 182, 184, 191,
+	146, 167, 169, 182, 186, 177, 182, 188,
+	189, 191, 255, 134, 136, 255, 138, 142,
+	144, 145, 147, 151, 179, 182, 131, 128,
+	129, 180, 186, 190, 191, 128, 130, 145,
+	128, 135, 149, 171, 172, 189, 190, 191,
+	176, 180, 176, 182, 143, 145, 255, 136,
+	142, 147, 255, 164, 176, 177, 178, 157,
+	158, 188, 189, 128, 173, 176, 255, 135,
+	255, 133, 134, 137, 168, 169, 170, 165,
+	169, 173, 178, 187, 255, 131, 132, 140,
+	169, 174, 255, 130, 132, 128, 182, 187,
+	255, 173, 180, 182, 255, 132, 155, 159,
+	161, 175, 128, 130, 132, 138, 139, 147,
+	163, 165, 128, 134, 136, 152, 155, 161,
+	163, 164, 166, 170, 143, 174, 172, 175,
+	144, 150, 132, 138, 128, 131, 132, 133,
+	134, 135, 136, 137, 139, 140, 141, 142,
+	143, 144, 145, 148, 149, 151, 152, 153,
+	157, 159, 160, 161, 162, 163, 164, 165,
+	168, 169, 176, 191, 129, 150, 154, 155,
+	166, 171, 177, 190, 192, 255, 175, 141,
+	143, 172, 177, 190, 191, 142, 145, 154,
+	173, 255, 166, 255, 154, 175, 129, 143,
+	178, 186, 188, 191, 137, 255, 190, 255,
+	134, 255, 144, 255, 180, 191, 149, 191,
+	140, 143, 136, 143, 154, 159, 136, 143,
+	174, 255, 140, 186, 188, 191, 128, 133,
+	135, 191, 160, 128, 129, 132, 135, 133,
+	134, 160, 255, 128, 130, 170, 175, 144,
+	145, 147, 150, 155, 156, 157, 158, 159,
+	143, 187, 191, 128, 133, 134, 155, 157,
+	191, 157, 128, 191, 143, 128, 191, 162,
+	163, 181, 128, 191, 128, 143, 144, 145,
+	146, 191, 162, 128, 191, 142, 128, 191,
+	132, 133, 134, 135, 160, 128, 191, 128,
+	255, 128, 129, 130, 132, 133, 134, 141,
+	156, 157, 158, 159, 160, 162, 164, 168,
+	169, 170, 171, 172, 173, 174, 175, 176,
+	179, 183, 160, 255, 128, 129, 130, 133,
+	134, 135, 141, 156, 157, 158, 159, 160,
+	162, 164, 168, 169, 170, 171, 172, 173,
+	174, 175, 176, 179, 183, 160, 255, 168,
+	255, 128, 129, 130, 134, 135, 141, 156,
+	157, 158, 159, 160, 162, 164, 168, 169,
+	170, 171, 172, 173, 174, 175, 176, 179,
+	183, 168, 255, 192, 255, 159, 139, 187,
+	158, 159, 176, 255, 135, 138, 139, 187,
+	188, 255, 168, 255, 153, 154, 155, 160,
+	162, 163, 164, 165, 166, 167, 168, 169,
+	170, 171, 175, 177, 178, 179, 180, 181,
+	182, 184, 185, 186, 187, 188, 189, 191,
+	176, 190, 192, 255, 135, 147, 160, 188,
+	128, 156, 184, 129, 255, 128, 129, 130,
+	133, 134, 141, 156, 157, 158, 159, 160,
+	162, 164, 168, 169, 170, 171, 172, 173,
+	174, 175, 176, 179, 183, 158, 159, 135,
+	255, 148, 176, 140, 168, 132, 160, 188,
+	152, 180, 144, 172, 136, 164, 192, 255,
+	129, 130, 131, 132, 133, 134, 136, 137,
+	138, 139, 140, 141, 143, 144, 145, 146,
+	147, 148, 150, 151, 152, 153, 154, 155,
+	157, 158, 159, 160, 161, 162, 164, 165,
+	166, 167, 168, 169, 171, 172, 173, 174,
+	175, 176, 178, 179, 180, 181, 182, 183,
+	185, 186, 187, 188, 189, 190, 128, 191,
+	129, 130, 131, 132, 133, 134, 136, 137,
+	138, 139, 140, 141, 143, 144, 145, 146,
+	147, 148, 150, 151, 152, 153, 154, 155,
+	157, 158, 159, 160, 161, 162, 164, 165,
+	166, 167, 168, 169, 171, 172, 173, 174,
+	175, 176, 178, 179, 180, 181, 182, 183,
+	185, 186, 187, 188, 189, 190, 128, 191,
+	129, 130, 131, 132, 133, 134, 136, 137,
+	138, 139, 140, 141, 143, 144, 145, 146,
+	147, 148, 150, 151, 152, 153, 154, 155,
+	157, 158, 159, 128, 156, 160, 255, 136,
+	164, 175, 176, 255, 128, 141, 143, 191,
+	128, 129, 132, 134, 140, 142, 143, 147,
+	150, 151, 152, 153, 154, 155, 156, 157,
+	158, 164, 172, 173, 130, 191, 188, 128,
+	138, 140, 141, 144, 167, 175, 191, 137,
+	128, 159, 176, 191, 162, 185, 128, 191,
+	128, 147, 148, 153, 154, 168, 169, 170,
+	171, 191, 168, 128, 153, 154, 155, 156,
+	191, 136, 128, 191, 143, 128, 168, 169,
+	179, 180, 183, 184, 186, 187, 191, 130,
+	128, 191, 182, 128, 169, 170, 171, 172,
+	191, 128, 191, 129, 186, 187, 190, 134,
+	147, 128, 191, 128, 133, 134, 143, 144,
+	255, 147, 149, 134, 135, 151, 156, 158,
+	160, 162, 167, 169, 178, 181, 191, 192,
+	255, 132, 135, 140, 142, 150, 128, 146,
+	147, 151, 152, 162, 163, 167, 168, 191,
+	161, 176, 191, 128, 148, 149, 151, 152,
+	190, 128, 179, 180, 181, 182, 191, 128,
+	132, 133, 135, 136, 154, 155, 156, 157,
+	191, 144, 149, 128, 191, 128, 138, 129,
+	191, 176, 189, 128, 191, 151, 153, 128,
+	191, 128, 191, 165, 177, 178, 179, 180,
+	181, 182, 184, 185, 186, 187, 188, 189,
+	191, 128, 175, 176, 190, 192, 255, 128,
+	159, 160, 188, 189, 191, 128, 156, 184,
+	129, 255, 148, 176, 140, 168, 132, 160,
+	188, 152, 180, 144, 172, 136, 164, 192,
+	255, 129, 130, 131, 132, 133, 134, 136,
+	137, 138, 139, 140, 141, 143, 144, 145,
+	146, 147, 148, 150, 151, 152, 153, 154,
+	155, 157, 158, 159, 160, 161, 162, 164,
+	165, 166, 167, 168, 169, 171, 172, 173,
+	174, 175, 176, 178, 179, 180, 181, 182,
+	183, 185, 186, 187, 188, 189, 190, 128,
+	191, 129, 130, 131, 132, 133, 134, 136,
+	137, 138, 139, 140, 141, 143, 144, 145,
+	146, 147, 148, 150, 151, 152, 153, 154,
+	155, 157, 158, 159, 160, 161, 162, 164,
+	165, 166, 167, 168, 169, 171, 172, 173,
+	174, 175, 176, 178, 179, 180, 181, 182,
+	183, 185, 186, 187, 188, 189, 190, 128,
+	191, 129, 130, 131, 132, 133, 134, 136,
+	137, 138, 139, 140, 141, 143, 144, 145,
+	146, 147, 148, 150, 151, 152, 153, 154,
+	155, 157, 158, 159, 128, 156, 160, 191,
+	192, 255, 136, 164, 175, 176, 255, 135,
+	138, 139, 187, 188, 191, 192, 255, 187,
+	191, 128, 190, 128, 190, 188, 128, 175,
+	190, 191, 145, 147, 155, 157, 159, 128,
+	191, 130, 131, 135, 164, 165, 168, 170,
+	181, 188, 128, 191, 189, 128, 191, 141,
+	128, 191, 128, 129, 130, 131, 132, 191,
+	191, 128, 190, 129, 128, 191, 186, 128,
+	191, 128, 131, 132, 137, 138, 191, 134,
+	128, 191, 130, 128, 191, 144, 128, 191,
+	128, 175, 178, 128, 191, 128, 159, 164,
+	191, 133, 128, 191, 128, 178, 187, 191,
+	128, 131, 132, 133, 134, 135, 136, 137,
+	139, 140, 141, 142, 143, 144, 145, 148,
+	149, 151, 152, 153, 156, 157, 158, 159,
+	160, 161, 162, 163, 164, 165, 168, 169,
+	176, 191, 129, 150, 154, 171, 172, 175,
+	177, 190, 175, 128, 140, 141, 143, 144,
+	191, 128, 171, 172, 177, 178, 189, 190,
+	191, 142, 128, 144, 145, 154, 155, 172,
+	173, 255, 166, 191, 192, 255, 144, 145,
+	147, 150, 155, 156, 157, 158, 159, 135,
+	143, 166, 191, 128, 154, 175, 187, 129,
+	143, 144, 177, 178, 191, 128, 136, 137,
+	255, 187, 191, 192, 255, 190, 191, 192,
+	255, 128, 133, 134, 255, 144, 191, 192,
+	255, 128, 179, 180, 191, 128, 148, 149,
+	191, 128, 139, 140, 143, 144, 191, 128,
+	135, 136, 143, 144, 153, 154, 159, 160,
+	191, 128, 135, 136, 143, 144, 173, 174,
+	255, 187, 128, 139, 140, 191, 134, 128,
+	191, 128, 191, 160, 128, 191, 128, 129,
+	135, 132, 134, 157, 128, 191, 143, 128,
+	191, 162, 163, 181, 128, 191, 128, 143,
+	144, 145, 146, 191, 162, 128, 191, 142,
+	128, 191, 132, 133, 134, 135, 160, 128,
+	191, 0, 127, 128, 255, 176, 255, 131,
+	137, 191, 145, 189, 135, 129, 130, 132,
+	133, 144, 154, 176, 139, 159, 150, 156,
+	159, 164, 167, 168, 170, 173, 145, 176,
+	255, 139, 255, 166, 176, 189, 171, 179,
+	160, 161, 162, 163, 164, 165, 167, 169,
+	171, 173, 174, 175, 176, 177, 179, 180,
+	181, 182, 183, 184, 185, 186, 187, 188,
+	189, 190, 191, 166, 170, 172, 178, 150,
+	153, 155, 163, 165, 167, 169, 173, 153,
+	155, 152, 159, 138, 161, 163, 255, 189,
+	132, 185, 144, 152, 161, 164, 255, 188,
+	129, 131, 190, 255, 133, 134, 137, 138,
+	142, 150, 152, 161, 164, 189, 191, 255,
+	131, 134, 137, 138, 142, 144, 146, 175,
+	178, 180, 182, 255, 134, 138, 142, 161,
+	164, 185, 192, 255, 188, 129, 131, 190,
+	191, 128, 132, 135, 136, 139, 141, 149,
+	151, 162, 163, 130, 190, 191, 151, 128,
+	130, 134, 136, 138, 141, 188, 128, 132,
+	190, 255, 133, 137, 142, 148, 151, 161,
+	164, 255, 179, 128, 132, 134, 136, 138,
+	141, 149, 150, 162, 163, 128, 131, 187,
+	188, 190, 255, 133, 137, 142, 150, 152,
+	161, 164, 255, 129, 131, 138, 150, 143,
+	148, 152, 159, 178, 179, 177, 179, 186,
+	135, 142, 177, 179, 188, 136, 142, 181,
+	183, 185, 152, 153, 190, 191, 177, 191,
+	128, 132, 134, 135, 141, 151, 153, 188,
+	134, 128, 129, 130, 141, 156, 157, 158,
+	159, 160, 162, 164, 168, 169, 170, 171,
+	172, 173, 174, 175, 176, 179, 183, 173,
+	183, 185, 190, 150, 153, 158, 160, 177,
+	180, 130, 141, 157, 132, 134, 157, 159,
+	146, 149, 178, 180, 146, 147, 178, 179,
+	180, 255, 148, 156, 158, 255, 143, 139,
+	141, 169, 133, 134, 160, 171, 176, 187,
+	151, 155, 160, 162, 191, 149, 158, 165,
+	188, 176, 255, 143, 255, 128, 132, 180,
+	255, 133, 170, 180, 255, 128, 130, 161,
+	173, 166, 179, 164, 183, 173, 180, 144,
+	146, 148, 168, 183, 185, 128, 191, 128,
+	131, 179, 181, 183, 140, 141, 169, 174,
+	128, 129, 131, 132, 134, 140, 142, 143,
+	147, 150, 151, 152, 153, 154, 155, 156,
+	157, 158, 164, 172, 173, 179, 181, 183,
+	140, 141, 188, 137, 144, 176, 162, 185,
+	148, 153, 169, 170, 168, 154, 155, 136,
+	143, 169, 179, 184, 186, 130, 182, 170,
+	171, 128, 187, 190, 128, 133, 135, 146,
+	148, 191, 128, 133, 144, 255, 147, 149,
+	134, 135, 151, 156, 158, 160, 162, 167,
+	169, 178, 181, 255, 132, 135, 140, 142,
+	151, 147, 149, 163, 167, 161, 176, 191,
+	149, 151, 180, 181, 133, 135, 155, 156,
+	144, 149, 175, 177, 191, 160, 191, 128,
+	130, 138, 189, 170, 176, 153, 154, 151,
+	153, 153, 154, 155, 160, 162, 163, 164,
+	165, 166, 167, 168, 169, 170, 171, 175,
+	175, 178, 180, 189, 158, 159, 176, 177,
+	130, 134, 139, 172, 163, 167, 128, 129,
+	180, 255, 134, 159, 178, 190, 192, 255,
+	166, 173, 135, 147, 128, 131, 179, 255,
+	129, 164, 166, 255, 169, 182, 131, 188,
+	140, 141, 176, 178, 180, 183, 184, 190,
+	191, 129, 171, 175, 181, 182, 163, 170,
+	172, 173, 172, 184, 190, 158, 128, 143,
+	160, 175, 144, 145, 147, 150, 155, 156,
+	157, 158, 159, 135, 139, 141, 168, 171,
+	180, 186, 187, 189, 190, 189, 160, 182,
+	186, 191, 129, 131, 133, 134, 140, 143,
+	184, 186, 165, 166, 164, 167, 171, 172,
+	189, 191, 134, 144, 130, 133, 128, 129,
+	130, 131, 132, 133, 134, 135, 136, 137,
+	139, 140, 141, 144, 145, 146, 147, 150,
+	151, 152, 153, 154, 156, 160, 164, 165,
+	167, 168, 169, 170, 176, 178, 180, 181,
+	182, 187, 188, 189, 128, 130, 184, 255,
+	135, 175, 177, 178, 181, 190, 131, 175,
+	187, 255, 128, 130, 167, 180, 179, 133,
+	134, 128, 130, 179, 255, 141, 129, 136,
+	144, 255, 190, 172, 183, 129, 159, 170,
+	128, 131, 187, 188, 190, 191, 151, 128,
+	132, 135, 136, 139, 141, 162, 163, 166,
+	172, 176, 180, 181, 191, 158, 128, 134,
+	132, 255, 175, 181, 184, 255, 129, 155,
+	158, 255, 129, 255, 171, 183, 157, 159,
+	162, 171, 172, 186, 176, 181, 183, 184,
+	187, 190, 128, 130, 131, 164, 145, 151,
+	154, 160, 129, 138, 179, 185, 187, 190,
+	135, 145, 155, 138, 153, 175, 182, 184,
+	191, 146, 167, 169, 182, 186, 177, 182,
+	188, 189, 191, 255, 134, 136, 255, 138,
+	142, 144, 145, 147, 151, 179, 182, 131,
+	128, 129, 180, 186, 190, 191, 128, 130,
+	145, 128, 135, 149, 171, 172, 189, 190,
+	191, 176, 180, 176, 182, 143, 145, 255,
+	136, 142, 147, 255, 164, 176, 177, 178,
+	157, 158, 188, 189, 128, 173, 176, 255,
+	135, 255, 133, 134, 137, 168, 169, 170,
+	165, 169, 173, 178, 187, 255, 131, 132,
+	140, 169, 174, 255, 130, 132, 128, 182,
+	187, 255, 173, 180, 182, 255, 132, 155,
+	159, 161, 175, 128, 130, 132, 138, 139,
+	147, 163, 165, 128, 134, 136, 152, 155,
+	161, 163, 164, 166, 170, 143, 174, 172,
+	175, 144, 150, 132, 138, 128, 131, 132,
+	133, 134, 135, 136, 137, 139, 140, 141,
+	142, 143, 144, 145, 148, 149, 151, 152,
+	153, 157, 159, 160, 161, 162, 163, 164,
+	165, 168, 169, 176, 191, 129, 150, 154,
+	155, 166, 171, 177, 190, 192, 255, 175,
+	141, 143, 172, 177, 190, 191, 142, 145,
+	154, 173, 255, 166, 255, 154, 175, 129,
+	143, 178, 186, 188, 191, 137, 255, 190,
+	255, 134, 255, 144, 255, 180, 191, 149,
+	191, 140, 143, 136, 143, 154, 159, 136,
+	143, 174, 255, 140, 186, 188, 191, 128,
+	133, 135, 191, 160, 128, 129, 132, 135,
+	133, 134, 160, 255, 128, 130, 170, 175,
+	144, 145, 147, 150, 155, 156, 157, 158,
+	159, 143, 187, 191, 128, 129, 130, 132,
+	133, 134, 141, 156, 157, 158, 159, 160,
+	162, 164, 168, 169, 170, 171, 172, 173,
+	174, 175, 176, 179, 183, 160, 255, 128,
+	129, 130, 133, 134, 135, 141, 156, 157,
+	158, 159, 160, 162, 164, 168, 169, 170,
+	171, 172, 173, 174, 175, 176, 179, 183,
+	160, 255, 168, 255, 128, 129, 130, 134,
+	135, 141, 156, 157, 158, 159, 160, 162,
+	164, 168, 169, 170, 171, 172, 173, 174,
+	175, 176, 179, 183, 168, 255, 192, 255,
+	159, 139, 187, 158, 159, 176, 255, 135,
+	138, 139, 187, 188, 255, 168, 255, 153,
+	154, 155, 160, 162, 163, 164, 165, 166,
+	167, 168, 169, 170, 171, 175, 177, 178,
+	179, 180, 181, 182, 184, 185, 186, 187,
+	188, 189, 191, 176, 190, 192, 255, 135,
+	147, 160, 188, 128, 156, 184, 129, 255,
+	128, 129, 130, 133, 134, 141, 156, 157,
+	158, 159, 160, 162, 164, 168, 169, 170,
+	171, 172, 173, 174, 175, 176, 179, 183,
+	158, 159, 135, 255, 148, 176, 140, 168,
+	132, 160, 188, 152, 180, 144, 172, 136,
+	164, 192, 255, 129, 130, 131, 132, 133,
+	134, 136, 137, 138, 139, 140, 141, 143,
+	144, 145, 146, 147, 148, 150, 151, 152,
+	153, 154, 155, 157, 158, 159, 160, 161,
+	162, 164, 165, 166, 167, 168, 169, 171,
+	172, 173, 174, 175, 176, 178, 179, 180,
+	181, 182, 183, 185, 186, 187, 188, 189,
+	190, 128, 191, 129, 130, 131, 132, 133,
+	134, 136, 137, 138, 139, 140, 141, 143,
+	144, 145, 146, 147, 148, 150, 151, 152,
+	153, 154, 155, 157, 158, 159, 160, 161,
+	162, 164, 165, 166, 167, 168, 169, 171,
+	172, 173, 174, 175, 176, 178, 179, 180,
+	181, 182, 183, 185, 186, 187, 188, 189,
+	190, 128, 191, 129, 130, 131, 132, 133,
+	134, 136, 137, 138, 139, 140, 141, 143,
+	144, 145, 146, 147, 148, 150, 151, 152,
+	153, 154, 155, 157, 158, 159, 128, 156,
+	160, 255, 136, 164, 175, 176, 255, 142,
+	128, 191, 128, 129, 132, 134, 140, 142,
+	143, 147, 150, 151, 152, 153, 154, 155,
+	156, 157, 158, 164, 172, 173, 130, 191,
+	139, 141, 188, 128, 140, 142, 143, 144,
+	167, 168, 174, 175, 191, 128, 255, 176,
+	255, 131, 137, 191, 145, 189, 135, 129,
+	130, 132, 133, 144, 154, 176, 139, 159,
+	150, 156, 159, 164, 167, 168, 170, 173,
+	145, 176, 255, 139, 255, 166, 176, 189,
+	171, 179, 160, 161, 162, 163, 164, 165,
+	167, 169, 171, 173, 174, 175, 176, 177,
+	179, 180, 181, 182, 183, 184, 185, 186,
+	187, 188, 189, 190, 191, 166, 170, 172,
+	178, 150, 153, 155, 163, 165, 167, 169,
+	173, 153, 155, 152, 159, 138, 161, 163,
+	255, 189, 132, 185, 144, 152, 161, 164,
+	255, 188, 129, 131, 190, 255, 133, 134,
+	137, 138, 142, 150, 152, 161, 164, 189,
+	191, 255, 131, 134, 137, 138, 142, 144,
+	146, 175, 178, 180, 182, 255, 134, 138,
+	142, 161, 164, 185, 192, 255, 188, 129,
+	131, 190, 191, 128, 132, 135, 136, 139,
+	141, 149, 151, 162, 163, 130, 190, 191,
+	151, 128, 130, 134, 136, 138, 141, 188,
+	128, 132, 190, 255, 133, 137, 142, 148,
+	151, 161, 164, 255, 179, 128, 132, 134,
+	136, 138, 141, 149, 150, 162, 163, 128,
+	131, 187, 188, 190, 255, 133, 137, 142,
+	150, 152, 161, 164, 255, 129, 131, 138,
+	150, 143, 148, 152, 159, 178, 179, 177,
+	179, 186, 135, 142, 177, 179, 188, 136,
+	142, 181, 183, 185, 152, 153, 190, 191,
+	177, 191, 128, 132, 134, 135, 141, 151,
+	153, 188, 134, 128, 129, 130, 141, 156,
+	157, 158, 159, 160, 162, 164, 168, 169,
+	170, 171, 172, 173, 174, 175, 176, 179,
+	183, 173, 183, 185, 190, 150, 153, 158,
+	160, 177, 180, 130, 141, 157, 132, 134,
+	157, 159, 146, 149, 178, 180, 146, 147,
+	178, 179, 180, 255, 148, 156, 158, 255,
+	143, 139, 141, 169, 133, 134, 160, 171,
+	176, 187, 151, 155, 160, 162, 191, 149,
+	158, 165, 188, 176, 255, 143, 255, 128,
+	132, 180, 255, 133, 170, 180, 255, 128,
+	130, 161, 173, 166, 179, 164, 183, 173,
+	180, 144, 146, 148, 168, 183, 185, 128,
+	191, 128, 131, 179, 181, 183, 140, 141,
+	144, 176, 175, 177, 191, 160, 191, 128,
+	130, 170, 175, 153, 154, 153, 154, 155,
+	160, 162, 163, 164, 165, 166, 167, 168,
+	169, 170, 171, 175, 175, 178, 180, 189,
+	158, 159, 176, 177, 130, 134, 139, 172,
+	163, 167, 128, 129, 180, 255, 134, 159,
+	178, 190, 192, 255, 166, 173, 135, 147,
+	128, 131, 179, 255, 129, 164, 166, 255,
+	169, 182, 131, 188, 140, 141, 176, 178,
+	180, 183, 184, 190, 191, 129, 171, 175,
+	181, 182, 163, 170, 172, 173, 172, 184,
+	190, 158, 128, 143, 160, 175, 144, 145,
+	147, 150, 155, 156, 157, 158, 159, 135,
+	139, 141, 168, 171, 180, 186, 187, 189,
+	190, 189, 160, 182, 186, 191, 129, 131,
+	133, 134, 140, 143, 184, 186, 165, 166,
+	164, 167, 171, 172, 189, 191, 134, 144,
+	130, 133, 128, 129, 130, 131, 132, 133,
+	134, 135, 136, 137, 139, 140, 141, 144,
+	145, 146, 147, 150, 151, 152, 153, 154,
+	156, 160, 164, 165, 167, 168, 169, 170,
+	176, 178, 180, 181, 182, 187, 188, 189,
+	128, 130, 184, 255, 135, 175, 177, 178,
+	181, 190, 131, 175, 187, 255, 130, 128,
+	130, 167, 180, 179, 133, 134, 128, 130,
+	179, 255, 141, 129, 136, 144, 255, 190,
+	172, 183, 129, 159, 170, 128, 131, 187,
+	188, 190, 191, 151, 128, 132, 135, 136,
+	139, 141, 162, 163, 166, 172, 176, 180,
+	181, 191, 158, 128, 134, 132, 255, 175,
+	181, 184, 255, 129, 155, 158, 255, 129,
+	255, 171, 183, 157, 159, 162, 171, 172,
+	186, 176, 181, 183, 184, 187, 190, 128,
+	130, 131, 164, 145, 151, 154, 160, 129,
+	138, 179, 185, 187, 190, 135, 145, 155,
+	138, 153, 175, 182, 184, 191, 146, 167,
+	169, 182, 186, 177, 182, 188, 189, 191,
+	255, 134, 136, 255, 138, 142, 144, 145,
+	147, 151, 179, 182, 131, 128, 129, 180,
+	186, 190, 191, 128, 130, 145, 128, 135,
+	149, 171, 172, 189, 190, 191, 176, 180,
+	176, 182, 143, 145, 255, 136, 142, 147,
+	255, 164, 176, 177, 178, 157, 158, 188,
+	189, 128, 173, 176, 255, 135, 255, 133,
+	134, 137, 168, 169, 170, 165, 169, 173,
+	178, 187, 255, 131, 132, 140, 169, 174,
+	255, 130, 132, 128, 182, 187, 255, 173,
+	180, 182, 255, 132, 155, 159, 161, 175,
+	128, 130, 132, 138, 139, 147, 163, 165,
+	128, 134, 136, 152, 155, 161, 163, 164,
+	166, 170, 143, 174, 172, 175, 144, 150,
+	132, 138, 143, 187, 191, 160, 128, 129,
+	132, 135, 133, 134, 160, 255, 192, 255,
+	137, 128, 159, 160, 175, 176, 191, 162,
+	185, 128, 191, 128, 147, 148, 153, 154,
+	168, 169, 170, 171, 191, 168, 128, 153,
+	154, 155, 156, 191, 136, 128, 191, 143,
+	128, 168, 169, 179, 180, 183, 184, 186,
+	187, 191, 130, 128, 191, 182, 128, 169,
+	170, 171, 172, 191, 128, 191, 129, 186,
+	187, 190, 134, 147, 128, 191, 128, 133,
+	134, 143, 144, 255, 147, 149, 134, 135,
+	151, 156, 158, 160, 162, 167, 169, 178,
+	181, 191, 192, 255, 132, 135, 140, 142,
+	150, 128, 146, 147, 151, 152, 162, 163,
+	167, 168, 191, 161, 176, 191, 128, 148,
+	149, 151, 152, 190, 128, 179, 180, 181,
+	182, 191, 128, 132, 133, 135, 136, 154,
+	155, 156, 157, 191, 144, 149, 128, 191,
+	128, 138, 129, 191, 176, 189, 128, 191,
+	151, 153, 128, 191, 128, 191, 165, 177,
+	178, 179, 180, 181, 182, 184, 185, 186,
+	187, 188, 189, 191, 128, 175, 176, 190,
+	192, 255, 128, 159, 160, 188, 189, 191,
+	128, 156, 184, 129, 255, 148, 176, 140,
+	168, 132, 160, 188, 152, 180, 144, 172,
+	136, 164, 192, 255, 129, 130, 131, 132,
+	133, 134, 136, 137, 138, 139, 140, 141,
+	143, 144, 145, 146, 147, 148, 150, 151,
+	152, 153, 154, 155, 157, 158, 159, 160,
+	161, 162, 164, 165, 166, 167, 168, 169,
+	171, 172, 173, 174, 175, 176, 178, 179,
+	180, 181, 182, 183, 185, 186, 187, 188,
+	189, 190, 128, 191, 129, 130, 131, 132,
+	133, 134, 136, 137, 138, 139, 140, 141,
+	143, 144, 145, 146, 147, 148, 150, 151,
+	152, 153, 154, 155, 157, 158, 159, 160,
+	161, 162, 164, 165, 166, 167, 168, 169,
+	171, 172, 173, 174, 175, 176, 178, 179,
+	180, 181, 182, 183, 185, 186, 187, 188,
+	189, 190, 128, 191, 129, 130, 131, 132,
+	133, 134, 136, 137, 138, 139, 140, 141,
+	143, 144, 145, 146, 147, 148, 150, 151,
+	152, 153, 154, 155, 157, 158, 159, 128,
+	156, 160, 191, 192, 255, 136, 164, 175,
+	176, 255, 135, 138, 139, 187, 188, 191,
+	192, 255, 187, 191, 128, 190, 191, 128,
+	190, 188, 128, 175, 176, 189, 190, 191,
+	145, 147, 155, 157, 159, 128, 191, 130,
+	131, 135, 164, 165, 168, 170, 181, 188,
+	128, 191, 189, 128, 191, 141, 128, 191,
+	128, 129, 130, 131, 132, 191, 191, 128,
+	190, 129, 128, 191, 186, 128, 191, 128,
+	131, 132, 137, 138, 191, 134, 128, 191,
+	130, 128, 191, 144, 128, 191, 128, 175,
+	176, 191, 178, 128, 191, 128, 159, 160,
+	163, 164, 191, 133, 128, 191, 128, 178,
+	179, 186, 187, 191, 128, 131, 132, 133,
+	134, 135, 136, 137, 139, 140, 141, 142,
+	143, 144, 145, 148, 149, 151, 152, 153,
+	156, 157, 158, 159, 160, 161, 162, 163,
+	164, 165, 168, 169, 176, 191, 129, 150,
+	154, 171, 172, 175, 177, 190, 175, 128,
+	140, 141, 143, 144, 191, 128, 171, 172,
+	177, 178, 189, 190, 191, 142, 128, 144,
+	145, 154, 155, 172, 173, 255, 166, 191,
+	192, 255, 128, 255, 176, 255, 131, 137,
+	191, 145, 189, 135, 129, 130, 132, 133,
+	144, 154, 176, 139, 159, 150, 156, 159,
+	164, 167, 168, 170, 173, 145, 176, 255,
+	139, 255, 166, 176, 189, 171, 179, 160,
+	161, 162, 163, 164, 165, 167, 169, 171,
+	173, 174, 175, 176, 177, 179, 180, 181,
+	182, 183, 184, 185, 186, 187, 188, 189,
+	190, 191, 166, 170, 172, 178, 150, 153,
+	155, 163, 165, 167, 169, 173, 153, 155,
+	152, 159, 138, 161, 163, 255, 189, 132,
+	185, 144, 152, 161, 164, 255, 188, 129,
+	131, 190, 255, 133, 134, 137, 138, 142,
+	150, 152, 161, 164, 189, 191, 255, 131,
+	134, 137, 138, 142, 144, 146, 175, 178,
+	180, 182, 255, 134, 138, 142, 161, 164,
+	185, 192, 255, 188, 129, 131, 190, 191,
+	128, 132, 135, 136, 139, 141, 149, 151,
+	162, 163, 130, 190, 191, 151, 128, 130,
+	134, 136, 138, 141, 188, 128, 132, 190,
+	255, 133, 137, 142, 148, 151, 161, 164,
+	255, 179, 128, 132, 134, 136, 138, 141,
+	149, 150, 162, 163, 128, 131, 187, 188,
+	190, 255, 133, 137, 142, 150, 152, 161,
+	164, 255, 129, 131, 138, 150, 143, 148,
+	152, 159, 178, 179, 177, 179, 186, 135,
+	142, 177, 179, 188, 136, 142, 181, 183,
+	185, 152, 153, 190, 191, 177, 191, 128,
+	132, 134, 135, 141, 151, 153, 188, 134,
+	128, 129, 130, 141, 156, 157, 158, 159,
+	160, 162, 164, 168, 169, 170, 171, 172,
+	173, 174, 175, 176, 179, 183, 173, 183,
+	185, 190, 150, 153, 158, 160, 177, 180,
+	130, 141, 157, 132, 134, 157, 159, 146,
+	149, 178, 180, 146, 147, 178, 179, 180,
+	255, 148, 156, 158, 255, 143, 139, 141,
+	169, 133, 134, 160, 171, 176, 187, 151,
+	155, 160, 162, 191, 149, 158, 165, 188,
+	176, 255, 143, 255, 128, 132, 180, 255,
+	133, 170, 180, 255, 128, 130, 161, 173,
+	166, 179, 164, 183, 173, 180, 144, 146,
+	148, 168, 183, 185, 128, 191, 128, 131,
+	179, 181, 183, 140, 141, 169, 174, 128,
+	129, 131, 132, 134, 140, 142, 143, 147,
+	150, 151, 152, 153, 154, 155, 156, 157,
+	158, 164, 172, 173, 179, 181, 183, 140,
+	141, 188, 137, 144, 176, 162, 185, 148,
+	153, 169, 170, 168, 154, 155, 136, 143,
+	169, 179, 184, 186, 130, 182, 170, 171,
+	128, 187, 190, 128, 133, 135, 146, 148,
+	191, 128, 133, 144, 255, 147, 149, 134,
+	135, 151, 156, 158, 160, 162, 167, 169,
+	178, 181, 255, 132, 135, 140, 142, 151,
+	147, 149, 163, 167, 161, 176, 191, 149,
+	151, 180, 181, 133, 135, 155, 156, 144,
+	149, 175, 177, 191, 160, 191, 128, 130,
+	138, 189, 170, 176, 153, 154, 151, 153,
+	153, 154, 155, 160, 162, 163, 164, 165,
+	166, 167, 168, 169, 170, 171, 175, 175,
+	178, 180, 189, 158, 159, 176, 177, 130,
+	134, 139, 172, 163, 167, 128, 129, 180,
+	255, 134, 159, 178, 190, 192, 255, 166,
+	173, 135, 147, 128, 131, 179, 255, 129,
+	164, 166, 255, 169, 182, 131, 188, 140,
+	141, 176, 178, 180, 183, 184, 190, 191,
+	129, 171, 175, 181, 182, 163, 170, 172,
+	173, 172, 184, 190, 158, 128, 143, 160,
+	175, 144, 145, 147, 150, 155, 156, 157,
+	158, 159, 135, 139, 141, 168, 171, 180,
+	186, 187, 189, 190, 189, 160, 182, 186,
+	191, 129, 131, 133, 134, 140, 143, 184,
+	186, 165, 166, 164, 167, 171, 172, 189,
+	191, 134, 144, 130, 133, 128, 129, 130,
+	131, 132, 133, 134, 135, 136, 137, 139,
+	140, 141, 144, 145, 146, 147, 150, 151,
+	152, 153, 154, 156, 160, 164, 165, 167,
+	168, 169, 170, 176, 178, 180, 181, 182,
+	187, 188, 189, 128, 130, 184, 255, 135,
+	175, 177, 178, 181, 190, 131, 175, 187,
+	255, 128, 130, 167, 180, 179, 133, 134,
+	128, 130, 179, 255, 141, 129, 136, 144,
+	255, 190, 172, 183, 129, 159, 170, 128,
+	131, 187, 188, 190, 191, 151, 128, 132,
+	135, 136, 139, 141, 162, 163, 166, 172,
+	176, 180, 181, 191, 158, 128, 134, 132,
+	255, 175, 181, 184, 255, 129, 155, 158,
+	255, 129, 255, 171, 183, 157, 159, 162,
+	171, 172, 186, 176, 181, 183, 184, 187,
+	190, 128, 130, 131, 164, 145, 151, 154,
+	160, 129, 138, 179, 185, 187, 190, 135,
+	145, 155, 138, 153, 175, 182, 184, 191,
+	146, 167, 169, 182, 186, 177, 182, 188,
+	189, 191, 255, 134, 136, 255, 138, 142,
+	144, 145, 147, 151, 179, 182, 131, 128,
+	129, 180, 186, 190, 191, 128, 130, 145,
+	128, 135, 149, 171, 172, 189, 190, 191,
+	176, 180, 176, 182, 143, 145, 255, 136,
+	142, 147, 255, 164, 176, 177, 178, 157,
+	158, 188, 189, 128, 173, 176, 255, 135,
+	255, 133, 134, 137, 168, 169, 170, 165,
+	169, 173, 178, 187, 255, 131, 132, 140,
+	169, 174, 255, 130, 132, 128, 182, 187,
+	255, 173, 180, 182, 255, 132, 155, 159,
+	161, 175, 128, 130, 132, 138, 139, 147,
+	163, 165, 128, 134, 136, 152, 155, 161,
+	163, 164, 166, 170, 143, 174, 172, 175,
+	144, 150, 132, 138, 128, 131, 132, 133,
+	134, 135, 136, 137, 139, 140, 141, 142,
+	143, 144, 145, 148, 149, 151, 152, 153,
+	157, 159, 160, 161, 162, 163, 164, 165,
+	168, 169, 176, 191, 129, 150, 154, 155,
+	166, 171, 177, 190, 192, 255, 175, 141,
+	143, 172, 177, 190, 191, 142, 145, 154,
+	173, 255, 166, 255, 154, 175, 129, 143,
+	178, 186, 188, 191, 137, 255, 190, 255,
+	134, 255, 144, 255, 180, 191, 149, 191,
+	140, 143, 136, 143, 154, 159, 136, 143,
+	174, 255, 140, 186, 188, 191, 128, 133,
+	135, 191, 160, 128, 129, 132, 135, 133,
+	134, 160, 255, 128, 130, 170, 175, 144,
+	145, 147, 150, 155, 156, 157, 158, 159,
+	143, 187, 191, 144, 145, 147, 150, 155,
+	156, 157, 158, 159, 135, 143, 166, 191,
+	128, 154, 175, 187, 129, 143, 144, 177,
+	178, 191, 128, 136, 137, 255, 187, 191,
+	192, 255, 190, 191, 192, 255, 128, 133,
+	134, 255, 144, 191, 192, 255, 128, 179,
+	180, 191, 128, 148, 149, 191, 128, 139,
+	140, 143, 144, 191, 128, 135, 136, 143,
+	144, 153, 154, 159, 160, 191, 128, 135,
+	136, 143, 144, 173, 174, 255, 187, 128,
+	139, 140, 191, 134, 128, 191, 128, 191,
+	160, 128, 191, 128, 130, 131, 135, 191,
+	129, 134, 136, 190, 128, 159, 160, 191,
+	0, 127, 192, 255, 128, 175, 176, 255,
+	10, 13, 127, 194, 216, 219, 220, 224,
+	225, 226, 227, 234, 235, 236, 237, 239,
+	240, 243, 0, 31, 128, 191, 192, 223,
+	228, 238, 241, 247, 248, 255, 204, 205,
+	210, 214, 215, 216, 217, 219, 220, 221,
+	222, 223, 224, 225, 226, 227, 234, 239,
+	240, 243, 204, 205, 210, 214, 215, 216,
+	217, 219, 220, 221, 222, 223, 224, 225,
+	226, 227, 234, 239, 240, 243, 194, 204,
+	205, 210, 214, 215, 216, 217, 219, 220,
+	221, 222, 223, 224, 225, 226, 227, 234,
+	239, 240, 243, 194, 216, 219, 220, 224,
+	225, 226, 227, 234, 235, 236, 237, 239,
+	240, 243, 32, 126, 192, 223, 228, 238,
+	241, 247, 204, 205, 210, 214, 215, 216,
+	217, 219, 220, 221, 222, 223, 224, 225,
+	226, 227, 234, 239, 240, 243, 204, 205,
+	210, 214, 215, 216, 217, 219, 220, 221,
+	222, 223, 224, 225, 226, 227, 234, 239,
+	240, 243, 194, 204, 205, 210, 214, 215,
+	216, 217, 219, 220, 221, 222, 223, 224,
+	225, 226, 227, 234, 239, 240, 243, 204,
+	205, 210, 214, 215, 216, 217, 219, 220,
+	221, 222, 223, 224, 225, 226, 227, 234,
+	235, 236, 237, 239, 240, 243, 204, 205,
+	210, 214, 215, 216, 217, 219, 220, 221,
+	222, 223, 224, 225, 226, 227, 234, 237,
+	239, 240, 243, 204, 205, 210, 214, 215,
+	216, 217, 219, 220, 221, 222, 223, 224,
+	225, 226, 227, 234, 237, 239, 240, 243,
+	204, 205, 210, 214, 215, 216, 217, 219,
+	220, 221, 222, 223, 224, 225, 226, 227,
+	234, 237, 239, 240, 243, 204, 205, 210,
+	214, 215, 216, 217, 219, 220, 221, 222,
+	223, 224, 225, 226, 227, 234, 239, 240,
+	243, 204, 205, 210, 214, 215, 216, 217,
+	219, 220, 221, 222, 223, 224, 225, 226,
+	227, 234, 235, 236, 237, 239, 240, 243,
+	204, 205, 210, 214, 215, 216, 217, 219,
+	220, 221, 222, 223, 224, 225, 226, 227,
+	234, 239, 240, 243, 194, 204, 205, 210,
+	214, 215, 216, 217, 219, 220, 221, 222,
+	223, 224, 225, 226, 227, 234, 239, 240,
+	243, 204, 205, 210, 214, 215, 216, 217,
+	219, 220, 221, 222, 223, 224, 225, 226,
+	227, 234, 237, 239, 240, 243, 204, 205,
+	210, 214, 215, 216, 217, 219, 220, 221,
+	222, 223, 224, 225, 226, 227, 234, 237,
+	239, 240, 243, 204, 205, 210, 214, 215,
+	216, 217, 219, 220, 221, 222, 223, 224,
+	225, 226, 227, 234, 237, 239, 240, 243,
+	204, 205, 210, 214, 215, 216, 217, 219,
+	220, 221, 222, 223, 224, 225, 226, 227,
+	234, 239, 240, 243, 204, 205, 210, 214,
+	215, 216, 217, 219, 220, 221, 222, 223,
+	224, 225, 226, 227, 234, 239, 240, 243,
+	204, 205, 210, 214, 215, 216, 217, 219,
+	220, 221, 222, 223, 224, 225, 226, 227,
+	234, 239, 240, 243, 194, 204, 205, 210,
+	214, 215, 216, 217, 219, 220, 221, 222,
+	223, 224, 225, 226, 227, 234, 239, 240,
+	243,
+}
+
+var _graphclust_single_lengths []byte = []byte{
+	0, 1, 0, 0, 0, 1, 1, 0,
+	1, 0, 1, 0, 0, 1, 27, 0,
+	0, 0, 0, 1, 1, 1, 0, 0,
+	2, 1, 0, 1, 1, 1, 2, 1,
+	0, 2, 0, 2, 1, 0, 1, 0,
+	3, 0, 0, 1, 22, 0, 0, 3,
+	0, 0, 0, 0, 0, 1, 1, 0,
+	0, 3, 0, 0, 0, 0, 0, 0,
+	0, 2, 0, 5, 0, 0, 0, 1,
+	0, 2, 0, 0, 15, 0, 0, 0,
+	4, 0, 0, 0, 0, 0, 0, 0,
+	2, 1, 1, 0, 3, 1, 0, 9,
+	10, 1, 1, 0, 1, 0, 0, 0,
+	0, 0, 0, 38, 0, 0, 0, 1,
+	0, 1, 0, 1, 1, 1, 0, 0,
+	1, 0, 1, 0, 0, 0, 0, 0,
+	0, 0, 0, 1, 1, 0, 1, 0,
+	0, 0, 1, 1, 0, 0, 1, 0,
+	1, 1, 5, 0, 0, 1, 0, 1,
+	1, 0, 2, 0, 0, 6, 0, 0,
+	0, 0, 0, 1, 8, 0, 1, 1,
+	0, 0, 0, 1, 0, 1, 4, 0,
+	0, 0, 3, 0, 0, 0, 1, 1,
+	0, 1, 0, 1, 0, 0, 1, 27,
+	0, 0, 0, 0, 1, 1, 1, 0,
+	0, 2, 1, 0, 1, 1, 1, 2,
+	1, 0, 2, 0, 2, 1, 0, 1,
+	0, 3, 0, 0, 1, 22, 0, 0,
+	3, 0, 0, 0, 0, 0, 1, 1,
+	0, 0, 3, 0, 0, 0, 0, 0,
+	0, 0, 2, 0, 5, 2, 2, 24,
+	3, 1, 0, 2, 0, 1, 1, 1,
+	1, 1, 1, 0, 0, 0, 2, 5,
+	3, 0, 0, 2, 0, 1, 0, 3,
+	1, 0, 2, 15, 0, 0, 0, 4,
+	0, 0, 0, 0, 0, 0, 0, 2,
+	1, 1, 0, 3, 1, 0, 9, 10,
+	1, 1, 0, 1, 0, 0, 0, 0,
+	0, 0, 38, 0, 0, 0, 0, 1,
+	0, 1, 1, 1, 0, 0, 1, 0,
+	1, 0, 0, 0, 0, 0, 0, 0,
+	0, 1, 1, 0, 1, 0, 0, 0,
+	1, 1, 0, 0, 1, 0, 1, 1,
+	5, 0, 0, 1, 0, 1, 1, 0,
+	2, 0, 0, 6, 0, 0, 0, 0,
+	0, 1, 8, 0, 1, 1, 0, 0,
+	0, 32, 0, 1, 0, 1, 0, 2,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 1, 4, 0, 2, 0,
+	9, 1, 0, 1, 0, 0, 0, 1,
+	1, 0, 1, 0, 1, 0, 0, 1,
+	27, 0, 0, 0, 0, 1, 1, 1,
+	0, 0, 2, 1, 0, 1, 1, 1,
+	2, 1, 0, 2, 0, 2, 1, 0,
+	1, 0, 3, 0, 0, 1, 22, 0,
+	0, 3, 0, 0, 0, 0, 0, 1,
+	1, 0, 0, 3, 0, 0, 0, 0,
+	0, 0, 0, 2, 0, 5, 0, 0,
+	0, 1, 0, 2, 0, 0, 15, 0,
+	0, 0, 4, 0, 0, 0, 0, 0,
+	0, 0, 2, 1, 1, 0, 3, 1,
+	0, 9, 10, 1, 1, 0, 1, 0,
+	0, 0, 0, 0, 0, 38, 0, 0,
+	0, 1, 0, 1, 0, 1, 1, 1,
+	0, 0, 1, 0, 1, 0, 0, 0,
+	0, 0, 0, 0, 0, 1, 1, 0,
+	1, 0, 0, 0, 1, 1, 0, 0,
+	1, 0, 1, 1, 5, 0, 0, 1,
+	0, 1, 1, 0, 2, 0, 0, 6,
+	0, 0, 0, 0, 0, 1, 8, 0,
+	1, 1, 0, 0, 0, 1, 0, 1,
+	4, 0, 0, 0, 2, 0, 0, 0,
+	1, 1, 0, 1, 0, 1, 0, 0,
+	1, 27, 0, 0, 0, 0, 1, 1,
+	1, 0, 0, 2, 1, 0, 1, 1,
+	1, 2, 1, 0, 2, 0, 2, 1,
+	0, 1, 0, 3, 0, 0, 1, 22,
+	0, 0, 3, 0, 0, 0, 0, 0,
+	1, 1, 0, 0, 3, 0, 0, 0,
+	0, 0, 0, 0, 2, 0, 5, 2,
+	2, 24, 3, 1, 0, 2, 0, 1,
+	1, 1, 1, 1, 1, 0, 0, 0,
+	2, 5, 3, 0, 0, 2, 0, 1,
+	0, 3, 1, 0, 2, 15, 0, 0,
+	0, 4, 0, 0, 0, 0, 0, 0,
+	0, 2, 1, 1, 0, 3, 1, 0,
+	9, 10, 1, 1, 0, 1, 0, 0,
+	0, 0, 0, 0, 38, 0, 0, 0,
+	0, 1, 0, 1, 1, 1, 0, 0,
+	1, 0, 1, 0, 0, 0, 0, 0,
+	0, 0, 0, 1, 1, 0, 1, 0,
+	0, 0, 1, 1, 0, 0, 1, 0,
+	1, 1, 5, 0, 0, 1, 0, 1,
+	1, 0, 2, 0, 0, 6, 0, 0,
+	0, 0, 0, 1, 8, 0, 1, 1,
+	0, 0, 0, 32, 0, 1, 0, 1,
+	0, 2, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 1, 4, 0,
+	2, 0, 9, 1, 0, 0, 1, 1,
+	3, 0, 1, 1, 5, 0, 25, 0,
+	25, 0, 0, 24, 0, 0, 1, 0,
+	2, 0, 0, 0, 28, 0, 3, 24,
+	2, 0, 2, 2, 3, 2, 2, 2,
+	0, 54, 54, 27, 1, 0, 20, 1,
+	1, 2, 0, 1, 1, 1, 1, 1,
+	2, 2, 0, 2, 5, 3, 0, 0,
+	2, 2, 2, 2, 0, 14, 0, 3,
+	2, 2, 3, 2, 2, 2, 54, 54,
+	27, 1, 0, 2, 0, 1, 5, 9,
+	1, 1, 0, 1, 1, 1, 0, 1,
+	1, 1, 0, 1, 0, 1, 0, 34,
+	1, 0, 1, 0, 9, 2, 0, 4,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 1, 1, 0, 1, 3, 1,
+	1, 3, 0, 1, 1, 5, 0, 0,
+	0, 0, 1, 1, 0, 1, 0, 1,
+	0, 0, 1, 27, 0, 0, 0, 0,
+	1, 1, 1, 0, 0, 2, 1, 0,
+	1, 1, 1, 2, 1, 0, 2, 0,
+	2, 1, 0, 1, 0, 3, 0, 0,
+	1, 22, 0, 0, 3, 0, 0, 0,
+	0, 0, 1, 1, 0, 0, 3, 0,
+	0, 0, 0, 0, 0, 0, 2, 0,
+	5, 2, 2, 24, 3, 1, 0, 2,
+	0, 1, 1, 1, 1, 1, 1, 0,
+	0, 0, 2, 5, 3, 0, 0, 2,
+	0, 1, 0, 3, 1, 0, 2, 15,
+	0, 0, 0, 4, 0, 0, 0, 0,
+	0, 0, 0, 2, 1, 1, 0, 3,
+	1, 0, 9, 10, 1, 1, 0, 1,
+	0, 0, 0, 0, 0, 0, 38, 0,
+	0, 0, 0, 1, 0, 1, 1, 1,
+	0, 0, 1, 0, 1, 0, 0, 0,
+	0, 0, 0, 0, 0, 1, 1, 0,
+	1, 0, 0, 0, 1, 1, 0, 0,
+	1, 0, 1, 1, 5, 0, 0, 1,
+	0, 1, 1, 0, 2, 0, 0, 6,
+	0, 0, 0, 0, 0, 1, 8, 0,
+	1, 1, 0, 0, 0, 32, 0, 1,
+	0, 1, 0, 2, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 1,
+	4, 0, 2, 0, 9, 1, 0, 25,
+	0, 25, 0, 0, 24, 0, 0, 1,
+	0, 2, 0, 0, 0, 28, 0, 3,
+	24, 2, 0, 2, 2, 3, 2, 2,
+	2, 0, 54, 54, 27, 1, 1, 20,
+	3, 0, 0, 0, 1, 1, 0, 1,
+	0, 1, 0, 0, 1, 27, 0, 0,
+	0, 0, 1, 1, 1, 0, 0, 2,
+	1, 0, 1, 1, 1, 2, 1, 0,
+	2, 0, 2, 1, 0, 1, 0, 3,
+	0, 0, 1, 22, 0, 0, 3, 0,
+	0, 0, 0, 0, 1, 1, 0, 0,
+	3, 0, 0, 0, 0, 0, 0, 0,
+	2, 0, 5, 0, 0, 0, 1, 0,
+	2, 0, 0, 15, 0, 0, 0, 4,
+	0, 0, 0, 0, 0, 0, 0, 2,
+	1, 1, 0, 3, 1, 0, 9, 10,
+	1, 1, 0, 1, 0, 0, 0, 0,
+	0, 0, 38, 0, 0, 0, 1, 0,
+	1, 0, 1, 1, 1, 0, 0, 1,
+	0, 1, 0, 0, 0, 0, 0, 0,
+	0, 0, 1, 1, 0, 1, 0, 0,
+	0, 1, 1, 0, 0, 1, 0, 1,
+	1, 5, 0, 0, 1, 0, 1, 1,
+	0, 2, 0, 0, 6, 0, 0, 0,
+	0, 0, 1, 8, 0, 1, 1, 0,
+	0, 0, 1, 0, 1, 4, 0, 0,
+	0, 1, 2, 0, 1, 1, 1, 1,
+	1, 2, 2, 0, 2, 5, 3, 0,
+	0, 2, 2, 2, 2, 0, 14, 0,
+	3, 2, 2, 3, 2, 2, 2, 54,
+	54, 27, 1, 0, 2, 1, 1, 5,
+	9, 1, 1, 0, 1, 1, 1, 0,
+	1, 1, 1, 0, 1, 0, 1, 0,
+	34, 1, 0, 1, 0, 0, 0, 0,
+	1, 1, 0, 1, 0, 1, 0, 0,
+	1, 27, 0, 0, 0, 0, 1, 1,
+	1, 0, 0, 2, 1, 0, 1, 1,
+	1, 2, 1, 0, 2, 0, 2, 1,
+	0, 1, 0, 3, 0, 0, 1, 22,
+	0, 0, 3, 0, 0, 0, 0, 0,
+	1, 1, 0, 0, 3, 0, 0, 0,
+	0, 0, 0, 0, 2, 0, 5, 2,
+	2, 24, 3, 1, 0, 2, 0, 1,
+	1, 1, 1, 1, 1, 0, 0, 0,
+	2, 5, 3, 0, 0, 2, 0, 1,
+	0, 3, 1, 0, 2, 15, 0, 0,
+	0, 4, 0, 0, 0, 0, 0, 0,
+	0, 2, 1, 1, 0, 3, 1, 0,
+	9, 10, 1, 1, 0, 1, 0, 0,
+	0, 0, 0, 0, 38, 0, 0, 0,
+	0, 1, 0, 1, 1, 1, 0, 0,
+	1, 0, 1, 0, 0, 0, 0, 0,
+	0, 0, 0, 1, 1, 0, 1, 0,
+	0, 0, 1, 1, 0, 0, 1, 0,
+	1, 1, 5, 0, 0, 1, 0, 1,
+	1, 0, 2, 0, 0, 6, 0, 0,
+	0, 0, 0, 1, 8, 0, 1, 1,
+	0, 0, 0, 32, 0, 1, 0, 1,
+	0, 2, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 1, 4, 0,
+	2, 0, 9, 1, 0, 9, 2, 0,
+	4, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 1, 1, 0, 1, 5,
+	0, 0, 0, 0, 0, 18, 20, 20,
+	21, 15, 20, 20, 21, 23, 21, 21,
+	21, 20, 23, 20, 21, 21, 21, 21,
+	20, 20, 20, 21,
+}
+
+var _graphclust_range_lengths []byte = []byte{
+	0, 0, 1, 1, 1, 1, 2, 1,
+	1, 4, 1, 1, 1, 1, 2, 4,
+	1, 1, 2, 1, 2, 2, 6, 6,
+	3, 2, 5, 1, 3, 2, 3, 5,
+	3, 3, 1, 3, 1, 1, 1, 1,
+	2, 1, 4, 0, 0, 2, 3, 1,
+	1, 2, 2, 1, 2, 1, 1, 2,
+	1, 2, 1, 1, 2, 2, 2, 1,
+	1, 3, 1, 0, 1, 1, 1, 0,
+	1, 0, 1, 1, 0, 2, 1, 1,
+	1, 2, 3, 1, 1, 2, 2, 1,
+	1, 3, 2, 2, 0, 0, 2, 0,
+	0, 0, 0, 1, 4, 1, 1, 1,
+	1, 1, 1, 0, 2, 3, 2, 0,
+	2, 1, 2, 2, 1, 0, 1, 3,
+	6, 1, 1, 1, 2, 2, 1, 1,
+	2, 1, 3, 1, 2, 3, 1, 1,
+	2, 2, 3, 1, 3, 1, 3, 1,
+	0, 1, 0, 1, 1, 1, 2, 1,
+	0, 1, 0, 2, 1, 0, 3, 3,
+	1, 2, 2, 2, 0, 5, 0, 0,
+	1, 1, 1, 0, 1, 0, 1, 1,
+	1, 0, 2, 1, 1, 1, 1, 2,
+	1, 1, 4, 1, 1, 1, 1, 2,
+	4, 1, 1, 2, 1, 2, 2, 6,
+	6, 3, 2, 5, 1, 3, 2, 3,
+	5, 3, 3, 1, 3, 1, 1, 1,
+	1, 2, 1, 4, 0, 0, 2, 3,
+	1, 1, 2, 2, 1, 2, 1, 1,
+	2, 1, 2, 1, 1, 2, 2, 2,
+	1, 1, 3, 1, 0, 0, 0, 0,
+	0, 0, 1, 0, 2, 1, 0, 2,
+	0, 1, 1, 3, 2, 0, 6, 2,
+	1, 1, 2, 0, 1, 0, 1, 0,
+	1, 1, 0, 0, 2, 1, 1, 1,
+	2, 3, 1, 1, 2, 2, 1, 1,
+	3, 2, 2, 0, 0, 2, 0, 0,
+	0, 0, 1, 4, 1, 1, 1, 1,
+	1, 1, 0, 2, 3, 2, 2, 1,
+	2, 2, 1, 0, 1, 3, 6, 1,
+	1, 1, 2, 2, 1, 1, 2, 1,
+	3, 1, 2, 3, 1, 1, 2, 2,
+	3, 1, 3, 1, 3, 1, 0, 1,
+	0, 1, 1, 1, 2, 1, 0, 1,
+	0, 2, 1, 0, 3, 3, 1, 2,
+	2, 2, 0, 5, 0, 0, 1, 1,
+	1, 4, 1, 1, 2, 2, 1, 3,
+	1, 1, 1, 1, 1, 1, 1, 2,
+	2, 2, 2, 0, 1, 1, 0, 1,
+	0, 0, 1, 2, 1, 1, 1, 1,
+	2, 1, 1, 4, 1, 1, 1, 1,
+	2, 4, 1, 1, 2, 1, 2, 2,
+	6, 6, 3, 2, 5, 1, 3, 2,
+	3, 5, 3, 3, 1, 3, 1, 1,
+	1, 1, 2, 1, 4, 0, 0, 2,
+	3, 1, 1, 2, 2, 1, 2, 1,
+	1, 2, 1, 2, 1, 1, 2, 2,
+	2, 1, 1, 3, 1, 0, 1, 1,
+	1, 0, 1, 0, 1, 1, 0, 2,
+	1, 1, 1, 2, 3, 1, 1, 2,
+	2, 1, 1, 3, 2, 2, 0, 0,
+	2, 0, 0, 0, 0, 1, 4, 1,
+	1, 1, 1, 1, 1, 0, 2, 3,
+	2, 0, 2, 1, 2, 2, 1, 0,
+	1, 3, 6, 1, 1, 1, 2, 2,
+	1, 1, 2, 1, 3, 1, 2, 3,
+	1, 1, 2, 2, 3, 1, 3, 1,
+	3, 1, 0, 1, 0, 1, 1, 1,
+	2, 1, 0, 1, 0, 2, 1, 0,
+	3, 3, 1, 2, 2, 2, 0, 5,
+	0, 0, 1, 1, 1, 0, 1, 0,
+	1, 1, 1, 0, 2, 1, 1, 1,
+	1, 2, 1, 1, 4, 1, 1, 1,
+	1, 2, 4, 1, 1, 2, 1, 2,
+	2, 6, 6, 3, 2, 5, 1, 3,
+	2, 3, 5, 3, 3, 1, 3, 1,
+	1, 1, 1, 2, 1, 4, 0, 0,
+	2, 3, 1, 1, 2, 2, 1, 2,
+	1, 1, 2, 1, 2, 1, 1, 2,
+	2, 2, 1, 1, 3, 1, 0, 0,
+	0, 0, 0, 0, 1, 0, 2, 1,
+	0, 2, 0, 1, 1, 3, 2, 0,
+	6, 2, 1, 1, 2, 0, 1, 0,
+	1, 0, 1, 1, 0, 0, 2, 1,
+	1, 1, 2, 3, 1, 1, 2, 2,
+	1, 1, 3, 2, 2, 0, 0, 2,
+	0, 0, 0, 0, 1, 4, 1, 1,
+	1, 1, 1, 1, 0, 2, 3, 2,
+	2, 1, 2, 2, 1, 0, 1, 3,
+	6, 1, 1, 1, 2, 2, 1, 1,
+	2, 1, 3, 1, 2, 3, 1, 1,
+	2, 2, 3, 1, 3, 1, 3, 1,
+	0, 1, 0, 1, 1, 1, 2, 1,
+	0, 1, 0, 2, 1, 0, 3, 3,
+	1, 2, 2, 2, 0, 5, 0, 0,
+	1, 1, 1, 4, 1, 1, 2, 2,
+	1, 3, 1, 1, 1, 1, 1, 1,
+	1, 2, 2, 2, 2, 0, 1, 1,
+	0, 1, 0, 0, 1, 3, 1, 1,
+	1, 3, 1, 1, 1, 1, 0, 1,
+	0, 1, 1, 0, 1, 1, 0, 1,
+	0, 1, 3, 1, 2, 2, 1, 0,
+	0, 1, 0, 0, 0, 0, 0, 1,
+	0, 1, 1, 2, 2, 2, 1, 4,
+	2, 1, 5, 3, 1, 5, 1, 3,
+	2, 1, 3, 7, 5, 3, 3, 5,
+	1, 1, 1, 1, 1, 3, 3, 1,
+	0, 0, 0, 0, 0, 1, 1, 1,
+	3, 2, 4, 1, 1, 2, 1, 1,
+	1, 1, 3, 1, 1, 1, 3, 1,
+	1, 1, 1, 1, 2, 1, 2, 4,
+	3, 4, 4, 2, 0, 0, 1, 3,
+	2, 2, 2, 2, 2, 2, 2, 3,
+	5, 4, 2, 1, 1, 1, 1, 1,
+	1, 1, 3, 1, 1, 1, 1, 1,
+	1, 1, 1, 2, 1, 1, 4, 1,
+	1, 1, 1, 2, 4, 1, 1, 2,
+	1, 2, 2, 6, 6, 3, 2, 5,
+	1, 3, 2, 3, 5, 3, 3, 1,
+	3, 1, 1, 1, 1, 2, 1, 4,
+	0, 0, 2, 3, 1, 1, 2, 2,
+	1, 2, 1, 1, 2, 1, 2, 1,
+	1, 2, 2, 2, 1, 1, 3, 1,
+	0, 0, 0, 0, 0, 0, 1, 0,
+	2, 1, 0, 2, 0, 1, 1, 3,
+	2, 0, 6, 2, 1, 1, 2, 0,
+	1, 0, 1, 0, 1, 1, 0, 0,
+	2, 1, 1, 1, 2, 3, 1, 1,
+	2, 2, 1, 1, 3, 2, 2, 0,
+	0, 2, 0, 0, 0, 0, 1, 4,
+	1, 1, 1, 1, 1, 1, 0, 2,
+	3, 2, 2, 1, 2, 2, 1, 0,
+	1, 3, 6, 1, 1, 1, 2, 2,
+	1, 1, 2, 1, 3, 1, 2, 3,
+	1, 1, 2, 2, 3, 1, 3, 1,
+	3, 1, 0, 1, 0, 1, 1, 1,
+	2, 1, 0, 1, 0, 2, 1, 0,
+	3, 3, 1, 2, 2, 2, 0, 5,
+	0, 0, 1, 1, 1, 4, 1, 1,
+	2, 2, 1, 3, 1, 1, 1, 1,
+	1, 1, 1, 2, 2, 2, 2, 0,
+	1, 1, 0, 1, 0, 0, 1, 0,
+	1, 0, 1, 1, 0, 1, 1, 0,
+	1, 0, 1, 3, 1, 2, 2, 1,
+	0, 0, 1, 0, 0, 0, 0, 0,
+	1, 0, 1, 1, 2, 2, 1, 1,
+	5, 1, 1, 1, 1, 2, 1, 1,
+	4, 1, 1, 1, 1, 2, 4, 1,
+	1, 2, 1, 2, 2, 6, 6, 3,
+	2, 5, 1, 3, 2, 3, 5, 3,
+	3, 1, 3, 1, 1, 1, 1, 2,
+	1, 4, 0, 0, 2, 3, 1, 1,
+	2, 2, 1, 2, 1, 1, 2, 1,
+	2, 1, 1, 2, 2, 2, 1, 1,
+	3, 1, 0, 1, 1, 1, 0, 1,
+	0, 1, 1, 0, 2, 1, 1, 1,
+	2, 3, 1, 1, 2, 2, 1, 1,
+	3, 2, 2, 0, 0, 2, 0, 0,
+	0, 0, 1, 4, 1, 1, 1, 1,
+	1, 1, 0, 2, 3, 2, 0, 2,
+	1, 2, 2, 1, 0, 1, 3, 6,
+	1, 1, 1, 2, 2, 1, 1, 2,
+	1, 3, 1, 2, 3, 1, 1, 2,
+	2, 3, 1, 3, 1, 3, 1, 0,
+	1, 0, 1, 1, 1, 2, 1, 0,
+	1, 0, 2, 1, 0, 3, 3, 1,
+	2, 2, 2, 0, 5, 0, 0, 1,
+	1, 1, 0, 1, 0, 1, 1, 1,
+	0, 3, 1, 5, 3, 1, 5, 1,
+	3, 2, 1, 3, 7, 5, 3, 3,
+	5, 1, 1, 1, 1, 1, 3, 3,
+	1, 0, 0, 0, 0, 0, 1, 1,
+	1, 3, 2, 4, 1, 1, 3, 1,
+	1, 1, 1, 3, 1, 1, 1, 3,
+	1, 1, 1, 2, 1, 3, 1, 3,
+	4, 3, 4, 4, 2, 1, 1, 1,
+	1, 2, 1, 1, 4, 1, 1, 1,
+	1, 2, 4, 1, 1, 2, 1, 2,
+	2, 6, 6, 3, 2, 5, 1, 3,
+	2, 3, 5, 3, 3, 1, 3, 1,
+	1, 1, 1, 2, 1, 4, 0, 0,
+	2, 3, 1, 1, 2, 2, 1, 2,
+	1, 1, 2, 1, 2, 1, 1, 2,
+	2, 2, 1, 1, 3, 1, 0, 0,
+	0, 0, 0, 0, 1, 0, 2, 1,
+	0, 2, 0, 1, 1, 3, 2, 0,
+	6, 2, 1, 1, 2, 0, 1, 0,
+	1, 0, 1, 1, 0, 0, 2, 1,
+	1, 1, 2, 3, 1, 1, 2, 2,
+	1, 1, 3, 2, 2, 0, 0, 2,
+	0, 0, 0, 0, 1, 4, 1, 1,
+	1, 1, 1, 1, 0, 2, 3, 2,
+	2, 1, 2, 2, 1, 0, 1, 3,
+	6, 1, 1, 1, 2, 2, 1, 1,
+	2, 1, 3, 1, 2, 3, 1, 1,
+	2, 2, 3, 1, 3, 1, 3, 1,
+	0, 1, 0, 1, 1, 1, 2, 1,
+	0, 1, 0, 2, 1, 0, 3, 3,
+	1, 2, 2, 2, 0, 5, 0, 0,
+	1, 1, 1, 4, 1, 1, 2, 2,
+	1, 3, 1, 1, 1, 1, 1, 1,
+	1, 2, 2, 2, 2, 0, 1, 1,
+	0, 1, 0, 0, 1, 0, 0, 1,
+	3, 2, 2, 2, 2, 2, 2, 2,
+	3, 5, 4, 2, 1, 1, 1, 2,
+	2, 1, 1, 2, 0, 6, 0, 0,
+	0, 4, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0,
+}
+
+var _graphclust_index_offsets []int16 = []int16{
+	0, 0, 2, 4, 6, 8, 11, 15,
+	17, 20, 25, 28, 30, 32, 35, 65,
+	70, 72, 74, 77, 80, 84, 88, 95,
+	102, 108, 112, 118, 121, 126, 130, 136,
+	143, 147, 153, 155, 161, 164, 166, 169,
+	171, 177, 179, 184, 186, 209, 212, 216,
+	221, 223, 226, 229, 231, 234, 237, 240,
+	243, 245, 251, 253, 255, 258, 261, 264,
+	266, 268, 274, 276, 282, 284, 286, 288,
+	290, 292, 295, 297, 299, 315, 318, 320,
+	322, 328, 331, 335, 337, 339, 342, 345,
+	347, 351, 356, 360, 363, 367, 369, 372,
+	382, 393, 395, 397, 399, 405, 407, 409,
+	411, 413, 415, 417, 456, 459, 463, 466,
+	468, 471, 474, 477, 481, 484, 486, 488,
+	492, 500, 502, 505, 507, 510, 513, 515,
+	517, 520, 522, 526, 529, 533, 537, 540,
+	542, 545, 548, 553, 556, 560, 562, 567,
+	569, 571, 574, 580, 582, 584, 587, 590,
+	593, 595, 597, 600, 603, 605, 612, 616,
+	620, 622, 625, 628, 632, 641, 647, 649,
+	651, 653, 655, 657, 659, 661, 663, 669,
+	671, 673, 674, 680, 682, 684, 686, 689,
+	693, 695, 698, 703, 706, 708, 710, 713,
+	743, 748, 750, 752, 755, 758, 762, 766,
+	773, 780, 786, 790, 796, 799, 804, 808,
+	814, 821, 825, 831, 833, 839, 842, 844,
+	847, 849, 855, 857, 862, 864, 887, 890,
+	894, 899, 901, 904, 907, 909, 912, 915,
+	918, 921, 923, 929, 931, 933, 936, 939,
+	942, 944, 946, 952, 954, 960, 963, 966,
+	991, 995, 997, 999, 1002, 1005, 1008, 1010,
+	1014, 1016, 1019, 1022, 1026, 1029, 1030, 1039,
+	1047, 1052, 1054, 1057, 1060, 1062, 1064, 1066,
+	1070, 1073, 1075, 1078, 1094, 1097, 1099, 1101,
+	1107, 1110, 1114, 1116, 1118, 1121, 1124, 1126,
+	1130, 1135, 1139, 1142, 1146, 1148, 1151, 1161,
+	1172, 1174, 1176, 1178, 1184, 1186, 1188, 1190,
+	1192, 1194, 1196, 1235, 1238, 1242, 1245, 1248,
+	1251, 1254, 1258, 1261, 1263, 1265, 1269, 1277,
+	1279, 1282, 1284, 1287, 1290, 1292, 1294, 1297,
+	1299, 1303, 1306, 1310, 1314, 1317, 1319, 1322,
+	1325, 1330, 1333, 1337, 1339, 1344, 1346, 1348,
+	1351, 1357, 1359, 1361, 1364, 1367, 1370, 1372,
+	1374, 1377, 1380, 1382, 1389, 1393, 1397, 1399,
+	1402, 1405, 1409, 1418, 1424, 1426, 1428, 1430,
+	1432, 1434, 1471, 1473, 1476, 1479, 1483, 1485,
+	1491, 1493, 1495, 1497, 1499, 1501, 1503, 1505,
+	1508, 1511, 1514, 1517, 1519, 1525, 1527, 1530,
+	1532, 1542, 1544, 1546, 1550, 1552, 1554, 1556,
+	1559, 1563, 1565, 1568, 1573, 1576, 1578, 1580,
+	1583, 1613, 1618, 1620, 1622, 1625, 1628, 1632,
+	1636, 1643, 1650, 1656, 1660, 1666, 1669, 1674,
+	1678, 1684, 1691, 1695, 1701, 1703, 1709, 1712,
+	1714, 1717, 1719, 1725, 1727, 1732, 1734, 1757,
+	1760, 1764, 1769, 1771, 1774, 1777, 1779, 1782,
+	1785, 1788, 1791, 1793, 1799, 1801, 1803, 1806,
+	1809, 1812, 1814, 1816, 1822, 1824, 1830, 1832,
+	1834, 1836, 1838, 1840, 1843, 1845, 1847, 1863,
+	1866, 1868, 1870, 1876, 1879, 1883, 1885, 1887,
+	1890, 1893, 1895, 1899, 1904, 1908, 1911, 1915,
+	1917, 1920, 1930, 1941, 1943, 1945, 1947, 1953,
+	1955, 1957, 1959, 1961, 1963, 1965, 2004, 2007,
+	2011, 2014, 2016, 2019, 2022, 2025, 2029, 2032,
+	2034, 2036, 2040, 2048, 2050, 2053, 2055, 2058,
+	2061, 2063, 2065, 2068, 2070, 2074, 2077, 2081,
+	2085, 2088, 2090, 2093, 2096, 2101, 2104, 2108,
+	2110, 2115, 2117, 2119, 2122, 2128, 2130, 2132,
+	2135, 2138, 2141, 2143, 2145, 2148, 2151, 2153,
+	2160, 2164, 2168, 2170, 2173, 2176, 2180, 2189,
+	2195, 2197, 2199, 2201, 2203, 2205, 2207, 2209,
+	2211, 2217, 2219, 2221, 2222, 2227, 2229, 2231,
+	2233, 2236, 2240, 2242, 2245, 2250, 2253, 2255,
+	2257, 2260, 2290, 2295, 2297, 2299, 2302, 2305,
+	2309, 2313, 2320, 2327, 2333, 2337, 2343, 2346,
+	2351, 2355, 2361, 2368, 2372, 2378, 2380, 2386,
+	2389, 2391, 2394, 2396, 2402, 2404, 2409, 2411,
+	2434, 2437, 2441, 2446, 2448, 2451, 2454, 2456,
+	2459, 2462, 2465, 2468, 2470, 2476, 2478, 2480,
+	2483, 2486, 2489, 2491, 2493, 2499, 2501, 2507,
+	2510, 2513, 2538, 2542, 2544, 2546, 2549, 2552,
+	2555, 2557, 2561, 2563, 2566, 2569, 2573, 2576,
+	2577, 2586, 2594, 2599, 2601, 2604, 2607, 2609,
+	2611, 2613, 2617, 2620, 2622, 2625, 2641, 2644,
+	2646, 2648, 2654, 2657, 2661, 2663, 2665, 2668,
+	2671, 2673, 2677, 2682, 2686, 2689, 2693, 2695,
+	2698, 2708, 2719, 2721, 2723, 2725, 2731, 2733,
+	2735, 2737, 2739, 2741, 2743, 2782, 2785, 2789,
+	2792, 2795, 2798, 2801, 2805, 2808, 2810, 2812,
+	2816, 2824, 2826, 2829, 2831, 2834, 2837, 2839,
+	2841, 2844, 2846, 2850, 2853, 2857, 2861, 2864,
+	2866, 2869, 2872, 2877, 2880, 2884, 2886, 2891,
+	2893, 2895, 2898, 2904, 2906, 2908, 2911, 2914,
+	2917, 2919, 2921, 2924, 2927, 2929, 2936, 2940,
+	2944, 2946, 2949, 2952, 2956, 2965, 2971, 2973,
+	2975, 2977, 2979, 2981, 3018, 3020, 3023, 3026,
+	3030, 3032, 3038, 3040, 3042, 3044, 3046, 3048,
+	3050, 3052, 3055, 3058, 3061, 3064, 3066, 3072,
+	3074, 3077, 3079, 3089, 3091, 3093, 3097, 3100,
+	3103, 3108, 3112, 3115, 3118, 3125, 3127, 3153,
+	3155, 3181, 3183, 3185, 3210, 3212, 3214, 3216,
+	3218, 3221, 3223, 3227, 3229, 3260, 3263, 3268,
+	3293, 3296, 3298, 3301, 3304, 3308, 3311, 3314,
+	3318, 3319, 3375, 3431, 3461, 3465, 3468, 3490,
+	3496, 3500, 3504, 3510, 3515, 3518, 3525, 3528,
+	3533, 3538, 3542, 3546, 3556, 3567, 3574, 3578,
+	3584, 3588, 3592, 3596, 3600, 3602, 3620, 3624,
+	3629, 3632, 3635, 3639, 3642, 3645, 3649, 3705,
+	3761, 3792, 3796, 3801, 3805, 3807, 3811, 3818,
+	3829, 3832, 3835, 3839, 3842, 3845, 3848, 3852,
+	3855, 3858, 3861, 3863, 3866, 3869, 3872, 3875,
+	3914, 3919, 3924, 3930, 3933, 3943, 3946, 3948,
+	3956, 3959, 3962, 3965, 3968, 3971, 3974, 3977,
+	3981, 3987, 3992, 3996, 3999, 4001, 4004, 4009,
+	4012, 4015, 4020, 4024, 4027, 4030, 4037, 4039,
+	4041, 4043, 4045, 4048, 4052, 4054, 4057, 4062,
+	4065, 4067, 4069, 4072, 4102, 4107, 4109, 4111,
+	4114, 4117, 4121, 4125, 4132, 4139, 4145, 4149,
+	4155, 4158, 4163, 4167, 4173, 4180, 4184, 4190,
+	4192, 4198, 4201, 4203, 4206, 4208, 4214, 4216,
+	4221, 4223, 4246, 4249, 4253, 4258, 4260, 4263,
+	4266, 4268, 4271, 4274, 4277, 4280, 4282, 4288,
+	4290, 4292, 4295, 4298, 4301, 4303, 4305, 4311,
+	4313, 4319, 4322, 4325, 4350, 4354, 4356, 4358,
+	4361, 4364, 4367, 4369, 4373, 4375, 4378, 4381,
+	4385, 4388, 4389, 4398, 4406, 4411, 4413, 4416,
+	4419, 4421, 4423, 4425, 4429, 4432, 4434, 4437,
+	4453, 4456, 4458, 4460, 4466, 4469, 4473, 4475,
+	4477, 4480, 4483, 4485, 4489, 4494, 4498, 4501,
+	4505, 4507, 4510, 4520, 4531, 4533, 4535, 4537,
+	4543, 4545, 4547, 4549, 4551, 4553, 4555, 4594,
+	4597, 4601, 4604, 4607, 4610, 4613, 4617, 4620,
+	4622, 4624, 4628, 4636, 4638, 4641, 4643, 4646,
+	4649, 4651, 4653, 4656, 4658, 4662, 4665, 4669,
+	4673, 4676, 4678, 4681, 4684, 4689, 4692, 4696,
+	4698, 4703, 4705, 4707, 4710, 4716, 4718, 4720,
+	4723, 4726, 4729, 4731, 4733, 4736, 4739, 4741,
+	4748, 4752, 4756, 4758, 4761, 4764, 4768, 4777,
+	4783, 4785, 4787, 4789, 4791, 4793, 4830, 4832,
+	4835, 4838, 4842, 4844, 4850, 4852, 4854, 4856,
+	4858, 4860, 4862, 4864, 4867, 4870, 4873, 4876,
+	4878, 4884, 4886, 4889, 4891, 4901, 4903, 4905,
+	4931, 4933, 4959, 4961, 4963, 4988, 4990, 4992,
+	4994, 4996, 4999, 5001, 5005, 5007, 5038, 5041,
+	5046, 5071, 5074, 5076, 5079, 5082, 5086, 5089,
+	5092, 5096, 5097, 5153, 5209, 5239, 5243, 5246,
+	5268, 5277, 5279, 5281, 5283, 5286, 5290, 5292,
+	5295, 5300, 5303, 5305, 5307, 5310, 5340, 5345,
+	5347, 5349, 5352, 5355, 5359, 5363, 5370, 5377,
+	5383, 5387, 5393, 5396, 5401, 5405, 5411, 5418,
+	5422, 5428, 5430, 5436, 5439, 5441, 5444, 5446,
+	5452, 5454, 5459, 5461, 5484, 5487, 5491, 5496,
+	5498, 5501, 5504, 5506, 5509, 5512, 5515, 5518,
+	5520, 5526, 5528, 5530, 5533, 5536, 5539, 5541,
+	5543, 5549, 5551, 5557, 5559, 5561, 5563, 5565,
+	5567, 5570, 5572, 5574, 5590, 5593, 5595, 5597,
+	5603, 5606, 5610, 5612, 5614, 5617, 5620, 5622,
+	5626, 5631, 5635, 5638, 5642, 5644, 5647, 5657,
+	5668, 5670, 5672, 5674, 5680, 5682, 5684, 5686,
+	5688, 5690, 5692, 5731, 5734, 5738, 5741, 5743,
+	5746, 5749, 5752, 5756, 5759, 5761, 5763, 5767,
+	5775, 5777, 5780, 5782, 5785, 5788, 5790, 5792,
+	5795, 5797, 5801, 5804, 5808, 5812, 5815, 5817,
+	5820, 5823, 5828, 5831, 5835, 5837, 5842, 5844,
+	5846, 5849, 5855, 5857, 5859, 5862, 5865, 5868,
+	5870, 5872, 5875, 5878, 5880, 5887, 5891, 5895,
+	5897, 5900, 5903, 5907, 5916, 5922, 5924, 5926,
+	5928, 5930, 5932, 5934, 5936, 5938, 5944, 5946,
+	5948, 5949, 5954, 5958, 5964, 5969, 5972, 5979,
+	5982, 5987, 5992, 5996, 6000, 6010, 6021, 6028,
+	6032, 6038, 6042, 6046, 6050, 6054, 6056, 6074,
+	6078, 6083, 6086, 6089, 6093, 6096, 6099, 6103,
+	6159, 6215, 6246, 6250, 6255, 6259, 6262, 6267,
+	6274, 6285, 6288, 6291, 6295, 6298, 6301, 6304,
+	6308, 6311, 6314, 6317, 6320, 6323, 6327, 6330,
+	6334, 6373, 6378, 6383, 6389, 6392, 6394, 6396,
+	6398, 6401, 6405, 6407, 6410, 6415, 6418, 6420,
+	6422, 6425, 6455, 6460, 6462, 6464, 6467, 6470,
+	6474, 6478, 6485, 6492, 6498, 6502, 6508, 6511,
+	6516, 6520, 6526, 6533, 6537, 6543, 6545, 6551,
+	6554, 6556, 6559, 6561, 6567, 6569, 6574, 6576,
+	6599, 6602, 6606, 6611, 6613, 6616, 6619, 6621,
+	6624, 6627, 6630, 6633, 6635, 6641, 6643, 6645,
+	6648, 6651, 6654, 6656, 6658, 6664, 6666, 6672,
+	6675, 6678, 6703, 6707, 6709, 6711, 6714, 6717,
+	6720, 6722, 6726, 6728, 6731, 6734, 6738, 6741,
+	6742, 6751, 6759, 6764, 6766, 6769, 6772, 6774,
+	6776, 6778, 6782, 6785, 6787, 6790, 6806, 6809,
+	6811, 6813, 6819, 6822, 6826, 6828, 6830, 6833,
+	6836, 6838, 6842, 6847, 6851, 6854, 6858, 6860,
+	6863, 6873, 6884, 6886, 6888, 6890, 6896, 6898,
+	6900, 6902, 6904, 6906, 6908, 6947, 6950, 6954,
+	6957, 6960, 6963, 6966, 6970, 6973, 6975, 6977,
+	6981, 6989, 6991, 6994, 6996, 6999, 7002, 7004,
+	7006, 7009, 7011, 7015, 7018, 7022, 7026, 7029,
+	7031, 7034, 7037, 7042, 7045, 7049, 7051, 7056,
+	7058, 7060, 7063, 7069, 7071, 7073, 7076, 7079,
+	7082, 7084, 7086, 7089, 7092, 7094, 7101, 7105,
+	7109, 7111, 7114, 7117, 7121, 7130, 7136, 7138,
+	7140, 7142, 7144, 7146, 7183, 7185, 7188, 7191,
+	7195, 7197, 7203, 7205, 7207, 7209, 7211, 7213,
+	7215, 7217, 7220, 7223, 7226, 7229, 7231, 7237,
+	7239, 7242, 7244, 7254, 7256, 7258, 7268, 7271,
+	7273, 7281, 7284, 7287, 7290, 7293, 7296, 7299,
+	7302, 7306, 7312, 7317, 7321, 7324, 7326, 7329,
+	7337, 7340, 7342, 7344, 7347, 7348, 7373, 7394,
+	7415, 7437, 7457, 7478, 7499, 7521, 7545, 7567,
+	7589, 7611, 7632, 7656, 7677, 7699, 7721, 7743,
+	7765, 7786, 7807, 7828,
+}
+
+var _graphclust_indicies []int16 = []int16{
+	0, 1, 3, 2, 2, 3, 3, 2,
+	3, 3, 2, 3, 3, 3, 2, 3,
+	2, 3, 3, 2, 3, 3, 3, 3,
+	2, 3, 3, 2, 2, 3, 3, 2,
+	3, 3, 2, 4, 5, 6, 7, 8,
+	9, 11, 12, 13, 15, 16, 17, 18,
+	19, 20, 21, 22, 23, 24, 25, 26,
+	27, 28, 29, 30, 31, 32, 10, 14,
+	2, 3, 3, 3, 3, 2, 3, 2,
+	3, 2, 3, 3, 2, 2, 2, 3,
+	2, 2, 2, 3, 3, 3, 3, 2,
+	2, 2, 2, 2, 2, 2, 3, 2,
+	2, 2, 2, 2, 2, 3, 2, 2,
+	2, 2, 2, 3, 3, 3, 3, 2,
+	3, 3, 3, 3, 3, 2, 3, 3,
+	2, 3, 3, 3, 3, 2, 3, 3,
+	3, 2, 2, 2, 2, 2, 2, 3,
+	3, 3, 3, 3, 3, 3, 2, 3,
+	3, 3, 2, 2, 2, 2, 2, 2,
+	3, 3, 2, 3, 3, 3, 3, 3,
+	2, 3, 3, 2, 3, 2, 3, 3,
+	2, 3, 2, 3, 3, 3, 3, 3,
+	2, 3, 2, 3, 3, 3, 3, 2,
+	3, 2, 33, 34, 35, 36, 37, 38,
+	39, 40, 41, 42, 43, 44, 45, 46,
+	47, 48, 49, 50, 51, 52, 53, 54,
+	2, 3, 3, 2, 3, 3, 3, 2,
+	3, 3, 3, 3, 2, 3, 2, 3,
+	3, 2, 3, 3, 2, 3, 2, 2,
+	2, 3, 3, 3, 2, 3, 3, 2,
+	3, 3, 2, 3, 2, 3, 3, 3,
+	3, 3, 2, 3, 2, 2, 3, 3,
+	3, 2, 2, 2, 3, 3, 3, 2,
+	3, 2, 3, 2, 3, 3, 3, 3,
+	3, 2, 3, 55, 56, 57, 58, 59,
+	60, 2, 3, 2, 3, 2, 3, 2,
+	3, 2, 3, 2, 61, 62, 2, 3,
+	2, 3, 2, 63, 64, 65, 66, 67,
+	68, 69, 70, 71, 72, 73, 74, 75,
+	76, 77, 2, 3, 3, 2, 3, 2,
+	3, 2, 3, 3, 3, 3, 3, 2,
+	3, 3, 2, 2, 2, 2, 3, 3,
+	2, 3, 2, 3, 3, 2, 2, 2,
+	3, 3, 2, 3, 3, 3, 2, 3,
+	3, 3, 3, 2, 3, 3, 3, 2,
+	3, 3, 2, 78, 79, 64, 2, 3,
+	2, 3, 3, 2, 80, 81, 82, 83,
+	84, 85, 86, 87, 88, 2, 89, 90,
+	91, 92, 93, 94, 95, 96, 97, 98,
+	2, 3, 2, 3, 2, 3, 2, 3,
+	3, 3, 3, 3, 2, 3, 2, 3,
+	2, 3, 2, 3, 2, 3, 2, 3,
+	2, 99, 100, 101, 102, 103, 104, 105,
+	106, 107, 108, 109, 110, 111, 112, 113,
+	46, 114, 115, 116, 46, 117, 118, 119,
+	120, 121, 122, 123, 124, 125, 126, 127,
+	128, 129, 130, 131, 132, 133, 134, 2,
+	3, 3, 2, 2, 2, 2, 3, 2,
+	2, 3, 3, 2, 3, 3, 2, 3,
+	3, 2, 3, 3, 2, 2, 2, 2,
+	3, 3, 3, 2, 3, 2, 3, 2,
+	3, 3, 3, 2, 3, 3, 3, 3,
+	3, 3, 3, 2, 3, 2, 3, 3,
+	2, 2, 3, 3, 3, 2, 2, 2,
+	3, 2, 3, 3, 2, 3, 3, 2,
+	3, 2, 3, 3, 3, 2, 3, 3,
+	2, 3, 3, 3, 2, 3, 3, 3,
+	2, 3, 3, 2, 3, 2, 3, 3,
+	2, 3, 3, 2, 3, 3, 3, 3,
+	2, 2, 2, 3, 3, 3, 3, 2,
+	3, 2, 3, 3, 3, 3, 2, 3,
+	2, 135, 2, 3, 3, 2, 136, 137,
+	138, 139, 140, 2, 3, 2, 3, 2,
+	3, 3, 2, 2, 2, 3, 3, 3,
+	2, 141, 2, 3, 2, 142, 143, 2,
+	3, 3, 2, 2, 3, 144, 145, 146,
+	147, 148, 149, 2, 3, 3, 3, 2,
+	2, 2, 2, 3, 3, 2, 3, 3,
+	2, 2, 2, 3, 3, 3, 3, 2,
+	150, 151, 137, 152, 153, 153, 154, 155,
+	2, 3, 3, 3, 3, 3, 2, 3,
+	2, 3, 2, 3, 2, 3, 2, 3,
+	2, 156, 2, 3, 2, 157, 2, 158,
+	159, 160, 162, 161, 2, 3, 2, 2,
+	3, 3, 164, 163, 164, 163, 3, 1,
+	55, 164, 165, 164, 164, 165, 164, 164,
+	165, 164, 164, 164, 165, 164, 165, 164,
+	164, 165, 164, 164, 164, 164, 165, 164,
+	164, 165, 165, 164, 164, 165, 164, 164,
+	165, 166, 167, 168, 169, 170, 171, 173,
+	174, 175, 177, 178, 179, 180, 181, 182,
+	183, 184, 185, 186, 187, 188, 189, 190,
+	191, 192, 193, 194, 172, 176, 165, 164,
+	164, 164, 164, 165, 164, 165, 164, 165,
+	164, 164, 165, 165, 165, 164, 165, 165,
+	165, 164, 164, 164, 164, 165, 165, 165,
+	165, 165, 165, 165, 164, 165, 165, 165,
+	165, 165, 165, 164, 165, 165, 165, 165,
+	165, 164, 164, 164, 164, 165, 164, 164,
+	164, 164, 164, 165, 164, 164, 165, 164,
+	164, 164, 164, 165, 164, 164, 164, 165,
+	165, 165, 165, 165, 165, 164, 164, 164,
+	164, 164, 164, 164, 165, 164, 164, 164,
+	165, 165, 165, 165, 165, 165, 164, 164,
+	165, 164, 164, 164, 164, 164, 165, 164,
+	164, 165, 164, 165, 164, 164, 165, 164,
+	165, 164, 164, 164, 164, 164, 165, 164,
+	165, 164, 164, 164, 164, 165, 164, 165,
+	195, 196, 197, 198, 199, 200, 201, 202,
+	203, 204, 205, 206, 207, 208, 209, 210,
+	211, 212, 213, 214, 215, 216, 165, 164,
+	164, 165, 164, 164, 164, 165, 164, 164,
+	164, 164, 165, 164, 165, 164, 164, 165,
+	164, 164, 165, 164, 165, 165, 165, 164,
+	164, 164, 165, 164, 164, 165, 164, 164,
+	165, 164, 165, 164, 164, 164, 164, 164,
+	165, 164, 165, 165, 164, 164, 164, 165,
+	165, 165, 164, 164, 164, 165, 164, 165,
+	164, 165, 164, 164, 164, 164, 164, 165,
+	164, 55, 217, 218, 219, 220, 221, 165,
+	164, 222, 165, 164, 164, 165, 223, 224,
+	218, 225, 226, 227, 228, 229, 230, 231,
+	232, 233, 216, 234, 235, 236, 237, 238,
+	239, 240, 241, 219, 220, 221, 165, 164,
+	222, 164, 165, 164, 165, 164, 165, 164,
+	164, 165, 164, 164, 165, 164, 164, 165,
+	164, 165, 164, 164, 164, 165, 164, 165,
+	164, 164, 165, 164, 164, 165, 164, 164,
+	164, 165, 164, 164, 165, 164, 165, 165,
+	165, 165, 165, 165, 165, 165, 164, 164,
+	164, 164, 164, 164, 164, 164, 165, 164,
+	164, 164, 164, 165, 164, 165, 164, 164,
+	165, 164, 164, 165, 164, 165, 164, 165,
+	164, 165, 242, 243, 244, 165, 164, 164,
+	165, 164, 165, 164, 164, 165, 245, 246,
+	247, 248, 249, 250, 251, 252, 253, 254,
+	255, 256, 257, 258, 259, 165, 164, 164,
+	165, 164, 165, 164, 165, 164, 164, 164,
+	164, 164, 165, 164, 164, 165, 165, 165,
+	165, 164, 164, 165, 164, 165, 164, 164,
+	165, 165, 165, 164, 164, 165, 164, 164,
+	164, 165, 164, 164, 164, 164, 165, 164,
+	164, 164, 165, 164, 164, 165, 260, 261,
+	246, 165, 164, 165, 164, 164, 165, 262,
+	263, 264, 265, 266, 267, 268, 269, 270,
+	165, 271, 272, 273, 274, 275, 276, 277,
+	278, 279, 280, 165, 164, 165, 164, 165,
+	164, 165, 164, 164, 164, 164, 164, 165,
+	164, 165, 164, 165, 164, 165, 164, 165,
+	164, 165, 164, 165, 281, 282, 283, 230,
+	284, 285, 286, 287, 288, 289, 290, 291,
+	292, 293, 294, 208, 295, 296, 297, 208,
+	298, 299, 300, 301, 302, 303, 304, 305,
+	306, 307, 308, 309, 310, 311, 312, 313,
+	314, 315, 165, 164, 164, 165, 165, 165,
+	165, 164, 165, 165, 164, 164, 164, 165,
+	164, 164, 165, 164, 164, 165, 165, 165,
+	165, 164, 164, 164, 165, 164, 165, 164,
+	165, 164, 164, 164, 165, 164, 164, 164,
+	164, 164, 164, 164, 165, 164, 165, 164,
+	164, 165, 165, 164, 164, 164, 165, 165,
+	165, 164, 165, 164, 164, 165, 164, 164,
+	165, 164, 165, 164, 164, 164, 165, 164,
+	164, 165, 164, 164, 164, 165, 164, 164,
+	164, 165, 164, 164, 165, 164, 165, 164,
+	164, 165, 164, 164, 165, 164, 164, 164,
+	164, 165, 165, 165, 164, 164, 164, 164,
+	165, 164, 165, 164, 164, 164, 164, 165,
+	164, 165, 316, 165, 164, 164, 165, 317,
+	318, 319, 320, 321, 165, 164, 165, 164,
+	165, 164, 164, 165, 165, 165, 164, 164,
+	164, 165, 322, 165, 164, 165, 323, 324,
+	165, 164, 164, 165, 165, 164, 325, 326,
+	327, 328, 329, 330, 165, 164, 164, 164,
+	165, 165, 165, 165, 164, 164, 165, 164,
+	164, 165, 165, 165, 164, 164, 164, 164,
+	165, 331, 332, 318, 333, 334, 334, 335,
+	336, 165, 164, 164, 164, 164, 164, 165,
+	164, 165, 164, 165, 164, 165, 164, 165,
+	164, 165, 337, 338, 339, 340, 341, 342,
+	343, 344, 338, 337, 338, 337, 338, 216,
+	337, 345, 346, 338, 337, 347, 348, 349,
+	350, 351, 352, 338, 353, 354, 337, 338,
+	337, 345, 235, 216, 216, 235, 165, 55,
+	164, 164, 164, 165, 164, 164, 165, 164,
+	164, 164, 165, 165, 164, 164, 164, 164,
+	164, 164, 165, 164, 165, 165, 164, 164,
+	165, 165, 164, 164, 165, 164, 165, 164,
+	165, 164, 164, 165, 164, 164, 165, 164,
+	164, 165, 164, 164, 165, 355, 165, 356,
+	338, 337, 357, 235, 165, 164, 165, 358,
+	243, 165, 164, 165, 262, 263, 264, 265,
+	266, 267, 268, 269, 359, 165, 360, 165,
+	164, 165, 163, 361, 3, 1, 363, 362,
+	362, 363, 363, 362, 363, 363, 362, 363,
+	363, 363, 362, 363, 362, 363, 363, 362,
+	363, 363, 363, 363, 362, 363, 363, 362,
+	362, 363, 363, 362, 363, 363, 362, 364,
+	365, 366, 367, 368, 369, 371, 372, 373,
+	375, 376, 377, 378, 379, 380, 381, 382,
+	383, 384, 385, 386, 387, 388, 389, 390,
+	391, 392, 370, 374, 362, 363, 363, 363,
+	363, 362, 363, 362, 363, 362, 363, 363,
+	362, 362, 362, 363, 362, 362, 362, 363,
+	363, 363, 363, 362, 362, 362, 362, 362,
+	362, 362, 363, 362, 362, 362, 362, 362,
+	362, 363, 362, 362, 362, 362, 362, 363,
+	363, 363, 363, 362, 363, 363, 363, 363,
+	363, 362, 363, 363, 362, 363, 363, 363,
+	363, 362, 363, 363, 363, 362, 362, 362,
+	362, 362, 362, 363, 363, 363, 363, 363,
+	363, 363, 362, 363, 363, 363, 362, 362,
+	362, 362, 362, 362, 363, 363, 362, 363,
+	363, 363, 363, 363, 362, 363, 363, 362,
+	363, 362, 363, 363, 362, 363, 362, 363,
+	363, 363, 363, 363, 362, 363, 362, 363,
+	363, 363, 363, 362, 363, 362, 393, 394,
+	395, 396, 397, 398, 399, 400, 401, 402,
+	403, 404, 405, 406, 407, 408, 409, 410,
+	411, 412, 413, 414, 362, 363, 363, 362,
+	363, 363, 363, 362, 363, 363, 363, 363,
+	362, 363, 362, 363, 363, 362, 363, 363,
+	362, 363, 362, 362, 362, 363, 363, 363,
+	362, 363, 363, 362, 363, 363, 362, 363,
+	362, 363, 363, 363, 363, 363, 362, 363,
+	362, 362, 363, 363, 363, 362, 362, 362,
+	363, 363, 363, 362, 363, 362, 363, 362,
+	363, 363, 363, 363, 363, 362, 363, 362,
+	415, 416, 417, 418, 419, 362, 363, 362,
+	363, 362, 363, 362, 363, 362, 363, 362,
+	420, 421, 362, 363, 362, 363, 362, 422,
+	423, 424, 425, 426, 427, 428, 429, 430,
+	431, 432, 433, 434, 435, 436, 362, 363,
+	363, 362, 363, 362, 363, 362, 363, 363,
+	363, 363, 363, 362, 363, 363, 362, 362,
+	362, 362, 363, 363, 362, 363, 362, 363,
+	363, 362, 362, 362, 363, 363, 362, 363,
+	363, 363, 362, 363, 363, 363, 363, 362,
+	363, 363, 363, 362, 363, 363, 362, 437,
+	438, 423, 362, 363, 362, 363, 363, 362,
+	439, 440, 441, 442, 443, 444, 445, 446,
+	447, 362, 448, 449, 450, 451, 452, 453,
+	454, 455, 456, 457, 362, 363, 362, 363,
+	362, 363, 362, 363, 363, 363, 363, 363,
+	362, 363, 362, 363, 362, 363, 362, 363,
+	362, 363, 362, 363, 362, 458, 459, 460,
+	461, 462, 463, 464, 465, 466, 467, 468,
+	469, 470, 471, 472, 406, 473, 474, 475,
+	406, 476, 477, 478, 479, 480, 481, 482,
+	483, 484, 485, 486, 487, 488, 489, 490,
+	491, 492, 493, 362, 363, 363, 362, 362,
+	362, 362, 363, 362, 362, 363, 363, 362,
+	363, 363, 362, 363, 363, 362, 363, 363,
+	362, 362, 362, 362, 363, 363, 363, 362,
+	363, 362, 363, 362, 363, 363, 363, 362,
+	363, 363, 363, 363, 363, 363, 363, 362,
+	363, 362, 363, 363, 362, 362, 363, 363,
+	363, 362, 362, 362, 363, 362, 363, 363,
+	362, 363, 363, 362, 363, 362, 363, 363,
+	363, 362, 363, 363, 362, 363, 363, 363,
+	362, 363, 363, 363, 362, 363, 363, 362,
+	363, 362, 363, 363, 362, 363, 363, 362,
+	363, 363, 363, 363, 362, 362, 362, 363,
+	363, 363, 363, 362, 363, 362, 363, 363,
+	363, 363, 362, 363, 362, 494, 362, 363,
+	363, 362, 495, 496, 497, 498, 499, 362,
+	363, 362, 363, 362, 363, 363, 362, 362,
+	362, 363, 363, 363, 362, 500, 362, 363,
+	362, 501, 502, 362, 363, 363, 362, 362,
+	363, 503, 504, 505, 506, 507, 508, 362,
+	363, 363, 363, 362, 362, 362, 362, 363,
+	363, 362, 363, 363, 362, 362, 362, 363,
+	363, 363, 363, 362, 509, 510, 496, 511,
+	512, 512, 513, 514, 362, 363, 363, 363,
+	363, 363, 362, 363, 362, 363, 362, 363,
+	362, 363, 362, 363, 362, 515, 362, 363,
+	362, 516, 362, 517, 518, 519, 521, 520,
+	362, 363, 362, 362, 363, 363, 522, 522,
+	363, 363, 362, 522, 362, 362, 522, 522,
+	362, 522, 522, 362, 522, 522, 522, 362,
+	522, 362, 522, 522, 362, 522, 522, 522,
+	522, 362, 522, 522, 362, 362, 522, 522,
+	362, 522, 522, 362, 523, 524, 525, 526,
+	527, 528, 530, 531, 532, 534, 535, 536,
+	537, 538, 539, 540, 541, 542, 543, 544,
+	545, 546, 547, 548, 549, 550, 551, 529,
+	533, 362, 522, 522, 522, 522, 362, 522,
+	362, 522, 362, 522, 522, 362, 362, 362,
+	522, 362, 362, 362, 522, 522, 522, 522,
+	362, 362, 362, 362, 362, 362, 362, 522,
+	362, 362, 362, 362, 362, 362, 522, 362,
+	362, 362, 362, 362, 522, 522, 522, 522,
+	362, 522, 522, 522, 522, 522, 362, 522,
+	522, 362, 522, 522, 522, 522, 362, 522,
+	522, 522, 362, 362, 362, 362, 362, 362,
+	522, 522, 522, 522, 522, 522, 522, 362,
+	522, 522, 522, 362, 362, 362, 362, 362,
+	362, 522, 522, 362, 522, 522, 522, 522,
+	522, 362, 522, 522, 362, 522, 362, 522,
+	522, 362, 522, 362, 522, 522, 522, 522,
+	522, 362, 522, 362, 522, 522, 522, 522,
+	362, 522, 362, 552, 553, 554, 555, 556,
+	557, 558, 559, 560, 561, 562, 563, 564,
+	565, 566, 567, 568, 569, 570, 571, 572,
+	573, 362, 522, 522, 362, 522, 522, 522,
+	362, 522, 522, 522, 522, 362, 522, 362,
+	522, 522, 362, 522, 522, 362, 522, 362,
+	362, 362, 522, 522, 522, 362, 522, 522,
+	362, 522, 522, 362, 522, 362, 522, 522,
+	522, 522, 522, 362, 522, 362, 362, 522,
+	522, 522, 362, 362, 362, 522, 522, 522,
+	362, 522, 362, 522, 362, 522, 522, 522,
+	522, 522, 362, 522, 362, 574, 575, 576,
+	577, 578, 362, 522, 579, 362, 522, 522,
+	362, 580, 581, 575, 582, 583, 584, 585,
+	586, 587, 588, 589, 590, 573, 591, 592,
+	593, 594, 595, 596, 597, 598, 576, 577,
+	578, 362, 522, 579, 522, 362, 522, 362,
+	522, 362, 522, 522, 362, 522, 522, 362,
+	522, 522, 362, 522, 362, 522, 522, 522,
+	362, 522, 362, 522, 522, 362, 522, 522,
+	362, 522, 522, 522, 362, 522, 522, 362,
+	522, 362, 362, 362, 362, 362, 362, 362,
+	362, 522, 522, 522, 522, 522, 522, 522,
+	522, 362, 522, 522, 522, 522, 362, 522,
+	362, 522, 522, 362, 522, 522, 362, 522,
+	362, 522, 362, 522, 362, 599, 600, 601,
+	362, 522, 522, 362, 522, 362, 522, 522,
+	362, 602, 603, 604, 605, 606, 607, 608,
+	609, 610, 611, 612, 613, 614, 615, 616,
+	362, 522, 522, 362, 522, 362, 522, 362,
+	522, 522, 522, 522, 522, 362, 522, 522,
+	362, 362, 362, 362, 522, 522, 362, 522,
+	362, 522, 522, 362, 362, 362, 522, 522,
+	362, 522, 522, 522, 362, 522, 522, 522,
+	522, 362, 522, 522, 522, 362, 522, 522,
+	362, 617, 618, 603, 362, 522, 362, 522,
+	522, 362, 619, 620, 621, 622, 623, 624,
+	625, 626, 627, 362, 628, 629, 630, 631,
+	632, 633, 634, 635, 636, 637, 362, 522,
+	362, 522, 362, 522, 362, 522, 522, 522,
+	522, 522, 362, 522, 362, 522, 362, 522,
+	362, 522, 362, 522, 362, 522, 362, 638,
+	639, 640, 587, 641, 642, 643, 644, 645,
+	646, 647, 648, 649, 650, 651, 565, 652,
+	653, 654, 565, 655, 656, 657, 658, 659,
+	660, 661, 662, 663, 664, 665, 666, 667,
+	668, 669, 670, 671, 672, 362, 522, 522,
+	362, 362, 362, 362, 522, 362, 362, 522,
+	522, 522, 362, 522, 522, 362, 522, 522,
+	362, 362, 362, 362, 522, 522, 522, 362,
+	522, 362, 522, 362, 522, 522, 522, 362,
+	522, 522, 522, 522, 522, 522, 522, 362,
+	522, 362, 522, 522, 362, 362, 522, 522,
+	522, 362, 362, 362, 522, 362, 522, 522,
+	362, 522, 522, 362, 522, 362, 522, 522,
+	522, 362, 522, 522, 362, 522, 522, 522,
+	362, 522, 522, 522, 362, 522, 522, 362,
+	522, 362, 522, 522, 362, 522, 522, 362,
+	522, 522, 522, 522, 362, 362, 362, 522,
+	522, 522, 522, 362, 522, 362, 522, 522,
+	522, 522, 362, 522, 362, 673, 362, 522,
+	522, 362, 674, 675, 676, 677, 678, 362,
+	522, 362, 522, 362, 522, 522, 362, 362,
+	362, 522, 522, 522, 362, 679, 362, 522,
+	362, 680, 681, 362, 522, 522, 362, 362,
+	522, 682, 683, 684, 685, 686, 687, 362,
+	522, 522, 522, 362, 362, 362, 362, 522,
+	522, 362, 522, 522, 362, 362, 362, 522,
+	522, 522, 522, 362, 688, 689, 675, 690,
+	691, 691, 692, 693, 362, 522, 522, 522,
+	522, 522, 362, 522, 362, 522, 362, 522,
+	362, 522, 362, 522, 362, 694, 695, 696,
+	697, 698, 699, 700, 701, 695, 694, 695,
+	694, 695, 573, 694, 702, 703, 695, 694,
+	704, 705, 706, 707, 708, 709, 695, 710,
+	711, 694, 695, 694, 702, 592, 573, 573,
+	592, 362, 362, 522, 522, 522, 362, 522,
+	522, 362, 522, 522, 522, 362, 362, 522,
+	522, 522, 522, 522, 522, 362, 522, 362,
+	362, 522, 522, 362, 362, 522, 522, 362,
+	522, 362, 522, 362, 522, 522, 362, 522,
+	522, 362, 522, 522, 362, 522, 522, 362,
+	712, 362, 713, 695, 694, 714, 592, 362,
+	522, 362, 715, 600, 362, 522, 362, 619,
+	620, 621, 622, 623, 624, 625, 626, 716,
+	362, 717, 362, 522, 362, 361, 363, 363,
+	362, 361, 363, 362, 361, 363, 362, 718,
+	719, 720, 414, 362, 363, 361, 363, 362,
+	361, 363, 362, 361, 363, 362, 721, 722,
+	723, 724, 725, 414, 362, 726, 362, 552,
+	553, 554, 721, 722, 727, 555, 556, 557,
+	558, 559, 560, 561, 562, 563, 564, 565,
+	566, 567, 568, 569, 570, 571, 572, 573,
+	362, 728, 726, 552, 553, 554, 729, 723,
+	724, 555, 556, 557, 558, 559, 560, 561,
+	562, 563, 564, 565, 566, 567, 568, 569,
+	570, 571, 572, 573, 362, 728, 362, 730,
+	728, 552, 553, 554, 731, 724, 555, 556,
+	557, 558, 559, 560, 561, 562, 563, 564,
+	565, 566, 567, 568, 569, 570, 571, 572,
+	573, 362, 730, 362, 362, 730, 732, 362,
+	730, 362, 733, 734, 362, 728, 362, 362,
+	730, 362, 728, 362, 728, 602, 603, 604,
+	605, 606, 607, 608, 735, 610, 611, 612,
+	613, 614, 615, 616, 737, 738, 739, 740,
+	741, 742, 737, 738, 739, 740, 741, 742,
+	737, 736, 743, 362, 522, 726, 362, 744,
+	744, 744, 730, 362, 552, 553, 554, 729,
+	727, 555, 556, 557, 558, 559, 560, 561,
+	562, 563, 564, 565, 566, 567, 568, 569,
+	570, 571, 572, 573, 362, 733, 745, 362,
+	362, 728, 744, 744, 730, 744, 744, 730,
+	744, 744, 744, 730, 744, 744, 730, 744,
+	744, 730, 744, 744, 362, 730, 730, 739,
+	740, 741, 742, 736, 737, 739, 740, 741,
+	742, 736, 737, 739, 740, 741, 742, 736,
+	737, 739, 740, 741, 742, 736, 737, 739,
+	740, 741, 742, 736, 737, 739, 740, 741,
+	742, 736, 737, 739, 740, 741, 742, 736,
+	737, 739, 740, 741, 742, 736, 737, 739,
+	740, 741, 742, 736, 737, 738, 743, 740,
+	741, 742, 736, 737, 738, 740, 741, 742,
+	736, 737, 738, 740, 741, 742, 736, 737,
+	738, 740, 741, 742, 736, 737, 738, 740,
+	741, 742, 736, 737, 738, 740, 741, 742,
+	736, 737, 738, 740, 741, 742, 736, 737,
+	738, 740, 741, 742, 736, 737, 738, 740,
+	741, 742, 736, 737, 738, 739, 743, 741,
+	742, 736, 737, 738, 739, 741, 742, 736,
+	737, 738, 739, 741, 742, 736, 737, 738,
+	739, 741, 742, 736, 737, 738, 739, 741,
+	746, 745, 740, 362, 743, 744, 362, 728,
+	730, 363, 363, 362, 747, 748, 749, 750,
+	751, 752, 753, 754, 755, 756, 757, 573,
+	758, 592, 759, 760, 761, 762, 763, 764,
+	414, 362, 522, 363, 363, 363, 363, 362,
+	522, 363, 363, 362, 522, 522, 363, 362,
+	363, 522, 363, 522, 363, 362, 522, 363,
+	522, 363, 362, 522, 363, 362, 522, 363,
+	522, 363, 522, 363, 362, 522, 363, 362,
+	522, 363, 522, 363, 362, 522, 363, 363,
+	522, 362, 363, 363, 522, 362, 522, 363,
+	522, 362, 363, 363, 363, 363, 363, 363,
+	363, 363, 362, 522, 522, 522, 522, 522,
+	363, 363, 522, 363, 522, 363, 362, 522,
+	522, 522, 363, 522, 363, 362, 363, 522,
+	363, 362, 363, 522, 363, 522, 363, 362,
+	522, 522, 363, 362, 765, 766, 414, 362,
+	522, 522, 363, 362, 522, 522, 363, 362,
+	414, 362, 767, 769, 770, 771, 772, 773,
+	774, 769, 770, 771, 772, 773, 774, 769,
+	414, 768, 743, 362, 363, 726, 363, 362,
+	728, 728, 728, 730, 362, 728, 728, 730,
+	728, 728, 730, 728, 728, 728, 730, 728,
+	728, 730, 728, 728, 730, 728, 728, 362,
+	730, 771, 772, 773, 774, 768, 769, 771,
+	772, 773, 774, 768, 769, 771, 772, 773,
+	774, 768, 769, 771, 772, 773, 774, 768,
+	769, 771, 772, 773, 774, 768, 769, 771,
+	772, 773, 774, 768, 769, 771, 772, 773,
+	774, 768, 769, 771, 772, 773, 774, 768,
+	769, 771, 772, 773, 774, 768, 769, 770,
+	743, 772, 773, 774, 768, 769, 770, 772,
+	773, 774, 768, 769, 770, 772, 773, 774,
+	768, 769, 770, 772, 773, 774, 768, 769,
+	770, 772, 773, 774, 768, 769, 770, 772,
+	773, 774, 768, 769, 770, 772, 773, 774,
+	768, 769, 770, 772, 773, 774, 768, 769,
+	770, 772, 773, 774, 768, 769, 770, 771,
+	743, 773, 774, 768, 769, 770, 771, 773,
+	774, 768, 769, 770, 771, 773, 774, 768,
+	769, 770, 771, 773, 774, 768, 769, 770,
+	771, 773, 775, 776, 772, 414, 362, 743,
+	728, 363, 728, 730, 363, 730, 363, 362,
+	728, 777, 778, 414, 362, 363, 362, 363,
+	363, 363, 362, 780, 781, 782, 783, 784,
+	779, 362, 785, 786, 787, 788, 789, 790,
+	791, 792, 793, 414, 362, 361, 363, 362,
+	361, 363, 362, 363, 361, 363, 362, 361,
+	363, 362, 361, 363, 362, 361, 363, 362,
+	363, 361, 363, 362, 361, 363, 362, 361,
+	363, 362, 794, 414, 362, 363, 362, 795,
+	414, 362, 363, 363, 362, 796, 414, 362,
+	363, 363, 362, 694, 695, 797, 798, 799,
+	800, 801, 802, 695, 694, 695, 694, 803,
+	573, 694, 804, 805, 695, 694, 806, 414,
+	807, 414, 808, 809, 810, 811, 695, 812,
+	813, 694, 695, 694, 804, 592, 573, 414,
+	592, 362, 522, 363, 522, 363, 362, 363,
+	522, 363, 522, 362, 522, 363, 522, 363,
+	522, 362, 814, 362, 522, 619, 620, 621,
+	622, 623, 624, 625, 626, 815, 362, 816,
+	717, 362, 522, 362, 363, 522, 522, 363,
+	522, 363, 522, 362, 363, 522, 362, 363,
+	362, 522, 363, 362, 522, 363, 522, 362,
+	363, 362, 522, 363, 522, 362, 363, 522,
+	362, 363, 522, 363, 362, 363, 522, 363,
+	522, 363, 362, 363, 522, 363, 522, 362,
+	363, 363, 522, 362, 363, 522, 362, 779,
+	362, 817, 779, 362, 419, 414, 794, 414,
+	362, 361, 3, 1, 361, 3, 1, 818,
+	819, 820, 54, 1, 3, 361, 3, 1,
+	361, 3, 1, 361, 3, 1, 821, 822,
+	823, 824, 825, 54, 1, 55, 826, 828,
+	827, 827, 828, 828, 827, 828, 828, 827,
+	828, 828, 828, 827, 828, 827, 828, 828,
+	827, 828, 828, 828, 828, 827, 828, 828,
+	827, 827, 828, 828, 827, 828, 828, 827,
+	829, 830, 831, 832, 833, 834, 836, 837,
+	838, 840, 841, 842, 843, 844, 845, 846,
+	847, 848, 849, 850, 851, 852, 853, 854,
+	855, 856, 857, 835, 839, 827, 828, 828,
+	828, 828, 827, 828, 827, 828, 827, 828,
+	828, 827, 827, 827, 828, 827, 827, 827,
+	828, 828, 828, 828, 827, 827, 827, 827,
+	827, 827, 827, 828, 827, 827, 827, 827,
+	827, 827, 828, 827, 827, 827, 827, 827,
+	828, 828, 828, 828, 827, 828, 828, 828,
+	828, 828, 827, 828, 828, 827, 828, 828,
+	828, 828, 827, 828, 828, 828, 827, 827,
+	827, 827, 827, 827, 828, 828, 828, 828,
+	828, 828, 828, 827, 828, 828, 828, 827,
+	827, 827, 827, 827, 827, 828, 828, 827,
+	828, 828, 828, 828, 828, 827, 828, 828,
+	827, 828, 827, 828, 828, 827, 828, 827,
+	828, 828, 828, 828, 828, 827, 828, 827,
+	828, 828, 828, 828, 827, 828, 827, 858,
+	859, 860, 861, 862, 863, 864, 865, 866,
+	867, 868, 869, 870, 871, 872, 873, 874,
+	875, 876, 877, 878, 879, 827, 828, 828,
+	827, 828, 828, 828, 827, 828, 828, 828,
+	828, 827, 828, 827, 828, 828, 827, 828,
+	828, 827, 828, 827, 827, 827, 828, 828,
+	828, 827, 828, 828, 827, 828, 828, 827,
+	828, 827, 828, 828, 828, 828, 828, 827,
+	828, 827, 827, 828, 828, 828, 827, 827,
+	827, 828, 828, 828, 827, 828, 827, 828,
+	827, 828, 828, 828, 828, 828, 827, 828,
+	827, 880, 881, 882, 883, 884, 827, 828,
+	885, 827, 828, 828, 827, 886, 887, 881,
+	888, 889, 890, 891, 892, 893, 894, 895,
+	896, 879, 897, 898, 899, 900, 901, 902,
+	903, 904, 882, 883, 884, 827, 828, 885,
+	828, 827, 828, 827, 828, 827, 828, 828,
+	827, 828, 828, 827, 828, 828, 827, 828,
+	827, 828, 828, 828, 827, 828, 827, 828,
+	828, 827, 828, 828, 827, 828, 828, 828,
+	827, 828, 828, 827, 828, 827, 827, 827,
+	827, 827, 827, 827, 827, 828, 828, 828,
+	828, 828, 828, 828, 828, 827, 828, 828,
+	828, 828, 827, 828, 827, 828, 828, 827,
+	828, 828, 827, 828, 827, 828, 827, 828,
+	827, 905, 906, 907, 827, 828, 828, 827,
+	828, 827, 828, 828, 827, 908, 909, 910,
+	911, 912, 913, 914, 915, 916, 917, 918,
+	919, 920, 921, 922, 827, 828, 828, 827,
+	828, 827, 828, 827, 828, 828, 828, 828,
+	828, 827, 828, 828, 827, 827, 827, 827,
+	828, 828, 827, 828, 827, 828, 828, 827,
+	827, 827, 828, 828, 827, 828, 828, 828,
+	827, 828, 828, 828, 828, 827, 828, 828,
+	828, 827, 828, 828, 827, 923, 924, 909,
+	827, 828, 827, 828, 828, 827, 925, 926,
+	927, 928, 929, 930, 931, 932, 933, 827,
+	934, 935, 936, 937, 938, 939, 940, 941,
+	942, 943, 827, 828, 827, 828, 827, 828,
+	827, 828, 828, 828, 828, 828, 827, 828,
+	827, 828, 827, 828, 827, 828, 827, 828,
+	827, 828, 827, 944, 945, 946, 893, 947,
+	948, 949, 950, 951, 952, 953, 954, 955,
+	956, 957, 871, 958, 959, 960, 871, 961,
+	962, 963, 964, 965, 966, 967, 968, 969,
+	970, 971, 972, 973, 974, 975, 976, 977,
+	978, 827, 828, 828, 827, 827, 827, 827,
+	828, 827, 827, 828, 828, 828, 827, 828,
+	828, 827, 828, 828, 827, 827, 827, 827,
+	828, 828, 828, 827, 828, 827, 828, 827,
+	828, 828, 828, 827, 828, 828, 828, 828,
+	828, 828, 828, 827, 828, 827, 828, 828,
+	827, 827, 828, 828, 828, 827, 827, 827,
+	828, 827, 828, 828, 827, 828, 828, 827,
+	828, 827, 828, 828, 828, 827, 828, 828,
+	827, 828, 828, 828, 827, 828, 828, 828,
+	827, 828, 828, 827, 828, 827, 828, 828,
+	827, 828, 828, 827, 828, 828, 828, 828,
+	827, 827, 827, 828, 828, 828, 828, 827,
+	828, 827, 828, 828, 828, 828, 827, 828,
+	827, 979, 827, 828, 828, 827, 980, 981,
+	982, 983, 984, 827, 828, 827, 828, 827,
+	828, 828, 827, 827, 827, 828, 828, 828,
+	827, 985, 827, 828, 827, 986, 987, 827,
+	828, 828, 827, 827, 828, 988, 989, 990,
+	991, 992, 993, 827, 828, 828, 828, 827,
+	827, 827, 827, 828, 828, 827, 828, 828,
+	827, 827, 827, 828, 828, 828, 828, 827,
+	994, 995, 981, 996, 997, 997, 998, 999,
+	827, 828, 828, 828, 828, 828, 827, 828,
+	827, 828, 827, 828, 827, 828, 827, 828,
+	827, 1000, 1001, 1002, 1003, 1004, 1005, 1006,
+	1007, 1001, 1000, 1001, 1000, 1001, 879, 1000,
+	1008, 1009, 1001, 1000, 1010, 1011, 1012, 1013,
+	1014, 1015, 1001, 1016, 1017, 1000, 1001, 1000,
+	1008, 898, 879, 879, 898, 827, 827, 828,
+	828, 828, 827, 828, 828, 827, 828, 828,
+	828, 827, 827, 828, 828, 828, 828, 828,
+	828, 827, 828, 827, 827, 828, 828, 827,
+	827, 828, 828, 827, 828, 827, 828, 827,
+	828, 828, 827, 828, 828, 827, 828, 828,
+	827, 828, 828, 827, 1018, 827, 1019, 1001,
+	1000, 1020, 898, 827, 828, 827, 1021, 906,
+	827, 828, 827, 925, 926, 927, 928, 929,
+	930, 931, 932, 1022, 827, 1023, 827, 828,
+	827, 858, 859, 860, 821, 822, 1024, 861,
+	862, 863, 864, 865, 866, 867, 868, 869,
+	870, 871, 872, 873, 874, 875, 876, 877,
+	878, 879, 827, 1025, 826, 858, 859, 860,
+	1026, 823, 824, 861, 862, 863, 864, 865,
+	866, 867, 868, 869, 870, 871, 872, 873,
+	874, 875, 876, 877, 878, 879, 827, 1025,
+	827, 1027, 1025, 858, 859, 860, 1028, 824,
+	861, 862, 863, 864, 865, 866, 867, 868,
+	869, 870, 871, 872, 873, 874, 875, 876,
+	877, 878, 879, 827, 1027, 827, 55, 1027,
+	1029, 827, 1027, 827, 1030, 1031, 827, 1025,
+	827, 827, 1027, 827, 1025, 827, 1025, 908,
+	909, 910, 911, 912, 913, 914, 1032, 916,
+	917, 918, 919, 920, 921, 922, 1034, 1035,
+	1036, 1037, 1038, 1039, 1034, 1035, 1036, 1037,
+	1038, 1039, 1034, 1033, 1040, 827, 828, 826,
+	827, 1041, 1041, 1041, 1027, 827, 858, 859,
+	860, 1026, 1024, 861, 862, 863, 864, 865,
+	866, 867, 868, 869, 870, 871, 872, 873,
+	874, 875, 876, 877, 878, 879, 827, 1030,
+	1042, 827, 827, 1025, 1041, 1041, 1027, 1041,
+	1041, 1027, 1041, 1041, 1041, 1027, 1041, 1041,
+	1027, 1041, 1041, 1027, 1041, 1041, 827, 1027,
+	1027, 1036, 1037, 1038, 1039, 1033, 1034, 1036,
+	1037, 1038, 1039, 1033, 1034, 1036, 1037, 1038,
+	1039, 1033, 1034, 1036, 1037, 1038, 1039, 1033,
+	1034, 1036, 1037, 1038, 1039, 1033, 1034, 1036,
+	1037, 1038, 1039, 1033, 1034, 1036, 1037, 1038,
+	1039, 1033, 1034, 1036, 1037, 1038, 1039, 1033,
+	1034, 1036, 1037, 1038, 1039, 1033, 1034, 1035,
+	1040, 1037, 1038, 1039, 1033, 1034, 1035, 1037,
+	1038, 1039, 1033, 1034, 1035, 1037, 1038, 1039,
+	1033, 1034, 1035, 1037, 1038, 1039, 1033, 1034,
+	1035, 1037, 1038, 1039, 1033, 1034, 1035, 1037,
+	1038, 1039, 1033, 1034, 1035, 1037, 1038, 1039,
+	1033, 1034, 1035, 1037, 1038, 1039, 1033, 1034,
+	1035, 1037, 1038, 1039, 1033, 1034, 1035, 1036,
+	1040, 1038, 1039, 1033, 1034, 1035, 1036, 1038,
+	1039, 1033, 1034, 1035, 1036, 1038, 1039, 1033,
+	1034, 1035, 1036, 1038, 1039, 1033, 1034, 1035,
+	1036, 1038, 1043, 1042, 1037, 827, 1040, 1041,
+	827, 1025, 1027, 163, 3, 1, 1044, 1045,
+	1046, 1047, 1048, 1049, 1050, 1051, 1052, 1053,
+	1054, 216, 1055, 235, 1056, 1057, 1058, 1059,
+	1060, 1061, 54, 1, 163, 1062, 164, 3,
+	163, 3, 163, 3, 1, 1062, 1063, 1063,
+	1062, 1062, 1063, 1062, 1062, 1063, 1062, 1062,
+	1062, 1063, 1062, 1063, 1062, 1062, 1063, 1062,
+	1062, 1062, 1062, 1063, 1062, 1062, 1063, 1063,
+	1062, 1062, 1063, 1062, 1062, 1063, 1064, 1065,
+	1066, 1067, 1068, 1069, 1071, 1072, 1073, 1075,
+	1076, 1077, 1078, 1079, 1080, 1081, 1082, 1083,
+	1084, 1085, 1086, 1087, 1088, 1089, 1090, 1091,
+	1092, 1070, 1074, 1063, 1062, 1062, 1062, 1062,
+	1063, 1062, 1063, 1062, 1063, 1062, 1062, 1063,
+	1063, 1063, 1062, 1063, 1063, 1063, 1062, 1062,
+	1062, 1062, 1063, 1063, 1063, 1063, 1063, 1063,
+	1063, 1062, 1063, 1063, 1063, 1063, 1063, 1063,
+	1062, 1063, 1063, 1063, 1063, 1063, 1062, 1062,
+	1062, 1062, 1063, 1062, 1062, 1062, 1062, 1062,
+	1063, 1062, 1062, 1063, 1062, 1062, 1062, 1062,
+	1063, 1062, 1062, 1062, 1063, 1063, 1063, 1063,
+	1063, 1063, 1062, 1062, 1062, 1062, 1062, 1062,
+	1062, 1063, 1062, 1062, 1062, 1063, 1063, 1063,
+	1063, 1063, 1063, 1062, 1062, 1063, 1062, 1062,
+	1062, 1062, 1062, 1063, 1062, 1062, 1063, 1062,
+	1063, 1062, 1062, 1063, 1062, 1063, 1062, 1062,
+	1062, 1062, 1062, 1063, 1062, 1063, 1062, 1062,
+	1062, 1062, 1063, 1062, 1063, 1093, 1094, 1095,
+	1096, 1097, 1098, 1099, 1100, 1101, 1102, 1103,
+	1104, 1105, 1106, 1107, 1108, 1109, 1110, 1111,
+	1112, 1113, 1114, 1063, 1062, 1062, 1063, 1062,
+	1062, 1062, 1063, 1062, 1062, 1062, 1062, 1063,
+	1062, 1063, 1062, 1062, 1063, 1062, 1062, 1063,
+	1062, 1063, 1063, 1063, 1062, 1062, 1062, 1063,
+	1062, 1062, 1063, 1062, 1062, 1063, 1062, 1063,
+	1062, 1062, 1062, 1062, 1062, 1063, 1062, 1063,
+	1063, 1062, 1062, 1062, 1063, 1063, 1063, 1062,
+	1062, 1062, 1063, 1062, 1063, 1062, 1063, 1062,
+	1062, 1062, 1062, 1062, 1063, 1062, 1063, 1115,
+	1116, 1117, 1118, 1119, 1063, 1062, 1063, 1062,
+	1063, 1062, 1063, 1062, 1063, 1062, 1063, 1120,
+	1121, 1063, 1062, 1063, 1062, 1063, 1122, 1123,
+	1124, 1125, 1126, 1127, 1128, 1129, 1130, 1131,
+	1132, 1133, 1134, 1135, 1136, 1063, 1062, 1062,
+	1063, 1062, 1063, 1062, 1063, 1062, 1062, 1062,
+	1062, 1062, 1063, 1062, 1062, 1063, 1063, 1063,
+	1063, 1062, 1062, 1063, 1062, 1063, 1062, 1062,
+	1063, 1063, 1063, 1062, 1062, 1063, 1062, 1062,
+	1062, 1063, 1062, 1062, 1062, 1062, 1063, 1062,
+	1062, 1062, 1063, 1062, 1062, 1063, 1137, 1138,
+	1123, 1063, 1062, 1063, 1062, 1062, 1063, 1139,
+	1140, 1141, 1142, 1143, 1144, 1145, 1146, 1147,
+	1063, 1148, 1149, 1150, 1151, 1152, 1153, 1154,
+	1155, 1156, 1157, 1063, 1062, 1063, 1062, 1063,
+	1062, 1063, 1062, 1062, 1062, 1062, 1062, 1063,
+	1062, 1063, 1062, 1063, 1062, 1063, 1062, 1063,
+	1062, 1063, 1062, 1063, 1158, 1159, 1160, 1161,
+	1162, 1163, 1164, 1165, 1166, 1167, 1168, 1169,
+	1170, 1171, 1172, 1106, 1173, 1174, 1175, 1106,
+	1176, 1177, 1178, 1179, 1180, 1181, 1182, 1183,
+	1184, 1185, 1186, 1187, 1188, 1189, 1190, 1191,
+	1192, 1193, 1063, 1062, 1062, 1063, 1063, 1063,
+	1063, 1062, 1063, 1063, 1062, 1062, 1063, 1062,
+	1062, 1063, 1062, 1062, 1063, 1062, 1062, 1063,
+	1063, 1063, 1063, 1062, 1062, 1062, 1063, 1062,
+	1063, 1062, 1063, 1062, 1062, 1062, 1063, 1062,
+	1062, 1062, 1062, 1062, 1062, 1062, 1063, 1062,
+	1063, 1062, 1062, 1063, 1063, 1062, 1062, 1062,
+	1063, 1063, 1063, 1062, 1063, 1062, 1062, 1063,
+	1062, 1062, 1063, 1062, 1063, 1062, 1062, 1062,
+	1063, 1062, 1062, 1063, 1062, 1062, 1062, 1063,
+	1062, 1062, 1062, 1063, 1062, 1062, 1063, 1062,
+	1063, 1062, 1062, 1063, 1062, 1062, 1063, 1062,
+	1062, 1062, 1062, 1063, 1063, 1063, 1062, 1062,
+	1062, 1062, 1063, 1062, 1063, 1062, 1062, 1062,
+	1062, 1063, 1062, 1063, 1194, 1063, 1062, 1062,
+	1063, 1195, 1196, 1197, 1198, 1199, 1063, 1062,
+	1063, 1062, 1063, 1062, 1062, 1063, 1063, 1063,
+	1062, 1062, 1062, 1063, 1200, 1063, 1062, 1063,
+	1201, 1202, 1063, 1062, 1062, 1063, 1063, 1062,
+	1203, 1204, 1205, 1206, 1207, 1208, 1063, 1062,
+	1062, 1062, 1063, 1063, 1063, 1063, 1062, 1062,
+	1063, 1062, 1062, 1063, 1063, 1063, 1062, 1062,
+	1062, 1062, 1063, 1209, 1210, 1196, 1211, 1212,
+	1212, 1213, 1214, 1063, 1062, 1062, 1062, 1062,
+	1062, 1063, 1062, 1063, 1062, 1063, 1062, 1063,
+	1062, 1063, 1062, 1063, 1215, 1063, 1062, 1063,
+	1216, 1063, 1217, 1218, 1219, 1221, 1220, 1063,
+	1062, 1063, 1063, 1062, 1062, 164, 3, 163,
+	3, 1, 164, 164, 3, 1, 3, 164,
+	3, 164, 3, 1, 164, 3, 164, 3,
+	1, 164, 3, 1, 164, 3, 164, 3,
+	164, 3, 1, 164, 3, 1, 164, 3,
+	164, 3, 1, 164, 3, 3, 164, 1,
+	3, 3, 164, 1, 164, 3, 164, 1,
+	3, 3, 3, 3, 3, 3, 3, 3,
+	1, 164, 164, 164, 164, 164, 3, 3,
+	164, 3, 164, 3, 1, 164, 164, 164,
+	3, 164, 3, 1, 3, 164, 3, 1,
+	3, 164, 3, 164, 3, 1, 164, 164,
+	3, 1, 1222, 1223, 54, 1, 164, 164,
+	3, 1, 164, 164, 3, 1, 54, 1,
+	1224, 1226, 1227, 1228, 1229, 1230, 1231, 1226,
+	1227, 1228, 1229, 1230, 1231, 1226, 54, 1225,
+	1040, 1, 3, 826, 3, 1, 1025, 1025,
+	1025, 1027, 1, 1025, 1025, 1027, 1025, 1025,
+	1027, 1025, 1025, 1025, 1027, 1025, 1025, 1027,
+	1025, 1025, 1027, 1025, 1025, 1, 1027, 1228,
+	1229, 1230, 1231, 1225, 1226, 1228, 1229, 1230,
+	1231, 1225, 1226, 1228, 1229, 1230, 1231, 1225,
+	1226, 1228, 1229, 1230, 1231, 1225, 1226, 1228,
+	1229, 1230, 1231, 1225, 1226, 1228, 1229, 1230,
+	1231, 1225, 1226, 1228, 1229, 1230, 1231, 1225,
+	1226, 1228, 1229, 1230, 1231, 1225, 1226, 1228,
+	1229, 1230, 1231, 1225, 1226, 1227, 1040, 1229,
+	1230, 1231, 1225, 1226, 1227, 1229, 1230, 1231,
+	1225, 1226, 1227, 1229, 1230, 1231, 1225, 1226,
+	1227, 1229, 1230, 1231, 1225, 1226, 1227, 1229,
+	1230, 1231, 1225, 1226, 1227, 1229, 1230, 1231,
+	1225, 1226, 1227, 1229, 1230, 1231, 1225, 1226,
+	1227, 1229, 1230, 1231, 1225, 1226, 1227, 1229,
+	1230, 1231, 1225, 1226, 1227, 1228, 1040, 1230,
+	1231, 1225, 1226, 1227, 1228, 1230, 1231, 1225,
+	1226, 1227, 1228, 1230, 1231, 1225, 1226, 1227,
+	1228, 1230, 1231, 1225, 1226, 1227, 1228, 1230,
+	1232, 1233, 1229, 54, 1, 1040, 1025, 3,
+	1025, 1027, 3, 1027, 3, 1, 1025, 1234,
+	1235, 54, 1, 163, 3, 1, 3, 3,
+	163, 3, 1, 1237, 1238, 1239, 1240, 1241,
+	1236, 1, 1242, 1243, 1244, 1245, 1246, 1247,
+	1248, 1249, 1250, 54, 1, 361, 3, 1,
+	361, 3, 1, 3, 361, 3, 1, 361,
+	3, 1, 361, 3, 1, 361, 3, 1,
+	3, 361, 3, 1, 361, 3, 1, 361,
+	3, 1, 1251, 54, 1, 3, 163, 1,
+	1252, 54, 1, 3, 163, 3, 1, 1253,
+	54, 1, 3, 163, 3, 1, 337, 338,
+	1254, 1255, 1256, 1257, 1258, 1259, 338, 337,
+	338, 337, 1260, 216, 337, 1261, 1262, 338,
+	337, 1263, 54, 1264, 54, 1265, 1266, 1267,
+	1268, 338, 1269, 1270, 337, 338, 337, 1261,
+	235, 216, 54, 235, 1, 164, 3, 164,
+	3, 1, 3, 164, 3, 164, 1, 164,
+	3, 164, 3, 164, 1, 1271, 1, 164,
+	1273, 1272, 1272, 1273, 1273, 1272, 1273, 1273,
+	1272, 1273, 1273, 1273, 1272, 1273, 1272, 1273,
+	1273, 1272, 1273, 1273, 1273, 1273, 1272, 1273,
+	1273, 1272, 1272, 1273, 1273, 1272, 1273, 1273,
+	1272, 1274, 1275, 1276, 1277, 1278, 1279, 1281,
+	1282, 1283, 1285, 1286, 1287, 1288, 1289, 1290,
+	1291, 1292, 1293, 1294, 1295, 1296, 1297, 1298,
+	1299, 1300, 1301, 1302, 1280, 1284, 1272, 1273,
+	1273, 1273, 1273, 1272, 1273, 1272, 1273, 1272,
+	1273, 1273, 1272, 1272, 1272, 1273, 1272, 1272,
+	1272, 1273, 1273, 1273, 1273, 1272, 1272, 1272,
+	1272, 1272, 1272, 1272, 1273, 1272, 1272, 1272,
+	1272, 1272, 1272, 1273, 1272, 1272, 1272, 1272,
+	1272, 1273, 1273, 1273, 1273, 1272, 1273, 1273,
+	1273, 1273, 1273, 1272, 1273, 1273, 1272, 1273,
+	1273, 1273, 1273, 1272, 1273, 1273, 1273, 1272,
+	1272, 1272, 1272, 1272, 1272, 1273, 1273, 1273,
+	1273, 1273, 1273, 1273, 1272, 1273, 1273, 1273,
+	1272, 1272, 1272, 1272, 1272, 1272, 1273, 1273,
+	1272, 1273, 1273, 1273, 1273, 1273, 1272, 1273,
+	1273, 1272, 1273, 1272, 1273, 1273, 1272, 1273,
+	1272, 1273, 1273, 1273, 1273, 1273, 1272, 1273,
+	1272, 1273, 1273, 1273, 1273, 1272, 1273, 1272,
+	1303, 1304, 1305, 1306, 1307, 1308, 1309, 1310,
+	1311, 1312, 1313, 1314, 1315, 1316, 1317, 1318,
+	1319, 1320, 1321, 1322, 1323, 1324, 1272, 1273,
+	1273, 1272, 1273, 1273, 1273, 1272, 1273, 1273,
+	1273, 1273, 1272, 1273, 1272, 1273, 1273, 1272,
+	1273, 1273, 1272, 1273, 1272, 1272, 1272, 1273,
+	1273, 1273, 1272, 1273, 1273, 1272, 1273, 1273,
+	1272, 1273, 1272, 1273, 1273, 1273, 1273, 1273,
+	1272, 1273, 1272, 1272, 1273, 1273, 1273, 1272,
+	1272, 1272, 1273, 1273, 1273, 1272, 1273, 1272,
+	1273, 1272, 1273, 1273, 1273, 1273, 1273, 1272,
+	1273, 1272, 1325, 1326, 1327, 1328, 1329, 1272,
+	1273, 1330, 1272, 1273, 1273, 1272, 1331, 1332,
+	1326, 1333, 1334, 1335, 1336, 1337, 1338, 1339,
+	1340, 1341, 1324, 1342, 1343, 1344, 1345, 1346,
+	1347, 1348, 1349, 1327, 1328, 1329, 1272, 1273,
+	1330, 1273, 1272, 1273, 1272, 1273, 1272, 1273,
+	1273, 1272, 1273, 1273, 1272, 1273, 1273, 1272,
+	1273, 1272, 1273, 1273, 1273, 1272, 1273, 1272,
+	1273, 1273, 1272, 1273, 1273, 1272, 1273, 1273,
+	1273, 1272, 1273, 1273, 1272, 1273, 1272, 1272,
+	1272, 1272, 1272, 1272, 1272, 1272, 1273, 1273,
+	1273, 1273, 1273, 1273, 1273, 1273, 1272, 1273,
+	1273, 1273, 1273, 1272, 1273, 1272, 1273, 1273,
+	1272, 1273, 1273, 1272, 1273, 1272, 1273, 1272,
+	1273, 1272, 1350, 1351, 1352, 1272, 1273, 1273,
+	1272, 1273, 1272, 1273, 1273, 1272, 1353, 1354,
+	1355, 1356, 1357, 1358, 1359, 1360, 1361, 1362,
+	1363, 1364, 1365, 1366, 1367, 1272, 1273, 1273,
+	1272, 1273, 1272, 1273, 1272, 1273, 1273, 1273,
+	1273, 1273, 1272, 1273, 1273, 1272, 1272, 1272,
+	1272, 1273, 1273, 1272, 1273, 1272, 1273, 1273,
+	1272, 1272, 1272, 1273, 1273, 1272, 1273, 1273,
+	1273, 1272, 1273, 1273, 1273, 1273, 1272, 1273,
+	1273, 1273, 1272, 1273, 1273, 1272, 1368, 1369,
+	1354, 1272, 1273, 1272, 1273, 1273, 1272, 1370,
+	1371, 1372, 1373, 1374, 1375, 1376, 1377, 1378,
+	1272, 1379, 1380, 1381, 1382, 1383, 1384, 1385,
+	1386, 1387, 1388, 1272, 1273, 1272, 1273, 1272,
+	1273, 1272, 1273, 1273, 1273, 1273, 1273, 1272,
+	1273, 1272, 1273, 1272, 1273, 1272, 1273, 1272,
+	1273, 1272, 1273, 1272, 1389, 1390, 1391, 1338,
+	1392, 1393, 1394, 1395, 1396, 1397, 1398, 1399,
+	1400, 1401, 1402, 1316, 1403, 1404, 1405, 1316,
+	1406, 1407, 1408, 1409, 1410, 1411, 1412, 1413,
+	1414, 1415, 1416, 1417, 1418, 1419, 1420, 1421,
+	1422, 1423, 1272, 1273, 1273, 1272, 1272, 1272,
+	1272, 1273, 1272, 1272, 1273, 1273, 1273, 1272,
+	1273, 1273, 1272, 1273, 1273, 1272, 1272, 1272,
+	1272, 1273, 1273, 1273, 1272, 1273, 1272, 1273,
+	1272, 1273, 1273, 1273, 1272, 1273, 1273, 1273,
+	1273, 1273, 1273, 1273, 1272, 1273, 1272, 1273,
+	1273, 1272, 1272, 1273, 1273, 1273, 1272, 1272,
+	1272, 1273, 1272, 1273, 1273, 1272, 1273, 1273,
+	1272, 1273, 1272, 1273, 1273, 1273, 1272, 1273,
+	1273, 1272, 1273, 1273, 1273, 1272, 1273, 1273,
+	1273, 1272, 1273, 1273, 1272, 1273, 1272, 1273,
+	1273, 1272, 1273, 1273, 1272, 1273, 1273, 1273,
+	1273, 1272, 1272, 1272, 1273, 1273, 1273, 1273,
+	1272, 1273, 1272, 1273, 1273, 1273, 1273, 1272,
+	1273, 1272, 1424, 1272, 1273, 1273, 1272, 1425,
+	1426, 1427, 1428, 1429, 1272, 1273, 1272, 1273,
+	1272, 1273, 1273, 1272, 1272, 1272, 1273, 1273,
+	1273, 1272, 1430, 1272, 1273, 1272, 1431, 1432,
+	1272, 1273, 1273, 1272, 1272, 1273, 1433, 1434,
+	1435, 1436, 1437, 1438, 1272, 1273, 1273, 1273,
+	1272, 1272, 1272, 1272, 1273, 1273, 1272, 1273,
+	1273, 1272, 1272, 1272, 1273, 1273, 1273, 1273,
+	1272, 1439, 1440, 1426, 1441, 1442, 1442, 1443,
+	1444, 1272, 1273, 1273, 1273, 1273, 1273, 1272,
+	1273, 1272, 1273, 1272, 1273, 1272, 1273, 1272,
+	1273, 1272, 1445, 1446, 1447, 1448, 1449, 1450,
+	1451, 1452, 1446, 1445, 1446, 1445, 1446, 1324,
+	1445, 1453, 1454, 1446, 1445, 1455, 1456, 1457,
+	1458, 1459, 1460, 1446, 1461, 1462, 1445, 1446,
+	1445, 1453, 1343, 1324, 1324, 1343, 1272, 1272,
+	1273, 1273, 1273, 1272, 1273, 1273, 1272, 1273,
+	1273, 1273, 1272, 1272, 1273, 1273, 1273, 1273,
+	1273, 1273, 1272, 1273, 1272, 1272, 1273, 1273,
+	1272, 1272, 1273, 1273, 1272, 1273, 1272, 1273,
+	1272, 1273, 1273, 1272, 1273, 1273, 1272, 1273,
+	1273, 1272, 1273, 1273, 1272, 1463, 1272, 1464,
+	1446, 1445, 1465, 1343, 1272, 1273, 1272, 1466,
+	1351, 1272, 1273, 1272, 1370, 1371, 1372, 1373,
+	1374, 1375, 1376, 1377, 1467, 1272, 1468, 1272,
+	1273, 1272, 1370, 1371, 1372, 1373, 1374, 1375,
+	1376, 1377, 1469, 1272, 1470, 1468, 1272, 1273,
+	1272, 3, 164, 164, 3, 164, 3, 164,
+	1, 3, 164, 1, 3, 1, 164, 3,
+	1, 164, 3, 164, 1, 3, 1, 164,
+	3, 164, 1, 3, 164, 1, 3, 164,
+	3, 1, 3, 164, 3, 164, 3, 1,
+	3, 164, 3, 164, 1, 3, 3, 164,
+	1, 3, 164, 1, 1236, 1, 1471, 1236,
+	1, 1472, 1473, 1474, 1475, 1474, 54, 1476,
+	1, 163, 3, 1, 1, 163, 1, 163,
+	3, 163, 1, 163, 1, 1478, 1477, 1481,
+	1482, 1483, 1484, 1485, 1486, 1487, 1488, 1490,
+	1491, 1492, 1493, 1494, 1495, 1497, 1477, 1,
+	1480, 1489, 1496, 1, 1479, 160, 162, 1499,
+	1500, 1501, 1502, 1503, 1504, 1505, 1506, 1507,
+	1508, 1509, 1510, 1511, 1512, 1513, 1514, 1515,
+	1516, 1498, 337, 357, 1518, 1519, 1520, 1521,
+	1522, 1523, 1524, 1525, 1526, 1527, 1528, 1529,
+	1530, 1531, 1532, 1533, 1534, 1535, 1517, 1536,
+	337, 357, 1518, 1519, 1520, 1521, 1522, 1523,
+	1524, 1525, 1526, 1527, 1528, 1529, 1537, 1538,
+	1532, 1533, 1539, 1535, 1517, 1541, 1542, 1543,
+	1544, 1545, 1546, 1547, 1548, 1549, 1550, 1551,
+	1552, 1553, 1554, 1556, 363, 414, 779, 1555,
+	1540, 519, 521, 1557, 1558, 1559, 1560, 1561,
+	1562, 1563, 1564, 1565, 1566, 1567, 1568, 1569,
+	1570, 1571, 1572, 1573, 1574, 1540, 694, 714,
+	1575, 1576, 1577, 1578, 1579, 1580, 1581, 1582,
+	1583, 1584, 1585, 1586, 1587, 1588, 1589, 1590,
+	1591, 1592, 1540, 1593, 694, 714, 1575, 1576,
+	1577, 1578, 1579, 1580, 1581, 1582, 1583, 1584,
+	1585, 1586, 1594, 1595, 1589, 1590, 1596, 1592,
+	1540, 694, 714, 1575, 1576, 1577, 1578, 1579,
+	1580, 1581, 1582, 1583, 1584, 1585, 1597, 1587,
+	1588, 1598, 1599, 1600, 1601, 1590, 1591, 1592,
+	1540, 694, 714, 1575, 1576, 1577, 1578, 1579,
+	1580, 1581, 1582, 1583, 1584, 1585, 1602, 1587,
+	1588, 1589, 1603, 1590, 1591, 1592, 1540, 694,
+	714, 1575, 1576, 1577, 1578, 1579, 1580, 1581,
+	1582, 1583, 1584, 1585, 1604, 1587, 1588, 1589,
+	1605, 1590, 1591, 1592, 1540, 694, 714, 1575,
+	1576, 1577, 1578, 1579, 1580, 1581, 1582, 1583,
+	1584, 1585, 1606, 1587, 1588, 1589, 1607, 1590,
+	1591, 1592, 1540, 694, 714, 1575, 1576, 1577,
+	1578, 1579, 1580, 1581, 1582, 1583, 1584, 1585,
+	1586, 1587, 1588, 1589, 1590, 1608, 1592, 1540,
+	1000, 1020, 1610, 1611, 1612, 1613, 1614, 1615,
+	1616, 1617, 1618, 1619, 1620, 1621, 1622, 1623,
+	1624, 1625, 1626, 1627, 1628, 1629, 1630, 1609,
+	1000, 1020, 1610, 1611, 1612, 1613, 1614, 1615,
+	1616, 1617, 1618, 1619, 1620, 1631, 1622, 1623,
+	1632, 1628, 1629, 1630, 1609, 1633, 1000, 1020,
+	1610, 1611, 1612, 1613, 1614, 1615, 1616, 1617,
+	1618, 1619, 1620, 1631, 1634, 1635, 1632, 1628,
+	1636, 1630, 1609, 1000, 1020, 1610, 1611, 1612,
+	1613, 1614, 1615, 1616, 1617, 1618, 1619, 1620,
+	1637, 1622, 1623, 1632, 1638, 1628, 1629, 1630,
+	1609, 1000, 1020, 1610, 1611, 1612, 1613, 1614,
+	1615, 1616, 1617, 1618, 1619, 1620, 1639, 1622,
+	1623, 1632, 1640, 1628, 1629, 1630, 1609, 1000,
+	1020, 1610, 1611, 1612, 1613, 1614, 1615, 1616,
+	1617, 1618, 1619, 1620, 1641, 1622, 1623, 1632,
+	1642, 1628, 1629, 1630, 1609, 1219, 1221, 1644,
+	1645, 1646, 1647, 1648, 1649, 1650, 1651, 1652,
+	1653, 1654, 1655, 1656, 1657, 1658, 1659, 1660,
+	1661, 1643, 1445, 1465, 1663, 1664, 1665, 1666,
+	1667, 1668, 1669, 1670, 1671, 1672, 1673, 1674,
+	1675, 1676, 1677, 1678, 1679, 1680, 1662, 1445,
+	1465, 1663, 1664, 1665, 1666, 1667, 1668, 1669,
+	1670, 1671, 1672, 1673, 1674, 1675, 1676, 1677,
+	1678, 1681, 1680, 1662, 1682, 1445, 1465, 1663,
+	1664, 1665, 1666, 1667, 1668, 1669, 1670, 1671,
+	1672, 1673, 1674, 1683, 1684, 1677, 1678, 1685,
+	1680, 1662,
+}
+
+var _graphclust_trans_targs []int16 = []int16{
+	1645, 0, 1645, 1646, 15, 16, 17, 18,
+	19, 20, 21, 22, 23, 24, 25, 26,
+	27, 28, 29, 30, 31, 32, 33, 34,
+	35, 36, 37, 38, 39, 40, 41, 42,
+	43, 45, 46, 47, 48, 49, 50, 51,
+	52, 53, 54, 55, 56, 57, 58, 59,
+	60, 61, 62, 63, 64, 65, 66, 1645,
+	68, 69, 70, 71, 72, 74, 75, 77,
+	78, 79, 80, 81, 82, 83, 84, 85,
+	86, 87, 88, 89, 90, 91, 93, 94,
+	96, 107, 144, 146, 152, 154, 157, 164,
+	171, 97, 98, 99, 100, 101, 102, 103,
+	104, 105, 106, 108, 109, 110, 111, 112,
+	113, 114, 115, 116, 117, 118, 119, 120,
+	121, 122, 123, 124, 125, 126, 127, 128,
+	129, 130, 131, 132, 133, 134, 135, 136,
+	137, 138, 139, 140, 141, 142, 143, 145,
+	147, 148, 149, 150, 151, 153, 155, 156,
+	158, 159, 160, 161, 162, 163, 165, 166,
+	167, 168, 169, 170, 172, 174, 175, 176,
+	2, 177, 3, 1645, 1647, 1645, 192, 193,
+	194, 195, 196, 197, 198, 199, 200, 201,
+	202, 203, 204, 205, 206, 207, 208, 209,
+	210, 211, 212, 213, 214, 215, 216, 217,
+	218, 219, 220, 222, 223, 224, 225, 226,
+	227, 228, 229, 230, 231, 232, 233, 234,
+	235, 236, 237, 238, 239, 240, 241, 242,
+	243, 245, 250, 268, 269, 270, 1648, 248,
+	249, 251, 252, 253, 254, 255, 256, 257,
+	258, 259, 260, 261, 262, 263, 264, 265,
+	266, 267, 272, 273, 274, 276, 277, 278,
+	279, 280, 281, 282, 283, 284, 285, 286,
+	287, 288, 289, 290, 292, 293, 295, 306,
+	342, 344, 350, 352, 355, 362, 369, 296,
+	297, 298, 299, 300, 301, 302, 303, 304,
+	305, 307, 308, 309, 310, 311, 312, 313,
+	314, 315, 316, 317, 318, 319, 320, 321,
+	322, 323, 324, 325, 326, 327, 328, 329,
+	330, 331, 332, 333, 334, 335, 336, 337,
+	338, 339, 340, 341, 343, 345, 346, 347,
+	348, 349, 351, 353, 354, 356, 357, 358,
+	359, 360, 361, 363, 364, 365, 366, 367,
+	368, 179, 370, 371, 372, 373, 374, 375,
+	376, 377, 378, 379, 380, 381, 382, 383,
+	384, 385, 386, 388, 389, 180, 391, 393,
+	394, 1649, 1645, 1650, 409, 410, 411, 412,
+	413, 414, 415, 416, 417, 418, 419, 420,
+	421, 422, 423, 424, 425, 426, 427, 428,
+	429, 430, 431, 432, 433, 434, 435, 436,
+	437, 439, 440, 441, 442, 443, 444, 445,
+	446, 447, 448, 449, 450, 451, 452, 453,
+	454, 455, 456, 457, 458, 459, 460, 462,
+	463, 464, 465, 466, 468, 469, 471, 472,
+	473, 474, 475, 476, 477, 478, 479, 480,
+	481, 482, 483, 484, 485, 487, 488, 490,
+	501, 538, 540, 546, 548, 551, 558, 565,
+	491, 492, 493, 494, 495, 496, 497, 498,
+	499, 500, 502, 503, 504, 505, 506, 507,
+	508, 509, 510, 511, 512, 513, 514, 515,
+	516, 517, 518, 519, 520, 521, 522, 523,
+	524, 525, 526, 527, 528, 529, 530, 531,
+	532, 533, 534, 535, 536, 537, 539, 541,
+	542, 543, 544, 545, 547, 549, 550, 552,
+	553, 554, 555, 556, 557, 559, 560, 561,
+	562, 563, 564, 566, 568, 569, 570, 396,
+	571, 397, 1651, 586, 587, 588, 589, 590,
+	591, 592, 593, 594, 595, 596, 597, 598,
+	599, 600, 601, 602, 603, 604, 605, 606,
+	607, 608, 609, 610, 611, 612, 613, 614,
+	616, 617, 618, 619, 620, 621, 622, 623,
+	624, 625, 626, 627, 628, 629, 630, 631,
+	632, 633, 634, 635, 636, 637, 639, 644,
+	662, 663, 664, 1652, 642, 643, 645, 646,
+	647, 648, 649, 650, 651, 652, 653, 654,
+	655, 656, 657, 658, 659, 660, 661, 666,
+	667, 668, 670, 671, 672, 673, 674, 675,
+	676, 677, 678, 679, 680, 681, 682, 683,
+	684, 686, 687, 689, 700, 736, 738, 744,
+	746, 749, 756, 763, 690, 691, 692, 693,
+	694, 695, 696, 697, 698, 699, 701, 702,
+	703, 704, 705, 706, 707, 708, 709, 710,
+	711, 712, 713, 714, 715, 716, 717, 718,
+	719, 720, 721, 722, 723, 724, 725, 726,
+	727, 728, 729, 730, 731, 732, 733, 734,
+	735, 737, 739, 740, 741, 742, 743, 745,
+	747, 748, 750, 751, 752, 753, 754, 755,
+	757, 758, 759, 760, 761, 762, 573, 764,
+	765, 766, 767, 768, 769, 770, 771, 772,
+	773, 774, 775, 776, 777, 778, 779, 780,
+	782, 783, 574, 785, 787, 788, 793, 794,
+	795, 797, 799, 802, 805, 829, 1653, 811,
+	1654, 801, 1655, 804, 807, 809, 810, 813,
+	814, 818, 819, 820, 821, 822, 823, 824,
+	1656, 817, 828, 831, 832, 833, 834, 835,
+	836, 837, 838, 839, 840, 841, 842, 843,
+	844, 845, 846, 847, 848, 850, 851, 854,
+	855, 856, 857, 858, 859, 860, 861, 865,
+	866, 868, 869, 852, 871, 881, 883, 885,
+	887, 872, 873, 874, 875, 876, 877, 878,
+	879, 880, 882, 884, 886, 888, 889, 890,
+	891, 895, 896, 897, 898, 899, 900, 901,
+	902, 903, 904, 905, 906, 907, 1657, 893,
+	894, 910, 914, 915, 916, 918, 1136, 1139,
+	1142, 1166, 1658, 1645, 1659, 932, 933, 934,
+	935, 936, 937, 938, 939, 940, 941, 942,
+	943, 944, 945, 946, 947, 948, 949, 950,
+	951, 952, 953, 954, 955, 956, 957, 958,
+	959, 960, 962, 963, 964, 965, 966, 967,
+	968, 969, 970, 971, 972, 973, 974, 975,
+	976, 977, 978, 979, 980, 981, 982, 983,
+	985, 990, 1008, 1009, 1010, 1660, 988, 989,
+	991, 992, 993, 994, 995, 996, 997, 998,
+	999, 1000, 1001, 1002, 1003, 1004, 1005, 1006,
+	1007, 1012, 1013, 1014, 1016, 1017, 1018, 1019,
+	1020, 1021, 1022, 1023, 1024, 1025, 1026, 1027,
+	1028, 1029, 1030, 1032, 1033, 1035, 1046, 1082,
+	1084, 1090, 1092, 1095, 1102, 1109, 1036, 1037,
+	1038, 1039, 1040, 1041, 1042, 1043, 1044, 1045,
+	1047, 1048, 1049, 1050, 1051, 1052, 1053, 1054,
+	1055, 1056, 1057, 1058, 1059, 1060, 1061, 1062,
+	1063, 1064, 1065, 1066, 1067, 1068, 1069, 1070,
+	1071, 1072, 1073, 1074, 1075, 1076, 1077, 1078,
+	1079, 1080, 1081, 1083, 1085, 1086, 1087, 1088,
+	1089, 1091, 1093, 1094, 1096, 1097, 1098, 1099,
+	1100, 1101, 1103, 1104, 1105, 1106, 1107, 1108,
+	919, 1110, 1111, 1112, 1113, 1114, 1115, 1116,
+	1117, 1118, 1119, 1120, 1121, 1122, 1123, 1124,
+	1125, 1126, 1128, 1129, 920, 1131, 1133, 1134,
+	1148, 1661, 1138, 1662, 1141, 1144, 1146, 1147,
+	1150, 1151, 1155, 1156, 1157, 1158, 1159, 1160,
+	1161, 1663, 1154, 1165, 1168, 1345, 1346, 1347,
+	1348, 1349, 1350, 1351, 1352, 1353, 1354, 1355,
+	1356, 1357, 1358, 1359, 1360, 1361, 1664, 1645,
+	1182, 1183, 1184, 1185, 1186, 1187, 1188, 1189,
+	1190, 1191, 1192, 1193, 1194, 1195, 1196, 1197,
+	1198, 1199, 1200, 1201, 1202, 1203, 1204, 1205,
+	1206, 1207, 1208, 1209, 1210, 1212, 1213, 1214,
+	1215, 1216, 1217, 1218, 1219, 1220, 1221, 1222,
+	1223, 1224, 1225, 1226, 1227, 1228, 1229, 1230,
+	1231, 1232, 1233, 1235, 1236, 1237, 1238, 1239,
+	1241, 1242, 1244, 1245, 1246, 1247, 1248, 1249,
+	1250, 1251, 1252, 1253, 1254, 1255, 1256, 1257,
+	1258, 1260, 1261, 1263, 1274, 1311, 1313, 1319,
+	1321, 1324, 1331, 1338, 1264, 1265, 1266, 1267,
+	1268, 1269, 1270, 1271, 1272, 1273, 1275, 1276,
+	1277, 1278, 1279, 1280, 1281, 1282, 1283, 1284,
+	1285, 1286, 1287, 1288, 1289, 1290, 1291, 1292,
+	1293, 1294, 1295, 1296, 1297, 1298, 1299, 1300,
+	1301, 1302, 1303, 1304, 1305, 1306, 1307, 1308,
+	1309, 1310, 1312, 1314, 1315, 1316, 1317, 1318,
+	1320, 1322, 1323, 1325, 1326, 1327, 1328, 1329,
+	1330, 1332, 1333, 1334, 1335, 1336, 1337, 1339,
+	1341, 1342, 1343, 1169, 1344, 1170, 1363, 1364,
+	1367, 1368, 1369, 1370, 1371, 1372, 1373, 1374,
+	1378, 1379, 1381, 1382, 1365, 1384, 1394, 1396,
+	1398, 1400, 1385, 1386, 1387, 1388, 1389, 1390,
+	1391, 1392, 1393, 1395, 1397, 1399, 1401, 1402,
+	1403, 1404, 1624, 1625, 1626, 1627, 1628, 1629,
+	1630, 1631, 1632, 1633, 1634, 1635, 1636, 1665,
+	1645, 1666, 1418, 1419, 1420, 1421, 1422, 1423,
+	1424, 1425, 1426, 1427, 1428, 1429, 1430, 1431,
+	1432, 1433, 1434, 1435, 1436, 1437, 1438, 1439,
+	1440, 1441, 1442, 1443, 1444, 1445, 1446, 1448,
+	1449, 1450, 1451, 1452, 1453, 1454, 1455, 1456,
+	1457, 1458, 1459, 1460, 1461, 1462, 1463, 1464,
+	1465, 1466, 1467, 1468, 1469, 1471, 1476, 1494,
+	1495, 1496, 1667, 1474, 1475, 1477, 1478, 1479,
+	1480, 1481, 1482, 1483, 1484, 1485, 1486, 1487,
+	1488, 1489, 1490, 1491, 1492, 1493, 1498, 1499,
+	1500, 1502, 1503, 1504, 1505, 1506, 1507, 1508,
+	1509, 1510, 1511, 1512, 1513, 1514, 1515, 1516,
+	1518, 1519, 1521, 1532, 1568, 1570, 1576, 1578,
+	1581, 1588, 1595, 1522, 1523, 1524, 1525, 1526,
+	1527, 1528, 1529, 1530, 1531, 1533, 1534, 1535,
+	1536, 1537, 1538, 1539, 1540, 1541, 1542, 1543,
+	1544, 1545, 1546, 1547, 1548, 1549, 1550, 1551,
+	1552, 1553, 1554, 1555, 1556, 1557, 1558, 1559,
+	1560, 1561, 1562, 1563, 1564, 1565, 1566, 1567,
+	1569, 1571, 1572, 1573, 1574, 1575, 1577, 1579,
+	1580, 1582, 1583, 1584, 1585, 1586, 1587, 1589,
+	1590, 1591, 1592, 1593, 1594, 1405, 1596, 1597,
+	1598, 1599, 1600, 1601, 1602, 1603, 1604, 1605,
+	1606, 1607, 1608, 1609, 1610, 1611, 1612, 1614,
+	1615, 1406, 1617, 1619, 1620, 1622, 1623, 1639,
+	1640, 1641, 1642, 1643, 1644, 1645, 1, 1646,
+	66, 178, 395, 911, 912, 913, 917, 1167,
+	1362, 1365, 1366, 1375, 1376, 1377, 1380, 1383,
+	1637, 1638, 1645, 4, 5, 6, 7, 8,
+	9, 10, 11, 12, 13, 14, 44, 67,
+	73, 76, 92, 95, 173, 1645, 181, 182,
+	183, 184, 185, 186, 187, 188, 189, 190,
+	191, 221, 244, 390, 275, 291, 392, 387,
+	246, 247, 271, 294, 1645, 572, 789, 790,
+	791, 792, 796, 830, 849, 853, 862, 863,
+	864, 867, 870, 908, 909, 398, 399, 400,
+	401, 402, 403, 404, 405, 406, 407, 408,
+	438, 461, 467, 470, 486, 489, 567, 575,
+	576, 577, 578, 579, 580, 581, 582, 583,
+	584, 585, 615, 638, 784, 669, 685, 786,
+	781, 640, 641, 665, 688, 798, 812, 825,
+	826, 827, 800, 808, 803, 806, 815, 816,
+	892, 1645, 921, 922, 923, 924, 925, 926,
+	927, 928, 929, 930, 931, 1135, 984, 1130,
+	1149, 1162, 1163, 1164, 1031, 1132, 1127, 961,
+	1015, 986, 987, 1011, 1034, 1137, 1145, 1140,
+	1143, 1152, 1153, 1645, 1171, 1172, 1173, 1174,
+	1175, 1176, 1177, 1178, 1179, 1180, 1181, 1211,
+	1234, 1240, 1243, 1259, 1262, 1340, 1645, 1407,
+	1408, 1409, 1410, 1411, 1412, 1413, 1414, 1415,
+	1416, 1417, 1447, 1470, 1616, 1501, 1517, 1621,
+	1613, 1618, 1472, 1473, 1497, 1520,
+}
+
+var _graphclust_trans_actions []byte = []byte{
+	31, 0, 27, 55, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 29,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 34, 51, 19, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 51, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 40, 25, 40, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 40, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 40, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 40, 0,
+	40, 0, 40, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	40, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 40, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 47, 17, 40, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 40, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 47, 0, 47, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 40, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 40, 21,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 40,
+	23, 40, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 40, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 43, 1, 59,
+	1, 1, 1, 1, 1, 1, 1, 1,
+	1, 1, 1, 1, 1, 1, 1, 1,
+	1, 1, 15, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 7, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 13, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 5, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 9, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 11, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0,
+}
+
+var _graphclust_to_state_actions []byte = []byte{
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 37, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0,
+}
+
+var _graphclust_from_state_actions []byte = []byte{
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 3, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0,
+}
+
+var _graphclust_eof_trans []int16 = []int16{
+	0, 0, 3, 3, 3, 3, 3, 3,
+	3, 3, 3, 3, 3, 3, 3, 3,
+	3, 3, 3, 3, 3, 3, 3, 3,
+	3, 3, 3, 3, 3, 3, 3, 3,
+	3, 3, 3, 3, 3, 3, 3, 3,
+	3, 3, 3, 3, 3, 3, 3, 3,
+	3, 3, 3, 3, 3, 3, 3, 3,
+	3, 3, 3, 3, 3, 3, 3, 3,
+	3, 3, 56, 3, 3, 3, 3, 3,
+	3, 3, 3, 3, 3, 3, 3, 3,
+	3, 3, 3, 3, 3, 3, 3, 3,
+	3, 3, 3, 3, 3, 3, 3, 3,
+	3, 3, 3, 3, 3, 3, 3, 3,
+	3, 3, 3, 3, 3, 3, 3, 3,
+	3, 3, 3, 3, 3, 3, 3, 3,
+	3, 3, 3, 3, 3, 3, 3, 3,
+	3, 3, 3, 3, 3, 3, 3, 3,
+	3, 3, 3, 3, 3, 3, 3, 3,
+	3, 3, 3, 3, 3, 3, 3, 3,
+	3, 3, 3, 3, 3, 3, 3, 3,
+	3, 3, 3, 3, 3, 3, 3, 3,
+	3, 3, 3, 3, 3, 3, 3, 3,
+	3, 3, 0, 56, 166, 166, 166, 166,
+	166, 166, 166, 166, 166, 166, 166, 166,
+	166, 166, 166, 166, 166, 166, 166, 166,
+	166, 166, 166, 166, 166, 166, 166, 166,
+	166, 166, 166, 166, 166, 166, 166, 166,
+	166, 166, 166, 166, 166, 166, 166, 166,
+	166, 166, 166, 166, 166, 166, 166, 166,
+	166, 166, 166, 166, 166, 166, 166, 166,
+	166, 166, 166, 56, 166, 166, 166, 166,
+	166, 166, 166, 166, 166, 166, 166, 166,
+	166, 166, 166, 166, 166, 56, 166, 166,
+	166, 166, 166, 166, 166, 166, 166, 166,
+	166, 166, 166, 166, 166, 166, 166, 166,
+	166, 166, 166, 166, 166, 166, 166, 166,
+	166, 166, 166, 166, 166, 166, 166, 166,
+	166, 166, 166, 166, 166, 166, 166, 166,
+	166, 166, 166, 166, 166, 166, 166, 166,
+	166, 166, 166, 166, 166, 166, 166, 166,
+	166, 166, 166, 166, 166, 166, 166, 166,
+	166, 166, 166, 166, 166, 166, 166, 166,
+	166, 166, 166, 166, 166, 166, 166, 166,
+	166, 166, 166, 166, 166, 166, 166, 166,
+	166, 166, 166, 166, 166, 166, 166, 166,
+	166, 166, 166, 166, 166, 166, 166, 166,
+	166, 166, 56, 166, 166, 166, 166, 166,
+	166, 166, 166, 166, 166, 166, 166, 166,
+	166, 166, 166, 166, 166, 166, 166, 166,
+	166, 166, 166, 0, 363, 363, 363, 363,
+	363, 363, 363, 363, 363, 363, 363, 363,
+	363, 363, 363, 363, 363, 363, 363, 363,
+	363, 363, 363, 363, 363, 363, 363, 363,
+	363, 363, 363, 363, 363, 363, 363, 363,
+	363, 363, 363, 363, 363, 363, 363, 363,
+	363, 363, 363, 363, 363, 363, 363, 363,
+	363, 363, 363, 363, 363, 363, 363, 363,
+	363, 363, 363, 363, 363, 363, 363, 363,
+	363, 363, 363, 363, 363, 363, 363, 363,
+	363, 363, 363, 363, 363, 363, 363, 363,
+	363, 363, 363, 363, 363, 363, 363, 363,
+	363, 363, 363, 363, 363, 363, 363, 363,
+	363, 363, 363, 363, 363, 363, 363, 363,
+	363, 363, 363, 363, 363, 363, 363, 363,
+	363, 363, 363, 363, 363, 363, 363, 363,
+	363, 363, 363, 363, 363, 363, 363, 363,
+	363, 363, 363, 363, 363, 363, 363, 363,
+	363, 363, 363, 363, 363, 363, 363, 363,
+	363, 363, 363, 363, 363, 363, 363, 363,
+	363, 363, 363, 363, 363, 363, 363, 363,
+	363, 363, 363, 363, 363, 363, 363, 363,
+	363, 363, 363, 363, 363, 363, 363, 363,
+	363, 363, 363, 363, 363, 363, 363, 363,
+	363, 363, 363, 363, 363, 363, 363, 363,
+	363, 363, 363, 363, 363, 363, 363, 363,
+	363, 363, 363, 363, 363, 363, 363, 363,
+	363, 363, 363, 363, 363, 363, 363, 363,
+	363, 363, 363, 363, 363, 363, 363, 363,
+	363, 363, 363, 363, 363, 363, 363, 363,
+	363, 363, 363, 363, 363, 363, 363, 363,
+	363, 363, 363, 363, 363, 363, 363, 363,
+	363, 363, 363, 363, 363, 363, 363, 363,
+	363, 363, 363, 363, 363, 363, 363, 363,
+	363, 363, 363, 363, 363, 363, 363, 363,
+	363, 363, 363, 363, 363, 363, 363, 363,
+	363, 363, 363, 363, 363, 363, 363, 363,
+	363, 363, 363, 363, 363, 363, 363, 363,
+	363, 363, 363, 363, 363, 363, 363, 363,
+	363, 363, 363, 363, 363, 363, 363, 363,
+	363, 363, 363, 363, 363, 363, 363, 363,
+	363, 363, 363, 363, 363, 363, 363, 363,
+	363, 363, 363, 363, 363, 363, 363, 363,
+	363, 363, 363, 363, 363, 363, 363, 363,
+	363, 363, 363, 363, 363, 363, 363, 363,
+	363, 363, 363, 363, 363, 363, 363, 363,
+	363, 363, 363, 363, 363, 363, 363, 363,
+	363, 363, 363, 363, 363, 363, 363, 363,
+	363, 363, 363, 363, 363, 363, 363, 363,
+	363, 363, 363, 363, 363, 363, 363, 363,
+	363, 363, 363, 363, 363, 363, 363, 363,
+	363, 363, 363, 363, 363, 363, 363, 363,
+	363, 363, 363, 363, 363, 363, 363, 363,
+	363, 363, 363, 363, 363, 363, 363, 363,
+	363, 363, 363, 363, 363, 363, 363, 363,
+	363, 363, 363, 363, 363, 363, 363, 363,
+	363, 363, 363, 363, 363, 363, 363, 363,
+	363, 363, 363, 363, 363, 363, 363, 363,
+	363, 363, 363, 363, 363, 363, 363, 363,
+	363, 363, 363, 363, 363, 363, 363, 363,
+	363, 363, 363, 363, 363, 363, 363, 363,
+	363, 363, 363, 363, 363, 363, 363, 363,
+	363, 363, 363, 363, 363, 363, 363, 363,
+	363, 363, 363, 363, 363, 363, 363, 363,
+	363, 363, 363, 363, 363, 363, 363, 0,
+	0, 0, 0, 0, 0, 0, 56, 828,
+	828, 828, 828, 828, 828, 828, 828, 828,
+	828, 828, 828, 828, 828, 828, 828, 828,
+	828, 828, 828, 828, 828, 828, 828, 828,
+	828, 828, 828, 828, 828, 828, 828, 828,
+	828, 828, 828, 828, 828, 828, 828, 828,
+	828, 828, 828, 828, 828, 828, 828, 828,
+	828, 828, 828, 828, 828, 828, 828, 828,
+	828, 828, 828, 828, 828, 828, 828, 828,
+	828, 828, 828, 828, 828, 828, 828, 828,
+	828, 828, 828, 828, 828, 828, 828, 828,
+	828, 828, 828, 828, 828, 828, 828, 828,
+	828, 828, 828, 828, 828, 828, 828, 828,
+	828, 828, 828, 828, 828, 828, 828, 828,
+	828, 828, 828, 828, 828, 828, 828, 828,
+	828, 828, 828, 828, 828, 828, 828, 828,
+	828, 828, 828, 828, 828, 828, 828, 828,
+	828, 828, 828, 828, 828, 828, 828, 828,
+	828, 828, 828, 828, 828, 828, 828, 828,
+	828, 828, 828, 828, 828, 828, 828, 828,
+	828, 828, 828, 828, 828, 828, 828, 828,
+	828, 828, 828, 828, 828, 828, 828, 828,
+	828, 828, 828, 828, 828, 828, 828, 828,
+	828, 828, 828, 828, 828, 828, 828, 828,
+	828, 828, 828, 828, 828, 828, 828, 828,
+	828, 828, 828, 828, 828, 828, 828, 828,
+	828, 828, 828, 828, 828, 828, 828, 828,
+	828, 828, 828, 828, 828, 828, 828, 828,
+	56, 828, 828, 56, 828, 828, 56, 828,
+	828, 828, 828, 828, 828, 828, 828, 828,
+	828, 828, 828, 828, 828, 828, 828, 828,
+	828, 56, 828, 828, 828, 828, 0, 0,
+	0, 1064, 1064, 1064, 1064, 1064, 1064, 1064,
+	1064, 1064, 1064, 1064, 1064, 1064, 1064, 1064,
+	1064, 1064, 1064, 1064, 1064, 1064, 1064, 1064,
+	1064, 1064, 1064, 1064, 1064, 1064, 1064, 1064,
+	1064, 1064, 1064, 1064, 1064, 1064, 1064, 1064,
+	1064, 1064, 1064, 1064, 1064, 1064, 1064, 1064,
+	1064, 1064, 1064, 1064, 1064, 1064, 1064, 1064,
+	1064, 1064, 1064, 1064, 1064, 1064, 1064, 1064,
+	1064, 1064, 1064, 1064, 1064, 1064, 1064, 1064,
+	1064, 1064, 1064, 1064, 1064, 1064, 1064, 1064,
+	1064, 1064, 1064, 1064, 1064, 1064, 1064, 1064,
+	1064, 1064, 1064, 1064, 1064, 1064, 1064, 1064,
+	1064, 1064, 1064, 1064, 1064, 1064, 1064, 1064,
+	1064, 1064, 1064, 1064, 1064, 1064, 1064, 1064,
+	1064, 1064, 1064, 1064, 1064, 1064, 1064, 1064,
+	1064, 1064, 1064, 1064, 1064, 1064, 1064, 1064,
+	1064, 1064, 1064, 1064, 1064, 1064, 1064, 1064,
+	1064, 1064, 1064, 1064, 1064, 1064, 1064, 1064,
+	1064, 1064, 1064, 1064, 1064, 1064, 1064, 1064,
+	1064, 1064, 1064, 1064, 1064, 1064, 1064, 1064,
+	1064, 1064, 1064, 1064, 1064, 1064, 1064, 1064,
+	1064, 1064, 1064, 1064, 1064, 1064, 1064, 1064,
+	1064, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 1273, 1273, 1273,
+	1273, 1273, 1273, 1273, 1273, 1273, 1273, 1273,
+	1273, 1273, 1273, 1273, 1273, 1273, 1273, 1273,
+	1273, 1273, 1273, 1273, 1273, 1273, 1273, 1273,
+	1273, 1273, 1273, 1273, 1273, 1273, 1273, 1273,
+	1273, 1273, 1273, 1273, 1273, 1273, 1273, 1273,
+	1273, 1273, 1273, 1273, 1273, 1273, 1273, 1273,
+	1273, 1273, 1273, 1273, 1273, 1273, 1273, 1273,
+	1273, 1273, 1273, 1273, 1273, 1273, 1273, 1273,
+	1273, 1273, 1273, 1273, 1273, 1273, 1273, 1273,
+	1273, 1273, 1273, 1273, 1273, 1273, 1273, 1273,
+	1273, 1273, 1273, 1273, 1273, 1273, 1273, 1273,
+	1273, 1273, 1273, 1273, 1273, 1273, 1273, 1273,
+	1273, 1273, 1273, 1273, 1273, 1273, 1273, 1273,
+	1273, 1273, 1273, 1273, 1273, 1273, 1273, 1273,
+	1273, 1273, 1273, 1273, 1273, 1273, 1273, 1273,
+	1273, 1273, 1273, 1273, 1273, 1273, 1273, 1273,
+	1273, 1273, 1273, 1273, 1273, 1273, 1273, 1273,
+	1273, 1273, 1273, 1273, 1273, 1273, 1273, 1273,
+	1273, 1273, 1273, 1273, 1273, 1273, 1273, 1273,
+	1273, 1273, 1273, 1273, 1273, 1273, 1273, 1273,
+	1273, 1273, 1273, 1273, 1273, 1273, 1273, 1273,
+	1273, 1273, 1273, 1273, 1273, 1273, 1273, 1273,
+	1273, 1273, 1273, 1273, 1273, 1273, 1273, 1273,
+	1273, 1273, 1273, 1273, 1273, 1273, 1273, 1273,
+	1273, 1273, 1273, 1273, 1273, 1273, 1273, 1273,
+	1273, 1273, 1273, 1273, 1273, 1273, 1273, 1273,
+	1273, 1273, 1273, 1273, 1273, 1273, 1273, 1273,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 1499, 1518,
+	1518, 1541, 1541, 1541, 1541, 1541, 1541, 1541,
+	1541, 1541, 1610, 1610, 1610, 1610, 1610, 1610,
+	1644, 1663, 1663, 1663,
+}
+
+const graphclust_start int = 1645
+const graphclust_first_final int = 1645
+const graphclust_error int = 0
+
+const graphclust_en_main int = 1645
+
+//line grapheme_clusters.rl:14
+
+var Error = errors.New("invalid UTF8 text")
+
+// ScanGraphemeClusters is a split function for bufio.Scanner that splits
+// on grapheme cluster boundaries.
+func ScanGraphemeClusters(data []byte, atEOF bool) (int, []byte, error) {
+	if len(data) == 0 {
+		return 0, nil, nil
+	}
+
+	// Ragel state
+	cs := 0         // Current State
+	p := 0          // "Pointer" into data
+	pe := len(data) // End-of-data "pointer"
+	ts := 0
+	te := 0
+	act := 0
+	eof := pe
+
+	// Make Go compiler happy
+	_ = ts
+	_ = te
+	_ = act
+	_ = eof
+
+	startPos := 0
+	endPos := 0
+
+//line grapheme_clusters.go:4049
+	{
+		cs = graphclust_start
+		ts = 0
+		te = 0
+		act = 0
+	}
+
+//line grapheme_clusters.go:4057
+	{
+		var _klen int
+		var _trans int
+		var _acts int
+		var _nacts uint
+		var _keys int
+		if p == pe {
+			goto _test_eof
+		}
+		if cs == 0 {
+			goto _out
+		}
+	_resume:
+		_acts = int(_graphclust_from_state_actions[cs])
+		_nacts = uint(_graphclust_actions[_acts])
+		_acts++
+		for ; _nacts > 0; _nacts-- {
+			_acts++
+			switch _graphclust_actions[_acts-1] {
+			case 4:
+//line NONE:1
+				ts = p
+
+//line grapheme_clusters.go:4080
+			}
+		}
+
+		_keys = int(_graphclust_key_offsets[cs])
+		_trans = int(_graphclust_index_offsets[cs])
+
+		_klen = int(_graphclust_single_lengths[cs])
+		if _klen > 0 {
+			_lower := int(_keys)
+			var _mid int
+			_upper := int(_keys + _klen - 1)
+			for {
+				if _upper < _lower {
+					break
+				}
+
+				_mid = _lower + ((_upper - _lower) >> 1)
+				switch {
+				case data[p] < _graphclust_trans_keys[_mid]:
+					_upper = _mid - 1
+				case data[p] > _graphclust_trans_keys[_mid]:
+					_lower = _mid + 1
+				default:
+					_trans += int(_mid - int(_keys))
+					goto _match
+				}
+			}
+			_keys += _klen
+			_trans += _klen
+		}
+
+		_klen = int(_graphclust_range_lengths[cs])
+		if _klen > 0 {
+			_lower := int(_keys)
+			var _mid int
+			_upper := int(_keys + (_klen << 1) - 2)
+			for {
+				if _upper < _lower {
+					break
+				}
+
+				_mid = _lower + (((_upper - _lower) >> 1) & ^1)
+				switch {
+				case data[p] < _graphclust_trans_keys[_mid]:
+					_upper = _mid - 2
+				case data[p] > _graphclust_trans_keys[_mid+1]:
+					_lower = _mid + 2
+				default:
+					_trans += int((_mid - int(_keys)) >> 1)
+					goto _match
+				}
+			}
+			_trans += _klen
+		}
+
+	_match:
+		_trans = int(_graphclust_indicies[_trans])
+	_eof_trans:
+		cs = int(_graphclust_trans_targs[_trans])
+
+		if _graphclust_trans_actions[_trans] == 0 {
+			goto _again
+		}
+
+		_acts = int(_graphclust_trans_actions[_trans])
+		_nacts = uint(_graphclust_actions[_acts])
+		_acts++
+		for ; _nacts > 0; _nacts-- {
+			_acts++
+			switch _graphclust_actions[_acts-1] {
+			case 0:
+//line grapheme_clusters.rl:47
+
+				startPos = p
+
+			case 1:
+//line grapheme_clusters.rl:51
+
+				endPos = p
+
+			case 5:
+//line NONE:1
+				te = p + 1
+
+			case 6:
+//line grapheme_clusters.rl:55
+				act = 3
+			case 7:
+//line grapheme_clusters.rl:55
+				act = 4
+			case 8:
+//line grapheme_clusters.rl:55
+				act = 8
+			case 9:
+//line grapheme_clusters.rl:55
+				te = p + 1
+				{
+					return endPos + 1, data[startPos : endPos+1], nil
+				}
+			case 10:
+//line grapheme_clusters.rl:55
+				te = p + 1
+				{
+					return endPos + 1, data[startPos : endPos+1], nil
+				}
+			case 11:
+//line grapheme_clusters.rl:55
+				te = p
+				p--
+				{
+					return endPos + 1, data[startPos : endPos+1], nil
+				}
+			case 12:
+//line grapheme_clusters.rl:55
+				te = p
+				p--
+				{
+					return endPos + 1, data[startPos : endPos+1], nil
+				}
+			case 13:
+//line grapheme_clusters.rl:55
+				te = p
+				p--
+				{
+					return endPos + 1, data[startPos : endPos+1], nil
+				}
+			case 14:
+//line grapheme_clusters.rl:55
+				te = p
+				p--
+				{
+					return endPos + 1, data[startPos : endPos+1], nil
+				}
+			case 15:
+//line grapheme_clusters.rl:55
+				te = p
+				p--
+				{
+					return endPos + 1, data[startPos : endPos+1], nil
+				}
+			case 16:
+//line grapheme_clusters.rl:55
+				te = p
+				p--
+				{
+					return endPos + 1, data[startPos : endPos+1], nil
+				}
+			case 17:
+//line grapheme_clusters.rl:55
+				p = (te) - 1
+				{
+					return endPos + 1, data[startPos : endPos+1], nil
+				}
+			case 18:
+//line grapheme_clusters.rl:55
+				p = (te) - 1
+				{
+					return endPos + 1, data[startPos : endPos+1], nil
+				}
+			case 19:
+//line grapheme_clusters.rl:55
+				p = (te) - 1
+				{
+					return endPos + 1, data[startPos : endPos+1], nil
+				}
+			case 20:
+//line grapheme_clusters.rl:55
+				p = (te) - 1
+				{
+					return endPos + 1, data[startPos : endPos+1], nil
+				}
+			case 21:
+//line grapheme_clusters.rl:55
+				p = (te) - 1
+				{
+					return endPos + 1, data[startPos : endPos+1], nil
+				}
+			case 22:
+//line grapheme_clusters.rl:55
+				p = (te) - 1
+				{
+					return endPos + 1, data[startPos : endPos+1], nil
+				}
+			case 23:
+//line NONE:1
+				switch act {
+				case 0:
+					{
+						cs = 0
+						goto _again
+					}
+				case 3:
+					{
+						p = (te) - 1
+
+						return endPos + 1, data[startPos : endPos+1], nil
+					}
+				case 4:
+					{
+						p = (te) - 1
+
+						return endPos + 1, data[startPos : endPos+1], nil
+					}
+				case 8:
+					{
+						p = (te) - 1
+
+						return endPos + 1, data[startPos : endPos+1], nil
+					}
+				}
+
+//line grapheme_clusters.go:4287
+			}
+		}
+
+	_again:
+		_acts = int(_graphclust_to_state_actions[cs])
+		_nacts = uint(_graphclust_actions[_acts])
+		_acts++
+		for ; _nacts > 0; _nacts-- {
+			_acts++
+			switch _graphclust_actions[_acts-1] {
+			case 2:
+//line NONE:1
+				ts = 0
+
+			case 3:
+//line NONE:1
+				act = 0
+
+//line grapheme_clusters.go:4305
+			}
+		}
+
+		if cs == 0 {
+			goto _out
+		}
+		p++
+		if p != pe {
+			goto _resume
+		}
+	_test_eof:
+		{
+		}
+		if p == eof {
+			if _graphclust_eof_trans[cs] > 0 {
+				_trans = int(_graphclust_eof_trans[cs] - 1)
+				goto _eof_trans
+			}
+		}
+
+	_out:
+		{
+		}
+	}
+
+//line grapheme_clusters.rl:117
+
+	// If we fall out here then we were unable to complete a sequence.
+	// If we weren't able to complete a sequence then either we've
+	// reached the end of a partial buffer (so there's more data to come)
+	// or we have an isolated symbol that would normally be part of a
+	// grapheme cluster but has appeared in isolation here.
+
+	if !atEOF {
+		// Request more
+		return 0, nil, nil
+	}
+
+	// Just take the first UTF-8 sequence and return that.
+	_, seqLen := utf8.DecodeRune(data)
+	return seqLen, data[:seqLen], nil
+}
diff --git a/.ci/providerlint/vendor/github.com/apparentlymart/go-textseg/v13/textseg/grapheme_clusters.rl b/.ci/providerlint/vendor/github.com/apparentlymart/go-textseg/v15/textseg/grapheme_clusters.rl
similarity index 100%
rename from .ci/providerlint/vendor/github.com/apparentlymart/go-textseg/v13/textseg/grapheme_clusters.rl
rename to .ci/providerlint/vendor/github.com/apparentlymart/go-textseg/v15/textseg/grapheme_clusters.rl
diff --git a/.ci/providerlint/vendor/github.com/apparentlymart/go-textseg/v13/textseg/grapheme_clusters_table.rl b/.ci/providerlint/vendor/github.com/apparentlymart/go-textseg/v15/textseg/grapheme_clusters_table.rl
similarity index 97%
rename from .ci/providerlint/vendor/github.com/apparentlymart/go-textseg/v13/textseg/grapheme_clusters_table.rl
rename to .ci/providerlint/vendor/github.com/apparentlymart/go-textseg/v15/textseg/grapheme_clusters_table.rl
index 803dca19c58..3cff4291de1 100644
--- a/.ci/providerlint/vendor/github.com/apparentlymart/go-textseg/v13/textseg/grapheme_clusters_table.rl
+++ b/.ci/providerlint/vendor/github.com/apparentlymart/go-textseg/v15/textseg/grapheme_clusters_table.rl
@@ -1,5 +1,5 @@
 # The following Ragel file was autogenerated with unicode2ragel.rb 
-# from: https://www.unicode.org/Public/13.0.0/ucd/auxiliary/GraphemeBreakProperty.txt
+# from: https://www.unicode.org/Public/15.0.0/ucd/auxiliary/GraphemeBreakProperty.txt
 #
 # It defines ["Prepend", "CR", "LF", "Control", "Extend", "Regional_Indicator", "SpacingMark", "L", "V", "T", "LV", "LVT", "ZWJ"].
 #
@@ -13,6 +13,7 @@
         0xD8 0x80..0x85         #Cf   [6] ARABIC NUMBER SIGN..ARABIC NUMBER ...
       | 0xDB 0x9D               #Cf       ARABIC END OF AYAH
       | 0xDC 0x8F               #Cf       SYRIAC ABBREVIATION MARK
+      | 0xE0 0xA2 0x90..0x91    #Cf   [2] ARABIC POUND MARK ABOVE..ARABIC PI...
       | 0xE0 0xA3 0xA2          #Cf       ARABIC DISPUTED END OF AYAH
       | 0xE0 0xB5 0x8E          #Lo       MALAYALAM LETTER DOT REPH
       | 0xF0 0x91 0x82 0xBD     #Cf       KAITHI NUMBER SIGN
@@ -23,6 +24,7 @@
       | 0xF0 0x91 0xA8 0xBA     #Lo       ZANABAZAR SQUARE CLUSTER-INITIAL L...
       | 0xF0 0x91 0xAA 0x84..0x89  #Lo   [6] SOYOMBO SIGN JIHVAMULIYA..SOYOM...
       | 0xF0 0x91 0xB5 0x86     #Lo       MASARAM GONDI REPHA
+      | 0xF0 0x91 0xBC 0x82     #Lo       KAWI SIGN REPHA
       ;
 
     CR = 
@@ -53,7 +55,7 @@
       | 0xEF 0xBB 0xBF          #Cf       ZERO WIDTH NO-BREAK SPACE
       | 0xEF 0xBF 0xB0..0xB8    #Cn   [9] <reserved-FFF0>..<reserved-FFF8>
       | 0xEF 0xBF 0xB9..0xBB    #Cf   [3] INTERLINEAR ANNOTATION ANCHOR..INT...
-      | 0xF0 0x93 0x90 0xB0..0xB8  #Cf   [9] EGYPTIAN HIEROGLYPH VERTICAL JO...
+      | 0xF0 0x93 0x90 0xB0..0xBF  #Cf  [16] EGYPTIAN HIEROGLYPH VERTICAL JO...
       | 0xF0 0x9B 0xB2 0xA0..0xA3  #Cf   [4] SHORTHAND FORMAT LETTER OVERLAP...
       | 0xF0 0x9D 0x85 0xB3..0xBA  #Cf   [8] MUSICAL SYMBOL BEGIN BEAM..MUSI...
       | 0xF3 0xA0 0x80 0x80     #Cn       <reserved-E0000>
@@ -94,7 +96,8 @@
       | 0xE0 0xA0 0xA5..0xA7    #Mn   [3] SAMARITAN VOWEL SIGN SHORT A..SAMA...
       | 0xE0 0xA0 0xA9..0xAD    #Mn   [5] SAMARITAN VOWEL SIGN LONG I..SAMAR...
       | 0xE0 0xA1 0x99..0x9B    #Mn   [3] MANDAIC AFFRICATION MARK..MANDAIC ...
-      | 0xE0 0xA3 0x93..0xA1    #Mn  [15] ARABIC SMALL LOW WAW..ARABIC SMALL...
+      | 0xE0 0xA2 0x98..0x9F    #Mn   [8] ARABIC SMALL HIGH WORD AL-JUZ..ARA...
+      | 0xE0 0xA3 0x8A..0xA1    #Mn  [24] ARABIC SMALL HIGH FARSI YEH..ARABI...
       | 0xE0 0xA3 0xA3..0xFF    #Mn  [32] ARABIC TURNED DAMMA BELOW..DEVANAG...
       | 0xE0 0xA4 0x00..0x82    #
       | 0xE0 0xA4 0xBA          #Mn       DEVANAGARI VOWEL SIGN OE
@@ -142,6 +145,7 @@
       | 0xE0 0xAF 0x97          #Mc       TAMIL AU LENGTH MARK
       | 0xE0 0xB0 0x80          #Mn       TELUGU SIGN COMBINING CANDRABINDU ...
       | 0xE0 0xB0 0x84          #Mn       TELUGU SIGN COMBINING ANUSVARA ABOVE
+      | 0xE0 0xB0 0xBC          #Mn       TELUGU SIGN NUKTA
       | 0xE0 0xB0 0xBE..0xFF    #Mn   [3] TELUGU VOWEL SIGN AA..TELUGU VOWEL...
       | 0xE0 0xB1 0x00..0x80    #
       | 0xE0 0xB1 0x86..0x88    #Mn   [3] TELUGU VOWEL SIGN E..TELUGU VOWEL ...
@@ -174,7 +178,7 @@
       | 0xE0 0xB9 0x87..0x8E    #Mn   [8] THAI CHARACTER MAITAIKHU..THAI CHA...
       | 0xE0 0xBA 0xB1          #Mn       LAO VOWEL SIGN MAI KAN
       | 0xE0 0xBA 0xB4..0xBC    #Mn   [9] LAO VOWEL SIGN I..LAO SEMIVOWEL SI...
-      | 0xE0 0xBB 0x88..0x8D    #Mn   [6] LAO TONE MAI EK..LAO NIGGAHITA
+      | 0xE0 0xBB 0x88..0x8E    #Mn   [7] LAO TONE MAI EK..LAO YAMAKKAN
       | 0xE0 0xBC 0x98..0x99    #Mn   [2] TIBETAN ASTROLOGICAL SIGN -KHYUD P...
       | 0xE0 0xBC 0xB5          #Mn       TIBETAN MARK NGAS BZUNG NYI ZLA
       | 0xE0 0xBC 0xB7          #Mn       TIBETAN MARK NGAS BZUNG SGOR RTAGS
@@ -198,7 +202,7 @@
       | 0xE1 0x82 0x9D          #Mn       MYANMAR VOWEL SIGN AITON AI
       | 0xE1 0x8D 0x9D..0x9F    #Mn   [3] ETHIOPIC COMBINING GEMINATION AND ...
       | 0xE1 0x9C 0x92..0x94    #Mn   [3] TAGALOG VOWEL SIGN I..TAGALOG SIGN...
-      | 0xE1 0x9C 0xB2..0xB4    #Mn   [3] HANUNOO VOWEL SIGN I..HANUNOO SIGN...
+      | 0xE1 0x9C 0xB2..0xB3    #Mn   [2] HANUNOO VOWEL SIGN I..HANUNOO VOWE...
       | 0xE1 0x9D 0x92..0x93    #Mn   [2] BUHID VOWEL SIGN I..BUHID VOWEL SI...
       | 0xE1 0x9D 0xB2..0xB3    #Mn   [2] TAGBANWA VOWEL SIGN I..TAGBANWA VO...
       | 0xE1 0x9E 0xB4..0xB5    #Mn   [2] KHMER VOWEL INHERENT AQ..KHMER VOW...
@@ -207,6 +211,7 @@
       | 0xE1 0x9F 0x89..0x93    #Mn  [11] KHMER SIGN MUUSIKATOAN..KHMER SIGN...
       | 0xE1 0x9F 0x9D          #Mn       KHMER SIGN ATTHACAN
       | 0xE1 0xA0 0x8B..0x8D    #Mn   [3] MONGOLIAN FREE VARIATION SELECTOR ...
+      | 0xE1 0xA0 0x8F          #Mn       MONGOLIAN FREE VARIATION SELECTOR ...
       | 0xE1 0xA2 0x85..0x86    #Mn   [2] MONGOLIAN LETTER ALI GALI BALUDA.....
       | 0xE1 0xA2 0xA9          #Mn       MONGOLIAN LETTER ALI GALI DAGALGA
       | 0xE1 0xA4 0xA0..0xA2    #Mn   [3] LIMBU VOWEL SIGN A..LIMBU VOWEL SI...
@@ -224,8 +229,8 @@
       | 0xE1 0xA9 0xBF          #Mn       TAI THAM COMBINING CRYPTOGRAMMIC DOT
       | 0xE1 0xAA 0xB0..0xBD    #Mn  [14] COMBINING DOUBLED CIRCUMFLEX ACCEN...
       | 0xE1 0xAA 0xBE          #Me       COMBINING PARENTHESES OVERLAY
-      | 0xE1 0xAA 0xBF..0xFF    #Mn   [2] COMBINING LATIN SMALL LETTER W BEL...
-      | 0xE1 0xAB 0x00..0x80    #
+      | 0xE1 0xAA 0xBF..0xFF    #Mn  [16] COMBINING LATIN SMALL LETTER W BEL...
+      | 0xE1 0xAB 0x00..0x8E    #
       | 0xE1 0xAC 0x80..0x83    #Mn   [4] BALINESE SIGN ULU RICEM..BALINESE ...
       | 0xE1 0xAC 0xB4          #Mn       BALINESE SIGN REREKAN
       | 0xE1 0xAC 0xB5          #Mc       BALINESE VOWEL SIGN TEDUNG
@@ -249,8 +254,7 @@
       | 0xE1 0xB3 0xAD          #Mn       VEDIC SIGN TIRYAK
       | 0xE1 0xB3 0xB4          #Mn       VEDIC TONE CANDRA ABOVE
       | 0xE1 0xB3 0xB8..0xB9    #Mn   [2] VEDIC TONE RING ABOVE..VEDIC TONE ...
-      | 0xE1 0xB7 0x80..0xB9    #Mn  [58] COMBINING DOTTED GRAVE ACCENT..COM...
-      | 0xE1 0xB7 0xBB..0xBF    #Mn   [5] COMBINING DELETION MARK..COMBINING...
+      | 0xE1 0xB7 0x80..0xBF    #Mn  [64] COMBINING DOTTED GRAVE ACCENT..COM...
       | 0xE2 0x80 0x8C          #Cf       ZERO WIDTH NON-JOINER
       | 0xE2 0x83 0x90..0x9C    #Mn  [13] COMBINING LEFT HARPOON ABOVE..COMB...
       | 0xE2 0x83 0x9D..0xA0    #Me   [4] COMBINING ENCLOSING CIRCLE..COMBIN...
@@ -314,14 +318,19 @@
       | 0xF0 0x90 0xAB 0xA5..0xA6  #Mn   [2] MANICHAEAN ABBREVIATION MARK AB...
       | 0xF0 0x90 0xB4 0xA4..0xA7  #Mn   [4] HANIFI ROHINGYA SIGN HARBAHAY.....
       | 0xF0 0x90 0xBA 0xAB..0xAC  #Mn   [2] YEZIDI COMBINING HAMZA MARK..YE...
+      | 0xF0 0x90 0xBB 0xBD..0xBF  #Mn   [3] ARABIC SMALL LOW WORD SAKTA..AR...
       | 0xF0 0x90 0xBD 0x86..0x90  #Mn  [11] SOGDIAN COMBINING DOT BELOW..SO...
+      | 0xF0 0x90 0xBE 0x82..0x85  #Mn   [4] OLD UYGHUR COMBINING DOT ABOVE....
       | 0xF0 0x91 0x80 0x81     #Mn       BRAHMI SIGN ANUSVARA
       | 0xF0 0x91 0x80 0xB8..0xFF  #Mn  [15] BRAHMI VOWEL SIGN AA..BRAHMI VI...
       | 0xF0 0x91 0x81 0x00..0x86  #
+      | 0xF0 0x91 0x81 0xB0     #Mn       BRAHMI SIGN OLD TAMIL VIRAMA
+      | 0xF0 0x91 0x81 0xB3..0xB4  #Mn   [2] BRAHMI VOWEL SIGN OLD TAMIL SHO...
       | 0xF0 0x91 0x81 0xBF..0xFF  #Mn   [3] BRAHMI NUMBER JOINER..KAITHI SI...
       | 0xF0 0x91 0x82 0x00..0x81  #
       | 0xF0 0x91 0x82 0xB3..0xB6  #Mn   [4] KAITHI VOWEL SIGN U..KAITHI VOW...
       | 0xF0 0x91 0x82 0xB9..0xBA  #Mn   [2] KAITHI SIGN VIRAMA..KAITHI SIGN...
+      | 0xF0 0x91 0x83 0x82     #Mn       KAITHI VOWEL SIGN VOCALIC R
       | 0xF0 0x91 0x84 0x80..0x82  #Mn   [3] CHAKMA SIGN CANDRABINDU..CHAKMA...
       | 0xF0 0x91 0x84 0xA7..0xAB  #Mn   [5] CHAKMA VOWEL SIGN A..CHAKMA VOW...
       | 0xF0 0x91 0x84 0xAD..0xB4  #Mn   [8] CHAKMA VOWEL SIGN AI..CHAKMA MA...
@@ -334,6 +343,7 @@
       | 0xF0 0x91 0x88 0xB4     #Mn       KHOJKI SIGN ANUSVARA
       | 0xF0 0x91 0x88 0xB6..0xB7  #Mn   [2] KHOJKI SIGN NUKTA..KHOJKI SIGN ...
       | 0xF0 0x91 0x88 0xBE     #Mn       KHOJKI SIGN SUKUN
+      | 0xF0 0x91 0x89 0x81     #Mn       KHOJKI VOWEL SIGN VOCALIC R
       | 0xF0 0x91 0x8B 0x9F     #Mn       KHUDAWADI SIGN ANUSVARA
       | 0xF0 0x91 0x8B 0xA3..0xAA  #Mn   [8] KHUDAWADI VOWEL SIGN U..KHUDAWA...
       | 0xF0 0x91 0x8C 0x80..0x81  #Mn   [2] GRANTHA SIGN COMBINING ANUSVARA...
@@ -405,12 +415,21 @@
       | 0xF0 0x91 0xB6 0x95     #Mn       GUNJALA GONDI SIGN ANUSVARA
       | 0xF0 0x91 0xB6 0x97     #Mn       GUNJALA GONDI VIRAMA
       | 0xF0 0x91 0xBB 0xB3..0xB4  #Mn   [2] MAKASAR VOWEL SIGN I..MAKASAR V...
+      | 0xF0 0x91 0xBC 0x80..0x81  #Mn   [2] KAWI SIGN CANDRABINDU..KAWI SIG...
+      | 0xF0 0x91 0xBC 0xB6..0xBA  #Mn   [5] KAWI VOWEL SIGN I..KAWI VOWEL S...
+      | 0xF0 0x91 0xBD 0x80     #Mn       KAWI VOWEL SIGN EU
+      | 0xF0 0x91 0xBD 0x82     #Mn       KAWI CONJOINER
+      | 0xF0 0x93 0x91 0x80     #Mn       EGYPTIAN HIEROGLYPH MIRROR HORIZON...
+      | 0xF0 0x93 0x91 0x87..0x95  #Mn  [15] EGYPTIAN HIEROGLYPH MODIFIER DA...
       | 0xF0 0x96 0xAB 0xB0..0xB4  #Mn   [5] BASSA VAH COMBINING HIGH TONE.....
       | 0xF0 0x96 0xAC 0xB0..0xB6  #Mn   [7] PAHAWH HMONG MARK CIM TUB..PAHA...
       | 0xF0 0x96 0xBD 0x8F     #Mn       MIAO SIGN CONSONANT MODIFIER BAR
       | 0xF0 0x96 0xBE 0x8F..0x92  #Mn   [4] MIAO TONE RIGHT..MIAO TONE BELOW
       | 0xF0 0x96 0xBF 0xA4     #Mn       KHITAN SMALL SCRIPT FILLER
       | 0xF0 0x9B 0xB2 0x9D..0x9E  #Mn   [2] DUPLOYAN THICK LETTER SELECTOR....
+      | 0xF0 0x9C 0xBC 0x80..0xAD  #Mn  [46] ZNAMENNY COMBINING MARK GORAZDO...
+      | 0xF0 0x9C 0xBC 0xB0..0xFF  #Mn  [23] ZNAMENNY COMBINING TONAL RANGE ...
+      | 0xF0 0x9C 0xBD 0x00..0x86  #
       | 0xF0 0x9D 0x85 0xA5     #Mc       MUSICAL SYMBOL COMBINING STEM
       | 0xF0 0x9D 0x85 0xA7..0xA9  #Mn   [3] MUSICAL SYMBOL COMBINING TREMOL...
       | 0xF0 0x9D 0x85 0xAE..0xB2  #Mc   [5] MUSICAL SYMBOL COMBINING FLAG-1...
@@ -431,8 +450,11 @@
       | 0xF0 0x9E 0x80 0x9B..0xA1  #Mn   [7] COMBINING GLAGOLITIC LETTER SHT...
       | 0xF0 0x9E 0x80 0xA3..0xA4  #Mn   [2] COMBINING GLAGOLITIC LETTER YU....
       | 0xF0 0x9E 0x80 0xA6..0xAA  #Mn   [5] COMBINING GLAGOLITIC LETTER YO....
+      | 0xF0 0x9E 0x82 0x8F     #Mn       COMBINING CYRILLIC SMALL LETTER BY...
       | 0xF0 0x9E 0x84 0xB0..0xB6  #Mn   [7] NYIAKENG PUACHUE HMONG TONE-B.....
+      | 0xF0 0x9E 0x8A 0xAE     #Mn       TOTO SIGN RISING TONE
       | 0xF0 0x9E 0x8B 0xAC..0xAF  #Mn   [4] WANCHO TONE TUP..WANCHO TONE KOINI
+      | 0xF0 0x9E 0x93 0xAC..0xAF  #Mn   [4] NAG MUNDARI SIGN MUHOR..NAG MUN...
       | 0xF0 0x9E 0xA3 0x90..0x96  #Mn   [7] MENDE KIKAKUI COMBINING NUMBER ...
       | 0xF0 0x9E 0xA5 0x84..0x8A  #Mn   [7] ADLAM ALIF LENGTHENER..ADLAM NUKTA
       | 0xF0 0x9F 0x8F 0xBB..0xBF  #Sk   [5] EMOJI MODIFIER FITZPATRICK TYPE...
@@ -483,6 +505,7 @@
       | 0xE0 0xB3 0x83..0x84    #Mc   [2] KANNADA VOWEL SIGN VOCALIC R..KANN...
       | 0xE0 0xB3 0x87..0x88    #Mc   [2] KANNADA VOWEL SIGN EE..KANNADA VOW...
       | 0xE0 0xB3 0x8A..0x8B    #Mc   [2] KANNADA VOWEL SIGN O..KANNADA VOWE...
+      | 0xE0 0xB3 0xB3          #Mc       KANNADA SIGN COMBINING ANUSVARA AB...
       | 0xE0 0xB4 0x82..0x83    #Mc   [2] MALAYALAM SIGN ANUSVARA..MALAYALAM...
       | 0xE0 0xB4 0xBF..0xFF    #Mc   [2] MALAYALAM VOWEL SIGN I..MALAYALAM ...
       | 0xE0 0xB5 0x00..0x80    #
@@ -500,6 +523,8 @@
       | 0xE1 0x80 0xBB..0xBC    #Mc   [2] MYANMAR CONSONANT SIGN MEDIAL YA.....
       | 0xE1 0x81 0x96..0x97    #Mc   [2] MYANMAR VOWEL SIGN VOCALIC R..MYAN...
       | 0xE1 0x82 0x84          #Mc       MYANMAR VOWEL SIGN SHAN E
+      | 0xE1 0x9C 0x95          #Mc       TAGALOG SIGN PAMUDPOD
+      | 0xE1 0x9C 0xB4          #Mc       HANUNOO SIGN PAMUDPOD
       | 0xE1 0x9E 0xB6          #Mc       KHMER VOWEL SIGN AA
       | 0xE1 0x9E 0xBE..0xFF    #Mc   [8] KHMER VOWEL SIGN OE..KHMER VOWEL S...
       | 0xE1 0x9F 0x00..0x85    #
@@ -589,7 +614,6 @@
       | 0xF0 0x91 0x9A 0xAC     #Mc       TAKRI SIGN VISARGA
       | 0xF0 0x91 0x9A 0xAE..0xAF  #Mc   [2] TAKRI VOWEL SIGN I..TAKRI VOWEL...
       | 0xF0 0x91 0x9A 0xB6     #Mc       TAKRI SIGN VIRAMA
-      | 0xF0 0x91 0x9C 0xA0..0xA1  #Mc   [2] AHOM VOWEL SIGN A..AHOM VOWEL S...
       | 0xF0 0x91 0x9C 0xA6     #Mc       AHOM VOWEL SIGN E
       | 0xF0 0x91 0xA0 0xAC..0xAE  #Mc   [3] DOGRA VOWEL SIGN AA..DOGRA VOWE...
       | 0xF0 0x91 0xA0 0xB8     #Mc       DOGRA SIGN VISARGA
@@ -613,6 +637,10 @@
       | 0xF0 0x91 0xB6 0x93..0x94  #Mc   [2] GUNJALA GONDI VOWEL SIGN OO..GU...
       | 0xF0 0x91 0xB6 0x96     #Mc       GUNJALA GONDI SIGN VISARGA
       | 0xF0 0x91 0xBB 0xB5..0xB6  #Mc   [2] MAKASAR VOWEL SIGN E..MAKASAR V...
+      | 0xF0 0x91 0xBC 0x83     #Mc       KAWI SIGN VISARGA
+      | 0xF0 0x91 0xBC 0xB4..0xB5  #Mc   [2] KAWI VOWEL SIGN AA..KAWI VOWEL ...
+      | 0xF0 0x91 0xBC 0xBE..0xBF  #Mc   [2] KAWI VOWEL SIGN E..KAWI VOWEL S...
+      | 0xF0 0x91 0xBD 0x81     #Mc       KAWI SIGN KILLER
       | 0xF0 0x96 0xBD 0x91..0xFF  #Mc  [55] MIAO SIGN ASPIRATION..MIAO VOWE...
       | 0xF0 0x96 0xBE 0x00..0x87  #
       | 0xF0 0x96 0xBF 0xB0..0xB1  #Mc   [2] VIETNAMESE ALTERNATE READING MA...
diff --git a/.ci/providerlint/vendor/github.com/apparentlymart/go-textseg/v15/textseg/tables.go b/.ci/providerlint/vendor/github.com/apparentlymart/go-textseg/v15/textseg/tables.go
new file mode 100644
index 00000000000..864268d5890
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/apparentlymart/go-textseg/v15/textseg/tables.go
@@ -0,0 +1,6120 @@
+// Generated by running
+//      maketables --url=http://www.unicode.org/Public/15.0.0/ucd/auxiliary/
+// DO NOT EDIT
+
+package textseg
+
+import (
+	"unicode"
+)
+
+var _GraphemeCR = &unicode.RangeTable{
+	R16: []unicode.Range16{
+		unicode.Range16{Lo: 0xd, Hi: 0xd, Stride: 0x1},
+	},
+	LatinOffset: 1,
+}
+
+var _GraphemeControl = &unicode.RangeTable{
+	R16: []unicode.Range16{
+		unicode.Range16{Lo: 0x0, Hi: 0x9, Stride: 0x1},
+		unicode.Range16{Lo: 0xb, Hi: 0xc, Stride: 0x1},
+		unicode.Range16{Lo: 0xe, Hi: 0x1f, Stride: 0x1},
+		unicode.Range16{Lo: 0x7f, Hi: 0x9f, Stride: 0x1},
+		unicode.Range16{Lo: 0xad, Hi: 0xad, Stride: 0x1},
+		unicode.Range16{Lo: 0x61c, Hi: 0x61c, Stride: 0x1},
+		unicode.Range16{Lo: 0x180e, Hi: 0x180e, Stride: 0x1},
+		unicode.Range16{Lo: 0x200b, Hi: 0x200b, Stride: 0x1},
+		unicode.Range16{Lo: 0x200e, Hi: 0x200f, Stride: 0x1},
+		unicode.Range16{Lo: 0x2028, Hi: 0x2028, Stride: 0x1},
+		unicode.Range16{Lo: 0x2029, Hi: 0x2029, Stride: 0x1},
+		unicode.Range16{Lo: 0x202a, Hi: 0x202e, Stride: 0x1},
+		unicode.Range16{Lo: 0x2060, Hi: 0x2064, Stride: 0x1},
+		unicode.Range16{Lo: 0x2065, Hi: 0x2065, Stride: 0x1},
+		unicode.Range16{Lo: 0x2066, Hi: 0x206f, Stride: 0x1},
+		unicode.Range16{Lo: 0xfeff, Hi: 0xfeff, Stride: 0x1},
+		unicode.Range16{Lo: 0xfff0, Hi: 0xfff8, Stride: 0x1},
+		unicode.Range16{Lo: 0xfff9, Hi: 0xfffb, Stride: 0x1},
+	},
+	R32: []unicode.Range32{
+		unicode.Range32{Lo: 0x13430, Hi: 0x1343f, Stride: 0x1},
+		unicode.Range32{Lo: 0x1bca0, Hi: 0x1bca3, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d173, Hi: 0x1d17a, Stride: 0x1},
+		unicode.Range32{Lo: 0xe0000, Hi: 0xe0000, Stride: 0x1},
+		unicode.Range32{Lo: 0xe0001, Hi: 0xe0001, Stride: 0x1},
+		unicode.Range32{Lo: 0xe0002, Hi: 0xe001f, Stride: 0x1},
+		unicode.Range32{Lo: 0xe0080, Hi: 0xe00ff, Stride: 0x1},
+		unicode.Range32{Lo: 0xe01f0, Hi: 0xe0fff, Stride: 0x1},
+	},
+	LatinOffset: 5,
+}
+
+var _GraphemeExtend = &unicode.RangeTable{
+	R16: []unicode.Range16{
+		unicode.Range16{Lo: 0x300, Hi: 0x36f, Stride: 0x1},
+		unicode.Range16{Lo: 0x483, Hi: 0x487, Stride: 0x1},
+		unicode.Range16{Lo: 0x488, Hi: 0x489, Stride: 0x1},
+		unicode.Range16{Lo: 0x591, Hi: 0x5bd, Stride: 0x1},
+		unicode.Range16{Lo: 0x5bf, Hi: 0x5bf, Stride: 0x1},
+		unicode.Range16{Lo: 0x5c1, Hi: 0x5c2, Stride: 0x1},
+		unicode.Range16{Lo: 0x5c4, Hi: 0x5c5, Stride: 0x1},
+		unicode.Range16{Lo: 0x5c7, Hi: 0x5c7, Stride: 0x1},
+		unicode.Range16{Lo: 0x610, Hi: 0x61a, Stride: 0x1},
+		unicode.Range16{Lo: 0x64b, Hi: 0x65f, Stride: 0x1},
+		unicode.Range16{Lo: 0x670, Hi: 0x670, Stride: 0x1},
+		unicode.Range16{Lo: 0x6d6, Hi: 0x6dc, Stride: 0x1},
+		unicode.Range16{Lo: 0x6df, Hi: 0x6e4, Stride: 0x1},
+		unicode.Range16{Lo: 0x6e7, Hi: 0x6e8, Stride: 0x1},
+		unicode.Range16{Lo: 0x6ea, Hi: 0x6ed, Stride: 0x1},
+		unicode.Range16{Lo: 0x711, Hi: 0x711, Stride: 0x1},
+		unicode.Range16{Lo: 0x730, Hi: 0x74a, Stride: 0x1},
+		unicode.Range16{Lo: 0x7a6, Hi: 0x7b0, Stride: 0x1},
+		unicode.Range16{Lo: 0x7eb, Hi: 0x7f3, Stride: 0x1},
+		unicode.Range16{Lo: 0x7fd, Hi: 0x7fd, Stride: 0x1},
+		unicode.Range16{Lo: 0x816, Hi: 0x819, Stride: 0x1},
+		unicode.Range16{Lo: 0x81b, Hi: 0x823, Stride: 0x1},
+		unicode.Range16{Lo: 0x825, Hi: 0x827, Stride: 0x1},
+		unicode.Range16{Lo: 0x829, Hi: 0x82d, Stride: 0x1},
+		unicode.Range16{Lo: 0x859, Hi: 0x85b, Stride: 0x1},
+		unicode.Range16{Lo: 0x898, Hi: 0x89f, Stride: 0x1},
+		unicode.Range16{Lo: 0x8ca, Hi: 0x8e1, Stride: 0x1},
+		unicode.Range16{Lo: 0x8e3, Hi: 0x902, Stride: 0x1},
+		unicode.Range16{Lo: 0x93a, Hi: 0x93a, Stride: 0x1},
+		unicode.Range16{Lo: 0x93c, Hi: 0x93c, Stride: 0x1},
+		unicode.Range16{Lo: 0x941, Hi: 0x948, Stride: 0x1},
+		unicode.Range16{Lo: 0x94d, Hi: 0x94d, Stride: 0x1},
+		unicode.Range16{Lo: 0x951, Hi: 0x957, Stride: 0x1},
+		unicode.Range16{Lo: 0x962, Hi: 0x963, Stride: 0x1},
+		unicode.Range16{Lo: 0x981, Hi: 0x981, Stride: 0x1},
+		unicode.Range16{Lo: 0x9bc, Hi: 0x9bc, Stride: 0x1},
+		unicode.Range16{Lo: 0x9be, Hi: 0x9be, Stride: 0x1},
+		unicode.Range16{Lo: 0x9c1, Hi: 0x9c4, Stride: 0x1},
+		unicode.Range16{Lo: 0x9cd, Hi: 0x9cd, Stride: 0x1},
+		unicode.Range16{Lo: 0x9d7, Hi: 0x9d7, Stride: 0x1},
+		unicode.Range16{Lo: 0x9e2, Hi: 0x9e3, Stride: 0x1},
+		unicode.Range16{Lo: 0x9fe, Hi: 0x9fe, Stride: 0x1},
+		unicode.Range16{Lo: 0xa01, Hi: 0xa02, Stride: 0x1},
+		unicode.Range16{Lo: 0xa3c, Hi: 0xa3c, Stride: 0x1},
+		unicode.Range16{Lo: 0xa41, Hi: 0xa42, Stride: 0x1},
+		unicode.Range16{Lo: 0xa47, Hi: 0xa48, Stride: 0x1},
+		unicode.Range16{Lo: 0xa4b, Hi: 0xa4d, Stride: 0x1},
+		unicode.Range16{Lo: 0xa51, Hi: 0xa51, Stride: 0x1},
+		unicode.Range16{Lo: 0xa70, Hi: 0xa71, Stride: 0x1},
+		unicode.Range16{Lo: 0xa75, Hi: 0xa75, Stride: 0x1},
+		unicode.Range16{Lo: 0xa81, Hi: 0xa82, Stride: 0x1},
+		unicode.Range16{Lo: 0xabc, Hi: 0xabc, Stride: 0x1},
+		unicode.Range16{Lo: 0xac1, Hi: 0xac5, Stride: 0x1},
+		unicode.Range16{Lo: 0xac7, Hi: 0xac8, Stride: 0x1},
+		unicode.Range16{Lo: 0xacd, Hi: 0xacd, Stride: 0x1},
+		unicode.Range16{Lo: 0xae2, Hi: 0xae3, Stride: 0x1},
+		unicode.Range16{Lo: 0xafa, Hi: 0xaff, Stride: 0x1},
+		unicode.Range16{Lo: 0xb01, Hi: 0xb01, Stride: 0x1},
+		unicode.Range16{Lo: 0xb3c, Hi: 0xb3c, Stride: 0x1},
+		unicode.Range16{Lo: 0xb3e, Hi: 0xb3e, Stride: 0x1},
+		unicode.Range16{Lo: 0xb3f, Hi: 0xb3f, Stride: 0x1},
+		unicode.Range16{Lo: 0xb41, Hi: 0xb44, Stride: 0x1},
+		unicode.Range16{Lo: 0xb4d, Hi: 0xb4d, Stride: 0x1},
+		unicode.Range16{Lo: 0xb55, Hi: 0xb56, Stride: 0x1},
+		unicode.Range16{Lo: 0xb57, Hi: 0xb57, Stride: 0x1},
+		unicode.Range16{Lo: 0xb62, Hi: 0xb63, Stride: 0x1},
+		unicode.Range16{Lo: 0xb82, Hi: 0xb82, Stride: 0x1},
+		unicode.Range16{Lo: 0xbbe, Hi: 0xbbe, Stride: 0x1},
+		unicode.Range16{Lo: 0xbc0, Hi: 0xbc0, Stride: 0x1},
+		unicode.Range16{Lo: 0xbcd, Hi: 0xbcd, Stride: 0x1},
+		unicode.Range16{Lo: 0xbd7, Hi: 0xbd7, Stride: 0x1},
+		unicode.Range16{Lo: 0xc00, Hi: 0xc00, Stride: 0x1},
+		unicode.Range16{Lo: 0xc04, Hi: 0xc04, Stride: 0x1},
+		unicode.Range16{Lo: 0xc3c, Hi: 0xc3c, Stride: 0x1},
+		unicode.Range16{Lo: 0xc3e, Hi: 0xc40, Stride: 0x1},
+		unicode.Range16{Lo: 0xc46, Hi: 0xc48, Stride: 0x1},
+		unicode.Range16{Lo: 0xc4a, Hi: 0xc4d, Stride: 0x1},
+		unicode.Range16{Lo: 0xc55, Hi: 0xc56, Stride: 0x1},
+		unicode.Range16{Lo: 0xc62, Hi: 0xc63, Stride: 0x1},
+		unicode.Range16{Lo: 0xc81, Hi: 0xc81, Stride: 0x1},
+		unicode.Range16{Lo: 0xcbc, Hi: 0xcbc, Stride: 0x1},
+		unicode.Range16{Lo: 0xcbf, Hi: 0xcbf, Stride: 0x1},
+		unicode.Range16{Lo: 0xcc2, Hi: 0xcc2, Stride: 0x1},
+		unicode.Range16{Lo: 0xcc6, Hi: 0xcc6, Stride: 0x1},
+		unicode.Range16{Lo: 0xccc, Hi: 0xccd, Stride: 0x1},
+		unicode.Range16{Lo: 0xcd5, Hi: 0xcd6, Stride: 0x1},
+		unicode.Range16{Lo: 0xce2, Hi: 0xce3, Stride: 0x1},
+		unicode.Range16{Lo: 0xd00, Hi: 0xd01, Stride: 0x1},
+		unicode.Range16{Lo: 0xd3b, Hi: 0xd3c, Stride: 0x1},
+		unicode.Range16{Lo: 0xd3e, Hi: 0xd3e, Stride: 0x1},
+		unicode.Range16{Lo: 0xd41, Hi: 0xd44, Stride: 0x1},
+		unicode.Range16{Lo: 0xd4d, Hi: 0xd4d, Stride: 0x1},
+		unicode.Range16{Lo: 0xd57, Hi: 0xd57, Stride: 0x1},
+		unicode.Range16{Lo: 0xd62, Hi: 0xd63, Stride: 0x1},
+		unicode.Range16{Lo: 0xd81, Hi: 0xd81, Stride: 0x1},
+		unicode.Range16{Lo: 0xdca, Hi: 0xdca, Stride: 0x1},
+		unicode.Range16{Lo: 0xdcf, Hi: 0xdcf, Stride: 0x1},
+		unicode.Range16{Lo: 0xdd2, Hi: 0xdd4, Stride: 0x1},
+		unicode.Range16{Lo: 0xdd6, Hi: 0xdd6, Stride: 0x1},
+		unicode.Range16{Lo: 0xddf, Hi: 0xddf, Stride: 0x1},
+		unicode.Range16{Lo: 0xe31, Hi: 0xe31, Stride: 0x1},
+		unicode.Range16{Lo: 0xe34, Hi: 0xe3a, Stride: 0x1},
+		unicode.Range16{Lo: 0xe47, Hi: 0xe4e, Stride: 0x1},
+		unicode.Range16{Lo: 0xeb1, Hi: 0xeb1, Stride: 0x1},
+		unicode.Range16{Lo: 0xeb4, Hi: 0xebc, Stride: 0x1},
+		unicode.Range16{Lo: 0xec8, Hi: 0xece, Stride: 0x1},
+		unicode.Range16{Lo: 0xf18, Hi: 0xf19, Stride: 0x1},
+		unicode.Range16{Lo: 0xf35, Hi: 0xf35, Stride: 0x1},
+		unicode.Range16{Lo: 0xf37, Hi: 0xf37, Stride: 0x1},
+		unicode.Range16{Lo: 0xf39, Hi: 0xf39, Stride: 0x1},
+		unicode.Range16{Lo: 0xf71, Hi: 0xf7e, Stride: 0x1},
+		unicode.Range16{Lo: 0xf80, Hi: 0xf84, Stride: 0x1},
+		unicode.Range16{Lo: 0xf86, Hi: 0xf87, Stride: 0x1},
+		unicode.Range16{Lo: 0xf8d, Hi: 0xf97, Stride: 0x1},
+		unicode.Range16{Lo: 0xf99, Hi: 0xfbc, Stride: 0x1},
+		unicode.Range16{Lo: 0xfc6, Hi: 0xfc6, Stride: 0x1},
+		unicode.Range16{Lo: 0x102d, Hi: 0x1030, Stride: 0x1},
+		unicode.Range16{Lo: 0x1032, Hi: 0x1037, Stride: 0x1},
+		unicode.Range16{Lo: 0x1039, Hi: 0x103a, Stride: 0x1},
+		unicode.Range16{Lo: 0x103d, Hi: 0x103e, Stride: 0x1},
+		unicode.Range16{Lo: 0x1058, Hi: 0x1059, Stride: 0x1},
+		unicode.Range16{Lo: 0x105e, Hi: 0x1060, Stride: 0x1},
+		unicode.Range16{Lo: 0x1071, Hi: 0x1074, Stride: 0x1},
+		unicode.Range16{Lo: 0x1082, Hi: 0x1082, Stride: 0x1},
+		unicode.Range16{Lo: 0x1085, Hi: 0x1086, Stride: 0x1},
+		unicode.Range16{Lo: 0x108d, Hi: 0x108d, Stride: 0x1},
+		unicode.Range16{Lo: 0x109d, Hi: 0x109d, Stride: 0x1},
+		unicode.Range16{Lo: 0x135d, Hi: 0x135f, Stride: 0x1},
+		unicode.Range16{Lo: 0x1712, Hi: 0x1714, Stride: 0x1},
+		unicode.Range16{Lo: 0x1732, Hi: 0x1733, Stride: 0x1},
+		unicode.Range16{Lo: 0x1752, Hi: 0x1753, Stride: 0x1},
+		unicode.Range16{Lo: 0x1772, Hi: 0x1773, Stride: 0x1},
+		unicode.Range16{Lo: 0x17b4, Hi: 0x17b5, Stride: 0x1},
+		unicode.Range16{Lo: 0x17b7, Hi: 0x17bd, Stride: 0x1},
+		unicode.Range16{Lo: 0x17c6, Hi: 0x17c6, Stride: 0x1},
+		unicode.Range16{Lo: 0x17c9, Hi: 0x17d3, Stride: 0x1},
+		unicode.Range16{Lo: 0x17dd, Hi: 0x17dd, Stride: 0x1},
+		unicode.Range16{Lo: 0x180b, Hi: 0x180d, Stride: 0x1},
+		unicode.Range16{Lo: 0x180f, Hi: 0x180f, Stride: 0x1},
+		unicode.Range16{Lo: 0x1885, Hi: 0x1886, Stride: 0x1},
+		unicode.Range16{Lo: 0x18a9, Hi: 0x18a9, Stride: 0x1},
+		unicode.Range16{Lo: 0x1920, Hi: 0x1922, Stride: 0x1},
+		unicode.Range16{Lo: 0x1927, Hi: 0x1928, Stride: 0x1},
+		unicode.Range16{Lo: 0x1932, Hi: 0x1932, Stride: 0x1},
+		unicode.Range16{Lo: 0x1939, Hi: 0x193b, Stride: 0x1},
+		unicode.Range16{Lo: 0x1a17, Hi: 0x1a18, Stride: 0x1},
+		unicode.Range16{Lo: 0x1a1b, Hi: 0x1a1b, Stride: 0x1},
+		unicode.Range16{Lo: 0x1a56, Hi: 0x1a56, Stride: 0x1},
+		unicode.Range16{Lo: 0x1a58, Hi: 0x1a5e, Stride: 0x1},
+		unicode.Range16{Lo: 0x1a60, Hi: 0x1a60, Stride: 0x1},
+		unicode.Range16{Lo: 0x1a62, Hi: 0x1a62, Stride: 0x1},
+		unicode.Range16{Lo: 0x1a65, Hi: 0x1a6c, Stride: 0x1},
+		unicode.Range16{Lo: 0x1a73, Hi: 0x1a7c, Stride: 0x1},
+		unicode.Range16{Lo: 0x1a7f, Hi: 0x1a7f, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ab0, Hi: 0x1abd, Stride: 0x1},
+		unicode.Range16{Lo: 0x1abe, Hi: 0x1abe, Stride: 0x1},
+		unicode.Range16{Lo: 0x1abf, Hi: 0x1ace, Stride: 0x1},
+		unicode.Range16{Lo: 0x1b00, Hi: 0x1b03, Stride: 0x1},
+		unicode.Range16{Lo: 0x1b34, Hi: 0x1b34, Stride: 0x1},
+		unicode.Range16{Lo: 0x1b35, Hi: 0x1b35, Stride: 0x1},
+		unicode.Range16{Lo: 0x1b36, Hi: 0x1b3a, Stride: 0x1},
+		unicode.Range16{Lo: 0x1b3c, Hi: 0x1b3c, Stride: 0x1},
+		unicode.Range16{Lo: 0x1b42, Hi: 0x1b42, Stride: 0x1},
+		unicode.Range16{Lo: 0x1b6b, Hi: 0x1b73, Stride: 0x1},
+		unicode.Range16{Lo: 0x1b80, Hi: 0x1b81, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ba2, Hi: 0x1ba5, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ba8, Hi: 0x1ba9, Stride: 0x1},
+		unicode.Range16{Lo: 0x1bab, Hi: 0x1bad, Stride: 0x1},
+		unicode.Range16{Lo: 0x1be6, Hi: 0x1be6, Stride: 0x1},
+		unicode.Range16{Lo: 0x1be8, Hi: 0x1be9, Stride: 0x1},
+		unicode.Range16{Lo: 0x1bed, Hi: 0x1bed, Stride: 0x1},
+		unicode.Range16{Lo: 0x1bef, Hi: 0x1bf1, Stride: 0x1},
+		unicode.Range16{Lo: 0x1c2c, Hi: 0x1c33, Stride: 0x1},
+		unicode.Range16{Lo: 0x1c36, Hi: 0x1c37, Stride: 0x1},
+		unicode.Range16{Lo: 0x1cd0, Hi: 0x1cd2, Stride: 0x1},
+		unicode.Range16{Lo: 0x1cd4, Hi: 0x1ce0, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ce2, Hi: 0x1ce8, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ced, Hi: 0x1ced, Stride: 0x1},
+		unicode.Range16{Lo: 0x1cf4, Hi: 0x1cf4, Stride: 0x1},
+		unicode.Range16{Lo: 0x1cf8, Hi: 0x1cf9, Stride: 0x1},
+		unicode.Range16{Lo: 0x1dc0, Hi: 0x1dff, Stride: 0x1},
+		unicode.Range16{Lo: 0x200c, Hi: 0x200c, Stride: 0x1},
+		unicode.Range16{Lo: 0x20d0, Hi: 0x20dc, Stride: 0x1},
+		unicode.Range16{Lo: 0x20dd, Hi: 0x20e0, Stride: 0x1},
+		unicode.Range16{Lo: 0x20e1, Hi: 0x20e1, Stride: 0x1},
+		unicode.Range16{Lo: 0x20e2, Hi: 0x20e4, Stride: 0x1},
+		unicode.Range16{Lo: 0x20e5, Hi: 0x20f0, Stride: 0x1},
+		unicode.Range16{Lo: 0x2cef, Hi: 0x2cf1, Stride: 0x1},
+		unicode.Range16{Lo: 0x2d7f, Hi: 0x2d7f, Stride: 0x1},
+		unicode.Range16{Lo: 0x2de0, Hi: 0x2dff, Stride: 0x1},
+		unicode.Range16{Lo: 0x302a, Hi: 0x302d, Stride: 0x1},
+		unicode.Range16{Lo: 0x302e, Hi: 0x302f, Stride: 0x1},
+		unicode.Range16{Lo: 0x3099, Hi: 0x309a, Stride: 0x1},
+		unicode.Range16{Lo: 0xa66f, Hi: 0xa66f, Stride: 0x1},
+		unicode.Range16{Lo: 0xa670, Hi: 0xa672, Stride: 0x1},
+		unicode.Range16{Lo: 0xa674, Hi: 0xa67d, Stride: 0x1},
+		unicode.Range16{Lo: 0xa69e, Hi: 0xa69f, Stride: 0x1},
+		unicode.Range16{Lo: 0xa6f0, Hi: 0xa6f1, Stride: 0x1},
+		unicode.Range16{Lo: 0xa802, Hi: 0xa802, Stride: 0x1},
+		unicode.Range16{Lo: 0xa806, Hi: 0xa806, Stride: 0x1},
+		unicode.Range16{Lo: 0xa80b, Hi: 0xa80b, Stride: 0x1},
+		unicode.Range16{Lo: 0xa825, Hi: 0xa826, Stride: 0x1},
+		unicode.Range16{Lo: 0xa82c, Hi: 0xa82c, Stride: 0x1},
+		unicode.Range16{Lo: 0xa8c4, Hi: 0xa8c5, Stride: 0x1},
+		unicode.Range16{Lo: 0xa8e0, Hi: 0xa8f1, Stride: 0x1},
+		unicode.Range16{Lo: 0xa8ff, Hi: 0xa8ff, Stride: 0x1},
+		unicode.Range16{Lo: 0xa926, Hi: 0xa92d, Stride: 0x1},
+		unicode.Range16{Lo: 0xa947, Hi: 0xa951, Stride: 0x1},
+		unicode.Range16{Lo: 0xa980, Hi: 0xa982, Stride: 0x1},
+		unicode.Range16{Lo: 0xa9b3, Hi: 0xa9b3, Stride: 0x1},
+		unicode.Range16{Lo: 0xa9b6, Hi: 0xa9b9, Stride: 0x1},
+		unicode.Range16{Lo: 0xa9bc, Hi: 0xa9bd, Stride: 0x1},
+		unicode.Range16{Lo: 0xa9e5, Hi: 0xa9e5, Stride: 0x1},
+		unicode.Range16{Lo: 0xaa29, Hi: 0xaa2e, Stride: 0x1},
+		unicode.Range16{Lo: 0xaa31, Hi: 0xaa32, Stride: 0x1},
+		unicode.Range16{Lo: 0xaa35, Hi: 0xaa36, Stride: 0x1},
+		unicode.Range16{Lo: 0xaa43, Hi: 0xaa43, Stride: 0x1},
+		unicode.Range16{Lo: 0xaa4c, Hi: 0xaa4c, Stride: 0x1},
+		unicode.Range16{Lo: 0xaa7c, Hi: 0xaa7c, Stride: 0x1},
+		unicode.Range16{Lo: 0xaab0, Hi: 0xaab0, Stride: 0x1},
+		unicode.Range16{Lo: 0xaab2, Hi: 0xaab4, Stride: 0x1},
+		unicode.Range16{Lo: 0xaab7, Hi: 0xaab8, Stride: 0x1},
+		unicode.Range16{Lo: 0xaabe, Hi: 0xaabf, Stride: 0x1},
+		unicode.Range16{Lo: 0xaac1, Hi: 0xaac1, Stride: 0x1},
+		unicode.Range16{Lo: 0xaaec, Hi: 0xaaed, Stride: 0x1},
+		unicode.Range16{Lo: 0xaaf6, Hi: 0xaaf6, Stride: 0x1},
+		unicode.Range16{Lo: 0xabe5, Hi: 0xabe5, Stride: 0x1},
+		unicode.Range16{Lo: 0xabe8, Hi: 0xabe8, Stride: 0x1},
+		unicode.Range16{Lo: 0xabed, Hi: 0xabed, Stride: 0x1},
+		unicode.Range16{Lo: 0xfb1e, Hi: 0xfb1e, Stride: 0x1},
+		unicode.Range16{Lo: 0xfe00, Hi: 0xfe0f, Stride: 0x1},
+		unicode.Range16{Lo: 0xfe20, Hi: 0xfe2f, Stride: 0x1},
+		unicode.Range16{Lo: 0xff9e, Hi: 0xff9f, Stride: 0x1},
+	},
+	R32: []unicode.Range32{
+		unicode.Range32{Lo: 0x101fd, Hi: 0x101fd, Stride: 0x1},
+		unicode.Range32{Lo: 0x102e0, Hi: 0x102e0, Stride: 0x1},
+		unicode.Range32{Lo: 0x10376, Hi: 0x1037a, Stride: 0x1},
+		unicode.Range32{Lo: 0x10a01, Hi: 0x10a03, Stride: 0x1},
+		unicode.Range32{Lo: 0x10a05, Hi: 0x10a06, Stride: 0x1},
+		unicode.Range32{Lo: 0x10a0c, Hi: 0x10a0f, Stride: 0x1},
+		unicode.Range32{Lo: 0x10a38, Hi: 0x10a3a, Stride: 0x1},
+		unicode.Range32{Lo: 0x10a3f, Hi: 0x10a3f, Stride: 0x1},
+		unicode.Range32{Lo: 0x10ae5, Hi: 0x10ae6, Stride: 0x1},
+		unicode.Range32{Lo: 0x10d24, Hi: 0x10d27, Stride: 0x1},
+		unicode.Range32{Lo: 0x10eab, Hi: 0x10eac, Stride: 0x1},
+		unicode.Range32{Lo: 0x10efd, Hi: 0x10eff, Stride: 0x1},
+		unicode.Range32{Lo: 0x10f46, Hi: 0x10f50, Stride: 0x1},
+		unicode.Range32{Lo: 0x10f82, Hi: 0x10f85, Stride: 0x1},
+		unicode.Range32{Lo: 0x11001, Hi: 0x11001, Stride: 0x1},
+		unicode.Range32{Lo: 0x11038, Hi: 0x11046, Stride: 0x1},
+		unicode.Range32{Lo: 0x11070, Hi: 0x11070, Stride: 0x1},
+		unicode.Range32{Lo: 0x11073, Hi: 0x11074, Stride: 0x1},
+		unicode.Range32{Lo: 0x1107f, Hi: 0x11081, Stride: 0x1},
+		unicode.Range32{Lo: 0x110b3, Hi: 0x110b6, Stride: 0x1},
+		unicode.Range32{Lo: 0x110b9, Hi: 0x110ba, Stride: 0x1},
+		unicode.Range32{Lo: 0x110c2, Hi: 0x110c2, Stride: 0x1},
+		unicode.Range32{Lo: 0x11100, Hi: 0x11102, Stride: 0x1},
+		unicode.Range32{Lo: 0x11127, Hi: 0x1112b, Stride: 0x1},
+		unicode.Range32{Lo: 0x1112d, Hi: 0x11134, Stride: 0x1},
+		unicode.Range32{Lo: 0x11173, Hi: 0x11173, Stride: 0x1},
+		unicode.Range32{Lo: 0x11180, Hi: 0x11181, Stride: 0x1},
+		unicode.Range32{Lo: 0x111b6, Hi: 0x111be, Stride: 0x1},
+		unicode.Range32{Lo: 0x111c9, Hi: 0x111cc, Stride: 0x1},
+		unicode.Range32{Lo: 0x111cf, Hi: 0x111cf, Stride: 0x1},
+		unicode.Range32{Lo: 0x1122f, Hi: 0x11231, Stride: 0x1},
+		unicode.Range32{Lo: 0x11234, Hi: 0x11234, Stride: 0x1},
+		unicode.Range32{Lo: 0x11236, Hi: 0x11237, Stride: 0x1},
+		unicode.Range32{Lo: 0x1123e, Hi: 0x1123e, Stride: 0x1},
+		unicode.Range32{Lo: 0x11241, Hi: 0x11241, Stride: 0x1},
+		unicode.Range32{Lo: 0x112df, Hi: 0x112df, Stride: 0x1},
+		unicode.Range32{Lo: 0x112e3, Hi: 0x112ea, Stride: 0x1},
+		unicode.Range32{Lo: 0x11300, Hi: 0x11301, Stride: 0x1},
+		unicode.Range32{Lo: 0x1133b, Hi: 0x1133c, Stride: 0x1},
+		unicode.Range32{Lo: 0x1133e, Hi: 0x1133e, Stride: 0x1},
+		unicode.Range32{Lo: 0x11340, Hi: 0x11340, Stride: 0x1},
+		unicode.Range32{Lo: 0x11357, Hi: 0x11357, Stride: 0x1},
+		unicode.Range32{Lo: 0x11366, Hi: 0x1136c, Stride: 0x1},
+		unicode.Range32{Lo: 0x11370, Hi: 0x11374, Stride: 0x1},
+		unicode.Range32{Lo: 0x11438, Hi: 0x1143f, Stride: 0x1},
+		unicode.Range32{Lo: 0x11442, Hi: 0x11444, Stride: 0x1},
+		unicode.Range32{Lo: 0x11446, Hi: 0x11446, Stride: 0x1},
+		unicode.Range32{Lo: 0x1145e, Hi: 0x1145e, Stride: 0x1},
+		unicode.Range32{Lo: 0x114b0, Hi: 0x114b0, Stride: 0x1},
+		unicode.Range32{Lo: 0x114b3, Hi: 0x114b8, Stride: 0x1},
+		unicode.Range32{Lo: 0x114ba, Hi: 0x114ba, Stride: 0x1},
+		unicode.Range32{Lo: 0x114bd, Hi: 0x114bd, Stride: 0x1},
+		unicode.Range32{Lo: 0x114bf, Hi: 0x114c0, Stride: 0x1},
+		unicode.Range32{Lo: 0x114c2, Hi: 0x114c3, Stride: 0x1},
+		unicode.Range32{Lo: 0x115af, Hi: 0x115af, Stride: 0x1},
+		unicode.Range32{Lo: 0x115b2, Hi: 0x115b5, Stride: 0x1},
+		unicode.Range32{Lo: 0x115bc, Hi: 0x115bd, Stride: 0x1},
+		unicode.Range32{Lo: 0x115bf, Hi: 0x115c0, Stride: 0x1},
+		unicode.Range32{Lo: 0x115dc, Hi: 0x115dd, Stride: 0x1},
+		unicode.Range32{Lo: 0x11633, Hi: 0x1163a, Stride: 0x1},
+		unicode.Range32{Lo: 0x1163d, Hi: 0x1163d, Stride: 0x1},
+		unicode.Range32{Lo: 0x1163f, Hi: 0x11640, Stride: 0x1},
+		unicode.Range32{Lo: 0x116ab, Hi: 0x116ab, Stride: 0x1},
+		unicode.Range32{Lo: 0x116ad, Hi: 0x116ad, Stride: 0x1},
+		unicode.Range32{Lo: 0x116b0, Hi: 0x116b5, Stride: 0x1},
+		unicode.Range32{Lo: 0x116b7, Hi: 0x116b7, Stride: 0x1},
+		unicode.Range32{Lo: 0x1171d, Hi: 0x1171f, Stride: 0x1},
+		unicode.Range32{Lo: 0x11722, Hi: 0x11725, Stride: 0x1},
+		unicode.Range32{Lo: 0x11727, Hi: 0x1172b, Stride: 0x1},
+		unicode.Range32{Lo: 0x1182f, Hi: 0x11837, Stride: 0x1},
+		unicode.Range32{Lo: 0x11839, Hi: 0x1183a, Stride: 0x1},
+		unicode.Range32{Lo: 0x11930, Hi: 0x11930, Stride: 0x1},
+		unicode.Range32{Lo: 0x1193b, Hi: 0x1193c, Stride: 0x1},
+		unicode.Range32{Lo: 0x1193e, Hi: 0x1193e, Stride: 0x1},
+		unicode.Range32{Lo: 0x11943, Hi: 0x11943, Stride: 0x1},
+		unicode.Range32{Lo: 0x119d4, Hi: 0x119d7, Stride: 0x1},
+		unicode.Range32{Lo: 0x119da, Hi: 0x119db, Stride: 0x1},
+		unicode.Range32{Lo: 0x119e0, Hi: 0x119e0, Stride: 0x1},
+		unicode.Range32{Lo: 0x11a01, Hi: 0x11a0a, Stride: 0x1},
+		unicode.Range32{Lo: 0x11a33, Hi: 0x11a38, Stride: 0x1},
+		unicode.Range32{Lo: 0x11a3b, Hi: 0x11a3e, Stride: 0x1},
+		unicode.Range32{Lo: 0x11a47, Hi: 0x11a47, Stride: 0x1},
+		unicode.Range32{Lo: 0x11a51, Hi: 0x11a56, Stride: 0x1},
+		unicode.Range32{Lo: 0x11a59, Hi: 0x11a5b, Stride: 0x1},
+		unicode.Range32{Lo: 0x11a8a, Hi: 0x11a96, Stride: 0x1},
+		unicode.Range32{Lo: 0x11a98, Hi: 0x11a99, Stride: 0x1},
+		unicode.Range32{Lo: 0x11c30, Hi: 0x11c36, Stride: 0x1},
+		unicode.Range32{Lo: 0x11c38, Hi: 0x11c3d, Stride: 0x1},
+		unicode.Range32{Lo: 0x11c3f, Hi: 0x11c3f, Stride: 0x1},
+		unicode.Range32{Lo: 0x11c92, Hi: 0x11ca7, Stride: 0x1},
+		unicode.Range32{Lo: 0x11caa, Hi: 0x11cb0, Stride: 0x1},
+		unicode.Range32{Lo: 0x11cb2, Hi: 0x11cb3, Stride: 0x1},
+		unicode.Range32{Lo: 0x11cb5, Hi: 0x11cb6, Stride: 0x1},
+		unicode.Range32{Lo: 0x11d31, Hi: 0x11d36, Stride: 0x1},
+		unicode.Range32{Lo: 0x11d3a, Hi: 0x11d3a, Stride: 0x1},
+		unicode.Range32{Lo: 0x11d3c, Hi: 0x11d3d, Stride: 0x1},
+		unicode.Range32{Lo: 0x11d3f, Hi: 0x11d45, Stride: 0x1},
+		unicode.Range32{Lo: 0x11d47, Hi: 0x11d47, Stride: 0x1},
+		unicode.Range32{Lo: 0x11d90, Hi: 0x11d91, Stride: 0x1},
+		unicode.Range32{Lo: 0x11d95, Hi: 0x11d95, Stride: 0x1},
+		unicode.Range32{Lo: 0x11d97, Hi: 0x11d97, Stride: 0x1},
+		unicode.Range32{Lo: 0x11ef3, Hi: 0x11ef4, Stride: 0x1},
+		unicode.Range32{Lo: 0x11f00, Hi: 0x11f01, Stride: 0x1},
+		unicode.Range32{Lo: 0x11f36, Hi: 0x11f3a, Stride: 0x1},
+		unicode.Range32{Lo: 0x11f40, Hi: 0x11f40, Stride: 0x1},
+		unicode.Range32{Lo: 0x11f42, Hi: 0x11f42, Stride: 0x1},
+		unicode.Range32{Lo: 0x13440, Hi: 0x13440, Stride: 0x1},
+		unicode.Range32{Lo: 0x13447, Hi: 0x13455, Stride: 0x1},
+		unicode.Range32{Lo: 0x16af0, Hi: 0x16af4, Stride: 0x1},
+		unicode.Range32{Lo: 0x16b30, Hi: 0x16b36, Stride: 0x1},
+		unicode.Range32{Lo: 0x16f4f, Hi: 0x16f4f, Stride: 0x1},
+		unicode.Range32{Lo: 0x16f8f, Hi: 0x16f92, Stride: 0x1},
+		unicode.Range32{Lo: 0x16fe4, Hi: 0x16fe4, Stride: 0x1},
+		unicode.Range32{Lo: 0x1bc9d, Hi: 0x1bc9e, Stride: 0x1},
+		unicode.Range32{Lo: 0x1cf00, Hi: 0x1cf2d, Stride: 0x1},
+		unicode.Range32{Lo: 0x1cf30, Hi: 0x1cf46, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d165, Hi: 0x1d165, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d167, Hi: 0x1d169, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d16e, Hi: 0x1d172, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d17b, Hi: 0x1d182, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d185, Hi: 0x1d18b, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d1aa, Hi: 0x1d1ad, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d242, Hi: 0x1d244, Stride: 0x1},
+		unicode.Range32{Lo: 0x1da00, Hi: 0x1da36, Stride: 0x1},
+		unicode.Range32{Lo: 0x1da3b, Hi: 0x1da6c, Stride: 0x1},
+		unicode.Range32{Lo: 0x1da75, Hi: 0x1da75, Stride: 0x1},
+		unicode.Range32{Lo: 0x1da84, Hi: 0x1da84, Stride: 0x1},
+		unicode.Range32{Lo: 0x1da9b, Hi: 0x1da9f, Stride: 0x1},
+		unicode.Range32{Lo: 0x1daa1, Hi: 0x1daaf, Stride: 0x1},
+		unicode.Range32{Lo: 0x1e000, Hi: 0x1e006, Stride: 0x1},
+		unicode.Range32{Lo: 0x1e008, Hi: 0x1e018, Stride: 0x1},
+		unicode.Range32{Lo: 0x1e01b, Hi: 0x1e021, Stride: 0x1},
+		unicode.Range32{Lo: 0x1e023, Hi: 0x1e024, Stride: 0x1},
+		unicode.Range32{Lo: 0x1e026, Hi: 0x1e02a, Stride: 0x1},
+		unicode.Range32{Lo: 0x1e08f, Hi: 0x1e08f, Stride: 0x1},
+		unicode.Range32{Lo: 0x1e130, Hi: 0x1e136, Stride: 0x1},
+		unicode.Range32{Lo: 0x1e2ae, Hi: 0x1e2ae, Stride: 0x1},
+		unicode.Range32{Lo: 0x1e2ec, Hi: 0x1e2ef, Stride: 0x1},
+		unicode.Range32{Lo: 0x1e4ec, Hi: 0x1e4ef, Stride: 0x1},
+		unicode.Range32{Lo: 0x1e8d0, Hi: 0x1e8d6, Stride: 0x1},
+		unicode.Range32{Lo: 0x1e944, Hi: 0x1e94a, Stride: 0x1},
+		unicode.Range32{Lo: 0x1f3fb, Hi: 0x1f3ff, Stride: 0x1},
+		unicode.Range32{Lo: 0xe0020, Hi: 0xe007f, Stride: 0x1},
+		unicode.Range32{Lo: 0xe0100, Hi: 0xe01ef, Stride: 0x1},
+	},
+	LatinOffset: 0,
+}
+
+var _GraphemeL = &unicode.RangeTable{
+	R16: []unicode.Range16{
+		unicode.Range16{Lo: 0x1100, Hi: 0x115f, Stride: 0x1},
+		unicode.Range16{Lo: 0xa960, Hi: 0xa97c, Stride: 0x1},
+	},
+	LatinOffset: 0,
+}
+
+var _GraphemeLF = &unicode.RangeTable{
+	R16: []unicode.Range16{
+		unicode.Range16{Lo: 0xa, Hi: 0xa, Stride: 0x1},
+	},
+	LatinOffset: 1,
+}
+
+var _GraphemeLV = &unicode.RangeTable{
+	R16: []unicode.Range16{
+		unicode.Range16{Lo: 0xac00, Hi: 0xac00, Stride: 0x1},
+		unicode.Range16{Lo: 0xac1c, Hi: 0xac1c, Stride: 0x1},
+		unicode.Range16{Lo: 0xac38, Hi: 0xac38, Stride: 0x1},
+		unicode.Range16{Lo: 0xac54, Hi: 0xac54, Stride: 0x1},
+		unicode.Range16{Lo: 0xac70, Hi: 0xac70, Stride: 0x1},
+		unicode.Range16{Lo: 0xac8c, Hi: 0xac8c, Stride: 0x1},
+		unicode.Range16{Lo: 0xaca8, Hi: 0xaca8, Stride: 0x1},
+		unicode.Range16{Lo: 0xacc4, Hi: 0xacc4, Stride: 0x1},
+		unicode.Range16{Lo: 0xace0, Hi: 0xace0, Stride: 0x1},
+		unicode.Range16{Lo: 0xacfc, Hi: 0xacfc, Stride: 0x1},
+		unicode.Range16{Lo: 0xad18, Hi: 0xad18, Stride: 0x1},
+		unicode.Range16{Lo: 0xad34, Hi: 0xad34, Stride: 0x1},
+		unicode.Range16{Lo: 0xad50, Hi: 0xad50, Stride: 0x1},
+		unicode.Range16{Lo: 0xad6c, Hi: 0xad6c, Stride: 0x1},
+		unicode.Range16{Lo: 0xad88, Hi: 0xad88, Stride: 0x1},
+		unicode.Range16{Lo: 0xada4, Hi: 0xada4, Stride: 0x1},
+		unicode.Range16{Lo: 0xadc0, Hi: 0xadc0, Stride: 0x1},
+		unicode.Range16{Lo: 0xaddc, Hi: 0xaddc, Stride: 0x1},
+		unicode.Range16{Lo: 0xadf8, Hi: 0xadf8, Stride: 0x1},
+		unicode.Range16{Lo: 0xae14, Hi: 0xae14, Stride: 0x1},
+		unicode.Range16{Lo: 0xae30, Hi: 0xae30, Stride: 0x1},
+		unicode.Range16{Lo: 0xae4c, Hi: 0xae4c, Stride: 0x1},
+		unicode.Range16{Lo: 0xae68, Hi: 0xae68, Stride: 0x1},
+		unicode.Range16{Lo: 0xae84, Hi: 0xae84, Stride: 0x1},
+		unicode.Range16{Lo: 0xaea0, Hi: 0xaea0, Stride: 0x1},
+		unicode.Range16{Lo: 0xaebc, Hi: 0xaebc, Stride: 0x1},
+		unicode.Range16{Lo: 0xaed8, Hi: 0xaed8, Stride: 0x1},
+		unicode.Range16{Lo: 0xaef4, Hi: 0xaef4, Stride: 0x1},
+		unicode.Range16{Lo: 0xaf10, Hi: 0xaf10, Stride: 0x1},
+		unicode.Range16{Lo: 0xaf2c, Hi: 0xaf2c, Stride: 0x1},
+		unicode.Range16{Lo: 0xaf48, Hi: 0xaf48, Stride: 0x1},
+		unicode.Range16{Lo: 0xaf64, Hi: 0xaf64, Stride: 0x1},
+		unicode.Range16{Lo: 0xaf80, Hi: 0xaf80, Stride: 0x1},
+		unicode.Range16{Lo: 0xaf9c, Hi: 0xaf9c, Stride: 0x1},
+		unicode.Range16{Lo: 0xafb8, Hi: 0xafb8, Stride: 0x1},
+		unicode.Range16{Lo: 0xafd4, Hi: 0xafd4, Stride: 0x1},
+		unicode.Range16{Lo: 0xaff0, Hi: 0xaff0, Stride: 0x1},
+		unicode.Range16{Lo: 0xb00c, Hi: 0xb00c, Stride: 0x1},
+		unicode.Range16{Lo: 0xb028, Hi: 0xb028, Stride: 0x1},
+		unicode.Range16{Lo: 0xb044, Hi: 0xb044, Stride: 0x1},
+		unicode.Range16{Lo: 0xb060, Hi: 0xb060, Stride: 0x1},
+		unicode.Range16{Lo: 0xb07c, Hi: 0xb07c, Stride: 0x1},
+		unicode.Range16{Lo: 0xb098, Hi: 0xb098, Stride: 0x1},
+		unicode.Range16{Lo: 0xb0b4, Hi: 0xb0b4, Stride: 0x1},
+		unicode.Range16{Lo: 0xb0d0, Hi: 0xb0d0, Stride: 0x1},
+		unicode.Range16{Lo: 0xb0ec, Hi: 0xb0ec, Stride: 0x1},
+		unicode.Range16{Lo: 0xb108, Hi: 0xb108, Stride: 0x1},
+		unicode.Range16{Lo: 0xb124, Hi: 0xb124, Stride: 0x1},
+		unicode.Range16{Lo: 0xb140, Hi: 0xb140, Stride: 0x1},
+		unicode.Range16{Lo: 0xb15c, Hi: 0xb15c, Stride: 0x1},
+		unicode.Range16{Lo: 0xb178, Hi: 0xb178, Stride: 0x1},
+		unicode.Range16{Lo: 0xb194, Hi: 0xb194, Stride: 0x1},
+		unicode.Range16{Lo: 0xb1b0, Hi: 0xb1b0, Stride: 0x1},
+		unicode.Range16{Lo: 0xb1cc, Hi: 0xb1cc, Stride: 0x1},
+		unicode.Range16{Lo: 0xb1e8, Hi: 0xb1e8, Stride: 0x1},
+		unicode.Range16{Lo: 0xb204, Hi: 0xb204, Stride: 0x1},
+		unicode.Range16{Lo: 0xb220, Hi: 0xb220, Stride: 0x1},
+		unicode.Range16{Lo: 0xb23c, Hi: 0xb23c, Stride: 0x1},
+		unicode.Range16{Lo: 0xb258, Hi: 0xb258, Stride: 0x1},
+		unicode.Range16{Lo: 0xb274, Hi: 0xb274, Stride: 0x1},
+		unicode.Range16{Lo: 0xb290, Hi: 0xb290, Stride: 0x1},
+		unicode.Range16{Lo: 0xb2ac, Hi: 0xb2ac, Stride: 0x1},
+		unicode.Range16{Lo: 0xb2c8, Hi: 0xb2c8, Stride: 0x1},
+		unicode.Range16{Lo: 0xb2e4, Hi: 0xb2e4, Stride: 0x1},
+		unicode.Range16{Lo: 0xb300, Hi: 0xb300, Stride: 0x1},
+		unicode.Range16{Lo: 0xb31c, Hi: 0xb31c, Stride: 0x1},
+		unicode.Range16{Lo: 0xb338, Hi: 0xb338, Stride: 0x1},
+		unicode.Range16{Lo: 0xb354, Hi: 0xb354, Stride: 0x1},
+		unicode.Range16{Lo: 0xb370, Hi: 0xb370, Stride: 0x1},
+		unicode.Range16{Lo: 0xb38c, Hi: 0xb38c, Stride: 0x1},
+		unicode.Range16{Lo: 0xb3a8, Hi: 0xb3a8, Stride: 0x1},
+		unicode.Range16{Lo: 0xb3c4, Hi: 0xb3c4, Stride: 0x1},
+		unicode.Range16{Lo: 0xb3e0, Hi: 0xb3e0, Stride: 0x1},
+		unicode.Range16{Lo: 0xb3fc, Hi: 0xb3fc, Stride: 0x1},
+		unicode.Range16{Lo: 0xb418, Hi: 0xb418, Stride: 0x1},
+		unicode.Range16{Lo: 0xb434, Hi: 0xb434, Stride: 0x1},
+		unicode.Range16{Lo: 0xb450, Hi: 0xb450, Stride: 0x1},
+		unicode.Range16{Lo: 0xb46c, Hi: 0xb46c, Stride: 0x1},
+		unicode.Range16{Lo: 0xb488, Hi: 0xb488, Stride: 0x1},
+		unicode.Range16{Lo: 0xb4a4, Hi: 0xb4a4, Stride: 0x1},
+		unicode.Range16{Lo: 0xb4c0, Hi: 0xb4c0, Stride: 0x1},
+		unicode.Range16{Lo: 0xb4dc, Hi: 0xb4dc, Stride: 0x1},
+		unicode.Range16{Lo: 0xb4f8, Hi: 0xb4f8, Stride: 0x1},
+		unicode.Range16{Lo: 0xb514, Hi: 0xb514, Stride: 0x1},
+		unicode.Range16{Lo: 0xb530, Hi: 0xb530, Stride: 0x1},
+		unicode.Range16{Lo: 0xb54c, Hi: 0xb54c, Stride: 0x1},
+		unicode.Range16{Lo: 0xb568, Hi: 0xb568, Stride: 0x1},
+		unicode.Range16{Lo: 0xb584, Hi: 0xb584, Stride: 0x1},
+		unicode.Range16{Lo: 0xb5a0, Hi: 0xb5a0, Stride: 0x1},
+		unicode.Range16{Lo: 0xb5bc, Hi: 0xb5bc, Stride: 0x1},
+		unicode.Range16{Lo: 0xb5d8, Hi: 0xb5d8, Stride: 0x1},
+		unicode.Range16{Lo: 0xb5f4, Hi: 0xb5f4, Stride: 0x1},
+		unicode.Range16{Lo: 0xb610, Hi: 0xb610, Stride: 0x1},
+		unicode.Range16{Lo: 0xb62c, Hi: 0xb62c, Stride: 0x1},
+		unicode.Range16{Lo: 0xb648, Hi: 0xb648, Stride: 0x1},
+		unicode.Range16{Lo: 0xb664, Hi: 0xb664, Stride: 0x1},
+		unicode.Range16{Lo: 0xb680, Hi: 0xb680, Stride: 0x1},
+		unicode.Range16{Lo: 0xb69c, Hi: 0xb69c, Stride: 0x1},
+		unicode.Range16{Lo: 0xb6b8, Hi: 0xb6b8, Stride: 0x1},
+		unicode.Range16{Lo: 0xb6d4, Hi: 0xb6d4, Stride: 0x1},
+		unicode.Range16{Lo: 0xb6f0, Hi: 0xb6f0, Stride: 0x1},
+		unicode.Range16{Lo: 0xb70c, Hi: 0xb70c, Stride: 0x1},
+		unicode.Range16{Lo: 0xb728, Hi: 0xb728, Stride: 0x1},
+		unicode.Range16{Lo: 0xb744, Hi: 0xb744, Stride: 0x1},
+		unicode.Range16{Lo: 0xb760, Hi: 0xb760, Stride: 0x1},
+		unicode.Range16{Lo: 0xb77c, Hi: 0xb77c, Stride: 0x1},
+		unicode.Range16{Lo: 0xb798, Hi: 0xb798, Stride: 0x1},
+		unicode.Range16{Lo: 0xb7b4, Hi: 0xb7b4, Stride: 0x1},
+		unicode.Range16{Lo: 0xb7d0, Hi: 0xb7d0, Stride: 0x1},
+		unicode.Range16{Lo: 0xb7ec, Hi: 0xb7ec, Stride: 0x1},
+		unicode.Range16{Lo: 0xb808, Hi: 0xb808, Stride: 0x1},
+		unicode.Range16{Lo: 0xb824, Hi: 0xb824, Stride: 0x1},
+		unicode.Range16{Lo: 0xb840, Hi: 0xb840, Stride: 0x1},
+		unicode.Range16{Lo: 0xb85c, Hi: 0xb85c, Stride: 0x1},
+		unicode.Range16{Lo: 0xb878, Hi: 0xb878, Stride: 0x1},
+		unicode.Range16{Lo: 0xb894, Hi: 0xb894, Stride: 0x1},
+		unicode.Range16{Lo: 0xb8b0, Hi: 0xb8b0, Stride: 0x1},
+		unicode.Range16{Lo: 0xb8cc, Hi: 0xb8cc, Stride: 0x1},
+		unicode.Range16{Lo: 0xb8e8, Hi: 0xb8e8, Stride: 0x1},
+		unicode.Range16{Lo: 0xb904, Hi: 0xb904, Stride: 0x1},
+		unicode.Range16{Lo: 0xb920, Hi: 0xb920, Stride: 0x1},
+		unicode.Range16{Lo: 0xb93c, Hi: 0xb93c, Stride: 0x1},
+		unicode.Range16{Lo: 0xb958, Hi: 0xb958, Stride: 0x1},
+		unicode.Range16{Lo: 0xb974, Hi: 0xb974, Stride: 0x1},
+		unicode.Range16{Lo: 0xb990, Hi: 0xb990, Stride: 0x1},
+		unicode.Range16{Lo: 0xb9ac, Hi: 0xb9ac, Stride: 0x1},
+		unicode.Range16{Lo: 0xb9c8, Hi: 0xb9c8, Stride: 0x1},
+		unicode.Range16{Lo: 0xb9e4, Hi: 0xb9e4, Stride: 0x1},
+		unicode.Range16{Lo: 0xba00, Hi: 0xba00, Stride: 0x1},
+		unicode.Range16{Lo: 0xba1c, Hi: 0xba1c, Stride: 0x1},
+		unicode.Range16{Lo: 0xba38, Hi: 0xba38, Stride: 0x1},
+		unicode.Range16{Lo: 0xba54, Hi: 0xba54, Stride: 0x1},
+		unicode.Range16{Lo: 0xba70, Hi: 0xba70, Stride: 0x1},
+		unicode.Range16{Lo: 0xba8c, Hi: 0xba8c, Stride: 0x1},
+		unicode.Range16{Lo: 0xbaa8, Hi: 0xbaa8, Stride: 0x1},
+		unicode.Range16{Lo: 0xbac4, Hi: 0xbac4, Stride: 0x1},
+		unicode.Range16{Lo: 0xbae0, Hi: 0xbae0, Stride: 0x1},
+		unicode.Range16{Lo: 0xbafc, Hi: 0xbafc, Stride: 0x1},
+		unicode.Range16{Lo: 0xbb18, Hi: 0xbb18, Stride: 0x1},
+		unicode.Range16{Lo: 0xbb34, Hi: 0xbb34, Stride: 0x1},
+		unicode.Range16{Lo: 0xbb50, Hi: 0xbb50, Stride: 0x1},
+		unicode.Range16{Lo: 0xbb6c, Hi: 0xbb6c, Stride: 0x1},
+		unicode.Range16{Lo: 0xbb88, Hi: 0xbb88, Stride: 0x1},
+		unicode.Range16{Lo: 0xbba4, Hi: 0xbba4, Stride: 0x1},
+		unicode.Range16{Lo: 0xbbc0, Hi: 0xbbc0, Stride: 0x1},
+		unicode.Range16{Lo: 0xbbdc, Hi: 0xbbdc, Stride: 0x1},
+		unicode.Range16{Lo: 0xbbf8, Hi: 0xbbf8, Stride: 0x1},
+		unicode.Range16{Lo: 0xbc14, Hi: 0xbc14, Stride: 0x1},
+		unicode.Range16{Lo: 0xbc30, Hi: 0xbc30, Stride: 0x1},
+		unicode.Range16{Lo: 0xbc4c, Hi: 0xbc4c, Stride: 0x1},
+		unicode.Range16{Lo: 0xbc68, Hi: 0xbc68, Stride: 0x1},
+		unicode.Range16{Lo: 0xbc84, Hi: 0xbc84, Stride: 0x1},
+		unicode.Range16{Lo: 0xbca0, Hi: 0xbca0, Stride: 0x1},
+		unicode.Range16{Lo: 0xbcbc, Hi: 0xbcbc, Stride: 0x1},
+		unicode.Range16{Lo: 0xbcd8, Hi: 0xbcd8, Stride: 0x1},
+		unicode.Range16{Lo: 0xbcf4, Hi: 0xbcf4, Stride: 0x1},
+		unicode.Range16{Lo: 0xbd10, Hi: 0xbd10, Stride: 0x1},
+		unicode.Range16{Lo: 0xbd2c, Hi: 0xbd2c, Stride: 0x1},
+		unicode.Range16{Lo: 0xbd48, Hi: 0xbd48, Stride: 0x1},
+		unicode.Range16{Lo: 0xbd64, Hi: 0xbd64, Stride: 0x1},
+		unicode.Range16{Lo: 0xbd80, Hi: 0xbd80, Stride: 0x1},
+		unicode.Range16{Lo: 0xbd9c, Hi: 0xbd9c, Stride: 0x1},
+		unicode.Range16{Lo: 0xbdb8, Hi: 0xbdb8, Stride: 0x1},
+		unicode.Range16{Lo: 0xbdd4, Hi: 0xbdd4, Stride: 0x1},
+		unicode.Range16{Lo: 0xbdf0, Hi: 0xbdf0, Stride: 0x1},
+		unicode.Range16{Lo: 0xbe0c, Hi: 0xbe0c, Stride: 0x1},
+		unicode.Range16{Lo: 0xbe28, Hi: 0xbe28, Stride: 0x1},
+		unicode.Range16{Lo: 0xbe44, Hi: 0xbe44, Stride: 0x1},
+		unicode.Range16{Lo: 0xbe60, Hi: 0xbe60, Stride: 0x1},
+		unicode.Range16{Lo: 0xbe7c, Hi: 0xbe7c, Stride: 0x1},
+		unicode.Range16{Lo: 0xbe98, Hi: 0xbe98, Stride: 0x1},
+		unicode.Range16{Lo: 0xbeb4, Hi: 0xbeb4, Stride: 0x1},
+		unicode.Range16{Lo: 0xbed0, Hi: 0xbed0, Stride: 0x1},
+		unicode.Range16{Lo: 0xbeec, Hi: 0xbeec, Stride: 0x1},
+		unicode.Range16{Lo: 0xbf08, Hi: 0xbf08, Stride: 0x1},
+		unicode.Range16{Lo: 0xbf24, Hi: 0xbf24, Stride: 0x1},
+		unicode.Range16{Lo: 0xbf40, Hi: 0xbf40, Stride: 0x1},
+		unicode.Range16{Lo: 0xbf5c, Hi: 0xbf5c, Stride: 0x1},
+		unicode.Range16{Lo: 0xbf78, Hi: 0xbf78, Stride: 0x1},
+		unicode.Range16{Lo: 0xbf94, Hi: 0xbf94, Stride: 0x1},
+		unicode.Range16{Lo: 0xbfb0, Hi: 0xbfb0, Stride: 0x1},
+		unicode.Range16{Lo: 0xbfcc, Hi: 0xbfcc, Stride: 0x1},
+		unicode.Range16{Lo: 0xbfe8, Hi: 0xbfe8, Stride: 0x1},
+		unicode.Range16{Lo: 0xc004, Hi: 0xc004, Stride: 0x1},
+		unicode.Range16{Lo: 0xc020, Hi: 0xc020, Stride: 0x1},
+		unicode.Range16{Lo: 0xc03c, Hi: 0xc03c, Stride: 0x1},
+		unicode.Range16{Lo: 0xc058, Hi: 0xc058, Stride: 0x1},
+		unicode.Range16{Lo: 0xc074, Hi: 0xc074, Stride: 0x1},
+		unicode.Range16{Lo: 0xc090, Hi: 0xc090, Stride: 0x1},
+		unicode.Range16{Lo: 0xc0ac, Hi: 0xc0ac, Stride: 0x1},
+		unicode.Range16{Lo: 0xc0c8, Hi: 0xc0c8, Stride: 0x1},
+		unicode.Range16{Lo: 0xc0e4, Hi: 0xc0e4, Stride: 0x1},
+		unicode.Range16{Lo: 0xc100, Hi: 0xc100, Stride: 0x1},
+		unicode.Range16{Lo: 0xc11c, Hi: 0xc11c, Stride: 0x1},
+		unicode.Range16{Lo: 0xc138, Hi: 0xc138, Stride: 0x1},
+		unicode.Range16{Lo: 0xc154, Hi: 0xc154, Stride: 0x1},
+		unicode.Range16{Lo: 0xc170, Hi: 0xc170, Stride: 0x1},
+		unicode.Range16{Lo: 0xc18c, Hi: 0xc18c, Stride: 0x1},
+		unicode.Range16{Lo: 0xc1a8, Hi: 0xc1a8, Stride: 0x1},
+		unicode.Range16{Lo: 0xc1c4, Hi: 0xc1c4, Stride: 0x1},
+		unicode.Range16{Lo: 0xc1e0, Hi: 0xc1e0, Stride: 0x1},
+		unicode.Range16{Lo: 0xc1fc, Hi: 0xc1fc, Stride: 0x1},
+		unicode.Range16{Lo: 0xc218, Hi: 0xc218, Stride: 0x1},
+		unicode.Range16{Lo: 0xc234, Hi: 0xc234, Stride: 0x1},
+		unicode.Range16{Lo: 0xc250, Hi: 0xc250, Stride: 0x1},
+		unicode.Range16{Lo: 0xc26c, Hi: 0xc26c, Stride: 0x1},
+		unicode.Range16{Lo: 0xc288, Hi: 0xc288, Stride: 0x1},
+		unicode.Range16{Lo: 0xc2a4, Hi: 0xc2a4, Stride: 0x1},
+		unicode.Range16{Lo: 0xc2c0, Hi: 0xc2c0, Stride: 0x1},
+		unicode.Range16{Lo: 0xc2dc, Hi: 0xc2dc, Stride: 0x1},
+		unicode.Range16{Lo: 0xc2f8, Hi: 0xc2f8, Stride: 0x1},
+		unicode.Range16{Lo: 0xc314, Hi: 0xc314, Stride: 0x1},
+		unicode.Range16{Lo: 0xc330, Hi: 0xc330, Stride: 0x1},
+		unicode.Range16{Lo: 0xc34c, Hi: 0xc34c, Stride: 0x1},
+		unicode.Range16{Lo: 0xc368, Hi: 0xc368, Stride: 0x1},
+		unicode.Range16{Lo: 0xc384, Hi: 0xc384, Stride: 0x1},
+		unicode.Range16{Lo: 0xc3a0, Hi: 0xc3a0, Stride: 0x1},
+		unicode.Range16{Lo: 0xc3bc, Hi: 0xc3bc, Stride: 0x1},
+		unicode.Range16{Lo: 0xc3d8, Hi: 0xc3d8, Stride: 0x1},
+		unicode.Range16{Lo: 0xc3f4, Hi: 0xc3f4, Stride: 0x1},
+		unicode.Range16{Lo: 0xc410, Hi: 0xc410, Stride: 0x1},
+		unicode.Range16{Lo: 0xc42c, Hi: 0xc42c, Stride: 0x1},
+		unicode.Range16{Lo: 0xc448, Hi: 0xc448, Stride: 0x1},
+		unicode.Range16{Lo: 0xc464, Hi: 0xc464, Stride: 0x1},
+		unicode.Range16{Lo: 0xc480, Hi: 0xc480, Stride: 0x1},
+		unicode.Range16{Lo: 0xc49c, Hi: 0xc49c, Stride: 0x1},
+		unicode.Range16{Lo: 0xc4b8, Hi: 0xc4b8, Stride: 0x1},
+		unicode.Range16{Lo: 0xc4d4, Hi: 0xc4d4, Stride: 0x1},
+		unicode.Range16{Lo: 0xc4f0, Hi: 0xc4f0, Stride: 0x1},
+		unicode.Range16{Lo: 0xc50c, Hi: 0xc50c, Stride: 0x1},
+		unicode.Range16{Lo: 0xc528, Hi: 0xc528, Stride: 0x1},
+		unicode.Range16{Lo: 0xc544, Hi: 0xc544, Stride: 0x1},
+		unicode.Range16{Lo: 0xc560, Hi: 0xc560, Stride: 0x1},
+		unicode.Range16{Lo: 0xc57c, Hi: 0xc57c, Stride: 0x1},
+		unicode.Range16{Lo: 0xc598, Hi: 0xc598, Stride: 0x1},
+		unicode.Range16{Lo: 0xc5b4, Hi: 0xc5b4, Stride: 0x1},
+		unicode.Range16{Lo: 0xc5d0, Hi: 0xc5d0, Stride: 0x1},
+		unicode.Range16{Lo: 0xc5ec, Hi: 0xc5ec, Stride: 0x1},
+		unicode.Range16{Lo: 0xc608, Hi: 0xc608, Stride: 0x1},
+		unicode.Range16{Lo: 0xc624, Hi: 0xc624, Stride: 0x1},
+		unicode.Range16{Lo: 0xc640, Hi: 0xc640, Stride: 0x1},
+		unicode.Range16{Lo: 0xc65c, Hi: 0xc65c, Stride: 0x1},
+		unicode.Range16{Lo: 0xc678, Hi: 0xc678, Stride: 0x1},
+		unicode.Range16{Lo: 0xc694, Hi: 0xc694, Stride: 0x1},
+		unicode.Range16{Lo: 0xc6b0, Hi: 0xc6b0, Stride: 0x1},
+		unicode.Range16{Lo: 0xc6cc, Hi: 0xc6cc, Stride: 0x1},
+		unicode.Range16{Lo: 0xc6e8, Hi: 0xc6e8, Stride: 0x1},
+		unicode.Range16{Lo: 0xc704, Hi: 0xc704, Stride: 0x1},
+		unicode.Range16{Lo: 0xc720, Hi: 0xc720, Stride: 0x1},
+		unicode.Range16{Lo: 0xc73c, Hi: 0xc73c, Stride: 0x1},
+		unicode.Range16{Lo: 0xc758, Hi: 0xc758, Stride: 0x1},
+		unicode.Range16{Lo: 0xc774, Hi: 0xc774, Stride: 0x1},
+		unicode.Range16{Lo: 0xc790, Hi: 0xc790, Stride: 0x1},
+		unicode.Range16{Lo: 0xc7ac, Hi: 0xc7ac, Stride: 0x1},
+		unicode.Range16{Lo: 0xc7c8, Hi: 0xc7c8, Stride: 0x1},
+		unicode.Range16{Lo: 0xc7e4, Hi: 0xc7e4, Stride: 0x1},
+		unicode.Range16{Lo: 0xc800, Hi: 0xc800, Stride: 0x1},
+		unicode.Range16{Lo: 0xc81c, Hi: 0xc81c, Stride: 0x1},
+		unicode.Range16{Lo: 0xc838, Hi: 0xc838, Stride: 0x1},
+		unicode.Range16{Lo: 0xc854, Hi: 0xc854, Stride: 0x1},
+		unicode.Range16{Lo: 0xc870, Hi: 0xc870, Stride: 0x1},
+		unicode.Range16{Lo: 0xc88c, Hi: 0xc88c, Stride: 0x1},
+		unicode.Range16{Lo: 0xc8a8, Hi: 0xc8a8, Stride: 0x1},
+		unicode.Range16{Lo: 0xc8c4, Hi: 0xc8c4, Stride: 0x1},
+		unicode.Range16{Lo: 0xc8e0, Hi: 0xc8e0, Stride: 0x1},
+		unicode.Range16{Lo: 0xc8fc, Hi: 0xc8fc, Stride: 0x1},
+		unicode.Range16{Lo: 0xc918, Hi: 0xc918, Stride: 0x1},
+		unicode.Range16{Lo: 0xc934, Hi: 0xc934, Stride: 0x1},
+		unicode.Range16{Lo: 0xc950, Hi: 0xc950, Stride: 0x1},
+		unicode.Range16{Lo: 0xc96c, Hi: 0xc96c, Stride: 0x1},
+		unicode.Range16{Lo: 0xc988, Hi: 0xc988, Stride: 0x1},
+		unicode.Range16{Lo: 0xc9a4, Hi: 0xc9a4, Stride: 0x1},
+		unicode.Range16{Lo: 0xc9c0, Hi: 0xc9c0, Stride: 0x1},
+		unicode.Range16{Lo: 0xc9dc, Hi: 0xc9dc, Stride: 0x1},
+		unicode.Range16{Lo: 0xc9f8, Hi: 0xc9f8, Stride: 0x1},
+		unicode.Range16{Lo: 0xca14, Hi: 0xca14, Stride: 0x1},
+		unicode.Range16{Lo: 0xca30, Hi: 0xca30, Stride: 0x1},
+		unicode.Range16{Lo: 0xca4c, Hi: 0xca4c, Stride: 0x1},
+		unicode.Range16{Lo: 0xca68, Hi: 0xca68, Stride: 0x1},
+		unicode.Range16{Lo: 0xca84, Hi: 0xca84, Stride: 0x1},
+		unicode.Range16{Lo: 0xcaa0, Hi: 0xcaa0, Stride: 0x1},
+		unicode.Range16{Lo: 0xcabc, Hi: 0xcabc, Stride: 0x1},
+		unicode.Range16{Lo: 0xcad8, Hi: 0xcad8, Stride: 0x1},
+		unicode.Range16{Lo: 0xcaf4, Hi: 0xcaf4, Stride: 0x1},
+		unicode.Range16{Lo: 0xcb10, Hi: 0xcb10, Stride: 0x1},
+		unicode.Range16{Lo: 0xcb2c, Hi: 0xcb2c, Stride: 0x1},
+		unicode.Range16{Lo: 0xcb48, Hi: 0xcb48, Stride: 0x1},
+		unicode.Range16{Lo: 0xcb64, Hi: 0xcb64, Stride: 0x1},
+		unicode.Range16{Lo: 0xcb80, Hi: 0xcb80, Stride: 0x1},
+		unicode.Range16{Lo: 0xcb9c, Hi: 0xcb9c, Stride: 0x1},
+		unicode.Range16{Lo: 0xcbb8, Hi: 0xcbb8, Stride: 0x1},
+		unicode.Range16{Lo: 0xcbd4, Hi: 0xcbd4, Stride: 0x1},
+		unicode.Range16{Lo: 0xcbf0, Hi: 0xcbf0, Stride: 0x1},
+		unicode.Range16{Lo: 0xcc0c, Hi: 0xcc0c, Stride: 0x1},
+		unicode.Range16{Lo: 0xcc28, Hi: 0xcc28, Stride: 0x1},
+		unicode.Range16{Lo: 0xcc44, Hi: 0xcc44, Stride: 0x1},
+		unicode.Range16{Lo: 0xcc60, Hi: 0xcc60, Stride: 0x1},
+		unicode.Range16{Lo: 0xcc7c, Hi: 0xcc7c, Stride: 0x1},
+		unicode.Range16{Lo: 0xcc98, Hi: 0xcc98, Stride: 0x1},
+		unicode.Range16{Lo: 0xccb4, Hi: 0xccb4, Stride: 0x1},
+		unicode.Range16{Lo: 0xccd0, Hi: 0xccd0, Stride: 0x1},
+		unicode.Range16{Lo: 0xccec, Hi: 0xccec, Stride: 0x1},
+		unicode.Range16{Lo: 0xcd08, Hi: 0xcd08, Stride: 0x1},
+		unicode.Range16{Lo: 0xcd24, Hi: 0xcd24, Stride: 0x1},
+		unicode.Range16{Lo: 0xcd40, Hi: 0xcd40, Stride: 0x1},
+		unicode.Range16{Lo: 0xcd5c, Hi: 0xcd5c, Stride: 0x1},
+		unicode.Range16{Lo: 0xcd78, Hi: 0xcd78, Stride: 0x1},
+		unicode.Range16{Lo: 0xcd94, Hi: 0xcd94, Stride: 0x1},
+		unicode.Range16{Lo: 0xcdb0, Hi: 0xcdb0, Stride: 0x1},
+		unicode.Range16{Lo: 0xcdcc, Hi: 0xcdcc, Stride: 0x1},
+		unicode.Range16{Lo: 0xcde8, Hi: 0xcde8, Stride: 0x1},
+		unicode.Range16{Lo: 0xce04, Hi: 0xce04, Stride: 0x1},
+		unicode.Range16{Lo: 0xce20, Hi: 0xce20, Stride: 0x1},
+		unicode.Range16{Lo: 0xce3c, Hi: 0xce3c, Stride: 0x1},
+		unicode.Range16{Lo: 0xce58, Hi: 0xce58, Stride: 0x1},
+		unicode.Range16{Lo: 0xce74, Hi: 0xce74, Stride: 0x1},
+		unicode.Range16{Lo: 0xce90, Hi: 0xce90, Stride: 0x1},
+		unicode.Range16{Lo: 0xceac, Hi: 0xceac, Stride: 0x1},
+		unicode.Range16{Lo: 0xcec8, Hi: 0xcec8, Stride: 0x1},
+		unicode.Range16{Lo: 0xcee4, Hi: 0xcee4, Stride: 0x1},
+		unicode.Range16{Lo: 0xcf00, Hi: 0xcf00, Stride: 0x1},
+		unicode.Range16{Lo: 0xcf1c, Hi: 0xcf1c, Stride: 0x1},
+		unicode.Range16{Lo: 0xcf38, Hi: 0xcf38, Stride: 0x1},
+		unicode.Range16{Lo: 0xcf54, Hi: 0xcf54, Stride: 0x1},
+		unicode.Range16{Lo: 0xcf70, Hi: 0xcf70, Stride: 0x1},
+		unicode.Range16{Lo: 0xcf8c, Hi: 0xcf8c, Stride: 0x1},
+		unicode.Range16{Lo: 0xcfa8, Hi: 0xcfa8, Stride: 0x1},
+		unicode.Range16{Lo: 0xcfc4, Hi: 0xcfc4, Stride: 0x1},
+		unicode.Range16{Lo: 0xcfe0, Hi: 0xcfe0, Stride: 0x1},
+		unicode.Range16{Lo: 0xcffc, Hi: 0xcffc, Stride: 0x1},
+		unicode.Range16{Lo: 0xd018, Hi: 0xd018, Stride: 0x1},
+		unicode.Range16{Lo: 0xd034, Hi: 0xd034, Stride: 0x1},
+		unicode.Range16{Lo: 0xd050, Hi: 0xd050, Stride: 0x1},
+		unicode.Range16{Lo: 0xd06c, Hi: 0xd06c, Stride: 0x1},
+		unicode.Range16{Lo: 0xd088, Hi: 0xd088, Stride: 0x1},
+		unicode.Range16{Lo: 0xd0a4, Hi: 0xd0a4, Stride: 0x1},
+		unicode.Range16{Lo: 0xd0c0, Hi: 0xd0c0, Stride: 0x1},
+		unicode.Range16{Lo: 0xd0dc, Hi: 0xd0dc, Stride: 0x1},
+		unicode.Range16{Lo: 0xd0f8, Hi: 0xd0f8, Stride: 0x1},
+		unicode.Range16{Lo: 0xd114, Hi: 0xd114, Stride: 0x1},
+		unicode.Range16{Lo: 0xd130, Hi: 0xd130, Stride: 0x1},
+		unicode.Range16{Lo: 0xd14c, Hi: 0xd14c, Stride: 0x1},
+		unicode.Range16{Lo: 0xd168, Hi: 0xd168, Stride: 0x1},
+		unicode.Range16{Lo: 0xd184, Hi: 0xd184, Stride: 0x1},
+		unicode.Range16{Lo: 0xd1a0, Hi: 0xd1a0, Stride: 0x1},
+		unicode.Range16{Lo: 0xd1bc, Hi: 0xd1bc, Stride: 0x1},
+		unicode.Range16{Lo: 0xd1d8, Hi: 0xd1d8, Stride: 0x1},
+		unicode.Range16{Lo: 0xd1f4, Hi: 0xd1f4, Stride: 0x1},
+		unicode.Range16{Lo: 0xd210, Hi: 0xd210, Stride: 0x1},
+		unicode.Range16{Lo: 0xd22c, Hi: 0xd22c, Stride: 0x1},
+		unicode.Range16{Lo: 0xd248, Hi: 0xd248, Stride: 0x1},
+		unicode.Range16{Lo: 0xd264, Hi: 0xd264, Stride: 0x1},
+		unicode.Range16{Lo: 0xd280, Hi: 0xd280, Stride: 0x1},
+		unicode.Range16{Lo: 0xd29c, Hi: 0xd29c, Stride: 0x1},
+		unicode.Range16{Lo: 0xd2b8, Hi: 0xd2b8, Stride: 0x1},
+		unicode.Range16{Lo: 0xd2d4, Hi: 0xd2d4, Stride: 0x1},
+		unicode.Range16{Lo: 0xd2f0, Hi: 0xd2f0, Stride: 0x1},
+		unicode.Range16{Lo: 0xd30c, Hi: 0xd30c, Stride: 0x1},
+		unicode.Range16{Lo: 0xd328, Hi: 0xd328, Stride: 0x1},
+		unicode.Range16{Lo: 0xd344, Hi: 0xd344, Stride: 0x1},
+		unicode.Range16{Lo: 0xd360, Hi: 0xd360, Stride: 0x1},
+		unicode.Range16{Lo: 0xd37c, Hi: 0xd37c, Stride: 0x1},
+		unicode.Range16{Lo: 0xd398, Hi: 0xd398, Stride: 0x1},
+		unicode.Range16{Lo: 0xd3b4, Hi: 0xd3b4, Stride: 0x1},
+		unicode.Range16{Lo: 0xd3d0, Hi: 0xd3d0, Stride: 0x1},
+		unicode.Range16{Lo: 0xd3ec, Hi: 0xd3ec, Stride: 0x1},
+		unicode.Range16{Lo: 0xd408, Hi: 0xd408, Stride: 0x1},
+		unicode.Range16{Lo: 0xd424, Hi: 0xd424, Stride: 0x1},
+		unicode.Range16{Lo: 0xd440, Hi: 0xd440, Stride: 0x1},
+		unicode.Range16{Lo: 0xd45c, Hi: 0xd45c, Stride: 0x1},
+		unicode.Range16{Lo: 0xd478, Hi: 0xd478, Stride: 0x1},
+		unicode.Range16{Lo: 0xd494, Hi: 0xd494, Stride: 0x1},
+		unicode.Range16{Lo: 0xd4b0, Hi: 0xd4b0, Stride: 0x1},
+		unicode.Range16{Lo: 0xd4cc, Hi: 0xd4cc, Stride: 0x1},
+		unicode.Range16{Lo: 0xd4e8, Hi: 0xd4e8, Stride: 0x1},
+		unicode.Range16{Lo: 0xd504, Hi: 0xd504, Stride: 0x1},
+		unicode.Range16{Lo: 0xd520, Hi: 0xd520, Stride: 0x1},
+		unicode.Range16{Lo: 0xd53c, Hi: 0xd53c, Stride: 0x1},
+		unicode.Range16{Lo: 0xd558, Hi: 0xd558, Stride: 0x1},
+		unicode.Range16{Lo: 0xd574, Hi: 0xd574, Stride: 0x1},
+		unicode.Range16{Lo: 0xd590, Hi: 0xd590, Stride: 0x1},
+		unicode.Range16{Lo: 0xd5ac, Hi: 0xd5ac, Stride: 0x1},
+		unicode.Range16{Lo: 0xd5c8, Hi: 0xd5c8, Stride: 0x1},
+		unicode.Range16{Lo: 0xd5e4, Hi: 0xd5e4, Stride: 0x1},
+		unicode.Range16{Lo: 0xd600, Hi: 0xd600, Stride: 0x1},
+		unicode.Range16{Lo: 0xd61c, Hi: 0xd61c, Stride: 0x1},
+		unicode.Range16{Lo: 0xd638, Hi: 0xd638, Stride: 0x1},
+		unicode.Range16{Lo: 0xd654, Hi: 0xd654, Stride: 0x1},
+		unicode.Range16{Lo: 0xd670, Hi: 0xd670, Stride: 0x1},
+		unicode.Range16{Lo: 0xd68c, Hi: 0xd68c, Stride: 0x1},
+		unicode.Range16{Lo: 0xd6a8, Hi: 0xd6a8, Stride: 0x1},
+		unicode.Range16{Lo: 0xd6c4, Hi: 0xd6c4, Stride: 0x1},
+		unicode.Range16{Lo: 0xd6e0, Hi: 0xd6e0, Stride: 0x1},
+		unicode.Range16{Lo: 0xd6fc, Hi: 0xd6fc, Stride: 0x1},
+		unicode.Range16{Lo: 0xd718, Hi: 0xd718, Stride: 0x1},
+		unicode.Range16{Lo: 0xd734, Hi: 0xd734, Stride: 0x1},
+		unicode.Range16{Lo: 0xd750, Hi: 0xd750, Stride: 0x1},
+		unicode.Range16{Lo: 0xd76c, Hi: 0xd76c, Stride: 0x1},
+		unicode.Range16{Lo: 0xd788, Hi: 0xd788, Stride: 0x1},
+	},
+	LatinOffset: 0,
+}
+
+var _GraphemeLVT = &unicode.RangeTable{
+	R16: []unicode.Range16{
+		unicode.Range16{Lo: 0xac01, Hi: 0xac1b, Stride: 0x1},
+		unicode.Range16{Lo: 0xac1d, Hi: 0xac37, Stride: 0x1},
+		unicode.Range16{Lo: 0xac39, Hi: 0xac53, Stride: 0x1},
+		unicode.Range16{Lo: 0xac55, Hi: 0xac6f, Stride: 0x1},
+		unicode.Range16{Lo: 0xac71, Hi: 0xac8b, Stride: 0x1},
+		unicode.Range16{Lo: 0xac8d, Hi: 0xaca7, Stride: 0x1},
+		unicode.Range16{Lo: 0xaca9, Hi: 0xacc3, Stride: 0x1},
+		unicode.Range16{Lo: 0xacc5, Hi: 0xacdf, Stride: 0x1},
+		unicode.Range16{Lo: 0xace1, Hi: 0xacfb, Stride: 0x1},
+		unicode.Range16{Lo: 0xacfd, Hi: 0xad17, Stride: 0x1},
+		unicode.Range16{Lo: 0xad19, Hi: 0xad33, Stride: 0x1},
+		unicode.Range16{Lo: 0xad35, Hi: 0xad4f, Stride: 0x1},
+		unicode.Range16{Lo: 0xad51, Hi: 0xad6b, Stride: 0x1},
+		unicode.Range16{Lo: 0xad6d, Hi: 0xad87, Stride: 0x1},
+		unicode.Range16{Lo: 0xad89, Hi: 0xada3, Stride: 0x1},
+		unicode.Range16{Lo: 0xada5, Hi: 0xadbf, Stride: 0x1},
+		unicode.Range16{Lo: 0xadc1, Hi: 0xaddb, Stride: 0x1},
+		unicode.Range16{Lo: 0xaddd, Hi: 0xadf7, Stride: 0x1},
+		unicode.Range16{Lo: 0xadf9, Hi: 0xae13, Stride: 0x1},
+		unicode.Range16{Lo: 0xae15, Hi: 0xae2f, Stride: 0x1},
+		unicode.Range16{Lo: 0xae31, Hi: 0xae4b, Stride: 0x1},
+		unicode.Range16{Lo: 0xae4d, Hi: 0xae67, Stride: 0x1},
+		unicode.Range16{Lo: 0xae69, Hi: 0xae83, Stride: 0x1},
+		unicode.Range16{Lo: 0xae85, Hi: 0xae9f, Stride: 0x1},
+		unicode.Range16{Lo: 0xaea1, Hi: 0xaebb, Stride: 0x1},
+		unicode.Range16{Lo: 0xaebd, Hi: 0xaed7, Stride: 0x1},
+		unicode.Range16{Lo: 0xaed9, Hi: 0xaef3, Stride: 0x1},
+		unicode.Range16{Lo: 0xaef5, Hi: 0xaf0f, Stride: 0x1},
+		unicode.Range16{Lo: 0xaf11, Hi: 0xaf2b, Stride: 0x1},
+		unicode.Range16{Lo: 0xaf2d, Hi: 0xaf47, Stride: 0x1},
+		unicode.Range16{Lo: 0xaf49, Hi: 0xaf63, Stride: 0x1},
+		unicode.Range16{Lo: 0xaf65, Hi: 0xaf7f, Stride: 0x1},
+		unicode.Range16{Lo: 0xaf81, Hi: 0xaf9b, Stride: 0x1},
+		unicode.Range16{Lo: 0xaf9d, Hi: 0xafb7, Stride: 0x1},
+		unicode.Range16{Lo: 0xafb9, Hi: 0xafd3, Stride: 0x1},
+		unicode.Range16{Lo: 0xafd5, Hi: 0xafef, Stride: 0x1},
+		unicode.Range16{Lo: 0xaff1, Hi: 0xb00b, Stride: 0x1},
+		unicode.Range16{Lo: 0xb00d, Hi: 0xb027, Stride: 0x1},
+		unicode.Range16{Lo: 0xb029, Hi: 0xb043, Stride: 0x1},
+		unicode.Range16{Lo: 0xb045, Hi: 0xb05f, Stride: 0x1},
+		unicode.Range16{Lo: 0xb061, Hi: 0xb07b, Stride: 0x1},
+		unicode.Range16{Lo: 0xb07d, Hi: 0xb097, Stride: 0x1},
+		unicode.Range16{Lo: 0xb099, Hi: 0xb0b3, Stride: 0x1},
+		unicode.Range16{Lo: 0xb0b5, Hi: 0xb0cf, Stride: 0x1},
+		unicode.Range16{Lo: 0xb0d1, Hi: 0xb0eb, Stride: 0x1},
+		unicode.Range16{Lo: 0xb0ed, Hi: 0xb107, Stride: 0x1},
+		unicode.Range16{Lo: 0xb109, Hi: 0xb123, Stride: 0x1},
+		unicode.Range16{Lo: 0xb125, Hi: 0xb13f, Stride: 0x1},
+		unicode.Range16{Lo: 0xb141, Hi: 0xb15b, Stride: 0x1},
+		unicode.Range16{Lo: 0xb15d, Hi: 0xb177, Stride: 0x1},
+		unicode.Range16{Lo: 0xb179, Hi: 0xb193, Stride: 0x1},
+		unicode.Range16{Lo: 0xb195, Hi: 0xb1af, Stride: 0x1},
+		unicode.Range16{Lo: 0xb1b1, Hi: 0xb1cb, Stride: 0x1},
+		unicode.Range16{Lo: 0xb1cd, Hi: 0xb1e7, Stride: 0x1},
+		unicode.Range16{Lo: 0xb1e9, Hi: 0xb203, Stride: 0x1},
+		unicode.Range16{Lo: 0xb205, Hi: 0xb21f, Stride: 0x1},
+		unicode.Range16{Lo: 0xb221, Hi: 0xb23b, Stride: 0x1},
+		unicode.Range16{Lo: 0xb23d, Hi: 0xb257, Stride: 0x1},
+		unicode.Range16{Lo: 0xb259, Hi: 0xb273, Stride: 0x1},
+		unicode.Range16{Lo: 0xb275, Hi: 0xb28f, Stride: 0x1},
+		unicode.Range16{Lo: 0xb291, Hi: 0xb2ab, Stride: 0x1},
+		unicode.Range16{Lo: 0xb2ad, Hi: 0xb2c7, Stride: 0x1},
+		unicode.Range16{Lo: 0xb2c9, Hi: 0xb2e3, Stride: 0x1},
+		unicode.Range16{Lo: 0xb2e5, Hi: 0xb2ff, Stride: 0x1},
+		unicode.Range16{Lo: 0xb301, Hi: 0xb31b, Stride: 0x1},
+		unicode.Range16{Lo: 0xb31d, Hi: 0xb337, Stride: 0x1},
+		unicode.Range16{Lo: 0xb339, Hi: 0xb353, Stride: 0x1},
+		unicode.Range16{Lo: 0xb355, Hi: 0xb36f, Stride: 0x1},
+		unicode.Range16{Lo: 0xb371, Hi: 0xb38b, Stride: 0x1},
+		unicode.Range16{Lo: 0xb38d, Hi: 0xb3a7, Stride: 0x1},
+		unicode.Range16{Lo: 0xb3a9, Hi: 0xb3c3, Stride: 0x1},
+		unicode.Range16{Lo: 0xb3c5, Hi: 0xb3df, Stride: 0x1},
+		unicode.Range16{Lo: 0xb3e1, Hi: 0xb3fb, Stride: 0x1},
+		unicode.Range16{Lo: 0xb3fd, Hi: 0xb417, Stride: 0x1},
+		unicode.Range16{Lo: 0xb419, Hi: 0xb433, Stride: 0x1},
+		unicode.Range16{Lo: 0xb435, Hi: 0xb44f, Stride: 0x1},
+		unicode.Range16{Lo: 0xb451, Hi: 0xb46b, Stride: 0x1},
+		unicode.Range16{Lo: 0xb46d, Hi: 0xb487, Stride: 0x1},
+		unicode.Range16{Lo: 0xb489, Hi: 0xb4a3, Stride: 0x1},
+		unicode.Range16{Lo: 0xb4a5, Hi: 0xb4bf, Stride: 0x1},
+		unicode.Range16{Lo: 0xb4c1, Hi: 0xb4db, Stride: 0x1},
+		unicode.Range16{Lo: 0xb4dd, Hi: 0xb4f7, Stride: 0x1},
+		unicode.Range16{Lo: 0xb4f9, Hi: 0xb513, Stride: 0x1},
+		unicode.Range16{Lo: 0xb515, Hi: 0xb52f, Stride: 0x1},
+		unicode.Range16{Lo: 0xb531, Hi: 0xb54b, Stride: 0x1},
+		unicode.Range16{Lo: 0xb54d, Hi: 0xb567, Stride: 0x1},
+		unicode.Range16{Lo: 0xb569, Hi: 0xb583, Stride: 0x1},
+		unicode.Range16{Lo: 0xb585, Hi: 0xb59f, Stride: 0x1},
+		unicode.Range16{Lo: 0xb5a1, Hi: 0xb5bb, Stride: 0x1},
+		unicode.Range16{Lo: 0xb5bd, Hi: 0xb5d7, Stride: 0x1},
+		unicode.Range16{Lo: 0xb5d9, Hi: 0xb5f3, Stride: 0x1},
+		unicode.Range16{Lo: 0xb5f5, Hi: 0xb60f, Stride: 0x1},
+		unicode.Range16{Lo: 0xb611, Hi: 0xb62b, Stride: 0x1},
+		unicode.Range16{Lo: 0xb62d, Hi: 0xb647, Stride: 0x1},
+		unicode.Range16{Lo: 0xb649, Hi: 0xb663, Stride: 0x1},
+		unicode.Range16{Lo: 0xb665, Hi: 0xb67f, Stride: 0x1},
+		unicode.Range16{Lo: 0xb681, Hi: 0xb69b, Stride: 0x1},
+		unicode.Range16{Lo: 0xb69d, Hi: 0xb6b7, Stride: 0x1},
+		unicode.Range16{Lo: 0xb6b9, Hi: 0xb6d3, Stride: 0x1},
+		unicode.Range16{Lo: 0xb6d5, Hi: 0xb6ef, Stride: 0x1},
+		unicode.Range16{Lo: 0xb6f1, Hi: 0xb70b, Stride: 0x1},
+		unicode.Range16{Lo: 0xb70d, Hi: 0xb727, Stride: 0x1},
+		unicode.Range16{Lo: 0xb729, Hi: 0xb743, Stride: 0x1},
+		unicode.Range16{Lo: 0xb745, Hi: 0xb75f, Stride: 0x1},
+		unicode.Range16{Lo: 0xb761, Hi: 0xb77b, Stride: 0x1},
+		unicode.Range16{Lo: 0xb77d, Hi: 0xb797, Stride: 0x1},
+		unicode.Range16{Lo: 0xb799, Hi: 0xb7b3, Stride: 0x1},
+		unicode.Range16{Lo: 0xb7b5, Hi: 0xb7cf, Stride: 0x1},
+		unicode.Range16{Lo: 0xb7d1, Hi: 0xb7eb, Stride: 0x1},
+		unicode.Range16{Lo: 0xb7ed, Hi: 0xb807, Stride: 0x1},
+		unicode.Range16{Lo: 0xb809, Hi: 0xb823, Stride: 0x1},
+		unicode.Range16{Lo: 0xb825, Hi: 0xb83f, Stride: 0x1},
+		unicode.Range16{Lo: 0xb841, Hi: 0xb85b, Stride: 0x1},
+		unicode.Range16{Lo: 0xb85d, Hi: 0xb877, Stride: 0x1},
+		unicode.Range16{Lo: 0xb879, Hi: 0xb893, Stride: 0x1},
+		unicode.Range16{Lo: 0xb895, Hi: 0xb8af, Stride: 0x1},
+		unicode.Range16{Lo: 0xb8b1, Hi: 0xb8cb, Stride: 0x1},
+		unicode.Range16{Lo: 0xb8cd, Hi: 0xb8e7, Stride: 0x1},
+		unicode.Range16{Lo: 0xb8e9, Hi: 0xb903, Stride: 0x1},
+		unicode.Range16{Lo: 0xb905, Hi: 0xb91f, Stride: 0x1},
+		unicode.Range16{Lo: 0xb921, Hi: 0xb93b, Stride: 0x1},
+		unicode.Range16{Lo: 0xb93d, Hi: 0xb957, Stride: 0x1},
+		unicode.Range16{Lo: 0xb959, Hi: 0xb973, Stride: 0x1},
+		unicode.Range16{Lo: 0xb975, Hi: 0xb98f, Stride: 0x1},
+		unicode.Range16{Lo: 0xb991, Hi: 0xb9ab, Stride: 0x1},
+		unicode.Range16{Lo: 0xb9ad, Hi: 0xb9c7, Stride: 0x1},
+		unicode.Range16{Lo: 0xb9c9, Hi: 0xb9e3, Stride: 0x1},
+		unicode.Range16{Lo: 0xb9e5, Hi: 0xb9ff, Stride: 0x1},
+		unicode.Range16{Lo: 0xba01, Hi: 0xba1b, Stride: 0x1},
+		unicode.Range16{Lo: 0xba1d, Hi: 0xba37, Stride: 0x1},
+		unicode.Range16{Lo: 0xba39, Hi: 0xba53, Stride: 0x1},
+		unicode.Range16{Lo: 0xba55, Hi: 0xba6f, Stride: 0x1},
+		unicode.Range16{Lo: 0xba71, Hi: 0xba8b, Stride: 0x1},
+		unicode.Range16{Lo: 0xba8d, Hi: 0xbaa7, Stride: 0x1},
+		unicode.Range16{Lo: 0xbaa9, Hi: 0xbac3, Stride: 0x1},
+		unicode.Range16{Lo: 0xbac5, Hi: 0xbadf, Stride: 0x1},
+		unicode.Range16{Lo: 0xbae1, Hi: 0xbafb, Stride: 0x1},
+		unicode.Range16{Lo: 0xbafd, Hi: 0xbb17, Stride: 0x1},
+		unicode.Range16{Lo: 0xbb19, Hi: 0xbb33, Stride: 0x1},
+		unicode.Range16{Lo: 0xbb35, Hi: 0xbb4f, Stride: 0x1},
+		unicode.Range16{Lo: 0xbb51, Hi: 0xbb6b, Stride: 0x1},
+		unicode.Range16{Lo: 0xbb6d, Hi: 0xbb87, Stride: 0x1},
+		unicode.Range16{Lo: 0xbb89, Hi: 0xbba3, Stride: 0x1},
+		unicode.Range16{Lo: 0xbba5, Hi: 0xbbbf, Stride: 0x1},
+		unicode.Range16{Lo: 0xbbc1, Hi: 0xbbdb, Stride: 0x1},
+		unicode.Range16{Lo: 0xbbdd, Hi: 0xbbf7, Stride: 0x1},
+		unicode.Range16{Lo: 0xbbf9, Hi: 0xbc13, Stride: 0x1},
+		unicode.Range16{Lo: 0xbc15, Hi: 0xbc2f, Stride: 0x1},
+		unicode.Range16{Lo: 0xbc31, Hi: 0xbc4b, Stride: 0x1},
+		unicode.Range16{Lo: 0xbc4d, Hi: 0xbc67, Stride: 0x1},
+		unicode.Range16{Lo: 0xbc69, Hi: 0xbc83, Stride: 0x1},
+		unicode.Range16{Lo: 0xbc85, Hi: 0xbc9f, Stride: 0x1},
+		unicode.Range16{Lo: 0xbca1, Hi: 0xbcbb, Stride: 0x1},
+		unicode.Range16{Lo: 0xbcbd, Hi: 0xbcd7, Stride: 0x1},
+		unicode.Range16{Lo: 0xbcd9, Hi: 0xbcf3, Stride: 0x1},
+		unicode.Range16{Lo: 0xbcf5, Hi: 0xbd0f, Stride: 0x1},
+		unicode.Range16{Lo: 0xbd11, Hi: 0xbd2b, Stride: 0x1},
+		unicode.Range16{Lo: 0xbd2d, Hi: 0xbd47, Stride: 0x1},
+		unicode.Range16{Lo: 0xbd49, Hi: 0xbd63, Stride: 0x1},
+		unicode.Range16{Lo: 0xbd65, Hi: 0xbd7f, Stride: 0x1},
+		unicode.Range16{Lo: 0xbd81, Hi: 0xbd9b, Stride: 0x1},
+		unicode.Range16{Lo: 0xbd9d, Hi: 0xbdb7, Stride: 0x1},
+		unicode.Range16{Lo: 0xbdb9, Hi: 0xbdd3, Stride: 0x1},
+		unicode.Range16{Lo: 0xbdd5, Hi: 0xbdef, Stride: 0x1},
+		unicode.Range16{Lo: 0xbdf1, Hi: 0xbe0b, Stride: 0x1},
+		unicode.Range16{Lo: 0xbe0d, Hi: 0xbe27, Stride: 0x1},
+		unicode.Range16{Lo: 0xbe29, Hi: 0xbe43, Stride: 0x1},
+		unicode.Range16{Lo: 0xbe45, Hi: 0xbe5f, Stride: 0x1},
+		unicode.Range16{Lo: 0xbe61, Hi: 0xbe7b, Stride: 0x1},
+		unicode.Range16{Lo: 0xbe7d, Hi: 0xbe97, Stride: 0x1},
+		unicode.Range16{Lo: 0xbe99, Hi: 0xbeb3, Stride: 0x1},
+		unicode.Range16{Lo: 0xbeb5, Hi: 0xbecf, Stride: 0x1},
+		unicode.Range16{Lo: 0xbed1, Hi: 0xbeeb, Stride: 0x1},
+		unicode.Range16{Lo: 0xbeed, Hi: 0xbf07, Stride: 0x1},
+		unicode.Range16{Lo: 0xbf09, Hi: 0xbf23, Stride: 0x1},
+		unicode.Range16{Lo: 0xbf25, Hi: 0xbf3f, Stride: 0x1},
+		unicode.Range16{Lo: 0xbf41, Hi: 0xbf5b, Stride: 0x1},
+		unicode.Range16{Lo: 0xbf5d, Hi: 0xbf77, Stride: 0x1},
+		unicode.Range16{Lo: 0xbf79, Hi: 0xbf93, Stride: 0x1},
+		unicode.Range16{Lo: 0xbf95, Hi: 0xbfaf, Stride: 0x1},
+		unicode.Range16{Lo: 0xbfb1, Hi: 0xbfcb, Stride: 0x1},
+		unicode.Range16{Lo: 0xbfcd, Hi: 0xbfe7, Stride: 0x1},
+		unicode.Range16{Lo: 0xbfe9, Hi: 0xc003, Stride: 0x1},
+		unicode.Range16{Lo: 0xc005, Hi: 0xc01f, Stride: 0x1},
+		unicode.Range16{Lo: 0xc021, Hi: 0xc03b, Stride: 0x1},
+		unicode.Range16{Lo: 0xc03d, Hi: 0xc057, Stride: 0x1},
+		unicode.Range16{Lo: 0xc059, Hi: 0xc073, Stride: 0x1},
+		unicode.Range16{Lo: 0xc075, Hi: 0xc08f, Stride: 0x1},
+		unicode.Range16{Lo: 0xc091, Hi: 0xc0ab, Stride: 0x1},
+		unicode.Range16{Lo: 0xc0ad, Hi: 0xc0c7, Stride: 0x1},
+		unicode.Range16{Lo: 0xc0c9, Hi: 0xc0e3, Stride: 0x1},
+		unicode.Range16{Lo: 0xc0e5, Hi: 0xc0ff, Stride: 0x1},
+		unicode.Range16{Lo: 0xc101, Hi: 0xc11b, Stride: 0x1},
+		unicode.Range16{Lo: 0xc11d, Hi: 0xc137, Stride: 0x1},
+		unicode.Range16{Lo: 0xc139, Hi: 0xc153, Stride: 0x1},
+		unicode.Range16{Lo: 0xc155, Hi: 0xc16f, Stride: 0x1},
+		unicode.Range16{Lo: 0xc171, Hi: 0xc18b, Stride: 0x1},
+		unicode.Range16{Lo: 0xc18d, Hi: 0xc1a7, Stride: 0x1},
+		unicode.Range16{Lo: 0xc1a9, Hi: 0xc1c3, Stride: 0x1},
+		unicode.Range16{Lo: 0xc1c5, Hi: 0xc1df, Stride: 0x1},
+		unicode.Range16{Lo: 0xc1e1, Hi: 0xc1fb, Stride: 0x1},
+		unicode.Range16{Lo: 0xc1fd, Hi: 0xc217, Stride: 0x1},
+		unicode.Range16{Lo: 0xc219, Hi: 0xc233, Stride: 0x1},
+		unicode.Range16{Lo: 0xc235, Hi: 0xc24f, Stride: 0x1},
+		unicode.Range16{Lo: 0xc251, Hi: 0xc26b, Stride: 0x1},
+		unicode.Range16{Lo: 0xc26d, Hi: 0xc287, Stride: 0x1},
+		unicode.Range16{Lo: 0xc289, Hi: 0xc2a3, Stride: 0x1},
+		unicode.Range16{Lo: 0xc2a5, Hi: 0xc2bf, Stride: 0x1},
+		unicode.Range16{Lo: 0xc2c1, Hi: 0xc2db, Stride: 0x1},
+		unicode.Range16{Lo: 0xc2dd, Hi: 0xc2f7, Stride: 0x1},
+		unicode.Range16{Lo: 0xc2f9, Hi: 0xc313, Stride: 0x1},
+		unicode.Range16{Lo: 0xc315, Hi: 0xc32f, Stride: 0x1},
+		unicode.Range16{Lo: 0xc331, Hi: 0xc34b, Stride: 0x1},
+		unicode.Range16{Lo: 0xc34d, Hi: 0xc367, Stride: 0x1},
+		unicode.Range16{Lo: 0xc369, Hi: 0xc383, Stride: 0x1},
+		unicode.Range16{Lo: 0xc385, Hi: 0xc39f, Stride: 0x1},
+		unicode.Range16{Lo: 0xc3a1, Hi: 0xc3bb, Stride: 0x1},
+		unicode.Range16{Lo: 0xc3bd, Hi: 0xc3d7, Stride: 0x1},
+		unicode.Range16{Lo: 0xc3d9, Hi: 0xc3f3, Stride: 0x1},
+		unicode.Range16{Lo: 0xc3f5, Hi: 0xc40f, Stride: 0x1},
+		unicode.Range16{Lo: 0xc411, Hi: 0xc42b, Stride: 0x1},
+		unicode.Range16{Lo: 0xc42d, Hi: 0xc447, Stride: 0x1},
+		unicode.Range16{Lo: 0xc449, Hi: 0xc463, Stride: 0x1},
+		unicode.Range16{Lo: 0xc465, Hi: 0xc47f, Stride: 0x1},
+		unicode.Range16{Lo: 0xc481, Hi: 0xc49b, Stride: 0x1},
+		unicode.Range16{Lo: 0xc49d, Hi: 0xc4b7, Stride: 0x1},
+		unicode.Range16{Lo: 0xc4b9, Hi: 0xc4d3, Stride: 0x1},
+		unicode.Range16{Lo: 0xc4d5, Hi: 0xc4ef, Stride: 0x1},
+		unicode.Range16{Lo: 0xc4f1, Hi: 0xc50b, Stride: 0x1},
+		unicode.Range16{Lo: 0xc50d, Hi: 0xc527, Stride: 0x1},
+		unicode.Range16{Lo: 0xc529, Hi: 0xc543, Stride: 0x1},
+		unicode.Range16{Lo: 0xc545, Hi: 0xc55f, Stride: 0x1},
+		unicode.Range16{Lo: 0xc561, Hi: 0xc57b, Stride: 0x1},
+		unicode.Range16{Lo: 0xc57d, Hi: 0xc597, Stride: 0x1},
+		unicode.Range16{Lo: 0xc599, Hi: 0xc5b3, Stride: 0x1},
+		unicode.Range16{Lo: 0xc5b5, Hi: 0xc5cf, Stride: 0x1},
+		unicode.Range16{Lo: 0xc5d1, Hi: 0xc5eb, Stride: 0x1},
+		unicode.Range16{Lo: 0xc5ed, Hi: 0xc607, Stride: 0x1},
+		unicode.Range16{Lo: 0xc609, Hi: 0xc623, Stride: 0x1},
+		unicode.Range16{Lo: 0xc625, Hi: 0xc63f, Stride: 0x1},
+		unicode.Range16{Lo: 0xc641, Hi: 0xc65b, Stride: 0x1},
+		unicode.Range16{Lo: 0xc65d, Hi: 0xc677, Stride: 0x1},
+		unicode.Range16{Lo: 0xc679, Hi: 0xc693, Stride: 0x1},
+		unicode.Range16{Lo: 0xc695, Hi: 0xc6af, Stride: 0x1},
+		unicode.Range16{Lo: 0xc6b1, Hi: 0xc6cb, Stride: 0x1},
+		unicode.Range16{Lo: 0xc6cd, Hi: 0xc6e7, Stride: 0x1},
+		unicode.Range16{Lo: 0xc6e9, Hi: 0xc703, Stride: 0x1},
+		unicode.Range16{Lo: 0xc705, Hi: 0xc71f, Stride: 0x1},
+		unicode.Range16{Lo: 0xc721, Hi: 0xc73b, Stride: 0x1},
+		unicode.Range16{Lo: 0xc73d, Hi: 0xc757, Stride: 0x1},
+		unicode.Range16{Lo: 0xc759, Hi: 0xc773, Stride: 0x1},
+		unicode.Range16{Lo: 0xc775, Hi: 0xc78f, Stride: 0x1},
+		unicode.Range16{Lo: 0xc791, Hi: 0xc7ab, Stride: 0x1},
+		unicode.Range16{Lo: 0xc7ad, Hi: 0xc7c7, Stride: 0x1},
+		unicode.Range16{Lo: 0xc7c9, Hi: 0xc7e3, Stride: 0x1},
+		unicode.Range16{Lo: 0xc7e5, Hi: 0xc7ff, Stride: 0x1},
+		unicode.Range16{Lo: 0xc801, Hi: 0xc81b, Stride: 0x1},
+		unicode.Range16{Lo: 0xc81d, Hi: 0xc837, Stride: 0x1},
+		unicode.Range16{Lo: 0xc839, Hi: 0xc853, Stride: 0x1},
+		unicode.Range16{Lo: 0xc855, Hi: 0xc86f, Stride: 0x1},
+		unicode.Range16{Lo: 0xc871, Hi: 0xc88b, Stride: 0x1},
+		unicode.Range16{Lo: 0xc88d, Hi: 0xc8a7, Stride: 0x1},
+		unicode.Range16{Lo: 0xc8a9, Hi: 0xc8c3, Stride: 0x1},
+		unicode.Range16{Lo: 0xc8c5, Hi: 0xc8df, Stride: 0x1},
+		unicode.Range16{Lo: 0xc8e1, Hi: 0xc8fb, Stride: 0x1},
+		unicode.Range16{Lo: 0xc8fd, Hi: 0xc917, Stride: 0x1},
+		unicode.Range16{Lo: 0xc919, Hi: 0xc933, Stride: 0x1},
+		unicode.Range16{Lo: 0xc935, Hi: 0xc94f, Stride: 0x1},
+		unicode.Range16{Lo: 0xc951, Hi: 0xc96b, Stride: 0x1},
+		unicode.Range16{Lo: 0xc96d, Hi: 0xc987, Stride: 0x1},
+		unicode.Range16{Lo: 0xc989, Hi: 0xc9a3, Stride: 0x1},
+		unicode.Range16{Lo: 0xc9a5, Hi: 0xc9bf, Stride: 0x1},
+		unicode.Range16{Lo: 0xc9c1, Hi: 0xc9db, Stride: 0x1},
+		unicode.Range16{Lo: 0xc9dd, Hi: 0xc9f7, Stride: 0x1},
+		unicode.Range16{Lo: 0xc9f9, Hi: 0xca13, Stride: 0x1},
+		unicode.Range16{Lo: 0xca15, Hi: 0xca2f, Stride: 0x1},
+		unicode.Range16{Lo: 0xca31, Hi: 0xca4b, Stride: 0x1},
+		unicode.Range16{Lo: 0xca4d, Hi: 0xca67, Stride: 0x1},
+		unicode.Range16{Lo: 0xca69, Hi: 0xca83, Stride: 0x1},
+		unicode.Range16{Lo: 0xca85, Hi: 0xca9f, Stride: 0x1},
+		unicode.Range16{Lo: 0xcaa1, Hi: 0xcabb, Stride: 0x1},
+		unicode.Range16{Lo: 0xcabd, Hi: 0xcad7, Stride: 0x1},
+		unicode.Range16{Lo: 0xcad9, Hi: 0xcaf3, Stride: 0x1},
+		unicode.Range16{Lo: 0xcaf5, Hi: 0xcb0f, Stride: 0x1},
+		unicode.Range16{Lo: 0xcb11, Hi: 0xcb2b, Stride: 0x1},
+		unicode.Range16{Lo: 0xcb2d, Hi: 0xcb47, Stride: 0x1},
+		unicode.Range16{Lo: 0xcb49, Hi: 0xcb63, Stride: 0x1},
+		unicode.Range16{Lo: 0xcb65, Hi: 0xcb7f, Stride: 0x1},
+		unicode.Range16{Lo: 0xcb81, Hi: 0xcb9b, Stride: 0x1},
+		unicode.Range16{Lo: 0xcb9d, Hi: 0xcbb7, Stride: 0x1},
+		unicode.Range16{Lo: 0xcbb9, Hi: 0xcbd3, Stride: 0x1},
+		unicode.Range16{Lo: 0xcbd5, Hi: 0xcbef, Stride: 0x1},
+		unicode.Range16{Lo: 0xcbf1, Hi: 0xcc0b, Stride: 0x1},
+		unicode.Range16{Lo: 0xcc0d, Hi: 0xcc27, Stride: 0x1},
+		unicode.Range16{Lo: 0xcc29, Hi: 0xcc43, Stride: 0x1},
+		unicode.Range16{Lo: 0xcc45, Hi: 0xcc5f, Stride: 0x1},
+		unicode.Range16{Lo: 0xcc61, Hi: 0xcc7b, Stride: 0x1},
+		unicode.Range16{Lo: 0xcc7d, Hi: 0xcc97, Stride: 0x1},
+		unicode.Range16{Lo: 0xcc99, Hi: 0xccb3, Stride: 0x1},
+		unicode.Range16{Lo: 0xccb5, Hi: 0xcccf, Stride: 0x1},
+		unicode.Range16{Lo: 0xccd1, Hi: 0xcceb, Stride: 0x1},
+		unicode.Range16{Lo: 0xcced, Hi: 0xcd07, Stride: 0x1},
+		unicode.Range16{Lo: 0xcd09, Hi: 0xcd23, Stride: 0x1},
+		unicode.Range16{Lo: 0xcd25, Hi: 0xcd3f, Stride: 0x1},
+		unicode.Range16{Lo: 0xcd41, Hi: 0xcd5b, Stride: 0x1},
+		unicode.Range16{Lo: 0xcd5d, Hi: 0xcd77, Stride: 0x1},
+		unicode.Range16{Lo: 0xcd79, Hi: 0xcd93, Stride: 0x1},
+		unicode.Range16{Lo: 0xcd95, Hi: 0xcdaf, Stride: 0x1},
+		unicode.Range16{Lo: 0xcdb1, Hi: 0xcdcb, Stride: 0x1},
+		unicode.Range16{Lo: 0xcdcd, Hi: 0xcde7, Stride: 0x1},
+		unicode.Range16{Lo: 0xcde9, Hi: 0xce03, Stride: 0x1},
+		unicode.Range16{Lo: 0xce05, Hi: 0xce1f, Stride: 0x1},
+		unicode.Range16{Lo: 0xce21, Hi: 0xce3b, Stride: 0x1},
+		unicode.Range16{Lo: 0xce3d, Hi: 0xce57, Stride: 0x1},
+		unicode.Range16{Lo: 0xce59, Hi: 0xce73, Stride: 0x1},
+		unicode.Range16{Lo: 0xce75, Hi: 0xce8f, Stride: 0x1},
+		unicode.Range16{Lo: 0xce91, Hi: 0xceab, Stride: 0x1},
+		unicode.Range16{Lo: 0xcead, Hi: 0xcec7, Stride: 0x1},
+		unicode.Range16{Lo: 0xcec9, Hi: 0xcee3, Stride: 0x1},
+		unicode.Range16{Lo: 0xcee5, Hi: 0xceff, Stride: 0x1},
+		unicode.Range16{Lo: 0xcf01, Hi: 0xcf1b, Stride: 0x1},
+		unicode.Range16{Lo: 0xcf1d, Hi: 0xcf37, Stride: 0x1},
+		unicode.Range16{Lo: 0xcf39, Hi: 0xcf53, Stride: 0x1},
+		unicode.Range16{Lo: 0xcf55, Hi: 0xcf6f, Stride: 0x1},
+		unicode.Range16{Lo: 0xcf71, Hi: 0xcf8b, Stride: 0x1},
+		unicode.Range16{Lo: 0xcf8d, Hi: 0xcfa7, Stride: 0x1},
+		unicode.Range16{Lo: 0xcfa9, Hi: 0xcfc3, Stride: 0x1},
+		unicode.Range16{Lo: 0xcfc5, Hi: 0xcfdf, Stride: 0x1},
+		unicode.Range16{Lo: 0xcfe1, Hi: 0xcffb, Stride: 0x1},
+		unicode.Range16{Lo: 0xcffd, Hi: 0xd017, Stride: 0x1},
+		unicode.Range16{Lo: 0xd019, Hi: 0xd033, Stride: 0x1},
+		unicode.Range16{Lo: 0xd035, Hi: 0xd04f, Stride: 0x1},
+		unicode.Range16{Lo: 0xd051, Hi: 0xd06b, Stride: 0x1},
+		unicode.Range16{Lo: 0xd06d, Hi: 0xd087, Stride: 0x1},
+		unicode.Range16{Lo: 0xd089, Hi: 0xd0a3, Stride: 0x1},
+		unicode.Range16{Lo: 0xd0a5, Hi: 0xd0bf, Stride: 0x1},
+		unicode.Range16{Lo: 0xd0c1, Hi: 0xd0db, Stride: 0x1},
+		unicode.Range16{Lo: 0xd0dd, Hi: 0xd0f7, Stride: 0x1},
+		unicode.Range16{Lo: 0xd0f9, Hi: 0xd113, Stride: 0x1},
+		unicode.Range16{Lo: 0xd115, Hi: 0xd12f, Stride: 0x1},
+		unicode.Range16{Lo: 0xd131, Hi: 0xd14b, Stride: 0x1},
+		unicode.Range16{Lo: 0xd14d, Hi: 0xd167, Stride: 0x1},
+		unicode.Range16{Lo: 0xd169, Hi: 0xd183, Stride: 0x1},
+		unicode.Range16{Lo: 0xd185, Hi: 0xd19f, Stride: 0x1},
+		unicode.Range16{Lo: 0xd1a1, Hi: 0xd1bb, Stride: 0x1},
+		unicode.Range16{Lo: 0xd1bd, Hi: 0xd1d7, Stride: 0x1},
+		unicode.Range16{Lo: 0xd1d9, Hi: 0xd1f3, Stride: 0x1},
+		unicode.Range16{Lo: 0xd1f5, Hi: 0xd20f, Stride: 0x1},
+		unicode.Range16{Lo: 0xd211, Hi: 0xd22b, Stride: 0x1},
+		unicode.Range16{Lo: 0xd22d, Hi: 0xd247, Stride: 0x1},
+		unicode.Range16{Lo: 0xd249, Hi: 0xd263, Stride: 0x1},
+		unicode.Range16{Lo: 0xd265, Hi: 0xd27f, Stride: 0x1},
+		unicode.Range16{Lo: 0xd281, Hi: 0xd29b, Stride: 0x1},
+		unicode.Range16{Lo: 0xd29d, Hi: 0xd2b7, Stride: 0x1},
+		unicode.Range16{Lo: 0xd2b9, Hi: 0xd2d3, Stride: 0x1},
+		unicode.Range16{Lo: 0xd2d5, Hi: 0xd2ef, Stride: 0x1},
+		unicode.Range16{Lo: 0xd2f1, Hi: 0xd30b, Stride: 0x1},
+		unicode.Range16{Lo: 0xd30d, Hi: 0xd327, Stride: 0x1},
+		unicode.Range16{Lo: 0xd329, Hi: 0xd343, Stride: 0x1},
+		unicode.Range16{Lo: 0xd345, Hi: 0xd35f, Stride: 0x1},
+		unicode.Range16{Lo: 0xd361, Hi: 0xd37b, Stride: 0x1},
+		unicode.Range16{Lo: 0xd37d, Hi: 0xd397, Stride: 0x1},
+		unicode.Range16{Lo: 0xd399, Hi: 0xd3b3, Stride: 0x1},
+		unicode.Range16{Lo: 0xd3b5, Hi: 0xd3cf, Stride: 0x1},
+		unicode.Range16{Lo: 0xd3d1, Hi: 0xd3eb, Stride: 0x1},
+		unicode.Range16{Lo: 0xd3ed, Hi: 0xd407, Stride: 0x1},
+		unicode.Range16{Lo: 0xd409, Hi: 0xd423, Stride: 0x1},
+		unicode.Range16{Lo: 0xd425, Hi: 0xd43f, Stride: 0x1},
+		unicode.Range16{Lo: 0xd441, Hi: 0xd45b, Stride: 0x1},
+		unicode.Range16{Lo: 0xd45d, Hi: 0xd477, Stride: 0x1},
+		unicode.Range16{Lo: 0xd479, Hi: 0xd493, Stride: 0x1},
+		unicode.Range16{Lo: 0xd495, Hi: 0xd4af, Stride: 0x1},
+		unicode.Range16{Lo: 0xd4b1, Hi: 0xd4cb, Stride: 0x1},
+		unicode.Range16{Lo: 0xd4cd, Hi: 0xd4e7, Stride: 0x1},
+		unicode.Range16{Lo: 0xd4e9, Hi: 0xd503, Stride: 0x1},
+		unicode.Range16{Lo: 0xd505, Hi: 0xd51f, Stride: 0x1},
+		unicode.Range16{Lo: 0xd521, Hi: 0xd53b, Stride: 0x1},
+		unicode.Range16{Lo: 0xd53d, Hi: 0xd557, Stride: 0x1},
+		unicode.Range16{Lo: 0xd559, Hi: 0xd573, Stride: 0x1},
+		unicode.Range16{Lo: 0xd575, Hi: 0xd58f, Stride: 0x1},
+		unicode.Range16{Lo: 0xd591, Hi: 0xd5ab, Stride: 0x1},
+		unicode.Range16{Lo: 0xd5ad, Hi: 0xd5c7, Stride: 0x1},
+		unicode.Range16{Lo: 0xd5c9, Hi: 0xd5e3, Stride: 0x1},
+		unicode.Range16{Lo: 0xd5e5, Hi: 0xd5ff, Stride: 0x1},
+		unicode.Range16{Lo: 0xd601, Hi: 0xd61b, Stride: 0x1},
+		unicode.Range16{Lo: 0xd61d, Hi: 0xd637, Stride: 0x1},
+		unicode.Range16{Lo: 0xd639, Hi: 0xd653, Stride: 0x1},
+		unicode.Range16{Lo: 0xd655, Hi: 0xd66f, Stride: 0x1},
+		unicode.Range16{Lo: 0xd671, Hi: 0xd68b, Stride: 0x1},
+		unicode.Range16{Lo: 0xd68d, Hi: 0xd6a7, Stride: 0x1},
+		unicode.Range16{Lo: 0xd6a9, Hi: 0xd6c3, Stride: 0x1},
+		unicode.Range16{Lo: 0xd6c5, Hi: 0xd6df, Stride: 0x1},
+		unicode.Range16{Lo: 0xd6e1, Hi: 0xd6fb, Stride: 0x1},
+		unicode.Range16{Lo: 0xd6fd, Hi: 0xd717, Stride: 0x1},
+		unicode.Range16{Lo: 0xd719, Hi: 0xd733, Stride: 0x1},
+		unicode.Range16{Lo: 0xd735, Hi: 0xd74f, Stride: 0x1},
+		unicode.Range16{Lo: 0xd751, Hi: 0xd76b, Stride: 0x1},
+		unicode.Range16{Lo: 0xd76d, Hi: 0xd787, Stride: 0x1},
+		unicode.Range16{Lo: 0xd789, Hi: 0xd7a3, Stride: 0x1},
+	},
+	LatinOffset: 0,
+}
+
+var _GraphemePrepend = &unicode.RangeTable{
+	R16: []unicode.Range16{
+		unicode.Range16{Lo: 0x600, Hi: 0x605, Stride: 0x1},
+		unicode.Range16{Lo: 0x6dd, Hi: 0x6dd, Stride: 0x1},
+		unicode.Range16{Lo: 0x70f, Hi: 0x70f, Stride: 0x1},
+		unicode.Range16{Lo: 0x890, Hi: 0x891, Stride: 0x1},
+		unicode.Range16{Lo: 0x8e2, Hi: 0x8e2, Stride: 0x1},
+		unicode.Range16{Lo: 0xd4e, Hi: 0xd4e, Stride: 0x1},
+	},
+	R32: []unicode.Range32{
+		unicode.Range32{Lo: 0x110bd, Hi: 0x110bd, Stride: 0x1},
+		unicode.Range32{Lo: 0x110cd, Hi: 0x110cd, Stride: 0x1},
+		unicode.Range32{Lo: 0x111c2, Hi: 0x111c3, Stride: 0x1},
+		unicode.Range32{Lo: 0x1193f, Hi: 0x1193f, Stride: 0x1},
+		unicode.Range32{Lo: 0x11941, Hi: 0x11941, Stride: 0x1},
+		unicode.Range32{Lo: 0x11a3a, Hi: 0x11a3a, Stride: 0x1},
+		unicode.Range32{Lo: 0x11a84, Hi: 0x11a89, Stride: 0x1},
+		unicode.Range32{Lo: 0x11d46, Hi: 0x11d46, Stride: 0x1},
+		unicode.Range32{Lo: 0x11f02, Hi: 0x11f02, Stride: 0x1},
+	},
+	LatinOffset: 0,
+}
+
+var _GraphemeRegional_Indicator = &unicode.RangeTable{
+	R32: []unicode.Range32{
+		unicode.Range32{Lo: 0x1f1e6, Hi: 0x1f1ff, Stride: 0x1},
+	},
+	LatinOffset: 0,
+}
+
+var _GraphemeSpacingMark = &unicode.RangeTable{
+	R16: []unicode.Range16{
+		unicode.Range16{Lo: 0x903, Hi: 0x903, Stride: 0x1},
+		unicode.Range16{Lo: 0x93b, Hi: 0x93b, Stride: 0x1},
+		unicode.Range16{Lo: 0x93e, Hi: 0x940, Stride: 0x1},
+		unicode.Range16{Lo: 0x949, Hi: 0x94c, Stride: 0x1},
+		unicode.Range16{Lo: 0x94e, Hi: 0x94f, Stride: 0x1},
+		unicode.Range16{Lo: 0x982, Hi: 0x983, Stride: 0x1},
+		unicode.Range16{Lo: 0x9bf, Hi: 0x9c0, Stride: 0x1},
+		unicode.Range16{Lo: 0x9c7, Hi: 0x9c8, Stride: 0x1},
+		unicode.Range16{Lo: 0x9cb, Hi: 0x9cc, Stride: 0x1},
+		unicode.Range16{Lo: 0xa03, Hi: 0xa03, Stride: 0x1},
+		unicode.Range16{Lo: 0xa3e, Hi: 0xa40, Stride: 0x1},
+		unicode.Range16{Lo: 0xa83, Hi: 0xa83, Stride: 0x1},
+		unicode.Range16{Lo: 0xabe, Hi: 0xac0, Stride: 0x1},
+		unicode.Range16{Lo: 0xac9, Hi: 0xac9, Stride: 0x1},
+		unicode.Range16{Lo: 0xacb, Hi: 0xacc, Stride: 0x1},
+		unicode.Range16{Lo: 0xb02, Hi: 0xb03, Stride: 0x1},
+		unicode.Range16{Lo: 0xb40, Hi: 0xb40, Stride: 0x1},
+		unicode.Range16{Lo: 0xb47, Hi: 0xb48, Stride: 0x1},
+		unicode.Range16{Lo: 0xb4b, Hi: 0xb4c, Stride: 0x1},
+		unicode.Range16{Lo: 0xbbf, Hi: 0xbbf, Stride: 0x1},
+		unicode.Range16{Lo: 0xbc1, Hi: 0xbc2, Stride: 0x1},
+		unicode.Range16{Lo: 0xbc6, Hi: 0xbc8, Stride: 0x1},
+		unicode.Range16{Lo: 0xbca, Hi: 0xbcc, Stride: 0x1},
+		unicode.Range16{Lo: 0xc01, Hi: 0xc03, Stride: 0x1},
+		unicode.Range16{Lo: 0xc41, Hi: 0xc44, Stride: 0x1},
+		unicode.Range16{Lo: 0xc82, Hi: 0xc83, Stride: 0x1},
+		unicode.Range16{Lo: 0xcbe, Hi: 0xcbe, Stride: 0x1},
+		unicode.Range16{Lo: 0xcc0, Hi: 0xcc1, Stride: 0x1},
+		unicode.Range16{Lo: 0xcc3, Hi: 0xcc4, Stride: 0x1},
+		unicode.Range16{Lo: 0xcc7, Hi: 0xcc8, Stride: 0x1},
+		unicode.Range16{Lo: 0xcca, Hi: 0xccb, Stride: 0x1},
+		unicode.Range16{Lo: 0xcf3, Hi: 0xcf3, Stride: 0x1},
+		unicode.Range16{Lo: 0xd02, Hi: 0xd03, Stride: 0x1},
+		unicode.Range16{Lo: 0xd3f, Hi: 0xd40, Stride: 0x1},
+		unicode.Range16{Lo: 0xd46, Hi: 0xd48, Stride: 0x1},
+		unicode.Range16{Lo: 0xd4a, Hi: 0xd4c, Stride: 0x1},
+		unicode.Range16{Lo: 0xd82, Hi: 0xd83, Stride: 0x1},
+		unicode.Range16{Lo: 0xdd0, Hi: 0xdd1, Stride: 0x1},
+		unicode.Range16{Lo: 0xdd8, Hi: 0xdde, Stride: 0x1},
+		unicode.Range16{Lo: 0xdf2, Hi: 0xdf3, Stride: 0x1},
+		unicode.Range16{Lo: 0xe33, Hi: 0xe33, Stride: 0x1},
+		unicode.Range16{Lo: 0xeb3, Hi: 0xeb3, Stride: 0x1},
+		unicode.Range16{Lo: 0xf3e, Hi: 0xf3f, Stride: 0x1},
+		unicode.Range16{Lo: 0xf7f, Hi: 0xf7f, Stride: 0x1},
+		unicode.Range16{Lo: 0x1031, Hi: 0x1031, Stride: 0x1},
+		unicode.Range16{Lo: 0x103b, Hi: 0x103c, Stride: 0x1},
+		unicode.Range16{Lo: 0x1056, Hi: 0x1057, Stride: 0x1},
+		unicode.Range16{Lo: 0x1084, Hi: 0x1084, Stride: 0x1},
+		unicode.Range16{Lo: 0x1715, Hi: 0x1715, Stride: 0x1},
+		unicode.Range16{Lo: 0x1734, Hi: 0x1734, Stride: 0x1},
+		unicode.Range16{Lo: 0x17b6, Hi: 0x17b6, Stride: 0x1},
+		unicode.Range16{Lo: 0x17be, Hi: 0x17c5, Stride: 0x1},
+		unicode.Range16{Lo: 0x17c7, Hi: 0x17c8, Stride: 0x1},
+		unicode.Range16{Lo: 0x1923, Hi: 0x1926, Stride: 0x1},
+		unicode.Range16{Lo: 0x1929, Hi: 0x192b, Stride: 0x1},
+		unicode.Range16{Lo: 0x1930, Hi: 0x1931, Stride: 0x1},
+		unicode.Range16{Lo: 0x1933, Hi: 0x1938, Stride: 0x1},
+		unicode.Range16{Lo: 0x1a19, Hi: 0x1a1a, Stride: 0x1},
+		unicode.Range16{Lo: 0x1a55, Hi: 0x1a55, Stride: 0x1},
+		unicode.Range16{Lo: 0x1a57, Hi: 0x1a57, Stride: 0x1},
+		unicode.Range16{Lo: 0x1a6d, Hi: 0x1a72, Stride: 0x1},
+		unicode.Range16{Lo: 0x1b04, Hi: 0x1b04, Stride: 0x1},
+		unicode.Range16{Lo: 0x1b3b, Hi: 0x1b3b, Stride: 0x1},
+		unicode.Range16{Lo: 0x1b3d, Hi: 0x1b41, Stride: 0x1},
+		unicode.Range16{Lo: 0x1b43, Hi: 0x1b44, Stride: 0x1},
+		unicode.Range16{Lo: 0x1b82, Hi: 0x1b82, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ba1, Hi: 0x1ba1, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ba6, Hi: 0x1ba7, Stride: 0x1},
+		unicode.Range16{Lo: 0x1baa, Hi: 0x1baa, Stride: 0x1},
+		unicode.Range16{Lo: 0x1be7, Hi: 0x1be7, Stride: 0x1},
+		unicode.Range16{Lo: 0x1bea, Hi: 0x1bec, Stride: 0x1},
+		unicode.Range16{Lo: 0x1bee, Hi: 0x1bee, Stride: 0x1},
+		unicode.Range16{Lo: 0x1bf2, Hi: 0x1bf3, Stride: 0x1},
+		unicode.Range16{Lo: 0x1c24, Hi: 0x1c2b, Stride: 0x1},
+		unicode.Range16{Lo: 0x1c34, Hi: 0x1c35, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ce1, Hi: 0x1ce1, Stride: 0x1},
+		unicode.Range16{Lo: 0x1cf7, Hi: 0x1cf7, Stride: 0x1},
+		unicode.Range16{Lo: 0xa823, Hi: 0xa824, Stride: 0x1},
+		unicode.Range16{Lo: 0xa827, Hi: 0xa827, Stride: 0x1},
+		unicode.Range16{Lo: 0xa880, Hi: 0xa881, Stride: 0x1},
+		unicode.Range16{Lo: 0xa8b4, Hi: 0xa8c3, Stride: 0x1},
+		unicode.Range16{Lo: 0xa952, Hi: 0xa953, Stride: 0x1},
+		unicode.Range16{Lo: 0xa983, Hi: 0xa983, Stride: 0x1},
+		unicode.Range16{Lo: 0xa9b4, Hi: 0xa9b5, Stride: 0x1},
+		unicode.Range16{Lo: 0xa9ba, Hi: 0xa9bb, Stride: 0x1},
+		unicode.Range16{Lo: 0xa9be, Hi: 0xa9c0, Stride: 0x1},
+		unicode.Range16{Lo: 0xaa2f, Hi: 0xaa30, Stride: 0x1},
+		unicode.Range16{Lo: 0xaa33, Hi: 0xaa34, Stride: 0x1},
+		unicode.Range16{Lo: 0xaa4d, Hi: 0xaa4d, Stride: 0x1},
+		unicode.Range16{Lo: 0xaaeb, Hi: 0xaaeb, Stride: 0x1},
+		unicode.Range16{Lo: 0xaaee, Hi: 0xaaef, Stride: 0x1},
+		unicode.Range16{Lo: 0xaaf5, Hi: 0xaaf5, Stride: 0x1},
+		unicode.Range16{Lo: 0xabe3, Hi: 0xabe4, Stride: 0x1},
+		unicode.Range16{Lo: 0xabe6, Hi: 0xabe7, Stride: 0x1},
+		unicode.Range16{Lo: 0xabe9, Hi: 0xabea, Stride: 0x1},
+		unicode.Range16{Lo: 0xabec, Hi: 0xabec, Stride: 0x1},
+	},
+	R32: []unicode.Range32{
+		unicode.Range32{Lo: 0x11000, Hi: 0x11000, Stride: 0x1},
+		unicode.Range32{Lo: 0x11002, Hi: 0x11002, Stride: 0x1},
+		unicode.Range32{Lo: 0x11082, Hi: 0x11082, Stride: 0x1},
+		unicode.Range32{Lo: 0x110b0, Hi: 0x110b2, Stride: 0x1},
+		unicode.Range32{Lo: 0x110b7, Hi: 0x110b8, Stride: 0x1},
+		unicode.Range32{Lo: 0x1112c, Hi: 0x1112c, Stride: 0x1},
+		unicode.Range32{Lo: 0x11145, Hi: 0x11146, Stride: 0x1},
+		unicode.Range32{Lo: 0x11182, Hi: 0x11182, Stride: 0x1},
+		unicode.Range32{Lo: 0x111b3, Hi: 0x111b5, Stride: 0x1},
+		unicode.Range32{Lo: 0x111bf, Hi: 0x111c0, Stride: 0x1},
+		unicode.Range32{Lo: 0x111ce, Hi: 0x111ce, Stride: 0x1},
+		unicode.Range32{Lo: 0x1122c, Hi: 0x1122e, Stride: 0x1},
+		unicode.Range32{Lo: 0x11232, Hi: 0x11233, Stride: 0x1},
+		unicode.Range32{Lo: 0x11235, Hi: 0x11235, Stride: 0x1},
+		unicode.Range32{Lo: 0x112e0, Hi: 0x112e2, Stride: 0x1},
+		unicode.Range32{Lo: 0x11302, Hi: 0x11303, Stride: 0x1},
+		unicode.Range32{Lo: 0x1133f, Hi: 0x1133f, Stride: 0x1},
+		unicode.Range32{Lo: 0x11341, Hi: 0x11344, Stride: 0x1},
+		unicode.Range32{Lo: 0x11347, Hi: 0x11348, Stride: 0x1},
+		unicode.Range32{Lo: 0x1134b, Hi: 0x1134d, Stride: 0x1},
+		unicode.Range32{Lo: 0x11362, Hi: 0x11363, Stride: 0x1},
+		unicode.Range32{Lo: 0x11435, Hi: 0x11437, Stride: 0x1},
+		unicode.Range32{Lo: 0x11440, Hi: 0x11441, Stride: 0x1},
+		unicode.Range32{Lo: 0x11445, Hi: 0x11445, Stride: 0x1},
+		unicode.Range32{Lo: 0x114b1, Hi: 0x114b2, Stride: 0x1},
+		unicode.Range32{Lo: 0x114b9, Hi: 0x114b9, Stride: 0x1},
+		unicode.Range32{Lo: 0x114bb, Hi: 0x114bc, Stride: 0x1},
+		unicode.Range32{Lo: 0x114be, Hi: 0x114be, Stride: 0x1},
+		unicode.Range32{Lo: 0x114c1, Hi: 0x114c1, Stride: 0x1},
+		unicode.Range32{Lo: 0x115b0, Hi: 0x115b1, Stride: 0x1},
+		unicode.Range32{Lo: 0x115b8, Hi: 0x115bb, Stride: 0x1},
+		unicode.Range32{Lo: 0x115be, Hi: 0x115be, Stride: 0x1},
+		unicode.Range32{Lo: 0x11630, Hi: 0x11632, Stride: 0x1},
+		unicode.Range32{Lo: 0x1163b, Hi: 0x1163c, Stride: 0x1},
+		unicode.Range32{Lo: 0x1163e, Hi: 0x1163e, Stride: 0x1},
+		unicode.Range32{Lo: 0x116ac, Hi: 0x116ac, Stride: 0x1},
+		unicode.Range32{Lo: 0x116ae, Hi: 0x116af, Stride: 0x1},
+		unicode.Range32{Lo: 0x116b6, Hi: 0x116b6, Stride: 0x1},
+		unicode.Range32{Lo: 0x11726, Hi: 0x11726, Stride: 0x1},
+		unicode.Range32{Lo: 0x1182c, Hi: 0x1182e, Stride: 0x1},
+		unicode.Range32{Lo: 0x11838, Hi: 0x11838, Stride: 0x1},
+		unicode.Range32{Lo: 0x11931, Hi: 0x11935, Stride: 0x1},
+		unicode.Range32{Lo: 0x11937, Hi: 0x11938, Stride: 0x1},
+		unicode.Range32{Lo: 0x1193d, Hi: 0x1193d, Stride: 0x1},
+		unicode.Range32{Lo: 0x11940, Hi: 0x11940, Stride: 0x1},
+		unicode.Range32{Lo: 0x11942, Hi: 0x11942, Stride: 0x1},
+		unicode.Range32{Lo: 0x119d1, Hi: 0x119d3, Stride: 0x1},
+		unicode.Range32{Lo: 0x119dc, Hi: 0x119df, Stride: 0x1},
+		unicode.Range32{Lo: 0x119e4, Hi: 0x119e4, Stride: 0x1},
+		unicode.Range32{Lo: 0x11a39, Hi: 0x11a39, Stride: 0x1},
+		unicode.Range32{Lo: 0x11a57, Hi: 0x11a58, Stride: 0x1},
+		unicode.Range32{Lo: 0x11a97, Hi: 0x11a97, Stride: 0x1},
+		unicode.Range32{Lo: 0x11c2f, Hi: 0x11c2f, Stride: 0x1},
+		unicode.Range32{Lo: 0x11c3e, Hi: 0x11c3e, Stride: 0x1},
+		unicode.Range32{Lo: 0x11ca9, Hi: 0x11ca9, Stride: 0x1},
+		unicode.Range32{Lo: 0x11cb1, Hi: 0x11cb1, Stride: 0x1},
+		unicode.Range32{Lo: 0x11cb4, Hi: 0x11cb4, Stride: 0x1},
+		unicode.Range32{Lo: 0x11d8a, Hi: 0x11d8e, Stride: 0x1},
+		unicode.Range32{Lo: 0x11d93, Hi: 0x11d94, Stride: 0x1},
+		unicode.Range32{Lo: 0x11d96, Hi: 0x11d96, Stride: 0x1},
+		unicode.Range32{Lo: 0x11ef5, Hi: 0x11ef6, Stride: 0x1},
+		unicode.Range32{Lo: 0x11f03, Hi: 0x11f03, Stride: 0x1},
+		unicode.Range32{Lo: 0x11f34, Hi: 0x11f35, Stride: 0x1},
+		unicode.Range32{Lo: 0x11f3e, Hi: 0x11f3f, Stride: 0x1},
+		unicode.Range32{Lo: 0x11f41, Hi: 0x11f41, Stride: 0x1},
+		unicode.Range32{Lo: 0x16f51, Hi: 0x16f87, Stride: 0x1},
+		unicode.Range32{Lo: 0x16ff0, Hi: 0x16ff1, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d166, Hi: 0x1d166, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d16d, Hi: 0x1d16d, Stride: 0x1},
+	},
+	LatinOffset: 0,
+}
+
+var _GraphemeT = &unicode.RangeTable{
+	R16: []unicode.Range16{
+		unicode.Range16{Lo: 0x11a8, Hi: 0x11ff, Stride: 0x1},
+		unicode.Range16{Lo: 0xd7cb, Hi: 0xd7fb, Stride: 0x1},
+	},
+	LatinOffset: 0,
+}
+
+var _GraphemeV = &unicode.RangeTable{
+	R16: []unicode.Range16{
+		unicode.Range16{Lo: 0x1160, Hi: 0x11a7, Stride: 0x1},
+		unicode.Range16{Lo: 0xd7b0, Hi: 0xd7c6, Stride: 0x1},
+	},
+	LatinOffset: 0,
+}
+
+var _GraphemeZWJ = &unicode.RangeTable{
+	R16: []unicode.Range16{
+		unicode.Range16{Lo: 0x200d, Hi: 0x200d, Stride: 0x1},
+	},
+	LatinOffset: 0,
+}
+
+type _GraphemeRuneRange unicode.RangeTable
+
+func _GraphemeRuneType(r rune) *_GraphemeRuneRange {
+	switch {
+	case unicode.Is(_GraphemeCR, r):
+		return (*_GraphemeRuneRange)(_GraphemeCR)
+	case unicode.Is(_GraphemeControl, r):
+		return (*_GraphemeRuneRange)(_GraphemeControl)
+	case unicode.Is(_GraphemeExtend, r):
+		return (*_GraphemeRuneRange)(_GraphemeExtend)
+	case unicode.Is(_GraphemeL, r):
+		return (*_GraphemeRuneRange)(_GraphemeL)
+	case unicode.Is(_GraphemeLF, r):
+		return (*_GraphemeRuneRange)(_GraphemeLF)
+	case unicode.Is(_GraphemeLV, r):
+		return (*_GraphemeRuneRange)(_GraphemeLV)
+	case unicode.Is(_GraphemeLVT, r):
+		return (*_GraphemeRuneRange)(_GraphemeLVT)
+	case unicode.Is(_GraphemePrepend, r):
+		return (*_GraphemeRuneRange)(_GraphemePrepend)
+	case unicode.Is(_GraphemeRegional_Indicator, r):
+		return (*_GraphemeRuneRange)(_GraphemeRegional_Indicator)
+	case unicode.Is(_GraphemeSpacingMark, r):
+		return (*_GraphemeRuneRange)(_GraphemeSpacingMark)
+	case unicode.Is(_GraphemeT, r):
+		return (*_GraphemeRuneRange)(_GraphemeT)
+	case unicode.Is(_GraphemeV, r):
+		return (*_GraphemeRuneRange)(_GraphemeV)
+	case unicode.Is(_GraphemeZWJ, r):
+		return (*_GraphemeRuneRange)(_GraphemeZWJ)
+	default:
+		return nil
+	}
+}
+func (rng *_GraphemeRuneRange) String() string {
+	switch (*unicode.RangeTable)(rng) {
+	case _GraphemeCR:
+		return "CR"
+	case _GraphemeControl:
+		return "Control"
+	case _GraphemeExtend:
+		return "Extend"
+	case _GraphemeL:
+		return "L"
+	case _GraphemeLF:
+		return "LF"
+	case _GraphemeLV:
+		return "LV"
+	case _GraphemeLVT:
+		return "LVT"
+	case _GraphemePrepend:
+		return "Prepend"
+	case _GraphemeRegional_Indicator:
+		return "Regional_Indicator"
+	case _GraphemeSpacingMark:
+		return "SpacingMark"
+	case _GraphemeT:
+		return "T"
+	case _GraphemeV:
+		return "V"
+	case _GraphemeZWJ:
+		return "ZWJ"
+	default:
+		return "Other"
+	}
+}
+
+var _WordALetter = &unicode.RangeTable{
+	R16: []unicode.Range16{
+		unicode.Range16{Lo: 0x41, Hi: 0x5a, Stride: 0x1},
+		unicode.Range16{Lo: 0x61, Hi: 0x7a, Stride: 0x1},
+		unicode.Range16{Lo: 0xaa, Hi: 0xaa, Stride: 0x1},
+		unicode.Range16{Lo: 0xb5, Hi: 0xb5, Stride: 0x1},
+		unicode.Range16{Lo: 0xba, Hi: 0xba, Stride: 0x1},
+		unicode.Range16{Lo: 0xc0, Hi: 0xd6, Stride: 0x1},
+		unicode.Range16{Lo: 0xd8, Hi: 0xf6, Stride: 0x1},
+		unicode.Range16{Lo: 0xf8, Hi: 0x1ba, Stride: 0x1},
+		unicode.Range16{Lo: 0x1bb, Hi: 0x1bb, Stride: 0x1},
+		unicode.Range16{Lo: 0x1bc, Hi: 0x1bf, Stride: 0x1},
+		unicode.Range16{Lo: 0x1c0, Hi: 0x1c3, Stride: 0x1},
+		unicode.Range16{Lo: 0x1c4, Hi: 0x293, Stride: 0x1},
+		unicode.Range16{Lo: 0x294, Hi: 0x294, Stride: 0x1},
+		unicode.Range16{Lo: 0x295, Hi: 0x2af, Stride: 0x1},
+		unicode.Range16{Lo: 0x2b0, Hi: 0x2c1, Stride: 0x1},
+		unicode.Range16{Lo: 0x2c2, Hi: 0x2c5, Stride: 0x1},
+		unicode.Range16{Lo: 0x2c6, Hi: 0x2d1, Stride: 0x1},
+		unicode.Range16{Lo: 0x2d2, Hi: 0x2d7, Stride: 0x1},
+		unicode.Range16{Lo: 0x2de, Hi: 0x2df, Stride: 0x1},
+		unicode.Range16{Lo: 0x2e0, Hi: 0x2e4, Stride: 0x1},
+		unicode.Range16{Lo: 0x2e5, Hi: 0x2eb, Stride: 0x1},
+		unicode.Range16{Lo: 0x2ec, Hi: 0x2ec, Stride: 0x1},
+		unicode.Range16{Lo: 0x2ed, Hi: 0x2ed, Stride: 0x1},
+		unicode.Range16{Lo: 0x2ee, Hi: 0x2ee, Stride: 0x1},
+		unicode.Range16{Lo: 0x2ef, Hi: 0x2ff, Stride: 0x1},
+		unicode.Range16{Lo: 0x370, Hi: 0x373, Stride: 0x1},
+		unicode.Range16{Lo: 0x374, Hi: 0x374, Stride: 0x1},
+		unicode.Range16{Lo: 0x376, Hi: 0x377, Stride: 0x1},
+		unicode.Range16{Lo: 0x37a, Hi: 0x37a, Stride: 0x1},
+		unicode.Range16{Lo: 0x37b, Hi: 0x37d, Stride: 0x1},
+		unicode.Range16{Lo: 0x37f, Hi: 0x37f, Stride: 0x1},
+		unicode.Range16{Lo: 0x386, Hi: 0x386, Stride: 0x1},
+		unicode.Range16{Lo: 0x388, Hi: 0x38a, Stride: 0x1},
+		unicode.Range16{Lo: 0x38c, Hi: 0x38c, Stride: 0x1},
+		unicode.Range16{Lo: 0x38e, Hi: 0x3a1, Stride: 0x1},
+		unicode.Range16{Lo: 0x3a3, Hi: 0x3f5, Stride: 0x1},
+		unicode.Range16{Lo: 0x3f7, Hi: 0x481, Stride: 0x1},
+		unicode.Range16{Lo: 0x48a, Hi: 0x52f, Stride: 0x1},
+		unicode.Range16{Lo: 0x531, Hi: 0x556, Stride: 0x1},
+		unicode.Range16{Lo: 0x559, Hi: 0x559, Stride: 0x1},
+		unicode.Range16{Lo: 0x55a, Hi: 0x55c, Stride: 0x1},
+		unicode.Range16{Lo: 0x55e, Hi: 0x55e, Stride: 0x1},
+		unicode.Range16{Lo: 0x560, Hi: 0x588, Stride: 0x1},
+		unicode.Range16{Lo: 0x58a, Hi: 0x58a, Stride: 0x1},
+		unicode.Range16{Lo: 0x5f3, Hi: 0x5f3, Stride: 0x1},
+		unicode.Range16{Lo: 0x620, Hi: 0x63f, Stride: 0x1},
+		unicode.Range16{Lo: 0x640, Hi: 0x640, Stride: 0x1},
+		unicode.Range16{Lo: 0x641, Hi: 0x64a, Stride: 0x1},
+		unicode.Range16{Lo: 0x66e, Hi: 0x66f, Stride: 0x1},
+		unicode.Range16{Lo: 0x671, Hi: 0x6d3, Stride: 0x1},
+		unicode.Range16{Lo: 0x6d5, Hi: 0x6d5, Stride: 0x1},
+		unicode.Range16{Lo: 0x6e5, Hi: 0x6e6, Stride: 0x1},
+		unicode.Range16{Lo: 0x6ee, Hi: 0x6ef, Stride: 0x1},
+		unicode.Range16{Lo: 0x6fa, Hi: 0x6fc, Stride: 0x1},
+		unicode.Range16{Lo: 0x6ff, Hi: 0x6ff, Stride: 0x1},
+		unicode.Range16{Lo: 0x710, Hi: 0x710, Stride: 0x1},
+		unicode.Range16{Lo: 0x712, Hi: 0x72f, Stride: 0x1},
+		unicode.Range16{Lo: 0x74d, Hi: 0x7a5, Stride: 0x1},
+		unicode.Range16{Lo: 0x7b1, Hi: 0x7b1, Stride: 0x1},
+		unicode.Range16{Lo: 0x7ca, Hi: 0x7ea, Stride: 0x1},
+		unicode.Range16{Lo: 0x7f4, Hi: 0x7f5, Stride: 0x1},
+		unicode.Range16{Lo: 0x7fa, Hi: 0x7fa, Stride: 0x1},
+		unicode.Range16{Lo: 0x800, Hi: 0x815, Stride: 0x1},
+		unicode.Range16{Lo: 0x81a, Hi: 0x81a, Stride: 0x1},
+		unicode.Range16{Lo: 0x824, Hi: 0x824, Stride: 0x1},
+		unicode.Range16{Lo: 0x828, Hi: 0x828, Stride: 0x1},
+		unicode.Range16{Lo: 0x840, Hi: 0x858, Stride: 0x1},
+		unicode.Range16{Lo: 0x860, Hi: 0x86a, Stride: 0x1},
+		unicode.Range16{Lo: 0x870, Hi: 0x887, Stride: 0x1},
+		unicode.Range16{Lo: 0x889, Hi: 0x88e, Stride: 0x1},
+		unicode.Range16{Lo: 0x8a0, Hi: 0x8c8, Stride: 0x1},
+		unicode.Range16{Lo: 0x8c9, Hi: 0x8c9, Stride: 0x1},
+		unicode.Range16{Lo: 0x904, Hi: 0x939, Stride: 0x1},
+		unicode.Range16{Lo: 0x93d, Hi: 0x93d, Stride: 0x1},
+		unicode.Range16{Lo: 0x950, Hi: 0x950, Stride: 0x1},
+		unicode.Range16{Lo: 0x958, Hi: 0x961, Stride: 0x1},
+		unicode.Range16{Lo: 0x971, Hi: 0x971, Stride: 0x1},
+		unicode.Range16{Lo: 0x972, Hi: 0x980, Stride: 0x1},
+		unicode.Range16{Lo: 0x985, Hi: 0x98c, Stride: 0x1},
+		unicode.Range16{Lo: 0x98f, Hi: 0x990, Stride: 0x1},
+		unicode.Range16{Lo: 0x993, Hi: 0x9a8, Stride: 0x1},
+		unicode.Range16{Lo: 0x9aa, Hi: 0x9b0, Stride: 0x1},
+		unicode.Range16{Lo: 0x9b2, Hi: 0x9b2, Stride: 0x1},
+		unicode.Range16{Lo: 0x9b6, Hi: 0x9b9, Stride: 0x1},
+		unicode.Range16{Lo: 0x9bd, Hi: 0x9bd, Stride: 0x1},
+		unicode.Range16{Lo: 0x9ce, Hi: 0x9ce, Stride: 0x1},
+		unicode.Range16{Lo: 0x9dc, Hi: 0x9dd, Stride: 0x1},
+		unicode.Range16{Lo: 0x9df, Hi: 0x9e1, Stride: 0x1},
+		unicode.Range16{Lo: 0x9f0, Hi: 0x9f1, Stride: 0x1},
+		unicode.Range16{Lo: 0x9fc, Hi: 0x9fc, Stride: 0x1},
+		unicode.Range16{Lo: 0xa05, Hi: 0xa0a, Stride: 0x1},
+		unicode.Range16{Lo: 0xa0f, Hi: 0xa10, Stride: 0x1},
+		unicode.Range16{Lo: 0xa13, Hi: 0xa28, Stride: 0x1},
+		unicode.Range16{Lo: 0xa2a, Hi: 0xa30, Stride: 0x1},
+		unicode.Range16{Lo: 0xa32, Hi: 0xa33, Stride: 0x1},
+		unicode.Range16{Lo: 0xa35, Hi: 0xa36, Stride: 0x1},
+		unicode.Range16{Lo: 0xa38, Hi: 0xa39, Stride: 0x1},
+		unicode.Range16{Lo: 0xa59, Hi: 0xa5c, Stride: 0x1},
+		unicode.Range16{Lo: 0xa5e, Hi: 0xa5e, Stride: 0x1},
+		unicode.Range16{Lo: 0xa72, Hi: 0xa74, Stride: 0x1},
+		unicode.Range16{Lo: 0xa85, Hi: 0xa8d, Stride: 0x1},
+		unicode.Range16{Lo: 0xa8f, Hi: 0xa91, Stride: 0x1},
+		unicode.Range16{Lo: 0xa93, Hi: 0xaa8, Stride: 0x1},
+		unicode.Range16{Lo: 0xaaa, Hi: 0xab0, Stride: 0x1},
+		unicode.Range16{Lo: 0xab2, Hi: 0xab3, Stride: 0x1},
+		unicode.Range16{Lo: 0xab5, Hi: 0xab9, Stride: 0x1},
+		unicode.Range16{Lo: 0xabd, Hi: 0xabd, Stride: 0x1},
+		unicode.Range16{Lo: 0xad0, Hi: 0xad0, Stride: 0x1},
+		unicode.Range16{Lo: 0xae0, Hi: 0xae1, Stride: 0x1},
+		unicode.Range16{Lo: 0xaf9, Hi: 0xaf9, Stride: 0x1},
+		unicode.Range16{Lo: 0xb05, Hi: 0xb0c, Stride: 0x1},
+		unicode.Range16{Lo: 0xb0f, Hi: 0xb10, Stride: 0x1},
+		unicode.Range16{Lo: 0xb13, Hi: 0xb28, Stride: 0x1},
+		unicode.Range16{Lo: 0xb2a, Hi: 0xb30, Stride: 0x1},
+		unicode.Range16{Lo: 0xb32, Hi: 0xb33, Stride: 0x1},
+		unicode.Range16{Lo: 0xb35, Hi: 0xb39, Stride: 0x1},
+		unicode.Range16{Lo: 0xb3d, Hi: 0xb3d, Stride: 0x1},
+		unicode.Range16{Lo: 0xb5c, Hi: 0xb5d, Stride: 0x1},
+		unicode.Range16{Lo: 0xb5f, Hi: 0xb61, Stride: 0x1},
+		unicode.Range16{Lo: 0xb71, Hi: 0xb71, Stride: 0x1},
+		unicode.Range16{Lo: 0xb83, Hi: 0xb83, Stride: 0x1},
+		unicode.Range16{Lo: 0xb85, Hi: 0xb8a, Stride: 0x1},
+		unicode.Range16{Lo: 0xb8e, Hi: 0xb90, Stride: 0x1},
+		unicode.Range16{Lo: 0xb92, Hi: 0xb95, Stride: 0x1},
+		unicode.Range16{Lo: 0xb99, Hi: 0xb9a, Stride: 0x1},
+		unicode.Range16{Lo: 0xb9c, Hi: 0xb9c, Stride: 0x1},
+		unicode.Range16{Lo: 0xb9e, Hi: 0xb9f, Stride: 0x1},
+		unicode.Range16{Lo: 0xba3, Hi: 0xba4, Stride: 0x1},
+		unicode.Range16{Lo: 0xba8, Hi: 0xbaa, Stride: 0x1},
+		unicode.Range16{Lo: 0xbae, Hi: 0xbb9, Stride: 0x1},
+		unicode.Range16{Lo: 0xbd0, Hi: 0xbd0, Stride: 0x1},
+		unicode.Range16{Lo: 0xc05, Hi: 0xc0c, Stride: 0x1},
+		unicode.Range16{Lo: 0xc0e, Hi: 0xc10, Stride: 0x1},
+		unicode.Range16{Lo: 0xc12, Hi: 0xc28, Stride: 0x1},
+		unicode.Range16{Lo: 0xc2a, Hi: 0xc39, Stride: 0x1},
+		unicode.Range16{Lo: 0xc3d, Hi: 0xc3d, Stride: 0x1},
+		unicode.Range16{Lo: 0xc58, Hi: 0xc5a, Stride: 0x1},
+		unicode.Range16{Lo: 0xc5d, Hi: 0xc5d, Stride: 0x1},
+		unicode.Range16{Lo: 0xc60, Hi: 0xc61, Stride: 0x1},
+		unicode.Range16{Lo: 0xc80, Hi: 0xc80, Stride: 0x1},
+		unicode.Range16{Lo: 0xc85, Hi: 0xc8c, Stride: 0x1},
+		unicode.Range16{Lo: 0xc8e, Hi: 0xc90, Stride: 0x1},
+		unicode.Range16{Lo: 0xc92, Hi: 0xca8, Stride: 0x1},
+		unicode.Range16{Lo: 0xcaa, Hi: 0xcb3, Stride: 0x1},
+		unicode.Range16{Lo: 0xcb5, Hi: 0xcb9, Stride: 0x1},
+		unicode.Range16{Lo: 0xcbd, Hi: 0xcbd, Stride: 0x1},
+		unicode.Range16{Lo: 0xcdd, Hi: 0xcde, Stride: 0x1},
+		unicode.Range16{Lo: 0xce0, Hi: 0xce1, Stride: 0x1},
+		unicode.Range16{Lo: 0xcf1, Hi: 0xcf2, Stride: 0x1},
+		unicode.Range16{Lo: 0xd04, Hi: 0xd0c, Stride: 0x1},
+		unicode.Range16{Lo: 0xd0e, Hi: 0xd10, Stride: 0x1},
+		unicode.Range16{Lo: 0xd12, Hi: 0xd3a, Stride: 0x1},
+		unicode.Range16{Lo: 0xd3d, Hi: 0xd3d, Stride: 0x1},
+		unicode.Range16{Lo: 0xd4e, Hi: 0xd4e, Stride: 0x1},
+		unicode.Range16{Lo: 0xd54, Hi: 0xd56, Stride: 0x1},
+		unicode.Range16{Lo: 0xd5f, Hi: 0xd61, Stride: 0x1},
+		unicode.Range16{Lo: 0xd7a, Hi: 0xd7f, Stride: 0x1},
+		unicode.Range16{Lo: 0xd85, Hi: 0xd96, Stride: 0x1},
+		unicode.Range16{Lo: 0xd9a, Hi: 0xdb1, Stride: 0x1},
+		unicode.Range16{Lo: 0xdb3, Hi: 0xdbb, Stride: 0x1},
+		unicode.Range16{Lo: 0xdbd, Hi: 0xdbd, Stride: 0x1},
+		unicode.Range16{Lo: 0xdc0, Hi: 0xdc6, Stride: 0x1},
+		unicode.Range16{Lo: 0xf00, Hi: 0xf00, Stride: 0x1},
+		unicode.Range16{Lo: 0xf40, Hi: 0xf47, Stride: 0x1},
+		unicode.Range16{Lo: 0xf49, Hi: 0xf6c, Stride: 0x1},
+		unicode.Range16{Lo: 0xf88, Hi: 0xf8c, Stride: 0x1},
+		unicode.Range16{Lo: 0x10a0, Hi: 0x10c5, Stride: 0x1},
+		unicode.Range16{Lo: 0x10c7, Hi: 0x10c7, Stride: 0x1},
+		unicode.Range16{Lo: 0x10cd, Hi: 0x10cd, Stride: 0x1},
+		unicode.Range16{Lo: 0x10d0, Hi: 0x10fa, Stride: 0x1},
+		unicode.Range16{Lo: 0x10fc, Hi: 0x10fc, Stride: 0x1},
+		unicode.Range16{Lo: 0x10fd, Hi: 0x10ff, Stride: 0x1},
+		unicode.Range16{Lo: 0x1100, Hi: 0x1248, Stride: 0x1},
+		unicode.Range16{Lo: 0x124a, Hi: 0x124d, Stride: 0x1},
+		unicode.Range16{Lo: 0x1250, Hi: 0x1256, Stride: 0x1},
+		unicode.Range16{Lo: 0x1258, Hi: 0x1258, Stride: 0x1},
+		unicode.Range16{Lo: 0x125a, Hi: 0x125d, Stride: 0x1},
+		unicode.Range16{Lo: 0x1260, Hi: 0x1288, Stride: 0x1},
+		unicode.Range16{Lo: 0x128a, Hi: 0x128d, Stride: 0x1},
+		unicode.Range16{Lo: 0x1290, Hi: 0x12b0, Stride: 0x1},
+		unicode.Range16{Lo: 0x12b2, Hi: 0x12b5, Stride: 0x1},
+		unicode.Range16{Lo: 0x12b8, Hi: 0x12be, Stride: 0x1},
+		unicode.Range16{Lo: 0x12c0, Hi: 0x12c0, Stride: 0x1},
+		unicode.Range16{Lo: 0x12c2, Hi: 0x12c5, Stride: 0x1},
+		unicode.Range16{Lo: 0x12c8, Hi: 0x12d6, Stride: 0x1},
+		unicode.Range16{Lo: 0x12d8, Hi: 0x1310, Stride: 0x1},
+		unicode.Range16{Lo: 0x1312, Hi: 0x1315, Stride: 0x1},
+		unicode.Range16{Lo: 0x1318, Hi: 0x135a, Stride: 0x1},
+		unicode.Range16{Lo: 0x1380, Hi: 0x138f, Stride: 0x1},
+		unicode.Range16{Lo: 0x13a0, Hi: 0x13f5, Stride: 0x1},
+		unicode.Range16{Lo: 0x13f8, Hi: 0x13fd, Stride: 0x1},
+		unicode.Range16{Lo: 0x1401, Hi: 0x166c, Stride: 0x1},
+		unicode.Range16{Lo: 0x166f, Hi: 0x167f, Stride: 0x1},
+		unicode.Range16{Lo: 0x1681, Hi: 0x169a, Stride: 0x1},
+		unicode.Range16{Lo: 0x16a0, Hi: 0x16ea, Stride: 0x1},
+		unicode.Range16{Lo: 0x16ee, Hi: 0x16f0, Stride: 0x1},
+		unicode.Range16{Lo: 0x16f1, Hi: 0x16f8, Stride: 0x1},
+		unicode.Range16{Lo: 0x1700, Hi: 0x1711, Stride: 0x1},
+		unicode.Range16{Lo: 0x171f, Hi: 0x1731, Stride: 0x1},
+		unicode.Range16{Lo: 0x1740, Hi: 0x1751, Stride: 0x1},
+		unicode.Range16{Lo: 0x1760, Hi: 0x176c, Stride: 0x1},
+		unicode.Range16{Lo: 0x176e, Hi: 0x1770, Stride: 0x1},
+		unicode.Range16{Lo: 0x1820, Hi: 0x1842, Stride: 0x1},
+		unicode.Range16{Lo: 0x1843, Hi: 0x1843, Stride: 0x1},
+		unicode.Range16{Lo: 0x1844, Hi: 0x1878, Stride: 0x1},
+		unicode.Range16{Lo: 0x1880, Hi: 0x1884, Stride: 0x1},
+		unicode.Range16{Lo: 0x1887, Hi: 0x18a8, Stride: 0x1},
+		unicode.Range16{Lo: 0x18aa, Hi: 0x18aa, Stride: 0x1},
+		unicode.Range16{Lo: 0x18b0, Hi: 0x18f5, Stride: 0x1},
+		unicode.Range16{Lo: 0x1900, Hi: 0x191e, Stride: 0x1},
+		unicode.Range16{Lo: 0x1a00, Hi: 0x1a16, Stride: 0x1},
+		unicode.Range16{Lo: 0x1b05, Hi: 0x1b33, Stride: 0x1},
+		unicode.Range16{Lo: 0x1b45, Hi: 0x1b4c, Stride: 0x1},
+		unicode.Range16{Lo: 0x1b83, Hi: 0x1ba0, Stride: 0x1},
+		unicode.Range16{Lo: 0x1bae, Hi: 0x1baf, Stride: 0x1},
+		unicode.Range16{Lo: 0x1bba, Hi: 0x1be5, Stride: 0x1},
+		unicode.Range16{Lo: 0x1c00, Hi: 0x1c23, Stride: 0x1},
+		unicode.Range16{Lo: 0x1c4d, Hi: 0x1c4f, Stride: 0x1},
+		unicode.Range16{Lo: 0x1c5a, Hi: 0x1c77, Stride: 0x1},
+		unicode.Range16{Lo: 0x1c78, Hi: 0x1c7d, Stride: 0x1},
+		unicode.Range16{Lo: 0x1c80, Hi: 0x1c88, Stride: 0x1},
+		unicode.Range16{Lo: 0x1c90, Hi: 0x1cba, Stride: 0x1},
+		unicode.Range16{Lo: 0x1cbd, Hi: 0x1cbf, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ce9, Hi: 0x1cec, Stride: 0x1},
+		unicode.Range16{Lo: 0x1cee, Hi: 0x1cf3, Stride: 0x1},
+		unicode.Range16{Lo: 0x1cf5, Hi: 0x1cf6, Stride: 0x1},
+		unicode.Range16{Lo: 0x1cfa, Hi: 0x1cfa, Stride: 0x1},
+		unicode.Range16{Lo: 0x1d00, Hi: 0x1d2b, Stride: 0x1},
+		unicode.Range16{Lo: 0x1d2c, Hi: 0x1d6a, Stride: 0x1},
+		unicode.Range16{Lo: 0x1d6b, Hi: 0x1d77, Stride: 0x1},
+		unicode.Range16{Lo: 0x1d78, Hi: 0x1d78, Stride: 0x1},
+		unicode.Range16{Lo: 0x1d79, Hi: 0x1d9a, Stride: 0x1},
+		unicode.Range16{Lo: 0x1d9b, Hi: 0x1dbf, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e00, Hi: 0x1f15, Stride: 0x1},
+		unicode.Range16{Lo: 0x1f18, Hi: 0x1f1d, Stride: 0x1},
+		unicode.Range16{Lo: 0x1f20, Hi: 0x1f45, Stride: 0x1},
+		unicode.Range16{Lo: 0x1f48, Hi: 0x1f4d, Stride: 0x1},
+		unicode.Range16{Lo: 0x1f50, Hi: 0x1f57, Stride: 0x1},
+		unicode.Range16{Lo: 0x1f59, Hi: 0x1f59, Stride: 0x1},
+		unicode.Range16{Lo: 0x1f5b, Hi: 0x1f5b, Stride: 0x1},
+		unicode.Range16{Lo: 0x1f5d, Hi: 0x1f5d, Stride: 0x1},
+		unicode.Range16{Lo: 0x1f5f, Hi: 0x1f7d, Stride: 0x1},
+		unicode.Range16{Lo: 0x1f80, Hi: 0x1fb4, Stride: 0x1},
+		unicode.Range16{Lo: 0x1fb6, Hi: 0x1fbc, Stride: 0x1},
+		unicode.Range16{Lo: 0x1fbe, Hi: 0x1fbe, Stride: 0x1},
+		unicode.Range16{Lo: 0x1fc2, Hi: 0x1fc4, Stride: 0x1},
+		unicode.Range16{Lo: 0x1fc6, Hi: 0x1fcc, Stride: 0x1},
+		unicode.Range16{Lo: 0x1fd0, Hi: 0x1fd3, Stride: 0x1},
+		unicode.Range16{Lo: 0x1fd6, Hi: 0x1fdb, Stride: 0x1},
+		unicode.Range16{Lo: 0x1fe0, Hi: 0x1fec, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ff2, Hi: 0x1ff4, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ff6, Hi: 0x1ffc, Stride: 0x1},
+		unicode.Range16{Lo: 0x2071, Hi: 0x2071, Stride: 0x1},
+		unicode.Range16{Lo: 0x207f, Hi: 0x207f, Stride: 0x1},
+		unicode.Range16{Lo: 0x2090, Hi: 0x209c, Stride: 0x1},
+		unicode.Range16{Lo: 0x2102, Hi: 0x2102, Stride: 0x1},
+		unicode.Range16{Lo: 0x2107, Hi: 0x2107, Stride: 0x1},
+		unicode.Range16{Lo: 0x210a, Hi: 0x2113, Stride: 0x1},
+		unicode.Range16{Lo: 0x2115, Hi: 0x2115, Stride: 0x1},
+		unicode.Range16{Lo: 0x2119, Hi: 0x211d, Stride: 0x1},
+		unicode.Range16{Lo: 0x2124, Hi: 0x2124, Stride: 0x1},
+		unicode.Range16{Lo: 0x2126, Hi: 0x2126, Stride: 0x1},
+		unicode.Range16{Lo: 0x2128, Hi: 0x2128, Stride: 0x1},
+		unicode.Range16{Lo: 0x212a, Hi: 0x212d, Stride: 0x1},
+		unicode.Range16{Lo: 0x212f, Hi: 0x2134, Stride: 0x1},
+		unicode.Range16{Lo: 0x2135, Hi: 0x2138, Stride: 0x1},
+		unicode.Range16{Lo: 0x2139, Hi: 0x2139, Stride: 0x1},
+		unicode.Range16{Lo: 0x213c, Hi: 0x213f, Stride: 0x1},
+		unicode.Range16{Lo: 0x2145, Hi: 0x2149, Stride: 0x1},
+		unicode.Range16{Lo: 0x214e, Hi: 0x214e, Stride: 0x1},
+		unicode.Range16{Lo: 0x2160, Hi: 0x2182, Stride: 0x1},
+		unicode.Range16{Lo: 0x2183, Hi: 0x2184, Stride: 0x1},
+		unicode.Range16{Lo: 0x2185, Hi: 0x2188, Stride: 0x1},
+		unicode.Range16{Lo: 0x24b6, Hi: 0x24e9, Stride: 0x1},
+		unicode.Range16{Lo: 0x2c00, Hi: 0x2c7b, Stride: 0x1},
+		unicode.Range16{Lo: 0x2c7c, Hi: 0x2c7d, Stride: 0x1},
+		unicode.Range16{Lo: 0x2c7e, Hi: 0x2ce4, Stride: 0x1},
+		unicode.Range16{Lo: 0x2ceb, Hi: 0x2cee, Stride: 0x1},
+		unicode.Range16{Lo: 0x2cf2, Hi: 0x2cf3, Stride: 0x1},
+		unicode.Range16{Lo: 0x2d00, Hi: 0x2d25, Stride: 0x1},
+		unicode.Range16{Lo: 0x2d27, Hi: 0x2d27, Stride: 0x1},
+		unicode.Range16{Lo: 0x2d2d, Hi: 0x2d2d, Stride: 0x1},
+		unicode.Range16{Lo: 0x2d30, Hi: 0x2d67, Stride: 0x1},
+		unicode.Range16{Lo: 0x2d6f, Hi: 0x2d6f, Stride: 0x1},
+		unicode.Range16{Lo: 0x2d80, Hi: 0x2d96, Stride: 0x1},
+		unicode.Range16{Lo: 0x2da0, Hi: 0x2da6, Stride: 0x1},
+		unicode.Range16{Lo: 0x2da8, Hi: 0x2dae, Stride: 0x1},
+		unicode.Range16{Lo: 0x2db0, Hi: 0x2db6, Stride: 0x1},
+		unicode.Range16{Lo: 0x2db8, Hi: 0x2dbe, Stride: 0x1},
+		unicode.Range16{Lo: 0x2dc0, Hi: 0x2dc6, Stride: 0x1},
+		unicode.Range16{Lo: 0x2dc8, Hi: 0x2dce, Stride: 0x1},
+		unicode.Range16{Lo: 0x2dd0, Hi: 0x2dd6, Stride: 0x1},
+		unicode.Range16{Lo: 0x2dd8, Hi: 0x2dde, Stride: 0x1},
+		unicode.Range16{Lo: 0x2e2f, Hi: 0x2e2f, Stride: 0x1},
+		unicode.Range16{Lo: 0x3005, Hi: 0x3005, Stride: 0x1},
+		unicode.Range16{Lo: 0x303b, Hi: 0x303b, Stride: 0x1},
+		unicode.Range16{Lo: 0x303c, Hi: 0x303c, Stride: 0x1},
+		unicode.Range16{Lo: 0x3105, Hi: 0x312f, Stride: 0x1},
+		unicode.Range16{Lo: 0x3131, Hi: 0x318e, Stride: 0x1},
+		unicode.Range16{Lo: 0x31a0, Hi: 0x31bf, Stride: 0x1},
+		unicode.Range16{Lo: 0xa000, Hi: 0xa014, Stride: 0x1},
+		unicode.Range16{Lo: 0xa015, Hi: 0xa015, Stride: 0x1},
+		unicode.Range16{Lo: 0xa016, Hi: 0xa48c, Stride: 0x1},
+		unicode.Range16{Lo: 0xa4d0, Hi: 0xa4f7, Stride: 0x1},
+		unicode.Range16{Lo: 0xa4f8, Hi: 0xa4fd, Stride: 0x1},
+		unicode.Range16{Lo: 0xa500, Hi: 0xa60b, Stride: 0x1},
+		unicode.Range16{Lo: 0xa60c, Hi: 0xa60c, Stride: 0x1},
+		unicode.Range16{Lo: 0xa610, Hi: 0xa61f, Stride: 0x1},
+		unicode.Range16{Lo: 0xa62a, Hi: 0xa62b, Stride: 0x1},
+		unicode.Range16{Lo: 0xa640, Hi: 0xa66d, Stride: 0x1},
+		unicode.Range16{Lo: 0xa66e, Hi: 0xa66e, Stride: 0x1},
+		unicode.Range16{Lo: 0xa67f, Hi: 0xa67f, Stride: 0x1},
+		unicode.Range16{Lo: 0xa680, Hi: 0xa69b, Stride: 0x1},
+		unicode.Range16{Lo: 0xa69c, Hi: 0xa69d, Stride: 0x1},
+		unicode.Range16{Lo: 0xa6a0, Hi: 0xa6e5, Stride: 0x1},
+		unicode.Range16{Lo: 0xa6e6, Hi: 0xa6ef, Stride: 0x1},
+		unicode.Range16{Lo: 0xa708, Hi: 0xa716, Stride: 0x1},
+		unicode.Range16{Lo: 0xa717, Hi: 0xa71f, Stride: 0x1},
+		unicode.Range16{Lo: 0xa720, Hi: 0xa721, Stride: 0x1},
+		unicode.Range16{Lo: 0xa722, Hi: 0xa76f, Stride: 0x1},
+		unicode.Range16{Lo: 0xa770, Hi: 0xa770, Stride: 0x1},
+		unicode.Range16{Lo: 0xa771, Hi: 0xa787, Stride: 0x1},
+		unicode.Range16{Lo: 0xa788, Hi: 0xa788, Stride: 0x1},
+		unicode.Range16{Lo: 0xa789, Hi: 0xa78a, Stride: 0x1},
+		unicode.Range16{Lo: 0xa78b, Hi: 0xa78e, Stride: 0x1},
+		unicode.Range16{Lo: 0xa78f, Hi: 0xa78f, Stride: 0x1},
+		unicode.Range16{Lo: 0xa790, Hi: 0xa7ca, Stride: 0x1},
+		unicode.Range16{Lo: 0xa7d0, Hi: 0xa7d1, Stride: 0x1},
+		unicode.Range16{Lo: 0xa7d3, Hi: 0xa7d3, Stride: 0x1},
+		unicode.Range16{Lo: 0xa7d5, Hi: 0xa7d9, Stride: 0x1},
+		unicode.Range16{Lo: 0xa7f2, Hi: 0xa7f4, Stride: 0x1},
+		unicode.Range16{Lo: 0xa7f5, Hi: 0xa7f6, Stride: 0x1},
+		unicode.Range16{Lo: 0xa7f7, Hi: 0xa7f7, Stride: 0x1},
+		unicode.Range16{Lo: 0xa7f8, Hi: 0xa7f9, Stride: 0x1},
+		unicode.Range16{Lo: 0xa7fa, Hi: 0xa7fa, Stride: 0x1},
+		unicode.Range16{Lo: 0xa7fb, Hi: 0xa801, Stride: 0x1},
+		unicode.Range16{Lo: 0xa803, Hi: 0xa805, Stride: 0x1},
+		unicode.Range16{Lo: 0xa807, Hi: 0xa80a, Stride: 0x1},
+		unicode.Range16{Lo: 0xa80c, Hi: 0xa822, Stride: 0x1},
+		unicode.Range16{Lo: 0xa840, Hi: 0xa873, Stride: 0x1},
+		unicode.Range16{Lo: 0xa882, Hi: 0xa8b3, Stride: 0x1},
+		unicode.Range16{Lo: 0xa8f2, Hi: 0xa8f7, Stride: 0x1},
+		unicode.Range16{Lo: 0xa8fb, Hi: 0xa8fb, Stride: 0x1},
+		unicode.Range16{Lo: 0xa8fd, Hi: 0xa8fe, Stride: 0x1},
+		unicode.Range16{Lo: 0xa90a, Hi: 0xa925, Stride: 0x1},
+		unicode.Range16{Lo: 0xa930, Hi: 0xa946, Stride: 0x1},
+		unicode.Range16{Lo: 0xa960, Hi: 0xa97c, Stride: 0x1},
+		unicode.Range16{Lo: 0xa984, Hi: 0xa9b2, Stride: 0x1},
+		unicode.Range16{Lo: 0xa9cf, Hi: 0xa9cf, Stride: 0x1},
+		unicode.Range16{Lo: 0xaa00, Hi: 0xaa28, Stride: 0x1},
+		unicode.Range16{Lo: 0xaa40, Hi: 0xaa42, Stride: 0x1},
+		unicode.Range16{Lo: 0xaa44, Hi: 0xaa4b, Stride: 0x1},
+		unicode.Range16{Lo: 0xaae0, Hi: 0xaaea, Stride: 0x1},
+		unicode.Range16{Lo: 0xaaf2, Hi: 0xaaf2, Stride: 0x1},
+		unicode.Range16{Lo: 0xaaf3, Hi: 0xaaf4, Stride: 0x1},
+		unicode.Range16{Lo: 0xab01, Hi: 0xab06, Stride: 0x1},
+		unicode.Range16{Lo: 0xab09, Hi: 0xab0e, Stride: 0x1},
+		unicode.Range16{Lo: 0xab11, Hi: 0xab16, Stride: 0x1},
+		unicode.Range16{Lo: 0xab20, Hi: 0xab26, Stride: 0x1},
+		unicode.Range16{Lo: 0xab28, Hi: 0xab2e, Stride: 0x1},
+		unicode.Range16{Lo: 0xab30, Hi: 0xab5a, Stride: 0x1},
+		unicode.Range16{Lo: 0xab5b, Hi: 0xab5b, Stride: 0x1},
+		unicode.Range16{Lo: 0xab5c, Hi: 0xab5f, Stride: 0x1},
+		unicode.Range16{Lo: 0xab60, Hi: 0xab68, Stride: 0x1},
+		unicode.Range16{Lo: 0xab69, Hi: 0xab69, Stride: 0x1},
+		unicode.Range16{Lo: 0xab70, Hi: 0xabbf, Stride: 0x1},
+		unicode.Range16{Lo: 0xabc0, Hi: 0xabe2, Stride: 0x1},
+		unicode.Range16{Lo: 0xac00, Hi: 0xd7a3, Stride: 0x1},
+		unicode.Range16{Lo: 0xd7b0, Hi: 0xd7c6, Stride: 0x1},
+		unicode.Range16{Lo: 0xd7cb, Hi: 0xd7fb, Stride: 0x1},
+		unicode.Range16{Lo: 0xfb00, Hi: 0xfb06, Stride: 0x1},
+		unicode.Range16{Lo: 0xfb13, Hi: 0xfb17, Stride: 0x1},
+		unicode.Range16{Lo: 0xfb50, Hi: 0xfbb1, Stride: 0x1},
+		unicode.Range16{Lo: 0xfbd3, Hi: 0xfd3d, Stride: 0x1},
+		unicode.Range16{Lo: 0xfd50, Hi: 0xfd8f, Stride: 0x1},
+		unicode.Range16{Lo: 0xfd92, Hi: 0xfdc7, Stride: 0x1},
+		unicode.Range16{Lo: 0xfdf0, Hi: 0xfdfb, Stride: 0x1},
+		unicode.Range16{Lo: 0xfe70, Hi: 0xfe74, Stride: 0x1},
+		unicode.Range16{Lo: 0xfe76, Hi: 0xfefc, Stride: 0x1},
+		unicode.Range16{Lo: 0xff21, Hi: 0xff3a, Stride: 0x1},
+		unicode.Range16{Lo: 0xff41, Hi: 0xff5a, Stride: 0x1},
+		unicode.Range16{Lo: 0xffa0, Hi: 0xffbe, Stride: 0x1},
+		unicode.Range16{Lo: 0xffc2, Hi: 0xffc7, Stride: 0x1},
+		unicode.Range16{Lo: 0xffca, Hi: 0xffcf, Stride: 0x1},
+		unicode.Range16{Lo: 0xffd2, Hi: 0xffd7, Stride: 0x1},
+		unicode.Range16{Lo: 0xffda, Hi: 0xffdc, Stride: 0x1},
+	},
+	R32: []unicode.Range32{
+		unicode.Range32{Lo: 0x10000, Hi: 0x1000b, Stride: 0x1},
+		unicode.Range32{Lo: 0x1000d, Hi: 0x10026, Stride: 0x1},
+		unicode.Range32{Lo: 0x10028, Hi: 0x1003a, Stride: 0x1},
+		unicode.Range32{Lo: 0x1003c, Hi: 0x1003d, Stride: 0x1},
+		unicode.Range32{Lo: 0x1003f, Hi: 0x1004d, Stride: 0x1},
+		unicode.Range32{Lo: 0x10050, Hi: 0x1005d, Stride: 0x1},
+		unicode.Range32{Lo: 0x10080, Hi: 0x100fa, Stride: 0x1},
+		unicode.Range32{Lo: 0x10140, Hi: 0x10174, Stride: 0x1},
+		unicode.Range32{Lo: 0x10280, Hi: 0x1029c, Stride: 0x1},
+		unicode.Range32{Lo: 0x102a0, Hi: 0x102d0, Stride: 0x1},
+		unicode.Range32{Lo: 0x10300, Hi: 0x1031f, Stride: 0x1},
+		unicode.Range32{Lo: 0x1032d, Hi: 0x10340, Stride: 0x1},
+		unicode.Range32{Lo: 0x10341, Hi: 0x10341, Stride: 0x1},
+		unicode.Range32{Lo: 0x10342, Hi: 0x10349, Stride: 0x1},
+		unicode.Range32{Lo: 0x1034a, Hi: 0x1034a, Stride: 0x1},
+		unicode.Range32{Lo: 0x10350, Hi: 0x10375, Stride: 0x1},
+		unicode.Range32{Lo: 0x10380, Hi: 0x1039d, Stride: 0x1},
+		unicode.Range32{Lo: 0x103a0, Hi: 0x103c3, Stride: 0x1},
+		unicode.Range32{Lo: 0x103c8, Hi: 0x103cf, Stride: 0x1},
+		unicode.Range32{Lo: 0x103d1, Hi: 0x103d5, Stride: 0x1},
+		unicode.Range32{Lo: 0x10400, Hi: 0x1044f, Stride: 0x1},
+		unicode.Range32{Lo: 0x10450, Hi: 0x1049d, Stride: 0x1},
+		unicode.Range32{Lo: 0x104b0, Hi: 0x104d3, Stride: 0x1},
+		unicode.Range32{Lo: 0x104d8, Hi: 0x104fb, Stride: 0x1},
+		unicode.Range32{Lo: 0x10500, Hi: 0x10527, Stride: 0x1},
+		unicode.Range32{Lo: 0x10530, Hi: 0x10563, Stride: 0x1},
+		unicode.Range32{Lo: 0x10570, Hi: 0x1057a, Stride: 0x1},
+		unicode.Range32{Lo: 0x1057c, Hi: 0x1058a, Stride: 0x1},
+		unicode.Range32{Lo: 0x1058c, Hi: 0x10592, Stride: 0x1},
+		unicode.Range32{Lo: 0x10594, Hi: 0x10595, Stride: 0x1},
+		unicode.Range32{Lo: 0x10597, Hi: 0x105a1, Stride: 0x1},
+		unicode.Range32{Lo: 0x105a3, Hi: 0x105b1, Stride: 0x1},
+		unicode.Range32{Lo: 0x105b3, Hi: 0x105b9, Stride: 0x1},
+		unicode.Range32{Lo: 0x105bb, Hi: 0x105bc, Stride: 0x1},
+		unicode.Range32{Lo: 0x10600, Hi: 0x10736, Stride: 0x1},
+		unicode.Range32{Lo: 0x10740, Hi: 0x10755, Stride: 0x1},
+		unicode.Range32{Lo: 0x10760, Hi: 0x10767, Stride: 0x1},
+		unicode.Range32{Lo: 0x10780, Hi: 0x10785, Stride: 0x1},
+		unicode.Range32{Lo: 0x10787, Hi: 0x107b0, Stride: 0x1},
+		unicode.Range32{Lo: 0x107b2, Hi: 0x107ba, Stride: 0x1},
+		unicode.Range32{Lo: 0x10800, Hi: 0x10805, Stride: 0x1},
+		unicode.Range32{Lo: 0x10808, Hi: 0x10808, Stride: 0x1},
+		unicode.Range32{Lo: 0x1080a, Hi: 0x10835, Stride: 0x1},
+		unicode.Range32{Lo: 0x10837, Hi: 0x10838, Stride: 0x1},
+		unicode.Range32{Lo: 0x1083c, Hi: 0x1083c, Stride: 0x1},
+		unicode.Range32{Lo: 0x1083f, Hi: 0x10855, Stride: 0x1},
+		unicode.Range32{Lo: 0x10860, Hi: 0x10876, Stride: 0x1},
+		unicode.Range32{Lo: 0x10880, Hi: 0x1089e, Stride: 0x1},
+		unicode.Range32{Lo: 0x108e0, Hi: 0x108f2, Stride: 0x1},
+		unicode.Range32{Lo: 0x108f4, Hi: 0x108f5, Stride: 0x1},
+		unicode.Range32{Lo: 0x10900, Hi: 0x10915, Stride: 0x1},
+		unicode.Range32{Lo: 0x10920, Hi: 0x10939, Stride: 0x1},
+		unicode.Range32{Lo: 0x10980, Hi: 0x109b7, Stride: 0x1},
+		unicode.Range32{Lo: 0x109be, Hi: 0x109bf, Stride: 0x1},
+		unicode.Range32{Lo: 0x10a00, Hi: 0x10a00, Stride: 0x1},
+		unicode.Range32{Lo: 0x10a10, Hi: 0x10a13, Stride: 0x1},
+		unicode.Range32{Lo: 0x10a15, Hi: 0x10a17, Stride: 0x1},
+		unicode.Range32{Lo: 0x10a19, Hi: 0x10a35, Stride: 0x1},
+		unicode.Range32{Lo: 0x10a60, Hi: 0x10a7c, Stride: 0x1},
+		unicode.Range32{Lo: 0x10a80, Hi: 0x10a9c, Stride: 0x1},
+		unicode.Range32{Lo: 0x10ac0, Hi: 0x10ac7, Stride: 0x1},
+		unicode.Range32{Lo: 0x10ac9, Hi: 0x10ae4, Stride: 0x1},
+		unicode.Range32{Lo: 0x10b00, Hi: 0x10b35, Stride: 0x1},
+		unicode.Range32{Lo: 0x10b40, Hi: 0x10b55, Stride: 0x1},
+		unicode.Range32{Lo: 0x10b60, Hi: 0x10b72, Stride: 0x1},
+		unicode.Range32{Lo: 0x10b80, Hi: 0x10b91, Stride: 0x1},
+		unicode.Range32{Lo: 0x10c00, Hi: 0x10c48, Stride: 0x1},
+		unicode.Range32{Lo: 0x10c80, Hi: 0x10cb2, Stride: 0x1},
+		unicode.Range32{Lo: 0x10cc0, Hi: 0x10cf2, Stride: 0x1},
+		unicode.Range32{Lo: 0x10d00, Hi: 0x10d23, Stride: 0x1},
+		unicode.Range32{Lo: 0x10e80, Hi: 0x10ea9, Stride: 0x1},
+		unicode.Range32{Lo: 0x10eb0, Hi: 0x10eb1, Stride: 0x1},
+		unicode.Range32{Lo: 0x10f00, Hi: 0x10f1c, Stride: 0x1},
+		unicode.Range32{Lo: 0x10f27, Hi: 0x10f27, Stride: 0x1},
+		unicode.Range32{Lo: 0x10f30, Hi: 0x10f45, Stride: 0x1},
+		unicode.Range32{Lo: 0x10f70, Hi: 0x10f81, Stride: 0x1},
+		unicode.Range32{Lo: 0x10fb0, Hi: 0x10fc4, Stride: 0x1},
+		unicode.Range32{Lo: 0x10fe0, Hi: 0x10ff6, Stride: 0x1},
+		unicode.Range32{Lo: 0x11003, Hi: 0x11037, Stride: 0x1},
+		unicode.Range32{Lo: 0x11071, Hi: 0x11072, Stride: 0x1},
+		unicode.Range32{Lo: 0x11075, Hi: 0x11075, Stride: 0x1},
+		unicode.Range32{Lo: 0x11083, Hi: 0x110af, Stride: 0x1},
+		unicode.Range32{Lo: 0x110d0, Hi: 0x110e8, Stride: 0x1},
+		unicode.Range32{Lo: 0x11103, Hi: 0x11126, Stride: 0x1},
+		unicode.Range32{Lo: 0x11144, Hi: 0x11144, Stride: 0x1},
+		unicode.Range32{Lo: 0x11147, Hi: 0x11147, Stride: 0x1},
+		unicode.Range32{Lo: 0x11150, Hi: 0x11172, Stride: 0x1},
+		unicode.Range32{Lo: 0x11176, Hi: 0x11176, Stride: 0x1},
+		unicode.Range32{Lo: 0x11183, Hi: 0x111b2, Stride: 0x1},
+		unicode.Range32{Lo: 0x111c1, Hi: 0x111c4, Stride: 0x1},
+		unicode.Range32{Lo: 0x111da, Hi: 0x111da, Stride: 0x1},
+		unicode.Range32{Lo: 0x111dc, Hi: 0x111dc, Stride: 0x1},
+		unicode.Range32{Lo: 0x11200, Hi: 0x11211, Stride: 0x1},
+		unicode.Range32{Lo: 0x11213, Hi: 0x1122b, Stride: 0x1},
+		unicode.Range32{Lo: 0x1123f, Hi: 0x11240, Stride: 0x1},
+		unicode.Range32{Lo: 0x11280, Hi: 0x11286, Stride: 0x1},
+		unicode.Range32{Lo: 0x11288, Hi: 0x11288, Stride: 0x1},
+		unicode.Range32{Lo: 0x1128a, Hi: 0x1128d, Stride: 0x1},
+		unicode.Range32{Lo: 0x1128f, Hi: 0x1129d, Stride: 0x1},
+		unicode.Range32{Lo: 0x1129f, Hi: 0x112a8, Stride: 0x1},
+		unicode.Range32{Lo: 0x112b0, Hi: 0x112de, Stride: 0x1},
+		unicode.Range32{Lo: 0x11305, Hi: 0x1130c, Stride: 0x1},
+		unicode.Range32{Lo: 0x1130f, Hi: 0x11310, Stride: 0x1},
+		unicode.Range32{Lo: 0x11313, Hi: 0x11328, Stride: 0x1},
+		unicode.Range32{Lo: 0x1132a, Hi: 0x11330, Stride: 0x1},
+		unicode.Range32{Lo: 0x11332, Hi: 0x11333, Stride: 0x1},
+		unicode.Range32{Lo: 0x11335, Hi: 0x11339, Stride: 0x1},
+		unicode.Range32{Lo: 0x1133d, Hi: 0x1133d, Stride: 0x1},
+		unicode.Range32{Lo: 0x11350, Hi: 0x11350, Stride: 0x1},
+		unicode.Range32{Lo: 0x1135d, Hi: 0x11361, Stride: 0x1},
+		unicode.Range32{Lo: 0x11400, Hi: 0x11434, Stride: 0x1},
+		unicode.Range32{Lo: 0x11447, Hi: 0x1144a, Stride: 0x1},
+		unicode.Range32{Lo: 0x1145f, Hi: 0x11461, Stride: 0x1},
+		unicode.Range32{Lo: 0x11480, Hi: 0x114af, Stride: 0x1},
+		unicode.Range32{Lo: 0x114c4, Hi: 0x114c5, Stride: 0x1},
+		unicode.Range32{Lo: 0x114c7, Hi: 0x114c7, Stride: 0x1},
+		unicode.Range32{Lo: 0x11580, Hi: 0x115ae, Stride: 0x1},
+		unicode.Range32{Lo: 0x115d8, Hi: 0x115db, Stride: 0x1},
+		unicode.Range32{Lo: 0x11600, Hi: 0x1162f, Stride: 0x1},
+		unicode.Range32{Lo: 0x11644, Hi: 0x11644, Stride: 0x1},
+		unicode.Range32{Lo: 0x11680, Hi: 0x116aa, Stride: 0x1},
+		unicode.Range32{Lo: 0x116b8, Hi: 0x116b8, Stride: 0x1},
+		unicode.Range32{Lo: 0x11800, Hi: 0x1182b, Stride: 0x1},
+		unicode.Range32{Lo: 0x118a0, Hi: 0x118df, Stride: 0x1},
+		unicode.Range32{Lo: 0x118ff, Hi: 0x11906, Stride: 0x1},
+		unicode.Range32{Lo: 0x11909, Hi: 0x11909, Stride: 0x1},
+		unicode.Range32{Lo: 0x1190c, Hi: 0x11913, Stride: 0x1},
+		unicode.Range32{Lo: 0x11915, Hi: 0x11916, Stride: 0x1},
+		unicode.Range32{Lo: 0x11918, Hi: 0x1192f, Stride: 0x1},
+		unicode.Range32{Lo: 0x1193f, Hi: 0x1193f, Stride: 0x1},
+		unicode.Range32{Lo: 0x11941, Hi: 0x11941, Stride: 0x1},
+		unicode.Range32{Lo: 0x119a0, Hi: 0x119a7, Stride: 0x1},
+		unicode.Range32{Lo: 0x119aa, Hi: 0x119d0, Stride: 0x1},
+		unicode.Range32{Lo: 0x119e1, Hi: 0x119e1, Stride: 0x1},
+		unicode.Range32{Lo: 0x119e3, Hi: 0x119e3, Stride: 0x1},
+		unicode.Range32{Lo: 0x11a00, Hi: 0x11a00, Stride: 0x1},
+		unicode.Range32{Lo: 0x11a0b, Hi: 0x11a32, Stride: 0x1},
+		unicode.Range32{Lo: 0x11a3a, Hi: 0x11a3a, Stride: 0x1},
+		unicode.Range32{Lo: 0x11a50, Hi: 0x11a50, Stride: 0x1},
+		unicode.Range32{Lo: 0x11a5c, Hi: 0x11a89, Stride: 0x1},
+		unicode.Range32{Lo: 0x11a9d, Hi: 0x11a9d, Stride: 0x1},
+		unicode.Range32{Lo: 0x11ab0, Hi: 0x11af8, Stride: 0x1},
+		unicode.Range32{Lo: 0x11c00, Hi: 0x11c08, Stride: 0x1},
+		unicode.Range32{Lo: 0x11c0a, Hi: 0x11c2e, Stride: 0x1},
+		unicode.Range32{Lo: 0x11c40, Hi: 0x11c40, Stride: 0x1},
+		unicode.Range32{Lo: 0x11c72, Hi: 0x11c8f, Stride: 0x1},
+		unicode.Range32{Lo: 0x11d00, Hi: 0x11d06, Stride: 0x1},
+		unicode.Range32{Lo: 0x11d08, Hi: 0x11d09, Stride: 0x1},
+		unicode.Range32{Lo: 0x11d0b, Hi: 0x11d30, Stride: 0x1},
+		unicode.Range32{Lo: 0x11d46, Hi: 0x11d46, Stride: 0x1},
+		unicode.Range32{Lo: 0x11d60, Hi: 0x11d65, Stride: 0x1},
+		unicode.Range32{Lo: 0x11d67, Hi: 0x11d68, Stride: 0x1},
+		unicode.Range32{Lo: 0x11d6a, Hi: 0x11d89, Stride: 0x1},
+		unicode.Range32{Lo: 0x11d98, Hi: 0x11d98, Stride: 0x1},
+		unicode.Range32{Lo: 0x11ee0, Hi: 0x11ef2, Stride: 0x1},
+		unicode.Range32{Lo: 0x11f02, Hi: 0x11f02, Stride: 0x1},
+		unicode.Range32{Lo: 0x11f04, Hi: 0x11f10, Stride: 0x1},
+		unicode.Range32{Lo: 0x11f12, Hi: 0x11f33, Stride: 0x1},
+		unicode.Range32{Lo: 0x11fb0, Hi: 0x11fb0, Stride: 0x1},
+		unicode.Range32{Lo: 0x12000, Hi: 0x12399, Stride: 0x1},
+		unicode.Range32{Lo: 0x12400, Hi: 0x1246e, Stride: 0x1},
+		unicode.Range32{Lo: 0x12480, Hi: 0x12543, Stride: 0x1},
+		unicode.Range32{Lo: 0x12f90, Hi: 0x12ff0, Stride: 0x1},
+		unicode.Range32{Lo: 0x13000, Hi: 0x1342f, Stride: 0x1},
+		unicode.Range32{Lo: 0x13441, Hi: 0x13446, Stride: 0x1},
+		unicode.Range32{Lo: 0x14400, Hi: 0x14646, Stride: 0x1},
+		unicode.Range32{Lo: 0x16800, Hi: 0x16a38, Stride: 0x1},
+		unicode.Range32{Lo: 0x16a40, Hi: 0x16a5e, Stride: 0x1},
+		unicode.Range32{Lo: 0x16a70, Hi: 0x16abe, Stride: 0x1},
+		unicode.Range32{Lo: 0x16ad0, Hi: 0x16aed, Stride: 0x1},
+		unicode.Range32{Lo: 0x16b00, Hi: 0x16b2f, Stride: 0x1},
+		unicode.Range32{Lo: 0x16b40, Hi: 0x16b43, Stride: 0x1},
+		unicode.Range32{Lo: 0x16b63, Hi: 0x16b77, Stride: 0x1},
+		unicode.Range32{Lo: 0x16b7d, Hi: 0x16b8f, Stride: 0x1},
+		unicode.Range32{Lo: 0x16e40, Hi: 0x16e7f, Stride: 0x1},
+		unicode.Range32{Lo: 0x16f00, Hi: 0x16f4a, Stride: 0x1},
+		unicode.Range32{Lo: 0x16f50, Hi: 0x16f50, Stride: 0x1},
+		unicode.Range32{Lo: 0x16f93, Hi: 0x16f9f, Stride: 0x1},
+		unicode.Range32{Lo: 0x16fe0, Hi: 0x16fe1, Stride: 0x1},
+		unicode.Range32{Lo: 0x16fe3, Hi: 0x16fe3, Stride: 0x1},
+		unicode.Range32{Lo: 0x1bc00, Hi: 0x1bc6a, Stride: 0x1},
+		unicode.Range32{Lo: 0x1bc70, Hi: 0x1bc7c, Stride: 0x1},
+		unicode.Range32{Lo: 0x1bc80, Hi: 0x1bc88, Stride: 0x1},
+		unicode.Range32{Lo: 0x1bc90, Hi: 0x1bc99, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d400, Hi: 0x1d454, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d456, Hi: 0x1d49c, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d49e, Hi: 0x1d49f, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d4a2, Hi: 0x1d4a2, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d4a5, Hi: 0x1d4a6, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d4a9, Hi: 0x1d4ac, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d4ae, Hi: 0x1d4b9, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d4bb, Hi: 0x1d4bb, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d4bd, Hi: 0x1d4c3, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d4c5, Hi: 0x1d505, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d507, Hi: 0x1d50a, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d50d, Hi: 0x1d514, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d516, Hi: 0x1d51c, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d51e, Hi: 0x1d539, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d53b, Hi: 0x1d53e, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d540, Hi: 0x1d544, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d546, Hi: 0x1d546, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d54a, Hi: 0x1d550, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d552, Hi: 0x1d6a5, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d6a8, Hi: 0x1d6c0, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d6c2, Hi: 0x1d6da, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d6dc, Hi: 0x1d6fa, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d6fc, Hi: 0x1d714, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d716, Hi: 0x1d734, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d736, Hi: 0x1d74e, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d750, Hi: 0x1d76e, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d770, Hi: 0x1d788, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d78a, Hi: 0x1d7a8, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d7aa, Hi: 0x1d7c2, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d7c4, Hi: 0x1d7cb, Stride: 0x1},
+		unicode.Range32{Lo: 0x1df00, Hi: 0x1df09, Stride: 0x1},
+		unicode.Range32{Lo: 0x1df0a, Hi: 0x1df0a, Stride: 0x1},
+		unicode.Range32{Lo: 0x1df0b, Hi: 0x1df1e, Stride: 0x1},
+		unicode.Range32{Lo: 0x1df25, Hi: 0x1df2a, Stride: 0x1},
+		unicode.Range32{Lo: 0x1e030, Hi: 0x1e06d, Stride: 0x1},
+		unicode.Range32{Lo: 0x1e100, Hi: 0x1e12c, Stride: 0x1},
+		unicode.Range32{Lo: 0x1e137, Hi: 0x1e13d, Stride: 0x1},
+		unicode.Range32{Lo: 0x1e14e, Hi: 0x1e14e, Stride: 0x1},
+		unicode.Range32{Lo: 0x1e290, Hi: 0x1e2ad, Stride: 0x1},
+		unicode.Range32{Lo: 0x1e2c0, Hi: 0x1e2eb, Stride: 0x1},
+		unicode.Range32{Lo: 0x1e4d0, Hi: 0x1e4ea, Stride: 0x1},
+		unicode.Range32{Lo: 0x1e4eb, Hi: 0x1e4eb, Stride: 0x1},
+		unicode.Range32{Lo: 0x1e7e0, Hi: 0x1e7e6, Stride: 0x1},
+		unicode.Range32{Lo: 0x1e7e8, Hi: 0x1e7eb, Stride: 0x1},
+		unicode.Range32{Lo: 0x1e7ed, Hi: 0x1e7ee, Stride: 0x1},
+		unicode.Range32{Lo: 0x1e7f0, Hi: 0x1e7fe, Stride: 0x1},
+		unicode.Range32{Lo: 0x1e800, Hi: 0x1e8c4, Stride: 0x1},
+		unicode.Range32{Lo: 0x1e900, Hi: 0x1e943, Stride: 0x1},
+		unicode.Range32{Lo: 0x1e94b, Hi: 0x1e94b, Stride: 0x1},
+		unicode.Range32{Lo: 0x1ee00, Hi: 0x1ee03, Stride: 0x1},
+		unicode.Range32{Lo: 0x1ee05, Hi: 0x1ee1f, Stride: 0x1},
+		unicode.Range32{Lo: 0x1ee21, Hi: 0x1ee22, Stride: 0x1},
+		unicode.Range32{Lo: 0x1ee24, Hi: 0x1ee24, Stride: 0x1},
+		unicode.Range32{Lo: 0x1ee27, Hi: 0x1ee27, Stride: 0x1},
+		unicode.Range32{Lo: 0x1ee29, Hi: 0x1ee32, Stride: 0x1},
+		unicode.Range32{Lo: 0x1ee34, Hi: 0x1ee37, Stride: 0x1},
+		unicode.Range32{Lo: 0x1ee39, Hi: 0x1ee39, Stride: 0x1},
+		unicode.Range32{Lo: 0x1ee3b, Hi: 0x1ee3b, Stride: 0x1},
+		unicode.Range32{Lo: 0x1ee42, Hi: 0x1ee42, Stride: 0x1},
+		unicode.Range32{Lo: 0x1ee47, Hi: 0x1ee47, Stride: 0x1},
+		unicode.Range32{Lo: 0x1ee49, Hi: 0x1ee49, Stride: 0x1},
+		unicode.Range32{Lo: 0x1ee4b, Hi: 0x1ee4b, Stride: 0x1},
+		unicode.Range32{Lo: 0x1ee4d, Hi: 0x1ee4f, Stride: 0x1},
+		unicode.Range32{Lo: 0x1ee51, Hi: 0x1ee52, Stride: 0x1},
+		unicode.Range32{Lo: 0x1ee54, Hi: 0x1ee54, Stride: 0x1},
+		unicode.Range32{Lo: 0x1ee57, Hi: 0x1ee57, Stride: 0x1},
+		unicode.Range32{Lo: 0x1ee59, Hi: 0x1ee59, Stride: 0x1},
+		unicode.Range32{Lo: 0x1ee5b, Hi: 0x1ee5b, Stride: 0x1},
+		unicode.Range32{Lo: 0x1ee5d, Hi: 0x1ee5d, Stride: 0x1},
+		unicode.Range32{Lo: 0x1ee5f, Hi: 0x1ee5f, Stride: 0x1},
+		unicode.Range32{Lo: 0x1ee61, Hi: 0x1ee62, Stride: 0x1},
+		unicode.Range32{Lo: 0x1ee64, Hi: 0x1ee64, Stride: 0x1},
+		unicode.Range32{Lo: 0x1ee67, Hi: 0x1ee6a, Stride: 0x1},
+		unicode.Range32{Lo: 0x1ee6c, Hi: 0x1ee72, Stride: 0x1},
+		unicode.Range32{Lo: 0x1ee74, Hi: 0x1ee77, Stride: 0x1},
+		unicode.Range32{Lo: 0x1ee79, Hi: 0x1ee7c, Stride: 0x1},
+		unicode.Range32{Lo: 0x1ee7e, Hi: 0x1ee7e, Stride: 0x1},
+		unicode.Range32{Lo: 0x1ee80, Hi: 0x1ee89, Stride: 0x1},
+		unicode.Range32{Lo: 0x1ee8b, Hi: 0x1ee9b, Stride: 0x1},
+		unicode.Range32{Lo: 0x1eea1, Hi: 0x1eea3, Stride: 0x1},
+		unicode.Range32{Lo: 0x1eea5, Hi: 0x1eea9, Stride: 0x1},
+		unicode.Range32{Lo: 0x1eeab, Hi: 0x1eebb, Stride: 0x1},
+		unicode.Range32{Lo: 0x1f130, Hi: 0x1f149, Stride: 0x1},
+		unicode.Range32{Lo: 0x1f150, Hi: 0x1f169, Stride: 0x1},
+		unicode.Range32{Lo: 0x1f170, Hi: 0x1f189, Stride: 0x1},
+	},
+	LatinOffset: 7,
+}
+
+var _WordCR = &unicode.RangeTable{
+	R16: []unicode.Range16{
+		unicode.Range16{Lo: 0xd, Hi: 0xd, Stride: 0x1},
+	},
+	LatinOffset: 1,
+}
+
+var _WordDouble_Quote = &unicode.RangeTable{
+	R16: []unicode.Range16{
+		unicode.Range16{Lo: 0x22, Hi: 0x22, Stride: 0x1},
+	},
+	LatinOffset: 1,
+}
+
+var _WordExtend = &unicode.RangeTable{
+	R16: []unicode.Range16{
+		unicode.Range16{Lo: 0x300, Hi: 0x36f, Stride: 0x1},
+		unicode.Range16{Lo: 0x483, Hi: 0x487, Stride: 0x1},
+		unicode.Range16{Lo: 0x488, Hi: 0x489, Stride: 0x1},
+		unicode.Range16{Lo: 0x591, Hi: 0x5bd, Stride: 0x1},
+		unicode.Range16{Lo: 0x5bf, Hi: 0x5bf, Stride: 0x1},
+		unicode.Range16{Lo: 0x5c1, Hi: 0x5c2, Stride: 0x1},
+		unicode.Range16{Lo: 0x5c4, Hi: 0x5c5, Stride: 0x1},
+		unicode.Range16{Lo: 0x5c7, Hi: 0x5c7, Stride: 0x1},
+		unicode.Range16{Lo: 0x610, Hi: 0x61a, Stride: 0x1},
+		unicode.Range16{Lo: 0x64b, Hi: 0x65f, Stride: 0x1},
+		unicode.Range16{Lo: 0x670, Hi: 0x670, Stride: 0x1},
+		unicode.Range16{Lo: 0x6d6, Hi: 0x6dc, Stride: 0x1},
+		unicode.Range16{Lo: 0x6df, Hi: 0x6e4, Stride: 0x1},
+		unicode.Range16{Lo: 0x6e7, Hi: 0x6e8, Stride: 0x1},
+		unicode.Range16{Lo: 0x6ea, Hi: 0x6ed, Stride: 0x1},
+		unicode.Range16{Lo: 0x711, Hi: 0x711, Stride: 0x1},
+		unicode.Range16{Lo: 0x730, Hi: 0x74a, Stride: 0x1},
+		unicode.Range16{Lo: 0x7a6, Hi: 0x7b0, Stride: 0x1},
+		unicode.Range16{Lo: 0x7eb, Hi: 0x7f3, Stride: 0x1},
+		unicode.Range16{Lo: 0x7fd, Hi: 0x7fd, Stride: 0x1},
+		unicode.Range16{Lo: 0x816, Hi: 0x819, Stride: 0x1},
+		unicode.Range16{Lo: 0x81b, Hi: 0x823, Stride: 0x1},
+		unicode.Range16{Lo: 0x825, Hi: 0x827, Stride: 0x1},
+		unicode.Range16{Lo: 0x829, Hi: 0x82d, Stride: 0x1},
+		unicode.Range16{Lo: 0x859, Hi: 0x85b, Stride: 0x1},
+		unicode.Range16{Lo: 0x898, Hi: 0x89f, Stride: 0x1},
+		unicode.Range16{Lo: 0x8ca, Hi: 0x8e1, Stride: 0x1},
+		unicode.Range16{Lo: 0x8e3, Hi: 0x902, Stride: 0x1},
+		unicode.Range16{Lo: 0x903, Hi: 0x903, Stride: 0x1},
+		unicode.Range16{Lo: 0x93a, Hi: 0x93a, Stride: 0x1},
+		unicode.Range16{Lo: 0x93b, Hi: 0x93b, Stride: 0x1},
+		unicode.Range16{Lo: 0x93c, Hi: 0x93c, Stride: 0x1},
+		unicode.Range16{Lo: 0x93e, Hi: 0x940, Stride: 0x1},
+		unicode.Range16{Lo: 0x941, Hi: 0x948, Stride: 0x1},
+		unicode.Range16{Lo: 0x949, Hi: 0x94c, Stride: 0x1},
+		unicode.Range16{Lo: 0x94d, Hi: 0x94d, Stride: 0x1},
+		unicode.Range16{Lo: 0x94e, Hi: 0x94f, Stride: 0x1},
+		unicode.Range16{Lo: 0x951, Hi: 0x957, Stride: 0x1},
+		unicode.Range16{Lo: 0x962, Hi: 0x963, Stride: 0x1},
+		unicode.Range16{Lo: 0x981, Hi: 0x981, Stride: 0x1},
+		unicode.Range16{Lo: 0x982, Hi: 0x983, Stride: 0x1},
+		unicode.Range16{Lo: 0x9bc, Hi: 0x9bc, Stride: 0x1},
+		unicode.Range16{Lo: 0x9be, Hi: 0x9c0, Stride: 0x1},
+		unicode.Range16{Lo: 0x9c1, Hi: 0x9c4, Stride: 0x1},
+		unicode.Range16{Lo: 0x9c7, Hi: 0x9c8, Stride: 0x1},
+		unicode.Range16{Lo: 0x9cb, Hi: 0x9cc, Stride: 0x1},
+		unicode.Range16{Lo: 0x9cd, Hi: 0x9cd, Stride: 0x1},
+		unicode.Range16{Lo: 0x9d7, Hi: 0x9d7, Stride: 0x1},
+		unicode.Range16{Lo: 0x9e2, Hi: 0x9e3, Stride: 0x1},
+		unicode.Range16{Lo: 0x9fe, Hi: 0x9fe, Stride: 0x1},
+		unicode.Range16{Lo: 0xa01, Hi: 0xa02, Stride: 0x1},
+		unicode.Range16{Lo: 0xa03, Hi: 0xa03, Stride: 0x1},
+		unicode.Range16{Lo: 0xa3c, Hi: 0xa3c, Stride: 0x1},
+		unicode.Range16{Lo: 0xa3e, Hi: 0xa40, Stride: 0x1},
+		unicode.Range16{Lo: 0xa41, Hi: 0xa42, Stride: 0x1},
+		unicode.Range16{Lo: 0xa47, Hi: 0xa48, Stride: 0x1},
+		unicode.Range16{Lo: 0xa4b, Hi: 0xa4d, Stride: 0x1},
+		unicode.Range16{Lo: 0xa51, Hi: 0xa51, Stride: 0x1},
+		unicode.Range16{Lo: 0xa70, Hi: 0xa71, Stride: 0x1},
+		unicode.Range16{Lo: 0xa75, Hi: 0xa75, Stride: 0x1},
+		unicode.Range16{Lo: 0xa81, Hi: 0xa82, Stride: 0x1},
+		unicode.Range16{Lo: 0xa83, Hi: 0xa83, Stride: 0x1},
+		unicode.Range16{Lo: 0xabc, Hi: 0xabc, Stride: 0x1},
+		unicode.Range16{Lo: 0xabe, Hi: 0xac0, Stride: 0x1},
+		unicode.Range16{Lo: 0xac1, Hi: 0xac5, Stride: 0x1},
+		unicode.Range16{Lo: 0xac7, Hi: 0xac8, Stride: 0x1},
+		unicode.Range16{Lo: 0xac9, Hi: 0xac9, Stride: 0x1},
+		unicode.Range16{Lo: 0xacb, Hi: 0xacc, Stride: 0x1},
+		unicode.Range16{Lo: 0xacd, Hi: 0xacd, Stride: 0x1},
+		unicode.Range16{Lo: 0xae2, Hi: 0xae3, Stride: 0x1},
+		unicode.Range16{Lo: 0xafa, Hi: 0xaff, Stride: 0x1},
+		unicode.Range16{Lo: 0xb01, Hi: 0xb01, Stride: 0x1},
+		unicode.Range16{Lo: 0xb02, Hi: 0xb03, Stride: 0x1},
+		unicode.Range16{Lo: 0xb3c, Hi: 0xb3c, Stride: 0x1},
+		unicode.Range16{Lo: 0xb3e, Hi: 0xb3e, Stride: 0x1},
+		unicode.Range16{Lo: 0xb3f, Hi: 0xb3f, Stride: 0x1},
+		unicode.Range16{Lo: 0xb40, Hi: 0xb40, Stride: 0x1},
+		unicode.Range16{Lo: 0xb41, Hi: 0xb44, Stride: 0x1},
+		unicode.Range16{Lo: 0xb47, Hi: 0xb48, Stride: 0x1},
+		unicode.Range16{Lo: 0xb4b, Hi: 0xb4c, Stride: 0x1},
+		unicode.Range16{Lo: 0xb4d, Hi: 0xb4d, Stride: 0x1},
+		unicode.Range16{Lo: 0xb55, Hi: 0xb56, Stride: 0x1},
+		unicode.Range16{Lo: 0xb57, Hi: 0xb57, Stride: 0x1},
+		unicode.Range16{Lo: 0xb62, Hi: 0xb63, Stride: 0x1},
+		unicode.Range16{Lo: 0xb82, Hi: 0xb82, Stride: 0x1},
+		unicode.Range16{Lo: 0xbbe, Hi: 0xbbf, Stride: 0x1},
+		unicode.Range16{Lo: 0xbc0, Hi: 0xbc0, Stride: 0x1},
+		unicode.Range16{Lo: 0xbc1, Hi: 0xbc2, Stride: 0x1},
+		unicode.Range16{Lo: 0xbc6, Hi: 0xbc8, Stride: 0x1},
+		unicode.Range16{Lo: 0xbca, Hi: 0xbcc, Stride: 0x1},
+		unicode.Range16{Lo: 0xbcd, Hi: 0xbcd, Stride: 0x1},
+		unicode.Range16{Lo: 0xbd7, Hi: 0xbd7, Stride: 0x1},
+		unicode.Range16{Lo: 0xc00, Hi: 0xc00, Stride: 0x1},
+		unicode.Range16{Lo: 0xc01, Hi: 0xc03, Stride: 0x1},
+		unicode.Range16{Lo: 0xc04, Hi: 0xc04, Stride: 0x1},
+		unicode.Range16{Lo: 0xc3c, Hi: 0xc3c, Stride: 0x1},
+		unicode.Range16{Lo: 0xc3e, Hi: 0xc40, Stride: 0x1},
+		unicode.Range16{Lo: 0xc41, Hi: 0xc44, Stride: 0x1},
+		unicode.Range16{Lo: 0xc46, Hi: 0xc48, Stride: 0x1},
+		unicode.Range16{Lo: 0xc4a, Hi: 0xc4d, Stride: 0x1},
+		unicode.Range16{Lo: 0xc55, Hi: 0xc56, Stride: 0x1},
+		unicode.Range16{Lo: 0xc62, Hi: 0xc63, Stride: 0x1},
+		unicode.Range16{Lo: 0xc81, Hi: 0xc81, Stride: 0x1},
+		unicode.Range16{Lo: 0xc82, Hi: 0xc83, Stride: 0x1},
+		unicode.Range16{Lo: 0xcbc, Hi: 0xcbc, Stride: 0x1},
+		unicode.Range16{Lo: 0xcbe, Hi: 0xcbe, Stride: 0x1},
+		unicode.Range16{Lo: 0xcbf, Hi: 0xcbf, Stride: 0x1},
+		unicode.Range16{Lo: 0xcc0, Hi: 0xcc4, Stride: 0x1},
+		unicode.Range16{Lo: 0xcc6, Hi: 0xcc6, Stride: 0x1},
+		unicode.Range16{Lo: 0xcc7, Hi: 0xcc8, Stride: 0x1},
+		unicode.Range16{Lo: 0xcca, Hi: 0xccb, Stride: 0x1},
+		unicode.Range16{Lo: 0xccc, Hi: 0xccd, Stride: 0x1},
+		unicode.Range16{Lo: 0xcd5, Hi: 0xcd6, Stride: 0x1},
+		unicode.Range16{Lo: 0xce2, Hi: 0xce3, Stride: 0x1},
+		unicode.Range16{Lo: 0xcf3, Hi: 0xcf3, Stride: 0x1},
+		unicode.Range16{Lo: 0xd00, Hi: 0xd01, Stride: 0x1},
+		unicode.Range16{Lo: 0xd02, Hi: 0xd03, Stride: 0x1},
+		unicode.Range16{Lo: 0xd3b, Hi: 0xd3c, Stride: 0x1},
+		unicode.Range16{Lo: 0xd3e, Hi: 0xd40, Stride: 0x1},
+		unicode.Range16{Lo: 0xd41, Hi: 0xd44, Stride: 0x1},
+		unicode.Range16{Lo: 0xd46, Hi: 0xd48, Stride: 0x1},
+		unicode.Range16{Lo: 0xd4a, Hi: 0xd4c, Stride: 0x1},
+		unicode.Range16{Lo: 0xd4d, Hi: 0xd4d, Stride: 0x1},
+		unicode.Range16{Lo: 0xd57, Hi: 0xd57, Stride: 0x1},
+		unicode.Range16{Lo: 0xd62, Hi: 0xd63, Stride: 0x1},
+		unicode.Range16{Lo: 0xd81, Hi: 0xd81, Stride: 0x1},
+		unicode.Range16{Lo: 0xd82, Hi: 0xd83, Stride: 0x1},
+		unicode.Range16{Lo: 0xdca, Hi: 0xdca, Stride: 0x1},
+		unicode.Range16{Lo: 0xdcf, Hi: 0xdd1, Stride: 0x1},
+		unicode.Range16{Lo: 0xdd2, Hi: 0xdd4, Stride: 0x1},
+		unicode.Range16{Lo: 0xdd6, Hi: 0xdd6, Stride: 0x1},
+		unicode.Range16{Lo: 0xdd8, Hi: 0xddf, Stride: 0x1},
+		unicode.Range16{Lo: 0xdf2, Hi: 0xdf3, Stride: 0x1},
+		unicode.Range16{Lo: 0xe31, Hi: 0xe31, Stride: 0x1},
+		unicode.Range16{Lo: 0xe34, Hi: 0xe3a, Stride: 0x1},
+		unicode.Range16{Lo: 0xe47, Hi: 0xe4e, Stride: 0x1},
+		unicode.Range16{Lo: 0xeb1, Hi: 0xeb1, Stride: 0x1},
+		unicode.Range16{Lo: 0xeb4, Hi: 0xebc, Stride: 0x1},
+		unicode.Range16{Lo: 0xec8, Hi: 0xece, Stride: 0x1},
+		unicode.Range16{Lo: 0xf18, Hi: 0xf19, Stride: 0x1},
+		unicode.Range16{Lo: 0xf35, Hi: 0xf35, Stride: 0x1},
+		unicode.Range16{Lo: 0xf37, Hi: 0xf37, Stride: 0x1},
+		unicode.Range16{Lo: 0xf39, Hi: 0xf39, Stride: 0x1},
+		unicode.Range16{Lo: 0xf3e, Hi: 0xf3f, Stride: 0x1},
+		unicode.Range16{Lo: 0xf71, Hi: 0xf7e, Stride: 0x1},
+		unicode.Range16{Lo: 0xf7f, Hi: 0xf7f, Stride: 0x1},
+		unicode.Range16{Lo: 0xf80, Hi: 0xf84, Stride: 0x1},
+		unicode.Range16{Lo: 0xf86, Hi: 0xf87, Stride: 0x1},
+		unicode.Range16{Lo: 0xf8d, Hi: 0xf97, Stride: 0x1},
+		unicode.Range16{Lo: 0xf99, Hi: 0xfbc, Stride: 0x1},
+		unicode.Range16{Lo: 0xfc6, Hi: 0xfc6, Stride: 0x1},
+		unicode.Range16{Lo: 0x102b, Hi: 0x102c, Stride: 0x1},
+		unicode.Range16{Lo: 0x102d, Hi: 0x1030, Stride: 0x1},
+		unicode.Range16{Lo: 0x1031, Hi: 0x1031, Stride: 0x1},
+		unicode.Range16{Lo: 0x1032, Hi: 0x1037, Stride: 0x1},
+		unicode.Range16{Lo: 0x1038, Hi: 0x1038, Stride: 0x1},
+		unicode.Range16{Lo: 0x1039, Hi: 0x103a, Stride: 0x1},
+		unicode.Range16{Lo: 0x103b, Hi: 0x103c, Stride: 0x1},
+		unicode.Range16{Lo: 0x103d, Hi: 0x103e, Stride: 0x1},
+		unicode.Range16{Lo: 0x1056, Hi: 0x1057, Stride: 0x1},
+		unicode.Range16{Lo: 0x1058, Hi: 0x1059, Stride: 0x1},
+		unicode.Range16{Lo: 0x105e, Hi: 0x1060, Stride: 0x1},
+		unicode.Range16{Lo: 0x1062, Hi: 0x1064, Stride: 0x1},
+		unicode.Range16{Lo: 0x1067, Hi: 0x106d, Stride: 0x1},
+		unicode.Range16{Lo: 0x1071, Hi: 0x1074, Stride: 0x1},
+		unicode.Range16{Lo: 0x1082, Hi: 0x1082, Stride: 0x1},
+		unicode.Range16{Lo: 0x1083, Hi: 0x1084, Stride: 0x1},
+		unicode.Range16{Lo: 0x1085, Hi: 0x1086, Stride: 0x1},
+		unicode.Range16{Lo: 0x1087, Hi: 0x108c, Stride: 0x1},
+		unicode.Range16{Lo: 0x108d, Hi: 0x108d, Stride: 0x1},
+		unicode.Range16{Lo: 0x108f, Hi: 0x108f, Stride: 0x1},
+		unicode.Range16{Lo: 0x109a, Hi: 0x109c, Stride: 0x1},
+		unicode.Range16{Lo: 0x109d, Hi: 0x109d, Stride: 0x1},
+		unicode.Range16{Lo: 0x135d, Hi: 0x135f, Stride: 0x1},
+		unicode.Range16{Lo: 0x1712, Hi: 0x1714, Stride: 0x1},
+		unicode.Range16{Lo: 0x1715, Hi: 0x1715, Stride: 0x1},
+		unicode.Range16{Lo: 0x1732, Hi: 0x1733, Stride: 0x1},
+		unicode.Range16{Lo: 0x1734, Hi: 0x1734, Stride: 0x1},
+		unicode.Range16{Lo: 0x1752, Hi: 0x1753, Stride: 0x1},
+		unicode.Range16{Lo: 0x1772, Hi: 0x1773, Stride: 0x1},
+		unicode.Range16{Lo: 0x17b4, Hi: 0x17b5, Stride: 0x1},
+		unicode.Range16{Lo: 0x17b6, Hi: 0x17b6, Stride: 0x1},
+		unicode.Range16{Lo: 0x17b7, Hi: 0x17bd, Stride: 0x1},
+		unicode.Range16{Lo: 0x17be, Hi: 0x17c5, Stride: 0x1},
+		unicode.Range16{Lo: 0x17c6, Hi: 0x17c6, Stride: 0x1},
+		unicode.Range16{Lo: 0x17c7, Hi: 0x17c8, Stride: 0x1},
+		unicode.Range16{Lo: 0x17c9, Hi: 0x17d3, Stride: 0x1},
+		unicode.Range16{Lo: 0x17dd, Hi: 0x17dd, Stride: 0x1},
+		unicode.Range16{Lo: 0x180b, Hi: 0x180d, Stride: 0x1},
+		unicode.Range16{Lo: 0x180f, Hi: 0x180f, Stride: 0x1},
+		unicode.Range16{Lo: 0x1885, Hi: 0x1886, Stride: 0x1},
+		unicode.Range16{Lo: 0x18a9, Hi: 0x18a9, Stride: 0x1},
+		unicode.Range16{Lo: 0x1920, Hi: 0x1922, Stride: 0x1},
+		unicode.Range16{Lo: 0x1923, Hi: 0x1926, Stride: 0x1},
+		unicode.Range16{Lo: 0x1927, Hi: 0x1928, Stride: 0x1},
+		unicode.Range16{Lo: 0x1929, Hi: 0x192b, Stride: 0x1},
+		unicode.Range16{Lo: 0x1930, Hi: 0x1931, Stride: 0x1},
+		unicode.Range16{Lo: 0x1932, Hi: 0x1932, Stride: 0x1},
+		unicode.Range16{Lo: 0x1933, Hi: 0x1938, Stride: 0x1},
+		unicode.Range16{Lo: 0x1939, Hi: 0x193b, Stride: 0x1},
+		unicode.Range16{Lo: 0x1a17, Hi: 0x1a18, Stride: 0x1},
+		unicode.Range16{Lo: 0x1a19, Hi: 0x1a1a, Stride: 0x1},
+		unicode.Range16{Lo: 0x1a1b, Hi: 0x1a1b, Stride: 0x1},
+		unicode.Range16{Lo: 0x1a55, Hi: 0x1a55, Stride: 0x1},
+		unicode.Range16{Lo: 0x1a56, Hi: 0x1a56, Stride: 0x1},
+		unicode.Range16{Lo: 0x1a57, Hi: 0x1a57, Stride: 0x1},
+		unicode.Range16{Lo: 0x1a58, Hi: 0x1a5e, Stride: 0x1},
+		unicode.Range16{Lo: 0x1a60, Hi: 0x1a60, Stride: 0x1},
+		unicode.Range16{Lo: 0x1a61, Hi: 0x1a61, Stride: 0x1},
+		unicode.Range16{Lo: 0x1a62, Hi: 0x1a62, Stride: 0x1},
+		unicode.Range16{Lo: 0x1a63, Hi: 0x1a64, Stride: 0x1},
+		unicode.Range16{Lo: 0x1a65, Hi: 0x1a6c, Stride: 0x1},
+		unicode.Range16{Lo: 0x1a6d, Hi: 0x1a72, Stride: 0x1},
+		unicode.Range16{Lo: 0x1a73, Hi: 0x1a7c, Stride: 0x1},
+		unicode.Range16{Lo: 0x1a7f, Hi: 0x1a7f, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ab0, Hi: 0x1abd, Stride: 0x1},
+		unicode.Range16{Lo: 0x1abe, Hi: 0x1abe, Stride: 0x1},
+		unicode.Range16{Lo: 0x1abf, Hi: 0x1ace, Stride: 0x1},
+		unicode.Range16{Lo: 0x1b00, Hi: 0x1b03, Stride: 0x1},
+		unicode.Range16{Lo: 0x1b04, Hi: 0x1b04, Stride: 0x1},
+		unicode.Range16{Lo: 0x1b34, Hi: 0x1b34, Stride: 0x1},
+		unicode.Range16{Lo: 0x1b35, Hi: 0x1b35, Stride: 0x1},
+		unicode.Range16{Lo: 0x1b36, Hi: 0x1b3a, Stride: 0x1},
+		unicode.Range16{Lo: 0x1b3b, Hi: 0x1b3b, Stride: 0x1},
+		unicode.Range16{Lo: 0x1b3c, Hi: 0x1b3c, Stride: 0x1},
+		unicode.Range16{Lo: 0x1b3d, Hi: 0x1b41, Stride: 0x1},
+		unicode.Range16{Lo: 0x1b42, Hi: 0x1b42, Stride: 0x1},
+		unicode.Range16{Lo: 0x1b43, Hi: 0x1b44, Stride: 0x1},
+		unicode.Range16{Lo: 0x1b6b, Hi: 0x1b73, Stride: 0x1},
+		unicode.Range16{Lo: 0x1b80, Hi: 0x1b81, Stride: 0x1},
+		unicode.Range16{Lo: 0x1b82, Hi: 0x1b82, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ba1, Hi: 0x1ba1, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ba2, Hi: 0x1ba5, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ba6, Hi: 0x1ba7, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ba8, Hi: 0x1ba9, Stride: 0x1},
+		unicode.Range16{Lo: 0x1baa, Hi: 0x1baa, Stride: 0x1},
+		unicode.Range16{Lo: 0x1bab, Hi: 0x1bad, Stride: 0x1},
+		unicode.Range16{Lo: 0x1be6, Hi: 0x1be6, Stride: 0x1},
+		unicode.Range16{Lo: 0x1be7, Hi: 0x1be7, Stride: 0x1},
+		unicode.Range16{Lo: 0x1be8, Hi: 0x1be9, Stride: 0x1},
+		unicode.Range16{Lo: 0x1bea, Hi: 0x1bec, Stride: 0x1},
+		unicode.Range16{Lo: 0x1bed, Hi: 0x1bed, Stride: 0x1},
+		unicode.Range16{Lo: 0x1bee, Hi: 0x1bee, Stride: 0x1},
+		unicode.Range16{Lo: 0x1bef, Hi: 0x1bf1, Stride: 0x1},
+		unicode.Range16{Lo: 0x1bf2, Hi: 0x1bf3, Stride: 0x1},
+		unicode.Range16{Lo: 0x1c24, Hi: 0x1c2b, Stride: 0x1},
+		unicode.Range16{Lo: 0x1c2c, Hi: 0x1c33, Stride: 0x1},
+		unicode.Range16{Lo: 0x1c34, Hi: 0x1c35, Stride: 0x1},
+		unicode.Range16{Lo: 0x1c36, Hi: 0x1c37, Stride: 0x1},
+		unicode.Range16{Lo: 0x1cd0, Hi: 0x1cd2, Stride: 0x1},
+		unicode.Range16{Lo: 0x1cd4, Hi: 0x1ce0, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ce1, Hi: 0x1ce1, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ce2, Hi: 0x1ce8, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ced, Hi: 0x1ced, Stride: 0x1},
+		unicode.Range16{Lo: 0x1cf4, Hi: 0x1cf4, Stride: 0x1},
+		unicode.Range16{Lo: 0x1cf7, Hi: 0x1cf7, Stride: 0x1},
+		unicode.Range16{Lo: 0x1cf8, Hi: 0x1cf9, Stride: 0x1},
+		unicode.Range16{Lo: 0x1dc0, Hi: 0x1dff, Stride: 0x1},
+		unicode.Range16{Lo: 0x200c, Hi: 0x200c, Stride: 0x1},
+		unicode.Range16{Lo: 0x20d0, Hi: 0x20dc, Stride: 0x1},
+		unicode.Range16{Lo: 0x20dd, Hi: 0x20e0, Stride: 0x1},
+		unicode.Range16{Lo: 0x20e1, Hi: 0x20e1, Stride: 0x1},
+		unicode.Range16{Lo: 0x20e2, Hi: 0x20e4, Stride: 0x1},
+		unicode.Range16{Lo: 0x20e5, Hi: 0x20f0, Stride: 0x1},
+		unicode.Range16{Lo: 0x2cef, Hi: 0x2cf1, Stride: 0x1},
+		unicode.Range16{Lo: 0x2d7f, Hi: 0x2d7f, Stride: 0x1},
+		unicode.Range16{Lo: 0x2de0, Hi: 0x2dff, Stride: 0x1},
+		unicode.Range16{Lo: 0x302a, Hi: 0x302d, Stride: 0x1},
+		unicode.Range16{Lo: 0x302e, Hi: 0x302f, Stride: 0x1},
+		unicode.Range16{Lo: 0x3099, Hi: 0x309a, Stride: 0x1},
+		unicode.Range16{Lo: 0xa66f, Hi: 0xa66f, Stride: 0x1},
+		unicode.Range16{Lo: 0xa670, Hi: 0xa672, Stride: 0x1},
+		unicode.Range16{Lo: 0xa674, Hi: 0xa67d, Stride: 0x1},
+		unicode.Range16{Lo: 0xa69e, Hi: 0xa69f, Stride: 0x1},
+		unicode.Range16{Lo: 0xa6f0, Hi: 0xa6f1, Stride: 0x1},
+		unicode.Range16{Lo: 0xa802, Hi: 0xa802, Stride: 0x1},
+		unicode.Range16{Lo: 0xa806, Hi: 0xa806, Stride: 0x1},
+		unicode.Range16{Lo: 0xa80b, Hi: 0xa80b, Stride: 0x1},
+		unicode.Range16{Lo: 0xa823, Hi: 0xa824, Stride: 0x1},
+		unicode.Range16{Lo: 0xa825, Hi: 0xa826, Stride: 0x1},
+		unicode.Range16{Lo: 0xa827, Hi: 0xa827, Stride: 0x1},
+		unicode.Range16{Lo: 0xa82c, Hi: 0xa82c, Stride: 0x1},
+		unicode.Range16{Lo: 0xa880, Hi: 0xa881, Stride: 0x1},
+		unicode.Range16{Lo: 0xa8b4, Hi: 0xa8c3, Stride: 0x1},
+		unicode.Range16{Lo: 0xa8c4, Hi: 0xa8c5, Stride: 0x1},
+		unicode.Range16{Lo: 0xa8e0, Hi: 0xa8f1, Stride: 0x1},
+		unicode.Range16{Lo: 0xa8ff, Hi: 0xa8ff, Stride: 0x1},
+		unicode.Range16{Lo: 0xa926, Hi: 0xa92d, Stride: 0x1},
+		unicode.Range16{Lo: 0xa947, Hi: 0xa951, Stride: 0x1},
+		unicode.Range16{Lo: 0xa952, Hi: 0xa953, Stride: 0x1},
+		unicode.Range16{Lo: 0xa980, Hi: 0xa982, Stride: 0x1},
+		unicode.Range16{Lo: 0xa983, Hi: 0xa983, Stride: 0x1},
+		unicode.Range16{Lo: 0xa9b3, Hi: 0xa9b3, Stride: 0x1},
+		unicode.Range16{Lo: 0xa9b4, Hi: 0xa9b5, Stride: 0x1},
+		unicode.Range16{Lo: 0xa9b6, Hi: 0xa9b9, Stride: 0x1},
+		unicode.Range16{Lo: 0xa9ba, Hi: 0xa9bb, Stride: 0x1},
+		unicode.Range16{Lo: 0xa9bc, Hi: 0xa9bd, Stride: 0x1},
+		unicode.Range16{Lo: 0xa9be, Hi: 0xa9c0, Stride: 0x1},
+		unicode.Range16{Lo: 0xa9e5, Hi: 0xa9e5, Stride: 0x1},
+		unicode.Range16{Lo: 0xaa29, Hi: 0xaa2e, Stride: 0x1},
+		unicode.Range16{Lo: 0xaa2f, Hi: 0xaa30, Stride: 0x1},
+		unicode.Range16{Lo: 0xaa31, Hi: 0xaa32, Stride: 0x1},
+		unicode.Range16{Lo: 0xaa33, Hi: 0xaa34, Stride: 0x1},
+		unicode.Range16{Lo: 0xaa35, Hi: 0xaa36, Stride: 0x1},
+		unicode.Range16{Lo: 0xaa43, Hi: 0xaa43, Stride: 0x1},
+		unicode.Range16{Lo: 0xaa4c, Hi: 0xaa4c, Stride: 0x1},
+		unicode.Range16{Lo: 0xaa4d, Hi: 0xaa4d, Stride: 0x1},
+		unicode.Range16{Lo: 0xaa7b, Hi: 0xaa7b, Stride: 0x1},
+		unicode.Range16{Lo: 0xaa7c, Hi: 0xaa7c, Stride: 0x1},
+		unicode.Range16{Lo: 0xaa7d, Hi: 0xaa7d, Stride: 0x1},
+		unicode.Range16{Lo: 0xaab0, Hi: 0xaab0, Stride: 0x1},
+		unicode.Range16{Lo: 0xaab2, Hi: 0xaab4, Stride: 0x1},
+		unicode.Range16{Lo: 0xaab7, Hi: 0xaab8, Stride: 0x1},
+		unicode.Range16{Lo: 0xaabe, Hi: 0xaabf, Stride: 0x1},
+		unicode.Range16{Lo: 0xaac1, Hi: 0xaac1, Stride: 0x1},
+		unicode.Range16{Lo: 0xaaeb, Hi: 0xaaeb, Stride: 0x1},
+		unicode.Range16{Lo: 0xaaec, Hi: 0xaaed, Stride: 0x1},
+		unicode.Range16{Lo: 0xaaee, Hi: 0xaaef, Stride: 0x1},
+		unicode.Range16{Lo: 0xaaf5, Hi: 0xaaf5, Stride: 0x1},
+		unicode.Range16{Lo: 0xaaf6, Hi: 0xaaf6, Stride: 0x1},
+		unicode.Range16{Lo: 0xabe3, Hi: 0xabe4, Stride: 0x1},
+		unicode.Range16{Lo: 0xabe5, Hi: 0xabe5, Stride: 0x1},
+		unicode.Range16{Lo: 0xabe6, Hi: 0xabe7, Stride: 0x1},
+		unicode.Range16{Lo: 0xabe8, Hi: 0xabe8, Stride: 0x1},
+		unicode.Range16{Lo: 0xabe9, Hi: 0xabea, Stride: 0x1},
+		unicode.Range16{Lo: 0xabec, Hi: 0xabec, Stride: 0x1},
+		unicode.Range16{Lo: 0xabed, Hi: 0xabed, Stride: 0x1},
+		unicode.Range16{Lo: 0xfb1e, Hi: 0xfb1e, Stride: 0x1},
+		unicode.Range16{Lo: 0xfe00, Hi: 0xfe0f, Stride: 0x1},
+		unicode.Range16{Lo: 0xfe20, Hi: 0xfe2f, Stride: 0x1},
+		unicode.Range16{Lo: 0xff9e, Hi: 0xff9f, Stride: 0x1},
+	},
+	R32: []unicode.Range32{
+		unicode.Range32{Lo: 0x101fd, Hi: 0x101fd, Stride: 0x1},
+		unicode.Range32{Lo: 0x102e0, Hi: 0x102e0, Stride: 0x1},
+		unicode.Range32{Lo: 0x10376, Hi: 0x1037a, Stride: 0x1},
+		unicode.Range32{Lo: 0x10a01, Hi: 0x10a03, Stride: 0x1},
+		unicode.Range32{Lo: 0x10a05, Hi: 0x10a06, Stride: 0x1},
+		unicode.Range32{Lo: 0x10a0c, Hi: 0x10a0f, Stride: 0x1},
+		unicode.Range32{Lo: 0x10a38, Hi: 0x10a3a, Stride: 0x1},
+		unicode.Range32{Lo: 0x10a3f, Hi: 0x10a3f, Stride: 0x1},
+		unicode.Range32{Lo: 0x10ae5, Hi: 0x10ae6, Stride: 0x1},
+		unicode.Range32{Lo: 0x10d24, Hi: 0x10d27, Stride: 0x1},
+		unicode.Range32{Lo: 0x10eab, Hi: 0x10eac, Stride: 0x1},
+		unicode.Range32{Lo: 0x10efd, Hi: 0x10eff, Stride: 0x1},
+		unicode.Range32{Lo: 0x10f46, Hi: 0x10f50, Stride: 0x1},
+		unicode.Range32{Lo: 0x10f82, Hi: 0x10f85, Stride: 0x1},
+		unicode.Range32{Lo: 0x11000, Hi: 0x11000, Stride: 0x1},
+		unicode.Range32{Lo: 0x11001, Hi: 0x11001, Stride: 0x1},
+		unicode.Range32{Lo: 0x11002, Hi: 0x11002, Stride: 0x1},
+		unicode.Range32{Lo: 0x11038, Hi: 0x11046, Stride: 0x1},
+		unicode.Range32{Lo: 0x11070, Hi: 0x11070, Stride: 0x1},
+		unicode.Range32{Lo: 0x11073, Hi: 0x11074, Stride: 0x1},
+		unicode.Range32{Lo: 0x1107f, Hi: 0x11081, Stride: 0x1},
+		unicode.Range32{Lo: 0x11082, Hi: 0x11082, Stride: 0x1},
+		unicode.Range32{Lo: 0x110b0, Hi: 0x110b2, Stride: 0x1},
+		unicode.Range32{Lo: 0x110b3, Hi: 0x110b6, Stride: 0x1},
+		unicode.Range32{Lo: 0x110b7, Hi: 0x110b8, Stride: 0x1},
+		unicode.Range32{Lo: 0x110b9, Hi: 0x110ba, Stride: 0x1},
+		unicode.Range32{Lo: 0x110c2, Hi: 0x110c2, Stride: 0x1},
+		unicode.Range32{Lo: 0x11100, Hi: 0x11102, Stride: 0x1},
+		unicode.Range32{Lo: 0x11127, Hi: 0x1112b, Stride: 0x1},
+		unicode.Range32{Lo: 0x1112c, Hi: 0x1112c, Stride: 0x1},
+		unicode.Range32{Lo: 0x1112d, Hi: 0x11134, Stride: 0x1},
+		unicode.Range32{Lo: 0x11145, Hi: 0x11146, Stride: 0x1},
+		unicode.Range32{Lo: 0x11173, Hi: 0x11173, Stride: 0x1},
+		unicode.Range32{Lo: 0x11180, Hi: 0x11181, Stride: 0x1},
+		unicode.Range32{Lo: 0x11182, Hi: 0x11182, Stride: 0x1},
+		unicode.Range32{Lo: 0x111b3, Hi: 0x111b5, Stride: 0x1},
+		unicode.Range32{Lo: 0x111b6, Hi: 0x111be, Stride: 0x1},
+		unicode.Range32{Lo: 0x111bf, Hi: 0x111c0, Stride: 0x1},
+		unicode.Range32{Lo: 0x111c9, Hi: 0x111cc, Stride: 0x1},
+		unicode.Range32{Lo: 0x111ce, Hi: 0x111ce, Stride: 0x1},
+		unicode.Range32{Lo: 0x111cf, Hi: 0x111cf, Stride: 0x1},
+		unicode.Range32{Lo: 0x1122c, Hi: 0x1122e, Stride: 0x1},
+		unicode.Range32{Lo: 0x1122f, Hi: 0x11231, Stride: 0x1},
+		unicode.Range32{Lo: 0x11232, Hi: 0x11233, Stride: 0x1},
+		unicode.Range32{Lo: 0x11234, Hi: 0x11234, Stride: 0x1},
+		unicode.Range32{Lo: 0x11235, Hi: 0x11235, Stride: 0x1},
+		unicode.Range32{Lo: 0x11236, Hi: 0x11237, Stride: 0x1},
+		unicode.Range32{Lo: 0x1123e, Hi: 0x1123e, Stride: 0x1},
+		unicode.Range32{Lo: 0x11241, Hi: 0x11241, Stride: 0x1},
+		unicode.Range32{Lo: 0x112df, Hi: 0x112df, Stride: 0x1},
+		unicode.Range32{Lo: 0x112e0, Hi: 0x112e2, Stride: 0x1},
+		unicode.Range32{Lo: 0x112e3, Hi: 0x112ea, Stride: 0x1},
+		unicode.Range32{Lo: 0x11300, Hi: 0x11301, Stride: 0x1},
+		unicode.Range32{Lo: 0x11302, Hi: 0x11303, Stride: 0x1},
+		unicode.Range32{Lo: 0x1133b, Hi: 0x1133c, Stride: 0x1},
+		unicode.Range32{Lo: 0x1133e, Hi: 0x1133f, Stride: 0x1},
+		unicode.Range32{Lo: 0x11340, Hi: 0x11340, Stride: 0x1},
+		unicode.Range32{Lo: 0x11341, Hi: 0x11344, Stride: 0x1},
+		unicode.Range32{Lo: 0x11347, Hi: 0x11348, Stride: 0x1},
+		unicode.Range32{Lo: 0x1134b, Hi: 0x1134d, Stride: 0x1},
+		unicode.Range32{Lo: 0x11357, Hi: 0x11357, Stride: 0x1},
+		unicode.Range32{Lo: 0x11362, Hi: 0x11363, Stride: 0x1},
+		unicode.Range32{Lo: 0x11366, Hi: 0x1136c, Stride: 0x1},
+		unicode.Range32{Lo: 0x11370, Hi: 0x11374, Stride: 0x1},
+		unicode.Range32{Lo: 0x11435, Hi: 0x11437, Stride: 0x1},
+		unicode.Range32{Lo: 0x11438, Hi: 0x1143f, Stride: 0x1},
+		unicode.Range32{Lo: 0x11440, Hi: 0x11441, Stride: 0x1},
+		unicode.Range32{Lo: 0x11442, Hi: 0x11444, Stride: 0x1},
+		unicode.Range32{Lo: 0x11445, Hi: 0x11445, Stride: 0x1},
+		unicode.Range32{Lo: 0x11446, Hi: 0x11446, Stride: 0x1},
+		unicode.Range32{Lo: 0x1145e, Hi: 0x1145e, Stride: 0x1},
+		unicode.Range32{Lo: 0x114b0, Hi: 0x114b2, Stride: 0x1},
+		unicode.Range32{Lo: 0x114b3, Hi: 0x114b8, Stride: 0x1},
+		unicode.Range32{Lo: 0x114b9, Hi: 0x114b9, Stride: 0x1},
+		unicode.Range32{Lo: 0x114ba, Hi: 0x114ba, Stride: 0x1},
+		unicode.Range32{Lo: 0x114bb, Hi: 0x114be, Stride: 0x1},
+		unicode.Range32{Lo: 0x114bf, Hi: 0x114c0, Stride: 0x1},
+		unicode.Range32{Lo: 0x114c1, Hi: 0x114c1, Stride: 0x1},
+		unicode.Range32{Lo: 0x114c2, Hi: 0x114c3, Stride: 0x1},
+		unicode.Range32{Lo: 0x115af, Hi: 0x115b1, Stride: 0x1},
+		unicode.Range32{Lo: 0x115b2, Hi: 0x115b5, Stride: 0x1},
+		unicode.Range32{Lo: 0x115b8, Hi: 0x115bb, Stride: 0x1},
+		unicode.Range32{Lo: 0x115bc, Hi: 0x115bd, Stride: 0x1},
+		unicode.Range32{Lo: 0x115be, Hi: 0x115be, Stride: 0x1},
+		unicode.Range32{Lo: 0x115bf, Hi: 0x115c0, Stride: 0x1},
+		unicode.Range32{Lo: 0x115dc, Hi: 0x115dd, Stride: 0x1},
+		unicode.Range32{Lo: 0x11630, Hi: 0x11632, Stride: 0x1},
+		unicode.Range32{Lo: 0x11633, Hi: 0x1163a, Stride: 0x1},
+		unicode.Range32{Lo: 0x1163b, Hi: 0x1163c, Stride: 0x1},
+		unicode.Range32{Lo: 0x1163d, Hi: 0x1163d, Stride: 0x1},
+		unicode.Range32{Lo: 0x1163e, Hi: 0x1163e, Stride: 0x1},
+		unicode.Range32{Lo: 0x1163f, Hi: 0x11640, Stride: 0x1},
+		unicode.Range32{Lo: 0x116ab, Hi: 0x116ab, Stride: 0x1},
+		unicode.Range32{Lo: 0x116ac, Hi: 0x116ac, Stride: 0x1},
+		unicode.Range32{Lo: 0x116ad, Hi: 0x116ad, Stride: 0x1},
+		unicode.Range32{Lo: 0x116ae, Hi: 0x116af, Stride: 0x1},
+		unicode.Range32{Lo: 0x116b0, Hi: 0x116b5, Stride: 0x1},
+		unicode.Range32{Lo: 0x116b6, Hi: 0x116b6, Stride: 0x1},
+		unicode.Range32{Lo: 0x116b7, Hi: 0x116b7, Stride: 0x1},
+		unicode.Range32{Lo: 0x1171d, Hi: 0x1171f, Stride: 0x1},
+		unicode.Range32{Lo: 0x11720, Hi: 0x11721, Stride: 0x1},
+		unicode.Range32{Lo: 0x11722, Hi: 0x11725, Stride: 0x1},
+		unicode.Range32{Lo: 0x11726, Hi: 0x11726, Stride: 0x1},
+		unicode.Range32{Lo: 0x11727, Hi: 0x1172b, Stride: 0x1},
+		unicode.Range32{Lo: 0x1182c, Hi: 0x1182e, Stride: 0x1},
+		unicode.Range32{Lo: 0x1182f, Hi: 0x11837, Stride: 0x1},
+		unicode.Range32{Lo: 0x11838, Hi: 0x11838, Stride: 0x1},
+		unicode.Range32{Lo: 0x11839, Hi: 0x1183a, Stride: 0x1},
+		unicode.Range32{Lo: 0x11930, Hi: 0x11935, Stride: 0x1},
+		unicode.Range32{Lo: 0x11937, Hi: 0x11938, Stride: 0x1},
+		unicode.Range32{Lo: 0x1193b, Hi: 0x1193c, Stride: 0x1},
+		unicode.Range32{Lo: 0x1193d, Hi: 0x1193d, Stride: 0x1},
+		unicode.Range32{Lo: 0x1193e, Hi: 0x1193e, Stride: 0x1},
+		unicode.Range32{Lo: 0x11940, Hi: 0x11940, Stride: 0x1},
+		unicode.Range32{Lo: 0x11942, Hi: 0x11942, Stride: 0x1},
+		unicode.Range32{Lo: 0x11943, Hi: 0x11943, Stride: 0x1},
+		unicode.Range32{Lo: 0x119d1, Hi: 0x119d3, Stride: 0x1},
+		unicode.Range32{Lo: 0x119d4, Hi: 0x119d7, Stride: 0x1},
+		unicode.Range32{Lo: 0x119da, Hi: 0x119db, Stride: 0x1},
+		unicode.Range32{Lo: 0x119dc, Hi: 0x119df, Stride: 0x1},
+		unicode.Range32{Lo: 0x119e0, Hi: 0x119e0, Stride: 0x1},
+		unicode.Range32{Lo: 0x119e4, Hi: 0x119e4, Stride: 0x1},
+		unicode.Range32{Lo: 0x11a01, Hi: 0x11a0a, Stride: 0x1},
+		unicode.Range32{Lo: 0x11a33, Hi: 0x11a38, Stride: 0x1},
+		unicode.Range32{Lo: 0x11a39, Hi: 0x11a39, Stride: 0x1},
+		unicode.Range32{Lo: 0x11a3b, Hi: 0x11a3e, Stride: 0x1},
+		unicode.Range32{Lo: 0x11a47, Hi: 0x11a47, Stride: 0x1},
+		unicode.Range32{Lo: 0x11a51, Hi: 0x11a56, Stride: 0x1},
+		unicode.Range32{Lo: 0x11a57, Hi: 0x11a58, Stride: 0x1},
+		unicode.Range32{Lo: 0x11a59, Hi: 0x11a5b, Stride: 0x1},
+		unicode.Range32{Lo: 0x11a8a, Hi: 0x11a96, Stride: 0x1},
+		unicode.Range32{Lo: 0x11a97, Hi: 0x11a97, Stride: 0x1},
+		unicode.Range32{Lo: 0x11a98, Hi: 0x11a99, Stride: 0x1},
+		unicode.Range32{Lo: 0x11c2f, Hi: 0x11c2f, Stride: 0x1},
+		unicode.Range32{Lo: 0x11c30, Hi: 0x11c36, Stride: 0x1},
+		unicode.Range32{Lo: 0x11c38, Hi: 0x11c3d, Stride: 0x1},
+		unicode.Range32{Lo: 0x11c3e, Hi: 0x11c3e, Stride: 0x1},
+		unicode.Range32{Lo: 0x11c3f, Hi: 0x11c3f, Stride: 0x1},
+		unicode.Range32{Lo: 0x11c92, Hi: 0x11ca7, Stride: 0x1},
+		unicode.Range32{Lo: 0x11ca9, Hi: 0x11ca9, Stride: 0x1},
+		unicode.Range32{Lo: 0x11caa, Hi: 0x11cb0, Stride: 0x1},
+		unicode.Range32{Lo: 0x11cb1, Hi: 0x11cb1, Stride: 0x1},
+		unicode.Range32{Lo: 0x11cb2, Hi: 0x11cb3, Stride: 0x1},
+		unicode.Range32{Lo: 0x11cb4, Hi: 0x11cb4, Stride: 0x1},
+		unicode.Range32{Lo: 0x11cb5, Hi: 0x11cb6, Stride: 0x1},
+		unicode.Range32{Lo: 0x11d31, Hi: 0x11d36, Stride: 0x1},
+		unicode.Range32{Lo: 0x11d3a, Hi: 0x11d3a, Stride: 0x1},
+		unicode.Range32{Lo: 0x11d3c, Hi: 0x11d3d, Stride: 0x1},
+		unicode.Range32{Lo: 0x11d3f, Hi: 0x11d45, Stride: 0x1},
+		unicode.Range32{Lo: 0x11d47, Hi: 0x11d47, Stride: 0x1},
+		unicode.Range32{Lo: 0x11d8a, Hi: 0x11d8e, Stride: 0x1},
+		unicode.Range32{Lo: 0x11d90, Hi: 0x11d91, Stride: 0x1},
+		unicode.Range32{Lo: 0x11d93, Hi: 0x11d94, Stride: 0x1},
+		unicode.Range32{Lo: 0x11d95, Hi: 0x11d95, Stride: 0x1},
+		unicode.Range32{Lo: 0x11d96, Hi: 0x11d96, Stride: 0x1},
+		unicode.Range32{Lo: 0x11d97, Hi: 0x11d97, Stride: 0x1},
+		unicode.Range32{Lo: 0x11ef3, Hi: 0x11ef4, Stride: 0x1},
+		unicode.Range32{Lo: 0x11ef5, Hi: 0x11ef6, Stride: 0x1},
+		unicode.Range32{Lo: 0x11f00, Hi: 0x11f01, Stride: 0x1},
+		unicode.Range32{Lo: 0x11f03, Hi: 0x11f03, Stride: 0x1},
+		unicode.Range32{Lo: 0x11f34, Hi: 0x11f35, Stride: 0x1},
+		unicode.Range32{Lo: 0x11f36, Hi: 0x11f3a, Stride: 0x1},
+		unicode.Range32{Lo: 0x11f3e, Hi: 0x11f3f, Stride: 0x1},
+		unicode.Range32{Lo: 0x11f40, Hi: 0x11f40, Stride: 0x1},
+		unicode.Range32{Lo: 0x11f41, Hi: 0x11f41, Stride: 0x1},
+		unicode.Range32{Lo: 0x11f42, Hi: 0x11f42, Stride: 0x1},
+		unicode.Range32{Lo: 0x13440, Hi: 0x13440, Stride: 0x1},
+		unicode.Range32{Lo: 0x13447, Hi: 0x13455, Stride: 0x1},
+		unicode.Range32{Lo: 0x16af0, Hi: 0x16af4, Stride: 0x1},
+		unicode.Range32{Lo: 0x16b30, Hi: 0x16b36, Stride: 0x1},
+		unicode.Range32{Lo: 0x16f4f, Hi: 0x16f4f, Stride: 0x1},
+		unicode.Range32{Lo: 0x16f51, Hi: 0x16f87, Stride: 0x1},
+		unicode.Range32{Lo: 0x16f8f, Hi: 0x16f92, Stride: 0x1},
+		unicode.Range32{Lo: 0x16fe4, Hi: 0x16fe4, Stride: 0x1},
+		unicode.Range32{Lo: 0x16ff0, Hi: 0x16ff1, Stride: 0x1},
+		unicode.Range32{Lo: 0x1bc9d, Hi: 0x1bc9e, Stride: 0x1},
+		unicode.Range32{Lo: 0x1cf00, Hi: 0x1cf2d, Stride: 0x1},
+		unicode.Range32{Lo: 0x1cf30, Hi: 0x1cf46, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d165, Hi: 0x1d166, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d167, Hi: 0x1d169, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d16d, Hi: 0x1d172, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d17b, Hi: 0x1d182, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d185, Hi: 0x1d18b, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d1aa, Hi: 0x1d1ad, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d242, Hi: 0x1d244, Stride: 0x1},
+		unicode.Range32{Lo: 0x1da00, Hi: 0x1da36, Stride: 0x1},
+		unicode.Range32{Lo: 0x1da3b, Hi: 0x1da6c, Stride: 0x1},
+		unicode.Range32{Lo: 0x1da75, Hi: 0x1da75, Stride: 0x1},
+		unicode.Range32{Lo: 0x1da84, Hi: 0x1da84, Stride: 0x1},
+		unicode.Range32{Lo: 0x1da9b, Hi: 0x1da9f, Stride: 0x1},
+		unicode.Range32{Lo: 0x1daa1, Hi: 0x1daaf, Stride: 0x1},
+		unicode.Range32{Lo: 0x1e000, Hi: 0x1e006, Stride: 0x1},
+		unicode.Range32{Lo: 0x1e008, Hi: 0x1e018, Stride: 0x1},
+		unicode.Range32{Lo: 0x1e01b, Hi: 0x1e021, Stride: 0x1},
+		unicode.Range32{Lo: 0x1e023, Hi: 0x1e024, Stride: 0x1},
+		unicode.Range32{Lo: 0x1e026, Hi: 0x1e02a, Stride: 0x1},
+		unicode.Range32{Lo: 0x1e08f, Hi: 0x1e08f, Stride: 0x1},
+		unicode.Range32{Lo: 0x1e130, Hi: 0x1e136, Stride: 0x1},
+		unicode.Range32{Lo: 0x1e2ae, Hi: 0x1e2ae, Stride: 0x1},
+		unicode.Range32{Lo: 0x1e2ec, Hi: 0x1e2ef, Stride: 0x1},
+		unicode.Range32{Lo: 0x1e4ec, Hi: 0x1e4ef, Stride: 0x1},
+		unicode.Range32{Lo: 0x1e8d0, Hi: 0x1e8d6, Stride: 0x1},
+		unicode.Range32{Lo: 0x1e944, Hi: 0x1e94a, Stride: 0x1},
+		unicode.Range32{Lo: 0x1f3fb, Hi: 0x1f3ff, Stride: 0x1},
+		unicode.Range32{Lo: 0xe0020, Hi: 0xe007f, Stride: 0x1},
+		unicode.Range32{Lo: 0xe0100, Hi: 0xe01ef, Stride: 0x1},
+	},
+	LatinOffset: 0,
+}
+
+var _WordExtendNumLet = &unicode.RangeTable{
+	R16: []unicode.Range16{
+		unicode.Range16{Lo: 0x5f, Hi: 0x5f, Stride: 0x1},
+		unicode.Range16{Lo: 0x202f, Hi: 0x202f, Stride: 0x1},
+		unicode.Range16{Lo: 0x203f, Hi: 0x2040, Stride: 0x1},
+		unicode.Range16{Lo: 0x2054, Hi: 0x2054, Stride: 0x1},
+		unicode.Range16{Lo: 0xfe33, Hi: 0xfe34, Stride: 0x1},
+		unicode.Range16{Lo: 0xfe4d, Hi: 0xfe4f, Stride: 0x1},
+		unicode.Range16{Lo: 0xff3f, Hi: 0xff3f, Stride: 0x1},
+	},
+	LatinOffset: 1,
+}
+
+var _WordFormat = &unicode.RangeTable{
+	R16: []unicode.Range16{
+		unicode.Range16{Lo: 0xad, Hi: 0xad, Stride: 0x1},
+		unicode.Range16{Lo: 0x600, Hi: 0x605, Stride: 0x1},
+		unicode.Range16{Lo: 0x61c, Hi: 0x61c, Stride: 0x1},
+		unicode.Range16{Lo: 0x6dd, Hi: 0x6dd, Stride: 0x1},
+		unicode.Range16{Lo: 0x70f, Hi: 0x70f, Stride: 0x1},
+		unicode.Range16{Lo: 0x890, Hi: 0x891, Stride: 0x1},
+		unicode.Range16{Lo: 0x8e2, Hi: 0x8e2, Stride: 0x1},
+		unicode.Range16{Lo: 0x180e, Hi: 0x180e, Stride: 0x1},
+		unicode.Range16{Lo: 0x200e, Hi: 0x200f, Stride: 0x1},
+		unicode.Range16{Lo: 0x202a, Hi: 0x202e, Stride: 0x1},
+		unicode.Range16{Lo: 0x2060, Hi: 0x2064, Stride: 0x1},
+		unicode.Range16{Lo: 0x2066, Hi: 0x206f, Stride: 0x1},
+		unicode.Range16{Lo: 0xfeff, Hi: 0xfeff, Stride: 0x1},
+		unicode.Range16{Lo: 0xfff9, Hi: 0xfffb, Stride: 0x1},
+	},
+	R32: []unicode.Range32{
+		unicode.Range32{Lo: 0x110bd, Hi: 0x110bd, Stride: 0x1},
+		unicode.Range32{Lo: 0x110cd, Hi: 0x110cd, Stride: 0x1},
+		unicode.Range32{Lo: 0x13430, Hi: 0x1343f, Stride: 0x1},
+		unicode.Range32{Lo: 0x1bca0, Hi: 0x1bca3, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d173, Hi: 0x1d17a, Stride: 0x1},
+		unicode.Range32{Lo: 0xe0001, Hi: 0xe0001, Stride: 0x1},
+	},
+	LatinOffset: 1,
+}
+
+var _WordHebrew_Letter = &unicode.RangeTable{
+	R16: []unicode.Range16{
+		unicode.Range16{Lo: 0x5d0, Hi: 0x5ea, Stride: 0x1},
+		unicode.Range16{Lo: 0x5ef, Hi: 0x5f2, Stride: 0x1},
+		unicode.Range16{Lo: 0xfb1d, Hi: 0xfb1d, Stride: 0x1},
+		unicode.Range16{Lo: 0xfb1f, Hi: 0xfb28, Stride: 0x1},
+		unicode.Range16{Lo: 0xfb2a, Hi: 0xfb36, Stride: 0x1},
+		unicode.Range16{Lo: 0xfb38, Hi: 0xfb3c, Stride: 0x1},
+		unicode.Range16{Lo: 0xfb3e, Hi: 0xfb3e, Stride: 0x1},
+		unicode.Range16{Lo: 0xfb40, Hi: 0xfb41, Stride: 0x1},
+		unicode.Range16{Lo: 0xfb43, Hi: 0xfb44, Stride: 0x1},
+		unicode.Range16{Lo: 0xfb46, Hi: 0xfb4f, Stride: 0x1},
+	},
+	LatinOffset: 0,
+}
+
+var _WordKatakana = &unicode.RangeTable{
+	R16: []unicode.Range16{
+		unicode.Range16{Lo: 0x3031, Hi: 0x3035, Stride: 0x1},
+		unicode.Range16{Lo: 0x309b, Hi: 0x309c, Stride: 0x1},
+		unicode.Range16{Lo: 0x30a0, Hi: 0x30a0, Stride: 0x1},
+		unicode.Range16{Lo: 0x30a1, Hi: 0x30fa, Stride: 0x1},
+		unicode.Range16{Lo: 0x30fc, Hi: 0x30fe, Stride: 0x1},
+		unicode.Range16{Lo: 0x30ff, Hi: 0x30ff, Stride: 0x1},
+		unicode.Range16{Lo: 0x31f0, Hi: 0x31ff, Stride: 0x1},
+		unicode.Range16{Lo: 0x32d0, Hi: 0x32fe, Stride: 0x1},
+		unicode.Range16{Lo: 0x3300, Hi: 0x3357, Stride: 0x1},
+		unicode.Range16{Lo: 0xff66, Hi: 0xff6f, Stride: 0x1},
+		unicode.Range16{Lo: 0xff70, Hi: 0xff70, Stride: 0x1},
+		unicode.Range16{Lo: 0xff71, Hi: 0xff9d, Stride: 0x1},
+	},
+	R32: []unicode.Range32{
+		unicode.Range32{Lo: 0x1aff0, Hi: 0x1aff3, Stride: 0x1},
+		unicode.Range32{Lo: 0x1aff5, Hi: 0x1affb, Stride: 0x1},
+		unicode.Range32{Lo: 0x1affd, Hi: 0x1affe, Stride: 0x1},
+		unicode.Range32{Lo: 0x1b000, Hi: 0x1b000, Stride: 0x1},
+		unicode.Range32{Lo: 0x1b120, Hi: 0x1b122, Stride: 0x1},
+		unicode.Range32{Lo: 0x1b155, Hi: 0x1b155, Stride: 0x1},
+		unicode.Range32{Lo: 0x1b164, Hi: 0x1b167, Stride: 0x1},
+	},
+	LatinOffset: 0,
+}
+
+var _WordLF = &unicode.RangeTable{
+	R16: []unicode.Range16{
+		unicode.Range16{Lo: 0xa, Hi: 0xa, Stride: 0x1},
+	},
+	LatinOffset: 1,
+}
+
+var _WordMidLetter = &unicode.RangeTable{
+	R16: []unicode.Range16{
+		unicode.Range16{Lo: 0x3a, Hi: 0x3a, Stride: 0x1},
+		unicode.Range16{Lo: 0xb7, Hi: 0xb7, Stride: 0x1},
+		unicode.Range16{Lo: 0x387, Hi: 0x387, Stride: 0x1},
+		unicode.Range16{Lo: 0x55f, Hi: 0x55f, Stride: 0x1},
+		unicode.Range16{Lo: 0x5f4, Hi: 0x5f4, Stride: 0x1},
+		unicode.Range16{Lo: 0x2027, Hi: 0x2027, Stride: 0x1},
+		unicode.Range16{Lo: 0xfe13, Hi: 0xfe13, Stride: 0x1},
+		unicode.Range16{Lo: 0xfe55, Hi: 0xfe55, Stride: 0x1},
+		unicode.Range16{Lo: 0xff1a, Hi: 0xff1a, Stride: 0x1},
+	},
+	LatinOffset: 2,
+}
+
+var _WordMidNum = &unicode.RangeTable{
+	R16: []unicode.Range16{
+		unicode.Range16{Lo: 0x2c, Hi: 0x2c, Stride: 0x1},
+		unicode.Range16{Lo: 0x3b, Hi: 0x3b, Stride: 0x1},
+		unicode.Range16{Lo: 0x37e, Hi: 0x37e, Stride: 0x1},
+		unicode.Range16{Lo: 0x589, Hi: 0x589, Stride: 0x1},
+		unicode.Range16{Lo: 0x60c, Hi: 0x60d, Stride: 0x1},
+		unicode.Range16{Lo: 0x66c, Hi: 0x66c, Stride: 0x1},
+		unicode.Range16{Lo: 0x7f8, Hi: 0x7f8, Stride: 0x1},
+		unicode.Range16{Lo: 0x2044, Hi: 0x2044, Stride: 0x1},
+		unicode.Range16{Lo: 0xfe10, Hi: 0xfe10, Stride: 0x1},
+		unicode.Range16{Lo: 0xfe14, Hi: 0xfe14, Stride: 0x1},
+		unicode.Range16{Lo: 0xfe50, Hi: 0xfe50, Stride: 0x1},
+		unicode.Range16{Lo: 0xfe54, Hi: 0xfe54, Stride: 0x1},
+		unicode.Range16{Lo: 0xff0c, Hi: 0xff0c, Stride: 0x1},
+		unicode.Range16{Lo: 0xff1b, Hi: 0xff1b, Stride: 0x1},
+	},
+	LatinOffset: 2,
+}
+
+var _WordMidNumLet = &unicode.RangeTable{
+	R16: []unicode.Range16{
+		unicode.Range16{Lo: 0x2e, Hi: 0x2e, Stride: 0x1},
+		unicode.Range16{Lo: 0x2018, Hi: 0x2018, Stride: 0x1},
+		unicode.Range16{Lo: 0x2019, Hi: 0x2019, Stride: 0x1},
+		unicode.Range16{Lo: 0x2024, Hi: 0x2024, Stride: 0x1},
+		unicode.Range16{Lo: 0xfe52, Hi: 0xfe52, Stride: 0x1},
+		unicode.Range16{Lo: 0xff07, Hi: 0xff07, Stride: 0x1},
+		unicode.Range16{Lo: 0xff0e, Hi: 0xff0e, Stride: 0x1},
+	},
+	LatinOffset: 1,
+}
+
+var _WordNewline = &unicode.RangeTable{
+	R16: []unicode.Range16{
+		unicode.Range16{Lo: 0xb, Hi: 0xc, Stride: 0x1},
+		unicode.Range16{Lo: 0x85, Hi: 0x85, Stride: 0x1},
+		unicode.Range16{Lo: 0x2028, Hi: 0x2028, Stride: 0x1},
+		unicode.Range16{Lo: 0x2029, Hi: 0x2029, Stride: 0x1},
+	},
+	LatinOffset: 2,
+}
+
+var _WordNumeric = &unicode.RangeTable{
+	R16: []unicode.Range16{
+		unicode.Range16{Lo: 0x30, Hi: 0x39, Stride: 0x1},
+		unicode.Range16{Lo: 0x660, Hi: 0x669, Stride: 0x1},
+		unicode.Range16{Lo: 0x66b, Hi: 0x66b, Stride: 0x1},
+		unicode.Range16{Lo: 0x6f0, Hi: 0x6f9, Stride: 0x1},
+		unicode.Range16{Lo: 0x7c0, Hi: 0x7c9, Stride: 0x1},
+		unicode.Range16{Lo: 0x966, Hi: 0x96f, Stride: 0x1},
+		unicode.Range16{Lo: 0x9e6, Hi: 0x9ef, Stride: 0x1},
+		unicode.Range16{Lo: 0xa66, Hi: 0xa6f, Stride: 0x1},
+		unicode.Range16{Lo: 0xae6, Hi: 0xaef, Stride: 0x1},
+		unicode.Range16{Lo: 0xb66, Hi: 0xb6f, Stride: 0x1},
+		unicode.Range16{Lo: 0xbe6, Hi: 0xbef, Stride: 0x1},
+		unicode.Range16{Lo: 0xc66, Hi: 0xc6f, Stride: 0x1},
+		unicode.Range16{Lo: 0xce6, Hi: 0xcef, Stride: 0x1},
+		unicode.Range16{Lo: 0xd66, Hi: 0xd6f, Stride: 0x1},
+		unicode.Range16{Lo: 0xde6, Hi: 0xdef, Stride: 0x1},
+		unicode.Range16{Lo: 0xe50, Hi: 0xe59, Stride: 0x1},
+		unicode.Range16{Lo: 0xed0, Hi: 0xed9, Stride: 0x1},
+		unicode.Range16{Lo: 0xf20, Hi: 0xf29, Stride: 0x1},
+		unicode.Range16{Lo: 0x1040, Hi: 0x1049, Stride: 0x1},
+		unicode.Range16{Lo: 0x1090, Hi: 0x1099, Stride: 0x1},
+		unicode.Range16{Lo: 0x17e0, Hi: 0x17e9, Stride: 0x1},
+		unicode.Range16{Lo: 0x1810, Hi: 0x1819, Stride: 0x1},
+		unicode.Range16{Lo: 0x1946, Hi: 0x194f, Stride: 0x1},
+		unicode.Range16{Lo: 0x19d0, Hi: 0x19d9, Stride: 0x1},
+		unicode.Range16{Lo: 0x1a80, Hi: 0x1a89, Stride: 0x1},
+		unicode.Range16{Lo: 0x1a90, Hi: 0x1a99, Stride: 0x1},
+		unicode.Range16{Lo: 0x1b50, Hi: 0x1b59, Stride: 0x1},
+		unicode.Range16{Lo: 0x1bb0, Hi: 0x1bb9, Stride: 0x1},
+		unicode.Range16{Lo: 0x1c40, Hi: 0x1c49, Stride: 0x1},
+		unicode.Range16{Lo: 0x1c50, Hi: 0x1c59, Stride: 0x1},
+		unicode.Range16{Lo: 0xa620, Hi: 0xa629, Stride: 0x1},
+		unicode.Range16{Lo: 0xa8d0, Hi: 0xa8d9, Stride: 0x1},
+		unicode.Range16{Lo: 0xa900, Hi: 0xa909, Stride: 0x1},
+		unicode.Range16{Lo: 0xa9d0, Hi: 0xa9d9, Stride: 0x1},
+		unicode.Range16{Lo: 0xa9f0, Hi: 0xa9f9, Stride: 0x1},
+		unicode.Range16{Lo: 0xaa50, Hi: 0xaa59, Stride: 0x1},
+		unicode.Range16{Lo: 0xabf0, Hi: 0xabf9, Stride: 0x1},
+		unicode.Range16{Lo: 0xff10, Hi: 0xff19, Stride: 0x1},
+	},
+	R32: []unicode.Range32{
+		unicode.Range32{Lo: 0x104a0, Hi: 0x104a9, Stride: 0x1},
+		unicode.Range32{Lo: 0x10d30, Hi: 0x10d39, Stride: 0x1},
+		unicode.Range32{Lo: 0x11066, Hi: 0x1106f, Stride: 0x1},
+		unicode.Range32{Lo: 0x110f0, Hi: 0x110f9, Stride: 0x1},
+		unicode.Range32{Lo: 0x11136, Hi: 0x1113f, Stride: 0x1},
+		unicode.Range32{Lo: 0x111d0, Hi: 0x111d9, Stride: 0x1},
+		unicode.Range32{Lo: 0x112f0, Hi: 0x112f9, Stride: 0x1},
+		unicode.Range32{Lo: 0x11450, Hi: 0x11459, Stride: 0x1},
+		unicode.Range32{Lo: 0x114d0, Hi: 0x114d9, Stride: 0x1},
+		unicode.Range32{Lo: 0x11650, Hi: 0x11659, Stride: 0x1},
+		unicode.Range32{Lo: 0x116c0, Hi: 0x116c9, Stride: 0x1},
+		unicode.Range32{Lo: 0x11730, Hi: 0x11739, Stride: 0x1},
+		unicode.Range32{Lo: 0x118e0, Hi: 0x118e9, Stride: 0x1},
+		unicode.Range32{Lo: 0x11950, Hi: 0x11959, Stride: 0x1},
+		unicode.Range32{Lo: 0x11c50, Hi: 0x11c59, Stride: 0x1},
+		unicode.Range32{Lo: 0x11d50, Hi: 0x11d59, Stride: 0x1},
+		unicode.Range32{Lo: 0x11da0, Hi: 0x11da9, Stride: 0x1},
+		unicode.Range32{Lo: 0x11f50, Hi: 0x11f59, Stride: 0x1},
+		unicode.Range32{Lo: 0x16a60, Hi: 0x16a69, Stride: 0x1},
+		unicode.Range32{Lo: 0x16ac0, Hi: 0x16ac9, Stride: 0x1},
+		unicode.Range32{Lo: 0x16b50, Hi: 0x16b59, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d7ce, Hi: 0x1d7ff, Stride: 0x1},
+		unicode.Range32{Lo: 0x1e140, Hi: 0x1e149, Stride: 0x1},
+		unicode.Range32{Lo: 0x1e2f0, Hi: 0x1e2f9, Stride: 0x1},
+		unicode.Range32{Lo: 0x1e4f0, Hi: 0x1e4f9, Stride: 0x1},
+		unicode.Range32{Lo: 0x1e950, Hi: 0x1e959, Stride: 0x1},
+		unicode.Range32{Lo: 0x1fbf0, Hi: 0x1fbf9, Stride: 0x1},
+	},
+	LatinOffset: 1,
+}
+
+var _WordRegional_Indicator = &unicode.RangeTable{
+	R32: []unicode.Range32{
+		unicode.Range32{Lo: 0x1f1e6, Hi: 0x1f1ff, Stride: 0x1},
+	},
+	LatinOffset: 0,
+}
+
+var _WordSingle_Quote = &unicode.RangeTable{
+	R16: []unicode.Range16{
+		unicode.Range16{Lo: 0x27, Hi: 0x27, Stride: 0x1},
+	},
+	LatinOffset: 1,
+}
+
+var _WordWSegSpace = &unicode.RangeTable{
+	R16: []unicode.Range16{
+		unicode.Range16{Lo: 0x20, Hi: 0x20, Stride: 0x1},
+		unicode.Range16{Lo: 0x1680, Hi: 0x1680, Stride: 0x1},
+		unicode.Range16{Lo: 0x2000, Hi: 0x2006, Stride: 0x1},
+		unicode.Range16{Lo: 0x2008, Hi: 0x200a, Stride: 0x1},
+		unicode.Range16{Lo: 0x205f, Hi: 0x205f, Stride: 0x1},
+		unicode.Range16{Lo: 0x3000, Hi: 0x3000, Stride: 0x1},
+	},
+	LatinOffset: 1,
+}
+
+var _WordZWJ = &unicode.RangeTable{
+	R16: []unicode.Range16{
+		unicode.Range16{Lo: 0x200d, Hi: 0x200d, Stride: 0x1},
+	},
+	LatinOffset: 0,
+}
+
+type _WordRuneRange unicode.RangeTable
+
+func _WordRuneType(r rune) *_WordRuneRange {
+	switch {
+	case unicode.Is(_WordALetter, r):
+		return (*_WordRuneRange)(_WordALetter)
+	case unicode.Is(_WordCR, r):
+		return (*_WordRuneRange)(_WordCR)
+	case unicode.Is(_WordDouble_Quote, r):
+		return (*_WordRuneRange)(_WordDouble_Quote)
+	case unicode.Is(_WordExtend, r):
+		return (*_WordRuneRange)(_WordExtend)
+	case unicode.Is(_WordExtendNumLet, r):
+		return (*_WordRuneRange)(_WordExtendNumLet)
+	case unicode.Is(_WordFormat, r):
+		return (*_WordRuneRange)(_WordFormat)
+	case unicode.Is(_WordHebrew_Letter, r):
+		return (*_WordRuneRange)(_WordHebrew_Letter)
+	case unicode.Is(_WordKatakana, r):
+		return (*_WordRuneRange)(_WordKatakana)
+	case unicode.Is(_WordLF, r):
+		return (*_WordRuneRange)(_WordLF)
+	case unicode.Is(_WordMidLetter, r):
+		return (*_WordRuneRange)(_WordMidLetter)
+	case unicode.Is(_WordMidNum, r):
+		return (*_WordRuneRange)(_WordMidNum)
+	case unicode.Is(_WordMidNumLet, r):
+		return (*_WordRuneRange)(_WordMidNumLet)
+	case unicode.Is(_WordNewline, r):
+		return (*_WordRuneRange)(_WordNewline)
+	case unicode.Is(_WordNumeric, r):
+		return (*_WordRuneRange)(_WordNumeric)
+	case unicode.Is(_WordRegional_Indicator, r):
+		return (*_WordRuneRange)(_WordRegional_Indicator)
+	case unicode.Is(_WordSingle_Quote, r):
+		return (*_WordRuneRange)(_WordSingle_Quote)
+	case unicode.Is(_WordWSegSpace, r):
+		return (*_WordRuneRange)(_WordWSegSpace)
+	case unicode.Is(_WordZWJ, r):
+		return (*_WordRuneRange)(_WordZWJ)
+	default:
+		return nil
+	}
+}
+func (rng *_WordRuneRange) String() string {
+	switch (*unicode.RangeTable)(rng) {
+	case _WordALetter:
+		return "ALetter"
+	case _WordCR:
+		return "CR"
+	case _WordDouble_Quote:
+		return "Double_Quote"
+	case _WordExtend:
+		return "Extend"
+	case _WordExtendNumLet:
+		return "ExtendNumLet"
+	case _WordFormat:
+		return "Format"
+	case _WordHebrew_Letter:
+		return "Hebrew_Letter"
+	case _WordKatakana:
+		return "Katakana"
+	case _WordLF:
+		return "LF"
+	case _WordMidLetter:
+		return "MidLetter"
+	case _WordMidNum:
+		return "MidNum"
+	case _WordMidNumLet:
+		return "MidNumLet"
+	case _WordNewline:
+		return "Newline"
+	case _WordNumeric:
+		return "Numeric"
+	case _WordRegional_Indicator:
+		return "Regional_Indicator"
+	case _WordSingle_Quote:
+		return "Single_Quote"
+	case _WordWSegSpace:
+		return "WSegSpace"
+	case _WordZWJ:
+		return "ZWJ"
+	default:
+		return "Other"
+	}
+}
+
+var _SentenceATerm = &unicode.RangeTable{
+	R16: []unicode.Range16{
+		unicode.Range16{Lo: 0x2e, Hi: 0x2e, Stride: 0x1},
+		unicode.Range16{Lo: 0x2024, Hi: 0x2024, Stride: 0x1},
+		unicode.Range16{Lo: 0xfe52, Hi: 0xfe52, Stride: 0x1},
+		unicode.Range16{Lo: 0xff0e, Hi: 0xff0e, Stride: 0x1},
+	},
+	LatinOffset: 1,
+}
+
+var _SentenceCR = &unicode.RangeTable{
+	R16: []unicode.Range16{
+		unicode.Range16{Lo: 0xd, Hi: 0xd, Stride: 0x1},
+	},
+	LatinOffset: 1,
+}
+
+var _SentenceClose = &unicode.RangeTable{
+	R16: []unicode.Range16{
+		unicode.Range16{Lo: 0x22, Hi: 0x22, Stride: 0x1},
+		unicode.Range16{Lo: 0x27, Hi: 0x27, Stride: 0x1},
+		unicode.Range16{Lo: 0x28, Hi: 0x28, Stride: 0x1},
+		unicode.Range16{Lo: 0x29, Hi: 0x29, Stride: 0x1},
+		unicode.Range16{Lo: 0x5b, Hi: 0x5b, Stride: 0x1},
+		unicode.Range16{Lo: 0x5d, Hi: 0x5d, Stride: 0x1},
+		unicode.Range16{Lo: 0x7b, Hi: 0x7b, Stride: 0x1},
+		unicode.Range16{Lo: 0x7d, Hi: 0x7d, Stride: 0x1},
+		unicode.Range16{Lo: 0xab, Hi: 0xab, Stride: 0x1},
+		unicode.Range16{Lo: 0xbb, Hi: 0xbb, Stride: 0x1},
+		unicode.Range16{Lo: 0xf3a, Hi: 0xf3a, Stride: 0x1},
+		unicode.Range16{Lo: 0xf3b, Hi: 0xf3b, Stride: 0x1},
+		unicode.Range16{Lo: 0xf3c, Hi: 0xf3c, Stride: 0x1},
+		unicode.Range16{Lo: 0xf3d, Hi: 0xf3d, Stride: 0x1},
+		unicode.Range16{Lo: 0x169b, Hi: 0x169b, Stride: 0x1},
+		unicode.Range16{Lo: 0x169c, Hi: 0x169c, Stride: 0x1},
+		unicode.Range16{Lo: 0x2018, Hi: 0x2018, Stride: 0x1},
+		unicode.Range16{Lo: 0x2019, Hi: 0x2019, Stride: 0x1},
+		unicode.Range16{Lo: 0x201a, Hi: 0x201a, Stride: 0x1},
+		unicode.Range16{Lo: 0x201b, Hi: 0x201c, Stride: 0x1},
+		unicode.Range16{Lo: 0x201d, Hi: 0x201d, Stride: 0x1},
+		unicode.Range16{Lo: 0x201e, Hi: 0x201e, Stride: 0x1},
+		unicode.Range16{Lo: 0x201f, Hi: 0x201f, Stride: 0x1},
+		unicode.Range16{Lo: 0x2039, Hi: 0x2039, Stride: 0x1},
+		unicode.Range16{Lo: 0x203a, Hi: 0x203a, Stride: 0x1},
+		unicode.Range16{Lo: 0x2045, Hi: 0x2045, Stride: 0x1},
+		unicode.Range16{Lo: 0x2046, Hi: 0x2046, Stride: 0x1},
+		unicode.Range16{Lo: 0x207d, Hi: 0x207d, Stride: 0x1},
+		unicode.Range16{Lo: 0x207e, Hi: 0x207e, Stride: 0x1},
+		unicode.Range16{Lo: 0x208d, Hi: 0x208d, Stride: 0x1},
+		unicode.Range16{Lo: 0x208e, Hi: 0x208e, Stride: 0x1},
+		unicode.Range16{Lo: 0x2308, Hi: 0x2308, Stride: 0x1},
+		unicode.Range16{Lo: 0x2309, Hi: 0x2309, Stride: 0x1},
+		unicode.Range16{Lo: 0x230a, Hi: 0x230a, Stride: 0x1},
+		unicode.Range16{Lo: 0x230b, Hi: 0x230b, Stride: 0x1},
+		unicode.Range16{Lo: 0x2329, Hi: 0x2329, Stride: 0x1},
+		unicode.Range16{Lo: 0x232a, Hi: 0x232a, Stride: 0x1},
+		unicode.Range16{Lo: 0x275b, Hi: 0x2760, Stride: 0x1},
+		unicode.Range16{Lo: 0x2768, Hi: 0x2768, Stride: 0x1},
+		unicode.Range16{Lo: 0x2769, Hi: 0x2769, Stride: 0x1},
+		unicode.Range16{Lo: 0x276a, Hi: 0x276a, Stride: 0x1},
+		unicode.Range16{Lo: 0x276b, Hi: 0x276b, Stride: 0x1},
+		unicode.Range16{Lo: 0x276c, Hi: 0x276c, Stride: 0x1},
+		unicode.Range16{Lo: 0x276d, Hi: 0x276d, Stride: 0x1},
+		unicode.Range16{Lo: 0x276e, Hi: 0x276e, Stride: 0x1},
+		unicode.Range16{Lo: 0x276f, Hi: 0x276f, Stride: 0x1},
+		unicode.Range16{Lo: 0x2770, Hi: 0x2770, Stride: 0x1},
+		unicode.Range16{Lo: 0x2771, Hi: 0x2771, Stride: 0x1},
+		unicode.Range16{Lo: 0x2772, Hi: 0x2772, Stride: 0x1},
+		unicode.Range16{Lo: 0x2773, Hi: 0x2773, Stride: 0x1},
+		unicode.Range16{Lo: 0x2774, Hi: 0x2774, Stride: 0x1},
+		unicode.Range16{Lo: 0x2775, Hi: 0x2775, Stride: 0x1},
+		unicode.Range16{Lo: 0x27c5, Hi: 0x27c5, Stride: 0x1},
+		unicode.Range16{Lo: 0x27c6, Hi: 0x27c6, Stride: 0x1},
+		unicode.Range16{Lo: 0x27e6, Hi: 0x27e6, Stride: 0x1},
+		unicode.Range16{Lo: 0x27e7, Hi: 0x27e7, Stride: 0x1},
+		unicode.Range16{Lo: 0x27e8, Hi: 0x27e8, Stride: 0x1},
+		unicode.Range16{Lo: 0x27e9, Hi: 0x27e9, Stride: 0x1},
+		unicode.Range16{Lo: 0x27ea, Hi: 0x27ea, Stride: 0x1},
+		unicode.Range16{Lo: 0x27eb, Hi: 0x27eb, Stride: 0x1},
+		unicode.Range16{Lo: 0x27ec, Hi: 0x27ec, Stride: 0x1},
+		unicode.Range16{Lo: 0x27ed, Hi: 0x27ed, Stride: 0x1},
+		unicode.Range16{Lo: 0x27ee, Hi: 0x27ee, Stride: 0x1},
+		unicode.Range16{Lo: 0x27ef, Hi: 0x27ef, Stride: 0x1},
+		unicode.Range16{Lo: 0x2983, Hi: 0x2983, Stride: 0x1},
+		unicode.Range16{Lo: 0x2984, Hi: 0x2984, Stride: 0x1},
+		unicode.Range16{Lo: 0x2985, Hi: 0x2985, Stride: 0x1},
+		unicode.Range16{Lo: 0x2986, Hi: 0x2986, Stride: 0x1},
+		unicode.Range16{Lo: 0x2987, Hi: 0x2987, Stride: 0x1},
+		unicode.Range16{Lo: 0x2988, Hi: 0x2988, Stride: 0x1},
+		unicode.Range16{Lo: 0x2989, Hi: 0x2989, Stride: 0x1},
+		unicode.Range16{Lo: 0x298a, Hi: 0x298a, Stride: 0x1},
+		unicode.Range16{Lo: 0x298b, Hi: 0x298b, Stride: 0x1},
+		unicode.Range16{Lo: 0x298c, Hi: 0x298c, Stride: 0x1},
+		unicode.Range16{Lo: 0x298d, Hi: 0x298d, Stride: 0x1},
+		unicode.Range16{Lo: 0x298e, Hi: 0x298e, Stride: 0x1},
+		unicode.Range16{Lo: 0x298f, Hi: 0x298f, Stride: 0x1},
+		unicode.Range16{Lo: 0x2990, Hi: 0x2990, Stride: 0x1},
+		unicode.Range16{Lo: 0x2991, Hi: 0x2991, Stride: 0x1},
+		unicode.Range16{Lo: 0x2992, Hi: 0x2992, Stride: 0x1},
+		unicode.Range16{Lo: 0x2993, Hi: 0x2993, Stride: 0x1},
+		unicode.Range16{Lo: 0x2994, Hi: 0x2994, Stride: 0x1},
+		unicode.Range16{Lo: 0x2995, Hi: 0x2995, Stride: 0x1},
+		unicode.Range16{Lo: 0x2996, Hi: 0x2996, Stride: 0x1},
+		unicode.Range16{Lo: 0x2997, Hi: 0x2997, Stride: 0x1},
+		unicode.Range16{Lo: 0x2998, Hi: 0x2998, Stride: 0x1},
+		unicode.Range16{Lo: 0x29d8, Hi: 0x29d8, Stride: 0x1},
+		unicode.Range16{Lo: 0x29d9, Hi: 0x29d9, Stride: 0x1},
+		unicode.Range16{Lo: 0x29da, Hi: 0x29da, Stride: 0x1},
+		unicode.Range16{Lo: 0x29db, Hi: 0x29db, Stride: 0x1},
+		unicode.Range16{Lo: 0x29fc, Hi: 0x29fc, Stride: 0x1},
+		unicode.Range16{Lo: 0x29fd, Hi: 0x29fd, Stride: 0x1},
+		unicode.Range16{Lo: 0x2e00, Hi: 0x2e01, Stride: 0x1},
+		unicode.Range16{Lo: 0x2e02, Hi: 0x2e02, Stride: 0x1},
+		unicode.Range16{Lo: 0x2e03, Hi: 0x2e03, Stride: 0x1},
+		unicode.Range16{Lo: 0x2e04, Hi: 0x2e04, Stride: 0x1},
+		unicode.Range16{Lo: 0x2e05, Hi: 0x2e05, Stride: 0x1},
+		unicode.Range16{Lo: 0x2e06, Hi: 0x2e08, Stride: 0x1},
+		unicode.Range16{Lo: 0x2e09, Hi: 0x2e09, Stride: 0x1},
+		unicode.Range16{Lo: 0x2e0a, Hi: 0x2e0a, Stride: 0x1},
+		unicode.Range16{Lo: 0x2e0b, Hi: 0x2e0b, Stride: 0x1},
+		unicode.Range16{Lo: 0x2e0c, Hi: 0x2e0c, Stride: 0x1},
+		unicode.Range16{Lo: 0x2e0d, Hi: 0x2e0d, Stride: 0x1},
+		unicode.Range16{Lo: 0x2e1c, Hi: 0x2e1c, Stride: 0x1},
+		unicode.Range16{Lo: 0x2e1d, Hi: 0x2e1d, Stride: 0x1},
+		unicode.Range16{Lo: 0x2e20, Hi: 0x2e20, Stride: 0x1},
+		unicode.Range16{Lo: 0x2e21, Hi: 0x2e21, Stride: 0x1},
+		unicode.Range16{Lo: 0x2e22, Hi: 0x2e22, Stride: 0x1},
+		unicode.Range16{Lo: 0x2e23, Hi: 0x2e23, Stride: 0x1},
+		unicode.Range16{Lo: 0x2e24, Hi: 0x2e24, Stride: 0x1},
+		unicode.Range16{Lo: 0x2e25, Hi: 0x2e25, Stride: 0x1},
+		unicode.Range16{Lo: 0x2e26, Hi: 0x2e26, Stride: 0x1},
+		unicode.Range16{Lo: 0x2e27, Hi: 0x2e27, Stride: 0x1},
+		unicode.Range16{Lo: 0x2e28, Hi: 0x2e28, Stride: 0x1},
+		unicode.Range16{Lo: 0x2e29, Hi: 0x2e29, Stride: 0x1},
+		unicode.Range16{Lo: 0x2e42, Hi: 0x2e42, Stride: 0x1},
+		unicode.Range16{Lo: 0x2e55, Hi: 0x2e55, Stride: 0x1},
+		unicode.Range16{Lo: 0x2e56, Hi: 0x2e56, Stride: 0x1},
+		unicode.Range16{Lo: 0x2e57, Hi: 0x2e57, Stride: 0x1},
+		unicode.Range16{Lo: 0x2e58, Hi: 0x2e58, Stride: 0x1},
+		unicode.Range16{Lo: 0x2e59, Hi: 0x2e59, Stride: 0x1},
+		unicode.Range16{Lo: 0x2e5a, Hi: 0x2e5a, Stride: 0x1},
+		unicode.Range16{Lo: 0x2e5b, Hi: 0x2e5b, Stride: 0x1},
+		unicode.Range16{Lo: 0x2e5c, Hi: 0x2e5c, Stride: 0x1},
+		unicode.Range16{Lo: 0x3008, Hi: 0x3008, Stride: 0x1},
+		unicode.Range16{Lo: 0x3009, Hi: 0x3009, Stride: 0x1},
+		unicode.Range16{Lo: 0x300a, Hi: 0x300a, Stride: 0x1},
+		unicode.Range16{Lo: 0x300b, Hi: 0x300b, Stride: 0x1},
+		unicode.Range16{Lo: 0x300c, Hi: 0x300c, Stride: 0x1},
+		unicode.Range16{Lo: 0x300d, Hi: 0x300d, Stride: 0x1},
+		unicode.Range16{Lo: 0x300e, Hi: 0x300e, Stride: 0x1},
+		unicode.Range16{Lo: 0x300f, Hi: 0x300f, Stride: 0x1},
+		unicode.Range16{Lo: 0x3010, Hi: 0x3010, Stride: 0x1},
+		unicode.Range16{Lo: 0x3011, Hi: 0x3011, Stride: 0x1},
+		unicode.Range16{Lo: 0x3014, Hi: 0x3014, Stride: 0x1},
+		unicode.Range16{Lo: 0x3015, Hi: 0x3015, Stride: 0x1},
+		unicode.Range16{Lo: 0x3016, Hi: 0x3016, Stride: 0x1},
+		unicode.Range16{Lo: 0x3017, Hi: 0x3017, Stride: 0x1},
+		unicode.Range16{Lo: 0x3018, Hi: 0x3018, Stride: 0x1},
+		unicode.Range16{Lo: 0x3019, Hi: 0x3019, Stride: 0x1},
+		unicode.Range16{Lo: 0x301a, Hi: 0x301a, Stride: 0x1},
+		unicode.Range16{Lo: 0x301b, Hi: 0x301b, Stride: 0x1},
+		unicode.Range16{Lo: 0x301d, Hi: 0x301d, Stride: 0x1},
+		unicode.Range16{Lo: 0x301e, Hi: 0x301f, Stride: 0x1},
+		unicode.Range16{Lo: 0xfd3e, Hi: 0xfd3e, Stride: 0x1},
+		unicode.Range16{Lo: 0xfd3f, Hi: 0xfd3f, Stride: 0x1},
+		unicode.Range16{Lo: 0xfe17, Hi: 0xfe17, Stride: 0x1},
+		unicode.Range16{Lo: 0xfe18, Hi: 0xfe18, Stride: 0x1},
+		unicode.Range16{Lo: 0xfe35, Hi: 0xfe35, Stride: 0x1},
+		unicode.Range16{Lo: 0xfe36, Hi: 0xfe36, Stride: 0x1},
+		unicode.Range16{Lo: 0xfe37, Hi: 0xfe37, Stride: 0x1},
+		unicode.Range16{Lo: 0xfe38, Hi: 0xfe38, Stride: 0x1},
+		unicode.Range16{Lo: 0xfe39, Hi: 0xfe39, Stride: 0x1},
+		unicode.Range16{Lo: 0xfe3a, Hi: 0xfe3a, Stride: 0x1},
+		unicode.Range16{Lo: 0xfe3b, Hi: 0xfe3b, Stride: 0x1},
+		unicode.Range16{Lo: 0xfe3c, Hi: 0xfe3c, Stride: 0x1},
+		unicode.Range16{Lo: 0xfe3d, Hi: 0xfe3d, Stride: 0x1},
+		unicode.Range16{Lo: 0xfe3e, Hi: 0xfe3e, Stride: 0x1},
+		unicode.Range16{Lo: 0xfe3f, Hi: 0xfe3f, Stride: 0x1},
+		unicode.Range16{Lo: 0xfe40, Hi: 0xfe40, Stride: 0x1},
+		unicode.Range16{Lo: 0xfe41, Hi: 0xfe41, Stride: 0x1},
+		unicode.Range16{Lo: 0xfe42, Hi: 0xfe42, Stride: 0x1},
+		unicode.Range16{Lo: 0xfe43, Hi: 0xfe43, Stride: 0x1},
+		unicode.Range16{Lo: 0xfe44, Hi: 0xfe44, Stride: 0x1},
+		unicode.Range16{Lo: 0xfe47, Hi: 0xfe47, Stride: 0x1},
+		unicode.Range16{Lo: 0xfe48, Hi: 0xfe48, Stride: 0x1},
+		unicode.Range16{Lo: 0xfe59, Hi: 0xfe59, Stride: 0x1},
+		unicode.Range16{Lo: 0xfe5a, Hi: 0xfe5a, Stride: 0x1},
+		unicode.Range16{Lo: 0xfe5b, Hi: 0xfe5b, Stride: 0x1},
+		unicode.Range16{Lo: 0xfe5c, Hi: 0xfe5c, Stride: 0x1},
+		unicode.Range16{Lo: 0xfe5d, Hi: 0xfe5d, Stride: 0x1},
+		unicode.Range16{Lo: 0xfe5e, Hi: 0xfe5e, Stride: 0x1},
+		unicode.Range16{Lo: 0xff08, Hi: 0xff08, Stride: 0x1},
+		unicode.Range16{Lo: 0xff09, Hi: 0xff09, Stride: 0x1},
+		unicode.Range16{Lo: 0xff3b, Hi: 0xff3b, Stride: 0x1},
+		unicode.Range16{Lo: 0xff3d, Hi: 0xff3d, Stride: 0x1},
+		unicode.Range16{Lo: 0xff5b, Hi: 0xff5b, Stride: 0x1},
+		unicode.Range16{Lo: 0xff5d, Hi: 0xff5d, Stride: 0x1},
+		unicode.Range16{Lo: 0xff5f, Hi: 0xff5f, Stride: 0x1},
+		unicode.Range16{Lo: 0xff60, Hi: 0xff60, Stride: 0x1},
+		unicode.Range16{Lo: 0xff62, Hi: 0xff62, Stride: 0x1},
+		unicode.Range16{Lo: 0xff63, Hi: 0xff63, Stride: 0x1},
+	},
+	R32: []unicode.Range32{
+		unicode.Range32{Lo: 0x1f676, Hi: 0x1f678, Stride: 0x1},
+	},
+	LatinOffset: 10,
+}
+
+var _SentenceExtend = &unicode.RangeTable{
+	R16: []unicode.Range16{
+		unicode.Range16{Lo: 0x300, Hi: 0x36f, Stride: 0x1},
+		unicode.Range16{Lo: 0x483, Hi: 0x487, Stride: 0x1},
+		unicode.Range16{Lo: 0x488, Hi: 0x489, Stride: 0x1},
+		unicode.Range16{Lo: 0x591, Hi: 0x5bd, Stride: 0x1},
+		unicode.Range16{Lo: 0x5bf, Hi: 0x5bf, Stride: 0x1},
+		unicode.Range16{Lo: 0x5c1, Hi: 0x5c2, Stride: 0x1},
+		unicode.Range16{Lo: 0x5c4, Hi: 0x5c5, Stride: 0x1},
+		unicode.Range16{Lo: 0x5c7, Hi: 0x5c7, Stride: 0x1},
+		unicode.Range16{Lo: 0x610, Hi: 0x61a, Stride: 0x1},
+		unicode.Range16{Lo: 0x64b, Hi: 0x65f, Stride: 0x1},
+		unicode.Range16{Lo: 0x670, Hi: 0x670, Stride: 0x1},
+		unicode.Range16{Lo: 0x6d6, Hi: 0x6dc, Stride: 0x1},
+		unicode.Range16{Lo: 0x6df, Hi: 0x6e4, Stride: 0x1},
+		unicode.Range16{Lo: 0x6e7, Hi: 0x6e8, Stride: 0x1},
+		unicode.Range16{Lo: 0x6ea, Hi: 0x6ed, Stride: 0x1},
+		unicode.Range16{Lo: 0x711, Hi: 0x711, Stride: 0x1},
+		unicode.Range16{Lo: 0x730, Hi: 0x74a, Stride: 0x1},
+		unicode.Range16{Lo: 0x7a6, Hi: 0x7b0, Stride: 0x1},
+		unicode.Range16{Lo: 0x7eb, Hi: 0x7f3, Stride: 0x1},
+		unicode.Range16{Lo: 0x7fd, Hi: 0x7fd, Stride: 0x1},
+		unicode.Range16{Lo: 0x816, Hi: 0x819, Stride: 0x1},
+		unicode.Range16{Lo: 0x81b, Hi: 0x823, Stride: 0x1},
+		unicode.Range16{Lo: 0x825, Hi: 0x827, Stride: 0x1},
+		unicode.Range16{Lo: 0x829, Hi: 0x82d, Stride: 0x1},
+		unicode.Range16{Lo: 0x859, Hi: 0x85b, Stride: 0x1},
+		unicode.Range16{Lo: 0x898, Hi: 0x89f, Stride: 0x1},
+		unicode.Range16{Lo: 0x8ca, Hi: 0x8e1, Stride: 0x1},
+		unicode.Range16{Lo: 0x8e3, Hi: 0x902, Stride: 0x1},
+		unicode.Range16{Lo: 0x903, Hi: 0x903, Stride: 0x1},
+		unicode.Range16{Lo: 0x93a, Hi: 0x93a, Stride: 0x1},
+		unicode.Range16{Lo: 0x93b, Hi: 0x93b, Stride: 0x1},
+		unicode.Range16{Lo: 0x93c, Hi: 0x93c, Stride: 0x1},
+		unicode.Range16{Lo: 0x93e, Hi: 0x940, Stride: 0x1},
+		unicode.Range16{Lo: 0x941, Hi: 0x948, Stride: 0x1},
+		unicode.Range16{Lo: 0x949, Hi: 0x94c, Stride: 0x1},
+		unicode.Range16{Lo: 0x94d, Hi: 0x94d, Stride: 0x1},
+		unicode.Range16{Lo: 0x94e, Hi: 0x94f, Stride: 0x1},
+		unicode.Range16{Lo: 0x951, Hi: 0x957, Stride: 0x1},
+		unicode.Range16{Lo: 0x962, Hi: 0x963, Stride: 0x1},
+		unicode.Range16{Lo: 0x981, Hi: 0x981, Stride: 0x1},
+		unicode.Range16{Lo: 0x982, Hi: 0x983, Stride: 0x1},
+		unicode.Range16{Lo: 0x9bc, Hi: 0x9bc, Stride: 0x1},
+		unicode.Range16{Lo: 0x9be, Hi: 0x9c0, Stride: 0x1},
+		unicode.Range16{Lo: 0x9c1, Hi: 0x9c4, Stride: 0x1},
+		unicode.Range16{Lo: 0x9c7, Hi: 0x9c8, Stride: 0x1},
+		unicode.Range16{Lo: 0x9cb, Hi: 0x9cc, Stride: 0x1},
+		unicode.Range16{Lo: 0x9cd, Hi: 0x9cd, Stride: 0x1},
+		unicode.Range16{Lo: 0x9d7, Hi: 0x9d7, Stride: 0x1},
+		unicode.Range16{Lo: 0x9e2, Hi: 0x9e3, Stride: 0x1},
+		unicode.Range16{Lo: 0x9fe, Hi: 0x9fe, Stride: 0x1},
+		unicode.Range16{Lo: 0xa01, Hi: 0xa02, Stride: 0x1},
+		unicode.Range16{Lo: 0xa03, Hi: 0xa03, Stride: 0x1},
+		unicode.Range16{Lo: 0xa3c, Hi: 0xa3c, Stride: 0x1},
+		unicode.Range16{Lo: 0xa3e, Hi: 0xa40, Stride: 0x1},
+		unicode.Range16{Lo: 0xa41, Hi: 0xa42, Stride: 0x1},
+		unicode.Range16{Lo: 0xa47, Hi: 0xa48, Stride: 0x1},
+		unicode.Range16{Lo: 0xa4b, Hi: 0xa4d, Stride: 0x1},
+		unicode.Range16{Lo: 0xa51, Hi: 0xa51, Stride: 0x1},
+		unicode.Range16{Lo: 0xa70, Hi: 0xa71, Stride: 0x1},
+		unicode.Range16{Lo: 0xa75, Hi: 0xa75, Stride: 0x1},
+		unicode.Range16{Lo: 0xa81, Hi: 0xa82, Stride: 0x1},
+		unicode.Range16{Lo: 0xa83, Hi: 0xa83, Stride: 0x1},
+		unicode.Range16{Lo: 0xabc, Hi: 0xabc, Stride: 0x1},
+		unicode.Range16{Lo: 0xabe, Hi: 0xac0, Stride: 0x1},
+		unicode.Range16{Lo: 0xac1, Hi: 0xac5, Stride: 0x1},
+		unicode.Range16{Lo: 0xac7, Hi: 0xac8, Stride: 0x1},
+		unicode.Range16{Lo: 0xac9, Hi: 0xac9, Stride: 0x1},
+		unicode.Range16{Lo: 0xacb, Hi: 0xacc, Stride: 0x1},
+		unicode.Range16{Lo: 0xacd, Hi: 0xacd, Stride: 0x1},
+		unicode.Range16{Lo: 0xae2, Hi: 0xae3, Stride: 0x1},
+		unicode.Range16{Lo: 0xafa, Hi: 0xaff, Stride: 0x1},
+		unicode.Range16{Lo: 0xb01, Hi: 0xb01, Stride: 0x1},
+		unicode.Range16{Lo: 0xb02, Hi: 0xb03, Stride: 0x1},
+		unicode.Range16{Lo: 0xb3c, Hi: 0xb3c, Stride: 0x1},
+		unicode.Range16{Lo: 0xb3e, Hi: 0xb3e, Stride: 0x1},
+		unicode.Range16{Lo: 0xb3f, Hi: 0xb3f, Stride: 0x1},
+		unicode.Range16{Lo: 0xb40, Hi: 0xb40, Stride: 0x1},
+		unicode.Range16{Lo: 0xb41, Hi: 0xb44, Stride: 0x1},
+		unicode.Range16{Lo: 0xb47, Hi: 0xb48, Stride: 0x1},
+		unicode.Range16{Lo: 0xb4b, Hi: 0xb4c, Stride: 0x1},
+		unicode.Range16{Lo: 0xb4d, Hi: 0xb4d, Stride: 0x1},
+		unicode.Range16{Lo: 0xb55, Hi: 0xb56, Stride: 0x1},
+		unicode.Range16{Lo: 0xb57, Hi: 0xb57, Stride: 0x1},
+		unicode.Range16{Lo: 0xb62, Hi: 0xb63, Stride: 0x1},
+		unicode.Range16{Lo: 0xb82, Hi: 0xb82, Stride: 0x1},
+		unicode.Range16{Lo: 0xbbe, Hi: 0xbbf, Stride: 0x1},
+		unicode.Range16{Lo: 0xbc0, Hi: 0xbc0, Stride: 0x1},
+		unicode.Range16{Lo: 0xbc1, Hi: 0xbc2, Stride: 0x1},
+		unicode.Range16{Lo: 0xbc6, Hi: 0xbc8, Stride: 0x1},
+		unicode.Range16{Lo: 0xbca, Hi: 0xbcc, Stride: 0x1},
+		unicode.Range16{Lo: 0xbcd, Hi: 0xbcd, Stride: 0x1},
+		unicode.Range16{Lo: 0xbd7, Hi: 0xbd7, Stride: 0x1},
+		unicode.Range16{Lo: 0xc00, Hi: 0xc00, Stride: 0x1},
+		unicode.Range16{Lo: 0xc01, Hi: 0xc03, Stride: 0x1},
+		unicode.Range16{Lo: 0xc04, Hi: 0xc04, Stride: 0x1},
+		unicode.Range16{Lo: 0xc3c, Hi: 0xc3c, Stride: 0x1},
+		unicode.Range16{Lo: 0xc3e, Hi: 0xc40, Stride: 0x1},
+		unicode.Range16{Lo: 0xc41, Hi: 0xc44, Stride: 0x1},
+		unicode.Range16{Lo: 0xc46, Hi: 0xc48, Stride: 0x1},
+		unicode.Range16{Lo: 0xc4a, Hi: 0xc4d, Stride: 0x1},
+		unicode.Range16{Lo: 0xc55, Hi: 0xc56, Stride: 0x1},
+		unicode.Range16{Lo: 0xc62, Hi: 0xc63, Stride: 0x1},
+		unicode.Range16{Lo: 0xc81, Hi: 0xc81, Stride: 0x1},
+		unicode.Range16{Lo: 0xc82, Hi: 0xc83, Stride: 0x1},
+		unicode.Range16{Lo: 0xcbc, Hi: 0xcbc, Stride: 0x1},
+		unicode.Range16{Lo: 0xcbe, Hi: 0xcbe, Stride: 0x1},
+		unicode.Range16{Lo: 0xcbf, Hi: 0xcbf, Stride: 0x1},
+		unicode.Range16{Lo: 0xcc0, Hi: 0xcc4, Stride: 0x1},
+		unicode.Range16{Lo: 0xcc6, Hi: 0xcc6, Stride: 0x1},
+		unicode.Range16{Lo: 0xcc7, Hi: 0xcc8, Stride: 0x1},
+		unicode.Range16{Lo: 0xcca, Hi: 0xccb, Stride: 0x1},
+		unicode.Range16{Lo: 0xccc, Hi: 0xccd, Stride: 0x1},
+		unicode.Range16{Lo: 0xcd5, Hi: 0xcd6, Stride: 0x1},
+		unicode.Range16{Lo: 0xce2, Hi: 0xce3, Stride: 0x1},
+		unicode.Range16{Lo: 0xcf3, Hi: 0xcf3, Stride: 0x1},
+		unicode.Range16{Lo: 0xd00, Hi: 0xd01, Stride: 0x1},
+		unicode.Range16{Lo: 0xd02, Hi: 0xd03, Stride: 0x1},
+		unicode.Range16{Lo: 0xd3b, Hi: 0xd3c, Stride: 0x1},
+		unicode.Range16{Lo: 0xd3e, Hi: 0xd40, Stride: 0x1},
+		unicode.Range16{Lo: 0xd41, Hi: 0xd44, Stride: 0x1},
+		unicode.Range16{Lo: 0xd46, Hi: 0xd48, Stride: 0x1},
+		unicode.Range16{Lo: 0xd4a, Hi: 0xd4c, Stride: 0x1},
+		unicode.Range16{Lo: 0xd4d, Hi: 0xd4d, Stride: 0x1},
+		unicode.Range16{Lo: 0xd57, Hi: 0xd57, Stride: 0x1},
+		unicode.Range16{Lo: 0xd62, Hi: 0xd63, Stride: 0x1},
+		unicode.Range16{Lo: 0xd81, Hi: 0xd81, Stride: 0x1},
+		unicode.Range16{Lo: 0xd82, Hi: 0xd83, Stride: 0x1},
+		unicode.Range16{Lo: 0xdca, Hi: 0xdca, Stride: 0x1},
+		unicode.Range16{Lo: 0xdcf, Hi: 0xdd1, Stride: 0x1},
+		unicode.Range16{Lo: 0xdd2, Hi: 0xdd4, Stride: 0x1},
+		unicode.Range16{Lo: 0xdd6, Hi: 0xdd6, Stride: 0x1},
+		unicode.Range16{Lo: 0xdd8, Hi: 0xddf, Stride: 0x1},
+		unicode.Range16{Lo: 0xdf2, Hi: 0xdf3, Stride: 0x1},
+		unicode.Range16{Lo: 0xe31, Hi: 0xe31, Stride: 0x1},
+		unicode.Range16{Lo: 0xe34, Hi: 0xe3a, Stride: 0x1},
+		unicode.Range16{Lo: 0xe47, Hi: 0xe4e, Stride: 0x1},
+		unicode.Range16{Lo: 0xeb1, Hi: 0xeb1, Stride: 0x1},
+		unicode.Range16{Lo: 0xeb4, Hi: 0xebc, Stride: 0x1},
+		unicode.Range16{Lo: 0xec8, Hi: 0xece, Stride: 0x1},
+		unicode.Range16{Lo: 0xf18, Hi: 0xf19, Stride: 0x1},
+		unicode.Range16{Lo: 0xf35, Hi: 0xf35, Stride: 0x1},
+		unicode.Range16{Lo: 0xf37, Hi: 0xf37, Stride: 0x1},
+		unicode.Range16{Lo: 0xf39, Hi: 0xf39, Stride: 0x1},
+		unicode.Range16{Lo: 0xf3e, Hi: 0xf3f, Stride: 0x1},
+		unicode.Range16{Lo: 0xf71, Hi: 0xf7e, Stride: 0x1},
+		unicode.Range16{Lo: 0xf7f, Hi: 0xf7f, Stride: 0x1},
+		unicode.Range16{Lo: 0xf80, Hi: 0xf84, Stride: 0x1},
+		unicode.Range16{Lo: 0xf86, Hi: 0xf87, Stride: 0x1},
+		unicode.Range16{Lo: 0xf8d, Hi: 0xf97, Stride: 0x1},
+		unicode.Range16{Lo: 0xf99, Hi: 0xfbc, Stride: 0x1},
+		unicode.Range16{Lo: 0xfc6, Hi: 0xfc6, Stride: 0x1},
+		unicode.Range16{Lo: 0x102b, Hi: 0x102c, Stride: 0x1},
+		unicode.Range16{Lo: 0x102d, Hi: 0x1030, Stride: 0x1},
+		unicode.Range16{Lo: 0x1031, Hi: 0x1031, Stride: 0x1},
+		unicode.Range16{Lo: 0x1032, Hi: 0x1037, Stride: 0x1},
+		unicode.Range16{Lo: 0x1038, Hi: 0x1038, Stride: 0x1},
+		unicode.Range16{Lo: 0x1039, Hi: 0x103a, Stride: 0x1},
+		unicode.Range16{Lo: 0x103b, Hi: 0x103c, Stride: 0x1},
+		unicode.Range16{Lo: 0x103d, Hi: 0x103e, Stride: 0x1},
+		unicode.Range16{Lo: 0x1056, Hi: 0x1057, Stride: 0x1},
+		unicode.Range16{Lo: 0x1058, Hi: 0x1059, Stride: 0x1},
+		unicode.Range16{Lo: 0x105e, Hi: 0x1060, Stride: 0x1},
+		unicode.Range16{Lo: 0x1062, Hi: 0x1064, Stride: 0x1},
+		unicode.Range16{Lo: 0x1067, Hi: 0x106d, Stride: 0x1},
+		unicode.Range16{Lo: 0x1071, Hi: 0x1074, Stride: 0x1},
+		unicode.Range16{Lo: 0x1082, Hi: 0x1082, Stride: 0x1},
+		unicode.Range16{Lo: 0x1083, Hi: 0x1084, Stride: 0x1},
+		unicode.Range16{Lo: 0x1085, Hi: 0x1086, Stride: 0x1},
+		unicode.Range16{Lo: 0x1087, Hi: 0x108c, Stride: 0x1},
+		unicode.Range16{Lo: 0x108d, Hi: 0x108d, Stride: 0x1},
+		unicode.Range16{Lo: 0x108f, Hi: 0x108f, Stride: 0x1},
+		unicode.Range16{Lo: 0x109a, Hi: 0x109c, Stride: 0x1},
+		unicode.Range16{Lo: 0x109d, Hi: 0x109d, Stride: 0x1},
+		unicode.Range16{Lo: 0x135d, Hi: 0x135f, Stride: 0x1},
+		unicode.Range16{Lo: 0x1712, Hi: 0x1714, Stride: 0x1},
+		unicode.Range16{Lo: 0x1715, Hi: 0x1715, Stride: 0x1},
+		unicode.Range16{Lo: 0x1732, Hi: 0x1733, Stride: 0x1},
+		unicode.Range16{Lo: 0x1734, Hi: 0x1734, Stride: 0x1},
+		unicode.Range16{Lo: 0x1752, Hi: 0x1753, Stride: 0x1},
+		unicode.Range16{Lo: 0x1772, Hi: 0x1773, Stride: 0x1},
+		unicode.Range16{Lo: 0x17b4, Hi: 0x17b5, Stride: 0x1},
+		unicode.Range16{Lo: 0x17b6, Hi: 0x17b6, Stride: 0x1},
+		unicode.Range16{Lo: 0x17b7, Hi: 0x17bd, Stride: 0x1},
+		unicode.Range16{Lo: 0x17be, Hi: 0x17c5, Stride: 0x1},
+		unicode.Range16{Lo: 0x17c6, Hi: 0x17c6, Stride: 0x1},
+		unicode.Range16{Lo: 0x17c7, Hi: 0x17c8, Stride: 0x1},
+		unicode.Range16{Lo: 0x17c9, Hi: 0x17d3, Stride: 0x1},
+		unicode.Range16{Lo: 0x17dd, Hi: 0x17dd, Stride: 0x1},
+		unicode.Range16{Lo: 0x180b, Hi: 0x180d, Stride: 0x1},
+		unicode.Range16{Lo: 0x180f, Hi: 0x180f, Stride: 0x1},
+		unicode.Range16{Lo: 0x1885, Hi: 0x1886, Stride: 0x1},
+		unicode.Range16{Lo: 0x18a9, Hi: 0x18a9, Stride: 0x1},
+		unicode.Range16{Lo: 0x1920, Hi: 0x1922, Stride: 0x1},
+		unicode.Range16{Lo: 0x1923, Hi: 0x1926, Stride: 0x1},
+		unicode.Range16{Lo: 0x1927, Hi: 0x1928, Stride: 0x1},
+		unicode.Range16{Lo: 0x1929, Hi: 0x192b, Stride: 0x1},
+		unicode.Range16{Lo: 0x1930, Hi: 0x1931, Stride: 0x1},
+		unicode.Range16{Lo: 0x1932, Hi: 0x1932, Stride: 0x1},
+		unicode.Range16{Lo: 0x1933, Hi: 0x1938, Stride: 0x1},
+		unicode.Range16{Lo: 0x1939, Hi: 0x193b, Stride: 0x1},
+		unicode.Range16{Lo: 0x1a17, Hi: 0x1a18, Stride: 0x1},
+		unicode.Range16{Lo: 0x1a19, Hi: 0x1a1a, Stride: 0x1},
+		unicode.Range16{Lo: 0x1a1b, Hi: 0x1a1b, Stride: 0x1},
+		unicode.Range16{Lo: 0x1a55, Hi: 0x1a55, Stride: 0x1},
+		unicode.Range16{Lo: 0x1a56, Hi: 0x1a56, Stride: 0x1},
+		unicode.Range16{Lo: 0x1a57, Hi: 0x1a57, Stride: 0x1},
+		unicode.Range16{Lo: 0x1a58, Hi: 0x1a5e, Stride: 0x1},
+		unicode.Range16{Lo: 0x1a60, Hi: 0x1a60, Stride: 0x1},
+		unicode.Range16{Lo: 0x1a61, Hi: 0x1a61, Stride: 0x1},
+		unicode.Range16{Lo: 0x1a62, Hi: 0x1a62, Stride: 0x1},
+		unicode.Range16{Lo: 0x1a63, Hi: 0x1a64, Stride: 0x1},
+		unicode.Range16{Lo: 0x1a65, Hi: 0x1a6c, Stride: 0x1},
+		unicode.Range16{Lo: 0x1a6d, Hi: 0x1a72, Stride: 0x1},
+		unicode.Range16{Lo: 0x1a73, Hi: 0x1a7c, Stride: 0x1},
+		unicode.Range16{Lo: 0x1a7f, Hi: 0x1a7f, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ab0, Hi: 0x1abd, Stride: 0x1},
+		unicode.Range16{Lo: 0x1abe, Hi: 0x1abe, Stride: 0x1},
+		unicode.Range16{Lo: 0x1abf, Hi: 0x1ace, Stride: 0x1},
+		unicode.Range16{Lo: 0x1b00, Hi: 0x1b03, Stride: 0x1},
+		unicode.Range16{Lo: 0x1b04, Hi: 0x1b04, Stride: 0x1},
+		unicode.Range16{Lo: 0x1b34, Hi: 0x1b34, Stride: 0x1},
+		unicode.Range16{Lo: 0x1b35, Hi: 0x1b35, Stride: 0x1},
+		unicode.Range16{Lo: 0x1b36, Hi: 0x1b3a, Stride: 0x1},
+		unicode.Range16{Lo: 0x1b3b, Hi: 0x1b3b, Stride: 0x1},
+		unicode.Range16{Lo: 0x1b3c, Hi: 0x1b3c, Stride: 0x1},
+		unicode.Range16{Lo: 0x1b3d, Hi: 0x1b41, Stride: 0x1},
+		unicode.Range16{Lo: 0x1b42, Hi: 0x1b42, Stride: 0x1},
+		unicode.Range16{Lo: 0x1b43, Hi: 0x1b44, Stride: 0x1},
+		unicode.Range16{Lo: 0x1b6b, Hi: 0x1b73, Stride: 0x1},
+		unicode.Range16{Lo: 0x1b80, Hi: 0x1b81, Stride: 0x1},
+		unicode.Range16{Lo: 0x1b82, Hi: 0x1b82, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ba1, Hi: 0x1ba1, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ba2, Hi: 0x1ba5, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ba6, Hi: 0x1ba7, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ba8, Hi: 0x1ba9, Stride: 0x1},
+		unicode.Range16{Lo: 0x1baa, Hi: 0x1baa, Stride: 0x1},
+		unicode.Range16{Lo: 0x1bab, Hi: 0x1bad, Stride: 0x1},
+		unicode.Range16{Lo: 0x1be6, Hi: 0x1be6, Stride: 0x1},
+		unicode.Range16{Lo: 0x1be7, Hi: 0x1be7, Stride: 0x1},
+		unicode.Range16{Lo: 0x1be8, Hi: 0x1be9, Stride: 0x1},
+		unicode.Range16{Lo: 0x1bea, Hi: 0x1bec, Stride: 0x1},
+		unicode.Range16{Lo: 0x1bed, Hi: 0x1bed, Stride: 0x1},
+		unicode.Range16{Lo: 0x1bee, Hi: 0x1bee, Stride: 0x1},
+		unicode.Range16{Lo: 0x1bef, Hi: 0x1bf1, Stride: 0x1},
+		unicode.Range16{Lo: 0x1bf2, Hi: 0x1bf3, Stride: 0x1},
+		unicode.Range16{Lo: 0x1c24, Hi: 0x1c2b, Stride: 0x1},
+		unicode.Range16{Lo: 0x1c2c, Hi: 0x1c33, Stride: 0x1},
+		unicode.Range16{Lo: 0x1c34, Hi: 0x1c35, Stride: 0x1},
+		unicode.Range16{Lo: 0x1c36, Hi: 0x1c37, Stride: 0x1},
+		unicode.Range16{Lo: 0x1cd0, Hi: 0x1cd2, Stride: 0x1},
+		unicode.Range16{Lo: 0x1cd4, Hi: 0x1ce0, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ce1, Hi: 0x1ce1, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ce2, Hi: 0x1ce8, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ced, Hi: 0x1ced, Stride: 0x1},
+		unicode.Range16{Lo: 0x1cf4, Hi: 0x1cf4, Stride: 0x1},
+		unicode.Range16{Lo: 0x1cf7, Hi: 0x1cf7, Stride: 0x1},
+		unicode.Range16{Lo: 0x1cf8, Hi: 0x1cf9, Stride: 0x1},
+		unicode.Range16{Lo: 0x1dc0, Hi: 0x1dff, Stride: 0x1},
+		unicode.Range16{Lo: 0x200c, Hi: 0x200d, Stride: 0x1},
+		unicode.Range16{Lo: 0x20d0, Hi: 0x20dc, Stride: 0x1},
+		unicode.Range16{Lo: 0x20dd, Hi: 0x20e0, Stride: 0x1},
+		unicode.Range16{Lo: 0x20e1, Hi: 0x20e1, Stride: 0x1},
+		unicode.Range16{Lo: 0x20e2, Hi: 0x20e4, Stride: 0x1},
+		unicode.Range16{Lo: 0x20e5, Hi: 0x20f0, Stride: 0x1},
+		unicode.Range16{Lo: 0x2cef, Hi: 0x2cf1, Stride: 0x1},
+		unicode.Range16{Lo: 0x2d7f, Hi: 0x2d7f, Stride: 0x1},
+		unicode.Range16{Lo: 0x2de0, Hi: 0x2dff, Stride: 0x1},
+		unicode.Range16{Lo: 0x302a, Hi: 0x302d, Stride: 0x1},
+		unicode.Range16{Lo: 0x302e, Hi: 0x302f, Stride: 0x1},
+		unicode.Range16{Lo: 0x3099, Hi: 0x309a, Stride: 0x1},
+		unicode.Range16{Lo: 0xa66f, Hi: 0xa66f, Stride: 0x1},
+		unicode.Range16{Lo: 0xa670, Hi: 0xa672, Stride: 0x1},
+		unicode.Range16{Lo: 0xa674, Hi: 0xa67d, Stride: 0x1},
+		unicode.Range16{Lo: 0xa69e, Hi: 0xa69f, Stride: 0x1},
+		unicode.Range16{Lo: 0xa6f0, Hi: 0xa6f1, Stride: 0x1},
+		unicode.Range16{Lo: 0xa802, Hi: 0xa802, Stride: 0x1},
+		unicode.Range16{Lo: 0xa806, Hi: 0xa806, Stride: 0x1},
+		unicode.Range16{Lo: 0xa80b, Hi: 0xa80b, Stride: 0x1},
+		unicode.Range16{Lo: 0xa823, Hi: 0xa824, Stride: 0x1},
+		unicode.Range16{Lo: 0xa825, Hi: 0xa826, Stride: 0x1},
+		unicode.Range16{Lo: 0xa827, Hi: 0xa827, Stride: 0x1},
+		unicode.Range16{Lo: 0xa82c, Hi: 0xa82c, Stride: 0x1},
+		unicode.Range16{Lo: 0xa880, Hi: 0xa881, Stride: 0x1},
+		unicode.Range16{Lo: 0xa8b4, Hi: 0xa8c3, Stride: 0x1},
+		unicode.Range16{Lo: 0xa8c4, Hi: 0xa8c5, Stride: 0x1},
+		unicode.Range16{Lo: 0xa8e0, Hi: 0xa8f1, Stride: 0x1},
+		unicode.Range16{Lo: 0xa8ff, Hi: 0xa8ff, Stride: 0x1},
+		unicode.Range16{Lo: 0xa926, Hi: 0xa92d, Stride: 0x1},
+		unicode.Range16{Lo: 0xa947, Hi: 0xa951, Stride: 0x1},
+		unicode.Range16{Lo: 0xa952, Hi: 0xa953, Stride: 0x1},
+		unicode.Range16{Lo: 0xa980, Hi: 0xa982, Stride: 0x1},
+		unicode.Range16{Lo: 0xa983, Hi: 0xa983, Stride: 0x1},
+		unicode.Range16{Lo: 0xa9b3, Hi: 0xa9b3, Stride: 0x1},
+		unicode.Range16{Lo: 0xa9b4, Hi: 0xa9b5, Stride: 0x1},
+		unicode.Range16{Lo: 0xa9b6, Hi: 0xa9b9, Stride: 0x1},
+		unicode.Range16{Lo: 0xa9ba, Hi: 0xa9bb, Stride: 0x1},
+		unicode.Range16{Lo: 0xa9bc, Hi: 0xa9bd, Stride: 0x1},
+		unicode.Range16{Lo: 0xa9be, Hi: 0xa9c0, Stride: 0x1},
+		unicode.Range16{Lo: 0xa9e5, Hi: 0xa9e5, Stride: 0x1},
+		unicode.Range16{Lo: 0xaa29, Hi: 0xaa2e, Stride: 0x1},
+		unicode.Range16{Lo: 0xaa2f, Hi: 0xaa30, Stride: 0x1},
+		unicode.Range16{Lo: 0xaa31, Hi: 0xaa32, Stride: 0x1},
+		unicode.Range16{Lo: 0xaa33, Hi: 0xaa34, Stride: 0x1},
+		unicode.Range16{Lo: 0xaa35, Hi: 0xaa36, Stride: 0x1},
+		unicode.Range16{Lo: 0xaa43, Hi: 0xaa43, Stride: 0x1},
+		unicode.Range16{Lo: 0xaa4c, Hi: 0xaa4c, Stride: 0x1},
+		unicode.Range16{Lo: 0xaa4d, Hi: 0xaa4d, Stride: 0x1},
+		unicode.Range16{Lo: 0xaa7b, Hi: 0xaa7b, Stride: 0x1},
+		unicode.Range16{Lo: 0xaa7c, Hi: 0xaa7c, Stride: 0x1},
+		unicode.Range16{Lo: 0xaa7d, Hi: 0xaa7d, Stride: 0x1},
+		unicode.Range16{Lo: 0xaab0, Hi: 0xaab0, Stride: 0x1},
+		unicode.Range16{Lo: 0xaab2, Hi: 0xaab4, Stride: 0x1},
+		unicode.Range16{Lo: 0xaab7, Hi: 0xaab8, Stride: 0x1},
+		unicode.Range16{Lo: 0xaabe, Hi: 0xaabf, Stride: 0x1},
+		unicode.Range16{Lo: 0xaac1, Hi: 0xaac1, Stride: 0x1},
+		unicode.Range16{Lo: 0xaaeb, Hi: 0xaaeb, Stride: 0x1},
+		unicode.Range16{Lo: 0xaaec, Hi: 0xaaed, Stride: 0x1},
+		unicode.Range16{Lo: 0xaaee, Hi: 0xaaef, Stride: 0x1},
+		unicode.Range16{Lo: 0xaaf5, Hi: 0xaaf5, Stride: 0x1},
+		unicode.Range16{Lo: 0xaaf6, Hi: 0xaaf6, Stride: 0x1},
+		unicode.Range16{Lo: 0xabe3, Hi: 0xabe4, Stride: 0x1},
+		unicode.Range16{Lo: 0xabe5, Hi: 0xabe5, Stride: 0x1},
+		unicode.Range16{Lo: 0xabe6, Hi: 0xabe7, Stride: 0x1},
+		unicode.Range16{Lo: 0xabe8, Hi: 0xabe8, Stride: 0x1},
+		unicode.Range16{Lo: 0xabe9, Hi: 0xabea, Stride: 0x1},
+		unicode.Range16{Lo: 0xabec, Hi: 0xabec, Stride: 0x1},
+		unicode.Range16{Lo: 0xabed, Hi: 0xabed, Stride: 0x1},
+		unicode.Range16{Lo: 0xfb1e, Hi: 0xfb1e, Stride: 0x1},
+		unicode.Range16{Lo: 0xfe00, Hi: 0xfe0f, Stride: 0x1},
+		unicode.Range16{Lo: 0xfe20, Hi: 0xfe2f, Stride: 0x1},
+		unicode.Range16{Lo: 0xff9e, Hi: 0xff9f, Stride: 0x1},
+	},
+	R32: []unicode.Range32{
+		unicode.Range32{Lo: 0x101fd, Hi: 0x101fd, Stride: 0x1},
+		unicode.Range32{Lo: 0x102e0, Hi: 0x102e0, Stride: 0x1},
+		unicode.Range32{Lo: 0x10376, Hi: 0x1037a, Stride: 0x1},
+		unicode.Range32{Lo: 0x10a01, Hi: 0x10a03, Stride: 0x1},
+		unicode.Range32{Lo: 0x10a05, Hi: 0x10a06, Stride: 0x1},
+		unicode.Range32{Lo: 0x10a0c, Hi: 0x10a0f, Stride: 0x1},
+		unicode.Range32{Lo: 0x10a38, Hi: 0x10a3a, Stride: 0x1},
+		unicode.Range32{Lo: 0x10a3f, Hi: 0x10a3f, Stride: 0x1},
+		unicode.Range32{Lo: 0x10ae5, Hi: 0x10ae6, Stride: 0x1},
+		unicode.Range32{Lo: 0x10d24, Hi: 0x10d27, Stride: 0x1},
+		unicode.Range32{Lo: 0x10eab, Hi: 0x10eac, Stride: 0x1},
+		unicode.Range32{Lo: 0x10efd, Hi: 0x10eff, Stride: 0x1},
+		unicode.Range32{Lo: 0x10f46, Hi: 0x10f50, Stride: 0x1},
+		unicode.Range32{Lo: 0x10f82, Hi: 0x10f85, Stride: 0x1},
+		unicode.Range32{Lo: 0x11000, Hi: 0x11000, Stride: 0x1},
+		unicode.Range32{Lo: 0x11001, Hi: 0x11001, Stride: 0x1},
+		unicode.Range32{Lo: 0x11002, Hi: 0x11002, Stride: 0x1},
+		unicode.Range32{Lo: 0x11038, Hi: 0x11046, Stride: 0x1},
+		unicode.Range32{Lo: 0x11070, Hi: 0x11070, Stride: 0x1},
+		unicode.Range32{Lo: 0x11073, Hi: 0x11074, Stride: 0x1},
+		unicode.Range32{Lo: 0x1107f, Hi: 0x11081, Stride: 0x1},
+		unicode.Range32{Lo: 0x11082, Hi: 0x11082, Stride: 0x1},
+		unicode.Range32{Lo: 0x110b0, Hi: 0x110b2, Stride: 0x1},
+		unicode.Range32{Lo: 0x110b3, Hi: 0x110b6, Stride: 0x1},
+		unicode.Range32{Lo: 0x110b7, Hi: 0x110b8, Stride: 0x1},
+		unicode.Range32{Lo: 0x110b9, Hi: 0x110ba, Stride: 0x1},
+		unicode.Range32{Lo: 0x110c2, Hi: 0x110c2, Stride: 0x1},
+		unicode.Range32{Lo: 0x11100, Hi: 0x11102, Stride: 0x1},
+		unicode.Range32{Lo: 0x11127, Hi: 0x1112b, Stride: 0x1},
+		unicode.Range32{Lo: 0x1112c, Hi: 0x1112c, Stride: 0x1},
+		unicode.Range32{Lo: 0x1112d, Hi: 0x11134, Stride: 0x1},
+		unicode.Range32{Lo: 0x11145, Hi: 0x11146, Stride: 0x1},
+		unicode.Range32{Lo: 0x11173, Hi: 0x11173, Stride: 0x1},
+		unicode.Range32{Lo: 0x11180, Hi: 0x11181, Stride: 0x1},
+		unicode.Range32{Lo: 0x11182, Hi: 0x11182, Stride: 0x1},
+		unicode.Range32{Lo: 0x111b3, Hi: 0x111b5, Stride: 0x1},
+		unicode.Range32{Lo: 0x111b6, Hi: 0x111be, Stride: 0x1},
+		unicode.Range32{Lo: 0x111bf, Hi: 0x111c0, Stride: 0x1},
+		unicode.Range32{Lo: 0x111c9, Hi: 0x111cc, Stride: 0x1},
+		unicode.Range32{Lo: 0x111ce, Hi: 0x111ce, Stride: 0x1},
+		unicode.Range32{Lo: 0x111cf, Hi: 0x111cf, Stride: 0x1},
+		unicode.Range32{Lo: 0x1122c, Hi: 0x1122e, Stride: 0x1},
+		unicode.Range32{Lo: 0x1122f, Hi: 0x11231, Stride: 0x1},
+		unicode.Range32{Lo: 0x11232, Hi: 0x11233, Stride: 0x1},
+		unicode.Range32{Lo: 0x11234, Hi: 0x11234, Stride: 0x1},
+		unicode.Range32{Lo: 0x11235, Hi: 0x11235, Stride: 0x1},
+		unicode.Range32{Lo: 0x11236, Hi: 0x11237, Stride: 0x1},
+		unicode.Range32{Lo: 0x1123e, Hi: 0x1123e, Stride: 0x1},
+		unicode.Range32{Lo: 0x11241, Hi: 0x11241, Stride: 0x1},
+		unicode.Range32{Lo: 0x112df, Hi: 0x112df, Stride: 0x1},
+		unicode.Range32{Lo: 0x112e0, Hi: 0x112e2, Stride: 0x1},
+		unicode.Range32{Lo: 0x112e3, Hi: 0x112ea, Stride: 0x1},
+		unicode.Range32{Lo: 0x11300, Hi: 0x11301, Stride: 0x1},
+		unicode.Range32{Lo: 0x11302, Hi: 0x11303, Stride: 0x1},
+		unicode.Range32{Lo: 0x1133b, Hi: 0x1133c, Stride: 0x1},
+		unicode.Range32{Lo: 0x1133e, Hi: 0x1133f, Stride: 0x1},
+		unicode.Range32{Lo: 0x11340, Hi: 0x11340, Stride: 0x1},
+		unicode.Range32{Lo: 0x11341, Hi: 0x11344, Stride: 0x1},
+		unicode.Range32{Lo: 0x11347, Hi: 0x11348, Stride: 0x1},
+		unicode.Range32{Lo: 0x1134b, Hi: 0x1134d, Stride: 0x1},
+		unicode.Range32{Lo: 0x11357, Hi: 0x11357, Stride: 0x1},
+		unicode.Range32{Lo: 0x11362, Hi: 0x11363, Stride: 0x1},
+		unicode.Range32{Lo: 0x11366, Hi: 0x1136c, Stride: 0x1},
+		unicode.Range32{Lo: 0x11370, Hi: 0x11374, Stride: 0x1},
+		unicode.Range32{Lo: 0x11435, Hi: 0x11437, Stride: 0x1},
+		unicode.Range32{Lo: 0x11438, Hi: 0x1143f, Stride: 0x1},
+		unicode.Range32{Lo: 0x11440, Hi: 0x11441, Stride: 0x1},
+		unicode.Range32{Lo: 0x11442, Hi: 0x11444, Stride: 0x1},
+		unicode.Range32{Lo: 0x11445, Hi: 0x11445, Stride: 0x1},
+		unicode.Range32{Lo: 0x11446, Hi: 0x11446, Stride: 0x1},
+		unicode.Range32{Lo: 0x1145e, Hi: 0x1145e, Stride: 0x1},
+		unicode.Range32{Lo: 0x114b0, Hi: 0x114b2, Stride: 0x1},
+		unicode.Range32{Lo: 0x114b3, Hi: 0x114b8, Stride: 0x1},
+		unicode.Range32{Lo: 0x114b9, Hi: 0x114b9, Stride: 0x1},
+		unicode.Range32{Lo: 0x114ba, Hi: 0x114ba, Stride: 0x1},
+		unicode.Range32{Lo: 0x114bb, Hi: 0x114be, Stride: 0x1},
+		unicode.Range32{Lo: 0x114bf, Hi: 0x114c0, Stride: 0x1},
+		unicode.Range32{Lo: 0x114c1, Hi: 0x114c1, Stride: 0x1},
+		unicode.Range32{Lo: 0x114c2, Hi: 0x114c3, Stride: 0x1},
+		unicode.Range32{Lo: 0x115af, Hi: 0x115b1, Stride: 0x1},
+		unicode.Range32{Lo: 0x115b2, Hi: 0x115b5, Stride: 0x1},
+		unicode.Range32{Lo: 0x115b8, Hi: 0x115bb, Stride: 0x1},
+		unicode.Range32{Lo: 0x115bc, Hi: 0x115bd, Stride: 0x1},
+		unicode.Range32{Lo: 0x115be, Hi: 0x115be, Stride: 0x1},
+		unicode.Range32{Lo: 0x115bf, Hi: 0x115c0, Stride: 0x1},
+		unicode.Range32{Lo: 0x115dc, Hi: 0x115dd, Stride: 0x1},
+		unicode.Range32{Lo: 0x11630, Hi: 0x11632, Stride: 0x1},
+		unicode.Range32{Lo: 0x11633, Hi: 0x1163a, Stride: 0x1},
+		unicode.Range32{Lo: 0x1163b, Hi: 0x1163c, Stride: 0x1},
+		unicode.Range32{Lo: 0x1163d, Hi: 0x1163d, Stride: 0x1},
+		unicode.Range32{Lo: 0x1163e, Hi: 0x1163e, Stride: 0x1},
+		unicode.Range32{Lo: 0x1163f, Hi: 0x11640, Stride: 0x1},
+		unicode.Range32{Lo: 0x116ab, Hi: 0x116ab, Stride: 0x1},
+		unicode.Range32{Lo: 0x116ac, Hi: 0x116ac, Stride: 0x1},
+		unicode.Range32{Lo: 0x116ad, Hi: 0x116ad, Stride: 0x1},
+		unicode.Range32{Lo: 0x116ae, Hi: 0x116af, Stride: 0x1},
+		unicode.Range32{Lo: 0x116b0, Hi: 0x116b5, Stride: 0x1},
+		unicode.Range32{Lo: 0x116b6, Hi: 0x116b6, Stride: 0x1},
+		unicode.Range32{Lo: 0x116b7, Hi: 0x116b7, Stride: 0x1},
+		unicode.Range32{Lo: 0x1171d, Hi: 0x1171f, Stride: 0x1},
+		unicode.Range32{Lo: 0x11720, Hi: 0x11721, Stride: 0x1},
+		unicode.Range32{Lo: 0x11722, Hi: 0x11725, Stride: 0x1},
+		unicode.Range32{Lo: 0x11726, Hi: 0x11726, Stride: 0x1},
+		unicode.Range32{Lo: 0x11727, Hi: 0x1172b, Stride: 0x1},
+		unicode.Range32{Lo: 0x1182c, Hi: 0x1182e, Stride: 0x1},
+		unicode.Range32{Lo: 0x1182f, Hi: 0x11837, Stride: 0x1},
+		unicode.Range32{Lo: 0x11838, Hi: 0x11838, Stride: 0x1},
+		unicode.Range32{Lo: 0x11839, Hi: 0x1183a, Stride: 0x1},
+		unicode.Range32{Lo: 0x11930, Hi: 0x11935, Stride: 0x1},
+		unicode.Range32{Lo: 0x11937, Hi: 0x11938, Stride: 0x1},
+		unicode.Range32{Lo: 0x1193b, Hi: 0x1193c, Stride: 0x1},
+		unicode.Range32{Lo: 0x1193d, Hi: 0x1193d, Stride: 0x1},
+		unicode.Range32{Lo: 0x1193e, Hi: 0x1193e, Stride: 0x1},
+		unicode.Range32{Lo: 0x11940, Hi: 0x11940, Stride: 0x1},
+		unicode.Range32{Lo: 0x11942, Hi: 0x11942, Stride: 0x1},
+		unicode.Range32{Lo: 0x11943, Hi: 0x11943, Stride: 0x1},
+		unicode.Range32{Lo: 0x119d1, Hi: 0x119d3, Stride: 0x1},
+		unicode.Range32{Lo: 0x119d4, Hi: 0x119d7, Stride: 0x1},
+		unicode.Range32{Lo: 0x119da, Hi: 0x119db, Stride: 0x1},
+		unicode.Range32{Lo: 0x119dc, Hi: 0x119df, Stride: 0x1},
+		unicode.Range32{Lo: 0x119e0, Hi: 0x119e0, Stride: 0x1},
+		unicode.Range32{Lo: 0x119e4, Hi: 0x119e4, Stride: 0x1},
+		unicode.Range32{Lo: 0x11a01, Hi: 0x11a0a, Stride: 0x1},
+		unicode.Range32{Lo: 0x11a33, Hi: 0x11a38, Stride: 0x1},
+		unicode.Range32{Lo: 0x11a39, Hi: 0x11a39, Stride: 0x1},
+		unicode.Range32{Lo: 0x11a3b, Hi: 0x11a3e, Stride: 0x1},
+		unicode.Range32{Lo: 0x11a47, Hi: 0x11a47, Stride: 0x1},
+		unicode.Range32{Lo: 0x11a51, Hi: 0x11a56, Stride: 0x1},
+		unicode.Range32{Lo: 0x11a57, Hi: 0x11a58, Stride: 0x1},
+		unicode.Range32{Lo: 0x11a59, Hi: 0x11a5b, Stride: 0x1},
+		unicode.Range32{Lo: 0x11a8a, Hi: 0x11a96, Stride: 0x1},
+		unicode.Range32{Lo: 0x11a97, Hi: 0x11a97, Stride: 0x1},
+		unicode.Range32{Lo: 0x11a98, Hi: 0x11a99, Stride: 0x1},
+		unicode.Range32{Lo: 0x11c2f, Hi: 0x11c2f, Stride: 0x1},
+		unicode.Range32{Lo: 0x11c30, Hi: 0x11c36, Stride: 0x1},
+		unicode.Range32{Lo: 0x11c38, Hi: 0x11c3d, Stride: 0x1},
+		unicode.Range32{Lo: 0x11c3e, Hi: 0x11c3e, Stride: 0x1},
+		unicode.Range32{Lo: 0x11c3f, Hi: 0x11c3f, Stride: 0x1},
+		unicode.Range32{Lo: 0x11c92, Hi: 0x11ca7, Stride: 0x1},
+		unicode.Range32{Lo: 0x11ca9, Hi: 0x11ca9, Stride: 0x1},
+		unicode.Range32{Lo: 0x11caa, Hi: 0x11cb0, Stride: 0x1},
+		unicode.Range32{Lo: 0x11cb1, Hi: 0x11cb1, Stride: 0x1},
+		unicode.Range32{Lo: 0x11cb2, Hi: 0x11cb3, Stride: 0x1},
+		unicode.Range32{Lo: 0x11cb4, Hi: 0x11cb4, Stride: 0x1},
+		unicode.Range32{Lo: 0x11cb5, Hi: 0x11cb6, Stride: 0x1},
+		unicode.Range32{Lo: 0x11d31, Hi: 0x11d36, Stride: 0x1},
+		unicode.Range32{Lo: 0x11d3a, Hi: 0x11d3a, Stride: 0x1},
+		unicode.Range32{Lo: 0x11d3c, Hi: 0x11d3d, Stride: 0x1},
+		unicode.Range32{Lo: 0x11d3f, Hi: 0x11d45, Stride: 0x1},
+		unicode.Range32{Lo: 0x11d47, Hi: 0x11d47, Stride: 0x1},
+		unicode.Range32{Lo: 0x11d8a, Hi: 0x11d8e, Stride: 0x1},
+		unicode.Range32{Lo: 0x11d90, Hi: 0x11d91, Stride: 0x1},
+		unicode.Range32{Lo: 0x11d93, Hi: 0x11d94, Stride: 0x1},
+		unicode.Range32{Lo: 0x11d95, Hi: 0x11d95, Stride: 0x1},
+		unicode.Range32{Lo: 0x11d96, Hi: 0x11d96, Stride: 0x1},
+		unicode.Range32{Lo: 0x11d97, Hi: 0x11d97, Stride: 0x1},
+		unicode.Range32{Lo: 0x11ef3, Hi: 0x11ef4, Stride: 0x1},
+		unicode.Range32{Lo: 0x11ef5, Hi: 0x11ef6, Stride: 0x1},
+		unicode.Range32{Lo: 0x11f00, Hi: 0x11f01, Stride: 0x1},
+		unicode.Range32{Lo: 0x11f03, Hi: 0x11f03, Stride: 0x1},
+		unicode.Range32{Lo: 0x11f34, Hi: 0x11f35, Stride: 0x1},
+		unicode.Range32{Lo: 0x11f36, Hi: 0x11f3a, Stride: 0x1},
+		unicode.Range32{Lo: 0x11f3e, Hi: 0x11f3f, Stride: 0x1},
+		unicode.Range32{Lo: 0x11f40, Hi: 0x11f40, Stride: 0x1},
+		unicode.Range32{Lo: 0x11f41, Hi: 0x11f41, Stride: 0x1},
+		unicode.Range32{Lo: 0x11f42, Hi: 0x11f42, Stride: 0x1},
+		unicode.Range32{Lo: 0x13440, Hi: 0x13440, Stride: 0x1},
+		unicode.Range32{Lo: 0x13447, Hi: 0x13455, Stride: 0x1},
+		unicode.Range32{Lo: 0x16af0, Hi: 0x16af4, Stride: 0x1},
+		unicode.Range32{Lo: 0x16b30, Hi: 0x16b36, Stride: 0x1},
+		unicode.Range32{Lo: 0x16f4f, Hi: 0x16f4f, Stride: 0x1},
+		unicode.Range32{Lo: 0x16f51, Hi: 0x16f87, Stride: 0x1},
+		unicode.Range32{Lo: 0x16f8f, Hi: 0x16f92, Stride: 0x1},
+		unicode.Range32{Lo: 0x16fe4, Hi: 0x16fe4, Stride: 0x1},
+		unicode.Range32{Lo: 0x16ff0, Hi: 0x16ff1, Stride: 0x1},
+		unicode.Range32{Lo: 0x1bc9d, Hi: 0x1bc9e, Stride: 0x1},
+		unicode.Range32{Lo: 0x1cf00, Hi: 0x1cf2d, Stride: 0x1},
+		unicode.Range32{Lo: 0x1cf30, Hi: 0x1cf46, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d165, Hi: 0x1d166, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d167, Hi: 0x1d169, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d16d, Hi: 0x1d172, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d17b, Hi: 0x1d182, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d185, Hi: 0x1d18b, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d1aa, Hi: 0x1d1ad, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d242, Hi: 0x1d244, Stride: 0x1},
+		unicode.Range32{Lo: 0x1da00, Hi: 0x1da36, Stride: 0x1},
+		unicode.Range32{Lo: 0x1da3b, Hi: 0x1da6c, Stride: 0x1},
+		unicode.Range32{Lo: 0x1da75, Hi: 0x1da75, Stride: 0x1},
+		unicode.Range32{Lo: 0x1da84, Hi: 0x1da84, Stride: 0x1},
+		unicode.Range32{Lo: 0x1da9b, Hi: 0x1da9f, Stride: 0x1},
+		unicode.Range32{Lo: 0x1daa1, Hi: 0x1daaf, Stride: 0x1},
+		unicode.Range32{Lo: 0x1e000, Hi: 0x1e006, Stride: 0x1},
+		unicode.Range32{Lo: 0x1e008, Hi: 0x1e018, Stride: 0x1},
+		unicode.Range32{Lo: 0x1e01b, Hi: 0x1e021, Stride: 0x1},
+		unicode.Range32{Lo: 0x1e023, Hi: 0x1e024, Stride: 0x1},
+		unicode.Range32{Lo: 0x1e026, Hi: 0x1e02a, Stride: 0x1},
+		unicode.Range32{Lo: 0x1e08f, Hi: 0x1e08f, Stride: 0x1},
+		unicode.Range32{Lo: 0x1e130, Hi: 0x1e136, Stride: 0x1},
+		unicode.Range32{Lo: 0x1e2ae, Hi: 0x1e2ae, Stride: 0x1},
+		unicode.Range32{Lo: 0x1e2ec, Hi: 0x1e2ef, Stride: 0x1},
+		unicode.Range32{Lo: 0x1e4ec, Hi: 0x1e4ef, Stride: 0x1},
+		unicode.Range32{Lo: 0x1e8d0, Hi: 0x1e8d6, Stride: 0x1},
+		unicode.Range32{Lo: 0x1e944, Hi: 0x1e94a, Stride: 0x1},
+		unicode.Range32{Lo: 0xe0020, Hi: 0xe007f, Stride: 0x1},
+		unicode.Range32{Lo: 0xe0100, Hi: 0xe01ef, Stride: 0x1},
+	},
+	LatinOffset: 0,
+}
+
+var _SentenceFormat = &unicode.RangeTable{
+	R16: []unicode.Range16{
+		unicode.Range16{Lo: 0xad, Hi: 0xad, Stride: 0x1},
+		unicode.Range16{Lo: 0x600, Hi: 0x605, Stride: 0x1},
+		unicode.Range16{Lo: 0x61c, Hi: 0x61c, Stride: 0x1},
+		unicode.Range16{Lo: 0x6dd, Hi: 0x6dd, Stride: 0x1},
+		unicode.Range16{Lo: 0x70f, Hi: 0x70f, Stride: 0x1},
+		unicode.Range16{Lo: 0x890, Hi: 0x891, Stride: 0x1},
+		unicode.Range16{Lo: 0x8e2, Hi: 0x8e2, Stride: 0x1},
+		unicode.Range16{Lo: 0x180e, Hi: 0x180e, Stride: 0x1},
+		unicode.Range16{Lo: 0x200b, Hi: 0x200b, Stride: 0x1},
+		unicode.Range16{Lo: 0x200e, Hi: 0x200f, Stride: 0x1},
+		unicode.Range16{Lo: 0x202a, Hi: 0x202e, Stride: 0x1},
+		unicode.Range16{Lo: 0x2060, Hi: 0x2064, Stride: 0x1},
+		unicode.Range16{Lo: 0x2066, Hi: 0x206f, Stride: 0x1},
+		unicode.Range16{Lo: 0xfeff, Hi: 0xfeff, Stride: 0x1},
+		unicode.Range16{Lo: 0xfff9, Hi: 0xfffb, Stride: 0x1},
+	},
+	R32: []unicode.Range32{
+		unicode.Range32{Lo: 0x110bd, Hi: 0x110bd, Stride: 0x1},
+		unicode.Range32{Lo: 0x110cd, Hi: 0x110cd, Stride: 0x1},
+		unicode.Range32{Lo: 0x13430, Hi: 0x1343f, Stride: 0x1},
+		unicode.Range32{Lo: 0x1bca0, Hi: 0x1bca3, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d173, Hi: 0x1d17a, Stride: 0x1},
+		unicode.Range32{Lo: 0xe0001, Hi: 0xe0001, Stride: 0x1},
+	},
+	LatinOffset: 1,
+}
+
+var _SentenceLF = &unicode.RangeTable{
+	R16: []unicode.Range16{
+		unicode.Range16{Lo: 0xa, Hi: 0xa, Stride: 0x1},
+	},
+	LatinOffset: 1,
+}
+
+var _SentenceLower = &unicode.RangeTable{
+	R16: []unicode.Range16{
+		unicode.Range16{Lo: 0x61, Hi: 0x7a, Stride: 0x1},
+		unicode.Range16{Lo: 0xaa, Hi: 0xaa, Stride: 0x1},
+		unicode.Range16{Lo: 0xb5, Hi: 0xb5, Stride: 0x1},
+		unicode.Range16{Lo: 0xba, Hi: 0xba, Stride: 0x1},
+		unicode.Range16{Lo: 0xdf, Hi: 0xf6, Stride: 0x1},
+		unicode.Range16{Lo: 0xf8, Hi: 0xff, Stride: 0x1},
+		unicode.Range16{Lo: 0x101, Hi: 0x101, Stride: 0x1},
+		unicode.Range16{Lo: 0x103, Hi: 0x103, Stride: 0x1},
+		unicode.Range16{Lo: 0x105, Hi: 0x105, Stride: 0x1},
+		unicode.Range16{Lo: 0x107, Hi: 0x107, Stride: 0x1},
+		unicode.Range16{Lo: 0x109, Hi: 0x109, Stride: 0x1},
+		unicode.Range16{Lo: 0x10b, Hi: 0x10b, Stride: 0x1},
+		unicode.Range16{Lo: 0x10d, Hi: 0x10d, Stride: 0x1},
+		unicode.Range16{Lo: 0x10f, Hi: 0x10f, Stride: 0x1},
+		unicode.Range16{Lo: 0x111, Hi: 0x111, Stride: 0x1},
+		unicode.Range16{Lo: 0x113, Hi: 0x113, Stride: 0x1},
+		unicode.Range16{Lo: 0x115, Hi: 0x115, Stride: 0x1},
+		unicode.Range16{Lo: 0x117, Hi: 0x117, Stride: 0x1},
+		unicode.Range16{Lo: 0x119, Hi: 0x119, Stride: 0x1},
+		unicode.Range16{Lo: 0x11b, Hi: 0x11b, Stride: 0x1},
+		unicode.Range16{Lo: 0x11d, Hi: 0x11d, Stride: 0x1},
+		unicode.Range16{Lo: 0x11f, Hi: 0x11f, Stride: 0x1},
+		unicode.Range16{Lo: 0x121, Hi: 0x121, Stride: 0x1},
+		unicode.Range16{Lo: 0x123, Hi: 0x123, Stride: 0x1},
+		unicode.Range16{Lo: 0x125, Hi: 0x125, Stride: 0x1},
+		unicode.Range16{Lo: 0x127, Hi: 0x127, Stride: 0x1},
+		unicode.Range16{Lo: 0x129, Hi: 0x129, Stride: 0x1},
+		unicode.Range16{Lo: 0x12b, Hi: 0x12b, Stride: 0x1},
+		unicode.Range16{Lo: 0x12d, Hi: 0x12d, Stride: 0x1},
+		unicode.Range16{Lo: 0x12f, Hi: 0x12f, Stride: 0x1},
+		unicode.Range16{Lo: 0x131, Hi: 0x131, Stride: 0x1},
+		unicode.Range16{Lo: 0x133, Hi: 0x133, Stride: 0x1},
+		unicode.Range16{Lo: 0x135, Hi: 0x135, Stride: 0x1},
+		unicode.Range16{Lo: 0x137, Hi: 0x138, Stride: 0x1},
+		unicode.Range16{Lo: 0x13a, Hi: 0x13a, Stride: 0x1},
+		unicode.Range16{Lo: 0x13c, Hi: 0x13c, Stride: 0x1},
+		unicode.Range16{Lo: 0x13e, Hi: 0x13e, Stride: 0x1},
+		unicode.Range16{Lo: 0x140, Hi: 0x140, Stride: 0x1},
+		unicode.Range16{Lo: 0x142, Hi: 0x142, Stride: 0x1},
+		unicode.Range16{Lo: 0x144, Hi: 0x144, Stride: 0x1},
+		unicode.Range16{Lo: 0x146, Hi: 0x146, Stride: 0x1},
+		unicode.Range16{Lo: 0x148, Hi: 0x149, Stride: 0x1},
+		unicode.Range16{Lo: 0x14b, Hi: 0x14b, Stride: 0x1},
+		unicode.Range16{Lo: 0x14d, Hi: 0x14d, Stride: 0x1},
+		unicode.Range16{Lo: 0x14f, Hi: 0x14f, Stride: 0x1},
+		unicode.Range16{Lo: 0x151, Hi: 0x151, Stride: 0x1},
+		unicode.Range16{Lo: 0x153, Hi: 0x153, Stride: 0x1},
+		unicode.Range16{Lo: 0x155, Hi: 0x155, Stride: 0x1},
+		unicode.Range16{Lo: 0x157, Hi: 0x157, Stride: 0x1},
+		unicode.Range16{Lo: 0x159, Hi: 0x159, Stride: 0x1},
+		unicode.Range16{Lo: 0x15b, Hi: 0x15b, Stride: 0x1},
+		unicode.Range16{Lo: 0x15d, Hi: 0x15d, Stride: 0x1},
+		unicode.Range16{Lo: 0x15f, Hi: 0x15f, Stride: 0x1},
+		unicode.Range16{Lo: 0x161, Hi: 0x161, Stride: 0x1},
+		unicode.Range16{Lo: 0x163, Hi: 0x163, Stride: 0x1},
+		unicode.Range16{Lo: 0x165, Hi: 0x165, Stride: 0x1},
+		unicode.Range16{Lo: 0x167, Hi: 0x167, Stride: 0x1},
+		unicode.Range16{Lo: 0x169, Hi: 0x169, Stride: 0x1},
+		unicode.Range16{Lo: 0x16b, Hi: 0x16b, Stride: 0x1},
+		unicode.Range16{Lo: 0x16d, Hi: 0x16d, Stride: 0x1},
+		unicode.Range16{Lo: 0x16f, Hi: 0x16f, Stride: 0x1},
+		unicode.Range16{Lo: 0x171, Hi: 0x171, Stride: 0x1},
+		unicode.Range16{Lo: 0x173, Hi: 0x173, Stride: 0x1},
+		unicode.Range16{Lo: 0x175, Hi: 0x175, Stride: 0x1},
+		unicode.Range16{Lo: 0x177, Hi: 0x177, Stride: 0x1},
+		unicode.Range16{Lo: 0x17a, Hi: 0x17a, Stride: 0x1},
+		unicode.Range16{Lo: 0x17c, Hi: 0x17c, Stride: 0x1},
+		unicode.Range16{Lo: 0x17e, Hi: 0x180, Stride: 0x1},
+		unicode.Range16{Lo: 0x183, Hi: 0x183, Stride: 0x1},
+		unicode.Range16{Lo: 0x185, Hi: 0x185, Stride: 0x1},
+		unicode.Range16{Lo: 0x188, Hi: 0x188, Stride: 0x1},
+		unicode.Range16{Lo: 0x18c, Hi: 0x18d, Stride: 0x1},
+		unicode.Range16{Lo: 0x192, Hi: 0x192, Stride: 0x1},
+		unicode.Range16{Lo: 0x195, Hi: 0x195, Stride: 0x1},
+		unicode.Range16{Lo: 0x199, Hi: 0x19b, Stride: 0x1},
+		unicode.Range16{Lo: 0x19e, Hi: 0x19e, Stride: 0x1},
+		unicode.Range16{Lo: 0x1a1, Hi: 0x1a1, Stride: 0x1},
+		unicode.Range16{Lo: 0x1a3, Hi: 0x1a3, Stride: 0x1},
+		unicode.Range16{Lo: 0x1a5, Hi: 0x1a5, Stride: 0x1},
+		unicode.Range16{Lo: 0x1a8, Hi: 0x1a8, Stride: 0x1},
+		unicode.Range16{Lo: 0x1aa, Hi: 0x1ab, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ad, Hi: 0x1ad, Stride: 0x1},
+		unicode.Range16{Lo: 0x1b0, Hi: 0x1b0, Stride: 0x1},
+		unicode.Range16{Lo: 0x1b4, Hi: 0x1b4, Stride: 0x1},
+		unicode.Range16{Lo: 0x1b6, Hi: 0x1b6, Stride: 0x1},
+		unicode.Range16{Lo: 0x1b9, Hi: 0x1ba, Stride: 0x1},
+		unicode.Range16{Lo: 0x1bd, Hi: 0x1bf, Stride: 0x1},
+		unicode.Range16{Lo: 0x1c6, Hi: 0x1c6, Stride: 0x1},
+		unicode.Range16{Lo: 0x1c9, Hi: 0x1c9, Stride: 0x1},
+		unicode.Range16{Lo: 0x1cc, Hi: 0x1cc, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ce, Hi: 0x1ce, Stride: 0x1},
+		unicode.Range16{Lo: 0x1d0, Hi: 0x1d0, Stride: 0x1},
+		unicode.Range16{Lo: 0x1d2, Hi: 0x1d2, Stride: 0x1},
+		unicode.Range16{Lo: 0x1d4, Hi: 0x1d4, Stride: 0x1},
+		unicode.Range16{Lo: 0x1d6, Hi: 0x1d6, Stride: 0x1},
+		unicode.Range16{Lo: 0x1d8, Hi: 0x1d8, Stride: 0x1},
+		unicode.Range16{Lo: 0x1da, Hi: 0x1da, Stride: 0x1},
+		unicode.Range16{Lo: 0x1dc, Hi: 0x1dd, Stride: 0x1},
+		unicode.Range16{Lo: 0x1df, Hi: 0x1df, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e1, Hi: 0x1e1, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e3, Hi: 0x1e3, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e5, Hi: 0x1e5, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e7, Hi: 0x1e7, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e9, Hi: 0x1e9, Stride: 0x1},
+		unicode.Range16{Lo: 0x1eb, Hi: 0x1eb, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ed, Hi: 0x1ed, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ef, Hi: 0x1f0, Stride: 0x1},
+		unicode.Range16{Lo: 0x1f3, Hi: 0x1f3, Stride: 0x1},
+		unicode.Range16{Lo: 0x1f5, Hi: 0x1f5, Stride: 0x1},
+		unicode.Range16{Lo: 0x1f9, Hi: 0x1f9, Stride: 0x1},
+		unicode.Range16{Lo: 0x1fb, Hi: 0x1fb, Stride: 0x1},
+		unicode.Range16{Lo: 0x1fd, Hi: 0x1fd, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ff, Hi: 0x1ff, Stride: 0x1},
+		unicode.Range16{Lo: 0x201, Hi: 0x201, Stride: 0x1},
+		unicode.Range16{Lo: 0x203, Hi: 0x203, Stride: 0x1},
+		unicode.Range16{Lo: 0x205, Hi: 0x205, Stride: 0x1},
+		unicode.Range16{Lo: 0x207, Hi: 0x207, Stride: 0x1},
+		unicode.Range16{Lo: 0x209, Hi: 0x209, Stride: 0x1},
+		unicode.Range16{Lo: 0x20b, Hi: 0x20b, Stride: 0x1},
+		unicode.Range16{Lo: 0x20d, Hi: 0x20d, Stride: 0x1},
+		unicode.Range16{Lo: 0x20f, Hi: 0x20f, Stride: 0x1},
+		unicode.Range16{Lo: 0x211, Hi: 0x211, Stride: 0x1},
+		unicode.Range16{Lo: 0x213, Hi: 0x213, Stride: 0x1},
+		unicode.Range16{Lo: 0x215, Hi: 0x215, Stride: 0x1},
+		unicode.Range16{Lo: 0x217, Hi: 0x217, Stride: 0x1},
+		unicode.Range16{Lo: 0x219, Hi: 0x219, Stride: 0x1},
+		unicode.Range16{Lo: 0x21b, Hi: 0x21b, Stride: 0x1},
+		unicode.Range16{Lo: 0x21d, Hi: 0x21d, Stride: 0x1},
+		unicode.Range16{Lo: 0x21f, Hi: 0x21f, Stride: 0x1},
+		unicode.Range16{Lo: 0x221, Hi: 0x221, Stride: 0x1},
+		unicode.Range16{Lo: 0x223, Hi: 0x223, Stride: 0x1},
+		unicode.Range16{Lo: 0x225, Hi: 0x225, Stride: 0x1},
+		unicode.Range16{Lo: 0x227, Hi: 0x227, Stride: 0x1},
+		unicode.Range16{Lo: 0x229, Hi: 0x229, Stride: 0x1},
+		unicode.Range16{Lo: 0x22b, Hi: 0x22b, Stride: 0x1},
+		unicode.Range16{Lo: 0x22d, Hi: 0x22d, Stride: 0x1},
+		unicode.Range16{Lo: 0x22f, Hi: 0x22f, Stride: 0x1},
+		unicode.Range16{Lo: 0x231, Hi: 0x231, Stride: 0x1},
+		unicode.Range16{Lo: 0x233, Hi: 0x239, Stride: 0x1},
+		unicode.Range16{Lo: 0x23c, Hi: 0x23c, Stride: 0x1},
+		unicode.Range16{Lo: 0x23f, Hi: 0x240, Stride: 0x1},
+		unicode.Range16{Lo: 0x242, Hi: 0x242, Stride: 0x1},
+		unicode.Range16{Lo: 0x247, Hi: 0x247, Stride: 0x1},
+		unicode.Range16{Lo: 0x249, Hi: 0x249, Stride: 0x1},
+		unicode.Range16{Lo: 0x24b, Hi: 0x24b, Stride: 0x1},
+		unicode.Range16{Lo: 0x24d, Hi: 0x24d, Stride: 0x1},
+		unicode.Range16{Lo: 0x24f, Hi: 0x293, Stride: 0x1},
+		unicode.Range16{Lo: 0x295, Hi: 0x2af, Stride: 0x1},
+		unicode.Range16{Lo: 0x2b0, Hi: 0x2b8, Stride: 0x1},
+		unicode.Range16{Lo: 0x2c0, Hi: 0x2c1, Stride: 0x1},
+		unicode.Range16{Lo: 0x2e0, Hi: 0x2e4, Stride: 0x1},
+		unicode.Range16{Lo: 0x371, Hi: 0x371, Stride: 0x1},
+		unicode.Range16{Lo: 0x373, Hi: 0x373, Stride: 0x1},
+		unicode.Range16{Lo: 0x377, Hi: 0x377, Stride: 0x1},
+		unicode.Range16{Lo: 0x37a, Hi: 0x37a, Stride: 0x1},
+		unicode.Range16{Lo: 0x37b, Hi: 0x37d, Stride: 0x1},
+		unicode.Range16{Lo: 0x390, Hi: 0x390, Stride: 0x1},
+		unicode.Range16{Lo: 0x3ac, Hi: 0x3ce, Stride: 0x1},
+		unicode.Range16{Lo: 0x3d0, Hi: 0x3d1, Stride: 0x1},
+		unicode.Range16{Lo: 0x3d5, Hi: 0x3d7, Stride: 0x1},
+		unicode.Range16{Lo: 0x3d9, Hi: 0x3d9, Stride: 0x1},
+		unicode.Range16{Lo: 0x3db, Hi: 0x3db, Stride: 0x1},
+		unicode.Range16{Lo: 0x3dd, Hi: 0x3dd, Stride: 0x1},
+		unicode.Range16{Lo: 0x3df, Hi: 0x3df, Stride: 0x1},
+		unicode.Range16{Lo: 0x3e1, Hi: 0x3e1, Stride: 0x1},
+		unicode.Range16{Lo: 0x3e3, Hi: 0x3e3, Stride: 0x1},
+		unicode.Range16{Lo: 0x3e5, Hi: 0x3e5, Stride: 0x1},
+		unicode.Range16{Lo: 0x3e7, Hi: 0x3e7, Stride: 0x1},
+		unicode.Range16{Lo: 0x3e9, Hi: 0x3e9, Stride: 0x1},
+		unicode.Range16{Lo: 0x3eb, Hi: 0x3eb, Stride: 0x1},
+		unicode.Range16{Lo: 0x3ed, Hi: 0x3ed, Stride: 0x1},
+		unicode.Range16{Lo: 0x3ef, Hi: 0x3f3, Stride: 0x1},
+		unicode.Range16{Lo: 0x3f5, Hi: 0x3f5, Stride: 0x1},
+		unicode.Range16{Lo: 0x3f8, Hi: 0x3f8, Stride: 0x1},
+		unicode.Range16{Lo: 0x3fb, Hi: 0x3fc, Stride: 0x1},
+		unicode.Range16{Lo: 0x430, Hi: 0x45f, Stride: 0x1},
+		unicode.Range16{Lo: 0x461, Hi: 0x461, Stride: 0x1},
+		unicode.Range16{Lo: 0x463, Hi: 0x463, Stride: 0x1},
+		unicode.Range16{Lo: 0x465, Hi: 0x465, Stride: 0x1},
+		unicode.Range16{Lo: 0x467, Hi: 0x467, Stride: 0x1},
+		unicode.Range16{Lo: 0x469, Hi: 0x469, Stride: 0x1},
+		unicode.Range16{Lo: 0x46b, Hi: 0x46b, Stride: 0x1},
+		unicode.Range16{Lo: 0x46d, Hi: 0x46d, Stride: 0x1},
+		unicode.Range16{Lo: 0x46f, Hi: 0x46f, Stride: 0x1},
+		unicode.Range16{Lo: 0x471, Hi: 0x471, Stride: 0x1},
+		unicode.Range16{Lo: 0x473, Hi: 0x473, Stride: 0x1},
+		unicode.Range16{Lo: 0x475, Hi: 0x475, Stride: 0x1},
+		unicode.Range16{Lo: 0x477, Hi: 0x477, Stride: 0x1},
+		unicode.Range16{Lo: 0x479, Hi: 0x479, Stride: 0x1},
+		unicode.Range16{Lo: 0x47b, Hi: 0x47b, Stride: 0x1},
+		unicode.Range16{Lo: 0x47d, Hi: 0x47d, Stride: 0x1},
+		unicode.Range16{Lo: 0x47f, Hi: 0x47f, Stride: 0x1},
+		unicode.Range16{Lo: 0x481, Hi: 0x481, Stride: 0x1},
+		unicode.Range16{Lo: 0x48b, Hi: 0x48b, Stride: 0x1},
+		unicode.Range16{Lo: 0x48d, Hi: 0x48d, Stride: 0x1},
+		unicode.Range16{Lo: 0x48f, Hi: 0x48f, Stride: 0x1},
+		unicode.Range16{Lo: 0x491, Hi: 0x491, Stride: 0x1},
+		unicode.Range16{Lo: 0x493, Hi: 0x493, Stride: 0x1},
+		unicode.Range16{Lo: 0x495, Hi: 0x495, Stride: 0x1},
+		unicode.Range16{Lo: 0x497, Hi: 0x497, Stride: 0x1},
+		unicode.Range16{Lo: 0x499, Hi: 0x499, Stride: 0x1},
+		unicode.Range16{Lo: 0x49b, Hi: 0x49b, Stride: 0x1},
+		unicode.Range16{Lo: 0x49d, Hi: 0x49d, Stride: 0x1},
+		unicode.Range16{Lo: 0x49f, Hi: 0x49f, Stride: 0x1},
+		unicode.Range16{Lo: 0x4a1, Hi: 0x4a1, Stride: 0x1},
+		unicode.Range16{Lo: 0x4a3, Hi: 0x4a3, Stride: 0x1},
+		unicode.Range16{Lo: 0x4a5, Hi: 0x4a5, Stride: 0x1},
+		unicode.Range16{Lo: 0x4a7, Hi: 0x4a7, Stride: 0x1},
+		unicode.Range16{Lo: 0x4a9, Hi: 0x4a9, Stride: 0x1},
+		unicode.Range16{Lo: 0x4ab, Hi: 0x4ab, Stride: 0x1},
+		unicode.Range16{Lo: 0x4ad, Hi: 0x4ad, Stride: 0x1},
+		unicode.Range16{Lo: 0x4af, Hi: 0x4af, Stride: 0x1},
+		unicode.Range16{Lo: 0x4b1, Hi: 0x4b1, Stride: 0x1},
+		unicode.Range16{Lo: 0x4b3, Hi: 0x4b3, Stride: 0x1},
+		unicode.Range16{Lo: 0x4b5, Hi: 0x4b5, Stride: 0x1},
+		unicode.Range16{Lo: 0x4b7, Hi: 0x4b7, Stride: 0x1},
+		unicode.Range16{Lo: 0x4b9, Hi: 0x4b9, Stride: 0x1},
+		unicode.Range16{Lo: 0x4bb, Hi: 0x4bb, Stride: 0x1},
+		unicode.Range16{Lo: 0x4bd, Hi: 0x4bd, Stride: 0x1},
+		unicode.Range16{Lo: 0x4bf, Hi: 0x4bf, Stride: 0x1},
+		unicode.Range16{Lo: 0x4c2, Hi: 0x4c2, Stride: 0x1},
+		unicode.Range16{Lo: 0x4c4, Hi: 0x4c4, Stride: 0x1},
+		unicode.Range16{Lo: 0x4c6, Hi: 0x4c6, Stride: 0x1},
+		unicode.Range16{Lo: 0x4c8, Hi: 0x4c8, Stride: 0x1},
+		unicode.Range16{Lo: 0x4ca, Hi: 0x4ca, Stride: 0x1},
+		unicode.Range16{Lo: 0x4cc, Hi: 0x4cc, Stride: 0x1},
+		unicode.Range16{Lo: 0x4ce, Hi: 0x4cf, Stride: 0x1},
+		unicode.Range16{Lo: 0x4d1, Hi: 0x4d1, Stride: 0x1},
+		unicode.Range16{Lo: 0x4d3, Hi: 0x4d3, Stride: 0x1},
+		unicode.Range16{Lo: 0x4d5, Hi: 0x4d5, Stride: 0x1},
+		unicode.Range16{Lo: 0x4d7, Hi: 0x4d7, Stride: 0x1},
+		unicode.Range16{Lo: 0x4d9, Hi: 0x4d9, Stride: 0x1},
+		unicode.Range16{Lo: 0x4db, Hi: 0x4db, Stride: 0x1},
+		unicode.Range16{Lo: 0x4dd, Hi: 0x4dd, Stride: 0x1},
+		unicode.Range16{Lo: 0x4df, Hi: 0x4df, Stride: 0x1},
+		unicode.Range16{Lo: 0x4e1, Hi: 0x4e1, Stride: 0x1},
+		unicode.Range16{Lo: 0x4e3, Hi: 0x4e3, Stride: 0x1},
+		unicode.Range16{Lo: 0x4e5, Hi: 0x4e5, Stride: 0x1},
+		unicode.Range16{Lo: 0x4e7, Hi: 0x4e7, Stride: 0x1},
+		unicode.Range16{Lo: 0x4e9, Hi: 0x4e9, Stride: 0x1},
+		unicode.Range16{Lo: 0x4eb, Hi: 0x4eb, Stride: 0x1},
+		unicode.Range16{Lo: 0x4ed, Hi: 0x4ed, Stride: 0x1},
+		unicode.Range16{Lo: 0x4ef, Hi: 0x4ef, Stride: 0x1},
+		unicode.Range16{Lo: 0x4f1, Hi: 0x4f1, Stride: 0x1},
+		unicode.Range16{Lo: 0x4f3, Hi: 0x4f3, Stride: 0x1},
+		unicode.Range16{Lo: 0x4f5, Hi: 0x4f5, Stride: 0x1},
+		unicode.Range16{Lo: 0x4f7, Hi: 0x4f7, Stride: 0x1},
+		unicode.Range16{Lo: 0x4f9, Hi: 0x4f9, Stride: 0x1},
+		unicode.Range16{Lo: 0x4fb, Hi: 0x4fb, Stride: 0x1},
+		unicode.Range16{Lo: 0x4fd, Hi: 0x4fd, Stride: 0x1},
+		unicode.Range16{Lo: 0x4ff, Hi: 0x4ff, Stride: 0x1},
+		unicode.Range16{Lo: 0x501, Hi: 0x501, Stride: 0x1},
+		unicode.Range16{Lo: 0x503, Hi: 0x503, Stride: 0x1},
+		unicode.Range16{Lo: 0x505, Hi: 0x505, Stride: 0x1},
+		unicode.Range16{Lo: 0x507, Hi: 0x507, Stride: 0x1},
+		unicode.Range16{Lo: 0x509, Hi: 0x509, Stride: 0x1},
+		unicode.Range16{Lo: 0x50b, Hi: 0x50b, Stride: 0x1},
+		unicode.Range16{Lo: 0x50d, Hi: 0x50d, Stride: 0x1},
+		unicode.Range16{Lo: 0x50f, Hi: 0x50f, Stride: 0x1},
+		unicode.Range16{Lo: 0x511, Hi: 0x511, Stride: 0x1},
+		unicode.Range16{Lo: 0x513, Hi: 0x513, Stride: 0x1},
+		unicode.Range16{Lo: 0x515, Hi: 0x515, Stride: 0x1},
+		unicode.Range16{Lo: 0x517, Hi: 0x517, Stride: 0x1},
+		unicode.Range16{Lo: 0x519, Hi: 0x519, Stride: 0x1},
+		unicode.Range16{Lo: 0x51b, Hi: 0x51b, Stride: 0x1},
+		unicode.Range16{Lo: 0x51d, Hi: 0x51d, Stride: 0x1},
+		unicode.Range16{Lo: 0x51f, Hi: 0x51f, Stride: 0x1},
+		unicode.Range16{Lo: 0x521, Hi: 0x521, Stride: 0x1},
+		unicode.Range16{Lo: 0x523, Hi: 0x523, Stride: 0x1},
+		unicode.Range16{Lo: 0x525, Hi: 0x525, Stride: 0x1},
+		unicode.Range16{Lo: 0x527, Hi: 0x527, Stride: 0x1},
+		unicode.Range16{Lo: 0x529, Hi: 0x529, Stride: 0x1},
+		unicode.Range16{Lo: 0x52b, Hi: 0x52b, Stride: 0x1},
+		unicode.Range16{Lo: 0x52d, Hi: 0x52d, Stride: 0x1},
+		unicode.Range16{Lo: 0x52f, Hi: 0x52f, Stride: 0x1},
+		unicode.Range16{Lo: 0x560, Hi: 0x588, Stride: 0x1},
+		unicode.Range16{Lo: 0x10fc, Hi: 0x10fc, Stride: 0x1},
+		unicode.Range16{Lo: 0x13f8, Hi: 0x13fd, Stride: 0x1},
+		unicode.Range16{Lo: 0x1c80, Hi: 0x1c88, Stride: 0x1},
+		unicode.Range16{Lo: 0x1d00, Hi: 0x1d2b, Stride: 0x1},
+		unicode.Range16{Lo: 0x1d2c, Hi: 0x1d6a, Stride: 0x1},
+		unicode.Range16{Lo: 0x1d6b, Hi: 0x1d77, Stride: 0x1},
+		unicode.Range16{Lo: 0x1d78, Hi: 0x1d78, Stride: 0x1},
+		unicode.Range16{Lo: 0x1d79, Hi: 0x1d9a, Stride: 0x1},
+		unicode.Range16{Lo: 0x1d9b, Hi: 0x1dbf, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e01, Hi: 0x1e01, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e03, Hi: 0x1e03, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e05, Hi: 0x1e05, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e07, Hi: 0x1e07, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e09, Hi: 0x1e09, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e0b, Hi: 0x1e0b, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e0d, Hi: 0x1e0d, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e0f, Hi: 0x1e0f, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e11, Hi: 0x1e11, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e13, Hi: 0x1e13, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e15, Hi: 0x1e15, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e17, Hi: 0x1e17, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e19, Hi: 0x1e19, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e1b, Hi: 0x1e1b, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e1d, Hi: 0x1e1d, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e1f, Hi: 0x1e1f, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e21, Hi: 0x1e21, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e23, Hi: 0x1e23, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e25, Hi: 0x1e25, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e27, Hi: 0x1e27, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e29, Hi: 0x1e29, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e2b, Hi: 0x1e2b, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e2d, Hi: 0x1e2d, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e2f, Hi: 0x1e2f, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e31, Hi: 0x1e31, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e33, Hi: 0x1e33, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e35, Hi: 0x1e35, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e37, Hi: 0x1e37, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e39, Hi: 0x1e39, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e3b, Hi: 0x1e3b, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e3d, Hi: 0x1e3d, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e3f, Hi: 0x1e3f, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e41, Hi: 0x1e41, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e43, Hi: 0x1e43, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e45, Hi: 0x1e45, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e47, Hi: 0x1e47, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e49, Hi: 0x1e49, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e4b, Hi: 0x1e4b, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e4d, Hi: 0x1e4d, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e4f, Hi: 0x1e4f, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e51, Hi: 0x1e51, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e53, Hi: 0x1e53, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e55, Hi: 0x1e55, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e57, Hi: 0x1e57, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e59, Hi: 0x1e59, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e5b, Hi: 0x1e5b, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e5d, Hi: 0x1e5d, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e5f, Hi: 0x1e5f, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e61, Hi: 0x1e61, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e63, Hi: 0x1e63, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e65, Hi: 0x1e65, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e67, Hi: 0x1e67, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e69, Hi: 0x1e69, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e6b, Hi: 0x1e6b, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e6d, Hi: 0x1e6d, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e6f, Hi: 0x1e6f, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e71, Hi: 0x1e71, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e73, Hi: 0x1e73, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e75, Hi: 0x1e75, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e77, Hi: 0x1e77, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e79, Hi: 0x1e79, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e7b, Hi: 0x1e7b, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e7d, Hi: 0x1e7d, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e7f, Hi: 0x1e7f, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e81, Hi: 0x1e81, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e83, Hi: 0x1e83, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e85, Hi: 0x1e85, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e87, Hi: 0x1e87, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e89, Hi: 0x1e89, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e8b, Hi: 0x1e8b, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e8d, Hi: 0x1e8d, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e8f, Hi: 0x1e8f, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e91, Hi: 0x1e91, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e93, Hi: 0x1e93, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e95, Hi: 0x1e9d, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e9f, Hi: 0x1e9f, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ea1, Hi: 0x1ea1, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ea3, Hi: 0x1ea3, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ea5, Hi: 0x1ea5, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ea7, Hi: 0x1ea7, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ea9, Hi: 0x1ea9, Stride: 0x1},
+		unicode.Range16{Lo: 0x1eab, Hi: 0x1eab, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ead, Hi: 0x1ead, Stride: 0x1},
+		unicode.Range16{Lo: 0x1eaf, Hi: 0x1eaf, Stride: 0x1},
+		unicode.Range16{Lo: 0x1eb1, Hi: 0x1eb1, Stride: 0x1},
+		unicode.Range16{Lo: 0x1eb3, Hi: 0x1eb3, Stride: 0x1},
+		unicode.Range16{Lo: 0x1eb5, Hi: 0x1eb5, Stride: 0x1},
+		unicode.Range16{Lo: 0x1eb7, Hi: 0x1eb7, Stride: 0x1},
+		unicode.Range16{Lo: 0x1eb9, Hi: 0x1eb9, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ebb, Hi: 0x1ebb, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ebd, Hi: 0x1ebd, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ebf, Hi: 0x1ebf, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ec1, Hi: 0x1ec1, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ec3, Hi: 0x1ec3, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ec5, Hi: 0x1ec5, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ec7, Hi: 0x1ec7, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ec9, Hi: 0x1ec9, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ecb, Hi: 0x1ecb, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ecd, Hi: 0x1ecd, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ecf, Hi: 0x1ecf, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ed1, Hi: 0x1ed1, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ed3, Hi: 0x1ed3, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ed5, Hi: 0x1ed5, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ed7, Hi: 0x1ed7, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ed9, Hi: 0x1ed9, Stride: 0x1},
+		unicode.Range16{Lo: 0x1edb, Hi: 0x1edb, Stride: 0x1},
+		unicode.Range16{Lo: 0x1edd, Hi: 0x1edd, Stride: 0x1},
+		unicode.Range16{Lo: 0x1edf, Hi: 0x1edf, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ee1, Hi: 0x1ee1, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ee3, Hi: 0x1ee3, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ee5, Hi: 0x1ee5, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ee7, Hi: 0x1ee7, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ee9, Hi: 0x1ee9, Stride: 0x1},
+		unicode.Range16{Lo: 0x1eeb, Hi: 0x1eeb, Stride: 0x1},
+		unicode.Range16{Lo: 0x1eed, Hi: 0x1eed, Stride: 0x1},
+		unicode.Range16{Lo: 0x1eef, Hi: 0x1eef, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ef1, Hi: 0x1ef1, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ef3, Hi: 0x1ef3, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ef5, Hi: 0x1ef5, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ef7, Hi: 0x1ef7, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ef9, Hi: 0x1ef9, Stride: 0x1},
+		unicode.Range16{Lo: 0x1efb, Hi: 0x1efb, Stride: 0x1},
+		unicode.Range16{Lo: 0x1efd, Hi: 0x1efd, Stride: 0x1},
+		unicode.Range16{Lo: 0x1eff, Hi: 0x1f07, Stride: 0x1},
+		unicode.Range16{Lo: 0x1f10, Hi: 0x1f15, Stride: 0x1},
+		unicode.Range16{Lo: 0x1f20, Hi: 0x1f27, Stride: 0x1},
+		unicode.Range16{Lo: 0x1f30, Hi: 0x1f37, Stride: 0x1},
+		unicode.Range16{Lo: 0x1f40, Hi: 0x1f45, Stride: 0x1},
+		unicode.Range16{Lo: 0x1f50, Hi: 0x1f57, Stride: 0x1},
+		unicode.Range16{Lo: 0x1f60, Hi: 0x1f67, Stride: 0x1},
+		unicode.Range16{Lo: 0x1f70, Hi: 0x1f7d, Stride: 0x1},
+		unicode.Range16{Lo: 0x1f80, Hi: 0x1f87, Stride: 0x1},
+		unicode.Range16{Lo: 0x1f90, Hi: 0x1f97, Stride: 0x1},
+		unicode.Range16{Lo: 0x1fa0, Hi: 0x1fa7, Stride: 0x1},
+		unicode.Range16{Lo: 0x1fb0, Hi: 0x1fb4, Stride: 0x1},
+		unicode.Range16{Lo: 0x1fb6, Hi: 0x1fb7, Stride: 0x1},
+		unicode.Range16{Lo: 0x1fbe, Hi: 0x1fbe, Stride: 0x1},
+		unicode.Range16{Lo: 0x1fc2, Hi: 0x1fc4, Stride: 0x1},
+		unicode.Range16{Lo: 0x1fc6, Hi: 0x1fc7, Stride: 0x1},
+		unicode.Range16{Lo: 0x1fd0, Hi: 0x1fd3, Stride: 0x1},
+		unicode.Range16{Lo: 0x1fd6, Hi: 0x1fd7, Stride: 0x1},
+		unicode.Range16{Lo: 0x1fe0, Hi: 0x1fe7, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ff2, Hi: 0x1ff4, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ff6, Hi: 0x1ff7, Stride: 0x1},
+		unicode.Range16{Lo: 0x2071, Hi: 0x2071, Stride: 0x1},
+		unicode.Range16{Lo: 0x207f, Hi: 0x207f, Stride: 0x1},
+		unicode.Range16{Lo: 0x2090, Hi: 0x209c, Stride: 0x1},
+		unicode.Range16{Lo: 0x210a, Hi: 0x210a, Stride: 0x1},
+		unicode.Range16{Lo: 0x210e, Hi: 0x210f, Stride: 0x1},
+		unicode.Range16{Lo: 0x2113, Hi: 0x2113, Stride: 0x1},
+		unicode.Range16{Lo: 0x212f, Hi: 0x212f, Stride: 0x1},
+		unicode.Range16{Lo: 0x2134, Hi: 0x2134, Stride: 0x1},
+		unicode.Range16{Lo: 0x2139, Hi: 0x2139, Stride: 0x1},
+		unicode.Range16{Lo: 0x213c, Hi: 0x213d, Stride: 0x1},
+		unicode.Range16{Lo: 0x2146, Hi: 0x2149, Stride: 0x1},
+		unicode.Range16{Lo: 0x214e, Hi: 0x214e, Stride: 0x1},
+		unicode.Range16{Lo: 0x2170, Hi: 0x217f, Stride: 0x1},
+		unicode.Range16{Lo: 0x2184, Hi: 0x2184, Stride: 0x1},
+		unicode.Range16{Lo: 0x24d0, Hi: 0x24e9, Stride: 0x1},
+		unicode.Range16{Lo: 0x2c30, Hi: 0x2c5f, Stride: 0x1},
+		unicode.Range16{Lo: 0x2c61, Hi: 0x2c61, Stride: 0x1},
+		unicode.Range16{Lo: 0x2c65, Hi: 0x2c66, Stride: 0x1},
+		unicode.Range16{Lo: 0x2c68, Hi: 0x2c68, Stride: 0x1},
+		unicode.Range16{Lo: 0x2c6a, Hi: 0x2c6a, Stride: 0x1},
+		unicode.Range16{Lo: 0x2c6c, Hi: 0x2c6c, Stride: 0x1},
+		unicode.Range16{Lo: 0x2c71, Hi: 0x2c71, Stride: 0x1},
+		unicode.Range16{Lo: 0x2c73, Hi: 0x2c74, Stride: 0x1},
+		unicode.Range16{Lo: 0x2c76, Hi: 0x2c7b, Stride: 0x1},
+		unicode.Range16{Lo: 0x2c7c, Hi: 0x2c7d, Stride: 0x1},
+		unicode.Range16{Lo: 0x2c81, Hi: 0x2c81, Stride: 0x1},
+		unicode.Range16{Lo: 0x2c83, Hi: 0x2c83, Stride: 0x1},
+		unicode.Range16{Lo: 0x2c85, Hi: 0x2c85, Stride: 0x1},
+		unicode.Range16{Lo: 0x2c87, Hi: 0x2c87, Stride: 0x1},
+		unicode.Range16{Lo: 0x2c89, Hi: 0x2c89, Stride: 0x1},
+		unicode.Range16{Lo: 0x2c8b, Hi: 0x2c8b, Stride: 0x1},
+		unicode.Range16{Lo: 0x2c8d, Hi: 0x2c8d, Stride: 0x1},
+		unicode.Range16{Lo: 0x2c8f, Hi: 0x2c8f, Stride: 0x1},
+		unicode.Range16{Lo: 0x2c91, Hi: 0x2c91, Stride: 0x1},
+		unicode.Range16{Lo: 0x2c93, Hi: 0x2c93, Stride: 0x1},
+		unicode.Range16{Lo: 0x2c95, Hi: 0x2c95, Stride: 0x1},
+		unicode.Range16{Lo: 0x2c97, Hi: 0x2c97, Stride: 0x1},
+		unicode.Range16{Lo: 0x2c99, Hi: 0x2c99, Stride: 0x1},
+		unicode.Range16{Lo: 0x2c9b, Hi: 0x2c9b, Stride: 0x1},
+		unicode.Range16{Lo: 0x2c9d, Hi: 0x2c9d, Stride: 0x1},
+		unicode.Range16{Lo: 0x2c9f, Hi: 0x2c9f, Stride: 0x1},
+		unicode.Range16{Lo: 0x2ca1, Hi: 0x2ca1, Stride: 0x1},
+		unicode.Range16{Lo: 0x2ca3, Hi: 0x2ca3, Stride: 0x1},
+		unicode.Range16{Lo: 0x2ca5, Hi: 0x2ca5, Stride: 0x1},
+		unicode.Range16{Lo: 0x2ca7, Hi: 0x2ca7, Stride: 0x1},
+		unicode.Range16{Lo: 0x2ca9, Hi: 0x2ca9, Stride: 0x1},
+		unicode.Range16{Lo: 0x2cab, Hi: 0x2cab, Stride: 0x1},
+		unicode.Range16{Lo: 0x2cad, Hi: 0x2cad, Stride: 0x1},
+		unicode.Range16{Lo: 0x2caf, Hi: 0x2caf, Stride: 0x1},
+		unicode.Range16{Lo: 0x2cb1, Hi: 0x2cb1, Stride: 0x1},
+		unicode.Range16{Lo: 0x2cb3, Hi: 0x2cb3, Stride: 0x1},
+		unicode.Range16{Lo: 0x2cb5, Hi: 0x2cb5, Stride: 0x1},
+		unicode.Range16{Lo: 0x2cb7, Hi: 0x2cb7, Stride: 0x1},
+		unicode.Range16{Lo: 0x2cb9, Hi: 0x2cb9, Stride: 0x1},
+		unicode.Range16{Lo: 0x2cbb, Hi: 0x2cbb, Stride: 0x1},
+		unicode.Range16{Lo: 0x2cbd, Hi: 0x2cbd, Stride: 0x1},
+		unicode.Range16{Lo: 0x2cbf, Hi: 0x2cbf, Stride: 0x1},
+		unicode.Range16{Lo: 0x2cc1, Hi: 0x2cc1, Stride: 0x1},
+		unicode.Range16{Lo: 0x2cc3, Hi: 0x2cc3, Stride: 0x1},
+		unicode.Range16{Lo: 0x2cc5, Hi: 0x2cc5, Stride: 0x1},
+		unicode.Range16{Lo: 0x2cc7, Hi: 0x2cc7, Stride: 0x1},
+		unicode.Range16{Lo: 0x2cc9, Hi: 0x2cc9, Stride: 0x1},
+		unicode.Range16{Lo: 0x2ccb, Hi: 0x2ccb, Stride: 0x1},
+		unicode.Range16{Lo: 0x2ccd, Hi: 0x2ccd, Stride: 0x1},
+		unicode.Range16{Lo: 0x2ccf, Hi: 0x2ccf, Stride: 0x1},
+		unicode.Range16{Lo: 0x2cd1, Hi: 0x2cd1, Stride: 0x1},
+		unicode.Range16{Lo: 0x2cd3, Hi: 0x2cd3, Stride: 0x1},
+		unicode.Range16{Lo: 0x2cd5, Hi: 0x2cd5, Stride: 0x1},
+		unicode.Range16{Lo: 0x2cd7, Hi: 0x2cd7, Stride: 0x1},
+		unicode.Range16{Lo: 0x2cd9, Hi: 0x2cd9, Stride: 0x1},
+		unicode.Range16{Lo: 0x2cdb, Hi: 0x2cdb, Stride: 0x1},
+		unicode.Range16{Lo: 0x2cdd, Hi: 0x2cdd, Stride: 0x1},
+		unicode.Range16{Lo: 0x2cdf, Hi: 0x2cdf, Stride: 0x1},
+		unicode.Range16{Lo: 0x2ce1, Hi: 0x2ce1, Stride: 0x1},
+		unicode.Range16{Lo: 0x2ce3, Hi: 0x2ce4, Stride: 0x1},
+		unicode.Range16{Lo: 0x2cec, Hi: 0x2cec, Stride: 0x1},
+		unicode.Range16{Lo: 0x2cee, Hi: 0x2cee, Stride: 0x1},
+		unicode.Range16{Lo: 0x2cf3, Hi: 0x2cf3, Stride: 0x1},
+		unicode.Range16{Lo: 0x2d00, Hi: 0x2d25, Stride: 0x1},
+		unicode.Range16{Lo: 0x2d27, Hi: 0x2d27, Stride: 0x1},
+		unicode.Range16{Lo: 0x2d2d, Hi: 0x2d2d, Stride: 0x1},
+		unicode.Range16{Lo: 0xa641, Hi: 0xa641, Stride: 0x1},
+		unicode.Range16{Lo: 0xa643, Hi: 0xa643, Stride: 0x1},
+		unicode.Range16{Lo: 0xa645, Hi: 0xa645, Stride: 0x1},
+		unicode.Range16{Lo: 0xa647, Hi: 0xa647, Stride: 0x1},
+		unicode.Range16{Lo: 0xa649, Hi: 0xa649, Stride: 0x1},
+		unicode.Range16{Lo: 0xa64b, Hi: 0xa64b, Stride: 0x1},
+		unicode.Range16{Lo: 0xa64d, Hi: 0xa64d, Stride: 0x1},
+		unicode.Range16{Lo: 0xa64f, Hi: 0xa64f, Stride: 0x1},
+		unicode.Range16{Lo: 0xa651, Hi: 0xa651, Stride: 0x1},
+		unicode.Range16{Lo: 0xa653, Hi: 0xa653, Stride: 0x1},
+		unicode.Range16{Lo: 0xa655, Hi: 0xa655, Stride: 0x1},
+		unicode.Range16{Lo: 0xa657, Hi: 0xa657, Stride: 0x1},
+		unicode.Range16{Lo: 0xa659, Hi: 0xa659, Stride: 0x1},
+		unicode.Range16{Lo: 0xa65b, Hi: 0xa65b, Stride: 0x1},
+		unicode.Range16{Lo: 0xa65d, Hi: 0xa65d, Stride: 0x1},
+		unicode.Range16{Lo: 0xa65f, Hi: 0xa65f, Stride: 0x1},
+		unicode.Range16{Lo: 0xa661, Hi: 0xa661, Stride: 0x1},
+		unicode.Range16{Lo: 0xa663, Hi: 0xa663, Stride: 0x1},
+		unicode.Range16{Lo: 0xa665, Hi: 0xa665, Stride: 0x1},
+		unicode.Range16{Lo: 0xa667, Hi: 0xa667, Stride: 0x1},
+		unicode.Range16{Lo: 0xa669, Hi: 0xa669, Stride: 0x1},
+		unicode.Range16{Lo: 0xa66b, Hi: 0xa66b, Stride: 0x1},
+		unicode.Range16{Lo: 0xa66d, Hi: 0xa66d, Stride: 0x1},
+		unicode.Range16{Lo: 0xa681, Hi: 0xa681, Stride: 0x1},
+		unicode.Range16{Lo: 0xa683, Hi: 0xa683, Stride: 0x1},
+		unicode.Range16{Lo: 0xa685, Hi: 0xa685, Stride: 0x1},
+		unicode.Range16{Lo: 0xa687, Hi: 0xa687, Stride: 0x1},
+		unicode.Range16{Lo: 0xa689, Hi: 0xa689, Stride: 0x1},
+		unicode.Range16{Lo: 0xa68b, Hi: 0xa68b, Stride: 0x1},
+		unicode.Range16{Lo: 0xa68d, Hi: 0xa68d, Stride: 0x1},
+		unicode.Range16{Lo: 0xa68f, Hi: 0xa68f, Stride: 0x1},
+		unicode.Range16{Lo: 0xa691, Hi: 0xa691, Stride: 0x1},
+		unicode.Range16{Lo: 0xa693, Hi: 0xa693, Stride: 0x1},
+		unicode.Range16{Lo: 0xa695, Hi: 0xa695, Stride: 0x1},
+		unicode.Range16{Lo: 0xa697, Hi: 0xa697, Stride: 0x1},
+		unicode.Range16{Lo: 0xa699, Hi: 0xa699, Stride: 0x1},
+		unicode.Range16{Lo: 0xa69b, Hi: 0xa69b, Stride: 0x1},
+		unicode.Range16{Lo: 0xa69c, Hi: 0xa69d, Stride: 0x1},
+		unicode.Range16{Lo: 0xa723, Hi: 0xa723, Stride: 0x1},
+		unicode.Range16{Lo: 0xa725, Hi: 0xa725, Stride: 0x1},
+		unicode.Range16{Lo: 0xa727, Hi: 0xa727, Stride: 0x1},
+		unicode.Range16{Lo: 0xa729, Hi: 0xa729, Stride: 0x1},
+		unicode.Range16{Lo: 0xa72b, Hi: 0xa72b, Stride: 0x1},
+		unicode.Range16{Lo: 0xa72d, Hi: 0xa72d, Stride: 0x1},
+		unicode.Range16{Lo: 0xa72f, Hi: 0xa731, Stride: 0x1},
+		unicode.Range16{Lo: 0xa733, Hi: 0xa733, Stride: 0x1},
+		unicode.Range16{Lo: 0xa735, Hi: 0xa735, Stride: 0x1},
+		unicode.Range16{Lo: 0xa737, Hi: 0xa737, Stride: 0x1},
+		unicode.Range16{Lo: 0xa739, Hi: 0xa739, Stride: 0x1},
+		unicode.Range16{Lo: 0xa73b, Hi: 0xa73b, Stride: 0x1},
+		unicode.Range16{Lo: 0xa73d, Hi: 0xa73d, Stride: 0x1},
+		unicode.Range16{Lo: 0xa73f, Hi: 0xa73f, Stride: 0x1},
+		unicode.Range16{Lo: 0xa741, Hi: 0xa741, Stride: 0x1},
+		unicode.Range16{Lo: 0xa743, Hi: 0xa743, Stride: 0x1},
+		unicode.Range16{Lo: 0xa745, Hi: 0xa745, Stride: 0x1},
+		unicode.Range16{Lo: 0xa747, Hi: 0xa747, Stride: 0x1},
+		unicode.Range16{Lo: 0xa749, Hi: 0xa749, Stride: 0x1},
+		unicode.Range16{Lo: 0xa74b, Hi: 0xa74b, Stride: 0x1},
+		unicode.Range16{Lo: 0xa74d, Hi: 0xa74d, Stride: 0x1},
+		unicode.Range16{Lo: 0xa74f, Hi: 0xa74f, Stride: 0x1},
+		unicode.Range16{Lo: 0xa751, Hi: 0xa751, Stride: 0x1},
+		unicode.Range16{Lo: 0xa753, Hi: 0xa753, Stride: 0x1},
+		unicode.Range16{Lo: 0xa755, Hi: 0xa755, Stride: 0x1},
+		unicode.Range16{Lo: 0xa757, Hi: 0xa757, Stride: 0x1},
+		unicode.Range16{Lo: 0xa759, Hi: 0xa759, Stride: 0x1},
+		unicode.Range16{Lo: 0xa75b, Hi: 0xa75b, Stride: 0x1},
+		unicode.Range16{Lo: 0xa75d, Hi: 0xa75d, Stride: 0x1},
+		unicode.Range16{Lo: 0xa75f, Hi: 0xa75f, Stride: 0x1},
+		unicode.Range16{Lo: 0xa761, Hi: 0xa761, Stride: 0x1},
+		unicode.Range16{Lo: 0xa763, Hi: 0xa763, Stride: 0x1},
+		unicode.Range16{Lo: 0xa765, Hi: 0xa765, Stride: 0x1},
+		unicode.Range16{Lo: 0xa767, Hi: 0xa767, Stride: 0x1},
+		unicode.Range16{Lo: 0xa769, Hi: 0xa769, Stride: 0x1},
+		unicode.Range16{Lo: 0xa76b, Hi: 0xa76b, Stride: 0x1},
+		unicode.Range16{Lo: 0xa76d, Hi: 0xa76d, Stride: 0x1},
+		unicode.Range16{Lo: 0xa76f, Hi: 0xa76f, Stride: 0x1},
+		unicode.Range16{Lo: 0xa770, Hi: 0xa770, Stride: 0x1},
+		unicode.Range16{Lo: 0xa771, Hi: 0xa778, Stride: 0x1},
+		unicode.Range16{Lo: 0xa77a, Hi: 0xa77a, Stride: 0x1},
+		unicode.Range16{Lo: 0xa77c, Hi: 0xa77c, Stride: 0x1},
+		unicode.Range16{Lo: 0xa77f, Hi: 0xa77f, Stride: 0x1},
+		unicode.Range16{Lo: 0xa781, Hi: 0xa781, Stride: 0x1},
+		unicode.Range16{Lo: 0xa783, Hi: 0xa783, Stride: 0x1},
+		unicode.Range16{Lo: 0xa785, Hi: 0xa785, Stride: 0x1},
+		unicode.Range16{Lo: 0xa787, Hi: 0xa787, Stride: 0x1},
+		unicode.Range16{Lo: 0xa78c, Hi: 0xa78c, Stride: 0x1},
+		unicode.Range16{Lo: 0xa78e, Hi: 0xa78e, Stride: 0x1},
+		unicode.Range16{Lo: 0xa791, Hi: 0xa791, Stride: 0x1},
+		unicode.Range16{Lo: 0xa793, Hi: 0xa795, Stride: 0x1},
+		unicode.Range16{Lo: 0xa797, Hi: 0xa797, Stride: 0x1},
+		unicode.Range16{Lo: 0xa799, Hi: 0xa799, Stride: 0x1},
+		unicode.Range16{Lo: 0xa79b, Hi: 0xa79b, Stride: 0x1},
+		unicode.Range16{Lo: 0xa79d, Hi: 0xa79d, Stride: 0x1},
+		unicode.Range16{Lo: 0xa79f, Hi: 0xa79f, Stride: 0x1},
+		unicode.Range16{Lo: 0xa7a1, Hi: 0xa7a1, Stride: 0x1},
+		unicode.Range16{Lo: 0xa7a3, Hi: 0xa7a3, Stride: 0x1},
+		unicode.Range16{Lo: 0xa7a5, Hi: 0xa7a5, Stride: 0x1},
+		unicode.Range16{Lo: 0xa7a7, Hi: 0xa7a7, Stride: 0x1},
+		unicode.Range16{Lo: 0xa7a9, Hi: 0xa7a9, Stride: 0x1},
+		unicode.Range16{Lo: 0xa7af, Hi: 0xa7af, Stride: 0x1},
+		unicode.Range16{Lo: 0xa7b5, Hi: 0xa7b5, Stride: 0x1},
+		unicode.Range16{Lo: 0xa7b7, Hi: 0xa7b7, Stride: 0x1},
+		unicode.Range16{Lo: 0xa7b9, Hi: 0xa7b9, Stride: 0x1},
+		unicode.Range16{Lo: 0xa7bb, Hi: 0xa7bb, Stride: 0x1},
+		unicode.Range16{Lo: 0xa7bd, Hi: 0xa7bd, Stride: 0x1},
+		unicode.Range16{Lo: 0xa7bf, Hi: 0xa7bf, Stride: 0x1},
+		unicode.Range16{Lo: 0xa7c1, Hi: 0xa7c1, Stride: 0x1},
+		unicode.Range16{Lo: 0xa7c3, Hi: 0xa7c3, Stride: 0x1},
+		unicode.Range16{Lo: 0xa7c8, Hi: 0xa7c8, Stride: 0x1},
+		unicode.Range16{Lo: 0xa7ca, Hi: 0xa7ca, Stride: 0x1},
+		unicode.Range16{Lo: 0xa7d1, Hi: 0xa7d1, Stride: 0x1},
+		unicode.Range16{Lo: 0xa7d3, Hi: 0xa7d3, Stride: 0x1},
+		unicode.Range16{Lo: 0xa7d5, Hi: 0xa7d5, Stride: 0x1},
+		unicode.Range16{Lo: 0xa7d7, Hi: 0xa7d7, Stride: 0x1},
+		unicode.Range16{Lo: 0xa7d9, Hi: 0xa7d9, Stride: 0x1},
+		unicode.Range16{Lo: 0xa7f2, Hi: 0xa7f4, Stride: 0x1},
+		unicode.Range16{Lo: 0xa7f6, Hi: 0xa7f6, Stride: 0x1},
+		unicode.Range16{Lo: 0xa7f8, Hi: 0xa7f9, Stride: 0x1},
+		unicode.Range16{Lo: 0xa7fa, Hi: 0xa7fa, Stride: 0x1},
+		unicode.Range16{Lo: 0xab30, Hi: 0xab5a, Stride: 0x1},
+		unicode.Range16{Lo: 0xab5c, Hi: 0xab5f, Stride: 0x1},
+		unicode.Range16{Lo: 0xab60, Hi: 0xab68, Stride: 0x1},
+		unicode.Range16{Lo: 0xab69, Hi: 0xab69, Stride: 0x1},
+		unicode.Range16{Lo: 0xab70, Hi: 0xabbf, Stride: 0x1},
+		unicode.Range16{Lo: 0xfb00, Hi: 0xfb06, Stride: 0x1},
+		unicode.Range16{Lo: 0xfb13, Hi: 0xfb17, Stride: 0x1},
+		unicode.Range16{Lo: 0xff41, Hi: 0xff5a, Stride: 0x1},
+	},
+	R32: []unicode.Range32{
+		unicode.Range32{Lo: 0x10428, Hi: 0x1044f, Stride: 0x1},
+		unicode.Range32{Lo: 0x104d8, Hi: 0x104fb, Stride: 0x1},
+		unicode.Range32{Lo: 0x10597, Hi: 0x105a1, Stride: 0x1},
+		unicode.Range32{Lo: 0x105a3, Hi: 0x105b1, Stride: 0x1},
+		unicode.Range32{Lo: 0x105b3, Hi: 0x105b9, Stride: 0x1},
+		unicode.Range32{Lo: 0x105bb, Hi: 0x105bc, Stride: 0x1},
+		unicode.Range32{Lo: 0x10780, Hi: 0x10780, Stride: 0x1},
+		unicode.Range32{Lo: 0x10783, Hi: 0x10785, Stride: 0x1},
+		unicode.Range32{Lo: 0x10787, Hi: 0x107b0, Stride: 0x1},
+		unicode.Range32{Lo: 0x107b2, Hi: 0x107ba, Stride: 0x1},
+		unicode.Range32{Lo: 0x10cc0, Hi: 0x10cf2, Stride: 0x1},
+		unicode.Range32{Lo: 0x118c0, Hi: 0x118df, Stride: 0x1},
+		unicode.Range32{Lo: 0x16e60, Hi: 0x16e7f, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d41a, Hi: 0x1d433, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d44e, Hi: 0x1d454, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d456, Hi: 0x1d467, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d482, Hi: 0x1d49b, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d4b6, Hi: 0x1d4b9, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d4bb, Hi: 0x1d4bb, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d4bd, Hi: 0x1d4c3, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d4c5, Hi: 0x1d4cf, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d4ea, Hi: 0x1d503, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d51e, Hi: 0x1d537, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d552, Hi: 0x1d56b, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d586, Hi: 0x1d59f, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d5ba, Hi: 0x1d5d3, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d5ee, Hi: 0x1d607, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d622, Hi: 0x1d63b, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d656, Hi: 0x1d66f, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d68a, Hi: 0x1d6a5, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d6c2, Hi: 0x1d6da, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d6dc, Hi: 0x1d6e1, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d6fc, Hi: 0x1d714, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d716, Hi: 0x1d71b, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d736, Hi: 0x1d74e, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d750, Hi: 0x1d755, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d770, Hi: 0x1d788, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d78a, Hi: 0x1d78f, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d7aa, Hi: 0x1d7c2, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d7c4, Hi: 0x1d7c9, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d7cb, Hi: 0x1d7cb, Stride: 0x1},
+		unicode.Range32{Lo: 0x1df00, Hi: 0x1df09, Stride: 0x1},
+		unicode.Range32{Lo: 0x1df0b, Hi: 0x1df1e, Stride: 0x1},
+		unicode.Range32{Lo: 0x1df25, Hi: 0x1df2a, Stride: 0x1},
+		unicode.Range32{Lo: 0x1e030, Hi: 0x1e06d, Stride: 0x1},
+		unicode.Range32{Lo: 0x1e922, Hi: 0x1e943, Stride: 0x1},
+	},
+	LatinOffset: 6,
+}
+
+var _SentenceNumeric = &unicode.RangeTable{
+	R16: []unicode.Range16{
+		unicode.Range16{Lo: 0x30, Hi: 0x39, Stride: 0x1},
+		unicode.Range16{Lo: 0x660, Hi: 0x669, Stride: 0x1},
+		unicode.Range16{Lo: 0x66b, Hi: 0x66c, Stride: 0x1},
+		unicode.Range16{Lo: 0x6f0, Hi: 0x6f9, Stride: 0x1},
+		unicode.Range16{Lo: 0x7c0, Hi: 0x7c9, Stride: 0x1},
+		unicode.Range16{Lo: 0x966, Hi: 0x96f, Stride: 0x1},
+		unicode.Range16{Lo: 0x9e6, Hi: 0x9ef, Stride: 0x1},
+		unicode.Range16{Lo: 0xa66, Hi: 0xa6f, Stride: 0x1},
+		unicode.Range16{Lo: 0xae6, Hi: 0xaef, Stride: 0x1},
+		unicode.Range16{Lo: 0xb66, Hi: 0xb6f, Stride: 0x1},
+		unicode.Range16{Lo: 0xbe6, Hi: 0xbef, Stride: 0x1},
+		unicode.Range16{Lo: 0xc66, Hi: 0xc6f, Stride: 0x1},
+		unicode.Range16{Lo: 0xce6, Hi: 0xcef, Stride: 0x1},
+		unicode.Range16{Lo: 0xd66, Hi: 0xd6f, Stride: 0x1},
+		unicode.Range16{Lo: 0xde6, Hi: 0xdef, Stride: 0x1},
+		unicode.Range16{Lo: 0xe50, Hi: 0xe59, Stride: 0x1},
+		unicode.Range16{Lo: 0xed0, Hi: 0xed9, Stride: 0x1},
+		unicode.Range16{Lo: 0xf20, Hi: 0xf29, Stride: 0x1},
+		unicode.Range16{Lo: 0x1040, Hi: 0x1049, Stride: 0x1},
+		unicode.Range16{Lo: 0x1090, Hi: 0x1099, Stride: 0x1},
+		unicode.Range16{Lo: 0x17e0, Hi: 0x17e9, Stride: 0x1},
+		unicode.Range16{Lo: 0x1810, Hi: 0x1819, Stride: 0x1},
+		unicode.Range16{Lo: 0x1946, Hi: 0x194f, Stride: 0x1},
+		unicode.Range16{Lo: 0x19d0, Hi: 0x19d9, Stride: 0x1},
+		unicode.Range16{Lo: 0x1a80, Hi: 0x1a89, Stride: 0x1},
+		unicode.Range16{Lo: 0x1a90, Hi: 0x1a99, Stride: 0x1},
+		unicode.Range16{Lo: 0x1b50, Hi: 0x1b59, Stride: 0x1},
+		unicode.Range16{Lo: 0x1bb0, Hi: 0x1bb9, Stride: 0x1},
+		unicode.Range16{Lo: 0x1c40, Hi: 0x1c49, Stride: 0x1},
+		unicode.Range16{Lo: 0x1c50, Hi: 0x1c59, Stride: 0x1},
+		unicode.Range16{Lo: 0xa620, Hi: 0xa629, Stride: 0x1},
+		unicode.Range16{Lo: 0xa8d0, Hi: 0xa8d9, Stride: 0x1},
+		unicode.Range16{Lo: 0xa900, Hi: 0xa909, Stride: 0x1},
+		unicode.Range16{Lo: 0xa9d0, Hi: 0xa9d9, Stride: 0x1},
+		unicode.Range16{Lo: 0xa9f0, Hi: 0xa9f9, Stride: 0x1},
+		unicode.Range16{Lo: 0xaa50, Hi: 0xaa59, Stride: 0x1},
+		unicode.Range16{Lo: 0xabf0, Hi: 0xabf9, Stride: 0x1},
+		unicode.Range16{Lo: 0xff10, Hi: 0xff19, Stride: 0x1},
+	},
+	R32: []unicode.Range32{
+		unicode.Range32{Lo: 0x104a0, Hi: 0x104a9, Stride: 0x1},
+		unicode.Range32{Lo: 0x10d30, Hi: 0x10d39, Stride: 0x1},
+		unicode.Range32{Lo: 0x11066, Hi: 0x1106f, Stride: 0x1},
+		unicode.Range32{Lo: 0x110f0, Hi: 0x110f9, Stride: 0x1},
+		unicode.Range32{Lo: 0x11136, Hi: 0x1113f, Stride: 0x1},
+		unicode.Range32{Lo: 0x111d0, Hi: 0x111d9, Stride: 0x1},
+		unicode.Range32{Lo: 0x112f0, Hi: 0x112f9, Stride: 0x1},
+		unicode.Range32{Lo: 0x11450, Hi: 0x11459, Stride: 0x1},
+		unicode.Range32{Lo: 0x114d0, Hi: 0x114d9, Stride: 0x1},
+		unicode.Range32{Lo: 0x11650, Hi: 0x11659, Stride: 0x1},
+		unicode.Range32{Lo: 0x116c0, Hi: 0x116c9, Stride: 0x1},
+		unicode.Range32{Lo: 0x11730, Hi: 0x11739, Stride: 0x1},
+		unicode.Range32{Lo: 0x118e0, Hi: 0x118e9, Stride: 0x1},
+		unicode.Range32{Lo: 0x11950, Hi: 0x11959, Stride: 0x1},
+		unicode.Range32{Lo: 0x11c50, Hi: 0x11c59, Stride: 0x1},
+		unicode.Range32{Lo: 0x11d50, Hi: 0x11d59, Stride: 0x1},
+		unicode.Range32{Lo: 0x11da0, Hi: 0x11da9, Stride: 0x1},
+		unicode.Range32{Lo: 0x11f50, Hi: 0x11f59, Stride: 0x1},
+		unicode.Range32{Lo: 0x16a60, Hi: 0x16a69, Stride: 0x1},
+		unicode.Range32{Lo: 0x16ac0, Hi: 0x16ac9, Stride: 0x1},
+		unicode.Range32{Lo: 0x16b50, Hi: 0x16b59, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d7ce, Hi: 0x1d7ff, Stride: 0x1},
+		unicode.Range32{Lo: 0x1e140, Hi: 0x1e149, Stride: 0x1},
+		unicode.Range32{Lo: 0x1e2f0, Hi: 0x1e2f9, Stride: 0x1},
+		unicode.Range32{Lo: 0x1e4f0, Hi: 0x1e4f9, Stride: 0x1},
+		unicode.Range32{Lo: 0x1e950, Hi: 0x1e959, Stride: 0x1},
+		unicode.Range32{Lo: 0x1fbf0, Hi: 0x1fbf9, Stride: 0x1},
+	},
+	LatinOffset: 1,
+}
+
+var _SentenceOLetter = &unicode.RangeTable{
+	R16: []unicode.Range16{
+		unicode.Range16{Lo: 0x1bb, Hi: 0x1bb, Stride: 0x1},
+		unicode.Range16{Lo: 0x1c0, Hi: 0x1c3, Stride: 0x1},
+		unicode.Range16{Lo: 0x294, Hi: 0x294, Stride: 0x1},
+		unicode.Range16{Lo: 0x2b9, Hi: 0x2bf, Stride: 0x1},
+		unicode.Range16{Lo: 0x2c6, Hi: 0x2d1, Stride: 0x1},
+		unicode.Range16{Lo: 0x2ec, Hi: 0x2ec, Stride: 0x1},
+		unicode.Range16{Lo: 0x2ee, Hi: 0x2ee, Stride: 0x1},
+		unicode.Range16{Lo: 0x374, Hi: 0x374, Stride: 0x1},
+		unicode.Range16{Lo: 0x559, Hi: 0x559, Stride: 0x1},
+		unicode.Range16{Lo: 0x5d0, Hi: 0x5ea, Stride: 0x1},
+		unicode.Range16{Lo: 0x5ef, Hi: 0x5f2, Stride: 0x1},
+		unicode.Range16{Lo: 0x5f3, Hi: 0x5f3, Stride: 0x1},
+		unicode.Range16{Lo: 0x620, Hi: 0x63f, Stride: 0x1},
+		unicode.Range16{Lo: 0x640, Hi: 0x640, Stride: 0x1},
+		unicode.Range16{Lo: 0x641, Hi: 0x64a, Stride: 0x1},
+		unicode.Range16{Lo: 0x66e, Hi: 0x66f, Stride: 0x1},
+		unicode.Range16{Lo: 0x671, Hi: 0x6d3, Stride: 0x1},
+		unicode.Range16{Lo: 0x6d5, Hi: 0x6d5, Stride: 0x1},
+		unicode.Range16{Lo: 0x6e5, Hi: 0x6e6, Stride: 0x1},
+		unicode.Range16{Lo: 0x6ee, Hi: 0x6ef, Stride: 0x1},
+		unicode.Range16{Lo: 0x6fa, Hi: 0x6fc, Stride: 0x1},
+		unicode.Range16{Lo: 0x6ff, Hi: 0x6ff, Stride: 0x1},
+		unicode.Range16{Lo: 0x710, Hi: 0x710, Stride: 0x1},
+		unicode.Range16{Lo: 0x712, Hi: 0x72f, Stride: 0x1},
+		unicode.Range16{Lo: 0x74d, Hi: 0x7a5, Stride: 0x1},
+		unicode.Range16{Lo: 0x7b1, Hi: 0x7b1, Stride: 0x1},
+		unicode.Range16{Lo: 0x7ca, Hi: 0x7ea, Stride: 0x1},
+		unicode.Range16{Lo: 0x7f4, Hi: 0x7f5, Stride: 0x1},
+		unicode.Range16{Lo: 0x7fa, Hi: 0x7fa, Stride: 0x1},
+		unicode.Range16{Lo: 0x800, Hi: 0x815, Stride: 0x1},
+		unicode.Range16{Lo: 0x81a, Hi: 0x81a, Stride: 0x1},
+		unicode.Range16{Lo: 0x824, Hi: 0x824, Stride: 0x1},
+		unicode.Range16{Lo: 0x828, Hi: 0x828, Stride: 0x1},
+		unicode.Range16{Lo: 0x840, Hi: 0x858, Stride: 0x1},
+		unicode.Range16{Lo: 0x860, Hi: 0x86a, Stride: 0x1},
+		unicode.Range16{Lo: 0x870, Hi: 0x887, Stride: 0x1},
+		unicode.Range16{Lo: 0x889, Hi: 0x88e, Stride: 0x1},
+		unicode.Range16{Lo: 0x8a0, Hi: 0x8c8, Stride: 0x1},
+		unicode.Range16{Lo: 0x8c9, Hi: 0x8c9, Stride: 0x1},
+		unicode.Range16{Lo: 0x904, Hi: 0x939, Stride: 0x1},
+		unicode.Range16{Lo: 0x93d, Hi: 0x93d, Stride: 0x1},
+		unicode.Range16{Lo: 0x950, Hi: 0x950, Stride: 0x1},
+		unicode.Range16{Lo: 0x958, Hi: 0x961, Stride: 0x1},
+		unicode.Range16{Lo: 0x971, Hi: 0x971, Stride: 0x1},
+		unicode.Range16{Lo: 0x972, Hi: 0x980, Stride: 0x1},
+		unicode.Range16{Lo: 0x985, Hi: 0x98c, Stride: 0x1},
+		unicode.Range16{Lo: 0x98f, Hi: 0x990, Stride: 0x1},
+		unicode.Range16{Lo: 0x993, Hi: 0x9a8, Stride: 0x1},
+		unicode.Range16{Lo: 0x9aa, Hi: 0x9b0, Stride: 0x1},
+		unicode.Range16{Lo: 0x9b2, Hi: 0x9b2, Stride: 0x1},
+		unicode.Range16{Lo: 0x9b6, Hi: 0x9b9, Stride: 0x1},
+		unicode.Range16{Lo: 0x9bd, Hi: 0x9bd, Stride: 0x1},
+		unicode.Range16{Lo: 0x9ce, Hi: 0x9ce, Stride: 0x1},
+		unicode.Range16{Lo: 0x9dc, Hi: 0x9dd, Stride: 0x1},
+		unicode.Range16{Lo: 0x9df, Hi: 0x9e1, Stride: 0x1},
+		unicode.Range16{Lo: 0x9f0, Hi: 0x9f1, Stride: 0x1},
+		unicode.Range16{Lo: 0x9fc, Hi: 0x9fc, Stride: 0x1},
+		unicode.Range16{Lo: 0xa05, Hi: 0xa0a, Stride: 0x1},
+		unicode.Range16{Lo: 0xa0f, Hi: 0xa10, Stride: 0x1},
+		unicode.Range16{Lo: 0xa13, Hi: 0xa28, Stride: 0x1},
+		unicode.Range16{Lo: 0xa2a, Hi: 0xa30, Stride: 0x1},
+		unicode.Range16{Lo: 0xa32, Hi: 0xa33, Stride: 0x1},
+		unicode.Range16{Lo: 0xa35, Hi: 0xa36, Stride: 0x1},
+		unicode.Range16{Lo: 0xa38, Hi: 0xa39, Stride: 0x1},
+		unicode.Range16{Lo: 0xa59, Hi: 0xa5c, Stride: 0x1},
+		unicode.Range16{Lo: 0xa5e, Hi: 0xa5e, Stride: 0x1},
+		unicode.Range16{Lo: 0xa72, Hi: 0xa74, Stride: 0x1},
+		unicode.Range16{Lo: 0xa85, Hi: 0xa8d, Stride: 0x1},
+		unicode.Range16{Lo: 0xa8f, Hi: 0xa91, Stride: 0x1},
+		unicode.Range16{Lo: 0xa93, Hi: 0xaa8, Stride: 0x1},
+		unicode.Range16{Lo: 0xaaa, Hi: 0xab0, Stride: 0x1},
+		unicode.Range16{Lo: 0xab2, Hi: 0xab3, Stride: 0x1},
+		unicode.Range16{Lo: 0xab5, Hi: 0xab9, Stride: 0x1},
+		unicode.Range16{Lo: 0xabd, Hi: 0xabd, Stride: 0x1},
+		unicode.Range16{Lo: 0xad0, Hi: 0xad0, Stride: 0x1},
+		unicode.Range16{Lo: 0xae0, Hi: 0xae1, Stride: 0x1},
+		unicode.Range16{Lo: 0xaf9, Hi: 0xaf9, Stride: 0x1},
+		unicode.Range16{Lo: 0xb05, Hi: 0xb0c, Stride: 0x1},
+		unicode.Range16{Lo: 0xb0f, Hi: 0xb10, Stride: 0x1},
+		unicode.Range16{Lo: 0xb13, Hi: 0xb28, Stride: 0x1},
+		unicode.Range16{Lo: 0xb2a, Hi: 0xb30, Stride: 0x1},
+		unicode.Range16{Lo: 0xb32, Hi: 0xb33, Stride: 0x1},
+		unicode.Range16{Lo: 0xb35, Hi: 0xb39, Stride: 0x1},
+		unicode.Range16{Lo: 0xb3d, Hi: 0xb3d, Stride: 0x1},
+		unicode.Range16{Lo: 0xb5c, Hi: 0xb5d, Stride: 0x1},
+		unicode.Range16{Lo: 0xb5f, Hi: 0xb61, Stride: 0x1},
+		unicode.Range16{Lo: 0xb71, Hi: 0xb71, Stride: 0x1},
+		unicode.Range16{Lo: 0xb83, Hi: 0xb83, Stride: 0x1},
+		unicode.Range16{Lo: 0xb85, Hi: 0xb8a, Stride: 0x1},
+		unicode.Range16{Lo: 0xb8e, Hi: 0xb90, Stride: 0x1},
+		unicode.Range16{Lo: 0xb92, Hi: 0xb95, Stride: 0x1},
+		unicode.Range16{Lo: 0xb99, Hi: 0xb9a, Stride: 0x1},
+		unicode.Range16{Lo: 0xb9c, Hi: 0xb9c, Stride: 0x1},
+		unicode.Range16{Lo: 0xb9e, Hi: 0xb9f, Stride: 0x1},
+		unicode.Range16{Lo: 0xba3, Hi: 0xba4, Stride: 0x1},
+		unicode.Range16{Lo: 0xba8, Hi: 0xbaa, Stride: 0x1},
+		unicode.Range16{Lo: 0xbae, Hi: 0xbb9, Stride: 0x1},
+		unicode.Range16{Lo: 0xbd0, Hi: 0xbd0, Stride: 0x1},
+		unicode.Range16{Lo: 0xc05, Hi: 0xc0c, Stride: 0x1},
+		unicode.Range16{Lo: 0xc0e, Hi: 0xc10, Stride: 0x1},
+		unicode.Range16{Lo: 0xc12, Hi: 0xc28, Stride: 0x1},
+		unicode.Range16{Lo: 0xc2a, Hi: 0xc39, Stride: 0x1},
+		unicode.Range16{Lo: 0xc3d, Hi: 0xc3d, Stride: 0x1},
+		unicode.Range16{Lo: 0xc58, Hi: 0xc5a, Stride: 0x1},
+		unicode.Range16{Lo: 0xc5d, Hi: 0xc5d, Stride: 0x1},
+		unicode.Range16{Lo: 0xc60, Hi: 0xc61, Stride: 0x1},
+		unicode.Range16{Lo: 0xc80, Hi: 0xc80, Stride: 0x1},
+		unicode.Range16{Lo: 0xc85, Hi: 0xc8c, Stride: 0x1},
+		unicode.Range16{Lo: 0xc8e, Hi: 0xc90, Stride: 0x1},
+		unicode.Range16{Lo: 0xc92, Hi: 0xca8, Stride: 0x1},
+		unicode.Range16{Lo: 0xcaa, Hi: 0xcb3, Stride: 0x1},
+		unicode.Range16{Lo: 0xcb5, Hi: 0xcb9, Stride: 0x1},
+		unicode.Range16{Lo: 0xcbd, Hi: 0xcbd, Stride: 0x1},
+		unicode.Range16{Lo: 0xcdd, Hi: 0xcde, Stride: 0x1},
+		unicode.Range16{Lo: 0xce0, Hi: 0xce1, Stride: 0x1},
+		unicode.Range16{Lo: 0xcf1, Hi: 0xcf2, Stride: 0x1},
+		unicode.Range16{Lo: 0xd04, Hi: 0xd0c, Stride: 0x1},
+		unicode.Range16{Lo: 0xd0e, Hi: 0xd10, Stride: 0x1},
+		unicode.Range16{Lo: 0xd12, Hi: 0xd3a, Stride: 0x1},
+		unicode.Range16{Lo: 0xd3d, Hi: 0xd3d, Stride: 0x1},
+		unicode.Range16{Lo: 0xd4e, Hi: 0xd4e, Stride: 0x1},
+		unicode.Range16{Lo: 0xd54, Hi: 0xd56, Stride: 0x1},
+		unicode.Range16{Lo: 0xd5f, Hi: 0xd61, Stride: 0x1},
+		unicode.Range16{Lo: 0xd7a, Hi: 0xd7f, Stride: 0x1},
+		unicode.Range16{Lo: 0xd85, Hi: 0xd96, Stride: 0x1},
+		unicode.Range16{Lo: 0xd9a, Hi: 0xdb1, Stride: 0x1},
+		unicode.Range16{Lo: 0xdb3, Hi: 0xdbb, Stride: 0x1},
+		unicode.Range16{Lo: 0xdbd, Hi: 0xdbd, Stride: 0x1},
+		unicode.Range16{Lo: 0xdc0, Hi: 0xdc6, Stride: 0x1},
+		unicode.Range16{Lo: 0xe01, Hi: 0xe30, Stride: 0x1},
+		unicode.Range16{Lo: 0xe32, Hi: 0xe33, Stride: 0x1},
+		unicode.Range16{Lo: 0xe40, Hi: 0xe45, Stride: 0x1},
+		unicode.Range16{Lo: 0xe46, Hi: 0xe46, Stride: 0x1},
+		unicode.Range16{Lo: 0xe81, Hi: 0xe82, Stride: 0x1},
+		unicode.Range16{Lo: 0xe84, Hi: 0xe84, Stride: 0x1},
+		unicode.Range16{Lo: 0xe86, Hi: 0xe8a, Stride: 0x1},
+		unicode.Range16{Lo: 0xe8c, Hi: 0xea3, Stride: 0x1},
+		unicode.Range16{Lo: 0xea5, Hi: 0xea5, Stride: 0x1},
+		unicode.Range16{Lo: 0xea7, Hi: 0xeb0, Stride: 0x1},
+		unicode.Range16{Lo: 0xeb2, Hi: 0xeb3, Stride: 0x1},
+		unicode.Range16{Lo: 0xebd, Hi: 0xebd, Stride: 0x1},
+		unicode.Range16{Lo: 0xec0, Hi: 0xec4, Stride: 0x1},
+		unicode.Range16{Lo: 0xec6, Hi: 0xec6, Stride: 0x1},
+		unicode.Range16{Lo: 0xedc, Hi: 0xedf, Stride: 0x1},
+		unicode.Range16{Lo: 0xf00, Hi: 0xf00, Stride: 0x1},
+		unicode.Range16{Lo: 0xf40, Hi: 0xf47, Stride: 0x1},
+		unicode.Range16{Lo: 0xf49, Hi: 0xf6c, Stride: 0x1},
+		unicode.Range16{Lo: 0xf88, Hi: 0xf8c, Stride: 0x1},
+		unicode.Range16{Lo: 0x1000, Hi: 0x102a, Stride: 0x1},
+		unicode.Range16{Lo: 0x103f, Hi: 0x103f, Stride: 0x1},
+		unicode.Range16{Lo: 0x1050, Hi: 0x1055, Stride: 0x1},
+		unicode.Range16{Lo: 0x105a, Hi: 0x105d, Stride: 0x1},
+		unicode.Range16{Lo: 0x1061, Hi: 0x1061, Stride: 0x1},
+		unicode.Range16{Lo: 0x1065, Hi: 0x1066, Stride: 0x1},
+		unicode.Range16{Lo: 0x106e, Hi: 0x1070, Stride: 0x1},
+		unicode.Range16{Lo: 0x1075, Hi: 0x1081, Stride: 0x1},
+		unicode.Range16{Lo: 0x108e, Hi: 0x108e, Stride: 0x1},
+		unicode.Range16{Lo: 0x10d0, Hi: 0x10fa, Stride: 0x1},
+		unicode.Range16{Lo: 0x10fd, Hi: 0x10ff, Stride: 0x1},
+		unicode.Range16{Lo: 0x1100, Hi: 0x1248, Stride: 0x1},
+		unicode.Range16{Lo: 0x124a, Hi: 0x124d, Stride: 0x1},
+		unicode.Range16{Lo: 0x1250, Hi: 0x1256, Stride: 0x1},
+		unicode.Range16{Lo: 0x1258, Hi: 0x1258, Stride: 0x1},
+		unicode.Range16{Lo: 0x125a, Hi: 0x125d, Stride: 0x1},
+		unicode.Range16{Lo: 0x1260, Hi: 0x1288, Stride: 0x1},
+		unicode.Range16{Lo: 0x128a, Hi: 0x128d, Stride: 0x1},
+		unicode.Range16{Lo: 0x1290, Hi: 0x12b0, Stride: 0x1},
+		unicode.Range16{Lo: 0x12b2, Hi: 0x12b5, Stride: 0x1},
+		unicode.Range16{Lo: 0x12b8, Hi: 0x12be, Stride: 0x1},
+		unicode.Range16{Lo: 0x12c0, Hi: 0x12c0, Stride: 0x1},
+		unicode.Range16{Lo: 0x12c2, Hi: 0x12c5, Stride: 0x1},
+		unicode.Range16{Lo: 0x12c8, Hi: 0x12d6, Stride: 0x1},
+		unicode.Range16{Lo: 0x12d8, Hi: 0x1310, Stride: 0x1},
+		unicode.Range16{Lo: 0x1312, Hi: 0x1315, Stride: 0x1},
+		unicode.Range16{Lo: 0x1318, Hi: 0x135a, Stride: 0x1},
+		unicode.Range16{Lo: 0x1380, Hi: 0x138f, Stride: 0x1},
+		unicode.Range16{Lo: 0x1401, Hi: 0x166c, Stride: 0x1},
+		unicode.Range16{Lo: 0x166f, Hi: 0x167f, Stride: 0x1},
+		unicode.Range16{Lo: 0x1681, Hi: 0x169a, Stride: 0x1},
+		unicode.Range16{Lo: 0x16a0, Hi: 0x16ea, Stride: 0x1},
+		unicode.Range16{Lo: 0x16ee, Hi: 0x16f0, Stride: 0x1},
+		unicode.Range16{Lo: 0x16f1, Hi: 0x16f8, Stride: 0x1},
+		unicode.Range16{Lo: 0x1700, Hi: 0x1711, Stride: 0x1},
+		unicode.Range16{Lo: 0x171f, Hi: 0x1731, Stride: 0x1},
+		unicode.Range16{Lo: 0x1740, Hi: 0x1751, Stride: 0x1},
+		unicode.Range16{Lo: 0x1760, Hi: 0x176c, Stride: 0x1},
+		unicode.Range16{Lo: 0x176e, Hi: 0x1770, Stride: 0x1},
+		unicode.Range16{Lo: 0x1780, Hi: 0x17b3, Stride: 0x1},
+		unicode.Range16{Lo: 0x17d7, Hi: 0x17d7, Stride: 0x1},
+		unicode.Range16{Lo: 0x17dc, Hi: 0x17dc, Stride: 0x1},
+		unicode.Range16{Lo: 0x1820, Hi: 0x1842, Stride: 0x1},
+		unicode.Range16{Lo: 0x1843, Hi: 0x1843, Stride: 0x1},
+		unicode.Range16{Lo: 0x1844, Hi: 0x1878, Stride: 0x1},
+		unicode.Range16{Lo: 0x1880, Hi: 0x1884, Stride: 0x1},
+		unicode.Range16{Lo: 0x1887, Hi: 0x18a8, Stride: 0x1},
+		unicode.Range16{Lo: 0x18aa, Hi: 0x18aa, Stride: 0x1},
+		unicode.Range16{Lo: 0x18b0, Hi: 0x18f5, Stride: 0x1},
+		unicode.Range16{Lo: 0x1900, Hi: 0x191e, Stride: 0x1},
+		unicode.Range16{Lo: 0x1950, Hi: 0x196d, Stride: 0x1},
+		unicode.Range16{Lo: 0x1970, Hi: 0x1974, Stride: 0x1},
+		unicode.Range16{Lo: 0x1980, Hi: 0x19ab, Stride: 0x1},
+		unicode.Range16{Lo: 0x19b0, Hi: 0x19c9, Stride: 0x1},
+		unicode.Range16{Lo: 0x1a00, Hi: 0x1a16, Stride: 0x1},
+		unicode.Range16{Lo: 0x1a20, Hi: 0x1a54, Stride: 0x1},
+		unicode.Range16{Lo: 0x1aa7, Hi: 0x1aa7, Stride: 0x1},
+		unicode.Range16{Lo: 0x1b05, Hi: 0x1b33, Stride: 0x1},
+		unicode.Range16{Lo: 0x1b45, Hi: 0x1b4c, Stride: 0x1},
+		unicode.Range16{Lo: 0x1b83, Hi: 0x1ba0, Stride: 0x1},
+		unicode.Range16{Lo: 0x1bae, Hi: 0x1baf, Stride: 0x1},
+		unicode.Range16{Lo: 0x1bba, Hi: 0x1be5, Stride: 0x1},
+		unicode.Range16{Lo: 0x1c00, Hi: 0x1c23, Stride: 0x1},
+		unicode.Range16{Lo: 0x1c4d, Hi: 0x1c4f, Stride: 0x1},
+		unicode.Range16{Lo: 0x1c5a, Hi: 0x1c77, Stride: 0x1},
+		unicode.Range16{Lo: 0x1c78, Hi: 0x1c7d, Stride: 0x1},
+		unicode.Range16{Lo: 0x1c90, Hi: 0x1cba, Stride: 0x1},
+		unicode.Range16{Lo: 0x1cbd, Hi: 0x1cbf, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ce9, Hi: 0x1cec, Stride: 0x1},
+		unicode.Range16{Lo: 0x1cee, Hi: 0x1cf3, Stride: 0x1},
+		unicode.Range16{Lo: 0x1cf5, Hi: 0x1cf6, Stride: 0x1},
+		unicode.Range16{Lo: 0x1cfa, Hi: 0x1cfa, Stride: 0x1},
+		unicode.Range16{Lo: 0x2135, Hi: 0x2138, Stride: 0x1},
+		unicode.Range16{Lo: 0x2180, Hi: 0x2182, Stride: 0x1},
+		unicode.Range16{Lo: 0x2185, Hi: 0x2188, Stride: 0x1},
+		unicode.Range16{Lo: 0x2d30, Hi: 0x2d67, Stride: 0x1},
+		unicode.Range16{Lo: 0x2d6f, Hi: 0x2d6f, Stride: 0x1},
+		unicode.Range16{Lo: 0x2d80, Hi: 0x2d96, Stride: 0x1},
+		unicode.Range16{Lo: 0x2da0, Hi: 0x2da6, Stride: 0x1},
+		unicode.Range16{Lo: 0x2da8, Hi: 0x2dae, Stride: 0x1},
+		unicode.Range16{Lo: 0x2db0, Hi: 0x2db6, Stride: 0x1},
+		unicode.Range16{Lo: 0x2db8, Hi: 0x2dbe, Stride: 0x1},
+		unicode.Range16{Lo: 0x2dc0, Hi: 0x2dc6, Stride: 0x1},
+		unicode.Range16{Lo: 0x2dc8, Hi: 0x2dce, Stride: 0x1},
+		unicode.Range16{Lo: 0x2dd0, Hi: 0x2dd6, Stride: 0x1},
+		unicode.Range16{Lo: 0x2dd8, Hi: 0x2dde, Stride: 0x1},
+		unicode.Range16{Lo: 0x2e2f, Hi: 0x2e2f, Stride: 0x1},
+		unicode.Range16{Lo: 0x3005, Hi: 0x3005, Stride: 0x1},
+		unicode.Range16{Lo: 0x3006, Hi: 0x3006, Stride: 0x1},
+		unicode.Range16{Lo: 0x3007, Hi: 0x3007, Stride: 0x1},
+		unicode.Range16{Lo: 0x3021, Hi: 0x3029, Stride: 0x1},
+		unicode.Range16{Lo: 0x3031, Hi: 0x3035, Stride: 0x1},
+		unicode.Range16{Lo: 0x3038, Hi: 0x303a, Stride: 0x1},
+		unicode.Range16{Lo: 0x303b, Hi: 0x303b, Stride: 0x1},
+		unicode.Range16{Lo: 0x303c, Hi: 0x303c, Stride: 0x1},
+		unicode.Range16{Lo: 0x3041, Hi: 0x3096, Stride: 0x1},
+		unicode.Range16{Lo: 0x309d, Hi: 0x309e, Stride: 0x1},
+		unicode.Range16{Lo: 0x309f, Hi: 0x309f, Stride: 0x1},
+		unicode.Range16{Lo: 0x30a1, Hi: 0x30fa, Stride: 0x1},
+		unicode.Range16{Lo: 0x30fc, Hi: 0x30fe, Stride: 0x1},
+		unicode.Range16{Lo: 0x30ff, Hi: 0x30ff, Stride: 0x1},
+		unicode.Range16{Lo: 0x3105, Hi: 0x312f, Stride: 0x1},
+		unicode.Range16{Lo: 0x3131, Hi: 0x318e, Stride: 0x1},
+		unicode.Range16{Lo: 0x31a0, Hi: 0x31bf, Stride: 0x1},
+		unicode.Range16{Lo: 0x31f0, Hi: 0x31ff, Stride: 0x1},
+		unicode.Range16{Lo: 0x3400, Hi: 0x4dbf, Stride: 0x1},
+		unicode.Range16{Lo: 0x4e00, Hi: 0xa014, Stride: 0x1},
+		unicode.Range16{Lo: 0xa015, Hi: 0xa015, Stride: 0x1},
+		unicode.Range16{Lo: 0xa016, Hi: 0xa48c, Stride: 0x1},
+		unicode.Range16{Lo: 0xa4d0, Hi: 0xa4f7, Stride: 0x1},
+		unicode.Range16{Lo: 0xa4f8, Hi: 0xa4fd, Stride: 0x1},
+		unicode.Range16{Lo: 0xa500, Hi: 0xa60b, Stride: 0x1},
+		unicode.Range16{Lo: 0xa60c, Hi: 0xa60c, Stride: 0x1},
+		unicode.Range16{Lo: 0xa610, Hi: 0xa61f, Stride: 0x1},
+		unicode.Range16{Lo: 0xa62a, Hi: 0xa62b, Stride: 0x1},
+		unicode.Range16{Lo: 0xa66e, Hi: 0xa66e, Stride: 0x1},
+		unicode.Range16{Lo: 0xa67f, Hi: 0xa67f, Stride: 0x1},
+		unicode.Range16{Lo: 0xa6a0, Hi: 0xa6e5, Stride: 0x1},
+		unicode.Range16{Lo: 0xa6e6, Hi: 0xa6ef, Stride: 0x1},
+		unicode.Range16{Lo: 0xa717, Hi: 0xa71f, Stride: 0x1},
+		unicode.Range16{Lo: 0xa788, Hi: 0xa788, Stride: 0x1},
+		unicode.Range16{Lo: 0xa78f, Hi: 0xa78f, Stride: 0x1},
+		unicode.Range16{Lo: 0xa7f7, Hi: 0xa7f7, Stride: 0x1},
+		unicode.Range16{Lo: 0xa7fb, Hi: 0xa801, Stride: 0x1},
+		unicode.Range16{Lo: 0xa803, Hi: 0xa805, Stride: 0x1},
+		unicode.Range16{Lo: 0xa807, Hi: 0xa80a, Stride: 0x1},
+		unicode.Range16{Lo: 0xa80c, Hi: 0xa822, Stride: 0x1},
+		unicode.Range16{Lo: 0xa840, Hi: 0xa873, Stride: 0x1},
+		unicode.Range16{Lo: 0xa882, Hi: 0xa8b3, Stride: 0x1},
+		unicode.Range16{Lo: 0xa8f2, Hi: 0xa8f7, Stride: 0x1},
+		unicode.Range16{Lo: 0xa8fb, Hi: 0xa8fb, Stride: 0x1},
+		unicode.Range16{Lo: 0xa8fd, Hi: 0xa8fe, Stride: 0x1},
+		unicode.Range16{Lo: 0xa90a, Hi: 0xa925, Stride: 0x1},
+		unicode.Range16{Lo: 0xa930, Hi: 0xa946, Stride: 0x1},
+		unicode.Range16{Lo: 0xa960, Hi: 0xa97c, Stride: 0x1},
+		unicode.Range16{Lo: 0xa984, Hi: 0xa9b2, Stride: 0x1},
+		unicode.Range16{Lo: 0xa9cf, Hi: 0xa9cf, Stride: 0x1},
+		unicode.Range16{Lo: 0xa9e0, Hi: 0xa9e4, Stride: 0x1},
+		unicode.Range16{Lo: 0xa9e6, Hi: 0xa9e6, Stride: 0x1},
+		unicode.Range16{Lo: 0xa9e7, Hi: 0xa9ef, Stride: 0x1},
+		unicode.Range16{Lo: 0xa9fa, Hi: 0xa9fe, Stride: 0x1},
+		unicode.Range16{Lo: 0xaa00, Hi: 0xaa28, Stride: 0x1},
+		unicode.Range16{Lo: 0xaa40, Hi: 0xaa42, Stride: 0x1},
+		unicode.Range16{Lo: 0xaa44, Hi: 0xaa4b, Stride: 0x1},
+		unicode.Range16{Lo: 0xaa60, Hi: 0xaa6f, Stride: 0x1},
+		unicode.Range16{Lo: 0xaa70, Hi: 0xaa70, Stride: 0x1},
+		unicode.Range16{Lo: 0xaa71, Hi: 0xaa76, Stride: 0x1},
+		unicode.Range16{Lo: 0xaa7a, Hi: 0xaa7a, Stride: 0x1},
+		unicode.Range16{Lo: 0xaa7e, Hi: 0xaaaf, Stride: 0x1},
+		unicode.Range16{Lo: 0xaab1, Hi: 0xaab1, Stride: 0x1},
+		unicode.Range16{Lo: 0xaab5, Hi: 0xaab6, Stride: 0x1},
+		unicode.Range16{Lo: 0xaab9, Hi: 0xaabd, Stride: 0x1},
+		unicode.Range16{Lo: 0xaac0, Hi: 0xaac0, Stride: 0x1},
+		unicode.Range16{Lo: 0xaac2, Hi: 0xaac2, Stride: 0x1},
+		unicode.Range16{Lo: 0xaadb, Hi: 0xaadc, Stride: 0x1},
+		unicode.Range16{Lo: 0xaadd, Hi: 0xaadd, Stride: 0x1},
+		unicode.Range16{Lo: 0xaae0, Hi: 0xaaea, Stride: 0x1},
+		unicode.Range16{Lo: 0xaaf2, Hi: 0xaaf2, Stride: 0x1},
+		unicode.Range16{Lo: 0xaaf3, Hi: 0xaaf4, Stride: 0x1},
+		unicode.Range16{Lo: 0xab01, Hi: 0xab06, Stride: 0x1},
+		unicode.Range16{Lo: 0xab09, Hi: 0xab0e, Stride: 0x1},
+		unicode.Range16{Lo: 0xab11, Hi: 0xab16, Stride: 0x1},
+		unicode.Range16{Lo: 0xab20, Hi: 0xab26, Stride: 0x1},
+		unicode.Range16{Lo: 0xab28, Hi: 0xab2e, Stride: 0x1},
+		unicode.Range16{Lo: 0xabc0, Hi: 0xabe2, Stride: 0x1},
+		unicode.Range16{Lo: 0xac00, Hi: 0xd7a3, Stride: 0x1},
+		unicode.Range16{Lo: 0xd7b0, Hi: 0xd7c6, Stride: 0x1},
+		unicode.Range16{Lo: 0xd7cb, Hi: 0xd7fb, Stride: 0x1},
+		unicode.Range16{Lo: 0xf900, Hi: 0xfa6d, Stride: 0x1},
+		unicode.Range16{Lo: 0xfa70, Hi: 0xfad9, Stride: 0x1},
+		unicode.Range16{Lo: 0xfb1d, Hi: 0xfb1d, Stride: 0x1},
+		unicode.Range16{Lo: 0xfb1f, Hi: 0xfb28, Stride: 0x1},
+		unicode.Range16{Lo: 0xfb2a, Hi: 0xfb36, Stride: 0x1},
+		unicode.Range16{Lo: 0xfb38, Hi: 0xfb3c, Stride: 0x1},
+		unicode.Range16{Lo: 0xfb3e, Hi: 0xfb3e, Stride: 0x1},
+		unicode.Range16{Lo: 0xfb40, Hi: 0xfb41, Stride: 0x1},
+		unicode.Range16{Lo: 0xfb43, Hi: 0xfb44, Stride: 0x1},
+		unicode.Range16{Lo: 0xfb46, Hi: 0xfbb1, Stride: 0x1},
+		unicode.Range16{Lo: 0xfbd3, Hi: 0xfd3d, Stride: 0x1},
+		unicode.Range16{Lo: 0xfd50, Hi: 0xfd8f, Stride: 0x1},
+		unicode.Range16{Lo: 0xfd92, Hi: 0xfdc7, Stride: 0x1},
+		unicode.Range16{Lo: 0xfdf0, Hi: 0xfdfb, Stride: 0x1},
+		unicode.Range16{Lo: 0xfe70, Hi: 0xfe74, Stride: 0x1},
+		unicode.Range16{Lo: 0xfe76, Hi: 0xfefc, Stride: 0x1},
+		unicode.Range16{Lo: 0xff66, Hi: 0xff6f, Stride: 0x1},
+		unicode.Range16{Lo: 0xff70, Hi: 0xff70, Stride: 0x1},
+		unicode.Range16{Lo: 0xff71, Hi: 0xff9d, Stride: 0x1},
+		unicode.Range16{Lo: 0xffa0, Hi: 0xffbe, Stride: 0x1},
+		unicode.Range16{Lo: 0xffc2, Hi: 0xffc7, Stride: 0x1},
+		unicode.Range16{Lo: 0xffca, Hi: 0xffcf, Stride: 0x1},
+		unicode.Range16{Lo: 0xffd2, Hi: 0xffd7, Stride: 0x1},
+		unicode.Range16{Lo: 0xffda, Hi: 0xffdc, Stride: 0x1},
+	},
+	R32: []unicode.Range32{
+		unicode.Range32{Lo: 0x10000, Hi: 0x1000b, Stride: 0x1},
+		unicode.Range32{Lo: 0x1000d, Hi: 0x10026, Stride: 0x1},
+		unicode.Range32{Lo: 0x10028, Hi: 0x1003a, Stride: 0x1},
+		unicode.Range32{Lo: 0x1003c, Hi: 0x1003d, Stride: 0x1},
+		unicode.Range32{Lo: 0x1003f, Hi: 0x1004d, Stride: 0x1},
+		unicode.Range32{Lo: 0x10050, Hi: 0x1005d, Stride: 0x1},
+		unicode.Range32{Lo: 0x10080, Hi: 0x100fa, Stride: 0x1},
+		unicode.Range32{Lo: 0x10140, Hi: 0x10174, Stride: 0x1},
+		unicode.Range32{Lo: 0x10280, Hi: 0x1029c, Stride: 0x1},
+		unicode.Range32{Lo: 0x102a0, Hi: 0x102d0, Stride: 0x1},
+		unicode.Range32{Lo: 0x10300, Hi: 0x1031f, Stride: 0x1},
+		unicode.Range32{Lo: 0x1032d, Hi: 0x10340, Stride: 0x1},
+		unicode.Range32{Lo: 0x10341, Hi: 0x10341, Stride: 0x1},
+		unicode.Range32{Lo: 0x10342, Hi: 0x10349, Stride: 0x1},
+		unicode.Range32{Lo: 0x1034a, Hi: 0x1034a, Stride: 0x1},
+		unicode.Range32{Lo: 0x10350, Hi: 0x10375, Stride: 0x1},
+		unicode.Range32{Lo: 0x10380, Hi: 0x1039d, Stride: 0x1},
+		unicode.Range32{Lo: 0x103a0, Hi: 0x103c3, Stride: 0x1},
+		unicode.Range32{Lo: 0x103c8, Hi: 0x103cf, Stride: 0x1},
+		unicode.Range32{Lo: 0x103d1, Hi: 0x103d5, Stride: 0x1},
+		unicode.Range32{Lo: 0x10450, Hi: 0x1049d, Stride: 0x1},
+		unicode.Range32{Lo: 0x10500, Hi: 0x10527, Stride: 0x1},
+		unicode.Range32{Lo: 0x10530, Hi: 0x10563, Stride: 0x1},
+		unicode.Range32{Lo: 0x10600, Hi: 0x10736, Stride: 0x1},
+		unicode.Range32{Lo: 0x10740, Hi: 0x10755, Stride: 0x1},
+		unicode.Range32{Lo: 0x10760, Hi: 0x10767, Stride: 0x1},
+		unicode.Range32{Lo: 0x10781, Hi: 0x10782, Stride: 0x1},
+		unicode.Range32{Lo: 0x10800, Hi: 0x10805, Stride: 0x1},
+		unicode.Range32{Lo: 0x10808, Hi: 0x10808, Stride: 0x1},
+		unicode.Range32{Lo: 0x1080a, Hi: 0x10835, Stride: 0x1},
+		unicode.Range32{Lo: 0x10837, Hi: 0x10838, Stride: 0x1},
+		unicode.Range32{Lo: 0x1083c, Hi: 0x1083c, Stride: 0x1},
+		unicode.Range32{Lo: 0x1083f, Hi: 0x10855, Stride: 0x1},
+		unicode.Range32{Lo: 0x10860, Hi: 0x10876, Stride: 0x1},
+		unicode.Range32{Lo: 0x10880, Hi: 0x1089e, Stride: 0x1},
+		unicode.Range32{Lo: 0x108e0, Hi: 0x108f2, Stride: 0x1},
+		unicode.Range32{Lo: 0x108f4, Hi: 0x108f5, Stride: 0x1},
+		unicode.Range32{Lo: 0x10900, Hi: 0x10915, Stride: 0x1},
+		unicode.Range32{Lo: 0x10920, Hi: 0x10939, Stride: 0x1},
+		unicode.Range32{Lo: 0x10980, Hi: 0x109b7, Stride: 0x1},
+		unicode.Range32{Lo: 0x109be, Hi: 0x109bf, Stride: 0x1},
+		unicode.Range32{Lo: 0x10a00, Hi: 0x10a00, Stride: 0x1},
+		unicode.Range32{Lo: 0x10a10, Hi: 0x10a13, Stride: 0x1},
+		unicode.Range32{Lo: 0x10a15, Hi: 0x10a17, Stride: 0x1},
+		unicode.Range32{Lo: 0x10a19, Hi: 0x10a35, Stride: 0x1},
+		unicode.Range32{Lo: 0x10a60, Hi: 0x10a7c, Stride: 0x1},
+		unicode.Range32{Lo: 0x10a80, Hi: 0x10a9c, Stride: 0x1},
+		unicode.Range32{Lo: 0x10ac0, Hi: 0x10ac7, Stride: 0x1},
+		unicode.Range32{Lo: 0x10ac9, Hi: 0x10ae4, Stride: 0x1},
+		unicode.Range32{Lo: 0x10b00, Hi: 0x10b35, Stride: 0x1},
+		unicode.Range32{Lo: 0x10b40, Hi: 0x10b55, Stride: 0x1},
+		unicode.Range32{Lo: 0x10b60, Hi: 0x10b72, Stride: 0x1},
+		unicode.Range32{Lo: 0x10b80, Hi: 0x10b91, Stride: 0x1},
+		unicode.Range32{Lo: 0x10c00, Hi: 0x10c48, Stride: 0x1},
+		unicode.Range32{Lo: 0x10d00, Hi: 0x10d23, Stride: 0x1},
+		unicode.Range32{Lo: 0x10e80, Hi: 0x10ea9, Stride: 0x1},
+		unicode.Range32{Lo: 0x10eb0, Hi: 0x10eb1, Stride: 0x1},
+		unicode.Range32{Lo: 0x10f00, Hi: 0x10f1c, Stride: 0x1},
+		unicode.Range32{Lo: 0x10f27, Hi: 0x10f27, Stride: 0x1},
+		unicode.Range32{Lo: 0x10f30, Hi: 0x10f45, Stride: 0x1},
+		unicode.Range32{Lo: 0x10f70, Hi: 0x10f81, Stride: 0x1},
+		unicode.Range32{Lo: 0x10fb0, Hi: 0x10fc4, Stride: 0x1},
+		unicode.Range32{Lo: 0x10fe0, Hi: 0x10ff6, Stride: 0x1},
+		unicode.Range32{Lo: 0x11003, Hi: 0x11037, Stride: 0x1},
+		unicode.Range32{Lo: 0x11071, Hi: 0x11072, Stride: 0x1},
+		unicode.Range32{Lo: 0x11075, Hi: 0x11075, Stride: 0x1},
+		unicode.Range32{Lo: 0x11083, Hi: 0x110af, Stride: 0x1},
+		unicode.Range32{Lo: 0x110d0, Hi: 0x110e8, Stride: 0x1},
+		unicode.Range32{Lo: 0x11103, Hi: 0x11126, Stride: 0x1},
+		unicode.Range32{Lo: 0x11144, Hi: 0x11144, Stride: 0x1},
+		unicode.Range32{Lo: 0x11147, Hi: 0x11147, Stride: 0x1},
+		unicode.Range32{Lo: 0x11150, Hi: 0x11172, Stride: 0x1},
+		unicode.Range32{Lo: 0x11176, Hi: 0x11176, Stride: 0x1},
+		unicode.Range32{Lo: 0x11183, Hi: 0x111b2, Stride: 0x1},
+		unicode.Range32{Lo: 0x111c1, Hi: 0x111c4, Stride: 0x1},
+		unicode.Range32{Lo: 0x111da, Hi: 0x111da, Stride: 0x1},
+		unicode.Range32{Lo: 0x111dc, Hi: 0x111dc, Stride: 0x1},
+		unicode.Range32{Lo: 0x11200, Hi: 0x11211, Stride: 0x1},
+		unicode.Range32{Lo: 0x11213, Hi: 0x1122b, Stride: 0x1},
+		unicode.Range32{Lo: 0x1123f, Hi: 0x11240, Stride: 0x1},
+		unicode.Range32{Lo: 0x11280, Hi: 0x11286, Stride: 0x1},
+		unicode.Range32{Lo: 0x11288, Hi: 0x11288, Stride: 0x1},
+		unicode.Range32{Lo: 0x1128a, Hi: 0x1128d, Stride: 0x1},
+		unicode.Range32{Lo: 0x1128f, Hi: 0x1129d, Stride: 0x1},
+		unicode.Range32{Lo: 0x1129f, Hi: 0x112a8, Stride: 0x1},
+		unicode.Range32{Lo: 0x112b0, Hi: 0x112de, Stride: 0x1},
+		unicode.Range32{Lo: 0x11305, Hi: 0x1130c, Stride: 0x1},
+		unicode.Range32{Lo: 0x1130f, Hi: 0x11310, Stride: 0x1},
+		unicode.Range32{Lo: 0x11313, Hi: 0x11328, Stride: 0x1},
+		unicode.Range32{Lo: 0x1132a, Hi: 0x11330, Stride: 0x1},
+		unicode.Range32{Lo: 0x11332, Hi: 0x11333, Stride: 0x1},
+		unicode.Range32{Lo: 0x11335, Hi: 0x11339, Stride: 0x1},
+		unicode.Range32{Lo: 0x1133d, Hi: 0x1133d, Stride: 0x1},
+		unicode.Range32{Lo: 0x11350, Hi: 0x11350, Stride: 0x1},
+		unicode.Range32{Lo: 0x1135d, Hi: 0x11361, Stride: 0x1},
+		unicode.Range32{Lo: 0x11400, Hi: 0x11434, Stride: 0x1},
+		unicode.Range32{Lo: 0x11447, Hi: 0x1144a, Stride: 0x1},
+		unicode.Range32{Lo: 0x1145f, Hi: 0x11461, Stride: 0x1},
+		unicode.Range32{Lo: 0x11480, Hi: 0x114af, Stride: 0x1},
+		unicode.Range32{Lo: 0x114c4, Hi: 0x114c5, Stride: 0x1},
+		unicode.Range32{Lo: 0x114c7, Hi: 0x114c7, Stride: 0x1},
+		unicode.Range32{Lo: 0x11580, Hi: 0x115ae, Stride: 0x1},
+		unicode.Range32{Lo: 0x115d8, Hi: 0x115db, Stride: 0x1},
+		unicode.Range32{Lo: 0x11600, Hi: 0x1162f, Stride: 0x1},
+		unicode.Range32{Lo: 0x11644, Hi: 0x11644, Stride: 0x1},
+		unicode.Range32{Lo: 0x11680, Hi: 0x116aa, Stride: 0x1},
+		unicode.Range32{Lo: 0x116b8, Hi: 0x116b8, Stride: 0x1},
+		unicode.Range32{Lo: 0x11700, Hi: 0x1171a, Stride: 0x1},
+		unicode.Range32{Lo: 0x11740, Hi: 0x11746, Stride: 0x1},
+		unicode.Range32{Lo: 0x11800, Hi: 0x1182b, Stride: 0x1},
+		unicode.Range32{Lo: 0x118ff, Hi: 0x11906, Stride: 0x1},
+		unicode.Range32{Lo: 0x11909, Hi: 0x11909, Stride: 0x1},
+		unicode.Range32{Lo: 0x1190c, Hi: 0x11913, Stride: 0x1},
+		unicode.Range32{Lo: 0x11915, Hi: 0x11916, Stride: 0x1},
+		unicode.Range32{Lo: 0x11918, Hi: 0x1192f, Stride: 0x1},
+		unicode.Range32{Lo: 0x1193f, Hi: 0x1193f, Stride: 0x1},
+		unicode.Range32{Lo: 0x11941, Hi: 0x11941, Stride: 0x1},
+		unicode.Range32{Lo: 0x119a0, Hi: 0x119a7, Stride: 0x1},
+		unicode.Range32{Lo: 0x119aa, Hi: 0x119d0, Stride: 0x1},
+		unicode.Range32{Lo: 0x119e1, Hi: 0x119e1, Stride: 0x1},
+		unicode.Range32{Lo: 0x119e3, Hi: 0x119e3, Stride: 0x1},
+		unicode.Range32{Lo: 0x11a00, Hi: 0x11a00, Stride: 0x1},
+		unicode.Range32{Lo: 0x11a0b, Hi: 0x11a32, Stride: 0x1},
+		unicode.Range32{Lo: 0x11a3a, Hi: 0x11a3a, Stride: 0x1},
+		unicode.Range32{Lo: 0x11a50, Hi: 0x11a50, Stride: 0x1},
+		unicode.Range32{Lo: 0x11a5c, Hi: 0x11a89, Stride: 0x1},
+		unicode.Range32{Lo: 0x11a9d, Hi: 0x11a9d, Stride: 0x1},
+		unicode.Range32{Lo: 0x11ab0, Hi: 0x11af8, Stride: 0x1},
+		unicode.Range32{Lo: 0x11c00, Hi: 0x11c08, Stride: 0x1},
+		unicode.Range32{Lo: 0x11c0a, Hi: 0x11c2e, Stride: 0x1},
+		unicode.Range32{Lo: 0x11c40, Hi: 0x11c40, Stride: 0x1},
+		unicode.Range32{Lo: 0x11c72, Hi: 0x11c8f, Stride: 0x1},
+		unicode.Range32{Lo: 0x11d00, Hi: 0x11d06, Stride: 0x1},
+		unicode.Range32{Lo: 0x11d08, Hi: 0x11d09, Stride: 0x1},
+		unicode.Range32{Lo: 0x11d0b, Hi: 0x11d30, Stride: 0x1},
+		unicode.Range32{Lo: 0x11d46, Hi: 0x11d46, Stride: 0x1},
+		unicode.Range32{Lo: 0x11d60, Hi: 0x11d65, Stride: 0x1},
+		unicode.Range32{Lo: 0x11d67, Hi: 0x11d68, Stride: 0x1},
+		unicode.Range32{Lo: 0x11d6a, Hi: 0x11d89, Stride: 0x1},
+		unicode.Range32{Lo: 0x11d98, Hi: 0x11d98, Stride: 0x1},
+		unicode.Range32{Lo: 0x11ee0, Hi: 0x11ef2, Stride: 0x1},
+		unicode.Range32{Lo: 0x11f02, Hi: 0x11f02, Stride: 0x1},
+		unicode.Range32{Lo: 0x11f04, Hi: 0x11f10, Stride: 0x1},
+		unicode.Range32{Lo: 0x11f12, Hi: 0x11f33, Stride: 0x1},
+		unicode.Range32{Lo: 0x11fb0, Hi: 0x11fb0, Stride: 0x1},
+		unicode.Range32{Lo: 0x12000, Hi: 0x12399, Stride: 0x1},
+		unicode.Range32{Lo: 0x12400, Hi: 0x1246e, Stride: 0x1},
+		unicode.Range32{Lo: 0x12480, Hi: 0x12543, Stride: 0x1},
+		unicode.Range32{Lo: 0x12f90, Hi: 0x12ff0, Stride: 0x1},
+		unicode.Range32{Lo: 0x13000, Hi: 0x1342f, Stride: 0x1},
+		unicode.Range32{Lo: 0x13441, Hi: 0x13446, Stride: 0x1},
+		unicode.Range32{Lo: 0x14400, Hi: 0x14646, Stride: 0x1},
+		unicode.Range32{Lo: 0x16800, Hi: 0x16a38, Stride: 0x1},
+		unicode.Range32{Lo: 0x16a40, Hi: 0x16a5e, Stride: 0x1},
+		unicode.Range32{Lo: 0x16a70, Hi: 0x16abe, Stride: 0x1},
+		unicode.Range32{Lo: 0x16ad0, Hi: 0x16aed, Stride: 0x1},
+		unicode.Range32{Lo: 0x16b00, Hi: 0x16b2f, Stride: 0x1},
+		unicode.Range32{Lo: 0x16b40, Hi: 0x16b43, Stride: 0x1},
+		unicode.Range32{Lo: 0x16b63, Hi: 0x16b77, Stride: 0x1},
+		unicode.Range32{Lo: 0x16b7d, Hi: 0x16b8f, Stride: 0x1},
+		unicode.Range32{Lo: 0x16f00, Hi: 0x16f4a, Stride: 0x1},
+		unicode.Range32{Lo: 0x16f50, Hi: 0x16f50, Stride: 0x1},
+		unicode.Range32{Lo: 0x16f93, Hi: 0x16f9f, Stride: 0x1},
+		unicode.Range32{Lo: 0x16fe0, Hi: 0x16fe1, Stride: 0x1},
+		unicode.Range32{Lo: 0x16fe3, Hi: 0x16fe3, Stride: 0x1},
+		unicode.Range32{Lo: 0x17000, Hi: 0x187f7, Stride: 0x1},
+		unicode.Range32{Lo: 0x18800, Hi: 0x18cd5, Stride: 0x1},
+		unicode.Range32{Lo: 0x18d00, Hi: 0x18d08, Stride: 0x1},
+		unicode.Range32{Lo: 0x1aff0, Hi: 0x1aff3, Stride: 0x1},
+		unicode.Range32{Lo: 0x1aff5, Hi: 0x1affb, Stride: 0x1},
+		unicode.Range32{Lo: 0x1affd, Hi: 0x1affe, Stride: 0x1},
+		unicode.Range32{Lo: 0x1b000, Hi: 0x1b122, Stride: 0x1},
+		unicode.Range32{Lo: 0x1b132, Hi: 0x1b132, Stride: 0x1},
+		unicode.Range32{Lo: 0x1b150, Hi: 0x1b152, Stride: 0x1},
+		unicode.Range32{Lo: 0x1b155, Hi: 0x1b155, Stride: 0x1},
+		unicode.Range32{Lo: 0x1b164, Hi: 0x1b167, Stride: 0x1},
+		unicode.Range32{Lo: 0x1b170, Hi: 0x1b2fb, Stride: 0x1},
+		unicode.Range32{Lo: 0x1bc00, Hi: 0x1bc6a, Stride: 0x1},
+		unicode.Range32{Lo: 0x1bc70, Hi: 0x1bc7c, Stride: 0x1},
+		unicode.Range32{Lo: 0x1bc80, Hi: 0x1bc88, Stride: 0x1},
+		unicode.Range32{Lo: 0x1bc90, Hi: 0x1bc99, Stride: 0x1},
+		unicode.Range32{Lo: 0x1df0a, Hi: 0x1df0a, Stride: 0x1},
+		unicode.Range32{Lo: 0x1e100, Hi: 0x1e12c, Stride: 0x1},
+		unicode.Range32{Lo: 0x1e137, Hi: 0x1e13d, Stride: 0x1},
+		unicode.Range32{Lo: 0x1e14e, Hi: 0x1e14e, Stride: 0x1},
+		unicode.Range32{Lo: 0x1e290, Hi: 0x1e2ad, Stride: 0x1},
+		unicode.Range32{Lo: 0x1e2c0, Hi: 0x1e2eb, Stride: 0x1},
+		unicode.Range32{Lo: 0x1e4d0, Hi: 0x1e4ea, Stride: 0x1},
+		unicode.Range32{Lo: 0x1e4eb, Hi: 0x1e4eb, Stride: 0x1},
+		unicode.Range32{Lo: 0x1e7e0, Hi: 0x1e7e6, Stride: 0x1},
+		unicode.Range32{Lo: 0x1e7e8, Hi: 0x1e7eb, Stride: 0x1},
+		unicode.Range32{Lo: 0x1e7ed, Hi: 0x1e7ee, Stride: 0x1},
+		unicode.Range32{Lo: 0x1e7f0, Hi: 0x1e7fe, Stride: 0x1},
+		unicode.Range32{Lo: 0x1e800, Hi: 0x1e8c4, Stride: 0x1},
+		unicode.Range32{Lo: 0x1e94b, Hi: 0x1e94b, Stride: 0x1},
+		unicode.Range32{Lo: 0x1ee00, Hi: 0x1ee03, Stride: 0x1},
+		unicode.Range32{Lo: 0x1ee05, Hi: 0x1ee1f, Stride: 0x1},
+		unicode.Range32{Lo: 0x1ee21, Hi: 0x1ee22, Stride: 0x1},
+		unicode.Range32{Lo: 0x1ee24, Hi: 0x1ee24, Stride: 0x1},
+		unicode.Range32{Lo: 0x1ee27, Hi: 0x1ee27, Stride: 0x1},
+		unicode.Range32{Lo: 0x1ee29, Hi: 0x1ee32, Stride: 0x1},
+		unicode.Range32{Lo: 0x1ee34, Hi: 0x1ee37, Stride: 0x1},
+		unicode.Range32{Lo: 0x1ee39, Hi: 0x1ee39, Stride: 0x1},
+		unicode.Range32{Lo: 0x1ee3b, Hi: 0x1ee3b, Stride: 0x1},
+		unicode.Range32{Lo: 0x1ee42, Hi: 0x1ee42, Stride: 0x1},
+		unicode.Range32{Lo: 0x1ee47, Hi: 0x1ee47, Stride: 0x1},
+		unicode.Range32{Lo: 0x1ee49, Hi: 0x1ee49, Stride: 0x1},
+		unicode.Range32{Lo: 0x1ee4b, Hi: 0x1ee4b, Stride: 0x1},
+		unicode.Range32{Lo: 0x1ee4d, Hi: 0x1ee4f, Stride: 0x1},
+		unicode.Range32{Lo: 0x1ee51, Hi: 0x1ee52, Stride: 0x1},
+		unicode.Range32{Lo: 0x1ee54, Hi: 0x1ee54, Stride: 0x1},
+		unicode.Range32{Lo: 0x1ee57, Hi: 0x1ee57, Stride: 0x1},
+		unicode.Range32{Lo: 0x1ee59, Hi: 0x1ee59, Stride: 0x1},
+		unicode.Range32{Lo: 0x1ee5b, Hi: 0x1ee5b, Stride: 0x1},
+		unicode.Range32{Lo: 0x1ee5d, Hi: 0x1ee5d, Stride: 0x1},
+		unicode.Range32{Lo: 0x1ee5f, Hi: 0x1ee5f, Stride: 0x1},
+		unicode.Range32{Lo: 0x1ee61, Hi: 0x1ee62, Stride: 0x1},
+		unicode.Range32{Lo: 0x1ee64, Hi: 0x1ee64, Stride: 0x1},
+		unicode.Range32{Lo: 0x1ee67, Hi: 0x1ee6a, Stride: 0x1},
+		unicode.Range32{Lo: 0x1ee6c, Hi: 0x1ee72, Stride: 0x1},
+		unicode.Range32{Lo: 0x1ee74, Hi: 0x1ee77, Stride: 0x1},
+		unicode.Range32{Lo: 0x1ee79, Hi: 0x1ee7c, Stride: 0x1},
+		unicode.Range32{Lo: 0x1ee7e, Hi: 0x1ee7e, Stride: 0x1},
+		unicode.Range32{Lo: 0x1ee80, Hi: 0x1ee89, Stride: 0x1},
+		unicode.Range32{Lo: 0x1ee8b, Hi: 0x1ee9b, Stride: 0x1},
+		unicode.Range32{Lo: 0x1eea1, Hi: 0x1eea3, Stride: 0x1},
+		unicode.Range32{Lo: 0x1eea5, Hi: 0x1eea9, Stride: 0x1},
+		unicode.Range32{Lo: 0x1eeab, Hi: 0x1eebb, Stride: 0x1},
+		unicode.Range32{Lo: 0x20000, Hi: 0x2a6df, Stride: 0x1},
+		unicode.Range32{Lo: 0x2a700, Hi: 0x2b739, Stride: 0x1},
+		unicode.Range32{Lo: 0x2b740, Hi: 0x2b81d, Stride: 0x1},
+		unicode.Range32{Lo: 0x2b820, Hi: 0x2cea1, Stride: 0x1},
+		unicode.Range32{Lo: 0x2ceb0, Hi: 0x2ebe0, Stride: 0x1},
+		unicode.Range32{Lo: 0x2f800, Hi: 0x2fa1d, Stride: 0x1},
+		unicode.Range32{Lo: 0x30000, Hi: 0x3134a, Stride: 0x1},
+		unicode.Range32{Lo: 0x31350, Hi: 0x323af, Stride: 0x1},
+	},
+	LatinOffset: 0,
+}
+
+var _SentenceSContinue = &unicode.RangeTable{
+	R16: []unicode.Range16{
+		unicode.Range16{Lo: 0x2c, Hi: 0x2c, Stride: 0x1},
+		unicode.Range16{Lo: 0x2d, Hi: 0x2d, Stride: 0x1},
+		unicode.Range16{Lo: 0x3a, Hi: 0x3a, Stride: 0x1},
+		unicode.Range16{Lo: 0x55d, Hi: 0x55d, Stride: 0x1},
+		unicode.Range16{Lo: 0x60c, Hi: 0x60d, Stride: 0x1},
+		unicode.Range16{Lo: 0x7f8, Hi: 0x7f8, Stride: 0x1},
+		unicode.Range16{Lo: 0x1802, Hi: 0x1802, Stride: 0x1},
+		unicode.Range16{Lo: 0x1808, Hi: 0x1808, Stride: 0x1},
+		unicode.Range16{Lo: 0x2013, Hi: 0x2014, Stride: 0x1},
+		unicode.Range16{Lo: 0x3001, Hi: 0x3001, Stride: 0x1},
+		unicode.Range16{Lo: 0xfe10, Hi: 0xfe11, Stride: 0x1},
+		unicode.Range16{Lo: 0xfe13, Hi: 0xfe13, Stride: 0x1},
+		unicode.Range16{Lo: 0xfe31, Hi: 0xfe32, Stride: 0x1},
+		unicode.Range16{Lo: 0xfe50, Hi: 0xfe51, Stride: 0x1},
+		unicode.Range16{Lo: 0xfe55, Hi: 0xfe55, Stride: 0x1},
+		unicode.Range16{Lo: 0xfe58, Hi: 0xfe58, Stride: 0x1},
+		unicode.Range16{Lo: 0xfe63, Hi: 0xfe63, Stride: 0x1},
+		unicode.Range16{Lo: 0xff0c, Hi: 0xff0c, Stride: 0x1},
+		unicode.Range16{Lo: 0xff0d, Hi: 0xff0d, Stride: 0x1},
+		unicode.Range16{Lo: 0xff1a, Hi: 0xff1a, Stride: 0x1},
+		unicode.Range16{Lo: 0xff64, Hi: 0xff64, Stride: 0x1},
+	},
+	LatinOffset: 3,
+}
+
+var _SentenceSTerm = &unicode.RangeTable{
+	R16: []unicode.Range16{
+		unicode.Range16{Lo: 0x21, Hi: 0x21, Stride: 0x1},
+		unicode.Range16{Lo: 0x3f, Hi: 0x3f, Stride: 0x1},
+		unicode.Range16{Lo: 0x589, Hi: 0x589, Stride: 0x1},
+		unicode.Range16{Lo: 0x61d, Hi: 0x61f, Stride: 0x1},
+		unicode.Range16{Lo: 0x6d4, Hi: 0x6d4, Stride: 0x1},
+		unicode.Range16{Lo: 0x700, Hi: 0x702, Stride: 0x1},
+		unicode.Range16{Lo: 0x7f9, Hi: 0x7f9, Stride: 0x1},
+		unicode.Range16{Lo: 0x837, Hi: 0x837, Stride: 0x1},
+		unicode.Range16{Lo: 0x839, Hi: 0x839, Stride: 0x1},
+		unicode.Range16{Lo: 0x83d, Hi: 0x83e, Stride: 0x1},
+		unicode.Range16{Lo: 0x964, Hi: 0x965, Stride: 0x1},
+		unicode.Range16{Lo: 0x104a, Hi: 0x104b, Stride: 0x1},
+		unicode.Range16{Lo: 0x1362, Hi: 0x1362, Stride: 0x1},
+		unicode.Range16{Lo: 0x1367, Hi: 0x1368, Stride: 0x1},
+		unicode.Range16{Lo: 0x166e, Hi: 0x166e, Stride: 0x1},
+		unicode.Range16{Lo: 0x1735, Hi: 0x1736, Stride: 0x1},
+		unicode.Range16{Lo: 0x1803, Hi: 0x1803, Stride: 0x1},
+		unicode.Range16{Lo: 0x1809, Hi: 0x1809, Stride: 0x1},
+		unicode.Range16{Lo: 0x1944, Hi: 0x1945, Stride: 0x1},
+		unicode.Range16{Lo: 0x1aa8, Hi: 0x1aab, Stride: 0x1},
+		unicode.Range16{Lo: 0x1b5a, Hi: 0x1b5b, Stride: 0x1},
+		unicode.Range16{Lo: 0x1b5e, Hi: 0x1b5f, Stride: 0x1},
+		unicode.Range16{Lo: 0x1b7d, Hi: 0x1b7e, Stride: 0x1},
+		unicode.Range16{Lo: 0x1c3b, Hi: 0x1c3c, Stride: 0x1},
+		unicode.Range16{Lo: 0x1c7e, Hi: 0x1c7f, Stride: 0x1},
+		unicode.Range16{Lo: 0x203c, Hi: 0x203d, Stride: 0x1},
+		unicode.Range16{Lo: 0x2047, Hi: 0x2049, Stride: 0x1},
+		unicode.Range16{Lo: 0x2e2e, Hi: 0x2e2e, Stride: 0x1},
+		unicode.Range16{Lo: 0x2e3c, Hi: 0x2e3c, Stride: 0x1},
+		unicode.Range16{Lo: 0x2e53, Hi: 0x2e54, Stride: 0x1},
+		unicode.Range16{Lo: 0x3002, Hi: 0x3002, Stride: 0x1},
+		unicode.Range16{Lo: 0xa4ff, Hi: 0xa4ff, Stride: 0x1},
+		unicode.Range16{Lo: 0xa60e, Hi: 0xa60f, Stride: 0x1},
+		unicode.Range16{Lo: 0xa6f3, Hi: 0xa6f3, Stride: 0x1},
+		unicode.Range16{Lo: 0xa6f7, Hi: 0xa6f7, Stride: 0x1},
+		unicode.Range16{Lo: 0xa876, Hi: 0xa877, Stride: 0x1},
+		unicode.Range16{Lo: 0xa8ce, Hi: 0xa8cf, Stride: 0x1},
+		unicode.Range16{Lo: 0xa92f, Hi: 0xa92f, Stride: 0x1},
+		unicode.Range16{Lo: 0xa9c8, Hi: 0xa9c9, Stride: 0x1},
+		unicode.Range16{Lo: 0xaa5d, Hi: 0xaa5f, Stride: 0x1},
+		unicode.Range16{Lo: 0xaaf0, Hi: 0xaaf1, Stride: 0x1},
+		unicode.Range16{Lo: 0xabeb, Hi: 0xabeb, Stride: 0x1},
+		unicode.Range16{Lo: 0xfe56, Hi: 0xfe57, Stride: 0x1},
+		unicode.Range16{Lo: 0xff01, Hi: 0xff01, Stride: 0x1},
+		unicode.Range16{Lo: 0xff1f, Hi: 0xff1f, Stride: 0x1},
+		unicode.Range16{Lo: 0xff61, Hi: 0xff61, Stride: 0x1},
+	},
+	R32: []unicode.Range32{
+		unicode.Range32{Lo: 0x10a56, Hi: 0x10a57, Stride: 0x1},
+		unicode.Range32{Lo: 0x10f55, Hi: 0x10f59, Stride: 0x1},
+		unicode.Range32{Lo: 0x10f86, Hi: 0x10f89, Stride: 0x1},
+		unicode.Range32{Lo: 0x11047, Hi: 0x11048, Stride: 0x1},
+		unicode.Range32{Lo: 0x110be, Hi: 0x110c1, Stride: 0x1},
+		unicode.Range32{Lo: 0x11141, Hi: 0x11143, Stride: 0x1},
+		unicode.Range32{Lo: 0x111c5, Hi: 0x111c6, Stride: 0x1},
+		unicode.Range32{Lo: 0x111cd, Hi: 0x111cd, Stride: 0x1},
+		unicode.Range32{Lo: 0x111de, Hi: 0x111df, Stride: 0x1},
+		unicode.Range32{Lo: 0x11238, Hi: 0x11239, Stride: 0x1},
+		unicode.Range32{Lo: 0x1123b, Hi: 0x1123c, Stride: 0x1},
+		unicode.Range32{Lo: 0x112a9, Hi: 0x112a9, Stride: 0x1},
+		unicode.Range32{Lo: 0x1144b, Hi: 0x1144c, Stride: 0x1},
+		unicode.Range32{Lo: 0x115c2, Hi: 0x115c3, Stride: 0x1},
+		unicode.Range32{Lo: 0x115c9, Hi: 0x115d7, Stride: 0x1},
+		unicode.Range32{Lo: 0x11641, Hi: 0x11642, Stride: 0x1},
+		unicode.Range32{Lo: 0x1173c, Hi: 0x1173e, Stride: 0x1},
+		unicode.Range32{Lo: 0x11944, Hi: 0x11944, Stride: 0x1},
+		unicode.Range32{Lo: 0x11946, Hi: 0x11946, Stride: 0x1},
+		unicode.Range32{Lo: 0x11a42, Hi: 0x11a43, Stride: 0x1},
+		unicode.Range32{Lo: 0x11a9b, Hi: 0x11a9c, Stride: 0x1},
+		unicode.Range32{Lo: 0x11c41, Hi: 0x11c42, Stride: 0x1},
+		unicode.Range32{Lo: 0x11ef7, Hi: 0x11ef8, Stride: 0x1},
+		unicode.Range32{Lo: 0x11f43, Hi: 0x11f44, Stride: 0x1},
+		unicode.Range32{Lo: 0x16a6e, Hi: 0x16a6f, Stride: 0x1},
+		unicode.Range32{Lo: 0x16af5, Hi: 0x16af5, Stride: 0x1},
+		unicode.Range32{Lo: 0x16b37, Hi: 0x16b38, Stride: 0x1},
+		unicode.Range32{Lo: 0x16b44, Hi: 0x16b44, Stride: 0x1},
+		unicode.Range32{Lo: 0x16e98, Hi: 0x16e98, Stride: 0x1},
+		unicode.Range32{Lo: 0x1bc9f, Hi: 0x1bc9f, Stride: 0x1},
+		unicode.Range32{Lo: 0x1da88, Hi: 0x1da88, Stride: 0x1},
+	},
+	LatinOffset: 2,
+}
+
+var _SentenceSep = &unicode.RangeTable{
+	R16: []unicode.Range16{
+		unicode.Range16{Lo: 0x85, Hi: 0x85, Stride: 0x1},
+		unicode.Range16{Lo: 0x2028, Hi: 0x2028, Stride: 0x1},
+		unicode.Range16{Lo: 0x2029, Hi: 0x2029, Stride: 0x1},
+	},
+	LatinOffset: 1,
+}
+
+var _SentenceSp = &unicode.RangeTable{
+	R16: []unicode.Range16{
+		unicode.Range16{Lo: 0x9, Hi: 0x9, Stride: 0x1},
+		unicode.Range16{Lo: 0xb, Hi: 0xc, Stride: 0x1},
+		unicode.Range16{Lo: 0x20, Hi: 0x20, Stride: 0x1},
+		unicode.Range16{Lo: 0xa0, Hi: 0xa0, Stride: 0x1},
+		unicode.Range16{Lo: 0x1680, Hi: 0x1680, Stride: 0x1},
+		unicode.Range16{Lo: 0x2000, Hi: 0x200a, Stride: 0x1},
+		unicode.Range16{Lo: 0x202f, Hi: 0x202f, Stride: 0x1},
+		unicode.Range16{Lo: 0x205f, Hi: 0x205f, Stride: 0x1},
+		unicode.Range16{Lo: 0x3000, Hi: 0x3000, Stride: 0x1},
+	},
+	LatinOffset: 4,
+}
+
+var _SentenceUpper = &unicode.RangeTable{
+	R16: []unicode.Range16{
+		unicode.Range16{Lo: 0x41, Hi: 0x5a, Stride: 0x1},
+		unicode.Range16{Lo: 0xc0, Hi: 0xd6, Stride: 0x1},
+		unicode.Range16{Lo: 0xd8, Hi: 0xde, Stride: 0x1},
+		unicode.Range16{Lo: 0x100, Hi: 0x100, Stride: 0x1},
+		unicode.Range16{Lo: 0x102, Hi: 0x102, Stride: 0x1},
+		unicode.Range16{Lo: 0x104, Hi: 0x104, Stride: 0x1},
+		unicode.Range16{Lo: 0x106, Hi: 0x106, Stride: 0x1},
+		unicode.Range16{Lo: 0x108, Hi: 0x108, Stride: 0x1},
+		unicode.Range16{Lo: 0x10a, Hi: 0x10a, Stride: 0x1},
+		unicode.Range16{Lo: 0x10c, Hi: 0x10c, Stride: 0x1},
+		unicode.Range16{Lo: 0x10e, Hi: 0x10e, Stride: 0x1},
+		unicode.Range16{Lo: 0x110, Hi: 0x110, Stride: 0x1},
+		unicode.Range16{Lo: 0x112, Hi: 0x112, Stride: 0x1},
+		unicode.Range16{Lo: 0x114, Hi: 0x114, Stride: 0x1},
+		unicode.Range16{Lo: 0x116, Hi: 0x116, Stride: 0x1},
+		unicode.Range16{Lo: 0x118, Hi: 0x118, Stride: 0x1},
+		unicode.Range16{Lo: 0x11a, Hi: 0x11a, Stride: 0x1},
+		unicode.Range16{Lo: 0x11c, Hi: 0x11c, Stride: 0x1},
+		unicode.Range16{Lo: 0x11e, Hi: 0x11e, Stride: 0x1},
+		unicode.Range16{Lo: 0x120, Hi: 0x120, Stride: 0x1},
+		unicode.Range16{Lo: 0x122, Hi: 0x122, Stride: 0x1},
+		unicode.Range16{Lo: 0x124, Hi: 0x124, Stride: 0x1},
+		unicode.Range16{Lo: 0x126, Hi: 0x126, Stride: 0x1},
+		unicode.Range16{Lo: 0x128, Hi: 0x128, Stride: 0x1},
+		unicode.Range16{Lo: 0x12a, Hi: 0x12a, Stride: 0x1},
+		unicode.Range16{Lo: 0x12c, Hi: 0x12c, Stride: 0x1},
+		unicode.Range16{Lo: 0x12e, Hi: 0x12e, Stride: 0x1},
+		unicode.Range16{Lo: 0x130, Hi: 0x130, Stride: 0x1},
+		unicode.Range16{Lo: 0x132, Hi: 0x132, Stride: 0x1},
+		unicode.Range16{Lo: 0x134, Hi: 0x134, Stride: 0x1},
+		unicode.Range16{Lo: 0x136, Hi: 0x136, Stride: 0x1},
+		unicode.Range16{Lo: 0x139, Hi: 0x139, Stride: 0x1},
+		unicode.Range16{Lo: 0x13b, Hi: 0x13b, Stride: 0x1},
+		unicode.Range16{Lo: 0x13d, Hi: 0x13d, Stride: 0x1},
+		unicode.Range16{Lo: 0x13f, Hi: 0x13f, Stride: 0x1},
+		unicode.Range16{Lo: 0x141, Hi: 0x141, Stride: 0x1},
+		unicode.Range16{Lo: 0x143, Hi: 0x143, Stride: 0x1},
+		unicode.Range16{Lo: 0x145, Hi: 0x145, Stride: 0x1},
+		unicode.Range16{Lo: 0x147, Hi: 0x147, Stride: 0x1},
+		unicode.Range16{Lo: 0x14a, Hi: 0x14a, Stride: 0x1},
+		unicode.Range16{Lo: 0x14c, Hi: 0x14c, Stride: 0x1},
+		unicode.Range16{Lo: 0x14e, Hi: 0x14e, Stride: 0x1},
+		unicode.Range16{Lo: 0x150, Hi: 0x150, Stride: 0x1},
+		unicode.Range16{Lo: 0x152, Hi: 0x152, Stride: 0x1},
+		unicode.Range16{Lo: 0x154, Hi: 0x154, Stride: 0x1},
+		unicode.Range16{Lo: 0x156, Hi: 0x156, Stride: 0x1},
+		unicode.Range16{Lo: 0x158, Hi: 0x158, Stride: 0x1},
+		unicode.Range16{Lo: 0x15a, Hi: 0x15a, Stride: 0x1},
+		unicode.Range16{Lo: 0x15c, Hi: 0x15c, Stride: 0x1},
+		unicode.Range16{Lo: 0x15e, Hi: 0x15e, Stride: 0x1},
+		unicode.Range16{Lo: 0x160, Hi: 0x160, Stride: 0x1},
+		unicode.Range16{Lo: 0x162, Hi: 0x162, Stride: 0x1},
+		unicode.Range16{Lo: 0x164, Hi: 0x164, Stride: 0x1},
+		unicode.Range16{Lo: 0x166, Hi: 0x166, Stride: 0x1},
+		unicode.Range16{Lo: 0x168, Hi: 0x168, Stride: 0x1},
+		unicode.Range16{Lo: 0x16a, Hi: 0x16a, Stride: 0x1},
+		unicode.Range16{Lo: 0x16c, Hi: 0x16c, Stride: 0x1},
+		unicode.Range16{Lo: 0x16e, Hi: 0x16e, Stride: 0x1},
+		unicode.Range16{Lo: 0x170, Hi: 0x170, Stride: 0x1},
+		unicode.Range16{Lo: 0x172, Hi: 0x172, Stride: 0x1},
+		unicode.Range16{Lo: 0x174, Hi: 0x174, Stride: 0x1},
+		unicode.Range16{Lo: 0x176, Hi: 0x176, Stride: 0x1},
+		unicode.Range16{Lo: 0x178, Hi: 0x179, Stride: 0x1},
+		unicode.Range16{Lo: 0x17b, Hi: 0x17b, Stride: 0x1},
+		unicode.Range16{Lo: 0x17d, Hi: 0x17d, Stride: 0x1},
+		unicode.Range16{Lo: 0x181, Hi: 0x182, Stride: 0x1},
+		unicode.Range16{Lo: 0x184, Hi: 0x184, Stride: 0x1},
+		unicode.Range16{Lo: 0x186, Hi: 0x187, Stride: 0x1},
+		unicode.Range16{Lo: 0x189, Hi: 0x18b, Stride: 0x1},
+		unicode.Range16{Lo: 0x18e, Hi: 0x191, Stride: 0x1},
+		unicode.Range16{Lo: 0x193, Hi: 0x194, Stride: 0x1},
+		unicode.Range16{Lo: 0x196, Hi: 0x198, Stride: 0x1},
+		unicode.Range16{Lo: 0x19c, Hi: 0x19d, Stride: 0x1},
+		unicode.Range16{Lo: 0x19f, Hi: 0x1a0, Stride: 0x1},
+		unicode.Range16{Lo: 0x1a2, Hi: 0x1a2, Stride: 0x1},
+		unicode.Range16{Lo: 0x1a4, Hi: 0x1a4, Stride: 0x1},
+		unicode.Range16{Lo: 0x1a6, Hi: 0x1a7, Stride: 0x1},
+		unicode.Range16{Lo: 0x1a9, Hi: 0x1a9, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ac, Hi: 0x1ac, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ae, Hi: 0x1af, Stride: 0x1},
+		unicode.Range16{Lo: 0x1b1, Hi: 0x1b3, Stride: 0x1},
+		unicode.Range16{Lo: 0x1b5, Hi: 0x1b5, Stride: 0x1},
+		unicode.Range16{Lo: 0x1b7, Hi: 0x1b8, Stride: 0x1},
+		unicode.Range16{Lo: 0x1bc, Hi: 0x1bc, Stride: 0x1},
+		unicode.Range16{Lo: 0x1c4, Hi: 0x1c5, Stride: 0x1},
+		unicode.Range16{Lo: 0x1c7, Hi: 0x1c8, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ca, Hi: 0x1cb, Stride: 0x1},
+		unicode.Range16{Lo: 0x1cd, Hi: 0x1cd, Stride: 0x1},
+		unicode.Range16{Lo: 0x1cf, Hi: 0x1cf, Stride: 0x1},
+		unicode.Range16{Lo: 0x1d1, Hi: 0x1d1, Stride: 0x1},
+		unicode.Range16{Lo: 0x1d3, Hi: 0x1d3, Stride: 0x1},
+		unicode.Range16{Lo: 0x1d5, Hi: 0x1d5, Stride: 0x1},
+		unicode.Range16{Lo: 0x1d7, Hi: 0x1d7, Stride: 0x1},
+		unicode.Range16{Lo: 0x1d9, Hi: 0x1d9, Stride: 0x1},
+		unicode.Range16{Lo: 0x1db, Hi: 0x1db, Stride: 0x1},
+		unicode.Range16{Lo: 0x1de, Hi: 0x1de, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e0, Hi: 0x1e0, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e2, Hi: 0x1e2, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e4, Hi: 0x1e4, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e6, Hi: 0x1e6, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e8, Hi: 0x1e8, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ea, Hi: 0x1ea, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ec, Hi: 0x1ec, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ee, Hi: 0x1ee, Stride: 0x1},
+		unicode.Range16{Lo: 0x1f1, Hi: 0x1f2, Stride: 0x1},
+		unicode.Range16{Lo: 0x1f4, Hi: 0x1f4, Stride: 0x1},
+		unicode.Range16{Lo: 0x1f6, Hi: 0x1f8, Stride: 0x1},
+		unicode.Range16{Lo: 0x1fa, Hi: 0x1fa, Stride: 0x1},
+		unicode.Range16{Lo: 0x1fc, Hi: 0x1fc, Stride: 0x1},
+		unicode.Range16{Lo: 0x1fe, Hi: 0x1fe, Stride: 0x1},
+		unicode.Range16{Lo: 0x200, Hi: 0x200, Stride: 0x1},
+		unicode.Range16{Lo: 0x202, Hi: 0x202, Stride: 0x1},
+		unicode.Range16{Lo: 0x204, Hi: 0x204, Stride: 0x1},
+		unicode.Range16{Lo: 0x206, Hi: 0x206, Stride: 0x1},
+		unicode.Range16{Lo: 0x208, Hi: 0x208, Stride: 0x1},
+		unicode.Range16{Lo: 0x20a, Hi: 0x20a, Stride: 0x1},
+		unicode.Range16{Lo: 0x20c, Hi: 0x20c, Stride: 0x1},
+		unicode.Range16{Lo: 0x20e, Hi: 0x20e, Stride: 0x1},
+		unicode.Range16{Lo: 0x210, Hi: 0x210, Stride: 0x1},
+		unicode.Range16{Lo: 0x212, Hi: 0x212, Stride: 0x1},
+		unicode.Range16{Lo: 0x214, Hi: 0x214, Stride: 0x1},
+		unicode.Range16{Lo: 0x216, Hi: 0x216, Stride: 0x1},
+		unicode.Range16{Lo: 0x218, Hi: 0x218, Stride: 0x1},
+		unicode.Range16{Lo: 0x21a, Hi: 0x21a, Stride: 0x1},
+		unicode.Range16{Lo: 0x21c, Hi: 0x21c, Stride: 0x1},
+		unicode.Range16{Lo: 0x21e, Hi: 0x21e, Stride: 0x1},
+		unicode.Range16{Lo: 0x220, Hi: 0x220, Stride: 0x1},
+		unicode.Range16{Lo: 0x222, Hi: 0x222, Stride: 0x1},
+		unicode.Range16{Lo: 0x224, Hi: 0x224, Stride: 0x1},
+		unicode.Range16{Lo: 0x226, Hi: 0x226, Stride: 0x1},
+		unicode.Range16{Lo: 0x228, Hi: 0x228, Stride: 0x1},
+		unicode.Range16{Lo: 0x22a, Hi: 0x22a, Stride: 0x1},
+		unicode.Range16{Lo: 0x22c, Hi: 0x22c, Stride: 0x1},
+		unicode.Range16{Lo: 0x22e, Hi: 0x22e, Stride: 0x1},
+		unicode.Range16{Lo: 0x230, Hi: 0x230, Stride: 0x1},
+		unicode.Range16{Lo: 0x232, Hi: 0x232, Stride: 0x1},
+		unicode.Range16{Lo: 0x23a, Hi: 0x23b, Stride: 0x1},
+		unicode.Range16{Lo: 0x23d, Hi: 0x23e, Stride: 0x1},
+		unicode.Range16{Lo: 0x241, Hi: 0x241, Stride: 0x1},
+		unicode.Range16{Lo: 0x243, Hi: 0x246, Stride: 0x1},
+		unicode.Range16{Lo: 0x248, Hi: 0x248, Stride: 0x1},
+		unicode.Range16{Lo: 0x24a, Hi: 0x24a, Stride: 0x1},
+		unicode.Range16{Lo: 0x24c, Hi: 0x24c, Stride: 0x1},
+		unicode.Range16{Lo: 0x24e, Hi: 0x24e, Stride: 0x1},
+		unicode.Range16{Lo: 0x370, Hi: 0x370, Stride: 0x1},
+		unicode.Range16{Lo: 0x372, Hi: 0x372, Stride: 0x1},
+		unicode.Range16{Lo: 0x376, Hi: 0x376, Stride: 0x1},
+		unicode.Range16{Lo: 0x37f, Hi: 0x37f, Stride: 0x1},
+		unicode.Range16{Lo: 0x386, Hi: 0x386, Stride: 0x1},
+		unicode.Range16{Lo: 0x388, Hi: 0x38a, Stride: 0x1},
+		unicode.Range16{Lo: 0x38c, Hi: 0x38c, Stride: 0x1},
+		unicode.Range16{Lo: 0x38e, Hi: 0x38f, Stride: 0x1},
+		unicode.Range16{Lo: 0x391, Hi: 0x3a1, Stride: 0x1},
+		unicode.Range16{Lo: 0x3a3, Hi: 0x3ab, Stride: 0x1},
+		unicode.Range16{Lo: 0x3cf, Hi: 0x3cf, Stride: 0x1},
+		unicode.Range16{Lo: 0x3d2, Hi: 0x3d4, Stride: 0x1},
+		unicode.Range16{Lo: 0x3d8, Hi: 0x3d8, Stride: 0x1},
+		unicode.Range16{Lo: 0x3da, Hi: 0x3da, Stride: 0x1},
+		unicode.Range16{Lo: 0x3dc, Hi: 0x3dc, Stride: 0x1},
+		unicode.Range16{Lo: 0x3de, Hi: 0x3de, Stride: 0x1},
+		unicode.Range16{Lo: 0x3e0, Hi: 0x3e0, Stride: 0x1},
+		unicode.Range16{Lo: 0x3e2, Hi: 0x3e2, Stride: 0x1},
+		unicode.Range16{Lo: 0x3e4, Hi: 0x3e4, Stride: 0x1},
+		unicode.Range16{Lo: 0x3e6, Hi: 0x3e6, Stride: 0x1},
+		unicode.Range16{Lo: 0x3e8, Hi: 0x3e8, Stride: 0x1},
+		unicode.Range16{Lo: 0x3ea, Hi: 0x3ea, Stride: 0x1},
+		unicode.Range16{Lo: 0x3ec, Hi: 0x3ec, Stride: 0x1},
+		unicode.Range16{Lo: 0x3ee, Hi: 0x3ee, Stride: 0x1},
+		unicode.Range16{Lo: 0x3f4, Hi: 0x3f4, Stride: 0x1},
+		unicode.Range16{Lo: 0x3f7, Hi: 0x3f7, Stride: 0x1},
+		unicode.Range16{Lo: 0x3f9, Hi: 0x3fa, Stride: 0x1},
+		unicode.Range16{Lo: 0x3fd, Hi: 0x42f, Stride: 0x1},
+		unicode.Range16{Lo: 0x460, Hi: 0x460, Stride: 0x1},
+		unicode.Range16{Lo: 0x462, Hi: 0x462, Stride: 0x1},
+		unicode.Range16{Lo: 0x464, Hi: 0x464, Stride: 0x1},
+		unicode.Range16{Lo: 0x466, Hi: 0x466, Stride: 0x1},
+		unicode.Range16{Lo: 0x468, Hi: 0x468, Stride: 0x1},
+		unicode.Range16{Lo: 0x46a, Hi: 0x46a, Stride: 0x1},
+		unicode.Range16{Lo: 0x46c, Hi: 0x46c, Stride: 0x1},
+		unicode.Range16{Lo: 0x46e, Hi: 0x46e, Stride: 0x1},
+		unicode.Range16{Lo: 0x470, Hi: 0x470, Stride: 0x1},
+		unicode.Range16{Lo: 0x472, Hi: 0x472, Stride: 0x1},
+		unicode.Range16{Lo: 0x474, Hi: 0x474, Stride: 0x1},
+		unicode.Range16{Lo: 0x476, Hi: 0x476, Stride: 0x1},
+		unicode.Range16{Lo: 0x478, Hi: 0x478, Stride: 0x1},
+		unicode.Range16{Lo: 0x47a, Hi: 0x47a, Stride: 0x1},
+		unicode.Range16{Lo: 0x47c, Hi: 0x47c, Stride: 0x1},
+		unicode.Range16{Lo: 0x47e, Hi: 0x47e, Stride: 0x1},
+		unicode.Range16{Lo: 0x480, Hi: 0x480, Stride: 0x1},
+		unicode.Range16{Lo: 0x48a, Hi: 0x48a, Stride: 0x1},
+		unicode.Range16{Lo: 0x48c, Hi: 0x48c, Stride: 0x1},
+		unicode.Range16{Lo: 0x48e, Hi: 0x48e, Stride: 0x1},
+		unicode.Range16{Lo: 0x490, Hi: 0x490, Stride: 0x1},
+		unicode.Range16{Lo: 0x492, Hi: 0x492, Stride: 0x1},
+		unicode.Range16{Lo: 0x494, Hi: 0x494, Stride: 0x1},
+		unicode.Range16{Lo: 0x496, Hi: 0x496, Stride: 0x1},
+		unicode.Range16{Lo: 0x498, Hi: 0x498, Stride: 0x1},
+		unicode.Range16{Lo: 0x49a, Hi: 0x49a, Stride: 0x1},
+		unicode.Range16{Lo: 0x49c, Hi: 0x49c, Stride: 0x1},
+		unicode.Range16{Lo: 0x49e, Hi: 0x49e, Stride: 0x1},
+		unicode.Range16{Lo: 0x4a0, Hi: 0x4a0, Stride: 0x1},
+		unicode.Range16{Lo: 0x4a2, Hi: 0x4a2, Stride: 0x1},
+		unicode.Range16{Lo: 0x4a4, Hi: 0x4a4, Stride: 0x1},
+		unicode.Range16{Lo: 0x4a6, Hi: 0x4a6, Stride: 0x1},
+		unicode.Range16{Lo: 0x4a8, Hi: 0x4a8, Stride: 0x1},
+		unicode.Range16{Lo: 0x4aa, Hi: 0x4aa, Stride: 0x1},
+		unicode.Range16{Lo: 0x4ac, Hi: 0x4ac, Stride: 0x1},
+		unicode.Range16{Lo: 0x4ae, Hi: 0x4ae, Stride: 0x1},
+		unicode.Range16{Lo: 0x4b0, Hi: 0x4b0, Stride: 0x1},
+		unicode.Range16{Lo: 0x4b2, Hi: 0x4b2, Stride: 0x1},
+		unicode.Range16{Lo: 0x4b4, Hi: 0x4b4, Stride: 0x1},
+		unicode.Range16{Lo: 0x4b6, Hi: 0x4b6, Stride: 0x1},
+		unicode.Range16{Lo: 0x4b8, Hi: 0x4b8, Stride: 0x1},
+		unicode.Range16{Lo: 0x4ba, Hi: 0x4ba, Stride: 0x1},
+		unicode.Range16{Lo: 0x4bc, Hi: 0x4bc, Stride: 0x1},
+		unicode.Range16{Lo: 0x4be, Hi: 0x4be, Stride: 0x1},
+		unicode.Range16{Lo: 0x4c0, Hi: 0x4c1, Stride: 0x1},
+		unicode.Range16{Lo: 0x4c3, Hi: 0x4c3, Stride: 0x1},
+		unicode.Range16{Lo: 0x4c5, Hi: 0x4c5, Stride: 0x1},
+		unicode.Range16{Lo: 0x4c7, Hi: 0x4c7, Stride: 0x1},
+		unicode.Range16{Lo: 0x4c9, Hi: 0x4c9, Stride: 0x1},
+		unicode.Range16{Lo: 0x4cb, Hi: 0x4cb, Stride: 0x1},
+		unicode.Range16{Lo: 0x4cd, Hi: 0x4cd, Stride: 0x1},
+		unicode.Range16{Lo: 0x4d0, Hi: 0x4d0, Stride: 0x1},
+		unicode.Range16{Lo: 0x4d2, Hi: 0x4d2, Stride: 0x1},
+		unicode.Range16{Lo: 0x4d4, Hi: 0x4d4, Stride: 0x1},
+		unicode.Range16{Lo: 0x4d6, Hi: 0x4d6, Stride: 0x1},
+		unicode.Range16{Lo: 0x4d8, Hi: 0x4d8, Stride: 0x1},
+		unicode.Range16{Lo: 0x4da, Hi: 0x4da, Stride: 0x1},
+		unicode.Range16{Lo: 0x4dc, Hi: 0x4dc, Stride: 0x1},
+		unicode.Range16{Lo: 0x4de, Hi: 0x4de, Stride: 0x1},
+		unicode.Range16{Lo: 0x4e0, Hi: 0x4e0, Stride: 0x1},
+		unicode.Range16{Lo: 0x4e2, Hi: 0x4e2, Stride: 0x1},
+		unicode.Range16{Lo: 0x4e4, Hi: 0x4e4, Stride: 0x1},
+		unicode.Range16{Lo: 0x4e6, Hi: 0x4e6, Stride: 0x1},
+		unicode.Range16{Lo: 0x4e8, Hi: 0x4e8, Stride: 0x1},
+		unicode.Range16{Lo: 0x4ea, Hi: 0x4ea, Stride: 0x1},
+		unicode.Range16{Lo: 0x4ec, Hi: 0x4ec, Stride: 0x1},
+		unicode.Range16{Lo: 0x4ee, Hi: 0x4ee, Stride: 0x1},
+		unicode.Range16{Lo: 0x4f0, Hi: 0x4f0, Stride: 0x1},
+		unicode.Range16{Lo: 0x4f2, Hi: 0x4f2, Stride: 0x1},
+		unicode.Range16{Lo: 0x4f4, Hi: 0x4f4, Stride: 0x1},
+		unicode.Range16{Lo: 0x4f6, Hi: 0x4f6, Stride: 0x1},
+		unicode.Range16{Lo: 0x4f8, Hi: 0x4f8, Stride: 0x1},
+		unicode.Range16{Lo: 0x4fa, Hi: 0x4fa, Stride: 0x1},
+		unicode.Range16{Lo: 0x4fc, Hi: 0x4fc, Stride: 0x1},
+		unicode.Range16{Lo: 0x4fe, Hi: 0x4fe, Stride: 0x1},
+		unicode.Range16{Lo: 0x500, Hi: 0x500, Stride: 0x1},
+		unicode.Range16{Lo: 0x502, Hi: 0x502, Stride: 0x1},
+		unicode.Range16{Lo: 0x504, Hi: 0x504, Stride: 0x1},
+		unicode.Range16{Lo: 0x506, Hi: 0x506, Stride: 0x1},
+		unicode.Range16{Lo: 0x508, Hi: 0x508, Stride: 0x1},
+		unicode.Range16{Lo: 0x50a, Hi: 0x50a, Stride: 0x1},
+		unicode.Range16{Lo: 0x50c, Hi: 0x50c, Stride: 0x1},
+		unicode.Range16{Lo: 0x50e, Hi: 0x50e, Stride: 0x1},
+		unicode.Range16{Lo: 0x510, Hi: 0x510, Stride: 0x1},
+		unicode.Range16{Lo: 0x512, Hi: 0x512, Stride: 0x1},
+		unicode.Range16{Lo: 0x514, Hi: 0x514, Stride: 0x1},
+		unicode.Range16{Lo: 0x516, Hi: 0x516, Stride: 0x1},
+		unicode.Range16{Lo: 0x518, Hi: 0x518, Stride: 0x1},
+		unicode.Range16{Lo: 0x51a, Hi: 0x51a, Stride: 0x1},
+		unicode.Range16{Lo: 0x51c, Hi: 0x51c, Stride: 0x1},
+		unicode.Range16{Lo: 0x51e, Hi: 0x51e, Stride: 0x1},
+		unicode.Range16{Lo: 0x520, Hi: 0x520, Stride: 0x1},
+		unicode.Range16{Lo: 0x522, Hi: 0x522, Stride: 0x1},
+		unicode.Range16{Lo: 0x524, Hi: 0x524, Stride: 0x1},
+		unicode.Range16{Lo: 0x526, Hi: 0x526, Stride: 0x1},
+		unicode.Range16{Lo: 0x528, Hi: 0x528, Stride: 0x1},
+		unicode.Range16{Lo: 0x52a, Hi: 0x52a, Stride: 0x1},
+		unicode.Range16{Lo: 0x52c, Hi: 0x52c, Stride: 0x1},
+		unicode.Range16{Lo: 0x52e, Hi: 0x52e, Stride: 0x1},
+		unicode.Range16{Lo: 0x531, Hi: 0x556, Stride: 0x1},
+		unicode.Range16{Lo: 0x10a0, Hi: 0x10c5, Stride: 0x1},
+		unicode.Range16{Lo: 0x10c7, Hi: 0x10c7, Stride: 0x1},
+		unicode.Range16{Lo: 0x10cd, Hi: 0x10cd, Stride: 0x1},
+		unicode.Range16{Lo: 0x13a0, Hi: 0x13f5, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e00, Hi: 0x1e00, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e02, Hi: 0x1e02, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e04, Hi: 0x1e04, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e06, Hi: 0x1e06, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e08, Hi: 0x1e08, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e0a, Hi: 0x1e0a, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e0c, Hi: 0x1e0c, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e0e, Hi: 0x1e0e, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e10, Hi: 0x1e10, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e12, Hi: 0x1e12, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e14, Hi: 0x1e14, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e16, Hi: 0x1e16, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e18, Hi: 0x1e18, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e1a, Hi: 0x1e1a, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e1c, Hi: 0x1e1c, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e1e, Hi: 0x1e1e, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e20, Hi: 0x1e20, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e22, Hi: 0x1e22, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e24, Hi: 0x1e24, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e26, Hi: 0x1e26, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e28, Hi: 0x1e28, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e2a, Hi: 0x1e2a, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e2c, Hi: 0x1e2c, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e2e, Hi: 0x1e2e, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e30, Hi: 0x1e30, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e32, Hi: 0x1e32, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e34, Hi: 0x1e34, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e36, Hi: 0x1e36, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e38, Hi: 0x1e38, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e3a, Hi: 0x1e3a, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e3c, Hi: 0x1e3c, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e3e, Hi: 0x1e3e, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e40, Hi: 0x1e40, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e42, Hi: 0x1e42, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e44, Hi: 0x1e44, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e46, Hi: 0x1e46, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e48, Hi: 0x1e48, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e4a, Hi: 0x1e4a, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e4c, Hi: 0x1e4c, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e4e, Hi: 0x1e4e, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e50, Hi: 0x1e50, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e52, Hi: 0x1e52, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e54, Hi: 0x1e54, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e56, Hi: 0x1e56, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e58, Hi: 0x1e58, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e5a, Hi: 0x1e5a, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e5c, Hi: 0x1e5c, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e5e, Hi: 0x1e5e, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e60, Hi: 0x1e60, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e62, Hi: 0x1e62, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e64, Hi: 0x1e64, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e66, Hi: 0x1e66, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e68, Hi: 0x1e68, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e6a, Hi: 0x1e6a, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e6c, Hi: 0x1e6c, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e6e, Hi: 0x1e6e, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e70, Hi: 0x1e70, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e72, Hi: 0x1e72, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e74, Hi: 0x1e74, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e76, Hi: 0x1e76, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e78, Hi: 0x1e78, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e7a, Hi: 0x1e7a, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e7c, Hi: 0x1e7c, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e7e, Hi: 0x1e7e, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e80, Hi: 0x1e80, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e82, Hi: 0x1e82, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e84, Hi: 0x1e84, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e86, Hi: 0x1e86, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e88, Hi: 0x1e88, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e8a, Hi: 0x1e8a, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e8c, Hi: 0x1e8c, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e8e, Hi: 0x1e8e, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e90, Hi: 0x1e90, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e92, Hi: 0x1e92, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e94, Hi: 0x1e94, Stride: 0x1},
+		unicode.Range16{Lo: 0x1e9e, Hi: 0x1e9e, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ea0, Hi: 0x1ea0, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ea2, Hi: 0x1ea2, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ea4, Hi: 0x1ea4, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ea6, Hi: 0x1ea6, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ea8, Hi: 0x1ea8, Stride: 0x1},
+		unicode.Range16{Lo: 0x1eaa, Hi: 0x1eaa, Stride: 0x1},
+		unicode.Range16{Lo: 0x1eac, Hi: 0x1eac, Stride: 0x1},
+		unicode.Range16{Lo: 0x1eae, Hi: 0x1eae, Stride: 0x1},
+		unicode.Range16{Lo: 0x1eb0, Hi: 0x1eb0, Stride: 0x1},
+		unicode.Range16{Lo: 0x1eb2, Hi: 0x1eb2, Stride: 0x1},
+		unicode.Range16{Lo: 0x1eb4, Hi: 0x1eb4, Stride: 0x1},
+		unicode.Range16{Lo: 0x1eb6, Hi: 0x1eb6, Stride: 0x1},
+		unicode.Range16{Lo: 0x1eb8, Hi: 0x1eb8, Stride: 0x1},
+		unicode.Range16{Lo: 0x1eba, Hi: 0x1eba, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ebc, Hi: 0x1ebc, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ebe, Hi: 0x1ebe, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ec0, Hi: 0x1ec0, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ec2, Hi: 0x1ec2, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ec4, Hi: 0x1ec4, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ec6, Hi: 0x1ec6, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ec8, Hi: 0x1ec8, Stride: 0x1},
+		unicode.Range16{Lo: 0x1eca, Hi: 0x1eca, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ecc, Hi: 0x1ecc, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ece, Hi: 0x1ece, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ed0, Hi: 0x1ed0, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ed2, Hi: 0x1ed2, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ed4, Hi: 0x1ed4, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ed6, Hi: 0x1ed6, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ed8, Hi: 0x1ed8, Stride: 0x1},
+		unicode.Range16{Lo: 0x1eda, Hi: 0x1eda, Stride: 0x1},
+		unicode.Range16{Lo: 0x1edc, Hi: 0x1edc, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ede, Hi: 0x1ede, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ee0, Hi: 0x1ee0, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ee2, Hi: 0x1ee2, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ee4, Hi: 0x1ee4, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ee6, Hi: 0x1ee6, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ee8, Hi: 0x1ee8, Stride: 0x1},
+		unicode.Range16{Lo: 0x1eea, Hi: 0x1eea, Stride: 0x1},
+		unicode.Range16{Lo: 0x1eec, Hi: 0x1eec, Stride: 0x1},
+		unicode.Range16{Lo: 0x1eee, Hi: 0x1eee, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ef0, Hi: 0x1ef0, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ef2, Hi: 0x1ef2, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ef4, Hi: 0x1ef4, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ef6, Hi: 0x1ef6, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ef8, Hi: 0x1ef8, Stride: 0x1},
+		unicode.Range16{Lo: 0x1efa, Hi: 0x1efa, Stride: 0x1},
+		unicode.Range16{Lo: 0x1efc, Hi: 0x1efc, Stride: 0x1},
+		unicode.Range16{Lo: 0x1efe, Hi: 0x1efe, Stride: 0x1},
+		unicode.Range16{Lo: 0x1f08, Hi: 0x1f0f, Stride: 0x1},
+		unicode.Range16{Lo: 0x1f18, Hi: 0x1f1d, Stride: 0x1},
+		unicode.Range16{Lo: 0x1f28, Hi: 0x1f2f, Stride: 0x1},
+		unicode.Range16{Lo: 0x1f38, Hi: 0x1f3f, Stride: 0x1},
+		unicode.Range16{Lo: 0x1f48, Hi: 0x1f4d, Stride: 0x1},
+		unicode.Range16{Lo: 0x1f59, Hi: 0x1f59, Stride: 0x1},
+		unicode.Range16{Lo: 0x1f5b, Hi: 0x1f5b, Stride: 0x1},
+		unicode.Range16{Lo: 0x1f5d, Hi: 0x1f5d, Stride: 0x1},
+		unicode.Range16{Lo: 0x1f5f, Hi: 0x1f5f, Stride: 0x1},
+		unicode.Range16{Lo: 0x1f68, Hi: 0x1f6f, Stride: 0x1},
+		unicode.Range16{Lo: 0x1f88, Hi: 0x1f8f, Stride: 0x1},
+		unicode.Range16{Lo: 0x1f98, Hi: 0x1f9f, Stride: 0x1},
+		unicode.Range16{Lo: 0x1fa8, Hi: 0x1faf, Stride: 0x1},
+		unicode.Range16{Lo: 0x1fb8, Hi: 0x1fbc, Stride: 0x1},
+		unicode.Range16{Lo: 0x1fc8, Hi: 0x1fcc, Stride: 0x1},
+		unicode.Range16{Lo: 0x1fd8, Hi: 0x1fdb, Stride: 0x1},
+		unicode.Range16{Lo: 0x1fe8, Hi: 0x1fec, Stride: 0x1},
+		unicode.Range16{Lo: 0x1ff8, Hi: 0x1ffc, Stride: 0x1},
+		unicode.Range16{Lo: 0x2102, Hi: 0x2102, Stride: 0x1},
+		unicode.Range16{Lo: 0x2107, Hi: 0x2107, Stride: 0x1},
+		unicode.Range16{Lo: 0x210b, Hi: 0x210d, Stride: 0x1},
+		unicode.Range16{Lo: 0x2110, Hi: 0x2112, Stride: 0x1},
+		unicode.Range16{Lo: 0x2115, Hi: 0x2115, Stride: 0x1},
+		unicode.Range16{Lo: 0x2119, Hi: 0x211d, Stride: 0x1},
+		unicode.Range16{Lo: 0x2124, Hi: 0x2124, Stride: 0x1},
+		unicode.Range16{Lo: 0x2126, Hi: 0x2126, Stride: 0x1},
+		unicode.Range16{Lo: 0x2128, Hi: 0x2128, Stride: 0x1},
+		unicode.Range16{Lo: 0x212a, Hi: 0x212d, Stride: 0x1},
+		unicode.Range16{Lo: 0x2130, Hi: 0x2133, Stride: 0x1},
+		unicode.Range16{Lo: 0x213e, Hi: 0x213f, Stride: 0x1},
+		unicode.Range16{Lo: 0x2145, Hi: 0x2145, Stride: 0x1},
+		unicode.Range16{Lo: 0x2160, Hi: 0x216f, Stride: 0x1},
+		unicode.Range16{Lo: 0x2183, Hi: 0x2183, Stride: 0x1},
+		unicode.Range16{Lo: 0x24b6, Hi: 0x24cf, Stride: 0x1},
+		unicode.Range16{Lo: 0x2c00, Hi: 0x2c2f, Stride: 0x1},
+		unicode.Range16{Lo: 0x2c60, Hi: 0x2c60, Stride: 0x1},
+		unicode.Range16{Lo: 0x2c62, Hi: 0x2c64, Stride: 0x1},
+		unicode.Range16{Lo: 0x2c67, Hi: 0x2c67, Stride: 0x1},
+		unicode.Range16{Lo: 0x2c69, Hi: 0x2c69, Stride: 0x1},
+		unicode.Range16{Lo: 0x2c6b, Hi: 0x2c6b, Stride: 0x1},
+		unicode.Range16{Lo: 0x2c6d, Hi: 0x2c70, Stride: 0x1},
+		unicode.Range16{Lo: 0x2c72, Hi: 0x2c72, Stride: 0x1},
+		unicode.Range16{Lo: 0x2c75, Hi: 0x2c75, Stride: 0x1},
+		unicode.Range16{Lo: 0x2c7e, Hi: 0x2c80, Stride: 0x1},
+		unicode.Range16{Lo: 0x2c82, Hi: 0x2c82, Stride: 0x1},
+		unicode.Range16{Lo: 0x2c84, Hi: 0x2c84, Stride: 0x1},
+		unicode.Range16{Lo: 0x2c86, Hi: 0x2c86, Stride: 0x1},
+		unicode.Range16{Lo: 0x2c88, Hi: 0x2c88, Stride: 0x1},
+		unicode.Range16{Lo: 0x2c8a, Hi: 0x2c8a, Stride: 0x1},
+		unicode.Range16{Lo: 0x2c8c, Hi: 0x2c8c, Stride: 0x1},
+		unicode.Range16{Lo: 0x2c8e, Hi: 0x2c8e, Stride: 0x1},
+		unicode.Range16{Lo: 0x2c90, Hi: 0x2c90, Stride: 0x1},
+		unicode.Range16{Lo: 0x2c92, Hi: 0x2c92, Stride: 0x1},
+		unicode.Range16{Lo: 0x2c94, Hi: 0x2c94, Stride: 0x1},
+		unicode.Range16{Lo: 0x2c96, Hi: 0x2c96, Stride: 0x1},
+		unicode.Range16{Lo: 0x2c98, Hi: 0x2c98, Stride: 0x1},
+		unicode.Range16{Lo: 0x2c9a, Hi: 0x2c9a, Stride: 0x1},
+		unicode.Range16{Lo: 0x2c9c, Hi: 0x2c9c, Stride: 0x1},
+		unicode.Range16{Lo: 0x2c9e, Hi: 0x2c9e, Stride: 0x1},
+		unicode.Range16{Lo: 0x2ca0, Hi: 0x2ca0, Stride: 0x1},
+		unicode.Range16{Lo: 0x2ca2, Hi: 0x2ca2, Stride: 0x1},
+		unicode.Range16{Lo: 0x2ca4, Hi: 0x2ca4, Stride: 0x1},
+		unicode.Range16{Lo: 0x2ca6, Hi: 0x2ca6, Stride: 0x1},
+		unicode.Range16{Lo: 0x2ca8, Hi: 0x2ca8, Stride: 0x1},
+		unicode.Range16{Lo: 0x2caa, Hi: 0x2caa, Stride: 0x1},
+		unicode.Range16{Lo: 0x2cac, Hi: 0x2cac, Stride: 0x1},
+		unicode.Range16{Lo: 0x2cae, Hi: 0x2cae, Stride: 0x1},
+		unicode.Range16{Lo: 0x2cb0, Hi: 0x2cb0, Stride: 0x1},
+		unicode.Range16{Lo: 0x2cb2, Hi: 0x2cb2, Stride: 0x1},
+		unicode.Range16{Lo: 0x2cb4, Hi: 0x2cb4, Stride: 0x1},
+		unicode.Range16{Lo: 0x2cb6, Hi: 0x2cb6, Stride: 0x1},
+		unicode.Range16{Lo: 0x2cb8, Hi: 0x2cb8, Stride: 0x1},
+		unicode.Range16{Lo: 0x2cba, Hi: 0x2cba, Stride: 0x1},
+		unicode.Range16{Lo: 0x2cbc, Hi: 0x2cbc, Stride: 0x1},
+		unicode.Range16{Lo: 0x2cbe, Hi: 0x2cbe, Stride: 0x1},
+		unicode.Range16{Lo: 0x2cc0, Hi: 0x2cc0, Stride: 0x1},
+		unicode.Range16{Lo: 0x2cc2, Hi: 0x2cc2, Stride: 0x1},
+		unicode.Range16{Lo: 0x2cc4, Hi: 0x2cc4, Stride: 0x1},
+		unicode.Range16{Lo: 0x2cc6, Hi: 0x2cc6, Stride: 0x1},
+		unicode.Range16{Lo: 0x2cc8, Hi: 0x2cc8, Stride: 0x1},
+		unicode.Range16{Lo: 0x2cca, Hi: 0x2cca, Stride: 0x1},
+		unicode.Range16{Lo: 0x2ccc, Hi: 0x2ccc, Stride: 0x1},
+		unicode.Range16{Lo: 0x2cce, Hi: 0x2cce, Stride: 0x1},
+		unicode.Range16{Lo: 0x2cd0, Hi: 0x2cd0, Stride: 0x1},
+		unicode.Range16{Lo: 0x2cd2, Hi: 0x2cd2, Stride: 0x1},
+		unicode.Range16{Lo: 0x2cd4, Hi: 0x2cd4, Stride: 0x1},
+		unicode.Range16{Lo: 0x2cd6, Hi: 0x2cd6, Stride: 0x1},
+		unicode.Range16{Lo: 0x2cd8, Hi: 0x2cd8, Stride: 0x1},
+		unicode.Range16{Lo: 0x2cda, Hi: 0x2cda, Stride: 0x1},
+		unicode.Range16{Lo: 0x2cdc, Hi: 0x2cdc, Stride: 0x1},
+		unicode.Range16{Lo: 0x2cde, Hi: 0x2cde, Stride: 0x1},
+		unicode.Range16{Lo: 0x2ce0, Hi: 0x2ce0, Stride: 0x1},
+		unicode.Range16{Lo: 0x2ce2, Hi: 0x2ce2, Stride: 0x1},
+		unicode.Range16{Lo: 0x2ceb, Hi: 0x2ceb, Stride: 0x1},
+		unicode.Range16{Lo: 0x2ced, Hi: 0x2ced, Stride: 0x1},
+		unicode.Range16{Lo: 0x2cf2, Hi: 0x2cf2, Stride: 0x1},
+		unicode.Range16{Lo: 0xa640, Hi: 0xa640, Stride: 0x1},
+		unicode.Range16{Lo: 0xa642, Hi: 0xa642, Stride: 0x1},
+		unicode.Range16{Lo: 0xa644, Hi: 0xa644, Stride: 0x1},
+		unicode.Range16{Lo: 0xa646, Hi: 0xa646, Stride: 0x1},
+		unicode.Range16{Lo: 0xa648, Hi: 0xa648, Stride: 0x1},
+		unicode.Range16{Lo: 0xa64a, Hi: 0xa64a, Stride: 0x1},
+		unicode.Range16{Lo: 0xa64c, Hi: 0xa64c, Stride: 0x1},
+		unicode.Range16{Lo: 0xa64e, Hi: 0xa64e, Stride: 0x1},
+		unicode.Range16{Lo: 0xa650, Hi: 0xa650, Stride: 0x1},
+		unicode.Range16{Lo: 0xa652, Hi: 0xa652, Stride: 0x1},
+		unicode.Range16{Lo: 0xa654, Hi: 0xa654, Stride: 0x1},
+		unicode.Range16{Lo: 0xa656, Hi: 0xa656, Stride: 0x1},
+		unicode.Range16{Lo: 0xa658, Hi: 0xa658, Stride: 0x1},
+		unicode.Range16{Lo: 0xa65a, Hi: 0xa65a, Stride: 0x1},
+		unicode.Range16{Lo: 0xa65c, Hi: 0xa65c, Stride: 0x1},
+		unicode.Range16{Lo: 0xa65e, Hi: 0xa65e, Stride: 0x1},
+		unicode.Range16{Lo: 0xa660, Hi: 0xa660, Stride: 0x1},
+		unicode.Range16{Lo: 0xa662, Hi: 0xa662, Stride: 0x1},
+		unicode.Range16{Lo: 0xa664, Hi: 0xa664, Stride: 0x1},
+		unicode.Range16{Lo: 0xa666, Hi: 0xa666, Stride: 0x1},
+		unicode.Range16{Lo: 0xa668, Hi: 0xa668, Stride: 0x1},
+		unicode.Range16{Lo: 0xa66a, Hi: 0xa66a, Stride: 0x1},
+		unicode.Range16{Lo: 0xa66c, Hi: 0xa66c, Stride: 0x1},
+		unicode.Range16{Lo: 0xa680, Hi: 0xa680, Stride: 0x1},
+		unicode.Range16{Lo: 0xa682, Hi: 0xa682, Stride: 0x1},
+		unicode.Range16{Lo: 0xa684, Hi: 0xa684, Stride: 0x1},
+		unicode.Range16{Lo: 0xa686, Hi: 0xa686, Stride: 0x1},
+		unicode.Range16{Lo: 0xa688, Hi: 0xa688, Stride: 0x1},
+		unicode.Range16{Lo: 0xa68a, Hi: 0xa68a, Stride: 0x1},
+		unicode.Range16{Lo: 0xa68c, Hi: 0xa68c, Stride: 0x1},
+		unicode.Range16{Lo: 0xa68e, Hi: 0xa68e, Stride: 0x1},
+		unicode.Range16{Lo: 0xa690, Hi: 0xa690, Stride: 0x1},
+		unicode.Range16{Lo: 0xa692, Hi: 0xa692, Stride: 0x1},
+		unicode.Range16{Lo: 0xa694, Hi: 0xa694, Stride: 0x1},
+		unicode.Range16{Lo: 0xa696, Hi: 0xa696, Stride: 0x1},
+		unicode.Range16{Lo: 0xa698, Hi: 0xa698, Stride: 0x1},
+		unicode.Range16{Lo: 0xa69a, Hi: 0xa69a, Stride: 0x1},
+		unicode.Range16{Lo: 0xa722, Hi: 0xa722, Stride: 0x1},
+		unicode.Range16{Lo: 0xa724, Hi: 0xa724, Stride: 0x1},
+		unicode.Range16{Lo: 0xa726, Hi: 0xa726, Stride: 0x1},
+		unicode.Range16{Lo: 0xa728, Hi: 0xa728, Stride: 0x1},
+		unicode.Range16{Lo: 0xa72a, Hi: 0xa72a, Stride: 0x1},
+		unicode.Range16{Lo: 0xa72c, Hi: 0xa72c, Stride: 0x1},
+		unicode.Range16{Lo: 0xa72e, Hi: 0xa72e, Stride: 0x1},
+		unicode.Range16{Lo: 0xa732, Hi: 0xa732, Stride: 0x1},
+		unicode.Range16{Lo: 0xa734, Hi: 0xa734, Stride: 0x1},
+		unicode.Range16{Lo: 0xa736, Hi: 0xa736, Stride: 0x1},
+		unicode.Range16{Lo: 0xa738, Hi: 0xa738, Stride: 0x1},
+		unicode.Range16{Lo: 0xa73a, Hi: 0xa73a, Stride: 0x1},
+		unicode.Range16{Lo: 0xa73c, Hi: 0xa73c, Stride: 0x1},
+		unicode.Range16{Lo: 0xa73e, Hi: 0xa73e, Stride: 0x1},
+		unicode.Range16{Lo: 0xa740, Hi: 0xa740, Stride: 0x1},
+		unicode.Range16{Lo: 0xa742, Hi: 0xa742, Stride: 0x1},
+		unicode.Range16{Lo: 0xa744, Hi: 0xa744, Stride: 0x1},
+		unicode.Range16{Lo: 0xa746, Hi: 0xa746, Stride: 0x1},
+		unicode.Range16{Lo: 0xa748, Hi: 0xa748, Stride: 0x1},
+		unicode.Range16{Lo: 0xa74a, Hi: 0xa74a, Stride: 0x1},
+		unicode.Range16{Lo: 0xa74c, Hi: 0xa74c, Stride: 0x1},
+		unicode.Range16{Lo: 0xa74e, Hi: 0xa74e, Stride: 0x1},
+		unicode.Range16{Lo: 0xa750, Hi: 0xa750, Stride: 0x1},
+		unicode.Range16{Lo: 0xa752, Hi: 0xa752, Stride: 0x1},
+		unicode.Range16{Lo: 0xa754, Hi: 0xa754, Stride: 0x1},
+		unicode.Range16{Lo: 0xa756, Hi: 0xa756, Stride: 0x1},
+		unicode.Range16{Lo: 0xa758, Hi: 0xa758, Stride: 0x1},
+		unicode.Range16{Lo: 0xa75a, Hi: 0xa75a, Stride: 0x1},
+		unicode.Range16{Lo: 0xa75c, Hi: 0xa75c, Stride: 0x1},
+		unicode.Range16{Lo: 0xa75e, Hi: 0xa75e, Stride: 0x1},
+		unicode.Range16{Lo: 0xa760, Hi: 0xa760, Stride: 0x1},
+		unicode.Range16{Lo: 0xa762, Hi: 0xa762, Stride: 0x1},
+		unicode.Range16{Lo: 0xa764, Hi: 0xa764, Stride: 0x1},
+		unicode.Range16{Lo: 0xa766, Hi: 0xa766, Stride: 0x1},
+		unicode.Range16{Lo: 0xa768, Hi: 0xa768, Stride: 0x1},
+		unicode.Range16{Lo: 0xa76a, Hi: 0xa76a, Stride: 0x1},
+		unicode.Range16{Lo: 0xa76c, Hi: 0xa76c, Stride: 0x1},
+		unicode.Range16{Lo: 0xa76e, Hi: 0xa76e, Stride: 0x1},
+		unicode.Range16{Lo: 0xa779, Hi: 0xa779, Stride: 0x1},
+		unicode.Range16{Lo: 0xa77b, Hi: 0xa77b, Stride: 0x1},
+		unicode.Range16{Lo: 0xa77d, Hi: 0xa77e, Stride: 0x1},
+		unicode.Range16{Lo: 0xa780, Hi: 0xa780, Stride: 0x1},
+		unicode.Range16{Lo: 0xa782, Hi: 0xa782, Stride: 0x1},
+		unicode.Range16{Lo: 0xa784, Hi: 0xa784, Stride: 0x1},
+		unicode.Range16{Lo: 0xa786, Hi: 0xa786, Stride: 0x1},
+		unicode.Range16{Lo: 0xa78b, Hi: 0xa78b, Stride: 0x1},
+		unicode.Range16{Lo: 0xa78d, Hi: 0xa78d, Stride: 0x1},
+		unicode.Range16{Lo: 0xa790, Hi: 0xa790, Stride: 0x1},
+		unicode.Range16{Lo: 0xa792, Hi: 0xa792, Stride: 0x1},
+		unicode.Range16{Lo: 0xa796, Hi: 0xa796, Stride: 0x1},
+		unicode.Range16{Lo: 0xa798, Hi: 0xa798, Stride: 0x1},
+		unicode.Range16{Lo: 0xa79a, Hi: 0xa79a, Stride: 0x1},
+		unicode.Range16{Lo: 0xa79c, Hi: 0xa79c, Stride: 0x1},
+		unicode.Range16{Lo: 0xa79e, Hi: 0xa79e, Stride: 0x1},
+		unicode.Range16{Lo: 0xa7a0, Hi: 0xa7a0, Stride: 0x1},
+		unicode.Range16{Lo: 0xa7a2, Hi: 0xa7a2, Stride: 0x1},
+		unicode.Range16{Lo: 0xa7a4, Hi: 0xa7a4, Stride: 0x1},
+		unicode.Range16{Lo: 0xa7a6, Hi: 0xa7a6, Stride: 0x1},
+		unicode.Range16{Lo: 0xa7a8, Hi: 0xa7a8, Stride: 0x1},
+		unicode.Range16{Lo: 0xa7aa, Hi: 0xa7ae, Stride: 0x1},
+		unicode.Range16{Lo: 0xa7b0, Hi: 0xa7b4, Stride: 0x1},
+		unicode.Range16{Lo: 0xa7b6, Hi: 0xa7b6, Stride: 0x1},
+		unicode.Range16{Lo: 0xa7b8, Hi: 0xa7b8, Stride: 0x1},
+		unicode.Range16{Lo: 0xa7ba, Hi: 0xa7ba, Stride: 0x1},
+		unicode.Range16{Lo: 0xa7bc, Hi: 0xa7bc, Stride: 0x1},
+		unicode.Range16{Lo: 0xa7be, Hi: 0xa7be, Stride: 0x1},
+		unicode.Range16{Lo: 0xa7c0, Hi: 0xa7c0, Stride: 0x1},
+		unicode.Range16{Lo: 0xa7c2, Hi: 0xa7c2, Stride: 0x1},
+		unicode.Range16{Lo: 0xa7c4, Hi: 0xa7c7, Stride: 0x1},
+		unicode.Range16{Lo: 0xa7c9, Hi: 0xa7c9, Stride: 0x1},
+		unicode.Range16{Lo: 0xa7d0, Hi: 0xa7d0, Stride: 0x1},
+		unicode.Range16{Lo: 0xa7d6, Hi: 0xa7d6, Stride: 0x1},
+		unicode.Range16{Lo: 0xa7d8, Hi: 0xa7d8, Stride: 0x1},
+		unicode.Range16{Lo: 0xa7f5, Hi: 0xa7f5, Stride: 0x1},
+		unicode.Range16{Lo: 0xff21, Hi: 0xff3a, Stride: 0x1},
+	},
+	R32: []unicode.Range32{
+		unicode.Range32{Lo: 0x10400, Hi: 0x10427, Stride: 0x1},
+		unicode.Range32{Lo: 0x104b0, Hi: 0x104d3, Stride: 0x1},
+		unicode.Range32{Lo: 0x10570, Hi: 0x1057a, Stride: 0x1},
+		unicode.Range32{Lo: 0x1057c, Hi: 0x1058a, Stride: 0x1},
+		unicode.Range32{Lo: 0x1058c, Hi: 0x10592, Stride: 0x1},
+		unicode.Range32{Lo: 0x10594, Hi: 0x10595, Stride: 0x1},
+		unicode.Range32{Lo: 0x10c80, Hi: 0x10cb2, Stride: 0x1},
+		unicode.Range32{Lo: 0x118a0, Hi: 0x118bf, Stride: 0x1},
+		unicode.Range32{Lo: 0x16e40, Hi: 0x16e5f, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d400, Hi: 0x1d419, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d434, Hi: 0x1d44d, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d468, Hi: 0x1d481, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d49c, Hi: 0x1d49c, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d49e, Hi: 0x1d49f, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d4a2, Hi: 0x1d4a2, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d4a5, Hi: 0x1d4a6, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d4a9, Hi: 0x1d4ac, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d4ae, Hi: 0x1d4b5, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d4d0, Hi: 0x1d4e9, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d504, Hi: 0x1d505, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d507, Hi: 0x1d50a, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d50d, Hi: 0x1d514, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d516, Hi: 0x1d51c, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d538, Hi: 0x1d539, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d53b, Hi: 0x1d53e, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d540, Hi: 0x1d544, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d546, Hi: 0x1d546, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d54a, Hi: 0x1d550, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d56c, Hi: 0x1d585, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d5a0, Hi: 0x1d5b9, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d5d4, Hi: 0x1d5ed, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d608, Hi: 0x1d621, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d63c, Hi: 0x1d655, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d670, Hi: 0x1d689, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d6a8, Hi: 0x1d6c0, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d6e2, Hi: 0x1d6fa, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d71c, Hi: 0x1d734, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d756, Hi: 0x1d76e, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d790, Hi: 0x1d7a8, Stride: 0x1},
+		unicode.Range32{Lo: 0x1d7ca, Hi: 0x1d7ca, Stride: 0x1},
+		unicode.Range32{Lo: 0x1e900, Hi: 0x1e921, Stride: 0x1},
+		unicode.Range32{Lo: 0x1f130, Hi: 0x1f149, Stride: 0x1},
+		unicode.Range32{Lo: 0x1f150, Hi: 0x1f169, Stride: 0x1},
+		unicode.Range32{Lo: 0x1f170, Hi: 0x1f189, Stride: 0x1},
+	},
+	LatinOffset: 3,
+}
+
+type _SentenceRuneRange unicode.RangeTable
+
+func _SentenceRuneType(r rune) *_SentenceRuneRange {
+	switch {
+	case unicode.Is(_SentenceATerm, r):
+		return (*_SentenceRuneRange)(_SentenceATerm)
+	case unicode.Is(_SentenceCR, r):
+		return (*_SentenceRuneRange)(_SentenceCR)
+	case unicode.Is(_SentenceClose, r):
+		return (*_SentenceRuneRange)(_SentenceClose)
+	case unicode.Is(_SentenceExtend, r):
+		return (*_SentenceRuneRange)(_SentenceExtend)
+	case unicode.Is(_SentenceFormat, r):
+		return (*_SentenceRuneRange)(_SentenceFormat)
+	case unicode.Is(_SentenceLF, r):
+		return (*_SentenceRuneRange)(_SentenceLF)
+	case unicode.Is(_SentenceLower, r):
+		return (*_SentenceRuneRange)(_SentenceLower)
+	case unicode.Is(_SentenceNumeric, r):
+		return (*_SentenceRuneRange)(_SentenceNumeric)
+	case unicode.Is(_SentenceOLetter, r):
+		return (*_SentenceRuneRange)(_SentenceOLetter)
+	case unicode.Is(_SentenceSContinue, r):
+		return (*_SentenceRuneRange)(_SentenceSContinue)
+	case unicode.Is(_SentenceSTerm, r):
+		return (*_SentenceRuneRange)(_SentenceSTerm)
+	case unicode.Is(_SentenceSep, r):
+		return (*_SentenceRuneRange)(_SentenceSep)
+	case unicode.Is(_SentenceSp, r):
+		return (*_SentenceRuneRange)(_SentenceSp)
+	case unicode.Is(_SentenceUpper, r):
+		return (*_SentenceRuneRange)(_SentenceUpper)
+	default:
+		return nil
+	}
+}
+func (rng *_SentenceRuneRange) String() string {
+	switch (*unicode.RangeTable)(rng) {
+	case _SentenceATerm:
+		return "ATerm"
+	case _SentenceCR:
+		return "CR"
+	case _SentenceClose:
+		return "Close"
+	case _SentenceExtend:
+		return "Extend"
+	case _SentenceFormat:
+		return "Format"
+	case _SentenceLF:
+		return "LF"
+	case _SentenceLower:
+		return "Lower"
+	case _SentenceNumeric:
+		return "Numeric"
+	case _SentenceOLetter:
+		return "OLetter"
+	case _SentenceSContinue:
+		return "SContinue"
+	case _SentenceSTerm:
+		return "STerm"
+	case _SentenceSep:
+		return "Sep"
+	case _SentenceSp:
+		return "Sp"
+	case _SentenceUpper:
+		return "Upper"
+	default:
+		return "Other"
+	}
+}
diff --git a/.ci/providerlint/vendor/github.com/apparentlymart/go-textseg/v13/textseg/unicode2ragel.rb b/.ci/providerlint/vendor/github.com/apparentlymart/go-textseg/v15/textseg/unicode2ragel.rb
similarity index 100%
rename from .ci/providerlint/vendor/github.com/apparentlymart/go-textseg/v13/textseg/unicode2ragel.rb
rename to .ci/providerlint/vendor/github.com/apparentlymart/go-textseg/v15/textseg/unicode2ragel.rb
diff --git a/.ci/providerlint/vendor/github.com/apparentlymart/go-textseg/v13/textseg/utf8_seqs.go b/.ci/providerlint/vendor/github.com/apparentlymart/go-textseg/v15/textseg/utf8_seqs.go
similarity index 100%
rename from .ci/providerlint/vendor/github.com/apparentlymart/go-textseg/v13/textseg/utf8_seqs.go
rename to .ci/providerlint/vendor/github.com/apparentlymart/go-textseg/v15/textseg/utf8_seqs.go
diff --git a/.ci/providerlint/vendor/github.com/aws/aws-sdk-go/aws/endpoints/defaults.go b/.ci/providerlint/vendor/github.com/aws/aws-sdk-go/aws/endpoints/defaults.go
index d9bd270ae16..f2fffc40eca 100644
--- a/.ci/providerlint/vendor/github.com/aws/aws-sdk-go/aws/endpoints/defaults.go
+++ b/.ci/providerlint/vendor/github.com/aws/aws-sdk-go/aws/endpoints/defaults.go
@@ -39,6 +39,7 @@ const (
 	EuWest1RegionID      = "eu-west-1"      // Europe (Ireland).
 	EuWest2RegionID      = "eu-west-2"      // Europe (London).
 	EuWest3RegionID      = "eu-west-3"      // Europe (Paris).
+	IlCentral1RegionID   = "il-central-1"   // Israel (Tel Aviv).
 	MeCentral1RegionID   = "me-central-1"   // Middle East (UAE).
 	MeSouth1RegionID     = "me-south-1"     // Middle East (Bahrain).
 	SaEast1RegionID      = "sa-east-1"      // South America (Sao Paulo).
@@ -117,7 +118,7 @@ var awsPartition = partition{
 	DNSSuffix: "amazonaws.com",
 	RegionRegex: regionRegex{
 		Regexp: func() *regexp.Regexp {
-			reg, _ := regexp.Compile("^(us|eu|ap|sa|ca|me|af)\\-\\w+\\-\\d+$")
+			reg, _ := regexp.Compile("^(us|eu|ap|sa|ca|me|af|il)\\-\\w+\\-\\d+$")
 			return reg
 		}(),
 	},
@@ -213,6 +214,9 @@ var awsPartition = partition{
 		"eu-west-3": region{
 			Description: "Europe (Paris)",
 		},
+		"il-central-1": region{
+			Description: "Israel (Tel Aviv)",
+		},
 		"me-central-1": region{
 			Description: "Middle East (UAE)",
 		},
@@ -356,6 +360,9 @@ var awsPartition = partition{
 					},
 					Deprecated: boxedTrue,
 				},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-central-1",
 				}: endpoint{},
@@ -494,6 +501,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-west-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-central-1",
 				}: endpoint{},
@@ -695,6 +705,9 @@ var awsPartition = partition{
 					},
 					Deprecated: boxedTrue,
 				},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-central-1",
 				}: endpoint{},
@@ -1045,6 +1058,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-west-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-south-1",
 				}: endpoint{},
@@ -1439,6 +1455,14 @@ var awsPartition = partition{
 					},
 					Deprecated: boxedTrue,
 				},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{
+					Hostname: "api.ecr.il-central-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "il-central-1",
+					},
+				},
 				endpointKey{
 					Region: "me-central-1",
 				}: endpoint{
@@ -1832,6 +1856,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "us-east-1",
 				}: endpoint{},
@@ -1907,6 +1934,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-west-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-central-1",
 				}: endpoint{},
@@ -2247,6 +2277,9 @@ var awsPartition = partition{
 					},
 					Deprecated: boxedTrue,
 				},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-central-1",
 				}: endpoint{},
@@ -2390,6 +2423,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-west-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-central-1",
 				}: endpoint{},
@@ -2475,6 +2511,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-west-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-central-1",
 				}: endpoint{},
@@ -2533,21 +2572,81 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-west-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "fips-us-east-1",
+				}: endpoint{
+					Hostname: "appflow-fips.us-east-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-1",
+					},
+					Deprecated: boxedTrue,
+				},
+				endpointKey{
+					Region: "fips-us-east-2",
+				}: endpoint{
+					Hostname: "appflow-fips.us-east-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-2",
+					},
+					Deprecated: boxedTrue,
+				},
+				endpointKey{
+					Region: "fips-us-west-1",
+				}: endpoint{
+					Hostname: "appflow-fips.us-west-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-west-1",
+					},
+					Deprecated: boxedTrue,
+				},
+				endpointKey{
+					Region: "fips-us-west-2",
+				}: endpoint{
+					Hostname: "appflow-fips.us-west-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-west-2",
+					},
+					Deprecated: boxedTrue,
+				},
 				endpointKey{
 					Region: "sa-east-1",
 				}: endpoint{},
 				endpointKey{
 					Region: "us-east-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "us-east-1",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "appflow-fips.us-east-1.amazonaws.com",
+				},
 				endpointKey{
 					Region: "us-east-2",
 				}: endpoint{},
+				endpointKey{
+					Region:  "us-east-2",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "appflow-fips.us-east-2.amazonaws.com",
+				},
 				endpointKey{
 					Region: "us-west-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "us-west-1",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "appflow-fips.us-west-1.amazonaws.com",
+				},
 				endpointKey{
 					Region: "us-west-2",
 				}: endpoint{},
+				endpointKey{
+					Region:  "us-west-2",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "appflow-fips.us-west-2.amazonaws.com",
+				},
 			},
 		},
 		"application-autoscaling": service{
@@ -2617,6 +2716,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-west-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-central-1",
 				}: endpoint{},
@@ -2660,6 +2762,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-southeast-1",
 				}: endpoint{},
@@ -2675,12 +2780,18 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-central-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-central-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-north-1",
 				}: endpoint{},
 				endpointKey{
 					Region: "eu-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-west-1",
 				}: endpoint{},
@@ -2690,6 +2801,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-west-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "me-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-south-1",
 				}: endpoint{},
@@ -2877,6 +2991,15 @@ var awsPartition = partition{
 				}: endpoint{
 					Hostname: "appmesh.eu-west-3.api.aws",
 				},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
+				endpointKey{
+					Region:  "il-central-1",
+					Variant: dualStackVariant,
+				}: endpoint{
+					Hostname: "appmesh.il-central-1.api.aws",
+				},
 				endpointKey{
 					Region: "me-south-1",
 				}: endpoint{},
@@ -3375,6 +3498,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-west-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-central-1",
 				}: endpoint{},
@@ -3454,6 +3580,15 @@ var awsPartition = partition{
 				}: endpoint{
 					Hostname: "athena.ap-south-1.api.aws",
 				},
+				endpointKey{
+					Region: "ap-south-2",
+				}: endpoint{},
+				endpointKey{
+					Region:  "ap-south-2",
+					Variant: dualStackVariant,
+				}: endpoint{
+					Hostname: "athena.ap-south-2.api.aws",
+				},
 				endpointKey{
 					Region: "ap-southeast-1",
 				}: endpoint{},
@@ -3481,6 +3616,15 @@ var awsPartition = partition{
 				}: endpoint{
 					Hostname: "athena.ap-southeast-3.api.aws",
 				},
+				endpointKey{
+					Region: "ap-southeast-4",
+				}: endpoint{},
+				endpointKey{
+					Region:  "ap-southeast-4",
+					Variant: dualStackVariant,
+				}: endpoint{
+					Hostname: "athena.ap-southeast-4.api.aws",
+				},
 				endpointKey{
 					Region: "ca-central-1",
 				}: endpoint{},
@@ -3499,6 +3643,15 @@ var awsPartition = partition{
 				}: endpoint{
 					Hostname: "athena.eu-central-1.api.aws",
 				},
+				endpointKey{
+					Region: "eu-central-2",
+				}: endpoint{},
+				endpointKey{
+					Region:  "eu-central-2",
+					Variant: dualStackVariant,
+				}: endpoint{
+					Hostname: "athena.eu-central-2.api.aws",
+				},
 				endpointKey{
 					Region: "eu-north-1",
 				}: endpoint{},
@@ -3517,6 +3670,15 @@ var awsPartition = partition{
 				}: endpoint{
 					Hostname: "athena.eu-south-1.api.aws",
 				},
+				endpointKey{
+					Region: "eu-south-2",
+				}: endpoint{},
+				endpointKey{
+					Region:  "eu-south-2",
+					Variant: dualStackVariant,
+				}: endpoint{
+					Hostname: "athena.eu-south-2.api.aws",
+				},
 				endpointKey{
 					Region: "eu-west-1",
 				}: endpoint{},
@@ -3580,6 +3742,24 @@ var awsPartition = partition{
 					},
 					Deprecated: boxedTrue,
 				},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
+				endpointKey{
+					Region:  "il-central-1",
+					Variant: dualStackVariant,
+				}: endpoint{
+					Hostname: "athena.il-central-1.api.aws",
+				},
+				endpointKey{
+					Region: "me-central-1",
+				}: endpoint{},
+				endpointKey{
+					Region:  "me-central-1",
+					Variant: dualStackVariant,
+				}: endpoint{
+					Hostname: "athena.me-central-1.api.aws",
+				},
 				endpointKey{
 					Region: "me-south-1",
 				}: endpoint{},
@@ -3792,164 +3972,170 @@ var awsPartition = partition{
 					Region: "eu-west-3",
 				}: endpoint{},
 				endpointKey{
-					Region: "me-central-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "me-south-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "sa-east-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "us-east-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "us-east-2",
-				}: endpoint{},
-				endpointKey{
-					Region: "us-west-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "us-west-2",
-				}: endpoint{},
-			},
-		},
-		"autoscaling-plans": service{
-			Defaults: endpointDefaults{
-				defaultKey{}: endpoint{
-					Protocols: []string{"http", "https"},
-				},
-			},
-			Endpoints: serviceEndpoints{
-				endpointKey{
-					Region: "af-south-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "ap-east-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "ap-northeast-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "ap-northeast-2",
-				}: endpoint{},
-				endpointKey{
-					Region: "ap-northeast-3",
-				}: endpoint{},
-				endpointKey{
-					Region: "ap-south-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "ap-southeast-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "ap-southeast-2",
-				}: endpoint{},
-				endpointKey{
-					Region: "ap-southeast-3",
-				}: endpoint{},
-				endpointKey{
-					Region: "ca-central-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "eu-central-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "eu-north-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "eu-south-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "eu-west-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "eu-west-2",
-				}: endpoint{},
-				endpointKey{
-					Region: "eu-west-3",
-				}: endpoint{},
-				endpointKey{
-					Region: "me-south-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "sa-east-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "us-east-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "us-east-2",
-				}: endpoint{},
-				endpointKey{
-					Region: "us-west-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "us-west-2",
-				}: endpoint{},
-			},
-		},
-		"backup": service{
-			Endpoints: serviceEndpoints{
-				endpointKey{
-					Region: "af-south-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "ap-east-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "ap-northeast-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "ap-northeast-2",
-				}: endpoint{},
-				endpointKey{
-					Region: "ap-northeast-3",
-				}: endpoint{},
-				endpointKey{
-					Region: "ap-south-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "ap-south-2",
-				}: endpoint{},
-				endpointKey{
-					Region: "ap-southeast-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "ap-southeast-2",
-				}: endpoint{},
-				endpointKey{
-					Region: "ap-southeast-3",
-				}: endpoint{},
-				endpointKey{
-					Region: "ap-southeast-4",
-				}: endpoint{},
-				endpointKey{
-					Region: "ca-central-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "eu-central-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "eu-central-2",
-				}: endpoint{},
-				endpointKey{
-					Region: "eu-north-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "eu-south-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "eu-south-2",
-				}: endpoint{},
-				endpointKey{
-					Region: "eu-west-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "eu-west-2",
-				}: endpoint{},
-				endpointKey{
-					Region: "eu-west-3",
+					Region: "il-central-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "me-central-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "me-south-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "sa-east-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "us-east-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "us-east-2",
+				}: endpoint{},
+				endpointKey{
+					Region: "us-west-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "us-west-2",
+				}: endpoint{},
+			},
+		},
+		"autoscaling-plans": service{
+			Defaults: endpointDefaults{
+				defaultKey{}: endpoint{
+					Protocols: []string{"http", "https"},
+				},
+			},
+			Endpoints: serviceEndpoints{
+				endpointKey{
+					Region: "af-south-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-east-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-northeast-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-northeast-2",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-northeast-3",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-south-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-2",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-3",
+				}: endpoint{},
+				endpointKey{
+					Region: "ca-central-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-central-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-north-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-south-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-west-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-west-2",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-west-3",
+				}: endpoint{},
+				endpointKey{
+					Region: "me-south-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "sa-east-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "us-east-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "us-east-2",
+				}: endpoint{},
+				endpointKey{
+					Region: "us-west-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "us-west-2",
+				}: endpoint{},
+			},
+		},
+		"backup": service{
+			Endpoints: serviceEndpoints{
+				endpointKey{
+					Region: "af-south-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-east-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-northeast-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-northeast-2",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-northeast-3",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-south-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-south-2",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-2",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-3",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-4",
+				}: endpoint{},
+				endpointKey{
+					Region: "ca-central-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-central-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-central-2",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-north-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-south-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-south-2",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-west-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-west-2",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-west-3",
+				}: endpoint{},
+				endpointKey{
+					Region: "il-central-1",
 				}: endpoint{},
 				endpointKey{
 					Region: "me-central-1",
@@ -4043,15 +4229,84 @@ var awsPartition = partition{
 		},
 		"backupstorage": service{
 			Endpoints: serviceEndpoints{
+				endpointKey{
+					Region: "af-south-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-east-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-northeast-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-northeast-2",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-northeast-3",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-south-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-south-2",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-2",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-3",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-4",
+				}: endpoint{},
+				endpointKey{
+					Region: "ca-central-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-central-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-central-2",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-north-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-south-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-west-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-west-2",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-west-3",
+				}: endpoint{},
+				endpointKey{
+					Region: "me-central-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "me-south-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "sa-east-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "us-east-1",
 				}: endpoint{},
 				endpointKey{
 					Region: "us-east-2",
 				}: endpoint{},
+				endpointKey{
+					Region: "us-west-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "us-west-2",
 				}: endpoint{},
@@ -4163,6 +4418,9 @@ var awsPartition = partition{
 					},
 					Deprecated: boxedTrue,
 				},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-central-1",
 				}: endpoint{},
@@ -4210,6 +4468,137 @@ var awsPartition = partition{
 				},
 			},
 		},
+		"bedrock": service{
+			Endpoints: serviceEndpoints{
+				endpointKey{
+					Region: "ap-northeast-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "bedrock-ap-northeast-1",
+				}: endpoint{
+					Hostname: "bedrock.ap-northeast-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "ap-northeast-1",
+					},
+				},
+				endpointKey{
+					Region: "bedrock-ap-southeast-1",
+				}: endpoint{
+					Hostname: "bedrock.ap-southeast-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "ap-southeast-1",
+					},
+				},
+				endpointKey{
+					Region: "bedrock-eu-central-1",
+				}: endpoint{
+					Hostname: "bedrock.eu-central-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "eu-central-1",
+					},
+				},
+				endpointKey{
+					Region: "bedrock-fips-us-east-1",
+				}: endpoint{
+					Hostname: "bedrock-fips.us-east-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-1",
+					},
+				},
+				endpointKey{
+					Region: "bedrock-fips-us-west-2",
+				}: endpoint{
+					Hostname: "bedrock-fips.us-west-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-west-2",
+					},
+				},
+				endpointKey{
+					Region: "bedrock-runtime-ap-northeast-1",
+				}: endpoint{
+					Hostname: "bedrock-runtime.ap-northeast-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "ap-northeast-1",
+					},
+				},
+				endpointKey{
+					Region: "bedrock-runtime-ap-southeast-1",
+				}: endpoint{
+					Hostname: "bedrock-runtime.ap-southeast-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "ap-southeast-1",
+					},
+				},
+				endpointKey{
+					Region: "bedrock-runtime-eu-central-1",
+				}: endpoint{
+					Hostname: "bedrock-runtime.eu-central-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "eu-central-1",
+					},
+				},
+				endpointKey{
+					Region: "bedrock-runtime-fips-us-east-1",
+				}: endpoint{
+					Hostname: "bedrock-runtime-fips.us-east-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-1",
+					},
+				},
+				endpointKey{
+					Region: "bedrock-runtime-fips-us-west-2",
+				}: endpoint{
+					Hostname: "bedrock-runtime-fips.us-west-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-west-2",
+					},
+				},
+				endpointKey{
+					Region: "bedrock-runtime-us-east-1",
+				}: endpoint{
+					Hostname: "bedrock-runtime.us-east-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-1",
+					},
+				},
+				endpointKey{
+					Region: "bedrock-runtime-us-west-2",
+				}: endpoint{
+					Hostname: "bedrock-runtime.us-west-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-west-2",
+					},
+				},
+				endpointKey{
+					Region: "bedrock-us-east-1",
+				}: endpoint{
+					Hostname: "bedrock.us-east-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-1",
+					},
+				},
+				endpointKey{
+					Region: "bedrock-us-west-2",
+				}: endpoint{
+					Hostname: "bedrock.us-west-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-west-2",
+					},
+				},
+				endpointKey{
+					Region: "eu-central-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "us-east-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "us-west-2",
+				}: endpoint{},
+			},
+		},
 		"billingconductor": service{
 			PartitionEndpoint: "aws-global",
 			IsRegionalized:    boxedFalse,
@@ -4645,6 +5034,9 @@ var awsPartition = partition{
 					},
 					Deprecated: boxedTrue,
 				},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-central-1",
 				}: endpoint{},
@@ -4785,6 +5177,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-west-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-central-1",
 				}: endpoint{},
@@ -4950,6 +5345,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-west-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-central-1",
 				}: endpoint{},
@@ -5105,6 +5503,9 @@ var awsPartition = partition{
 					},
 					Deprecated: boxedTrue,
 				},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-central-1",
 				}: endpoint{},
@@ -5327,6 +5728,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-west-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-central-1",
 				}: endpoint{},
@@ -5498,6 +5902,9 @@ var awsPartition = partition{
 					},
 					Deprecated: boxedTrue,
 				},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-central-1",
 				}: endpoint{},
@@ -5643,6 +6050,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-west-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-central-1",
 				}: endpoint{},
@@ -6066,6 +6476,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-northeast-2",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-northeast-3",
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-south-1",
 				}: endpoint{},
@@ -6132,6 +6545,9 @@ var awsPartition = partition{
 					},
 					Deprecated: boxedTrue,
 				},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-south-1",
 				}: endpoint{},
@@ -6184,6 +6600,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-northeast-2",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-northeast-3",
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-south-1",
 				}: endpoint{},
@@ -6250,6 +6669,9 @@ var awsPartition = partition{
 					},
 					Deprecated: boxedTrue,
 				},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-south-1",
 				}: endpoint{},
@@ -6761,6 +7183,9 @@ var awsPartition = partition{
 					},
 					Deprecated: boxedTrue,
 				},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-central-1",
 				}: endpoint{},
@@ -6880,6 +7305,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ca-central-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-west-2",
 				}: endpoint{},
@@ -6929,6 +7357,12 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-northeast-2",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-south-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-southeast-2",
 				}: endpoint{},
@@ -6969,6 +7403,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-southeast-1",
 				}: endpoint{},
@@ -6999,12 +7436,18 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-central-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-central-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-north-1",
 				}: endpoint{},
 				endpointKey{
 					Region: "eu-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-west-1",
 				}: endpoint{},
@@ -7014,6 +7457,12 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-west-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "me-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-south-1",
 				}: endpoint{},
@@ -7699,6 +8148,9 @@ var awsPartition = partition{
 					},
 					Deprecated: boxedTrue,
 				},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-central-1",
 				}: endpoint{},
@@ -7746,6 +8198,185 @@ var awsPartition = partition{
 				},
 			},
 		},
+		"datazone": service{
+			Defaults: endpointDefaults{
+				defaultKey{}: endpoint{
+					DNSSuffix: "api.aws",
+				},
+				defaultKey{
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname:  "{service}-fips.{region}.{dnsSuffix}",
+					DNSSuffix: "api.aws",
+				},
+			},
+			Endpoints: serviceEndpoints{
+				endpointKey{
+					Region: "af-south-1",
+				}: endpoint{
+					Hostname: "datazone.af-south-1.api.aws",
+				},
+				endpointKey{
+					Region: "ap-east-1",
+				}: endpoint{
+					Hostname: "datazone.ap-east-1.api.aws",
+				},
+				endpointKey{
+					Region: "ap-northeast-1",
+				}: endpoint{
+					Hostname: "datazone.ap-northeast-1.api.aws",
+				},
+				endpointKey{
+					Region: "ap-northeast-2",
+				}: endpoint{
+					Hostname: "datazone.ap-northeast-2.api.aws",
+				},
+				endpointKey{
+					Region: "ap-northeast-3",
+				}: endpoint{
+					Hostname: "datazone.ap-northeast-3.api.aws",
+				},
+				endpointKey{
+					Region: "ap-south-1",
+				}: endpoint{
+					Hostname: "datazone.ap-south-1.api.aws",
+				},
+				endpointKey{
+					Region: "ap-south-2",
+				}: endpoint{
+					Hostname: "datazone.ap-south-2.api.aws",
+				},
+				endpointKey{
+					Region: "ap-southeast-1",
+				}: endpoint{
+					Hostname: "datazone.ap-southeast-1.api.aws",
+				},
+				endpointKey{
+					Region: "ap-southeast-2",
+				}: endpoint{
+					Hostname: "datazone.ap-southeast-2.api.aws",
+				},
+				endpointKey{
+					Region: "ap-southeast-3",
+				}: endpoint{
+					Hostname: "datazone.ap-southeast-3.api.aws",
+				},
+				endpointKey{
+					Region: "ap-southeast-4",
+				}: endpoint{
+					Hostname: "datazone.ap-southeast-4.api.aws",
+				},
+				endpointKey{
+					Region: "ca-central-1",
+				}: endpoint{
+					Hostname: "datazone.ca-central-1.api.aws",
+				},
+				endpointKey{
+					Region:  "ca-central-1",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "datazone-fips.ca-central-1.amazonaws.com",
+				},
+				endpointKey{
+					Region: "eu-central-1",
+				}: endpoint{
+					Hostname: "datazone.eu-central-1.api.aws",
+				},
+				endpointKey{
+					Region: "eu-central-2",
+				}: endpoint{
+					Hostname: "datazone.eu-central-2.api.aws",
+				},
+				endpointKey{
+					Region: "eu-north-1",
+				}: endpoint{
+					Hostname: "datazone.eu-north-1.api.aws",
+				},
+				endpointKey{
+					Region: "eu-south-1",
+				}: endpoint{
+					Hostname: "datazone.eu-south-1.api.aws",
+				},
+				endpointKey{
+					Region: "eu-south-2",
+				}: endpoint{
+					Hostname: "datazone.eu-south-2.api.aws",
+				},
+				endpointKey{
+					Region: "eu-west-1",
+				}: endpoint{
+					Hostname: "datazone.eu-west-1.api.aws",
+				},
+				endpointKey{
+					Region: "eu-west-2",
+				}: endpoint{
+					Hostname: "datazone.eu-west-2.api.aws",
+				},
+				endpointKey{
+					Region: "eu-west-3",
+				}: endpoint{
+					Hostname: "datazone.eu-west-3.api.aws",
+				},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{
+					Hostname: "datazone.il-central-1.api.aws",
+				},
+				endpointKey{
+					Region: "me-central-1",
+				}: endpoint{
+					Hostname: "datazone.me-central-1.api.aws",
+				},
+				endpointKey{
+					Region: "me-south-1",
+				}: endpoint{
+					Hostname: "datazone.me-south-1.api.aws",
+				},
+				endpointKey{
+					Region: "sa-east-1",
+				}: endpoint{
+					Hostname: "datazone.sa-east-1.api.aws",
+				},
+				endpointKey{
+					Region: "us-east-1",
+				}: endpoint{
+					Hostname: "datazone.us-east-1.api.aws",
+				},
+				endpointKey{
+					Region:  "us-east-1",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "datazone-fips.us-east-1.amazonaws.com",
+				},
+				endpointKey{
+					Region: "us-east-2",
+				}: endpoint{
+					Hostname: "datazone.us-east-2.api.aws",
+				},
+				endpointKey{
+					Region:  "us-east-2",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "datazone-fips.us-east-2.amazonaws.com",
+				},
+				endpointKey{
+					Region: "us-west-1",
+				}: endpoint{
+					Hostname: "datazone.us-west-1.api.aws",
+				},
+				endpointKey{
+					Region: "us-west-2",
+				}: endpoint{
+					Hostname: "datazone.us-west-2.api.aws",
+				},
+				endpointKey{
+					Region:  "us-west-2",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "datazone-fips.us-west-2.amazonaws.com",
+				},
+			},
+		},
 		"dax": service{
 			Endpoints: serviceEndpoints{
 				endpointKey{
@@ -8026,6 +8657,9 @@ var awsPartition = partition{
 					},
 					Deprecated: boxedTrue,
 				},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-central-1",
 				}: endpoint{},
@@ -8118,6 +8752,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-southeast-1",
 				}: endpoint{},
@@ -8269,6 +8906,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-west-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-central-1",
 				}: endpoint{},
@@ -8488,6 +9128,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-southeast-1",
 				}: endpoint{},
@@ -8497,18 +9140,27 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-southeast-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-4",
+				}: endpoint{},
 				endpointKey{
 					Region: "ca-central-1",
 				}: endpoint{},
 				endpointKey{
 					Region: "eu-central-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-central-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-north-1",
 				}: endpoint{},
 				endpointKey{
 					Region: "eu-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-west-1",
 				}: endpoint{},
@@ -8518,6 +9170,12 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-west-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "me-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-south-1",
 				}: endpoint{},
@@ -8607,178 +9265,184 @@ var awsPartition = partition{
 					Region: "eu-west-3",
 				}: endpoint{},
 				endpointKey{
-					Region: "fips-ca-central-1",
-				}: endpoint{
-					Hostname: "ds-fips.ca-central-1.amazonaws.com",
-					CredentialScope: credentialScope{
-						Region: "ca-central-1",
-					},
-					Deprecated: boxedTrue,
-				},
-				endpointKey{
-					Region: "fips-us-east-1",
-				}: endpoint{
-					Hostname: "ds-fips.us-east-1.amazonaws.com",
-					CredentialScope: credentialScope{
-						Region: "us-east-1",
-					},
-					Deprecated: boxedTrue,
-				},
-				endpointKey{
-					Region: "fips-us-east-2",
-				}: endpoint{
-					Hostname: "ds-fips.us-east-2.amazonaws.com",
-					CredentialScope: credentialScope{
-						Region: "us-east-2",
-					},
-					Deprecated: boxedTrue,
-				},
-				endpointKey{
-					Region: "fips-us-west-1",
-				}: endpoint{
-					Hostname: "ds-fips.us-west-1.amazonaws.com",
-					CredentialScope: credentialScope{
-						Region: "us-west-1",
-					},
-					Deprecated: boxedTrue,
-				},
-				endpointKey{
-					Region: "fips-us-west-2",
-				}: endpoint{
-					Hostname: "ds-fips.us-west-2.amazonaws.com",
-					CredentialScope: credentialScope{
-						Region: "us-west-2",
-					},
-					Deprecated: boxedTrue,
-				},
-				endpointKey{
-					Region: "me-central-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "me-south-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "sa-east-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "us-east-1",
-				}: endpoint{},
-				endpointKey{
-					Region:  "us-east-1",
-					Variant: fipsVariant,
-				}: endpoint{
-					Hostname: "ds-fips.us-east-1.amazonaws.com",
-				},
-				endpointKey{
-					Region: "us-east-2",
-				}: endpoint{},
-				endpointKey{
-					Region:  "us-east-2",
-					Variant: fipsVariant,
-				}: endpoint{
-					Hostname: "ds-fips.us-east-2.amazonaws.com",
-				},
-				endpointKey{
-					Region: "us-west-1",
-				}: endpoint{},
-				endpointKey{
-					Region:  "us-west-1",
-					Variant: fipsVariant,
-				}: endpoint{
-					Hostname: "ds-fips.us-west-1.amazonaws.com",
-				},
-				endpointKey{
-					Region: "us-west-2",
-				}: endpoint{},
-				endpointKey{
-					Region:  "us-west-2",
-					Variant: fipsVariant,
-				}: endpoint{
-					Hostname: "ds-fips.us-west-2.amazonaws.com",
-				},
-			},
-		},
-		"dynamodb": service{
-			Defaults: endpointDefaults{
-				defaultKey{}: endpoint{
-					Protocols: []string{"http", "https"},
-				},
-			},
-			Endpoints: serviceEndpoints{
-				endpointKey{
-					Region: "af-south-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "ap-east-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "ap-northeast-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "ap-northeast-2",
-				}: endpoint{},
-				endpointKey{
-					Region: "ap-northeast-3",
-				}: endpoint{},
-				endpointKey{
-					Region: "ap-south-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "ap-south-2",
-				}: endpoint{},
-				endpointKey{
-					Region: "ap-southeast-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "ap-southeast-2",
-				}: endpoint{},
-				endpointKey{
-					Region: "ap-southeast-3",
-				}: endpoint{},
-				endpointKey{
-					Region: "ap-southeast-4",
-				}: endpoint{},
-				endpointKey{
-					Region: "ca-central-1",
-				}: endpoint{},
-				endpointKey{
-					Region:  "ca-central-1",
-					Variant: fipsVariant,
-				}: endpoint{
-					Hostname: "dynamodb-fips.ca-central-1.amazonaws.com",
-				},
-				endpointKey{
-					Region: "ca-central-1-fips",
-				}: endpoint{
-					Hostname: "dynamodb-fips.ca-central-1.amazonaws.com",
-					CredentialScope: credentialScope{
-						Region: "ca-central-1",
-					},
-					Deprecated: boxedTrue,
-				},
-				endpointKey{
-					Region: "eu-central-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "eu-central-2",
-				}: endpoint{},
-				endpointKey{
-					Region: "eu-north-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "eu-south-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "eu-south-2",
-				}: endpoint{},
-				endpointKey{
-					Region: "eu-west-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "eu-west-2",
-				}: endpoint{},
-				endpointKey{
-					Region: "eu-west-3",
+					Region: "fips-ca-central-1",
+				}: endpoint{
+					Hostname: "ds-fips.ca-central-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "ca-central-1",
+					},
+					Deprecated: boxedTrue,
+				},
+				endpointKey{
+					Region: "fips-us-east-1",
+				}: endpoint{
+					Hostname: "ds-fips.us-east-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-1",
+					},
+					Deprecated: boxedTrue,
+				},
+				endpointKey{
+					Region: "fips-us-east-2",
+				}: endpoint{
+					Hostname: "ds-fips.us-east-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-2",
+					},
+					Deprecated: boxedTrue,
+				},
+				endpointKey{
+					Region: "fips-us-west-1",
+				}: endpoint{
+					Hostname: "ds-fips.us-west-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-west-1",
+					},
+					Deprecated: boxedTrue,
+				},
+				endpointKey{
+					Region: "fips-us-west-2",
+				}: endpoint{
+					Hostname: "ds-fips.us-west-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-west-2",
+					},
+					Deprecated: boxedTrue,
+				},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "me-central-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "me-south-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "sa-east-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "us-east-1",
+				}: endpoint{},
+				endpointKey{
+					Region:  "us-east-1",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "ds-fips.us-east-1.amazonaws.com",
+				},
+				endpointKey{
+					Region: "us-east-2",
+				}: endpoint{},
+				endpointKey{
+					Region:  "us-east-2",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "ds-fips.us-east-2.amazonaws.com",
+				},
+				endpointKey{
+					Region: "us-west-1",
+				}: endpoint{},
+				endpointKey{
+					Region:  "us-west-1",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "ds-fips.us-west-1.amazonaws.com",
+				},
+				endpointKey{
+					Region: "us-west-2",
+				}: endpoint{},
+				endpointKey{
+					Region:  "us-west-2",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "ds-fips.us-west-2.amazonaws.com",
+				},
+			},
+		},
+		"dynamodb": service{
+			Defaults: endpointDefaults{
+				defaultKey{}: endpoint{
+					Protocols: []string{"http", "https"},
+				},
+			},
+			Endpoints: serviceEndpoints{
+				endpointKey{
+					Region: "af-south-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-east-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-northeast-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-northeast-2",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-northeast-3",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-south-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-south-2",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-2",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-3",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-4",
+				}: endpoint{},
+				endpointKey{
+					Region: "ca-central-1",
+				}: endpoint{},
+				endpointKey{
+					Region:  "ca-central-1",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "dynamodb-fips.ca-central-1.amazonaws.com",
+				},
+				endpointKey{
+					Region: "ca-central-1-fips",
+				}: endpoint{
+					Hostname: "dynamodb-fips.ca-central-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "ca-central-1",
+					},
+					Deprecated: boxedTrue,
+				},
+				endpointKey{
+					Region: "eu-central-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-central-2",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-north-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-south-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-south-2",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-west-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-west-2",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-west-3",
+				}: endpoint{},
+				endpointKey{
+					Region: "il-central-1",
 				}: endpoint{},
 				endpointKey{
 					Region: "local",
@@ -8985,6 +9649,9 @@ var awsPartition = partition{
 					},
 					Deprecated: boxedTrue,
 				},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-central-1",
 				}: endpoint{},
@@ -9162,6 +9829,9 @@ var awsPartition = partition{
 					},
 					Deprecated: boxedTrue,
 				},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-central-1",
 				}: endpoint{},
@@ -9331,6 +10001,9 @@ var awsPartition = partition{
 					},
 					Deprecated: boxedTrue,
 				},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-central-1",
 				}: endpoint{},
@@ -9509,6 +10182,9 @@ var awsPartition = partition{
 					},
 					Deprecated: boxedTrue,
 				},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-central-1",
 				}: endpoint{},
@@ -9627,6 +10303,9 @@ var awsPartition = partition{
 					},
 					Deprecated: boxedTrue,
 				},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-central-1",
 				}: endpoint{},
@@ -9796,6 +10475,9 @@ var awsPartition = partition{
 					},
 					Deprecated: boxedTrue,
 				},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-south-1",
 				}: endpoint{},
@@ -10202,6 +10884,15 @@ var awsPartition = partition{
 					},
 					Deprecated: boxedTrue,
 				},
+				endpointKey{
+					Region: "fips-il-central-1",
+				}: endpoint{
+					Hostname: "elasticfilesystem-fips.il-central-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "il-central-1",
+					},
+					Deprecated: boxedTrue,
+				},
 				endpointKey{
 					Region: "fips-me-central-1",
 				}: endpoint{
@@ -10265,6 +10956,15 @@ var awsPartition = partition{
 					},
 					Deprecated: boxedTrue,
 				},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
+				endpointKey{
+					Region:  "il-central-1",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "elasticfilesystem-fips.il-central-1.amazonaws.com",
+				},
 				endpointKey{
 					Region: "me-central-1",
 				}: endpoint{},
@@ -10433,6 +11133,9 @@ var awsPartition = partition{
 					},
 					Deprecated: boxedTrue,
 				},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-central-1",
 				}: endpoint{},
@@ -10601,6 +11304,9 @@ var awsPartition = partition{
 					},
 					Deprecated: boxedTrue,
 				},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-central-1",
 				}: endpoint{},
@@ -10625,6 +11331,12 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "us-east-2",
 				}: endpoint{},
+				endpointKey{
+					Region:  "us-east-2",
+					Variant: dualStackVariant,
+				}: endpoint{
+					Hostname: "elasticmapreduce.us-east-2.api.aws",
+				},
 				endpointKey{
 					Region:  "us-east-2",
 					Variant: fipsVariant,
@@ -10708,6 +11420,12 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ca-central-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "ca-central-1",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "email-fips.ca-central-1.amazonaws.com",
+				},
 				endpointKey{
 					Region: "eu-central-1",
 				}: endpoint{},
@@ -10726,6 +11444,15 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-west-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "fips-ca-central-1",
+				}: endpoint{
+					Hostname: "email-fips.ca-central-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "ca-central-1",
+					},
+					Deprecated: boxedTrue,
+				},
 				endpointKey{
 					Region: "fips-us-east-1",
 				}: endpoint{
@@ -10735,6 +11462,24 @@ var awsPartition = partition{
 					},
 					Deprecated: boxedTrue,
 				},
+				endpointKey{
+					Region: "fips-us-east-2",
+				}: endpoint{
+					Hostname: "email-fips.us-east-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-2",
+					},
+					Deprecated: boxedTrue,
+				},
+				endpointKey{
+					Region: "fips-us-west-1",
+				}: endpoint{
+					Hostname: "email-fips.us-west-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-west-1",
+					},
+					Deprecated: boxedTrue,
+				},
 				endpointKey{
 					Region: "fips-us-west-2",
 				}: endpoint{
@@ -10744,6 +11489,9 @@ var awsPartition = partition{
 					},
 					Deprecated: boxedTrue,
 				},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-south-1",
 				}: endpoint{},
@@ -10762,9 +11510,21 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "us-east-2",
 				}: endpoint{},
+				endpointKey{
+					Region:  "us-east-2",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "email-fips.us-east-2.amazonaws.com",
+				},
 				endpointKey{
 					Region: "us-west-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "us-west-1",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "email-fips.us-west-1.amazonaws.com",
+				},
 				endpointKey{
 					Region: "us-west-2",
 				}: endpoint{},
@@ -10778,6 +11538,9 @@ var awsPartition = partition{
 		},
 		"emr-containers": service{
 			Endpoints: serviceEndpoints{
+				endpointKey{
+					Region: "af-south-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-east-1",
 				}: endpoint{},
@@ -10787,6 +11550,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-northeast-2",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-northeast-3",
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-south-1",
 				}: endpoint{},
@@ -10811,6 +11577,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-north-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-south-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-west-1",
 				}: endpoint{},
@@ -11061,63 +11830,183 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "af-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "af-south-1",
+					Variant: dualStackVariant,
+				}: endpoint{
+					Hostname: "aos.af-south-1.api.aws",
+				},
 				endpointKey{
 					Region: "ap-east-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "ap-east-1",
+					Variant: dualStackVariant,
+				}: endpoint{
+					Hostname: "aos.ap-east-1.api.aws",
+				},
 				endpointKey{
 					Region: "ap-northeast-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "ap-northeast-1",
+					Variant: dualStackVariant,
+				}: endpoint{
+					Hostname: "aos.ap-northeast-1.api.aws",
+				},
 				endpointKey{
 					Region: "ap-northeast-2",
 				}: endpoint{},
+				endpointKey{
+					Region:  "ap-northeast-2",
+					Variant: dualStackVariant,
+				}: endpoint{
+					Hostname: "aos.ap-northeast-2.api.aws",
+				},
 				endpointKey{
 					Region: "ap-northeast-3",
 				}: endpoint{},
+				endpointKey{
+					Region:  "ap-northeast-3",
+					Variant: dualStackVariant,
+				}: endpoint{
+					Hostname: "aos.ap-northeast-3.api.aws",
+				},
 				endpointKey{
 					Region: "ap-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "ap-south-1",
+					Variant: dualStackVariant,
+				}: endpoint{
+					Hostname: "aos.ap-south-1.api.aws",
+				},
 				endpointKey{
 					Region: "ap-south-2",
 				}: endpoint{},
+				endpointKey{
+					Region:  "ap-south-2",
+					Variant: dualStackVariant,
+				}: endpoint{
+					Hostname: "aos.ap-south-2.api.aws",
+				},
 				endpointKey{
 					Region: "ap-southeast-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "ap-southeast-1",
+					Variant: dualStackVariant,
+				}: endpoint{
+					Hostname: "aos.ap-southeast-1.api.aws",
+				},
 				endpointKey{
 					Region: "ap-southeast-2",
 				}: endpoint{},
+				endpointKey{
+					Region:  "ap-southeast-2",
+					Variant: dualStackVariant,
+				}: endpoint{
+					Hostname: "aos.ap-southeast-2.api.aws",
+				},
 				endpointKey{
 					Region: "ap-southeast-3",
 				}: endpoint{},
+				endpointKey{
+					Region:  "ap-southeast-3",
+					Variant: dualStackVariant,
+				}: endpoint{
+					Hostname: "aos.ap-southeast-3.api.aws",
+				},
 				endpointKey{
 					Region: "ap-southeast-4",
 				}: endpoint{},
+				endpointKey{
+					Region:  "ap-southeast-4",
+					Variant: dualStackVariant,
+				}: endpoint{
+					Hostname: "aos.ap-southeast-4.api.aws",
+				},
 				endpointKey{
 					Region: "ca-central-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "ca-central-1",
+					Variant: dualStackVariant,
+				}: endpoint{
+					Hostname: "aos.ca-central-1.api.aws",
+				},
 				endpointKey{
 					Region: "eu-central-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "eu-central-1",
+					Variant: dualStackVariant,
+				}: endpoint{
+					Hostname: "aos.eu-central-1.api.aws",
+				},
 				endpointKey{
 					Region: "eu-central-2",
 				}: endpoint{},
+				endpointKey{
+					Region:  "eu-central-2",
+					Variant: dualStackVariant,
+				}: endpoint{
+					Hostname: "aos.eu-central-2.api.aws",
+				},
 				endpointKey{
 					Region: "eu-north-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "eu-north-1",
+					Variant: dualStackVariant,
+				}: endpoint{
+					Hostname: "aos.eu-north-1.api.aws",
+				},
 				endpointKey{
 					Region: "eu-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "eu-south-1",
+					Variant: dualStackVariant,
+				}: endpoint{
+					Hostname: "aos.eu-south-1.api.aws",
+				},
 				endpointKey{
 					Region: "eu-south-2",
 				}: endpoint{},
+				endpointKey{
+					Region:  "eu-south-2",
+					Variant: dualStackVariant,
+				}: endpoint{
+					Hostname: "aos.eu-south-2.api.aws",
+				},
 				endpointKey{
 					Region: "eu-west-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "eu-west-1",
+					Variant: dualStackVariant,
+				}: endpoint{
+					Hostname: "aos.eu-west-1.api.aws",
+				},
 				endpointKey{
 					Region: "eu-west-2",
 				}: endpoint{},
+				endpointKey{
+					Region:  "eu-west-2",
+					Variant: dualStackVariant,
+				}: endpoint{
+					Hostname: "aos.eu-west-2.api.aws",
+				},
 				endpointKey{
 					Region: "eu-west-3",
 				}: endpoint{},
+				endpointKey{
+					Region:  "eu-west-3",
+					Variant: dualStackVariant,
+				}: endpoint{
+					Hostname: "aos.eu-west-3.api.aws",
+				},
 				endpointKey{
 					Region: "fips",
 				}: endpoint{
@@ -11127,18 +12016,51 @@ var awsPartition = partition{
 					},
 					Deprecated: boxedTrue,
 				},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
+				endpointKey{
+					Region:  "il-central-1",
+					Variant: dualStackVariant,
+				}: endpoint{
+					Hostname: "aos.il-central-1.api.aws",
+				},
 				endpointKey{
 					Region: "me-central-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "me-central-1",
+					Variant: dualStackVariant,
+				}: endpoint{
+					Hostname: "aos.me-central-1.api.aws",
+				},
 				endpointKey{
 					Region: "me-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "me-south-1",
+					Variant: dualStackVariant,
+				}: endpoint{
+					Hostname: "aos.me-south-1.api.aws",
+				},
 				endpointKey{
 					Region: "sa-east-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "sa-east-1",
+					Variant: dualStackVariant,
+				}: endpoint{
+					Hostname: "aos.sa-east-1.api.aws",
+				},
 				endpointKey{
 					Region: "us-east-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "us-east-1",
+					Variant: dualStackVariant,
+				}: endpoint{
+					Hostname: "aos.us-east-1.api.aws",
+				},
 				endpointKey{
 					Region:  "us-east-1",
 					Variant: fipsVariant,
@@ -11157,6 +12079,12 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "us-east-2",
 				}: endpoint{},
+				endpointKey{
+					Region:  "us-east-2",
+					Variant: dualStackVariant,
+				}: endpoint{
+					Hostname: "aos.us-east-2.api.aws",
+				},
 				endpointKey{
 					Region:  "us-east-2",
 					Variant: fipsVariant,
@@ -11175,6 +12103,12 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "us-west-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "us-west-1",
+					Variant: dualStackVariant,
+				}: endpoint{
+					Hostname: "aos.us-west-1.api.aws",
+				},
 				endpointKey{
 					Region:  "us-west-1",
 					Variant: fipsVariant,
@@ -11193,6 +12127,12 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "us-west-2",
 				}: endpoint{},
+				endpointKey{
+					Region:  "us-west-2",
+					Variant: dualStackVariant,
+				}: endpoint{
+					Hostname: "aos.us-west-2.api.aws",
+				},
 				endpointKey{
 					Region:  "us-west-2",
 					Variant: fipsVariant,
@@ -11308,6 +12248,9 @@ var awsPartition = partition{
 					},
 					Deprecated: boxedTrue,
 				},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-central-1",
 				}: endpoint{},
@@ -11406,12 +12349,27 @@ var awsPartition = partition{
 		},
 		"finspace": service{
 			Endpoints: serviceEndpoints{
+				endpointKey{
+					Region: "ap-northeast-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "ca-central-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-west-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-west-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "us-east-1",
 				}: endpoint{},
@@ -11540,6 +12498,9 @@ var awsPartition = partition{
 					},
 					Deprecated: boxedTrue,
 				},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-central-1",
 				}: endpoint{},
@@ -11903,6 +12864,9 @@ var awsPartition = partition{
 					},
 					Deprecated: boxedTrue,
 				},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-central-1",
 				}: endpoint{},
@@ -12300,6 +13264,9 @@ var awsPartition = partition{
 					},
 					Deprecated: boxedTrue,
 				},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-central-1",
 				}: endpoint{},
@@ -12504,16 +13471,6 @@ var awsPartition = partition{
 				}: endpoint{},
 			},
 		},
-		"gamesparks": service{
-			Endpoints: serviceEndpoints{
-				endpointKey{
-					Region: "ap-northeast-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "us-east-1",
-				}: endpoint{},
-			},
-		},
 		"geo": service{
 			Endpoints: serviceEndpoints{
 				endpointKey{
@@ -12727,6 +13684,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-southeast-1",
 				}: endpoint{},
@@ -12736,6 +13696,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-southeast-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-4",
+				}: endpoint{},
 				endpointKey{
 					Region: "ca-central-1",
 				}: endpoint{},
@@ -12799,6 +13762,9 @@ var awsPartition = partition{
 					},
 					Deprecated: boxedTrue,
 				},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-central-1",
 				}: endpoint{},
@@ -13189,6 +14155,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-west-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-central-1",
 				}: endpoint{},
@@ -13436,6 +14405,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "af-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-east-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-northeast-1",
 				}: endpoint{},
@@ -13463,6 +14435,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-central-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-central-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-north-1",
 				}: endpoint{},
@@ -13478,6 +14453,12 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-west-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "me-south-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "sa-east-1",
 				}: endpoint{},
@@ -13487,6 +14468,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "us-east-2",
 				}: endpoint{},
+				endpointKey{
+					Region: "us-west-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "us-west-2",
 				}: endpoint{},
@@ -13716,6 +14700,9 @@ var awsPartition = partition{
 		},
 		"inspector2": service{
 			Endpoints: serviceEndpoints{
+				endpointKey{
+					Region: "af-south-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-east-1",
 				}: endpoint{},
@@ -13725,6 +14712,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-northeast-2",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-northeast-3",
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-south-1",
 				}: endpoint{},
@@ -13734,12 +14724,18 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-southeast-2",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-3",
+				}: endpoint{},
 				endpointKey{
 					Region: "ca-central-1",
 				}: endpoint{},
 				endpointKey{
 					Region: "eu-central-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-central-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-north-1",
 				}: endpoint{},
@@ -13755,6 +14751,42 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-west-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "fips-us-east-1",
+				}: endpoint{
+					Hostname: "inspector2-fips.us-east-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-1",
+					},
+					Deprecated: boxedTrue,
+				},
+				endpointKey{
+					Region: "fips-us-east-2",
+				}: endpoint{
+					Hostname: "inspector2-fips.us-east-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-2",
+					},
+					Deprecated: boxedTrue,
+				},
+				endpointKey{
+					Region: "fips-us-west-1",
+				}: endpoint{
+					Hostname: "inspector2-fips.us-west-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-west-1",
+					},
+					Deprecated: boxedTrue,
+				},
+				endpointKey{
+					Region: "fips-us-west-2",
+				}: endpoint{
+					Hostname: "inspector2-fips.us-west-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-west-2",
+					},
+					Deprecated: boxedTrue,
+				},
 				endpointKey{
 					Region: "me-south-1",
 				}: endpoint{},
@@ -13764,15 +14796,39 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "us-east-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "us-east-1",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "inspector2-fips.us-east-1.amazonaws.com",
+				},
 				endpointKey{
 					Region: "us-east-2",
 				}: endpoint{},
+				endpointKey{
+					Region:  "us-east-2",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "inspector2-fips.us-east-2.amazonaws.com",
+				},
 				endpointKey{
 					Region: "us-west-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "us-west-1",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "inspector2-fips.us-west-1.amazonaws.com",
+				},
 				endpointKey{
 					Region: "us-west-2",
 				}: endpoint{},
+				endpointKey{
+					Region:  "us-west-2",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "inspector2-fips.us-west-2.amazonaws.com",
+				},
 			},
 		},
 		"internetmonitor": service{
@@ -13808,11 +14864,21 @@ var awsPartition = partition{
 				}: endpoint{
 					Hostname: "internetmonitor.ap-northeast-2.api.aws",
 				},
+				endpointKey{
+					Region: "ap-northeast-3",
+				}: endpoint{
+					Hostname: "internetmonitor.ap-northeast-3.api.aws",
+				},
 				endpointKey{
 					Region: "ap-south-1",
 				}: endpoint{
 					Hostname: "internetmonitor.ap-south-1.api.aws",
 				},
+				endpointKey{
+					Region: "ap-south-2",
+				}: endpoint{
+					Hostname: "internetmonitor.ap-south-2.api.aws",
+				},
 				endpointKey{
 					Region: "ap-southeast-1",
 				}: endpoint{
@@ -13823,16 +14889,37 @@ var awsPartition = partition{
 				}: endpoint{
 					Hostname: "internetmonitor.ap-southeast-2.api.aws",
 				},
+				endpointKey{
+					Region: "ap-southeast-3",
+				}: endpoint{
+					Hostname: "internetmonitor.ap-southeast-3.api.aws",
+				},
+				endpointKey{
+					Region: "ap-southeast-4",
+				}: endpoint{
+					Hostname: "internetmonitor.ap-southeast-4.api.aws",
+				},
 				endpointKey{
 					Region: "ca-central-1",
 				}: endpoint{
 					Hostname: "internetmonitor.ca-central-1.api.aws",
 				},
+				endpointKey{
+					Region:  "ca-central-1",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "internetmonitor-fips.ca-central-1.amazonaws.com",
+				},
 				endpointKey{
 					Region: "eu-central-1",
 				}: endpoint{
 					Hostname: "internetmonitor.eu-central-1.api.aws",
 				},
+				endpointKey{
+					Region: "eu-central-2",
+				}: endpoint{
+					Hostname: "internetmonitor.eu-central-2.api.aws",
+				},
 				endpointKey{
 					Region: "eu-north-1",
 				}: endpoint{
@@ -13843,6 +14930,11 @@ var awsPartition = partition{
 				}: endpoint{
 					Hostname: "internetmonitor.eu-south-1.api.aws",
 				},
+				endpointKey{
+					Region: "eu-south-2",
+				}: endpoint{
+					Hostname: "internetmonitor.eu-south-2.api.aws",
+				},
 				endpointKey{
 					Region: "eu-west-1",
 				}: endpoint{
@@ -13858,6 +14950,16 @@ var awsPartition = partition{
 				}: endpoint{
 					Hostname: "internetmonitor.eu-west-3.api.aws",
 				},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{
+					Hostname: "internetmonitor.il-central-1.api.aws",
+				},
+				endpointKey{
+					Region: "me-central-1",
+				}: endpoint{
+					Hostname: "internetmonitor.me-central-1.api.aws",
+				},
 				endpointKey{
 					Region: "me-south-1",
 				}: endpoint{
@@ -13873,21 +14975,45 @@ var awsPartition = partition{
 				}: endpoint{
 					Hostname: "internetmonitor.us-east-1.api.aws",
 				},
+				endpointKey{
+					Region:  "us-east-1",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "internetmonitor-fips.us-east-1.amazonaws.com",
+				},
 				endpointKey{
 					Region: "us-east-2",
 				}: endpoint{
 					Hostname: "internetmonitor.us-east-2.api.aws",
 				},
+				endpointKey{
+					Region:  "us-east-2",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "internetmonitor-fips.us-east-2.amazonaws.com",
+				},
 				endpointKey{
 					Region: "us-west-1",
 				}: endpoint{
 					Hostname: "internetmonitor.us-west-1.api.aws",
 				},
+				endpointKey{
+					Region:  "us-west-1",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "internetmonitor-fips.us-west-1.amazonaws.com",
+				},
 				endpointKey{
 					Region: "us-west-2",
 				}: endpoint{
 					Hostname: "internetmonitor.us-west-2.api.aws",
 				},
+				endpointKey{
+					Region:  "us-west-2",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "internetmonitor-fips.us-west-2.amazonaws.com",
+				},
 			},
 		},
 		"iot": service{
@@ -14605,18 +15731,203 @@ var awsPartition = partition{
 		},
 		"iottwinmaker": service{
 			Endpoints: serviceEndpoints{
+				endpointKey{
+					Region: "ap-northeast-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-northeast-2",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-south-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-southeast-1",
 				}: endpoint{},
 				endpointKey{
 					Region: "ap-southeast-2",
 				}: endpoint{},
+				endpointKey{
+					Region: "api-ap-northeast-1",
+				}: endpoint{
+					Hostname: "api.iottwinmaker.ap-northeast-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "ap-northeast-1",
+					},
+				},
+				endpointKey{
+					Region: "api-ap-northeast-2",
+				}: endpoint{
+					Hostname: "api.iottwinmaker.ap-northeast-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "ap-northeast-2",
+					},
+				},
+				endpointKey{
+					Region: "api-ap-south-1",
+				}: endpoint{
+					Hostname: "api.iottwinmaker.ap-south-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "ap-south-1",
+					},
+				},
+				endpointKey{
+					Region: "api-ap-southeast-1",
+				}: endpoint{
+					Hostname: "api.iottwinmaker.ap-southeast-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "ap-southeast-1",
+					},
+				},
+				endpointKey{
+					Region: "api-ap-southeast-2",
+				}: endpoint{
+					Hostname: "api.iottwinmaker.ap-southeast-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "ap-southeast-2",
+					},
+				},
+				endpointKey{
+					Region: "api-eu-central-1",
+				}: endpoint{
+					Hostname: "api.iottwinmaker.eu-central-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "eu-central-1",
+					},
+				},
+				endpointKey{
+					Region: "api-eu-west-1",
+				}: endpoint{
+					Hostname: "api.iottwinmaker.eu-west-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "eu-west-1",
+					},
+				},
+				endpointKey{
+					Region: "api-us-east-1",
+				}: endpoint{
+					Hostname: "api.iottwinmaker.us-east-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-1",
+					},
+				},
+				endpointKey{
+					Region: "api-us-west-2",
+				}: endpoint{
+					Hostname: "api.iottwinmaker.us-west-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-west-2",
+					},
+				},
+				endpointKey{
+					Region: "data-ap-northeast-1",
+				}: endpoint{
+					Hostname: "data.iottwinmaker.ap-northeast-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "ap-northeast-1",
+					},
+				},
+				endpointKey{
+					Region: "data-ap-northeast-2",
+				}: endpoint{
+					Hostname: "data.iottwinmaker.ap-northeast-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "ap-northeast-2",
+					},
+				},
+				endpointKey{
+					Region: "data-ap-south-1",
+				}: endpoint{
+					Hostname: "data.iottwinmaker.ap-south-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "ap-south-1",
+					},
+				},
+				endpointKey{
+					Region: "data-ap-southeast-1",
+				}: endpoint{
+					Hostname: "data.iottwinmaker.ap-southeast-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "ap-southeast-1",
+					},
+				},
+				endpointKey{
+					Region: "data-ap-southeast-2",
+				}: endpoint{
+					Hostname: "data.iottwinmaker.ap-southeast-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "ap-southeast-2",
+					},
+				},
+				endpointKey{
+					Region: "data-eu-central-1",
+				}: endpoint{
+					Hostname: "data.iottwinmaker.eu-central-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "eu-central-1",
+					},
+				},
+				endpointKey{
+					Region: "data-eu-west-1",
+				}: endpoint{
+					Hostname: "data.iottwinmaker.eu-west-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "eu-west-1",
+					},
+				},
+				endpointKey{
+					Region: "data-us-east-1",
+				}: endpoint{
+					Hostname: "data.iottwinmaker.us-east-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-1",
+					},
+				},
+				endpointKey{
+					Region: "data-us-west-2",
+				}: endpoint{
+					Hostname: "data.iottwinmaker.us-west-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-west-2",
+					},
+				},
 				endpointKey{
 					Region: "eu-central-1",
 				}: endpoint{},
 				endpointKey{
 					Region: "eu-west-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "fips-api-us-east-1",
+				}: endpoint{
+					Hostname: "api.iottwinmaker-fips.us-east-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-1",
+					},
+				},
+				endpointKey{
+					Region: "fips-api-us-west-2",
+				}: endpoint{
+					Hostname: "api.iottwinmaker-fips.us-west-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-west-2",
+					},
+				},
+				endpointKey{
+					Region: "fips-data-us-east-1",
+				}: endpoint{
+					Hostname: "data.iottwinmaker-fips.us-east-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-1",
+					},
+				},
+				endpointKey{
+					Region: "fips-data-us-west-2",
+				}: endpoint{
+					Hostname: "data.iottwinmaker-fips.us-west-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-west-2",
+					},
+				},
 				endpointKey{
 					Region: "fips-us-east-1",
 				}: endpoint{
@@ -14887,6 +16198,9 @@ var awsPartition = partition{
 					},
 					Deprecated: boxedTrue,
 				},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-central-1",
 				}: endpoint{},
@@ -15174,6 +16488,11 @@ var awsPartition = partition{
 				}: endpoint{
 					Hostname: "kendra-ranking.eu-west-3.api.aws",
 				},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{
+					Hostname: "kendra-ranking.il-central-1.api.aws",
+				},
 				endpointKey{
 					Region: "me-central-1",
 				}: endpoint{
@@ -15292,149 +16611,155 @@ var awsPartition = partition{
 					Region: "eu-west-3",
 				}: endpoint{},
 				endpointKey{
-					Region: "fips-us-east-1",
-				}: endpoint{
-					Hostname: "kinesis-fips.us-east-1.amazonaws.com",
-					CredentialScope: credentialScope{
-						Region: "us-east-1",
-					},
-					Deprecated: boxedTrue,
-				},
-				endpointKey{
-					Region: "fips-us-east-2",
-				}: endpoint{
-					Hostname: "kinesis-fips.us-east-2.amazonaws.com",
-					CredentialScope: credentialScope{
-						Region: "us-east-2",
-					},
-					Deprecated: boxedTrue,
-				},
-				endpointKey{
-					Region: "fips-us-west-1",
-				}: endpoint{
-					Hostname: "kinesis-fips.us-west-1.amazonaws.com",
-					CredentialScope: credentialScope{
-						Region: "us-west-1",
-					},
-					Deprecated: boxedTrue,
-				},
-				endpointKey{
-					Region: "fips-us-west-2",
-				}: endpoint{
-					Hostname: "kinesis-fips.us-west-2.amazonaws.com",
-					CredentialScope: credentialScope{
-						Region: "us-west-2",
-					},
-					Deprecated: boxedTrue,
-				},
-				endpointKey{
-					Region: "me-central-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "me-south-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "sa-east-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "us-east-1",
-				}: endpoint{},
-				endpointKey{
-					Region:  "us-east-1",
-					Variant: fipsVariant,
-				}: endpoint{
-					Hostname: "kinesis-fips.us-east-1.amazonaws.com",
-				},
-				endpointKey{
-					Region: "us-east-2",
-				}: endpoint{},
-				endpointKey{
-					Region:  "us-east-2",
-					Variant: fipsVariant,
-				}: endpoint{
-					Hostname: "kinesis-fips.us-east-2.amazonaws.com",
-				},
-				endpointKey{
-					Region: "us-west-1",
-				}: endpoint{},
-				endpointKey{
-					Region:  "us-west-1",
-					Variant: fipsVariant,
-				}: endpoint{
-					Hostname: "kinesis-fips.us-west-1.amazonaws.com",
-				},
-				endpointKey{
-					Region: "us-west-2",
-				}: endpoint{},
-				endpointKey{
-					Region:  "us-west-2",
-					Variant: fipsVariant,
-				}: endpoint{
-					Hostname: "kinesis-fips.us-west-2.amazonaws.com",
-				},
-			},
-		},
-		"kinesisanalytics": service{
-			Endpoints: serviceEndpoints{
-				endpointKey{
-					Region: "af-south-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "ap-east-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "ap-northeast-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "ap-northeast-2",
-				}: endpoint{},
-				endpointKey{
-					Region: "ap-northeast-3",
-				}: endpoint{},
-				endpointKey{
-					Region: "ap-south-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "ap-south-2",
-				}: endpoint{},
-				endpointKey{
-					Region: "ap-southeast-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "ap-southeast-2",
-				}: endpoint{},
-				endpointKey{
-					Region: "ap-southeast-3",
-				}: endpoint{},
-				endpointKey{
-					Region: "ap-southeast-4",
-				}: endpoint{},
-				endpointKey{
-					Region: "ca-central-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "eu-central-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "eu-central-2",
-				}: endpoint{},
-				endpointKey{
-					Region: "eu-north-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "eu-south-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "eu-south-2",
-				}: endpoint{},
-				endpointKey{
-					Region: "eu-west-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "eu-west-2",
-				}: endpoint{},
-				endpointKey{
-					Region: "eu-west-3",
+					Region: "fips-us-east-1",
+				}: endpoint{
+					Hostname: "kinesis-fips.us-east-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-1",
+					},
+					Deprecated: boxedTrue,
+				},
+				endpointKey{
+					Region: "fips-us-east-2",
+				}: endpoint{
+					Hostname: "kinesis-fips.us-east-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-2",
+					},
+					Deprecated: boxedTrue,
+				},
+				endpointKey{
+					Region: "fips-us-west-1",
+				}: endpoint{
+					Hostname: "kinesis-fips.us-west-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-west-1",
+					},
+					Deprecated: boxedTrue,
+				},
+				endpointKey{
+					Region: "fips-us-west-2",
+				}: endpoint{
+					Hostname: "kinesis-fips.us-west-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-west-2",
+					},
+					Deprecated: boxedTrue,
+				},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "me-central-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "me-south-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "sa-east-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "us-east-1",
+				}: endpoint{},
+				endpointKey{
+					Region:  "us-east-1",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "kinesis-fips.us-east-1.amazonaws.com",
+				},
+				endpointKey{
+					Region: "us-east-2",
+				}: endpoint{},
+				endpointKey{
+					Region:  "us-east-2",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "kinesis-fips.us-east-2.amazonaws.com",
+				},
+				endpointKey{
+					Region: "us-west-1",
+				}: endpoint{},
+				endpointKey{
+					Region:  "us-west-1",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "kinesis-fips.us-west-1.amazonaws.com",
+				},
+				endpointKey{
+					Region: "us-west-2",
+				}: endpoint{},
+				endpointKey{
+					Region:  "us-west-2",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "kinesis-fips.us-west-2.amazonaws.com",
+				},
+			},
+		},
+		"kinesisanalytics": service{
+			Endpoints: serviceEndpoints{
+				endpointKey{
+					Region: "af-south-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-east-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-northeast-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-northeast-2",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-northeast-3",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-south-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-south-2",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-2",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-3",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-4",
+				}: endpoint{},
+				endpointKey{
+					Region: "ca-central-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-central-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-central-2",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-north-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-south-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-south-2",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-west-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-west-2",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-west-3",
+				}: endpoint{},
+				endpointKey{
+					Region: "il-central-1",
 				}: endpoint{},
 				endpointKey{
 					Region: "me-central-1",
@@ -15882,6 +17207,15 @@ var awsPartition = partition{
 					},
 					Deprecated: boxedTrue,
 				},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
+				endpointKey{
+					Region:  "il-central-1",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "kms-fips.il-central-1.amazonaws.com",
+				},
 				endpointKey{
 					Region: "il-central-1-fips",
 				}: endpoint{
@@ -15889,6 +17223,7 @@ var awsPartition = partition{
 					CredentialScope: credentialScope{
 						Region: "il-central-1",
 					},
+					Deprecated: boxedTrue,
 				},
 				endpointKey{
 					Region: "me-central-1",
@@ -16038,6 +17373,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-southeast-1",
 				}: endpoint{},
@@ -16047,6 +17385,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-southeast-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-4",
+				}: endpoint{},
 				endpointKey{
 					Region: "ca-central-1",
 				}: endpoint{},
@@ -16110,6 +17451,9 @@ var awsPartition = partition{
 					},
 					Deprecated: boxedTrue,
 				},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-central-1",
 				}: endpoint{},
@@ -16375,6 +17719,15 @@ var awsPartition = partition{
 					},
 					Deprecated: boxedTrue,
 				},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
+				endpointKey{
+					Region:  "il-central-1",
+					Variant: dualStackVariant,
+				}: endpoint{
+					Hostname: "lambda.il-central-1.api.aws",
+				},
 				endpointKey{
 					Region: "me-central-1",
 				}: endpoint{},
@@ -16484,6 +17837,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-southeast-1",
 				}: endpoint{},
@@ -16493,12 +17849,18 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-southeast-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-4",
+				}: endpoint{},
 				endpointKey{
 					Region: "ca-central-1",
 				}: endpoint{},
 				endpointKey{
 					Region: "eu-central-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-central-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-north-1",
 				}: endpoint{},
@@ -16550,6 +17912,12 @@ var awsPartition = partition{
 					},
 					Deprecated: boxedTrue,
 				},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "me-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-south-1",
 				}: endpoint{},
@@ -16644,139 +18012,154 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-south-1",
 				}: endpoint{},
-				endpointKey{
-					Region: "eu-south-2",
-				}: endpoint{},
-				endpointKey{
-					Region: "eu-west-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "eu-west-2",
-				}: endpoint{},
-				endpointKey{
-					Region: "eu-west-3",
-				}: endpoint{},
-				endpointKey{
-					Region: "fips-us-east-1",
-				}: endpoint{
-					Hostname: "license-manager-linux-subscriptions-fips.us-east-1.amazonaws.com",
-					CredentialScope: credentialScope{
-						Region: "us-east-1",
-					},
-					Deprecated: boxedTrue,
-				},
-				endpointKey{
-					Region: "fips-us-east-2",
-				}: endpoint{
-					Hostname: "license-manager-linux-subscriptions-fips.us-east-2.amazonaws.com",
-					CredentialScope: credentialScope{
-						Region: "us-east-2",
-					},
-					Deprecated: boxedTrue,
-				},
-				endpointKey{
-					Region: "fips-us-west-1",
-				}: endpoint{
-					Hostname: "license-manager-linux-subscriptions-fips.us-west-1.amazonaws.com",
-					CredentialScope: credentialScope{
-						Region: "us-west-1",
-					},
-					Deprecated: boxedTrue,
-				},
-				endpointKey{
-					Region: "fips-us-west-2",
-				}: endpoint{
-					Hostname: "license-manager-linux-subscriptions-fips.us-west-2.amazonaws.com",
-					CredentialScope: credentialScope{
-						Region: "us-west-2",
-					},
-					Deprecated: boxedTrue,
-				},
-				endpointKey{
-					Region: "me-central-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "me-south-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "sa-east-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "us-east-1",
-				}: endpoint{},
-				endpointKey{
-					Region:  "us-east-1",
-					Variant: fipsVariant,
-				}: endpoint{
-					Hostname: "license-manager-linux-subscriptions-fips.us-east-1.amazonaws.com",
-				},
-				endpointKey{
-					Region: "us-east-2",
-				}: endpoint{},
-				endpointKey{
-					Region:  "us-east-2",
-					Variant: fipsVariant,
-				}: endpoint{
-					Hostname: "license-manager-linux-subscriptions-fips.us-east-2.amazonaws.com",
-				},
-				endpointKey{
-					Region: "us-west-1",
-				}: endpoint{},
-				endpointKey{
-					Region:  "us-west-1",
-					Variant: fipsVariant,
-				}: endpoint{
-					Hostname: "license-manager-linux-subscriptions-fips.us-west-1.amazonaws.com",
-				},
-				endpointKey{
-					Region: "us-west-2",
-				}: endpoint{},
-				endpointKey{
-					Region:  "us-west-2",
-					Variant: fipsVariant,
-				}: endpoint{
-					Hostname: "license-manager-linux-subscriptions-fips.us-west-2.amazonaws.com",
-				},
-			},
-		},
-		"license-manager-user-subscriptions": service{
-			Endpoints: serviceEndpoints{
-				endpointKey{
-					Region: "af-south-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "ap-east-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "ap-northeast-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "ap-northeast-2",
-				}: endpoint{},
-				endpointKey{
-					Region: "ap-northeast-3",
-				}: endpoint{},
-				endpointKey{
-					Region: "ap-south-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "ap-southeast-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "ap-southeast-2",
-				}: endpoint{},
-				endpointKey{
-					Region: "ca-central-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "eu-central-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "eu-north-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "eu-south-1",
-				}: endpoint{},
+				endpointKey{
+					Region: "eu-south-2",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-west-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-west-2",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-west-3",
+				}: endpoint{},
+				endpointKey{
+					Region: "fips-us-east-1",
+				}: endpoint{
+					Hostname: "license-manager-linux-subscriptions-fips.us-east-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-1",
+					},
+					Deprecated: boxedTrue,
+				},
+				endpointKey{
+					Region: "fips-us-east-2",
+				}: endpoint{
+					Hostname: "license-manager-linux-subscriptions-fips.us-east-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-2",
+					},
+					Deprecated: boxedTrue,
+				},
+				endpointKey{
+					Region: "fips-us-west-1",
+				}: endpoint{
+					Hostname: "license-manager-linux-subscriptions-fips.us-west-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-west-1",
+					},
+					Deprecated: boxedTrue,
+				},
+				endpointKey{
+					Region: "fips-us-west-2",
+				}: endpoint{
+					Hostname: "license-manager-linux-subscriptions-fips.us-west-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-west-2",
+					},
+					Deprecated: boxedTrue,
+				},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "me-central-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "me-south-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "sa-east-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "us-east-1",
+				}: endpoint{},
+				endpointKey{
+					Region:  "us-east-1",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "license-manager-linux-subscriptions-fips.us-east-1.amazonaws.com",
+				},
+				endpointKey{
+					Region: "us-east-2",
+				}: endpoint{},
+				endpointKey{
+					Region:  "us-east-2",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "license-manager-linux-subscriptions-fips.us-east-2.amazonaws.com",
+				},
+				endpointKey{
+					Region: "us-west-1",
+				}: endpoint{},
+				endpointKey{
+					Region:  "us-west-1",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "license-manager-linux-subscriptions-fips.us-west-1.amazonaws.com",
+				},
+				endpointKey{
+					Region: "us-west-2",
+				}: endpoint{},
+				endpointKey{
+					Region:  "us-west-2",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "license-manager-linux-subscriptions-fips.us-west-2.amazonaws.com",
+				},
+			},
+		},
+		"license-manager-user-subscriptions": service{
+			Endpoints: serviceEndpoints{
+				endpointKey{
+					Region: "af-south-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-east-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-northeast-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-northeast-2",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-northeast-3",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-south-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-south-2",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-2",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-3",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-4",
+				}: endpoint{},
+				endpointKey{
+					Region: "ca-central-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-central-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-central-2",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-north-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-south-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-west-1",
 				}: endpoint{},
@@ -16822,6 +18205,12 @@ var awsPartition = partition{
 					},
 					Deprecated: boxedTrue,
 				},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "me-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-south-1",
 				}: endpoint{},
@@ -17010,6 +18399,9 @@ var awsPartition = partition{
 					},
 					Deprecated: boxedTrue,
 				},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-central-1",
 				}: endpoint{},
@@ -17358,6 +18750,9 @@ var awsPartition = partition{
 					},
 					Deprecated: boxedTrue,
 				},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-south-1",
 				}: endpoint{},
@@ -17424,6 +18819,13 @@ var awsPartition = partition{
 				}: endpoint{},
 			},
 		},
+		"managedblockchain-query": service{
+			Endpoints: serviceEndpoints{
+				endpointKey{
+					Region: "us-east-1",
+				}: endpoint{},
+			},
+		},
 		"marketplacecommerceanalytics": service{
 			Endpoints: serviceEndpoints{
 				endpointKey{
@@ -17479,6 +18881,9 @@ var awsPartition = partition{
 		},
 		"mediaconnect": service{
 			Endpoints: serviceEndpoints{
+				endpointKey{
+					Region: "af-south-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-east-1",
 				}: endpoint{},
@@ -17488,6 +18893,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-northeast-2",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-northeast-3",
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-south-1",
 				}: endpoint{},
@@ -17497,6 +18905,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-southeast-2",
 				}: endpoint{},
+				endpointKey{
+					Region: "ca-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-central-1",
 				}: endpoint{},
@@ -17540,6 +18951,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-northeast-2",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-northeast-3",
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-south-1",
 				}: endpoint{},
@@ -17549,6 +18963,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-southeast-2",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-4",
+				}: endpoint{},
 				endpointKey{
 					Region: "ca-central-1",
 				}: endpoint{},
@@ -17758,6 +19175,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-northeast-2",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-northeast-3",
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-south-1",
 				}: endpoint{},
@@ -17767,6 +19187,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-southeast-2",
 				}: endpoint{},
+				endpointKey{
+					Region: "ca-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-central-1",
 				}: endpoint{},
@@ -17807,6 +19230,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-northeast-2",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-northeast-3",
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-south-1",
 				}: endpoint{},
@@ -17816,6 +19242,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-southeast-2",
 				}: endpoint{},
+				endpointKey{
+					Region: "ca-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-central-1",
 				}: endpoint{},
@@ -17856,6 +19285,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-northeast-2",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-northeast-3",
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-south-1",
 				}: endpoint{},
@@ -17865,6 +19297,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-southeast-2",
 				}: endpoint{},
+				endpointKey{
+					Region: "ca-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-central-1",
 				}: endpoint{},
@@ -17930,12 +19365,33 @@ var awsPartition = partition{
 		},
 		"meetings-chime": service{
 			Endpoints: serviceEndpoints{
+				endpointKey{
+					Region: "ap-northeast-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-northeast-2",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-south-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-southeast-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-2",
+				}: endpoint{},
+				endpointKey{
+					Region: "ca-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-central-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-west-2",
+				}: endpoint{},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "us-east-1",
 				}: endpoint{},
@@ -18134,6 +19590,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-west-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-central-1",
 				}: endpoint{},
@@ -18219,6 +19678,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-west-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-central-1",
 				}: endpoint{},
@@ -18365,6 +19827,9 @@ var awsPartition = partition{
 					},
 					Deprecated: boxedTrue,
 				},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-central-1",
 				}: endpoint{},
@@ -18682,6 +20147,9 @@ var awsPartition = partition{
 					},
 					Deprecated: boxedTrue,
 				},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-central-1",
 				}: endpoint{},
@@ -19055,6 +20523,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-southeast-1",
 				}: endpoint{},
@@ -19064,6 +20535,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-southeast-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-4",
+				}: endpoint{},
 				endpointKey{
 					Region: "ca-central-1",
 				}: endpoint{},
@@ -19076,12 +20550,18 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-central-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-central-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-north-1",
 				}: endpoint{},
 				endpointKey{
 					Region: "eu-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-west-1",
 				}: endpoint{},
@@ -19136,6 +20616,9 @@ var awsPartition = partition{
 					},
 					Deprecated: boxedTrue,
 				},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-central-1",
 				}: endpoint{},
@@ -19195,6 +20678,24 @@ var awsPartition = partition{
 						Region: "us-west-2",
 					},
 				},
+				endpointKey{
+					Region:  "aws-global",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "networkmanager-fips.us-west-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-west-2",
+					},
+				},
+				endpointKey{
+					Region: "fips-aws-global",
+				}: endpoint{
+					Hostname: "networkmanager-fips.us-west-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-west-2",
+					},
+					Deprecated: boxedTrue,
+				},
 			},
 		},
 		"nimble": service{
@@ -19202,18 +20703,33 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-northeast-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-southeast-2",
 				}: endpoint{},
 				endpointKey{
 					Region: "ca-central-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-central-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-north-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-west-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-west-2",
 				}: endpoint{},
 				endpointKey{
 					Region: "us-east-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "us-east-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "us-west-2",
 				}: endpoint{},
@@ -19281,6 +20797,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-west-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-central-1",
 				}: endpoint{},
@@ -19394,6 +20913,14 @@ var awsPartition = partition{
 						Region: "eu-central-1",
 					},
 				},
+				endpointKey{
+					Region: "eu-central-2",
+				}: endpoint{
+					Hostname: "oidc.eu-central-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "eu-central-2",
+					},
+				},
 				endpointKey{
 					Region: "eu-north-1",
 				}: endpoint{
@@ -19434,6 +20961,14 @@ var awsPartition = partition{
 						Region: "eu-west-3",
 					},
 				},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{
+					Hostname: "oidc.il-central-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "il-central-1",
+					},
+				},
 				endpointKey{
 					Region: "me-south-1",
 				}: endpoint{
@@ -19536,6 +21071,14 @@ var awsPartition = partition{
 					},
 					Deprecated: boxedTrue,
 				},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{
+					Hostname: "omics.il-central-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "il-central-1",
+					},
+				},
 				endpointKey{
 					Region: "us-east-1",
 				}: endpoint{
@@ -19819,6 +21362,12 @@ var awsPartition = partition{
 					},
 					Deprecated: boxedTrue,
 				},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "me-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-south-1",
 				}: endpoint{},
@@ -20026,6 +21575,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-west-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-central-1",
 				}: endpoint{},
@@ -20208,6 +21760,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-southeast-1",
 				}: endpoint{},
@@ -20223,12 +21778,18 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-central-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-central-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-north-1",
 				}: endpoint{},
 				endpointKey{
 					Region: "eu-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-west-1",
 				}: endpoint{},
@@ -20475,6 +22036,14 @@ var awsPartition = partition{
 						Region: "eu-central-1",
 					},
 				},
+				endpointKey{
+					Region: "eu-central-2",
+				}: endpoint{
+					Hostname: "portal.sso.eu-central-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "eu-central-2",
+					},
+				},
 				endpointKey{
 					Region: "eu-north-1",
 				}: endpoint{
@@ -20515,6 +22084,14 @@ var awsPartition = partition{
 						Region: "eu-west-3",
 					},
 				},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{
+					Hostname: "portal.sso.il-central-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "il-central-1",
+					},
+				},
 				endpointKey{
 					Region: "me-south-1",
 				}: endpoint{
@@ -20965,6 +22542,9 @@ var awsPartition = partition{
 					},
 					Deprecated: boxedTrue,
 				},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-central-1",
 				}: endpoint{},
@@ -21125,6 +22705,9 @@ var awsPartition = partition{
 					},
 					Deprecated: boxedTrue,
 				},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-central-1",
 				}: endpoint{},
@@ -21249,6 +22832,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-west-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-central-1",
 				}: endpoint{},
@@ -21689,6 +23275,9 @@ var awsPartition = partition{
 					},
 					Deprecated: boxedTrue,
 				},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-central-1",
 				}: endpoint{},
@@ -21829,6 +23418,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-west-2",
 				}: endpoint{},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "rekognition-fips.ca-central-1",
 				}: endpoint{
@@ -22150,6 +23742,11 @@ var awsPartition = partition{
 				}: endpoint{
 					Hostname: "resource-explorer-2.ap-southeast-2.api.aws",
 				},
+				endpointKey{
+					Region: "ap-southeast-3",
+				}: endpoint{
+					Hostname: "resource-explorer-2.ap-southeast-3.api.aws",
+				},
 				endpointKey{
 					Region: "ap-southeast-4",
 				}: endpoint{
@@ -22190,6 +23787,16 @@ var awsPartition = partition{
 				}: endpoint{
 					Hostname: "resource-explorer-2.eu-west-3.api.aws",
 				},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{
+					Hostname: "resource-explorer-2.il-central-1.api.aws",
+				},
+				endpointKey{
+					Region: "me-south-1",
+				}: endpoint{
+					Hostname: "resource-explorer-2.me-south-1.api.aws",
+				},
 				endpointKey{
 					Region: "sa-east-1",
 				}: endpoint{
@@ -22315,6 +23922,9 @@ var awsPartition = partition{
 					},
 					Deprecated: boxedTrue,
 				},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-central-1",
 				}: endpoint{},
@@ -22575,6 +24185,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-west-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-central-1",
 				}: endpoint{},
@@ -22812,6 +24425,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-west-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-central-1",
 				}: endpoint{},
@@ -23183,6 +24799,15 @@ var awsPartition = partition{
 					},
 					Deprecated: boxedTrue,
 				},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
+				endpointKey{
+					Region:  "il-central-1",
+					Variant: dualStackVariant,
+				}: endpoint{
+					Hostname: "s3.dualstack.il-central-1.amazonaws.com",
+				},
 				endpointKey{
 					Region: "me-central-1",
 				}: endpoint{},
@@ -23910,6 +25535,9 @@ var awsPartition = partition{
 
 					Deprecated: boxedTrue,
 				},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-south-1",
 				}: endpoint{},
@@ -24054,6 +25682,9 @@ var awsPartition = partition{
 		},
 		"schemas": service{
 			Endpoints: serviceEndpoints{
+				endpointKey{
+					Region: "af-south-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-east-1",
 				}: endpoint{},
@@ -24063,6 +25694,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-northeast-2",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-northeast-3",
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-south-1",
 				}: endpoint{},
@@ -24072,15 +25706,27 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-southeast-2",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-3",
+				}: endpoint{},
 				endpointKey{
 					Region: "ca-central-1",
 				}: endpoint{},
 				endpointKey{
 					Region: "eu-central-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-central-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-north-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-south-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-west-1",
 				}: endpoint{},
@@ -24090,6 +25736,12 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-west-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "me-central-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "me-south-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "sa-east-1",
 				}: endpoint{},
@@ -24220,6 +25872,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-west-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-central-1",
 				}: endpoint{},
@@ -24401,6 +26056,9 @@ var awsPartition = partition{
 					},
 					Deprecated: boxedTrue,
 				},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-central-1",
 				}: endpoint{},
@@ -24456,6 +26114,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-northeast-2",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-northeast-3",
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-south-1",
 				}: endpoint{},
@@ -24465,15 +26126,24 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-southeast-2",
 				}: endpoint{},
+				endpointKey{
+					Region: "ca-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-central-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-north-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-west-1",
 				}: endpoint{},
 				endpointKey{
 					Region: "eu-west-2",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-west-3",
+				}: endpoint{},
 				endpointKey{
 					Region: "sa-east-1",
 				}: endpoint{},
@@ -24652,6 +26322,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-west-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-central-1",
 				}: endpoint{},
@@ -24755,6 +26428,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-southeast-1",
 				}: endpoint{},
@@ -24764,6 +26440,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-southeast-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-4",
+				}: endpoint{},
 				endpointKey{
 					Region: "ca-central-1",
 				}: endpoint{},
@@ -24776,12 +26455,18 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-central-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-central-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-north-1",
 				}: endpoint{},
 				endpointKey{
 					Region: "eu-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-west-1",
 				}: endpoint{},
@@ -24892,7 +26577,7 @@ var awsPartition = partition{
 					Region:  "af-south-1",
 					Variant: dualStackVariant,
 				}: endpoint{
-					Hostname: "servicediscovery.af-south-1.amazonaws.com",
+					Hostname: "servicediscovery.af-south-1.api.aws",
 				},
 				endpointKey{
 					Region: "ap-east-1",
@@ -24901,7 +26586,7 @@ var awsPartition = partition{
 					Region:  "ap-east-1",
 					Variant: dualStackVariant,
 				}: endpoint{
-					Hostname: "servicediscovery.ap-east-1.amazonaws.com",
+					Hostname: "servicediscovery.ap-east-1.api.aws",
 				},
 				endpointKey{
 					Region: "ap-northeast-1",
@@ -24910,7 +26595,7 @@ var awsPartition = partition{
 					Region:  "ap-northeast-1",
 					Variant: dualStackVariant,
 				}: endpoint{
-					Hostname: "servicediscovery.ap-northeast-1.amazonaws.com",
+					Hostname: "servicediscovery.ap-northeast-1.api.aws",
 				},
 				endpointKey{
 					Region: "ap-northeast-2",
@@ -24919,7 +26604,7 @@ var awsPartition = partition{
 					Region:  "ap-northeast-2",
 					Variant: dualStackVariant,
 				}: endpoint{
-					Hostname: "servicediscovery.ap-northeast-2.amazonaws.com",
+					Hostname: "servicediscovery.ap-northeast-2.api.aws",
 				},
 				endpointKey{
 					Region: "ap-northeast-3",
@@ -24928,7 +26613,7 @@ var awsPartition = partition{
 					Region:  "ap-northeast-3",
 					Variant: dualStackVariant,
 				}: endpoint{
-					Hostname: "servicediscovery.ap-northeast-3.amazonaws.com",
+					Hostname: "servicediscovery.ap-northeast-3.api.aws",
 				},
 				endpointKey{
 					Region: "ap-south-1",
@@ -24937,7 +26622,7 @@ var awsPartition = partition{
 					Region:  "ap-south-1",
 					Variant: dualStackVariant,
 				}: endpoint{
-					Hostname: "servicediscovery.ap-south-1.amazonaws.com",
+					Hostname: "servicediscovery.ap-south-1.api.aws",
 				},
 				endpointKey{
 					Region: "ap-south-2",
@@ -24946,7 +26631,7 @@ var awsPartition = partition{
 					Region:  "ap-south-2",
 					Variant: dualStackVariant,
 				}: endpoint{
-					Hostname: "servicediscovery.ap-south-2.amazonaws.com",
+					Hostname: "servicediscovery.ap-south-2.api.aws",
 				},
 				endpointKey{
 					Region: "ap-southeast-1",
@@ -24955,7 +26640,7 @@ var awsPartition = partition{
 					Region:  "ap-southeast-1",
 					Variant: dualStackVariant,
 				}: endpoint{
-					Hostname: "servicediscovery.ap-southeast-1.amazonaws.com",
+					Hostname: "servicediscovery.ap-southeast-1.api.aws",
 				},
 				endpointKey{
 					Region: "ap-southeast-2",
@@ -24964,7 +26649,7 @@ var awsPartition = partition{
 					Region:  "ap-southeast-2",
 					Variant: dualStackVariant,
 				}: endpoint{
-					Hostname: "servicediscovery.ap-southeast-2.amazonaws.com",
+					Hostname: "servicediscovery.ap-southeast-2.api.aws",
 				},
 				endpointKey{
 					Region: "ap-southeast-3",
@@ -24973,7 +26658,7 @@ var awsPartition = partition{
 					Region:  "ap-southeast-3",
 					Variant: dualStackVariant,
 				}: endpoint{
-					Hostname: "servicediscovery.ap-southeast-3.amazonaws.com",
+					Hostname: "servicediscovery.ap-southeast-3.api.aws",
 				},
 				endpointKey{
 					Region: "ap-southeast-4",
@@ -24982,7 +26667,7 @@ var awsPartition = partition{
 					Region:  "ap-southeast-4",
 					Variant: dualStackVariant,
 				}: endpoint{
-					Hostname: "servicediscovery.ap-southeast-4.amazonaws.com",
+					Hostname: "servicediscovery.ap-southeast-4.api.aws",
 				},
 				endpointKey{
 					Region: "ca-central-1",
@@ -24991,7 +26676,7 @@ var awsPartition = partition{
 					Region:  "ca-central-1",
 					Variant: dualStackVariant,
 				}: endpoint{
-					Hostname: "servicediscovery.ca-central-1.amazonaws.com",
+					Hostname: "servicediscovery.ca-central-1.api.aws",
 				},
 				endpointKey{
 					Region:  "ca-central-1",
@@ -24999,6 +26684,12 @@ var awsPartition = partition{
 				}: endpoint{
 					Hostname: "servicediscovery-fips.ca-central-1.amazonaws.com",
 				},
+				endpointKey{
+					Region:  "ca-central-1",
+					Variant: fipsVariant | dualStackVariant,
+				}: endpoint{
+					Hostname: "servicediscovery-fips.ca-central-1.api.aws",
+				},
 				endpointKey{
 					Region: "ca-central-1-fips",
 				}: endpoint{
@@ -25015,7 +26706,7 @@ var awsPartition = partition{
 					Region:  "eu-central-1",
 					Variant: dualStackVariant,
 				}: endpoint{
-					Hostname: "servicediscovery.eu-central-1.amazonaws.com",
+					Hostname: "servicediscovery.eu-central-1.api.aws",
 				},
 				endpointKey{
 					Region: "eu-central-2",
@@ -25024,7 +26715,7 @@ var awsPartition = partition{
 					Region:  "eu-central-2",
 					Variant: dualStackVariant,
 				}: endpoint{
-					Hostname: "servicediscovery.eu-central-2.amazonaws.com",
+					Hostname: "servicediscovery.eu-central-2.api.aws",
 				},
 				endpointKey{
 					Region: "eu-north-1",
@@ -25033,7 +26724,7 @@ var awsPartition = partition{
 					Region:  "eu-north-1",
 					Variant: dualStackVariant,
 				}: endpoint{
-					Hostname: "servicediscovery.eu-north-1.amazonaws.com",
+					Hostname: "servicediscovery.eu-north-1.api.aws",
 				},
 				endpointKey{
 					Region: "eu-south-1",
@@ -25042,7 +26733,7 @@ var awsPartition = partition{
 					Region:  "eu-south-1",
 					Variant: dualStackVariant,
 				}: endpoint{
-					Hostname: "servicediscovery.eu-south-1.amazonaws.com",
+					Hostname: "servicediscovery.eu-south-1.api.aws",
 				},
 				endpointKey{
 					Region: "eu-south-2",
@@ -25051,7 +26742,7 @@ var awsPartition = partition{
 					Region:  "eu-south-2",
 					Variant: dualStackVariant,
 				}: endpoint{
-					Hostname: "servicediscovery.eu-south-2.amazonaws.com",
+					Hostname: "servicediscovery.eu-south-2.api.aws",
 				},
 				endpointKey{
 					Region: "eu-west-1",
@@ -25060,7 +26751,7 @@ var awsPartition = partition{
 					Region:  "eu-west-1",
 					Variant: dualStackVariant,
 				}: endpoint{
-					Hostname: "servicediscovery.eu-west-1.amazonaws.com",
+					Hostname: "servicediscovery.eu-west-1.api.aws",
 				},
 				endpointKey{
 					Region: "eu-west-2",
@@ -25069,7 +26760,7 @@ var awsPartition = partition{
 					Region:  "eu-west-2",
 					Variant: dualStackVariant,
 				}: endpoint{
-					Hostname: "servicediscovery.eu-west-2.amazonaws.com",
+					Hostname: "servicediscovery.eu-west-2.api.aws",
 				},
 				endpointKey{
 					Region: "eu-west-3",
@@ -25078,7 +26769,16 @@ var awsPartition = partition{
 					Region:  "eu-west-3",
 					Variant: dualStackVariant,
 				}: endpoint{
-					Hostname: "servicediscovery.eu-west-3.amazonaws.com",
+					Hostname: "servicediscovery.eu-west-3.api.aws",
+				},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
+				endpointKey{
+					Region:  "il-central-1",
+					Variant: dualStackVariant,
+				}: endpoint{
+					Hostname: "servicediscovery.il-central-1.api.aws",
 				},
 				endpointKey{
 					Region: "me-central-1",
@@ -25087,7 +26787,7 @@ var awsPartition = partition{
 					Region:  "me-central-1",
 					Variant: dualStackVariant,
 				}: endpoint{
-					Hostname: "servicediscovery.me-central-1.amazonaws.com",
+					Hostname: "servicediscovery.me-central-1.api.aws",
 				},
 				endpointKey{
 					Region: "me-south-1",
@@ -25096,7 +26796,7 @@ var awsPartition = partition{
 					Region:  "me-south-1",
 					Variant: dualStackVariant,
 				}: endpoint{
-					Hostname: "servicediscovery.me-south-1.amazonaws.com",
+					Hostname: "servicediscovery.me-south-1.api.aws",
 				},
 				endpointKey{
 					Region: "sa-east-1",
@@ -25105,34 +26805,7 @@ var awsPartition = partition{
 					Region:  "sa-east-1",
 					Variant: dualStackVariant,
 				}: endpoint{
-					Hostname: "servicediscovery.sa-east-1.amazonaws.com",
-				},
-				endpointKey{
-					Region: "servicediscovery",
-				}: endpoint{
-					CredentialScope: credentialScope{
-						Region: "ca-central-1",
-					},
-					Deprecated: boxedTrue,
-				},
-				endpointKey{
-					Region:  "servicediscovery",
-					Variant: fipsVariant,
-				}: endpoint{
-					Hostname: "servicediscovery-fips.ca-central-1.amazonaws.com",
-					CredentialScope: credentialScope{
-						Region: "ca-central-1",
-					},
-					Deprecated: boxedTrue,
-				},
-				endpointKey{
-					Region: "servicediscovery-fips",
-				}: endpoint{
-					Hostname: "servicediscovery-fips.ca-central-1.amazonaws.com",
-					CredentialScope: credentialScope{
-						Region: "ca-central-1",
-					},
-					Deprecated: boxedTrue,
+					Hostname: "servicediscovery.sa-east-1.api.aws",
 				},
 				endpointKey{
 					Region: "us-east-1",
@@ -25141,7 +26814,7 @@ var awsPartition = partition{
 					Region:  "us-east-1",
 					Variant: dualStackVariant,
 				}: endpoint{
-					Hostname: "servicediscovery.us-east-1.amazonaws.com",
+					Hostname: "servicediscovery.us-east-1.api.aws",
 				},
 				endpointKey{
 					Region:  "us-east-1",
@@ -25149,6 +26822,12 @@ var awsPartition = partition{
 				}: endpoint{
 					Hostname: "servicediscovery-fips.us-east-1.amazonaws.com",
 				},
+				endpointKey{
+					Region:  "us-east-1",
+					Variant: fipsVariant | dualStackVariant,
+				}: endpoint{
+					Hostname: "servicediscovery-fips.us-east-1.api.aws",
+				},
 				endpointKey{
 					Region: "us-east-1-fips",
 				}: endpoint{
@@ -25165,7 +26844,7 @@ var awsPartition = partition{
 					Region:  "us-east-2",
 					Variant: dualStackVariant,
 				}: endpoint{
-					Hostname: "servicediscovery.us-east-2.amazonaws.com",
+					Hostname: "servicediscovery.us-east-2.api.aws",
 				},
 				endpointKey{
 					Region:  "us-east-2",
@@ -25173,6 +26852,12 @@ var awsPartition = partition{
 				}: endpoint{
 					Hostname: "servicediscovery-fips.us-east-2.amazonaws.com",
 				},
+				endpointKey{
+					Region:  "us-east-2",
+					Variant: fipsVariant | dualStackVariant,
+				}: endpoint{
+					Hostname: "servicediscovery-fips.us-east-2.api.aws",
+				},
 				endpointKey{
 					Region: "us-east-2-fips",
 				}: endpoint{
@@ -25189,7 +26874,7 @@ var awsPartition = partition{
 					Region:  "us-west-1",
 					Variant: dualStackVariant,
 				}: endpoint{
-					Hostname: "servicediscovery.us-west-1.amazonaws.com",
+					Hostname: "servicediscovery.us-west-1.api.aws",
 				},
 				endpointKey{
 					Region:  "us-west-1",
@@ -25197,6 +26882,12 @@ var awsPartition = partition{
 				}: endpoint{
 					Hostname: "servicediscovery-fips.us-west-1.amazonaws.com",
 				},
+				endpointKey{
+					Region:  "us-west-1",
+					Variant: fipsVariant | dualStackVariant,
+				}: endpoint{
+					Hostname: "servicediscovery-fips.us-west-1.api.aws",
+				},
 				endpointKey{
 					Region: "us-west-1-fips",
 				}: endpoint{
@@ -25213,7 +26904,7 @@ var awsPartition = partition{
 					Region:  "us-west-2",
 					Variant: dualStackVariant,
 				}: endpoint{
-					Hostname: "servicediscovery.us-west-2.amazonaws.com",
+					Hostname: "servicediscovery.us-west-2.api.aws",
 				},
 				endpointKey{
 					Region:  "us-west-2",
@@ -25221,6 +26912,12 @@ var awsPartition = partition{
 				}: endpoint{
 					Hostname: "servicediscovery-fips.us-west-2.amazonaws.com",
 				},
+				endpointKey{
+					Region:  "us-west-2",
+					Variant: fipsVariant | dualStackVariant,
+				}: endpoint{
+					Hostname: "servicediscovery-fips.us-west-2.api.aws",
+				},
 				endpointKey{
 					Region: "us-west-2-fips",
 				}: endpoint{
@@ -25299,6 +26996,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-west-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-central-1",
 				}: endpoint{},
@@ -25596,75 +27296,6 @@ var awsPartition = partition{
 		},
 		"sms": service{
 			Endpoints: serviceEndpoints{
-				endpointKey{
-					Region: "af-south-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "ap-east-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "ap-northeast-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "ap-northeast-2",
-				}: endpoint{},
-				endpointKey{
-					Region: "ap-south-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "ap-southeast-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "ap-southeast-2",
-				}: endpoint{},
-				endpointKey{
-					Region: "ca-central-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "eu-central-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "eu-north-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "eu-south-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "eu-west-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "eu-west-2",
-				}: endpoint{},
-				endpointKey{
-					Region: "eu-west-3",
-				}: endpoint{},
-				endpointKey{
-					Region: "fips-us-east-1",
-				}: endpoint{
-					Hostname: "sms-fips.us-east-1.amazonaws.com",
-					CredentialScope: credentialScope{
-						Region: "us-east-1",
-					},
-					Deprecated: boxedTrue,
-				},
-				endpointKey{
-					Region: "fips-us-east-2",
-				}: endpoint{
-					Hostname: "sms-fips.us-east-2.amazonaws.com",
-					CredentialScope: credentialScope{
-						Region: "us-east-2",
-					},
-					Deprecated: boxedTrue,
-				},
-				endpointKey{
-					Region: "fips-us-west-1",
-				}: endpoint{
-					Hostname: "sms-fips.us-west-1.amazonaws.com",
-					CredentialScope: credentialScope{
-						Region: "us-west-1",
-					},
-					Deprecated: boxedTrue,
-				},
 				endpointKey{
 					Region: "fips-us-west-2",
 				}: endpoint{
@@ -25674,39 +27305,6 @@ var awsPartition = partition{
 					},
 					Deprecated: boxedTrue,
 				},
-				endpointKey{
-					Region: "me-south-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "sa-east-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "us-east-1",
-				}: endpoint{},
-				endpointKey{
-					Region:  "us-east-1",
-					Variant: fipsVariant,
-				}: endpoint{
-					Hostname: "sms-fips.us-east-1.amazonaws.com",
-				},
-				endpointKey{
-					Region: "us-east-2",
-				}: endpoint{},
-				endpointKey{
-					Region:  "us-east-2",
-					Variant: fipsVariant,
-				}: endpoint{
-					Hostname: "sms-fips.us-east-2.amazonaws.com",
-				},
-				endpointKey{
-					Region: "us-west-1",
-				}: endpoint{},
-				endpointKey{
-					Region:  "us-west-1",
-					Variant: fipsVariant,
-				}: endpoint{
-					Hostname: "sms-fips.us-west-1.amazonaws.com",
-				},
 				endpointKey{
 					Region: "us-west-2",
 				}: endpoint{},
@@ -26210,6 +27808,9 @@ var awsPartition = partition{
 					},
 					Deprecated: boxedTrue,
 				},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-central-1",
 				}: endpoint{},
@@ -26361,6 +27962,9 @@ var awsPartition = partition{
 					},
 					Deprecated: boxedTrue,
 				},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-central-1",
 				}: endpoint{},
@@ -26524,6 +28128,9 @@ var awsPartition = partition{
 					},
 					Deprecated: boxedTrue,
 				},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-central-1",
 				}: endpoint{},
@@ -26571,6 +28178,118 @@ var awsPartition = partition{
 				},
 			},
 		},
+		"ssm-contacts": service{
+			Endpoints: serviceEndpoints{
+				endpointKey{
+					Region: "ap-northeast-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-northeast-2",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-south-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-2",
+				}: endpoint{},
+				endpointKey{
+					Region: "ca-central-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-central-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-north-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-west-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-west-2",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-west-3",
+				}: endpoint{},
+				endpointKey{
+					Region: "fips-us-east-1",
+				}: endpoint{
+					Hostname: "ssm-contacts-fips.us-east-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-1",
+					},
+					Deprecated: boxedTrue,
+				},
+				endpointKey{
+					Region: "fips-us-east-2",
+				}: endpoint{
+					Hostname: "ssm-contacts-fips.us-east-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-2",
+					},
+					Deprecated: boxedTrue,
+				},
+				endpointKey{
+					Region: "fips-us-west-1",
+				}: endpoint{
+					Hostname: "ssm-contacts-fips.us-west-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-west-1",
+					},
+					Deprecated: boxedTrue,
+				},
+				endpointKey{
+					Region: "fips-us-west-2",
+				}: endpoint{
+					Hostname: "ssm-contacts-fips.us-west-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-west-2",
+					},
+					Deprecated: boxedTrue,
+				},
+				endpointKey{
+					Region: "sa-east-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "us-east-1",
+				}: endpoint{},
+				endpointKey{
+					Region:  "us-east-1",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "ssm-contacts-fips.us-east-1.amazonaws.com",
+				},
+				endpointKey{
+					Region: "us-east-2",
+				}: endpoint{},
+				endpointKey{
+					Region:  "us-east-2",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "ssm-contacts-fips.us-east-2.amazonaws.com",
+				},
+				endpointKey{
+					Region: "us-west-1",
+				}: endpoint{},
+				endpointKey{
+					Region:  "us-west-1",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "ssm-contacts-fips.us-west-1.amazonaws.com",
+				},
+				endpointKey{
+					Region: "us-west-2",
+				}: endpoint{},
+				endpointKey{
+					Region:  "us-west-2",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "ssm-contacts-fips.us-west-2.amazonaws.com",
+				},
+			},
+		},
 		"ssm-incidents": service{
 			Endpoints: serviceEndpoints{
 				endpointKey{
@@ -26591,6 +28310,12 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ca-central-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "ca-central-1",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "ssm-incidents-fips.ca-central-1.amazonaws.com",
+				},
 				endpointKey{
 					Region: "eu-central-1",
 				}: endpoint{},
@@ -26606,21 +28331,90 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-west-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "fips-ca-central-1",
+				}: endpoint{
+					Hostname: "ssm-incidents-fips.ca-central-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "ca-central-1",
+					},
+					Deprecated: boxedTrue,
+				},
+				endpointKey{
+					Region: "fips-us-east-1",
+				}: endpoint{
+					Hostname: "ssm-incidents-fips.us-east-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-1",
+					},
+					Deprecated: boxedTrue,
+				},
+				endpointKey{
+					Region: "fips-us-east-2",
+				}: endpoint{
+					Hostname: "ssm-incidents-fips.us-east-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-2",
+					},
+					Deprecated: boxedTrue,
+				},
+				endpointKey{
+					Region: "fips-us-west-1",
+				}: endpoint{
+					Hostname: "ssm-incidents-fips.us-west-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-west-1",
+					},
+					Deprecated: boxedTrue,
+				},
+				endpointKey{
+					Region: "fips-us-west-2",
+				}: endpoint{
+					Hostname: "ssm-incidents-fips.us-west-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-west-2",
+					},
+					Deprecated: boxedTrue,
+				},
 				endpointKey{
 					Region: "sa-east-1",
 				}: endpoint{},
 				endpointKey{
 					Region: "us-east-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "us-east-1",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "ssm-incidents-fips.us-east-1.amazonaws.com",
+				},
 				endpointKey{
 					Region: "us-east-2",
 				}: endpoint{},
+				endpointKey{
+					Region:  "us-east-2",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "ssm-incidents-fips.us-east-2.amazonaws.com",
+				},
 				endpointKey{
 					Region: "us-west-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "us-west-1",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "ssm-incidents-fips.us-west-1.amazonaws.com",
+				},
 				endpointKey{
 					Region: "us-west-2",
 				}: endpoint{},
+				endpointKey{
+					Region:  "us-west-2",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "ssm-incidents-fips.us-west-2.amazonaws.com",
+				},
 			},
 		},
 		"ssm-sap": service{
@@ -26655,153 +28449,156 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ca-central-1",
 				}: endpoint{},
-				endpointKey{
-					Region:  "ca-central-1",
-					Variant: fipsVariant,
-				}: endpoint{
-					Hostname: "ssm-sap-fips.ca-central-1.amazonaws.com",
-				},
+				endpointKey{
+					Region:  "ca-central-1",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "ssm-sap-fips.ca-central-1.amazonaws.com",
+				},
+				endpointKey{
+					Region: "eu-central-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-north-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-south-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-west-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-west-2",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-west-3",
+				}: endpoint{},
+				endpointKey{
+					Region: "fips-ca-central-1",
+				}: endpoint{
+					Hostname: "ssm-sap-fips.ca-central-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "ca-central-1",
+					},
+					Deprecated: boxedTrue,
+				},
+				endpointKey{
+					Region: "fips-us-east-1",
+				}: endpoint{
+					Hostname: "ssm-sap-fips.us-east-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-1",
+					},
+					Deprecated: boxedTrue,
+				},
+				endpointKey{
+					Region: "fips-us-east-2",
+				}: endpoint{
+					Hostname: "ssm-sap-fips.us-east-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-2",
+					},
+					Deprecated: boxedTrue,
+				},
+				endpointKey{
+					Region: "fips-us-west-1",
+				}: endpoint{
+					Hostname: "ssm-sap-fips.us-west-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-west-1",
+					},
+					Deprecated: boxedTrue,
+				},
+				endpointKey{
+					Region: "fips-us-west-2",
+				}: endpoint{
+					Hostname: "ssm-sap-fips.us-west-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-west-2",
+					},
+					Deprecated: boxedTrue,
+				},
+				endpointKey{
+					Region: "me-south-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "sa-east-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "us-east-1",
+				}: endpoint{},
+				endpointKey{
+					Region:  "us-east-1",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "ssm-sap-fips.us-east-1.amazonaws.com",
+				},
+				endpointKey{
+					Region: "us-east-2",
+				}: endpoint{},
+				endpointKey{
+					Region:  "us-east-2",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "ssm-sap-fips.us-east-2.amazonaws.com",
+				},
+				endpointKey{
+					Region: "us-west-1",
+				}: endpoint{},
+				endpointKey{
+					Region:  "us-west-1",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "ssm-sap-fips.us-west-1.amazonaws.com",
+				},
+				endpointKey{
+					Region: "us-west-2",
+				}: endpoint{},
+				endpointKey{
+					Region:  "us-west-2",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "ssm-sap-fips.us-west-2.amazonaws.com",
+				},
+			},
+		},
+		"sso": service{
+			Endpoints: serviceEndpoints{
+				endpointKey{
+					Region: "af-south-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-east-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-northeast-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-northeast-2",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-northeast-3",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-south-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-2",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-3",
+				}: endpoint{},
+				endpointKey{
+					Region: "ca-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-central-1",
 				}: endpoint{},
 				endpointKey{
-					Region: "eu-north-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "eu-south-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "eu-west-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "eu-west-2",
-				}: endpoint{},
-				endpointKey{
-					Region: "eu-west-3",
-				}: endpoint{},
-				endpointKey{
-					Region: "fips-ca-central-1",
-				}: endpoint{
-					Hostname: "ssm-sap-fips.ca-central-1.amazonaws.com",
-					CredentialScope: credentialScope{
-						Region: "ca-central-1",
-					},
-					Deprecated: boxedTrue,
-				},
-				endpointKey{
-					Region: "fips-us-east-1",
-				}: endpoint{
-					Hostname: "ssm-sap-fips.us-east-1.amazonaws.com",
-					CredentialScope: credentialScope{
-						Region: "us-east-1",
-					},
-					Deprecated: boxedTrue,
-				},
-				endpointKey{
-					Region: "fips-us-east-2",
-				}: endpoint{
-					Hostname: "ssm-sap-fips.us-east-2.amazonaws.com",
-					CredentialScope: credentialScope{
-						Region: "us-east-2",
-					},
-					Deprecated: boxedTrue,
-				},
-				endpointKey{
-					Region: "fips-us-west-1",
-				}: endpoint{
-					Hostname: "ssm-sap-fips.us-west-1.amazonaws.com",
-					CredentialScope: credentialScope{
-						Region: "us-west-1",
-					},
-					Deprecated: boxedTrue,
-				},
-				endpointKey{
-					Region: "fips-us-west-2",
-				}: endpoint{
-					Hostname: "ssm-sap-fips.us-west-2.amazonaws.com",
-					CredentialScope: credentialScope{
-						Region: "us-west-2",
-					},
-					Deprecated: boxedTrue,
-				},
-				endpointKey{
-					Region: "me-south-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "sa-east-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "us-east-1",
-				}: endpoint{},
-				endpointKey{
-					Region:  "us-east-1",
-					Variant: fipsVariant,
-				}: endpoint{
-					Hostname: "ssm-sap-fips.us-east-1.amazonaws.com",
-				},
-				endpointKey{
-					Region: "us-east-2",
-				}: endpoint{},
-				endpointKey{
-					Region:  "us-east-2",
-					Variant: fipsVariant,
-				}: endpoint{
-					Hostname: "ssm-sap-fips.us-east-2.amazonaws.com",
-				},
-				endpointKey{
-					Region: "us-west-1",
-				}: endpoint{},
-				endpointKey{
-					Region:  "us-west-1",
-					Variant: fipsVariant,
-				}: endpoint{
-					Hostname: "ssm-sap-fips.us-west-1.amazonaws.com",
-				},
-				endpointKey{
-					Region: "us-west-2",
-				}: endpoint{},
-				endpointKey{
-					Region:  "us-west-2",
-					Variant: fipsVariant,
-				}: endpoint{
-					Hostname: "ssm-sap-fips.us-west-2.amazonaws.com",
-				},
-			},
-		},
-		"sso": service{
-			Endpoints: serviceEndpoints{
-				endpointKey{
-					Region: "af-south-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "ap-east-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "ap-northeast-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "ap-northeast-2",
-				}: endpoint{},
-				endpointKey{
-					Region: "ap-northeast-3",
-				}: endpoint{},
-				endpointKey{
-					Region: "ap-south-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "ap-southeast-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "ap-southeast-2",
-				}: endpoint{},
-				endpointKey{
-					Region: "ap-southeast-3",
-				}: endpoint{},
-				endpointKey{
-					Region: "ca-central-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "eu-central-1",
+					Region: "eu-central-2",
 				}: endpoint{},
 				endpointKey{
 					Region: "eu-north-1",
@@ -26818,6 +28615,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-west-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-south-1",
 				}: endpoint{},
@@ -26936,6 +28736,9 @@ var awsPartition = partition{
 					},
 					Deprecated: boxedTrue,
 				},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-central-1",
 				}: endpoint{},
@@ -27061,14 +28864,8 @@ var awsPartition = partition{
 					Region: "eu-west-3",
 				}: endpoint{},
 				endpointKey{
-					Region: "fips",
-				}: endpoint{
-					Hostname: "storagegateway-fips.ca-central-1.amazonaws.com",
-					CredentialScope: credentialScope{
-						Region: "ca-central-1",
-					},
-					Deprecated: boxedTrue,
-				},
+					Region: "il-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-central-1",
 				}: endpoint{},
@@ -27222,6 +29019,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-west-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "local",
 				}: endpoint{
@@ -27325,6 +29125,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-west-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-central-1",
 				}: endpoint{},
@@ -27532,6 +29335,9 @@ var awsPartition = partition{
 					},
 					Deprecated: boxedTrue,
 				},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-central-1",
 				}: endpoint{},
@@ -27642,149 +29448,155 @@ var awsPartition = partition{
 					Region: "eu-west-3",
 				}: endpoint{},
 				endpointKey{
-					Region: "fips-us-east-1",
-				}: endpoint{
-					Hostname: "synthetics-fips.us-east-1.amazonaws.com",
-					CredentialScope: credentialScope{
-						Region: "us-east-1",
-					},
-					Deprecated: boxedTrue,
-				},
-				endpointKey{
-					Region: "fips-us-east-2",
-				}: endpoint{
-					Hostname: "synthetics-fips.us-east-2.amazonaws.com",
-					CredentialScope: credentialScope{
-						Region: "us-east-2",
-					},
-					Deprecated: boxedTrue,
-				},
-				endpointKey{
-					Region: "fips-us-west-1",
-				}: endpoint{
-					Hostname: "synthetics-fips.us-west-1.amazonaws.com",
-					CredentialScope: credentialScope{
-						Region: "us-west-1",
-					},
-					Deprecated: boxedTrue,
-				},
-				endpointKey{
-					Region: "fips-us-west-2",
-				}: endpoint{
-					Hostname: "synthetics-fips.us-west-2.amazonaws.com",
-					CredentialScope: credentialScope{
-						Region: "us-west-2",
-					},
-					Deprecated: boxedTrue,
-				},
-				endpointKey{
-					Region: "me-central-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "me-south-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "sa-east-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "us-east-1",
-				}: endpoint{},
-				endpointKey{
-					Region:  "us-east-1",
-					Variant: fipsVariant,
-				}: endpoint{
-					Hostname: "synthetics-fips.us-east-1.amazonaws.com",
-				},
-				endpointKey{
-					Region: "us-east-2",
-				}: endpoint{},
-				endpointKey{
-					Region:  "us-east-2",
-					Variant: fipsVariant,
-				}: endpoint{
-					Hostname: "synthetics-fips.us-east-2.amazonaws.com",
-				},
-				endpointKey{
-					Region: "us-west-1",
-				}: endpoint{},
-				endpointKey{
-					Region:  "us-west-1",
-					Variant: fipsVariant,
-				}: endpoint{
-					Hostname: "synthetics-fips.us-west-1.amazonaws.com",
-				},
-				endpointKey{
-					Region: "us-west-2",
-				}: endpoint{},
-				endpointKey{
-					Region:  "us-west-2",
-					Variant: fipsVariant,
-				}: endpoint{
-					Hostname: "synthetics-fips.us-west-2.amazonaws.com",
-				},
-			},
-		},
-		"tagging": service{
-			Endpoints: serviceEndpoints{
-				endpointKey{
-					Region: "af-south-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "ap-east-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "ap-northeast-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "ap-northeast-2",
-				}: endpoint{},
-				endpointKey{
-					Region: "ap-northeast-3",
-				}: endpoint{},
-				endpointKey{
-					Region: "ap-south-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "ap-south-2",
-				}: endpoint{},
-				endpointKey{
-					Region: "ap-southeast-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "ap-southeast-2",
-				}: endpoint{},
-				endpointKey{
-					Region: "ap-southeast-3",
-				}: endpoint{},
-				endpointKey{
-					Region: "ap-southeast-4",
-				}: endpoint{},
-				endpointKey{
-					Region: "ca-central-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "eu-central-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "eu-central-2",
-				}: endpoint{},
-				endpointKey{
-					Region: "eu-north-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "eu-south-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "eu-south-2",
-				}: endpoint{},
-				endpointKey{
-					Region: "eu-west-1",
-				}: endpoint{},
-				endpointKey{
-					Region: "eu-west-2",
-				}: endpoint{},
-				endpointKey{
-					Region: "eu-west-3",
+					Region: "fips-us-east-1",
+				}: endpoint{
+					Hostname: "synthetics-fips.us-east-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-1",
+					},
+					Deprecated: boxedTrue,
+				},
+				endpointKey{
+					Region: "fips-us-east-2",
+				}: endpoint{
+					Hostname: "synthetics-fips.us-east-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-2",
+					},
+					Deprecated: boxedTrue,
+				},
+				endpointKey{
+					Region: "fips-us-west-1",
+				}: endpoint{
+					Hostname: "synthetics-fips.us-west-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-west-1",
+					},
+					Deprecated: boxedTrue,
+				},
+				endpointKey{
+					Region: "fips-us-west-2",
+				}: endpoint{
+					Hostname: "synthetics-fips.us-west-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-west-2",
+					},
+					Deprecated: boxedTrue,
+				},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "me-central-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "me-south-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "sa-east-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "us-east-1",
+				}: endpoint{},
+				endpointKey{
+					Region:  "us-east-1",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "synthetics-fips.us-east-1.amazonaws.com",
+				},
+				endpointKey{
+					Region: "us-east-2",
+				}: endpoint{},
+				endpointKey{
+					Region:  "us-east-2",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "synthetics-fips.us-east-2.amazonaws.com",
+				},
+				endpointKey{
+					Region: "us-west-1",
+				}: endpoint{},
+				endpointKey{
+					Region:  "us-west-1",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "synthetics-fips.us-west-1.amazonaws.com",
+				},
+				endpointKey{
+					Region: "us-west-2",
+				}: endpoint{},
+				endpointKey{
+					Region:  "us-west-2",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "synthetics-fips.us-west-2.amazonaws.com",
+				},
+			},
+		},
+		"tagging": service{
+			Endpoints: serviceEndpoints{
+				endpointKey{
+					Region: "af-south-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-east-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-northeast-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-northeast-2",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-northeast-3",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-south-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-south-2",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-2",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-3",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-4",
+				}: endpoint{},
+				endpointKey{
+					Region: "ca-central-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-central-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-central-2",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-north-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-south-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-south-2",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-west-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-west-2",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-west-3",
+				}: endpoint{},
+				endpointKey{
+					Region: "il-central-1",
 				}: endpoint{},
 				endpointKey{
 					Region: "me-central-1",
@@ -27927,6 +29739,40 @@ var awsPartition = partition{
 				},
 			},
 		},
+		"tnb": service{
+			Endpoints: serviceEndpoints{
+				endpointKey{
+					Region: "ap-northeast-2",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-2",
+				}: endpoint{},
+				endpointKey{
+					Region: "ca-central-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-central-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-north-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-south-2",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-west-3",
+				}: endpoint{},
+				endpointKey{
+					Region: "sa-east-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "us-east-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "us-west-2",
+				}: endpoint{},
+			},
+		},
 		"transcribe": service{
 			Defaults: endpointDefaults{
 				defaultKey{}: endpoint{
@@ -28260,6 +30106,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-southeast-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-4",
+				}: endpoint{},
 				endpointKey{
 					Region: "ca-central-1",
 				}: endpoint{},
@@ -28338,6 +30187,9 @@ var awsPartition = partition{
 					},
 					Deprecated: boxedTrue,
 				},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-central-1",
 				}: endpoint{},
@@ -28732,9 +30584,21 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-southeast-2",
 				}: endpoint{},
+				endpointKey{
+					Region: "ca-central-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-central-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-north-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-west-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-west-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "us-east-1",
 				}: endpoint{},
@@ -29334,6 +31198,7 @@ var awsPartition = partition{
 					CredentialScope: credentialScope{
 						Region: "il-central-1",
 					},
+					Deprecated: boxedTrue,
 				},
 				endpointKey{
 					Region: "fips-me-central-1",
@@ -29398,6 +31263,23 @@ var awsPartition = partition{
 					},
 					Deprecated: boxedTrue,
 				},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{
+					Hostname: "waf-regional.il-central-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "il-central-1",
+					},
+				},
+				endpointKey{
+					Region:  "il-central-1",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "waf-regional-fips.il-central-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "il-central-1",
+					},
+				},
 				endpointKey{
 					Region: "me-central-1",
 				}: endpoint{
@@ -30048,6 +31930,7 @@ var awsPartition = partition{
 					CredentialScope: credentialScope{
 						Region: "il-central-1",
 					},
+					Deprecated: boxedTrue,
 				},
 				endpointKey{
 					Region: "fips-me-central-1",
@@ -30112,6 +31995,23 @@ var awsPartition = partition{
 					},
 					Deprecated: boxedTrue,
 				},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{
+					Hostname: "wafv2.il-central-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "il-central-1",
+					},
+				},
+				endpointKey{
+					Region:  "il-central-1",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "wafv2-fips.il-central-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "il-central-1",
+					},
+				},
 				endpointKey{
 					Region: "me-central-1",
 				}: endpoint{
@@ -30626,6 +32526,9 @@ var awsPartition = partition{
 					},
 					Deprecated: boxedTrue,
 				},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-central-1",
 				}: endpoint{},
@@ -30795,6 +32698,20 @@ var awscnPartition = partition{
 				},
 			},
 		},
+		"api.pricing": service{
+			Defaults: endpointDefaults{
+				defaultKey{}: endpoint{
+					CredentialScope: credentialScope{
+						Service: "pricing",
+					},
+				},
+			},
+			Endpoints: serviceEndpoints{
+				endpointKey{
+					Region: "cn-northwest-1",
+				}: endpoint{},
+			},
+		},
 		"api.sagemaker": service{
 			Endpoints: serviceEndpoints{
 				endpointKey{
@@ -30902,6 +32819,16 @@ var awscnPartition = partition{
 				}: endpoint{},
 			},
 		},
+		"arc-zonal-shift": service{
+			Endpoints: serviceEndpoints{
+				endpointKey{
+					Region: "cn-north-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "cn-northwest-1",
+				}: endpoint{},
+			},
+		},
 		"athena": service{
 			Endpoints: serviceEndpoints{
 				endpointKey{
@@ -30964,6 +32891,16 @@ var awscnPartition = partition{
 				}: endpoint{},
 			},
 		},
+		"backupstorage": service{
+			Endpoints: serviceEndpoints{
+				endpointKey{
+					Region: "cn-north-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "cn-northwest-1",
+				}: endpoint{},
+			},
+		},
 		"batch": service{
 			Endpoints: serviceEndpoints{
 				endpointKey{
@@ -31192,6 +33129,31 @@ var awscnPartition = partition{
 				}: endpoint{},
 			},
 		},
+		"datazone": service{
+			Defaults: endpointDefaults{
+				defaultKey{}: endpoint{
+					DNSSuffix: "api.amazonwebservices.com.cn",
+				},
+				defaultKey{
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname:  "{service}-fips.{region}.{dnsSuffix}",
+					DNSSuffix: "api.amazonwebservices.com.cn",
+				},
+			},
+			Endpoints: serviceEndpoints{
+				endpointKey{
+					Region: "cn-north-1",
+				}: endpoint{
+					Hostname: "datazone.cn-north-1.api.amazonwebservices.com.cn",
+				},
+				endpointKey{
+					Region: "cn-northwest-1",
+				}: endpoint{
+					Hostname: "datazone.cn-northwest-1.api.amazonwebservices.com.cn",
+				},
+			},
+		},
 		"dax": service{
 			Endpoints: serviceEndpoints{
 				endpointKey{
@@ -31404,9 +33366,21 @@ var awscnPartition = partition{
 				endpointKey{
 					Region: "cn-north-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "cn-north-1",
+					Variant: dualStackVariant,
+				}: endpoint{
+					Hostname: "elasticmapreduce.cn-north-1.api.amazonwebservices.com.cn",
+				},
 				endpointKey{
 					Region: "cn-northwest-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "cn-northwest-1",
+					Variant: dualStackVariant,
+				}: endpoint{
+					Hostname: "elasticmapreduce.cn-northwest-1.api.amazonwebservices.com.cn",
+				},
 			},
 		},
 		"emr-containers": service{
@@ -31434,9 +33408,21 @@ var awscnPartition = partition{
 				endpointKey{
 					Region: "cn-north-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "cn-north-1",
+					Variant: dualStackVariant,
+				}: endpoint{
+					Hostname: "aos.cn-north-1.api.amazonwebservices.com.cn",
+				},
 				endpointKey{
 					Region: "cn-northwest-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "cn-northwest-1",
+					Variant: dualStackVariant,
+				}: endpoint{
+					Hostname: "aos.cn-northwest-1.api.amazonwebservices.com.cn",
+				},
 			},
 		},
 		"events": service{
@@ -31594,6 +33580,16 @@ var awscnPartition = partition{
 				},
 			},
 		},
+		"identitystore": service{
+			Endpoints: serviceEndpoints{
+				endpointKey{
+					Region: "cn-north-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "cn-northwest-1",
+				}: endpoint{},
+			},
+		},
 		"internetmonitor": service{
 			Defaults: endpointDefaults{
 				defaultKey{}: endpoint{
@@ -31893,6 +33889,26 @@ var awscnPartition = partition{
 				}: endpoint{},
 			},
 		},
+		"oidc": service{
+			Endpoints: serviceEndpoints{
+				endpointKey{
+					Region: "cn-north-1",
+				}: endpoint{
+					Hostname: "oidc.cn-north-1.amazonaws.com.cn",
+					CredentialScope: credentialScope{
+						Region: "cn-north-1",
+					},
+				},
+				endpointKey{
+					Region: "cn-northwest-1",
+				}: endpoint{
+					Hostname: "oidc.cn-northwest-1.amazonaws.com.cn",
+					CredentialScope: credentialScope{
+						Region: "cn-northwest-1",
+					},
+				},
+			},
+		},
 		"organizations": service{
 			PartitionEndpoint: "aws-cn-global",
 			IsRegionalized:    boxedFalse,
@@ -31931,6 +33947,26 @@ var awscnPartition = partition{
 				}: endpoint{},
 			},
 		},
+		"portal.sso": service{
+			Endpoints: serviceEndpoints{
+				endpointKey{
+					Region: "cn-north-1",
+				}: endpoint{
+					Hostname: "portal.sso.cn-north-1.amazonaws.com.cn",
+					CredentialScope: credentialScope{
+						Region: "cn-north-1",
+					},
+				},
+				endpointKey{
+					Region: "cn-northwest-1",
+				}: endpoint{
+					Hostname: "portal.sso.cn-northwest-1.amazonaws.com.cn",
+					CredentialScope: credentialScope{
+						Region: "cn-northwest-1",
+					},
+				},
+			},
+		},
 		"ram": service{
 			Endpoints: serviceEndpoints{
 				endpointKey{
@@ -32147,6 +34183,37 @@ var awscnPartition = partition{
 				},
 			},
 		},
+		"savingsplans": service{
+			IsRegionalized: boxedTrue,
+			Endpoints: serviceEndpoints{
+				endpointKey{
+					Region: "cn-north-1",
+				}: endpoint{
+					Hostname: "savingsplans.cn-north-1.amazonaws.com.cn",
+					CredentialScope: credentialScope{
+						Region: "cn-north-1",
+					},
+				},
+				endpointKey{
+					Region: "cn-northwest-1",
+				}: endpoint{
+					Hostname: "savingsplans.cn-northwest-1.amazonaws.com.cn",
+					CredentialScope: credentialScope{
+						Region: "cn-northwest-1",
+					},
+				},
+			},
+		},
+		"schemas": service{
+			Endpoints: serviceEndpoints{
+				endpointKey{
+					Region: "cn-north-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "cn-northwest-1",
+				}: endpoint{},
+			},
+		},
 		"secretsmanager": service{
 			Endpoints: serviceEndpoints{
 				endpointKey{
@@ -32205,7 +34272,7 @@ var awscnPartition = partition{
 					Region:  "cn-north-1",
 					Variant: dualStackVariant,
 				}: endpoint{
-					Hostname: "servicediscovery.cn-north-1.amazonaws.com.cn",
+					Hostname: "servicediscovery.cn-north-1.api.amazonwebservices.com.cn",
 				},
 				endpointKey{
 					Region: "cn-northwest-1",
@@ -32214,7 +34281,7 @@ var awscnPartition = partition{
 					Region:  "cn-northwest-1",
 					Variant: dualStackVariant,
 				}: endpoint{
-					Hostname: "servicediscovery.cn-northwest-1.amazonaws.com.cn",
+					Hostname: "servicediscovery.cn-northwest-1.api.amazonwebservices.com.cn",
 				},
 			},
 		},
@@ -32248,9 +34315,6 @@ var awscnPartition = partition{
 				endpointKey{
 					Region: "cn-north-1",
 				}: endpoint{},
-				endpointKey{
-					Region: "cn-northwest-1",
-				}: endpoint{},
 			},
 		},
 		"snowball": service{
@@ -32334,14 +34398,36 @@ var awscnPartition = partition{
 				}: endpoint{},
 			},
 		},
+		"sso": service{
+			Endpoints: serviceEndpoints{
+				endpointKey{
+					Region: "cn-north-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "cn-northwest-1",
+				}: endpoint{},
+			},
+		},
 		"states": service{
 			Endpoints: serviceEndpoints{
 				endpointKey{
 					Region: "cn-north-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "cn-north-1",
+					Variant: dualStackVariant,
+				}: endpoint{
+					Hostname: "states.cn-north-1.api.amazonwebservices.com.cn",
+				},
 				endpointKey{
 					Region: "cn-northwest-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "cn-northwest-1",
+					Variant: dualStackVariant,
+				}: endpoint{
+					Hostname: "states.cn-northwest-1.api.amazonwebservices.com.cn",
+				},
 			},
 		},
 		"storagegateway": service{
@@ -33380,6 +35466,16 @@ var awsusgovPartition = partition{
 				}: endpoint{},
 			},
 		},
+		"backupstorage": service{
+			Endpoints: serviceEndpoints{
+				endpointKey{
+					Region: "us-gov-east-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "us-gov-west-1",
+				}: endpoint{},
+			},
+		},
 		"batch": service{
 			Defaults: endpointDefaults{
 				defaultKey{}: endpoint{},
@@ -33805,6 +35901,15 @@ var awsusgovPartition = partition{
 		},
 		"codepipeline": service{
 			Endpoints: serviceEndpoints{
+				endpointKey{
+					Region: "fips-us-gov-east-1",
+				}: endpoint{
+					Hostname: "codepipeline-fips.us-gov-east-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-gov-east-1",
+					},
+					Deprecated: boxedTrue,
+				},
 				endpointKey{
 					Region: "fips-us-gov-west-1",
 				}: endpoint{
@@ -33817,6 +35922,12 @@ var awsusgovPartition = partition{
 				endpointKey{
 					Region: "us-gov-east-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "us-gov-east-1",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "codepipeline-fips.us-gov-east-1.amazonaws.com",
+				},
 				endpointKey{
 					Region: "us-gov-west-1",
 				}: endpoint{},
@@ -33828,6 +35939,13 @@ var awsusgovPartition = partition{
 				},
 			},
 		},
+		"codestar-connections": service{
+			Endpoints: serviceEndpoints{
+				endpointKey{
+					Region: "us-gov-east-1",
+				}: endpoint{},
+			},
+		},
 		"cognito-identity": service{
 			Endpoints: serviceEndpoints{
 				endpointKey{
@@ -34171,6 +36289,31 @@ var awsusgovPartition = partition{
 				},
 			},
 		},
+		"datazone": service{
+			Defaults: endpointDefaults{
+				defaultKey{}: endpoint{
+					DNSSuffix: "api.aws",
+				},
+				defaultKey{
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname:  "{service}-fips.{region}.{dnsSuffix}",
+					DNSSuffix: "api.aws",
+				},
+			},
+			Endpoints: serviceEndpoints{
+				endpointKey{
+					Region: "us-gov-east-1",
+				}: endpoint{
+					Hostname: "datazone.us-gov-east-1.api.aws",
+				},
+				endpointKey{
+					Region: "us-gov-west-1",
+				}: endpoint{
+					Hostname: "datazone.us-gov-west-1.api.aws",
+				},
+			},
+		},
 		"directconnect": service{
 			Endpoints: serviceEndpoints{
 				endpointKey{
@@ -34773,6 +36916,12 @@ var awsusgovPartition = partition{
 				endpointKey{
 					Region: "us-gov-east-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "us-gov-east-1",
+					Variant: dualStackVariant,
+				}: endpoint{
+					Hostname: "elasticmapreduce.us-gov-east-1.api.aws",
+				},
 				endpointKey{
 					Region:  "us-gov-east-1",
 					Variant: fipsVariant,
@@ -34784,6 +36933,13 @@ var awsusgovPartition = partition{
 				}: endpoint{
 					Protocols: []string{"https"},
 				},
+				endpointKey{
+					Region:  "us-gov-west-1",
+					Variant: dualStackVariant,
+				}: endpoint{
+					Hostname:  "elasticmapreduce.us-gov-west-1.api.aws",
+					Protocols: []string{"https"},
+				},
 				endpointKey{
 					Region:  "us-gov-west-1",
 					Variant: fipsVariant,
@@ -34839,6 +36995,12 @@ var awsusgovPartition = partition{
 				endpointKey{
 					Region: "us-gov-east-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "us-gov-east-1",
+					Variant: dualStackVariant,
+				}: endpoint{
+					Hostname: "aos.us-gov-east-1.api.aws",
+				},
 				endpointKey{
 					Region:  "us-gov-east-1",
 					Variant: fipsVariant,
@@ -34857,6 +37019,12 @@ var awsusgovPartition = partition{
 				endpointKey{
 					Region: "us-gov-west-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "us-gov-west-1",
+					Variant: dualStackVariant,
+				}: endpoint{
+					Hostname: "aos.us-gov-west-1.api.aws",
+				},
 				endpointKey{
 					Region:  "us-gov-west-1",
 					Variant: fipsVariant,
@@ -35093,6 +37261,28 @@ var awsusgovPartition = partition{
 				},
 			},
 		},
+		"geo": service{
+			Endpoints: serviceEndpoints{
+				endpointKey{
+					Region: "fips-us-gov-west-1",
+				}: endpoint{
+					Hostname: "geo-fips.us-gov-west-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-gov-west-1",
+					},
+					Deprecated: boxedTrue,
+				},
+				endpointKey{
+					Region: "us-gov-west-1",
+				}: endpoint{},
+				endpointKey{
+					Region:  "us-gov-west-1",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "geo-fips.us-gov-west-1.amazonaws.com",
+				},
+			},
+		},
 		"glacier": service{
 			Endpoints: serviceEndpoints{
 				endpointKey{
@@ -35159,21 +37349,45 @@ var awsusgovPartition = partition{
 				endpointKey{
 					Region: "us-gov-east-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "us-gov-east-1",
+					Variant: dualStackVariant,
+				}: endpoint{
+					Hostname: "glue.us-gov-east-1.api.aws",
+				},
 				endpointKey{
 					Region:  "us-gov-east-1",
 					Variant: fipsVariant,
 				}: endpoint{
 					Hostname: "glue-fips.us-gov-east-1.amazonaws.com",
 				},
+				endpointKey{
+					Region:  "us-gov-east-1",
+					Variant: fipsVariant | dualStackVariant,
+				}: endpoint{
+					Hostname: "glue-fips.us-gov-east-1.api.aws",
+				},
 				endpointKey{
 					Region: "us-gov-west-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "us-gov-west-1",
+					Variant: dualStackVariant,
+				}: endpoint{
+					Hostname: "glue.us-gov-west-1.api.aws",
+				},
 				endpointKey{
 					Region:  "us-gov-west-1",
 					Variant: fipsVariant,
 				}: endpoint{
 					Hostname: "glue-fips.us-gov-west-1.amazonaws.com",
 				},
+				endpointKey{
+					Region:  "us-gov-west-1",
+					Variant: fipsVariant | dualStackVariant,
+				}: endpoint{
+					Hostname: "glue-fips.us-gov-west-1.api.aws",
+				},
 			},
 		},
 		"greengrass": service{
@@ -35492,12 +37706,42 @@ var awsusgovPartition = partition{
 		},
 		"inspector2": service{
 			Endpoints: serviceEndpoints{
+				endpointKey{
+					Region: "fips-us-gov-east-1",
+				}: endpoint{
+					Hostname: "inspector2-fips.us-gov-east-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-gov-east-1",
+					},
+					Deprecated: boxedTrue,
+				},
+				endpointKey{
+					Region: "fips-us-gov-west-1",
+				}: endpoint{
+					Hostname: "inspector2-fips.us-gov-west-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-gov-west-1",
+					},
+					Deprecated: boxedTrue,
+				},
 				endpointKey{
 					Region: "us-gov-east-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "us-gov-east-1",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "inspector2-fips.us-gov-east-1.amazonaws.com",
+				},
 				endpointKey{
 					Region: "us-gov-west-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "us-gov-west-1",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "inspector2-fips.us-gov-west-1.amazonaws.com",
+				},
 			},
 		},
 		"internetmonitor": service{
@@ -35685,6 +37929,38 @@ var awsusgovPartition = partition{
 		},
 		"iottwinmaker": service{
 			Endpoints: serviceEndpoints{
+				endpointKey{
+					Region: "api-us-gov-west-1",
+				}: endpoint{
+					Hostname: "api.iottwinmaker.us-gov-west-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-gov-west-1",
+					},
+				},
+				endpointKey{
+					Region: "data-us-gov-west-1",
+				}: endpoint{
+					Hostname: "data.iottwinmaker.us-gov-west-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-gov-west-1",
+					},
+				},
+				endpointKey{
+					Region: "fips-api-us-gov-west-1",
+				}: endpoint{
+					Hostname: "api.iottwinmaker-fips.us-gov-west-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-gov-west-1",
+					},
+				},
+				endpointKey{
+					Region: "fips-data-us-gov-west-1",
+				}: endpoint{
+					Hostname: "data.iottwinmaker-fips.us-gov-west-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-gov-west-1",
+					},
+				},
 				endpointKey{
 					Region: "fips-us-gov-west-1",
 				}: endpoint{
@@ -35946,21 +38222,45 @@ var awsusgovPartition = partition{
 				endpointKey{
 					Region: "us-gov-east-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "us-gov-east-1",
+					Variant: dualStackVariant,
+				}: endpoint{
+					Hostname: "lakeformation.us-gov-east-1.api.aws",
+				},
 				endpointKey{
 					Region:  "us-gov-east-1",
 					Variant: fipsVariant,
 				}: endpoint{
 					Hostname: "lakeformation-fips.us-gov-east-1.amazonaws.com",
 				},
+				endpointKey{
+					Region:  "us-gov-east-1",
+					Variant: fipsVariant | dualStackVariant,
+				}: endpoint{
+					Hostname: "lakeformation-fips.us-gov-east-1.api.aws",
+				},
 				endpointKey{
 					Region: "us-gov-west-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "us-gov-west-1",
+					Variant: dualStackVariant,
+				}: endpoint{
+					Hostname: "lakeformation.us-gov-west-1.api.aws",
+				},
 				endpointKey{
 					Region:  "us-gov-west-1",
 					Variant: fipsVariant,
 				}: endpoint{
 					Hostname: "lakeformation-fips.us-gov-west-1.amazonaws.com",
 				},
+				endpointKey{
+					Region:  "us-gov-west-1",
+					Variant: fipsVariant | dualStackVariant,
+				}: endpoint{
+					Hostname: "lakeformation-fips.us-gov-west-1.api.aws",
+				},
 			},
 		},
 		"lambda": service{
@@ -36055,6 +38355,16 @@ var awsusgovPartition = partition{
 				},
 			},
 		},
+		"license-manager-linux-subscriptions": service{
+			Endpoints: serviceEndpoints{
+				endpointKey{
+					Region: "us-gov-east-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "us-gov-west-1",
+				}: endpoint{},
+			},
+		},
 		"logs": service{
 			Endpoints: serviceEndpoints{
 				endpointKey{
@@ -36095,6 +38405,36 @@ var awsusgovPartition = partition{
 				},
 			},
 		},
+		"m2": service{
+			Endpoints: serviceEndpoints{
+				endpointKey{
+					Region: "fips-us-gov-east-1",
+				}: endpoint{
+
+					Deprecated: boxedTrue,
+				},
+				endpointKey{
+					Region: "fips-us-gov-west-1",
+				}: endpoint{
+
+					Deprecated: boxedTrue,
+				},
+				endpointKey{
+					Region: "us-gov-east-1",
+				}: endpoint{},
+				endpointKey{
+					Region:  "us-gov-east-1",
+					Variant: fipsVariant,
+				}: endpoint{},
+				endpointKey{
+					Region: "us-gov-west-1",
+				}: endpoint{},
+				endpointKey{
+					Region:  "us-gov-west-1",
+					Variant: fipsVariant,
+				}: endpoint{},
+			},
+		},
 		"managedblockchain": service{
 			Endpoints: serviceEndpoints{
 				endpointKey{
@@ -36428,6 +38768,24 @@ var awsusgovPartition = partition{
 						Region: "us-gov-west-1",
 					},
 				},
+				endpointKey{
+					Region:  "aws-us-gov-global",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "networkmanager.us-gov-west-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-gov-west-1",
+					},
+				},
+				endpointKey{
+					Region: "fips-aws-us-gov-global",
+				}: endpoint{
+					Hostname: "networkmanager.us-gov-west-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-gov-west-1",
+					},
+					Deprecated: boxedTrue,
+				},
 			},
 		},
 		"oidc": service{
@@ -36874,6 +39232,46 @@ var awsusgovPartition = partition{
 				},
 			},
 		},
+		"resiliencehub": service{
+			Endpoints: serviceEndpoints{
+				endpointKey{
+					Region: "fips-us-gov-east-1",
+				}: endpoint{
+					Hostname: "resiliencehub-fips.us-gov-east-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-gov-east-1",
+					},
+					Deprecated: boxedTrue,
+				},
+				endpointKey{
+					Region: "fips-us-gov-west-1",
+				}: endpoint{
+					Hostname: "resiliencehub-fips.us-gov-west-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-gov-west-1",
+					},
+					Deprecated: boxedTrue,
+				},
+				endpointKey{
+					Region: "us-gov-east-1",
+				}: endpoint{},
+				endpointKey{
+					Region:  "us-gov-east-1",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "resiliencehub-fips.us-gov-east-1.amazonaws.com",
+				},
+				endpointKey{
+					Region: "us-gov-west-1",
+				}: endpoint{},
+				endpointKey{
+					Region:  "us-gov-west-1",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "resiliencehub-fips.us-gov-west-1.amazonaws.com",
+				},
+			},
+		},
 		"resource-explorer-2": service{
 			Defaults: endpointDefaults{
 				defaultKey{}: endpoint{
@@ -36954,6 +39352,16 @@ var awsusgovPartition = partition{
 				}: endpoint{},
 			},
 		},
+		"rolesanywhere": service{
+			Endpoints: serviceEndpoints{
+				endpointKey{
+					Region: "us-gov-east-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "us-gov-west-1",
+				}: endpoint{},
+			},
+		},
 		"route53": service{
 			PartitionEndpoint: "aws-us-gov-global",
 			IsRegionalized:    boxedFalse,
@@ -37552,7 +39960,7 @@ var awsusgovPartition = partition{
 					Region:  "us-gov-east-1",
 					Variant: dualStackVariant,
 				}: endpoint{
-					Hostname: "servicediscovery.us-gov-east-1.amazonaws.com",
+					Hostname: "servicediscovery.us-gov-east-1.api.aws",
 				},
 				endpointKey{
 					Region:  "us-gov-east-1",
@@ -37560,6 +39968,12 @@ var awsusgovPartition = partition{
 				}: endpoint{
 					Hostname: "servicediscovery-fips.us-gov-east-1.amazonaws.com",
 				},
+				endpointKey{
+					Region:  "us-gov-east-1",
+					Variant: fipsVariant | dualStackVariant,
+				}: endpoint{
+					Hostname: "servicediscovery-fips.us-gov-east-1.api.aws",
+				},
 				endpointKey{
 					Region: "us-gov-east-1-fips",
 				}: endpoint{
@@ -37576,7 +39990,7 @@ var awsusgovPartition = partition{
 					Region:  "us-gov-west-1",
 					Variant: dualStackVariant,
 				}: endpoint{
-					Hostname: "servicediscovery.us-gov-west-1.amazonaws.com",
+					Hostname: "servicediscovery.us-gov-west-1.api.aws",
 				},
 				endpointKey{
 					Region:  "us-gov-west-1",
@@ -37584,6 +39998,12 @@ var awsusgovPartition = partition{
 				}: endpoint{
 					Hostname: "servicediscovery-fips.us-gov-west-1.amazonaws.com",
 				},
+				endpointKey{
+					Region:  "us-gov-west-1",
+					Variant: fipsVariant | dualStackVariant,
+				}: endpoint{
+					Hostname: "servicediscovery-fips.us-gov-west-1.api.aws",
+				},
 				endpointKey{
 					Region: "us-gov-west-1-fips",
 				}: endpoint{
@@ -37650,23 +40070,24 @@ var awsusgovPartition = partition{
 			Endpoints: serviceEndpoints{
 				endpointKey{
 					Region: "us-gov-east-1",
-				}: endpoint{},
+				}: endpoint{
+					Hostname: "simspaceweaver.us-gov-east-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-gov-east-1",
+					},
+				},
 				endpointKey{
 					Region: "us-gov-west-1",
-				}: endpoint{},
-			},
-		},
-		"sms": service{
-			Endpoints: serviceEndpoints{
-				endpointKey{
-					Region: "fips-us-gov-east-1",
 				}: endpoint{
-					Hostname: "sms-fips.us-gov-east-1.amazonaws.com",
+					Hostname: "simspaceweaver.us-gov-west-1.amazonaws.com",
 					CredentialScope: credentialScope{
-						Region: "us-gov-east-1",
+						Region: "us-gov-west-1",
 					},
-					Deprecated: boxedTrue,
 				},
+			},
+		},
+		"sms": service{
+			Endpoints: serviceEndpoints{
 				endpointKey{
 					Region: "fips-us-gov-west-1",
 				}: endpoint{
@@ -37676,15 +40097,6 @@ var awsusgovPartition = partition{
 					},
 					Deprecated: boxedTrue,
 				},
-				endpointKey{
-					Region: "us-gov-east-1",
-				}: endpoint{},
-				endpointKey{
-					Region:  "us-gov-east-1",
-					Variant: fipsVariant,
-				}: endpoint{
-					Hostname: "sms-fips.us-gov-east-1.amazonaws.com",
-				},
 				endpointKey{
 					Region: "us-gov-west-1",
 				}: endpoint{},
@@ -38960,6 +41372,9 @@ var awsisoPartition = partition{
 				endpointKey{
 					Region: "us-iso-east-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "us-iso-west-1",
+				}: endpoint{},
 			},
 		},
 		"elasticache": service{
@@ -39026,14 +41441,45 @@ var awsisoPartition = partition{
 		},
 		"elasticmapreduce": service{
 			Endpoints: serviceEndpoints{
+				endpointKey{
+					Region: "fips-us-iso-east-1",
+				}: endpoint{
+					Hostname: "elasticmapreduce.us-iso-east-1.c2s.ic.gov",
+					CredentialScope: credentialScope{
+						Region: "us-iso-east-1",
+					},
+					Deprecated: boxedTrue,
+				},
+				endpointKey{
+					Region: "fips-us-iso-west-1",
+				}: endpoint{
+					Hostname: "elasticmapreduce.us-iso-west-1.c2s.ic.gov",
+					CredentialScope: credentialScope{
+						Region: "us-iso-west-1",
+					},
+					Deprecated: boxedTrue,
+				},
 				endpointKey{
 					Region: "us-iso-east-1",
 				}: endpoint{
 					Protocols: []string{"https"},
 				},
+				endpointKey{
+					Region:  "us-iso-east-1",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname:  "elasticmapreduce.us-iso-east-1.c2s.ic.gov",
+					Protocols: []string{"https"},
+				},
 				endpointKey{
 					Region: "us-iso-west-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "us-iso-west-1",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "elasticmapreduce.us-iso-west-1.c2s.ic.gov",
+				},
 			},
 		},
 		"es": service{
@@ -39254,6 +41700,15 @@ var awsisoPartition = partition{
 					},
 					Deprecated: boxedTrue,
 				},
+				endpointKey{
+					Region: "fips-us-iso-west-1",
+				}: endpoint{
+					Hostname: "rbin-fips.us-iso-west-1.c2s.ic.gov",
+					CredentialScope: credentialScope{
+						Region: "us-iso-west-1",
+					},
+					Deprecated: boxedTrue,
+				},
 				endpointKey{
 					Region: "us-iso-east-1",
 				}: endpoint{},
@@ -39263,6 +41718,15 @@ var awsisoPartition = partition{
 				}: endpoint{
 					Hostname: "rbin-fips.us-iso-east-1.c2s.ic.gov",
 				},
+				endpointKey{
+					Region: "us-iso-west-1",
+				}: endpoint{},
+				endpointKey{
+					Region:  "us-iso-west-1",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "rbin-fips.us-iso-west-1.c2s.ic.gov",
+				},
 			},
 		},
 		"rds": service{
@@ -39285,6 +41749,16 @@ var awsisoPartition = partition{
 				}: endpoint{},
 			},
 		},
+		"resource-groups": service{
+			Endpoints: serviceEndpoints{
+				endpointKey{
+					Region: "us-iso-east-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "us-iso-west-1",
+				}: endpoint{},
+			},
+		},
 		"route53": service{
 			PartitionEndpoint: "aws-iso-global",
 			IsRegionalized:    boxedFalse,
@@ -39557,6 +42031,13 @@ var awsisobPartition = partition{
 				},
 			},
 		},
+		"api.sagemaker": service{
+			Endpoints: serviceEndpoints{
+				endpointKey{
+					Region: "us-isob-east-1",
+				}: endpoint{},
+			},
+		},
 		"appconfig": service{
 			Endpoints: serviceEndpoints{
 				endpointKey{
@@ -39791,9 +42272,24 @@ var awsisobPartition = partition{
 		},
 		"elasticmapreduce": service{
 			Endpoints: serviceEndpoints{
+				endpointKey{
+					Region: "fips-us-isob-east-1",
+				}: endpoint{
+					Hostname: "elasticmapreduce.us-isob-east-1.sc2s.sgov.gov",
+					CredentialScope: credentialScope{
+						Region: "us-isob-east-1",
+					},
+					Deprecated: boxedTrue,
+				},
 				endpointKey{
 					Region: "us-isob-east-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "us-isob-east-1",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "elasticmapreduce.us-isob-east-1.sc2s.sgov.gov",
+				},
 			},
 		},
 		"es": service{
@@ -39925,6 +42421,13 @@ var awsisobPartition = partition{
 				}: endpoint{},
 			},
 		},
+		"outposts": service{
+			Endpoints: serviceEndpoints{
+				endpointKey{
+					Region: "us-isob-east-1",
+				}: endpoint{},
+			},
+		},
 		"ram": service{
 			Endpoints: serviceEndpoints{
 				endpointKey{
diff --git a/.ci/providerlint/vendor/github.com/cloudflare/circl/LICENSE b/.ci/providerlint/vendor/github.com/cloudflare/circl/LICENSE
new file mode 100644
index 00000000000..67edaa90a04
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/cloudflare/circl/LICENSE
@@ -0,0 +1,57 @@
+Copyright (c) 2019 Cloudflare. All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are
+met:
+
+   * Redistributions of source code must retain the above copyright
+notice, this list of conditions and the following disclaimer.
+   * Redistributions in binary form must reproduce the above
+copyright notice, this list of conditions and the following disclaimer
+in the documentation and/or other materials provided with the
+distribution.
+   * Neither the name of Cloudflare nor the names of its
+contributors may be used to endorse or promote products derived from
+this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+========================================================================
+
+Copyright (c) 2009 The Go Authors. All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are
+met:
+
+   * Redistributions of source code must retain the above copyright
+notice, this list of conditions and the following disclaimer.
+   * Redistributions in binary form must reproduce the above
+copyright notice, this list of conditions and the following disclaimer
+in the documentation and/or other materials provided with the
+distribution.
+   * Neither the name of Google Inc. nor the names of its
+contributors may be used to endorse or promote products derived from
+this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
diff --git a/.ci/providerlint/vendor/github.com/cloudflare/circl/dh/x25519/curve.go b/.ci/providerlint/vendor/github.com/cloudflare/circl/dh/x25519/curve.go
new file mode 100644
index 00000000000..f9057c2b866
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/cloudflare/circl/dh/x25519/curve.go
@@ -0,0 +1,96 @@
+package x25519
+
+import (
+	fp "github.com/cloudflare/circl/math/fp25519"
+)
+
+// ladderJoye calculates a fixed-point multiplication with the generator point.
+// The algorithm is the right-to-left Joye's ladder as described
+// in "How to precompute a ladder" in SAC'2017.
+func ladderJoye(k *Key) {
+	w := [5]fp.Elt{} // [mu,x1,z1,x2,z2] order must be preserved.
+	fp.SetOne(&w[1]) // x1 = 1
+	fp.SetOne(&w[2]) // z1 = 1
+	w[3] = fp.Elt{   // x2 = G-S
+		0xbd, 0xaa, 0x2f, 0xc8, 0xfe, 0xe1, 0x94, 0x7e,
+		0xf8, 0xed, 0xb2, 0x14, 0xae, 0x95, 0xf0, 0xbb,
+		0xe2, 0x48, 0x5d, 0x23, 0xb9, 0xa0, 0xc7, 0xad,
+		0x34, 0xab, 0x7c, 0xe2, 0xee, 0xcd, 0xae, 0x1e,
+	}
+	fp.SetOne(&w[4]) // z2 = 1
+
+	const n = 255
+	const h = 3
+	swap := uint(1)
+	for s := 0; s < n-h; s++ {
+		i := (s + h) / 8
+		j := (s + h) % 8
+		bit := uint((k[i] >> uint(j)) & 1)
+		copy(w[0][:], tableGenerator[s*Size:(s+1)*Size])
+		diffAdd(&w, swap^bit)
+		swap = bit
+	}
+	for s := 0; s < h; s++ {
+		double(&w[1], &w[2])
+	}
+	toAffine((*[fp.Size]byte)(k), &w[1], &w[2])
+}
+
+// ladderMontgomery calculates a generic scalar point multiplication
+// The algorithm implemented is the left-to-right Montgomery's ladder.
+func ladderMontgomery(k, xP *Key) {
+	w := [5]fp.Elt{}      // [x1, x2, z2, x3, z3] order must be preserved.
+	w[0] = *(*fp.Elt)(xP) // x1 = xP
+	fp.SetOne(&w[1])      // x2 = 1
+	w[3] = *(*fp.Elt)(xP) // x3 = xP
+	fp.SetOne(&w[4])      // z3 = 1
+
+	move := uint(0)
+	for s := 255 - 1; s >= 0; s-- {
+		i := s / 8
+		j := s % 8
+		bit := uint((k[i] >> uint(j)) & 1)
+		ladderStep(&w, move^bit)
+		move = bit
+	}
+	toAffine((*[fp.Size]byte)(k), &w[1], &w[2])
+}
+
+func toAffine(k *[fp.Size]byte, x, z *fp.Elt) {
+	fp.Inv(z, z)
+	fp.Mul(x, x, z)
+	_ = fp.ToBytes(k[:], x)
+}
+
+var lowOrderPoints = [5]fp.Elt{
+	{ /* (0,_,1) point of order 2 on Curve25519 */
+		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	},
+	{ /* (1,_,1) point of order 4 on Curve25519 */
+		0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	},
+	{ /* (x,_,1) first point of order 8 on Curve25519 */
+		0xe0, 0xeb, 0x7a, 0x7c, 0x3b, 0x41, 0xb8, 0xae,
+		0x16, 0x56, 0xe3, 0xfa, 0xf1, 0x9f, 0xc4, 0x6a,
+		0xda, 0x09, 0x8d, 0xeb, 0x9c, 0x32, 0xb1, 0xfd,
+		0x86, 0x62, 0x05, 0x16, 0x5f, 0x49, 0xb8, 0x00,
+	},
+	{ /* (x,_,1) second point of order 8 on Curve25519 */
+		0x5f, 0x9c, 0x95, 0xbc, 0xa3, 0x50, 0x8c, 0x24,
+		0xb1, 0xd0, 0xb1, 0x55, 0x9c, 0x83, 0xef, 0x5b,
+		0x04, 0x44, 0x5c, 0xc4, 0x58, 0x1c, 0x8e, 0x86,
+		0xd8, 0x22, 0x4e, 0xdd, 0xd0, 0x9f, 0x11, 0x57,
+	},
+	{ /* (-1,_,1) a point of order 4 on the twist of Curve25519 */
+		0xec, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+		0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+		0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+		0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f,
+	},
+}
diff --git a/.ci/providerlint/vendor/github.com/cloudflare/circl/dh/x25519/curve_amd64.go b/.ci/providerlint/vendor/github.com/cloudflare/circl/dh/x25519/curve_amd64.go
new file mode 100644
index 00000000000..8a3d54c570f
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/cloudflare/circl/dh/x25519/curve_amd64.go
@@ -0,0 +1,30 @@
+//go:build amd64 && !purego
+// +build amd64,!purego
+
+package x25519
+
+import (
+	fp "github.com/cloudflare/circl/math/fp25519"
+	"golang.org/x/sys/cpu"
+)
+
+var hasBmi2Adx = cpu.X86.HasBMI2 && cpu.X86.HasADX
+
+var _ = hasBmi2Adx
+
+func double(x, z *fp.Elt)             { doubleAmd64(x, z) }
+func diffAdd(w *[5]fp.Elt, b uint)    { diffAddAmd64(w, b) }
+func ladderStep(w *[5]fp.Elt, b uint) { ladderStepAmd64(w, b) }
+func mulA24(z, x *fp.Elt)             { mulA24Amd64(z, x) }
+
+//go:noescape
+func ladderStepAmd64(w *[5]fp.Elt, b uint)
+
+//go:noescape
+func diffAddAmd64(w *[5]fp.Elt, b uint)
+
+//go:noescape
+func doubleAmd64(x, z *fp.Elt)
+
+//go:noescape
+func mulA24Amd64(z, x *fp.Elt)
diff --git a/.ci/providerlint/vendor/github.com/cloudflare/circl/dh/x25519/curve_amd64.h b/.ci/providerlint/vendor/github.com/cloudflare/circl/dh/x25519/curve_amd64.h
new file mode 100644
index 00000000000..8c1ae4d0fbb
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/cloudflare/circl/dh/x25519/curve_amd64.h
@@ -0,0 +1,111 @@
+#define ladderStepLeg          \
+    addSub(x2,z2)              \
+    addSub(x3,z3)              \
+    integerMulLeg(b0,x2,z3)    \
+    integerMulLeg(b1,x3,z2)    \
+    reduceFromDoubleLeg(t0,b0) \
+    reduceFromDoubleLeg(t1,b1) \
+    addSub(t0,t1)              \
+    cselect(x2,x3,regMove)     \
+    cselect(z2,z3,regMove)     \
+    integerSqrLeg(b0,t0)       \
+    integerSqrLeg(b1,t1)       \
+    reduceFromDoubleLeg(x3,b0) \
+    reduceFromDoubleLeg(z3,b1) \
+    integerMulLeg(b0,x1,z3)    \
+    reduceFromDoubleLeg(z3,b0) \
+    integerSqrLeg(b0,x2)       \
+    integerSqrLeg(b1,z2)       \
+    reduceFromDoubleLeg(x2,b0) \
+    reduceFromDoubleLeg(z2,b1) \
+    subtraction(t0,x2,z2)      \
+    multiplyA24Leg(t1,t0)      \
+    additionLeg(t1,t1,z2)      \
+    integerMulLeg(b0,x2,z2)    \
+    integerMulLeg(b1,t0,t1)    \
+    reduceFromDoubleLeg(x2,b0) \
+    reduceFromDoubleLeg(z2,b1)
+
+#define ladderStepBmi2Adx      \
+    addSub(x2,z2)              \
+    addSub(x3,z3)              \
+    integerMulAdx(b0,x2,z3)    \
+    integerMulAdx(b1,x3,z2)    \
+    reduceFromDoubleAdx(t0,b0) \
+    reduceFromDoubleAdx(t1,b1) \
+    addSub(t0,t1)              \
+    cselect(x2,x3,regMove)     \
+    cselect(z2,z3,regMove)     \
+    integerSqrAdx(b0,t0)       \
+    integerSqrAdx(b1,t1)       \
+    reduceFromDoubleAdx(x3,b0) \
+    reduceFromDoubleAdx(z3,b1) \
+    integerMulAdx(b0,x1,z3)    \
+    reduceFromDoubleAdx(z3,b0) \
+    integerSqrAdx(b0,x2)       \
+    integerSqrAdx(b1,z2)       \
+    reduceFromDoubleAdx(x2,b0) \
+    reduceFromDoubleAdx(z2,b1) \
+    subtraction(t0,x2,z2)      \
+    multiplyA24Adx(t1,t0)      \
+    additionAdx(t1,t1,z2)      \
+    integerMulAdx(b0,x2,z2)    \
+    integerMulAdx(b1,t0,t1)    \
+    reduceFromDoubleAdx(x2,b0) \
+    reduceFromDoubleAdx(z2,b1)
+
+#define difAddLeg              \
+    addSub(x1,z1)              \
+    integerMulLeg(b0,z1,ui)    \
+    reduceFromDoubleLeg(z1,b0) \
+    addSub(x1,z1)              \
+    integerSqrLeg(b0,x1)       \
+    integerSqrLeg(b1,z1)       \
+    reduceFromDoubleLeg(x1,b0) \
+    reduceFromDoubleLeg(z1,b1) \
+    integerMulLeg(b0,x1,z2)    \
+    integerMulLeg(b1,z1,x2)    \
+    reduceFromDoubleLeg(x1,b0) \
+    reduceFromDoubleLeg(z1,b1)
+
+#define difAddBmi2Adx          \
+    addSub(x1,z1)              \
+    integerMulAdx(b0,z1,ui)    \
+    reduceFromDoubleAdx(z1,b0) \
+    addSub(x1,z1)              \
+    integerSqrAdx(b0,x1)       \
+    integerSqrAdx(b1,z1)       \
+    reduceFromDoubleAdx(x1,b0) \
+    reduceFromDoubleAdx(z1,b1) \
+    integerMulAdx(b0,x1,z2)    \
+    integerMulAdx(b1,z1,x2)    \
+    reduceFromDoubleAdx(x1,b0) \
+    reduceFromDoubleAdx(z1,b1)
+
+#define doubleLeg              \
+    addSub(x1,z1)              \
+    integerSqrLeg(b0,x1)       \
+    integerSqrLeg(b1,z1)       \
+    reduceFromDoubleLeg(x1,b0) \
+    reduceFromDoubleLeg(z1,b1) \
+    subtraction(t0,x1,z1)      \
+    multiplyA24Leg(t1,t0)      \
+    additionLeg(t1,t1,z1)      \
+    integerMulLeg(b0,x1,z1)    \
+    integerMulLeg(b1,t0,t1)    \
+    reduceFromDoubleLeg(x1,b0) \
+    reduceFromDoubleLeg(z1,b1)
+
+#define doubleBmi2Adx          \
+    addSub(x1,z1)              \
+    integerSqrAdx(b0,x1)       \
+    integerSqrAdx(b1,z1)       \
+    reduceFromDoubleAdx(x1,b0) \
+    reduceFromDoubleAdx(z1,b1) \
+    subtraction(t0,x1,z1)      \
+    multiplyA24Adx(t1,t0)      \
+    additionAdx(t1,t1,z1)      \
+    integerMulAdx(b0,x1,z1)    \
+    integerMulAdx(b1,t0,t1)    \
+    reduceFromDoubleAdx(x1,b0) \
+    reduceFromDoubleAdx(z1,b1)
diff --git a/.ci/providerlint/vendor/github.com/cloudflare/circl/dh/x25519/curve_amd64.s b/.ci/providerlint/vendor/github.com/cloudflare/circl/dh/x25519/curve_amd64.s
new file mode 100644
index 00000000000..b7723185b61
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/cloudflare/circl/dh/x25519/curve_amd64.s
@@ -0,0 +1,156 @@
+// +build amd64
+
+#include "textflag.h"
+
+// Depends on circl/math/fp25519 package
+#include "../../math/fp25519/fp_amd64.h"
+#include "curve_amd64.h"
+
+// CTE_A24 is (A+2)/4 from Curve25519
+#define CTE_A24 121666
+
+#define Size 32
+
+// multiplyA24Leg multiplies x times CTE_A24 and stores in z
+// Uses: AX, DX, R8-R13, FLAGS
+// Instr: x86_64, cmov
+#define multiplyA24Leg(z,x) \
+    MOVL $CTE_A24, AX; MULQ  0+x; MOVQ AX,  R8; MOVQ DX,  R9; \
+    MOVL $CTE_A24, AX; MULQ  8+x; MOVQ AX, R12; MOVQ DX, R10; \
+    MOVL $CTE_A24, AX; MULQ 16+x; MOVQ AX, R13; MOVQ DX, R11; \
+    MOVL $CTE_A24, AX; MULQ 24+x; \
+    ADDQ R12,  R9; \
+    ADCQ R13, R10; \
+    ADCQ  AX, R11; \
+    ADCQ  $0,  DX; \
+    MOVL $38,  AX; /* 2*C = 38 = 2^256 MOD 2^255-19*/ \
+    IMULQ AX, DX; \
+    ADDQ DX, R8; \
+    ADCQ $0,  R9;  MOVQ  R9,  8+z; \
+    ADCQ $0, R10;  MOVQ R10, 16+z; \
+    ADCQ $0, R11;  MOVQ R11, 24+z; \
+    MOVQ $0, DX; \
+    CMOVQCS AX, DX; \
+    ADDQ DX, R8;  MOVQ  R8,   0+z;
+
+// multiplyA24Adx multiplies x times CTE_A24 and stores in z
+// Uses: AX, DX, R8-R12, FLAGS
+// Instr: x86_64, cmov, bmi2
+#define multiplyA24Adx(z,x) \
+    MOVQ  $CTE_A24, DX; \
+    MULXQ  0+x,  R8, R10; \
+    MULXQ  8+x,  R9, R11;  ADDQ R10,  R9; \
+    MULXQ 16+x, R10,  AX;  ADCQ R11, R10; \
+    MULXQ 24+x, R11, R12;  ADCQ  AX, R11; \
+    ;;;;;;;;;;;;;;;;;;;;;  ADCQ  $0, R12; \
+    MOVL $38,  DX; /* 2*C = 38 = 2^256 MOD 2^255-19*/ \
+    IMULQ DX, R12; \
+    ADDQ R12, R8; \
+    ADCQ $0,  R9;  MOVQ  R9,  8+z; \
+    ADCQ $0, R10;  MOVQ R10, 16+z; \
+    ADCQ $0, R11;  MOVQ R11, 24+z; \
+    MOVQ $0, R12; \
+    CMOVQCS DX, R12; \
+    ADDQ R12, R8;  MOVQ  R8,  0+z;
+
+#define mulA24Legacy \
+    multiplyA24Leg(0(DI),0(SI))
+#define mulA24Bmi2Adx \
+    multiplyA24Adx(0(DI),0(SI))
+
+// func mulA24Amd64(z, x *fp255.Elt)
+TEXT ·mulA24Amd64(SB),NOSPLIT,$0-16
+    MOVQ z+0(FP), DI
+    MOVQ x+8(FP), SI
+    CHECK_BMI2ADX(LMA24, mulA24Legacy, mulA24Bmi2Adx)
+
+
+// func ladderStepAmd64(w *[5]fp255.Elt, b uint)
+// ladderStepAmd64 calculates a point addition and doubling as follows:
+// (x2,z2) = 2*(x2,z2) and (x3,z3) = (x2,z2)+(x3,z3) using as a difference (x1,-).
+//  work  = (x1,x2,z2,x3,z3) are five fp255.Elt of 32 bytes.
+//  stack = (t0,t1) are two fp.Elt of fp.Size bytes, and
+//          (b0,b1) are two-double precision fp.Elt of 2*fp.Size bytes.
+TEXT ·ladderStepAmd64(SB),NOSPLIT,$192-16
+    // Parameters
+    #define regWork DI
+    #define regMove SI
+    #define x1 0*Size(regWork)
+    #define x2 1*Size(regWork)
+    #define z2 2*Size(regWork)
+    #define x3 3*Size(regWork)
+    #define z3 4*Size(regWork)
+    // Local variables
+    #define t0 0*Size(SP)
+    #define t1 1*Size(SP)
+    #define b0 2*Size(SP)
+    #define b1 4*Size(SP)
+    MOVQ w+0(FP), regWork
+    MOVQ b+8(FP), regMove
+    CHECK_BMI2ADX(LLADSTEP, ladderStepLeg, ladderStepBmi2Adx)
+    #undef regWork
+    #undef regMove
+    #undef x1
+    #undef x2
+    #undef z2
+    #undef x3
+    #undef z3
+    #undef t0
+    #undef t1
+    #undef b0
+    #undef b1
+
+// func diffAddAmd64(w *[5]fp255.Elt, b uint)
+// diffAddAmd64 calculates a differential point addition using a precomputed point.
+// (x1,z1) = (x1,z1)+(mu) using a difference point (x2,z2)
+//    w    = (mu,x1,z1,x2,z2) are five fp.Elt, and
+//   stack = (b0,b1) are two-double precision fp.Elt of 2*fp.Size bytes.
+TEXT ·diffAddAmd64(SB),NOSPLIT,$128-16
+    // Parameters
+    #define regWork DI
+    #define regSwap SI
+    #define ui 0*Size(regWork)
+    #define x1 1*Size(regWork)
+    #define z1 2*Size(regWork)
+    #define x2 3*Size(regWork)
+    #define z2 4*Size(regWork)
+    // Local variables
+    #define b0 0*Size(SP)
+    #define b1 2*Size(SP)
+    MOVQ w+0(FP), regWork
+    MOVQ b+8(FP), regSwap
+    cswap(x1,x2,regSwap)
+    cswap(z1,z2,regSwap)
+    CHECK_BMI2ADX(LDIFADD, difAddLeg, difAddBmi2Adx)
+    #undef regWork
+    #undef regSwap
+    #undef ui
+    #undef x1
+    #undef z1
+    #undef x2
+    #undef z2
+    #undef b0
+    #undef b1
+
+// func doubleAmd64(x, z *fp255.Elt)
+// doubleAmd64 calculates a point doubling (x1,z1) = 2*(x1,z1).
+//  stack = (t0,t1) are two fp.Elt of fp.Size bytes, and
+//          (b0,b1) are two-double precision fp.Elt of 2*fp.Size bytes.
+TEXT ·doubleAmd64(SB),NOSPLIT,$192-16
+    // Parameters
+    #define x1 0(DI)
+    #define z1 0(SI)
+    // Local variables
+    #define t0 0*Size(SP)
+    #define t1 1*Size(SP)
+    #define b0 2*Size(SP)
+    #define b1 4*Size(SP)
+    MOVQ x+0(FP), DI
+    MOVQ z+8(FP), SI
+    CHECK_BMI2ADX(LDOUB,doubleLeg,doubleBmi2Adx)
+    #undef x1
+    #undef z1
+    #undef t0
+    #undef t1
+    #undef b0
+    #undef b1
diff --git a/.ci/providerlint/vendor/github.com/cloudflare/circl/dh/x25519/curve_generic.go b/.ci/providerlint/vendor/github.com/cloudflare/circl/dh/x25519/curve_generic.go
new file mode 100644
index 00000000000..dae67ea37df
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/cloudflare/circl/dh/x25519/curve_generic.go
@@ -0,0 +1,85 @@
+package x25519
+
+import (
+	"encoding/binary"
+	"math/bits"
+
+	fp "github.com/cloudflare/circl/math/fp25519"
+)
+
+func doubleGeneric(x, z *fp.Elt) {
+	t0, t1 := &fp.Elt{}, &fp.Elt{}
+	fp.AddSub(x, z)
+	fp.Sqr(x, x)
+	fp.Sqr(z, z)
+	fp.Sub(t0, x, z)
+	mulA24Generic(t1, t0)
+	fp.Add(t1, t1, z)
+	fp.Mul(x, x, z)
+	fp.Mul(z, t0, t1)
+}
+
+func diffAddGeneric(w *[5]fp.Elt, b uint) {
+	mu, x1, z1, x2, z2 := &w[0], &w[1], &w[2], &w[3], &w[4]
+	fp.Cswap(x1, x2, b)
+	fp.Cswap(z1, z2, b)
+	fp.AddSub(x1, z1)
+	fp.Mul(z1, z1, mu)
+	fp.AddSub(x1, z1)
+	fp.Sqr(x1, x1)
+	fp.Sqr(z1, z1)
+	fp.Mul(x1, x1, z2)
+	fp.Mul(z1, z1, x2)
+}
+
+func ladderStepGeneric(w *[5]fp.Elt, b uint) {
+	x1, x2, z2, x3, z3 := &w[0], &w[1], &w[2], &w[3], &w[4]
+	t0 := &fp.Elt{}
+	t1 := &fp.Elt{}
+	fp.AddSub(x2, z2)
+	fp.AddSub(x3, z3)
+	fp.Mul(t0, x2, z3)
+	fp.Mul(t1, x3, z2)
+	fp.AddSub(t0, t1)
+	fp.Cmov(x2, x3, b)
+	fp.Cmov(z2, z3, b)
+	fp.Sqr(x3, t0)
+	fp.Sqr(z3, t1)
+	fp.Mul(z3, x1, z3)
+	fp.Sqr(x2, x2)
+	fp.Sqr(z2, z2)
+	fp.Sub(t0, x2, z2)
+	mulA24Generic(t1, t0)
+	fp.Add(t1, t1, z2)
+	fp.Mul(x2, x2, z2)
+	fp.Mul(z2, t0, t1)
+}
+
+func mulA24Generic(z, x *fp.Elt) {
+	const A24 = 121666
+	const n = 8
+	var xx [4]uint64
+	for i := range xx {
+		xx[i] = binary.LittleEndian.Uint64(x[i*n : (i+1)*n])
+	}
+
+	h0, l0 := bits.Mul64(xx[0], A24)
+	h1, l1 := bits.Mul64(xx[1], A24)
+	h2, l2 := bits.Mul64(xx[2], A24)
+	h3, l3 := bits.Mul64(xx[3], A24)
+
+	var c3 uint64
+	l1, c0 := bits.Add64(h0, l1, 0)
+	l2, c1 := bits.Add64(h1, l2, c0)
+	l3, c2 := bits.Add64(h2, l3, c1)
+	l4, _ := bits.Add64(h3, 0, c2)
+	_, l4 = bits.Mul64(l4, 38)
+	l0, c0 = bits.Add64(l0, l4, 0)
+	xx[1], c1 = bits.Add64(l1, 0, c0)
+	xx[2], c2 = bits.Add64(l2, 0, c1)
+	xx[3], c3 = bits.Add64(l3, 0, c2)
+	xx[0], _ = bits.Add64(l0, (-c3)&38, 0)
+	for i := range xx {
+		binary.LittleEndian.PutUint64(z[i*n:(i+1)*n], xx[i])
+	}
+}
diff --git a/.ci/providerlint/vendor/github.com/cloudflare/circl/dh/x25519/curve_noasm.go b/.ci/providerlint/vendor/github.com/cloudflare/circl/dh/x25519/curve_noasm.go
new file mode 100644
index 00000000000..07fab97d2af
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/cloudflare/circl/dh/x25519/curve_noasm.go
@@ -0,0 +1,11 @@
+//go:build !amd64 || purego
+// +build !amd64 purego
+
+package x25519
+
+import fp "github.com/cloudflare/circl/math/fp25519"
+
+func double(x, z *fp.Elt)             { doubleGeneric(x, z) }
+func diffAdd(w *[5]fp.Elt, b uint)    { diffAddGeneric(w, b) }
+func ladderStep(w *[5]fp.Elt, b uint) { ladderStepGeneric(w, b) }
+func mulA24(z, x *fp.Elt)             { mulA24Generic(z, x) }
diff --git a/.ci/providerlint/vendor/github.com/cloudflare/circl/dh/x25519/doc.go b/.ci/providerlint/vendor/github.com/cloudflare/circl/dh/x25519/doc.go
new file mode 100644
index 00000000000..3ce102d1457
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/cloudflare/circl/dh/x25519/doc.go
@@ -0,0 +1,19 @@
+/*
+Package x25519 provides Diffie-Hellman functions as specified in RFC-7748.
+
+Validation of public keys.
+
+The Diffie-Hellman function, as described in RFC-7748 [1], works for any
+public key. However, if a different protocol requires contributory
+behaviour [2,3], then the public keys must be validated against low-order
+points [3,4]. To do that, the Shared function performs this validation
+internally and returns false when the public key is invalid (i.e., it
+is a low-order point).
+
+References:
+  - [1] RFC7748 by Langley, Hamburg, Turner (https://rfc-editor.org/rfc/rfc7748.txt)
+  - [2] Curve25519 by Bernstein (https://cr.yp.to/ecdh.html)
+  - [3] Bernstein (https://cr.yp.to/ecdh.html#validate)
+  - [4] Cremers&Jackson (https://eprint.iacr.org/2019/526)
+*/
+package x25519
diff --git a/.ci/providerlint/vendor/github.com/cloudflare/circl/dh/x25519/key.go b/.ci/providerlint/vendor/github.com/cloudflare/circl/dh/x25519/key.go
new file mode 100644
index 00000000000..c76f72ac7fa
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/cloudflare/circl/dh/x25519/key.go
@@ -0,0 +1,47 @@
+package x25519
+
+import (
+	"crypto/subtle"
+
+	fp "github.com/cloudflare/circl/math/fp25519"
+)
+
+// Size is the length in bytes of a X25519 key.
+const Size = 32
+
+// Key represents a X25519 key.
+type Key [Size]byte
+
+func (k *Key) clamp(in *Key) *Key {
+	*k = *in
+	k[0] &= 248
+	k[31] = (k[31] & 127) | 64
+	return k
+}
+
+// isValidPubKey verifies if the public key is not a low-order point.
+func (k *Key) isValidPubKey() bool {
+	fp.Modp((*fp.Elt)(k))
+	var isLowOrder int
+	for _, P := range lowOrderPoints {
+		isLowOrder |= subtle.ConstantTimeCompare(P[:], k[:])
+	}
+	return isLowOrder == 0
+}
+
+// KeyGen obtains a public key given a secret key.
+func KeyGen(public, secret *Key) {
+	ladderJoye(public.clamp(secret))
+}
+
+// Shared calculates Alice's shared key from Alice's secret key and Bob's
+// public key returning true on success. A failure case happens when the public
+// key is a low-order point, thus the shared key is all-zeros and the function
+// returns false.
+func Shared(shared, secret, public *Key) bool {
+	validPk := *public
+	validPk[31] &= (1 << (255 % 8)) - 1
+	ok := validPk.isValidPubKey()
+	ladderMontgomery(shared.clamp(secret), &validPk)
+	return ok
+}
diff --git a/.ci/providerlint/vendor/github.com/cloudflare/circl/dh/x25519/table.go b/.ci/providerlint/vendor/github.com/cloudflare/circl/dh/x25519/table.go
new file mode 100644
index 00000000000..28c8c4ac032
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/cloudflare/circl/dh/x25519/table.go
@@ -0,0 +1,268 @@
+package x25519
+
+import "github.com/cloudflare/circl/math/fp25519"
+
+// tableGenerator contains the set of points:
+//
+//	t[i] = (xi+1)/(xi-1),
+//
+// where (xi,yi) = 2^iG and G is the generator point
+// Size = (256)*(256/8) = 8192 bytes.
+var tableGenerator = [256 * fp25519.Size]byte{
+	/* (2^  0)P */ 0xf3, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x5f,
+	/* (2^  1)P */ 0x96, 0xfe, 0xaa, 0x16, 0xf4, 0x20, 0x82, 0x6b, 0x34, 0x6a, 0x56, 0x4f, 0x2b, 0xeb, 0xeb, 0x82, 0x0f, 0x95, 0xa5, 0x75, 0xb0, 0xa5, 0xa9, 0xd5, 0xf4, 0x88, 0x24, 0x4b, 0xcf, 0xb2, 0x42, 0x51,
+	/* (2^  2)P */ 0x0c, 0x68, 0x69, 0x00, 0x75, 0xbc, 0xae, 0x6a, 0x41, 0x9c, 0xf9, 0xa0, 0x20, 0x78, 0xcf, 0x89, 0xf4, 0xd0, 0x56, 0x3b, 0x18, 0xd9, 0x58, 0x2a, 0xa4, 0x11, 0x60, 0xe3, 0x80, 0xca, 0x5a, 0x4b,
+	/* (2^  3)P */ 0x5d, 0x74, 0x29, 0x8c, 0x34, 0x32, 0x91, 0x32, 0xd7, 0x2f, 0x64, 0xe1, 0x16, 0xe6, 0xa2, 0xf4, 0x34, 0xbc, 0x67, 0xff, 0x03, 0xbb, 0x45, 0x1e, 0x4a, 0x9b, 0x2a, 0xf4, 0xd0, 0x12, 0x69, 0x30,
+	/* (2^  4)P */ 0x54, 0x71, 0xaf, 0xe6, 0x07, 0x65, 0x88, 0xff, 0x2f, 0xc8, 0xee, 0xdf, 0x13, 0x0e, 0xf5, 0x04, 0xce, 0xb5, 0xba, 0x2a, 0xe8, 0x2f, 0x51, 0xaa, 0x22, 0xf2, 0xd5, 0x68, 0x1a, 0x25, 0x4e, 0x17,
+	/* (2^  5)P */ 0x98, 0x88, 0x02, 0x82, 0x0d, 0x70, 0x96, 0xcf, 0xc5, 0x02, 0x2c, 0x0a, 0x37, 0xe3, 0x43, 0x17, 0xaa, 0x6e, 0xe8, 0xb4, 0x98, 0xec, 0x9e, 0x37, 0x2e, 0x48, 0xe0, 0x51, 0x8a, 0x88, 0x59, 0x0c,
+	/* (2^  6)P */ 0x89, 0xd1, 0xb5, 0x99, 0xd6, 0xf1, 0xcb, 0xfb, 0x84, 0xdc, 0x9f, 0x8e, 0xd5, 0xf0, 0xae, 0xac, 0x14, 0x76, 0x1f, 0x23, 0x06, 0x0d, 0xc2, 0xc1, 0x72, 0xf9, 0x74, 0xa2, 0x8d, 0x21, 0x38, 0x29,
+	/* (2^  7)P */ 0x18, 0x7f, 0x1d, 0xff, 0xbe, 0x49, 0xaf, 0xf6, 0xc2, 0xc9, 0x7a, 0x38, 0x22, 0x1c, 0x54, 0xcc, 0x6b, 0xc5, 0x15, 0x40, 0xef, 0xc9, 0xfc, 0x96, 0xa9, 0x13, 0x09, 0x69, 0x7c, 0x62, 0xc1, 0x69,
+	/* (2^  8)P */ 0x0e, 0xdb, 0x33, 0x47, 0x2f, 0xfd, 0x86, 0x7a, 0xe9, 0x7d, 0x08, 0x9e, 0xf2, 0xc4, 0xb8, 0xfd, 0x29, 0xa2, 0xa2, 0x8e, 0x1a, 0x4b, 0x5e, 0x09, 0x79, 0x7a, 0xb3, 0x29, 0xc8, 0xa7, 0xd7, 0x1a,
+	/* (2^  9)P */ 0xc0, 0xa0, 0x7e, 0xd1, 0xca, 0x89, 0x2d, 0x34, 0x51, 0x20, 0xed, 0xcc, 0xa6, 0xdd, 0xbe, 0x67, 0x74, 0x2f, 0xb4, 0x2b, 0xbf, 0x31, 0xca, 0x19, 0xbb, 0xac, 0x80, 0x49, 0xc8, 0xb4, 0xf7, 0x3d,
+	/* (2^ 10)P */ 0x83, 0xd8, 0x0a, 0xc8, 0x4d, 0x44, 0xc6, 0xa8, 0x85, 0xab, 0xe3, 0x66, 0x03, 0x44, 0x1e, 0xb9, 0xd8, 0xf6, 0x64, 0x01, 0xa0, 0xcd, 0x15, 0xc2, 0x68, 0xe6, 0x47, 0xf2, 0x6e, 0x7c, 0x86, 0x3d,
+	/* (2^ 11)P */ 0x8c, 0x65, 0x3e, 0xcc, 0x2b, 0x58, 0xdd, 0xc7, 0x28, 0x55, 0x0e, 0xee, 0x48, 0x47, 0x2c, 0xfd, 0x71, 0x4f, 0x9f, 0xcc, 0x95, 0x9b, 0xfd, 0xa0, 0xdf, 0x5d, 0x67, 0xb0, 0x71, 0xd8, 0x29, 0x75,
+	/* (2^ 12)P */ 0x78, 0xbd, 0x3c, 0x2d, 0xb4, 0x68, 0xf5, 0xb8, 0x82, 0xda, 0xf3, 0x91, 0x1b, 0x01, 0x33, 0x12, 0x62, 0x3b, 0x7c, 0x4a, 0xcd, 0x6c, 0xce, 0x2d, 0x03, 0x86, 0x49, 0x9e, 0x8e, 0xfc, 0xe7, 0x75,
+	/* (2^ 13)P */ 0xec, 0xb6, 0xd0, 0xfc, 0xf1, 0x13, 0x4f, 0x2f, 0x45, 0x7a, 0xff, 0x29, 0x1f, 0xca, 0xa8, 0xf1, 0x9b, 0xe2, 0x81, 0x29, 0xa7, 0xc1, 0x49, 0xc2, 0x6a, 0xb5, 0x83, 0x8c, 0xbb, 0x0d, 0xbe, 0x6e,
+	/* (2^ 14)P */ 0x22, 0xb2, 0x0b, 0x17, 0x8d, 0xfa, 0x14, 0x71, 0x5f, 0x93, 0x93, 0xbf, 0xd5, 0xdc, 0xa2, 0x65, 0x9a, 0x97, 0x9c, 0xb5, 0x68, 0x1f, 0xc4, 0xbd, 0x89, 0x92, 0xce, 0xa2, 0x79, 0xef, 0x0e, 0x2f,
+	/* (2^ 15)P */ 0xce, 0x37, 0x3c, 0x08, 0x0c, 0xbf, 0xec, 0x42, 0x22, 0x63, 0x49, 0xec, 0x09, 0xbc, 0x30, 0x29, 0x0d, 0xac, 0xfe, 0x9c, 0xc1, 0xb0, 0x94, 0xf2, 0x80, 0xbb, 0xfa, 0xed, 0x4b, 0xaa, 0x80, 0x37,
+	/* (2^ 16)P */ 0x29, 0xd9, 0xea, 0x7c, 0x3e, 0x7d, 0xc1, 0x56, 0xc5, 0x22, 0x57, 0x2e, 0xeb, 0x4b, 0xcb, 0xe7, 0x5a, 0xe1, 0xbf, 0x2d, 0x73, 0x31, 0xe9, 0x0c, 0xf8, 0x52, 0x10, 0x62, 0xc7, 0x83, 0xb8, 0x41,
+	/* (2^ 17)P */ 0x50, 0x53, 0xd2, 0xc3, 0xa0, 0x5c, 0xf7, 0xdb, 0x51, 0xe3, 0xb1, 0x6e, 0x08, 0xbe, 0x36, 0x29, 0x12, 0xb2, 0xa9, 0xb4, 0x3c, 0xe0, 0x36, 0xc9, 0xaa, 0x25, 0x22, 0x32, 0x82, 0xbf, 0x45, 0x1d,
+	/* (2^ 18)P */ 0xc5, 0x4c, 0x02, 0x6a, 0x03, 0xb1, 0x1a, 0xe8, 0x72, 0x9a, 0x4c, 0x30, 0x1c, 0x20, 0x12, 0xe2, 0xfc, 0xb1, 0x32, 0x68, 0xba, 0x3f, 0xd7, 0xc5, 0x81, 0x95, 0x83, 0x4d, 0x5a, 0xdb, 0xff, 0x20,
+	/* (2^ 19)P */ 0xad, 0x0f, 0x5d, 0xbe, 0x67, 0xd3, 0x83, 0xa2, 0x75, 0x44, 0x16, 0x8b, 0xca, 0x25, 0x2b, 0x6c, 0x2e, 0xf2, 0xaa, 0x7c, 0x46, 0x35, 0x49, 0x9d, 0x49, 0xff, 0x85, 0xee, 0x8e, 0x40, 0x66, 0x51,
+	/* (2^ 20)P */ 0x61, 0xe3, 0xb4, 0xfa, 0xa2, 0xba, 0x67, 0x3c, 0xef, 0x5c, 0xf3, 0x7e, 0xc6, 0x33, 0xe4, 0xb3, 0x1c, 0x9b, 0x15, 0x41, 0x92, 0x72, 0x59, 0x52, 0x33, 0xab, 0xb0, 0xd5, 0x92, 0x18, 0x62, 0x6a,
+	/* (2^ 21)P */ 0xcb, 0xcd, 0x55, 0x75, 0x38, 0x4a, 0xb7, 0x20, 0x3f, 0x92, 0x08, 0x12, 0x0e, 0xa1, 0x2a, 0x53, 0xd1, 0x1d, 0x28, 0x62, 0x77, 0x7b, 0xa1, 0xea, 0xbf, 0x44, 0x5c, 0xf0, 0x43, 0x34, 0xab, 0x61,
+	/* (2^ 22)P */ 0xf8, 0xde, 0x24, 0x23, 0x42, 0x6c, 0x7a, 0x25, 0x7f, 0xcf, 0xe3, 0x17, 0x10, 0x6c, 0x1c, 0x13, 0x57, 0xa2, 0x30, 0xf6, 0x39, 0x87, 0x75, 0x23, 0x80, 0x85, 0xa7, 0x01, 0x7a, 0x40, 0x5a, 0x29,
+	/* (2^ 23)P */ 0xd9, 0xa8, 0x5d, 0x6d, 0x24, 0x43, 0xc4, 0xf8, 0x5d, 0xfa, 0x52, 0x0c, 0x45, 0x75, 0xd7, 0x19, 0x3d, 0xf8, 0x1b, 0x73, 0x92, 0xfc, 0xfc, 0x2a, 0x00, 0x47, 0x2b, 0x1b, 0xe8, 0xc8, 0x10, 0x7d,
+	/* (2^ 24)P */ 0x0b, 0xa2, 0xba, 0x70, 0x1f, 0x27, 0xe0, 0xc8, 0x57, 0x39, 0xa6, 0x7c, 0x86, 0x48, 0x37, 0x99, 0xbb, 0xd4, 0x7e, 0xcb, 0xb3, 0xef, 0x12, 0x54, 0x75, 0x29, 0xe6, 0x73, 0x61, 0xd3, 0x96, 0x31,
+	/* (2^ 25)P */ 0xfc, 0xdf, 0xc7, 0x41, 0xd1, 0xca, 0x5b, 0xde, 0x48, 0xc8, 0x95, 0xb3, 0xd2, 0x8c, 0xcc, 0x47, 0xcb, 0xf3, 0x1a, 0xe1, 0x42, 0xd9, 0x4c, 0xa3, 0xc2, 0xce, 0x4e, 0xd0, 0xf2, 0xdb, 0x56, 0x02,
+	/* (2^ 26)P */ 0x7f, 0x66, 0x0e, 0x4b, 0xe9, 0xb7, 0x5a, 0x87, 0x10, 0x0d, 0x85, 0xc0, 0x83, 0xdd, 0xd4, 0xca, 0x9f, 0xc7, 0x72, 0x4e, 0x8f, 0x2e, 0xf1, 0x47, 0x9b, 0xb1, 0x85, 0x8c, 0xbb, 0x87, 0x1a, 0x5f,
+	/* (2^ 27)P */ 0xb8, 0x51, 0x7f, 0x43, 0xb6, 0xd0, 0xe9, 0x7a, 0x65, 0x90, 0x87, 0x18, 0x55, 0xce, 0xc7, 0x12, 0xee, 0x7a, 0xf7, 0x5c, 0xfe, 0x09, 0xde, 0x2a, 0x27, 0x56, 0x2c, 0x7d, 0x2f, 0x5a, 0xa0, 0x23,
+	/* (2^ 28)P */ 0x9a, 0x16, 0x7c, 0xf1, 0x28, 0xe1, 0x08, 0x59, 0x2d, 0x85, 0xd0, 0x8a, 0xdd, 0x98, 0x74, 0xf7, 0x64, 0x2f, 0x10, 0xab, 0xce, 0xc4, 0xb4, 0x74, 0x45, 0x98, 0x13, 0x10, 0xdd, 0xba, 0x3a, 0x18,
+	/* (2^ 29)P */ 0xac, 0xaa, 0x92, 0xaa, 0x8d, 0xba, 0x65, 0xb1, 0x05, 0x67, 0x38, 0x99, 0x95, 0xef, 0xc5, 0xd5, 0xd1, 0x40, 0xfc, 0xf8, 0x0c, 0x8f, 0x2f, 0xbe, 0x14, 0x45, 0x20, 0xee, 0x35, 0xe6, 0x01, 0x27,
+	/* (2^ 30)P */ 0x14, 0x65, 0x15, 0x20, 0x00, 0xa8, 0x9f, 0x62, 0xce, 0xc1, 0xa8, 0x64, 0x87, 0x86, 0x23, 0xf2, 0x0e, 0x06, 0x3f, 0x0b, 0xff, 0x4f, 0x89, 0x5b, 0xfa, 0xa3, 0x08, 0xf7, 0x4c, 0x94, 0xd9, 0x60,
+	/* (2^ 31)P */ 0x1f, 0x20, 0x7a, 0x1c, 0x1a, 0x00, 0xea, 0xae, 0x63, 0xce, 0xe2, 0x3e, 0x63, 0x6a, 0xf1, 0xeb, 0xe1, 0x07, 0x7a, 0x4c, 0x59, 0x09, 0x77, 0x6f, 0xcb, 0x08, 0x02, 0x0d, 0x15, 0x58, 0xb9, 0x79,
+	/* (2^ 32)P */ 0xe7, 0x10, 0xd4, 0x01, 0x53, 0x5e, 0xb5, 0x24, 0x4d, 0xc8, 0xfd, 0xf3, 0xdf, 0x4e, 0xa3, 0xe3, 0xd8, 0x32, 0x40, 0x90, 0xe4, 0x68, 0x87, 0xd8, 0xec, 0xae, 0x3a, 0x7b, 0x42, 0x84, 0x13, 0x13,
+	/* (2^ 33)P */ 0x14, 0x4f, 0x23, 0x86, 0x12, 0xe5, 0x05, 0x84, 0x29, 0xc5, 0xb4, 0xad, 0x39, 0x47, 0xdc, 0x14, 0xfd, 0x4f, 0x63, 0x50, 0xb2, 0xb5, 0xa2, 0xb8, 0x93, 0xff, 0xa7, 0xd8, 0x4a, 0xa9, 0xe2, 0x2f,
+	/* (2^ 34)P */ 0xdd, 0xfa, 0x43, 0xe8, 0xef, 0x57, 0x5c, 0xec, 0x18, 0x99, 0xbb, 0xf0, 0x40, 0xce, 0x43, 0x28, 0x05, 0x63, 0x3d, 0xcf, 0xd6, 0x61, 0xb5, 0xa4, 0x7e, 0x77, 0xfb, 0xe8, 0xbd, 0x29, 0x36, 0x74,
+	/* (2^ 35)P */ 0x8f, 0x73, 0xaf, 0xbb, 0x46, 0xdd, 0x3e, 0x34, 0x51, 0xa6, 0x01, 0xb1, 0x28, 0x18, 0x98, 0xed, 0x7a, 0x79, 0x2c, 0x88, 0x0b, 0x76, 0x01, 0xa4, 0x30, 0x87, 0xc8, 0x8d, 0xe2, 0x23, 0xc2, 0x1f,
+	/* (2^ 36)P */ 0x0e, 0xba, 0x0f, 0xfc, 0x91, 0x4e, 0x60, 0x48, 0xa4, 0x6f, 0x2c, 0x05, 0x8f, 0xf7, 0x37, 0xb6, 0x9c, 0x23, 0xe9, 0x09, 0x3d, 0xac, 0xcc, 0x91, 0x7c, 0x68, 0x7a, 0x43, 0xd4, 0xee, 0xf7, 0x23,
+	/* (2^ 37)P */ 0x00, 0xd8, 0x9b, 0x8d, 0x11, 0xb1, 0x73, 0x51, 0xa7, 0xd4, 0x89, 0x31, 0xb6, 0x41, 0xd6, 0x29, 0x86, 0xc5, 0xbb, 0x88, 0x79, 0x17, 0xbf, 0xfd, 0xf5, 0x1d, 0xd8, 0xca, 0x4f, 0x89, 0x59, 0x29,
+	/* (2^ 38)P */ 0x99, 0xc8, 0xbb, 0xb4, 0xf3, 0x8e, 0xbc, 0xae, 0xb9, 0x92, 0x69, 0xb2, 0x5a, 0x99, 0x48, 0x41, 0xfb, 0x2c, 0xf9, 0x34, 0x01, 0x0b, 0xe2, 0x24, 0xe8, 0xde, 0x05, 0x4a, 0x89, 0x58, 0xd1, 0x40,
+	/* (2^ 39)P */ 0xf6, 0x76, 0xaf, 0x85, 0x11, 0x0b, 0xb0, 0x46, 0x79, 0x7a, 0x18, 0x73, 0x78, 0xc7, 0xba, 0x26, 0x5f, 0xff, 0x8f, 0xab, 0x95, 0xbf, 0xc0, 0x3d, 0xd7, 0x24, 0x55, 0x94, 0xd8, 0x8b, 0x60, 0x2a,
+	/* (2^ 40)P */ 0x02, 0x63, 0x44, 0xbd, 0x88, 0x95, 0x44, 0x26, 0x9c, 0x43, 0x88, 0x03, 0x1c, 0xc2, 0x4b, 0x7c, 0xb2, 0x11, 0xbd, 0x83, 0xf3, 0xa4, 0x98, 0x8e, 0xb9, 0x76, 0xd8, 0xc9, 0x7b, 0x8d, 0x21, 0x26,
+	/* (2^ 41)P */ 0x8a, 0x17, 0x7c, 0x99, 0x42, 0x15, 0x08, 0xe3, 0x6f, 0x60, 0xb6, 0x6f, 0xa8, 0x29, 0x2d, 0x3c, 0x74, 0x93, 0x27, 0xfa, 0x36, 0x77, 0x21, 0x5c, 0xfa, 0xb1, 0xfe, 0x4a, 0x73, 0x05, 0xde, 0x7d,
+	/* (2^ 42)P */ 0xab, 0x2b, 0xd4, 0x06, 0x39, 0x0e, 0xf1, 0x3b, 0x9c, 0x64, 0x80, 0x19, 0x3e, 0x80, 0xf7, 0xe4, 0x7a, 0xbf, 0x95, 0x95, 0xf8, 0x3b, 0x05, 0xe6, 0x30, 0x55, 0x24, 0xda, 0x38, 0xaf, 0x4f, 0x39,
+	/* (2^ 43)P */ 0xf4, 0x28, 0x69, 0x89, 0x58, 0xfb, 0x8e, 0x7a, 0x3c, 0x11, 0x6a, 0xcc, 0xe9, 0x78, 0xc7, 0xfb, 0x6f, 0x59, 0xaf, 0x30, 0xe3, 0x0c, 0x67, 0x72, 0xf7, 0x6c, 0x3d, 0x1d, 0xa8, 0x22, 0xf2, 0x48,
+	/* (2^ 44)P */ 0xa7, 0xca, 0x72, 0x0d, 0x41, 0xce, 0x1f, 0xf0, 0x95, 0x55, 0x3b, 0x21, 0xc7, 0xec, 0x20, 0x5a, 0x83, 0x14, 0xfa, 0xc1, 0x65, 0x11, 0xc2, 0x7b, 0x41, 0xa7, 0xa8, 0x1d, 0xe3, 0x9a, 0xf8, 0x07,
+	/* (2^ 45)P */ 0xf9, 0x0f, 0x83, 0xc6, 0xb4, 0xc2, 0xd2, 0x05, 0x93, 0x62, 0x31, 0xc6, 0x0f, 0x33, 0x3e, 0xd4, 0x04, 0xa9, 0xd3, 0x96, 0x0a, 0x59, 0xa5, 0xa5, 0xb6, 0x33, 0x53, 0xa6, 0x91, 0xdb, 0x5e, 0x70,
+	/* (2^ 46)P */ 0xf7, 0xa5, 0xb9, 0x0b, 0x5e, 0xe1, 0x8e, 0x04, 0x5d, 0xaf, 0x0a, 0x9e, 0xca, 0xcf, 0x40, 0x32, 0x0b, 0xa4, 0xc4, 0xed, 0xce, 0x71, 0x4b, 0x8f, 0x6d, 0x4a, 0x54, 0xde, 0xa3, 0x0d, 0x1c, 0x62,
+	/* (2^ 47)P */ 0x91, 0x40, 0x8c, 0xa0, 0x36, 0x28, 0x87, 0x92, 0x45, 0x14, 0xc9, 0x10, 0xb0, 0x75, 0x83, 0xce, 0x94, 0x63, 0x27, 0x4f, 0x52, 0xeb, 0x72, 0x8a, 0x35, 0x36, 0xc8, 0x7e, 0xfa, 0xfc, 0x67, 0x26,
+	/* (2^ 48)P */ 0x2a, 0x75, 0xe8, 0x45, 0x33, 0x17, 0x4c, 0x7f, 0xa5, 0x79, 0x70, 0xee, 0xfe, 0x47, 0x1b, 0x06, 0x34, 0xff, 0x86, 0x9f, 0xfa, 0x9a, 0xdd, 0x25, 0x9c, 0xc8, 0x5d, 0x42, 0xf5, 0xce, 0x80, 0x37,
+	/* (2^ 49)P */ 0xe9, 0xb4, 0x3b, 0x51, 0x5a, 0x03, 0x46, 0x1a, 0xda, 0x5a, 0x57, 0xac, 0x79, 0xf3, 0x1e, 0x3e, 0x50, 0x4b, 0xa2, 0x5f, 0x1c, 0x5f, 0x8c, 0xc7, 0x22, 0x9f, 0xfd, 0x34, 0x76, 0x96, 0x1a, 0x32,
+	/* (2^ 50)P */ 0xfa, 0x27, 0x6e, 0x82, 0xb8, 0x07, 0x67, 0x94, 0xd0, 0x6f, 0x50, 0x4c, 0xd6, 0x84, 0xca, 0x3d, 0x36, 0x14, 0xe9, 0x75, 0x80, 0x21, 0x89, 0xc1, 0x84, 0x84, 0x3b, 0x9b, 0x16, 0x84, 0x92, 0x6d,
+	/* (2^ 51)P */ 0xdf, 0x2d, 0x3f, 0x38, 0x40, 0xe8, 0x67, 0x3a, 0x75, 0x9b, 0x4f, 0x0c, 0xa3, 0xc9, 0xee, 0x33, 0x47, 0xef, 0x83, 0xa7, 0x6f, 0xc8, 0xc7, 0x3e, 0xc4, 0xfb, 0xc9, 0xba, 0x9f, 0x44, 0xec, 0x26,
+	/* (2^ 52)P */ 0x7d, 0x9e, 0x9b, 0xa0, 0xcb, 0x38, 0x0f, 0x5c, 0x8c, 0x47, 0xa3, 0x62, 0xc7, 0x8c, 0x16, 0x81, 0x1c, 0x12, 0xfc, 0x06, 0xd3, 0xb0, 0x23, 0x3e, 0xdd, 0xdc, 0xef, 0xa5, 0xa0, 0x8a, 0x23, 0x5a,
+	/* (2^ 53)P */ 0xff, 0x43, 0xea, 0xc4, 0x21, 0x61, 0xa2, 0x1b, 0xb5, 0x32, 0x88, 0x7c, 0x7f, 0xc7, 0xf8, 0x36, 0x9a, 0xf9, 0xdc, 0x0a, 0x0b, 0xea, 0xfb, 0x88, 0xf9, 0xeb, 0x5b, 0xc2, 0x8e, 0x93, 0xa9, 0x5c,
+	/* (2^ 54)P */ 0xa0, 0xcd, 0xfc, 0x51, 0x5e, 0x6a, 0x43, 0xd5, 0x3b, 0x89, 0xcd, 0xc2, 0x97, 0x47, 0xbc, 0x1d, 0x08, 0x4a, 0x22, 0xd3, 0x65, 0x6a, 0x34, 0x19, 0x66, 0xf4, 0x9a, 0x9b, 0xe4, 0x34, 0x50, 0x0f,
+	/* (2^ 55)P */ 0x6e, 0xb9, 0xe0, 0xa1, 0x67, 0x39, 0x3c, 0xf2, 0x88, 0x4d, 0x7a, 0x86, 0xfa, 0x08, 0x8b, 0xe5, 0x79, 0x16, 0x34, 0xa7, 0xc6, 0xab, 0x2f, 0xfb, 0x46, 0x69, 0x02, 0xb6, 0x1e, 0x38, 0x75, 0x2a,
+	/* (2^ 56)P */ 0xac, 0x20, 0x94, 0xc1, 0xe4, 0x3b, 0x0a, 0xc8, 0xdc, 0xb6, 0xf2, 0x81, 0xc6, 0xf6, 0xb1, 0x66, 0x88, 0x33, 0xe9, 0x61, 0x67, 0x03, 0xf7, 0x7c, 0xc4, 0xa4, 0x60, 0xa6, 0xd8, 0xbb, 0xab, 0x25,
+	/* (2^ 57)P */ 0x98, 0x51, 0xfd, 0x14, 0xba, 0x12, 0xea, 0x91, 0xa9, 0xff, 0x3c, 0x4a, 0xfc, 0x50, 0x49, 0x68, 0x28, 0xad, 0xf5, 0x30, 0x21, 0x84, 0x26, 0xf8, 0x41, 0xa4, 0x01, 0x53, 0xf7, 0x88, 0xa9, 0x3e,
+	/* (2^ 58)P */ 0x6f, 0x8c, 0x5f, 0x69, 0x9a, 0x10, 0x78, 0xc9, 0xf3, 0xc3, 0x30, 0x05, 0x4a, 0xeb, 0x46, 0x17, 0x95, 0x99, 0x45, 0xb4, 0x77, 0x6d, 0x4d, 0x44, 0xc7, 0x5c, 0x4e, 0x05, 0x8c, 0x2b, 0x95, 0x75,
+	/* (2^ 59)P */ 0xaa, 0xd6, 0xf4, 0x15, 0x79, 0x3f, 0x70, 0xa3, 0xd8, 0x47, 0x26, 0x2f, 0x20, 0x46, 0xc3, 0x66, 0x4b, 0x64, 0x1d, 0x81, 0xdf, 0x69, 0x14, 0xd0, 0x1f, 0xd7, 0xa5, 0x81, 0x7d, 0xa4, 0xfe, 0x77,
+	/* (2^ 60)P */ 0x81, 0xa3, 0x7c, 0xf5, 0x9e, 0x52, 0xe9, 0xc5, 0x1a, 0x88, 0x2f, 0xce, 0xb9, 0xb4, 0xee, 0x6e, 0xd6, 0x9b, 0x00, 0xe8, 0x28, 0x1a, 0xe9, 0xb6, 0xec, 0x3f, 0xfc, 0x9a, 0x3e, 0xbe, 0x80, 0x4b,
+	/* (2^ 61)P */ 0xc5, 0xd2, 0xae, 0x26, 0xc5, 0x73, 0x37, 0x7e, 0x9d, 0xa4, 0xc9, 0x53, 0xb4, 0xfc, 0x4a, 0x1b, 0x4d, 0xb2, 0xff, 0xba, 0xd7, 0xbd, 0x20, 0xa9, 0x0e, 0x40, 0x2d, 0x12, 0x9f, 0x69, 0x54, 0x7c,
+	/* (2^ 62)P */ 0xc8, 0x4b, 0xa9, 0x4f, 0xe1, 0xc8, 0x46, 0xef, 0x5e, 0xed, 0x52, 0x29, 0xce, 0x74, 0xb0, 0xe0, 0xd5, 0x85, 0xd8, 0xdb, 0xe1, 0x50, 0xa4, 0xbe, 0x2c, 0x71, 0x0f, 0x32, 0x49, 0x86, 0xb6, 0x61,
+	/* (2^ 63)P */ 0xd1, 0xbd, 0xcc, 0x09, 0x73, 0x5f, 0x48, 0x8a, 0x2d, 0x1a, 0x4d, 0x7d, 0x0d, 0x32, 0x06, 0xbd, 0xf4, 0xbe, 0x2d, 0x32, 0x73, 0x29, 0x23, 0x25, 0x70, 0xf7, 0x17, 0x8c, 0x75, 0xc4, 0x5d, 0x44,
+	/* (2^ 64)P */ 0x3c, 0x93, 0xc8, 0x7c, 0x17, 0x34, 0x04, 0xdb, 0x9f, 0x05, 0xea, 0x75, 0x21, 0xe8, 0x6f, 0xed, 0x34, 0xdb, 0x53, 0xc0, 0xfd, 0xbe, 0xfe, 0x1e, 0x99, 0xaf, 0x5d, 0xc6, 0x67, 0xe8, 0xdb, 0x4a,
+	/* (2^ 65)P */ 0xdf, 0x09, 0x06, 0xa9, 0xa2, 0x71, 0xcd, 0x3a, 0x50, 0x40, 0xd0, 0x6d, 0x85, 0x91, 0xe9, 0xe5, 0x3c, 0xc2, 0x57, 0x81, 0x68, 0x9b, 0xc6, 0x1e, 0x4d, 0xfe, 0x5c, 0x88, 0xf6, 0x27, 0x74, 0x69,
+	/* (2^ 66)P */ 0x51, 0xa8, 0xe1, 0x65, 0x9b, 0x7b, 0xbe, 0xd7, 0xdd, 0x36, 0xc5, 0x22, 0xd5, 0x28, 0x3d, 0xa0, 0x45, 0xb6, 0xd2, 0x8f, 0x65, 0x9d, 0x39, 0x28, 0xe1, 0x41, 0x26, 0x7c, 0xe1, 0xb7, 0xe5, 0x49,
+	/* (2^ 67)P */ 0xa4, 0x57, 0x04, 0x70, 0x98, 0x3a, 0x8c, 0x6f, 0x78, 0x67, 0xbb, 0x5e, 0xa2, 0xf0, 0x78, 0x50, 0x0f, 0x96, 0x82, 0xc3, 0xcb, 0x3c, 0x3c, 0xd1, 0xb1, 0x84, 0xdf, 0xa7, 0x58, 0x32, 0x00, 0x2e,
+	/* (2^ 68)P */ 0x1c, 0x6a, 0x29, 0xe6, 0x9b, 0xf3, 0xd1, 0x8a, 0xb2, 0xbf, 0x5f, 0x2a, 0x65, 0xaa, 0xee, 0xc1, 0xcb, 0xf3, 0x26, 0xfd, 0x73, 0x06, 0xee, 0x33, 0xcc, 0x2c, 0x9d, 0xa6, 0x73, 0x61, 0x25, 0x59,
+	/* (2^ 69)P */ 0x41, 0xfc, 0x18, 0x4e, 0xaa, 0x07, 0xea, 0x41, 0x1e, 0xa5, 0x87, 0x7c, 0x52, 0x19, 0xfc, 0xd9, 0x6f, 0xca, 0x31, 0x58, 0x80, 0xcb, 0xaa, 0xbd, 0x4f, 0x69, 0x16, 0xc9, 0x2d, 0x65, 0x5b, 0x44,
+	/* (2^ 70)P */ 0x15, 0x23, 0x17, 0xf2, 0xa7, 0xa3, 0x92, 0xce, 0x64, 0x99, 0x1b, 0xe1, 0x2d, 0x28, 0xdc, 0x1e, 0x4a, 0x31, 0x4c, 0xe0, 0xaf, 0x3a, 0x82, 0xa1, 0x86, 0xf5, 0x7c, 0x43, 0x94, 0x2d, 0x0a, 0x79,
+	/* (2^ 71)P */ 0x09, 0xe0, 0xf6, 0x93, 0xfb, 0x47, 0xc4, 0x71, 0x76, 0x52, 0x84, 0x22, 0x67, 0xa5, 0x22, 0x89, 0x69, 0x51, 0x4f, 0x20, 0x3b, 0x90, 0x70, 0xbf, 0xfe, 0x19, 0xa3, 0x1b, 0x89, 0x89, 0x7a, 0x2f,
+	/* (2^ 72)P */ 0x0c, 0x14, 0xe2, 0x77, 0xb5, 0x8e, 0xa0, 0x02, 0xf4, 0xdc, 0x7b, 0x42, 0xd4, 0x4e, 0x9a, 0xed, 0xd1, 0x3c, 0x32, 0xe4, 0x44, 0xec, 0x53, 0x52, 0x5b, 0x35, 0xe9, 0x14, 0x3c, 0x36, 0x88, 0x3e,
+	/* (2^ 73)P */ 0x8c, 0x0b, 0x11, 0x77, 0x42, 0xc1, 0x66, 0xaa, 0x90, 0x33, 0xa2, 0x10, 0x16, 0x39, 0xe0, 0x1a, 0xa2, 0xc2, 0x3f, 0xc9, 0x12, 0xbd, 0x30, 0x20, 0xab, 0xc7, 0x55, 0x95, 0x57, 0x41, 0xe1, 0x3e,
+	/* (2^ 74)P */ 0x41, 0x7d, 0x6e, 0x6d, 0x3a, 0xde, 0x14, 0x92, 0xfe, 0x7e, 0xf1, 0x07, 0x86, 0xd8, 0xcd, 0x3c, 0x17, 0x12, 0xe1, 0xf8, 0x88, 0x12, 0x4f, 0x67, 0xd0, 0x93, 0x9f, 0x32, 0x0f, 0x25, 0x82, 0x56,
+	/* (2^ 75)P */ 0x6e, 0x39, 0x2e, 0x6d, 0x13, 0x0b, 0xf0, 0x6c, 0xbf, 0xde, 0x14, 0x10, 0x6f, 0xf8, 0x4c, 0x6e, 0x83, 0x4e, 0xcc, 0xbf, 0xb5, 0xb1, 0x30, 0x59, 0xb6, 0x16, 0xba, 0x8a, 0xb4, 0x69, 0x70, 0x04,
+	/* (2^ 76)P */ 0x93, 0x07, 0xb2, 0x69, 0xab, 0xe4, 0x4c, 0x0d, 0x9e, 0xfb, 0xd0, 0x97, 0x1a, 0xb9, 0x4d, 0xb2, 0x1d, 0xd0, 0x00, 0x4e, 0xf5, 0x50, 0xfa, 0xcd, 0xb5, 0xdd, 0x8b, 0x36, 0x85, 0x10, 0x1b, 0x22,
+	/* (2^ 77)P */ 0xd2, 0xd8, 0xe3, 0xb1, 0x68, 0x94, 0xe5, 0xe7, 0x93, 0x2f, 0x12, 0xbd, 0x63, 0x65, 0xc5, 0x53, 0x09, 0x3f, 0x66, 0xe0, 0x03, 0xa9, 0xe8, 0xee, 0x42, 0x3d, 0xbe, 0xcb, 0x62, 0xa6, 0xef, 0x61,
+	/* (2^ 78)P */ 0x2a, 0xab, 0x6e, 0xde, 0xdd, 0xdd, 0xf8, 0x2c, 0x31, 0xf2, 0x35, 0x14, 0xd5, 0x0a, 0xf8, 0x9b, 0x73, 0x49, 0xf0, 0xc9, 0xce, 0xda, 0xea, 0x5d, 0x27, 0x9b, 0xd2, 0x41, 0x5d, 0x5b, 0x27, 0x29,
+	/* (2^ 79)P */ 0x4f, 0xf1, 0xeb, 0x95, 0x08, 0x0f, 0xde, 0xcf, 0xa7, 0x05, 0x49, 0x05, 0x6b, 0xb9, 0xaa, 0xb9, 0xfd, 0x20, 0xc4, 0xa1, 0xd9, 0x0d, 0xe8, 0xca, 0xc7, 0xbb, 0x73, 0x16, 0x2f, 0xbf, 0x63, 0x0a,
+	/* (2^ 80)P */ 0x8c, 0xbc, 0x8f, 0x95, 0x11, 0x6e, 0x2f, 0x09, 0xad, 0x2f, 0x82, 0x04, 0xe8, 0x81, 0x2a, 0x67, 0x17, 0x25, 0xd5, 0x60, 0x15, 0x35, 0xc8, 0xca, 0xf8, 0x92, 0xf1, 0xc8, 0x22, 0x77, 0x3f, 0x6f,
+	/* (2^ 81)P */ 0xb7, 0x94, 0xe8, 0xc2, 0xcc, 0x90, 0xba, 0xf8, 0x0d, 0x9f, 0xff, 0x38, 0xa4, 0x57, 0x75, 0x2c, 0x59, 0x23, 0xe5, 0x5a, 0x85, 0x1d, 0x4d, 0x89, 0x69, 0x3d, 0x74, 0x7b, 0x15, 0x22, 0xe1, 0x68,
+	/* (2^ 82)P */ 0xf3, 0x19, 0xb9, 0xcf, 0x70, 0x55, 0x7e, 0xd8, 0xb9, 0x8d, 0x79, 0x95, 0xcd, 0xde, 0x2c, 0x3f, 0xce, 0xa2, 0xc0, 0x10, 0x47, 0x15, 0x21, 0x21, 0xb2, 0xc5, 0x6d, 0x24, 0x15, 0xa1, 0x66, 0x3c,
+	/* (2^ 83)P */ 0x72, 0xcb, 0x4e, 0x29, 0x62, 0xc5, 0xed, 0xcb, 0x16, 0x0b, 0x28, 0x6a, 0xc3, 0x43, 0x71, 0xba, 0x67, 0x8b, 0x07, 0xd4, 0xef, 0xc2, 0x10, 0x96, 0x1e, 0x4b, 0x6a, 0x94, 0x5d, 0x73, 0x44, 0x61,
+	/* (2^ 84)P */ 0x50, 0x33, 0x5b, 0xd7, 0x1e, 0x11, 0x6f, 0x53, 0x1b, 0xd8, 0x41, 0x20, 0x8c, 0xdb, 0x11, 0x02, 0x3c, 0x41, 0x10, 0x0e, 0x00, 0xb1, 0x3c, 0xf9, 0x76, 0x88, 0x9e, 0x03, 0x3c, 0xfd, 0x9d, 0x14,
+	/* (2^ 85)P */ 0x5b, 0x15, 0x63, 0x6b, 0xe4, 0xdd, 0x79, 0xd4, 0x76, 0x79, 0x83, 0x3c, 0xe9, 0x15, 0x6e, 0xb6, 0x38, 0xe0, 0x13, 0x1f, 0x3b, 0xe4, 0xfd, 0xda, 0x35, 0x0b, 0x4b, 0x2e, 0x1a, 0xda, 0xaf, 0x5f,
+	/* (2^ 86)P */ 0x81, 0x75, 0x19, 0x17, 0xdf, 0xbb, 0x00, 0x36, 0xc2, 0xd2, 0x3c, 0xbe, 0x0b, 0x05, 0x72, 0x39, 0x86, 0xbe, 0xd5, 0xbd, 0x6d, 0x90, 0x38, 0x59, 0x0f, 0x86, 0x9b, 0x3f, 0xe4, 0xe5, 0xfc, 0x34,
+	/* (2^ 87)P */ 0x02, 0x4d, 0xd1, 0x42, 0xcd, 0xa4, 0xa8, 0x75, 0x65, 0xdf, 0x41, 0x34, 0xc5, 0xab, 0x8d, 0x82, 0xd3, 0x31, 0xe1, 0xd2, 0xed, 0xab, 0xdc, 0x33, 0x5f, 0xd2, 0x14, 0xb8, 0x6f, 0xd7, 0xba, 0x3e,
+	/* (2^ 88)P */ 0x0f, 0xe1, 0x70, 0x6f, 0x56, 0x6f, 0x90, 0xd4, 0x5a, 0x0f, 0x69, 0x51, 0xaa, 0xf7, 0x12, 0x5d, 0xf2, 0xfc, 0xce, 0x76, 0x6e, 0xb1, 0xad, 0x45, 0x99, 0x29, 0x23, 0xad, 0xae, 0x68, 0xf7, 0x01,
+	/* (2^ 89)P */ 0xbd, 0xfe, 0x48, 0x62, 0x7b, 0xc7, 0x6c, 0x2b, 0xfd, 0xaf, 0x3a, 0xec, 0x28, 0x06, 0xd3, 0x3c, 0x6a, 0x48, 0xef, 0xd4, 0x80, 0x0b, 0x1c, 0xce, 0x23, 0x6c, 0xf6, 0xa6, 0x2e, 0xff, 0x3b, 0x4c,
+	/* (2^ 90)P */ 0x5f, 0xeb, 0xea, 0x4a, 0x09, 0xc4, 0x2e, 0x3f, 0xa7, 0x2c, 0x37, 0x6e, 0x28, 0x9b, 0xb1, 0x61, 0x1d, 0x70, 0x2a, 0xde, 0x66, 0xa9, 0xef, 0x5e, 0xef, 0xe3, 0x55, 0xde, 0x65, 0x05, 0xb2, 0x23,
+	/* (2^ 91)P */ 0x57, 0x85, 0xd5, 0x79, 0x52, 0xca, 0x01, 0xe3, 0x4f, 0x87, 0xc2, 0x27, 0xce, 0xd4, 0xb2, 0x07, 0x67, 0x1d, 0xcf, 0x9d, 0x8a, 0xcd, 0x32, 0xa5, 0x56, 0xff, 0x2b, 0x3f, 0xe2, 0xfe, 0x52, 0x2a,
+	/* (2^ 92)P */ 0x3d, 0x66, 0xd8, 0x7c, 0xb3, 0xef, 0x24, 0x86, 0x94, 0x75, 0xbd, 0xff, 0x20, 0xac, 0xc7, 0xbb, 0x45, 0x74, 0xd3, 0x82, 0x9c, 0x5e, 0xb8, 0x57, 0x66, 0xec, 0xa6, 0x86, 0xcb, 0x52, 0x30, 0x7b,
+	/* (2^ 93)P */ 0x1e, 0xe9, 0x25, 0x25, 0xad, 0xf0, 0x82, 0x34, 0xa0, 0xdc, 0x8e, 0xd2, 0x43, 0x80, 0xb6, 0x2c, 0x3a, 0x00, 0x1b, 0x2e, 0x05, 0x6d, 0x4f, 0xaf, 0x0a, 0x1b, 0x78, 0x29, 0x25, 0x8c, 0x5f, 0x18,
+	/* (2^ 94)P */ 0xd6, 0xe0, 0x0c, 0xd8, 0x5b, 0xde, 0x41, 0xaa, 0xd6, 0xe9, 0x53, 0x68, 0x41, 0xb2, 0x07, 0x94, 0x3a, 0x4c, 0x7f, 0x35, 0x6e, 0xc3, 0x3e, 0x56, 0xce, 0x7b, 0x29, 0x0e, 0xdd, 0xb8, 0xc4, 0x4c,
+	/* (2^ 95)P */ 0x0e, 0x73, 0xb8, 0xff, 0x52, 0x1a, 0xfc, 0xa2, 0x37, 0x8e, 0x05, 0x67, 0x6e, 0xf1, 0x11, 0x18, 0xe1, 0x4e, 0xdf, 0xcd, 0x66, 0xa3, 0xf9, 0x10, 0x99, 0xf0, 0xb9, 0xa0, 0xc4, 0xa0, 0xf4, 0x72,
+	/* (2^ 96)P */ 0xa7, 0x4e, 0x3f, 0x66, 0x6f, 0xc0, 0x16, 0x8c, 0xba, 0x0f, 0x97, 0x4e, 0xf7, 0x3a, 0x3b, 0x69, 0x45, 0xc3, 0x9e, 0xd6, 0xf1, 0xe7, 0x02, 0x21, 0x89, 0x80, 0x8a, 0x96, 0xbc, 0x3c, 0xa5, 0x0b,
+	/* (2^ 97)P */ 0x37, 0x55, 0xa1, 0xfe, 0xc7, 0x9d, 0x3d, 0xca, 0x93, 0x64, 0x53, 0x51, 0xbb, 0x24, 0x68, 0x4c, 0xb1, 0x06, 0x40, 0x84, 0x14, 0x63, 0x88, 0xb9, 0x60, 0xcc, 0x54, 0xb4, 0x2a, 0xa7, 0xd2, 0x40,
+	/* (2^ 98)P */ 0x75, 0x09, 0x57, 0x12, 0xb7, 0xa1, 0x36, 0x59, 0x57, 0xa6, 0xbd, 0xde, 0x48, 0xd6, 0xb9, 0x91, 0xea, 0x30, 0x43, 0xb6, 0x4b, 0x09, 0x44, 0x33, 0xd0, 0x51, 0xee, 0x12, 0x0d, 0xa1, 0x6b, 0x00,
+	/* (2^ 99)P */ 0x58, 0x5d, 0xde, 0xf5, 0x68, 0x84, 0x22, 0x19, 0xb0, 0x05, 0xcc, 0x38, 0x4c, 0x2f, 0xb1, 0x0e, 0x90, 0x19, 0x60, 0xd5, 0x9d, 0x9f, 0x03, 0xa1, 0x0b, 0x0e, 0xff, 0x4f, 0xce, 0xd4, 0x02, 0x45,
+	/* (2^100)P */ 0x89, 0xc1, 0x37, 0x68, 0x10, 0x54, 0x20, 0xeb, 0x3c, 0xb9, 0xd3, 0x6d, 0x4c, 0x54, 0xf6, 0xd0, 0x4f, 0xd7, 0x16, 0xc4, 0x64, 0x70, 0x72, 0x40, 0xf0, 0x2e, 0x50, 0x4b, 0x11, 0xc6, 0x15, 0x6e,
+	/* (2^101)P */ 0x6b, 0xa7, 0xb1, 0xcf, 0x98, 0xa3, 0xf2, 0x4d, 0xb1, 0xf6, 0xf2, 0x19, 0x74, 0x6c, 0x25, 0x11, 0x43, 0x60, 0x6e, 0x06, 0x62, 0x79, 0x49, 0x4a, 0x44, 0x5b, 0x35, 0x41, 0xab, 0x3a, 0x5b, 0x70,
+	/* (2^102)P */ 0xd8, 0xb1, 0x97, 0xd7, 0x36, 0xf5, 0x5e, 0x36, 0xdb, 0xf0, 0xdd, 0x22, 0xd6, 0x6b, 0x07, 0x00, 0x88, 0x5a, 0x57, 0xe0, 0xb0, 0x33, 0xbf, 0x3b, 0x4d, 0xca, 0xe4, 0xc8, 0x05, 0xaa, 0x77, 0x37,
+	/* (2^103)P */ 0x5f, 0xdb, 0x78, 0x55, 0xc8, 0x45, 0x27, 0x39, 0xe2, 0x5a, 0xae, 0xdb, 0x49, 0x41, 0xda, 0x6f, 0x67, 0x98, 0xdc, 0x8a, 0x0b, 0xb0, 0xf0, 0xb1, 0xa3, 0x1d, 0x6f, 0xd3, 0x37, 0x34, 0x96, 0x09,
+	/* (2^104)P */ 0x53, 0x38, 0xdc, 0xa5, 0x90, 0x4e, 0x82, 0x7e, 0xbd, 0x5c, 0x13, 0x1f, 0x64, 0xf6, 0xb5, 0xcc, 0xcc, 0x8f, 0xce, 0x87, 0x6c, 0xd8, 0x36, 0x67, 0x9f, 0x24, 0x04, 0x66, 0xe2, 0x3c, 0x5f, 0x62,
+	/* (2^105)P */ 0x3f, 0xf6, 0x02, 0x95, 0x05, 0xc8, 0x8a, 0xaf, 0x69, 0x14, 0x35, 0x2e, 0x0a, 0xe7, 0x05, 0x0c, 0x05, 0x63, 0x4b, 0x76, 0x9c, 0x2e, 0x29, 0x35, 0xc3, 0x3a, 0xe2, 0xc7, 0x60, 0x43, 0x39, 0x1a,
+	/* (2^106)P */ 0x64, 0x32, 0x18, 0x51, 0x32, 0xd5, 0xc6, 0xd5, 0x4f, 0xb7, 0xc2, 0x43, 0xbd, 0x5a, 0x06, 0x62, 0x9b, 0x3f, 0x97, 0x3b, 0xd0, 0xf5, 0xfb, 0xb5, 0x5e, 0x6e, 0x20, 0x61, 0x36, 0xda, 0xa3, 0x13,
+	/* (2^107)P */ 0xe5, 0x94, 0x5d, 0x72, 0x37, 0x58, 0xbd, 0xc6, 0xc5, 0x16, 0x50, 0x20, 0x12, 0x09, 0xe3, 0x18, 0x68, 0x3c, 0x03, 0x70, 0x15, 0xce, 0x88, 0x20, 0x87, 0x79, 0x83, 0x5c, 0x49, 0x1f, 0xba, 0x7f,
+	/* (2^108)P */ 0x9d, 0x07, 0xf9, 0xf2, 0x23, 0x74, 0x8c, 0x5a, 0xc5, 0x3f, 0x02, 0x34, 0x7b, 0x15, 0x35, 0x17, 0x51, 0xb3, 0xfa, 0xd2, 0x9a, 0xb4, 0xf9, 0xe4, 0x3c, 0xe3, 0x78, 0xc8, 0x72, 0xff, 0x91, 0x66,
+	/* (2^109)P */ 0x3e, 0xff, 0x5e, 0xdc, 0xde, 0x2a, 0x2c, 0x12, 0xf4, 0x6c, 0x95, 0xd8, 0xf1, 0x4b, 0xdd, 0xf8, 0xda, 0x5b, 0x9e, 0x9e, 0x5d, 0x20, 0x86, 0xeb, 0x43, 0xc7, 0x75, 0xd9, 0xb9, 0x92, 0x9b, 0x04,
+	/* (2^110)P */ 0x5a, 0xc0, 0xf6, 0xb0, 0x30, 0x97, 0x37, 0xa5, 0x53, 0xa5, 0xf3, 0xc6, 0xac, 0xff, 0xa0, 0x72, 0x6d, 0xcd, 0x0d, 0xb2, 0x34, 0x2c, 0x03, 0xb0, 0x4a, 0x16, 0xd5, 0x88, 0xbc, 0x9d, 0x0e, 0x47,
+	/* (2^111)P */ 0x47, 0xc0, 0x37, 0xa2, 0x0c, 0xf1, 0x9c, 0xb1, 0xa2, 0x81, 0x6c, 0x1f, 0x71, 0x66, 0x54, 0xb6, 0x43, 0x0b, 0xd8, 0x6d, 0xd1, 0x1b, 0x32, 0xb3, 0x8e, 0xbe, 0x5f, 0x0c, 0x60, 0x4f, 0xc1, 0x48,
+	/* (2^112)P */ 0x03, 0xc8, 0xa6, 0x4a, 0x26, 0x1c, 0x45, 0x66, 0xa6, 0x7d, 0xfa, 0xa4, 0x04, 0x39, 0x6e, 0xb6, 0x95, 0x83, 0x12, 0xb3, 0xb0, 0x19, 0x5f, 0xd4, 0x10, 0xbc, 0xc9, 0xc3, 0x27, 0x26, 0x60, 0x31,
+	/* (2^113)P */ 0x0d, 0xe1, 0xe4, 0x32, 0x48, 0xdc, 0x20, 0x31, 0xf7, 0x17, 0xc7, 0x56, 0x67, 0xc4, 0x20, 0xeb, 0x94, 0x02, 0x28, 0x67, 0x3f, 0x2e, 0xf5, 0x00, 0x09, 0xc5, 0x30, 0x47, 0xc1, 0x4f, 0x6d, 0x56,
+	/* (2^114)P */ 0x06, 0x72, 0x83, 0xfd, 0x40, 0x5d, 0x3a, 0x7e, 0x7a, 0x54, 0x59, 0x71, 0xdc, 0x26, 0xe9, 0xc1, 0x95, 0x60, 0x8d, 0xa6, 0xfb, 0x30, 0x67, 0x21, 0xa7, 0xce, 0x69, 0x3f, 0x84, 0xc3, 0xe8, 0x22,
+	/* (2^115)P */ 0x2b, 0x4b, 0x0e, 0x93, 0xe8, 0x74, 0xd0, 0x33, 0x16, 0x58, 0xd1, 0x84, 0x0e, 0x35, 0xe4, 0xb6, 0x65, 0x23, 0xba, 0xd6, 0x6a, 0xc2, 0x34, 0x55, 0xf3, 0xf3, 0xf1, 0x89, 0x2f, 0xc1, 0x73, 0x77,
+	/* (2^116)P */ 0xaa, 0x62, 0x79, 0xa5, 0x4d, 0x40, 0xba, 0x8c, 0x56, 0xce, 0x99, 0x19, 0xa8, 0x97, 0x98, 0x5b, 0xfc, 0x92, 0x16, 0x12, 0x2f, 0x86, 0x8e, 0x50, 0x91, 0xc2, 0x93, 0xa0, 0x7f, 0x90, 0x81, 0x3a,
+	/* (2^117)P */ 0x10, 0xa5, 0x25, 0x47, 0xff, 0xd0, 0xde, 0x0d, 0x03, 0xc5, 0x3f, 0x67, 0x10, 0xcc, 0xd8, 0x10, 0x89, 0x4e, 0x1f, 0x9f, 0x1c, 0x15, 0x9d, 0x5b, 0x4c, 0xa4, 0x09, 0xcb, 0xd5, 0xc1, 0xa5, 0x32,
+	/* (2^118)P */ 0xfb, 0x41, 0x05, 0xb9, 0x42, 0xa4, 0x0a, 0x1e, 0xdb, 0x85, 0xb4, 0xc1, 0x7c, 0xeb, 0x85, 0x5f, 0xe5, 0xf2, 0x9d, 0x8a, 0xce, 0x95, 0xe5, 0xbe, 0x36, 0x22, 0x42, 0x22, 0xc7, 0x96, 0xe4, 0x25,
+	/* (2^119)P */ 0xb9, 0xe5, 0x0f, 0xcd, 0x46, 0x3c, 0xdf, 0x5e, 0x88, 0x33, 0xa4, 0xd2, 0x7e, 0x5a, 0xe7, 0x34, 0x52, 0xe3, 0x61, 0xd7, 0x11, 0xde, 0x88, 0xe4, 0x5c, 0x54, 0x85, 0xa0, 0x01, 0x8a, 0x87, 0x0e,
+	/* (2^120)P */ 0x04, 0xbb, 0x21, 0xe0, 0x77, 0x3c, 0x49, 0xba, 0x9a, 0x89, 0xdf, 0xc7, 0x43, 0x18, 0x4d, 0x2b, 0x67, 0x0d, 0xe8, 0x7a, 0x48, 0x7a, 0xa3, 0x9e, 0x94, 0x17, 0xe4, 0x11, 0x80, 0x95, 0xa9, 0x67,
+	/* (2^121)P */ 0x65, 0xb0, 0x97, 0x66, 0x1a, 0x05, 0x58, 0x4b, 0xd4, 0xa6, 0x6b, 0x8d, 0x7d, 0x3f, 0xe3, 0x47, 0xc1, 0x46, 0xca, 0x83, 0xd4, 0xa8, 0x4d, 0xbb, 0x0d, 0xdb, 0xc2, 0x81, 0xa1, 0xca, 0xbe, 0x68,
+	/* (2^122)P */ 0xa5, 0x9a, 0x98, 0x0b, 0xe9, 0x80, 0x89, 0x8d, 0x9b, 0xc9, 0x93, 0x2c, 0x4a, 0xb1, 0x5e, 0xf9, 0xa2, 0x73, 0x6e, 0x79, 0xc4, 0xc7, 0xc6, 0x51, 0x69, 0xb5, 0xef, 0xb5, 0x63, 0x83, 0x22, 0x6e,
+	/* (2^123)P */ 0xc8, 0x24, 0xd6, 0x2d, 0xb0, 0xc0, 0xbb, 0xc6, 0xee, 0x70, 0x81, 0xec, 0x7d, 0xb4, 0x7e, 0x77, 0xa9, 0xaf, 0xcf, 0x04, 0xa0, 0x15, 0xde, 0x3c, 0x9b, 0xbf, 0x60, 0x71, 0x08, 0xbc, 0xc6, 0x1d,
+	/* (2^124)P */ 0x02, 0x40, 0xc3, 0xee, 0x43, 0xe0, 0x07, 0x2e, 0x7f, 0xdc, 0x68, 0x7a, 0x67, 0xfc, 0xe9, 0x18, 0x9a, 0x5b, 0xd1, 0x8b, 0x18, 0x03, 0xda, 0xd8, 0x53, 0x82, 0x56, 0x00, 0xbb, 0xc3, 0xfb, 0x48,
+	/* (2^125)P */ 0xe1, 0x4c, 0x65, 0xfb, 0x4c, 0x7d, 0x54, 0x57, 0xad, 0xe2, 0x58, 0xa0, 0x82, 0x5b, 0x56, 0xd3, 0x78, 0x44, 0x15, 0xbf, 0x0b, 0xaf, 0x3e, 0xf6, 0x18, 0xbb, 0xdf, 0x14, 0xf1, 0x1e, 0x53, 0x47,
+	/* (2^126)P */ 0x87, 0xc5, 0x78, 0x42, 0x0a, 0x63, 0xec, 0xe1, 0xf3, 0x83, 0x8e, 0xca, 0x46, 0xd5, 0x07, 0x55, 0x2b, 0x0c, 0xdc, 0x3a, 0xc6, 0x35, 0xe1, 0x85, 0x4e, 0x84, 0x82, 0x56, 0xa8, 0xef, 0xa7, 0x0a,
+	/* (2^127)P */ 0x15, 0xf6, 0xe1, 0xb3, 0xa8, 0x1b, 0x69, 0x72, 0xfa, 0x3f, 0xbe, 0x1f, 0x70, 0xe9, 0xb4, 0x32, 0x68, 0x78, 0xbb, 0x39, 0x2e, 0xd9, 0xb6, 0x97, 0xe8, 0x39, 0x2e, 0xa0, 0xde, 0x53, 0xfe, 0x2c,
+	/* (2^128)P */ 0xb0, 0x52, 0xcd, 0x85, 0xcd, 0x92, 0x73, 0x68, 0x31, 0x98, 0xe2, 0x10, 0xc9, 0x66, 0xff, 0x27, 0x06, 0x2d, 0x83, 0xa9, 0x56, 0x45, 0x13, 0x97, 0xa0, 0xf8, 0x84, 0x0a, 0x36, 0xb0, 0x9b, 0x26,
+	/* (2^129)P */ 0x5c, 0xf8, 0x43, 0x76, 0x45, 0x55, 0x6e, 0x70, 0x1b, 0x7d, 0x59, 0x9b, 0x8c, 0xa4, 0x34, 0x37, 0x72, 0xa4, 0xef, 0xc6, 0xe8, 0x91, 0xee, 0x7a, 0xe0, 0xd9, 0xa9, 0x98, 0xc1, 0xab, 0xd6, 0x5c,
+	/* (2^130)P */ 0x1a, 0xe4, 0x3c, 0xcb, 0x06, 0xde, 0x04, 0x0e, 0x38, 0xe1, 0x02, 0x34, 0x89, 0xeb, 0xc6, 0xd8, 0x72, 0x37, 0x6e, 0x68, 0xbb, 0x59, 0x46, 0x90, 0xc8, 0xa8, 0x6b, 0x74, 0x71, 0xc3, 0x15, 0x72,
+	/* (2^131)P */ 0xd9, 0xa2, 0xe4, 0xea, 0x7e, 0xa9, 0x12, 0xfd, 0xc5, 0xf2, 0x94, 0x63, 0x51, 0xb7, 0x14, 0x95, 0x94, 0xf2, 0x08, 0x92, 0x80, 0xd5, 0x6f, 0x26, 0xb9, 0x26, 0x9a, 0x61, 0x85, 0x70, 0x84, 0x5c,
+	/* (2^132)P */ 0xea, 0x94, 0xd6, 0xfe, 0x10, 0x54, 0x98, 0x52, 0x54, 0xd2, 0x2e, 0x4a, 0x93, 0x5b, 0x90, 0x3c, 0x67, 0xe4, 0x3b, 0x2d, 0x69, 0x47, 0xbb, 0x10, 0xe1, 0xe9, 0xe5, 0x69, 0x2d, 0x3d, 0x3b, 0x06,
+	/* (2^133)P */ 0xeb, 0x7d, 0xa5, 0xdd, 0xee, 0x26, 0x27, 0x47, 0x91, 0x18, 0xf4, 0x10, 0xae, 0xc4, 0xb6, 0xef, 0x14, 0x76, 0x30, 0x7b, 0x91, 0x41, 0x16, 0x2b, 0x7c, 0x5b, 0xf4, 0xc4, 0x4f, 0x55, 0x7c, 0x11,
+	/* (2^134)P */ 0x12, 0x88, 0x9d, 0x8f, 0x11, 0xf3, 0x7c, 0xc0, 0x39, 0x79, 0x01, 0x50, 0x20, 0xd8, 0xdb, 0x01, 0x27, 0x28, 0x1b, 0x17, 0xf4, 0x03, 0xe8, 0xd7, 0xea, 0x25, 0xd2, 0x87, 0x74, 0xe8, 0x15, 0x10,
+	/* (2^135)P */ 0x4d, 0xcc, 0x3a, 0xd2, 0xfe, 0xe3, 0x8d, 0xc5, 0x2d, 0xbe, 0xa7, 0x94, 0xc2, 0x91, 0xdb, 0x50, 0x57, 0xf4, 0x9c, 0x1c, 0x3d, 0xd4, 0x94, 0x0b, 0x4a, 0x52, 0x37, 0x6e, 0xfa, 0x40, 0x16, 0x6b,
+	/* (2^136)P */ 0x09, 0x0d, 0xda, 0x5f, 0x6c, 0x34, 0x2f, 0x69, 0x51, 0x31, 0x4d, 0xfa, 0x59, 0x1c, 0x0b, 0x20, 0x96, 0xa2, 0x77, 0x07, 0x76, 0x6f, 0xc4, 0xb8, 0xcf, 0xfb, 0xfd, 0x3f, 0x5f, 0x39, 0x38, 0x4b,
+	/* (2^137)P */ 0x71, 0xd6, 0x54, 0xbe, 0x00, 0x5e, 0xd2, 0x18, 0xa6, 0xab, 0xc8, 0xbe, 0x82, 0x05, 0xd5, 0x60, 0x82, 0xb9, 0x78, 0x3b, 0x26, 0x8f, 0xad, 0x87, 0x32, 0x04, 0xda, 0x9c, 0x4e, 0xf6, 0xfd, 0x50,
+	/* (2^138)P */ 0xf0, 0xdc, 0x78, 0xc5, 0xaa, 0x67, 0xf5, 0x90, 0x3b, 0x13, 0xa3, 0xf2, 0x0e, 0x9b, 0x1e, 0xef, 0x71, 0xde, 0xd9, 0x42, 0x92, 0xba, 0xeb, 0x0e, 0xc7, 0x01, 0x31, 0xf0, 0x9b, 0x3c, 0x47, 0x15,
+	/* (2^139)P */ 0x95, 0x80, 0xb7, 0x56, 0xae, 0xe8, 0x77, 0x7c, 0x8e, 0x07, 0x6f, 0x6e, 0x66, 0xe7, 0x78, 0xb6, 0x1f, 0xba, 0x48, 0x53, 0x61, 0xb9, 0xa0, 0x2d, 0x0b, 0x3f, 0x73, 0xff, 0xc1, 0x31, 0xf9, 0x7c,
+	/* (2^140)P */ 0x6c, 0x36, 0x0a, 0x0a, 0xf5, 0x57, 0xb3, 0x26, 0x32, 0xd7, 0x87, 0x2b, 0xf4, 0x8c, 0x70, 0xe9, 0xc0, 0xb2, 0x1c, 0xf9, 0xa5, 0xee, 0x3a, 0xc1, 0x4c, 0xbb, 0x43, 0x11, 0x99, 0x0c, 0xd9, 0x35,
+	/* (2^141)P */ 0xdc, 0xd9, 0xa0, 0xa9, 0x04, 0xc4, 0xc1, 0x47, 0x51, 0xd2, 0x72, 0x19, 0x45, 0x58, 0x9e, 0x65, 0x31, 0x8c, 0xb3, 0x73, 0xc4, 0xa8, 0x75, 0x38, 0x24, 0x1f, 0x56, 0x79, 0xd3, 0x9e, 0xbd, 0x1f,
+	/* (2^142)P */ 0x8d, 0xc2, 0x1e, 0xd4, 0x6f, 0xbc, 0xfa, 0x11, 0xca, 0x2d, 0x2a, 0xcd, 0xe3, 0xdf, 0xf8, 0x7e, 0x95, 0x45, 0x40, 0x8c, 0x5d, 0x3b, 0xe7, 0x72, 0x27, 0x2f, 0xb7, 0x54, 0x49, 0xfa, 0x35, 0x61,
+	/* (2^143)P */ 0x9c, 0xb6, 0x24, 0xde, 0xa2, 0x32, 0xfc, 0xcc, 0x88, 0x5d, 0x09, 0x1f, 0x8c, 0x69, 0x55, 0x3f, 0x29, 0xf9, 0xc3, 0x5a, 0xed, 0x50, 0x33, 0xbe, 0xeb, 0x7e, 0x47, 0xca, 0x06, 0xf8, 0x9b, 0x5e,
+	/* (2^144)P */ 0x68, 0x9f, 0x30, 0x3c, 0xb6, 0x8f, 0xce, 0xe9, 0xf4, 0xf9, 0xe1, 0x65, 0x35, 0xf6, 0x76, 0x53, 0xf1, 0x93, 0x63, 0x5a, 0xb3, 0xcf, 0xaf, 0xd1, 0x06, 0x35, 0x62, 0xe5, 0xed, 0xa1, 0x32, 0x66,
+	/* (2^145)P */ 0x4c, 0xed, 0x2d, 0x0c, 0x39, 0x6c, 0x7d, 0x0b, 0x1f, 0xcb, 0x04, 0xdf, 0x81, 0x32, 0xcb, 0x56, 0xc7, 0xc3, 0xec, 0x49, 0x12, 0x5a, 0x30, 0x66, 0x2a, 0xa7, 0x8c, 0xa3, 0x60, 0x8b, 0x58, 0x5d,
+	/* (2^146)P */ 0x2d, 0xf4, 0xe5, 0xe8, 0x78, 0xbf, 0xec, 0xa6, 0xec, 0x3e, 0x8a, 0x3c, 0x4b, 0xb4, 0xee, 0x86, 0x04, 0x16, 0xd2, 0xfb, 0x48, 0x9c, 0x21, 0xec, 0x31, 0x67, 0xc3, 0x17, 0xf5, 0x1a, 0xaf, 0x1a,
+	/* (2^147)P */ 0xe7, 0xbd, 0x69, 0x67, 0x83, 0xa2, 0x06, 0xc3, 0xdb, 0x2a, 0x1e, 0x2b, 0x62, 0x80, 0x82, 0x20, 0xa6, 0x94, 0xff, 0xfb, 0x1f, 0xf5, 0x27, 0x80, 0x6b, 0xf2, 0x24, 0x11, 0xce, 0xa1, 0xcf, 0x76,
+	/* (2^148)P */ 0xb6, 0xab, 0x22, 0x24, 0x56, 0x00, 0xeb, 0x18, 0xc3, 0x29, 0x8c, 0x8f, 0xd5, 0xc4, 0x77, 0xf3, 0x1a, 0x56, 0x31, 0xf5, 0x07, 0xc2, 0xbb, 0x4d, 0x27, 0x8a, 0x12, 0x82, 0xf0, 0xb7, 0x53, 0x02,
+	/* (2^149)P */ 0xe0, 0x17, 0x2c, 0xb6, 0x1c, 0x09, 0x1f, 0x3d, 0xa9, 0x28, 0x46, 0xd6, 0xab, 0xe1, 0x60, 0x48, 0x53, 0x42, 0x9d, 0x30, 0x36, 0x74, 0xd1, 0x52, 0x76, 0xe5, 0xfa, 0x3e, 0xe1, 0x97, 0x6f, 0x35,
+	/* (2^150)P */ 0x5b, 0x53, 0x50, 0xa1, 0x1a, 0xe1, 0x51, 0xd3, 0xcc, 0x78, 0xd8, 0x1d, 0xbb, 0x45, 0x6b, 0x3e, 0x98, 0x2c, 0xd9, 0xbe, 0x28, 0x61, 0x77, 0x0c, 0xb8, 0x85, 0x28, 0x03, 0x93, 0xae, 0x34, 0x1d,
+	/* (2^151)P */ 0xc3, 0xa4, 0x5b, 0xa8, 0x8c, 0x48, 0xa0, 0x4b, 0xce, 0xe6, 0x9c, 0x3c, 0xc3, 0x48, 0x53, 0x98, 0x70, 0xa7, 0xbd, 0x97, 0x6f, 0x4c, 0x12, 0x66, 0x4a, 0x12, 0x54, 0x06, 0x29, 0xa0, 0x81, 0x0f,
+	/* (2^152)P */ 0xfd, 0x86, 0x9b, 0x56, 0xa6, 0x9c, 0xd0, 0x9e, 0x2d, 0x9a, 0xaf, 0x18, 0xfd, 0x09, 0x10, 0x81, 0x0a, 0xc2, 0xd8, 0x93, 0x3f, 0xd0, 0x08, 0xff, 0x6b, 0xf2, 0xae, 0x9f, 0x19, 0x48, 0xa1, 0x52,
+	/* (2^153)P */ 0x73, 0x1b, 0x8d, 0x2d, 0xdc, 0xf9, 0x03, 0x3e, 0x70, 0x1a, 0x96, 0x73, 0x18, 0x80, 0x05, 0x42, 0x70, 0x59, 0xa3, 0x41, 0xf0, 0x87, 0xd9, 0xc0, 0x49, 0xd5, 0xc0, 0xa1, 0x15, 0x1f, 0xaa, 0x07,
+	/* (2^154)P */ 0x24, 0x72, 0xd2, 0x8c, 0xe0, 0x6c, 0xd4, 0xdf, 0x39, 0x42, 0x4e, 0x93, 0x4f, 0x02, 0x0a, 0x6d, 0x59, 0x7b, 0x89, 0x99, 0x63, 0x7a, 0x8a, 0x80, 0xa2, 0x95, 0x3d, 0xe1, 0xe9, 0x56, 0x45, 0x0a,
+	/* (2^155)P */ 0x45, 0x30, 0xc1, 0xe9, 0x1f, 0x99, 0x1a, 0xd2, 0xb8, 0x51, 0x77, 0xfe, 0x48, 0x85, 0x0e, 0x9b, 0x35, 0x00, 0xf3, 0x4b, 0xcb, 0x43, 0xa6, 0x5d, 0x21, 0xf7, 0x40, 0x39, 0xd6, 0x28, 0xdb, 0x77,
+	/* (2^156)P */ 0x11, 0x90, 0xdc, 0x4a, 0x61, 0xeb, 0x5e, 0xfc, 0xeb, 0x11, 0xc4, 0xe8, 0x9a, 0x41, 0x29, 0x52, 0x74, 0xcf, 0x1d, 0x7d, 0x78, 0xe7, 0xc3, 0x9e, 0xb5, 0x4c, 0x6e, 0x21, 0x3e, 0x05, 0x0d, 0x34,
+	/* (2^157)P */ 0xb4, 0xf2, 0x8d, 0xb4, 0x39, 0xaf, 0xc7, 0xca, 0x94, 0x0a, 0xa1, 0x71, 0x28, 0xec, 0xfa, 0xc0, 0xed, 0x75, 0xa5, 0x5c, 0x24, 0x69, 0x0a, 0x14, 0x4c, 0x3a, 0x27, 0x34, 0x71, 0xc3, 0xf1, 0x0c,
+	/* (2^158)P */ 0xa5, 0xb8, 0x24, 0xc2, 0x6a, 0x30, 0xee, 0xc8, 0xb0, 0x30, 0x49, 0xcb, 0x7c, 0xee, 0xea, 0x57, 0x4f, 0xe7, 0xcb, 0xaa, 0xbd, 0x06, 0xe8, 0xa1, 0x7d, 0x65, 0xeb, 0x2e, 0x74, 0x62, 0x9a, 0x7d,
+	/* (2^159)P */ 0x30, 0x48, 0x6c, 0x54, 0xef, 0xb6, 0xb6, 0x9e, 0x2e, 0x6e, 0xb3, 0xdd, 0x1f, 0xca, 0x5c, 0x88, 0x05, 0x71, 0x0d, 0xef, 0x83, 0xf3, 0xb9, 0xe6, 0x12, 0x04, 0x2e, 0x9d, 0xef, 0x4f, 0x65, 0x58,
+	/* (2^160)P */ 0x26, 0x8e, 0x0e, 0xbe, 0xff, 0xc4, 0x05, 0xa9, 0x6e, 0x81, 0x31, 0x9b, 0xdf, 0xe5, 0x2d, 0x94, 0xe1, 0x88, 0x2e, 0x80, 0x3f, 0x72, 0x7d, 0x49, 0x8d, 0x40, 0x2f, 0x60, 0xea, 0x4d, 0x68, 0x30,
+	/* (2^161)P */ 0x34, 0xcb, 0xe6, 0xa3, 0x78, 0xa2, 0xe5, 0x21, 0xc4, 0x1d, 0x15, 0x5b, 0x6f, 0x6e, 0xfb, 0xae, 0x15, 0xca, 0x77, 0x9d, 0x04, 0x8e, 0x0b, 0xb3, 0x81, 0x89, 0xb9, 0x53, 0xcf, 0xc9, 0xc3, 0x28,
+	/* (2^162)P */ 0x2a, 0xdd, 0x6c, 0x55, 0x21, 0xb7, 0x7f, 0x28, 0x74, 0x22, 0x02, 0x97, 0xa8, 0x7c, 0x31, 0x0d, 0x58, 0x32, 0x54, 0x3a, 0x42, 0xc7, 0x68, 0x74, 0x2f, 0x64, 0xb5, 0x4e, 0x46, 0x11, 0x7f, 0x4a,
+	/* (2^163)P */ 0xa6, 0x3a, 0x19, 0x4d, 0x77, 0xa4, 0x37, 0xa2, 0xa1, 0x29, 0x21, 0xa9, 0x6e, 0x98, 0x65, 0xd8, 0x88, 0x1a, 0x7c, 0xf8, 0xec, 0x15, 0xc5, 0x24, 0xeb, 0xf5, 0x39, 0x5f, 0x57, 0x03, 0x40, 0x60,
+	/* (2^164)P */ 0x27, 0x9b, 0x0a, 0x57, 0x89, 0xf1, 0xb9, 0x47, 0x78, 0x4b, 0x5e, 0x46, 0xde, 0xce, 0x98, 0x2b, 0x20, 0x5c, 0xb8, 0xdb, 0x51, 0xf5, 0x6d, 0x02, 0x01, 0x19, 0xe2, 0x47, 0x10, 0xd9, 0xfc, 0x74,
+	/* (2^165)P */ 0xa3, 0xbf, 0xc1, 0x23, 0x0a, 0xa9, 0xe2, 0x13, 0xf6, 0x19, 0x85, 0x47, 0x4e, 0x07, 0xb0, 0x0c, 0x44, 0xcf, 0xf6, 0x3a, 0xbe, 0xcb, 0xf1, 0x5f, 0xbe, 0x2d, 0x81, 0xbe, 0x38, 0x54, 0xfe, 0x67,
+	/* (2^166)P */ 0xb0, 0x05, 0x0f, 0xa4, 0x4f, 0xf6, 0x3c, 0xd1, 0x87, 0x37, 0x28, 0x32, 0x2f, 0xfb, 0x4d, 0x05, 0xea, 0x2a, 0x0d, 0x7f, 0x5b, 0x91, 0x73, 0x41, 0x4e, 0x0d, 0x61, 0x1f, 0x4f, 0x14, 0x2f, 0x48,
+	/* (2^167)P */ 0x34, 0x82, 0x7f, 0xb4, 0x01, 0x02, 0x21, 0xf6, 0x90, 0xb9, 0x70, 0x9e, 0x92, 0xe1, 0x0a, 0x5d, 0x7c, 0x56, 0x49, 0xb0, 0x55, 0xf4, 0xd7, 0xdc, 0x01, 0x6f, 0x91, 0xf0, 0xf1, 0xd0, 0x93, 0x7e,
+	/* (2^168)P */ 0xfa, 0xb4, 0x7d, 0x8a, 0xf1, 0xcb, 0x79, 0xdd, 0x2f, 0xc6, 0x74, 0x6f, 0xbf, 0x91, 0x83, 0xbe, 0xbd, 0x91, 0x82, 0x4b, 0xd1, 0x45, 0x71, 0x02, 0x05, 0x17, 0xbf, 0x2c, 0xea, 0x73, 0x5a, 0x58,
+	/* (2^169)P */ 0xb2, 0x0d, 0x8a, 0x92, 0x3e, 0xa0, 0x5c, 0x48, 0xe7, 0x57, 0x28, 0x74, 0xa5, 0x01, 0xfc, 0x10, 0xa7, 0x51, 0xd5, 0xd6, 0xdb, 0x2e, 0x48, 0x2f, 0x8a, 0xdb, 0x8f, 0x04, 0xb5, 0x33, 0x04, 0x0f,
+	/* (2^170)P */ 0x47, 0x62, 0xdc, 0xd7, 0x8d, 0x2e, 0xda, 0x60, 0x9a, 0x81, 0xd4, 0x8c, 0xd3, 0xc9, 0xb4, 0x88, 0x97, 0x66, 0xf6, 0x01, 0xc0, 0x3a, 0x03, 0x13, 0x75, 0x7d, 0x36, 0x3b, 0xfe, 0x24, 0x3b, 0x27,
+	/* (2^171)P */ 0xd4, 0xb9, 0xb3, 0x31, 0x6a, 0xf6, 0xe8, 0xc6, 0xd5, 0x49, 0xdf, 0x94, 0xa4, 0x14, 0x15, 0x28, 0xa7, 0x3d, 0xb2, 0xc8, 0xdf, 0x6f, 0x72, 0xd1, 0x48, 0xe5, 0xde, 0x03, 0xd1, 0xe7, 0x3a, 0x4b,
+	/* (2^172)P */ 0x7e, 0x9d, 0x4b, 0xce, 0x19, 0x6e, 0x25, 0xc6, 0x1c, 0xc6, 0xe3, 0x86, 0xf1, 0x5c, 0x5c, 0xff, 0x45, 0xc1, 0x8e, 0x4b, 0xa3, 0x3c, 0xc6, 0xac, 0x74, 0x65, 0xe6, 0xfe, 0x88, 0x18, 0x62, 0x74,
+	/* (2^173)P */ 0x1e, 0x0a, 0x29, 0x45, 0x96, 0x40, 0x6f, 0x95, 0x2e, 0x96, 0x3a, 0x26, 0xe3, 0xf8, 0x0b, 0xef, 0x7b, 0x64, 0xc2, 0x5e, 0xeb, 0x50, 0x6a, 0xed, 0x02, 0x75, 0xca, 0x9d, 0x3a, 0x28, 0x94, 0x06,
+	/* (2^174)P */ 0xd1, 0xdc, 0xa2, 0x43, 0x36, 0x96, 0x9b, 0x76, 0x53, 0x53, 0xfc, 0x09, 0xea, 0xc8, 0xb7, 0x42, 0xab, 0x7e, 0x39, 0x13, 0xee, 0x2a, 0x00, 0x4f, 0x3a, 0xd6, 0xb7, 0x19, 0x2c, 0x5e, 0x00, 0x63,
+	/* (2^175)P */ 0xea, 0x3b, 0x02, 0x63, 0xda, 0x36, 0x67, 0xca, 0xb7, 0x99, 0x2a, 0xb1, 0x6d, 0x7f, 0x6c, 0x96, 0xe1, 0xc5, 0x37, 0xc5, 0x90, 0x93, 0xe0, 0xac, 0xee, 0x89, 0xaa, 0xa1, 0x63, 0x60, 0x69, 0x0b,
+	/* (2^176)P */ 0xe5, 0x56, 0x8c, 0x28, 0x97, 0x3e, 0xb0, 0xeb, 0xe8, 0x8b, 0x8c, 0x93, 0x9f, 0x9f, 0x2a, 0x43, 0x71, 0x7f, 0x71, 0x5b, 0x3d, 0xa9, 0xa5, 0xa6, 0x97, 0x9d, 0x8f, 0xe1, 0xc3, 0xb4, 0x5f, 0x1a,
+	/* (2^177)P */ 0xce, 0xcd, 0x60, 0x1c, 0xad, 0xe7, 0x94, 0x1c, 0xa0, 0xc4, 0x02, 0xfc, 0x43, 0x2a, 0x20, 0xee, 0x20, 0x6a, 0xc4, 0x67, 0xd8, 0xe4, 0xaf, 0x8d, 0x58, 0x7b, 0xc2, 0x8a, 0x3c, 0x26, 0x10, 0x0a,
+	/* (2^178)P */ 0x4a, 0x2a, 0x43, 0xe4, 0xdf, 0xa9, 0xde, 0xd0, 0xc5, 0x77, 0x92, 0xbe, 0x7b, 0xf8, 0x6a, 0x85, 0x1a, 0xc7, 0x12, 0xc2, 0xac, 0x72, 0x84, 0xce, 0x91, 0x1e, 0xbb, 0x9b, 0x6d, 0x1b, 0x15, 0x6f,
+	/* (2^179)P */ 0x6a, 0xd5, 0xee, 0x7c, 0x52, 0x6c, 0x77, 0x26, 0xec, 0xfa, 0xf8, 0xfb, 0xb7, 0x1c, 0x21, 0x7d, 0xcc, 0x09, 0x46, 0xfd, 0xa6, 0x66, 0xae, 0x37, 0x42, 0x0c, 0x77, 0xd2, 0x02, 0xb7, 0x81, 0x1f,
+	/* (2^180)P */ 0x92, 0x83, 0xc5, 0xea, 0x57, 0xb0, 0xb0, 0x2f, 0x9d, 0x4e, 0x74, 0x29, 0xfe, 0x89, 0xdd, 0xe1, 0xf8, 0xb4, 0xbe, 0x17, 0xeb, 0xf8, 0x64, 0xc9, 0x1e, 0xd4, 0xa2, 0xc9, 0x73, 0x10, 0x57, 0x29,
+	/* (2^181)P */ 0x54, 0xe2, 0xc0, 0x81, 0x89, 0xa1, 0x48, 0xa9, 0x30, 0x28, 0xb2, 0x65, 0x9b, 0x36, 0xf6, 0x2d, 0xc6, 0xd3, 0xcf, 0x5f, 0xd7, 0xb2, 0x3e, 0xa3, 0x1f, 0xa0, 0x99, 0x41, 0xec, 0xd6, 0x8c, 0x07,
+	/* (2^182)P */ 0x2f, 0x0d, 0x90, 0xad, 0x41, 0x4a, 0x58, 0x4a, 0x52, 0x4c, 0xc7, 0xe2, 0x78, 0x2b, 0x14, 0x32, 0x78, 0xc9, 0x31, 0x84, 0x33, 0xe8, 0xc4, 0x68, 0xc2, 0x9f, 0x68, 0x08, 0x90, 0xea, 0x69, 0x7f,
+	/* (2^183)P */ 0x65, 0x82, 0xa3, 0x46, 0x1e, 0xc8, 0xf2, 0x52, 0xfd, 0x32, 0xa8, 0x04, 0x2d, 0x07, 0x78, 0xfd, 0x94, 0x9e, 0x35, 0x25, 0xfa, 0xd5, 0xd7, 0x8c, 0xd2, 0x29, 0xcc, 0x54, 0x74, 0x1b, 0xe7, 0x4d,
+	/* (2^184)P */ 0xc9, 0x6a, 0xda, 0x1e, 0xad, 0x60, 0xeb, 0x42, 0x3a, 0x9c, 0xc0, 0xdb, 0xdf, 0x37, 0xad, 0x0a, 0x91, 0xc1, 0x3c, 0xe3, 0x71, 0x4b, 0x00, 0x81, 0x3c, 0x80, 0x22, 0x51, 0x34, 0xbe, 0xe6, 0x44,
+	/* (2^185)P */ 0xdb, 0x20, 0x19, 0xba, 0x88, 0x83, 0xfe, 0x03, 0x08, 0xb0, 0x0d, 0x15, 0x32, 0x7c, 0xd5, 0xf5, 0x29, 0x0c, 0xf6, 0x1a, 0x28, 0xc4, 0xc8, 0x49, 0xee, 0x1a, 0x70, 0xde, 0x18, 0xb5, 0xed, 0x21,
+	/* (2^186)P */ 0x99, 0xdc, 0x06, 0x8f, 0x41, 0x3e, 0xb6, 0x7f, 0xb8, 0xd7, 0x66, 0xc1, 0x99, 0x0d, 0x46, 0xa4, 0x83, 0x0a, 0x52, 0xce, 0x48, 0x52, 0xdd, 0x24, 0x58, 0x83, 0x92, 0x2b, 0x71, 0xad, 0xc3, 0x5e,
+	/* (2^187)P */ 0x0f, 0x93, 0x17, 0xbd, 0x5f, 0x2a, 0x02, 0x15, 0xe3, 0x70, 0x25, 0xd8, 0x77, 0x4a, 0xf6, 0xa4, 0x12, 0x37, 0x78, 0x15, 0x69, 0x8d, 0xbc, 0x12, 0xbb, 0x0a, 0x62, 0xfc, 0xc0, 0x94, 0x81, 0x49,
+	/* (2^188)P */ 0x82, 0x6c, 0x68, 0x55, 0xd2, 0xd9, 0xa2, 0x38, 0xf0, 0x21, 0x3e, 0x19, 0xd9, 0x6b, 0x5c, 0x78, 0x84, 0x54, 0x4a, 0xb2, 0x1a, 0xc8, 0xd5, 0xe4, 0x89, 0x09, 0xe2, 0xb2, 0x60, 0x78, 0x30, 0x56,
+	/* (2^189)P */ 0xc4, 0x74, 0x4d, 0x8b, 0xf7, 0x55, 0x9d, 0x42, 0x31, 0x01, 0x35, 0x43, 0x46, 0x83, 0xf1, 0x22, 0xff, 0x1f, 0xc7, 0x98, 0x45, 0xc2, 0x60, 0x1e, 0xef, 0x83, 0x99, 0x97, 0x14, 0xf0, 0xf2, 0x59,
+	/* (2^190)P */ 0x44, 0x4a, 0x49, 0xeb, 0x56, 0x7d, 0xa4, 0x46, 0x8e, 0xa1, 0x36, 0xd6, 0x54, 0xa8, 0x22, 0x3e, 0x3b, 0x1c, 0x49, 0x74, 0x52, 0xe1, 0x46, 0xb3, 0xe7, 0xcd, 0x90, 0x53, 0x4e, 0xfd, 0xea, 0x2c,
+	/* (2^191)P */ 0x75, 0x66, 0x0d, 0xbe, 0x38, 0x85, 0x8a, 0xba, 0x23, 0x8e, 0x81, 0x50, 0xbb, 0x74, 0x90, 0x4b, 0xc3, 0x04, 0xd3, 0x85, 0x90, 0xb8, 0xda, 0xcb, 0xc4, 0x92, 0x61, 0xe5, 0xe0, 0x4f, 0xa2, 0x61,
+	/* (2^192)P */ 0xcb, 0x5b, 0x52, 0xdb, 0xe6, 0x15, 0x76, 0xcb, 0xca, 0xe4, 0x67, 0xa5, 0x35, 0x8c, 0x7d, 0xdd, 0x69, 0xdd, 0xfc, 0xca, 0x3a, 0x15, 0xb4, 0xe6, 0x66, 0x97, 0x3c, 0x7f, 0x09, 0x8e, 0x66, 0x2d,
+	/* (2^193)P */ 0xf0, 0x5e, 0xe5, 0x5c, 0x26, 0x7e, 0x7e, 0xa5, 0x67, 0xb9, 0xd4, 0x7c, 0x52, 0x4e, 0x9f, 0x5d, 0xe5, 0xd1, 0x2f, 0x49, 0x06, 0x36, 0xc8, 0xfb, 0xae, 0xf7, 0xc3, 0xb7, 0xbe, 0x52, 0x0d, 0x09,
+	/* (2^194)P */ 0x7c, 0x4d, 0x7b, 0x1e, 0x5a, 0x51, 0xb9, 0x09, 0xc0, 0x44, 0xda, 0x99, 0x25, 0x6a, 0x26, 0x1f, 0x04, 0x55, 0xc5, 0xe2, 0x48, 0x95, 0xc4, 0xa1, 0xcc, 0x15, 0x6f, 0x12, 0x87, 0x42, 0xf0, 0x7e,
+	/* (2^195)P */ 0x15, 0xef, 0x30, 0xbd, 0x9d, 0x65, 0xd1, 0xfe, 0x7b, 0x27, 0xe0, 0xc4, 0xee, 0xb9, 0x4a, 0x8b, 0x91, 0x32, 0xdf, 0xa5, 0x36, 0x62, 0x4d, 0x88, 0x88, 0xf7, 0x5c, 0xbf, 0xa6, 0x6e, 0xd9, 0x1f,
+	/* (2^196)P */ 0x9a, 0x0d, 0x19, 0x1f, 0x98, 0x61, 0xa1, 0x42, 0xc1, 0x52, 0x60, 0x7e, 0x50, 0x49, 0xd8, 0x61, 0xd5, 0x2c, 0x5a, 0x28, 0xbf, 0x13, 0xe1, 0x9f, 0xd8, 0x85, 0xad, 0xdb, 0x76, 0xd6, 0x22, 0x7c,
+	/* (2^197)P */ 0x7d, 0xd2, 0xfb, 0x2b, 0xed, 0x70, 0xe7, 0x82, 0xa5, 0xf5, 0x96, 0xe9, 0xec, 0xb2, 0x05, 0x4c, 0x50, 0x01, 0x90, 0xb0, 0xc2, 0xa9, 0x40, 0xcd, 0x64, 0xbf, 0xd9, 0x13, 0x92, 0x31, 0x95, 0x58,
+	/* (2^198)P */ 0x08, 0x2e, 0xea, 0x3f, 0x70, 0x5d, 0xcc, 0xe7, 0x8c, 0x18, 0xe2, 0x58, 0x12, 0x49, 0x0c, 0xb5, 0xf0, 0x5b, 0x20, 0x48, 0xaa, 0x0b, 0xe3, 0xcc, 0x62, 0x2d, 0xa3, 0xcf, 0x9c, 0x65, 0x7c, 0x53,
+	/* (2^199)P */ 0x88, 0xc0, 0xcf, 0x98, 0x3a, 0x62, 0xb6, 0x37, 0xa4, 0xac, 0xd6, 0xa4, 0x1f, 0xed, 0x9b, 0xfe, 0xb0, 0xd1, 0xa8, 0x56, 0x8e, 0x9b, 0xd2, 0x04, 0x75, 0x95, 0x51, 0x0b, 0xc4, 0x71, 0x5f, 0x72,
+	/* (2^200)P */ 0xe6, 0x9c, 0x33, 0xd0, 0x9c, 0xf8, 0xc7, 0x28, 0x8b, 0xc1, 0xdd, 0x69, 0x44, 0xb1, 0x67, 0x83, 0x2c, 0x65, 0xa1, 0xa6, 0x83, 0xda, 0x3a, 0x88, 0x17, 0x6c, 0x4d, 0x03, 0x74, 0x19, 0x5f, 0x58,
+	/* (2^201)P */ 0x88, 0x91, 0xb1, 0xf1, 0x66, 0xb2, 0xcf, 0x89, 0x17, 0x52, 0xc3, 0xe7, 0x63, 0x48, 0x3b, 0xe6, 0x6a, 0x52, 0xc0, 0xb4, 0xa6, 0x9d, 0x8c, 0xd8, 0x35, 0x46, 0x95, 0xf0, 0x9d, 0x5c, 0x03, 0x3e,
+	/* (2^202)P */ 0x9d, 0xde, 0x45, 0xfb, 0x12, 0x54, 0x9d, 0xdd, 0x0d, 0xf4, 0xcf, 0xe4, 0x32, 0x45, 0x68, 0xdd, 0x1c, 0x67, 0x1d, 0x15, 0x9b, 0x99, 0x5c, 0x4b, 0x90, 0xf6, 0xe7, 0x11, 0xc8, 0x2c, 0x8c, 0x2d,
+	/* (2^203)P */ 0x40, 0x5d, 0x05, 0x90, 0x1d, 0xbe, 0x54, 0x7f, 0x40, 0xaf, 0x4a, 0x46, 0xdf, 0xc5, 0x64, 0xa4, 0xbe, 0x17, 0xe9, 0xf0, 0x24, 0x96, 0x97, 0x33, 0x30, 0x6b, 0x35, 0x27, 0xc5, 0x8d, 0x01, 0x2c,
+	/* (2^204)P */ 0xd4, 0xb3, 0x30, 0xe3, 0x24, 0x50, 0x41, 0xa5, 0xd3, 0x52, 0x16, 0x69, 0x96, 0x3d, 0xff, 0x73, 0xf1, 0x59, 0x9b, 0xef, 0xc4, 0x42, 0xec, 0x94, 0x5a, 0x8e, 0xd0, 0x18, 0x16, 0x20, 0x47, 0x07,
+	/* (2^205)P */ 0x53, 0x1c, 0x41, 0xca, 0x8a, 0xa4, 0x6c, 0x4d, 0x19, 0x61, 0xa6, 0xcf, 0x2f, 0x5f, 0x41, 0x66, 0xff, 0x27, 0xe2, 0x51, 0x00, 0xd4, 0x4d, 0x9c, 0xeb, 0xf7, 0x02, 0x9a, 0xc0, 0x0b, 0x81, 0x59,
+	/* (2^206)P */ 0x1d, 0x10, 0xdc, 0xb3, 0x71, 0xb1, 0x7e, 0x2a, 0x8e, 0xf6, 0xfe, 0x9f, 0xb9, 0x5a, 0x1c, 0x44, 0xea, 0x59, 0xb3, 0x93, 0x9b, 0x5c, 0x02, 0x32, 0x2f, 0x11, 0x9d, 0x1e, 0xa7, 0xe0, 0x8c, 0x5e,
+	/* (2^207)P */ 0xfd, 0x03, 0x95, 0x42, 0x92, 0xcb, 0xcc, 0xbf, 0x55, 0x5d, 0x09, 0x2f, 0x75, 0xba, 0x71, 0xd2, 0x1e, 0x09, 0x2d, 0x97, 0x5e, 0xad, 0x5e, 0x34, 0xba, 0x03, 0x31, 0xa8, 0x11, 0xdf, 0xc8, 0x18,
+	/* (2^208)P */ 0x4c, 0x0f, 0xed, 0x9a, 0x9a, 0x94, 0xcd, 0x90, 0x7e, 0xe3, 0x60, 0x66, 0xcb, 0xf4, 0xd1, 0xc5, 0x0b, 0x2e, 0xc5, 0x56, 0x2d, 0xc5, 0xca, 0xb8, 0x0d, 0x8e, 0x80, 0xc5, 0x00, 0xe4, 0x42, 0x6e,
+	/* (2^209)P */ 0x23, 0xfd, 0xae, 0xee, 0x66, 0x69, 0xb4, 0xa3, 0xca, 0xcd, 0x9e, 0xe3, 0x0b, 0x1f, 0x4f, 0x0c, 0x1d, 0xa5, 0x83, 0xd6, 0xc9, 0xc8, 0x9d, 0x18, 0x1b, 0x35, 0x09, 0x4c, 0x05, 0x7f, 0xf2, 0x51,
+	/* (2^210)P */ 0x82, 0x06, 0x32, 0x2a, 0xcd, 0x7c, 0x48, 0x4c, 0x96, 0x1c, 0xdf, 0xb3, 0x5b, 0xa9, 0x7e, 0x58, 0xe8, 0xb8, 0x5c, 0x55, 0x9e, 0xf7, 0xcc, 0xc8, 0x3d, 0xd7, 0x06, 0xa2, 0x29, 0xc8, 0x7d, 0x54,
+	/* (2^211)P */ 0x06, 0x9b, 0xc3, 0x80, 0xcd, 0xa6, 0x22, 0xb8, 0xc6, 0xd4, 0x00, 0x20, 0x73, 0x54, 0x6d, 0xe9, 0x4d, 0x3b, 0x46, 0x91, 0x6f, 0x5b, 0x53, 0x28, 0x1d, 0x6e, 0x48, 0xe2, 0x60, 0x46, 0x8f, 0x22,
+	/* (2^212)P */ 0xbf, 0x3a, 0x8d, 0xde, 0x38, 0x95, 0x79, 0x98, 0x6e, 0xca, 0xeb, 0x45, 0x00, 0x33, 0xd8, 0x8c, 0x38, 0xe7, 0x21, 0x82, 0x00, 0x2a, 0x95, 0x79, 0xbb, 0xd2, 0x5c, 0x53, 0xa7, 0xe1, 0x22, 0x43,
+	/* (2^213)P */ 0x1c, 0x80, 0xd1, 0x19, 0x18, 0xc1, 0x14, 0xb1, 0xc7, 0x5e, 0x3f, 0x4f, 0xd8, 0xe4, 0x16, 0x20, 0x4c, 0x0f, 0x26, 0x09, 0xf4, 0x2d, 0x0e, 0xdd, 0x66, 0x72, 0x5f, 0xae, 0xc0, 0x62, 0xc3, 0x5e,
+	/* (2^214)P */ 0xee, 0xb4, 0xb2, 0xb8, 0x18, 0x2b, 0x46, 0xc0, 0xfb, 0x1a, 0x4d, 0x27, 0x50, 0xd9, 0xc8, 0x7c, 0xd2, 0x02, 0x6b, 0x43, 0x05, 0x71, 0x5f, 0xf2, 0xd3, 0xcc, 0xf9, 0xbf, 0xdc, 0xf8, 0xbb, 0x43,
+	/* (2^215)P */ 0xdf, 0xe9, 0x39, 0xa0, 0x67, 0x17, 0xad, 0xb6, 0x83, 0x35, 0x9d, 0xf6, 0xa8, 0x4d, 0x71, 0xb0, 0xf5, 0x31, 0x29, 0xb4, 0x18, 0xfa, 0x55, 0x5e, 0x61, 0x09, 0xc6, 0x33, 0x8f, 0x55, 0xd5, 0x4e,
+	/* (2^216)P */ 0xdd, 0xa5, 0x47, 0xc6, 0x01, 0x79, 0xe3, 0x1f, 0x57, 0xd3, 0x81, 0x80, 0x1f, 0xdf, 0x3d, 0x59, 0xa6, 0xd7, 0x3f, 0x81, 0xfd, 0xa4, 0x49, 0x02, 0x61, 0xaf, 0x9c, 0x4e, 0x27, 0xca, 0xac, 0x69,
+	/* (2^217)P */ 0xc9, 0x21, 0x07, 0x33, 0xea, 0xa3, 0x7b, 0x04, 0xa0, 0x1e, 0x7e, 0x0e, 0xc2, 0x3f, 0x42, 0x83, 0x60, 0x4a, 0x31, 0x01, 0xaf, 0xc0, 0xf4, 0x1d, 0x27, 0x95, 0x28, 0x89, 0xab, 0x2d, 0xa6, 0x09,
+	/* (2^218)P */ 0x00, 0xcb, 0xc6, 0x9c, 0xa4, 0x25, 0xb3, 0xa5, 0xb6, 0x6c, 0xb5, 0x54, 0xc6, 0x5d, 0x4b, 0xe9, 0xa0, 0x94, 0xc9, 0xad, 0x79, 0x87, 0xe2, 0x3b, 0xad, 0x4a, 0x3a, 0xba, 0xf8, 0xe8, 0x96, 0x42,
+	/* (2^219)P */ 0xab, 0x1e, 0x45, 0x1e, 0x76, 0x89, 0x86, 0x32, 0x4a, 0x59, 0x59, 0xff, 0x8b, 0x59, 0x4d, 0x2e, 0x4a, 0x08, 0xa7, 0xd7, 0x53, 0x68, 0xb9, 0x49, 0xa8, 0x20, 0x14, 0x60, 0x19, 0xa3, 0x80, 0x49,
+	/* (2^220)P */ 0x42, 0x2c, 0x55, 0x2f, 0xe1, 0xb9, 0x65, 0x95, 0x96, 0xfe, 0x00, 0x71, 0xdb, 0x18, 0x53, 0x8a, 0xd7, 0xd0, 0xad, 0x43, 0x4d, 0x0b, 0xc9, 0x05, 0xda, 0x4e, 0x5d, 0x6a, 0xd6, 0x4c, 0x8b, 0x53,
+	/* (2^221)P */ 0x9f, 0x03, 0x9f, 0xe8, 0xc3, 0x4f, 0xe9, 0xf4, 0x45, 0x80, 0x61, 0x6f, 0xf2, 0x9a, 0x2c, 0x59, 0x50, 0x95, 0x4b, 0xfd, 0xb5, 0x6e, 0xa3, 0x08, 0x19, 0x14, 0xed, 0xc2, 0xf6, 0xfa, 0xff, 0x25,
+	/* (2^222)P */ 0x54, 0xd3, 0x79, 0xcc, 0x59, 0x44, 0x43, 0x34, 0x6b, 0x47, 0xd5, 0xb1, 0xb4, 0xbf, 0xec, 0xee, 0x99, 0x5d, 0x61, 0x61, 0xa0, 0x34, 0xeb, 0xdd, 0x73, 0xb7, 0x64, 0xeb, 0xcc, 0xce, 0x29, 0x51,
+	/* (2^223)P */ 0x20, 0x35, 0x99, 0x94, 0x58, 0x21, 0x43, 0xee, 0x3b, 0x0b, 0x4c, 0xf1, 0x7c, 0x9c, 0x2f, 0x77, 0xd5, 0xda, 0xbe, 0x06, 0xe3, 0xfc, 0xe2, 0xd2, 0x97, 0x6a, 0xf0, 0x46, 0xb5, 0x42, 0x5f, 0x71,
+	/* (2^224)P */ 0x1a, 0x5f, 0x5b, 0xda, 0xce, 0xcd, 0x4e, 0x43, 0xa9, 0x41, 0x97, 0xa4, 0x15, 0x71, 0xa1, 0x0d, 0x2e, 0xad, 0xed, 0x73, 0x7c, 0xd7, 0x0b, 0x68, 0x41, 0x90, 0xdd, 0x4e, 0x35, 0x02, 0x7c, 0x48,
+	/* (2^225)P */ 0xc4, 0xd9, 0x0e, 0xa7, 0xf3, 0xef, 0xef, 0xb8, 0x02, 0xe3, 0x57, 0xe8, 0xa3, 0x2a, 0xa3, 0x56, 0xa0, 0xa5, 0xa2, 0x48, 0xbd, 0x68, 0x3a, 0xdf, 0x44, 0xc4, 0x76, 0x31, 0xb7, 0x50, 0xf6, 0x07,
+	/* (2^226)P */ 0xb1, 0xcc, 0xe0, 0x26, 0x16, 0x9b, 0x8b, 0xe3, 0x36, 0xfb, 0x09, 0x8b, 0xc1, 0x53, 0xe0, 0x79, 0x64, 0x49, 0xf9, 0xc9, 0x19, 0x03, 0xd9, 0x56, 0xc4, 0xf5, 0x9f, 0xac, 0xe7, 0x41, 0xa9, 0x1c,
+	/* (2^227)P */ 0xbb, 0xa0, 0x2f, 0x16, 0x29, 0xdf, 0xc4, 0x49, 0x05, 0x33, 0xb3, 0x82, 0x32, 0xcf, 0x88, 0x84, 0x7d, 0x43, 0xbb, 0xca, 0x14, 0xda, 0xdf, 0x95, 0x86, 0xad, 0xd5, 0x64, 0x82, 0xf7, 0x91, 0x33,
+	/* (2^228)P */ 0x5d, 0x09, 0xb5, 0xe2, 0x6a, 0xe0, 0x9a, 0x72, 0x46, 0xa9, 0x59, 0x32, 0xd7, 0x58, 0x8a, 0xd5, 0xed, 0x21, 0x39, 0xd1, 0x62, 0x42, 0x83, 0xe9, 0x92, 0xb5, 0x4b, 0xa5, 0xfa, 0xda, 0xfe, 0x27,
+	/* (2^229)P */ 0xbb, 0x48, 0xad, 0x29, 0xb8, 0xc5, 0x9d, 0xa9, 0x60, 0xe2, 0x9e, 0x49, 0x42, 0x57, 0x02, 0x5f, 0xfd, 0x13, 0x75, 0x5d, 0xcd, 0x8e, 0x2c, 0x80, 0x38, 0xd9, 0x6d, 0x3f, 0xef, 0xb3, 0xce, 0x78,
+	/* (2^230)P */ 0x94, 0x5d, 0x13, 0x8a, 0x4f, 0xf4, 0x42, 0xc3, 0xa3, 0xdd, 0x8c, 0x82, 0x44, 0xdb, 0x9e, 0x7b, 0xe7, 0xcf, 0x37, 0x05, 0x1a, 0xd1, 0x36, 0x94, 0xc8, 0xb4, 0x1a, 0xec, 0x64, 0xb1, 0x64, 0x50,
+	/* (2^231)P */ 0xfc, 0xb2, 0x7e, 0xd3, 0xcf, 0xec, 0x20, 0x70, 0xfc, 0x25, 0x0d, 0xd9, 0x3e, 0xea, 0x31, 0x1f, 0x34, 0xbb, 0xa1, 0xdf, 0x7b, 0x0d, 0x93, 0x1b, 0x44, 0x30, 0x11, 0x48, 0x7a, 0x46, 0x44, 0x53,
+	/* (2^232)P */ 0xfb, 0x6d, 0x5e, 0xf2, 0x70, 0x31, 0x07, 0x70, 0xc8, 0x4c, 0x11, 0x50, 0x1a, 0xdc, 0x85, 0xe3, 0x00, 0x4f, 0xfc, 0xc8, 0x8a, 0x69, 0x48, 0x23, 0xd8, 0x40, 0xdd, 0x84, 0x52, 0xa5, 0x77, 0x2a,
+	/* (2^233)P */ 0xe4, 0x6c, 0x8c, 0xc9, 0xe0, 0xaf, 0x06, 0xfe, 0xe4, 0xd6, 0xdf, 0xdd, 0x96, 0xdf, 0x35, 0xc2, 0xd3, 0x1e, 0xbf, 0x33, 0x1e, 0xd0, 0x28, 0x14, 0xaf, 0xbd, 0x00, 0x93, 0xec, 0x68, 0x57, 0x78,
+	/* (2^234)P */ 0x3b, 0xb6, 0xde, 0x91, 0x7a, 0xe5, 0x02, 0x97, 0x80, 0x8b, 0xce, 0xe5, 0xbf, 0xb8, 0xbd, 0x61, 0xac, 0x58, 0x1d, 0x3d, 0x6f, 0x42, 0x5b, 0x64, 0xbc, 0x57, 0xa5, 0x27, 0x22, 0xa8, 0x04, 0x48,
+	/* (2^235)P */ 0x01, 0x26, 0x4d, 0xb4, 0x8a, 0x04, 0x57, 0x8e, 0x35, 0x69, 0x3a, 0x4b, 0x1a, 0x50, 0xd6, 0x68, 0x93, 0xc2, 0xe1, 0xf9, 0xc3, 0x9e, 0x9c, 0xc3, 0xe2, 0x63, 0xde, 0xd4, 0x57, 0xf2, 0x72, 0x41,
+	/* (2^236)P */ 0x01, 0x64, 0x0c, 0x33, 0x50, 0xb4, 0x68, 0xd3, 0x91, 0x23, 0x8f, 0x41, 0x17, 0x30, 0x0d, 0x04, 0x0d, 0xd9, 0xb7, 0x90, 0x60, 0xbb, 0x34, 0x2c, 0x1f, 0xd5, 0xdf, 0x8f, 0x22, 0x49, 0xf6, 0x16,
+	/* (2^237)P */ 0xf5, 0x8e, 0x92, 0x2b, 0x8e, 0x81, 0xa6, 0xbe, 0x72, 0x1e, 0xc1, 0xcd, 0x91, 0xcf, 0x8c, 0xe2, 0xcd, 0x36, 0x7a, 0xe7, 0x68, 0xaa, 0x4a, 0x59, 0x0f, 0xfd, 0x7f, 0x6c, 0x80, 0x34, 0x30, 0x31,
+	/* (2^238)P */ 0x65, 0xbd, 0x49, 0x22, 0xac, 0x27, 0x9d, 0x8a, 0x12, 0x95, 0x8e, 0x01, 0x64, 0xb4, 0xa3, 0x19, 0xc7, 0x7e, 0xb3, 0x52, 0xf3, 0xcf, 0x6c, 0xc2, 0x21, 0x7b, 0x79, 0x1d, 0x34, 0x68, 0x6f, 0x05,
+	/* (2^239)P */ 0x27, 0x23, 0xfd, 0x7e, 0x75, 0xd6, 0x79, 0x5e, 0x15, 0xfe, 0x3a, 0x55, 0xb6, 0xbc, 0xbd, 0xfa, 0x60, 0x5a, 0xaf, 0x6e, 0x2c, 0x22, 0xe7, 0xd3, 0x3b, 0x74, 0xae, 0x4d, 0x6d, 0xc7, 0x46, 0x70,
+	/* (2^240)P */ 0x55, 0x4a, 0x8d, 0xb1, 0x72, 0xe8, 0x0b, 0x66, 0x96, 0x14, 0x4e, 0x57, 0x18, 0x25, 0x99, 0x19, 0xbb, 0xdc, 0x2b, 0x30, 0x3a, 0x05, 0x03, 0xc1, 0x8e, 0x8e, 0x21, 0x0b, 0x80, 0xe9, 0xd8, 0x3e,
+	/* (2^241)P */ 0x3e, 0xe0, 0x75, 0xfa, 0x39, 0x92, 0x0b, 0x7b, 0x83, 0xc0, 0x33, 0x46, 0x68, 0xfb, 0xe9, 0xef, 0x93, 0x77, 0x1a, 0x39, 0xbe, 0x5f, 0xa3, 0x98, 0x34, 0xfe, 0xd0, 0xe2, 0x0f, 0x51, 0x65, 0x60,
+	/* (2^242)P */ 0x0c, 0xad, 0xab, 0x48, 0x85, 0x66, 0xcb, 0x55, 0x27, 0xe5, 0x87, 0xda, 0x48, 0x45, 0x58, 0xb4, 0xdd, 0xc1, 0x07, 0x01, 0xea, 0xec, 0x43, 0x2c, 0x35, 0xde, 0x72, 0x93, 0x80, 0x28, 0x60, 0x52,
+	/* (2^243)P */ 0x1f, 0x3b, 0x21, 0xf9, 0x6a, 0xc5, 0x15, 0x34, 0xdb, 0x98, 0x7e, 0x01, 0x4d, 0x1a, 0xee, 0x5b, 0x9b, 0x70, 0xcf, 0xb5, 0x05, 0xb1, 0xf6, 0x13, 0xb6, 0x9a, 0xb2, 0x82, 0x34, 0x0e, 0xf2, 0x5f,
+	/* (2^244)P */ 0x90, 0x6c, 0x2e, 0xcc, 0x75, 0x9c, 0xa2, 0x0a, 0x06, 0xe2, 0x70, 0x3a, 0xca, 0x73, 0x7d, 0xfc, 0x15, 0xc5, 0xb5, 0xc4, 0x8f, 0xc3, 0x9f, 0x89, 0x07, 0xc2, 0xff, 0x24, 0xb1, 0x86, 0x03, 0x25,
+	/* (2^245)P */ 0x56, 0x2b, 0x3d, 0xae, 0xd5, 0x28, 0xea, 0x54, 0xce, 0x60, 0xde, 0xd6, 0x9d, 0x14, 0x13, 0x99, 0xc1, 0xd6, 0x06, 0x8f, 0xc5, 0x4f, 0x69, 0x16, 0xc7, 0x8f, 0x01, 0xeb, 0x75, 0x39, 0xb2, 0x46,
+	/* (2^246)P */ 0xe2, 0xb4, 0xb7, 0xb4, 0x0f, 0x6a, 0x0a, 0x47, 0xde, 0x53, 0x72, 0x8f, 0x5a, 0x47, 0x92, 0x5d, 0xdb, 0x3a, 0xbd, 0x2f, 0xb5, 0xe5, 0xee, 0xab, 0x68, 0x69, 0x80, 0xa0, 0x01, 0x08, 0xa2, 0x7f,
+	/* (2^247)P */ 0xd2, 0x14, 0x77, 0x9f, 0xf1, 0xfa, 0xf3, 0x76, 0xc3, 0x60, 0x46, 0x2f, 0xc1, 0x40, 0xe8, 0xb3, 0x4e, 0x74, 0x12, 0xf2, 0x8d, 0xcd, 0xb4, 0x0f, 0xd2, 0x2d, 0x3a, 0x1d, 0x25, 0x5a, 0x06, 0x4b,
+	/* (2^248)P */ 0x4a, 0xcd, 0x77, 0x3d, 0x38, 0xde, 0xeb, 0x5c, 0xb1, 0x9c, 0x2c, 0x88, 0xdf, 0x39, 0xdf, 0x6a, 0x59, 0xf7, 0x9a, 0xb0, 0x2e, 0x24, 0xdd, 0xa2, 0x22, 0x64, 0x5f, 0x0e, 0xe5, 0xc0, 0x47, 0x31,
+	/* (2^249)P */ 0xdb, 0x50, 0x13, 0x1d, 0x10, 0xa5, 0x4c, 0x16, 0x62, 0xc9, 0x3f, 0xc3, 0x79, 0x34, 0xd1, 0xf8, 0x08, 0xda, 0xe5, 0x13, 0x4d, 0xce, 0x40, 0xe6, 0xba, 0xf8, 0x61, 0x50, 0xc4, 0xe0, 0xde, 0x4b,
+	/* (2^250)P */ 0xc9, 0xb1, 0xed, 0xa4, 0xc1, 0x6d, 0xc4, 0xd7, 0x8a, 0xd9, 0x7f, 0x43, 0xb6, 0xd7, 0x14, 0x55, 0x0b, 0xc0, 0xa1, 0xb2, 0x6b, 0x2f, 0x94, 0x58, 0x0e, 0x71, 0x70, 0x1d, 0xab, 0xb2, 0xff, 0x2d,
+	/* (2^251)P */ 0x68, 0x6d, 0x8b, 0xc1, 0x2f, 0xcf, 0xdf, 0xcc, 0x67, 0x61, 0x80, 0xb7, 0xa8, 0xcb, 0xeb, 0xa8, 0xe3, 0x37, 0x29, 0x5e, 0xf9, 0x97, 0x06, 0x98, 0x8c, 0x6e, 0x12, 0xd0, 0x1c, 0xba, 0xfb, 0x02,
+	/* (2^252)P */ 0x65, 0x45, 0xff, 0xad, 0x60, 0xc3, 0x98, 0xcb, 0x19, 0x15, 0xdb, 0x4b, 0xd2, 0x01, 0x71, 0x44, 0xd5, 0x15, 0xfb, 0x75, 0x74, 0xc8, 0xc4, 0x98, 0x7d, 0xa2, 0x22, 0x6e, 0x6d, 0xc7, 0xf8, 0x05,
+	/* (2^253)P */ 0x94, 0xf4, 0xb9, 0xfe, 0xdf, 0xe5, 0x69, 0xab, 0x75, 0x6b, 0x40, 0x18, 0x9d, 0xc7, 0x09, 0xae, 0x1d, 0x2d, 0xa4, 0x94, 0xfb, 0x45, 0x9b, 0x19, 0x84, 0xfa, 0x2a, 0xae, 0xeb, 0x0a, 0x71, 0x79,
+	/* (2^254)P */ 0xdf, 0xd2, 0x34, 0xf3, 0xa7, 0xed, 0xad, 0xa6, 0xb4, 0x57, 0x2a, 0xaf, 0x51, 0x9c, 0xde, 0x7b, 0xa8, 0xea, 0xdc, 0x86, 0x4f, 0xc6, 0x8f, 0xa9, 0x7b, 0xd0, 0x0e, 0xc2, 0x35, 0x03, 0xbe, 0x6b,
+	/* (2^255)P */ 0x44, 0x43, 0x98, 0x53, 0xbe, 0xdc, 0x7f, 0x66, 0xa8, 0x49, 0x59, 0x00, 0x1c, 0xbc, 0x72, 0x07, 0x8e, 0xd6, 0xbe, 0x4e, 0x9f, 0xa4, 0x07, 0xba, 0xbf, 0x30, 0xdf, 0xba, 0x85, 0xb0, 0xa7, 0x1f,
+}
diff --git a/.ci/providerlint/vendor/github.com/cloudflare/circl/dh/x448/curve.go b/.ci/providerlint/vendor/github.com/cloudflare/circl/dh/x448/curve.go
new file mode 100644
index 00000000000..d59564e4b42
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/cloudflare/circl/dh/x448/curve.go
@@ -0,0 +1,104 @@
+package x448
+
+import (
+	fp "github.com/cloudflare/circl/math/fp448"
+)
+
+// ladderJoye calculates a fixed-point multiplication with the generator point.
+// The algorithm is the right-to-left Joye's ladder as described
+// in "How to precompute a ladder" in SAC'2017.
+func ladderJoye(k *Key) {
+	w := [5]fp.Elt{} // [mu,x1,z1,x2,z2] order must be preserved.
+	w[1] = fp.Elt{   // x1 = S
+		0xfe, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+		0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+		0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+		0xff, 0xff, 0xff, 0xff, 0xfe, 0xff, 0xff, 0xff,
+		0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+		0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+		0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+	}
+	fp.SetOne(&w[2]) // z1 = 1
+	w[3] = fp.Elt{   // x2 = G-S
+		0x20, 0x27, 0x9d, 0xc9, 0x7d, 0x19, 0xb1, 0xac,
+		0xf8, 0xba, 0x69, 0x1c, 0xff, 0x33, 0xac, 0x23,
+		0x51, 0x1b, 0xce, 0x3a, 0x64, 0x65, 0xbd, 0xf1,
+		0x23, 0xf8, 0xc1, 0x84, 0x9d, 0x45, 0x54, 0x29,
+		0x67, 0xb9, 0x81, 0x1c, 0x03, 0xd1, 0xcd, 0xda,
+		0x7b, 0xeb, 0xff, 0x1a, 0x88, 0x03, 0xcf, 0x3a,
+		0x42, 0x44, 0x32, 0x01, 0x25, 0xb7, 0xfa, 0xf0,
+	}
+	fp.SetOne(&w[4]) // z2 = 1
+
+	const n = 448
+	const h = 2
+	swap := uint(1)
+	for s := 0; s < n-h; s++ {
+		i := (s + h) / 8
+		j := (s + h) % 8
+		bit := uint((k[i] >> uint(j)) & 1)
+		copy(w[0][:], tableGenerator[s*Size:(s+1)*Size])
+		diffAdd(&w, swap^bit)
+		swap = bit
+	}
+	for s := 0; s < h; s++ {
+		double(&w[1], &w[2])
+	}
+	toAffine((*[fp.Size]byte)(k), &w[1], &w[2])
+}
+
+// ladderMontgomery calculates a generic scalar point multiplication
+// The algorithm implemented is the left-to-right Montgomery's ladder.
+func ladderMontgomery(k, xP *Key) {
+	w := [5]fp.Elt{}      // [x1, x2, z2, x3, z3] order must be preserved.
+	w[0] = *(*fp.Elt)(xP) // x1 = xP
+	fp.SetOne(&w[1])      // x2 = 1
+	w[3] = *(*fp.Elt)(xP) // x3 = xP
+	fp.SetOne(&w[4])      // z3 = 1
+
+	move := uint(0)
+	for s := 448 - 1; s >= 0; s-- {
+		i := s / 8
+		j := s % 8
+		bit := uint((k[i] >> uint(j)) & 1)
+		ladderStep(&w, move^bit)
+		move = bit
+	}
+	toAffine((*[fp.Size]byte)(k), &w[1], &w[2])
+}
+
+func toAffine(k *[fp.Size]byte, x, z *fp.Elt) {
+	fp.Inv(z, z)
+	fp.Mul(x, x, z)
+	_ = fp.ToBytes(k[:], x)
+}
+
+var lowOrderPoints = [3]fp.Elt{
+	{ /* (0,_,1) point of order 2 on Curve448 */
+		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	},
+	{ /* (1,_,1) a point of order 4 on the twist of Curve448 */
+		0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	},
+	{ /* (-1,_,1) point of order 4 on Curve448 */
+		0xfe, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+		0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+		0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+		0xff, 0xff, 0xff, 0xff, 0xfe, 0xff, 0xff, 0xff,
+		0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+		0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+		0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+	},
+}
diff --git a/.ci/providerlint/vendor/github.com/cloudflare/circl/dh/x448/curve_amd64.go b/.ci/providerlint/vendor/github.com/cloudflare/circl/dh/x448/curve_amd64.go
new file mode 100644
index 00000000000..a0622666136
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/cloudflare/circl/dh/x448/curve_amd64.go
@@ -0,0 +1,30 @@
+//go:build amd64 && !purego
+// +build amd64,!purego
+
+package x448
+
+import (
+	fp "github.com/cloudflare/circl/math/fp448"
+	"golang.org/x/sys/cpu"
+)
+
+var hasBmi2Adx = cpu.X86.HasBMI2 && cpu.X86.HasADX
+
+var _ = hasBmi2Adx
+
+func double(x, z *fp.Elt)             { doubleAmd64(x, z) }
+func diffAdd(w *[5]fp.Elt, b uint)    { diffAddAmd64(w, b) }
+func ladderStep(w *[5]fp.Elt, b uint) { ladderStepAmd64(w, b) }
+func mulA24(z, x *fp.Elt)             { mulA24Amd64(z, x) }
+
+//go:noescape
+func doubleAmd64(x, z *fp.Elt)
+
+//go:noescape
+func diffAddAmd64(w *[5]fp.Elt, b uint)
+
+//go:noescape
+func ladderStepAmd64(w *[5]fp.Elt, b uint)
+
+//go:noescape
+func mulA24Amd64(z, x *fp.Elt)
diff --git a/.ci/providerlint/vendor/github.com/cloudflare/circl/dh/x448/curve_amd64.h b/.ci/providerlint/vendor/github.com/cloudflare/circl/dh/x448/curve_amd64.h
new file mode 100644
index 00000000000..8c1ae4d0fbb
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/cloudflare/circl/dh/x448/curve_amd64.h
@@ -0,0 +1,111 @@
+#define ladderStepLeg          \
+    addSub(x2,z2)              \
+    addSub(x3,z3)              \
+    integerMulLeg(b0,x2,z3)    \
+    integerMulLeg(b1,x3,z2)    \
+    reduceFromDoubleLeg(t0,b0) \
+    reduceFromDoubleLeg(t1,b1) \
+    addSub(t0,t1)              \
+    cselect(x2,x3,regMove)     \
+    cselect(z2,z3,regMove)     \
+    integerSqrLeg(b0,t0)       \
+    integerSqrLeg(b1,t1)       \
+    reduceFromDoubleLeg(x3,b0) \
+    reduceFromDoubleLeg(z3,b1) \
+    integerMulLeg(b0,x1,z3)    \
+    reduceFromDoubleLeg(z3,b0) \
+    integerSqrLeg(b0,x2)       \
+    integerSqrLeg(b1,z2)       \
+    reduceFromDoubleLeg(x2,b0) \
+    reduceFromDoubleLeg(z2,b1) \
+    subtraction(t0,x2,z2)      \
+    multiplyA24Leg(t1,t0)      \
+    additionLeg(t1,t1,z2)      \
+    integerMulLeg(b0,x2,z2)    \
+    integerMulLeg(b1,t0,t1)    \
+    reduceFromDoubleLeg(x2,b0) \
+    reduceFromDoubleLeg(z2,b1)
+
+#define ladderStepBmi2Adx      \
+    addSub(x2,z2)              \
+    addSub(x3,z3)              \
+    integerMulAdx(b0,x2,z3)    \
+    integerMulAdx(b1,x3,z2)    \
+    reduceFromDoubleAdx(t0,b0) \
+    reduceFromDoubleAdx(t1,b1) \
+    addSub(t0,t1)              \
+    cselect(x2,x3,regMove)     \
+    cselect(z2,z3,regMove)     \
+    integerSqrAdx(b0,t0)       \
+    integerSqrAdx(b1,t1)       \
+    reduceFromDoubleAdx(x3,b0) \
+    reduceFromDoubleAdx(z3,b1) \
+    integerMulAdx(b0,x1,z3)    \
+    reduceFromDoubleAdx(z3,b0) \
+    integerSqrAdx(b0,x2)       \
+    integerSqrAdx(b1,z2)       \
+    reduceFromDoubleAdx(x2,b0) \
+    reduceFromDoubleAdx(z2,b1) \
+    subtraction(t0,x2,z2)      \
+    multiplyA24Adx(t1,t0)      \
+    additionAdx(t1,t1,z2)      \
+    integerMulAdx(b0,x2,z2)    \
+    integerMulAdx(b1,t0,t1)    \
+    reduceFromDoubleAdx(x2,b0) \
+    reduceFromDoubleAdx(z2,b1)
+
+#define difAddLeg              \
+    addSub(x1,z1)              \
+    integerMulLeg(b0,z1,ui)    \
+    reduceFromDoubleLeg(z1,b0) \
+    addSub(x1,z1)              \
+    integerSqrLeg(b0,x1)       \
+    integerSqrLeg(b1,z1)       \
+    reduceFromDoubleLeg(x1,b0) \
+    reduceFromDoubleLeg(z1,b1) \
+    integerMulLeg(b0,x1,z2)    \
+    integerMulLeg(b1,z1,x2)    \
+    reduceFromDoubleLeg(x1,b0) \
+    reduceFromDoubleLeg(z1,b1)
+
+#define difAddBmi2Adx          \
+    addSub(x1,z1)              \
+    integerMulAdx(b0,z1,ui)    \
+    reduceFromDoubleAdx(z1,b0) \
+    addSub(x1,z1)              \
+    integerSqrAdx(b0,x1)       \
+    integerSqrAdx(b1,z1)       \
+    reduceFromDoubleAdx(x1,b0) \
+    reduceFromDoubleAdx(z1,b1) \
+    integerMulAdx(b0,x1,z2)    \
+    integerMulAdx(b1,z1,x2)    \
+    reduceFromDoubleAdx(x1,b0) \
+    reduceFromDoubleAdx(z1,b1)
+
+#define doubleLeg              \
+    addSub(x1,z1)              \
+    integerSqrLeg(b0,x1)       \
+    integerSqrLeg(b1,z1)       \
+    reduceFromDoubleLeg(x1,b0) \
+    reduceFromDoubleLeg(z1,b1) \
+    subtraction(t0,x1,z1)      \
+    multiplyA24Leg(t1,t0)      \
+    additionLeg(t1,t1,z1)      \
+    integerMulLeg(b0,x1,z1)    \
+    integerMulLeg(b1,t0,t1)    \
+    reduceFromDoubleLeg(x1,b0) \
+    reduceFromDoubleLeg(z1,b1)
+
+#define doubleBmi2Adx          \
+    addSub(x1,z1)              \
+    integerSqrAdx(b0,x1)       \
+    integerSqrAdx(b1,z1)       \
+    reduceFromDoubleAdx(x1,b0) \
+    reduceFromDoubleAdx(z1,b1) \
+    subtraction(t0,x1,z1)      \
+    multiplyA24Adx(t1,t0)      \
+    additionAdx(t1,t1,z1)      \
+    integerMulAdx(b0,x1,z1)    \
+    integerMulAdx(b1,t0,t1)    \
+    reduceFromDoubleAdx(x1,b0) \
+    reduceFromDoubleAdx(z1,b1)
diff --git a/.ci/providerlint/vendor/github.com/cloudflare/circl/dh/x448/curve_amd64.s b/.ci/providerlint/vendor/github.com/cloudflare/circl/dh/x448/curve_amd64.s
new file mode 100644
index 00000000000..810aa9e6481
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/cloudflare/circl/dh/x448/curve_amd64.s
@@ -0,0 +1,193 @@
+// +build amd64
+
+#include "textflag.h"
+
+// Depends on circl/math/fp448 package
+#include "../../math/fp448/fp_amd64.h"
+#include "curve_amd64.h"
+
+// CTE_A24 is (A+2)/4 from Curve448
+#define CTE_A24 39082
+
+#define Size 56
+
+// multiplyA24Leg multiplies x times CTE_A24 and stores in z
+// Uses: AX, DX, R8-R15, FLAGS
+// Instr: x86_64, cmov, adx
+#define multiplyA24Leg(z,x) \
+    MOVQ $CTE_A24, R15; \
+    MOVQ  0+x, AX; MULQ R15; MOVQ AX,  R8; ;;;;;;;;;;;;  MOVQ DX,  R9; \
+    MOVQ  8+x, AX; MULQ R15; ADDQ AX,  R9; ADCQ $0, DX;  MOVQ DX, R10; \
+    MOVQ 16+x, AX; MULQ R15; ADDQ AX, R10; ADCQ $0, DX;  MOVQ DX, R11; \
+    MOVQ 24+x, AX; MULQ R15; ADDQ AX, R11; ADCQ $0, DX;  MOVQ DX, R12; \
+    MOVQ 32+x, AX; MULQ R15; ADDQ AX, R12; ADCQ $0, DX;  MOVQ DX, R13; \
+    MOVQ 40+x, AX; MULQ R15; ADDQ AX, R13; ADCQ $0, DX;  MOVQ DX, R14; \
+    MOVQ 48+x, AX; MULQ R15; ADDQ AX, R14; ADCQ $0, DX; \
+    MOVQ DX,  AX; \
+    SHLQ $32, AX; \
+    ADDQ DX,  R8; MOVQ $0, DX; \
+    ADCQ $0,  R9; \
+    ADCQ $0, R10; \
+    ADCQ AX, R11; \
+    ADCQ $0, R12; \
+    ADCQ $0, R13; \
+    ADCQ $0, R14; \
+    ADCQ $0,  DX; \
+    MOVQ DX,  AX; \
+    SHLQ $32, AX; \
+    ADDQ DX,  R8; \
+    ADCQ $0,  R9; \
+    ADCQ $0, R10; \
+    ADCQ AX, R11; \
+    ADCQ $0, R12; \
+    ADCQ $0, R13; \
+    ADCQ $0, R14; \
+    MOVQ  R8,  0+z; \
+    MOVQ  R9,  8+z; \
+    MOVQ R10, 16+z; \
+    MOVQ R11, 24+z; \
+    MOVQ R12, 32+z; \
+    MOVQ R13, 40+z; \
+    MOVQ R14, 48+z;
+
+// multiplyA24Adx multiplies x times CTE_A24 and stores in z
+// Uses: AX, DX, R8-R14, FLAGS
+// Instr: x86_64, bmi2
+#define multiplyA24Adx(z,x) \
+    MOVQ $CTE_A24, DX; \
+    MULXQ  0+x, R8,  R9; \
+    MULXQ  8+x, AX, R10;  ADDQ AX,  R9; \
+    MULXQ 16+x, AX, R11;  ADCQ AX, R10; \
+    MULXQ 24+x, AX, R12;  ADCQ AX, R11; \
+    MULXQ 32+x, AX, R13;  ADCQ AX, R12; \
+    MULXQ 40+x, AX, R14;  ADCQ AX, R13; \
+    MULXQ 48+x, AX,  DX;  ADCQ AX, R14; \
+    ;;;;;;;;;;;;;;;;;;;;  ADCQ $0,  DX; \
+    MOVQ DX,  AX; \
+    SHLQ $32, AX; \
+    ADDQ DX,  R8; MOVQ $0, DX; \
+    ADCQ $0,  R9; \
+    ADCQ $0, R10; \
+    ADCQ AX, R11; \
+    ADCQ $0, R12; \
+    ADCQ $0, R13; \
+    ADCQ $0, R14; \
+    ADCQ $0,  DX; \
+    MOVQ DX,  AX; \
+    SHLQ $32, AX; \
+    ADDQ DX,  R8; \
+    ADCQ $0,  R9; \
+    ADCQ $0, R10; \
+    ADCQ AX, R11; \
+    ADCQ $0, R12; \
+    ADCQ $0, R13; \
+    ADCQ $0, R14; \
+    MOVQ  R8,  0+z; \
+    MOVQ  R9,  8+z; \
+    MOVQ R10, 16+z; \
+    MOVQ R11, 24+z; \
+    MOVQ R12, 32+z; \
+    MOVQ R13, 40+z; \
+    MOVQ R14, 48+z;
+
+#define mulA24Legacy \
+    multiplyA24Leg(0(DI),0(SI))
+#define mulA24Bmi2Adx \
+    multiplyA24Adx(0(DI),0(SI))
+
+// func mulA24Amd64(z, x *fp448.Elt)
+TEXT ·mulA24Amd64(SB),NOSPLIT,$0-16
+    MOVQ z+0(FP), DI
+    MOVQ x+8(FP), SI
+    CHECK_BMI2ADX(LMA24, mulA24Legacy, mulA24Bmi2Adx)
+
+// func ladderStepAmd64(w *[5]fp448.Elt, b uint)
+// ladderStepAmd64 calculates a point addition and doubling as follows:
+// (x2,z2) = 2*(x2,z2) and (x3,z3) = (x2,z2)+(x3,z3) using as a difference (x1,-).
+//    w    = {x1,x2,z2,x3,z4} are five fp255.Elt of 56 bytes.
+//  stack  = (t0,t1) are two fp.Elt of fp.Size bytes, and
+//           (b0,b1) are two-double precision fp.Elt of 2*fp.Size bytes.
+TEXT ·ladderStepAmd64(SB),NOSPLIT,$336-16
+    // Parameters
+    #define regWork DI
+    #define regMove SI
+    #define x1 0*Size(regWork)
+    #define x2 1*Size(regWork)
+    #define z2 2*Size(regWork)
+    #define x3 3*Size(regWork)
+    #define z3 4*Size(regWork)
+    // Local variables
+    #define t0 0*Size(SP)
+    #define t1 1*Size(SP)
+    #define b0 2*Size(SP)
+    #define b1 4*Size(SP)
+    MOVQ w+0(FP), regWork
+    MOVQ b+8(FP), regMove
+    CHECK_BMI2ADX(LLADSTEP, ladderStepLeg, ladderStepBmi2Adx)
+    #undef regWork
+    #undef regMove
+    #undef x1
+    #undef x2
+    #undef z2
+    #undef x3
+    #undef z3
+    #undef t0
+    #undef t1
+    #undef b0
+    #undef b1
+
+// func diffAddAmd64(work *[5]fp.Elt, swap uint)
+// diffAddAmd64 calculates a differential point addition using a precomputed point.
+// (x1,z1) = (x1,z1)+(mu) using a difference point (x2,z2)
+//    work = {mu,x1,z1,x2,z2} are five fp448.Elt of 56 bytes, and
+//   stack = (b0,b1) are two-double precision fp.Elt of 2*fp.Size bytes.
+// This is Equation 7 at https://eprint.iacr.org/2017/264.
+TEXT ·diffAddAmd64(SB),NOSPLIT,$224-16
+    // Parameters
+    #define regWork DI
+    #define regSwap SI
+    #define ui 0*Size(regWork)
+    #define x1 1*Size(regWork)
+    #define z1 2*Size(regWork)
+    #define x2 3*Size(regWork)
+    #define z2 4*Size(regWork)
+    // Local variables
+    #define b0 0*Size(SP)
+    #define b1 2*Size(SP)
+    MOVQ w+0(FP), regWork
+    MOVQ b+8(FP), regSwap
+    cswap(x1,x2,regSwap)
+    cswap(z1,z2,regSwap)
+    CHECK_BMI2ADX(LDIFADD, difAddLeg, difAddBmi2Adx)
+    #undef regWork
+    #undef regSwap
+    #undef ui
+    #undef x1
+    #undef z1
+    #undef x2
+    #undef z2
+    #undef b0
+    #undef b1
+
+// func doubleAmd64(x, z *fp448.Elt)
+// doubleAmd64 calculates a point doubling (x1,z1) = 2*(x1,z1).
+//  stack = (t0,t1) are two fp.Elt of fp.Size bytes, and
+//          (b0,b1) are two-double precision fp.Elt of 2*fp.Size bytes.
+TEXT ·doubleAmd64(SB),NOSPLIT,$336-16
+    // Parameters
+    #define x1 0(DI)
+    #define z1 0(SI)
+    // Local variables
+    #define t0 0*Size(SP)
+    #define t1 1*Size(SP)
+    #define b0 2*Size(SP)
+    #define b1 4*Size(SP)
+    MOVQ x+0(FP), DI
+    MOVQ z+8(FP), SI
+    CHECK_BMI2ADX(LDOUB,doubleLeg,doubleBmi2Adx)
+    #undef x1
+    #undef z1
+    #undef t0
+    #undef t1
+    #undef b0
+    #undef b1
diff --git a/.ci/providerlint/vendor/github.com/cloudflare/circl/dh/x448/curve_generic.go b/.ci/providerlint/vendor/github.com/cloudflare/circl/dh/x448/curve_generic.go
new file mode 100644
index 00000000000..b0b65ccf7eb
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/cloudflare/circl/dh/x448/curve_generic.go
@@ -0,0 +1,100 @@
+package x448
+
+import (
+	"encoding/binary"
+	"math/bits"
+
+	"github.com/cloudflare/circl/math/fp448"
+)
+
+func doubleGeneric(x, z *fp448.Elt) {
+	t0, t1 := &fp448.Elt{}, &fp448.Elt{}
+	fp448.AddSub(x, z)
+	fp448.Sqr(x, x)
+	fp448.Sqr(z, z)
+	fp448.Sub(t0, x, z)
+	mulA24Generic(t1, t0)
+	fp448.Add(t1, t1, z)
+	fp448.Mul(x, x, z)
+	fp448.Mul(z, t0, t1)
+}
+
+func diffAddGeneric(w *[5]fp448.Elt, b uint) {
+	mu, x1, z1, x2, z2 := &w[0], &w[1], &w[2], &w[3], &w[4]
+	fp448.Cswap(x1, x2, b)
+	fp448.Cswap(z1, z2, b)
+	fp448.AddSub(x1, z1)
+	fp448.Mul(z1, z1, mu)
+	fp448.AddSub(x1, z1)
+	fp448.Sqr(x1, x1)
+	fp448.Sqr(z1, z1)
+	fp448.Mul(x1, x1, z2)
+	fp448.Mul(z1, z1, x2)
+}
+
+func ladderStepGeneric(w *[5]fp448.Elt, b uint) {
+	x1, x2, z2, x3, z3 := &w[0], &w[1], &w[2], &w[3], &w[4]
+	t0 := &fp448.Elt{}
+	t1 := &fp448.Elt{}
+	fp448.AddSub(x2, z2)
+	fp448.AddSub(x3, z3)
+	fp448.Mul(t0, x2, z3)
+	fp448.Mul(t1, x3, z2)
+	fp448.AddSub(t0, t1)
+	fp448.Cmov(x2, x3, b)
+	fp448.Cmov(z2, z3, b)
+	fp448.Sqr(x3, t0)
+	fp448.Sqr(z3, t1)
+	fp448.Mul(z3, x1, z3)
+	fp448.Sqr(x2, x2)
+	fp448.Sqr(z2, z2)
+	fp448.Sub(t0, x2, z2)
+	mulA24Generic(t1, t0)
+	fp448.Add(t1, t1, z2)
+	fp448.Mul(x2, x2, z2)
+	fp448.Mul(z2, t0, t1)
+}
+
+func mulA24Generic(z, x *fp448.Elt) {
+	const A24 = 39082
+	const n = 8
+	var xx [7]uint64
+	for i := range xx {
+		xx[i] = binary.LittleEndian.Uint64(x[i*n : (i+1)*n])
+	}
+	h0, l0 := bits.Mul64(xx[0], A24)
+	h1, l1 := bits.Mul64(xx[1], A24)
+	h2, l2 := bits.Mul64(xx[2], A24)
+	h3, l3 := bits.Mul64(xx[3], A24)
+	h4, l4 := bits.Mul64(xx[4], A24)
+	h5, l5 := bits.Mul64(xx[5], A24)
+	h6, l6 := bits.Mul64(xx[6], A24)
+
+	l1, c0 := bits.Add64(h0, l1, 0)
+	l2, c1 := bits.Add64(h1, l2, c0)
+	l3, c2 := bits.Add64(h2, l3, c1)
+	l4, c3 := bits.Add64(h3, l4, c2)
+	l5, c4 := bits.Add64(h4, l5, c3)
+	l6, c5 := bits.Add64(h5, l6, c4)
+	l7, _ := bits.Add64(h6, 0, c5)
+
+	l0, c0 = bits.Add64(l0, l7, 0)
+	l1, c1 = bits.Add64(l1, 0, c0)
+	l2, c2 = bits.Add64(l2, 0, c1)
+	l3, c3 = bits.Add64(l3, l7<<32, c2)
+	l4, c4 = bits.Add64(l4, 0, c3)
+	l5, c5 = bits.Add64(l5, 0, c4)
+	l6, l7 = bits.Add64(l6, 0, c5)
+
+	xx[0], c0 = bits.Add64(l0, l7, 0)
+	xx[1], c1 = bits.Add64(l1, 0, c0)
+	xx[2], c2 = bits.Add64(l2, 0, c1)
+	xx[3], c3 = bits.Add64(l3, l7<<32, c2)
+	xx[4], c4 = bits.Add64(l4, 0, c3)
+	xx[5], c5 = bits.Add64(l5, 0, c4)
+	xx[6], _ = bits.Add64(l6, 0, c5)
+
+	for i := range xx {
+		binary.LittleEndian.PutUint64(z[i*n:(i+1)*n], xx[i])
+	}
+}
diff --git a/.ci/providerlint/vendor/github.com/cloudflare/circl/dh/x448/curve_noasm.go b/.ci/providerlint/vendor/github.com/cloudflare/circl/dh/x448/curve_noasm.go
new file mode 100644
index 00000000000..3755b7c83b3
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/cloudflare/circl/dh/x448/curve_noasm.go
@@ -0,0 +1,11 @@
+//go:build !amd64 || purego
+// +build !amd64 purego
+
+package x448
+
+import fp "github.com/cloudflare/circl/math/fp448"
+
+func double(x, z *fp.Elt)             { doubleGeneric(x, z) }
+func diffAdd(w *[5]fp.Elt, b uint)    { diffAddGeneric(w, b) }
+func ladderStep(w *[5]fp.Elt, b uint) { ladderStepGeneric(w, b) }
+func mulA24(z, x *fp.Elt)             { mulA24Generic(z, x) }
diff --git a/.ci/providerlint/vendor/github.com/cloudflare/circl/dh/x448/doc.go b/.ci/providerlint/vendor/github.com/cloudflare/circl/dh/x448/doc.go
new file mode 100644
index 00000000000..c02904fedae
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/cloudflare/circl/dh/x448/doc.go
@@ -0,0 +1,19 @@
+/*
+Package x448 provides Diffie-Hellman functions as specified in RFC-7748.
+
+Validation of public keys.
+
+The Diffie-Hellman function, as described in RFC-7748 [1], works for any
+public key. However, if a different protocol requires contributory
+behaviour [2,3], then the public keys must be validated against low-order
+points [3,4]. To do that, the Shared function performs this validation
+internally and returns false when the public key is invalid (i.e., it
+is a low-order point).
+
+References:
+  - [1] RFC7748 by Langley, Hamburg, Turner (https://rfc-editor.org/rfc/rfc7748.txt)
+  - [2] Curve25519 by Bernstein (https://cr.yp.to/ecdh.html)
+  - [3] Bernstein (https://cr.yp.to/ecdh.html#validate)
+  - [4] Cremers&Jackson (https://eprint.iacr.org/2019/526)
+*/
+package x448
diff --git a/.ci/providerlint/vendor/github.com/cloudflare/circl/dh/x448/key.go b/.ci/providerlint/vendor/github.com/cloudflare/circl/dh/x448/key.go
new file mode 100644
index 00000000000..2fdde51168a
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/cloudflare/circl/dh/x448/key.go
@@ -0,0 +1,46 @@
+package x448
+
+import (
+	"crypto/subtle"
+
+	fp "github.com/cloudflare/circl/math/fp448"
+)
+
+// Size is the length in bytes of a X448 key.
+const Size = 56
+
+// Key represents a X448 key.
+type Key [Size]byte
+
+func (k *Key) clamp(in *Key) *Key {
+	*k = *in
+	k[0] &= 252
+	k[55] |= 128
+	return k
+}
+
+// isValidPubKey verifies if the public key is not a low-order point.
+func (k *Key) isValidPubKey() bool {
+	fp.Modp((*fp.Elt)(k))
+	var isLowOrder int
+	for _, P := range lowOrderPoints {
+		isLowOrder |= subtle.ConstantTimeCompare(P[:], k[:])
+	}
+	return isLowOrder == 0
+}
+
+// KeyGen obtains a public key given a secret key.
+func KeyGen(public, secret *Key) {
+	ladderJoye(public.clamp(secret))
+}
+
+// Shared calculates Alice's shared key from Alice's secret key and Bob's
+// public key returning true on success. A failure case happens when the public
+// key is a low-order point, thus the shared key is all-zeros and the function
+// returns false.
+func Shared(shared, secret, public *Key) bool {
+	validPk := *public
+	ok := validPk.isValidPubKey()
+	ladderMontgomery(shared.clamp(secret), &validPk)
+	return ok
+}
diff --git a/.ci/providerlint/vendor/github.com/cloudflare/circl/dh/x448/table.go b/.ci/providerlint/vendor/github.com/cloudflare/circl/dh/x448/table.go
new file mode 100644
index 00000000000..eef53c30f80
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/cloudflare/circl/dh/x448/table.go
@@ -0,0 +1,460 @@
+package x448
+
+import fp "github.com/cloudflare/circl/math/fp448"
+
+// tableGenerator contains the set of points:
+//
+//	t[i] = (xi+1)/(xi-1),
+//
+// where (xi,yi) = 2^iG and G is the generator point
+// Size = (448)*(448/8) = 25088 bytes.
+var tableGenerator = [448 * fp.Size]byte{
+	/* (2^  0)P */ 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f,
+	/* (2^  1)P */ 0x37, 0xfa, 0xaa, 0x0d, 0x86, 0xa6, 0x24, 0xe9, 0x6c, 0x95, 0x08, 0x34, 0xba, 0x1a, 0x81, 0x3a, 0xae, 0x01, 0xa5, 0xa7, 0x05, 0x85, 0x96, 0x00, 0x06, 0x5a, 0xd7, 0xff, 0xee, 0x8e, 0x8f, 0x94, 0xd2, 0xdc, 0xd7, 0xfc, 0xe7, 0xe5, 0x99, 0x1d, 0x05, 0x46, 0x43, 0xe8, 0xbc, 0x12, 0xb7, 0xeb, 0x30, 0x5e, 0x7a, 0x85, 0x68, 0xed, 0x9d, 0x28,
+	/* (2^  2)P */ 0xf1, 0x7d, 0x08, 0x2b, 0x32, 0x4a, 0x62, 0x80, 0x36, 0xe7, 0xa4, 0x76, 0x5a, 0x2a, 0x1e, 0xf7, 0x9e, 0x3c, 0x40, 0x46, 0x9a, 0x1b, 0x61, 0xc1, 0xbf, 0x1a, 0x1b, 0xae, 0x91, 0x80, 0xa3, 0x76, 0x6c, 0xd4, 0x8f, 0xa4, 0xee, 0x26, 0x39, 0x23, 0xa4, 0x80, 0xf4, 0x66, 0x92, 0xe4, 0xe1, 0x18, 0x76, 0xc5, 0xe2, 0x19, 0x87, 0xd5, 0xc3, 0xe8,
+	/* (2^  3)P */ 0xfb, 0xc9, 0xf0, 0x07, 0xf2, 0x93, 0xd8, 0x50, 0x36, 0xed, 0xfb, 0xbd, 0xb2, 0xd3, 0xfc, 0xdf, 0xd5, 0x2a, 0x6e, 0x26, 0x09, 0xce, 0xd4, 0x07, 0x64, 0x9f, 0x40, 0x74, 0xad, 0x98, 0x2f, 0x1c, 0xb6, 0xdc, 0x2d, 0x42, 0xff, 0xbf, 0x97, 0xd8, 0xdb, 0xef, 0x99, 0xca, 0x73, 0x99, 0x1a, 0x04, 0x3b, 0x56, 0x2c, 0x1f, 0x87, 0x9d, 0x9f, 0x03,
+	/* (2^  4)P */ 0x4c, 0x35, 0x97, 0xf7, 0x81, 0x2c, 0x84, 0xa6, 0xe0, 0xcb, 0xce, 0x37, 0x4c, 0x21, 0x1c, 0x67, 0xfa, 0xab, 0x18, 0x4d, 0xef, 0xd0, 0xf0, 0x44, 0xa9, 0xfb, 0xc0, 0x8e, 0xda, 0x57, 0xa1, 0xd8, 0xeb, 0x87, 0xf4, 0x17, 0xea, 0x66, 0x0f, 0x16, 0xea, 0xcd, 0x5f, 0x3e, 0x88, 0xea, 0x09, 0x68, 0x40, 0xdf, 0x43, 0xcc, 0x54, 0x61, 0x58, 0xaa,
+	/* (2^  5)P */ 0x8d, 0xe7, 0x59, 0xd7, 0x5e, 0x63, 0x37, 0xa7, 0x3f, 0xd1, 0x49, 0x85, 0x01, 0xdd, 0x5e, 0xb3, 0xe6, 0x29, 0xcb, 0x25, 0x93, 0xdd, 0x08, 0x96, 0x83, 0x52, 0x76, 0x85, 0xf5, 0x5d, 0x02, 0xbf, 0xe9, 0x6d, 0x15, 0x27, 0xc1, 0x09, 0xd1, 0x14, 0x4d, 0x6e, 0xe8, 0xaf, 0x59, 0x58, 0x34, 0x9d, 0x2a, 0x99, 0x85, 0x26, 0xbe, 0x4b, 0x1e, 0xb9,
+	/* (2^  6)P */ 0x8d, 0xce, 0x94, 0xe2, 0x18, 0x56, 0x0d, 0x82, 0x8e, 0xdf, 0x85, 0x01, 0x8f, 0x93, 0x3c, 0xc6, 0xbd, 0x61, 0xfb, 0xf4, 0x22, 0xc5, 0x16, 0x87, 0xd1, 0xb1, 0x9e, 0x09, 0xc5, 0x83, 0x2e, 0x4a, 0x07, 0x88, 0xee, 0xe0, 0x29, 0x8d, 0x2e, 0x1f, 0x88, 0xad, 0xfd, 0x18, 0x93, 0xb7, 0xed, 0x42, 0x86, 0x78, 0xf0, 0xb8, 0x70, 0xbe, 0x01, 0x67,
+	/* (2^  7)P */ 0xdf, 0x62, 0x2d, 0x94, 0xc7, 0x35, 0x23, 0xda, 0x27, 0xbb, 0x2b, 0xdb, 0x30, 0x80, 0x68, 0x16, 0xa3, 0xae, 0xd7, 0xd2, 0xa7, 0x7c, 0xbf, 0x6a, 0x1d, 0x83, 0xde, 0x96, 0x0a, 0x43, 0xb6, 0x30, 0x37, 0xd6, 0xee, 0x63, 0x59, 0x9a, 0xbf, 0xa3, 0x30, 0x6c, 0xaf, 0x0c, 0xee, 0x3d, 0xcb, 0x35, 0x4b, 0x55, 0x5f, 0x84, 0x85, 0xcb, 0x4f, 0x1e,
+	/* (2^  8)P */ 0x9d, 0x04, 0x68, 0x89, 0xa4, 0xa9, 0x0d, 0x87, 0xc1, 0x70, 0xf1, 0xeb, 0xfb, 0x47, 0x0a, 0xf0, 0xde, 0x67, 0xb7, 0x94, 0xcd, 0x36, 0x43, 0xa5, 0x49, 0x43, 0x67, 0xc3, 0xee, 0x3c, 0x6b, 0xec, 0xd0, 0x1a, 0xf4, 0xad, 0xef, 0x06, 0x4a, 0xe8, 0x46, 0x24, 0xd7, 0x93, 0xbf, 0xf0, 0xe3, 0x81, 0x61, 0xec, 0xea, 0x64, 0xfe, 0x67, 0xeb, 0xc7,
+	/* (2^  9)P */ 0x95, 0x45, 0x79, 0xcf, 0x2c, 0xfd, 0x9b, 0xfe, 0x84, 0x46, 0x4b, 0x8f, 0xa1, 0xcf, 0xc3, 0x04, 0x94, 0x78, 0xdb, 0xc9, 0xa6, 0x01, 0x75, 0xa4, 0xb4, 0x93, 0x72, 0x43, 0xa7, 0x7d, 0xda, 0x31, 0x38, 0x54, 0xab, 0x4e, 0x3f, 0x89, 0xa6, 0xab, 0x57, 0xc0, 0x16, 0x65, 0xdb, 0x92, 0x96, 0xe4, 0xc8, 0xae, 0xe7, 0x4c, 0x7a, 0xeb, 0xbb, 0x5a,
+	/* (2^ 10)P */ 0xbe, 0xfe, 0x86, 0xc3, 0x97, 0xe0, 0x6a, 0x18, 0x20, 0x21, 0xca, 0x22, 0x55, 0xa1, 0xeb, 0xf5, 0x74, 0xe5, 0xc9, 0x59, 0xa7, 0x92, 0x65, 0x15, 0x08, 0x71, 0xd1, 0x09, 0x7e, 0x83, 0xfc, 0xbc, 0x5a, 0x93, 0x38, 0x0d, 0x43, 0x42, 0xfd, 0x76, 0x30, 0xe8, 0x63, 0x60, 0x09, 0x8d, 0x6c, 0xd3, 0xf8, 0x56, 0x3d, 0x68, 0x47, 0xab, 0xa0, 0x1d,
+	/* (2^ 11)P */ 0x38, 0x50, 0x1c, 0xb1, 0xac, 0x88, 0x8f, 0x38, 0xe3, 0x69, 0xe6, 0xfc, 0x4f, 0x8f, 0xe1, 0x9b, 0xb1, 0x1a, 0x09, 0x39, 0x19, 0xdf, 0xcd, 0x98, 0x7b, 0x64, 0x42, 0xf6, 0x11, 0xea, 0xc7, 0xe8, 0x92, 0x65, 0x00, 0x2c, 0x75, 0xb5, 0x94, 0x1e, 0x5b, 0xa6, 0x66, 0x81, 0x77, 0xf3, 0x39, 0x94, 0xac, 0xbd, 0xe4, 0x2a, 0x66, 0x84, 0x9c, 0x60,
+	/* (2^ 12)P */ 0xb5, 0xb6, 0xd9, 0x03, 0x67, 0xa4, 0xa8, 0x0a, 0x4a, 0x2b, 0x9d, 0xfa, 0x13, 0xe1, 0x99, 0x25, 0x4a, 0x5c, 0x67, 0xb9, 0xb2, 0xb7, 0xdd, 0x1e, 0xaf, 0xeb, 0x63, 0x41, 0xb6, 0xb9, 0xa0, 0x87, 0x0a, 0xe0, 0x06, 0x07, 0xaa, 0x97, 0xf8, 0xf9, 0x38, 0x4f, 0xdf, 0x0c, 0x40, 0x7c, 0xc3, 0x98, 0xa9, 0x74, 0xf1, 0x5d, 0xda, 0xd1, 0xc0, 0x0a,
+	/* (2^ 13)P */ 0xf2, 0x0a, 0xab, 0xab, 0x94, 0x50, 0xf0, 0xa3, 0x6f, 0xc6, 0x66, 0xba, 0xa6, 0xdc, 0x44, 0xdd, 0xd6, 0x08, 0xf4, 0xd3, 0xed, 0xb1, 0x40, 0x93, 0xee, 0xf6, 0xb8, 0x8e, 0xb4, 0x7c, 0xb9, 0x82, 0xc9, 0x9d, 0x45, 0x3b, 0x8e, 0x10, 0xcb, 0x70, 0x1e, 0xba, 0x3c, 0x62, 0x50, 0xda, 0xa9, 0x93, 0xb5, 0xd7, 0xd0, 0x6f, 0x29, 0x52, 0x95, 0xae,
+	/* (2^ 14)P */ 0x14, 0x68, 0x69, 0x23, 0xa8, 0x44, 0x87, 0x9e, 0x22, 0x91, 0xe8, 0x92, 0xdf, 0xf7, 0xae, 0xba, 0x1c, 0x96, 0xe1, 0xc3, 0x94, 0xed, 0x6c, 0x95, 0xae, 0x96, 0xa7, 0x15, 0x9f, 0xf1, 0x17, 0x11, 0x92, 0x42, 0xd5, 0xcd, 0x18, 0xe7, 0xa9, 0xb5, 0x2f, 0xcd, 0xde, 0x6c, 0xc9, 0x7d, 0xfc, 0x7e, 0xbd, 0x7f, 0x10, 0x3d, 0x01, 0x00, 0x8d, 0x95,
+	/* (2^ 15)P */ 0x3b, 0x76, 0x72, 0xae, 0xaf, 0x84, 0xf2, 0xf7, 0xd1, 0x6d, 0x13, 0x9c, 0x47, 0xe1, 0xb7, 0xa3, 0x19, 0x16, 0xee, 0x75, 0x45, 0xf6, 0x1a, 0x7b, 0x78, 0x49, 0x79, 0x05, 0x86, 0xf0, 0x7f, 0x9f, 0xfc, 0xc4, 0xbd, 0x86, 0xf3, 0x41, 0xa7, 0xfe, 0x01, 0xd5, 0x67, 0x16, 0x10, 0x5b, 0xa5, 0x16, 0xf3, 0x7f, 0x60, 0xce, 0xd2, 0x0c, 0x8e, 0x4b,
+	/* (2^ 16)P */ 0x4a, 0x07, 0x99, 0x4a, 0x0f, 0x74, 0x91, 0x14, 0x68, 0xb9, 0x48, 0xb7, 0x44, 0x77, 0x9b, 0x4a, 0xe0, 0x68, 0x0e, 0x43, 0x4d, 0x98, 0x98, 0xbf, 0xa8, 0x3a, 0xb7, 0x6d, 0x2a, 0x9a, 0x77, 0x5f, 0x62, 0xf5, 0x6b, 0x4a, 0xb7, 0x7d, 0xe5, 0x09, 0x6b, 0xc0, 0x8b, 0x9c, 0x88, 0x37, 0x33, 0xf2, 0x41, 0xac, 0x22, 0x1f, 0xcf, 0x3b, 0x82, 0x34,
+	/* (2^ 17)P */ 0x00, 0xc3, 0x78, 0x42, 0x32, 0x2e, 0xdc, 0xda, 0xb1, 0x96, 0x21, 0xa4, 0xe4, 0xbb, 0xe9, 0x9d, 0xbb, 0x0f, 0x93, 0xed, 0x26, 0x3d, 0xb5, 0xdb, 0x94, 0x31, 0x37, 0x07, 0xa2, 0xb2, 0xd5, 0x99, 0x0d, 0x93, 0xe1, 0xce, 0x3f, 0x0b, 0x96, 0x82, 0x47, 0xfe, 0x60, 0x6f, 0x8f, 0x61, 0x88, 0xd7, 0x05, 0x95, 0x0b, 0x46, 0x06, 0xb7, 0x32, 0x06,
+	/* (2^ 18)P */ 0x44, 0xf5, 0x34, 0xdf, 0x2f, 0x9c, 0x5d, 0x9f, 0x53, 0x5c, 0x42, 0x8f, 0xc9, 0xdc, 0xd8, 0x40, 0xa2, 0xe7, 0x6a, 0x4a, 0x05, 0xf7, 0x86, 0x77, 0x2b, 0xae, 0x37, 0xed, 0x48, 0xfb, 0xf7, 0x62, 0x7c, 0x17, 0x59, 0x92, 0x41, 0x61, 0x93, 0x38, 0x30, 0xd1, 0xef, 0x54, 0x54, 0x03, 0x17, 0x57, 0x91, 0x15, 0x11, 0x33, 0xb5, 0xfa, 0xfb, 0x17,
+	/* (2^ 19)P */ 0x29, 0xbb, 0xd4, 0xb4, 0x9c, 0xf1, 0x72, 0x94, 0xce, 0x6a, 0x29, 0xa8, 0x89, 0x18, 0x19, 0xf7, 0xb7, 0xcc, 0xee, 0x9a, 0x02, 0xe3, 0xc0, 0xb1, 0xe0, 0xee, 0x83, 0x78, 0xb4, 0x9e, 0x07, 0x87, 0xdf, 0xb0, 0x82, 0x26, 0x4e, 0xa4, 0x0c, 0x33, 0xaf, 0x40, 0x59, 0xb6, 0xdd, 0x52, 0x45, 0xf0, 0xb4, 0xf6, 0xe8, 0x4e, 0x4e, 0x79, 0x1a, 0x5d,
+	/* (2^ 20)P */ 0x27, 0x33, 0x4d, 0x4c, 0x6b, 0x4f, 0x75, 0xb1, 0xbc, 0x1f, 0xab, 0x5b, 0x2b, 0xf0, 0x1c, 0x57, 0x86, 0xdd, 0xfd, 0x60, 0xb0, 0x8c, 0xe7, 0x9a, 0xe5, 0x5c, 0xeb, 0x11, 0x3a, 0xda, 0x22, 0x25, 0x99, 0x06, 0x8d, 0xf4, 0xaf, 0x29, 0x7a, 0xc9, 0xe5, 0xd2, 0x16, 0x9e, 0xd4, 0x63, 0x1d, 0x64, 0xa6, 0x47, 0x96, 0x37, 0x6f, 0x93, 0x2c, 0xcc,
+	/* (2^ 21)P */ 0xc1, 0x94, 0x74, 0x86, 0x75, 0xf2, 0x91, 0x58, 0x23, 0x85, 0x63, 0x76, 0x54, 0xc7, 0xb4, 0x8c, 0xbc, 0x4e, 0xc4, 0xa7, 0xba, 0xa0, 0x55, 0x26, 0x71, 0xd5, 0x33, 0x72, 0xc9, 0xad, 0x1e, 0xf9, 0x5d, 0x78, 0x70, 0x93, 0x4e, 0x85, 0xfc, 0x39, 0x06, 0x73, 0x76, 0xff, 0xe8, 0x64, 0x69, 0x42, 0x45, 0xb2, 0x69, 0xb5, 0x32, 0xe7, 0x2c, 0xde,
+	/* (2^ 22)P */ 0xde, 0x16, 0xd8, 0x33, 0x49, 0x32, 0xe9, 0x0e, 0x3a, 0x60, 0xee, 0x2e, 0x24, 0x75, 0xe3, 0x9c, 0x92, 0x07, 0xdb, 0xad, 0x92, 0xf5, 0x11, 0xdf, 0xdb, 0xb0, 0x17, 0x5c, 0xd6, 0x1a, 0x70, 0x00, 0xb7, 0xe2, 0x18, 0xec, 0xdc, 0xc2, 0x02, 0x93, 0xb3, 0xc8, 0x3f, 0x4f, 0x1b, 0x96, 0xe6, 0x33, 0x8c, 0xfb, 0xcc, 0xa5, 0x4e, 0xe8, 0xe7, 0x11,
+	/* (2^ 23)P */ 0x05, 0x7a, 0x74, 0x52, 0xf8, 0xdf, 0x0d, 0x7c, 0x6a, 0x1a, 0x4e, 0x9a, 0x02, 0x1d, 0xae, 0x77, 0xf8, 0x8e, 0xf9, 0xa2, 0x38, 0x54, 0x50, 0xb2, 0x2c, 0x08, 0x9d, 0x9b, 0x9f, 0xfb, 0x2b, 0x06, 0xde, 0x9d, 0xc2, 0x03, 0x0b, 0x22, 0x2b, 0x10, 0x5b, 0x3a, 0x73, 0x29, 0x8e, 0x3e, 0x37, 0x08, 0x2c, 0x3b, 0xf8, 0x80, 0xc1, 0x66, 0x1e, 0x98,
+	/* (2^ 24)P */ 0xd8, 0xd6, 0x3e, 0xcd, 0x63, 0x8c, 0x2b, 0x41, 0x81, 0xc0, 0x0c, 0x06, 0x87, 0xd6, 0xe7, 0x92, 0xfe, 0xf1, 0x0c, 0x4a, 0x84, 0x5b, 0xaf, 0x40, 0x53, 0x6f, 0x60, 0xd6, 0x6b, 0x76, 0x4b, 0xc2, 0xad, 0xc9, 0xb6, 0xb6, 0x6a, 0xa2, 0xb3, 0xf5, 0xf5, 0xc2, 0x55, 0x83, 0xb2, 0xd3, 0xe9, 0x41, 0x6c, 0x63, 0x51, 0xb8, 0x81, 0x74, 0xc8, 0x2c,
+	/* (2^ 25)P */ 0xb2, 0xaf, 0x1c, 0xee, 0x07, 0xb0, 0x58, 0xa8, 0x2c, 0x6a, 0xc9, 0x2d, 0x62, 0x28, 0x75, 0x0c, 0x40, 0xb6, 0x11, 0x33, 0x96, 0x80, 0x28, 0x6d, 0xd5, 0x9e, 0x87, 0x90, 0x01, 0x66, 0x1d, 0x1c, 0xf8, 0xb4, 0x92, 0xac, 0x38, 0x18, 0x05, 0xc2, 0x4c, 0x4b, 0x54, 0x7d, 0x80, 0x46, 0x87, 0x2d, 0x99, 0x8e, 0x70, 0x80, 0x69, 0x71, 0x8b, 0xed,
+	/* (2^ 26)P */ 0x37, 0xa7, 0x6b, 0x71, 0x36, 0x75, 0x8e, 0xff, 0x0f, 0x42, 0xda, 0x5a, 0x46, 0xa6, 0x97, 0x79, 0x7e, 0x30, 0xb3, 0x8f, 0xc7, 0x3a, 0xa0, 0xcb, 0x1d, 0x9c, 0x78, 0x77, 0x36, 0xc2, 0xe7, 0xf4, 0x2f, 0x29, 0x07, 0xb1, 0x07, 0xfd, 0xed, 0x1b, 0x39, 0x77, 0x06, 0x38, 0x77, 0x0f, 0x50, 0x31, 0x12, 0xbf, 0x92, 0xbf, 0x72, 0x79, 0x54, 0xa9,
+	/* (2^ 27)P */ 0xbd, 0x4d, 0x46, 0x6b, 0x1a, 0x80, 0x46, 0x2d, 0xed, 0xfd, 0x64, 0x6d, 0x94, 0xbc, 0x4a, 0x6e, 0x0c, 0x12, 0xf6, 0x12, 0xab, 0x54, 0x88, 0xd3, 0x85, 0xac, 0x51, 0xae, 0x6f, 0xca, 0xc4, 0xb7, 0xec, 0x22, 0x54, 0x6d, 0x80, 0xb2, 0x1c, 0x63, 0x33, 0x76, 0x6b, 0x8e, 0x6d, 0x59, 0xcd, 0x73, 0x92, 0x5f, 0xff, 0xad, 0x10, 0x35, 0x70, 0x5f,
+	/* (2^ 28)P */ 0xb3, 0x84, 0xde, 0xc8, 0x04, 0x43, 0x63, 0xfa, 0x29, 0xd9, 0xf0, 0x69, 0x65, 0x5a, 0x0c, 0xe8, 0x2e, 0x0b, 0xfe, 0xb0, 0x7a, 0x42, 0xb3, 0xc3, 0xfc, 0xe6, 0xb8, 0x92, 0x29, 0xae, 0xed, 0xec, 0xd5, 0xe8, 0x4a, 0xa1, 0xbd, 0x3b, 0xd3, 0xc0, 0x07, 0xab, 0x65, 0x65, 0x35, 0x9a, 0xa6, 0x5e, 0x78, 0x18, 0x76, 0x1c, 0x15, 0x49, 0xe6, 0x75,
+	/* (2^ 29)P */ 0x45, 0xb3, 0x92, 0xa9, 0xc3, 0xb8, 0x11, 0x68, 0x64, 0x3a, 0x83, 0x5d, 0xa8, 0x94, 0x6a, 0x9d, 0xaa, 0x27, 0x9f, 0x98, 0x5d, 0xc0, 0x29, 0xf0, 0xc0, 0x4b, 0x14, 0x3c, 0x05, 0xe7, 0xf8, 0xbd, 0x38, 0x22, 0x96, 0x75, 0x65, 0x5e, 0x0d, 0x3f, 0xbb, 0x6f, 0xe8, 0x3f, 0x96, 0x76, 0x9f, 0xba, 0xd9, 0x44, 0x92, 0x96, 0x22, 0xe7, 0x52, 0xe7,
+	/* (2^ 30)P */ 0xf4, 0xa3, 0x95, 0x90, 0x47, 0xdf, 0x7d, 0xdc, 0xf4, 0x13, 0x87, 0x67, 0x7d, 0x4f, 0x9d, 0xa0, 0x00, 0x46, 0x72, 0x08, 0xc3, 0xa2, 0x7a, 0x3e, 0xe7, 0x6d, 0x52, 0x7c, 0x11, 0x36, 0x50, 0x83, 0x89, 0x64, 0xcb, 0x1f, 0x08, 0x83, 0x46, 0xcb, 0xac, 0xa6, 0xd8, 0x9c, 0x1b, 0xe8, 0x05, 0x47, 0xc7, 0x26, 0x06, 0x83, 0x39, 0xe9, 0xb1, 0x1c,
+	/* (2^ 31)P */ 0x11, 0xe8, 0xc8, 0x42, 0xbf, 0x30, 0x9c, 0xa3, 0xf1, 0x85, 0x96, 0x95, 0x4f, 0x4f, 0x52, 0xa2, 0xf5, 0x8b, 0x68, 0x24, 0x16, 0xac, 0x9b, 0xa9, 0x27, 0x28, 0x0e, 0x84, 0x03, 0x46, 0x22, 0x5f, 0xf7, 0x0d, 0xa6, 0x85, 0x88, 0xc1, 0x45, 0x4b, 0x85, 0x1a, 0x10, 0x7f, 0xc9, 0x94, 0x20, 0xb0, 0x04, 0x28, 0x12, 0x30, 0xb9, 0xe6, 0x40, 0x6b,
+	/* (2^ 32)P */ 0xac, 0x1b, 0x57, 0xb6, 0x42, 0xdb, 0x81, 0x8d, 0x76, 0xfd, 0x9b, 0x1c, 0x29, 0x30, 0xd5, 0x3a, 0xcc, 0x53, 0xd9, 0x26, 0x7a, 0x0f, 0x9c, 0x2e, 0x79, 0xf5, 0x62, 0xeb, 0x61, 0x9d, 0x9b, 0x80, 0x39, 0xcd, 0x60, 0x2e, 0x1f, 0x08, 0x22, 0xbc, 0x19, 0xb3, 0x2a, 0x43, 0x44, 0xf2, 0x4e, 0x66, 0xf4, 0x36, 0xa6, 0xa7, 0xbc, 0xa4, 0x15, 0x7e,
+	/* (2^ 33)P */ 0xc1, 0x90, 0x8a, 0xde, 0xff, 0x78, 0xc3, 0x73, 0x16, 0xee, 0x76, 0xa0, 0x84, 0x60, 0x8d, 0xe6, 0x82, 0x0f, 0xde, 0x4e, 0xc5, 0x99, 0x34, 0x06, 0x90, 0x44, 0x55, 0xf8, 0x91, 0xd8, 0xe1, 0xe4, 0x2c, 0x8a, 0xde, 0x94, 0x1e, 0x78, 0x25, 0x3d, 0xfd, 0xd8, 0x59, 0x7d, 0xaf, 0x6e, 0xbe, 0x96, 0xbe, 0x3c, 0x16, 0x23, 0x0f, 0x4c, 0xa4, 0x28,
+	/* (2^ 34)P */ 0xba, 0x11, 0x35, 0x57, 0x03, 0xb6, 0xf4, 0x24, 0x89, 0xb8, 0x5a, 0x0d, 0x50, 0x9c, 0xaa, 0x51, 0x7f, 0xa4, 0x0e, 0xfc, 0x71, 0xb3, 0x3b, 0xf1, 0x96, 0x50, 0x23, 0x15, 0xf5, 0xf5, 0xd4, 0x23, 0xdc, 0x8b, 0x26, 0x9e, 0xae, 0xb7, 0x50, 0xcd, 0xc4, 0x25, 0xf6, 0x75, 0x40, 0x9c, 0x37, 0x79, 0x33, 0x60, 0xd4, 0x4b, 0x13, 0x32, 0xee, 0xe2,
+	/* (2^ 35)P */ 0x43, 0xb8, 0x56, 0x59, 0xf0, 0x68, 0x23, 0xb3, 0xea, 0x70, 0x58, 0x4c, 0x1e, 0x5a, 0x16, 0x54, 0x03, 0xb2, 0xf4, 0x73, 0xb6, 0xd9, 0x5c, 0x9c, 0x6f, 0xcf, 0x82, 0x2e, 0x54, 0x15, 0x46, 0x2c, 0xa3, 0xda, 0x4e, 0x87, 0xf5, 0x2b, 0xba, 0x91, 0xa3, 0xa0, 0x89, 0xba, 0x48, 0x2b, 0xfa, 0x64, 0x02, 0x7f, 0x78, 0x03, 0xd1, 0xe8, 0x3b, 0xe9,
+	/* (2^ 36)P */ 0x15, 0xa4, 0x71, 0xd4, 0x0c, 0x24, 0xe9, 0x07, 0xa1, 0x43, 0xf4, 0x7f, 0xbb, 0xa2, 0xa6, 0x6b, 0xfa, 0xb7, 0xea, 0x58, 0xd1, 0x96, 0xb0, 0x24, 0x5c, 0xc7, 0x37, 0x4e, 0x60, 0x0f, 0x40, 0xf2, 0x2f, 0x44, 0x70, 0xea, 0x80, 0x63, 0xfe, 0xfc, 0x46, 0x59, 0x12, 0x27, 0xb5, 0x27, 0xfd, 0xb7, 0x73, 0x0b, 0xca, 0x8b, 0xc2, 0xd3, 0x71, 0x08,
+	/* (2^ 37)P */ 0x26, 0x0e, 0xd7, 0x52, 0x6f, 0xf1, 0xf2, 0x9d, 0xb8, 0x3d, 0xbd, 0xd4, 0x75, 0x97, 0xd8, 0xbf, 0xa8, 0x86, 0x96, 0xa5, 0x80, 0xa0, 0x45, 0x75, 0xf6, 0x77, 0x71, 0xdb, 0x77, 0x96, 0x55, 0x99, 0x31, 0xd0, 0x4f, 0x34, 0xf4, 0x35, 0x39, 0x41, 0xd3, 0x7d, 0xf7, 0xe2, 0x74, 0xde, 0xbe, 0x5b, 0x1f, 0x39, 0x10, 0x21, 0xa3, 0x4d, 0x3b, 0xc8,
+	/* (2^ 38)P */ 0x04, 0x00, 0x2a, 0x45, 0xb2, 0xaf, 0x9b, 0x18, 0x6a, 0xeb, 0x96, 0x28, 0xa4, 0x77, 0xd0, 0x13, 0xcf, 0x17, 0x65, 0xe8, 0xc5, 0x81, 0x28, 0xad, 0x39, 0x7a, 0x0b, 0xaa, 0x55, 0x2b, 0xf3, 0xfc, 0x86, 0x40, 0xad, 0x0d, 0x1e, 0x28, 0xa2, 0x2d, 0xc5, 0xd6, 0x04, 0x15, 0xa2, 0x30, 0x3d, 0x12, 0x8e, 0xd6, 0xb5, 0xf7, 0x69, 0xbb, 0x84, 0x20,
+	/* (2^ 39)P */ 0xd7, 0x7a, 0x77, 0x2c, 0xfb, 0x81, 0x80, 0xe9, 0x1e, 0xc6, 0x36, 0x31, 0x79, 0xc3, 0x7c, 0xa9, 0x57, 0x6b, 0xb5, 0x70, 0xfb, 0xe4, 0xa1, 0xff, 0xfd, 0x21, 0xa5, 0x7c, 0xfa, 0x44, 0xba, 0x0d, 0x96, 0x3d, 0xc4, 0x5c, 0x39, 0x52, 0x87, 0xd7, 0x22, 0x0f, 0x52, 0x88, 0x91, 0x87, 0x96, 0xac, 0xfa, 0x3b, 0xdf, 0xdc, 0x83, 0x8c, 0x99, 0x29,
+	/* (2^ 40)P */ 0x98, 0x6b, 0x3a, 0x8d, 0x83, 0x17, 0xe1, 0x62, 0xd8, 0x80, 0x4c, 0x97, 0xce, 0x6b, 0xaa, 0x10, 0xa7, 0xc4, 0xe9, 0xeb, 0xa5, 0xfb, 0xc9, 0xdd, 0x2d, 0xeb, 0xfc, 0x9a, 0x71, 0xcd, 0x68, 0x6e, 0xc0, 0x35, 0x64, 0x62, 0x1b, 0x95, 0x12, 0xe8, 0x53, 0xec, 0xf0, 0xf4, 0x86, 0x86, 0x78, 0x18, 0xc4, 0xc6, 0xbc, 0x5a, 0x59, 0x8f, 0x7c, 0x7e,
+	/* (2^ 41)P */ 0x7f, 0xd7, 0x1e, 0xc5, 0x83, 0xdc, 0x1f, 0xbe, 0x0b, 0xcf, 0x2e, 0x01, 0x01, 0xed, 0xac, 0x17, 0x3b, 0xed, 0xa4, 0x30, 0x96, 0x0e, 0x14, 0x7e, 0x19, 0x2b, 0xa5, 0x67, 0x1e, 0xb3, 0x34, 0x03, 0xa8, 0xbb, 0x0a, 0x7d, 0x08, 0x2d, 0xd5, 0x53, 0x19, 0x6f, 0x13, 0xd5, 0xc0, 0x90, 0x8a, 0xcc, 0xc9, 0x5c, 0xab, 0x24, 0xd7, 0x03, 0xf6, 0x57,
+	/* (2^ 42)P */ 0x49, 0xcb, 0xb4, 0x96, 0x5f, 0xa6, 0xf8, 0x71, 0x6f, 0x59, 0xad, 0x05, 0x24, 0x2d, 0xaf, 0x67, 0xa8, 0xbe, 0x95, 0xdf, 0x0d, 0x28, 0x5a, 0x7f, 0x6e, 0x87, 0x8c, 0x6e, 0x67, 0x0c, 0xf4, 0xe0, 0x1c, 0x30, 0xc2, 0x66, 0xae, 0x20, 0xa1, 0x34, 0xec, 0x9c, 0xbc, 0xae, 0x3d, 0xa1, 0x28, 0x28, 0x95, 0x1d, 0xc9, 0x3a, 0xa8, 0xfd, 0xfc, 0xa1,
+	/* (2^ 43)P */ 0xe2, 0x2b, 0x9d, 0xed, 0x02, 0x99, 0x67, 0xbb, 0x2e, 0x16, 0x62, 0x05, 0x70, 0xc7, 0x27, 0xb9, 0x1c, 0x3f, 0xf2, 0x11, 0x01, 0xd8, 0x51, 0xa4, 0x18, 0x92, 0xa9, 0x5d, 0xfb, 0xa9, 0xe4, 0x42, 0xba, 0x38, 0x34, 0x1a, 0x4a, 0xc5, 0x6a, 0x37, 0xde, 0xa7, 0x0c, 0xb4, 0x7e, 0x7f, 0xde, 0xa6, 0xee, 0xcd, 0x55, 0x57, 0x05, 0x06, 0xfd, 0x5d,
+	/* (2^ 44)P */ 0x2f, 0x32, 0xcf, 0x2e, 0x2c, 0x7b, 0xbe, 0x9a, 0x0c, 0x57, 0x35, 0xf8, 0x87, 0xda, 0x9c, 0xec, 0x48, 0xf2, 0xbb, 0xe2, 0xda, 0x10, 0x58, 0x20, 0xc6, 0xd3, 0x87, 0xe9, 0xc7, 0x26, 0xd1, 0x9a, 0x46, 0x87, 0x90, 0xda, 0xdc, 0xde, 0xc3, 0xb3, 0xf2, 0xe8, 0x6f, 0x4a, 0xe6, 0xe8, 0x9d, 0x98, 0x36, 0x20, 0x03, 0x47, 0x15, 0x3f, 0x64, 0x59,
+	/* (2^ 45)P */ 0xd4, 0x71, 0x49, 0x0a, 0x67, 0x97, 0xaa, 0x3f, 0xf4, 0x1b, 0x3a, 0x6e, 0x5e, 0x17, 0xcc, 0x0a, 0x8f, 0x81, 0x6a, 0x41, 0x38, 0x77, 0x40, 0x8a, 0x11, 0x42, 0x62, 0xd2, 0x50, 0x32, 0x79, 0x78, 0x28, 0xc2, 0x2e, 0x10, 0x01, 0x94, 0x30, 0x4f, 0x7f, 0x18, 0x17, 0x56, 0x85, 0x4e, 0xad, 0xf7, 0xcb, 0x87, 0x3c, 0x3f, 0x50, 0x2c, 0xc0, 0xba,
+	/* (2^ 46)P */ 0xbc, 0x30, 0x8e, 0x65, 0x8e, 0x57, 0x5b, 0x38, 0x7a, 0xd4, 0x95, 0x52, 0x7a, 0x32, 0x59, 0x69, 0xcd, 0x9d, 0x47, 0x34, 0x5b, 0x55, 0xa5, 0x24, 0x60, 0xdd, 0xc0, 0xc1, 0x62, 0x73, 0x44, 0xae, 0x4c, 0x9c, 0x65, 0x55, 0x1b, 0x9d, 0x8a, 0x29, 0xb0, 0x1a, 0x52, 0xa8, 0xf1, 0xe6, 0x9a, 0xb3, 0xf6, 0xa3, 0xc9, 0x0a, 0x70, 0x7d, 0x0f, 0xee,
+	/* (2^ 47)P */ 0x77, 0xd3, 0xe5, 0x8e, 0xfa, 0x00, 0xeb, 0x1b, 0x7f, 0xdc, 0x68, 0x3f, 0x92, 0xbd, 0xb7, 0x0b, 0xb7, 0xb5, 0x24, 0xdf, 0xc5, 0x67, 0x53, 0xd4, 0x36, 0x79, 0xc4, 0x7b, 0x57, 0xbc, 0x99, 0x97, 0x60, 0xef, 0xe4, 0x01, 0xa1, 0xa7, 0xaa, 0x12, 0x36, 0x29, 0xb1, 0x03, 0xc2, 0x83, 0x1c, 0x2b, 0x83, 0xef, 0x2e, 0x2c, 0x23, 0x92, 0xfd, 0xd1,
+	/* (2^ 48)P */ 0x94, 0xef, 0x03, 0x59, 0xfa, 0x8a, 0x18, 0x76, 0xee, 0x58, 0x08, 0x4d, 0x44, 0xce, 0xf1, 0x52, 0x33, 0x49, 0xf6, 0x69, 0x71, 0xe3, 0xa9, 0xbc, 0x86, 0xe3, 0x43, 0xde, 0x33, 0x7b, 0x90, 0x8b, 0x3e, 0x7d, 0xd5, 0x4a, 0xf0, 0x23, 0x99, 0xa6, 0xea, 0x5f, 0x08, 0xe5, 0xb9, 0x49, 0x8b, 0x0d, 0x6a, 0x21, 0xab, 0x07, 0x62, 0xcd, 0xc4, 0xbe,
+	/* (2^ 49)P */ 0x61, 0xbf, 0x70, 0x14, 0xfa, 0x4e, 0x9e, 0x7c, 0x0c, 0xf8, 0xb2, 0x48, 0x71, 0x62, 0x83, 0xd6, 0xd1, 0xdc, 0x9c, 0x29, 0x66, 0xb1, 0x34, 0x9c, 0x8d, 0xe6, 0x88, 0xaf, 0xbe, 0xdc, 0x4d, 0xeb, 0xb0, 0xe7, 0x28, 0xae, 0xb2, 0x05, 0x56, 0xc6, 0x0e, 0x10, 0x26, 0xab, 0x2c, 0x59, 0x72, 0x03, 0x66, 0xfe, 0x8f, 0x2c, 0x51, 0x2d, 0xdc, 0xae,
+	/* (2^ 50)P */ 0xdc, 0x63, 0xf1, 0x8b, 0x5c, 0x65, 0x0b, 0xf1, 0xa6, 0x22, 0xe2, 0xd9, 0xdb, 0x49, 0xb1, 0x3c, 0x47, 0xc2, 0xfe, 0xac, 0x86, 0x07, 0x52, 0xec, 0xb0, 0x08, 0x69, 0xfb, 0xd1, 0x06, 0xdc, 0x48, 0x5c, 0x3d, 0xb2, 0x4d, 0xb8, 0x1a, 0x4e, 0xda, 0xb9, 0xc1, 0x2b, 0xab, 0x4b, 0x62, 0x81, 0x21, 0x9a, 0xfc, 0x3d, 0x39, 0x83, 0x11, 0x36, 0xeb,
+	/* (2^ 51)P */ 0x94, 0xf3, 0x17, 0xef, 0xf9, 0x60, 0x54, 0xc3, 0xd7, 0x27, 0x35, 0xc5, 0x98, 0x5e, 0xf6, 0x63, 0x6c, 0xa0, 0x4a, 0xd3, 0xa3, 0x98, 0xd9, 0x42, 0xe3, 0xf1, 0xf8, 0x81, 0x96, 0xa9, 0xea, 0x6d, 0x4b, 0x8e, 0x33, 0xca, 0x94, 0x0d, 0xa0, 0xf7, 0xbb, 0x64, 0xa3, 0x36, 0x6f, 0xdc, 0x5a, 0x94, 0x42, 0xca, 0x06, 0xb2, 0x2b, 0x9a, 0x9f, 0x71,
+	/* (2^ 52)P */ 0xec, 0xdb, 0xa6, 0x1f, 0xdf, 0x15, 0x36, 0xa3, 0xda, 0x8a, 0x7a, 0xb6, 0xa7, 0xe3, 0xaf, 0x52, 0xe0, 0x8d, 0xe8, 0xf2, 0x44, 0x20, 0xeb, 0xa1, 0x20, 0xc4, 0x65, 0x3c, 0x7c, 0x6c, 0x49, 0xed, 0x2f, 0x66, 0x23, 0x68, 0x61, 0x91, 0x40, 0x9f, 0x50, 0x19, 0xd1, 0x84, 0xa7, 0xe2, 0xed, 0x34, 0x37, 0xe3, 0xe4, 0x11, 0x7f, 0x87, 0x55, 0x0f,
+	/* (2^ 53)P */ 0xb3, 0xa1, 0x0f, 0xb0, 0x48, 0xc0, 0x4d, 0x96, 0xa7, 0xcf, 0x5a, 0x81, 0xb8, 0x4a, 0x46, 0xef, 0x0a, 0xd3, 0x40, 0x7e, 0x02, 0xe3, 0x63, 0xaa, 0x50, 0xd1, 0x2a, 0x37, 0x22, 0x4a, 0x7f, 0x4f, 0xb6, 0xf9, 0x01, 0x82, 0x78, 0x3d, 0x93, 0x14, 0x11, 0x8a, 0x90, 0x60, 0xcd, 0x45, 0x4e, 0x7b, 0x42, 0xb9, 0x3e, 0x6e, 0x68, 0x1f, 0x36, 0x41,
+	/* (2^ 54)P */ 0x13, 0x73, 0x0e, 0x4f, 0x79, 0x93, 0x9e, 0x29, 0x70, 0x7b, 0x4a, 0x59, 0x1a, 0x9a, 0xf4, 0x55, 0x08, 0xf0, 0xdb, 0x17, 0x58, 0xec, 0x64, 0xad, 0x7f, 0x29, 0xeb, 0x3f, 0x85, 0x4e, 0x60, 0x28, 0x98, 0x1f, 0x73, 0x4e, 0xe6, 0xa8, 0xab, 0xd5, 0xd6, 0xfc, 0xa1, 0x36, 0x6d, 0x15, 0xc6, 0x13, 0x83, 0xa0, 0xc2, 0x6e, 0xd9, 0xdb, 0xc9, 0xcc,
+	/* (2^ 55)P */ 0xff, 0xd8, 0x52, 0xa3, 0xdc, 0x99, 0xcf, 0x3e, 0x19, 0xb3, 0x68, 0xd0, 0xb5, 0x0d, 0xb8, 0xee, 0x3f, 0xef, 0x6e, 0xc0, 0x38, 0x28, 0x44, 0x92, 0x78, 0x91, 0x1a, 0x08, 0x78, 0x6c, 0x65, 0x24, 0xf3, 0xa2, 0x3d, 0xf2, 0xe5, 0x79, 0x62, 0x69, 0x29, 0xf4, 0x22, 0xc5, 0xdb, 0x6a, 0xae, 0xf4, 0x44, 0xa3, 0x6f, 0xc7, 0x86, 0xab, 0xef, 0xef,
+	/* (2^ 56)P */ 0xbf, 0x54, 0x9a, 0x09, 0x5d, 0x17, 0xd0, 0xde, 0xfb, 0xf5, 0xca, 0xff, 0x13, 0x20, 0x88, 0x82, 0x3a, 0xe2, 0xd0, 0x3b, 0xfb, 0x05, 0x76, 0xd1, 0xc0, 0x02, 0x71, 0x3b, 0x94, 0xe8, 0xc9, 0x84, 0xcf, 0xa4, 0xe9, 0x28, 0x7b, 0xf5, 0x09, 0xc3, 0x2b, 0x22, 0x40, 0xf1, 0x68, 0x24, 0x24, 0x7d, 0x9f, 0x6e, 0xcd, 0xfe, 0xb0, 0x19, 0x61, 0xf5,
+	/* (2^ 57)P */ 0xe8, 0x63, 0x51, 0xb3, 0x95, 0x6b, 0x7b, 0x74, 0x92, 0x52, 0x45, 0xa4, 0xed, 0xea, 0x0e, 0x0d, 0x2b, 0x01, 0x1e, 0x2c, 0xbc, 0x91, 0x06, 0x69, 0xdb, 0x1f, 0xb5, 0x77, 0x1d, 0x56, 0xf5, 0xb4, 0x02, 0x80, 0x49, 0x56, 0x12, 0xce, 0x86, 0x05, 0xc9, 0xd9, 0xae, 0xf3, 0x6d, 0xe6, 0x3f, 0x40, 0x52, 0xe9, 0x49, 0x2b, 0x31, 0x06, 0x86, 0x14,
+	/* (2^ 58)P */ 0xf5, 0x09, 0x3b, 0xd2, 0xff, 0xdf, 0x11, 0xa5, 0x1c, 0x99, 0xe8, 0x1b, 0xa4, 0x2c, 0x7d, 0x8e, 0xc8, 0xf7, 0x03, 0x46, 0xfa, 0xb6, 0xde, 0x73, 0x91, 0x7e, 0x5a, 0x7a, 0xd7, 0x9a, 0x5b, 0x80, 0x24, 0x62, 0x5e, 0x92, 0xf1, 0xa3, 0x45, 0xa3, 0x43, 0x92, 0x8a, 0x2a, 0x5b, 0x0c, 0xb4, 0xc8, 0xad, 0x1c, 0xb6, 0x6c, 0x5e, 0x81, 0x18, 0x91,
+	/* (2^ 59)P */ 0x96, 0xb3, 0xca, 0x2b, 0xe3, 0x7a, 0x59, 0x72, 0x17, 0x74, 0x29, 0x21, 0xe7, 0x78, 0x07, 0xad, 0xda, 0xb6, 0xcd, 0xf9, 0x27, 0x4d, 0xc8, 0xf2, 0x98, 0x22, 0xca, 0xf2, 0x33, 0x74, 0x7a, 0xdd, 0x1e, 0x71, 0xec, 0xe3, 0x3f, 0xe2, 0xa2, 0xd2, 0x38, 0x75, 0xb0, 0xd0, 0x0a, 0xcf, 0x7d, 0x36, 0xdc, 0x49, 0x38, 0x25, 0x34, 0x4f, 0x20, 0x9a,
+	/* (2^ 60)P */ 0x2b, 0x6e, 0x04, 0x0d, 0x4f, 0x3d, 0x3b, 0x24, 0xf6, 0x4e, 0x5e, 0x0a, 0xbd, 0x48, 0x96, 0xba, 0x81, 0x8f, 0x39, 0x82, 0x13, 0xe6, 0x72, 0xf3, 0x0f, 0xb6, 0x94, 0xf4, 0xc5, 0x90, 0x74, 0x91, 0xa8, 0xf2, 0xc9, 0xca, 0x9a, 0x4d, 0x98, 0xf2, 0xdf, 0x52, 0x4e, 0x97, 0x2f, 0xeb, 0x84, 0xd3, 0xaf, 0xc2, 0xcc, 0xfb, 0x4c, 0x26, 0x4b, 0xe4,
+	/* (2^ 61)P */ 0x12, 0x9e, 0xfb, 0x9d, 0x78, 0x79, 0x99, 0xdd, 0xb3, 0x0b, 0x2e, 0x56, 0x41, 0x8e, 0x3f, 0x39, 0xb8, 0x97, 0x89, 0x53, 0x9b, 0x8a, 0x3c, 0x40, 0x9d, 0xa4, 0x6c, 0x2e, 0x31, 0x71, 0xc6, 0x0a, 0x41, 0xd4, 0x95, 0x06, 0x5e, 0xc1, 0xab, 0xc2, 0x14, 0xc4, 0xc7, 0x15, 0x08, 0x3a, 0xad, 0x7a, 0xb4, 0x62, 0xa3, 0x0c, 0x90, 0xf4, 0x47, 0x08,
+	/* (2^ 62)P */ 0x7f, 0xec, 0x09, 0x82, 0xf5, 0x94, 0x09, 0x93, 0x32, 0xd3, 0xdc, 0x56, 0x80, 0x7b, 0x5b, 0x22, 0x80, 0x6a, 0x96, 0x72, 0xb1, 0xc2, 0xd9, 0xa1, 0x8b, 0x66, 0x42, 0x16, 0xe2, 0x07, 0xb3, 0x2d, 0xf1, 0x75, 0x35, 0x72, 0xc7, 0x98, 0xbe, 0x63, 0x3b, 0x20, 0x75, 0x05, 0xc1, 0x3e, 0x31, 0x5a, 0xf7, 0xaa, 0xae, 0x4b, 0xdb, 0x1d, 0xd0, 0x74,
+	/* (2^ 63)P */ 0x36, 0x5c, 0x74, 0xe6, 0x5d, 0x59, 0x3f, 0x15, 0x4b, 0x4d, 0x4e, 0x67, 0x41, 0xfe, 0x98, 0x1f, 0x49, 0x76, 0x91, 0x0f, 0x9b, 0xf4, 0xaf, 0x86, 0xaf, 0x66, 0x19, 0xed, 0x46, 0xf1, 0x05, 0x9a, 0xcc, 0xd1, 0x14, 0x1f, 0x82, 0x12, 0x8e, 0xe6, 0xf4, 0xc3, 0x42, 0x5c, 0x4e, 0x33, 0x93, 0xbe, 0x30, 0xe7, 0x64, 0xa9, 0x35, 0x00, 0x4d, 0xf9,
+	/* (2^ 64)P */ 0x1f, 0xc1, 0x1e, 0xb7, 0xe3, 0x7c, 0xfa, 0xa3, 0x6b, 0x76, 0xaf, 0x9c, 0x05, 0x85, 0x4a, 0xa9, 0xfb, 0xe3, 0x7e, 0xf2, 0x49, 0x56, 0xdc, 0x2f, 0x57, 0x10, 0xba, 0x37, 0xb2, 0x62, 0xf5, 0x6b, 0xe5, 0x8f, 0x0a, 0x87, 0xd1, 0x6a, 0xcb, 0x9d, 0x07, 0xd0, 0xf6, 0x38, 0x99, 0x2c, 0x61, 0x4a, 0x4e, 0xd8, 0xd2, 0x88, 0x29, 0x99, 0x11, 0x95,
+	/* (2^ 65)P */ 0x6f, 0xdc, 0xd5, 0xd6, 0xd6, 0xa7, 0x4c, 0x46, 0x93, 0x65, 0x62, 0x23, 0x95, 0x32, 0x9c, 0xde, 0x40, 0x41, 0x68, 0x2c, 0x18, 0x4e, 0x5a, 0x8c, 0xc0, 0xc5, 0xc5, 0xea, 0x5c, 0x45, 0x0f, 0x60, 0x78, 0x39, 0xb6, 0x36, 0x23, 0x12, 0xbc, 0x21, 0x9a, 0xf8, 0x91, 0xac, 0xc4, 0x70, 0xdf, 0x85, 0x8e, 0x3c, 0xec, 0x22, 0x04, 0x98, 0xa8, 0xaa,
+	/* (2^ 66)P */ 0xcc, 0x52, 0x10, 0x5b, 0x4b, 0x6c, 0xc5, 0xfa, 0x3e, 0xd4, 0xf8, 0x1c, 0x04, 0x14, 0x48, 0x33, 0xd9, 0xfc, 0x5f, 0xb0, 0xa5, 0x48, 0x8c, 0x45, 0x8a, 0xee, 0x3e, 0xa7, 0xc1, 0x2e, 0x34, 0xca, 0xf6, 0xc9, 0xeb, 0x10, 0xbb, 0xe1, 0x59, 0x84, 0x25, 0xe8, 0x81, 0x70, 0xc0, 0x09, 0x42, 0xa7, 0x3b, 0x0d, 0x33, 0x00, 0xb5, 0x77, 0xbe, 0x25,
+	/* (2^ 67)P */ 0xcd, 0x1f, 0xbc, 0x7d, 0xef, 0xe5, 0xca, 0x91, 0xaf, 0xa9, 0x59, 0x6a, 0x09, 0xca, 0xd6, 0x1b, 0x3d, 0x55, 0xde, 0xa2, 0x6a, 0x80, 0xd6, 0x95, 0x47, 0xe4, 0x5f, 0x68, 0x54, 0x08, 0xdf, 0x29, 0xba, 0x2a, 0x02, 0x84, 0xe8, 0xe9, 0x00, 0x77, 0x99, 0x36, 0x03, 0xf6, 0x4a, 0x3e, 0x21, 0x81, 0x7d, 0xb8, 0xa4, 0x8a, 0xa2, 0x05, 0xef, 0xbc,
+	/* (2^ 68)P */ 0x7c, 0x59, 0x5f, 0x66, 0xd9, 0xb7, 0x83, 0x43, 0x8a, 0xa1, 0x8d, 0x51, 0x70, 0xba, 0xf2, 0x9b, 0x95, 0xc0, 0x4b, 0x4c, 0xa0, 0x14, 0xd3, 0xa4, 0x5d, 0x4a, 0x37, 0x36, 0x97, 0x31, 0x1e, 0x12, 0xe7, 0xbb, 0x08, 0x67, 0xa5, 0x23, 0xd7, 0xfb, 0x97, 0xd8, 0x6a, 0x03, 0xb1, 0xf8, 0x7f, 0xda, 0x58, 0xd9, 0x3f, 0x73, 0x4a, 0x53, 0xe1, 0x7b,
+	/* (2^ 69)P */ 0x55, 0x83, 0x98, 0x78, 0x6c, 0x56, 0x5e, 0xed, 0xf7, 0x23, 0x3e, 0x4c, 0x7d, 0x09, 0x2d, 0x09, 0x9c, 0x58, 0x8b, 0x32, 0xca, 0xfe, 0xbf, 0x47, 0x03, 0xeb, 0x4d, 0xe7, 0xeb, 0x9c, 0x83, 0x05, 0x68, 0xaa, 0x80, 0x89, 0x44, 0xf9, 0xd4, 0xdc, 0xdb, 0xb1, 0xdb, 0x77, 0xac, 0xf9, 0x2a, 0xae, 0x35, 0xac, 0x74, 0xb5, 0x95, 0x62, 0x18, 0x85,
+	/* (2^ 70)P */ 0xab, 0x82, 0x7e, 0x10, 0xd7, 0xe6, 0x57, 0xd1, 0x66, 0x12, 0x31, 0x9c, 0x9c, 0xa6, 0x27, 0x59, 0x71, 0x2e, 0xeb, 0xa0, 0x68, 0xc5, 0x87, 0x51, 0xf4, 0xca, 0x3f, 0x98, 0x56, 0xb0, 0x89, 0xb1, 0xc7, 0x7b, 0x46, 0xb3, 0xae, 0x36, 0xf2, 0xee, 0x15, 0x1a, 0x60, 0xf4, 0x50, 0x76, 0x4f, 0xc4, 0x53, 0x0d, 0x36, 0x4d, 0x31, 0xb1, 0x20, 0x51,
+	/* (2^ 71)P */ 0xf7, 0x1d, 0x8c, 0x1b, 0x5e, 0xe5, 0x02, 0x6f, 0xc5, 0xa5, 0xe0, 0x5f, 0xc6, 0xb6, 0x63, 0x43, 0xaf, 0x3c, 0x19, 0x6c, 0xf4, 0xaf, 0xa4, 0x33, 0xb1, 0x0a, 0x37, 0x3d, 0xd9, 0x4d, 0xe2, 0x29, 0x24, 0x26, 0x94, 0x7c, 0x02, 0xe4, 0xe2, 0xf2, 0xbe, 0xbd, 0xac, 0x1b, 0x48, 0xb8, 0xdd, 0xe9, 0x0d, 0x9a, 0x50, 0x1a, 0x98, 0x71, 0x6e, 0xdc,
+	/* (2^ 72)P */ 0x9f, 0x40, 0xb1, 0xb3, 0x66, 0x28, 0x6c, 0xfe, 0xa6, 0x7d, 0xf8, 0x3e, 0xb8, 0xf3, 0xde, 0x52, 0x76, 0x52, 0xa3, 0x92, 0x98, 0x23, 0xab, 0x4f, 0x88, 0x97, 0xfc, 0x22, 0xe1, 0x6b, 0x67, 0xcd, 0x13, 0x95, 0xda, 0x65, 0xdd, 0x3b, 0x67, 0x3f, 0x5f, 0x4c, 0xf2, 0x8a, 0xad, 0x98, 0xa7, 0x94, 0x24, 0x45, 0x87, 0x11, 0x7c, 0x75, 0x79, 0x85,
+	/* (2^ 73)P */ 0x70, 0xbf, 0xf9, 0x3b, 0xa9, 0x44, 0x57, 0x72, 0x96, 0xc9, 0xa4, 0x98, 0x65, 0xbf, 0x87, 0xb3, 0x3a, 0x39, 0x12, 0xde, 0xe5, 0x39, 0x01, 0x4f, 0xf7, 0xc0, 0x71, 0x52, 0x36, 0x85, 0xb3, 0x18, 0xf8, 0x14, 0xc0, 0x6d, 0xae, 0x9e, 0x4f, 0xb0, 0x72, 0x87, 0xac, 0x5c, 0xd1, 0x6c, 0x41, 0x6c, 0x90, 0x9d, 0x22, 0x81, 0xe4, 0x2b, 0xea, 0xe5,
+	/* (2^ 74)P */ 0xfc, 0xea, 0x1a, 0x65, 0xd9, 0x49, 0x6a, 0x39, 0xb5, 0x96, 0x72, 0x7b, 0x32, 0xf1, 0xd0, 0xe9, 0x45, 0xd9, 0x31, 0x55, 0xc7, 0x34, 0xe9, 0x5a, 0xec, 0x73, 0x0b, 0x03, 0xc4, 0xb3, 0xe6, 0xc9, 0x5e, 0x0a, 0x17, 0xfe, 0x53, 0x66, 0x7f, 0x21, 0x18, 0x74, 0x54, 0x1b, 0xc9, 0x49, 0x16, 0xd2, 0x48, 0xaf, 0x5b, 0x47, 0x7b, 0xeb, 0xaa, 0xc9,
+	/* (2^ 75)P */ 0x47, 0x04, 0xf5, 0x5a, 0x87, 0x77, 0x9e, 0x21, 0x34, 0x4e, 0x83, 0x88, 0xaf, 0x02, 0x1d, 0xb0, 0x5a, 0x1d, 0x1d, 0x7d, 0x8d, 0x2c, 0xd3, 0x8d, 0x63, 0xa9, 0x45, 0xfb, 0x15, 0x6d, 0x86, 0x45, 0xcd, 0x38, 0x0e, 0xf7, 0x37, 0x79, 0xed, 0x6d, 0x5a, 0xbc, 0x32, 0xcc, 0x66, 0xf1, 0x3a, 0xb2, 0x87, 0x6f, 0x70, 0x71, 0xd9, 0xf2, 0xfa, 0x7b,
+	/* (2^ 76)P */ 0x68, 0x07, 0xdc, 0x61, 0x40, 0xe4, 0xec, 0x32, 0xc8, 0xbe, 0x66, 0x30, 0x54, 0x80, 0xfd, 0x13, 0x7a, 0xef, 0xae, 0xed, 0x2e, 0x00, 0x6d, 0x3f, 0xbd, 0xfc, 0x91, 0x24, 0x53, 0x7f, 0x63, 0x9d, 0x2e, 0xe3, 0x76, 0xe0, 0xf3, 0xe1, 0x8f, 0x7a, 0xc4, 0x77, 0x0c, 0x91, 0xc0, 0xc2, 0x18, 0x6b, 0x04, 0xad, 0xb6, 0x70, 0x9a, 0x64, 0xc5, 0x82,
+	/* (2^ 77)P */ 0x7f, 0xea, 0x13, 0xd8, 0x9e, 0xfc, 0x5b, 0x06, 0xb5, 0x4f, 0xda, 0x38, 0xe0, 0x9c, 0xd2, 0x3a, 0xc1, 0x1c, 0x62, 0x70, 0x7f, 0xc6, 0x24, 0x0a, 0x47, 0x04, 0x01, 0xc4, 0x55, 0x09, 0xd1, 0x7a, 0x07, 0xba, 0xa3, 0x80, 0x4f, 0xc1, 0x65, 0x36, 0x6d, 0xc0, 0x10, 0xcf, 0x94, 0xa9, 0xa2, 0x01, 0x44, 0xd1, 0xf9, 0x1c, 0x4c, 0xfb, 0xf8, 0x99,
+	/* (2^ 78)P */ 0x6c, 0xb9, 0x6b, 0xee, 0x43, 0x5b, 0xb9, 0xbb, 0xee, 0x2e, 0x52, 0xc1, 0xc6, 0xb9, 0x61, 0xd2, 0x93, 0xa5, 0xaf, 0x52, 0xf4, 0xa4, 0x1a, 0x51, 0x61, 0xa7, 0xcb, 0x9e, 0xbb, 0x56, 0x65, 0xe2, 0xbf, 0x75, 0xb9, 0x9c, 0x50, 0x96, 0x60, 0x81, 0x74, 0x47, 0xc0, 0x04, 0x88, 0x71, 0x76, 0x39, 0x9a, 0xa7, 0xb1, 0x4e, 0x43, 0x15, 0xe0, 0xbb,
+	/* (2^ 79)P */ 0xbb, 0xce, 0xe2, 0xbb, 0xf9, 0x17, 0x0f, 0x82, 0x40, 0xad, 0x73, 0xe3, 0xeb, 0x3b, 0x06, 0x1a, 0xcf, 0x8e, 0x6e, 0x28, 0xb8, 0x26, 0xd9, 0x5b, 0xb7, 0xb3, 0xcf, 0xb4, 0x6a, 0x1c, 0xbf, 0x7f, 0xb8, 0xb5, 0x79, 0xcf, 0x45, 0x68, 0x7d, 0xc5, 0xeb, 0xf3, 0xbe, 0x39, 0x40, 0xfc, 0x07, 0x90, 0x7a, 0x62, 0xad, 0x86, 0x08, 0x71, 0x25, 0xe1,
+	/* (2^ 80)P */ 0x9b, 0x46, 0xac, 0xef, 0xc1, 0x4e, 0xa1, 0x97, 0x95, 0x76, 0xf9, 0x1b, 0xc2, 0xb2, 0x6a, 0x41, 0xea, 0x80, 0x3d, 0xe9, 0x08, 0x52, 0x5a, 0xe3, 0xf2, 0x08, 0xc5, 0xea, 0x39, 0x3f, 0x44, 0x71, 0x4d, 0xea, 0x0d, 0x05, 0x23, 0xe4, 0x2e, 0x3c, 0x89, 0xfe, 0x12, 0x8a, 0x95, 0x42, 0x0a, 0x68, 0xea, 0x5a, 0x28, 0x06, 0x9e, 0xe3, 0x5f, 0xe0,
+	/* (2^ 81)P */ 0x00, 0x61, 0x6c, 0x98, 0x9b, 0xe7, 0xb9, 0x06, 0x1c, 0xc5, 0x1b, 0xed, 0xbe, 0xc8, 0xb3, 0xea, 0x87, 0xf0, 0xc4, 0x24, 0x7d, 0xbb, 0x5d, 0xa4, 0x1d, 0x7a, 0x16, 0x00, 0x55, 0x94, 0x67, 0x78, 0xbd, 0x58, 0x02, 0x82, 0x90, 0x53, 0x76, 0xd4, 0x72, 0x99, 0x51, 0x6f, 0x7b, 0xcf, 0x80, 0x30, 0x31, 0x3b, 0x01, 0xc7, 0xc1, 0xef, 0xe6, 0x42,
+	/* (2^ 82)P */ 0xe2, 0x35, 0xaf, 0x4b, 0x79, 0xc6, 0x12, 0x24, 0x99, 0xc0, 0x68, 0xb0, 0x43, 0x3e, 0xe5, 0xef, 0xe2, 0x29, 0xea, 0xb8, 0xb3, 0xbc, 0x6a, 0x53, 0x2c, 0x69, 0x18, 0x5a, 0xf9, 0x15, 0xae, 0x66, 0x58, 0x18, 0xd3, 0x2d, 0x4b, 0x00, 0xfd, 0x84, 0xab, 0x4f, 0xae, 0x70, 0x6b, 0x9e, 0x9a, 0xdf, 0x83, 0xfd, 0x2e, 0x3c, 0xcf, 0xf8, 0x88, 0x5b,
+	/* (2^ 83)P */ 0xa4, 0x90, 0x31, 0x85, 0x13, 0xcd, 0xdf, 0x64, 0xc9, 0xa1, 0x0b, 0xe7, 0xb6, 0x73, 0x8a, 0x1b, 0x22, 0x78, 0x4c, 0xd4, 0xae, 0x48, 0x18, 0x00, 0x00, 0xa8, 0x9f, 0x06, 0xf9, 0xfb, 0x2d, 0xc3, 0xb1, 0x2a, 0xbc, 0x13, 0x99, 0x57, 0xaf, 0xf0, 0x8d, 0x61, 0x54, 0x29, 0xd5, 0xf2, 0x72, 0x00, 0x96, 0xd1, 0x85, 0x12, 0x8a, 0xf0, 0x23, 0xfb,
+	/* (2^ 84)P */ 0x69, 0xc7, 0xdb, 0xd9, 0x92, 0x75, 0x08, 0x9b, 0xeb, 0xa5, 0x93, 0xd1, 0x1a, 0xf4, 0xf5, 0xaf, 0xe6, 0xc4, 0x4a, 0x0d, 0x35, 0x26, 0x39, 0x9d, 0xd3, 0x17, 0x3e, 0xae, 0x2d, 0xbf, 0x73, 0x9f, 0xb7, 0x74, 0x91, 0xd1, 0xd8, 0x5c, 0x14, 0xf9, 0x75, 0xdf, 0xeb, 0xc2, 0x22, 0xd8, 0x14, 0x8d, 0x86, 0x23, 0x4d, 0xd1, 0x2d, 0xdb, 0x6b, 0x42,
+	/* (2^ 85)P */ 0x8c, 0xda, 0xc6, 0xf8, 0x71, 0xba, 0x2b, 0x06, 0x78, 0xae, 0xcc, 0x3a, 0xe3, 0xe3, 0xa1, 0x8b, 0xe2, 0x34, 0x6d, 0x28, 0x9e, 0x46, 0x13, 0x4d, 0x9e, 0xa6, 0x73, 0x49, 0x65, 0x79, 0x88, 0xb9, 0x3a, 0xd1, 0x6d, 0x2f, 0x48, 0x2b, 0x0a, 0x7f, 0x58, 0x20, 0x37, 0xf4, 0x0e, 0xbb, 0x4a, 0x95, 0x58, 0x0c, 0x88, 0x30, 0xc4, 0x74, 0xdd, 0xfd,
+	/* (2^ 86)P */ 0x6d, 0x13, 0x4e, 0x89, 0x2d, 0xa9, 0xa3, 0xed, 0x09, 0xe3, 0x0e, 0x71, 0x3e, 0x4a, 0xab, 0x90, 0xde, 0x03, 0xeb, 0x56, 0x46, 0x60, 0x06, 0xf5, 0x71, 0xe5, 0xee, 0x9b, 0xef, 0xff, 0xc4, 0x2c, 0x9f, 0x37, 0x48, 0x45, 0x94, 0x12, 0x41, 0x81, 0x15, 0x70, 0x91, 0x99, 0x5e, 0x56, 0x6b, 0xf4, 0xa6, 0xc9, 0xf5, 0x69, 0x9d, 0x78, 0x37, 0x57,
+	/* (2^ 87)P */ 0xf3, 0x51, 0x57, 0x7e, 0x43, 0x6f, 0xc6, 0x67, 0x59, 0x0c, 0xcf, 0x94, 0xe6, 0x3d, 0xb5, 0x07, 0xc9, 0x77, 0x48, 0xc9, 0x68, 0x0d, 0x98, 0x36, 0x62, 0x35, 0x38, 0x1c, 0xf5, 0xc5, 0xec, 0x66, 0x78, 0xfe, 0x47, 0xab, 0x26, 0xd6, 0x44, 0xb6, 0x06, 0x0f, 0x89, 0xe3, 0x19, 0x40, 0x1a, 0xe7, 0xd8, 0x65, 0x55, 0xf7, 0x1a, 0xfc, 0xa3, 0x0e,
+	/* (2^ 88)P */ 0x0e, 0x30, 0xa6, 0xb7, 0x58, 0x60, 0x62, 0x2a, 0x6c, 0x13, 0xa8, 0x14, 0x9b, 0xb8, 0xf2, 0x70, 0xd8, 0xb1, 0x71, 0x88, 0x8c, 0x18, 0x31, 0x25, 0x93, 0x90, 0xb4, 0xc7, 0x49, 0xd8, 0xd4, 0xdb, 0x1e, 0x1e, 0x7f, 0xaa, 0xba, 0xc9, 0xf2, 0x5d, 0xa9, 0x3a, 0x43, 0xb4, 0x5c, 0xee, 0x7b, 0xc7, 0x97, 0xb7, 0x66, 0xd7, 0x23, 0xd9, 0x22, 0x59,
+	/* (2^ 89)P */ 0x28, 0x19, 0xa6, 0xf9, 0x89, 0x20, 0x78, 0xd4, 0x6d, 0xcb, 0x79, 0x8f, 0x61, 0x6f, 0xb2, 0x5c, 0x4f, 0xa6, 0x54, 0x84, 0x95, 0x24, 0x36, 0x64, 0xcb, 0x39, 0xe7, 0x8f, 0x97, 0x9c, 0x5c, 0x3c, 0xfb, 0x51, 0x11, 0x01, 0x17, 0xdb, 0xc9, 0x9b, 0x51, 0x03, 0x9a, 0xe9, 0xe5, 0x24, 0x1e, 0xf5, 0xda, 0xe0, 0x48, 0x02, 0x23, 0xd0, 0x2c, 0x81,
+	/* (2^ 90)P */ 0x42, 0x1b, 0xe4, 0x91, 0x85, 0x2a, 0x0c, 0xd2, 0x28, 0x66, 0x57, 0x9e, 0x33, 0x8d, 0x25, 0x71, 0x10, 0x65, 0x76, 0xa2, 0x8c, 0x21, 0x86, 0x81, 0x15, 0xc2, 0x27, 0xeb, 0x54, 0x2d, 0x4f, 0x6c, 0xe6, 0xd6, 0x24, 0x9c, 0x1a, 0x12, 0xb8, 0x81, 0xe2, 0x0a, 0xf3, 0xd3, 0xf0, 0xd3, 0xe1, 0x74, 0x1f, 0x9b, 0x11, 0x47, 0xd0, 0xcf, 0xb6, 0x54,
+	/* (2^ 91)P */ 0x26, 0x45, 0xa2, 0x10, 0xd4, 0x2d, 0xae, 0xc0, 0xb0, 0xe8, 0x86, 0xb3, 0xc7, 0xea, 0x70, 0x87, 0x61, 0xb5, 0xa5, 0x55, 0xbe, 0x88, 0x1d, 0x7a, 0xd9, 0x6f, 0xeb, 0x83, 0xe2, 0x44, 0x7f, 0x98, 0x04, 0xd6, 0x50, 0x9d, 0xa7, 0x86, 0x66, 0x09, 0x63, 0xe1, 0xed, 0x72, 0xb1, 0xe4, 0x1d, 0x3a, 0xfd, 0x47, 0xce, 0x1c, 0xaa, 0x3b, 0x8f, 0x1b,
+	/* (2^ 92)P */ 0xf4, 0x3c, 0x4a, 0xb6, 0xc2, 0x9c, 0xe0, 0x2e, 0xb7, 0x38, 0xea, 0x61, 0x35, 0x97, 0x10, 0x90, 0xae, 0x22, 0x48, 0xb3, 0xa9, 0xc6, 0x7a, 0xbb, 0x23, 0xf2, 0xf8, 0x1b, 0xa7, 0xa1, 0x79, 0xcc, 0xc4, 0xf8, 0x08, 0x76, 0x8a, 0x5a, 0x1c, 0x1b, 0xc5, 0x33, 0x91, 0xa9, 0xb8, 0xb9, 0xd3, 0xf8, 0x49, 0xcd, 0xe5, 0x82, 0x43, 0xf7, 0xca, 0x68,
+	/* (2^ 93)P */ 0x38, 0xba, 0xae, 0x44, 0xfe, 0x57, 0x64, 0x56, 0x7c, 0x0e, 0x9c, 0xca, 0xff, 0xa9, 0x82, 0xbb, 0x38, 0x4a, 0xa7, 0xf7, 0x47, 0xab, 0xbe, 0x6d, 0x23, 0x0b, 0x8a, 0xed, 0xc2, 0xb9, 0x8f, 0xf1, 0xec, 0x91, 0x44, 0x73, 0x64, 0xba, 0xd5, 0x8f, 0x37, 0x38, 0x0d, 0xd5, 0xf8, 0x73, 0x57, 0xb6, 0xc2, 0x45, 0xdc, 0x25, 0xb2, 0xb6, 0xea, 0xd9,
+	/* (2^ 94)P */ 0xbf, 0xe9, 0x1a, 0x40, 0x4d, 0xcc, 0xe6, 0x1d, 0x70, 0x1a, 0x65, 0xcc, 0x34, 0x2c, 0x37, 0x2c, 0x2d, 0x6b, 0x6d, 0xe5, 0x2f, 0x19, 0x9e, 0xe4, 0xe1, 0xaa, 0xd4, 0xab, 0x54, 0xf4, 0xa8, 0xe4, 0x69, 0x2d, 0x8e, 0x4d, 0xd7, 0xac, 0xb0, 0x5b, 0xfe, 0xe3, 0x26, 0x07, 0xc3, 0xf8, 0x1b, 0x43, 0xa8, 0x1d, 0x64, 0xa5, 0x25, 0x88, 0xbb, 0x77,
+	/* (2^ 95)P */ 0x92, 0xcd, 0x6e, 0xa0, 0x79, 0x04, 0x18, 0xf4, 0x11, 0x58, 0x48, 0xb5, 0x3c, 0x7b, 0xd1, 0xcc, 0xd3, 0x14, 0x2c, 0xa0, 0xdd, 0x04, 0x44, 0x11, 0xb3, 0x6d, 0x2f, 0x0d, 0xf5, 0x2a, 0x75, 0x5d, 0x1d, 0xda, 0x86, 0x8d, 0x7d, 0x6b, 0x32, 0x68, 0xb6, 0x6c, 0x64, 0x9e, 0xde, 0x80, 0x88, 0xce, 0x08, 0xbf, 0x0b, 0xe5, 0x8e, 0x4f, 0x1d, 0xfb,
+	/* (2^ 96)P */ 0xaf, 0xe8, 0x85, 0xbf, 0x7f, 0x37, 0x8d, 0x66, 0x7c, 0xd5, 0xd3, 0x96, 0xa5, 0x81, 0x67, 0x95, 0xff, 0x48, 0xde, 0xde, 0xd7, 0x7a, 0x46, 0x34, 0xb1, 0x13, 0x70, 0x29, 0xed, 0x87, 0x90, 0xb0, 0x40, 0x2c, 0xa6, 0x43, 0x6e, 0xb6, 0xbc, 0x48, 0x8a, 0xc1, 0xae, 0xb8, 0xd4, 0xe2, 0xc0, 0x32, 0xb2, 0xa6, 0x2a, 0x8f, 0xb5, 0x16, 0x9e, 0xc3,
+	/* (2^ 97)P */ 0xff, 0x4d, 0xd2, 0xd6, 0x74, 0xef, 0x2c, 0x96, 0xc1, 0x11, 0xa8, 0xb8, 0xfe, 0x94, 0x87, 0x3e, 0xa0, 0xfb, 0x57, 0xa3, 0xfc, 0x7a, 0x7e, 0x6a, 0x59, 0x6c, 0x54, 0xbb, 0xbb, 0xa2, 0x25, 0x38, 0x1b, 0xdf, 0x5d, 0x7b, 0x94, 0x14, 0xde, 0x07, 0x6e, 0xd3, 0xab, 0x02, 0x26, 0x74, 0x16, 0x12, 0xdf, 0x2e, 0x2a, 0xa7, 0xb0, 0xe8, 0x29, 0xc0,
+	/* (2^ 98)P */ 0x6a, 0x38, 0x0b, 0xd3, 0xba, 0x45, 0x23, 0xe0, 0x04, 0x3b, 0x83, 0x39, 0xc5, 0x11, 0xe6, 0xcf, 0x39, 0x0a, 0xb3, 0xb0, 0x3b, 0x27, 0x29, 0x63, 0x1c, 0xf3, 0x00, 0xe6, 0xd2, 0x55, 0x21, 0x1f, 0x84, 0x97, 0x9f, 0x01, 0x49, 0x43, 0x30, 0x5f, 0xe0, 0x1d, 0x24, 0xc4, 0x4e, 0xa0, 0x2b, 0x0b, 0x12, 0x55, 0xc3, 0x27, 0xae, 0x08, 0x83, 0x7c,
+	/* (2^ 99)P */ 0x5d, 0x1a, 0xb7, 0xa9, 0xf5, 0xfd, 0xec, 0xad, 0xb7, 0x87, 0x02, 0x5f, 0x0d, 0x30, 0x4d, 0xe2, 0x65, 0x87, 0xa4, 0x41, 0x45, 0x1d, 0x67, 0xe0, 0x30, 0x5c, 0x13, 0x87, 0xf6, 0x2e, 0x08, 0xc1, 0xc7, 0x12, 0x45, 0xc8, 0x9b, 0xad, 0xb8, 0xd5, 0x57, 0xbb, 0x5c, 0x48, 0x3a, 0xe1, 0x91, 0x5e, 0xf6, 0x4d, 0x8a, 0x63, 0x75, 0x69, 0x0c, 0x01,
+	/* (2^100)P */ 0x8f, 0x53, 0x2d, 0xa0, 0x71, 0x3d, 0xfc, 0x45, 0x10, 0x96, 0xcf, 0x56, 0xf9, 0xbb, 0x40, 0x3c, 0x86, 0x52, 0x76, 0xbe, 0x84, 0xf9, 0xa6, 0x9d, 0x3d, 0x27, 0xbe, 0xb4, 0x00, 0x49, 0x94, 0xf5, 0x5d, 0xe1, 0x62, 0x85, 0x66, 0xe5, 0xb8, 0x20, 0x2c, 0x09, 0x7d, 0x9d, 0x3d, 0x6e, 0x74, 0x39, 0xab, 0xad, 0xa0, 0x90, 0x97, 0x5f, 0xbb, 0xa7,
+	/* (2^101)P */ 0xdb, 0x2d, 0x99, 0x08, 0x16, 0x46, 0x83, 0x7a, 0xa8, 0xea, 0x3d, 0x28, 0x5b, 0x49, 0xfc, 0xb9, 0x6d, 0x00, 0x9e, 0x54, 0x4f, 0x47, 0x64, 0x9b, 0x58, 0x4d, 0x07, 0x0c, 0x6f, 0x29, 0x56, 0x0b, 0x00, 0x14, 0x85, 0x96, 0x41, 0x04, 0xb9, 0x5c, 0xa4, 0xf6, 0x16, 0x73, 0x6a, 0xc7, 0x62, 0x0c, 0x65, 0x2f, 0x93, 0xbf, 0xf7, 0xb9, 0xb7, 0xf1,
+	/* (2^102)P */ 0xeb, 0x6d, 0xb3, 0x46, 0x32, 0xd2, 0xcb, 0x08, 0x94, 0x14, 0xbf, 0x3f, 0xc5, 0xcb, 0x5f, 0x9f, 0x8a, 0x89, 0x0c, 0x1b, 0x45, 0xad, 0x4c, 0x50, 0xb4, 0xe1, 0xa0, 0x6b, 0x11, 0x92, 0xaf, 0x1f, 0x00, 0xcc, 0xe5, 0x13, 0x7e, 0xe4, 0x2e, 0xa0, 0x57, 0xf3, 0xa7, 0x84, 0x79, 0x7a, 0xc2, 0xb7, 0xb7, 0xfc, 0x5d, 0xa5, 0xa9, 0x64, 0xcc, 0xd8,
+	/* (2^103)P */ 0xa9, 0xc4, 0x12, 0x8b, 0x34, 0x78, 0x3e, 0x38, 0xfd, 0x3f, 0x87, 0xfa, 0x88, 0x94, 0xd5, 0xd9, 0x7f, 0xeb, 0x58, 0xff, 0xb9, 0x45, 0xdb, 0xa1, 0xed, 0x22, 0x28, 0x1d, 0x00, 0x6d, 0x79, 0x85, 0x7a, 0x75, 0x5d, 0xf0, 0xb1, 0x9e, 0x47, 0x28, 0x8c, 0x62, 0xdf, 0xfb, 0x4c, 0x7b, 0xc5, 0x1a, 0x42, 0x95, 0xef, 0x9a, 0xb7, 0x27, 0x7e, 0xda,
+	/* (2^104)P */ 0xca, 0xd5, 0xc0, 0x17, 0xa1, 0x66, 0x79, 0x9c, 0x2a, 0xb7, 0x0a, 0xfe, 0x62, 0xe4, 0x26, 0x78, 0x90, 0xa7, 0xcb, 0xb0, 0x4f, 0x6d, 0xf9, 0x8f, 0xf7, 0x7d, 0xac, 0xb8, 0x78, 0x1f, 0x41, 0xea, 0x97, 0x1e, 0x62, 0x97, 0x43, 0x80, 0x58, 0x80, 0xb6, 0x69, 0x7d, 0xee, 0x16, 0xd2, 0xa1, 0x81, 0xd7, 0xb1, 0x27, 0x03, 0x48, 0xda, 0xab, 0xec,
+	/* (2^105)P */ 0x5b, 0xed, 0x40, 0x8e, 0x8c, 0xc1, 0x66, 0x90, 0x7f, 0x0c, 0xb2, 0xfc, 0xbd, 0x16, 0xac, 0x7d, 0x4c, 0x6a, 0xf9, 0xae, 0xe7, 0x4e, 0x11, 0x12, 0xe9, 0xbe, 0x17, 0x09, 0xc6, 0xc1, 0x5e, 0xb5, 0x7b, 0x50, 0x5c, 0x27, 0xfb, 0x80, 0xab, 0x01, 0xfa, 0x5b, 0x9b, 0x75, 0x16, 0x6e, 0xb2, 0x5c, 0x8c, 0x2f, 0xa5, 0x6a, 0x1a, 0x68, 0xa6, 0x90,
+	/* (2^106)P */ 0x75, 0xfe, 0xb6, 0x96, 0x96, 0x87, 0x4c, 0x12, 0xa9, 0xd1, 0xd8, 0x03, 0xa3, 0xc1, 0x15, 0x96, 0xe8, 0xa0, 0x75, 0x82, 0xa0, 0x6d, 0xea, 0x54, 0xdc, 0x5f, 0x0d, 0x7e, 0xf6, 0x70, 0xb5, 0xdc, 0x7a, 0xf6, 0xc4, 0xd4, 0x21, 0x49, 0xf5, 0xd4, 0x14, 0x6d, 0x48, 0x1d, 0x7c, 0x99, 0x42, 0xdf, 0x78, 0x6b, 0x9d, 0xb9, 0x30, 0x3c, 0xd0, 0x29,
+	/* (2^107)P */ 0x85, 0xd6, 0xd8, 0xf3, 0x91, 0x74, 0xdd, 0xbd, 0x72, 0x96, 0x10, 0xe4, 0x76, 0x02, 0x5a, 0x72, 0x67, 0xd3, 0x17, 0x72, 0x14, 0x9a, 0x20, 0x5b, 0x0f, 0x8d, 0xed, 0x6d, 0x4e, 0xe3, 0xd9, 0x82, 0xc2, 0x99, 0xee, 0x39, 0x61, 0x69, 0x8a, 0x24, 0x01, 0x92, 0x15, 0xe7, 0xfc, 0xf9, 0x4d, 0xac, 0xf1, 0x30, 0x49, 0x01, 0x0b, 0x6e, 0x0f, 0x20,
+	/* (2^108)P */ 0xd8, 0x25, 0x94, 0x5e, 0x43, 0x29, 0xf5, 0xcc, 0xe8, 0xe3, 0x55, 0x41, 0x3c, 0x9f, 0x58, 0x5b, 0x00, 0xeb, 0xc5, 0xdf, 0xcf, 0xfb, 0xfd, 0x6e, 0x92, 0xec, 0x99, 0x30, 0xd6, 0x05, 0xdd, 0x80, 0x7a, 0x5d, 0x6d, 0x16, 0x85, 0xd8, 0x9d, 0x43, 0x65, 0xd8, 0x2c, 0x33, 0x2f, 0x5c, 0x41, 0xea, 0xb7, 0x95, 0x77, 0xf2, 0x9e, 0x59, 0x09, 0xe8,
+	/* (2^109)P */ 0x00, 0xa0, 0x03, 0x80, 0xcd, 0x60, 0xe5, 0x17, 0xd4, 0x15, 0x99, 0xdd, 0x4f, 0xbf, 0x66, 0xb8, 0xc0, 0xf5, 0xf9, 0xfc, 0x6d, 0x42, 0x18, 0x34, 0x1c, 0x7d, 0x5b, 0xb5, 0x09, 0xd0, 0x99, 0x57, 0x81, 0x0b, 0x62, 0xb3, 0xa2, 0xf9, 0x0b, 0xae, 0x95, 0xb8, 0xc2, 0x3b, 0x0d, 0x5b, 0x00, 0xf1, 0xed, 0xbc, 0x05, 0x9d, 0x61, 0xbc, 0x73, 0x9d,
+	/* (2^110)P */ 0xd4, 0xdb, 0x29, 0xe5, 0x85, 0xe9, 0xc6, 0x89, 0x2a, 0xa8, 0x54, 0xab, 0xb3, 0x7f, 0x88, 0xc0, 0x4d, 0xe0, 0xd1, 0x74, 0x6e, 0xa3, 0xa7, 0x39, 0xd5, 0xcc, 0xa1, 0x8a, 0xcb, 0x5b, 0x34, 0xad, 0x92, 0xb4, 0xd8, 0xd5, 0x17, 0xf6, 0x77, 0x18, 0x9e, 0xaf, 0x45, 0x3b, 0x03, 0xe2, 0xf8, 0x52, 0x60, 0xdc, 0x15, 0x20, 0x9e, 0xdf, 0xd8, 0x5d,
+	/* (2^111)P */ 0x02, 0xc1, 0xac, 0x1a, 0x15, 0x8e, 0x6c, 0xf5, 0x1e, 0x1e, 0xba, 0x7e, 0xc2, 0xda, 0x7d, 0x02, 0xda, 0x43, 0xae, 0x04, 0x70, 0x28, 0x54, 0x78, 0x94, 0xf5, 0x4f, 0x07, 0x84, 0x8f, 0xed, 0xaa, 0xc0, 0xb8, 0xcd, 0x7f, 0x7e, 0x33, 0xa3, 0xbe, 0x21, 0x29, 0xc8, 0x56, 0x34, 0xc0, 0x76, 0x87, 0x8f, 0xc7, 0x73, 0x58, 0x90, 0x16, 0xfc, 0xd6,
+	/* (2^112)P */ 0xb8, 0x3f, 0xe1, 0xdf, 0x3a, 0x91, 0x25, 0x0c, 0xf6, 0x47, 0xa8, 0x89, 0xc4, 0xc6, 0x61, 0xec, 0x86, 0x2c, 0xfd, 0xbe, 0xa4, 0x6f, 0xc2, 0xd4, 0x46, 0x19, 0x70, 0x5d, 0x09, 0x02, 0x86, 0xd3, 0x4b, 0xe9, 0x16, 0x7b, 0xf0, 0x0d, 0x6c, 0xff, 0x91, 0x05, 0xbf, 0x55, 0xb4, 0x00, 0x8d, 0xe5, 0x6d, 0x68, 0x20, 0x90, 0x12, 0xb5, 0x5c, 0x32,
+	/* (2^113)P */ 0x80, 0x45, 0xc8, 0x51, 0x87, 0xba, 0x1c, 0x5c, 0xcf, 0x5f, 0x4b, 0x3c, 0x9e, 0x3b, 0x36, 0xd2, 0x26, 0xa2, 0x7f, 0xab, 0xb7, 0xbf, 0xda, 0x68, 0x23, 0x8f, 0xc3, 0xa0, 0xfd, 0xad, 0xf1, 0x56, 0x3b, 0xd0, 0x75, 0x2b, 0x44, 0x61, 0xd8, 0xf4, 0xf1, 0x05, 0x49, 0x53, 0x07, 0xee, 0x47, 0xef, 0xc0, 0x7c, 0x9d, 0xe4, 0x15, 0x88, 0xc5, 0x47,
+	/* (2^114)P */ 0x2d, 0xb5, 0x09, 0x80, 0xb9, 0xd3, 0xd8, 0xfe, 0x4c, 0xd2, 0xa6, 0x6e, 0xd3, 0x75, 0xcf, 0xb0, 0x99, 0xcb, 0x50, 0x8d, 0xe9, 0x67, 0x9b, 0x20, 0xe8, 0x57, 0xd8, 0x14, 0x85, 0x73, 0x6a, 0x74, 0xe0, 0x99, 0xf0, 0x6b, 0x6e, 0x59, 0x30, 0x31, 0x33, 0x96, 0x5f, 0xa1, 0x0c, 0x1b, 0xf4, 0xca, 0x09, 0xe1, 0x9b, 0xb5, 0xcf, 0x6d, 0x0b, 0xeb,
+	/* (2^115)P */ 0x1a, 0xde, 0x50, 0xa9, 0xac, 0x3e, 0x10, 0x43, 0x4f, 0x82, 0x4f, 0xc0, 0xfe, 0x3f, 0x33, 0xd2, 0x64, 0x86, 0x50, 0xa9, 0x51, 0x76, 0x5e, 0x50, 0x97, 0x6c, 0x73, 0x8d, 0x77, 0xa3, 0x75, 0x03, 0xbc, 0xc9, 0xfb, 0x50, 0xd9, 0x6d, 0x16, 0xad, 0x5d, 0x32, 0x3d, 0xac, 0x44, 0xdf, 0x51, 0xf7, 0x19, 0xd4, 0x0b, 0x57, 0x78, 0x0b, 0x81, 0x4e,
+	/* (2^116)P */ 0x32, 0x24, 0xf1, 0x6c, 0x55, 0x62, 0x1d, 0xb3, 0x1f, 0xda, 0xfa, 0x6a, 0x8f, 0x98, 0x01, 0x16, 0xde, 0x44, 0x50, 0x0d, 0x2e, 0x6c, 0x0b, 0xa2, 0xd3, 0x74, 0x0e, 0xa9, 0xbf, 0x8d, 0xa9, 0xc8, 0xc8, 0x2f, 0x62, 0xc1, 0x35, 0x5e, 0xfd, 0x3a, 0xb3, 0x83, 0x2d, 0xee, 0x4e, 0xfd, 0x5c, 0x5e, 0xad, 0x85, 0xa5, 0x10, 0xb5, 0x4f, 0x34, 0xa7,
+	/* (2^117)P */ 0xd1, 0x58, 0x6f, 0xe6, 0x54, 0x2c, 0xc2, 0xcd, 0xcf, 0x83, 0xdc, 0x88, 0x0c, 0xb9, 0xb4, 0x62, 0x18, 0x89, 0x65, 0x28, 0xe9, 0x72, 0x4b, 0x65, 0xcf, 0xd6, 0x90, 0x88, 0xd7, 0x76, 0x17, 0x4f, 0x74, 0x64, 0x1e, 0xcb, 0xd3, 0xf5, 0x4b, 0xaa, 0x2e, 0x4d, 0x2d, 0x7c, 0x13, 0x1f, 0xfd, 0xd9, 0x60, 0x83, 0x7e, 0xda, 0x64, 0x1c, 0xdc, 0x9f,
+	/* (2^118)P */ 0xad, 0xef, 0xac, 0x1b, 0xc1, 0x30, 0x5a, 0x15, 0xc9, 0x1f, 0xac, 0xf1, 0xca, 0x44, 0x95, 0x95, 0xea, 0xf2, 0x22, 0xe7, 0x8d, 0x25, 0xf0, 0xff, 0xd8, 0x71, 0xf7, 0xf8, 0x8f, 0x8f, 0xcd, 0xf4, 0x1e, 0xfe, 0x6c, 0x68, 0x04, 0xb8, 0x78, 0xa1, 0x5f, 0xa6, 0x5d, 0x5e, 0xf9, 0x8d, 0xea, 0x80, 0xcb, 0xf3, 0x17, 0xa6, 0x03, 0xc9, 0x38, 0xd5,
+	/* (2^119)P */ 0x79, 0x14, 0x31, 0xc3, 0x38, 0xe5, 0xaa, 0xbf, 0x17, 0xa3, 0x04, 0x4e, 0x80, 0x59, 0x9c, 0x9f, 0x19, 0x39, 0xe4, 0x2d, 0x23, 0x54, 0x4a, 0x7f, 0x3e, 0xf3, 0xd9, 0xc7, 0xba, 0x6c, 0x8f, 0x6b, 0xfa, 0x34, 0xb5, 0x23, 0x17, 0x1d, 0xff, 0x1d, 0xea, 0x1f, 0xd7, 0xba, 0x61, 0xb2, 0xe0, 0x38, 0x6a, 0xe9, 0xcf, 0x48, 0x5d, 0x6a, 0x10, 0x9c,
+	/* (2^120)P */ 0xc8, 0xbb, 0x13, 0x1c, 0x3f, 0x3c, 0x34, 0xfd, 0xac, 0x37, 0x52, 0x44, 0x25, 0xa8, 0xde, 0x1d, 0x63, 0xf4, 0x81, 0x9a, 0xbe, 0x0b, 0x74, 0x2e, 0xc8, 0x51, 0x16, 0xd3, 0xac, 0x4a, 0xaf, 0xe2, 0x5f, 0x3a, 0x89, 0x32, 0xd1, 0x9b, 0x7c, 0x90, 0x0d, 0xac, 0xdc, 0x8b, 0x73, 0x45, 0x45, 0x97, 0xb1, 0x90, 0x2c, 0x1b, 0x31, 0xca, 0xb1, 0x94,
+	/* (2^121)P */ 0x07, 0x28, 0xdd, 0x10, 0x14, 0xa5, 0x95, 0x7e, 0xf3, 0xe4, 0xd4, 0x14, 0xb4, 0x7e, 0x76, 0xdb, 0x42, 0xd6, 0x94, 0x3e, 0xeb, 0x44, 0x64, 0x88, 0x0d, 0xec, 0xc1, 0x21, 0xf0, 0x79, 0xe0, 0x83, 0x67, 0x55, 0x53, 0xc2, 0xf6, 0xc5, 0xc5, 0x89, 0x39, 0xe8, 0x42, 0xd0, 0x17, 0xbd, 0xff, 0x35, 0x59, 0x0e, 0xc3, 0x06, 0x86, 0xd4, 0x64, 0xcf,
+	/* (2^122)P */ 0x91, 0xa8, 0xdb, 0x57, 0x9b, 0xe2, 0x96, 0x31, 0x10, 0x6e, 0xd7, 0x9a, 0x97, 0xb3, 0xab, 0xb5, 0x15, 0x66, 0xbe, 0xcc, 0x6d, 0x9a, 0xac, 0x06, 0xb3, 0x0d, 0xaa, 0x4b, 0x9c, 0x96, 0x79, 0x6c, 0x34, 0xee, 0x9e, 0x53, 0x4d, 0x6e, 0xbd, 0x88, 0x02, 0xbf, 0x50, 0x54, 0x12, 0x5d, 0x01, 0x02, 0x46, 0xc6, 0x74, 0x02, 0x8c, 0x24, 0xae, 0xb1,
+	/* (2^123)P */ 0xf5, 0x22, 0xea, 0xac, 0x7d, 0x9c, 0x33, 0x8a, 0xa5, 0x36, 0x79, 0x6a, 0x4f, 0xa4, 0xdc, 0xa5, 0x73, 0x64, 0xc4, 0x6f, 0x43, 0x02, 0x3b, 0x94, 0x66, 0xd2, 0x4b, 0x4f, 0xf6, 0x45, 0x33, 0x5d, 0x10, 0x33, 0x18, 0x1e, 0xa3, 0xfc, 0xf7, 0xd2, 0xb8, 0xc8, 0xa7, 0xe0, 0x76, 0x8a, 0xcd, 0xff, 0x4f, 0x99, 0x34, 0x47, 0x84, 0x91, 0x96, 0x9f,
+	/* (2^124)P */ 0x8a, 0x48, 0x3b, 0x48, 0x4a, 0xbc, 0xac, 0xe2, 0x80, 0xd6, 0xd2, 0x35, 0xde, 0xd0, 0x56, 0x42, 0x33, 0xb3, 0x56, 0x5a, 0xcd, 0xb8, 0x3d, 0xb5, 0x25, 0xc1, 0xed, 0xff, 0x87, 0x0b, 0x79, 0xff, 0xf2, 0x62, 0xe1, 0x76, 0xc6, 0xa2, 0x0f, 0xa8, 0x9b, 0x0d, 0xcc, 0x3f, 0x3d, 0x35, 0x27, 0x8d, 0x0b, 0x74, 0xb0, 0xc3, 0x78, 0x8c, 0xcc, 0xc8,
+	/* (2^125)P */ 0xfc, 0x9a, 0x0c, 0xa8, 0x49, 0x42, 0xb8, 0xdf, 0xcf, 0xb3, 0x19, 0xa6, 0x64, 0x57, 0xfe, 0xe8, 0xf8, 0xa6, 0x4b, 0x86, 0xa1, 0xd5, 0x83, 0x7f, 0x14, 0x99, 0x18, 0x0c, 0x7d, 0x5b, 0xf7, 0x3d, 0xf9, 0x4b, 0x79, 0xb1, 0x86, 0x30, 0xb4, 0x5e, 0x6a, 0xe8, 0x9d, 0xfa, 0x8a, 0x41, 0xc4, 0x30, 0xfc, 0x56, 0x74, 0x14, 0x42, 0xc8, 0x96, 0x0e,
+	/* (2^126)P */ 0xdf, 0x66, 0xec, 0xbc, 0x44, 0xdb, 0x19, 0xce, 0xd4, 0xb5, 0x49, 0x40, 0x07, 0x49, 0xe0, 0x3a, 0x61, 0x10, 0xfb, 0x7d, 0xba, 0xb1, 0xe0, 0x28, 0x5b, 0x99, 0x59, 0x96, 0xa2, 0xee, 0xe0, 0x23, 0x37, 0x39, 0x1f, 0xe6, 0x57, 0x9f, 0xf8, 0xf8, 0xdc, 0x74, 0xf6, 0x8f, 0x4f, 0x5e, 0x51, 0xa4, 0x12, 0xac, 0xbe, 0xe4, 0xf3, 0xd1, 0xf0, 0x24,
+	/* (2^127)P */ 0x1e, 0x3e, 0x9a, 0x5f, 0xdf, 0x9f, 0xd6, 0x4e, 0x8a, 0x28, 0xc3, 0xcd, 0x96, 0x9d, 0x57, 0xc7, 0x61, 0x81, 0x90, 0xff, 0xae, 0xb1, 0x4f, 0xc2, 0x96, 0x8b, 0x1a, 0x18, 0xf4, 0x50, 0xcb, 0x31, 0xe1, 0x57, 0xf4, 0x90, 0xa8, 0xea, 0xac, 0xe7, 0x61, 0x98, 0xb6, 0x15, 0xc1, 0x7b, 0x29, 0xa4, 0xc3, 0x18, 0xef, 0xb9, 0xd8, 0xdf, 0xf6, 0xac,
+	/* (2^128)P */ 0xca, 0xa8, 0x6c, 0xf1, 0xb4, 0xca, 0xfe, 0x31, 0xee, 0x48, 0x38, 0x8b, 0x0e, 0xbb, 0x7a, 0x30, 0xaa, 0xf9, 0xee, 0x27, 0x53, 0x24, 0xdc, 0x2e, 0x15, 0xa6, 0x48, 0x8f, 0xa0, 0x7e, 0xf1, 0xdc, 0x93, 0x87, 0x39, 0xeb, 0x7f, 0x38, 0x92, 0x92, 0x4c, 0x29, 0xe9, 0x57, 0xd8, 0x59, 0xfc, 0xe9, 0x9c, 0x44, 0xc0, 0x65, 0xcf, 0xac, 0x4b, 0xdc,
+	/* (2^129)P */ 0xa3, 0xd0, 0x37, 0x8f, 0x86, 0x2f, 0xc6, 0x47, 0x55, 0x46, 0x65, 0x26, 0x4b, 0x91, 0xe2, 0x18, 0x5c, 0x4f, 0x23, 0xc1, 0x37, 0x29, 0xb9, 0xc1, 0x27, 0xc5, 0x3c, 0xbf, 0x7e, 0x23, 0xdb, 0x73, 0x99, 0xbd, 0x1b, 0xb2, 0x31, 0x68, 0x3a, 0xad, 0xb7, 0xb0, 0x10, 0xc5, 0xe5, 0x11, 0x51, 0xba, 0xa7, 0x60, 0x66, 0x54, 0xf0, 0x08, 0xd7, 0x69,
+	/* (2^130)P */ 0x89, 0x41, 0x79, 0xcc, 0xeb, 0x0a, 0xf5, 0x4b, 0xa3, 0x4c, 0xce, 0x52, 0xb0, 0xa7, 0xe4, 0x41, 0x75, 0x7d, 0x04, 0xbb, 0x09, 0x4c, 0x50, 0x9f, 0xdf, 0xea, 0x74, 0x61, 0x02, 0xad, 0xb4, 0x9d, 0xb7, 0x05, 0xb9, 0xea, 0xeb, 0x91, 0x35, 0xe7, 0x49, 0xea, 0xd3, 0x4f, 0x3c, 0x60, 0x21, 0x7a, 0xde, 0xc7, 0xe2, 0x5a, 0xee, 0x8e, 0x93, 0xc7,
+	/* (2^131)P */ 0x00, 0xe8, 0xed, 0xd0, 0xb3, 0x0d, 0xaf, 0xb2, 0xde, 0x2c, 0xf6, 0x00, 0xe2, 0xea, 0x6d, 0xf8, 0x0e, 0xd9, 0x67, 0x59, 0xa9, 0x50, 0xbb, 0x17, 0x8f, 0xff, 0xb1, 0x9f, 0x17, 0xb6, 0xf2, 0xb5, 0xba, 0x80, 0xf7, 0x0f, 0xba, 0xd5, 0x09, 0x43, 0xaa, 0x4e, 0x3a, 0x67, 0x6a, 0x89, 0x9b, 0x18, 0x65, 0x35, 0xf8, 0x3a, 0x49, 0x91, 0x30, 0x51,
+	/* (2^132)P */ 0x8d, 0x25, 0xe9, 0x0e, 0x7d, 0x50, 0x76, 0xe4, 0x58, 0x7e, 0xb9, 0x33, 0xe6, 0x65, 0x90, 0xc2, 0x50, 0x9d, 0x50, 0x2e, 0x11, 0xad, 0xd5, 0x43, 0x52, 0x32, 0x41, 0x4f, 0x7b, 0xb6, 0xa0, 0xec, 0x81, 0x75, 0x36, 0x7c, 0x77, 0x85, 0x59, 0x70, 0xe4, 0xf9, 0xef, 0x66, 0x8d, 0x35, 0xc8, 0x2a, 0x6e, 0x5b, 0xc6, 0x0d, 0x0b, 0x29, 0x60, 0x68,
+	/* (2^133)P */ 0xf8, 0xce, 0xb0, 0x3a, 0x56, 0x7d, 0x51, 0x9a, 0x25, 0x73, 0xea, 0xdd, 0xe4, 0xe0, 0x0e, 0xf0, 0x07, 0xc0, 0x31, 0x00, 0x73, 0x35, 0xd0, 0x39, 0xc4, 0x9b, 0xb7, 0x95, 0xe0, 0x62, 0x70, 0x36, 0x0b, 0xcb, 0xa0, 0x42, 0xde, 0x51, 0xcf, 0x41, 0xe0, 0xb8, 0xb4, 0xc0, 0xe5, 0x46, 0x99, 0x9f, 0x02, 0x7f, 0x14, 0x8c, 0xc1, 0x4e, 0xef, 0xe8,
+	/* (2^134)P */ 0x10, 0x01, 0x57, 0x0a, 0xbe, 0x8b, 0x18, 0xc8, 0xca, 0x00, 0x28, 0x77, 0x4a, 0x9a, 0xc7, 0x55, 0x2a, 0xcc, 0x0c, 0x7b, 0xb9, 0xe9, 0xc8, 0x97, 0x7c, 0x02, 0xe3, 0x09, 0x2f, 0x62, 0x30, 0xb8, 0x40, 0x09, 0x65, 0xe9, 0x55, 0x63, 0xb5, 0x07, 0xca, 0x9f, 0x00, 0xdf, 0x9d, 0x5c, 0xc7, 0xee, 0x57, 0xa5, 0x90, 0x15, 0x1e, 0x22, 0xa0, 0x12,
+	/* (2^135)P */ 0x71, 0x2d, 0xc9, 0xef, 0x27, 0xb9, 0xd8, 0x12, 0x43, 0x6b, 0xa8, 0xce, 0x3b, 0x6d, 0x6e, 0x91, 0x43, 0x23, 0xbc, 0x32, 0xb3, 0xbf, 0xe1, 0xc7, 0x39, 0xcf, 0x7c, 0x42, 0x4c, 0xb1, 0x30, 0xe2, 0xdd, 0x69, 0x06, 0xe5, 0xea, 0xf0, 0x2a, 0x16, 0x50, 0x71, 0xca, 0x92, 0xdf, 0xc1, 0xcc, 0xec, 0xe6, 0x54, 0x07, 0xf3, 0x18, 0x8d, 0xd8, 0x29,
+	/* (2^136)P */ 0x98, 0x51, 0x48, 0x8f, 0xfa, 0x2e, 0x5e, 0x67, 0xb0, 0xc6, 0x17, 0x12, 0xb6, 0x7d, 0xc9, 0xad, 0x81, 0x11, 0xad, 0x0c, 0x1c, 0x2d, 0x45, 0xdf, 0xac, 0x66, 0xbd, 0x08, 0x6f, 0x7c, 0xc7, 0x06, 0x6e, 0x19, 0x08, 0x39, 0x64, 0xd7, 0xe4, 0xd1, 0x11, 0x5f, 0x1c, 0xf4, 0x67, 0xc3, 0x88, 0x6a, 0xe6, 0x07, 0xa3, 0x83, 0xd7, 0xfd, 0x2a, 0xf9,
+	/* (2^137)P */ 0x87, 0xed, 0xeb, 0xd9, 0xdf, 0xff, 0x43, 0x8b, 0xaa, 0x20, 0x58, 0xb0, 0xb4, 0x6b, 0x14, 0xb8, 0x02, 0xc5, 0x40, 0x20, 0x22, 0xbb, 0xf7, 0xb4, 0xf3, 0x05, 0x1e, 0x4d, 0x94, 0xff, 0xe3, 0xc5, 0x22, 0x82, 0xfe, 0xaf, 0x90, 0x42, 0x98, 0x6b, 0x76, 0x8b, 0x3e, 0x89, 0x3f, 0x42, 0x2a, 0xa7, 0x26, 0x00, 0xda, 0x5c, 0xa2, 0x2b, 0xec, 0xdd,
+	/* (2^138)P */ 0x5c, 0x21, 0x16, 0x0d, 0x46, 0xb8, 0xd0, 0xa7, 0x88, 0xe7, 0x25, 0xcb, 0x3e, 0x50, 0x73, 0x61, 0xe7, 0xaf, 0x5a, 0x3f, 0x47, 0x8b, 0x3d, 0x97, 0x79, 0x2c, 0xe6, 0x6d, 0x95, 0x74, 0x65, 0x70, 0x36, 0xfd, 0xd1, 0x9e, 0x13, 0x18, 0x63, 0xb1, 0x2d, 0x0b, 0xb5, 0x36, 0x3e, 0xe7, 0x35, 0x42, 0x3b, 0xe6, 0x1f, 0x4d, 0x9d, 0x59, 0xa2, 0x43,
+	/* (2^139)P */ 0x8c, 0x0c, 0x7c, 0x24, 0x9e, 0xe0, 0xf8, 0x05, 0x1c, 0x9e, 0x1f, 0x31, 0xc0, 0x70, 0xb3, 0xfb, 0x4e, 0xf8, 0x0a, 0x57, 0xb7, 0x49, 0xb5, 0x73, 0xa1, 0x5f, 0x9b, 0x6a, 0x07, 0x6c, 0x87, 0x71, 0x87, 0xd4, 0xbe, 0x98, 0x1e, 0x98, 0xee, 0x52, 0xc1, 0x7b, 0x95, 0x0f, 0x28, 0x32, 0x36, 0x28, 0xd0, 0x3a, 0x0f, 0x7d, 0x2a, 0xa9, 0x62, 0xb9,
+	/* (2^140)P */ 0x97, 0xe6, 0x18, 0x77, 0xf9, 0x34, 0xac, 0xbc, 0xe0, 0x62, 0x9f, 0x42, 0xde, 0xbd, 0x2f, 0xf7, 0x1f, 0xb7, 0x14, 0x52, 0x8a, 0x79, 0xb2, 0x3f, 0xd2, 0x95, 0x71, 0x01, 0xe8, 0xaf, 0x8c, 0xa4, 0xa4, 0xa7, 0x27, 0xf3, 0x5c, 0xdf, 0x3e, 0x57, 0x7a, 0xf1, 0x76, 0x49, 0xe6, 0x42, 0x3f, 0x8f, 0x1e, 0x63, 0x4a, 0x65, 0xb5, 0x41, 0xf5, 0x02,
+	/* (2^141)P */ 0x72, 0x85, 0xc5, 0x0b, 0xe1, 0x47, 0x64, 0x02, 0xc5, 0x4d, 0x81, 0x69, 0xb2, 0xcf, 0x0f, 0x6c, 0xd4, 0x6d, 0xd0, 0xc7, 0xb4, 0x1c, 0xd0, 0x32, 0x59, 0x89, 0xe2, 0xe0, 0x96, 0x8b, 0x12, 0x98, 0xbf, 0x63, 0x7a, 0x4c, 0x76, 0x7e, 0x58, 0x17, 0x8f, 0x5b, 0x0a, 0x59, 0x65, 0x75, 0xbc, 0x61, 0x1f, 0xbe, 0xc5, 0x6e, 0x0a, 0x57, 0x52, 0x70,
+	/* (2^142)P */ 0x92, 0x1c, 0x77, 0xbb, 0x62, 0x02, 0x6c, 0x25, 0x9c, 0x66, 0x07, 0x83, 0xab, 0xcc, 0x80, 0x5d, 0xd2, 0x76, 0x0c, 0xa4, 0xc5, 0xb4, 0x8a, 0x68, 0x23, 0x31, 0x32, 0x29, 0x8a, 0x47, 0x92, 0x12, 0x80, 0xb3, 0xfa, 0x18, 0xe4, 0x8d, 0xc0, 0x4d, 0xfe, 0x97, 0x5f, 0x72, 0x41, 0xb5, 0x5c, 0x7a, 0xbd, 0xf0, 0xcf, 0x5e, 0x97, 0xaa, 0x64, 0x32,
+	/* (2^143)P */ 0x35, 0x3f, 0x75, 0xc1, 0x7a, 0x75, 0x7e, 0xa9, 0xc6, 0x0b, 0x4e, 0x32, 0x62, 0xec, 0xe3, 0x5c, 0xfb, 0x01, 0x43, 0xb6, 0xd4, 0x5b, 0x75, 0xd2, 0xee, 0x7f, 0x5d, 0x23, 0x2b, 0xb3, 0x54, 0x34, 0x4c, 0xd3, 0xb4, 0x32, 0x84, 0x81, 0xb5, 0x09, 0x76, 0x19, 0xda, 0x58, 0xda, 0x7c, 0xdb, 0x2e, 0xdd, 0x4c, 0x8e, 0xdd, 0x5d, 0x89, 0x10, 0x10,
+	/* (2^144)P */ 0x57, 0x25, 0x6a, 0x08, 0x37, 0x92, 0xa8, 0xdf, 0x24, 0xef, 0x8f, 0x33, 0x34, 0x52, 0xa4, 0x4c, 0xf0, 0x77, 0x9f, 0x69, 0x77, 0xd5, 0x8f, 0xd2, 0x9a, 0xb3, 0xb6, 0x1d, 0x2d, 0xa6, 0xf7, 0x1f, 0xda, 0xd7, 0xcb, 0x75, 0x11, 0xc3, 0x6b, 0xc0, 0x38, 0xb1, 0xd5, 0x2d, 0x96, 0x84, 0x16, 0xfa, 0x26, 0xb9, 0xcc, 0x3f, 0x16, 0x47, 0x23, 0x74,
+	/* (2^145)P */ 0x9b, 0x61, 0x2a, 0x1c, 0xdd, 0x39, 0xa5, 0xfa, 0x1c, 0x7d, 0x63, 0x50, 0xca, 0xe6, 0x9d, 0xfa, 0xb7, 0xc4, 0x4c, 0x6a, 0x97, 0x5f, 0x36, 0x4e, 0x47, 0xdd, 0x17, 0xf7, 0xf9, 0x19, 0xce, 0x75, 0x17, 0xad, 0xce, 0x2a, 0xf3, 0xfe, 0x27, 0x8f, 0x3e, 0x48, 0xc0, 0x60, 0x87, 0x24, 0x19, 0xae, 0x59, 0xe4, 0x5a, 0x00, 0x2a, 0xba, 0xa2, 0x1f,
+	/* (2^146)P */ 0x26, 0x88, 0x42, 0x60, 0x9f, 0x6e, 0x2c, 0x7c, 0x39, 0x0f, 0x47, 0x6a, 0x0e, 0x02, 0xbb, 0x4b, 0x34, 0x29, 0x55, 0x18, 0x36, 0xcf, 0x3b, 0x47, 0xf1, 0x2e, 0xfc, 0x6e, 0x94, 0xff, 0xe8, 0x6b, 0x06, 0xd2, 0xba, 0x77, 0x5e, 0x60, 0xd7, 0x19, 0xef, 0x02, 0x9d, 0x3a, 0xc2, 0xb7, 0xa9, 0xd8, 0x57, 0xee, 0x7e, 0x2b, 0xf2, 0x6d, 0x28, 0xda,
+	/* (2^147)P */ 0xdf, 0xd9, 0x92, 0x11, 0x98, 0x23, 0xe2, 0x45, 0x2f, 0x74, 0x70, 0xee, 0x0e, 0x55, 0x65, 0x79, 0x86, 0x38, 0x17, 0x92, 0x85, 0x87, 0x99, 0x50, 0xd9, 0x7c, 0xdb, 0xa1, 0x10, 0xec, 0x30, 0xb7, 0x40, 0xa3, 0x23, 0x9b, 0x0e, 0x27, 0x49, 0x29, 0x03, 0x94, 0xff, 0x53, 0xdc, 0xd7, 0xed, 0x49, 0xa9, 0x5a, 0x3b, 0xee, 0xd7, 0xc7, 0x65, 0xaf,
+	/* (2^148)P */ 0xa0, 0xbd, 0xbe, 0x03, 0xee, 0x0c, 0xbe, 0x32, 0x00, 0x7b, 0x52, 0xcb, 0x92, 0x29, 0xbf, 0xa0, 0xc6, 0xd9, 0xd2, 0xd6, 0x15, 0xe8, 0x3a, 0x75, 0x61, 0x65, 0x56, 0xae, 0xad, 0x3c, 0x2a, 0x64, 0x14, 0x3f, 0x8e, 0xc1, 0x2d, 0x0c, 0x8d, 0x20, 0xdb, 0x58, 0x4b, 0xe5, 0x40, 0x15, 0x4b, 0xdc, 0xa8, 0xbd, 0xef, 0x08, 0xa7, 0xd1, 0xf4, 0xb0,
+	/* (2^149)P */ 0xa9, 0x0f, 0x05, 0x94, 0x66, 0xac, 0x1f, 0x65, 0x3f, 0xe1, 0xb8, 0xe1, 0x34, 0x5e, 0x1d, 0x8f, 0xe3, 0x93, 0x03, 0x15, 0xff, 0xb6, 0x65, 0xb6, 0x6e, 0xc0, 0x2f, 0xd4, 0x2e, 0xb9, 0x2c, 0x13, 0x3c, 0x99, 0x1c, 0xb5, 0x87, 0xba, 0x79, 0xcb, 0xf0, 0x18, 0x06, 0x86, 0x04, 0x14, 0x25, 0x09, 0xcd, 0x1c, 0x14, 0xda, 0x35, 0xd0, 0x38, 0x3b,
+	/* (2^150)P */ 0x1b, 0x04, 0xa3, 0x27, 0xb4, 0xd3, 0x37, 0x48, 0x1e, 0x8f, 0x69, 0xd3, 0x5a, 0x2f, 0x20, 0x02, 0x36, 0xbe, 0x06, 0x7b, 0x6b, 0x6c, 0x12, 0x5b, 0x80, 0x74, 0x44, 0xe6, 0xf8, 0xf5, 0x95, 0x59, 0x29, 0xab, 0x51, 0x47, 0x83, 0x28, 0xe0, 0xad, 0xde, 0xaa, 0xd3, 0xb1, 0x1a, 0xcb, 0xa3, 0xcd, 0x8b, 0x6a, 0xb1, 0xa7, 0x0a, 0xd1, 0xf9, 0xbe,
+	/* (2^151)P */ 0xce, 0x2f, 0x85, 0xca, 0x74, 0x6d, 0x49, 0xb8, 0xce, 0x80, 0x44, 0xe0, 0xda, 0x5b, 0xcf, 0x2f, 0x79, 0x74, 0xfe, 0xb4, 0x2c, 0x99, 0x20, 0x6e, 0x09, 0x04, 0xfb, 0x6d, 0x57, 0x5b, 0x95, 0x0c, 0x45, 0xda, 0x4f, 0x7f, 0x63, 0xcc, 0x85, 0x5a, 0x67, 0x50, 0x68, 0x71, 0xb4, 0x67, 0xb1, 0x2e, 0xc1, 0x1c, 0xdc, 0xff, 0x2a, 0x7c, 0x10, 0x5e,
+	/* (2^152)P */ 0xa6, 0xde, 0xf3, 0xd4, 0x22, 0x30, 0x24, 0x9e, 0x0b, 0x30, 0x54, 0x59, 0x7e, 0xa2, 0xeb, 0x89, 0x54, 0x65, 0x3e, 0x40, 0xd1, 0xde, 0xe6, 0xee, 0x4d, 0xbf, 0x5e, 0x40, 0x1d, 0xee, 0x4f, 0x68, 0xd9, 0xa7, 0x2f, 0xb3, 0x64, 0xb3, 0xf5, 0xc8, 0xd3, 0xaa, 0x70, 0x70, 0x3d, 0xef, 0xd3, 0x95, 0x54, 0xdb, 0x3e, 0x94, 0x95, 0x92, 0x1f, 0x45,
+	/* (2^153)P */ 0x22, 0x80, 0x1d, 0x9d, 0x96, 0xa5, 0x78, 0x6f, 0xe0, 0x1e, 0x1b, 0x66, 0x42, 0xc8, 0xae, 0x9e, 0x46, 0x45, 0x08, 0x41, 0xdf, 0x80, 0xae, 0x6f, 0xdb, 0x15, 0x5a, 0x21, 0x31, 0x7a, 0xd0, 0xf2, 0x54, 0x15, 0x88, 0xd3, 0x0f, 0x7f, 0x14, 0x5a, 0x14, 0x97, 0xab, 0xf4, 0x58, 0x6a, 0x9f, 0xea, 0x74, 0xe5, 0x6b, 0x90, 0x59, 0x2b, 0x48, 0xd9,
+	/* (2^154)P */ 0x12, 0x24, 0x04, 0xf5, 0x50, 0xc2, 0x8c, 0xb0, 0x7c, 0x46, 0x98, 0xd5, 0x24, 0xad, 0xf6, 0x72, 0xdc, 0x82, 0x1a, 0x60, 0xc1, 0xeb, 0x48, 0xef, 0x7f, 0x6e, 0xe6, 0xcc, 0xdb, 0x7b, 0xae, 0xbe, 0x5e, 0x1e, 0x5c, 0xe6, 0x0a, 0x70, 0xdf, 0xa4, 0xa3, 0x85, 0x1b, 0x1b, 0x7f, 0x72, 0xb9, 0x96, 0x6f, 0xdc, 0x03, 0x76, 0x66, 0xfb, 0xa0, 0x33,
+	/* (2^155)P */ 0x37, 0x40, 0xbb, 0xbc, 0x68, 0x58, 0x86, 0xca, 0xbb, 0xa5, 0x24, 0x76, 0x3d, 0x48, 0xd1, 0xad, 0xb4, 0xa8, 0xcf, 0xc3, 0xb6, 0xa8, 0xba, 0x1a, 0x3a, 0xbe, 0x33, 0x75, 0x04, 0x5c, 0x13, 0x8c, 0x0d, 0x70, 0x8d, 0xa6, 0x4e, 0x2a, 0xeb, 0x17, 0x3c, 0x22, 0xdd, 0x3e, 0x96, 0x40, 0x11, 0x9e, 0x4e, 0xae, 0x3d, 0xf8, 0x91, 0xd7, 0x50, 0xc8,
+	/* (2^156)P */ 0xd8, 0xca, 0xde, 0x19, 0xcf, 0x00, 0xe4, 0x73, 0x18, 0x7f, 0x9b, 0x9f, 0xf4, 0x5b, 0x49, 0x49, 0x99, 0xdc, 0xa4, 0x46, 0x21, 0xb5, 0xd7, 0x3e, 0xb7, 0x47, 0x1b, 0xa9, 0x9f, 0x4c, 0x69, 0x7d, 0xec, 0x33, 0xd6, 0x1c, 0x51, 0x7f, 0x47, 0x74, 0x7a, 0x6c, 0xf3, 0xd2, 0x2e, 0xbf, 0xdf, 0x6c, 0x9e, 0x77, 0x3b, 0x34, 0xf6, 0x73, 0x80, 0xed,
+	/* (2^157)P */ 0x16, 0xfb, 0x16, 0xc3, 0xc2, 0x83, 0xe4, 0xf4, 0x03, 0x7f, 0x52, 0xb0, 0x67, 0x51, 0x7b, 0x24, 0x5a, 0x51, 0xd3, 0xb6, 0x4e, 0x59, 0x76, 0xcd, 0x08, 0x7b, 0x1d, 0x7a, 0x9c, 0x65, 0xae, 0xce, 0xaa, 0xd2, 0x1c, 0x85, 0x66, 0x68, 0x06, 0x15, 0xa8, 0x06, 0xe6, 0x16, 0x37, 0xf4, 0x49, 0x9e, 0x0f, 0x50, 0x37, 0xb1, 0xb2, 0x93, 0x70, 0x43,
+	/* (2^158)P */ 0x18, 0x3a, 0x16, 0xe5, 0x8d, 0xc8, 0x35, 0xd6, 0x7b, 0x09, 0xec, 0x61, 0x5f, 0x5c, 0x2a, 0x19, 0x96, 0x2e, 0xc3, 0xfd, 0xab, 0xe6, 0x23, 0xae, 0xab, 0xc5, 0xcb, 0xb9, 0x7b, 0x2d, 0x34, 0x51, 0xb9, 0x41, 0x9e, 0x7d, 0xca, 0xda, 0x25, 0x45, 0x14, 0xb0, 0xc7, 0x4d, 0x26, 0x2b, 0xfe, 0x43, 0xb0, 0x21, 0x5e, 0xfa, 0xdc, 0x7c, 0xf9, 0x5a,
+	/* (2^159)P */ 0x94, 0xad, 0x42, 0x17, 0xf5, 0xcd, 0x1c, 0x0d, 0xf6, 0x41, 0xd2, 0x55, 0xbb, 0x50, 0xf1, 0xc6, 0xbc, 0xa6, 0xc5, 0x3a, 0xfd, 0x9b, 0x75, 0x3e, 0xf6, 0x1a, 0xa7, 0xb2, 0x6e, 0x64, 0x12, 0xdc, 0x3c, 0xe5, 0xf6, 0xfc, 0x3b, 0xfa, 0x43, 0x81, 0xd4, 0xa5, 0xee, 0xf5, 0x9c, 0x47, 0x2f, 0xd0, 0x9c, 0xde, 0xa1, 0x48, 0x91, 0x9a, 0x34, 0xc1,
+	/* (2^160)P */ 0x37, 0x1b, 0xb3, 0x88, 0xc9, 0x98, 0x4e, 0xfb, 0x84, 0x4f, 0x2b, 0x0a, 0xb6, 0x8f, 0x35, 0x15, 0xcd, 0x61, 0x7a, 0x5f, 0x5c, 0xa0, 0xca, 0x23, 0xa0, 0x93, 0x1f, 0xcc, 0x3c, 0x39, 0x3a, 0x24, 0xa7, 0x49, 0xad, 0x8d, 0x59, 0xcc, 0x94, 0x5a, 0x16, 0xf5, 0x70, 0xe8, 0x52, 0x1e, 0xee, 0x20, 0x30, 0x17, 0x7e, 0xf0, 0x4c, 0x93, 0x06, 0x5a,
+	/* (2^161)P */ 0x81, 0xba, 0x3b, 0xd7, 0x3e, 0xb4, 0x32, 0x3a, 0x22, 0x39, 0x2a, 0xfc, 0x19, 0xd9, 0xd2, 0xf6, 0xc5, 0x79, 0x6c, 0x0e, 0xde, 0xda, 0x01, 0xff, 0x52, 0xfb, 0xb6, 0x95, 0x4e, 0x7a, 0x10, 0xb8, 0x06, 0x86, 0x3c, 0xcd, 0x56, 0xd6, 0x15, 0xbf, 0x6e, 0x3e, 0x4f, 0x35, 0x5e, 0xca, 0xbc, 0xa5, 0x95, 0xa2, 0xdf, 0x2d, 0x1d, 0xaf, 0x59, 0xf9,
+	/* (2^162)P */ 0x69, 0xe5, 0xe2, 0xfa, 0xc9, 0x7f, 0xdd, 0x09, 0xf5, 0x6b, 0x4e, 0x2e, 0xbe, 0xb4, 0xbf, 0x3e, 0xb2, 0xf2, 0x81, 0x30, 0xe1, 0x07, 0xa8, 0x0d, 0x2b, 0xd2, 0x5a, 0x55, 0xbe, 0x4b, 0x86, 0x5d, 0xb0, 0x5e, 0x7c, 0x8f, 0xc1, 0x3c, 0x81, 0x4c, 0xf7, 0x6d, 0x7d, 0xe6, 0x4f, 0x8a, 0x85, 0xc2, 0x2f, 0x28, 0xef, 0x8c, 0x69, 0xc2, 0xc2, 0x1a,
+	/* (2^163)P */ 0xd9, 0xe4, 0x0e, 0x1e, 0xc2, 0xf7, 0x2f, 0x9f, 0xa1, 0x40, 0xfe, 0x46, 0x16, 0xaf, 0x2e, 0xd1, 0xec, 0x15, 0x9b, 0x61, 0x92, 0xce, 0xfc, 0x10, 0x43, 0x1d, 0x00, 0xf6, 0xbe, 0x20, 0x80, 0x80, 0x6f, 0x3c, 0x16, 0x94, 0x59, 0xba, 0x03, 0x53, 0x6e, 0xb6, 0xdd, 0x25, 0x7b, 0x86, 0xbf, 0x96, 0xf4, 0x2f, 0xa1, 0x96, 0x8d, 0xf9, 0xb3, 0x29,
+	/* (2^164)P */ 0x3b, 0x04, 0x60, 0x6e, 0xce, 0xab, 0xd2, 0x63, 0x18, 0x53, 0x88, 0x16, 0x4a, 0x6a, 0xab, 0x72, 0x03, 0x68, 0xa5, 0xd4, 0x0d, 0xb2, 0x82, 0x81, 0x1f, 0x2b, 0x5c, 0x75, 0xe8, 0xd2, 0x1d, 0x7f, 0xe7, 0x1b, 0x35, 0x02, 0xde, 0xec, 0xbd, 0xcb, 0xc7, 0x01, 0xd3, 0x95, 0x61, 0xfe, 0xb2, 0x7a, 0x66, 0x09, 0x4c, 0x6d, 0xfd, 0x39, 0xf7, 0x52,
+	/* (2^165)P */ 0x42, 0xc1, 0x5f, 0xf8, 0x35, 0x52, 0xc1, 0xfe, 0xc5, 0x11, 0x80, 0x1c, 0x11, 0x46, 0x31, 0x11, 0xbe, 0xd0, 0xc4, 0xb6, 0x07, 0x13, 0x38, 0xa0, 0x8d, 0x65, 0xf0, 0x56, 0x9e, 0x16, 0xbf, 0x9d, 0xcd, 0x51, 0x34, 0xf9, 0x08, 0x48, 0x7b, 0x76, 0x0c, 0x7b, 0x30, 0x07, 0xa8, 0x76, 0xaf, 0xa3, 0x29, 0x38, 0xb0, 0x58, 0xde, 0x72, 0x4b, 0x45,
+	/* (2^166)P */ 0xd4, 0x16, 0xa7, 0xc0, 0xb4, 0x9f, 0xdf, 0x1a, 0x37, 0xc8, 0x35, 0xed, 0xc5, 0x85, 0x74, 0x64, 0x09, 0x22, 0xef, 0xe9, 0x0c, 0xaf, 0x12, 0x4c, 0x9e, 0xf8, 0x47, 0x56, 0xe0, 0x7f, 0x4e, 0x24, 0x6b, 0x0c, 0xe7, 0xad, 0xc6, 0x47, 0x1d, 0xa4, 0x0d, 0x86, 0x89, 0x65, 0xe8, 0x5f, 0x71, 0xc7, 0xe9, 0xcd, 0xec, 0x6c, 0x62, 0xc7, 0xe3, 0xb3,
+	/* (2^167)P */ 0xb5, 0xea, 0x86, 0xe3, 0x15, 0x18, 0x3f, 0x6d, 0x7b, 0x05, 0x95, 0x15, 0x53, 0x26, 0x1c, 0xeb, 0xbe, 0x7e, 0x16, 0x42, 0x4b, 0xa2, 0x3d, 0xdd, 0x0e, 0xff, 0xba, 0x67, 0xb5, 0xae, 0x7a, 0x17, 0xde, 0x23, 0xad, 0x14, 0xcc, 0xd7, 0xaf, 0x57, 0x01, 0xe0, 0xdd, 0x48, 0xdd, 0xd7, 0xe3, 0xdf, 0xe9, 0x2d, 0xda, 0x67, 0xa4, 0x9f, 0x29, 0x04,
+	/* (2^168)P */ 0x16, 0x53, 0xe6, 0x9c, 0x4e, 0xe5, 0x1e, 0x70, 0x81, 0x25, 0x02, 0x9b, 0x47, 0x6d, 0xd2, 0x08, 0x73, 0xbe, 0x0a, 0xf1, 0x7b, 0xeb, 0x24, 0xeb, 0x38, 0x23, 0x5c, 0xb6, 0x3e, 0xce, 0x1e, 0xe3, 0xbc, 0x82, 0x35, 0x1f, 0xaf, 0x3a, 0x3a, 0xe5, 0x4e, 0xc1, 0xca, 0xbf, 0x47, 0xb4, 0xbb, 0xbc, 0x5f, 0xea, 0xc6, 0xca, 0xf3, 0xa0, 0xa2, 0x73,
+	/* (2^169)P */ 0xef, 0xa4, 0x7a, 0x4e, 0xe4, 0xc7, 0xb6, 0x43, 0x2e, 0xa5, 0xe4, 0xa5, 0xba, 0x1e, 0xa5, 0xfe, 0x9e, 0xce, 0xa9, 0x80, 0x04, 0xcb, 0x4f, 0xd8, 0x74, 0x05, 0x48, 0xfa, 0x99, 0x11, 0x5d, 0x97, 0x3b, 0x07, 0x0d, 0xdd, 0xe6, 0xb1, 0x74, 0x87, 0x1a, 0xd3, 0x26, 0xb7, 0x8f, 0xe1, 0x63, 0x3d, 0xec, 0x53, 0x93, 0xb0, 0x81, 0x78, 0x34, 0xa4,
+	/* (2^170)P */ 0xe1, 0xe7, 0xd4, 0x58, 0x9d, 0x0e, 0x8b, 0x65, 0x66, 0x37, 0x16, 0x48, 0x6f, 0xaa, 0x42, 0x37, 0x77, 0xad, 0xb1, 0x56, 0x48, 0xdf, 0x65, 0x36, 0x30, 0xb8, 0x00, 0x12, 0xd8, 0x32, 0x28, 0x7f, 0xc1, 0x71, 0xeb, 0x93, 0x0f, 0x48, 0x04, 0xe1, 0x5a, 0x6a, 0x96, 0xc1, 0xca, 0x89, 0x6d, 0x1b, 0x82, 0x4c, 0x18, 0x6d, 0x55, 0x4b, 0xea, 0xfd,
+	/* (2^171)P */ 0x62, 0x1a, 0x53, 0xb4, 0xb1, 0xbe, 0x6f, 0x15, 0x18, 0x88, 0xd4, 0x66, 0x61, 0xc7, 0x12, 0x69, 0x02, 0xbd, 0x03, 0x23, 0x2b, 0xef, 0xf9, 0x54, 0xa4, 0x85, 0xa8, 0xe3, 0xb7, 0xbd, 0xa9, 0xa3, 0xf3, 0x2a, 0xdd, 0xf1, 0xd4, 0x03, 0x0f, 0xa9, 0xa1, 0xd8, 0xa3, 0xcd, 0xb2, 0x71, 0x90, 0x4b, 0x35, 0x62, 0xf2, 0x2f, 0xce, 0x67, 0x1f, 0xaa,
+	/* (2^172)P */ 0x9e, 0x1e, 0xcd, 0x43, 0x7e, 0x87, 0x37, 0x94, 0x3a, 0x97, 0x4c, 0x7e, 0xee, 0xc9, 0x37, 0x85, 0xf1, 0xd9, 0x4f, 0xbf, 0xf9, 0x6f, 0x39, 0x9a, 0x39, 0x87, 0x2e, 0x25, 0x84, 0x42, 0xc3, 0x80, 0xcb, 0x07, 0x22, 0xae, 0x30, 0xd5, 0x50, 0xa1, 0x23, 0xcc, 0x31, 0x81, 0x9d, 0xf1, 0x30, 0xd9, 0x2b, 0x73, 0x41, 0x16, 0x50, 0xab, 0x2d, 0xa2,
+	/* (2^173)P */ 0xa4, 0x69, 0x4f, 0xa1, 0x4e, 0xb9, 0xbf, 0x14, 0xe8, 0x2b, 0x04, 0x93, 0xb7, 0x6e, 0x9f, 0x7d, 0x73, 0x0a, 0xc5, 0x14, 0xb8, 0xde, 0x8c, 0xc1, 0xfe, 0xc0, 0xa7, 0xa4, 0xcc, 0x42, 0x42, 0x81, 0x15, 0x65, 0x8a, 0x80, 0xb9, 0xde, 0x1f, 0x60, 0x33, 0x0e, 0xcb, 0xfc, 0xe0, 0xdb, 0x83, 0xa1, 0xe5, 0xd0, 0x16, 0x86, 0x2c, 0xe2, 0x87, 0xed,
+	/* (2^174)P */ 0x7a, 0xc0, 0xeb, 0x6b, 0xf6, 0x0d, 0x4c, 0x6d, 0x1e, 0xdb, 0xab, 0xe7, 0x19, 0x45, 0xc6, 0xe3, 0xb2, 0x06, 0xbb, 0xbc, 0x70, 0x99, 0x83, 0x33, 0xeb, 0x28, 0xc8, 0x77, 0xf6, 0x4d, 0x01, 0xb7, 0x59, 0xa0, 0xd2, 0xb3, 0x2a, 0x72, 0x30, 0xe7, 0x11, 0x39, 0xb6, 0x41, 0x29, 0x65, 0x5a, 0x14, 0xb9, 0x86, 0x08, 0xe0, 0x7d, 0x32, 0x8c, 0xf0,
+	/* (2^175)P */ 0x5c, 0x11, 0x30, 0x9e, 0x05, 0x27, 0xf5, 0x45, 0x0f, 0xb3, 0xc9, 0x75, 0xc3, 0xd7, 0xe1, 0x82, 0x3b, 0x8e, 0x87, 0x23, 0x00, 0x15, 0x19, 0x07, 0xd9, 0x21, 0x53, 0xc7, 0xf1, 0xa3, 0xbf, 0x70, 0x64, 0x15, 0x18, 0xca, 0x23, 0x9e, 0xd3, 0x08, 0xc3, 0x2a, 0x8b, 0xe5, 0x83, 0x04, 0x89, 0x14, 0xfd, 0x28, 0x25, 0x1c, 0xe3, 0x26, 0xa7, 0x22,
+	/* (2^176)P */ 0xdc, 0xd4, 0x75, 0x60, 0x99, 0x94, 0xea, 0x09, 0x8e, 0x8a, 0x3c, 0x1b, 0xf9, 0xbd, 0x33, 0x0d, 0x51, 0x3d, 0x12, 0x6f, 0x4e, 0x72, 0xe0, 0x17, 0x20, 0xe9, 0x75, 0xe6, 0x3a, 0xb2, 0x13, 0x83, 0x4e, 0x7a, 0x08, 0x9e, 0xd1, 0x04, 0x5f, 0x6b, 0x42, 0x0b, 0x76, 0x2a, 0x2d, 0x77, 0x53, 0x6c, 0x65, 0x6d, 0x8e, 0x25, 0x3c, 0xb6, 0x8b, 0x69,
+	/* (2^177)P */ 0xb9, 0x49, 0x28, 0xd0, 0xdc, 0x6c, 0x8f, 0x4c, 0xc9, 0x14, 0x8a, 0x38, 0xa3, 0xcb, 0xc4, 0x9d, 0x53, 0xcf, 0xe9, 0xe3, 0xcf, 0xe0, 0xb1, 0xf2, 0x1b, 0x4c, 0x7f, 0x83, 0x2a, 0x7a, 0xe9, 0x8b, 0x3b, 0x86, 0x61, 0x30, 0xe9, 0x99, 0xbd, 0xba, 0x19, 0x6e, 0x65, 0x2a, 0x12, 0x3e, 0x9c, 0xa8, 0xaf, 0xc3, 0xcf, 0xf8, 0x1f, 0x77, 0x86, 0xea,
+	/* (2^178)P */ 0x30, 0xde, 0xe7, 0xff, 0x54, 0xf7, 0xa2, 0x59, 0xf6, 0x0b, 0xfb, 0x7a, 0xf2, 0x39, 0xf0, 0xdb, 0x39, 0xbc, 0xf0, 0xfa, 0x60, 0xeb, 0x6b, 0x4f, 0x47, 0x17, 0xc8, 0x00, 0x65, 0x6d, 0x25, 0x1c, 0xd0, 0x48, 0x56, 0x53, 0x45, 0x11, 0x30, 0x02, 0x49, 0x20, 0x27, 0xac, 0xf2, 0x4c, 0xac, 0x64, 0x3d, 0x52, 0xb8, 0x89, 0xe0, 0x93, 0x16, 0x0f,
+	/* (2^179)P */ 0x84, 0x09, 0xba, 0x40, 0xb2, 0x2f, 0xa3, 0xa8, 0xc2, 0xba, 0x46, 0x33, 0x05, 0x9d, 0x62, 0xad, 0xa1, 0x3c, 0x33, 0xef, 0x0d, 0xeb, 0xf0, 0x77, 0x11, 0x5a, 0xb0, 0x21, 0x9c, 0xdf, 0x55, 0x24, 0x25, 0x35, 0x51, 0x61, 0x92, 0xf0, 0xb1, 0xce, 0xf5, 0xd4, 0x7b, 0x6c, 0x21, 0x9d, 0x56, 0x52, 0xf8, 0xa1, 0x4c, 0xe9, 0x27, 0x55, 0xac, 0x91,
+	/* (2^180)P */ 0x03, 0x3e, 0x30, 0xd2, 0x0a, 0xfa, 0x7d, 0x82, 0x3d, 0x1f, 0x8b, 0xcb, 0xb6, 0x04, 0x5c, 0xcc, 0x8b, 0xda, 0xe2, 0x68, 0x74, 0x08, 0x8c, 0x44, 0x83, 0x57, 0x6d, 0x6f, 0x80, 0xb0, 0x7e, 0xa9, 0x82, 0x91, 0x7b, 0x4c, 0x37, 0x97, 0xd1, 0x63, 0xd1, 0xbd, 0x45, 0xe6, 0x8a, 0x86, 0xd6, 0x89, 0x54, 0xfd, 0xd2, 0xb1, 0xd7, 0x54, 0xad, 0xaf,
+	/* (2^181)P */ 0x8b, 0x33, 0x62, 0x49, 0x9f, 0x63, 0xf9, 0x87, 0x42, 0x58, 0xbf, 0xb3, 0xe6, 0x68, 0x02, 0x60, 0x5c, 0x76, 0x62, 0xf7, 0x61, 0xd7, 0x36, 0x31, 0xf7, 0x9c, 0xb5, 0xe5, 0x13, 0x6c, 0xea, 0x78, 0xae, 0xcf, 0xde, 0xbf, 0xb6, 0xeb, 0x4f, 0xc8, 0x2a, 0xb4, 0x9a, 0x9f, 0xf3, 0xd1, 0x6a, 0xec, 0x0c, 0xbd, 0x85, 0x98, 0x40, 0x06, 0x1c, 0x2a,
+	/* (2^182)P */ 0x74, 0x3b, 0xe7, 0x81, 0xd5, 0xae, 0x54, 0x56, 0x03, 0xe8, 0x97, 0x16, 0x76, 0xcf, 0x24, 0x96, 0x96, 0x5b, 0xcc, 0x09, 0xab, 0x23, 0x6f, 0x54, 0xae, 0x8f, 0xe4, 0x12, 0xcb, 0xfd, 0xbc, 0xac, 0x93, 0x45, 0x3d, 0x68, 0x08, 0x22, 0x59, 0xc6, 0xf0, 0x47, 0x19, 0x8c, 0x79, 0x93, 0x1e, 0x0e, 0x30, 0xb0, 0x94, 0xfb, 0x17, 0x1d, 0x5a, 0x12,
+	/* (2^183)P */ 0x85, 0xff, 0x40, 0x18, 0x85, 0xff, 0x44, 0x37, 0x69, 0x23, 0x4d, 0x34, 0xe1, 0xeb, 0xa3, 0x1b, 0x55, 0x40, 0xc1, 0x64, 0xf4, 0xd4, 0x13, 0x0a, 0x9f, 0xb9, 0x19, 0xfc, 0x88, 0x7d, 0xc0, 0x72, 0xcf, 0x69, 0x2f, 0xd2, 0x0c, 0x82, 0x0f, 0xda, 0x08, 0xba, 0x0f, 0xaa, 0x3b, 0xe9, 0xe5, 0x83, 0x7a, 0x06, 0xe8, 0x1b, 0x38, 0x43, 0xc3, 0x54,
+	/* (2^184)P */ 0x14, 0xaa, 0xb3, 0x6e, 0xe6, 0x28, 0xee, 0xc5, 0x22, 0x6c, 0x7c, 0xf9, 0xa8, 0x71, 0xcc, 0xfe, 0x68, 0x7e, 0xd3, 0xb8, 0x37, 0x96, 0xca, 0x0b, 0xd9, 0xb6, 0x06, 0xa9, 0xf6, 0x71, 0xe8, 0x31, 0xf7, 0xd8, 0xf1, 0x5d, 0xab, 0xb9, 0xf0, 0x5c, 0x98, 0xcf, 0x22, 0xa2, 0x2a, 0xf6, 0xd0, 0x59, 0xf0, 0x9d, 0xd9, 0x6a, 0x4f, 0x59, 0x57, 0xad,
+	/* (2^185)P */ 0xd7, 0x2b, 0x3d, 0x38, 0x4c, 0x2e, 0x23, 0x4d, 0x49, 0xa2, 0x62, 0x62, 0xf9, 0x0f, 0xde, 0x08, 0xf3, 0x86, 0x71, 0xb6, 0xc7, 0xf9, 0x85, 0x9c, 0x33, 0xa1, 0xcf, 0x16, 0xaa, 0x60, 0xb9, 0xb7, 0xea, 0xed, 0x01, 0x1c, 0x59, 0xdb, 0x3f, 0x3f, 0x97, 0x2e, 0xf0, 0x09, 0x9f, 0x10, 0x85, 0x5f, 0x53, 0x39, 0xf3, 0x13, 0x40, 0x56, 0x95, 0xf9,
+	/* (2^186)P */ 0xb4, 0xe3, 0xda, 0xc6, 0x1f, 0x78, 0x8e, 0xac, 0xd4, 0x20, 0x1d, 0xa0, 0xbf, 0x4c, 0x09, 0x16, 0xa7, 0x30, 0xb5, 0x8d, 0x9e, 0xa1, 0x5f, 0x6d, 0x52, 0xf4, 0x71, 0xb6, 0x32, 0x2d, 0x21, 0x51, 0xc6, 0xfc, 0x2f, 0x08, 0xf4, 0x13, 0x6c, 0x55, 0xba, 0x72, 0x81, 0x24, 0x49, 0x0e, 0x4f, 0x06, 0x36, 0x39, 0x6a, 0xc5, 0x81, 0xfc, 0xeb, 0xb2,
+	/* (2^187)P */ 0x7d, 0x8d, 0xc8, 0x6c, 0xea, 0xb4, 0xb9, 0xe8, 0x40, 0xc9, 0x69, 0xc9, 0x30, 0x05, 0xfd, 0x34, 0x46, 0xfd, 0x94, 0x05, 0x16, 0xf5, 0x4b, 0x13, 0x3d, 0x24, 0x1a, 0xd6, 0x64, 0x2b, 0x9c, 0xe2, 0xa5, 0xd9, 0x98, 0xe0, 0xe8, 0xf4, 0xbc, 0x2c, 0xbd, 0xa2, 0x56, 0xe3, 0x9e, 0x14, 0xdb, 0xbf, 0x05, 0xbf, 0x9a, 0x13, 0x5d, 0xf7, 0x91, 0xa3,
+	/* (2^188)P */ 0x8b, 0xcb, 0x27, 0xf3, 0x15, 0x26, 0x05, 0x40, 0x0f, 0xa6, 0x15, 0x13, 0x71, 0x95, 0xa2, 0xc6, 0x38, 0x04, 0x67, 0xf8, 0x9a, 0x83, 0x06, 0xaa, 0x25, 0x36, 0x72, 0x01, 0x6f, 0x74, 0x5f, 0xe5, 0x6e, 0x44, 0x99, 0xce, 0x13, 0xbc, 0x82, 0xc2, 0x0d, 0xa4, 0x98, 0x50, 0x38, 0xf3, 0xa2, 0xc5, 0xe5, 0x24, 0x1f, 0x6f, 0x56, 0x3e, 0x07, 0xb2,
+	/* (2^189)P */ 0xbd, 0x0f, 0x32, 0x60, 0x07, 0xb1, 0xd7, 0x0b, 0x11, 0x07, 0x57, 0x02, 0x89, 0xe8, 0x8b, 0xe8, 0x5a, 0x1f, 0xee, 0x54, 0x6b, 0xff, 0xb3, 0x04, 0x07, 0x57, 0x13, 0x0b, 0x94, 0xa8, 0x4d, 0x81, 0xe2, 0x17, 0x16, 0x45, 0xd4, 0x4b, 0xf7, 0x7e, 0x64, 0x66, 0x20, 0xe8, 0x0b, 0x26, 0xfd, 0xa9, 0x8a, 0x47, 0x52, 0x89, 0x14, 0xd0, 0xd1, 0xa1,
+	/* (2^190)P */ 0xdc, 0x03, 0xe6, 0x20, 0x44, 0x47, 0x8f, 0x04, 0x16, 0x24, 0x22, 0xc1, 0x55, 0x5c, 0xbe, 0x43, 0xc3, 0x92, 0xc5, 0x54, 0x3d, 0x5d, 0xd1, 0x05, 0x9c, 0xc6, 0x7c, 0xbf, 0x23, 0x84, 0x1a, 0xba, 0x4f, 0x1f, 0xfc, 0xa1, 0xae, 0x1a, 0x64, 0x02, 0x51, 0xf1, 0xcb, 0x7a, 0x20, 0xce, 0xb2, 0x34, 0x3c, 0xca, 0xe0, 0xe4, 0xba, 0x22, 0xd4, 0x7b,
+	/* (2^191)P */ 0xca, 0xfd, 0xca, 0xd7, 0xde, 0x61, 0xae, 0xf0, 0x79, 0x0c, 0x20, 0xab, 0xbc, 0x6f, 0x4d, 0x61, 0xf0, 0xc7, 0x9c, 0x8d, 0x4b, 0x52, 0xf3, 0xb9, 0x48, 0x63, 0x0b, 0xb6, 0xd2, 0x25, 0x9a, 0x96, 0x72, 0xc1, 0x6b, 0x0c, 0xb5, 0xfb, 0x71, 0xaa, 0xad, 0x47, 0x5b, 0xe7, 0xc0, 0x0a, 0x55, 0xb2, 0xd4, 0x16, 0x2f, 0xb1, 0x01, 0xfd, 0xce, 0x27,
+	/* (2^192)P */ 0x64, 0x11, 0x4b, 0xab, 0x57, 0x09, 0xc6, 0x49, 0x4a, 0x37, 0xc3, 0x36, 0xc4, 0x7b, 0x81, 0x1f, 0x42, 0xed, 0xbb, 0xe0, 0xa0, 0x8d, 0x51, 0xe6, 0xca, 0x8b, 0xb9, 0xcd, 0x99, 0x2d, 0x91, 0x53, 0xa9, 0x47, 0xcb, 0x32, 0xc7, 0xa4, 0x92, 0xec, 0x46, 0x74, 0x44, 0x6d, 0x71, 0x9f, 0x6d, 0x0c, 0x69, 0xa4, 0xf8, 0xbe, 0x9f, 0x7f, 0xa0, 0xd7,
+	/* (2^193)P */ 0x5f, 0x33, 0xb6, 0x91, 0xc8, 0xa5, 0x3f, 0x5d, 0x7f, 0x38, 0x6e, 0x74, 0x20, 0x4a, 0xd6, 0x2b, 0x98, 0x2a, 0x41, 0x4b, 0x83, 0x64, 0x0b, 0x92, 0x7a, 0x06, 0x1e, 0xc6, 0x2c, 0xf6, 0xe4, 0x91, 0xe5, 0xb1, 0x2e, 0x6e, 0x4e, 0xa8, 0xc8, 0x14, 0x32, 0x57, 0x44, 0x1c, 0xe4, 0xb9, 0x7f, 0x54, 0x51, 0x08, 0x81, 0xaa, 0x4e, 0xce, 0xa1, 0x5d,
+	/* (2^194)P */ 0x5c, 0xd5, 0x9b, 0x5e, 0x7c, 0xb5, 0xb1, 0x52, 0x73, 0x00, 0x41, 0x56, 0x79, 0x08, 0x7e, 0x07, 0x28, 0x06, 0xa6, 0xfb, 0x7f, 0x69, 0xbd, 0x7a, 0x3c, 0xae, 0x9f, 0x39, 0xbb, 0x54, 0xa2, 0x79, 0xb9, 0x0e, 0x7f, 0xbb, 0xe0, 0xe6, 0xb7, 0x27, 0x64, 0x38, 0x45, 0xdb, 0x84, 0xe4, 0x61, 0x72, 0x3f, 0xe2, 0x24, 0xfe, 0x7a, 0x31, 0x9a, 0xc9,
+	/* (2^195)P */ 0xa1, 0xd2, 0xa4, 0xee, 0x24, 0x96, 0xe5, 0x5b, 0x79, 0x78, 0x3c, 0x7b, 0x82, 0x3b, 0x8b, 0x58, 0x0b, 0xa3, 0x63, 0x2d, 0xbc, 0x75, 0x46, 0xe8, 0x83, 0x1a, 0xc0, 0x2a, 0x92, 0x61, 0xa8, 0x75, 0x37, 0x3c, 0xbf, 0x0f, 0xef, 0x8f, 0x6c, 0x97, 0x75, 0x10, 0x05, 0x7a, 0xde, 0x23, 0xe8, 0x2a, 0x35, 0xeb, 0x41, 0x64, 0x7d, 0xcf, 0xe0, 0x52,
+	/* (2^196)P */ 0x4a, 0xd0, 0x49, 0x93, 0xae, 0xf3, 0x24, 0x8c, 0xe1, 0x09, 0x98, 0x45, 0xd8, 0xb9, 0xfe, 0x8e, 0x8c, 0xa8, 0x2c, 0xc9, 0x9f, 0xce, 0x01, 0xdc, 0x38, 0x11, 0xab, 0x85, 0xb9, 0xe8, 0x00, 0x51, 0xfd, 0x82, 0xe1, 0x9b, 0x4e, 0xfc, 0xb5, 0x2a, 0x0f, 0x8b, 0xda, 0x4e, 0x02, 0xca, 0xcc, 0xe3, 0x91, 0xc4, 0xe0, 0xcf, 0x7b, 0xd6, 0xe6, 0x6a,
+	/* (2^197)P */ 0xfe, 0x11, 0xd7, 0xaa, 0xe3, 0x0c, 0x52, 0x2e, 0x04, 0xe0, 0xe0, 0x61, 0xc8, 0x05, 0xd7, 0x31, 0x4c, 0xc3, 0x9b, 0x2d, 0xce, 0x59, 0xbe, 0x12, 0xb7, 0x30, 0x21, 0xfc, 0x81, 0xb8, 0x5e, 0x57, 0x73, 0xd0, 0xad, 0x8e, 0x9e, 0xe4, 0xeb, 0xcd, 0xcf, 0xd2, 0x0f, 0x01, 0x35, 0x16, 0xed, 0x7a, 0x43, 0x8e, 0x42, 0xdc, 0xea, 0x4c, 0xa8, 0x7c,
+	/* (2^198)P */ 0x37, 0x26, 0xcc, 0x76, 0x0b, 0xe5, 0x76, 0xdd, 0x3e, 0x19, 0x3c, 0xc4, 0x6c, 0x7f, 0xd0, 0x03, 0xc1, 0xb8, 0x59, 0x82, 0xca, 0x36, 0xc1, 0xe4, 0xc8, 0xb2, 0x83, 0x69, 0x9c, 0xc5, 0x9d, 0x12, 0x82, 0x1c, 0xea, 0xb2, 0x84, 0x9f, 0xf3, 0x52, 0x6b, 0xbb, 0xd8, 0x81, 0x56, 0x83, 0x04, 0x66, 0x05, 0x22, 0x49, 0x37, 0x93, 0xb1, 0xfd, 0xd5,
+	/* (2^199)P */ 0xaf, 0x96, 0xbf, 0x03, 0xbe, 0xe6, 0x5d, 0x78, 0x19, 0xba, 0x37, 0x46, 0x0a, 0x2b, 0x52, 0x7c, 0xd8, 0x51, 0x9e, 0x3d, 0x29, 0x42, 0xdb, 0x0e, 0x31, 0x20, 0x94, 0xf8, 0x43, 0x9a, 0x2d, 0x22, 0xd3, 0xe3, 0xa1, 0x79, 0x68, 0xfb, 0x2d, 0x7e, 0xd6, 0x79, 0xda, 0x0b, 0xc6, 0x5b, 0x76, 0x68, 0xf0, 0xfe, 0x72, 0x59, 0xbb, 0xa1, 0x9c, 0x74,
+	/* (2^200)P */ 0x0a, 0xd9, 0xec, 0xc5, 0xbd, 0xf0, 0xda, 0xcf, 0x82, 0xab, 0x46, 0xc5, 0x32, 0x13, 0xdc, 0x5b, 0xac, 0xc3, 0x53, 0x9a, 0x7f, 0xef, 0xa5, 0x40, 0x5a, 0x1f, 0xc1, 0x12, 0x91, 0x54, 0x83, 0x6a, 0xb0, 0x9a, 0x85, 0x4d, 0xbf, 0x36, 0x8e, 0xd3, 0xa2, 0x2b, 0xe5, 0xd6, 0xc6, 0xe1, 0x58, 0x5b, 0x82, 0x9b, 0xc8, 0xf2, 0x03, 0xba, 0xf5, 0x92,
+	/* (2^201)P */ 0xfb, 0x21, 0x7e, 0xde, 0xe7, 0xb4, 0xc0, 0x56, 0x86, 0x3a, 0x5b, 0x78, 0xf8, 0xf0, 0xf4, 0xe7, 0x5c, 0x00, 0xd2, 0xd7, 0xd6, 0xf8, 0x75, 0x5e, 0x0f, 0x3e, 0xd1, 0x4b, 0x77, 0xd8, 0xad, 0xb0, 0xc9, 0x8b, 0x59, 0x7d, 0x30, 0x76, 0x64, 0x7a, 0x76, 0xd9, 0x51, 0x69, 0xfc, 0xbd, 0x8e, 0xb5, 0x55, 0xe0, 0xd2, 0x07, 0x15, 0xa9, 0xf7, 0xa4,
+	/* (2^202)P */ 0xaa, 0x2d, 0x2f, 0x2b, 0x3c, 0x15, 0xdd, 0xcd, 0xe9, 0x28, 0x82, 0x4f, 0xa2, 0xaa, 0x31, 0x48, 0xcc, 0xfa, 0x07, 0x73, 0x8a, 0x34, 0x74, 0x0d, 0xab, 0x1a, 0xca, 0xd2, 0xbf, 0x3a, 0xdb, 0x1a, 0x5f, 0x50, 0x62, 0xf4, 0x6b, 0x83, 0x38, 0x43, 0x96, 0xee, 0x6b, 0x39, 0x1e, 0xf0, 0x17, 0x80, 0x1e, 0x9b, 0xed, 0x2b, 0x2f, 0xcc, 0x65, 0xf7,
+	/* (2^203)P */ 0x03, 0xb3, 0x23, 0x9c, 0x0d, 0xd1, 0xeb, 0x7e, 0x34, 0x17, 0x8a, 0x4c, 0xde, 0x54, 0x39, 0xc4, 0x11, 0x82, 0xd3, 0xa4, 0x00, 0x32, 0x95, 0x9c, 0xa6, 0x64, 0x76, 0x6e, 0xd6, 0x53, 0x27, 0xb4, 0x6a, 0x14, 0x8c, 0x54, 0xf6, 0x58, 0x9e, 0x22, 0x4a, 0x55, 0x18, 0x77, 0xd0, 0x08, 0x6b, 0x19, 0x8a, 0xb5, 0xe7, 0x19, 0xb8, 0x60, 0x92, 0xb1,
+	/* (2^204)P */ 0x66, 0xec, 0xf3, 0x12, 0xde, 0x67, 0x7f, 0xd4, 0x5b, 0xf6, 0x70, 0x64, 0x0a, 0xb5, 0xc2, 0xf9, 0xb3, 0x64, 0xab, 0x56, 0x46, 0xc7, 0x93, 0xc2, 0x8b, 0x2d, 0xd0, 0xd6, 0x39, 0x3b, 0x1f, 0xcd, 0xb3, 0xac, 0xcc, 0x2c, 0x27, 0x6a, 0xbc, 0xb3, 0x4b, 0xa8, 0x3c, 0x69, 0x20, 0xe2, 0x18, 0x35, 0x17, 0xe1, 0x8a, 0xd3, 0x11, 0x74, 0xaa, 0x4d,
+	/* (2^205)P */ 0x96, 0xc4, 0x16, 0x7e, 0xfd, 0xf5, 0xd0, 0x7d, 0x1f, 0x32, 0x1b, 0xdb, 0xa6, 0xfd, 0x51, 0x75, 0x4d, 0xd7, 0x00, 0xe5, 0x7f, 0x58, 0x5b, 0xeb, 0x4b, 0x6a, 0x78, 0xfe, 0xe5, 0xd6, 0x8f, 0x99, 0x17, 0xca, 0x96, 0x45, 0xf7, 0x52, 0xdf, 0x84, 0x06, 0x77, 0xb9, 0x05, 0x63, 0x5d, 0xe9, 0x91, 0xb1, 0x4b, 0x82, 0x5a, 0xdb, 0xd7, 0xca, 0x69,
+	/* (2^206)P */ 0x02, 0xd3, 0x38, 0x38, 0x87, 0xea, 0xbd, 0x9f, 0x11, 0xca, 0xf3, 0x21, 0xf1, 0x9b, 0x35, 0x97, 0x98, 0xff, 0x8e, 0x6d, 0x3d, 0xd6, 0xb2, 0xfa, 0x68, 0xcb, 0x7e, 0x62, 0x85, 0xbb, 0xc7, 0x5d, 0xee, 0x32, 0x30, 0x2e, 0x71, 0x96, 0x63, 0x43, 0x98, 0xc4, 0xa7, 0xde, 0x60, 0xb2, 0xd9, 0x43, 0x4a, 0xfa, 0x97, 0x2d, 0x5f, 0x21, 0xd4, 0xfe,
+	/* (2^207)P */ 0x3b, 0x20, 0x29, 0x07, 0x07, 0xb5, 0x78, 0xc3, 0xc7, 0xab, 0x56, 0xba, 0x40, 0xde, 0x1d, 0xcf, 0xc3, 0x00, 0x56, 0x21, 0x0c, 0xc8, 0x42, 0xd9, 0x0e, 0xcd, 0x02, 0x7c, 0x07, 0xb9, 0x11, 0xd7, 0x96, 0xaf, 0xff, 0xad, 0xc5, 0xba, 0x30, 0x6d, 0x82, 0x3a, 0xbf, 0xef, 0x7b, 0xf7, 0x0a, 0x74, 0xbd, 0x31, 0x0c, 0xe4, 0xec, 0x1a, 0xe5, 0xc5,
+	/* (2^208)P */ 0xcc, 0xf2, 0x28, 0x16, 0x12, 0xbf, 0xef, 0x85, 0xbc, 0xf7, 0xcb, 0x9f, 0xdb, 0xa8, 0xb2, 0x49, 0x53, 0x48, 0xa8, 0x24, 0xa8, 0x68, 0x8d, 0xbb, 0x21, 0x0a, 0x5a, 0xbd, 0xb2, 0x91, 0x61, 0x47, 0xc4, 0x43, 0x08, 0xa6, 0x19, 0xef, 0x8e, 0x88, 0x39, 0xc6, 0x33, 0x30, 0xf3, 0x0e, 0xc5, 0x92, 0x66, 0xd6, 0xfe, 0xc5, 0x12, 0xd9, 0x4c, 0x2d,
+	/* (2^209)P */ 0x30, 0x34, 0x07, 0xbf, 0x9c, 0x5a, 0x4e, 0x65, 0xf1, 0x39, 0x35, 0x38, 0xae, 0x7b, 0x55, 0xac, 0x6a, 0x92, 0x24, 0x7e, 0x50, 0xd3, 0xba, 0x78, 0x51, 0xfe, 0x4d, 0x32, 0x05, 0x11, 0xf5, 0x52, 0xf1, 0x31, 0x45, 0x39, 0x98, 0x7b, 0x28, 0x56, 0xc3, 0x5d, 0x4f, 0x07, 0x6f, 0x84, 0xb8, 0x1a, 0x58, 0x0b, 0xc4, 0x7c, 0xc4, 0x8d, 0x32, 0x8e,
+	/* (2^210)P */ 0x7e, 0xaf, 0x98, 0xce, 0xc5, 0x2b, 0x9d, 0xf6, 0xfa, 0x2c, 0xb6, 0x2a, 0x5a, 0x1d, 0xc0, 0x24, 0x8d, 0xa4, 0xce, 0xb1, 0x12, 0x01, 0xf9, 0x79, 0xc6, 0x79, 0x38, 0x0c, 0xd4, 0x07, 0xc9, 0xf7, 0x37, 0xa1, 0x0b, 0xfe, 0x72, 0xec, 0x5d, 0xd6, 0xb0, 0x1c, 0x70, 0xbe, 0x70, 0x01, 0x13, 0xe0, 0x86, 0x95, 0xc7, 0x2e, 0x12, 0x3b, 0xe6, 0xa6,
+	/* (2^211)P */ 0x24, 0x82, 0x67, 0xe0, 0x14, 0x7b, 0x56, 0x08, 0x38, 0x44, 0xdb, 0xa0, 0x3a, 0x05, 0x47, 0xb2, 0xc0, 0xac, 0xd1, 0xcc, 0x3f, 0x82, 0xb8, 0x8a, 0x88, 0xbc, 0xf5, 0x33, 0xa1, 0x35, 0x0f, 0xf6, 0xe2, 0xef, 0x6c, 0xf7, 0x37, 0x9e, 0xe8, 0x10, 0xca, 0xb0, 0x8e, 0x80, 0x86, 0x00, 0x23, 0xd0, 0x4a, 0x76, 0x9f, 0xf7, 0x2c, 0x52, 0x15, 0x0e,
+	/* (2^212)P */ 0x5e, 0x49, 0xe1, 0x2c, 0x9a, 0x01, 0x76, 0xa6, 0xb3, 0x07, 0x5b, 0xa4, 0x07, 0xef, 0x1d, 0xc3, 0x6a, 0xbb, 0x64, 0xbe, 0x71, 0x15, 0x6e, 0x32, 0x31, 0x46, 0x9a, 0x9e, 0x8f, 0x45, 0x73, 0xce, 0x0b, 0x94, 0x1a, 0x52, 0x07, 0xf4, 0x50, 0x30, 0x49, 0x53, 0x50, 0xfb, 0x71, 0x1f, 0x5a, 0x03, 0xa9, 0x76, 0xf2, 0x8f, 0x42, 0xff, 0xed, 0xed,
+	/* (2^213)P */ 0xed, 0x08, 0xdb, 0x91, 0x1c, 0xee, 0xa2, 0xb4, 0x47, 0xa2, 0xfa, 0xcb, 0x03, 0xd1, 0xff, 0x8c, 0xad, 0x64, 0x50, 0x61, 0xcd, 0xfc, 0x88, 0xa0, 0x31, 0x95, 0x30, 0xb9, 0x58, 0xdd, 0xd7, 0x43, 0xe4, 0x46, 0xc2, 0x16, 0xd9, 0x72, 0x4a, 0x56, 0x51, 0x70, 0x85, 0xf1, 0xa1, 0x80, 0x40, 0xd5, 0xba, 0x67, 0x81, 0xda, 0xcd, 0x03, 0xea, 0x51,
+	/* (2^214)P */ 0x42, 0x50, 0xf0, 0xef, 0x37, 0x61, 0x72, 0x85, 0xe1, 0xf1, 0xff, 0x6f, 0x3d, 0xe8, 0x7b, 0x21, 0x5c, 0xe5, 0x50, 0x03, 0xde, 0x00, 0xc1, 0xf7, 0x3a, 0x55, 0x12, 0x1c, 0x9e, 0x1e, 0xce, 0xd1, 0x2f, 0xaf, 0x05, 0x70, 0x5b, 0x47, 0xf2, 0x04, 0x7a, 0x89, 0xbc, 0x78, 0xa6, 0x65, 0x6c, 0xaa, 0x3c, 0xa2, 0x3c, 0x8b, 0x5c, 0xa9, 0x22, 0x48,
+	/* (2^215)P */ 0x7e, 0x8c, 0x8f, 0x2f, 0x60, 0xe3, 0x5a, 0x94, 0xd4, 0xce, 0xdd, 0x9d, 0x83, 0x3b, 0x77, 0x78, 0x43, 0x1d, 0xfd, 0x8f, 0xc8, 0xe8, 0x02, 0x90, 0xab, 0xf6, 0xc9, 0xfc, 0xf1, 0x63, 0xaa, 0x5f, 0x42, 0xf1, 0x78, 0x34, 0x64, 0x16, 0x75, 0x9c, 0x7d, 0xd0, 0xe4, 0x74, 0x5a, 0xa8, 0xfb, 0xcb, 0xac, 0x20, 0xa3, 0xc2, 0xa6, 0x20, 0xf8, 0x1b,
+	/* (2^216)P */ 0x00, 0x4f, 0x1e, 0x56, 0xb5, 0x34, 0xb2, 0x87, 0x31, 0xe5, 0xee, 0x8d, 0xf1, 0x41, 0x67, 0xb7, 0x67, 0x3a, 0x54, 0x86, 0x5c, 0xf0, 0x0b, 0x37, 0x2f, 0x1b, 0x92, 0x5d, 0x58, 0x93, 0xdc, 0xd8, 0x58, 0xcc, 0x9e, 0x67, 0xd0, 0x97, 0x3a, 0xaf, 0x49, 0x39, 0x2d, 0x3b, 0xd8, 0x98, 0xfb, 0x76, 0x6b, 0xe7, 0xaf, 0xc3, 0x45, 0x44, 0x53, 0x94,
+	/* (2^217)P */ 0x30, 0xbd, 0x90, 0x75, 0xd3, 0xbd, 0x3b, 0x58, 0x27, 0x14, 0x9f, 0x6b, 0xd4, 0x31, 0x99, 0xcd, 0xde, 0x3a, 0x21, 0x1e, 0xb4, 0x02, 0xe4, 0x33, 0x04, 0x02, 0xb0, 0x50, 0x66, 0x68, 0x90, 0xdd, 0x7b, 0x69, 0x31, 0xd9, 0xcf, 0x68, 0x73, 0xf1, 0x60, 0xdd, 0xc8, 0x1d, 0x5d, 0xe3, 0xd6, 0x5b, 0x2a, 0xa4, 0xea, 0xc4, 0x3f, 0x08, 0xcd, 0x9c,
+	/* (2^218)P */ 0x6b, 0x1a, 0xbf, 0x55, 0xc1, 0x1b, 0x0c, 0x05, 0x09, 0xdf, 0xf5, 0x5e, 0xa3, 0x77, 0x95, 0xe9, 0xdf, 0x19, 0xdd, 0xc7, 0x94, 0xcb, 0x06, 0x73, 0xd0, 0x88, 0x02, 0x33, 0x94, 0xca, 0x7a, 0x2f, 0x8e, 0x3d, 0x72, 0x61, 0x2d, 0x4d, 0xa6, 0x61, 0x1f, 0x32, 0x5e, 0x87, 0x53, 0x36, 0x11, 0x15, 0x20, 0xb3, 0x5a, 0x57, 0x51, 0x93, 0x20, 0xd8,
+	/* (2^219)P */ 0xb7, 0x56, 0xf4, 0xab, 0x7d, 0x0c, 0xfb, 0x99, 0x1a, 0x30, 0x29, 0xb0, 0x75, 0x2a, 0xf8, 0x53, 0x71, 0x23, 0xbd, 0xa7, 0xd8, 0x0a, 0xe2, 0x27, 0x65, 0xe9, 0x74, 0x26, 0x98, 0x4a, 0x69, 0x19, 0xb2, 0x4d, 0x0a, 0x17, 0x98, 0xb2, 0xa9, 0x57, 0x4e, 0xf6, 0x86, 0xc8, 0x01, 0xa4, 0xc6, 0x98, 0xad, 0x5a, 0x90, 0x2c, 0x05, 0x46, 0x64, 0xb7,
+	/* (2^220)P */ 0x7b, 0x91, 0xdf, 0xfc, 0xf8, 0x1c, 0x8c, 0x15, 0x9e, 0xf7, 0xd5, 0xa8, 0xe8, 0xe7, 0xe3, 0xa3, 0xb0, 0x04, 0x74, 0xfa, 0x78, 0xfb, 0x26, 0xbf, 0x67, 0x42, 0xf9, 0x8c, 0x9b, 0xb4, 0x69, 0x5b, 0x02, 0x13, 0x6d, 0x09, 0x6c, 0xd6, 0x99, 0x61, 0x7b, 0x89, 0x4a, 0x67, 0x75, 0xa3, 0x98, 0x13, 0x23, 0x1d, 0x18, 0x24, 0x0e, 0xef, 0x41, 0x79,
+	/* (2^221)P */ 0x86, 0x33, 0xab, 0x08, 0xcb, 0xbf, 0x1e, 0x76, 0x3c, 0x0b, 0xbd, 0x30, 0xdb, 0xe9, 0xa3, 0x35, 0x87, 0x1b, 0xe9, 0x07, 0x00, 0x66, 0x7f, 0x3b, 0x35, 0x0c, 0x8a, 0x3f, 0x61, 0xbc, 0xe0, 0xae, 0xf6, 0xcc, 0x54, 0xe1, 0x72, 0x36, 0x2d, 0xee, 0x93, 0x24, 0xf8, 0xd7, 0xc5, 0xf9, 0xcb, 0xb0, 0xe5, 0x88, 0x0d, 0x23, 0x4b, 0x76, 0x15, 0xa2,
+	/* (2^222)P */ 0x37, 0xdb, 0x83, 0xd5, 0x6d, 0x06, 0x24, 0x37, 0x1b, 0x15, 0x85, 0x15, 0xe2, 0xc0, 0x4e, 0x02, 0xa9, 0x6d, 0x0a, 0x3a, 0x94, 0x4a, 0x6f, 0x49, 0x00, 0x01, 0x72, 0xbb, 0x60, 0x14, 0x35, 0xae, 0xb4, 0xc6, 0x01, 0x0a, 0x00, 0x9e, 0xc3, 0x58, 0xc5, 0xd1, 0x5e, 0x30, 0x73, 0x96, 0x24, 0x85, 0x9d, 0xf0, 0xf9, 0xec, 0x09, 0xd3, 0xe7, 0x70,
+	/* (2^223)P */ 0xf3, 0xbd, 0x96, 0x87, 0xe9, 0x71, 0xbd, 0xd6, 0xa2, 0x45, 0xeb, 0x0a, 0xcd, 0x2c, 0xf1, 0x72, 0xa6, 0x31, 0xa9, 0x6f, 0x09, 0xa1, 0x5e, 0xdd, 0xc8, 0x8d, 0x0d, 0xbc, 0x5a, 0x8d, 0xb1, 0x2c, 0x9a, 0xcc, 0x37, 0x74, 0xc2, 0xa9, 0x4e, 0xd6, 0xc0, 0x3c, 0xa0, 0x23, 0xb0, 0xa0, 0x77, 0x14, 0x80, 0x45, 0x71, 0x6a, 0x2d, 0x41, 0xc3, 0x82,
+	/* (2^224)P */ 0x37, 0x44, 0xec, 0x8a, 0x3e, 0xc1, 0x0c, 0xa9, 0x12, 0x9c, 0x08, 0x88, 0xcb, 0xd9, 0xf8, 0xba, 0x00, 0xd6, 0xc3, 0xdf, 0xef, 0x7a, 0x44, 0x7e, 0x25, 0x69, 0xc9, 0xc1, 0x46, 0xe5, 0x20, 0x9e, 0xcc, 0x0b, 0x05, 0x3e, 0xf4, 0x78, 0x43, 0x0c, 0xa6, 0x2f, 0xc1, 0xfa, 0x70, 0xb2, 0x3c, 0x31, 0x7a, 0x63, 0x58, 0xab, 0x17, 0xcf, 0x4c, 0x4f,
+	/* (2^225)P */ 0x2b, 0x08, 0x31, 0x59, 0x75, 0x8b, 0xec, 0x0a, 0xa9, 0x79, 0x70, 0xdd, 0xf1, 0x11, 0xc3, 0x11, 0x1f, 0xab, 0x37, 0xaa, 0x26, 0xea, 0x53, 0xc4, 0x79, 0xa7, 0x91, 0x00, 0xaa, 0x08, 0x42, 0xeb, 0x8b, 0x8b, 0xe8, 0xc3, 0x2f, 0xb8, 0x78, 0x90, 0x38, 0x0e, 0x8a, 0x42, 0x0c, 0x0f, 0xbf, 0x3e, 0xf8, 0xd8, 0x07, 0xcf, 0x6a, 0x34, 0xc9, 0xfa,
+	/* (2^226)P */ 0x11, 0xe0, 0x76, 0x4d, 0x23, 0xc5, 0xa6, 0xcc, 0x9f, 0x9a, 0x2a, 0xde, 0x3a, 0xb5, 0x92, 0x39, 0x19, 0x8a, 0xf1, 0x8d, 0xf9, 0x4d, 0xc9, 0xb4, 0x39, 0x9f, 0x57, 0xd8, 0x72, 0xab, 0x1d, 0x61, 0x6a, 0xb2, 0xff, 0x52, 0xba, 0x54, 0x0e, 0xfb, 0x83, 0x30, 0x8a, 0xf7, 0x3b, 0xf4, 0xd8, 0xae, 0x1a, 0x94, 0x3a, 0xec, 0x63, 0xfe, 0x6e, 0x7c,
+	/* (2^227)P */ 0xdc, 0x70, 0x8e, 0x55, 0x44, 0xbf, 0xd2, 0x6a, 0xa0, 0x14, 0x61, 0x89, 0xd5, 0x55, 0x45, 0x3c, 0xf6, 0x40, 0x0d, 0x83, 0x85, 0x44, 0xb4, 0x62, 0x56, 0xfe, 0x60, 0xd7, 0x07, 0x1d, 0x47, 0x30, 0x3b, 0x73, 0xa4, 0xb5, 0xb7, 0xea, 0xac, 0xda, 0xf1, 0x17, 0xaa, 0x60, 0xdf, 0xe9, 0x84, 0xda, 0x31, 0x32, 0x61, 0xbf, 0xd0, 0x7e, 0x8a, 0x02,
+	/* (2^228)P */ 0xb9, 0x51, 0xb3, 0x89, 0x21, 0x5d, 0xa2, 0xfe, 0x79, 0x2a, 0xb3, 0x2a, 0x3b, 0xe6, 0x6f, 0x2b, 0x22, 0x03, 0xea, 0x7b, 0x1f, 0xaf, 0x85, 0xc3, 0x38, 0x55, 0x5b, 0x8e, 0xb4, 0xaa, 0x77, 0xfe, 0x03, 0x6e, 0xda, 0x91, 0x24, 0x0c, 0x48, 0x39, 0x27, 0x43, 0x16, 0xd2, 0x0a, 0x0d, 0x43, 0xa3, 0x0e, 0xca, 0x45, 0xd1, 0x7f, 0xf5, 0xd3, 0x16,
+	/* (2^229)P */ 0x3d, 0x32, 0x9b, 0x38, 0xf8, 0x06, 0x93, 0x78, 0x5b, 0x50, 0x2b, 0x06, 0xd8, 0x66, 0xfe, 0xab, 0x9b, 0x58, 0xc7, 0xd1, 0x4d, 0xd5, 0xf8, 0x3b, 0x10, 0x7e, 0x85, 0xde, 0x58, 0x4e, 0xdf, 0x53, 0xd9, 0x58, 0xe0, 0x15, 0x81, 0x9f, 0x1a, 0x78, 0xfc, 0x9f, 0x10, 0xc2, 0x23, 0xd6, 0x78, 0xd1, 0x9d, 0xd2, 0xd5, 0x1c, 0x53, 0xe2, 0xc9, 0x76,
+	/* (2^230)P */ 0x98, 0x1e, 0x38, 0x7b, 0x71, 0x18, 0x4b, 0x15, 0xaf, 0xa1, 0xa6, 0x98, 0xcb, 0x26, 0xa3, 0xc8, 0x07, 0x46, 0xda, 0x3b, 0x70, 0x65, 0xec, 0x7a, 0x2b, 0x34, 0x94, 0xa8, 0xb6, 0x14, 0xf8, 0x1a, 0xce, 0xf7, 0xc8, 0x60, 0xf3, 0x88, 0xf4, 0x33, 0x60, 0x7b, 0xd1, 0x02, 0xe7, 0xda, 0x00, 0x4a, 0xea, 0xd2, 0xfd, 0x88, 0xd2, 0x99, 0x28, 0xf3,
+	/* (2^231)P */ 0x28, 0x24, 0x1d, 0x26, 0xc2, 0xeb, 0x8b, 0x3b, 0xb4, 0x6b, 0xbe, 0x6b, 0x77, 0xff, 0xf3, 0x21, 0x3b, 0x26, 0x6a, 0x8c, 0x8e, 0x2a, 0x44, 0xa8, 0x01, 0x2b, 0x71, 0xea, 0x64, 0x30, 0xfd, 0xfd, 0x95, 0xcb, 0x39, 0x38, 0x48, 0xfa, 0x96, 0x97, 0x8c, 0x2f, 0x33, 0xca, 0x03, 0xe6, 0xd7, 0x94, 0x55, 0x6c, 0xc3, 0xb3, 0xa8, 0xf7, 0xae, 0x8c,
+	/* (2^232)P */ 0xea, 0x62, 0x8a, 0xb4, 0xeb, 0x74, 0xf7, 0xb8, 0xae, 0xc5, 0x20, 0x71, 0x06, 0xd6, 0x7c, 0x62, 0x9b, 0x69, 0x74, 0xef, 0xa7, 0x6d, 0xd6, 0x8c, 0x37, 0xb9, 0xbf, 0xcf, 0xeb, 0xe4, 0x2f, 0x04, 0x02, 0x21, 0x7d, 0x75, 0x6b, 0x92, 0x48, 0xf8, 0x70, 0xad, 0x69, 0xe2, 0xea, 0x0e, 0x88, 0x67, 0x72, 0xcc, 0x2d, 0x10, 0xce, 0x2d, 0xcf, 0x65,
+	/* (2^233)P */ 0x49, 0xf3, 0x57, 0x64, 0xe5, 0x5c, 0xc5, 0x65, 0x49, 0x97, 0xc4, 0x8a, 0xcc, 0xa9, 0xca, 0x94, 0x7b, 0x86, 0x88, 0xb6, 0x51, 0x27, 0x69, 0xa5, 0x0f, 0x8b, 0x06, 0x59, 0xa0, 0x94, 0xef, 0x63, 0x1a, 0x01, 0x9e, 0x4f, 0xd2, 0x5a, 0x93, 0xc0, 0x7c, 0xe6, 0x61, 0x77, 0xb6, 0xf5, 0x40, 0xd9, 0x98, 0x43, 0x5b, 0x56, 0x68, 0xe9, 0x37, 0x8f,
+	/* (2^234)P */ 0xee, 0x87, 0xd2, 0x05, 0x1b, 0x39, 0x89, 0x10, 0x07, 0x6d, 0xe8, 0xfd, 0x8b, 0x4d, 0xb2, 0xa7, 0x7b, 0x1e, 0xa0, 0x6c, 0x0d, 0x3d, 0x3d, 0x49, 0xba, 0x61, 0x36, 0x1f, 0xc2, 0x84, 0x4a, 0xcc, 0x87, 0xa9, 0x1b, 0x23, 0x04, 0xe2, 0x3e, 0x97, 0xe1, 0xdb, 0xd5, 0x5a, 0xe8, 0x41, 0x6b, 0xe5, 0x5a, 0xa1, 0x99, 0xe5, 0x7b, 0xa7, 0xe0, 0x3b,
+	/* (2^235)P */ 0xea, 0xa3, 0x6a, 0xdd, 0x77, 0x7f, 0x77, 0x41, 0xc5, 0x6a, 0xe4, 0xaf, 0x11, 0x5f, 0x88, 0xa5, 0x10, 0xee, 0xd0, 0x8c, 0x0c, 0xb4, 0xa5, 0x2a, 0xd0, 0xd8, 0x1d, 0x47, 0x06, 0xc0, 0xd5, 0xce, 0x51, 0x54, 0x9b, 0x2b, 0xe6, 0x2f, 0xe7, 0xe7, 0x31, 0x5f, 0x5c, 0x23, 0x81, 0x3e, 0x03, 0x93, 0xaa, 0x2d, 0x71, 0x84, 0xa0, 0x89, 0x32, 0xa6,
+	/* (2^236)P */ 0x55, 0xa3, 0x13, 0x92, 0x4e, 0x93, 0x7d, 0xec, 0xca, 0x57, 0xfb, 0x37, 0xae, 0xd2, 0x18, 0x2e, 0x54, 0x05, 0x6c, 0xd1, 0x28, 0xca, 0x90, 0x40, 0x82, 0x2e, 0x79, 0xc6, 0x5a, 0xc7, 0xdd, 0x84, 0x93, 0xdf, 0x15, 0xb8, 0x1f, 0xb1, 0xf9, 0xaf, 0x2c, 0xe5, 0x32, 0xcd, 0xc2, 0x99, 0x6d, 0xac, 0x85, 0x5c, 0x63, 0xd3, 0xe2, 0xff, 0x24, 0xda,
+	/* (2^237)P */ 0x2d, 0x8d, 0xfd, 0x65, 0xcc, 0xe5, 0x02, 0xa0, 0xe5, 0xb9, 0xec, 0x59, 0x09, 0x50, 0x27, 0xb7, 0x3d, 0x2a, 0x79, 0xb2, 0x76, 0x5d, 0x64, 0x95, 0xf8, 0xc5, 0xaf, 0x8a, 0x62, 0x11, 0x5c, 0x56, 0x1c, 0x05, 0x64, 0x9e, 0x5e, 0xbd, 0x54, 0x04, 0xe6, 0x9e, 0xab, 0xe6, 0x22, 0x7e, 0x42, 0x54, 0xb5, 0xa5, 0xd0, 0x8d, 0x28, 0x6b, 0x0f, 0x0b,
+	/* (2^238)P */ 0x2d, 0xb2, 0x8c, 0x59, 0x10, 0x37, 0x84, 0x3b, 0x9b, 0x65, 0x1b, 0x0f, 0x10, 0xf9, 0xea, 0x60, 0x1b, 0x02, 0xf5, 0xee, 0x8b, 0xe6, 0x32, 0x7d, 0x10, 0x7f, 0x5f, 0x8c, 0x72, 0x09, 0x4e, 0x1f, 0x29, 0xff, 0x65, 0xcb, 0x3e, 0x3a, 0xd2, 0x96, 0x50, 0x1e, 0xea, 0x64, 0x99, 0xb5, 0x4c, 0x7a, 0x69, 0xb8, 0x95, 0xae, 0x48, 0xc0, 0x7c, 0xb1,
+	/* (2^239)P */ 0xcd, 0x7c, 0x4f, 0x3e, 0xea, 0xf3, 0x90, 0xcb, 0x12, 0x76, 0xd1, 0x17, 0xdc, 0x0d, 0x13, 0x0f, 0xfd, 0x4d, 0xb5, 0x1f, 0xe4, 0xdd, 0xf2, 0x4d, 0x58, 0xea, 0xa5, 0x66, 0x92, 0xcf, 0xe5, 0x54, 0xea, 0x9b, 0x35, 0x83, 0x1a, 0x44, 0x8e, 0x62, 0x73, 0x45, 0x98, 0xa3, 0x89, 0x95, 0x52, 0x93, 0x1a, 0x8d, 0x63, 0x0f, 0xc2, 0x57, 0x3c, 0xb1,
+	/* (2^240)P */ 0x72, 0xb4, 0xdf, 0x51, 0xb7, 0xf6, 0x52, 0xa2, 0x14, 0x56, 0xe5, 0x0a, 0x2e, 0x75, 0x81, 0x02, 0xee, 0x93, 0x48, 0x0a, 0x92, 0x4e, 0x0c, 0x0f, 0xdf, 0x09, 0x89, 0x99, 0xf6, 0xf9, 0x22, 0xa2, 0x32, 0xf8, 0xb0, 0x76, 0x0c, 0xb2, 0x4d, 0x6e, 0xbe, 0x83, 0x35, 0x61, 0x44, 0xd2, 0x58, 0xc7, 0xdd, 0x14, 0xcf, 0xc3, 0x4b, 0x7c, 0x07, 0xee,
+	/* (2^241)P */ 0x8b, 0x03, 0xee, 0xcb, 0xa7, 0x2e, 0x28, 0xbd, 0x97, 0xd1, 0x4c, 0x2b, 0xd1, 0x92, 0x67, 0x5b, 0x5a, 0x12, 0xbf, 0x29, 0x17, 0xfc, 0x50, 0x09, 0x74, 0x76, 0xa2, 0xd4, 0x82, 0xfd, 0x2c, 0x0c, 0x90, 0xf7, 0xe7, 0xe5, 0x9a, 0x2c, 0x16, 0x40, 0xb9, 0x6c, 0xd9, 0xe0, 0x22, 0x9e, 0xf8, 0xdd, 0x73, 0xe4, 0x7b, 0x9e, 0xbe, 0x4f, 0x66, 0x22,
+	/* (2^242)P */ 0xa4, 0x10, 0xbe, 0xb8, 0x83, 0x3a, 0x77, 0x8e, 0xea, 0x0a, 0xc4, 0x97, 0x3e, 0xb6, 0x6c, 0x81, 0xd7, 0x65, 0xd9, 0xf7, 0xae, 0xe6, 0xbe, 0xab, 0x59, 0x81, 0x29, 0x4b, 0xff, 0xe1, 0x0f, 0xc3, 0x2b, 0xad, 0x4b, 0xef, 0xc4, 0x50, 0x9f, 0x88, 0x31, 0xf2, 0xde, 0x80, 0xd6, 0xf4, 0x20, 0x9c, 0x77, 0x9b, 0xbe, 0xbe, 0x08, 0xf5, 0xf0, 0x95,
+	/* (2^243)P */ 0x0e, 0x7c, 0x7b, 0x7c, 0xb3, 0xd8, 0x83, 0xfc, 0x8c, 0x75, 0x51, 0x74, 0x1b, 0xe1, 0x6d, 0x11, 0x05, 0x46, 0x24, 0x0d, 0xa4, 0x2b, 0x32, 0xfd, 0x2c, 0x4e, 0x21, 0xdf, 0x39, 0x6b, 0x96, 0xfc, 0xff, 0x92, 0xfc, 0x35, 0x0d, 0x9a, 0x4b, 0xc0, 0x70, 0x46, 0x32, 0x7d, 0xc0, 0xc4, 0x04, 0xe0, 0x2d, 0x83, 0xa7, 0x00, 0xc7, 0xcb, 0xb4, 0x8f,
+	/* (2^244)P */ 0xa9, 0x5a, 0x7f, 0x0e, 0xdd, 0x2c, 0x85, 0xaa, 0x4d, 0xac, 0xde, 0xb3, 0xb6, 0xaf, 0xe6, 0xd1, 0x06, 0x7b, 0x2c, 0xa4, 0x01, 0x19, 0x22, 0x7d, 0x78, 0xf0, 0x3a, 0xea, 0x89, 0xfe, 0x21, 0x61, 0x6d, 0xb8, 0xfe, 0xa5, 0x2a, 0xab, 0x0d, 0x7b, 0x51, 0x39, 0xb6, 0xde, 0xbc, 0xf0, 0xc5, 0x48, 0xd7, 0x09, 0x82, 0x6e, 0x66, 0x75, 0xc5, 0xcd,
+	/* (2^245)P */ 0xee, 0xdf, 0x2b, 0x6c, 0xa8, 0xde, 0x61, 0xe1, 0x27, 0xfa, 0x2a, 0x0f, 0x68, 0xe7, 0x7a, 0x9b, 0x13, 0xe9, 0x56, 0xd2, 0x1c, 0x3d, 0x2f, 0x3c, 0x7a, 0xf6, 0x6f, 0x45, 0xee, 0xe8, 0xf4, 0xa0, 0xa6, 0xe8, 0xa5, 0x27, 0xee, 0xf2, 0x85, 0xa9, 0xd5, 0x0e, 0xa9, 0x26, 0x60, 0xfe, 0xee, 0xc7, 0x59, 0x99, 0x5e, 0xa3, 0xdf, 0x23, 0x36, 0xd5,
+	/* (2^246)P */ 0x15, 0x66, 0x6f, 0xd5, 0x78, 0xa4, 0x0a, 0xf7, 0xb1, 0xe8, 0x75, 0x6b, 0x48, 0x7d, 0xa6, 0x4d, 0x3d, 0x36, 0x9b, 0xc7, 0xcc, 0x68, 0x9a, 0xfe, 0x2f, 0x39, 0x2a, 0x51, 0x31, 0x39, 0x7d, 0x73, 0x6f, 0xc8, 0x74, 0x72, 0x6f, 0x6e, 0xda, 0x5f, 0xad, 0x48, 0xc8, 0x40, 0xe1, 0x06, 0x01, 0x36, 0xa1, 0x88, 0xc8, 0x99, 0x9c, 0xd1, 0x11, 0x8f,
+	/* (2^247)P */ 0xab, 0xc5, 0xcb, 0xcf, 0xbd, 0x73, 0x21, 0xd0, 0x82, 0xb1, 0x2e, 0x2d, 0xd4, 0x36, 0x1b, 0xed, 0xa9, 0x8a, 0x26, 0x79, 0xc4, 0x17, 0xae, 0xe5, 0x09, 0x0a, 0x0c, 0xa4, 0x21, 0xa0, 0x6e, 0xdd, 0x62, 0x8e, 0x44, 0x62, 0xcc, 0x50, 0xff, 0x93, 0xb3, 0x9a, 0x72, 0x8c, 0x3f, 0xa1, 0xa6, 0x4d, 0x87, 0xd5, 0x1c, 0x5a, 0xc0, 0x0b, 0x1a, 0xd6,
+	/* (2^248)P */ 0x67, 0x36, 0x6a, 0x1f, 0x96, 0xe5, 0x80, 0x20, 0xa9, 0xe8, 0x0b, 0x0e, 0x21, 0x29, 0x3f, 0xc8, 0x0a, 0x6d, 0x27, 0x47, 0xca, 0xd9, 0x05, 0x55, 0xbf, 0x11, 0xcf, 0x31, 0x7a, 0x37, 0xc7, 0x90, 0xa9, 0xf4, 0x07, 0x5e, 0xd5, 0xc3, 0x92, 0xaa, 0x95, 0xc8, 0x23, 0x2a, 0x53, 0x45, 0xe3, 0x3a, 0x24, 0xe9, 0x67, 0x97, 0x3a, 0x82, 0xf9, 0xa6,
+	/* (2^249)P */ 0x92, 0x9e, 0x6d, 0x82, 0x67, 0xe9, 0xf9, 0x17, 0x96, 0x2c, 0xa7, 0xd3, 0x89, 0xf9, 0xdb, 0xd8, 0x20, 0xc6, 0x2e, 0xec, 0x4a, 0x76, 0x64, 0xbf, 0x27, 0x40, 0xe2, 0xb4, 0xdf, 0x1f, 0xa0, 0xef, 0x07, 0x80, 0xfb, 0x8e, 0x12, 0xf8, 0xb8, 0xe1, 0xc6, 0xdf, 0x7c, 0x69, 0x35, 0x5a, 0xe1, 0x8e, 0x5d, 0x69, 0x84, 0x56, 0xb6, 0x31, 0x1c, 0x0b,
+	/* (2^250)P */ 0xd6, 0x94, 0x5c, 0xef, 0xbb, 0x46, 0x45, 0x44, 0x5b, 0xa1, 0xae, 0x03, 0x65, 0xdd, 0xb5, 0x66, 0x88, 0x35, 0x29, 0x95, 0x16, 0x54, 0xa6, 0xf5, 0xc9, 0x78, 0x34, 0xe6, 0x0f, 0xc4, 0x2b, 0x5b, 0x79, 0x51, 0x68, 0x48, 0x3a, 0x26, 0x87, 0x05, 0x70, 0xaf, 0x8b, 0xa6, 0xc7, 0x2e, 0xb3, 0xa9, 0x10, 0x01, 0xb0, 0xb9, 0x31, 0xfd, 0xdc, 0x80,
+	/* (2^251)P */ 0x25, 0xf2, 0xad, 0xd6, 0x75, 0xa3, 0x04, 0x05, 0x64, 0x8a, 0x97, 0x60, 0x27, 0x2a, 0xe5, 0x6d, 0xb0, 0x73, 0xf4, 0x07, 0x2a, 0x9d, 0xe9, 0x46, 0xb4, 0x1c, 0x51, 0xf8, 0x63, 0x98, 0x7e, 0xe5, 0x13, 0x51, 0xed, 0x98, 0x65, 0x98, 0x4f, 0x8f, 0xe7, 0x7e, 0x72, 0xd7, 0x64, 0x11, 0x2f, 0xcd, 0x12, 0xf8, 0xc4, 0x63, 0x52, 0x0f, 0x7f, 0xc4,
+	/* (2^252)P */ 0x5c, 0xd9, 0x85, 0x63, 0xc7, 0x8a, 0x65, 0x9a, 0x25, 0x83, 0x31, 0x73, 0x49, 0xf0, 0x93, 0x96, 0x70, 0x67, 0x6d, 0xb1, 0xff, 0x95, 0x54, 0xe4, 0xf8, 0x15, 0x6c, 0x5f, 0xbd, 0xf6, 0x0f, 0x38, 0x7b, 0x68, 0x7d, 0xd9, 0x3d, 0xf0, 0xa9, 0xa0, 0xe4, 0xd1, 0xb6, 0x34, 0x6d, 0x14, 0x16, 0xc2, 0x4c, 0x30, 0x0e, 0x67, 0xd3, 0xbe, 0x2e, 0xc0,
+	/* (2^253)P */ 0x06, 0x6b, 0x52, 0xc8, 0x14, 0xcd, 0xae, 0x03, 0x93, 0xea, 0xc1, 0xf2, 0xf6, 0x8b, 0xc5, 0xb6, 0xdc, 0x82, 0x42, 0x29, 0x94, 0xe0, 0x25, 0x6c, 0x3f, 0x9f, 0x5d, 0xe4, 0x96, 0xf6, 0x8e, 0x3f, 0xf9, 0x72, 0xc4, 0x77, 0x60, 0x8b, 0xa4, 0xf9, 0xa8, 0xc3, 0x0a, 0x81, 0xb1, 0x97, 0x70, 0x18, 0xab, 0xea, 0x37, 0x8a, 0x08, 0xc7, 0xe2, 0x95,
+	/* (2^254)P */ 0x94, 0x49, 0xd9, 0x5f, 0x76, 0x72, 0x82, 0xad, 0x2d, 0x50, 0x1a, 0x7a, 0x5b, 0xe6, 0x95, 0x1e, 0x95, 0x65, 0x87, 0x1c, 0x52, 0xd7, 0x44, 0xe6, 0x9b, 0x56, 0xcd, 0x6f, 0x05, 0xff, 0x67, 0xc5, 0xdb, 0xa2, 0xac, 0xe4, 0xa2, 0x28, 0x63, 0x5f, 0xfb, 0x0c, 0x3b, 0xf1, 0x87, 0xc3, 0x36, 0x78, 0x3f, 0x77, 0xfa, 0x50, 0x85, 0xf9, 0xd7, 0x82,
+	/* (2^255)P */ 0x64, 0xc0, 0xe0, 0xd8, 0x2d, 0xed, 0xcb, 0x6a, 0xfd, 0xcd, 0xbc, 0x7e, 0x9f, 0xc8, 0x85, 0xe9, 0xc1, 0x7c, 0x0f, 0xe5, 0x18, 0xea, 0xd4, 0x51, 0xad, 0x59, 0x13, 0x75, 0xd9, 0x3d, 0xd4, 0x8a, 0xb2, 0xbe, 0x78, 0x52, 0x2b, 0x52, 0x94, 0x37, 0x41, 0xd6, 0xb4, 0xb6, 0x45, 0x20, 0x76, 0xe0, 0x1f, 0x31, 0xdb, 0xb1, 0xa1, 0x43, 0xf0, 0x18,
+	/* (2^256)P */ 0x74, 0xa9, 0xa4, 0xa9, 0xdd, 0x6e, 0x3e, 0x68, 0xe5, 0xc3, 0x2e, 0x92, 0x17, 0xa4, 0xcb, 0x80, 0xb1, 0xf0, 0x06, 0x93, 0xef, 0xe6, 0x00, 0xe6, 0x3b, 0xb1, 0x32, 0x65, 0x7b, 0x83, 0xb6, 0x8a, 0x49, 0x1b, 0x14, 0x89, 0xee, 0xba, 0xf5, 0x6a, 0x8d, 0x36, 0xef, 0xb0, 0xd8, 0xb2, 0x16, 0x99, 0x17, 0x35, 0x02, 0x16, 0x55, 0x58, 0xdd, 0x82,
+	/* (2^257)P */ 0x36, 0x95, 0xe8, 0xf4, 0x36, 0x42, 0xbb, 0xc5, 0x3e, 0xfa, 0x30, 0x84, 0x9e, 0x59, 0xfd, 0xd2, 0x95, 0x42, 0xf8, 0x64, 0xd9, 0xb9, 0x0e, 0x9f, 0xfa, 0xd0, 0x7b, 0x20, 0x31, 0x77, 0x48, 0x29, 0x4d, 0xd0, 0x32, 0x57, 0x56, 0x30, 0xa6, 0x17, 0x53, 0x04, 0xbf, 0x08, 0x28, 0xec, 0xb8, 0x46, 0xc1, 0x03, 0x89, 0xdc, 0xed, 0xa0, 0x35, 0x53,
+	/* (2^258)P */ 0xc5, 0x7f, 0x9e, 0xd8, 0xc5, 0xba, 0x5f, 0x68, 0xc8, 0x23, 0x75, 0xea, 0x0d, 0xd9, 0x5a, 0xfd, 0x61, 0x1a, 0xa3, 0x2e, 0x45, 0x63, 0x14, 0x55, 0x86, 0x21, 0x29, 0xbe, 0xef, 0x5e, 0x50, 0xe5, 0x18, 0x59, 0xe7, 0xe3, 0xce, 0x4d, 0x8c, 0x15, 0x8f, 0x89, 0x66, 0x44, 0x52, 0x3d, 0xfa, 0xc7, 0x9a, 0x59, 0x90, 0x8e, 0xc0, 0x06, 0x3f, 0xc9,
+	/* (2^259)P */ 0x8e, 0x04, 0xd9, 0x16, 0x50, 0x1d, 0x8c, 0x9f, 0xd5, 0xe3, 0xce, 0xfd, 0x47, 0x04, 0x27, 0x4d, 0xc2, 0xfa, 0x71, 0xd9, 0x0b, 0xb8, 0x65, 0xf4, 0x11, 0xf3, 0x08, 0xee, 0x81, 0xc8, 0x67, 0x99, 0x0b, 0x8d, 0x77, 0xa3, 0x4f, 0xb5, 0x9b, 0xdb, 0x26, 0xf1, 0x97, 0xeb, 0x04, 0x54, 0xeb, 0x80, 0x08, 0x1d, 0x1d, 0xf6, 0x3d, 0x1f, 0x5a, 0xb8,
+	/* (2^260)P */ 0xb7, 0x9c, 0x9d, 0xee, 0xb9, 0x5c, 0xad, 0x0d, 0x9e, 0xfd, 0x60, 0x3c, 0x27, 0x4e, 0xa2, 0x95, 0xfb, 0x64, 0x7e, 0x79, 0x64, 0x87, 0x10, 0xb4, 0x73, 0xe0, 0x9d, 0x46, 0x4d, 0x3d, 0xee, 0x83, 0xe4, 0x16, 0x88, 0x97, 0xe6, 0x4d, 0xba, 0x70, 0xb6, 0x96, 0x7b, 0xff, 0x4b, 0xc8, 0xcf, 0x72, 0x83, 0x3e, 0x5b, 0x24, 0x2e, 0x57, 0xf1, 0x82,
+	/* (2^261)P */ 0x30, 0x71, 0x40, 0x51, 0x4f, 0x44, 0xbb, 0xc7, 0xf0, 0x54, 0x6e, 0x9d, 0xeb, 0x15, 0xad, 0xf8, 0x61, 0x43, 0x5a, 0xef, 0xc0, 0xb1, 0x57, 0xae, 0x03, 0x40, 0xe8, 0x68, 0x6f, 0x03, 0x20, 0x4f, 0x8a, 0x51, 0x2a, 0x9e, 0xd2, 0x45, 0xaf, 0xb4, 0xf5, 0xd4, 0x95, 0x7f, 0x3d, 0x3d, 0xb7, 0xb6, 0x28, 0xc5, 0x08, 0x8b, 0x44, 0xd6, 0x3f, 0xe7,
+	/* (2^262)P */ 0xa9, 0x52, 0x04, 0x67, 0xcb, 0x20, 0x63, 0xf8, 0x18, 0x01, 0x44, 0x21, 0x6a, 0x8a, 0x83, 0x48, 0xd4, 0xaf, 0x23, 0x0f, 0x35, 0x8d, 0xe5, 0x5a, 0xc4, 0x7c, 0x55, 0x46, 0x19, 0x5f, 0x35, 0xe0, 0x5d, 0x97, 0x4c, 0x2d, 0x04, 0xed, 0x59, 0xd4, 0xb0, 0xb2, 0xc6, 0xe3, 0x51, 0xe1, 0x38, 0xc6, 0x30, 0x49, 0x8f, 0xae, 0x61, 0x64, 0xce, 0xa8,
+	/* (2^263)P */ 0x9b, 0x64, 0x83, 0x3c, 0xd3, 0xdf, 0xb9, 0x27, 0xe7, 0x5b, 0x7f, 0xeb, 0xf3, 0x26, 0xcf, 0xb1, 0x8f, 0xaf, 0x26, 0xc8, 0x48, 0xce, 0xa1, 0xac, 0x7d, 0x10, 0x34, 0x28, 0xe1, 0x1f, 0x69, 0x03, 0x64, 0x77, 0x61, 0xdd, 0x4a, 0x9b, 0x18, 0x47, 0xf8, 0xca, 0x63, 0xc9, 0x03, 0x2d, 0x20, 0x2a, 0x69, 0x6e, 0x42, 0xd0, 0xe7, 0xaa, 0xb5, 0xf3,
+	/* (2^264)P */ 0xea, 0x31, 0x0c, 0x57, 0x0f, 0x3e, 0xe3, 0x35, 0xd8, 0x30, 0xa5, 0x6f, 0xdd, 0x95, 0x43, 0xc6, 0x66, 0x07, 0x4f, 0x34, 0xc3, 0x7e, 0x04, 0x10, 0x2d, 0xc4, 0x1c, 0x94, 0x52, 0x2e, 0x5b, 0x9a, 0x65, 0x2f, 0x91, 0xaa, 0x4f, 0x3c, 0xdc, 0x23, 0x18, 0xe1, 0x4f, 0x85, 0xcd, 0xf4, 0x8c, 0x51, 0xf7, 0xab, 0x4f, 0xdc, 0x15, 0x5c, 0x9e, 0xc5,
+	/* (2^265)P */ 0x54, 0x57, 0x23, 0x17, 0xe7, 0x82, 0x2f, 0x04, 0x7d, 0xfe, 0xe7, 0x1f, 0xa2, 0x57, 0x79, 0xe9, 0x58, 0x9b, 0xbe, 0xc6, 0x16, 0x4a, 0x17, 0x50, 0x90, 0x4a, 0x34, 0x70, 0x87, 0x37, 0x01, 0x26, 0xd8, 0xa3, 0x5f, 0x07, 0x7c, 0xd0, 0x7d, 0x05, 0x8a, 0x93, 0x51, 0x2f, 0x99, 0xea, 0xcf, 0x00, 0xd8, 0xc7, 0xe6, 0x9b, 0x8c, 0x62, 0x45, 0x87,
+	/* (2^266)P */ 0xc3, 0xfd, 0x29, 0x66, 0xe7, 0x30, 0x29, 0x77, 0xe0, 0x0d, 0x63, 0x5b, 0xe6, 0x90, 0x1a, 0x1e, 0x99, 0xc2, 0xa7, 0xab, 0xff, 0xa7, 0xbd, 0x79, 0x01, 0x97, 0xfd, 0x27, 0x1b, 0x43, 0x2b, 0xe6, 0xfe, 0x5e, 0xf1, 0xb9, 0x35, 0x38, 0x08, 0x25, 0x55, 0x90, 0x68, 0x2e, 0xc3, 0x67, 0x39, 0x9f, 0x2b, 0x2c, 0x70, 0x48, 0x8c, 0x47, 0xee, 0x56,
+	/* (2^267)P */ 0xf7, 0x32, 0x70, 0xb5, 0xe6, 0x42, 0xfd, 0x0a, 0x39, 0x9b, 0x07, 0xfe, 0x0e, 0xf4, 0x47, 0xba, 0x6a, 0x3f, 0xf5, 0x2c, 0x15, 0xf3, 0x60, 0x3f, 0xb1, 0x83, 0x7b, 0x2e, 0x34, 0x58, 0x1a, 0x6e, 0x4a, 0x49, 0x05, 0x45, 0xca, 0xdb, 0x00, 0x01, 0x0c, 0x42, 0x5e, 0x60, 0x40, 0x5f, 0xd9, 0xc7, 0x3a, 0x9e, 0x1c, 0x8d, 0xab, 0x11, 0x55, 0x65,
+	/* (2^268)P */ 0x87, 0x40, 0xb7, 0x0d, 0xaa, 0x34, 0x89, 0x90, 0x75, 0x6d, 0xa2, 0xfe, 0x3b, 0x6d, 0x5c, 0x39, 0x98, 0x10, 0x9e, 0x15, 0xc5, 0x35, 0xa2, 0x27, 0x23, 0x0a, 0x2d, 0x60, 0xe2, 0xa8, 0x7f, 0x3e, 0x77, 0x8f, 0xcc, 0x44, 0xcc, 0x30, 0x28, 0xe2, 0xf0, 0x04, 0x8c, 0xee, 0xe4, 0x5f, 0x68, 0x8c, 0xdf, 0x70, 0xbf, 0x31, 0xee, 0x2a, 0xfc, 0xce,
+	/* (2^269)P */ 0x92, 0xf2, 0xa0, 0xd9, 0x58, 0x3b, 0x7c, 0x1a, 0x99, 0x46, 0x59, 0x54, 0x60, 0x06, 0x8d, 0x5e, 0xf0, 0x22, 0xa1, 0xed, 0x92, 0x8a, 0x4d, 0x76, 0x95, 0x05, 0x0b, 0xff, 0xfc, 0x9a, 0xd1, 0xcc, 0x05, 0xb9, 0x5e, 0x99, 0xe8, 0x2a, 0x76, 0x7b, 0xfd, 0xa6, 0xe2, 0xd1, 0x1a, 0xd6, 0x76, 0x9f, 0x2f, 0x0e, 0xd1, 0xa8, 0x77, 0x5a, 0x40, 0x5a,
+	/* (2^270)P */ 0xff, 0xf9, 0x3f, 0xa9, 0xa6, 0x6c, 0x6d, 0x03, 0x8b, 0xa7, 0x10, 0x5d, 0x3f, 0xec, 0x3e, 0x1c, 0x0b, 0x6b, 0xa2, 0x6a, 0x22, 0xa9, 0x28, 0xd0, 0x66, 0xc9, 0xc2, 0x3d, 0x47, 0x20, 0x7d, 0xa6, 0x1d, 0xd8, 0x25, 0xb5, 0xf2, 0xf9, 0x70, 0x19, 0x6b, 0xf8, 0x43, 0x36, 0xc5, 0x1f, 0xe4, 0x5a, 0x4c, 0x13, 0xe4, 0x6d, 0x08, 0x0b, 0x1d, 0xb1,
+	/* (2^271)P */ 0x3f, 0x20, 0x9b, 0xfb, 0xec, 0x7d, 0x31, 0xc5, 0xfc, 0x88, 0x0b, 0x30, 0xed, 0x36, 0xc0, 0x63, 0xb1, 0x7d, 0x10, 0xda, 0xb6, 0x2e, 0xad, 0xf3, 0xec, 0x94, 0xe7, 0xec, 0xb5, 0x9c, 0xfe, 0xf5, 0x35, 0xf0, 0xa2, 0x2d, 0x7f, 0xca, 0x6b, 0x67, 0x1a, 0xf6, 0xb3, 0xda, 0x09, 0x2a, 0xaa, 0xdf, 0xb1, 0xca, 0x9b, 0xfb, 0xeb, 0xb3, 0xcd, 0xc0,
+	/* (2^272)P */ 0xcd, 0x4d, 0x89, 0x00, 0xa4, 0x3b, 0x48, 0xf0, 0x76, 0x91, 0x35, 0xa5, 0xf8, 0xc9, 0xb6, 0x46, 0xbc, 0xf6, 0x9a, 0x45, 0x47, 0x17, 0x96, 0x80, 0x5b, 0x3a, 0x28, 0x33, 0xf9, 0x5a, 0xef, 0x43, 0x07, 0xfe, 0x3b, 0xf4, 0x8e, 0x19, 0xce, 0xd2, 0x94, 0x4b, 0x6d, 0x8e, 0x67, 0x20, 0xc7, 0x4f, 0x2f, 0x59, 0x8e, 0xe1, 0xa1, 0xa9, 0xf9, 0x0e,
+	/* (2^273)P */ 0xdc, 0x7b, 0xb5, 0x50, 0x2e, 0xe9, 0x7e, 0x8b, 0x78, 0xa1, 0x38, 0x96, 0x22, 0xc3, 0x61, 0x67, 0x6d, 0xc8, 0x58, 0xed, 0x41, 0x1d, 0x5d, 0x86, 0x98, 0x7f, 0x2f, 0x1b, 0x8d, 0x3e, 0xaa, 0xc1, 0xd2, 0x0a, 0xf3, 0xbf, 0x95, 0x04, 0xf3, 0x10, 0x3c, 0x2b, 0x7f, 0x90, 0x46, 0x04, 0xaa, 0x6a, 0xa9, 0x35, 0x76, 0xac, 0x49, 0xb5, 0x00, 0x45,
+	/* (2^274)P */ 0xb1, 0x93, 0x79, 0x84, 0x4a, 0x2a, 0x30, 0x78, 0x16, 0xaa, 0xc5, 0x74, 0x06, 0xce, 0xa5, 0xa7, 0x32, 0x86, 0xe0, 0xf9, 0x10, 0xd2, 0x58, 0x76, 0xfb, 0x66, 0x49, 0x76, 0x3a, 0x90, 0xba, 0xb5, 0xcc, 0x99, 0xcd, 0x09, 0xc1, 0x9a, 0x74, 0x23, 0xdf, 0x0c, 0xfe, 0x99, 0x52, 0x80, 0xa3, 0x7c, 0x1c, 0x71, 0x5f, 0x2c, 0x49, 0x57, 0xf4, 0xf9,
+	/* (2^275)P */ 0x6d, 0xbf, 0x52, 0xe6, 0x25, 0x98, 0xed, 0xcf, 0xe3, 0xbc, 0x08, 0xa2, 0x1a, 0x90, 0xae, 0xa0, 0xbf, 0x07, 0x15, 0xad, 0x0a, 0x9f, 0x3e, 0x47, 0x44, 0xc2, 0x10, 0x46, 0xa6, 0x7a, 0x9e, 0x2f, 0x57, 0xbc, 0xe2, 0xf0, 0x1d, 0xd6, 0x9a, 0x06, 0xed, 0xfc, 0x54, 0x95, 0x92, 0x15, 0xa2, 0xf7, 0x8d, 0x6b, 0xef, 0xb2, 0x05, 0xed, 0x5c, 0x63,
+	/* (2^276)P */ 0xbc, 0x0b, 0x27, 0x3a, 0x3a, 0xf8, 0xe1, 0x48, 0x02, 0x7e, 0x27, 0xe6, 0x81, 0x62, 0x07, 0x73, 0x74, 0xe5, 0x52, 0xd7, 0xf8, 0x26, 0xca, 0x93, 0x4d, 0x3e, 0x9b, 0x55, 0x09, 0x8e, 0xe3, 0xd7, 0xa6, 0xe3, 0xb6, 0x2a, 0xa9, 0xb3, 0xb0, 0xa0, 0x8c, 0x01, 0xbb, 0x07, 0x90, 0x78, 0x6d, 0x6d, 0xe9, 0xf0, 0x7a, 0x90, 0xbd, 0xdc, 0x0c, 0x36,
+	/* (2^277)P */ 0x7f, 0x20, 0x12, 0x0f, 0x40, 0x00, 0x53, 0xd8, 0x0c, 0x27, 0x47, 0x47, 0x22, 0x80, 0xfb, 0x62, 0xe4, 0xa7, 0xf7, 0xbd, 0x42, 0xa5, 0xc3, 0x2b, 0xb2, 0x7f, 0x50, 0xcc, 0xe2, 0xfb, 0xd5, 0xc0, 0x63, 0xdd, 0x24, 0x5f, 0x7c, 0x08, 0x91, 0xbf, 0x6e, 0x47, 0x44, 0xd4, 0x6a, 0xc0, 0xc3, 0x09, 0x39, 0x27, 0xdd, 0xc7, 0xca, 0x06, 0x29, 0x55,
+	/* (2^278)P */ 0x76, 0x28, 0x58, 0xb0, 0xd2, 0xf3, 0x0f, 0x04, 0xe9, 0xc9, 0xab, 0x66, 0x5b, 0x75, 0x51, 0xdc, 0xe5, 0x8f, 0xe8, 0x1f, 0xdb, 0x03, 0x0f, 0xb0, 0x7d, 0xf9, 0x20, 0x64, 0x89, 0xe9, 0xdc, 0xe6, 0x24, 0xc3, 0xd5, 0xd2, 0x41, 0xa6, 0xe4, 0xe3, 0xc4, 0x79, 0x7c, 0x0f, 0xa1, 0x61, 0x2f, 0xda, 0xa4, 0xc9, 0xfd, 0xad, 0x5c, 0x65, 0x6a, 0xf3,
+	/* (2^279)P */ 0xd5, 0xab, 0x72, 0x7a, 0x3b, 0x59, 0xea, 0xcf, 0xd5, 0x17, 0xd2, 0xb2, 0x5f, 0x2d, 0xab, 0xad, 0x9e, 0x88, 0x64, 0x55, 0x96, 0x6e, 0xf3, 0x44, 0xa9, 0x11, 0xf5, 0xf8, 0x3a, 0xf1, 0xcd, 0x79, 0x4c, 0x99, 0x6d, 0x23, 0x6a, 0xa0, 0xc2, 0x1a, 0x19, 0x45, 0xb5, 0xd8, 0x95, 0x2f, 0x49, 0xe9, 0x46, 0x39, 0x26, 0x60, 0x04, 0x15, 0x8b, 0xcc,
+	/* (2^280)P */ 0x66, 0x0c, 0xf0, 0x54, 0x41, 0x02, 0x91, 0xab, 0xe5, 0x85, 0x8a, 0x44, 0xa6, 0x34, 0x96, 0x32, 0xc0, 0xdf, 0x6c, 0x41, 0x39, 0xd4, 0xc6, 0xe1, 0xe3, 0x81, 0xb0, 0x4c, 0x34, 0x4f, 0xe5, 0xf4, 0x35, 0x46, 0x1f, 0xeb, 0x75, 0xfd, 0x43, 0x37, 0x50, 0x99, 0xab, 0xad, 0xb7, 0x8c, 0xa1, 0x57, 0xcb, 0xe6, 0xce, 0x16, 0x2e, 0x85, 0xcc, 0xf9,
+	/* (2^281)P */ 0x63, 0xd1, 0x3f, 0x9e, 0xa2, 0x17, 0x2e, 0x1d, 0x3e, 0xce, 0x48, 0x2d, 0xbb, 0x8f, 0x69, 0xc9, 0xa6, 0x3d, 0x4e, 0xfe, 0x09, 0x56, 0xb3, 0x02, 0x5f, 0x99, 0x97, 0x0c, 0x54, 0xda, 0x32, 0x97, 0x9b, 0xf4, 0x95, 0xf1, 0xad, 0xe3, 0x2b, 0x04, 0xa7, 0x9b, 0x3f, 0xbb, 0xe7, 0x87, 0x2e, 0x1f, 0x8b, 0x4b, 0x7a, 0xa4, 0x43, 0x0c, 0x0f, 0x35,
+	/* (2^282)P */ 0x05, 0xdc, 0xe0, 0x2c, 0xa1, 0xc1, 0xd0, 0xf1, 0x1f, 0x4e, 0xc0, 0x6c, 0x35, 0x7b, 0xca, 0x8f, 0x8b, 0x02, 0xb1, 0xf7, 0xd6, 0x2e, 0xe7, 0x93, 0x80, 0x85, 0x18, 0x88, 0x19, 0xb9, 0xb4, 0x4a, 0xbc, 0xeb, 0x5a, 0x78, 0x38, 0xed, 0xc6, 0x27, 0x2a, 0x74, 0x76, 0xf0, 0x1b, 0x79, 0x92, 0x2f, 0xd2, 0x81, 0x98, 0xdf, 0xa9, 0x50, 0x19, 0xeb,
+	/* (2^283)P */ 0xb5, 0xe7, 0xb4, 0x11, 0x3a, 0x81, 0xb6, 0xb4, 0xf8, 0xa2, 0xb3, 0x6c, 0xfc, 0x9d, 0xe0, 0xc0, 0xe0, 0x59, 0x7f, 0x05, 0x37, 0xef, 0x2c, 0xa9, 0x3a, 0x24, 0xac, 0x7b, 0x25, 0xa0, 0x55, 0xd2, 0x44, 0x82, 0x82, 0x6e, 0x64, 0xa3, 0x58, 0xc8, 0x67, 0xae, 0x26, 0xa7, 0x0f, 0x42, 0x63, 0xe1, 0x93, 0x01, 0x52, 0x19, 0xaf, 0x49, 0x3e, 0x33,
+	/* (2^284)P */ 0x05, 0x85, 0xe6, 0x66, 0xaf, 0x5f, 0xdf, 0xbf, 0x9d, 0x24, 0x62, 0x60, 0x90, 0xe2, 0x4c, 0x7d, 0x4e, 0xc3, 0x74, 0x5d, 0x4f, 0x53, 0xf3, 0x63, 0x13, 0xf4, 0x74, 0x28, 0x6b, 0x7d, 0x57, 0x0c, 0x9d, 0x84, 0xa7, 0x1a, 0xff, 0xa0, 0x79, 0xdf, 0xfc, 0x65, 0x98, 0x8e, 0x22, 0x0d, 0x62, 0x7e, 0xf2, 0x34, 0x60, 0x83, 0x05, 0x14, 0xb1, 0xc1,
+	/* (2^285)P */ 0x64, 0x22, 0xcc, 0xdf, 0x5c, 0xbc, 0x88, 0x68, 0x4c, 0xd9, 0xbc, 0x0e, 0xc9, 0x8b, 0xb4, 0x23, 0x52, 0xad, 0xb0, 0xb3, 0xf1, 0x17, 0xd8, 0x15, 0x04, 0x6b, 0x99, 0xf0, 0xc4, 0x7d, 0x48, 0x22, 0x4a, 0xf8, 0x6f, 0xaa, 0x88, 0x0d, 0xc5, 0x5e, 0xa9, 0x1c, 0x61, 0x3d, 0x95, 0xa9, 0x7b, 0x6a, 0x79, 0x33, 0x0a, 0x2b, 0x99, 0xe3, 0x4e, 0x48,
+	/* (2^286)P */ 0x6b, 0x9b, 0x6a, 0x2a, 0xf1, 0x60, 0x31, 0xb4, 0x73, 0xd1, 0x87, 0x45, 0x9c, 0x15, 0x58, 0x4b, 0x91, 0x6d, 0x94, 0x1c, 0x41, 0x11, 0x4a, 0x83, 0xec, 0xaf, 0x65, 0xbc, 0x34, 0xaa, 0x26, 0xe2, 0xaf, 0xed, 0x46, 0x05, 0x4e, 0xdb, 0xc6, 0x4e, 0x10, 0x28, 0x4e, 0x72, 0xe5, 0x31, 0xa3, 0x20, 0xd7, 0xb1, 0x96, 0x64, 0xf6, 0xce, 0x08, 0x08,
+	/* (2^287)P */ 0x16, 0xa9, 0x5c, 0x9f, 0x9a, 0xb4, 0xb8, 0xc8, 0x32, 0x78, 0xc0, 0x3a, 0xd9, 0x5f, 0x94, 0xac, 0x3a, 0x42, 0x1f, 0x43, 0xd6, 0x80, 0x47, 0x2c, 0xdc, 0x76, 0x27, 0xfa, 0x50, 0xe5, 0xa1, 0xe4, 0xc3, 0xcb, 0x61, 0x31, 0xe1, 0x2e, 0xde, 0x81, 0x3b, 0x77, 0x1c, 0x39, 0x3c, 0xdb, 0xda, 0x87, 0x4b, 0x84, 0x12, 0xeb, 0xdd, 0x54, 0xbf, 0xe7,
+	/* (2^288)P */ 0xbf, 0xcb, 0x73, 0x21, 0x3d, 0x7e, 0x13, 0x8c, 0xa6, 0x34, 0x21, 0x2b, 0xa5, 0xe4, 0x9f, 0x8e, 0x9c, 0x01, 0x9c, 0x43, 0xd9, 0xc7, 0xb9, 0xf1, 0xbe, 0x7f, 0x45, 0x51, 0x97, 0xa1, 0x8e, 0x01, 0xf8, 0xbd, 0xd2, 0xbf, 0x81, 0x3a, 0x8b, 0xab, 0xe4, 0x89, 0xb7, 0xbd, 0xf2, 0xcd, 0xa9, 0x8a, 0x8a, 0xde, 0xfb, 0x8a, 0x55, 0x12, 0x7b, 0x17,
+	/* (2^289)P */ 0x1b, 0x95, 0x58, 0x4d, 0xe6, 0x51, 0x31, 0x52, 0x1c, 0xd8, 0x15, 0x84, 0xb1, 0x0d, 0x36, 0x25, 0x88, 0x91, 0x46, 0x71, 0x42, 0x56, 0xe2, 0x90, 0x08, 0x9e, 0x77, 0x1b, 0xee, 0x22, 0x3f, 0xec, 0xee, 0x8c, 0x7b, 0x2e, 0x79, 0xc4, 0x6c, 0x07, 0xa1, 0x7e, 0x52, 0xf5, 0x26, 0x5c, 0x84, 0x2a, 0x50, 0x6e, 0x82, 0xb3, 0x76, 0xda, 0x35, 0x16,
+	/* (2^290)P */ 0x0a, 0x6f, 0x99, 0x87, 0xc0, 0x7d, 0x8a, 0xb2, 0xca, 0xae, 0xe8, 0x65, 0x98, 0x0f, 0xb3, 0x44, 0xe1, 0xdc, 0x52, 0x79, 0x75, 0xec, 0x8f, 0x95, 0x87, 0x45, 0xd1, 0x32, 0x18, 0x55, 0x15, 0xce, 0x64, 0x9b, 0x08, 0x4f, 0x2c, 0xea, 0xba, 0x1c, 0x57, 0x06, 0x63, 0xc8, 0xb1, 0xfd, 0xc5, 0x67, 0xe7, 0x1f, 0x87, 0x9e, 0xde, 0x72, 0x7d, 0xec,
+	/* (2^291)P */ 0x36, 0x8b, 0x4d, 0x2c, 0xc2, 0x46, 0xe8, 0x96, 0xac, 0x0b, 0x8c, 0xc5, 0x09, 0x10, 0xfc, 0xf2, 0xda, 0xea, 0x22, 0xb2, 0xd3, 0x89, 0xeb, 0xb2, 0x85, 0x0f, 0xff, 0x59, 0x50, 0x2c, 0x99, 0x5a, 0x1f, 0xec, 0x2a, 0x6f, 0xec, 0xcf, 0xe9, 0xce, 0x12, 0x6b, 0x19, 0xd8, 0xde, 0x9b, 0xce, 0x0e, 0x6a, 0xaa, 0xe1, 0x32, 0xea, 0x4c, 0xfe, 0x92,
+	/* (2^292)P */ 0x5f, 0x17, 0x70, 0x53, 0x26, 0x03, 0x0b, 0xab, 0xd1, 0xc1, 0x42, 0x0b, 0xab, 0x2b, 0x3d, 0x31, 0xa4, 0xd5, 0x2b, 0x5e, 0x00, 0xd5, 0x9a, 0x22, 0x34, 0xe0, 0x53, 0x3f, 0x59, 0x7f, 0x2c, 0x6d, 0x72, 0x9a, 0xa4, 0xbe, 0x3d, 0x42, 0x05, 0x1b, 0xf2, 0x7f, 0x88, 0x56, 0xd1, 0x7c, 0x7d, 0x6b, 0x9f, 0x43, 0xfe, 0x65, 0x19, 0xae, 0x9c, 0x4c,
+	/* (2^293)P */ 0xf3, 0x7c, 0x20, 0xa9, 0xfc, 0xf2, 0xf2, 0x3b, 0x3c, 0x57, 0x41, 0x94, 0xe5, 0xcc, 0x6a, 0x37, 0x5d, 0x09, 0xf2, 0xab, 0xc2, 0xca, 0x60, 0x38, 0x6b, 0x7a, 0xe1, 0x78, 0x2b, 0xc1, 0x1d, 0xe8, 0xfd, 0xbc, 0x3d, 0x5c, 0xa2, 0xdb, 0x49, 0x20, 0x79, 0xe6, 0x1b, 0x9b, 0x65, 0xd9, 0x6d, 0xec, 0x57, 0x1d, 0xd2, 0xe9, 0x90, 0xeb, 0x43, 0x7b,
+	/* (2^294)P */ 0x2a, 0x8b, 0x2e, 0x19, 0x18, 0x10, 0xb8, 0x83, 0xe7, 0x7d, 0x2d, 0x9a, 0x3a, 0xe5, 0xd1, 0xe4, 0x7c, 0x38, 0xe5, 0x59, 0x2a, 0x6e, 0xd9, 0x01, 0x29, 0x3d, 0x23, 0xf7, 0x52, 0xba, 0x61, 0x04, 0x9a, 0xde, 0xc4, 0x31, 0x50, 0xeb, 0x1b, 0xaa, 0xde, 0x39, 0x58, 0xd8, 0x1b, 0x1e, 0xfc, 0x57, 0x9a, 0x28, 0x43, 0x9e, 0x97, 0x5e, 0xaa, 0xa3,
+	/* (2^295)P */ 0x97, 0x0a, 0x74, 0xc4, 0x39, 0x99, 0x6b, 0x40, 0xc7, 0x3e, 0x8c, 0xa7, 0xb1, 0x4e, 0x9a, 0x59, 0x6e, 0x1c, 0xfe, 0xfc, 0x2a, 0x5e, 0x73, 0x2b, 0x8c, 0xa9, 0x71, 0xf5, 0xda, 0x6b, 0x15, 0xab, 0xf7, 0xbe, 0x2a, 0x44, 0x5f, 0xba, 0xae, 0x67, 0x93, 0xc5, 0x86, 0xc1, 0xb8, 0xdf, 0xdc, 0xcb, 0xd7, 0xff, 0xb1, 0x71, 0x7c, 0x6f, 0x88, 0xf8,
+	/* (2^296)P */ 0x3f, 0x89, 0xb1, 0xbf, 0x24, 0x16, 0xac, 0x56, 0xfe, 0xdf, 0x94, 0x71, 0xbf, 0xd6, 0x57, 0x0c, 0xb4, 0x77, 0x37, 0xaa, 0x2a, 0x70, 0x76, 0x49, 0xaf, 0x0c, 0x97, 0x8e, 0x78, 0x2a, 0x67, 0xc9, 0x3b, 0x3d, 0x5b, 0x01, 0x2f, 0xda, 0xd5, 0xa8, 0xde, 0x02, 0xa9, 0xac, 0x76, 0x00, 0x0b, 0x46, 0xc6, 0x2d, 0xdc, 0x08, 0xf4, 0x10, 0x2c, 0xbe,
+	/* (2^297)P */ 0xcb, 0x07, 0xf9, 0x91, 0xc6, 0xd5, 0x3e, 0x54, 0x63, 0xae, 0xfc, 0x10, 0xbe, 0x3a, 0x20, 0x73, 0x4e, 0x65, 0x0e, 0x2d, 0x86, 0x77, 0x83, 0x9d, 0xe2, 0x0a, 0xe9, 0xac, 0x22, 0x52, 0x76, 0xd4, 0x6e, 0xfa, 0xe0, 0x09, 0xef, 0x78, 0x82, 0x9f, 0x26, 0xf9, 0x06, 0xb5, 0xe7, 0x05, 0x0e, 0xf2, 0x46, 0x72, 0x93, 0xd3, 0x24, 0xbd, 0x87, 0x60,
+	/* (2^298)P */ 0x14, 0x55, 0x84, 0x7b, 0x6c, 0x60, 0x80, 0x73, 0x8c, 0xbe, 0x2d, 0xd6, 0x69, 0xd6, 0x17, 0x26, 0x44, 0x9f, 0x88, 0xa2, 0x39, 0x7c, 0x89, 0xbc, 0x6d, 0x9e, 0x46, 0xb6, 0x68, 0x66, 0xea, 0xdc, 0x31, 0xd6, 0x21, 0x51, 0x9f, 0x28, 0x28, 0xaf, 0x9e, 0x47, 0x2c, 0x4c, 0x8f, 0xf3, 0xaf, 0x1f, 0xe4, 0xab, 0xac, 0xe9, 0x0c, 0x91, 0x3a, 0x61,
+	/* (2^299)P */ 0xb0, 0x37, 0x55, 0x4b, 0xe9, 0xc3, 0xb1, 0xce, 0x42, 0xe6, 0xc5, 0x11, 0x7f, 0x2c, 0x11, 0xfc, 0x4e, 0x71, 0x17, 0x00, 0x74, 0x7f, 0xbf, 0x07, 0x4d, 0xfd, 0x40, 0xb2, 0x87, 0xb0, 0xef, 0x1f, 0x35, 0x2c, 0x2d, 0xd7, 0xe1, 0xe4, 0xad, 0x0e, 0x7f, 0x63, 0x66, 0x62, 0x23, 0x41, 0xf6, 0xc1, 0x14, 0xa6, 0xd7, 0xa9, 0x11, 0x56, 0x9d, 0x1b,
+	/* (2^300)P */ 0x02, 0x82, 0x42, 0x18, 0x4f, 0x1b, 0xc9, 0x5d, 0x78, 0x5f, 0xee, 0xed, 0x01, 0x49, 0x8f, 0xf2, 0xa0, 0xe2, 0x6e, 0xbb, 0x6b, 0x04, 0x8d, 0xb2, 0x41, 0xae, 0xc8, 0x1b, 0x59, 0x34, 0xb8, 0x2a, 0xdb, 0x1f, 0xd2, 0x52, 0xdf, 0x3f, 0x35, 0x00, 0x8b, 0x61, 0xbc, 0x97, 0xa0, 0xc4, 0x77, 0xd1, 0xe4, 0x2c, 0x59, 0x68, 0xff, 0x30, 0xf2, 0xe2,
+	/* (2^301)P */ 0x79, 0x08, 0xb1, 0xdb, 0x55, 0xae, 0xd0, 0xed, 0xda, 0xa0, 0xec, 0x6c, 0xae, 0x68, 0xf2, 0x0b, 0x61, 0xb3, 0xf5, 0x21, 0x69, 0x87, 0x0b, 0x03, 0xea, 0x8a, 0x15, 0xd9, 0x7e, 0xca, 0xf7, 0xcd, 0xf3, 0x33, 0xb3, 0x4c, 0x5b, 0x23, 0x4e, 0x6f, 0x90, 0xad, 0x91, 0x4b, 0x4f, 0x46, 0x37, 0xe5, 0xe8, 0xb7, 0xeb, 0xd5, 0xca, 0x34, 0x4e, 0x23,
+	/* (2^302)P */ 0x09, 0x02, 0xdd, 0xfd, 0x70, 0xac, 0x56, 0x80, 0x36, 0x5e, 0x49, 0xd0, 0x3f, 0xc2, 0xe0, 0xba, 0x46, 0x7f, 0x5c, 0xf7, 0xc5, 0xbd, 0xd5, 0x55, 0x7d, 0x3f, 0xd5, 0x7d, 0x06, 0xdf, 0x27, 0x20, 0x4f, 0xe9, 0x30, 0xec, 0x1b, 0xa0, 0x0c, 0xd4, 0x2c, 0xe1, 0x2b, 0x65, 0x73, 0xea, 0x75, 0x35, 0xe8, 0xe6, 0x56, 0xd6, 0x07, 0x15, 0x99, 0xdf,
+	/* (2^303)P */ 0x4e, 0x10, 0xb7, 0xd0, 0x63, 0x8c, 0xcf, 0x16, 0x00, 0x7c, 0x58, 0xdf, 0x86, 0xdc, 0x4e, 0xca, 0x9c, 0x40, 0x5a, 0x42, 0xfd, 0xec, 0x98, 0xa4, 0x42, 0x53, 0xae, 0x16, 0x9d, 0xfd, 0x75, 0x5a, 0x12, 0x56, 0x1e, 0xc6, 0x57, 0xcc, 0x79, 0x27, 0x96, 0x00, 0xcf, 0x80, 0x4f, 0x8a, 0x36, 0x5c, 0xbb, 0xe9, 0x12, 0xdb, 0xb6, 0x2b, 0xad, 0x96,
+	/* (2^304)P */ 0x92, 0x32, 0x1f, 0xfd, 0xc6, 0x02, 0x94, 0x08, 0x1b, 0x60, 0x6a, 0x9f, 0x8b, 0xd6, 0xc8, 0xad, 0xd5, 0x1b, 0x27, 0x4e, 0xa4, 0x4d, 0x4a, 0x00, 0x10, 0x5f, 0x86, 0x11, 0xf5, 0xe3, 0x14, 0x32, 0x43, 0xee, 0xb9, 0xc7, 0xab, 0xf4, 0x6f, 0xe5, 0x66, 0x0c, 0x06, 0x0d, 0x96, 0x79, 0x28, 0xaf, 0x45, 0x2b, 0x56, 0xbe, 0xe4, 0x4a, 0x52, 0xd6,
+	/* (2^305)P */ 0x15, 0x16, 0x69, 0xef, 0x60, 0xca, 0x82, 0x25, 0x0f, 0xc6, 0x30, 0xa0, 0x0a, 0xd1, 0x83, 0x29, 0xcd, 0xb6, 0x89, 0x6c, 0xf5, 0xb2, 0x08, 0x38, 0xe6, 0xca, 0x6b, 0x19, 0x93, 0xc6, 0x5f, 0x75, 0x8e, 0x60, 0x34, 0x23, 0xc4, 0x13, 0x17, 0x69, 0x55, 0xcc, 0x72, 0x9c, 0x2b, 0x6c, 0x80, 0xf4, 0x4b, 0x8b, 0xb6, 0x97, 0x65, 0x07, 0xb6, 0xfb,
+	/* (2^306)P */ 0x01, 0x99, 0x74, 0x28, 0xa6, 0x67, 0xa3, 0xe5, 0x25, 0xfb, 0xdf, 0x82, 0x93, 0xe7, 0x35, 0x74, 0xce, 0xe3, 0x15, 0x1c, 0x1d, 0x79, 0x52, 0x84, 0x08, 0x04, 0x2f, 0x5c, 0xb8, 0xcd, 0x7f, 0x89, 0xb0, 0x39, 0x93, 0x63, 0xc9, 0x5d, 0x06, 0x01, 0x59, 0xf7, 0x7e, 0xf1, 0x4c, 0x3d, 0x12, 0x8d, 0x69, 0x1d, 0xb7, 0x21, 0x5e, 0x88, 0x82, 0xa2,
+	/* (2^307)P */ 0x8e, 0x69, 0xaf, 0x9a, 0x41, 0x0d, 0x9d, 0xcf, 0x8e, 0x8d, 0x5c, 0x51, 0x6e, 0xde, 0x0e, 0x48, 0x23, 0x89, 0xe5, 0x37, 0x80, 0xd6, 0x9d, 0x72, 0x32, 0x26, 0x38, 0x2d, 0x63, 0xa0, 0xfa, 0xd3, 0x40, 0xc0, 0x8c, 0x68, 0x6f, 0x2b, 0x1e, 0x9a, 0x39, 0x51, 0x78, 0x74, 0x9a, 0x7b, 0x4a, 0x8f, 0x0c, 0xa0, 0x88, 0x60, 0xa5, 0x21, 0xcd, 0xc7,
+	/* (2^308)P */ 0x3a, 0x7f, 0x73, 0x14, 0xbf, 0x89, 0x6a, 0x4c, 0x09, 0x5d, 0xf2, 0x93, 0x20, 0x2d, 0xc4, 0x29, 0x86, 0x06, 0x95, 0xab, 0x22, 0x76, 0x4c, 0x54, 0xe1, 0x7e, 0x80, 0x6d, 0xab, 0x29, 0x61, 0x87, 0x77, 0xf6, 0xc0, 0x3e, 0xda, 0xab, 0x65, 0x7e, 0x39, 0x12, 0xa1, 0x6b, 0x42, 0xf7, 0xc5, 0x97, 0x77, 0xec, 0x6f, 0x22, 0xbe, 0x44, 0xc7, 0x03,
+	/* (2^309)P */ 0xa5, 0x23, 0x90, 0x41, 0xa3, 0xc5, 0x3e, 0xe0, 0xa5, 0x32, 0x49, 0x1f, 0x39, 0x78, 0xb1, 0xd8, 0x24, 0xea, 0xd4, 0x87, 0x53, 0x42, 0x51, 0xf4, 0xd9, 0x46, 0x25, 0x2f, 0x62, 0xa9, 0x90, 0x9a, 0x4a, 0x25, 0x8a, 0xd2, 0x10, 0xe7, 0x3c, 0xbc, 0x58, 0x8d, 0x16, 0x14, 0x96, 0xa4, 0x6f, 0xf8, 0x12, 0x69, 0x91, 0x73, 0xe2, 0xfa, 0xf4, 0x57,
+	/* (2^310)P */ 0x51, 0x45, 0x3f, 0x96, 0xdc, 0x97, 0x38, 0xa6, 0x01, 0x63, 0x09, 0xea, 0xc2, 0x13, 0x30, 0xb0, 0x00, 0xb8, 0x0a, 0xce, 0xd1, 0x8f, 0x3e, 0x69, 0x62, 0x46, 0x33, 0x9c, 0xbf, 0x4b, 0xcb, 0x0c, 0x90, 0x1c, 0x45, 0xcf, 0x37, 0x5b, 0xf7, 0x4b, 0x5e, 0x95, 0xc3, 0x28, 0x9f, 0x08, 0x83, 0x53, 0x74, 0xab, 0x0c, 0xb4, 0xc0, 0xa1, 0xbc, 0x89,
+	/* (2^311)P */ 0x06, 0xb1, 0x51, 0x15, 0x65, 0x60, 0x21, 0x17, 0x7a, 0x20, 0x65, 0xee, 0x12, 0x35, 0x4d, 0x46, 0xf4, 0xf8, 0xd0, 0xb1, 0xca, 0x09, 0x30, 0x08, 0x89, 0x23, 0x3b, 0xe7, 0xab, 0x8b, 0x77, 0xa6, 0xad, 0x25, 0xdd, 0xea, 0x3c, 0x7d, 0xa5, 0x24, 0xb3, 0xe8, 0xfa, 0xfb, 0xc9, 0xf2, 0x71, 0xe9, 0xfa, 0xf2, 0xdc, 0x54, 0xdd, 0x55, 0x2e, 0x2f,
+	/* (2^312)P */ 0x7f, 0x96, 0x96, 0xfb, 0x52, 0x86, 0xcf, 0xea, 0x62, 0x18, 0xf1, 0x53, 0x1f, 0x61, 0x2a, 0x9f, 0x8c, 0x51, 0xca, 0x2c, 0xde, 0x6d, 0xce, 0xab, 0x58, 0x32, 0x0b, 0x33, 0x9b, 0x99, 0xb4, 0x5c, 0x88, 0x2a, 0x76, 0xcc, 0x3e, 0x54, 0x1e, 0x9d, 0xa2, 0x89, 0xe4, 0x19, 0xba, 0x80, 0xc8, 0x39, 0x32, 0x7f, 0x0f, 0xc7, 0x84, 0xbb, 0x43, 0x56,
+	/* (2^313)P */ 0x9b, 0x07, 0xb4, 0x42, 0xa9, 0xa0, 0x78, 0x4f, 0x28, 0x70, 0x2b, 0x7e, 0x61, 0xe0, 0xdd, 0x02, 0x98, 0xfc, 0xed, 0x31, 0x80, 0xf1, 0x15, 0x52, 0x89, 0x23, 0xcd, 0x5d, 0x2b, 0xc5, 0x19, 0x32, 0xfb, 0x70, 0x50, 0x7a, 0x97, 0x6b, 0x42, 0xdb, 0xca, 0xdb, 0xc4, 0x59, 0x99, 0xe0, 0x12, 0x1f, 0x17, 0xba, 0x8b, 0xf0, 0xc4, 0x38, 0x5d, 0x27,
+	/* (2^314)P */ 0x29, 0x1d, 0xdc, 0x2b, 0xf6, 0x5b, 0x04, 0x61, 0x36, 0x76, 0xa0, 0x56, 0x36, 0x6e, 0xd7, 0x24, 0x4d, 0xe7, 0xef, 0x44, 0xd2, 0xd5, 0x07, 0xcd, 0xc4, 0x9d, 0x80, 0x48, 0xc3, 0x38, 0xcf, 0xd8, 0xa3, 0xdd, 0xb2, 0x5e, 0xb5, 0x70, 0x15, 0xbb, 0x36, 0x85, 0x8a, 0xd7, 0xfb, 0x56, 0x94, 0x73, 0x9c, 0x81, 0xbe, 0xb1, 0x44, 0x28, 0xf1, 0x37,
+	/* (2^315)P */ 0xbf, 0xcf, 0x5c, 0xd2, 0xe2, 0xea, 0xc2, 0xcd, 0x70, 0x7a, 0x9d, 0xcb, 0x81, 0xc1, 0xe9, 0xf1, 0x56, 0x71, 0x52, 0xf7, 0x1b, 0x87, 0xc6, 0xd8, 0xcc, 0xb2, 0x69, 0xf3, 0xb0, 0xbd, 0xba, 0x83, 0x12, 0x26, 0xc4, 0xce, 0x72, 0xde, 0x3b, 0x21, 0x28, 0x9e, 0x5a, 0x94, 0xf5, 0x04, 0xa3, 0xc8, 0x0f, 0x5e, 0xbc, 0x71, 0xf9, 0x0d, 0xce, 0xf5,
+	/* (2^316)P */ 0x93, 0x97, 0x00, 0x85, 0xf4, 0xb4, 0x40, 0xec, 0xd9, 0x2b, 0x6c, 0xd6, 0x63, 0x9e, 0x93, 0x0a, 0x5a, 0xf4, 0xa7, 0x9a, 0xe3, 0x3c, 0xf0, 0x55, 0xd1, 0x96, 0x6c, 0xf5, 0x2a, 0xce, 0xd7, 0x95, 0x72, 0xbf, 0xc5, 0x0c, 0xce, 0x79, 0xa2, 0x0a, 0x78, 0xe0, 0x72, 0xd0, 0x66, 0x28, 0x05, 0x75, 0xd3, 0x23, 0x09, 0x91, 0xed, 0x7e, 0xc4, 0xbc,
+	/* (2^317)P */ 0x77, 0xc2, 0x9a, 0xf7, 0xa6, 0xe6, 0x18, 0xb4, 0xe7, 0xf6, 0xda, 0xec, 0x44, 0x6d, 0xfb, 0x08, 0xee, 0x65, 0xa8, 0x92, 0x85, 0x1f, 0xba, 0x38, 0x93, 0x20, 0x5c, 0x4d, 0xd2, 0x18, 0x0f, 0x24, 0xbe, 0x1a, 0x96, 0x44, 0x7d, 0xeb, 0xb3, 0xda, 0x95, 0xf4, 0xaf, 0x6c, 0x06, 0x0f, 0x47, 0x37, 0xc8, 0x77, 0x63, 0xe1, 0x29, 0xef, 0xff, 0xa5,
+	/* (2^318)P */ 0x16, 0x12, 0xd9, 0x47, 0x90, 0x22, 0x9b, 0x05, 0xf2, 0xa5, 0x9a, 0xae, 0x83, 0x98, 0xb5, 0xac, 0xab, 0x29, 0xaa, 0xdc, 0x5f, 0xde, 0xcd, 0xf7, 0x42, 0xad, 0x3b, 0x96, 0xd6, 0x3e, 0x6e, 0x52, 0x47, 0xb1, 0xab, 0x51, 0xde, 0x49, 0x7c, 0x87, 0x8d, 0x86, 0xe2, 0x70, 0x13, 0x21, 0x51, 0x1c, 0x0c, 0x25, 0xc1, 0xb0, 0xe6, 0x19, 0xcf, 0x12,
+	/* (2^319)P */ 0xf0, 0xbc, 0x97, 0x8f, 0x4b, 0x2f, 0xd1, 0x1f, 0x8c, 0x57, 0xed, 0x3c, 0xf4, 0x26, 0x19, 0xbb, 0x60, 0xca, 0x24, 0xc5, 0xd9, 0x97, 0xe2, 0x5f, 0x76, 0x49, 0x39, 0x7e, 0x2d, 0x12, 0x21, 0x98, 0xda, 0xe6, 0xdb, 0xd2, 0xd8, 0x9f, 0x18, 0xd8, 0x83, 0x6c, 0xba, 0x89, 0x8d, 0x29, 0xfa, 0x46, 0x33, 0x8c, 0x28, 0xdf, 0x6a, 0xb3, 0x69, 0x28,
+	/* (2^320)P */ 0x86, 0x17, 0xbc, 0xd6, 0x7c, 0xba, 0x1e, 0x83, 0xbb, 0x84, 0xb5, 0x8c, 0xad, 0xdf, 0xa1, 0x24, 0x81, 0x70, 0x40, 0x0f, 0xad, 0xad, 0x3b, 0x23, 0xd0, 0x93, 0xa0, 0x49, 0x5c, 0x4b, 0x51, 0xbe, 0x20, 0x49, 0x4e, 0xda, 0x2d, 0xd3, 0xad, 0x1b, 0x74, 0x08, 0x41, 0xf0, 0xef, 0x19, 0xe9, 0x45, 0x5d, 0x02, 0xae, 0x26, 0x25, 0xd9, 0xd1, 0xc2,
+	/* (2^321)P */ 0x48, 0x81, 0x3e, 0xb2, 0x83, 0xf8, 0x4d, 0xb3, 0xd0, 0x4c, 0x75, 0xb3, 0xa0, 0x52, 0x26, 0xf2, 0xaf, 0x5d, 0x36, 0x70, 0x72, 0xd6, 0xb7, 0x88, 0x08, 0x69, 0xbd, 0x15, 0x25, 0xb1, 0x45, 0x1b, 0xb7, 0x0b, 0x5f, 0x71, 0x5d, 0x83, 0x49, 0xb9, 0x84, 0x3b, 0x7c, 0xc1, 0x50, 0x93, 0x05, 0x53, 0xe0, 0x61, 0xea, 0xc1, 0xef, 0xdb, 0x82, 0x97,
+	/* (2^322)P */ 0x00, 0xd5, 0xc3, 0x3a, 0x4d, 0x8a, 0x23, 0x7a, 0xef, 0xff, 0x37, 0xef, 0xf3, 0xbc, 0xa9, 0xb6, 0xae, 0xd7, 0x3a, 0x7b, 0xfd, 0x3e, 0x8e, 0x9b, 0xab, 0x44, 0x54, 0x60, 0x28, 0x6c, 0xbf, 0x15, 0x24, 0x4a, 0x56, 0x60, 0x7f, 0xa9, 0x7a, 0x28, 0x59, 0x2c, 0x8a, 0xd1, 0x7d, 0x6b, 0x00, 0xfd, 0xa5, 0xad, 0xbc, 0x19, 0x3f, 0xcb, 0x73, 0xe0,
+	/* (2^323)P */ 0xcf, 0x9e, 0x66, 0x06, 0x4d, 0x2b, 0xf5, 0x9c, 0xc2, 0x9d, 0x9e, 0xed, 0x5a, 0x5c, 0x2d, 0x00, 0xbf, 0x29, 0x90, 0x88, 0xe4, 0x5d, 0xfd, 0xe2, 0xf0, 0x38, 0xec, 0x4d, 0x26, 0xea, 0x54, 0xf0, 0x3c, 0x84, 0x10, 0x6a, 0xf9, 0x66, 0x9c, 0xe7, 0x21, 0xfd, 0x0f, 0xc7, 0x13, 0x50, 0x81, 0xb6, 0x50, 0xf9, 0x04, 0x7f, 0xa4, 0x37, 0x85, 0x14,
+	/* (2^324)P */ 0xdb, 0x87, 0x49, 0xc7, 0xa8, 0x39, 0x0c, 0x32, 0x98, 0x0c, 0xb9, 0x1a, 0x1b, 0x4d, 0xe0, 0x8a, 0x9a, 0x8e, 0x8f, 0xab, 0x5a, 0x17, 0x3d, 0x04, 0x21, 0xce, 0x3e, 0x2c, 0xf9, 0xa3, 0x97, 0xe4, 0x77, 0x95, 0x0e, 0xb6, 0xa5, 0x15, 0xad, 0x3a, 0x1e, 0x46, 0x53, 0x17, 0x09, 0x83, 0x71, 0x4e, 0x86, 0x38, 0xd5, 0x23, 0x44, 0x16, 0x8d, 0xc8,
+	/* (2^325)P */ 0x05, 0x5e, 0x99, 0x08, 0xbb, 0xc3, 0xc0, 0xb7, 0x6c, 0x12, 0xf2, 0xf3, 0xf4, 0x7c, 0x6a, 0x4d, 0x9e, 0xeb, 0x3d, 0xb9, 0x63, 0x94, 0xce, 0x81, 0xd8, 0x11, 0xcb, 0x55, 0x69, 0x4a, 0x20, 0x0b, 0x4c, 0x2e, 0x14, 0xb8, 0xd4, 0x6a, 0x7c, 0xf0, 0xed, 0xfc, 0x8f, 0xef, 0xa0, 0xeb, 0x6c, 0x01, 0xe2, 0xdc, 0x10, 0x22, 0xa2, 0x01, 0x85, 0x64,
+	/* (2^326)P */ 0x58, 0xe1, 0x9c, 0x27, 0x55, 0xc6, 0x25, 0xa6, 0x7d, 0x67, 0x88, 0x65, 0x99, 0x6c, 0xcb, 0xdb, 0x27, 0x4f, 0x44, 0x29, 0xf5, 0x4a, 0x23, 0x10, 0xbc, 0x03, 0x3f, 0x36, 0x1e, 0xef, 0xb0, 0xba, 0x75, 0xe8, 0x74, 0x5f, 0x69, 0x3e, 0x26, 0x40, 0xb4, 0x2f, 0xdc, 0x43, 0xbf, 0xa1, 0x8b, 0xbd, 0xca, 0x6e, 0xc1, 0x6e, 0x21, 0x79, 0xa0, 0xd0,
+	/* (2^327)P */ 0x78, 0x93, 0x4a, 0x2d, 0x22, 0x6e, 0x6e, 0x7d, 0x74, 0xd2, 0x66, 0x58, 0xce, 0x7b, 0x1d, 0x97, 0xb1, 0xf2, 0xda, 0x1c, 0x79, 0xfb, 0xba, 0xd1, 0xc0, 0xc5, 0x6e, 0xc9, 0x11, 0x89, 0xd2, 0x41, 0x8d, 0x70, 0xb9, 0xcc, 0xea, 0x6a, 0xb3, 0x45, 0xb6, 0x05, 0x2e, 0xf2, 0x17, 0xf1, 0x27, 0xb8, 0xed, 0x06, 0x1f, 0xdb, 0x9d, 0x1f, 0x69, 0x28,
+	/* (2^328)P */ 0x93, 0x12, 0xa8, 0x11, 0xe1, 0x92, 0x30, 0x8d, 0xac, 0xe1, 0x1c, 0x60, 0x7c, 0xed, 0x2d, 0x2e, 0xd3, 0x03, 0x5c, 0x9c, 0xc5, 0xbd, 0x64, 0x4a, 0x8c, 0xba, 0x76, 0xfe, 0xc6, 0xc1, 0xea, 0xc2, 0x4f, 0xbe, 0x70, 0x3d, 0x64, 0xcf, 0x8e, 0x18, 0xcb, 0xcd, 0x57, 0xa7, 0xf7, 0x36, 0xa9, 0x6b, 0x3e, 0xb8, 0x69, 0xee, 0x47, 0xa2, 0x7e, 0xb2,
+	/* (2^329)P */ 0x96, 0xaf, 0x3a, 0xf5, 0xed, 0xcd, 0xaf, 0xf7, 0x82, 0xaf, 0x59, 0x62, 0x0b, 0x36, 0x85, 0xf9, 0xaf, 0xd6, 0x38, 0xff, 0x87, 0x2e, 0x1d, 0x6c, 0x8b, 0xaf, 0x3b, 0xdf, 0x28, 0xa2, 0xd6, 0x4d, 0x80, 0x92, 0xc3, 0x0f, 0x34, 0xa8, 0xae, 0x69, 0x5d, 0x7b, 0x9d, 0xbc, 0xf5, 0xfd, 0x1d, 0xb1, 0x96, 0x55, 0x86, 0xe1, 0x5c, 0xb6, 0xac, 0xb9,
+	/* (2^330)P */ 0x50, 0x9e, 0x37, 0x28, 0x7d, 0xa8, 0x33, 0x63, 0xda, 0x3f, 0x20, 0x98, 0x0e, 0x09, 0xa8, 0x77, 0x3b, 0x7a, 0xfc, 0x16, 0x85, 0x44, 0x64, 0x77, 0x65, 0x68, 0x92, 0x41, 0xc6, 0x1f, 0xdf, 0x27, 0xf9, 0xec, 0xa0, 0x61, 0x22, 0xea, 0x19, 0xe7, 0x75, 0x8b, 0x4e, 0xe5, 0x0f, 0xb7, 0xf7, 0xd2, 0x53, 0xf4, 0xdd, 0x4a, 0xaa, 0x78, 0x40, 0xb7,
+	/* (2^331)P */ 0xd4, 0x89, 0xe3, 0x79, 0xba, 0xb6, 0xc3, 0xda, 0xe6, 0x78, 0x65, 0x7d, 0x6e, 0x22, 0x62, 0xb1, 0x3d, 0xea, 0x90, 0x84, 0x30, 0x5e, 0xd4, 0x39, 0x84, 0x78, 0xd9, 0x75, 0xd6, 0xce, 0x2a, 0x11, 0x29, 0x69, 0xa4, 0x5e, 0xaa, 0x2a, 0x98, 0x5a, 0xe5, 0x91, 0x8f, 0xb2, 0xfb, 0xda, 0x97, 0xe8, 0x83, 0x6f, 0x04, 0xb9, 0x5d, 0xaf, 0xe1, 0x9b,
+	/* (2^332)P */ 0x8b, 0xe4, 0xe1, 0x48, 0x9c, 0xc4, 0x83, 0x89, 0xdf, 0x65, 0xd3, 0x35, 0x55, 0x13, 0xf4, 0x1f, 0x36, 0x92, 0x33, 0x38, 0xcb, 0xed, 0x15, 0xe6, 0x60, 0x2d, 0x25, 0xf5, 0x36, 0x60, 0x3a, 0x37, 0x9b, 0x71, 0x9d, 0x42, 0xb0, 0x14, 0xc8, 0xba, 0x62, 0xa3, 0x49, 0xb0, 0x88, 0xc1, 0x72, 0x73, 0xdd, 0x62, 0x40, 0xa9, 0x62, 0x88, 0x99, 0xca,
+	/* (2^333)P */ 0x47, 0x7b, 0xea, 0xda, 0x46, 0x2f, 0x45, 0xc6, 0xe3, 0xb4, 0x4d, 0x8d, 0xac, 0x0b, 0x54, 0x22, 0x06, 0x31, 0x16, 0x66, 0x3e, 0xe4, 0x38, 0x12, 0xcd, 0xf3, 0xe7, 0x99, 0x37, 0xd9, 0x62, 0x24, 0x4b, 0x05, 0xf2, 0x58, 0xe6, 0x29, 0x4b, 0x0d, 0xf6, 0xc1, 0xba, 0xa0, 0x1e, 0x0f, 0xcb, 0x1f, 0xc6, 0x2b, 0x19, 0xfc, 0x82, 0x01, 0xd0, 0x86,
+	/* (2^334)P */ 0xa2, 0xae, 0x77, 0x20, 0xfb, 0xa8, 0x18, 0xb4, 0x61, 0xef, 0xe8, 0x52, 0x79, 0xbb, 0x86, 0x90, 0x5d, 0x2e, 0x76, 0xed, 0x66, 0x60, 0x5d, 0x00, 0xb5, 0xa4, 0x00, 0x40, 0x89, 0xec, 0xd1, 0xd2, 0x0d, 0x26, 0xb9, 0x30, 0xb2, 0xd2, 0xb8, 0xe8, 0x0e, 0x56, 0xf9, 0x67, 0x94, 0x2e, 0x62, 0xe1, 0x79, 0x48, 0x2b, 0xa9, 0xfa, 0xea, 0xdb, 0x28,
+	/* (2^335)P */ 0x35, 0xf1, 0xb0, 0x43, 0xbd, 0x27, 0xef, 0x18, 0x44, 0xa2, 0x04, 0xb4, 0x69, 0xa1, 0x97, 0x1f, 0x8c, 0x04, 0x82, 0x9b, 0x00, 0x6d, 0xf8, 0xbf, 0x7d, 0xc1, 0x5b, 0xab, 0xe8, 0xb2, 0x34, 0xbd, 0xaf, 0x7f, 0xb2, 0x0d, 0xf3, 0xed, 0xfc, 0x5b, 0x50, 0xee, 0xe7, 0x4a, 0x20, 0xd9, 0xf5, 0xc6, 0x9a, 0x97, 0x6d, 0x07, 0x2f, 0xb9, 0x31, 0x02,
+	/* (2^336)P */ 0xf9, 0x54, 0x4a, 0xc5, 0x61, 0x7e, 0x1d, 0xa6, 0x0e, 0x1a, 0xa8, 0xd3, 0x8c, 0x36, 0x7d, 0xf1, 0x06, 0xb1, 0xac, 0x93, 0xcd, 0xe9, 0x8f, 0x61, 0x6c, 0x5d, 0x03, 0x23, 0xdf, 0x85, 0x53, 0x39, 0x63, 0x5e, 0xeb, 0xf3, 0xd3, 0xd3, 0x75, 0x97, 0x9b, 0x62, 0x9b, 0x01, 0xb3, 0x19, 0xd8, 0x2b, 0x36, 0xf2, 0x2c, 0x2c, 0x6f, 0x36, 0xc6, 0x3c,
+	/* (2^337)P */ 0x05, 0x74, 0x43, 0x10, 0xb6, 0xb0, 0xf8, 0xbf, 0x02, 0x46, 0x9a, 0xee, 0xc1, 0xaf, 0xc1, 0xe5, 0x5a, 0x2e, 0xbb, 0xe1, 0xdc, 0xc6, 0xce, 0x51, 0x29, 0x50, 0xbf, 0x1b, 0xde, 0xff, 0xba, 0x4d, 0x8d, 0x8b, 0x7e, 0xe7, 0xbd, 0x5b, 0x8f, 0xbe, 0xe3, 0x75, 0x71, 0xff, 0x37, 0x05, 0x5a, 0x10, 0xeb, 0x54, 0x7e, 0x44, 0x72, 0x2c, 0xd4, 0xfc,
+	/* (2^338)P */ 0x03, 0x12, 0x1c, 0xb2, 0x08, 0x90, 0xa1, 0x2d, 0x50, 0xa0, 0xad, 0x7f, 0x8d, 0xa6, 0x97, 0xc1, 0xbd, 0xdc, 0xc3, 0xa7, 0xad, 0x31, 0xdf, 0xb8, 0x03, 0x84, 0xc3, 0xb9, 0x29, 0x3d, 0x92, 0x2e, 0xc3, 0x90, 0x07, 0xe8, 0xa7, 0xc7, 0xbc, 0x61, 0xe9, 0x3e, 0xa0, 0x35, 0xda, 0x1d, 0xab, 0x48, 0xfe, 0x50, 0xc9, 0x25, 0x59, 0x23, 0x69, 0x3f,
+	/* (2^339)P */ 0x8e, 0x91, 0xab, 0x6b, 0x91, 0x4f, 0x89, 0x76, 0x67, 0xad, 0xb2, 0x65, 0x9d, 0xad, 0x02, 0x36, 0xdc, 0xac, 0x96, 0x93, 0x97, 0x21, 0x14, 0xd0, 0xe8, 0x11, 0x60, 0x1e, 0xeb, 0x96, 0x06, 0xf2, 0x53, 0xf2, 0x6d, 0xb7, 0x93, 0x6f, 0x26, 0x91, 0x23, 0xe3, 0x34, 0x04, 0x92, 0x91, 0x37, 0x08, 0x50, 0xd6, 0x28, 0x09, 0x27, 0xa1, 0x0c, 0x00,
+	/* (2^340)P */ 0x1f, 0xbb, 0x21, 0x26, 0x33, 0xcb, 0xa4, 0xd1, 0xee, 0x85, 0xf9, 0xd9, 0x3c, 0x90, 0xc3, 0xd1, 0x26, 0xa2, 0x25, 0x93, 0x43, 0x61, 0xed, 0x91, 0x6e, 0x54, 0x03, 0x2e, 0x42, 0x9d, 0xf7, 0xa6, 0x02, 0x0f, 0x2f, 0x9c, 0x7a, 0x8d, 0x12, 0xc2, 0x18, 0xfc, 0x41, 0xff, 0x85, 0x26, 0x1a, 0x44, 0x55, 0x0b, 0x89, 0xab, 0x6f, 0x62, 0x33, 0x8c,
+	/* (2^341)P */ 0xe0, 0x3c, 0x5d, 0x70, 0x64, 0x87, 0x81, 0x35, 0xf2, 0x37, 0xa6, 0x24, 0x3e, 0xe0, 0x62, 0xd5, 0x71, 0xe7, 0x93, 0xfb, 0xac, 0xc3, 0xe7, 0xc7, 0x04, 0xe2, 0x70, 0xd3, 0x29, 0x5b, 0x21, 0xbf, 0xf4, 0x26, 0x5d, 0xf3, 0x95, 0xb4, 0x2a, 0x6a, 0x07, 0x55, 0xa6, 0x4b, 0x3b, 0x15, 0xf2, 0x25, 0x8a, 0x95, 0x3f, 0x63, 0x2f, 0x7a, 0x23, 0x96,
+	/* (2^342)P */ 0x0d, 0x3d, 0xd9, 0x13, 0xa7, 0xb3, 0x5e, 0x67, 0xf7, 0x02, 0x23, 0xee, 0x84, 0xff, 0x99, 0xda, 0xb9, 0x53, 0xf8, 0xf0, 0x0e, 0x39, 0x2f, 0x3c, 0x64, 0x34, 0xe3, 0x09, 0xfd, 0x2b, 0x33, 0xc7, 0xfe, 0x62, 0x2b, 0x84, 0xdf, 0x2b, 0xd2, 0x7c, 0x26, 0x01, 0x70, 0x66, 0x5b, 0x85, 0xc2, 0xbe, 0x88, 0x37, 0xf1, 0x30, 0xac, 0xb8, 0x76, 0xa3,
+	/* (2^343)P */ 0x6e, 0x01, 0xf0, 0x55, 0x35, 0xe4, 0xbd, 0x43, 0x62, 0x9d, 0xd6, 0x11, 0xef, 0x6f, 0xb8, 0x8c, 0xaa, 0x98, 0x87, 0xc6, 0x6d, 0xc4, 0xcc, 0x74, 0x92, 0x53, 0x4a, 0xdf, 0xe4, 0x08, 0x89, 0x17, 0xd0, 0x0f, 0xf4, 0x00, 0x60, 0x78, 0x08, 0x44, 0xb5, 0xda, 0x18, 0xed, 0x98, 0xc8, 0x61, 0x3d, 0x39, 0xdb, 0xcf, 0x1d, 0x49, 0x40, 0x65, 0x75,
+	/* (2^344)P */ 0x8e, 0x10, 0xae, 0x5f, 0x06, 0xd2, 0x95, 0xfd, 0x20, 0x16, 0x49, 0x5b, 0x57, 0xbe, 0x22, 0x8b, 0x43, 0xfb, 0xe6, 0xcc, 0x26, 0xa5, 0x5d, 0xd3, 0x68, 0xc5, 0xf9, 0x5a, 0x86, 0x24, 0x87, 0x27, 0x05, 0xfd, 0xe2, 0xff, 0xb3, 0xa3, 0x7b, 0x37, 0x59, 0xc5, 0x4e, 0x14, 0x94, 0xf9, 0x3b, 0xcb, 0x7c, 0xed, 0xca, 0x1d, 0xb2, 0xac, 0x05, 0x4a,
+	/* (2^345)P */ 0xf4, 0xd1, 0x81, 0xeb, 0x89, 0xbf, 0xfe, 0x1e, 0x41, 0x92, 0x29, 0xee, 0xe1, 0x43, 0xf5, 0x86, 0x1d, 0x2f, 0xbb, 0x1e, 0x84, 0x5d, 0x7b, 0x8d, 0xd5, 0xda, 0xee, 0x1e, 0x8a, 0xd0, 0x27, 0xf2, 0x60, 0x51, 0x59, 0x82, 0xf4, 0x84, 0x2b, 0x5b, 0x14, 0x2d, 0x81, 0x82, 0x3e, 0x2b, 0xb4, 0x6d, 0x51, 0x4f, 0xc5, 0xcb, 0xbf, 0x74, 0xe3, 0xb4,
+	/* (2^346)P */ 0x19, 0x2f, 0x22, 0xb3, 0x04, 0x5f, 0x81, 0xca, 0x05, 0x60, 0xb9, 0xaa, 0xee, 0x0e, 0x2f, 0x48, 0x38, 0xf9, 0x91, 0xb4, 0x66, 0xe4, 0x57, 0x28, 0x54, 0x10, 0xe9, 0x61, 0x9d, 0xd4, 0x90, 0x75, 0xb1, 0x39, 0x23, 0xb6, 0xfc, 0x82, 0xe0, 0xfa, 0xbb, 0x5c, 0x6e, 0xc3, 0x44, 0x13, 0x00, 0x83, 0x55, 0x9e, 0x8e, 0x10, 0x61, 0x81, 0x91, 0x04,
+	/* (2^347)P */ 0x5f, 0x2a, 0xd7, 0x81, 0xd9, 0x9c, 0xbb, 0x79, 0xbc, 0x62, 0x56, 0x98, 0x03, 0x5a, 0x18, 0x85, 0x2a, 0x9c, 0xd0, 0xfb, 0xd2, 0xb1, 0xaf, 0xef, 0x0d, 0x24, 0xc5, 0xfa, 0x39, 0xbb, 0x6b, 0xed, 0xa4, 0xdf, 0xe4, 0x87, 0xcd, 0x41, 0xd3, 0x72, 0x32, 0xc6, 0x28, 0x21, 0xb1, 0xba, 0x8b, 0xa3, 0x91, 0x79, 0x76, 0x22, 0x25, 0x10, 0x61, 0xd1,
+	/* (2^348)P */ 0x73, 0xb5, 0x32, 0x97, 0xdd, 0xeb, 0xdd, 0x22, 0x22, 0xf1, 0x33, 0x3c, 0x77, 0x56, 0x7d, 0x6b, 0x48, 0x2b, 0x05, 0x81, 0x03, 0x03, 0x91, 0x9a, 0xe3, 0x5e, 0xd4, 0xee, 0x3f, 0xf8, 0xbb, 0x50, 0x21, 0x32, 0x4c, 0x4a, 0x58, 0x49, 0xde, 0x0c, 0xde, 0x30, 0x82, 0x3d, 0x92, 0xf0, 0x6c, 0xcc, 0x32, 0x3e, 0xd2, 0x78, 0x8a, 0x6e, 0x2c, 0xd0,
+	/* (2^349)P */ 0xf0, 0xf7, 0xa1, 0x0b, 0xc1, 0x74, 0x85, 0xa8, 0xe9, 0xdd, 0x48, 0xa1, 0xc0, 0x16, 0xd8, 0x2b, 0x61, 0x08, 0xc2, 0x2b, 0x30, 0x26, 0x79, 0xce, 0x9e, 0xfd, 0x39, 0xd7, 0x81, 0xa4, 0x63, 0x8c, 0xd5, 0x74, 0xa0, 0x88, 0xfa, 0x03, 0x30, 0xe9, 0x7f, 0x2b, 0xc6, 0x02, 0xc9, 0x5e, 0xe4, 0xd5, 0x4d, 0x92, 0xd0, 0xf6, 0xf2, 0x5b, 0x79, 0x08,
+	/* (2^350)P */ 0x34, 0x89, 0x81, 0x43, 0xd1, 0x94, 0x2c, 0x10, 0x54, 0x9b, 0xa0, 0xe5, 0x44, 0xe8, 0xc2, 0x2f, 0x3e, 0x0e, 0x74, 0xae, 0xba, 0xe2, 0xac, 0x85, 0x6b, 0xd3, 0x5c, 0x97, 0xf7, 0x90, 0xf1, 0x12, 0xc0, 0x03, 0xc8, 0x1f, 0x37, 0x72, 0x8c, 0x9b, 0x9c, 0x17, 0x96, 0x9d, 0xc7, 0xbf, 0xa3, 0x3f, 0x44, 0x3d, 0x87, 0x81, 0xbd, 0x81, 0xa6, 0x5f,
+	/* (2^351)P */ 0xe4, 0xff, 0x78, 0x62, 0x82, 0x5b, 0x76, 0x58, 0xf5, 0x5b, 0xa6, 0xc4, 0x53, 0x11, 0x3b, 0x7b, 0xaa, 0x67, 0xf8, 0xea, 0x3b, 0x5d, 0x9a, 0x2e, 0x04, 0xeb, 0x4a, 0x24, 0xfb, 0x56, 0xf0, 0xa8, 0xd4, 0x14, 0xed, 0x0f, 0xfd, 0xc5, 0x26, 0x17, 0x2a, 0xf0, 0xb9, 0x13, 0x8c, 0xbd, 0x65, 0x14, 0x24, 0x95, 0x27, 0x12, 0x63, 0x2a, 0x09, 0x18,
+	/* (2^352)P */ 0xe1, 0x5c, 0xe7, 0xe0, 0x00, 0x6a, 0x96, 0xf2, 0x49, 0x6a, 0x39, 0xa5, 0xe0, 0x17, 0x79, 0x4a, 0x63, 0x07, 0x62, 0x09, 0x61, 0x1b, 0x6e, 0xa9, 0xb5, 0x62, 0xb7, 0xde, 0xdf, 0x80, 0x4c, 0x5a, 0x99, 0x73, 0x59, 0x9d, 0xfb, 0xb1, 0x5e, 0xbe, 0xb8, 0xb7, 0x63, 0x93, 0xe8, 0xad, 0x5e, 0x1f, 0xae, 0x59, 0x1c, 0xcd, 0xb4, 0xc2, 0xb3, 0x8a,
+	/* (2^353)P */ 0x78, 0x53, 0xa1, 0x4c, 0x70, 0x9c, 0x63, 0x7e, 0xb3, 0x12, 0x40, 0x5f, 0xbb, 0x23, 0xa7, 0xf7, 0x77, 0x96, 0x5b, 0x4d, 0x91, 0x10, 0x52, 0x85, 0x9e, 0xa5, 0x38, 0x0b, 0xfd, 0x25, 0x01, 0x4b, 0xfa, 0x4d, 0xd3, 0x3f, 0x78, 0x74, 0x42, 0xff, 0x62, 0x2d, 0x27, 0xdc, 0x9d, 0xd1, 0x29, 0x76, 0x2e, 0x78, 0xb3, 0x35, 0xfa, 0x15, 0xd5, 0x38,
+	/* (2^354)P */ 0x8b, 0xc7, 0x43, 0xce, 0xf0, 0x5e, 0xf1, 0x0d, 0x02, 0x38, 0xe8, 0x82, 0xc9, 0x25, 0xad, 0x2d, 0x27, 0xa4, 0x54, 0x18, 0xb2, 0x30, 0x73, 0xa4, 0x41, 0x08, 0xe4, 0x86, 0xe6, 0x8c, 0xe9, 0x2a, 0x34, 0xb3, 0xd6, 0x61, 0x8f, 0x66, 0x26, 0x08, 0xb6, 0x06, 0x33, 0xaa, 0x12, 0xac, 0x72, 0xec, 0x2e, 0x52, 0xa3, 0x25, 0x3e, 0xd7, 0x62, 0xe8,
+	/* (2^355)P */ 0xc4, 0xbb, 0x89, 0xc8, 0x40, 0xcc, 0x84, 0xec, 0x4a, 0xd9, 0xc4, 0x55, 0x78, 0x00, 0xcf, 0xd8, 0xe9, 0x24, 0x59, 0xdc, 0x5e, 0xf0, 0x66, 0xa1, 0x83, 0xae, 0x97, 0x18, 0xc5, 0x54, 0x27, 0xa2, 0x21, 0x52, 0x03, 0x31, 0x5b, 0x11, 0x67, 0xf6, 0x12, 0x00, 0x87, 0x2f, 0xff, 0x59, 0x70, 0x8f, 0x6d, 0x71, 0xab, 0xab, 0x24, 0xb8, 0xba, 0x35,
+	/* (2^356)P */ 0x69, 0x43, 0xa7, 0x14, 0x06, 0x96, 0xe9, 0xc2, 0xe3, 0x2b, 0x45, 0x22, 0xc0, 0xd0, 0x2f, 0x34, 0xd1, 0x01, 0x99, 0xfc, 0x99, 0x38, 0xa1, 0x25, 0x2e, 0x59, 0x6c, 0x27, 0xc9, 0xeb, 0x7b, 0xdc, 0x4e, 0x26, 0x68, 0xba, 0xfa, 0xec, 0x02, 0x05, 0x64, 0x80, 0x30, 0x20, 0x5c, 0x26, 0x7f, 0xaf, 0x95, 0x17, 0x3d, 0x5c, 0x9e, 0x96, 0x96, 0xaf,
+	/* (2^357)P */ 0xa6, 0xba, 0x21, 0x29, 0x32, 0xe2, 0x98, 0xde, 0x9b, 0x6d, 0x0b, 0x44, 0x91, 0xa8, 0x3e, 0xd4, 0xb8, 0x04, 0x6c, 0xf6, 0x04, 0x39, 0xbd, 0x52, 0x05, 0x15, 0x27, 0x78, 0x8e, 0x55, 0xac, 0x79, 0xc5, 0xe6, 0x00, 0x7f, 0x90, 0xa2, 0xdd, 0x07, 0x13, 0xe0, 0x24, 0x70, 0x5c, 0x0f, 0x4d, 0xa9, 0xf9, 0xae, 0xcb, 0x34, 0x10, 0x9d, 0x89, 0x9d,
+	/* (2^358)P */ 0x12, 0xe0, 0xb3, 0x9f, 0xc4, 0x96, 0x1d, 0xcf, 0xed, 0x99, 0x64, 0x28, 0x8d, 0xc7, 0x31, 0x82, 0xee, 0x5e, 0x75, 0x48, 0xff, 0x3a, 0xf2, 0x09, 0x34, 0x03, 0x93, 0x52, 0x19, 0xb2, 0xc5, 0x81, 0x93, 0x45, 0x5e, 0x59, 0x21, 0x2b, 0xec, 0x89, 0xba, 0x36, 0x6e, 0xf9, 0x82, 0x75, 0x7e, 0x82, 0x3f, 0xaa, 0xe2, 0xe3, 0x3b, 0x94, 0xfd, 0x98,
+	/* (2^359)P */ 0x7c, 0xdb, 0x75, 0x31, 0x61, 0xfb, 0x15, 0x28, 0x94, 0xd7, 0xc3, 0x5a, 0xa9, 0xa1, 0x0a, 0x66, 0x0f, 0x2b, 0x13, 0x3e, 0x42, 0xb5, 0x28, 0x3a, 0xca, 0x83, 0xf3, 0x61, 0x22, 0xf4, 0x40, 0xc5, 0xdf, 0xe7, 0x31, 0x9f, 0x7e, 0x51, 0x75, 0x06, 0x9d, 0x51, 0xc8, 0xe7, 0x9f, 0xc3, 0x71, 0x4f, 0x3d, 0x5b, 0xfb, 0xe9, 0x8e, 0x08, 0x40, 0x8e,
+	/* (2^360)P */ 0xf7, 0x31, 0xad, 0x50, 0x5d, 0x25, 0x93, 0x73, 0x68, 0xf6, 0x7c, 0x89, 0x5a, 0x3d, 0x9f, 0x9b, 0x05, 0x82, 0xe7, 0x70, 0x4b, 0x19, 0xaa, 0xcf, 0xff, 0xde, 0x50, 0x8f, 0x2f, 0x69, 0xd3, 0xf0, 0x99, 0x51, 0x6b, 0x9d, 0xb6, 0x56, 0x6f, 0xf8, 0x4c, 0x74, 0x8b, 0x4c, 0x91, 0xf9, 0xa9, 0xb1, 0x3e, 0x07, 0xdf, 0x0b, 0x27, 0x8a, 0xb1, 0xed,
+	/* (2^361)P */ 0xfb, 0x67, 0xd9, 0x48, 0xd2, 0xe4, 0x44, 0x9b, 0x43, 0x15, 0x8a, 0xeb, 0x00, 0x53, 0xad, 0x25, 0xc7, 0x7e, 0x19, 0x30, 0x87, 0xb7, 0xd5, 0x5f, 0x04, 0xf8, 0xaa, 0xdd, 0x57, 0xae, 0x34, 0x75, 0xe2, 0x84, 0x4b, 0x54, 0x60, 0x37, 0x95, 0xe4, 0xd3, 0xec, 0xac, 0xef, 0x47, 0x31, 0xa3, 0xc8, 0x31, 0x22, 0xdb, 0x26, 0xe7, 0x6a, 0xb5, 0xad,
+	/* (2^362)P */ 0x44, 0x09, 0x5c, 0x95, 0xe4, 0x72, 0x3c, 0x1a, 0xd1, 0xac, 0x42, 0x51, 0x99, 0x6f, 0xfa, 0x1f, 0xf2, 0x22, 0xbe, 0xff, 0x7b, 0x66, 0xf5, 0x6c, 0xb3, 0x66, 0xc7, 0x4d, 0x78, 0x31, 0x83, 0x80, 0xf5, 0x41, 0xe9, 0x7f, 0xbe, 0xf7, 0x23, 0x49, 0x6b, 0x84, 0x4e, 0x7e, 0x47, 0x07, 0x6e, 0x74, 0xdf, 0xe5, 0x9d, 0x9e, 0x56, 0x2a, 0xc0, 0xbc,
+	/* (2^363)P */ 0xac, 0x10, 0x80, 0x8c, 0x7c, 0xfa, 0x83, 0xdf, 0xb3, 0xd0, 0xc4, 0xbe, 0xfb, 0x9f, 0xac, 0xc9, 0xc3, 0x40, 0x95, 0x0b, 0x09, 0x23, 0xda, 0x63, 0x67, 0xcf, 0xe7, 0x9f, 0x7d, 0x7b, 0x6b, 0xe2, 0xe6, 0x6d, 0xdb, 0x87, 0x9e, 0xa6, 0xff, 0x6d, 0xab, 0xbd, 0xfb, 0x54, 0x84, 0x68, 0xcf, 0x89, 0xf1, 0xd0, 0xe2, 0x85, 0x61, 0xdc, 0x22, 0xd1,
+	/* (2^364)P */ 0xa8, 0x48, 0xfb, 0x8c, 0x6a, 0x63, 0x01, 0x72, 0x43, 0x43, 0xeb, 0x21, 0xa3, 0x00, 0x8a, 0xc0, 0x87, 0x51, 0x9e, 0x86, 0x75, 0x16, 0x79, 0xf9, 0x6b, 0x11, 0x80, 0x62, 0xc2, 0x9d, 0xb8, 0x8c, 0x30, 0x8e, 0x8d, 0x03, 0x52, 0x7e, 0x31, 0x59, 0x38, 0xf9, 0x25, 0xc7, 0x0f, 0xc7, 0xa8, 0x2b, 0x5c, 0x80, 0xfa, 0x90, 0xa2, 0x63, 0xca, 0xe7,
+	/* (2^365)P */ 0xf1, 0x5d, 0xb5, 0xd9, 0x20, 0x10, 0x7d, 0x0f, 0xc5, 0x50, 0x46, 0x07, 0xff, 0x02, 0x75, 0x2b, 0x4a, 0xf3, 0x39, 0x91, 0x72, 0xb7, 0xd5, 0xcc, 0x38, 0xb8, 0xe7, 0x36, 0x26, 0x5e, 0x11, 0x97, 0x25, 0xfb, 0x49, 0x68, 0xdc, 0xb4, 0x46, 0x87, 0x5c, 0xc2, 0x7f, 0xaa, 0x7d, 0x36, 0x23, 0xa6, 0xc6, 0x53, 0xec, 0xbc, 0x57, 0x47, 0xc1, 0x2b,
+	/* (2^366)P */ 0x25, 0x5d, 0x7d, 0x95, 0xda, 0x0b, 0x8f, 0x78, 0x1e, 0x19, 0x09, 0xfa, 0x67, 0xe0, 0xa0, 0x17, 0x24, 0x76, 0x6c, 0x30, 0x1f, 0x62, 0x3d, 0xbe, 0x45, 0x70, 0xcc, 0xb6, 0x1e, 0x68, 0x06, 0x25, 0x68, 0x16, 0x1a, 0x33, 0x3f, 0x90, 0xc7, 0x78, 0x2d, 0x98, 0x3c, 0x2f, 0xb9, 0x2d, 0x94, 0x0b, 0xfb, 0x49, 0x56, 0x30, 0xd7, 0xc1, 0xe6, 0x48,
+	/* (2^367)P */ 0x7a, 0xd1, 0xe0, 0x8e, 0x67, 0xfc, 0x0b, 0x50, 0x1f, 0x84, 0x98, 0xfa, 0xaf, 0xae, 0x2e, 0x31, 0x27, 0xcf, 0x3f, 0xf2, 0x6e, 0x8d, 0x81, 0x8f, 0xd2, 0x5f, 0xde, 0xd3, 0x5e, 0xe9, 0xe7, 0x13, 0x48, 0x83, 0x5a, 0x4e, 0x84, 0xd1, 0x58, 0xcf, 0x6b, 0x84, 0xdf, 0x13, 0x1d, 0x91, 0x85, 0xe8, 0xcb, 0x29, 0x79, 0xd2, 0xca, 0xac, 0x6a, 0x93,
+	/* (2^368)P */ 0x53, 0x82, 0xce, 0x61, 0x96, 0x88, 0x6f, 0xe1, 0x4a, 0x4c, 0x1e, 0x30, 0x73, 0xe8, 0x74, 0xde, 0x40, 0x2b, 0xe0, 0xc4, 0xb5, 0xd8, 0x7c, 0x15, 0xe7, 0xe1, 0xb1, 0xe0, 0xd6, 0x88, 0xb1, 0x6a, 0x57, 0x19, 0x6a, 0x22, 0x66, 0x57, 0xf6, 0x8d, 0xfd, 0xc0, 0xf2, 0xa3, 0x03, 0x56, 0xfb, 0x2e, 0x75, 0x5e, 0xc7, 0x8e, 0x22, 0x96, 0x5c, 0x06,
+	/* (2^369)P */ 0x98, 0x7e, 0xbf, 0x3e, 0xbf, 0x24, 0x9d, 0x15, 0xd3, 0xf6, 0xd3, 0xd2, 0xf0, 0x11, 0xf2, 0xdb, 0x36, 0x23, 0x38, 0xf7, 0x1d, 0x71, 0x20, 0xd2, 0x54, 0x7f, 0x1e, 0x24, 0x8f, 0xe2, 0xaa, 0xf7, 0x3f, 0x6b, 0x41, 0x4e, 0xdc, 0x0e, 0xec, 0xe8, 0x35, 0x0a, 0x08, 0x6d, 0x89, 0x5b, 0x32, 0x91, 0x01, 0xb6, 0xe0, 0x2c, 0xc6, 0xa1, 0xbe, 0xb4,
+	/* (2^370)P */ 0x29, 0xf2, 0x1e, 0x1c, 0xdc, 0x68, 0x8a, 0x43, 0x87, 0x2c, 0x48, 0xb3, 0x9e, 0xed, 0xd2, 0x82, 0x46, 0xac, 0x2f, 0xef, 0x93, 0x34, 0x37, 0xca, 0x64, 0x8d, 0xc9, 0x06, 0x90, 0xbb, 0x78, 0x0a, 0x3c, 0x4c, 0xcf, 0x35, 0x7a, 0x0f, 0xf7, 0xa7, 0xf4, 0x2f, 0x45, 0x69, 0x3f, 0xa9, 0x5d, 0xce, 0x7b, 0x8a, 0x84, 0xc3, 0xae, 0xf4, 0xda, 0xd5,
+	/* (2^371)P */ 0xca, 0xba, 0x95, 0x43, 0x05, 0x7b, 0x06, 0xd9, 0x5c, 0x0a, 0x18, 0x5f, 0x6a, 0x6a, 0xce, 0xc0, 0x3d, 0x95, 0x51, 0x0e, 0x1a, 0xbe, 0x85, 0x7a, 0xf2, 0x69, 0xec, 0xc0, 0x8c, 0xca, 0xa3, 0x32, 0x0a, 0x76, 0x50, 0xc6, 0x76, 0x61, 0x00, 0x89, 0xbf, 0x6e, 0x0f, 0x48, 0x90, 0x31, 0x93, 0xec, 0x34, 0x70, 0xf0, 0xc3, 0x8d, 0xf0, 0x0f, 0xb5,
+	/* (2^372)P */ 0xbe, 0x23, 0xe2, 0x18, 0x99, 0xf1, 0xed, 0x8a, 0xf6, 0xc9, 0xac, 0xb8, 0x1e, 0x9a, 0x3c, 0x15, 0xae, 0xd7, 0x6d, 0xb3, 0x04, 0xee, 0x5b, 0x0d, 0x1e, 0x79, 0xb7, 0xf9, 0xf9, 0x8d, 0xad, 0xf9, 0x8f, 0x5a, 0x6a, 0x7b, 0xd7, 0x9b, 0xca, 0x62, 0xfe, 0x9c, 0xc0, 0x6f, 0x6d, 0x9d, 0x76, 0xa3, 0x69, 0xb9, 0x4c, 0xa1, 0xc4, 0x0c, 0x76, 0xaa,
+	/* (2^373)P */ 0x1c, 0x06, 0xfe, 0x3f, 0x45, 0x70, 0xcd, 0x97, 0xa9, 0xa2, 0xb1, 0xd3, 0xf2, 0xa5, 0x0c, 0x49, 0x2c, 0x75, 0x73, 0x1f, 0xcf, 0x00, 0xaf, 0xd5, 0x2e, 0xde, 0x0d, 0x8f, 0x8f, 0x7c, 0xc4, 0x58, 0xce, 0xd4, 0xf6, 0x24, 0x19, 0x2e, 0xd8, 0xc5, 0x1d, 0x1a, 0x3f, 0xb8, 0x4f, 0xbc, 0x7d, 0xbd, 0x68, 0xe3, 0x81, 0x98, 0x1b, 0xa8, 0xc9, 0xd9,
+	/* (2^374)P */ 0x39, 0x95, 0x78, 0x24, 0x6c, 0x38, 0xe4, 0xe7, 0xd0, 0x8d, 0xb9, 0x38, 0x71, 0x5e, 0xc1, 0x62, 0x80, 0xcc, 0xcb, 0x8c, 0x97, 0xca, 0xf8, 0xb9, 0xd9, 0x9c, 0xce, 0x72, 0x7b, 0x70, 0xee, 0x5f, 0xea, 0xa2, 0xdf, 0xa9, 0x14, 0x10, 0xf9, 0x6e, 0x59, 0x9f, 0x9c, 0xe0, 0x0c, 0xb2, 0x07, 0x97, 0xcd, 0xd2, 0x89, 0x16, 0xfd, 0x9c, 0xa8, 0xa5,
+	/* (2^375)P */ 0x5a, 0x61, 0xf1, 0x59, 0x7c, 0x38, 0xda, 0xe2, 0x85, 0x99, 0x68, 0xe9, 0xc9, 0xf7, 0x32, 0x7e, 0xc4, 0xca, 0xb7, 0x11, 0x08, 0x69, 0x2b, 0x66, 0x02, 0xf7, 0x2e, 0x18, 0xc3, 0x8e, 0xe1, 0xf9, 0xc5, 0x19, 0x9a, 0x0a, 0x9c, 0x07, 0xba, 0xc7, 0x9c, 0x03, 0x34, 0x89, 0x99, 0x67, 0x0b, 0x16, 0x4b, 0x07, 0x36, 0x16, 0x36, 0x2c, 0xe2, 0xa1,
+	/* (2^376)P */ 0x70, 0x10, 0x91, 0x27, 0xa8, 0x24, 0x8e, 0x29, 0x04, 0x6f, 0x79, 0x1f, 0xd3, 0xa5, 0x68, 0xd3, 0x0b, 0x7d, 0x56, 0x4d, 0x14, 0x57, 0x7b, 0x2e, 0x00, 0x9f, 0x9a, 0xfd, 0x6c, 0x63, 0x18, 0x81, 0xdb, 0x9d, 0xb7, 0xd7, 0xa4, 0x1e, 0xe8, 0x40, 0xf1, 0x4c, 0xa3, 0x01, 0xd5, 0x4b, 0x75, 0xea, 0xdd, 0x97, 0xfd, 0x5b, 0xb2, 0x66, 0x6a, 0x24,
+	/* (2^377)P */ 0x72, 0x11, 0xfe, 0x73, 0x1b, 0xd3, 0xea, 0x7f, 0x93, 0x15, 0x15, 0x05, 0xfe, 0x40, 0xe8, 0x28, 0xd8, 0x50, 0x47, 0x66, 0xfa, 0xb7, 0xb5, 0x04, 0xba, 0x35, 0x1e, 0x32, 0x9f, 0x5f, 0x32, 0xba, 0x3d, 0xd1, 0xed, 0x9a, 0x76, 0xca, 0xa3, 0x3e, 0x77, 0xd8, 0xd8, 0x7c, 0x5f, 0x68, 0x42, 0xb5, 0x86, 0x7f, 0x3b, 0xc9, 0xc1, 0x89, 0x64, 0xda,
+	/* (2^378)P */ 0xd5, 0xd4, 0x17, 0x31, 0xfc, 0x6a, 0xfd, 0xb8, 0xe8, 0xe5, 0x3e, 0x39, 0x06, 0xe4, 0xd1, 0x90, 0x2a, 0xca, 0xf6, 0x54, 0x6c, 0x1b, 0x2f, 0x49, 0x97, 0xb1, 0x2a, 0x82, 0x43, 0x3d, 0x1f, 0x8b, 0xe2, 0x47, 0xc5, 0x24, 0xa8, 0xd5, 0x53, 0x29, 0x7d, 0xc6, 0x87, 0xa6, 0x25, 0x3a, 0x64, 0xdd, 0x71, 0x08, 0x9e, 0xcd, 0xe9, 0x45, 0xc7, 0xba,
+	/* (2^379)P */ 0x37, 0x72, 0x6d, 0x13, 0x7a, 0x8d, 0x04, 0x31, 0xe6, 0xe3, 0x9e, 0x36, 0x71, 0x3e, 0xc0, 0x1e, 0xe3, 0x71, 0xd3, 0x49, 0x4e, 0x4a, 0x36, 0x42, 0x68, 0x68, 0x61, 0xc7, 0x3c, 0xdb, 0x81, 0x49, 0xf7, 0x91, 0x4d, 0xea, 0x4c, 0x4f, 0x98, 0xc6, 0x7e, 0x60, 0x84, 0x4b, 0x6a, 0x37, 0xbb, 0x52, 0xf7, 0xce, 0x02, 0xe4, 0xad, 0xd1, 0x3c, 0xa7,
+	/* (2^380)P */ 0x51, 0x06, 0x2d, 0xf8, 0x08, 0xe8, 0xf1, 0x0c, 0xe5, 0xa9, 0xac, 0x29, 0x73, 0x3b, 0xed, 0x98, 0x5f, 0x55, 0x08, 0x38, 0x51, 0x44, 0x36, 0x5d, 0xea, 0xc3, 0xb8, 0x0e, 0xa0, 0x4f, 0xd2, 0x79, 0xe9, 0x98, 0xc3, 0xf5, 0x00, 0xb9, 0x26, 0x27, 0x42, 0xa8, 0x07, 0xc1, 0x12, 0x31, 0xc1, 0xc3, 0x3c, 0x3b, 0x7a, 0x72, 0x97, 0xc2, 0x70, 0x3a,
+	/* (2^381)P */ 0xf4, 0xb2, 0xba, 0x32, 0xbc, 0xa9, 0x2f, 0x87, 0xc7, 0x3c, 0x45, 0xcd, 0xae, 0xe2, 0x13, 0x6d, 0x3a, 0xf2, 0xf5, 0x66, 0x97, 0x29, 0xaf, 0x53, 0x9f, 0xda, 0xea, 0x14, 0xdf, 0x04, 0x98, 0x19, 0x95, 0x9e, 0x2a, 0x00, 0x5c, 0x9d, 0x1d, 0xf0, 0x39, 0x23, 0xff, 0xfc, 0xca, 0x36, 0xb7, 0xde, 0xdf, 0x37, 0x78, 0x52, 0x21, 0xfa, 0x19, 0x10,
+	/* (2^382)P */ 0x50, 0x20, 0x73, 0x74, 0x62, 0x21, 0xf2, 0xf7, 0x9b, 0x66, 0x85, 0x34, 0x74, 0xd4, 0x9d, 0x60, 0xd7, 0xbc, 0xc8, 0x46, 0x3b, 0xb8, 0x80, 0x42, 0x15, 0x0a, 0x6c, 0x35, 0x1a, 0x69, 0xf0, 0x1d, 0x4b, 0x29, 0x54, 0x5a, 0x9a, 0x48, 0xec, 0x9f, 0x37, 0x74, 0x91, 0xd0, 0xd1, 0x9e, 0x00, 0xc2, 0x76, 0x56, 0xd6, 0xa0, 0x15, 0x14, 0x83, 0x59,
+	/* (2^383)P */ 0xc2, 0xf8, 0x22, 0x20, 0x23, 0x07, 0xbd, 0x1d, 0x6f, 0x1e, 0x8c, 0x56, 0x06, 0x6a, 0x4b, 0x9f, 0xe2, 0xa9, 0x92, 0x46, 0x4b, 0x46, 0x59, 0xd7, 0xe1, 0xda, 0x14, 0x98, 0x07, 0x65, 0x7e, 0x28, 0x20, 0xf2, 0x9d, 0x4f, 0x36, 0x5c, 0x92, 0xe0, 0x9d, 0xfe, 0x3e, 0xda, 0xe4, 0x47, 0x19, 0x3c, 0x00, 0x7f, 0x22, 0xf2, 0x9e, 0x51, 0xae, 0x4d,
+	/* (2^384)P */ 0xbe, 0x8c, 0x1b, 0x10, 0xb6, 0xad, 0xcc, 0xcc, 0xd8, 0x5e, 0x21, 0xa6, 0xfb, 0xf1, 0xf6, 0xbd, 0x0a, 0x24, 0x67, 0xb4, 0x57, 0x7a, 0xbc, 0xe8, 0xe9, 0xff, 0xee, 0x0a, 0x1f, 0xee, 0xbd, 0xc8, 0x44, 0xed, 0x2b, 0xbb, 0x55, 0x1f, 0xdd, 0x7c, 0xb3, 0xeb, 0x3f, 0x63, 0xa1, 0x28, 0x91, 0x21, 0xab, 0x71, 0xc6, 0x4c, 0xd0, 0xe9, 0xb0, 0x21,
+	/* (2^385)P */ 0xad, 0xc9, 0x77, 0x2b, 0xee, 0x89, 0xa4, 0x7b, 0xfd, 0xf9, 0xf6, 0x14, 0xe4, 0xed, 0x1a, 0x16, 0x9b, 0x78, 0x41, 0x43, 0xa8, 0x83, 0x72, 0x06, 0x2e, 0x7c, 0xdf, 0xeb, 0x7e, 0xdd, 0xd7, 0x8b, 0xea, 0x9a, 0x2b, 0x03, 0xba, 0x57, 0xf3, 0xf1, 0xd9, 0xe5, 0x09, 0xc5, 0x98, 0x61, 0x1c, 0x51, 0x6d, 0x5d, 0x6e, 0xfb, 0x5e, 0x95, 0x9f, 0xb5,
+	/* (2^386)P */ 0x23, 0xe2, 0x1e, 0x95, 0xa3, 0x5e, 0x42, 0x10, 0xc7, 0xc3, 0x70, 0xbf, 0x4b, 0x6b, 0x83, 0x36, 0x93, 0xb7, 0x68, 0x47, 0x88, 0x3a, 0x10, 0x88, 0x48, 0x7f, 0x8c, 0xae, 0x54, 0x10, 0x02, 0xa4, 0x52, 0x8f, 0x8d, 0xf7, 0x26, 0x4f, 0x50, 0xc3, 0x6a, 0xe2, 0x4e, 0x3b, 0x4c, 0xb9, 0x8a, 0x14, 0x15, 0x6d, 0x21, 0x29, 0xb3, 0x6e, 0x4e, 0xd0,
+	/* (2^387)P */ 0x4c, 0x8a, 0x18, 0x3f, 0xb7, 0x20, 0xfd, 0x3e, 0x54, 0xca, 0x68, 0x3c, 0xea, 0x6f, 0xf4, 0x6b, 0xa2, 0xbd, 0x01, 0xbd, 0xfe, 0x08, 0xa8, 0xd8, 0xc2, 0x20, 0x36, 0x05, 0xcd, 0xe9, 0xf3, 0x9e, 0xfa, 0x85, 0x66, 0x8f, 0x4b, 0x1d, 0x8c, 0x64, 0x4f, 0xb8, 0xc6, 0x0f, 0x5b, 0x57, 0xd8, 0x24, 0x19, 0x5a, 0x14, 0x4b, 0x92, 0xd3, 0x96, 0xbc,
+	/* (2^388)P */ 0xa9, 0x3f, 0xc9, 0x6c, 0xca, 0x64, 0x1e, 0x6f, 0xdf, 0x65, 0x7f, 0x9a, 0x47, 0x6b, 0x8a, 0x60, 0x31, 0xa6, 0x06, 0xac, 0x69, 0x30, 0xe6, 0xea, 0x63, 0x42, 0x26, 0x5f, 0xdb, 0xd0, 0xf2, 0x8e, 0x34, 0x0a, 0x3a, 0xeb, 0xf3, 0x79, 0xc8, 0xb7, 0x60, 0x56, 0x5c, 0x37, 0x95, 0x71, 0xf8, 0x7f, 0x49, 0x3e, 0x9e, 0x01, 0x26, 0x1e, 0x80, 0x9f,
+	/* (2^389)P */ 0xf8, 0x16, 0x9a, 0xaa, 0xb0, 0x28, 0xb5, 0x8e, 0xd0, 0x60, 0xe5, 0x26, 0xa9, 0x47, 0xc4, 0x5c, 0xa9, 0x39, 0xfe, 0x0a, 0xd8, 0x07, 0x2b, 0xb3, 0xce, 0xf1, 0xea, 0x1a, 0xf4, 0x7b, 0x98, 0x31, 0x3d, 0x13, 0x29, 0x80, 0xe8, 0x0d, 0xcf, 0x56, 0x39, 0x86, 0x50, 0x0c, 0xb3, 0x18, 0xf4, 0xc5, 0xca, 0xf2, 0x6f, 0xcd, 0x8d, 0xd5, 0x02, 0xb0,
+	/* (2^390)P */ 0xbf, 0x39, 0x3f, 0xac, 0x6d, 0x1a, 0x6a, 0xe4, 0x42, 0x24, 0xd6, 0x41, 0x9d, 0xb9, 0x5b, 0x46, 0x73, 0x93, 0x76, 0xaa, 0xb7, 0x37, 0x36, 0xa6, 0x09, 0xe5, 0x04, 0x3b, 0x66, 0xc4, 0x29, 0x3e, 0x41, 0xc2, 0xcb, 0xe5, 0x17, 0xd7, 0x34, 0x67, 0x1d, 0x2c, 0x12, 0xec, 0x24, 0x7a, 0x40, 0xa2, 0x45, 0x41, 0xf0, 0x75, 0xed, 0x43, 0x30, 0xc9,
+	/* (2^391)P */ 0x80, 0xf6, 0x47, 0x5b, 0xad, 0x54, 0x02, 0xbc, 0xdd, 0xa4, 0xb2, 0xd7, 0x42, 0x95, 0xf2, 0x0d, 0x1b, 0xef, 0x37, 0xa7, 0xb4, 0x34, 0x04, 0x08, 0x71, 0x1b, 0xd3, 0xdf, 0xa1, 0xf0, 0x2b, 0xfa, 0xc0, 0x1f, 0xf3, 0x44, 0xb5, 0xc6, 0x47, 0x3d, 0x65, 0x67, 0x45, 0x4d, 0x2f, 0xde, 0x52, 0x73, 0xfc, 0x30, 0x01, 0x6b, 0xc1, 0x03, 0xd8, 0xd7,
+	/* (2^392)P */ 0x1c, 0x67, 0x55, 0x3e, 0x01, 0x17, 0x0f, 0x3e, 0xe5, 0x34, 0x58, 0xfc, 0xcb, 0x71, 0x24, 0x74, 0x5d, 0x36, 0x1e, 0x89, 0x2a, 0x63, 0xf8, 0xf8, 0x9f, 0x50, 0x9f, 0x32, 0x92, 0x29, 0xd8, 0x1a, 0xec, 0x76, 0x57, 0x6c, 0x67, 0x12, 0x6a, 0x6e, 0xef, 0x97, 0x1f, 0xc3, 0x77, 0x60, 0x3c, 0x22, 0xcb, 0xc7, 0x04, 0x1a, 0x89, 0x2d, 0x10, 0xa6,
+	/* (2^393)P */ 0x12, 0xf5, 0xa9, 0x26, 0x16, 0xd9, 0x3c, 0x65, 0x5d, 0x83, 0xab, 0xd1, 0x70, 0x6b, 0x1c, 0xdb, 0xe7, 0x86, 0x0d, 0xfb, 0xe7, 0xf8, 0x2a, 0x58, 0x6e, 0x7a, 0x66, 0x13, 0x53, 0x3a, 0x6f, 0x8d, 0x43, 0x5f, 0x14, 0x23, 0x14, 0xff, 0x3d, 0x52, 0x7f, 0xee, 0xbd, 0x7a, 0x34, 0x8b, 0x35, 0x24, 0xc3, 0x7a, 0xdb, 0xcf, 0x22, 0x74, 0x9a, 0x8f,
+	/* (2^394)P */ 0xdb, 0x20, 0xfc, 0xe5, 0x39, 0x4e, 0x7d, 0x78, 0xee, 0x0b, 0xbf, 0x1d, 0x80, 0xd4, 0x05, 0x4f, 0xb9, 0xd7, 0x4e, 0x94, 0x88, 0x9a, 0x50, 0x78, 0x1a, 0x70, 0x8c, 0xcc, 0x25, 0xb6, 0x61, 0x09, 0xdc, 0x7b, 0xea, 0x3f, 0x7f, 0xea, 0x2a, 0x0d, 0x47, 0x1c, 0x8e, 0xa6, 0x5b, 0xd2, 0xa3, 0x61, 0x93, 0x3c, 0x68, 0x9f, 0x8b, 0xea, 0xb0, 0xcb,
+	/* (2^395)P */ 0xff, 0x54, 0x02, 0x19, 0xae, 0x8b, 0x4c, 0x2c, 0x3a, 0xe0, 0xe4, 0xac, 0x87, 0xf7, 0x51, 0x45, 0x41, 0x43, 0xdc, 0xaa, 0xcd, 0xcb, 0xdc, 0x40, 0xe3, 0x44, 0x3b, 0x1d, 0x9e, 0x3d, 0xb9, 0x82, 0xcc, 0x7a, 0xc5, 0x12, 0xf8, 0x1e, 0xdd, 0xdb, 0x8d, 0xb0, 0x2a, 0xe8, 0xe6, 0x6c, 0x94, 0x3b, 0xb7, 0x2d, 0xba, 0x79, 0x3b, 0xb5, 0x86, 0xfb,
+	/* (2^396)P */ 0x82, 0x88, 0x13, 0xdd, 0x6c, 0xcd, 0x85, 0x2b, 0x90, 0x86, 0xb7, 0xac, 0x16, 0xa6, 0x6e, 0x6a, 0x94, 0xd8, 0x1e, 0x4e, 0x41, 0x0f, 0xce, 0x81, 0x6a, 0xa8, 0x26, 0x56, 0x43, 0x52, 0x52, 0xe6, 0xff, 0x88, 0xcf, 0x47, 0x05, 0x1d, 0xff, 0xf3, 0xa0, 0x10, 0xb2, 0x97, 0x87, 0xeb, 0x47, 0xbb, 0xfa, 0x1f, 0xe8, 0x4c, 0xce, 0xc4, 0xcd, 0x93,
+	/* (2^397)P */ 0xf4, 0x11, 0xf5, 0x8d, 0x89, 0x29, 0x79, 0xb3, 0x59, 0x0b, 0x29, 0x7d, 0x9c, 0x12, 0x4a, 0x65, 0x72, 0x3a, 0xf9, 0xec, 0x37, 0x18, 0x86, 0xef, 0x44, 0x07, 0x25, 0x74, 0x76, 0x53, 0xed, 0x51, 0x01, 0xc6, 0x28, 0xc5, 0xc3, 0x4a, 0x0f, 0x99, 0xec, 0xc8, 0x40, 0x5a, 0x83, 0x30, 0x79, 0xa2, 0x3e, 0x63, 0x09, 0x2d, 0x6f, 0x23, 0x54, 0x1c,
+	/* (2^398)P */ 0x5c, 0x6f, 0x3b, 0x1c, 0x30, 0x77, 0x7e, 0x87, 0x66, 0x83, 0x2e, 0x7e, 0x85, 0x50, 0xfd, 0xa0, 0x7a, 0xc2, 0xf5, 0x0f, 0xc1, 0x64, 0xe7, 0x0b, 0xbd, 0x59, 0xa7, 0xe7, 0x65, 0x53, 0xc3, 0xf5, 0x55, 0x5b, 0xe1, 0x82, 0x30, 0x5a, 0x61, 0xcd, 0xa0, 0x89, 0x32, 0xdb, 0x87, 0xfc, 0x21, 0x8a, 0xab, 0x6d, 0x82, 0xa8, 0x42, 0x81, 0x4f, 0xf2,
+	/* (2^399)P */ 0xb3, 0xeb, 0x88, 0x18, 0xf6, 0x56, 0x96, 0xbf, 0xba, 0x5d, 0x71, 0xa1, 0x5a, 0xd1, 0x04, 0x7b, 0xd5, 0x46, 0x01, 0x74, 0xfe, 0x15, 0x25, 0xb7, 0xff, 0x0c, 0x24, 0x47, 0xac, 0xfd, 0xab, 0x47, 0x32, 0xe1, 0x6a, 0x4e, 0xca, 0xcf, 0x7f, 0xdd, 0xf8, 0xd2, 0x4b, 0x3b, 0xf5, 0x17, 0xba, 0xba, 0x8b, 0xa1, 0xec, 0x28, 0x3f, 0x97, 0xab, 0x2a,
+	/* (2^400)P */ 0x51, 0x38, 0xc9, 0x5e, 0xc6, 0xb3, 0x64, 0xf2, 0x24, 0x4d, 0x04, 0x7d, 0xc8, 0x39, 0x0c, 0x4a, 0xc9, 0x73, 0x74, 0x1b, 0x5c, 0xb2, 0xc5, 0x41, 0x62, 0xa0, 0x4c, 0x6d, 0x8d, 0x91, 0x9a, 0x7b, 0x88, 0xab, 0x9c, 0x7e, 0x23, 0xdb, 0x6f, 0xb5, 0x72, 0xd6, 0x47, 0x40, 0xef, 0x22, 0x58, 0x62, 0x19, 0x6c, 0x38, 0xba, 0x5b, 0x00, 0x30, 0x9f,
+	/* (2^401)P */ 0x65, 0xbb, 0x3b, 0x9b, 0xe9, 0xae, 0xbf, 0xbe, 0xe4, 0x13, 0x95, 0xf3, 0xe3, 0x77, 0xcb, 0xe4, 0x9a, 0x22, 0xb5, 0x4a, 0x08, 0x9d, 0xb3, 0x9e, 0x27, 0xe0, 0x15, 0x6c, 0x9f, 0x7e, 0x9a, 0x5e, 0x15, 0x45, 0x25, 0x8d, 0x01, 0x0a, 0xd2, 0x2b, 0xbd, 0x48, 0x06, 0x0d, 0x18, 0x97, 0x4b, 0xdc, 0xbc, 0xf0, 0xcd, 0xb2, 0x52, 0x3c, 0xac, 0xf5,
+	/* (2^402)P */ 0x3e, 0xed, 0x47, 0x6b, 0x5c, 0xf6, 0x76, 0xd0, 0xe9, 0x15, 0xa3, 0xcb, 0x36, 0x00, 0x21, 0xa3, 0x79, 0x20, 0xa5, 0x3e, 0x88, 0x03, 0xcb, 0x7e, 0x63, 0xbb, 0xed, 0xa9, 0x13, 0x35, 0x16, 0xaf, 0x2e, 0xb4, 0x70, 0x14, 0x93, 0xfb, 0xc4, 0x9b, 0xd8, 0xb1, 0xbe, 0x43, 0xd1, 0x85, 0xb8, 0x97, 0xef, 0xea, 0x88, 0xa1, 0x25, 0x52, 0x62, 0x75,
+	/* (2^403)P */ 0x8e, 0x4f, 0xaa, 0x23, 0x62, 0x7e, 0x2b, 0x37, 0x89, 0x00, 0x11, 0x30, 0xc5, 0x33, 0x4a, 0x89, 0x8a, 0xe2, 0xfc, 0x5c, 0x6a, 0x75, 0xe5, 0xf7, 0x02, 0x4a, 0x9b, 0xf7, 0xb5, 0x6a, 0x85, 0x31, 0xd3, 0x5a, 0xcf, 0xc3, 0xf8, 0xde, 0x2f, 0xcf, 0xb5, 0x24, 0xf4, 0xe3, 0xa1, 0xad, 0x42, 0xae, 0x09, 0xb9, 0x2e, 0x04, 0x2d, 0x01, 0x22, 0x3f,
+	/* (2^404)P */ 0x41, 0x16, 0xfb, 0x7d, 0x50, 0xfd, 0xb5, 0xba, 0x88, 0x24, 0xba, 0xfd, 0x3d, 0xb2, 0x90, 0x15, 0xb7, 0xfa, 0xa2, 0xe1, 0x4c, 0x7d, 0xb9, 0xc6, 0xff, 0x81, 0x57, 0xb6, 0xc2, 0x9e, 0xcb, 0xc4, 0x35, 0xbd, 0x01, 0xb7, 0xaa, 0xce, 0xd0, 0xe9, 0xb5, 0xd6, 0x72, 0xbf, 0xd2, 0xee, 0xc7, 0xac, 0x94, 0xff, 0x29, 0x57, 0x02, 0x49, 0x09, 0xad,
+	/* (2^405)P */ 0x27, 0xa5, 0x78, 0x1b, 0xbf, 0x6b, 0xaf, 0x0b, 0x8c, 0xd9, 0xa8, 0x37, 0xb0, 0x67, 0x18, 0xb6, 0xc7, 0x05, 0x8a, 0x67, 0x03, 0x30, 0x62, 0x6e, 0x56, 0x82, 0xa9, 0x54, 0x3e, 0x0c, 0x4e, 0x07, 0xe1, 0x5a, 0x38, 0xed, 0xfa, 0xc8, 0x55, 0x6b, 0x08, 0xa3, 0x6b, 0x64, 0x2a, 0x15, 0xd6, 0x39, 0x6f, 0x47, 0x99, 0x42, 0x3f, 0x33, 0x84, 0x8f,
+	/* (2^406)P */ 0xbc, 0x45, 0x29, 0x81, 0x0e, 0xa4, 0xc5, 0x72, 0x3a, 0x10, 0xe1, 0xc4, 0x1e, 0xda, 0xc3, 0xfe, 0xb0, 0xce, 0xd2, 0x13, 0x34, 0x67, 0x21, 0xc6, 0x7e, 0xf9, 0x8c, 0xff, 0x39, 0x50, 0xae, 0x92, 0x60, 0x35, 0x2f, 0x8b, 0x6e, 0xc9, 0xc1, 0x27, 0x3a, 0x94, 0x66, 0x3e, 0x26, 0x84, 0x93, 0xc8, 0x6c, 0xcf, 0xd2, 0x03, 0xa1, 0x10, 0xcf, 0xb7,
+	/* (2^407)P */ 0x64, 0xda, 0x19, 0xf6, 0xc5, 0x73, 0x17, 0x44, 0x88, 0x81, 0x07, 0x0d, 0x34, 0xb2, 0x75, 0xf9, 0xd9, 0xe2, 0xe0, 0x8b, 0x71, 0xcf, 0x72, 0x34, 0x83, 0xb4, 0xce, 0xfc, 0xd7, 0x29, 0x09, 0x5a, 0x98, 0xbf, 0x14, 0xac, 0x77, 0x55, 0x38, 0x47, 0x5b, 0x0f, 0x40, 0x24, 0xe5, 0xa5, 0xa6, 0xac, 0x2d, 0xa6, 0xff, 0x9c, 0x73, 0xfe, 0x5c, 0x7e,
+	/* (2^408)P */ 0x1e, 0x33, 0xcc, 0x68, 0xb2, 0xbc, 0x8c, 0x93, 0xaf, 0xcc, 0x38, 0xf8, 0xd9, 0x16, 0x72, 0x50, 0xac, 0xd9, 0xb5, 0x0b, 0x9a, 0xbe, 0x46, 0x7a, 0xf1, 0xee, 0xf1, 0xad, 0xec, 0x5b, 0x59, 0x27, 0x9c, 0x05, 0xa3, 0x87, 0xe0, 0x37, 0x2c, 0x83, 0xce, 0xb3, 0x65, 0x09, 0x8e, 0xc3, 0x9c, 0xbf, 0x6a, 0xa2, 0x00, 0xcc, 0x12, 0x36, 0xc5, 0x95,
+	/* (2^409)P */ 0x36, 0x11, 0x02, 0x14, 0x9c, 0x3c, 0xeb, 0x2f, 0x23, 0x5b, 0x6b, 0x2b, 0x08, 0x54, 0x53, 0xac, 0xb2, 0xa3, 0xe0, 0x26, 0x62, 0x3c, 0xe4, 0xe1, 0x81, 0xee, 0x13, 0x3e, 0xa4, 0x97, 0xef, 0xf9, 0x92, 0x27, 0x01, 0xce, 0x54, 0x8b, 0x3e, 0x31, 0xbe, 0xa7, 0x88, 0xcf, 0x47, 0x99, 0x3c, 0x10, 0x6f, 0x60, 0xb3, 0x06, 0x4e, 0xee, 0x1b, 0xf0,
+	/* (2^410)P */ 0x59, 0x49, 0x66, 0xcf, 0x22, 0xe6, 0xf6, 0x73, 0xfe, 0xa3, 0x1c, 0x09, 0xfa, 0x5f, 0x65, 0xa8, 0xf0, 0x82, 0xc2, 0xef, 0x16, 0x63, 0x6e, 0x79, 0x69, 0x51, 0x39, 0x07, 0x65, 0xc4, 0x81, 0xec, 0x73, 0x0f, 0x15, 0x93, 0xe1, 0x30, 0x33, 0xe9, 0x37, 0x86, 0x42, 0x4c, 0x1f, 0x9b, 0xad, 0xee, 0x3f, 0xf1, 0x2a, 0x8e, 0x6a, 0xa3, 0xc8, 0x35,
+	/* (2^411)P */ 0x1e, 0x49, 0xf1, 0xdd, 0xd2, 0x9c, 0x8e, 0x78, 0xb2, 0x06, 0xe4, 0x6a, 0xab, 0x3a, 0xdc, 0xcd, 0xf4, 0xeb, 0xe1, 0xe7, 0x2f, 0xaa, 0xeb, 0x40, 0x31, 0x9f, 0xb9, 0xab, 0x13, 0xa9, 0x78, 0xbf, 0x38, 0x89, 0x0e, 0x85, 0x14, 0x8b, 0x46, 0x76, 0x14, 0xda, 0xcf, 0x33, 0xc8, 0x79, 0xd3, 0xd5, 0xa3, 0x6a, 0x69, 0x45, 0x70, 0x34, 0xc3, 0xe9,
+	/* (2^412)P */ 0x5e, 0xe7, 0x78, 0xe9, 0x24, 0xcc, 0xe9, 0xf4, 0xc8, 0x6b, 0xe0, 0xfb, 0x3a, 0xbe, 0xcc, 0x42, 0x4a, 0x00, 0x22, 0xf8, 0xe6, 0x32, 0xbe, 0x6d, 0x18, 0x55, 0x60, 0xe9, 0x72, 0x69, 0x50, 0x56, 0xca, 0x04, 0x18, 0x38, 0xa1, 0xee, 0xd8, 0x38, 0x3c, 0xa7, 0x70, 0xe2, 0xb9, 0x4c, 0xa0, 0xc8, 0x89, 0x72, 0xcf, 0x49, 0x7f, 0xdf, 0xbc, 0x67,
+	/* (2^413)P */ 0x1d, 0x17, 0xcb, 0x0b, 0xbd, 0xb2, 0x36, 0xe3, 0xa8, 0x99, 0x31, 0xb6, 0x26, 0x9c, 0x0c, 0x74, 0xaf, 0x4d, 0x24, 0x61, 0xcf, 0x31, 0x7b, 0xed, 0xdd, 0xc3, 0xf6, 0x32, 0x70, 0xfe, 0x17, 0xf6, 0x51, 0x37, 0x65, 0xce, 0x5d, 0xaf, 0xa5, 0x2f, 0x2a, 0xfe, 0x00, 0x71, 0x7c, 0x50, 0xbe, 0x21, 0xc7, 0xed, 0xc6, 0xfc, 0x67, 0xcf, 0x9c, 0xdd,
+	/* (2^414)P */ 0x26, 0x3e, 0xf8, 0xbb, 0xd0, 0xb1, 0x01, 0xd8, 0xeb, 0x0b, 0x62, 0x87, 0x35, 0x4c, 0xde, 0xca, 0x99, 0x9c, 0x6d, 0xf7, 0xb6, 0xf0, 0x57, 0x0a, 0x52, 0x29, 0x6a, 0x3f, 0x26, 0x31, 0x04, 0x07, 0x2a, 0xc9, 0xfa, 0x9b, 0x0e, 0x62, 0x8e, 0x72, 0xf2, 0xad, 0xce, 0xb6, 0x35, 0x7a, 0xc1, 0xae, 0x35, 0xc7, 0xa3, 0x14, 0xcf, 0x0c, 0x28, 0xb7,
+	/* (2^415)P */ 0xa6, 0xf1, 0x32, 0x3a, 0x20, 0xd2, 0x24, 0x97, 0xcf, 0x5d, 0x37, 0x99, 0xaf, 0x33, 0x7a, 0x5b, 0x7a, 0xcc, 0x4e, 0x41, 0x38, 0xb1, 0x4e, 0xad, 0xc9, 0xd9, 0x71, 0x7e, 0xb2, 0xf5, 0xd5, 0x01, 0x6c, 0x4d, 0xfd, 0xa1, 0xda, 0x03, 0x38, 0x9b, 0x3d, 0x92, 0x92, 0xf2, 0xca, 0xbf, 0x1f, 0x24, 0xa4, 0xbb, 0x30, 0x6a, 0x74, 0x56, 0xc8, 0xce,
+	/* (2^416)P */ 0x27, 0xf4, 0xed, 0xc9, 0xc3, 0xb1, 0x79, 0x85, 0xbe, 0xf6, 0xeb, 0xf3, 0x55, 0xc7, 0xaa, 0xa6, 0xe9, 0x07, 0x5d, 0xf4, 0xeb, 0xa6, 0x81, 0xe3, 0x0e, 0xcf, 0xa3, 0xc1, 0xef, 0xe7, 0x34, 0xb2, 0x03, 0x73, 0x8a, 0x91, 0xf1, 0xad, 0x05, 0xc7, 0x0b, 0x43, 0x99, 0x12, 0x31, 0xc8, 0xc7, 0xc5, 0xa4, 0x3d, 0xcd, 0xe5, 0x4e, 0x6d, 0x24, 0xdd,
+	/* (2^417)P */ 0x61, 0x54, 0xd0, 0x95, 0x2c, 0x45, 0x75, 0xac, 0xb5, 0x1a, 0x9d, 0x11, 0xeb, 0xed, 0x6b, 0x57, 0xa3, 0xe6, 0xcd, 0x77, 0xd4, 0x83, 0x8e, 0x39, 0xf1, 0x0f, 0x98, 0xcb, 0x40, 0x02, 0x6e, 0x10, 0x82, 0x9e, 0xb4, 0x93, 0x76, 0xd7, 0x97, 0xa3, 0x53, 0x12, 0x86, 0xc6, 0x15, 0x78, 0x73, 0x93, 0xe7, 0x7f, 0xcf, 0x1f, 0xbf, 0xcd, 0xd2, 0x7a,
+	/* (2^418)P */ 0xc2, 0x21, 0xdc, 0xd5, 0x69, 0xff, 0xca, 0x49, 0x3a, 0xe1, 0xc3, 0x69, 0x41, 0x56, 0xc1, 0x76, 0x63, 0x24, 0xbd, 0x64, 0x1b, 0x3d, 0x92, 0xf9, 0x13, 0x04, 0x25, 0xeb, 0x27, 0xa6, 0xef, 0x39, 0x3a, 0x80, 0xe0, 0xf8, 0x27, 0xee, 0xc9, 0x49, 0x77, 0xef, 0x3f, 0x29, 0x3d, 0x5e, 0xe6, 0x66, 0x83, 0xd1, 0xf6, 0xfe, 0x9d, 0xbc, 0xf1, 0x96,
+	/* (2^419)P */ 0x6b, 0xc6, 0x99, 0x26, 0x3c, 0xf3, 0x63, 0xf9, 0xc7, 0x29, 0x8c, 0x52, 0x62, 0x2d, 0xdc, 0x8a, 0x66, 0xce, 0x2c, 0xa7, 0xe4, 0xf0, 0xd7, 0x37, 0x17, 0x1e, 0xe4, 0xa3, 0x53, 0x7b, 0x29, 0x8e, 0x60, 0x99, 0xf9, 0x0c, 0x7c, 0x6f, 0xa2, 0xcc, 0x9f, 0x80, 0xdd, 0x5e, 0x46, 0xaa, 0x0d, 0x6c, 0xc9, 0x6c, 0xf7, 0x78, 0x5b, 0x38, 0xe3, 0x24,
+	/* (2^420)P */ 0x4b, 0x75, 0x6a, 0x2f, 0x08, 0xe1, 0x72, 0x76, 0xab, 0x82, 0x96, 0xdf, 0x3b, 0x1f, 0x9b, 0xd8, 0xed, 0xdb, 0xcd, 0x15, 0x09, 0x5a, 0x1e, 0xb7, 0xc5, 0x26, 0x72, 0x07, 0x0c, 0x50, 0xcd, 0x3b, 0x4d, 0x3f, 0xa2, 0x67, 0xc2, 0x02, 0x61, 0x2e, 0x68, 0xe9, 0x6f, 0xf0, 0x21, 0x2a, 0xa7, 0x3b, 0x88, 0x04, 0x11, 0x64, 0x49, 0x0d, 0xb4, 0x46,
+	/* (2^421)P */ 0x63, 0x85, 0xf3, 0xc5, 0x2b, 0x5a, 0x9f, 0xf0, 0x17, 0xcb, 0x45, 0x0a, 0xf3, 0x6e, 0x7e, 0xb0, 0x7c, 0xbc, 0xf0, 0x4f, 0x3a, 0xb0, 0xbc, 0x36, 0x36, 0x52, 0x51, 0xcb, 0xfe, 0x9a, 0xcb, 0xe8, 0x7e, 0x4b, 0x06, 0x7f, 0xaa, 0x35, 0xc8, 0x0e, 0x7a, 0x30, 0xa3, 0xb1, 0x09, 0xbb, 0x86, 0x4c, 0xbe, 0xb8, 0xbd, 0xe0, 0x32, 0xa5, 0xd4, 0xf7,
+	/* (2^422)P */ 0x7d, 0x50, 0x37, 0x68, 0x4e, 0x22, 0xb2, 0x2c, 0xd5, 0x0f, 0x2b, 0x6d, 0xb1, 0x51, 0xf2, 0x82, 0xe9, 0x98, 0x7c, 0x50, 0xc7, 0x96, 0x7e, 0x0e, 0xdc, 0xb1, 0x0e, 0xb2, 0x63, 0x8c, 0x30, 0x37, 0x72, 0x21, 0x9c, 0x61, 0xc2, 0xa7, 0x33, 0xd9, 0xb2, 0x63, 0x93, 0xd1, 0x6b, 0x6a, 0x73, 0xa5, 0x58, 0x80, 0xff, 0x04, 0xc7, 0x83, 0x21, 0x29,
+	/* (2^423)P */ 0x29, 0x04, 0xbc, 0x99, 0x39, 0xc9, 0x58, 0xc9, 0x6b, 0x17, 0xe8, 0x90, 0xb3, 0xe6, 0xa9, 0xb6, 0x28, 0x9b, 0xcb, 0x3b, 0x28, 0x90, 0x68, 0x71, 0xff, 0xcf, 0x08, 0x78, 0xc9, 0x8d, 0xa8, 0x4e, 0x43, 0xd1, 0x1c, 0x9e, 0xa4, 0xe3, 0xdf, 0xbf, 0x92, 0xf4, 0xf9, 0x41, 0xba, 0x4d, 0x1c, 0xf9, 0xdd, 0x74, 0x76, 0x1c, 0x6e, 0x3e, 0x94, 0x87,
+	/* (2^424)P */ 0xe4, 0xda, 0xc5, 0xd7, 0xfb, 0x87, 0xc5, 0x4d, 0x6b, 0x19, 0xaa, 0xb9, 0xbc, 0x8c, 0xf2, 0x8a, 0xd8, 0x5d, 0xdb, 0x4d, 0xef, 0xa6, 0xf2, 0x65, 0xf1, 0x22, 0x9c, 0xf1, 0x46, 0x30, 0x71, 0x7c, 0xe4, 0x53, 0x8e, 0x55, 0x2e, 0x9c, 0x9a, 0x31, 0x2a, 0xc3, 0xab, 0x0f, 0xde, 0xe4, 0xbe, 0xd8, 0x96, 0x50, 0x6e, 0x0c, 0x54, 0x49, 0xe6, 0xec,
+	/* (2^425)P */ 0x3c, 0x1d, 0x5a, 0xa5, 0xda, 0xad, 0xdd, 0xc2, 0xae, 0xac, 0x6f, 0x86, 0x75, 0x31, 0x91, 0x64, 0x45, 0x9d, 0xa4, 0xf0, 0x81, 0xf1, 0x0e, 0xba, 0x74, 0xaf, 0x7b, 0xcd, 0x6f, 0xfe, 0xac, 0x4e, 0xdb, 0x4e, 0x45, 0x35, 0x36, 0xc5, 0xc0, 0x6c, 0x3d, 0x64, 0xf4, 0xd8, 0x07, 0x62, 0xd1, 0xec, 0xf3, 0xfc, 0x93, 0xc9, 0x28, 0x0c, 0x2c, 0xf3,
+	/* (2^426)P */ 0x0c, 0x69, 0x2b, 0x5c, 0xb6, 0x41, 0x69, 0xf1, 0xa4, 0xf1, 0x5b, 0x75, 0x4c, 0x42, 0x8b, 0x47, 0xeb, 0x69, 0xfb, 0xa8, 0xe6, 0xf9, 0x7b, 0x48, 0x50, 0xaf, 0xd3, 0xda, 0xb2, 0x35, 0x10, 0xb5, 0x5b, 0x40, 0x90, 0x39, 0xc9, 0x07, 0x06, 0x73, 0x26, 0x20, 0x95, 0x01, 0xa4, 0x2d, 0xf0, 0xe7, 0x2e, 0x00, 0x7d, 0x41, 0x09, 0x68, 0x13, 0xc4,
+	/* (2^427)P */ 0xbe, 0x38, 0x78, 0xcf, 0xc9, 0x4f, 0x36, 0xca, 0x09, 0x61, 0x31, 0x3c, 0x57, 0x2e, 0xec, 0x17, 0xa4, 0x7d, 0x19, 0x2b, 0x9b, 0x5b, 0xbe, 0x8f, 0xd6, 0xc5, 0x2f, 0x86, 0xf2, 0x64, 0x76, 0x17, 0x00, 0x6e, 0x1a, 0x8c, 0x67, 0x1b, 0x68, 0xeb, 0x15, 0xa2, 0xd6, 0x09, 0x91, 0xdd, 0x23, 0x0d, 0x98, 0xb2, 0x10, 0x19, 0x55, 0x9b, 0x63, 0xf2,
+	/* (2^428)P */ 0x51, 0x1f, 0x93, 0xea, 0x2a, 0x3a, 0xfa, 0x41, 0xc0, 0x57, 0xfb, 0x74, 0xa6, 0x65, 0x09, 0x56, 0x14, 0xb6, 0x12, 0xaa, 0xb3, 0x1a, 0x8d, 0x3b, 0x76, 0x91, 0x7a, 0x23, 0x56, 0x9c, 0x6a, 0xc0, 0xe0, 0x3c, 0x3f, 0xb5, 0x1a, 0xf4, 0x57, 0x71, 0x93, 0x2b, 0xb1, 0xa7, 0x70, 0x57, 0x22, 0x80, 0xf5, 0xb8, 0x07, 0x77, 0x87, 0x0c, 0xbe, 0x83,
+	/* (2^429)P */ 0x07, 0x9b, 0x0e, 0x52, 0x38, 0x63, 0x13, 0x86, 0x6a, 0xa6, 0xb4, 0xd2, 0x60, 0x68, 0x9a, 0x99, 0x82, 0x0a, 0x04, 0x5f, 0x89, 0x7a, 0x1a, 0x2a, 0xae, 0x2d, 0x35, 0x0c, 0x1e, 0xad, 0xef, 0x4f, 0x9a, 0xfc, 0xc8, 0xd9, 0xcf, 0x9d, 0x48, 0x71, 0xa5, 0x55, 0x79, 0x73, 0x39, 0x1b, 0xd8, 0x73, 0xec, 0x9b, 0x03, 0x16, 0xd8, 0x82, 0xf7, 0x67,
+	/* (2^430)P */ 0x52, 0x67, 0x42, 0x21, 0xc9, 0x40, 0x78, 0x82, 0x2b, 0x95, 0x2d, 0x20, 0x92, 0xd1, 0xe2, 0x61, 0x25, 0xb0, 0xc6, 0x9c, 0x20, 0x59, 0x8e, 0x28, 0x6f, 0xf3, 0xfd, 0xd3, 0xc1, 0x32, 0x43, 0xc9, 0xa6, 0x08, 0x7a, 0x77, 0x9c, 0x4c, 0x8c, 0x33, 0x71, 0x13, 0x69, 0xe3, 0x52, 0x30, 0xa7, 0xf5, 0x07, 0x67, 0xac, 0xad, 0x46, 0x8a, 0x26, 0x25,
+	/* (2^431)P */ 0xda, 0x86, 0xc4, 0xa2, 0x71, 0x56, 0xdd, 0xd2, 0x48, 0xd3, 0xde, 0x42, 0x63, 0x01, 0xa7, 0x2c, 0x92, 0x83, 0x6f, 0x2e, 0xd8, 0x1e, 0x3f, 0xc1, 0xc5, 0x42, 0x4e, 0x34, 0x19, 0x54, 0x6e, 0x35, 0x2c, 0x51, 0x2e, 0xfd, 0x0f, 0x9a, 0x45, 0x66, 0x5e, 0x4a, 0x83, 0xda, 0x0a, 0x53, 0x68, 0x63, 0xfa, 0xce, 0x47, 0x20, 0xd3, 0x34, 0xba, 0x0d,
+	/* (2^432)P */ 0xd0, 0xe9, 0x64, 0xa4, 0x61, 0x4b, 0x86, 0xe5, 0x93, 0x6f, 0xda, 0x0e, 0x31, 0x7e, 0x6e, 0xe3, 0xc6, 0x73, 0xd8, 0xa3, 0x08, 0x57, 0x52, 0xcd, 0x51, 0x63, 0x1d, 0x9f, 0x93, 0x00, 0x62, 0x91, 0x26, 0x21, 0xa7, 0xdd, 0x25, 0x0f, 0x09, 0x0d, 0x35, 0xad, 0xcf, 0x11, 0x8e, 0x6e, 0xe8, 0xae, 0x1d, 0x95, 0xcb, 0x88, 0xf8, 0x70, 0x7b, 0x91,
+	/* (2^433)P */ 0x0c, 0x19, 0x5c, 0xd9, 0x8d, 0xda, 0x9d, 0x2c, 0x90, 0x54, 0x65, 0xe8, 0xb6, 0x35, 0x50, 0xae, 0xea, 0xae, 0x43, 0xb7, 0x1e, 0x99, 0x8b, 0x4c, 0x36, 0x4e, 0xe4, 0x1e, 0xc4, 0x64, 0x43, 0xb6, 0xeb, 0xd4, 0xe9, 0x60, 0x22, 0xee, 0xcf, 0xb8, 0x52, 0x1b, 0xf0, 0x04, 0xce, 0xbc, 0x2b, 0xf0, 0xbe, 0xcd, 0x44, 0x74, 0x1e, 0x1f, 0x63, 0xf9,
+	/* (2^434)P */ 0xe1, 0x3f, 0x95, 0x94, 0xb2, 0xb6, 0x31, 0xa9, 0x1b, 0xdb, 0xfd, 0x0e, 0xdb, 0xdd, 0x1a, 0x22, 0x78, 0x60, 0x9f, 0x75, 0x5f, 0x93, 0x06, 0x0c, 0xd8, 0xbb, 0xa2, 0x85, 0x2b, 0x5e, 0xc0, 0x9b, 0xa8, 0x5d, 0xaf, 0x93, 0x91, 0x91, 0x47, 0x41, 0x1a, 0xfc, 0xb4, 0x51, 0x85, 0xad, 0x69, 0x4d, 0x73, 0x69, 0xd5, 0x4e, 0x82, 0xfb, 0x66, 0xcb,
+	/* (2^435)P */ 0x7c, 0xbe, 0xc7, 0x51, 0xc4, 0x74, 0x6e, 0xab, 0xfd, 0x41, 0x4f, 0x76, 0x4f, 0x24, 0x03, 0xd6, 0x2a, 0xb7, 0x42, 0xb4, 0xda, 0x41, 0x2c, 0x82, 0x48, 0x4c, 0x7f, 0x6f, 0x25, 0x5d, 0x36, 0xd4, 0x69, 0xf5, 0xef, 0x02, 0x81, 0xea, 0x6f, 0x19, 0x69, 0xe8, 0x6f, 0x5b, 0x2f, 0x14, 0x0e, 0x6f, 0x89, 0xb4, 0xb5, 0xd8, 0xae, 0xef, 0x7b, 0x87,
+	/* (2^436)P */ 0xe9, 0x91, 0xa0, 0x8b, 0xc9, 0xe0, 0x01, 0x90, 0x37, 0xc1, 0x6f, 0xdc, 0x5e, 0xf7, 0xbf, 0x43, 0x00, 0xaa, 0x10, 0x76, 0x76, 0x18, 0x6e, 0x19, 0x1e, 0x94, 0x50, 0x11, 0x0a, 0xd1, 0xe2, 0xdb, 0x08, 0x21, 0xa0, 0x1f, 0xdb, 0x54, 0xfe, 0xea, 0x6e, 0xa3, 0x68, 0x56, 0x87, 0x0b, 0x22, 0x4e, 0x66, 0xf3, 0x82, 0x82, 0x00, 0xcd, 0xd4, 0x12,
+	/* (2^437)P */ 0x25, 0x8e, 0x24, 0x77, 0x64, 0x4c, 0xe0, 0xf8, 0x18, 0xc0, 0xdc, 0xc7, 0x1b, 0x35, 0x65, 0xde, 0x67, 0x41, 0x5e, 0x6f, 0x90, 0x82, 0xa7, 0x2e, 0x6d, 0xf1, 0x47, 0xb4, 0x92, 0x9c, 0xfd, 0x6a, 0x9a, 0x41, 0x36, 0x20, 0x24, 0x58, 0xc3, 0x59, 0x07, 0x9a, 0xfa, 0x9f, 0x03, 0xcb, 0xc7, 0x69, 0x37, 0x60, 0xe1, 0xab, 0x13, 0x72, 0xee, 0xa2,
+	/* (2^438)P */ 0x74, 0x78, 0xfb, 0x13, 0xcb, 0x8e, 0x37, 0x1a, 0xf6, 0x1d, 0x17, 0x83, 0x06, 0xd4, 0x27, 0x06, 0x21, 0xe8, 0xda, 0xdf, 0x6b, 0xf3, 0x83, 0x6b, 0x34, 0x8a, 0x8c, 0xee, 0x01, 0x05, 0x5b, 0xed, 0xd3, 0x1b, 0xc9, 0x64, 0x83, 0xc9, 0x49, 0xc2, 0x57, 0x1b, 0xdd, 0xcf, 0xf1, 0x9d, 0x63, 0xee, 0x1c, 0x0d, 0xa0, 0x0a, 0x73, 0x1f, 0x5b, 0x32,
+	/* (2^439)P */ 0x29, 0xce, 0x1e, 0xc0, 0x6a, 0xf5, 0xeb, 0x99, 0x5a, 0x39, 0x23, 0xe9, 0xdd, 0xac, 0x44, 0x88, 0xbc, 0x80, 0x22, 0xde, 0x2c, 0xcb, 0xa8, 0x3b, 0xff, 0xf7, 0x6f, 0xc7, 0x71, 0x72, 0xa8, 0xa3, 0xf6, 0x4d, 0xc6, 0x75, 0xda, 0x80, 0xdc, 0xd9, 0x30, 0xd9, 0x07, 0x50, 0x5a, 0x54, 0x7d, 0xda, 0x39, 0x6f, 0x78, 0x94, 0xbf, 0x25, 0x98, 0xdc,
+	/* (2^440)P */ 0x01, 0x26, 0x62, 0x44, 0xfb, 0x0f, 0x11, 0x72, 0x73, 0x0a, 0x16, 0xc7, 0x16, 0x9c, 0x9b, 0x37, 0xd8, 0xff, 0x4f, 0xfe, 0x57, 0xdb, 0xae, 0xef, 0x7d, 0x94, 0x30, 0x04, 0x70, 0x83, 0xde, 0x3c, 0xd4, 0xb5, 0x70, 0xda, 0xa7, 0x55, 0xc8, 0x19, 0xe1, 0x36, 0x15, 0x61, 0xe7, 0x3b, 0x7d, 0x85, 0xbb, 0xf3, 0x42, 0x5a, 0x94, 0xf4, 0x53, 0x2a,
+	/* (2^441)P */ 0x14, 0x60, 0xa6, 0x0b, 0x83, 0xe1, 0x23, 0x77, 0xc0, 0xce, 0x50, 0xed, 0x35, 0x8d, 0x98, 0x99, 0x7d, 0xf5, 0x8d, 0xce, 0x94, 0x25, 0xc8, 0x0f, 0x6d, 0xfa, 0x4a, 0xa4, 0x3a, 0x1f, 0x66, 0xfb, 0x5a, 0x64, 0xaf, 0x8b, 0x54, 0x54, 0x44, 0x3f, 0x5b, 0x88, 0x61, 0xe4, 0x48, 0x45, 0x26, 0x20, 0xbe, 0x0d, 0x06, 0xbb, 0x65, 0x59, 0xe1, 0x36,
+	/* (2^442)P */ 0xb7, 0x98, 0xce, 0xa3, 0xe3, 0xee, 0x11, 0x1b, 0x9e, 0x24, 0x59, 0x75, 0x31, 0x37, 0x44, 0x6f, 0x6b, 0x9e, 0xec, 0xb7, 0x44, 0x01, 0x7e, 0xab, 0xbb, 0x69, 0x5d, 0x11, 0xb0, 0x30, 0x64, 0xea, 0x91, 0xb4, 0x7a, 0x8c, 0x02, 0x4c, 0xb9, 0x10, 0xa7, 0xc7, 0x79, 0xe6, 0xdc, 0x77, 0xe3, 0xc8, 0xef, 0x3e, 0xf9, 0x38, 0x81, 0xce, 0x9a, 0xb2,
+	/* (2^443)P */ 0x91, 0x12, 0x76, 0xd0, 0x10, 0xb4, 0xaf, 0xe1, 0x89, 0x3a, 0x93, 0x6b, 0x5c, 0x19, 0x5f, 0x24, 0xed, 0x04, 0x92, 0xc7, 0xf0, 0x00, 0x08, 0xc1, 0x92, 0xff, 0x90, 0xdb, 0xb2, 0xbf, 0xdf, 0x49, 0xcd, 0xbd, 0x5c, 0x6e, 0xbf, 0x16, 0xbb, 0x61, 0xf9, 0x20, 0x33, 0x35, 0x93, 0x11, 0xbc, 0x59, 0x69, 0xce, 0x18, 0x9f, 0xf8, 0x7b, 0xa1, 0x6e,
+	/* (2^444)P */ 0xa1, 0xf4, 0xaf, 0xad, 0xf8, 0xe6, 0x99, 0xd2, 0xa1, 0x4d, 0xde, 0x56, 0xc9, 0x7b, 0x0b, 0x11, 0x3e, 0xbf, 0x89, 0x1a, 0x9a, 0x90, 0xe5, 0xe2, 0xa6, 0x37, 0x88, 0xa1, 0x68, 0x59, 0xae, 0x8c, 0xec, 0x02, 0x14, 0x8d, 0xb7, 0x2e, 0x25, 0x75, 0x7f, 0x76, 0x1a, 0xd3, 0x4d, 0xad, 0x8a, 0x00, 0x6c, 0x96, 0x49, 0xa4, 0xc3, 0x2e, 0x5c, 0x7b,
+	/* (2^445)P */ 0x26, 0x53, 0xf7, 0xda, 0xa8, 0x01, 0x14, 0xb1, 0x63, 0xe3, 0xc3, 0x89, 0x88, 0xb0, 0x85, 0x40, 0x2b, 0x26, 0x9a, 0x10, 0x1a, 0x70, 0x33, 0xf4, 0x50, 0x9d, 0x4d, 0xd8, 0x64, 0xc6, 0x0f, 0xe1, 0x17, 0xc8, 0x10, 0x4b, 0xfc, 0xa0, 0xc9, 0xba, 0x2c, 0x98, 0x09, 0xf5, 0x84, 0xb6, 0x7c, 0x4e, 0xa3, 0xe3, 0x81, 0x1b, 0x32, 0x60, 0x02, 0xdd,
+	/* (2^446)P */ 0xa3, 0xe5, 0x86, 0xd4, 0x43, 0xa8, 0xd1, 0x98, 0x9d, 0x9d, 0xdb, 0x04, 0xcf, 0x6e, 0x35, 0x05, 0x30, 0x53, 0x3b, 0xbc, 0x90, 0x00, 0x4a, 0xc5, 0x40, 0x2a, 0x0f, 0xde, 0x1a, 0xd7, 0x36, 0x27, 0x44, 0x62, 0xa6, 0xac, 0x9d, 0xd2, 0x70, 0x69, 0x14, 0x39, 0x9b, 0xd1, 0xc3, 0x0a, 0x3a, 0x82, 0x0e, 0xf1, 0x94, 0xd7, 0x42, 0x94, 0xd5, 0x7d,
+	/* (2^447)P */ 0x04, 0xc0, 0x6e, 0x12, 0x90, 0x70, 0xf9, 0xdf, 0xf7, 0xc9, 0x86, 0xc0, 0xe6, 0x92, 0x8b, 0x0a, 0xa1, 0xc1, 0x3b, 0xcc, 0x33, 0xb7, 0xf0, 0xeb, 0x51, 0x50, 0x80, 0x20, 0x69, 0x1c, 0x4f, 0x89, 0x05, 0x1e, 0xe4, 0x7a, 0x0a, 0xc2, 0xf0, 0xf5, 0x78, 0x91, 0x76, 0x34, 0x45, 0xdc, 0x24, 0x53, 0x24, 0x98, 0xe2, 0x73, 0x6f, 0xe6, 0x46, 0x67,
+}
diff --git a/.ci/providerlint/vendor/github.com/cloudflare/circl/ecc/goldilocks/constants.go b/.ci/providerlint/vendor/github.com/cloudflare/circl/ecc/goldilocks/constants.go
new file mode 100644
index 00000000000..b6b236e5d3d
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/cloudflare/circl/ecc/goldilocks/constants.go
@@ -0,0 +1,71 @@
+package goldilocks
+
+import fp "github.com/cloudflare/circl/math/fp448"
+
+var (
+	// genX is the x-coordinate of the generator of Goldilocks curve.
+	genX = fp.Elt{
+		0x5e, 0xc0, 0x0c, 0xc7, 0x2b, 0xa8, 0x26, 0x26,
+		0x8e, 0x93, 0x00, 0x8b, 0xe1, 0x80, 0x3b, 0x43,
+		0x11, 0x65, 0xb6, 0x2a, 0xf7, 0x1a, 0xae, 0x12,
+		0x64, 0xa4, 0xd3, 0xa3, 0x24, 0xe3, 0x6d, 0xea,
+		0x67, 0x17, 0x0f, 0x47, 0x70, 0x65, 0x14, 0x9e,
+		0xda, 0x36, 0xbf, 0x22, 0xa6, 0x15, 0x1d, 0x22,
+		0xed, 0x0d, 0xed, 0x6b, 0xc6, 0x70, 0x19, 0x4f,
+	}
+	// genY is the y-coordinate of the generator of Goldilocks curve.
+	genY = fp.Elt{
+		0x14, 0xfa, 0x30, 0xf2, 0x5b, 0x79, 0x08, 0x98,
+		0xad, 0xc8, 0xd7, 0x4e, 0x2c, 0x13, 0xbd, 0xfd,
+		0xc4, 0x39, 0x7c, 0xe6, 0x1c, 0xff, 0xd3, 0x3a,
+		0xd7, 0xc2, 0xa0, 0x05, 0x1e, 0x9c, 0x78, 0x87,
+		0x40, 0x98, 0xa3, 0x6c, 0x73, 0x73, 0xea, 0x4b,
+		0x62, 0xc7, 0xc9, 0x56, 0x37, 0x20, 0x76, 0x88,
+		0x24, 0xbc, 0xb6, 0x6e, 0x71, 0x46, 0x3f, 0x69,
+	}
+	// paramD is -39081 in Fp.
+	paramD = fp.Elt{
+		0x56, 0x67, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+		0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+		0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+		0xff, 0xff, 0xff, 0xff, 0xfe, 0xff, 0xff, 0xff,
+		0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+		0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+		0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+	}
+	// order is 2^446-0x8335dc163bb124b65129c96fde933d8d723a70aadc873d6d54a7bb0d,
+	// which is the number of points in the prime subgroup.
+	order = Scalar{
+		0xf3, 0x44, 0x58, 0xab, 0x92, 0xc2, 0x78, 0x23,
+		0x55, 0x8f, 0xc5, 0x8d, 0x72, 0xc2, 0x6c, 0x21,
+		0x90, 0x36, 0xd6, 0xae, 0x49, 0xdb, 0x4e, 0xc4,
+		0xe9, 0x23, 0xca, 0x7c, 0xff, 0xff, 0xff, 0xff,
+		0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+		0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+		0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x3f,
+	}
+	// residue448 is 2^448 mod order.
+	residue448 = [4]uint64{
+		0x721cf5b5529eec34, 0x7a4cf635c8e9c2ab, 0xeec492d944a725bf, 0x20cd77058,
+	}
+	// invFour is 1/4 mod order.
+	invFour = Scalar{
+		0x3d, 0x11, 0xd6, 0xaa, 0xa4, 0x30, 0xde, 0x48,
+		0xd5, 0x63, 0x71, 0xa3, 0x9c, 0x30, 0x5b, 0x08,
+		0xa4, 0x8d, 0xb5, 0x6b, 0xd2, 0xb6, 0x13, 0x71,
+		0xfa, 0x88, 0x32, 0xdf, 0xff, 0xff, 0xff, 0xff,
+		0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+		0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+		0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x0f,
+	}
+	// paramDTwist is -39082 in Fp. The D parameter of the twist curve.
+	paramDTwist = fp.Elt{
+		0x55, 0x67, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+		0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+		0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+		0xff, 0xff, 0xff, 0xff, 0xfe, 0xff, 0xff, 0xff,
+		0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+		0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+		0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+	}
+)
diff --git a/.ci/providerlint/vendor/github.com/cloudflare/circl/ecc/goldilocks/curve.go b/.ci/providerlint/vendor/github.com/cloudflare/circl/ecc/goldilocks/curve.go
new file mode 100644
index 00000000000..5a939100d2c
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/cloudflare/circl/ecc/goldilocks/curve.go
@@ -0,0 +1,80 @@
+// Package goldilocks provides elliptic curve operations over the goldilocks curve.
+package goldilocks
+
+import fp "github.com/cloudflare/circl/math/fp448"
+
+// Curve is the Goldilocks curve x^2+y^2=z^2-39081x^2y^2.
+type Curve struct{}
+
+// Identity returns the identity point.
+func (Curve) Identity() *Point {
+	return &Point{
+		y: fp.One(),
+		z: fp.One(),
+	}
+}
+
+// IsOnCurve returns true if the point lies on the curve.
+func (Curve) IsOnCurve(P *Point) bool {
+	x2, y2, t, t2, z2 := &fp.Elt{}, &fp.Elt{}, &fp.Elt{}, &fp.Elt{}, &fp.Elt{}
+	rhs, lhs := &fp.Elt{}, &fp.Elt{}
+	fp.Mul(t, &P.ta, &P.tb)  // t = ta*tb
+	fp.Sqr(x2, &P.x)         // x^2
+	fp.Sqr(y2, &P.y)         // y^2
+	fp.Sqr(z2, &P.z)         // z^2
+	fp.Sqr(t2, t)            // t^2
+	fp.Add(lhs, x2, y2)      // x^2 + y^2
+	fp.Mul(rhs, t2, &paramD) // dt^2
+	fp.Add(rhs, rhs, z2)     // z^2 + dt^2
+	fp.Sub(lhs, lhs, rhs)    // x^2 + y^2 - (z^2 + dt^2)
+	eq0 := fp.IsZero(lhs)
+
+	fp.Mul(lhs, &P.x, &P.y) // xy
+	fp.Mul(rhs, t, &P.z)    // tz
+	fp.Sub(lhs, lhs, rhs)   // xy - tz
+	eq1 := fp.IsZero(lhs)
+	return eq0 && eq1
+}
+
+// Generator returns the generator point.
+func (Curve) Generator() *Point {
+	return &Point{
+		x:  genX,
+		y:  genY,
+		z:  fp.One(),
+		ta: genX,
+		tb: genY,
+	}
+}
+
+// Order returns the number of points in the prime subgroup.
+func (Curve) Order() Scalar { return order }
+
+// Double returns 2P.
+func (Curve) Double(P *Point) *Point { R := *P; R.Double(); return &R }
+
+// Add returns P+Q.
+func (Curve) Add(P, Q *Point) *Point { R := *P; R.Add(Q); return &R }
+
+// ScalarMult returns kP. This function runs in constant time.
+func (e Curve) ScalarMult(k *Scalar, P *Point) *Point {
+	k4 := &Scalar{}
+	k4.divBy4(k)
+	return e.pull(twistCurve{}.ScalarMult(k4, e.push(P)))
+}
+
+// ScalarBaseMult returns kG where G is the generator point. This function runs in constant time.
+func (e Curve) ScalarBaseMult(k *Scalar) *Point {
+	k4 := &Scalar{}
+	k4.divBy4(k)
+	return e.pull(twistCurve{}.ScalarBaseMult(k4))
+}
+
+// CombinedMult returns mG+nP, where G is the generator point. This function is non-constant time.
+func (e Curve) CombinedMult(m, n *Scalar, P *Point) *Point {
+	m4 := &Scalar{}
+	n4 := &Scalar{}
+	m4.divBy4(m)
+	n4.divBy4(n)
+	return e.pull(twistCurve{}.CombinedMult(m4, n4, twistCurve{}.pull(P)))
+}
diff --git a/.ci/providerlint/vendor/github.com/cloudflare/circl/ecc/goldilocks/isogeny.go b/.ci/providerlint/vendor/github.com/cloudflare/circl/ecc/goldilocks/isogeny.go
new file mode 100644
index 00000000000..b1daab851c5
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/cloudflare/circl/ecc/goldilocks/isogeny.go
@@ -0,0 +1,52 @@
+package goldilocks
+
+import fp "github.com/cloudflare/circl/math/fp448"
+
+func (Curve) pull(P *twistPoint) *Point      { return twistCurve{}.push(P) }
+func (twistCurve) pull(P *Point) *twistPoint { return Curve{}.push(P) }
+
+// push sends a point on the Goldilocks curve to a point on the twist curve.
+func (Curve) push(P *Point) *twistPoint {
+	Q := &twistPoint{}
+	Px, Py, Pz := &P.x, &P.y, &P.z
+	a, b, c, d, e, f, g, h := &Q.x, &Q.y, &Q.z, &fp.Elt{}, &Q.ta, &Q.x, &Q.y, &Q.tb
+	fp.Add(e, Px, Py)  // x+y
+	fp.Sqr(a, Px)      // A = x^2
+	fp.Sqr(b, Py)      // B = y^2
+	fp.Sqr(c, Pz)      // z^2
+	fp.Add(c, c, c)    // C = 2*z^2
+	*d = *a            // D = A
+	fp.Sqr(e, e)       // (x+y)^2
+	fp.Sub(e, e, a)    // (x+y)^2-A
+	fp.Sub(e, e, b)    // E = (x+y)^2-A-B
+	fp.Add(h, b, d)    // H = B+D
+	fp.Sub(g, b, d)    // G = B-D
+	fp.Sub(f, c, h)    // F = C-H
+	fp.Mul(&Q.z, f, g) // Z = F * G
+	fp.Mul(&Q.x, e, f) // X = E * F
+	fp.Mul(&Q.y, g, h) // Y = G * H, // T = E * H
+	return Q
+}
+
+// push sends a point on the twist curve to a point on the Goldilocks curve.
+func (twistCurve) push(P *twistPoint) *Point {
+	Q := &Point{}
+	Px, Py, Pz := &P.x, &P.y, &P.z
+	a, b, c, d, e, f, g, h := &Q.x, &Q.y, &Q.z, &fp.Elt{}, &Q.ta, &Q.x, &Q.y, &Q.tb
+	fp.Add(e, Px, Py)  // x+y
+	fp.Sqr(a, Px)      // A = x^2
+	fp.Sqr(b, Py)      // B = y^2
+	fp.Sqr(c, Pz)      // z^2
+	fp.Add(c, c, c)    // C = 2*z^2
+	fp.Neg(d, a)       // D = -A
+	fp.Sqr(e, e)       // (x+y)^2
+	fp.Sub(e, e, a)    // (x+y)^2-A
+	fp.Sub(e, e, b)    // E = (x+y)^2-A-B
+	fp.Add(h, b, d)    // H = B+D
+	fp.Sub(g, b, d)    // G = B-D
+	fp.Sub(f, c, h)    // F = C-H
+	fp.Mul(&Q.z, f, g) // Z = F * G
+	fp.Mul(&Q.x, e, f) // X = E * F
+	fp.Mul(&Q.y, g, h) // Y = G * H, // T = E * H
+	return Q
+}
diff --git a/.ci/providerlint/vendor/github.com/cloudflare/circl/ecc/goldilocks/point.go b/.ci/providerlint/vendor/github.com/cloudflare/circl/ecc/goldilocks/point.go
new file mode 100644
index 00000000000..11f73de0542
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/cloudflare/circl/ecc/goldilocks/point.go
@@ -0,0 +1,171 @@
+package goldilocks
+
+import (
+	"errors"
+	"fmt"
+
+	fp "github.com/cloudflare/circl/math/fp448"
+)
+
+// Point is a point on the Goldilocks Curve.
+type Point struct{ x, y, z, ta, tb fp.Elt }
+
+func (P Point) String() string {
+	return fmt.Sprintf("x: %v\ny: %v\nz: %v\nta: %v\ntb: %v", P.x, P.y, P.z, P.ta, P.tb)
+}
+
+// FromAffine creates a point from affine coordinates.
+func FromAffine(x, y *fp.Elt) (*Point, error) {
+	P := &Point{
+		x:  *x,
+		y:  *y,
+		z:  fp.One(),
+		ta: *x,
+		tb: *y,
+	}
+	if !(Curve{}).IsOnCurve(P) {
+		return P, errors.New("point not on curve")
+	}
+	return P, nil
+}
+
+// isLessThan returns true if 0 <= x < y, and assumes that slices are of the
+// same length and are interpreted in little-endian order.
+func isLessThan(x, y []byte) bool {
+	i := len(x) - 1
+	for i > 0 && x[i] == y[i] {
+		i--
+	}
+	return x[i] < y[i]
+}
+
+// FromBytes returns a point from the input buffer.
+func FromBytes(in []byte) (*Point, error) {
+	if len(in) < fp.Size+1 {
+		return nil, errors.New("wrong input length")
+	}
+	err := errors.New("invalid decoding")
+	P := &Point{}
+	signX := in[fp.Size] >> 7
+	copy(P.y[:], in[:fp.Size])
+	p := fp.P()
+	if !isLessThan(P.y[:], p[:]) {
+		return nil, err
+	}
+
+	u, v := &fp.Elt{}, &fp.Elt{}
+	one := fp.One()
+	fp.Sqr(u, &P.y)                // u = y^2
+	fp.Mul(v, u, &paramD)          // v = dy^2
+	fp.Sub(u, u, &one)             // u = y^2-1
+	fp.Sub(v, v, &one)             // v = dy^2-1
+	isQR := fp.InvSqrt(&P.x, u, v) // x = sqrt(u/v)
+	if !isQR {
+		return nil, err
+	}
+	fp.Modp(&P.x) // x = x mod p
+	if fp.IsZero(&P.x) && signX == 1 {
+		return nil, err
+	}
+	if signX != (P.x[0] & 1) {
+		fp.Neg(&P.x, &P.x)
+	}
+	P.ta = P.x
+	P.tb = P.y
+	P.z = fp.One()
+	return P, nil
+}
+
+// IsIdentity returns true is P is the identity Point.
+func (P *Point) IsIdentity() bool {
+	return fp.IsZero(&P.x) && !fp.IsZero(&P.y) && !fp.IsZero(&P.z) && P.y == P.z
+}
+
+// IsEqual returns true if P is equivalent to Q.
+func (P *Point) IsEqual(Q *Point) bool {
+	l, r := &fp.Elt{}, &fp.Elt{}
+	fp.Mul(l, &P.x, &Q.z)
+	fp.Mul(r, &Q.x, &P.z)
+	fp.Sub(l, l, r)
+	b := fp.IsZero(l)
+	fp.Mul(l, &P.y, &Q.z)
+	fp.Mul(r, &Q.y, &P.z)
+	fp.Sub(l, l, r)
+	b = b && fp.IsZero(l)
+	fp.Mul(l, &P.ta, &P.tb)
+	fp.Mul(l, l, &Q.z)
+	fp.Mul(r, &Q.ta, &Q.tb)
+	fp.Mul(r, r, &P.z)
+	fp.Sub(l, l, r)
+	b = b && fp.IsZero(l)
+	return b
+}
+
+// Neg obtains the inverse of the Point.
+func (P *Point) Neg() { fp.Neg(&P.x, &P.x); fp.Neg(&P.ta, &P.ta) }
+
+// ToAffine returns the x,y affine coordinates of P.
+func (P *Point) ToAffine() (x, y fp.Elt) {
+	fp.Inv(&P.z, &P.z)       // 1/z
+	fp.Mul(&P.x, &P.x, &P.z) // x/z
+	fp.Mul(&P.y, &P.y, &P.z) // y/z
+	fp.Modp(&P.x)
+	fp.Modp(&P.y)
+	fp.SetOne(&P.z)
+	P.ta = P.x
+	P.tb = P.y
+	return P.x, P.y
+}
+
+// ToBytes stores P into a slice of bytes.
+func (P *Point) ToBytes(out []byte) error {
+	if len(out) < fp.Size+1 {
+		return errors.New("invalid decoding")
+	}
+	x, y := P.ToAffine()
+	out[fp.Size] = (x[0] & 1) << 7
+	return fp.ToBytes(out[:fp.Size], &y)
+}
+
+// MarshalBinary encodes the receiver into a binary form and returns the result.
+func (P *Point) MarshalBinary() (data []byte, err error) {
+	data = make([]byte, fp.Size+1)
+	err = P.ToBytes(data[:fp.Size+1])
+	return data, err
+}
+
+// UnmarshalBinary must be able to decode the form generated by MarshalBinary.
+func (P *Point) UnmarshalBinary(data []byte) error { Q, err := FromBytes(data); *P = *Q; return err }
+
+// Double sets P = 2Q.
+func (P *Point) Double() { P.Add(P) }
+
+// Add sets P =P+Q..
+func (P *Point) Add(Q *Point) {
+	// This is formula (5) from "Twisted Edwards Curves Revisited" by
+	// Hisil H., Wong K.KH., Carter G., Dawson E. (2008)
+	// https://doi.org/10.1007/978-3-540-89255-7_20
+	x1, y1, z1, ta1, tb1 := &P.x, &P.y, &P.z, &P.ta, &P.tb
+	x2, y2, z2, ta2, tb2 := &Q.x, &Q.y, &Q.z, &Q.ta, &Q.tb
+	x3, y3, z3, E, H := &P.x, &P.y, &P.z, &P.ta, &P.tb
+	A, B, C, D := &fp.Elt{}, &fp.Elt{}, &fp.Elt{}, &fp.Elt{}
+	t1, t2, F, G := C, D, &fp.Elt{}, &fp.Elt{}
+	fp.Mul(t1, ta1, tb1)  // t1 = ta1*tb1
+	fp.Mul(t2, ta2, tb2)  // t2 = ta2*tb2
+	fp.Mul(A, x1, x2)     // A = x1*x2
+	fp.Mul(B, y1, y2)     // B = y1*y2
+	fp.Mul(C, t1, t2)     // t1*t2
+	fp.Mul(C, C, &paramD) // C = d*t1*t2
+	fp.Mul(D, z1, z2)     // D = z1*z2
+	fp.Add(F, x1, y1)     // x1+y1
+	fp.Add(E, x2, y2)     // x2+y2
+	fp.Mul(E, E, F)       // (x1+y1)*(x2+y2)
+	fp.Sub(E, E, A)       // (x1+y1)*(x2+y2)-A
+	fp.Sub(E, E, B)       // E = (x1+y1)*(x2+y2)-A-B
+	fp.Sub(F, D, C)       // F = D-C
+	fp.Add(G, D, C)       // G = D+C
+	fp.Sub(H, B, A)       // H = B-A
+	fp.Mul(z3, F, G)      // Z = F * G
+	fp.Mul(x3, E, F)      // X = E * F
+	fp.Mul(y3, G, H)      // Y = G * H, T = E * H
+}
diff --git a/.ci/providerlint/vendor/github.com/cloudflare/circl/ecc/goldilocks/scalar.go b/.ci/providerlint/vendor/github.com/cloudflare/circl/ecc/goldilocks/scalar.go
new file mode 100644
index 00000000000..f98117b2527
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/cloudflare/circl/ecc/goldilocks/scalar.go
@@ -0,0 +1,203 @@
+package goldilocks
+
+import (
+	"encoding/binary"
+	"math/bits"
+)
+
+// ScalarSize is the size (in bytes) of scalars.
+const ScalarSize = 56 // 448 / 8
+
+// _N is the number of 64-bit words to store scalars.
+const _N = 7 // 448 / 64
+
+// Scalar represents a positive integer stored in little-endian order.
+type Scalar [ScalarSize]byte
+
+type scalar64 [_N]uint64
+
+func (z *scalar64) fromScalar(x *Scalar) {
+	z[0] = binary.LittleEndian.Uint64(x[0*8 : 1*8])
+	z[1] = binary.LittleEndian.Uint64(x[1*8 : 2*8])
+	z[2] = binary.LittleEndian.Uint64(x[2*8 : 3*8])
+	z[3] = binary.LittleEndian.Uint64(x[3*8 : 4*8])
+	z[4] = binary.LittleEndian.Uint64(x[4*8 : 5*8])
+	z[5] = binary.LittleEndian.Uint64(x[5*8 : 6*8])
+	z[6] = binary.LittleEndian.Uint64(x[6*8 : 7*8])
+}
+
+func (z *scalar64) toScalar(x *Scalar) {
+	binary.LittleEndian.PutUint64(x[0*8:1*8], z[0])
+	binary.LittleEndian.PutUint64(x[1*8:2*8], z[1])
+	binary.LittleEndian.PutUint64(x[2*8:3*8], z[2])
+	binary.LittleEndian.PutUint64(x[3*8:4*8], z[3])
+	binary.LittleEndian.PutUint64(x[4*8:5*8], z[4])
+	binary.LittleEndian.PutUint64(x[5*8:6*8], z[5])
+	binary.LittleEndian.PutUint64(x[6*8:7*8], z[6])
+}
+
+// add calculates z = x + y. Assumes len(z) > max(len(x),len(y)).
+func add(z, x, y []uint64) uint64 {
+	l, L, zz := len(x), len(y), y
+	if l > L {
+		l, L, zz = L, l, x
+	}
+	c := uint64(0)
+	for i := 0; i < l; i++ {
+		z[i], c = bits.Add64(x[i], y[i], c)
+	}
+	for i := l; i < L; i++ {
+		z[i], c = bits.Add64(zz[i], 0, c)
+	}
+	return c
+}
+
+// sub calculates z = x - y. Assumes len(z) > max(len(x),len(y)).
+func sub(z, x, y []uint64) uint64 {
+	l, L, zz := len(x), len(y), y
+	if l > L {
+		l, L, zz = L, l, x
+	}
+	c := uint64(0)
+	for i := 0; i < l; i++ {
+		z[i], c = bits.Sub64(x[i], y[i], c)
+	}
+	for i := l; i < L; i++ {
+		z[i], c = bits.Sub64(zz[i], 0, c)
+	}
+	return c
+}
+
+// mulWord calculates z = x * y. Assumes len(z) >= len(x)+1.
+func mulWord(z, x []uint64, y uint64) {
+	for i := range z {
+		z[i] = 0
+	}
+	carry := uint64(0)
+	for i := range x {
+		hi, lo := bits.Mul64(x[i], y)
+		lo, cc := bits.Add64(lo, z[i], 0)
+		hi, _ = bits.Add64(hi, 0, cc)
+		z[i], cc = bits.Add64(lo, carry, 0)
+		carry, _ = bits.Add64(hi, 0, cc)
+	}
+	z[len(x)] = carry
+}
+
+// Cmov moves x into z if b=1.
+func (z *scalar64) Cmov(b uint64, x *scalar64) {
+	m := uint64(0) - b
+	for i := range z {
+		z[i] = (z[i] &^ m) | (x[i] & m)
+	}
+}
+
+// leftShift shifts to the left the words of z returning the more significant word.
+func (z *scalar64) leftShift(low uint64) uint64 {
+	high := z[_N-1]
+	for i := _N - 1; i > 0; i-- {
+		z[i] = z[i-1]
+	}
+	z[0] = low
+	return high
+}
+
+// reduceOneWord calculates z = z + 2^448*x such that the result fits in a Scalar.
+func (z *scalar64) reduceOneWord(x uint64) {
+	prod := (&scalar64{})[:]
+	mulWord(prod, residue448[:], x)
+	cc := add(z[:], z[:], prod)
+	mulWord(prod, residue448[:], cc)
+	add(z[:], z[:], prod)
+}
+
+// modOrder reduces z mod order.
+func (z *scalar64) modOrder() {
+	var o64, x scalar64
+	o64.fromScalar(&order)
+	// Performs: while (z >= order) { z = z-order }
+	// At most 8 (eight) iterations reduce 3 bits by subtracting.
+	for i := 0; i < 8; i++ {
+		c := sub(x[:], z[:], o64[:]) // (c || x) = z-order
+		z.Cmov(1-c, &x)              // if c != 0 { z = x }
+	}
+}
+
+// FromBytes stores z = x mod order, where x is a number stored in little-endian order.
+func (z *Scalar) FromBytes(x []byte) {
+	n := len(x)
+	nCeil := (n + 7) >> 3
+	for i := range z {
+		z[i] = 0
+	}
+	if nCeil < _N {
+		copy(z[:], x)
+		return
+	}
+	copy(z[:], x[8*(nCeil-_N):])
+	var z64 scalar64
+	z64.fromScalar(z)
+	for i := nCeil - _N - 1; i >= 0; i-- {
+		low := binary.LittleEndian.Uint64(x[8*i:])
+		high := z64.leftShift(low)
+		z64.reduceOneWord(high)
+	}
+	z64.modOrder()
+	z64.toScalar(z)
+}
+
+// divBy4 calculates z = x/4 mod order.
+func (z *Scalar) divBy4(x *Scalar) { z.Mul(x, &invFour) }
+
+// Red reduces z mod order.
+func (z *Scalar) Red() { var t scalar64; t.fromScalar(z); t.modOrder(); t.toScalar(z) }
+
+// Neg calculates z = -z mod order.
+func (z *Scalar) Neg() { z.Sub(&order, z) }
+
+// Add calculates z = x+y mod order.
+func (z *Scalar) Add(x, y *Scalar) {
+	var z64, x64, y64, t scalar64
+	x64.fromScalar(x)
+	y64.fromScalar(y)
+	c := add(z64[:], x64[:], y64[:])
+	add(t[:], z64[:], residue448[:])
+	z64.Cmov(c, &t)
+	z64.modOrder()
+	z64.toScalar(z)
+}
+
+// Sub calculates z = x-y mod order.
+func (z *Scalar) Sub(x, y *Scalar) {
+	var z64, x64, y64, t scalar64
+	x64.fromScalar(x)
+	y64.fromScalar(y)
+	c := sub(z64[:], x64[:], y64[:])
+	sub(t[:], z64[:], residue448[:])
+	z64.Cmov(c, &t)
+	z64.modOrder()
+	z64.toScalar(z)
+}
+
+// Mul calculates z = x*y mod order.
+func (z *Scalar) Mul(x, y *Scalar) {
+	var z64, x64, y64 scalar64
+	prod := (&[_N + 1]uint64{})[:]
+	x64.fromScalar(x)
+	y64.fromScalar(y)
+	mulWord(prod, x64[:], y64[_N-1])
+	copy(z64[:], prod[:_N])
+	z64.reduceOneWord(prod[_N])
+	for i := _N - 2; i >= 0; i-- {
+		h := z64.leftShift(0)
+		z64.reduceOneWord(h)
+		mulWord(prod, x64[:], y64[i])
+		c := add(z64[:], z64[:], prod[:_N])
+		z64.reduceOneWord(prod[_N] + c)
+	}
+	z64.modOrder()
+	z64.toScalar(z)
+}
+
+// IsZero returns true if z=0.
+func (z *Scalar) IsZero() bool { z.Red(); return *z == Scalar{} }
diff --git a/.ci/providerlint/vendor/github.com/cloudflare/circl/ecc/goldilocks/twist.go b/.ci/providerlint/vendor/github.com/cloudflare/circl/ecc/goldilocks/twist.go
new file mode 100644
index 00000000000..8cd4e333b96
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/cloudflare/circl/ecc/goldilocks/twist.go
@@ -0,0 +1,138 @@
+package goldilocks
+
+import (
+	"crypto/subtle"
+	"math/bits"
+
+	"github.com/cloudflare/circl/internal/conv"
+	"github.com/cloudflare/circl/math"
+	fp "github.com/cloudflare/circl/math/fp448"
+)
+
+// twistCurve is -x^2+y^2=1-39082x^2y^2 and is 4-isogeneous to Goldilocks.
+type twistCurve struct{}
+
+// Identity returns the identity point.
+func (twistCurve) Identity() *twistPoint {
+	return &twistPoint{
+		y: fp.One(),
+		z: fp.One(),
+	}
+}
+
+// subYDiv16 update x = (x - y) / 16.
+func subYDiv16(x *scalar64, y int64) {
+	s := uint64(y >> 63)
+	x0, b0 := bits.Sub64((*x)[0], uint64(y), 0)
+	x1, b1 := bits.Sub64((*x)[1], s, b0)
+	x2, b2 := bits.Sub64((*x)[2], s, b1)
+	x3, b3 := bits.Sub64((*x)[3], s, b2)
+	x4, b4 := bits.Sub64((*x)[4], s, b3)
+	x5, b5 := bits.Sub64((*x)[5], s, b4)
+	x6, _ := bits.Sub64((*x)[6], s, b5)
+	x[0] = (x0 >> 4) | (x1 << 60)
+	x[1] = (x1 >> 4) | (x2 << 60)
+	x[2] = (x2 >> 4) | (x3 << 60)
+	x[3] = (x3 >> 4) | (x4 << 60)
+	x[4] = (x4 >> 4) | (x5 << 60)
+	x[5] = (x5 >> 4) | (x6 << 60)
+	x[6] = (x6 >> 4)
+}
+
+func recodeScalar(d *[113]int8, k *Scalar) {
+	var k64 scalar64
+	k64.fromScalar(k)
+	for i := 0; i < 112; i++ {
+		d[i] = int8((k64[0] & 0x1f) - 16)
+		subYDiv16(&k64, int64(d[i]))
+	}
+	d[112] = int8(k64[0])
+}
+
+// ScalarMult returns kP.
+func (e twistCurve) ScalarMult(k *Scalar, P *twistPoint) *twistPoint {
+	var TabP [8]preTwistPointProy
+	var S preTwistPointProy
+	var d [113]int8
+
+	var isZero int
+	if k.IsZero() {
+		isZero = 1
+	}
+	subtle.ConstantTimeCopy(isZero, k[:], order[:])
+
+	minusK := *k
+	isEven := 1 - int(k[0]&0x1)
+	minusK.Neg()
+	subtle.ConstantTimeCopy(isEven, k[:], minusK[:])
+	recodeScalar(&d, k)
+
+	P.oddMultiples(TabP[:])
+	Q := e.Identity()
+	for i := 112; i >= 0; i-- {
+		Q.Double()
+		Q.Double()
+		Q.Double()
+		Q.Double()
+		mask := d[i] >> 7
+		absDi := (d[i] + mask) ^ mask
+		inx := int32((absDi - 1) >> 1)
+		sig := int((d[i] >> 7) & 0x1)
+		for j := range TabP {
+			S.cmov(&TabP[j], uint(subtle.ConstantTimeEq(inx, int32(j))))
+		}
+		S.cneg(sig)
+		Q.mixAdd(&S)
+	}
+	Q.cneg(uint(isEven))
+	return Q
+}
+
+const (
+	omegaFix = 7
+	omegaVar = 5
+)
+
+// CombinedMult returns mG+nP.
+func (e twistCurve) CombinedMult(m, n *Scalar, P *twistPoint) *twistPoint {
+	nafFix := math.OmegaNAF(conv.BytesLe2BigInt(m[:]), omegaFix)
+	nafVar := math.OmegaNAF(conv.BytesLe2BigInt(n[:]), omegaVar)
+
+	if len(nafFix) > len(nafVar) {
+		nafVar = append(nafVar, make([]int32, len(nafFix)-len(nafVar))...)
+	} else if len(nafFix) < len(nafVar) {
+		nafFix = append(nafFix, make([]int32, len(nafVar)-len(nafFix))...)
+	}
+
+	var TabQ [1 << (omegaVar - 2)]preTwistPointProy
+	P.oddMultiples(TabQ[:])
+	Q := e.Identity()
+	for i := len(nafFix) - 1; i >= 0; i-- {
+		Q.Double()
+		// Generator point
+		if nafFix[i] != 0 {
+			idxM := absolute(nafFix[i]) >> 1
+			R := tabVerif[idxM]
+			if nafFix[i] < 0 {
+				R.neg()
+			}
+			Q.mixAddZ1(&R)
+		}
+		// Variable input point
+		if nafVar[i] != 0 {
+			idxN := absolute(nafVar[i]) >> 1
+			S := TabQ[idxN]
+			if nafVar[i] < 0 {
+				S.neg()
+			}
+			Q.mixAdd(&S)
+		}
+	}
+	return Q
+}
+
+// absolute returns always a positive value.
+func absolute(x int32) int32 {
+	mask := x >> 31
+	return (x + mask) ^ mask
+}
diff --git a/.ci/providerlint/vendor/github.com/cloudflare/circl/ecc/goldilocks/twistPoint.go b/.ci/providerlint/vendor/github.com/cloudflare/circl/ecc/goldilocks/twistPoint.go
new file mode 100644
index 00000000000..c55db77b069
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/cloudflare/circl/ecc/goldilocks/twistPoint.go
@@ -0,0 +1,135 @@
+package goldilocks
+
+import (
+	"fmt"
+
+	fp "github.com/cloudflare/circl/math/fp448"
+)
+
+type twistPoint struct{ x, y, z, ta, tb fp.Elt }
+
+type preTwistPointAffine struct{ addYX, subYX, dt2 fp.Elt }
+
+type preTwistPointProy struct {
+	preTwistPointAffine
+	z2 fp.Elt
+}
+
+func (P *twistPoint) String() string {
+	return fmt.Sprintf("x: %v\ny: %v\nz: %v\nta: %v\ntb: %v", P.x, P.y, P.z, P.ta, P.tb)
+}
+
+// cneg conditionally negates the point if b=1.
+func (P *twistPoint) cneg(b uint) {
+	t := &fp.Elt{}
+	fp.Neg(t, &P.x)
+	fp.Cmov(&P.x, t, b)
+	fp.Neg(t, &P.ta)
+	fp.Cmov(&P.ta, t, b)
+}
+
+// Double updates P with 2P.
+func (P *twistPoint) Double() {
+	// This is formula (7) from "Twisted Edwards Curves Revisited" by
+	// Hisil H., Wong K.KH., Carter G., Dawson E. (2008)
+	// https://doi.org/10.1007/978-3-540-89255-7_20
+	Px, Py, Pz, Pta, Ptb := &P.x, &P.y, &P.z, &P.ta, &P.tb
+	a, b, c, e, f, g, h := Px, Py, Pz, Pta, Px, Py, Ptb
+	fp.Add(e, Px, Py) // x+y
+	fp.Sqr(a, Px)     // A = x^2
+	fp.Sqr(b, Py)     // B = y^2
+	fp.Sqr(c, Pz)     // z^2
+	fp.Add(c, c, c)   // C = 2*z^2
+	fp.Add(h, a, b)   // H = A+B
+	fp.Sqr(e, e)      // (x+y)^2
+	fp.Sub(e, e, h)   // E = (x+y)^2-A-B
+	fp.Sub(g, b, a)   // G = B-A
+	fp.Sub(f, c, g)   // F = C-G
+	fp.Mul(Pz, f, g)  // Z = F * G
+	fp.Mul(Px, e, f)  // X = E * F
+	fp.Mul(Py, g, h)  // Y = G * H, T = E * H
+}
+
+// mixAdd calculates P= P+Q, where Q is a precomputed point with Z_Q = 1.
+func (P *twistPoint) mixAddZ1(Q *preTwistPointAffine) {
+	fp.Add(&P.z, &P.z, &P.z) // D = 2*z1 (z2=1)
+	P.coreAddition(Q)
+}
+
+// coreAddition calculates P=P+Q for curves with A=-1.
+func (P *twistPoint) coreAddition(Q *preTwistPointAffine) {
+	// This is the formula following (5) from "Twisted Edwards Curves Revisited" by
+	// Hisil H., Wong K.KH., Carter G., Dawson E. (2008)
+	// https://doi.org/10.1007/978-3-540-89255-7_20
+	Px, Py, Pz, Pta, Ptb := &P.x, &P.y, &P.z, &P.ta, &P.tb
+	addYX2, subYX2, dt2 := &Q.addYX, &Q.subYX, &Q.dt2
+	a, b, c, d, e, f, g, h := Px, Py, &fp.Elt{}, Pz, Pta, Px, Py, Ptb
+	fp.Mul(c, Pta, Ptb)  // t1 = ta*tb
+	fp.Sub(h, Py, Px)    // y1-x1
+	fp.Add(b, Py, Px)    // y1+x1
+	fp.Mul(a, h, subYX2) // A = (y1-x1)*(y2-x2)
+	fp.Mul(b, b, addYX2) // B = (y1+x1)*(y2+x2)
+	fp.Mul(c, c, dt2)    // C = 2*D*t1*t2
+	fp.Sub(e, b, a)      // E = B-A
+	fp.Add(h, b, a)      // H = B+A
+	fp.Sub(f, d, c)      // F = D-C
+	fp.Add(g, d, c)      // G = D+C
+	fp.Mul(Pz, f, g)     // Z = F * G
+	fp.Mul(Px, e, f)     // X = E * F
+	fp.Mul(Py, g, h)     // Y = G * H, T = E * H
+}
+
+func (P *preTwistPointAffine) neg() {
+	P.addYX, P.subYX = P.subYX, P.addYX
+	fp.Neg(&P.dt2, &P.dt2)
+}
+
+func (P *preTwistPointAffine) cneg(b int) {
+	t := &fp.Elt{}
+	fp.Cswap(&P.addYX, &P.subYX, uint(b))
+	fp.Neg(t, &P.dt2)
+	fp.Cmov(&P.dt2, t, uint(b))
+}
+
+func (P *preTwistPointAffine) cmov(Q *preTwistPointAffine, b uint) {
+	fp.Cmov(&P.addYX, &Q.addYX, b)
+	fp.Cmov(&P.subYX, &Q.subYX, b)
+	fp.Cmov(&P.dt2, &Q.dt2, b)
+}
+
+// mixAdd calculates P= P+Q, where Q is a precomputed point with Z_Q != 1.
+func (P *twistPoint) mixAdd(Q *preTwistPointProy) {
+	fp.Mul(&P.z, &P.z, &Q.z2) // D = 2*z1*z2
+	P.coreAddition(&Q.preTwistPointAffine)
+}
+
+// oddMultiples calculates T[i] = (2*i-1)P for 0 < i < len(T).
+func (P *twistPoint) oddMultiples(T []preTwistPointProy) {
+	if n := len(T); n > 0 {
+		T[0].FromTwistPoint(P)
+		_2P := *P
+		_2P.Double()
+		R := &preTwistPointProy{}
+		R.FromTwistPoint(&_2P)
+		for i := 1; i < n; i++ {
+			P.mixAdd(R)
+			T[i].FromTwistPoint(P)
+		}
+	}
+}
+
+// cmov conditionally moves Q into P if b=1.
+func (P *preTwistPointProy) cmov(Q *preTwistPointProy, b uint) {
+	P.preTwistPointAffine.cmov(&Q.preTwistPointAffine, b)
+	fp.Cmov(&P.z2, &Q.z2, b)
+}
+
+// FromTwistPoint precomputes some coordinates of Q for missed addition.
+func (P *preTwistPointProy) FromTwistPoint(Q *twistPoint) {
+	fp.Add(&P.addYX, &Q.y, &Q.x)         // addYX = X + Y
+	fp.Sub(&P.subYX, &Q.y, &Q.x)         // subYX = Y - X
+	fp.Mul(&P.dt2, &Q.ta, &Q.tb)         // T = ta*tb
+	fp.Mul(&P.dt2, &P.dt2, &paramDTwist) // D*T
+	fp.Add(&P.dt2, &P.dt2, &P.dt2)       // dt2 = 2*D*T
+	fp.Add(&P.z2, &Q.z, &Q.z)            // z2 = 2*Z
+}
diff --git a/.ci/providerlint/vendor/github.com/cloudflare/circl/ecc/goldilocks/twistTables.go b/.ci/providerlint/vendor/github.com/cloudflare/circl/ecc/goldilocks/twistTables.go
new file mode 100644
index 00000000000..ed432e02c78
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/cloudflare/circl/ecc/goldilocks/twistTables.go
@@ -0,0 +1,216 @@
+package goldilocks
+
+import fp "github.com/cloudflare/circl/math/fp448"
+
+var tabFixMult = [fxV][fx2w1]preTwistPointAffine{
+	{
+		{
+			addYX: fp.Elt{0x65, 0x4a, 0xdd, 0xdf, 0xb4, 0x79, 0x60, 0xc8, 0xa1, 0x70, 0xb4, 0x3a, 0x1e, 0x0c, 0x9b, 0x19, 0xe5, 0x48, 0x3f, 0xd7, 0x44, 0x18, 0x18, 0x14, 0x14, 0x27, 0x45, 0xd0, 0x2b, 0x24, 0xd5, 0x93, 0xc3, 0x74, 0x4c, 0x50, 0x70, 0x43, 0x26, 0x05, 0x08, 0x24, 0xca, 0x78, 0x30, 0xc1, 0x06, 0x8d, 0xd4, 0x86, 0x42, 0xf0, 0x14, 0xde, 0x08, 0x05},
+			subYX: fp.Elt{0x64, 0x4a, 0xdd, 0xdf, 0xb4, 0x79, 0x60, 0xc8, 0xa1, 0x70, 0xb4, 0x3a, 0x1e, 0x0c, 0x9b, 0x19, 0xe5, 0x48, 0x3f, 0xd7, 0x44, 0x18, 0x18, 0x14, 0x14, 0x27, 0x45, 0xd0, 0x2d, 0x24, 0xd5, 0x93, 0xc3, 0x74, 0x4c, 0x50, 0x70, 0x43, 0x26, 0x05, 0x08, 0x24, 0xca, 0x78, 0x30, 0xc1, 0x06, 0x8d, 0xd4, 0x86, 0x42, 0xf0, 0x14, 0xde, 0x08, 0x05},
+			dt2:   fp.Elt{0x1a, 0x33, 0xea, 0x64, 0x45, 0x1c, 0xdf, 0x17, 0x1d, 0x16, 0x34, 0x28, 0xd6, 0x61, 0x19, 0x67, 0x79, 0xb4, 0x13, 0xcf, 0x3e, 0x7c, 0x0e, 0x72, 0xda, 0xf1, 0x5f, 0xda, 0xe6, 0xcf, 0x42, 0xd3, 0xb6, 0x17, 0xc2, 0x68, 0x13, 0x2d, 0xd9, 0x60, 0x3e, 0xae, 0xf0, 0x5b, 0x96, 0xf0, 0xcd, 0xaf, 0xea, 0xb7, 0x0d, 0x59, 0x16, 0xa7, 0xff, 0x55},
+		},
+		{
+			addYX: fp.Elt{0xca, 0xd8, 0x7d, 0x86, 0x1a, 0xef, 0xad, 0x11, 0xe3, 0x27, 0x41, 0x7e, 0x7f, 0x3e, 0xa9, 0xd2, 0xb5, 0x4e, 0x50, 0xe0, 0x77, 0x91, 0xc2, 0x13, 0x52, 0x73, 0x41, 0x09, 0xa6, 0x57, 0x9a, 0xc8, 0xa8, 0x90, 0x9d, 0x26, 0x14, 0xbb, 0xa1, 0x2a, 0xf7, 0x45, 0x43, 0x4e, 0xea, 0x35, 0x62, 0xe1, 0x08, 0x85, 0x46, 0xb8, 0x24, 0x05, 0x2d, 0xab},
+			subYX: fp.Elt{0x9b, 0xe6, 0xd3, 0xe5, 0xfe, 0x50, 0x36, 0x3c, 0x3c, 0x6d, 0x74, 0x1d, 0x74, 0xc0, 0xde, 0x5b, 0x45, 0x27, 0xe5, 0x12, 0xee, 0x63, 0x35, 0x6b, 0x13, 0xe2, 0x41, 0x6b, 0x3a, 0x05, 0x2b, 0xb1, 0x89, 0x26, 0xb6, 0xc6, 0xd1, 0x84, 0xff, 0x0e, 0x9b, 0xa3, 0xfb, 0x21, 0x36, 0x6b, 0x01, 0xf7, 0x9f, 0x7c, 0xeb, 0xf5, 0x18, 0x7a, 0x2a, 0x70},
+			dt2:   fp.Elt{0x09, 0xad, 0x99, 0x1a, 0x38, 0xd3, 0xdf, 0x22, 0x37, 0x32, 0x61, 0x8b, 0xf3, 0x19, 0x48, 0x08, 0xe8, 0x49, 0xb6, 0x4a, 0xa7, 0xed, 0xa4, 0xa2, 0xee, 0x86, 0xd7, 0x31, 0x5e, 0xce, 0x95, 0x76, 0x86, 0x42, 0x1c, 0x9d, 0x07, 0x14, 0x8c, 0x34, 0x18, 0x9c, 0x6d, 0x3a, 0xdf, 0xa9, 0xe8, 0x36, 0x7e, 0xe4, 0x95, 0xbe, 0xb5, 0x09, 0xf8, 0x9c},
+		},
+		{
+			addYX: fp.Elt{0x51, 0xdb, 0x49, 0xa8, 0x9f, 0xe3, 0xd7, 0xec, 0x0d, 0x0f, 0x49, 0xe8, 0xb6, 0xc5, 0x0f, 0x5a, 0x1c, 0xce, 0x54, 0x0d, 0xb1, 0x8d, 0x5b, 0xbf, 0xf4, 0xaa, 0x34, 0x77, 0xc4, 0x5d, 0x59, 0xb6, 0xc5, 0x0e, 0x5a, 0xd8, 0x5b, 0x30, 0xc2, 0x1d, 0xec, 0x85, 0x1c, 0x42, 0xbe, 0x24, 0x2e, 0x50, 0x55, 0x44, 0xb2, 0x3a, 0x01, 0xaa, 0x98, 0xfb},
+			subYX: fp.Elt{0xe7, 0x29, 0xb7, 0xd0, 0xaa, 0x4f, 0x32, 0x53, 0x56, 0xde, 0xbc, 0xd1, 0x92, 0x5d, 0x19, 0xbe, 0xa3, 0xe3, 0x75, 0x48, 0xe0, 0x7a, 0x1b, 0x54, 0x7a, 0xb7, 0x41, 0x77, 0x84, 0x38, 0xdd, 0x14, 0x9f, 0xca, 0x3f, 0xa3, 0xc8, 0xa7, 0x04, 0x70, 0xf1, 0x4d, 0x3d, 0xb3, 0x84, 0x79, 0xcb, 0xdb, 0xe4, 0xc5, 0x42, 0x9b, 0x57, 0x19, 0xf1, 0x2d},
+			dt2:   fp.Elt{0x20, 0xb4, 0x94, 0x9e, 0xdf, 0x31, 0x44, 0x0b, 0xc9, 0x7b, 0x75, 0x40, 0x9d, 0xd1, 0x96, 0x39, 0x70, 0x71, 0x15, 0xc8, 0x93, 0xd5, 0xc5, 0xe5, 0xba, 0xfe, 0xee, 0x08, 0x6a, 0x98, 0x0a, 0x1b, 0xb2, 0xaa, 0x3a, 0xf4, 0xa4, 0x79, 0xf9, 0x8e, 0x4d, 0x65, 0x10, 0x9b, 0x3a, 0x6e, 0x7c, 0x87, 0x94, 0x92, 0x11, 0x65, 0xbf, 0x1a, 0x09, 0xde},
+		},
+		{
+			addYX: fp.Elt{0xf3, 0x84, 0x76, 0x77, 0xa5, 0x6b, 0x27, 0x3b, 0x83, 0x3d, 0xdf, 0xa0, 0xeb, 0x32, 0x6d, 0x58, 0x81, 0x57, 0x64, 0xc2, 0x21, 0x7c, 0x9b, 0xea, 0xe6, 0xb0, 0x93, 0xf9, 0xe7, 0xc3, 0xed, 0x5a, 0x8e, 0xe2, 0xb4, 0x72, 0x76, 0x66, 0x0f, 0x22, 0x29, 0x94, 0x3e, 0x63, 0x48, 0x5e, 0x80, 0xcb, 0xac, 0xfa, 0x95, 0xb6, 0x4b, 0xc4, 0x95, 0x33},
+			subYX: fp.Elt{0x0c, 0x55, 0xd1, 0x5e, 0x5f, 0xbf, 0xbf, 0xe2, 0x4c, 0xfc, 0x37, 0x4a, 0xc4, 0xb1, 0xf4, 0x83, 0x61, 0x93, 0x60, 0x8e, 0x9f, 0x31, 0xf0, 0xa0, 0x41, 0xff, 0x1d, 0xe2, 0x7f, 0xca, 0x40, 0xd6, 0x88, 0xe8, 0x91, 0x61, 0xe2, 0x11, 0x18, 0x83, 0xf3, 0x25, 0x2f, 0x3f, 0x49, 0x40, 0xd4, 0x83, 0xe2, 0xd7, 0x74, 0x6a, 0x16, 0x86, 0x4e, 0xab},
+			dt2:   fp.Elt{0xdd, 0x58, 0x65, 0xd8, 0x9f, 0xdd, 0x70, 0x7f, 0x0f, 0xec, 0xbd, 0x5c, 0x5c, 0x9b, 0x7e, 0x1b, 0x9f, 0x79, 0x36, 0x1f, 0xfd, 0x79, 0x10, 0x1c, 0x52, 0xf3, 0x22, 0xa4, 0x1f, 0x71, 0x6e, 0x63, 0x14, 0xf4, 0xa7, 0x3e, 0xbe, 0xad, 0x43, 0x30, 0x38, 0x8c, 0x29, 0xc6, 0xcf, 0x50, 0x75, 0x21, 0xe5, 0x78, 0xfd, 0xb0, 0x9a, 0xc4, 0x6d, 0xd4},
+		},
+	},
+	{
+		{
+			addYX: fp.Elt{0x7a, 0xa1, 0x38, 0xa6, 0xfd, 0x0e, 0x96, 0xd5, 0x26, 0x76, 0x86, 0x70, 0x80, 0x30, 0xa6, 0x67, 0xeb, 0xf4, 0x39, 0xdb, 0x22, 0xf5, 0x9f, 0x98, 0xe4, 0xb5, 0x3a, 0x0c, 0x59, 0xbf, 0x85, 0xc6, 0xf0, 0x0b, 0x1c, 0x41, 0x38, 0x09, 0x01, 0xdb, 0xd6, 0x3c, 0xb7, 0xf1, 0x08, 0x6b, 0x4b, 0x9e, 0x63, 0x53, 0x83, 0xd3, 0xab, 0xa3, 0x72, 0x0d},
+			subYX: fp.Elt{0x84, 0x68, 0x25, 0xe8, 0xe9, 0x8f, 0x91, 0xbf, 0xf7, 0xa4, 0x30, 0xae, 0xea, 0x9f, 0xdd, 0x56, 0x64, 0x09, 0xc9, 0x54, 0x68, 0x4e, 0x33, 0xc5, 0x6f, 0x7b, 0x2d, 0x52, 0x2e, 0x42, 0xbe, 0xbe, 0xf5, 0x64, 0xbf, 0x77, 0x54, 0xdf, 0xb0, 0x10, 0xd2, 0x16, 0x5d, 0xce, 0xaf, 0x9f, 0xfb, 0xa3, 0x63, 0x50, 0xcb, 0xc0, 0xd0, 0x88, 0x44, 0xa3},
+			dt2:   fp.Elt{0xc3, 0x8b, 0xa5, 0xf1, 0x44, 0xe4, 0x41, 0xcd, 0x75, 0xe3, 0x17, 0x69, 0x5b, 0xb9, 0xbb, 0xee, 0x82, 0xbb, 0xce, 0x57, 0xdf, 0x2a, 0x9c, 0x12, 0xab, 0x66, 0x08, 0x68, 0x05, 0x1b, 0x87, 0xee, 0x5d, 0x1e, 0x18, 0x14, 0x22, 0x4b, 0x99, 0x61, 0x75, 0x28, 0xe7, 0x65, 0x1c, 0x36, 0xb6, 0x18, 0x09, 0xa8, 0xdf, 0xef, 0x30, 0x35, 0xbc, 0x58},
+		},
+		{
+			addYX: fp.Elt{0xc5, 0xd3, 0x0e, 0x6f, 0xaf, 0x06, 0x69, 0xc4, 0x07, 0x9e, 0x58, 0x6e, 0x3f, 0x49, 0xd9, 0x0a, 0x3c, 0x2c, 0x37, 0xcd, 0x27, 0x4d, 0x87, 0x91, 0x7a, 0xb0, 0x28, 0xad, 0x2f, 0x68, 0x92, 0x05, 0x97, 0xf1, 0x30, 0x5f, 0x4c, 0x10, 0x20, 0x30, 0xd3, 0x08, 0x3f, 0xc1, 0xc6, 0xb7, 0xb5, 0xd1, 0x71, 0x7b, 0xa8, 0x0a, 0xd8, 0xf5, 0x17, 0xcf},
+			subYX: fp.Elt{0x64, 0xd4, 0x8f, 0x91, 0x40, 0xab, 0x6e, 0x1a, 0x62, 0x83, 0xdc, 0xd7, 0x30, 0x1a, 0x4a, 0x2a, 0x4c, 0x54, 0x86, 0x19, 0x81, 0x5d, 0x04, 0x52, 0xa3, 0xca, 0x82, 0x38, 0xdc, 0x1e, 0xf0, 0x7a, 0x78, 0x76, 0x49, 0x4f, 0x71, 0xc4, 0x74, 0x2f, 0xf0, 0x5b, 0x2e, 0x5e, 0xac, 0xef, 0x17, 0xe4, 0x8e, 0x6e, 0xed, 0x43, 0x23, 0x61, 0x99, 0x49},
+			dt2:   fp.Elt{0x64, 0x90, 0x72, 0x76, 0xf8, 0x2c, 0x7d, 0x57, 0xf9, 0x30, 0x5e, 0x7a, 0x10, 0x74, 0x19, 0x39, 0xd9, 0xaf, 0x0a, 0xf1, 0x43, 0xed, 0x88, 0x9c, 0x8b, 0xdc, 0x9b, 0x1c, 0x90, 0xe7, 0xf7, 0xa3, 0xa5, 0x0d, 0xc6, 0xbc, 0x30, 0xfb, 0x91, 0x1a, 0x51, 0xba, 0x2d, 0xbe, 0x89, 0xdf, 0x1d, 0xdc, 0x53, 0xa8, 0x82, 0x8a, 0xd3, 0x8d, 0x16, 0x68},
+		},
+		{
+			addYX: fp.Elt{0xef, 0x5c, 0xe3, 0x74, 0xbf, 0x13, 0x4a, 0xbf, 0x66, 0x73, 0x64, 0xb7, 0xd4, 0xce, 0x98, 0x82, 0x05, 0xfa, 0x98, 0x0c, 0x0a, 0xae, 0xe5, 0x6b, 0x9f, 0xac, 0xbb, 0x6e, 0x1f, 0xcf, 0xff, 0xa6, 0x71, 0x9a, 0xa8, 0x7a, 0x9e, 0x64, 0x1f, 0x20, 0x4a, 0x61, 0xa2, 0xd6, 0x50, 0xe3, 0xba, 0x81, 0x0c, 0x50, 0x59, 0x69, 0x59, 0x15, 0x55, 0xdb},
+			subYX: fp.Elt{0xe8, 0x77, 0x4d, 0xe8, 0x66, 0x3d, 0xc1, 0x00, 0x3c, 0xf2, 0x25, 0x00, 0xdc, 0xb2, 0xe5, 0x9b, 0x12, 0x89, 0xf3, 0xd6, 0xea, 0x85, 0x60, 0xfe, 0x67, 0x91, 0xfd, 0x04, 0x7c, 0xe0, 0xf1, 0x86, 0x06, 0x11, 0x66, 0xee, 0xd4, 0xd5, 0xbe, 0x3b, 0x0f, 0xe3, 0x59, 0xb3, 0x4f, 0x00, 0xb6, 0xce, 0x80, 0xc1, 0x61, 0xf7, 0xaf, 0x04, 0x6a, 0x3c},
+			dt2:   fp.Elt{0x00, 0xd7, 0x32, 0x93, 0x67, 0x70, 0x6f, 0xd7, 0x69, 0xab, 0xb1, 0xd3, 0xdc, 0xd6, 0xa8, 0xdd, 0x35, 0x25, 0xca, 0xd3, 0x8a, 0x6d, 0xce, 0xfb, 0xfd, 0x2b, 0x83, 0xf0, 0xd4, 0xac, 0x66, 0xfb, 0x72, 0x87, 0x7e, 0x55, 0xb7, 0x91, 0x58, 0x10, 0xc3, 0x11, 0x7e, 0x15, 0xfe, 0x7c, 0x55, 0x90, 0xa3, 0x9e, 0xed, 0x9a, 0x7f, 0xa7, 0xb7, 0xeb},
+		},
+		{
+			addYX: fp.Elt{0x25, 0x0f, 0xc2, 0x09, 0x9c, 0x10, 0xc8, 0x7c, 0x93, 0xa7, 0xbe, 0xe9, 0x26, 0x25, 0x7c, 0x21, 0xfe, 0xe7, 0x5f, 0x3c, 0x02, 0x83, 0xa7, 0x9e, 0xdf, 0xc0, 0x94, 0x2b, 0x7d, 0x1a, 0xd0, 0x1d, 0xcc, 0x2e, 0x7d, 0xd4, 0x85, 0xe7, 0xc1, 0x15, 0x66, 0xd6, 0xd6, 0x32, 0xb8, 0xf7, 0x63, 0xaa, 0x3b, 0xa5, 0xea, 0x49, 0xad, 0x88, 0x9b, 0x66},
+			subYX: fp.Elt{0x09, 0x97, 0x79, 0x36, 0x41, 0x56, 0x9b, 0xdf, 0x15, 0xd8, 0x43, 0x28, 0x17, 0x5b, 0x96, 0xc9, 0xcf, 0x39, 0x1f, 0x13, 0xf7, 0x4d, 0x1d, 0x1f, 0xda, 0x51, 0x56, 0xe7, 0x0a, 0x5a, 0x65, 0xb6, 0x2a, 0x87, 0x49, 0x86, 0xc2, 0x2b, 0xcd, 0xfe, 0x07, 0xf6, 0x4c, 0xe2, 0x1d, 0x9b, 0xd8, 0x82, 0x09, 0x5b, 0x11, 0x10, 0x62, 0x56, 0x89, 0xbd},
+			dt2:   fp.Elt{0xd9, 0x15, 0x73, 0xf2, 0x96, 0x35, 0x53, 0xb0, 0xe7, 0xa8, 0x0b, 0x93, 0x35, 0x0b, 0x3a, 0x00, 0xf5, 0x18, 0xb1, 0xc3, 0x12, 0x3f, 0x91, 0x17, 0xc1, 0x4c, 0x15, 0x5a, 0x86, 0x92, 0x11, 0xbd, 0x44, 0x40, 0x5a, 0x7b, 0x15, 0x89, 0xba, 0xc1, 0xc1, 0xbc, 0x43, 0x45, 0xe6, 0x52, 0x02, 0x73, 0x0a, 0xd0, 0x2a, 0x19, 0xda, 0x47, 0xa8, 0xff},
+		},
+	},
+}
+
+// tabVerif contains the odd multiples of P. The entry T[i] = (2i+1)P, where
+// P = phi(G) and G is the generator of the Goldilocks curve, and phi is a
+// 4-degree isogeny.
+var tabVerif = [1 << (omegaFix - 2)]preTwistPointAffine{
+	{ /* 1P*/
+		addYX: fp.Elt{0x65, 0x4a, 0xdd, 0xdf, 0xb4, 0x79, 0x60, 0xc8, 0xa1, 0x70, 0xb4, 0x3a, 0x1e, 0x0c, 0x9b, 0x19, 0xe5, 0x48, 0x3f, 0xd7, 0x44, 0x18, 0x18, 0x14, 0x14, 0x27, 0x45, 0xd0, 0x2b, 0x24, 0xd5, 0x93, 0xc3, 0x74, 0x4c, 0x50, 0x70, 0x43, 0x26, 0x05, 0x08, 0x24, 0xca, 0x78, 0x30, 0xc1, 0x06, 0x8d, 0xd4, 0x86, 0x42, 0xf0, 0x14, 0xde, 0x08, 0x05},
+		subYX: fp.Elt{0x64, 0x4a, 0xdd, 0xdf, 0xb4, 0x79, 0x60, 0xc8, 0xa1, 0x70, 0xb4, 0x3a, 0x1e, 0x0c, 0x9b, 0x19, 0xe5, 0x48, 0x3f, 0xd7, 0x44, 0x18, 0x18, 0x14, 0x14, 0x27, 0x45, 0xd0, 0x2d, 0x24, 0xd5, 0x93, 0xc3, 0x74, 0x4c, 0x50, 0x70, 0x43, 0x26, 0x05, 0x08, 0x24, 0xca, 0x78, 0x30, 0xc1, 0x06, 0x8d, 0xd4, 0x86, 0x42, 0xf0, 0x14, 0xde, 0x08, 0x05},
+		dt2:   fp.Elt{0x1a, 0x33, 0xea, 0x64, 0x45, 0x1c, 0xdf, 0x17, 0x1d, 0x16, 0x34, 0x28, 0xd6, 0x61, 0x19, 0x67, 0x79, 0xb4, 0x13, 0xcf, 0x3e, 0x7c, 0x0e, 0x72, 0xda, 0xf1, 0x5f, 0xda, 0xe6, 0xcf, 0x42, 0xd3, 0xb6, 0x17, 0xc2, 0x68, 0x13, 0x2d, 0xd9, 0x60, 0x3e, 0xae, 0xf0, 0x5b, 0x96, 0xf0, 0xcd, 0xaf, 0xea, 0xb7, 0x0d, 0x59, 0x16, 0xa7, 0xff, 0x55},
+	},
+	{ /* 3P*/
+		addYX: fp.Elt{0xd1, 0xe9, 0xa8, 0x33, 0x20, 0x76, 0x18, 0x08, 0x45, 0x2a, 0xc9, 0x67, 0x2a, 0xc3, 0x15, 0x24, 0xf9, 0x74, 0x21, 0x30, 0x99, 0x59, 0x8b, 0xb2, 0xf0, 0xa4, 0x07, 0xe2, 0x6a, 0x36, 0x8d, 0xd9, 0xd2, 0x4a, 0x7f, 0x73, 0x50, 0x39, 0x3d, 0xaa, 0xa7, 0x51, 0x73, 0x0d, 0x2b, 0x8b, 0x96, 0x47, 0xac, 0x3c, 0x5d, 0xaa, 0x39, 0x9c, 0xcf, 0xd5},
+		subYX: fp.Elt{0x6b, 0x11, 0x5d, 0x1a, 0xf9, 0x41, 0x9d, 0xc5, 0x30, 0x3e, 0xad, 0x25, 0x2c, 0x04, 0x45, 0xea, 0xcc, 0x67, 0x07, 0x85, 0xe9, 0xda, 0x0e, 0xb5, 0x40, 0xb7, 0x32, 0xb4, 0x49, 0xdd, 0xff, 0xaa, 0xfc, 0xbb, 0x19, 0xca, 0x8b, 0x79, 0x2b, 0x8f, 0x8d, 0x00, 0x33, 0xc2, 0xad, 0xe9, 0xd3, 0x12, 0xa8, 0xaa, 0x87, 0x62, 0xad, 0x2d, 0xff, 0xa4},
+		dt2:   fp.Elt{0xb0, 0xaf, 0x3b, 0xea, 0xf0, 0x42, 0x0b, 0x5e, 0x88, 0xd3, 0x98, 0x08, 0x87, 0x59, 0x72, 0x0a, 0xc2, 0xdf, 0xcb, 0x7f, 0x59, 0xb5, 0x4c, 0x63, 0x68, 0xe8, 0x41, 0x38, 0x67, 0x4f, 0xe9, 0xc6, 0xb2, 0x6b, 0x08, 0xa7, 0xf7, 0x0e, 0xcd, 0xea, 0xca, 0x3d, 0xaf, 0x8e, 0xda, 0x4b, 0x2e, 0xd2, 0x88, 0x64, 0x8d, 0xc5, 0x5f, 0x76, 0x0f, 0x3d},
+	},
+	{ /* 5P*/
+		addYX: fp.Elt{0xe5, 0x65, 0xc9, 0xe2, 0x75, 0xf0, 0x7d, 0x1a, 0xba, 0xa4, 0x40, 0x4b, 0x93, 0x12, 0xa2, 0x80, 0x95, 0x0d, 0x03, 0x93, 0xe8, 0xa5, 0x4d, 0xe2, 0x3d, 0x81, 0xf5, 0xce, 0xd4, 0x2d, 0x25, 0x59, 0x16, 0x5c, 0xe7, 0xda, 0xc7, 0x45, 0xd2, 0x7e, 0x2c, 0x38, 0xd4, 0x37, 0x64, 0xb2, 0xc2, 0x28, 0xc5, 0x72, 0x16, 0x32, 0x45, 0x36, 0x6f, 0x9f},
+		subYX: fp.Elt{0x09, 0xf4, 0x7e, 0xbd, 0x89, 0xdb, 0x19, 0x58, 0xe1, 0x08, 0x00, 0x8a, 0xf4, 0x5f, 0x2a, 0x32, 0x40, 0xf0, 0x2c, 0x3f, 0x5d, 0xe4, 0xfc, 0x89, 0x11, 0x24, 0xb4, 0x2f, 0x97, 0xad, 0xac, 0x8f, 0x19, 0xab, 0xfa, 0x12, 0xe5, 0xf9, 0x50, 0x4e, 0x50, 0x6f, 0x32, 0x30, 0x88, 0xa6, 0xe5, 0x48, 0x28, 0xa2, 0x1b, 0x9f, 0xcd, 0xe2, 0x43, 0x38},
+		dt2:   fp.Elt{0xa9, 0xcc, 0x53, 0x39, 0x86, 0x02, 0x60, 0x75, 0x34, 0x99, 0x57, 0xbd, 0xfc, 0x5a, 0x8e, 0xce, 0x5e, 0x98, 0x22, 0xd0, 0xa5, 0x24, 0xff, 0x90, 0x28, 0x9f, 0x58, 0xf3, 0x39, 0xe9, 0xba, 0x36, 0x23, 0xfb, 0x7f, 0x41, 0xcc, 0x2b, 0x5a, 0x25, 0x3f, 0x4c, 0x2a, 0xf1, 0x52, 0x6f, 0x2f, 0x07, 0xe3, 0x88, 0x81, 0x77, 0xdd, 0x7c, 0x88, 0x82},
+	},
+	{ /* 7P*/
+		addYX: fp.Elt{0xf7, 0xee, 0x88, 0xfd, 0x3a, 0xbf, 0x7e, 0x28, 0x39, 0x23, 0x79, 0xe6, 0x5c, 0x56, 0xcb, 0xb5, 0x48, 0x6a, 0x80, 0x6d, 0x37, 0x60, 0x6c, 0x10, 0x35, 0x49, 0x4b, 0x46, 0x60, 0xd4, 0x79, 0xd4, 0x53, 0xd3, 0x67, 0x88, 0xd0, 0x41, 0xd5, 0x43, 0x85, 0xc8, 0x71, 0xe3, 0x1c, 0xb6, 0xda, 0x22, 0x64, 0x8f, 0x80, 0xac, 0xad, 0x7d, 0xd5, 0x82},
+		subYX: fp.Elt{0x92, 0x40, 0xc1, 0x83, 0x21, 0x9b, 0xd5, 0x7d, 0x3f, 0x29, 0xb6, 0x26, 0xef, 0x12, 0xb9, 0x27, 0x39, 0x42, 0x37, 0x97, 0x09, 0x9a, 0x08, 0xe1, 0x68, 0xb6, 0x7a, 0x3f, 0x9f, 0x45, 0xf8, 0x37, 0x19, 0x83, 0x97, 0xe6, 0x73, 0x30, 0x32, 0x35, 0xcf, 0xae, 0x5c, 0x12, 0x68, 0xdf, 0x6e, 0x2b, 0xde, 0x83, 0xa0, 0x44, 0x74, 0x2e, 0x4a, 0xe9},
+		dt2:   fp.Elt{0xcb, 0x22, 0x0a, 0xda, 0x6b, 0xc1, 0x8a, 0x29, 0xa1, 0xac, 0x8b, 0x5b, 0x8b, 0x32, 0x20, 0xf2, 0x21, 0xae, 0x0c, 0x43, 0xc4, 0xd7, 0x19, 0x37, 0x3d, 0x79, 0x25, 0x98, 0x6c, 0x9c, 0x22, 0x31, 0x2a, 0x55, 0x9f, 0xda, 0x5e, 0xa8, 0x13, 0xdb, 0x8e, 0x2e, 0x16, 0x39, 0xf4, 0x91, 0x6f, 0xec, 0x71, 0x71, 0xc9, 0x10, 0xf2, 0xa4, 0x8f, 0x11},
+	},
+	{ /* 9P*/
+		addYX: fp.Elt{0x85, 0xdd, 0x37, 0x62, 0x74, 0x8e, 0x33, 0x5b, 0x25, 0x12, 0x1b, 0xe7, 0xdf, 0x47, 0xe5, 0x12, 0xfd, 0x3a, 0x3a, 0xf5, 0x5d, 0x4c, 0xa2, 0x29, 0x3c, 0x5c, 0x2f, 0xee, 0x18, 0x19, 0x0a, 0x2b, 0xef, 0x67, 0x50, 0x7a, 0x0d, 0x29, 0xae, 0x55, 0x82, 0xcd, 0xd6, 0x41, 0x90, 0xb4, 0x13, 0x31, 0x5d, 0x11, 0xb8, 0xaa, 0x12, 0x86, 0x08, 0xac},
+		subYX: fp.Elt{0xcc, 0x37, 0x8d, 0x83, 0x5f, 0xfd, 0xde, 0xd5, 0xf7, 0xf1, 0xae, 0x0a, 0xa7, 0x0b, 0xeb, 0x6d, 0x19, 0x8a, 0xb6, 0x1a, 0x59, 0xd8, 0xff, 0x3c, 0xbc, 0xbc, 0xef, 0x9c, 0xda, 0x7b, 0x75, 0x12, 0xaf, 0x80, 0x8f, 0x2c, 0x3c, 0xaa, 0x0b, 0x17, 0x86, 0x36, 0x78, 0x18, 0xc8, 0x8a, 0xf6, 0xb8, 0x2c, 0x2f, 0x57, 0x2c, 0x62, 0x57, 0xf6, 0x90},
+		dt2:   fp.Elt{0x83, 0xbc, 0xa2, 0x07, 0xa5, 0x38, 0x96, 0xea, 0xfe, 0x11, 0x46, 0x1d, 0x3b, 0xcd, 0x42, 0xc5, 0xee, 0x67, 0x04, 0x72, 0x08, 0xd8, 0xd9, 0x96, 0x07, 0xf7, 0xac, 0xc3, 0x64, 0xf1, 0x98, 0x2c, 0x55, 0xd7, 0x7d, 0xc8, 0x6c, 0xbd, 0x2c, 0xff, 0x15, 0xd6, 0x6e, 0xb8, 0x17, 0x8e, 0xa8, 0x27, 0x66, 0xb1, 0x73, 0x79, 0x96, 0xff, 0x29, 0x10},
+	},
+	{ /* 11P*/
+		addYX: fp.Elt{0x76, 0xcb, 0x9b, 0x0c, 0x5b, 0xfe, 0xe1, 0x2a, 0xdd, 0x6f, 0x6c, 0xdd, 0x6f, 0xb4, 0xc0, 0xc2, 0x1b, 0x4b, 0x38, 0xe8, 0x66, 0x8c, 0x1e, 0x31, 0x63, 0xb9, 0x94, 0xcd, 0xc3, 0x8c, 0x44, 0x25, 0x7b, 0xd5, 0x39, 0x80, 0xfc, 0x01, 0xaa, 0xf7, 0x2a, 0x61, 0x8a, 0x25, 0xd2, 0x5f, 0xc5, 0x66, 0x38, 0xa4, 0x17, 0xcf, 0x3e, 0x11, 0x0f, 0xa3},
+		subYX: fp.Elt{0xe0, 0xb6, 0xd1, 0x9c, 0x71, 0x49, 0x2e, 0x7b, 0xde, 0x00, 0xda, 0x6b, 0xf1, 0xec, 0xe6, 0x7a, 0x15, 0x38, 0x71, 0xe9, 0x7b, 0xdb, 0xf8, 0x98, 0xc0, 0x91, 0x2e, 0x53, 0xee, 0x92, 0x87, 0x25, 0xc9, 0xb0, 0xbb, 0x33, 0x15, 0x46, 0x7f, 0xfd, 0x4f, 0x8b, 0x77, 0x05, 0x96, 0xb6, 0xe2, 0x08, 0xdb, 0x0d, 0x09, 0xee, 0x5b, 0xd1, 0x2a, 0x63},
+		dt2:   fp.Elt{0x8f, 0x7b, 0x57, 0x8c, 0xbf, 0x06, 0x0d, 0x43, 0x21, 0x92, 0x94, 0x2d, 0x6a, 0x38, 0x07, 0x0f, 0xa0, 0xf1, 0xe3, 0xd8, 0x2a, 0xbf, 0x46, 0xc6, 0x9e, 0x1f, 0x8f, 0x2b, 0x46, 0x84, 0x0b, 0x74, 0xed, 0xff, 0xf8, 0xa5, 0x94, 0xae, 0xf1, 0x67, 0xb1, 0x9b, 0xdd, 0x4a, 0xd0, 0xdb, 0xc2, 0xb5, 0x58, 0x49, 0x0c, 0xa9, 0x1d, 0x7d, 0xa9, 0xd3},
+	},
+	{ /* 13P*/
+		addYX: fp.Elt{0x73, 0x84, 0x2e, 0x31, 0x1f, 0xdc, 0xed, 0x9f, 0x74, 0xfa, 0xe0, 0x35, 0xb1, 0x85, 0x6a, 0x8d, 0x86, 0xd0, 0xff, 0xd6, 0x08, 0x43, 0x73, 0x1a, 0xd5, 0xf8, 0x43, 0xd4, 0xb3, 0xe5, 0x3f, 0xa8, 0x84, 0x17, 0x59, 0x65, 0x4e, 0xe6, 0xee, 0x54, 0x9c, 0xda, 0x5e, 0x7e, 0x98, 0x29, 0x6d, 0x73, 0x34, 0x1f, 0x99, 0x80, 0x54, 0x54, 0x81, 0x0b},
+		subYX: fp.Elt{0xb1, 0xe5, 0xbb, 0x80, 0x22, 0x9c, 0x81, 0x6d, 0xaf, 0x27, 0x65, 0x6f, 0x7e, 0x9c, 0xb6, 0x8d, 0x35, 0x5c, 0x2e, 0x20, 0x48, 0x7a, 0x28, 0xf0, 0x97, 0xfe, 0xb7, 0x71, 0xce, 0xd6, 0xad, 0x3a, 0x81, 0xf6, 0x74, 0x5e, 0xf3, 0xfd, 0x1b, 0xd4, 0x1e, 0x7c, 0xc2, 0xb7, 0xc8, 0xa6, 0xc9, 0x89, 0x03, 0x47, 0xec, 0x24, 0xd6, 0x0e, 0xec, 0x9c},
+		dt2:   fp.Elt{0x91, 0x0a, 0x43, 0x34, 0x20, 0xc2, 0x64, 0xf7, 0x4e, 0x48, 0xc8, 0xd2, 0x95, 0x83, 0xd1, 0xa4, 0xfb, 0x4e, 0x41, 0x3b, 0x0d, 0xd5, 0x07, 0xd9, 0xf1, 0x13, 0x16, 0x78, 0x54, 0x57, 0xd0, 0xf1, 0x4f, 0x20, 0xac, 0xcf, 0x9c, 0x3b, 0x33, 0x0b, 0x99, 0x54, 0xc3, 0x7f, 0x3e, 0x57, 0x26, 0x86, 0xd5, 0xa5, 0x2b, 0x8d, 0xe3, 0x19, 0x36, 0xf7},
+	},
+	{ /* 15P*/
+		addYX: fp.Elt{0x23, 0x69, 0x47, 0x14, 0xf9, 0x9a, 0x50, 0xff, 0x64, 0xd1, 0x50, 0x35, 0xc3, 0x11, 0xd3, 0x19, 0xcf, 0x87, 0xda, 0x30, 0x0b, 0x50, 0xda, 0xc0, 0xe0, 0x25, 0x00, 0xe5, 0x68, 0x93, 0x04, 0xc2, 0xaf, 0xbd, 0x2f, 0x36, 0x5f, 0x47, 0x96, 0x10, 0xa8, 0xbd, 0xe4, 0x88, 0xac, 0x80, 0x52, 0x61, 0x73, 0xe9, 0x63, 0xdd, 0x99, 0xad, 0x20, 0x5b},
+		subYX: fp.Elt{0x1b, 0x5e, 0xa2, 0x2a, 0x25, 0x0f, 0x86, 0xc0, 0xb1, 0x2e, 0x0c, 0x13, 0x40, 0x8d, 0xf0, 0xe6, 0x00, 0x55, 0x08, 0xc5, 0x7d, 0xf4, 0xc9, 0x31, 0x25, 0x3a, 0x99, 0x69, 0xdd, 0x67, 0x63, 0x9a, 0xd6, 0x89, 0x2e, 0xa1, 0x19, 0xca, 0x2c, 0xd9, 0x59, 0x5f, 0x5d, 0xc3, 0x6e, 0x62, 0x36, 0x12, 0x59, 0x15, 0xe1, 0xdc, 0xa4, 0xad, 0xc9, 0xd0},
+		dt2:   fp.Elt{0xbc, 0xea, 0xfc, 0xaf, 0x66, 0x23, 0xb7, 0x39, 0x6b, 0x2a, 0x96, 0xa8, 0x54, 0x43, 0xe9, 0xaa, 0x32, 0x40, 0x63, 0x92, 0x5e, 0xdf, 0x35, 0xc2, 0x9f, 0x24, 0x0c, 0xed, 0xfc, 0xde, 0x73, 0x8f, 0xa7, 0xd5, 0xa3, 0x2b, 0x18, 0x1f, 0xb0, 0xf8, 0xeb, 0x55, 0xd9, 0xc3, 0xfd, 0x28, 0x7c, 0x4f, 0xce, 0x0d, 0xf7, 0xae, 0xc2, 0x83, 0xc3, 0x78},
+	},
+	{ /* 17P*/
+		addYX: fp.Elt{0x71, 0xe6, 0x60, 0x93, 0x37, 0xdb, 0x01, 0xa5, 0x4c, 0xba, 0xe8, 0x8e, 0xd5, 0xf9, 0xd3, 0x98, 0xe5, 0xeb, 0xab, 0x3a, 0x15, 0x8b, 0x35, 0x60, 0xbe, 0xe5, 0x9c, 0x2d, 0x10, 0x9b, 0x2e, 0xcf, 0x65, 0x64, 0xea, 0x8f, 0x72, 0xce, 0xf5, 0x18, 0xe5, 0xe2, 0xf0, 0x0e, 0xae, 0x04, 0xec, 0xa0, 0x20, 0x65, 0x63, 0x07, 0xb1, 0x9f, 0x03, 0x97},
+		subYX: fp.Elt{0x9e, 0x41, 0x64, 0x30, 0x95, 0x7f, 0x3a, 0x89, 0x7b, 0x0a, 0x79, 0x59, 0x23, 0x9a, 0x3b, 0xfe, 0xa4, 0x13, 0x08, 0xb2, 0x2e, 0x04, 0x50, 0x10, 0x30, 0xcd, 0x2e, 0xa4, 0x91, 0x71, 0x50, 0x36, 0x4a, 0x02, 0xf4, 0x8d, 0xa3, 0x36, 0x1b, 0xf4, 0x52, 0xba, 0x15, 0x04, 0x8b, 0x80, 0x25, 0xd9, 0xae, 0x67, 0x20, 0xd9, 0x88, 0x8f, 0x97, 0xa6},
+		dt2:   fp.Elt{0xb5, 0xe7, 0x46, 0xbd, 0x55, 0x23, 0xa0, 0x68, 0xc0, 0x12, 0xd9, 0xf1, 0x0a, 0x75, 0xe2, 0xda, 0xf4, 0x6b, 0xca, 0x14, 0xe4, 0x9f, 0x0f, 0xb5, 0x3c, 0xa6, 0xa5, 0xa2, 0x63, 0x94, 0xd1, 0x1c, 0x39, 0x58, 0x57, 0x02, 0x27, 0x98, 0xb6, 0x47, 0xc6, 0x61, 0x4b, 0x5c, 0xab, 0x6f, 0x2d, 0xab, 0xe3, 0xc1, 0x69, 0xf9, 0x12, 0xb0, 0xc8, 0xd5},
+	},
+	{ /* 19P*/
+		addYX: fp.Elt{0x19, 0x7d, 0xd5, 0xac, 0x79, 0xa2, 0x82, 0x9b, 0x28, 0x31, 0x22, 0xc0, 0x73, 0x02, 0x76, 0x17, 0x10, 0x70, 0x79, 0x57, 0xc9, 0x84, 0x62, 0x8e, 0x04, 0x04, 0x61, 0x67, 0x08, 0x48, 0xb4, 0x4b, 0xde, 0x53, 0x8c, 0xff, 0x36, 0x1b, 0x62, 0x86, 0x5d, 0xe1, 0x9b, 0xb1, 0xe5, 0xe8, 0x44, 0x64, 0xa1, 0x68, 0x3f, 0xa8, 0x45, 0x52, 0x91, 0xed},
+		subYX: fp.Elt{0x42, 0x1a, 0x36, 0x1f, 0x90, 0x15, 0x24, 0x8d, 0x24, 0x80, 0xe6, 0xfe, 0x1e, 0xf0, 0xad, 0xaf, 0x6a, 0x93, 0xf0, 0xa6, 0x0d, 0x5d, 0xea, 0xf6, 0x62, 0x96, 0x7a, 0x05, 0x76, 0x85, 0x74, 0x32, 0xc7, 0xc8, 0x64, 0x53, 0x62, 0xe7, 0x54, 0x84, 0xe0, 0x40, 0x66, 0x19, 0x70, 0x40, 0x95, 0x35, 0x68, 0x64, 0x43, 0xcd, 0xba, 0x29, 0x32, 0xa8},
+		dt2:   fp.Elt{0x3e, 0xf6, 0xd6, 0xe4, 0x99, 0xeb, 0x20, 0x66, 0x08, 0x2e, 0x26, 0x64, 0xd7, 0x76, 0xf3, 0xb4, 0xc5, 0xa4, 0x35, 0x92, 0xd2, 0x99, 0x70, 0x5a, 0x1a, 0xe9, 0xe9, 0x3d, 0x3b, 0xe1, 0xcd, 0x0e, 0xee, 0x24, 0x13, 0x03, 0x22, 0xd6, 0xd6, 0x72, 0x08, 0x2b, 0xde, 0xfd, 0x93, 0xed, 0x0c, 0x7f, 0x5e, 0x31, 0x22, 0x4d, 0x80, 0x78, 0xc0, 0x48},
+	},
+	{ /* 21P*/
+		addYX: fp.Elt{0x8f, 0x72, 0xd2, 0x9e, 0xc4, 0xcd, 0x2c, 0xbf, 0xa8, 0xd3, 0x24, 0x62, 0x28, 0xee, 0x39, 0x0a, 0x19, 0x3a, 0x58, 0xff, 0x21, 0x2e, 0x69, 0x6c, 0x6e, 0x18, 0xd0, 0xcd, 0x61, 0xc1, 0x18, 0x02, 0x5a, 0xe9, 0xe3, 0xef, 0x1f, 0x8e, 0x10, 0xe8, 0x90, 0x2b, 0x48, 0xcd, 0xee, 0x38, 0xbd, 0x3a, 0xca, 0xbc, 0x2d, 0xe2, 0x3a, 0x03, 0x71, 0x02},
+		subYX: fp.Elt{0xf8, 0xa4, 0x32, 0x26, 0x66, 0xaf, 0x3b, 0x53, 0xe7, 0xb0, 0x91, 0x92, 0xf5, 0x3c, 0x74, 0xce, 0xf2, 0xdd, 0x68, 0xa9, 0xf4, 0xcd, 0x5f, 0x60, 0xab, 0x71, 0xdf, 0xcd, 0x5c, 0x5d, 0x51, 0x72, 0x3a, 0x96, 0xea, 0xd6, 0xde, 0x54, 0x8e, 0x55, 0x4c, 0x08, 0x4c, 0x60, 0xdd, 0x34, 0xa9, 0x6f, 0xf3, 0x04, 0x02, 0xa8, 0xa6, 0x4e, 0x4d, 0x62},
+		dt2:   fp.Elt{0x76, 0x4a, 0xae, 0x38, 0x62, 0x69, 0x72, 0xdc, 0xe8, 0x43, 0xbe, 0x1d, 0x61, 0xde, 0x31, 0xc3, 0x42, 0x8f, 0x33, 0x9d, 0xca, 0xc7, 0x9c, 0xec, 0x6a, 0xe2, 0xaa, 0x01, 0x49, 0x78, 0x8d, 0x72, 0x4f, 0x38, 0xea, 0x52, 0xc2, 0xd3, 0xc9, 0x39, 0x71, 0xba, 0xb9, 0x09, 0x9b, 0xa3, 0x7f, 0x45, 0x43, 0x65, 0x36, 0x29, 0xca, 0xe7, 0x5c, 0x5f},
+	},
+	{ /* 23P*/
+		addYX: fp.Elt{0x89, 0x42, 0x35, 0x48, 0x6d, 0x74, 0xe5, 0x1f, 0xc3, 0xdd, 0x28, 0x5b, 0x84, 0x41, 0x33, 0x9f, 0x42, 0xf3, 0x1d, 0x5d, 0x15, 0x6d, 0x76, 0x33, 0x36, 0xaf, 0xe9, 0xdd, 0xfa, 0x63, 0x4f, 0x7a, 0x9c, 0xeb, 0x1c, 0x4f, 0x34, 0x65, 0x07, 0x54, 0xbb, 0x4c, 0x8b, 0x62, 0x9d, 0xd0, 0x06, 0x99, 0xb3, 0xe9, 0xda, 0x85, 0x19, 0xb0, 0x3d, 0x3c},
+		subYX: fp.Elt{0xbb, 0x99, 0xf6, 0xbf, 0xaf, 0x2c, 0x22, 0x0d, 0x7a, 0xaa, 0x98, 0x6f, 0x01, 0x82, 0x99, 0xcf, 0x88, 0xbd, 0x0e, 0x3a, 0x89, 0xe0, 0x9c, 0x8c, 0x17, 0x20, 0xc4, 0xe0, 0xcf, 0x43, 0x7a, 0xef, 0x0d, 0x9f, 0x87, 0xd4, 0xfb, 0xf2, 0x96, 0xb8, 0x03, 0xe8, 0xcb, 0x5c, 0xec, 0x65, 0x5f, 0x49, 0xa4, 0x7c, 0x85, 0xb4, 0xf6, 0xc7, 0xdb, 0xa3},
+		dt2:   fp.Elt{0x11, 0xf3, 0x32, 0xa3, 0xa7, 0xb2, 0x7d, 0x51, 0x82, 0x44, 0xeb, 0xa2, 0x7d, 0x72, 0xcb, 0xc6, 0xf6, 0xc7, 0xb2, 0x38, 0x0e, 0x0f, 0x4f, 0x29, 0x00, 0xe4, 0x5b, 0x94, 0x46, 0x86, 0x66, 0xa1, 0x83, 0xb3, 0xeb, 0x15, 0xb6, 0x31, 0x50, 0x28, 0xeb, 0xed, 0x0d, 0x32, 0x39, 0xe9, 0x23, 0x81, 0x99, 0x3e, 0xff, 0x17, 0x4c, 0x11, 0x43, 0xd1},
+	},
+	{ /* 25P*/
+		addYX: fp.Elt{0xce, 0xe7, 0xf8, 0x94, 0x8f, 0x96, 0xf8, 0x96, 0xe6, 0x72, 0x20, 0x44, 0x2c, 0xa7, 0xfc, 0xba, 0xc8, 0xe1, 0xbb, 0xc9, 0x16, 0x85, 0xcd, 0x0b, 0xe5, 0xb5, 0x5a, 0x7f, 0x51, 0x43, 0x63, 0x8b, 0x23, 0x8e, 0x1d, 0x31, 0xff, 0x46, 0x02, 0x66, 0xcc, 0x9e, 0x4d, 0xa2, 0xca, 0xe2, 0xc7, 0xfd, 0x22, 0xb1, 0xdb, 0xdf, 0x6f, 0xe6, 0xa5, 0x82},
+		subYX: fp.Elt{0xd0, 0xf5, 0x65, 0x40, 0xec, 0x8e, 0x65, 0x42, 0x78, 0xc1, 0x65, 0xe4, 0x10, 0xc8, 0x0b, 0x1b, 0xdd, 0x96, 0x68, 0xce, 0xee, 0x45, 0x55, 0xd8, 0x6e, 0xd3, 0xe6, 0x77, 0x19, 0xae, 0xc2, 0x8d, 0x8d, 0x3e, 0x14, 0x3f, 0x6d, 0x00, 0x2f, 0x9b, 0xd1, 0x26, 0x60, 0x28, 0x0f, 0x3a, 0x47, 0xb3, 0xe6, 0x68, 0x28, 0x24, 0x25, 0xca, 0xc8, 0x06},
+		dt2:   fp.Elt{0x54, 0xbb, 0x60, 0x92, 0xdb, 0x8f, 0x0f, 0x38, 0xe0, 0xe6, 0xe4, 0xc9, 0xcc, 0x14, 0x62, 0x01, 0xc4, 0x2b, 0x0f, 0xcf, 0xed, 0x7d, 0x8e, 0xa4, 0xd9, 0x73, 0x0b, 0xba, 0x0c, 0xaf, 0x0c, 0xf9, 0xe2, 0xeb, 0x29, 0x2a, 0x53, 0xdf, 0x2c, 0x5a, 0xfa, 0x8f, 0xc1, 0x01, 0xd7, 0xb1, 0x45, 0x73, 0x92, 0x32, 0x83, 0x85, 0x12, 0x74, 0x89, 0x44},
+	},
+	{ /* 27P*/
+		addYX: fp.Elt{0x0b, 0x73, 0x3c, 0xc2, 0xb1, 0x2e, 0xe1, 0xa7, 0xf5, 0xc9, 0x7a, 0xfb, 0x3d, 0x2d, 0xac, 0x59, 0xdb, 0xfa, 0x36, 0x11, 0xd1, 0x13, 0x04, 0x51, 0x1d, 0xab, 0x9b, 0x6b, 0x93, 0xfe, 0xda, 0xb0, 0x8e, 0xb4, 0x79, 0x11, 0x21, 0x0f, 0x65, 0xb9, 0xbb, 0x79, 0x96, 0x2a, 0xfd, 0x30, 0xe0, 0xb4, 0x2d, 0x9a, 0x55, 0x25, 0x5d, 0xd4, 0xad, 0x2a},
+		subYX: fp.Elt{0x9e, 0xc5, 0x04, 0xfe, 0xec, 0x3c, 0x64, 0x1c, 0xed, 0x95, 0xed, 0xae, 0xaf, 0x5c, 0x6e, 0x08, 0x9e, 0x02, 0x29, 0x59, 0x7e, 0x5f, 0xc4, 0x9a, 0xd5, 0x32, 0x72, 0x86, 0xe1, 0x4e, 0x3c, 0xce, 0x99, 0x69, 0x3b, 0xc4, 0xdd, 0x4d, 0xb7, 0xbb, 0xda, 0x3b, 0x1a, 0x99, 0xaa, 0x62, 0x15, 0xc1, 0xf0, 0xb6, 0x6c, 0xec, 0x56, 0xc1, 0xff, 0x0c},
+		dt2:   fp.Elt{0x2f, 0xf1, 0x3f, 0x7a, 0x2d, 0x56, 0x19, 0x7f, 0xea, 0xbe, 0x59, 0x2e, 0x13, 0x67, 0x81, 0xfb, 0xdb, 0xc8, 0xa3, 0x1d, 0xd5, 0xe9, 0x13, 0x8b, 0x29, 0xdf, 0xcf, 0x9f, 0xe7, 0xd9, 0x0b, 0x70, 0xd3, 0x15, 0x57, 0x4a, 0xe9, 0x50, 0x12, 0x1b, 0x81, 0x4b, 0x98, 0x98, 0xa8, 0x31, 0x1d, 0x27, 0x47, 0x38, 0xed, 0x57, 0x99, 0x26, 0xb2, 0xee},
+	},
+	{ /* 29P*/
+		addYX: fp.Elt{0x1c, 0xb2, 0xb2, 0x67, 0x3b, 0x8b, 0x3d, 0x5a, 0x30, 0x7e, 0x38, 0x7e, 0x3c, 0x3d, 0x28, 0x56, 0x59, 0xd8, 0x87, 0x53, 0x8b, 0xe6, 0x6c, 0x5d, 0xe5, 0x0a, 0x33, 0x10, 0xce, 0xa2, 0x17, 0x0d, 0xe8, 0x76, 0xee, 0x68, 0xa8, 0x72, 0x54, 0xbd, 0xa6, 0x24, 0x94, 0x6e, 0x77, 0xc7, 0x53, 0xb7, 0x89, 0x1c, 0x7a, 0xe9, 0x78, 0x9a, 0x74, 0x5f},
+		subYX: fp.Elt{0x76, 0x96, 0x1c, 0xcf, 0x08, 0x55, 0xd8, 0x1e, 0x0d, 0xa3, 0x59, 0x95, 0x32, 0xf4, 0xc2, 0x8e, 0x84, 0x5e, 0x4b, 0x04, 0xda, 0x71, 0xc9, 0x78, 0x52, 0xde, 0x14, 0xb4, 0x31, 0xf4, 0xd4, 0xb8, 0x58, 0xc5, 0x20, 0xe8, 0xdd, 0x15, 0xb5, 0xee, 0xea, 0x61, 0xe0, 0xf5, 0xd6, 0xae, 0x55, 0x59, 0x05, 0x3e, 0xaf, 0x74, 0xac, 0x1f, 0x17, 0x82},
+		dt2:   fp.Elt{0x59, 0x24, 0xcd, 0xfc, 0x11, 0x7e, 0x85, 0x18, 0x3d, 0x69, 0xf7, 0x71, 0x31, 0x66, 0x98, 0x42, 0x95, 0x00, 0x8c, 0xb2, 0xae, 0x39, 0x7e, 0x85, 0xd6, 0xb0, 0x02, 0xec, 0xce, 0xfc, 0x25, 0xb2, 0xe3, 0x99, 0x8e, 0x5b, 0x61, 0x96, 0x2e, 0x6d, 0x96, 0x57, 0x71, 0xa5, 0x93, 0x41, 0x0e, 0x6f, 0xfd, 0x0a, 0xbf, 0xa9, 0xf7, 0x56, 0xa9, 0x3e},
+	},
+	{ /* 31P*/
+		addYX: fp.Elt{0xa2, 0x2e, 0x0c, 0x17, 0x4d, 0xcc, 0x85, 0x2c, 0x18, 0xa0, 0xd2, 0x08, 0xba, 0x11, 0xfa, 0x47, 0x71, 0x86, 0xaf, 0x36, 0x6a, 0xd7, 0xfe, 0xb9, 0xb0, 0x2f, 0x89, 0x98, 0x49, 0x69, 0xf8, 0x6a, 0xad, 0x27, 0x5e, 0x0a, 0x22, 0x60, 0x5e, 0x5d, 0xca, 0x06, 0x51, 0x27, 0x99, 0x29, 0x85, 0x68, 0x98, 0xe1, 0xc4, 0x21, 0x50, 0xa0, 0xe9, 0xc1},
+		subYX: fp.Elt{0x4d, 0x70, 0xee, 0x91, 0x92, 0x3f, 0xb7, 0xd3, 0x1d, 0xdb, 0x8d, 0x6e, 0x16, 0xf5, 0x65, 0x7d, 0x5f, 0xb5, 0x6c, 0x59, 0x26, 0x70, 0x4b, 0xf2, 0xfc, 0xe7, 0xdf, 0x86, 0xfe, 0xa5, 0xa7, 0xa6, 0x5d, 0xfb, 0x06, 0xe9, 0xf9, 0xcc, 0xc0, 0x37, 0xcc, 0xd8, 0x09, 0x04, 0xd2, 0xa5, 0x1d, 0xd7, 0xb7, 0xce, 0x92, 0xac, 0x3c, 0xad, 0xfb, 0xae},
+		dt2:   fp.Elt{0x17, 0xa3, 0x9a, 0xc7, 0x86, 0x2a, 0x51, 0xf7, 0x96, 0x79, 0x49, 0x22, 0x2e, 0x5a, 0x01, 0x5c, 0xb5, 0x95, 0xd4, 0xe8, 0xcb, 0x00, 0xca, 0x2d, 0x55, 0xb6, 0x34, 0x36, 0x0b, 0x65, 0x46, 0xf0, 0x49, 0xfc, 0x87, 0x86, 0xe5, 0xc3, 0x15, 0xdb, 0x32, 0xcd, 0xf2, 0xd3, 0x82, 0x4c, 0xe6, 0x61, 0x8a, 0xaf, 0xd4, 0x9e, 0x0f, 0x5a, 0xf2, 0x81},
+	},
+	{ /* 33P*/
+		addYX: fp.Elt{0x88, 0x10, 0xc0, 0xcb, 0xf5, 0x77, 0xae, 0xa5, 0xbe, 0xf6, 0xcd, 0x2e, 0x8b, 0x7e, 0xbd, 0x79, 0x62, 0x4a, 0xeb, 0x69, 0xc3, 0x28, 0xaa, 0x72, 0x87, 0xa9, 0x25, 0x87, 0x46, 0xea, 0x0e, 0x62, 0xa3, 0x6a, 0x1a, 0xe2, 0xba, 0xdc, 0x81, 0x10, 0x33, 0x01, 0xf6, 0x16, 0x89, 0x80, 0xc6, 0xcd, 0xdb, 0xdc, 0xba, 0x0e, 0x09, 0x4a, 0x35, 0x4a},
+		subYX: fp.Elt{0x86, 0xb2, 0x2b, 0xd0, 0xb8, 0x4a, 0x6d, 0x66, 0x7b, 0x32, 0xdf, 0x3b, 0x1a, 0x19, 0x1f, 0x63, 0xee, 0x1f, 0x3d, 0x1c, 0x5c, 0x14, 0x60, 0x5b, 0x72, 0x49, 0x07, 0xb1, 0x0d, 0x72, 0xc6, 0x35, 0xf0, 0xbc, 0x5e, 0xda, 0x80, 0x6b, 0x64, 0x5b, 0xe5, 0x34, 0x54, 0x39, 0xdd, 0xe6, 0x3c, 0xcb, 0xe5, 0x29, 0x32, 0x06, 0xc6, 0xb1, 0x96, 0x34},
+		dt2:   fp.Elt{0x85, 0x86, 0xf5, 0x84, 0x86, 0xe6, 0x77, 0x8a, 0x71, 0x85, 0x0c, 0x4f, 0x81, 0x5b, 0x29, 0x06, 0xb5, 0x2e, 0x26, 0x71, 0x07, 0x78, 0x07, 0xae, 0xbc, 0x95, 0x46, 0xc3, 0x65, 0xac, 0xe3, 0x76, 0x51, 0x7d, 0xd4, 0x85, 0x31, 0xe3, 0x43, 0xf3, 0x1b, 0x7c, 0xf7, 0x6b, 0x2c, 0xf8, 0x1c, 0xbb, 0x8d, 0xca, 0xab, 0x4b, 0xba, 0x7f, 0xa4, 0xe2},
+	},
+	{ /* 35P*/
+		addYX: fp.Elt{0x1a, 0xee, 0xe7, 0xa4, 0x8a, 0x9d, 0x53, 0x80, 0xc6, 0xb8, 0x4e, 0xdc, 0x89, 0xe0, 0xc4, 0x2b, 0x60, 0x52, 0x6f, 0xec, 0x81, 0xd2, 0x55, 0x6b, 0x1b, 0x6f, 0x17, 0x67, 0x8e, 0x42, 0x26, 0x4c, 0x65, 0x23, 0x29, 0xc6, 0x7b, 0xcd, 0x9f, 0xad, 0x4b, 0x42, 0xd3, 0x0c, 0x75, 0xc3, 0x8a, 0xf5, 0xbe, 0x9e, 0x55, 0xf7, 0x47, 0x5d, 0xbd, 0x3a},
+		subYX: fp.Elt{0x0d, 0xa8, 0x3b, 0xf9, 0xc7, 0x7e, 0xc6, 0x86, 0x94, 0xc0, 0x01, 0xff, 0x27, 0xce, 0x43, 0xac, 0xe5, 0xe1, 0xd2, 0x8d, 0xc1, 0x22, 0x31, 0xbe, 0xe1, 0xaf, 0xf9, 0x4a, 0x78, 0xa1, 0x0c, 0xaa, 0xd4, 0x80, 0xe4, 0x09, 0x8d, 0xfb, 0x1d, 0x52, 0xc8, 0x60, 0x2d, 0xf2, 0xa2, 0x89, 0x02, 0x56, 0x3d, 0x56, 0x27, 0x85, 0xc7, 0xf0, 0x2b, 0x9a},
+		dt2:   fp.Elt{0x62, 0x7c, 0xc7, 0x6b, 0x2c, 0x9d, 0x0a, 0x7c, 0xe5, 0x50, 0x3c, 0xe6, 0x87, 0x1c, 0x82, 0x30, 0x67, 0x3c, 0x39, 0xb6, 0xa0, 0x31, 0xfb, 0x03, 0x7b, 0xa1, 0x58, 0xdf, 0x12, 0x76, 0x5d, 0x5d, 0x0a, 0x8f, 0x9b, 0x37, 0x32, 0xc3, 0x60, 0x33, 0xea, 0x9f, 0x0a, 0x99, 0xfa, 0x20, 0xd0, 0x33, 0x21, 0xc3, 0x94, 0xd4, 0x86, 0x49, 0x7c, 0x4e},
+	},
+	{ /* 37P*/
+		addYX: fp.Elt{0xc7, 0x0c, 0x71, 0xfe, 0x55, 0xd1, 0x95, 0x8f, 0x43, 0xbb, 0x6b, 0x74, 0x30, 0xbd, 0xe8, 0x6f, 0x1c, 0x1b, 0x06, 0x62, 0xf5, 0xfc, 0x65, 0xa0, 0xeb, 0x81, 0x12, 0xc9, 0x64, 0x66, 0x61, 0xde, 0xf3, 0x6d, 0xd4, 0xae, 0x8e, 0xb1, 0x72, 0xe0, 0xcd, 0x37, 0x01, 0x28, 0x52, 0xd7, 0x39, 0x46, 0x0c, 0x55, 0xcf, 0x47, 0x70, 0xef, 0xa1, 0x17},
+		subYX: fp.Elt{0x8d, 0x58, 0xde, 0x83, 0x88, 0x16, 0x0e, 0x12, 0x42, 0x03, 0x50, 0x60, 0x4b, 0xdf, 0xbf, 0x95, 0xcc, 0x7d, 0x18, 0x17, 0x7e, 0x31, 0x5d, 0x8a, 0x66, 0xc1, 0xcf, 0x14, 0xea, 0xf4, 0xf4, 0xe5, 0x63, 0x2d, 0x32, 0x86, 0x9b, 0xed, 0x1f, 0x4f, 0x03, 0xaf, 0x33, 0x92, 0xcb, 0xaf, 0x9c, 0x05, 0x0d, 0x47, 0x1b, 0x42, 0xba, 0x13, 0x22, 0x98},
+		dt2:   fp.Elt{0xb5, 0x48, 0xeb, 0x7d, 0x3d, 0x10, 0x9f, 0x59, 0xde, 0xf8, 0x1c, 0x4f, 0x7d, 0x9d, 0x40, 0x4d, 0x9e, 0x13, 0x24, 0xb5, 0x21, 0x09, 0xb7, 0xee, 0x98, 0x5c, 0x56, 0xbc, 0x5e, 0x2b, 0x78, 0x38, 0x06, 0xac, 0xe3, 0xe0, 0xfa, 0x2e, 0xde, 0x4f, 0xd2, 0xb3, 0xfb, 0x2d, 0x71, 0x84, 0xd1, 0x9d, 0x12, 0x5b, 0x35, 0xc8, 0x03, 0x68, 0x67, 0xc7},
+	},
+	{ /* 39P*/
+		addYX: fp.Elt{0xb6, 0x65, 0xfb, 0xa7, 0x06, 0x35, 0xbb, 0xe0, 0x31, 0x8d, 0x91, 0x40, 0x98, 0xab, 0x30, 0xe4, 0xca, 0x12, 0x59, 0x89, 0xed, 0x65, 0x5d, 0x7f, 0xae, 0x69, 0xa0, 0xa4, 0xfa, 0x78, 0xb4, 0xf7, 0xed, 0xae, 0x86, 0x78, 0x79, 0x64, 0x24, 0xa6, 0xd4, 0xe1, 0xf6, 0xd3, 0xa0, 0x89, 0xba, 0x20, 0xf4, 0x54, 0x0d, 0x8f, 0xdb, 0x1a, 0x79, 0xdb},
+		subYX: fp.Elt{0xe1, 0x82, 0x0c, 0x4d, 0xde, 0x9f, 0x40, 0xf0, 0xc1, 0xbd, 0x8b, 0xd3, 0x24, 0x03, 0xcd, 0xf2, 0x92, 0x7d, 0xe2, 0x68, 0x7f, 0xf1, 0xbe, 0x69, 0xde, 0x34, 0x67, 0x4c, 0x85, 0x3b, 0xec, 0x98, 0xcc, 0x4d, 0x3e, 0xc0, 0x96, 0x27, 0xe6, 0x75, 0xfc, 0xdf, 0x37, 0xc0, 0x1e, 0x27, 0xe0, 0xf6, 0xc2, 0xbd, 0xbc, 0x3d, 0x9b, 0x39, 0xdc, 0xe2},
+		dt2:   fp.Elt{0xd8, 0x29, 0xa7, 0x39, 0xe3, 0x9f, 0x2f, 0x0e, 0x4b, 0x24, 0x21, 0x70, 0xef, 0xfd, 0x91, 0xea, 0xbf, 0xe1, 0x72, 0x90, 0xcc, 0xc9, 0x84, 0x0e, 0xad, 0xd5, 0xe6, 0xbb, 0xc5, 0x99, 0x7f, 0xa4, 0xf0, 0x2e, 0xcc, 0x95, 0x64, 0x27, 0x19, 0xd8, 0x4c, 0x27, 0x0d, 0xff, 0xb6, 0x29, 0xe2, 0x6c, 0xfa, 0xbb, 0x4d, 0x9c, 0xbb, 0xaf, 0xa5, 0xec},
+	},
+	{ /* 41P*/
+		addYX: fp.Elt{0xd6, 0x33, 0x3f, 0x9f, 0xcf, 0xfd, 0x4c, 0xd1, 0xfe, 0xe5, 0xeb, 0x64, 0x27, 0xae, 0x7a, 0xa2, 0x82, 0x50, 0x6d, 0xaa, 0xe3, 0x5d, 0xe2, 0x48, 0x60, 0xb3, 0x76, 0x04, 0xd9, 0x19, 0xa7, 0xa1, 0x73, 0x8d, 0x38, 0xa9, 0xaf, 0x45, 0xb5, 0xb2, 0x62, 0x9b, 0xf1, 0x35, 0x7b, 0x84, 0x66, 0xeb, 0x06, 0xef, 0xf1, 0xb2, 0x2d, 0x6a, 0x61, 0x15},
+		subYX: fp.Elt{0x86, 0x50, 0x42, 0xf7, 0xda, 0x59, 0xb2, 0xcf, 0x0d, 0x3d, 0xee, 0x8e, 0x53, 0x5d, 0xf7, 0x9e, 0x6a, 0x26, 0x2d, 0xc7, 0x8c, 0x8e, 0x18, 0x50, 0x6d, 0xb7, 0x51, 0x4c, 0xa7, 0x52, 0x6e, 0x0e, 0x0a, 0x16, 0x74, 0xb2, 0x81, 0x8b, 0x56, 0x27, 0x22, 0x84, 0xf4, 0x56, 0xc5, 0x06, 0xe1, 0x8b, 0xca, 0x2d, 0xdb, 0x9a, 0xf6, 0x10, 0x9c, 0x51},
+		dt2:   fp.Elt{0x1f, 0x16, 0xa2, 0x78, 0x96, 0x1b, 0x85, 0x9c, 0x76, 0x49, 0xd4, 0x0f, 0xac, 0xb0, 0xf4, 0xd0, 0x06, 0x2c, 0x7e, 0x6d, 0x6e, 0x8e, 0xc7, 0x9f, 0x18, 0xad, 0xfc, 0x88, 0x0c, 0x0c, 0x09, 0x05, 0x05, 0xa0, 0x79, 0x72, 0x32, 0x72, 0x87, 0x0f, 0x49, 0x87, 0x0c, 0xb4, 0x12, 0xc2, 0x09, 0xf8, 0x9f, 0x30, 0x72, 0xa9, 0x47, 0x13, 0x93, 0x49},
+	},
+	{ /* 43P*/
+		addYX: fp.Elt{0xcc, 0xb1, 0x4c, 0xd3, 0xc0, 0x9e, 0x9e, 0x4d, 0x6d, 0x28, 0x0b, 0xa5, 0x94, 0xa7, 0x2e, 0xc2, 0xc7, 0xaf, 0x29, 0x73, 0xc9, 0x68, 0xea, 0x0f, 0x34, 0x37, 0x8d, 0x96, 0x8f, 0x3a, 0x3d, 0x73, 0x1e, 0x6d, 0x9f, 0xcf, 0x8d, 0x83, 0xb5, 0x71, 0xb9, 0xe1, 0x4b, 0x67, 0x71, 0xea, 0xcf, 0x56, 0xe5, 0xeb, 0x72, 0x15, 0x2f, 0x9e, 0xa8, 0xaa},
+		subYX: fp.Elt{0xf4, 0x3e, 0x85, 0x1c, 0x1a, 0xef, 0x50, 0xd1, 0xb4, 0x20, 0xb2, 0x60, 0x05, 0x98, 0xfe, 0x47, 0x3b, 0xc1, 0x76, 0xca, 0x2c, 0x4e, 0x5a, 0x42, 0xa3, 0xf7, 0x20, 0xaa, 0x57, 0x39, 0xee, 0x34, 0x1f, 0xe1, 0x68, 0xd3, 0x7e, 0x06, 0xc4, 0x6c, 0xc7, 0x76, 0x2b, 0xe4, 0x1c, 0x48, 0x44, 0xe6, 0xe5, 0x44, 0x24, 0x8d, 0xb3, 0xb6, 0x88, 0x32},
+		dt2:   fp.Elt{0x18, 0xa7, 0xba, 0xd0, 0x44, 0x6f, 0x33, 0x31, 0x00, 0xf8, 0xf6, 0x12, 0xe3, 0xc5, 0xc7, 0xb5, 0x91, 0x9c, 0x91, 0xb5, 0x75, 0x18, 0x18, 0x8a, 0xab, 0xed, 0x24, 0x11, 0x2e, 0xce, 0x5a, 0x0f, 0x94, 0x5f, 0x2e, 0xca, 0xd3, 0x80, 0xea, 0xe5, 0x34, 0x96, 0x67, 0x8b, 0x6a, 0x26, 0x5e, 0xc8, 0x9d, 0x2c, 0x5e, 0x6c, 0xa2, 0x0c, 0xbf, 0xf0},
+	},
+	{ /* 45P*/
+		addYX: fp.Elt{0xb3, 0xbf, 0xa3, 0x85, 0xee, 0xf6, 0x58, 0x02, 0x78, 0xc4, 0x30, 0xd6, 0x57, 0x59, 0x8c, 0x88, 0x08, 0x7c, 0xbc, 0xbe, 0x0a, 0x74, 0xa9, 0xde, 0x69, 0xe7, 0x41, 0xd8, 0xbf, 0x66, 0x8d, 0x3d, 0x28, 0x00, 0x8c, 0x47, 0x65, 0x34, 0xfe, 0x86, 0x9e, 0x6a, 0xf2, 0x41, 0x6a, 0x94, 0xc4, 0x88, 0x75, 0x23, 0x0d, 0x52, 0x69, 0xee, 0x07, 0x89},
+		subYX: fp.Elt{0x22, 0x3c, 0xa1, 0x70, 0x58, 0x97, 0x93, 0xbe, 0x59, 0xa8, 0x0b, 0x8a, 0x46, 0x2a, 0x38, 0x1e, 0x08, 0x6b, 0x61, 0x9f, 0xf2, 0x4a, 0x8b, 0x80, 0x68, 0x6e, 0xc8, 0x92, 0x60, 0xf3, 0xc9, 0x89, 0xb2, 0x6d, 0x63, 0xb0, 0xeb, 0x83, 0x15, 0x63, 0x0e, 0x64, 0xbb, 0xb8, 0xfe, 0xb4, 0x81, 0x90, 0x01, 0x28, 0x10, 0xb9, 0x74, 0x6e, 0xde, 0xa4},
+		dt2:   fp.Elt{0x1a, 0x23, 0x45, 0xa8, 0x6f, 0x4e, 0xa7, 0x4a, 0x0c, 0xeb, 0xb0, 0x43, 0xf9, 0xef, 0x99, 0x60, 0x5b, 0xdb, 0x66, 0xc0, 0x86, 0x71, 0x43, 0xb1, 0x22, 0x7b, 0x1c, 0xe7, 0x8d, 0x09, 0x1d, 0x83, 0x76, 0x9c, 0xd3, 0x5a, 0xdd, 0x42, 0xd9, 0x2f, 0x2d, 0xba, 0x7a, 0xc2, 0xd9, 0x6b, 0xd4, 0x7a, 0xf1, 0xd5, 0x5f, 0x6b, 0x85, 0xbf, 0x0b, 0xf1},
+	},
+	{ /* 47P*/
+		addYX: fp.Elt{0xb2, 0x83, 0xfa, 0x1f, 0xd2, 0xce, 0xb6, 0xf2, 0x2d, 0xea, 0x1b, 0xe5, 0x29, 0xa5, 0x72, 0xf9, 0x25, 0x48, 0x4e, 0xf2, 0x50, 0x1b, 0x39, 0xda, 0x34, 0xc5, 0x16, 0x13, 0xb4, 0x0c, 0xa1, 0x00, 0x79, 0x7a, 0xf5, 0x8b, 0xf3, 0x70, 0x14, 0xb6, 0xfc, 0x9a, 0x47, 0x68, 0x1e, 0x42, 0x70, 0x64, 0x2a, 0x84, 0x3e, 0x3d, 0x20, 0x58, 0xf9, 0x6a},
+		subYX: fp.Elt{0xd9, 0xee, 0xc0, 0xc4, 0xf5, 0xc2, 0x86, 0xaf, 0x45, 0xd2, 0xd2, 0x87, 0x1b, 0x64, 0xd5, 0xe0, 0x8c, 0x44, 0x00, 0x4f, 0x43, 0x89, 0x04, 0x48, 0x4a, 0x0b, 0xca, 0x94, 0x06, 0x2f, 0x23, 0x5b, 0x6c, 0x8d, 0x44, 0x66, 0x53, 0xf5, 0x5a, 0x20, 0x72, 0x28, 0x58, 0x84, 0xcc, 0x73, 0x22, 0x5e, 0xd1, 0x0b, 0x56, 0x5e, 0x6a, 0xa3, 0x11, 0x91},
+		dt2:   fp.Elt{0x6e, 0x9f, 0x88, 0xa8, 0x68, 0x2f, 0x12, 0x37, 0x88, 0xfc, 0x92, 0x8f, 0x24, 0xeb, 0x5b, 0x2a, 0x2a, 0xd0, 0x14, 0x40, 0x4c, 0xa9, 0xa4, 0x03, 0x0c, 0x45, 0x48, 0x13, 0xe8, 0xa6, 0x37, 0xab, 0xc0, 0x06, 0x38, 0x6c, 0x96, 0x73, 0x40, 0x6c, 0xc6, 0xea, 0x56, 0xc6, 0xe9, 0x1a, 0x69, 0xeb, 0x7a, 0xd1, 0x33, 0x69, 0x58, 0x2b, 0xea, 0x2f},
+	},
+	{ /* 49P*/
+		addYX: fp.Elt{0x58, 0xa8, 0x05, 0x41, 0x00, 0x9d, 0xaa, 0xd9, 0x98, 0xcf, 0xb9, 0x41, 0xb5, 0x4a, 0x8d, 0xe2, 0xe7, 0xc0, 0x72, 0xef, 0xc8, 0x28, 0x6b, 0x68, 0x9d, 0xc9, 0xdf, 0x05, 0x8b, 0xd0, 0x04, 0x74, 0x79, 0x45, 0x52, 0x05, 0xa3, 0x6e, 0x35, 0x3a, 0xe3, 0xef, 0xb2, 0xdc, 0x08, 0x6f, 0x4e, 0x76, 0x85, 0x67, 0xba, 0x23, 0x8f, 0xdd, 0xaf, 0x09},
+		subYX: fp.Elt{0xb4, 0x38, 0xc8, 0xff, 0x4f, 0x65, 0x2a, 0x7e, 0xad, 0xb1, 0xc6, 0xb9, 0x3d, 0xd6, 0xf7, 0x14, 0xcf, 0xf6, 0x98, 0x75, 0xbb, 0x47, 0x83, 0x90, 0xe7, 0xe1, 0xf6, 0x14, 0x99, 0x7e, 0xfa, 0xe4, 0x77, 0x24, 0xe3, 0xe7, 0xf0, 0x1e, 0xdb, 0x27, 0x4e, 0x16, 0x04, 0xf2, 0x08, 0x52, 0xfc, 0xec, 0x55, 0xdb, 0x2e, 0x67, 0xe1, 0x94, 0x32, 0x89},
+		dt2:   fp.Elt{0x00, 0xad, 0x03, 0x35, 0x1a, 0xb1, 0x88, 0xf0, 0xc9, 0x11, 0xe4, 0x12, 0x52, 0x61, 0xfd, 0x8a, 0x1b, 0x6a, 0x0a, 0x4c, 0x42, 0x46, 0x22, 0x0e, 0xa5, 0xf9, 0xe2, 0x50, 0xf2, 0xb2, 0x1f, 0x20, 0x78, 0x10, 0xf6, 0xbf, 0x7f, 0x0c, 0x9c, 0xad, 0x40, 0x8b, 0x82, 0xd4, 0xba, 0x69, 0x09, 0xac, 0x4b, 0x6d, 0xc4, 0x49, 0x17, 0x81, 0x57, 0x3b},
+	},
+	{ /* 51P*/
+		addYX: fp.Elt{0x0d, 0xfe, 0xb4, 0x35, 0x11, 0xbd, 0x1d, 0x6b, 0xc2, 0xc5, 0x3b, 0xd2, 0x23, 0x2c, 0x72, 0xe3, 0x48, 0xb1, 0x48, 0x73, 0xfb, 0xa3, 0x21, 0x6e, 0xc0, 0x09, 0x69, 0xac, 0xe1, 0x60, 0xbc, 0x24, 0x03, 0x99, 0x63, 0x0a, 0x00, 0xf0, 0x75, 0xf6, 0x92, 0xc5, 0xd6, 0xdb, 0x51, 0xd4, 0x7d, 0xe6, 0xf4, 0x11, 0x79, 0xd7, 0xc3, 0xaf, 0x48, 0xd0},
+		subYX: fp.Elt{0xf4, 0x4f, 0xaf, 0x31, 0xe3, 0x10, 0x89, 0x95, 0xf0, 0x8a, 0xf6, 0x31, 0x9f, 0x48, 0x02, 0xba, 0x42, 0x2b, 0x3c, 0x22, 0x8b, 0xcc, 0x12, 0x98, 0x6e, 0x7a, 0x64, 0x3a, 0xc4, 0xca, 0x32, 0x2a, 0x72, 0xf8, 0x2c, 0xcf, 0x78, 0x5e, 0x7a, 0x75, 0x6e, 0x72, 0x46, 0x48, 0x62, 0x28, 0xac, 0x58, 0x1a, 0xc6, 0x59, 0x88, 0x2a, 0x44, 0x9e, 0x83},
+		dt2:   fp.Elt{0xb3, 0xde, 0x36, 0xfd, 0xeb, 0x1b, 0xd4, 0x24, 0x1b, 0x08, 0x8c, 0xfe, 0xa9, 0x41, 0xa1, 0x64, 0xf2, 0x6d, 0xdb, 0xf9, 0x94, 0xae, 0x86, 0x71, 0xab, 0x10, 0xbf, 0xa3, 0xb2, 0xa0, 0xdf, 0x10, 0x8c, 0x74, 0xce, 0xb3, 0xfc, 0xdb, 0xba, 0x15, 0xf6, 0x91, 0x7a, 0x9c, 0x36, 0x1e, 0x45, 0x07, 0x3c, 0xec, 0x1a, 0x61, 0x26, 0x93, 0xe3, 0x50},
+	},
+	{ /* 53P*/
+		addYX: fp.Elt{0xc5, 0x50, 0xc5, 0x83, 0xb0, 0xbd, 0xd9, 0xf6, 0x6d, 0x15, 0x5e, 0xc1, 0x1a, 0x33, 0xa0, 0xce, 0x13, 0x70, 0x3b, 0xe1, 0x31, 0xc6, 0xc4, 0x02, 0xec, 0x8c, 0xd5, 0x9c, 0x97, 0xd3, 0x12, 0xc4, 0xa2, 0xf9, 0xd5, 0xfb, 0x22, 0x69, 0x94, 0x09, 0x2f, 0x59, 0xce, 0xdb, 0xf2, 0xf2, 0x00, 0xe0, 0xa9, 0x08, 0x44, 0x2e, 0x8b, 0x6b, 0xf5, 0xb3},
+		subYX: fp.Elt{0x90, 0xdd, 0xec, 0xa2, 0x65, 0xb7, 0x61, 0xbc, 0xaa, 0x70, 0xa2, 0x15, 0xd8, 0xb0, 0xf8, 0x8e, 0x23, 0x3d, 0x9f, 0x46, 0xa3, 0x29, 0x20, 0xd1, 0xa1, 0x15, 0x81, 0xc6, 0xb6, 0xde, 0xbe, 0x60, 0x63, 0x24, 0xac, 0x15, 0xfb, 0xeb, 0xd3, 0xea, 0x57, 0x13, 0x86, 0x38, 0x1e, 0x22, 0xf4, 0x8c, 0x5d, 0xaf, 0x1b, 0x27, 0x21, 0x4f, 0xa3, 0x63},
+		dt2:   fp.Elt{0x07, 0x15, 0x87, 0xc4, 0xfd, 0xa1, 0x97, 0x7a, 0x07, 0x1f, 0x56, 0xcc, 0xe3, 0x6a, 0x01, 0x90, 0xce, 0xf9, 0xfa, 0x50, 0xb2, 0xe0, 0x87, 0x8b, 0x6c, 0x63, 0x6c, 0xf6, 0x2a, 0x09, 0xef, 0xef, 0xd2, 0x31, 0x40, 0x25, 0xf6, 0x84, 0xcb, 0xe0, 0xc4, 0x23, 0xc1, 0xcb, 0xe2, 0x02, 0x83, 0x2d, 0xed, 0x74, 0x74, 0x8b, 0xf8, 0x7c, 0x81, 0x18},
+	},
+	{ /* 55P*/
+		addYX: fp.Elt{0x9e, 0xe5, 0x59, 0x95, 0x63, 0x2e, 0xac, 0x8b, 0x03, 0x3c, 0xc1, 0x8e, 0xe1, 0x5b, 0x56, 0x3c, 0x16, 0x41, 0xe4, 0xc2, 0x60, 0x0c, 0x6d, 0x65, 0x9f, 0xfc, 0x27, 0x68, 0x43, 0x44, 0x05, 0x12, 0x6c, 0xda, 0x04, 0xef, 0xcf, 0xcf, 0xdc, 0x0a, 0x1a, 0x7f, 0x12, 0xd3, 0xeb, 0x02, 0xb6, 0x04, 0xca, 0xd6, 0xcb, 0xf0, 0x22, 0xba, 0x35, 0x6d},
+		subYX: fp.Elt{0x09, 0x6d, 0xf9, 0x64, 0x4c, 0xe6, 0x41, 0xff, 0x01, 0x4d, 0xce, 0x1e, 0xfa, 0x38, 0xa2, 0x25, 0x62, 0xff, 0x03, 0x39, 0x18, 0x91, 0xbb, 0x9d, 0xce, 0x02, 0xf0, 0xf1, 0x3c, 0x55, 0x18, 0xa9, 0xab, 0x4d, 0xd2, 0x35, 0xfd, 0x8d, 0xa9, 0xb2, 0xad, 0xb7, 0x06, 0x6e, 0xc6, 0x69, 0x49, 0xd6, 0x98, 0x98, 0x0b, 0x22, 0x81, 0x6b, 0xbd, 0xa0},
+		dt2:   fp.Elt{0x22, 0xf4, 0x85, 0x5d, 0x2b, 0xf1, 0x55, 0xa5, 0xd6, 0x27, 0x86, 0x57, 0x12, 0x1f, 0x16, 0x0a, 0x5a, 0x9b, 0xf2, 0x38, 0xb6, 0x28, 0xd8, 0x99, 0x0c, 0x89, 0x1d, 0x7f, 0xca, 0x21, 0x17, 0x1a, 0x0b, 0x02, 0x5f, 0x77, 0x2f, 0x73, 0x30, 0x7c, 0xc8, 0xd7, 0x2b, 0xcc, 0xe7, 0xf3, 0x21, 0xac, 0x53, 0xa7, 0x11, 0x5d, 0xd8, 0x1d, 0x9b, 0xf5},
+	},
+	{ /* 57P*/
+		addYX: fp.Elt{0x94, 0x63, 0x5d, 0xef, 0xfd, 0x6d, 0x25, 0x4e, 0x6d, 0x29, 0x03, 0xed, 0x24, 0x28, 0x27, 0x57, 0x47, 0x3e, 0x6a, 0x1a, 0xfe, 0x37, 0xee, 0x5f, 0x83, 0x29, 0x14, 0xfd, 0x78, 0x25, 0x8a, 0xe1, 0x02, 0x38, 0xd8, 0xca, 0x65, 0x55, 0x40, 0x7d, 0x48, 0x2c, 0x7c, 0x7e, 0x60, 0xb6, 0x0c, 0x6d, 0xf7, 0xe8, 0xb3, 0x62, 0x53, 0xd6, 0x9c, 0x2b},
+		subYX: fp.Elt{0x47, 0x25, 0x70, 0x62, 0xf5, 0x65, 0x93, 0x62, 0x08, 0xac, 0x59, 0x66, 0xdb, 0x08, 0xd9, 0x1a, 0x19, 0xaf, 0xf4, 0xef, 0x02, 0xa2, 0x78, 0xa9, 0x55, 0x1c, 0xfa, 0x08, 0x11, 0xcb, 0xa3, 0x71, 0x74, 0xb1, 0x62, 0xe7, 0xc7, 0xf3, 0x5a, 0xb5, 0x8b, 0xd4, 0xf6, 0x10, 0x57, 0x79, 0x72, 0x2f, 0x13, 0x86, 0x7b, 0x44, 0x5f, 0x48, 0xfd, 0x88},
+		dt2:   fp.Elt{0x10, 0x02, 0xcd, 0x05, 0x9a, 0xc3, 0x32, 0x6d, 0x10, 0x3a, 0x74, 0xba, 0x06, 0xc4, 0x3b, 0x34, 0xbc, 0x36, 0xed, 0xa3, 0xba, 0x9a, 0xdb, 0x6d, 0xd4, 0x69, 0x99, 0x97, 0xd0, 0xe4, 0xdd, 0xf5, 0xd4, 0x7c, 0xd3, 0x4e, 0xab, 0xd1, 0x3b, 0xbb, 0xe9, 0xc7, 0x6a, 0x94, 0x25, 0x61, 0xf0, 0x06, 0xc5, 0x12, 0xa8, 0x86, 0xe5, 0x35, 0x46, 0xeb},
+	},
+	{ /* 59P*/
+		addYX: fp.Elt{0x9e, 0x95, 0x11, 0xc6, 0xc7, 0xe8, 0xee, 0x5a, 0x26, 0xa0, 0x72, 0x72, 0x59, 0x91, 0x59, 0x16, 0x49, 0x99, 0x7e, 0xbb, 0xd7, 0x15, 0xb4, 0xf2, 0x40, 0xf9, 0x5a, 0x4d, 0xc8, 0xa0, 0xe2, 0x34, 0x7b, 0x34, 0xf3, 0x99, 0xbf, 0xa9, 0xf3, 0x79, 0xc1, 0x1a, 0x0c, 0xf4, 0x86, 0x74, 0x4e, 0xcb, 0xbc, 0x90, 0xad, 0xb6, 0x51, 0x6d, 0xaa, 0x33},
+		subYX: fp.Elt{0x9f, 0xd1, 0xc5, 0xa2, 0x6c, 0x24, 0x88, 0x15, 0x71, 0x68, 0xf6, 0x07, 0x45, 0x02, 0xc4, 0x73, 0x7e, 0x75, 0x87, 0xca, 0x7c, 0xf0, 0x92, 0x00, 0x75, 0xd6, 0x5a, 0xdd, 0xe0, 0x64, 0x16, 0x9d, 0x62, 0x80, 0x33, 0x9f, 0xf4, 0x8e, 0x1a, 0x15, 0x1c, 0xd3, 0x0f, 0x4d, 0x4f, 0x62, 0x2d, 0xd7, 0xa5, 0x77, 0xe3, 0xea, 0xf0, 0xfb, 0x1a, 0xdb},
+		dt2:   fp.Elt{0x6a, 0xa2, 0xb1, 0xaa, 0xfb, 0x5a, 0x32, 0x4e, 0xff, 0x47, 0x06, 0xd5, 0x9a, 0x4f, 0xce, 0x83, 0x5b, 0x82, 0x34, 0x3e, 0x47, 0xb8, 0xf8, 0xe9, 0x7c, 0x67, 0x69, 0x8d, 0x9c, 0xb7, 0xde, 0x57, 0xf4, 0x88, 0x41, 0x56, 0x0c, 0x87, 0x1e, 0xc9, 0x2f, 0x54, 0xbf, 0x5c, 0x68, 0x2c, 0xd9, 0xc4, 0xef, 0x53, 0x73, 0x1e, 0xa6, 0x38, 0x02, 0x10},
+	},
+	{ /* 61P*/
+		addYX: fp.Elt{0x08, 0x80, 0x4a, 0xc9, 0xb7, 0xa8, 0x88, 0xd9, 0xfc, 0x6a, 0xc0, 0x3e, 0xc2, 0x33, 0x4d, 0x2b, 0x2a, 0xa3, 0x6d, 0x72, 0x3e, 0xdc, 0x34, 0x68, 0x08, 0xbf, 0x27, 0xef, 0xf4, 0xff, 0xe2, 0x0c, 0x31, 0x0c, 0xa2, 0x0a, 0x1f, 0x65, 0xc1, 0x4c, 0x61, 0xd3, 0x1b, 0xbc, 0x25, 0xb1, 0xd0, 0xd4, 0x89, 0xb2, 0x53, 0xfb, 0x43, 0xa5, 0xaf, 0x04},
+		subYX: fp.Elt{0xe3, 0xe1, 0x37, 0xad, 0x58, 0xa9, 0x55, 0x81, 0xee, 0x64, 0x21, 0xb9, 0xf5, 0x4c, 0x35, 0xea, 0x4a, 0xd3, 0x26, 0xaa, 0x90, 0xd4, 0x60, 0x46, 0x09, 0x4b, 0x4a, 0x62, 0xf9, 0xcd, 0xe1, 0xee, 0xbb, 0xc2, 0x09, 0x0b, 0xb0, 0x96, 0x8e, 0x43, 0x77, 0xaf, 0x25, 0x20, 0x5e, 0x47, 0xe4, 0x1d, 0x50, 0x69, 0x74, 0x08, 0xd7, 0xb9, 0x90, 0x13},
+		dt2:   fp.Elt{0x51, 0x91, 0x95, 0x64, 0x03, 0x16, 0xfd, 0x6e, 0x26, 0x94, 0x6b, 0x61, 0xe7, 0xd9, 0xe0, 0x4a, 0x6d, 0x7c, 0xfa, 0xc0, 0xe2, 0x43, 0x23, 0x53, 0x70, 0xf5, 0x6f, 0x73, 0x8b, 0x81, 0xb0, 0x0c, 0xee, 0x2e, 0x46, 0xf2, 0x8d, 0xa6, 0xfb, 0xb5, 0x1c, 0x33, 0xbf, 0x90, 0x59, 0xc9, 0x7c, 0xb8, 0x6f, 0xad, 0x75, 0x02, 0x90, 0x8e, 0x59, 0x75},
+	},
+	{ /* 63P*/
+		addYX: fp.Elt{0x36, 0x4d, 0x77, 0x04, 0xb8, 0x7d, 0x4a, 0xd1, 0xc5, 0xbb, 0x7b, 0x50, 0x5f, 0x8d, 0x9d, 0x62, 0x0f, 0x66, 0x71, 0xec, 0x87, 0xc5, 0x80, 0x82, 0xc8, 0xf4, 0x6a, 0x94, 0x92, 0x5b, 0xb0, 0x16, 0x9b, 0xb2, 0xc9, 0x6f, 0x2b, 0x2d, 0xee, 0x95, 0x73, 0x2e, 0xc2, 0x1b, 0xc5, 0x55, 0x36, 0x86, 0x24, 0xf8, 0x20, 0x05, 0x0d, 0x93, 0xd7, 0x76},
+		subYX: fp.Elt{0x7f, 0x01, 0xeb, 0x2e, 0x48, 0x4d, 0x1d, 0xf1, 0x06, 0x7e, 0x7c, 0x2a, 0x43, 0xbf, 0x28, 0xac, 0xe9, 0x58, 0x13, 0xc8, 0xbf, 0x8e, 0xc0, 0xef, 0xe8, 0x4f, 0x46, 0x8a, 0xe7, 0xc0, 0xf6, 0x0f, 0x0a, 0x03, 0x48, 0x91, 0x55, 0x39, 0x2a, 0xe3, 0xdc, 0xf6, 0x22, 0x9d, 0x4d, 0x71, 0x55, 0x68, 0x25, 0x6e, 0x95, 0x52, 0xee, 0x4c, 0xd9, 0x01},
+		dt2:   fp.Elt{0xac, 0x33, 0x3f, 0x7c, 0x27, 0x35, 0x15, 0x91, 0x33, 0x8d, 0xf9, 0xc4, 0xf4, 0xf3, 0x90, 0x09, 0x75, 0x69, 0x62, 0x9f, 0x61, 0x35, 0x83, 0x92, 0x04, 0xef, 0x96, 0x38, 0x80, 0x9e, 0x88, 0xb3, 0x67, 0x95, 0xbe, 0x79, 0x3c, 0x35, 0xd8, 0xdc, 0xb2, 0x3e, 0x2d, 0xe6, 0x46, 0xbe, 0x81, 0xf3, 0x32, 0x0e, 0x37, 0x23, 0x75, 0x2a, 0x3d, 0xa0},
+	},
+}
diff --git a/.ci/providerlint/vendor/github.com/cloudflare/circl/ecc/goldilocks/twist_basemult.go b/.ci/providerlint/vendor/github.com/cloudflare/circl/ecc/goldilocks/twist_basemult.go
new file mode 100644
index 00000000000..f6ac5edbbbc
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/cloudflare/circl/ecc/goldilocks/twist_basemult.go
@@ -0,0 +1,62 @@
+package goldilocks
+
+import (
+	"crypto/subtle"
+
+	mlsb "github.com/cloudflare/circl/math/mlsbset"
+)
+
+const (
+	// MLSBRecoding parameters
+	fxT   = 448
+	fxV   = 2
+	fxW   = 3
+	fx2w1 = 1 << (uint(fxW) - 1)
+)
+
+// ScalarBaseMult returns kG where G is the generator point.
+func (e twistCurve) ScalarBaseMult(k *Scalar) *twistPoint {
+	m, err := mlsb.New(fxT, fxV, fxW)
+	if err != nil {
+		panic(err)
+	}
+	if m.IsExtended() {
+		panic("not extended")
+	}
+
+	var isZero int
+	if k.IsZero() {
+		isZero = 1
+	}
+	subtle.ConstantTimeCopy(isZero, k[:], order[:])
+
+	minusK := *k
+	isEven := 1 - int(k[0]&0x1)
+	minusK.Neg()
+	subtle.ConstantTimeCopy(isEven, k[:], minusK[:])
+	c, err := m.Encode(k[:])
+	if err != nil {
+		panic(err)
+	}
+
+	gP := c.Exp(groupMLSB{})
+	P := gP.(*twistPoint)
+	P.cneg(uint(isEven))
+	return P
+}
+
+type groupMLSB struct{}
+
+func (e groupMLSB) ExtendedEltP() mlsb.EltP      { return nil }
+func (e groupMLSB) Sqr(x mlsb.EltG)              { x.(*twistPoint).Double() }
+func (e groupMLSB) Mul(x mlsb.EltG, y mlsb.EltP) { x.(*twistPoint).mixAddZ1(y.(*preTwistPointAffine)) }
+func (e groupMLSB) Identity() mlsb.EltG          { return twistCurve{}.Identity() }
+func (e groupMLSB) NewEltP() mlsb.EltP           { return &preTwistPointAffine{} }
+func (e groupMLSB) Lookup(a mlsb.EltP, v uint, s, u int32) {
+	Tabj := &tabFixMult[v]
+	P := a.(*preTwistPointAffine)
+	for k := range Tabj {
+		P.cmov(&Tabj[k], uint(subtle.ConstantTimeEq(int32(k), u)))
+	}
+	P.cneg(int(s >> 31))
+}
diff --git a/.ci/providerlint/vendor/github.com/cloudflare/circl/internal/conv/conv.go b/.ci/providerlint/vendor/github.com/cloudflare/circl/internal/conv/conv.go
new file mode 100644
index 00000000000..649a8e931d6
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/cloudflare/circl/internal/conv/conv.go
@@ -0,0 +1,140 @@
+package conv
+
+import (
+	"encoding/binary"
+	"fmt"
+	"math/big"
+	"strings"
+)
+
+// BytesLe2Hex returns an hexadecimal string of a number stored in a
+// little-endian order slice x.
+func BytesLe2Hex(x []byte) string {
+	b := &strings.Builder{}
+	b.Grow(2*len(x) + 2)
+	fmt.Fprint(b, "0x")
+	if len(x) == 0 {
+		fmt.Fprint(b, "00")
+	}
+	for i := len(x) - 1; i >= 0; i-- {
+		fmt.Fprintf(b, "%02x", x[i])
+	}
+	return b.String()
+}
+
+// BytesLe2BigInt converts a little-endian slice x into a big-endian
+// math/big.Int.
+func BytesLe2BigInt(x []byte) *big.Int {
+	n := len(x)
+	b := new(big.Int)
+	if len(x) > 0 {
+		y := make([]byte, n)
+		for i := 0; i < n; i++ {
+			y[n-1-i] = x[i]
+		}
+		b.SetBytes(y)
+	}
+	return b
+}
+
+// BytesBe2Uint64Le converts a big-endian slice x to a little-endian slice of uint64.
+func BytesBe2Uint64Le(x []byte) []uint64 {
+	l := len(x)
+	z := make([]uint64, (l+7)/8)
+	blocks := l / 8
+	for i := 0; i < blocks; i++ {
+		z[i] = binary.BigEndian.Uint64(x[l-8*(i+1):])
+	}
+	remBytes := l % 8
+	for i := 0; i < remBytes; i++ {
+		z[blocks] |= uint64(x[l-1-8*blocks-i]) << uint(8*i)
+	}
+	return z
+}
+
+// BigInt2BytesLe stores a positive big.Int number x into a little-endian slice z.
+// The slice is modified if the bitlength of x <= 8*len(z) (padding with zeros).
+// If x does not fit in the slice or is negative, z is not modified.
+func BigInt2BytesLe(z []byte, x *big.Int) {
+	xLen := (x.BitLen() + 7) >> 3
+	zLen := len(z)
+	if zLen >= xLen && x.Sign() >= 0 {
+		y := x.Bytes()
+		for i := 0; i < xLen; i++ {
+			z[i] = y[xLen-1-i]
+		}
+		for i := xLen; i < zLen; i++ {
+			z[i] = 0
+		}
+	}
+}
+
+// Uint64Le2BigInt converts a little-endian slice x into a big number.
+func Uint64Le2BigInt(x []uint64) *big.Int {
+	n := len(x)
+	b := new(big.Int)
+	var bi big.Int
+	for i := n - 1; i >= 0; i-- {
+		bi.SetUint64(x[i])
+		b.Lsh(b, 64)
+		b.Add(b, &bi)
+	}
+	return b
+}
+
+// Uint64Le2BytesLe converts a little-endian slice x to a little-endian slice of bytes.
+func Uint64Le2BytesLe(x []uint64) []byte {
+	b := make([]byte, 8*len(x))
+	n := len(x)
+	for i := 0; i < n; i++ {
+		binary.LittleEndian.PutUint64(b[i*8:], x[i])
+	}
+	return b
+}
+
+// Uint64Le2BytesBe converts a little-endian slice x to a big-endian slice of bytes.
+func Uint64Le2BytesBe(x []uint64) []byte {
+	b := make([]byte, 8*len(x))
+	n := len(x)
+	for i := 0; i < n; i++ {
+		binary.BigEndian.PutUint64(b[i*8:], x[n-1-i])
+	}
+	return b
+}
+
+// Uint64Le2Hex returns an hexadecimal string of a number stored in a
+// little-endian order slice x.
+func Uint64Le2Hex(x []uint64) string {
+	b := new(strings.Builder)
+	b.Grow(16*len(x) + 2)
+	fmt.Fprint(b, "0x")
+	if len(x) == 0 {
+		fmt.Fprint(b, "00")
+	}
+	for i := len(x) - 1; i >= 0; i-- {
+		fmt.Fprintf(b, "%016x", x[i])
+	}
+	return b.String()
+}
+
+// BigInt2Uint64Le stores a positive big.Int number x into a little-endian slice z.
+// The slice is modified if the bitlength of x <= 8*len(z) (padding with zeros).
+// If x does not fit in the slice or is negative, z is not modified.
+func BigInt2Uint64Le(z []uint64, x *big.Int) {
+	xLen := (x.BitLen() + 63) >> 6 // number of 64-bit words
+	zLen := len(z)
+	if zLen >= xLen && x.Sign() > 0 {
+		var y, yi big.Int
+		y.Set(x)
+		two64 := big.NewInt(1)
+		two64.Lsh(two64, 64).Sub(two64, big.NewInt(1))
+		for i := 0; i < xLen; i++ {
+			yi.And(&y, two64)
+			z[i] = yi.Uint64()
+			y.Rsh(&y, 64)
+		}
+	}
+	for i := xLen; i < zLen; i++ {
+		z[i] = 0
+	}
+}
diff --git a/.ci/providerlint/vendor/github.com/cloudflare/circl/internal/sha3/doc.go b/.ci/providerlint/vendor/github.com/cloudflare/circl/internal/sha3/doc.go
new file mode 100644
index 00000000000..7e023090707
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/cloudflare/circl/internal/sha3/doc.go
@@ -0,0 +1,62 @@
+// Copyright 2014 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// Package sha3 implements the SHA-3 fixed-output-length hash functions and
+// the SHAKE variable-output-length hash functions defined by FIPS-202.
+//
+// Both types of hash function use the "sponge" construction and the Keccak
+// permutation. For a detailed specification see http://keccak.noekeon.org/
+//
+// # Guidance
+//
+// If you aren't sure what function you need, use SHAKE256 with at least 64
+// bytes of output. The SHAKE instances are faster than the SHA3 instances;
+// the latter have to allocate memory to conform to the hash.Hash interface.
+//
+// If you need a secret-key MAC (message authentication code), prepend the
+// secret key to the input, hash with SHAKE256 and read at least 32 bytes of
+// output.
+//
+// # Security strengths
+//
+// The SHA3-x (x equals 224, 256, 384, or 512) functions have a security
+// strength against preimage attacks of x bits. Since they only produce "x"
+// bits of output, their collision-resistance is only "x/2" bits.
+//
+// The SHAKE-256 and -128 functions have a generic security strength of 256 and
+// 128 bits against all attacks, provided that at least 2x bits of their output
+// is used.  Requesting more than 64 or 32 bytes of output, respectively, does
+// not increase the collision-resistance of the SHAKE functions.
+//
+// # The sponge construction
+//
+// A sponge builds a pseudo-random function from a public pseudo-random
+// permutation, by applying the permutation to a state of "rate + capacity"
+// bytes, but hiding "capacity" of the bytes.
+//
+// A sponge starts out with a zero state. To hash an input using a sponge, up
+// to "rate" bytes of the input are XORed into the sponge's state. The sponge
+// is then "full" and the permutation is applied to "empty" it. This process is
+// repeated until all the input has been "absorbed". The input is then padded.
+// The digest is "squeezed" from the sponge in the same way, except that output
+// is copied out instead of input being XORed in.
+//
+// A sponge is parameterized by its generic security strength, which is equal
+// to half its capacity; capacity + rate is equal to the permutation's width.
+// Since the KeccakF-1600 permutation is 1600 bits (200 bytes) wide, this means
+// that the security strength of a sponge instance is equal to (1600 - bitrate) / 2.
+//
+// # Recommendations
+//
+// The SHAKE functions are recommended for most new uses. They can produce
+// output of arbitrary length. SHAKE256, with an output length of at least
+// 64 bytes, provides 256-bit security against all attacks.  The Keccak team
+// recommends it for most applications upgrading from SHA2-512. (NIST chose a
+// much stronger, but much slower, sponge instance for SHA3-512.)
+//
+// The SHA-3 functions are "drop-in" replacements for the SHA-2 functions.
+// They produce output of the same length, with the same security strengths
+// against all attacks. This means, in particular, that SHA3-256 only has
+// 128-bit collision resistance, because its output length is 32 bytes.
+package sha3
diff --git a/.ci/providerlint/vendor/github.com/cloudflare/circl/internal/sha3/hashes.go b/.ci/providerlint/vendor/github.com/cloudflare/circl/internal/sha3/hashes.go
new file mode 100644
index 00000000000..7d2365a76ed
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/cloudflare/circl/internal/sha3/hashes.go
@@ -0,0 +1,69 @@
+// Copyright 2014 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package sha3
+
+// This file provides functions for creating instances of the SHA-3
+// and SHAKE hash functions, as well as utility functions for hashing
+// bytes.
+
+// New224 creates a new SHA3-224 hash.
+// Its generic security strength is 224 bits against preimage attacks,
+// and 112 bits against collision attacks.
+func New224() State {
+	return State{rate: 144, outputLen: 28, dsbyte: 0x06}
+}
+
+// New256 creates a new SHA3-256 hash.
+// Its generic security strength is 256 bits against preimage attacks,
+// and 128 bits against collision attacks.
+func New256() State {
+	return State{rate: 136, outputLen: 32, dsbyte: 0x06}
+}
+
+// New384 creates a new SHA3-384 hash.
+// Its generic security strength is 384 bits against preimage attacks,
+// and 192 bits against collision attacks.
+func New384() State {
+	return State{rate: 104, outputLen: 48, dsbyte: 0x06}
+}
+
+// New512 creates a new SHA3-512 hash.
+// Its generic security strength is 512 bits against preimage attacks,
+// and 256 bits against collision attacks.
+func New512() State {
+	return State{rate: 72, outputLen: 64, dsbyte: 0x06}
+}
+
+// Sum224 returns the SHA3-224 digest of the data.
+func Sum224(data []byte) (digest [28]byte) {
+	h := New224()
+	_, _ = h.Write(data)
+	h.Sum(digest[:0])
+	return
+}
+
+// Sum256 returns the SHA3-256 digest of the data.
+func Sum256(data []byte) (digest [32]byte) {
+	h := New256()
+	_, _ = h.Write(data)
+	h.Sum(digest[:0])
+	return
+}
+
+// Sum384 returns the SHA3-384 digest of the data.
+func Sum384(data []byte) (digest [48]byte) {
+	h := New384()
+	_, _ = h.Write(data)
+	h.Sum(digest[:0])
+	return
+}
+
+// Sum512 returns the SHA3-512 digest of the data.
+func Sum512(data []byte) (digest [64]byte) {
+	h := New512()
+	_, _ = h.Write(data)
+	h.Sum(digest[:0])
+	return
+}
diff --git a/.ci/providerlint/vendor/github.com/cloudflare/circl/internal/sha3/keccakf.go b/.ci/providerlint/vendor/github.com/cloudflare/circl/internal/sha3/keccakf.go
new file mode 100644
index 00000000000..ab19d0ad124
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/cloudflare/circl/internal/sha3/keccakf.go
@@ -0,0 +1,383 @@
+// Copyright 2014 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package sha3
+
+// KeccakF1600 applies the Keccak permutation to a 1600b-wide
+// state represented as a slice of 25 uint64s.
+// nolint:funlen
+func KeccakF1600(a *[25]uint64) {
+	// Implementation translated from Keccak-inplace.c
+	// in the keccak reference code.
+	var t, bc0, bc1, bc2, bc3, bc4, d0, d1, d2, d3, d4 uint64
+
+	for i := 0; i < 24; i += 4 {
+		// Combines the 5 steps in each round into 2 steps.
+		// Unrolls 4 rounds per loop and spreads some steps across rounds.
+
+		// Round 1
+		bc0 = a[0] ^ a[5] ^ a[10] ^ a[15] ^ a[20]
+		bc1 = a[1] ^ a[6] ^ a[11] ^ a[16] ^ a[21]
+		bc2 = a[2] ^ a[7] ^ a[12] ^ a[17] ^ a[22]
+		bc3 = a[3] ^ a[8] ^ a[13] ^ a[18] ^ a[23]
+		bc4 = a[4] ^ a[9] ^ a[14] ^ a[19] ^ a[24]
+		d0 = bc4 ^ (bc1<<1 | bc1>>63)
+		d1 = bc0 ^ (bc2<<1 | bc2>>63)
+		d2 = bc1 ^ (bc3<<1 | bc3>>63)
+		d3 = bc2 ^ (bc4<<1 | bc4>>63)
+		d4 = bc3 ^ (bc0<<1 | bc0>>63)
+
+		bc0 = a[0] ^ d0
+		t = a[6] ^ d1
+		bc1 = t<<44 | t>>(64-44)
+		t = a[12] ^ d2
+		bc2 = t<<43 | t>>(64-43)
+		t = a[18] ^ d3
+		bc3 = t<<21 | t>>(64-21)
+		t = a[24] ^ d4
+		bc4 = t<<14 | t>>(64-14)
+		a[0] = bc0 ^ (bc2 &^ bc1) ^ RC[i]
+		a[6] = bc1 ^ (bc3 &^ bc2)
+		a[12] = bc2 ^ (bc4 &^ bc3)
+		a[18] = bc3 ^ (bc0 &^ bc4)
+		a[24] = bc4 ^ (bc1 &^ bc0)
+
+		t = a[10] ^ d0
+		bc2 = t<<3 | t>>(64-3)
+		t = a[16] ^ d1
+		bc3 = t<<45 | t>>(64-45)
+		t = a[22] ^ d2
+		bc4 = t<<61 | t>>(64-61)
+		t = a[3] ^ d3
+		bc0 = t<<28 | t>>(64-28)
+		t = a[9] ^ d4
+		bc1 = t<<20 | t>>(64-20)
+		a[10] = bc0 ^ (bc2 &^ bc1)
+		a[16] = bc1 ^ (bc3 &^ bc2)
+		a[22] = bc2 ^ (bc4 &^ bc3)
+		a[3] = bc3 ^ (bc0 &^ bc4)
+		a[9] = bc4 ^ (bc1 &^ bc0)
+
+		t = a[20] ^ d0
+		bc4 = t<<18 | t>>(64-18)
+		t = a[1] ^ d1
+		bc0 = t<<1 | t>>(64-1)
+		t = a[7] ^ d2
+		bc1 = t<<6 | t>>(64-6)
+		t = a[13] ^ d3
+		bc2 = t<<25 | t>>(64-25)
+		t = a[19] ^ d4
+		bc3 = t<<8 | t>>(64-8)
+		a[20] = bc0 ^ (bc2 &^ bc1)
+		a[1] = bc1 ^ (bc3 &^ bc2)
+		a[7] = bc2 ^ (bc4 &^ bc3)
+		a[13] = bc3 ^ (bc0 &^ bc4)
+		a[19] = bc4 ^ (bc1 &^ bc0)
+
+		t = a[5] ^ d0
+		bc1 = t<<36 | t>>(64-36)
+		t = a[11] ^ d1
+		bc2 = t<<10 | t>>(64-10)
+		t = a[17] ^ d2
+		bc3 = t<<15 | t>>(64-15)
+		t = a[23] ^ d3
+		bc4 = t<<56 | t>>(64-56)
+		t = a[4] ^ d4
+		bc0 = t<<27 | t>>(64-27)
+		a[5] = bc0 ^ (bc2 &^ bc1)
+		a[11] = bc1 ^ (bc3 &^ bc2)
+		a[17] = bc2 ^ (bc4 &^ bc3)
+		a[23] = bc3 ^ (bc0 &^ bc4)
+		a[4] = bc4 ^ (bc1 &^ bc0)
+
+		t = a[15] ^ d0
+		bc3 = t<<41 | t>>(64-41)
+		t = a[21] ^ d1
+		bc4 = t<<2 | t>>(64-2)
+		t = a[2] ^ d2
+		bc0 = t<<62 | t>>(64-62)
+		t = a[8] ^ d3
+		bc1 = t<<55 | t>>(64-55)
+		t = a[14] ^ d4
+		bc2 = t<<39 | t>>(64-39)
+		a[15] = bc0 ^ (bc2 &^ bc1)
+		a[21] = bc1 ^ (bc3 &^ bc2)
+		a[2] = bc2 ^ (bc4 &^ bc3)
+		a[8] = bc3 ^ (bc0 &^ bc4)
+		a[14] = bc4 ^ (bc1 &^ bc0)
+
+		// Round 2
+		bc0 = a[0] ^ a[5] ^ a[10] ^ a[15] ^ a[20]
+		bc1 = a[1] ^ a[6] ^ a[11] ^ a[16] ^ a[21]
+		bc2 = a[2] ^ a[7] ^ a[12] ^ a[17] ^ a[22]
+		bc3 = a[3] ^ a[8] ^ a[13] ^ a[18] ^ a[23]
+		bc4 = a[4] ^ a[9] ^ a[14] ^ a[19] ^ a[24]
+		d0 = bc4 ^ (bc1<<1 | bc1>>63)
+		d1 = bc0 ^ (bc2<<1 | bc2>>63)
+		d2 = bc1 ^ (bc3<<1 | bc3>>63)
+		d3 = bc2 ^ (bc4<<1 | bc4>>63)
+		d4 = bc3 ^ (bc0<<1 | bc0>>63)
+
+		bc0 = a[0] ^ d0
+		t = a[16] ^ d1
+		bc1 = t<<44 | t>>(64-44)
+		t = a[7] ^ d2
+		bc2 = t<<43 | t>>(64-43)
+		t = a[23] ^ d3
+		bc3 = t<<21 | t>>(64-21)
+		t = a[14] ^ d4
+		bc4 = t<<14 | t>>(64-14)
+		a[0] = bc0 ^ (bc2 &^ bc1) ^ RC[i+1]
+		a[16] = bc1 ^ (bc3 &^ bc2)
+		a[7] = bc2 ^ (bc4 &^ bc3)
+		a[23] = bc3 ^ (bc0 &^ bc4)
+		a[14] = bc4 ^ (bc1 &^ bc0)
+
+		t = a[20] ^ d0
+		bc2 = t<<3 | t>>(64-3)
+		t = a[11] ^ d1
+		bc3 = t<<45 | t>>(64-45)
+		t = a[2] ^ d2
+		bc4 = t<<61 | t>>(64-61)
+		t = a[18] ^ d3
+		bc0 = t<<28 | t>>(64-28)
+		t = a[9] ^ d4
+		bc1 = t<<20 | t>>(64-20)
+		a[20] = bc0 ^ (bc2 &^ bc1)
+		a[11] = bc1 ^ (bc3 &^ bc2)
+		a[2] = bc2 ^ (bc4 &^ bc3)
+		a[18] = bc3 ^ (bc0 &^ bc4)
+		a[9] = bc4 ^ (bc1 &^ bc0)
+
+		t = a[15] ^ d0
+		bc4 = t<<18 | t>>(64-18)
+		t = a[6] ^ d1
+		bc0 = t<<1 | t>>(64-1)
+		t = a[22] ^ d2
+		bc1 = t<<6 | t>>(64-6)
+		t = a[13] ^ d3
+		bc2 = t<<25 | t>>(64-25)
+		t = a[4] ^ d4
+		bc3 = t<<8 | t>>(64-8)
+		a[15] = bc0 ^ (bc2 &^ bc1)
+		a[6] = bc1 ^ (bc3 &^ bc2)
+		a[22] = bc2 ^ (bc4 &^ bc3)
+		a[13] = bc3 ^ (bc0 &^ bc4)
+		a[4] = bc4 ^ (bc1 &^ bc0)
+
+		t = a[10] ^ d0
+		bc1 = t<<36 | t>>(64-36)
+		t = a[1] ^ d1
+		bc2 = t<<10 | t>>(64-10)
+		t = a[17] ^ d2
+		bc3 = t<<15 | t>>(64-15)
+		t = a[8] ^ d3
+		bc4 = t<<56 | t>>(64-56)
+		t = a[24] ^ d4
+		bc0 = t<<27 | t>>(64-27)
+		a[10] = bc0 ^ (bc2 &^ bc1)
+		a[1] = bc1 ^ (bc3 &^ bc2)
+		a[17] = bc2 ^ (bc4 &^ bc3)
+		a[8] = bc3 ^ (bc0 &^ bc4)
+		a[24] = bc4 ^ (bc1 &^ bc0)
+
+		t = a[5] ^ d0
+		bc3 = t<<41 | t>>(64-41)
+		t = a[21] ^ d1
+		bc4 = t<<2 | t>>(64-2)
+		t = a[12] ^ d2
+		bc0 = t<<62 | t>>(64-62)
+		t = a[3] ^ d3
+		bc1 = t<<55 | t>>(64-55)
+		t = a[19] ^ d4
+		bc2 = t<<39 | t>>(64-39)
+		a[5] = bc0 ^ (bc2 &^ bc1)
+		a[21] = bc1 ^ (bc3 &^ bc2)
+		a[12] = bc2 ^ (bc4 &^ bc3)
+		a[3] = bc3 ^ (bc0 &^ bc4)
+		a[19] = bc4 ^ (bc1 &^ bc0)
+
+		// Round 3
+		bc0 = a[0] ^ a[5] ^ a[10] ^ a[15] ^ a[20]
+		bc1 = a[1] ^ a[6] ^ a[11] ^ a[16] ^ a[21]
+		bc2 = a[2] ^ a[7] ^ a[12] ^ a[17] ^ a[22]
+		bc3 = a[3] ^ a[8] ^ a[13] ^ a[18] ^ a[23]
+		bc4 = a[4] ^ a[9] ^ a[14] ^ a[19] ^ a[24]
+		d0 = bc4 ^ (bc1<<1 | bc1>>63)
+		d1 = bc0 ^ (bc2<<1 | bc2>>63)
+		d2 = bc1 ^ (bc3<<1 | bc3>>63)
+		d3 = bc2 ^ (bc4<<1 | bc4>>63)
+		d4 = bc3 ^ (bc0<<1 | bc0>>63)
+
+		bc0 = a[0] ^ d0
+		t = a[11] ^ d1
+		bc1 = t<<44 | t>>(64-44)
+		t = a[22] ^ d2
+		bc2 = t<<43 | t>>(64-43)
+		t = a[8] ^ d3
+		bc3 = t<<21 | t>>(64-21)
+		t = a[19] ^ d4
+		bc4 = t<<14 | t>>(64-14)
+		a[0] = bc0 ^ (bc2 &^ bc1) ^ RC[i+2]
+		a[11] = bc1 ^ (bc3 &^ bc2)
+		a[22] = bc2 ^ (bc4 &^ bc3)
+		a[8] = bc3 ^ (bc0 &^ bc4)
+		a[19] = bc4 ^ (bc1 &^ bc0)
+
+		t = a[15] ^ d0
+		bc2 = t<<3 | t>>(64-3)
+		t = a[1] ^ d1
+		bc3 = t<<45 | t>>(64-45)
+		t = a[12] ^ d2
+		bc4 = t<<61 | t>>(64-61)
+		t = a[23] ^ d3
+		bc0 = t<<28 | t>>(64-28)
+		t = a[9] ^ d4
+		bc1 = t<<20 | t>>(64-20)
+		a[15] = bc0 ^ (bc2 &^ bc1)
+		a[1] = bc1 ^ (bc3 &^ bc2)
+		a[12] = bc2 ^ (bc4 &^ bc3)
+		a[23] = bc3 ^ (bc0 &^ bc4)
+		a[9] = bc4 ^ (bc1 &^ bc0)
+
+		t = a[5] ^ d0
+		bc4 = t<<18 | t>>(64-18)
+		t = a[16] ^ d1
+		bc0 = t<<1 | t>>(64-1)
+		t = a[2] ^ d2
+		bc1 = t<<6 | t>>(64-6)
+		t = a[13] ^ d3
+		bc2 = t<<25 | t>>(64-25)
+		t = a[24] ^ d4
+		bc3 = t<<8 | t>>(64-8)
+		a[5] = bc0 ^ (bc2 &^ bc1)
+		a[16] = bc1 ^ (bc3 &^ bc2)
+		a[2] = bc2 ^ (bc4 &^ bc3)
+		a[13] = bc3 ^ (bc0 &^ bc4)
+		a[24] = bc4 ^ (bc1 &^ bc0)
+
+		t = a[20] ^ d0
+		bc1 = t<<36 | t>>(64-36)
+		t = a[6] ^ d1
+		bc2 = t<<10 | t>>(64-10)
+		t = a[17] ^ d2
+		bc3 = t<<15 | t>>(64-15)
+		t = a[3] ^ d3
+		bc4 = t<<56 | t>>(64-56)
+		t = a[14] ^ d4
+		bc0 = t<<27 | t>>(64-27)
+		a[20] = bc0 ^ (bc2 &^ bc1)
+		a[6] = bc1 ^ (bc3 &^ bc2)
+		a[17] = bc2 ^ (bc4 &^ bc3)
+		a[3] = bc3 ^ (bc0 &^ bc4)
+		a[14] = bc4 ^ (bc1 &^ bc0)
+
+		t = a[10] ^ d0
+		bc3 = t<<41 | t>>(64-41)
+		t = a[21] ^ d1
+		bc4 = t<<2 | t>>(64-2)
+		t = a[7] ^ d2
+		bc0 = t<<62 | t>>(64-62)
+		t = a[18] ^ d3
+		bc1 = t<<55 | t>>(64-55)
+		t = a[4] ^ d4
+		bc2 = t<<39 | t>>(64-39)
+		a[10] = bc0 ^ (bc2 &^ bc1)
+		a[21] = bc1 ^ (bc3 &^ bc2)
+		a[7] = bc2 ^ (bc4 &^ bc3)
+		a[18] = bc3 ^ (bc0 &^ bc4)
+		a[4] = bc4 ^ (bc1 &^ bc0)
+
+		// Round 4
+		bc0 = a[0] ^ a[5] ^ a[10] ^ a[15] ^ a[20]
+		bc1 = a[1] ^ a[6] ^ a[11] ^ a[16] ^ a[21]
+		bc2 = a[2] ^ a[7] ^ a[12] ^ a[17] ^ a[22]
+		bc3 = a[3] ^ a[8] ^ a[13] ^ a[18] ^ a[23]
+		bc4 = a[4] ^ a[9] ^ a[14] ^ a[19] ^ a[24]
+		d0 = bc4 ^ (bc1<<1 | bc1>>63)
+		d1 = bc0 ^ (bc2<<1 | bc2>>63)
+		d2 = bc1 ^ (bc3<<1 | bc3>>63)
+		d3 = bc2 ^ (bc4<<1 | bc4>>63)
+		d4 = bc3 ^ (bc0<<1 | bc0>>63)
+
+		bc0 = a[0] ^ d0
+		t = a[1] ^ d1
+		bc1 = t<<44 | t>>(64-44)
+		t = a[2] ^ d2
+		bc2 = t<<43 | t>>(64-43)
+		t = a[3] ^ d3
+		bc3 = t<<21 | t>>(64-21)
+		t = a[4] ^ d4
+		bc4 = t<<14 | t>>(64-14)
+		a[0] = bc0 ^ (bc2 &^ bc1) ^ RC[i+3]
+		a[1] = bc1 ^ (bc3 &^ bc2)
+		a[2] = bc2 ^ (bc4 &^ bc3)
+		a[3] = bc3 ^ (bc0 &^ bc4)
+		a[4] = bc4 ^ (bc1 &^ bc0)
+
+		t = a[5] ^ d0
+		bc2 = t<<3 | t>>(64-3)
+		t = a[6] ^ d1
+		bc3 = t<<45 | t>>(64-45)
+		t = a[7] ^ d2
+		bc4 = t<<61 | t>>(64-61)
+		t = a[8] ^ d3
+		bc0 = t<<28 | t>>(64-28)
+		t = a[9] ^ d4
+		bc1 = t<<20 | t>>(64-20)
+		a[5] = bc0 ^ (bc2 &^ bc1)
+		a[6] = bc1 ^ (bc3 &^ bc2)
+		a[7] = bc2 ^ (bc4 &^ bc3)
+		a[8] = bc3 ^ (bc0 &^ bc4)
+		a[9] = bc4 ^ (bc1 &^ bc0)
+
+		t = a[10] ^ d0
+		bc4 = t<<18 | t>>(64-18)
+		t = a[11] ^ d1
+		bc0 = t<<1 | t>>(64-1)
+		t = a[12] ^ d2
+		bc1 = t<<6 | t>>(64-6)
+		t = a[13] ^ d3
+		bc2 = t<<25 | t>>(64-25)
+		t = a[14] ^ d4
+		bc3 = t<<8 | t>>(64-8)
+		a[10] = bc0 ^ (bc2 &^ bc1)
+		a[11] = bc1 ^ (bc3 &^ bc2)
+		a[12] = bc2 ^ (bc4 &^ bc3)
+		a[13] = bc3 ^ (bc0 &^ bc4)
+		a[14] = bc4 ^ (bc1 &^ bc0)
+
+		t = a[15] ^ d0
+		bc1 = t<<36 | t>>(64-36)
+		t = a[16] ^ d1
+		bc2 = t<<10 | t>>(64-10)
+		t = a[17] ^ d2
+		bc3 = t<<15 | t>>(64-15)
+		t = a[18] ^ d3
+		bc4 = t<<56 | t>>(64-56)
+		t = a[19] ^ d4
+		bc0 = t<<27 | t>>(64-27)
+		a[15] = bc0 ^ (bc2 &^ bc1)
+		a[16] = bc1 ^ (bc3 &^ bc2)
+		a[17] = bc2 ^ (bc4 &^ bc3)
+		a[18] = bc3 ^ (bc0 &^ bc4)
+		a[19] = bc4 ^ (bc1 &^ bc0)
+
+		t = a[20] ^ d0
+		bc3 = t<<41 | t>>(64-41)
+		t = a[21] ^ d1
+		bc4 = t<<2 | t>>(64-2)
+		t = a[22] ^ d2
+		bc0 = t<<62 | t>>(64-62)
+		t = a[23] ^ d3
+		bc1 = t<<55 | t>>(64-55)
+		t = a[24] ^ d4
+		bc2 = t<<39 | t>>(64-39)
+		a[20] = bc0 ^ (bc2 &^ bc1)
+		a[21] = bc1 ^ (bc3 &^ bc2)
+		a[22] = bc2 ^ (bc4 &^ bc3)
+		a[23] = bc3 ^ (bc0 &^ bc4)
+		a[24] = bc4 ^ (bc1 &^ bc0)
+	}
+}
diff --git a/.ci/providerlint/vendor/github.com/cloudflare/circl/internal/sha3/rc.go b/.ci/providerlint/vendor/github.com/cloudflare/circl/internal/sha3/rc.go
new file mode 100644
index 00000000000..6a3df42f305
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/cloudflare/circl/internal/sha3/rc.go
@@ -0,0 +1,29 @@
+package sha3
+
+// RC stores the round constants for use in the ι step.
+var RC = [24]uint64{
+	0x0000000000000001,
+	0x0000000000008082,
+	0x800000000000808A,
+	0x8000000080008000,
+	0x000000000000808B,
+	0x0000000080000001,
+	0x8000000080008081,
+	0x8000000000008009,
+	0x000000000000008A,
+	0x0000000000000088,
+	0x0000000080008009,
+	0x000000008000000A,
+	0x000000008000808B,
+	0x800000000000008B,
+	0x8000000000008089,
+	0x8000000000008003,
+	0x8000000000008002,
+	0x8000000000000080,
+	0x000000000000800A,
+	0x800000008000000A,
+	0x8000000080008081,
+	0x8000000000008080,
+	0x0000000080000001,
+	0x8000000080008008,
+}
diff --git a/.ci/providerlint/vendor/github.com/cloudflare/circl/internal/sha3/sha3.go b/.ci/providerlint/vendor/github.com/cloudflare/circl/internal/sha3/sha3.go
new file mode 100644
index 00000000000..b35cd006b03
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/cloudflare/circl/internal/sha3/sha3.go
@@ -0,0 +1,195 @@
+// Copyright 2014 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package sha3
+
+// spongeDirection indicates the direction bytes are flowing through the sponge.
+type spongeDirection int
+
+const (
+	// spongeAbsorbing indicates that the sponge is absorbing input.
+	spongeAbsorbing spongeDirection = iota
+	// spongeSqueezing indicates that the sponge is being squeezed.
+	spongeSqueezing
+)
+
+const (
+	// maxRate is the maximum size of the internal buffer. SHAKE-256
+	// currently needs the largest buffer.
+	maxRate = 168
+)
+
+func (d *State) buf() []byte {
+	return d.storage.asBytes()[d.bufo:d.bufe]
+}
+
+type State struct {
+	// Generic sponge components.
+	a    [25]uint64 // main state of the hash
+	rate int        // the number of bytes of state to use
+
+	bufo int // offset of buffer in storage
+	bufe int // end of buffer in storage
+
+	// dsbyte contains the "domain separation" bits and the first bit of
+	// the padding. Sections 6.1 and 6.2 of [1] separate the outputs of the
+	// SHA-3 and SHAKE functions by appending bitstrings to the message.
+	// Using a little-endian bit-ordering convention, these are "01" for SHA-3
+	// and "1111" for SHAKE, or 00000010b and 00001111b, respectively. Then the
+	// padding rule from section 5.1 is applied to pad the message to a multiple
+	// of the rate, which involves adding a "1" bit, zero or more "0" bits, and
+	// a final "1" bit. We merge the first "1" bit from the padding into dsbyte,
+	// giving 00000110b (0x06) and 00011111b (0x1f).
+	// [1] http://csrc.nist.gov/publications/drafts/fips-202/fips_202_draft.pdf
+	//     "Draft FIPS 202: SHA-3 Standard: Permutation-Based Hash and
+	//      Extendable-Output Functions (May 2014)"
+	dsbyte byte
+
+	storage storageBuf
+
+	// Specific to SHA-3 and SHAKE.
+	outputLen int             // the default output size in bytes
+	state     spongeDirection // whether the sponge is absorbing or squeezing
+}
+
+// BlockSize returns the rate of sponge underlying this hash function.
+func (d *State) BlockSize() int { return d.rate }
+
+// Size returns the output size of the hash function in bytes.
+func (d *State) Size() int { return d.outputLen }
+
+// Reset clears the internal state by zeroing the sponge state and
+// the byte buffer, and setting Sponge.state to absorbing.
+func (d *State) Reset() {
+	// Zero the permutation's state.
+	for i := range d.a {
+		d.a[i] = 0
+	}
+	d.state = spongeAbsorbing
+	d.bufo = 0
+	d.bufe = 0
+}
+
+func (d *State) clone() *State {
+	ret := *d
+	return &ret
+}
+
+// permute applies the KeccakF-1600 permutation. It handles
+// any input-output buffering.
+func (d *State) permute() {
+	switch d.state {
+	case spongeAbsorbing:
+		// If we're absorbing, we need to xor the input into the state
+		// before applying the permutation.
+		xorIn(d, d.buf())
+		d.bufe = 0
+		d.bufo = 0
+		KeccakF1600(&d.a)
+	case spongeSqueezing:
+		// If we're squeezing, we need to apply the permutation before
+		// copying more output.
+		KeccakF1600(&d.a)
+		d.bufe = d.rate
+		d.bufo = 0
+		copyOut(d, d.buf())
+	}
+}
+
+// pads appends the domain separation bits in dsbyte, applies
+// the multi-bitrate 10..1 padding rule, and permutes the state.
+func (d *State) padAndPermute(dsbyte byte) {
+	// Pad with this instance's domain-separator bits. We know that there's
+	// at least one byte of space in d.buf() because, if it were full,
+	// permute would have been called to empty it. dsbyte also contains the
+	// first one bit for the padding. See the comment in the state struct.
+	zerosStart := d.bufe + 1
+	d.bufe = d.rate
+	buf := d.buf()
+	buf[zerosStart-1] = dsbyte
+	for i := zerosStart; i < d.rate; i++ {
+		buf[i] = 0
+	}
+	// This adds the final one bit for the padding. Because of the way that
+	// bits are numbered from the LSB upwards, the final bit is the MSB of
+	// the last byte.
+	buf[d.rate-1] ^= 0x80
+	// Apply the permutation
+	d.permute()
+	d.state = spongeSqueezing
+	d.bufe = d.rate
+	copyOut(d, buf)
+}
+
+// Write absorbs more data into the hash's state. It produces an error
+// if more data is written to the ShakeHash after writing
+func (d *State) Write(p []byte) (written int, err error) {
+	if d.state != spongeAbsorbing {
+		panic("sha3: write to sponge after read")
+	}
+	written = len(p)
+
+	for len(p) > 0 {
+		bufl := d.bufe - d.bufo
+		if bufl == 0 && len(p) >= d.rate {
+			// The fast path; absorb a full "rate" bytes of input and apply the permutation.
+			xorIn(d, p[:d.rate])
+			p = p[d.rate:]
+			KeccakF1600(&d.a)
+		} else {
+			// The slow path; buffer the input until we can fill the sponge, and then xor it in.
+			todo := d.rate - bufl
+			if todo > len(p) {
+				todo = len(p)
+			}
+			d.bufe += todo
+			buf := d.buf()
+			copy(buf[bufl:], p[:todo])
+			p = p[todo:]
+
+			// If the sponge is full, apply the permutation.
+			if d.bufe == d.rate {
+				d.permute()
+			}
+		}
+	}
+
+	return written, nil
+}
+
+// Read squeezes an arbitrary number of bytes from the sponge.
+func (d *State) Read(out []byte) (n int, err error) {
+	// If we're still absorbing, pad and apply the permutation.
+	if d.state == spongeAbsorbing {
+		d.padAndPermute(d.dsbyte)
+	}
+
+	n = len(out)
+
+	// Now, do the squeezing.
+	for len(out) > 0 {
+		buf := d.buf()
+		n := copy(out, buf)
+		d.bufo += n
+		out = out[n:]
+
+		// Apply the permutation if we've squeezed the sponge dry.
+		if d.bufo == d.bufe {
+			d.permute()
+		}
+	}
+
+	return
+}
+
+// Sum applies padding to the hash state and then squeezes out the desired
+// number of output bytes.
+func (d *State) Sum(in []byte) []byte {
+	// Make a copy of the original hash so that caller can keep writing
+	// and summing.
+	dup := d.clone()
+	hash := make([]byte, dup.outputLen)
+	_, _ = dup.Read(hash)
+	return append(in, hash...)
+}
diff --git a/.ci/providerlint/vendor/github.com/cloudflare/circl/internal/sha3/sha3_s390x.s b/.ci/providerlint/vendor/github.com/cloudflare/circl/internal/sha3/sha3_s390x.s
new file mode 100644
index 00000000000..8a4458f63f9
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/cloudflare/circl/internal/sha3/sha3_s390x.s
@@ -0,0 +1,33 @@
+// Copyright 2017 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// +build !gccgo,!appengine
+
+#include "textflag.h"
+
+// func kimd(function code, chain *[200]byte, src []byte)
+TEXT ·kimd(SB), NOFRAME|NOSPLIT, $0-40
+	MOVD function+0(FP), R0
+	MOVD chain+8(FP), R1
+	LMG  src+16(FP), R2, R3 // R2=base, R3=len
+
+continue:
+	WORD $0xB93E0002 // KIMD --, R2
+	BVS  continue    // continue if interrupted
+	MOVD $0, R0      // reset R0 for pre-go1.8 compilers
+	RET
+
+// func klmd(function code, chain *[200]byte, dst, src []byte)
+TEXT ·klmd(SB), NOFRAME|NOSPLIT, $0-64
+	// TODO: SHAKE support
+	MOVD function+0(FP), R0
+	MOVD chain+8(FP), R1
+	LMG  dst+16(FP), R2, R3 // R2=base, R3=len
+	LMG  src+40(FP), R4, R5 // R4=base, R5=len
+
+continue:
+	WORD $0xB93F0024 // KLMD R2, R4
+	BVS  continue    // continue if interrupted
+	MOVD $0, R0      // reset R0 for pre-go1.8 compilers
+	RET
diff --git a/.ci/providerlint/vendor/github.com/cloudflare/circl/internal/sha3/shake.go b/.ci/providerlint/vendor/github.com/cloudflare/circl/internal/sha3/shake.go
new file mode 100644
index 00000000000..b92c5b7d785
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/cloudflare/circl/internal/sha3/shake.go
@@ -0,0 +1,79 @@
+// Copyright 2014 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package sha3
+
+// This file defines the ShakeHash interface, and provides
+// functions for creating SHAKE and cSHAKE instances, as well as utility
+// functions for hashing bytes to arbitrary-length output.
+//
+//
+// SHAKE implementation is based on FIPS PUB 202 [1]
+// cSHAKE implementations is based on NIST SP 800-185 [2]
+//
+// [1] https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.202.pdf
+// [2] https://doi.org/10.6028/NIST.SP.800-185
+
+import (
+	"io"
+)
+
+// ShakeHash defines the interface to hash functions that
+// support arbitrary-length output.
+type ShakeHash interface {
+	// Write absorbs more data into the hash's state. It panics if input is
+	// written to it after output has been read from it.
+	io.Writer
+
+	// Read reads more output from the hash; reading affects the hash's
+	// state. (ShakeHash.Read is thus very different from Hash.Sum)
+	// It never returns an error.
+	io.Reader
+
+	// Clone returns a copy of the ShakeHash in its current state.
+	Clone() ShakeHash
+
+	// Reset resets the ShakeHash to its initial state.
+	Reset()
+}
+
+// Consts for configuring initial SHA-3 state
+const (
+	dsbyteShake = 0x1f
+	rate128     = 168
+	rate256     = 136
+)
+
+// Clone returns copy of SHAKE context within its current state.
+func (d *State) Clone() ShakeHash {
+	return d.clone()
+}
+
+// NewShake128 creates a new SHAKE128 variable-output-length ShakeHash.
+// Its generic security strength is 128 bits against all attacks if at
+// least 32 bytes of its output are used.
+func NewShake128() State {
+	return State{rate: rate128, dsbyte: dsbyteShake}
+}
+
+// NewShake256 creates a new SHAKE256 variable-output-length ShakeHash.
+// Its generic security strength is 256 bits against all attacks if
+// at least 64 bytes of its output are used.
+func NewShake256() State {
+	return State{rate: rate256, dsbyte: dsbyteShake}
+}
+
+// ShakeSum128 writes an arbitrary-length digest of data into hash.
+func ShakeSum128(hash, data []byte) {
+	h := NewShake128()
+	_, _ = h.Write(data)
+	_, _ = h.Read(hash)
+}
+
+// ShakeSum256 writes an arbitrary-length digest of data into hash.
+func ShakeSum256(hash, data []byte) {
+	h := NewShake256()
+	_, _ = h.Write(data)
+	_, _ = h.Read(hash)
+}
diff --git a/.ci/providerlint/vendor/github.com/cloudflare/circl/internal/sha3/xor.go b/.ci/providerlint/vendor/github.com/cloudflare/circl/internal/sha3/xor.go
new file mode 100644
index 00000000000..1e21337454f
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/cloudflare/circl/internal/sha3/xor.go
@@ -0,0 +1,15 @@
+// Copyright 2015 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build (!amd64 && !386 && !ppc64le) || appengine
+// +build !amd64,!386,!ppc64le appengine
+
+package sha3
+
+// A storageBuf is an aligned array of maxRate bytes.
+type storageBuf [maxRate]byte
+
+func (b *storageBuf) asBytes() *[maxRate]byte {
+	return (*[maxRate]byte)(b)
+}
diff --git a/.ci/providerlint/vendor/github.com/cloudflare/circl/internal/sha3/xor_generic.go b/.ci/providerlint/vendor/github.com/cloudflare/circl/internal/sha3/xor_generic.go
new file mode 100644
index 00000000000..2b0c6617906
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/cloudflare/circl/internal/sha3/xor_generic.go
@@ -0,0 +1,33 @@
+// Copyright 2015 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build (!amd64 || appengine) && (!386 || appengine) && (!ppc64le || appengine)
+// +build !amd64 appengine
+// +build !386 appengine
+// +build !ppc64le appengine
+
+package sha3
+
+import "encoding/binary"
+
+// xorIn xors the bytes in buf into the state; it
+// makes no non-portable assumptions about memory layout
+// or alignment.
+func xorIn(d *State, buf []byte) {
+	n := len(buf) / 8
+
+	for i := 0; i < n; i++ {
+		a := binary.LittleEndian.Uint64(buf)
+		d.a[i] ^= a
+		buf = buf[8:]
+	}
+}
+
+// copyOut copies ulint64s to a byte buffer.
+func copyOut(d *State, b []byte) {
+	for i := 0; len(b) >= 8; i++ {
+		binary.LittleEndian.PutUint64(b, d.a[i])
+		b = b[8:]
+	}
+}
diff --git a/.ci/providerlint/vendor/github.com/cloudflare/circl/internal/sha3/xor_unaligned.go b/.ci/providerlint/vendor/github.com/cloudflare/circl/internal/sha3/xor_unaligned.go
new file mode 100644
index 00000000000..052fc8d32d2
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/cloudflare/circl/internal/sha3/xor_unaligned.go
@@ -0,0 +1,61 @@
+// Copyright 2015 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build (amd64 || 386 || ppc64le) && !appengine
+// +build amd64 386 ppc64le
+// +build !appengine
+
+package sha3
+
+import "unsafe"
+
+// A storageBuf is an aligned array of maxRate bytes.
+type storageBuf [maxRate / 8]uint64
+
+func (b *storageBuf) asBytes() *[maxRate]byte {
+	return (*[maxRate]byte)(unsafe.Pointer(b))
+}
+
+// xorInuses unaligned reads and writes to update d.a to contain d.a
+// XOR buf.
+func xorIn(d *State, buf []byte) {
+	n := len(buf)
+	bw := (*[maxRate / 8]uint64)(unsafe.Pointer(&buf[0]))[: n/8 : n/8]
+	if n >= 72 {
+		d.a[0] ^= bw[0]
+		d.a[1] ^= bw[1]
+		d.a[2] ^= bw[2]
+		d.a[3] ^= bw[3]
+		d.a[4] ^= bw[4]
+		d.a[5] ^= bw[5]
+		d.a[6] ^= bw[6]
+		d.a[7] ^= bw[7]
+		d.a[8] ^= bw[8]
+	}
+	if n >= 104 {
+		d.a[9] ^= bw[9]
+		d.a[10] ^= bw[10]
+		d.a[11] ^= bw[11]
+		d.a[12] ^= bw[12]
+	}
+	if n >= 136 {
+		d.a[13] ^= bw[13]
+		d.a[14] ^= bw[14]
+		d.a[15] ^= bw[15]
+		d.a[16] ^= bw[16]
+	}
+	if n >= 144 {
+		d.a[17] ^= bw[17]
+	}
+	if n >= 168 {
+		d.a[18] ^= bw[18]
+		d.a[19] ^= bw[19]
+		d.a[20] ^= bw[20]
+	}
+}
+
+func copyOut(d *State, buf []byte) {
+	ab := (*[maxRate]uint8)(unsafe.Pointer(&d.a[0]))
+	copy(buf, ab[:])
+}
diff --git a/.ci/providerlint/vendor/github.com/cloudflare/circl/math/fp25519/fp.go b/.ci/providerlint/vendor/github.com/cloudflare/circl/math/fp25519/fp.go
new file mode 100644
index 00000000000..57a50ff5e9b
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/cloudflare/circl/math/fp25519/fp.go
@@ -0,0 +1,205 @@
+// Package fp25519 provides prime field arithmetic over GF(2^255-19).
+package fp25519
+
+import (
+	"errors"
+
+	"github.com/cloudflare/circl/internal/conv"
+)
+
+// Size in bytes of an element.
+const Size = 32
+
+// Elt is a prime field element.
+type Elt [Size]byte
+
+func (e Elt) String() string { return conv.BytesLe2Hex(e[:]) }
+
+// p is the prime modulus 2^255-19.
+var p = Elt{
+	0xed, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f,
+}
+
+// P returns the prime modulus 2^255-19.
+func P() Elt { return p }
+
+// ToBytes stores in b the little-endian byte representation of x.
+func ToBytes(b []byte, x *Elt) error {
+	if len(b) != Size {
+		return errors.New("wrong size")
+	}
+	Modp(x)
+	copy(b, x[:])
+	return nil
+}
+
+// IsZero returns true if x is equal to 0.
+func IsZero(x *Elt) bool { Modp(x); return *x == Elt{} }
+
+// SetOne assigns x=1.
+func SetOne(x *Elt) { *x = Elt{}; x[0] = 1 }
+
+// Neg calculates z = -x.
+func Neg(z, x *Elt) { Sub(z, &p, x) }
+
+// InvSqrt calculates z = sqrt(x/y) iff x/y is a quadratic-residue, which is
+// indicated by returning isQR = true. Otherwise, when x/y is a quadratic
+// non-residue, z will have an undetermined value and isQR = false.
+func InvSqrt(z, x, y *Elt) (isQR bool) {
+	sqrtMinusOne := &Elt{
+		0xb0, 0xa0, 0x0e, 0x4a, 0x27, 0x1b, 0xee, 0xc4,
+		0x78, 0xe4, 0x2f, 0xad, 0x06, 0x18, 0x43, 0x2f,
+		0xa7, 0xd7, 0xfb, 0x3d, 0x99, 0x00, 0x4d, 0x2b,
+		0x0b, 0xdf, 0xc1, 0x4f, 0x80, 0x24, 0x83, 0x2b,
+	}
+	t0, t1, t2, t3 := &Elt{}, &Elt{}, &Elt{}, &Elt{}
+
+	Mul(t0, x, y)   // t0 = u*v
+	Sqr(t1, y)      // t1 = v^2
+	Mul(t2, t0, t1) // t2 = u*v^3
+	Sqr(t0, t1)     // t0 = v^4
+	Mul(t1, t0, t2) // t1 = u*v^7
+
+	var Tab [4]*Elt
+	Tab[0] = &Elt{}
+	Tab[1] = &Elt{}
+	Tab[2] = t3
+	Tab[3] = t1
+
+	*Tab[0] = *t1
+	Sqr(Tab[0], Tab[0])
+	Sqr(Tab[1], Tab[0])
+	Sqr(Tab[1], Tab[1])
+	Mul(Tab[1], Tab[1], Tab[3])
+	Mul(Tab[0], Tab[0], Tab[1])
+	Sqr(Tab[0], Tab[0])
+	Mul(Tab[0], Tab[0], Tab[1])
+	Sqr(Tab[1], Tab[0])
+	for i := 0; i < 4; i++ {
+		Sqr(Tab[1], Tab[1])
+	}
+	Mul(Tab[1], Tab[1], Tab[0])
+	Sqr(Tab[2], Tab[1])
+	for i := 0; i < 4; i++ {
+		Sqr(Tab[2], Tab[2])
+	}
+	Mul(Tab[2], Tab[2], Tab[0])
+	Sqr(Tab[1], Tab[2])
+	for i := 0; i < 14; i++ {
+		Sqr(Tab[1], Tab[1])
+	}
+	Mul(Tab[1], Tab[1], Tab[2])
+	Sqr(Tab[2], Tab[1])
+	for i := 0; i < 29; i++ {
+		Sqr(Tab[2], Tab[2])
+	}
+	Mul(Tab[2], Tab[2], Tab[1])
+	Sqr(Tab[1], Tab[2])
+	for i := 0; i < 59; i++ {
+		Sqr(Tab[1], Tab[1])
+	}
+	Mul(Tab[1], Tab[1], Tab[2])
+	for i := 0; i < 5; i++ {
+		Sqr(Tab[1], Tab[1])
+	}
+	Mul(Tab[1], Tab[1], Tab[0])
+	Sqr(Tab[2], Tab[1])
+	for i := 0; i < 124; i++ {
+		Sqr(Tab[2], Tab[2])
+	}
+	Mul(Tab[2], Tab[2], Tab[1])
+	Sqr(Tab[2], Tab[2])
+	Sqr(Tab[2], Tab[2])
+	Mul(Tab[2], Tab[2], Tab[3])
+
+	Mul(z, t3, t2) // z = xy^(p+3)/8 = xy^3*(xy^7)^(p-5)/8
+	// Checking whether y z^2 == x
+	Sqr(t0, z)     // t0 = z^2
+	Mul(t0, t0, y) // t0 = yz^2
+	Sub(t1, t0, x) // t1 = t0-u
+	Add(t2, t0, x) // t2 = t0+u
+	if IsZero(t1) {
+		return true
+	} else if IsZero(t2) {
+		Mul(z, z, sqrtMinusOne) // z = z*sqrt(-1)
+		return true
+	} else {
+		return false
+	}
+}
+
+// Inv calculates z = 1/x mod p.
+func Inv(z, x *Elt) {
+	x0, x1, x2 := &Elt{}, &Elt{}, &Elt{}
+	Sqr(x1, x)
+	Sqr(x0, x1)
+	Sqr(x0, x0)
+	Mul(x0, x0, x)
+	Mul(z, x0, x1)
+	Sqr(x1, z)
+	Mul(x0, x0, x1)
+	Sqr(x1, x0)
+	for i := 0; i < 4; i++ {
+		Sqr(x1, x1)
+	}
+	Mul(x0, x0, x1)
+	Sqr(x1, x0)
+	for i := 0; i < 9; i++ {
+		Sqr(x1, x1)
+	}
+	Mul(x1, x1, x0)
+	Sqr(x2, x1)
+	for i := 0; i < 19; i++ {
+		Sqr(x2, x2)
+	}
+	Mul(x2, x2, x1)
+	for i := 0; i < 10; i++ {
+		Sqr(x2, x2)
+	}
+	Mul(x2, x2, x0)
+	Sqr(x0, x2)
+	for i := 0; i < 49; i++ {
+		Sqr(x0, x0)
+	}
+	Mul(x0, x0, x2)
+	Sqr(x1, x0)
+	for i := 0; i < 99; i++ {
+		Sqr(x1, x1)
+	}
+	Mul(x1, x1, x0)
+	for i := 0; i < 50; i++ {
+		Sqr(x1, x1)
+	}
+	Mul(x1, x1, x2)
+	for i := 0; i < 5; i++ {
+		Sqr(x1, x1)
+	}
+	Mul(z, z, x1)
+}
+
+// Cmov assigns y to x if n is 1.
+func Cmov(x, y *Elt, n uint) { cmov(x, y, n) }
+
+// Cswap interchanges x and y if n is 1.
+func Cswap(x, y *Elt, n uint) { cswap(x, y, n) }
+
+// Add calculates z = x+y mod p.
+func Add(z, x, y *Elt) { add(z, x, y) }
+
+// Sub calculates z = x-y mod p.
+func Sub(z, x, y *Elt) { sub(z, x, y) }
+
+// AddSub calculates (x,y) = (x+y mod p, x-y mod p).
+func AddSub(x, y *Elt) { addsub(x, y) }
+
+// Mul calculates z = x*y mod p.
+func Mul(z, x, y *Elt) { mul(z, x, y) }
+
+// Sqr calculates z = x^2 mod p.
+func Sqr(z, x *Elt) { sqr(z, x) }
+
+// Modp ensures that z is between [0,p-1].
+func Modp(z *Elt) { modp(z) }
diff --git a/.ci/providerlint/vendor/github.com/cloudflare/circl/math/fp25519/fp_amd64.go b/.ci/providerlint/vendor/github.com/cloudflare/circl/math/fp25519/fp_amd64.go
new file mode 100644
index 00000000000..057f0d2803f
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/cloudflare/circl/math/fp25519/fp_amd64.go
@@ -0,0 +1,45 @@
+//go:build amd64 && !purego
+// +build amd64,!purego
+
+package fp25519
+
+import (
+	"golang.org/x/sys/cpu"
+)
+
+var hasBmi2Adx = cpu.X86.HasBMI2 && cpu.X86.HasADX
+
+var _ = hasBmi2Adx
+
+func cmov(x, y *Elt, n uint)  { cmovAmd64(x, y, n) }
+func cswap(x, y *Elt, n uint) { cswapAmd64(x, y, n) }
+func add(z, x, y *Elt)        { addAmd64(z, x, y) }
+func sub(z, x, y *Elt)        { subAmd64(z, x, y) }
+func addsub(x, y *Elt)        { addsubAmd64(x, y) }
+func mul(z, x, y *Elt)        { mulAmd64(z, x, y) }
+func sqr(z, x *Elt)           { sqrAmd64(z, x) }
+func modp(z *Elt)             { modpAmd64(z) }
+
+//go:noescape
+func cmovAmd64(x, y *Elt, n uint)
+
+//go:noescape
+func cswapAmd64(x, y *Elt, n uint)
+
+//go:noescape
+func addAmd64(z, x, y *Elt)
+
+//go:noescape
+func subAmd64(z, x, y *Elt)
+
+//go:noescape
+func addsubAmd64(x, y *Elt)
+
+//go:noescape
+func mulAmd64(z, x, y *Elt)
+
+//go:noescape
+func sqrAmd64(z, x *Elt)
+
+//go:noescape
+func modpAmd64(z *Elt)
diff --git a/.ci/providerlint/vendor/github.com/cloudflare/circl/math/fp25519/fp_amd64.h b/.ci/providerlint/vendor/github.com/cloudflare/circl/math/fp25519/fp_amd64.h
new file mode 100644
index 00000000000..b884b584ab3
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/cloudflare/circl/math/fp25519/fp_amd64.h
@@ -0,0 +1,351 @@
+// This code was imported from https://github.com/armfazh/rfc7748_precomputed
+
+// CHECK_BMI2ADX triggers bmi2adx if supported,
+// otherwise it fallbacks to legacy code.
+#define CHECK_BMI2ADX(label, legacy, bmi2adx) \
+    CMPB ·hasBmi2Adx(SB), $0  \
+    JE label                  \
+    bmi2adx                   \
+    RET                       \
+    label:                    \
+    legacy                    \
+    RET
+
+// cselect is a conditional move
+// if b=1: it copies y into x;
+// if b=0: x remains with the same value;
+// if b<> 0,1: undefined.
+// Uses: AX, DX, FLAGS
+// Instr: x86_64, cmov
+#define cselect(x,y,b) \
+    TESTQ b, b \
+    MOVQ  0+x, AX; MOVQ  0+y, DX; CMOVQNE DX, AX; MOVQ AX,  0+x; \
+    MOVQ  8+x, AX; MOVQ  8+y, DX; CMOVQNE DX, AX; MOVQ AX,  8+x; \
+    MOVQ 16+x, AX; MOVQ 16+y, DX; CMOVQNE DX, AX; MOVQ AX, 16+x; \
+    MOVQ 24+x, AX; MOVQ 24+y, DX; CMOVQNE DX, AX; MOVQ AX, 24+x;
+
+// cswap is a conditional swap
+// if b=1: x,y <- y,x;
+// if b=0: x,y remain with the same values;
+// if b<> 0,1: undefined.
+// Uses: AX, DX, R8, FLAGS
+// Instr: x86_64, cmov
+#define cswap(x,y,b) \
+    TESTQ b, b \
+    MOVQ  0+x, AX; MOVQ AX, R8; MOVQ  0+y, DX; CMOVQNE DX, AX; CMOVQNE R8, DX; MOVQ AX,  0+x; MOVQ DX,  0+y; \
+    MOVQ  8+x, AX; MOVQ AX, R8; MOVQ  8+y, DX; CMOVQNE DX, AX; CMOVQNE R8, DX; MOVQ AX,  8+x; MOVQ DX,  8+y; \
+    MOVQ 16+x, AX; MOVQ AX, R8; MOVQ 16+y, DX; CMOVQNE DX, AX; CMOVQNE R8, DX; MOVQ AX, 16+x; MOVQ DX, 16+y; \
+    MOVQ 24+x, AX; MOVQ AX, R8; MOVQ 24+y, DX; CMOVQNE DX, AX; CMOVQNE R8, DX; MOVQ AX, 24+x; MOVQ DX, 24+y;
+
+// additionLeg adds x and y and stores in z
+// Uses: AX, DX, R8-R11, FLAGS
+// Instr: x86_64, cmov
+#define additionLeg(z,x,y) \
+    MOVL $38, AX; \
+    MOVL  $0, DX; \
+    MOVQ  0+x,  R8;  ADDQ  0+y,  R8; \
+    MOVQ  8+x,  R9;  ADCQ  8+y,  R9; \
+    MOVQ 16+x, R10;  ADCQ 16+y, R10; \
+    MOVQ 24+x, R11;  ADCQ 24+y, R11; \
+    CMOVQCS AX, DX;    \
+    ADDQ DX,  R8; \
+    ADCQ $0,  R9;  MOVQ  R9,  8+z; \
+    ADCQ $0, R10;  MOVQ R10, 16+z; \
+    ADCQ $0, R11;  MOVQ R11, 24+z; \
+    MOVL $0,  DX; \
+    CMOVQCS AX, DX; \
+    ADDQ DX,  R8;  MOVQ  R8,  0+z;
+
+// additionAdx adds x and y and stores in z
+// Uses: AX, DX, R8-R11, FLAGS
+// Instr: x86_64, cmov, adx
+#define additionAdx(z,x,y) \
+    MOVL $38, AX; \
+    XORL  DX, DX; \
+    MOVQ  0+x,  R8;  ADCXQ  0+y,  R8; \
+    MOVQ  8+x,  R9;  ADCXQ  8+y,  R9; \
+    MOVQ 16+x, R10;  ADCXQ 16+y, R10; \
+    MOVQ 24+x, R11;  ADCXQ 24+y, R11; \
+    CMOVQCS AX, DX ; \
+    XORL  AX,  AX; \
+    ADCXQ DX,  R8; \
+    ADCXQ AX,  R9;  MOVQ  R9,  8+z; \
+    ADCXQ AX, R10;  MOVQ R10, 16+z; \
+    ADCXQ AX, R11;  MOVQ R11, 24+z; \
+    MOVL $38,  DX; \
+    CMOVQCS DX, AX; \
+    ADDQ  AX,  R8;  MOVQ  R8,  0+z;
+
+// subtraction subtracts y from x and stores in z
+// Uses: AX, DX, R8-R11, FLAGS
+// Instr: x86_64, cmov
+#define subtraction(z,x,y) \
+    MOVL   $38,  AX; \
+    MOVQ  0+x,  R8;  SUBQ  0+y,  R8; \
+    MOVQ  8+x,  R9;  SBBQ  8+y,  R9; \
+    MOVQ 16+x, R10;  SBBQ 16+y, R10; \
+    MOVQ 24+x, R11;  SBBQ 24+y, R11; \
+    MOVL $0, DX; \
+    CMOVQCS AX, DX; \
+    SUBQ  DX,  R8; \
+    SBBQ  $0,  R9;  MOVQ  R9,  8+z; \
+    SBBQ  $0, R10;  MOVQ R10, 16+z; \
+    SBBQ  $0, R11;  MOVQ R11, 24+z; \
+    MOVL  $0,  DX; \
+    CMOVQCS AX, DX; \
+    SUBQ  DX,  R8;  MOVQ  R8,  0+z;
+
+// integerMulAdx multiplies x and y and stores in z
+// Uses: AX, DX, R8-R15, FLAGS
+// Instr: x86_64, bmi2, adx
+#define integerMulAdx(z,x,y) \
+    MOVL    $0,R15; \
+    MOVQ   0+y, DX;       XORL  AX,  AX; \
+    MULXQ  0+x, AX,  R8;  MOVQ  AX, 0+z; \
+    MULXQ  8+x, AX,  R9;  ADCXQ AX,  R8; \
+    MULXQ 16+x, AX, R10;  ADCXQ AX,  R9; \
+    MULXQ 24+x, AX, R11;  ADCXQ AX, R10; \
+    MOVL $0, AX;;;;;;;;;  ADCXQ AX, R11; \
+    MOVQ   8+y, DX;       XORL   AX,  AX; \
+    MULXQ  0+x, AX, R12;  ADCXQ  R8,  AX;  MOVQ  AX,  8+z; \
+    MULXQ  8+x, AX, R13;  ADCXQ  R9, R12;  ADOXQ AX, R12; \
+    MULXQ 16+x, AX, R14;  ADCXQ R10, R13;  ADOXQ AX, R13; \
+    MULXQ 24+x, AX, R15;  ADCXQ R11, R14;  ADOXQ AX, R14; \
+    MOVL $0, AX;;;;;;;;;  ADCXQ  AX, R15;  ADOXQ AX, R15; \
+    MOVQ  16+y, DX;       XORL   AX,  AX; \
+    MULXQ  0+x, AX,  R8;  ADCXQ R12,  AX;  MOVQ  AX, 16+z; \
+    MULXQ  8+x, AX,  R9;  ADCXQ R13,  R8;  ADOXQ AX,  R8; \
+    MULXQ 16+x, AX, R10;  ADCXQ R14,  R9;  ADOXQ AX,  R9; \
+    MULXQ 24+x, AX, R11;  ADCXQ R15, R10;  ADOXQ AX, R10; \
+    MOVL $0, AX;;;;;;;;;  ADCXQ  AX, R11;  ADOXQ AX, R11; \
+    MOVQ  24+y, DX;       XORL   AX,  AX; \
+    MULXQ  0+x, AX, R12;  ADCXQ  R8,  AX;  MOVQ  AX, 24+z; \
+    MULXQ  8+x, AX, R13;  ADCXQ  R9, R12;  ADOXQ AX, R12;  MOVQ R12, 32+z; \
+    MULXQ 16+x, AX, R14;  ADCXQ R10, R13;  ADOXQ AX, R13;  MOVQ R13, 40+z; \
+    MULXQ 24+x, AX, R15;  ADCXQ R11, R14;  ADOXQ AX, R14;  MOVQ R14, 48+z; \
+    MOVL $0, AX;;;;;;;;;  ADCXQ  AX, R15;  ADOXQ AX, R15;  MOVQ R15, 56+z;
+
+// integerMulLeg multiplies x and y and stores in z
+// Uses: AX, DX, R8-R15, FLAGS
+// Instr: x86_64
+#define integerMulLeg(z,x,y) \
+    MOVQ  0+y, R8; \
+    MOVQ  0+x, AX; MULQ R8; MOVQ AX, 0+z; MOVQ DX, R15; \
+    MOVQ  8+x, AX; MULQ R8; MOVQ AX, R13; MOVQ DX, R10; \
+    MOVQ 16+x, AX; MULQ R8; MOVQ AX, R14; MOVQ DX, R11; \
+    MOVQ 24+x, AX; MULQ R8; \
+    ADDQ R13, R15; \
+    ADCQ R14, R10;  MOVQ R10, 16+z; \
+    ADCQ  AX, R11;  MOVQ R11, 24+z; \
+    ADCQ  $0,  DX;  MOVQ  DX, 32+z; \
+    MOVQ  8+y, R8; \
+    MOVQ  0+x, AX; MULQ R8; MOVQ AX, R12; MOVQ DX,  R9; \
+    MOVQ  8+x, AX; MULQ R8; MOVQ AX, R13; MOVQ DX, R10; \
+    MOVQ 16+x, AX; MULQ R8; MOVQ AX, R14; MOVQ DX, R11; \
+    MOVQ 24+x, AX; MULQ R8; \
+    ADDQ R12, R15; MOVQ R15,  8+z; \
+    ADCQ R13,  R9; \
+    ADCQ R14, R10; \
+    ADCQ  AX, R11; \
+    ADCQ  $0,  DX; \
+    ADCQ 16+z,  R9;  MOVQ  R9,  R15; \
+    ADCQ 24+z, R10;  MOVQ R10, 24+z; \
+    ADCQ 32+z, R11;  MOVQ R11, 32+z; \
+    ADCQ   $0,  DX;  MOVQ  DX, 40+z; \
+    MOVQ 16+y, R8; \
+    MOVQ  0+x, AX; MULQ R8; MOVQ AX, R12; MOVQ DX,  R9; \
+    MOVQ  8+x, AX; MULQ R8; MOVQ AX, R13; MOVQ DX, R10; \
+    MOVQ 16+x, AX; MULQ R8; MOVQ AX, R14; MOVQ DX, R11; \
+    MOVQ 24+x, AX; MULQ R8; \
+    ADDQ R12, R15;  MOVQ R15, 16+z; \
+    ADCQ R13,  R9; \
+    ADCQ R14, R10; \
+    ADCQ  AX, R11; \
+    ADCQ  $0,  DX; \
+    ADCQ 24+z,  R9;  MOVQ  R9,  R15; \
+    ADCQ 32+z, R10;  MOVQ R10, 32+z; \
+    ADCQ 40+z, R11;  MOVQ R11, 40+z; \
+    ADCQ   $0,  DX;  MOVQ  DX, 48+z; \
+    MOVQ 24+y, R8; \
+    MOVQ  0+x, AX; MULQ R8; MOVQ AX, R12; MOVQ DX,  R9; \
+    MOVQ  8+x, AX; MULQ R8; MOVQ AX, R13; MOVQ DX, R10; \
+    MOVQ 16+x, AX; MULQ R8; MOVQ AX, R14; MOVQ DX, R11; \
+    MOVQ 24+x, AX; MULQ R8; \
+    ADDQ R12, R15; MOVQ R15, 24+z; \
+    ADCQ R13,  R9; \
+    ADCQ R14, R10; \
+    ADCQ  AX, R11; \
+    ADCQ  $0,  DX; \
+    ADCQ 32+z,  R9;  MOVQ  R9, 32+z; \
+    ADCQ 40+z, R10;  MOVQ R10, 40+z; \
+    ADCQ 48+z, R11;  MOVQ R11, 48+z; \
+    ADCQ   $0,  DX;  MOVQ  DX, 56+z;
+
+// integerSqrLeg squares x and stores in z
+// Uses: AX, CX, DX, R8-R15, FLAGS
+// Instr: x86_64
+#define integerSqrLeg(z,x) \
+    MOVQ  0+x, R8; \
+    MOVQ  8+x, AX; MULQ R8; MOVQ AX,  R9; MOVQ DX, R10; /* A[0]*A[1] */ \
+    MOVQ 16+x, AX; MULQ R8; MOVQ AX, R14; MOVQ DX, R11; /* A[0]*A[2] */ \
+    MOVQ 24+x, AX; MULQ R8; MOVQ AX, R15; MOVQ DX, R12; /* A[0]*A[3] */ \
+    MOVQ 24+x, R8; \
+    MOVQ  8+x, AX; MULQ R8; MOVQ AX,  CX; MOVQ DX, R13; /* A[3]*A[1] */ \
+    MOVQ 16+x, AX; MULQ R8; /* A[3]*A[2] */ \
+    \
+    ADDQ R14, R10;\
+    ADCQ R15, R11; MOVL $0, R15;\
+    ADCQ  CX, R12;\
+    ADCQ  AX, R13;\
+    ADCQ  $0,  DX; MOVQ DX, R14;\
+    MOVQ 8+x, AX; MULQ 16+x;\
+    \
+    ADDQ AX, R11;\
+    ADCQ DX, R12;\
+    ADCQ $0, R13;\
+    ADCQ $0, R14;\
+    ADCQ $0, R15;\
+    \
+    SHLQ $1, R14, R15; MOVQ R15, 56+z;\
+    SHLQ $1, R13, R14; MOVQ R14, 48+z;\
+    SHLQ $1, R12, R13; MOVQ R13, 40+z;\
+    SHLQ $1, R11, R12; MOVQ R12, 32+z;\
+    SHLQ $1, R10, R11; MOVQ R11, 24+z;\
+    SHLQ $1,  R9, R10; MOVQ R10, 16+z;\
+    SHLQ $1,  R9;      MOVQ  R9,  8+z;\
+    \
+    MOVQ  0+x,AX; MULQ AX; MOVQ AX, 0+z; MOVQ DX,  R9;\
+    MOVQ  8+x,AX; MULQ AX; MOVQ AX, R10; MOVQ DX, R11;\
+    MOVQ 16+x,AX; MULQ AX; MOVQ AX, R12; MOVQ DX, R13;\
+    MOVQ 24+x,AX; MULQ AX; MOVQ AX, R14; MOVQ DX, R15;\
+    \
+    ADDQ  8+z,  R9; MOVQ  R9,  8+z;\
+    ADCQ 16+z, R10; MOVQ R10, 16+z;\
+    ADCQ 24+z, R11; MOVQ R11, 24+z;\
+    ADCQ 32+z, R12; MOVQ R12, 32+z;\
+    ADCQ 40+z, R13; MOVQ R13, 40+z;\
+    ADCQ 48+z, R14; MOVQ R14, 48+z;\
+    ADCQ 56+z, R15; MOVQ R15, 56+z;
+
+// integerSqrAdx squares x and stores in z
+// Uses: AX, CX, DX, R8-R15, FLAGS
+// Instr: x86_64, bmi2, adx
+#define integerSqrAdx(z,x) \
+    MOVQ   0+x,  DX; /* A[0] */ \
+    MULXQ  8+x,  R8, R14; /* A[1]*A[0] */  XORL  R15, R15; \
+    MULXQ 16+x,  R9, R10; /* A[2]*A[0] */  ADCXQ R14,  R9; \
+    MULXQ 24+x,  AX,  CX; /* A[3]*A[0] */  ADCXQ  AX, R10; \
+    MOVQ  24+x,  DX; /* A[3] */ \
+    MULXQ  8+x, R11, R12; /* A[1]*A[3] */  ADCXQ  CX, R11; \
+    MULXQ 16+x,  AX, R13; /* A[2]*A[3] */  ADCXQ  AX, R12; \
+    MOVQ   8+x,  DX; /* A[1] */            ADCXQ R15, R13; \
+    MULXQ 16+x,  AX,  CX; /* A[2]*A[1] */  MOVL   $0, R14; \
+    ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;  ADCXQ R15, R14; \
+    XORL  R15, R15; \
+    ADOXQ  AX, R10;  ADCXQ  R8,  R8; \
+    ADOXQ  CX, R11;  ADCXQ  R9,  R9; \
+    ADOXQ R15, R12;  ADCXQ R10, R10; \
+    ADOXQ R15, R13;  ADCXQ R11, R11; \
+    ADOXQ R15, R14;  ADCXQ R12, R12; \
+    ;;;;;;;;;;;;;;;  ADCXQ R13, R13; \
+    ;;;;;;;;;;;;;;;  ADCXQ R14, R14; \
+    MOVQ  0+x, DX;  MULXQ DX, AX, CX; /* A[0]^2 */ \
+    ;;;;;;;;;;;;;;;  MOVQ  AX,  0+z; \
+    ADDQ CX,  R8;    MOVQ  R8,  8+z; \
+    MOVQ  8+x, DX;  MULXQ DX, AX, CX; /* A[1]^2 */ \
+    ADCQ AX,  R9;    MOVQ  R9, 16+z; \
+    ADCQ CX, R10;    MOVQ R10, 24+z; \
+    MOVQ 16+x, DX;  MULXQ DX, AX, CX; /* A[2]^2 */ \
+    ADCQ AX, R11;    MOVQ R11, 32+z; \
+    ADCQ CX, R12;    MOVQ R12, 40+z; \
+    MOVQ 24+x, DX;  MULXQ DX, AX, CX; /* A[3]^2 */ \
+    ADCQ AX, R13;    MOVQ R13, 48+z; \
+    ADCQ CX, R14;    MOVQ R14, 56+z;
+
+// reduceFromDouble finds z congruent to x modulo p such that 0<z<2^256
+// Uses: AX, DX, R8-R13, FLAGS
+// Instr: x86_64
+#define reduceFromDoubleLeg(z,x) \
+    /* 2*C = 38 = 2^256 */ \
+    MOVL $38, AX; MULQ 32+x; MOVQ AX,  R8; MOVQ DX,  R9; /* C*C[4] */ \
+    MOVL $38, AX; MULQ 40+x; MOVQ AX, R12; MOVQ DX, R10; /* C*C[5] */ \
+    MOVL $38, AX; MULQ 48+x; MOVQ AX, R13; MOVQ DX, R11; /* C*C[6] */ \
+    MOVL $38, AX; MULQ 56+x; /* C*C[7] */ \
+    ADDQ R12,  R9; \
+    ADCQ R13, R10; \
+    ADCQ  AX, R11; \
+    ADCQ  $0,  DX; \
+    ADDQ  0+x,  R8; \
+    ADCQ  8+x,  R9; \
+    ADCQ 16+x, R10; \
+    ADCQ 24+x, R11; \
+    ADCQ    $0, DX; \
+    MOVL $38, AX; \
+    IMULQ AX, DX; /* C*C[4], CF=0, OF=0 */ \
+    ADDQ DX,  R8; \
+    ADCQ $0,  R9; MOVQ  R9,  8+z; \
+    ADCQ $0, R10; MOVQ R10, 16+z; \
+    ADCQ $0, R11; MOVQ R11, 24+z; \
+    MOVL $0,  DX; \
+    CMOVQCS AX, DX; \
+    ADDQ DX,  R8; MOVQ  R8,  0+z;
+
+// reduceFromDoubleAdx finds z congruent to x modulo p such that 0<z<2^256
+// Uses: AX, DX, R8-R13, FLAGS
+// Instr: x86_64, bmi2, adx
+#define reduceFromDoubleAdx(z,x) \
+    MOVL    $38,  DX; /* 2*C = 38 = 2^256 */ \
+    MULXQ 32+x,  R8, R10; /* C*C[4] */  XORL AX, AX;     ADOXQ  0+x,  R8; \
+    MULXQ 40+x,  R9, R11; /* C*C[5] */  ADCXQ R10,  R9;  ADOXQ  8+x,  R9; \
+    MULXQ 48+x, R10, R13; /* C*C[6] */  ADCXQ R11, R10;  ADOXQ 16+x, R10; \
+    MULXQ 56+x, R11, R12; /* C*C[7] */  ADCXQ R13, R11;  ADOXQ 24+x, R11; \
+    ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;  ADCXQ  AX, R12;  ADOXQ   AX, R12; \
+    IMULQ  DX, R12; /* C*C[4], CF=0, OF=0 */ \
+    ADCXQ R12, R8; \
+    ADCXQ AX,  R9; MOVQ  R9,  8+z; \
+    ADCXQ AX, R10; MOVQ R10, 16+z; \
+    ADCXQ AX, R11; MOVQ R11, 24+z; \
+    MOVL  $0, R12; \
+    CMOVQCS DX, R12; \
+    ADDQ R12,  R8; MOVQ  R8,  0+z;
+
+// addSub calculates two operations: x,y = x+y,x-y
+// Uses: AX, DX, R8-R15, FLAGS
+#define addSub(x,y) \
+    MOVL $38, AX; \
+    XORL  DX, DX; \
+    MOVQ  0+x,  R8;  MOVQ  R8, R12;  ADDQ  0+y,  R8; \
+    MOVQ  8+x,  R9;  MOVQ  R9, R13;  ADCQ  8+y,  R9; \
+    MOVQ 16+x, R10;  MOVQ R10, R14;  ADCQ 16+y, R10; \
+    MOVQ 24+x, R11;  MOVQ R11, R15;  ADCQ 24+y, R11; \
+    CMOVQCS AX, DX; \
+    XORL AX,  AX; \
+    ADDQ DX,  R8; \
+    ADCQ $0,  R9; \
+    ADCQ $0, R10; \
+    ADCQ $0, R11; \
+    MOVL $38, DX; \
+    CMOVQCS DX, AX; \
+    ADDQ  AX, R8; \
+    MOVL $38, AX; \
+    SUBQ  0+y, R12; \
+    SBBQ  8+y, R13; \
+    SBBQ 16+y, R14; \
+    SBBQ 24+y, R15; \
+    MOVL $0, DX; \
+    CMOVQCS AX, DX; \
+    SUBQ DX, R12; \
+    SBBQ $0, R13; \
+    SBBQ $0, R14; \
+    SBBQ $0, R15; \
+    MOVL $0,  DX; \
+    CMOVQCS AX, DX; \
+    SUBQ DX, R12; \
+    MOVQ  R8,  0+x; \
+    MOVQ  R9,  8+x; \
+    MOVQ R10, 16+x; \
+    MOVQ R11, 24+x; \
+    MOVQ R12,  0+y; \
+    MOVQ R13,  8+y; \
+    MOVQ R14, 16+y; \
+    MOVQ R15, 24+y;
diff --git a/.ci/providerlint/vendor/github.com/cloudflare/circl/math/fp25519/fp_amd64.s b/.ci/providerlint/vendor/github.com/cloudflare/circl/math/fp25519/fp_amd64.s
new file mode 100644
index 00000000000..5c4aeddecb4
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/cloudflare/circl/math/fp25519/fp_amd64.s
@@ -0,0 +1,111 @@
+// +build amd64
+
+#include "textflag.h"
+#include "fp_amd64.h"
+
+// func cmovAmd64(x, y *Elt, n uint)
+TEXT ·cmovAmd64(SB),NOSPLIT,$0-24
+    MOVQ x+0(FP), DI
+    MOVQ y+8(FP), SI
+    MOVQ n+16(FP), BX
+    cselect(0(DI),0(SI),BX)
+    RET
+
+// func cswapAmd64(x, y *Elt, n uint)
+TEXT ·cswapAmd64(SB),NOSPLIT,$0-24
+    MOVQ x+0(FP), DI
+    MOVQ y+8(FP), SI
+    MOVQ n+16(FP), BX
+    cswap(0(DI),0(SI),BX)
+    RET
+
+// func subAmd64(z, x, y *Elt)
+TEXT ·subAmd64(SB),NOSPLIT,$0-24
+    MOVQ z+0(FP), DI
+    MOVQ x+8(FP), SI
+    MOVQ y+16(FP), BX
+    subtraction(0(DI),0(SI),0(BX))
+    RET
+
+// func addsubAmd64(x, y *Elt)
+TEXT ·addsubAmd64(SB),NOSPLIT,$0-16
+    MOVQ x+0(FP), DI
+    MOVQ y+8(FP), SI
+    addSub(0(DI),0(SI))
+    RET
+
+#define addLegacy \
+    additionLeg(0(DI),0(SI),0(BX))
+#define addBmi2Adx \
+    additionAdx(0(DI),0(SI),0(BX))
+
+#define mulLegacy \
+    integerMulLeg(0(SP),0(SI),0(BX)) \
+    reduceFromDoubleLeg(0(DI),0(SP))
+#define mulBmi2Adx \
+    integerMulAdx(0(SP),0(SI),0(BX)) \
+    reduceFromDoubleAdx(0(DI),0(SP))
+
+#define sqrLegacy \
+    integerSqrLeg(0(SP),0(SI)) \
+    reduceFromDoubleLeg(0(DI),0(SP))
+#define sqrBmi2Adx \
+    integerSqrAdx(0(SP),0(SI)) \
+    reduceFromDoubleAdx(0(DI),0(SP))
+
+// func addAmd64(z, x, y *Elt)
+TEXT ·addAmd64(SB),NOSPLIT,$0-24
+    MOVQ z+0(FP), DI
+    MOVQ x+8(FP), SI
+    MOVQ y+16(FP), BX
+    CHECK_BMI2ADX(LADD, addLegacy, addBmi2Adx)
+
+// func mulAmd64(z, x, y *Elt)
+TEXT ·mulAmd64(SB),NOSPLIT,$64-24
+    MOVQ z+0(FP), DI
+    MOVQ x+8(FP), SI
+    MOVQ y+16(FP), BX
+    CHECK_BMI2ADX(LMUL, mulLegacy, mulBmi2Adx)
+
+// func sqrAmd64(z, x *Elt)
+TEXT ·sqrAmd64(SB),NOSPLIT,$64-16
+    MOVQ z+0(FP), DI
+    MOVQ x+8(FP), SI
+    CHECK_BMI2ADX(LSQR, sqrLegacy, sqrBmi2Adx)
+
+// func modpAmd64(z *Elt)
+TEXT ·modpAmd64(SB),NOSPLIT,$0-8
+    MOVQ z+0(FP), DI
+
+    MOVQ   (DI),  R8
+    MOVQ  8(DI),  R9
+    MOVQ 16(DI), R10
+    MOVQ 24(DI), R11
+
+    MOVL $19, AX
+    MOVL $38, CX
+
+    BTRQ $63, R11 // PUT BIT 255 IN CARRY FLAG AND CLEAR
+    CMOVLCC AX, CX // C[255] ? 38 : 19
+
+    // ADD EITHER 19 OR 38 TO C
+    ADDQ CX,  R8
+    ADCQ $0,  R9
+    ADCQ $0, R10
+    ADCQ $0, R11
+
+    // TEST FOR BIT 255 AGAIN; ONLY TRIGGERED ON OVERFLOW MODULO 2^255-19
+    MOVL     $0,  CX
+    CMOVLPL  AX,  CX // C[255] ? 0 : 19
+    BTRQ    $63, R11 // CLEAR BIT 255
+
+    // SUBTRACT 19 IF NECESSARY
+    SUBQ CX,  R8
+    MOVQ  R8,   (DI)
+    SBBQ $0,  R9
+    MOVQ  R9,  8(DI)
+    SBBQ $0, R10
+    MOVQ R10, 16(DI)
+    SBBQ $0, R11
+    MOVQ R11, 24(DI)
+    RET
diff --git a/.ci/providerlint/vendor/github.com/cloudflare/circl/math/fp25519/fp_generic.go b/.ci/providerlint/vendor/github.com/cloudflare/circl/math/fp25519/fp_generic.go
new file mode 100644
index 00000000000..32bc582a257
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/cloudflare/circl/math/fp25519/fp_generic.go
@@ -0,0 +1,317 @@
+package fp25519
+
+import (
+	"encoding/binary"
+	"math/bits"
+)
+
+func cmovGeneric(x, y *Elt, n uint) {
+	m := -uint64(n & 0x1)
+	x0 := binary.LittleEndian.Uint64(x[0*8 : 1*8])
+	x1 := binary.LittleEndian.Uint64(x[1*8 : 2*8])
+	x2 := binary.LittleEndian.Uint64(x[2*8 : 3*8])
+	x3 := binary.LittleEndian.Uint64(x[3*8 : 4*8])
+
+	y0 := binary.LittleEndian.Uint64(y[0*8 : 1*8])
+	y1 := binary.LittleEndian.Uint64(y[1*8 : 2*8])
+	y2 := binary.LittleEndian.Uint64(y[2*8 : 3*8])
+	y3 := binary.LittleEndian.Uint64(y[3*8 : 4*8])
+
+	x0 = (x0 &^ m) | (y0 & m)
+	x1 = (x1 &^ m) | (y1 & m)
+	x2 = (x2 &^ m) | (y2 & m)
+	x3 = (x3 &^ m) | (y3 & m)
+
+	binary.LittleEndian.PutUint64(x[0*8:1*8], x0)
+	binary.LittleEndian.PutUint64(x[1*8:2*8], x1)
+	binary.LittleEndian.PutUint64(x[2*8:3*8], x2)
+	binary.LittleEndian.PutUint64(x[3*8:4*8], x3)
+}
+
+func cswapGeneric(x, y *Elt, n uint) {
+	m := -uint64(n & 0x1)
+	x0 := binary.LittleEndian.Uint64(x[0*8 : 1*8])
+	x1 := binary.LittleEndian.Uint64(x[1*8 : 2*8])
+	x2 := binary.LittleEndian.Uint64(x[2*8 : 3*8])
+	x3 := binary.LittleEndian.Uint64(x[3*8 : 4*8])
+
+	y0 := binary.LittleEndian.Uint64(y[0*8 : 1*8])
+	y1 := binary.LittleEndian.Uint64(y[1*8 : 2*8])
+	y2 := binary.LittleEndian.Uint64(y[2*8 : 3*8])
+	y3 := binary.LittleEndian.Uint64(y[3*8 : 4*8])
+
+	t0 := m & (x0 ^ y0)
+	t1 := m & (x1 ^ y1)
+	t2 := m & (x2 ^ y2)
+	t3 := m & (x3 ^ y3)
+	x0 ^= t0
+	x1 ^= t1
+	x2 ^= t2
+	x3 ^= t3
+	y0 ^= t0
+	y1 ^= t1
+	y2 ^= t2
+	y3 ^= t3
+
+	binary.LittleEndian.PutUint64(x[0*8:1*8], x0)
+	binary.LittleEndian.PutUint64(x[1*8:2*8], x1)
+	binary.LittleEndian.PutUint64(x[2*8:3*8], x2)
+	binary.LittleEndian.PutUint64(x[3*8:4*8], x3)
+
+	binary.LittleEndian.PutUint64(y[0*8:1*8], y0)
+	binary.LittleEndian.PutUint64(y[1*8:2*8], y1)
+	binary.LittleEndian.PutUint64(y[2*8:3*8], y2)
+	binary.LittleEndian.PutUint64(y[3*8:4*8], y3)
+}
+
+func addGeneric(z, x, y *Elt) {
+	x0 := binary.LittleEndian.Uint64(x[0*8 : 1*8])
+	x1 := binary.LittleEndian.Uint64(x[1*8 : 2*8])
+	x2 := binary.LittleEndian.Uint64(x[2*8 : 3*8])
+	x3 := binary.LittleEndian.Uint64(x[3*8 : 4*8])
+
+	y0 := binary.LittleEndian.Uint64(y[0*8 : 1*8])
+	y1 := binary.LittleEndian.Uint64(y[1*8 : 2*8])
+	y2 := binary.LittleEndian.Uint64(y[2*8 : 3*8])
+	y3 := binary.LittleEndian.Uint64(y[3*8 : 4*8])
+
+	z0, c0 := bits.Add64(x0, y0, 0)
+	z1, c1 := bits.Add64(x1, y1, c0)
+	z2, c2 := bits.Add64(x2, y2, c1)
+	z3, c3 := bits.Add64(x3, y3, c2)
+
+	z0, c0 = bits.Add64(z0, (-c3)&38, 0)
+	z1, c1 = bits.Add64(z1, 0, c0)
+	z2, c2 = bits.Add64(z2, 0, c1)
+	z3, c3 = bits.Add64(z3, 0, c2)
+	z0, _ = bits.Add64(z0, (-c3)&38, 0)
+
+	binary.LittleEndian.PutUint64(z[0*8:1*8], z0)
+	binary.LittleEndian.PutUint64(z[1*8:2*8], z1)
+	binary.LittleEndian.PutUint64(z[2*8:3*8], z2)
+	binary.LittleEndian.PutUint64(z[3*8:4*8], z3)
+}
+
+func subGeneric(z, x, y *Elt) {
+	x0 := binary.LittleEndian.Uint64(x[0*8 : 1*8])
+	x1 := binary.LittleEndian.Uint64(x[1*8 : 2*8])
+	x2 := binary.LittleEndian.Uint64(x[2*8 : 3*8])
+	x3 := binary.LittleEndian.Uint64(x[3*8 : 4*8])
+
+	y0 := binary.LittleEndian.Uint64(y[0*8 : 1*8])
+	y1 := binary.LittleEndian.Uint64(y[1*8 : 2*8])
+	y2 := binary.LittleEndian.Uint64(y[2*8 : 3*8])
+	y3 := binary.LittleEndian.Uint64(y[3*8 : 4*8])
+
+	z0, c0 := bits.Sub64(x0, y0, 0)
+	z1, c1 := bits.Sub64(x1, y1, c0)
+	z2, c2 := bits.Sub64(x2, y2, c1)
+	z3, c3 := bits.Sub64(x3, y3, c2)
+
+	z0, c0 = bits.Sub64(z0, (-c3)&38, 0)
+	z1, c1 = bits.Sub64(z1, 0, c0)
+	z2, c2 = bits.Sub64(z2, 0, c1)
+	z3, c3 = bits.Sub64(z3, 0, c2)
+	z0, _ = bits.Sub64(z0, (-c3)&38, 0)
+
+	binary.LittleEndian.PutUint64(z[0*8:1*8], z0)
+	binary.LittleEndian.PutUint64(z[1*8:2*8], z1)
+	binary.LittleEndian.PutUint64(z[2*8:3*8], z2)
+	binary.LittleEndian.PutUint64(z[3*8:4*8], z3)
+}
+
+func addsubGeneric(x, y *Elt) {
+	z := &Elt{}
+	addGeneric(z, x, y)
+	subGeneric(y, x, y)
+	*x = *z
+}
+
+func mulGeneric(z, x, y *Elt) {
+	x0 := binary.LittleEndian.Uint64(x[0*8 : 1*8])
+	x1 := binary.LittleEndian.Uint64(x[1*8 : 2*8])
+	x2 := binary.LittleEndian.Uint64(x[2*8 : 3*8])
+	x3 := binary.LittleEndian.Uint64(x[3*8 : 4*8])
+
+	y0 := binary.LittleEndian.Uint64(y[0*8 : 1*8])
+	y1 := binary.LittleEndian.Uint64(y[1*8 : 2*8])
+	y2 := binary.LittleEndian.Uint64(y[2*8 : 3*8])
+	y3 := binary.LittleEndian.Uint64(y[3*8 : 4*8])
+
+	yi := y0
+	h0, l0 := bits.Mul64(x0, yi)
+	h1, l1 := bits.Mul64(x1, yi)
+	h2, l2 := bits.Mul64(x2, yi)
+	h3, l3 := bits.Mul64(x3, yi)
+
+	z0 := l0
+	a0, c0 := bits.Add64(h0, l1, 0)
+	a1, c1 := bits.Add64(h1, l2, c0)
+	a2, c2 := bits.Add64(h2, l3, c1)
+	a3, _ := bits.Add64(h3, 0, c2)
+
+	yi = y1
+	h0, l0 = bits.Mul64(x0, yi)
+	h1, l1 = bits.Mul64(x1, yi)
+	h2, l2 = bits.Mul64(x2, yi)
+	h3, l3 = bits.Mul64(x3, yi)
+
+	z1, c0 := bits.Add64(a0, l0, 0)
+	h0, c1 = bits.Add64(h0, l1, c0)
+	h1, c2 = bits.Add64(h1, l2, c1)
+	h2, c3 := bits.Add64(h2, l3, c2)
+	h3, _ = bits.Add64(h3, 0, c3)
+
+	a0, c0 = bits.Add64(a1, h0, 0)
+	a1, c1 = bits.Add64(a2, h1, c0)
+	a2, c2 = bits.Add64(a3, h2, c1)
+	a3, _ = bits.Add64(0, h3, c2)
+
+	yi = y2
+	h0, l0 = bits.Mul64(x0, yi)
+	h1, l1 = bits.Mul64(x1, yi)
+	h2, l2 = bits.Mul64(x2, yi)
+	h3, l3 = bits.Mul64(x3, yi)
+
+	z2, c0 := bits.Add64(a0, l0, 0)
+	h0, c1 = bits.Add64(h0, l1, c0)
+	h1, c2 = bits.Add64(h1, l2, c1)
+	h2, c3 = bits.Add64(h2, l3, c2)
+	h3, _ = bits.Add64(h3, 0, c3)
+
+	a0, c0 = bits.Add64(a1, h0, 0)
+	a1, c1 = bits.Add64(a2, h1, c0)
+	a2, c2 = bits.Add64(a3, h2, c1)
+	a3, _ = bits.Add64(0, h3, c2)
+
+	yi = y3
+	h0, l0 = bits.Mul64(x0, yi)
+	h1, l1 = bits.Mul64(x1, yi)
+	h2, l2 = bits.Mul64(x2, yi)
+	h3, l3 = bits.Mul64(x3, yi)
+
+	z3, c0 := bits.Add64(a0, l0, 0)
+	h0, c1 = bits.Add64(h0, l1, c0)
+	h1, c2 = bits.Add64(h1, l2, c1)
+	h2, c3 = bits.Add64(h2, l3, c2)
+	h3, _ = bits.Add64(h3, 0, c3)
+
+	z4, c0 := bits.Add64(a1, h0, 0)
+	z5, c1 := bits.Add64(a2, h1, c0)
+	z6, c2 := bits.Add64(a3, h2, c1)
+	z7, _ := bits.Add64(0, h3, c2)
+
+	red64(z, z0, z1, z2, z3, z4, z5, z6, z7)
+}
+
+func sqrGeneric(z, x *Elt) {
+	x0 := binary.LittleEndian.Uint64(x[0*8 : 1*8])
+	x1 := binary.LittleEndian.Uint64(x[1*8 : 2*8])
+	x2 := binary.LittleEndian.Uint64(x[2*8 : 3*8])
+	x3 := binary.LittleEndian.Uint64(x[3*8 : 4*8])
+
+	h0, a0 := bits.Mul64(x0, x1)
+	h1, l1 := bits.Mul64(x0, x2)
+	h2, l2 := bits.Mul64(x0, x3)
+	h3, l3 := bits.Mul64(x3, x1)
+	h4, l4 := bits.Mul64(x3, x2)
+	h, l := bits.Mul64(x1, x2)
+
+	a1, c0 := bits.Add64(l1, h0, 0)
+	a2, c1 := bits.Add64(l2, h1, c0)
+	a3, c2 := bits.Add64(l3, h2, c1)
+	a4, c3 := bits.Add64(l4, h3, c2)
+	a5, _ := bits.Add64(h4, 0, c3)
+
+	a2, c0 = bits.Add64(a2, l, 0)
+	a3, c1 = bits.Add64(a3, h, c0)
+	a4, c2 = bits.Add64(a4, 0, c1)
+	a5, c3 = bits.Add64(a5, 0, c2)
+	a6, _ := bits.Add64(0, 0, c3)
+
+	a0, c0 = bits.Add64(a0, a0, 0)
+	a1, c1 = bits.Add64(a1, a1, c0)
+	a2, c2 = bits.Add64(a2, a2, c1)
+	a3, c3 = bits.Add64(a3, a3, c2)
+	a4, c4 := bits.Add64(a4, a4, c3)
+	a5, c5 := bits.Add64(a5, a5, c4)
+	a6, _ = bits.Add64(a6, a6, c5)
+
+	b1, b0 := bits.Mul64(x0, x0)
+	b3, b2 := bits.Mul64(x1, x1)
+	b5, b4 := bits.Mul64(x2, x2)
+	b7, b6 := bits.Mul64(x3, x3)
+
+	b1, c0 = bits.Add64(b1, a0, 0)
+	b2, c1 = bits.Add64(b2, a1, c0)
+	b3, c2 = bits.Add64(b3, a2, c1)
+	b4, c3 = bits.Add64(b4, a3, c2)
+	b5, c4 = bits.Add64(b5, a4, c3)
+	b6, c5 = bits.Add64(b6, a5, c4)
+	b7, _ = bits.Add64(b7, a6, c5)
+
+	red64(z, b0, b1, b2, b3, b4, b5, b6, b7)
+}
+
+func modpGeneric(x *Elt) {
+	x0 := binary.LittleEndian.Uint64(x[0*8 : 1*8])
+	x1 := binary.LittleEndian.Uint64(x[1*8 : 2*8])
+	x2 := binary.LittleEndian.Uint64(x[2*8 : 3*8])
+	x3 := binary.LittleEndian.Uint64(x[3*8 : 4*8])
+
+	// CX = C[255] ? 38 : 19
+	cx := uint64(19) << (x3 >> 63)
+	// PUT BIT 255 IN CARRY FLAG AND CLEAR
+	x3 &^= 1 << 63
+
+	x0, c0 := bits.Add64(x0, cx, 0)
+	x1, c1 := bits.Add64(x1, 0, c0)
+	x2, c2 := bits.Add64(x2, 0, c1)
+	x3, _ = bits.Add64(x3, 0, c2)
+
+	// TEST FOR BIT 255 AGAIN; ONLY TRIGGERED ON OVERFLOW MODULO 2^255-19
+	// cx = C[255] ? 0 : 19
+	cx = uint64(19) &^ (-(x3 >> 63))
+	// CLEAR BIT 255
+	x3 &^= 1 << 63
+
+	x0, c0 = bits.Sub64(x0, cx, 0)
+	x1, c1 = bits.Sub64(x1, 0, c0)
+	x2, c2 = bits.Sub64(x2, 0, c1)
+	x3, _ = bits.Sub64(x3, 0, c2)
+
+	binary.LittleEndian.PutUint64(x[0*8:1*8], x0)
+	binary.LittleEndian.PutUint64(x[1*8:2*8], x1)
+	binary.LittleEndian.PutUint64(x[2*8:3*8], x2)
+	binary.LittleEndian.PutUint64(x[3*8:4*8], x3)
+}
+
+func red64(z *Elt, x0, x1, x2, x3, x4, x5, x6, x7 uint64) {
+	h0, l0 := bits.Mul64(x4, 38)
+	h1, l1 := bits.Mul64(x5, 38)
+	h2, l2 := bits.Mul64(x6, 38)
+	h3, l3 := bits.Mul64(x7, 38)
+
+	l1, c0 := bits.Add64(h0, l1, 0)
+	l2, c1 := bits.Add64(h1, l2, c0)
+	l3, c2 := bits.Add64(h2, l3, c1)
+	l4, _ := bits.Add64(h3, 0, c2)
+
+	l0, c0 = bits.Add64(l0, x0, 0)
+	l1, c1 = bits.Add64(l1, x1, c0)
+	l2, c2 = bits.Add64(l2, x2, c1)
+	l3, c3 := bits.Add64(l3, x3, c2)
+	l4, _ = bits.Add64(l4, 0, c3)
+
+	_, l4 = bits.Mul64(l4, 38)
+	l0, c0 = bits.Add64(l0, l4, 0)
+	z1, c1 := bits.Add64(l1, 0, c0)
+	z2, c2 := bits.Add64(l2, 0, c1)
+	z3, c3 := bits.Add64(l3, 0, c2)
+	z0, _ := bits.Add64(l0, (-c3)&38, 0)
+
+	binary.LittleEndian.PutUint64(z[0*8:1*8], z0)
+	binary.LittleEndian.PutUint64(z[1*8:2*8], z1)
+	binary.LittleEndian.PutUint64(z[2*8:3*8], z2)
+	binary.LittleEndian.PutUint64(z[3*8:4*8], z3)
+}
diff --git a/.ci/providerlint/vendor/github.com/cloudflare/circl/math/fp25519/fp_noasm.go b/.ci/providerlint/vendor/github.com/cloudflare/circl/math/fp25519/fp_noasm.go
new file mode 100644
index 00000000000..26ca4d01b7e
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/cloudflare/circl/math/fp25519/fp_noasm.go
@@ -0,0 +1,13 @@
+//go:build !amd64 || purego
+// +build !amd64 purego
+
+package fp25519
+
+func cmov(x, y *Elt, n uint)  { cmovGeneric(x, y, n) }
+func cswap(x, y *Elt, n uint) { cswapGeneric(x, y, n) }
+func add(z, x, y *Elt)        { addGeneric(z, x, y) }
+func sub(z, x, y *Elt)        { subGeneric(z, x, y) }
+func addsub(x, y *Elt)        { addsubGeneric(x, y) }
+func mul(z, x, y *Elt)        { mulGeneric(z, x, y) }
+func sqr(z, x *Elt)           { sqrGeneric(z, x) }
+func modp(z *Elt)             { modpGeneric(z) }
diff --git a/.ci/providerlint/vendor/github.com/cloudflare/circl/math/fp448/fp.go b/.ci/providerlint/vendor/github.com/cloudflare/circl/math/fp448/fp.go
new file mode 100644
index 00000000000..a5e36600bb6
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/cloudflare/circl/math/fp448/fp.go
@@ -0,0 +1,164 @@
+// Package fp448 provides prime field arithmetic over GF(2^448-2^224-1).
+package fp448
+
+import (
+	"errors"
+
+	"github.com/cloudflare/circl/internal/conv"
+)
+
+// Size in bytes of an element.
+const Size = 56
+
+// Elt is a prime field element.
+type Elt [Size]byte
+
+func (e Elt) String() string { return conv.BytesLe2Hex(e[:]) }
+
+// p is the prime modulus 2^448-2^224-1.
+var p = Elt{
+	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+	0xff, 0xff, 0xff, 0xff, 0xfe, 0xff, 0xff, 0xff,
+	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+}
+
+// P returns the prime modulus 2^448-2^224-1.
+func P() Elt { return p }
+
+// ToBytes stores in b the little-endian byte representation of x.
+func ToBytes(b []byte, x *Elt) error {
+	if len(b) != Size {
+		return errors.New("wrong size")
+	}
+	Modp(x)
+	copy(b, x[:])
+	return nil
+}
+
+// IsZero returns true if x is equal to 0.
+func IsZero(x *Elt) bool { Modp(x); return *x == Elt{} }
+
+// IsOne returns true if x is equal to 1.
+func IsOne(x *Elt) bool { Modp(x); return *x == Elt{1} }
+
+// SetOne assigns x=1.
+func SetOne(x *Elt) { *x = Elt{1} }
+
+// One returns the 1 element.
+func One() (x Elt) { x = Elt{1}; return }
+
+// Neg calculates z = -x.
+func Neg(z, x *Elt) { Sub(z, &p, x) }
+
+// Modp ensures that z is between [0,p-1].
+func Modp(z *Elt) { Sub(z, z, &p) }
+
+// InvSqrt calculates z = sqrt(x/y) iff x/y is a quadratic-residue. If so,
+// isQR = true; otherwise, isQR = false, since x/y is a quadratic non-residue,
+// and z = sqrt(-x/y).
+func InvSqrt(z, x, y *Elt) (isQR bool) {
+	// First note that x^(2(k+1)) = x^(p-1)/2 * x = legendre(x) * x
+	// so that's x if x is a quadratic residue and -x otherwise.
+	// Next, y^(6k+3) = y^(4k+2) * y^(2k+1) = y^(p-1) * y^((p-1)/2) = legendre(y).
+	// So the z we compute satisfies z^2 y = x^(2(k+1)) y^(6k+3) = legendre(x)*legendre(y).
+	// Thus if x and y are quadratic residues, then z is indeed sqrt(x/y).
+	t0, t1 := &Elt{}, &Elt{}
+	Mul(t0, x, y)         // x*y
+	Sqr(t1, y)            // y^2
+	Mul(t1, t0, t1)       // x*y^3
+	powPminus3div4(z, t1) // (x*y^3)^k
+	Mul(z, z, t0)         // z = x*y*(x*y^3)^k = x^(k+1) * y^(3k+1)
+
+	// Check if x/y is a quadratic residue
+	Sqr(t0, z)     // z^2
+	Mul(t0, t0, y) // y*z^2
+	Sub(t0, t0, x) // y*z^2-x
+	return IsZero(t0)
+}
+
+// Inv calculates z = 1/x mod p.
+func Inv(z, x *Elt) {
+	// Calculates z = x^(4k+1) = x^(p-3+1) = x^(p-2) = x^-1, where k = (p-3)/4.
+	t := &Elt{}
+	powPminus3div4(t, x) // t = x^k
+	Sqr(t, t)            // t = x^2k
+	Sqr(t, t)            // t = x^4k
+	Mul(z, t, x)         // z = x^(4k+1)
+}
+
+// powPminus3div4 calculates z = x^k mod p, where k = (p-3)/4.
+func powPminus3div4(z, x *Elt) {
+	x0, x1 := &Elt{}, &Elt{}
+	Sqr(z, x)
+	Mul(z, z, x)
+	Sqr(x0, z)
+	Mul(x0, x0, x)
+	Sqr(z, x0)
+	Sqr(z, z)
+	Sqr(z, z)
+	Mul(z, z, x0)
+	Sqr(x1, z)
+	for i := 0; i < 5; i++ {
+		Sqr(x1, x1)
+	}
+	Mul(x1, x1, z)
+	Sqr(z, x1)
+	for i := 0; i < 11; i++ {
+		Sqr(z, z)
+	}
+	Mul(z, z, x1)
+	Sqr(z, z)
+	Sqr(z, z)
+	Sqr(z, z)
+	Mul(z, z, x0)
+	Sqr(x1, z)
+	for i := 0; i < 26; i++ {
+		Sqr(x1, x1)
+	}
+	Mul(x1, x1, z)
+	Sqr(z, x1)
+	for i := 0; i < 53; i++ {
+		Sqr(z, z)
+	}
+	Mul(z, z, x1)
+	Sqr(z, z)
+	Sqr(z, z)
+	Sqr(z, z)
+	Mul(z, z, x0)
+	Sqr(x1, z)
+	for i := 0; i < 110; i++ {
+		Sqr(x1, x1)
+	}
+	Mul(x1, x1, z)
+	Sqr(z, x1)
+	Mul(z, z, x)
+	for i := 0; i < 223; i++ {
+		Sqr(z, z)
+	}
+	Mul(z, z, x1)
+}
+
+// Cmov assigns y to x if n is 1.
+func Cmov(x, y *Elt, n uint) { cmov(x, y, n) }
+
+// Cswap interchanges x and y if n is 1.
+func Cswap(x, y *Elt, n uint) { cswap(x, y, n) }
+
+// Add calculates z = x+y mod p.
+func Add(z, x, y *Elt) { add(z, x, y) }
+
+// Sub calculates z = x-y mod p.
+func Sub(z, x, y *Elt) { sub(z, x, y) }
+
+// AddSub calculates (x,y) = (x+y mod p, x-y mod p).
+func AddSub(x, y *Elt) { addsub(x, y) }
+
+// Mul calculates z = x*y mod p.
+func Mul(z, x, y *Elt) { mul(z, x, y) }
+
+// Sqr calculates z = x^2 mod p.
+func Sqr(z, x *Elt) { sqr(z, x) }
diff --git a/.ci/providerlint/vendor/github.com/cloudflare/circl/math/fp448/fp_amd64.go b/.ci/providerlint/vendor/github.com/cloudflare/circl/math/fp448/fp_amd64.go
new file mode 100644
index 00000000000..6a12209a704
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/cloudflare/circl/math/fp448/fp_amd64.go
@@ -0,0 +1,43 @@
+//go:build amd64 && !purego
+// +build amd64,!purego
+
+package fp448
+
+import (
+	"golang.org/x/sys/cpu"
+)
+
+var hasBmi2Adx = cpu.X86.HasBMI2 && cpu.X86.HasADX
+
+var _ = hasBmi2Adx
+
+func cmov(x, y *Elt, n uint)  { cmovAmd64(x, y, n) }
+func cswap(x, y *Elt, n uint) { cswapAmd64(x, y, n) }
+func add(z, x, y *Elt)        { addAmd64(z, x, y) }
+func sub(z, x, y *Elt)        { subAmd64(z, x, y) }
+func addsub(x, y *Elt)        { addsubAmd64(x, y) }
+func mul(z, x, y *Elt)        { mulAmd64(z, x, y) }
+func sqr(z, x *Elt)           { sqrAmd64(z, x) }
+
+/* Functions defined in fp_amd64.s */
+
+//go:noescape
+func cmovAmd64(x, y *Elt, n uint)
+
+//go:noescape
+func cswapAmd64(x, y *Elt, n uint)
+
+//go:noescape
+func addAmd64(z, x, y *Elt)
+
+//go:noescape
+func subAmd64(z, x, y *Elt)
+
+//go:noescape
+func addsubAmd64(x, y *Elt)
+
+//go:noescape
+func mulAmd64(z, x, y *Elt)
+
+//go:noescape
+func sqrAmd64(z, x *Elt)
diff --git a/.ci/providerlint/vendor/github.com/cloudflare/circl/math/fp448/fp_amd64.h b/.ci/providerlint/vendor/github.com/cloudflare/circl/math/fp448/fp_amd64.h
new file mode 100644
index 00000000000..536fe5bdfe0
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/cloudflare/circl/math/fp448/fp_amd64.h
@@ -0,0 +1,591 @@
+// This code was imported from https://github.com/armfazh/rfc7748_precomputed
+
+// CHECK_BMI2ADX triggers bmi2adx if supported,
+// otherwise it fallbacks to legacy code.
+#define CHECK_BMI2ADX(label, legacy, bmi2adx) \
+    CMPB ·hasBmi2Adx(SB), $0  \
+    JE label                  \
+    bmi2adx                   \
+    RET                       \
+    label:                    \
+    legacy                    \
+    RET
+
+// cselect is a conditional move
+// if b=1: it copies y into x;
+// if b=0: x remains with the same value;
+// if b<> 0,1: undefined.
+// Uses: AX, DX, FLAGS
+// Instr: x86_64, cmov
+#define cselect(x,y,b) \
+    TESTQ b, b \
+    MOVQ  0+x, AX; MOVQ  0+y, DX; CMOVQNE DX, AX; MOVQ AX,  0+x; \
+    MOVQ  8+x, AX; MOVQ  8+y, DX; CMOVQNE DX, AX; MOVQ AX,  8+x; \
+    MOVQ 16+x, AX; MOVQ 16+y, DX; CMOVQNE DX, AX; MOVQ AX, 16+x; \
+    MOVQ 24+x, AX; MOVQ 24+y, DX; CMOVQNE DX, AX; MOVQ AX, 24+x; \
+    MOVQ 32+x, AX; MOVQ 32+y, DX; CMOVQNE DX, AX; MOVQ AX, 32+x; \
+    MOVQ 40+x, AX; MOVQ 40+y, DX; CMOVQNE DX, AX; MOVQ AX, 40+x; \
+    MOVQ 48+x, AX; MOVQ 48+y, DX; CMOVQNE DX, AX; MOVQ AX, 48+x;
+
+// cswap is a conditional swap
+// if b=1: x,y <- y,x;
+// if b=0: x,y remain with the same values;
+// if b<> 0,1: undefined.
+// Uses: AX, DX, R8, FLAGS
+// Instr: x86_64, cmov
+#define cswap(x,y,b) \
+    TESTQ b, b \
+    MOVQ  0+x, AX; MOVQ AX, R8; MOVQ  0+y, DX; CMOVQNE DX, AX; CMOVQNE R8, DX; MOVQ AX,  0+x; MOVQ DX,  0+y; \
+    MOVQ  8+x, AX; MOVQ AX, R8; MOVQ  8+y, DX; CMOVQNE DX, AX; CMOVQNE R8, DX; MOVQ AX,  8+x; MOVQ DX,  8+y; \
+    MOVQ 16+x, AX; MOVQ AX, R8; MOVQ 16+y, DX; CMOVQNE DX, AX; CMOVQNE R8, DX; MOVQ AX, 16+x; MOVQ DX, 16+y; \
+    MOVQ 24+x, AX; MOVQ AX, R8; MOVQ 24+y, DX; CMOVQNE DX, AX; CMOVQNE R8, DX; MOVQ AX, 24+x; MOVQ DX, 24+y; \
+    MOVQ 32+x, AX; MOVQ AX, R8; MOVQ 32+y, DX; CMOVQNE DX, AX; CMOVQNE R8, DX; MOVQ AX, 32+x; MOVQ DX, 32+y; \
+    MOVQ 40+x, AX; MOVQ AX, R8; MOVQ 40+y, DX; CMOVQNE DX, AX; CMOVQNE R8, DX; MOVQ AX, 40+x; MOVQ DX, 40+y; \
+    MOVQ 48+x, AX; MOVQ AX, R8; MOVQ 48+y, DX; CMOVQNE DX, AX; CMOVQNE R8, DX; MOVQ AX, 48+x; MOVQ DX, 48+y;
+
+// additionLeg adds x and y and stores in z
+// Uses: AX, DX, R8-R14, FLAGS
+// Instr: x86_64
+#define additionLeg(z,x,y) \
+    MOVQ  0+x,  R8;  ADDQ  0+y,  R8; \
+    MOVQ  8+x,  R9;  ADCQ  8+y,  R9; \
+    MOVQ 16+x, R10;  ADCQ 16+y, R10; \
+    MOVQ 24+x, R11;  ADCQ 24+y, R11; \
+    MOVQ 32+x, R12;  ADCQ 32+y, R12; \
+    MOVQ 40+x, R13;  ADCQ 40+y, R13; \
+    MOVQ 48+x, R14;  ADCQ 48+y, R14; \
+    MOVQ   $0,  AX;  ADCQ   $0,  AX; \
+    MOVQ AX,  DX; \
+    SHLQ $32, DX; \
+    ADDQ AX,  R8; MOVQ  $0, AX; \
+    ADCQ $0,  R9; \
+    ADCQ $0, R10; \
+    ADCQ DX, R11; \
+    ADCQ $0, R12; \
+    ADCQ $0, R13; \
+    ADCQ $0, R14; \
+    ADCQ $0,  AX; \
+    MOVQ AX,  DX; \
+    SHLQ $32, DX; \
+    ADDQ AX,  R8;  MOVQ  R8,  0+z; \
+    ADCQ $0,  R9;  MOVQ  R9,  8+z; \
+    ADCQ $0, R10;  MOVQ R10, 16+z; \
+    ADCQ DX, R11;  MOVQ R11, 24+z; \
+    ADCQ $0, R12;  MOVQ R12, 32+z; \
+    ADCQ $0, R13;  MOVQ R13, 40+z; \
+    ADCQ $0, R14;  MOVQ R14, 48+z;
+
+
+// additionAdx adds x and y and stores in z
+// Uses: AX, DX, R8-R15, FLAGS
+// Instr: x86_64, adx
+#define additionAdx(z,x,y) \
+    MOVL $32, R15; \
+    XORL DX, DX; \
+    MOVQ  0+x,  R8;  ADCXQ  0+y,  R8; \
+    MOVQ  8+x,  R9;  ADCXQ  8+y,  R9; \
+    MOVQ 16+x, R10;  ADCXQ 16+y, R10; \
+    MOVQ 24+x, R11;  ADCXQ 24+y, R11; \
+    MOVQ 32+x, R12;  ADCXQ 32+y, R12; \
+    MOVQ 40+x, R13;  ADCXQ 40+y, R13; \
+    MOVQ 48+x, R14;  ADCXQ 48+y, R14; \
+    ;;;;;;;;;;;;;;;  ADCXQ   DX,  DX; \
+    XORL AX, AX; \
+    ADCXQ DX,  R8; SHLXQ R15, DX, DX; \
+    ADCXQ AX,  R9; \
+    ADCXQ AX, R10; \
+    ADCXQ DX, R11; \
+    ADCXQ AX, R12; \
+    ADCXQ AX, R13; \
+    ADCXQ AX, R14; \
+    ADCXQ AX,  AX; \
+    XORL  DX,  DX; \
+    ADCXQ AX,  R8;  MOVQ  R8,  0+z; SHLXQ R15, AX, AX; \
+    ADCXQ DX,  R9;  MOVQ  R9,  8+z; \
+    ADCXQ DX, R10;  MOVQ R10, 16+z; \
+    ADCXQ AX, R11;  MOVQ R11, 24+z; \
+    ADCXQ DX, R12;  MOVQ R12, 32+z; \
+    ADCXQ DX, R13;  MOVQ R13, 40+z; \
+    ADCXQ DX, R14;  MOVQ R14, 48+z;
+
+// subtraction subtracts y from x and stores in z
+// Uses: AX, DX, R8-R14, FLAGS
+// Instr: x86_64
+#define subtraction(z,x,y) \
+    MOVQ  0+x,  R8;  SUBQ  0+y,  R8; \
+    MOVQ  8+x,  R9;  SBBQ  8+y,  R9; \
+    MOVQ 16+x, R10;  SBBQ 16+y, R10; \
+    MOVQ 24+x, R11;  SBBQ 24+y, R11; \
+    MOVQ 32+x, R12;  SBBQ 32+y, R12; \
+    MOVQ 40+x, R13;  SBBQ 40+y, R13; \
+    MOVQ 48+x, R14;  SBBQ 48+y, R14; \
+    MOVQ   $0,  AX;  SETCS AX; \
+    MOVQ AX,  DX; \
+    SHLQ $32, DX; \
+    SUBQ AX,  R8; MOVQ  $0, AX; \
+    SBBQ $0,  R9; \
+    SBBQ $0, R10; \
+    SBBQ DX, R11; \
+    SBBQ $0, R12; \
+    SBBQ $0, R13; \
+    SBBQ $0, R14; \
+    SETCS AX; \
+    MOVQ AX,  DX; \
+    SHLQ $32, DX; \
+    SUBQ AX,  R8;  MOVQ  R8,  0+z; \
+    SBBQ $0,  R9;  MOVQ  R9,  8+z; \
+    SBBQ $0, R10;  MOVQ R10, 16+z; \
+    SBBQ DX, R11;  MOVQ R11, 24+z; \
+    SBBQ $0, R12;  MOVQ R12, 32+z; \
+    SBBQ $0, R13;  MOVQ R13, 40+z; \
+    SBBQ $0, R14;  MOVQ R14, 48+z;
+
+// maddBmi2Adx multiplies x and y and accumulates in z
+// Uses: AX, DX, R15, FLAGS
+// Instr: x86_64, bmi2, adx
+#define maddBmi2Adx(z,x,y,i,r0,r1,r2,r3,r4,r5,r6) \
+    MOVQ   i+y, DX; XORL AX, AX; \
+    MULXQ  0+x, AX, R8;  ADOXQ AX, r0;  ADCXQ R8, r1; MOVQ r0,i+z; \
+    MULXQ  8+x, AX, r0;  ADOXQ AX, r1;  ADCXQ r0, r2; MOVQ $0, R8; \
+    MULXQ 16+x, AX, r0;  ADOXQ AX, r2;  ADCXQ r0, r3; \
+    MULXQ 24+x, AX, r0;  ADOXQ AX, r3;  ADCXQ r0, r4; \
+    MULXQ 32+x, AX, r0;  ADOXQ AX, r4;  ADCXQ r0, r5; \
+    MULXQ 40+x, AX, r0;  ADOXQ AX, r5;  ADCXQ r0, r6; \
+    MULXQ 48+x, AX, r0;  ADOXQ AX, r6;  ADCXQ R8, r0; \
+    ;;;;;;;;;;;;;;;;;;;  ADOXQ R8, r0;
+
+// integerMulAdx multiplies x and y and stores in z
+// Uses: AX, DX, R8-R15, FLAGS
+// Instr: x86_64, bmi2, adx
+#define integerMulAdx(z,x,y) \
+    MOVL    $0,R15; \
+    MOVQ   0+y, DX;  XORL AX, AX;  MOVQ $0, R8; \
+    MULXQ  0+x, AX,  R9;  MOVQ  AX, 0+z; \
+    MULXQ  8+x, AX, R10;  ADCXQ AX,  R9; \
+    MULXQ 16+x, AX, R11;  ADCXQ AX, R10; \
+    MULXQ 24+x, AX, R12;  ADCXQ AX, R11; \
+    MULXQ 32+x, AX, R13;  ADCXQ AX, R12; \
+    MULXQ 40+x, AX, R14;  ADCXQ AX, R13; \
+    MULXQ 48+x, AX, R15;  ADCXQ AX, R14; \
+    ;;;;;;;;;;;;;;;;;;;;  ADCXQ R8, R15; \
+    maddBmi2Adx(z,x,y, 8, R9,R10,R11,R12,R13,R14,R15) \
+    maddBmi2Adx(z,x,y,16,R10,R11,R12,R13,R14,R15, R9) \
+    maddBmi2Adx(z,x,y,24,R11,R12,R13,R14,R15, R9,R10) \
+    maddBmi2Adx(z,x,y,32,R12,R13,R14,R15, R9,R10,R11) \
+    maddBmi2Adx(z,x,y,40,R13,R14,R15, R9,R10,R11,R12) \
+    maddBmi2Adx(z,x,y,48,R14,R15, R9,R10,R11,R12,R13) \
+    MOVQ R15,  56+z; \
+    MOVQ  R9,  64+z; \
+    MOVQ R10,  72+z; \
+    MOVQ R11,  80+z; \
+    MOVQ R12,  88+z; \
+    MOVQ R13,  96+z; \
+    MOVQ R14, 104+z;
+
+// maddLegacy multiplies x and y and accumulates in z
+// Uses: AX, DX, R15, FLAGS
+// Instr: x86_64
+#define maddLegacy(z,x,y,i) \
+    MOVQ  i+y, R15; \
+    MOVQ  0+x, AX; MULQ R15; MOVQ AX,  R8; ;;;;;;;;;;;; MOVQ DX,  R9; \
+    MOVQ  8+x, AX; MULQ R15; ADDQ AX,  R9; ADCQ $0, DX; MOVQ DX, R10; \
+    MOVQ 16+x, AX; MULQ R15; ADDQ AX, R10; ADCQ $0, DX; MOVQ DX, R11; \
+    MOVQ 24+x, AX; MULQ R15; ADDQ AX, R11; ADCQ $0, DX; MOVQ DX, R12; \
+    MOVQ 32+x, AX; MULQ R15; ADDQ AX, R12; ADCQ $0, DX; MOVQ DX, R13; \
+    MOVQ 40+x, AX; MULQ R15; ADDQ AX, R13; ADCQ $0, DX; MOVQ DX, R14; \
+    MOVQ 48+x, AX; MULQ R15; ADDQ AX, R14; ADCQ $0, DX; \
+    ADDQ  0+i+z,  R8; MOVQ  R8,  0+i+z; \
+    ADCQ  8+i+z,  R9; MOVQ  R9,  8+i+z; \
+    ADCQ 16+i+z, R10; MOVQ R10, 16+i+z; \
+    ADCQ 24+i+z, R11; MOVQ R11, 24+i+z; \
+    ADCQ 32+i+z, R12; MOVQ R12, 32+i+z; \
+    ADCQ 40+i+z, R13; MOVQ R13, 40+i+z; \
+    ADCQ 48+i+z, R14; MOVQ R14, 48+i+z; \
+    ADCQ     $0,  DX; MOVQ  DX, 56+i+z;
+
+// integerMulLeg multiplies x and y and stores in z
+// Uses: AX, DX, R8-R15, FLAGS
+// Instr: x86_64
+#define integerMulLeg(z,x,y) \
+    MOVQ  0+y, R15; \
+    MOVQ  0+x, AX; MULQ R15; MOVQ AX, 0+z; ;;;;;;;;;;;; MOVQ DX,  R8; \
+    MOVQ  8+x, AX; MULQ R15; ADDQ AX,  R8; ADCQ $0, DX; MOVQ DX,  R9; MOVQ  R8,  8+z; \
+    MOVQ 16+x, AX; MULQ R15; ADDQ AX,  R9; ADCQ $0, DX; MOVQ DX, R10; MOVQ  R9, 16+z; \
+    MOVQ 24+x, AX; MULQ R15; ADDQ AX, R10; ADCQ $0, DX; MOVQ DX, R11; MOVQ R10, 24+z; \
+    MOVQ 32+x, AX; MULQ R15; ADDQ AX, R11; ADCQ $0, DX; MOVQ DX, R12; MOVQ R11, 32+z; \
+    MOVQ 40+x, AX; MULQ R15; ADDQ AX, R12; ADCQ $0, DX; MOVQ DX, R13; MOVQ R12, 40+z; \
+    MOVQ 48+x, AX; MULQ R15; ADDQ AX, R13; ADCQ $0, DX; MOVQ DX,56+z; MOVQ R13, 48+z; \
+    maddLegacy(z,x,y, 8) \
+    maddLegacy(z,x,y,16) \
+    maddLegacy(z,x,y,24) \
+    maddLegacy(z,x,y,32) \
+    maddLegacy(z,x,y,40) \
+    maddLegacy(z,x,y,48)
+
+// integerSqrLeg squares x and stores in z
+// Uses: AX, CX, DX, R8-R15, FLAGS
+// Instr: x86_64
+#define integerSqrLeg(z,x) \
+    XORL R15, R15; \
+    MOVQ  0+x, CX; \
+    MOVQ   CX, AX; MULQ CX; MOVQ AX, 0+z; MOVQ DX, R8; \
+    ADDQ   CX, CX; ADCQ $0, R15; \
+    MOVQ  8+x, AX; MULQ CX; ADDQ AX,  R8; ADCQ $0, DX; MOVQ DX,  R9; MOVQ R8, 8+z; \
+    MOVQ 16+x, AX; MULQ CX; ADDQ AX,  R9; ADCQ $0, DX; MOVQ DX, R10; \
+    MOVQ 24+x, AX; MULQ CX; ADDQ AX, R10; ADCQ $0, DX; MOVQ DX, R11; \
+    MOVQ 32+x, AX; MULQ CX; ADDQ AX, R11; ADCQ $0, DX; MOVQ DX, R12; \
+    MOVQ 40+x, AX; MULQ CX; ADDQ AX, R12; ADCQ $0, DX; MOVQ DX, R13; \
+    MOVQ 48+x, AX; MULQ CX; ADDQ AX, R13; ADCQ $0, DX; MOVQ DX, R14; \
+    \
+    MOVQ  8+x, CX; \
+    MOVQ   CX, AX; ADDQ R15, CX; MOVQ $0, R15; ADCQ $0, R15; \
+    ;;;;;;;;;;;;;; MULQ CX; ADDQ  AX, R9; ADCQ $0, DX; MOVQ R9,16+z; \
+    MOVQ  R15, AX; NEGQ AX; ANDQ 8+x, AX; ADDQ AX, DX; ADCQ $0, R11; MOVQ DX, R8; \
+    ADDQ  8+x, CX; ADCQ $0, R15; \
+    MOVQ 16+x, AX; MULQ CX; ADDQ AX, R10; ADCQ $0, DX; ADDQ R8, R10; ADCQ $0, DX; MOVQ DX, R8; MOVQ R10, 24+z; \
+    MOVQ 24+x, AX; MULQ CX; ADDQ AX, R11; ADCQ $0, DX; ADDQ R8, R11; ADCQ $0, DX; MOVQ DX, R8; \
+    MOVQ 32+x, AX; MULQ CX; ADDQ AX, R12; ADCQ $0, DX; ADDQ R8, R12; ADCQ $0, DX; MOVQ DX, R8; \
+    MOVQ 40+x, AX; MULQ CX; ADDQ AX, R13; ADCQ $0, DX; ADDQ R8, R13; ADCQ $0, DX; MOVQ DX, R8; \
+    MOVQ 48+x, AX; MULQ CX; ADDQ AX, R14; ADCQ $0, DX; ADDQ R8, R14; ADCQ $0, DX; MOVQ DX, R9; \
+    \
+    MOVQ 16+x, CX; \
+    MOVQ   CX, AX; ADDQ R15, CX; MOVQ $0, R15; ADCQ $0, R15; \
+    ;;;;;;;;;;;;;; MULQ CX; ADDQ AX, R11; ADCQ $0, DX; MOVQ R11, 32+z; \
+    MOVQ  R15, AX; NEGQ AX; ANDQ 16+x,AX; ADDQ AX, DX; ADCQ $0, R13; MOVQ DX, R8; \
+    ADDQ 16+x, CX; ADCQ $0, R15; \
+    MOVQ 24+x, AX; MULQ CX; ADDQ AX, R12; ADCQ $0, DX; ADDQ R8, R12; ADCQ $0, DX; MOVQ DX, R8; MOVQ R12, 40+z; \
+    MOVQ 32+x, AX; MULQ CX; ADDQ AX, R13; ADCQ $0, DX; ADDQ R8, R13; ADCQ $0, DX; MOVQ DX, R8; \
+    MOVQ 40+x, AX; MULQ CX; ADDQ AX, R14; ADCQ $0, DX; ADDQ R8, R14; ADCQ $0, DX; MOVQ DX, R8; \
+    MOVQ 48+x, AX; MULQ CX; ADDQ AX,  R9; ADCQ $0, DX; ADDQ R8,  R9; ADCQ $0, DX; MOVQ DX,R10; \
+    \
+    MOVQ 24+x, CX; \
+    MOVQ   CX, AX; ADDQ R15, CX; MOVQ $0, R15; ADCQ $0, R15; \
+    ;;;;;;;;;;;;;; MULQ CX; ADDQ AX, R13; ADCQ $0, DX; MOVQ R13, 48+z; \
+    MOVQ  R15, AX; NEGQ AX; ANDQ 24+x,AX; ADDQ AX, DX; ADCQ $0,  R9; MOVQ DX, R8; \
+    ADDQ 24+x, CX; ADCQ $0, R15; \
+    MOVQ 32+x, AX; MULQ CX; ADDQ AX, R14; ADCQ $0, DX; ADDQ R8, R14; ADCQ $0, DX; MOVQ DX, R8; MOVQ R14, 56+z; \
+    MOVQ 40+x, AX; MULQ CX; ADDQ AX,  R9; ADCQ $0, DX; ADDQ R8,  R9; ADCQ $0, DX; MOVQ DX, R8; \
+    MOVQ 48+x, AX; MULQ CX; ADDQ AX, R10; ADCQ $0, DX; ADDQ R8, R10; ADCQ $0, DX; MOVQ DX,R11; \
+    \
+    MOVQ 32+x, CX; \
+    MOVQ   CX, AX; ADDQ R15, CX; MOVQ $0, R15; ADCQ $0, R15; \
+    ;;;;;;;;;;;;;; MULQ CX; ADDQ AX,  R9; ADCQ $0, DX; MOVQ R9, 64+z; \
+    MOVQ  R15, AX; NEGQ AX; ANDQ 32+x,AX; ADDQ AX, DX; ADCQ $0, R11; MOVQ DX, R8; \
+    ADDQ 32+x, CX; ADCQ $0, R15; \
+    MOVQ 40+x, AX; MULQ CX; ADDQ AX, R10; ADCQ $0, DX; ADDQ R8, R10; ADCQ $0, DX; MOVQ DX, R8; MOVQ R10, 72+z; \
+    MOVQ 48+x, AX; MULQ CX; ADDQ AX, R11; ADCQ $0, DX; ADDQ R8, R11; ADCQ $0, DX; MOVQ DX,R12; \
+    \
+    XORL R13, R13; \
+    XORL R14, R14; \
+    MOVQ 40+x, CX; \
+    MOVQ   CX, AX; ADDQ R15, CX; MOVQ $0, R15; ADCQ $0, R15; \
+    ;;;;;;;;;;;;;; MULQ CX; ADDQ AX, R11; ADCQ $0, DX; MOVQ R11, 80+z; \
+    MOVQ  R15, AX; NEGQ AX; ANDQ 40+x,AX; ADDQ AX, DX; ADCQ $0, R13; MOVQ DX, R8; \
+    ADDQ 40+x, CX; ADCQ $0, R15; \
+    MOVQ 48+x, AX; MULQ CX; ADDQ AX, R12; ADCQ $0, DX; ADDQ R8, R12; ADCQ $0, DX; MOVQ DX, R8; MOVQ R12, 88+z; \
+    ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ADDQ R8, R13; ADCQ $0,R14; \
+    \
+    XORL   R9, R9; \
+    MOVQ 48+x, CX; \
+    MOVQ   CX, AX; ADDQ R15, CX; MOVQ $0, R15; ADCQ $0, R15; \
+    ;;;;;;;;;;;;;; MULQ CX; ADDQ AX, R13; ADCQ $0, DX; MOVQ R13, 96+z; \
+    MOVQ  R15, AX; NEGQ AX; ANDQ 48+x,AX; ADDQ AX, DX; ADCQ $0, R9; MOVQ DX, R8; \
+    ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ADDQ R8,R14; ADCQ $0, R9; MOVQ R14, 104+z;
+
+
+// integerSqrAdx squares x and stores in z
+// Uses: AX, CX, DX, R8-R15, FLAGS
+// Instr: x86_64, bmi2, adx
+#define integerSqrAdx(z,x) \
+    XORL R15, R15; \
+    MOVQ  0+x, DX; \
+    ;;;;;;;;;;;;;; MULXQ DX, AX, R8; MOVQ AX, 0+z; \
+    ADDQ   DX, DX; ADCQ $0, R15; CLC; \
+    MULXQ  8+x, AX,  R9; ADCXQ AX,  R8; MOVQ R8, 8+z; \
+    MULXQ 16+x, AX, R10; ADCXQ AX,  R9; MOVQ $0, R8;\
+    MULXQ 24+x, AX, R11; ADCXQ AX, R10; \
+    MULXQ 32+x, AX, R12; ADCXQ AX, R11; \
+    MULXQ 40+x, AX, R13; ADCXQ AX, R12; \
+    MULXQ 48+x, AX, R14; ADCXQ AX, R13; \
+    ;;;;;;;;;;;;;;;;;;;; ADCXQ R8, R14; \
+    \
+    MOVQ  8+x, DX; \
+    MOVQ   DX, AX; ADDQ R15, DX; MOVQ $0, R15; ADCQ  $0, R15; \
+    MULXQ AX,  AX, CX; \
+    MOVQ R15,  R8; NEGQ R8; ANDQ 8+x, R8; \
+    ADDQ AX,  R9; MOVQ R9, 16+z; \
+    ADCQ CX,  R8; \
+    ADCQ $0, R11; \
+    ADDQ  8+x,  DX; \
+    ADCQ   $0, R15; \
+    XORL R9, R9; ;;;;;;;;;;;;;;;;;;;;; ADOXQ R8, R10; \
+    MULXQ 16+x, AX, CX; ADCXQ AX, R10; ADOXQ CX, R11; MOVQ R10, 24+z; \
+    MULXQ 24+x, AX, CX; ADCXQ AX, R11; ADOXQ CX, R12; MOVQ  $0, R10; \
+    MULXQ 32+x, AX, CX; ADCXQ AX, R12; ADOXQ CX, R13; \
+    MULXQ 40+x, AX, CX; ADCXQ AX, R13; ADOXQ CX, R14; \
+    MULXQ 48+x, AX, CX; ADCXQ AX, R14; ADOXQ CX,  R9; \
+    ;;;;;;;;;;;;;;;;;;; ADCXQ R10, R9; \
+    \
+    MOVQ 16+x, DX; \
+    MOVQ   DX, AX; ADDQ R15, DX; MOVQ $0, R15; ADCQ  $0, R15; \
+    MULXQ AX,  AX, CX; \
+    MOVQ R15,  R8; NEGQ R8; ANDQ 16+x, R8; \
+    ADDQ AX, R11; MOVQ R11, 32+z; \
+    ADCQ CX,  R8; \
+    ADCQ $0, R13; \
+    ADDQ 16+x,  DX; \
+    ADCQ   $0, R15; \
+    XORL R11, R11; ;;;;;;;;;;;;;;;;;;; ADOXQ R8, R12; \
+    MULXQ 24+x, AX, CX; ADCXQ AX, R12; ADOXQ CX, R13; MOVQ R12, 40+z; \
+    MULXQ 32+x, AX, CX; ADCXQ AX, R13; ADOXQ CX, R14; MOVQ  $0, R12; \
+    MULXQ 40+x, AX, CX; ADCXQ AX, R14; ADOXQ CX,  R9; \
+    MULXQ 48+x, AX, CX; ADCXQ AX,  R9; ADOXQ CX, R10; \
+    ;;;;;;;;;;;;;;;;;;; ADCXQ R11,R10; \
+    \
+    MOVQ 24+x, DX; \
+    MOVQ   DX, AX; ADDQ R15, DX; MOVQ $0, R15; ADCQ  $0, R15; \
+    MULXQ AX,  AX, CX; \
+    MOVQ R15,  R8; NEGQ R8; ANDQ 24+x, R8; \
+    ADDQ AX, R13; MOVQ R13, 48+z; \
+    ADCQ CX,  R8; \
+    ADCQ $0,  R9; \
+    ADDQ 24+x,  DX; \
+    ADCQ   $0, R15; \
+    XORL R13, R13; ;;;;;;;;;;;;;;;;;;; ADOXQ R8, R14; \
+    MULXQ 32+x, AX, CX; ADCXQ AX, R14; ADOXQ CX,  R9; MOVQ R14, 56+z; \
+    MULXQ 40+x, AX, CX; ADCXQ AX,  R9; ADOXQ CX, R10; MOVQ  $0, R14; \
+    MULXQ 48+x, AX, CX; ADCXQ AX, R10; ADOXQ CX, R11; \
+    ;;;;;;;;;;;;;;;;;;; ADCXQ R12,R11; \
+    \
+    MOVQ 32+x, DX; \
+    MOVQ   DX, AX; ADDQ R15, DX; MOVQ $0, R15; ADCQ  $0, R15; \
+    MULXQ AX,  AX, CX; \
+    MOVQ R15,  R8; NEGQ R8; ANDQ 32+x, R8; \
+    ADDQ AX,  R9; MOVQ R9, 64+z; \
+    ADCQ CX,  R8; \
+    ADCQ $0, R11; \
+    ADDQ 32+x,  DX; \
+    ADCQ   $0, R15; \
+    XORL R9, R9; ;;;;;;;;;;;;;;;;;;;;; ADOXQ R8, R10; \
+    MULXQ 40+x, AX, CX; ADCXQ AX, R10; ADOXQ CX, R11; MOVQ R10, 72+z; \
+    MULXQ 48+x, AX, CX; ADCXQ AX, R11; ADOXQ CX, R12; \
+    ;;;;;;;;;;;;;;;;;;; ADCXQ R13,R12; \
+    \
+    MOVQ 40+x, DX; \
+    MOVQ   DX, AX; ADDQ R15, DX; MOVQ $0, R15; ADCQ  $0, R15; \
+    MULXQ AX,  AX, CX; \
+    MOVQ R15,  R8; NEGQ R8; ANDQ 40+x, R8; \
+    ADDQ AX, R11; MOVQ R11, 80+z; \
+    ADCQ CX,  R8; \
+    ADCQ $0, R13; \
+    ADDQ 40+x,  DX; \
+    ADCQ   $0, R15; \
+    XORL R11, R11; ;;;;;;;;;;;;;;;;;;; ADOXQ R8, R12; \
+    MULXQ 48+x, AX, CX; ADCXQ AX, R12; ADOXQ CX, R13; MOVQ R12, 88+z; \
+    ;;;;;;;;;;;;;;;;;;; ADCXQ R14,R13; \
+    \
+    MOVQ 48+x, DX; \
+    MOVQ   DX, AX; ADDQ R15, DX; MOVQ $0, R15; ADCQ  $0, R15; \
+    MULXQ AX,  AX, CX; \
+    MOVQ R15,  R8; NEGQ R8; ANDQ 48+x, R8; \
+    XORL R10, R10; ;;;;;;;;;;;;;; ADOXQ CX, R14; \
+    ;;;;;;;;;;;;;; ADCXQ AX, R13; ;;;;;;;;;;;;;; MOVQ R13, 96+z; \
+    ;;;;;;;;;;;;;; ADCXQ R8, R14; MOVQ R14, 104+z;
+
+// reduceFromDoubleLeg finds a z=x modulo p such that z<2^448 and stores in z
+// Uses: AX, R8-R15, FLAGS
+// Instr: x86_64
+#define reduceFromDoubleLeg(z,x) \
+    /* (   ,2C13,2C12,2C11,2C10|C10,C9,C8, C7) + (C6,...,C0) */ \
+    /* (r14, r13, r12, r11,     r10,r9,r8,r15) */ \
+    MOVQ 80+x,AX; MOVQ AX,R10; \
+    MOVQ $0xFFFFFFFF00000000, R8; \
+    ANDQ R8,R10; \
+    \
+    MOVQ $0,R14; \
+    MOVQ 104+x,R13; SHLQ $1,R13,R14; \
+    MOVQ  96+x,R12; SHLQ $1,R12,R13; \
+    MOVQ  88+x,R11; SHLQ $1,R11,R12; \
+    MOVQ  72+x, R9; SHLQ $1,R10,R11; \
+    MOVQ  64+x, R8; SHLQ $1,R10; \
+    MOVQ $0xFFFFFFFF,R15; ANDQ R15,AX; ORQ AX,R10; \
+    MOVQ  56+x,R15; \
+    \
+    ADDQ  0+x,R15; MOVQ R15, 0+z; MOVQ  56+x,R15; \
+    ADCQ  8+x, R8; MOVQ  R8, 8+z; MOVQ  64+x, R8; \
+    ADCQ 16+x, R9; MOVQ  R9,16+z; MOVQ  72+x, R9; \
+    ADCQ 24+x,R10; MOVQ R10,24+z; MOVQ  80+x,R10; \
+    ADCQ 32+x,R11; MOVQ R11,32+z; MOVQ  88+x,R11; \
+    ADCQ 40+x,R12; MOVQ R12,40+z; MOVQ  96+x,R12; \
+    ADCQ 48+x,R13; MOVQ R13,48+z; MOVQ 104+x,R13; \
+    ADCQ   $0,R14; \
+    /* (c10c9,c9c8,c8c7,c7c13,c13c12,c12c11,c11c10) + (c6,...,c0) */ \
+    /* (   r9,  r8, r15,  r13,   r12,   r11,   r10) */ \
+    MOVQ R10, AX; \
+    SHRQ $32,R11,R10; \
+    SHRQ $32,R12,R11; \
+    SHRQ $32,R13,R12; \
+    SHRQ $32,R15,R13; \
+    SHRQ $32, R8,R15; \
+    SHRQ $32, R9, R8; \
+    SHRQ $32, AX, R9; \
+    \
+    ADDQ  0+z,R10; \
+    ADCQ  8+z,R11; \
+    ADCQ 16+z,R12; \
+    ADCQ 24+z,R13; \
+    ADCQ 32+z,R15; \
+    ADCQ 40+z, R8; \
+    ADCQ 48+z, R9; \
+    ADCQ   $0,R14; \
+    /* ( c7) + (c6,...,c0) */ \
+    /* (r14) */ \
+    MOVQ R14, AX; SHLQ $32, AX; \
+    ADDQ R14,R10; MOVQ  $0,R14; \
+    ADCQ  $0,R11; \
+    ADCQ  $0,R12; \
+    ADCQ  AX,R13; \
+    ADCQ  $0,R15; \
+    ADCQ  $0, R8; \
+    ADCQ  $0, R9; \
+    ADCQ  $0,R14; \
+    /* ( c7) + (c6,...,c0) */ \
+    /* (r14) */ \
+    MOVQ R14, AX; SHLQ $32,AX; \
+    ADDQ R14,R10; MOVQ R10, 0+z; \
+    ADCQ  $0,R11; MOVQ R11, 8+z; \
+    ADCQ  $0,R12; MOVQ R12,16+z; \
+    ADCQ  AX,R13; MOVQ R13,24+z; \
+    ADCQ  $0,R15; MOVQ R15,32+z; \
+    ADCQ  $0, R8; MOVQ  R8,40+z; \
+    ADCQ  $0, R9; MOVQ  R9,48+z;
+
+// reduceFromDoubleAdx finds a z=x modulo p such that z<2^448 and stores in z
+// Uses: AX, R8-R15, FLAGS
+// Instr: x86_64, adx
+#define reduceFromDoubleAdx(z,x) \
+    /* (   ,2C13,2C12,2C11,2C10|C10,C9,C8, C7) + (C6,...,C0) */ \
+    /* (r14, r13, r12, r11,     r10,r9,r8,r15) */ \
+    MOVQ 80+x,AX; MOVQ AX,R10; \
+    MOVQ $0xFFFFFFFF00000000, R8; \
+    ANDQ R8,R10; \
+    \
+    MOVQ $0,R14; \
+    MOVQ 104+x,R13; SHLQ $1,R13,R14; \
+    MOVQ  96+x,R12; SHLQ $1,R12,R13; \
+    MOVQ  88+x,R11; SHLQ $1,R11,R12; \
+    MOVQ  72+x, R9; SHLQ $1,R10,R11; \
+    MOVQ  64+x, R8; SHLQ $1,R10; \
+    MOVQ $0xFFFFFFFF,R15; ANDQ R15,AX; ORQ AX,R10; \
+    MOVQ  56+x,R15; \
+    \
+    XORL AX,AX; \
+    ADCXQ  0+x,R15; MOVQ R15, 0+z; MOVQ  56+x,R15; \
+    ADCXQ  8+x, R8; MOVQ  R8, 8+z; MOVQ  64+x, R8; \
+    ADCXQ 16+x, R9; MOVQ  R9,16+z; MOVQ  72+x, R9; \
+    ADCXQ 24+x,R10; MOVQ R10,24+z; MOVQ  80+x,R10; \
+    ADCXQ 32+x,R11; MOVQ R11,32+z; MOVQ  88+x,R11; \
+    ADCXQ 40+x,R12; MOVQ R12,40+z; MOVQ  96+x,R12; \
+    ADCXQ 48+x,R13; MOVQ R13,48+z; MOVQ 104+x,R13; \
+    ADCXQ   AX,R14; \
+    /* (c10c9,c9c8,c8c7,c7c13,c13c12,c12c11,c11c10) + (c6,...,c0) */ \
+    /* (   r9,  r8, r15,  r13,   r12,   r11,   r10) */ \
+    MOVQ R10, AX; \
+    SHRQ $32,R11,R10; \
+    SHRQ $32,R12,R11; \
+    SHRQ $32,R13,R12; \
+    SHRQ $32,R15,R13; \
+    SHRQ $32, R8,R15; \
+    SHRQ $32, R9, R8; \
+    SHRQ $32, AX, R9; \
+    \
+    XORL AX,AX; \
+    ADCXQ  0+z,R10; \
+    ADCXQ  8+z,R11; \
+    ADCXQ 16+z,R12; \
+    ADCXQ 24+z,R13; \
+    ADCXQ 32+z,R15; \
+    ADCXQ 40+z, R8; \
+    ADCXQ 48+z, R9; \
+    ADCXQ   AX,R14; \
+    /* ( c7) + (c6,...,c0) */ \
+    /* (r14) */ \
+    MOVQ R14, AX; SHLQ $32, AX; \
+    CLC; \
+    ADCXQ R14,R10; MOVQ $0,R14; \
+    ADCXQ R14,R11; \
+    ADCXQ R14,R12; \
+    ADCXQ  AX,R13; \
+    ADCXQ R14,R15; \
+    ADCXQ R14, R8; \
+    ADCXQ R14, R9; \
+    ADCXQ R14,R14; \
+    /* ( c7) + (c6,...,c0) */ \
+    /* (r14) */ \
+    MOVQ R14, AX; SHLQ $32, AX; \
+    CLC; \
+    ADCXQ R14,R10; MOVQ R10, 0+z; MOVQ $0,R14; \
+    ADCXQ R14,R11; MOVQ R11, 8+z; \
+    ADCXQ R14,R12; MOVQ R12,16+z; \
+    ADCXQ  AX,R13; MOVQ R13,24+z; \
+    ADCXQ R14,R15; MOVQ R15,32+z; \
+    ADCXQ R14, R8; MOVQ  R8,40+z; \
+    ADCXQ R14, R9; MOVQ  R9,48+z;
+
+// addSub calculates two operations: x,y = x+y,x-y
+// Uses: AX, DX, R8-R15, FLAGS
+#define addSub(x,y) \
+    MOVQ  0+x,  R8;  ADDQ  0+y,  R8; \
+    MOVQ  8+x,  R9;  ADCQ  8+y,  R9; \
+    MOVQ 16+x, R10;  ADCQ 16+y, R10; \
+    MOVQ 24+x, R11;  ADCQ 24+y, R11; \
+    MOVQ 32+x, R12;  ADCQ 32+y, R12; \
+    MOVQ 40+x, R13;  ADCQ 40+y, R13; \
+    MOVQ 48+x, R14;  ADCQ 48+y, R14; \
+    MOVQ   $0,  AX;  ADCQ   $0,  AX; \
+    MOVQ AX,  DX; \
+    SHLQ $32, DX; \
+    ADDQ AX,  R8; MOVQ  $0, AX; \
+    ADCQ $0,  R9; \
+    ADCQ $0, R10; \
+    ADCQ DX, R11; \
+    ADCQ $0, R12; \
+    ADCQ $0, R13; \
+    ADCQ $0, R14; \
+    ADCQ $0,  AX; \
+    MOVQ AX,  DX; \
+    SHLQ $32, DX; \
+    ADDQ AX,  R8;  MOVQ  0+x,AX; MOVQ  R8,  0+x; MOVQ AX,  R8; \
+    ADCQ $0,  R9;  MOVQ  8+x,AX; MOVQ  R9,  8+x; MOVQ AX,  R9; \
+    ADCQ $0, R10;  MOVQ 16+x,AX; MOVQ R10, 16+x; MOVQ AX, R10; \
+    ADCQ DX, R11;  MOVQ 24+x,AX; MOVQ R11, 24+x; MOVQ AX, R11; \
+    ADCQ $0, R12;  MOVQ 32+x,AX; MOVQ R12, 32+x; MOVQ AX, R12; \
+    ADCQ $0, R13;  MOVQ 40+x,AX; MOVQ R13, 40+x; MOVQ AX, R13; \
+    ADCQ $0, R14;  MOVQ 48+x,AX; MOVQ R14, 48+x; MOVQ AX, R14; \
+    SUBQ  0+y,  R8; \
+    SBBQ  8+y,  R9; \
+    SBBQ 16+y, R10; \
+    SBBQ 24+y, R11; \
+    SBBQ 32+y, R12; \
+    SBBQ 40+y, R13; \
+    SBBQ 48+y, R14; \
+    MOVQ   $0,  AX;  SETCS AX; \
+    MOVQ AX,  DX; \
+    SHLQ $32, DX; \
+    SUBQ AX,  R8; MOVQ  $0, AX; \
+    SBBQ $0,  R9; \
+    SBBQ $0, R10; \
+    SBBQ DX, R11; \
+    SBBQ $0, R12; \
+    SBBQ $0, R13; \
+    SBBQ $0, R14; \
+    SETCS AX; \
+    MOVQ AX,  DX; \
+    SHLQ $32, DX; \
+    SUBQ AX,  R8;  MOVQ  R8,  0+y; \
+    SBBQ $0,  R9;  MOVQ  R9,  8+y; \
+    SBBQ $0, R10;  MOVQ R10, 16+y; \
+    SBBQ DX, R11;  MOVQ R11, 24+y; \
+    SBBQ $0, R12;  MOVQ R12, 32+y; \
+    SBBQ $0, R13;  MOVQ R13, 40+y; \
+    SBBQ $0, R14;  MOVQ R14, 48+y;
diff --git a/.ci/providerlint/vendor/github.com/cloudflare/circl/math/fp448/fp_amd64.s b/.ci/providerlint/vendor/github.com/cloudflare/circl/math/fp448/fp_amd64.s
new file mode 100644
index 00000000000..435addf5e6c
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/cloudflare/circl/math/fp448/fp_amd64.s
@@ -0,0 +1,74 @@
+// +build amd64
+
+#include "textflag.h"
+#include "fp_amd64.h"
+
+// func cmovAmd64(x, y *Elt, n uint)
+TEXT ·cmovAmd64(SB),NOSPLIT,$0-24
+    MOVQ x+0(FP), DI
+    MOVQ y+8(FP), SI
+    MOVQ n+16(FP), BX
+    cselect(0(DI),0(SI),BX)
+    RET
+
+// func cswapAmd64(x, y *Elt, n uint)
+TEXT ·cswapAmd64(SB),NOSPLIT,$0-24
+    MOVQ x+0(FP), DI
+    MOVQ y+8(FP), SI
+    MOVQ n+16(FP), BX
+    cswap(0(DI),0(SI),BX)
+    RET
+
+// func subAmd64(z, x, y *Elt)
+TEXT ·subAmd64(SB),NOSPLIT,$0-24
+    MOVQ z+0(FP), DI
+    MOVQ x+8(FP), SI
+    MOVQ y+16(FP), BX
+    subtraction(0(DI),0(SI),0(BX))
+    RET
+
+// func addsubAmd64(x, y *Elt)
+TEXT ·addsubAmd64(SB),NOSPLIT,$0-16
+    MOVQ x+0(FP), DI
+    MOVQ y+8(FP), SI
+    addSub(0(DI),0(SI))
+    RET
+
+#define addLegacy \
+    additionLeg(0(DI),0(SI),0(BX))
+#define addBmi2Adx \
+    additionAdx(0(DI),0(SI),0(BX))
+
+#define mulLegacy \
+    integerMulLeg(0(SP),0(SI),0(BX)) \
+    reduceFromDoubleLeg(0(DI),0(SP))
+#define mulBmi2Adx \
+    integerMulAdx(0(SP),0(SI),0(BX)) \
+    reduceFromDoubleAdx(0(DI),0(SP))
+
+#define sqrLegacy \
+    integerSqrLeg(0(SP),0(SI)) \
+    reduceFromDoubleLeg(0(DI),0(SP))
+#define sqrBmi2Adx \
+    integerSqrAdx(0(SP),0(SI)) \
+    reduceFromDoubleAdx(0(DI),0(SP))
+
+// func addAmd64(z, x, y *Elt)
+TEXT ·addAmd64(SB),NOSPLIT,$0-24
+    MOVQ z+0(FP), DI
+    MOVQ x+8(FP), SI
+    MOVQ y+16(FP), BX
+    CHECK_BMI2ADX(LADD, addLegacy, addBmi2Adx)
+
+// func mulAmd64(z, x, y *Elt)
+TEXT ·mulAmd64(SB),NOSPLIT,$112-24
+    MOVQ z+0(FP), DI
+    MOVQ x+8(FP), SI
+    MOVQ y+16(FP), BX
+    CHECK_BMI2ADX(LMUL, mulLegacy, mulBmi2Adx)
+
+// func sqrAmd64(z, x *Elt)
+TEXT ·sqrAmd64(SB),NOSPLIT,$112-16
+    MOVQ z+0(FP), DI
+    MOVQ x+8(FP), SI
+    CHECK_BMI2ADX(LSQR, sqrLegacy, sqrBmi2Adx)
diff --git a/.ci/providerlint/vendor/github.com/cloudflare/circl/math/fp448/fp_generic.go b/.ci/providerlint/vendor/github.com/cloudflare/circl/math/fp448/fp_generic.go
new file mode 100644
index 00000000000..47a0b63205f
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/cloudflare/circl/math/fp448/fp_generic.go
@@ -0,0 +1,339 @@
+package fp448
+
+import (
+	"encoding/binary"
+	"math/bits"
+)
+
+func cmovGeneric(x, y *Elt, n uint) {
+	m := -uint64(n & 0x1)
+	x0 := binary.LittleEndian.Uint64(x[0*8 : 1*8])
+	x1 := binary.LittleEndian.Uint64(x[1*8 : 2*8])
+	x2 := binary.LittleEndian.Uint64(x[2*8 : 3*8])
+	x3 := binary.LittleEndian.Uint64(x[3*8 : 4*8])
+	x4 := binary.LittleEndian.Uint64(x[4*8 : 5*8])
+	x5 := binary.LittleEndian.Uint64(x[5*8 : 6*8])
+	x6 := binary.LittleEndian.Uint64(x[6*8 : 7*8])
+
+	y0 := binary.LittleEndian.Uint64(y[0*8 : 1*8])
+	y1 := binary.LittleEndian.Uint64(y[1*8 : 2*8])
+	y2 := binary.LittleEndian.Uint64(y[2*8 : 3*8])
+	y3 := binary.LittleEndian.Uint64(y[3*8 : 4*8])
+	y4 := binary.LittleEndian.Uint64(y[4*8 : 5*8])
+	y5 := binary.LittleEndian.Uint64(y[5*8 : 6*8])
+	y6 := binary.LittleEndian.Uint64(y[6*8 : 7*8])
+
+	x0 = (x0 &^ m) | (y0 & m)
+	x1 = (x1 &^ m) | (y1 & m)
+	x2 = (x2 &^ m) | (y2 & m)
+	x3 = (x3 &^ m) | (y3 & m)
+	x4 = (x4 &^ m) | (y4 & m)
+	x5 = (x5 &^ m) | (y5 & m)
+	x6 = (x6 &^ m) | (y6 & m)
+
+	binary.LittleEndian.PutUint64(x[0*8:1*8], x0)
+	binary.LittleEndian.PutUint64(x[1*8:2*8], x1)
+	binary.LittleEndian.PutUint64(x[2*8:3*8], x2)
+	binary.LittleEndian.PutUint64(x[3*8:4*8], x3)
+	binary.LittleEndian.PutUint64(x[4*8:5*8], x4)
+	binary.LittleEndian.PutUint64(x[5*8:6*8], x5)
+	binary.LittleEndian.PutUint64(x[6*8:7*8], x6)
+}
+
+func cswapGeneric(x, y *Elt, n uint) {
+	m := -uint64(n & 0x1)
+	x0 := binary.LittleEndian.Uint64(x[0*8 : 1*8])
+	x1 := binary.LittleEndian.Uint64(x[1*8 : 2*8])
+	x2 := binary.LittleEndian.Uint64(x[2*8 : 3*8])
+	x3 := binary.LittleEndian.Uint64(x[3*8 : 4*8])
+	x4 := binary.LittleEndian.Uint64(x[4*8 : 5*8])
+	x5 := binary.LittleEndian.Uint64(x[5*8 : 6*8])
+	x6 := binary.LittleEndian.Uint64(x[6*8 : 7*8])
+
+	y0 := binary.LittleEndian.Uint64(y[0*8 : 1*8])
+	y1 := binary.LittleEndian.Uint64(y[1*8 : 2*8])
+	y2 := binary.LittleEndian.Uint64(y[2*8 : 3*8])
+	y3 := binary.LittleEndian.Uint64(y[3*8 : 4*8])
+	y4 := binary.LittleEndian.Uint64(y[4*8 : 5*8])
+	y5 := binary.LittleEndian.Uint64(y[5*8 : 6*8])
+	y6 := binary.LittleEndian.Uint64(y[6*8 : 7*8])
+
+	t0 := m & (x0 ^ y0)
+	t1 := m & (x1 ^ y1)
+	t2 := m & (x2 ^ y2)
+	t3 := m & (x3 ^ y3)
+	t4 := m & (x4 ^ y4)
+	t5 := m & (x5 ^ y5)
+	t6 := m & (x6 ^ y6)
+	x0 ^= t0
+	x1 ^= t1
+	x2 ^= t2
+	x3 ^= t3
+	x4 ^= t4
+	x5 ^= t5
+	x6 ^= t6
+	y0 ^= t0
+	y1 ^= t1
+	y2 ^= t2
+	y3 ^= t3
+	y4 ^= t4
+	y5 ^= t5
+	y6 ^= t6
+
+	binary.LittleEndian.PutUint64(x[0*8:1*8], x0)
+	binary.LittleEndian.PutUint64(x[1*8:2*8], x1)
+	binary.LittleEndian.PutUint64(x[2*8:3*8], x2)
+	binary.LittleEndian.PutUint64(x[3*8:4*8], x3)
+	binary.LittleEndian.PutUint64(x[4*8:5*8], x4)
+	binary.LittleEndian.PutUint64(x[5*8:6*8], x5)
+	binary.LittleEndian.PutUint64(x[6*8:7*8], x6)
+
+	binary.LittleEndian.PutUint64(y[0*8:1*8], y0)
+	binary.LittleEndian.PutUint64(y[1*8:2*8], y1)
+	binary.LittleEndian.PutUint64(y[2*8:3*8], y2)
+	binary.LittleEndian.PutUint64(y[3*8:4*8], y3)
+	binary.LittleEndian.PutUint64(y[4*8:5*8], y4)
+	binary.LittleEndian.PutUint64(y[5*8:6*8], y5)
+	binary.LittleEndian.PutUint64(y[6*8:7*8], y6)
+}
+
+func addGeneric(z, x, y *Elt) {
+	x0 := binary.LittleEndian.Uint64(x[0*8 : 1*8])
+	x1 := binary.LittleEndian.Uint64(x[1*8 : 2*8])
+	x2 := binary.LittleEndian.Uint64(x[2*8 : 3*8])
+	x3 := binary.LittleEndian.Uint64(x[3*8 : 4*8])
+	x4 := binary.LittleEndian.Uint64(x[4*8 : 5*8])
+	x5 := binary.LittleEndian.Uint64(x[5*8 : 6*8])
+	x6 := binary.LittleEndian.Uint64(x[6*8 : 7*8])
+
+	y0 := binary.LittleEndian.Uint64(y[0*8 : 1*8])
+	y1 := binary.LittleEndian.Uint64(y[1*8 : 2*8])
+	y2 := binary.LittleEndian.Uint64(y[2*8 : 3*8])
+	y3 := binary.LittleEndian.Uint64(y[3*8 : 4*8])
+	y4 := binary.LittleEndian.Uint64(y[4*8 : 5*8])
+	y5 := binary.LittleEndian.Uint64(y[5*8 : 6*8])
+	y6 := binary.LittleEndian.Uint64(y[6*8 : 7*8])
+
+	z0, c0 := bits.Add64(x0, y0, 0)
+	z1, c1 := bits.Add64(x1, y1, c0)
+	z2, c2 := bits.Add64(x2, y2, c1)
+	z3, c3 := bits.Add64(x3, y3, c2)
+	z4, c4 := bits.Add64(x4, y4, c3)
+	z5, c5 := bits.Add64(x5, y5, c4)
+	z6, z7 := bits.Add64(x6, y6, c5)
+
+	z0, c0 = bits.Add64(z0, z7, 0)
+	z1, c1 = bits.Add64(z1, 0, c0)
+	z2, c2 = bits.Add64(z2, 0, c1)
+	z3, c3 = bits.Add64(z3, z7<<32, c2)
+	z4, c4 = bits.Add64(z4, 0, c3)
+	z5, c5 = bits.Add64(z5, 0, c4)
+	z6, z7 = bits.Add64(z6, 0, c5)
+
+	z0, c0 = bits.Add64(z0, z7, 0)
+	z1, c1 = bits.Add64(z1, 0, c0)
+	z2, c2 = bits.Add64(z2, 0, c1)
+	z3, c3 = bits.Add64(z3, z7<<32, c2)
+	z4, c4 = bits.Add64(z4, 0, c3)
+	z5, c5 = bits.Add64(z5, 0, c4)
+	z6, _ = bits.Add64(z6, 0, c5)
+
+	binary.LittleEndian.PutUint64(z[0*8:1*8], z0)
+	binary.LittleEndian.PutUint64(z[1*8:2*8], z1)
+	binary.LittleEndian.PutUint64(z[2*8:3*8], z2)
+	binary.LittleEndian.PutUint64(z[3*8:4*8], z3)
+	binary.LittleEndian.PutUint64(z[4*8:5*8], z4)
+	binary.LittleEndian.PutUint64(z[5*8:6*8], z5)
+	binary.LittleEndian.PutUint64(z[6*8:7*8], z6)
+}
+
+func subGeneric(z, x, y *Elt) {
+	x0 := binary.LittleEndian.Uint64(x[0*8 : 1*8])
+	x1 := binary.LittleEndian.Uint64(x[1*8 : 2*8])
+	x2 := binary.LittleEndian.Uint64(x[2*8 : 3*8])
+	x3 := binary.LittleEndian.Uint64(x[3*8 : 4*8])
+	x4 := binary.LittleEndian.Uint64(x[4*8 : 5*8])
+	x5 := binary.LittleEndian.Uint64(x[5*8 : 6*8])
+	x6 := binary.LittleEndian.Uint64(x[6*8 : 7*8])
+
+	y0 := binary.LittleEndian.Uint64(y[0*8 : 1*8])
+	y1 := binary.LittleEndian.Uint64(y[1*8 : 2*8])
+	y2 := binary.LittleEndian.Uint64(y[2*8 : 3*8])
+	y3 := binary.LittleEndian.Uint64(y[3*8 : 4*8])
+	y4 := binary.LittleEndian.Uint64(y[4*8 : 5*8])
+	y5 := binary.LittleEndian.Uint64(y[5*8 : 6*8])
+	y6 := binary.LittleEndian.Uint64(y[6*8 : 7*8])
+
+	z0, c0 := bits.Sub64(x0, y0, 0)
+	z1, c1 := bits.Sub64(x1, y1, c0)
+	z2, c2 := bits.Sub64(x2, y2, c1)
+	z3, c3 := bits.Sub64(x3, y3, c2)
+	z4, c4 := bits.Sub64(x4, y4, c3)
+	z5, c5 := bits.Sub64(x5, y5, c4)
+	z6, z7 := bits.Sub64(x6, y6, c5)
+
+	z0, c0 = bits.Sub64(z0, z7, 0)
+	z1, c1 = bits.Sub64(z1, 0, c0)
+	z2, c2 = bits.Sub64(z2, 0, c1)
+	z3, c3 = bits.Sub64(z3, z7<<32, c2)
+	z4, c4 = bits.Sub64(z4, 0, c3)
+	z5, c5 = bits.Sub64(z5, 0, c4)
+	z6, z7 = bits.Sub64(z6, 0, c5)
+
+	z0, c0 = bits.Sub64(z0, z7, 0)
+	z1, c1 = bits.Sub64(z1, 0, c0)
+	z2, c2 = bits.Sub64(z2, 0, c1)
+	z3, c3 = bits.Sub64(z3, z7<<32, c2)
+	z4, c4 = bits.Sub64(z4, 0, c3)
+	z5, c5 = bits.Sub64(z5, 0, c4)
+	z6, _ = bits.Sub64(z6, 0, c5)
+
+	binary.LittleEndian.PutUint64(z[0*8:1*8], z0)
+	binary.LittleEndian.PutUint64(z[1*8:2*8], z1)
+	binary.LittleEndian.PutUint64(z[2*8:3*8], z2)
+	binary.LittleEndian.PutUint64(z[3*8:4*8], z3)
+	binary.LittleEndian.PutUint64(z[4*8:5*8], z4)
+	binary.LittleEndian.PutUint64(z[5*8:6*8], z5)
+	binary.LittleEndian.PutUint64(z[6*8:7*8], z6)
+}
+
+func addsubGeneric(x, y *Elt) {
+	z := &Elt{}
+	addGeneric(z, x, y)
+	subGeneric(y, x, y)
+	*x = *z
+}
+
+func mulGeneric(z, x, y *Elt) {
+	x0 := binary.LittleEndian.Uint64(x[0*8 : 1*8])
+	x1 := binary.LittleEndian.Uint64(x[1*8 : 2*8])
+	x2 := binary.LittleEndian.Uint64(x[2*8 : 3*8])
+	x3 := binary.LittleEndian.Uint64(x[3*8 : 4*8])
+	x4 := binary.LittleEndian.Uint64(x[4*8 : 5*8])
+	x5 := binary.LittleEndian.Uint64(x[5*8 : 6*8])
+	x6 := binary.LittleEndian.Uint64(x[6*8 : 7*8])
+
+	y0 := binary.LittleEndian.Uint64(y[0*8 : 1*8])
+	y1 := binary.LittleEndian.Uint64(y[1*8 : 2*8])
+	y2 := binary.LittleEndian.Uint64(y[2*8 : 3*8])
+	y3 := binary.LittleEndian.Uint64(y[3*8 : 4*8])
+	y4 := binary.LittleEndian.Uint64(y[4*8 : 5*8])
+	y5 := binary.LittleEndian.Uint64(y[5*8 : 6*8])
+	y6 := binary.LittleEndian.Uint64(y[6*8 : 7*8])
+
+	yy := [7]uint64{y0, y1, y2, y3, y4, y5, y6}
+	zz := [7]uint64{}
+
+	yi := yy[0]
+	h0, l0 := bits.Mul64(x0, yi)
+	h1, l1 := bits.Mul64(x1, yi)
+	h2, l2 := bits.Mul64(x2, yi)
+	h3, l3 := bits.Mul64(x3, yi)
+	h4, l4 := bits.Mul64(x4, yi)
+	h5, l5 := bits.Mul64(x5, yi)
+	h6, l6 := bits.Mul64(x6, yi)
+
+	zz[0] = l0
+	a0, c0 := bits.Add64(h0, l1, 0)
+	a1, c1 := bits.Add64(h1, l2, c0)
+	a2, c2 := bits.Add64(h2, l3, c1)
+	a3, c3 := bits.Add64(h3, l4, c2)
+	a4, c4 := bits.Add64(h4, l5, c3)
+	a5, c5 := bits.Add64(h5, l6, c4)
+	a6, _ := bits.Add64(h6, 0, c5)
+
+	for i := 1; i < 7; i++ {
+		yi = yy[i]
+		h0, l0 = bits.Mul64(x0, yi)
+		h1, l1 = bits.Mul64(x1, yi)
+		h2, l2 = bits.Mul64(x2, yi)
+		h3, l3 = bits.Mul64(x3, yi)
+		h4, l4 = bits.Mul64(x4, yi)
+		h5, l5 = bits.Mul64(x5, yi)
+		h6, l6 = bits.Mul64(x6, yi)
+
+		zz[i], c0 = bits.Add64(a0, l0, 0)
+		a0, c1 = bits.Add64(a1, l1, c0)
+		a1, c2 = bits.Add64(a2, l2, c1)
+		a2, c3 = bits.Add64(a3, l3, c2)
+		a3, c4 = bits.Add64(a4, l4, c3)
+		a4, c5 = bits.Add64(a5, l5, c4)
+		a5, a6 = bits.Add64(a6, l6, c5)
+
+		a0, c0 = bits.Add64(a0, h0, 0)
+		a1, c1 = bits.Add64(a1, h1, c0)
+		a2, c2 = bits.Add64(a2, h2, c1)
+		a3, c3 = bits.Add64(a3, h3, c2)
+		a4, c4 = bits.Add64(a4, h4, c3)
+		a5, c5 = bits.Add64(a5, h5, c4)
+		a6, _ = bits.Add64(a6, h6, c5)
+	}
+	red64(z, &zz, &[7]uint64{a0, a1, a2, a3, a4, a5, a6})
+}
+
+func sqrGeneric(z, x *Elt) { mulGeneric(z, x, x) }
+
+func red64(z *Elt, l, h *[7]uint64) {
+	/* (2C13, 2C12, 2C11, 2C10|C10, C9, C8, C7) + (C6,...,C0) */
+	h0 := h[0]
+	h1 := h[1]
+	h2 := h[2]
+	h3 := ((h[3] & (0xFFFFFFFF << 32)) << 1) | (h[3] & 0xFFFFFFFF)
+	h4 := (h[3] >> 63) | (h[4] << 1)
+	h5 := (h[4] >> 63) | (h[5] << 1)
+	h6 := (h[5] >> 63) | (h[6] << 1)
+	h7 := (h[6] >> 63)
+
+	l0, c0 := bits.Add64(h0, l[0], 0)
+	l1, c1 := bits.Add64(h1, l[1], c0)
+	l2, c2 := bits.Add64(h2, l[2], c1)
+	l3, c3 := bits.Add64(h3, l[3], c2)
+	l4, c4 := bits.Add64(h4, l[4], c3)
+	l5, c5 := bits.Add64(h5, l[5], c4)
+	l6, c6 := bits.Add64(h6, l[6], c5)
+	l7, _ := bits.Add64(h7, 0, c6)
+
+	/* (C10C9, C9C8,C8C7,C7C13,C13C12,C12C11,C11C10) + (C6,...,C0) */
+	h0 = (h[3] >> 32) | (h[4] << 32)
+	h1 = (h[4] >> 32) | (h[5] << 32)
+	h2 = (h[5] >> 32) | (h[6] << 32)
+	h3 = (h[6] >> 32) | (h[0] << 32)
+	h4 = (h[0] >> 32) | (h[1] << 32)
+	h5 = (h[1] >> 32) | (h[2] << 32)
+	h6 = (h[2] >> 32) | (h[3] << 32)
+
+	l0, c0 = bits.Add64(l0, h0, 0)
+	l1, c1 = bits.Add64(l1, h1, c0)
+	l2, c2 = bits.Add64(l2, h2, c1)
+	l3, c3 = bits.Add64(l3, h3, c2)
+	l4, c4 = bits.Add64(l4, h4, c3)
+	l5, c5 = bits.Add64(l5, h5, c4)
+	l6, c6 = bits.Add64(l6, h6, c5)
+	l7, _ = bits.Add64(l7, 0, c6)
+
+	/* (C7) + (C6,...,C0) */
+	l0, c0 = bits.Add64(l0, l7, 0)
+	l1, c1 = bits.Add64(l1, 0, c0)
+	l2, c2 = bits.Add64(l2, 0, c1)
+	l3, c3 = bits.Add64(l3, l7<<32, c2)
+	l4, c4 = bits.Add64(l4, 0, c3)
+	l5, c5 = bits.Add64(l5, 0, c4)
+	l6, l7 = bits.Add64(l6, 0, c5)
+
+	/* (C7) + (C6,...,C0) */
+	l0, c0 = bits.Add64(l0, l7, 0)
+	l1, c1 = bits.Add64(l1, 0, c0)
+	l2, c2 = bits.Add64(l2, 0, c1)
+	l3, c3 = bits.Add64(l3, l7<<32, c2)
+	l4, c4 = bits.Add64(l4, 0, c3)
+	l5, c5 = bits.Add64(l5, 0, c4)
+	l6, _ = bits.Add64(l6, 0, c5)
+
+	binary.LittleEndian.PutUint64(z[0*8:1*8], l0)
+	binary.LittleEndian.PutUint64(z[1*8:2*8], l1)
+	binary.LittleEndian.PutUint64(z[2*8:3*8], l2)
+	binary.LittleEndian.PutUint64(z[3*8:4*8], l3)
+	binary.LittleEndian.PutUint64(z[4*8:5*8], l4)
+	binary.LittleEndian.PutUint64(z[5*8:6*8], l5)
+	binary.LittleEndian.PutUint64(z[6*8:7*8], l6)
+}
diff --git a/.ci/providerlint/vendor/github.com/cloudflare/circl/math/fp448/fp_noasm.go b/.ci/providerlint/vendor/github.com/cloudflare/circl/math/fp448/fp_noasm.go
new file mode 100644
index 00000000000..a62225d2962
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/cloudflare/circl/math/fp448/fp_noasm.go
@@ -0,0 +1,12 @@
+//go:build !amd64 || purego
+// +build !amd64 purego
+
+package fp448
+
+func cmov(x, y *Elt, n uint)  { cmovGeneric(x, y, n) }
+func cswap(x, y *Elt, n uint) { cswapGeneric(x, y, n) }
+func add(z, x, y *Elt)        { addGeneric(z, x, y) }
+func sub(z, x, y *Elt)        { subGeneric(z, x, y) }
+func addsub(x, y *Elt)        { addsubGeneric(x, y) }
+func mul(z, x, y *Elt)        { mulGeneric(z, x, y) }
+func sqr(z, x *Elt)           { sqrGeneric(z, x) }
diff --git a/.ci/providerlint/vendor/github.com/cloudflare/circl/math/fp448/fuzzer.go b/.ci/providerlint/vendor/github.com/cloudflare/circl/math/fp448/fuzzer.go
new file mode 100644
index 00000000000..2d7afc80598
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/cloudflare/circl/math/fp448/fuzzer.go
@@ -0,0 +1,75 @@
+//go:build gofuzz
+// +build gofuzz
+
+// How to run the fuzzer:
+//
+//	$ go get -u github.com/dvyukov/go-fuzz/go-fuzz
+//	$ go get -u github.com/dvyukov/go-fuzz/go-fuzz-build
+//	$ go-fuzz-build -libfuzzer -func FuzzReduction -o lib.a
+//	$ clang -fsanitize=fuzzer lib.a -o fu.exe
+//	$ ./fu.exe
+package fp448
+
+import (
+	"encoding/binary"
+	"fmt"
+	"math/big"
+
+	"github.com/cloudflare/circl/internal/conv"
+)
+
+// FuzzReduction is a fuzzer target for red64 function, which reduces t
+// (112 bits) to a number t' (56 bits) congruent modulo p448.
+func FuzzReduction(data []byte) int {
+	if len(data) != 2*Size {
+		return -1
+	}
+	var got, want Elt
+	var lo, hi [7]uint64
+	a := data[:Size]
+	b := data[Size:]
+	lo[0] = binary.LittleEndian.Uint64(a[0*8 : 1*8])
+	lo[1] = binary.LittleEndian.Uint64(a[1*8 : 2*8])
+	lo[2] = binary.LittleEndian.Uint64(a[2*8 : 3*8])
+	lo[3] = binary.LittleEndian.Uint64(a[3*8 : 4*8])
+	lo[4] = binary.LittleEndian.Uint64(a[4*8 : 5*8])
+	lo[5] = binary.LittleEndian.Uint64(a[5*8 : 6*8])
+	lo[6] = binary.LittleEndian.Uint64(a[6*8 : 7*8])
+
+	hi[0] = binary.LittleEndian.Uint64(b[0*8 : 1*8])
+	hi[1] = binary.LittleEndian.Uint64(b[1*8 : 2*8])
+	hi[2] = binary.LittleEndian.Uint64(b[2*8 : 3*8])
+	hi[3] = binary.LittleEndian.Uint64(b[3*8 : 4*8])
+	hi[4] = binary.LittleEndian.Uint64(b[4*8 : 5*8])
+	hi[5] = binary.LittleEndian.Uint64(b[5*8 : 6*8])
+	hi[6] = binary.LittleEndian.Uint64(b[6*8 : 7*8])
+
+	red64(&got, &lo, &hi)
+
+	t := conv.BytesLe2BigInt(data[:2*Size])
+
+	two448 := big.NewInt(1)
+	two448.Lsh(two448, 448) // 2^448
+	mask448 := big.NewInt(1)
+	mask448.Sub(two448, mask448) // 2^448-1
+	two224plus1 := big.NewInt(1)
+	two224plus1.Lsh(two224plus1, 224)
+	two224plus1.Add(two224plus1, big.NewInt(1)) // 2^224+1
+
+	var loBig, hiBig big.Int
+	for t.Cmp(two448) >= 0 {
+		loBig.And(t, mask448)
+		hiBig.Rsh(t, 448)
+		t.Mul(&hiBig, two224plus1)
+		t.Add(t, &loBig)
+	}
+	conv.BigInt2BytesLe(want[:], t)
+
+	if got != want {
+		fmt.Printf("in:   %v\n", conv.BytesLe2BigInt(data[:2*Size]))
+		fmt.Printf("got:  %v\n", got)
+		fmt.Printf("want: %v\n", want)
+		panic("error found")
+	}
+	return 1
+}
diff --git a/.ci/providerlint/vendor/github.com/cloudflare/circl/math/mlsbset/mlsbset.go b/.ci/providerlint/vendor/github.com/cloudflare/circl/math/mlsbset/mlsbset.go
new file mode 100644
index 00000000000..a43851b8bb2
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/cloudflare/circl/math/mlsbset/mlsbset.go
@@ -0,0 +1,122 @@
+// Package mlsbset provides a constant-time exponentiation method with precomputation.
+//
+// References: "Efficient and secure algorithms for GLV-based scalar
+// multiplication and their implementation on GLV–GLS curves" by (Faz-Hernandez et al.)
+//   - https://doi.org/10.1007/s13389-014-0085-7
+//   - https://eprint.iacr.org/2013/158
+package mlsbset
+
+import (
+	"errors"
+	"fmt"
+	"math/big"
+
+	"github.com/cloudflare/circl/internal/conv"
+)
+
+// EltG is a group element.
+type EltG interface{}
+
+// EltP is a precomputed group element.
+type EltP interface{}
+
+// Group defines the operations required by MLSBSet exponentiation method.
+type Group interface {
+	Identity() EltG                    // Returns the identity of the group.
+	Sqr(x EltG)                        // Calculates x = x^2.
+	Mul(x EltG, y EltP)                // Calculates x = x*y.
+	NewEltP() EltP                     // Returns an arbitrary precomputed element.
+	ExtendedEltP() EltP                // Returns the precomputed element x^(2^(w*d)).
+	Lookup(a EltP, v uint, s, u int32) // Sets a = s*T[v][u].
+}
+
+// Params contains the parameters of the encoding.
+type Params struct {
+	T uint // T is the maximum size (in bits) of exponents.
+	V uint // V is the number of tables.
+	W uint // W is the window size.
+	E uint // E is the number of digits per table.
+	D uint // D is the number of digits in total.
+	L uint // L is the length of the code.
+}
+
+// Encoder allows to convert integers into valid powers.
+type Encoder struct{ p Params }
+
+// New produces an encoder of the MLSBSet algorithm.
+func New(t, v, w uint) (Encoder, error) {
+	if !(t > 1 && v >= 1 && w >= 2) {
+		return Encoder{}, errors.New("t>1, v>=1, w>=2")
+	}
+	e := (t + w*v - 1) / (w * v)
+	d := e * v
+	l := d * w
+	return Encoder{Params{t, v, w, e, d, l}}, nil
+}
+
+// Encode converts an odd integer k into a valid power for exponentiation.
+func (m Encoder) Encode(k []byte) (*Power, error) {
+	if len(k) == 0 {
+		return nil, errors.New("empty slice")
+	}
+	if !(len(k) <= int(m.p.L+7)>>3) {
+		return nil, errors.New("k too big")
+	}
+	if k[0]%2 == 0 {
+		return nil, errors.New("k must be odd")
+	}
+	ap := int((m.p.L+7)/8) - len(k)
+	k = append(k, make([]byte, ap)...)
+	s := m.signs(k)
+	b := make([]int32, m.p.L-m.p.D)
+	c := conv.BytesLe2BigInt(k)
+	c.Rsh(c, m.p.D)
+	var bi big.Int
+	for i := m.p.D; i < m.p.L; i++ {
+		c0 := int32(c.Bit(0))
+		b[i-m.p.D] = s[i%m.p.D] * c0
+		bi.SetInt64(int64(b[i-m.p.D] >> 1))
+		c.Rsh(c, 1)
+		c.Sub(c, &bi)
+	}
+	carry := int(c.Int64())
+	return &Power{m, s, b, carry}, nil
+}
+
+// signs calculates the set of signs.
+func (m Encoder) signs(k []byte) []int32 {
+	s := make([]int32, m.p.D)
+	s[m.p.D-1] = 1
+	for i := uint(1); i < m.p.D; i++ {
+		ki := int32((k[i>>3] >> (i & 0x7)) & 0x1)
+		s[i-1] = 2*ki - 1
+	}
+	return s
+}
+
+// GetParams returns the complementary parameters of the encoding.
+func (m Encoder) GetParams() Params { return m.p }
+
+// tableSize returns the size of each table.
+func (m Encoder) tableSize() uint { return 1 << (m.p.W - 1) }
+
+// Elts returns the total number of elements that must be precomputed.
+func (m Encoder) Elts() uint { return m.p.V * m.tableSize() }
+
+// IsExtended returns true if the element x^(2^(wd)) must be calculated.
+func (m Encoder) IsExtended() bool { q := m.p.T / (m.p.V * m.p.W); return m.p.T == q*m.p.V*m.p.W }
+
+// Ops returns the number of squares and multiplications executed during an exponentiation.
+func (m Encoder) Ops() (S uint, M uint) {
+	S = m.p.E
+	M = m.p.E * m.p.V
+	if m.IsExtended() {
+		M++
+	}
+	return
+}
+
+func (m Encoder) String() string {
+	return fmt.Sprintf("T: %v W: %v V: %v e: %v d: %v l: %v wv|t: %v",
+		m.p.T, m.p.W, m.p.V, m.p.E, m.p.D, m.p.L, m.IsExtended())
+}
diff --git a/.ci/providerlint/vendor/github.com/cloudflare/circl/math/mlsbset/power.go b/.ci/providerlint/vendor/github.com/cloudflare/circl/math/mlsbset/power.go
new file mode 100644
index 00000000000..3f214c3046a
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/cloudflare/circl/math/mlsbset/power.go
@@ -0,0 +1,64 @@
+package mlsbset
+
+import "fmt"
+
+// Power is a valid exponent produced by the MLSBSet encoding algorithm.
+type Power struct {
+	set Encoder // parameters of code.
+	s   []int32 // set of signs.
+	b   []int32 // set of digits.
+	c   int     // carry is {0,1}.
+}
+
+// Exp is calculates x^k, where x is a predetermined element of a group G.
+func (p *Power) Exp(G Group) EltG {
+	a, b := G.Identity(), G.NewEltP()
+	for e := int(p.set.p.E - 1); e >= 0; e-- {
+		G.Sqr(a)
+		for v := uint(0); v < p.set.p.V; v++ {
+			sgnElt, idElt := p.Digit(v, uint(e))
+			G.Lookup(b, v, sgnElt, idElt)
+			G.Mul(a, b)
+		}
+	}
+	if p.set.IsExtended() && p.c == 1 {
+		G.Mul(a, G.ExtendedEltP())
+	}
+	return a
+}
+
+// Digit returns the (v,e)-th digit and its sign.
+func (p *Power) Digit(v, e uint) (sgn, dig int32) {
+	sgn = p.bit(0, v, e)
+	dig = 0
+	for i := p.set.p.W - 1; i > 0; i-- {
+		dig = 2*dig + p.bit(i, v, e)
+	}
+	mask := dig >> 31
+	dig = (dig + mask) ^ mask
+	return sgn, dig
+}
+
+// bit returns the (w,v,e)-th bit of the code.
+func (p *Power) bit(w, v, e uint) int32 {
+	if !(w < p.set.p.W &&
+		v < p.set.p.V &&
+		e < p.set.p.E) {
+		panic(fmt.Errorf("indexes outside (%v,%v,%v)", w, v, e))
+	}
+	if w == 0 {
+		return p.s[p.set.p.E*v+e]
+	}
+	return p.b[p.set.p.D*(w-1)+p.set.p.E*v+e]
+}
+
+func (p *Power) String() string {
+	dig := ""
+	for j := uint(0); j < p.set.p.V; j++ {
+		for i := uint(0); i < p.set.p.E; i++ {
+			s, d := p.Digit(j, i)
+			dig += fmt.Sprintf("(%2v,%2v) = %+2v %+2v\n", j, i, s, d)
+		}
+	}
+	return fmt.Sprintf("len: %v\ncarry: %v\ndigits:\n%v", len(p.b)+len(p.s), p.c, dig)
+}
diff --git a/.ci/providerlint/vendor/github.com/cloudflare/circl/math/wnaf.go b/.ci/providerlint/vendor/github.com/cloudflare/circl/math/wnaf.go
new file mode 100644
index 00000000000..94a1ec50429
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/cloudflare/circl/math/wnaf.go
@@ -0,0 +1,84 @@
+// Package math provides some utility functions for big integers.
+package math
+
+import "math/big"
+
+// SignedDigit obtains the signed-digit recoding of n and returns a list L of
+// digits such that n = sum( L[i]*2^(i*(w-1)) ), and each L[i] is an odd number
+// in the set {±1, ±3, ..., ±2^(w-1)-1}. The third parameter ensures that the
+// output has ceil(l/(w-1)) digits.
+//
+// Restrictions:
+//   - n is odd and n > 0.
+//   - 1 < w < 32.
+//   - l >= bit length of n.
+//
+// References:
+//   - Alg.6 in "Exponent Recoding and Regular Exponentiation Algorithms"
+//     by Joye-Tunstall. http://doi.org/10.1007/978-3-642-02384-2_21
+//   - Alg.6 in "Selecting Elliptic Curves for Cryptography: An Efficiency and
+//     Security Analysis" by Bos et al. http://doi.org/10.1007/s13389-015-0097-y
+func SignedDigit(n *big.Int, w, l uint) []int32 {
+	if n.Sign() <= 0 || n.Bit(0) == 0 {
+		panic("n must be non-zero, odd, and positive")
+	}
+	if w <= 1 || w >= 32 {
+		panic("Verify that 1 < w < 32")
+	}
+	if uint(n.BitLen()) > l {
+		panic("n is too big to fit in l digits")
+	}
+	lenN := (l + (w - 1) - 1) / (w - 1) // ceil(l/(w-1))
+	L := make([]int32, lenN+1)
+	var k, v big.Int
+	k.Set(n)
+
+	var i uint
+	for i = 0; i < lenN; i++ {
+		words := k.Bits()
+		value := int32(words[0] & ((1 << w) - 1))
+		value -= int32(1) << (w - 1)
+		L[i] = value
+		v.SetInt64(int64(value))
+		k.Sub(&k, &v)
+		k.Rsh(&k, w-1)
+	}
+	L[i] = int32(k.Int64())
+	return L
+}
+
+// OmegaNAF obtains the window-w Non-Adjacent Form of a positive number n and
+// 1 < w < 32. The returned slice L holds n = sum( L[i]*2^i ).
+//
+// Reference:
+//   - Alg.9 "Efficient arithmetic on Koblitz curves" by Solinas.
+//     http://doi.org/10.1023/A:1008306223194
+func OmegaNAF(n *big.Int, w uint) (L []int32) {
+	if n.Sign() < 0 {
+		panic("n must be positive")
+	}
+	if w <= 1 || w >= 32 {
+		panic("Verify that 1 < w < 32")
+	}
+
+	L = make([]int32, n.BitLen()+1)
+	var k, v big.Int
+	k.Set(n)
+
+	i := 0
+	for ; k.Sign() > 0; i++ {
+		value := int32(0)
+		if k.Bit(0) == 1 {
+			words := k.Bits()
+			value = int32(words[0] & ((1 << w) - 1))
+			if value >= (int32(1) << (w - 1)) {
+				value -= int32(1) << w
+			}
+			v.SetInt64(int64(value))
+			k.Sub(&k, &v)
+		}
+		L[i] = value
+		k.Rsh(&k, 1)
+	}
+	return L[:i]
+}
diff --git a/.ci/providerlint/vendor/github.com/cloudflare/circl/sign/ed25519/ed25519.go b/.ci/providerlint/vendor/github.com/cloudflare/circl/sign/ed25519/ed25519.go
new file mode 100644
index 00000000000..08ca65d799a
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/cloudflare/circl/sign/ed25519/ed25519.go
@@ -0,0 +1,453 @@
+// Package ed25519 implements Ed25519 signature scheme as described in RFC-8032.
+//
+// This package provides optimized implementations of the three signature
+// variants and maintaining closer compatiblilty with crypto/ed25519.
+//
+//	| Scheme Name | Sign Function     | Verification  | Context           |
+//	|-------------|-------------------|---------------|-------------------|
+//	| Ed25519     | Sign              | Verify        | None              |
+//	| Ed25519Ph   | SignPh            | VerifyPh      | Yes, can be empty |
+//	| Ed25519Ctx  | SignWithCtx       | VerifyWithCtx | Yes, non-empty    |
+//	| All above   | (PrivateKey).Sign | VerifyAny     | As above          |
+//
+// Specific functions for sign and verify are defined. A generic signing
+// function for all schemes is available through the crypto.Signer interface,
+// which is implemented by the PrivateKey type. A correspond all-in-one
+// verification method is provided by the VerifyAny function.
+//
+// Signing with Ed25519Ph or Ed25519Ctx requires a context string for domain
+// separation. This parameter is passed using a SignerOptions struct defined
+// in this package. While Ed25519Ph accepts an empty context, Ed25519Ctx
+// enforces non-empty context strings.
+//
+// # Compatibility with crypto.ed25519
+//
+// These functions are compatible with the “Ed25519” function defined in
+// RFC-8032. However, unlike RFC 8032's formulation, this package's private
+// key representation includes a public key suffix to make multiple signing
+// operations with the same key more efficient. This package refers to the
+// RFC-8032 private key as the “seed”.
+//
+// References
+//
+//   - RFC-8032: https://rfc-editor.org/rfc/rfc8032.txt
+//   - Ed25519: https://ed25519.cr.yp.to/
+//   - EdDSA: High-speed high-security signatures. https://doi.org/10.1007/s13389-012-0027-1
+package ed25519
+
+import (
+	"bytes"
+	"crypto"
+	cryptoRand "crypto/rand"
+	"crypto/sha512"
+	"crypto/subtle"
+	"errors"
+	"fmt"
+	"io"
+	"strconv"
+
+	"github.com/cloudflare/circl/sign"
+)
+
+const (
+	// ContextMaxSize is the maximum length (in bytes) allowed for context.
+	ContextMaxSize = 255
+	// PublicKeySize is the size, in bytes, of public keys as used in this package.
+	PublicKeySize = 32
+	// PrivateKeySize is the size, in bytes, of private keys as used in this package.
+	PrivateKeySize = 64
+	// SignatureSize is the size, in bytes, of signatures generated and verified by this package.
+	SignatureSize = 64
+	// SeedSize is the size, in bytes, of private key seeds. These are the private key representations used by RFC 8032.
+	SeedSize = 32
+)
+
+const (
+	paramB = 256 / 8 // Size of keys in bytes.
+)
+
+// SignerOptions implements crypto.SignerOpts and augments with parameters
+// that are specific to the Ed25519 signature schemes.
+type SignerOptions struct {
+	// Hash must be crypto.Hash(0) for Ed25519/Ed25519ctx, or crypto.SHA512
+	// for Ed25519ph.
+	crypto.Hash
+
+	// Context is an optional domain separation string for Ed25519ph and a
+	// must for Ed25519ctx. Its length must be less or equal than 255 bytes.
+	Context string
+
+	// Scheme is an identifier for choosing a signature scheme. The zero value
+	// is ED25519.
+	Scheme SchemeID
+}
+
+// SchemeID is an identifier for each signature scheme.
+type SchemeID uint
+
+const (
+	ED25519 SchemeID = iota
+	ED25519Ph
+	ED25519Ctx
+)
+
+// PrivateKey is the type of Ed25519 private keys. It implements crypto.Signer.
+type PrivateKey []byte
+
+// Equal reports whether priv and x have the same value.
+func (priv PrivateKey) Equal(x crypto.PrivateKey) bool {
+	xx, ok := x.(PrivateKey)
+	return ok && subtle.ConstantTimeCompare(priv, xx) == 1
+}
+
+// Public returns the PublicKey corresponding to priv.
+func (priv PrivateKey) Public() crypto.PublicKey {
+	publicKey := make(PublicKey, PublicKeySize)
+	copy(publicKey, priv[SeedSize:])
+	return publicKey
+}
+
+// Seed returns the private key seed corresponding to priv. It is provided for
+// interoperability with RFC 8032. RFC 8032's private keys correspond to seeds
+// in this package.
+func (priv PrivateKey) Seed() []byte {
+	seed := make([]byte, SeedSize)
+	copy(seed, priv[:SeedSize])
+	return seed
+}
+
+func (priv PrivateKey) Scheme() sign.Scheme { return sch }
+
+func (pub PublicKey) Scheme() sign.Scheme { return sch }
+
+func (priv PrivateKey) MarshalBinary() (data []byte, err error) {
+	privateKey := make(PrivateKey, PrivateKeySize)
+	copy(privateKey, priv)
+	return privateKey, nil
+}
+
+func (pub PublicKey) MarshalBinary() (data []byte, err error) {
+	publicKey := make(PublicKey, PublicKeySize)
+	copy(publicKey, pub)
+	return publicKey, nil
+}
+
+// Equal reports whether pub and x have the same value.
+func (pub PublicKey) Equal(x crypto.PublicKey) bool {
+	xx, ok := x.(PublicKey)
+	return ok && bytes.Equal(pub, xx)
+}
+
+// Sign creates a signature of a message with priv key.
+// This function is compatible with crypto.ed25519 and also supports the
+// three signature variants defined in RFC-8032, namely Ed25519 (or pure
+// EdDSA), Ed25519Ph, and Ed25519Ctx.
+// The opts.HashFunc() must return zero to specify either Ed25519 or Ed25519Ctx
+// variant. This can be achieved by passing crypto.Hash(0) as the value for
+// opts.
+// The opts.HashFunc() must return SHA512 to specify the Ed25519Ph variant.
+// This can be achieved by passing crypto.SHA512 as the value for opts.
+// Use a SignerOptions struct (defined in this package) to pass a context
+// string for signing.
+func (priv PrivateKey) Sign(
+	rand io.Reader,
+	message []byte,
+	opts crypto.SignerOpts,
+) (signature []byte, err error) {
+	var ctx string
+	var scheme SchemeID
+	if o, ok := opts.(SignerOptions); ok {
+		ctx = o.Context
+		scheme = o.Scheme
+	}
+
+	switch true {
+	case scheme == ED25519 && opts.HashFunc() == crypto.Hash(0):
+		return Sign(priv, message), nil
+	case scheme == ED25519Ph && opts.HashFunc() == crypto.SHA512:
+		return SignPh(priv, message, ctx), nil
+	case scheme == ED25519Ctx && opts.HashFunc() == crypto.Hash(0) && len(ctx) > 0:
+		return SignWithCtx(priv, message, ctx), nil
+	default:
+		return nil, errors.New("ed25519: bad hash algorithm")
+	}
+}
+
+// GenerateKey generates a public/private key pair using entropy from rand.
+// If rand is nil, crypto/rand.Reader will be used.
+func GenerateKey(rand io.Reader) (PublicKey, PrivateKey, error) {
+	if rand == nil {
+		rand = cryptoRand.Reader
+	}
+
+	seed := make([]byte, SeedSize)
+	if _, err := io.ReadFull(rand, seed); err != nil {
+		return nil, nil, err
+	}
+
+	privateKey := NewKeyFromSeed(seed)
+	publicKey := make(PublicKey, PublicKeySize)
+	copy(publicKey, privateKey[SeedSize:])
+
+	return publicKey, privateKey, nil
+}
+
+// NewKeyFromSeed calculates a private key from a seed. It will panic if
+// len(seed) is not SeedSize. This function is provided for interoperability
+// with RFC 8032. RFC 8032's private keys correspond to seeds in this
+// package.
+func NewKeyFromSeed(seed []byte) PrivateKey {
+	privateKey := make(PrivateKey, PrivateKeySize)
+	newKeyFromSeed(privateKey, seed)
+	return privateKey
+}
+
+func newKeyFromSeed(privateKey, seed []byte) {
+	if l := len(seed); l != SeedSize {
+		panic("ed25519: bad seed length: " + strconv.Itoa(l))
+	}
+	var P pointR1
+	k := sha512.Sum512(seed)
+	clamp(k[:])
+	reduceModOrder(k[:paramB], false)
+	P.fixedMult(k[:paramB])
+	copy(privateKey[:SeedSize], seed)
+	_ = P.ToBytes(privateKey[SeedSize:])
+}
+
+func signAll(signature []byte, privateKey PrivateKey, message, ctx []byte, preHash bool) {
+	if l := len(privateKey); l != PrivateKeySize {
+		panic("ed25519: bad private key length: " + strconv.Itoa(l))
+	}
+
+	H := sha512.New()
+	var PHM []byte
+
+	if preHash {
+		_, _ = H.Write(message)
+		PHM = H.Sum(nil)
+		H.Reset()
+	} else {
+		PHM = message
+	}
+
+	// 1.  Hash the 32-byte private key using SHA-512.
+	_, _ = H.Write(privateKey[:SeedSize])
+	h := H.Sum(nil)
+	clamp(h[:])
+	prefix, s := h[paramB:], h[:paramB]
+
+	// 2.  Compute SHA-512(dom2(F, C) || prefix || PH(M))
+	H.Reset()
+
+	writeDom(H, ctx, preHash)
+
+	_, _ = H.Write(prefix)
+	_, _ = H.Write(PHM)
+	r := H.Sum(nil)
+	reduceModOrder(r[:], true)
+
+	// 3.  Compute the point [r]B.
+	var P pointR1
+	P.fixedMult(r[:paramB])
+	R := (&[paramB]byte{})[:]
+	if err := P.ToBytes(R); err != nil {
+		panic(err)
+	}
+
+	// 4.  Compute SHA512(dom2(F, C) || R || A || PH(M)).
+	H.Reset()
+
+	writeDom(H, ctx, preHash)
+
+	_, _ = H.Write(R)
+	_, _ = H.Write(privateKey[SeedSize:])
+	_, _ = H.Write(PHM)
+	hRAM := H.Sum(nil)
+
+	reduceModOrder(hRAM[:], true)
+
+	// 5.  Compute S = (r + k * s) mod order.
+	S := (&[paramB]byte{})[:]
+	calculateS(S, r[:paramB], hRAM[:paramB], s)
+
+	// 6.  The signature is the concatenation of R and S.
+	copy(signature[:paramB], R[:])
+	copy(signature[paramB:], S[:])
+}
+
+// Sign signs the message with privateKey and returns a signature.
+// This function supports the signature variant defined in RFC-8032: Ed25519,
+// also known as the pure version of EdDSA.
+// It will panic if len(privateKey) is not PrivateKeySize.
+func Sign(privateKey PrivateKey, message []byte) []byte {
+	signature := make([]byte, SignatureSize)
+	signAll(signature, privateKey, message, []byte(""), false)
+	return signature
+}
+
+// SignPh creates a signature of a message with private key and context.
+// This function supports the signature variant defined in RFC-8032: Ed25519ph,
+// meaning it internally hashes the message using SHA-512, and optionally
+// accepts a context string.
+// It will panic if len(privateKey) is not PrivateKeySize.
+// Context could be passed to this function, which length should be no more than
+// ContextMaxSize=255. It can be empty.
+func SignPh(privateKey PrivateKey, message []byte, ctx string) []byte {
+	if len(ctx) > ContextMaxSize {
+		panic(fmt.Errorf("ed25519: bad context length: %v", len(ctx)))
+	}
+
+	signature := make([]byte, SignatureSize)
+	signAll(signature, privateKey, message, []byte(ctx), true)
+	return signature
+}
+
+// SignWithCtx creates a signature of a message with private key and context.
+// This function supports the signature variant defined in RFC-8032: Ed25519ctx,
+// meaning it accepts a non-empty context string.
+// It will panic if len(privateKey) is not PrivateKeySize.
+// Context must be passed to this function, which length should be no more than
+// ContextMaxSize=255 and cannot be empty.
+func SignWithCtx(privateKey PrivateKey, message []byte, ctx string) []byte {
+	if len(ctx) == 0 || len(ctx) > ContextMaxSize {
+		panic(fmt.Errorf("ed25519: bad context length: %v > %v", len(ctx), ContextMaxSize))
+	}
+
+	signature := make([]byte, SignatureSize)
+	signAll(signature, privateKey, message, []byte(ctx), false)
+	return signature
+}
+
+func verify(public PublicKey, message, signature, ctx []byte, preHash bool) bool {
+	if len(public) != PublicKeySize ||
+		len(signature) != SignatureSize ||
+		!isLessThanOrder(signature[paramB:]) {
+		return false
+	}
+
+	var P pointR1
+	if ok := P.FromBytes(public); !ok {
+		return false
+	}
+
+	H := sha512.New()
+	var PHM []byte
+
+	if preHash {
+		_, _ = H.Write(message)
+		PHM = H.Sum(nil)
+		H.Reset()
+	} else {
+		PHM = message
+	}
+
+	R := signature[:paramB]
+
+	writeDom(H, ctx, preHash)
+
+	_, _ = H.Write(R)
+	_, _ = H.Write(public)
+	_, _ = H.Write(PHM)
+	hRAM := H.Sum(nil)
+	reduceModOrder(hRAM[:], true)
+
+	var Q pointR1
+	encR := (&[paramB]byte{})[:]
+	P.neg()
+	Q.doubleMult(&P, signature[paramB:], hRAM[:paramB])
+	_ = Q.ToBytes(encR)
+	return bytes.Equal(R, encR)
+}
+
+// VerifyAny returns true if the signature is valid. Failure cases are invalid
+// signature, or when the public key cannot be decoded.
+// This function supports all the three signature variants defined in RFC-8032,
+// namely Ed25519 (or pure EdDSA), Ed25519Ph, and Ed25519Ctx.
+// The opts.HashFunc() must return zero to specify either Ed25519 or Ed25519Ctx
+// variant. This can be achieved by passing crypto.Hash(0) as the value for opts.
+// The opts.HashFunc() must return SHA512 to specify the Ed25519Ph variant.
+// This can be achieved by passing crypto.SHA512 as the value for opts.
+// Use a SignerOptions struct to pass a context string for signing.
+func VerifyAny(public PublicKey, message, signature []byte, opts crypto.SignerOpts) bool {
+	var ctx string
+	var scheme SchemeID
+	if o, ok := opts.(SignerOptions); ok {
+		ctx = o.Context
+		scheme = o.Scheme
+	}
+
+	switch true {
+	case scheme == ED25519 && opts.HashFunc() == crypto.Hash(0):
+		return Verify(public, message, signature)
+	case scheme == ED25519Ph && opts.HashFunc() == crypto.SHA512:
+		return VerifyPh(public, message, signature, ctx)
+	case scheme == ED25519Ctx && opts.HashFunc() == crypto.Hash(0) && len(ctx) > 0:
+		return VerifyWithCtx(public, message, signature, ctx)
+	default:
+		return false
+	}
+}
+
+// Verify returns true if the signature is valid. Failure cases are invalid
+// signature, or when the public key cannot be decoded.
+// This function supports the signature variant defined in RFC-8032: Ed25519,
+// also known as the pure version of EdDSA.
+func Verify(public PublicKey, message, signature []byte) bool {
+	return verify(public, message, signature, []byte(""), false)
+}
+
+// VerifyPh returns true if the signature is valid. Failure cases are invalid
+// signature, or when the public key cannot be decoded.
+// This function supports the signature variant defined in RFC-8032: Ed25519ph,
+// meaning it internally hashes the message using SHA-512.
+// Context could be passed to this function, which length should be no more than
+// 255. It can be empty.
+func VerifyPh(public PublicKey, message, signature []byte, ctx string) bool {
+	return verify(public, message, signature, []byte(ctx), true)
+}
+
+// VerifyWithCtx returns true if the signature is valid. Failure cases are invalid
+// signature, or when the public key cannot be decoded, or when context is
+// not provided.
+// This function supports the signature variant defined in RFC-8032: Ed25519ctx,
+// meaning it does not handle prehashed messages. Non-empty context string must be
+// provided, and must not be more than 255 of length.
+func VerifyWithCtx(public PublicKey, message, signature []byte, ctx string) bool {
+	if len(ctx) == 0 || len(ctx) > ContextMaxSize {
+		return false
+	}
+
+	return verify(public, message, signature, []byte(ctx), false)
+}
+
+func clamp(k []byte) {
+	k[0] &= 248
+	k[paramB-1] = (k[paramB-1] & 127) | 64
+}
+
+// isLessThanOrder returns true if 0 <= x < order.
+func isLessThanOrder(x []byte) bool {
+	i := len(order) - 1
+	for i > 0 && x[i] == order[i] {
+		i--
+	}
+	return x[i] < order[i]
+}
+
+func writeDom(h io.Writer, ctx []byte, preHash bool) {
+	dom2 := "SigEd25519 no Ed25519 collisions"
+
+	if len(ctx) > 0 {
+		_, _ = h.Write([]byte(dom2))
+		if preHash {
+			_, _ = h.Write([]byte{byte(0x01), byte(len(ctx))})
+		} else {
+			_, _ = h.Write([]byte{byte(0x00), byte(len(ctx))})
+		}
+		_, _ = h.Write(ctx)
+	} else if preHash {
+		_, _ = h.Write([]byte(dom2))
+		_, _ = h.Write([]byte{0x01, 0x00})
+	}
+}
diff --git a/.ci/providerlint/vendor/github.com/cloudflare/circl/sign/ed25519/modular.go b/.ci/providerlint/vendor/github.com/cloudflare/circl/sign/ed25519/modular.go
new file mode 100644
index 00000000000..10efafdcafb
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/cloudflare/circl/sign/ed25519/modular.go
@@ -0,0 +1,175 @@
+package ed25519
+
+import (
+	"encoding/binary"
+	"math/bits"
+)
+
+var order = [paramB]byte{
+	0xed, 0xd3, 0xf5, 0x5c, 0x1a, 0x63, 0x12, 0x58,
+	0xd6, 0x9c, 0xf7, 0xa2, 0xde, 0xf9, 0xde, 0x14,
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x10,
+}
+
+// isLessThan returns true if 0 <= x < y, and assumes that slices have the same length.
+func isLessThan(x, y []byte) bool {
+	i := len(x) - 1
+	for i > 0 && x[i] == y[i] {
+		i--
+	}
+	return x[i] < y[i]
+}
+
+// reduceModOrder calculates k = k mod order of the curve.
+func reduceModOrder(k []byte, is512Bit bool) {
+	var X [((2 * paramB) * 8) / 64]uint64
+	numWords := len(k) >> 3
+	for i := 0; i < numWords; i++ {
+		X[i] = binary.LittleEndian.Uint64(k[i*8 : (i+1)*8])
+	}
+	red512(&X, is512Bit)
+	for i := 0; i < numWords; i++ {
+		binary.LittleEndian.PutUint64(k[i*8:(i+1)*8], X[i])
+	}
+}
+
+// red512 calculates x = x mod Order of the curve.
+func red512(x *[8]uint64, full bool) {
+	// Implementation of Algs.(14.47)+(14.52) of Handbook of Applied
+	// Cryptography, by A. Menezes, P. van Oorschot, and S. Vanstone.
+	const (
+		ell0   = uint64(0x5812631a5cf5d3ed)
+		ell1   = uint64(0x14def9dea2f79cd6)
+		ell160 = uint64(0x812631a5cf5d3ed0)
+		ell161 = uint64(0x4def9dea2f79cd65)
+		ell162 = uint64(0x0000000000000001)
+	)
+
+	var c0, c1, c2, c3 uint64
+	r0, r1, r2, r3, r4 := x[0], x[1], x[2], x[3], uint64(0)
+
+	if full {
+		q0, q1, q2, q3 := x[4], x[5], x[6], x[7]
+
+		for i := 0; i < 3; i++ {
+			h0, s0 := bits.Mul64(q0, ell160)
+			h1, s1 := bits.Mul64(q1, ell160)
+			h2, s2 := bits.Mul64(q2, ell160)
+			h3, s3 := bits.Mul64(q3, ell160)
+
+			s1, c0 = bits.Add64(h0, s1, 0)
+			s2, c1 = bits.Add64(h1, s2, c0)
+			s3, c2 = bits.Add64(h2, s3, c1)
+			s4, _ := bits.Add64(h3, 0, c2)
+
+			h0, l0 := bits.Mul64(q0, ell161)
+			h1, l1 := bits.Mul64(q1, ell161)
+			h2, l2 := bits.Mul64(q2, ell161)
+			h3, l3 := bits.Mul64(q3, ell161)
+
+			l1, c0 = bits.Add64(h0, l1, 0)
+			l2, c1 = bits.Add64(h1, l2, c0)
+			l3, c2 = bits.Add64(h2, l3, c1)
+			l4, _ := bits.Add64(h3, 0, c2)
+
+			s1, c0 = bits.Add64(s1, l0, 0)
+			s2, c1 = bits.Add64(s2, l1, c0)
+			s3, c2 = bits.Add64(s3, l2, c1)
+			s4, c3 = bits.Add64(s4, l3, c2)
+			s5, s6 := bits.Add64(l4, 0, c3)
+
+			s2, c0 = bits.Add64(s2, q0, 0)
+			s3, c1 = bits.Add64(s3, q1, c0)
+			s4, c2 = bits.Add64(s4, q2, c1)
+			s5, c3 = bits.Add64(s5, q3, c2)
+			s6, s7 := bits.Add64(s6, 0, c3)
+
+			q := q0 | q1 | q2 | q3
+			m := -((q | -q) >> 63) // if q=0 then m=0...0 else m=1..1
+			s0 &= m
+			s1 &= m
+			s2 &= m
+			s3 &= m
+			q0, q1, q2, q3 = s4, s5, s6, s7
+
+			if (i+1)%2 == 0 {
+				r0, c0 = bits.Add64(r0, s0, 0)
+				r1, c1 = bits.Add64(r1, s1, c0)
+				r2, c2 = bits.Add64(r2, s2, c1)
+				r3, c3 = bits.Add64(r3, s3, c2)
+				r4, _ = bits.Add64(r4, 0, c3)
+			} else {
+				r0, c0 = bits.Sub64(r0, s0, 0)
+				r1, c1 = bits.Sub64(r1, s1, c0)
+				r2, c2 = bits.Sub64(r2, s2, c1)
+				r3, c3 = bits.Sub64(r3, s3, c2)
+				r4, _ = bits.Sub64(r4, 0, c3)
+			}
+		}
+
+		m := -(r4 >> 63)
+		r0, c0 = bits.Add64(r0, m&ell160, 0)
+		r1, c1 = bits.Add64(r1, m&ell161, c0)
+		r2, c2 = bits.Add64(r2, m&ell162, c1)
+		r3, c3 = bits.Add64(r3, 0, c2)
+		r4, _ = bits.Add64(r4, m&1, c3)
+		x[4], x[5], x[6], x[7] = 0, 0, 0, 0
+	}
+
+	q0 := (r4 << 4) | (r3 >> 60)
+	r3 &= (uint64(1) << 60) - 1
+
+	h0, s0 := bits.Mul64(ell0, q0)
+	h1, s1 := bits.Mul64(ell1, q0)
+	s1, c0 = bits.Add64(h0, s1, 0)
+	s2, _ := bits.Add64(h1, 0, c0)
+
+	r0, c0 = bits.Sub64(r0, s0, 0)
+	r1, c1 = bits.Sub64(r1, s1, c0)
+	r2, c2 = bits.Sub64(r2, s2, c1)
+	r3, _ = bits.Sub64(r3, 0, c2)
+
+	x[0], x[1], x[2], x[3] = r0, r1, r2, r3
+}
+
+// calculateS performs s = r+k*a mod Order of the curve.
+func calculateS(s, r, k, a []byte) {
+	K := [4]uint64{
+		binary.LittleEndian.Uint64(k[0*8 : 1*8]),
+		binary.LittleEndian.Uint64(k[1*8 : 2*8]),
+		binary.LittleEndian.Uint64(k[2*8 : 3*8]),
+		binary.LittleEndian.Uint64(k[3*8 : 4*8]),
+	}
+	S := [8]uint64{
+		binary.LittleEndian.Uint64(r[0*8 : 1*8]),
+		binary.LittleEndian.Uint64(r[1*8 : 2*8]),
+		binary.LittleEndian.Uint64(r[2*8 : 3*8]),
+		binary.LittleEndian.Uint64(r[3*8 : 4*8]),
+	}
+	var c3 uint64
+	for i := range K {
+		ai := binary.LittleEndian.Uint64(a[i*8 : (i+1)*8])
+
+		h0, l0 := bits.Mul64(K[0], ai)
+		h1, l1 := bits.Mul64(K[1], ai)
+		h2, l2 := bits.Mul64(K[2], ai)
+		h3, l3 := bits.Mul64(K[3], ai)
+
+		l1, c0 := bits.Add64(h0, l1, 0)
+		l2, c1 := bits.Add64(h1, l2, c0)
+		l3, c2 := bits.Add64(h2, l3, c1)
+		l4, _ := bits.Add64(h3, 0, c2)
+
+		S[i+0], c0 = bits.Add64(S[i+0], l0, 0)
+		S[i+1], c1 = bits.Add64(S[i+1], l1, c0)
+		S[i+2], c2 = bits.Add64(S[i+2], l2, c1)
+		S[i+3], c3 = bits.Add64(S[i+3], l3, c2)
+		S[i+4], _ = bits.Add64(S[i+4], l4, c3)
+	}
+	red512(&S, true)
+	binary.LittleEndian.PutUint64(s[0*8:1*8], S[0])
+	binary.LittleEndian.PutUint64(s[1*8:2*8], S[1])
+	binary.LittleEndian.PutUint64(s[2*8:3*8], S[2])
+	binary.LittleEndian.PutUint64(s[3*8:4*8], S[3])
+}
diff --git a/.ci/providerlint/vendor/github.com/cloudflare/circl/sign/ed25519/mult.go b/.ci/providerlint/vendor/github.com/cloudflare/circl/sign/ed25519/mult.go
new file mode 100644
index 00000000000..3216aae303c
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/cloudflare/circl/sign/ed25519/mult.go
@@ -0,0 +1,180 @@
+package ed25519
+
+import (
+	"crypto/subtle"
+	"encoding/binary"
+	"math/bits"
+
+	"github.com/cloudflare/circl/internal/conv"
+	"github.com/cloudflare/circl/math"
+	fp "github.com/cloudflare/circl/math/fp25519"
+)
+
+var paramD = fp.Elt{
+	0xa3, 0x78, 0x59, 0x13, 0xca, 0x4d, 0xeb, 0x75,
+	0xab, 0xd8, 0x41, 0x41, 0x4d, 0x0a, 0x70, 0x00,
+	0x98, 0xe8, 0x79, 0x77, 0x79, 0x40, 0xc7, 0x8c,
+	0x73, 0xfe, 0x6f, 0x2b, 0xee, 0x6c, 0x03, 0x52,
+}
+
+// mLSBRecoding parameters.
+const (
+	fxT        = 257
+	fxV        = 2
+	fxW        = 3
+	fx2w1      = 1 << (uint(fxW) - 1)
+	numWords64 = (paramB * 8 / 64)
+)
+
+// mLSBRecoding is the odd-only modified LSB-set.
+//
+// Reference:
+//
+//	"Efficient and secure algorithms for GLV-based scalar multiplication and
+//	 their implementation on GLV–GLS curves" by (Faz-Hernandez et al.)
+//	 http://doi.org/10.1007/s13389-014-0085-7.
+func mLSBRecoding(L []int8, k []byte) {
+	const ee = (fxT + fxW*fxV - 1) / (fxW * fxV)
+	const dd = ee * fxV
+	const ll = dd * fxW
+	if len(L) == (ll + 1) {
+		var m [numWords64 + 1]uint64
+		for i := 0; i < numWords64; i++ {
+			m[i] = binary.LittleEndian.Uint64(k[8*i : 8*i+8])
+		}
+		condAddOrderN(&m)
+		L[dd-1] = 1
+		for i := 0; i < dd-1; i++ {
+			kip1 := (m[(i+1)/64] >> (uint(i+1) % 64)) & 0x1
+			L[i] = int8(kip1<<1) - 1
+		}
+		{ // right-shift by d
+			right := uint(dd % 64)
+			left := uint(64) - right
+			lim := ((numWords64+1)*64 - dd) / 64
+			j := dd / 64
+			for i := 0; i < lim; i++ {
+				m[i] = (m[i+j] >> right) | (m[i+j+1] << left)
+			}
+			m[lim] = m[lim+j] >> right
+		}
+		for i := dd; i < ll; i++ {
+			L[i] = L[i%dd] * int8(m[0]&0x1)
+			div2subY(m[:], int64(L[i]>>1), numWords64)
+		}
+		L[ll] = int8(m[0])
+	}
+}
+
+// absolute returns always a positive value.
+func absolute(x int32) int32 {
+	mask := x >> 31
+	return (x + mask) ^ mask
+}
+
+// condAddOrderN updates x = x+order if x is even, otherwise x remains unchanged.
+func condAddOrderN(x *[numWords64 + 1]uint64) {
+	isOdd := (x[0] & 0x1) - 1
+	c := uint64(0)
+	for i := 0; i < numWords64; i++ {
+		orderWord := binary.LittleEndian.Uint64(order[8*i : 8*i+8])
+		o := isOdd & orderWord
+		x0, c0 := bits.Add64(x[i], o, c)
+		x[i] = x0
+		c = c0
+	}
+	x[numWords64], _ = bits.Add64(x[numWords64], 0, c)
+}
+
+// div2subY update x = (x/2) - y.
+func div2subY(x []uint64, y int64, l int) {
+	s := uint64(y >> 63)
+	for i := 0; i < l-1; i++ {
+		x[i] = (x[i] >> 1) | (x[i+1] << 63)
+	}
+	x[l-1] = (x[l-1] >> 1)
+
+	b := uint64(0)
+	x0, b0 := bits.Sub64(x[0], uint64(y), b)
+	x[0] = x0
+	b = b0
+	for i := 1; i < l-1; i++ {
+		x0, b0 := bits.Sub64(x[i], s, b)
+		x[i] = x0
+		b = b0
+	}
+	x[l-1], _ = bits.Sub64(x[l-1], s, b)
+}
+
+func (P *pointR1) fixedMult(scalar []byte) {
+	if len(scalar) != paramB {
+		panic("wrong scalar size")
+	}
+	const ee = (fxT + fxW*fxV - 1) / (fxW * fxV)
+	const dd = ee * fxV
+	const ll = dd * fxW
+
+	L := make([]int8, ll+1)
+	mLSBRecoding(L[:], scalar)
+	S := &pointR3{}
+	P.SetIdentity()
+	for ii := ee - 1; ii >= 0; ii-- {
+		P.double()
+		for j := 0; j < fxV; j++ {
+			dig := L[fxW*dd-j*ee+ii-ee]
+			for i := (fxW-1)*dd - j*ee + ii - ee; i >= (2*dd - j*ee + ii - ee); i = i - dd {
+				dig = 2*dig + L[i]
+			}
+			idx := absolute(int32(dig))
+			sig := L[dd-j*ee+ii-ee]
+			Tabj := &tabSign[fxV-j-1]
+			for k := 0; k < fx2w1; k++ {
+				S.cmov(&Tabj[k], subtle.ConstantTimeEq(int32(k), idx))
+			}
+			S.cneg(subtle.ConstantTimeEq(int32(sig), -1))
+			P.mixAdd(S)
+		}
+	}
+}
+
+const (
+	omegaFix = 7
+	omegaVar = 5
+)
+
+// doubleMult returns P=mG+nQ.
+func (P *pointR1) doubleMult(Q *pointR1, m, n []byte) {
+	nafFix := math.OmegaNAF(conv.BytesLe2BigInt(m), omegaFix)
+	nafVar := math.OmegaNAF(conv.BytesLe2BigInt(n), omegaVar)
+
+	if len(nafFix) > len(nafVar) {
+		nafVar = append(nafVar, make([]int32, len(nafFix)-len(nafVar))...)
+	} else if len(nafFix) < len(nafVar) {
+		nafFix = append(nafFix, make([]int32, len(nafVar)-len(nafFix))...)
+	}
+
+	var TabQ [1 << (omegaVar - 2)]pointR2
+	Q.oddMultiples(TabQ[:])
+	P.SetIdentity()
+	for i := len(nafFix) - 1; i >= 0; i-- {
+		P.double()
+		// Generator point
+		if nafFix[i] != 0 {
+			idxM := absolute(nafFix[i]) >> 1
+			R := tabVerif[idxM]
+			if nafFix[i] < 0 {
+				R.neg()
+			}
+			P.mixAdd(&R)
+		}
+		// Variable input point
+		if nafVar[i] != 0 {
+			idxN := absolute(nafVar[i]) >> 1
+			S := TabQ[idxN]
+			if nafVar[i] < 0 {
+				S.neg()
+			}
+			P.add(&S)
+		}
+	}
+}
diff --git a/.ci/providerlint/vendor/github.com/cloudflare/circl/sign/ed25519/point.go b/.ci/providerlint/vendor/github.com/cloudflare/circl/sign/ed25519/point.go
new file mode 100644
index 00000000000..374a69503c3
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/cloudflare/circl/sign/ed25519/point.go
@@ -0,0 +1,195 @@
+package ed25519
+
+import fp "github.com/cloudflare/circl/math/fp25519"
+
+type (
+	pointR1 struct{ x, y, z, ta, tb fp.Elt }
+	pointR2 struct {
+		pointR3
+		z2 fp.Elt
+	}
+)
+type pointR3 struct{ addYX, subYX, dt2 fp.Elt }
+
+func (P *pointR1) neg() {
+	fp.Neg(&P.x, &P.x)
+	fp.Neg(&P.ta, &P.ta)
+}
+
+func (P *pointR1) SetIdentity() {
+	P.x = fp.Elt{}
+	fp.SetOne(&P.y)
+	fp.SetOne(&P.z)
+	P.ta = fp.Elt{}
+	P.tb = fp.Elt{}
+}
+
+func (P *pointR1) toAffine() {
+	fp.Inv(&P.z, &P.z)
+	fp.Mul(&P.x, &P.x, &P.z)
+	fp.Mul(&P.y, &P.y, &P.z)
+	fp.Modp(&P.x)
+	fp.Modp(&P.y)
+	fp.SetOne(&P.z)
+	P.ta = P.x
+	P.tb = P.y
+}
+
+func (P *pointR1) ToBytes(k []byte) error {
+	P.toAffine()
+	var x [fp.Size]byte
+	err := fp.ToBytes(k[:fp.Size], &P.y)
+	if err != nil {
+		return err
+	}
+	err = fp.ToBytes(x[:], &P.x)
+	if err != nil {
+		return err
+	}
+	b := x[0] & 1
+	k[paramB-1] = k[paramB-1] | (b << 7)
+	return nil
+}
+
+func (P *pointR1) FromBytes(k []byte) bool {
+	if len(k) != paramB {
+		panic("wrong size")
+	}
+	signX := k[paramB-1] >> 7
+	copy(P.y[:], k[:fp.Size])
+	P.y[fp.Size-1] &= 0x7F
+	p := fp.P()
+	if !isLessThan(P.y[:], p[:]) {
+		return false
+	}
+
+	one, u, v := &fp.Elt{}, &fp.Elt{}, &fp.Elt{}
+	fp.SetOne(one)
+	fp.Sqr(u, &P.y)                // u = y^2
+	fp.Mul(v, u, &paramD)          // v = dy^2
+	fp.Sub(u, u, one)              // u = y^2-1
+	fp.Add(v, v, one)              // v = dy^2+1
+	isQR := fp.InvSqrt(&P.x, u, v) // x = sqrt(u/v)
+	if !isQR {
+		return false
+	}
+	fp.Modp(&P.x) // x = x mod p
+	if fp.IsZero(&P.x) && signX == 1 {
+		return false
+	}
+	if signX != (P.x[0] & 1) {
+		fp.Neg(&P.x, &P.x)
+	}
+	P.ta = P.x
+	P.tb = P.y
+	fp.SetOne(&P.z)
+	return true
+}
+
+// double calculates 2P for curves with A=-1.
+func (P *pointR1) double() {
+	Px, Py, Pz, Pta, Ptb := &P.x, &P.y, &P.z, &P.ta, &P.tb
+	a, b, c, e, f, g, h := Px, Py, Pz, Pta, Px, Py, Ptb
+	fp.Add(e, Px, Py) // x+y
+	fp.Sqr(a, Px)     // A = x^2
+	fp.Sqr(b, Py)     // B = y^2
+	fp.Sqr(c, Pz)     // z^2
+	fp.Add(c, c, c)   // C = 2*z^2
+	fp.Add(h, a, b)   // H = A+B
+	fp.Sqr(e, e)      // (x+y)^2
+	fp.Sub(e, e, h)   // E = (x+y)^2-A-B
+	fp.Sub(g, b, a)   // G = B-A
+	fp.Sub(f, c, g)   // F = C-G
+	fp.Mul(Pz, f, g)  // Z = F * G
+	fp.Mul(Px, e, f)  // X = E * F
+	fp.Mul(Py, g, h)  // Y = G * H, T = E * H
+}
+
+func (P *pointR1) mixAdd(Q *pointR3) {
+	fp.Add(&P.z, &P.z, &P.z) // D = 2*z1
+	P.coreAddition(Q)
+}
+
+func (P *pointR1) add(Q *pointR2) {
+	fp.Mul(&P.z, &P.z, &Q.z2) // D = 2*z1*z2
+	P.coreAddition(&Q.pointR3)
+}
+
+// coreAddition calculates P=P+Q for curves with A=-1.
+func (P *pointR1) coreAddition(Q *pointR3) {
+	Px, Py, Pz, Pta, Ptb := &P.x, &P.y, &P.z, &P.ta, &P.tb
+	addYX2, subYX2, dt2 := &Q.addYX, &Q.subYX, &Q.dt2
+	a, b, c, d, e, f, g, h := Px, Py, &fp.Elt{}, Pz, Pta, Px, Py, Ptb
+	fp.Mul(c, Pta, Ptb)  // t1 = ta*tb
+	fp.Sub(h, Py, Px)    // y1-x1
+	fp.Add(b, Py, Px)    // y1+x1
+	fp.Mul(a, h, subYX2) // A = (y1-x1)*(y2-x2)
+	fp.Mul(b, b, addYX2) // B = (y1+x1)*(y2+x2)
+	fp.Mul(c, c, dt2)    // C = 2*D*t1*t2
+	fp.Sub(e, b, a)      // E = B-A
+	fp.Add(h, b, a)      // H = B+A
+	fp.Sub(f, d, c)      // F = D-C
+	fp.Add(g, d, c)      // G = D+C
+	fp.Mul(Pz, f, g)     // Z = F * G
+	fp.Mul(Px, e, f)     // X = E * F
+	fp.Mul(Py, g, h)     // Y = G * H, T = E * H
+}
+
+func (P *pointR1) oddMultiples(T []pointR2) {
+	var R pointR2
+	n := len(T)
+	T[0].fromR1(P)
+	_2P := *P
+	_2P.double()
+	R.fromR1(&_2P)
+	for i := 1; i < n; i++ {
+		P.add(&R)
+		T[i].fromR1(P)
+	}
+}
+
+func (P *pointR1) isEqual(Q *pointR1) bool {
+	l, r := &fp.Elt{}, &fp.Elt{}
+	fp.Mul(l, &P.x, &Q.z)
+	fp.Mul(r, &Q.x, &P.z)
+	fp.Sub(l, l, r)
+	b := fp.IsZero(l)
+	fp.Mul(l, &P.y, &Q.z)
+	fp.Mul(r, &Q.y, &P.z)
+	fp.Sub(l, l, r)
+	b = b && fp.IsZero(l)
+	fp.Mul(l, &P.ta, &P.tb)
+	fp.Mul(l, l, &Q.z)
+	fp.Mul(r, &Q.ta, &Q.tb)
+	fp.Mul(r, r, &P.z)
+	fp.Sub(l, l, r)
+	b = b && fp.IsZero(l)
+	return b
+}
+
+func (P *pointR3) neg() {
+	P.addYX, P.subYX = P.subYX, P.addYX
+	fp.Neg(&P.dt2, &P.dt2)
+}
+
+func (P *pointR2) fromR1(Q *pointR1) {
+	fp.Add(&P.addYX, &Q.y, &Q.x)
+	fp.Sub(&P.subYX, &Q.y, &Q.x)
+	fp.Mul(&P.dt2, &Q.ta, &Q.tb)
+	fp.Mul(&P.dt2, &P.dt2, &paramD)
+	fp.Add(&P.dt2, &P.dt2, &P.dt2)
+	fp.Add(&P.z2, &Q.z, &Q.z)
+}
+
+func (P *pointR3) cneg(b int) {
+	t := &fp.Elt{}
+	fp.Cswap(&P.addYX, &P.subYX, uint(b))
+	fp.Neg(t, &P.dt2)
+	fp.Cmov(&P.dt2, t, uint(b))
+}
+
+func (P *pointR3) cmov(Q *pointR3, b int) {
+	fp.Cmov(&P.addYX, &Q.addYX, uint(b))
+	fp.Cmov(&P.subYX, &Q.subYX, uint(b))
+	fp.Cmov(&P.dt2, &Q.dt2, uint(b))
+}
diff --git a/.ci/providerlint/vendor/github.com/cloudflare/circl/sign/ed25519/pubkey.go b/.ci/providerlint/vendor/github.com/cloudflare/circl/sign/ed25519/pubkey.go
new file mode 100644
index 00000000000..c3505b67ace
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/cloudflare/circl/sign/ed25519/pubkey.go
@@ -0,0 +1,9 @@
+//go:build go1.13
+// +build go1.13
+
+package ed25519
+
+import cryptoEd25519 "crypto/ed25519"
+
+// PublicKey is the type of Ed25519 public keys.
+type PublicKey cryptoEd25519.PublicKey
diff --git a/.ci/providerlint/vendor/github.com/cloudflare/circl/sign/ed25519/pubkey112.go b/.ci/providerlint/vendor/github.com/cloudflare/circl/sign/ed25519/pubkey112.go
new file mode 100644
index 00000000000..d57d86eff08
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/cloudflare/circl/sign/ed25519/pubkey112.go
@@ -0,0 +1,7 @@
+//go:build !go1.13
+// +build !go1.13
+
+package ed25519
+
+// PublicKey is the type of Ed25519 public keys.
+type PublicKey []byte
diff --git a/.ci/providerlint/vendor/github.com/cloudflare/circl/sign/ed25519/signapi.go b/.ci/providerlint/vendor/github.com/cloudflare/circl/sign/ed25519/signapi.go
new file mode 100644
index 00000000000..e4520f52034
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/cloudflare/circl/sign/ed25519/signapi.go
@@ -0,0 +1,87 @@
+package ed25519
+
+import (
+	"crypto/rand"
+	"encoding/asn1"
+
+	"github.com/cloudflare/circl/sign"
+)
+
+var sch sign.Scheme = &scheme{}
+
+// Scheme returns a signature interface.
+func Scheme() sign.Scheme { return sch }
+
+type scheme struct{}
+
+func (*scheme) Name() string          { return "Ed25519" }
+func (*scheme) PublicKeySize() int    { return PublicKeySize }
+func (*scheme) PrivateKeySize() int   { return PrivateKeySize }
+func (*scheme) SignatureSize() int    { return SignatureSize }
+func (*scheme) SeedSize() int         { return SeedSize }
+func (*scheme) TLSIdentifier() uint   { return 0x0807 }
+func (*scheme) SupportsContext() bool { return false }
+func (*scheme) Oid() asn1.ObjectIdentifier {
+	return asn1.ObjectIdentifier{1, 3, 101, 112}
+}
+
+func (*scheme) GenerateKey() (sign.PublicKey, sign.PrivateKey, error) {
+	return GenerateKey(rand.Reader)
+}
+
+func (*scheme) Sign(
+	sk sign.PrivateKey,
+	message []byte,
+	opts *sign.SignatureOpts,
+) []byte {
+	priv, ok := sk.(PrivateKey)
+	if !ok {
+		panic(sign.ErrTypeMismatch)
+	}
+	if opts != nil && opts.Context != "" {
+		panic(sign.ErrContextNotSupported)
+	}
+	return Sign(priv, message)
+}
+
+func (*scheme) Verify(
+	pk sign.PublicKey,
+	message, signature []byte,
+	opts *sign.SignatureOpts,
+) bool {
+	pub, ok := pk.(PublicKey)
+	if !ok {
+		panic(sign.ErrTypeMismatch)
+	}
+	if opts != nil {
+		if opts.Context != "" {
+			panic(sign.ErrContextNotSupported)
+		}
+	}
+	return Verify(pub, message, signature)
+}
+
+func (*scheme) DeriveKey(seed []byte) (sign.PublicKey, sign.PrivateKey) {
+	privateKey := NewKeyFromSeed(seed)
+	publicKey := make(PublicKey, PublicKeySize)
+	copy(publicKey, privateKey[SeedSize:])
+	return publicKey, privateKey
+}
+
+func (*scheme) UnmarshalBinaryPublicKey(buf []byte) (sign.PublicKey, error) {
+	if len(buf) < PublicKeySize {
+		return nil, sign.ErrPubKeySize
+	}
+	pub := make(PublicKey, PublicKeySize)
+	copy(pub, buf[:PublicKeySize])
+	return pub, nil
+}
+
+func (*scheme) UnmarshalBinaryPrivateKey(buf []byte) (sign.PrivateKey, error) {
+	if len(buf) < PrivateKeySize {
+		return nil, sign.ErrPrivKeySize
+	}
+	priv := make(PrivateKey, PrivateKeySize)
+	copy(priv, buf[:PrivateKeySize])
+	return priv, nil
+}
diff --git a/.ci/providerlint/vendor/github.com/cloudflare/circl/sign/ed25519/tables.go b/.ci/providerlint/vendor/github.com/cloudflare/circl/sign/ed25519/tables.go
new file mode 100644
index 00000000000..8763b426fc0
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/cloudflare/circl/sign/ed25519/tables.go
@@ -0,0 +1,213 @@
+package ed25519
+
+import fp "github.com/cloudflare/circl/math/fp25519"
+
+var tabSign = [fxV][fx2w1]pointR3{
+	{
+		pointR3{
+			addYX: fp.Elt{0x85, 0x3b, 0x8c, 0xf5, 0xc6, 0x93, 0xbc, 0x2f, 0x19, 0x0e, 0x8c, 0xfb, 0xc6, 0x2d, 0x93, 0xcf, 0xc2, 0x42, 0x3d, 0x64, 0x98, 0x48, 0x0b, 0x27, 0x65, 0xba, 0xd4, 0x33, 0x3a, 0x9d, 0xcf, 0x07},
+			subYX: fp.Elt{0x3e, 0x91, 0x40, 0xd7, 0x05, 0x39, 0x10, 0x9d, 0xb3, 0xbe, 0x40, 0xd1, 0x05, 0x9f, 0x39, 0xfd, 0x09, 0x8a, 0x8f, 0x68, 0x34, 0x84, 0xc1, 0xa5, 0x67, 0x12, 0xf8, 0x98, 0x92, 0x2f, 0xfd, 0x44},
+			dt2:   fp.Elt{0x68, 0xaa, 0x7a, 0x87, 0x05, 0x12, 0xc9, 0xab, 0x9e, 0xc4, 0xaa, 0xcc, 0x23, 0xe8, 0xd9, 0x26, 0x8c, 0x59, 0x43, 0xdd, 0xcb, 0x7d, 0x1b, 0x5a, 0xa8, 0x65, 0x0c, 0x9f, 0x68, 0x7b, 0x11, 0x6f},
+		},
+		{
+			addYX: fp.Elt{0x7c, 0xb0, 0x9e, 0xe6, 0xc5, 0xbf, 0xfa, 0x13, 0x8e, 0x0d, 0x22, 0xde, 0xc8, 0xd1, 0xce, 0x52, 0x02, 0xd5, 0x62, 0x31, 0x71, 0x0e, 0x8e, 0x9d, 0xb0, 0xd6, 0x00, 0xa5, 0x5a, 0x0e, 0xce, 0x72},
+			subYX: fp.Elt{0x1a, 0x8e, 0x5c, 0xdc, 0xa4, 0xb3, 0x6c, 0x51, 0x18, 0xa0, 0x09, 0x80, 0x9a, 0x46, 0x33, 0xd5, 0xe0, 0x3c, 0x4d, 0x3b, 0xfc, 0x49, 0xa2, 0x43, 0x29, 0xe1, 0x29, 0xa9, 0x93, 0xea, 0x7c, 0x35},
+			dt2:   fp.Elt{0x08, 0x46, 0x6f, 0x68, 0x7f, 0x0b, 0x7c, 0x9e, 0xad, 0xba, 0x07, 0x61, 0x74, 0x83, 0x2f, 0xfc, 0x26, 0xd6, 0x09, 0xb9, 0x00, 0x34, 0x36, 0x4f, 0x01, 0xf3, 0x48, 0xdb, 0x43, 0xba, 0x04, 0x44},
+		},
+		{
+			addYX: fp.Elt{0x4c, 0xda, 0x0d, 0x13, 0x66, 0xfd, 0x82, 0x84, 0x9f, 0x75, 0x5b, 0xa2, 0x17, 0xfe, 0x34, 0xbf, 0x1f, 0xcb, 0xba, 0x90, 0x55, 0x80, 0x83, 0xfd, 0x63, 0xb9, 0x18, 0xf8, 0x5b, 0x5d, 0x94, 0x1e},
+			subYX: fp.Elt{0xb9, 0xdb, 0x6c, 0x04, 0x88, 0x22, 0xd8, 0x79, 0x83, 0x2f, 0x8d, 0x65, 0x6b, 0xd2, 0xab, 0x1b, 0xdd, 0x65, 0xe5, 0x93, 0x63, 0xf8, 0xa2, 0xd8, 0x3c, 0xf1, 0x4b, 0xc5, 0x99, 0xd1, 0xf2, 0x12},
+			dt2:   fp.Elt{0x05, 0x4c, 0xb8, 0x3b, 0xfe, 0xf5, 0x9f, 0x2e, 0xd1, 0xb2, 0xb8, 0xff, 0xfe, 0x6d, 0xd9, 0x37, 0xe0, 0xae, 0xb4, 0x5a, 0x51, 0x80, 0x7e, 0x9b, 0x1d, 0xd1, 0x8d, 0x8c, 0x56, 0xb1, 0x84, 0x35},
+		},
+		{
+			addYX: fp.Elt{0x39, 0x71, 0x43, 0x34, 0xe3, 0x42, 0x45, 0xa1, 0xf2, 0x68, 0x71, 0xa7, 0xe8, 0x23, 0xfd, 0x9f, 0x86, 0x48, 0xff, 0xe5, 0x96, 0x74, 0xcf, 0x05, 0x49, 0xe2, 0xb3, 0x6c, 0x17, 0x77, 0x2f, 0x6d},
+			subYX: fp.Elt{0x73, 0x3f, 0xc1, 0xc7, 0x6a, 0x66, 0xa1, 0x20, 0xdd, 0x11, 0xfb, 0x7a, 0x6e, 0xa8, 0x51, 0xb8, 0x3f, 0x9d, 0xa2, 0x97, 0x84, 0xb5, 0xc7, 0x90, 0x7c, 0xab, 0x48, 0xd6, 0x84, 0xa3, 0xd5, 0x1a},
+			dt2:   fp.Elt{0x63, 0x27, 0x3c, 0x49, 0x4b, 0xfc, 0x22, 0xf2, 0x0b, 0x50, 0xc2, 0x0f, 0xb4, 0x1f, 0x31, 0x0c, 0x2f, 0x53, 0xab, 0xaa, 0x75, 0x6f, 0xe0, 0x69, 0x39, 0x56, 0xe0, 0x3b, 0xb7, 0xa8, 0xbf, 0x45},
+		},
+	},
+	{
+		{
+			addYX: fp.Elt{0x00, 0x45, 0xd9, 0x0d, 0x58, 0x03, 0xfc, 0x29, 0x93, 0xec, 0xbb, 0x6f, 0xa4, 0x7a, 0xd2, 0xec, 0xf8, 0xa7, 0xe2, 0xc2, 0x5f, 0x15, 0x0a, 0x13, 0xd5, 0xa1, 0x06, 0xb7, 0x1a, 0x15, 0x6b, 0x41},
+			subYX: fp.Elt{0x85, 0x8c, 0xb2, 0x17, 0xd6, 0x3b, 0x0a, 0xd3, 0xea, 0x3b, 0x77, 0x39, 0xb7, 0x77, 0xd3, 0xc5, 0xbf, 0x5c, 0x6a, 0x1e, 0x8c, 0xe7, 0xc6, 0xc6, 0xc4, 0xb7, 0x2a, 0x8b, 0xf7, 0xb8, 0x61, 0x0d},
+			dt2:   fp.Elt{0xb0, 0x36, 0xc1, 0xe9, 0xef, 0xd7, 0xa8, 0x56, 0x20, 0x4b, 0xe4, 0x58, 0xcd, 0xe5, 0x07, 0xbd, 0xab, 0xe0, 0x57, 0x1b, 0xda, 0x2f, 0xe6, 0xaf, 0xd2, 0xe8, 0x77, 0x42, 0xf7, 0x2a, 0x1a, 0x19},
+		},
+		{
+			addYX: fp.Elt{0x6a, 0x6d, 0x6d, 0xd1, 0xfa, 0xf5, 0x03, 0x30, 0xbd, 0x6d, 0xc2, 0xc8, 0xf5, 0x38, 0x80, 0x4f, 0xb2, 0xbe, 0xa1, 0x76, 0x50, 0x1a, 0x73, 0xf2, 0x78, 0x2b, 0x8e, 0x3a, 0x1e, 0x34, 0x47, 0x7b},
+			subYX: fp.Elt{0xc3, 0x2c, 0x36, 0xdc, 0xc5, 0x45, 0xbc, 0xef, 0x1b, 0x64, 0xd6, 0x65, 0x28, 0xe9, 0xda, 0x84, 0x13, 0xbe, 0x27, 0x8e, 0x3f, 0x98, 0x2a, 0x37, 0xee, 0x78, 0x97, 0xd6, 0xc0, 0x6f, 0xb4, 0x53},
+			dt2:   fp.Elt{0x58, 0x5d, 0xa7, 0xa3, 0x68, 0xbb, 0x20, 0x30, 0x2e, 0x03, 0xe9, 0xb1, 0xd4, 0x90, 0x72, 0xe3, 0x71, 0xb2, 0x36, 0x3e, 0x73, 0xa0, 0x2e, 0x3d, 0xd1, 0x85, 0x33, 0x62, 0x4e, 0xa7, 0x7b, 0x31},
+		},
+		{
+			addYX: fp.Elt{0xbf, 0xc4, 0x38, 0x53, 0xfb, 0x68, 0xa9, 0x77, 0xce, 0x55, 0xf9, 0x05, 0xcb, 0xeb, 0xfb, 0x8c, 0x46, 0xc2, 0x32, 0x7c, 0xf0, 0xdb, 0xd7, 0x2c, 0x62, 0x8e, 0xdd, 0x54, 0x75, 0xcf, 0x3f, 0x33},
+			subYX: fp.Elt{0x49, 0x50, 0x1f, 0x4e, 0x6e, 0x55, 0x55, 0xde, 0x8c, 0x4e, 0x77, 0x96, 0x38, 0x3b, 0xfe, 0xb6, 0x43, 0x3c, 0x86, 0x69, 0xc2, 0x72, 0x66, 0x1f, 0x6b, 0xf9, 0x87, 0xbc, 0x4f, 0x37, 0x3e, 0x3c},
+			dt2:   fp.Elt{0xd2, 0x2f, 0x06, 0x6b, 0x08, 0x07, 0x69, 0x77, 0xc0, 0x94, 0xcc, 0xae, 0x43, 0x00, 0x59, 0x6e, 0xa3, 0x63, 0xa8, 0xdd, 0xfa, 0x24, 0x18, 0xd0, 0x35, 0xc7, 0x78, 0xf7, 0x0d, 0xd4, 0x5a, 0x1e},
+		},
+		{
+			addYX: fp.Elt{0x45, 0xc1, 0x17, 0x51, 0xf8, 0xed, 0x7e, 0xc7, 0xa9, 0x1a, 0x11, 0x6e, 0x2d, 0xef, 0x0b, 0xd5, 0x3f, 0x98, 0xb0, 0xa3, 0x9d, 0x65, 0xf1, 0xcd, 0x53, 0x4a, 0x8a, 0x18, 0x70, 0x0a, 0x7f, 0x23},
+			subYX: fp.Elt{0xdd, 0xef, 0xbe, 0x3a, 0x31, 0xe0, 0xbc, 0xbe, 0x6d, 0x5d, 0x79, 0x87, 0xd6, 0xbe, 0x68, 0xe3, 0x59, 0x76, 0x8c, 0x86, 0x0e, 0x7a, 0x92, 0x13, 0x14, 0x8f, 0x67, 0xb3, 0xcb, 0x1a, 0x76, 0x76},
+			dt2:   fp.Elt{0x56, 0x7a, 0x1c, 0x9d, 0xca, 0x96, 0xf9, 0xf9, 0x03, 0x21, 0xd4, 0xe8, 0xb3, 0xd5, 0xe9, 0x52, 0xc8, 0x54, 0x1e, 0x1b, 0x13, 0xb6, 0xfd, 0x47, 0x7d, 0x02, 0x32, 0x33, 0x27, 0xe2, 0x1f, 0x19},
+		},
+	},
+}
+
+var tabVerif = [1 << (omegaFix - 2)]pointR3{
+	{ /* 1P */
+		addYX: fp.Elt{0x85, 0x3b, 0x8c, 0xf5, 0xc6, 0x93, 0xbc, 0x2f, 0x19, 0x0e, 0x8c, 0xfb, 0xc6, 0x2d, 0x93, 0xcf, 0xc2, 0x42, 0x3d, 0x64, 0x98, 0x48, 0x0b, 0x27, 0x65, 0xba, 0xd4, 0x33, 0x3a, 0x9d, 0xcf, 0x07},
+		subYX: fp.Elt{0x3e, 0x91, 0x40, 0xd7, 0x05, 0x39, 0x10, 0x9d, 0xb3, 0xbe, 0x40, 0xd1, 0x05, 0x9f, 0x39, 0xfd, 0x09, 0x8a, 0x8f, 0x68, 0x34, 0x84, 0xc1, 0xa5, 0x67, 0x12, 0xf8, 0x98, 0x92, 0x2f, 0xfd, 0x44},
+		dt2:   fp.Elt{0x68, 0xaa, 0x7a, 0x87, 0x05, 0x12, 0xc9, 0xab, 0x9e, 0xc4, 0xaa, 0xcc, 0x23, 0xe8, 0xd9, 0x26, 0x8c, 0x59, 0x43, 0xdd, 0xcb, 0x7d, 0x1b, 0x5a, 0xa8, 0x65, 0x0c, 0x9f, 0x68, 0x7b, 0x11, 0x6f},
+	},
+	{ /* 3P */
+		addYX: fp.Elt{0x30, 0x97, 0xee, 0x4c, 0xa8, 0xb0, 0x25, 0xaf, 0x8a, 0x4b, 0x86, 0xe8, 0x30, 0x84, 0x5a, 0x02, 0x32, 0x67, 0x01, 0x9f, 0x02, 0x50, 0x1b, 0xc1, 0xf4, 0xf8, 0x80, 0x9a, 0x1b, 0x4e, 0x16, 0x7a},
+		subYX: fp.Elt{0x65, 0xd2, 0xfc, 0xa4, 0xe8, 0x1f, 0x61, 0x56, 0x7d, 0xba, 0xc1, 0xe5, 0xfd, 0x53, 0xd3, 0x3b, 0xbd, 0xd6, 0x4b, 0x21, 0x1a, 0xf3, 0x31, 0x81, 0x62, 0xda, 0x5b, 0x55, 0x87, 0x15, 0xb9, 0x2a},
+		dt2:   fp.Elt{0x89, 0xd8, 0xd0, 0x0d, 0x3f, 0x93, 0xae, 0x14, 0x62, 0xda, 0x35, 0x1c, 0x22, 0x23, 0x94, 0x58, 0x4c, 0xdb, 0xf2, 0x8c, 0x45, 0xe5, 0x70, 0xd1, 0xc6, 0xb4, 0xb9, 0x12, 0xaf, 0x26, 0x28, 0x5a},
+	},
+	{ /* 5P */
+		addYX: fp.Elt{0x33, 0xbb, 0xa5, 0x08, 0x44, 0xbc, 0x12, 0xa2, 0x02, 0xed, 0x5e, 0xc7, 0xc3, 0x48, 0x50, 0x8d, 0x44, 0xec, 0xbf, 0x5a, 0x0c, 0xeb, 0x1b, 0xdd, 0xeb, 0x06, 0xe2, 0x46, 0xf1, 0xcc, 0x45, 0x29},
+		subYX: fp.Elt{0xba, 0xd6, 0x47, 0xa4, 0xc3, 0x82, 0x91, 0x7f, 0xb7, 0x29, 0x27, 0x4b, 0xd1, 0x14, 0x00, 0xd5, 0x87, 0xa0, 0x64, 0xb8, 0x1c, 0xf1, 0x3c, 0xe3, 0xf3, 0x55, 0x1b, 0xeb, 0x73, 0x7e, 0x4a, 0x15},
+		dt2:   fp.Elt{0x85, 0x82, 0x2a, 0x81, 0xf1, 0xdb, 0xbb, 0xbc, 0xfc, 0xd1, 0xbd, 0xd0, 0x07, 0x08, 0x0e, 0x27, 0x2d, 0xa7, 0xbd, 0x1b, 0x0b, 0x67, 0x1b, 0xb4, 0x9a, 0xb6, 0x3b, 0x6b, 0x69, 0xbe, 0xaa, 0x43},
+	},
+	{ /* 7P */
+		addYX: fp.Elt{0xbf, 0xa3, 0x4e, 0x94, 0xd0, 0x5c, 0x1a, 0x6b, 0xd2, 0xc0, 0x9d, 0xb3, 0x3a, 0x35, 0x70, 0x74, 0x49, 0x2e, 0x54, 0x28, 0x82, 0x52, 0xb2, 0x71, 0x7e, 0x92, 0x3c, 0x28, 0x69, 0xea, 0x1b, 0x46},
+		subYX: fp.Elt{0xb1, 0x21, 0x32, 0xaa, 0x9a, 0x2c, 0x6f, 0xba, 0xa7, 0x23, 0xba, 0x3b, 0x53, 0x21, 0xa0, 0x6c, 0x3a, 0x2c, 0x19, 0x92, 0x4f, 0x76, 0xea, 0x9d, 0xe0, 0x17, 0x53, 0x2e, 0x5d, 0xdd, 0x6e, 0x1d},
+		dt2:   fp.Elt{0xa2, 0xb3, 0xb8, 0x01, 0xc8, 0x6d, 0x83, 0xf1, 0x9a, 0xa4, 0x3e, 0x05, 0x47, 0x5f, 0x03, 0xb3, 0xf3, 0xad, 0x77, 0x58, 0xba, 0x41, 0x9c, 0x52, 0xa7, 0x90, 0x0f, 0x6a, 0x1c, 0xbb, 0x9f, 0x7a},
+	},
+	{ /* 9P */
+		addYX: fp.Elt{0x2f, 0x63, 0xa8, 0xa6, 0x8a, 0x67, 0x2e, 0x9b, 0xc5, 0x46, 0xbc, 0x51, 0x6f, 0x9e, 0x50, 0xa6, 0xb5, 0xf5, 0x86, 0xc6, 0xc9, 0x33, 0xb2, 0xce, 0x59, 0x7f, 0xdd, 0x8a, 0x33, 0xed, 0xb9, 0x34},
+		subYX: fp.Elt{0x64, 0x80, 0x9d, 0x03, 0x7e, 0x21, 0x6e, 0xf3, 0x9b, 0x41, 0x20, 0xf5, 0xb6, 0x81, 0xa0, 0x98, 0x44, 0xb0, 0x5e, 0xe7, 0x08, 0xc6, 0xcb, 0x96, 0x8f, 0x9c, 0xdc, 0xfa, 0x51, 0x5a, 0xc0, 0x49},
+		dt2:   fp.Elt{0x1b, 0xaf, 0x45, 0x90, 0xbf, 0xe8, 0xb4, 0x06, 0x2f, 0xd2, 0x19, 0xa7, 0xe8, 0x83, 0xff, 0xe2, 0x16, 0xcf, 0xd4, 0x93, 0x29, 0xfc, 0xf6, 0xaa, 0x06, 0x8b, 0x00, 0x1b, 0x02, 0x72, 0xc1, 0x73},
+	},
+	{ /* 11P */
+		addYX: fp.Elt{0xde, 0x2a, 0x80, 0x8a, 0x84, 0x00, 0xbf, 0x2f, 0x27, 0x2e, 0x30, 0x02, 0xcf, 0xfe, 0xd9, 0xe5, 0x06, 0x34, 0x70, 0x17, 0x71, 0x84, 0x3e, 0x11, 0xaf, 0x8f, 0x6d, 0x54, 0xe2, 0xaa, 0x75, 0x42},
+		subYX: fp.Elt{0x48, 0x43, 0x86, 0x49, 0x02, 0x5b, 0x5f, 0x31, 0x81, 0x83, 0x08, 0x77, 0x69, 0xb3, 0xd6, 0x3e, 0x95, 0xeb, 0x8d, 0x6a, 0x55, 0x75, 0xa0, 0xa3, 0x7f, 0xc7, 0xd5, 0x29, 0x80, 0x59, 0xab, 0x18},
+		dt2:   fp.Elt{0xe9, 0x89, 0x60, 0xfd, 0xc5, 0x2c, 0x2b, 0xd8, 0xa4, 0xe4, 0x82, 0x32, 0xa1, 0xb4, 0x1e, 0x03, 0x22, 0x86, 0x1a, 0xb5, 0x99, 0x11, 0x31, 0x44, 0x48, 0xf9, 0x3d, 0xb5, 0x22, 0x55, 0xc6, 0x3d},
+	},
+	{ /* 13P */
+		addYX: fp.Elt{0x6d, 0x7f, 0x00, 0xa2, 0x22, 0xc2, 0x70, 0xbf, 0xdb, 0xde, 0xbc, 0xb5, 0x9a, 0xb3, 0x84, 0xbf, 0x07, 0xba, 0x07, 0xfb, 0x12, 0x0e, 0x7a, 0x53, 0x41, 0xf2, 0x46, 0xc3, 0xee, 0xd7, 0x4f, 0x23},
+		subYX: fp.Elt{0x93, 0xbf, 0x7f, 0x32, 0x3b, 0x01, 0x6f, 0x50, 0x6b, 0x6f, 0x77, 0x9b, 0xc9, 0xeb, 0xfc, 0xae, 0x68, 0x59, 0xad, 0xaa, 0x32, 0xb2, 0x12, 0x9d, 0xa7, 0x24, 0x60, 0x17, 0x2d, 0x88, 0x67, 0x02},
+		dt2:   fp.Elt{0x78, 0xa3, 0x2e, 0x73, 0x19, 0xa1, 0x60, 0x53, 0x71, 0xd4, 0x8d, 0xdf, 0xb1, 0xe6, 0x37, 0x24, 0x33, 0xe5, 0xa7, 0x91, 0xf8, 0x37, 0xef, 0xa2, 0x63, 0x78, 0x09, 0xaa, 0xfd, 0xa6, 0x7b, 0x49},
+	},
+	{ /* 15P */
+		addYX: fp.Elt{0xa0, 0xea, 0xcf, 0x13, 0x03, 0xcc, 0xce, 0x24, 0x6d, 0x24, 0x9c, 0x18, 0x8d, 0xc2, 0x48, 0x86, 0xd0, 0xd4, 0xf2, 0xc1, 0xfa, 0xbd, 0xbd, 0x2d, 0x2b, 0xe7, 0x2d, 0xf1, 0x17, 0x29, 0xe2, 0x61},
+		subYX: fp.Elt{0x0b, 0xcf, 0x8c, 0x46, 0x86, 0xcd, 0x0b, 0x04, 0xd6, 0x10, 0x99, 0x2a, 0xa4, 0x9b, 0x82, 0xd3, 0x92, 0x51, 0xb2, 0x07, 0x08, 0x30, 0x08, 0x75, 0xbf, 0x5e, 0xd0, 0x18, 0x42, 0xcd, 0xb5, 0x43},
+		dt2:   fp.Elt{0x16, 0xb5, 0xd0, 0x9b, 0x2f, 0x76, 0x9a, 0x5d, 0xee, 0xde, 0x3f, 0x37, 0x4e, 0xaf, 0x38, 0xeb, 0x70, 0x42, 0xd6, 0x93, 0x7d, 0x5a, 0x2e, 0x03, 0x42, 0xd8, 0xe4, 0x0a, 0x21, 0x61, 0x1d, 0x51},
+	},
+	{ /* 17P */
+		addYX: fp.Elt{0x81, 0x9d, 0x0e, 0x95, 0xef, 0x76, 0xc6, 0x92, 0x4f, 0x04, 0xd7, 0xc0, 0xcd, 0x20, 0x46, 0xa5, 0x48, 0x12, 0x8f, 0x6f, 0x64, 0x36, 0x9b, 0xaa, 0xe3, 0x55, 0xb8, 0xdd, 0x24, 0x59, 0x32, 0x6d},
+		subYX: fp.Elt{0x87, 0xde, 0x20, 0x44, 0x48, 0x86, 0x13, 0x08, 0xb4, 0xed, 0x92, 0xb5, 0x16, 0xf0, 0x1c, 0x8a, 0x25, 0x2d, 0x94, 0x29, 0x27, 0x4e, 0xfa, 0x39, 0x10, 0x28, 0x48, 0xe2, 0x6f, 0xfe, 0xa7, 0x71},
+		dt2:   fp.Elt{0x54, 0xc8, 0xc8, 0xa5, 0xb8, 0x82, 0x71, 0x6c, 0x03, 0x2a, 0x5f, 0xfe, 0x79, 0x14, 0xfd, 0x33, 0x0c, 0x8d, 0x77, 0x83, 0x18, 0x59, 0xcf, 0x72, 0xa9, 0xea, 0x9e, 0x55, 0xb6, 0xc4, 0x46, 0x47},
+	},
+	{ /* 19P */
+		addYX: fp.Elt{0x2b, 0x9a, 0xc6, 0x6d, 0x3c, 0x7b, 0x77, 0xd3, 0x17, 0xf6, 0x89, 0x6f, 0x27, 0xb2, 0xfa, 0xde, 0xb5, 0x16, 0x3a, 0xb5, 0xf7, 0x1c, 0x65, 0x45, 0xb7, 0x9f, 0xfe, 0x34, 0xde, 0x51, 0x9a, 0x5c},
+		subYX: fp.Elt{0x47, 0x11, 0x74, 0x64, 0xc8, 0x46, 0x85, 0x34, 0x49, 0xc8, 0xfc, 0x0e, 0xdd, 0xae, 0x35, 0x7d, 0x32, 0xa3, 0x72, 0x06, 0x76, 0x9a, 0x93, 0xff, 0xd6, 0xe6, 0xb5, 0x7d, 0x49, 0x63, 0x96, 0x21},
+		dt2:   fp.Elt{0x67, 0x0e, 0xf1, 0x79, 0xcf, 0xf1, 0x10, 0xf5, 0x5b, 0x51, 0x58, 0xe6, 0xa1, 0xda, 0xdd, 0xff, 0x77, 0x22, 0x14, 0x10, 0x17, 0xa7, 0xc3, 0x09, 0xbb, 0x23, 0x82, 0x60, 0x3c, 0x50, 0x04, 0x48},
+	},
+	{ /* 21P */
+		addYX: fp.Elt{0xc7, 0x7f, 0xa3, 0x2c, 0xd0, 0x9e, 0x24, 0xc4, 0xab, 0xac, 0x15, 0xa6, 0xe3, 0xa0, 0x59, 0xa0, 0x23, 0x0e, 0x6e, 0xc9, 0xd7, 0x6e, 0xa9, 0x88, 0x6d, 0x69, 0x50, 0x16, 0xa5, 0x98, 0x33, 0x55},
+		subYX: fp.Elt{0x75, 0xd1, 0x36, 0x3a, 0xd2, 0x21, 0x68, 0x3b, 0x32, 0x9e, 0x9b, 0xe9, 0xa7, 0x0a, 0xb4, 0xbb, 0x47, 0x8a, 0x83, 0x20, 0xe4, 0x5c, 0x9e, 0x5d, 0x5e, 0x4c, 0xde, 0x58, 0x88, 0x09, 0x1e, 0x77},
+		dt2:   fp.Elt{0xdf, 0x1e, 0x45, 0x78, 0xd2, 0xf5, 0x12, 0x9a, 0xcb, 0x9c, 0x89, 0x85, 0x79, 0x5d, 0xda, 0x3a, 0x08, 0x95, 0xa5, 0x9f, 0x2d, 0x4a, 0x7f, 0x47, 0x11, 0xa6, 0xf5, 0x8f, 0xd6, 0xd1, 0x5e, 0x5a},
+	},
+	{ /* 23P */
+		addYX: fp.Elt{0x83, 0x0e, 0x15, 0xfe, 0x2a, 0x12, 0x95, 0x11, 0xd8, 0x35, 0x4b, 0x7e, 0x25, 0x9a, 0x20, 0xcf, 0x20, 0x1e, 0x71, 0x1e, 0x29, 0xf8, 0x87, 0x73, 0xf0, 0x92, 0xbf, 0xd8, 0x97, 0xb8, 0xac, 0x44},
+		subYX: fp.Elt{0x59, 0x73, 0x52, 0x58, 0xc5, 0xe0, 0xe5, 0xba, 0x7e, 0x9d, 0xdb, 0xca, 0x19, 0x5c, 0x2e, 0x39, 0xe9, 0xab, 0x1c, 0xda, 0x1e, 0x3c, 0x65, 0x28, 0x44, 0xdc, 0xef, 0x5f, 0x13, 0x60, 0x9b, 0x01},
+		dt2:   fp.Elt{0x83, 0x4b, 0x13, 0x5e, 0x14, 0x68, 0x60, 0x1e, 0x16, 0x4c, 0x30, 0x24, 0x4f, 0xe6, 0xf5, 0xc4, 0xd7, 0x3e, 0x1a, 0xfc, 0xa8, 0x88, 0x6e, 0x50, 0x92, 0x2f, 0xad, 0xe6, 0xfd, 0x49, 0x0c, 0x15},
+	},
+	{ /* 25P */
+		addYX: fp.Elt{0x38, 0x11, 0x47, 0x09, 0x95, 0xf2, 0x7b, 0x8e, 0x51, 0xa6, 0x75, 0x4f, 0x39, 0xef, 0x6f, 0x5d, 0xad, 0x08, 0xa7, 0x25, 0xc4, 0x79, 0xaf, 0x10, 0x22, 0x99, 0xb9, 0x5b, 0x07, 0x5a, 0x2b, 0x6b},
+		subYX: fp.Elt{0x68, 0xa8, 0xdc, 0x9c, 0x3c, 0x86, 0x49, 0xb8, 0xd0, 0x4a, 0x71, 0xb8, 0xdb, 0x44, 0x3f, 0xc8, 0x8d, 0x16, 0x36, 0x0c, 0x56, 0xe3, 0x3e, 0xfe, 0xc1, 0xfb, 0x05, 0x1e, 0x79, 0xd7, 0xa6, 0x78},
+		dt2:   fp.Elt{0x76, 0xb9, 0xa0, 0x47, 0x4b, 0x70, 0xbf, 0x58, 0xd5, 0x48, 0x17, 0x74, 0x55, 0xb3, 0x01, 0xa6, 0x90, 0xf5, 0x42, 0xd5, 0xb1, 0x1f, 0x2b, 0xaa, 0x00, 0x5d, 0xd5, 0x4a, 0xfc, 0x7f, 0x5c, 0x72},
+	},
+	{ /* 27P */
+		addYX: fp.Elt{0xb2, 0x99, 0xcf, 0xd1, 0x15, 0x67, 0x42, 0xe4, 0x34, 0x0d, 0xa2, 0x02, 0x11, 0xd5, 0x52, 0x73, 0x9f, 0x10, 0x12, 0x8b, 0x7b, 0x15, 0xd1, 0x23, 0xa3, 0xf3, 0xb1, 0x7c, 0x27, 0xc9, 0x4c, 0x79},
+		subYX: fp.Elt{0xc0, 0x98, 0xd0, 0x1c, 0xf7, 0x2b, 0x80, 0x91, 0x66, 0x63, 0x5e, 0xed, 0xa4, 0x6c, 0x41, 0xfe, 0x4c, 0x99, 0x02, 0x49, 0x71, 0x5d, 0x58, 0xdf, 0xe7, 0xfa, 0x55, 0xf8, 0x25, 0x46, 0xd5, 0x4c},
+		dt2:   fp.Elt{0x53, 0x50, 0xac, 0xc2, 0x26, 0xc4, 0xf6, 0x4a, 0x58, 0x72, 0xf6, 0x32, 0xad, 0xed, 0x9a, 0xbc, 0x21, 0x10, 0x31, 0x0a, 0xf1, 0x32, 0xd0, 0x2a, 0x85, 0x8e, 0xcc, 0x6f, 0x7b, 0x35, 0x08, 0x70},
+	},
+	{ /* 29P */
+		addYX: fp.Elt{0x01, 0x3f, 0x77, 0x38, 0x27, 0x67, 0x88, 0x0b, 0xfb, 0xcc, 0xfb, 0x95, 0xfa, 0xc8, 0xcc, 0xb8, 0xb6, 0x29, 0xad, 0xb9, 0xa3, 0xd5, 0x2d, 0x8d, 0x6a, 0x0f, 0xad, 0x51, 0x98, 0x7e, 0xef, 0x06},
+		subYX: fp.Elt{0x34, 0x4a, 0x58, 0x82, 0xbb, 0x9f, 0x1b, 0xd0, 0x2b, 0x79, 0xb4, 0xd2, 0x63, 0x64, 0xab, 0x47, 0x02, 0x62, 0x53, 0x48, 0x9c, 0x63, 0x31, 0xb6, 0x28, 0xd4, 0xd6, 0x69, 0x36, 0x2a, 0xa9, 0x13},
+		dt2:   fp.Elt{0xe5, 0x7d, 0x57, 0xc0, 0x1c, 0x77, 0x93, 0xca, 0x5c, 0xdc, 0x35, 0x50, 0x1e, 0xe4, 0x40, 0x75, 0x71, 0xe0, 0x02, 0xd8, 0x01, 0x0f, 0x68, 0x24, 0x6a, 0xf8, 0x2a, 0x8a, 0xdf, 0x6d, 0x29, 0x3c},
+	},
+	{ /* 31P */
+		addYX: fp.Elt{0x13, 0xa7, 0x14, 0xd9, 0xf9, 0x15, 0xad, 0xae, 0x12, 0xf9, 0x8f, 0x8c, 0xf9, 0x7b, 0x2f, 0xa9, 0x30, 0xd7, 0x53, 0x9f, 0x17, 0x23, 0xf8, 0xaf, 0xba, 0x77, 0x0c, 0x49, 0x93, 0xd3, 0x99, 0x7a},
+		subYX: fp.Elt{0x41, 0x25, 0x1f, 0xbb, 0x2e, 0x4d, 0xeb, 0xfc, 0x1f, 0xb9, 0xad, 0x40, 0xc7, 0x10, 0x95, 0xb8, 0x05, 0xad, 0xa1, 0xd0, 0x7d, 0xa3, 0x71, 0xfc, 0x7b, 0x71, 0x47, 0x07, 0x70, 0x2c, 0x89, 0x0a},
+		dt2:   fp.Elt{0xe8, 0xa3, 0xbd, 0x36, 0x24, 0xed, 0x52, 0x8f, 0x94, 0x07, 0xe8, 0x57, 0x41, 0xc8, 0xa8, 0x77, 0xe0, 0x9c, 0x2f, 0x26, 0x63, 0x65, 0xa9, 0xa5, 0xd2, 0xf7, 0x02, 0x83, 0xd2, 0x62, 0x67, 0x28},
+	},
+	{ /* 33P */
+		addYX: fp.Elt{0x25, 0x5b, 0xe3, 0x3c, 0x09, 0x36, 0x78, 0x4e, 0x97, 0xaa, 0x6b, 0xb2, 0x1d, 0x18, 0xe1, 0x82, 0x3f, 0xb8, 0xc7, 0xcb, 0xd3, 0x92, 0xc1, 0x0c, 0x3a, 0x9d, 0x9d, 0x6a, 0x04, 0xda, 0xf1, 0x32},
+		subYX: fp.Elt{0xbd, 0xf5, 0x2e, 0xce, 0x2b, 0x8e, 0x55, 0x7c, 0x63, 0xbc, 0x47, 0x67, 0xb4, 0x6c, 0x98, 0xe4, 0xb8, 0x89, 0xbb, 0x3b, 0x9f, 0x17, 0x4a, 0x15, 0x7a, 0x76, 0xf1, 0xd6, 0xa3, 0xf2, 0x86, 0x76},
+		dt2:   fp.Elt{0x6a, 0x7c, 0x59, 0x6d, 0xa6, 0x12, 0x8d, 0xaa, 0x2b, 0x85, 0xd3, 0x04, 0x03, 0x93, 0x11, 0x8f, 0x22, 0xb0, 0x09, 0xc2, 0x73, 0xdc, 0x91, 0x3f, 0xa6, 0x28, 0xad, 0xa9, 0xf8, 0x05, 0x13, 0x56},
+	},
+	{ /* 35P */
+		addYX: fp.Elt{0xd1, 0xae, 0x92, 0xec, 0x8d, 0x97, 0x0c, 0x10, 0xe5, 0x73, 0x6d, 0x4d, 0x43, 0xd5, 0x43, 0xca, 0x48, 0xba, 0x47, 0xd8, 0x22, 0x1b, 0x13, 0x83, 0x2c, 0x4d, 0x5d, 0xe3, 0x53, 0xec, 0xaa},
+		subYX: fp.Elt{0xd5, 0xc0, 0xb0, 0xe7, 0x28, 0xcc, 0x22, 0x67, 0x53, 0x5c, 0x07, 0xdb, 0xbb, 0xe9, 0x9d, 0x70, 0x61, 0x0a, 0x01, 0xd7, 0xa7, 0x8d, 0xf6, 0xca, 0x6c, 0xcc, 0x57, 0x2c, 0xef, 0x1a, 0x0a, 0x03},
+		dt2:   fp.Elt{0xaa, 0xd2, 0x3a, 0x00, 0x73, 0xf7, 0xb1, 0x7b, 0x08, 0x66, 0x21, 0x2b, 0x80, 0x29, 0x3f, 0x0b, 0x3e, 0xd2, 0x0e, 0x52, 0x86, 0xdc, 0x21, 0x78, 0x80, 0x54, 0x06, 0x24, 0x1c, 0x9c, 0xbe, 0x20},
+	},
+	{ /* 37P */
+		addYX: fp.Elt{0xa6, 0x73, 0x96, 0x24, 0xd8, 0x87, 0x53, 0xe1, 0x93, 0xe4, 0x46, 0xf5, 0x2d, 0xbc, 0x43, 0x59, 0xb5, 0x63, 0x6f, 0xc3, 0x81, 0x9a, 0x7f, 0x1c, 0xde, 0xc1, 0x0a, 0x1f, 0x36, 0xb3, 0x0a, 0x75},
+		subYX: fp.Elt{0x60, 0x5e, 0x02, 0xe2, 0x4a, 0xe4, 0xe0, 0x20, 0x38, 0xb9, 0xdc, 0xcb, 0x2f, 0x3b, 0x3b, 0xb0, 0x1c, 0x0d, 0x5a, 0xf9, 0x9c, 0x63, 0x5d, 0x10, 0x11, 0xe3, 0x67, 0x50, 0x54, 0x4c, 0x76, 0x69},
+		dt2:   fp.Elt{0x37, 0x10, 0xf8, 0xa2, 0x83, 0x32, 0x8a, 0x1e, 0xf1, 0xcb, 0x7f, 0xbd, 0x23, 0xda, 0x2e, 0x6f, 0x63, 0x25, 0x2e, 0xac, 0x5b, 0xd1, 0x2f, 0xb7, 0x40, 0x50, 0x07, 0xb7, 0x3f, 0x6b, 0xf9, 0x54},
+	},
+	{ /* 39P */
+		addYX: fp.Elt{0x79, 0x92, 0x66, 0x29, 0x04, 0xf2, 0xad, 0x0f, 0x4a, 0x72, 0x7d, 0x7d, 0x04, 0xa2, 0xdd, 0x3a, 0xf1, 0x60, 0x57, 0x8c, 0x82, 0x94, 0x3d, 0x6f, 0x9e, 0x53, 0xb7, 0x2b, 0xc5, 0xe9, 0x7f, 0x3d},
+		subYX: fp.Elt{0xcd, 0x1e, 0xb1, 0x16, 0xc6, 0xaf, 0x7d, 0x17, 0x79, 0x64, 0x57, 0xfa, 0x9c, 0x4b, 0x76, 0x89, 0x85, 0xe7, 0xec, 0xe6, 0x10, 0xa1, 0xa8, 0xb7, 0xf0, 0xdb, 0x85, 0xbe, 0x9f, 0x83, 0xe6, 0x78},
+		dt2:   fp.Elt{0x6b, 0x85, 0xb8, 0x37, 0xf7, 0x2d, 0x33, 0x70, 0x8a, 0x17, 0x1a, 0x04, 0x43, 0x5d, 0xd0, 0x75, 0x22, 0x9e, 0xe5, 0xa0, 0x4a, 0xf7, 0x0f, 0x32, 0x42, 0x82, 0x08, 0x50, 0xf3, 0x68, 0xf2, 0x70},
+	},
+	{ /* 41P */
+		addYX: fp.Elt{0x47, 0x5f, 0x80, 0xb1, 0x83, 0x45, 0x86, 0x66, 0x19, 0x7c, 0xdd, 0x60, 0xd1, 0xc5, 0x35, 0xf5, 0x06, 0xb0, 0x4c, 0x1e, 0xb7, 0x4e, 0x87, 0xe9, 0xd9, 0x89, 0xd8, 0xfa, 0x5c, 0x34, 0x0d, 0x7c},
+		subYX: fp.Elt{0x55, 0xf3, 0xdc, 0x70, 0x20, 0x11, 0x24, 0x23, 0x17, 0xe1, 0xfc, 0xe7, 0x7e, 0xc9, 0x0c, 0x38, 0x98, 0xb6, 0x52, 0x35, 0xed, 0xde, 0x1d, 0xb3, 0xb9, 0xc4, 0xb8, 0x39, 0xc0, 0x56, 0x4e, 0x40},
+		dt2:   fp.Elt{0x8a, 0x33, 0x78, 0x8c, 0x4b, 0x1f, 0x1f, 0x59, 0xe1, 0xb5, 0xe0, 0x67, 0xb1, 0x6a, 0x36, 0xa0, 0x44, 0x3d, 0x5f, 0xb4, 0x52, 0x41, 0xbc, 0x5c, 0x77, 0xc7, 0xae, 0x2a, 0x76, 0x54, 0xd7, 0x20},
+	},
+	{ /* 43P */
+		addYX: fp.Elt{0x58, 0xb7, 0x3b, 0xc7, 0x6f, 0xc3, 0x8f, 0x5e, 0x9a, 0xbb, 0x3c, 0x36, 0xa5, 0x43, 0xe5, 0xac, 0x22, 0xc9, 0x3b, 0x90, 0x7d, 0x4a, 0x93, 0xa9, 0x62, 0xec, 0xce, 0xf3, 0x46, 0x1e, 0x8f, 0x2b},
+		subYX: fp.Elt{0x43, 0xf5, 0xb9, 0x35, 0xb1, 0xfe, 0x74, 0x9d, 0x6c, 0x95, 0x8c, 0xde, 0xf1, 0x7d, 0xb3, 0x84, 0xa9, 0x8b, 0x13, 0x57, 0x07, 0x2b, 0x32, 0xe9, 0xe1, 0x4c, 0x0b, 0x79, 0xa8, 0xad, 0xb8, 0x38},
+		dt2:   fp.Elt{0x5d, 0xf9, 0x51, 0xdf, 0x9c, 0x4a, 0xc0, 0xb5, 0xac, 0xde, 0x1f, 0xcb, 0xae, 0x52, 0x39, 0x2b, 0xda, 0x66, 0x8b, 0x32, 0x8b, 0x6d, 0x10, 0x1d, 0x53, 0x19, 0xba, 0xce, 0x32, 0xeb, 0x9a, 0x04},
+	},
+	{ /* 45P */
+		addYX: fp.Elt{0x31, 0x79, 0xfc, 0x75, 0x0b, 0x7d, 0x50, 0xaa, 0xd3, 0x25, 0x67, 0x7a, 0x4b, 0x92, 0xef, 0x0f, 0x30, 0x39, 0x6b, 0x39, 0x2b, 0x54, 0x82, 0x1d, 0xfc, 0x74, 0xf6, 0x30, 0x75, 0xe1, 0x5e, 0x79},
+		subYX: fp.Elt{0x7e, 0xfe, 0xdc, 0x63, 0x3c, 0x7d, 0x76, 0xd7, 0x40, 0x6e, 0x85, 0x97, 0x48, 0x59, 0x9c, 0x20, 0x13, 0x7c, 0x4f, 0xe1, 0x61, 0x68, 0x67, 0xb6, 0xfc, 0x25, 0xd6, 0xc8, 0xe0, 0x65, 0xc6, 0x51},
+		dt2:   fp.Elt{0x81, 0xbd, 0xec, 0x52, 0x0a, 0x5b, 0x4a, 0x25, 0xe7, 0xaf, 0x34, 0xe0, 0x6e, 0x1f, 0x41, 0x5d, 0x31, 0x4a, 0xee, 0xca, 0x0d, 0x4d, 0xa2, 0xe6, 0x77, 0x44, 0xc5, 0x9d, 0xf4, 0x9b, 0xd1, 0x6c},
+	},
+	{ /* 47P */
+		addYX: fp.Elt{0x86, 0xc3, 0xaf, 0x65, 0x21, 0x61, 0xfe, 0x1f, 0x10, 0x1b, 0xd5, 0xb8, 0x88, 0x2a, 0x2a, 0x08, 0xaa, 0x0b, 0x99, 0x20, 0x7e, 0x62, 0xf6, 0x76, 0xe7, 0x43, 0x9e, 0x42, 0xa7, 0xb3, 0x01, 0x5e},
+		subYX: fp.Elt{0xa3, 0x9c, 0x17, 0x52, 0x90, 0x61, 0x87, 0x7e, 0x85, 0x9f, 0x2c, 0x0b, 0x06, 0x0a, 0x1d, 0x57, 0x1e, 0x71, 0x99, 0x84, 0xa8, 0xba, 0xa2, 0x80, 0x38, 0xe6, 0xb2, 0x40, 0xdb, 0xf3, 0x20, 0x75},
+		dt2:   fp.Elt{0xa1, 0x57, 0x93, 0xd3, 0xe3, 0x0b, 0xb5, 0x3d, 0xa5, 0x94, 0x9e, 0x59, 0xdd, 0x6c, 0x7b, 0x96, 0x6e, 0x1e, 0x31, 0xdf, 0x64, 0x9a, 0x30, 0x1a, 0x86, 0xc9, 0xf3, 0xce, 0x9c, 0x2c, 0x09, 0x71},
+	},
+	{ /* 49P */
+		addYX: fp.Elt{0xcf, 0x1d, 0x05, 0x74, 0xac, 0xd8, 0x6b, 0x85, 0x1e, 0xaa, 0xb7, 0x55, 0x08, 0xa4, 0xf6, 0x03, 0xeb, 0x3c, 0x74, 0xc9, 0xcb, 0xe7, 0x4a, 0x3a, 0xde, 0xab, 0x37, 0x71, 0xbb, 0xa5, 0x73, 0x41},
+		subYX: fp.Elt{0x8c, 0x91, 0x64, 0x03, 0x3f, 0x52, 0xd8, 0x53, 0x1c, 0x6b, 0xab, 0x3f, 0xf4, 0x04, 0xb4, 0xa2, 0xa4, 0xe5, 0x81, 0x66, 0x9e, 0x4a, 0x0b, 0x08, 0xa7, 0x7b, 0x25, 0xd0, 0x03, 0x5b, 0xa1, 0x0e},
+		dt2:   fp.Elt{0x8a, 0x21, 0xf9, 0xf0, 0x31, 0x6e, 0xc5, 0x17, 0x08, 0x47, 0xfc, 0x1a, 0x2b, 0x6e, 0x69, 0x5a, 0x76, 0xf1, 0xb2, 0xf4, 0x68, 0x16, 0x93, 0xf7, 0x67, 0x3a, 0x4e, 0x4a, 0x61, 0x65, 0xc5, 0x5f},
+	},
+	{ /* 51P */
+		addYX: fp.Elt{0x8e, 0x98, 0x90, 0x77, 0xe6, 0xe1, 0x92, 0x48, 0x22, 0xd7, 0x5c, 0x1c, 0x0f, 0x95, 0xd5, 0x01, 0xed, 0x3e, 0x92, 0xe5, 0x9a, 0x81, 0xb0, 0xe3, 0x1b, 0x65, 0x46, 0x9d, 0x40, 0xc7, 0x14, 0x32},
+		subYX: fp.Elt{0xe5, 0x7a, 0x6d, 0xc4, 0x0d, 0x57, 0x6e, 0x13, 0x8f, 0xdc, 0xf8, 0x54, 0xcc, 0xaa, 0xd0, 0x0f, 0x86, 0xad, 0x0d, 0x31, 0x03, 0x9f, 0x54, 0x59, 0xa1, 0x4a, 0x45, 0x4c, 0x41, 0x1c, 0x71, 0x62},
+		dt2:   fp.Elt{0x70, 0x17, 0x65, 0x06, 0x74, 0x82, 0x29, 0x13, 0x36, 0x94, 0x27, 0x8a, 0x66, 0xa0, 0xa4, 0x3b, 0x3c, 0x22, 0x5d, 0x18, 0xec, 0xb8, 0xb6, 0xd9, 0x3c, 0x83, 0xcb, 0x3e, 0x07, 0x94, 0xea, 0x5b},
+	},
+	{ /* 53P */
+		addYX: fp.Elt{0xf8, 0xd2, 0x43, 0xf3, 0x63, 0xce, 0x70, 0xb4, 0xf1, 0xe8, 0x43, 0x05, 0x8f, 0xba, 0x67, 0x00, 0x6f, 0x7b, 0x11, 0xa2, 0xa1, 0x51, 0xda, 0x35, 0x2f, 0xbd, 0xf1, 0x44, 0x59, 0x78, 0xd0, 0x4a},
+		subYX: fp.Elt{0xe4, 0x9b, 0xc8, 0x12, 0x09, 0xbf, 0x1d, 0x64, 0x9c, 0x57, 0x6e, 0x7d, 0x31, 0x8b, 0xf3, 0xac, 0x65, 0xb0, 0x97, 0xf6, 0x02, 0x9e, 0xfe, 0xab, 0xec, 0x1e, 0xf6, 0x48, 0xc1, 0xd5, 0xac, 0x3a},
+		dt2:   fp.Elt{0x01, 0x83, 0x31, 0xc3, 0x34, 0x3b, 0x8e, 0x85, 0x26, 0x68, 0x31, 0x07, 0x47, 0xc0, 0x99, 0xdc, 0x8c, 0xa8, 0x9d, 0xd3, 0x2e, 0x5b, 0x08, 0x34, 0x3d, 0x85, 0x02, 0xd9, 0xb1, 0x0c, 0xff, 0x3a},
+	},
+	{ /* 55P */
+		addYX: fp.Elt{0x05, 0x35, 0xc5, 0xf4, 0x0b, 0x43, 0x26, 0x92, 0x83, 0x22, 0x1f, 0x26, 0x13, 0x9c, 0xe4, 0x68, 0xc6, 0x27, 0xd3, 0x8f, 0x78, 0x33, 0xef, 0x09, 0x7f, 0x9e, 0xd9, 0x2b, 0x73, 0x9f, 0xcf, 0x2c},
+		subYX: fp.Elt{0x5e, 0x40, 0x20, 0x3a, 0xeb, 0xc7, 0xc5, 0x87, 0xc9, 0x56, 0xad, 0xed, 0xef, 0x11, 0xe3, 0x8e, 0xf9, 0xd5, 0x29, 0xad, 0x48, 0x2e, 0x25, 0x29, 0x1d, 0x25, 0xcd, 0xf4, 0x86, 0x7e, 0x0e, 0x11},
+		dt2:   fp.Elt{0xe4, 0xf5, 0x03, 0xd6, 0x9e, 0xd8, 0xc0, 0x57, 0x0c, 0x20, 0xb0, 0xf0, 0x28, 0x86, 0x88, 0x12, 0xb7, 0x3b, 0x2e, 0xa0, 0x09, 0x27, 0x17, 0x53, 0x37, 0x3a, 0x69, 0xb9, 0xe0, 0x57, 0xc5, 0x05},
+	},
+	{ /* 57P */
+		addYX: fp.Elt{0xb0, 0x0e, 0xc2, 0x89, 0xb0, 0xbb, 0x76, 0xf7, 0x5c, 0xd8, 0x0f, 0xfa, 0xf6, 0x5b, 0xf8, 0x61, 0xfb, 0x21, 0x44, 0x63, 0x4e, 0x3f, 0xb9, 0xb6, 0x05, 0x12, 0x86, 0x41, 0x08, 0xef, 0x9f, 0x28},
+		subYX: fp.Elt{0x6f, 0x7e, 0xc9, 0x1f, 0x31, 0xce, 0xf9, 0xd8, 0xae, 0xfd, 0xf9, 0x11, 0x30, 0x26, 0x3f, 0x7a, 0xdd, 0x25, 0xed, 0x8b, 0xa0, 0x7e, 0x5b, 0xe1, 0x5a, 0x87, 0xe9, 0x8f, 0x17, 0x4c, 0x15, 0x6e},
+		dt2:   fp.Elt{0xbf, 0x9a, 0xd6, 0xfe, 0x36, 0x63, 0x61, 0xcf, 0x4f, 0xc9, 0x35, 0x83, 0xe7, 0xe4, 0x16, 0x9b, 0xe7, 0x7f, 0x3a, 0x75, 0x65, 0x97, 0x78, 0x13, 0x19, 0xa3, 0x5c, 0xa9, 0x42, 0xf6, 0xfb, 0x6a},
+	},
+	{ /* 59P */
+		addYX: fp.Elt{0xcc, 0xa8, 0x13, 0xf9, 0x70, 0x50, 0xe5, 0x5d, 0x61, 0xf5, 0x0c, 0x2b, 0x7b, 0x16, 0x1d, 0x7d, 0x89, 0xd4, 0xea, 0x90, 0xb6, 0x56, 0x29, 0xda, 0xd9, 0x1e, 0x80, 0xdb, 0xce, 0x93, 0xc0, 0x12},
+		subYX: fp.Elt{0xc1, 0xd2, 0xf5, 0x62, 0x0c, 0xde, 0xa8, 0x7d, 0x9a, 0x7b, 0x0e, 0xb0, 0xa4, 0x3d, 0xfc, 0x98, 0xe0, 0x70, 0xad, 0x0d, 0xda, 0x6a, 0xeb, 0x7d, 0xc4, 0x38, 0x50, 0xb9, 0x51, 0xb8, 0xb4, 0x0d},
+		dt2:   fp.Elt{0x0f, 0x19, 0xb8, 0x08, 0x93, 0x7f, 0x14, 0xfc, 0x10, 0xe3, 0x1a, 0xa1, 0xa0, 0x9d, 0x96, 0x06, 0xfd, 0xd7, 0xc7, 0xda, 0x72, 0x55, 0xe7, 0xce, 0xe6, 0x5c, 0x63, 0xc6, 0x99, 0x87, 0xaa, 0x33},
+	},
+	{ /* 61P */
+		addYX: fp.Elt{0xb1, 0x6c, 0x15, 0xfc, 0x88, 0xf5, 0x48, 0x83, 0x27, 0x6d, 0x0a, 0x1a, 0x9b, 0xba, 0xa2, 0x6d, 0xb6, 0x5a, 0xca, 0x87, 0x5c, 0x2d, 0x26, 0xe2, 0xa6, 0x89, 0xd5, 0xc8, 0xc1, 0xd0, 0x2c, 0x21},
+		subYX: fp.Elt{0xf2, 0x5c, 0x08, 0xbd, 0x1e, 0xf5, 0x0f, 0xaf, 0x1f, 0x3f, 0xd3, 0x67, 0x89, 0x1a, 0xf5, 0x78, 0x3c, 0x03, 0x60, 0x50, 0xe1, 0xbf, 0xc2, 0x6e, 0x86, 0x1a, 0xe2, 0xe8, 0x29, 0x6f, 0x3c, 0x23},
+		dt2:   fp.Elt{0x81, 0xc7, 0x18, 0x7f, 0x10, 0xd5, 0xf4, 0xd2, 0x28, 0x9d, 0x7e, 0x52, 0xf2, 0xcd, 0x2e, 0x12, 0x41, 0x33, 0x3d, 0x3d, 0x2a, 0x86, 0x0a, 0xa7, 0xe3, 0x4c, 0x91, 0x11, 0x89, 0x77, 0xb7, 0x1d},
+	},
+	{ /* 63P */
+		addYX: fp.Elt{0xb6, 0x1a, 0x70, 0xdd, 0x69, 0x47, 0x39, 0xb3, 0xa5, 0x8d, 0xcf, 0x19, 0xd4, 0xde, 0xb8, 0xe2, 0x52, 0xc8, 0x2a, 0xfd, 0x61, 0x41, 0xdf, 0x15, 0xbe, 0x24, 0x7d, 0x01, 0x8a, 0xca, 0xe2, 0x7a},
+		subYX: fp.Elt{0x6f, 0xc2, 0x6b, 0x7c, 0x39, 0x52, 0xf3, 0xdd, 0x13, 0x01, 0xd5, 0x53, 0xcc, 0xe2, 0x97, 0x7a, 0x30, 0xa3, 0x79, 0xbf, 0x3a, 0xf4, 0x74, 0x7c, 0xfc, 0xad, 0xe2, 0x26, 0xad, 0x97, 0xad, 0x31},
+		dt2:   fp.Elt{0x62, 0xb9, 0x20, 0x09, 0xed, 0x17, 0xe8, 0xb7, 0x9d, 0xda, 0x19, 0x3f, 0xcc, 0x18, 0x85, 0x1e, 0x64, 0x0a, 0x56, 0x25, 0x4f, 0xc1, 0x91, 0xe4, 0x83, 0x2c, 0x62, 0xa6, 0x53, 0xfc, 0xd1, 0x1e},
+	},
+}
diff --git a/.ci/providerlint/vendor/github.com/cloudflare/circl/sign/ed448/ed448.go b/.ci/providerlint/vendor/github.com/cloudflare/circl/sign/ed448/ed448.go
new file mode 100644
index 00000000000..324bd8f3346
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/cloudflare/circl/sign/ed448/ed448.go
@@ -0,0 +1,411 @@
+// Package ed448 implements Ed448 signature scheme as described in RFC-8032.
+//
+// This package implements two signature variants.
+//
+//	| Scheme Name | Sign Function     | Verification  | Context           |
+//	|-------------|-------------------|---------------|-------------------|
+//	| Ed448       | Sign              | Verify        | Yes, can be empty |
+//	| Ed448Ph     | SignPh            | VerifyPh      | Yes, can be empty |
+//	| All above   | (PrivateKey).Sign | VerifyAny     | As above          |
+//
+// Specific functions for sign and verify are defined. A generic signing
+// function for all schemes is available through the crypto.Signer interface,
+// which is implemented by the PrivateKey type. A correspond all-in-one
+// verification method is provided by the VerifyAny function.
+//
+// Both schemes require a context string for domain separation. This parameter
+// is passed using a SignerOptions struct defined in this package.
+//
+// References:
+//
+//   - RFC8032: https://rfc-editor.org/rfc/rfc8032.txt
+//   - EdDSA for more curves: https://eprint.iacr.org/2015/677
+//   - High-speed high-security signatures: https://doi.org/10.1007/s13389-012-0027-1
+package ed448
+
+import (
+	"bytes"
+	"crypto"
+	cryptoRand "crypto/rand"
+	"crypto/subtle"
+	"errors"
+	"fmt"
+	"io"
+	"strconv"
+
+	"github.com/cloudflare/circl/ecc/goldilocks"
+	"github.com/cloudflare/circl/internal/sha3"
+	"github.com/cloudflare/circl/sign"
+)
+
+const (
+	// ContextMaxSize is the maximum length (in bytes) allowed for context.
+	ContextMaxSize = 255
+	// PublicKeySize is the length in bytes of Ed448 public keys.
+	PublicKeySize = 57
+	// PrivateKeySize is the length in bytes of Ed448 private keys.
+	PrivateKeySize = 114
+	// SignatureSize is the length in bytes of signatures.
+	SignatureSize = 114
+	// SeedSize is the size, in bytes, of private key seeds. These are the private key representations used by RFC 8032.
+	SeedSize = 57
+)
+
+const (
+	paramB   = 456 / 8    // Size of keys in bytes.
+	hashSize = 2 * paramB // Size of the hash function's output.
+)
+
+// SignerOptions implements crypto.SignerOpts and augments with parameters
+// that are specific to the Ed448 signature schemes.
+type SignerOptions struct {
+	// Hash must be crypto.Hash(0) for both Ed448 and Ed448Ph.
+	crypto.Hash
+
+	// Context is an optional domain separation string for signing.
+	// Its length must be less or equal than 255 bytes.
+	Context string
+
+	// Scheme is an identifier for choosing a signature scheme.
+	Scheme SchemeID
+}
+
+// SchemeID is an identifier for each signature scheme.
+type SchemeID uint
+
+const (
+	ED448 SchemeID = iota
+	ED448Ph
+)
+
+// PublicKey is the type of Ed448 public keys.
+type PublicKey []byte
+
+// Equal reports whether pub and x have the same value.
+func (pub PublicKey) Equal(x crypto.PublicKey) bool {
+	xx, ok := x.(PublicKey)
+	return ok && bytes.Equal(pub, xx)
+}
+
+// PrivateKey is the type of Ed448 private keys. It implements crypto.Signer.
+type PrivateKey []byte
+
+// Equal reports whether priv and x have the same value.
+func (priv PrivateKey) Equal(x crypto.PrivateKey) bool {
+	xx, ok := x.(PrivateKey)
+	return ok && subtle.ConstantTimeCompare(priv, xx) == 1
+}
+
+// Public returns the PublicKey corresponding to priv.
+func (priv PrivateKey) Public() crypto.PublicKey {
+	publicKey := make([]byte, PublicKeySize)
+	copy(publicKey, priv[SeedSize:])
+	return PublicKey(publicKey)
+}
+
+// Seed returns the private key seed corresponding to priv. It is provided for
+// interoperability with RFC 8032. RFC 8032's private keys correspond to seeds
+// in this package.
+func (priv PrivateKey) Seed() []byte {
+	seed := make([]byte, SeedSize)
+	copy(seed, priv[:SeedSize])
+	return seed
+}
+
+func (priv PrivateKey) Scheme() sign.Scheme { return sch }
+
+func (pub PublicKey) Scheme() sign.Scheme { return sch }
+
+func (priv PrivateKey) MarshalBinary() (data []byte, err error) {
+	privateKey := make(PrivateKey, PrivateKeySize)
+	copy(privateKey, priv)
+	return privateKey, nil
+}
+
+func (pub PublicKey) MarshalBinary() (data []byte, err error) {
+	publicKey := make(PublicKey, PublicKeySize)
+	copy(publicKey, pub)
+	return publicKey, nil
+}
+
+// Sign creates a signature of a message given a key pair.
+// This function supports all the two signature variants defined in RFC-8032,
+// namely Ed448 (or pure EdDSA) and Ed448Ph.
+// The opts.HashFunc() must return zero to the specify Ed448 variant. This can
+// be achieved by passing crypto.Hash(0) as the value for opts.
+// Use an Options struct to pass a bool indicating that the ed448Ph variant
+// should be used.
+// The struct can also be optionally used to pass a context string for signing.
+func (priv PrivateKey) Sign(
+	rand io.Reader,
+	message []byte,
+	opts crypto.SignerOpts,
+) (signature []byte, err error) {
+	var ctx string
+	var scheme SchemeID
+
+	if o, ok := opts.(SignerOptions); ok {
+		ctx = o.Context
+		scheme = o.Scheme
+	}
+
+	switch true {
+	case scheme == ED448 && opts.HashFunc() == crypto.Hash(0):
+		return Sign(priv, message, ctx), nil
+	case scheme == ED448Ph && opts.HashFunc() == crypto.Hash(0):
+		return SignPh(priv, message, ctx), nil
+	default:
+		return nil, errors.New("ed448: bad hash algorithm")
+	}
+}
+
+// GenerateKey generates a public/private key pair using entropy from rand.
+// If rand is nil, crypto/rand.Reader will be used.
+func GenerateKey(rand io.Reader) (PublicKey, PrivateKey, error) {
+	if rand == nil {
+		rand = cryptoRand.Reader
+	}
+
+	seed := make(PrivateKey, SeedSize)
+	if _, err := io.ReadFull(rand, seed); err != nil {
+		return nil, nil, err
+	}
+
+	privateKey := NewKeyFromSeed(seed)
+	publicKey := make([]byte, PublicKeySize)
+	copy(publicKey, privateKey[SeedSize:])
+
+	return publicKey, privateKey, nil
+}
+
+// NewKeyFromSeed calculates a private key from a seed. It will panic if
+// len(seed) is not SeedSize. This function is provided for interoperability
+// with RFC 8032. RFC 8032's private keys correspond to seeds in this
+// package.
+func NewKeyFromSeed(seed []byte) PrivateKey {
+	privateKey := make([]byte, PrivateKeySize)
+	newKeyFromSeed(privateKey, seed)
+	return privateKey
+}
+
+func newKeyFromSeed(privateKey, seed []byte) {
+	if l := len(seed); l != SeedSize {
+		panic("ed448: bad seed length: " + strconv.Itoa(l))
+	}
+
+	var h [hashSize]byte
+	H := sha3.NewShake256()
+	_, _ = H.Write(seed)
+	_, _ = H.Read(h[:])
+	s := &goldilocks.Scalar{}
+	deriveSecretScalar(s, h[:paramB])
+
+	copy(privateKey[:SeedSize], seed)
+	_ = goldilocks.Curve{}.ScalarBaseMult(s).ToBytes(privateKey[SeedSize:])
+}
+
+func signAll(signature []byte, privateKey PrivateKey, message, ctx []byte, preHash bool) {
+	if len(ctx) > ContextMaxSize {
+		panic(fmt.Errorf("ed448: bad context length: " + strconv.Itoa(len(ctx))))
+	}
+
+	H := sha3.NewShake256()
+	var PHM []byte
+
+	if preHash {
+		var h [64]byte
+		_, _ = H.Write(message)
+		_, _ = H.Read(h[:])
+		PHM = h[:]
+		H.Reset()
+	} else {
+		PHM = message
+	}
+
+	// 1.  Hash the 57-byte private key using SHAKE256(x, 114).
+	var h [hashSize]byte
+	_, _ = H.Write(privateKey[:SeedSize])
+	_, _ = H.Read(h[:])
+	s := &goldilocks.Scalar{}
+	deriveSecretScalar(s, h[:paramB])
+	prefix := h[paramB:]
+
+	// 2.  Compute SHAKE256(dom4(F, C) || prefix || PH(M), 114).
+	var rPM [hashSize]byte
+	H.Reset()
+
+	writeDom(&H, ctx, preHash)
+
+	_, _ = H.Write(prefix)
+	_, _ = H.Write(PHM)
+	_, _ = H.Read(rPM[:])
+
+	// 3.  Compute the point [r]B.
+	r := &goldilocks.Scalar{}
+	r.FromBytes(rPM[:])
+	R := (&[paramB]byte{})[:]
+	if err := (goldilocks.Curve{}.ScalarBaseMult(r).ToBytes(R)); err != nil {
+		panic(err)
+	}
+	// 4.  Compute SHAKE256(dom4(F, C) || R || A || PH(M), 114)
+	var hRAM [hashSize]byte
+	H.Reset()
+
+	writeDom(&H, ctx, preHash)
+
+	_, _ = H.Write(R)
+	_, _ = H.Write(privateKey[SeedSize:])
+	_, _ = H.Write(PHM)
+	_, _ = H.Read(hRAM[:])
+
+	// 5.  Compute S = (r + k * s) mod order.
+	k := &goldilocks.Scalar{}
+	k.FromBytes(hRAM[:])
+	S := &goldilocks.Scalar{}
+	S.Mul(k, s)
+	S.Add(S, r)
+
+	// 6.  The signature is the concatenation of R and S.
+	copy(signature[:paramB], R[:])
+	copy(signature[paramB:], S[:])
+}
+
+// Sign signs the message with privateKey and returns a signature.
+// This function supports the signature variant defined in RFC-8032: Ed448,
+// also known as the pure version of EdDSA.
+// It will panic if len(privateKey) is not PrivateKeySize.
+func Sign(priv PrivateKey, message []byte, ctx string) []byte {
+	signature := make([]byte, SignatureSize)
+	signAll(signature, priv, message, []byte(ctx), false)
+	return signature
+}
+
+// SignPh creates a signature of a message given a keypair.
+// This function supports the signature variant defined in RFC-8032: Ed448ph,
+// meaning it internally hashes the message using SHAKE-256.
+// Context could be passed to this function, which length should be no more than
+// 255. It can be empty.
+func SignPh(priv PrivateKey, message []byte, ctx string) []byte {
+	signature := make([]byte, SignatureSize)
+	signAll(signature, priv, message, []byte(ctx), true)
+	return signature
+}
+
+func verify(public PublicKey, message, signature, ctx []byte, preHash bool) bool {
+	if len(public) != PublicKeySize ||
+		len(signature) != SignatureSize ||
+		len(ctx) > ContextMaxSize ||
+		!isLessThanOrder(signature[paramB:]) {
+		return false
+	}
+
+	P, err := goldilocks.FromBytes(public)
+	if err != nil {
+		return false
+	}
+
+	H := sha3.NewShake256()
+	var PHM []byte
+
+	if preHash {
+		var h [64]byte
+		_, _ = H.Write(message)
+		_, _ = H.Read(h[:])
+		PHM = h[:]
+		H.Reset()
+	} else {
+		PHM = message
+	}
+
+	var hRAM [hashSize]byte
+	R := signature[:paramB]
+
+	writeDom(&H, ctx, preHash)
+
+	_, _ = H.Write(R)
+	_, _ = H.Write(public)
+	_, _ = H.Write(PHM)
+	_, _ = H.Read(hRAM[:])
+
+	k := &goldilocks.Scalar{}
+	k.FromBytes(hRAM[:])
+	S := &goldilocks.Scalar{}
+	S.FromBytes(signature[paramB:])
+
+	encR := (&[paramB]byte{})[:]
+	P.Neg()
+	_ = goldilocks.Curve{}.CombinedMult(S, k, P).ToBytes(encR)
+	return bytes.Equal(R, encR)
+}
+
+// VerifyAny returns true if the signature is valid. Failure cases are invalid
+// signature, or when the public key cannot be decoded.
+// This function supports all the two signature variants defined in RFC-8032,
+// namely Ed448 (or pure EdDSA) and Ed448Ph.
+// The opts.HashFunc() must return zero, this can be achieved by passing
+// crypto.Hash(0) as the value for opts.
+// Use a SignerOptions struct to pass a context string for signing.
+func VerifyAny(public PublicKey, message, signature []byte, opts crypto.SignerOpts) bool {
+	var ctx string
+	var scheme SchemeID
+	if o, ok := opts.(SignerOptions); ok {
+		ctx = o.Context
+		scheme = o.Scheme
+	}
+
+	switch true {
+	case scheme == ED448 && opts.HashFunc() == crypto.Hash(0):
+		return Verify(public, message, signature, ctx)
+	case scheme == ED448Ph && opts.HashFunc() == crypto.Hash(0):
+		return VerifyPh(public, message, signature, ctx)
+	default:
+		return false
+	}
+}
+
+// Verify returns true if the signature is valid. Failure cases are invalid
+// signature, or when the public key cannot be decoded.
+// This function supports the signature variant defined in RFC-8032: Ed448,
+// also known as the pure version of EdDSA.
+func Verify(public PublicKey, message, signature []byte, ctx string) bool {
+	return verify(public, message, signature, []byte(ctx), false)
+}
+
+// VerifyPh returns true if the signature is valid. Failure cases are invalid
+// signature, or when the public key cannot be decoded.
+// This function supports the signature variant defined in RFC-8032: Ed448ph,
+// meaning it internally hashes the message using SHAKE-256.
+// Context could be passed to this function, which length should be no more than
+// 255. It can be empty.
+func VerifyPh(public PublicKey, message, signature []byte, ctx string) bool {
+	return verify(public, message, signature, []byte(ctx), true)
+}
+
+func deriveSecretScalar(s *goldilocks.Scalar, h []byte) {
+	h[0] &= 0xFC        // The two least significant bits of the first octet are cleared,
+	h[paramB-1] = 0x00  // all eight bits the last octet are cleared, and
+	h[paramB-2] |= 0x80 // the highest bit of the second to last octet is set.
+	s.FromBytes(h[:paramB])
+}
+
+// isLessThanOrder returns true if 0 <= x < order and if the last byte of x is zero.
+func isLessThanOrder(x []byte) bool {
+	order := goldilocks.Curve{}.Order()
+	i := len(order) - 1
+	for i > 0 && x[i] == order[i] {
+		i--
+	}
+	return x[paramB-1] == 0 && x[i] < order[i]
+}
+
+func writeDom(h io.Writer, ctx []byte, preHash bool) {
+	dom4 := "SigEd448"
+	_, _ = h.Write([]byte(dom4))
+
+	if preHash {
+		_, _ = h.Write([]byte{byte(0x01), byte(len(ctx))})
+	} else {
+		_, _ = h.Write([]byte{byte(0x00), byte(len(ctx))})
+	}
+	_, _ = h.Write(ctx)
+}
diff --git a/.ci/providerlint/vendor/github.com/cloudflare/circl/sign/ed448/signapi.go b/.ci/providerlint/vendor/github.com/cloudflare/circl/sign/ed448/signapi.go
new file mode 100644
index 00000000000..22da8bc0a57
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/cloudflare/circl/sign/ed448/signapi.go
@@ -0,0 +1,87 @@
+package ed448
+
+import (
+	"crypto/rand"
+	"encoding/asn1"
+
+	"github.com/cloudflare/circl/sign"
+)
+
+var sch sign.Scheme = &scheme{}
+
+// Scheme returns a signature interface.
+func Scheme() sign.Scheme { return sch }
+
+type scheme struct{}
+
+func (*scheme) Name() string          { return "Ed448" }
+func (*scheme) PublicKeySize() int    { return PublicKeySize }
+func (*scheme) PrivateKeySize() int   { return PrivateKeySize }
+func (*scheme) SignatureSize() int    { return SignatureSize }
+func (*scheme) SeedSize() int         { return SeedSize }
+func (*scheme) TLSIdentifier() uint   { return 0x0808 }
+func (*scheme) SupportsContext() bool { return true }
+func (*scheme) Oid() asn1.ObjectIdentifier {
+	return asn1.ObjectIdentifier{1, 3, 101, 113}
+}
+
+func (*scheme) GenerateKey() (sign.PublicKey, sign.PrivateKey, error) {
+	return GenerateKey(rand.Reader)
+}
+
+func (*scheme) Sign(
+	sk sign.PrivateKey,
+	message []byte,
+	opts *sign.SignatureOpts,
+) []byte {
+	priv, ok := sk.(PrivateKey)
+	if !ok {
+		panic(sign.ErrTypeMismatch)
+	}
+	ctx := ""
+	if opts != nil {
+		ctx = opts.Context
+	}
+	return Sign(priv, message, ctx)
+}
+
+func (*scheme) Verify(
+	pk sign.PublicKey,
+	message, signature []byte,
+	opts *sign.SignatureOpts,
+) bool {
+	pub, ok := pk.(PublicKey)
+	if !ok {
+		panic(sign.ErrTypeMismatch)
+	}
+	ctx := ""
+	if opts != nil {
+		ctx = opts.Context
+	}
+	return Verify(pub, message, signature, ctx)
+}
+
+func (*scheme) DeriveKey(seed []byte) (sign.PublicKey, sign.PrivateKey) {
+	privateKey := NewKeyFromSeed(seed)
+	publicKey := make(PublicKey, PublicKeySize)
+	copy(publicKey, privateKey[SeedSize:])
+	return publicKey, privateKey
+}
+
+func (*scheme) UnmarshalBinaryPublicKey(buf []byte) (sign.PublicKey, error) {
+	if len(buf) < PublicKeySize {
+		return nil, sign.ErrPubKeySize
+	}
+	pub := make(PublicKey, PublicKeySize)
+	copy(pub, buf[:PublicKeySize])
+	return pub, nil
+}
+
+func (*scheme) UnmarshalBinaryPrivateKey(buf []byte) (sign.PrivateKey, error) {
+	if len(buf) < PrivateKeySize {
+		return nil, sign.ErrPrivKeySize
+	}
+	priv := make(PrivateKey, PrivateKeySize)
+	copy(priv, buf[:PrivateKeySize])
+	return priv, nil
+}
diff --git a/.ci/providerlint/vendor/github.com/cloudflare/circl/sign/sign.go b/.ci/providerlint/vendor/github.com/cloudflare/circl/sign/sign.go
new file mode 100644
index 00000000000..13b20fa4b04
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/cloudflare/circl/sign/sign.go
@@ -0,0 +1,110 @@
+// Package sign provides unified interfaces for signature schemes.
+//
+// A register of schemes is available in the package
+//
+//	github.com/cloudflare/circl/sign/schemes
+package sign
+
+import (
+	"crypto"
+	"encoding"
+	"errors"
+)
+
+type SignatureOpts struct {
+	// If non-empty, includes the given context in the signature if supported
+	// and will cause an error during signing otherwise.
+	Context string
+}
+
+// A public key is used to verify a signature set by the corresponding private
+// key.
+type PublicKey interface {
+	// Returns the signature scheme for this public key.
+	Scheme() Scheme
+	Equal(crypto.PublicKey) bool
+	encoding.BinaryMarshaler
+	crypto.PublicKey
+}
+
+// A private key allows one to create signatures.
+type PrivateKey interface {
+	// Returns the signature scheme for this private key.
+	Scheme() Scheme
+	Equal(crypto.PrivateKey) bool
+	// For compatibility with Go standard library
+	crypto.Signer
+	crypto.PrivateKey
+	encoding.BinaryMarshaler
+}
+
+// A Scheme represents a specific instance of a signature scheme.
+type Scheme interface {
+	// Name of the scheme.
+	Name() string
+
+	// GenerateKey creates a new key-pair.
+	GenerateKey() (PublicKey, PrivateKey, error)
+
+	// Creates a signature using the PrivateKey on the given message and
+	// returns the signature. opts are additional options which can be nil.
+	//
+	// Panics if key is nil or wrong type or opts context is not supported.
+	Sign(sk PrivateKey, message []byte, opts *SignatureOpts) []byte
+
+	// Checks whether the given signature is a valid signature set by
+	// the private key corresponding to the given public key on the
+	// given message. opts are additional options which can be nil.
+	//
+	// Panics if key is nil or wrong type or opts context is not supported.
+	Verify(pk PublicKey, message []byte, signature []byte, opts *SignatureOpts) bool
+
+	// Deterministically derives a keypair from a seed. If you're unsure,
+	// you're better off using GenerateKey().
+	//
+	// Panics if seed is not of length SeedSize().
+	DeriveKey(seed []byte) (PublicKey, PrivateKey)
+
+	// Unmarshals a PublicKey from the provided buffer.
+	UnmarshalBinaryPublicKey([]byte) (PublicKey, error)
+
+	// Unmarshals a PublicKey from the provided buffer.
+	UnmarshalBinaryPrivateKey([]byte) (PrivateKey, error)
+
+	// Size of binary marshalled public keys.
+	PublicKeySize() int
+
+	// Size of binary marshalled public keys.
+	PrivateKeySize() int
+
+	// Size of signatures.
+	SignatureSize() int
+
+	// Size of seeds.
+	SeedSize() int
+
+	// Returns whether contexts are supported.
+	SupportsContext() bool
+}
+
+var (
+	// ErrTypeMismatch is the error used if types of, for instance, private
+	// and public keys don't match.
+	ErrTypeMismatch = errors.New("types mismatch")
+
+	// ErrSeedSize is the error used if the provided seed is of the wrong
+	// size.
+	ErrSeedSize = errors.New("wrong seed size")
+
+	// ErrPubKeySize is the error used if the provided public key is of
+	// the wrong size.
+	ErrPubKeySize = errors.New("wrong size for public key")
+
+	// ErrPrivKeySize is the error used if the provided private key is of
+	// the wrong size.
+	ErrPrivKeySize = errors.New("wrong size for private key")
+
+	// ErrContextNotSupported is the error used if a context is not
+	// supported.
+	ErrContextNotSupported = errors.New("context not supported")
+)
diff --git a/.ci/providerlint/vendor/github.com/golang/protobuf/jsonpb/decode.go b/.ci/providerlint/vendor/github.com/golang/protobuf/jsonpb/decode.go
index 60e82caa9a2..6c16c255ffb 100644
--- a/.ci/providerlint/vendor/github.com/golang/protobuf/jsonpb/decode.go
+++ b/.ci/providerlint/vendor/github.com/golang/protobuf/jsonpb/decode.go
@@ -386,8 +386,14 @@ func (u *Unmarshaler) unmarshalMessage(m protoreflect.Message, in []byte) error
 }
 
 func isSingularWellKnownValue(fd protoreflect.FieldDescriptor) bool {
+	if fd.Cardinality() == protoreflect.Repeated {
+		return false
+	}
 	if md := fd.Message(); md != nil {
-		return md.FullName() == "google.protobuf.Value" && fd.Cardinality() != protoreflect.Repeated
+		return md.FullName() == "google.protobuf.Value"
+	}
+	if ed := fd.Enum(); ed != nil {
+		return ed.FullName() == "google.protobuf.NullValue"
 	}
 	return false
 }
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/go-hclog/LICENSE b/.ci/providerlint/vendor/github.com/hashicorp/go-hclog/LICENSE
index abaf1e45f2a..9938fb50ee1 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/go-hclog/LICENSE
+++ b/.ci/providerlint/vendor/github.com/hashicorp/go-hclog/LICENSE
@@ -1,6 +1,4 @@
-MIT License
-
-Copyright (c) 2017 HashiCorp
+Copyright (c) 2017 HashiCorp, Inc.
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/go-hclog/colorize_unix.go b/.ci/providerlint/vendor/github.com/hashicorp/go-hclog/colorize_unix.go
index 99cc176a416..d00816b38fa 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/go-hclog/colorize_unix.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/go-hclog/colorize_unix.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MIT
+
 //go:build !windows
 // +build !windows
 
@@ -7,23 +10,35 @@ import (
 	"github.com/mattn/go-isatty"
 )
 
+// hasFD is used to check if the writer has an Fd value to check
+// if it's a terminal.
+type hasFD interface {
+	Fd() uintptr
+}
+
 // setColorization will mutate the values of this logger
 // to appropriately configure colorization options. It provides
 // a wrapper to the output stream on Windows systems.
 func (l *intLogger) setColorization(opts *LoggerOptions) {
-	switch opts.Color {
-	case ColorOff:
-		fallthrough
-	case ForceColor:
+	if opts.Color != AutoColor {
 		return
-	case AutoColor:
-		fi := l.checkWriterIsFile()
-		isUnixTerm := isatty.IsTerminal(fi.Fd())
-		isCygwinTerm := isatty.IsCygwinTerminal(fi.Fd())
-		isTerm := isUnixTerm || isCygwinTerm
-		if !isTerm {
+	}
+
+	if sc, ok := l.writer.w.(SupportsColor); ok {
+		if !sc.SupportsColor() {
 			l.headerColor = ColorOff
 			l.writer.color = ColorOff
 		}
+		return
+	}
+
+	fi, ok := l.writer.w.(hasFD)
+	if !ok {
+		return
+	}
+
+	if !isatty.IsTerminal(fi.Fd()) {
+		l.headerColor = ColorOff
+		l.writer.color = ColorOff
 	}
 }
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/go-hclog/colorize_windows.go b/.ci/providerlint/vendor/github.com/hashicorp/go-hclog/colorize_windows.go
index 26f8cef8d12..2c3fb9ea6f0 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/go-hclog/colorize_windows.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/go-hclog/colorize_windows.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MIT
+
 //go:build windows
 // +build windows
 
@@ -7,32 +10,32 @@ import (
 	"os"
 
 	colorable "github.com/mattn/go-colorable"
-	"github.com/mattn/go-isatty"
 )
 
 // setColorization will mutate the values of this logger
 // to appropriately configure colorization options. It provides
 // a wrapper to the output stream on Windows systems.
 func (l *intLogger) setColorization(opts *LoggerOptions) {
-	switch opts.Color {
-	case ColorOff:
+	if opts.Color == ColorOff {
+		return
+	}
+
+	fi, ok := l.writer.w.(*os.File)
+	if !ok {
+		l.writer.color = ColorOff
+		l.headerColor = ColorOff
 		return
-	case ForceColor:
-		fi := l.checkWriterIsFile()
-		l.writer.w = colorable.NewColorable(fi)
-	case AutoColor:
-		fi := l.checkWriterIsFile()
-		isUnixTerm := isatty.IsTerminal(os.Stdout.Fd())
-		isCygwinTerm := isatty.IsCygwinTerminal(os.Stdout.Fd())
-		isTerm := isUnixTerm || isCygwinTerm
-		if !isTerm {
-			l.writer.color = ColorOff
-			l.headerColor = ColorOff
-			return
-		}
-
-		if l.headerColor == ColorOff {
-			l.writer.w = colorable.NewColorable(fi)
-		}
+	}
+
+	cfi := colorable.NewColorable(fi)
+
+	// NewColorable detects if color is possible and if it's not, then it
+	// returns the original value. So we can test if we got the original
+	// value back to know if color is possible.
+	if cfi == fi {
+		l.writer.color = ColorOff
+		l.headerColor = ColorOff
+	} else {
+		l.writer.w = cfi
 	}
 }
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/go-hclog/context.go b/.ci/providerlint/vendor/github.com/hashicorp/go-hclog/context.go
index 7815f501942..eb5aba556bb 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/go-hclog/context.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/go-hclog/context.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MIT
+
 package hclog
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/go-hclog/exclude.go b/.ci/providerlint/vendor/github.com/hashicorp/go-hclog/exclude.go
index cfd4307a803..4b73ba553da 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/go-hclog/exclude.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/go-hclog/exclude.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MIT
+
 package hclog
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/go-hclog/global.go b/.ci/providerlint/vendor/github.com/hashicorp/go-hclog/global.go
index 48ff1f3a4e9..a7403f593a9 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/go-hclog/global.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/go-hclog/global.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MIT
+
 package hclog
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/go-hclog/interceptlogger.go b/.ci/providerlint/vendor/github.com/hashicorp/go-hclog/interceptlogger.go
index ff42f1bfc1d..e9b1c188530 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/go-hclog/interceptlogger.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/go-hclog/interceptlogger.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MIT
+
 package hclog
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/go-hclog/intlogger.go b/.ci/providerlint/vendor/github.com/hashicorp/go-hclog/intlogger.go
index 89d26c9b01f..b45064acf1a 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/go-hclog/intlogger.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/go-hclog/intlogger.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MIT
+
 package hclog
 
 import (
@@ -8,7 +11,6 @@ import (
 	"fmt"
 	"io"
 	"log"
-	"os"
 	"reflect"
 	"runtime"
 	"sort"
@@ -86,6 +88,8 @@ type intLogger struct {
 
 	// create subloggers with their own level setting
 	independentLevels bool
+
+	subloggerHook func(sub Logger) Logger
 }
 
 // New returns a configured logger.
@@ -152,6 +156,7 @@ func newLogger(opts *LoggerOptions) *intLogger {
 		independentLevels: opts.IndependentLevels,
 		headerColor:       headerColor,
 		fieldColor:        fieldColor,
+		subloggerHook:     opts.SubloggerHook,
 	}
 	if opts.IncludeLocation {
 		l.callerOffset = offsetIntLogger + opts.AdditionalLocationOffset
@@ -167,6 +172,10 @@ func newLogger(opts *LoggerOptions) *intLogger {
 		l.timeFormat = opts.TimeFormat
 	}
 
+	if l.subloggerHook == nil {
+		l.subloggerHook = identityHook
+	}
+
 	l.setColorization(opts)
 
 	atomic.StoreInt32(l.level, int32(level))
@@ -174,6 +183,10 @@ func newLogger(opts *LoggerOptions) *intLogger {
 	return l
 }
 
+func identityHook(logger Logger) Logger {
+	return logger
+}
+
 // offsetIntLogger is the stack frame offset in the call stack for the caller to
 // one of the Warn, Info, Log, etc methods.
 const offsetIntLogger = 3
@@ -775,7 +788,7 @@ func (l *intLogger) With(args ...interface{}) Logger {
 		sl.implied = append(sl.implied, MissingKey, extra)
 	}
 
-	return sl
+	return l.subloggerHook(sl)
 }
 
 // Create a new sub-Logger that a name decending from the current name.
@@ -789,7 +802,7 @@ func (l *intLogger) Named(name string) Logger {
 		sl.name = name
 	}
 
-	return sl
+	return l.subloggerHook(sl)
 }
 
 // Create a new sub-Logger with an explicit name. This ignores the current
@@ -800,7 +813,7 @@ func (l *intLogger) ResetNamed(name string) Logger {
 
 	sl.name = name
 
-	return sl
+	return l.subloggerHook(sl)
 }
 
 func (l *intLogger) ResetOutput(opts *LoggerOptions) error {
@@ -876,16 +889,6 @@ func (l *intLogger) StandardWriter(opts *StandardLoggerOptions) io.Writer {
 	}
 }
 
-// checks if the underlying io.Writer is a file, and
-// panics if not. For use by colorization.
-func (l *intLogger) checkWriterIsFile() *os.File {
-	fi, ok := l.writer.w.(*os.File)
-	if !ok {
-		panic("Cannot enable coloring of non-file Writers")
-	}
-	return fi
-}
-
 // Accept implements the SinkAdapter interface
 func (i *intLogger) Accept(name string, level Level, msg string, args ...interface{}) {
 	i.log(name, level, msg, args...)
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/go-hclog/logger.go b/.ci/providerlint/vendor/github.com/hashicorp/go-hclog/logger.go
index 3cdb2837d79..947ac0c9afc 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/go-hclog/logger.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/go-hclog/logger.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MIT
+
 package hclog
 
 import (
@@ -89,6 +92,13 @@ const (
 	ForceColor
 )
 
+// SupportsColor is an optional interface that can be implemented by the output
+// value. If implemented and SupportsColor() returns true, then AutoColor will
+// enable colorization.
+type SupportsColor interface {
+	SupportsColor() bool
+}
+
 // LevelFromString returns a Level type for the named log level, or "NoLevel" if
 // the level string is invalid. This facilitates setting the log level via
 // config or environment variable by name in a predictable way.
@@ -292,6 +302,13 @@ type LoggerOptions struct {
 	// logger will not affect any subloggers, and SetLevel on any subloggers
 	// will not affect the parent or sibling loggers.
 	IndependentLevels bool
+
+	// SubloggerHook registers a function that is called when a sublogger via
+	// Named, With, or ResetNamed is created. If defined, the function is passed
+	// the newly created Logger and the returned Logger is returned from the
+	// original function. This option allows customization via interception and
+	// wrapping of Logger instances.
+	SubloggerHook func(sub Logger) Logger
 }
 
 // InterceptLogger describes the interface for using a logger
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/go-hclog/nulllogger.go b/.ci/providerlint/vendor/github.com/hashicorp/go-hclog/nulllogger.go
index 55e89dd31ca..d43da809eb9 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/go-hclog/nulllogger.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/go-hclog/nulllogger.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MIT
+
 package hclog
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/go-hclog/stdlog.go b/.ci/providerlint/vendor/github.com/hashicorp/go-hclog/stdlog.go
index 641f20ccbcc..03739b61fa7 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/go-hclog/stdlog.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/go-hclog/stdlog.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MIT
+
 package hclog
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/go-hclog/writer.go b/.ci/providerlint/vendor/github.com/hashicorp/go-hclog/writer.go
index 421a1f06c0b..4ee219bf0ce 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/go-hclog/writer.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/go-hclog/writer.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MIT
+
 package hclog
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/CHANGELOG.md b/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/CHANGELOG.md
index d40ad613615..ffcfe15431b 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/CHANGELOG.md
+++ b/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/CHANGELOG.md
@@ -1,3 +1,47 @@
+## v1.5.1
+
+BUGS:
+
+* server: `PLUGIN_UNIX_SOCKET_DIR` is consistently used for gRPC broker sockets as well as the initial socket [[GH-277](https://github.com/hashicorp/go-plugin/pull/277)]
+
+ENHANCEMENTS:
+
+* client: New `UnixSocketConfig` option in `ClientConfig` to support making the client's Unix sockets group-writable [[GH-277](https://github.com/hashicorp/go-plugin/pull/277)]
+
+## v1.5.0
+
+ENHANCEMENTS:
+
+* client: New `runner.Runner` interface to support clients providing custom plugin command runner implementations [[GH-270](https://github.com/hashicorp/go-plugin/pull/270)]
+    * Accessible via new `ClientConfig` field `RunnerFunc`, which is mutually exclusive with `Cmd` and `Reattach`
+    * Reattaching support via `ReattachConfig` field `ReattachFunc`
+* client: New `ClientConfig` field `SkipHostEnv` allows omitting the client process' own environment variables from the plugin command's environment [[GH-270](https://github.com/hashicorp/go-plugin/pull/270)]
+* client: Add `ID()` method to `Client` for retrieving the pid or other unique ID of a running plugin [[GH-272](https://github.com/hashicorp/go-plugin/pull/272)]
+* server: Support setting the directory to create Unix sockets in with the env var `PLUGIN_UNIX_SOCKET_DIR` [[GH-270](https://github.com/hashicorp/go-plugin/pull/270)]
+* server: Support setting group write permission and a custom group name or gid owner with the env var `PLUGIN_UNIX_SOCKET_GROUP` [[GH-270](https://github.com/hashicorp/go-plugin/pull/270)]
+
+## v1.4.11-rc1
+
+ENHANCEMENTS:
+
+* deps: bump protoreflect to v1.15.1 [[GH-264](https://github.com/hashicorp/go-plugin/pull/264)]
+
+## v1.4.10
+
+BUG FIXES:
+
+* additional notes: ensure to close files [[GH-241](https://github.com/hashicorp/go-plugin/pull/241)]
+
+ENHANCEMENTS:
+
+* deps: Remove direct dependency on golang.org/x/net [[GH-240](https://github.com/hashicorp/go-plugin/pull/240)]
+
+## v1.4.9
+
+ENHANCEMENTS:
+
+* client: Remove log warning introduced in 1.4.5 when SecureConfig is nil. [[GH-238](https://github.com/hashicorp/go-plugin/pull/238)]
+
 ## v1.4.8
 
 BUG FIXES:
@@ -33,5 +77,3 @@ BUG FIXES:
 
 * Bidirectional communication: fix bidirectional communication when AutoMTLS is enabled [[GH-193](https://github.com/hashicorp/go-plugin/pull/193)]
 * RPC: Trim a spurious log message for plugins using RPC [[GH-186](https://github.com/hashicorp/go-plugin/pull/186)]
-
-
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/README.md b/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/README.md
index 39391f24fe4..50baee06e15 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/README.md
+++ b/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/README.md
@@ -4,8 +4,9 @@
 that has been in use by HashiCorp tooling for over 4 years. While initially
 created for [Packer](https://www.packer.io), it is additionally in use by
 [Terraform](https://www.terraform.io), [Nomad](https://www.nomadproject.io),
-[Vault](https://www.vaultproject.io), and
-[Boundary](https://www.boundaryproject.io).
+[Vault](https://www.vaultproject.io),
+[Boundary](https://www.boundaryproject.io),
+and [Waypoint](https://www.waypointproject.io).
 
 While the plugin system is over RPC, it is currently only designed to work
 over a local [reliable] network. Plugins over a real network are not supported
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/client.go b/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/client.go
index d0baf7e8d76..b6024afce0e 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/client.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/client.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package plugin
 
 import (
@@ -23,17 +26,11 @@ import (
 	"time"
 
 	"github.com/hashicorp/go-hclog"
+	"github.com/hashicorp/go-plugin/internal/cmdrunner"
+	"github.com/hashicorp/go-plugin/runner"
 	"google.golang.org/grpc"
 )
 
-const unrecognizedRemotePluginMessage = `Unrecognized remote plugin message: %s
-This usually means
-  the plugin was not compiled for this architecture,
-  the plugin is missing dynamic-link libraries necessary to run,
-  the plugin is not executable by this process due to file permissions, or
-  the plugin failed to negotiate the initial go-plugin protocol handshake
-%s`
-
 // If this is 1, then we've called CleanupClients. This can be used
 // by plugin RPC implementations to change error behavior since you
 // can expected network connection errors at this point. This should be
@@ -49,7 +46,7 @@ var managedClientsLock sync.Mutex
 var (
 	// ErrProcessNotFound is returned when a client is instantiated to
 	// reattach to an existing process and it isn't found.
-	ErrProcessNotFound = errors.New("Reattachment process not found")
+	ErrProcessNotFound = cmdrunner.ErrProcessNotFound
 
 	// ErrChecksumsDoNotMatch is returned when binary's checksum doesn't match
 	// the one provided in the SecureConfig.
@@ -84,7 +81,7 @@ type Client struct {
 	exited            bool
 	l                 sync.Mutex
 	address           net.Addr
-	process           *os.Process
+	runner            runner.AttachedRunner
 	client            ClientProtocol
 	protocol          Protocol
 	logger            hclog.Logger
@@ -103,6 +100,8 @@ type Client struct {
 	// processKilled is used for testing only, to flag when the process was
 	// forcefully killed.
 	processKilled bool
+
+	unixSocketCfg UnixSocketConfig
 }
 
 // NegotiatedVersion returns the protocol version negotiated with the server.
@@ -111,6 +110,19 @@ func (c *Client) NegotiatedVersion() int {
 	return c.negotiatedVersion
 }
 
+// ID returns a unique ID for the running plugin. By default this is the process
+// ID (pid), but it could take other forms if RunnerFunc was provided.
+func (c *Client) ID() string {
+	c.l.Lock()
+	defer c.l.Unlock()
+
+	if c.runner != nil {
+		return c.runner.ID()
+	}
+
+	return ""
+}
+
 // ClientConfig is the configuration used to initialize a new
 // plugin client. After being used to initialize a plugin client,
 // that configuration must not be modified again.
@@ -138,6 +150,13 @@ type ClientConfig struct {
 	Cmd      *exec.Cmd
 	Reattach *ReattachConfig
 
+	// RunnerFunc allows consumers to provide their own implementation of
+	// runner.Runner and control the context within which a plugin is executed.
+	// The cmd argument will have been copied from the config and populated with
+	// environment variables that a go-plugin server expects to read such as
+	// AutoMTLS certs and the magic cookie key.
+	RunnerFunc func(l hclog.Logger, cmd *exec.Cmd, tmpDir string) (runner.Runner, error)
+
 	// SecureConfig is configuration for verifying the integrity of the
 	// executable. It can not be used with Reattach.
 	SecureConfig *SecureConfig
@@ -217,6 +236,32 @@ type ClientConfig struct {
 	// to create gRPC connections. This only affects plugins using the gRPC
 	// protocol.
 	GRPCDialOptions []grpc.DialOption
+
+	// SkipHostEnv allows plugins to run without inheriting the parent process'
+	// environment variables.
+	SkipHostEnv bool
+
+	// UnixSocketConfig configures additional options for any Unix sockets
+	// that are created. Not normally required. Not supported on Windows.
+	UnixSocketConfig *UnixSocketConfig
+}
+
+type UnixSocketConfig struct {
+	// If set, go-plugin will change the owner of any Unix sockets created to
+	// this group, and set them as group-writable. Can be a name or gid. The
+	// client process must be a member of this group or chown will fail.
+	Group string
+
+	// The directory to create Unix sockets in. Internally managed by go-plugin
+	// and deleted when the plugin is killed.
+	directory string
+}
+
+func unixSocketConfigFromEnv() UnixSocketConfig {
+	return UnixSocketConfig{
+		Group:     os.Getenv(EnvUnixSocketGroup),
+		directory: os.Getenv(EnvUnixSocketDir),
+	}
 }
 
 // ReattachConfig is used to configure a client to reattach to an
@@ -228,6 +273,11 @@ type ReattachConfig struct {
 	Addr            net.Addr
 	Pid             int
 
+	// ReattachFunc allows consumers to provide their own implementation of
+	// runner.AttachedRunner and attach to something other than a plain process.
+	// At least one of Pid or ReattachFunc must be set.
+	ReattachFunc runner.ReattachFunc
+
 	// Test is set to true if this is reattaching to to a plugin in "test mode"
 	// (see ServeConfig.Test). In this mode, client.Kill will NOT kill the
 	// process and instead will rely on the plugin to terminate itself. This
@@ -307,7 +357,7 @@ func CleanupClients() {
 // plugin and gets the address for the RPC connection.
 //
 // The client must be cleaned up at some point by calling Kill(). If
-// the client is a managed client (created with NewManagedClient) you
+// the client is a managed client (created with ClientConfig.Managed) you
 // can just call CleanupClients at the end of your program and they will
 // be properly cleaned.
 func NewClient(config *ClientConfig) (c *Client) {
@@ -415,12 +465,13 @@ func (c *Client) killed() bool {
 func (c *Client) Kill() {
 	// Grab a lock to read some private fields.
 	c.l.Lock()
-	process := c.process
+	runner := c.runner
 	addr := c.address
+	hostSocketDir := c.unixSocketCfg.directory
 	c.l.Unlock()
 
-	// If there is no process, there is nothing to kill.
-	if process == nil {
+	// If there is no runner or ID, there is nothing to kill.
+	if runner == nil || runner.ID() == "" {
 		return
 	}
 
@@ -428,10 +479,14 @@ func (c *Client) Kill() {
 		// Wait for the all client goroutines to finish.
 		c.clientWaitGroup.Wait()
 
+		if hostSocketDir != "" {
+			os.RemoveAll(hostSocketDir)
+		}
+
 		// Make sure there is no reference to the old process after it has been
 		// killed.
 		c.l.Lock()
-		c.process = nil
+		c.runner = nil
 		c.l.Unlock()
 	}()
 
@@ -474,23 +529,15 @@ func (c *Client) Kill() {
 
 	// If graceful exiting failed, just kill it
 	c.logger.Warn("plugin failed to exit gracefully")
-	process.Kill()
+	if err := runner.Kill(context.Background()); err != nil {
+		c.logger.Debug("error killing plugin", "error", err)
+	}
 
 	c.l.Lock()
 	c.processKilled = true
 	c.l.Unlock()
 }
 
-// peTypes is a list of Portable Executable (PE) machine types from https://learn.microsoft.com/en-us/windows/win32/debug/pe-format
-// mapped to GOARCH types. It is not comprehensive, and only includes machine types that Go supports.
-var peTypes = map[uint16]string{
-	0x14c:  "386",
-	0x1c0:  "arm",
-	0x6264: "loong64",
-	0x8664: "amd64",
-	0xaa64: "arm64",
-}
-
 // Start the underlying subprocess, communicating with it to negotiate
 // a port for RPC connections, and returning the address to connect via RPC.
 //
@@ -509,14 +556,21 @@ func (c *Client) Start() (addr net.Addr, err error) {
 	// this in a {} for scoping reasons, and hopeful that the escape
 	// analysis will pop the stack here.
 	{
-		cmdSet := c.config.Cmd != nil
-		attachSet := c.config.Reattach != nil
-		secureSet := c.config.SecureConfig != nil
-		if cmdSet == attachSet {
-			return nil, fmt.Errorf("Only one of Cmd or Reattach must be set")
+		var mutuallyExclusiveOptions int
+		if c.config.Cmd != nil {
+			mutuallyExclusiveOptions += 1
+		}
+		if c.config.Reattach != nil {
+			mutuallyExclusiveOptions += 1
+		}
+		if c.config.RunnerFunc != nil {
+			mutuallyExclusiveOptions += 1
+		}
+		if mutuallyExclusiveOptions != 1 {
+			return nil, fmt.Errorf("exactly one of Cmd, or Reattach, or RunnerFunc must be set")
 		}
 
-		if secureSet && attachSet {
+		if c.config.SecureConfig != nil && c.config.Reattach != nil {
 			return nil, ErrSecureConfigAndReattach
 		}
 	}
@@ -552,22 +606,19 @@ func (c *Client) Start() (addr net.Addr, err error) {
 	}
 
 	cmd := c.config.Cmd
-	cmd.Env = append(cmd.Env, os.Environ()...)
-	cmd.Env = append(cmd.Env, env...)
-	cmd.Stdin = os.Stdin
-
-	cmdStdout, err := cmd.StdoutPipe()
-	if err != nil {
-		return nil, err
+	if cmd == nil {
+		// It's only possible to get here if RunnerFunc is non-nil, but we'll
+		// still use cmd as a spec to populate metadata for the external
+		// implementation to consume.
+		cmd = exec.Command("")
 	}
-	cmdStderr, err := cmd.StderrPipe()
-	if err != nil {
-		return nil, err
+	if !c.config.SkipHostEnv {
+		cmd.Env = append(cmd.Env, os.Environ()...)
 	}
+	cmd.Env = append(cmd.Env, env...)
+	cmd.Stdin = os.Stdin
 
-	if c.config.SecureConfig == nil {
-		c.logger.Warn("plugin configured with a nil SecureConfig")
-	} else {
+	if c.config.SecureConfig != nil {
 		if ok, err := c.config.SecureConfig.Check(cmd.Path); err != nil {
 			return nil, fmt.Errorf("error verifying checksum: %s", err)
 		} else if !ok {
@@ -600,26 +651,62 @@ func (c *Client) Start() (addr net.Addr, err error) {
 		}
 	}
 
-	c.logger.Debug("starting plugin", "path", cmd.Path, "args", cmd.Args)
-	err = cmd.Start()
-	if err != nil {
-		return
+	if c.config.UnixSocketConfig != nil {
+		c.unixSocketCfg.Group = c.config.UnixSocketConfig.Group
 	}
 
-	// Set the process
-	c.process = cmd.Process
-	c.logger.Debug("plugin started", "path", cmd.Path, "pid", c.process.Pid)
+	if c.unixSocketCfg.Group != "" {
+		cmd.Env = append(cmd.Env, fmt.Sprintf("%s=%s", EnvUnixSocketGroup, c.unixSocketCfg.Group))
+	}
+
+	var runner runner.Runner
+	switch {
+	case c.config.RunnerFunc != nil:
+		c.unixSocketCfg.directory, err = os.MkdirTemp("", "plugin-dir")
+		if err != nil {
+			return nil, err
+		}
+		// os.MkdirTemp creates folders with 0o700, so if we have a group
+		// configured we need to make it group-writable.
+		if c.unixSocketCfg.Group != "" {
+			err = setGroupWritable(c.unixSocketCfg.directory, c.unixSocketCfg.Group, 0o770)
+			if err != nil {
+				return nil, err
+			}
+		}
+		cmd.Env = append(cmd.Env, fmt.Sprintf("%s=%s", EnvUnixSocketDir, c.unixSocketCfg.directory))
+		c.logger.Trace("created temporary directory for unix sockets", "dir", c.unixSocketCfg.directory)
+
+		runner, err = c.config.RunnerFunc(c.logger, cmd, c.unixSocketCfg.directory)
+		if err != nil {
+			return nil, err
+		}
+	default:
+		runner, err = cmdrunner.NewCmdRunner(c.logger, cmd)
+		if err != nil {
+			return nil, err
+		}
+
+	}
+
+	c.runner = runner
+	startCtx, startCtxCancel := context.WithTimeout(context.Background(), c.config.StartTimeout)
+	defer startCtxCancel()
+	err = runner.Start(startCtx)
+	if err != nil {
+		return nil, err
+	}
 
 	// Make sure the command is properly cleaned up if there is an error
 	defer func() {
-		r := recover()
+		rErr := recover()
 
-		if err != nil || r != nil {
-			cmd.Process.Kill()
+		if err != nil || rErr != nil {
+			runner.Kill(context.Background())
 		}
 
-		if r != nil {
-			panic(r)
+		if rErr != nil {
+			panic(rErr)
 		}
 	}()
 
@@ -630,7 +717,7 @@ func (c *Client) Start() (addr net.Addr, err error) {
 	c.clientWaitGroup.Add(1)
 	c.stderrWaitGroup.Add(1)
 	// logStderr calls Done()
-	go c.logStderr(cmdStderr)
+	go c.logStderr(runner.Name(), runner.Stderr())
 
 	c.clientWaitGroup.Add(1)
 	go func() {
@@ -639,29 +726,17 @@ func (c *Client) Start() (addr net.Addr, err error) {
 
 		defer c.clientWaitGroup.Done()
 
-		// get the cmd info early, since the process information will be removed
-		// in Kill.
-		pid := c.process.Pid
-		path := cmd.Path
-
 		// wait to finish reading from stderr since the stderr pipe reader
 		// will be closed by the subsequent call to cmd.Wait().
 		c.stderrWaitGroup.Wait()
 
 		// Wait for the command to end.
-		err := cmd.Wait()
-
-		msgArgs := []interface{}{
-			"path", path,
-			"pid", pid,
-		}
+		err := runner.Wait(context.Background())
 		if err != nil {
-			msgArgs = append(msgArgs,
-				[]interface{}{"error", err.Error()}...)
-			c.logger.Error("plugin process exited", msgArgs...)
+			c.logger.Error("plugin process exited", "plugin", runner.Name(), "id", runner.ID(), "error", err.Error())
 		} else {
 			// Log and make sure to flush the logs right away
-			c.logger.Info("plugin process exited", msgArgs...)
+			c.logger.Info("plugin process exited", "plugin", runner.Name(), "id", runner.ID())
 		}
 
 		os.Stderr.Sync()
@@ -680,10 +755,13 @@ func (c *Client) Start() (addr net.Addr, err error) {
 		defer c.clientWaitGroup.Done()
 		defer close(linesCh)
 
-		scanner := bufio.NewScanner(cmdStdout)
+		scanner := bufio.NewScanner(runner.Stdout())
 		for scanner.Scan() {
 			linesCh <- scanner.Text()
 		}
+		if scanner.Err() != nil {
+			c.logger.Error("error encountered while scanning stdout", "error", scanner.Err())
+		}
 	}()
 
 	// Make sure after we exit we read the lines from stdout forever
@@ -703,19 +781,27 @@ func (c *Client) Start() (addr net.Addr, err error) {
 	timeout := time.After(c.config.StartTimeout)
 
 	// Start looking for the address
-	c.logger.Debug("waiting for RPC address", "path", cmd.Path)
+	c.logger.Debug("waiting for RPC address", "plugin", runner.Name())
 	select {
 	case <-timeout:
 		err = errors.New("timeout while waiting for plugin to start")
 	case <-c.doneCtx.Done():
 		err = errors.New("plugin exited before we could connect")
-	case line := <-linesCh:
+	case line, ok := <-linesCh:
 		// Trim the line and split by "|" in order to get the parts of
 		// the output.
 		line = strings.TrimSpace(line)
 		parts := strings.SplitN(line, "|", 6)
 		if len(parts) < 4 {
-			err = fmt.Errorf(unrecognizedRemotePluginMessage, line, additionalNotesAboutCommand(cmd.Path))
+			errText := fmt.Sprintf("Unrecognized remote plugin message: %s", line)
+			if !ok {
+				errText += "\n" + "Failed to read any lines from plugin's stdout"
+			}
+			additionalNotes := runner.Diagnose(context.Background())
+			if additionalNotes != "" {
+				errText += "\n" + additionalNotes
+			}
+			err = errors.New(errText)
 			return
 		}
 
@@ -750,13 +836,18 @@ func (c *Client) Start() (addr net.Addr, err error) {
 		c.negotiatedVersion = version
 		c.logger.Debug("using plugin", "version", version)
 
-		switch parts[2] {
+		network, address, err := runner.PluginToHost(parts[2], parts[3])
+		if err != nil {
+			return addr, err
+		}
+
+		switch network {
 		case "tcp":
-			addr, err = net.ResolveTCPAddr("tcp", parts[3])
+			addr, err = net.ResolveTCPAddr("tcp", address)
 		case "unix":
-			addr, err = net.ResolveUnixAddr("unix", parts[3])
+			addr, err = net.ResolveUnixAddr("unix", address)
 		default:
-			err = fmt.Errorf("Unknown address type: %s", parts[3])
+			err = fmt.Errorf("Unknown address type: %s", address)
 		}
 
 		// If we have a server type, then record that. We default to net/rpc
@@ -817,39 +908,30 @@ func (c *Client) loadServerCert(cert string) error {
 }
 
 func (c *Client) reattach() (net.Addr, error) {
-	// Verify the process still exists. If not, then it is an error
-	p, err := os.FindProcess(c.config.Reattach.Pid)
-	if err != nil {
-		// On Unix systems, FindProcess never returns an error.
-		// On Windows, for non-existent pids it returns:
-		// os.SyscallError - 'OpenProcess: the paremter is incorrect'
-		return nil, ErrProcessNotFound
+	reattachFunc := c.config.Reattach.ReattachFunc
+	// For backwards compatibility default to cmdrunner.ReattachFunc
+	if reattachFunc == nil {
+		reattachFunc = cmdrunner.ReattachFunc(c.config.Reattach.Pid, c.config.Reattach.Addr)
 	}
 
-	// Attempt to connect to the addr since on Unix systems FindProcess
-	// doesn't actually return an error if it can't find the process.
-	conn, err := net.Dial(
-		c.config.Reattach.Addr.Network(),
-		c.config.Reattach.Addr.String())
+	r, err := reattachFunc()
 	if err != nil {
-		p.Kill()
-		return nil, ErrProcessNotFound
+		return nil, err
 	}
-	conn.Close()
 
 	// Create a context for when we kill
 	c.doneCtx, c.ctxCancel = context.WithCancel(context.Background())
 
 	c.clientWaitGroup.Add(1)
 	// Goroutine to mark exit status
-	go func(pid int) {
+	go func(r runner.AttachedRunner) {
 		defer c.clientWaitGroup.Done()
 
 		// ensure the context is cancelled when we're done
 		defer c.ctxCancel()
 
 		// Wait for the process to die
-		pidWait(pid)
+		r.Wait(context.Background())
 
 		// Log so we can see it
 		c.logger.Debug("reattached plugin process exited")
@@ -858,7 +940,7 @@ func (c *Client) reattach() (net.Addr, error) {
 		c.l.Lock()
 		defer c.l.Unlock()
 		c.exited = true
-	}(p.Pid)
+	}(r)
 
 	// Set the address and protocol
 	c.address = c.config.Reattach.Addr
@@ -876,7 +958,7 @@ func (c *Client) reattach() (net.Addr, error) {
 	// process being killed (the only purpose we have for c.process), since
 	// in test mode the process is responsible for exiting on its own.
 	if !c.config.Reattach.Test {
-		c.process = p
+		c.runner = r
 	}
 
 	return c.address, nil
@@ -915,6 +997,9 @@ func (c *Client) checkProtoVersion(protoVersion string) (int, PluginSet, error)
 //
 // If this returns nil then the process hasn't been started yet. Please
 // call Start or Client before calling this.
+//
+// Clients who specified a RunnerFunc will need to populate their own
+// ReattachFunc in the returned ReattachConfig before it can be used.
 func (c *Client) ReattachConfig() *ReattachConfig {
 	c.l.Lock()
 	defer c.l.Unlock()
@@ -932,11 +1017,16 @@ func (c *Client) ReattachConfig() *ReattachConfig {
 		return c.config.Reattach
 	}
 
-	return &ReattachConfig{
+	reattach := &ReattachConfig{
 		Protocol: c.protocol,
 		Addr:     c.address,
-		Pid:      c.config.Cmd.Process.Pid,
 	}
+
+	if c.config.Cmd != nil && c.config.Cmd.Process != nil {
+		reattach.Pid = c.config.Cmd.Process.Pid
+	}
+
+	return reattach
 }
 
 // Protocol returns the protocol of server on the remote end. This will
@@ -988,10 +1078,10 @@ func (c *Client) dialer(_ string, timeout time.Duration) (net.Conn, error) {
 
 var stdErrBufferSize = 64 * 1024
 
-func (c *Client) logStderr(r io.Reader) {
+func (c *Client) logStderr(name string, r io.Reader) {
 	defer c.clientWaitGroup.Done()
 	defer c.stderrWaitGroup.Done()
-	l := c.logger.Named(filepath.Base(c.config.Cmd.Path))
+	l := c.logger.Named(filepath.Base(name))
 
 	reader := bufio.NewReaderSize(r, stdErrBufferSize)
 	// continuation indicates the previous line was a prefix
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/constants.go b/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/constants.go
new file mode 100644
index 00000000000..b66fa79993e
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/constants.go
@@ -0,0 +1,9 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package plugin
+
+const (
+	EnvUnixSocketDir   = "PLUGIN_UNIX_SOCKET_DIR"
+	EnvUnixSocketGroup = "PLUGIN_UNIX_SOCKET_GROUP"
+)
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/discover.go b/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/discover.go
index d22c566ed50..c5b96242b1a 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/discover.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/discover.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package plugin
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/error.go b/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/error.go
index 22a7baa6a0d..e62a21913f4 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/error.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/error.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package plugin
 
 // This is a type that wraps error types so that they can be messaged
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/grpc_broker.go b/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/grpc_broker.go
index daf142d1709..b86561a017f 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/grpc_broker.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/grpc_broker.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package plugin
 
 import (
@@ -12,6 +15,7 @@ import (
 	"time"
 
 	"github.com/hashicorp/go-plugin/internal/plugin"
+	"github.com/hashicorp/go-plugin/runner"
 
 	"github.com/oklog/run"
 	"google.golang.org/grpc"
@@ -264,6 +268,9 @@ type GRPCBroker struct {
 	doneCh   chan struct{}
 	o        sync.Once
 
+	unixSocketCfg  UnixSocketConfig
+	addrTranslator runner.AddrTranslator
+
 	sync.Mutex
 }
 
@@ -272,12 +279,15 @@ type gRPCBrokerPending struct {
 	doneCh chan struct{}
 }
 
-func newGRPCBroker(s streamer, tls *tls.Config) *GRPCBroker {
+func newGRPCBroker(s streamer, tls *tls.Config, unixSocketCfg UnixSocketConfig, addrTranslator runner.AddrTranslator) *GRPCBroker {
 	return &GRPCBroker{
 		streamer: s,
 		streams:  make(map[uint32]*gRPCBrokerPending),
 		tls:      tls,
 		doneCh:   make(chan struct{}),
+
+		unixSocketCfg:  unixSocketCfg,
+		addrTranslator: addrTranslator,
 	}
 }
 
@@ -285,15 +295,23 @@ func newGRPCBroker(s streamer, tls *tls.Config) *GRPCBroker {
 //
 // This should not be called multiple times with the same ID at one time.
 func (b *GRPCBroker) Accept(id uint32) (net.Listener, error) {
-	listener, err := serverListener()
+	listener, err := serverListener(b.unixSocketCfg)
 	if err != nil {
 		return nil, err
 	}
 
+	advertiseNet := listener.Addr().Network()
+	advertiseAddr := listener.Addr().String()
+	if b.addrTranslator != nil {
+		advertiseNet, advertiseAddr, err = b.addrTranslator.HostToPlugin(advertiseNet, advertiseAddr)
+		if err != nil {
+			return nil, err
+		}
+	}
 	err = b.streamer.Send(&plugin.ConnInfo{
 		ServiceId: id,
-		Network:   listener.Addr().Network(),
-		Address:   listener.Addr().String(),
+		Network:   advertiseNet,
+		Address:   advertiseAddr,
 	})
 	if err != nil {
 		return nil, err
@@ -376,12 +394,20 @@ func (b *GRPCBroker) Dial(id uint32) (conn *grpc.ClientConn, err error) {
 		return nil, fmt.Errorf("timeout waiting for connection info")
 	}
 
+	network, address := c.Network, c.Address
+	if b.addrTranslator != nil {
+		network, address, err = b.addrTranslator.PluginToHost(network, address)
+		if err != nil {
+			return nil, err
+		}
+	}
+
 	var addr net.Addr
-	switch c.Network {
+	switch network {
 	case "tcp":
-		addr, err = net.ResolveTCPAddr("tcp", c.Address)
+		addr, err = net.ResolveTCPAddr("tcp", address)
 	case "unix":
-		addr, err = net.ResolveUnixAddr("unix", c.Address)
+		addr, err = net.ResolveUnixAddr("unix", address)
 	default:
 		err = fmt.Errorf("Unknown address type: %s", c.Address)
 	}
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/grpc_client.go b/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/grpc_client.go
index 842903c922b..583e42503c8 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/grpc_client.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/grpc_client.go
@@ -1,6 +1,10 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package plugin
 
 import (
+	"context"
 	"crypto/tls"
 	"fmt"
 	"math"
@@ -8,7 +12,6 @@ import (
 	"time"
 
 	"github.com/hashicorp/go-plugin/internal/plugin"
-	"golang.org/x/net/context"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials"
 	"google.golang.org/grpc/health/grpc_health_v1"
@@ -60,7 +63,7 @@ func newGRPCClient(doneCtx context.Context, c *Client) (*GRPCClient, error) {
 
 	// Start the broker.
 	brokerGRPCClient := newGRPCBrokerClient(conn)
-	broker := newGRPCBroker(brokerGRPCClient, c.config.TLSConfig)
+	broker := newGRPCBroker(brokerGRPCClient, c.config.TLSConfig, c.unixSocketCfg, c.runner)
 	go broker.Run()
 	go brokerGRPCClient.StartStream()
 
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/grpc_controller.go b/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/grpc_controller.go
index 1a8a8e70ea4..2085356cd34 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/grpc_controller.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/grpc_controller.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package plugin
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/grpc_server.go b/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/grpc_server.go
index 54b061cc365..369f958aeea 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/grpc_server.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/grpc_server.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package plugin
 
 import (
@@ -81,7 +84,7 @@ func (s *GRPCServer) Init() error {
 	// Register the broker service
 	brokerServer := newGRPCBrokerServer()
 	plugin.RegisterGRPCBrokerServer(s.server, brokerServer)
-	s.broker = newGRPCBroker(brokerServer, s.TLS)
+	s.broker = newGRPCBroker(brokerServer, s.TLS, unixSocketConfigFromEnv(), nil)
 	go s.broker.Run()
 
 	// Register the controller
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/grpc_stdio.go b/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/grpc_stdio.go
index a582181505f..ae06c116313 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/grpc_stdio.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/grpc_stdio.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package plugin
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/internal/cmdrunner/addr_translator.go b/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/internal/cmdrunner/addr_translator.go
new file mode 100644
index 00000000000..1854d2dd531
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/internal/cmdrunner/addr_translator.go
@@ -0,0 +1,16 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package cmdrunner
+
+// addrTranslator implements stateless identity functions, as the host and plugin
+// run in the same context wrt Unix and network addresses.
+type addrTranslator struct{}
+
+func (*addrTranslator) PluginToHost(pluginNet, pluginAddr string) (string, string, error) {
+	return pluginNet, pluginAddr, nil
+}
+
+func (*addrTranslator) HostToPlugin(hostNet, hostAddr string) (string, string, error) {
+	return hostNet, hostAddr, nil
+}
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/internal/cmdrunner/cmd_reattach.go b/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/internal/cmdrunner/cmd_reattach.go
new file mode 100644
index 00000000000..dce1a86a88e
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/internal/cmdrunner/cmd_reattach.go
@@ -0,0 +1,63 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package cmdrunner
+
+import (
+	"context"
+	"fmt"
+	"net"
+	"os"
+
+	"github.com/hashicorp/go-plugin/runner"
+)
+
+// ReattachFunc returns a function that allows reattaching to a plugin running
+// as a plain process. The process may or may not be a child process.
+func ReattachFunc(pid int, addr net.Addr) runner.ReattachFunc {
+	return func() (runner.AttachedRunner, error) {
+		p, err := os.FindProcess(pid)
+		if err != nil {
+			// On Unix systems, FindProcess never returns an error.
+			// On Windows, for non-existent pids it returns:
+			// os.SyscallError - 'OpenProcess: the paremter is incorrect'
+			return nil, ErrProcessNotFound
+		}
+
+		// Attempt to connect to the addr since on Unix systems FindProcess
+		// doesn't actually return an error if it can't find the process.
+		conn, err := net.Dial(addr.Network(), addr.String())
+		if err != nil {
+			p.Kill()
+			return nil, ErrProcessNotFound
+		}
+		conn.Close()
+
+		return &CmdAttachedRunner{
+			pid:     pid,
+			process: p,
+		}, nil
+	}
+}
+
+// CmdAttachedRunner is mostly a subset of CmdRunner, except the Wait function
+// does not assume the process is a child of the host process, and so uses a
+// different implementation to wait on the process.
+type CmdAttachedRunner struct {
+	pid     int
+	process *os.Process
+
+	addrTranslator
+}
+
+func (c *CmdAttachedRunner) Wait(_ context.Context) error {
+	return pidWait(c.pid)
+}
+
+func (c *CmdAttachedRunner) Kill(_ context.Context) error {
+	return c.process.Kill()
+}
+
+func (c *CmdAttachedRunner) ID() string {
+	return fmt.Sprintf("%d", c.pid)
+}
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/internal/cmdrunner/cmd_runner.go b/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/internal/cmdrunner/cmd_runner.go
new file mode 100644
index 00000000000..b26fea928e2
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/internal/cmdrunner/cmd_runner.go
@@ -0,0 +1,129 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package cmdrunner
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"os/exec"
+
+	"github.com/hashicorp/go-hclog"
+	"github.com/hashicorp/go-plugin/runner"
+)
+
+var (
+	_ runner.Runner = (*CmdRunner)(nil)
+
+	// ErrProcessNotFound is returned when a client is instantiated to
+	// reattach to an existing process and it isn't found.
+	ErrProcessNotFound = errors.New("Reattachment process not found")
+)
+
+const unrecognizedRemotePluginMessage = `This usually means
+  the plugin was not compiled for this architecture,
+  the plugin is missing dynamic-link libraries necessary to run,
+  the plugin is not executable by this process due to file permissions, or
+  the plugin failed to negotiate the initial go-plugin protocol handshake
+%s`
+
+// CmdRunner implements the runner.Runner interface. It mostly just passes through
+// to exec.Cmd methods.
+type CmdRunner struct {
+	logger hclog.Logger
+	cmd    *exec.Cmd
+
+	stdout io.ReadCloser
+	stderr io.ReadCloser
+
+	// Cmd info is persisted early, since the process information will be removed
+	// after Kill is called.
+	path string
+	pid  int
+
+	addrTranslator
+}
+
+// NewCmdRunner returns an implementation of runner.Runner for running a plugin
+// as a subprocess. It must be passed a cmd that hasn't yet been started.
+func NewCmdRunner(logger hclog.Logger, cmd *exec.Cmd) (*CmdRunner, error) {
+	stdout, err := cmd.StdoutPipe()
+	if err != nil {
+		return nil, err
+	}
+
+	stderr, err := cmd.StderrPipe()
+	if err != nil {
+		return nil, err
+	}
+
+	return &CmdRunner{
+		logger: logger,
+		cmd:    cmd,
+		stdout: stdout,
+		stderr: stderr,
+		path:   cmd.Path,
+	}, nil
+}
+
+func (c *CmdRunner) Start(_ context.Context) error {
+	c.logger.Debug("starting plugin", "path", c.cmd.Path, "args", c.cmd.Args)
+	err := c.cmd.Start()
+	if err != nil {
+		return err
+	}
+
+	c.pid = c.cmd.Process.Pid
+	c.logger.Debug("plugin started", "path", c.path, "pid", c.pid)
+	return nil
+}
+
+func (c *CmdRunner) Wait(_ context.Context) error {
+	return c.cmd.Wait()
+}
+
+func (c *CmdRunner) Kill(_ context.Context) error {
+	if c.cmd.Process != nil {
+		err := c.cmd.Process.Kill()
+		// Swallow ErrProcessDone, we support calling Kill multiple times.
+		if !errors.Is(err, os.ErrProcessDone) {
+			return err
+		}
+		return nil
+	}
+
+	return nil
+}
+
+func (c *CmdRunner) Stdout() io.ReadCloser {
+	return c.stdout
+}
+
+func (c *CmdRunner) Stderr() io.ReadCloser {
+	return c.stderr
+}
+
+func (c *CmdRunner) Name() string {
+	return c.path
+}
+
+func (c *CmdRunner) ID() string {
+	return fmt.Sprintf("%d", c.pid)
+}
+
+// peTypes is a list of Portable Executable (PE) machine types from https://learn.microsoft.com/en-us/windows/win32/debug/pe-format
+// mapped to GOARCH types. It is not comprehensive, and only includes machine types that Go supports.
+var peTypes = map[uint16]string{
+	0x14c:  "386",
+	0x1c0:  "arm",
+	0x6264: "loong64",
+	0x8664: "amd64",
+	0xaa64: "arm64",
+}
+
+func (c *CmdRunner) Diagnose(_ context.Context) string {
+	return fmt.Sprintf(unrecognizedRemotePluginMessage, additionalNotesAboutCommand(c.cmd.Path))
+}
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/notes_unix.go b/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/internal/cmdrunner/notes_unix.go
similarity index 92%
rename from .ci/providerlint/vendor/github.com/hashicorp/go-plugin/notes_unix.go
rename to .ci/providerlint/vendor/github.com/hashicorp/go-plugin/internal/cmdrunner/notes_unix.go
index dae1c411dec..ce04cfebc67 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/notes_unix.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/internal/cmdrunner/notes_unix.go
@@ -1,7 +1,10 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:build !windows
 // +build !windows
 
-package plugin
+package cmdrunner
 
 import (
 	"debug/elf"
@@ -50,10 +53,13 @@ func additionalNotesAboutCommand(path string) string {
 	}
 
 	if elfFile, err := elf.Open(path); err == nil {
+		defer elfFile.Close()
 		notes += fmt.Sprintf("  ELF architecture: %s (current architecture: %s)\n", elfFile.Machine, runtime.GOARCH)
 	} else if machoFile, err := macho.Open(path); err == nil {
+		defer machoFile.Close()
 		notes += fmt.Sprintf("  MachO architecture: %s (current architecture: %s)\n", machoFile.Cpu, runtime.GOARCH)
 	} else if peFile, err := pe.Open(path); err == nil {
+		defer peFile.Close()
 		machine, ok := peTypes[peFile.Machine]
 		if !ok {
 			machine = "unknown"
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/notes_windows.go b/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/internal/cmdrunner/notes_windows.go
similarity index 87%
rename from .ci/providerlint/vendor/github.com/hashicorp/go-plugin/notes_windows.go
rename to .ci/providerlint/vendor/github.com/hashicorp/go-plugin/internal/cmdrunner/notes_windows.go
index 900b93319c1..39c51dd1e08 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/notes_windows.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/internal/cmdrunner/notes_windows.go
@@ -1,7 +1,10 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:build windows
 // +build windows
 
-package plugin
+package cmdrunner
 
 import (
 	"debug/elf"
@@ -26,10 +29,13 @@ func additionalNotesAboutCommand(path string) string {
 	notes += fmt.Sprintf("  Mode: %s\n", stat.Mode())
 
 	if elfFile, err := elf.Open(path); err == nil {
+		defer elfFile.Close()
 		notes += fmt.Sprintf("  ELF architecture: %s (current architecture: %s)\n", elfFile.Machine, runtime.GOARCH)
 	} else if machoFile, err := macho.Open(path); err == nil {
+		defer machoFile.Close()
 		notes += fmt.Sprintf("  MachO architecture: %s (current architecture: %s)\n", machoFile.Cpu, runtime.GOARCH)
 	} else if peFile, err := pe.Open(path); err == nil {
+		defer peFile.Close()
 		machine, ok := peTypes[peFile.Machine]
 		if !ok {
 			machine = "unknown"
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/internal/cmdrunner/process.go b/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/internal/cmdrunner/process.go
new file mode 100644
index 00000000000..6c34dc7747f
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/internal/cmdrunner/process.go
@@ -0,0 +1,25 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package cmdrunner
+
+import "time"
+
+// pidAlive checks whether a pid is alive.
+func pidAlive(pid int) bool {
+	return _pidAlive(pid)
+}
+
+// pidWait blocks for a process to exit.
+func pidWait(pid int) error {
+	ticker := time.NewTicker(1 * time.Second)
+	defer ticker.Stop()
+
+	for range ticker.C {
+		if !pidAlive(pid) {
+			break
+		}
+	}
+
+	return nil
+}
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/process_posix.go b/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/internal/cmdrunner/process_posix.go
similarity index 79%
rename from .ci/providerlint/vendor/github.com/hashicorp/go-plugin/process_posix.go
rename to .ci/providerlint/vendor/github.com/hashicorp/go-plugin/internal/cmdrunner/process_posix.go
index 185957f8d11..bf3fc5b683e 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/process_posix.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/internal/cmdrunner/process_posix.go
@@ -1,7 +1,10 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:build !windows
 // +build !windows
 
-package plugin
+package cmdrunner
 
 import (
 	"os"
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/process_windows.go b/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/internal/cmdrunner/process_windows.go
similarity index 86%
rename from .ci/providerlint/vendor/github.com/hashicorp/go-plugin/process_windows.go
rename to .ci/providerlint/vendor/github.com/hashicorp/go-plugin/internal/cmdrunner/process_windows.go
index 0eaa7705d22..6c39df28f7e 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/process_windows.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/internal/cmdrunner/process_windows.go
@@ -1,4 +1,7 @@
-package plugin
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package cmdrunner
 
 import (
 	"syscall"
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/internal/plugin/gen.go b/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/internal/plugin/gen.go
index fb9d415254f..a3b5fb124e0 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/internal/plugin/gen.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/internal/plugin/gen.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate protoc -I ./ ./grpc_broker.proto ./grpc_controller.proto ./grpc_stdio.proto --go_out=plugins=grpc:.
 
 package plugin
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/internal/plugin/grpc_broker.pb.go b/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/internal/plugin/grpc_broker.pb.go
index 6bf103859f8..303b63e43b1 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/internal/plugin/grpc_broker.pb.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/internal/plugin/grpc_broker.pb.go
@@ -8,7 +8,7 @@ import fmt "fmt"
 import math "math"
 
 import (
-	context "golang.org/x/net/context"
+	context "context"
 	grpc "google.golang.org/grpc"
 )
 
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/internal/plugin/grpc_broker.proto b/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/internal/plugin/grpc_broker.proto
index aa3df4630a7..038423ded7a 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/internal/plugin/grpc_broker.proto
+++ b/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/internal/plugin/grpc_broker.proto
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 syntax = "proto3";
 package plugin;
 option go_package = "plugin";
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/internal/plugin/grpc_controller.pb.go b/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/internal/plugin/grpc_controller.pb.go
index 3e39da95a89..982fca0a574 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/internal/plugin/grpc_controller.pb.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/internal/plugin/grpc_controller.pb.go
@@ -8,7 +8,7 @@ import fmt "fmt"
 import math "math"
 
 import (
-	context "golang.org/x/net/context"
+	context "context"
 	grpc "google.golang.org/grpc"
 )
 
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/internal/plugin/grpc_controller.proto b/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/internal/plugin/grpc_controller.proto
index 345d0a1c1f2..3157eb885de 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/internal/plugin/grpc_controller.proto
+++ b/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/internal/plugin/grpc_controller.proto
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 syntax = "proto3";
 package plugin;
 option go_package = "plugin";
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/internal/plugin/grpc_stdio.pb.go b/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/internal/plugin/grpc_stdio.pb.go
index c8f94921b46..bdef71b8aa0 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/internal/plugin/grpc_stdio.pb.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/internal/plugin/grpc_stdio.pb.go
@@ -9,7 +9,7 @@ import math "math"
 import empty "github.com/golang/protobuf/ptypes/empty"
 
 import (
-	context "golang.org/x/net/context"
+	context "context"
 	grpc "google.golang.org/grpc"
 )
 
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/internal/plugin/grpc_stdio.proto b/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/internal/plugin/grpc_stdio.proto
index ce1a1223035..1c0d1d0526a 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/internal/plugin/grpc_stdio.proto
+++ b/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/internal/plugin/grpc_stdio.proto
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 syntax = "proto3";
 package plugin;
 option go_package = "plugin";
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/log_entry.go b/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/log_entry.go
index fb2ef930caa..ab963d56b54 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/log_entry.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/log_entry.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package plugin
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/mtls.go b/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/mtls.go
index 88955245877..09ecafaf45a 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/mtls.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/mtls.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package plugin
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/mux_broker.go b/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/mux_broker.go
index 01c45ad7c68..4eb1208fbb7 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/mux_broker.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/mux_broker.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package plugin
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/plugin.go b/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/plugin.go
index 79d9674633a..184749b96ef 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/plugin.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/plugin.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 // The plugin package exposes functions and helpers for communicating to
 // plugins which are implemented as standalone binary applications.
 //
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/process.go b/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/process.go
index 88c999a580d..b88446361da 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/process.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/process.go
@@ -1,24 +1,4 @@
-package plugin
-
-import (
-	"time"
-)
-
-// pidAlive checks whether a pid is alive.
-func pidAlive(pid int) bool {
-	return _pidAlive(pid)
-}
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
-// pidWait blocks for a process to exit.
-func pidWait(pid int) error {
-	ticker := time.NewTicker(1 * time.Second)
-	defer ticker.Stop()
-
-	for range ticker.C {
-		if !pidAlive(pid) {
-			break
-		}
-	}
-
-	return nil
-}
+package plugin
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/protocol.go b/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/protocol.go
index 0cfc19e52d6..e4b7be38378 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/protocol.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/protocol.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package plugin
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/rpc_client.go b/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/rpc_client.go
index f30a4b1d387..142454df80d 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/rpc_client.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/rpc_client.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package plugin
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/rpc_server.go b/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/rpc_server.go
index 064809d2918..cec0a3d93a2 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/rpc_server.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/rpc_server.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package plugin
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/runner/runner.go b/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/runner/runner.go
new file mode 100644
index 00000000000..e638ae5f8ee
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/runner/runner.go
@@ -0,0 +1,72 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package runner
+
+import (
+	"context"
+	"io"
+)
+
+// Runner defines the interface required by go-plugin to manage the lifecycle of
+// of a plugin and attempt to negotiate a connection with it. Note that this
+// is orthogonal to the protocol and transport used, which is negotiated over stdout.
+type Runner interface {
+	// Start should start the plugin and ensure any work required for servicing
+	// other interface methods is done. If the context is cancelled, it should
+	// only abort any attempts to _start_ the plugin. Waiting and shutdown are
+	// handled separately.
+	Start(ctx context.Context) error
+
+	// Diagnose makes a best-effort attempt to return any debug information that
+	// might help users understand why a plugin failed to start and negotiate a
+	// connection.
+	Diagnose(ctx context.Context) string
+
+	// Stdout is used to negotiate the go-plugin protocol.
+	Stdout() io.ReadCloser
+
+	// Stderr is used for forwarding plugin logs to the host process logger.
+	Stderr() io.ReadCloser
+
+	// Name is a human-friendly name for the plugin, such as the path to the
+	// executable. It does not have to be unique.
+	Name() string
+
+	AttachedRunner
+}
+
+// AttachedRunner defines a limited subset of Runner's interface to represent the
+// reduced responsibility for plugin lifecycle when attaching to an already running
+// plugin.
+type AttachedRunner interface {
+	// Wait should wait until the plugin stops running, whether in response to
+	// an out of band signal or in response to calling Kill().
+	Wait(ctx context.Context) error
+
+	// Kill should stop the plugin and perform any cleanup required.
+	Kill(ctx context.Context) error
+
+	// ID is a unique identifier to represent the running plugin. e.g. pid or
+	// container ID.
+	ID() string
+
+	AddrTranslator
+}
+
+// AddrTranslator translates addresses between the execution context of the host
+// process and the plugin. For example, if the plugin is in a container, the file
+// path for a Unix socket may be different between the host and the container.
+//
+// It is only intended to be used by the host process.
+type AddrTranslator interface {
+	// Called before connecting on any addresses received back from the plugin.
+	PluginToHost(pluginNet, pluginAddr string) (hostNet string, hostAddr string, err error)
+
+	// Called on any host process addresses before they are sent to the plugin.
+	HostToPlugin(hostNet, hostAddr string) (pluginNet string, pluginAddr string, err error)
+}
+
+// ReattachFunc can be passed to a client's reattach config to reattach to an
+// already running plugin instead of starting it ourselves.
+type ReattachFunc func() (AttachedRunner, error)
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/server.go b/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/server.go
index e134999103f..4b0f2b76919 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/server.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/server.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package plugin
 
 import (
@@ -8,10 +11,10 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"net"
 	"os"
 	"os/signal"
+	"os/user"
 	"runtime"
 	"sort"
 	"strconv"
@@ -270,7 +273,7 @@ func Serve(opts *ServeConfig) {
 	}
 
 	// Register a listener so we can accept a connection
-	listener, err := serverListener()
+	listener, err := serverListener(unixSocketConfigFromEnv())
 	if err != nil {
 		logger.Error("plugin init error", "error", err)
 		return
@@ -493,12 +496,12 @@ func Serve(opts *ServeConfig) {
 	}
 }
 
-func serverListener() (net.Listener, error) {
+func serverListener(unixSocketCfg UnixSocketConfig) (net.Listener, error) {
 	if runtime.GOOS == "windows" {
 		return serverListener_tcp()
 	}
 
-	return serverListener_unix()
+	return serverListener_unix(unixSocketCfg)
 }
 
 func serverListener_tcp() (net.Listener, error) {
@@ -543,8 +546,8 @@ func serverListener_tcp() (net.Listener, error) {
 	return nil, errors.New("Couldn't bind plugin TCP listener")
 }
 
-func serverListener_unix() (net.Listener, error) {
-	tf, err := ioutil.TempFile("", "plugin")
+func serverListener_unix(unixSocketCfg UnixSocketConfig) (net.Listener, error) {
+	tf, err := os.CreateTemp(unixSocketCfg.directory, "plugin")
 	if err != nil {
 		return nil, err
 	}
@@ -564,6 +567,15 @@ func serverListener_unix() (net.Listener, error) {
 		return nil, err
 	}
 
+	// By default, unix sockets are only writable by the owner. Set up a custom
+	// group owner and group write permissions if configured.
+	if unixSocketCfg.Group != "" {
+		err = setGroupWritable(path, unixSocketCfg.Group, 0o660)
+		if err != nil {
+			return nil, err
+		}
+	}
+
 	// Wrap the listener in rmListener so that the Unix domain socket file
 	// is removed on close.
 	return &rmListener{
@@ -572,6 +584,32 @@ func serverListener_unix() (net.Listener, error) {
 	}, nil
 }
 
+func setGroupWritable(path, groupString string, mode os.FileMode) error {
+	groupID, err := strconv.Atoi(groupString)
+	if err != nil {
+		group, err := user.LookupGroup(groupString)
+		if err != nil {
+			return fmt.Errorf("failed to find gid from %q: %w", groupString, err)
+		}
+		groupID, err = strconv.Atoi(group.Gid)
+		if err != nil {
+			return fmt.Errorf("failed to parse %q group's gid as an integer: %w", groupString, err)
+		}
+	}
+
+	err = os.Chown(path, -1, groupID)
+	if err != nil {
+		return err
+	}
+
+	err = os.Chmod(path, mode)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
 // rmListener is an implementation of net.Listener that forwards most
 // calls to the listener but also removes a file as part of the close. We
 // use this to cleanup the unix domain socket on close.
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/server_mux.go b/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/server_mux.go
index 033079ea0fc..6b14b0c291d 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/server_mux.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/server_mux.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package plugin
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/stream.go b/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/stream.go
index 1d547aaaab3..a2348642d86 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/stream.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/stream.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package plugin
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/testing.go b/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/testing.go
index e36f2eb2b7c..ae48b7a37eb 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/testing.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/go-plugin/testing.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package plugin
 
 import (
@@ -163,7 +166,7 @@ func TestPluginGRPCConn(t testing.T, ps map[string]Plugin) (*GRPCClient, *GRPCSe
 	}
 
 	brokerGRPCClient := newGRPCBrokerClient(conn)
-	broker := newGRPCBroker(brokerGRPCClient, nil)
+	broker := newGRPCBroker(brokerGRPCClient, nil, UnixSocketConfig{}, nil)
 	go broker.Run()
 	go brokerGRPCClient.StartStream()
 
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/hc-install/.copywrite.hcl b/.ci/providerlint/vendor/github.com/hashicorp/hc-install/.copywrite.hcl
new file mode 100644
index 00000000000..45ec82c768d
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/hashicorp/hc-install/.copywrite.hcl
@@ -0,0 +1,7 @@
+schema_version = 1
+
+project {
+  license        = "MPL-2.0"
+  copyright_year = 2020
+  header_ignore  = []
+}
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/hc-install/.go-version b/.ci/providerlint/vendor/github.com/hashicorp/hc-install/.go-version
index 83d5e73f00e..5fb5a6b4f54 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/hc-install/.go-version
+++ b/.ci/providerlint/vendor/github.com/hashicorp/hc-install/.go-version
@@ -1 +1 @@
-1.19.5
+1.20
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/hc-install/README.md b/.ci/providerlint/vendor/github.com/hashicorp/hc-install/README.md
index eb287ff0fc7..6e78b5a610a 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/hc-install/README.md
+++ b/.ci/providerlint/vendor/github.com/hashicorp/hc-install/README.md
@@ -41,16 +41,17 @@ Each comes with different trade-offs described below.
  - `releases.{LatestVersion,ExactVersion}` - Downloads, verifies & installs any known product from `releases.hashicorp.com`
    - **Pros:**
      - Fast and reliable way of obtaining any pre-built version of any product
+     - Allows installation of enterprise versions
    - **Cons:**
-     - Installation may consume some bandwith, disk space and a little time
+     - Installation may consume some bandwidth, disk space and a little time
      - Potentially less stable builds (see `checkpoint` below)
- - `checkpoint.{LatestVersion}` - Downloads, verifies & installs any known product available in HashiCorp Checkpoint
+ - `checkpoint.LatestVersion` - Downloads, verifies & installs any known product available in HashiCorp Checkpoint
    - **Pros:**
      - Checkpoint typically contains only product versions considered stable
    - **Cons:**
-     - Installation may consume some bandwith, disk space and a little time
-     - Currently doesn't allow installation of a old versions (see `releases` above)
- - `build.{GitRevision}` - Clones raw source code and builds the product from it
+     - Installation may consume some bandwidth, disk space and a little time
+     - Currently doesn't allow installation of old versions or enterprise versions (see `releases` above)
+ - `build.GitRevision` - Clones raw source code and builds the product from it
    - **Pros:**
      - Useful for catching bugs and incompatibilities as early as possible (prior to product release).
    - **Cons:**
@@ -61,73 +62,59 @@ Each comes with different trade-offs described below.
 
 ## Example Usage
 
-### Install single version
+See examples at https://pkg.go.dev/github.com/hashicorp/hc-install#example-Installer.
 
-```go
-TODO
-```
+## CLI
+
+In addition to the Go library, which is the intended primary use case of `hc-install`, we also distribute CLI.
+
+The CLI comes with some trade-offs:
 
-### Find or install single version
+ - more limited interface compared to the flexible Go API (installs specific versions of products via `releases.ExactVersion`)
+ - minimal environment pre-requisites (no need to compile Go code)
+ - see ["hc-install is not a package manager"](https://github.com/hashicorp/hc-install#hc-install-is-not-a-package-manager)
 
-```go
-i := NewInstaller()
+### Installation
 
-v0_14_0 := version.Must(version.NewVersion("0.14.0"))
+Given that one of the key roles of the CLI/library is integrity checking, you should choose the installation method which involves the same level of integrity checks, and/or perform these checks yourself. `go install` provides only minimal to no integrity checks, depending on exact use. We recommend any of the installation methods documented below.
 
-execPath, err := i.Ensure(context.Background(), []src.Source{
-  &fs.ExactVersion{
-    Product: product.Terraform,
-    Version: v0_14_0,
-  },
-  &releases.ExactVersion{
-    Product: product.Terraform,
-    Version: v0_14_0,
-  },
-})
-if err != nil {
-  // process err
-}
+#### Homebrew (macOS / Linux)
 
-// run any tests
+[Homebrew](https://brew.sh)
 
-defer i.Remove()
 ```
+brew install hashicorp/tap/hc-install
+```
+
+#### Linux
+
+We support Debian & Ubuntu via apt and RHEL, CentOS, Fedora and Amazon Linux via RPM.
 
-### Install multiple versions
+You can follow the instructions in the [Official Packaging Guide](https://www.hashicorp.com/official-packaging-guide) to install the package from the official HashiCorp-maintained repositories. The package name is `hc-install` in all repositories.
+
+#### Other platforms
+
+1. [Download for the latest version](https://releases.hashicorp.com/hc-install/) relevant for your operating system and architecture.
+2. Verify integrity by comparing the SHA256 checksums which are part of the release (called `hc-install_<VERSION>_SHA256SUMS`).
+3. Install it by unzipping it and moving it to a directory included in your system's `PATH`.
+4. Check that you have installed it correctly via `hc-install --version`.
+  You should see the latest version printed to your terminal.
+
+### Usage
 
-```go
-TODO
 ```
+Usage: hc-install install [options] -version <version> <product>
 
-### Install and build multiple versions
-
-```go
-i := NewInstaller()
-
-vc, _ := version.NewConstraint(">= 0.12")
-rv := &releases.Versions{
-  Product:     product.Terraform,
-  Constraints: vc,
-}
-
-versions, err := rv.List(context.Background())
-if err != nil {
-  return err
-}
-versions = append(versions, &build.GitRevision{Ref: "HEAD"})
-
-for _, installableVersion := range versions {
-  execPath, err := i.Ensure(context.Background(), []src.Source{
-    installableVersion,
-  })
-  if err != nil {
-    return err
-  }
-
-  // Do some testing here
-  _ = execPath
-
-  // clean up
-  os.Remove(execPath)
-}
+  This command installs a HashiCorp product.
+  Options:
+    -version  [REQUIRED] Version of product to install.
+    -path     Path to directory where the product will be installed. Defaults
+              to current working directory.
+```
+```sh
+hc-install install -version 1.3.7 terraform
+```
+```
+hc-install: will install terraform@1.3.7
+installed terraform@1.3.7 to /current/working/dir/terraform
 ```
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/hc-install/checkpoint/latest_version.go b/.ci/providerlint/vendor/github.com/hashicorp/hc-install/checkpoint/latest_version.go
index 2d52b339f97..2cd5379fb8e 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/hc-install/checkpoint/latest_version.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/hc-install/checkpoint/latest_version.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package checkpoint
 
 import (
@@ -123,7 +126,7 @@ func (lv *LatestVersion) Install(ctx context.Context) (string, error) {
 	if lv.ArmoredPublicKey != "" {
 		d.ArmoredPublicKey = lv.ArmoredPublicKey
 	}
-	zipFilePath, err := d.DownloadAndUnpack(ctx, pv, dstDir)
+	zipFilePath, err := d.DownloadAndUnpack(ctx, pv, dstDir, "")
 	if zipFilePath != "" {
 		lv.pathsToRemove = append(lv.pathsToRemove, zipFilePath)
 	}
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/hc-install/errors/errors.go b/.ci/providerlint/vendor/github.com/hashicorp/hc-install/errors/errors.go
index 8d4f1d22d87..15d51b60263 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/hc-install/errors/errors.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/hc-install/errors/errors.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package errors
 
 type skippableErr struct {
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/hc-install/fs/any_version.go b/.ci/providerlint/vendor/github.com/hashicorp/hc-install/fs/any_version.go
index fc1f9463403..8071dfcf52c 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/hc-install/fs/any_version.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/hc-install/fs/any_version.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package fs
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/hc-install/fs/exact_version.go b/.ci/providerlint/vendor/github.com/hashicorp/hc-install/fs/exact_version.go
index 018c1fbadcb..c3cc49bfc91 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/hc-install/fs/exact_version.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/hc-install/fs/exact_version.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package fs
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/hc-install/fs/fs.go b/.ci/providerlint/vendor/github.com/hashicorp/hc-install/fs/fs.go
index 5adb9c329c2..216df2c2cdc 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/hc-install/fs/fs.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/hc-install/fs/fs.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package fs
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/hc-install/fs/fs_unix.go b/.ci/providerlint/vendor/github.com/hashicorp/hc-install/fs/fs_unix.go
index 95c5c11f1d9..eebd98b82c0 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/hc-install/fs/fs_unix.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/hc-install/fs/fs_unix.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:build !windows
 // +build !windows
 
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/hc-install/fs/fs_windows.go b/.ci/providerlint/vendor/github.com/hashicorp/hc-install/fs/fs_windows.go
index 2a03c7ad2f2..e2e4e73fb19 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/hc-install/fs/fs_windows.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/hc-install/fs/fs_windows.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package fs
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/hc-install/fs/version.go b/.ci/providerlint/vendor/github.com/hashicorp/hc-install/fs/version.go
index 26633b8afc8..39efb52d9fa 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/hc-install/fs/version.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/hc-install/fs/version.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package fs
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/hc-install/installer.go b/.ci/providerlint/vendor/github.com/hashicorp/hc-install/installer.go
index 8b773c56db0..6c704eede3d 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/hc-install/installer.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/hc-install/installer.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package install
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/hc-install/internal/build/get_go_version.go b/.ci/providerlint/vendor/github.com/hashicorp/hc-install/internal/build/get_go_version.go
index 3a929859ac1..858f8ab2974 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/hc-install/internal/build/get_go_version.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/hc-install/internal/build/get_go_version.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package build
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/hc-install/internal/build/go_build.go b/.ci/providerlint/vendor/github.com/hashicorp/hc-install/internal/build/go_build.go
index 9581c322cc2..504bf45a305 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/hc-install/internal/build/go_build.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/hc-install/internal/build/go_build.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package build
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/hc-install/internal/build/go_is_installed.go b/.ci/providerlint/vendor/github.com/hashicorp/hc-install/internal/build/go_is_installed.go
index 6a81d196b68..00165fff5cb 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/hc-install/internal/build/go_is_installed.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/hc-install/internal/build/go_is_installed.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package build
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/hc-install/internal/build/install_go_version.go b/.ci/providerlint/vendor/github.com/hashicorp/hc-install/internal/build/install_go_version.go
index a6610e076f6..9dc070d7957 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/hc-install/internal/build/install_go_version.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/hc-install/internal/build/install_go_version.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package build
 
 import (
@@ -10,14 +13,21 @@ import (
 	"github.com/hashicorp/go-version"
 )
 
+var v1_21 = version.Must(version.NewVersion("1.21"))
+
 // installGoVersion installs given version of Go using Go
 // according to https://golang.org/doc/manage-install
 func (gb *GoBuild) installGoVersion(ctx context.Context, v *version.Version) (Go, error) {
-	versionString := v.Core().String()
+	goVersion := v.String()
 
-	// trim 0 patch versions as that's how Go does it :shrug:
-	shortVersion := strings.TrimSuffix(versionString, ".0")
-	pkgURL := fmt.Sprintf("golang.org/dl/go%s", shortVersion)
+	// trim 0 patch versions as that's how Go does it
+	// for versions prior to 1.21
+	// See https://github.com/golang/go/issues/62136
+	if v.LessThan(v1_21) {
+		versionString := v.Core().String()
+		goVersion = strings.TrimSuffix(versionString, ".0")
+	}
+	pkgURL := fmt.Sprintf("golang.org/dl/go%s", goVersion)
 
 	gb.log().Printf("go getting %q", pkgURL)
 	cmd := exec.CommandContext(ctx, "go", "get", pkgURL)
@@ -33,7 +43,7 @@ func (gb *GoBuild) installGoVersion(ctx context.Context, v *version.Version) (Go
 		return Go{}, fmt.Errorf("unable to install Go %s: %w\n%s", v, err, out)
 	}
 
-	cmdName := fmt.Sprintf("go%s", shortVersion)
+	cmdName := fmt.Sprintf("go%s", goVersion)
 
 	gb.log().Printf("downloading go %q", v)
 	cmd = exec.CommandContext(ctx, cmdName, "download")
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/hc-install/internal/httpclient/httpclient.go b/.ci/providerlint/vendor/github.com/hashicorp/hc-install/internal/httpclient/httpclient.go
index 0ae6ae4af86..a9503dfdb88 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/hc-install/internal/httpclient/httpclient.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/hc-install/internal/httpclient/httpclient.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package httpclient
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/hc-install/internal/pubkey/pubkey.go b/.ci/providerlint/vendor/github.com/hashicorp/hc-install/internal/pubkey/pubkey.go
index c36fba47166..d06f1045063 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/hc-install/internal/pubkey/pubkey.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/hc-install/internal/pubkey/pubkey.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package pubkey
 
 const (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/hc-install/internal/releasesjson/checksum_downloader.go b/.ci/providerlint/vendor/github.com/hashicorp/hc-install/internal/releasesjson/checksum_downloader.go
index c012a20aab1..843de8cdfad 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/hc-install/internal/releasesjson/checksum_downloader.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/hc-install/internal/releasesjson/checksum_downloader.go
@@ -1,7 +1,9 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package releasesjson
 
 import (
-	"bytes"
 	"context"
 	"crypto/sha256"
 	"encoding/hex"
@@ -12,8 +14,8 @@ import (
 	"net/url"
 	"strings"
 
+	"github.com/ProtonMail/go-crypto/openpgp"
 	"github.com/hashicorp/hc-install/internal/httpclient"
-	"golang.org/x/crypto/openpgp"
 )
 
 type ChecksumDownloader struct {
@@ -133,43 +135,13 @@ func fileMapFromChecksums(checksums strings.Builder) (ChecksumFileMap, error) {
 	return csMap, nil
 }
 
-func compareChecksum(logger *log.Logger, r io.Reader, verifiedHashSum HashSum, filename string, expectedSize int64) error {
-	h := sha256.New()
-
-	// This may take a while depending on network connection as the io.Reader
-	// is expected to be http.Response.Body which streams the bytes
-	// on demand over the network.
-	logger.Printf("copying %q (%d bytes) to calculate checksum", filename, expectedSize)
-	bytesCopied, err := io.Copy(h, r)
-	if err != nil {
-		return err
-	}
-	logger.Printf("copied %d bytes of %q", bytesCopied, filename)
-
-	if expectedSize != 0 && bytesCopied != int64(expectedSize) {
-		return fmt.Errorf("unexpected size (downloaded: %d, expected: %d)",
-			bytesCopied, expectedSize)
-	}
-
-	calculatedSum := h.Sum(nil)
-	if !bytes.Equal(calculatedSum, verifiedHashSum) {
-		return fmt.Errorf("checksum mismatch (expected %q, calculated %q)",
-			verifiedHashSum,
-			hex.EncodeToString(calculatedSum))
-	}
-
-	logger.Printf("checksum matches: %q", hex.EncodeToString(calculatedSum))
-
-	return nil
-}
-
 func (cd *ChecksumDownloader) verifySumsSignature(checksums, signature io.Reader) error {
 	el, err := cd.keyEntityList()
 	if err != nil {
 		return err
 	}
 
-	_, err = openpgp.CheckDetachedSignature(el, checksums, signature)
+	_, err = openpgp.CheckDetachedSignature(el, checksums, signature, nil)
 	if err != nil {
 		return fmt.Errorf("unable to verify checksums signature: %w", err)
 	}
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/hc-install/internal/releasesjson/downloader.go b/.ci/providerlint/vendor/github.com/hashicorp/hc-install/internal/releasesjson/downloader.go
index 8b2097d7615..146c1cf029f 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/hc-install/internal/releasesjson/downloader.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/hc-install/internal/releasesjson/downloader.go
@@ -1,9 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package releasesjson
 
 import (
 	"archive/zip"
 	"bytes"
 	"context"
+	"crypto/sha256"
 	"fmt"
 	"io"
 	"io/ioutil"
@@ -25,7 +29,7 @@ type Downloader struct {
 	BaseURL          string
 }
 
-func (d *Downloader) DownloadAndUnpack(ctx context.Context, pv *ProductVersion, dstDir string) (zipFilePath string, err error) {
+func (d *Downloader) DownloadAndUnpack(ctx context.Context, pv *ProductVersion, binDir string, licenseDir string) (zipFilePath string, err error) {
 	if len(pv.Builds) == 0 {
 		return "", fmt.Errorf("no builds found for %s %s", pv.Name, pv.Version)
 	}
@@ -92,8 +96,7 @@ func (d *Downloader) DownloadAndUnpack(ctx context.Context, pv *ProductVersion,
 
 	defer resp.Body.Close()
 
-	var pkgReader io.Reader
-	pkgReader = resp.Body
+	pkgReader := resp.Body
 
 	contentType := resp.Header.Get("content-type")
 	if !contentTypeIsZip(contentType) {
@@ -103,19 +106,6 @@ func (d *Downloader) DownloadAndUnpack(ctx context.Context, pv *ProductVersion,
 
 	expectedSize := resp.ContentLength
 
-	if d.VerifyChecksum {
-		d.Logger.Printf("verifying checksum of %q", pb.Filename)
-		// provide extra reader to calculate & compare checksum
-		var buf bytes.Buffer
-		r := io.TeeReader(resp.Body, &buf)
-		pkgReader = &buf
-
-		err := compareChecksum(d.Logger, r, verifiedChecksum, pb.Filename, expectedSize)
-		if err != nil {
-			return "", err
-		}
-	}
-
 	pkgFile, err := ioutil.TempFile("", pb.Filename)
 	if err != nil {
 		return "", err
@@ -124,19 +114,39 @@ func (d *Downloader) DownloadAndUnpack(ctx context.Context, pv *ProductVersion,
 	pkgFilePath, err := filepath.Abs(pkgFile.Name())
 
 	d.Logger.Printf("copying %q (%d bytes) to %s", pb.Filename, expectedSize, pkgFile.Name())
-	// Unless the bytes were already downloaded above for checksum verification
-	// this may take a while depending on network connection as the io.Reader
-	// is expected to be http.Response.Body which streams the bytes
-	// on demand over the network.
-	bytesCopied, err := io.Copy(pkgFile, pkgReader)
-	if err != nil {
-		return pkgFilePath, err
+
+	var bytesCopied int64
+	if d.VerifyChecksum {
+		d.Logger.Printf("verifying checksum of %q", pb.Filename)
+		h := sha256.New()
+		r := io.TeeReader(resp.Body, pkgFile)
+
+		bytesCopied, err = io.Copy(h, r)
+		if err != nil {
+			return "", err
+		}
+
+		calculatedSum := h.Sum(nil)
+		if !bytes.Equal(calculatedSum, verifiedChecksum) {
+			return pkgFilePath, fmt.Errorf(
+				"checksum mismatch (expected: %x, got: %x)",
+				verifiedChecksum, calculatedSum,
+			)
+		}
+	} else {
+		bytesCopied, err = io.Copy(pkgFile, pkgReader)
+		if err != nil {
+			return pkgFilePath, err
+		}
 	}
+
 	d.Logger.Printf("copied %d bytes to %s", bytesCopied, pkgFile.Name())
 
 	if expectedSize != 0 && bytesCopied != int64(expectedSize) {
-		return pkgFilePath, fmt.Errorf("unexpected size (downloaded: %d, expected: %d)",
-			bytesCopied, expectedSize)
+		return pkgFilePath, fmt.Errorf(
+			"unexpected size (downloaded: %d, expected: %d)",
+			bytesCopied, expectedSize,
+		)
 	}
 
 	r, err := zip.OpenReader(pkgFile.Name())
@@ -156,6 +166,12 @@ func (d *Downloader) DownloadAndUnpack(ctx context.Context, pv *ProductVersion,
 			return pkgFilePath, err
 		}
 
+		// Determine the appropriate destination file path
+		dstDir := binDir
+		if isLicenseFile(f.Name) && licenseDir != "" {
+			dstDir = licenseDir
+		}
+
 		d.Logger.Printf("unpacking %s to %s", f.Name, dstDir)
 		dstPath := filepath.Join(dstDir, f.Name)
 		dstFile, err := os.Create(dstPath)
@@ -190,3 +206,19 @@ func contentTypeIsZip(contentType string) bool {
 	}
 	return false
 }
+
+// Enterprise products have a few additional license files
+// that need to be extracted to a separate directory
+var licenseFiles = []string{
+	"EULA.txt",
+	"TermsOfEvaluation.txt",
+}
+
+func isLicenseFile(filename string) bool {
+	for _, lf := range licenseFiles {
+		if lf == filename {
+			return true
+		}
+	}
+	return false
+}
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/hc-install/internal/releasesjson/product_version.go b/.ci/providerlint/vendor/github.com/hashicorp/hc-install/internal/releasesjson/product_version.go
index 5eecb013647..99b811a6458 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/hc-install/internal/releasesjson/product_version.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/hc-install/internal/releasesjson/product_version.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package releasesjson
 
 import "github.com/hashicorp/go-version"
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/hc-install/internal/releasesjson/releases.go b/.ci/providerlint/vendor/github.com/hashicorp/hc-install/internal/releasesjson/releases.go
index b100a8d2b57..755019f2f25 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/hc-install/internal/releasesjson/releases.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/hc-install/internal/releasesjson/releases.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package releasesjson
 
 import (
@@ -112,13 +115,6 @@ func (r *Releases) ListProductVersions(ctx context.Context, productName string)
 			continue
 		}
 
-		if ok, _ := versionIsSupported(v); !ok {
-			// Remove (currently unsupported) enterprise
-			// version and any other "custom" build
-			delete(p.Versions, rawVersion)
-			continue
-		}
-
 		p.Versions[rawVersion].Version = v
 	}
 
@@ -126,10 +122,6 @@ func (r *Releases) ListProductVersions(ctx context.Context, productName string)
 }
 
 func (r *Releases) GetProductVersion(ctx context.Context, product string, version *version.Version) (*ProductVersion, error) {
-	if ok, err := versionIsSupported(version); !ok {
-		return nil, fmt.Errorf("%s: %w", product, err)
-	}
-
 	client := httpclient.NewHTTPClient()
 
 	indexURL := fmt.Sprintf("%s/%s/%s/index.json",
@@ -175,12 +167,3 @@ func (r *Releases) GetProductVersion(ctx context.Context, product string, versio
 
 	return pv, nil
 }
-
-func versionIsSupported(v *version.Version) (bool, error) {
-	isSupported := v.Metadata() == ""
-	if !isSupported {
-		return false, fmt.Errorf("cannot obtain %s (enterprise versions are not supported)",
-			v.String())
-	}
-	return true, nil
-}
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/hc-install/internal/src/src.go b/.ci/providerlint/vendor/github.com/hashicorp/hc-install/internal/src/src.go
index 5b53d92b12f..9cac8a64e31 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/hc-install/internal/src/src.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/hc-install/internal/src/src.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package src
 
 type InstallSrcSigil struct{}
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/hc-install/internal/validators/validators.go b/.ci/providerlint/vendor/github.com/hashicorp/hc-install/internal/validators/validators.go
index 5e3e6c81637..8a331c4cf72 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/hc-install/internal/validators/validators.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/hc-install/internal/validators/validators.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package validators
 
 import "regexp"
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/hc-install/product/consul.go b/.ci/providerlint/vendor/github.com/hashicorp/hc-install/product/consul.go
index 72e490e2f30..9789d7c318e 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/hc-install/product/consul.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/hc-install/product/consul.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package product
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/hc-install/product/nomad.go b/.ci/providerlint/vendor/github.com/hashicorp/hc-install/product/nomad.go
new file mode 100644
index 00000000000..b675d9a19a8
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/hashicorp/hc-install/product/nomad.go
@@ -0,0 +1,54 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package product
+
+import (
+	"context"
+	"fmt"
+	"os/exec"
+	"regexp"
+	"runtime"
+	"strings"
+
+	"github.com/hashicorp/go-version"
+	"github.com/hashicorp/hc-install/internal/build"
+)
+
+var nomadVersionOutputRe = regexp.MustCompile(`Nomad ` + simpleVersionRe)
+
+var Nomad = Product{
+	Name: "nomad",
+	BinaryName: func() string {
+		if runtime.GOOS == "windows" {
+			return "nomad.exe"
+		}
+		return "nomad"
+	},
+	GetVersion: func(ctx context.Context, path string) (*version.Version, error) {
+		cmd := exec.CommandContext(ctx, path, "version")
+
+		out, err := cmd.Output()
+		if err != nil {
+			return nil, err
+		}
+
+		stdout := strings.TrimSpace(string(out))
+
+		submatches := nomadVersionOutputRe.FindStringSubmatch(stdout)
+		if len(submatches) != 2 {
+			return nil, fmt.Errorf("unexpected number of version matches %d for %s", len(submatches), stdout)
+		}
+		v, err := version.NewVersion(submatches[1])
+		if err != nil {
+			return nil, fmt.Errorf("unable to parse version %q: %w", submatches[1], err)
+		}
+
+		return v, err
+	},
+	BuildInstructions: &BuildInstructions{
+		GitRepoURL:    "https://github.com/hashicorp/nomad.git",
+		PreCloneCheck: &build.GoIsInstalled{},
+		Build:         &build.GoBuild{DetectVendoring: true},
+	},
+}
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/hc-install/product/product.go b/.ci/providerlint/vendor/github.com/hashicorp/hc-install/product/product.go
index 0b5e2a54671..85f2e11bf2c 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/hc-install/product/product.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/hc-install/product/product.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package product
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/hc-install/product/terraform.go b/.ci/providerlint/vendor/github.com/hashicorp/hc-install/product/terraform.go
index d820203a77e..afb6b35fb3a 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/hc-install/product/terraform.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/hc-install/product/terraform.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package product
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/hc-install/product/vault.go b/.ci/providerlint/vendor/github.com/hashicorp/hc-install/product/vault.go
index f00827bfecb..0b25965963a 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/hc-install/product/vault.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/hc-install/product/vault.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package product
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/hc-install/releases/enterprise.go b/.ci/providerlint/vendor/github.com/hashicorp/hc-install/releases/enterprise.go
new file mode 100644
index 00000000000..179d40d1cd4
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/hashicorp/hc-install/releases/enterprise.go
@@ -0,0 +1,38 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package releases
+
+import "fmt"
+
+type EnterpriseOptions struct {
+	// LicenseDir represents directory path where to install license files (required)
+	LicenseDir string
+
+	// Meta represents optional version metadata (e.g. hsm, fips1402)
+	Meta string
+}
+
+func enterpriseVersionMetadata(eo *EnterpriseOptions) string {
+	if eo == nil {
+		return ""
+	}
+
+	metadata := "ent"
+	if eo.Meta != "" {
+		metadata += "." + eo.Meta
+	}
+	return metadata
+}
+
+func validateEnterpriseOptions(eo *EnterpriseOptions) error {
+	if eo == nil {
+		return nil
+	}
+
+	if eo.LicenseDir == "" {
+		return fmt.Errorf("LicenseDir must be provided when requesting enterprise versions")
+	}
+
+	return nil
+}
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/hc-install/releases/exact_version.go b/.ci/providerlint/vendor/github.com/hashicorp/hc-install/releases/exact_version.go
index 7e4091ef7e1..e42f4d239fd 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/hc-install/releases/exact_version.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/hc-install/releases/exact_version.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package releases
 
 import (
@@ -25,6 +28,9 @@ type ExactVersion struct {
 	InstallDir string
 	Timeout    time.Duration
 
+	// Enterprise indicates installation of enterprise version (leave nil for Community editions)
+	Enterprise *EnterpriseOptions
+
 	SkipChecksumVerification bool
 
 	// ArmoredPublicKey is a public PGP key in ASCII/armor format to use
@@ -64,6 +70,10 @@ func (ev *ExactVersion) Validate() error {
 		return fmt.Errorf("unknown version")
 	}
 
+	if err := validateEnterpriseOptions(ev.Enterprise); err != nil {
+		return err
+	}
+
 	return nil
 }
 
@@ -97,7 +107,11 @@ func (ev *ExactVersion) Install(ctx context.Context) (string, error) {
 		rels.BaseURL = ev.apiBaseURL
 	}
 	rels.SetLogger(ev.log())
-	pv, err := rels.GetProductVersion(ctx, ev.Product.Name, ev.Version)
+	installVersion := ev.Version
+	if ev.Enterprise != nil {
+		installVersion = versionWithMetadata(installVersion, enterpriseVersionMetadata(ev.Enterprise))
+	}
+	pv, err := rels.GetProductVersion(ctx, ev.Product.Name, installVersion)
 	if err != nil {
 		return "", err
 	}
@@ -115,7 +129,11 @@ func (ev *ExactVersion) Install(ctx context.Context) (string, error) {
 		d.BaseURL = ev.apiBaseURL
 	}
 
-	zipFilePath, err := d.DownloadAndUnpack(ctx, pv, dstDir)
+	licenseDir := ""
+	if ev.Enterprise != nil {
+		licenseDir = ev.Enterprise.LicenseDir
+	}
+	zipFilePath, err := d.DownloadAndUnpack(ctx, pv, dstDir, licenseDir)
 	if zipFilePath != "" {
 		ev.pathsToRemove = append(ev.pathsToRemove, zipFilePath)
 	}
@@ -148,3 +166,21 @@ func (ev *ExactVersion) Remove(ctx context.Context) error {
 
 	return nil
 }
+
+// versionWithMetadata returns a new version by combining the given version with the given metadata
+func versionWithMetadata(v *version.Version, metadata string) *version.Version {
+	if v == nil {
+		return nil
+	}
+
+	if metadata == "" {
+		return v
+	}
+
+	v2, err := version.NewVersion(fmt.Sprintf("%s+%s", v.Core(), metadata))
+	if err != nil {
+		return nil
+	}
+
+	return v2
+}
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/hc-install/releases/latest_version.go b/.ci/providerlint/vendor/github.com/hashicorp/hc-install/releases/latest_version.go
index 36aa5b2b3cb..8873b5d4ecc 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/hc-install/releases/latest_version.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/hc-install/releases/latest_version.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package releases
 
 import (
@@ -25,6 +28,9 @@ type LatestVersion struct {
 	Timeout            time.Duration
 	IncludePrereleases bool
 
+	// Enterprise indicates installation of enterprise version (leave nil for Community editions)
+	Enterprise *EnterpriseOptions
+
 	SkipChecksumVerification bool
 
 	// ArmoredPublicKey is a public PGP key in ASCII/armor format to use
@@ -60,6 +66,10 @@ func (lv *LatestVersion) Validate() error {
 		return fmt.Errorf("invalid binary name: %q", lv.Product.BinaryName())
 	}
 
+	if err := validateEnterpriseOptions(lv.Enterprise); err != nil {
+		return err
+	}
+
 	return nil
 }
 
@@ -119,7 +129,11 @@ func (lv *LatestVersion) Install(ctx context.Context) (string, error) {
 	if lv.apiBaseURL != "" {
 		d.BaseURL = lv.apiBaseURL
 	}
-	zipFilePath, err := d.DownloadAndUnpack(ctx, versionToInstall, dstDir)
+	licenseDir := ""
+	if lv.Enterprise != nil {
+		licenseDir = lv.Enterprise.LicenseDir
+	}
+	zipFilePath, err := d.DownloadAndUnpack(ctx, versionToInstall, dstDir, licenseDir)
 	if zipFilePath != "" {
 		lv.pathsToRemove = append(lv.pathsToRemove, zipFilePath)
 	}
@@ -153,6 +167,7 @@ func (lv *LatestVersion) Remove(ctx context.Context) error {
 }
 
 func (lv *LatestVersion) findLatestMatchingVersion(pvs rjson.ProductVersionsMap, vc version.Constraints) (*rjson.ProductVersion, bool) {
+	expectedMetadata := enterpriseVersionMetadata(lv.Enterprise)
 	versions := make(version.Collection, 0)
 	for _, pv := range pvs.AsSlice() {
 		if !lv.IncludePrereleases && pv.Version.Prerelease() != "" {
@@ -160,6 +175,10 @@ func (lv *LatestVersion) findLatestMatchingVersion(pvs rjson.ProductVersionsMap,
 			continue
 		}
 
+		if pv.Version.Metadata() != expectedMetadata {
+			continue
+		}
+
 		versions = append(versions, pv.Version)
 	}
 
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/hc-install/releases/releases.go b/.ci/providerlint/vendor/github.com/hashicorp/hc-install/releases/releases.go
index 2c3f3099280..7bef49ba30f 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/hc-install/releases/releases.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/hc-install/releases/releases.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package releases
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/hc-install/releases/versions.go b/.ci/providerlint/vendor/github.com/hashicorp/hc-install/releases/versions.go
index bf0f799faaf..49b1af78cae 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/hc-install/releases/versions.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/hc-install/releases/versions.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package releases
 
 import (
@@ -18,6 +21,7 @@ import (
 type Versions struct {
 	Product     product.Product
 	Constraints version.Constraints
+	Enterprise  *EnterpriseOptions // require enterprise version if set (leave nil for OSS)
 
 	ListTimeout time.Duration
 
@@ -42,6 +46,10 @@ func (v *Versions) List(ctx context.Context) ([]src.Source, error) {
 		return nil, fmt.Errorf("invalid product name: %q", v.Product.Name)
 	}
 
+	if err := validateEnterpriseOptions(v.Enterprise); err != nil {
+		return nil, err
+	}
+
 	timeout := defaultListTimeout
 	if v.ListTimeout > 0 {
 		timeout = v.ListTimeout
@@ -58,6 +66,8 @@ func (v *Versions) List(ctx context.Context) ([]src.Source, error) {
 	versions := pvs.AsSlice()
 	sort.Stable(versions)
 
+	expectedMetadata := enterpriseVersionMetadata(v.Enterprise)
+
 	installables := make([]src.Source, 0)
 	for _, pv := range versions {
 		if !v.Constraints.Check(pv.Version) {
@@ -65,6 +75,11 @@ func (v *Versions) List(ctx context.Context) ([]src.Source, error) {
 			continue
 		}
 
+		if pv.Version.Metadata() != expectedMetadata {
+			// skip version which doesn't match required metadata for enterprise or OSS versions
+			continue
+		}
+
 		ev := &ExactVersion{
 			Product:    v.Product,
 			Version:    pv.Version,
@@ -75,6 +90,13 @@ func (v *Versions) List(ctx context.Context) ([]src.Source, error) {
 			SkipChecksumVerification: v.Install.SkipChecksumVerification,
 		}
 
+		if v.Enterprise != nil {
+			ev.Enterprise = &EnterpriseOptions{
+				Meta:       v.Enterprise.Meta,
+				LicenseDir: v.Enterprise.LicenseDir,
+			}
+		}
+
 		installables = append(installables, ev)
 	}
 
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/hc-install/src/src.go b/.ci/providerlint/vendor/github.com/hashicorp/hc-install/src/src.go
index 11fef7869ff..f7b8265efba 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/hc-install/src/src.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/hc-install/src/src.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package src
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/hc-install/version/VERSION b/.ci/providerlint/vendor/github.com/hashicorp/hc-install/version/VERSION
index 79a2734bbf3..a918a2aa18d 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/hc-install/version/VERSION
+++ b/.ci/providerlint/vendor/github.com/hashicorp/hc-install/version/VERSION
@@ -1 +1 @@
-0.5.0
\ No newline at end of file
+0.6.0
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/hc-install/version/version.go b/.ci/providerlint/vendor/github.com/hashicorp/hc-install/version/version.go
index db367e560ae..facd42949c7 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/hc-install/version/version.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/hc-install/version/version.go
@@ -1,7 +1,11 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package version
 
 import (
 	_ "embed"
+	"strings"
 
 	"github.com/hashicorp/go-version"
 )
@@ -9,6 +13,9 @@ import (
 //go:embed VERSION
 var rawVersion string
 
+// parsedVersion declared here ensures that invalid versions panic early, on import
+var parsedVersion = version.Must(version.NewVersion(strings.TrimSpace(rawVersion)))
+
 // Version returns the version of the library
 //
 // Note: This is only exposed as public function/package
@@ -16,5 +23,5 @@ var rawVersion string
 // In general downstream should not implement version-specific
 // logic and rely on this function to be present in future releases.
 func Version() *version.Version {
-	return version.Must(version.NewVersion(rawVersion))
+	return parsedVersion
 }
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/hcl/v2/CHANGELOG.md b/.ci/providerlint/vendor/github.com/hashicorp/hcl/v2/CHANGELOG.md
index daf3ad90f60..0d523b52282 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/hcl/v2/CHANGELOG.md
+++ b/.ci/providerlint/vendor/github.com/hashicorp/hcl/v2/CHANGELOG.md
@@ -1,5 +1,35 @@
 # HCL Changelog
 
+## v2.18.0 (August 30, 2023)
+
+### Enhancements
+
+* HCL now uses the tables from Unicode 15 when performing string normalization and character segmentation. HCL was previously using the Unicode 13 tables.
+
+    For calling applications where consistent Unicode support is important, consider also upgrading to Go 1.21 at the same time as adopting HCL v2.18.0 so that the standard library unicode tables (used for case folding, etc) will also be from Unicode 15.
+
+## v2.17.1 (August 30, 2023)
+
+### Enhancements
+
+* hclsyntax: When evaluating string templates that have a long known constant prefix, HCL will truncate the known prefix to avoid creating excessively-large refinements. String prefix refinements are intended primarily for relatively-short fixed prefixes, such as `https://` at the start of a URL known to use that scheme. ([#617](https://github.com/hashicorp/hcl/pull/617))
+* ext/tryfunc: The "try" and "can" functions now handle unknown values slightly more precisely, and so can return known values in more situations when given expressions referring to unknown symbols. ([#622](https://github.com/hashicorp/hcl/pull/622))
+
+### Bugs Fixed
+
+* ext/typeexpr: Will no longer try to refine unknown values of unknown type when dealing with a user-specified type constraint containing the `any` keyword, avoiding an incorrect panic at runtime. ([#625](https://github.com/hashicorp/hcl/pull/625))
+* ext/typeexpr: Now correctly handles attempts to declare the same object type attribute multiple times by returning an error. Previously this could potentially panic by creating an incoherent internal state. ([#624](https://github.com/hashicorp/hcl/pull/624))
+
+## v2.17.0 (May 31, 2023)
+
+### Enhancements
+
+* HCL now uses a newer version of the upstream `cty` library which has improved treatment of unknown values: it can now track additional optional information that reduces the range of an unknown value, which allows some operations against unknown values to return known or partially-known results. ([#590](https://github.com/hashicorp/hcl/pull/590))
+
+    **Note:** This change effectively passes on [`cty`'s notion of backward compatibility](https://github.com/zclconf/go-cty/blob/main/COMPATIBILITY.md) whereby unknown values can become "more known" in later releases. In particular, if your caller is using `cty.Value.RawEquals` in its tests against the results of operations with unknown values then you may see those tests begin failing after upgrading, due to the values now being more "refined".
+    
+    If so, you should review the refinements with consideration to [the `cty` refinements docs](https://github.com/zclconf/go-cty/blob/7dcbae46a6f247e983efb1fa774d2bb68781a333/docs/refinements.md) and update your expected results to match only if the reported refinements seem correct for the given situation. The `RawEquals` method is intended only for making exact value comparisons in test cases, so main application code should not use it; use `Equals` instead for real logic, which will take refinements into account automatically.
+
 ## v2.16.2 (March 9, 2023)
 
 ### Bugs Fixed
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/hcl/v2/hclsyntax/expression.go b/.ci/providerlint/vendor/github.com/hashicorp/hcl/v2/hclsyntax/expression.go
index 55fecd4eaf0..5df423fec24 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/hcl/v2/hclsyntax/expression.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/hcl/v2/hclsyntax/expression.go
@@ -696,7 +696,59 @@ func (e *ConditionalExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostic
 		return cty.UnknownVal(resultType), diags
 	}
 	if !condResult.IsKnown() {
-		return cty.UnknownVal(resultType), diags
+		// We might be able to offer a refined range for the result based on
+		// the two possible outcomes.
+		if trueResult.Type() == cty.Number && falseResult.Type() == cty.Number {
+			// This case deals with the common case of (predicate ? 1 : 0) and
+			// significantly decreases the range of the result in that case.
+			if !(trueResult.IsNull() || falseResult.IsNull()) {
+				if gt := trueResult.GreaterThan(falseResult); gt.IsKnown() {
+					b := cty.UnknownVal(cty.Number).Refine()
+					if gt.True() {
+						b = b.
+							NumberRangeLowerBound(falseResult, true).
+							NumberRangeUpperBound(trueResult, true)
+					} else {
+						b = b.
+							NumberRangeLowerBound(trueResult, true).
+							NumberRangeUpperBound(falseResult, true)
+					}
+					b = b.NotNull() // If neither of the results is null then the result can't be either
+					return b.NewValue().WithSameMarks(condResult).WithSameMarks(trueResult).WithSameMarks(falseResult), diags
+				}
+			}
+		}
+		if trueResult.Type().IsCollectionType() && falseResult.Type().IsCollectionType() {
+			if trueResult.Type().Equals(falseResult.Type()) {
+				if !(trueResult.IsNull() || falseResult.IsNull()) {
+					trueLen := trueResult.Length()
+					falseLen := falseResult.Length()
+					if gt := trueLen.GreaterThan(falseLen); gt.IsKnown() {
+						b := cty.UnknownVal(resultType).Refine()
+						trueLen, _ := trueLen.AsBigFloat().Int64()
+						falseLen, _ := falseLen.AsBigFloat().Int64()
+						if gt.True() {
+							b = b.
+								CollectionLengthLowerBound(int(falseLen)).
+								CollectionLengthUpperBound(int(trueLen))
+						} else {
+							b = b.
+								CollectionLengthLowerBound(int(trueLen)).
+								CollectionLengthUpperBound(int(falseLen))
+						}
+						b = b.NotNull() // If neither of the results is null then the result can't be either
+						return b.NewValue().WithSameMarks(condResult).WithSameMarks(trueResult).WithSameMarks(falseResult), diags
+					}
+				}
+			}
+		}
+		trueRng := trueResult.Range()
+		falseRng := falseResult.Range()
+		ret := cty.UnknownVal(resultType)
+		if trueRng.DefinitelyNotNull() && falseRng.DefinitelyNotNull() {
+			ret = ret.RefineNotNull()
+		}
+		return ret.WithSameMarks(condResult).WithSameMarks(trueResult).WithSameMarks(falseResult), diags
 	}
 	condResult, err := convert.Convert(condResult, cty.Bool)
 	if err != nil {
@@ -1632,11 +1684,15 @@ func (e *SplatExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
 		// example, it is valid to use a splat on a single object to retrieve a
 		// list of a single attribute, but we still need to check if that
 		// attribute actually exists.
-		upgradedUnknown = !sourceVal.IsKnown()
+		if !sourceVal.IsKnown() {
+			sourceRng := sourceVal.Range()
+			if sourceRng.CouldBeNull() {
+				upgradedUnknown = true
+			}
+		}
 
 		sourceVal = cty.TupleVal([]cty.Value{sourceVal})
 		sourceTy = sourceVal.Type()
-
 	}
 
 	// We'll compute our result type lazily if we need it. In the normal case
@@ -1675,7 +1731,20 @@ func (e *SplatExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) {
 		// checking to proceed.
 		ty, tyDiags := resultTy()
 		diags = append(diags, tyDiags...)
-		return cty.UnknownVal(ty), diags
+		ret := cty.UnknownVal(ty)
+		if ty != cty.DynamicPseudoType {
+			ret = ret.RefineNotNull()
+		}
+		if ty.IsListType() && sourceVal.Type().IsCollectionType() {
+			// We can refine the length of an unknown list result based on
+			// the source collection's own length.
+			sourceRng := sourceVal.Range()
+			ret = ret.Refine().
+				CollectionLengthLowerBound(sourceRng.LengthLowerBound()).
+				CollectionLengthUpperBound(sourceRng.LengthUpperBound()).
+				NewValue()
+		}
+		return ret.WithSameMarks(sourceVal), diags
 	}
 
 	// Unmark the collection, and save the marks to apply to the returned
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/hcl/v2/hclsyntax/expression_template.go b/.ci/providerlint/vendor/github.com/hashicorp/hcl/v2/hclsyntax/expression_template.go
index 0b5ac19553e..a0dc7c2291b 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/hcl/v2/hclsyntax/expression_template.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/hcl/v2/hclsyntax/expression_template.go
@@ -38,11 +38,9 @@ func (e *TemplateExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics)
 
 		if partVal.IsNull() {
 			diags = append(diags, &hcl.Diagnostic{
-				Severity: hcl.DiagError,
-				Summary:  "Invalid template interpolation value",
-				Detail: fmt.Sprintf(
-					"The expression result is null. Cannot include a null value in a string template.",
-				),
+				Severity:    hcl.DiagError,
+				Summary:     "Invalid template interpolation value",
+				Detail:      "The expression result is null. Cannot include a null value in a string template.",
 				Subject:     part.Range().Ptr(),
 				Context:     &e.SrcRange,
 				Expression:  part,
@@ -83,16 +81,38 @@ func (e *TemplateExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics)
 			continue
 		}
 
-		buf.WriteString(strVal.AsString())
+		// If we're just continuing to validate after we found an unknown value
+		// then we'll skip appending so that "buf" will contain only the
+		// known prefix of the result.
+		if isKnown && !diags.HasErrors() {
+			buf.WriteString(strVal.AsString())
+		}
 	}
 
 	var ret cty.Value
 	if !isKnown {
 		ret = cty.UnknownVal(cty.String)
+		if !diags.HasErrors() { // Invalid input means our partial result buffer is suspect
+			if knownPrefix := buf.String(); knownPrefix != "" {
+				byteLen := len(knownPrefix)
+				// Impose a reasonable upper limit to avoid producing too long a prefix.
+				// The 128 B is about 10% of the safety limits in cty's msgpack decoder.
+				// @see https://github.com/zclconf/go-cty/blob/v1.13.2/cty/msgpack/unknown.go#L170-L175
+				//
+				// This operation is safe because StringPrefix removes incomplete trailing grapheme clusters.
+				if byteLen > 128 { // arbitrarily-decided threshold
+					byteLen = 128
+				}
+				ret = ret.Refine().StringPrefix(knownPrefix[:byteLen]).NewValue()
+			}
+		}
 	} else {
 		ret = cty.StringVal(buf.String())
 	}
 
+	// A template rendering result is never null.
+	ret = ret.RefineNotNull()
+
 	// Apply the full set of marks to the returned value
 	return ret.WithMarks(marks), diags
 }
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/hcl/v2/hclsyntax/parser.go b/.ci/providerlint/vendor/github.com/hashicorp/hcl/v2/hclsyntax/parser.go
index 6ed88e63203..aa147afeb49 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/hcl/v2/hclsyntax/parser.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/hcl/v2/hclsyntax/parser.go
@@ -9,7 +9,7 @@ import (
 	"strconv"
 	"unicode/utf8"
 
-	"github.com/apparentlymart/go-textseg/v13/textseg"
+	"github.com/apparentlymart/go-textseg/v15/textseg"
 	"github.com/hashicorp/hcl/v2"
 	"github.com/zclconf/go-cty/cty"
 )
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/hcl/v2/hclsyntax/parser_template.go b/.ci/providerlint/vendor/github.com/hashicorp/hcl/v2/hclsyntax/parser_template.go
index 3ac6829881a..19e988064d8 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/hcl/v2/hclsyntax/parser_template.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/hcl/v2/hclsyntax/parser_template.go
@@ -8,7 +8,7 @@ import (
 	"strings"
 	"unicode"
 
-	"github.com/apparentlymart/go-textseg/v13/textseg"
+	"github.com/apparentlymart/go-textseg/v15/textseg"
 	"github.com/hashicorp/hcl/v2"
 	"github.com/zclconf/go-cty/cty"
 )
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/hcl/v2/hclsyntax/token.go b/.ci/providerlint/vendor/github.com/hashicorp/hcl/v2/hclsyntax/token.go
index a14b39407fe..afde5f33a0b 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/hcl/v2/hclsyntax/token.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/hcl/v2/hclsyntax/token.go
@@ -7,7 +7,7 @@ import (
 	"bytes"
 	"fmt"
 
-	"github.com/apparentlymart/go-textseg/v13/textseg"
+	"github.com/apparentlymart/go-textseg/v15/textseg"
 	"github.com/hashicorp/hcl/v2"
 )
 
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/hcl/v2/pos_scanner.go b/.ci/providerlint/vendor/github.com/hashicorp/hcl/v2/pos_scanner.go
index cff55392709..2232f374af2 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/hcl/v2/pos_scanner.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/hcl/v2/pos_scanner.go
@@ -7,7 +7,7 @@ import (
 	"bufio"
 	"bytes"
 
-	"github.com/apparentlymart/go-textseg/v13/textseg"
+	"github.com/apparentlymart/go-textseg/v15/textseg"
 )
 
 // RangeScanner is a helper that will scan over a buffer using a bufio.SplitFunc
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/internal/version/version.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/internal/version/version.go
index bf1a046c740..e5328d98036 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/internal/version/version.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/internal/version/version.go
@@ -1,6 +1,9 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package version
 
-const version = "0.18.1"
+const version = "0.19.0"
 
 // ModuleVersion returns the current version of the github.com/hashicorp/terraform-exec Go module.
 // This is a function to allow for future possible enhancement using debug.BuildInfo.
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/apply.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/apply.go
index 6dfdb976c53..2c5a6d07a9d 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/apply.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/apply.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tfexec
 
 import (
@@ -10,6 +13,7 @@ import (
 
 type applyConfig struct {
 	backup    string
+	destroy   bool
 	dirOrPlan string
 	lock      bool
 
@@ -18,6 +22,7 @@ type applyConfig struct {
 	parallelism  int
 	reattachInfo ReattachInfo
 	refresh      bool
+	refreshOnly  bool
 	replaceAddrs []string
 	state        string
 	stateOut     string
@@ -29,6 +34,7 @@ type applyConfig struct {
 }
 
 var defaultApplyOptions = applyConfig{
+	destroy:     false,
 	lock:        true,
 	parallelism: 10,
 	refresh:     true,
@@ -75,6 +81,10 @@ func (opt *RefreshOption) configureApply(conf *applyConfig) {
 	conf.refresh = opt.refresh
 }
 
+func (opt *RefreshOnlyOption) configureApply(conf *applyConfig) {
+	conf.refreshOnly = opt.refreshOnly
+}
+
 func (opt *ReplaceOption) configureApply(conf *applyConfig) {
 	conf.replaceAddrs = append(conf.replaceAddrs, opt.address)
 }
@@ -91,6 +101,10 @@ func (opt *ReattachOption) configureApply(conf *applyConfig) {
 	conf.reattachInfo = opt.info
 }
 
+func (opt *DestroyFlagOption) configureApply(conf *applyConfig) {
+	conf.destroy = opt.destroy
+}
+
 // Apply represents the terraform apply subcommand.
 func (tf *Terraform) Apply(ctx context.Context, opts ...ApplyOption) error {
 	cmd, err := tf.applyCmd(ctx, opts...)
@@ -178,6 +192,17 @@ func (tf *Terraform) buildApplyArgs(ctx context.Context, c applyConfig) ([]strin
 	args = append(args, "-parallelism="+fmt.Sprint(c.parallelism))
 	args = append(args, "-refresh="+strconv.FormatBool(c.refresh))
 
+	if c.refreshOnly {
+		err := tf.compatible(ctx, tf0_15_4, nil)
+		if err != nil {
+			return nil, fmt.Errorf("refresh-only option was introduced in Terraform 0.15.4: %w", err)
+		}
+		if !c.refresh {
+			return nil, fmt.Errorf("you cannot use refresh=false in refresh-only planning mode")
+		}
+		args = append(args, "-refresh-only")
+	}
+
 	// string slice opts: split into separate args
 	if c.replaceAddrs != nil {
 		err := tf.compatible(ctx, tf0_15_2, nil)
@@ -188,6 +213,14 @@ func (tf *Terraform) buildApplyArgs(ctx context.Context, c applyConfig) ([]strin
 			args = append(args, "-replace="+addr)
 		}
 	}
+	if c.destroy {
+		err := tf.compatible(ctx, tf0_15_2, nil)
+		if err != nil {
+			return nil, fmt.Errorf("-destroy option was introduced in Terraform 0.15.2: %w", err)
+		}
+		args = append(args, "-destroy")
+	}
+
 	if c.targets != nil {
 		for _, ta := range c.targets {
 			args = append(args, "-target="+ta)
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/cmd.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/cmd.go
index 56393a006c1..5e160324c82 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/cmd.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/cmd.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tfexec
 
 import (
@@ -166,7 +169,7 @@ func (tf *Terraform) buildEnv(mergeEnv map[string]string) []string {
 	env[automationEnvVar] = "1"
 
 	// force usage of workspace methods for switching
-	env[workspaceEnvVar] = ""
+	delete(env, workspaceEnvVar)
 
 	if tf.disablePluginTLS {
 		env[disablePluginTLSEnvVar] = "1"
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/cmd_default.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/cmd_default.go
index 79dacc93337..3af11c81228 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/cmd_default.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/cmd_default.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:build !linux
 // +build !linux
 
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/cmd_linux.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/cmd_linux.go
index 440fafe8f25..0565372c12f 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/cmd_linux.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/cmd_linux.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tfexec
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/destroy.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/destroy.go
index 189db7e45f6..dbef8b3757e 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/destroy.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/destroy.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tfexec
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/doc.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/doc.go
index 0e82bbd9f90..288476f516e 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/doc.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/doc.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 // Package tfexec exposes functionality for constructing and running Terraform
 // CLI commands. Structured return values use the data types defined in the
 // github.com/hashicorp/terraform-json package.
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/errors.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/errors.go
index 3bbb431caa0..c6645e8bc77 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/errors.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/errors.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tfexec
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/fmt.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/fmt.go
index 2234c79fa7e..0979492336c 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/fmt.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/fmt.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tfexec
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/force_unlock.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/force_unlock.go
index de95f547a6a..7d74a12f931 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/force_unlock.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/force_unlock.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tfexec
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/get.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/get.go
index 5bac9b1976d..8a1363b5df9 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/get.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/get.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tfexec
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/graph.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/graph.go
index 73396280ba9..1b28aa579e0 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/graph.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/graph.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tfexec
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/import.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/import.go
index e243d728177..67275dfaa7e 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/import.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/import.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tfexec
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/init.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/init.go
index 8fd366777c0..c292fdc0f19 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/init.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/init.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tfexec
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/metadata_functions.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/metadata_functions.go
index 4577e062b4a..0e642b2db8d 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/metadata_functions.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/metadata_functions.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tfexec
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/options.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/options.go
index ad3cc65c66b..5f04680b290 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/options.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/options.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tfexec
 
 import (
@@ -324,6 +327,14 @@ func Refresh(refresh bool) *RefreshOption {
 	return &RefreshOption{refresh}
 }
 
+type RefreshOnlyOption struct {
+	refreshOnly bool
+}
+
+func RefreshOnly(refreshOnly bool) *RefreshOnlyOption {
+	return &RefreshOnlyOption{refreshOnly}
+}
+
 type ReplaceOption struct {
 	address string
 }
@@ -362,6 +373,15 @@ func Target(resource string) *TargetOption {
 	return &TargetOption{resource}
 }
 
+type TestsDirectoryOption struct {
+	testsDirectory string
+}
+
+// TestsDirectory represents the -tests-directory option (path to tests files)
+func TestsDirectory(testsDirectory string) *TestsDirectoryOption {
+	return &TestsDirectoryOption{testsDirectory}
+}
+
 type GraphTypeOption struct {
 	graphType string
 }
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/output.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/output.go
index b16b8b72890..b1185e8a179 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/output.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/output.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tfexec
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/plan.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/plan.go
index 5ea3155202d..946ce8d0ad3 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/plan.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/plan.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tfexec
 
 import (
@@ -17,6 +20,7 @@ type planConfig struct {
 	parallelism  int
 	reattachInfo ReattachInfo
 	refresh      bool
+	refreshOnly  bool
 	replaceAddrs []string
 	state        string
 	targets      []string
@@ -65,6 +69,10 @@ func (opt *RefreshOption) configurePlan(conf *planConfig) {
 	conf.refresh = opt.refresh
 }
 
+func (opt *RefreshOnlyOption) configurePlan(conf *planConfig) {
+	conf.refreshOnly = opt.refreshOnly
+}
+
 func (opt *ReplaceOption) configurePlan(conf *planConfig) {
 	conf.replaceAddrs = append(conf.replaceAddrs, opt.address)
 }
@@ -199,6 +207,17 @@ func (tf *Terraform) buildPlanArgs(ctx context.Context, c planConfig) ([]string,
 	args = append(args, "-parallelism="+fmt.Sprint(c.parallelism))
 	args = append(args, "-refresh="+strconv.FormatBool(c.refresh))
 
+	if c.refreshOnly {
+		err := tf.compatible(ctx, tf0_15_4, nil)
+		if err != nil {
+			return nil, fmt.Errorf("refresh-only option was introduced in Terraform 0.15.4: %w", err)
+		}
+		if !c.refresh {
+			return nil, fmt.Errorf("you cannot use refresh=false in refresh-only planning mode")
+		}
+		args = append(args, "-refresh-only")
+	}
+
 	// unary flags: pass if true
 	if c.replaceAddrs != nil {
 		err := tf.compatible(ctx, tf0_15_2, nil)
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/providers_lock.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/providers_lock.go
index b3a20216d23..ef5d995b2af 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/providers_lock.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/providers_lock.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tfexec
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/providers_schema.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/providers_schema.go
index 52efc5db606..995dd15697d 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/providers_schema.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/providers_schema.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tfexec
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/refresh.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/refresh.go
index 4bdd8960f59..16733889d84 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/refresh.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/refresh.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tfexec
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/show.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/show.go
index 61e660ac991..8bf0779f5f4 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/show.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/show.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tfexec
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/state_mv.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/state_mv.go
index fc7eecf86ce..ca92e5220b4 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/state_mv.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/state_mv.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tfexec
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/state_pull.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/state_pull.go
index 11b6b9c77f0..9fa6e5db95a 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/state_pull.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/state_pull.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tfexec
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/state_push.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/state_push.go
index 14e55a2eb3f..a0873e96ced 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/state_push.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/state_push.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tfexec
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/state_rm.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/state_rm.go
index 0c5dd66676e..2db18cb7472 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/state_rm.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/state_rm.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tfexec
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/taint.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/taint.go
index cd69df3085f..b6ac955cdd6 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/taint.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/taint.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tfexec
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/terraform.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/terraform.go
index 10d7d9adbae..628b733dec2 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/terraform.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/terraform.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tfexec
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/test.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/test.go
new file mode 100644
index 00000000000..5e0bb6353fb
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/test.go
@@ -0,0 +1,66 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package tfexec
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"os/exec"
+)
+
+type testConfig struct {
+	testsDirectory string
+}
+
+var defaultTestOptions = testConfig{}
+
+type TestOption interface {
+	configureTest(*testConfig)
+}
+
+func (opt *TestsDirectoryOption) configureTest(conf *testConfig) {
+	conf.testsDirectory = opt.testsDirectory
+}
+
+// Test represents the terraform test -json subcommand.
+//
+// The given io.Writer, if specified, will receive
+// [machine-readable](https://developer.hashicorp.com/terraform/internals/machine-readable-ui)
+// JSON from Terraform including test results.
+func (tf *Terraform) Test(ctx context.Context, w io.Writer, opts ...TestOption) error {
+	err := tf.compatible(ctx, tf1_6_0, nil)
+
+	if err != nil {
+		return fmt.Errorf("terraform test was added in 1.6.0: %w", err)
+	}
+
+	tf.SetStdout(w)
+
+	testCmd := tf.testCmd(ctx)
+
+	err = tf.runTerraformCmd(ctx, testCmd)
+
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (tf *Terraform) testCmd(ctx context.Context, opts ...TestOption) *exec.Cmd {
+	c := defaultTestOptions
+
+	for _, o := range opts {
+		o.configureTest(&c)
+	}
+
+	args := []string{"test", "-json"}
+
+	if c.testsDirectory != "" {
+		args = append(args, "-tests-directory="+c.testsDirectory)
+	}
+
+	return tf.buildTerraformCmd(ctx, nil, args...)
+}
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/untaint.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/untaint.go
index bda1272775d..5f0bf350e65 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/untaint.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/untaint.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tfexec
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/upgrade012.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/upgrade012.go
index e55237a7b6e..34a2c87de14 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/upgrade012.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/upgrade012.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tfexec
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/upgrade013.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/upgrade013.go
index f1f444e2f42..98dc4590853 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/upgrade013.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/upgrade013.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tfexec
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/validate.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/validate.go
index 320011df19a..d995d3759da 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/validate.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/validate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tfexec
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/version.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/version.go
index a2e973681f0..4ba4f6eafcd 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/version.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/version.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tfexec
 
 import (
@@ -26,8 +29,10 @@ var (
 	tf0_15_0 = version.Must(version.NewVersion("0.15.0"))
 	tf0_15_2 = version.Must(version.NewVersion("0.15.2"))
 	tf0_15_3 = version.Must(version.NewVersion("0.15.3"))
+	tf0_15_4 = version.Must(version.NewVersion("0.15.4"))
 	tf1_1_0  = version.Must(version.NewVersion("1.1.0"))
 	tf1_4_0  = version.Must(version.NewVersion("1.4.0"))
+	tf1_6_0  = version.Must(version.NewVersion("1.6.0"))
 )
 
 // Version returns structured output from the terraform version command including both the Terraform CLI version
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/workspace_delete.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/workspace_delete.go
index 526772079a3..f2a17e652ee 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/workspace_delete.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/workspace_delete.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tfexec
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/workspace_list.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/workspace_list.go
index 33c0d779b39..1b4bec37636 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/workspace_list.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/workspace_list.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tfexec
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/workspace_new.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/workspace_new.go
index 2e05ffdb764..921a11873f9 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/workspace_new.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/workspace_new.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tfexec
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/workspace_select.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/workspace_select.go
index 5a51330f6f5..da88472ab47 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/workspace_select.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/workspace_select.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tfexec
 
 import "context"
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/workspace_show.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/workspace_show.go
index 7d5a267f1db..840eff9ae98 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/workspace_show.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-exec/tfexec/workspace_show.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tfexec
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-json/.copywrite.hcl b/.ci/providerlint/vendor/github.com/hashicorp/terraform-json/.copywrite.hcl
new file mode 100644
index 00000000000..ada7d74aa73
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-json/.copywrite.hcl
@@ -0,0 +1,13 @@
+schema_version = 1
+
+project {
+  license        = "MPL-2.0"
+  copyright_year = 2019
+
+  # (OPTIONAL) A list of globs that should not have copyright/license headers.
+  # Supports doublestar glob patterns for more flexibility in defining which
+  # files or folders should be ignored
+  header_ignore = [
+    "testdata/**",
+  ]
+}
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-json/action.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-json/action.go
index 51c4c8369af..c74f7e68a31 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-json/action.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-json/action.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tfjson
 
 // Action is a valid action type for a resource change.
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-json/checks.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-json/checks.go
new file mode 100644
index 00000000000..558cb290b6d
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-json/checks.go
@@ -0,0 +1,145 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package tfjson
+
+// CheckKind is a string representation of the type of conditional check
+// referenced in a check result.
+type CheckKind string
+
+const (
+	// CheckKindResource indicates the check result is from a pre- or
+	// post-condition on a resource or data source.
+	CheckKindResource CheckKind = "resource"
+
+	// CheckKindOutputValue indicates the check result is from an output
+	// post-condition.
+	CheckKindOutputValue CheckKind = "output_value"
+
+	// CheckKindCheckBlock indicates the check result is from a check block.
+	CheckKindCheckBlock CheckKind = "check"
+)
+
+// CheckStatus is a string representation of the status of a given conditional
+// check.
+type CheckStatus string
+
+const (
+	// CheckStatusPass indicates the check passed.
+	CheckStatusPass CheckStatus = "pass"
+
+	// CheckStatusFail indicates the check failed.
+	CheckStatusFail CheckStatus = "fail"
+
+	// CheckStatusError indicates the check errored. This is distinct from
+	// CheckStatusFail in that it represents a logical or configuration error
+	// within the check block that prevented the check from executing, as
+	// opposed to the check was attempted and evaluated to false.
+	CheckStatusError CheckStatus = "error"
+
+	// CheckStatusUnknown indicates the result of the check was not known. This
+	// could be because a value within the check could not be known at plan
+	// time, or because the overall plan failed for an unrelated reason before
+	// this check could be executed.
+	CheckStatusUnknown CheckStatus = "unknown"
+)
+
+// CheckStaticAddress details the address of the object that performed a given
+// check. The static address points to the overall resource, as opposed to the
+// dynamic address which contains the instance key for any resource that has
+// multiple instances.
+type CheckStaticAddress struct {
+	// ToDisplay is a formatted and ready to display representation of the
+	// address.
+	ToDisplay string `json:"to_display"`
+
+	// Kind represents the CheckKind of this check.
+	Kind CheckKind `json:"kind"`
+
+	// Module is the module part of the address. This will be empty for any
+	// resources in the root module.
+	Module string `json:"module,omitempty"`
+
+	// Mode is the ResourceMode of the resource that contains this check. This
+	// field is only set is Kind equals CheckKindResource.
+	Mode ResourceMode `json:"mode,omitempty"`
+
+	// Type is the resource type for the resource that contains this check. This
+	// field is only set if Kind equals CheckKindResource.
+	Type string `json:"type,omitempty"`
+
+	// Name is the name of the resource, check block, or output that contains
+	// this check.
+	Name string `json:"name,omitempty"`
+}
+
+// CheckDynamicAddress contains the InstanceKey field for any resources that
+// have multiple instances. A complete address can be built by combining the
+// CheckStaticAddress with the CheckDynamicAddress.
+type CheckDynamicAddress struct {
+	// ToDisplay is a formatted and ready to display representation of the
+	// full address, including the additional information from the relevant
+	// CheckStaticAddress.
+	ToDisplay string `json:"to_display"`
+
+	// Module is the module part of the address. This address will include the
+	// instance key for any module expansions resulting from foreach or count
+	// arguments. This field will be empty for any resources within the root
+	// module.
+	Module string `json:"module,omitempty"`
+
+	// InstanceKey is the instance key for any instances of a given resource.
+	//
+	// InstanceKey will be empty if there was no foreach or count argument
+	// defined on the containing object.
+	InstanceKey interface{} `json:"instance_key,omitempty"`
+}
+
+// CheckResultStatic is the container for a "checkable object".
+//
+// A "checkable object" is a resource or data source, an output, or a check
+// block.
+type CheckResultStatic struct {
+	// Address is the absolute address of the "checkable object"
+	Address CheckStaticAddress `json:"address"`
+
+	// Status is the overall status for all the checks within this object.
+	Status CheckStatus `json:"status"`
+
+	// Instances contains the results for dynamic object that belongs to this
+	// static object. For example, any instances created from an object using
+	// the foreach or count meta arguments.
+	//
+	// Check blocks and outputs will only contain a single instance, while
+	// resources can contain 1 to many.
+	Instances []CheckResultDynamic `json:"instances,omitempty"`
+}
+
+// CheckResultDynamic describes the check result for a dynamic object that
+// results from the expansion of the containing object.
+type CheckResultDynamic struct {
+	// Address is the relative address of this instance given the Address in the
+	// parent object.
+	Address CheckDynamicAddress `json:"address"`
+
+	// Status is the overall status for the checks within this dynamic object.
+	Status CheckStatus `json:"status"`
+
+	// Problems describes any additional optional details about this check if
+	// the check failed.
+	//
+	// This will not include the errors resulting from this check block, as they
+	// will be exposed as diagnostics in the original terraform execution. It
+	// may contain any failure messages even if the overall status is
+	// CheckStatusError, however, as the instance could contain multiple checks
+	// that returned a mix of error and failure statuses.
+	Problems []CheckResultProblem `json:"problems,omitempty"`
+}
+
+// CheckResultProblem describes one of potentially several problems that led to
+// a check being classied as CheckStatusFail.
+type CheckResultProblem struct {
+	// Message is the condition error message provided by the original check
+	// author.
+	Message string `json:"message"`
+}
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-json/config.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-json/config.go
index 5ebe4bc840c..e8ea638acc1 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-json/config.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-json/config.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tfjson
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-json/expression.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-json/expression.go
index 8a39face7b6..5ecb15ce50f 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-json/expression.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-json/expression.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tfjson
 
 import "encoding/json"
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-json/metadata.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-json/metadata.go
index 70d7ce4380a..eb525776078 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-json/metadata.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-json/metadata.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tfjson
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-json/plan.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-json/plan.go
index 6cfd533e992..de529accc05 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-json/plan.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-json/plan.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tfjson
 
 import (
@@ -63,6 +66,14 @@ type Plan struct {
 	// RelevantAttributes represents any resource instances and their
 	// attributes which may have contributed to the planned changes
 	RelevantAttributes []ResourceAttribute `json:"relevant_attributes,omitempty"`
+
+	// Checks contains the results of any conditional checks executed, or
+	// planned to be executed, during this plan.
+	Checks []CheckResultStatic `json:"checks,omitempty"`
+
+	// Timestamp contains the static timestamp that Terraform considers to be
+	// the time this plan executed, in UTC.
+	Timestamp string `json:"timestamp,omitempty"`
 }
 
 // ResourceAttribute describes a full path to a resource attribute
@@ -197,6 +208,28 @@ type Change struct {
 	// display of sensitive values in user interfaces.
 	BeforeSensitive interface{} `json:"before_sensitive,omitempty"`
 	AfterSensitive  interface{} `json:"after_sensitive,omitempty"`
+
+	// Importing contains the import metadata about this operation. If importing
+	// is present (ie. not null) then the change is an import operation in
+	// addition to anything mentioned in the actions field. The actual contents
+	// of the Importing struct is subject to change, so downstream consumers
+	// should treat any values in here as strictly optional.
+	Importing *Importing `json:"importing,omitempty"`
+
+	// GeneratedConfig contains any HCL config generated for this resource
+	// during planning as a string.
+	//
+	// If this is populated, then Importing should also be populated but this
+	// might change in the future. However, not all Importing changes will
+	// contain generated config.
+	GeneratedConfig string `json:"generated_config,omitempty"`
+}
+
+// Importing is a nested object for the resource import metadata.
+type Importing struct {
+	// The original ID of this resource used to target it as part of planned
+	// import operation.
+	ID string `json:"id,omitempty"`
 }
 
 // PlanVariable is a top-level variable in the Terraform plan.
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-json/schemas.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-json/schemas.go
index f7c8abd50f6..64f87d84a90 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-json/schemas.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-json/schemas.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tfjson
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-json/state.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-json/state.go
index 3c3f6a4b0aa..0f2a9996966 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-json/state.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-json/state.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tfjson
 
 import (
@@ -32,6 +35,10 @@ type State struct {
 
 	// The values that make up the state.
 	Values *StateValues `json:"values,omitempty"`
+
+	// Checks contains the results of any conditional checks when Values was
+	// last updated.
+	Checks *CheckResultStatic `json:"checks,omitempty"`
 }
 
 // UseJSONNumber controls whether the State will be decoded using the
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-json/tfjson.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-json/tfjson.go
index 55f9ac44498..3a78a4f0fed 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-json/tfjson.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-json/tfjson.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 // Package tfjson is a de-coupled helper library containing types for
 // the plan format output by "terraform show -json" command. This
 // command is designed for the export of Terraform plan data in
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-json/validate.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-json/validate.go
index 97b82d0a979..53652eff300 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-json/validate.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-json/validate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tfjson
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-json/version.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-json/version.go
index 16f0a853e34..7516ad6dd49 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-json/version.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-json/version.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tfjson
 
 // VersionOutput represents output from the version -json command
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/internal/logging/context.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/internal/logging/context.go
index 385283bb915..d99e19796c2 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/internal/logging/context.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/internal/logging/context.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package logging
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/internal/logging/doc.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/internal/logging/doc.go
index cc1a033e614..1d29f515eac 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/internal/logging/doc.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/internal/logging/doc.go
@@ -1,2 +1,5 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 // Package logging contains shared environment variable and log functionality.
 package logging
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/internal/logging/environment_variables.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/internal/logging/environment_variables.go
index 49b8072c8c8..c203345769d 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/internal/logging/environment_variables.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/internal/logging/environment_variables.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package logging
 
 // Environment variables.
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/internal/logging/keys.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/internal/logging/keys.go
index ce803d752bd..2cfacba63e4 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/internal/logging/keys.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/internal/logging/keys.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package logging
 
 // Global logging keys attached to all requests.
@@ -50,4 +53,10 @@ const (
 
 	// The protocol version being used, as a string, such as "6"
 	KeyProtocolVersion = "tf_proto_version"
+
+	// Whether the GetProviderSchemaOptional server capability is enabled
+	KeyServerCapabilityGetProviderSchemaOptional = "tf_server_capability_get_provider_schema_optional"
+
+	// Whether the PlanDestroy server capability is enabled
+	KeyServerCapabilityPlanDestroy = "tf_server_capability_plan_destroy"
 )
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/internal/logging/protocol.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/internal/logging/protocol.go
index ee124769055..a1d49eae12c 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/internal/logging/protocol.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/internal/logging/protocol.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package logging
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/internal/logging/protocol_data.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/internal/logging/protocol_data.go
index 36dfcd764df..e96188f59c6 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/internal/logging/protocol_data.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/internal/logging/protocol_data.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package logging
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/internal/logging/provider.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/internal/logging/provider.go
index b40763c6e17..1ece6992d09 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/internal/logging/provider.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/internal/logging/provider.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package logging
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/data_source.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/data_source.go
index bdeac863848..f76df34175a 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/data_source.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/data_source.go
@@ -1,9 +1,19 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tfprotov5
 
 import (
 	"context"
 )
 
+// DataSourceMetadata describes metadata for a data resource in the GetMetadata
+// RPC.
+type DataSourceMetadata struct {
+	// TypeName is the name of the data resource.
+	TypeName string
+}
+
 // DataSourceServer is an interface containing the methods a data source
 // implementation needs to fill.
 type DataSourceServer interface {
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/diagnostic.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/diagnostic.go
index de0906e33a0..15ab6a4ab13 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/diagnostic.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/diagnostic.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tfprotov5
 
 import "github.com/hashicorp/terraform-plugin-go/tftypes"
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/doc.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/doc.go
index fdaf5cde4c7..2d35c9251fb 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/doc.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/doc.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 // Package tfprotov5 provides the interfaces and types needed to build a
 // Terraform provider server.
 //
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/dynamic_value.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/dynamic_value.go
index 71d5cc4e97b..d21e4966114 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/dynamic_value.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/dynamic_value.go
@@ -1,9 +1,17 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tfprotov5
 
 import (
+	"bytes"
+	"encoding/json"
 	"errors"
+	"fmt"
 
 	"github.com/hashicorp/terraform-plugin-go/tftypes"
+	msgpack "github.com/vmihailenco/msgpack/v5"
+	"github.com/vmihailenco/msgpack/v5/msgpcode"
 )
 
 // ErrUnknownDynamicValueType is returned when a DynamicValue has no MsgPack or
@@ -35,7 +43,7 @@ func NewDynamicValue(t tftypes.Type, v tftypes.Value) (DynamicValue, error) {
 
 // DynamicValue represents a nested encoding value that came from the protocol.
 // The only way providers should ever interact with it is by calling its
-// `Unmarshal` method to retrive a `tftypes.Value`. Although the type system
+// `Unmarshal` method to retrieve a `tftypes.Value`. Although the type system
 // allows for other interactions, they are explicitly not supported, and will
 // not be considered when evaluating for breaking changes. Treat this type as
 // an opaque value, and *only* call its `Unmarshal` method.
@@ -44,6 +52,43 @@ type DynamicValue struct {
 	JSON    []byte
 }
 
+// IsNull returns true if the DynamicValue represents a null value based on the
+// underlying JSON or MessagePack data.
+func (d DynamicValue) IsNull() (bool, error) {
+	if d.JSON != nil {
+		decoder := json.NewDecoder(bytes.NewReader(d.JSON))
+		token, err := decoder.Token()
+
+		if err != nil {
+			return false, fmt.Errorf("unable to read DynamicValue JSON token: %w", err)
+		}
+
+		if token != nil {
+			return false, nil
+		}
+
+		return true, nil
+	}
+
+	if d.MsgPack != nil {
+		decoder := msgpack.NewDecoder(bytes.NewReader(d.MsgPack))
+		code, err := decoder.PeekCode()
+
+		if err != nil {
+			return false, fmt.Errorf("unable to read DynamicValue MsgPack code: %w", err)
+		}
+
+		// Extensions are considered unknown
+		if msgpcode.IsExt(code) || code != msgpcode.Nil {
+			return false, nil
+		}
+
+		return true, nil
+	}
+
+	return false, fmt.Errorf("unable to read DynamicValue: %w", ErrUnknownDynamicValueType)
+}
+
 // Unmarshal returns a `tftypes.Value` that represents the information
 // contained in the DynamicValue in an easy-to-interact-with way. It is the
 // main purpose of the DynamicValue type, and is how provider developers should
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/diag/diagnostics.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/diag/diagnostics.go
index 9032b901fdb..cc40d861fce 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/diag/diagnostics.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/diag/diagnostics.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package diag
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/diag/doc.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/diag/doc.go
index 0c73dab12fe..faaba2285cd 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/diag/doc.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/diag/doc.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 // Package diag contains diagnostics helpers. These implementations are
 // intentionally outside the public API.
 package diag
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/fromproto/attribute_path.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/fromproto/attribute_path.go
index 421bfbec548..182479ec9a8 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/fromproto/attribute_path.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/fromproto/attribute_path.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package fromproto
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/fromproto/data_source.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/fromproto/data_source.go
index bb1ad54250c..9a3e8891c98 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/fromproto/data_source.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/fromproto/data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package fromproto
 
 import (
@@ -5,6 +8,16 @@ import (
 	"github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/tfplugin5"
 )
 
+func DataSourceMetadata(in *tfplugin5.GetMetadata_DataSourceMetadata) *tfprotov5.DataSourceMetadata {
+	if in == nil {
+		return nil
+	}
+
+	return &tfprotov5.DataSourceMetadata{
+		TypeName: in.TypeName,
+	}
+}
+
 func ValidateDataSourceConfigRequest(in *tfplugin5.ValidateDataSourceConfig_Request) (*tfprotov5.ValidateDataSourceConfigRequest, error) {
 	resp := &tfprotov5.ValidateDataSourceConfigRequest{
 		TypeName: in.TypeName,
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/fromproto/diagnostic.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/fromproto/diagnostic.go
index e0feaea5e94..1dc41687dc1 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/fromproto/diagnostic.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/fromproto/diagnostic.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package fromproto
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/fromproto/provider.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/fromproto/provider.go
index 8184bebf387..e45cecaa059 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/fromproto/provider.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/fromproto/provider.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package fromproto
 
 import (
@@ -5,6 +8,40 @@ import (
 	"github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/tfplugin5"
 )
 
+func GetMetadataRequest(in *tfplugin5.GetMetadata_Request) (*tfprotov5.GetMetadataRequest, error) {
+	return &tfprotov5.GetMetadataRequest{}, nil
+}
+
+func GetMetadataResponse(in *tfplugin5.GetMetadata_Response) (*tfprotov5.GetMetadataResponse, error) {
+	if in == nil {
+		return nil, nil
+	}
+
+	resp := &tfprotov5.GetMetadataResponse{
+		DataSources:        make([]tfprotov5.DataSourceMetadata, 0, len(in.DataSources)),
+		Resources:          make([]tfprotov5.ResourceMetadata, 0, len(in.Resources)),
+		ServerCapabilities: ServerCapabilities(in.ServerCapabilities),
+	}
+
+	for _, datasource := range in.DataSources {
+		resp.DataSources = append(resp.DataSources, *DataSourceMetadata(datasource))
+	}
+
+	for _, resource := range in.Resources {
+		resp.Resources = append(resp.Resources, *ResourceMetadata(resource))
+	}
+
+	diags, err := Diagnostics(in.Diagnostics)
+
+	if err != nil {
+		return resp, err
+	}
+
+	resp.Diagnostics = diags
+
+	return resp, nil
+}
+
 func GetProviderSchemaRequest(in *tfplugin5.GetProviderSchema_Request) (*tfprotov5.GetProviderSchemaRequest, error) {
 	return &tfprotov5.GetProviderSchemaRequest{}, nil
 }
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/fromproto/resource.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/fromproto/resource.go
index 9b7d505be4d..f87abdfad08 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/fromproto/resource.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/fromproto/resource.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package fromproto
 
 import (
@@ -7,6 +10,16 @@ import (
 	"github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/tfplugin5"
 )
 
+func ResourceMetadata(in *tfplugin5.GetMetadata_ResourceMetadata) *tfprotov5.ResourceMetadata {
+	if in == nil {
+		return nil
+	}
+
+	return &tfprotov5.ResourceMetadata{
+		TypeName: in.TypeName,
+	}
+}
+
 func ValidateResourceTypeConfigRequest(in *tfplugin5.ValidateResourceTypeConfig_Request) (*tfprotov5.ValidateResourceTypeConfigRequest, error) {
 	resp := &tfprotov5.ValidateResourceTypeConfigRequest{
 		TypeName: in.TypeName,
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/fromproto/schema.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/fromproto/schema.go
index 90f2e032226..35828c3115c 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/fromproto/schema.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/fromproto/schema.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package fromproto
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/fromproto/server_capabilities.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/fromproto/server_capabilities.go
new file mode 100644
index 00000000000..16e258f3947
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/fromproto/server_capabilities.go
@@ -0,0 +1,20 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package fromproto
+
+import (
+	"github.com/hashicorp/terraform-plugin-go/tfprotov5"
+	"github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/tfplugin5"
+)
+
+func ServerCapabilities(in *tfplugin5.ServerCapabilities) *tfprotov5.ServerCapabilities {
+	if in == nil {
+		return nil
+	}
+
+	return &tfprotov5.ServerCapabilities{
+		GetProviderSchemaOptional: in.GetProviderSchemaOptional,
+		PlanDestroy:               in.PlanDestroy,
+	}
+}
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/fromproto/state.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/fromproto/state.go
index ad89004d2d1..910f0c7304c 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/fromproto/state.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/fromproto/state.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package fromproto
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/fromproto/string_kind.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/fromproto/string_kind.go
index c15d2df4614..b2b47248f38 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/fromproto/string_kind.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/fromproto/string_kind.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package fromproto
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/fromproto/types.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/fromproto/types.go
index 17f31f852b9..f99ff2b777c 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/fromproto/types.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/fromproto/types.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package fromproto
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/tf5serverlogging/context_keys.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/tf5serverlogging/context_keys.go
index cc72fe4bbf6..5b2556a27b4 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/tf5serverlogging/context_keys.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/tf5serverlogging/context_keys.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tf5serverlogging
 
 // Context key types.
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/tf5serverlogging/doc.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/tf5serverlogging/doc.go
index e77a831c03e..82b9d39e5c5 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/tf5serverlogging/doc.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/tf5serverlogging/doc.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 // Package tf5serverlogging contains logging functionality specific to
 // tf5server and tfprotov5 types.
 package tf5serverlogging
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/tf5serverlogging/downstream_request.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/tf5serverlogging/downstream_request.go
index 65ed7011321..efa4d9b529b 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/tf5serverlogging/downstream_request.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/tf5serverlogging/downstream_request.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tf5serverlogging
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/tf5serverlogging/server_capabilities.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/tf5serverlogging/server_capabilities.go
new file mode 100644
index 00000000000..d0f86c84272
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/tf5serverlogging/server_capabilities.go
@@ -0,0 +1,26 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package tf5serverlogging
+
+import (
+	"context"
+
+	"github.com/hashicorp/terraform-plugin-go/internal/logging"
+	"github.com/hashicorp/terraform-plugin-go/tfprotov5"
+)
+
+// ServerCapabilities generates a TRACE "Announced server capabilities" log.
+func ServerCapabilities(ctx context.Context, capabilities *tfprotov5.ServerCapabilities) {
+	responseFields := map[string]interface{}{
+		logging.KeyServerCapabilityGetProviderSchemaOptional: false,
+		logging.KeyServerCapabilityPlanDestroy:               false,
+	}
+
+	if capabilities != nil {
+		responseFields[logging.KeyServerCapabilityGetProviderSchemaOptional] = capabilities.GetProviderSchemaOptional
+		responseFields[logging.KeyServerCapabilityPlanDestroy] = capabilities.PlanDestroy
+	}
+
+	logging.ProtocolTrace(ctx, "Announced server capabilities", responseFields)
+}
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/tfplugin5/tfplugin5.pb.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/tfplugin5/tfplugin5.pb.go
index 9b7abe79e46..b00fa1be15f 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/tfplugin5/tfplugin5.pb.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/tfplugin5/tfplugin5.pb.go
@@ -1,6 +1,9 @@
-// Terraform Plugin RPC protocol version 5.3
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+// Terraform Plugin RPC protocol version 5.4
 //
-// This file defines version 5.3 of the RPC protocol. To implement a plugin
+// This file defines version 5.4 of the RPC protocol. To implement a plugin
 // against this protocol, copy this definition into your own codebase and
 // use protoc to generate stubs for your target language.
 //
@@ -19,8 +22,8 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.28.1
-// 	protoc        v3.19.4
+// 	protoc-gen-go v1.31.0
+// 	protoc        v4.23.2
 // source: tfplugin5.proto
 
 package tfplugin5
@@ -523,6 +526,109 @@ func (x *Schema) GetBlock() *Schema_Block {
 	return nil
 }
 
+// ServerCapabilities allows providers to communicate extra information
+// regarding supported protocol features. This is used to indicate
+// availability of certain forward-compatible changes which may be optional
+// in a major protocol version, but cannot be tested for directly.
+type ServerCapabilities struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// The plan_destroy capability signals that a provider expects a call
+	// to PlanResourceChange when a resource is going to be destroyed.
+	PlanDestroy bool `protobuf:"varint,1,opt,name=plan_destroy,json=planDestroy,proto3" json:"plan_destroy,omitempty"`
+	// The get_provider_schema_optional capability indicates that this
+	// provider does not require calling GetProviderSchema to operate
+	// normally, and the caller can used a cached copy of the provider's
+	// schema.
+	GetProviderSchemaOptional bool `protobuf:"varint,2,opt,name=get_provider_schema_optional,json=getProviderSchemaOptional,proto3" json:"get_provider_schema_optional,omitempty"`
+}
+
+func (x *ServerCapabilities) Reset() {
+	*x = ServerCapabilities{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_tfplugin5_proto_msgTypes[6]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ServerCapabilities) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ServerCapabilities) ProtoMessage() {}
+
+func (x *ServerCapabilities) ProtoReflect() protoreflect.Message {
+	mi := &file_tfplugin5_proto_msgTypes[6]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ServerCapabilities.ProtoReflect.Descriptor instead.
+func (*ServerCapabilities) Descriptor() ([]byte, []int) {
+	return file_tfplugin5_proto_rawDescGZIP(), []int{6}
+}
+
+func (x *ServerCapabilities) GetPlanDestroy() bool {
+	if x != nil {
+		return x.PlanDestroy
+	}
+	return false
+}
+
+func (x *ServerCapabilities) GetGetProviderSchemaOptional() bool {
+	if x != nil {
+		return x.GetProviderSchemaOptional
+	}
+	return false
+}
+
+type GetMetadata struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+}
+
+func (x *GetMetadata) Reset() {
+	*x = GetMetadata{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_tfplugin5_proto_msgTypes[7]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *GetMetadata) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetMetadata) ProtoMessage() {}
+
+func (x *GetMetadata) ProtoReflect() protoreflect.Message {
+	mi := &file_tfplugin5_proto_msgTypes[7]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetMetadata.ProtoReflect.Descriptor instead.
+func (*GetMetadata) Descriptor() ([]byte, []int) {
+	return file_tfplugin5_proto_rawDescGZIP(), []int{7}
+}
+
 type GetProviderSchema struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -532,7 +638,7 @@ type GetProviderSchema struct {
 func (x *GetProviderSchema) Reset() {
 	*x = GetProviderSchema{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin5_proto_msgTypes[6]
+		mi := &file_tfplugin5_proto_msgTypes[8]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -545,7 +651,7 @@ func (x *GetProviderSchema) String() string {
 func (*GetProviderSchema) ProtoMessage() {}
 
 func (x *GetProviderSchema) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin5_proto_msgTypes[6]
+	mi := &file_tfplugin5_proto_msgTypes[8]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -558,7 +664,7 @@ func (x *GetProviderSchema) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetProviderSchema.ProtoReflect.Descriptor instead.
 func (*GetProviderSchema) Descriptor() ([]byte, []int) {
-	return file_tfplugin5_proto_rawDescGZIP(), []int{6}
+	return file_tfplugin5_proto_rawDescGZIP(), []int{8}
 }
 
 type PrepareProviderConfig struct {
@@ -570,7 +676,7 @@ type PrepareProviderConfig struct {
 func (x *PrepareProviderConfig) Reset() {
 	*x = PrepareProviderConfig{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin5_proto_msgTypes[7]
+		mi := &file_tfplugin5_proto_msgTypes[9]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -583,7 +689,7 @@ func (x *PrepareProviderConfig) String() string {
 func (*PrepareProviderConfig) ProtoMessage() {}
 
 func (x *PrepareProviderConfig) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin5_proto_msgTypes[7]
+	mi := &file_tfplugin5_proto_msgTypes[9]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -596,7 +702,7 @@ func (x *PrepareProviderConfig) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use PrepareProviderConfig.ProtoReflect.Descriptor instead.
 func (*PrepareProviderConfig) Descriptor() ([]byte, []int) {
-	return file_tfplugin5_proto_rawDescGZIP(), []int{7}
+	return file_tfplugin5_proto_rawDescGZIP(), []int{9}
 }
 
 type UpgradeResourceState struct {
@@ -608,7 +714,7 @@ type UpgradeResourceState struct {
 func (x *UpgradeResourceState) Reset() {
 	*x = UpgradeResourceState{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin5_proto_msgTypes[8]
+		mi := &file_tfplugin5_proto_msgTypes[10]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -621,7 +727,7 @@ func (x *UpgradeResourceState) String() string {
 func (*UpgradeResourceState) ProtoMessage() {}
 
 func (x *UpgradeResourceState) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin5_proto_msgTypes[8]
+	mi := &file_tfplugin5_proto_msgTypes[10]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -634,7 +740,7 @@ func (x *UpgradeResourceState) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use UpgradeResourceState.ProtoReflect.Descriptor instead.
 func (*UpgradeResourceState) Descriptor() ([]byte, []int) {
-	return file_tfplugin5_proto_rawDescGZIP(), []int{8}
+	return file_tfplugin5_proto_rawDescGZIP(), []int{10}
 }
 
 type ValidateResourceTypeConfig struct {
@@ -646,7 +752,7 @@ type ValidateResourceTypeConfig struct {
 func (x *ValidateResourceTypeConfig) Reset() {
 	*x = ValidateResourceTypeConfig{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin5_proto_msgTypes[9]
+		mi := &file_tfplugin5_proto_msgTypes[11]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -659,7 +765,7 @@ func (x *ValidateResourceTypeConfig) String() string {
 func (*ValidateResourceTypeConfig) ProtoMessage() {}
 
 func (x *ValidateResourceTypeConfig) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin5_proto_msgTypes[9]
+	mi := &file_tfplugin5_proto_msgTypes[11]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -672,7 +778,7 @@ func (x *ValidateResourceTypeConfig) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ValidateResourceTypeConfig.ProtoReflect.Descriptor instead.
 func (*ValidateResourceTypeConfig) Descriptor() ([]byte, []int) {
-	return file_tfplugin5_proto_rawDescGZIP(), []int{9}
+	return file_tfplugin5_proto_rawDescGZIP(), []int{11}
 }
 
 type ValidateDataSourceConfig struct {
@@ -684,7 +790,7 @@ type ValidateDataSourceConfig struct {
 func (x *ValidateDataSourceConfig) Reset() {
 	*x = ValidateDataSourceConfig{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin5_proto_msgTypes[10]
+		mi := &file_tfplugin5_proto_msgTypes[12]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -697,7 +803,7 @@ func (x *ValidateDataSourceConfig) String() string {
 func (*ValidateDataSourceConfig) ProtoMessage() {}
 
 func (x *ValidateDataSourceConfig) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin5_proto_msgTypes[10]
+	mi := &file_tfplugin5_proto_msgTypes[12]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -710,7 +816,7 @@ func (x *ValidateDataSourceConfig) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ValidateDataSourceConfig.ProtoReflect.Descriptor instead.
 func (*ValidateDataSourceConfig) Descriptor() ([]byte, []int) {
-	return file_tfplugin5_proto_rawDescGZIP(), []int{10}
+	return file_tfplugin5_proto_rawDescGZIP(), []int{12}
 }
 
 type Configure struct {
@@ -722,7 +828,7 @@ type Configure struct {
 func (x *Configure) Reset() {
 	*x = Configure{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin5_proto_msgTypes[11]
+		mi := &file_tfplugin5_proto_msgTypes[13]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -735,7 +841,7 @@ func (x *Configure) String() string {
 func (*Configure) ProtoMessage() {}
 
 func (x *Configure) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin5_proto_msgTypes[11]
+	mi := &file_tfplugin5_proto_msgTypes[13]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -748,7 +854,7 @@ func (x *Configure) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use Configure.ProtoReflect.Descriptor instead.
 func (*Configure) Descriptor() ([]byte, []int) {
-	return file_tfplugin5_proto_rawDescGZIP(), []int{11}
+	return file_tfplugin5_proto_rawDescGZIP(), []int{13}
 }
 
 type ReadResource struct {
@@ -760,7 +866,7 @@ type ReadResource struct {
 func (x *ReadResource) Reset() {
 	*x = ReadResource{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin5_proto_msgTypes[12]
+		mi := &file_tfplugin5_proto_msgTypes[14]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -773,7 +879,7 @@ func (x *ReadResource) String() string {
 func (*ReadResource) ProtoMessage() {}
 
 func (x *ReadResource) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin5_proto_msgTypes[12]
+	mi := &file_tfplugin5_proto_msgTypes[14]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -786,7 +892,7 @@ func (x *ReadResource) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ReadResource.ProtoReflect.Descriptor instead.
 func (*ReadResource) Descriptor() ([]byte, []int) {
-	return file_tfplugin5_proto_rawDescGZIP(), []int{12}
+	return file_tfplugin5_proto_rawDescGZIP(), []int{14}
 }
 
 type PlanResourceChange struct {
@@ -798,7 +904,7 @@ type PlanResourceChange struct {
 func (x *PlanResourceChange) Reset() {
 	*x = PlanResourceChange{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin5_proto_msgTypes[13]
+		mi := &file_tfplugin5_proto_msgTypes[15]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -811,7 +917,7 @@ func (x *PlanResourceChange) String() string {
 func (*PlanResourceChange) ProtoMessage() {}
 
 func (x *PlanResourceChange) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin5_proto_msgTypes[13]
+	mi := &file_tfplugin5_proto_msgTypes[15]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -824,7 +930,7 @@ func (x *PlanResourceChange) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use PlanResourceChange.ProtoReflect.Descriptor instead.
 func (*PlanResourceChange) Descriptor() ([]byte, []int) {
-	return file_tfplugin5_proto_rawDescGZIP(), []int{13}
+	return file_tfplugin5_proto_rawDescGZIP(), []int{15}
 }
 
 type ApplyResourceChange struct {
@@ -836,7 +942,7 @@ type ApplyResourceChange struct {
 func (x *ApplyResourceChange) Reset() {
 	*x = ApplyResourceChange{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin5_proto_msgTypes[14]
+		mi := &file_tfplugin5_proto_msgTypes[16]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -849,7 +955,7 @@ func (x *ApplyResourceChange) String() string {
 func (*ApplyResourceChange) ProtoMessage() {}
 
 func (x *ApplyResourceChange) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin5_proto_msgTypes[14]
+	mi := &file_tfplugin5_proto_msgTypes[16]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -862,7 +968,7 @@ func (x *ApplyResourceChange) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ApplyResourceChange.ProtoReflect.Descriptor instead.
 func (*ApplyResourceChange) Descriptor() ([]byte, []int) {
-	return file_tfplugin5_proto_rawDescGZIP(), []int{14}
+	return file_tfplugin5_proto_rawDescGZIP(), []int{16}
 }
 
 type ImportResourceState struct {
@@ -874,7 +980,7 @@ type ImportResourceState struct {
 func (x *ImportResourceState) Reset() {
 	*x = ImportResourceState{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin5_proto_msgTypes[15]
+		mi := &file_tfplugin5_proto_msgTypes[17]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -887,7 +993,7 @@ func (x *ImportResourceState) String() string {
 func (*ImportResourceState) ProtoMessage() {}
 
 func (x *ImportResourceState) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin5_proto_msgTypes[15]
+	mi := &file_tfplugin5_proto_msgTypes[17]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -900,7 +1006,7 @@ func (x *ImportResourceState) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ImportResourceState.ProtoReflect.Descriptor instead.
 func (*ImportResourceState) Descriptor() ([]byte, []int) {
-	return file_tfplugin5_proto_rawDescGZIP(), []int{15}
+	return file_tfplugin5_proto_rawDescGZIP(), []int{17}
 }
 
 type ReadDataSource struct {
@@ -912,7 +1018,7 @@ type ReadDataSource struct {
 func (x *ReadDataSource) Reset() {
 	*x = ReadDataSource{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin5_proto_msgTypes[16]
+		mi := &file_tfplugin5_proto_msgTypes[18]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -925,7 +1031,7 @@ func (x *ReadDataSource) String() string {
 func (*ReadDataSource) ProtoMessage() {}
 
 func (x *ReadDataSource) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin5_proto_msgTypes[16]
+	mi := &file_tfplugin5_proto_msgTypes[18]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -938,7 +1044,7 @@ func (x *ReadDataSource) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ReadDataSource.ProtoReflect.Descriptor instead.
 func (*ReadDataSource) Descriptor() ([]byte, []int) {
-	return file_tfplugin5_proto_rawDescGZIP(), []int{16}
+	return file_tfplugin5_proto_rawDescGZIP(), []int{18}
 }
 
 type GetProvisionerSchema struct {
@@ -950,7 +1056,7 @@ type GetProvisionerSchema struct {
 func (x *GetProvisionerSchema) Reset() {
 	*x = GetProvisionerSchema{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin5_proto_msgTypes[17]
+		mi := &file_tfplugin5_proto_msgTypes[19]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -963,7 +1069,7 @@ func (x *GetProvisionerSchema) String() string {
 func (*GetProvisionerSchema) ProtoMessage() {}
 
 func (x *GetProvisionerSchema) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin5_proto_msgTypes[17]
+	mi := &file_tfplugin5_proto_msgTypes[19]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -976,7 +1082,7 @@ func (x *GetProvisionerSchema) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetProvisionerSchema.ProtoReflect.Descriptor instead.
 func (*GetProvisionerSchema) Descriptor() ([]byte, []int) {
-	return file_tfplugin5_proto_rawDescGZIP(), []int{17}
+	return file_tfplugin5_proto_rawDescGZIP(), []int{19}
 }
 
 type ValidateProvisionerConfig struct {
@@ -988,7 +1094,7 @@ type ValidateProvisionerConfig struct {
 func (x *ValidateProvisionerConfig) Reset() {
 	*x = ValidateProvisionerConfig{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin5_proto_msgTypes[18]
+		mi := &file_tfplugin5_proto_msgTypes[20]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1001,7 +1107,7 @@ func (x *ValidateProvisionerConfig) String() string {
 func (*ValidateProvisionerConfig) ProtoMessage() {}
 
 func (x *ValidateProvisionerConfig) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin5_proto_msgTypes[18]
+	mi := &file_tfplugin5_proto_msgTypes[20]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1014,7 +1120,7 @@ func (x *ValidateProvisionerConfig) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ValidateProvisionerConfig.ProtoReflect.Descriptor instead.
 func (*ValidateProvisionerConfig) Descriptor() ([]byte, []int) {
-	return file_tfplugin5_proto_rawDescGZIP(), []int{18}
+	return file_tfplugin5_proto_rawDescGZIP(), []int{20}
 }
 
 type ProvisionResource struct {
@@ -1026,7 +1132,7 @@ type ProvisionResource struct {
 func (x *ProvisionResource) Reset() {
 	*x = ProvisionResource{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin5_proto_msgTypes[19]
+		mi := &file_tfplugin5_proto_msgTypes[21]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1039,7 +1145,7 @@ func (x *ProvisionResource) String() string {
 func (*ProvisionResource) ProtoMessage() {}
 
 func (x *ProvisionResource) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin5_proto_msgTypes[19]
+	mi := &file_tfplugin5_proto_msgTypes[21]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1052,7 +1158,7 @@ func (x *ProvisionResource) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ProvisionResource.ProtoReflect.Descriptor instead.
 func (*ProvisionResource) Descriptor() ([]byte, []int) {
-	return file_tfplugin5_proto_rawDescGZIP(), []int{19}
+	return file_tfplugin5_proto_rawDescGZIP(), []int{21}
 }
 
 type AttributePath_Step struct {
@@ -1061,6 +1167,7 @@ type AttributePath_Step struct {
 	unknownFields protoimpl.UnknownFields
 
 	// Types that are assignable to Selector:
+	//
 	//	*AttributePath_Step_AttributeName
 	//	*AttributePath_Step_ElementKeyString
 	//	*AttributePath_Step_ElementKeyInt
@@ -1070,7 +1177,7 @@ type AttributePath_Step struct {
 func (x *AttributePath_Step) Reset() {
 	*x = AttributePath_Step{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin5_proto_msgTypes[20]
+		mi := &file_tfplugin5_proto_msgTypes[22]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1083,7 +1190,7 @@ func (x *AttributePath_Step) String() string {
 func (*AttributePath_Step) ProtoMessage() {}
 
 func (x *AttributePath_Step) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin5_proto_msgTypes[20]
+	mi := &file_tfplugin5_proto_msgTypes[22]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1162,7 +1269,7 @@ type Stop_Request struct {
 func (x *Stop_Request) Reset() {
 	*x = Stop_Request{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin5_proto_msgTypes[21]
+		mi := &file_tfplugin5_proto_msgTypes[23]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1175,7 +1282,7 @@ func (x *Stop_Request) String() string {
 func (*Stop_Request) ProtoMessage() {}
 
 func (x *Stop_Request) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin5_proto_msgTypes[21]
+	mi := &file_tfplugin5_proto_msgTypes[23]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1202,7 +1309,7 @@ type Stop_Response struct {
 func (x *Stop_Response) Reset() {
 	*x = Stop_Response{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin5_proto_msgTypes[22]
+		mi := &file_tfplugin5_proto_msgTypes[24]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1215,7 +1322,7 @@ func (x *Stop_Response) String() string {
 func (*Stop_Response) ProtoMessage() {}
 
 func (x *Stop_Response) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin5_proto_msgTypes[22]
+	mi := &file_tfplugin5_proto_msgTypes[24]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1254,7 +1361,7 @@ type Schema_Block struct {
 func (x *Schema_Block) Reset() {
 	*x = Schema_Block{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin5_proto_msgTypes[24]
+		mi := &file_tfplugin5_proto_msgTypes[26]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1267,7 +1374,7 @@ func (x *Schema_Block) String() string {
 func (*Schema_Block) ProtoMessage() {}
 
 func (x *Schema_Block) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin5_proto_msgTypes[24]
+	mi := &file_tfplugin5_proto_msgTypes[26]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1344,7 +1451,7 @@ type Schema_Attribute struct {
 func (x *Schema_Attribute) Reset() {
 	*x = Schema_Attribute{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin5_proto_msgTypes[25]
+		mi := &file_tfplugin5_proto_msgTypes[27]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1357,7 +1464,7 @@ func (x *Schema_Attribute) String() string {
 func (*Schema_Attribute) ProtoMessage() {}
 
 func (x *Schema_Attribute) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin5_proto_msgTypes[25]
+	mi := &file_tfplugin5_proto_msgTypes[27]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1451,7 +1558,7 @@ type Schema_NestedBlock struct {
 func (x *Schema_NestedBlock) Reset() {
 	*x = Schema_NestedBlock{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin5_proto_msgTypes[26]
+		mi := &file_tfplugin5_proto_msgTypes[28]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1464,7 +1571,7 @@ func (x *Schema_NestedBlock) String() string {
 func (*Schema_NestedBlock) ProtoMessage() {}
 
 func (x *Schema_NestedBlock) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin5_proto_msgTypes[26]
+	mi := &file_tfplugin5_proto_msgTypes[28]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1515,29 +1622,29 @@ func (x *Schema_NestedBlock) GetMaxItems() int64 {
 	return 0
 }
 
-type GetProviderSchema_Request struct {
+type GetMetadata_Request struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 }
 
-func (x *GetProviderSchema_Request) Reset() {
-	*x = GetProviderSchema_Request{}
+func (x *GetMetadata_Request) Reset() {
+	*x = GetMetadata_Request{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin5_proto_msgTypes[27]
+		mi := &file_tfplugin5_proto_msgTypes[29]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
 }
 
-func (x *GetProviderSchema_Request) String() string {
+func (x *GetMetadata_Request) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*GetProviderSchema_Request) ProtoMessage() {}
+func (*GetMetadata_Request) ProtoMessage() {}
 
-func (x *GetProviderSchema_Request) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin5_proto_msgTypes[27]
+func (x *GetMetadata_Request) ProtoReflect() protoreflect.Message {
+	mi := &file_tfplugin5_proto_msgTypes[29]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1548,41 +1655,39 @@ func (x *GetProviderSchema_Request) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use GetProviderSchema_Request.ProtoReflect.Descriptor instead.
-func (*GetProviderSchema_Request) Descriptor() ([]byte, []int) {
-	return file_tfplugin5_proto_rawDescGZIP(), []int{6, 0}
+// Deprecated: Use GetMetadata_Request.ProtoReflect.Descriptor instead.
+func (*GetMetadata_Request) Descriptor() ([]byte, []int) {
+	return file_tfplugin5_proto_rawDescGZIP(), []int{7, 0}
 }
 
-type GetProviderSchema_Response struct {
+type GetMetadata_Response struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	Provider           *Schema                               `protobuf:"bytes,1,opt,name=provider,proto3" json:"provider,omitempty"`
-	ResourceSchemas    map[string]*Schema                    `protobuf:"bytes,2,rep,name=resource_schemas,json=resourceSchemas,proto3" json:"resource_schemas,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
-	DataSourceSchemas  map[string]*Schema                    `protobuf:"bytes,3,rep,name=data_source_schemas,json=dataSourceSchemas,proto3" json:"data_source_schemas,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
-	Diagnostics        []*Diagnostic                         `protobuf:"bytes,4,rep,name=diagnostics,proto3" json:"diagnostics,omitempty"`
-	ProviderMeta       *Schema                               `protobuf:"bytes,5,opt,name=provider_meta,json=providerMeta,proto3" json:"provider_meta,omitempty"`
-	ServerCapabilities *GetProviderSchema_ServerCapabilities `protobuf:"bytes,6,opt,name=server_capabilities,json=serverCapabilities,proto3" json:"server_capabilities,omitempty"`
+	ServerCapabilities *ServerCapabilities               `protobuf:"bytes,1,opt,name=server_capabilities,json=serverCapabilities,proto3" json:"server_capabilities,omitempty"`
+	Diagnostics        []*Diagnostic                     `protobuf:"bytes,2,rep,name=diagnostics,proto3" json:"diagnostics,omitempty"`
+	DataSources        []*GetMetadata_DataSourceMetadata `protobuf:"bytes,3,rep,name=data_sources,json=dataSources,proto3" json:"data_sources,omitempty"`
+	Resources          []*GetMetadata_ResourceMetadata   `protobuf:"bytes,4,rep,name=resources,proto3" json:"resources,omitempty"`
 }
 
-func (x *GetProviderSchema_Response) Reset() {
-	*x = GetProviderSchema_Response{}
+func (x *GetMetadata_Response) Reset() {
+	*x = GetMetadata_Response{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin5_proto_msgTypes[28]
+		mi := &file_tfplugin5_proto_msgTypes[30]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
 }
 
-func (x *GetProviderSchema_Response) String() string {
+func (x *GetMetadata_Response) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*GetProviderSchema_Response) ProtoMessage() {}
+func (*GetMetadata_Response) ProtoMessage() {}
 
-func (x *GetProviderSchema_Response) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin5_proto_msgTypes[28]
+func (x *GetMetadata_Response) ProtoReflect() protoreflect.Message {
+	mi := &file_tfplugin5_proto_msgTypes[30]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1593,84 +1698,64 @@ func (x *GetProviderSchema_Response) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use GetProviderSchema_Response.ProtoReflect.Descriptor instead.
-func (*GetProviderSchema_Response) Descriptor() ([]byte, []int) {
-	return file_tfplugin5_proto_rawDescGZIP(), []int{6, 1}
-}
-
-func (x *GetProviderSchema_Response) GetProvider() *Schema {
-	if x != nil {
-		return x.Provider
-	}
-	return nil
-}
-
-func (x *GetProviderSchema_Response) GetResourceSchemas() map[string]*Schema {
-	if x != nil {
-		return x.ResourceSchemas
-	}
-	return nil
+// Deprecated: Use GetMetadata_Response.ProtoReflect.Descriptor instead.
+func (*GetMetadata_Response) Descriptor() ([]byte, []int) {
+	return file_tfplugin5_proto_rawDescGZIP(), []int{7, 1}
 }
 
-func (x *GetProviderSchema_Response) GetDataSourceSchemas() map[string]*Schema {
+func (x *GetMetadata_Response) GetServerCapabilities() *ServerCapabilities {
 	if x != nil {
-		return x.DataSourceSchemas
+		return x.ServerCapabilities
 	}
 	return nil
 }
 
-func (x *GetProviderSchema_Response) GetDiagnostics() []*Diagnostic {
+func (x *GetMetadata_Response) GetDiagnostics() []*Diagnostic {
 	if x != nil {
 		return x.Diagnostics
 	}
 	return nil
 }
 
-func (x *GetProviderSchema_Response) GetProviderMeta() *Schema {
+func (x *GetMetadata_Response) GetDataSources() []*GetMetadata_DataSourceMetadata {
 	if x != nil {
-		return x.ProviderMeta
+		return x.DataSources
 	}
 	return nil
 }
 
-func (x *GetProviderSchema_Response) GetServerCapabilities() *GetProviderSchema_ServerCapabilities {
+func (x *GetMetadata_Response) GetResources() []*GetMetadata_ResourceMetadata {
 	if x != nil {
-		return x.ServerCapabilities
+		return x.Resources
 	}
 	return nil
 }
 
-// ServerCapabilities allows providers to communicate extra information
-// regarding supported protocol features. This is used to indicate
-// availability of certain forward-compatible changes which may be optional
-// in a major protocol version, but cannot be tested for directly.
-type GetProviderSchema_ServerCapabilities struct {
+type GetMetadata_DataSourceMetadata struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	// The plan_destroy capability signals that a provider expects a call
-	// to PlanResourceChange when a resource is going to be destroyed.
-	PlanDestroy bool `protobuf:"varint,1,opt,name=plan_destroy,json=planDestroy,proto3" json:"plan_destroy,omitempty"`
+	TypeName string `protobuf:"bytes,1,opt,name=type_name,json=typeName,proto3" json:"type_name,omitempty"`
 }
 
-func (x *GetProviderSchema_ServerCapabilities) Reset() {
-	*x = GetProviderSchema_ServerCapabilities{}
+func (x *GetMetadata_DataSourceMetadata) Reset() {
+	*x = GetMetadata_DataSourceMetadata{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin5_proto_msgTypes[29]
+		mi := &file_tfplugin5_proto_msgTypes[31]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
 }
 
-func (x *GetProviderSchema_ServerCapabilities) String() string {
+func (x *GetMetadata_DataSourceMetadata) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*GetProviderSchema_ServerCapabilities) ProtoMessage() {}
+func (*GetMetadata_DataSourceMetadata) ProtoMessage() {}
 
-func (x *GetProviderSchema_ServerCapabilities) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin5_proto_msgTypes[29]
+func (x *GetMetadata_DataSourceMetadata) ProtoReflect() protoreflect.Message {
+	mi := &file_tfplugin5_proto_msgTypes[31]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1681,28 +1766,28 @@ func (x *GetProviderSchema_ServerCapabilities) ProtoReflect() protoreflect.Messa
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use GetProviderSchema_ServerCapabilities.ProtoReflect.Descriptor instead.
-func (*GetProviderSchema_ServerCapabilities) Descriptor() ([]byte, []int) {
-	return file_tfplugin5_proto_rawDescGZIP(), []int{6, 2}
+// Deprecated: Use GetMetadata_DataSourceMetadata.ProtoReflect.Descriptor instead.
+func (*GetMetadata_DataSourceMetadata) Descriptor() ([]byte, []int) {
+	return file_tfplugin5_proto_rawDescGZIP(), []int{7, 2}
 }
 
-func (x *GetProviderSchema_ServerCapabilities) GetPlanDestroy() bool {
+func (x *GetMetadata_DataSourceMetadata) GetTypeName() string {
 	if x != nil {
-		return x.PlanDestroy
+		return x.TypeName
 	}
-	return false
+	return ""
 }
 
-type PrepareProviderConfig_Request struct {
+type GetMetadata_ResourceMetadata struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	Config *DynamicValue `protobuf:"bytes,1,opt,name=config,proto3" json:"config,omitempty"`
+	TypeName string `protobuf:"bytes,1,opt,name=type_name,json=typeName,proto3" json:"type_name,omitempty"`
 }
 
-func (x *PrepareProviderConfig_Request) Reset() {
-	*x = PrepareProviderConfig_Request{}
+func (x *GetMetadata_ResourceMetadata) Reset() {
+	*x = GetMetadata_ResourceMetadata{}
 	if protoimpl.UnsafeEnabled {
 		mi := &file_tfplugin5_proto_msgTypes[32]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -1710,13 +1795,13 @@ func (x *PrepareProviderConfig_Request) Reset() {
 	}
 }
 
-func (x *PrepareProviderConfig_Request) String() string {
+func (x *GetMetadata_ResourceMetadata) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*PrepareProviderConfig_Request) ProtoMessage() {}
+func (*GetMetadata_ResourceMetadata) ProtoMessage() {}
 
-func (x *PrepareProviderConfig_Request) ProtoReflect() protoreflect.Message {
+func (x *GetMetadata_ResourceMetadata) ProtoReflect() protoreflect.Message {
 	mi := &file_tfplugin5_proto_msgTypes[32]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -1728,14 +1813,186 @@ func (x *PrepareProviderConfig_Request) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use PrepareProviderConfig_Request.ProtoReflect.Descriptor instead.
-func (*PrepareProviderConfig_Request) Descriptor() ([]byte, []int) {
-	return file_tfplugin5_proto_rawDescGZIP(), []int{7, 0}
+// Deprecated: Use GetMetadata_ResourceMetadata.ProtoReflect.Descriptor instead.
+func (*GetMetadata_ResourceMetadata) Descriptor() ([]byte, []int) {
+	return file_tfplugin5_proto_rawDescGZIP(), []int{7, 3}
 }
 
-func (x *PrepareProviderConfig_Request) GetConfig() *DynamicValue {
+func (x *GetMetadata_ResourceMetadata) GetTypeName() string {
 	if x != nil {
-		return x.Config
+		return x.TypeName
+	}
+	return ""
+}
+
+type GetProviderSchema_Request struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+}
+
+func (x *GetProviderSchema_Request) Reset() {
+	*x = GetProviderSchema_Request{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_tfplugin5_proto_msgTypes[33]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *GetProviderSchema_Request) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetProviderSchema_Request) ProtoMessage() {}
+
+func (x *GetProviderSchema_Request) ProtoReflect() protoreflect.Message {
+	mi := &file_tfplugin5_proto_msgTypes[33]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetProviderSchema_Request.ProtoReflect.Descriptor instead.
+func (*GetProviderSchema_Request) Descriptor() ([]byte, []int) {
+	return file_tfplugin5_proto_rawDescGZIP(), []int{8, 0}
+}
+
+type GetProviderSchema_Response struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Provider           *Schema             `protobuf:"bytes,1,opt,name=provider,proto3" json:"provider,omitempty"`
+	ResourceSchemas    map[string]*Schema  `protobuf:"bytes,2,rep,name=resource_schemas,json=resourceSchemas,proto3" json:"resource_schemas,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+	DataSourceSchemas  map[string]*Schema  `protobuf:"bytes,3,rep,name=data_source_schemas,json=dataSourceSchemas,proto3" json:"data_source_schemas,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+	Diagnostics        []*Diagnostic       `protobuf:"bytes,4,rep,name=diagnostics,proto3" json:"diagnostics,omitempty"`
+	ProviderMeta       *Schema             `protobuf:"bytes,5,opt,name=provider_meta,json=providerMeta,proto3" json:"provider_meta,omitempty"`
+	ServerCapabilities *ServerCapabilities `protobuf:"bytes,6,opt,name=server_capabilities,json=serverCapabilities,proto3" json:"server_capabilities,omitempty"`
+}
+
+func (x *GetProviderSchema_Response) Reset() {
+	*x = GetProviderSchema_Response{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_tfplugin5_proto_msgTypes[34]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *GetProviderSchema_Response) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetProviderSchema_Response) ProtoMessage() {}
+
+func (x *GetProviderSchema_Response) ProtoReflect() protoreflect.Message {
+	mi := &file_tfplugin5_proto_msgTypes[34]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetProviderSchema_Response.ProtoReflect.Descriptor instead.
+func (*GetProviderSchema_Response) Descriptor() ([]byte, []int) {
+	return file_tfplugin5_proto_rawDescGZIP(), []int{8, 1}
+}
+
+func (x *GetProviderSchema_Response) GetProvider() *Schema {
+	if x != nil {
+		return x.Provider
+	}
+	return nil
+}
+
+func (x *GetProviderSchema_Response) GetResourceSchemas() map[string]*Schema {
+	if x != nil {
+		return x.ResourceSchemas
+	}
+	return nil
+}
+
+func (x *GetProviderSchema_Response) GetDataSourceSchemas() map[string]*Schema {
+	if x != nil {
+		return x.DataSourceSchemas
+	}
+	return nil
+}
+
+func (x *GetProviderSchema_Response) GetDiagnostics() []*Diagnostic {
+	if x != nil {
+		return x.Diagnostics
+	}
+	return nil
+}
+
+func (x *GetProviderSchema_Response) GetProviderMeta() *Schema {
+	if x != nil {
+		return x.ProviderMeta
+	}
+	return nil
+}
+
+func (x *GetProviderSchema_Response) GetServerCapabilities() *ServerCapabilities {
+	if x != nil {
+		return x.ServerCapabilities
+	}
+	return nil
+}
+
+type PrepareProviderConfig_Request struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Config *DynamicValue `protobuf:"bytes,1,opt,name=config,proto3" json:"config,omitempty"`
+}
+
+func (x *PrepareProviderConfig_Request) Reset() {
+	*x = PrepareProviderConfig_Request{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_tfplugin5_proto_msgTypes[37]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *PrepareProviderConfig_Request) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PrepareProviderConfig_Request) ProtoMessage() {}
+
+func (x *PrepareProviderConfig_Request) ProtoReflect() protoreflect.Message {
+	mi := &file_tfplugin5_proto_msgTypes[37]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PrepareProviderConfig_Request.ProtoReflect.Descriptor instead.
+func (*PrepareProviderConfig_Request) Descriptor() ([]byte, []int) {
+	return file_tfplugin5_proto_rawDescGZIP(), []int{9, 0}
+}
+
+func (x *PrepareProviderConfig_Request) GetConfig() *DynamicValue {
+	if x != nil {
+		return x.Config
 	}
 	return nil
 }
@@ -1752,7 +2009,7 @@ type PrepareProviderConfig_Response struct {
 func (x *PrepareProviderConfig_Response) Reset() {
 	*x = PrepareProviderConfig_Response{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin5_proto_msgTypes[33]
+		mi := &file_tfplugin5_proto_msgTypes[38]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1765,7 +2022,7 @@ func (x *PrepareProviderConfig_Response) String() string {
 func (*PrepareProviderConfig_Response) ProtoMessage() {}
 
 func (x *PrepareProviderConfig_Response) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin5_proto_msgTypes[33]
+	mi := &file_tfplugin5_proto_msgTypes[38]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1778,7 +2035,7 @@ func (x *PrepareProviderConfig_Response) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use PrepareProviderConfig_Response.ProtoReflect.Descriptor instead.
 func (*PrepareProviderConfig_Response) Descriptor() ([]byte, []int) {
-	return file_tfplugin5_proto_rawDescGZIP(), []int{7, 1}
+	return file_tfplugin5_proto_rawDescGZIP(), []int{9, 1}
 }
 
 func (x *PrepareProviderConfig_Response) GetPreparedConfig() *DynamicValue {
@@ -1823,7 +2080,7 @@ type UpgradeResourceState_Request struct {
 func (x *UpgradeResourceState_Request) Reset() {
 	*x = UpgradeResourceState_Request{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin5_proto_msgTypes[34]
+		mi := &file_tfplugin5_proto_msgTypes[39]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1836,7 +2093,7 @@ func (x *UpgradeResourceState_Request) String() string {
 func (*UpgradeResourceState_Request) ProtoMessage() {}
 
 func (x *UpgradeResourceState_Request) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin5_proto_msgTypes[34]
+	mi := &file_tfplugin5_proto_msgTypes[39]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1849,7 +2106,7 @@ func (x *UpgradeResourceState_Request) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use UpgradeResourceState_Request.ProtoReflect.Descriptor instead.
 func (*UpgradeResourceState_Request) Descriptor() ([]byte, []int) {
-	return file_tfplugin5_proto_rawDescGZIP(), []int{8, 0}
+	return file_tfplugin5_proto_rawDescGZIP(), []int{10, 0}
 }
 
 func (x *UpgradeResourceState_Request) GetTypeName() string {
@@ -1891,7 +2148,7 @@ type UpgradeResourceState_Response struct {
 func (x *UpgradeResourceState_Response) Reset() {
 	*x = UpgradeResourceState_Response{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin5_proto_msgTypes[35]
+		mi := &file_tfplugin5_proto_msgTypes[40]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1904,7 +2161,7 @@ func (x *UpgradeResourceState_Response) String() string {
 func (*UpgradeResourceState_Response) ProtoMessage() {}
 
 func (x *UpgradeResourceState_Response) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin5_proto_msgTypes[35]
+	mi := &file_tfplugin5_proto_msgTypes[40]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1917,7 +2174,7 @@ func (x *UpgradeResourceState_Response) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use UpgradeResourceState_Response.ProtoReflect.Descriptor instead.
 func (*UpgradeResourceState_Response) Descriptor() ([]byte, []int) {
-	return file_tfplugin5_proto_rawDescGZIP(), []int{8, 1}
+	return file_tfplugin5_proto_rawDescGZIP(), []int{10, 1}
 }
 
 func (x *UpgradeResourceState_Response) GetUpgradedState() *DynamicValue {
@@ -1946,7 +2203,7 @@ type ValidateResourceTypeConfig_Request struct {
 func (x *ValidateResourceTypeConfig_Request) Reset() {
 	*x = ValidateResourceTypeConfig_Request{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin5_proto_msgTypes[36]
+		mi := &file_tfplugin5_proto_msgTypes[41]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1959,7 +2216,7 @@ func (x *ValidateResourceTypeConfig_Request) String() string {
 func (*ValidateResourceTypeConfig_Request) ProtoMessage() {}
 
 func (x *ValidateResourceTypeConfig_Request) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin5_proto_msgTypes[36]
+	mi := &file_tfplugin5_proto_msgTypes[41]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1972,7 +2229,7 @@ func (x *ValidateResourceTypeConfig_Request) ProtoReflect() protoreflect.Message
 
 // Deprecated: Use ValidateResourceTypeConfig_Request.ProtoReflect.Descriptor instead.
 func (*ValidateResourceTypeConfig_Request) Descriptor() ([]byte, []int) {
-	return file_tfplugin5_proto_rawDescGZIP(), []int{9, 0}
+	return file_tfplugin5_proto_rawDescGZIP(), []int{11, 0}
 }
 
 func (x *ValidateResourceTypeConfig_Request) GetTypeName() string {
@@ -2000,7 +2257,7 @@ type ValidateResourceTypeConfig_Response struct {
 func (x *ValidateResourceTypeConfig_Response) Reset() {
 	*x = ValidateResourceTypeConfig_Response{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin5_proto_msgTypes[37]
+		mi := &file_tfplugin5_proto_msgTypes[42]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2013,7 +2270,7 @@ func (x *ValidateResourceTypeConfig_Response) String() string {
 func (*ValidateResourceTypeConfig_Response) ProtoMessage() {}
 
 func (x *ValidateResourceTypeConfig_Response) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin5_proto_msgTypes[37]
+	mi := &file_tfplugin5_proto_msgTypes[42]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2026,7 +2283,7 @@ func (x *ValidateResourceTypeConfig_Response) ProtoReflect() protoreflect.Messag
 
 // Deprecated: Use ValidateResourceTypeConfig_Response.ProtoReflect.Descriptor instead.
 func (*ValidateResourceTypeConfig_Response) Descriptor() ([]byte, []int) {
-	return file_tfplugin5_proto_rawDescGZIP(), []int{9, 1}
+	return file_tfplugin5_proto_rawDescGZIP(), []int{11, 1}
 }
 
 func (x *ValidateResourceTypeConfig_Response) GetDiagnostics() []*Diagnostic {
@@ -2048,7 +2305,7 @@ type ValidateDataSourceConfig_Request struct {
 func (x *ValidateDataSourceConfig_Request) Reset() {
 	*x = ValidateDataSourceConfig_Request{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin5_proto_msgTypes[38]
+		mi := &file_tfplugin5_proto_msgTypes[43]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2061,7 +2318,7 @@ func (x *ValidateDataSourceConfig_Request) String() string {
 func (*ValidateDataSourceConfig_Request) ProtoMessage() {}
 
 func (x *ValidateDataSourceConfig_Request) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin5_proto_msgTypes[38]
+	mi := &file_tfplugin5_proto_msgTypes[43]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2074,7 +2331,7 @@ func (x *ValidateDataSourceConfig_Request) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ValidateDataSourceConfig_Request.ProtoReflect.Descriptor instead.
 func (*ValidateDataSourceConfig_Request) Descriptor() ([]byte, []int) {
-	return file_tfplugin5_proto_rawDescGZIP(), []int{10, 0}
+	return file_tfplugin5_proto_rawDescGZIP(), []int{12, 0}
 }
 
 func (x *ValidateDataSourceConfig_Request) GetTypeName() string {
@@ -2102,7 +2359,7 @@ type ValidateDataSourceConfig_Response struct {
 func (x *ValidateDataSourceConfig_Response) Reset() {
 	*x = ValidateDataSourceConfig_Response{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin5_proto_msgTypes[39]
+		mi := &file_tfplugin5_proto_msgTypes[44]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2115,7 +2372,7 @@ func (x *ValidateDataSourceConfig_Response) String() string {
 func (*ValidateDataSourceConfig_Response) ProtoMessage() {}
 
 func (x *ValidateDataSourceConfig_Response) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin5_proto_msgTypes[39]
+	mi := &file_tfplugin5_proto_msgTypes[44]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2128,7 +2385,7 @@ func (x *ValidateDataSourceConfig_Response) ProtoReflect() protoreflect.Message
 
 // Deprecated: Use ValidateDataSourceConfig_Response.ProtoReflect.Descriptor instead.
 func (*ValidateDataSourceConfig_Response) Descriptor() ([]byte, []int) {
-	return file_tfplugin5_proto_rawDescGZIP(), []int{10, 1}
+	return file_tfplugin5_proto_rawDescGZIP(), []int{12, 1}
 }
 
 func (x *ValidateDataSourceConfig_Response) GetDiagnostics() []*Diagnostic {
@@ -2150,7 +2407,7 @@ type Configure_Request struct {
 func (x *Configure_Request) Reset() {
 	*x = Configure_Request{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin5_proto_msgTypes[40]
+		mi := &file_tfplugin5_proto_msgTypes[45]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2163,7 +2420,7 @@ func (x *Configure_Request) String() string {
 func (*Configure_Request) ProtoMessage() {}
 
 func (x *Configure_Request) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin5_proto_msgTypes[40]
+	mi := &file_tfplugin5_proto_msgTypes[45]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2176,7 +2433,7 @@ func (x *Configure_Request) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use Configure_Request.ProtoReflect.Descriptor instead.
 func (*Configure_Request) Descriptor() ([]byte, []int) {
-	return file_tfplugin5_proto_rawDescGZIP(), []int{11, 0}
+	return file_tfplugin5_proto_rawDescGZIP(), []int{13, 0}
 }
 
 func (x *Configure_Request) GetTerraformVersion() string {
@@ -2204,7 +2461,7 @@ type Configure_Response struct {
 func (x *Configure_Response) Reset() {
 	*x = Configure_Response{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin5_proto_msgTypes[41]
+		mi := &file_tfplugin5_proto_msgTypes[46]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2217,7 +2474,7 @@ func (x *Configure_Response) String() string {
 func (*Configure_Response) ProtoMessage() {}
 
 func (x *Configure_Response) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin5_proto_msgTypes[41]
+	mi := &file_tfplugin5_proto_msgTypes[46]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2230,7 +2487,7 @@ func (x *Configure_Response) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use Configure_Response.ProtoReflect.Descriptor instead.
 func (*Configure_Response) Descriptor() ([]byte, []int) {
-	return file_tfplugin5_proto_rawDescGZIP(), []int{11, 1}
+	return file_tfplugin5_proto_rawDescGZIP(), []int{13, 1}
 }
 
 func (x *Configure_Response) GetDiagnostics() []*Diagnostic {
@@ -2262,7 +2519,7 @@ type ReadResource_Request struct {
 func (x *ReadResource_Request) Reset() {
 	*x = ReadResource_Request{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin5_proto_msgTypes[42]
+		mi := &file_tfplugin5_proto_msgTypes[47]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2275,7 +2532,7 @@ func (x *ReadResource_Request) String() string {
 func (*ReadResource_Request) ProtoMessage() {}
 
 func (x *ReadResource_Request) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin5_proto_msgTypes[42]
+	mi := &file_tfplugin5_proto_msgTypes[47]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2288,7 +2545,7 @@ func (x *ReadResource_Request) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ReadResource_Request.ProtoReflect.Descriptor instead.
 func (*ReadResource_Request) Descriptor() ([]byte, []int) {
-	return file_tfplugin5_proto_rawDescGZIP(), []int{12, 0}
+	return file_tfplugin5_proto_rawDescGZIP(), []int{14, 0}
 }
 
 func (x *ReadResource_Request) GetTypeName() string {
@@ -2332,7 +2589,7 @@ type ReadResource_Response struct {
 func (x *ReadResource_Response) Reset() {
 	*x = ReadResource_Response{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin5_proto_msgTypes[43]
+		mi := &file_tfplugin5_proto_msgTypes[48]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2345,7 +2602,7 @@ func (x *ReadResource_Response) String() string {
 func (*ReadResource_Response) ProtoMessage() {}
 
 func (x *ReadResource_Response) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin5_proto_msgTypes[43]
+	mi := &file_tfplugin5_proto_msgTypes[48]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2358,7 +2615,7 @@ func (x *ReadResource_Response) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ReadResource_Response.ProtoReflect.Descriptor instead.
 func (*ReadResource_Response) Descriptor() ([]byte, []int) {
-	return file_tfplugin5_proto_rawDescGZIP(), []int{12, 1}
+	return file_tfplugin5_proto_rawDescGZIP(), []int{14, 1}
 }
 
 func (x *ReadResource_Response) GetNewState() *DynamicValue {
@@ -2398,7 +2655,7 @@ type PlanResourceChange_Request struct {
 func (x *PlanResourceChange_Request) Reset() {
 	*x = PlanResourceChange_Request{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin5_proto_msgTypes[44]
+		mi := &file_tfplugin5_proto_msgTypes[49]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2411,7 +2668,7 @@ func (x *PlanResourceChange_Request) String() string {
 func (*PlanResourceChange_Request) ProtoMessage() {}
 
 func (x *PlanResourceChange_Request) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin5_proto_msgTypes[44]
+	mi := &file_tfplugin5_proto_msgTypes[49]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2424,7 +2681,7 @@ func (x *PlanResourceChange_Request) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use PlanResourceChange_Request.ProtoReflect.Descriptor instead.
 func (*PlanResourceChange_Request) Descriptor() ([]byte, []int) {
-	return file_tfplugin5_proto_rawDescGZIP(), []int{13, 0}
+	return file_tfplugin5_proto_rawDescGZIP(), []int{15, 0}
 }
 
 func (x *PlanResourceChange_Request) GetTypeName() string {
@@ -2486,16 +2743,16 @@ type PlanResourceChange_Response struct {
 	// specific details of the legacy SDK type system, and are not a general
 	// mechanism to avoid proper type handling in providers.
 	//
-	//     ====              DO NOT USE THIS              ====
-	//     ==== THIS MUST BE LEFT UNSET IN ALL OTHER SDKS ====
-	//     ====              DO NOT USE THIS              ====
+	//	====              DO NOT USE THIS              ====
+	//	==== THIS MUST BE LEFT UNSET IN ALL OTHER SDKS ====
+	//	====              DO NOT USE THIS              ====
 	LegacyTypeSystem bool `protobuf:"varint,5,opt,name=legacy_type_system,json=legacyTypeSystem,proto3" json:"legacy_type_system,omitempty"`
 }
 
 func (x *PlanResourceChange_Response) Reset() {
 	*x = PlanResourceChange_Response{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin5_proto_msgTypes[45]
+		mi := &file_tfplugin5_proto_msgTypes[50]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2508,7 +2765,7 @@ func (x *PlanResourceChange_Response) String() string {
 func (*PlanResourceChange_Response) ProtoMessage() {}
 
 func (x *PlanResourceChange_Response) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin5_proto_msgTypes[45]
+	mi := &file_tfplugin5_proto_msgTypes[50]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2521,7 +2778,7 @@ func (x *PlanResourceChange_Response) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use PlanResourceChange_Response.ProtoReflect.Descriptor instead.
 func (*PlanResourceChange_Response) Descriptor() ([]byte, []int) {
-	return file_tfplugin5_proto_rawDescGZIP(), []int{13, 1}
+	return file_tfplugin5_proto_rawDescGZIP(), []int{15, 1}
 }
 
 func (x *PlanResourceChange_Response) GetPlannedState() *DynamicValue {
@@ -2575,7 +2832,7 @@ type ApplyResourceChange_Request struct {
 func (x *ApplyResourceChange_Request) Reset() {
 	*x = ApplyResourceChange_Request{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin5_proto_msgTypes[46]
+		mi := &file_tfplugin5_proto_msgTypes[51]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2588,7 +2845,7 @@ func (x *ApplyResourceChange_Request) String() string {
 func (*ApplyResourceChange_Request) ProtoMessage() {}
 
 func (x *ApplyResourceChange_Request) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin5_proto_msgTypes[46]
+	mi := &file_tfplugin5_proto_msgTypes[51]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2601,7 +2858,7 @@ func (x *ApplyResourceChange_Request) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ApplyResourceChange_Request.ProtoReflect.Descriptor instead.
 func (*ApplyResourceChange_Request) Descriptor() ([]byte, []int) {
-	return file_tfplugin5_proto_rawDescGZIP(), []int{14, 0}
+	return file_tfplugin5_proto_rawDescGZIP(), []int{16, 0}
 }
 
 func (x *ApplyResourceChange_Request) GetTypeName() string {
@@ -2662,16 +2919,16 @@ type ApplyResourceChange_Response struct {
 	// specific details of the legacy SDK type system, and are not a general
 	// mechanism to avoid proper type handling in providers.
 	//
-	//     ====              DO NOT USE THIS              ====
-	//     ==== THIS MUST BE LEFT UNSET IN ALL OTHER SDKS ====
-	//     ====              DO NOT USE THIS              ====
+	//	====              DO NOT USE THIS              ====
+	//	==== THIS MUST BE LEFT UNSET IN ALL OTHER SDKS ====
+	//	====              DO NOT USE THIS              ====
 	LegacyTypeSystem bool `protobuf:"varint,4,opt,name=legacy_type_system,json=legacyTypeSystem,proto3" json:"legacy_type_system,omitempty"`
 }
 
 func (x *ApplyResourceChange_Response) Reset() {
 	*x = ApplyResourceChange_Response{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin5_proto_msgTypes[47]
+		mi := &file_tfplugin5_proto_msgTypes[52]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2684,7 +2941,7 @@ func (x *ApplyResourceChange_Response) String() string {
 func (*ApplyResourceChange_Response) ProtoMessage() {}
 
 func (x *ApplyResourceChange_Response) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin5_proto_msgTypes[47]
+	mi := &file_tfplugin5_proto_msgTypes[52]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2697,7 +2954,7 @@ func (x *ApplyResourceChange_Response) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ApplyResourceChange_Response.ProtoReflect.Descriptor instead.
 func (*ApplyResourceChange_Response) Descriptor() ([]byte, []int) {
-	return file_tfplugin5_proto_rawDescGZIP(), []int{14, 1}
+	return file_tfplugin5_proto_rawDescGZIP(), []int{16, 1}
 }
 
 func (x *ApplyResourceChange_Response) GetNewState() *DynamicValue {
@@ -2740,7 +2997,7 @@ type ImportResourceState_Request struct {
 func (x *ImportResourceState_Request) Reset() {
 	*x = ImportResourceState_Request{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin5_proto_msgTypes[48]
+		mi := &file_tfplugin5_proto_msgTypes[53]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2753,7 +3010,7 @@ func (x *ImportResourceState_Request) String() string {
 func (*ImportResourceState_Request) ProtoMessage() {}
 
 func (x *ImportResourceState_Request) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin5_proto_msgTypes[48]
+	mi := &file_tfplugin5_proto_msgTypes[53]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2766,7 +3023,7 @@ func (x *ImportResourceState_Request) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ImportResourceState_Request.ProtoReflect.Descriptor instead.
 func (*ImportResourceState_Request) Descriptor() ([]byte, []int) {
-	return file_tfplugin5_proto_rawDescGZIP(), []int{15, 0}
+	return file_tfplugin5_proto_rawDescGZIP(), []int{17, 0}
 }
 
 func (x *ImportResourceState_Request) GetTypeName() string {
@@ -2796,7 +3053,7 @@ type ImportResourceState_ImportedResource struct {
 func (x *ImportResourceState_ImportedResource) Reset() {
 	*x = ImportResourceState_ImportedResource{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin5_proto_msgTypes[49]
+		mi := &file_tfplugin5_proto_msgTypes[54]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2809,7 +3066,7 @@ func (x *ImportResourceState_ImportedResource) String() string {
 func (*ImportResourceState_ImportedResource) ProtoMessage() {}
 
 func (x *ImportResourceState_ImportedResource) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin5_proto_msgTypes[49]
+	mi := &file_tfplugin5_proto_msgTypes[54]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2822,7 +3079,7 @@ func (x *ImportResourceState_ImportedResource) ProtoReflect() protoreflect.Messa
 
 // Deprecated: Use ImportResourceState_ImportedResource.ProtoReflect.Descriptor instead.
 func (*ImportResourceState_ImportedResource) Descriptor() ([]byte, []int) {
-	return file_tfplugin5_proto_rawDescGZIP(), []int{15, 1}
+	return file_tfplugin5_proto_rawDescGZIP(), []int{17, 1}
 }
 
 func (x *ImportResourceState_ImportedResource) GetTypeName() string {
@@ -2858,7 +3115,7 @@ type ImportResourceState_Response struct {
 func (x *ImportResourceState_Response) Reset() {
 	*x = ImportResourceState_Response{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin5_proto_msgTypes[50]
+		mi := &file_tfplugin5_proto_msgTypes[55]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2871,7 +3128,7 @@ func (x *ImportResourceState_Response) String() string {
 func (*ImportResourceState_Response) ProtoMessage() {}
 
 func (x *ImportResourceState_Response) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin5_proto_msgTypes[50]
+	mi := &file_tfplugin5_proto_msgTypes[55]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2884,7 +3141,7 @@ func (x *ImportResourceState_Response) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ImportResourceState_Response.ProtoReflect.Descriptor instead.
 func (*ImportResourceState_Response) Descriptor() ([]byte, []int) {
-	return file_tfplugin5_proto_rawDescGZIP(), []int{15, 2}
+	return file_tfplugin5_proto_rawDescGZIP(), []int{17, 2}
 }
 
 func (x *ImportResourceState_Response) GetImportedResources() []*ImportResourceState_ImportedResource {
@@ -2914,7 +3171,7 @@ type ReadDataSource_Request struct {
 func (x *ReadDataSource_Request) Reset() {
 	*x = ReadDataSource_Request{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin5_proto_msgTypes[51]
+		mi := &file_tfplugin5_proto_msgTypes[56]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2927,7 +3184,7 @@ func (x *ReadDataSource_Request) String() string {
 func (*ReadDataSource_Request) ProtoMessage() {}
 
 func (x *ReadDataSource_Request) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin5_proto_msgTypes[51]
+	mi := &file_tfplugin5_proto_msgTypes[56]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2940,7 +3197,7 @@ func (x *ReadDataSource_Request) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ReadDataSource_Request.ProtoReflect.Descriptor instead.
 func (*ReadDataSource_Request) Descriptor() ([]byte, []int) {
-	return file_tfplugin5_proto_rawDescGZIP(), []int{16, 0}
+	return file_tfplugin5_proto_rawDescGZIP(), []int{18, 0}
 }
 
 func (x *ReadDataSource_Request) GetTypeName() string {
@@ -2976,7 +3233,7 @@ type ReadDataSource_Response struct {
 func (x *ReadDataSource_Response) Reset() {
 	*x = ReadDataSource_Response{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin5_proto_msgTypes[52]
+		mi := &file_tfplugin5_proto_msgTypes[57]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2989,7 +3246,7 @@ func (x *ReadDataSource_Response) String() string {
 func (*ReadDataSource_Response) ProtoMessage() {}
 
 func (x *ReadDataSource_Response) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin5_proto_msgTypes[52]
+	mi := &file_tfplugin5_proto_msgTypes[57]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3002,7 +3259,7 @@ func (x *ReadDataSource_Response) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ReadDataSource_Response.ProtoReflect.Descriptor instead.
 func (*ReadDataSource_Response) Descriptor() ([]byte, []int) {
-	return file_tfplugin5_proto_rawDescGZIP(), []int{16, 1}
+	return file_tfplugin5_proto_rawDescGZIP(), []int{18, 1}
 }
 
 func (x *ReadDataSource_Response) GetState() *DynamicValue {
@@ -3028,7 +3285,7 @@ type GetProvisionerSchema_Request struct {
 func (x *GetProvisionerSchema_Request) Reset() {
 	*x = GetProvisionerSchema_Request{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin5_proto_msgTypes[53]
+		mi := &file_tfplugin5_proto_msgTypes[58]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -3041,7 +3298,7 @@ func (x *GetProvisionerSchema_Request) String() string {
 func (*GetProvisionerSchema_Request) ProtoMessage() {}
 
 func (x *GetProvisionerSchema_Request) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin5_proto_msgTypes[53]
+	mi := &file_tfplugin5_proto_msgTypes[58]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3054,7 +3311,7 @@ func (x *GetProvisionerSchema_Request) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetProvisionerSchema_Request.ProtoReflect.Descriptor instead.
 func (*GetProvisionerSchema_Request) Descriptor() ([]byte, []int) {
-	return file_tfplugin5_proto_rawDescGZIP(), []int{17, 0}
+	return file_tfplugin5_proto_rawDescGZIP(), []int{19, 0}
 }
 
 type GetProvisionerSchema_Response struct {
@@ -3069,7 +3326,7 @@ type GetProvisionerSchema_Response struct {
 func (x *GetProvisionerSchema_Response) Reset() {
 	*x = GetProvisionerSchema_Response{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin5_proto_msgTypes[54]
+		mi := &file_tfplugin5_proto_msgTypes[59]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -3082,7 +3339,7 @@ func (x *GetProvisionerSchema_Response) String() string {
 func (*GetProvisionerSchema_Response) ProtoMessage() {}
 
 func (x *GetProvisionerSchema_Response) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin5_proto_msgTypes[54]
+	mi := &file_tfplugin5_proto_msgTypes[59]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3095,7 +3352,7 @@ func (x *GetProvisionerSchema_Response) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetProvisionerSchema_Response.ProtoReflect.Descriptor instead.
 func (*GetProvisionerSchema_Response) Descriptor() ([]byte, []int) {
-	return file_tfplugin5_proto_rawDescGZIP(), []int{17, 1}
+	return file_tfplugin5_proto_rawDescGZIP(), []int{19, 1}
 }
 
 func (x *GetProvisionerSchema_Response) GetProvisioner() *Schema {
@@ -3123,7 +3380,7 @@ type ValidateProvisionerConfig_Request struct {
 func (x *ValidateProvisionerConfig_Request) Reset() {
 	*x = ValidateProvisionerConfig_Request{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin5_proto_msgTypes[55]
+		mi := &file_tfplugin5_proto_msgTypes[60]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -3136,7 +3393,7 @@ func (x *ValidateProvisionerConfig_Request) String() string {
 func (*ValidateProvisionerConfig_Request) ProtoMessage() {}
 
 func (x *ValidateProvisionerConfig_Request) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin5_proto_msgTypes[55]
+	mi := &file_tfplugin5_proto_msgTypes[60]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3149,7 +3406,7 @@ func (x *ValidateProvisionerConfig_Request) ProtoReflect() protoreflect.Message
 
 // Deprecated: Use ValidateProvisionerConfig_Request.ProtoReflect.Descriptor instead.
 func (*ValidateProvisionerConfig_Request) Descriptor() ([]byte, []int) {
-	return file_tfplugin5_proto_rawDescGZIP(), []int{18, 0}
+	return file_tfplugin5_proto_rawDescGZIP(), []int{20, 0}
 }
 
 func (x *ValidateProvisionerConfig_Request) GetConfig() *DynamicValue {
@@ -3170,7 +3427,7 @@ type ValidateProvisionerConfig_Response struct {
 func (x *ValidateProvisionerConfig_Response) Reset() {
 	*x = ValidateProvisionerConfig_Response{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin5_proto_msgTypes[56]
+		mi := &file_tfplugin5_proto_msgTypes[61]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -3183,7 +3440,7 @@ func (x *ValidateProvisionerConfig_Response) String() string {
 func (*ValidateProvisionerConfig_Response) ProtoMessage() {}
 
 func (x *ValidateProvisionerConfig_Response) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin5_proto_msgTypes[56]
+	mi := &file_tfplugin5_proto_msgTypes[61]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3196,7 +3453,7 @@ func (x *ValidateProvisionerConfig_Response) ProtoReflect() protoreflect.Message
 
 // Deprecated: Use ValidateProvisionerConfig_Response.ProtoReflect.Descriptor instead.
 func (*ValidateProvisionerConfig_Response) Descriptor() ([]byte, []int) {
-	return file_tfplugin5_proto_rawDescGZIP(), []int{18, 1}
+	return file_tfplugin5_proto_rawDescGZIP(), []int{20, 1}
 }
 
 func (x *ValidateProvisionerConfig_Response) GetDiagnostics() []*Diagnostic {
@@ -3218,7 +3475,7 @@ type ProvisionResource_Request struct {
 func (x *ProvisionResource_Request) Reset() {
 	*x = ProvisionResource_Request{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin5_proto_msgTypes[57]
+		mi := &file_tfplugin5_proto_msgTypes[62]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -3231,7 +3488,7 @@ func (x *ProvisionResource_Request) String() string {
 func (*ProvisionResource_Request) ProtoMessage() {}
 
 func (x *ProvisionResource_Request) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin5_proto_msgTypes[57]
+	mi := &file_tfplugin5_proto_msgTypes[62]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3244,7 +3501,7 @@ func (x *ProvisionResource_Request) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ProvisionResource_Request.ProtoReflect.Descriptor instead.
 func (*ProvisionResource_Request) Descriptor() ([]byte, []int) {
-	return file_tfplugin5_proto_rawDescGZIP(), []int{19, 0}
+	return file_tfplugin5_proto_rawDescGZIP(), []int{21, 0}
 }
 
 func (x *ProvisionResource_Request) GetConfig() *DynamicValue {
@@ -3273,7 +3530,7 @@ type ProvisionResource_Response struct {
 func (x *ProvisionResource_Response) Reset() {
 	*x = ProvisionResource_Response{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin5_proto_msgTypes[58]
+		mi := &file_tfplugin5_proto_msgTypes[63]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -3286,7 +3543,7 @@ func (x *ProvisionResource_Response) String() string {
 func (*ProvisionResource_Response) ProtoMessage() {}
 
 func (x *ProvisionResource_Response) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin5_proto_msgTypes[58]
+	mi := &file_tfplugin5_proto_msgTypes[63]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3299,7 +3556,7 @@ func (x *ProvisionResource_Response) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ProvisionResource_Response.ProtoReflect.Descriptor instead.
 func (*ProvisionResource_Response) Descriptor() ([]byte, []int) {
-	return file_tfplugin5_proto_rawDescGZIP(), []int{19, 1}
+	return file_tfplugin5_proto_rawDescGZIP(), []int{21, 1}
 }
 
 func (x *ProvisionResource_Response) GetOutput() string {
@@ -3426,396 +3683,431 @@ var file_tfplugin5_proto_rawDesc = []byte{
 	0x49, 0x4e, 0x56, 0x41, 0x4c, 0x49, 0x44, 0x10, 0x00, 0x12, 0x0a, 0x0a, 0x06, 0x53, 0x49, 0x4e,
 	0x47, 0x4c, 0x45, 0x10, 0x01, 0x12, 0x08, 0x0a, 0x04, 0x4c, 0x49, 0x53, 0x54, 0x10, 0x02, 0x12,
 	0x07, 0x0a, 0x03, 0x53, 0x45, 0x54, 0x10, 0x03, 0x12, 0x07, 0x0a, 0x03, 0x4d, 0x41, 0x50, 0x10,
-	0x04, 0x12, 0x09, 0x0a, 0x05, 0x47, 0x52, 0x4f, 0x55, 0x50, 0x10, 0x05, 0x22, 0xeb, 0x05, 0x0a,
-	0x11, 0x47, 0x65, 0x74, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x53, 0x63, 0x68, 0x65,
-	0x6d, 0x61, 0x1a, 0x09, 0x0a, 0x07, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x91, 0x05,
-	0x0a, 0x08, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x2d, 0x0a, 0x08, 0x70, 0x72,
-	0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x11, 0x2e, 0x74,
-	0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x53, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x52,
-	0x08, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x12, 0x65, 0x0a, 0x10, 0x72, 0x65, 0x73,
-	0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x73, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x73, 0x18, 0x02, 0x20,
-	0x03, 0x28, 0x0b, 0x32, 0x3a, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e,
-	0x47, 0x65, 0x74, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x53, 0x63, 0x68, 0x65, 0x6d,
-	0x61, 0x2e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75,
-	0x72, 0x63, 0x65, 0x53, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52,
-	0x0f, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x53, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x73,
-	0x12, 0x6c, 0x0a, 0x13, 0x64, 0x61, 0x74, 0x61, 0x5f, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f,
-	0x73, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x3c, 0x2e,
-	0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x47, 0x65, 0x74, 0x50, 0x72, 0x6f,
-	0x76, 0x69, 0x64, 0x65, 0x72, 0x53, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x2e, 0x52, 0x65, 0x73, 0x70,
-	0x6f, 0x6e, 0x73, 0x65, 0x2e, 0x44, 0x61, 0x74, 0x61, 0x53, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x53,
-	0x63, 0x68, 0x65, 0x6d, 0x61, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x11, 0x64, 0x61, 0x74,
-	0x61, 0x53, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x53, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x73, 0x12, 0x37,
-	0x0a, 0x0b, 0x64, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x73, 0x18, 0x04, 0x20,
+	0x04, 0x12, 0x09, 0x0a, 0x05, 0x47, 0x52, 0x4f, 0x55, 0x50, 0x10, 0x05, 0x22, 0x78, 0x0a, 0x12,
+	0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x43, 0x61, 0x70, 0x61, 0x62, 0x69, 0x6c, 0x69, 0x74, 0x69,
+	0x65, 0x73, 0x12, 0x21, 0x0a, 0x0c, 0x70, 0x6c, 0x61, 0x6e, 0x5f, 0x64, 0x65, 0x73, 0x74, 0x72,
+	0x6f, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0b, 0x70, 0x6c, 0x61, 0x6e, 0x44, 0x65,
+	0x73, 0x74, 0x72, 0x6f, 0x79, 0x12, 0x3f, 0x0a, 0x1c, 0x67, 0x65, 0x74, 0x5f, 0x70, 0x72, 0x6f,
+	0x76, 0x69, 0x64, 0x65, 0x72, 0x5f, 0x73, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x5f, 0x6f, 0x70, 0x74,
+	0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x19, 0x67, 0x65, 0x74,
+	0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x53, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x4f, 0x70,
+	0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x22, 0xa7, 0x03, 0x0a, 0x0b, 0x47, 0x65, 0x74, 0x4d, 0x65,
+	0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x1a, 0x09, 0x0a, 0x07, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
+	0x74, 0x1a, 0xa8, 0x02, 0x0a, 0x08, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x4e,
+	0x0a, 0x13, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x5f, 0x63, 0x61, 0x70, 0x61, 0x62, 0x69, 0x6c,
+	0x69, 0x74, 0x69, 0x65, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x74, 0x66,
+	0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x43, 0x61,
+	0x70, 0x61, 0x62, 0x69, 0x6c, 0x69, 0x74, 0x69, 0x65, 0x73, 0x52, 0x12, 0x73, 0x65, 0x72, 0x76,
+	0x65, 0x72, 0x43, 0x61, 0x70, 0x61, 0x62, 0x69, 0x6c, 0x69, 0x74, 0x69, 0x65, 0x73, 0x12, 0x37,
+	0x0a, 0x0b, 0x64, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x73, 0x18, 0x02, 0x20,
 	0x03, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e,
 	0x44, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x52, 0x0b, 0x64, 0x69, 0x61, 0x67,
-	0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x73, 0x12, 0x36, 0x0a, 0x0d, 0x70, 0x72, 0x6f, 0x76, 0x69,
-	0x64, 0x65, 0x72, 0x5f, 0x6d, 0x65, 0x74, 0x61, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x11,
-	0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x53, 0x63, 0x68, 0x65, 0x6d,
-	0x61, 0x52, 0x0c, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x4d, 0x65, 0x74, 0x61, 0x12,
-	0x60, 0x0a, 0x13, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x5f, 0x63, 0x61, 0x70, 0x61, 0x62, 0x69,
-	0x6c, 0x69, 0x74, 0x69, 0x65, 0x73, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2f, 0x2e, 0x74,
-	0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x47, 0x65, 0x74, 0x50, 0x72, 0x6f, 0x76,
-	0x69, 0x64, 0x65, 0x72, 0x53, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x2e, 0x53, 0x65, 0x72, 0x76, 0x65,
-	0x72, 0x43, 0x61, 0x70, 0x61, 0x62, 0x69, 0x6c, 0x69, 0x74, 0x69, 0x65, 0x73, 0x52, 0x12, 0x73,
-	0x65, 0x72, 0x76, 0x65, 0x72, 0x43, 0x61, 0x70, 0x61, 0x62, 0x69, 0x6c, 0x69, 0x74, 0x69, 0x65,
-	0x73, 0x1a, 0x55, 0x0a, 0x14, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x53, 0x63, 0x68,
-	0x65, 0x6d, 0x61, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79,
-	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x27, 0x0a, 0x05, 0x76,
-	0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x11, 0x2e, 0x74, 0x66, 0x70,
-	0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x53, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x52, 0x05, 0x76,
-	0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x1a, 0x57, 0x0a, 0x16, 0x44, 0x61, 0x74, 0x61,
-	0x53, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x53, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x73, 0x45, 0x6e, 0x74,
-	0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x03, 0x6b, 0x65, 0x79, 0x12, 0x27, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20,
-	0x01, 0x28, 0x0b, 0x32, 0x11, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e,
-	0x53, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38,
-	0x01, 0x1a, 0x37, 0x0a, 0x12, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x43, 0x61, 0x70, 0x61, 0x62,
-	0x69, 0x6c, 0x69, 0x74, 0x69, 0x65, 0x73, 0x12, 0x21, 0x0a, 0x0c, 0x70, 0x6c, 0x61, 0x6e, 0x5f,
-	0x64, 0x65, 0x73, 0x74, 0x72, 0x6f, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0b, 0x70,
-	0x6c, 0x61, 0x6e, 0x44, 0x65, 0x73, 0x74, 0x72, 0x6f, 0x79, 0x22, 0xdb, 0x01, 0x0a, 0x15, 0x50,
-	0x72, 0x65, 0x70, 0x61, 0x72, 0x65, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x43, 0x6f,
-	0x6e, 0x66, 0x69, 0x67, 0x1a, 0x3a, 0x0a, 0x07, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12,
-	0x2f, 0x0a, 0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32,
-	0x17, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x44, 0x79, 0x6e, 0x61,
-	0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67,
-	0x1a, 0x85, 0x01, 0x0a, 0x08, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x40, 0x0a,
-	0x0f, 0x70, 0x72, 0x65, 0x70, 0x61, 0x72, 0x65, 0x64, 0x5f, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67,
-	0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69,
-	0x6e, 0x35, 0x2e, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52,
-	0x0e, 0x70, 0x72, 0x65, 0x70, 0x61, 0x72, 0x65, 0x64, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12,
-	0x37, 0x0a, 0x0b, 0x64, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x73, 0x18, 0x02,
-	0x20, 0x03, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35,
-	0x2e, 0x44, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x52, 0x0b, 0x64, 0x69, 0x61,
-	0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x73, 0x22, 0x90, 0x02, 0x0a, 0x14, 0x55, 0x70, 0x67,
-	0x72, 0x61, 0x64, 0x65, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x53, 0x74, 0x61, 0x74,
-	0x65, 0x1a, 0x72, 0x0a, 0x07, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1b, 0x0a, 0x09,
-	0x74, 0x79, 0x70, 0x65, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x08, 0x74, 0x79, 0x70, 0x65, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x76, 0x65, 0x72,
-	0x73, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x03, 0x52, 0x07, 0x76, 0x65, 0x72, 0x73,
-	0x69, 0x6f, 0x6e, 0x12, 0x30, 0x0a, 0x09, 0x72, 0x61, 0x77, 0x5f, 0x73, 0x74, 0x61, 0x74, 0x65,
-	0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x13, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69,
-	0x6e, 0x35, 0x2e, 0x52, 0x61, 0x77, 0x53, 0x74, 0x61, 0x74, 0x65, 0x52, 0x08, 0x72, 0x61, 0x77,
-	0x53, 0x74, 0x61, 0x74, 0x65, 0x1a, 0x83, 0x01, 0x0a, 0x08, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
-	0x73, 0x65, 0x12, 0x3e, 0x0a, 0x0e, 0x75, 0x70, 0x67, 0x72, 0x61, 0x64, 0x65, 0x64, 0x5f, 0x73,
-	0x74, 0x61, 0x74, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x74, 0x66, 0x70,
-	0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56, 0x61,
-	0x6c, 0x75, 0x65, 0x52, 0x0d, 0x75, 0x70, 0x67, 0x72, 0x61, 0x64, 0x65, 0x64, 0x53, 0x74, 0x61,
-	0x74, 0x65, 0x12, 0x37, 0x0a, 0x0b, 0x64, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63,
-	0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67,
+	0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x73, 0x12, 0x4c, 0x0a, 0x0c, 0x64, 0x61, 0x74, 0x61, 0x5f,
+	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x29, 0x2e,
+	0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x47, 0x65, 0x74, 0x4d, 0x65, 0x74,
+	0x61, 0x64, 0x61, 0x74, 0x61, 0x2e, 0x44, 0x61, 0x74, 0x61, 0x53, 0x6f, 0x75, 0x72, 0x63, 0x65,
+	0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x0b, 0x64, 0x61, 0x74, 0x61, 0x53, 0x6f,
+	0x75, 0x72, 0x63, 0x65, 0x73, 0x12, 0x45, 0x0a, 0x09, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
+	0x65, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x27, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75,
+	0x67, 0x69, 0x6e, 0x35, 0x2e, 0x47, 0x65, 0x74, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61,
+	0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74,
+	0x61, 0x52, 0x09, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x1a, 0x31, 0x0a, 0x12,
+	0x44, 0x61, 0x74, 0x61, 0x53, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61,
+	0x74, 0x61, 0x12, 0x1b, 0x0a, 0x09, 0x74, 0x79, 0x70, 0x65, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x74, 0x79, 0x70, 0x65, 0x4e, 0x61, 0x6d, 0x65, 0x1a,
+	0x2f, 0x0a, 0x10, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x4d, 0x65, 0x74, 0x61, 0x64,
+	0x61, 0x74, 0x61, 0x12, 0x1b, 0x0a, 0x09, 0x74, 0x79, 0x70, 0x65, 0x5f, 0x6e, 0x61, 0x6d, 0x65,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x74, 0x79, 0x70, 0x65, 0x4e, 0x61, 0x6d, 0x65,
+	0x22, 0xa0, 0x05, 0x0a, 0x11, 0x47, 0x65, 0x74, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72,
+	0x53, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x1a, 0x09, 0x0a, 0x07, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
+	0x74, 0x1a, 0xff, 0x04, 0x0a, 0x08, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x2d,
+	0x0a, 0x08, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x11, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x53, 0x63, 0x68,
+	0x65, 0x6d, 0x61, 0x52, 0x08, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x12, 0x65, 0x0a,
+	0x10, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x73, 0x63, 0x68, 0x65, 0x6d, 0x61,
+	0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x3a, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67,
+	0x69, 0x6e, 0x35, 0x2e, 0x47, 0x65, 0x74, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x53,
+	0x63, 0x68, 0x65, 0x6d, 0x61, 0x2e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x2e, 0x52,
+	0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x53, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x73, 0x45, 0x6e,
+	0x74, 0x72, 0x79, 0x52, 0x0f, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x53, 0x63, 0x68,
+	0x65, 0x6d, 0x61, 0x73, 0x12, 0x6c, 0x0a, 0x13, 0x64, 0x61, 0x74, 0x61, 0x5f, 0x73, 0x6f, 0x75,
+	0x72, 0x63, 0x65, 0x5f, 0x73, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28,
+	0x0b, 0x32, 0x3c, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x47, 0x65,
+	0x74, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x53, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x2e,
+	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x2e, 0x44, 0x61, 0x74, 0x61, 0x53, 0x6f, 0x75,
+	0x72, 0x63, 0x65, 0x53, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52,
+	0x11, 0x64, 0x61, 0x74, 0x61, 0x53, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x53, 0x63, 0x68, 0x65, 0x6d,
+	0x61, 0x73, 0x12, 0x37, 0x0a, 0x0b, 0x64, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63,
+	0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67,
 	0x69, 0x6e, 0x35, 0x2e, 0x44, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x52, 0x0b,
-	0x64, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x73, 0x22, 0xba, 0x01, 0x0a, 0x1a,
-	0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
-	0x54, 0x79, 0x70, 0x65, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x1a, 0x57, 0x0a, 0x07, 0x52, 0x65,
+	0x64, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x73, 0x12, 0x36, 0x0a, 0x0d, 0x70,
+	0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x5f, 0x6d, 0x65, 0x74, 0x61, 0x18, 0x05, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x11, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x53,
+	0x63, 0x68, 0x65, 0x6d, 0x61, 0x52, 0x0c, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x4d,
+	0x65, 0x74, 0x61, 0x12, 0x4e, 0x0a, 0x13, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x5f, 0x63, 0x61,
+	0x70, 0x61, 0x62, 0x69, 0x6c, 0x69, 0x74, 0x69, 0x65, 0x73, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x1d, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x53, 0x65, 0x72,
+	0x76, 0x65, 0x72, 0x43, 0x61, 0x70, 0x61, 0x62, 0x69, 0x6c, 0x69, 0x74, 0x69, 0x65, 0x73, 0x52,
+	0x12, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x43, 0x61, 0x70, 0x61, 0x62, 0x69, 0x6c, 0x69, 0x74,
+	0x69, 0x65, 0x73, 0x1a, 0x55, 0x0a, 0x14, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x53,
+	0x63, 0x68, 0x65, 0x6d, 0x61, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b,
+	0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x27, 0x0a,
+	0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x11, 0x2e, 0x74,
+	0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x53, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x52,
+	0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x1a, 0x57, 0x0a, 0x16, 0x44, 0x61,
+	0x74, 0x61, 0x53, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x53, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x73, 0x45,
+	0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x27, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x11, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e,
+	0x35, 0x2e, 0x53, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a,
+	0x02, 0x38, 0x01, 0x22, 0xdb, 0x01, 0x0a, 0x15, 0x50, 0x72, 0x65, 0x70, 0x61, 0x72, 0x65, 0x50,
+	0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x1a, 0x3a, 0x0a,
+	0x07, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x2f, 0x0a, 0x06, 0x63, 0x6f, 0x6e, 0x66,
+	0x69, 0x67, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75,
+	0x67, 0x69, 0x6e, 0x35, 0x2e, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c, 0x75,
+	0x65, 0x52, 0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x1a, 0x85, 0x01, 0x0a, 0x08, 0x52, 0x65,
+	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x40, 0x0a, 0x0f, 0x70, 0x72, 0x65, 0x70, 0x61, 0x72,
+	0x65, 0x64, 0x5f, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x17, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x44, 0x79, 0x6e, 0x61,
+	0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x0e, 0x70, 0x72, 0x65, 0x70, 0x61, 0x72,
+	0x65, 0x64, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x37, 0x0a, 0x0b, 0x64, 0x69, 0x61, 0x67,
+	0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x15, 0x2e,
+	0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x44, 0x69, 0x61, 0x67, 0x6e, 0x6f,
+	0x73, 0x74, 0x69, 0x63, 0x52, 0x0b, 0x64, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63,
+	0x73, 0x22, 0x90, 0x02, 0x0a, 0x14, 0x55, 0x70, 0x67, 0x72, 0x61, 0x64, 0x65, 0x52, 0x65, 0x73,
+	0x6f, 0x75, 0x72, 0x63, 0x65, 0x53, 0x74, 0x61, 0x74, 0x65, 0x1a, 0x72, 0x0a, 0x07, 0x52, 0x65,
 	0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1b, 0x0a, 0x09, 0x74, 0x79, 0x70, 0x65, 0x5f, 0x6e, 0x61,
 	0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x74, 0x79, 0x70, 0x65, 0x4e, 0x61,
-	0x6d, 0x65, 0x12, 0x2f, 0x0a, 0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x02, 0x20, 0x01,
+	0x6d, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20,
+	0x01, 0x28, 0x03, 0x52, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x30, 0x0a, 0x09,
+	0x72, 0x61, 0x77, 0x5f, 0x73, 0x74, 0x61, 0x74, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x13, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x52, 0x61, 0x77, 0x53,
+	0x74, 0x61, 0x74, 0x65, 0x52, 0x08, 0x72, 0x61, 0x77, 0x53, 0x74, 0x61, 0x74, 0x65, 0x1a, 0x83,
+	0x01, 0x0a, 0x08, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x3e, 0x0a, 0x0e, 0x75,
+	0x70, 0x67, 0x72, 0x61, 0x64, 0x65, 0x64, 0x5f, 0x73, 0x74, 0x61, 0x74, 0x65, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e,
+	0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x0d, 0x75, 0x70,
+	0x67, 0x72, 0x61, 0x64, 0x65, 0x64, 0x53, 0x74, 0x61, 0x74, 0x65, 0x12, 0x37, 0x0a, 0x0b, 0x64,
+	0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b,
+	0x32, 0x15, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x44, 0x69, 0x61,
+	0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x52, 0x0b, 0x64, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73,
+	0x74, 0x69, 0x63, 0x73, 0x22, 0xba, 0x01, 0x0a, 0x1a, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74,
+	0x65, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x54, 0x79, 0x70, 0x65, 0x43, 0x6f, 0x6e,
+	0x66, 0x69, 0x67, 0x1a, 0x57, 0x0a, 0x07, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1b,
+	0x0a, 0x09, 0x74, 0x79, 0x70, 0x65, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x08, 0x74, 0x79, 0x70, 0x65, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x2f, 0x0a, 0x06, 0x63,
+	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x74, 0x66,
+	0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56,
+	0x61, 0x6c, 0x75, 0x65, 0x52, 0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x1a, 0x43, 0x0a, 0x08,
+	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x37, 0x0a, 0x0b, 0x64, 0x69, 0x61, 0x67,
+	0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x15, 0x2e,
+	0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x44, 0x69, 0x61, 0x67, 0x6e, 0x6f,
+	0x73, 0x74, 0x69, 0x63, 0x52, 0x0b, 0x64, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63,
+	0x73, 0x22, 0xb8, 0x01, 0x0a, 0x18, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x44, 0x61,
+	0x74, 0x61, 0x53, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x1a, 0x57,
+	0x0a, 0x07, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1b, 0x0a, 0x09, 0x74, 0x79, 0x70,
+	0x65, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x74, 0x79,
+	0x70, 0x65, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x2f, 0x0a, 0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69,
+	0x6e, 0x35, 0x2e, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52,
+	0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x1a, 0x43, 0x0a, 0x08, 0x52, 0x65, 0x73, 0x70, 0x6f,
+	0x6e, 0x73, 0x65, 0x12, 0x37, 0x0a, 0x0b, 0x64, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69,
+	0x63, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75,
+	0x67, 0x69, 0x6e, 0x35, 0x2e, 0x44, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x52,
+	0x0b, 0x64, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x73, 0x22, 0xb9, 0x01, 0x0a,
+	0x09, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x75, 0x72, 0x65, 0x1a, 0x67, 0x0a, 0x07, 0x52, 0x65,
+	0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x2b, 0x0a, 0x11, 0x74, 0x65, 0x72, 0x72, 0x61, 0x66, 0x6f,
+	0x72, 0x6d, 0x5f, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x10, 0x74, 0x65, 0x72, 0x72, 0x61, 0x66, 0x6f, 0x72, 0x6d, 0x56, 0x65, 0x72, 0x73, 0x69,
+	0x6f, 0x6e, 0x12, 0x2f, 0x0a, 0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x02, 0x20, 0x01,
 	0x28, 0x0b, 0x32, 0x17, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x44,
 	0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x06, 0x63, 0x6f, 0x6e,
 	0x66, 0x69, 0x67, 0x1a, 0x43, 0x0a, 0x08, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12,
 	0x37, 0x0a, 0x0b, 0x64, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x73, 0x18, 0x01,
 	0x20, 0x03, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35,
 	0x2e, 0x44, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x52, 0x0b, 0x64, 0x69, 0x61,
-	0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x73, 0x22, 0xb8, 0x01, 0x0a, 0x18, 0x56, 0x61, 0x6c,
-	0x69, 0x64, 0x61, 0x74, 0x65, 0x44, 0x61, 0x74, 0x61, 0x53, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x43,
-	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x1a, 0x57, 0x0a, 0x07, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
-	0x12, 0x1b, 0x0a, 0x09, 0x74, 0x79, 0x70, 0x65, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x08, 0x74, 0x79, 0x70, 0x65, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x2f, 0x0a,
-	0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e,
-	0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69,
-	0x63, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x1a, 0x43,
-	0x0a, 0x08, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x37, 0x0a, 0x0b, 0x64, 0x69,
-	0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32,
-	0x15, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x44, 0x69, 0x61, 0x67,
-	0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x52, 0x0b, 0x64, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74,
-	0x69, 0x63, 0x73, 0x22, 0xb9, 0x01, 0x0a, 0x09, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x75, 0x72,
-	0x65, 0x1a, 0x67, 0x0a, 0x07, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x2b, 0x0a, 0x11,
-	0x74, 0x65, 0x72, 0x72, 0x61, 0x66, 0x6f, 0x72, 0x6d, 0x5f, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f,
-	0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x10, 0x74, 0x65, 0x72, 0x72, 0x61, 0x66, 0x6f,
-	0x72, 0x6d, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x2f, 0x0a, 0x06, 0x63, 0x6f, 0x6e,
-	0x66, 0x69, 0x67, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x74, 0x66, 0x70, 0x6c,
+	0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x73, 0x22, 0xe3, 0x02, 0x0a, 0x0c, 0x52, 0x65, 0x61,
+	0x64, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x1a, 0xbc, 0x01, 0x0a, 0x07, 0x52, 0x65,
+	0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1b, 0x0a, 0x09, 0x74, 0x79, 0x70, 0x65, 0x5f, 0x6e, 0x61,
+	0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x74, 0x79, 0x70, 0x65, 0x4e, 0x61,
+	0x6d, 0x65, 0x12, 0x3c, 0x0a, 0x0d, 0x63, 0x75, 0x72, 0x72, 0x65, 0x6e, 0x74, 0x5f, 0x73, 0x74,
+	0x61, 0x74, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x74, 0x66, 0x70, 0x6c,
 	0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c,
-	0x75, 0x65, 0x52, 0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x1a, 0x43, 0x0a, 0x08, 0x52, 0x65,
-	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x37, 0x0a, 0x0b, 0x64, 0x69, 0x61, 0x67, 0x6e, 0x6f,
-	0x73, 0x74, 0x69, 0x63, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x74, 0x66,
-	0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x44, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74,
-	0x69, 0x63, 0x52, 0x0b, 0x64, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x73, 0x22,
-	0xe3, 0x02, 0x0a, 0x0c, 0x52, 0x65, 0x61, 0x64, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
-	0x1a, 0xbc, 0x01, 0x0a, 0x07, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1b, 0x0a, 0x09,
-	0x74, 0x79, 0x70, 0x65, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x08, 0x74, 0x79, 0x70, 0x65, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x3c, 0x0a, 0x0d, 0x63, 0x75, 0x72,
-	0x72, 0x65, 0x6e, 0x74, 0x5f, 0x73, 0x74, 0x61, 0x74, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b,
-	0x32, 0x17, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x44, 0x79, 0x6e,
-	0x61, 0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x0c, 0x63, 0x75, 0x72, 0x72, 0x65,
-	0x6e, 0x74, 0x53, 0x74, 0x61, 0x74, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x70, 0x72, 0x69, 0x76, 0x61,
-	0x74, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x07, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74,
-	0x65, 0x12, 0x3c, 0x0a, 0x0d, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x5f, 0x6d, 0x65,
-	0x74, 0x61, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75,
+	0x75, 0x65, 0x52, 0x0c, 0x63, 0x75, 0x72, 0x72, 0x65, 0x6e, 0x74, 0x53, 0x74, 0x61, 0x74, 0x65,
+	0x12, 0x18, 0x0a, 0x07, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28,
+	0x0c, 0x52, 0x07, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x12, 0x3c, 0x0a, 0x0d, 0x70, 0x72,
+	0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x5f, 0x6d, 0x65, 0x74, 0x61, 0x18, 0x04, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x17, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x44, 0x79,
+	0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x0c, 0x70, 0x72, 0x6f, 0x76,
+	0x69, 0x64, 0x65, 0x72, 0x4d, 0x65, 0x74, 0x61, 0x1a, 0x93, 0x01, 0x0a, 0x08, 0x52, 0x65, 0x73,
+	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x34, 0x0a, 0x09, 0x6e, 0x65, 0x77, 0x5f, 0x73, 0x74, 0x61,
+	0x74, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75,
 	0x67, 0x69, 0x6e, 0x35, 0x2e, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c, 0x75,
-	0x65, 0x52, 0x0c, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x4d, 0x65, 0x74, 0x61, 0x1a,
-	0x93, 0x01, 0x0a, 0x08, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x34, 0x0a, 0x09,
-	0x6e, 0x65, 0x77, 0x5f, 0x73, 0x74, 0x61, 0x74, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32,
-	0x17, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x44, 0x79, 0x6e, 0x61,
-	0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x08, 0x6e, 0x65, 0x77, 0x53, 0x74, 0x61,
-	0x74, 0x65, 0x12, 0x37, 0x0a, 0x0b, 0x64, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63,
-	0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67,
-	0x69, 0x6e, 0x35, 0x2e, 0x44, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x52, 0x0b,
-	0x64, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x73, 0x12, 0x18, 0x0a, 0x07, 0x70,
-	0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x07, 0x70, 0x72,
-	0x69, 0x76, 0x61, 0x74, 0x65, 0x22, 0xf2, 0x04, 0x0a, 0x12, 0x50, 0x6c, 0x61, 0x6e, 0x52, 0x65,
-	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x43, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x1a, 0xbb, 0x02, 0x0a,
-	0x07, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1b, 0x0a, 0x09, 0x74, 0x79, 0x70, 0x65,
-	0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x74, 0x79, 0x70,
-	0x65, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x38, 0x0a, 0x0b, 0x70, 0x72, 0x69, 0x6f, 0x72, 0x5f, 0x73,
-	0x74, 0x61, 0x74, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x74, 0x66, 0x70,
-	0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56, 0x61,
-	0x6c, 0x75, 0x65, 0x52, 0x0a, 0x70, 0x72, 0x69, 0x6f, 0x72, 0x53, 0x74, 0x61, 0x74, 0x65, 0x12,
-	0x45, 0x0a, 0x12, 0x70, 0x72, 0x6f, 0x70, 0x6f, 0x73, 0x65, 0x64, 0x5f, 0x6e, 0x65, 0x77, 0x5f,
-	0x73, 0x74, 0x61, 0x74, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x74, 0x66,
-	0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56,
-	0x61, 0x6c, 0x75, 0x65, 0x52, 0x10, 0x70, 0x72, 0x6f, 0x70, 0x6f, 0x73, 0x65, 0x64, 0x4e, 0x65,
-	0x77, 0x53, 0x74, 0x61, 0x74, 0x65, 0x12, 0x2f, 0x0a, 0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67,
-	0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69,
-	0x6e, 0x35, 0x2e, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52,
-	0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x23, 0x0a, 0x0d, 0x70, 0x72, 0x69, 0x6f, 0x72,
-	0x5f, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x0c,
-	0x70, 0x72, 0x69, 0x6f, 0x72, 0x50, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x12, 0x3c, 0x0a, 0x0d,
-	0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x5f, 0x6d, 0x65, 0x74, 0x61, 0x18, 0x06, 0x20,
-	0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e,
-	0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x0c, 0x70, 0x72,
-	0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x4d, 0x65, 0x74, 0x61, 0x1a, 0x9d, 0x02, 0x0a, 0x08, 0x52,
-	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x3c, 0x0a, 0x0d, 0x70, 0x6c, 0x61, 0x6e, 0x6e,
-	0x65, 0x64, 0x5f, 0x73, 0x74, 0x61, 0x74, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17,
-	0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x44, 0x79, 0x6e, 0x61, 0x6d,
-	0x69, 0x63, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x0c, 0x70, 0x6c, 0x61, 0x6e, 0x6e, 0x65, 0x64,
-	0x53, 0x74, 0x61, 0x74, 0x65, 0x12, 0x43, 0x0a, 0x10, 0x72, 0x65, 0x71, 0x75, 0x69, 0x72, 0x65,
-	0x73, 0x5f, 0x72, 0x65, 0x70, 0x6c, 0x61, 0x63, 0x65, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32,
-	0x18, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x41, 0x74, 0x74, 0x72,
-	0x69, 0x62, 0x75, 0x74, 0x65, 0x50, 0x61, 0x74, 0x68, 0x52, 0x0f, 0x72, 0x65, 0x71, 0x75, 0x69,
-	0x72, 0x65, 0x73, 0x52, 0x65, 0x70, 0x6c, 0x61, 0x63, 0x65, 0x12, 0x27, 0x0a, 0x0f, 0x70, 0x6c,
-	0x61, 0x6e, 0x6e, 0x65, 0x64, 0x5f, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x18, 0x03, 0x20,
-	0x01, 0x28, 0x0c, 0x52, 0x0e, 0x70, 0x6c, 0x61, 0x6e, 0x6e, 0x65, 0x64, 0x50, 0x72, 0x69, 0x76,
-	0x61, 0x74, 0x65, 0x12, 0x37, 0x0a, 0x0b, 0x64, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69,
-	0x63, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75,
-	0x67, 0x69, 0x6e, 0x35, 0x2e, 0x44, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x52,
-	0x0b, 0x64, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x73, 0x12, 0x2c, 0x0a, 0x12,
-	0x6c, 0x65, 0x67, 0x61, 0x63, 0x79, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x5f, 0x73, 0x79, 0x73, 0x74,
-	0x65, 0x6d, 0x18, 0x05, 0x20, 0x01, 0x28, 0x08, 0x52, 0x10, 0x6c, 0x65, 0x67, 0x61, 0x63, 0x79,
-	0x54, 0x79, 0x70, 0x65, 0x53, 0x79, 0x73, 0x74, 0x65, 0x6d, 0x22, 0x92, 0x04, 0x0a, 0x13, 0x41,
-	0x70, 0x70, 0x6c, 0x79, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x43, 0x68, 0x61, 0x6e,
-	0x67, 0x65, 0x1a, 0xb6, 0x02, 0x0a, 0x07, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1b,
-	0x0a, 0x09, 0x74, 0x79, 0x70, 0x65, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x08, 0x74, 0x79, 0x70, 0x65, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x38, 0x0a, 0x0b, 0x70,
-	0x72, 0x69, 0x6f, 0x72, 0x5f, 0x73, 0x74, 0x61, 0x74, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b,
-	0x32, 0x17, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x44, 0x79, 0x6e,
-	0x61, 0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x0a, 0x70, 0x72, 0x69, 0x6f, 0x72,
-	0x53, 0x74, 0x61, 0x74, 0x65, 0x12, 0x3c, 0x0a, 0x0d, 0x70, 0x6c, 0x61, 0x6e, 0x6e, 0x65, 0x64,
-	0x5f, 0x73, 0x74, 0x61, 0x74, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x74,
-	0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63,
-	0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x0c, 0x70, 0x6c, 0x61, 0x6e, 0x6e, 0x65, 0x64, 0x53, 0x74,
-	0x61, 0x74, 0x65, 0x12, 0x2f, 0x0a, 0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x04, 0x20,
+	0x65, 0x52, 0x08, 0x6e, 0x65, 0x77, 0x53, 0x74, 0x61, 0x74, 0x65, 0x12, 0x37, 0x0a, 0x0b, 0x64,
+	0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b,
+	0x32, 0x15, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x44, 0x69, 0x61,
+	0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x52, 0x0b, 0x64, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73,
+	0x74, 0x69, 0x63, 0x73, 0x12, 0x18, 0x0a, 0x07, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x18,
+	0x03, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x07, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x22, 0xf2,
+	0x04, 0x0a, 0x12, 0x50, 0x6c, 0x61, 0x6e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x43,
+	0x68, 0x61, 0x6e, 0x67, 0x65, 0x1a, 0xbb, 0x02, 0x0a, 0x07, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
+	0x74, 0x12, 0x1b, 0x0a, 0x09, 0x74, 0x79, 0x70, 0x65, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x74, 0x79, 0x70, 0x65, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x38,
+	0x0a, 0x0b, 0x70, 0x72, 0x69, 0x6f, 0x72, 0x5f, 0x73, 0x74, 0x61, 0x74, 0x65, 0x18, 0x02, 0x20,
 	0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e,
-	0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x06, 0x63, 0x6f,
-	0x6e, 0x66, 0x69, 0x67, 0x12, 0x27, 0x0a, 0x0f, 0x70, 0x6c, 0x61, 0x6e, 0x6e, 0x65, 0x64, 0x5f,
-	0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x0e, 0x70,
-	0x6c, 0x61, 0x6e, 0x6e, 0x65, 0x64, 0x50, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x12, 0x3c, 0x0a,
-	0x0d, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x5f, 0x6d, 0x65, 0x74, 0x61, 0x18, 0x06,
+	0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x0a, 0x70, 0x72,
+	0x69, 0x6f, 0x72, 0x53, 0x74, 0x61, 0x74, 0x65, 0x12, 0x45, 0x0a, 0x12, 0x70, 0x72, 0x6f, 0x70,
+	0x6f, 0x73, 0x65, 0x64, 0x5f, 0x6e, 0x65, 0x77, 0x5f, 0x73, 0x74, 0x61, 0x74, 0x65, 0x18, 0x03,
 	0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35,
-	0x2e, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x0c, 0x70,
-	0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x4d, 0x65, 0x74, 0x61, 0x1a, 0xc1, 0x01, 0x0a, 0x08,
-	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x34, 0x0a, 0x09, 0x6e, 0x65, 0x77, 0x5f,
-	0x73, 0x74, 0x61, 0x74, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x74, 0x66,
-	0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56,
-	0x61, 0x6c, 0x75, 0x65, 0x52, 0x08, 0x6e, 0x65, 0x77, 0x53, 0x74, 0x61, 0x74, 0x65, 0x12, 0x18,
-	0x0a, 0x07, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0c, 0x52,
-	0x07, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x12, 0x37, 0x0a, 0x0b, 0x64, 0x69, 0x61, 0x67,
-	0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x15, 0x2e,
-	0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x44, 0x69, 0x61, 0x67, 0x6e, 0x6f,
-	0x73, 0x74, 0x69, 0x63, 0x52, 0x0b, 0x64, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63,
-	0x73, 0x12, 0x2c, 0x0a, 0x12, 0x6c, 0x65, 0x67, 0x61, 0x63, 0x79, 0x5f, 0x74, 0x79, 0x70, 0x65,
-	0x5f, 0x73, 0x79, 0x73, 0x74, 0x65, 0x6d, 0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x52, 0x10, 0x6c,
-	0x65, 0x67, 0x61, 0x63, 0x79, 0x54, 0x79, 0x70, 0x65, 0x53, 0x79, 0x73, 0x74, 0x65, 0x6d, 0x22,
-	0xed, 0x02, 0x0a, 0x13, 0x49, 0x6d, 0x70, 0x6f, 0x72, 0x74, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72,
-	0x63, 0x65, 0x53, 0x74, 0x61, 0x74, 0x65, 0x1a, 0x36, 0x0a, 0x07, 0x52, 0x65, 0x71, 0x75, 0x65,
-	0x73, 0x74, 0x12, 0x1b, 0x0a, 0x09, 0x74, 0x79, 0x70, 0x65, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18,
-	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x74, 0x79, 0x70, 0x65, 0x4e, 0x61, 0x6d, 0x65, 0x12,
-	0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x1a,
-	0x78, 0x0a, 0x10, 0x49, 0x6d, 0x70, 0x6f, 0x72, 0x74, 0x65, 0x64, 0x52, 0x65, 0x73, 0x6f, 0x75,
-	0x72, 0x63, 0x65, 0x12, 0x1b, 0x0a, 0x09, 0x74, 0x79, 0x70, 0x65, 0x5f, 0x6e, 0x61, 0x6d, 0x65,
-	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x74, 0x79, 0x70, 0x65, 0x4e, 0x61, 0x6d, 0x65,
-	0x12, 0x2d, 0x0a, 0x05, 0x73, 0x74, 0x61, 0x74, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x2e, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x10, 0x70,
+	0x72, 0x6f, 0x70, 0x6f, 0x73, 0x65, 0x64, 0x4e, 0x65, 0x77, 0x53, 0x74, 0x61, 0x74, 0x65, 0x12,
+	0x2f, 0x0a, 0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32,
 	0x17, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x44, 0x79, 0x6e, 0x61,
-	0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x05, 0x73, 0x74, 0x61, 0x74, 0x65, 0x12,
-	0x18, 0x0a, 0x07, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0c,
-	0x52, 0x07, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x1a, 0xa3, 0x01, 0x0a, 0x08, 0x52, 0x65,
-	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x5e, 0x0a, 0x12, 0x69, 0x6d, 0x70, 0x6f, 0x72, 0x74,
-	0x65, 0x64, 0x5f, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03,
-	0x28, 0x0b, 0x32, 0x2f, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x49,
-	0x6d, 0x70, 0x6f, 0x72, 0x74, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x53, 0x74, 0x61,
-	0x74, 0x65, 0x2e, 0x49, 0x6d, 0x70, 0x6f, 0x72, 0x74, 0x65, 0x64, 0x52, 0x65, 0x73, 0x6f, 0x75,
-	0x72, 0x63, 0x65, 0x52, 0x11, 0x69, 0x6d, 0x70, 0x6f, 0x72, 0x74, 0x65, 0x64, 0x52, 0x65, 0x73,
-	0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x12, 0x37, 0x0a, 0x0b, 0x64, 0x69, 0x61, 0x67, 0x6e, 0x6f,
-	0x73, 0x74, 0x69, 0x63, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x74, 0x66,
-	0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x44, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74,
-	0x69, 0x63, 0x52, 0x0b, 0x64, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x73, 0x22,
-	0x9c, 0x02, 0x0a, 0x0e, 0x52, 0x65, 0x61, 0x64, 0x44, 0x61, 0x74, 0x61, 0x53, 0x6f, 0x75, 0x72,
-	0x63, 0x65, 0x1a, 0x95, 0x01, 0x0a, 0x07, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1b,
-	0x0a, 0x09, 0x74, 0x79, 0x70, 0x65, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x08, 0x74, 0x79, 0x70, 0x65, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x2f, 0x0a, 0x06, 0x63,
-	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x74, 0x66,
-	0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56,
-	0x61, 0x6c, 0x75, 0x65, 0x52, 0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x3c, 0x0a, 0x0d,
-	0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x5f, 0x6d, 0x65, 0x74, 0x61, 0x18, 0x03, 0x20,
-	0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e,
-	0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x0c, 0x70, 0x72,
-	0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x4d, 0x65, 0x74, 0x61, 0x1a, 0x72, 0x0a, 0x08, 0x52, 0x65,
-	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x2d, 0x0a, 0x05, 0x73, 0x74, 0x61, 0x74, 0x65, 0x18,
-	0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e,
-	0x35, 0x2e, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x05,
-	0x73, 0x74, 0x61, 0x74, 0x65, 0x12, 0x37, 0x0a, 0x0b, 0x64, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73,
-	0x74, 0x69, 0x63, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x74, 0x66, 0x70,
-	0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x44, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69,
-	0x63, 0x52, 0x0b, 0x64, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x73, 0x22, 0x9b,
-	0x01, 0x0a, 0x14, 0x47, 0x65, 0x74, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65,
-	0x72, 0x53, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x1a, 0x09, 0x0a, 0x07, 0x52, 0x65, 0x71, 0x75, 0x65,
-	0x73, 0x74, 0x1a, 0x78, 0x0a, 0x08, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x33,
-	0x0a, 0x0b, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x18, 0x01, 0x20,
-	0x01, 0x28, 0x0b, 0x32, 0x11, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e,
-	0x53, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x52, 0x0b, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f,
-	0x6e, 0x65, 0x72, 0x12, 0x37, 0x0a, 0x0b, 0x64, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69,
-	0x63, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75,
-	0x67, 0x69, 0x6e, 0x35, 0x2e, 0x44, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x52,
-	0x0b, 0x64, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x73, 0x22, 0x9c, 0x01, 0x0a,
-	0x19, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69,
-	0x6f, 0x6e, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x1a, 0x3a, 0x0a, 0x07, 0x52, 0x65,
+	0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67,
+	0x12, 0x23, 0x0a, 0x0d, 0x70, 0x72, 0x69, 0x6f, 0x72, 0x5f, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74,
+	0x65, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x0c, 0x70, 0x72, 0x69, 0x6f, 0x72, 0x50, 0x72,
+	0x69, 0x76, 0x61, 0x74, 0x65, 0x12, 0x3c, 0x0a, 0x0d, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65,
+	0x72, 0x5f, 0x6d, 0x65, 0x74, 0x61, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x74,
+	0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63,
+	0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x0c, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x4d,
+	0x65, 0x74, 0x61, 0x1a, 0x9d, 0x02, 0x0a, 0x08, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
+	0x12, 0x3c, 0x0a, 0x0d, 0x70, 0x6c, 0x61, 0x6e, 0x6e, 0x65, 0x64, 0x5f, 0x73, 0x74, 0x61, 0x74,
+	0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67,
+	0x69, 0x6e, 0x35, 0x2e, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c, 0x75, 0x65,
+	0x52, 0x0c, 0x70, 0x6c, 0x61, 0x6e, 0x6e, 0x65, 0x64, 0x53, 0x74, 0x61, 0x74, 0x65, 0x12, 0x43,
+	0x0a, 0x10, 0x72, 0x65, 0x71, 0x75, 0x69, 0x72, 0x65, 0x73, 0x5f, 0x72, 0x65, 0x70, 0x6c, 0x61,
+	0x63, 0x65, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x18, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75,
+	0x67, 0x69, 0x6e, 0x35, 0x2e, 0x41, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x50, 0x61,
+	0x74, 0x68, 0x52, 0x0f, 0x72, 0x65, 0x71, 0x75, 0x69, 0x72, 0x65, 0x73, 0x52, 0x65, 0x70, 0x6c,
+	0x61, 0x63, 0x65, 0x12, 0x27, 0x0a, 0x0f, 0x70, 0x6c, 0x61, 0x6e, 0x6e, 0x65, 0x64, 0x5f, 0x70,
+	0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x0e, 0x70, 0x6c,
+	0x61, 0x6e, 0x6e, 0x65, 0x64, 0x50, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x12, 0x37, 0x0a, 0x0b,
+	0x64, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28,
+	0x0b, 0x32, 0x15, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x44, 0x69,
+	0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x52, 0x0b, 0x64, 0x69, 0x61, 0x67, 0x6e, 0x6f,
+	0x73, 0x74, 0x69, 0x63, 0x73, 0x12, 0x2c, 0x0a, 0x12, 0x6c, 0x65, 0x67, 0x61, 0x63, 0x79, 0x5f,
+	0x74, 0x79, 0x70, 0x65, 0x5f, 0x73, 0x79, 0x73, 0x74, 0x65, 0x6d, 0x18, 0x05, 0x20, 0x01, 0x28,
+	0x08, 0x52, 0x10, 0x6c, 0x65, 0x67, 0x61, 0x63, 0x79, 0x54, 0x79, 0x70, 0x65, 0x53, 0x79, 0x73,
+	0x74, 0x65, 0x6d, 0x22, 0x92, 0x04, 0x0a, 0x13, 0x41, 0x70, 0x70, 0x6c, 0x79, 0x52, 0x65, 0x73,
+	0x6f, 0x75, 0x72, 0x63, 0x65, 0x43, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x1a, 0xb6, 0x02, 0x0a, 0x07,
+	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1b, 0x0a, 0x09, 0x74, 0x79, 0x70, 0x65, 0x5f,
+	0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x74, 0x79, 0x70, 0x65,
+	0x4e, 0x61, 0x6d, 0x65, 0x12, 0x38, 0x0a, 0x0b, 0x70, 0x72, 0x69, 0x6f, 0x72, 0x5f, 0x73, 0x74,
+	0x61, 0x74, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x74, 0x66, 0x70, 0x6c,
+	0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c,
+	0x75, 0x65, 0x52, 0x0a, 0x70, 0x72, 0x69, 0x6f, 0x72, 0x53, 0x74, 0x61, 0x74, 0x65, 0x12, 0x3c,
+	0x0a, 0x0d, 0x70, 0x6c, 0x61, 0x6e, 0x6e, 0x65, 0x64, 0x5f, 0x73, 0x74, 0x61, 0x74, 0x65, 0x18,
+	0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e,
+	0x35, 0x2e, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x0c,
+	0x70, 0x6c, 0x61, 0x6e, 0x6e, 0x65, 0x64, 0x53, 0x74, 0x61, 0x74, 0x65, 0x12, 0x2f, 0x0a, 0x06,
+	0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x74,
+	0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63,
+	0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x27, 0x0a,
+	0x0f, 0x70, 0x6c, 0x61, 0x6e, 0x6e, 0x65, 0x64, 0x5f, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65,
+	0x18, 0x05, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x0e, 0x70, 0x6c, 0x61, 0x6e, 0x6e, 0x65, 0x64, 0x50,
+	0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x12, 0x3c, 0x0a, 0x0d, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64,
+	0x65, 0x72, 0x5f, 0x6d, 0x65, 0x74, 0x61, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e,
+	0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69,
+	0x63, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x0c, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72,
+	0x4d, 0x65, 0x74, 0x61, 0x1a, 0xc1, 0x01, 0x0a, 0x08, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
+	0x65, 0x12, 0x34, 0x0a, 0x09, 0x6e, 0x65, 0x77, 0x5f, 0x73, 0x74, 0x61, 0x74, 0x65, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35,
+	0x2e, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x08, 0x6e,
+	0x65, 0x77, 0x53, 0x74, 0x61, 0x74, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x70, 0x72, 0x69, 0x76, 0x61,
+	0x74, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x07, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74,
+	0x65, 0x12, 0x37, 0x0a, 0x0b, 0x64, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x73,
+	0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69,
+	0x6e, 0x35, 0x2e, 0x44, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x52, 0x0b, 0x64,
+	0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x73, 0x12, 0x2c, 0x0a, 0x12, 0x6c, 0x65,
+	0x67, 0x61, 0x63, 0x79, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x5f, 0x73, 0x79, 0x73, 0x74, 0x65, 0x6d,
+	0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x52, 0x10, 0x6c, 0x65, 0x67, 0x61, 0x63, 0x79, 0x54, 0x79,
+	0x70, 0x65, 0x53, 0x79, 0x73, 0x74, 0x65, 0x6d, 0x22, 0xed, 0x02, 0x0a, 0x13, 0x49, 0x6d, 0x70,
+	0x6f, 0x72, 0x74, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x53, 0x74, 0x61, 0x74, 0x65,
+	0x1a, 0x36, 0x0a, 0x07, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1b, 0x0a, 0x09, 0x74,
+	0x79, 0x70, 0x65, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08,
+	0x74, 0x79, 0x70, 0x65, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x02,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x1a, 0x78, 0x0a, 0x10, 0x49, 0x6d, 0x70, 0x6f,
+	0x72, 0x74, 0x65, 0x64, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x12, 0x1b, 0x0a, 0x09,
+	0x74, 0x79, 0x70, 0x65, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x08, 0x74, 0x79, 0x70, 0x65, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x2d, 0x0a, 0x05, 0x73, 0x74, 0x61,
+	0x74, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75,
+	0x67, 0x69, 0x6e, 0x35, 0x2e, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c, 0x75,
+	0x65, 0x52, 0x05, 0x73, 0x74, 0x61, 0x74, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x70, 0x72, 0x69, 0x76,
+	0x61, 0x74, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x07, 0x70, 0x72, 0x69, 0x76, 0x61,
+	0x74, 0x65, 0x1a, 0xa3, 0x01, 0x0a, 0x08, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12,
+	0x5e, 0x0a, 0x12, 0x69, 0x6d, 0x70, 0x6f, 0x72, 0x74, 0x65, 0x64, 0x5f, 0x72, 0x65, 0x73, 0x6f,
+	0x75, 0x72, 0x63, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x2f, 0x2e, 0x74, 0x66,
+	0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x49, 0x6d, 0x70, 0x6f, 0x72, 0x74, 0x52, 0x65,
+	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x53, 0x74, 0x61, 0x74, 0x65, 0x2e, 0x49, 0x6d, 0x70, 0x6f,
+	0x72, 0x74, 0x65, 0x64, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x11, 0x69, 0x6d,
+	0x70, 0x6f, 0x72, 0x74, 0x65, 0x64, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x12,
+	0x37, 0x0a, 0x0b, 0x64, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x73, 0x18, 0x02,
+	0x20, 0x03, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35,
+	0x2e, 0x44, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x52, 0x0b, 0x64, 0x69, 0x61,
+	0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x73, 0x22, 0x9c, 0x02, 0x0a, 0x0e, 0x52, 0x65, 0x61,
+	0x64, 0x44, 0x61, 0x74, 0x61, 0x53, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x1a, 0x95, 0x01, 0x0a, 0x07,
+	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1b, 0x0a, 0x09, 0x74, 0x79, 0x70, 0x65, 0x5f,
+	0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x74, 0x79, 0x70, 0x65,
+	0x4e, 0x61, 0x6d, 0x65, 0x12, 0x2f, 0x0a, 0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x02,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35,
+	0x2e, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x06, 0x63,
+	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x3c, 0x0a, 0x0d, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65,
+	0x72, 0x5f, 0x6d, 0x65, 0x74, 0x61, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x74,
+	0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63,
+	0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x0c, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x4d,
+	0x65, 0x74, 0x61, 0x1a, 0x72, 0x0a, 0x08, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12,
+	0x2d, 0x0a, 0x05, 0x73, 0x74, 0x61, 0x74, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17,
+	0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x44, 0x79, 0x6e, 0x61, 0x6d,
+	0x69, 0x63, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x05, 0x73, 0x74, 0x61, 0x74, 0x65, 0x12, 0x37,
+	0x0a, 0x0b, 0x64, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x73, 0x18, 0x02, 0x20,
+	0x03, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e,
+	0x44, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x52, 0x0b, 0x64, 0x69, 0x61, 0x67,
+	0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x73, 0x22, 0x9b, 0x01, 0x0a, 0x14, 0x47, 0x65, 0x74, 0x50,
+	0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x53, 0x63, 0x68, 0x65, 0x6d, 0x61,
+	0x1a, 0x09, 0x0a, 0x07, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x78, 0x0a, 0x08, 0x52,
+	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x33, 0x0a, 0x0b, 0x70, 0x72, 0x6f, 0x76, 0x69,
+	0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x11, 0x2e, 0x74,
+	0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x53, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x52,
+	0x0b, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x12, 0x37, 0x0a, 0x0b,
+	0x64, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28,
+	0x0b, 0x32, 0x15, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x44, 0x69,
+	0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x52, 0x0b, 0x64, 0x69, 0x61, 0x67, 0x6e, 0x6f,
+	0x73, 0x74, 0x69, 0x63, 0x73, 0x22, 0x9c, 0x01, 0x0a, 0x19, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61,
+	0x74, 0x65, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x43, 0x6f, 0x6e,
+	0x66, 0x69, 0x67, 0x1a, 0x3a, 0x0a, 0x07, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x2f,
+	0x0a, 0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17,
+	0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x44, 0x79, 0x6e, 0x61, 0x6d,
+	0x69, 0x63, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x1a,
+	0x43, 0x0a, 0x08, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x37, 0x0a, 0x0b, 0x64,
+	0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b,
+	0x32, 0x15, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x44, 0x69, 0x61,
+	0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x52, 0x0b, 0x64, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73,
+	0x74, 0x69, 0x63, 0x73, 0x22, 0xe5, 0x01, 0x0a, 0x11, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69,
+	0x6f, 0x6e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x1a, 0x73, 0x0a, 0x07, 0x52, 0x65,
 	0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x2f, 0x0a, 0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18,
 	0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e,
 	0x35, 0x2e, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x06,
-	0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x1a, 0x43, 0x0a, 0x08, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
-	0x73, 0x65, 0x12, 0x37, 0x0a, 0x0b, 0x64, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63,
-	0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67,
-	0x69, 0x6e, 0x35, 0x2e, 0x44, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x52, 0x0b,
-	0x64, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x73, 0x22, 0xe5, 0x01, 0x0a, 0x11,
-	0x50, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
-	0x65, 0x1a, 0x73, 0x0a, 0x07, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x2f, 0x0a, 0x06,
-	0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x74,
-	0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63,
-	0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x37, 0x0a,
-	0x0a, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28,
-	0x0b, 0x32, 0x17, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x44, 0x79,
-	0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x0a, 0x63, 0x6f, 0x6e, 0x6e,
-	0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x1a, 0x5b, 0x0a, 0x08, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
-	0x73, 0x65, 0x12, 0x16, 0x0a, 0x06, 0x6f, 0x75, 0x74, 0x70, 0x75, 0x74, 0x18, 0x01, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x06, 0x6f, 0x75, 0x74, 0x70, 0x75, 0x74, 0x12, 0x37, 0x0a, 0x0b, 0x64, 0x69,
-	0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32,
-	0x15, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x44, 0x69, 0x61, 0x67,
-	0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x52, 0x0b, 0x64, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74,
-	0x69, 0x63, 0x73, 0x2a, 0x25, 0x0a, 0x0a, 0x53, 0x74, 0x72, 0x69, 0x6e, 0x67, 0x4b, 0x69, 0x6e,
-	0x64, 0x12, 0x09, 0x0a, 0x05, 0x50, 0x4c, 0x41, 0x49, 0x4e, 0x10, 0x00, 0x12, 0x0c, 0x0a, 0x08,
-	0x4d, 0x41, 0x52, 0x4b, 0x44, 0x4f, 0x57, 0x4e, 0x10, 0x01, 0x32, 0x97, 0x09, 0x0a, 0x08, 0x50,
-	0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x12, 0x58, 0x0a, 0x09, 0x47, 0x65, 0x74, 0x53, 0x63,
-	0x68, 0x65, 0x6d, 0x61, 0x12, 0x24, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35,
-	0x2e, 0x47, 0x65, 0x74, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x53, 0x63, 0x68, 0x65,
-	0x6d, 0x61, 0x2e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x25, 0x2e, 0x74, 0x66, 0x70,
-	0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x47, 0x65, 0x74, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64,
-	0x65, 0x72, 0x53, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x2e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
-	0x65, 0x12, 0x6c, 0x0a, 0x15, 0x50, 0x72, 0x65, 0x70, 0x61, 0x72, 0x65, 0x50, 0x72, 0x6f, 0x76,
-	0x69, 0x64, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x28, 0x2e, 0x74, 0x66, 0x70,
-	0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x50, 0x72, 0x65, 0x70, 0x61, 0x72, 0x65, 0x50, 0x72,
-	0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e, 0x52, 0x65, 0x71,
-	0x75, 0x65, 0x73, 0x74, 0x1a, 0x29, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35,
-	0x2e, 0x50, 0x72, 0x65, 0x70, 0x61, 0x72, 0x65, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72,
-	0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12,
-	0x7b, 0x0a, 0x1a, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x52, 0x65, 0x73, 0x6f, 0x75,
-	0x72, 0x63, 0x65, 0x54, 0x79, 0x70, 0x65, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x2d, 0x2e,
-	0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61,
-	0x74, 0x65, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x54, 0x79, 0x70, 0x65, 0x43, 0x6f,
-	0x6e, 0x66, 0x69, 0x67, 0x2e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x2e, 0x2e, 0x74,
-	0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74,
-	0x65, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x54, 0x79, 0x70, 0x65, 0x43, 0x6f, 0x6e,
-	0x66, 0x69, 0x67, 0x2e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x75, 0x0a, 0x18,
-	0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x44, 0x61, 0x74, 0x61, 0x53, 0x6f, 0x75, 0x72,
-	0x63, 0x65, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x2b, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75,
-	0x67, 0x69, 0x6e, 0x35, 0x2e, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x44, 0x61, 0x74,
-	0x61, 0x53, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e, 0x52, 0x65,
-	0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x2c, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e,
-	0x35, 0x2e, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x44, 0x61, 0x74, 0x61, 0x53, 0x6f,
-	0x75, 0x72, 0x63, 0x65, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e, 0x52, 0x65, 0x73, 0x70, 0x6f,
-	0x6e, 0x73, 0x65, 0x12, 0x69, 0x0a, 0x14, 0x55, 0x70, 0x67, 0x72, 0x61, 0x64, 0x65, 0x52, 0x65,
-	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x53, 0x74, 0x61, 0x74, 0x65, 0x12, 0x27, 0x2e, 0x74, 0x66,
-	0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x55, 0x70, 0x67, 0x72, 0x61, 0x64, 0x65, 0x52,
-	0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x53, 0x74, 0x61, 0x74, 0x65, 0x2e, 0x52, 0x65, 0x71,
-	0x75, 0x65, 0x73, 0x74, 0x1a, 0x28, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35,
+	0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x37, 0x0a, 0x0a, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63,
+	0x74, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x74, 0x66, 0x70,
+	0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56, 0x61,
+	0x6c, 0x75, 0x65, 0x52, 0x0a, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x1a,
+	0x5b, 0x0a, 0x08, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x16, 0x0a, 0x06, 0x6f,
+	0x75, 0x74, 0x70, 0x75, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x6f, 0x75, 0x74,
+	0x70, 0x75, 0x74, 0x12, 0x37, 0x0a, 0x0b, 0x64, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69,
+	0x63, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75,
+	0x67, 0x69, 0x6e, 0x35, 0x2e, 0x44, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x52,
+	0x0b, 0x64, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x73, 0x2a, 0x25, 0x0a, 0x0a,
+	0x53, 0x74, 0x72, 0x69, 0x6e, 0x67, 0x4b, 0x69, 0x6e, 0x64, 0x12, 0x09, 0x0a, 0x05, 0x50, 0x4c,
+	0x41, 0x49, 0x4e, 0x10, 0x00, 0x12, 0x0c, 0x0a, 0x08, 0x4d, 0x41, 0x52, 0x4b, 0x44, 0x4f, 0x57,
+	0x4e, 0x10, 0x01, 0x32, 0xe7, 0x09, 0x0a, 0x08, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72,
+	0x12, 0x4e, 0x0a, 0x0b, 0x47, 0x65, 0x74, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12,
+	0x1e, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x47, 0x65, 0x74, 0x4d,
+	0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x2e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a,
+	0x1f, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x47, 0x65, 0x74, 0x4d,
+	0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x2e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
+	0x12, 0x58, 0x0a, 0x09, 0x47, 0x65, 0x74, 0x53, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x12, 0x24, 0x2e,
+	0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x47, 0x65, 0x74, 0x50, 0x72, 0x6f,
+	0x76, 0x69, 0x64, 0x65, 0x72, 0x53, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x2e, 0x52, 0x65, 0x71, 0x75,
+	0x65, 0x73, 0x74, 0x1a, 0x25, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e,
+	0x47, 0x65, 0x74, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x53, 0x63, 0x68, 0x65, 0x6d,
+	0x61, 0x2e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x6c, 0x0a, 0x15, 0x50, 0x72,
+	0x65, 0x70, 0x61, 0x72, 0x65, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x43, 0x6f, 0x6e,
+	0x66, 0x69, 0x67, 0x12, 0x28, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e,
+	0x50, 0x72, 0x65, 0x70, 0x61, 0x72, 0x65, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x43,
+	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x29, 0x2e,
+	0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x50, 0x72, 0x65, 0x70, 0x61, 0x72,
+	0x65, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e,
+	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x7b, 0x0a, 0x1a, 0x56, 0x61, 0x6c, 0x69,
+	0x64, 0x61, 0x74, 0x65, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x54, 0x79, 0x70, 0x65,
+	0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x2d, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69,
+	0x6e, 0x35, 0x2e, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x52, 0x65, 0x73, 0x6f, 0x75,
+	0x72, 0x63, 0x65, 0x54, 0x79, 0x70, 0x65, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e, 0x52, 0x65,
+	0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x2e, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e,
+	0x35, 0x2e, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72,
+	0x63, 0x65, 0x54, 0x79, 0x70, 0x65, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e, 0x52, 0x65, 0x73,
+	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x75, 0x0a, 0x18, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74,
+	0x65, 0x44, 0x61, 0x74, 0x61, 0x53, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x43, 0x6f, 0x6e, 0x66, 0x69,
+	0x67, 0x12, 0x2b, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x56, 0x61,
+	0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x44, 0x61, 0x74, 0x61, 0x53, 0x6f, 0x75, 0x72, 0x63, 0x65,
+	0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x2c,
+	0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x56, 0x61, 0x6c, 0x69, 0x64,
+	0x61, 0x74, 0x65, 0x44, 0x61, 0x74, 0x61, 0x53, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x43, 0x6f, 0x6e,
+	0x66, 0x69, 0x67, 0x2e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x69, 0x0a, 0x14,
+	0x55, 0x70, 0x67, 0x72, 0x61, 0x64, 0x65, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x53,
+	0x74, 0x61, 0x74, 0x65, 0x12, 0x27, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35,
 	0x2e, 0x55, 0x70, 0x67, 0x72, 0x61, 0x64, 0x65, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
-	0x53, 0x74, 0x61, 0x74, 0x65, 0x2e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x48,
-	0x0a, 0x09, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x75, 0x72, 0x65, 0x12, 0x1c, 0x2e, 0x74, 0x66,
-	0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x75, 0x72,
-	0x65, 0x2e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1d, 0x2e, 0x74, 0x66, 0x70, 0x6c,
-	0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x75, 0x72, 0x65, 0x2e,
-	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x51, 0x0a, 0x0c, 0x52, 0x65, 0x61, 0x64,
-	0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x12, 0x1f, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75,
-	0x67, 0x69, 0x6e, 0x35, 0x2e, 0x52, 0x65, 0x61, 0x64, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
-	0x65, 0x2e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x20, 0x2e, 0x74, 0x66, 0x70, 0x6c,
-	0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x52, 0x65, 0x61, 0x64, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72,
-	0x63, 0x65, 0x2e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x63, 0x0a, 0x12, 0x50,
-	0x6c, 0x61, 0x6e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x43, 0x68, 0x61, 0x6e, 0x67,
-	0x65, 0x12, 0x25, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x50, 0x6c,
+	0x53, 0x74, 0x61, 0x74, 0x65, 0x2e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x28, 0x2e,
+	0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x55, 0x70, 0x67, 0x72, 0x61, 0x64,
+	0x65, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x53, 0x74, 0x61, 0x74, 0x65, 0x2e, 0x52,
+	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x48, 0x0a, 0x09, 0x43, 0x6f, 0x6e, 0x66, 0x69,
+	0x67, 0x75, 0x72, 0x65, 0x12, 0x1c, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35,
+	0x2e, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x75, 0x72, 0x65, 0x2e, 0x52, 0x65, 0x71, 0x75, 0x65,
+	0x73, 0x74, 0x1a, 0x1d, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x43,
+	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x75, 0x72, 0x65, 0x2e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
+	0x65, 0x12, 0x51, 0x0a, 0x0c, 0x52, 0x65, 0x61, 0x64, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
+	0x65, 0x12, 0x1f, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x52, 0x65,
+	0x61, 0x64, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x52, 0x65, 0x71, 0x75, 0x65,
+	0x73, 0x74, 0x1a, 0x20, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x52,
+	0x65, 0x61, 0x64, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x52, 0x65, 0x73, 0x70,
+	0x6f, 0x6e, 0x73, 0x65, 0x12, 0x63, 0x0a, 0x12, 0x50, 0x6c, 0x61, 0x6e, 0x52, 0x65, 0x73, 0x6f,
+	0x75, 0x72, 0x63, 0x65, 0x43, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x12, 0x25, 0x2e, 0x74, 0x66, 0x70,
+	0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x50, 0x6c, 0x61, 0x6e, 0x52, 0x65, 0x73, 0x6f, 0x75,
+	0x72, 0x63, 0x65, 0x43, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x2e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
+	0x74, 0x1a, 0x26, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x50, 0x6c,
 	0x61, 0x6e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x43, 0x68, 0x61, 0x6e, 0x67, 0x65,
-	0x2e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x26, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75,
-	0x67, 0x69, 0x6e, 0x35, 0x2e, 0x50, 0x6c, 0x61, 0x6e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
-	0x65, 0x43, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x2e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
-	0x12, 0x66, 0x0a, 0x13, 0x41, 0x70, 0x70, 0x6c, 0x79, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
-	0x65, 0x43, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x12, 0x26, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67,
-	0x69, 0x6e, 0x35, 0x2e, 0x41, 0x70, 0x70, 0x6c, 0x79, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
-	0x65, 0x43, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x2e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a,
-	0x27, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x41, 0x70, 0x70, 0x6c,
-	0x79, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x43, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x2e,
-	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x66, 0x0a, 0x13, 0x49, 0x6d, 0x70, 0x6f,
-	0x72, 0x74, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x53, 0x74, 0x61, 0x74, 0x65, 0x12,
-	0x26, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x49, 0x6d, 0x70, 0x6f,
-	0x72, 0x74, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x53, 0x74, 0x61, 0x74, 0x65, 0x2e,
-	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x27, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67,
-	0x69, 0x6e, 0x35, 0x2e, 0x49, 0x6d, 0x70, 0x6f, 0x72, 0x74, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72,
-	0x63, 0x65, 0x53, 0x74, 0x61, 0x74, 0x65, 0x2e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
-	0x12, 0x57, 0x0a, 0x0e, 0x52, 0x65, 0x61, 0x64, 0x44, 0x61, 0x74, 0x61, 0x53, 0x6f, 0x75, 0x72,
-	0x63, 0x65, 0x12, 0x21, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x52,
-	0x65, 0x61, 0x64, 0x44, 0x61, 0x74, 0x61, 0x53, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x52, 0x65,
-	0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x22, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e,
-	0x35, 0x2e, 0x52, 0x65, 0x61, 0x64, 0x44, 0x61, 0x74, 0x61, 0x53, 0x6f, 0x75, 0x72, 0x63, 0x65,
-	0x2e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x39, 0x0a, 0x04, 0x53, 0x74, 0x6f,
-	0x70, 0x12, 0x17, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x53, 0x74,
-	0x6f, 0x70, 0x2e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x18, 0x2e, 0x74, 0x66, 0x70,
-	0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x53, 0x74, 0x6f, 0x70, 0x2e, 0x52, 0x65, 0x73, 0x70,
-	0x6f, 0x6e, 0x73, 0x65, 0x32, 0x86, 0x03, 0x0a, 0x0b, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69,
-	0x6f, 0x6e, 0x65, 0x72, 0x12, 0x5e, 0x0a, 0x09, 0x47, 0x65, 0x74, 0x53, 0x63, 0x68, 0x65, 0x6d,
-	0x61, 0x12, 0x27, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x47, 0x65,
-	0x74, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x53, 0x63, 0x68, 0x65,
-	0x6d, 0x61, 0x2e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x28, 0x2e, 0x74, 0x66, 0x70,
-	0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x47, 0x65, 0x74, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x73,
-	0x69, 0x6f, 0x6e, 0x65, 0x72, 0x53, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x2e, 0x52, 0x65, 0x73, 0x70,
-	0x6f, 0x6e, 0x73, 0x65, 0x12, 0x78, 0x0a, 0x19, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65,
-	0x50, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69,
-	0x67, 0x12, 0x2c, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x56, 0x61,
-	0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65,
-	0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a,
-	0x2d, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x56, 0x61, 0x6c, 0x69,
-	0x64, 0x61, 0x74, 0x65, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x43,
-	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x62,
-	0x0a, 0x11, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x6f, 0x75,
-	0x72, 0x63, 0x65, 0x12, 0x24, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e,
-	0x50, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
-	0x65, 0x2e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x25, 0x2e, 0x74, 0x66, 0x70, 0x6c,
-	0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x52,
-	0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
-	0x30, 0x01, 0x12, 0x39, 0x0a, 0x04, 0x53, 0x74, 0x6f, 0x70, 0x12, 0x17, 0x2e, 0x74, 0x66, 0x70,
+	0x2e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x66, 0x0a, 0x13, 0x41, 0x70, 0x70,
+	0x6c, 0x79, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x43, 0x68, 0x61, 0x6e, 0x67, 0x65,
+	0x12, 0x26, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x41, 0x70, 0x70,
+	0x6c, 0x79, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x43, 0x68, 0x61, 0x6e, 0x67, 0x65,
+	0x2e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x27, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75,
+	0x67, 0x69, 0x6e, 0x35, 0x2e, 0x41, 0x70, 0x70, 0x6c, 0x79, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72,
+	0x63, 0x65, 0x43, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x2e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
+	0x65, 0x12, 0x66, 0x0a, 0x13, 0x49, 0x6d, 0x70, 0x6f, 0x72, 0x74, 0x52, 0x65, 0x73, 0x6f, 0x75,
+	0x72, 0x63, 0x65, 0x53, 0x74, 0x61, 0x74, 0x65, 0x12, 0x26, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75,
+	0x67, 0x69, 0x6e, 0x35, 0x2e, 0x49, 0x6d, 0x70, 0x6f, 0x72, 0x74, 0x52, 0x65, 0x73, 0x6f, 0x75,
+	0x72, 0x63, 0x65, 0x53, 0x74, 0x61, 0x74, 0x65, 0x2e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
+	0x1a, 0x27, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x49, 0x6d, 0x70,
+	0x6f, 0x72, 0x74, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x53, 0x74, 0x61, 0x74, 0x65,
+	0x2e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x57, 0x0a, 0x0e, 0x52, 0x65, 0x61,
+	0x64, 0x44, 0x61, 0x74, 0x61, 0x53, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x12, 0x21, 0x2e, 0x74, 0x66,
+	0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x52, 0x65, 0x61, 0x64, 0x44, 0x61, 0x74, 0x61,
+	0x53, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x22,
+	0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x52, 0x65, 0x61, 0x64, 0x44,
+	0x61, 0x74, 0x61, 0x53, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
+	0x73, 0x65, 0x12, 0x39, 0x0a, 0x04, 0x53, 0x74, 0x6f, 0x70, 0x12, 0x17, 0x2e, 0x74, 0x66, 0x70,
 	0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x53, 0x74, 0x6f, 0x70, 0x2e, 0x52, 0x65, 0x71, 0x75,
 	0x65, 0x73, 0x74, 0x1a, 0x18, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e,
-	0x53, 0x74, 0x6f, 0x70, 0x2e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x42, 0x47, 0x5a,
-	0x45, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x61, 0x73, 0x68,
-	0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, 0x74, 0x65, 0x72, 0x72, 0x61, 0x66, 0x6f, 0x72, 0x6d, 0x2d,
-	0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x2d, 0x67, 0x6f, 0x2f, 0x74, 0x66, 0x70, 0x72, 0x6f, 0x74,
-	0x6f, 0x76, 0x35, 0x2f, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2f, 0x74, 0x66, 0x70,
-	0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x53, 0x74, 0x6f, 0x70, 0x2e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x32, 0x86, 0x03,
+	0x0a, 0x0b, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x12, 0x5e, 0x0a,
+	0x09, 0x47, 0x65, 0x74, 0x53, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x12, 0x27, 0x2e, 0x74, 0x66, 0x70,
+	0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x47, 0x65, 0x74, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x73,
+	0x69, 0x6f, 0x6e, 0x65, 0x72, 0x53, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x2e, 0x52, 0x65, 0x71, 0x75,
+	0x65, 0x73, 0x74, 0x1a, 0x28, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e,
+	0x47, 0x65, 0x74, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x53, 0x63,
+	0x68, 0x65, 0x6d, 0x61, 0x2e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x78, 0x0a,
+	0x19, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69,
+	0x6f, 0x6e, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x2c, 0x2e, 0x74, 0x66, 0x70,
+	0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x50,
+	0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67,
+	0x2e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x2d, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75,
+	0x67, 0x69, 0x6e, 0x35, 0x2e, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x50, 0x72, 0x6f,
+	0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e, 0x52,
+	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x62, 0x0a, 0x11, 0x50, 0x72, 0x6f, 0x76, 0x69,
+	0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x12, 0x24, 0x2e, 0x74,
+	0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69,
+	0x6f, 0x6e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x52, 0x65, 0x71, 0x75, 0x65,
+	0x73, 0x74, 0x1a, 0x25, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x50,
+	0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
+	0x2e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x30, 0x01, 0x12, 0x39, 0x0a, 0x04, 0x53,
+	0x74, 0x6f, 0x70, 0x12, 0x17, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e,
+	0x53, 0x74, 0x6f, 0x70, 0x2e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x18, 0x2e, 0x74,
+	0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x2e, 0x53, 0x74, 0x6f, 0x70, 0x2e, 0x52, 0x65,
+	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x42, 0x47, 0x5a, 0x45, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62,
+	0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, 0x74,
+	0x65, 0x72, 0x72, 0x61, 0x66, 0x6f, 0x72, 0x6d, 0x2d, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x2d,
+	0x67, 0x6f, 0x2f, 0x74, 0x66, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x76, 0x35, 0x2f, 0x69, 0x6e, 0x74,
+	0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2f, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x35, 0x62,
+	0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
@@ -3831,7 +4123,7 @@ func file_tfplugin5_proto_rawDescGZIP() []byte {
 }
 
 var file_tfplugin5_proto_enumTypes = make([]protoimpl.EnumInfo, 3)
-var file_tfplugin5_proto_msgTypes = make([]protoimpl.MessageInfo, 59)
+var file_tfplugin5_proto_msgTypes = make([]protoimpl.MessageInfo, 64)
 var file_tfplugin5_proto_goTypes = []interface{}{
 	(StringKind)(0),                              // 0: tfplugin5.StringKind
 	(Diagnostic_Severity)(0),                     // 1: tfplugin5.Diagnostic.Severity
@@ -3842,160 +4134,171 @@ var file_tfplugin5_proto_goTypes = []interface{}{
 	(*Stop)(nil),                                 // 6: tfplugin5.Stop
 	(*RawState)(nil),                             // 7: tfplugin5.RawState
 	(*Schema)(nil),                               // 8: tfplugin5.Schema
-	(*GetProviderSchema)(nil),                    // 9: tfplugin5.GetProviderSchema
-	(*PrepareProviderConfig)(nil),                // 10: tfplugin5.PrepareProviderConfig
-	(*UpgradeResourceState)(nil),                 // 11: tfplugin5.UpgradeResourceState
-	(*ValidateResourceTypeConfig)(nil),           // 12: tfplugin5.ValidateResourceTypeConfig
-	(*ValidateDataSourceConfig)(nil),             // 13: tfplugin5.ValidateDataSourceConfig
-	(*Configure)(nil),                            // 14: tfplugin5.Configure
-	(*ReadResource)(nil),                         // 15: tfplugin5.ReadResource
-	(*PlanResourceChange)(nil),                   // 16: tfplugin5.PlanResourceChange
-	(*ApplyResourceChange)(nil),                  // 17: tfplugin5.ApplyResourceChange
-	(*ImportResourceState)(nil),                  // 18: tfplugin5.ImportResourceState
-	(*ReadDataSource)(nil),                       // 19: tfplugin5.ReadDataSource
-	(*GetProvisionerSchema)(nil),                 // 20: tfplugin5.GetProvisionerSchema
-	(*ValidateProvisionerConfig)(nil),            // 21: tfplugin5.ValidateProvisionerConfig
-	(*ProvisionResource)(nil),                    // 22: tfplugin5.ProvisionResource
-	(*AttributePath_Step)(nil),                   // 23: tfplugin5.AttributePath.Step
-	(*Stop_Request)(nil),                         // 24: tfplugin5.Stop.Request
-	(*Stop_Response)(nil),                        // 25: tfplugin5.Stop.Response
-	nil,                                          // 26: tfplugin5.RawState.FlatmapEntry
-	(*Schema_Block)(nil),                         // 27: tfplugin5.Schema.Block
-	(*Schema_Attribute)(nil),                     // 28: tfplugin5.Schema.Attribute
-	(*Schema_NestedBlock)(nil),                   // 29: tfplugin5.Schema.NestedBlock
-	(*GetProviderSchema_Request)(nil),            // 30: tfplugin5.GetProviderSchema.Request
-	(*GetProviderSchema_Response)(nil),           // 31: tfplugin5.GetProviderSchema.Response
-	(*GetProviderSchema_ServerCapabilities)(nil), // 32: tfplugin5.GetProviderSchema.ServerCapabilities
-	nil,                                    // 33: tfplugin5.GetProviderSchema.Response.ResourceSchemasEntry
-	nil,                                    // 34: tfplugin5.GetProviderSchema.Response.DataSourceSchemasEntry
-	(*PrepareProviderConfig_Request)(nil),  // 35: tfplugin5.PrepareProviderConfig.Request
-	(*PrepareProviderConfig_Response)(nil), // 36: tfplugin5.PrepareProviderConfig.Response
-	(*UpgradeResourceState_Request)(nil),   // 37: tfplugin5.UpgradeResourceState.Request
-	(*UpgradeResourceState_Response)(nil),  // 38: tfplugin5.UpgradeResourceState.Response
-	(*ValidateResourceTypeConfig_Request)(nil),   // 39: tfplugin5.ValidateResourceTypeConfig.Request
-	(*ValidateResourceTypeConfig_Response)(nil),  // 40: tfplugin5.ValidateResourceTypeConfig.Response
-	(*ValidateDataSourceConfig_Request)(nil),     // 41: tfplugin5.ValidateDataSourceConfig.Request
-	(*ValidateDataSourceConfig_Response)(nil),    // 42: tfplugin5.ValidateDataSourceConfig.Response
-	(*Configure_Request)(nil),                    // 43: tfplugin5.Configure.Request
-	(*Configure_Response)(nil),                   // 44: tfplugin5.Configure.Response
-	(*ReadResource_Request)(nil),                 // 45: tfplugin5.ReadResource.Request
-	(*ReadResource_Response)(nil),                // 46: tfplugin5.ReadResource.Response
-	(*PlanResourceChange_Request)(nil),           // 47: tfplugin5.PlanResourceChange.Request
-	(*PlanResourceChange_Response)(nil),          // 48: tfplugin5.PlanResourceChange.Response
-	(*ApplyResourceChange_Request)(nil),          // 49: tfplugin5.ApplyResourceChange.Request
-	(*ApplyResourceChange_Response)(nil),         // 50: tfplugin5.ApplyResourceChange.Response
-	(*ImportResourceState_Request)(nil),          // 51: tfplugin5.ImportResourceState.Request
-	(*ImportResourceState_ImportedResource)(nil), // 52: tfplugin5.ImportResourceState.ImportedResource
-	(*ImportResourceState_Response)(nil),         // 53: tfplugin5.ImportResourceState.Response
-	(*ReadDataSource_Request)(nil),               // 54: tfplugin5.ReadDataSource.Request
-	(*ReadDataSource_Response)(nil),              // 55: tfplugin5.ReadDataSource.Response
-	(*GetProvisionerSchema_Request)(nil),         // 56: tfplugin5.GetProvisionerSchema.Request
-	(*GetProvisionerSchema_Response)(nil),        // 57: tfplugin5.GetProvisionerSchema.Response
-	(*ValidateProvisionerConfig_Request)(nil),    // 58: tfplugin5.ValidateProvisionerConfig.Request
-	(*ValidateProvisionerConfig_Response)(nil),   // 59: tfplugin5.ValidateProvisionerConfig.Response
-	(*ProvisionResource_Request)(nil),            // 60: tfplugin5.ProvisionResource.Request
-	(*ProvisionResource_Response)(nil),           // 61: tfplugin5.ProvisionResource.Response
+	(*ServerCapabilities)(nil),                   // 9: tfplugin5.ServerCapabilities
+	(*GetMetadata)(nil),                          // 10: tfplugin5.GetMetadata
+	(*GetProviderSchema)(nil),                    // 11: tfplugin5.GetProviderSchema
+	(*PrepareProviderConfig)(nil),                // 12: tfplugin5.PrepareProviderConfig
+	(*UpgradeResourceState)(nil),                 // 13: tfplugin5.UpgradeResourceState
+	(*ValidateResourceTypeConfig)(nil),           // 14: tfplugin5.ValidateResourceTypeConfig
+	(*ValidateDataSourceConfig)(nil),             // 15: tfplugin5.ValidateDataSourceConfig
+	(*Configure)(nil),                            // 16: tfplugin5.Configure
+	(*ReadResource)(nil),                         // 17: tfplugin5.ReadResource
+	(*PlanResourceChange)(nil),                   // 18: tfplugin5.PlanResourceChange
+	(*ApplyResourceChange)(nil),                  // 19: tfplugin5.ApplyResourceChange
+	(*ImportResourceState)(nil),                  // 20: tfplugin5.ImportResourceState
+	(*ReadDataSource)(nil),                       // 21: tfplugin5.ReadDataSource
+	(*GetProvisionerSchema)(nil),                 // 22: tfplugin5.GetProvisionerSchema
+	(*ValidateProvisionerConfig)(nil),            // 23: tfplugin5.ValidateProvisionerConfig
+	(*ProvisionResource)(nil),                    // 24: tfplugin5.ProvisionResource
+	(*AttributePath_Step)(nil),                   // 25: tfplugin5.AttributePath.Step
+	(*Stop_Request)(nil),                         // 26: tfplugin5.Stop.Request
+	(*Stop_Response)(nil),                        // 27: tfplugin5.Stop.Response
+	nil,                                          // 28: tfplugin5.RawState.FlatmapEntry
+	(*Schema_Block)(nil),                         // 29: tfplugin5.Schema.Block
+	(*Schema_Attribute)(nil),                     // 30: tfplugin5.Schema.Attribute
+	(*Schema_NestedBlock)(nil),                   // 31: tfplugin5.Schema.NestedBlock
+	(*GetMetadata_Request)(nil),                  // 32: tfplugin5.GetMetadata.Request
+	(*GetMetadata_Response)(nil),                 // 33: tfplugin5.GetMetadata.Response
+	(*GetMetadata_DataSourceMetadata)(nil),       // 34: tfplugin5.GetMetadata.DataSourceMetadata
+	(*GetMetadata_ResourceMetadata)(nil),         // 35: tfplugin5.GetMetadata.ResourceMetadata
+	(*GetProviderSchema_Request)(nil),            // 36: tfplugin5.GetProviderSchema.Request
+	(*GetProviderSchema_Response)(nil),           // 37: tfplugin5.GetProviderSchema.Response
+	nil,                                          // 38: tfplugin5.GetProviderSchema.Response.ResourceSchemasEntry
+	nil,                                          // 39: tfplugin5.GetProviderSchema.Response.DataSourceSchemasEntry
+	(*PrepareProviderConfig_Request)(nil),        // 40: tfplugin5.PrepareProviderConfig.Request
+	(*PrepareProviderConfig_Response)(nil),       // 41: tfplugin5.PrepareProviderConfig.Response
+	(*UpgradeResourceState_Request)(nil),         // 42: tfplugin5.UpgradeResourceState.Request
+	(*UpgradeResourceState_Response)(nil),        // 43: tfplugin5.UpgradeResourceState.Response
+	(*ValidateResourceTypeConfig_Request)(nil),   // 44: tfplugin5.ValidateResourceTypeConfig.Request
+	(*ValidateResourceTypeConfig_Response)(nil),  // 45: tfplugin5.ValidateResourceTypeConfig.Response
+	(*ValidateDataSourceConfig_Request)(nil),     // 46: tfplugin5.ValidateDataSourceConfig.Request
+	(*ValidateDataSourceConfig_Response)(nil),    // 47: tfplugin5.ValidateDataSourceConfig.Response
+	(*Configure_Request)(nil),                    // 48: tfplugin5.Configure.Request
+	(*Configure_Response)(nil),                   // 49: tfplugin5.Configure.Response
+	(*ReadResource_Request)(nil),                 // 50: tfplugin5.ReadResource.Request
+	(*ReadResource_Response)(nil),                // 51: tfplugin5.ReadResource.Response
+	(*PlanResourceChange_Request)(nil),           // 52: tfplugin5.PlanResourceChange.Request
+	(*PlanResourceChange_Response)(nil),          // 53: tfplugin5.PlanResourceChange.Response
+	(*ApplyResourceChange_Request)(nil),          // 54: tfplugin5.ApplyResourceChange.Request
+	(*ApplyResourceChange_Response)(nil),         // 55: tfplugin5.ApplyResourceChange.Response
+	(*ImportResourceState_Request)(nil),          // 56: tfplugin5.ImportResourceState.Request
+	(*ImportResourceState_ImportedResource)(nil), // 57: tfplugin5.ImportResourceState.ImportedResource
+	(*ImportResourceState_Response)(nil),         // 58: tfplugin5.ImportResourceState.Response
+	(*ReadDataSource_Request)(nil),               // 59: tfplugin5.ReadDataSource.Request
+	(*ReadDataSource_Response)(nil),              // 60: tfplugin5.ReadDataSource.Response
+	(*GetProvisionerSchema_Request)(nil),         // 61: tfplugin5.GetProvisionerSchema.Request
+	(*GetProvisionerSchema_Response)(nil),        // 62: tfplugin5.GetProvisionerSchema.Response
+	(*ValidateProvisionerConfig_Request)(nil),    // 63: tfplugin5.ValidateProvisionerConfig.Request
+	(*ValidateProvisionerConfig_Response)(nil),   // 64: tfplugin5.ValidateProvisionerConfig.Response
+	(*ProvisionResource_Request)(nil),            // 65: tfplugin5.ProvisionResource.Request
+	(*ProvisionResource_Response)(nil),           // 66: tfplugin5.ProvisionResource.Response
 }
 var file_tfplugin5_proto_depIdxs = []int32{
 	1,  // 0: tfplugin5.Diagnostic.severity:type_name -> tfplugin5.Diagnostic.Severity
 	5,  // 1: tfplugin5.Diagnostic.attribute:type_name -> tfplugin5.AttributePath
-	23, // 2: tfplugin5.AttributePath.steps:type_name -> tfplugin5.AttributePath.Step
-	26, // 3: tfplugin5.RawState.flatmap:type_name -> tfplugin5.RawState.FlatmapEntry
-	27, // 4: tfplugin5.Schema.block:type_name -> tfplugin5.Schema.Block
-	28, // 5: tfplugin5.Schema.Block.attributes:type_name -> tfplugin5.Schema.Attribute
-	29, // 6: tfplugin5.Schema.Block.block_types:type_name -> tfplugin5.Schema.NestedBlock
+	25, // 2: tfplugin5.AttributePath.steps:type_name -> tfplugin5.AttributePath.Step
+	28, // 3: tfplugin5.RawState.flatmap:type_name -> tfplugin5.RawState.FlatmapEntry
+	29, // 4: tfplugin5.Schema.block:type_name -> tfplugin5.Schema.Block
+	30, // 5: tfplugin5.Schema.Block.attributes:type_name -> tfplugin5.Schema.Attribute
+	31, // 6: tfplugin5.Schema.Block.block_types:type_name -> tfplugin5.Schema.NestedBlock
 	0,  // 7: tfplugin5.Schema.Block.description_kind:type_name -> tfplugin5.StringKind
 	0,  // 8: tfplugin5.Schema.Attribute.description_kind:type_name -> tfplugin5.StringKind
-	27, // 9: tfplugin5.Schema.NestedBlock.block:type_name -> tfplugin5.Schema.Block
+	29, // 9: tfplugin5.Schema.NestedBlock.block:type_name -> tfplugin5.Schema.Block
 	2,  // 10: tfplugin5.Schema.NestedBlock.nesting:type_name -> tfplugin5.Schema.NestedBlock.NestingMode
-	8,  // 11: tfplugin5.GetProviderSchema.Response.provider:type_name -> tfplugin5.Schema
-	33, // 12: tfplugin5.GetProviderSchema.Response.resource_schemas:type_name -> tfplugin5.GetProviderSchema.Response.ResourceSchemasEntry
-	34, // 13: tfplugin5.GetProviderSchema.Response.data_source_schemas:type_name -> tfplugin5.GetProviderSchema.Response.DataSourceSchemasEntry
-	4,  // 14: tfplugin5.GetProviderSchema.Response.diagnostics:type_name -> tfplugin5.Diagnostic
-	8,  // 15: tfplugin5.GetProviderSchema.Response.provider_meta:type_name -> tfplugin5.Schema
-	32, // 16: tfplugin5.GetProviderSchema.Response.server_capabilities:type_name -> tfplugin5.GetProviderSchema.ServerCapabilities
-	8,  // 17: tfplugin5.GetProviderSchema.Response.ResourceSchemasEntry.value:type_name -> tfplugin5.Schema
-	8,  // 18: tfplugin5.GetProviderSchema.Response.DataSourceSchemasEntry.value:type_name -> tfplugin5.Schema
-	3,  // 19: tfplugin5.PrepareProviderConfig.Request.config:type_name -> tfplugin5.DynamicValue
-	3,  // 20: tfplugin5.PrepareProviderConfig.Response.prepared_config:type_name -> tfplugin5.DynamicValue
-	4,  // 21: tfplugin5.PrepareProviderConfig.Response.diagnostics:type_name -> tfplugin5.Diagnostic
-	7,  // 22: tfplugin5.UpgradeResourceState.Request.raw_state:type_name -> tfplugin5.RawState
-	3,  // 23: tfplugin5.UpgradeResourceState.Response.upgraded_state:type_name -> tfplugin5.DynamicValue
-	4,  // 24: tfplugin5.UpgradeResourceState.Response.diagnostics:type_name -> tfplugin5.Diagnostic
-	3,  // 25: tfplugin5.ValidateResourceTypeConfig.Request.config:type_name -> tfplugin5.DynamicValue
-	4,  // 26: tfplugin5.ValidateResourceTypeConfig.Response.diagnostics:type_name -> tfplugin5.Diagnostic
-	3,  // 27: tfplugin5.ValidateDataSourceConfig.Request.config:type_name -> tfplugin5.DynamicValue
-	4,  // 28: tfplugin5.ValidateDataSourceConfig.Response.diagnostics:type_name -> tfplugin5.Diagnostic
-	3,  // 29: tfplugin5.Configure.Request.config:type_name -> tfplugin5.DynamicValue
-	4,  // 30: tfplugin5.Configure.Response.diagnostics:type_name -> tfplugin5.Diagnostic
-	3,  // 31: tfplugin5.ReadResource.Request.current_state:type_name -> tfplugin5.DynamicValue
-	3,  // 32: tfplugin5.ReadResource.Request.provider_meta:type_name -> tfplugin5.DynamicValue
-	3,  // 33: tfplugin5.ReadResource.Response.new_state:type_name -> tfplugin5.DynamicValue
-	4,  // 34: tfplugin5.ReadResource.Response.diagnostics:type_name -> tfplugin5.Diagnostic
-	3,  // 35: tfplugin5.PlanResourceChange.Request.prior_state:type_name -> tfplugin5.DynamicValue
-	3,  // 36: tfplugin5.PlanResourceChange.Request.proposed_new_state:type_name -> tfplugin5.DynamicValue
-	3,  // 37: tfplugin5.PlanResourceChange.Request.config:type_name -> tfplugin5.DynamicValue
-	3,  // 38: tfplugin5.PlanResourceChange.Request.provider_meta:type_name -> tfplugin5.DynamicValue
-	3,  // 39: tfplugin5.PlanResourceChange.Response.planned_state:type_name -> tfplugin5.DynamicValue
-	5,  // 40: tfplugin5.PlanResourceChange.Response.requires_replace:type_name -> tfplugin5.AttributePath
-	4,  // 41: tfplugin5.PlanResourceChange.Response.diagnostics:type_name -> tfplugin5.Diagnostic
-	3,  // 42: tfplugin5.ApplyResourceChange.Request.prior_state:type_name -> tfplugin5.DynamicValue
-	3,  // 43: tfplugin5.ApplyResourceChange.Request.planned_state:type_name -> tfplugin5.DynamicValue
-	3,  // 44: tfplugin5.ApplyResourceChange.Request.config:type_name -> tfplugin5.DynamicValue
-	3,  // 45: tfplugin5.ApplyResourceChange.Request.provider_meta:type_name -> tfplugin5.DynamicValue
-	3,  // 46: tfplugin5.ApplyResourceChange.Response.new_state:type_name -> tfplugin5.DynamicValue
-	4,  // 47: tfplugin5.ApplyResourceChange.Response.diagnostics:type_name -> tfplugin5.Diagnostic
-	3,  // 48: tfplugin5.ImportResourceState.ImportedResource.state:type_name -> tfplugin5.DynamicValue
-	52, // 49: tfplugin5.ImportResourceState.Response.imported_resources:type_name -> tfplugin5.ImportResourceState.ImportedResource
-	4,  // 50: tfplugin5.ImportResourceState.Response.diagnostics:type_name -> tfplugin5.Diagnostic
-	3,  // 51: tfplugin5.ReadDataSource.Request.config:type_name -> tfplugin5.DynamicValue
-	3,  // 52: tfplugin5.ReadDataSource.Request.provider_meta:type_name -> tfplugin5.DynamicValue
-	3,  // 53: tfplugin5.ReadDataSource.Response.state:type_name -> tfplugin5.DynamicValue
-	4,  // 54: tfplugin5.ReadDataSource.Response.diagnostics:type_name -> tfplugin5.Diagnostic
-	8,  // 55: tfplugin5.GetProvisionerSchema.Response.provisioner:type_name -> tfplugin5.Schema
-	4,  // 56: tfplugin5.GetProvisionerSchema.Response.diagnostics:type_name -> tfplugin5.Diagnostic
-	3,  // 57: tfplugin5.ValidateProvisionerConfig.Request.config:type_name -> tfplugin5.DynamicValue
-	4,  // 58: tfplugin5.ValidateProvisionerConfig.Response.diagnostics:type_name -> tfplugin5.Diagnostic
-	3,  // 59: tfplugin5.ProvisionResource.Request.config:type_name -> tfplugin5.DynamicValue
-	3,  // 60: tfplugin5.ProvisionResource.Request.connection:type_name -> tfplugin5.DynamicValue
-	4,  // 61: tfplugin5.ProvisionResource.Response.diagnostics:type_name -> tfplugin5.Diagnostic
-	30, // 62: tfplugin5.Provider.GetSchema:input_type -> tfplugin5.GetProviderSchema.Request
-	35, // 63: tfplugin5.Provider.PrepareProviderConfig:input_type -> tfplugin5.PrepareProviderConfig.Request
-	39, // 64: tfplugin5.Provider.ValidateResourceTypeConfig:input_type -> tfplugin5.ValidateResourceTypeConfig.Request
-	41, // 65: tfplugin5.Provider.ValidateDataSourceConfig:input_type -> tfplugin5.ValidateDataSourceConfig.Request
-	37, // 66: tfplugin5.Provider.UpgradeResourceState:input_type -> tfplugin5.UpgradeResourceState.Request
-	43, // 67: tfplugin5.Provider.Configure:input_type -> tfplugin5.Configure.Request
-	45, // 68: tfplugin5.Provider.ReadResource:input_type -> tfplugin5.ReadResource.Request
-	47, // 69: tfplugin5.Provider.PlanResourceChange:input_type -> tfplugin5.PlanResourceChange.Request
-	49, // 70: tfplugin5.Provider.ApplyResourceChange:input_type -> tfplugin5.ApplyResourceChange.Request
-	51, // 71: tfplugin5.Provider.ImportResourceState:input_type -> tfplugin5.ImportResourceState.Request
-	54, // 72: tfplugin5.Provider.ReadDataSource:input_type -> tfplugin5.ReadDataSource.Request
-	24, // 73: tfplugin5.Provider.Stop:input_type -> tfplugin5.Stop.Request
-	56, // 74: tfplugin5.Provisioner.GetSchema:input_type -> tfplugin5.GetProvisionerSchema.Request
-	58, // 75: tfplugin5.Provisioner.ValidateProvisionerConfig:input_type -> tfplugin5.ValidateProvisionerConfig.Request
-	60, // 76: tfplugin5.Provisioner.ProvisionResource:input_type -> tfplugin5.ProvisionResource.Request
-	24, // 77: tfplugin5.Provisioner.Stop:input_type -> tfplugin5.Stop.Request
-	31, // 78: tfplugin5.Provider.GetSchema:output_type -> tfplugin5.GetProviderSchema.Response
-	36, // 79: tfplugin5.Provider.PrepareProviderConfig:output_type -> tfplugin5.PrepareProviderConfig.Response
-	40, // 80: tfplugin5.Provider.ValidateResourceTypeConfig:output_type -> tfplugin5.ValidateResourceTypeConfig.Response
-	42, // 81: tfplugin5.Provider.ValidateDataSourceConfig:output_type -> tfplugin5.ValidateDataSourceConfig.Response
-	38, // 82: tfplugin5.Provider.UpgradeResourceState:output_type -> tfplugin5.UpgradeResourceState.Response
-	44, // 83: tfplugin5.Provider.Configure:output_type -> tfplugin5.Configure.Response
-	46, // 84: tfplugin5.Provider.ReadResource:output_type -> tfplugin5.ReadResource.Response
-	48, // 85: tfplugin5.Provider.PlanResourceChange:output_type -> tfplugin5.PlanResourceChange.Response
-	50, // 86: tfplugin5.Provider.ApplyResourceChange:output_type -> tfplugin5.ApplyResourceChange.Response
-	53, // 87: tfplugin5.Provider.ImportResourceState:output_type -> tfplugin5.ImportResourceState.Response
-	55, // 88: tfplugin5.Provider.ReadDataSource:output_type -> tfplugin5.ReadDataSource.Response
-	25, // 89: tfplugin5.Provider.Stop:output_type -> tfplugin5.Stop.Response
-	57, // 90: tfplugin5.Provisioner.GetSchema:output_type -> tfplugin5.GetProvisionerSchema.Response
-	59, // 91: tfplugin5.Provisioner.ValidateProvisionerConfig:output_type -> tfplugin5.ValidateProvisionerConfig.Response
-	61, // 92: tfplugin5.Provisioner.ProvisionResource:output_type -> tfplugin5.ProvisionResource.Response
-	25, // 93: tfplugin5.Provisioner.Stop:output_type -> tfplugin5.Stop.Response
-	78, // [78:94] is the sub-list for method output_type
-	62, // [62:78] is the sub-list for method input_type
-	62, // [62:62] is the sub-list for extension type_name
-	62, // [62:62] is the sub-list for extension extendee
-	0,  // [0:62] is the sub-list for field type_name
+	9,  // 11: tfplugin5.GetMetadata.Response.server_capabilities:type_name -> tfplugin5.ServerCapabilities
+	4,  // 12: tfplugin5.GetMetadata.Response.diagnostics:type_name -> tfplugin5.Diagnostic
+	34, // 13: tfplugin5.GetMetadata.Response.data_sources:type_name -> tfplugin5.GetMetadata.DataSourceMetadata
+	35, // 14: tfplugin5.GetMetadata.Response.resources:type_name -> tfplugin5.GetMetadata.ResourceMetadata
+	8,  // 15: tfplugin5.GetProviderSchema.Response.provider:type_name -> tfplugin5.Schema
+	38, // 16: tfplugin5.GetProviderSchema.Response.resource_schemas:type_name -> tfplugin5.GetProviderSchema.Response.ResourceSchemasEntry
+	39, // 17: tfplugin5.GetProviderSchema.Response.data_source_schemas:type_name -> tfplugin5.GetProviderSchema.Response.DataSourceSchemasEntry
+	4,  // 18: tfplugin5.GetProviderSchema.Response.diagnostics:type_name -> tfplugin5.Diagnostic
+	8,  // 19: tfplugin5.GetProviderSchema.Response.provider_meta:type_name -> tfplugin5.Schema
+	9,  // 20: tfplugin5.GetProviderSchema.Response.server_capabilities:type_name -> tfplugin5.ServerCapabilities
+	8,  // 21: tfplugin5.GetProviderSchema.Response.ResourceSchemasEntry.value:type_name -> tfplugin5.Schema
+	8,  // 22: tfplugin5.GetProviderSchema.Response.DataSourceSchemasEntry.value:type_name -> tfplugin5.Schema
+	3,  // 23: tfplugin5.PrepareProviderConfig.Request.config:type_name -> tfplugin5.DynamicValue
+	3,  // 24: tfplugin5.PrepareProviderConfig.Response.prepared_config:type_name -> tfplugin5.DynamicValue
+	4,  // 25: tfplugin5.PrepareProviderConfig.Response.diagnostics:type_name -> tfplugin5.Diagnostic
+	7,  // 26: tfplugin5.UpgradeResourceState.Request.raw_state:type_name -> tfplugin5.RawState
+	3,  // 27: tfplugin5.UpgradeResourceState.Response.upgraded_state:type_name -> tfplugin5.DynamicValue
+	4,  // 28: tfplugin5.UpgradeResourceState.Response.diagnostics:type_name -> tfplugin5.Diagnostic
+	3,  // 29: tfplugin5.ValidateResourceTypeConfig.Request.config:type_name -> tfplugin5.DynamicValue
+	4,  // 30: tfplugin5.ValidateResourceTypeConfig.Response.diagnostics:type_name -> tfplugin5.Diagnostic
+	3,  // 31: tfplugin5.ValidateDataSourceConfig.Request.config:type_name -> tfplugin5.DynamicValue
+	4,  // 32: tfplugin5.ValidateDataSourceConfig.Response.diagnostics:type_name -> tfplugin5.Diagnostic
+	3,  // 33: tfplugin5.Configure.Request.config:type_name -> tfplugin5.DynamicValue
+	4,  // 34: tfplugin5.Configure.Response.diagnostics:type_name -> tfplugin5.Diagnostic
+	3,  // 35: tfplugin5.ReadResource.Request.current_state:type_name -> tfplugin5.DynamicValue
+	3,  // 36: tfplugin5.ReadResource.Request.provider_meta:type_name -> tfplugin5.DynamicValue
+	3,  // 37: tfplugin5.ReadResource.Response.new_state:type_name -> tfplugin5.DynamicValue
+	4,  // 38: tfplugin5.ReadResource.Response.diagnostics:type_name -> tfplugin5.Diagnostic
+	3,  // 39: tfplugin5.PlanResourceChange.Request.prior_state:type_name -> tfplugin5.DynamicValue
+	3,  // 40: tfplugin5.PlanResourceChange.Request.proposed_new_state:type_name -> tfplugin5.DynamicValue
+	3,  // 41: tfplugin5.PlanResourceChange.Request.config:type_name -> tfplugin5.DynamicValue
+	3,  // 42: tfplugin5.PlanResourceChange.Request.provider_meta:type_name -> tfplugin5.DynamicValue
+	3,  // 43: tfplugin5.PlanResourceChange.Response.planned_state:type_name -> tfplugin5.DynamicValue
+	5,  // 44: tfplugin5.PlanResourceChange.Response.requires_replace:type_name -> tfplugin5.AttributePath
+	4,  // 45: tfplugin5.PlanResourceChange.Response.diagnostics:type_name -> tfplugin5.Diagnostic
+	3,  // 46: tfplugin5.ApplyResourceChange.Request.prior_state:type_name -> tfplugin5.DynamicValue
+	3,  // 47: tfplugin5.ApplyResourceChange.Request.planned_state:type_name -> tfplugin5.DynamicValue
+	3,  // 48: tfplugin5.ApplyResourceChange.Request.config:type_name -> tfplugin5.DynamicValue
+	3,  // 49: tfplugin5.ApplyResourceChange.Request.provider_meta:type_name -> tfplugin5.DynamicValue
+	3,  // 50: tfplugin5.ApplyResourceChange.Response.new_state:type_name -> tfplugin5.DynamicValue
+	4,  // 51: tfplugin5.ApplyResourceChange.Response.diagnostics:type_name -> tfplugin5.Diagnostic
+	3,  // 52: tfplugin5.ImportResourceState.ImportedResource.state:type_name -> tfplugin5.DynamicValue
+	57, // 53: tfplugin5.ImportResourceState.Response.imported_resources:type_name -> tfplugin5.ImportResourceState.ImportedResource
+	4,  // 54: tfplugin5.ImportResourceState.Response.diagnostics:type_name -> tfplugin5.Diagnostic
+	3,  // 55: tfplugin5.ReadDataSource.Request.config:type_name -> tfplugin5.DynamicValue
+	3,  // 56: tfplugin5.ReadDataSource.Request.provider_meta:type_name -> tfplugin5.DynamicValue
+	3,  // 57: tfplugin5.ReadDataSource.Response.state:type_name -> tfplugin5.DynamicValue
+	4,  // 58: tfplugin5.ReadDataSource.Response.diagnostics:type_name -> tfplugin5.Diagnostic
+	8,  // 59: tfplugin5.GetProvisionerSchema.Response.provisioner:type_name -> tfplugin5.Schema
+	4,  // 60: tfplugin5.GetProvisionerSchema.Response.diagnostics:type_name -> tfplugin5.Diagnostic
+	3,  // 61: tfplugin5.ValidateProvisionerConfig.Request.config:type_name -> tfplugin5.DynamicValue
+	4,  // 62: tfplugin5.ValidateProvisionerConfig.Response.diagnostics:type_name -> tfplugin5.Diagnostic
+	3,  // 63: tfplugin5.ProvisionResource.Request.config:type_name -> tfplugin5.DynamicValue
+	3,  // 64: tfplugin5.ProvisionResource.Request.connection:type_name -> tfplugin5.DynamicValue
+	4,  // 65: tfplugin5.ProvisionResource.Response.diagnostics:type_name -> tfplugin5.Diagnostic
+	32, // 66: tfplugin5.Provider.GetMetadata:input_type -> tfplugin5.GetMetadata.Request
+	36, // 67: tfplugin5.Provider.GetSchema:input_type -> tfplugin5.GetProviderSchema.Request
+	40, // 68: tfplugin5.Provider.PrepareProviderConfig:input_type -> tfplugin5.PrepareProviderConfig.Request
+	44, // 69: tfplugin5.Provider.ValidateResourceTypeConfig:input_type -> tfplugin5.ValidateResourceTypeConfig.Request
+	46, // 70: tfplugin5.Provider.ValidateDataSourceConfig:input_type -> tfplugin5.ValidateDataSourceConfig.Request
+	42, // 71: tfplugin5.Provider.UpgradeResourceState:input_type -> tfplugin5.UpgradeResourceState.Request
+	48, // 72: tfplugin5.Provider.Configure:input_type -> tfplugin5.Configure.Request
+	50, // 73: tfplugin5.Provider.ReadResource:input_type -> tfplugin5.ReadResource.Request
+	52, // 74: tfplugin5.Provider.PlanResourceChange:input_type -> tfplugin5.PlanResourceChange.Request
+	54, // 75: tfplugin5.Provider.ApplyResourceChange:input_type -> tfplugin5.ApplyResourceChange.Request
+	56, // 76: tfplugin5.Provider.ImportResourceState:input_type -> tfplugin5.ImportResourceState.Request
+	59, // 77: tfplugin5.Provider.ReadDataSource:input_type -> tfplugin5.ReadDataSource.Request
+	26, // 78: tfplugin5.Provider.Stop:input_type -> tfplugin5.Stop.Request
+	61, // 79: tfplugin5.Provisioner.GetSchema:input_type -> tfplugin5.GetProvisionerSchema.Request
+	63, // 80: tfplugin5.Provisioner.ValidateProvisionerConfig:input_type -> tfplugin5.ValidateProvisionerConfig.Request
+	65, // 81: tfplugin5.Provisioner.ProvisionResource:input_type -> tfplugin5.ProvisionResource.Request
+	26, // 82: tfplugin5.Provisioner.Stop:input_type -> tfplugin5.Stop.Request
+	33, // 83: tfplugin5.Provider.GetMetadata:output_type -> tfplugin5.GetMetadata.Response
+	37, // 84: tfplugin5.Provider.GetSchema:output_type -> tfplugin5.GetProviderSchema.Response
+	41, // 85: tfplugin5.Provider.PrepareProviderConfig:output_type -> tfplugin5.PrepareProviderConfig.Response
+	45, // 86: tfplugin5.Provider.ValidateResourceTypeConfig:output_type -> tfplugin5.ValidateResourceTypeConfig.Response
+	47, // 87: tfplugin5.Provider.ValidateDataSourceConfig:output_type -> tfplugin5.ValidateDataSourceConfig.Response
+	43, // 88: tfplugin5.Provider.UpgradeResourceState:output_type -> tfplugin5.UpgradeResourceState.Response
+	49, // 89: tfplugin5.Provider.Configure:output_type -> tfplugin5.Configure.Response
+	51, // 90: tfplugin5.Provider.ReadResource:output_type -> tfplugin5.ReadResource.Response
+	53, // 91: tfplugin5.Provider.PlanResourceChange:output_type -> tfplugin5.PlanResourceChange.Response
+	55, // 92: tfplugin5.Provider.ApplyResourceChange:output_type -> tfplugin5.ApplyResourceChange.Response
+	58, // 93: tfplugin5.Provider.ImportResourceState:output_type -> tfplugin5.ImportResourceState.Response
+	60, // 94: tfplugin5.Provider.ReadDataSource:output_type -> tfplugin5.ReadDataSource.Response
+	27, // 95: tfplugin5.Provider.Stop:output_type -> tfplugin5.Stop.Response
+	62, // 96: tfplugin5.Provisioner.GetSchema:output_type -> tfplugin5.GetProvisionerSchema.Response
+	64, // 97: tfplugin5.Provisioner.ValidateProvisionerConfig:output_type -> tfplugin5.ValidateProvisionerConfig.Response
+	66, // 98: tfplugin5.Provisioner.ProvisionResource:output_type -> tfplugin5.ProvisionResource.Response
+	27, // 99: tfplugin5.Provisioner.Stop:output_type -> tfplugin5.Stop.Response
+	83, // [83:100] is the sub-list for method output_type
+	66, // [66:83] is the sub-list for method input_type
+	66, // [66:66] is the sub-list for extension type_name
+	66, // [66:66] is the sub-list for extension extendee
+	0,  // [0:66] is the sub-list for field type_name
 }
 
 func init() { file_tfplugin5_proto_init() }
@@ -4077,7 +4380,7 @@ func file_tfplugin5_proto_init() {
 			}
 		}
 		file_tfplugin5_proto_msgTypes[6].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*GetProviderSchema); i {
+			switch v := v.(*ServerCapabilities); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -4089,7 +4392,7 @@ func file_tfplugin5_proto_init() {
 			}
 		}
 		file_tfplugin5_proto_msgTypes[7].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*PrepareProviderConfig); i {
+			switch v := v.(*GetMetadata); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -4101,7 +4404,7 @@ func file_tfplugin5_proto_init() {
 			}
 		}
 		file_tfplugin5_proto_msgTypes[8].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*UpgradeResourceState); i {
+			switch v := v.(*GetProviderSchema); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -4113,7 +4416,7 @@ func file_tfplugin5_proto_init() {
 			}
 		}
 		file_tfplugin5_proto_msgTypes[9].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ValidateResourceTypeConfig); i {
+			switch v := v.(*PrepareProviderConfig); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -4125,7 +4428,7 @@ func file_tfplugin5_proto_init() {
 			}
 		}
 		file_tfplugin5_proto_msgTypes[10].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ValidateDataSourceConfig); i {
+			switch v := v.(*UpgradeResourceState); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -4137,7 +4440,7 @@ func file_tfplugin5_proto_init() {
 			}
 		}
 		file_tfplugin5_proto_msgTypes[11].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Configure); i {
+			switch v := v.(*ValidateResourceTypeConfig); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -4149,7 +4452,7 @@ func file_tfplugin5_proto_init() {
 			}
 		}
 		file_tfplugin5_proto_msgTypes[12].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ReadResource); i {
+			switch v := v.(*ValidateDataSourceConfig); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -4161,7 +4464,7 @@ func file_tfplugin5_proto_init() {
 			}
 		}
 		file_tfplugin5_proto_msgTypes[13].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*PlanResourceChange); i {
+			switch v := v.(*Configure); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -4173,7 +4476,7 @@ func file_tfplugin5_proto_init() {
 			}
 		}
 		file_tfplugin5_proto_msgTypes[14].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ApplyResourceChange); i {
+			switch v := v.(*ReadResource); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -4185,7 +4488,7 @@ func file_tfplugin5_proto_init() {
 			}
 		}
 		file_tfplugin5_proto_msgTypes[15].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ImportResourceState); i {
+			switch v := v.(*PlanResourceChange); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -4197,7 +4500,7 @@ func file_tfplugin5_proto_init() {
 			}
 		}
 		file_tfplugin5_proto_msgTypes[16].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ReadDataSource); i {
+			switch v := v.(*ApplyResourceChange); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -4209,7 +4512,7 @@ func file_tfplugin5_proto_init() {
 			}
 		}
 		file_tfplugin5_proto_msgTypes[17].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*GetProvisionerSchema); i {
+			switch v := v.(*ImportResourceState); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -4221,7 +4524,7 @@ func file_tfplugin5_proto_init() {
 			}
 		}
 		file_tfplugin5_proto_msgTypes[18].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ValidateProvisionerConfig); i {
+			switch v := v.(*ReadDataSource); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -4233,7 +4536,7 @@ func file_tfplugin5_proto_init() {
 			}
 		}
 		file_tfplugin5_proto_msgTypes[19].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ProvisionResource); i {
+			switch v := v.(*GetProvisionerSchema); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -4245,7 +4548,7 @@ func file_tfplugin5_proto_init() {
 			}
 		}
 		file_tfplugin5_proto_msgTypes[20].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*AttributePath_Step); i {
+			switch v := v.(*ValidateProvisionerConfig); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -4257,7 +4560,7 @@ func file_tfplugin5_proto_init() {
 			}
 		}
 		file_tfplugin5_proto_msgTypes[21].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Stop_Request); i {
+			switch v := v.(*ProvisionResource); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -4269,7 +4572,7 @@ func file_tfplugin5_proto_init() {
 			}
 		}
 		file_tfplugin5_proto_msgTypes[22].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Stop_Response); i {
+			switch v := v.(*AttributePath_Step); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -4280,8 +4583,8 @@ func file_tfplugin5_proto_init() {
 				return nil
 			}
 		}
-		file_tfplugin5_proto_msgTypes[24].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Schema_Block); i {
+		file_tfplugin5_proto_msgTypes[23].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Stop_Request); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -4292,8 +4595,8 @@ func file_tfplugin5_proto_init() {
 				return nil
 			}
 		}
-		file_tfplugin5_proto_msgTypes[25].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Schema_Attribute); i {
+		file_tfplugin5_proto_msgTypes[24].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Stop_Response); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -4305,7 +4608,7 @@ func file_tfplugin5_proto_init() {
 			}
 		}
 		file_tfplugin5_proto_msgTypes[26].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Schema_NestedBlock); i {
+			switch v := v.(*Schema_Block); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -4317,7 +4620,7 @@ func file_tfplugin5_proto_init() {
 			}
 		}
 		file_tfplugin5_proto_msgTypes[27].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*GetProviderSchema_Request); i {
+			switch v := v.(*Schema_Attribute); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -4329,7 +4632,7 @@ func file_tfplugin5_proto_init() {
 			}
 		}
 		file_tfplugin5_proto_msgTypes[28].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*GetProviderSchema_Response); i {
+			switch v := v.(*Schema_NestedBlock); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -4341,7 +4644,31 @@ func file_tfplugin5_proto_init() {
 			}
 		}
 		file_tfplugin5_proto_msgTypes[29].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*GetProviderSchema_ServerCapabilities); i {
+			switch v := v.(*GetMetadata_Request); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_tfplugin5_proto_msgTypes[30].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*GetMetadata_Response); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_tfplugin5_proto_msgTypes[31].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*GetMetadata_DataSourceMetadata); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -4353,7 +4680,7 @@ func file_tfplugin5_proto_init() {
 			}
 		}
 		file_tfplugin5_proto_msgTypes[32].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*PrepareProviderConfig_Request); i {
+			switch v := v.(*GetMetadata_ResourceMetadata); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -4365,7 +4692,7 @@ func file_tfplugin5_proto_init() {
 			}
 		}
 		file_tfplugin5_proto_msgTypes[33].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*PrepareProviderConfig_Response); i {
+			switch v := v.(*GetProviderSchema_Request); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -4377,6 +4704,42 @@ func file_tfplugin5_proto_init() {
 			}
 		}
 		file_tfplugin5_proto_msgTypes[34].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*GetProviderSchema_Response); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_tfplugin5_proto_msgTypes[37].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*PrepareProviderConfig_Request); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_tfplugin5_proto_msgTypes[38].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*PrepareProviderConfig_Response); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_tfplugin5_proto_msgTypes[39].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*UpgradeResourceState_Request); i {
 			case 0:
 				return &v.state
@@ -4388,7 +4751,7 @@ func file_tfplugin5_proto_init() {
 				return nil
 			}
 		}
-		file_tfplugin5_proto_msgTypes[35].Exporter = func(v interface{}, i int) interface{} {
+		file_tfplugin5_proto_msgTypes[40].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*UpgradeResourceState_Response); i {
 			case 0:
 				return &v.state
@@ -4400,7 +4763,7 @@ func file_tfplugin5_proto_init() {
 				return nil
 			}
 		}
-		file_tfplugin5_proto_msgTypes[36].Exporter = func(v interface{}, i int) interface{} {
+		file_tfplugin5_proto_msgTypes[41].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*ValidateResourceTypeConfig_Request); i {
 			case 0:
 				return &v.state
@@ -4412,7 +4775,7 @@ func file_tfplugin5_proto_init() {
 				return nil
 			}
 		}
-		file_tfplugin5_proto_msgTypes[37].Exporter = func(v interface{}, i int) interface{} {
+		file_tfplugin5_proto_msgTypes[42].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*ValidateResourceTypeConfig_Response); i {
 			case 0:
 				return &v.state
@@ -4424,7 +4787,7 @@ func file_tfplugin5_proto_init() {
 				return nil
 			}
 		}
-		file_tfplugin5_proto_msgTypes[38].Exporter = func(v interface{}, i int) interface{} {
+		file_tfplugin5_proto_msgTypes[43].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*ValidateDataSourceConfig_Request); i {
 			case 0:
 				return &v.state
@@ -4436,7 +4799,7 @@ func file_tfplugin5_proto_init() {
 				return nil
 			}
 		}
-		file_tfplugin5_proto_msgTypes[39].Exporter = func(v interface{}, i int) interface{} {
+		file_tfplugin5_proto_msgTypes[44].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*ValidateDataSourceConfig_Response); i {
 			case 0:
 				return &v.state
@@ -4448,7 +4811,7 @@ func file_tfplugin5_proto_init() {
 				return nil
 			}
 		}
-		file_tfplugin5_proto_msgTypes[40].Exporter = func(v interface{}, i int) interface{} {
+		file_tfplugin5_proto_msgTypes[45].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*Configure_Request); i {
 			case 0:
 				return &v.state
@@ -4460,7 +4823,7 @@ func file_tfplugin5_proto_init() {
 				return nil
 			}
 		}
-		file_tfplugin5_proto_msgTypes[41].Exporter = func(v interface{}, i int) interface{} {
+		file_tfplugin5_proto_msgTypes[46].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*Configure_Response); i {
 			case 0:
 				return &v.state
@@ -4472,7 +4835,7 @@ func file_tfplugin5_proto_init() {
 				return nil
 			}
 		}
-		file_tfplugin5_proto_msgTypes[42].Exporter = func(v interface{}, i int) interface{} {
+		file_tfplugin5_proto_msgTypes[47].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*ReadResource_Request); i {
 			case 0:
 				return &v.state
@@ -4484,7 +4847,7 @@ func file_tfplugin5_proto_init() {
 				return nil
 			}
 		}
-		file_tfplugin5_proto_msgTypes[43].Exporter = func(v interface{}, i int) interface{} {
+		file_tfplugin5_proto_msgTypes[48].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*ReadResource_Response); i {
 			case 0:
 				return &v.state
@@ -4496,7 +4859,7 @@ func file_tfplugin5_proto_init() {
 				return nil
 			}
 		}
-		file_tfplugin5_proto_msgTypes[44].Exporter = func(v interface{}, i int) interface{} {
+		file_tfplugin5_proto_msgTypes[49].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*PlanResourceChange_Request); i {
 			case 0:
 				return &v.state
@@ -4508,7 +4871,7 @@ func file_tfplugin5_proto_init() {
 				return nil
 			}
 		}
-		file_tfplugin5_proto_msgTypes[45].Exporter = func(v interface{}, i int) interface{} {
+		file_tfplugin5_proto_msgTypes[50].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*PlanResourceChange_Response); i {
 			case 0:
 				return &v.state
@@ -4520,7 +4883,7 @@ func file_tfplugin5_proto_init() {
 				return nil
 			}
 		}
-		file_tfplugin5_proto_msgTypes[46].Exporter = func(v interface{}, i int) interface{} {
+		file_tfplugin5_proto_msgTypes[51].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*ApplyResourceChange_Request); i {
 			case 0:
 				return &v.state
@@ -4532,7 +4895,7 @@ func file_tfplugin5_proto_init() {
 				return nil
 			}
 		}
-		file_tfplugin5_proto_msgTypes[47].Exporter = func(v interface{}, i int) interface{} {
+		file_tfplugin5_proto_msgTypes[52].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*ApplyResourceChange_Response); i {
 			case 0:
 				return &v.state
@@ -4544,7 +4907,7 @@ func file_tfplugin5_proto_init() {
 				return nil
 			}
 		}
-		file_tfplugin5_proto_msgTypes[48].Exporter = func(v interface{}, i int) interface{} {
+		file_tfplugin5_proto_msgTypes[53].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*ImportResourceState_Request); i {
 			case 0:
 				return &v.state
@@ -4556,7 +4919,7 @@ func file_tfplugin5_proto_init() {
 				return nil
 			}
 		}
-		file_tfplugin5_proto_msgTypes[49].Exporter = func(v interface{}, i int) interface{} {
+		file_tfplugin5_proto_msgTypes[54].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*ImportResourceState_ImportedResource); i {
 			case 0:
 				return &v.state
@@ -4568,7 +4931,7 @@ func file_tfplugin5_proto_init() {
 				return nil
 			}
 		}
-		file_tfplugin5_proto_msgTypes[50].Exporter = func(v interface{}, i int) interface{} {
+		file_tfplugin5_proto_msgTypes[55].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*ImportResourceState_Response); i {
 			case 0:
 				return &v.state
@@ -4580,7 +4943,7 @@ func file_tfplugin5_proto_init() {
 				return nil
 			}
 		}
-		file_tfplugin5_proto_msgTypes[51].Exporter = func(v interface{}, i int) interface{} {
+		file_tfplugin5_proto_msgTypes[56].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*ReadDataSource_Request); i {
 			case 0:
 				return &v.state
@@ -4592,7 +4955,7 @@ func file_tfplugin5_proto_init() {
 				return nil
 			}
 		}
-		file_tfplugin5_proto_msgTypes[52].Exporter = func(v interface{}, i int) interface{} {
+		file_tfplugin5_proto_msgTypes[57].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*ReadDataSource_Response); i {
 			case 0:
 				return &v.state
@@ -4604,7 +4967,7 @@ func file_tfplugin5_proto_init() {
 				return nil
 			}
 		}
-		file_tfplugin5_proto_msgTypes[53].Exporter = func(v interface{}, i int) interface{} {
+		file_tfplugin5_proto_msgTypes[58].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*GetProvisionerSchema_Request); i {
 			case 0:
 				return &v.state
@@ -4616,7 +4979,7 @@ func file_tfplugin5_proto_init() {
 				return nil
 			}
 		}
-		file_tfplugin5_proto_msgTypes[54].Exporter = func(v interface{}, i int) interface{} {
+		file_tfplugin5_proto_msgTypes[59].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*GetProvisionerSchema_Response); i {
 			case 0:
 				return &v.state
@@ -4628,7 +4991,7 @@ func file_tfplugin5_proto_init() {
 				return nil
 			}
 		}
-		file_tfplugin5_proto_msgTypes[55].Exporter = func(v interface{}, i int) interface{} {
+		file_tfplugin5_proto_msgTypes[60].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*ValidateProvisionerConfig_Request); i {
 			case 0:
 				return &v.state
@@ -4640,7 +5003,7 @@ func file_tfplugin5_proto_init() {
 				return nil
 			}
 		}
-		file_tfplugin5_proto_msgTypes[56].Exporter = func(v interface{}, i int) interface{} {
+		file_tfplugin5_proto_msgTypes[61].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*ValidateProvisionerConfig_Response); i {
 			case 0:
 				return &v.state
@@ -4652,7 +5015,7 @@ func file_tfplugin5_proto_init() {
 				return nil
 			}
 		}
-		file_tfplugin5_proto_msgTypes[57].Exporter = func(v interface{}, i int) interface{} {
+		file_tfplugin5_proto_msgTypes[62].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*ProvisionResource_Request); i {
 			case 0:
 				return &v.state
@@ -4664,7 +5027,7 @@ func file_tfplugin5_proto_init() {
 				return nil
 			}
 		}
-		file_tfplugin5_proto_msgTypes[58].Exporter = func(v interface{}, i int) interface{} {
+		file_tfplugin5_proto_msgTypes[63].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*ProvisionResource_Response); i {
 			case 0:
 				return &v.state
@@ -4677,7 +5040,7 @@ func file_tfplugin5_proto_init() {
 			}
 		}
 	}
-	file_tfplugin5_proto_msgTypes[20].OneofWrappers = []interface{}{
+	file_tfplugin5_proto_msgTypes[22].OneofWrappers = []interface{}{
 		(*AttributePath_Step_AttributeName)(nil),
 		(*AttributePath_Step_ElementKeyString)(nil),
 		(*AttributePath_Step_ElementKeyInt)(nil),
@@ -4688,7 +5051,7 @@ func file_tfplugin5_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: file_tfplugin5_proto_rawDesc,
 			NumEnums:      3,
-			NumMessages:   59,
+			NumMessages:   64,
 			NumExtensions: 0,
 			NumServices:   2,
 		},
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/tfplugin5/tfplugin5.proto b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/tfplugin5/tfplugin5.proto
index 6cdaf2c0305..639147f9550 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/tfplugin5/tfplugin5.proto
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/tfplugin5/tfplugin5.proto
@@ -1,6 +1,9 @@
-// Terraform Plugin RPC protocol version 5.3
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+// Terraform Plugin RPC protocol version 5.4
 //
-// This file defines version 5.3 of the RPC protocol. To implement a plugin
+// This file defines version 5.4 of the RPC protocol. To implement a plugin
 // against this protocol, copy this definition into your own codebase and
 // use protoc to generate stubs for your target language.
 //
@@ -17,9 +20,9 @@
 // branch or any other development branch.
 //
 syntax = "proto3";
+option go_package = "github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/tfplugin5";
 
 package tfplugin5;
-option go_package = "github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/tfplugin5";
 
 // DynamicValue is an opaque encoding of terraform data, with the field name
 // indicating the encoding scheme used.
@@ -125,8 +128,34 @@ message Schema {
     Block block = 2;
 }
 
+// ServerCapabilities allows providers to communicate extra information
+// regarding supported protocol features. This is used to indicate
+// availability of certain forward-compatible changes which may be optional
+// in a major protocol version, but cannot be tested for directly.
+message ServerCapabilities {
+    // The plan_destroy capability signals that a provider expects a call
+    // to PlanResourceChange when a resource is going to be destroyed.
+    bool plan_destroy = 1;
+
+    // The get_provider_schema_optional capability indicates that this
+    // provider does not require calling GetProviderSchema to operate
+    // normally, and the caller can used a cached copy of the provider's
+    // schema.
+    bool get_provider_schema_optional = 2;
+}
+
 service Provider {
     //////// Information about what a provider supports/expects
+
+    // GetMetadata returns upfront information about server capabilities and
+    // supported resource types without requiring the server to instantiate all
+    // schema information, which may be memory intensive. This RPC is optional,
+    // where clients may receive an unimplemented RPC error. Clients should
+    // ignore the error and call the GetSchema RPC as a fallback.
+    rpc GetMetadata(GetMetadata.Request) returns (GetMetadata.Response);
+
+    // GetSchema returns schema information for the provider, data resources,
+    // and managed resources.
     rpc GetSchema(GetProviderSchema.Request) returns (GetProviderSchema.Response);
     rpc PrepareProviderConfig(PrepareProviderConfig.Request) returns (PrepareProviderConfig.Response);
     rpc ValidateResourceTypeConfig(ValidateResourceTypeConfig.Request) returns (ValidateResourceTypeConfig.Response);
@@ -148,6 +177,26 @@ service Provider {
     rpc Stop(Stop.Request) returns (Stop.Response);
 }
 
+message GetMetadata {
+    message Request {
+    }
+
+    message Response {
+        ServerCapabilities server_capabilities = 1;
+        repeated Diagnostic diagnostics = 2;
+        repeated DataSourceMetadata data_sources = 3;
+        repeated ResourceMetadata resources = 4;
+    }
+
+    message DataSourceMetadata {
+        string type_name = 1;
+    }
+
+    message ResourceMetadata {
+        string type_name = 1;
+    }
+}
+
 message GetProviderSchema {
     message Request {
     }
@@ -159,17 +208,6 @@ message GetProviderSchema {
         Schema provider_meta = 5;
         ServerCapabilities server_capabilities = 6;
     }
-
-
-    // ServerCapabilities allows providers to communicate extra information
-    // regarding supported protocol features. This is used to indicate
-    // availability of certain forward-compatible changes which may be optional
-    // in a major protocol version, but cannot be tested for directly.
-    message ServerCapabilities {
-        // The plan_destroy capability signals that a provider expects a call
-        // to PlanResourceChange when a resource is going to be destroyed.
-        bool plan_destroy = 1;
-    }
 }
 
 message PrepareProviderConfig {
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/tfplugin5/tfplugin5_grpc.pb.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/tfplugin5/tfplugin5_grpc.pb.go
index ddbdea31e71..0ed31f74882 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/tfplugin5/tfplugin5_grpc.pb.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/tfplugin5/tfplugin5_grpc.pb.go
@@ -1,7 +1,29 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+// Terraform Plugin RPC protocol version 5.4
+//
+// This file defines version 5.4 of the RPC protocol. To implement a plugin
+// against this protocol, copy this definition into your own codebase and
+// use protoc to generate stubs for your target language.
+//
+// This file will not be updated. Any minor versions of protocol 5 to follow
+// should copy this file and modify the copy while maintaing backwards
+// compatibility. Breaking changes, if any are required, will come
+// in a subsequent major version with its own separate proto definition.
+//
+// Note that only the proto files included in a release tag of Terraform are
+// official protocol releases. Proto files taken from other commits may include
+// incomplete changes or features that did not make it into a final release.
+// In all reasonable cases, plugin developers should take the proto file from
+// the tag of the most recent release of Terraform, and not from the main
+// branch or any other development branch.
+//
+
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.2.0
-// - protoc             v3.19.4
+// - protoc-gen-go-grpc v1.3.0
+// - protoc             v4.23.2
 // source: tfplugin5.proto
 
 package tfplugin5
@@ -18,25 +40,48 @@ import (
 // Requires gRPC-Go v1.32.0 or later.
 const _ = grpc.SupportPackageIsVersion7
 
+const (
+	Provider_GetMetadata_FullMethodName                = "/tfplugin5.Provider/GetMetadata"
+	Provider_GetSchema_FullMethodName                  = "/tfplugin5.Provider/GetSchema"
+	Provider_PrepareProviderConfig_FullMethodName      = "/tfplugin5.Provider/PrepareProviderConfig"
+	Provider_ValidateResourceTypeConfig_FullMethodName = "/tfplugin5.Provider/ValidateResourceTypeConfig"
+	Provider_ValidateDataSourceConfig_FullMethodName   = "/tfplugin5.Provider/ValidateDataSourceConfig"
+	Provider_UpgradeResourceState_FullMethodName       = "/tfplugin5.Provider/UpgradeResourceState"
+	Provider_Configure_FullMethodName                  = "/tfplugin5.Provider/Configure"
+	Provider_ReadResource_FullMethodName               = "/tfplugin5.Provider/ReadResource"
+	Provider_PlanResourceChange_FullMethodName         = "/tfplugin5.Provider/PlanResourceChange"
+	Provider_ApplyResourceChange_FullMethodName        = "/tfplugin5.Provider/ApplyResourceChange"
+	Provider_ImportResourceState_FullMethodName        = "/tfplugin5.Provider/ImportResourceState"
+	Provider_ReadDataSource_FullMethodName             = "/tfplugin5.Provider/ReadDataSource"
+	Provider_Stop_FullMethodName                       = "/tfplugin5.Provider/Stop"
+)
+
 // ProviderClient is the client API for Provider service.
 //
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
 type ProviderClient interface {
-	//////// Information about what a provider supports/expects
+	// GetMetadata returns upfront information about server capabilities and
+	// supported resource types without requiring the server to instantiate all
+	// schema information, which may be memory intensive. This RPC is optional,
+	// where clients may receive an unimplemented RPC error. Clients should
+	// ignore the error and call the GetSchema RPC as a fallback.
+	GetMetadata(ctx context.Context, in *GetMetadata_Request, opts ...grpc.CallOption) (*GetMetadata_Response, error)
+	// GetSchema returns schema information for the provider, data resources,
+	// and managed resources.
 	GetSchema(ctx context.Context, in *GetProviderSchema_Request, opts ...grpc.CallOption) (*GetProviderSchema_Response, error)
 	PrepareProviderConfig(ctx context.Context, in *PrepareProviderConfig_Request, opts ...grpc.CallOption) (*PrepareProviderConfig_Response, error)
 	ValidateResourceTypeConfig(ctx context.Context, in *ValidateResourceTypeConfig_Request, opts ...grpc.CallOption) (*ValidateResourceTypeConfig_Response, error)
 	ValidateDataSourceConfig(ctx context.Context, in *ValidateDataSourceConfig_Request, opts ...grpc.CallOption) (*ValidateDataSourceConfig_Response, error)
 	UpgradeResourceState(ctx context.Context, in *UpgradeResourceState_Request, opts ...grpc.CallOption) (*UpgradeResourceState_Response, error)
-	//////// One-time initialization, called before other functions below
+	// ////// One-time initialization, called before other functions below
 	Configure(ctx context.Context, in *Configure_Request, opts ...grpc.CallOption) (*Configure_Response, error)
-	//////// Managed Resource Lifecycle
+	// ////// Managed Resource Lifecycle
 	ReadResource(ctx context.Context, in *ReadResource_Request, opts ...grpc.CallOption) (*ReadResource_Response, error)
 	PlanResourceChange(ctx context.Context, in *PlanResourceChange_Request, opts ...grpc.CallOption) (*PlanResourceChange_Response, error)
 	ApplyResourceChange(ctx context.Context, in *ApplyResourceChange_Request, opts ...grpc.CallOption) (*ApplyResourceChange_Response, error)
 	ImportResourceState(ctx context.Context, in *ImportResourceState_Request, opts ...grpc.CallOption) (*ImportResourceState_Response, error)
 	ReadDataSource(ctx context.Context, in *ReadDataSource_Request, opts ...grpc.CallOption) (*ReadDataSource_Response, error)
-	//////// Graceful Shutdown
+	// ////// Graceful Shutdown
 	Stop(ctx context.Context, in *Stop_Request, opts ...grpc.CallOption) (*Stop_Response, error)
 }
 
@@ -48,9 +93,18 @@ func NewProviderClient(cc grpc.ClientConnInterface) ProviderClient {
 	return &providerClient{cc}
 }
 
+func (c *providerClient) GetMetadata(ctx context.Context, in *GetMetadata_Request, opts ...grpc.CallOption) (*GetMetadata_Response, error) {
+	out := new(GetMetadata_Response)
+	err := c.cc.Invoke(ctx, Provider_GetMetadata_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 func (c *providerClient) GetSchema(ctx context.Context, in *GetProviderSchema_Request, opts ...grpc.CallOption) (*GetProviderSchema_Response, error) {
 	out := new(GetProviderSchema_Response)
-	err := c.cc.Invoke(ctx, "/tfplugin5.Provider/GetSchema", in, out, opts...)
+	err := c.cc.Invoke(ctx, Provider_GetSchema_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -59,7 +113,7 @@ func (c *providerClient) GetSchema(ctx context.Context, in *GetProviderSchema_Re
 
 func (c *providerClient) PrepareProviderConfig(ctx context.Context, in *PrepareProviderConfig_Request, opts ...grpc.CallOption) (*PrepareProviderConfig_Response, error) {
 	out := new(PrepareProviderConfig_Response)
-	err := c.cc.Invoke(ctx, "/tfplugin5.Provider/PrepareProviderConfig", in, out, opts...)
+	err := c.cc.Invoke(ctx, Provider_PrepareProviderConfig_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -68,7 +122,7 @@ func (c *providerClient) PrepareProviderConfig(ctx context.Context, in *PrepareP
 
 func (c *providerClient) ValidateResourceTypeConfig(ctx context.Context, in *ValidateResourceTypeConfig_Request, opts ...grpc.CallOption) (*ValidateResourceTypeConfig_Response, error) {
 	out := new(ValidateResourceTypeConfig_Response)
-	err := c.cc.Invoke(ctx, "/tfplugin5.Provider/ValidateResourceTypeConfig", in, out, opts...)
+	err := c.cc.Invoke(ctx, Provider_ValidateResourceTypeConfig_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -77,7 +131,7 @@ func (c *providerClient) ValidateResourceTypeConfig(ctx context.Context, in *Val
 
 func (c *providerClient) ValidateDataSourceConfig(ctx context.Context, in *ValidateDataSourceConfig_Request, opts ...grpc.CallOption) (*ValidateDataSourceConfig_Response, error) {
 	out := new(ValidateDataSourceConfig_Response)
-	err := c.cc.Invoke(ctx, "/tfplugin5.Provider/ValidateDataSourceConfig", in, out, opts...)
+	err := c.cc.Invoke(ctx, Provider_ValidateDataSourceConfig_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -86,7 +140,7 @@ func (c *providerClient) ValidateDataSourceConfig(ctx context.Context, in *Valid
 
 func (c *providerClient) UpgradeResourceState(ctx context.Context, in *UpgradeResourceState_Request, opts ...grpc.CallOption) (*UpgradeResourceState_Response, error) {
 	out := new(UpgradeResourceState_Response)
-	err := c.cc.Invoke(ctx, "/tfplugin5.Provider/UpgradeResourceState", in, out, opts...)
+	err := c.cc.Invoke(ctx, Provider_UpgradeResourceState_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -95,7 +149,7 @@ func (c *providerClient) UpgradeResourceState(ctx context.Context, in *UpgradeRe
 
 func (c *providerClient) Configure(ctx context.Context, in *Configure_Request, opts ...grpc.CallOption) (*Configure_Response, error) {
 	out := new(Configure_Response)
-	err := c.cc.Invoke(ctx, "/tfplugin5.Provider/Configure", in, out, opts...)
+	err := c.cc.Invoke(ctx, Provider_Configure_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -104,7 +158,7 @@ func (c *providerClient) Configure(ctx context.Context, in *Configure_Request, o
 
 func (c *providerClient) ReadResource(ctx context.Context, in *ReadResource_Request, opts ...grpc.CallOption) (*ReadResource_Response, error) {
 	out := new(ReadResource_Response)
-	err := c.cc.Invoke(ctx, "/tfplugin5.Provider/ReadResource", in, out, opts...)
+	err := c.cc.Invoke(ctx, Provider_ReadResource_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -113,7 +167,7 @@ func (c *providerClient) ReadResource(ctx context.Context, in *ReadResource_Requ
 
 func (c *providerClient) PlanResourceChange(ctx context.Context, in *PlanResourceChange_Request, opts ...grpc.CallOption) (*PlanResourceChange_Response, error) {
 	out := new(PlanResourceChange_Response)
-	err := c.cc.Invoke(ctx, "/tfplugin5.Provider/PlanResourceChange", in, out, opts...)
+	err := c.cc.Invoke(ctx, Provider_PlanResourceChange_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -122,7 +176,7 @@ func (c *providerClient) PlanResourceChange(ctx context.Context, in *PlanResourc
 
 func (c *providerClient) ApplyResourceChange(ctx context.Context, in *ApplyResourceChange_Request, opts ...grpc.CallOption) (*ApplyResourceChange_Response, error) {
 	out := new(ApplyResourceChange_Response)
-	err := c.cc.Invoke(ctx, "/tfplugin5.Provider/ApplyResourceChange", in, out, opts...)
+	err := c.cc.Invoke(ctx, Provider_ApplyResourceChange_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -131,7 +185,7 @@ func (c *providerClient) ApplyResourceChange(ctx context.Context, in *ApplyResou
 
 func (c *providerClient) ImportResourceState(ctx context.Context, in *ImportResourceState_Request, opts ...grpc.CallOption) (*ImportResourceState_Response, error) {
 	out := new(ImportResourceState_Response)
-	err := c.cc.Invoke(ctx, "/tfplugin5.Provider/ImportResourceState", in, out, opts...)
+	err := c.cc.Invoke(ctx, Provider_ImportResourceState_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -140,7 +194,7 @@ func (c *providerClient) ImportResourceState(ctx context.Context, in *ImportReso
 
 func (c *providerClient) ReadDataSource(ctx context.Context, in *ReadDataSource_Request, opts ...grpc.CallOption) (*ReadDataSource_Response, error) {
 	out := new(ReadDataSource_Response)
-	err := c.cc.Invoke(ctx, "/tfplugin5.Provider/ReadDataSource", in, out, opts...)
+	err := c.cc.Invoke(ctx, Provider_ReadDataSource_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -149,7 +203,7 @@ func (c *providerClient) ReadDataSource(ctx context.Context, in *ReadDataSource_
 
 func (c *providerClient) Stop(ctx context.Context, in *Stop_Request, opts ...grpc.CallOption) (*Stop_Response, error) {
 	out := new(Stop_Response)
-	err := c.cc.Invoke(ctx, "/tfplugin5.Provider/Stop", in, out, opts...)
+	err := c.cc.Invoke(ctx, Provider_Stop_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -160,21 +214,28 @@ func (c *providerClient) Stop(ctx context.Context, in *Stop_Request, opts ...grp
 // All implementations must embed UnimplementedProviderServer
 // for forward compatibility
 type ProviderServer interface {
-	//////// Information about what a provider supports/expects
+	// GetMetadata returns upfront information about server capabilities and
+	// supported resource types without requiring the server to instantiate all
+	// schema information, which may be memory intensive. This RPC is optional,
+	// where clients may receive an unimplemented RPC error. Clients should
+	// ignore the error and call the GetSchema RPC as a fallback.
+	GetMetadata(context.Context, *GetMetadata_Request) (*GetMetadata_Response, error)
+	// GetSchema returns schema information for the provider, data resources,
+	// and managed resources.
 	GetSchema(context.Context, *GetProviderSchema_Request) (*GetProviderSchema_Response, error)
 	PrepareProviderConfig(context.Context, *PrepareProviderConfig_Request) (*PrepareProviderConfig_Response, error)
 	ValidateResourceTypeConfig(context.Context, *ValidateResourceTypeConfig_Request) (*ValidateResourceTypeConfig_Response, error)
 	ValidateDataSourceConfig(context.Context, *ValidateDataSourceConfig_Request) (*ValidateDataSourceConfig_Response, error)
 	UpgradeResourceState(context.Context, *UpgradeResourceState_Request) (*UpgradeResourceState_Response, error)
-	//////// One-time initialization, called before other functions below
+	// ////// One-time initialization, called before other functions below
 	Configure(context.Context, *Configure_Request) (*Configure_Response, error)
-	//////// Managed Resource Lifecycle
+	// ////// Managed Resource Lifecycle
 	ReadResource(context.Context, *ReadResource_Request) (*ReadResource_Response, error)
 	PlanResourceChange(context.Context, *PlanResourceChange_Request) (*PlanResourceChange_Response, error)
 	ApplyResourceChange(context.Context, *ApplyResourceChange_Request) (*ApplyResourceChange_Response, error)
 	ImportResourceState(context.Context, *ImportResourceState_Request) (*ImportResourceState_Response, error)
 	ReadDataSource(context.Context, *ReadDataSource_Request) (*ReadDataSource_Response, error)
-	//////// Graceful Shutdown
+	// ////// Graceful Shutdown
 	Stop(context.Context, *Stop_Request) (*Stop_Response, error)
 	mustEmbedUnimplementedProviderServer()
 }
@@ -183,6 +244,9 @@ type ProviderServer interface {
 type UnimplementedProviderServer struct {
 }
 
+func (UnimplementedProviderServer) GetMetadata(context.Context, *GetMetadata_Request) (*GetMetadata_Response, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method GetMetadata not implemented")
+}
 func (UnimplementedProviderServer) GetSchema(context.Context, *GetProviderSchema_Request) (*GetProviderSchema_Response, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method GetSchema not implemented")
 }
@@ -232,6 +296,24 @@ func RegisterProviderServer(s grpc.ServiceRegistrar, srv ProviderServer) {
 	s.RegisterService(&Provider_ServiceDesc, srv)
 }
 
+func _Provider_GetMetadata_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(GetMetadata_Request)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ProviderServer).GetMetadata(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Provider_GetMetadata_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ProviderServer).GetMetadata(ctx, req.(*GetMetadata_Request))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 func _Provider_GetSchema_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(GetProviderSchema_Request)
 	if err := dec(in); err != nil {
@@ -242,7 +324,7 @@ func _Provider_GetSchema_Handler(srv interface{}, ctx context.Context, dec func(
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/tfplugin5.Provider/GetSchema",
+		FullMethod: Provider_GetSchema_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(ProviderServer).GetSchema(ctx, req.(*GetProviderSchema_Request))
@@ -260,7 +342,7 @@ func _Provider_PrepareProviderConfig_Handler(srv interface{}, ctx context.Contex
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/tfplugin5.Provider/PrepareProviderConfig",
+		FullMethod: Provider_PrepareProviderConfig_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(ProviderServer).PrepareProviderConfig(ctx, req.(*PrepareProviderConfig_Request))
@@ -278,7 +360,7 @@ func _Provider_ValidateResourceTypeConfig_Handler(srv interface{}, ctx context.C
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/tfplugin5.Provider/ValidateResourceTypeConfig",
+		FullMethod: Provider_ValidateResourceTypeConfig_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(ProviderServer).ValidateResourceTypeConfig(ctx, req.(*ValidateResourceTypeConfig_Request))
@@ -296,7 +378,7 @@ func _Provider_ValidateDataSourceConfig_Handler(srv interface{}, ctx context.Con
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/tfplugin5.Provider/ValidateDataSourceConfig",
+		FullMethod: Provider_ValidateDataSourceConfig_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(ProviderServer).ValidateDataSourceConfig(ctx, req.(*ValidateDataSourceConfig_Request))
@@ -314,7 +396,7 @@ func _Provider_UpgradeResourceState_Handler(srv interface{}, ctx context.Context
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/tfplugin5.Provider/UpgradeResourceState",
+		FullMethod: Provider_UpgradeResourceState_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(ProviderServer).UpgradeResourceState(ctx, req.(*UpgradeResourceState_Request))
@@ -332,7 +414,7 @@ func _Provider_Configure_Handler(srv interface{}, ctx context.Context, dec func(
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/tfplugin5.Provider/Configure",
+		FullMethod: Provider_Configure_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(ProviderServer).Configure(ctx, req.(*Configure_Request))
@@ -350,7 +432,7 @@ func _Provider_ReadResource_Handler(srv interface{}, ctx context.Context, dec fu
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/tfplugin5.Provider/ReadResource",
+		FullMethod: Provider_ReadResource_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(ProviderServer).ReadResource(ctx, req.(*ReadResource_Request))
@@ -368,7 +450,7 @@ func _Provider_PlanResourceChange_Handler(srv interface{}, ctx context.Context,
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/tfplugin5.Provider/PlanResourceChange",
+		FullMethod: Provider_PlanResourceChange_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(ProviderServer).PlanResourceChange(ctx, req.(*PlanResourceChange_Request))
@@ -386,7 +468,7 @@ func _Provider_ApplyResourceChange_Handler(srv interface{}, ctx context.Context,
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/tfplugin5.Provider/ApplyResourceChange",
+		FullMethod: Provider_ApplyResourceChange_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(ProviderServer).ApplyResourceChange(ctx, req.(*ApplyResourceChange_Request))
@@ -404,7 +486,7 @@ func _Provider_ImportResourceState_Handler(srv interface{}, ctx context.Context,
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/tfplugin5.Provider/ImportResourceState",
+		FullMethod: Provider_ImportResourceState_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(ProviderServer).ImportResourceState(ctx, req.(*ImportResourceState_Request))
@@ -422,7 +504,7 @@ func _Provider_ReadDataSource_Handler(srv interface{}, ctx context.Context, dec
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/tfplugin5.Provider/ReadDataSource",
+		FullMethod: Provider_ReadDataSource_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(ProviderServer).ReadDataSource(ctx, req.(*ReadDataSource_Request))
@@ -440,7 +522,7 @@ func _Provider_Stop_Handler(srv interface{}, ctx context.Context, dec func(inter
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/tfplugin5.Provider/Stop",
+		FullMethod: Provider_Stop_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(ProviderServer).Stop(ctx, req.(*Stop_Request))
@@ -455,6 +537,10 @@ var Provider_ServiceDesc = grpc.ServiceDesc{
 	ServiceName: "tfplugin5.Provider",
 	HandlerType: (*ProviderServer)(nil),
 	Methods: []grpc.MethodDesc{
+		{
+			MethodName: "GetMetadata",
+			Handler:    _Provider_GetMetadata_Handler,
+		},
 		{
 			MethodName: "GetSchema",
 			Handler:    _Provider_GetSchema_Handler,
@@ -508,6 +594,13 @@ var Provider_ServiceDesc = grpc.ServiceDesc{
 	Metadata: "tfplugin5.proto",
 }
 
+const (
+	Provisioner_GetSchema_FullMethodName                 = "/tfplugin5.Provisioner/GetSchema"
+	Provisioner_ValidateProvisionerConfig_FullMethodName = "/tfplugin5.Provisioner/ValidateProvisionerConfig"
+	Provisioner_ProvisionResource_FullMethodName         = "/tfplugin5.Provisioner/ProvisionResource"
+	Provisioner_Stop_FullMethodName                      = "/tfplugin5.Provisioner/Stop"
+)
+
 // ProvisionerClient is the client API for Provisioner service.
 //
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
@@ -528,7 +621,7 @@ func NewProvisionerClient(cc grpc.ClientConnInterface) ProvisionerClient {
 
 func (c *provisionerClient) GetSchema(ctx context.Context, in *GetProvisionerSchema_Request, opts ...grpc.CallOption) (*GetProvisionerSchema_Response, error) {
 	out := new(GetProvisionerSchema_Response)
-	err := c.cc.Invoke(ctx, "/tfplugin5.Provisioner/GetSchema", in, out, opts...)
+	err := c.cc.Invoke(ctx, Provisioner_GetSchema_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -537,7 +630,7 @@ func (c *provisionerClient) GetSchema(ctx context.Context, in *GetProvisionerSch
 
 func (c *provisionerClient) ValidateProvisionerConfig(ctx context.Context, in *ValidateProvisionerConfig_Request, opts ...grpc.CallOption) (*ValidateProvisionerConfig_Response, error) {
 	out := new(ValidateProvisionerConfig_Response)
-	err := c.cc.Invoke(ctx, "/tfplugin5.Provisioner/ValidateProvisionerConfig", in, out, opts...)
+	err := c.cc.Invoke(ctx, Provisioner_ValidateProvisionerConfig_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -545,7 +638,7 @@ func (c *provisionerClient) ValidateProvisionerConfig(ctx context.Context, in *V
 }
 
 func (c *provisionerClient) ProvisionResource(ctx context.Context, in *ProvisionResource_Request, opts ...grpc.CallOption) (Provisioner_ProvisionResourceClient, error) {
-	stream, err := c.cc.NewStream(ctx, &Provisioner_ServiceDesc.Streams[0], "/tfplugin5.Provisioner/ProvisionResource", opts...)
+	stream, err := c.cc.NewStream(ctx, &Provisioner_ServiceDesc.Streams[0], Provisioner_ProvisionResource_FullMethodName, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -578,7 +671,7 @@ func (x *provisionerProvisionResourceClient) Recv() (*ProvisionResource_Response
 
 func (c *provisionerClient) Stop(ctx context.Context, in *Stop_Request, opts ...grpc.CallOption) (*Stop_Response, error) {
 	out := new(Stop_Response)
-	err := c.cc.Invoke(ctx, "/tfplugin5.Provisioner/Stop", in, out, opts...)
+	err := c.cc.Invoke(ctx, Provisioner_Stop_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -635,7 +728,7 @@ func _Provisioner_GetSchema_Handler(srv interface{}, ctx context.Context, dec fu
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/tfplugin5.Provisioner/GetSchema",
+		FullMethod: Provisioner_GetSchema_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(ProvisionerServer).GetSchema(ctx, req.(*GetProvisionerSchema_Request))
@@ -653,7 +746,7 @@ func _Provisioner_ValidateProvisionerConfig_Handler(srv interface{}, ctx context
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/tfplugin5.Provisioner/ValidateProvisionerConfig",
+		FullMethod: Provisioner_ValidateProvisionerConfig_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(ProvisionerServer).ValidateProvisionerConfig(ctx, req.(*ValidateProvisionerConfig_Request))
@@ -692,7 +785,7 @@ func _Provisioner_Stop_Handler(srv interface{}, ctx context.Context, dec func(in
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/tfplugin5.Provisioner/Stop",
+		FullMethod: Provisioner_Stop_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(ProvisionerServer).Stop(ctx, req.(*Stop_Request))
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/toproto/data_source.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/toproto/data_source.go
index 516812cd221..e16e94fbe29 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/toproto/data_source.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/toproto/data_source.go
@@ -5,6 +5,16 @@ import (
 	"github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/tfplugin5"
 )
 
+func GetMetadata_DataSourceMetadata(in *tfprotov5.DataSourceMetadata) *tfplugin5.GetMetadata_DataSourceMetadata {
+	if in == nil {
+		return nil
+	}
+
+	return &tfplugin5.GetMetadata_DataSourceMetadata{
+		TypeName: in.TypeName,
+	}
+}
+
 func ValidateDataSourceConfig_Request(in *tfprotov5.ValidateDataSourceConfigRequest) (*tfplugin5.ValidateDataSourceConfig_Request, error) {
 	resp := &tfplugin5.ValidateDataSourceConfig_Request{
 		TypeName: in.TypeName,
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/toproto/provider.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/toproto/provider.go
index 9b0d9ac251b..6e29c1dd5f1 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/toproto/provider.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/toproto/provider.go
@@ -7,6 +7,40 @@ import (
 	"github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/tfplugin5"
 )
 
+func GetMetadata_Request(in *tfprotov5.GetMetadataRequest) (*tfplugin5.GetMetadata_Request, error) {
+	return &tfplugin5.GetMetadata_Request{}, nil
+}
+
+func GetMetadata_Response(in *tfprotov5.GetMetadataResponse) (*tfplugin5.GetMetadata_Response, error) {
+	if in == nil {
+		return nil, nil
+	}
+
+	resp := &tfplugin5.GetMetadata_Response{
+		DataSources:        make([]*tfplugin5.GetMetadata_DataSourceMetadata, 0, len(in.DataSources)),
+		Resources:          make([]*tfplugin5.GetMetadata_ResourceMetadata, 0, len(in.Resources)),
+		ServerCapabilities: ServerCapabilities(in.ServerCapabilities),
+	}
+
+	for _, datasource := range in.DataSources {
+		resp.DataSources = append(resp.DataSources, GetMetadata_DataSourceMetadata(&datasource))
+	}
+
+	for _, resource := range in.Resources {
+		resp.Resources = append(resp.Resources, GetMetadata_ResourceMetadata(&resource))
+	}
+
+	diags, err := Diagnostics(in.Diagnostics)
+
+	if err != nil {
+		return resp, err
+	}
+
+	resp.Diagnostics = diags
+
+	return resp, nil
+}
+
 func GetProviderSchema_Request(in *tfprotov5.GetProviderSchemaRequest) (*tfplugin5.GetProviderSchema_Request, error) {
 	return &tfplugin5.GetProviderSchema_Request{}, nil
 }
@@ -16,7 +50,7 @@ func GetProviderSchema_Response(in *tfprotov5.GetProviderSchemaResponse) (*tfplu
 		return nil, nil
 	}
 	resp := tfplugin5.GetProviderSchema_Response{
-		ServerCapabilities: GetProviderSchema_ServerCapabilities(in.ServerCapabilities),
+		ServerCapabilities: ServerCapabilities(in.ServerCapabilities),
 	}
 	if in.Provider != nil {
 		schema, err := Schema(in.Provider)
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/toproto/resource.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/toproto/resource.go
index 77eba487e6e..fd2d6c38ca0 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/toproto/resource.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/toproto/resource.go
@@ -5,6 +5,16 @@ import (
 	"github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/tfplugin5"
 )
 
+func GetMetadata_ResourceMetadata(in *tfprotov5.ResourceMetadata) *tfplugin5.GetMetadata_ResourceMetadata {
+	if in == nil {
+		return nil
+	}
+
+	return &tfplugin5.GetMetadata_ResourceMetadata{
+		TypeName: in.TypeName,
+	}
+}
+
 func ValidateResourceTypeConfig_Request(in *tfprotov5.ValidateResourceTypeConfigRequest) (*tfplugin5.ValidateResourceTypeConfig_Request, error) {
 	resp := &tfplugin5.ValidateResourceTypeConfig_Request{
 		TypeName: in.TypeName,
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/toproto/server_capabilities.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/toproto/server_capabilities.go
index c1ff45ae413..08ccbb3d990 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/toproto/server_capabilities.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/toproto/server_capabilities.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package toproto
 
 import (
@@ -5,12 +8,13 @@ import (
 	"github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/tfplugin5"
 )
 
-func GetProviderSchema_ServerCapabilities(in *tfprotov5.ServerCapabilities) *tfplugin5.GetProviderSchema_ServerCapabilities {
+func ServerCapabilities(in *tfprotov5.ServerCapabilities) *tfplugin5.ServerCapabilities {
 	if in == nil {
 		return nil
 	}
 
-	return &tfplugin5.GetProviderSchema_ServerCapabilities{
-		PlanDestroy: in.PlanDestroy,
+	return &tfplugin5.ServerCapabilities{
+		GetProviderSchemaOptional: in.GetProviderSchemaOptional,
+		PlanDestroy:               in.PlanDestroy,
 	}
 }
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/provider.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/provider.go
index 0bc84ff2630..20b7e44e5c2 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/provider.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/provider.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tfprotov5
 
 import (
@@ -7,6 +10,13 @@ import (
 // ProviderServer is an interface that reflects that Terraform protocol.
 // Providers must implement this interface.
 type ProviderServer interface {
+	// GetMetadata returns upfront information about server capabilities and
+	// supported resource types without requiring the server to instantiate all
+	// schema information, which may be memory intensive. This RPC is optional,
+	// where clients may receive an unimplemented RPC error. Clients should
+	// ignore the error and call the GetProviderSchema RPC as a fallback.
+	GetMetadata(context.Context, *GetMetadataRequest) (*GetMetadataResponse, error)
+
 	// GetProviderSchema is called when Terraform needs to know what the
 	// provider's schema is, along with the schemas of all its resources
 	// and data sources.
@@ -39,6 +49,27 @@ type ProviderServer interface {
 	DataSourceServer
 }
 
+// GetMetadataRequest represents a GetMetadata RPC request.
+type GetMetadataRequest struct{}
+
+// GetMetadataResponse represents a GetMetadata RPC response.
+type GetMetadataResponse struct {
+	// ServerCapabilities defines optionally supported protocol features,
+	// such as forward-compatible Terraform behavior changes.
+	ServerCapabilities *ServerCapabilities
+
+	// Diagnostics report errors or warnings related to returning the
+	// provider's schemas. Returning an empty slice indicates success, with
+	// no errors or warnings generated.
+	Diagnostics []*Diagnostic
+
+	// DataSources returns metadata for all data resources.
+	DataSources []DataSourceMetadata
+
+	// Resources returns metadata for all managed resources.
+	Resources []ResourceMetadata
+}
+
 // GetProviderSchemaRequest represents a Terraform RPC request for the
 // provider's schemas.
 type GetProviderSchemaRequest struct{}
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/resource.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/resource.go
index b86a045e957..fdae84f3262 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/resource.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/resource.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tfprotov5
 
 import (
@@ -6,6 +9,13 @@ import (
 	"github.com/hashicorp/terraform-plugin-go/tftypes"
 )
 
+// ResourceMetadata describes metadata for a managed resource in the GetMetadata
+// RPC.
+type ResourceMetadata struct {
+	// TypeName is the name of the managed resource.
+	TypeName string
+}
+
 // ResourceServer is an interface containing the methods a resource
 // implementation needs to fill.
 type ResourceServer interface {
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/schema.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/schema.go
index b0b6dff2843..9b860275f13 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/schema.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/schema.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tfprotov5
 
 import "github.com/hashicorp/terraform-plugin-go/tftypes"
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/server_capabilities.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/server_capabilities.go
index f87cf2f4aa3..9f2e79e98ec 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/server_capabilities.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/server_capabilities.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tfprotov5
 
 // ServerCapabilities allows providers to communicate optionally supported
@@ -11,4 +14,9 @@ type ServerCapabilities struct {
 	// opt-in to prevent unexpected errors or panics since the
 	// ProposedNewState in PlanResourceChangeRequest will be a null value.
 	PlanDestroy bool
+
+	// GetProviderSchemaOptional signals that this provider does not require
+	// having the GetProviderSchema RPC called first to operate normally. This
+	// means the caller can use a cached copy of the provider's schema instead.
+	GetProviderSchemaOptional bool
 }
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/state.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/state.go
index 1f85dcad106..08c118958ef 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/state.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/state.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tfprotov5
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/string_kind.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/string_kind.go
index 35d89d038c0..69169b678a8 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/string_kind.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/string_kind.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tfprotov5
 
 const (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/tf5server/doc.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/tf5server/doc.go
index d8360a7fba3..96089e6ba12 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/tf5server/doc.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/tf5server/doc.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 // Package tf5server implements a server implementation to run
 // tfprotov5.ProviderServers as gRPC servers.
 //
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/tf5server/plugin.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/tf5server/plugin.go
index a33afd84c0e..602246aa3f2 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/tf5server/plugin.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/tf5server/plugin.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tf5server
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/tf5server/server.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/tf5server/server.go
index 952b789f585..c9fcdc75503 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/tf5server/server.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov5/tf5server/server.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tf5server
 
 import (
@@ -45,7 +48,7 @@ const (
 	//
 	// In the future, it may be possible to include this information directly
 	// in the protocol buffers rather than recreating a constant here.
-	protocolVersionMinor uint = 3
+	protocolVersionMinor uint = 4
 )
 
 // protocolVersion represents the combined major and minor version numbers of
@@ -483,6 +486,43 @@ func New(name string, serve tfprotov5.ProviderServer, opts ...ServeOpt) tfplugin
 	}
 }
 
+func (s *server) GetMetadata(ctx context.Context, req *tfplugin5.GetMetadata_Request) (*tfplugin5.GetMetadata_Response, error) {
+	rpc := "GetMetadata"
+	ctx = s.loggingContext(ctx)
+	ctx = logging.RpcContext(ctx, rpc)
+	ctx = s.stoppableContext(ctx)
+	logging.ProtocolTrace(ctx, "Received request")
+	defer logging.ProtocolTrace(ctx, "Served request")
+
+	r, err := fromproto.GetMetadataRequest(req)
+
+	if err != nil {
+		logging.ProtocolError(ctx, "Error converting request from protobuf", map[string]interface{}{logging.KeyError: err})
+		return nil, err
+	}
+
+	ctx = tf5serverlogging.DownstreamRequest(ctx)
+
+	resp, err := s.downstream.GetMetadata(ctx, r)
+
+	if err != nil {
+		logging.ProtocolError(ctx, "Error from downstream", map[string]interface{}{logging.KeyError: err})
+		return nil, err
+	}
+
+	tf5serverlogging.DownstreamResponse(ctx, resp.Diagnostics)
+	tf5serverlogging.ServerCapabilities(ctx, resp.ServerCapabilities)
+
+	ret, err := toproto.GetMetadata_Response(resp)
+
+	if err != nil {
+		logging.ProtocolError(ctx, "Error converting response to protobuf", map[string]interface{}{logging.KeyError: err})
+		return nil, err
+	}
+
+	return ret, nil
+}
+
 func (s *server) GetSchema(ctx context.Context, req *tfplugin5.GetProviderSchema_Request) (*tfplugin5.GetProviderSchema_Response, error) {
 	rpc := "GetProviderSchema"
 	ctx = s.loggingContext(ctx)
@@ -502,6 +542,7 @@ func (s *server) GetSchema(ctx context.Context, req *tfplugin5.GetProviderSchema
 		return nil, err
 	}
 	tf5serverlogging.DownstreamResponse(ctx, resp.Diagnostics)
+	tf5serverlogging.ServerCapabilities(ctx, resp.ServerCapabilities)
 	ret, err := toproto.GetProviderSchema_Response(resp)
 	if err != nil {
 		logging.ProtocolError(ctx, "Error converting response to protobuf", map[string]interface{}{logging.KeyError: err})
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/data_source.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/data_source.go
index 1feb2cf3450..ebb2cbd3dc2 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/data_source.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/data_source.go
@@ -1,9 +1,19 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tfprotov6
 
 import (
 	"context"
 )
 
+// DataSourceMetadata describes metadata for a data resource in the GetMetadata
+// RPC.
+type DataSourceMetadata struct {
+	// TypeName is the name of the data resource.
+	TypeName string
+}
+
 // DataSourceServer is an interface containing the methods a data source
 // implementation needs to fill.
 type DataSourceServer interface {
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/diagnostic.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/diagnostic.go
index c40d52ad07c..8f856abbba7 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/diagnostic.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/diagnostic.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tfprotov6
 
 import "github.com/hashicorp/terraform-plugin-go/tftypes"
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/doc.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/doc.go
index 875120cba38..e9adfdedb69 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/doc.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/doc.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 // Package tfprotov6 provides the interfaces and types needed to build a
 // Terraform provider server.
 //
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/dynamic_value.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/dynamic_value.go
index a9fd78420a3..76bac4d5df5 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/dynamic_value.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/dynamic_value.go
@@ -1,9 +1,17 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tfprotov6
 
 import (
+	"bytes"
+	"encoding/json"
 	"errors"
+	"fmt"
 
 	"github.com/hashicorp/terraform-plugin-go/tftypes"
+	msgpack "github.com/vmihailenco/msgpack/v5"
+	"github.com/vmihailenco/msgpack/v5/msgpcode"
 )
 
 // ErrUnknownDynamicValueType is returned when a DynamicValue has no MsgPack or
@@ -35,7 +43,7 @@ func NewDynamicValue(t tftypes.Type, v tftypes.Value) (DynamicValue, error) {
 
 // DynamicValue represents a nested encoding value that came from the protocol.
 // The only way providers should ever interact with it is by calling its
-// `Unmarshal` method to retrive a `tftypes.Value`. Although the type system
+// `Unmarshal` method to retrieve a `tftypes.Value`. Although the type system
 // allows for other interactions, they are explicitly not supported, and will
 // not be considered when evaluating for breaking changes. Treat this type as
 // an opaque value, and *only* call its `Unmarshal` method.
@@ -44,6 +52,43 @@ type DynamicValue struct {
 	JSON    []byte
 }
 
+// IsNull returns true if the DynamicValue represents a null value based on the
+// underlying JSON or MessagePack data.
+func (d DynamicValue) IsNull() (bool, error) {
+	if d.JSON != nil {
+		decoder := json.NewDecoder(bytes.NewReader(d.JSON))
+		token, err := decoder.Token()
+
+		if err != nil {
+			return false, fmt.Errorf("unable to read DynamicValue JSON token: %w", err)
+		}
+
+		if token != nil {
+			return false, nil
+		}
+
+		return true, nil
+	}
+
+	if d.MsgPack != nil {
+		decoder := msgpack.NewDecoder(bytes.NewReader(d.MsgPack))
+		code, err := decoder.PeekCode()
+
+		if err != nil {
+			return false, fmt.Errorf("unable to read DynamicValue MsgPack code: %w", err)
+		}
+
+		// Extensions are considered unknown
+		if msgpcode.IsExt(code) || code != msgpcode.Nil {
+			return false, nil
+		}
+
+		return true, nil
+	}
+
+	return false, fmt.Errorf("unable to read DynamicValue: %w", ErrUnknownDynamicValueType)
+}
+
 // Unmarshal returns a `tftypes.Value` that represents the information
 // contained in the DynamicValue in an easy-to-interact-with way. It is the
 // main purpose of the DynamicValue type, and is how provider developers should
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/diag/diagnostics.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/diag/diagnostics.go
index fbec5677cb1..29bed4540c4 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/diag/diagnostics.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/diag/diagnostics.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package diag
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/diag/doc.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/diag/doc.go
index 0c73dab12fe..faaba2285cd 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/diag/doc.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/diag/doc.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 // Package diag contains diagnostics helpers. These implementations are
 // intentionally outside the public API.
 package diag
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/fromproto/attribute_path.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/fromproto/attribute_path.go
index c25c3cb0d95..267bc223da3 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/fromproto/attribute_path.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/fromproto/attribute_path.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package fromproto
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/fromproto/data_source.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/fromproto/data_source.go
index 130f6a82198..f6c3c3663ee 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/fromproto/data_source.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/fromproto/data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package fromproto
 
 import (
@@ -5,6 +8,16 @@ import (
 	"github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/tfplugin6"
 )
 
+func DataSourceMetadata(in *tfplugin6.GetMetadata_DataSourceMetadata) *tfprotov6.DataSourceMetadata {
+	if in == nil {
+		return nil
+	}
+
+	return &tfprotov6.DataSourceMetadata{
+		TypeName: in.TypeName,
+	}
+}
+
 func ValidateDataResourceConfigRequest(in *tfplugin6.ValidateDataResourceConfig_Request) (*tfprotov6.ValidateDataResourceConfigRequest, error) {
 	resp := &tfprotov6.ValidateDataResourceConfigRequest{
 		TypeName: in.TypeName,
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/fromproto/diagnostic.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/fromproto/diagnostic.go
index ac92796fb1f..21673ca0da8 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/fromproto/diagnostic.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/fromproto/diagnostic.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package fromproto
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/fromproto/provider.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/fromproto/provider.go
index 2000b9bb0c4..0bf78cb8e58 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/fromproto/provider.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/fromproto/provider.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package fromproto
 
 import (
@@ -5,6 +8,40 @@ import (
 	"github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/tfplugin6"
 )
 
+func GetMetadataRequest(in *tfplugin6.GetMetadata_Request) (*tfprotov6.GetMetadataRequest, error) {
+	return &tfprotov6.GetMetadataRequest{}, nil
+}
+
+func GetMetadataResponse(in *tfplugin6.GetMetadata_Response) (*tfprotov6.GetMetadataResponse, error) {
+	if in == nil {
+		return nil, nil
+	}
+
+	resp := &tfprotov6.GetMetadataResponse{
+		DataSources:        make([]tfprotov6.DataSourceMetadata, 0, len(in.DataSources)),
+		Resources:          make([]tfprotov6.ResourceMetadata, 0, len(in.Resources)),
+		ServerCapabilities: ServerCapabilities(in.ServerCapabilities),
+	}
+
+	for _, datasource := range in.DataSources {
+		resp.DataSources = append(resp.DataSources, *DataSourceMetadata(datasource))
+	}
+
+	for _, resource := range in.Resources {
+		resp.Resources = append(resp.Resources, *ResourceMetadata(resource))
+	}
+
+	diags, err := Diagnostics(in.Diagnostics)
+
+	if err != nil {
+		return resp, err
+	}
+
+	resp.Diagnostics = diags
+
+	return resp, nil
+}
+
 func GetProviderSchemaRequest(in *tfplugin6.GetProviderSchema_Request) (*tfprotov6.GetProviderSchemaRequest, error) {
 	return &tfprotov6.GetProviderSchemaRequest{}, nil
 }
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/fromproto/resource.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/fromproto/resource.go
index 94addd80125..385ef134d0b 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/fromproto/resource.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/fromproto/resource.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package fromproto
 
 import (
@@ -7,6 +10,16 @@ import (
 	"github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/tfplugin6"
 )
 
+func ResourceMetadata(in *tfplugin6.GetMetadata_ResourceMetadata) *tfprotov6.ResourceMetadata {
+	if in == nil {
+		return nil
+	}
+
+	return &tfprotov6.ResourceMetadata{
+		TypeName: in.TypeName,
+	}
+}
+
 func ValidateResourceConfigRequest(in *tfplugin6.ValidateResourceConfig_Request) (*tfprotov6.ValidateResourceConfigRequest, error) {
 	resp := &tfprotov6.ValidateResourceConfigRequest{
 		TypeName: in.TypeName,
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/fromproto/schema.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/fromproto/schema.go
index db720246f51..b4cb1399fac 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/fromproto/schema.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/fromproto/schema.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package fromproto
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/fromproto/server_capabilities.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/fromproto/server_capabilities.go
new file mode 100644
index 00000000000..58ba96ab5d9
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/fromproto/server_capabilities.go
@@ -0,0 +1,20 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package fromproto
+
+import (
+	"github.com/hashicorp/terraform-plugin-go/tfprotov6"
+	"github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/tfplugin6"
+)
+
+func ServerCapabilities(in *tfplugin6.ServerCapabilities) *tfprotov6.ServerCapabilities {
+	if in == nil {
+		return nil
+	}
+
+	return &tfprotov6.ServerCapabilities{
+		GetProviderSchemaOptional: in.GetProviderSchemaOptional,
+		PlanDestroy:               in.PlanDestroy,
+	}
+}
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/fromproto/state.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/fromproto/state.go
index 0aa2a5a6a06..e5470b50d52 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/fromproto/state.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/fromproto/state.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package fromproto
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/fromproto/string_kind.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/fromproto/string_kind.go
index f2b1107538a..bfe82ca8aa6 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/fromproto/string_kind.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/fromproto/string_kind.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package fromproto
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/fromproto/types.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/fromproto/types.go
index 87127f4a6df..967256b728e 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/fromproto/types.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/fromproto/types.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package fromproto
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/tf6serverlogging/context_keys.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/tf6serverlogging/context_keys.go
index 15386cd2cc2..99f55e467d3 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/tf6serverlogging/context_keys.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/tf6serverlogging/context_keys.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tf6serverlogging
 
 // Context key types.
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/tf6serverlogging/doc.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/tf6serverlogging/doc.go
index 167a61825ac..29c51245efb 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/tf6serverlogging/doc.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/tf6serverlogging/doc.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 // Package tf5serverlogging contains logging functionality specific to
 // tf5server and tfprotov5 types.
 package tf6serverlogging
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/tf6serverlogging/downstream_request.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/tf6serverlogging/downstream_request.go
index 31ce386aebb..0fd36326e56 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/tf6serverlogging/downstream_request.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/tf6serverlogging/downstream_request.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tf6serverlogging
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/tf6serverlogging/server_capabilities.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/tf6serverlogging/server_capabilities.go
new file mode 100644
index 00000000000..f6aaf953d99
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/tf6serverlogging/server_capabilities.go
@@ -0,0 +1,26 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package tf6serverlogging
+
+import (
+	"context"
+
+	"github.com/hashicorp/terraform-plugin-go/internal/logging"
+	"github.com/hashicorp/terraform-plugin-go/tfprotov6"
+)
+
+// ServerCapabilities generates a TRACE "Announced server capabilities" log.
+func ServerCapabilities(ctx context.Context, capabilities *tfprotov6.ServerCapabilities) {
+	responseFields := map[string]interface{}{
+		logging.KeyServerCapabilityGetProviderSchemaOptional: false,
+		logging.KeyServerCapabilityPlanDestroy:               false,
+	}
+
+	if capabilities != nil {
+		responseFields[logging.KeyServerCapabilityGetProviderSchemaOptional] = capabilities.GetProviderSchemaOptional
+		responseFields[logging.KeyServerCapabilityPlanDestroy] = capabilities.PlanDestroy
+	}
+
+	logging.ProtocolTrace(ctx, "Announced server capabilities", responseFields)
+}
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/tfplugin6/tfplugin6.pb.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/tfplugin6/tfplugin6.pb.go
index 817f059ccd7..1e2cd2366a5 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/tfplugin6/tfplugin6.pb.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/tfplugin6/tfplugin6.pb.go
@@ -1,6 +1,9 @@
-// Terraform Plugin RPC protocol version 6.3
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+// Terraform Plugin RPC protocol version 6.4
 //
-// This file defines version 6.3 of the RPC protocol. To implement a plugin
+// This file defines version 6.4 of the RPC protocol. To implement a plugin
 // against this protocol, copy this definition into your own codebase and
 // use protoc to generate stubs for your target language.
 //
@@ -19,8 +22,8 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.28.1
-// 	protoc        v3.19.4
+// 	protoc-gen-go v1.31.0
+// 	protoc        v4.23.2
 // source: tfplugin6.proto
 
 package tfplugin6
@@ -578,6 +581,109 @@ func (x *Schema) GetBlock() *Schema_Block {
 	return nil
 }
 
+// ServerCapabilities allows providers to communicate extra information
+// regarding supported protocol features. This is used to indicate
+// availability of certain forward-compatible changes which may be optional
+// in a major protocol version, but cannot be tested for directly.
+type ServerCapabilities struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// The plan_destroy capability signals that a provider expects a call
+	// to PlanResourceChange when a resource is going to be destroyed.
+	PlanDestroy bool `protobuf:"varint,1,opt,name=plan_destroy,json=planDestroy,proto3" json:"plan_destroy,omitempty"`
+	// The get_provider_schema_optional capability indicates that this
+	// provider does not require calling GetProviderSchema to operate
+	// normally, and the caller can used a cached copy of the provider's
+	// schema.
+	GetProviderSchemaOptional bool `protobuf:"varint,2,opt,name=get_provider_schema_optional,json=getProviderSchemaOptional,proto3" json:"get_provider_schema_optional,omitempty"`
+}
+
+func (x *ServerCapabilities) Reset() {
+	*x = ServerCapabilities{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_tfplugin6_proto_msgTypes[6]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ServerCapabilities) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ServerCapabilities) ProtoMessage() {}
+
+func (x *ServerCapabilities) ProtoReflect() protoreflect.Message {
+	mi := &file_tfplugin6_proto_msgTypes[6]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ServerCapabilities.ProtoReflect.Descriptor instead.
+func (*ServerCapabilities) Descriptor() ([]byte, []int) {
+	return file_tfplugin6_proto_rawDescGZIP(), []int{6}
+}
+
+func (x *ServerCapabilities) GetPlanDestroy() bool {
+	if x != nil {
+		return x.PlanDestroy
+	}
+	return false
+}
+
+func (x *ServerCapabilities) GetGetProviderSchemaOptional() bool {
+	if x != nil {
+		return x.GetProviderSchemaOptional
+	}
+	return false
+}
+
+type GetMetadata struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+}
+
+func (x *GetMetadata) Reset() {
+	*x = GetMetadata{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_tfplugin6_proto_msgTypes[7]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *GetMetadata) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetMetadata) ProtoMessage() {}
+
+func (x *GetMetadata) ProtoReflect() protoreflect.Message {
+	mi := &file_tfplugin6_proto_msgTypes[7]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetMetadata.ProtoReflect.Descriptor instead.
+func (*GetMetadata) Descriptor() ([]byte, []int) {
+	return file_tfplugin6_proto_rawDescGZIP(), []int{7}
+}
+
 type GetProviderSchema struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -587,7 +693,7 @@ type GetProviderSchema struct {
 func (x *GetProviderSchema) Reset() {
 	*x = GetProviderSchema{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin6_proto_msgTypes[6]
+		mi := &file_tfplugin6_proto_msgTypes[8]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -600,7 +706,7 @@ func (x *GetProviderSchema) String() string {
 func (*GetProviderSchema) ProtoMessage() {}
 
 func (x *GetProviderSchema) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin6_proto_msgTypes[6]
+	mi := &file_tfplugin6_proto_msgTypes[8]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -613,7 +719,7 @@ func (x *GetProviderSchema) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetProviderSchema.ProtoReflect.Descriptor instead.
 func (*GetProviderSchema) Descriptor() ([]byte, []int) {
-	return file_tfplugin6_proto_rawDescGZIP(), []int{6}
+	return file_tfplugin6_proto_rawDescGZIP(), []int{8}
 }
 
 type ValidateProviderConfig struct {
@@ -625,7 +731,7 @@ type ValidateProviderConfig struct {
 func (x *ValidateProviderConfig) Reset() {
 	*x = ValidateProviderConfig{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin6_proto_msgTypes[7]
+		mi := &file_tfplugin6_proto_msgTypes[9]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -638,7 +744,7 @@ func (x *ValidateProviderConfig) String() string {
 func (*ValidateProviderConfig) ProtoMessage() {}
 
 func (x *ValidateProviderConfig) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin6_proto_msgTypes[7]
+	mi := &file_tfplugin6_proto_msgTypes[9]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -651,7 +757,7 @@ func (x *ValidateProviderConfig) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ValidateProviderConfig.ProtoReflect.Descriptor instead.
 func (*ValidateProviderConfig) Descriptor() ([]byte, []int) {
-	return file_tfplugin6_proto_rawDescGZIP(), []int{7}
+	return file_tfplugin6_proto_rawDescGZIP(), []int{9}
 }
 
 type UpgradeResourceState struct {
@@ -663,7 +769,7 @@ type UpgradeResourceState struct {
 func (x *UpgradeResourceState) Reset() {
 	*x = UpgradeResourceState{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin6_proto_msgTypes[8]
+		mi := &file_tfplugin6_proto_msgTypes[10]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -676,7 +782,7 @@ func (x *UpgradeResourceState) String() string {
 func (*UpgradeResourceState) ProtoMessage() {}
 
 func (x *UpgradeResourceState) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin6_proto_msgTypes[8]
+	mi := &file_tfplugin6_proto_msgTypes[10]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -689,7 +795,7 @@ func (x *UpgradeResourceState) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use UpgradeResourceState.ProtoReflect.Descriptor instead.
 func (*UpgradeResourceState) Descriptor() ([]byte, []int) {
-	return file_tfplugin6_proto_rawDescGZIP(), []int{8}
+	return file_tfplugin6_proto_rawDescGZIP(), []int{10}
 }
 
 type ValidateResourceConfig struct {
@@ -701,7 +807,7 @@ type ValidateResourceConfig struct {
 func (x *ValidateResourceConfig) Reset() {
 	*x = ValidateResourceConfig{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin6_proto_msgTypes[9]
+		mi := &file_tfplugin6_proto_msgTypes[11]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -714,7 +820,7 @@ func (x *ValidateResourceConfig) String() string {
 func (*ValidateResourceConfig) ProtoMessage() {}
 
 func (x *ValidateResourceConfig) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin6_proto_msgTypes[9]
+	mi := &file_tfplugin6_proto_msgTypes[11]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -727,7 +833,7 @@ func (x *ValidateResourceConfig) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ValidateResourceConfig.ProtoReflect.Descriptor instead.
 func (*ValidateResourceConfig) Descriptor() ([]byte, []int) {
-	return file_tfplugin6_proto_rawDescGZIP(), []int{9}
+	return file_tfplugin6_proto_rawDescGZIP(), []int{11}
 }
 
 type ValidateDataResourceConfig struct {
@@ -739,7 +845,7 @@ type ValidateDataResourceConfig struct {
 func (x *ValidateDataResourceConfig) Reset() {
 	*x = ValidateDataResourceConfig{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin6_proto_msgTypes[10]
+		mi := &file_tfplugin6_proto_msgTypes[12]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -752,7 +858,7 @@ func (x *ValidateDataResourceConfig) String() string {
 func (*ValidateDataResourceConfig) ProtoMessage() {}
 
 func (x *ValidateDataResourceConfig) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin6_proto_msgTypes[10]
+	mi := &file_tfplugin6_proto_msgTypes[12]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -765,7 +871,7 @@ func (x *ValidateDataResourceConfig) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ValidateDataResourceConfig.ProtoReflect.Descriptor instead.
 func (*ValidateDataResourceConfig) Descriptor() ([]byte, []int) {
-	return file_tfplugin6_proto_rawDescGZIP(), []int{10}
+	return file_tfplugin6_proto_rawDescGZIP(), []int{12}
 }
 
 type ConfigureProvider struct {
@@ -777,7 +883,7 @@ type ConfigureProvider struct {
 func (x *ConfigureProvider) Reset() {
 	*x = ConfigureProvider{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin6_proto_msgTypes[11]
+		mi := &file_tfplugin6_proto_msgTypes[13]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -790,7 +896,7 @@ func (x *ConfigureProvider) String() string {
 func (*ConfigureProvider) ProtoMessage() {}
 
 func (x *ConfigureProvider) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin6_proto_msgTypes[11]
+	mi := &file_tfplugin6_proto_msgTypes[13]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -803,7 +909,7 @@ func (x *ConfigureProvider) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ConfigureProvider.ProtoReflect.Descriptor instead.
 func (*ConfigureProvider) Descriptor() ([]byte, []int) {
-	return file_tfplugin6_proto_rawDescGZIP(), []int{11}
+	return file_tfplugin6_proto_rawDescGZIP(), []int{13}
 }
 
 type ReadResource struct {
@@ -815,7 +921,7 @@ type ReadResource struct {
 func (x *ReadResource) Reset() {
 	*x = ReadResource{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin6_proto_msgTypes[12]
+		mi := &file_tfplugin6_proto_msgTypes[14]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -828,7 +934,7 @@ func (x *ReadResource) String() string {
 func (*ReadResource) ProtoMessage() {}
 
 func (x *ReadResource) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin6_proto_msgTypes[12]
+	mi := &file_tfplugin6_proto_msgTypes[14]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -841,7 +947,7 @@ func (x *ReadResource) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ReadResource.ProtoReflect.Descriptor instead.
 func (*ReadResource) Descriptor() ([]byte, []int) {
-	return file_tfplugin6_proto_rawDescGZIP(), []int{12}
+	return file_tfplugin6_proto_rawDescGZIP(), []int{14}
 }
 
 type PlanResourceChange struct {
@@ -853,7 +959,7 @@ type PlanResourceChange struct {
 func (x *PlanResourceChange) Reset() {
 	*x = PlanResourceChange{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin6_proto_msgTypes[13]
+		mi := &file_tfplugin6_proto_msgTypes[15]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -866,7 +972,7 @@ func (x *PlanResourceChange) String() string {
 func (*PlanResourceChange) ProtoMessage() {}
 
 func (x *PlanResourceChange) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin6_proto_msgTypes[13]
+	mi := &file_tfplugin6_proto_msgTypes[15]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -879,7 +985,7 @@ func (x *PlanResourceChange) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use PlanResourceChange.ProtoReflect.Descriptor instead.
 func (*PlanResourceChange) Descriptor() ([]byte, []int) {
-	return file_tfplugin6_proto_rawDescGZIP(), []int{13}
+	return file_tfplugin6_proto_rawDescGZIP(), []int{15}
 }
 
 type ApplyResourceChange struct {
@@ -891,7 +997,7 @@ type ApplyResourceChange struct {
 func (x *ApplyResourceChange) Reset() {
 	*x = ApplyResourceChange{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin6_proto_msgTypes[14]
+		mi := &file_tfplugin6_proto_msgTypes[16]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -904,7 +1010,7 @@ func (x *ApplyResourceChange) String() string {
 func (*ApplyResourceChange) ProtoMessage() {}
 
 func (x *ApplyResourceChange) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin6_proto_msgTypes[14]
+	mi := &file_tfplugin6_proto_msgTypes[16]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -917,7 +1023,7 @@ func (x *ApplyResourceChange) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ApplyResourceChange.ProtoReflect.Descriptor instead.
 func (*ApplyResourceChange) Descriptor() ([]byte, []int) {
-	return file_tfplugin6_proto_rawDescGZIP(), []int{14}
+	return file_tfplugin6_proto_rawDescGZIP(), []int{16}
 }
 
 type ImportResourceState struct {
@@ -929,7 +1035,7 @@ type ImportResourceState struct {
 func (x *ImportResourceState) Reset() {
 	*x = ImportResourceState{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin6_proto_msgTypes[15]
+		mi := &file_tfplugin6_proto_msgTypes[17]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -942,7 +1048,7 @@ func (x *ImportResourceState) String() string {
 func (*ImportResourceState) ProtoMessage() {}
 
 func (x *ImportResourceState) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin6_proto_msgTypes[15]
+	mi := &file_tfplugin6_proto_msgTypes[17]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -955,7 +1061,7 @@ func (x *ImportResourceState) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ImportResourceState.ProtoReflect.Descriptor instead.
 func (*ImportResourceState) Descriptor() ([]byte, []int) {
-	return file_tfplugin6_proto_rawDescGZIP(), []int{15}
+	return file_tfplugin6_proto_rawDescGZIP(), []int{17}
 }
 
 type ReadDataSource struct {
@@ -967,7 +1073,7 @@ type ReadDataSource struct {
 func (x *ReadDataSource) Reset() {
 	*x = ReadDataSource{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin6_proto_msgTypes[16]
+		mi := &file_tfplugin6_proto_msgTypes[18]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -980,7 +1086,7 @@ func (x *ReadDataSource) String() string {
 func (*ReadDataSource) ProtoMessage() {}
 
 func (x *ReadDataSource) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin6_proto_msgTypes[16]
+	mi := &file_tfplugin6_proto_msgTypes[18]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -993,7 +1099,7 @@ func (x *ReadDataSource) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ReadDataSource.ProtoReflect.Descriptor instead.
 func (*ReadDataSource) Descriptor() ([]byte, []int) {
-	return file_tfplugin6_proto_rawDescGZIP(), []int{16}
+	return file_tfplugin6_proto_rawDescGZIP(), []int{18}
 }
 
 type AttributePath_Step struct {
@@ -1002,6 +1108,7 @@ type AttributePath_Step struct {
 	unknownFields protoimpl.UnknownFields
 
 	// Types that are assignable to Selector:
+	//
 	//	*AttributePath_Step_AttributeName
 	//	*AttributePath_Step_ElementKeyString
 	//	*AttributePath_Step_ElementKeyInt
@@ -1011,7 +1118,7 @@ type AttributePath_Step struct {
 func (x *AttributePath_Step) Reset() {
 	*x = AttributePath_Step{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin6_proto_msgTypes[17]
+		mi := &file_tfplugin6_proto_msgTypes[19]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1024,7 +1131,7 @@ func (x *AttributePath_Step) String() string {
 func (*AttributePath_Step) ProtoMessage() {}
 
 func (x *AttributePath_Step) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin6_proto_msgTypes[17]
+	mi := &file_tfplugin6_proto_msgTypes[19]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1103,7 +1210,7 @@ type StopProvider_Request struct {
 func (x *StopProvider_Request) Reset() {
 	*x = StopProvider_Request{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin6_proto_msgTypes[18]
+		mi := &file_tfplugin6_proto_msgTypes[20]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1116,7 +1223,7 @@ func (x *StopProvider_Request) String() string {
 func (*StopProvider_Request) ProtoMessage() {}
 
 func (x *StopProvider_Request) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin6_proto_msgTypes[18]
+	mi := &file_tfplugin6_proto_msgTypes[20]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1143,7 +1250,7 @@ type StopProvider_Response struct {
 func (x *StopProvider_Response) Reset() {
 	*x = StopProvider_Response{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin6_proto_msgTypes[19]
+		mi := &file_tfplugin6_proto_msgTypes[21]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1156,7 +1263,7 @@ func (x *StopProvider_Response) String() string {
 func (*StopProvider_Response) ProtoMessage() {}
 
 func (x *StopProvider_Response) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin6_proto_msgTypes[19]
+	mi := &file_tfplugin6_proto_msgTypes[21]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1195,7 +1302,7 @@ type Schema_Block struct {
 func (x *Schema_Block) Reset() {
 	*x = Schema_Block{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin6_proto_msgTypes[21]
+		mi := &file_tfplugin6_proto_msgTypes[23]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1208,7 +1315,7 @@ func (x *Schema_Block) String() string {
 func (*Schema_Block) ProtoMessage() {}
 
 func (x *Schema_Block) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin6_proto_msgTypes[21]
+	mi := &file_tfplugin6_proto_msgTypes[23]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1286,7 +1393,7 @@ type Schema_Attribute struct {
 func (x *Schema_Attribute) Reset() {
 	*x = Schema_Attribute{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin6_proto_msgTypes[22]
+		mi := &file_tfplugin6_proto_msgTypes[24]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1299,7 +1406,7 @@ func (x *Schema_Attribute) String() string {
 func (*Schema_Attribute) ProtoMessage() {}
 
 func (x *Schema_Attribute) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin6_proto_msgTypes[22]
+	mi := &file_tfplugin6_proto_msgTypes[24]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1400,7 +1507,7 @@ type Schema_NestedBlock struct {
 func (x *Schema_NestedBlock) Reset() {
 	*x = Schema_NestedBlock{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin6_proto_msgTypes[23]
+		mi := &file_tfplugin6_proto_msgTypes[25]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1413,7 +1520,7 @@ func (x *Schema_NestedBlock) String() string {
 func (*Schema_NestedBlock) ProtoMessage() {}
 
 func (x *Schema_NestedBlock) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin6_proto_msgTypes[23]
+	mi := &file_tfplugin6_proto_msgTypes[25]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1474,16 +1581,16 @@ type Schema_Object struct {
 	// MinItems and MaxItems were never used in the protocol, and have no
 	// effect on validation.
 	//
-	// Deprecated: Do not use.
+	// Deprecated: Marked as deprecated in tfplugin6.proto.
 	MinItems int64 `protobuf:"varint,4,opt,name=min_items,json=minItems,proto3" json:"min_items,omitempty"`
-	// Deprecated: Do not use.
+	// Deprecated: Marked as deprecated in tfplugin6.proto.
 	MaxItems int64 `protobuf:"varint,5,opt,name=max_items,json=maxItems,proto3" json:"max_items,omitempty"`
 }
 
 func (x *Schema_Object) Reset() {
 	*x = Schema_Object{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin6_proto_msgTypes[24]
+		mi := &file_tfplugin6_proto_msgTypes[26]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1496,7 +1603,7 @@ func (x *Schema_Object) String() string {
 func (*Schema_Object) ProtoMessage() {}
 
 func (x *Schema_Object) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin6_proto_msgTypes[24]
+	mi := &file_tfplugin6_proto_msgTypes[26]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1526,7 +1633,7 @@ func (x *Schema_Object) GetNesting() Schema_Object_NestingMode {
 	return Schema_Object_INVALID
 }
 
-// Deprecated: Do not use.
+// Deprecated: Marked as deprecated in tfplugin6.proto.
 func (x *Schema_Object) GetMinItems() int64 {
 	if x != nil {
 		return x.MinItems
@@ -1534,7 +1641,7 @@ func (x *Schema_Object) GetMinItems() int64 {
 	return 0
 }
 
-// Deprecated: Do not use.
+// Deprecated: Marked as deprecated in tfplugin6.proto.
 func (x *Schema_Object) GetMaxItems() int64 {
 	if x != nil {
 		return x.MaxItems
@@ -1542,29 +1649,29 @@ func (x *Schema_Object) GetMaxItems() int64 {
 	return 0
 }
 
-type GetProviderSchema_Request struct {
+type GetMetadata_Request struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 }
 
-func (x *GetProviderSchema_Request) Reset() {
-	*x = GetProviderSchema_Request{}
+func (x *GetMetadata_Request) Reset() {
+	*x = GetMetadata_Request{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin6_proto_msgTypes[25]
+		mi := &file_tfplugin6_proto_msgTypes[27]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
 }
 
-func (x *GetProviderSchema_Request) String() string {
+func (x *GetMetadata_Request) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*GetProviderSchema_Request) ProtoMessage() {}
+func (*GetMetadata_Request) ProtoMessage() {}
 
-func (x *GetProviderSchema_Request) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin6_proto_msgTypes[25]
+func (x *GetMetadata_Request) ProtoReflect() protoreflect.Message {
+	mi := &file_tfplugin6_proto_msgTypes[27]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1575,41 +1682,39 @@ func (x *GetProviderSchema_Request) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use GetProviderSchema_Request.ProtoReflect.Descriptor instead.
-func (*GetProviderSchema_Request) Descriptor() ([]byte, []int) {
-	return file_tfplugin6_proto_rawDescGZIP(), []int{6, 0}
+// Deprecated: Use GetMetadata_Request.ProtoReflect.Descriptor instead.
+func (*GetMetadata_Request) Descriptor() ([]byte, []int) {
+	return file_tfplugin6_proto_rawDescGZIP(), []int{7, 0}
 }
 
-type GetProviderSchema_Response struct {
+type GetMetadata_Response struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	Provider           *Schema                               `protobuf:"bytes,1,opt,name=provider,proto3" json:"provider,omitempty"`
-	ResourceSchemas    map[string]*Schema                    `protobuf:"bytes,2,rep,name=resource_schemas,json=resourceSchemas,proto3" json:"resource_schemas,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
-	DataSourceSchemas  map[string]*Schema                    `protobuf:"bytes,3,rep,name=data_source_schemas,json=dataSourceSchemas,proto3" json:"data_source_schemas,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
-	Diagnostics        []*Diagnostic                         `protobuf:"bytes,4,rep,name=diagnostics,proto3" json:"diagnostics,omitempty"`
-	ProviderMeta       *Schema                               `protobuf:"bytes,5,opt,name=provider_meta,json=providerMeta,proto3" json:"provider_meta,omitempty"`
-	ServerCapabilities *GetProviderSchema_ServerCapabilities `protobuf:"bytes,6,opt,name=server_capabilities,json=serverCapabilities,proto3" json:"server_capabilities,omitempty"`
+	ServerCapabilities *ServerCapabilities               `protobuf:"bytes,1,opt,name=server_capabilities,json=serverCapabilities,proto3" json:"server_capabilities,omitempty"`
+	Diagnostics        []*Diagnostic                     `protobuf:"bytes,2,rep,name=diagnostics,proto3" json:"diagnostics,omitempty"`
+	DataSources        []*GetMetadata_DataSourceMetadata `protobuf:"bytes,3,rep,name=data_sources,json=dataSources,proto3" json:"data_sources,omitempty"`
+	Resources          []*GetMetadata_ResourceMetadata   `protobuf:"bytes,4,rep,name=resources,proto3" json:"resources,omitempty"`
 }
 
-func (x *GetProviderSchema_Response) Reset() {
-	*x = GetProviderSchema_Response{}
+func (x *GetMetadata_Response) Reset() {
+	*x = GetMetadata_Response{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin6_proto_msgTypes[26]
+		mi := &file_tfplugin6_proto_msgTypes[28]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
 }
 
-func (x *GetProviderSchema_Response) String() string {
+func (x *GetMetadata_Response) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*GetProviderSchema_Response) ProtoMessage() {}
+func (*GetMetadata_Response) ProtoMessage() {}
 
-func (x *GetProviderSchema_Response) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin6_proto_msgTypes[26]
+func (x *GetMetadata_Response) ProtoReflect() protoreflect.Message {
+	mi := &file_tfplugin6_proto_msgTypes[28]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1620,84 +1725,201 @@ func (x *GetProviderSchema_Response) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use GetProviderSchema_Response.ProtoReflect.Descriptor instead.
-func (*GetProviderSchema_Response) Descriptor() ([]byte, []int) {
-	return file_tfplugin6_proto_rawDescGZIP(), []int{6, 1}
+// Deprecated: Use GetMetadata_Response.ProtoReflect.Descriptor instead.
+func (*GetMetadata_Response) Descriptor() ([]byte, []int) {
+	return file_tfplugin6_proto_rawDescGZIP(), []int{7, 1}
 }
 
-func (x *GetProviderSchema_Response) GetProvider() *Schema {
+func (x *GetMetadata_Response) GetServerCapabilities() *ServerCapabilities {
 	if x != nil {
-		return x.Provider
+		return x.ServerCapabilities
 	}
 	return nil
 }
 
-func (x *GetProviderSchema_Response) GetResourceSchemas() map[string]*Schema {
+func (x *GetMetadata_Response) GetDiagnostics() []*Diagnostic {
 	if x != nil {
-		return x.ResourceSchemas
+		return x.Diagnostics
 	}
 	return nil
 }
 
-func (x *GetProviderSchema_Response) GetDataSourceSchemas() map[string]*Schema {
+func (x *GetMetadata_Response) GetDataSources() []*GetMetadata_DataSourceMetadata {
 	if x != nil {
-		return x.DataSourceSchemas
+		return x.DataSources
 	}
 	return nil
 }
 
-func (x *GetProviderSchema_Response) GetDiagnostics() []*Diagnostic {
+func (x *GetMetadata_Response) GetResources() []*GetMetadata_ResourceMetadata {
 	if x != nil {
-		return x.Diagnostics
+		return x.Resources
 	}
 	return nil
 }
 
-func (x *GetProviderSchema_Response) GetProviderMeta() *Schema {
+type GetMetadata_DataSourceMetadata struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	TypeName string `protobuf:"bytes,1,opt,name=type_name,json=typeName,proto3" json:"type_name,omitempty"`
+}
+
+func (x *GetMetadata_DataSourceMetadata) Reset() {
+	*x = GetMetadata_DataSourceMetadata{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_tfplugin6_proto_msgTypes[29]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *GetMetadata_DataSourceMetadata) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetMetadata_DataSourceMetadata) ProtoMessage() {}
+
+func (x *GetMetadata_DataSourceMetadata) ProtoReflect() protoreflect.Message {
+	mi := &file_tfplugin6_proto_msgTypes[29]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetMetadata_DataSourceMetadata.ProtoReflect.Descriptor instead.
+func (*GetMetadata_DataSourceMetadata) Descriptor() ([]byte, []int) {
+	return file_tfplugin6_proto_rawDescGZIP(), []int{7, 2}
+}
+
+func (x *GetMetadata_DataSourceMetadata) GetTypeName() string {
 	if x != nil {
-		return x.ProviderMeta
+		return x.TypeName
 	}
-	return nil
+	return ""
+}
+
+type GetMetadata_ResourceMetadata struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	TypeName string `protobuf:"bytes,1,opt,name=type_name,json=typeName,proto3" json:"type_name,omitempty"`
+}
+
+func (x *GetMetadata_ResourceMetadata) Reset() {
+	*x = GetMetadata_ResourceMetadata{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_tfplugin6_proto_msgTypes[30]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *GetMetadata_ResourceMetadata) String() string {
+	return protoimpl.X.MessageStringOf(x)
 }
 
-func (x *GetProviderSchema_Response) GetServerCapabilities() *GetProviderSchema_ServerCapabilities {
+func (*GetMetadata_ResourceMetadata) ProtoMessage() {}
+
+func (x *GetMetadata_ResourceMetadata) ProtoReflect() protoreflect.Message {
+	mi := &file_tfplugin6_proto_msgTypes[30]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetMetadata_ResourceMetadata.ProtoReflect.Descriptor instead.
+func (*GetMetadata_ResourceMetadata) Descriptor() ([]byte, []int) {
+	return file_tfplugin6_proto_rawDescGZIP(), []int{7, 3}
+}
+
+func (x *GetMetadata_ResourceMetadata) GetTypeName() string {
 	if x != nil {
-		return x.ServerCapabilities
+		return x.TypeName
 	}
-	return nil
+	return ""
 }
 
-// ServerCapabilities allows providers to communicate extra information
-// regarding supported protocol features. This is used to indicate
-// availability of certain forward-compatible changes which may be optional
-// in a major protocol version, but cannot be tested for directly.
-type GetProviderSchema_ServerCapabilities struct {
+type GetProviderSchema_Request struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
+}
 
-	// The plan_destroy capability signals that a provider expects a call
-	// to PlanResourceChange when a resource is going to be destroyed.
-	PlanDestroy bool `protobuf:"varint,1,opt,name=plan_destroy,json=planDestroy,proto3" json:"plan_destroy,omitempty"`
+func (x *GetProviderSchema_Request) Reset() {
+	*x = GetProviderSchema_Request{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_tfplugin6_proto_msgTypes[31]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *GetProviderSchema_Request) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetProviderSchema_Request) ProtoMessage() {}
+
+func (x *GetProviderSchema_Request) ProtoReflect() protoreflect.Message {
+	mi := &file_tfplugin6_proto_msgTypes[31]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
 }
 
-func (x *GetProviderSchema_ServerCapabilities) Reset() {
-	*x = GetProviderSchema_ServerCapabilities{}
+// Deprecated: Use GetProviderSchema_Request.ProtoReflect.Descriptor instead.
+func (*GetProviderSchema_Request) Descriptor() ([]byte, []int) {
+	return file_tfplugin6_proto_rawDescGZIP(), []int{8, 0}
+}
+
+type GetProviderSchema_Response struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Provider           *Schema             `protobuf:"bytes,1,opt,name=provider,proto3" json:"provider,omitempty"`
+	ResourceSchemas    map[string]*Schema  `protobuf:"bytes,2,rep,name=resource_schemas,json=resourceSchemas,proto3" json:"resource_schemas,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+	DataSourceSchemas  map[string]*Schema  `protobuf:"bytes,3,rep,name=data_source_schemas,json=dataSourceSchemas,proto3" json:"data_source_schemas,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+	Diagnostics        []*Diagnostic       `protobuf:"bytes,4,rep,name=diagnostics,proto3" json:"diagnostics,omitempty"`
+	ProviderMeta       *Schema             `protobuf:"bytes,5,opt,name=provider_meta,json=providerMeta,proto3" json:"provider_meta,omitempty"`
+	ServerCapabilities *ServerCapabilities `protobuf:"bytes,6,opt,name=server_capabilities,json=serverCapabilities,proto3" json:"server_capabilities,omitempty"`
+}
+
+func (x *GetProviderSchema_Response) Reset() {
+	*x = GetProviderSchema_Response{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin6_proto_msgTypes[27]
+		mi := &file_tfplugin6_proto_msgTypes[32]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
 }
 
-func (x *GetProviderSchema_ServerCapabilities) String() string {
+func (x *GetProviderSchema_Response) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*GetProviderSchema_ServerCapabilities) ProtoMessage() {}
+func (*GetProviderSchema_Response) ProtoMessage() {}
 
-func (x *GetProviderSchema_ServerCapabilities) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin6_proto_msgTypes[27]
+func (x *GetProviderSchema_Response) ProtoReflect() protoreflect.Message {
+	mi := &file_tfplugin6_proto_msgTypes[32]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1708,16 +1930,51 @@ func (x *GetProviderSchema_ServerCapabilities) ProtoReflect() protoreflect.Messa
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use GetProviderSchema_ServerCapabilities.ProtoReflect.Descriptor instead.
-func (*GetProviderSchema_ServerCapabilities) Descriptor() ([]byte, []int) {
-	return file_tfplugin6_proto_rawDescGZIP(), []int{6, 2}
+// Deprecated: Use GetProviderSchema_Response.ProtoReflect.Descriptor instead.
+func (*GetProviderSchema_Response) Descriptor() ([]byte, []int) {
+	return file_tfplugin6_proto_rawDescGZIP(), []int{8, 1}
 }
 
-func (x *GetProviderSchema_ServerCapabilities) GetPlanDestroy() bool {
+func (x *GetProviderSchema_Response) GetProvider() *Schema {
 	if x != nil {
-		return x.PlanDestroy
+		return x.Provider
 	}
-	return false
+	return nil
+}
+
+func (x *GetProviderSchema_Response) GetResourceSchemas() map[string]*Schema {
+	if x != nil {
+		return x.ResourceSchemas
+	}
+	return nil
+}
+
+func (x *GetProviderSchema_Response) GetDataSourceSchemas() map[string]*Schema {
+	if x != nil {
+		return x.DataSourceSchemas
+	}
+	return nil
+}
+
+func (x *GetProviderSchema_Response) GetDiagnostics() []*Diagnostic {
+	if x != nil {
+		return x.Diagnostics
+	}
+	return nil
+}
+
+func (x *GetProviderSchema_Response) GetProviderMeta() *Schema {
+	if x != nil {
+		return x.ProviderMeta
+	}
+	return nil
+}
+
+func (x *GetProviderSchema_Response) GetServerCapabilities() *ServerCapabilities {
+	if x != nil {
+		return x.ServerCapabilities
+	}
+	return nil
 }
 
 type ValidateProviderConfig_Request struct {
@@ -1731,7 +1988,7 @@ type ValidateProviderConfig_Request struct {
 func (x *ValidateProviderConfig_Request) Reset() {
 	*x = ValidateProviderConfig_Request{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin6_proto_msgTypes[30]
+		mi := &file_tfplugin6_proto_msgTypes[35]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1744,7 +2001,7 @@ func (x *ValidateProviderConfig_Request) String() string {
 func (*ValidateProviderConfig_Request) ProtoMessage() {}
 
 func (x *ValidateProviderConfig_Request) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin6_proto_msgTypes[30]
+	mi := &file_tfplugin6_proto_msgTypes[35]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1757,7 +2014,7 @@ func (x *ValidateProviderConfig_Request) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ValidateProviderConfig_Request.ProtoReflect.Descriptor instead.
 func (*ValidateProviderConfig_Request) Descriptor() ([]byte, []int) {
-	return file_tfplugin6_proto_rawDescGZIP(), []int{7, 0}
+	return file_tfplugin6_proto_rawDescGZIP(), []int{9, 0}
 }
 
 func (x *ValidateProviderConfig_Request) GetConfig() *DynamicValue {
@@ -1778,7 +2035,7 @@ type ValidateProviderConfig_Response struct {
 func (x *ValidateProviderConfig_Response) Reset() {
 	*x = ValidateProviderConfig_Response{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin6_proto_msgTypes[31]
+		mi := &file_tfplugin6_proto_msgTypes[36]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1791,7 +2048,7 @@ func (x *ValidateProviderConfig_Response) String() string {
 func (*ValidateProviderConfig_Response) ProtoMessage() {}
 
 func (x *ValidateProviderConfig_Response) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin6_proto_msgTypes[31]
+	mi := &file_tfplugin6_proto_msgTypes[36]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1804,7 +2061,7 @@ func (x *ValidateProviderConfig_Response) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ValidateProviderConfig_Response.ProtoReflect.Descriptor instead.
 func (*ValidateProviderConfig_Response) Descriptor() ([]byte, []int) {
-	return file_tfplugin6_proto_rawDescGZIP(), []int{7, 1}
+	return file_tfplugin6_proto_rawDescGZIP(), []int{9, 1}
 }
 
 func (x *ValidateProviderConfig_Response) GetDiagnostics() []*Diagnostic {
@@ -1842,7 +2099,7 @@ type UpgradeResourceState_Request struct {
 func (x *UpgradeResourceState_Request) Reset() {
 	*x = UpgradeResourceState_Request{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin6_proto_msgTypes[32]
+		mi := &file_tfplugin6_proto_msgTypes[37]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1855,7 +2112,7 @@ func (x *UpgradeResourceState_Request) String() string {
 func (*UpgradeResourceState_Request) ProtoMessage() {}
 
 func (x *UpgradeResourceState_Request) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin6_proto_msgTypes[32]
+	mi := &file_tfplugin6_proto_msgTypes[37]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1868,7 +2125,7 @@ func (x *UpgradeResourceState_Request) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use UpgradeResourceState_Request.ProtoReflect.Descriptor instead.
 func (*UpgradeResourceState_Request) Descriptor() ([]byte, []int) {
-	return file_tfplugin6_proto_rawDescGZIP(), []int{8, 0}
+	return file_tfplugin6_proto_rawDescGZIP(), []int{10, 0}
 }
 
 func (x *UpgradeResourceState_Request) GetTypeName() string {
@@ -1910,7 +2167,7 @@ type UpgradeResourceState_Response struct {
 func (x *UpgradeResourceState_Response) Reset() {
 	*x = UpgradeResourceState_Response{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin6_proto_msgTypes[33]
+		mi := &file_tfplugin6_proto_msgTypes[38]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1923,7 +2180,7 @@ func (x *UpgradeResourceState_Response) String() string {
 func (*UpgradeResourceState_Response) ProtoMessage() {}
 
 func (x *UpgradeResourceState_Response) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin6_proto_msgTypes[33]
+	mi := &file_tfplugin6_proto_msgTypes[38]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1936,7 +2193,7 @@ func (x *UpgradeResourceState_Response) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use UpgradeResourceState_Response.ProtoReflect.Descriptor instead.
 func (*UpgradeResourceState_Response) Descriptor() ([]byte, []int) {
-	return file_tfplugin6_proto_rawDescGZIP(), []int{8, 1}
+	return file_tfplugin6_proto_rawDescGZIP(), []int{10, 1}
 }
 
 func (x *UpgradeResourceState_Response) GetUpgradedState() *DynamicValue {
@@ -1965,7 +2222,7 @@ type ValidateResourceConfig_Request struct {
 func (x *ValidateResourceConfig_Request) Reset() {
 	*x = ValidateResourceConfig_Request{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin6_proto_msgTypes[34]
+		mi := &file_tfplugin6_proto_msgTypes[39]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1978,7 +2235,7 @@ func (x *ValidateResourceConfig_Request) String() string {
 func (*ValidateResourceConfig_Request) ProtoMessage() {}
 
 func (x *ValidateResourceConfig_Request) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin6_proto_msgTypes[34]
+	mi := &file_tfplugin6_proto_msgTypes[39]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1991,7 +2248,7 @@ func (x *ValidateResourceConfig_Request) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ValidateResourceConfig_Request.ProtoReflect.Descriptor instead.
 func (*ValidateResourceConfig_Request) Descriptor() ([]byte, []int) {
-	return file_tfplugin6_proto_rawDescGZIP(), []int{9, 0}
+	return file_tfplugin6_proto_rawDescGZIP(), []int{11, 0}
 }
 
 func (x *ValidateResourceConfig_Request) GetTypeName() string {
@@ -2019,7 +2276,7 @@ type ValidateResourceConfig_Response struct {
 func (x *ValidateResourceConfig_Response) Reset() {
 	*x = ValidateResourceConfig_Response{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin6_proto_msgTypes[35]
+		mi := &file_tfplugin6_proto_msgTypes[40]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2032,7 +2289,7 @@ func (x *ValidateResourceConfig_Response) String() string {
 func (*ValidateResourceConfig_Response) ProtoMessage() {}
 
 func (x *ValidateResourceConfig_Response) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin6_proto_msgTypes[35]
+	mi := &file_tfplugin6_proto_msgTypes[40]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2045,7 +2302,7 @@ func (x *ValidateResourceConfig_Response) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ValidateResourceConfig_Response.ProtoReflect.Descriptor instead.
 func (*ValidateResourceConfig_Response) Descriptor() ([]byte, []int) {
-	return file_tfplugin6_proto_rawDescGZIP(), []int{9, 1}
+	return file_tfplugin6_proto_rawDescGZIP(), []int{11, 1}
 }
 
 func (x *ValidateResourceConfig_Response) GetDiagnostics() []*Diagnostic {
@@ -2067,7 +2324,7 @@ type ValidateDataResourceConfig_Request struct {
 func (x *ValidateDataResourceConfig_Request) Reset() {
 	*x = ValidateDataResourceConfig_Request{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin6_proto_msgTypes[36]
+		mi := &file_tfplugin6_proto_msgTypes[41]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2080,7 +2337,7 @@ func (x *ValidateDataResourceConfig_Request) String() string {
 func (*ValidateDataResourceConfig_Request) ProtoMessage() {}
 
 func (x *ValidateDataResourceConfig_Request) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin6_proto_msgTypes[36]
+	mi := &file_tfplugin6_proto_msgTypes[41]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2093,7 +2350,7 @@ func (x *ValidateDataResourceConfig_Request) ProtoReflect() protoreflect.Message
 
 // Deprecated: Use ValidateDataResourceConfig_Request.ProtoReflect.Descriptor instead.
 func (*ValidateDataResourceConfig_Request) Descriptor() ([]byte, []int) {
-	return file_tfplugin6_proto_rawDescGZIP(), []int{10, 0}
+	return file_tfplugin6_proto_rawDescGZIP(), []int{12, 0}
 }
 
 func (x *ValidateDataResourceConfig_Request) GetTypeName() string {
@@ -2121,7 +2378,7 @@ type ValidateDataResourceConfig_Response struct {
 func (x *ValidateDataResourceConfig_Response) Reset() {
 	*x = ValidateDataResourceConfig_Response{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin6_proto_msgTypes[37]
+		mi := &file_tfplugin6_proto_msgTypes[42]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2134,7 +2391,7 @@ func (x *ValidateDataResourceConfig_Response) String() string {
 func (*ValidateDataResourceConfig_Response) ProtoMessage() {}
 
 func (x *ValidateDataResourceConfig_Response) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin6_proto_msgTypes[37]
+	mi := &file_tfplugin6_proto_msgTypes[42]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2147,7 +2404,7 @@ func (x *ValidateDataResourceConfig_Response) ProtoReflect() protoreflect.Messag
 
 // Deprecated: Use ValidateDataResourceConfig_Response.ProtoReflect.Descriptor instead.
 func (*ValidateDataResourceConfig_Response) Descriptor() ([]byte, []int) {
-	return file_tfplugin6_proto_rawDescGZIP(), []int{10, 1}
+	return file_tfplugin6_proto_rawDescGZIP(), []int{12, 1}
 }
 
 func (x *ValidateDataResourceConfig_Response) GetDiagnostics() []*Diagnostic {
@@ -2169,7 +2426,7 @@ type ConfigureProvider_Request struct {
 func (x *ConfigureProvider_Request) Reset() {
 	*x = ConfigureProvider_Request{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin6_proto_msgTypes[38]
+		mi := &file_tfplugin6_proto_msgTypes[43]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2182,7 +2439,7 @@ func (x *ConfigureProvider_Request) String() string {
 func (*ConfigureProvider_Request) ProtoMessage() {}
 
 func (x *ConfigureProvider_Request) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin6_proto_msgTypes[38]
+	mi := &file_tfplugin6_proto_msgTypes[43]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2195,7 +2452,7 @@ func (x *ConfigureProvider_Request) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ConfigureProvider_Request.ProtoReflect.Descriptor instead.
 func (*ConfigureProvider_Request) Descriptor() ([]byte, []int) {
-	return file_tfplugin6_proto_rawDescGZIP(), []int{11, 0}
+	return file_tfplugin6_proto_rawDescGZIP(), []int{13, 0}
 }
 
 func (x *ConfigureProvider_Request) GetTerraformVersion() string {
@@ -2223,7 +2480,7 @@ type ConfigureProvider_Response struct {
 func (x *ConfigureProvider_Response) Reset() {
 	*x = ConfigureProvider_Response{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin6_proto_msgTypes[39]
+		mi := &file_tfplugin6_proto_msgTypes[44]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2236,7 +2493,7 @@ func (x *ConfigureProvider_Response) String() string {
 func (*ConfigureProvider_Response) ProtoMessage() {}
 
 func (x *ConfigureProvider_Response) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin6_proto_msgTypes[39]
+	mi := &file_tfplugin6_proto_msgTypes[44]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2249,7 +2506,7 @@ func (x *ConfigureProvider_Response) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ConfigureProvider_Response.ProtoReflect.Descriptor instead.
 func (*ConfigureProvider_Response) Descriptor() ([]byte, []int) {
-	return file_tfplugin6_proto_rawDescGZIP(), []int{11, 1}
+	return file_tfplugin6_proto_rawDescGZIP(), []int{13, 1}
 }
 
 func (x *ConfigureProvider_Response) GetDiagnostics() []*Diagnostic {
@@ -2281,7 +2538,7 @@ type ReadResource_Request struct {
 func (x *ReadResource_Request) Reset() {
 	*x = ReadResource_Request{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin6_proto_msgTypes[40]
+		mi := &file_tfplugin6_proto_msgTypes[45]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2294,7 +2551,7 @@ func (x *ReadResource_Request) String() string {
 func (*ReadResource_Request) ProtoMessage() {}
 
 func (x *ReadResource_Request) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin6_proto_msgTypes[40]
+	mi := &file_tfplugin6_proto_msgTypes[45]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2307,7 +2564,7 @@ func (x *ReadResource_Request) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ReadResource_Request.ProtoReflect.Descriptor instead.
 func (*ReadResource_Request) Descriptor() ([]byte, []int) {
-	return file_tfplugin6_proto_rawDescGZIP(), []int{12, 0}
+	return file_tfplugin6_proto_rawDescGZIP(), []int{14, 0}
 }
 
 func (x *ReadResource_Request) GetTypeName() string {
@@ -2351,7 +2608,7 @@ type ReadResource_Response struct {
 func (x *ReadResource_Response) Reset() {
 	*x = ReadResource_Response{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin6_proto_msgTypes[41]
+		mi := &file_tfplugin6_proto_msgTypes[46]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2364,7 +2621,7 @@ func (x *ReadResource_Response) String() string {
 func (*ReadResource_Response) ProtoMessage() {}
 
 func (x *ReadResource_Response) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin6_proto_msgTypes[41]
+	mi := &file_tfplugin6_proto_msgTypes[46]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2377,7 +2634,7 @@ func (x *ReadResource_Response) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ReadResource_Response.ProtoReflect.Descriptor instead.
 func (*ReadResource_Response) Descriptor() ([]byte, []int) {
-	return file_tfplugin6_proto_rawDescGZIP(), []int{12, 1}
+	return file_tfplugin6_proto_rawDescGZIP(), []int{14, 1}
 }
 
 func (x *ReadResource_Response) GetNewState() *DynamicValue {
@@ -2417,7 +2674,7 @@ type PlanResourceChange_Request struct {
 func (x *PlanResourceChange_Request) Reset() {
 	*x = PlanResourceChange_Request{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin6_proto_msgTypes[42]
+		mi := &file_tfplugin6_proto_msgTypes[47]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2430,7 +2687,7 @@ func (x *PlanResourceChange_Request) String() string {
 func (*PlanResourceChange_Request) ProtoMessage() {}
 
 func (x *PlanResourceChange_Request) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin6_proto_msgTypes[42]
+	mi := &file_tfplugin6_proto_msgTypes[47]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2443,7 +2700,7 @@ func (x *PlanResourceChange_Request) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use PlanResourceChange_Request.ProtoReflect.Descriptor instead.
 func (*PlanResourceChange_Request) Descriptor() ([]byte, []int) {
-	return file_tfplugin6_proto_rawDescGZIP(), []int{13, 0}
+	return file_tfplugin6_proto_rawDescGZIP(), []int{15, 0}
 }
 
 func (x *PlanResourceChange_Request) GetTypeName() string {
@@ -2505,16 +2762,16 @@ type PlanResourceChange_Response struct {
 	// specific details of the legacy SDK type system, and are not a general
 	// mechanism to avoid proper type handling in providers.
 	//
-	//     ====              DO NOT USE THIS              ====
-	//     ==== THIS MUST BE LEFT UNSET IN ALL OTHER SDKS ====
-	//     ====              DO NOT USE THIS              ====
+	//	====              DO NOT USE THIS              ====
+	//	==== THIS MUST BE LEFT UNSET IN ALL OTHER SDKS ====
+	//	====              DO NOT USE THIS              ====
 	LegacyTypeSystem bool `protobuf:"varint,5,opt,name=legacy_type_system,json=legacyTypeSystem,proto3" json:"legacy_type_system,omitempty"`
 }
 
 func (x *PlanResourceChange_Response) Reset() {
 	*x = PlanResourceChange_Response{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin6_proto_msgTypes[43]
+		mi := &file_tfplugin6_proto_msgTypes[48]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2527,7 +2784,7 @@ func (x *PlanResourceChange_Response) String() string {
 func (*PlanResourceChange_Response) ProtoMessage() {}
 
 func (x *PlanResourceChange_Response) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin6_proto_msgTypes[43]
+	mi := &file_tfplugin6_proto_msgTypes[48]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2540,7 +2797,7 @@ func (x *PlanResourceChange_Response) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use PlanResourceChange_Response.ProtoReflect.Descriptor instead.
 func (*PlanResourceChange_Response) Descriptor() ([]byte, []int) {
-	return file_tfplugin6_proto_rawDescGZIP(), []int{13, 1}
+	return file_tfplugin6_proto_rawDescGZIP(), []int{15, 1}
 }
 
 func (x *PlanResourceChange_Response) GetPlannedState() *DynamicValue {
@@ -2594,7 +2851,7 @@ type ApplyResourceChange_Request struct {
 func (x *ApplyResourceChange_Request) Reset() {
 	*x = ApplyResourceChange_Request{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin6_proto_msgTypes[44]
+		mi := &file_tfplugin6_proto_msgTypes[49]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2607,7 +2864,7 @@ func (x *ApplyResourceChange_Request) String() string {
 func (*ApplyResourceChange_Request) ProtoMessage() {}
 
 func (x *ApplyResourceChange_Request) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin6_proto_msgTypes[44]
+	mi := &file_tfplugin6_proto_msgTypes[49]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2620,7 +2877,7 @@ func (x *ApplyResourceChange_Request) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ApplyResourceChange_Request.ProtoReflect.Descriptor instead.
 func (*ApplyResourceChange_Request) Descriptor() ([]byte, []int) {
-	return file_tfplugin6_proto_rawDescGZIP(), []int{14, 0}
+	return file_tfplugin6_proto_rawDescGZIP(), []int{16, 0}
 }
 
 func (x *ApplyResourceChange_Request) GetTypeName() string {
@@ -2681,16 +2938,16 @@ type ApplyResourceChange_Response struct {
 	// specific details of the legacy SDK type system, and are not a general
 	// mechanism to avoid proper type handling in providers.
 	//
-	//     ====              DO NOT USE THIS              ====
-	//     ==== THIS MUST BE LEFT UNSET IN ALL OTHER SDKS ====
-	//     ====              DO NOT USE THIS              ====
+	//	====              DO NOT USE THIS              ====
+	//	==== THIS MUST BE LEFT UNSET IN ALL OTHER SDKS ====
+	//	====              DO NOT USE THIS              ====
 	LegacyTypeSystem bool `protobuf:"varint,4,opt,name=legacy_type_system,json=legacyTypeSystem,proto3" json:"legacy_type_system,omitempty"`
 }
 
 func (x *ApplyResourceChange_Response) Reset() {
 	*x = ApplyResourceChange_Response{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin6_proto_msgTypes[45]
+		mi := &file_tfplugin6_proto_msgTypes[50]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2703,7 +2960,7 @@ func (x *ApplyResourceChange_Response) String() string {
 func (*ApplyResourceChange_Response) ProtoMessage() {}
 
 func (x *ApplyResourceChange_Response) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin6_proto_msgTypes[45]
+	mi := &file_tfplugin6_proto_msgTypes[50]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2716,7 +2973,7 @@ func (x *ApplyResourceChange_Response) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ApplyResourceChange_Response.ProtoReflect.Descriptor instead.
 func (*ApplyResourceChange_Response) Descriptor() ([]byte, []int) {
-	return file_tfplugin6_proto_rawDescGZIP(), []int{14, 1}
+	return file_tfplugin6_proto_rawDescGZIP(), []int{16, 1}
 }
 
 func (x *ApplyResourceChange_Response) GetNewState() *DynamicValue {
@@ -2759,7 +3016,7 @@ type ImportResourceState_Request struct {
 func (x *ImportResourceState_Request) Reset() {
 	*x = ImportResourceState_Request{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin6_proto_msgTypes[46]
+		mi := &file_tfplugin6_proto_msgTypes[51]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2772,7 +3029,7 @@ func (x *ImportResourceState_Request) String() string {
 func (*ImportResourceState_Request) ProtoMessage() {}
 
 func (x *ImportResourceState_Request) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin6_proto_msgTypes[46]
+	mi := &file_tfplugin6_proto_msgTypes[51]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2785,7 +3042,7 @@ func (x *ImportResourceState_Request) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ImportResourceState_Request.ProtoReflect.Descriptor instead.
 func (*ImportResourceState_Request) Descriptor() ([]byte, []int) {
-	return file_tfplugin6_proto_rawDescGZIP(), []int{15, 0}
+	return file_tfplugin6_proto_rawDescGZIP(), []int{17, 0}
 }
 
 func (x *ImportResourceState_Request) GetTypeName() string {
@@ -2815,7 +3072,7 @@ type ImportResourceState_ImportedResource struct {
 func (x *ImportResourceState_ImportedResource) Reset() {
 	*x = ImportResourceState_ImportedResource{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin6_proto_msgTypes[47]
+		mi := &file_tfplugin6_proto_msgTypes[52]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2828,7 +3085,7 @@ func (x *ImportResourceState_ImportedResource) String() string {
 func (*ImportResourceState_ImportedResource) ProtoMessage() {}
 
 func (x *ImportResourceState_ImportedResource) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin6_proto_msgTypes[47]
+	mi := &file_tfplugin6_proto_msgTypes[52]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2841,7 +3098,7 @@ func (x *ImportResourceState_ImportedResource) ProtoReflect() protoreflect.Messa
 
 // Deprecated: Use ImportResourceState_ImportedResource.ProtoReflect.Descriptor instead.
 func (*ImportResourceState_ImportedResource) Descriptor() ([]byte, []int) {
-	return file_tfplugin6_proto_rawDescGZIP(), []int{15, 1}
+	return file_tfplugin6_proto_rawDescGZIP(), []int{17, 1}
 }
 
 func (x *ImportResourceState_ImportedResource) GetTypeName() string {
@@ -2877,7 +3134,7 @@ type ImportResourceState_Response struct {
 func (x *ImportResourceState_Response) Reset() {
 	*x = ImportResourceState_Response{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin6_proto_msgTypes[48]
+		mi := &file_tfplugin6_proto_msgTypes[53]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2890,7 +3147,7 @@ func (x *ImportResourceState_Response) String() string {
 func (*ImportResourceState_Response) ProtoMessage() {}
 
 func (x *ImportResourceState_Response) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin6_proto_msgTypes[48]
+	mi := &file_tfplugin6_proto_msgTypes[53]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2903,7 +3160,7 @@ func (x *ImportResourceState_Response) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ImportResourceState_Response.ProtoReflect.Descriptor instead.
 func (*ImportResourceState_Response) Descriptor() ([]byte, []int) {
-	return file_tfplugin6_proto_rawDescGZIP(), []int{15, 2}
+	return file_tfplugin6_proto_rawDescGZIP(), []int{17, 2}
 }
 
 func (x *ImportResourceState_Response) GetImportedResources() []*ImportResourceState_ImportedResource {
@@ -2933,7 +3190,7 @@ type ReadDataSource_Request struct {
 func (x *ReadDataSource_Request) Reset() {
 	*x = ReadDataSource_Request{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin6_proto_msgTypes[49]
+		mi := &file_tfplugin6_proto_msgTypes[54]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2946,7 +3203,7 @@ func (x *ReadDataSource_Request) String() string {
 func (*ReadDataSource_Request) ProtoMessage() {}
 
 func (x *ReadDataSource_Request) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin6_proto_msgTypes[49]
+	mi := &file_tfplugin6_proto_msgTypes[54]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2959,7 +3216,7 @@ func (x *ReadDataSource_Request) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ReadDataSource_Request.ProtoReflect.Descriptor instead.
 func (*ReadDataSource_Request) Descriptor() ([]byte, []int) {
-	return file_tfplugin6_proto_rawDescGZIP(), []int{16, 0}
+	return file_tfplugin6_proto_rawDescGZIP(), []int{18, 0}
 }
 
 func (x *ReadDataSource_Request) GetTypeName() string {
@@ -2995,7 +3252,7 @@ type ReadDataSource_Response struct {
 func (x *ReadDataSource_Response) Reset() {
 	*x = ReadDataSource_Response{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_tfplugin6_proto_msgTypes[50]
+		mi := &file_tfplugin6_proto_msgTypes[55]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -3008,7 +3265,7 @@ func (x *ReadDataSource_Response) String() string {
 func (*ReadDataSource_Response) ProtoMessage() {}
 
 func (x *ReadDataSource_Response) ProtoReflect() protoreflect.Message {
-	mi := &file_tfplugin6_proto_msgTypes[50]
+	mi := &file_tfplugin6_proto_msgTypes[55]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3021,7 +3278,7 @@ func (x *ReadDataSource_Response) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ReadDataSource_Response.ProtoReflect.Descriptor instead.
 func (*ReadDataSource_Response) Descriptor() ([]byte, []int) {
-	return file_tfplugin6_proto_rawDescGZIP(), []int{16, 1}
+	return file_tfplugin6_proto_rawDescGZIP(), []int{18, 1}
 }
 
 func (x *ReadDataSource_Response) GetState() *DynamicValue {
@@ -3169,337 +3426,372 @@ var file_tfplugin6_proto_rawDesc = []byte{
 	0x74, 0x69, 0x6e, 0x67, 0x4d, 0x6f, 0x64, 0x65, 0x12, 0x0b, 0x0a, 0x07, 0x49, 0x4e, 0x56, 0x41,
 	0x4c, 0x49, 0x44, 0x10, 0x00, 0x12, 0x0a, 0x0a, 0x06, 0x53, 0x49, 0x4e, 0x47, 0x4c, 0x45, 0x10,
 	0x01, 0x12, 0x08, 0x0a, 0x04, 0x4c, 0x49, 0x53, 0x54, 0x10, 0x02, 0x12, 0x07, 0x0a, 0x03, 0x53,
-	0x45, 0x54, 0x10, 0x03, 0x12, 0x07, 0x0a, 0x03, 0x4d, 0x41, 0x50, 0x10, 0x04, 0x22, 0xeb, 0x05,
-	0x0a, 0x11, 0x47, 0x65, 0x74, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x53, 0x63, 0x68,
-	0x65, 0x6d, 0x61, 0x1a, 0x09, 0x0a, 0x07, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x91,
-	0x05, 0x0a, 0x08, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x2d, 0x0a, 0x08, 0x70,
-	0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x11, 0x2e,
-	0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x36, 0x2e, 0x53, 0x63, 0x68, 0x65, 0x6d, 0x61,
-	0x52, 0x08, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x12, 0x65, 0x0a, 0x10, 0x72, 0x65,
-	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x73, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x73, 0x18, 0x02,
-	0x20, 0x03, 0x28, 0x0b, 0x32, 0x3a, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x36,
-	0x2e, 0x47, 0x65, 0x74, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x53, 0x63, 0x68, 0x65,
-	0x6d, 0x61, 0x2e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x2e, 0x52, 0x65, 0x73, 0x6f,
-	0x75, 0x72, 0x63, 0x65, 0x53, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79,
-	0x52, 0x0f, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x53, 0x63, 0x68, 0x65, 0x6d, 0x61,
-	0x73, 0x12, 0x6c, 0x0a, 0x13, 0x64, 0x61, 0x74, 0x61, 0x5f, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
-	0x5f, 0x73, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x3c,
-	0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x36, 0x2e, 0x47, 0x65, 0x74, 0x50, 0x72,
-	0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x53, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x2e, 0x52, 0x65, 0x73,
-	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x2e, 0x44, 0x61, 0x74, 0x61, 0x53, 0x6f, 0x75, 0x72, 0x63, 0x65,
-	0x53, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x11, 0x64, 0x61,
-	0x74, 0x61, 0x53, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x53, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x73, 0x12,
-	0x37, 0x0a, 0x0b, 0x64, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x73, 0x18, 0x04,
+	0x45, 0x54, 0x10, 0x03, 0x12, 0x07, 0x0a, 0x03, 0x4d, 0x41, 0x50, 0x10, 0x04, 0x22, 0x78, 0x0a,
+	0x12, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x43, 0x61, 0x70, 0x61, 0x62, 0x69, 0x6c, 0x69, 0x74,
+	0x69, 0x65, 0x73, 0x12, 0x21, 0x0a, 0x0c, 0x70, 0x6c, 0x61, 0x6e, 0x5f, 0x64, 0x65, 0x73, 0x74,
+	0x72, 0x6f, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0b, 0x70, 0x6c, 0x61, 0x6e, 0x44,
+	0x65, 0x73, 0x74, 0x72, 0x6f, 0x79, 0x12, 0x3f, 0x0a, 0x1c, 0x67, 0x65, 0x74, 0x5f, 0x70, 0x72,
+	0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x5f, 0x73, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x5f, 0x6f, 0x70,
+	0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x19, 0x67, 0x65,
+	0x74, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x53, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x4f,
+	0x70, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x22, 0xa7, 0x03, 0x0a, 0x0b, 0x47, 0x65, 0x74, 0x4d,
+	0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x1a, 0x09, 0x0a, 0x07, 0x52, 0x65, 0x71, 0x75, 0x65,
+	0x73, 0x74, 0x1a, 0xa8, 0x02, 0x0a, 0x08, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12,
+	0x4e, 0x0a, 0x13, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x5f, 0x63, 0x61, 0x70, 0x61, 0x62, 0x69,
+	0x6c, 0x69, 0x74, 0x69, 0x65, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x74,
+	0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x36, 0x2e, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x43,
+	0x61, 0x70, 0x61, 0x62, 0x69, 0x6c, 0x69, 0x74, 0x69, 0x65, 0x73, 0x52, 0x12, 0x73, 0x65, 0x72,
+	0x76, 0x65, 0x72, 0x43, 0x61, 0x70, 0x61, 0x62, 0x69, 0x6c, 0x69, 0x74, 0x69, 0x65, 0x73, 0x12,
+	0x37, 0x0a, 0x0b, 0x64, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x73, 0x18, 0x02,
 	0x20, 0x03, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x36,
 	0x2e, 0x44, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x52, 0x0b, 0x64, 0x69, 0x61,
-	0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x73, 0x12, 0x36, 0x0a, 0x0d, 0x70, 0x72, 0x6f, 0x76,
-	0x69, 0x64, 0x65, 0x72, 0x5f, 0x6d, 0x65, 0x74, 0x61, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32,
-	0x11, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x36, 0x2e, 0x53, 0x63, 0x68, 0x65,
-	0x6d, 0x61, 0x52, 0x0c, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x4d, 0x65, 0x74, 0x61,
-	0x12, 0x60, 0x0a, 0x13, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x5f, 0x63, 0x61, 0x70, 0x61, 0x62,
-	0x69, 0x6c, 0x69, 0x74, 0x69, 0x65, 0x73, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2f, 0x2e,
-	0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x36, 0x2e, 0x47, 0x65, 0x74, 0x50, 0x72, 0x6f,
-	0x76, 0x69, 0x64, 0x65, 0x72, 0x53, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x2e, 0x53, 0x65, 0x72, 0x76,
-	0x65, 0x72, 0x43, 0x61, 0x70, 0x61, 0x62, 0x69, 0x6c, 0x69, 0x74, 0x69, 0x65, 0x73, 0x52, 0x12,
-	0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x43, 0x61, 0x70, 0x61, 0x62, 0x69, 0x6c, 0x69, 0x74, 0x69,
-	0x65, 0x73, 0x1a, 0x55, 0x0a, 0x14, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x53, 0x63,
-	0x68, 0x65, 0x6d, 0x61, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65,
-	0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x27, 0x0a, 0x05,
-	0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x11, 0x2e, 0x74, 0x66,
-	0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x36, 0x2e, 0x53, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x52, 0x05,
-	0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x1a, 0x57, 0x0a, 0x16, 0x44, 0x61, 0x74,
-	0x61, 0x53, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x53, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x73, 0x45, 0x6e,
-	0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x27, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02,
-	0x20, 0x01, 0x28, 0x0b, 0x32, 0x11, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x36,
-	0x2e, 0x53, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02,
-	0x38, 0x01, 0x1a, 0x37, 0x0a, 0x12, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x43, 0x61, 0x70, 0x61,
-	0x62, 0x69, 0x6c, 0x69, 0x74, 0x69, 0x65, 0x73, 0x12, 0x21, 0x0a, 0x0c, 0x70, 0x6c, 0x61, 0x6e,
-	0x5f, 0x64, 0x65, 0x73, 0x74, 0x72, 0x6f, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0b,
-	0x70, 0x6c, 0x61, 0x6e, 0x44, 0x65, 0x73, 0x74, 0x72, 0x6f, 0x79, 0x22, 0x99, 0x01, 0x0a, 0x16,
-	0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72,
-	0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x1a, 0x3a, 0x0a, 0x07, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
-	0x74, 0x12, 0x2f, 0x0a, 0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x01, 0x20, 0x01, 0x28,
-	0x0b, 0x32, 0x17, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x36, 0x2e, 0x44, 0x79,
-	0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x06, 0x63, 0x6f, 0x6e, 0x66,
-	0x69, 0x67, 0x1a, 0x43, 0x0a, 0x08, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x37,
-	0x0a, 0x0b, 0x64, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x73, 0x18, 0x02, 0x20,
-	0x03, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x36, 0x2e,
-	0x44, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x52, 0x0b, 0x64, 0x69, 0x61, 0x67,
-	0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x73, 0x22, 0x90, 0x02, 0x0a, 0x14, 0x55, 0x70, 0x67, 0x72,
-	0x61, 0x64, 0x65, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x53, 0x74, 0x61, 0x74, 0x65,
-	0x1a, 0x72, 0x0a, 0x07, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1b, 0x0a, 0x09, 0x74,
-	0x79, 0x70, 0x65, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08,
-	0x74, 0x79, 0x70, 0x65, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x76, 0x65, 0x72, 0x73,
-	0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x03, 0x52, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69,
-	0x6f, 0x6e, 0x12, 0x30, 0x0a, 0x09, 0x72, 0x61, 0x77, 0x5f, 0x73, 0x74, 0x61, 0x74, 0x65, 0x18,
-	0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x13, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e,
-	0x36, 0x2e, 0x52, 0x61, 0x77, 0x53, 0x74, 0x61, 0x74, 0x65, 0x52, 0x08, 0x72, 0x61, 0x77, 0x53,
-	0x74, 0x61, 0x74, 0x65, 0x1a, 0x83, 0x01, 0x0a, 0x08, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
-	0x65, 0x12, 0x3e, 0x0a, 0x0e, 0x75, 0x70, 0x67, 0x72, 0x61, 0x64, 0x65, 0x64, 0x5f, 0x73, 0x74,
-	0x61, 0x74, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x74, 0x66, 0x70, 0x6c,
-	0x75, 0x67, 0x69, 0x6e, 0x36, 0x2e, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c,
-	0x75, 0x65, 0x52, 0x0d, 0x75, 0x70, 0x67, 0x72, 0x61, 0x64, 0x65, 0x64, 0x53, 0x74, 0x61, 0x74,
-	0x65, 0x12, 0x37, 0x0a, 0x0b, 0x64, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x73,
-	0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69,
-	0x6e, 0x36, 0x2e, 0x44, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x52, 0x0b, 0x64,
-	0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x73, 0x22, 0xb6, 0x01, 0x0a, 0x16, 0x56,
-	0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x43,
-	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x1a, 0x57, 0x0a, 0x07, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
-	0x12, 0x1b, 0x0a, 0x09, 0x74, 0x79, 0x70, 0x65, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x08, 0x74, 0x79, 0x70, 0x65, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x2f, 0x0a,
-	0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e,
-	0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x36, 0x2e, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69,
-	0x63, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x1a, 0x43,
-	0x0a, 0x08, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x37, 0x0a, 0x0b, 0x64, 0x69,
-	0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32,
-	0x15, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x36, 0x2e, 0x44, 0x69, 0x61, 0x67,
-	0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x52, 0x0b, 0x64, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74,
-	0x69, 0x63, 0x73, 0x22, 0xba, 0x01, 0x0a, 0x1a, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65,
-	0x44, 0x61, 0x74, 0x61, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x43, 0x6f, 0x6e, 0x66,
-	0x69, 0x67, 0x1a, 0x57, 0x0a, 0x07, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1b, 0x0a,
-	0x09, 0x74, 0x79, 0x70, 0x65, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x08, 0x74, 0x79, 0x70, 0x65, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x2f, 0x0a, 0x06, 0x63, 0x6f,
-	0x6e, 0x66, 0x69, 0x67, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x74, 0x66, 0x70,
+	0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x73, 0x12, 0x4c, 0x0a, 0x0c, 0x64, 0x61, 0x74, 0x61,
+	0x5f, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x29,
+	0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x36, 0x2e, 0x47, 0x65, 0x74, 0x4d, 0x65,
+	0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x2e, 0x44, 0x61, 0x74, 0x61, 0x53, 0x6f, 0x75, 0x72, 0x63,
+	0x65, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x0b, 0x64, 0x61, 0x74, 0x61, 0x53,
+	0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x12, 0x45, 0x0a, 0x09, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72,
+	0x63, 0x65, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x27, 0x2e, 0x74, 0x66, 0x70, 0x6c,
+	0x75, 0x67, 0x69, 0x6e, 0x36, 0x2e, 0x47, 0x65, 0x74, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74,
+	0x61, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61,
+	0x74, 0x61, 0x52, 0x09, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x1a, 0x31, 0x0a,
+	0x12, 0x44, 0x61, 0x74, 0x61, 0x53, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x4d, 0x65, 0x74, 0x61, 0x64,
+	0x61, 0x74, 0x61, 0x12, 0x1b, 0x0a, 0x09, 0x74, 0x79, 0x70, 0x65, 0x5f, 0x6e, 0x61, 0x6d, 0x65,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x74, 0x79, 0x70, 0x65, 0x4e, 0x61, 0x6d, 0x65,
+	0x1a, 0x2f, 0x0a, 0x10, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x4d, 0x65, 0x74, 0x61,
+	0x64, 0x61, 0x74, 0x61, 0x12, 0x1b, 0x0a, 0x09, 0x74, 0x79, 0x70, 0x65, 0x5f, 0x6e, 0x61, 0x6d,
+	0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x74, 0x79, 0x70, 0x65, 0x4e, 0x61, 0x6d,
+	0x65, 0x22, 0xa0, 0x05, 0x0a, 0x11, 0x47, 0x65, 0x74, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65,
+	0x72, 0x53, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x1a, 0x09, 0x0a, 0x07, 0x52, 0x65, 0x71, 0x75, 0x65,
+	0x73, 0x74, 0x1a, 0xff, 0x04, 0x0a, 0x08, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12,
+	0x2d, 0x0a, 0x08, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x11, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x36, 0x2e, 0x53, 0x63,
+	0x68, 0x65, 0x6d, 0x61, 0x52, 0x08, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x12, 0x65,
+	0x0a, 0x10, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x73, 0x63, 0x68, 0x65, 0x6d,
+	0x61, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x3a, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75,
+	0x67, 0x69, 0x6e, 0x36, 0x2e, 0x47, 0x65, 0x74, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72,
+	0x53, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x2e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x2e,
+	0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x53, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x73, 0x45,
+	0x6e, 0x74, 0x72, 0x79, 0x52, 0x0f, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x53, 0x63,
+	0x68, 0x65, 0x6d, 0x61, 0x73, 0x12, 0x6c, 0x0a, 0x13, 0x64, 0x61, 0x74, 0x61, 0x5f, 0x73, 0x6f,
+	0x75, 0x72, 0x63, 0x65, 0x5f, 0x73, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x73, 0x18, 0x03, 0x20, 0x03,
+	0x28, 0x0b, 0x32, 0x3c, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x36, 0x2e, 0x47,
+	0x65, 0x74, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x53, 0x63, 0x68, 0x65, 0x6d, 0x61,
+	0x2e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x2e, 0x44, 0x61, 0x74, 0x61, 0x53, 0x6f,
+	0x75, 0x72, 0x63, 0x65, 0x53, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79,
+	0x52, 0x11, 0x64, 0x61, 0x74, 0x61, 0x53, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x53, 0x63, 0x68, 0x65,
+	0x6d, 0x61, 0x73, 0x12, 0x37, 0x0a, 0x0b, 0x64, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69,
+	0x63, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75,
+	0x67, 0x69, 0x6e, 0x36, 0x2e, 0x44, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x52,
+	0x0b, 0x64, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x73, 0x12, 0x36, 0x0a, 0x0d,
+	0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x5f, 0x6d, 0x65, 0x74, 0x61, 0x18, 0x05, 0x20,
+	0x01, 0x28, 0x0b, 0x32, 0x11, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x36, 0x2e,
+	0x53, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x52, 0x0c, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72,
+	0x4d, 0x65, 0x74, 0x61, 0x12, 0x4e, 0x0a, 0x13, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x5f, 0x63,
+	0x61, 0x70, 0x61, 0x62, 0x69, 0x6c, 0x69, 0x74, 0x69, 0x65, 0x73, 0x18, 0x06, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x1d, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x36, 0x2e, 0x53, 0x65,
+	0x72, 0x76, 0x65, 0x72, 0x43, 0x61, 0x70, 0x61, 0x62, 0x69, 0x6c, 0x69, 0x74, 0x69, 0x65, 0x73,
+	0x52, 0x12, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x43, 0x61, 0x70, 0x61, 0x62, 0x69, 0x6c, 0x69,
+	0x74, 0x69, 0x65, 0x73, 0x1a, 0x55, 0x0a, 0x14, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
+	0x53, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03,
+	0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x27,
+	0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x11, 0x2e,
+	0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x36, 0x2e, 0x53, 0x63, 0x68, 0x65, 0x6d, 0x61,
+	0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x1a, 0x57, 0x0a, 0x16, 0x44,
+	0x61, 0x74, 0x61, 0x53, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x53, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x73,
+	0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x27, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x11, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69,
+	0x6e, 0x36, 0x2e, 0x53, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65,
+	0x3a, 0x02, 0x38, 0x01, 0x22, 0x99, 0x01, 0x0a, 0x16, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74,
+	0x65, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x1a,
+	0x3a, 0x0a, 0x07, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x2f, 0x0a, 0x06, 0x63, 0x6f,
+	0x6e, 0x66, 0x69, 0x67, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x74, 0x66, 0x70,
 	0x6c, 0x75, 0x67, 0x69, 0x6e, 0x36, 0x2e, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56, 0x61,
 	0x6c, 0x75, 0x65, 0x52, 0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x1a, 0x43, 0x0a, 0x08, 0x52,
 	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x37, 0x0a, 0x0b, 0x64, 0x69, 0x61, 0x67, 0x6e,
-	0x6f, 0x73, 0x74, 0x69, 0x63, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x74,
-	0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x36, 0x2e, 0x44, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73,
-	0x74, 0x69, 0x63, 0x52, 0x0b, 0x64, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x73,
-	0x22, 0xc1, 0x01, 0x0a, 0x11, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x75, 0x72, 0x65, 0x50, 0x72,
-	0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x1a, 0x67, 0x0a, 0x07, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
-	0x74, 0x12, 0x2b, 0x0a, 0x11, 0x74, 0x65, 0x72, 0x72, 0x61, 0x66, 0x6f, 0x72, 0x6d, 0x5f, 0x76,
-	0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x10, 0x74, 0x65,
-	0x72, 0x72, 0x61, 0x66, 0x6f, 0x72, 0x6d, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x2f,
-	0x0a, 0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17,
-	0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x36, 0x2e, 0x44, 0x79, 0x6e, 0x61, 0x6d,
-	0x69, 0x63, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x1a,
-	0x43, 0x0a, 0x08, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x37, 0x0a, 0x0b, 0x64,
-	0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b,
-	0x32, 0x15, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x36, 0x2e, 0x44, 0x69, 0x61,
-	0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x52, 0x0b, 0x64, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73,
-	0x74, 0x69, 0x63, 0x73, 0x22, 0xe3, 0x02, 0x0a, 0x0c, 0x52, 0x65, 0x61, 0x64, 0x52, 0x65, 0x73,
-	0x6f, 0x75, 0x72, 0x63, 0x65, 0x1a, 0xbc, 0x01, 0x0a, 0x07, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
-	0x74, 0x12, 0x1b, 0x0a, 0x09, 0x74, 0x79, 0x70, 0x65, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x74, 0x79, 0x70, 0x65, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x3c,
-	0x0a, 0x0d, 0x63, 0x75, 0x72, 0x72, 0x65, 0x6e, 0x74, 0x5f, 0x73, 0x74, 0x61, 0x74, 0x65, 0x18,
-	0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e,
-	0x36, 0x2e, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x0c,
-	0x63, 0x75, 0x72, 0x72, 0x65, 0x6e, 0x74, 0x53, 0x74, 0x61, 0x74, 0x65, 0x12, 0x18, 0x0a, 0x07,
-	0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x07, 0x70,
-	0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x12, 0x3c, 0x0a, 0x0d, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64,
-	0x65, 0x72, 0x5f, 0x6d, 0x65, 0x74, 0x61, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e,
-	0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x36, 0x2e, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69,
-	0x63, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x0c, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72,
-	0x4d, 0x65, 0x74, 0x61, 0x1a, 0x93, 0x01, 0x0a, 0x08, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
-	0x65, 0x12, 0x34, 0x0a, 0x09, 0x6e, 0x65, 0x77, 0x5f, 0x73, 0x74, 0x61, 0x74, 0x65, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x36,
-	0x2e, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x08, 0x6e,
-	0x65, 0x77, 0x53, 0x74, 0x61, 0x74, 0x65, 0x12, 0x37, 0x0a, 0x0b, 0x64, 0x69, 0x61, 0x67, 0x6e,
 	0x6f, 0x73, 0x74, 0x69, 0x63, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x74,
 	0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x36, 0x2e, 0x44, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73,
 	0x74, 0x69, 0x63, 0x52, 0x0b, 0x64, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x73,
-	0x12, 0x18, 0x0a, 0x07, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28,
-	0x0c, 0x52, 0x07, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x22, 0xf2, 0x04, 0x0a, 0x12, 0x50,
-	0x6c, 0x61, 0x6e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x43, 0x68, 0x61, 0x6e, 0x67,
-	0x65, 0x1a, 0xbb, 0x02, 0x0a, 0x07, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1b, 0x0a,
-	0x09, 0x74, 0x79, 0x70, 0x65, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x08, 0x74, 0x79, 0x70, 0x65, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x38, 0x0a, 0x0b, 0x70, 0x72,
-	0x69, 0x6f, 0x72, 0x5f, 0x73, 0x74, 0x61, 0x74, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32,
-	0x17, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x36, 0x2e, 0x44, 0x79, 0x6e, 0x61,
-	0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x0a, 0x70, 0x72, 0x69, 0x6f, 0x72, 0x53,
-	0x74, 0x61, 0x74, 0x65, 0x12, 0x45, 0x0a, 0x12, 0x70, 0x72, 0x6f, 0x70, 0x6f, 0x73, 0x65, 0x64,
-	0x5f, 0x6e, 0x65, 0x77, 0x5f, 0x73, 0x74, 0x61, 0x74, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b,
-	0x32, 0x17, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x36, 0x2e, 0x44, 0x79, 0x6e,
-	0x61, 0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x10, 0x70, 0x72, 0x6f, 0x70, 0x6f,
-	0x73, 0x65, 0x64, 0x4e, 0x65, 0x77, 0x53, 0x74, 0x61, 0x74, 0x65, 0x12, 0x2f, 0x0a, 0x06, 0x63,
-	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x74, 0x66,
-	0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x36, 0x2e, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56,
-	0x61, 0x6c, 0x75, 0x65, 0x52, 0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x23, 0x0a, 0x0d,
-	0x70, 0x72, 0x69, 0x6f, 0x72, 0x5f, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x18, 0x05, 0x20,
-	0x01, 0x28, 0x0c, 0x52, 0x0c, 0x70, 0x72, 0x69, 0x6f, 0x72, 0x50, 0x72, 0x69, 0x76, 0x61, 0x74,
-	0x65, 0x12, 0x3c, 0x0a, 0x0d, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x5f, 0x6d, 0x65,
-	0x74, 0x61, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75,
-	0x67, 0x69, 0x6e, 0x36, 0x2e, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c, 0x75,
-	0x65, 0x52, 0x0c, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x4d, 0x65, 0x74, 0x61, 0x1a,
-	0x9d, 0x02, 0x0a, 0x08, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x3c, 0x0a, 0x0d,
-	0x70, 0x6c, 0x61, 0x6e, 0x6e, 0x65, 0x64, 0x5f, 0x73, 0x74, 0x61, 0x74, 0x65, 0x18, 0x01, 0x20,
+	0x22, 0x90, 0x02, 0x0a, 0x14, 0x55, 0x70, 0x67, 0x72, 0x61, 0x64, 0x65, 0x52, 0x65, 0x73, 0x6f,
+	0x75, 0x72, 0x63, 0x65, 0x53, 0x74, 0x61, 0x74, 0x65, 0x1a, 0x72, 0x0a, 0x07, 0x52, 0x65, 0x71,
+	0x75, 0x65, 0x73, 0x74, 0x12, 0x1b, 0x0a, 0x09, 0x74, 0x79, 0x70, 0x65, 0x5f, 0x6e, 0x61, 0x6d,
+	0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x74, 0x79, 0x70, 0x65, 0x4e, 0x61, 0x6d,
+	0x65, 0x12, 0x18, 0x0a, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01,
+	0x28, 0x03, 0x52, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x30, 0x0a, 0x09, 0x72,
+	0x61, 0x77, 0x5f, 0x73, 0x74, 0x61, 0x74, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x13,
+	0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x36, 0x2e, 0x52, 0x61, 0x77, 0x53, 0x74,
+	0x61, 0x74, 0x65, 0x52, 0x08, 0x72, 0x61, 0x77, 0x53, 0x74, 0x61, 0x74, 0x65, 0x1a, 0x83, 0x01,
+	0x0a, 0x08, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x3e, 0x0a, 0x0e, 0x75, 0x70,
+	0x67, 0x72, 0x61, 0x64, 0x65, 0x64, 0x5f, 0x73, 0x74, 0x61, 0x74, 0x65, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x17, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x36, 0x2e, 0x44,
+	0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x0d, 0x75, 0x70, 0x67,
+	0x72, 0x61, 0x64, 0x65, 0x64, 0x53, 0x74, 0x61, 0x74, 0x65, 0x12, 0x37, 0x0a, 0x0b, 0x64, 0x69,
+	0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32,
+	0x15, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x36, 0x2e, 0x44, 0x69, 0x61, 0x67,
+	0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x52, 0x0b, 0x64, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74,
+	0x69, 0x63, 0x73, 0x22, 0xb6, 0x01, 0x0a, 0x16, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65,
+	0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x1a, 0x57,
+	0x0a, 0x07, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1b, 0x0a, 0x09, 0x74, 0x79, 0x70,
+	0x65, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x74, 0x79,
+	0x70, 0x65, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x2f, 0x0a, 0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69,
+	0x6e, 0x36, 0x2e, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52,
+	0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x1a, 0x43, 0x0a, 0x08, 0x52, 0x65, 0x73, 0x70, 0x6f,
+	0x6e, 0x73, 0x65, 0x12, 0x37, 0x0a, 0x0b, 0x64, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69,
+	0x63, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75,
+	0x67, 0x69, 0x6e, 0x36, 0x2e, 0x44, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x52,
+	0x0b, 0x64, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x73, 0x22, 0xba, 0x01, 0x0a,
+	0x1a, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x44, 0x61, 0x74, 0x61, 0x52, 0x65, 0x73,
+	0x6f, 0x75, 0x72, 0x63, 0x65, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x1a, 0x57, 0x0a, 0x07, 0x52,
+	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1b, 0x0a, 0x09, 0x74, 0x79, 0x70, 0x65, 0x5f, 0x6e,
+	0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x74, 0x79, 0x70, 0x65, 0x4e,
+	0x61, 0x6d, 0x65, 0x12, 0x2f, 0x0a, 0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x02, 0x20,
 	0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x36, 0x2e,
-	0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x0c, 0x70, 0x6c,
-	0x61, 0x6e, 0x6e, 0x65, 0x64, 0x53, 0x74, 0x61, 0x74, 0x65, 0x12, 0x43, 0x0a, 0x10, 0x72, 0x65,
-	0x71, 0x75, 0x69, 0x72, 0x65, 0x73, 0x5f, 0x72, 0x65, 0x70, 0x6c, 0x61, 0x63, 0x65, 0x18, 0x02,
-	0x20, 0x03, 0x28, 0x0b, 0x32, 0x18, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x36,
-	0x2e, 0x41, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x50, 0x61, 0x74, 0x68, 0x52, 0x0f,
-	0x72, 0x65, 0x71, 0x75, 0x69, 0x72, 0x65, 0x73, 0x52, 0x65, 0x70, 0x6c, 0x61, 0x63, 0x65, 0x12,
-	0x27, 0x0a, 0x0f, 0x70, 0x6c, 0x61, 0x6e, 0x6e, 0x65, 0x64, 0x5f, 0x70, 0x72, 0x69, 0x76, 0x61,
-	0x74, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x0e, 0x70, 0x6c, 0x61, 0x6e, 0x6e, 0x65,
-	0x64, 0x50, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x12, 0x37, 0x0a, 0x0b, 0x64, 0x69, 0x61, 0x67,
-	0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x15, 0x2e,
-	0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x36, 0x2e, 0x44, 0x69, 0x61, 0x67, 0x6e, 0x6f,
-	0x73, 0x74, 0x69, 0x63, 0x52, 0x0b, 0x64, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63,
-	0x73, 0x12, 0x2c, 0x0a, 0x12, 0x6c, 0x65, 0x67, 0x61, 0x63, 0x79, 0x5f, 0x74, 0x79, 0x70, 0x65,
-	0x5f, 0x73, 0x79, 0x73, 0x74, 0x65, 0x6d, 0x18, 0x05, 0x20, 0x01, 0x28, 0x08, 0x52, 0x10, 0x6c,
-	0x65, 0x67, 0x61, 0x63, 0x79, 0x54, 0x79, 0x70, 0x65, 0x53, 0x79, 0x73, 0x74, 0x65, 0x6d, 0x22,
-	0x92, 0x04, 0x0a, 0x13, 0x41, 0x70, 0x70, 0x6c, 0x79, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
-	0x65, 0x43, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x1a, 0xb6, 0x02, 0x0a, 0x07, 0x52, 0x65, 0x71, 0x75,
-	0x65, 0x73, 0x74, 0x12, 0x1b, 0x0a, 0x09, 0x74, 0x79, 0x70, 0x65, 0x5f, 0x6e, 0x61, 0x6d, 0x65,
-	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x74, 0x79, 0x70, 0x65, 0x4e, 0x61, 0x6d, 0x65,
-	0x12, 0x38, 0x0a, 0x0b, 0x70, 0x72, 0x69, 0x6f, 0x72, 0x5f, 0x73, 0x74, 0x61, 0x74, 0x65, 0x18,
-	0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e,
-	0x36, 0x2e, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x0a,
-	0x70, 0x72, 0x69, 0x6f, 0x72, 0x53, 0x74, 0x61, 0x74, 0x65, 0x12, 0x3c, 0x0a, 0x0d, 0x70, 0x6c,
-	0x61, 0x6e, 0x6e, 0x65, 0x64, 0x5f, 0x73, 0x74, 0x61, 0x74, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28,
-	0x0b, 0x32, 0x17, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x36, 0x2e, 0x44, 0x79,
-	0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x0c, 0x70, 0x6c, 0x61, 0x6e,
-	0x6e, 0x65, 0x64, 0x53, 0x74, 0x61, 0x74, 0x65, 0x12, 0x2f, 0x0a, 0x06, 0x63, 0x6f, 0x6e, 0x66,
-	0x69, 0x67, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75,
+	0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x06, 0x63, 0x6f,
+	0x6e, 0x66, 0x69, 0x67, 0x1a, 0x43, 0x0a, 0x08, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
+	0x12, 0x37, 0x0a, 0x0b, 0x64, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x73, 0x18,
+	0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e,
+	0x36, 0x2e, 0x44, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x52, 0x0b, 0x64, 0x69,
+	0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x73, 0x22, 0xc1, 0x01, 0x0a, 0x11, 0x43, 0x6f,
+	0x6e, 0x66, 0x69, 0x67, 0x75, 0x72, 0x65, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x1a,
+	0x67, 0x0a, 0x07, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x2b, 0x0a, 0x11, 0x74, 0x65,
+	0x72, 0x72, 0x61, 0x66, 0x6f, 0x72, 0x6d, 0x5f, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x10, 0x74, 0x65, 0x72, 0x72, 0x61, 0x66, 0x6f, 0x72, 0x6d,
+	0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x2f, 0x0a, 0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69,
+	0x67, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67,
+	0x69, 0x6e, 0x36, 0x2e, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c, 0x75, 0x65,
+	0x52, 0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x1a, 0x43, 0x0a, 0x08, 0x52, 0x65, 0x73, 0x70,
+	0x6f, 0x6e, 0x73, 0x65, 0x12, 0x37, 0x0a, 0x0b, 0x64, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74,
+	0x69, 0x63, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x74, 0x66, 0x70, 0x6c,
+	0x75, 0x67, 0x69, 0x6e, 0x36, 0x2e, 0x44, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63,
+	0x52, 0x0b, 0x64, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x73, 0x22, 0xe3, 0x02,
+	0x0a, 0x0c, 0x52, 0x65, 0x61, 0x64, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x1a, 0xbc,
+	0x01, 0x0a, 0x07, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1b, 0x0a, 0x09, 0x74, 0x79,
+	0x70, 0x65, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x74,
+	0x79, 0x70, 0x65, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x3c, 0x0a, 0x0d, 0x63, 0x75, 0x72, 0x72, 0x65,
+	0x6e, 0x74, 0x5f, 0x73, 0x74, 0x61, 0x74, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17,
+	0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x36, 0x2e, 0x44, 0x79, 0x6e, 0x61, 0x6d,
+	0x69, 0x63, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x0c, 0x63, 0x75, 0x72, 0x72, 0x65, 0x6e, 0x74,
+	0x53, 0x74, 0x61, 0x74, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65,
+	0x18, 0x03, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x07, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x12,
+	0x3c, 0x0a, 0x0d, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x5f, 0x6d, 0x65, 0x74, 0x61,
+	0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69,
+	0x6e, 0x36, 0x2e, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52,
+	0x0c, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x4d, 0x65, 0x74, 0x61, 0x1a, 0x93, 0x01,
+	0x0a, 0x08, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x34, 0x0a, 0x09, 0x6e, 0x65,
+	0x77, 0x5f, 0x73, 0x74, 0x61, 0x74, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e,
+	0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x36, 0x2e, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69,
+	0x63, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x08, 0x6e, 0x65, 0x77, 0x53, 0x74, 0x61, 0x74, 0x65,
+	0x12, 0x37, 0x0a, 0x0b, 0x64, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x73, 0x18,
+	0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e,
+	0x36, 0x2e, 0x44, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x52, 0x0b, 0x64, 0x69,
+	0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x73, 0x12, 0x18, 0x0a, 0x07, 0x70, 0x72, 0x69,
+	0x76, 0x61, 0x74, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x07, 0x70, 0x72, 0x69, 0x76,
+	0x61, 0x74, 0x65, 0x22, 0xf2, 0x04, 0x0a, 0x12, 0x50, 0x6c, 0x61, 0x6e, 0x52, 0x65, 0x73, 0x6f,
+	0x75, 0x72, 0x63, 0x65, 0x43, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x1a, 0xbb, 0x02, 0x0a, 0x07, 0x52,
+	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1b, 0x0a, 0x09, 0x74, 0x79, 0x70, 0x65, 0x5f, 0x6e,
+	0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x74, 0x79, 0x70, 0x65, 0x4e,
+	0x61, 0x6d, 0x65, 0x12, 0x38, 0x0a, 0x0b, 0x70, 0x72, 0x69, 0x6f, 0x72, 0x5f, 0x73, 0x74, 0x61,
+	0x74, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75,
 	0x67, 0x69, 0x6e, 0x36, 0x2e, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c, 0x75,
-	0x65, 0x52, 0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x27, 0x0a, 0x0f, 0x70, 0x6c, 0x61,
-	0x6e, 0x6e, 0x65, 0x64, 0x5f, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x18, 0x05, 0x20, 0x01,
-	0x28, 0x0c, 0x52, 0x0e, 0x70, 0x6c, 0x61, 0x6e, 0x6e, 0x65, 0x64, 0x50, 0x72, 0x69, 0x76, 0x61,
-	0x74, 0x65, 0x12, 0x3c, 0x0a, 0x0d, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x5f, 0x6d,
-	0x65, 0x74, 0x61, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x74, 0x66, 0x70, 0x6c,
+	0x65, 0x52, 0x0a, 0x70, 0x72, 0x69, 0x6f, 0x72, 0x53, 0x74, 0x61, 0x74, 0x65, 0x12, 0x45, 0x0a,
+	0x12, 0x70, 0x72, 0x6f, 0x70, 0x6f, 0x73, 0x65, 0x64, 0x5f, 0x6e, 0x65, 0x77, 0x5f, 0x73, 0x74,
+	0x61, 0x74, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x74, 0x66, 0x70, 0x6c,
 	0x75, 0x67, 0x69, 0x6e, 0x36, 0x2e, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c,
-	0x75, 0x65, 0x52, 0x0c, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x4d, 0x65, 0x74, 0x61,
-	0x1a, 0xc1, 0x01, 0x0a, 0x08, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x34, 0x0a,
-	0x09, 0x6e, 0x65, 0x77, 0x5f, 0x73, 0x74, 0x61, 0x74, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b,
-	0x32, 0x17, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x36, 0x2e, 0x44, 0x79, 0x6e,
-	0x61, 0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x08, 0x6e, 0x65, 0x77, 0x53, 0x74,
-	0x61, 0x74, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x18, 0x02,
-	0x20, 0x01, 0x28, 0x0c, 0x52, 0x07, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x12, 0x37, 0x0a,
-	0x0b, 0x64, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x73, 0x18, 0x03, 0x20, 0x03,
-	0x28, 0x0b, 0x32, 0x15, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x36, 0x2e, 0x44,
-	0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x52, 0x0b, 0x64, 0x69, 0x61, 0x67, 0x6e,
-	0x6f, 0x73, 0x74, 0x69, 0x63, 0x73, 0x12, 0x2c, 0x0a, 0x12, 0x6c, 0x65, 0x67, 0x61, 0x63, 0x79,
-	0x5f, 0x74, 0x79, 0x70, 0x65, 0x5f, 0x73, 0x79, 0x73, 0x74, 0x65, 0x6d, 0x18, 0x04, 0x20, 0x01,
-	0x28, 0x08, 0x52, 0x10, 0x6c, 0x65, 0x67, 0x61, 0x63, 0x79, 0x54, 0x79, 0x70, 0x65, 0x53, 0x79,
-	0x73, 0x74, 0x65, 0x6d, 0x22, 0xed, 0x02, 0x0a, 0x13, 0x49, 0x6d, 0x70, 0x6f, 0x72, 0x74, 0x52,
-	0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x53, 0x74, 0x61, 0x74, 0x65, 0x1a, 0x36, 0x0a, 0x07,
-	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1b, 0x0a, 0x09, 0x74, 0x79, 0x70, 0x65, 0x5f,
-	0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x74, 0x79, 0x70, 0x65,
-	0x4e, 0x61, 0x6d, 0x65, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x02, 0x69, 0x64, 0x1a, 0x78, 0x0a, 0x10, 0x49, 0x6d, 0x70, 0x6f, 0x72, 0x74, 0x65, 0x64,
-	0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x12, 0x1b, 0x0a, 0x09, 0x74, 0x79, 0x70, 0x65,
-	0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x74, 0x79, 0x70,
-	0x65, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x2d, 0x0a, 0x05, 0x73, 0x74, 0x61, 0x74, 0x65, 0x18, 0x02,
+	0x75, 0x65, 0x52, 0x10, 0x70, 0x72, 0x6f, 0x70, 0x6f, 0x73, 0x65, 0x64, 0x4e, 0x65, 0x77, 0x53,
+	0x74, 0x61, 0x74, 0x65, 0x12, 0x2f, 0x0a, 0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x04,
 	0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x36,
-	0x2e, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x05, 0x73,
-	0x74, 0x61, 0x74, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x18,
-	0x03, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x07, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x1a, 0xa3,
-	0x01, 0x0a, 0x08, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x5e, 0x0a, 0x12, 0x69,
-	0x6d, 0x70, 0x6f, 0x72, 0x74, 0x65, 0x64, 0x5f, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
-	0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x2f, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67,
-	0x69, 0x6e, 0x36, 0x2e, 0x49, 0x6d, 0x70, 0x6f, 0x72, 0x74, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72,
-	0x63, 0x65, 0x53, 0x74, 0x61, 0x74, 0x65, 0x2e, 0x49, 0x6d, 0x70, 0x6f, 0x72, 0x74, 0x65, 0x64,
-	0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x11, 0x69, 0x6d, 0x70, 0x6f, 0x72, 0x74,
-	0x65, 0x64, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x12, 0x37, 0x0a, 0x0b, 0x64,
-	0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b,
-	0x32, 0x15, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x36, 0x2e, 0x44, 0x69, 0x61,
-	0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x52, 0x0b, 0x64, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73,
-	0x74, 0x69, 0x63, 0x73, 0x22, 0x9c, 0x02, 0x0a, 0x0e, 0x52, 0x65, 0x61, 0x64, 0x44, 0x61, 0x74,
-	0x61, 0x53, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x1a, 0x95, 0x01, 0x0a, 0x07, 0x52, 0x65, 0x71, 0x75,
-	0x65, 0x73, 0x74, 0x12, 0x1b, 0x0a, 0x09, 0x74, 0x79, 0x70, 0x65, 0x5f, 0x6e, 0x61, 0x6d, 0x65,
-	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x74, 0x79, 0x70, 0x65, 0x4e, 0x61, 0x6d, 0x65,
-	0x12, 0x2f, 0x0a, 0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b,
-	0x32, 0x17, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x36, 0x2e, 0x44, 0x79, 0x6e,
-	0x61, 0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69,
-	0x67, 0x12, 0x3c, 0x0a, 0x0d, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x5f, 0x6d, 0x65,
-	0x74, 0x61, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75,
-	0x67, 0x69, 0x6e, 0x36, 0x2e, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c, 0x75,
-	0x65, 0x52, 0x0c, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x4d, 0x65, 0x74, 0x61, 0x1a,
-	0x72, 0x0a, 0x08, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x2d, 0x0a, 0x05, 0x73,
-	0x74, 0x61, 0x74, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x74, 0x66, 0x70,
+	0x2e, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x06, 0x63,
+	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x23, 0x0a, 0x0d, 0x70, 0x72, 0x69, 0x6f, 0x72, 0x5f, 0x70,
+	0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x0c, 0x70, 0x72,
+	0x69, 0x6f, 0x72, 0x50, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x12, 0x3c, 0x0a, 0x0d, 0x70, 0x72,
+	0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x5f, 0x6d, 0x65, 0x74, 0x61, 0x18, 0x06, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x17, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x36, 0x2e, 0x44, 0x79,
+	0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x0c, 0x70, 0x72, 0x6f, 0x76,
+	0x69, 0x64, 0x65, 0x72, 0x4d, 0x65, 0x74, 0x61, 0x1a, 0x9d, 0x02, 0x0a, 0x08, 0x52, 0x65, 0x73,
+	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x3c, 0x0a, 0x0d, 0x70, 0x6c, 0x61, 0x6e, 0x6e, 0x65, 0x64,
+	0x5f, 0x73, 0x74, 0x61, 0x74, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x74,
+	0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x36, 0x2e, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63,
+	0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x0c, 0x70, 0x6c, 0x61, 0x6e, 0x6e, 0x65, 0x64, 0x53, 0x74,
+	0x61, 0x74, 0x65, 0x12, 0x43, 0x0a, 0x10, 0x72, 0x65, 0x71, 0x75, 0x69, 0x72, 0x65, 0x73, 0x5f,
+	0x72, 0x65, 0x70, 0x6c, 0x61, 0x63, 0x65, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x18, 0x2e,
+	0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x36, 0x2e, 0x41, 0x74, 0x74, 0x72, 0x69, 0x62,
+	0x75, 0x74, 0x65, 0x50, 0x61, 0x74, 0x68, 0x52, 0x0f, 0x72, 0x65, 0x71, 0x75, 0x69, 0x72, 0x65,
+	0x73, 0x52, 0x65, 0x70, 0x6c, 0x61, 0x63, 0x65, 0x12, 0x27, 0x0a, 0x0f, 0x70, 0x6c, 0x61, 0x6e,
+	0x6e, 0x65, 0x64, 0x5f, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28,
+	0x0c, 0x52, 0x0e, 0x70, 0x6c, 0x61, 0x6e, 0x6e, 0x65, 0x64, 0x50, 0x72, 0x69, 0x76, 0x61, 0x74,
+	0x65, 0x12, 0x37, 0x0a, 0x0b, 0x64, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x73,
+	0x18, 0x04, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69,
+	0x6e, 0x36, 0x2e, 0x44, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x52, 0x0b, 0x64,
+	0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x73, 0x12, 0x2c, 0x0a, 0x12, 0x6c, 0x65,
+	0x67, 0x61, 0x63, 0x79, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x5f, 0x73, 0x79, 0x73, 0x74, 0x65, 0x6d,
+	0x18, 0x05, 0x20, 0x01, 0x28, 0x08, 0x52, 0x10, 0x6c, 0x65, 0x67, 0x61, 0x63, 0x79, 0x54, 0x79,
+	0x70, 0x65, 0x53, 0x79, 0x73, 0x74, 0x65, 0x6d, 0x22, 0x92, 0x04, 0x0a, 0x13, 0x41, 0x70, 0x70,
+	0x6c, 0x79, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x43, 0x68, 0x61, 0x6e, 0x67, 0x65,
+	0x1a, 0xb6, 0x02, 0x0a, 0x07, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1b, 0x0a, 0x09,
+	0x74, 0x79, 0x70, 0x65, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x08, 0x74, 0x79, 0x70, 0x65, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x38, 0x0a, 0x0b, 0x70, 0x72, 0x69,
+	0x6f, 0x72, 0x5f, 0x73, 0x74, 0x61, 0x74, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17,
+	0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x36, 0x2e, 0x44, 0x79, 0x6e, 0x61, 0x6d,
+	0x69, 0x63, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x0a, 0x70, 0x72, 0x69, 0x6f, 0x72, 0x53, 0x74,
+	0x61, 0x74, 0x65, 0x12, 0x3c, 0x0a, 0x0d, 0x70, 0x6c, 0x61, 0x6e, 0x6e, 0x65, 0x64, 0x5f, 0x73,
+	0x74, 0x61, 0x74, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x74, 0x66, 0x70,
 	0x6c, 0x75, 0x67, 0x69, 0x6e, 0x36, 0x2e, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56, 0x61,
-	0x6c, 0x75, 0x65, 0x52, 0x05, 0x73, 0x74, 0x61, 0x74, 0x65, 0x12, 0x37, 0x0a, 0x0b, 0x64, 0x69,
-	0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32,
-	0x15, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x36, 0x2e, 0x44, 0x69, 0x61, 0x67,
-	0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x52, 0x0b, 0x64, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74,
-	0x69, 0x63, 0x73, 0x2a, 0x25, 0x0a, 0x0a, 0x53, 0x74, 0x72, 0x69, 0x6e, 0x67, 0x4b, 0x69, 0x6e,
-	0x64, 0x12, 0x09, 0x0a, 0x05, 0x50, 0x4c, 0x41, 0x49, 0x4e, 0x10, 0x00, 0x12, 0x0c, 0x0a, 0x08,
-	0x4d, 0x41, 0x52, 0x4b, 0x44, 0x4f, 0x57, 0x4e, 0x10, 0x01, 0x32, 0xcc, 0x09, 0x0a, 0x08, 0x50,
-	0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x12, 0x60, 0x0a, 0x11, 0x47, 0x65, 0x74, 0x50, 0x72,
-	0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x53, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x12, 0x24, 0x2e, 0x74,
-	0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x36, 0x2e, 0x47, 0x65, 0x74, 0x50, 0x72, 0x6f, 0x76,
-	0x69, 0x64, 0x65, 0x72, 0x53, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x2e, 0x52, 0x65, 0x71, 0x75, 0x65,
-	0x73, 0x74, 0x1a, 0x25, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x36, 0x2e, 0x47,
-	0x65, 0x74, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x53, 0x63, 0x68, 0x65, 0x6d, 0x61,
-	0x2e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x6f, 0x0a, 0x16, 0x56, 0x61, 0x6c,
-	0x69, 0x64, 0x61, 0x74, 0x65, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x43, 0x6f, 0x6e,
-	0x66, 0x69, 0x67, 0x12, 0x29, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x36, 0x2e,
-	0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72,
-	0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x2a,
-	0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x36, 0x2e, 0x56, 0x61, 0x6c, 0x69, 0x64,
-	0x61, 0x74, 0x65, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69,
-	0x67, 0x2e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x6f, 0x0a, 0x16, 0x56, 0x61,
-	0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x43, 0x6f,
-	0x6e, 0x66, 0x69, 0x67, 0x12, 0x29, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x36,
-	0x2e, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
-	0x65, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a,
-	0x2a, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x36, 0x2e, 0x56, 0x61, 0x6c, 0x69,
-	0x64, 0x61, 0x74, 0x65, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x43, 0x6f, 0x6e, 0x66,
-	0x69, 0x67, 0x2e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x7b, 0x0a, 0x1a, 0x56,
+	0x6c, 0x75, 0x65, 0x52, 0x0c, 0x70, 0x6c, 0x61, 0x6e, 0x6e, 0x65, 0x64, 0x53, 0x74, 0x61, 0x74,
+	0x65, 0x12, 0x2f, 0x0a, 0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x04, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x17, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x36, 0x2e, 0x44, 0x79,
+	0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x06, 0x63, 0x6f, 0x6e, 0x66,
+	0x69, 0x67, 0x12, 0x27, 0x0a, 0x0f, 0x70, 0x6c, 0x61, 0x6e, 0x6e, 0x65, 0x64, 0x5f, 0x70, 0x72,
+	0x69, 0x76, 0x61, 0x74, 0x65, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x0e, 0x70, 0x6c, 0x61,
+	0x6e, 0x6e, 0x65, 0x64, 0x50, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x12, 0x3c, 0x0a, 0x0d, 0x70,
+	0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x5f, 0x6d, 0x65, 0x74, 0x61, 0x18, 0x06, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x17, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x36, 0x2e, 0x44,
+	0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x0c, 0x70, 0x72, 0x6f,
+	0x76, 0x69, 0x64, 0x65, 0x72, 0x4d, 0x65, 0x74, 0x61, 0x1a, 0xc1, 0x01, 0x0a, 0x08, 0x52, 0x65,
+	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x34, 0x0a, 0x09, 0x6e, 0x65, 0x77, 0x5f, 0x73, 0x74,
+	0x61, 0x74, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x74, 0x66, 0x70, 0x6c,
+	0x75, 0x67, 0x69, 0x6e, 0x36, 0x2e, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c,
+	0x75, 0x65, 0x52, 0x08, 0x6e, 0x65, 0x77, 0x53, 0x74, 0x61, 0x74, 0x65, 0x12, 0x18, 0x0a, 0x07,
+	0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x07, 0x70,
+	0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x12, 0x37, 0x0a, 0x0b, 0x64, 0x69, 0x61, 0x67, 0x6e, 0x6f,
+	0x73, 0x74, 0x69, 0x63, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x74, 0x66,
+	0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x36, 0x2e, 0x44, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74,
+	0x69, 0x63, 0x52, 0x0b, 0x64, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x73, 0x12,
+	0x2c, 0x0a, 0x12, 0x6c, 0x65, 0x67, 0x61, 0x63, 0x79, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x5f, 0x73,
+	0x79, 0x73, 0x74, 0x65, 0x6d, 0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x52, 0x10, 0x6c, 0x65, 0x67,
+	0x61, 0x63, 0x79, 0x54, 0x79, 0x70, 0x65, 0x53, 0x79, 0x73, 0x74, 0x65, 0x6d, 0x22, 0xed, 0x02,
+	0x0a, 0x13, 0x49, 0x6d, 0x70, 0x6f, 0x72, 0x74, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
+	0x53, 0x74, 0x61, 0x74, 0x65, 0x1a, 0x36, 0x0a, 0x07, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
+	0x12, 0x1b, 0x0a, 0x09, 0x74, 0x79, 0x70, 0x65, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x08, 0x74, 0x79, 0x70, 0x65, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x0e, 0x0a,
+	0x02, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x1a, 0x78, 0x0a,
+	0x10, 0x49, 0x6d, 0x70, 0x6f, 0x72, 0x74, 0x65, 0x64, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
+	0x65, 0x12, 0x1b, 0x0a, 0x09, 0x74, 0x79, 0x70, 0x65, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x74, 0x79, 0x70, 0x65, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x2d,
+	0x0a, 0x05, 0x73, 0x74, 0x61, 0x74, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e,
+	0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x36, 0x2e, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69,
+	0x63, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x05, 0x73, 0x74, 0x61, 0x74, 0x65, 0x12, 0x18, 0x0a,
+	0x07, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x07,
+	0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x1a, 0xa3, 0x01, 0x0a, 0x08, 0x52, 0x65, 0x73, 0x70,
+	0x6f, 0x6e, 0x73, 0x65, 0x12, 0x5e, 0x0a, 0x12, 0x69, 0x6d, 0x70, 0x6f, 0x72, 0x74, 0x65, 0x64,
+	0x5f, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b,
+	0x32, 0x2f, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x36, 0x2e, 0x49, 0x6d, 0x70,
+	0x6f, 0x72, 0x74, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x53, 0x74, 0x61, 0x74, 0x65,
+	0x2e, 0x49, 0x6d, 0x70, 0x6f, 0x72, 0x74, 0x65, 0x64, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
+	0x65, 0x52, 0x11, 0x69, 0x6d, 0x70, 0x6f, 0x72, 0x74, 0x65, 0x64, 0x52, 0x65, 0x73, 0x6f, 0x75,
+	0x72, 0x63, 0x65, 0x73, 0x12, 0x37, 0x0a, 0x0b, 0x64, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74,
+	0x69, 0x63, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x74, 0x66, 0x70, 0x6c,
+	0x75, 0x67, 0x69, 0x6e, 0x36, 0x2e, 0x44, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63,
+	0x52, 0x0b, 0x64, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x73, 0x22, 0x9c, 0x02,
+	0x0a, 0x0e, 0x52, 0x65, 0x61, 0x64, 0x44, 0x61, 0x74, 0x61, 0x53, 0x6f, 0x75, 0x72, 0x63, 0x65,
+	0x1a, 0x95, 0x01, 0x0a, 0x07, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1b, 0x0a, 0x09,
+	0x74, 0x79, 0x70, 0x65, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x08, 0x74, 0x79, 0x70, 0x65, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x2f, 0x0a, 0x06, 0x63, 0x6f, 0x6e,
+	0x66, 0x69, 0x67, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x74, 0x66, 0x70, 0x6c,
+	0x75, 0x67, 0x69, 0x6e, 0x36, 0x2e, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c,
+	0x75, 0x65, 0x52, 0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x3c, 0x0a, 0x0d, 0x70, 0x72,
+	0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x5f, 0x6d, 0x65, 0x74, 0x61, 0x18, 0x03, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x17, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x36, 0x2e, 0x44, 0x79,
+	0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x0c, 0x70, 0x72, 0x6f, 0x76,
+	0x69, 0x64, 0x65, 0x72, 0x4d, 0x65, 0x74, 0x61, 0x1a, 0x72, 0x0a, 0x08, 0x52, 0x65, 0x73, 0x70,
+	0x6f, 0x6e, 0x73, 0x65, 0x12, 0x2d, 0x0a, 0x05, 0x73, 0x74, 0x61, 0x74, 0x65, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x36, 0x2e,
+	0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x05, 0x73, 0x74,
+	0x61, 0x74, 0x65, 0x12, 0x37, 0x0a, 0x0b, 0x64, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69,
+	0x63, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75,
+	0x67, 0x69, 0x6e, 0x36, 0x2e, 0x44, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x52,
+	0x0b, 0x64, 0x69, 0x61, 0x67, 0x6e, 0x6f, 0x73, 0x74, 0x69, 0x63, 0x73, 0x2a, 0x25, 0x0a, 0x0a,
+	0x53, 0x74, 0x72, 0x69, 0x6e, 0x67, 0x4b, 0x69, 0x6e, 0x64, 0x12, 0x09, 0x0a, 0x05, 0x50, 0x4c,
+	0x41, 0x49, 0x4e, 0x10, 0x00, 0x12, 0x0c, 0x0a, 0x08, 0x4d, 0x41, 0x52, 0x4b, 0x44, 0x4f, 0x57,
+	0x4e, 0x10, 0x01, 0x32, 0x9c, 0x0a, 0x0a, 0x08, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72,
+	0x12, 0x4e, 0x0a, 0x0b, 0x47, 0x65, 0x74, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12,
+	0x1e, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x36, 0x2e, 0x47, 0x65, 0x74, 0x4d,
+	0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x2e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a,
+	0x1f, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x36, 0x2e, 0x47, 0x65, 0x74, 0x4d,
+	0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x2e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
+	0x12, 0x60, 0x0a, 0x11, 0x47, 0x65, 0x74, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x53,
+	0x63, 0x68, 0x65, 0x6d, 0x61, 0x12, 0x24, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e,
+	0x36, 0x2e, 0x47, 0x65, 0x74, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x53, 0x63, 0x68,
+	0x65, 0x6d, 0x61, 0x2e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x25, 0x2e, 0x74, 0x66,
+	0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x36, 0x2e, 0x47, 0x65, 0x74, 0x50, 0x72, 0x6f, 0x76, 0x69,
+	0x64, 0x65, 0x72, 0x53, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x2e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
+	0x73, 0x65, 0x12, 0x6f, 0x0a, 0x16, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x50, 0x72,
+	0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x29, 0x2e, 0x74,
+	0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x36, 0x2e, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74,
+	0x65, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e,
+	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x2a, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67,
+	0x69, 0x6e, 0x36, 0x2e, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x50, 0x72, 0x6f, 0x76,
+	0x69, 0x64, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e, 0x52, 0x65, 0x73, 0x70, 0x6f,
+	0x6e, 0x73, 0x65, 0x12, 0x6f, 0x0a, 0x16, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x52,
+	0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x29, 0x2e,
+	0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x36, 0x2e, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61,
+	0x74, 0x65, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67,
+	0x2e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x2a, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75,
+	0x67, 0x69, 0x6e, 0x36, 0x2e, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x52, 0x65, 0x73,
+	0x6f, 0x75, 0x72, 0x63, 0x65, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e, 0x52, 0x65, 0x73, 0x70,
+	0x6f, 0x6e, 0x73, 0x65, 0x12, 0x7b, 0x0a, 0x1a, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65,
+	0x44, 0x61, 0x74, 0x61, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x43, 0x6f, 0x6e, 0x66,
+	0x69, 0x67, 0x12, 0x2d, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x36, 0x2e, 0x56,
 	0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x44, 0x61, 0x74, 0x61, 0x52, 0x65, 0x73, 0x6f, 0x75,
-	0x72, 0x63, 0x65, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x2d, 0x2e, 0x74, 0x66, 0x70, 0x6c,
-	0x75, 0x67, 0x69, 0x6e, 0x36, 0x2e, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x44, 0x61,
-	0x74, 0x61, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67,
-	0x2e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x2e, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75,
-	0x67, 0x69, 0x6e, 0x36, 0x2e, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x44, 0x61, 0x74,
-	0x61, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e,
-	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x69, 0x0a, 0x14, 0x55, 0x70, 0x67, 0x72,
-	0x61, 0x64, 0x65, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x53, 0x74, 0x61, 0x74, 0x65,
-	0x12, 0x27, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x36, 0x2e, 0x55, 0x70, 0x67,
-	0x72, 0x61, 0x64, 0x65, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x53, 0x74, 0x61, 0x74,
-	0x65, 0x2e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x28, 0x2e, 0x74, 0x66, 0x70, 0x6c,
+	0x72, 0x63, 0x65, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
+	0x74, 0x1a, 0x2e, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x36, 0x2e, 0x56, 0x61,
+	0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x44, 0x61, 0x74, 0x61, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72,
+	0x63, 0x65, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
+	0x65, 0x12, 0x69, 0x0a, 0x14, 0x55, 0x70, 0x67, 0x72, 0x61, 0x64, 0x65, 0x52, 0x65, 0x73, 0x6f,
+	0x75, 0x72, 0x63, 0x65, 0x53, 0x74, 0x61, 0x74, 0x65, 0x12, 0x27, 0x2e, 0x74, 0x66, 0x70, 0x6c,
 	0x75, 0x67, 0x69, 0x6e, 0x36, 0x2e, 0x55, 0x70, 0x67, 0x72, 0x61, 0x64, 0x65, 0x52, 0x65, 0x73,
-	0x6f, 0x75, 0x72, 0x63, 0x65, 0x53, 0x74, 0x61, 0x74, 0x65, 0x2e, 0x52, 0x65, 0x73, 0x70, 0x6f,
-	0x6e, 0x73, 0x65, 0x12, 0x60, 0x0a, 0x11, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x75, 0x72, 0x65,
-	0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x12, 0x24, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75,
-	0x67, 0x69, 0x6e, 0x36, 0x2e, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x75, 0x72, 0x65, 0x50, 0x72,
-	0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x2e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x25,
-	0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x36, 0x2e, 0x43, 0x6f, 0x6e, 0x66, 0x69,
-	0x67, 0x75, 0x72, 0x65, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x2e, 0x52, 0x65, 0x73,
-	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x51, 0x0a, 0x0c, 0x52, 0x65, 0x61, 0x64, 0x52, 0x65, 0x73,
-	0x6f, 0x75, 0x72, 0x63, 0x65, 0x12, 0x1f, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e,
-	0x36, 0x2e, 0x52, 0x65, 0x61, 0x64, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x52,
-	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x20, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69,
-	0x6e, 0x36, 0x2e, 0x52, 0x65, 0x61, 0x64, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e,
-	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x63, 0x0a, 0x12, 0x50, 0x6c, 0x61, 0x6e,
-	0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x43, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x12, 0x25,
+	0x6f, 0x75, 0x72, 0x63, 0x65, 0x53, 0x74, 0x61, 0x74, 0x65, 0x2e, 0x52, 0x65, 0x71, 0x75, 0x65,
+	0x73, 0x74, 0x1a, 0x28, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x36, 0x2e, 0x55,
+	0x70, 0x67, 0x72, 0x61, 0x64, 0x65, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x53, 0x74,
+	0x61, 0x74, 0x65, 0x2e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x60, 0x0a, 0x11,
+	0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x75, 0x72, 0x65, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65,
+	0x72, 0x12, 0x24, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x36, 0x2e, 0x43, 0x6f,
+	0x6e, 0x66, 0x69, 0x67, 0x75, 0x72, 0x65, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x2e,
+	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x25, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67,
+	0x69, 0x6e, 0x36, 0x2e, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x75, 0x72, 0x65, 0x50, 0x72, 0x6f,
+	0x76, 0x69, 0x64, 0x65, 0x72, 0x2e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x51,
+	0x0a, 0x0c, 0x52, 0x65, 0x61, 0x64, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x12, 0x1f,
+	0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x36, 0x2e, 0x52, 0x65, 0x61, 0x64, 0x52,
+	0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a,
+	0x20, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x36, 0x2e, 0x52, 0x65, 0x61, 0x64,
+	0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
+	0x65, 0x12, 0x63, 0x0a, 0x12, 0x50, 0x6c, 0x61, 0x6e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
+	0x65, 0x43, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x12, 0x25, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67,
+	0x69, 0x6e, 0x36, 0x2e, 0x50, 0x6c, 0x61, 0x6e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
+	0x43, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x2e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x26,
 	0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x36, 0x2e, 0x50, 0x6c, 0x61, 0x6e, 0x52,
 	0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x43, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x2e, 0x52, 0x65,
-	0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x26, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e,
-	0x36, 0x2e, 0x50, 0x6c, 0x61, 0x6e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x43, 0x68,
-	0x61, 0x6e, 0x67, 0x65, 0x2e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x66, 0x0a,
-	0x13, 0x41, 0x70, 0x70, 0x6c, 0x79, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x43, 0x68,
-	0x61, 0x6e, 0x67, 0x65, 0x12, 0x26, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x36,
-	0x2e, 0x41, 0x70, 0x70, 0x6c, 0x79, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x43, 0x68,
-	0x61, 0x6e, 0x67, 0x65, 0x2e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x27, 0x2e, 0x74,
-	0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x36, 0x2e, 0x41, 0x70, 0x70, 0x6c, 0x79, 0x52, 0x65,
-	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x43, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x2e, 0x52, 0x65, 0x73,
-	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x66, 0x0a, 0x13, 0x49, 0x6d, 0x70, 0x6f, 0x72, 0x74, 0x52,
-	0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x53, 0x74, 0x61, 0x74, 0x65, 0x12, 0x26, 0x2e, 0x74,
-	0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x36, 0x2e, 0x49, 0x6d, 0x70, 0x6f, 0x72, 0x74, 0x52,
-	0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x53, 0x74, 0x61, 0x74, 0x65, 0x2e, 0x52, 0x65, 0x71,
-	0x75, 0x65, 0x73, 0x74, 0x1a, 0x27, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x36,
-	0x2e, 0x49, 0x6d, 0x70, 0x6f, 0x72, 0x74, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x53,
-	0x74, 0x61, 0x74, 0x65, 0x2e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x57, 0x0a,
-	0x0e, 0x52, 0x65, 0x61, 0x64, 0x44, 0x61, 0x74, 0x61, 0x53, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x12,
-	0x21, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x36, 0x2e, 0x52, 0x65, 0x61, 0x64,
-	0x44, 0x61, 0x74, 0x61, 0x53, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x52, 0x65, 0x71, 0x75, 0x65,
-	0x73, 0x74, 0x1a, 0x22, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x36, 0x2e, 0x52,
-	0x65, 0x61, 0x64, 0x44, 0x61, 0x74, 0x61, 0x53, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x52, 0x65,
-	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x51, 0x0a, 0x0c, 0x53, 0x74, 0x6f, 0x70, 0x50, 0x72,
-	0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x12, 0x1f, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69,
-	0x6e, 0x36, 0x2e, 0x53, 0x74, 0x6f, 0x70, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x2e,
-	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x20, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67,
-	0x69, 0x6e, 0x36, 0x2e, 0x53, 0x74, 0x6f, 0x70, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72,
-	0x2e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x42, 0x47, 0x5a, 0x45, 0x67, 0x69, 0x74,
-	0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72,
-	0x70, 0x2f, 0x74, 0x65, 0x72, 0x72, 0x61, 0x66, 0x6f, 0x72, 0x6d, 0x2d, 0x70, 0x6c, 0x75, 0x67,
-	0x69, 0x6e, 0x2d, 0x67, 0x6f, 0x2f, 0x74, 0x66, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x76, 0x36, 0x2f,
-	0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2f, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69,
-	0x6e, 0x36, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x66, 0x0a, 0x13, 0x41, 0x70, 0x70, 0x6c, 0x79, 0x52,
+	0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x43, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x12, 0x26, 0x2e,
+	0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x36, 0x2e, 0x41, 0x70, 0x70, 0x6c, 0x79, 0x52,
+	0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x43, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x2e, 0x52, 0x65,
+	0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x27, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e,
+	0x36, 0x2e, 0x41, 0x70, 0x70, 0x6c, 0x79, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x43,
+	0x68, 0x61, 0x6e, 0x67, 0x65, 0x2e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x66,
+	0x0a, 0x13, 0x49, 0x6d, 0x70, 0x6f, 0x72, 0x74, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
+	0x53, 0x74, 0x61, 0x74, 0x65, 0x12, 0x26, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e,
+	0x36, 0x2e, 0x49, 0x6d, 0x70, 0x6f, 0x72, 0x74, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
+	0x53, 0x74, 0x61, 0x74, 0x65, 0x2e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x27, 0x2e,
+	0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x36, 0x2e, 0x49, 0x6d, 0x70, 0x6f, 0x72, 0x74,
+	0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x53, 0x74, 0x61, 0x74, 0x65, 0x2e, 0x52, 0x65,
+	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x57, 0x0a, 0x0e, 0x52, 0x65, 0x61, 0x64, 0x44, 0x61,
+	0x74, 0x61, 0x53, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x12, 0x21, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75,
+	0x67, 0x69, 0x6e, 0x36, 0x2e, 0x52, 0x65, 0x61, 0x64, 0x44, 0x61, 0x74, 0x61, 0x53, 0x6f, 0x75,
+	0x72, 0x63, 0x65, 0x2e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x22, 0x2e, 0x74, 0x66,
+	0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x36, 0x2e, 0x52, 0x65, 0x61, 0x64, 0x44, 0x61, 0x74, 0x61,
+	0x53, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12,
+	0x51, 0x0a, 0x0c, 0x53, 0x74, 0x6f, 0x70, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x12,
+	0x1f, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x36, 0x2e, 0x53, 0x74, 0x6f, 0x70,
+	0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x2e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
+	0x1a, 0x20, 0x2e, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x36, 0x2e, 0x53, 0x74, 0x6f,
+	0x70, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x2e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
+	0x73, 0x65, 0x42, 0x47, 0x5a, 0x45, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d,
+	0x2f, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, 0x74, 0x65, 0x72, 0x72, 0x61,
+	0x66, 0x6f, 0x72, 0x6d, 0x2d, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x2d, 0x67, 0x6f, 0x2f, 0x74,
+	0x66, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x76, 0x36, 0x2f, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61,
+	0x6c, 0x2f, 0x74, 0x66, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x36, 0x62, 0x06, 0x70, 0x72, 0x6f,
+	0x74, 0x6f, 0x33,
 }
 
 var (
@@ -3515,7 +3807,7 @@ func file_tfplugin6_proto_rawDescGZIP() []byte {
 }
 
 var file_tfplugin6_proto_enumTypes = make([]protoimpl.EnumInfo, 4)
-var file_tfplugin6_proto_msgTypes = make([]protoimpl.MessageInfo, 51)
+var file_tfplugin6_proto_msgTypes = make([]protoimpl.MessageInfo, 56)
 var file_tfplugin6_proto_goTypes = []interface{}{
 	(StringKind)(0),                              // 0: tfplugin6.StringKind
 	(Diagnostic_Severity)(0),                     // 1: tfplugin6.Diagnostic.Severity
@@ -3527,139 +3819,150 @@ var file_tfplugin6_proto_goTypes = []interface{}{
 	(*StopProvider)(nil),                         // 7: tfplugin6.StopProvider
 	(*RawState)(nil),                             // 8: tfplugin6.RawState
 	(*Schema)(nil),                               // 9: tfplugin6.Schema
-	(*GetProviderSchema)(nil),                    // 10: tfplugin6.GetProviderSchema
-	(*ValidateProviderConfig)(nil),               // 11: tfplugin6.ValidateProviderConfig
-	(*UpgradeResourceState)(nil),                 // 12: tfplugin6.UpgradeResourceState
-	(*ValidateResourceConfig)(nil),               // 13: tfplugin6.ValidateResourceConfig
-	(*ValidateDataResourceConfig)(nil),           // 14: tfplugin6.ValidateDataResourceConfig
-	(*ConfigureProvider)(nil),                    // 15: tfplugin6.ConfigureProvider
-	(*ReadResource)(nil),                         // 16: tfplugin6.ReadResource
-	(*PlanResourceChange)(nil),                   // 17: tfplugin6.PlanResourceChange
-	(*ApplyResourceChange)(nil),                  // 18: tfplugin6.ApplyResourceChange
-	(*ImportResourceState)(nil),                  // 19: tfplugin6.ImportResourceState
-	(*ReadDataSource)(nil),                       // 20: tfplugin6.ReadDataSource
-	(*AttributePath_Step)(nil),                   // 21: tfplugin6.AttributePath.Step
-	(*StopProvider_Request)(nil),                 // 22: tfplugin6.StopProvider.Request
-	(*StopProvider_Response)(nil),                // 23: tfplugin6.StopProvider.Response
-	nil,                                          // 24: tfplugin6.RawState.FlatmapEntry
-	(*Schema_Block)(nil),                         // 25: tfplugin6.Schema.Block
-	(*Schema_Attribute)(nil),                     // 26: tfplugin6.Schema.Attribute
-	(*Schema_NestedBlock)(nil),                   // 27: tfplugin6.Schema.NestedBlock
-	(*Schema_Object)(nil),                        // 28: tfplugin6.Schema.Object
-	(*GetProviderSchema_Request)(nil),            // 29: tfplugin6.GetProviderSchema.Request
-	(*GetProviderSchema_Response)(nil),           // 30: tfplugin6.GetProviderSchema.Response
-	(*GetProviderSchema_ServerCapabilities)(nil), // 31: tfplugin6.GetProviderSchema.ServerCapabilities
-	nil,                                          // 32: tfplugin6.GetProviderSchema.Response.ResourceSchemasEntry
-	nil,                                          // 33: tfplugin6.GetProviderSchema.Response.DataSourceSchemasEntry
-	(*ValidateProviderConfig_Request)(nil),       // 34: tfplugin6.ValidateProviderConfig.Request
-	(*ValidateProviderConfig_Response)(nil),      // 35: tfplugin6.ValidateProviderConfig.Response
-	(*UpgradeResourceState_Request)(nil),         // 36: tfplugin6.UpgradeResourceState.Request
-	(*UpgradeResourceState_Response)(nil),        // 37: tfplugin6.UpgradeResourceState.Response
-	(*ValidateResourceConfig_Request)(nil),       // 38: tfplugin6.ValidateResourceConfig.Request
-	(*ValidateResourceConfig_Response)(nil),      // 39: tfplugin6.ValidateResourceConfig.Response
-	(*ValidateDataResourceConfig_Request)(nil),   // 40: tfplugin6.ValidateDataResourceConfig.Request
-	(*ValidateDataResourceConfig_Response)(nil),  // 41: tfplugin6.ValidateDataResourceConfig.Response
-	(*ConfigureProvider_Request)(nil),            // 42: tfplugin6.ConfigureProvider.Request
-	(*ConfigureProvider_Response)(nil),           // 43: tfplugin6.ConfigureProvider.Response
-	(*ReadResource_Request)(nil),                 // 44: tfplugin6.ReadResource.Request
-	(*ReadResource_Response)(nil),                // 45: tfplugin6.ReadResource.Response
-	(*PlanResourceChange_Request)(nil),           // 46: tfplugin6.PlanResourceChange.Request
-	(*PlanResourceChange_Response)(nil),          // 47: tfplugin6.PlanResourceChange.Response
-	(*ApplyResourceChange_Request)(nil),          // 48: tfplugin6.ApplyResourceChange.Request
-	(*ApplyResourceChange_Response)(nil),         // 49: tfplugin6.ApplyResourceChange.Response
-	(*ImportResourceState_Request)(nil),          // 50: tfplugin6.ImportResourceState.Request
-	(*ImportResourceState_ImportedResource)(nil), // 51: tfplugin6.ImportResourceState.ImportedResource
-	(*ImportResourceState_Response)(nil),         // 52: tfplugin6.ImportResourceState.Response
-	(*ReadDataSource_Request)(nil),               // 53: tfplugin6.ReadDataSource.Request
-	(*ReadDataSource_Response)(nil),              // 54: tfplugin6.ReadDataSource.Response
+	(*ServerCapabilities)(nil),                   // 10: tfplugin6.ServerCapabilities
+	(*GetMetadata)(nil),                          // 11: tfplugin6.GetMetadata
+	(*GetProviderSchema)(nil),                    // 12: tfplugin6.GetProviderSchema
+	(*ValidateProviderConfig)(nil),               // 13: tfplugin6.ValidateProviderConfig
+	(*UpgradeResourceState)(nil),                 // 14: tfplugin6.UpgradeResourceState
+	(*ValidateResourceConfig)(nil),               // 15: tfplugin6.ValidateResourceConfig
+	(*ValidateDataResourceConfig)(nil),           // 16: tfplugin6.ValidateDataResourceConfig
+	(*ConfigureProvider)(nil),                    // 17: tfplugin6.ConfigureProvider
+	(*ReadResource)(nil),                         // 18: tfplugin6.ReadResource
+	(*PlanResourceChange)(nil),                   // 19: tfplugin6.PlanResourceChange
+	(*ApplyResourceChange)(nil),                  // 20: tfplugin6.ApplyResourceChange
+	(*ImportResourceState)(nil),                  // 21: tfplugin6.ImportResourceState
+	(*ReadDataSource)(nil),                       // 22: tfplugin6.ReadDataSource
+	(*AttributePath_Step)(nil),                   // 23: tfplugin6.AttributePath.Step
+	(*StopProvider_Request)(nil),                 // 24: tfplugin6.StopProvider.Request
+	(*StopProvider_Response)(nil),                // 25: tfplugin6.StopProvider.Response
+	nil,                                          // 26: tfplugin6.RawState.FlatmapEntry
+	(*Schema_Block)(nil),                         // 27: tfplugin6.Schema.Block
+	(*Schema_Attribute)(nil),                     // 28: tfplugin6.Schema.Attribute
+	(*Schema_NestedBlock)(nil),                   // 29: tfplugin6.Schema.NestedBlock
+	(*Schema_Object)(nil),                        // 30: tfplugin6.Schema.Object
+	(*GetMetadata_Request)(nil),                  // 31: tfplugin6.GetMetadata.Request
+	(*GetMetadata_Response)(nil),                 // 32: tfplugin6.GetMetadata.Response
+	(*GetMetadata_DataSourceMetadata)(nil),       // 33: tfplugin6.GetMetadata.DataSourceMetadata
+	(*GetMetadata_ResourceMetadata)(nil),         // 34: tfplugin6.GetMetadata.ResourceMetadata
+	(*GetProviderSchema_Request)(nil),            // 35: tfplugin6.GetProviderSchema.Request
+	(*GetProviderSchema_Response)(nil),           // 36: tfplugin6.GetProviderSchema.Response
+	nil,                                          // 37: tfplugin6.GetProviderSchema.Response.ResourceSchemasEntry
+	nil,                                          // 38: tfplugin6.GetProviderSchema.Response.DataSourceSchemasEntry
+	(*ValidateProviderConfig_Request)(nil),       // 39: tfplugin6.ValidateProviderConfig.Request
+	(*ValidateProviderConfig_Response)(nil),      // 40: tfplugin6.ValidateProviderConfig.Response
+	(*UpgradeResourceState_Request)(nil),         // 41: tfplugin6.UpgradeResourceState.Request
+	(*UpgradeResourceState_Response)(nil),        // 42: tfplugin6.UpgradeResourceState.Response
+	(*ValidateResourceConfig_Request)(nil),       // 43: tfplugin6.ValidateResourceConfig.Request
+	(*ValidateResourceConfig_Response)(nil),      // 44: tfplugin6.ValidateResourceConfig.Response
+	(*ValidateDataResourceConfig_Request)(nil),   // 45: tfplugin6.ValidateDataResourceConfig.Request
+	(*ValidateDataResourceConfig_Response)(nil),  // 46: tfplugin6.ValidateDataResourceConfig.Response
+	(*ConfigureProvider_Request)(nil),            // 47: tfplugin6.ConfigureProvider.Request
+	(*ConfigureProvider_Response)(nil),           // 48: tfplugin6.ConfigureProvider.Response
+	(*ReadResource_Request)(nil),                 // 49: tfplugin6.ReadResource.Request
+	(*ReadResource_Response)(nil),                // 50: tfplugin6.ReadResource.Response
+	(*PlanResourceChange_Request)(nil),           // 51: tfplugin6.PlanResourceChange.Request
+	(*PlanResourceChange_Response)(nil),          // 52: tfplugin6.PlanResourceChange.Response
+	(*ApplyResourceChange_Request)(nil),          // 53: tfplugin6.ApplyResourceChange.Request
+	(*ApplyResourceChange_Response)(nil),         // 54: tfplugin6.ApplyResourceChange.Response
+	(*ImportResourceState_Request)(nil),          // 55: tfplugin6.ImportResourceState.Request
+	(*ImportResourceState_ImportedResource)(nil), // 56: tfplugin6.ImportResourceState.ImportedResource
+	(*ImportResourceState_Response)(nil),         // 57: tfplugin6.ImportResourceState.Response
+	(*ReadDataSource_Request)(nil),               // 58: tfplugin6.ReadDataSource.Request
+	(*ReadDataSource_Response)(nil),              // 59: tfplugin6.ReadDataSource.Response
 }
 var file_tfplugin6_proto_depIdxs = []int32{
 	1,  // 0: tfplugin6.Diagnostic.severity:type_name -> tfplugin6.Diagnostic.Severity
 	6,  // 1: tfplugin6.Diagnostic.attribute:type_name -> tfplugin6.AttributePath
-	21, // 2: tfplugin6.AttributePath.steps:type_name -> tfplugin6.AttributePath.Step
-	24, // 3: tfplugin6.RawState.flatmap:type_name -> tfplugin6.RawState.FlatmapEntry
-	25, // 4: tfplugin6.Schema.block:type_name -> tfplugin6.Schema.Block
-	26, // 5: tfplugin6.Schema.Block.attributes:type_name -> tfplugin6.Schema.Attribute
-	27, // 6: tfplugin6.Schema.Block.block_types:type_name -> tfplugin6.Schema.NestedBlock
+	23, // 2: tfplugin6.AttributePath.steps:type_name -> tfplugin6.AttributePath.Step
+	26, // 3: tfplugin6.RawState.flatmap:type_name -> tfplugin6.RawState.FlatmapEntry
+	27, // 4: tfplugin6.Schema.block:type_name -> tfplugin6.Schema.Block
+	28, // 5: tfplugin6.Schema.Block.attributes:type_name -> tfplugin6.Schema.Attribute
+	29, // 6: tfplugin6.Schema.Block.block_types:type_name -> tfplugin6.Schema.NestedBlock
 	0,  // 7: tfplugin6.Schema.Block.description_kind:type_name -> tfplugin6.StringKind
-	28, // 8: tfplugin6.Schema.Attribute.nested_type:type_name -> tfplugin6.Schema.Object
+	30, // 8: tfplugin6.Schema.Attribute.nested_type:type_name -> tfplugin6.Schema.Object
 	0,  // 9: tfplugin6.Schema.Attribute.description_kind:type_name -> tfplugin6.StringKind
-	25, // 10: tfplugin6.Schema.NestedBlock.block:type_name -> tfplugin6.Schema.Block
+	27, // 10: tfplugin6.Schema.NestedBlock.block:type_name -> tfplugin6.Schema.Block
 	2,  // 11: tfplugin6.Schema.NestedBlock.nesting:type_name -> tfplugin6.Schema.NestedBlock.NestingMode
-	26, // 12: tfplugin6.Schema.Object.attributes:type_name -> tfplugin6.Schema.Attribute
+	28, // 12: tfplugin6.Schema.Object.attributes:type_name -> tfplugin6.Schema.Attribute
 	3,  // 13: tfplugin6.Schema.Object.nesting:type_name -> tfplugin6.Schema.Object.NestingMode
-	9,  // 14: tfplugin6.GetProviderSchema.Response.provider:type_name -> tfplugin6.Schema
-	32, // 15: tfplugin6.GetProviderSchema.Response.resource_schemas:type_name -> tfplugin6.GetProviderSchema.Response.ResourceSchemasEntry
-	33, // 16: tfplugin6.GetProviderSchema.Response.data_source_schemas:type_name -> tfplugin6.GetProviderSchema.Response.DataSourceSchemasEntry
-	5,  // 17: tfplugin6.GetProviderSchema.Response.diagnostics:type_name -> tfplugin6.Diagnostic
-	9,  // 18: tfplugin6.GetProviderSchema.Response.provider_meta:type_name -> tfplugin6.Schema
-	31, // 19: tfplugin6.GetProviderSchema.Response.server_capabilities:type_name -> tfplugin6.GetProviderSchema.ServerCapabilities
-	9,  // 20: tfplugin6.GetProviderSchema.Response.ResourceSchemasEntry.value:type_name -> tfplugin6.Schema
-	9,  // 21: tfplugin6.GetProviderSchema.Response.DataSourceSchemasEntry.value:type_name -> tfplugin6.Schema
-	4,  // 22: tfplugin6.ValidateProviderConfig.Request.config:type_name -> tfplugin6.DynamicValue
-	5,  // 23: tfplugin6.ValidateProviderConfig.Response.diagnostics:type_name -> tfplugin6.Diagnostic
-	8,  // 24: tfplugin6.UpgradeResourceState.Request.raw_state:type_name -> tfplugin6.RawState
-	4,  // 25: tfplugin6.UpgradeResourceState.Response.upgraded_state:type_name -> tfplugin6.DynamicValue
-	5,  // 26: tfplugin6.UpgradeResourceState.Response.diagnostics:type_name -> tfplugin6.Diagnostic
-	4,  // 27: tfplugin6.ValidateResourceConfig.Request.config:type_name -> tfplugin6.DynamicValue
-	5,  // 28: tfplugin6.ValidateResourceConfig.Response.diagnostics:type_name -> tfplugin6.Diagnostic
-	4,  // 29: tfplugin6.ValidateDataResourceConfig.Request.config:type_name -> tfplugin6.DynamicValue
-	5,  // 30: tfplugin6.ValidateDataResourceConfig.Response.diagnostics:type_name -> tfplugin6.Diagnostic
-	4,  // 31: tfplugin6.ConfigureProvider.Request.config:type_name -> tfplugin6.DynamicValue
-	5,  // 32: tfplugin6.ConfigureProvider.Response.diagnostics:type_name -> tfplugin6.Diagnostic
-	4,  // 33: tfplugin6.ReadResource.Request.current_state:type_name -> tfplugin6.DynamicValue
-	4,  // 34: tfplugin6.ReadResource.Request.provider_meta:type_name -> tfplugin6.DynamicValue
-	4,  // 35: tfplugin6.ReadResource.Response.new_state:type_name -> tfplugin6.DynamicValue
-	5,  // 36: tfplugin6.ReadResource.Response.diagnostics:type_name -> tfplugin6.Diagnostic
-	4,  // 37: tfplugin6.PlanResourceChange.Request.prior_state:type_name -> tfplugin6.DynamicValue
-	4,  // 38: tfplugin6.PlanResourceChange.Request.proposed_new_state:type_name -> tfplugin6.DynamicValue
-	4,  // 39: tfplugin6.PlanResourceChange.Request.config:type_name -> tfplugin6.DynamicValue
-	4,  // 40: tfplugin6.PlanResourceChange.Request.provider_meta:type_name -> tfplugin6.DynamicValue
-	4,  // 41: tfplugin6.PlanResourceChange.Response.planned_state:type_name -> tfplugin6.DynamicValue
-	6,  // 42: tfplugin6.PlanResourceChange.Response.requires_replace:type_name -> tfplugin6.AttributePath
-	5,  // 43: tfplugin6.PlanResourceChange.Response.diagnostics:type_name -> tfplugin6.Diagnostic
-	4,  // 44: tfplugin6.ApplyResourceChange.Request.prior_state:type_name -> tfplugin6.DynamicValue
-	4,  // 45: tfplugin6.ApplyResourceChange.Request.planned_state:type_name -> tfplugin6.DynamicValue
-	4,  // 46: tfplugin6.ApplyResourceChange.Request.config:type_name -> tfplugin6.DynamicValue
-	4,  // 47: tfplugin6.ApplyResourceChange.Request.provider_meta:type_name -> tfplugin6.DynamicValue
-	4,  // 48: tfplugin6.ApplyResourceChange.Response.new_state:type_name -> tfplugin6.DynamicValue
-	5,  // 49: tfplugin6.ApplyResourceChange.Response.diagnostics:type_name -> tfplugin6.Diagnostic
-	4,  // 50: tfplugin6.ImportResourceState.ImportedResource.state:type_name -> tfplugin6.DynamicValue
-	51, // 51: tfplugin6.ImportResourceState.Response.imported_resources:type_name -> tfplugin6.ImportResourceState.ImportedResource
-	5,  // 52: tfplugin6.ImportResourceState.Response.diagnostics:type_name -> tfplugin6.Diagnostic
-	4,  // 53: tfplugin6.ReadDataSource.Request.config:type_name -> tfplugin6.DynamicValue
-	4,  // 54: tfplugin6.ReadDataSource.Request.provider_meta:type_name -> tfplugin6.DynamicValue
-	4,  // 55: tfplugin6.ReadDataSource.Response.state:type_name -> tfplugin6.DynamicValue
-	5,  // 56: tfplugin6.ReadDataSource.Response.diagnostics:type_name -> tfplugin6.Diagnostic
-	29, // 57: tfplugin6.Provider.GetProviderSchema:input_type -> tfplugin6.GetProviderSchema.Request
-	34, // 58: tfplugin6.Provider.ValidateProviderConfig:input_type -> tfplugin6.ValidateProviderConfig.Request
-	38, // 59: tfplugin6.Provider.ValidateResourceConfig:input_type -> tfplugin6.ValidateResourceConfig.Request
-	40, // 60: tfplugin6.Provider.ValidateDataResourceConfig:input_type -> tfplugin6.ValidateDataResourceConfig.Request
-	36, // 61: tfplugin6.Provider.UpgradeResourceState:input_type -> tfplugin6.UpgradeResourceState.Request
-	42, // 62: tfplugin6.Provider.ConfigureProvider:input_type -> tfplugin6.ConfigureProvider.Request
-	44, // 63: tfplugin6.Provider.ReadResource:input_type -> tfplugin6.ReadResource.Request
-	46, // 64: tfplugin6.Provider.PlanResourceChange:input_type -> tfplugin6.PlanResourceChange.Request
-	48, // 65: tfplugin6.Provider.ApplyResourceChange:input_type -> tfplugin6.ApplyResourceChange.Request
-	50, // 66: tfplugin6.Provider.ImportResourceState:input_type -> tfplugin6.ImportResourceState.Request
-	53, // 67: tfplugin6.Provider.ReadDataSource:input_type -> tfplugin6.ReadDataSource.Request
-	22, // 68: tfplugin6.Provider.StopProvider:input_type -> tfplugin6.StopProvider.Request
-	30, // 69: tfplugin6.Provider.GetProviderSchema:output_type -> tfplugin6.GetProviderSchema.Response
-	35, // 70: tfplugin6.Provider.ValidateProviderConfig:output_type -> tfplugin6.ValidateProviderConfig.Response
-	39, // 71: tfplugin6.Provider.ValidateResourceConfig:output_type -> tfplugin6.ValidateResourceConfig.Response
-	41, // 72: tfplugin6.Provider.ValidateDataResourceConfig:output_type -> tfplugin6.ValidateDataResourceConfig.Response
-	37, // 73: tfplugin6.Provider.UpgradeResourceState:output_type -> tfplugin6.UpgradeResourceState.Response
-	43, // 74: tfplugin6.Provider.ConfigureProvider:output_type -> tfplugin6.ConfigureProvider.Response
-	45, // 75: tfplugin6.Provider.ReadResource:output_type -> tfplugin6.ReadResource.Response
-	47, // 76: tfplugin6.Provider.PlanResourceChange:output_type -> tfplugin6.PlanResourceChange.Response
-	49, // 77: tfplugin6.Provider.ApplyResourceChange:output_type -> tfplugin6.ApplyResourceChange.Response
-	52, // 78: tfplugin6.Provider.ImportResourceState:output_type -> tfplugin6.ImportResourceState.Response
-	54, // 79: tfplugin6.Provider.ReadDataSource:output_type -> tfplugin6.ReadDataSource.Response
-	23, // 80: tfplugin6.Provider.StopProvider:output_type -> tfplugin6.StopProvider.Response
-	69, // [69:81] is the sub-list for method output_type
-	57, // [57:69] is the sub-list for method input_type
-	57, // [57:57] is the sub-list for extension type_name
-	57, // [57:57] is the sub-list for extension extendee
-	0,  // [0:57] is the sub-list for field type_name
+	10, // 14: tfplugin6.GetMetadata.Response.server_capabilities:type_name -> tfplugin6.ServerCapabilities
+	5,  // 15: tfplugin6.GetMetadata.Response.diagnostics:type_name -> tfplugin6.Diagnostic
+	33, // 16: tfplugin6.GetMetadata.Response.data_sources:type_name -> tfplugin6.GetMetadata.DataSourceMetadata
+	34, // 17: tfplugin6.GetMetadata.Response.resources:type_name -> tfplugin6.GetMetadata.ResourceMetadata
+	9,  // 18: tfplugin6.GetProviderSchema.Response.provider:type_name -> tfplugin6.Schema
+	37, // 19: tfplugin6.GetProviderSchema.Response.resource_schemas:type_name -> tfplugin6.GetProviderSchema.Response.ResourceSchemasEntry
+	38, // 20: tfplugin6.GetProviderSchema.Response.data_source_schemas:type_name -> tfplugin6.GetProviderSchema.Response.DataSourceSchemasEntry
+	5,  // 21: tfplugin6.GetProviderSchema.Response.diagnostics:type_name -> tfplugin6.Diagnostic
+	9,  // 22: tfplugin6.GetProviderSchema.Response.provider_meta:type_name -> tfplugin6.Schema
+	10, // 23: tfplugin6.GetProviderSchema.Response.server_capabilities:type_name -> tfplugin6.ServerCapabilities
+	9,  // 24: tfplugin6.GetProviderSchema.Response.ResourceSchemasEntry.value:type_name -> tfplugin6.Schema
+	9,  // 25: tfplugin6.GetProviderSchema.Response.DataSourceSchemasEntry.value:type_name -> tfplugin6.Schema
+	4,  // 26: tfplugin6.ValidateProviderConfig.Request.config:type_name -> tfplugin6.DynamicValue
+	5,  // 27: tfplugin6.ValidateProviderConfig.Response.diagnostics:type_name -> tfplugin6.Diagnostic
+	8,  // 28: tfplugin6.UpgradeResourceState.Request.raw_state:type_name -> tfplugin6.RawState
+	4,  // 29: tfplugin6.UpgradeResourceState.Response.upgraded_state:type_name -> tfplugin6.DynamicValue
+	5,  // 30: tfplugin6.UpgradeResourceState.Response.diagnostics:type_name -> tfplugin6.Diagnostic
+	4,  // 31: tfplugin6.ValidateResourceConfig.Request.config:type_name -> tfplugin6.DynamicValue
+	5,  // 32: tfplugin6.ValidateResourceConfig.Response.diagnostics:type_name -> tfplugin6.Diagnostic
+	4,  // 33: tfplugin6.ValidateDataResourceConfig.Request.config:type_name -> tfplugin6.DynamicValue
+	5,  // 34: tfplugin6.ValidateDataResourceConfig.Response.diagnostics:type_name -> tfplugin6.Diagnostic
+	4,  // 35: tfplugin6.ConfigureProvider.Request.config:type_name -> tfplugin6.DynamicValue
+	5,  // 36: tfplugin6.ConfigureProvider.Response.diagnostics:type_name -> tfplugin6.Diagnostic
+	4,  // 37: tfplugin6.ReadResource.Request.current_state:type_name -> tfplugin6.DynamicValue
+	4,  // 38: tfplugin6.ReadResource.Request.provider_meta:type_name -> tfplugin6.DynamicValue
+	4,  // 39: tfplugin6.ReadResource.Response.new_state:type_name -> tfplugin6.DynamicValue
+	5,  // 40: tfplugin6.ReadResource.Response.diagnostics:type_name -> tfplugin6.Diagnostic
+	4,  // 41: tfplugin6.PlanResourceChange.Request.prior_state:type_name -> tfplugin6.DynamicValue
+	4,  // 42: tfplugin6.PlanResourceChange.Request.proposed_new_state:type_name -> tfplugin6.DynamicValue
+	4,  // 43: tfplugin6.PlanResourceChange.Request.config:type_name -> tfplugin6.DynamicValue
+	4,  // 44: tfplugin6.PlanResourceChange.Request.provider_meta:type_name -> tfplugin6.DynamicValue
+	4,  // 45: tfplugin6.PlanResourceChange.Response.planned_state:type_name -> tfplugin6.DynamicValue
+	6,  // 46: tfplugin6.PlanResourceChange.Response.requires_replace:type_name -> tfplugin6.AttributePath
+	5,  // 47: tfplugin6.PlanResourceChange.Response.diagnostics:type_name -> tfplugin6.Diagnostic
+	4,  // 48: tfplugin6.ApplyResourceChange.Request.prior_state:type_name -> tfplugin6.DynamicValue
+	4,  // 49: tfplugin6.ApplyResourceChange.Request.planned_state:type_name -> tfplugin6.DynamicValue
+	4,  // 50: tfplugin6.ApplyResourceChange.Request.config:type_name -> tfplugin6.DynamicValue
+	4,  // 51: tfplugin6.ApplyResourceChange.Request.provider_meta:type_name -> tfplugin6.DynamicValue
+	4,  // 52: tfplugin6.ApplyResourceChange.Response.new_state:type_name -> tfplugin6.DynamicValue
+	5,  // 53: tfplugin6.ApplyResourceChange.Response.diagnostics:type_name -> tfplugin6.Diagnostic
+	4,  // 54: tfplugin6.ImportResourceState.ImportedResource.state:type_name -> tfplugin6.DynamicValue
+	56, // 55: tfplugin6.ImportResourceState.Response.imported_resources:type_name -> tfplugin6.ImportResourceState.ImportedResource
+	5,  // 56: tfplugin6.ImportResourceState.Response.diagnostics:type_name -> tfplugin6.Diagnostic
+	4,  // 57: tfplugin6.ReadDataSource.Request.config:type_name -> tfplugin6.DynamicValue
+	4,  // 58: tfplugin6.ReadDataSource.Request.provider_meta:type_name -> tfplugin6.DynamicValue
+	4,  // 59: tfplugin6.ReadDataSource.Response.state:type_name -> tfplugin6.DynamicValue
+	5,  // 60: tfplugin6.ReadDataSource.Response.diagnostics:type_name -> tfplugin6.Diagnostic
+	31, // 61: tfplugin6.Provider.GetMetadata:input_type -> tfplugin6.GetMetadata.Request
+	35, // 62: tfplugin6.Provider.GetProviderSchema:input_type -> tfplugin6.GetProviderSchema.Request
+	39, // 63: tfplugin6.Provider.ValidateProviderConfig:input_type -> tfplugin6.ValidateProviderConfig.Request
+	43, // 64: tfplugin6.Provider.ValidateResourceConfig:input_type -> tfplugin6.ValidateResourceConfig.Request
+	45, // 65: tfplugin6.Provider.ValidateDataResourceConfig:input_type -> tfplugin6.ValidateDataResourceConfig.Request
+	41, // 66: tfplugin6.Provider.UpgradeResourceState:input_type -> tfplugin6.UpgradeResourceState.Request
+	47, // 67: tfplugin6.Provider.ConfigureProvider:input_type -> tfplugin6.ConfigureProvider.Request
+	49, // 68: tfplugin6.Provider.ReadResource:input_type -> tfplugin6.ReadResource.Request
+	51, // 69: tfplugin6.Provider.PlanResourceChange:input_type -> tfplugin6.PlanResourceChange.Request
+	53, // 70: tfplugin6.Provider.ApplyResourceChange:input_type -> tfplugin6.ApplyResourceChange.Request
+	55, // 71: tfplugin6.Provider.ImportResourceState:input_type -> tfplugin6.ImportResourceState.Request
+	58, // 72: tfplugin6.Provider.ReadDataSource:input_type -> tfplugin6.ReadDataSource.Request
+	24, // 73: tfplugin6.Provider.StopProvider:input_type -> tfplugin6.StopProvider.Request
+	32, // 74: tfplugin6.Provider.GetMetadata:output_type -> tfplugin6.GetMetadata.Response
+	36, // 75: tfplugin6.Provider.GetProviderSchema:output_type -> tfplugin6.GetProviderSchema.Response
+	40, // 76: tfplugin6.Provider.ValidateProviderConfig:output_type -> tfplugin6.ValidateProviderConfig.Response
+	44, // 77: tfplugin6.Provider.ValidateResourceConfig:output_type -> tfplugin6.ValidateResourceConfig.Response
+	46, // 78: tfplugin6.Provider.ValidateDataResourceConfig:output_type -> tfplugin6.ValidateDataResourceConfig.Response
+	42, // 79: tfplugin6.Provider.UpgradeResourceState:output_type -> tfplugin6.UpgradeResourceState.Response
+	48, // 80: tfplugin6.Provider.ConfigureProvider:output_type -> tfplugin6.ConfigureProvider.Response
+	50, // 81: tfplugin6.Provider.ReadResource:output_type -> tfplugin6.ReadResource.Response
+	52, // 82: tfplugin6.Provider.PlanResourceChange:output_type -> tfplugin6.PlanResourceChange.Response
+	54, // 83: tfplugin6.Provider.ApplyResourceChange:output_type -> tfplugin6.ApplyResourceChange.Response
+	57, // 84: tfplugin6.Provider.ImportResourceState:output_type -> tfplugin6.ImportResourceState.Response
+	59, // 85: tfplugin6.Provider.ReadDataSource:output_type -> tfplugin6.ReadDataSource.Response
+	25, // 86: tfplugin6.Provider.StopProvider:output_type -> tfplugin6.StopProvider.Response
+	74, // [74:87] is the sub-list for method output_type
+	61, // [61:74] is the sub-list for method input_type
+	61, // [61:61] is the sub-list for extension type_name
+	61, // [61:61] is the sub-list for extension extendee
+	0,  // [0:61] is the sub-list for field type_name
 }
 
 func init() { file_tfplugin6_proto_init() }
@@ -3741,7 +4044,7 @@ func file_tfplugin6_proto_init() {
 			}
 		}
 		file_tfplugin6_proto_msgTypes[6].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*GetProviderSchema); i {
+			switch v := v.(*ServerCapabilities); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -3753,7 +4056,7 @@ func file_tfplugin6_proto_init() {
 			}
 		}
 		file_tfplugin6_proto_msgTypes[7].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ValidateProviderConfig); i {
+			switch v := v.(*GetMetadata); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -3765,7 +4068,7 @@ func file_tfplugin6_proto_init() {
 			}
 		}
 		file_tfplugin6_proto_msgTypes[8].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*UpgradeResourceState); i {
+			switch v := v.(*GetProviderSchema); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -3777,7 +4080,7 @@ func file_tfplugin6_proto_init() {
 			}
 		}
 		file_tfplugin6_proto_msgTypes[9].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ValidateResourceConfig); i {
+			switch v := v.(*ValidateProviderConfig); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -3789,7 +4092,7 @@ func file_tfplugin6_proto_init() {
 			}
 		}
 		file_tfplugin6_proto_msgTypes[10].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ValidateDataResourceConfig); i {
+			switch v := v.(*UpgradeResourceState); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -3801,7 +4104,7 @@ func file_tfplugin6_proto_init() {
 			}
 		}
 		file_tfplugin6_proto_msgTypes[11].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ConfigureProvider); i {
+			switch v := v.(*ValidateResourceConfig); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -3813,7 +4116,7 @@ func file_tfplugin6_proto_init() {
 			}
 		}
 		file_tfplugin6_proto_msgTypes[12].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ReadResource); i {
+			switch v := v.(*ValidateDataResourceConfig); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -3825,7 +4128,7 @@ func file_tfplugin6_proto_init() {
 			}
 		}
 		file_tfplugin6_proto_msgTypes[13].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*PlanResourceChange); i {
+			switch v := v.(*ConfigureProvider); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -3837,7 +4140,7 @@ func file_tfplugin6_proto_init() {
 			}
 		}
 		file_tfplugin6_proto_msgTypes[14].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ApplyResourceChange); i {
+			switch v := v.(*ReadResource); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -3849,7 +4152,7 @@ func file_tfplugin6_proto_init() {
 			}
 		}
 		file_tfplugin6_proto_msgTypes[15].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ImportResourceState); i {
+			switch v := v.(*PlanResourceChange); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -3861,7 +4164,7 @@ func file_tfplugin6_proto_init() {
 			}
 		}
 		file_tfplugin6_proto_msgTypes[16].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ReadDataSource); i {
+			switch v := v.(*ApplyResourceChange); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -3873,7 +4176,7 @@ func file_tfplugin6_proto_init() {
 			}
 		}
 		file_tfplugin6_proto_msgTypes[17].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*AttributePath_Step); i {
+			switch v := v.(*ImportResourceState); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -3885,7 +4188,7 @@ func file_tfplugin6_proto_init() {
 			}
 		}
 		file_tfplugin6_proto_msgTypes[18].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*StopProvider_Request); i {
+			switch v := v.(*ReadDataSource); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -3897,7 +4200,7 @@ func file_tfplugin6_proto_init() {
 			}
 		}
 		file_tfplugin6_proto_msgTypes[19].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*StopProvider_Response); i {
+			switch v := v.(*AttributePath_Step); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -3908,8 +4211,8 @@ func file_tfplugin6_proto_init() {
 				return nil
 			}
 		}
-		file_tfplugin6_proto_msgTypes[21].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Schema_Block); i {
+		file_tfplugin6_proto_msgTypes[20].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*StopProvider_Request); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -3920,8 +4223,8 @@ func file_tfplugin6_proto_init() {
 				return nil
 			}
 		}
-		file_tfplugin6_proto_msgTypes[22].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Schema_Attribute); i {
+		file_tfplugin6_proto_msgTypes[21].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*StopProvider_Response); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -3933,7 +4236,7 @@ func file_tfplugin6_proto_init() {
 			}
 		}
 		file_tfplugin6_proto_msgTypes[23].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Schema_NestedBlock); i {
+			switch v := v.(*Schema_Block); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -3945,7 +4248,7 @@ func file_tfplugin6_proto_init() {
 			}
 		}
 		file_tfplugin6_proto_msgTypes[24].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Schema_Object); i {
+			switch v := v.(*Schema_Attribute); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -3957,7 +4260,7 @@ func file_tfplugin6_proto_init() {
 			}
 		}
 		file_tfplugin6_proto_msgTypes[25].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*GetProviderSchema_Request); i {
+			switch v := v.(*Schema_NestedBlock); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -3969,7 +4272,7 @@ func file_tfplugin6_proto_init() {
 			}
 		}
 		file_tfplugin6_proto_msgTypes[26].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*GetProviderSchema_Response); i {
+			switch v := v.(*Schema_Object); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -3981,7 +4284,31 @@ func file_tfplugin6_proto_init() {
 			}
 		}
 		file_tfplugin6_proto_msgTypes[27].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*GetProviderSchema_ServerCapabilities); i {
+			switch v := v.(*GetMetadata_Request); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_tfplugin6_proto_msgTypes[28].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*GetMetadata_Response); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_tfplugin6_proto_msgTypes[29].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*GetMetadata_DataSourceMetadata); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -3993,7 +4320,7 @@ func file_tfplugin6_proto_init() {
 			}
 		}
 		file_tfplugin6_proto_msgTypes[30].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ValidateProviderConfig_Request); i {
+			switch v := v.(*GetMetadata_ResourceMetadata); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -4005,7 +4332,7 @@ func file_tfplugin6_proto_init() {
 			}
 		}
 		file_tfplugin6_proto_msgTypes[31].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ValidateProviderConfig_Response); i {
+			switch v := v.(*GetProviderSchema_Request); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -4017,6 +4344,42 @@ func file_tfplugin6_proto_init() {
 			}
 		}
 		file_tfplugin6_proto_msgTypes[32].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*GetProviderSchema_Response); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_tfplugin6_proto_msgTypes[35].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ValidateProviderConfig_Request); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_tfplugin6_proto_msgTypes[36].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ValidateProviderConfig_Response); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_tfplugin6_proto_msgTypes[37].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*UpgradeResourceState_Request); i {
 			case 0:
 				return &v.state
@@ -4028,7 +4391,7 @@ func file_tfplugin6_proto_init() {
 				return nil
 			}
 		}
-		file_tfplugin6_proto_msgTypes[33].Exporter = func(v interface{}, i int) interface{} {
+		file_tfplugin6_proto_msgTypes[38].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*UpgradeResourceState_Response); i {
 			case 0:
 				return &v.state
@@ -4040,7 +4403,7 @@ func file_tfplugin6_proto_init() {
 				return nil
 			}
 		}
-		file_tfplugin6_proto_msgTypes[34].Exporter = func(v interface{}, i int) interface{} {
+		file_tfplugin6_proto_msgTypes[39].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*ValidateResourceConfig_Request); i {
 			case 0:
 				return &v.state
@@ -4052,7 +4415,7 @@ func file_tfplugin6_proto_init() {
 				return nil
 			}
 		}
-		file_tfplugin6_proto_msgTypes[35].Exporter = func(v interface{}, i int) interface{} {
+		file_tfplugin6_proto_msgTypes[40].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*ValidateResourceConfig_Response); i {
 			case 0:
 				return &v.state
@@ -4064,7 +4427,7 @@ func file_tfplugin6_proto_init() {
 				return nil
 			}
 		}
-		file_tfplugin6_proto_msgTypes[36].Exporter = func(v interface{}, i int) interface{} {
+		file_tfplugin6_proto_msgTypes[41].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*ValidateDataResourceConfig_Request); i {
 			case 0:
 				return &v.state
@@ -4076,7 +4439,7 @@ func file_tfplugin6_proto_init() {
 				return nil
 			}
 		}
-		file_tfplugin6_proto_msgTypes[37].Exporter = func(v interface{}, i int) interface{} {
+		file_tfplugin6_proto_msgTypes[42].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*ValidateDataResourceConfig_Response); i {
 			case 0:
 				return &v.state
@@ -4088,7 +4451,7 @@ func file_tfplugin6_proto_init() {
 				return nil
 			}
 		}
-		file_tfplugin6_proto_msgTypes[38].Exporter = func(v interface{}, i int) interface{} {
+		file_tfplugin6_proto_msgTypes[43].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*ConfigureProvider_Request); i {
 			case 0:
 				return &v.state
@@ -4100,7 +4463,7 @@ func file_tfplugin6_proto_init() {
 				return nil
 			}
 		}
-		file_tfplugin6_proto_msgTypes[39].Exporter = func(v interface{}, i int) interface{} {
+		file_tfplugin6_proto_msgTypes[44].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*ConfigureProvider_Response); i {
 			case 0:
 				return &v.state
@@ -4112,7 +4475,7 @@ func file_tfplugin6_proto_init() {
 				return nil
 			}
 		}
-		file_tfplugin6_proto_msgTypes[40].Exporter = func(v interface{}, i int) interface{} {
+		file_tfplugin6_proto_msgTypes[45].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*ReadResource_Request); i {
 			case 0:
 				return &v.state
@@ -4124,7 +4487,7 @@ func file_tfplugin6_proto_init() {
 				return nil
 			}
 		}
-		file_tfplugin6_proto_msgTypes[41].Exporter = func(v interface{}, i int) interface{} {
+		file_tfplugin6_proto_msgTypes[46].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*ReadResource_Response); i {
 			case 0:
 				return &v.state
@@ -4136,7 +4499,7 @@ func file_tfplugin6_proto_init() {
 				return nil
 			}
 		}
-		file_tfplugin6_proto_msgTypes[42].Exporter = func(v interface{}, i int) interface{} {
+		file_tfplugin6_proto_msgTypes[47].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*PlanResourceChange_Request); i {
 			case 0:
 				return &v.state
@@ -4148,7 +4511,7 @@ func file_tfplugin6_proto_init() {
 				return nil
 			}
 		}
-		file_tfplugin6_proto_msgTypes[43].Exporter = func(v interface{}, i int) interface{} {
+		file_tfplugin6_proto_msgTypes[48].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*PlanResourceChange_Response); i {
 			case 0:
 				return &v.state
@@ -4160,7 +4523,7 @@ func file_tfplugin6_proto_init() {
 				return nil
 			}
 		}
-		file_tfplugin6_proto_msgTypes[44].Exporter = func(v interface{}, i int) interface{} {
+		file_tfplugin6_proto_msgTypes[49].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*ApplyResourceChange_Request); i {
 			case 0:
 				return &v.state
@@ -4172,7 +4535,7 @@ func file_tfplugin6_proto_init() {
 				return nil
 			}
 		}
-		file_tfplugin6_proto_msgTypes[45].Exporter = func(v interface{}, i int) interface{} {
+		file_tfplugin6_proto_msgTypes[50].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*ApplyResourceChange_Response); i {
 			case 0:
 				return &v.state
@@ -4184,7 +4547,7 @@ func file_tfplugin6_proto_init() {
 				return nil
 			}
 		}
-		file_tfplugin6_proto_msgTypes[46].Exporter = func(v interface{}, i int) interface{} {
+		file_tfplugin6_proto_msgTypes[51].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*ImportResourceState_Request); i {
 			case 0:
 				return &v.state
@@ -4196,7 +4559,7 @@ func file_tfplugin6_proto_init() {
 				return nil
 			}
 		}
-		file_tfplugin6_proto_msgTypes[47].Exporter = func(v interface{}, i int) interface{} {
+		file_tfplugin6_proto_msgTypes[52].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*ImportResourceState_ImportedResource); i {
 			case 0:
 				return &v.state
@@ -4208,7 +4571,7 @@ func file_tfplugin6_proto_init() {
 				return nil
 			}
 		}
-		file_tfplugin6_proto_msgTypes[48].Exporter = func(v interface{}, i int) interface{} {
+		file_tfplugin6_proto_msgTypes[53].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*ImportResourceState_Response); i {
 			case 0:
 				return &v.state
@@ -4220,7 +4583,7 @@ func file_tfplugin6_proto_init() {
 				return nil
 			}
 		}
-		file_tfplugin6_proto_msgTypes[49].Exporter = func(v interface{}, i int) interface{} {
+		file_tfplugin6_proto_msgTypes[54].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*ReadDataSource_Request); i {
 			case 0:
 				return &v.state
@@ -4232,7 +4595,7 @@ func file_tfplugin6_proto_init() {
 				return nil
 			}
 		}
-		file_tfplugin6_proto_msgTypes[50].Exporter = func(v interface{}, i int) interface{} {
+		file_tfplugin6_proto_msgTypes[55].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*ReadDataSource_Response); i {
 			case 0:
 				return &v.state
@@ -4245,7 +4608,7 @@ func file_tfplugin6_proto_init() {
 			}
 		}
 	}
-	file_tfplugin6_proto_msgTypes[17].OneofWrappers = []interface{}{
+	file_tfplugin6_proto_msgTypes[19].OneofWrappers = []interface{}{
 		(*AttributePath_Step_AttributeName)(nil),
 		(*AttributePath_Step_ElementKeyString)(nil),
 		(*AttributePath_Step_ElementKeyInt)(nil),
@@ -4256,7 +4619,7 @@ func file_tfplugin6_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: file_tfplugin6_proto_rawDesc,
 			NumEnums:      4,
-			NumMessages:   51,
+			NumMessages:   56,
 			NumExtensions: 0,
 			NumServices:   1,
 		},
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/tfplugin6/tfplugin6.proto b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/tfplugin6/tfplugin6.proto
index affb15fb460..a20ee8f8255 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/tfplugin6/tfplugin6.proto
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/tfplugin6/tfplugin6.proto
@@ -1,6 +1,9 @@
-// Terraform Plugin RPC protocol version 6.3
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+// Terraform Plugin RPC protocol version 6.4
 //
-// This file defines version 6.3 of the RPC protocol. To implement a plugin
+// This file defines version 6.4 of the RPC protocol. To implement a plugin
 // against this protocol, copy this definition into your own codebase and
 // use protoc to generate stubs for your target language.
 //
@@ -144,8 +147,34 @@ message Schema {
     Block block = 2;
 }
 
+// ServerCapabilities allows providers to communicate extra information
+// regarding supported protocol features. This is used to indicate
+// availability of certain forward-compatible changes which may be optional
+// in a major protocol version, but cannot be tested for directly.
+message ServerCapabilities {
+    // The plan_destroy capability signals that a provider expects a call
+    // to PlanResourceChange when a resource is going to be destroyed.
+    bool plan_destroy = 1;
+
+    // The get_provider_schema_optional capability indicates that this
+    // provider does not require calling GetProviderSchema to operate
+    // normally, and the caller can used a cached copy of the provider's
+    // schema.
+    bool get_provider_schema_optional = 2;
+}
+
 service Provider {
     //////// Information about what a provider supports/expects
+
+    // GetMetadata returns upfront information about server capabilities and
+    // supported resource types without requiring the server to instantiate all
+    // schema information, which may be memory intensive. This RPC is optional,
+    // where clients may receive an unimplemented RPC error. Clients should
+    // ignore the error and call the GetProviderSchema RPC as a fallback.
+    rpc GetMetadata(GetMetadata.Request) returns (GetMetadata.Response);
+
+    // GetSchema returns schema information for the provider, data resources,
+    // and managed resources.
     rpc GetProviderSchema(GetProviderSchema.Request) returns (GetProviderSchema.Response);
     rpc ValidateProviderConfig(ValidateProviderConfig.Request) returns (ValidateProviderConfig.Response);
     rpc ValidateResourceConfig(ValidateResourceConfig.Request) returns (ValidateResourceConfig.Response);
@@ -167,6 +196,26 @@ service Provider {
     rpc StopProvider(StopProvider.Request) returns (StopProvider.Response);
 }
 
+message GetMetadata {
+    message Request {
+    }
+
+    message Response {
+        ServerCapabilities server_capabilities = 1;
+        repeated Diagnostic diagnostics = 2;
+        repeated DataSourceMetadata data_sources = 3;
+        repeated ResourceMetadata resources = 4;
+    }
+
+    message DataSourceMetadata {
+        string type_name = 1;
+    }
+
+    message ResourceMetadata {
+        string type_name = 1;
+    }
+}
+
 message GetProviderSchema {
     message Request {
     }
@@ -178,17 +227,6 @@ message GetProviderSchema {
         Schema provider_meta = 5;
         ServerCapabilities server_capabilities = 6;
     }
-
-
-    // ServerCapabilities allows providers to communicate extra information
-    // regarding supported protocol features. This is used to indicate
-    // availability of certain forward-compatible changes which may be optional
-    // in a major protocol version, but cannot be tested for directly.
-    message ServerCapabilities {
-        // The plan_destroy capability signals that a provider expects a call
-        // to PlanResourceChange when a resource is going to be destroyed.
-        bool plan_destroy = 1;
-    }
 }
 
 message ValidateProviderConfig {
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/tfplugin6/tfplugin6_grpc.pb.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/tfplugin6/tfplugin6_grpc.pb.go
index a22d32dc9ed..4e92cbf4d90 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/tfplugin6/tfplugin6_grpc.pb.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/tfplugin6/tfplugin6_grpc.pb.go
@@ -1,7 +1,29 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+// Terraform Plugin RPC protocol version 6.4
+//
+// This file defines version 6.4 of the RPC protocol. To implement a plugin
+// against this protocol, copy this definition into your own codebase and
+// use protoc to generate stubs for your target language.
+//
+// This file will not be updated. Any minor versions of protocol 6 to follow
+// should copy this file and modify the copy while maintaing backwards
+// compatibility. Breaking changes, if any are required, will come
+// in a subsequent major version with its own separate proto definition.
+//
+// Note that only the proto files included in a release tag of Terraform are
+// official protocol releases. Proto files taken from other commits may include
+// incomplete changes or features that did not make it into a final release.
+// In all reasonable cases, plugin developers should take the proto file from
+// the tag of the most recent release of Terraform, and not from the main
+// branch or any other development branch.
+//
+
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.2.0
-// - protoc             v3.19.4
+// - protoc-gen-go-grpc v1.3.0
+// - protoc             v4.23.2
 // source: tfplugin6.proto
 
 package tfplugin6
@@ -18,25 +40,48 @@ import (
 // Requires gRPC-Go v1.32.0 or later.
 const _ = grpc.SupportPackageIsVersion7
 
+const (
+	Provider_GetMetadata_FullMethodName                = "/tfplugin6.Provider/GetMetadata"
+	Provider_GetProviderSchema_FullMethodName          = "/tfplugin6.Provider/GetProviderSchema"
+	Provider_ValidateProviderConfig_FullMethodName     = "/tfplugin6.Provider/ValidateProviderConfig"
+	Provider_ValidateResourceConfig_FullMethodName     = "/tfplugin6.Provider/ValidateResourceConfig"
+	Provider_ValidateDataResourceConfig_FullMethodName = "/tfplugin6.Provider/ValidateDataResourceConfig"
+	Provider_UpgradeResourceState_FullMethodName       = "/tfplugin6.Provider/UpgradeResourceState"
+	Provider_ConfigureProvider_FullMethodName          = "/tfplugin6.Provider/ConfigureProvider"
+	Provider_ReadResource_FullMethodName               = "/tfplugin6.Provider/ReadResource"
+	Provider_PlanResourceChange_FullMethodName         = "/tfplugin6.Provider/PlanResourceChange"
+	Provider_ApplyResourceChange_FullMethodName        = "/tfplugin6.Provider/ApplyResourceChange"
+	Provider_ImportResourceState_FullMethodName        = "/tfplugin6.Provider/ImportResourceState"
+	Provider_ReadDataSource_FullMethodName             = "/tfplugin6.Provider/ReadDataSource"
+	Provider_StopProvider_FullMethodName               = "/tfplugin6.Provider/StopProvider"
+)
+
 // ProviderClient is the client API for Provider service.
 //
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
 type ProviderClient interface {
-	//////// Information about what a provider supports/expects
+	// GetMetadata returns upfront information about server capabilities and
+	// supported resource types without requiring the server to instantiate all
+	// schema information, which may be memory intensive. This RPC is optional,
+	// where clients may receive an unimplemented RPC error. Clients should
+	// ignore the error and call the GetProviderSchema RPC as a fallback.
+	GetMetadata(ctx context.Context, in *GetMetadata_Request, opts ...grpc.CallOption) (*GetMetadata_Response, error)
+	// GetSchema returns schema information for the provider, data resources,
+	// and managed resources.
 	GetProviderSchema(ctx context.Context, in *GetProviderSchema_Request, opts ...grpc.CallOption) (*GetProviderSchema_Response, error)
 	ValidateProviderConfig(ctx context.Context, in *ValidateProviderConfig_Request, opts ...grpc.CallOption) (*ValidateProviderConfig_Response, error)
 	ValidateResourceConfig(ctx context.Context, in *ValidateResourceConfig_Request, opts ...grpc.CallOption) (*ValidateResourceConfig_Response, error)
 	ValidateDataResourceConfig(ctx context.Context, in *ValidateDataResourceConfig_Request, opts ...grpc.CallOption) (*ValidateDataResourceConfig_Response, error)
 	UpgradeResourceState(ctx context.Context, in *UpgradeResourceState_Request, opts ...grpc.CallOption) (*UpgradeResourceState_Response, error)
-	//////// One-time initialization, called before other functions below
+	// ////// One-time initialization, called before other functions below
 	ConfigureProvider(ctx context.Context, in *ConfigureProvider_Request, opts ...grpc.CallOption) (*ConfigureProvider_Response, error)
-	//////// Managed Resource Lifecycle
+	// ////// Managed Resource Lifecycle
 	ReadResource(ctx context.Context, in *ReadResource_Request, opts ...grpc.CallOption) (*ReadResource_Response, error)
 	PlanResourceChange(ctx context.Context, in *PlanResourceChange_Request, opts ...grpc.CallOption) (*PlanResourceChange_Response, error)
 	ApplyResourceChange(ctx context.Context, in *ApplyResourceChange_Request, opts ...grpc.CallOption) (*ApplyResourceChange_Response, error)
 	ImportResourceState(ctx context.Context, in *ImportResourceState_Request, opts ...grpc.CallOption) (*ImportResourceState_Response, error)
 	ReadDataSource(ctx context.Context, in *ReadDataSource_Request, opts ...grpc.CallOption) (*ReadDataSource_Response, error)
-	//////// Graceful Shutdown
+	// ////// Graceful Shutdown
 	StopProvider(ctx context.Context, in *StopProvider_Request, opts ...grpc.CallOption) (*StopProvider_Response, error)
 }
 
@@ -48,9 +93,18 @@ func NewProviderClient(cc grpc.ClientConnInterface) ProviderClient {
 	return &providerClient{cc}
 }
 
+func (c *providerClient) GetMetadata(ctx context.Context, in *GetMetadata_Request, opts ...grpc.CallOption) (*GetMetadata_Response, error) {
+	out := new(GetMetadata_Response)
+	err := c.cc.Invoke(ctx, Provider_GetMetadata_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 func (c *providerClient) GetProviderSchema(ctx context.Context, in *GetProviderSchema_Request, opts ...grpc.CallOption) (*GetProviderSchema_Response, error) {
 	out := new(GetProviderSchema_Response)
-	err := c.cc.Invoke(ctx, "/tfplugin6.Provider/GetProviderSchema", in, out, opts...)
+	err := c.cc.Invoke(ctx, Provider_GetProviderSchema_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -59,7 +113,7 @@ func (c *providerClient) GetProviderSchema(ctx context.Context, in *GetProviderS
 
 func (c *providerClient) ValidateProviderConfig(ctx context.Context, in *ValidateProviderConfig_Request, opts ...grpc.CallOption) (*ValidateProviderConfig_Response, error) {
 	out := new(ValidateProviderConfig_Response)
-	err := c.cc.Invoke(ctx, "/tfplugin6.Provider/ValidateProviderConfig", in, out, opts...)
+	err := c.cc.Invoke(ctx, Provider_ValidateProviderConfig_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -68,7 +122,7 @@ func (c *providerClient) ValidateProviderConfig(ctx context.Context, in *Validat
 
 func (c *providerClient) ValidateResourceConfig(ctx context.Context, in *ValidateResourceConfig_Request, opts ...grpc.CallOption) (*ValidateResourceConfig_Response, error) {
 	out := new(ValidateResourceConfig_Response)
-	err := c.cc.Invoke(ctx, "/tfplugin6.Provider/ValidateResourceConfig", in, out, opts...)
+	err := c.cc.Invoke(ctx, Provider_ValidateResourceConfig_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -77,7 +131,7 @@ func (c *providerClient) ValidateResourceConfig(ctx context.Context, in *Validat
 
 func (c *providerClient) ValidateDataResourceConfig(ctx context.Context, in *ValidateDataResourceConfig_Request, opts ...grpc.CallOption) (*ValidateDataResourceConfig_Response, error) {
 	out := new(ValidateDataResourceConfig_Response)
-	err := c.cc.Invoke(ctx, "/tfplugin6.Provider/ValidateDataResourceConfig", in, out, opts...)
+	err := c.cc.Invoke(ctx, Provider_ValidateDataResourceConfig_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -86,7 +140,7 @@ func (c *providerClient) ValidateDataResourceConfig(ctx context.Context, in *Val
 
 func (c *providerClient) UpgradeResourceState(ctx context.Context, in *UpgradeResourceState_Request, opts ...grpc.CallOption) (*UpgradeResourceState_Response, error) {
 	out := new(UpgradeResourceState_Response)
-	err := c.cc.Invoke(ctx, "/tfplugin6.Provider/UpgradeResourceState", in, out, opts...)
+	err := c.cc.Invoke(ctx, Provider_UpgradeResourceState_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -95,7 +149,7 @@ func (c *providerClient) UpgradeResourceState(ctx context.Context, in *UpgradeRe
 
 func (c *providerClient) ConfigureProvider(ctx context.Context, in *ConfigureProvider_Request, opts ...grpc.CallOption) (*ConfigureProvider_Response, error) {
 	out := new(ConfigureProvider_Response)
-	err := c.cc.Invoke(ctx, "/tfplugin6.Provider/ConfigureProvider", in, out, opts...)
+	err := c.cc.Invoke(ctx, Provider_ConfigureProvider_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -104,7 +158,7 @@ func (c *providerClient) ConfigureProvider(ctx context.Context, in *ConfigurePro
 
 func (c *providerClient) ReadResource(ctx context.Context, in *ReadResource_Request, opts ...grpc.CallOption) (*ReadResource_Response, error) {
 	out := new(ReadResource_Response)
-	err := c.cc.Invoke(ctx, "/tfplugin6.Provider/ReadResource", in, out, opts...)
+	err := c.cc.Invoke(ctx, Provider_ReadResource_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -113,7 +167,7 @@ func (c *providerClient) ReadResource(ctx context.Context, in *ReadResource_Requ
 
 func (c *providerClient) PlanResourceChange(ctx context.Context, in *PlanResourceChange_Request, opts ...grpc.CallOption) (*PlanResourceChange_Response, error) {
 	out := new(PlanResourceChange_Response)
-	err := c.cc.Invoke(ctx, "/tfplugin6.Provider/PlanResourceChange", in, out, opts...)
+	err := c.cc.Invoke(ctx, Provider_PlanResourceChange_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -122,7 +176,7 @@ func (c *providerClient) PlanResourceChange(ctx context.Context, in *PlanResourc
 
 func (c *providerClient) ApplyResourceChange(ctx context.Context, in *ApplyResourceChange_Request, opts ...grpc.CallOption) (*ApplyResourceChange_Response, error) {
 	out := new(ApplyResourceChange_Response)
-	err := c.cc.Invoke(ctx, "/tfplugin6.Provider/ApplyResourceChange", in, out, opts...)
+	err := c.cc.Invoke(ctx, Provider_ApplyResourceChange_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -131,7 +185,7 @@ func (c *providerClient) ApplyResourceChange(ctx context.Context, in *ApplyResou
 
 func (c *providerClient) ImportResourceState(ctx context.Context, in *ImportResourceState_Request, opts ...grpc.CallOption) (*ImportResourceState_Response, error) {
 	out := new(ImportResourceState_Response)
-	err := c.cc.Invoke(ctx, "/tfplugin6.Provider/ImportResourceState", in, out, opts...)
+	err := c.cc.Invoke(ctx, Provider_ImportResourceState_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -140,7 +194,7 @@ func (c *providerClient) ImportResourceState(ctx context.Context, in *ImportReso
 
 func (c *providerClient) ReadDataSource(ctx context.Context, in *ReadDataSource_Request, opts ...grpc.CallOption) (*ReadDataSource_Response, error) {
 	out := new(ReadDataSource_Response)
-	err := c.cc.Invoke(ctx, "/tfplugin6.Provider/ReadDataSource", in, out, opts...)
+	err := c.cc.Invoke(ctx, Provider_ReadDataSource_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -149,7 +203,7 @@ func (c *providerClient) ReadDataSource(ctx context.Context, in *ReadDataSource_
 
 func (c *providerClient) StopProvider(ctx context.Context, in *StopProvider_Request, opts ...grpc.CallOption) (*StopProvider_Response, error) {
 	out := new(StopProvider_Response)
-	err := c.cc.Invoke(ctx, "/tfplugin6.Provider/StopProvider", in, out, opts...)
+	err := c.cc.Invoke(ctx, Provider_StopProvider_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -160,21 +214,28 @@ func (c *providerClient) StopProvider(ctx context.Context, in *StopProvider_Requ
 // All implementations must embed UnimplementedProviderServer
 // for forward compatibility
 type ProviderServer interface {
-	//////// Information about what a provider supports/expects
+	// GetMetadata returns upfront information about server capabilities and
+	// supported resource types without requiring the server to instantiate all
+	// schema information, which may be memory intensive. This RPC is optional,
+	// where clients may receive an unimplemented RPC error. Clients should
+	// ignore the error and call the GetProviderSchema RPC as a fallback.
+	GetMetadata(context.Context, *GetMetadata_Request) (*GetMetadata_Response, error)
+	// GetSchema returns schema information for the provider, data resources,
+	// and managed resources.
 	GetProviderSchema(context.Context, *GetProviderSchema_Request) (*GetProviderSchema_Response, error)
 	ValidateProviderConfig(context.Context, *ValidateProviderConfig_Request) (*ValidateProviderConfig_Response, error)
 	ValidateResourceConfig(context.Context, *ValidateResourceConfig_Request) (*ValidateResourceConfig_Response, error)
 	ValidateDataResourceConfig(context.Context, *ValidateDataResourceConfig_Request) (*ValidateDataResourceConfig_Response, error)
 	UpgradeResourceState(context.Context, *UpgradeResourceState_Request) (*UpgradeResourceState_Response, error)
-	//////// One-time initialization, called before other functions below
+	// ////// One-time initialization, called before other functions below
 	ConfigureProvider(context.Context, *ConfigureProvider_Request) (*ConfigureProvider_Response, error)
-	//////// Managed Resource Lifecycle
+	// ////// Managed Resource Lifecycle
 	ReadResource(context.Context, *ReadResource_Request) (*ReadResource_Response, error)
 	PlanResourceChange(context.Context, *PlanResourceChange_Request) (*PlanResourceChange_Response, error)
 	ApplyResourceChange(context.Context, *ApplyResourceChange_Request) (*ApplyResourceChange_Response, error)
 	ImportResourceState(context.Context, *ImportResourceState_Request) (*ImportResourceState_Response, error)
 	ReadDataSource(context.Context, *ReadDataSource_Request) (*ReadDataSource_Response, error)
-	//////// Graceful Shutdown
+	// ////// Graceful Shutdown
 	StopProvider(context.Context, *StopProvider_Request) (*StopProvider_Response, error)
 	mustEmbedUnimplementedProviderServer()
 }
@@ -183,6 +244,9 @@ type ProviderServer interface {
 type UnimplementedProviderServer struct {
 }
 
+func (UnimplementedProviderServer) GetMetadata(context.Context, *GetMetadata_Request) (*GetMetadata_Response, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method GetMetadata not implemented")
+}
 func (UnimplementedProviderServer) GetProviderSchema(context.Context, *GetProviderSchema_Request) (*GetProviderSchema_Response, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method GetProviderSchema not implemented")
 }
@@ -232,6 +296,24 @@ func RegisterProviderServer(s grpc.ServiceRegistrar, srv ProviderServer) {
 	s.RegisterService(&Provider_ServiceDesc, srv)
 }
 
+func _Provider_GetMetadata_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(GetMetadata_Request)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ProviderServer).GetMetadata(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Provider_GetMetadata_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ProviderServer).GetMetadata(ctx, req.(*GetMetadata_Request))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 func _Provider_GetProviderSchema_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(GetProviderSchema_Request)
 	if err := dec(in); err != nil {
@@ -242,7 +324,7 @@ func _Provider_GetProviderSchema_Handler(srv interface{}, ctx context.Context, d
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/tfplugin6.Provider/GetProviderSchema",
+		FullMethod: Provider_GetProviderSchema_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(ProviderServer).GetProviderSchema(ctx, req.(*GetProviderSchema_Request))
@@ -260,7 +342,7 @@ func _Provider_ValidateProviderConfig_Handler(srv interface{}, ctx context.Conte
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/tfplugin6.Provider/ValidateProviderConfig",
+		FullMethod: Provider_ValidateProviderConfig_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(ProviderServer).ValidateProviderConfig(ctx, req.(*ValidateProviderConfig_Request))
@@ -278,7 +360,7 @@ func _Provider_ValidateResourceConfig_Handler(srv interface{}, ctx context.Conte
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/tfplugin6.Provider/ValidateResourceConfig",
+		FullMethod: Provider_ValidateResourceConfig_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(ProviderServer).ValidateResourceConfig(ctx, req.(*ValidateResourceConfig_Request))
@@ -296,7 +378,7 @@ func _Provider_ValidateDataResourceConfig_Handler(srv interface{}, ctx context.C
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/tfplugin6.Provider/ValidateDataResourceConfig",
+		FullMethod: Provider_ValidateDataResourceConfig_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(ProviderServer).ValidateDataResourceConfig(ctx, req.(*ValidateDataResourceConfig_Request))
@@ -314,7 +396,7 @@ func _Provider_UpgradeResourceState_Handler(srv interface{}, ctx context.Context
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/tfplugin6.Provider/UpgradeResourceState",
+		FullMethod: Provider_UpgradeResourceState_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(ProviderServer).UpgradeResourceState(ctx, req.(*UpgradeResourceState_Request))
@@ -332,7 +414,7 @@ func _Provider_ConfigureProvider_Handler(srv interface{}, ctx context.Context, d
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/tfplugin6.Provider/ConfigureProvider",
+		FullMethod: Provider_ConfigureProvider_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(ProviderServer).ConfigureProvider(ctx, req.(*ConfigureProvider_Request))
@@ -350,7 +432,7 @@ func _Provider_ReadResource_Handler(srv interface{}, ctx context.Context, dec fu
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/tfplugin6.Provider/ReadResource",
+		FullMethod: Provider_ReadResource_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(ProviderServer).ReadResource(ctx, req.(*ReadResource_Request))
@@ -368,7 +450,7 @@ func _Provider_PlanResourceChange_Handler(srv interface{}, ctx context.Context,
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/tfplugin6.Provider/PlanResourceChange",
+		FullMethod: Provider_PlanResourceChange_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(ProviderServer).PlanResourceChange(ctx, req.(*PlanResourceChange_Request))
@@ -386,7 +468,7 @@ func _Provider_ApplyResourceChange_Handler(srv interface{}, ctx context.Context,
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/tfplugin6.Provider/ApplyResourceChange",
+		FullMethod: Provider_ApplyResourceChange_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(ProviderServer).ApplyResourceChange(ctx, req.(*ApplyResourceChange_Request))
@@ -404,7 +486,7 @@ func _Provider_ImportResourceState_Handler(srv interface{}, ctx context.Context,
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/tfplugin6.Provider/ImportResourceState",
+		FullMethod: Provider_ImportResourceState_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(ProviderServer).ImportResourceState(ctx, req.(*ImportResourceState_Request))
@@ -422,7 +504,7 @@ func _Provider_ReadDataSource_Handler(srv interface{}, ctx context.Context, dec
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/tfplugin6.Provider/ReadDataSource",
+		FullMethod: Provider_ReadDataSource_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(ProviderServer).ReadDataSource(ctx, req.(*ReadDataSource_Request))
@@ -440,7 +522,7 @@ func _Provider_StopProvider_Handler(srv interface{}, ctx context.Context, dec fu
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/tfplugin6.Provider/StopProvider",
+		FullMethod: Provider_StopProvider_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(ProviderServer).StopProvider(ctx, req.(*StopProvider_Request))
@@ -455,6 +537,10 @@ var Provider_ServiceDesc = grpc.ServiceDesc{
 	ServiceName: "tfplugin6.Provider",
 	HandlerType: (*ProviderServer)(nil),
 	Methods: []grpc.MethodDesc{
+		{
+			MethodName: "GetMetadata",
+			Handler:    _Provider_GetMetadata_Handler,
+		},
 		{
 			MethodName: "GetProviderSchema",
 			Handler:    _Provider_GetProviderSchema_Handler,
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/toproto/data_source.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/toproto/data_source.go
index 624a3bb108c..e264d91d6aa 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/toproto/data_source.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/toproto/data_source.go
@@ -5,6 +5,16 @@ import (
 	"github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/tfplugin6"
 )
 
+func GetMetadata_DataSourceMetadata(in *tfprotov6.DataSourceMetadata) *tfplugin6.GetMetadata_DataSourceMetadata {
+	if in == nil {
+		return nil
+	}
+
+	return &tfplugin6.GetMetadata_DataSourceMetadata{
+		TypeName: in.TypeName,
+	}
+}
+
 func ValidateDataResourceConfig_Request(in *tfprotov6.ValidateDataResourceConfigRequest) (*tfplugin6.ValidateDataResourceConfig_Request, error) {
 	resp := &tfplugin6.ValidateDataResourceConfig_Request{
 		TypeName: in.TypeName,
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/toproto/provider.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/toproto/provider.go
index ce37207f98f..40db1bc90b7 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/toproto/provider.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/toproto/provider.go
@@ -7,6 +7,40 @@ import (
 	"github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/tfplugin6"
 )
 
+func GetMetadata_Request(in *tfprotov6.GetMetadataRequest) (*tfplugin6.GetMetadata_Request, error) {
+	return &tfplugin6.GetMetadata_Request{}, nil
+}
+
+func GetMetadata_Response(in *tfprotov6.GetMetadataResponse) (*tfplugin6.GetMetadata_Response, error) {
+	if in == nil {
+		return nil, nil
+	}
+
+	resp := &tfplugin6.GetMetadata_Response{
+		DataSources:        make([]*tfplugin6.GetMetadata_DataSourceMetadata, 0, len(in.DataSources)),
+		Resources:          make([]*tfplugin6.GetMetadata_ResourceMetadata, 0, len(in.Resources)),
+		ServerCapabilities: ServerCapabilities(in.ServerCapabilities),
+	}
+
+	for _, datasource := range in.DataSources {
+		resp.DataSources = append(resp.DataSources, GetMetadata_DataSourceMetadata(&datasource))
+	}
+
+	for _, resource := range in.Resources {
+		resp.Resources = append(resp.Resources, GetMetadata_ResourceMetadata(&resource))
+	}
+
+	diags, err := Diagnostics(in.Diagnostics)
+
+	if err != nil {
+		return resp, err
+	}
+
+	resp.Diagnostics = diags
+
+	return resp, nil
+}
+
 func GetProviderSchema_Request(in *tfprotov6.GetProviderSchemaRequest) (*tfplugin6.GetProviderSchema_Request, error) {
 	return &tfplugin6.GetProviderSchema_Request{}, nil
 }
@@ -16,7 +50,7 @@ func GetProviderSchema_Response(in *tfprotov6.GetProviderSchemaResponse) (*tfplu
 		return nil, nil
 	}
 	resp := tfplugin6.GetProviderSchema_Response{
-		ServerCapabilities: GetProviderSchema_ServerCapabilities(in.ServerCapabilities),
+		ServerCapabilities: ServerCapabilities(in.ServerCapabilities),
 	}
 	if in.Provider != nil {
 		schema, err := Schema(in.Provider)
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/toproto/resource.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/toproto/resource.go
index bb09681850f..8dd35f7809b 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/toproto/resource.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/toproto/resource.go
@@ -5,6 +5,16 @@ import (
 	"github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/tfplugin6"
 )
 
+func GetMetadata_ResourceMetadata(in *tfprotov6.ResourceMetadata) *tfplugin6.GetMetadata_ResourceMetadata {
+	if in == nil {
+		return nil
+	}
+
+	return &tfplugin6.GetMetadata_ResourceMetadata{
+		TypeName: in.TypeName,
+	}
+}
+
 func ValidateResourceConfig_Request(in *tfprotov6.ValidateResourceConfigRequest) (*tfplugin6.ValidateResourceConfig_Request, error) {
 	resp := &tfplugin6.ValidateResourceConfig_Request{
 		TypeName: in.TypeName,
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/toproto/server_capabilities.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/toproto/server_capabilities.go
index fa335d6913e..2c63554b40a 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/toproto/server_capabilities.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/toproto/server_capabilities.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package toproto
 
 import (
@@ -5,12 +8,13 @@ import (
 	"github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/tfplugin6"
 )
 
-func GetProviderSchema_ServerCapabilities(in *tfprotov6.ServerCapabilities) *tfplugin6.GetProviderSchema_ServerCapabilities {
+func ServerCapabilities(in *tfprotov6.ServerCapabilities) *tfplugin6.ServerCapabilities {
 	if in == nil {
 		return nil
 	}
 
-	return &tfplugin6.GetProviderSchema_ServerCapabilities{
-		PlanDestroy: in.PlanDestroy,
+	return &tfplugin6.ServerCapabilities{
+		GetProviderSchemaOptional: in.GetProviderSchemaOptional,
+		PlanDestroy:               in.PlanDestroy,
 	}
 }
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/provider.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/provider.go
index 970ef8e70c2..6f3f9d974d4 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/provider.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/provider.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tfprotov6
 
 import (
@@ -7,6 +10,13 @@ import (
 // ProviderServer is an interface that reflects that Terraform protocol.
 // Providers must implement this interface.
 type ProviderServer interface {
+	// GetMetadata returns upfront information about server capabilities and
+	// supported resource types without requiring the server to instantiate all
+	// schema information, which may be memory intensive. This RPC is optional,
+	// where clients may receive an unimplemented RPC error. Clients should
+	// ignore the error and call the GetProviderSchema RPC as a fallback.
+	GetMetadata(context.Context, *GetMetadataRequest) (*GetMetadataResponse, error)
+
 	// GetProviderSchema is called when Terraform needs to know what the
 	// provider's schema is, along with the schemas of all its resources
 	// and data sources.
@@ -39,6 +49,27 @@ type ProviderServer interface {
 	DataSourceServer
 }
 
+// GetMetadataRequest represents a GetMetadata RPC request.
+type GetMetadataRequest struct{}
+
+// GetMetadataResponse represents a GetMetadata RPC response.
+type GetMetadataResponse struct {
+	// ServerCapabilities defines optionally supported protocol features,
+	// such as forward-compatible Terraform behavior changes.
+	ServerCapabilities *ServerCapabilities
+
+	// Diagnostics report errors or warnings related to returning the
+	// provider's schemas. Returning an empty slice indicates success, with
+	// no errors or warnings generated.
+	Diagnostics []*Diagnostic
+
+	// DataSources returns metadata for all data resources.
+	DataSources []DataSourceMetadata
+
+	// Resources returns metadata for all managed resources.
+	Resources []ResourceMetadata
+}
+
 // GetProviderSchemaRequest represents a Terraform RPC request for the
 // provider's schemas.
 type GetProviderSchemaRequest struct{}
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/resource.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/resource.go
index 2768bb526e8..987d9cc5e6a 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/resource.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/resource.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tfprotov6
 
 import (
@@ -6,6 +9,13 @@ import (
 	"github.com/hashicorp/terraform-plugin-go/tftypes"
 )
 
+// ResourceMetadata describes metadata for a managed resource in the GetMetadata
+// RPC.
+type ResourceMetadata struct {
+	// TypeName is the name of the managed resource.
+	TypeName string
+}
+
 // ResourceServer is an interface containing the methods a resource
 // implementation needs to fill.
 type ResourceServer interface {
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/schema.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/schema.go
index c17e2cceebb..b368c620fbc 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/schema.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/schema.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tfprotov6
 
 import "github.com/hashicorp/terraform-plugin-go/tftypes"
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/server_capabilities.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/server_capabilities.go
index eed59219d55..2ea71df6d69 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/server_capabilities.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/server_capabilities.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tfprotov6
 
 // ServerCapabilities allows providers to communicate optionally supported
@@ -6,6 +9,11 @@ package tfprotov6
 // This information is used in GetProviderSchemaResponse as capabilities are
 // static features which must be known upfront in the provider server.
 type ServerCapabilities struct {
+	// GetProviderSchemaOptional signals that this provider does not require
+	// having the GetProviderSchema RPC called first to operate normally. This
+	// means the caller can use a cached copy of the provider's schema instead.
+	GetProviderSchemaOptional bool
+
 	// PlanDestroy signals that a provider expects a call to
 	// PlanResourceChange when a resource is going to be destroyed. This is
 	// opt-in to prevent unexpected errors or panics since the
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/state.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/state.go
index 41506b8d700..5f7a14518b8 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/state.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/state.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tfprotov6
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/string_kind.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/string_kind.go
index 359e036e7a3..7f0d9131b6a 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/string_kind.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/string_kind.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tfprotov6
 
 const (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/tf6server/doc.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/tf6server/doc.go
index 8b5313d953b..5501d70d713 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/tf6server/doc.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/tf6server/doc.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 // Package tf6server implements a server implementation to run
 // tfprotov6.ProviderServers as gRPC servers.
 //
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/tf6server/plugin.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/tf6server/plugin.go
index e868d30a5ba..c5d24ffdb49 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/tf6server/plugin.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/tf6server/plugin.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tf6server
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/tf6server/server.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/tf6server/server.go
index 9889a93e695..6b42836e213 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/tf6server/server.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tfprotov6/tf6server/server.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tf6server
 
 import (
@@ -45,7 +48,7 @@ const (
 	//
 	// In the future, it may be possible to include this information directly
 	// in the protocol buffers rather than recreating a constant here.
-	protocolVersionMinor uint = 3
+	protocolVersionMinor uint = 4
 )
 
 // protocolVersion represents the combined major and minor version numbers of
@@ -483,6 +486,43 @@ func New(name string, serve tfprotov6.ProviderServer, opts ...ServeOpt) tfplugin
 	}
 }
 
+func (s *server) GetMetadata(ctx context.Context, req *tfplugin6.GetMetadata_Request) (*tfplugin6.GetMetadata_Response, error) {
+	rpc := "GetMetadata"
+	ctx = s.loggingContext(ctx)
+	ctx = logging.RpcContext(ctx, rpc)
+	ctx = s.stoppableContext(ctx)
+	logging.ProtocolTrace(ctx, "Received request")
+	defer logging.ProtocolTrace(ctx, "Served request")
+
+	r, err := fromproto.GetMetadataRequest(req)
+
+	if err != nil {
+		logging.ProtocolError(ctx, "Error converting request from protobuf", map[string]interface{}{logging.KeyError: err})
+		return nil, err
+	}
+
+	ctx = tf6serverlogging.DownstreamRequest(ctx)
+
+	resp, err := s.downstream.GetMetadata(ctx, r)
+
+	if err != nil {
+		logging.ProtocolError(ctx, "Error from downstream", map[string]interface{}{logging.KeyError: err})
+		return nil, err
+	}
+
+	tf6serverlogging.DownstreamResponse(ctx, resp.Diagnostics)
+	tf6serverlogging.ServerCapabilities(ctx, resp.ServerCapabilities)
+
+	ret, err := toproto.GetMetadata_Response(resp)
+
+	if err != nil {
+		logging.ProtocolError(ctx, "Error converting response to protobuf", map[string]interface{}{logging.KeyError: err})
+		return nil, err
+	}
+
+	return ret, nil
+}
+
 func (s *server) GetProviderSchema(ctx context.Context, req *tfplugin6.GetProviderSchema_Request) (*tfplugin6.GetProviderSchema_Response, error) {
 	rpc := "GetProviderSchema"
 	ctx = s.loggingContext(ctx)
@@ -502,6 +542,7 @@ func (s *server) GetProviderSchema(ctx context.Context, req *tfplugin6.GetProvid
 		return nil, err
 	}
 	tf6serverlogging.DownstreamResponse(ctx, resp.Diagnostics)
+	tf6serverlogging.ServerCapabilities(ctx, resp.ServerCapabilities)
 	ret, err := toproto.GetProviderSchema_Response(resp)
 	if err != nil {
 		logging.ProtocolError(ctx, "Error converting response to protobuf", map[string]interface{}{logging.KeyError: err})
@@ -578,7 +619,7 @@ func (s *server) stop() {
 	s.stopCh = make(chan struct{})
 }
 
-func (s *server) Stop(ctx context.Context, req *tfplugin6.StopProvider_Request) (*tfplugin6.StopProvider_Response, error) {
+func (s *server) StopProvider(ctx context.Context, req *tfplugin6.StopProvider_Request) (*tfplugin6.StopProvider_Response, error) {
 	rpc := "StopProvider"
 	ctx = s.loggingContext(ctx)
 	ctx = logging.RpcContext(ctx, rpc)
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tftypes/attribute_path.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tftypes/attribute_path.go
index d6108d4ab33..809cc99f666 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tftypes/attribute_path.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tftypes/attribute_path.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tftypes
 
 import (
@@ -77,14 +80,20 @@ func (a *AttributePath) String() string {
 // AttributePaths are considered equal if they have the same number of steps,
 // the steps are all the same types, and the steps have all the same values.
 func (a *AttributePath) Equal(o *AttributePath) bool {
-	if len(a.Steps()) == 0 && len(o.Steps()) == 0 {
-		return true
+	if a == nil {
+		return o == nil || len(o.steps) == 0
 	}
-	if len(a.Steps()) != len(o.Steps()) {
+
+	if o == nil {
+		return len(a.steps) == 0
+	}
+
+	if len(a.steps) != len(o.steps) {
 		return false
 	}
-	for pos, aStep := range a.Steps() {
-		oStep := o.Steps()[pos]
+
+	for pos, aStep := range a.steps {
+		oStep := o.steps[pos]
 
 		if !aStep.Equal(oStep) {
 			return false
@@ -117,63 +126,112 @@ func (a *AttributePath) NewError(err error) error {
 	}
 }
 
-// LastStep returns the last step in the path. If the path was
-// empty, nil is returned.
+// LastStep returns the last step in the path. If the path is nil or empty, nil
+// is returned.
 func (a *AttributePath) LastStep() AttributePathStep {
-	steps := a.Steps()
+	if a == nil || len(a.steps) == 0 {
+		return nil
+	}
+
+	return a.steps[len(a.steps)-1]
+}
 
-	if len(steps) == 0 {
+// NextStep returns the next step in the path. If the path is nil or empty, nil
+// is returned.
+func (a *AttributePath) NextStep() AttributePathStep {
+	if a == nil || len(a.steps) == 0 {
 		return nil
 	}
 
-	return steps[len(steps)-1]
+	return a.steps[0]
 }
 
 // WithAttributeName adds an AttributeName step to `a`, using `name` as the
 // attribute's name. `a` is copied, not modified.
 func (a *AttributePath) WithAttributeName(name string) *AttributePath {
-	steps := a.Steps()
+	if a == nil {
+		return &AttributePath{
+			steps: []AttributePathStep{AttributeName(name)},
+		}
+	}
+
+	// Avoid re-allocating larger slice
+	steps := make([]AttributePathStep, len(a.steps)+1)
+	copy(steps, a.steps)
+	steps[len(steps)-1] = AttributeName(name)
+
 	return &AttributePath{
-		steps: append(steps, AttributeName(name)),
+		steps: steps,
 	}
 }
 
 // WithElementKeyString adds an ElementKeyString step to `a`, using `key` as
 // the element's key. `a` is copied, not modified.
 func (a *AttributePath) WithElementKeyString(key string) *AttributePath {
-	steps := a.Steps()
+	if a == nil {
+		return &AttributePath{
+			steps: []AttributePathStep{ElementKeyString(key)},
+		}
+	}
+
+	// Avoid re-allocating larger slice
+	steps := make([]AttributePathStep, len(a.steps)+1)
+	copy(steps, a.steps)
+	steps[len(steps)-1] = ElementKeyString(key)
+
 	return &AttributePath{
-		steps: append(steps, ElementKeyString(key)),
+		steps: steps,
 	}
 }
 
 // WithElementKeyInt adds an ElementKeyInt step to `a`, using `key` as the
 // element's key. `a` is copied, not modified.
 func (a *AttributePath) WithElementKeyInt(key int) *AttributePath {
-	steps := a.Steps()
+	if a == nil {
+		return &AttributePath{
+			steps: []AttributePathStep{ElementKeyInt(key)},
+		}
+	}
+
+	// Avoid re-allocating larger slice
+	steps := make([]AttributePathStep, len(a.steps)+1)
+	copy(steps, a.steps)
+	steps[len(steps)-1] = ElementKeyInt(key)
+
 	return &AttributePath{
-		steps: append(steps, ElementKeyInt(key)),
+		steps: steps,
 	}
 }
 
 // WithElementKeyValue adds an ElementKeyValue to `a`, using `key` as the
 // element's key. `a` is copied, not modified.
 func (a *AttributePath) WithElementKeyValue(key Value) *AttributePath {
-	steps := a.Steps()
+	if a == nil {
+		return &AttributePath{
+			steps: []AttributePathStep{ElementKeyValue(key)},
+		}
+	}
+
+	// Avoid re-allocating larger slice
+	steps := make([]AttributePathStep, len(a.steps)+1)
+	copy(steps, a.steps)
+	steps[len(steps)-1] = ElementKeyValue(key)
+
 	return &AttributePath{
-		steps: append(steps, ElementKeyValue(key.Copy())),
+		steps: steps,
 	}
 }
 
 // WithoutLastStep removes the last step, whatever kind of step it was, from
 // `a`. `a` is copied, not modified.
 func (a *AttributePath) WithoutLastStep() *AttributePath {
-	steps := a.Steps()
-	if len(steps) == 0 {
+	if a == nil || len(a.steps) == 0 {
 		return nil
 	}
+
 	return &AttributePath{
-		steps: steps[:len(steps)-1],
+		// Paths are immutable, so this should be safe without copying.
+		steps: a.steps[:len(a.steps)-1],
 	}
 }
 
@@ -293,7 +351,7 @@ type AttributePathStepper interface {
 // types need to use the AttributePathStepper interface to tell
 // WalkAttributePath how to traverse themselves.
 func WalkAttributePath(in interface{}, path *AttributePath) (interface{}, *AttributePath, error) {
-	if len(path.Steps()) < 1 {
+	if path == nil || len(path.steps) == 0 {
 		return in, path, nil
 	}
 	stepper, ok := in.(AttributePathStepper)
@@ -303,11 +361,11 @@ func WalkAttributePath(in interface{}, path *AttributePath) (interface{}, *Attri
 			return in, path, ErrNotAttributePathStepper
 		}
 	}
-	next, err := stepper.ApplyTerraform5AttributePathStep(path.Steps()[0])
+	next, err := stepper.ApplyTerraform5AttributePathStep(path.NextStep())
 	if err != nil {
 		return in, path, err
 	}
-	return WalkAttributePath(next, &AttributePath{steps: path.Steps()[1:]})
+	return WalkAttributePath(next, NewAttributePathWithSteps(path.steps[1:]))
 }
 
 func builtinAttributePathStepper(in interface{}) (AttributePathStepper, bool) {
@@ -324,17 +382,17 @@ func builtinAttributePathStepper(in interface{}) (AttributePathStepper, bool) {
 type mapStringInterfaceAttributePathStepper map[string]interface{}
 
 func (m mapStringInterfaceAttributePathStepper) ApplyTerraform5AttributePathStep(step AttributePathStep) (interface{}, error) {
-	_, isAttributeName := step.(AttributeName)
-	_, isElementKeyString := step.(ElementKeyString)
+	attributeName, isAttributeName := step.(AttributeName)
+	elementKeyString, isElementKeyString := step.(ElementKeyString)
 	if !isAttributeName && !isElementKeyString {
 		return nil, ErrInvalidStep
 	}
 	var stepValue string
 	if isAttributeName {
-		stepValue = string(step.(AttributeName))
+		stepValue = string(attributeName)
 	}
 	if isElementKeyString {
-		stepValue = string(step.(ElementKeyString))
+		stepValue = string(elementKeyString)
 	}
 	v, ok := m[stepValue]
 	if !ok {
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tftypes/attribute_path_error.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tftypes/attribute_path_error.go
index be000207217..df887c2fd61 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tftypes/attribute_path_error.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tftypes/attribute_path_error.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tftypes
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tftypes/diff.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tftypes/diff.go
index 328b1adf67c..72486b65e59 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tftypes/diff.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tftypes/diff.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tftypes
 
 import (
@@ -122,8 +125,10 @@ func (val1 Value) Diff(val2 Value) ([]ValueDiff, error) {
 			return true, nil
 		}
 
-		// convert from an interface{} to a Value
-		value2 := value2I.(Value)
+		value2, ok := value2I.(Value)
+		if !ok {
+			return false, fmt.Errorf("unexpected type %T in Diff", value2I)
+		}
 
 		// if they're both unknown, no need to continue
 		if !value1.IsKnown() && !value2.IsKnown() {
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tftypes/doc.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tftypes/doc.go
index 414a797d96c..ea82da6e906 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tftypes/doc.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tftypes/doc.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 // Package tftypes provides a type system for Terraform configuration and state
 // values.
 //
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tftypes/list.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tftypes/list.go
index a0bc2f37009..512c7c9004a 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tftypes/list.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tftypes/list.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tftypes
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tftypes/map.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tftypes/map.go
index 7c1e7d05ae0..0d299dcbee8 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tftypes/map.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tftypes/map.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tftypes
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tftypes/object.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tftypes/object.go
index ce2bf1325c6..b901c99e01e 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tftypes/object.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tftypes/object.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tftypes
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tftypes/primitive.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tftypes/primitive.go
index 0349f414553..5a631baea2a 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tftypes/primitive.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tftypes/primitive.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tftypes
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tftypes/set.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tftypes/set.go
index 00163067ea1..e4549b5945b 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tftypes/set.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tftypes/set.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tftypes
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tftypes/tuple.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tftypes/tuple.go
index 5ca5709a340..a5c5e52390f 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tftypes/tuple.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tftypes/tuple.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tftypes
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tftypes/type.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tftypes/type.go
index 4f0e4af7c85..c5965992187 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tftypes/type.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tftypes/type.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tftypes
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tftypes/unknown_value.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tftypes/unknown_value.go
index 016d3bbe8ac..4aefe719e4c 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tftypes/unknown_value.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tftypes/unknown_value.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tftypes
 
 const (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tftypes/value.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tftypes/value.go
index f997347e2b2..b8450783963 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tftypes/value.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tftypes/value.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tftypes
 
 import (
@@ -8,7 +11,7 @@ import (
 	"strconv"
 	"strings"
 
-	msgpack "github.com/vmihailenco/msgpack/v4"
+	msgpack "github.com/vmihailenco/msgpack/v5"
 )
 
 // ValueConverter is an interface that provider-defined types can implement to
@@ -131,15 +134,17 @@ func (val Value) ApplyTerraform5AttributePathStep(step AttributePathStep) (inter
 	if !val.IsKnown() || val.IsNull() {
 		return nil, ErrInvalidStep
 	}
+
+	// Since this logic is very hot path, it is optimized to use Value
+	// implementation details rather than As() to avoid memory allocations.
 	switch s := step.(type) {
 	case AttributeName:
-		if !val.Type().Is(Object{}) {
+		if _, ok := val.Type().(Object); !ok {
 			return nil, ErrInvalidStep
 		}
-		o := map[string]Value{}
-		err := val.As(&o)
-		if err != nil {
-			return nil, err
+		o, ok := val.value.(map[string]Value)
+		if !ok {
+			return nil, fmt.Errorf("cannot convert %T into map[string]tftypes.Value", val.value)
 		}
 		res, ok := o[string(s)]
 		if !ok {
@@ -147,13 +152,12 @@ func (val Value) ApplyTerraform5AttributePathStep(step AttributePathStep) (inter
 		}
 		return res, nil
 	case ElementKeyString:
-		if !val.Type().Is(Map{}) {
+		if _, ok := val.Type().(Map); !ok {
 			return nil, ErrInvalidStep
 		}
-		m := map[string]Value{}
-		err := val.As(&m)
-		if err != nil {
-			return nil, err
+		m, ok := val.value.(map[string]Value)
+		if !ok {
+			return nil, fmt.Errorf("cannot convert %T into map[string]tftypes.Value", val.value)
 		}
 		res, ok := m[string(s)]
 		if !ok {
@@ -161,36 +165,37 @@ func (val Value) ApplyTerraform5AttributePathStep(step AttributePathStep) (inter
 		}
 		return res, nil
 	case ElementKeyInt:
-		if !val.Type().Is(List{}) && !val.Type().Is(Tuple{}) {
+		_, listOk := val.Type().(List)
+		_, tupleOk := val.Type().(Tuple)
+		if !listOk && !tupleOk {
 			return nil, ErrInvalidStep
 		}
 		if int64(s) < 0 {
 			return nil, ErrInvalidStep
 		}
-		sl := []Value{}
-		err := val.As(&sl)
-		if err != nil {
-			return nil, err
+		sl, ok := val.value.([]Value)
+		if !ok {
+			return nil, fmt.Errorf("cannot convert %T into []tftypes.Value", val.value)
 		}
 		if int64(len(sl)) <= int64(s) {
 			return nil, ErrInvalidStep
 		}
 		return sl[int64(s)], nil
 	case ElementKeyValue:
-		if !val.Type().Is(Set{}) {
+		if _, ok := val.Type().(Set); !ok {
 			return nil, ErrInvalidStep
 		}
-		sl := []Value{}
-		err := val.As(&sl)
-		if err != nil {
-			return nil, err
+		sl, ok := val.value.([]Value)
+		if !ok {
+			return nil, fmt.Errorf("cannot convert %T into []tftypes.Value", val.value)
 		}
+		stepValue := Value(s)
 		for _, el := range sl {
-			diffs, err := el.Diff(Value(s))
+			deepEqual, err := stepValue.deepEqual(el)
 			if err != nil {
 				return nil, err
 			}
-			if len(diffs) == 0 {
+			if deepEqual {
 				return el, nil
 			}
 		}
@@ -216,11 +221,11 @@ func (val Value) Equal(o Value) bool {
 	if !val.Type().Equal(o.Type()) {
 		return false
 	}
-	diff, err := val.Diff(o)
+	deepEqual, err := val.deepEqual(o)
 	if err != nil {
 		panic(err)
 	}
-	return len(diff) < 1
+	return deepEqual
 }
 
 // Copy returns a defensively-copied clone of Value that shares no underlying
@@ -299,57 +304,62 @@ func newValue(t Type, val interface{}) (Value, error) {
 		}
 	}
 
-	switch {
-	case t.Is(String):
-		v, err := valueFromString(val)
-		if err != nil {
-			return Value{}, err
-		}
-		return v, nil
-	case t.Is(Number):
-		v, err := valueFromNumber(val)
-		if err != nil {
-			return Value{}, err
-		}
-		return v, nil
-	case t.Is(Bool):
-		v, err := valueFromBool(val)
-		if err != nil {
-			return Value{}, err
-		}
-		return v, nil
-	case t.Is(Map{}):
-		v, err := valueFromMap(t.(Map).ElementType, val)
-		if err != nil {
-			return Value{}, err
+	switch typ := t.(type) {
+	case primitive:
+		switch typ.name {
+		case String.name:
+			v, err := valueFromString(val)
+			if err != nil {
+				return Value{}, err
+			}
+			return v, nil
+		case Number.name:
+			v, err := valueFromNumber(val)
+			if err != nil {
+				return Value{}, err
+			}
+			return v, nil
+		case Bool.name:
+			v, err := valueFromBool(val)
+			if err != nil {
+				return Value{}, err
+			}
+			return v, nil
+		case DynamicPseudoType.name:
+			v, err := valueFromDynamicPseudoType(val)
+			if err != nil {
+				return Value{}, err
+			}
+			return v, nil
+		default:
+			return Value{}, fmt.Errorf("unknown primitive type %v passed to tftypes.NewValue", typ)
 		}
-		return v, nil
-	case t.Is(Object{}):
-		v, err := valueFromObject(t.(Object).AttributeTypes, t.(Object).OptionalAttributes, val)
+	case Map:
+		v, err := valueFromMap(typ.ElementType, val)
 		if err != nil {
 			return Value{}, err
 		}
 		return v, nil
-	case t.Is(List{}):
-		v, err := valueFromList(t.(List).ElementType, val)
+	case Object:
+		v, err := valueFromObject(typ.AttributeTypes, typ.OptionalAttributes, val)
 		if err != nil {
 			return Value{}, err
 		}
 		return v, nil
-	case t.Is(Set{}):
-		v, err := valueFromSet(t.(Set).ElementType, val)
+	case List:
+		v, err := valueFromList(typ.ElementType, val)
 		if err != nil {
 			return Value{}, err
 		}
 		return v, nil
-	case t.Is(Tuple{}):
-		v, err := valueFromTuple(t.(Tuple).ElementTypes, val)
+	case Set:
+		v, err := valueFromSet(typ.ElementType, val)
 		if err != nil {
 			return Value{}, err
 		}
 		return v, nil
-	case t.Is(DynamicPseudoType):
-		v, err := valueFromDynamicPseudoType(val)
+	case Tuple:
+		v, err := valueFromTuple(typ.ElementTypes, val)
 		if err != nil {
 			return Value{}, err
 		}
@@ -540,6 +550,7 @@ func (val Value) IsFullyKnown() bool {
 	case primitive:
 		return true
 	case List, Set, Tuple:
+		//nolint:forcetypeassert // NewValue func validates the type
 		for _, v := range val.value.([]Value) {
 			if !v.IsFullyKnown() {
 				return false
@@ -547,6 +558,7 @@ func (val Value) IsFullyKnown() bool {
 		}
 		return true
 	case Map, Object:
+		//nolint:forcetypeassert // NewValue func validates the type
 		for _, v := range val.value.(map[string]Value) {
 			if !v.IsFullyKnown() {
 				return false
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tftypes/value_equal.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tftypes/value_equal.go
new file mode 100644
index 00000000000..8d326657a79
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tftypes/value_equal.go
@@ -0,0 +1,213 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package tftypes
+
+import (
+	"errors"
+	"fmt"
+	"math/big"
+)
+
+// deepEqual walks both Value to ensure any underlying Value are equal. This
+// logic is essentially a duplicate of Diff, however it is intended to return
+// early on any inequality and avoids memory allocations where possible.
+//
+// There might be ways to better share the internal logic of this method with
+// Diff, however that effort is reserved for a time when the effort is justified
+// over resolving the inherent compute and memory performance issues with Diff
+// when only checking for inequality.
+func (val1 Value) deepEqual(val2 Value) (bool, error) {
+	if val1.Type() == nil && val2.Type() == nil && val1.value == nil && val2.value == nil {
+		return false, nil
+	}
+
+	if (val1.Type() == nil && val2.Type() != nil) || (val1.Type() != nil && val2.Type() == nil) {
+		return false, errors.New("cannot diff value missing type")
+	}
+
+	if !val1.Type().Is(val2.Type()) {
+		return false, errors.New("Can't diff values of different types")
+	}
+
+	// Capture walk differences for returning early
+	var hasDiff bool
+
+	// make sure everything in val2 is also in val1
+	err := Walk(val2, func(path *AttributePath, _ Value) (bool, error) {
+		_, _, err := val1.walkAttributePath(path)
+
+		if err != nil && err != ErrInvalidStep {
+			return false, fmt.Errorf("Error walking %q: %w", path, err)
+		} else if err == ErrInvalidStep {
+			hasDiff = true
+
+			return false, stopWalkError
+		}
+
+		return true, nil
+	})
+
+	if err != nil {
+		return false, err
+	}
+
+	if hasDiff {
+		return false, nil
+	}
+
+	// make sure everything in val1 is also in val2 and also that it all matches
+	err = Walk(val1, func(path *AttributePath, value1 Value) (bool, error) {
+		// pull out the Value at the same path in val2
+		value2, _, err := val2.walkAttributePath(path)
+
+		if err != nil && err != ErrInvalidStep {
+			return false, fmt.Errorf("Error walking %q: %w", path, err)
+		} else if err == ErrInvalidStep {
+			hasDiff = true
+
+			return false, stopWalkError
+		}
+
+		// if they're both unknown, no need to continue
+		if !value1.IsKnown() && !value2.IsKnown() {
+			return false, nil
+		}
+
+		if value1.IsKnown() != value2.IsKnown() {
+			hasDiff = true
+
+			return false, stopWalkError
+		}
+
+		// if they're both null, no need to continue
+		if value1.IsNull() && value2.IsNull() {
+			return false, nil
+		}
+
+		if value1.IsNull() != value2.IsNull() {
+			hasDiff = true
+
+			return false, stopWalkError
+		}
+
+		// We know there are known, non-null values, time to compare them.
+		// Since this logic is very hot path, it is optimized to use type and
+		// value implementation details rather than Equal() and As()
+		// respectively, since both result in memory allocations.
+		switch typ := value1.Type().(type) {
+		case primitive:
+			switch typ.name {
+			case String.name:
+				s1, ok := value1.value.(string)
+
+				if !ok {
+					return false, fmt.Errorf("cannot convert %T into string", value1.value)
+				}
+
+				s2, ok := value2.value.(string)
+
+				if !ok {
+					return false, fmt.Errorf("cannot convert %T into string", value2.value)
+				}
+
+				if s1 != s2 {
+					hasDiff = true
+
+					return false, stopWalkError
+				}
+			case Number.name:
+				n1, ok := value1.value.(*big.Float)
+
+				if !ok {
+					return false, fmt.Errorf("cannot convert %T into *big.Float", value1.value)
+				}
+
+				n2, ok := value2.value.(*big.Float)
+
+				if !ok {
+					return false, fmt.Errorf("cannot convert %T into *big.Float", value2.value)
+				}
+
+				if n1.Cmp(n2) != 0 {
+					hasDiff = true
+
+					return false, stopWalkError
+				}
+			case Bool.name:
+				b1, ok := value1.value.(bool)
+
+				if !ok {
+					return false, fmt.Errorf("cannot convert %T into bool", value1.value)
+				}
+
+				b2, ok := value2.value.(bool)
+
+				if !ok {
+					return false, fmt.Errorf("cannot convert %T into bool", value2.value)
+				}
+
+				if b1 != b2 {
+					hasDiff = true
+
+					return false, stopWalkError
+				}
+			case DynamicPseudoType.name:
+				// Let recursion from the walk check the sub-values match
+				return true, nil
+			}
+
+			return false, nil
+		case List, Set, Tuple:
+			s1, ok := value1.value.([]Value)
+
+			if !ok {
+				return false, fmt.Errorf("cannot convert %T into []tftypes.Value", value1.value)
+			}
+
+			s2, ok := value2.value.([]Value)
+
+			if !ok {
+				return false, fmt.Errorf("cannot convert %T into []tftypes.Value", value2.value)
+			}
+
+			// we only care about if the lengths match for lists,
+			// sets, and tuples. If any of the elements differ,
+			// the recursion of the walk will find them for us.
+			if len(s1) != len(s2) {
+				hasDiff = true
+
+				return false, stopWalkError
+			}
+
+			return true, nil
+		case Map, Object:
+			m1, ok := value1.value.(map[string]Value)
+
+			if !ok {
+				return false, fmt.Errorf("cannot convert %T into map[string]tftypes.Value", value1.value)
+			}
+
+			m2, ok := value2.value.(map[string]Value)
+
+			if !ok {
+				return false, fmt.Errorf("cannot convert %T into map[string]tftypes.Value", value2.value)
+			}
+
+			// we only care about if the number of keys match for maps and
+			// objects. If any of the elements differ, the recursion of the walk
+			// will find them for us.
+			if len(m1) != len(m2) {
+				hasDiff = true
+
+				return false, stopWalkError
+			}
+
+			return true, nil
+		}
+
+		return false, fmt.Errorf("unexpected type %v in Diff at %s", value1.Type(), path)
+	})
+
+	return !hasDiff, err
+}
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tftypes/value_json.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tftypes/value_json.go
index b889b3bebf5..8a61918e2cc 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tftypes/value_json.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tftypes/value_json.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tftypes
 
 import (
@@ -65,14 +68,19 @@ func jsonUnmarshal(buf []byte, typ Type, p *AttributePath, opts ValueFromJSONOpt
 	case typ.Is(DynamicPseudoType):
 		return jsonUnmarshalDynamicPseudoType(buf, typ, p, opts)
 	case typ.Is(List{}):
+		//nolint:forcetypeassert // Is func above guarantees this type assertion
 		return jsonUnmarshalList(buf, typ.(List).ElementType, p, opts)
 	case typ.Is(Set{}):
+		//nolint:forcetypeassert // Is func above guarantees this type assertion
 		return jsonUnmarshalSet(buf, typ.(Set).ElementType, p, opts)
 	case typ.Is(Map{}):
+		//nolint:forcetypeassert // Is func above guarantees this type assertion
 		return jsonUnmarshalMap(buf, typ.(Map).ElementType, p, opts)
 	case typ.Is(Tuple{}):
+		//nolint:forcetypeassert // Is func above guarantees this type assertion
 		return jsonUnmarshalTuple(buf, typ.(Tuple).ElementTypes, p, opts)
 	case typ.Is(Object{}):
+		//nolint:forcetypeassert // Is func above guarantees this type assertion
 		return jsonUnmarshalObject(buf, typ.(Object).AttributeTypes, p, opts)
 	}
 	return Value{}, p.NewErrorf("unknown type %s", typ)
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tftypes/value_msgpack.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tftypes/value_msgpack.go
index c4047aeab2b..ed03ef9833d 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tftypes/value_msgpack.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tftypes/value_msgpack.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tftypes
 
 import (
@@ -7,8 +10,8 @@ import (
 	"math/big"
 	"sort"
 
-	msgpack "github.com/vmihailenco/msgpack/v4"
-	msgpackCodes "github.com/vmihailenco/msgpack/v4/codes"
+	msgpack "github.com/vmihailenco/msgpack/v5"
+	msgpackCodes "github.com/vmihailenco/msgpack/v5/msgpcode"
 )
 
 type msgPackUnknownType struct{}
@@ -118,14 +121,19 @@ func msgpackUnmarshal(dec *msgpack.Decoder, typ Type, path *AttributePath) (Valu
 		}
 		return NewValue(Bool, rv), nil
 	case typ.Is(List{}):
+		//nolint:forcetypeassert // Is func above guarantees this type assertion
 		return msgpackUnmarshalList(dec, typ.(List).ElementType, path)
 	case typ.Is(Set{}):
+		//nolint:forcetypeassert // Is func above guarantees this type assertion
 		return msgpackUnmarshalSet(dec, typ.(Set).ElementType, path)
 	case typ.Is(Map{}):
+		//nolint:forcetypeassert // Is func above guarantees this type assertion
 		return msgpackUnmarshalMap(dec, typ.(Map).ElementType, path)
 	case typ.Is(Tuple{}):
+		//nolint:forcetypeassert // Is func above guarantees this type assertion
 		return msgpackUnmarshalTuple(dec, typ.(Tuple).ElementTypes, path)
 	case typ.Is(Object{}):
+		//nolint:forcetypeassert // Is func above guarantees this type assertion
 		return msgpackUnmarshalObject(dec, typ.(Object).AttributeTypes, path)
 	}
 	return Value{}, path.NewErrorf("unsupported type %s", typ.String())
@@ -364,15 +372,20 @@ func marshalMsgPack(val Value, typ Type, p *AttributePath, enc *msgpack.Encoder)
 	case typ.Is(Bool):
 		return marshalMsgPackBool(val, typ, p, enc)
 	case typ.Is(List{}):
-		return marshalMsgPackList(val, typ, p, enc)
+		//nolint:forcetypeassert // Is func above guarantees this type assertion
+		return marshalMsgPackList(val, typ.(List), p, enc)
 	case typ.Is(Set{}):
-		return marshalMsgPackSet(val, typ, p, enc)
+		//nolint:forcetypeassert // Is func above guarantees this type assertion
+		return marshalMsgPackSet(val, typ.(Set), p, enc)
 	case typ.Is(Map{}):
-		return marshalMsgPackMap(val, typ, p, enc)
+		//nolint:forcetypeassert // Is func above guarantees this type assertion
+		return marshalMsgPackMap(val, typ.(Map), p, enc)
 	case typ.Is(Tuple{}):
-		return marshalMsgPackTuple(val, typ, p, enc)
+		//nolint:forcetypeassert // Is func above guarantees this type assertion
+		return marshalMsgPackTuple(val, typ.(Tuple), p, enc)
 	case typ.Is(Object{}):
-		return marshalMsgPackObject(val, typ, p, enc)
+		//nolint:forcetypeassert // Is func above guarantees this type assertion
+		return marshalMsgPackObject(val, typ.(Object), p, enc)
 	}
 	return fmt.Errorf("unknown type %s", typ)
 }
@@ -459,7 +472,7 @@ func marshalMsgPackBool(val Value, typ Type, p *AttributePath, enc *msgpack.Enco
 	return nil
 }
 
-func marshalMsgPackList(val Value, typ Type, p *AttributePath, enc *msgpack.Encoder) error {
+func marshalMsgPackList(val Value, typ List, p *AttributePath, enc *msgpack.Encoder) error {
 	l, ok := val.value.([]Value)
 	if !ok {
 		return unexpectedValueTypeError(p, l, val.value, typ)
@@ -469,7 +482,7 @@ func marshalMsgPackList(val Value, typ Type, p *AttributePath, enc *msgpack.Enco
 		return p.NewErrorf("error encoding list length: %w", err)
 	}
 	for pos, i := range l {
-		err := marshalMsgPack(i, typ.(List).ElementType, p.WithElementKeyInt(pos), enc)
+		err := marshalMsgPack(i, typ.ElementType, p.WithElementKeyInt(pos), enc)
 		if err != nil {
 			return err
 		}
@@ -477,7 +490,7 @@ func marshalMsgPackList(val Value, typ Type, p *AttributePath, enc *msgpack.Enco
 	return nil
 }
 
-func marshalMsgPackSet(val Value, typ Type, p *AttributePath, enc *msgpack.Encoder) error {
+func marshalMsgPackSet(val Value, typ Set, p *AttributePath, enc *msgpack.Encoder) error {
 	s, ok := val.value.([]Value)
 	if !ok {
 		return unexpectedValueTypeError(p, s, val.value, typ)
@@ -487,7 +500,7 @@ func marshalMsgPackSet(val Value, typ Type, p *AttributePath, enc *msgpack.Encod
 		return p.NewErrorf("error encoding set length: %w", err)
 	}
 	for _, i := range s {
-		err := marshalMsgPack(i, typ.(Set).ElementType, p.WithElementKeyValue(i), enc)
+		err := marshalMsgPack(i, typ.ElementType, p.WithElementKeyValue(i), enc)
 		if err != nil {
 			return err
 		}
@@ -495,7 +508,7 @@ func marshalMsgPackSet(val Value, typ Type, p *AttributePath, enc *msgpack.Encod
 	return nil
 }
 
-func marshalMsgPackMap(val Value, typ Type, p *AttributePath, enc *msgpack.Encoder) error {
+func marshalMsgPackMap(val Value, typ Map, p *AttributePath, enc *msgpack.Encoder) error {
 	m, ok := val.value.(map[string]Value)
 	if !ok {
 		return unexpectedValueTypeError(p, m, val.value, typ)
@@ -509,7 +522,7 @@ func marshalMsgPackMap(val Value, typ Type, p *AttributePath, enc *msgpack.Encod
 		if err != nil {
 			return p.NewErrorf("error encoding map key: %w", err)
 		}
-		err = marshalMsgPack(v, typ.(Map).ElementType, p, enc)
+		err = marshalMsgPack(v, typ.ElementType, p, enc)
 		if err != nil {
 			return err
 		}
@@ -517,12 +530,12 @@ func marshalMsgPackMap(val Value, typ Type, p *AttributePath, enc *msgpack.Encod
 	return nil
 }
 
-func marshalMsgPackTuple(val Value, typ Type, p *AttributePath, enc *msgpack.Encoder) error {
+func marshalMsgPackTuple(val Value, typ Tuple, p *AttributePath, enc *msgpack.Encoder) error {
 	t, ok := val.value.([]Value)
 	if !ok {
 		return unexpectedValueTypeError(p, t, val.value, typ)
 	}
-	types := typ.(Tuple).ElementTypes
+	types := typ.ElementTypes
 	err := enc.EncodeArrayLen(len(types))
 	if err != nil {
 		return p.NewErrorf("error encoding tuple length: %w", err)
@@ -537,12 +550,12 @@ func marshalMsgPackTuple(val Value, typ Type, p *AttributePath, enc *msgpack.Enc
 	return nil
 }
 
-func marshalMsgPackObject(val Value, typ Type, p *AttributePath, enc *msgpack.Encoder) error {
+func marshalMsgPackObject(val Value, typ Object, p *AttributePath, enc *msgpack.Encoder) error {
 	o, ok := val.value.(map[string]Value)
 	if !ok {
 		return unexpectedValueTypeError(p, o, val.value, typ)
 	}
-	types := typ.(Object).AttributeTypes
+	types := typ.AttributeTypes
 	keys := make([]string, 0, len(types))
 	for k := range types {
 		keys = append(keys, k)
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tftypes/value_walk.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tftypes/value_walk.go
new file mode 100644
index 00000000000..7e6abb60130
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tftypes/value_walk.go
@@ -0,0 +1,33 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package tftypes
+
+import "fmt"
+
+// walkAttributePath will return the Value that `path` is pointing to within the
+// Value. If an error is returned, the AttributePath returned will indicate
+// will indicate the steps that remained to be applied when the error was
+// encountered.
+//
+// This implementation, along with one for Type, could be exported to deprecate
+// the overly generic WalkAttributePath function.
+func (v Value) walkAttributePath(path *AttributePath) (Value, *AttributePath, error) {
+	if path == nil || len(path.steps) == 0 {
+		return v, path, nil
+	}
+
+	nextValueI, err := v.ApplyTerraform5AttributePathStep(path.NextStep())
+
+	if err != nil {
+		return Value{}, path, err
+	}
+
+	nextValue, ok := nextValueI.(Value)
+
+	if !ok {
+		return Value{}, path, fmt.Errorf("unknown type %T returned from tftypes.ApplyTerraform5AttributePathStep", nextValueI)
+	}
+
+	return nextValue.walkAttributePath(NewAttributePathWithSteps(path.steps[1:]))
+}
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tftypes/walk.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tftypes/walk.go
index 6b26f8ff3ed..e06a540abeb 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tftypes/walk.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-go/tftypes/walk.go
@@ -27,6 +27,18 @@ import (
 	"errors"
 )
 
+// stopWalkError is a well-known error for immediately stopping walk() without
+// returning an actual error.
+//
+// The implementation of walk() will continue walking all attributes/elements
+// within an object/collection since the boolean return value of the callback
+// function is only intended to signal whether to stop descending into the same
+// Value. Changing that behavior would be considered a breaking change.
+//
+// This could be considered for exporting to give external consumers better
+// performance.
+var stopWalkError = errors.New("walk stop requested")
+
 // Walk traverses a Value, calling the passed function for every element and
 // attribute in the Value. The AttributePath passed to the callback function
 // will identify which attribute or element is currently being surfaced by the
@@ -38,65 +50,116 @@ import (
 // not matter when the Value that has been surfaced has no elements or
 // attributes. Walk uses a depth-first traversal.
 func Walk(val Value, cb func(*AttributePath, Value) (bool, error)) error {
-	return walk(nil, val, cb)
+	_, err := walk(NewAttributePath(), val, cb)
+
+	return err
 }
 
-func walk(path *AttributePath, val Value, cb func(*AttributePath, Value) (bool, error)) error {
+// walk is the internal implementation of Walk(). It includes a bool return for
+// whether callers should continue walking any remaining Value.
+func walk(path *AttributePath, val Value, cb func(*AttributePath, Value) (bool, error)) (bool, error) {
 	shouldContinue, err := cb(path, val)
+
+	if errors.Is(err, stopWalkError) {
+		return false, nil
+	}
+
 	if err != nil {
-		return path.NewError(err)
+		return false, path.NewError(err)
 	}
+
 	if !shouldContinue {
-		return nil
+		// The callback bool return is intended to signal that this Value should
+		// no longer be descended. Changing this behavior is a breaking change.
+		// A stopWalkError can be used to signal that all remaining Value can be
+		// skipped.
+		return true, nil
 	}
 
 	if val.IsNull() || !val.IsKnown() {
-		return nil
+		return true, nil
 	}
 
-	ty := val.Type()
-	switch {
-	case ty.Is(List{}), ty.Is(Set{}), ty.Is(Tuple{}):
-		var v []Value
-		err := val.As(&v)
-		if err != nil {
-			// should never happen
-			return path.NewError(err)
+	switch val.Type().(type) {
+	case List, Tuple:
+		v, ok := val.value.([]Value)
+
+		if !ok {
+			return false, path.NewErrorf("cannot convert %T into []tftypes.Value", val.value)
 		}
+
 		for pos, el := range v {
-			if ty.Is(Set{}) {
-				path = path.WithElementKeyValue(el)
-			} else {
-				path = path.WithElementKeyInt(pos)
+			elementPath := path.WithElementKeyInt(pos)
+			shouldContinue, err := walk(elementPath, el, cb)
+
+			if err != nil {
+				return false, elementPath.NewError(err)
 			}
-			err = walk(path, el, cb)
+
+			if !shouldContinue {
+				return false, nil
+			}
+		}
+	case Map:
+		v, ok := val.value.(map[string]Value)
+
+		if !ok {
+			return false, path.NewErrorf("cannot convert %T into map[string]tftypes.Value", val.value)
+		}
+
+		for k, el := range v {
+			elementPath := path.WithElementKeyString(k)
+			shouldContinue, err := walk(elementPath, el, cb)
+
 			if err != nil {
-				return path.NewError(err)
+				return false, elementPath.NewError(err)
+			}
+
+			if !shouldContinue {
+				return false, nil
 			}
-			path = path.WithoutLastStep()
 		}
-	case ty.Is(Map{}), ty.Is(Object{}):
-		v := map[string]Value{}
-		err := val.As(&v)
-		if err != nil {
-			// should never happen
-			return err
+	case Object:
+		v, ok := val.value.(map[string]Value)
+
+		if !ok {
+			return false, path.NewErrorf("cannot convert %T into map[string]tftypes.Value", val.value)
 		}
+
 		for k, el := range v {
-			if ty.Is(Map{}) {
-				path = path.WithElementKeyString(k)
-			} else if ty.Is(Object{}) {
-				path = path.WithAttributeName(k)
+			attributePath := path.WithAttributeName(k)
+			shouldContinue, err := walk(attributePath, el, cb)
+
+			if err != nil {
+				return false, attributePath.NewError(err)
+			}
+
+			if !shouldContinue {
+				return false, nil
 			}
-			err = walk(path, el, cb)
+		}
+	case Set:
+		v, ok := val.value.([]Value)
+
+		if !ok {
+			return false, path.NewErrorf("cannot convert %T into []tftypes.Value", val.value)
+		}
+
+		for _, el := range v {
+			elementPath := path.WithElementKeyValue(el)
+			shouldContinue, err := walk(elementPath, el, cb)
+
 			if err != nil {
-				return path.NewError(err)
+				return false, elementPath.NewError(err)
+			}
+
+			if !shouldContinue {
+				return false, nil
 			}
-			path = path.WithoutLastStep()
 		}
 	}
 
-	return nil
+	return true, nil
 }
 
 // Transform uses a callback to mutate a Value. Each element or attribute will
@@ -113,85 +176,174 @@ func Transform(val Value, cb func(*AttributePath, Value) (Value, error)) (Value,
 }
 
 func transform(path *AttributePath, val Value, cb func(*AttributePath, Value) (Value, error)) (Value, error) {
-	var newVal Value
-	ty := val.Type()
-
-	if ty == nil {
+	switch val.Type().(type) {
+	case nil:
 		return val, path.NewError(errors.New("invalid transform: value missing type"))
 	}
 
-	switch {
-	case val.IsNull() || !val.IsKnown():
-		newVal = val
-	case ty.Is(List{}), ty.Is(Set{}), ty.Is(Tuple{}):
-		var v []Value
-		err := val.As(&v)
-		if err != nil {
-			return val, err
-		}
-		if len(v) == 0 {
-			newVal = val
-		} else {
-			elems := make([]Value, 0, len(v))
-			for pos, el := range v {
-				if ty.Is(Set{}) {
-					path = path.WithElementKeyValue(el)
-				} else {
-					path = path.WithElementKeyInt(pos)
-				}
-				newEl, err := transform(path, el, cb)
-				if err != nil {
-					return val, path.NewError(err)
-				}
-				elems = append(elems, newEl)
-				path = path.WithoutLastStep()
-			}
-			newVal, err = newValue(ty, elems)
-			if err != nil {
-				return val, path.NewError(err)
-			}
-		}
-	case ty.Is(Map{}), ty.Is(Object{}):
-		v := map[string]Value{}
-		err := val.As(&v)
-		if err != nil {
-			return val, err
-		}
-		if len(v) == 0 {
-			newVal = val
-		} else {
-			elems := map[string]Value{}
-			for k, el := range v {
-				if ty.Is(Map{}) {
-					path = path.WithElementKeyString(k)
-				} else {
-					path = path.WithAttributeName(k)
-				}
-				newEl, err := transform(path, el, cb)
-				if err != nil {
-					return val, path.NewError(err)
-				}
-				elems[k] = newEl
-				path = path.WithoutLastStep()
-			}
-			newVal, err = newValue(ty, elems)
-			if err != nil {
-				return val, path.NewError(err)
-			}
-		}
-	default:
-		newVal = val
+	newVal, err := transformUnderlying(path, val, cb)
+
+	if err != nil {
+		return val, err
 	}
+
 	res, err := cb(path, newVal)
+
 	if err != nil {
 		return res, path.NewError(err)
 	}
+
 	newTy := newVal.Type()
+
 	if newTy == nil {
 		return val, path.NewError(errors.New("invalid transform: new value missing type"))
 	}
-	if !newTy.UsableAs(ty) {
+
+	if !newTy.UsableAs(val.Type()) {
 		return val, path.NewError(errors.New("invalid transform: value changed type"))
 	}
+
 	return res, err
 }
+
+// transformUnderlying returns the Value with any underlying attribute or
+// element transformations completed.
+func transformUnderlying(path *AttributePath, val Value, cb func(*AttributePath, Value) (Value, error)) (Value, error) {
+	// If the Value is null or unknown, there is nothing to descend.
+	if val.IsNull() || !val.IsKnown() {
+		return val, nil
+	}
+
+	switch val.Type().(type) {
+	case List, Tuple:
+		elements, ok := val.value.([]Value)
+
+		if !ok {
+			return val, path.NewErrorf("cannot convert %T into []tftypes.Value", val.value)
+		}
+
+		if len(elements) == 0 {
+			return val, nil
+		}
+
+		newElements := make([]Value, 0, len(elements))
+
+		for index, element := range elements {
+			elementPath := path.WithElementKeyInt(index)
+
+			newElement, err := transform(elementPath, element, cb)
+
+			if err != nil {
+				return val, elementPath.NewError(err)
+			}
+
+			newElements = append(newElements, newElement)
+		}
+
+		newVal, err := newValue(val.Type(), newElements)
+
+		if err != nil {
+			return val, path.NewError(err)
+		}
+
+		return newVal, nil
+	case Map:
+		elements, ok := val.value.(map[string]Value)
+
+		if !ok {
+			return val, path.NewErrorf("cannot convert %T into map[string]tftypes.Value", val.value)
+		}
+
+		if len(elements) == 0 {
+			return val, nil
+		}
+
+		newElements := make(map[string]Value, len(elements))
+
+		for key, element := range elements {
+			elementPath := path.WithElementKeyString(key)
+
+			newElement, err := transform(elementPath, element, cb)
+
+			if err != nil {
+				return val, elementPath.NewError(err)
+			}
+
+			newElements[key] = newElement
+		}
+
+		newVal, err := newValue(val.Type(), newElements)
+
+		if err != nil {
+			return val, path.NewError(err)
+		}
+
+		return newVal, nil
+	case Object:
+		attributes, ok := val.value.(map[string]Value)
+
+		if !ok {
+			return val, path.NewErrorf("cannot convert %T into map[string]tftypes.Value", val.value)
+		}
+
+		if len(attributes) == 0 {
+			return val, nil
+		}
+
+		newAttributes := make(map[string]Value, len(attributes))
+
+		for name, attribute := range attributes {
+			attributePath := path.WithAttributeName(name)
+
+			newAttribute, err := transform(attributePath, attribute, cb)
+
+			if err != nil {
+				return val, attributePath.NewError(err)
+			}
+
+			newAttributes[name] = newAttribute
+		}
+
+		newVal, err := newValue(val.Type(), newAttributes)
+
+		if err != nil {
+			return val, path.NewError(err)
+		}
+
+		return newVal, nil
+	case Set:
+		elements, ok := val.value.([]Value)
+
+		if !ok {
+			return val, path.NewErrorf("cannot convert %T into []tftypes.Value", val.value)
+		}
+
+		if len(elements) == 0 {
+			return val, nil
+		}
+
+		newElements := make([]Value, 0, len(elements))
+
+		for _, element := range elements {
+			elementPath := path.WithElementKeyValue(element)
+
+			newElement, err := transform(elementPath, element, cb)
+
+			if err != nil {
+				return val, elementPath.NewError(err)
+			}
+
+			newElements = append(newElements, newElement)
+		}
+
+		newVal, err := newValue(val.Type(), newElements)
+
+		if err != nil {
+			return val, path.NewError(err)
+		}
+
+		return newVal, nil
+	}
+
+	return val, nil
+}
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-log/tfsdklog/levels.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-log/tfsdklog/levels.go
new file mode 100644
index 00000000000..ed475a13790
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-log/tfsdklog/levels.go
@@ -0,0 +1,81 @@
+package tfsdklog
+
+import (
+	"sync"
+
+	"github.com/hashicorp/go-hclog"
+)
+
+var (
+	// rootLevel stores the effective level of the root SDK logger during
+	// NewRootSDKLogger where the value is deterministically chosen based on
+	// environment variables, etc. This call generally happens with each new
+	// provider RPC request. If the environment variable values changed during
+	// runtime between calls, then inflight provider requests checking this
+	// value would receive the most up-to-date value which would potentially
+	// differ with the actual in-context logger level. This tradeoff would only
+	// effect the inflight requests and should not be an overall performance
+	// concern in the case of this level causing more context checks until the
+	// request is over.
+	rootLevel hclog.Level = hclog.NoLevel
+
+	// rootLevelMutex is a read-write mutex that protects rootLevel from
+	// triggering the data race detector.
+	rootLevelMutex = sync.RWMutex{}
+
+	// subsystemLevels stores the effective level of all subsystem SDK loggers
+	// during NewSubsystem where the value is deterministically chosen based on
+	// environment variables, etc. This call generally happens with each new
+	// provider RPC request. If the environment variable values changed during
+	// runtime between calls, then inflight provider requests checking this
+	// value would receive the most up-to-date value which would potentially
+	// differ with the actual in-context logger level. This tradeoff would only
+	// effect the inflight requests and should not be an overall performance
+	// concern in the case of this level causing more context checks until the
+	// request is over.
+	subsystemLevels map[string]hclog.Level = make(map[string]hclog.Level)
+
+	// subsystemLevelsMutex is a read-write mutex that protects the
+	// subsystemLevels map from concurrent read and write panics.
+	subsystemLevelsMutex = sync.RWMutex{}
+)
+
+// subsystemWouldLog returns true if the subsystem SDK logger would emit a log
+// at the given level. This is performed outside the context-based logger for
+// performance.
+func subsystemWouldLog(subsystem string, level hclog.Level) bool {
+	subsystemLevelsMutex.RLock()
+
+	setLevel, ok := subsystemLevels[subsystem]
+
+	subsystemLevelsMutex.RUnlock()
+
+	if !ok {
+		return false
+	}
+
+	return wouldLog(setLevel, level)
+}
+
+// rootWouldLog returns true if the root SDK logger would emit a log at the
+// given level. This is performed outside the context-based logger for
+// performance.
+func rootWouldLog(level hclog.Level) bool {
+	rootLevelMutex.RLock()
+
+	setLevel := rootLevel
+
+	rootLevelMutex.RUnlock()
+
+	return wouldLog(setLevel, level)
+}
+
+// wouldLog returns true if the set level would emit a log at the given
+// level. This is performed outside the context-based logger for performance.
+func wouldLog(setLevel, checkLevel hclog.Level) bool {
+	if checkLevel == hclog.Off {
+		return false
+	}
+
+	return checkLevel >= setLevel
+}
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-log/tfsdklog/sdk.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-log/tfsdklog/sdk.go
index 2891ddf29c0..4ffb2cc2f53 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-log/tfsdklog/sdk.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-log/tfsdklog/sdk.go
@@ -35,6 +35,14 @@ func NewRootSDKLogger(ctx context.Context, options ...logging.Option) context.Co
 	if opts.Level == hclog.NoLevel {
 		opts.Level = hclog.Trace
 	}
+
+	// Cache root logger level outside context for performance reasons.
+	rootLevelMutex.Lock()
+
+	rootLevel = opts.Level
+
+	rootLevelMutex.Unlock()
+
 	loggerOptions := &hclog.LoggerOptions{
 		Name:                     opts.Name,
 		Level:                    opts.Level,
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-log/tfsdklog/subsystem.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-log/tfsdklog/subsystem.go
index 4d2a1a1a54a..0aeb5463cab 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-log/tfsdklog/subsystem.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-log/tfsdklog/subsystem.go
@@ -58,6 +58,13 @@ func NewSubsystem(ctx context.Context, subsystem string, options ...logging.Opti
 		subLogger = hclog.New(subLoggerOptions)
 	}
 
+	// Cache subsystem logger level outside context for performance reasons.
+	subsystemLevelsMutex.Lock()
+
+	subsystemLevels[subsystem] = subLoggerTFLoggerOpts.Level
+
+	subsystemLevelsMutex.Unlock()
+
 	// Set the configured log level
 	if subLoggerTFLoggerOpts.Level != hclog.NoLevel {
 		subLogger.SetLevel(subLoggerTFLoggerOpts.Level)
@@ -97,6 +104,10 @@ func SubsystemSetField(ctx context.Context, subsystem, key string, value interfa
 // subsystem logger, e.g. by the `SubsystemSetField()` function, and across
 // multiple maps.
 func SubsystemTrace(ctx context.Context, subsystem, msg string, additionalFields ...map[string]interface{}) {
+	if !subsystemWouldLog(subsystem, hclog.Trace) {
+		return
+	}
+
 	logger := logging.GetSDKSubsystemLogger(ctx, subsystem)
 	if logger == nil {
 		if logging.GetSDKRootLogger(ctx) == nil {
@@ -122,6 +133,10 @@ func SubsystemTrace(ctx context.Context, subsystem, msg string, additionalFields
 // subsystem logger, e.g. by the `SubsystemSetField()` function, and across
 // multiple maps.
 func SubsystemDebug(ctx context.Context, subsystem, msg string, additionalFields ...map[string]interface{}) {
+	if !subsystemWouldLog(subsystem, hclog.Debug) {
+		return
+	}
+
 	logger := logging.GetSDKSubsystemLogger(ctx, subsystem)
 	if logger == nil {
 		if logging.GetSDKRootLogger(ctx) == nil {
@@ -147,6 +162,10 @@ func SubsystemDebug(ctx context.Context, subsystem, msg string, additionalFields
 // subsystem logger, e.g. by the `SubsystemSetField()` function, and across
 // multiple maps.
 func SubsystemInfo(ctx context.Context, subsystem, msg string, additionalFields ...map[string]interface{}) {
+	if !subsystemWouldLog(subsystem, hclog.Info) {
+		return
+	}
+
 	logger := logging.GetSDKSubsystemLogger(ctx, subsystem)
 	if logger == nil {
 		if logging.GetSDKRootLogger(ctx) == nil {
@@ -172,6 +191,10 @@ func SubsystemInfo(ctx context.Context, subsystem, msg string, additionalFields
 // subsystem logger, e.g. by the `SubsystemSetField()` function, and across
 // multiple maps.
 func SubsystemWarn(ctx context.Context, subsystem, msg string, additionalFields ...map[string]interface{}) {
+	if !subsystemWouldLog(subsystem, hclog.Warn) {
+		return
+	}
+
 	logger := logging.GetSDKSubsystemLogger(ctx, subsystem)
 	if logger == nil {
 		if logging.GetSDKRootLogger(ctx) == nil {
@@ -197,6 +220,10 @@ func SubsystemWarn(ctx context.Context, subsystem, msg string, additionalFields
 // subsystem logger, e.g. by the `SubsystemSetField()` function, and across
 // multiple maps.
 func SubsystemError(ctx context.Context, subsystem, msg string, additionalFields ...map[string]interface{}) {
+	if !subsystemWouldLog(subsystem, hclog.Error) {
+		return
+	}
+
 	logger := logging.GetSDKSubsystemLogger(ctx, subsystem)
 	if logger == nil {
 		if logging.GetSDKRootLogger(ctx) == nil {
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/diag/diagnostic.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/diag/diagnostic.go
index 3b1ced344f5..5a533042697 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/diag/diagnostic.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/diag/diagnostic.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package diag
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/diag/helpers.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/diag/helpers.go
index 08e9291784d..4f2b7a88332 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/diag/helpers.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/diag/helpers.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package diag
 
 import "fmt"
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/id/id.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/id/id.go
index f0af80efd5c..0491252c855 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/id/id.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/id/id.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package id
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/logging/logging.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/logging/logging.go
index 74eb7f6667a..ea0764d13ad 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/logging/logging.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/logging/logging.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package logging
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/logging/logging_http_transport.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/logging/logging_http_transport.go
index 335e1784e22..ca8ba4ecce9 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/logging/logging_http_transport.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/logging/logging_http_transport.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package logging
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/logging/transport.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/logging/transport.go
index bda3813d961..774bc480f69 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/logging/transport.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/logging/transport.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package logging
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource/aliases.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource/aliases.go
index 582adada891..275137d8129 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource/aliases.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource/aliases.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package resource
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource/environment_variables.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource/environment_variables.go
index fed6aa25c32..981908799e6 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource/environment_variables.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource/environment_variables.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package resource
 
 // Environment variables for acceptance testing. Additional environment
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource/json.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource/json.go
index 345abf71995..9cd6a1b9832 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource/json.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource/json.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package resource
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource/plugin.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource/plugin.go
index 120f04276b3..14d869466b5 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource/plugin.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource/plugin.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package resource
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource/state_shim.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource/state_shim.go
index 497bcc1c996..43c809f2ba6 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource/state_shim.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource/state_shim.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package resource
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource/testcase_providers.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource/testcase_providers.go
index 19a548cdb1f..9639cb04dfc 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource/testcase_providers.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource/testcase_providers.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package resource
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource/testcase_validate.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource/testcase_validate.go
index 4a4911615cb..8eb85a14abf 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource/testcase_validate.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource/testcase_validate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package resource
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource/testing.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource/testing.go
index caadc3ddc5f..a14eede9e5e 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource/testing.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource/testing.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package resource
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource/testing_config.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource/testing_config.go
index 35bfea0988d..f56c885be32 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource/testing_config.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource/testing_config.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package resource
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource/testing_new.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource/testing_new.go
index 3298ccc86a5..14b247306af 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource/testing_new.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource/testing_new.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package resource
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource/testing_new_config.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource/testing_new_config.go
index 0d4e0b0e4ae..a52008768fb 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource/testing_new_config.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource/testing_new_config.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package resource
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource/testing_new_import_state.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource/testing_new_import_state.go
index 48ec26c1ee0..4ddf56c5b28 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource/testing_new_import_state.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource/testing_new_import_state.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package resource
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource/testing_new_refresh_state.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource/testing_new_refresh_state.go
index 37ed3fc7cdd..627190a9d19 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource/testing_new_refresh_state.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource/testing_new_refresh_state.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package resource
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource/testing_sets.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource/testing_sets.go
index 3cdb4b9ecc4..8f5a731c32e 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource/testing_sets.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource/testing_sets.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 // These test helpers were developed by the AWS provider team at HashiCorp.
 
 package resource
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource/teststep_providers.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource/teststep_providers.go
index 757f8f638cf..9b759bde03a 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource/teststep_providers.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource/teststep_providers.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package resource
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource/teststep_validate.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource/teststep_validate.go
index 0ba655168c8..7dbf883b504 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource/teststep_validate.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource/teststep_validate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package resource
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry/error.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry/error.go
index d9175bdcbe1..789c712f51e 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry/error.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry/error.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package retry
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry/state.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry/state.go
index e2d8bfff40c..4780090d956 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry/state.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry/state.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package retry
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry/wait.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry/wait.go
index 913acb12d69..c8d2de14398 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry/wait.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry/wait.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package retry
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/context.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/context.go
index ed8d0964bfa..bced9ead54d 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/context.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/context.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package schema
 
 type Key string
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/core_schema.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/core_schema.go
index bb1fc1dbe54..736af218da2 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/core_schema.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/core_schema.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package schema
 
 import (
@@ -364,5 +367,5 @@ func (r *Resource) CoreConfigSchema() *configschema.Block {
 }
 
 func (r *Resource) coreConfigSchema() *configschema.Block {
-	return schemaMap(r.Schema).CoreConfigSchema()
+	return schemaMap(r.SchemaMap()).CoreConfigSchema()
 }
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/data_source_resource_shim.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/data_source_resource_shim.go
index 8d93750aede..3a01c0f32f6 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/data_source_resource_shim.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/data_source_resource_shim.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package schema
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/equal.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/equal.go
index d5e20e03889..92a02b3b3ac 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/equal.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/equal.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package schema
 
 // Equal is an interface that checks for deep equality between two objects.
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/field_reader.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/field_reader.go
index 855bc4028a1..6aae74d95b6 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/field_reader.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/field_reader.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package schema
 
 import (
@@ -81,7 +84,7 @@ func addrToSchema(addr []string, schemaMap map[string]*Schema) []*Schema {
 			case *Resource:
 				current = &Schema{
 					Type: typeObject,
-					Elem: v.Schema,
+					Elem: v.SchemaMap(),
 				}
 			case *Schema:
 				current = v
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/field_reader_config.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/field_reader_config.go
index cd4a993a35c..df317c20bb0 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/field_reader_config.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/field_reader_config.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package schema
 
 import (
@@ -300,7 +303,7 @@ func (r *ConfigFieldReader) hasComputedSubKeys(key string, schema *Schema) bool
 
 	switch t := schema.Elem.(type) {
 	case *Resource:
-		for k, schema := range t.Schema {
+		for k, schema := range t.SchemaMap() {
 			if r.Config.IsComputed(prefix + k) {
 				return true
 			}
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/field_reader_diff.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/field_reader_diff.go
index ca3b714b1dd..c9da00e9119 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/field_reader_diff.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/field_reader_diff.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package schema
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/field_reader_map.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/field_reader_map.go
index 6fa19152274..6697606c6f2 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/field_reader_map.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/field_reader_map.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package schema
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/field_reader_multi.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/field_reader_multi.go
index 89ad3a86f2b..da4c9c81500 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/field_reader_multi.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/field_reader_multi.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package schema
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/field_writer.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/field_writer.go
index 9abc41b54f4..be4fae5060e 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/field_writer.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/field_writer.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package schema
 
 // FieldWriters are responsible for writing fields by address into
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/field_writer_map.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/field_writer_map.go
index 39c708b27fa..c9147cec191 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/field_writer_map.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/field_writer_map.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package schema
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/grpc_provider.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/grpc_provider.go
index 17a0de4cc63..7fb59e082cd 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/grpc_provider.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/grpc_provider.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package schema
 
 import (
@@ -64,14 +67,47 @@ func (s *GRPCProviderServer) StopContext(ctx context.Context) context.Context {
 	return stoppable
 }
 
+func (s *GRPCProviderServer) serverCapabilities() *tfprotov5.ServerCapabilities {
+	return &tfprotov5.ServerCapabilities{
+		GetProviderSchemaOptional: true,
+	}
+}
+
+func (s *GRPCProviderServer) GetMetadata(ctx context.Context, req *tfprotov5.GetMetadataRequest) (*tfprotov5.GetMetadataResponse, error) {
+	ctx = logging.InitContext(ctx)
+
+	logging.HelperSchemaTrace(ctx, "Getting provider metadata")
+
+	resp := &tfprotov5.GetMetadataResponse{
+		DataSources:        make([]tfprotov5.DataSourceMetadata, 0, len(s.provider.DataSourcesMap)),
+		Resources:          make([]tfprotov5.ResourceMetadata, 0, len(s.provider.ResourcesMap)),
+		ServerCapabilities: s.serverCapabilities(),
+	}
+
+	for typeName := range s.provider.DataSourcesMap {
+		resp.DataSources = append(resp.DataSources, tfprotov5.DataSourceMetadata{
+			TypeName: typeName,
+		})
+	}
+
+	for typeName := range s.provider.ResourcesMap {
+		resp.Resources = append(resp.Resources, tfprotov5.ResourceMetadata{
+			TypeName: typeName,
+		})
+	}
+
+	return resp, nil
+}
+
 func (s *GRPCProviderServer) GetProviderSchema(ctx context.Context, req *tfprotov5.GetProviderSchemaRequest) (*tfprotov5.GetProviderSchemaResponse, error) {
 	ctx = logging.InitContext(ctx)
 
 	logging.HelperSchemaTrace(ctx, "Getting provider schema")
 
 	resp := &tfprotov5.GetProviderSchemaResponse{
-		ResourceSchemas:   make(map[string]*tfprotov5.Schema),
-		DataSourceSchemas: make(map[string]*tfprotov5.Schema),
+		DataSourceSchemas:  make(map[string]*tfprotov5.Schema, len(s.provider.DataSourcesMap)),
+		ResourceSchemas:    make(map[string]*tfprotov5.Schema, len(s.provider.ResourcesMap)),
+		ServerCapabilities: s.serverCapabilities(),
 	}
 
 	resp.Provider = &tfprotov5.Schema{
@@ -659,20 +695,23 @@ func (s *GRPCProviderServer) PlanResourceChange(ctx context.Context, req *tfprot
 	ctx = logging.InitContext(ctx)
 	resp := &tfprotov5.PlanResourceChangeResponse{}
 
+	res, ok := s.provider.ResourcesMap[req.TypeName]
+	if !ok {
+		resp.Diagnostics = convert.AppendProtoDiag(ctx, resp.Diagnostics, fmt.Errorf("unknown resource type: %s", req.TypeName))
+		return resp, nil
+	}
+	schemaBlock := s.getResourceSchemaBlock(req.TypeName)
+
 	// This is a signal to Terraform Core that we're doing the best we can to
 	// shim the legacy type system of the SDK onto the Terraform type system
 	// but we need it to cut us some slack. This setting should not be taken
 	// forward to any new SDK implementations, since setting it prevents us
 	// from catching certain classes of provider bug that can lead to
 	// confusing downstream errors.
-	resp.UnsafeToUseLegacyTypeSystem = true //nolint:staticcheck
-
-	res, ok := s.provider.ResourcesMap[req.TypeName]
-	if !ok {
-		resp.Diagnostics = convert.AppendProtoDiag(ctx, resp.Diagnostics, fmt.Errorf("unknown resource type: %s", req.TypeName))
-		return resp, nil
+	if !res.EnableLegacyTypeSystemPlanErrors {
+		//nolint:staticcheck // explicitly for this SDK
+		resp.UnsafeToUseLegacyTypeSystem = true
 	}
-	schemaBlock := s.getResourceSchemaBlock(req.TypeName)
 
 	priorStateVal, err := msgpack.Unmarshal(req.PriorState.MsgPack, schemaBlock.ImpliedType())
 	if err != nil {
@@ -1072,7 +1111,10 @@ func (s *GRPCProviderServer) ApplyResourceChange(ctx context.Context, req *tfpro
 	// forward to any new SDK implementations, since setting it prevents us
 	// from catching certain classes of provider bug that can lead to
 	// confusing downstream errors.
-	resp.UnsafeToUseLegacyTypeSystem = true //nolint:staticcheck
+	if !res.EnableLegacyTypeSystemApplyErrors {
+		//nolint:staticcheck // explicitly for this SDK
+		resp.UnsafeToUseLegacyTypeSystem = true
+	}
 
 	return resp, nil
 }
@@ -1300,7 +1342,7 @@ func stripResourceModifiers(r *Resource) *Resource {
 	newResource.CustomizeDiff = nil
 	newResource.Schema = map[string]*Schema{}
 
-	for k, s := range r.Schema {
+	for k, s := range r.SchemaMap() {
 		newResource.Schema[k] = stripSchema(s)
 	}
 
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/json.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/json.go
index 265099a6b6f..8cf22a51855 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/json.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/json.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package schema
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/provider.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/provider.go
index 91a21b38908..75e1a7c42e1 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/provider.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/provider.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package schema
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/resource.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/resource.go
index 28a7600b077..7564a0aff23 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/resource.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/resource.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package schema
 
 import (
@@ -53,13 +56,25 @@ var ReservedResourceFields = []string{
 // being implemented.
 type Resource struct {
 	// Schema is the structure and type information for this component. This
-	// field is required for all Resource concepts.
+	// field, or SchemaFunc, is required for all Resource concepts. To prevent
+	// storing all schema information in memory for the lifecycle of a provider,
+	// use SchemaFunc instead.
 	//
 	// The keys of this map are the names used in a practitioner configuration,
 	// such as the attribute or block name. The values describe the structure
 	// and type information of that attribute or block.
 	Schema map[string]*Schema
 
+	// SchemaFunc is the structure and type information for this component. This
+	// field, or Schema, is required for all Resource concepts. Use this field
+	// instead of Schema on top level Resource declarations to prevent storing
+	// all schema information in memory for the lifecycle of a provider.
+	//
+	// The keys of this map are the names used in a practitioner configuration,
+	// such as the attribute or block name. The values describe the structure
+	// and type information of that attribute or block.
+	SchemaFunc func() map[string]*Schema
+
 	// SchemaVersion is the version number for this resource's Schema
 	// definition. This field is only valid when the Resource is a managed
 	// resource.
@@ -580,6 +595,62 @@ type Resource struct {
 	// See github.com/hashicorp/terraform-plugin-sdk/issues/655 for more
 	// details.
 	UseJSONNumber bool
+
+	// EnableLegacyTypeSystemApplyErrors when enabled will prevent the SDK from
+	// setting the legacy type system flag in the protocol during
+	// ApplyResourceChange (Create, Update, and Delete) operations. Before
+	// enabling this setting in a production release for a resource, the
+	// resource should be exhaustively acceptance tested with the setting
+	// enabled in an environment where it is easy to clean up resources,
+	// potentially outside of Terraform, since these errors may be unavoidable
+	// in certain cases.
+	//
+	// Disabling the legacy type system protocol flag is an unsafe operation
+	// when using this SDK as there are certain unavoidable behaviors imposed
+	// by the SDK, however this option is surfaced to allow provider developers
+	// to try to discover fixable data inconsistency errors more easily.
+	// Terraform, when encountering an enabled legacy type system protocol flag,
+	// will demote certain schema and data consistency errors into warning logs
+	// containing the text "legacy plugin SDK". Some errors for errant schema
+	// definitions, such as when an attribute is not marked as Computed as
+	// expected by Terraform, can only be resolved by migrating to
+	// terraform-plugin-framework since that SDK does not impose behavior
+	// changes with it enabled. However, data-based errors typically require
+	// logic fixes that should be applicable for both SDKs to be resolved.
+	EnableLegacyTypeSystemApplyErrors bool
+
+	// EnableLegacyTypeSystemPlanErrors when enabled will prevent the SDK from
+	// setting the legacy type system flag in the protocol during
+	// PlanResourceChange operations. Before enabling this setting in a
+	// production release for a resource, the resource should be exhaustively
+	// acceptance tested with the setting enabled in an environment where it is
+	// easy to clean up resources, potentially outside of Terraform, since these
+	// errors may be unavoidable in certain cases.
+	//
+	// Disabling the legacy type system protocol flag is an unsafe operation
+	// when using this SDK as there are certain unavoidable behaviors imposed
+	// by the SDK, however this option is surfaced to allow provider developers
+	// to try to discover fixable data inconsistency errors more easily.
+	// Terraform, when encountering an enabled legacy type system protocol flag,
+	// will demote certain schema and data consistency errors into warning logs
+	// containing the text "legacy plugin SDK". Some errors for errant schema
+	// definitions, such as when an attribute is not marked as Computed as
+	// expected by Terraform, can only be resolved by migrating to
+	// terraform-plugin-framework since that SDK does not impose behavior
+	// changes with it enabled. However, data-based errors typically require
+	// logic fixes that should be applicable for both SDKs to be resolved.
+	EnableLegacyTypeSystemPlanErrors bool
+}
+
+// SchemaMap returns the schema information for this Resource whether it is
+// defined via the SchemaFunc field or Schema field. The SchemaFunc field, if
+// defined, takes precedence over the Schema field.
+func (r *Resource) SchemaMap() map[string]*Schema {
+	if r.SchemaFunc != nil {
+		return r.SchemaFunc()
+	}
+
+	return r.Schema
 }
 
 // ShimInstanceStateFromValue converts a cty.Value to a
@@ -591,7 +662,7 @@ func (r *Resource) ShimInstanceStateFromValue(state cty.Value) (*terraform.Insta
 
 	// We now rebuild the state through the ResourceData, so that the set indexes
 	// match what helper/schema expects.
-	data, err := schemaMap(r.Schema).Data(s, nil)
+	data, err := schemaMap(r.SchemaMap()).Data(s, nil)
 	if err != nil {
 		return nil, err
 	}
@@ -764,7 +835,8 @@ func (r *Resource) Apply(
 	s *terraform.InstanceState,
 	d *terraform.InstanceDiff,
 	meta interface{}) (*terraform.InstanceState, diag.Diagnostics) {
-	data, err := schemaMap(r.Schema).Data(s, d)
+	schema := schemaMap(r.SchemaMap())
+	data, err := schema.Data(s, d)
 	if err != nil {
 		return s, diag.FromErr(err)
 	}
@@ -821,7 +893,7 @@ func (r *Resource) Apply(
 		}
 
 		// Reset the data to be stateless since we just destroyed
-		data, err = schemaMap(r.Schema).Data(nil, d)
+		data, err = schema.Data(nil, d)
 		if err != nil {
 			return nil, append(diags, diag.FromErr(err)...)
 		}
@@ -865,7 +937,7 @@ func (r *Resource) Diff(
 		return nil, fmt.Errorf("[ERR] Error decoding timeout: %s", err)
 	}
 
-	instanceDiff, err := schemaMap(r.Schema).Diff(ctx, s, c, r.CustomizeDiff, meta, true)
+	instanceDiff, err := schemaMap(r.SchemaMap()).Diff(ctx, s, c, r.CustomizeDiff, meta, true)
 	if err != nil {
 		return instanceDiff, err
 	}
@@ -887,7 +959,7 @@ func (r *Resource) SimpleDiff(
 	c *terraform.ResourceConfig,
 	meta interface{}) (*terraform.InstanceDiff, error) {
 
-	instanceDiff, err := schemaMap(r.Schema).Diff(ctx, s, c, r.CustomizeDiff, meta, false)
+	instanceDiff, err := schemaMap(r.SchemaMap()).Diff(ctx, s, c, r.CustomizeDiff, meta, false)
 	if err != nil {
 		return instanceDiff, err
 	}
@@ -912,7 +984,7 @@ func (r *Resource) SimpleDiff(
 
 // Validate validates the resource configuration against the schema.
 func (r *Resource) Validate(c *terraform.ResourceConfig) diag.Diagnostics {
-	diags := schemaMap(r.Schema).Validate(c)
+	diags := schemaMap(r.SchemaMap()).Validate(c)
 
 	if r.DeprecationMessage != "" {
 		diags = append(diags, diag.Diagnostic{
@@ -934,7 +1006,7 @@ func (r *Resource) ReadDataApply(
 ) (*terraform.InstanceState, diag.Diagnostics) {
 	// Data sources are always built completely from scratch
 	// on each read, so the source state is always nil.
-	data, err := schemaMap(r.Schema).Data(nil, d)
+	data, err := schemaMap(r.SchemaMap()).Data(nil, d)
 	if err != nil {
 		return nil, diag.FromErr(err)
 	}
@@ -975,10 +1047,12 @@ func (r *Resource) RefreshWithoutUpgrade(
 		}
 	}
 
+	schema := schemaMap(r.SchemaMap())
+
 	if r.Exists != nil {
 		// Make a copy of data so that if it is modified it doesn't
 		// affect our Read later.
-		data, err := schemaMap(r.Schema).Data(s, nil)
+		data, err := schema.Data(s, nil)
 		if err != nil {
 			return s, diag.FromErr(err)
 		}
@@ -1001,7 +1075,7 @@ func (r *Resource) RefreshWithoutUpgrade(
 		}
 	}
 
-	data, err := schemaMap(r.Schema).Data(s, nil)
+	data, err := schema.Data(s, nil)
 	if err != nil {
 		return s, diag.FromErr(err)
 	}
@@ -1020,7 +1094,7 @@ func (r *Resource) RefreshWithoutUpgrade(
 		state = nil
 	}
 
-	schemaMap(r.Schema).handleDiffSuppressOnRefresh(ctx, s, state)
+	schema.handleDiffSuppressOnRefresh(ctx, s, state)
 	return r.recordCurrentSchemaVersion(state), diags
 }
 
@@ -1066,13 +1140,14 @@ func (r *Resource) InternalValidate(topSchemaMap schemaMap, writable bool) error
 		}
 	}
 
+	schema := schemaMap(r.SchemaMap())
 	tsm := topSchemaMap
 
 	if r.isTopLevel() && writable {
 		// All non-Computed attributes must be ForceNew if Update is not defined
 		if !r.updateFuncSet() {
 			nonForceNewAttrs := make([]string, 0)
-			for k, v := range r.Schema {
+			for k, v := range schema {
 				if !v.ForceNew && !v.Computed {
 					nonForceNewAttrs = append(nonForceNewAttrs, k)
 				}
@@ -1083,19 +1158,19 @@ func (r *Resource) InternalValidate(topSchemaMap schemaMap, writable bool) error
 			}
 		} else {
 			nonUpdateableAttrs := make([]string, 0)
-			for k, v := range r.Schema {
+			for k, v := range schema {
 				if v.ForceNew || v.Computed && !v.Optional {
 					nonUpdateableAttrs = append(nonUpdateableAttrs, k)
 				}
 			}
-			updateableAttrs := len(r.Schema) - len(nonUpdateableAttrs)
+			updateableAttrs := len(schema) - len(nonUpdateableAttrs)
 			if updateableAttrs == 0 {
 				return fmt.Errorf(
 					"All fields are ForceNew or Computed w/out Optional, Update is superfluous")
 			}
 		}
 
-		tsm = schemaMap(r.Schema)
+		tsm = schema
 
 		// Destroy, and Read are required
 		if !r.readFuncSet() {
@@ -1154,7 +1229,7 @@ func (r *Resource) InternalValidate(topSchemaMap schemaMap, writable bool) error
 
 	// Data source
 	if r.isTopLevel() && !writable {
-		tsm = schemaMap(r.Schema)
+		tsm = schema
 		for k := range tsm {
 			if isReservedDataSourceFieldName(k) {
 				return fmt.Errorf("%s is a reserved field name", k)
@@ -1162,6 +1237,10 @@ func (r *Resource) InternalValidate(topSchemaMap schemaMap, writable bool) error
 		}
 	}
 
+	if r.SchemaFunc != nil && r.Schema != nil {
+		return fmt.Errorf("SchemaFunc and Schema should not both be set")
+	}
+
 	// check context funcs are not set alongside their nonctx counterparts
 	if r.CreateContext != nil && r.Create != nil {
 		return fmt.Errorf("CreateContext and Create should not both be set")
@@ -1204,7 +1283,7 @@ func (r *Resource) InternalValidate(topSchemaMap schemaMap, writable bool) error
 		return fmt.Errorf("Delete and DeleteWithoutTimeout should not both be set")
 	}
 
-	return schemaMap(r.Schema).InternalValidate(tsm)
+	return schema.InternalValidate(tsm)
 }
 
 func isReservedDataSourceFieldName(name string) bool {
@@ -1251,7 +1330,7 @@ func isReservedResourceFieldName(name string) bool {
 //
 // This function is useful for unit tests and ResourceImporter functions.
 func (r *Resource) Data(s *terraform.InstanceState) *ResourceData {
-	result, err := schemaMap(r.Schema).Data(s, nil)
+	result, err := schemaMap(r.SchemaMap()).Data(s, nil)
 	if err != nil {
 		// At the time of writing, this isn't possible (Data never returns
 		// non-nil errors). We panic to find this in the future if we have to.
@@ -1278,7 +1357,7 @@ func (r *Resource) Data(s *terraform.InstanceState) *ResourceData {
 // TODO: May be able to be removed with the above ResourceData function.
 func (r *Resource) TestResourceData() *ResourceData {
 	return &ResourceData{
-		schema: r.Schema,
+		schema: r.SchemaMap(),
 	}
 }
 
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/resource_data.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/resource_data.go
index 396b5bc6f15..b7eb7d2711f 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/resource_data.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/resource_data.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package schema
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/resource_data_get_source.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/resource_data_get_source.go
index 9e4cc53e78f..0639540b47b 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/resource_data_get_source.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/resource_data_get_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package schema
 
 // This code was previously generated with a go:generate directive calling:
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/resource_diff.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/resource_diff.go
index 27575b29770..6af9490b9e0 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/resource_diff.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/resource_diff.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package schema
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/resource_importer.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/resource_importer.go
index 3b17c8e96d4..ad9a5c3b9c6 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/resource_importer.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/resource_importer.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package schema
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/resource_timeout.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/resource_timeout.go
index 93f6fc243cf..90d29e6259a 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/resource_timeout.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/resource_timeout.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package schema
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/schema.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/schema.go
index 4a3e146b60d..176288b0cd8 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/schema.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/schema.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 // schema is a high-level framework for easily writing new providers
 // for Terraform. Usage of schema is recommended over attempting to write
 // to the low-level plugin interfaces manually.
@@ -88,10 +91,6 @@ type Schema struct {
 	// Optional indicates whether the practitioner can choose to not enter
 	// a value in the configuration for this attribute. Optional cannot be used
 	// with Required.
-	//
-	// If also using Default or DefaultFunc, Computed should also be enabled,
-	// otherwise Terraform can output warning logs or "inconsistent result
-	// after apply" errors.
 	Optional bool
 
 	// Computed indicates whether the provider may return its own value for
@@ -940,7 +939,7 @@ func (m schemaMap) internalValidate(topSchemaMap schemaMap, attrsOnly bool) erro
 			case *Resource:
 				attrsOnly := attrsOnly || v.ConfigMode == SchemaConfigModeAttr
 
-				if err := schemaMap(t.Schema).internalValidate(topSchemaMap, attrsOnly); err != nil {
+				if err := schemaMap(t.SchemaMap()).internalValidate(topSchemaMap, attrsOnly); err != nil {
 					return err
 				}
 			case *Schema:
@@ -1070,7 +1069,7 @@ func checkKeysAgainstSchemaFlags(k string, keys []string, topSchemaMap schemaMap
 				return fmt.Errorf("%s configuration block reference (%s) can only be used with TypeList and MaxItems: 1 configuration blocks", k, key)
 			}
 
-			sm = schemaMap(subResource.Schema)
+			sm = subResource.SchemaMap()
 		}
 
 		if target == nil {
@@ -1260,7 +1259,7 @@ func (m schemaMap) diffList(
 	case *Resource:
 		// This is a complex resource
 		for i := 0; i < maxLen; i++ {
-			for k2, schema := range t.Schema {
+			for k2, schema := range t.SchemaMap() {
 				subK := fmt.Sprintf("%s.%d.%s", k, i, k2)
 				err := m.diff(ctx, subK, schema, diff, d, all)
 				if err != nil {
@@ -1507,7 +1506,7 @@ func (m schemaMap) diffSet(
 			switch t := schema.Elem.(type) {
 			case *Resource:
 				// This is a complex resource
-				for k2, schema := range t.Schema {
+				for k2, schema := range t.SchemaMap() {
 					subK := fmt.Sprintf("%s.%s.%s", k, code, k2)
 					err := m.diff(ctx, subK, schema, diff, d, true)
 					if err != nil {
@@ -1974,7 +1973,7 @@ func (m schemaMap) validateList(
 		switch t := schema.Elem.(type) {
 		case *Resource:
 			// This is a sub-resource
-			diags = append(diags, m.validateObject(key, t.Schema, c, p)...)
+			diags = append(diags, m.validateObject(key, t.SchemaMap(), c, p)...)
 		case *Schema:
 			diags = append(diags, m.validateType(key, raw, t, c, p)...)
 		}
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/serialize.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/serialize.go
index 0e0e3cca9e5..d629240fd38 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/serialize.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/serialize.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package schema
 
 import (
@@ -88,7 +91,7 @@ func SerializeResourceForHash(buf *bytes.Buffer, val interface{}, resource *Reso
 	if val == nil {
 		return
 	}
-	sm := resource.Schema
+	sm := resource.SchemaMap()
 	m := val.(map[string]interface{})
 	var keys []string
 	allComputed := true
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/set.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/set.go
index b937ab6e561..e897817fd30 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/set.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/set.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package schema
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/shims.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/shims.go
index 9c7f0906c64..e8baebd70cf 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/shims.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/shims.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package schema
 
 import (
@@ -40,7 +43,7 @@ func diffFromValues(ctx context.Context, prior, planned, config cty.Value, res *
 	removeConfigUnknowns(cfg.Config)
 	removeConfigUnknowns(cfg.Raw)
 
-	diff, err := schemaMap(res.Schema).Diff(ctx, instanceState, cfg, cust, nil, false)
+	diff, err := schemaMap(res.SchemaMap()).Diff(ctx, instanceState, cfg, cust, nil, false)
 	if err != nil {
 		return nil, err
 	}
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/testing.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/testing.go
index f345f832631..bdf56d9012f 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/testing.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/testing.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package schema
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/unknown.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/unknown.go
index c58d3648ab4..1089e4d2d79 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/unknown.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/unknown.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package schema
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/valuetype.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/valuetype.go
index 2b355cc9ca1..2563ff84106 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/valuetype.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema/valuetype.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package schema
 
 // This code was previously generated with a go:generate directive calling:
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/structure/expand_json.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/structure/expand_json.go
index b3eb90fdff5..520afeffcb2 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/structure/expand_json.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/structure/expand_json.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package structure
 
 import "encoding/json"
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/structure/flatten_json.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/structure/flatten_json.go
index 578ad2eade3..d0913ac65fc 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/structure/flatten_json.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/structure/flatten_json.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package structure
 
 import "encoding/json"
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/structure/normalize_json.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/structure/normalize_json.go
index 3256b476dd0..0521420849b 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/structure/normalize_json.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/structure/normalize_json.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package structure
 
 import "encoding/json"
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/structure/suppress_json_diff.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/structure/suppress_json_diff.go
index c99b73846ee..c610616374c 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/structure/suppress_json_diff.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/structure/suppress_json_diff.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package structure
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation/float.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation/float.go
index 05a30531e2d..dfc261842d3 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation/float.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation/float.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package validation
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation/int.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation/int.go
index f2738201cc0..2873897f276 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation/int.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation/int.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package validation
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation/list.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation/list.go
index 75702b5b8a3..9f0eb4b65d6 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation/list.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation/list.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package validation
 
 import "fmt"
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation/map.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation/map.go
index 9e4510b1e55..7c925090541 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation/map.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation/map.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package validation
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation/meta.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation/meta.go
index b0515c8d085..941476429c2 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation/meta.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation/meta.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package validation
 
 import (
@@ -42,6 +45,18 @@ func All(validators ...schema.SchemaValidateFunc) schema.SchemaValidateFunc {
 	}
 }
 
+// AllDiag returns a SchemaValidateDiagFunc which tests if the provided value
+// passes all provided SchemaValidateDiagFunc
+func AllDiag(validators ...schema.SchemaValidateDiagFunc) schema.SchemaValidateDiagFunc {
+	return func(i interface{}, k cty.Path) diag.Diagnostics {
+		var diags diag.Diagnostics
+		for _, validator := range validators {
+			diags = append(diags, validator(i, k)...)
+		}
+		return diags
+	}
+}
+
 // Any returns a SchemaValidateFunc which tests if the provided value
 // passes any of the provided SchemaValidateFunc
 func Any(validators ...schema.SchemaValidateFunc) schema.SchemaValidateFunc {
@@ -60,6 +75,22 @@ func Any(validators ...schema.SchemaValidateFunc) schema.SchemaValidateFunc {
 	}
 }
 
+// AnyDiag returns a SchemaValidateDiagFunc which tests if the provided value
+// passes any of the provided SchemaValidateDiagFunc
+func AnyDiag(validators ...schema.SchemaValidateDiagFunc) schema.SchemaValidateDiagFunc {
+	return func(i interface{}, k cty.Path) diag.Diagnostics {
+		var diags diag.Diagnostics
+		for _, validator := range validators {
+			validatorDiags := validator(i, k)
+			if len(validatorDiags) == 0 {
+				return diag.Diagnostics{}
+			}
+			diags = append(diags, validatorDiags...)
+		}
+		return diags
+	}
+}
+
 // ToDiagFunc is a wrapper for legacy schema.SchemaValidateFunc
 // converting it to schema.SchemaValidateDiagFunc
 func ToDiagFunc(validator schema.SchemaValidateFunc) schema.SchemaValidateDiagFunc {
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation/network.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation/network.go
index 8aa7139a004..9bc6da2b8ee 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation/network.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation/network.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package validation
 
 import (
@@ -89,7 +92,7 @@ func IsCIDR(i interface{}, k string) (warnings []string, errors []error) {
 	}
 
 	if _, _, err := net.ParseCIDR(v); err != nil {
-		errors = append(errors, fmt.Errorf("expected %q to be a valid IPv4 Value, got %v: %v", k, i, err))
+		errors = append(errors, fmt.Errorf("expected %q to be a valid CIDR Value, got %v: %v", k, i, err))
 	}
 
 	return warnings, errors
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation/strings.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation/strings.go
index e739a1a1bfa..375a698f2c2 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation/strings.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation/strings.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package validation
 
 import (
@@ -143,7 +146,7 @@ func StringInSlice(valid []string, ignoreCase bool) schema.SchemaValidateFunc {
 			}
 		}
 
-		errors = append(errors, fmt.Errorf("expected %s to be one of %v, got %s", k, valid, v))
+		errors = append(errors, fmt.Errorf("expected %s to be one of %q, got %s", k, valid, v))
 		return warnings, errors
 	}
 }
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation/testing.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation/testing.go
index d861f5a2af9..a5aa6e04549 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation/testing.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation/testing.go
@@ -1,9 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package validation
 
 import (
+	"fmt"
 	"regexp"
+	"testing"
 
-	testing "github.com/mitchellh/go-testing-interface"
+	"github.com/hashicorp/go-cty/cty"
 
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
@@ -15,23 +20,53 @@ type testCase struct {
 	expectedErr *regexp.Regexp
 }
 
-func runTestCases(t testing.T, cases []testCase) {
+func runTestCases(t *testing.T, cases []testCase) {
 	t.Helper()
 
 	for i, tc := range cases {
-		_, errs := tc.f(tc.val, "test_property")
+		t.Run(fmt.Sprintf("TestCase_%d", i), func(t *testing.T) {
+			_, errs := tc.f(tc.val, "test_property")
 
-		if len(errs) == 0 && tc.expectedErr == nil {
-			continue
-		}
+			if len(errs) == 0 && tc.expectedErr == nil {
+				return
+			}
 
-		if len(errs) != 0 && tc.expectedErr == nil {
-			t.Fatalf("expected test case %d to produce no errors, got %v", i, errs)
-		}
+			if len(errs) != 0 && tc.expectedErr == nil {
+				t.Fatalf("expected test case %d to produce no errors, got %v", i, errs)
+			}
 
-		if !matchAnyError(errs, tc.expectedErr) {
-			t.Fatalf("expected test case %d to produce error matching \"%s\", got %v", i, tc.expectedErr, errs)
-		}
+			if !matchAnyError(errs, tc.expectedErr) {
+				t.Fatalf("expected test case %d to produce error matching \"%s\", got %v", i, tc.expectedErr, errs)
+			}
+		})
+	}
+}
+
+type diagTestCase struct {
+	val                 interface{}
+	f                   schema.SchemaValidateDiagFunc
+	expectedDiagSummary *regexp.Regexp
+}
+
+func runDiagTestCases(t *testing.T, cases []diagTestCase) {
+	t.Helper()
+
+	for i, tc := range cases {
+		t.Run(fmt.Sprintf("TestCase_%d", i), func(t *testing.T) {
+			diags := tc.f(tc.val, cty.GetAttrPath("test_property"))
+
+			if len(diags) == 0 && tc.expectedDiagSummary == nil {
+				return
+			}
+
+			if len(diags) != 0 && tc.expectedDiagSummary == nil {
+				t.Fatalf("expected test case %d to produce no diagnostics, got %v", i, diags)
+			}
+
+			if !matchAnyDiagSummary(diags, tc.expectedDiagSummary) {
+				t.Fatalf("expected test case %d to produce diagnostic summary matching \"%s\", got %v", i, tc.expectedDiagSummary, diags)
+			}
+		})
 	}
 }
 
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation/time.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation/time.go
index fde3a019923..940a9ec1cf3 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation/time.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation/time.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package validation
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation/uuid.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation/uuid.go
index 00783fafce8..91122ce714d 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation/uuid.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation/uuid.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package validation
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation/web.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation/web.go
index 615e0feb7c1..2e875442f4d 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation/web.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation/web.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package validation
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/addrs/doc.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/addrs/doc.go
index 46093314fe2..0d29d9f4563 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/addrs/doc.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/addrs/doc.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 // Package addrs contains types that represent "addresses", which are
 // references to specific objects within a Terraform configuration or
 // state.
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/addrs/instance_key.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/addrs/instance_key.go
index 064aeda28c3..8373297f876 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/addrs/instance_key.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/addrs/instance_key.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package addrs
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/addrs/module.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/addrs/module.go
index 98699f46e27..8dbbb469d48 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/addrs/module.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/addrs/module.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package addrs
 
 // Module is an address for a module call within configuration. This is
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/addrs/module_instance.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/addrs/module_instance.go
index 113d3d675ab..12cd83051a7 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/addrs/module_instance.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/addrs/module_instance.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package addrs
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/configs/configschema/coerce_value.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/configs/configschema/coerce_value.go
index 48278abed25..d12ff8cced9 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/configs/configschema/coerce_value.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/configs/configschema/coerce_value.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package configschema
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/configs/configschema/doc.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/configs/configschema/doc.go
index caf8d730c1e..d96be9c7f0f 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/configs/configschema/doc.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/configs/configschema/doc.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 // Package configschema contains types for describing the expected structure
 // of a configuration block whose shape is not known until runtime.
 //
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/configs/configschema/empty_value.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/configs/configschema/empty_value.go
index 51b8c5d24c0..3c9573bc56a 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/configs/configschema/empty_value.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/configs/configschema/empty_value.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package configschema
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/configs/configschema/implied_type.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/configs/configschema/implied_type.go
index edc9dadccee..4de413519f6 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/configs/configschema/implied_type.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/configs/configschema/implied_type.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package configschema
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/configs/configschema/schema.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/configs/configschema/schema.go
index c41751b71ca..c445b4ba55e 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/configs/configschema/schema.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/configs/configschema/schema.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package configschema
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/configs/hcl2shim/flatmap.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/configs/hcl2shim/flatmap.go
index b96e17c5853..2bad034de94 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/configs/hcl2shim/flatmap.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/configs/hcl2shim/flatmap.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package hcl2shim
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/configs/hcl2shim/paths.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/configs/hcl2shim/paths.go
index e557845a703..628a8bf6868 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/configs/hcl2shim/paths.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/configs/hcl2shim/paths.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package hcl2shim
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/configs/hcl2shim/values.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/configs/hcl2shim/values.go
index 91e91547a85..f5f5de3b259 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/configs/hcl2shim/values.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/configs/hcl2shim/values.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package hcl2shim
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/configs/hcl2shim/values_equiv.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/configs/hcl2shim/values_equiv.go
index 87638b4e499..6b2be2239d3 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/configs/hcl2shim/values_equiv.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/configs/hcl2shim/values_equiv.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package hcl2shim
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/helper/hashcode/hashcode.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/helper/hashcode/hashcode.go
index 6ccc5231834..97bc709b2a7 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/helper/hashcode/hashcode.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/helper/hashcode/hashcode.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package hashcode
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/logging/context.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/logging/context.go
index 6036b0d0446..0fe8002aa7a 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/logging/context.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/logging/context.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package logging
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/logging/environment_variables.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/logging/environment_variables.go
index db1a27a8147..2ffc73eee6c 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/logging/environment_variables.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/logging/environment_variables.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package logging
 
 // Environment variables.
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/logging/helper_resource.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/logging/helper_resource.go
index a889601c7c4..1b1459f2461 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/logging/helper_resource.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/logging/helper_resource.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package logging
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/logging/helper_schema.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/logging/helper_schema.go
index b2fe71d15d6..0ecf6bf2e48 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/logging/helper_schema.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/logging/helper_schema.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package logging
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/logging/keys.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/logging/keys.go
index ad510721847..983fde437a2 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/logging/keys.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/logging/keys.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package logging
 
 // Structured logging keys.
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/plans/objchange/normalize_obj.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/plans/objchange/normalize_obj.go
index d6aabbe3382..b888237fc29 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/plans/objchange/normalize_obj.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/plans/objchange/normalize_obj.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package objchange
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/plugin/convert/diagnostics.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/plugin/convert/diagnostics.go
index e02c1e44394..672f75e6d83 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/plugin/convert/diagnostics.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/plugin/convert/diagnostics.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package convert
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/plugin/convert/schema.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/plugin/convert/schema.go
index 07d0b89783c..e2b4e431ce9 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/plugin/convert/schema.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/plugin/convert/schema.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package convert
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/plugintest/config.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/plugintest/config.go
index 920c4716558..d3cb35bcec9 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/plugintest/config.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/plugintest/config.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package plugintest
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/plugintest/doc.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/plugintest/doc.go
index 3f84c6a37e4..1b34a0b233e 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/plugintest/doc.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/plugintest/doc.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 // Package plugintest contains utilities to help with writing tests for
 // Terraform plugins.
 //
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/plugintest/environment_variables.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/plugintest/environment_variables.go
index 6fd001a07d0..6df86f89f8c 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/plugintest/environment_variables.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/plugintest/environment_variables.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package plugintest
 
 // Environment variables
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/plugintest/guard.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/plugintest/guard.go
index ad796be08c6..77f87398009 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/plugintest/guard.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/plugintest/guard.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package plugintest
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/plugintest/helper.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/plugintest/helper.go
index bfe89e1b9ea..f9617887218 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/plugintest/helper.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/plugintest/helper.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package plugintest
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/plugintest/util.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/plugintest/util.go
index c77a9cb0827..0d4bbe52667 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/plugintest/util.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/plugintest/util.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package plugintest
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/plugintest/working_dir.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/plugintest/working_dir.go
index dba079eb266..05b02844206 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/plugintest/working_dir.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/plugintest/working_dir.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package plugintest
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/tfdiags/config_traversals.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/tfdiags/config_traversals.go
index 2201d0c0bef..6208117cbff 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/tfdiags/config_traversals.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/tfdiags/config_traversals.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tfdiags
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/tfdiags/contextual.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/tfdiags/contextual.go
index b063bc1de23..a9b5c7e83e8 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/tfdiags/contextual.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/tfdiags/contextual.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tfdiags
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/tfdiags/diagnostic.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/tfdiags/diagnostic.go
index 21fb177262f..547271346aa 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/tfdiags/diagnostic.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/tfdiags/diagnostic.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tfdiags
 
 type Diagnostic interface {
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/tfdiags/diagnostic_base.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/tfdiags/diagnostic_base.go
index 34816208786..505692ce51a 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/tfdiags/diagnostic_base.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/tfdiags/diagnostic_base.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tfdiags
 
 // diagnosticBase can be embedded in other diagnostic structs to get
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/tfdiags/diagnostics.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/tfdiags/diagnostics.go
index 2e04b72a629..4fc99c1bb70 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/tfdiags/diagnostics.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/tfdiags/diagnostics.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tfdiags
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/tfdiags/doc.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/tfdiags/doc.go
index c427879ebc7..23be0a8bece 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/tfdiags/doc.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/tfdiags/doc.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 // Package tfdiags is a utility package for representing errors and
 // warnings in a manner that allows us to produce good messages for the
 // user.
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/tfdiags/error.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/tfdiags/error.go
index b63c5d74150..f7c9c65d382 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/tfdiags/error.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/tfdiags/error.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tfdiags
 
 // nativeError is a Diagnostic implementation that wraps a normal Go error
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/tfdiags/simple_warning.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/tfdiags/simple_warning.go
index 0919170456c..0c90c478891 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/tfdiags/simple_warning.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/internal/tfdiags/simple_warning.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tfdiags
 
 type simpleWarning string
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/meta/meta.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/meta/meta.go
index 35f20f7ee53..494f61ce1bd 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/meta/meta.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/meta/meta.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 // The meta package provides a location to set the release version
 // and any other relevant metadata for the SDK.
 //
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/plugin/debug.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/plugin/debug.go
index e1875e134cb..3e33dfed6b9 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/plugin/debug.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/plugin/debug.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package plugin
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/plugin/serve.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/plugin/serve.go
index cce6212b159..f089ab5215b 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/plugin/serve.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/plugin/serve.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package plugin
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/terraform/diff.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/terraform/diff.go
index 8a2940f31e2..7b988d9f3dc 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/terraform/diff.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/terraform/diff.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package terraform
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/terraform/instancetype.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/terraform/instancetype.go
index c0d1288f00b..1871445819a 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/terraform/instancetype.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/terraform/instancetype.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package terraform
 
 // This code was previously generated with a go:generate directive calling:
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/terraform/resource.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/terraform/resource.go
index 703547745e8..0da593711b9 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/terraform/resource.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/terraform/resource.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package terraform
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/terraform/resource_address.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/terraform/resource_address.go
index ec2665d3133..8d92fbb5e45 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/terraform/resource_address.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/terraform/resource_address.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package terraform
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/terraform/resource_mode.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/terraform/resource_mode.go
index d2a806c0ba9..2d7b10bcff7 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/terraform/resource_mode.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/terraform/resource_mode.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package terraform
 
 // This code was previously generated with a go:generate directive calling:
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/terraform/resource_provider.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/terraform/resource_provider.go
index ece8fc66042..c8e7008c0a8 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/terraform/resource_provider.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/terraform/resource_provider.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package terraform
 
 // ResourceType is a type of resource that a resource provider can manage.
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/terraform/schemas.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/terraform/schemas.go
index 07e5a84fa1d..86ad0e7f1cf 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/terraform/schemas.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/terraform/schemas.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package terraform
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/terraform/state.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/terraform/state.go
index 1a4d3d6d112..9357070b401 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/terraform/state.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/terraform/state.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package terraform
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/terraform/state_filter.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/terraform/state_filter.go
index d2229f8ce76..caf2c79674b 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/terraform/state_filter.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/terraform/state_filter.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package terraform
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/terraform/util.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/terraform/util.go
index 01ac810f103..6353ad27d95 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/terraform/util.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-plugin-sdk/v2/terraform/util.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package terraform
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-registry-address/.copywrite.hcl b/.ci/providerlint/vendor/github.com/hashicorp/terraform-registry-address/.copywrite.hcl
new file mode 100644
index 00000000000..235a80dc462
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-registry-address/.copywrite.hcl
@@ -0,0 +1,7 @@
+schema_version = 1
+
+project {
+  license        = "MPL-2.0"
+  copyright_year = 2021
+  header_ignore  = []
+}
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-registry-address/.go-version b/.ci/providerlint/vendor/github.com/hashicorp/terraform-registry-address/.go-version
index adc97d8e221..bc4493477ae 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-registry-address/.go-version
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-registry-address/.go-version
@@ -1 +1 @@
-1.18
+1.19
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-registry-address/errors.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-registry-address/errors.go
index 1ca735383a6..cf977115a55 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-registry-address/errors.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-registry-address/errors.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tfaddr
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-registry-address/module.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-registry-address/module.go
index 6af0c5976b5..f000a7410ee 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-registry-address/module.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-registry-address/module.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tfaddr
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-registry-address/module_package.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-registry-address/module_package.go
index d8ad2534a09..be065966138 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-registry-address/module_package.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-registry-address/module_package.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tfaddr
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-registry-address/provider.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-registry-address/provider.go
index 23e1e221f2f..7fb252ea222 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-registry-address/provider.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-registry-address/provider.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tfaddr
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-svchost/CHANGELOG.md b/.ci/providerlint/vendor/github.com/hashicorp/terraform-svchost/CHANGELOG.md
new file mode 100644
index 00000000000..ed9f9932a93
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-svchost/CHANGELOG.md
@@ -0,0 +1,13 @@
+## v0.1.1
+
+The `disco.Disco` and `auth.CachingCredentialsSource` implementations are now safe for concurrent calls. Previously concurrent calls could potentially corrupt the internal cache maps or cause the Go runtime to panic.
+
+## v0.1.0
+
+#### Features:
+
+- Adds hostname `Alias` method to service discovery, making it possible to interpret one hostname as another.
+
+## v0.0.1
+
+Initial release
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-svchost/CONTRIBUTING.md b/.ci/providerlint/vendor/github.com/hashicorp/terraform-svchost/CONTRIBUTING.md
new file mode 100644
index 00000000000..c12e3bb41a7
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-svchost/CONTRIBUTING.md
@@ -0,0 +1,3 @@
+# Contributing to the svchost library
+
+If you find an issue or would like to add a feature, please add an issue in GitHub. We welcome your contributions - fork the repo and submit a pull request.
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-svchost/LICENSE b/.ci/providerlint/vendor/github.com/hashicorp/terraform-svchost/LICENSE
index 82b4de97c7e..342bbb5bb91 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-svchost/LICENSE
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-svchost/LICENSE
@@ -1,3 +1,5 @@
+Copyright (c) 2019 HashiCorp, Inc.
+
 Mozilla Public License, version 2.0
 
 1. Definitions
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-svchost/README.md b/.ci/providerlint/vendor/github.com/hashicorp/terraform-svchost/README.md
new file mode 100644
index 00000000000..3a12f013be4
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-svchost/README.md
@@ -0,0 +1,9 @@
+# terraform-svchost
+
+[![CI Tests](https://github.com/hashicorp/terraform-svchost/actions/workflows/ci.yml/badge.svg?branch=main)](https://github.com/hashicorp/terraform-svchost/actions/workflows/ci.yml)
+[![GitHub license](https://img.shields.io/github/license/hashicorp/terraform-svchost.svg)](https://github.com/hashicorp/terraform-svchost/blob/main/LICENSE)
+[![GoDoc](https://godoc.org/github.com/hashicorp/terraform-svchost?status.svg)](https://godoc.org/github.com/hashicorp/terraform-svchost)
+[![Go Report Card](https://goreportcard.com/badge/github.com/hashicorp/terraform-svchost)](https://goreportcard.com/report/github.com/hashicorp/terraform-svchost)
+[![GitHub issues](https://img.shields.io/github/issues/hashicorp/terraform-svchost.svg)](https://github.com/hashicorp/terraform-svchost/issues)
+
+This package provides friendly hostnames, and is used by [terraform](https://github.com/hashicorp/terraform).
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-svchost/label_iter.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-svchost/label_iter.go
index af8ccbab208..eb875681445 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-svchost/label_iter.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-svchost/label_iter.go
@@ -1,3 +1,5 @@
+// Copyright (c) HashiCorp, Inc.
+
 package svchost
 
 import (
diff --git a/.ci/providerlint/vendor/github.com/hashicorp/terraform-svchost/svchost.go b/.ci/providerlint/vendor/github.com/hashicorp/terraform-svchost/svchost.go
index 4060b767e58..45a702978ef 100644
--- a/.ci/providerlint/vendor/github.com/hashicorp/terraform-svchost/svchost.go
+++ b/.ci/providerlint/vendor/github.com/hashicorp/terraform-svchost/svchost.go
@@ -1,3 +1,5 @@
+// Copyright (c) HashiCorp, Inc.
+
 // Package svchost deals with the representations of the so-called "friendly
 // hostnames" that we use to represent systems that provide Terraform-native
 // remote services, such as module registry, remote operations, etc.
@@ -101,6 +103,18 @@ func ForComparison(given string) (Hostname, error) {
 	var err error
 	portPortion, err = normalizePortPortion(portPortion)
 	if err != nil {
+		// We can get in here if someone has incorrectly specified a URL
+		// instead of a hostname, because normalizePortPortion will try to
+		// treat the colon after the scheme as the port number separator.
+		// We'll return a more specific error message for that situation.
+		given = strings.ToLower(given)
+		if given == "https" || given == "http" {
+			// Technically it's valid to have a host called "https" or "http"
+			// which would generate a false positive here with input like
+			// "http:foo", but we can only get here if the hostname exactly
+			// matches one of the schemes _and_ the port number is also invalid.
+			return Hostname(""), fmt.Errorf("need just a hostname and optional port number, not a full URL")
+		}
 		return Hostname(""), err
 	}
 
diff --git a/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v4/.golangci.yml b/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v4/.golangci.yml
deleted file mode 100644
index 98d6cb7797f..00000000000
--- a/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v4/.golangci.yml
+++ /dev/null
@@ -1,12 +0,0 @@
-run:
-  concurrency: 8
-  deadline: 5m
-  tests: false
-linters:
-  enable-all: true
-  disable:
-    - gochecknoglobals
-    - gocognit
-    - godox
-    - wsl
-    - funlen
diff --git a/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v4/.travis.yml b/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v4/.travis.yml
deleted file mode 100644
index b35bf5484e7..00000000000
--- a/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v4/.travis.yml
+++ /dev/null
@@ -1,21 +0,0 @@
-sudo: false
-language: go
-
-go:
-  - 1.11.x
-  - 1.12.x
-  - 1.13.x
-  - 1.14.x
-  - tip
-
-matrix:
-  allow_failures:
-    - go: tip
-
-env:
-  - GO111MODULE=on
-
-go_import_path: github.com/vmihailenco/msgpack
-
-before_install:
-  - curl -sfL https://install.goreleaser.com/github.com/golangci/golangci-lint.sh | sh -s -- -b $(go env GOPATH)/bin v1.21.0
diff --git a/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v4/CHANGELOG.md b/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v4/CHANGELOG.md
deleted file mode 100644
index fac97090e45..00000000000
--- a/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v4/CHANGELOG.md
+++ /dev/null
@@ -1,24 +0,0 @@
-## v4
-
-- Encode, Decode, Marshal, and Unmarshal are changed to accept single argument. EncodeMulti and DecodeMulti are added as replacement.
-- Added EncodeInt8/16/32/64 and EncodeUint8/16/32/64.
-- Encoder changed to preserve type of numbers instead of chosing most compact encoding. The old behavior can be achieved with Encoder.UseCompactEncoding.
-
-## v3.3
-
-- `msgpack:",inline"` tag is restored to force inlining structs.
-
-## v3.2
-
-- Decoding extension types returns pointer to the value instead of the value. Fixes #153
-
-## v3
-
-- gopkg.in is not supported any more. Update import path to github.com/vmihailenco/msgpack.
-- Msgpack maps are decoded into map[string]interface{} by default.
-- EncodeSliceLen is removed in favor of EncodeArrayLen. DecodeSliceLen is removed in favor of DecodeArrayLen.
-- Embedded structs are automatically inlined where possible.
-- Time is encoded using extension as described in https://github.com/msgpack/msgpack/pull/209. Old format is supported as well.
-- EncodeInt8/16/32/64 is replaced with EncodeInt. EncodeUint8/16/32/64 is replaced with EncodeUint. There should be no performance differences.
-- DecodeInterface can now return int8/16/32 and uint8/16/32.
-- PeekCode returns codes.Code instead of byte.
diff --git a/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v4/Makefile b/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v4/Makefile
deleted file mode 100644
index 57914e333a8..00000000000
--- a/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v4/Makefile
+++ /dev/null
@@ -1,6 +0,0 @@
-all:
-	go test ./...
-	go test ./... -short -race
-	go test ./... -run=NONE -bench=. -benchmem
-	env GOOS=linux GOARCH=386 go test ./...
-	golangci-lint run
diff --git a/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v4/README.md b/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v4/README.md
deleted file mode 100644
index a5b1004e08c..00000000000
--- a/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v4/README.md
+++ /dev/null
@@ -1,72 +0,0 @@
-# MessagePack encoding for Golang
-
-[![Build Status](https://travis-ci.org/vmihailenco/msgpack.svg?branch=v2)](https://travis-ci.org/vmihailenco/msgpack)
-[![GoDoc](https://godoc.org/github.com/vmihailenco/msgpack?status.svg)](https://godoc.org/github.com/vmihailenco/msgpack)
-
-Supports:
-- Primitives, arrays, maps, structs, time.Time and interface{}.
-- Appengine *datastore.Key and datastore.Cursor.
-- [CustomEncoder](https://godoc.org/github.com/vmihailenco/msgpack#example-CustomEncoder)/CustomDecoder interfaces for custom encoding.
-- [Extensions](https://godoc.org/github.com/vmihailenco/msgpack#example-RegisterExt) to encode type information.
-- Renaming fields via `msgpack:"my_field_name"` and alias via `msgpack:"alias:another_name"`.
-- Omitting individual empty fields via `msgpack:",omitempty"` tag or all [empty fields in a struct](https://godoc.org/github.com/vmihailenco/msgpack#example-Marshal--OmitEmpty).
-- [Map keys sorting](https://godoc.org/github.com/vmihailenco/msgpack#Encoder.SortMapKeys).
-- Encoding/decoding all [structs as arrays](https://godoc.org/github.com/vmihailenco/msgpack#Encoder.UseArrayForStructs) or [individual structs](https://godoc.org/github.com/vmihailenco/msgpack#example-Marshal--AsArray).
-- [Encoder.UseJSONTag](https://godoc.org/github.com/vmihailenco/msgpack#Encoder.UseJSONTag) with [Decoder.UseJSONTag](https://godoc.org/github.com/vmihailenco/msgpack#Decoder.UseJSONTag) can turn msgpack into drop-in replacement for JSON.
-- Simple but very fast and efficient [queries](https://godoc.org/github.com/vmihailenco/msgpack#example-Decoder-Query).
-
-API docs: https://godoc.org/github.com/vmihailenco/msgpack.
-Examples: https://godoc.org/github.com/vmihailenco/msgpack#pkg-examples.
-
-## Installation
-
-This project uses [Go Modules](https://github.com/golang/go/wiki/Modules) and semantic import versioning since v4:
-
-``` shell
-go mod init github.com/my/repo
-go get github.com/vmihailenco/msgpack/v4
-```
-
-## Quickstart
-
-``` go
-import "github.com/vmihailenco/msgpack/v4"
-
-func ExampleMarshal() {
-	type Item struct {
-		Foo string
-	}
-
-	b, err := msgpack.Marshal(&Item{Foo: "bar"})
-	if err != nil {
-		panic(err)
-	}
-
-	var item Item
-	err = msgpack.Unmarshal(b, &item)
-	if err != nil {
-		panic(err)
-	}
-	fmt.Println(item.Foo)
-	// Output: bar
-}
-```
-
-## Benchmark
-
-```
-BenchmarkStructVmihailencoMsgpack-4   	  200000	     12814 ns/op	    2128 B/op	      26 allocs/op
-BenchmarkStructUgorjiGoMsgpack-4      	  100000	     17678 ns/op	    3616 B/op	      70 allocs/op
-BenchmarkStructUgorjiGoCodec-4        	  100000	     19053 ns/op	    7346 B/op	      23 allocs/op
-BenchmarkStructJSON-4                 	   20000	     69438 ns/op	    7864 B/op	      26 allocs/op
-BenchmarkStructGOB-4                  	   10000	    104331 ns/op	   14664 B/op	     278 allocs/op
-```
-
-## Howto
-
-Please go through [examples](https://godoc.org/github.com/vmihailenco/msgpack#pkg-examples) to get an idea how to use this package.
-
-## See also
-
-- [Golang PostgreSQL ORM](https://github.com/go-pg/pg)
-- [Golang message task queue](https://github.com/vmihailenco/taskq)
diff --git a/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v4/appengine.go b/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v4/appengine.go
deleted file mode 100644
index e8e91e53f35..00000000000
--- a/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v4/appengine.go
+++ /dev/null
@@ -1,64 +0,0 @@
-// +build appengine
-
-package msgpack
-
-import (
-	"reflect"
-
-	ds "google.golang.org/appengine/datastore"
-)
-
-func init() {
-	Register((*ds.Key)(nil), encodeDatastoreKeyValue, decodeDatastoreKeyValue)
-	Register((*ds.Cursor)(nil), encodeDatastoreCursorValue, decodeDatastoreCursorValue)
-}
-
-func EncodeDatastoreKey(e *Encoder, key *ds.Key) error {
-	if key == nil {
-		return e.EncodeNil()
-	}
-	return e.EncodeString(key.Encode())
-}
-
-func encodeDatastoreKeyValue(e *Encoder, v reflect.Value) error {
-	key := v.Interface().(*ds.Key)
-	return EncodeDatastoreKey(e, key)
-}
-
-func DecodeDatastoreKey(d *Decoder) (*ds.Key, error) {
-	v, err := d.DecodeString()
-	if err != nil {
-		return nil, err
-	}
-	if v == "" {
-		return nil, nil
-	}
-	return ds.DecodeKey(v)
-}
-
-func decodeDatastoreKeyValue(d *Decoder, v reflect.Value) error {
-	key, err := DecodeDatastoreKey(d)
-	if err != nil {
-		return err
-	}
-	v.Set(reflect.ValueOf(key))
-	return nil
-}
-
-func encodeDatastoreCursorValue(e *Encoder, v reflect.Value) error {
-	cursor := v.Interface().(ds.Cursor)
-	return e.Encode(cursor.String())
-}
-
-func decodeDatastoreCursorValue(d *Decoder, v reflect.Value) error {
-	s, err := d.DecodeString()
-	if err != nil {
-		return err
-	}
-	cursor, err := ds.DecodeCursor(s)
-	if err != nil {
-		return err
-	}
-	v.Set(reflect.ValueOf(cursor))
-	return nil
-}
diff --git a/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v4/codes/codes.go b/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v4/codes/codes.go
deleted file mode 100644
index 28e0a5a88b4..00000000000
--- a/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v4/codes/codes.go
+++ /dev/null
@@ -1,90 +0,0 @@
-package codes
-
-type Code byte
-
-var (
-	PosFixedNumHigh Code = 0x7f
-	NegFixedNumLow  Code = 0xe0
-
-	Nil Code = 0xc0
-
-	False Code = 0xc2
-	True  Code = 0xc3
-
-	Float  Code = 0xca
-	Double Code = 0xcb
-
-	Uint8  Code = 0xcc
-	Uint16 Code = 0xcd
-	Uint32 Code = 0xce
-	Uint64 Code = 0xcf
-
-	Int8  Code = 0xd0
-	Int16 Code = 0xd1
-	Int32 Code = 0xd2
-	Int64 Code = 0xd3
-
-	FixedStrLow  Code = 0xa0
-	FixedStrHigh Code = 0xbf
-	FixedStrMask Code = 0x1f
-	Str8         Code = 0xd9
-	Str16        Code = 0xda
-	Str32        Code = 0xdb
-
-	Bin8  Code = 0xc4
-	Bin16 Code = 0xc5
-	Bin32 Code = 0xc6
-
-	FixedArrayLow  Code = 0x90
-	FixedArrayHigh Code = 0x9f
-	FixedArrayMask Code = 0xf
-	Array16        Code = 0xdc
-	Array32        Code = 0xdd
-
-	FixedMapLow  Code = 0x80
-	FixedMapHigh Code = 0x8f
-	FixedMapMask Code = 0xf
-	Map16        Code = 0xde
-	Map32        Code = 0xdf
-
-	FixExt1  Code = 0xd4
-	FixExt2  Code = 0xd5
-	FixExt4  Code = 0xd6
-	FixExt8  Code = 0xd7
-	FixExt16 Code = 0xd8
-	Ext8     Code = 0xc7
-	Ext16    Code = 0xc8
-	Ext32    Code = 0xc9
-)
-
-func IsFixedNum(c Code) bool {
-	return c <= PosFixedNumHigh || c >= NegFixedNumLow
-}
-
-func IsFixedMap(c Code) bool {
-	return c >= FixedMapLow && c <= FixedMapHigh
-}
-
-func IsFixedArray(c Code) bool {
-	return c >= FixedArrayLow && c <= FixedArrayHigh
-}
-
-func IsFixedString(c Code) bool {
-	return c >= FixedStrLow && c <= FixedStrHigh
-}
-
-func IsString(c Code) bool {
-	return IsFixedString(c) || c == Str8 || c == Str16 || c == Str32
-}
-
-func IsBin(c Code) bool {
-	return c == Bin8 || c == Bin16 || c == Bin32
-}
-
-func IsFixedExt(c Code) bool {
-	return c >= FixExt1 && c <= FixExt16
-}
-
-func IsExt(c Code) bool {
-	return IsFixedExt(c) || c == Ext8 || c == Ext16 || c == Ext32
-}
diff --git a/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v4/decode.go b/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v4/decode.go
deleted file mode 100644
index 1711675e9a1..00000000000
--- a/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v4/decode.go
+++ /dev/null
@@ -1,617 +0,0 @@
-package msgpack
-
-import (
-	"bufio"
-	"bytes"
-	"errors"
-	"fmt"
-	"io"
-	"reflect"
-	"sync"
-	"time"
-
-	"github.com/vmihailenco/msgpack/v4/codes"
-)
-
-const (
-	looseIfaceFlag uint32 = 1 << iota
-	decodeUsingJSONFlag
-	disallowUnknownFieldsFlag
-)
-
-const (
-	bytesAllocLimit = 1e6 // 1mb
-	sliceAllocLimit = 1e4
-	maxMapSize      = 1e6
-)
-
-type bufReader interface {
-	io.Reader
-	io.ByteScanner
-}
-
-//------------------------------------------------------------------------------
-
-var decPool = sync.Pool{
-	New: func() interface{} {
-		return NewDecoder(nil)
-	},
-}
-
-// Unmarshal decodes the MessagePack-encoded data and stores the result
-// in the value pointed to by v.
-func Unmarshal(data []byte, v interface{}) error {
-	dec := decPool.Get().(*Decoder)
-
-	if r, ok := dec.r.(*bytes.Reader); ok {
-		r.Reset(data)
-	} else {
-		dec.Reset(bytes.NewReader(data))
-	}
-	err := dec.Decode(v)
-
-	decPool.Put(dec)
-
-	return err
-}
-
-// A Decoder reads and decodes MessagePack values from an input stream.
-type Decoder struct {
-	r   io.Reader
-	s   io.ByteScanner
-	buf []byte
-
-	extLen int
-	rec    []byte // accumulates read data if not nil
-
-	intern        []string
-	flags         uint32
-	decodeMapFunc func(*Decoder) (interface{}, error)
-}
-
-// NewDecoder returns a new decoder that reads from r.
-//
-// The decoder introduces its own buffering and may read data from r
-// beyond the MessagePack values requested. Buffering can be disabled
-// by passing a reader that implements io.ByteScanner interface.
-func NewDecoder(r io.Reader) *Decoder {
-	d := new(Decoder)
-	d.Reset(r)
-	return d
-}
-
-// Reset discards any buffered data, resets all state, and switches the buffered
-// reader to read from r.
-func (d *Decoder) Reset(r io.Reader) {
-	if br, ok := r.(bufReader); ok {
-		d.r = br
-		d.s = br
-	} else if br, ok := d.r.(*bufio.Reader); ok {
-		br.Reset(r)
-	} else {
-		br := bufio.NewReader(r)
-		d.r = br
-		d.s = br
-	}
-
-	if d.intern != nil {
-		d.intern = d.intern[:0]
-	}
-
-	//TODO:
-	//d.useLoose = false
-	//d.useJSONTag = false
-	//d.disallowUnknownFields = false
-	//d.decodeMapFunc = nil
-}
-
-func (d *Decoder) SetDecodeMapFunc(fn func(*Decoder) (interface{}, error)) {
-	d.decodeMapFunc = fn
-}
-
-// UseDecodeInterfaceLoose causes decoder to use DecodeInterfaceLoose
-// to decode msgpack value into Go interface{}.
-func (d *Decoder) UseDecodeInterfaceLoose(on bool) *Decoder {
-	if on {
-		d.flags |= looseIfaceFlag
-	} else {
-		d.flags &= ^looseIfaceFlag
-	}
-	return d
-}
-
-// UseJSONTag causes the Decoder to use json struct tag as fallback option
-// if there is no msgpack tag.
-func (d *Decoder) UseJSONTag(on bool) *Decoder {
-	if on {
-		d.flags |= decodeUsingJSONFlag
-	} else {
-		d.flags &= ^decodeUsingJSONFlag
-	}
-	return d
-}
-
-// DisallowUnknownFields causes the Decoder to return an error when the destination
-// is a struct and the input contains object keys which do not match any
-// non-ignored, exported fields in the destination.
-func (d *Decoder) DisallowUnknownFields() {
-	if true {
-		d.flags |= disallowUnknownFieldsFlag
-	} else {
-		d.flags &= ^disallowUnknownFieldsFlag
-	}
-}
-
-// Buffered returns a reader of the data remaining in the Decoder's buffer.
-// The reader is valid until the next call to Decode.
-func (d *Decoder) Buffered() io.Reader {
-	return d.r
-}
-
-//nolint:gocyclo
-func (d *Decoder) Decode(v interface{}) error {
-	var err error
-	switch v := v.(type) {
-	case *string:
-		if v != nil {
-			*v, err = d.DecodeString()
-			return err
-		}
-	case *[]byte:
-		if v != nil {
-			return d.decodeBytesPtr(v)
-		}
-	case *int:
-		if v != nil {
-			*v, err = d.DecodeInt()
-			return err
-		}
-	case *int8:
-		if v != nil {
-			*v, err = d.DecodeInt8()
-			return err
-		}
-	case *int16:
-		if v != nil {
-			*v, err = d.DecodeInt16()
-			return err
-		}
-	case *int32:
-		if v != nil {
-			*v, err = d.DecodeInt32()
-			return err
-		}
-	case *int64:
-		if v != nil {
-			*v, err = d.DecodeInt64()
-			return err
-		}
-	case *uint:
-		if v != nil {
-			*v, err = d.DecodeUint()
-			return err
-		}
-	case *uint8:
-		if v != nil {
-			*v, err = d.DecodeUint8()
-			return err
-		}
-	case *uint16:
-		if v != nil {
-			*v, err = d.DecodeUint16()
-			return err
-		}
-	case *uint32:
-		if v != nil {
-			*v, err = d.DecodeUint32()
-			return err
-		}
-	case *uint64:
-		if v != nil {
-			*v, err = d.DecodeUint64()
-			return err
-		}
-	case *bool:
-		if v != nil {
-			*v, err = d.DecodeBool()
-			return err
-		}
-	case *float32:
-		if v != nil {
-			*v, err = d.DecodeFloat32()
-			return err
-		}
-	case *float64:
-		if v != nil {
-			*v, err = d.DecodeFloat64()
-			return err
-		}
-	case *[]string:
-		return d.decodeStringSlicePtr(v)
-	case *map[string]string:
-		return d.decodeMapStringStringPtr(v)
-	case *map[string]interface{}:
-		return d.decodeMapStringInterfacePtr(v)
-	case *time.Duration:
-		if v != nil {
-			vv, err := d.DecodeInt64()
-			*v = time.Duration(vv)
-			return err
-		}
-	case *time.Time:
-		if v != nil {
-			*v, err = d.DecodeTime()
-			return err
-		}
-	}
-
-	vv := reflect.ValueOf(v)
-	if !vv.IsValid() {
-		return errors.New("msgpack: Decode(nil)")
-	}
-	if vv.Kind() != reflect.Ptr {
-		return fmt.Errorf("msgpack: Decode(nonsettable %T)", v)
-	}
-	vv = vv.Elem()
-	if !vv.IsValid() {
-		return fmt.Errorf("msgpack: Decode(nonsettable %T)", v)
-	}
-	return d.DecodeValue(vv)
-}
-
-func (d *Decoder) DecodeMulti(v ...interface{}) error {
-	for _, vv := range v {
-		if err := d.Decode(vv); err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-func (d *Decoder) decodeInterfaceCond() (interface{}, error) {
-	if d.flags&looseIfaceFlag != 0 {
-		return d.DecodeInterfaceLoose()
-	}
-	return d.DecodeInterface()
-}
-
-func (d *Decoder) DecodeValue(v reflect.Value) error {
-	decode := getDecoder(v.Type())
-	return decode(d, v)
-}
-
-func (d *Decoder) DecodeNil() error {
-	c, err := d.readCode()
-	if err != nil {
-		return err
-	}
-	if c != codes.Nil {
-		return fmt.Errorf("msgpack: invalid code=%x decoding nil", c)
-	}
-	return nil
-}
-
-func (d *Decoder) decodeNilValue(v reflect.Value) error {
-	err := d.DecodeNil()
-	if v.IsNil() {
-		return err
-	}
-	if v.Kind() == reflect.Ptr {
-		v = v.Elem()
-	}
-	v.Set(reflect.Zero(v.Type()))
-	return err
-}
-
-func (d *Decoder) DecodeBool() (bool, error) {
-	c, err := d.readCode()
-	if err != nil {
-		return false, err
-	}
-	return d.bool(c)
-}
-
-func (d *Decoder) bool(c codes.Code) (bool, error) {
-	if c == codes.False {
-		return false, nil
-	}
-	if c == codes.True {
-		return true, nil
-	}
-	return false, fmt.Errorf("msgpack: invalid code=%x decoding bool", c)
-}
-
-func (d *Decoder) DecodeDuration() (time.Duration, error) {
-	n, err := d.DecodeInt64()
-	if err != nil {
-		return 0, err
-	}
-	return time.Duration(n), nil
-}
-
-// DecodeInterface decodes value into interface. It returns following types:
-//   - nil,
-//   - bool,
-//   - int8, int16, int32, int64,
-//   - uint8, uint16, uint32, uint64,
-//   - float32 and float64,
-//   - string,
-//   - []byte,
-//   - slices of any of the above,
-//   - maps of any of the above.
-//
-// DecodeInterface should be used only when you don't know the type of value
-// you are decoding. For example, if you are decoding number it is better to use
-// DecodeInt64 for negative numbers and DecodeUint64 for positive numbers.
-func (d *Decoder) DecodeInterface() (interface{}, error) {
-	c, err := d.readCode()
-	if err != nil {
-		return nil, err
-	}
-
-	if codes.IsFixedNum(c) {
-		return int8(c), nil
-	}
-	if codes.IsFixedMap(c) {
-		err = d.s.UnreadByte()
-		if err != nil {
-			return nil, err
-		}
-		return d.DecodeMap()
-	}
-	if codes.IsFixedArray(c) {
-		return d.decodeSlice(c)
-	}
-	if codes.IsFixedString(c) {
-		return d.string(c)
-	}
-
-	switch c {
-	case codes.Nil:
-		return nil, nil
-	case codes.False, codes.True:
-		return d.bool(c)
-	case codes.Float:
-		return d.float32(c)
-	case codes.Double:
-		return d.float64(c)
-	case codes.Uint8:
-		return d.uint8()
-	case codes.Uint16:
-		return d.uint16()
-	case codes.Uint32:
-		return d.uint32()
-	case codes.Uint64:
-		return d.uint64()
-	case codes.Int8:
-		return d.int8()
-	case codes.Int16:
-		return d.int16()
-	case codes.Int32:
-		return d.int32()
-	case codes.Int64:
-		return d.int64()
-	case codes.Bin8, codes.Bin16, codes.Bin32:
-		return d.bytes(c, nil)
-	case codes.Str8, codes.Str16, codes.Str32:
-		return d.string(c)
-	case codes.Array16, codes.Array32:
-		return d.decodeSlice(c)
-	case codes.Map16, codes.Map32:
-		err = d.s.UnreadByte()
-		if err != nil {
-			return nil, err
-		}
-		return d.DecodeMap()
-	case codes.FixExt1, codes.FixExt2, codes.FixExt4, codes.FixExt8, codes.FixExt16,
-		codes.Ext8, codes.Ext16, codes.Ext32:
-		return d.extInterface(c)
-	}
-
-	return 0, fmt.Errorf("msgpack: unknown code %x decoding interface{}", c)
-}
-
-// DecodeInterfaceLoose is like DecodeInterface except that:
-//   - int8, int16, and int32 are converted to int64,
-//   - uint8, uint16, and uint32 are converted to uint64,
-//   - float32 is converted to float64.
-func (d *Decoder) DecodeInterfaceLoose() (interface{}, error) {
-	c, err := d.readCode()
-	if err != nil {
-		return nil, err
-	}
-
-	if codes.IsFixedNum(c) {
-		return int64(int8(c)), nil
-	}
-	if codes.IsFixedMap(c) {
-		err = d.s.UnreadByte()
-		if err != nil {
-			return nil, err
-		}
-		return d.DecodeMap()
-	}
-	if codes.IsFixedArray(c) {
-		return d.decodeSlice(c)
-	}
-	if codes.IsFixedString(c) {
-		return d.string(c)
-	}
-
-	switch c {
-	case codes.Nil:
-		return nil, nil
-	case codes.False, codes.True:
-		return d.bool(c)
-	case codes.Float, codes.Double:
-		return d.float64(c)
-	case codes.Uint8, codes.Uint16, codes.Uint32, codes.Uint64:
-		return d.uint(c)
-	case codes.Int8, codes.Int16, codes.Int32, codes.Int64:
-		return d.int(c)
-	case codes.Bin8, codes.Bin16, codes.Bin32:
-		return d.bytes(c, nil)
-	case codes.Str8, codes.Str16, codes.Str32:
-		return d.string(c)
-	case codes.Array16, codes.Array32:
-		return d.decodeSlice(c)
-	case codes.Map16, codes.Map32:
-		err = d.s.UnreadByte()
-		if err != nil {
-			return nil, err
-		}
-		return d.DecodeMap()
-	case codes.FixExt1, codes.FixExt2, codes.FixExt4, codes.FixExt8, codes.FixExt16,
-		codes.Ext8, codes.Ext16, codes.Ext32:
-		return d.extInterface(c)
-	}
-
-	return 0, fmt.Errorf("msgpack: unknown code %x decoding interface{}", c)
-}
-
-// Skip skips next value.
-func (d *Decoder) Skip() error {
-	c, err := d.readCode()
-	if err != nil {
-		return err
-	}
-
-	if codes.IsFixedNum(c) {
-		return nil
-	}
-	if codes.IsFixedMap(c) {
-		return d.skipMap(c)
-	}
-	if codes.IsFixedArray(c) {
-		return d.skipSlice(c)
-	}
-	if codes.IsFixedString(c) {
-		return d.skipBytes(c)
-	}
-
-	switch c {
-	case codes.Nil, codes.False, codes.True:
-		return nil
-	case codes.Uint8, codes.Int8:
-		return d.skipN(1)
-	case codes.Uint16, codes.Int16:
-		return d.skipN(2)
-	case codes.Uint32, codes.Int32, codes.Float:
-		return d.skipN(4)
-	case codes.Uint64, codes.Int64, codes.Double:
-		return d.skipN(8)
-	case codes.Bin8, codes.Bin16, codes.Bin32:
-		return d.skipBytes(c)
-	case codes.Str8, codes.Str16, codes.Str32:
-		return d.skipBytes(c)
-	case codes.Array16, codes.Array32:
-		return d.skipSlice(c)
-	case codes.Map16, codes.Map32:
-		return d.skipMap(c)
-	case codes.FixExt1, codes.FixExt2, codes.FixExt4, codes.FixExt8, codes.FixExt16,
-		codes.Ext8, codes.Ext16, codes.Ext32:
-		return d.skipExt(c)
-	}
-
-	return fmt.Errorf("msgpack: unknown code %x", c)
-}
-
-// PeekCode returns the next MessagePack code without advancing the reader.
-// Subpackage msgpack/codes contains list of available codes.
-func (d *Decoder) PeekCode() (codes.Code, error) {
-	c, err := d.s.ReadByte()
-	if err != nil {
-		return 0, err
-	}
-	return codes.Code(c), d.s.UnreadByte()
-}
-
-func (d *Decoder) hasNilCode() bool {
-	code, err := d.PeekCode()
-	return err == nil && code == codes.Nil
-}
-
-func (d *Decoder) readCode() (codes.Code, error) {
-	d.extLen = 0
-	c, err := d.s.ReadByte()
-	if err != nil {
-		return 0, err
-	}
-	if d.rec != nil {
-		d.rec = append(d.rec, c)
-	}
-	return codes.Code(c), nil
-}
-
-func (d *Decoder) readFull(b []byte) error {
-	_, err := io.ReadFull(d.r, b)
-	if err != nil {
-		return err
-	}
-	if d.rec != nil {
-		//TODO: read directly into d.rec?
-		d.rec = append(d.rec, b...)
-	}
-	return nil
-}
-
-func (d *Decoder) readN(n int) ([]byte, error) {
-	var err error
-	d.buf, err = readN(d.r, d.buf, n)
-	if err != nil {
-		return nil, err
-	}
-	if d.rec != nil {
-		//TODO: read directly into d.rec?
-		d.rec = append(d.rec, d.buf...)
-	}
-	return d.buf, nil
-}
-
-func readN(r io.Reader, b []byte, n int) ([]byte, error) {
-	if b == nil {
-		if n == 0 {
-			return make([]byte, 0), nil
-		}
-		switch {
-		case n < 64:
-			b = make([]byte, 0, 64)
-		case n <= bytesAllocLimit:
-			b = make([]byte, 0, n)
-		default:
-			b = make([]byte, 0, bytesAllocLimit)
-		}
-	}
-
-	if n <= cap(b) {
-		b = b[:n]
-		_, err := io.ReadFull(r, b)
-		return b, err
-	}
-	b = b[:cap(b)]
-
-	var pos int
-	for {
-		alloc := min(n-len(b), bytesAllocLimit)
-		b = append(b, make([]byte, alloc)...)
-
-		_, err := io.ReadFull(r, b[pos:])
-		if err != nil {
-			return b, err
-		}
-
-		if len(b) == n {
-			break
-		}
-		pos = len(b)
-	}
-
-	return b, nil
-}
-
-func min(a, b int) int { //nolint:unparam
-	if a <= b {
-		return a
-	}
-	return b
-}
diff --git a/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v4/decode_map.go b/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v4/decode_map.go
deleted file mode 100644
index 16c40fe77e1..00000000000
--- a/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v4/decode_map.go
+++ /dev/null
@@ -1,350 +0,0 @@
-package msgpack
-
-import (
-	"errors"
-	"fmt"
-	"reflect"
-
-	"github.com/vmihailenco/msgpack/v4/codes"
-)
-
-var (
-	mapStringStringPtrType = reflect.TypeOf((*map[string]string)(nil))
-	mapStringStringType    = mapStringStringPtrType.Elem()
-)
-
-var (
-	mapStringInterfacePtrType = reflect.TypeOf((*map[string]interface{})(nil))
-	mapStringInterfaceType    = mapStringInterfacePtrType.Elem()
-)
-
-func decodeMapValue(d *Decoder, v reflect.Value) error {
-	size, err := d.DecodeMapLen()
-	if err != nil {
-		return err
-	}
-
-	typ := v.Type()
-	if size == -1 {
-		v.Set(reflect.Zero(typ))
-		return nil
-	}
-
-	if v.IsNil() {
-		v.Set(reflect.MakeMap(typ))
-	}
-	if size == 0 {
-		return nil
-	}
-
-	return decodeMapValueSize(d, v, size)
-}
-
-func decodeMapValueSize(d *Decoder, v reflect.Value, size int) error {
-	typ := v.Type()
-	keyType := typ.Key()
-	valueType := typ.Elem()
-
-	for i := 0; i < size; i++ {
-		mk := reflect.New(keyType).Elem()
-		if err := d.DecodeValue(mk); err != nil {
-			return err
-		}
-
-		mv := reflect.New(valueType).Elem()
-		if err := d.DecodeValue(mv); err != nil {
-			return err
-		}
-
-		v.SetMapIndex(mk, mv)
-	}
-
-	return nil
-}
-
-// DecodeMapLen decodes map length. Length is -1 when map is nil.
-func (d *Decoder) DecodeMapLen() (int, error) {
-	c, err := d.readCode()
-	if err != nil {
-		return 0, err
-	}
-
-	if codes.IsExt(c) {
-		if err = d.skipExtHeader(c); err != nil {
-			return 0, err
-		}
-
-		c, err = d.readCode()
-		if err != nil {
-			return 0, err
-		}
-	}
-	return d.mapLen(c)
-}
-
-func (d *Decoder) mapLen(c codes.Code) (int, error) {
-	size, err := d._mapLen(c)
-	err = expandInvalidCodeMapLenError(c, err)
-	return size, err
-}
-
-func (d *Decoder) _mapLen(c codes.Code) (int, error) {
-	if c == codes.Nil {
-		return -1, nil
-	}
-	if c >= codes.FixedMapLow && c <= codes.FixedMapHigh {
-		return int(c & codes.FixedMapMask), nil
-	}
-	if c == codes.Map16 {
-		size, err := d.uint16()
-		return int(size), err
-	}
-	if c == codes.Map32 {
-		size, err := d.uint32()
-		return int(size), err
-	}
-	return 0, errInvalidCode
-}
-
-var errInvalidCode = errors.New("invalid code")
-
-func expandInvalidCodeMapLenError(c codes.Code, err error) error {
-	if err == errInvalidCode {
-		return fmt.Errorf("msgpack: invalid code=%x decoding map length", c)
-	}
-	return err
-}
-
-func decodeMapStringStringValue(d *Decoder, v reflect.Value) error {
-	mptr := v.Addr().Convert(mapStringStringPtrType).Interface().(*map[string]string)
-	return d.decodeMapStringStringPtr(mptr)
-}
-
-func (d *Decoder) decodeMapStringStringPtr(ptr *map[string]string) error {
-	size, err := d.DecodeMapLen()
-	if err != nil {
-		return err
-	}
-	if size == -1 {
-		*ptr = nil
-		return nil
-	}
-
-	m := *ptr
-	if m == nil {
-		*ptr = make(map[string]string, min(size, maxMapSize))
-		m = *ptr
-	}
-
-	for i := 0; i < size; i++ {
-		mk, err := d.DecodeString()
-		if err != nil {
-			return err
-		}
-		mv, err := d.DecodeString()
-		if err != nil {
-			return err
-		}
-		m[mk] = mv
-	}
-
-	return nil
-}
-
-func decodeMapStringInterfaceValue(d *Decoder, v reflect.Value) error {
-	ptr := v.Addr().Convert(mapStringInterfacePtrType).Interface().(*map[string]interface{})
-	return d.decodeMapStringInterfacePtr(ptr)
-}
-
-func (d *Decoder) decodeMapStringInterfacePtr(ptr *map[string]interface{}) error {
-	n, err := d.DecodeMapLen()
-	if err != nil {
-		return err
-	}
-	if n == -1 {
-		*ptr = nil
-		return nil
-	}
-
-	m := *ptr
-	if m == nil {
-		*ptr = make(map[string]interface{}, min(n, maxMapSize))
-		m = *ptr
-	}
-
-	for i := 0; i < n; i++ {
-		mk, err := d.DecodeString()
-		if err != nil {
-			return err
-		}
-		mv, err := d.decodeInterfaceCond()
-		if err != nil {
-			return err
-		}
-		m[mk] = mv
-	}
-
-	return nil
-}
-
-var errUnsupportedMapKey = errors.New("msgpack: unsupported map key")
-
-func (d *Decoder) DecodeMap() (interface{}, error) {
-	if d.decodeMapFunc != nil {
-		return d.decodeMapFunc(d)
-	}
-
-	size, err := d.DecodeMapLen()
-	if err != nil {
-		return nil, err
-	}
-	if size == -1 {
-		return nil, nil
-	}
-	if size == 0 {
-		return make(map[string]interface{}), nil
-	}
-
-	code, err := d.PeekCode()
-	if err != nil {
-		return nil, err
-	}
-
-	if codes.IsString(code) || codes.IsBin(code) {
-		return d.decodeMapStringInterfaceSize(size)
-	}
-
-	key, err := d.decodeInterfaceCond()
-	if err != nil {
-		return nil, err
-	}
-
-	value, err := d.decodeInterfaceCond()
-	if err != nil {
-		return nil, err
-	}
-
-	keyType := reflect.TypeOf(key)
-	valueType := reflect.TypeOf(value)
-
-	if !keyType.Comparable() {
-		return nil, errUnsupportedMapKey
-	}
-
-	mapType := reflect.MapOf(keyType, valueType)
-	mapValue := reflect.MakeMap(mapType)
-
-	mapValue.SetMapIndex(reflect.ValueOf(key), reflect.ValueOf(value))
-	size--
-
-	err = decodeMapValueSize(d, mapValue, size)
-	if err != nil {
-		return nil, err
-	}
-
-	return mapValue.Interface(), nil
-}
-
-func (d *Decoder) decodeMapStringInterfaceSize(size int) (map[string]interface{}, error) {
-	m := make(map[string]interface{}, min(size, maxMapSize))
-	for i := 0; i < size; i++ {
-		mk, err := d.DecodeString()
-		if err != nil {
-			return nil, err
-		}
-		mv, err := d.decodeInterfaceCond()
-		if err != nil {
-			return nil, err
-		}
-		m[mk] = mv
-	}
-	return m, nil
-}
-
-func (d *Decoder) skipMap(c codes.Code) error {
-	n, err := d.mapLen(c)
-	if err != nil {
-		return err
-	}
-	for i := 0; i < n; i++ {
-		if err := d.Skip(); err != nil {
-			return err
-		}
-		if err := d.Skip(); err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-func decodeStructValue(d *Decoder, v reflect.Value) error {
-	c, err := d.readCode()
-	if err != nil {
-		return err
-	}
-
-	var isArray bool
-
-	n, err := d._mapLen(c)
-	if err != nil {
-		var err2 error
-		n, err2 = d.arrayLen(c)
-		if err2 != nil {
-			return expandInvalidCodeMapLenError(c, err)
-		}
-		isArray = true
-	}
-	if n == -1 {
-		if err = mustSet(v); err != nil {
-			return err
-		}
-		v.Set(reflect.Zero(v.Type()))
-		return nil
-	}
-
-	var fields *fields
-	if d.flags&decodeUsingJSONFlag != 0 {
-		fields = jsonStructs.Fields(v.Type())
-	} else {
-		fields = structs.Fields(v.Type())
-	}
-
-	if isArray {
-		for i, f := range fields.List {
-			if i >= n {
-				break
-			}
-			if err := f.DecodeValue(d, v); err != nil {
-				return err
-			}
-		}
-
-		// Skip extra values.
-		for i := len(fields.List); i < n; i++ {
-			if err := d.Skip(); err != nil {
-				return err
-			}
-		}
-
-		return nil
-	}
-
-	for i := 0; i < n; i++ {
-		name, err := d.DecodeString()
-		if err != nil {
-			return err
-		}
-
-		if f := fields.Map[name]; f != nil {
-			if err := f.DecodeValue(d, v); err != nil {
-				return err
-			}
-		} else if d.flags&disallowUnknownFieldsFlag != 0 {
-			return fmt.Errorf("msgpack: unknown field %q", name)
-		} else if err := d.Skip(); err != nil {
-			return err
-		}
-	}
-
-	return nil
-}
diff --git a/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v4/decode_string.go b/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v4/decode_string.go
deleted file mode 100644
index c5adf3865cb..00000000000
--- a/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v4/decode_string.go
+++ /dev/null
@@ -1,186 +0,0 @@
-package msgpack
-
-import (
-	"fmt"
-	"reflect"
-
-	"github.com/vmihailenco/msgpack/v4/codes"
-)
-
-func (d *Decoder) bytesLen(c codes.Code) (int, error) {
-	if c == codes.Nil {
-		return -1, nil
-	}
-
-	if codes.IsFixedString(c) {
-		return int(c & codes.FixedStrMask), nil
-	}
-
-	switch c {
-	case codes.Str8, codes.Bin8:
-		n, err := d.uint8()
-		return int(n), err
-	case codes.Str16, codes.Bin16:
-		n, err := d.uint16()
-		return int(n), err
-	case codes.Str32, codes.Bin32:
-		n, err := d.uint32()
-		return int(n), err
-	}
-
-	return 0, fmt.Errorf("msgpack: invalid code=%x decoding bytes length", c)
-}
-
-func (d *Decoder) DecodeString() (string, error) {
-	c, err := d.readCode()
-	if err != nil {
-		return "", err
-	}
-	return d.string(c)
-}
-
-func (d *Decoder) string(c codes.Code) (string, error) {
-	n, err := d.bytesLen(c)
-	if err != nil {
-		return "", err
-	}
-	return d.stringWithLen(n)
-}
-
-func (d *Decoder) stringWithLen(n int) (string, error) {
-	if n <= 0 {
-		return "", nil
-	}
-	b, err := d.readN(n)
-	return string(b), err
-}
-
-func decodeStringValue(d *Decoder, v reflect.Value) error {
-	if err := mustSet(v); err != nil {
-		return err
-	}
-
-	s, err := d.DecodeString()
-	if err != nil {
-		return err
-	}
-
-	v.SetString(s)
-	return nil
-}
-
-func (d *Decoder) DecodeBytesLen() (int, error) {
-	c, err := d.readCode()
-	if err != nil {
-		return 0, err
-	}
-	return d.bytesLen(c)
-}
-
-func (d *Decoder) DecodeBytes() ([]byte, error) {
-	c, err := d.readCode()
-	if err != nil {
-		return nil, err
-	}
-	return d.bytes(c, nil)
-}
-
-func (d *Decoder) bytes(c codes.Code, b []byte) ([]byte, error) {
-	n, err := d.bytesLen(c)
-	if err != nil {
-		return nil, err
-	}
-	if n == -1 {
-		return nil, nil
-	}
-	return readN(d.r, b, n)
-}
-
-func (d *Decoder) bytesNoCopy() ([]byte, error) {
-	c, err := d.readCode()
-	if err != nil {
-		return nil, err
-	}
-	n, err := d.bytesLen(c)
-	if err != nil {
-		return nil, err
-	}
-	if n == -1 {
-		return nil, nil
-	}
-	return d.readN(n)
-}
-
-func (d *Decoder) decodeBytesPtr(ptr *[]byte) error {
-	c, err := d.readCode()
-	if err != nil {
-		return err
-	}
-	return d.bytesPtr(c, ptr)
-}
-
-func (d *Decoder) bytesPtr(c codes.Code, ptr *[]byte) error {
-	n, err := d.bytesLen(c)
-	if err != nil {
-		return err
-	}
-	if n == -1 {
-		*ptr = nil
-		return nil
-	}
-
-	*ptr, err = readN(d.r, *ptr, n)
-	return err
-}
-
-func (d *Decoder) skipBytes(c codes.Code) error {
-	n, err := d.bytesLen(c)
-	if err != nil {
-		return err
-	}
-	if n <= 0 {
-		return nil
-	}
-	return d.skipN(n)
-}
-
-func decodeBytesValue(d *Decoder, v reflect.Value) error {
-	if err := mustSet(v); err != nil {
-		return err
-	}
-
-	c, err := d.readCode()
-	if err != nil {
-		return err
-	}
-
-	b, err := d.bytes(c, v.Bytes())
-	if err != nil {
-		return err
-	}
-
-	v.SetBytes(b)
-
-	return nil
-}
-
-func decodeByteArrayValue(d *Decoder, v reflect.Value) error {
-	c, err := d.readCode()
-	if err != nil {
-		return err
-	}
-
-	n, err := d.bytesLen(c)
-	if err != nil {
-		return err
-	}
-	if n == -1 {
-		return nil
-	}
-	if n > v.Len() {
-		return fmt.Errorf("%s len is %d, but msgpack has %d elements", v.Type(), v.Len(), n)
-	}
-
-	b := v.Slice(0, n).Bytes()
-	return d.readFull(b)
-}
diff --git a/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v4/decode_value.go b/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v4/decode_value.go
deleted file mode 100644
index 810d3be8f92..00000000000
--- a/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v4/decode_value.go
+++ /dev/null
@@ -1,276 +0,0 @@
-package msgpack
-
-import (
-	"encoding"
-	"errors"
-	"fmt"
-	"reflect"
-)
-
-var interfaceType = reflect.TypeOf((*interface{})(nil)).Elem()
-var stringType = reflect.TypeOf((*string)(nil)).Elem()
-
-var valueDecoders []decoderFunc
-
-//nolint:gochecknoinits
-func init() {
-	valueDecoders = []decoderFunc{
-		reflect.Bool:          decodeBoolValue,
-		reflect.Int:           decodeInt64Value,
-		reflect.Int8:          decodeInt64Value,
-		reflect.Int16:         decodeInt64Value,
-		reflect.Int32:         decodeInt64Value,
-		reflect.Int64:         decodeInt64Value,
-		reflect.Uint:          decodeUint64Value,
-		reflect.Uint8:         decodeUint64Value,
-		reflect.Uint16:        decodeUint64Value,
-		reflect.Uint32:        decodeUint64Value,
-		reflect.Uint64:        decodeUint64Value,
-		reflect.Float32:       decodeFloat32Value,
-		reflect.Float64:       decodeFloat64Value,
-		reflect.Complex64:     decodeUnsupportedValue,
-		reflect.Complex128:    decodeUnsupportedValue,
-		reflect.Array:         decodeArrayValue,
-		reflect.Chan:          decodeUnsupportedValue,
-		reflect.Func:          decodeUnsupportedValue,
-		reflect.Interface:     decodeInterfaceValue,
-		reflect.Map:           decodeMapValue,
-		reflect.Ptr:           decodeUnsupportedValue,
-		reflect.Slice:         decodeSliceValue,
-		reflect.String:        decodeStringValue,
-		reflect.Struct:        decodeStructValue,
-		reflect.UnsafePointer: decodeUnsupportedValue,
-	}
-}
-
-func mustSet(v reflect.Value) error {
-	if !v.CanSet() {
-		return fmt.Errorf("msgpack: Decode(nonsettable %s)", v.Type())
-	}
-	return nil
-}
-
-func getDecoder(typ reflect.Type) decoderFunc {
-	if v, ok := typeDecMap.Load(typ); ok {
-		return v.(decoderFunc)
-	}
-	fn := _getDecoder(typ)
-	typeDecMap.Store(typ, fn)
-	return fn
-}
-
-func _getDecoder(typ reflect.Type) decoderFunc {
-	kind := typ.Kind()
-
-	if typ.Implements(customDecoderType) {
-		return decodeCustomValue
-	}
-	if typ.Implements(unmarshalerType) {
-		return unmarshalValue
-	}
-	if typ.Implements(binaryUnmarshalerType) {
-		return unmarshalBinaryValue
-	}
-
-	// Addressable struct field value.
-	if kind != reflect.Ptr {
-		ptr := reflect.PtrTo(typ)
-		if ptr.Implements(customDecoderType) {
-			return decodeCustomValueAddr
-		}
-		if ptr.Implements(unmarshalerType) {
-			return unmarshalValueAddr
-		}
-		if ptr.Implements(binaryUnmarshalerType) {
-			return unmarshalBinaryValueAddr
-		}
-	}
-
-	switch kind {
-	case reflect.Ptr:
-		return ptrDecoderFunc(typ)
-	case reflect.Slice:
-		elem := typ.Elem()
-		if elem.Kind() == reflect.Uint8 {
-			return decodeBytesValue
-		}
-		if elem == stringType {
-			return decodeStringSliceValue
-		}
-	case reflect.Array:
-		if typ.Elem().Kind() == reflect.Uint8 {
-			return decodeByteArrayValue
-		}
-	case reflect.Map:
-		if typ.Key() == stringType {
-			switch typ.Elem() {
-			case stringType:
-				return decodeMapStringStringValue
-			case interfaceType:
-				return decodeMapStringInterfaceValue
-			}
-		}
-	}
-
-	return valueDecoders[kind]
-}
-
-func ptrDecoderFunc(typ reflect.Type) decoderFunc {
-	decoder := getDecoder(typ.Elem())
-	return func(d *Decoder, v reflect.Value) error {
-		if d.hasNilCode() {
-			if err := mustSet(v); err != nil {
-				return err
-			}
-			if !v.IsNil() {
-				v.Set(reflect.Zero(v.Type()))
-			}
-			return d.DecodeNil()
-		}
-		if v.IsNil() {
-			if err := mustSet(v); err != nil {
-				return err
-			}
-			v.Set(reflect.New(v.Type().Elem()))
-		}
-		return decoder(d, v.Elem())
-	}
-}
-
-func decodeCustomValueAddr(d *Decoder, v reflect.Value) error {
-	if !v.CanAddr() {
-		return fmt.Errorf("msgpack: Decode(nonaddressable %T)", v.Interface())
-	}
-	return decodeCustomValue(d, v.Addr())
-}
-
-func decodeCustomValue(d *Decoder, v reflect.Value) error {
-	if d.hasNilCode() {
-		return d.decodeNilValue(v)
-	}
-
-	if v.IsNil() {
-		v.Set(reflect.New(v.Type().Elem()))
-	}
-
-	decoder := v.Interface().(CustomDecoder)
-	return decoder.DecodeMsgpack(d)
-}
-
-func unmarshalValueAddr(d *Decoder, v reflect.Value) error {
-	if !v.CanAddr() {
-		return fmt.Errorf("msgpack: Decode(nonaddressable %T)", v.Interface())
-	}
-	return unmarshalValue(d, v.Addr())
-}
-
-func unmarshalValue(d *Decoder, v reflect.Value) error {
-	if d.extLen == 0 || d.extLen == 1 {
-		if d.hasNilCode() {
-			return d.decodeNilValue(v)
-		}
-	}
-
-	if v.IsNil() {
-		v.Set(reflect.New(v.Type().Elem()))
-	}
-
-	var b []byte
-
-	if d.extLen != 0 {
-		var err error
-		b, err = d.readN(d.extLen)
-		if err != nil {
-			return err
-		}
-	} else {
-		d.rec = make([]byte, 0, 64)
-		if err := d.Skip(); err != nil {
-			return err
-		}
-		b = d.rec
-		d.rec = nil
-	}
-
-	unmarshaler := v.Interface().(Unmarshaler)
-	return unmarshaler.UnmarshalMsgpack(b)
-}
-
-func decodeBoolValue(d *Decoder, v reflect.Value) error {
-	flag, err := d.DecodeBool()
-	if err != nil {
-		return err
-	}
-	if err = mustSet(v); err != nil {
-		return err
-	}
-	v.SetBool(flag)
-	return nil
-}
-
-func decodeInterfaceValue(d *Decoder, v reflect.Value) error {
-	if v.IsNil() {
-		return d.interfaceValue(v)
-	}
-
-	elem := v.Elem()
-	if !elem.CanAddr() {
-		if d.hasNilCode() {
-			v.Set(reflect.Zero(v.Type()))
-			return d.DecodeNil()
-		}
-	}
-
-	return d.DecodeValue(elem)
-}
-
-func (d *Decoder) interfaceValue(v reflect.Value) error {
-	vv, err := d.decodeInterfaceCond()
-	if err != nil {
-		return err
-	}
-
-	if vv != nil {
-		if v.Type() == errorType {
-			if vv, ok := vv.(string); ok {
-				v.Set(reflect.ValueOf(errors.New(vv)))
-				return nil
-			}
-		}
-
-		v.Set(reflect.ValueOf(vv))
-	}
-
-	return nil
-}
-
-func decodeUnsupportedValue(d *Decoder, v reflect.Value) error {
-	return fmt.Errorf("msgpack: Decode(unsupported %s)", v.Type())
-}
-
-//------------------------------------------------------------------------------
-
-func unmarshalBinaryValueAddr(d *Decoder, v reflect.Value) error {
-	if !v.CanAddr() {
-		return fmt.Errorf("msgpack: Decode(nonaddressable %T)", v.Interface())
-	}
-	return unmarshalBinaryValue(d, v.Addr())
-}
-
-func unmarshalBinaryValue(d *Decoder, v reflect.Value) error {
-	if d.hasNilCode() {
-		return d.decodeNilValue(v)
-	}
-
-	if v.IsNil() {
-		v.Set(reflect.New(v.Type().Elem()))
-	}
-
-	data, err := d.DecodeBytes()
-	if err != nil {
-		return err
-	}
-
-	unmarshaler := v.Interface().(encoding.BinaryUnmarshaler)
-	return unmarshaler.UnmarshalBinary(data)
-}
diff --git a/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v4/encode.go b/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v4/encode.go
deleted file mode 100644
index 37f098701ea..00000000000
--- a/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v4/encode.go
+++ /dev/null
@@ -1,241 +0,0 @@
-package msgpack
-
-import (
-	"bytes"
-	"io"
-	"reflect"
-	"sync"
-	"time"
-
-	"github.com/vmihailenco/msgpack/v4/codes"
-)
-
-const (
-	sortMapKeysFlag uint32 = 1 << iota
-	structAsArrayFlag
-	encodeUsingJSONFlag
-	useCompactIntsFlag
-	useCompactFloatsFlag
-)
-
-type writer interface {
-	io.Writer
-	WriteByte(byte) error
-}
-
-type byteWriter struct {
-	io.Writer
-
-	buf [1]byte
-}
-
-func newByteWriter(w io.Writer) *byteWriter {
-	bw := new(byteWriter)
-	bw.Reset(w)
-	return bw
-}
-
-func (bw *byteWriter) Reset(w io.Writer) {
-	bw.Writer = w
-}
-
-func (bw *byteWriter) WriteByte(c byte) error {
-	bw.buf[0] = c
-	_, err := bw.Write(bw.buf[:])
-	return err
-}
-
-//------------------------------------------------------------------------------
-
-var encPool = sync.Pool{
-	New: func() interface{} {
-		return NewEncoder(nil)
-	},
-}
-
-// Marshal returns the MessagePack encoding of v.
-func Marshal(v interface{}) ([]byte, error) {
-	enc := encPool.Get().(*Encoder)
-
-	var buf bytes.Buffer
-	enc.Reset(&buf)
-
-	err := enc.Encode(v)
-	b := buf.Bytes()
-
-	encPool.Put(enc)
-
-	if err != nil {
-		return nil, err
-	}
-	return b, err
-}
-
-type Encoder struct {
-	w writer
-
-	buf       []byte
-	timeBuf   []byte
-	bootstrap [9 + 12]byte
-
-	intern map[string]int
-
-	flags uint32
-}
-
-// NewEncoder returns a new encoder that writes to w.
-func NewEncoder(w io.Writer) *Encoder {
-	e := new(Encoder)
-	e.buf = e.bootstrap[:9]
-	e.timeBuf = e.bootstrap[9 : 9+12]
-	e.Reset(w)
-	return e
-}
-
-func (e *Encoder) Reset(w io.Writer) {
-	if bw, ok := w.(writer); ok {
-		e.w = bw
-	} else if bw, ok := e.w.(*byteWriter); ok {
-		bw.Reset(w)
-	} else {
-		e.w = newByteWriter(w)
-	}
-
-	for k := range e.intern {
-		delete(e.intern, k)
-	}
-
-	//TODO:
-	//e.sortMapKeys = false
-	//e.structAsArray = false
-	//e.useJSONTag = false
-	//e.useCompact = false
-}
-
-// SortMapKeys causes the Encoder to encode map keys in increasing order.
-// Supported map types are:
-//   - map[string]string
-//   - map[string]interface{}
-func (e *Encoder) SortMapKeys(on bool) *Encoder {
-	if on {
-		e.flags |= sortMapKeysFlag
-	} else {
-		e.flags &= ^sortMapKeysFlag
-	}
-	return e
-}
-
-// StructAsArray causes the Encoder to encode Go structs as msgpack arrays.
-func (e *Encoder) StructAsArray(on bool) *Encoder {
-	if on {
-		e.flags |= structAsArrayFlag
-	} else {
-		e.flags &= ^structAsArrayFlag
-	}
-	return e
-}
-
-// UseJSONTag causes the Encoder to use json struct tag as fallback option
-// if there is no msgpack tag.
-func (e *Encoder) UseJSONTag(on bool) *Encoder {
-	if on {
-		e.flags |= encodeUsingJSONFlag
-	} else {
-		e.flags &= ^encodeUsingJSONFlag
-	}
-	return e
-}
-
-// UseCompactEncoding causes the Encoder to chose the most compact encoding.
-// For example, it allows to encode small Go int64 as msgpack int8 saving 7 bytes.
-func (e *Encoder) UseCompactEncoding(on bool) *Encoder {
-	if on {
-		e.flags |= useCompactIntsFlag
-	} else {
-		e.flags &= ^useCompactIntsFlag
-	}
-	return e
-}
-
-// UseCompactFloats causes the Encoder to chose a compact integer encoding
-// for floats that can be represented as integers.
-func (e *Encoder) UseCompactFloats(on bool) {
-	if on {
-		e.flags |= useCompactFloatsFlag
-	} else {
-		e.flags &= ^useCompactFloatsFlag
-	}
-}
-
-func (e *Encoder) Encode(v interface{}) error {
-	switch v := v.(type) {
-	case nil:
-		return e.EncodeNil()
-	case string:
-		return e.EncodeString(v)
-	case []byte:
-		return e.EncodeBytes(v)
-	case int:
-		return e.encodeInt64Cond(int64(v))
-	case int64:
-		return e.encodeInt64Cond(v)
-	case uint:
-		return e.encodeUint64Cond(uint64(v))
-	case uint64:
-		return e.encodeUint64Cond(v)
-	case bool:
-		return e.EncodeBool(v)
-	case float32:
-		return e.EncodeFloat32(v)
-	case float64:
-		return e.EncodeFloat64(v)
-	case time.Duration:
-		return e.encodeInt64Cond(int64(v))
-	case time.Time:
-		return e.EncodeTime(v)
-	}
-	return e.EncodeValue(reflect.ValueOf(v))
-}
-
-func (e *Encoder) EncodeMulti(v ...interface{}) error {
-	for _, vv := range v {
-		if err := e.Encode(vv); err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-func (e *Encoder) EncodeValue(v reflect.Value) error {
-	fn := getEncoder(v.Type())
-	return fn(e, v)
-}
-
-func (e *Encoder) EncodeNil() error {
-	return e.writeCode(codes.Nil)
-}
-
-func (e *Encoder) EncodeBool(value bool) error {
-	if value {
-		return e.writeCode(codes.True)
-	}
-	return e.writeCode(codes.False)
-}
-
-func (e *Encoder) EncodeDuration(d time.Duration) error {
-	return e.EncodeInt(int64(d))
-}
-
-func (e *Encoder) writeCode(c codes.Code) error {
-	return e.w.WriteByte(byte(c))
-}
-
-func (e *Encoder) write(b []byte) error {
-	_, err := e.w.Write(b)
-	return err
-}
-
-func (e *Encoder) writeString(s string) error {
-	_, err := e.w.Write(stringToBytes(s))
-	return err
-}
diff --git a/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v4/encode_map.go b/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v4/encode_map.go
deleted file mode 100644
index d9b954d8667..00000000000
--- a/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v4/encode_map.go
+++ /dev/null
@@ -1,172 +0,0 @@
-package msgpack
-
-import (
-	"reflect"
-	"sort"
-
-	"github.com/vmihailenco/msgpack/v4/codes"
-)
-
-func encodeMapValue(e *Encoder, v reflect.Value) error {
-	if v.IsNil() {
-		return e.EncodeNil()
-	}
-
-	if err := e.EncodeMapLen(v.Len()); err != nil {
-		return err
-	}
-
-	for _, key := range v.MapKeys() {
-		if err := e.EncodeValue(key); err != nil {
-			return err
-		}
-		if err := e.EncodeValue(v.MapIndex(key)); err != nil {
-			return err
-		}
-	}
-
-	return nil
-}
-
-func encodeMapStringStringValue(e *Encoder, v reflect.Value) error {
-	if v.IsNil() {
-		return e.EncodeNil()
-	}
-
-	if err := e.EncodeMapLen(v.Len()); err != nil {
-		return err
-	}
-
-	m := v.Convert(mapStringStringType).Interface().(map[string]string)
-	if e.flags&sortMapKeysFlag != 0 {
-		return e.encodeSortedMapStringString(m)
-	}
-
-	for mk, mv := range m {
-		if err := e.EncodeString(mk); err != nil {
-			return err
-		}
-		if err := e.EncodeString(mv); err != nil {
-			return err
-		}
-	}
-
-	return nil
-}
-
-func encodeMapStringInterfaceValue(e *Encoder, v reflect.Value) error {
-	if v.IsNil() {
-		return e.EncodeNil()
-	}
-
-	if err := e.EncodeMapLen(v.Len()); err != nil {
-		return err
-	}
-
-	m := v.Convert(mapStringInterfaceType).Interface().(map[string]interface{})
-	if e.flags&sortMapKeysFlag != 0 {
-		return e.encodeSortedMapStringInterface(m)
-	}
-
-	for mk, mv := range m {
-		if err := e.EncodeString(mk); err != nil {
-			return err
-		}
-		if err := e.Encode(mv); err != nil {
-			return err
-		}
-	}
-
-	return nil
-}
-
-func (e *Encoder) encodeSortedMapStringString(m map[string]string) error {
-	keys := make([]string, 0, len(m))
-	for k := range m {
-		keys = append(keys, k)
-	}
-	sort.Strings(keys)
-
-	for _, k := range keys {
-		err := e.EncodeString(k)
-		if err != nil {
-			return err
-		}
-		if err = e.EncodeString(m[k]); err != nil {
-			return err
-		}
-	}
-
-	return nil
-}
-
-func (e *Encoder) encodeSortedMapStringInterface(m map[string]interface{}) error {
-	keys := make([]string, 0, len(m))
-	for k := range m {
-		keys = append(keys, k)
-	}
-	sort.Strings(keys)
-
-	for _, k := range keys {
-		err := e.EncodeString(k)
-		if err != nil {
-			return err
-		}
-		if err = e.Encode(m[k]); err != nil {
-			return err
-		}
-	}
-
-	return nil
-}
-
-func (e *Encoder) EncodeMapLen(l int) error {
-	if l < 16 {
-		return e.writeCode(codes.FixedMapLow | codes.Code(l))
-	}
-	if l < 65536 {
-		return e.write2(codes.Map16, uint16(l))
-	}
-	return e.write4(codes.Map32, uint32(l))
-}
-
-func encodeStructValue(e *Encoder, strct reflect.Value) error {
-	var structFields *fields
-	if e.flags&encodeUsingJSONFlag != 0 {
-		structFields = jsonStructs.Fields(strct.Type())
-	} else {
-		structFields = structs.Fields(strct.Type())
-	}
-
-	if e.flags&structAsArrayFlag != 0 || structFields.AsArray {
-		return encodeStructValueAsArray(e, strct, structFields.List)
-	}
-	fields := structFields.OmitEmpty(strct)
-
-	if err := e.EncodeMapLen(len(fields)); err != nil {
-		return err
-	}
-
-	for _, f := range fields {
-		if err := e.EncodeString(f.name); err != nil {
-			return err
-		}
-		if err := f.EncodeValue(e, strct); err != nil {
-			return err
-		}
-	}
-
-	return nil
-}
-
-func encodeStructValueAsArray(e *Encoder, strct reflect.Value, fields []*field) error {
-	if err := e.EncodeArrayLen(len(fields)); err != nil {
-		return err
-	}
-	for _, f := range fields {
-		if err := f.EncodeValue(e, strct); err != nil {
-			return err
-		}
-	}
-	return nil
-}
diff --git a/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v4/encode_slice.go b/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v4/encode_slice.go
deleted file mode 100644
index 69a9618e064..00000000000
--- a/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v4/encode_slice.go
+++ /dev/null
@@ -1,131 +0,0 @@
-package msgpack
-
-import (
-	"reflect"
-
-	"github.com/vmihailenco/msgpack/v4/codes"
-)
-
-var sliceStringType = reflect.TypeOf(([]string)(nil))
-
-func encodeStringValue(e *Encoder, v reflect.Value) error {
-	return e.EncodeString(v.String())
-}
-
-func encodeByteSliceValue(e *Encoder, v reflect.Value) error {
-	return e.EncodeBytes(v.Bytes())
-}
-
-func encodeByteArrayValue(e *Encoder, v reflect.Value) error {
-	if err := e.EncodeBytesLen(v.Len()); err != nil {
-		return err
-	}
-
-	if v.CanAddr() {
-		b := v.Slice(0, v.Len()).Bytes()
-		return e.write(b)
-	}
-
-	e.buf = grow(e.buf, v.Len())
-	reflect.Copy(reflect.ValueOf(e.buf), v)
-	return e.write(e.buf)
-}
-
-func grow(b []byte, n int) []byte {
-	if cap(b) >= n {
-		return b[:n]
-	}
-	b = b[:cap(b)]
-	b = append(b, make([]byte, n-len(b))...)
-	return b
-}
-
-func (e *Encoder) EncodeBytesLen(l int) error {
-	if l < 256 {
-		return e.write1(codes.Bin8, uint8(l))
-	}
-	if l < 65536 {
-		return e.write2(codes.Bin16, uint16(l))
-	}
-	return e.write4(codes.Bin32, uint32(l))
-}
-
-func (e *Encoder) encodeStrLen(l int) error {
-	if l < 32 {
-		return e.writeCode(codes.FixedStrLow | codes.Code(l))
-	}
-	if l < 256 {
-		return e.write1(codes.Str8, uint8(l))
-	}
-	if l < 65536 {
-		return e.write2(codes.Str16, uint16(l))
-	}
-	return e.write4(codes.Str32, uint32(l))
-}
-
-func (e *Encoder) EncodeString(v string) error {
-	if err := e.encodeStrLen(len(v)); err != nil {
-		return err
-	}
-	return e.writeString(v)
-}
-
-func (e *Encoder) EncodeBytes(v []byte) error {
-	if v == nil {
-		return e.EncodeNil()
-	}
-	if err := e.EncodeBytesLen(len(v)); err != nil {
-		return err
-	}
-	return e.write(v)
-}
-
-func (e *Encoder) EncodeArrayLen(l int) error {
-	if l < 16 {
-		return e.writeCode(codes.FixedArrayLow | codes.Code(l))
-	}
-	if l < 65536 {
-		return e.write2(codes.Array16, uint16(l))
-	}
-	return e.write4(codes.Array32, uint32(l))
-}
-
-func encodeStringSliceValue(e *Encoder, v reflect.Value) error {
-	ss := v.Convert(sliceStringType).Interface().([]string)
-	return e.encodeStringSlice(ss)
-}
-
-func (e *Encoder) encodeStringSlice(s []string) error {
-	if s == nil {
-		return e.EncodeNil()
-	}
-	if err := e.EncodeArrayLen(len(s)); err != nil {
-		return err
-	}
-	for _, v := range s {
-		if err := e.EncodeString(v); err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-func encodeSliceValue(e *Encoder, v reflect.Value) error {
-	if v.IsNil() {
-		return e.EncodeNil()
-	}
-	return encodeArrayValue(e, v)
-}
-
-func encodeArrayValue(e *Encoder, v reflect.Value) error {
-	l := v.Len()
-	if err := e.EncodeArrayLen(l); err != nil {
-		return err
-	}
-	for i := 0; i < l; i++ {
-		if err := e.EncodeValue(v.Index(i)); err != nil {
-			return err
-		}
-	}
-	return nil
-}
diff --git a/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v4/ext.go b/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v4/ext.go
deleted file mode 100644
index 17e709bc8ff..00000000000
--- a/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v4/ext.go
+++ /dev/null
@@ -1,244 +0,0 @@
-package msgpack
-
-import (
-	"bytes"
-	"fmt"
-	"reflect"
-	"sync"
-
-	"github.com/vmihailenco/msgpack/v4/codes"
-)
-
-type extInfo struct {
-	Type    reflect.Type
-	Decoder decoderFunc
-}
-
-var extTypes = make(map[int8]*extInfo)
-
-var bufferPool = &sync.Pool{
-	New: func() interface{} {
-		return new(bytes.Buffer)
-	},
-}
-
-// RegisterExt records a type, identified by a value for that type,
-// under the provided id. That id will identify the concrete type of a value
-// sent or received as an interface variable. Only types that will be
-// transferred as implementations of interface values need to be registered.
-// Expecting to be used only during initialization, it panics if the mapping
-// between types and ids is not a bijection.
-func RegisterExt(id int8, value interface{}) {
-	typ := reflect.TypeOf(value)
-	if typ.Kind() == reflect.Ptr {
-		typ = typ.Elem()
-	}
-	ptr := reflect.PtrTo(typ)
-
-	if _, ok := extTypes[id]; ok {
-		panic(fmt.Errorf("msgpack: ext with id=%d is already registered", id))
-	}
-
-	registerExt(id, ptr, getEncoder(ptr), getDecoder(ptr))
-	registerExt(id, typ, getEncoder(typ), getDecoder(typ))
-}
-
-func registerExt(id int8, typ reflect.Type, enc encoderFunc, dec decoderFunc) {
-	if enc != nil {
-		typeEncMap.Store(typ, makeExtEncoder(id, enc))
-	}
-	if dec != nil {
-		extTypes[id] = &extInfo{
-			Type:    typ,
-			Decoder: dec,
-		}
-		typeDecMap.Store(typ, makeExtDecoder(id, dec))
-	}
-}
-
-func (e *Encoder) EncodeExtHeader(typeID int8, length int) error {
-	if err := e.encodeExtLen(length); err != nil {
-		return err
-	}
-	if err := e.w.WriteByte(byte(typeID)); err != nil {
-		return err
-	}
-	return nil
-}
-
-func makeExtEncoder(typeID int8, enc encoderFunc) encoderFunc {
-	return func(e *Encoder, v reflect.Value) error {
-		buf := bufferPool.Get().(*bytes.Buffer)
-		defer bufferPool.Put(buf)
-		buf.Reset()
-
-		oldw := e.w
-		e.w = buf
-		err := enc(e, v)
-		e.w = oldw
-
-		if err != nil {
-			return err
-		}
-
-		err = e.EncodeExtHeader(typeID, buf.Len())
-		if err != nil {
-			return err
-		}
-		return e.write(buf.Bytes())
-	}
-}
-
-func makeExtDecoder(typeID int8, dec decoderFunc) decoderFunc {
-	return func(d *Decoder, v reflect.Value) error {
-		c, err := d.PeekCode()
-		if err != nil {
-			return err
-		}
-
-		if !codes.IsExt(c) {
-			return dec(d, v)
-		}
-
-		id, extLen, err := d.DecodeExtHeader()
-		if err != nil {
-			return err
-		}
-
-		if id != typeID {
-			return fmt.Errorf("msgpack: got ext type=%d, wanted %d", id, typeID)
-		}
-
-		d.extLen = extLen
-		return dec(d, v)
-	}
-}
-
-func (e *Encoder) encodeExtLen(l int) error {
-	switch l {
-	case 1:
-		return e.writeCode(codes.FixExt1)
-	case 2:
-		return e.writeCode(codes.FixExt2)
-	case 4:
-		return e.writeCode(codes.FixExt4)
-	case 8:
-		return e.writeCode(codes.FixExt8)
-	case 16:
-		return e.writeCode(codes.FixExt16)
-	}
-	if l < 256 {
-		return e.write1(codes.Ext8, uint8(l))
-	}
-	if l < 65536 {
-		return e.write2(codes.Ext16, uint16(l))
-	}
-	return e.write4(codes.Ext32, uint32(l))
-}
-
-func (d *Decoder) parseExtLen(c codes.Code) (int, error) {
-	switch c {
-	case codes.FixExt1:
-		return 1, nil
-	case codes.FixExt2:
-		return 2, nil
-	case codes.FixExt4:
-		return 4, nil
-	case codes.FixExt8:
-		return 8, nil
-	case codes.FixExt16:
-		return 16, nil
-	case codes.Ext8:
-		n, err := d.uint8()
-		return int(n), err
-	case codes.Ext16:
-		n, err := d.uint16()
-		return int(n), err
-	case codes.Ext32:
-		n, err := d.uint32()
-		return int(n), err
-	default:
-		return 0, fmt.Errorf("msgpack: invalid code=%x decoding ext length", c)
-	}
-}
-
-func (d *Decoder) extHeader(c codes.Code) (int8, int, error) {
-	length, err := d.parseExtLen(c)
-	if err != nil {
-		return 0, 0, err
-	}
-
-	typeID, err := d.readCode()
-	if err != nil {
-		return 0, 0, err
-	}
-
-	return int8(typeID), length, nil
-}
-
-func (d *Decoder) DecodeExtHeader() (typeID int8, length int, err error) {
-	c, err := d.readCode()
-	if err != nil {
-		return
-	}
-	return d.extHeader(c)
-}
-
-func (d *Decoder) extInterface(c codes.Code) (interface{}, error) {
-	extID, extLen, err := d.extHeader(c)
-	if err != nil {
-		return nil, err
-	}
-
-	info, ok := extTypes[extID]
-	if !ok {
-		return nil, fmt.Errorf("msgpack: unknown ext id=%d", extID)
-	}
-
-	v := reflect.New(info.Type)
-
-	d.extLen = extLen
-	err = info.Decoder(d, v.Elem())
-	d.extLen = 0
-	if err != nil {
-		return nil, err
-	}
-
-	return v.Interface(), nil
-}
-
-func (d *Decoder) skipExt(c codes.Code) error {
-	n, err := d.parseExtLen(c)
-	if err != nil {
-		return err
-	}
-	return d.skipN(n + 1)
-}
-
-func (d *Decoder) skipExtHeader(c codes.Code) error {
-	// Read ext type.
-	_, err := d.readCode()
-	if err != nil {
-		return err
-	}
-	// Read ext body len.
-	for i := 0; i < extHeaderLen(c); i++ {
-		_, err := d.readCode()
-		if err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-func extHeaderLen(c codes.Code) int {
-	switch c {
-	case codes.Ext8:
-		return 1
-	case codes.Ext16:
-		return 2
-	case codes.Ext32:
-		return 4
-	}
-	return 0
-}
diff --git a/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v4/intern.go b/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v4/intern.go
deleted file mode 100644
index 6ca5692739a..00000000000
--- a/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v4/intern.go
+++ /dev/null
@@ -1,236 +0,0 @@
-package msgpack
-
-import (
-	"encoding/binary"
-	"errors"
-	"fmt"
-	"math"
-	"reflect"
-
-	"github.com/vmihailenco/msgpack/v4/codes"
-)
-
-var internStringExtID int8 = -128
-
-var errUnexpectedCode = errors.New("msgpack: unexpected code")
-
-func encodeInternInterfaceValue(e *Encoder, v reflect.Value) error {
-	if v.IsNil() {
-		return e.EncodeNil()
-	}
-
-	v = v.Elem()
-	if v.Kind() == reflect.String {
-		return encodeInternStringValue(e, v)
-	}
-	return e.EncodeValue(v)
-}
-
-func encodeInternStringValue(e *Encoder, v reflect.Value) error {
-	s := v.String()
-
-	if s != "" {
-		if idx, ok := e.intern[s]; ok {
-			return e.internStringIndex(idx)
-		}
-
-		if e.intern == nil {
-			e.intern = make(map[string]int)
-		}
-
-		idx := len(e.intern)
-		e.intern[s] = idx
-	}
-
-	return e.EncodeString(s)
-}
-
-func (e *Encoder) internStringIndex(idx int) error {
-	if idx < math.MaxUint8 {
-		if err := e.writeCode(codes.FixExt1); err != nil {
-			return err
-		}
-		if err := e.w.WriteByte(byte(internStringExtID)); err != nil {
-			return err
-		}
-		return e.w.WriteByte(byte(idx))
-	}
-
-	if idx < math.MaxUint16 {
-		if err := e.writeCode(codes.FixExt2); err != nil {
-			return err
-		}
-		if err := e.w.WriteByte(byte(internStringExtID)); err != nil {
-			return err
-		}
-		if err := e.w.WriteByte(byte(idx >> 8)); err != nil {
-			return err
-		}
-		return e.w.WriteByte(byte(idx))
-	}
-
-	if int64(idx) < math.MaxUint32 {
-		if err := e.writeCode(codes.FixExt4); err != nil {
-			return err
-		}
-		if err := e.w.WriteByte(byte(internStringExtID)); err != nil {
-			return err
-		}
-		if err := e.w.WriteByte(byte(idx >> 24)); err != nil {
-			return err
-		}
-		if err := e.w.WriteByte(byte(idx >> 16)); err != nil {
-			return err
-		}
-		if err := e.w.WriteByte(byte(idx >> 8)); err != nil {
-			return err
-		}
-		return e.w.WriteByte(byte(idx))
-	}
-
-	return fmt.Errorf("msgpack: intern string index=%d is too large", idx)
-}
-
-//------------------------------------------------------------------------------
-
-func decodeInternInterfaceValue(d *Decoder, v reflect.Value) error {
-	c, err := d.readCode()
-	if err != nil {
-		return err
-	}
-
-	s, err := d.internString(c)
-	if err == nil {
-		v.Set(reflect.ValueOf(s))
-		return nil
-	}
-	if err != nil && err != errUnexpectedCode {
-		return err
-	}
-
-	if err := d.s.UnreadByte(); err != nil {
-		return err
-	}
-
-	return decodeInterfaceValue(d, v)
-}
-
-func decodeInternStringValue(d *Decoder, v reflect.Value) error {
-	if err := mustSet(v); err != nil {
-		return err
-	}
-
-	c, err := d.readCode()
-	if err != nil {
-		return err
-	}
-
-	s, err := d.internString(c)
-	if err != nil {
-		if err == errUnexpectedCode {
-			return fmt.Errorf("msgpack: invalid code=%x decoding intern string", c)
-		}
-		return err
-	}
-
-	v.SetString(s)
-	return nil
-}
-
-func (d *Decoder) internString(c codes.Code) (string, error) {
-	if codes.IsFixedString(c) {
-		n := int(c & codes.FixedStrMask)
-		return d.internStringWithLen(n)
-	}
-
-	switch c {
-	case codes.FixExt1, codes.FixExt2, codes.FixExt4:
-		typeID, length, err := d.extHeader(c)
-		if err != nil {
-			return "", err
-		}
-		if typeID != internStringExtID {
-			err := fmt.Errorf("msgpack: got ext type=%d, wanted %d",
-				typeID, internStringExtID)
-			return "", err
-		}
-
-		idx, err := d.internStringIndex(length)
-		if err != nil {
-			return "", err
-		}
-
-		return d.internStringAtIndex(idx)
-	case codes.Str8, codes.Bin8:
-		n, err := d.uint8()
-		if err != nil {
-			return "", err
-		}
-		return d.internStringWithLen(int(n))
-	case codes.Str16, codes.Bin16:
-		n, err := d.uint16()
-		if err != nil {
-			return "", err
-		}
-		return d.internStringWithLen(int(n))
-	case codes.Str32, codes.Bin32:
-		n, err := d.uint32()
-		if err != nil {
-			return "", err
-		}
-		return d.internStringWithLen(int(n))
-	}
-
-	return "", errUnexpectedCode
-}
-
-func (d *Decoder) internStringIndex(length int) (int, error) {
-	switch length {
-	case 1:
-		c, err := d.s.ReadByte()
-		if err != nil {
-			return 0, err
-		}
-		return int(c), nil
-	case 2:
-		b, err := d.readN(2)
-		if err != nil {
-			return 0, err
-		}
-		n := binary.BigEndian.Uint16(b)
-		return int(n), nil
-	case 4:
-		b, err := d.readN(4)
-		if err != nil {
-			return 0, err
-		}
-		n := binary.BigEndian.Uint32(b)
-		return int(n), nil
-	}
-
-	err := fmt.Errorf("msgpack: unsupported intern string index length=%d", length)
-	return 0, err
-}
-
-func (d *Decoder) internStringAtIndex(idx int) (string, error) {
-	if idx >= len(d.intern) {
-		err := fmt.Errorf("msgpack: intern string with index=%d does not exist", idx)
-		return "", err
-	}
-	return d.intern[idx], nil
-}
-
-func (d *Decoder) internStringWithLen(n int) (string, error) {
-	if n <= 0 {
-		return "", nil
-	}
-
-	s, err := d.stringWithLen(n)
-	if err != nil {
-		return "", err
-	}
-
-	d.intern = append(d.intern, s)
-
-	return s, nil
-}
diff --git a/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v4/msgpack.go b/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v4/msgpack.go
deleted file mode 100644
index 220b43c47b3..00000000000
--- a/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v4/msgpack.go
+++ /dev/null
@@ -1,17 +0,0 @@
-package msgpack
-
-type Marshaler interface {
-	MarshalMsgpack() ([]byte, error)
-}
-
-type Unmarshaler interface {
-	UnmarshalMsgpack([]byte) error
-}
-
-type CustomEncoder interface {
-	EncodeMsgpack(*Encoder) error
-}
-
-type CustomDecoder interface {
-	DecodeMsgpack(*Decoder) error
-}
diff --git a/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v4/time.go b/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v4/time.go
deleted file mode 100644
index bf53eb2a36f..00000000000
--- a/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v4/time.go
+++ /dev/null
@@ -1,149 +0,0 @@
-package msgpack
-
-import (
-	"encoding/binary"
-	"fmt"
-	"reflect"
-	"time"
-
-	"github.com/vmihailenco/msgpack/v4/codes"
-)
-
-var timeExtID int8 = -1
-
-var timePtrType = reflect.TypeOf((*time.Time)(nil))
-
-//nolint:gochecknoinits
-func init() {
-	registerExt(timeExtID, timePtrType.Elem(), encodeTimeValue, decodeTimeValue)
-}
-
-func (e *Encoder) EncodeTime(tm time.Time) error {
-	b := e.encodeTime(tm)
-	if err := e.encodeExtLen(len(b)); err != nil {
-		return err
-	}
-	if err := e.w.WriteByte(byte(timeExtID)); err != nil {
-		return err
-	}
-	return e.write(b)
-}
-
-func (e *Encoder) encodeTime(tm time.Time) []byte {
-	secs := uint64(tm.Unix())
-	if secs>>34 == 0 {
-		data := uint64(tm.Nanosecond())<<34 | secs
-		if data&0xffffffff00000000 == 0 {
-			b := e.timeBuf[:4]
-			binary.BigEndian.PutUint32(b, uint32(data))
-			return b
-		}
-		b := e.timeBuf[:8]
-		binary.BigEndian.PutUint64(b, data)
-		return b
-	}
-
-	b := e.timeBuf[:12]
-	binary.BigEndian.PutUint32(b, uint32(tm.Nanosecond()))
-	binary.BigEndian.PutUint64(b[4:], secs)
-	return b
-}
-
-func (d *Decoder) DecodeTime() (time.Time, error) {
-	tm, err := d.decodeTime()
-	if err != nil {
-		return tm, err
-	}
-
-	if tm.IsZero() {
-		// Assume that zero time does not have timezone information.
-		return tm.UTC(), nil
-	}
-	return tm, nil
-}
-
-func (d *Decoder) decodeTime() (time.Time, error) {
-	extLen := d.extLen
-	d.extLen = 0
-	if extLen == 0 {
-		c, err := d.readCode()
-		if err != nil {
-			return time.Time{}, err
-		}
-
-		// Legacy format.
-		if c == codes.FixedArrayLow|2 {
-			sec, err := d.DecodeInt64()
-			if err != nil {
-				return time.Time{}, err
-			}
-
-			nsec, err := d.DecodeInt64()
-			if err != nil {
-				return time.Time{}, err
-			}
-
-			return time.Unix(sec, nsec), nil
-		}
-
-		if codes.IsString(c) {
-			s, err := d.string(c)
-			if err != nil {
-				return time.Time{}, err
-			}
-			return time.Parse(time.RFC3339Nano, s)
-		}
-
-		extLen, err = d.parseExtLen(c)
-		if err != nil {
-			return time.Time{}, err
-		}
-
-		// Skip ext id.
-		_, err = d.s.ReadByte()
-		if err != nil {
-			return time.Time{}, nil
-		}
-	}
-
-	b, err := d.readN(extLen)
-	if err != nil {
-		return time.Time{}, err
-	}
-
-	switch len(b) {
-	case 4:
-		sec := binary.BigEndian.Uint32(b)
-		return time.Unix(int64(sec), 0), nil
-	case 8:
-		sec := binary.BigEndian.Uint64(b)
-		nsec := int64(sec >> 34)
-		sec &= 0x00000003ffffffff
-		return time.Unix(int64(sec), nsec), nil
-	case 12:
-		nsec := binary.BigEndian.Uint32(b)
-		sec := binary.BigEndian.Uint64(b[4:])
-		return time.Unix(int64(sec), int64(nsec)), nil
-	default:
-		err = fmt.Errorf("msgpack: invalid ext len=%d decoding time", extLen)
-		return time.Time{}, err
-	}
-}
-
-func encodeTimeValue(e *Encoder, v reflect.Value) error {
-	tm := v.Interface().(time.Time)
-	b := e.encodeTime(tm)
-	return e.write(b)
-}
-
-func decodeTimeValue(d *Decoder, v reflect.Value) error {
-	tm, err := d.DecodeTime()
-	if err != nil {
-		return err
-	}
-
-	ptr := v.Addr().Interface().(*time.Time)
-	*ptr = tm
-
-	return nil
-}
diff --git a/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v4/types.go b/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v4/types.go
deleted file mode 100644
index 08cf099dd2a..00000000000
--- a/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v4/types.go
+++ /dev/null
@@ -1,382 +0,0 @@
-package msgpack
-
-import (
-	"encoding"
-	"fmt"
-	"log"
-	"reflect"
-	"sync"
-
-	"github.com/vmihailenco/tagparser"
-)
-
-var errorType = reflect.TypeOf((*error)(nil)).Elem()
-
-var (
-	customEncoderType = reflect.TypeOf((*CustomEncoder)(nil)).Elem()
-	customDecoderType = reflect.TypeOf((*CustomDecoder)(nil)).Elem()
-)
-
-var (
-	marshalerType   = reflect.TypeOf((*Marshaler)(nil)).Elem()
-	unmarshalerType = reflect.TypeOf((*Unmarshaler)(nil)).Elem()
-)
-
-var (
-	binaryMarshalerType   = reflect.TypeOf((*encoding.BinaryMarshaler)(nil)).Elem()
-	binaryUnmarshalerType = reflect.TypeOf((*encoding.BinaryUnmarshaler)(nil)).Elem()
-)
-
-type (
-	encoderFunc func(*Encoder, reflect.Value) error
-	decoderFunc func(*Decoder, reflect.Value) error
-)
-
-var (
-	typeEncMap sync.Map
-	typeDecMap sync.Map
-)
-
-// Register registers encoder and decoder functions for a value.
-// This is low level API and in most cases you should prefer implementing
-// Marshaler/CustomEncoder and Unmarshaler/CustomDecoder interfaces.
-func Register(value interface{}, enc encoderFunc, dec decoderFunc) {
-	typ := reflect.TypeOf(value)
-	if enc != nil {
-		typeEncMap.Store(typ, enc)
-	}
-	if dec != nil {
-		typeDecMap.Store(typ, dec)
-	}
-}
-
-//------------------------------------------------------------------------------
-
-var (
-	structs     = newStructCache(false)
-	jsonStructs = newStructCache(true)
-)
-
-type structCache struct {
-	m sync.Map
-
-	useJSONTag bool
-}
-
-func newStructCache(useJSONTag bool) *structCache {
-	return &structCache{
-		useJSONTag: useJSONTag,
-	}
-}
-
-func (m *structCache) Fields(typ reflect.Type) *fields {
-	if v, ok := m.m.Load(typ); ok {
-		return v.(*fields)
-	}
-
-	fs := getFields(typ, m.useJSONTag)
-	m.m.Store(typ, fs)
-	return fs
-}
-
-//------------------------------------------------------------------------------
-
-type field struct {
-	name      string
-	index     []int
-	omitEmpty bool
-	encoder   encoderFunc
-	decoder   decoderFunc
-}
-
-func (f *field) Omit(strct reflect.Value) bool {
-	v, isNil := fieldByIndex(strct, f.index)
-	if isNil {
-		return true
-	}
-	return f.omitEmpty && isEmptyValue(v)
-}
-
-func (f *field) EncodeValue(e *Encoder, strct reflect.Value) error {
-	v, isNil := fieldByIndex(strct, f.index)
-	if isNil {
-		return e.EncodeNil()
-	}
-	return f.encoder(e, v)
-}
-
-func (f *field) DecodeValue(d *Decoder, strct reflect.Value) error {
-	v := fieldByIndexAlloc(strct, f.index)
-	return f.decoder(d, v)
-}
-
-//------------------------------------------------------------------------------
-
-type fields struct {
-	Type    reflect.Type
-	Map     map[string]*field
-	List    []*field
-	AsArray bool
-
-	hasOmitEmpty bool
-}
-
-func newFields(typ reflect.Type) *fields {
-	return &fields{
-		Type: typ,
-		Map:  make(map[string]*field, typ.NumField()),
-		List: make([]*field, 0, typ.NumField()),
-	}
-}
-
-func (fs *fields) Add(field *field) {
-	fs.warnIfFieldExists(field.name)
-	fs.Map[field.name] = field
-	fs.List = append(fs.List, field)
-	if field.omitEmpty {
-		fs.hasOmitEmpty = true
-	}
-}
-
-func (fs *fields) warnIfFieldExists(name string) {
-	if _, ok := fs.Map[name]; ok {
-		log.Printf("msgpack: %s already has field=%s", fs.Type, name)
-	}
-}
-
-func (fs *fields) OmitEmpty(strct reflect.Value) []*field {
-	if !fs.hasOmitEmpty {
-		return fs.List
-	}
-
-	fields := make([]*field, 0, len(fs.List))
-
-	for _, f := range fs.List {
-		if !f.Omit(strct) {
-			fields = append(fields, f)
-		}
-	}
-
-	return fields
-}
-
-func getFields(typ reflect.Type, useJSONTag bool) *fields {
-	fs := newFields(typ)
-
-	var omitEmpty bool
-	for i := 0; i < typ.NumField(); i++ {
-		f := typ.Field(i)
-
-		tagStr := f.Tag.Get("msgpack")
-		if useJSONTag && tagStr == "" {
-			tagStr = f.Tag.Get("json")
-		}
-
-		tag := tagparser.Parse(tagStr)
-		if tag.Name == "-" {
-			continue
-		}
-
-		if f.Name == "_msgpack" {
-			if tag.HasOption("asArray") {
-				fs.AsArray = true
-			}
-			if tag.HasOption("omitempty") {
-				omitEmpty = true
-			}
-		}
-
-		if f.PkgPath != "" && !f.Anonymous {
-			continue
-		}
-
-		field := &field{
-			name:      tag.Name,
-			index:     f.Index,
-			omitEmpty: omitEmpty || tag.HasOption("omitempty"),
-		}
-
-		if tag.HasOption("intern") {
-			switch f.Type.Kind() {
-			case reflect.Interface:
-				field.encoder = encodeInternInterfaceValue
-				field.decoder = decodeInternInterfaceValue
-			case reflect.String:
-				field.encoder = encodeInternStringValue
-				field.decoder = decodeInternStringValue
-			default:
-				err := fmt.Errorf("msgpack: intern strings are not supported on %s", f.Type)
-				panic(err)
-			}
-		} else {
-			field.encoder = getEncoder(f.Type)
-			field.decoder = getDecoder(f.Type)
-		}
-
-		if field.name == "" {
-			field.name = f.Name
-		}
-
-		if f.Anonymous && !tag.HasOption("noinline") {
-			inline := tag.HasOption("inline")
-			if inline {
-				inlineFields(fs, f.Type, field, useJSONTag)
-			} else {
-				inline = shouldInline(fs, f.Type, field, useJSONTag)
-			}
-
-			if inline {
-				if _, ok := fs.Map[field.name]; ok {
-					log.Printf("msgpack: %s already has field=%s", fs.Type, field.name)
-				}
-				fs.Map[field.name] = field
-				continue
-			}
-		}
-
-		fs.Add(field)
-
-		if alias, ok := tag.Options["alias"]; ok {
-			fs.warnIfFieldExists(alias)
-			fs.Map[alias] = field
-		}
-	}
-	return fs
-}
-
-var (
-	encodeStructValuePtr uintptr
-	decodeStructValuePtr uintptr
-)
-
-//nolint:gochecknoinits
-func init() {
-	encodeStructValuePtr = reflect.ValueOf(encodeStructValue).Pointer()
-	decodeStructValuePtr = reflect.ValueOf(decodeStructValue).Pointer()
-}
-
-func inlineFields(fs *fields, typ reflect.Type, f *field, useJSONTag bool) {
-	inlinedFields := getFields(typ, useJSONTag).List
-	for _, field := range inlinedFields {
-		if _, ok := fs.Map[field.name]; ok {
-			// Don't inline shadowed fields.
-			continue
-		}
-		field.index = append(f.index, field.index...)
-		fs.Add(field)
-	}
-}
-
-func shouldInline(fs *fields, typ reflect.Type, f *field, useJSONTag bool) bool {
-	var encoder encoderFunc
-	var decoder decoderFunc
-
-	if typ.Kind() == reflect.Struct {
-		encoder = f.encoder
-		decoder = f.decoder
-	} else {
-		for typ.Kind() == reflect.Ptr {
-			typ = typ.Elem()
-			encoder = getEncoder(typ)
-			decoder = getDecoder(typ)
-		}
-		if typ.Kind() != reflect.Struct {
-			return false
-		}
-	}
-
-	if reflect.ValueOf(encoder).Pointer() != encodeStructValuePtr {
-		return false
-	}
-	if reflect.ValueOf(decoder).Pointer() != decodeStructValuePtr {
-		return false
-	}
-
-	inlinedFields := getFields(typ, useJSONTag).List
-	for _, field := range inlinedFields {
-		if _, ok := fs.Map[field.name]; ok {
-			// Don't auto inline if there are shadowed fields.
-			return false
-		}
-	}
-
-	for _, field := range inlinedFields {
-		field.index = append(f.index, field.index...)
-		fs.Add(field)
-	}
-	return true
-}
-
-func isEmptyValue(v reflect.Value) bool {
-	switch v.Kind() {
-	case reflect.Array, reflect.Map, reflect.Slice, reflect.String:
-		return v.Len() == 0
-	case reflect.Bool:
-		return !v.Bool()
-	case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
-		return v.Int() == 0
-	case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64, reflect.Uintptr:
-		return v.Uint() == 0
-	case reflect.Float32, reflect.Float64:
-		return v.Float() == 0
-	case reflect.Interface, reflect.Ptr:
-		return v.IsNil()
-	}
-	return false
-}
-
-func fieldByIndex(v reflect.Value, index []int) (_ reflect.Value, isNil bool) {
-	if len(index) == 1 {
-		return v.Field(index[0]), false
-	}
-
-	for i, idx := range index {
-		if i > 0 {
-			if v.Kind() == reflect.Ptr {
-				if v.IsNil() {
-					return v, true
-				}
-				v = v.Elem()
-			}
-		}
-		v = v.Field(idx)
-	}
-
-	return v, false
-}
-
-func fieldByIndexAlloc(v reflect.Value, index []int) reflect.Value {
-	if len(index) == 1 {
-		return v.Field(index[0])
-	}
-
-	for i, idx := range index {
-		if i > 0 {
-			var ok bool
-			v, ok = indirectNew(v)
-			if !ok {
-				return v
-			}
-		}
-		v = v.Field(idx)
-	}
-
-	return v
-}
-
-func indirectNew(v reflect.Value) (reflect.Value, bool) {
-	if v.Kind() == reflect.Ptr {
-		if v.IsNil() {
-			if !v.CanSet() {
-				return v, false
-			}
-			elemType := v.Type().Elem()
-			if elemType.Kind() != reflect.Struct {
-				return v, false
-			}
-			v.Set(reflect.New(elemType))
-		}
-		v = v.Elem()
-	}
-	return v, true
-}
diff --git a/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v5/.prettierrc b/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v5/.prettierrc
new file mode 100644
index 00000000000..8b7f044ad1f
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v5/.prettierrc
@@ -0,0 +1,4 @@
+semi: false
+singleQuote: true
+proseWrap: always
+printWidth: 100
diff --git a/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v5/.travis.yml b/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v5/.travis.yml
new file mode 100644
index 00000000000..e2ce06c49f0
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v5/.travis.yml
@@ -0,0 +1,20 @@
+sudo: false
+language: go
+
+go:
+  - 1.15.x
+  - 1.16.x
+  - tip
+
+matrix:
+  allow_failures:
+    - go: tip
+
+env:
+  - GO111MODULE=on
+
+go_import_path: github.com/vmihailenco/msgpack
+
+before_install:
+  - curl -sfL https://install.goreleaser.com/github.com/golangci/golangci-lint.sh | sh -s -- -b $(go
+    env GOPATH)/bin v1.31.0
diff --git a/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v5/CHANGELOG.md b/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v5/CHANGELOG.md
new file mode 100644
index 00000000000..f6b19d5ba40
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v5/CHANGELOG.md
@@ -0,0 +1,51 @@
+## [5.3.5](https://github.com/vmihailenco/msgpack/compare/v5.3.4...v5.3.5) (2021-10-22)
+
+
+
+## v5
+
+### Added
+
+- `DecodeMap` is split into `DecodeMap`, `DecodeTypedMap`, and `DecodeUntypedMap`.
+- New msgpack extensions API.
+
+### Changed
+
+- `Reset*` functions also reset flags.
+- `SetMapDecodeFunc` is renamed to `SetMapDecoder`.
+- `StructAsArray` is renamed to `UseArrayEncodedStructs`.
+- `SortMapKeys` is renamed to `SetSortMapKeys`.
+
+### Removed
+
+- `UseJSONTag` is removed. Use `SetCustomStructTag("json")` instead.
+
+## v4
+
+- Encode, Decode, Marshal, and Unmarshal are changed to accept single argument. EncodeMulti and
+  DecodeMulti are added as replacement.
+- Added EncodeInt8/16/32/64 and EncodeUint8/16/32/64.
+- Encoder changed to preserve type of numbers instead of chosing most compact encoding. The old
+  behavior can be achieved with Encoder.UseCompactEncoding.
+
+## v3.3
+
+- `msgpack:",inline"` tag is restored to force inlining structs.
+
+## v3.2
+
+- Decoding extension types returns pointer to the value instead of the value. Fixes #153
+
+## v3
+
+- gopkg.in is not supported any more. Update import path to github.com/vmihailenco/msgpack.
+- Msgpack maps are decoded into map[string]interface{} by default.
+- EncodeSliceLen is removed in favor of EncodeArrayLen. DecodeSliceLen is removed in favor of
+  DecodeArrayLen.
+- Embedded structs are automatically inlined where possible.
+- Time is encoded using extension as described in https://github.com/msgpack/msgpack/pull/209. Old
+  format is supported as well.
+- EncodeInt8/16/32/64 is replaced with EncodeInt. EncodeUint8/16/32/64 is replaced with EncodeUint.
+  There should be no performance differences.
+- DecodeInterface can now return int8/16/32 and uint8/16/32.
+- PeekCode returns codes.Code instead of byte.
diff --git a/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v4/LICENSE b/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v5/LICENSE
similarity index 100%
rename from .ci/providerlint/vendor/github.com/vmihailenco/msgpack/v4/LICENSE
rename to .ci/providerlint/vendor/github.com/vmihailenco/msgpack/v5/LICENSE
diff --git a/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v5/Makefile b/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v5/Makefile
new file mode 100644
index 00000000000..e9aade78294
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v5/Makefile
@@ -0,0 +1,6 @@
+test:
+	go test ./...
+	go test ./... -short -race
+	go test ./... -run=NONE -bench=. -benchmem
+	env GOOS=linux GOARCH=386 go test ./...
+	go vet
diff --git a/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v5/README.md b/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v5/README.md
new file mode 100644
index 00000000000..66ad98b9c8d
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v5/README.md
@@ -0,0 +1,86 @@
+# MessagePack encoding for Golang
+
+[![Build Status](https://travis-ci.org/vmihailenco/msgpack.svg)](https://travis-ci.org/vmihailenco/msgpack)
+[![PkgGoDev](https://pkg.go.dev/badge/github.com/vmihailenco/msgpack/v5)](https://pkg.go.dev/github.com/vmihailenco/msgpack/v5)
+[![Documentation](https://img.shields.io/badge/msgpack-documentation-informational)](https://msgpack.uptrace.dev/)
+[![Chat](https://discordapp.com/api/guilds/752070105847955518/widget.png)](https://discord.gg/rWtp5Aj)
+
+> :heart:
+> [**Uptrace.dev** - All-in-one tool to optimize performance and monitor errors & logs](https://uptrace.dev/?utm_source=gh-msgpack&utm_campaign=gh-msgpack-var2)
+
+- Join [Discord](https://discord.gg/rWtp5Aj) to ask questions.
+- [Documentation](https://msgpack.uptrace.dev)
+- [Reference](https://pkg.go.dev/github.com/vmihailenco/msgpack/v5)
+- [Examples](https://pkg.go.dev/github.com/vmihailenco/msgpack/v5#pkg-examples)
+
+Other projects you may like:
+
+- [Bun](https://bun.uptrace.dev) - fast and simple SQL client for PostgreSQL, MySQL, and SQLite.
+- [BunRouter](https://bunrouter.uptrace.dev/) - fast and flexible HTTP router for Go.
+
+## Features
+
+- Primitives, arrays, maps, structs, time.Time and interface{}.
+- Appengine \*datastore.Key and datastore.Cursor.
+- [CustomEncoder]/[CustomDecoder] interfaces for custom encoding.
+- [Extensions](https://pkg.go.dev/github.com/vmihailenco/msgpack/v5#example-RegisterExt) to encode
+  type information.
+- Renaming fields via `msgpack:"my_field_name"` and alias via `msgpack:"alias:another_name"`.
+- Omitting individual empty fields via `msgpack:",omitempty"` tag or all
+  [empty fields in a struct](https://pkg.go.dev/github.com/vmihailenco/msgpack/v5#example-Marshal-OmitEmpty).
+- [Map keys sorting](https://pkg.go.dev/github.com/vmihailenco/msgpack/v5#Encoder.SetSortMapKeys).
+- Encoding/decoding all
+  [structs as arrays](https://pkg.go.dev/github.com/vmihailenco/msgpack/v5#Encoder.UseArrayEncodedStructs)
+  or
+  [individual structs](https://pkg.go.dev/github.com/vmihailenco/msgpack/v5#example-Marshal-AsArray).
+- [Encoder.SetCustomStructTag] with [Decoder.SetCustomStructTag] can turn msgpack into drop-in
+  replacement for any tag.
+- Simple but very fast and efficient
+  [queries](https://pkg.go.dev/github.com/vmihailenco/msgpack/v5#example-Decoder.Query).
+
+[customencoder]: https://pkg.go.dev/github.com/vmihailenco/msgpack/v5#CustomEncoder
+[customdecoder]: https://pkg.go.dev/github.com/vmihailenco/msgpack/v5#CustomDecoder
+[encoder.setcustomstructtag]:
+  https://pkg.go.dev/github.com/vmihailenco/msgpack/v5#Encoder.SetCustomStructTag
+[decoder.setcustomstructtag]:
+  https://pkg.go.dev/github.com/vmihailenco/msgpack/v5#Decoder.SetCustomStructTag
+
+## Installation
+
+msgpack supports 2 last Go versions and requires support for
+[Go modules](https://github.com/golang/go/wiki/Modules). So make sure to initialize a Go module:
+
+```shell
+go mod init github.com/my/repo
+```
+
+And then install msgpack/v5 (note _v5_ in the import; omitting it is a popular mistake):
+
+```shell
+go get github.com/vmihailenco/msgpack/v5
+```
+
+## Quickstart
+
+```go
+import "github.com/vmihailenco/msgpack/v5"
+
+func ExampleMarshal() {
+    type Item struct {
+        Foo string
+    }
+
+    b, err := msgpack.Marshal(&Item{Foo: "bar"})
+    if err != nil {
+        panic(err)
+    }
+
+    var item Item
+    err = msgpack.Unmarshal(b, &item)
+    if err != nil {
+        panic(err)
+    }
+    fmt.Println(item.Foo)
+    // Output: bar
+}
+```
diff --git a/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v5/commitlint.config.js b/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v5/commitlint.config.js
new file mode 100644
index 00000000000..4fedde6daf0
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v5/commitlint.config.js
@@ -0,0 +1 @@
+module.exports = { extends: ['@commitlint/config-conventional'] }
diff --git a/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v5/decode.go b/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v5/decode.go
new file mode 100644
index 00000000000..5df40e5d9ca
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v5/decode.go
@@ -0,0 +1,663 @@
+package msgpack
+
+import (
+	"bufio"
+	"bytes"
+	"errors"
+	"fmt"
+	"io"
+	"reflect"
+	"sync"
+	"time"
+
+	"github.com/vmihailenco/msgpack/v5/msgpcode"
+)
+
+const (
+	looseInterfaceDecodingFlag uint32 = 1 << iota
+	disallowUnknownFieldsFlag
+)
+
+const (
+	bytesAllocLimit = 1e6 // 1mb
+	sliceAllocLimit = 1e4
+	maxMapSize      = 1e6
+)
+
+type bufReader interface {
+	io.Reader
+	io.ByteScanner
+}
+
+//------------------------------------------------------------------------------
+
+var decPool = sync.Pool{
+	New: func() interface{} {
+		return NewDecoder(nil)
+	},
+}
+
+func GetDecoder() *Decoder {
+	return decPool.Get().(*Decoder)
+}
+
+func PutDecoder(dec *Decoder) {
+	dec.r = nil
+	dec.s = nil
+	decPool.Put(dec)
+}
+
+//------------------------------------------------------------------------------
+
+// Unmarshal decodes the MessagePack-encoded data and stores the result
+// in the value pointed to by v.
+func Unmarshal(data []byte, v interface{}) error {
+	dec := GetDecoder()
+
+	dec.Reset(bytes.NewReader(data))
+	err := dec.Decode(v)
+
+	PutDecoder(dec)
+
+	return err
+}
+
+// A Decoder reads and decodes MessagePack values from an input stream.
+type Decoder struct {
+	r   io.Reader
+	s   io.ByteScanner
+	buf []byte
+
+	rec []byte // accumulates read data if not nil
+
+	dict       []string
+	flags      uint32
+	structTag  string
+	mapDecoder func(*Decoder) (interface{}, error)
+}
+
+// NewDecoder returns a new decoder that reads from r.
+//
+// The decoder introduces its own buffering and may read data from r
+// beyond the requested msgpack values. Buffering can be disabled
+// by passing a reader that implements io.ByteScanner interface.
+func NewDecoder(r io.Reader) *Decoder {
+	d := new(Decoder)
+	d.Reset(r)
+	return d
+}
+
+// Reset discards any buffered data, resets all state, and switches the buffered
+// reader to read from r.
+func (d *Decoder) Reset(r io.Reader) {
+	d.ResetDict(r, nil)
+}
+
+// ResetDict is like Reset, but also resets the dict.
+func (d *Decoder) ResetDict(r io.Reader, dict []string) {
+	d.resetReader(r)
+	d.flags = 0
+	d.structTag = ""
+	d.mapDecoder = nil
+	d.dict = dict
+}
+
+func (d *Decoder) WithDict(dict []string, fn func(*Decoder) error) error {
+	oldDict := d.dict
+	d.dict = dict
+	err := fn(d)
+	d.dict = oldDict
+	return err
+}
+
+func (d *Decoder) resetReader(r io.Reader) {
+	if br, ok := r.(bufReader); ok {
+		d.r = br
+		d.s = br
+	} else {
+		br := bufio.NewReader(r)
+		d.r = br
+		d.s = br
+	}
+}
+
+func (d *Decoder) SetMapDecoder(fn func(*Decoder) (interface{}, error)) {
+	d.mapDecoder = fn
+}
+
+// UseLooseInterfaceDecoding causes decoder to use DecodeInterfaceLoose
+// to decode msgpack value into Go interface{}.
+func (d *Decoder) UseLooseInterfaceDecoding(on bool) {
+	if on {
+		d.flags |= looseInterfaceDecodingFlag
+	} else {
+		d.flags &= ^looseInterfaceDecodingFlag
+	}
+}
+
+// SetCustomStructTag causes the decoder to use the supplied tag as a fallback option
+// if there is no msgpack tag.
+func (d *Decoder) SetCustomStructTag(tag string) {
+	d.structTag = tag
+}
+
+// DisallowUnknownFields causes the Decoder to return an error when the destination
+// is a struct and the input contains object keys which do not match any
+// non-ignored, exported fields in the destination.
+func (d *Decoder) DisallowUnknownFields(on bool) {
+	if on {
+		d.flags |= disallowUnknownFieldsFlag
+	} else {
+		d.flags &= ^disallowUnknownFieldsFlag
+	}
+}
+
+// UseInternedStrings enables support for decoding interned strings.
+func (d *Decoder) UseInternedStrings(on bool) {
+	if on {
+		d.flags |= useInternedStringsFlag
+	} else {
+		d.flags &= ^useInternedStringsFlag
+	}
+}
+
+// Buffered returns a reader of the data remaining in the Decoder's buffer.
+// The reader is valid until the next call to Decode.
+func (d *Decoder) Buffered() io.Reader {
+	return d.r
+}
+
+//nolint:gocyclo
+func (d *Decoder) Decode(v interface{}) error {
+	var err error
+	switch v := v.(type) {
+	case *string:
+		if v != nil {
+			*v, err = d.DecodeString()
+			return err
+		}
+	case *[]byte:
+		if v != nil {
+			return d.decodeBytesPtr(v)
+		}
+	case *int:
+		if v != nil {
+			*v, err = d.DecodeInt()
+			return err
+		}
+	case *int8:
+		if v != nil {
+			*v, err = d.DecodeInt8()
+			return err
+		}
+	case *int16:
+		if v != nil {
+			*v, err = d.DecodeInt16()
+			return err
+		}
+	case *int32:
+		if v != nil {
+			*v, err = d.DecodeInt32()
+			return err
+		}
+	case *int64:
+		if v != nil {
+			*v, err = d.DecodeInt64()
+			return err
+		}
+	case *uint:
+		if v != nil {
+			*v, err = d.DecodeUint()
+			return err
+		}
+	case *uint8:
+		if v != nil {
+			*v, err = d.DecodeUint8()
+			return err
+		}
+	case *uint16:
+		if v != nil {
+			*v, err = d.DecodeUint16()
+			return err
+		}
+	case *uint32:
+		if v != nil {
+			*v, err = d.DecodeUint32()
+			return err
+		}
+	case *uint64:
+		if v != nil {
+			*v, err = d.DecodeUint64()
+			return err
+		}
+	case *bool:
+		if v != nil {
+			*v, err = d.DecodeBool()
+			return err
+		}
+	case *float32:
+		if v != nil {
+			*v, err = d.DecodeFloat32()
+			return err
+		}
+	case *float64:
+		if v != nil {
+			*v, err = d.DecodeFloat64()
+			return err
+		}
+	case *[]string:
+		return d.decodeStringSlicePtr(v)
+	case *map[string]string:
+		return d.decodeMapStringStringPtr(v)
+	case *map[string]interface{}:
+		return d.decodeMapStringInterfacePtr(v)
+	case *time.Duration:
+		if v != nil {
+			vv, err := d.DecodeInt64()
+			*v = time.Duration(vv)
+			return err
+		}
+	case *time.Time:
+		if v != nil {
+			*v, err = d.DecodeTime()
+			return err
+		}
+	}
+
+	vv := reflect.ValueOf(v)
+	if !vv.IsValid() {
+		return errors.New("msgpack: Decode(nil)")
+	}
+	if vv.Kind() != reflect.Ptr {
+		return fmt.Errorf("msgpack: Decode(non-pointer %T)", v)
+	}
+	if vv.IsNil() {
+		return fmt.Errorf("msgpack: Decode(non-settable %T)", v)
+	}
+
+	vv = vv.Elem()
+	if vv.Kind() == reflect.Interface {
+		if !vv.IsNil() {
+			vv = vv.Elem()
+			if vv.Kind() != reflect.Ptr {
+				return fmt.Errorf("msgpack: Decode(non-pointer %s)", vv.Type().String())
+			}
+		}
+	}
+
+	return d.DecodeValue(vv)
+}
+
+func (d *Decoder) DecodeMulti(v ...interface{}) error {
+	for _, vv := range v {
+		if err := d.Decode(vv); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func (d *Decoder) decodeInterfaceCond() (interface{}, error) {
+	if d.flags&looseInterfaceDecodingFlag != 0 {
+		return d.DecodeInterfaceLoose()
+	}
+	return d.DecodeInterface()
+}
+
+func (d *Decoder) DecodeValue(v reflect.Value) error {
+	decode := getDecoder(v.Type())
+	return decode(d, v)
+}
+
+func (d *Decoder) DecodeNil() error {
+	c, err := d.readCode()
+	if err != nil {
+		return err
+	}
+	if c != msgpcode.Nil {
+		return fmt.Errorf("msgpack: invalid code=%x decoding nil", c)
+	}
+	return nil
+}
+
+func (d *Decoder) decodeNilValue(v reflect.Value) error {
+	err := d.DecodeNil()
+	if v.IsNil() {
+		return err
+	}
+	if v.Kind() == reflect.Ptr {
+		v = v.Elem()
+	}
+	v.Set(reflect.Zero(v.Type()))
+	return err
+}
+
+func (d *Decoder) DecodeBool() (bool, error) {
+	c, err := d.readCode()
+	if err != nil {
+		return false, err
+	}
+	return d.bool(c)
+}
+
+func (d *Decoder) bool(c byte) (bool, error) {
+	if c == msgpcode.Nil {
+		return false, nil
+	}
+	if c == msgpcode.False {
+		return false, nil
+	}
+	if c == msgpcode.True {
+		return true, nil
+	}
+	return false, fmt.Errorf("msgpack: invalid code=%x decoding bool", c)
+}
+
+func (d *Decoder) DecodeDuration() (time.Duration, error) {
+	n, err := d.DecodeInt64()
+	if err != nil {
+		return 0, err
+	}
+	return time.Duration(n), nil
+}
+
+// DecodeInterface decodes value into interface. It returns following types:
+//   - nil,
+//   - bool,
+//   - int8, int16, int32, int64,
+//   - uint8, uint16, uint32, uint64,
+//   - float32 and float64,
+//   - string,
+//   - []byte,
+//   - slices of any of the above,
+//   - maps of any of the above.
+//
+// DecodeInterface should be used only when you don't know the type of value
+// you are decoding. For example, if you are decoding number it is better to use
+// DecodeInt64 for negative numbers and DecodeUint64 for positive numbers.
+func (d *Decoder) DecodeInterface() (interface{}, error) {
+	c, err := d.readCode()
+	if err != nil {
+		return nil, err
+	}
+
+	if msgpcode.IsFixedNum(c) {
+		return int8(c), nil
+	}
+	if msgpcode.IsFixedMap(c) {
+		err = d.s.UnreadByte()
+		if err != nil {
+			return nil, err
+		}
+		return d.decodeMapDefault()
+	}
+	if msgpcode.IsFixedArray(c) {
+		return d.decodeSlice(c)
+	}
+	if msgpcode.IsFixedString(c) {
+		return d.string(c)
+	}
+
+	switch c {
+	case msgpcode.Nil:
+		return nil, nil
+	case msgpcode.False, msgpcode.True:
+		return d.bool(c)
+	case msgpcode.Float:
+		return d.float32(c)
+	case msgpcode.Double:
+		return d.float64(c)
+	case msgpcode.Uint8:
+		return d.uint8()
+	case msgpcode.Uint16:
+		return d.uint16()
+	case msgpcode.Uint32:
+		return d.uint32()
+	case msgpcode.Uint64:
+		return d.uint64()
+	case msgpcode.Int8:
+		return d.int8()
+	case msgpcode.Int16:
+		return d.int16()
+	case msgpcode.Int32:
+		return d.int32()
+	case msgpcode.Int64:
+		return d.int64()
+	case msgpcode.Bin8, msgpcode.Bin16, msgpcode.Bin32:
+		return d.bytes(c, nil)
+	case msgpcode.Str8, msgpcode.Str16, msgpcode.Str32:
+		return d.string(c)
+	case msgpcode.Array16, msgpcode.Array32:
+		return d.decodeSlice(c)
+	case msgpcode.Map16, msgpcode.Map32:
+		err = d.s.UnreadByte()
+		if err != nil {
+			return nil, err
+		}
+		return d.decodeMapDefault()
+	case msgpcode.FixExt1, msgpcode.FixExt2, msgpcode.FixExt4, msgpcode.FixExt8, msgpcode.FixExt16,
+		msgpcode.Ext8, msgpcode.Ext16, msgpcode.Ext32:
+		return d.decodeInterfaceExt(c)
+	}
+
+	return 0, fmt.Errorf("msgpack: unknown code %x decoding interface{}", c)
+}
+
+// DecodeInterfaceLoose is like DecodeInterface except that:
+//   - int8, int16, and int32 are converted to int64,
+//   - uint8, uint16, and uint32 are converted to uint64,
+//   - float32 is converted to float64.
+//   - []byte is converted to string.
+func (d *Decoder) DecodeInterfaceLoose() (interface{}, error) {
+	c, err := d.readCode()
+	if err != nil {
+		return nil, err
+	}
+
+	if msgpcode.IsFixedNum(c) {
+		return int64(int8(c)), nil
+	}
+	if msgpcode.IsFixedMap(c) {
+		err = d.s.UnreadByte()
+		if err != nil {
+			return nil, err
+		}
+		return d.decodeMapDefault()
+	}
+	if msgpcode.IsFixedArray(c) {
+		return d.decodeSlice(c)
+	}
+	if msgpcode.IsFixedString(c) {
+		return d.string(c)
+	}
+
+	switch c {
+	case msgpcode.Nil:
+		return nil, nil
+	case msgpcode.False, msgpcode.True:
+		return d.bool(c)
+	case msgpcode.Float, msgpcode.Double:
+		return d.float64(c)
+	case msgpcode.Uint8, msgpcode.Uint16, msgpcode.Uint32, msgpcode.Uint64:
+		return d.uint(c)
+	case msgpcode.Int8, msgpcode.Int16, msgpcode.Int32, msgpcode.Int64:
+		return d.int(c)
+	case msgpcode.Str8, msgpcode.Str16, msgpcode.Str32,
+		msgpcode.Bin8, msgpcode.Bin16, msgpcode.Bin32:
+		return d.string(c)
+	case msgpcode.Array16, msgpcode.Array32:
+		return d.decodeSlice(c)
+	case msgpcode.Map16, msgpcode.Map32:
+		err = d.s.UnreadByte()
+		if err != nil {
+			return nil, err
+		}
+		return d.decodeMapDefault()
+	case msgpcode.FixExt1, msgpcode.FixExt2, msgpcode.FixExt4, msgpcode.FixExt8, msgpcode.FixExt16,
+		msgpcode.Ext8, msgpcode.Ext16, msgpcode.Ext32:
+		return d.decodeInterfaceExt(c)
+	}
+
+	return 0, fmt.Errorf("msgpack: unknown code %x decoding interface{}", c)
+}
+
+// Skip skips next value.
+func (d *Decoder) Skip() error {
+	c, err := d.readCode()
+	if err != nil {
+		return err
+	}
+
+	if msgpcode.IsFixedNum(c) {
+		return nil
+	}
+	if msgpcode.IsFixedMap(c) {
+		return d.skipMap(c)
+	}
+	if msgpcode.IsFixedArray(c) {
+		return d.skipSlice(c)
+	}
+	if msgpcode.IsFixedString(c) {
+		return d.skipBytes(c)
+	}
+
+	switch c {
+	case msgpcode.Nil, msgpcode.False, msgpcode.True:
+		return nil
+	case msgpcode.Uint8, msgpcode.Int8:
+		return d.skipN(1)
+	case msgpcode.Uint16, msgpcode.Int16:
+		return d.skipN(2)
+	case msgpcode.Uint32, msgpcode.Int32, msgpcode.Float:
+		return d.skipN(4)
+	case msgpcode.Uint64, msgpcode.Int64, msgpcode.Double:
+		return d.skipN(8)
+	case msgpcode.Bin8, msgpcode.Bin16, msgpcode.Bin32:
+		return d.skipBytes(c)
+	case msgpcode.Str8, msgpcode.Str16, msgpcode.Str32:
+		return d.skipBytes(c)
+	case msgpcode.Array16, msgpcode.Array32:
+		return d.skipSlice(c)
+	case msgpcode.Map16, msgpcode.Map32:
+		return d.skipMap(c)
+	case msgpcode.FixExt1, msgpcode.FixExt2, msgpcode.FixExt4, msgpcode.FixExt8, msgpcode.FixExt16,
+		msgpcode.Ext8, msgpcode.Ext16, msgpcode.Ext32:
+		return d.skipExt(c)
+	}
+
+	return fmt.Errorf("msgpack: unknown code %x", c)
+}
+
+func (d *Decoder) DecodeRaw() (RawMessage, error) {
+	d.rec = make([]byte, 0)
+	if err := d.Skip(); err != nil {
+		return nil, err
+	}
+	msg := RawMessage(d.rec)
+	d.rec = nil
+	return msg, nil
+}
+
+// PeekCode returns the next MessagePack code without advancing the reader.
+// Subpackage msgpack/codes defines the list of available msgpcode.
+func (d *Decoder) PeekCode() (byte, error) {
+	c, err := d.s.ReadByte()
+	if err != nil {
+		return 0, err
+	}
+	return c, d.s.UnreadByte()
+}
+
+// ReadFull reads exactly len(buf) bytes into the buf.
+func (d *Decoder) ReadFull(buf []byte) error {
+	_, err := readN(d.r, buf, len(buf))
+	return err
+}
+
+func (d *Decoder) hasNilCode() bool {
+	code, err := d.PeekCode()
+	return err == nil && code == msgpcode.Nil
+}
+
+func (d *Decoder) readCode() (byte, error) {
+	c, err := d.s.ReadByte()
+	if err != nil {
+		return 0, err
+	}
+	if d.rec != nil {
+		d.rec = append(d.rec, c)
+	}
+	return c, nil
+}
+
+func (d *Decoder) readFull(b []byte) error {
+	_, err := io.ReadFull(d.r, b)
+	if err != nil {
+		return err
+	}
+	if d.rec != nil {
+		d.rec = append(d.rec, b...)
+	}
+	return nil
+}
+
+func (d *Decoder) readN(n int) ([]byte, error) {
+	var err error
+	d.buf, err = readN(d.r, d.buf, n)
+	if err != nil {
+		return nil, err
+	}
+	if d.rec != nil {
+		// TODO: read directly into d.rec?
+		d.rec = append(d.rec, d.buf...)
+	}
+	return d.buf, nil
+}
+
+func readN(r io.Reader, b []byte, n int) ([]byte, error) {
+	if b == nil {
+		if n == 0 {
+			return make([]byte, 0), nil
+		}
+		switch {
+		case n < 64:
+			b = make([]byte, 0, 64)
+		case n <= bytesAllocLimit:
+			b = make([]byte, 0, n)
+		default:
+			b = make([]byte, 0, bytesAllocLimit)
+		}
+	}
+
+	if n <= cap(b) {
+		b = b[:n]
+		_, err := io.ReadFull(r, b)
+		return b, err
+	}
+	b = b[:cap(b)]
+
+	var pos int
+	for {
+		alloc := min(n-len(b), bytesAllocLimit)
+		b = append(b, make([]byte, alloc)...)
+
+		_, err := io.ReadFull(r, b[pos:])
+		if err != nil {
+			return b, err
+		}
+
+		if len(b) == n {
+			break
+		}
+		pos = len(b)
+	}
+
+	return b, nil
+}
+
+func min(a, b int) int { //nolint:unparam
+	if a <= b {
+		return a
+	}
+	return b
+}
diff --git a/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v5/decode_map.go b/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v5/decode_map.go
new file mode 100644
index 00000000000..52e0526cc51
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v5/decode_map.go
@@ -0,0 +1,339 @@
+package msgpack
+
+import (
+	"errors"
+	"fmt"
+	"reflect"
+
+	"github.com/vmihailenco/msgpack/v5/msgpcode"
+)
+
+var errArrayStruct = errors.New("msgpack: number of fields in array-encoded struct has changed")
+
+var (
+	mapStringStringPtrType = reflect.TypeOf((*map[string]string)(nil))
+	mapStringStringType    = mapStringStringPtrType.Elem()
+)
+
+var (
+	mapStringInterfacePtrType = reflect.TypeOf((*map[string]interface{})(nil))
+	mapStringInterfaceType    = mapStringInterfacePtrType.Elem()
+)
+
+func decodeMapValue(d *Decoder, v reflect.Value) error {
+	n, err := d.DecodeMapLen()
+	if err != nil {
+		return err
+	}
+
+	typ := v.Type()
+	if n == -1 {
+		v.Set(reflect.Zero(typ))
+		return nil
+	}
+
+	if v.IsNil() {
+		v.Set(reflect.MakeMap(typ))
+	}
+	if n == 0 {
+		return nil
+	}
+
+	return d.decodeTypedMapValue(v, n)
+}
+
+func (d *Decoder) decodeMapDefault() (interface{}, error) {
+	if d.mapDecoder != nil {
+		return d.mapDecoder(d)
+	}
+	return d.DecodeMap()
+}
+
+// DecodeMapLen decodes map length. Length is -1 when map is nil.
+func (d *Decoder) DecodeMapLen() (int, error) {
+	c, err := d.readCode()
+	if err != nil {
+		return 0, err
+	}
+
+	if msgpcode.IsExt(c) {
+		if err = d.skipExtHeader(c); err != nil {
+			return 0, err
+		}
+
+		c, err = d.readCode()
+		if err != nil {
+			return 0, err
+		}
+	}
+	return d.mapLen(c)
+}
+
+func (d *Decoder) mapLen(c byte) (int, error) {
+	if c == msgpcode.Nil {
+		return -1, nil
+	}
+	if c >= msgpcode.FixedMapLow && c <= msgpcode.FixedMapHigh {
+		return int(c & msgpcode.FixedMapMask), nil
+	}
+	if c == msgpcode.Map16 {
+		size, err := d.uint16()
+		return int(size), err
+	}
+	if c == msgpcode.Map32 {
+		size, err := d.uint32()
+		return int(size), err
+	}
+	return 0, unexpectedCodeError{code: c, hint: "map length"}
+}
+
+func decodeMapStringStringValue(d *Decoder, v reflect.Value) error {
+	mptr := v.Addr().Convert(mapStringStringPtrType).Interface().(*map[string]string)
+	return d.decodeMapStringStringPtr(mptr)
+}
+
+func (d *Decoder) decodeMapStringStringPtr(ptr *map[string]string) error {
+	size, err := d.DecodeMapLen()
+	if err != nil {
+		return err
+	}
+	if size == -1 {
+		*ptr = nil
+		return nil
+	}
+
+	m := *ptr
+	if m == nil {
+		*ptr = make(map[string]string, min(size, maxMapSize))
+		m = *ptr
+	}
+
+	for i := 0; i < size; i++ {
+		mk, err := d.DecodeString()
+		if err != nil {
+			return err
+		}
+		mv, err := d.DecodeString()
+		if err != nil {
+			return err
+		}
+		m[mk] = mv
+	}
+
+	return nil
+}
+
+func decodeMapStringInterfaceValue(d *Decoder, v reflect.Value) error {
+	ptr := v.Addr().Convert(mapStringInterfacePtrType).Interface().(*map[string]interface{})
+	return d.decodeMapStringInterfacePtr(ptr)
+}
+
+func (d *Decoder) decodeMapStringInterfacePtr(ptr *map[string]interface{}) error {
+	m, err := d.DecodeMap()
+	if err != nil {
+		return err
+	}
+	*ptr = m
+	return nil
+}
+
+func (d *Decoder) DecodeMap() (map[string]interface{}, error) {
+	n, err := d.DecodeMapLen()
+	if err != nil {
+		return nil, err
+	}
+
+	if n == -1 {
+		return nil, nil
+	}
+
+	m := make(map[string]interface{}, min(n, maxMapSize))
+
+	for i := 0; i < n; i++ {
+		mk, err := d.DecodeString()
+		if err != nil {
+			return nil, err
+		}
+		mv, err := d.decodeInterfaceCond()
+		if err != nil {
+			return nil, err
+		}
+		m[mk] = mv
+	}
+
+	return m, nil
+}
+
+func (d *Decoder) DecodeUntypedMap() (map[interface{}]interface{}, error) {
+	n, err := d.DecodeMapLen()
+	if err != nil {
+		return nil, err
+	}
+
+	if n == -1 {
+		return nil, nil
+	}
+
+	m := make(map[interface{}]interface{}, min(n, maxMapSize))
+
+	for i := 0; i < n; i++ {
+		mk, err := d.decodeInterfaceCond()
+		if err != nil {
+			return nil, err
+		}
+
+		mv, err := d.decodeInterfaceCond()
+		if err != nil {
+			return nil, err
+		}
+
+		m[mk] = mv
+	}
+
+	return m, nil
+}
+
+// DecodeTypedMap decodes a typed map. Typed map is a map that has a fixed type for keys and values.
+// Key and value types may be different.
+func (d *Decoder) DecodeTypedMap() (interface{}, error) {
+	n, err := d.DecodeMapLen()
+	if err != nil {
+		return nil, err
+	}
+	if n <= 0 {
+		return nil, nil
+	}
+
+	key, err := d.decodeInterfaceCond()
+	if err != nil {
+		return nil, err
+	}
+
+	value, err := d.decodeInterfaceCond()
+	if err != nil {
+		return nil, err
+	}
+
+	keyType := reflect.TypeOf(key)
+	valueType := reflect.TypeOf(value)
+
+	if !keyType.Comparable() {
+		return nil, fmt.Errorf("msgpack: unsupported map key: %s", keyType.String())
+	}
+
+	mapType := reflect.MapOf(keyType, valueType)
+	mapValue := reflect.MakeMap(mapType)
+	mapValue.SetMapIndex(reflect.ValueOf(key), reflect.ValueOf(value))
+
+	n--
+	if err := d.decodeTypedMapValue(mapValue, n); err != nil {
+		return nil, err
+	}
+
+	return mapValue.Interface(), nil
+}
+
+func (d *Decoder) decodeTypedMapValue(v reflect.Value, n int) error {
+	typ := v.Type()
+	keyType := typ.Key()
+	valueType := typ.Elem()
+
+	for i := 0; i < n; i++ {
+		mk := reflect.New(keyType).Elem()
+		if err := d.DecodeValue(mk); err != nil {
+			return err
+		}
+
+		mv := reflect.New(valueType).Elem()
+		if err := d.DecodeValue(mv); err != nil {
+			return err
+		}
+
+		v.SetMapIndex(mk, mv)
+	}
+
+	return nil
+}
+
+func (d *Decoder) skipMap(c byte) error {
+	n, err := d.mapLen(c)
+	if err != nil {
+		return err
+	}
+	for i := 0; i < n; i++ {
+		if err := d.Skip(); err != nil {
+			return err
+		}
+		if err := d.Skip(); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func decodeStructValue(d *Decoder, v reflect.Value) error {
+	c, err := d.readCode()
+	if err != nil {
+		return err
+	}
+
+	n, err := d.mapLen(c)
+	if err == nil {
+		return d.decodeStruct(v, n)
+	}
+
+	var err2 error
+	n, err2 = d.arrayLen(c)
+	if err2 != nil {
+		return err
+	}
+
+	if n <= 0 {
+		v.Set(reflect.Zero(v.Type()))
+		return nil
+	}
+
+	fields := structs.Fields(v.Type(), d.structTag)
+	if n != len(fields.List) {
+		return errArrayStruct
+	}
+
+	for _, f := range fields.List {
+		if err := f.DecodeValue(d, v); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func (d *Decoder) decodeStruct(v reflect.Value, n int) error {
+	if n == -1 {
+		v.Set(reflect.Zero(v.Type()))
+		return nil
+	}
+
+	fields := structs.Fields(v.Type(), d.structTag)
+	for i := 0; i < n; i++ {
+		name, err := d.decodeStringTemp()
+		if err != nil {
+			return err
+		}
+
+		if f := fields.Map[name]; f != nil {
+			if err := f.DecodeValue(d, v); err != nil {
+				return err
+			}
+			continue
+		}
+
+		if d.flags&disallowUnknownFieldsFlag != 0 {
+			return fmt.Errorf("msgpack: unknown field %q", name)
+		}
+		if err := d.Skip(); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
diff --git a/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v4/decode_number.go b/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v5/decode_number.go
similarity index 83%
rename from .ci/providerlint/vendor/github.com/vmihailenco/msgpack/v4/decode_number.go
rename to .ci/providerlint/vendor/github.com/vmihailenco/msgpack/v5/decode_number.go
index f6b9151f01e..45d6a741868 100644
--- a/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v4/decode_number.go
+++ b/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v5/decode_number.go
@@ -5,7 +5,7 @@ import (
 	"math"
 	"reflect"
 
-	"github.com/vmihailenco/msgpack/v4/codes"
+	"github.com/vmihailenco/msgpack/v5/msgpcode"
 )
 
 func (d *Decoder) skipN(n int) error {
@@ -18,7 +18,7 @@ func (d *Decoder) uint8() (uint8, error) {
 	if err != nil {
 		return 0, err
 	}
-	return uint8(c), nil
+	return c, nil
 }
 
 func (d *Decoder) int8() (int8, error) {
@@ -87,33 +87,33 @@ func (d *Decoder) DecodeUint64() (uint64, error) {
 	return d.uint(c)
 }
 
-func (d *Decoder) uint(c codes.Code) (uint64, error) {
-	if c == codes.Nil {
+func (d *Decoder) uint(c byte) (uint64, error) {
+	if c == msgpcode.Nil {
 		return 0, nil
 	}
-	if codes.IsFixedNum(c) {
+	if msgpcode.IsFixedNum(c) {
 		return uint64(int8(c)), nil
 	}
 	switch c {
-	case codes.Uint8:
+	case msgpcode.Uint8:
 		n, err := d.uint8()
 		return uint64(n), err
-	case codes.Int8:
+	case msgpcode.Int8:
 		n, err := d.int8()
 		return uint64(n), err
-	case codes.Uint16:
+	case msgpcode.Uint16:
 		n, err := d.uint16()
 		return uint64(n), err
-	case codes.Int16:
+	case msgpcode.Int16:
 		n, err := d.int16()
 		return uint64(n), err
-	case codes.Uint32:
+	case msgpcode.Uint32:
 		n, err := d.uint32()
 		return uint64(n), err
-	case codes.Int32:
+	case msgpcode.Int32:
 		n, err := d.int32()
 		return uint64(n), err
-	case codes.Uint64, codes.Int64:
+	case msgpcode.Uint64, msgpcode.Int64:
 		return d.uint64()
 	}
 	return 0, fmt.Errorf("msgpack: invalid code=%x decoding uint64", c)
@@ -129,33 +129,33 @@ func (d *Decoder) DecodeInt64() (int64, error) {
 	return d.int(c)
 }
 
-func (d *Decoder) int(c codes.Code) (int64, error) {
-	if c == codes.Nil {
+func (d *Decoder) int(c byte) (int64, error) {
+	if c == msgpcode.Nil {
 		return 0, nil
 	}
-	if codes.IsFixedNum(c) {
+	if msgpcode.IsFixedNum(c) {
 		return int64(int8(c)), nil
 	}
 	switch c {
-	case codes.Uint8:
+	case msgpcode.Uint8:
 		n, err := d.uint8()
 		return int64(n), err
-	case codes.Int8:
+	case msgpcode.Int8:
 		n, err := d.uint8()
 		return int64(int8(n)), err
-	case codes.Uint16:
+	case msgpcode.Uint16:
 		n, err := d.uint16()
 		return int64(n), err
-	case codes.Int16:
+	case msgpcode.Int16:
 		n, err := d.uint16()
 		return int64(int16(n)), err
-	case codes.Uint32:
+	case msgpcode.Uint32:
 		n, err := d.uint32()
 		return int64(n), err
-	case codes.Int32:
+	case msgpcode.Int32:
 		n, err := d.uint32()
 		return int64(int32(n)), err
-	case codes.Uint64, codes.Int64:
+	case msgpcode.Uint64, msgpcode.Int64:
 		n, err := d.uint64()
 		return int64(n), err
 	}
@@ -170,8 +170,8 @@ func (d *Decoder) DecodeFloat32() (float32, error) {
 	return d.float32(c)
 }
 
-func (d *Decoder) float32(c codes.Code) (float32, error) {
-	if c == codes.Float {
+func (d *Decoder) float32(c byte) (float32, error) {
+	if c == msgpcode.Float {
 		n, err := d.uint32()
 		if err != nil {
 			return 0, err
@@ -195,15 +195,15 @@ func (d *Decoder) DecodeFloat64() (float64, error) {
 	return d.float64(c)
 }
 
-func (d *Decoder) float64(c codes.Code) (float64, error) {
+func (d *Decoder) float64(c byte) (float64, error) {
 	switch c {
-	case codes.Float:
+	case msgpcode.Float:
 		n, err := d.float32(c)
 		if err != nil {
 			return 0, err
 		}
 		return float64(n), nil
-	case codes.Double:
+	case msgpcode.Double:
 		n, err := d.uint64()
 		if err != nil {
 			return 0, err
@@ -263,9 +263,6 @@ func decodeFloat32Value(d *Decoder, v reflect.Value) error {
 	if err != nil {
 		return err
 	}
-	if err = mustSet(v); err != nil {
-		return err
-	}
 	v.SetFloat(float64(f))
 	return nil
 }
@@ -275,9 +272,6 @@ func decodeFloat64Value(d *Decoder, v reflect.Value) error {
 	if err != nil {
 		return err
 	}
-	if err = mustSet(v); err != nil {
-		return err
-	}
 	v.SetFloat(f)
 	return nil
 }
@@ -287,9 +281,6 @@ func decodeInt64Value(d *Decoder, v reflect.Value) error {
 	if err != nil {
 		return err
 	}
-	if err = mustSet(v); err != nil {
-		return err
-	}
 	v.SetInt(n)
 	return nil
 }
@@ -299,9 +290,6 @@ func decodeUint64Value(d *Decoder, v reflect.Value) error {
 	if err != nil {
 		return err
 	}
-	if err = mustSet(v); err != nil {
-		return err
-	}
 	v.SetUint(n)
 	return nil
 }
diff --git a/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v4/decode_query.go b/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v5/decode_query.go
similarity index 89%
rename from .ci/providerlint/vendor/github.com/vmihailenco/msgpack/v4/decode_query.go
rename to .ci/providerlint/vendor/github.com/vmihailenco/msgpack/v5/decode_query.go
index 80cd80e7852..c302ed1f33e 100644
--- a/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v4/decode_query.go
+++ b/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v5/decode_query.go
@@ -5,7 +5,7 @@ import (
 	"strconv"
 	"strings"
 
-	"github.com/vmihailenco/msgpack/v4/codes"
+	"github.com/vmihailenco/msgpack/v5/msgpcode"
 )
 
 type queryResult struct {
@@ -57,9 +57,9 @@ func (d *Decoder) query(q *queryResult) error {
 	}
 
 	switch {
-	case code == codes.Map16 || code == codes.Map32 || codes.IsFixedMap(code):
+	case code == msgpcode.Map16 || code == msgpcode.Map32 || msgpcode.IsFixedMap(code):
 		err = d.queryMapKey(q)
-	case code == codes.Array16 || code == codes.Array32 || codes.IsFixedArray(code):
+	case code == msgpcode.Array16 || code == msgpcode.Array32 || msgpcode.IsFixedArray(code):
 		err = d.queryArrayIndex(q)
 	default:
 		err = fmt.Errorf("msgpack: unsupported code=%x decoding key=%q", code, q.key)
@@ -77,12 +77,12 @@ func (d *Decoder) queryMapKey(q *queryResult) error {
 	}
 
 	for i := 0; i < n; i++ {
-		k, err := d.bytesNoCopy()
+		key, err := d.decodeStringTemp()
 		if err != nil {
 			return err
 		}
 
-		if string(k) == q.key {
+		if key == q.key {
 			if err := d.query(q); err != nil {
 				return err
 			}
diff --git a/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v4/decode_slice.go b/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v5/decode_slice.go
similarity index 88%
rename from .ci/providerlint/vendor/github.com/vmihailenco/msgpack/v4/decode_slice.go
rename to .ci/providerlint/vendor/github.com/vmihailenco/msgpack/v5/decode_slice.go
index adf17ae5cfb..db6f7c5472d 100644
--- a/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v4/decode_slice.go
+++ b/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v5/decode_slice.go
@@ -4,7 +4,7 @@ import (
 	"fmt"
 	"reflect"
 
-	"github.com/vmihailenco/msgpack/v4/codes"
+	"github.com/vmihailenco/msgpack/v5/msgpcode"
 )
 
 var sliceStringPtrType = reflect.TypeOf((*[]string)(nil))
@@ -18,17 +18,17 @@ func (d *Decoder) DecodeArrayLen() (int, error) {
 	return d.arrayLen(c)
 }
 
-func (d *Decoder) arrayLen(c codes.Code) (int, error) {
-	if c == codes.Nil {
+func (d *Decoder) arrayLen(c byte) (int, error) {
+	if c == msgpcode.Nil {
 		return -1, nil
-	} else if c >= codes.FixedArrayLow && c <= codes.FixedArrayHigh {
-		return int(c & codes.FixedArrayMask), nil
+	} else if c >= msgpcode.FixedArrayLow && c <= msgpcode.FixedArrayHigh {
+		return int(c & msgpcode.FixedArrayMask), nil
 	}
 	switch c {
-	case codes.Array16:
+	case msgpcode.Array16:
 		n, err := d.uint16()
 		return int(n), err
-	case codes.Array32:
+	case msgpcode.Array32:
 		n, err := d.uint32()
 		return int(n), err
 	}
@@ -154,7 +154,7 @@ func (d *Decoder) DecodeSlice() ([]interface{}, error) {
 	return d.decodeSlice(c)
 }
 
-func (d *Decoder) decodeSlice(c codes.Code) ([]interface{}, error) {
+func (d *Decoder) decodeSlice(c byte) ([]interface{}, error) {
 	n, err := d.arrayLen(c)
 	if err != nil {
 		return nil, err
@@ -175,7 +175,7 @@ func (d *Decoder) decodeSlice(c codes.Code) ([]interface{}, error) {
 	return s, nil
 }
 
-func (d *Decoder) skipSlice(c codes.Code) error {
+func (d *Decoder) skipSlice(c byte) error {
 	n, err := d.arrayLen(c)
 	if err != nil {
 		return err
diff --git a/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v5/decode_string.go b/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v5/decode_string.go
new file mode 100644
index 00000000000..e837e08bf14
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v5/decode_string.go
@@ -0,0 +1,192 @@
+package msgpack
+
+import (
+	"fmt"
+	"reflect"
+
+	"github.com/vmihailenco/msgpack/v5/msgpcode"
+)
+
+func (d *Decoder) bytesLen(c byte) (int, error) {
+	if c == msgpcode.Nil {
+		return -1, nil
+	}
+
+	if msgpcode.IsFixedString(c) {
+		return int(c & msgpcode.FixedStrMask), nil
+	}
+
+	switch c {
+	case msgpcode.Str8, msgpcode.Bin8:
+		n, err := d.uint8()
+		return int(n), err
+	case msgpcode.Str16, msgpcode.Bin16:
+		n, err := d.uint16()
+		return int(n), err
+	case msgpcode.Str32, msgpcode.Bin32:
+		n, err := d.uint32()
+		return int(n), err
+	}
+
+	return 0, fmt.Errorf("msgpack: invalid code=%x decoding string/bytes length", c)
+}
+
+func (d *Decoder) DecodeString() (string, error) {
+	if intern := d.flags&useInternedStringsFlag != 0; intern || len(d.dict) > 0 {
+		return d.decodeInternedString(intern)
+	}
+
+	c, err := d.readCode()
+	if err != nil {
+		return "", err
+	}
+	return d.string(c)
+}
+
+func (d *Decoder) string(c byte) (string, error) {
+	n, err := d.bytesLen(c)
+	if err != nil {
+		return "", err
+	}
+	return d.stringWithLen(n)
+}
+
+func (d *Decoder) stringWithLen(n int) (string, error) {
+	if n <= 0 {
+		return "", nil
+	}
+	b, err := d.readN(n)
+	return string(b), err
+}
+
+func decodeStringValue(d *Decoder, v reflect.Value) error {
+	s, err := d.DecodeString()
+	if err != nil {
+		return err
+	}
+	v.SetString(s)
+	return nil
+}
+
+func (d *Decoder) DecodeBytesLen() (int, error) {
+	c, err := d.readCode()
+	if err != nil {
+		return 0, err
+	}
+	return d.bytesLen(c)
+}
+
+func (d *Decoder) DecodeBytes() ([]byte, error) {
+	c, err := d.readCode()
+	if err != nil {
+		return nil, err
+	}
+	return d.bytes(c, nil)
+}
+
+func (d *Decoder) bytes(c byte, b []byte) ([]byte, error) {
+	n, err := d.bytesLen(c)
+	if err != nil {
+		return nil, err
+	}
+	if n == -1 {
+		return nil, nil
+	}
+	return readN(d.r, b, n)
+}
+
+func (d *Decoder) decodeStringTemp() (string, error) {
+	if intern := d.flags&useInternedStringsFlag != 0; intern || len(d.dict) > 0 {
+		return d.decodeInternedString(intern)
+	}
+
+	c, err := d.readCode()
+	if err != nil {
+		return "", err
+	}
+
+	n, err := d.bytesLen(c)
+	if err != nil {
+		return "", err
+	}
+	if n == -1 {
+		return "", nil
+	}
+
+	b, err := d.readN(n)
+	if err != nil {
+		return "", err
+	}
+
+	return bytesToString(b), nil
+}
+
+func (d *Decoder) decodeBytesPtr(ptr *[]byte) error {
+	c, err := d.readCode()
+	if err != nil {
+		return err
+	}
+	return d.bytesPtr(c, ptr)
+}
+
+func (d *Decoder) bytesPtr(c byte, ptr *[]byte) error {
+	n, err := d.bytesLen(c)
+	if err != nil {
+		return err
+	}
+	if n == -1 {
+		*ptr = nil
+		return nil
+	}
+
+	*ptr, err = readN(d.r, *ptr, n)
+	return err
+}
+
+func (d *Decoder) skipBytes(c byte) error {
+	n, err := d.bytesLen(c)
+	if err != nil {
+		return err
+	}
+	if n <= 0 {
+		return nil
+	}
+	return d.skipN(n)
+}
+
+func decodeBytesValue(d *Decoder, v reflect.Value) error {
+	c, err := d.readCode()
+	if err != nil {
+		return err
+	}
+
+	b, err := d.bytes(c, v.Bytes())
+	if err != nil {
+		return err
+	}
+
+	v.SetBytes(b)
+
+	return nil
+}
+
+func decodeByteArrayValue(d *Decoder, v reflect.Value) error {
+	c, err := d.readCode()
+	if err != nil {
+		return err
+	}
+
+	n, err := d.bytesLen(c)
+	if err != nil {
+		return err
+	}
+	if n == -1 {
+		return nil
+	}
+	if n > v.Len() {
+		return fmt.Errorf("%s len is %d, but msgpack has %d elements", v.Type(), v.Len(), n)
+	}
+
+	b := v.Slice(0, n).Bytes()
+	return d.readFull(b)
+}
diff --git a/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v5/decode_value.go b/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v5/decode_value.go
new file mode 100644
index 00000000000..d2ff2aea50f
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v5/decode_value.go
@@ -0,0 +1,250 @@
+package msgpack
+
+import (
+	"encoding"
+	"errors"
+	"fmt"
+	"reflect"
+)
+
+var (
+	interfaceType = reflect.TypeOf((*interface{})(nil)).Elem()
+	stringType    = reflect.TypeOf((*string)(nil)).Elem()
+)
+
+var valueDecoders []decoderFunc
+
+//nolint:gochecknoinits
+func init() {
+	valueDecoders = []decoderFunc{
+		reflect.Bool:          decodeBoolValue,
+		reflect.Int:           decodeInt64Value,
+		reflect.Int8:          decodeInt64Value,
+		reflect.Int16:         decodeInt64Value,
+		reflect.Int32:         decodeInt64Value,
+		reflect.Int64:         decodeInt64Value,
+		reflect.Uint:          decodeUint64Value,
+		reflect.Uint8:         decodeUint64Value,
+		reflect.Uint16:        decodeUint64Value,
+		reflect.Uint32:        decodeUint64Value,
+		reflect.Uint64:        decodeUint64Value,
+		reflect.Float32:       decodeFloat32Value,
+		reflect.Float64:       decodeFloat64Value,
+		reflect.Complex64:     decodeUnsupportedValue,
+		reflect.Complex128:    decodeUnsupportedValue,
+		reflect.Array:         decodeArrayValue,
+		reflect.Chan:          decodeUnsupportedValue,
+		reflect.Func:          decodeUnsupportedValue,
+		reflect.Interface:     decodeInterfaceValue,
+		reflect.Map:           decodeMapValue,
+		reflect.Ptr:           decodeUnsupportedValue,
+		reflect.Slice:         decodeSliceValue,
+		reflect.String:        decodeStringValue,
+		reflect.Struct:        decodeStructValue,
+		reflect.UnsafePointer: decodeUnsupportedValue,
+	}
+}
+
+func getDecoder(typ reflect.Type) decoderFunc {
+	if v, ok := typeDecMap.Load(typ); ok {
+		return v.(decoderFunc)
+	}
+	fn := _getDecoder(typ)
+	typeDecMap.Store(typ, fn)
+	return fn
+}
+
+func _getDecoder(typ reflect.Type) decoderFunc {
+	kind := typ.Kind()
+
+	if kind == reflect.Ptr {
+		if _, ok := typeDecMap.Load(typ.Elem()); ok {
+			return ptrValueDecoder(typ)
+		}
+	}
+
+	if typ.Implements(customDecoderType) {
+		return nilAwareDecoder(typ, decodeCustomValue)
+	}
+	if typ.Implements(unmarshalerType) {
+		return nilAwareDecoder(typ, unmarshalValue)
+	}
+	if typ.Implements(binaryUnmarshalerType) {
+		return nilAwareDecoder(typ, unmarshalBinaryValue)
+	}
+	if typ.Implements(textUnmarshalerType) {
+		return nilAwareDecoder(typ, unmarshalTextValue)
+	}
+
+	// Addressable struct field value.
+	if kind != reflect.Ptr {
+		ptr := reflect.PtrTo(typ)
+		if ptr.Implements(customDecoderType) {
+			return addrDecoder(nilAwareDecoder(typ, decodeCustomValue))
+		}
+		if ptr.Implements(unmarshalerType) {
+			return addrDecoder(nilAwareDecoder(typ, unmarshalValue))
+		}
+		if ptr.Implements(binaryUnmarshalerType) {
+			return addrDecoder(nilAwareDecoder(typ, unmarshalBinaryValue))
+		}
+		if ptr.Implements(textUnmarshalerType) {
+			return addrDecoder(nilAwareDecoder(typ, unmarshalTextValue))
+		}
+	}
+
+	switch kind {
+	case reflect.Ptr:
+		return ptrValueDecoder(typ)
+	case reflect.Slice:
+		elem := typ.Elem()
+		if elem.Kind() == reflect.Uint8 {
+			return decodeBytesValue
+		}
+		if elem == stringType {
+			return decodeStringSliceValue
+		}
+	case reflect.Array:
+		if typ.Elem().Kind() == reflect.Uint8 {
+			return decodeByteArrayValue
+		}
+	case reflect.Map:
+		if typ.Key() == stringType {
+			switch typ.Elem() {
+			case stringType:
+				return decodeMapStringStringValue
+			case interfaceType:
+				return decodeMapStringInterfaceValue
+			}
+		}
+	}
+
+	return valueDecoders[kind]
+}
+
+func ptrValueDecoder(typ reflect.Type) decoderFunc {
+	decoder := getDecoder(typ.Elem())
+	return func(d *Decoder, v reflect.Value) error {
+		if d.hasNilCode() {
+			if !v.IsNil() {
+				v.Set(reflect.Zero(v.Type()))
+			}
+			return d.DecodeNil()
+		}
+		if v.IsNil() {
+			v.Set(reflect.New(v.Type().Elem()))
+		}
+		return decoder(d, v.Elem())
+	}
+}
+
+func addrDecoder(fn decoderFunc) decoderFunc {
+	return func(d *Decoder, v reflect.Value) error {
+		if !v.CanAddr() {
+			return fmt.Errorf("msgpack: Decode(nonaddressable %T)", v.Interface())
+		}
+		return fn(d, v.Addr())
+	}
+}
+
+func nilAwareDecoder(typ reflect.Type, fn decoderFunc) decoderFunc {
+	if nilable(typ.Kind()) {
+		return func(d *Decoder, v reflect.Value) error {
+			if d.hasNilCode() {
+				return d.decodeNilValue(v)
+			}
+			if v.IsNil() {
+				v.Set(reflect.New(v.Type().Elem()))
+			}
+			return fn(d, v)
+		}
+	}
+
+	return func(d *Decoder, v reflect.Value) error {
+		if d.hasNilCode() {
+			return d.decodeNilValue(v)
+		}
+		return fn(d, v)
+	}
+}
+
+func decodeBoolValue(d *Decoder, v reflect.Value) error {
+	flag, err := d.DecodeBool()
+	if err != nil {
+		return err
+	}
+	v.SetBool(flag)
+	return nil
+}
+
+func decodeInterfaceValue(d *Decoder, v reflect.Value) error {
+	if v.IsNil() {
+		return d.interfaceValue(v)
+	}
+	return d.DecodeValue(v.Elem())
+}
+
+func (d *Decoder) interfaceValue(v reflect.Value) error {
+	vv, err := d.decodeInterfaceCond()
+	if err != nil {
+		return err
+	}
+
+	if vv != nil {
+		if v.Type() == errorType {
+			if vv, ok := vv.(string); ok {
+				v.Set(reflect.ValueOf(errors.New(vv)))
+				return nil
+			}
+		}
+
+		v.Set(reflect.ValueOf(vv))
+	}
+
+	return nil
+}
+
+func decodeUnsupportedValue(d *Decoder, v reflect.Value) error {
+	return fmt.Errorf("msgpack: Decode(unsupported %s)", v.Type())
+}
+
+//------------------------------------------------------------------------------
+
+func decodeCustomValue(d *Decoder, v reflect.Value) error {
+	decoder := v.Interface().(CustomDecoder)
+	return decoder.DecodeMsgpack(d)
+}
+
+func unmarshalValue(d *Decoder, v reflect.Value) error {
+	var b []byte
+
+	d.rec = make([]byte, 0, 64)
+	if err := d.Skip(); err != nil {
+		return err
+	}
+	b = d.rec
+	d.rec = nil
+
+	unmarshaler := v.Interface().(Unmarshaler)
+	return unmarshaler.UnmarshalMsgpack(b)
+}
+
+func unmarshalBinaryValue(d *Decoder, v reflect.Value) error {
+	data, err := d.DecodeBytes()
+	if err != nil {
+		return err
+	}
+
+	unmarshaler := v.Interface().(encoding.BinaryUnmarshaler)
+	return unmarshaler.UnmarshalBinary(data)
+}
+
+func unmarshalTextValue(d *Decoder, v reflect.Value) error {
+	data, err := d.DecodeBytes()
+	if err != nil {
+		return err
+	}
+
+	unmarshaler := v.Interface().(encoding.TextUnmarshaler)
+	return unmarshaler.UnmarshalText(data)
+}
diff --git a/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v5/encode.go b/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v5/encode.go
new file mode 100644
index 00000000000..0ef6212e63b
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v5/encode.go
@@ -0,0 +1,269 @@
+package msgpack
+
+import (
+	"bytes"
+	"io"
+	"reflect"
+	"sync"
+	"time"
+
+	"github.com/vmihailenco/msgpack/v5/msgpcode"
+)
+
+const (
+	sortMapKeysFlag uint32 = 1 << iota
+	arrayEncodedStructsFlag
+	useCompactIntsFlag
+	useCompactFloatsFlag
+	useInternedStringsFlag
+	omitEmptyFlag
+)
+
+type writer interface {
+	io.Writer
+	WriteByte(byte) error
+}
+
+type byteWriter struct {
+	io.Writer
+}
+
+func newByteWriter(w io.Writer) byteWriter {
+	return byteWriter{
+		Writer: w,
+	}
+}
+
+func (bw byteWriter) WriteByte(c byte) error {
+	_, err := bw.Write([]byte{c})
+	return err
+}
+
+//------------------------------------------------------------------------------
+
+var encPool = sync.Pool{
+	New: func() interface{} {
+		return NewEncoder(nil)
+	},
+}
+
+func GetEncoder() *Encoder {
+	return encPool.Get().(*Encoder)
+}
+
+func PutEncoder(enc *Encoder) {
+	enc.w = nil
+	encPool.Put(enc)
+}
+
+// Marshal returns the MessagePack encoding of v.
+func Marshal(v interface{}) ([]byte, error) {
+	enc := GetEncoder()
+
+	var buf bytes.Buffer
+	enc.Reset(&buf)
+
+	err := enc.Encode(v)
+	b := buf.Bytes()
+
+	PutEncoder(enc)
+
+	if err != nil {
+		return nil, err
+	}
+	return b, err
+}
+
+type Encoder struct {
+	w writer
+
+	buf     []byte
+	timeBuf []byte
+
+	dict map[string]int
+
+	flags     uint32
+	structTag string
+}
+
+// NewEncoder returns a new encoder that writes to w.
+func NewEncoder(w io.Writer) *Encoder {
+	e := &Encoder{
+		buf: make([]byte, 9),
+	}
+	e.Reset(w)
+	return e
+}
+
+// Writer returns the Encoder's writer.
+func (e *Encoder) Writer() io.Writer {
+	return e.w
+}
+
+// Reset discards any buffered data, resets all state, and switches the writer to write to w.
+func (e *Encoder) Reset(w io.Writer) {
+	e.ResetDict(w, nil)
+}
+
+// ResetDict is like Reset, but also resets the dict.
+func (e *Encoder) ResetDict(w io.Writer, dict map[string]int) {
+	e.resetWriter(w)
+	e.flags = 0
+	e.structTag = ""
+	e.dict = dict
+}
+
+func (e *Encoder) WithDict(dict map[string]int, fn func(*Encoder) error) error {
+	oldDict := e.dict
+	e.dict = dict
+	err := fn(e)
+	e.dict = oldDict
+	return err
+}
+
+func (e *Encoder) resetWriter(w io.Writer) {
+	if bw, ok := w.(writer); ok {
+		e.w = bw
+	} else {
+		e.w = newByteWriter(w)
+	}
+}
+
+// SetSortMapKeys causes the Encoder to encode map keys in increasing order.
+// Supported map types are:
+//   - map[string]string
+//   - map[string]interface{}
+func (e *Encoder) SetSortMapKeys(on bool) *Encoder {
+	if on {
+		e.flags |= sortMapKeysFlag
+	} else {
+		e.flags &= ^sortMapKeysFlag
+	}
+	return e
+}
+
+// SetCustomStructTag causes the Encoder to use a custom struct tag as
+// fallback option if there is no msgpack tag.
+func (e *Encoder) SetCustomStructTag(tag string) {
+	e.structTag = tag
+}
+
+// SetOmitEmpty causes the Encoder to omit empty values by default.
+func (e *Encoder) SetOmitEmpty(on bool) {
+	if on {
+		e.flags |= omitEmptyFlag
+	} else {
+		e.flags &= ^omitEmptyFlag
+	}
+}
+
+// UseArrayEncodedStructs causes the Encoder to encode Go structs as msgpack arrays.
+func (e *Encoder) UseArrayEncodedStructs(on bool) {
+	if on {
+		e.flags |= arrayEncodedStructsFlag
+	} else {
+		e.flags &= ^arrayEncodedStructsFlag
+	}
+}
+
+// UseCompactEncoding causes the Encoder to chose the most compact encoding.
+// For example, it allows to encode small Go int64 as msgpack int8 saving 7 bytes.
+func (e *Encoder) UseCompactInts(on bool) {
+	if on {
+		e.flags |= useCompactIntsFlag
+	} else {
+		e.flags &= ^useCompactIntsFlag
+	}
+}
+
+// UseCompactFloats causes the Encoder to chose a compact integer encoding
+// for floats that can be represented as integers.
+func (e *Encoder) UseCompactFloats(on bool) {
+	if on {
+		e.flags |= useCompactFloatsFlag
+	} else {
+		e.flags &= ^useCompactFloatsFlag
+	}
+}
+
+// UseInternedStrings causes the Encoder to intern strings.
+func (e *Encoder) UseInternedStrings(on bool) {
+	if on {
+		e.flags |= useInternedStringsFlag
+	} else {
+		e.flags &= ^useInternedStringsFlag
+	}
+}
+
+func (e *Encoder) Encode(v interface{}) error {
+	switch v := v.(type) {
+	case nil:
+		return e.EncodeNil()
+	case string:
+		return e.EncodeString(v)
+	case []byte:
+		return e.EncodeBytes(v)
+	case int:
+		return e.EncodeInt(int64(v))
+	case int64:
+		return e.encodeInt64Cond(v)
+	case uint:
+		return e.EncodeUint(uint64(v))
+	case uint64:
+		return e.encodeUint64Cond(v)
+	case bool:
+		return e.EncodeBool(v)
+	case float32:
+		return e.EncodeFloat32(v)
+	case float64:
+		return e.EncodeFloat64(v)
+	case time.Duration:
+		return e.encodeInt64Cond(int64(v))
+	case time.Time:
+		return e.EncodeTime(v)
+	}
+	return e.EncodeValue(reflect.ValueOf(v))
+}
+
+func (e *Encoder) EncodeMulti(v ...interface{}) error {
+	for _, vv := range v {
+		if err := e.Encode(vv); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func (e *Encoder) EncodeValue(v reflect.Value) error {
+	fn := getEncoder(v.Type())
+	return fn(e, v)
+}
+
+func (e *Encoder) EncodeNil() error {
+	return e.writeCode(msgpcode.Nil)
+}
+
+func (e *Encoder) EncodeBool(value bool) error {
+	if value {
+		return e.writeCode(msgpcode.True)
+	}
+	return e.writeCode(msgpcode.False)
+}
+
+func (e *Encoder) EncodeDuration(d time.Duration) error {
+	return e.EncodeInt(int64(d))
+}
+
+func (e *Encoder) writeCode(c byte) error {
+	return e.w.WriteByte(c)
+}
+
+func (e *Encoder) write(b []byte) error {
+	_, err := e.w.Write(b)
+	return err
+}
+
+func (e *Encoder) writeString(s string) error {
+	_, err := e.w.Write(stringToBytes(s))
+	return err
+}
diff --git a/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v5/encode_map.go b/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v5/encode_map.go
new file mode 100644
index 00000000000..ba4c61be72d
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v5/encode_map.go
@@ -0,0 +1,179 @@
+package msgpack
+
+import (
+	"math"
+	"reflect"
+	"sort"
+
+	"github.com/vmihailenco/msgpack/v5/msgpcode"
+)
+
+func encodeMapValue(e *Encoder, v reflect.Value) error {
+	if v.IsNil() {
+		return e.EncodeNil()
+	}
+
+	if err := e.EncodeMapLen(v.Len()); err != nil {
+		return err
+	}
+
+	iter := v.MapRange()
+	for iter.Next() {
+		if err := e.EncodeValue(iter.Key()); err != nil {
+			return err
+		}
+		if err := e.EncodeValue(iter.Value()); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func encodeMapStringStringValue(e *Encoder, v reflect.Value) error {
+	if v.IsNil() {
+		return e.EncodeNil()
+	}
+
+	if err := e.EncodeMapLen(v.Len()); err != nil {
+		return err
+	}
+
+	m := v.Convert(mapStringStringType).Interface().(map[string]string)
+	if e.flags&sortMapKeysFlag != 0 {
+		return e.encodeSortedMapStringString(m)
+	}
+
+	for mk, mv := range m {
+		if err := e.EncodeString(mk); err != nil {
+			return err
+		}
+		if err := e.EncodeString(mv); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func encodeMapStringInterfaceValue(e *Encoder, v reflect.Value) error {
+	if v.IsNil() {
+		return e.EncodeNil()
+	}
+	m := v.Convert(mapStringInterfaceType).Interface().(map[string]interface{})
+	if e.flags&sortMapKeysFlag != 0 {
+		return e.EncodeMapSorted(m)
+	}
+	return e.EncodeMap(m)
+}
+
+func (e *Encoder) EncodeMap(m map[string]interface{}) error {
+	if m == nil {
+		return e.EncodeNil()
+	}
+	if err := e.EncodeMapLen(len(m)); err != nil {
+		return err
+	}
+	for mk, mv := range m {
+		if err := e.EncodeString(mk); err != nil {
+			return err
+		}
+		if err := e.Encode(mv); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func (e *Encoder) EncodeMapSorted(m map[string]interface{}) error {
+	if m == nil {
+		return e.EncodeNil()
+	}
+	if err := e.EncodeMapLen(len(m)); err != nil {
+		return err
+	}
+
+	keys := make([]string, 0, len(m))
+
+	for k := range m {
+		keys = append(keys, k)
+	}
+
+	sort.Strings(keys)
+
+	for _, k := range keys {
+		if err := e.EncodeString(k); err != nil {
+			return err
+		}
+		if err := e.Encode(m[k]); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func (e *Encoder) encodeSortedMapStringString(m map[string]string) error {
+	keys := make([]string, 0, len(m))
+	for k := range m {
+		keys = append(keys, k)
+	}
+	sort.Strings(keys)
+
+	for _, k := range keys {
+		err := e.EncodeString(k)
+		if err != nil {
+			return err
+		}
+		if err = e.EncodeString(m[k]); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func (e *Encoder) EncodeMapLen(l int) error {
+	if l < 16 {
+		return e.writeCode(msgpcode.FixedMapLow | byte(l))
+	}
+	if l <= math.MaxUint16 {
+		return e.write2(msgpcode.Map16, uint16(l))
+	}
+	return e.write4(msgpcode.Map32, uint32(l))
+}
+
+func encodeStructValue(e *Encoder, strct reflect.Value) error {
+	structFields := structs.Fields(strct.Type(), e.structTag)
+	if e.flags&arrayEncodedStructsFlag != 0 || structFields.AsArray {
+		return encodeStructValueAsArray(e, strct, structFields.List)
+	}
+	fields := structFields.OmitEmpty(strct, e.flags&omitEmptyFlag != 0)
+
+	if err := e.EncodeMapLen(len(fields)); err != nil {
+		return err
+	}
+
+	for _, f := range fields {
+		if err := e.EncodeString(f.name); err != nil {
+			return err
+		}
+		if err := f.EncodeValue(e, strct); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func encodeStructValueAsArray(e *Encoder, strct reflect.Value, fields []*field) error {
+	if err := e.EncodeArrayLen(len(fields)); err != nil {
+		return err
+	}
+	for _, f := range fields {
+		if err := f.EncodeValue(e, strct); err != nil {
+			return err
+		}
+	}
+	return nil
+}
diff --git a/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v4/encode_number.go b/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v5/encode_number.go
similarity index 84%
rename from .ci/providerlint/vendor/github.com/vmihailenco/msgpack/v4/encode_number.go
rename to .ci/providerlint/vendor/github.com/vmihailenco/msgpack/v5/encode_number.go
index bf3c2f851ae..63c311bfae8 100644
--- a/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v4/encode_number.go
+++ b/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v5/encode_number.go
@@ -4,12 +4,12 @@ import (
 	"math"
 	"reflect"
 
-	"github.com/vmihailenco/msgpack/v4/codes"
+	"github.com/vmihailenco/msgpack/v5/msgpcode"
 )
 
 // EncodeUint8 encodes an uint8 in 2 bytes preserving type of the number.
 func (e *Encoder) EncodeUint8(n uint8) error {
-	return e.write1(codes.Uint8, n)
+	return e.write1(msgpcode.Uint8, n)
 }
 
 func (e *Encoder) encodeUint8Cond(n uint8) error {
@@ -21,7 +21,7 @@ func (e *Encoder) encodeUint8Cond(n uint8) error {
 
 // EncodeUint16 encodes an uint16 in 3 bytes preserving type of the number.
 func (e *Encoder) EncodeUint16(n uint16) error {
-	return e.write2(codes.Uint16, n)
+	return e.write2(msgpcode.Uint16, n)
 }
 
 func (e *Encoder) encodeUint16Cond(n uint16) error {
@@ -33,7 +33,7 @@ func (e *Encoder) encodeUint16Cond(n uint16) error {
 
 // EncodeUint32 encodes an uint16 in 5 bytes preserving type of the number.
 func (e *Encoder) EncodeUint32(n uint32) error {
-	return e.write4(codes.Uint32, n)
+	return e.write4(msgpcode.Uint32, n)
 }
 
 func (e *Encoder) encodeUint32Cond(n uint32) error {
@@ -45,7 +45,7 @@ func (e *Encoder) encodeUint32Cond(n uint32) error {
 
 // EncodeUint64 encodes an uint16 in 9 bytes preserving type of the number.
 func (e *Encoder) EncodeUint64(n uint64) error {
-	return e.write8(codes.Uint64, n)
+	return e.write8(msgpcode.Uint64, n)
 }
 
 func (e *Encoder) encodeUint64Cond(n uint64) error {
@@ -57,7 +57,7 @@ func (e *Encoder) encodeUint64Cond(n uint64) error {
 
 // EncodeInt8 encodes an int8 in 2 bytes preserving type of the number.
 func (e *Encoder) EncodeInt8(n int8) error {
-	return e.write1(codes.Int8, uint8(n))
+	return e.write1(msgpcode.Int8, uint8(n))
 }
 
 func (e *Encoder) encodeInt8Cond(n int8) error {
@@ -69,7 +69,7 @@ func (e *Encoder) encodeInt8Cond(n int8) error {
 
 // EncodeInt16 encodes an int16 in 3 bytes preserving type of the number.
 func (e *Encoder) EncodeInt16(n int16) error {
-	return e.write2(codes.Int16, uint16(n))
+	return e.write2(msgpcode.Int16, uint16(n))
 }
 
 func (e *Encoder) encodeInt16Cond(n int16) error {
@@ -81,7 +81,7 @@ func (e *Encoder) encodeInt16Cond(n int16) error {
 
 // EncodeInt32 encodes an int32 in 5 bytes preserving type of the number.
 func (e *Encoder) EncodeInt32(n int32) error {
-	return e.write4(codes.Int32, uint32(n))
+	return e.write4(msgpcode.Int32, uint32(n))
 }
 
 func (e *Encoder) encodeInt32Cond(n int32) error {
@@ -93,7 +93,7 @@ func (e *Encoder) encodeInt32Cond(n int32) error {
 
 // EncodeInt64 encodes an int64 in 9 bytes preserving type of the number.
 func (e *Encoder) EncodeInt64(n int64) error {
-	return e.write8(codes.Int64, uint64(n))
+	return e.write8(msgpcode.Int64, uint64(n))
 }
 
 func (e *Encoder) encodeInt64Cond(n int64) error {
@@ -127,7 +127,7 @@ func (e *Encoder) EncodeInt(n int64) error {
 	if n >= 0 {
 		return e.EncodeUint(uint64(n))
 	}
-	if n >= int64(int8(codes.NegFixedNumLow)) {
+	if n >= int64(int8(msgpcode.NegFixedNumLow)) {
 		return e.w.WriteByte(byte(n))
 	}
 	if n >= math.MinInt8 {
@@ -148,7 +148,7 @@ func (e *Encoder) EncodeFloat32(n float32) error {
 			return e.EncodeInt(int64(n))
 		}
 	}
-	return e.write4(codes.Float, math.Float32bits(n))
+	return e.write4(msgpcode.Float, math.Float32bits(n))
 }
 
 func (e *Encoder) EncodeFloat64(n float64) error {
@@ -161,27 +161,27 @@ func (e *Encoder) EncodeFloat64(n float64) error {
 			return e.EncodeInt(int64(n))
 		}
 	}
-	return e.write8(codes.Double, math.Float64bits(n))
+	return e.write8(msgpcode.Double, math.Float64bits(n))
 }
 
-func (e *Encoder) write1(code codes.Code, n uint8) error {
+func (e *Encoder) write1(code byte, n uint8) error {
 	e.buf = e.buf[:2]
-	e.buf[0] = byte(code)
+	e.buf[0] = code
 	e.buf[1] = n
 	return e.write(e.buf)
 }
 
-func (e *Encoder) write2(code codes.Code, n uint16) error {
+func (e *Encoder) write2(code byte, n uint16) error {
 	e.buf = e.buf[:3]
-	e.buf[0] = byte(code)
+	e.buf[0] = code
 	e.buf[1] = byte(n >> 8)
 	e.buf[2] = byte(n)
 	return e.write(e.buf)
 }
 
-func (e *Encoder) write4(code codes.Code, n uint32) error {
+func (e *Encoder) write4(code byte, n uint32) error {
 	e.buf = e.buf[:5]
-	e.buf[0] = byte(code)
+	e.buf[0] = code
 	e.buf[1] = byte(n >> 24)
 	e.buf[2] = byte(n >> 16)
 	e.buf[3] = byte(n >> 8)
@@ -189,9 +189,9 @@ func (e *Encoder) write4(code codes.Code, n uint32) error {
 	return e.write(e.buf)
 }
 
-func (e *Encoder) write8(code codes.Code, n uint64) error {
+func (e *Encoder) write8(code byte, n uint64) error {
 	e.buf = e.buf[:9]
-	e.buf[0] = byte(code)
+	e.buf[0] = code
 	e.buf[1] = byte(n >> 56)
 	e.buf[2] = byte(n >> 48)
 	e.buf[3] = byte(n >> 40)
@@ -203,6 +203,14 @@ func (e *Encoder) write8(code codes.Code, n uint64) error {
 	return e.write(e.buf)
 }
 
+func encodeUintValue(e *Encoder, v reflect.Value) error {
+	return e.EncodeUint(v.Uint())
+}
+
+func encodeIntValue(e *Encoder, v reflect.Value) error {
+	return e.EncodeInt(v.Int())
+}
+
 func encodeUint8CondValue(e *Encoder, v reflect.Value) error {
 	return e.encodeUint8Cond(uint8(v.Uint()))
 }
diff --git a/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v5/encode_slice.go b/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v5/encode_slice.go
new file mode 100644
index 00000000000..ca46eadae51
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v5/encode_slice.go
@@ -0,0 +1,139 @@
+package msgpack
+
+import (
+	"math"
+	"reflect"
+
+	"github.com/vmihailenco/msgpack/v5/msgpcode"
+)
+
+var stringSliceType = reflect.TypeOf(([]string)(nil))
+
+func encodeStringValue(e *Encoder, v reflect.Value) error {
+	return e.EncodeString(v.String())
+}
+
+func encodeByteSliceValue(e *Encoder, v reflect.Value) error {
+	return e.EncodeBytes(v.Bytes())
+}
+
+func encodeByteArrayValue(e *Encoder, v reflect.Value) error {
+	if err := e.EncodeBytesLen(v.Len()); err != nil {
+		return err
+	}
+
+	if v.CanAddr() {
+		b := v.Slice(0, v.Len()).Bytes()
+		return e.write(b)
+	}
+
+	e.buf = grow(e.buf, v.Len())
+	reflect.Copy(reflect.ValueOf(e.buf), v)
+	return e.write(e.buf)
+}
+
+func grow(b []byte, n int) []byte {
+	if cap(b) >= n {
+		return b[:n]
+	}
+	b = b[:cap(b)]
+	b = append(b, make([]byte, n-len(b))...)
+	return b
+}
+
+func (e *Encoder) EncodeBytesLen(l int) error {
+	if l < 256 {
+		return e.write1(msgpcode.Bin8, uint8(l))
+	}
+	if l <= math.MaxUint16 {
+		return e.write2(msgpcode.Bin16, uint16(l))
+	}
+	return e.write4(msgpcode.Bin32, uint32(l))
+}
+
+func (e *Encoder) encodeStringLen(l int) error {
+	if l < 32 {
+		return e.writeCode(msgpcode.FixedStrLow | byte(l))
+	}
+	if l < 256 {
+		return e.write1(msgpcode.Str8, uint8(l))
+	}
+	if l <= math.MaxUint16 {
+		return e.write2(msgpcode.Str16, uint16(l))
+	}
+	return e.write4(msgpcode.Str32, uint32(l))
+}
+
+func (e *Encoder) EncodeString(v string) error {
+	if intern := e.flags&useInternedStringsFlag != 0; intern || len(e.dict) > 0 {
+		return e.encodeInternedString(v, intern)
+	}
+	return e.encodeNormalString(v)
+}
+
+func (e *Encoder) encodeNormalString(v string) error {
+	if err := e.encodeStringLen(len(v)); err != nil {
+		return err
+	}
+	return e.writeString(v)
+}
+
+func (e *Encoder) EncodeBytes(v []byte) error {
+	if v == nil {
+		return e.EncodeNil()
+	}
+	if err := e.EncodeBytesLen(len(v)); err != nil {
+		return err
+	}
+	return e.write(v)
+}
+
+func (e *Encoder) EncodeArrayLen(l int) error {
+	if l < 16 {
+		return e.writeCode(msgpcode.FixedArrayLow | byte(l))
+	}
+	if l <= math.MaxUint16 {
+		return e.write2(msgpcode.Array16, uint16(l))
+	}
+	return e.write4(msgpcode.Array32, uint32(l))
+}
+
+func encodeStringSliceValue(e *Encoder, v reflect.Value) error {
+	ss := v.Convert(stringSliceType).Interface().([]string)
+	return e.encodeStringSlice(ss)
+}
+
+func (e *Encoder) encodeStringSlice(s []string) error {
+	if s == nil {
+		return e.EncodeNil()
+	}
+	if err := e.EncodeArrayLen(len(s)); err != nil {
+		return err
+	}
+	for _, v := range s {
+		if err := e.EncodeString(v); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func encodeSliceValue(e *Encoder, v reflect.Value) error {
+	if v.IsNil() {
+		return e.EncodeNil()
+	}
+	return encodeArrayValue(e, v)
+}
+
+func encodeArrayValue(e *Encoder, v reflect.Value) error {
+	l := v.Len()
+	if err := e.EncodeArrayLen(l); err != nil {
+		return err
+	}
+	for i := 0; i < l; i++ {
+		if err := e.EncodeValue(v.Index(i)); err != nil {
+			return err
+		}
+	}
+	return nil
+}
diff --git a/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v4/encode_value.go b/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v5/encode_value.go
similarity index 82%
rename from .ci/providerlint/vendor/github.com/vmihailenco/msgpack/v4/encode_value.go
rename to .ci/providerlint/vendor/github.com/vmihailenco/msgpack/v5/encode_value.go
index 335fcdb7ed6..48cf489fa1f 100644
--- a/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v4/encode_value.go
+++ b/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v5/encode_value.go
@@ -12,12 +12,12 @@ var valueEncoders []encoderFunc
 func init() {
 	valueEncoders = []encoderFunc{
 		reflect.Bool:          encodeBoolValue,
-		reflect.Int:           encodeInt64CondValue,
+		reflect.Int:           encodeIntValue,
 		reflect.Int8:          encodeInt8CondValue,
 		reflect.Int16:         encodeInt16CondValue,
 		reflect.Int32:         encodeInt32CondValue,
 		reflect.Int64:         encodeInt64CondValue,
-		reflect.Uint:          encodeUint64CondValue,
+		reflect.Uint:          encodeUintValue,
 		reflect.Uint8:         encodeUint8CondValue,
 		reflect.Uint16:        encodeUint16CondValue,
 		reflect.Uint32:        encodeUint32CondValue,
@@ -66,6 +66,9 @@ func _getEncoder(typ reflect.Type) encoderFunc {
 	if typ.Implements(binaryMarshalerType) {
 		return marshalBinaryValue
 	}
+	if typ.Implements(textMarshalerType) {
+		return marshalTextValue
+	}
 
 	// Addressable struct field value.
 	if kind != reflect.Ptr {
@@ -77,7 +80,10 @@ func _getEncoder(typ reflect.Type) encoderFunc {
 			return marshalValuePtr
 		}
 		if ptr.Implements(binaryMarshalerType) {
-			return marshalBinaryValuePtr
+			return marshalBinaryValueAddr
+		}
+		if ptr.Implements(textMarshalerType) {
+			return marshalTextValueAddr
 		}
 	}
 
@@ -133,7 +139,7 @@ func encodeCustomValuePtr(e *Encoder, v reflect.Value) error {
 }
 
 func encodeCustomValue(e *Encoder, v reflect.Value) error {
-	if nilable(v) && v.IsNil() {
+	if nilable(v.Kind()) && v.IsNil() {
 		return e.EncodeNil()
 	}
 
@@ -149,7 +155,7 @@ func marshalValuePtr(e *Encoder, v reflect.Value) error {
 }
 
 func marshalValue(e *Encoder, v reflect.Value) error {
-	if nilable(v) && v.IsNil() {
+	if nilable(v.Kind()) && v.IsNil() {
 		return e.EncodeNil()
 	}
 
@@ -184,8 +190,8 @@ func encodeUnsupportedValue(e *Encoder, v reflect.Value) error {
 	return fmt.Errorf("msgpack: Encode(unsupported %s)", v.Type())
 }
 
-func nilable(v reflect.Value) bool {
-	switch v.Kind() {
+func nilable(kind reflect.Kind) bool {
+	switch kind {
 	case reflect.Chan, reflect.Func, reflect.Interface, reflect.Map, reflect.Ptr, reflect.Slice:
 		return true
 	}
@@ -194,7 +200,7 @@ func nilable(v reflect.Value) bool {
 
 //------------------------------------------------------------------------------
 
-func marshalBinaryValuePtr(e *Encoder, v reflect.Value) error {
+func marshalBinaryValueAddr(e *Encoder, v reflect.Value) error {
 	if !v.CanAddr() {
 		return fmt.Errorf("msgpack: Encode(non-addressable %T)", v.Interface())
 	}
@@ -202,7 +208,7 @@ func marshalBinaryValuePtr(e *Encoder, v reflect.Value) error {
 }
 
 func marshalBinaryValue(e *Encoder, v reflect.Value) error {
-	if nilable(v) && v.IsNil() {
+	if nilable(v.Kind()) && v.IsNil() {
 		return e.EncodeNil()
 	}
 
@@ -214,3 +220,26 @@ func marshalBinaryValue(e *Encoder, v reflect.Value) error {
 
 	return e.EncodeBytes(data)
 }
+
+//------------------------------------------------------------------------------
+
+func marshalTextValueAddr(e *Encoder, v reflect.Value) error {
+	if !v.CanAddr() {
+		return fmt.Errorf("msgpack: Encode(non-addressable %T)", v.Interface())
+	}
+	return marshalTextValue(e, v.Addr())
+}
+
+func marshalTextValue(e *Encoder, v reflect.Value) error {
+	if nilable(v.Kind()) && v.IsNil() {
+		return e.EncodeNil()
+	}
+
+	marshaler := v.Interface().(encoding.TextMarshaler)
+	data, err := marshaler.MarshalText()
+	if err != nil {
+		return err
+	}
+
+	return e.EncodeBytes(data)
+}
diff --git a/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v5/ext.go b/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v5/ext.go
new file mode 100644
index 00000000000..76e11603d92
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v5/ext.go
@@ -0,0 +1,303 @@
+package msgpack
+
+import (
+	"fmt"
+	"math"
+	"reflect"
+
+	"github.com/vmihailenco/msgpack/v5/msgpcode"
+)
+
+type extInfo struct {
+	Type    reflect.Type
+	Decoder func(d *Decoder, v reflect.Value, extLen int) error
+}
+
+var extTypes = make(map[int8]*extInfo)
+
+type MarshalerUnmarshaler interface {
+	Marshaler
+	Unmarshaler
+}
+
+func RegisterExt(extID int8, value MarshalerUnmarshaler) {
+	RegisterExtEncoder(extID, value, func(e *Encoder, v reflect.Value) ([]byte, error) {
+		marshaler := v.Interface().(Marshaler)
+		return marshaler.MarshalMsgpack()
+	})
+	RegisterExtDecoder(extID, value, func(d *Decoder, v reflect.Value, extLen int) error {
+		b, err := d.readN(extLen)
+		if err != nil {
+			return err
+		}
+		return v.Interface().(Unmarshaler).UnmarshalMsgpack(b)
+	})
+}
+
+func UnregisterExt(extID int8) {
+	unregisterExtEncoder(extID)
+	unregisterExtDecoder(extID)
+}
+
+func RegisterExtEncoder(
+	extID int8,
+	value interface{},
+	encoder func(enc *Encoder, v reflect.Value) ([]byte, error),
+) {
+	unregisterExtEncoder(extID)
+
+	typ := reflect.TypeOf(value)
+	extEncoder := makeExtEncoder(extID, typ, encoder)
+	typeEncMap.Store(extID, typ)
+	typeEncMap.Store(typ, extEncoder)
+	if typ.Kind() == reflect.Ptr {
+		typeEncMap.Store(typ.Elem(), makeExtEncoderAddr(extEncoder))
+	}
+}
+
+func unregisterExtEncoder(extID int8) {
+	t, ok := typeEncMap.Load(extID)
+	if !ok {
+		return
+	}
+	typeEncMap.Delete(extID)
+	typ := t.(reflect.Type)
+	typeEncMap.Delete(typ)
+	if typ.Kind() == reflect.Ptr {
+		typeEncMap.Delete(typ.Elem())
+	}
+}
+
+func makeExtEncoder(
+	extID int8,
+	typ reflect.Type,
+	encoder func(enc *Encoder, v reflect.Value) ([]byte, error),
+) encoderFunc {
+	nilable := typ.Kind() == reflect.Ptr
+
+	return func(e *Encoder, v reflect.Value) error {
+		if nilable && v.IsNil() {
+			return e.EncodeNil()
+		}
+
+		b, err := encoder(e, v)
+		if err != nil {
+			return err
+		}
+
+		if err := e.EncodeExtHeader(extID, len(b)); err != nil {
+			return err
+		}
+
+		return e.write(b)
+	}
+}
+
+func makeExtEncoderAddr(extEncoder encoderFunc) encoderFunc {
+	return func(e *Encoder, v reflect.Value) error {
+		if !v.CanAddr() {
+			return fmt.Errorf("msgpack: Decode(nonaddressable %T)", v.Interface())
+		}
+		return extEncoder(e, v.Addr())
+	}
+}
+
+func RegisterExtDecoder(
+	extID int8,
+	value interface{},
+	decoder func(dec *Decoder, v reflect.Value, extLen int) error,
+) {
+	unregisterExtDecoder(extID)
+
+	typ := reflect.TypeOf(value)
+	extDecoder := makeExtDecoder(extID, typ, decoder)
+	extTypes[extID] = &extInfo{
+		Type:    typ,
+		Decoder: decoder,
+	}
+
+	typeDecMap.Store(extID, typ)
+	typeDecMap.Store(typ, extDecoder)
+	if typ.Kind() == reflect.Ptr {
+		typeDecMap.Store(typ.Elem(), makeExtDecoderAddr(extDecoder))
+	}
+}
+
+func unregisterExtDecoder(extID int8) {
+	t, ok := typeDecMap.Load(extID)
+	if !ok {
+		return
+	}
+	typeDecMap.Delete(extID)
+	delete(extTypes, extID)
+	typ := t.(reflect.Type)
+	typeDecMap.Delete(typ)
+	if typ.Kind() == reflect.Ptr {
+		typeDecMap.Delete(typ.Elem())
+	}
+}
+
+func makeExtDecoder(
+	wantedExtID int8,
+	typ reflect.Type,
+	decoder func(d *Decoder, v reflect.Value, extLen int) error,
+) decoderFunc {
+	return nilAwareDecoder(typ, func(d *Decoder, v reflect.Value) error {
+		extID, extLen, err := d.DecodeExtHeader()
+		if err != nil {
+			return err
+		}
+		if extID != wantedExtID {
+			return fmt.Errorf("msgpack: got ext type=%d, wanted %d", extID, wantedExtID)
+		}
+		return decoder(d, v, extLen)
+	})
+}
+
+func makeExtDecoderAddr(extDecoder decoderFunc) decoderFunc {
+	return func(d *Decoder, v reflect.Value) error {
+		if !v.CanAddr() {
+			return fmt.Errorf("msgpack: Decode(nonaddressable %T)", v.Interface())
+		}
+		return extDecoder(d, v.Addr())
+	}
+}
+
+func (e *Encoder) EncodeExtHeader(extID int8, extLen int) error {
+	if err := e.encodeExtLen(extLen); err != nil {
+		return err
+	}
+	if err := e.w.WriteByte(byte(extID)); err != nil {
+		return err
+	}
+	return nil
+}
+
+func (e *Encoder) encodeExtLen(l int) error {
+	switch l {
+	case 1:
+		return e.writeCode(msgpcode.FixExt1)
+	case 2:
+		return e.writeCode(msgpcode.FixExt2)
+	case 4:
+		return e.writeCode(msgpcode.FixExt4)
+	case 8:
+		return e.writeCode(msgpcode.FixExt8)
+	case 16:
+		return e.writeCode(msgpcode.FixExt16)
+	}
+	if l <= math.MaxUint8 {
+		return e.write1(msgpcode.Ext8, uint8(l))
+	}
+	if l <= math.MaxUint16 {
+		return e.write2(msgpcode.Ext16, uint16(l))
+	}
+	return e.write4(msgpcode.Ext32, uint32(l))
+}
+
+func (d *Decoder) DecodeExtHeader() (extID int8, extLen int, err error) {
+	c, err := d.readCode()
+	if err != nil {
+		return
+	}
+	return d.extHeader(c)
+}
+
+func (d *Decoder) extHeader(c byte) (int8, int, error) {
+	extLen, err := d.parseExtLen(c)
+	if err != nil {
+		return 0, 0, err
+	}
+
+	extID, err := d.readCode()
+	if err != nil {
+		return 0, 0, err
+	}
+
+	return int8(extID), extLen, nil
+}
+
+func (d *Decoder) parseExtLen(c byte) (int, error) {
+	switch c {
+	case msgpcode.FixExt1:
+		return 1, nil
+	case msgpcode.FixExt2:
+		return 2, nil
+	case msgpcode.FixExt4:
+		return 4, nil
+	case msgpcode.FixExt8:
+		return 8, nil
+	case msgpcode.FixExt16:
+		return 16, nil
+	case msgpcode.Ext8:
+		n, err := d.uint8()
+		return int(n), err
+	case msgpcode.Ext16:
+		n, err := d.uint16()
+		return int(n), err
+	case msgpcode.Ext32:
+		n, err := d.uint32()
+		return int(n), err
+	default:
+		return 0, fmt.Errorf("msgpack: invalid code=%x decoding ext len", c)
+	}
+}
+
+func (d *Decoder) decodeInterfaceExt(c byte) (interface{}, error) {
+	extID, extLen, err := d.extHeader(c)
+	if err != nil {
+		return nil, err
+	}
+
+	info, ok := extTypes[extID]
+	if !ok {
+		return nil, fmt.Errorf("msgpack: unknown ext id=%d", extID)
+	}
+
+	v := reflect.New(info.Type).Elem()
+	if nilable(v.Kind()) && v.IsNil() {
+		v.Set(reflect.New(info.Type.Elem()))
+	}
+
+	if err := info.Decoder(d, v, extLen); err != nil {
+		return nil, err
+	}
+
+	return v.Interface(), nil
+}
+
+func (d *Decoder) skipExt(c byte) error {
+	n, err := d.parseExtLen(c)
+	if err != nil {
+		return err
+	}
+	return d.skipN(n + 1)
+}
+
+func (d *Decoder) skipExtHeader(c byte) error {
+	// Read ext type.
+	_, err := d.readCode()
+	if err != nil {
+		return err
+	}
+	// Read ext body len.
+	for i := 0; i < extHeaderLen(c); i++ {
+		_, err := d.readCode()
+		if err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func extHeaderLen(c byte) int {
+	switch c {
+	case msgpcode.Ext8:
+		return 1
+	case msgpcode.Ext16:
+		return 2
+	case msgpcode.Ext32:
+		return 4
+	}
+	return 0
+}
diff --git a/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v5/intern.go b/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v5/intern.go
new file mode 100644
index 00000000000..be0316a83d8
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v5/intern.go
@@ -0,0 +1,238 @@
+package msgpack
+
+import (
+	"fmt"
+	"math"
+	"reflect"
+
+	"github.com/vmihailenco/msgpack/v5/msgpcode"
+)
+
+const (
+	minInternedStringLen = 3
+	maxDictLen           = math.MaxUint16
+)
+
+var internedStringExtID = int8(math.MinInt8)
+
+func init() {
+	extTypes[internedStringExtID] = &extInfo{
+		Type:    stringType,
+		Decoder: decodeInternedStringExt,
+	}
+}
+
+func decodeInternedStringExt(d *Decoder, v reflect.Value, extLen int) error {
+	idx, err := d.decodeInternedStringIndex(extLen)
+	if err != nil {
+		return err
+	}
+
+	s, err := d.internedStringAtIndex(idx)
+	if err != nil {
+		return err
+	}
+
+	v.SetString(s)
+	return nil
+}
+
+//------------------------------------------------------------------------------
+
+func encodeInternedInterfaceValue(e *Encoder, v reflect.Value) error {
+	if v.IsNil() {
+		return e.EncodeNil()
+	}
+
+	v = v.Elem()
+	if v.Kind() == reflect.String {
+		return e.encodeInternedString(v.String(), true)
+	}
+	return e.EncodeValue(v)
+}
+
+func encodeInternedStringValue(e *Encoder, v reflect.Value) error {
+	return e.encodeInternedString(v.String(), true)
+}
+
+func (e *Encoder) encodeInternedString(s string, intern bool) error {
+	// Interned string takes at least 3 bytes. Plain string 1 byte + string len.
+	if len(s) >= minInternedStringLen {
+		if idx, ok := e.dict[s]; ok {
+			return e.encodeInternedStringIndex(idx)
+		}
+
+		if intern && len(e.dict) < maxDictLen {
+			if e.dict == nil {
+				e.dict = make(map[string]int)
+			}
+			idx := len(e.dict)
+			e.dict[s] = idx
+		}
+	}
+
+	return e.encodeNormalString(s)
+}
+
+func (e *Encoder) encodeInternedStringIndex(idx int) error {
+	if idx <= math.MaxUint8 {
+		if err := e.writeCode(msgpcode.FixExt1); err != nil {
+			return err
+		}
+		return e.write1(byte(internedStringExtID), uint8(idx))
+	}
+
+	if idx <= math.MaxUint16 {
+		if err := e.writeCode(msgpcode.FixExt2); err != nil {
+			return err
+		}
+		return e.write2(byte(internedStringExtID), uint16(idx))
+	}
+
+	if uint64(idx) <= math.MaxUint32 {
+		if err := e.writeCode(msgpcode.FixExt4); err != nil {
+			return err
+		}
+		return e.write4(byte(internedStringExtID), uint32(idx))
+	}
+
+	return fmt.Errorf("msgpack: interned string index=%d is too large", idx)
+}
+
+//------------------------------------------------------------------------------
+
+func decodeInternedInterfaceValue(d *Decoder, v reflect.Value) error {
+	s, err := d.decodeInternedString(true)
+	if err == nil {
+		v.Set(reflect.ValueOf(s))
+		return nil
+	}
+	if err != nil {
+		if _, ok := err.(unexpectedCodeError); !ok {
+			return err
+		}
+	}
+
+	if err := d.s.UnreadByte(); err != nil {
+		return err
+	}
+	return decodeInterfaceValue(d, v)
+}
+
+func decodeInternedStringValue(d *Decoder, v reflect.Value) error {
+	s, err := d.decodeInternedString(true)
+	if err != nil {
+		return err
+	}
+
+	v.SetString(s)
+	return nil
+}
+
+func (d *Decoder) decodeInternedString(intern bool) (string, error) {
+	c, err := d.readCode()
+	if err != nil {
+		return "", err
+	}
+
+	if msgpcode.IsFixedString(c) {
+		n := int(c & msgpcode.FixedStrMask)
+		return d.decodeInternedStringWithLen(n, intern)
+	}
+
+	switch c {
+	case msgpcode.Nil:
+		return "", nil
+	case msgpcode.FixExt1, msgpcode.FixExt2, msgpcode.FixExt4:
+		typeID, extLen, err := d.extHeader(c)
+		if err != nil {
+			return "", err
+		}
+		if typeID != internedStringExtID {
+			err := fmt.Errorf("msgpack: got ext type=%d, wanted %d",
+				typeID, internedStringExtID)
+			return "", err
+		}
+
+		idx, err := d.decodeInternedStringIndex(extLen)
+		if err != nil {
+			return "", err
+		}
+
+		return d.internedStringAtIndex(idx)
+	case msgpcode.Str8, msgpcode.Bin8:
+		n, err := d.uint8()
+		if err != nil {
+			return "", err
+		}
+		return d.decodeInternedStringWithLen(int(n), intern)
+	case msgpcode.Str16, msgpcode.Bin16:
+		n, err := d.uint16()
+		if err != nil {
+			return "", err
+		}
+		return d.decodeInternedStringWithLen(int(n), intern)
+	case msgpcode.Str32, msgpcode.Bin32:
+		n, err := d.uint32()
+		if err != nil {
+			return "", err
+		}
+		return d.decodeInternedStringWithLen(int(n), intern)
+	}
+
+	return "", unexpectedCodeError{
+		code: c,
+		hint: "interned string",
+	}
+}
+
+func (d *Decoder) decodeInternedStringIndex(extLen int) (int, error) {
+	switch extLen {
+	case 1:
+		n, err := d.uint8()
+		if err != nil {
+			return 0, err
+		}
+		return int(n), nil
+	case 2:
+		n, err := d.uint16()
+		if err != nil {
+			return 0, err
+		}
+		return int(n), nil
+	case 4:
+		n, err := d.uint32()
+		if err != nil {
+			return 0, err
+		}
+		return int(n), nil
+	}
+
+	err := fmt.Errorf("msgpack: unsupported ext len=%d decoding interned string", extLen)
+	return 0, err
+}
+
+func (d *Decoder) internedStringAtIndex(idx int) (string, error) {
+	if idx >= len(d.dict) {
+		err := fmt.Errorf("msgpack: interned string at index=%d does not exist", idx)
+		return "", err
+	}
+	return d.dict[idx], nil
+}
+
+func (d *Decoder) decodeInternedStringWithLen(n int, intern bool) (string, error) {
+	if n <= 0 {
+		return "", nil
+	}
+
+	s, err := d.stringWithLen(n)
+	if err != nil {
+		return "", err
+	}
+
+	if intern && len(s) >= minInternedStringLen && len(d.dict) < maxDictLen {
+		d.dict = append(d.dict, s)
+	}
+
+	return s, nil
+}
diff --git a/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v5/msgpack.go b/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v5/msgpack.go
new file mode 100644
index 00000000000..4db2fa2c71d
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v5/msgpack.go
@@ -0,0 +1,52 @@
+package msgpack
+
+import "fmt"
+
+type Marshaler interface {
+	MarshalMsgpack() ([]byte, error)
+}
+
+type Unmarshaler interface {
+	UnmarshalMsgpack([]byte) error
+}
+
+type CustomEncoder interface {
+	EncodeMsgpack(*Encoder) error
+}
+
+type CustomDecoder interface {
+	DecodeMsgpack(*Decoder) error
+}
+
+//------------------------------------------------------------------------------
+
+type RawMessage []byte
+
+var (
+	_ CustomEncoder = (RawMessage)(nil)
+	_ CustomDecoder = (*RawMessage)(nil)
+)
+
+func (m RawMessage) EncodeMsgpack(enc *Encoder) error {
+	return enc.write(m)
+}
+
+func (m *RawMessage) DecodeMsgpack(dec *Decoder) error {
+	msg, err := dec.DecodeRaw()
+	if err != nil {
+		return err
+	}
+	*m = msg
+	return nil
+}
+
+//------------------------------------------------------------------------------
+
+type unexpectedCodeError struct {
+	code byte
+	hint string
+}
+
+func (err unexpectedCodeError) Error() string {
+	return fmt.Sprintf("msgpack: unexpected code=%x decoding %s", err.code, err.hint)
+}
diff --git a/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v5/msgpcode/msgpcode.go b/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v5/msgpcode/msgpcode.go
new file mode 100644
index 00000000000..e35389cccfe
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v5/msgpcode/msgpcode.go
@@ -0,0 +1,88 @@
+package msgpcode
+
+var (
+	PosFixedNumHigh byte = 0x7f
+	NegFixedNumLow  byte = 0xe0
+
+	Nil byte = 0xc0
+
+	False byte = 0xc2
+	True  byte = 0xc3
+
+	Float  byte = 0xca
+	Double byte = 0xcb
+
+	Uint8  byte = 0xcc
+	Uint16 byte = 0xcd
+	Uint32 byte = 0xce
+	Uint64 byte = 0xcf
+
+	Int8  byte = 0xd0
+	Int16 byte = 0xd1
+	Int32 byte = 0xd2
+	Int64 byte = 0xd3
+
+	FixedStrLow  byte = 0xa0
+	FixedStrHigh byte = 0xbf
+	FixedStrMask byte = 0x1f
+	Str8         byte = 0xd9
+	Str16        byte = 0xda
+	Str32        byte = 0xdb
+
+	Bin8  byte = 0xc4
+	Bin16 byte = 0xc5
+	Bin32 byte = 0xc6
+
+	FixedArrayLow  byte = 0x90
+	FixedArrayHigh byte = 0x9f
+	FixedArrayMask byte = 0xf
+	Array16        byte = 0xdc
+	Array32        byte = 0xdd
+
+	FixedMapLow  byte = 0x80
+	FixedMapHigh byte = 0x8f
+	FixedMapMask byte = 0xf
+	Map16        byte = 0xde
+	Map32        byte = 0xdf
+
+	FixExt1  byte = 0xd4
+	FixExt2  byte = 0xd5
+	FixExt4  byte = 0xd6
+	FixExt8  byte = 0xd7
+	FixExt16 byte = 0xd8
+	Ext8     byte = 0xc7
+	Ext16    byte = 0xc8
+	Ext32    byte = 0xc9
+)
+
+func IsFixedNum(c byte) bool {
+	return c <= PosFixedNumHigh || c >= NegFixedNumLow
+}
+
+func IsFixedMap(c byte) bool {
+	return c >= FixedMapLow && c <= FixedMapHigh
+}
+
+func IsFixedArray(c byte) bool {
+	return c >= FixedArrayLow && c <= FixedArrayHigh
+}
+
+func IsFixedString(c byte) bool {
+	return c >= FixedStrLow && c <= FixedStrHigh
+}
+
+func IsString(c byte) bool {
+	return IsFixedString(c) || c == Str8 || c == Str16 || c == Str32
+}
+
+func IsBin(c byte) bool {
+	return c == Bin8 || c == Bin16 || c == Bin32
+}
+
+func IsFixedExt(c byte) bool {
+	return c >= FixExt1 && c <= FixExt16
+}
+
+func IsExt(c byte) bool {
+	return IsFixedExt(c) || c == Ext8 || c == Ext16 || c == Ext32
+}
diff --git a/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v5/package.json b/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v5/package.json
new file mode 100644
index 00000000000..298910d45cf
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v5/package.json
@@ -0,0 +1,4 @@
+{
+  "name": "msgpack",
+  "version": "5.3.5"
+}
diff --git a/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v4/safe.go b/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v5/safe.go
similarity index 100%
rename from .ci/providerlint/vendor/github.com/vmihailenco/msgpack/v4/safe.go
rename to .ci/providerlint/vendor/github.com/vmihailenco/msgpack/v5/safe.go
diff --git a/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v5/time.go b/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v5/time.go
new file mode 100644
index 00000000000..44566ec0761
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v5/time.go
@@ -0,0 +1,145 @@
+package msgpack
+
+import (
+	"encoding/binary"
+	"fmt"
+	"reflect"
+	"time"
+
+	"github.com/vmihailenco/msgpack/v5/msgpcode"
+)
+
+var timeExtID int8 = -1
+
+func init() {
+	RegisterExtEncoder(timeExtID, time.Time{}, timeEncoder)
+	RegisterExtDecoder(timeExtID, time.Time{}, timeDecoder)
+}
+
+func timeEncoder(e *Encoder, v reflect.Value) ([]byte, error) {
+	return e.encodeTime(v.Interface().(time.Time)), nil
+}
+
+func timeDecoder(d *Decoder, v reflect.Value, extLen int) error {
+	tm, err := d.decodeTime(extLen)
+	if err != nil {
+		return err
+	}
+
+	ptr := v.Addr().Interface().(*time.Time)
+	*ptr = tm
+
+	return nil
+}
+
+func (e *Encoder) EncodeTime(tm time.Time) error {
+	b := e.encodeTime(tm)
+	if err := e.encodeExtLen(len(b)); err != nil {
+		return err
+	}
+	if err := e.w.WriteByte(byte(timeExtID)); err != nil {
+		return err
+	}
+	return e.write(b)
+}
+
+func (e *Encoder) encodeTime(tm time.Time) []byte {
+	if e.timeBuf == nil {
+		e.timeBuf = make([]byte, 12)
+	}
+
+	secs := uint64(tm.Unix())
+	if secs>>34 == 0 {
+		data := uint64(tm.Nanosecond())<<34 | secs
+
+		if data&0xffffffff00000000 == 0 {
+			b := e.timeBuf[:4]
+			binary.BigEndian.PutUint32(b, uint32(data))
+			return b
+		}
+
+		b := e.timeBuf[:8]
+		binary.BigEndian.PutUint64(b, data)
+		return b
+	}
+
+	b := e.timeBuf[:12]
+	binary.BigEndian.PutUint32(b, uint32(tm.Nanosecond()))
+	binary.BigEndian.PutUint64(b[4:], secs)
+	return b
+}
+
+func (d *Decoder) DecodeTime() (time.Time, error) {
+	c, err := d.readCode()
+	if err != nil {
+		return time.Time{}, err
+	}
+
+	// Legacy format.
+	if c == msgpcode.FixedArrayLow|2 {
+		sec, err := d.DecodeInt64()
+		if err != nil {
+			return time.Time{}, err
+		}
+
+		nsec, err := d.DecodeInt64()
+		if err != nil {
+			return time.Time{}, err
+		}
+
+		return time.Unix(sec, nsec), nil
+	}
+
+	if msgpcode.IsString(c) {
+		s, err := d.string(c)
+		if err != nil {
+			return time.Time{}, err
+		}
+		return time.Parse(time.RFC3339Nano, s)
+	}
+
+	extID, extLen, err := d.extHeader(c)
+	if err != nil {
+		return time.Time{}, err
+	}
+
+	if extID != timeExtID {
+		return time.Time{}, fmt.Errorf("msgpack: invalid time ext id=%d", extID)
+	}
+
+	tm, err := d.decodeTime(extLen)
+	if err != nil {
+		return tm, err
+	}
+
+	if tm.IsZero() {
+		// Zero time does not have timezone information.
+		return tm.UTC(), nil
+	}
+	return tm, nil
+}
+
+func (d *Decoder) decodeTime(extLen int) (time.Time, error) {
+	b, err := d.readN(extLen)
+	if err != nil {
+		return time.Time{}, err
+	}
+
+	switch len(b) {
+	case 4:
+		sec := binary.BigEndian.Uint32(b)
+		return time.Unix(int64(sec), 0), nil
+	case 8:
+		sec := binary.BigEndian.Uint64(b)
+		nsec := int64(sec >> 34)
+		sec &= 0x00000003ffffffff
+		return time.Unix(int64(sec), nsec), nil
+	case 12:
+		nsec := binary.BigEndian.Uint32(b)
+		sec := binary.BigEndian.Uint64(b[4:])
+		return time.Unix(int64(sec), int64(nsec)), nil
+	default:
+		err = fmt.Errorf("msgpack: invalid ext len=%d decoding time", extLen)
+		return time.Time{}, err
+	}
+}
diff --git a/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v5/types.go b/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v5/types.go
new file mode 100644
index 00000000000..69aca611b23
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v5/types.go
@@ -0,0 +1,407 @@
+package msgpack
+
+import (
+	"encoding"
+	"fmt"
+	"log"
+	"reflect"
+	"sync"
+
+	"github.com/vmihailenco/tagparser/v2"
+)
+
+var errorType = reflect.TypeOf((*error)(nil)).Elem()
+
+var (
+	customEncoderType = reflect.TypeOf((*CustomEncoder)(nil)).Elem()
+	customDecoderType = reflect.TypeOf((*CustomDecoder)(nil)).Elem()
+)
+
+var (
+	marshalerType   = reflect.TypeOf((*Marshaler)(nil)).Elem()
+	unmarshalerType = reflect.TypeOf((*Unmarshaler)(nil)).Elem()
+)
+
+var (
+	binaryMarshalerType   = reflect.TypeOf((*encoding.BinaryMarshaler)(nil)).Elem()
+	binaryUnmarshalerType = reflect.TypeOf((*encoding.BinaryUnmarshaler)(nil)).Elem()
+)
+
+var (
+	textMarshalerType   = reflect.TypeOf((*encoding.TextMarshaler)(nil)).Elem()
+	textUnmarshalerType = reflect.TypeOf((*encoding.TextUnmarshaler)(nil)).Elem()
+)
+
+type (
+	encoderFunc func(*Encoder, reflect.Value) error
+	decoderFunc func(*Decoder, reflect.Value) error
+)
+
+var (
+	typeEncMap sync.Map
+	typeDecMap sync.Map
+)
+
+// Register registers encoder and decoder functions for a value.
+// This is low level API and in most cases you should prefer implementing
+// CustomEncoder/CustomDecoder or Marshaler/Unmarshaler interfaces.
+func Register(value interface{}, enc encoderFunc, dec decoderFunc) {
+	typ := reflect.TypeOf(value)
+	if enc != nil {
+		typeEncMap.Store(typ, enc)
+	}
+	if dec != nil {
+		typeDecMap.Store(typ, dec)
+	}
+}
+
+//------------------------------------------------------------------------------
+
+const defaultStructTag = "msgpack"
+
+var structs = newStructCache()
+
+type structCache struct {
+	m sync.Map
+}
+
+type structCacheKey struct {
+	tag string
+	typ reflect.Type
+}
+
+func newStructCache() *structCache {
+	return new(structCache)
+}
+
+func (m *structCache) Fields(typ reflect.Type, tag string) *fields {
+	key := structCacheKey{tag: tag, typ: typ}
+
+	if v, ok := m.m.Load(key); ok {
+		return v.(*fields)
+	}
+
+	fs := getFields(typ, tag)
+	m.m.Store(key, fs)
+
+	return fs
+}
+
+//------------------------------------------------------------------------------
+
+type field struct {
+	name      string
+	index     []int
+	omitEmpty bool
+	encoder   encoderFunc
+	decoder   decoderFunc
+}
+
+func (f *field) Omit(strct reflect.Value, forced bool) bool {
+	v, ok := fieldByIndex(strct, f.index)
+	if !ok {
+		return true
+	}
+	return (f.omitEmpty || forced) && isEmptyValue(v)
+}
+
+func (f *field) EncodeValue(e *Encoder, strct reflect.Value) error {
+	v, ok := fieldByIndex(strct, f.index)
+	if !ok {
+		return e.EncodeNil()
+	}
+	return f.encoder(e, v)
+}
+
+func (f *field) DecodeValue(d *Decoder, strct reflect.Value) error {
+	v := fieldByIndexAlloc(strct, f.index)
+	return f.decoder(d, v)
+}
+
+//------------------------------------------------------------------------------
+
+type fields struct {
+	Type    reflect.Type
+	Map     map[string]*field
+	List    []*field
+	AsArray bool
+
+	hasOmitEmpty bool
+}
+
+func newFields(typ reflect.Type) *fields {
+	return &fields{
+		Type: typ,
+		Map:  make(map[string]*field, typ.NumField()),
+		List: make([]*field, 0, typ.NumField()),
+	}
+}
+
+func (fs *fields) Add(field *field) {
+	fs.warnIfFieldExists(field.name)
+	fs.Map[field.name] = field
+	fs.List = append(fs.List, field)
+	if field.omitEmpty {
+		fs.hasOmitEmpty = true
+	}
+}
+
+func (fs *fields) warnIfFieldExists(name string) {
+	if _, ok := fs.Map[name]; ok {
+		log.Printf("msgpack: %s already has field=%s", fs.Type, name)
+	}
+}
+
+func (fs *fields) OmitEmpty(strct reflect.Value, forced bool) []*field {
+	if !fs.hasOmitEmpty && !forced {
+		return fs.List
+	}
+
+	fields := make([]*field, 0, len(fs.List))
+
+	for _, f := range fs.List {
+		if !f.Omit(strct, forced) {
+			fields = append(fields, f)
+		}
+	}
+
+	return fields
+}
+
+func getFields(typ reflect.Type, fallbackTag string) *fields {
+	fs := newFields(typ)
+
+	var omitEmpty bool
+	for i := 0; i < typ.NumField(); i++ {
+		f := typ.Field(i)
+
+		tagStr := f.Tag.Get(defaultStructTag)
+		if tagStr == "" && fallbackTag != "" {
+			tagStr = f.Tag.Get(fallbackTag)
+		}
+
+		tag := tagparser.Parse(tagStr)
+		if tag.Name == "-" {
+			continue
+		}
+
+		if f.Name == "_msgpack" {
+			fs.AsArray = tag.HasOption("as_array") || tag.HasOption("asArray")
+			if tag.HasOption("omitempty") {
+				omitEmpty = true
+			}
+		}
+
+		if f.PkgPath != "" && !f.Anonymous {
+			continue
+		}
+
+		field := &field{
+			name:      tag.Name,
+			index:     f.Index,
+			omitEmpty: omitEmpty || tag.HasOption("omitempty"),
+		}
+
+		if tag.HasOption("intern") {
+			switch f.Type.Kind() {
+			case reflect.Interface:
+				field.encoder = encodeInternedInterfaceValue
+				field.decoder = decodeInternedInterfaceValue
+			case reflect.String:
+				field.encoder = encodeInternedStringValue
+				field.decoder = decodeInternedStringValue
+			default:
+				err := fmt.Errorf("msgpack: intern strings are not supported on %s", f.Type)
+				panic(err)
+			}
+		} else {
+			field.encoder = getEncoder(f.Type)
+			field.decoder = getDecoder(f.Type)
+		}
+
+		if field.name == "" {
+			field.name = f.Name
+		}
+
+		if f.Anonymous && !tag.HasOption("noinline") {
+			inline := tag.HasOption("inline")
+			if inline {
+				inlineFields(fs, f.Type, field, fallbackTag)
+			} else {
+				inline = shouldInline(fs, f.Type, field, fallbackTag)
+			}
+
+			if inline {
+				if _, ok := fs.Map[field.name]; ok {
+					log.Printf("msgpack: %s already has field=%s", fs.Type, field.name)
+				}
+				fs.Map[field.name] = field
+				continue
+			}
+		}
+
+		fs.Add(field)
+
+		if alias, ok := tag.Options["alias"]; ok {
+			fs.warnIfFieldExists(alias)
+			fs.Map[alias] = field
+		}
+	}
+	return fs
+}
+
+var (
+	encodeStructValuePtr uintptr
+	decodeStructValuePtr uintptr
+)
+
+//nolint:gochecknoinits
+func init() {
+	encodeStructValuePtr = reflect.ValueOf(encodeStructValue).Pointer()
+	decodeStructValuePtr = reflect.ValueOf(decodeStructValue).Pointer()
+}
+
+func inlineFields(fs *fields, typ reflect.Type, f *field, tag string) {
+	inlinedFields := getFields(typ, tag).List
+	for _, field := range inlinedFields {
+		if _, ok := fs.Map[field.name]; ok {
+			// Don't inline shadowed fields.
+			continue
+		}
+		field.index = append(f.index, field.index...)
+		fs.Add(field)
+	}
+}
+
+func shouldInline(fs *fields, typ reflect.Type, f *field, tag string) bool {
+	var encoder encoderFunc
+	var decoder decoderFunc
+
+	if typ.Kind() == reflect.Struct {
+		encoder = f.encoder
+		decoder = f.decoder
+	} else {
+		for typ.Kind() == reflect.Ptr {
+			typ = typ.Elem()
+			encoder = getEncoder(typ)
+			decoder = getDecoder(typ)
+		}
+		if typ.Kind() != reflect.Struct {
+			return false
+		}
+	}
+
+	if reflect.ValueOf(encoder).Pointer() != encodeStructValuePtr {
+		return false
+	}
+	if reflect.ValueOf(decoder).Pointer() != decodeStructValuePtr {
+		return false
+	}
+
+	inlinedFields := getFields(typ, tag).List
+	for _, field := range inlinedFields {
+		if _, ok := fs.Map[field.name]; ok {
+			// Don't auto inline if there are shadowed fields.
+			return false
+		}
+	}
+
+	for _, field := range inlinedFields {
+		field.index = append(f.index, field.index...)
+		fs.Add(field)
+	}
+	return true
+}
+
+type isZeroer interface {
+	IsZero() bool
+}
+
+func isEmptyValue(v reflect.Value) bool {
+	kind := v.Kind()
+
+	for kind == reflect.Interface {
+		if v.IsNil() {
+			return true
+		}
+		v = v.Elem()
+		kind = v.Kind()
+	}
+
+	if z, ok := v.Interface().(isZeroer); ok {
+		return nilable(kind) && v.IsNil() || z.IsZero()
+	}
+
+	switch kind {
+	case reflect.Array, reflect.Map, reflect.Slice, reflect.String:
+		return v.Len() == 0
+	case reflect.Bool:
+		return !v.Bool()
+	case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
+		return v.Int() == 0
+	case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64, reflect.Uintptr:
+		return v.Uint() == 0
+	case reflect.Float32, reflect.Float64:
+		return v.Float() == 0
+	case reflect.Ptr:
+		return v.IsNil()
+	default:
+		return false
+	}
+}
+
+func fieldByIndex(v reflect.Value, index []int) (_ reflect.Value, ok bool) {
+	if len(index) == 1 {
+		return v.Field(index[0]), true
+	}
+
+	for i, idx := range index {
+		if i > 0 {
+			if v.Kind() == reflect.Ptr {
+				if v.IsNil() {
+					return v, false
+				}
+				v = v.Elem()
+			}
+		}
+		v = v.Field(idx)
+	}
+
+	return v, true
+}
+
+func fieldByIndexAlloc(v reflect.Value, index []int) reflect.Value {
+	if len(index) == 1 {
+		return v.Field(index[0])
+	}
+
+	for i, idx := range index {
+		if i > 0 {
+			var ok bool
+			v, ok = indirectNil(v)
+			if !ok {
+				return v
+			}
+		}
+		v = v.Field(idx)
+	}
+
+	return v
+}
+
+func indirectNil(v reflect.Value) (reflect.Value, bool) {
+	if v.Kind() == reflect.Ptr {
+		if v.IsNil() {
+			if !v.CanSet() {
+				return v, false
+			}
+			elemType := v.Type().Elem()
+			if elemType.Kind() != reflect.Struct {
+				return v, false
+			}
+			v.Set(reflect.New(elemType))
+		}
+		v = v.Elem()
+	}
+	return v, true
+}
diff --git a/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v4/unsafe.go b/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v5/unsafe.go
similarity index 83%
rename from .ci/providerlint/vendor/github.com/vmihailenco/msgpack/v4/unsafe.go
rename to .ci/providerlint/vendor/github.com/vmihailenco/msgpack/v5/unsafe.go
index 50c0da8b5be..192ac47920d 100644
--- a/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v4/unsafe.go
+++ b/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v5/unsafe.go
@@ -7,7 +7,7 @@ import (
 )
 
 // bytesToString converts byte slice to string.
-func bytesToString(b []byte) string { //nolint:deadcode,unused
+func bytesToString(b []byte) string {
 	return *(*string)(unsafe.Pointer(&b))
 }
 
diff --git a/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v5/version.go b/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v5/version.go
new file mode 100644
index 00000000000..1d49337c359
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/vmihailenco/msgpack/v5/version.go
@@ -0,0 +1,6 @@
+package msgpack
+
+// Version is the current release version.
+func Version() string {
+	return "5.3.5"
+}
diff --git a/.ci/providerlint/vendor/github.com/vmihailenco/tagparser/.travis.yml b/.ci/providerlint/vendor/github.com/vmihailenco/tagparser/.travis.yml
deleted file mode 100644
index ec538452322..00000000000
--- a/.ci/providerlint/vendor/github.com/vmihailenco/tagparser/.travis.yml
+++ /dev/null
@@ -1,24 +0,0 @@
-dist: xenial
-sudo: false
-language: go
-
-go:
-  - 1.11.x
-  - 1.12.x
-  - tip
-
-matrix:
-  allow_failures:
-    - go: tip
-
-env:
-  - GO111MODULE=on
-
-go_import_path: github.com/vmihailenco/tagparser
-
-before_install:
-  - curl -sfL https://install.goreleaser.com/github.com/golangci/golangci-lint.sh | sh -s -- -b $(go env GOPATH)/bin v1.17.1
-
-script:
-  - make
-  - golangci-lint run
diff --git a/.ci/providerlint/vendor/github.com/vmihailenco/tagparser/Makefile b/.ci/providerlint/vendor/github.com/vmihailenco/tagparser/Makefile
deleted file mode 100644
index fe9dc5bdbaf..00000000000
--- a/.ci/providerlint/vendor/github.com/vmihailenco/tagparser/Makefile
+++ /dev/null
@@ -1,8 +0,0 @@
-all:
-	go test ./...
-	go test ./... -short -race
-	go test ./... -run=NONE -bench=. -benchmem
-	env GOOS=linux GOARCH=386 go test ./...
-	go vet ./...
-	go get github.com/gordonklaus/ineffassign
-	ineffassign .
diff --git a/.ci/providerlint/vendor/github.com/vmihailenco/tagparser/README.md b/.ci/providerlint/vendor/github.com/vmihailenco/tagparser/README.md
deleted file mode 100644
index 411aa5444dc..00000000000
--- a/.ci/providerlint/vendor/github.com/vmihailenco/tagparser/README.md
+++ /dev/null
@@ -1,24 +0,0 @@
-# Opinionated Golang tag parser
-
-[![Build Status](https://travis-ci.org/vmihailenco/tagparser.png?branch=master)](https://travis-ci.org/vmihailenco/tagparser)
-[![GoDoc](https://godoc.org/github.com/vmihailenco/tagparser?status.svg)](https://godoc.org/github.com/vmihailenco/tagparser)
-
-## Installation
-
-Install:
-
-```shell
-go get -u github.com/vmihailenco/tagparser
-```
-
-## Quickstart
-
-```go
-func ExampleParse() {
-	tag := tagparser.Parse("some_name,key:value,key2:'complex value'")
-	fmt.Println(tag.Name)
-	fmt.Println(tag.Options)
-	// Output: some_name
-	// map[key:value key2:'complex value']
-}
-```
diff --git a/.ci/providerlint/vendor/github.com/vmihailenco/tagparser/v2/.travis.yml b/.ci/providerlint/vendor/github.com/vmihailenco/tagparser/v2/.travis.yml
new file mode 100644
index 00000000000..7194cd00109
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/vmihailenco/tagparser/v2/.travis.yml
@@ -0,0 +1,19 @@
+dist: xenial
+language: go
+
+go:
+  - 1.14.x
+  - 1.15.x
+  - tip
+
+matrix:
+  allow_failures:
+    - go: tip
+
+env:
+  - GO111MODULE=on
+
+go_import_path: github.com/vmihailenco/tagparser
+
+before_install:
+  - curl -sfL https://install.goreleaser.com/github.com/golangci/golangci-lint.sh | sh -s -- -b $(go env GOPATH)/bin v1.17.1
diff --git a/.ci/providerlint/vendor/github.com/vmihailenco/tagparser/LICENSE b/.ci/providerlint/vendor/github.com/vmihailenco/tagparser/v2/LICENSE
similarity index 100%
rename from .ci/providerlint/vendor/github.com/vmihailenco/tagparser/LICENSE
rename to .ci/providerlint/vendor/github.com/vmihailenco/tagparser/v2/LICENSE
diff --git a/.ci/providerlint/vendor/github.com/vmihailenco/tagparser/v2/Makefile b/.ci/providerlint/vendor/github.com/vmihailenco/tagparser/v2/Makefile
new file mode 100644
index 00000000000..0b1b59595ac
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/vmihailenco/tagparser/v2/Makefile
@@ -0,0 +1,9 @@
+all:
+	go test ./...
+	go test ./... -short -race
+	go test ./... -run=NONE -bench=. -benchmem
+	env GOOS=linux GOARCH=386 go test ./...
+	go vet ./...
+	go get github.com/gordonklaus/ineffassign
+	ineffassign .
+	golangci-lint run
diff --git a/.ci/providerlint/vendor/github.com/vmihailenco/tagparser/v2/README.md b/.ci/providerlint/vendor/github.com/vmihailenco/tagparser/v2/README.md
new file mode 100644
index 00000000000..c0259de5659
--- /dev/null
+++ b/.ci/providerlint/vendor/github.com/vmihailenco/tagparser/v2/README.md
@@ -0,0 +1,24 @@
+# Opinionated Golang tag parser
+
+[![Build Status](https://travis-ci.org/vmihailenco/tagparser.png?branch=master)](https://travis-ci.org/vmihailenco/tagparser)
+[![GoDoc](https://godoc.org/github.com/vmihailenco/tagparser?status.svg)](https://godoc.org/github.com/vmihailenco/tagparser)
+
+## Installation
+
+Install:
+
+```shell
+go get github.com/vmihailenco/tagparser/v2
+```
+
+## Quickstart
+
+```go
+func ExampleParse() {
+	tag := tagparser.Parse("some_name,key:value,key2:'complex value'")
+	fmt.Println(tag.Name)
+	fmt.Println(tag.Options)
+	// Output: some_name
+	// map[key:value key2:'complex value']
+}
+```
diff --git a/.ci/providerlint/vendor/github.com/vmihailenco/tagparser/internal/parser/parser.go b/.ci/providerlint/vendor/github.com/vmihailenco/tagparser/v2/internal/parser/parser.go
similarity index 95%
rename from .ci/providerlint/vendor/github.com/vmihailenco/tagparser/internal/parser/parser.go
rename to .ci/providerlint/vendor/github.com/vmihailenco/tagparser/v2/internal/parser/parser.go
index 2de1c6f7bde..21a9bc7f747 100644
--- a/.ci/providerlint/vendor/github.com/vmihailenco/tagparser/internal/parser/parser.go
+++ b/.ci/providerlint/vendor/github.com/vmihailenco/tagparser/v2/internal/parser/parser.go
@@ -3,7 +3,7 @@ package parser
 import (
 	"bytes"
 
-	"github.com/vmihailenco/tagparser/internal"
+	"github.com/vmihailenco/tagparser/v2/internal"
 )
 
 type Parser struct {
diff --git a/.ci/providerlint/vendor/github.com/vmihailenco/tagparser/internal/safe.go b/.ci/providerlint/vendor/github.com/vmihailenco/tagparser/v2/internal/safe.go
similarity index 100%
rename from .ci/providerlint/vendor/github.com/vmihailenco/tagparser/internal/safe.go
rename to .ci/providerlint/vendor/github.com/vmihailenco/tagparser/v2/internal/safe.go
diff --git a/.ci/providerlint/vendor/github.com/vmihailenco/tagparser/internal/unsafe.go b/.ci/providerlint/vendor/github.com/vmihailenco/tagparser/v2/internal/unsafe.go
similarity index 100%
rename from .ci/providerlint/vendor/github.com/vmihailenco/tagparser/internal/unsafe.go
rename to .ci/providerlint/vendor/github.com/vmihailenco/tagparser/v2/internal/unsafe.go
diff --git a/.ci/providerlint/vendor/github.com/vmihailenco/tagparser/tagparser.go b/.ci/providerlint/vendor/github.com/vmihailenco/tagparser/v2/tagparser.go
similarity index 88%
rename from .ci/providerlint/vendor/github.com/vmihailenco/tagparser/tagparser.go
rename to .ci/providerlint/vendor/github.com/vmihailenco/tagparser/v2/tagparser.go
index 56b918011b0..5002e6453ea 100644
--- a/.ci/providerlint/vendor/github.com/vmihailenco/tagparser/tagparser.go
+++ b/.ci/providerlint/vendor/github.com/vmihailenco/tagparser/v2/tagparser.go
@@ -1,7 +1,9 @@
 package tagparser
 
 import (
-	"github.com/vmihailenco/tagparser/internal/parser"
+	"strings"
+
+	"github.com/vmihailenco/tagparser/v2/internal/parser"
 )
 
 type Tag struct {
@@ -31,6 +33,9 @@ type tagParser struct {
 }
 
 func (p *tagParser) setTagOption(key, value string) {
+	key = strings.TrimSpace(key)
+	value = strings.TrimSpace(value)
+
 	if !p.hasName {
 		p.hasName = true
 		if key == "" {
@@ -79,7 +84,6 @@ func (p *tagParser) parseKey() {
 
 func (p *tagParser) parseValue() {
 	const quote = '\''
-
 	c := p.Peek()
 	if c == quote {
 		p.Skip(quote)
@@ -134,10 +138,7 @@ loop:
 
 func (p *tagParser) parseQuotedValue() {
 	const quote = '\''
-
 	var b []byte
-	b = append(b, quote)
-
 	for p.Valid() {
 		bb, ok := p.ReadSep(quote)
 		if !ok {
@@ -145,6 +146,8 @@ func (p *tagParser) parseQuotedValue() {
 			break
 		}
 
+		// keep the escaped single-quote, and continue until we've found the
+		// one that isn't.
 		if len(bb) > 0 && bb[len(bb)-1] == '\\' {
 			b = append(b, bb[:len(bb)-1]...)
 			b = append(b, quote)
@@ -152,7 +155,6 @@ func (p *tagParser) parseQuotedValue() {
 		}
 
 		b = append(b, bb...)
-		b = append(b, quote)
 		break
 	}
 
@@ -162,15 +164,3 @@ func (p *tagParser) parseQuotedValue() {
 	}
 	p.parseKey()
 }
-
-func Unquote(s string) (string, bool) {
-	const quote = '\''
-
-	if len(s) < 2 {
-		return s, false
-	}
-	if s[0] == quote && s[len(s)-1] == quote {
-		return s[1 : len(s)-1], true
-	}
-	return s, false
-}
diff --git a/.ci/providerlint/vendor/github.com/zclconf/go-cty/cty/ctystrings/prefix.go b/.ci/providerlint/vendor/github.com/zclconf/go-cty/cty/ctystrings/prefix.go
index 1d9f5c5a1f9..bbf045233b4 100644
--- a/.ci/providerlint/vendor/github.com/zclconf/go-cty/cty/ctystrings/prefix.go
+++ b/.ci/providerlint/vendor/github.com/zclconf/go-cty/cty/ctystrings/prefix.go
@@ -4,7 +4,7 @@ import (
 	"fmt"
 	"unicode/utf8"
 
-	"github.com/apparentlymart/go-textseg/v13/textseg"
+	"github.com/apparentlymart/go-textseg/v15/textseg"
 	"golang.org/x/text/unicode/norm"
 )
 
@@ -26,10 +26,6 @@ import (
 // application can guarantee that the remainder of the string will not begin
 // with combining marks then it is safe to instead just normalize the prefix
 // string with [Normalize].
-//
-// Note that this function only takes into account normalization boundaries
-// and does _not_ take into account grapheme cluster boundaries as defined
-// by Unicode Standard Annex #29.
 func SafeKnownPrefix(prefix string) string {
 	prefix = Normalize(prefix)
 
diff --git a/.ci/providerlint/vendor/github.com/zclconf/go-cty/cty/function/stdlib/format.go b/.ci/providerlint/vendor/github.com/zclconf/go-cty/cty/function/stdlib/format.go
index d04a5eec78b..2339cc33a7d 100644
--- a/.ci/providerlint/vendor/github.com/zclconf/go-cty/cty/function/stdlib/format.go
+++ b/.ci/providerlint/vendor/github.com/zclconf/go-cty/cty/function/stdlib/format.go
@@ -6,7 +6,7 @@ import (
 	"math/big"
 	"strings"
 
-	"github.com/apparentlymart/go-textseg/v13/textseg"
+	"github.com/apparentlymart/go-textseg/v15/textseg"
 
 	"github.com/zclconf/go-cty/cty"
 	"github.com/zclconf/go-cty/cty/convert"
diff --git a/.ci/providerlint/vendor/github.com/zclconf/go-cty/cty/function/stdlib/string.go b/.ci/providerlint/vendor/github.com/zclconf/go-cty/cty/function/stdlib/string.go
index 57ebce1b4a6..f79bf98df2e 100644
--- a/.ci/providerlint/vendor/github.com/zclconf/go-cty/cty/function/stdlib/string.go
+++ b/.ci/providerlint/vendor/github.com/zclconf/go-cty/cty/function/stdlib/string.go
@@ -6,7 +6,7 @@ import (
 	"sort"
 	"strings"
 
-	"github.com/apparentlymart/go-textseg/v13/textseg"
+	"github.com/apparentlymart/go-textseg/v15/textseg"
 
 	"github.com/zclconf/go-cty/cty"
 	"github.com/zclconf/go-cty/cty/function"
diff --git a/.ci/providerlint/vendor/github.com/zclconf/go-cty/cty/path.go b/.ci/providerlint/vendor/github.com/zclconf/go-cty/cty/path.go
index 636e68c63dd..4995a8c7bfc 100644
--- a/.ci/providerlint/vendor/github.com/zclconf/go-cty/cty/path.go
+++ b/.ci/providerlint/vendor/github.com/zclconf/go-cty/cty/path.go
@@ -225,7 +225,9 @@ func (s IndexStep) Apply(val Value) (Value, error) {
 		return NilVal, errors.New("key value not number or string")
 	}
 
-	has := val.HasIndex(s.Key)
+	// This value needs to be stripped of marks to check True(), but Index will
+	// apply the correct marks for the result.
+	has, _ := val.HasIndex(s.Key).Unmark()
 	if !has.IsKnown() {
 		return UnknownVal(val.Type().ElementType()), nil
 	}
diff --git a/.ci/providerlint/vendor/golang.org/x/crypto/argon2/argon2.go b/.ci/providerlint/vendor/golang.org/x/crypto/argon2/argon2.go
new file mode 100644
index 00000000000..29f0a2de451
--- /dev/null
+++ b/.ci/providerlint/vendor/golang.org/x/crypto/argon2/argon2.go
@@ -0,0 +1,283 @@
+// Copyright 2017 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// Package argon2 implements the key derivation function Argon2.
+// Argon2 was selected as the winner of the Password Hashing Competition and can
+// be used to derive cryptographic keys from passwords.
+//
+// For a detailed specification of Argon2 see [1].
+//
+// If you aren't sure which function you need, use Argon2id (IDKey) and
+// the parameter recommendations for your scenario.
+//
+// # Argon2i
+//
+// Argon2i (implemented by Key) is the side-channel resistant version of Argon2.
+// It uses data-independent memory access, which is preferred for password
+// hashing and password-based key derivation. Argon2i requires more passes over
+// memory than Argon2id to protect from trade-off attacks. The recommended
+// parameters (taken from [2]) for non-interactive operations are time=3 and to
+// use the maximum available memory.
+//
+// # Argon2id
+//
+// Argon2id (implemented by IDKey) is a hybrid version of Argon2 combining
+// Argon2i and Argon2d. It uses data-independent memory access for the first
+// half of the first iteration over the memory and data-dependent memory access
+// for the rest. Argon2id is side-channel resistant and provides better brute-
+// force cost savings due to time-memory tradeoffs than Argon2i. The recommended
+// parameters for non-interactive operations (taken from [2]) are time=1 and to
+// use the maximum available memory.
+//
+// [1] https://github.com/P-H-C/phc-winner-argon2/blob/master/argon2-specs.pdf
+// [2] https://tools.ietf.org/html/draft-irtf-cfrg-argon2-03#section-9.3
+package argon2
+
+import (
+	"encoding/binary"
+	"sync"
+
+	"golang.org/x/crypto/blake2b"
+)
+
+// The Argon2 version implemented by this package.
+const Version = 0x13
+
+const (
+	argon2d = iota
+	argon2i
+	argon2id
+)
+
+// Key derives a key from the password, salt, and cost parameters using Argon2i
+// returning a byte slice of length keyLen that can be used as cryptographic
+// key. The CPU cost and parallelism degree must be greater than zero.
+//
+// For example, you can get a derived key for e.g. AES-256 (which needs a
+// 32-byte key) by doing:
+//
+//	key := argon2.Key([]byte("some password"), salt, 3, 32*1024, 4, 32)
+//
+// The draft RFC recommends[2] time=3, and memory=32*1024 is a sensible number.
+// If using that amount of memory (32 MB) is not possible in some contexts then
+// the time parameter can be increased to compensate.
+//
+// The time parameter specifies the number of passes over the memory and the
+// memory parameter specifies the size of the memory in KiB. For example
+// memory=32*1024 sets the memory cost to ~32 MB. The number of threads can be
+// adjusted to the number of available CPUs. The cost parameters should be
+// increased as memory latency and CPU parallelism increases. Remember to get a
+// good random salt.
+func Key(password, salt []byte, time, memory uint32, threads uint8, keyLen uint32) []byte {
+	return deriveKey(argon2i, password, salt, nil, nil, time, memory, threads, keyLen)
+}
+
+// IDKey derives a key from the password, salt, and cost parameters using
+// Argon2id returning a byte slice of length keyLen that can be used as
+// cryptographic key. The CPU cost and parallelism degree must be greater than
+// zero.
+//
+// For example, you can get a derived key for e.g. AES-256 (which needs a
+// 32-byte key) by doing:
+//
+//	key := argon2.IDKey([]byte("some password"), salt, 1, 64*1024, 4, 32)
+//
+// The draft RFC recommends[2] time=1, and memory=64*1024 is a sensible number.
+// If using that amount of memory (64 MB) is not possible in some contexts then
+// the time parameter can be increased to compensate.
+//
+// The time parameter specifies the number of passes over the memory and the
+// memory parameter specifies the size of the memory in KiB. For example
+// memory=64*1024 sets the memory cost to ~64 MB. The number of threads can be
+// adjusted to the numbers of available CPUs. The cost parameters should be
+// increased as memory latency and CPU parallelism increases. Remember to get a
+// good random salt.
+func IDKey(password, salt []byte, time, memory uint32, threads uint8, keyLen uint32) []byte {
+	return deriveKey(argon2id, password, salt, nil, nil, time, memory, threads, keyLen)
+}
+
+func deriveKey(mode int, password, salt, secret, data []byte, time, memory uint32, threads uint8, keyLen uint32) []byte {
+	if time < 1 {
+		panic("argon2: number of rounds too small")
+	}
+	if threads < 1 {
+		panic("argon2: parallelism degree too low")
+	}
+	h0 := initHash(password, salt, secret, data, time, memory, uint32(threads), keyLen, mode)
+
+	memory = memory / (syncPoints * uint32(threads)) * (syncPoints * uint32(threads))
+	if memory < 2*syncPoints*uint32(threads) {
+		memory = 2 * syncPoints * uint32(threads)
+	}
+	B := initBlocks(&h0, memory, uint32(threads))
+	processBlocks(B, time, memory, uint32(threads), mode)
+	return extractKey(B, memory, uint32(threads), keyLen)
+}
+
+const (
+	blockLength = 128
+	syncPoints  = 4
+)
+
+type block [blockLength]uint64
+
+func initHash(password, salt, key, data []byte, time, memory, threads, keyLen uint32, mode int) [blake2b.Size + 8]byte {
+	var (
+		h0     [blake2b.Size + 8]byte
+		params [24]byte
+		tmp    [4]byte
+	)
+
+	b2, _ := blake2b.New512(nil)
+	binary.LittleEndian.PutUint32(params[0:4], threads)
+	binary.LittleEndian.PutUint32(params[4:8], keyLen)
+	binary.LittleEndian.PutUint32(params[8:12], memory)
+	binary.LittleEndian.PutUint32(params[12:16], time)
+	binary.LittleEndian.PutUint32(params[16:20], uint32(Version))
+	binary.LittleEndian.PutUint32(params[20:24], uint32(mode))
+	b2.Write(params[:])
+	binary.LittleEndian.PutUint32(tmp[:], uint32(len(password)))
+	b2.Write(tmp[:])
+	b2.Write(password)
+	binary.LittleEndian.PutUint32(tmp[:], uint32(len(salt)))
+	b2.Write(tmp[:])
+	b2.Write(salt)
+	binary.LittleEndian.PutUint32(tmp[:], uint32(len(key)))
+	b2.Write(tmp[:])
+	b2.Write(key)
+	binary.LittleEndian.PutUint32(tmp[:], uint32(len(data)))
+	b2.Write(tmp[:])
+	b2.Write(data)
+	b2.Sum(h0[:0])
+	return h0
+}
+
+func initBlocks(h0 *[blake2b.Size + 8]byte, memory, threads uint32) []block {
+	var block0 [1024]byte
+	B := make([]block, memory)
+	for lane := uint32(0); lane < threads; lane++ {
+		j := lane * (memory / threads)
+		binary.LittleEndian.PutUint32(h0[blake2b.Size+4:], lane)
+
+		binary.LittleEndian.PutUint32(h0[blake2b.Size:], 0)
+		blake2bHash(block0[:], h0[:])
+		for i := range B[j+0] {
+			B[j+0][i] = binary.LittleEndian.Uint64(block0[i*8:])
+		}
+
+		binary.LittleEndian.PutUint32(h0[blake2b.Size:], 1)
+		blake2bHash(block0[:], h0[:])
+		for i := range B[j+1] {
+			B[j+1][i] = binary.LittleEndian.Uint64(block0[i*8:])
+		}
+	}
+	return B
+}
+
+func processBlocks(B []block, time, memory, threads uint32, mode int) {
+	lanes := memory / threads
+	segments := lanes / syncPoints
+
+	processSegment := func(n, slice, lane uint32, wg *sync.WaitGroup) {
+		var addresses, in, zero block
+		if mode == argon2i || (mode == argon2id && n == 0 && slice < syncPoints/2) {
+			in[0] = uint64(n)
+			in[1] = uint64(lane)
+			in[2] = uint64(slice)
+			in[3] = uint64(memory)
+			in[4] = uint64(time)
+			in[5] = uint64(mode)
+		}
+
+		index := uint32(0)
+		if n == 0 && slice == 0 {
+			index = 2 // we have already generated the first two blocks
+			if mode == argon2i || mode == argon2id {
+				in[6]++
+				processBlock(&addresses, &in, &zero)
+				processBlock(&addresses, &addresses, &zero)
+			}
+		}
+
+		offset := lane*lanes + slice*segments + index
+		var random uint64
+		for index < segments {
+			prev := offset - 1
+			if index == 0 && slice == 0 {
+				prev += lanes // last block in lane
+			}
+			if mode == argon2i || (mode == argon2id && n == 0 && slice < syncPoints/2) {
+				if index%blockLength == 0 {
+					in[6]++
+					processBlock(&addresses, &in, &zero)
+					processBlock(&addresses, &addresses, &zero)
+				}
+				random = addresses[index%blockLength]
+			} else {
+				random = B[prev][0]
+			}
+			newOffset := indexAlpha(random, lanes, segments, threads, n, slice, lane, index)
+			processBlockXOR(&B[offset], &B[prev], &B[newOffset])
+			index, offset = index+1, offset+1
+		}
+		wg.Done()
+	}
+
+	for n := uint32(0); n < time; n++ {
+		for slice := uint32(0); slice < syncPoints; slice++ {
+			var wg sync.WaitGroup
+			for lane := uint32(0); lane < threads; lane++ {
+				wg.Add(1)
+				go processSegment(n, slice, lane, &wg)
+			}
+			wg.Wait()
+		}
+	}
+
+}
+
+func extractKey(B []block, memory, threads, keyLen uint32) []byte {
+	lanes := memory / threads
+	for lane := uint32(0); lane < threads-1; lane++ {
+		for i, v := range B[(lane*lanes)+lanes-1] {
+			B[memory-1][i] ^= v
+		}
+	}
+
+	var block [1024]byte
+	for i, v := range B[memory-1] {
+		binary.LittleEndian.PutUint64(block[i*8:], v)
+	}
+	key := make([]byte, keyLen)
+	blake2bHash(key, block[:])
+	return key
+}
+
+func indexAlpha(rand uint64, lanes, segments, threads, n, slice, lane, index uint32) uint32 {
+	refLane := uint32(rand>>32) % threads
+	if n == 0 && slice == 0 {
+		refLane = lane
+	}
+	m, s := 3*segments, ((slice+1)%syncPoints)*segments
+	if lane == refLane {
+		m += index
+	}
+	if n == 0 {
+		m, s = slice*segments, 0
+		if slice == 0 || lane == refLane {
+			m += index
+		}
+	}
+	if index == 0 || lane == refLane {
+		m--
+	}
+	return phi(rand, uint64(m), uint64(s), refLane, lanes)
+}
+
+func phi(rand, m, s uint64, lane, lanes uint32) uint32 {
+	p := rand & 0xFFFFFFFF
+	p = (p * p) >> 32
+	p = (p * m) >> 32
+	return lane*lanes + uint32((s+m-(p+1))%uint64(lanes))
+}
diff --git a/.ci/providerlint/vendor/golang.org/x/crypto/argon2/blake2b.go b/.ci/providerlint/vendor/golang.org/x/crypto/argon2/blake2b.go
new file mode 100644
index 00000000000..10f46948dc1
--- /dev/null
+++ b/.ci/providerlint/vendor/golang.org/x/crypto/argon2/blake2b.go
@@ -0,0 +1,53 @@
+// Copyright 2017 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package argon2
+
+import (
+	"encoding/binary"
+	"hash"
+
+	"golang.org/x/crypto/blake2b"
+)
+
+// blake2bHash computes an arbitrary long hash value of in
+// and writes the hash to out.
+func blake2bHash(out []byte, in []byte) {
+	var b2 hash.Hash
+	if n := len(out); n < blake2b.Size {
+		b2, _ = blake2b.New(n, nil)
+	} else {
+		b2, _ = blake2b.New512(nil)
+	}
+
+	var buffer [blake2b.Size]byte
+	binary.LittleEndian.PutUint32(buffer[:4], uint32(len(out)))
+	b2.Write(buffer[:4])
+	b2.Write(in)
+
+	if len(out) <= blake2b.Size {
+		b2.Sum(out[:0])
+		return
+	}
+
+	outLen := len(out)
+	b2.Sum(buffer[:0])
+	b2.Reset()
+	copy(out, buffer[:32])
+	out = out[32:]
+	for len(out) > blake2b.Size {
+		b2.Write(buffer[:])
+		b2.Sum(buffer[:0])
+		copy(out, buffer[:32])
+		out = out[32:]
+		b2.Reset()
+	}
+
+	if outLen%blake2b.Size > 0 { // outLen > 64
+		r := ((outLen + 31) / 32) - 2 // ⌈τ /32⌉-2
+		b2, _ = blake2b.New(outLen-32*r, nil)
+	}
+	b2.Write(buffer[:])
+	b2.Sum(out[:0])
+}
diff --git a/.ci/providerlint/vendor/golang.org/x/crypto/argon2/blamka_amd64.go b/.ci/providerlint/vendor/golang.org/x/crypto/argon2/blamka_amd64.go
new file mode 100644
index 00000000000..a014ac92aa9
--- /dev/null
+++ b/.ci/providerlint/vendor/golang.org/x/crypto/argon2/blamka_amd64.go
@@ -0,0 +1,61 @@
+// Copyright 2017 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build amd64 && gc && !purego
+// +build amd64,gc,!purego
+
+package argon2
+
+import "golang.org/x/sys/cpu"
+
+func init() {
+	useSSE4 = cpu.X86.HasSSE41
+}
+
+//go:noescape
+func mixBlocksSSE2(out, a, b, c *block)
+
+//go:noescape
+func xorBlocksSSE2(out, a, b, c *block)
+
+//go:noescape
+func blamkaSSE4(b *block)
+
+func processBlockSSE(out, in1, in2 *block, xor bool) {
+	var t block
+	mixBlocksSSE2(&t, in1, in2, &t)
+	if useSSE4 {
+		blamkaSSE4(&t)
+	} else {
+		for i := 0; i < blockLength; i += 16 {
+			blamkaGeneric(
+				&t[i+0], &t[i+1], &t[i+2], &t[i+3],
+				&t[i+4], &t[i+5], &t[i+6], &t[i+7],
+				&t[i+8], &t[i+9], &t[i+10], &t[i+11],
+				&t[i+12], &t[i+13], &t[i+14], &t[i+15],
+			)
+		}
+		for i := 0; i < blockLength/8; i += 2 {
+			blamkaGeneric(
+				&t[i], &t[i+1], &t[16+i], &t[16+i+1],
+				&t[32+i], &t[32+i+1], &t[48+i], &t[48+i+1],
+				&t[64+i], &t[64+i+1], &t[80+i], &t[80+i+1],
+				&t[96+i], &t[96+i+1], &t[112+i], &t[112+i+1],
+			)
+		}
+	}
+	if xor {
+		xorBlocksSSE2(out, in1, in2, &t)
+	} else {
+		mixBlocksSSE2(out, in1, in2, &t)
+	}
+}
+
+func processBlock(out, in1, in2 *block) {
+	processBlockSSE(out, in1, in2, false)
+}
+
+func processBlockXOR(out, in1, in2 *block) {
+	processBlockSSE(out, in1, in2, true)
+}
diff --git a/.ci/providerlint/vendor/golang.org/x/crypto/argon2/blamka_amd64.s b/.ci/providerlint/vendor/golang.org/x/crypto/argon2/blamka_amd64.s
new file mode 100644
index 00000000000..b2cc0515049
--- /dev/null
+++ b/.ci/providerlint/vendor/golang.org/x/crypto/argon2/blamka_amd64.s
@@ -0,0 +1,244 @@
+// Copyright 2017 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build amd64 && gc && !purego
+// +build amd64,gc,!purego
+
+#include "textflag.h"
+
+DATA ·c40<>+0x00(SB)/8, $0x0201000706050403
+DATA ·c40<>+0x08(SB)/8, $0x0a09080f0e0d0c0b
+GLOBL ·c40<>(SB), (NOPTR+RODATA), $16
+
+DATA ·c48<>+0x00(SB)/8, $0x0100070605040302
+DATA ·c48<>+0x08(SB)/8, $0x09080f0e0d0c0b0a
+GLOBL ·c48<>(SB), (NOPTR+RODATA), $16
+
+#define SHUFFLE(v2, v3, v4, v5, v6, v7, t1, t2) \
+	MOVO       v4, t1; \
+	MOVO       v5, v4; \
+	MOVO       t1, v5; \
+	MOVO       v6, t1; \
+	PUNPCKLQDQ v6, t2; \
+	PUNPCKHQDQ v7, v6; \
+	PUNPCKHQDQ t2, v6; \
+	PUNPCKLQDQ v7, t2; \
+	MOVO       t1, v7; \
+	MOVO       v2, t1; \
+	PUNPCKHQDQ t2, v7; \
+	PUNPCKLQDQ v3, t2; \
+	PUNPCKHQDQ t2, v2; \
+	PUNPCKLQDQ t1, t2; \
+	PUNPCKHQDQ t2, v3
+
+#define SHUFFLE_INV(v2, v3, v4, v5, v6, v7, t1, t2) \
+	MOVO       v4, t1; \
+	MOVO       v5, v4; \
+	MOVO       t1, v5; \
+	MOVO       v2, t1; \
+	PUNPCKLQDQ v2, t2; \
+	PUNPCKHQDQ v3, v2; \
+	PUNPCKHQDQ t2, v2; \
+	PUNPCKLQDQ v3, t2; \
+	MOVO       t1, v3; \
+	MOVO       v6, t1; \
+	PUNPCKHQDQ t2, v3; \
+	PUNPCKLQDQ v7, t2; \
+	PUNPCKHQDQ t2, v6; \
+	PUNPCKLQDQ t1, t2; \
+	PUNPCKHQDQ t2, v7
+
+#define HALF_ROUND(v0, v1, v2, v3, v4, v5, v6, v7, t0, c40, c48) \
+	MOVO    v0, t0;        \
+	PMULULQ v2, t0;        \
+	PADDQ   v2, v0;        \
+	PADDQ   t0, v0;        \
+	PADDQ   t0, v0;        \
+	PXOR    v0, v6;        \
+	PSHUFD  $0xB1, v6, v6; \
+	MOVO    v4, t0;        \
+	PMULULQ v6, t0;        \
+	PADDQ   v6, v4;        \
+	PADDQ   t0, v4;        \
+	PADDQ   t0, v4;        \
+	PXOR    v4, v2;        \
+	PSHUFB  c40, v2;       \
+	MOVO    v0, t0;        \
+	PMULULQ v2, t0;        \
+	PADDQ   v2, v0;        \
+	PADDQ   t0, v0;        \
+	PADDQ   t0, v0;        \
+	PXOR    v0, v6;        \
+	PSHUFB  c48, v6;       \
+	MOVO    v4, t0;        \
+	PMULULQ v6, t0;        \
+	PADDQ   v6, v4;        \
+	PADDQ   t0, v4;        \
+	PADDQ   t0, v4;        \
+	PXOR    v4, v2;        \
+	MOVO    v2, t0;        \
+	PADDQ   v2, t0;        \
+	PSRLQ   $63, v2;       \
+	PXOR    t0, v2;        \
+	MOVO    v1, t0;        \
+	PMULULQ v3, t0;        \
+	PADDQ   v3, v1;        \
+	PADDQ   t0, v1;        \
+	PADDQ   t0, v1;        \
+	PXOR    v1, v7;        \
+	PSHUFD  $0xB1, v7, v7; \
+	MOVO    v5, t0;        \
+	PMULULQ v7, t0;        \
+	PADDQ   v7, v5;        \
+	PADDQ   t0, v5;        \
+	PADDQ   t0, v5;        \
+	PXOR    v5, v3;        \
+	PSHUFB  c40, v3;       \
+	MOVO    v1, t0;        \
+	PMULULQ v3, t0;        \
+	PADDQ   v3, v1;        \
+	PADDQ   t0, v1;        \
+	PADDQ   t0, v1;        \
+	PXOR    v1, v7;        \
+	PSHUFB  c48, v7;       \
+	MOVO    v5, t0;        \
+	PMULULQ v7, t0;        \
+	PADDQ   v7, v5;        \
+	PADDQ   t0, v5;        \
+	PADDQ   t0, v5;        \
+	PXOR    v5, v3;        \
+	MOVO    v3, t0;        \
+	PADDQ   v3, t0;        \
+	PSRLQ   $63, v3;       \
+	PXOR    t0, v3
+
+#define LOAD_MSG_0(block, off) \
+	MOVOU 8*(off+0)(block), X0;  \
+	MOVOU 8*(off+2)(block), X1;  \
+	MOVOU 8*(off+4)(block), X2;  \
+	MOVOU 8*(off+6)(block), X3;  \
+	MOVOU 8*(off+8)(block), X4;  \
+	MOVOU 8*(off+10)(block), X5; \
+	MOVOU 8*(off+12)(block), X6; \
+	MOVOU 8*(off+14)(block), X7
+
+#define STORE_MSG_0(block, off) \
+	MOVOU X0, 8*(off+0)(block);  \
+	MOVOU X1, 8*(off+2)(block);  \
+	MOVOU X2, 8*(off+4)(block);  \
+	MOVOU X3, 8*(off+6)(block);  \
+	MOVOU X4, 8*(off+8)(block);  \
+	MOVOU X5, 8*(off+10)(block); \
+	MOVOU X6, 8*(off+12)(block); \
+	MOVOU X7, 8*(off+14)(block)
+
+#define LOAD_MSG_1(block, off) \
+	MOVOU 8*off+0*8(block), X0;  \
+	MOVOU 8*off+16*8(block), X1; \
+	MOVOU 8*off+32*8(block), X2; \
+	MOVOU 8*off+48*8(block), X3; \
+	MOVOU 8*off+64*8(block), X4; \
+	MOVOU 8*off+80*8(block), X5; \
+	MOVOU 8*off+96*8(block), X6; \
+	MOVOU 8*off+112*8(block), X7
+
+#define STORE_MSG_1(block, off) \
+	MOVOU X0, 8*off+0*8(block);  \
+	MOVOU X1, 8*off+16*8(block); \
+	MOVOU X2, 8*off+32*8(block); \
+	MOVOU X3, 8*off+48*8(block); \
+	MOVOU X4, 8*off+64*8(block); \
+	MOVOU X5, 8*off+80*8(block); \
+	MOVOU X6, 8*off+96*8(block); \
+	MOVOU X7, 8*off+112*8(block)
+
+#define BLAMKA_ROUND_0(block, off, t0, t1, c40, c48) \
+	LOAD_MSG_0(block, off);                                   \
+	HALF_ROUND(X0, X1, X2, X3, X4, X5, X6, X7, t0, c40, c48); \
+	SHUFFLE(X2, X3, X4, X5, X6, X7, t0, t1);                  \
+	HALF_ROUND(X0, X1, X2, X3, X4, X5, X6, X7, t0, c40, c48); \
+	SHUFFLE_INV(X2, X3, X4, X5, X6, X7, t0, t1);              \
+	STORE_MSG_0(block, off)
+
+#define BLAMKA_ROUND_1(block, off, t0, t1, c40, c48) \
+	LOAD_MSG_1(block, off);                                   \
+	HALF_ROUND(X0, X1, X2, X3, X4, X5, X6, X7, t0, c40, c48); \
+	SHUFFLE(X2, X3, X4, X5, X6, X7, t0, t1);                  \
+	HALF_ROUND(X0, X1, X2, X3, X4, X5, X6, X7, t0, c40, c48); \
+	SHUFFLE_INV(X2, X3, X4, X5, X6, X7, t0, t1);              \
+	STORE_MSG_1(block, off)
+
+// func blamkaSSE4(b *block)
+TEXT ·blamkaSSE4(SB), 4, $0-8
+	MOVQ b+0(FP), AX
+
+	MOVOU ·c40<>(SB), X10
+	MOVOU ·c48<>(SB), X11
+
+	BLAMKA_ROUND_0(AX, 0, X8, X9, X10, X11)
+	BLAMKA_ROUND_0(AX, 16, X8, X9, X10, X11)
+	BLAMKA_ROUND_0(AX, 32, X8, X9, X10, X11)
+	BLAMKA_ROUND_0(AX, 48, X8, X9, X10, X11)
+	BLAMKA_ROUND_0(AX, 64, X8, X9, X10, X11)
+	BLAMKA_ROUND_0(AX, 80, X8, X9, X10, X11)
+	BLAMKA_ROUND_0(AX, 96, X8, X9, X10, X11)
+	BLAMKA_ROUND_0(AX, 112, X8, X9, X10, X11)
+
+	BLAMKA_ROUND_1(AX, 0, X8, X9, X10, X11)
+	BLAMKA_ROUND_1(AX, 2, X8, X9, X10, X11)
+	BLAMKA_ROUND_1(AX, 4, X8, X9, X10, X11)
+	BLAMKA_ROUND_1(AX, 6, X8, X9, X10, X11)
+	BLAMKA_ROUND_1(AX, 8, X8, X9, X10, X11)
+	BLAMKA_ROUND_1(AX, 10, X8, X9, X10, X11)
+	BLAMKA_ROUND_1(AX, 12, X8, X9, X10, X11)
+	BLAMKA_ROUND_1(AX, 14, X8, X9, X10, X11)
+	RET
+
+// func mixBlocksSSE2(out, a, b, c *block)
+TEXT ·mixBlocksSSE2(SB), 4, $0-32
+	MOVQ out+0(FP), DX
+	MOVQ a+8(FP), AX
+	MOVQ b+16(FP), BX
+	MOVQ a+24(FP), CX
+	MOVQ $128, BP
+
+loop:
+	MOVOU 0(AX), X0
+	MOVOU 0(BX), X1
+	MOVOU 0(CX), X2
+	PXOR  X1, X0
+	PXOR  X2, X0
+	MOVOU X0, 0(DX)
+	ADDQ  $16, AX
+	ADDQ  $16, BX
+	ADDQ  $16, CX
+	ADDQ  $16, DX
+	SUBQ  $2, BP
+	JA    loop
+	RET
+
+// func xorBlocksSSE2(out, a, b, c *block)
+TEXT ·xorBlocksSSE2(SB), 4, $0-32
+	MOVQ out+0(FP), DX
+	MOVQ a+8(FP), AX
+	MOVQ b+16(FP), BX
+	MOVQ a+24(FP), CX
+	MOVQ $128, BP
+
+loop:
+	MOVOU 0(AX), X0
+	MOVOU 0(BX), X1
+	MOVOU 0(CX), X2
+	MOVOU 0(DX), X3
+	PXOR  X1, X0
+	PXOR  X2, X0
+	PXOR  X3, X0
+	MOVOU X0, 0(DX)
+	ADDQ  $16, AX
+	ADDQ  $16, BX
+	ADDQ  $16, CX
+	ADDQ  $16, DX
+	SUBQ  $2, BP
+	JA    loop
+	RET
diff --git a/.ci/providerlint/vendor/golang.org/x/crypto/argon2/blamka_generic.go b/.ci/providerlint/vendor/golang.org/x/crypto/argon2/blamka_generic.go
new file mode 100644
index 00000000000..a481b2243f8
--- /dev/null
+++ b/.ci/providerlint/vendor/golang.org/x/crypto/argon2/blamka_generic.go
@@ -0,0 +1,163 @@
+// Copyright 2017 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package argon2
+
+var useSSE4 bool
+
+func processBlockGeneric(out, in1, in2 *block, xor bool) {
+	var t block
+	for i := range t {
+		t[i] = in1[i] ^ in2[i]
+	}
+	for i := 0; i < blockLength; i += 16 {
+		blamkaGeneric(
+			&t[i+0], &t[i+1], &t[i+2], &t[i+3],
+			&t[i+4], &t[i+5], &t[i+6], &t[i+7],
+			&t[i+8], &t[i+9], &t[i+10], &t[i+11],
+			&t[i+12], &t[i+13], &t[i+14], &t[i+15],
+		)
+	}
+	for i := 0; i < blockLength/8; i += 2 {
+		blamkaGeneric(
+			&t[i], &t[i+1], &t[16+i], &t[16+i+1],
+			&t[32+i], &t[32+i+1], &t[48+i], &t[48+i+1],
+			&t[64+i], &t[64+i+1], &t[80+i], &t[80+i+1],
+			&t[96+i], &t[96+i+1], &t[112+i], &t[112+i+1],
+		)
+	}
+	if xor {
+		for i := range t {
+			out[i] ^= in1[i] ^ in2[i] ^ t[i]
+		}
+	} else {
+		for i := range t {
+			out[i] = in1[i] ^ in2[i] ^ t[i]
+		}
+	}
+}
+
+func blamkaGeneric(t00, t01, t02, t03, t04, t05, t06, t07, t08, t09, t10, t11, t12, t13, t14, t15 *uint64) {
+	v00, v01, v02, v03 := *t00, *t01, *t02, *t03
+	v04, v05, v06, v07 := *t04, *t05, *t06, *t07
+	v08, v09, v10, v11 := *t08, *t09, *t10, *t11
+	v12, v13, v14, v15 := *t12, *t13, *t14, *t15
+
+	v00 += v04 + 2*uint64(uint32(v00))*uint64(uint32(v04))
+	v12 ^= v00
+	v12 = v12>>32 | v12<<32
+	v08 += v12 + 2*uint64(uint32(v08))*uint64(uint32(v12))
+	v04 ^= v08
+	v04 = v04>>24 | v04<<40
+
+	v00 += v04 + 2*uint64(uint32(v00))*uint64(uint32(v04))
+	v12 ^= v00
+	v12 = v12>>16 | v12<<48
+	v08 += v12 + 2*uint64(uint32(v08))*uint64(uint32(v12))
+	v04 ^= v08
+	v04 = v04>>63 | v04<<1
+
+	v01 += v05 + 2*uint64(uint32(v01))*uint64(uint32(v05))
+	v13 ^= v01
+	v13 = v13>>32 | v13<<32
+	v09 += v13 + 2*uint64(uint32(v09))*uint64(uint32(v13))
+	v05 ^= v09
+	v05 = v05>>24 | v05<<40
+
+	v01 += v05 + 2*uint64(uint32(v01))*uint64(uint32(v05))
+	v13 ^= v01
+	v13 = v13>>16 | v13<<48
+	v09 += v13 + 2*uint64(uint32(v09))*uint64(uint32(v13))
+	v05 ^= v09
+	v05 = v05>>63 | v05<<1
+
+	v02 += v06 + 2*uint64(uint32(v02))*uint64(uint32(v06))
+	v14 ^= v02
+	v14 = v14>>32 | v14<<32
+	v10 += v14 + 2*uint64(uint32(v10))*uint64(uint32(v14))
+	v06 ^= v10
+	v06 = v06>>24 | v06<<40
+
+	v02 += v06 + 2*uint64(uint32(v02))*uint64(uint32(v06))
+	v14 ^= v02
+	v14 = v14>>16 | v14<<48
+	v10 += v14 + 2*uint64(uint32(v10))*uint64(uint32(v14))
+	v06 ^= v10
+	v06 = v06>>63 | v06<<1
+
+	v03 += v07 + 2*uint64(uint32(v03))*uint64(uint32(v07))
+	v15 ^= v03
+	v15 = v15>>32 | v15<<32
+	v11 += v15 + 2*uint64(uint32(v11))*uint64(uint32(v15))
+	v07 ^= v11
+	v07 = v07>>24 | v07<<40
+
+	v03 += v07 + 2*uint64(uint32(v03))*uint64(uint32(v07))
+	v15 ^= v03
+	v15 = v15>>16 | v15<<48
+	v11 += v15 + 2*uint64(uint32(v11))*uint64(uint32(v15))
+	v07 ^= v11
+	v07 = v07>>63 | v07<<1
+
+	v00 += v05 + 2*uint64(uint32(v00))*uint64(uint32(v05))
+	v15 ^= v00
+	v15 = v15>>32 | v15<<32
+	v10 += v15 + 2*uint64(uint32(v10))*uint64(uint32(v15))
+	v05 ^= v10
+	v05 = v05>>24 | v05<<40
+
+	v00 += v05 + 2*uint64(uint32(v00))*uint64(uint32(v05))
+	v15 ^= v00
+	v15 = v15>>16 | v15<<48
+	v10 += v15 + 2*uint64(uint32(v10))*uint64(uint32(v15))
+	v05 ^= v10
+	v05 = v05>>63 | v05<<1
+
+	v01 += v06 + 2*uint64(uint32(v01))*uint64(uint32(v06))
+	v12 ^= v01
+	v12 = v12>>32 | v12<<32
+	v11 += v12 + 2*uint64(uint32(v11))*uint64(uint32(v12))
+	v06 ^= v11
+	v06 = v06>>24 | v06<<40
+
+	v01 += v06 + 2*uint64(uint32(v01))*uint64(uint32(v06))
+	v12 ^= v01
+	v12 = v12>>16 | v12<<48
+	v11 += v12 + 2*uint64(uint32(v11))*uint64(uint32(v12))
+	v06 ^= v11
+	v06 = v06>>63 | v06<<1
+
+	v02 += v07 + 2*uint64(uint32(v02))*uint64(uint32(v07))
+	v13 ^= v02
+	v13 = v13>>32 | v13<<32
+	v08 += v13 + 2*uint64(uint32(v08))*uint64(uint32(v13))
+	v07 ^= v08
+	v07 = v07>>24 | v07<<40
+
+	v02 += v07 + 2*uint64(uint32(v02))*uint64(uint32(v07))
+	v13 ^= v02
+	v13 = v13>>16 | v13<<48
+	v08 += v13 + 2*uint64(uint32(v08))*uint64(uint32(v13))
+	v07 ^= v08
+	v07 = v07>>63 | v07<<1
+
+	v03 += v04 + 2*uint64(uint32(v03))*uint64(uint32(v04))
+	v14 ^= v03
+	v14 = v14>>32 | v14<<32
+	v09 += v14 + 2*uint64(uint32(v09))*uint64(uint32(v14))
+	v04 ^= v09
+	v04 = v04>>24 | v04<<40
+
+	v03 += v04 + 2*uint64(uint32(v03))*uint64(uint32(v04))
+	v14 ^= v03
+	v14 = v14>>16 | v14<<48
+	v09 += v14 + 2*uint64(uint32(v09))*uint64(uint32(v14))
+	v04 ^= v09
+	v04 = v04>>63 | v04<<1
+
+	*t00, *t01, *t02, *t03 = v00, v01, v02, v03
+	*t04, *t05, *t06, *t07 = v04, v05, v06, v07
+	*t08, *t09, *t10, *t11 = v08, v09, v10, v11
+	*t12, *t13, *t14, *t15 = v12, v13, v14, v15
+}
diff --git a/.ci/providerlint/vendor/golang.org/x/crypto/argon2/blamka_ref.go b/.ci/providerlint/vendor/golang.org/x/crypto/argon2/blamka_ref.go
new file mode 100644
index 00000000000..167c59d2d5a
--- /dev/null
+++ b/.ci/providerlint/vendor/golang.org/x/crypto/argon2/blamka_ref.go
@@ -0,0 +1,16 @@
+// Copyright 2017 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build !amd64 || purego || !gc
+// +build !amd64 purego !gc
+
+package argon2
+
+func processBlock(out, in1, in2 *block) {
+	processBlockGeneric(out, in1, in2, false)
+}
+
+func processBlockXOR(out, in1, in2 *block) {
+	processBlockGeneric(out, in1, in2, true)
+}
diff --git a/.ci/providerlint/vendor/golang.org/x/crypto/blake2b/blake2b.go b/.ci/providerlint/vendor/golang.org/x/crypto/blake2b/blake2b.go
new file mode 100644
index 00000000000..d2e98d4295b
--- /dev/null
+++ b/.ci/providerlint/vendor/golang.org/x/crypto/blake2b/blake2b.go
@@ -0,0 +1,291 @@
+// Copyright 2016 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// Package blake2b implements the BLAKE2b hash algorithm defined by RFC 7693
+// and the extendable output function (XOF) BLAKE2Xb.
+//
+// BLAKE2b is optimized for 64-bit platforms—including NEON-enabled ARMs—and
+// produces digests of any size between 1 and 64 bytes.
+// For a detailed specification of BLAKE2b see https://blake2.net/blake2.pdf
+// and for BLAKE2Xb see https://blake2.net/blake2x.pdf
+//
+// If you aren't sure which function you need, use BLAKE2b (Sum512 or New512).
+// If you need a secret-key MAC (message authentication code), use the New512
+// function with a non-nil key.
+//
+// BLAKE2X is a construction to compute hash values larger than 64 bytes. It
+// can produce hash values between 0 and 4 GiB.
+package blake2b
+
+import (
+	"encoding/binary"
+	"errors"
+	"hash"
+)
+
+const (
+	// The blocksize of BLAKE2b in bytes.
+	BlockSize = 128
+	// The hash size of BLAKE2b-512 in bytes.
+	Size = 64
+	// The hash size of BLAKE2b-384 in bytes.
+	Size384 = 48
+	// The hash size of BLAKE2b-256 in bytes.
+	Size256 = 32
+)
+
+var (
+	useAVX2 bool
+	useAVX  bool
+	useSSE4 bool
+)
+
+var (
+	errKeySize  = errors.New("blake2b: invalid key size")
+	errHashSize = errors.New("blake2b: invalid hash size")
+)
+
+var iv = [8]uint64{
+	0x6a09e667f3bcc908, 0xbb67ae8584caa73b, 0x3c6ef372fe94f82b, 0xa54ff53a5f1d36f1,
+	0x510e527fade682d1, 0x9b05688c2b3e6c1f, 0x1f83d9abfb41bd6b, 0x5be0cd19137e2179,
+}
+
+// Sum512 returns the BLAKE2b-512 checksum of the data.
+func Sum512(data []byte) [Size]byte {
+	var sum [Size]byte
+	checkSum(&sum, Size, data)
+	return sum
+}
+
+// Sum384 returns the BLAKE2b-384 checksum of the data.
+func Sum384(data []byte) [Size384]byte {
+	var sum [Size]byte
+	var sum384 [Size384]byte
+	checkSum(&sum, Size384, data)
+	copy(sum384[:], sum[:Size384])
+	return sum384
+}
+
+// Sum256 returns the BLAKE2b-256 checksum of the data.
+func Sum256(data []byte) [Size256]byte {
+	var sum [Size]byte
+	var sum256 [Size256]byte
+	checkSum(&sum, Size256, data)
+	copy(sum256[:], sum[:Size256])
+	return sum256
+}
+
+// New512 returns a new hash.Hash computing the BLAKE2b-512 checksum. A non-nil
+// key turns the hash into a MAC. The key must be between zero and 64 bytes long.
+func New512(key []byte) (hash.Hash, error) { return newDigest(Size, key) }
+
+// New384 returns a new hash.Hash computing the BLAKE2b-384 checksum. A non-nil
+// key turns the hash into a MAC. The key must be between zero and 64 bytes long.
+func New384(key []byte) (hash.Hash, error) { return newDigest(Size384, key) }
+
+// New256 returns a new hash.Hash computing the BLAKE2b-256 checksum. A non-nil
+// key turns the hash into a MAC. The key must be between zero and 64 bytes long.
+func New256(key []byte) (hash.Hash, error) { return newDigest(Size256, key) }
+
+// New returns a new hash.Hash computing the BLAKE2b checksum with a custom length.
+// A non-nil key turns the hash into a MAC. The key must be between zero and 64 bytes long.
+// The hash size can be a value between 1 and 64 but it is highly recommended to use
+// values equal or greater than:
+// - 32 if BLAKE2b is used as a hash function (The key is zero bytes long).
+// - 16 if BLAKE2b is used as a MAC function (The key is at least 16 bytes long).
+// When the key is nil, the returned hash.Hash implements BinaryMarshaler
+// and BinaryUnmarshaler for state (de)serialization as documented by hash.Hash.
+func New(size int, key []byte) (hash.Hash, error) { return newDigest(size, key) }
+
+func newDigest(hashSize int, key []byte) (*digest, error) {
+	if hashSize < 1 || hashSize > Size {
+		return nil, errHashSize
+	}
+	if len(key) > Size {
+		return nil, errKeySize
+	}
+	d := &digest{
+		size:   hashSize,
+		keyLen: len(key),
+	}
+	copy(d.key[:], key)
+	d.Reset()
+	return d, nil
+}
+
+func checkSum(sum *[Size]byte, hashSize int, data []byte) {
+	h := iv
+	h[0] ^= uint64(hashSize) | (1 << 16) | (1 << 24)
+	var c [2]uint64
+
+	if length := len(data); length > BlockSize {
+		n := length &^ (BlockSize - 1)
+		if length == n {
+			n -= BlockSize
+		}
+		hashBlocks(&h, &c, 0, data[:n])
+		data = data[n:]
+	}
+
+	var block [BlockSize]byte
+	offset := copy(block[:], data)
+	remaining := uint64(BlockSize - offset)
+	if c[0] < remaining {
+		c[1]--
+	}
+	c[0] -= remaining
+
+	hashBlocks(&h, &c, 0xFFFFFFFFFFFFFFFF, block[:])
+
+	for i, v := range h[:(hashSize+7)/8] {
+		binary.LittleEndian.PutUint64(sum[8*i:], v)
+	}
+}
+
+type digest struct {
+	h      [8]uint64
+	c      [2]uint64
+	size   int
+	block  [BlockSize]byte
+	offset int
+
+	key    [BlockSize]byte
+	keyLen int
+}
+
+const (
+	magic         = "b2b"
+	marshaledSize = len(magic) + 8*8 + 2*8 + 1 + BlockSize + 1
+)
+
+func (d *digest) MarshalBinary() ([]byte, error) {
+	if d.keyLen != 0 {
+		return nil, errors.New("crypto/blake2b: cannot marshal MACs")
+	}
+	b := make([]byte, 0, marshaledSize)
+	b = append(b, magic...)
+	for i := 0; i < 8; i++ {
+		b = appendUint64(b, d.h[i])
+	}
+	b = appendUint64(b, d.c[0])
+	b = appendUint64(b, d.c[1])
+	// Maximum value for size is 64
+	b = append(b, byte(d.size))
+	b = append(b, d.block[:]...)
+	b = append(b, byte(d.offset))
+	return b, nil
+}
+
+func (d *digest) UnmarshalBinary(b []byte) error {
+	if len(b) < len(magic) || string(b[:len(magic)]) != magic {
+		return errors.New("crypto/blake2b: invalid hash state identifier")
+	}
+	if len(b) != marshaledSize {
+		return errors.New("crypto/blake2b: invalid hash state size")
+	}
+	b = b[len(magic):]
+	for i := 0; i < 8; i++ {
+		b, d.h[i] = consumeUint64(b)
+	}
+	b, d.c[0] = consumeUint64(b)
+	b, d.c[1] = consumeUint64(b)
+	d.size = int(b[0])
+	b = b[1:]
+	copy(d.block[:], b[:BlockSize])
+	b = b[BlockSize:]
+	d.offset = int(b[0])
+	return nil
+}
+
+func (d *digest) BlockSize() int { return BlockSize }
+
+func (d *digest) Size() int { return d.size }
+
+func (d *digest) Reset() {
+	d.h = iv
+	d.h[0] ^= uint64(d.size) | (uint64(d.keyLen) << 8) | (1 << 16) | (1 << 24)
+	d.offset, d.c[0], d.c[1] = 0, 0, 0
+	if d.keyLen > 0 {
+		d.block = d.key
+		d.offset = BlockSize
+	}
+}
+
+func (d *digest) Write(p []byte) (n int, err error) {
+	n = len(p)
+
+	if d.offset > 0 {
+		remaining := BlockSize - d.offset
+		if n <= remaining {
+			d.offset += copy(d.block[d.offset:], p)
+			return
+		}
+		copy(d.block[d.offset:], p[:remaining])
+		hashBlocks(&d.h, &d.c, 0, d.block[:])
+		d.offset = 0
+		p = p[remaining:]
+	}
+
+	if length := len(p); length > BlockSize {
+		nn := length &^ (BlockSize - 1)
+		if length == nn {
+			nn -= BlockSize
+		}
+		hashBlocks(&d.h, &d.c, 0, p[:nn])
+		p = p[nn:]
+	}
+
+	if len(p) > 0 {
+		d.offset += copy(d.block[:], p)
+	}
+
+	return
+}
+
+func (d *digest) Sum(sum []byte) []byte {
+	var hash [Size]byte
+	d.finalize(&hash)
+	return append(sum, hash[:d.size]...)
+}
+
+func (d *digest) finalize(hash *[Size]byte) {
+	var block [BlockSize]byte
+	copy(block[:], d.block[:d.offset])
+	remaining := uint64(BlockSize - d.offset)
+
+	c := d.c
+	if c[0] < remaining {
+		c[1]--
+	}
+	c[0] -= remaining
+
+	h := d.h
+	hashBlocks(&h, &c, 0xFFFFFFFFFFFFFFFF, block[:])
+
+	for i, v := range h {
+		binary.LittleEndian.PutUint64(hash[8*i:], v)
+	}
+}
+
+func appendUint64(b []byte, x uint64) []byte {
+	var a [8]byte
+	binary.BigEndian.PutUint64(a[:], x)
+	return append(b, a[:]...)
+}
+
+func appendUint32(b []byte, x uint32) []byte {
+	var a [4]byte
+	binary.BigEndian.PutUint32(a[:], x)
+	return append(b, a[:]...)
+}
+
+func consumeUint64(b []byte) ([]byte, uint64) {
+	x := binary.BigEndian.Uint64(b)
+	return b[8:], x
+}
+
+func consumeUint32(b []byte) ([]byte, uint32) {
+	x := binary.BigEndian.Uint32(b)
+	return b[4:], x
+}
diff --git a/.ci/providerlint/vendor/golang.org/x/crypto/blake2b/blake2bAVX2_amd64.go b/.ci/providerlint/vendor/golang.org/x/crypto/blake2b/blake2bAVX2_amd64.go
new file mode 100644
index 00000000000..56bfaaa17da
--- /dev/null
+++ b/.ci/providerlint/vendor/golang.org/x/crypto/blake2b/blake2bAVX2_amd64.go
@@ -0,0 +1,38 @@
+// Copyright 2016 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build go1.7 && amd64 && gc && !purego
+// +build go1.7,amd64,gc,!purego
+
+package blake2b
+
+import "golang.org/x/sys/cpu"
+
+func init() {
+	useAVX2 = cpu.X86.HasAVX2
+	useAVX = cpu.X86.HasAVX
+	useSSE4 = cpu.X86.HasSSE41
+}
+
+//go:noescape
+func hashBlocksAVX2(h *[8]uint64, c *[2]uint64, flag uint64, blocks []byte)
+
+//go:noescape
+func hashBlocksAVX(h *[8]uint64, c *[2]uint64, flag uint64, blocks []byte)
+
+//go:noescape
+func hashBlocksSSE4(h *[8]uint64, c *[2]uint64, flag uint64, blocks []byte)
+
+func hashBlocks(h *[8]uint64, c *[2]uint64, flag uint64, blocks []byte) {
+	switch {
+	case useAVX2:
+		hashBlocksAVX2(h, c, flag, blocks)
+	case useAVX:
+		hashBlocksAVX(h, c, flag, blocks)
+	case useSSE4:
+		hashBlocksSSE4(h, c, flag, blocks)
+	default:
+		hashBlocksGeneric(h, c, flag, blocks)
+	}
+}
diff --git a/.ci/providerlint/vendor/golang.org/x/crypto/blake2b/blake2bAVX2_amd64.s b/.ci/providerlint/vendor/golang.org/x/crypto/blake2b/blake2bAVX2_amd64.s
new file mode 100644
index 00000000000..4b9daa18d9d
--- /dev/null
+++ b/.ci/providerlint/vendor/golang.org/x/crypto/blake2b/blake2bAVX2_amd64.s
@@ -0,0 +1,745 @@
+// Copyright 2016 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build go1.7 && amd64 && gc && !purego
+// +build go1.7,amd64,gc,!purego
+
+#include "textflag.h"
+
+DATA ·AVX2_iv0<>+0x00(SB)/8, $0x6a09e667f3bcc908
+DATA ·AVX2_iv0<>+0x08(SB)/8, $0xbb67ae8584caa73b
+DATA ·AVX2_iv0<>+0x10(SB)/8, $0x3c6ef372fe94f82b
+DATA ·AVX2_iv0<>+0x18(SB)/8, $0xa54ff53a5f1d36f1
+GLOBL ·AVX2_iv0<>(SB), (NOPTR+RODATA), $32
+
+DATA ·AVX2_iv1<>+0x00(SB)/8, $0x510e527fade682d1
+DATA ·AVX2_iv1<>+0x08(SB)/8, $0x9b05688c2b3e6c1f
+DATA ·AVX2_iv1<>+0x10(SB)/8, $0x1f83d9abfb41bd6b
+DATA ·AVX2_iv1<>+0x18(SB)/8, $0x5be0cd19137e2179
+GLOBL ·AVX2_iv1<>(SB), (NOPTR+RODATA), $32
+
+DATA ·AVX2_c40<>+0x00(SB)/8, $0x0201000706050403
+DATA ·AVX2_c40<>+0x08(SB)/8, $0x0a09080f0e0d0c0b
+DATA ·AVX2_c40<>+0x10(SB)/8, $0x0201000706050403
+DATA ·AVX2_c40<>+0x18(SB)/8, $0x0a09080f0e0d0c0b
+GLOBL ·AVX2_c40<>(SB), (NOPTR+RODATA), $32
+
+DATA ·AVX2_c48<>+0x00(SB)/8, $0x0100070605040302
+DATA ·AVX2_c48<>+0x08(SB)/8, $0x09080f0e0d0c0b0a
+DATA ·AVX2_c48<>+0x10(SB)/8, $0x0100070605040302
+DATA ·AVX2_c48<>+0x18(SB)/8, $0x09080f0e0d0c0b0a
+GLOBL ·AVX2_c48<>(SB), (NOPTR+RODATA), $32
+
+DATA ·AVX_iv0<>+0x00(SB)/8, $0x6a09e667f3bcc908
+DATA ·AVX_iv0<>+0x08(SB)/8, $0xbb67ae8584caa73b
+GLOBL ·AVX_iv0<>(SB), (NOPTR+RODATA), $16
+
+DATA ·AVX_iv1<>+0x00(SB)/8, $0x3c6ef372fe94f82b
+DATA ·AVX_iv1<>+0x08(SB)/8, $0xa54ff53a5f1d36f1
+GLOBL ·AVX_iv1<>(SB), (NOPTR+RODATA), $16
+
+DATA ·AVX_iv2<>+0x00(SB)/8, $0x510e527fade682d1
+DATA ·AVX_iv2<>+0x08(SB)/8, $0x9b05688c2b3e6c1f
+GLOBL ·AVX_iv2<>(SB), (NOPTR+RODATA), $16
+
+DATA ·AVX_iv3<>+0x00(SB)/8, $0x1f83d9abfb41bd6b
+DATA ·AVX_iv3<>+0x08(SB)/8, $0x5be0cd19137e2179
+GLOBL ·AVX_iv3<>(SB), (NOPTR+RODATA), $16
+
+DATA ·AVX_c40<>+0x00(SB)/8, $0x0201000706050403
+DATA ·AVX_c40<>+0x08(SB)/8, $0x0a09080f0e0d0c0b
+GLOBL ·AVX_c40<>(SB), (NOPTR+RODATA), $16
+
+DATA ·AVX_c48<>+0x00(SB)/8, $0x0100070605040302
+DATA ·AVX_c48<>+0x08(SB)/8, $0x09080f0e0d0c0b0a
+GLOBL ·AVX_c48<>(SB), (NOPTR+RODATA), $16
+
+#define VPERMQ_0x39_Y1_Y1 BYTE $0xc4; BYTE $0xe3; BYTE $0xfd; BYTE $0x00; BYTE $0xc9; BYTE $0x39
+#define VPERMQ_0x93_Y1_Y1 BYTE $0xc4; BYTE $0xe3; BYTE $0xfd; BYTE $0x00; BYTE $0xc9; BYTE $0x93
+#define VPERMQ_0x4E_Y2_Y2 BYTE $0xc4; BYTE $0xe3; BYTE $0xfd; BYTE $0x00; BYTE $0xd2; BYTE $0x4e
+#define VPERMQ_0x93_Y3_Y3 BYTE $0xc4; BYTE $0xe3; BYTE $0xfd; BYTE $0x00; BYTE $0xdb; BYTE $0x93
+#define VPERMQ_0x39_Y3_Y3 BYTE $0xc4; BYTE $0xe3; BYTE $0xfd; BYTE $0x00; BYTE $0xdb; BYTE $0x39
+
+#define ROUND_AVX2(m0, m1, m2, m3, t, c40, c48) \
+	VPADDQ  m0, Y0, Y0;   \
+	VPADDQ  Y1, Y0, Y0;   \
+	VPXOR   Y0, Y3, Y3;   \
+	VPSHUFD $-79, Y3, Y3; \
+	VPADDQ  Y3, Y2, Y2;   \
+	VPXOR   Y2, Y1, Y1;   \
+	VPSHUFB c40, Y1, Y1;  \
+	VPADDQ  m1, Y0, Y0;   \
+	VPADDQ  Y1, Y0, Y0;   \
+	VPXOR   Y0, Y3, Y3;   \
+	VPSHUFB c48, Y3, Y3;  \
+	VPADDQ  Y3, Y2, Y2;   \
+	VPXOR   Y2, Y1, Y1;   \
+	VPADDQ  Y1, Y1, t;    \
+	VPSRLQ  $63, Y1, Y1;  \
+	VPXOR   t, Y1, Y1;    \
+	VPERMQ_0x39_Y1_Y1;    \
+	VPERMQ_0x4E_Y2_Y2;    \
+	VPERMQ_0x93_Y3_Y3;    \
+	VPADDQ  m2, Y0, Y0;   \
+	VPADDQ  Y1, Y0, Y0;   \
+	VPXOR   Y0, Y3, Y3;   \
+	VPSHUFD $-79, Y3, Y3; \
+	VPADDQ  Y3, Y2, Y2;   \
+	VPXOR   Y2, Y1, Y1;   \
+	VPSHUFB c40, Y1, Y1;  \
+	VPADDQ  m3, Y0, Y0;   \
+	VPADDQ  Y1, Y0, Y0;   \
+	VPXOR   Y0, Y3, Y3;   \
+	VPSHUFB c48, Y3, Y3;  \
+	VPADDQ  Y3, Y2, Y2;   \
+	VPXOR   Y2, Y1, Y1;   \
+	VPADDQ  Y1, Y1, t;    \
+	VPSRLQ  $63, Y1, Y1;  \
+	VPXOR   t, Y1, Y1;    \
+	VPERMQ_0x39_Y3_Y3;    \
+	VPERMQ_0x4E_Y2_Y2;    \
+	VPERMQ_0x93_Y1_Y1
+
+#define VMOVQ_SI_X11_0 BYTE $0xC5; BYTE $0x7A; BYTE $0x7E; BYTE $0x1E
+#define VMOVQ_SI_X12_0 BYTE $0xC5; BYTE $0x7A; BYTE $0x7E; BYTE $0x26
+#define VMOVQ_SI_X13_0 BYTE $0xC5; BYTE $0x7A; BYTE $0x7E; BYTE $0x2E
+#define VMOVQ_SI_X14_0 BYTE $0xC5; BYTE $0x7A; BYTE $0x7E; BYTE $0x36
+#define VMOVQ_SI_X15_0 BYTE $0xC5; BYTE $0x7A; BYTE $0x7E; BYTE $0x3E
+
+#define VMOVQ_SI_X11(n) BYTE $0xC5; BYTE $0x7A; BYTE $0x7E; BYTE $0x5E; BYTE $n
+#define VMOVQ_SI_X12(n) BYTE $0xC5; BYTE $0x7A; BYTE $0x7E; BYTE $0x66; BYTE $n
+#define VMOVQ_SI_X13(n) BYTE $0xC5; BYTE $0x7A; BYTE $0x7E; BYTE $0x6E; BYTE $n
+#define VMOVQ_SI_X14(n) BYTE $0xC5; BYTE $0x7A; BYTE $0x7E; BYTE $0x76; BYTE $n
+#define VMOVQ_SI_X15(n) BYTE $0xC5; BYTE $0x7A; BYTE $0x7E; BYTE $0x7E; BYTE $n
+
+#define VPINSRQ_1_SI_X11_0 BYTE $0xC4; BYTE $0x63; BYTE $0xA1; BYTE $0x22; BYTE $0x1E; BYTE $0x01
+#define VPINSRQ_1_SI_X12_0 BYTE $0xC4; BYTE $0x63; BYTE $0x99; BYTE $0x22; BYTE $0x26; BYTE $0x01
+#define VPINSRQ_1_SI_X13_0 BYTE $0xC4; BYTE $0x63; BYTE $0x91; BYTE $0x22; BYTE $0x2E; BYTE $0x01
+#define VPINSRQ_1_SI_X14_0 BYTE $0xC4; BYTE $0x63; BYTE $0x89; BYTE $0x22; BYTE $0x36; BYTE $0x01
+#define VPINSRQ_1_SI_X15_0 BYTE $0xC4; BYTE $0x63; BYTE $0x81; BYTE $0x22; BYTE $0x3E; BYTE $0x01
+
+#define VPINSRQ_1_SI_X11(n) BYTE $0xC4; BYTE $0x63; BYTE $0xA1; BYTE $0x22; BYTE $0x5E; BYTE $n; BYTE $0x01
+#define VPINSRQ_1_SI_X12(n) BYTE $0xC4; BYTE $0x63; BYTE $0x99; BYTE $0x22; BYTE $0x66; BYTE $n; BYTE $0x01
+#define VPINSRQ_1_SI_X13(n) BYTE $0xC4; BYTE $0x63; BYTE $0x91; BYTE $0x22; BYTE $0x6E; BYTE $n; BYTE $0x01
+#define VPINSRQ_1_SI_X14(n) BYTE $0xC4; BYTE $0x63; BYTE $0x89; BYTE $0x22; BYTE $0x76; BYTE $n; BYTE $0x01
+#define VPINSRQ_1_SI_X15(n) BYTE $0xC4; BYTE $0x63; BYTE $0x81; BYTE $0x22; BYTE $0x7E; BYTE $n; BYTE $0x01
+
+#define VMOVQ_R8_X15 BYTE $0xC4; BYTE $0x41; BYTE $0xF9; BYTE $0x6E; BYTE $0xF8
+#define VPINSRQ_1_R9_X15 BYTE $0xC4; BYTE $0x43; BYTE $0x81; BYTE $0x22; BYTE $0xF9; BYTE $0x01
+
+// load msg: Y12 = (i0, i1, i2, i3)
+// i0, i1, i2, i3 must not be 0
+#define LOAD_MSG_AVX2_Y12(i0, i1, i2, i3) \
+	VMOVQ_SI_X12(i0*8);           \
+	VMOVQ_SI_X11(i2*8);           \
+	VPINSRQ_1_SI_X12(i1*8);       \
+	VPINSRQ_1_SI_X11(i3*8);       \
+	VINSERTI128 $1, X11, Y12, Y12
+
+// load msg: Y13 = (i0, i1, i2, i3)
+// i0, i1, i2, i3 must not be 0
+#define LOAD_MSG_AVX2_Y13(i0, i1, i2, i3) \
+	VMOVQ_SI_X13(i0*8);           \
+	VMOVQ_SI_X11(i2*8);           \
+	VPINSRQ_1_SI_X13(i1*8);       \
+	VPINSRQ_1_SI_X11(i3*8);       \
+	VINSERTI128 $1, X11, Y13, Y13
+
+// load msg: Y14 = (i0, i1, i2, i3)
+// i0, i1, i2, i3 must not be 0
+#define LOAD_MSG_AVX2_Y14(i0, i1, i2, i3) \
+	VMOVQ_SI_X14(i0*8);           \
+	VMOVQ_SI_X11(i2*8);           \
+	VPINSRQ_1_SI_X14(i1*8);       \
+	VPINSRQ_1_SI_X11(i3*8);       \
+	VINSERTI128 $1, X11, Y14, Y14
+
+// load msg: Y15 = (i0, i1, i2, i3)
+// i0, i1, i2, i3 must not be 0
+#define LOAD_MSG_AVX2_Y15(i0, i1, i2, i3) \
+	VMOVQ_SI_X15(i0*8);           \
+	VMOVQ_SI_X11(i2*8);           \
+	VPINSRQ_1_SI_X15(i1*8);       \
+	VPINSRQ_1_SI_X11(i3*8);       \
+	VINSERTI128 $1, X11, Y15, Y15
+
+#define LOAD_MSG_AVX2_0_2_4_6_1_3_5_7_8_10_12_14_9_11_13_15() \
+	VMOVQ_SI_X12_0;                   \
+	VMOVQ_SI_X11(4*8);                \
+	VPINSRQ_1_SI_X12(2*8);            \
+	VPINSRQ_1_SI_X11(6*8);            \
+	VINSERTI128 $1, X11, Y12, Y12;    \
+	LOAD_MSG_AVX2_Y13(1, 3, 5, 7);    \
+	LOAD_MSG_AVX2_Y14(8, 10, 12, 14); \
+	LOAD_MSG_AVX2_Y15(9, 11, 13, 15)
+
+#define LOAD_MSG_AVX2_14_4_9_13_10_8_15_6_1_0_11_5_12_2_7_3() \
+	LOAD_MSG_AVX2_Y12(14, 4, 9, 13); \
+	LOAD_MSG_AVX2_Y13(10, 8, 15, 6); \
+	VMOVQ_SI_X11(11*8);              \
+	VPSHUFD     $0x4E, 0*8(SI), X14; \
+	VPINSRQ_1_SI_X11(5*8);           \
+	VINSERTI128 $1, X11, Y14, Y14;   \
+	LOAD_MSG_AVX2_Y15(12, 2, 7, 3)
+
+#define LOAD_MSG_AVX2_11_12_5_15_8_0_2_13_10_3_7_9_14_6_1_4() \
+	VMOVQ_SI_X11(5*8);              \
+	VMOVDQU     11*8(SI), X12;      \
+	VPINSRQ_1_SI_X11(15*8);         \
+	VINSERTI128 $1, X11, Y12, Y12;  \
+	VMOVQ_SI_X13(8*8);              \
+	VMOVQ_SI_X11(2*8);              \
+	VPINSRQ_1_SI_X13_0;             \
+	VPINSRQ_1_SI_X11(13*8);         \
+	VINSERTI128 $1, X11, Y13, Y13;  \
+	LOAD_MSG_AVX2_Y14(10, 3, 7, 9); \
+	LOAD_MSG_AVX2_Y15(14, 6, 1, 4)
+
+#define LOAD_MSG_AVX2_7_3_13_11_9_1_12_14_2_5_4_15_6_10_0_8() \
+	LOAD_MSG_AVX2_Y12(7, 3, 13, 11); \
+	LOAD_MSG_AVX2_Y13(9, 1, 12, 14); \
+	LOAD_MSG_AVX2_Y14(2, 5, 4, 15);  \
+	VMOVQ_SI_X15(6*8);               \
+	VMOVQ_SI_X11_0;                  \
+	VPINSRQ_1_SI_X15(10*8);          \
+	VPINSRQ_1_SI_X11(8*8);           \
+	VINSERTI128 $1, X11, Y15, Y15
+
+#define LOAD_MSG_AVX2_9_5_2_10_0_7_4_15_14_11_6_3_1_12_8_13() \
+	LOAD_MSG_AVX2_Y12(9, 5, 2, 10);  \
+	VMOVQ_SI_X13_0;                  \
+	VMOVQ_SI_X11(4*8);               \
+	VPINSRQ_1_SI_X13(7*8);           \
+	VPINSRQ_1_SI_X11(15*8);          \
+	VINSERTI128 $1, X11, Y13, Y13;   \
+	LOAD_MSG_AVX2_Y14(14, 11, 6, 3); \
+	LOAD_MSG_AVX2_Y15(1, 12, 8, 13)
+
+#define LOAD_MSG_AVX2_2_6_0_8_12_10_11_3_4_7_15_1_13_5_14_9() \
+	VMOVQ_SI_X12(2*8);                \
+	VMOVQ_SI_X11_0;                   \
+	VPINSRQ_1_SI_X12(6*8);            \
+	VPINSRQ_1_SI_X11(8*8);            \
+	VINSERTI128 $1, X11, Y12, Y12;    \
+	LOAD_MSG_AVX2_Y13(12, 10, 11, 3); \
+	LOAD_MSG_AVX2_Y14(4, 7, 15, 1);   \
+	LOAD_MSG_AVX2_Y15(13, 5, 14, 9)
+
+#define LOAD_MSG_AVX2_12_1_14_4_5_15_13_10_0_6_9_8_7_3_2_11() \
+	LOAD_MSG_AVX2_Y12(12, 1, 14, 4);  \
+	LOAD_MSG_AVX2_Y13(5, 15, 13, 10); \
+	VMOVQ_SI_X14_0;                   \
+	VPSHUFD     $0x4E, 8*8(SI), X11;  \
+	VPINSRQ_1_SI_X14(6*8);            \
+	VINSERTI128 $1, X11, Y14, Y14;    \
+	LOAD_MSG_AVX2_Y15(7, 3, 2, 11)
+
+#define LOAD_MSG_AVX2_13_7_12_3_11_14_1_9_5_15_8_2_0_4_6_10() \
+	LOAD_MSG_AVX2_Y12(13, 7, 12, 3); \
+	LOAD_MSG_AVX2_Y13(11, 14, 1, 9); \
+	LOAD_MSG_AVX2_Y14(5, 15, 8, 2);  \
+	VMOVQ_SI_X15_0;                  \
+	VMOVQ_SI_X11(6*8);               \
+	VPINSRQ_1_SI_X15(4*8);           \
+	VPINSRQ_1_SI_X11(10*8);          \
+	VINSERTI128 $1, X11, Y15, Y15
+
+#define LOAD_MSG_AVX2_6_14_11_0_15_9_3_8_12_13_1_10_2_7_4_5() \
+	VMOVQ_SI_X12(6*8);              \
+	VMOVQ_SI_X11(11*8);             \
+	VPINSRQ_1_SI_X12(14*8);         \
+	VPINSRQ_1_SI_X11_0;             \
+	VINSERTI128 $1, X11, Y12, Y12;  \
+	LOAD_MSG_AVX2_Y13(15, 9, 3, 8); \
+	VMOVQ_SI_X11(1*8);              \
+	VMOVDQU     12*8(SI), X14;      \
+	VPINSRQ_1_SI_X11(10*8);         \
+	VINSERTI128 $1, X11, Y14, Y14;  \
+	VMOVQ_SI_X15(2*8);              \
+	VMOVDQU     4*8(SI), X11;       \
+	VPINSRQ_1_SI_X15(7*8);          \
+	VINSERTI128 $1, X11, Y15, Y15
+
+#define LOAD_MSG_AVX2_10_8_7_1_2_4_6_5_15_9_3_13_11_14_12_0() \
+	LOAD_MSG_AVX2_Y12(10, 8, 7, 1);  \
+	VMOVQ_SI_X13(2*8);               \
+	VPSHUFD     $0x4E, 5*8(SI), X11; \
+	VPINSRQ_1_SI_X13(4*8);           \
+	VINSERTI128 $1, X11, Y13, Y13;   \
+	LOAD_MSG_AVX2_Y14(15, 9, 3, 13); \
+	VMOVQ_SI_X15(11*8);              \
+	VMOVQ_SI_X11(12*8);              \
+	VPINSRQ_1_SI_X15(14*8);          \
+	VPINSRQ_1_SI_X11_0;              \
+	VINSERTI128 $1, X11, Y15, Y15
+
+// func hashBlocksAVX2(h *[8]uint64, c *[2]uint64, flag uint64, blocks []byte)
+TEXT ·hashBlocksAVX2(SB), 4, $320-48 // frame size = 288 + 32 byte alignment
+	MOVQ h+0(FP), AX
+	MOVQ c+8(FP), BX
+	MOVQ flag+16(FP), CX
+	MOVQ blocks_base+24(FP), SI
+	MOVQ blocks_len+32(FP), DI
+
+	MOVQ SP, DX
+	ADDQ $31, DX
+	ANDQ $~31, DX
+
+	MOVQ CX, 16(DX)
+	XORQ CX, CX
+	MOVQ CX, 24(DX)
+
+	VMOVDQU ·AVX2_c40<>(SB), Y4
+	VMOVDQU ·AVX2_c48<>(SB), Y5
+
+	VMOVDQU 0(AX), Y8
+	VMOVDQU 32(AX), Y9
+	VMOVDQU ·AVX2_iv0<>(SB), Y6
+	VMOVDQU ·AVX2_iv1<>(SB), Y7
+
+	MOVQ 0(BX), R8
+	MOVQ 8(BX), R9
+	MOVQ R9, 8(DX)
+
+loop:
+	ADDQ $128, R8
+	MOVQ R8, 0(DX)
+	CMPQ R8, $128
+	JGE  noinc
+	INCQ R9
+	MOVQ R9, 8(DX)
+
+noinc:
+	VMOVDQA Y8, Y0
+	VMOVDQA Y9, Y1
+	VMOVDQA Y6, Y2
+	VPXOR   0(DX), Y7, Y3
+
+	LOAD_MSG_AVX2_0_2_4_6_1_3_5_7_8_10_12_14_9_11_13_15()
+	VMOVDQA Y12, 32(DX)
+	VMOVDQA Y13, 64(DX)
+	VMOVDQA Y14, 96(DX)
+	VMOVDQA Y15, 128(DX)
+	ROUND_AVX2(Y12, Y13, Y14, Y15, Y10, Y4, Y5)
+	LOAD_MSG_AVX2_14_4_9_13_10_8_15_6_1_0_11_5_12_2_7_3()
+	VMOVDQA Y12, 160(DX)
+	VMOVDQA Y13, 192(DX)
+	VMOVDQA Y14, 224(DX)
+	VMOVDQA Y15, 256(DX)
+
+	ROUND_AVX2(Y12, Y13, Y14, Y15, Y10, Y4, Y5)
+	LOAD_MSG_AVX2_11_12_5_15_8_0_2_13_10_3_7_9_14_6_1_4()
+	ROUND_AVX2(Y12, Y13, Y14, Y15, Y10, Y4, Y5)
+	LOAD_MSG_AVX2_7_3_13_11_9_1_12_14_2_5_4_15_6_10_0_8()
+	ROUND_AVX2(Y12, Y13, Y14, Y15, Y10, Y4, Y5)
+	LOAD_MSG_AVX2_9_5_2_10_0_7_4_15_14_11_6_3_1_12_8_13()
+	ROUND_AVX2(Y12, Y13, Y14, Y15, Y10, Y4, Y5)
+	LOAD_MSG_AVX2_2_6_0_8_12_10_11_3_4_7_15_1_13_5_14_9()
+	ROUND_AVX2(Y12, Y13, Y14, Y15, Y10, Y4, Y5)
+	LOAD_MSG_AVX2_12_1_14_4_5_15_13_10_0_6_9_8_7_3_2_11()
+	ROUND_AVX2(Y12, Y13, Y14, Y15, Y10, Y4, Y5)
+	LOAD_MSG_AVX2_13_7_12_3_11_14_1_9_5_15_8_2_0_4_6_10()
+	ROUND_AVX2(Y12, Y13, Y14, Y15, Y10, Y4, Y5)
+	LOAD_MSG_AVX2_6_14_11_0_15_9_3_8_12_13_1_10_2_7_4_5()
+	ROUND_AVX2(Y12, Y13, Y14, Y15, Y10, Y4, Y5)
+	LOAD_MSG_AVX2_10_8_7_1_2_4_6_5_15_9_3_13_11_14_12_0()
+	ROUND_AVX2(Y12, Y13, Y14, Y15, Y10, Y4, Y5)
+
+	ROUND_AVX2(32(DX), 64(DX), 96(DX), 128(DX), Y10, Y4, Y5)
+	ROUND_AVX2(160(DX), 192(DX), 224(DX), 256(DX), Y10, Y4, Y5)
+
+	VPXOR Y0, Y8, Y8
+	VPXOR Y1, Y9, Y9
+	VPXOR Y2, Y8, Y8
+	VPXOR Y3, Y9, Y9
+
+	LEAQ 128(SI), SI
+	SUBQ $128, DI
+	JNE  loop
+
+	MOVQ R8, 0(BX)
+	MOVQ R9, 8(BX)
+
+	VMOVDQU Y8, 0(AX)
+	VMOVDQU Y9, 32(AX)
+	VZEROUPPER
+
+	RET
+
+#define VPUNPCKLQDQ_X2_X2_X15 BYTE $0xC5; BYTE $0x69; BYTE $0x6C; BYTE $0xFA
+#define VPUNPCKLQDQ_X3_X3_X15 BYTE $0xC5; BYTE $0x61; BYTE $0x6C; BYTE $0xFB
+#define VPUNPCKLQDQ_X7_X7_X15 BYTE $0xC5; BYTE $0x41; BYTE $0x6C; BYTE $0xFF
+#define VPUNPCKLQDQ_X13_X13_X15 BYTE $0xC4; BYTE $0x41; BYTE $0x11; BYTE $0x6C; BYTE $0xFD
+#define VPUNPCKLQDQ_X14_X14_X15 BYTE $0xC4; BYTE $0x41; BYTE $0x09; BYTE $0x6C; BYTE $0xFE
+
+#define VPUNPCKHQDQ_X15_X2_X2 BYTE $0xC4; BYTE $0xC1; BYTE $0x69; BYTE $0x6D; BYTE $0xD7
+#define VPUNPCKHQDQ_X15_X3_X3 BYTE $0xC4; BYTE $0xC1; BYTE $0x61; BYTE $0x6D; BYTE $0xDF
+#define VPUNPCKHQDQ_X15_X6_X6 BYTE $0xC4; BYTE $0xC1; BYTE $0x49; BYTE $0x6D; BYTE $0xF7
+#define VPUNPCKHQDQ_X15_X7_X7 BYTE $0xC4; BYTE $0xC1; BYTE $0x41; BYTE $0x6D; BYTE $0xFF
+#define VPUNPCKHQDQ_X15_X3_X2 BYTE $0xC4; BYTE $0xC1; BYTE $0x61; BYTE $0x6D; BYTE $0xD7
+#define VPUNPCKHQDQ_X15_X7_X6 BYTE $0xC4; BYTE $0xC1; BYTE $0x41; BYTE $0x6D; BYTE $0xF7
+#define VPUNPCKHQDQ_X15_X13_X3 BYTE $0xC4; BYTE $0xC1; BYTE $0x11; BYTE $0x6D; BYTE $0xDF
+#define VPUNPCKHQDQ_X15_X13_X7 BYTE $0xC4; BYTE $0xC1; BYTE $0x11; BYTE $0x6D; BYTE $0xFF
+
+#define SHUFFLE_AVX() \
+	VMOVDQA X6, X13;         \
+	VMOVDQA X2, X14;         \
+	VMOVDQA X4, X6;          \
+	VPUNPCKLQDQ_X13_X13_X15; \
+	VMOVDQA X5, X4;          \
+	VMOVDQA X6, X5;          \
+	VPUNPCKHQDQ_X15_X7_X6;   \
+	VPUNPCKLQDQ_X7_X7_X15;   \
+	VPUNPCKHQDQ_X15_X13_X7;  \
+	VPUNPCKLQDQ_X3_X3_X15;   \
+	VPUNPCKHQDQ_X15_X2_X2;   \
+	VPUNPCKLQDQ_X14_X14_X15; \
+	VPUNPCKHQDQ_X15_X3_X3;   \
+
+#define SHUFFLE_AVX_INV() \
+	VMOVDQA X2, X13;         \
+	VMOVDQA X4, X14;         \
+	VPUNPCKLQDQ_X2_X2_X15;   \
+	VMOVDQA X5, X4;          \
+	VPUNPCKHQDQ_X15_X3_X2;   \
+	VMOVDQA X14, X5;         \
+	VPUNPCKLQDQ_X3_X3_X15;   \
+	VMOVDQA X6, X14;         \
+	VPUNPCKHQDQ_X15_X13_X3;  \
+	VPUNPCKLQDQ_X7_X7_X15;   \
+	VPUNPCKHQDQ_X15_X6_X6;   \
+	VPUNPCKLQDQ_X14_X14_X15; \
+	VPUNPCKHQDQ_X15_X7_X7;   \
+
+#define HALF_ROUND_AVX(v0, v1, v2, v3, v4, v5, v6, v7, m0, m1, m2, m3, t0, c40, c48) \
+	VPADDQ  m0, v0, v0;   \
+	VPADDQ  v2, v0, v0;   \
+	VPADDQ  m1, v1, v1;   \
+	VPADDQ  v3, v1, v1;   \
+	VPXOR   v0, v6, v6;   \
+	VPXOR   v1, v7, v7;   \
+	VPSHUFD $-79, v6, v6; \
+	VPSHUFD $-79, v7, v7; \
+	VPADDQ  v6, v4, v4;   \
+	VPADDQ  v7, v5, v5;   \
+	VPXOR   v4, v2, v2;   \
+	VPXOR   v5, v3, v3;   \
+	VPSHUFB c40, v2, v2;  \
+	VPSHUFB c40, v3, v3;  \
+	VPADDQ  m2, v0, v0;   \
+	VPADDQ  v2, v0, v0;   \
+	VPADDQ  m3, v1, v1;   \
+	VPADDQ  v3, v1, v1;   \
+	VPXOR   v0, v6, v6;   \
+	VPXOR   v1, v7, v7;   \
+	VPSHUFB c48, v6, v6;  \
+	VPSHUFB c48, v7, v7;  \
+	VPADDQ  v6, v4, v4;   \
+	VPADDQ  v7, v5, v5;   \
+	VPXOR   v4, v2, v2;   \
+	VPXOR   v5, v3, v3;   \
+	VPADDQ  v2, v2, t0;   \
+	VPSRLQ  $63, v2, v2;  \
+	VPXOR   t0, v2, v2;   \
+	VPADDQ  v3, v3, t0;   \
+	VPSRLQ  $63, v3, v3;  \
+	VPXOR   t0, v3, v3
+
+// load msg: X12 = (i0, i1), X13 = (i2, i3), X14 = (i4, i5), X15 = (i6, i7)
+// i0, i1, i2, i3, i4, i5, i6, i7 must not be 0
+#define LOAD_MSG_AVX(i0, i1, i2, i3, i4, i5, i6, i7) \
+	VMOVQ_SI_X12(i0*8);     \
+	VMOVQ_SI_X13(i2*8);     \
+	VMOVQ_SI_X14(i4*8);     \
+	VMOVQ_SI_X15(i6*8);     \
+	VPINSRQ_1_SI_X12(i1*8); \
+	VPINSRQ_1_SI_X13(i3*8); \
+	VPINSRQ_1_SI_X14(i5*8); \
+	VPINSRQ_1_SI_X15(i7*8)
+
+// load msg: X12 = (0, 2), X13 = (4, 6), X14 = (1, 3), X15 = (5, 7)
+#define LOAD_MSG_AVX_0_2_4_6_1_3_5_7() \
+	VMOVQ_SI_X12_0;        \
+	VMOVQ_SI_X13(4*8);     \
+	VMOVQ_SI_X14(1*8);     \
+	VMOVQ_SI_X15(5*8);     \
+	VPINSRQ_1_SI_X12(2*8); \
+	VPINSRQ_1_SI_X13(6*8); \
+	VPINSRQ_1_SI_X14(3*8); \
+	VPINSRQ_1_SI_X15(7*8)
+
+// load msg: X12 = (1, 0), X13 = (11, 5), X14 = (12, 2), X15 = (7, 3)
+#define LOAD_MSG_AVX_1_0_11_5_12_2_7_3() \
+	VPSHUFD $0x4E, 0*8(SI), X12; \
+	VMOVQ_SI_X13(11*8);          \
+	VMOVQ_SI_X14(12*8);          \
+	VMOVQ_SI_X15(7*8);           \
+	VPINSRQ_1_SI_X13(5*8);       \
+	VPINSRQ_1_SI_X14(2*8);       \
+	VPINSRQ_1_SI_X15(3*8)
+
+// load msg: X12 = (11, 12), X13 = (5, 15), X14 = (8, 0), X15 = (2, 13)
+#define LOAD_MSG_AVX_11_12_5_15_8_0_2_13() \
+	VMOVDQU 11*8(SI), X12;  \
+	VMOVQ_SI_X13(5*8);      \
+	VMOVQ_SI_X14(8*8);      \
+	VMOVQ_SI_X15(2*8);      \
+	VPINSRQ_1_SI_X13(15*8); \
+	VPINSRQ_1_SI_X14_0;     \
+	VPINSRQ_1_SI_X15(13*8)
+
+// load msg: X12 = (2, 5), X13 = (4, 15), X14 = (6, 10), X15 = (0, 8)
+#define LOAD_MSG_AVX_2_5_4_15_6_10_0_8() \
+	VMOVQ_SI_X12(2*8);      \
+	VMOVQ_SI_X13(4*8);      \
+	VMOVQ_SI_X14(6*8);      \
+	VMOVQ_SI_X15_0;         \
+	VPINSRQ_1_SI_X12(5*8);  \
+	VPINSRQ_1_SI_X13(15*8); \
+	VPINSRQ_1_SI_X14(10*8); \
+	VPINSRQ_1_SI_X15(8*8)
+
+// load msg: X12 = (9, 5), X13 = (2, 10), X14 = (0, 7), X15 = (4, 15)
+#define LOAD_MSG_AVX_9_5_2_10_0_7_4_15() \
+	VMOVQ_SI_X12(9*8);      \
+	VMOVQ_SI_X13(2*8);      \
+	VMOVQ_SI_X14_0;         \
+	VMOVQ_SI_X15(4*8);      \
+	VPINSRQ_1_SI_X12(5*8);  \
+	VPINSRQ_1_SI_X13(10*8); \
+	VPINSRQ_1_SI_X14(7*8);  \
+	VPINSRQ_1_SI_X15(15*8)
+
+// load msg: X12 = (2, 6), X13 = (0, 8), X14 = (12, 10), X15 = (11, 3)
+#define LOAD_MSG_AVX_2_6_0_8_12_10_11_3() \
+	VMOVQ_SI_X12(2*8);      \
+	VMOVQ_SI_X13_0;         \
+	VMOVQ_SI_X14(12*8);     \
+	VMOVQ_SI_X15(11*8);     \
+	VPINSRQ_1_SI_X12(6*8);  \
+	VPINSRQ_1_SI_X13(8*8);  \
+	VPINSRQ_1_SI_X14(10*8); \
+	VPINSRQ_1_SI_X15(3*8)
+
+// load msg: X12 = (0, 6), X13 = (9, 8), X14 = (7, 3), X15 = (2, 11)
+#define LOAD_MSG_AVX_0_6_9_8_7_3_2_11() \
+	MOVQ    0*8(SI), X12;        \
+	VPSHUFD $0x4E, 8*8(SI), X13; \
+	MOVQ    7*8(SI), X14;        \
+	MOVQ    2*8(SI), X15;        \
+	VPINSRQ_1_SI_X12(6*8);       \
+	VPINSRQ_1_SI_X14(3*8);       \
+	VPINSRQ_1_SI_X15(11*8)
+
+// load msg: X12 = (6, 14), X13 = (11, 0), X14 = (15, 9), X15 = (3, 8)
+#define LOAD_MSG_AVX_6_14_11_0_15_9_3_8() \
+	MOVQ 6*8(SI), X12;      \
+	MOVQ 11*8(SI), X13;     \
+	MOVQ 15*8(SI), X14;     \
+	MOVQ 3*8(SI), X15;      \
+	VPINSRQ_1_SI_X12(14*8); \
+	VPINSRQ_1_SI_X13_0;     \
+	VPINSRQ_1_SI_X14(9*8);  \
+	VPINSRQ_1_SI_X15(8*8)
+
+// load msg: X12 = (5, 15), X13 = (8, 2), X14 = (0, 4), X15 = (6, 10)
+#define LOAD_MSG_AVX_5_15_8_2_0_4_6_10() \
+	MOVQ 5*8(SI), X12;      \
+	MOVQ 8*8(SI), X13;      \
+	MOVQ 0*8(SI), X14;      \
+	MOVQ 6*8(SI), X15;      \
+	VPINSRQ_1_SI_X12(15*8); \
+	VPINSRQ_1_SI_X13(2*8);  \
+	VPINSRQ_1_SI_X14(4*8);  \
+	VPINSRQ_1_SI_X15(10*8)
+
+// load msg: X12 = (12, 13), X13 = (1, 10), X14 = (2, 7), X15 = (4, 5)
+#define LOAD_MSG_AVX_12_13_1_10_2_7_4_5() \
+	VMOVDQU 12*8(SI), X12;  \
+	MOVQ    1*8(SI), X13;   \
+	MOVQ    2*8(SI), X14;   \
+	VPINSRQ_1_SI_X13(10*8); \
+	VPINSRQ_1_SI_X14(7*8);  \
+	VMOVDQU 4*8(SI), X15
+
+// load msg: X12 = (15, 9), X13 = (3, 13), X14 = (11, 14), X15 = (12, 0)
+#define LOAD_MSG_AVX_15_9_3_13_11_14_12_0() \
+	MOVQ 15*8(SI), X12;     \
+	MOVQ 3*8(SI), X13;      \
+	MOVQ 11*8(SI), X14;     \
+	MOVQ 12*8(SI), X15;     \
+	VPINSRQ_1_SI_X12(9*8);  \
+	VPINSRQ_1_SI_X13(13*8); \
+	VPINSRQ_1_SI_X14(14*8); \
+	VPINSRQ_1_SI_X15_0
+
+// func hashBlocksAVX(h *[8]uint64, c *[2]uint64, flag uint64, blocks []byte)
+TEXT ·hashBlocksAVX(SB), 4, $288-48 // frame size = 272 + 16 byte alignment
+	MOVQ h+0(FP), AX
+	MOVQ c+8(FP), BX
+	MOVQ flag+16(FP), CX
+	MOVQ blocks_base+24(FP), SI
+	MOVQ blocks_len+32(FP), DI
+
+	MOVQ SP, R10
+	ADDQ $15, R10
+	ANDQ $~15, R10
+
+	VMOVDQU ·AVX_c40<>(SB), X0
+	VMOVDQU ·AVX_c48<>(SB), X1
+	VMOVDQA X0, X8
+	VMOVDQA X1, X9
+
+	VMOVDQU ·AVX_iv3<>(SB), X0
+	VMOVDQA X0, 0(R10)
+	XORQ    CX, 0(R10)          // 0(R10) = ·AVX_iv3 ^ (CX || 0)
+
+	VMOVDQU 0(AX), X10
+	VMOVDQU 16(AX), X11
+	VMOVDQU 32(AX), X2
+	VMOVDQU 48(AX), X3
+
+	MOVQ 0(BX), R8
+	MOVQ 8(BX), R9
+
+loop:
+	ADDQ $128, R8
+	CMPQ R8, $128
+	JGE  noinc
+	INCQ R9
+
+noinc:
+	VMOVQ_R8_X15
+	VPINSRQ_1_R9_X15
+
+	VMOVDQA X10, X0
+	VMOVDQA X11, X1
+	VMOVDQU ·AVX_iv0<>(SB), X4
+	VMOVDQU ·AVX_iv1<>(SB), X5
+	VMOVDQU ·AVX_iv2<>(SB), X6
+
+	VPXOR   X15, X6, X6
+	VMOVDQA 0(R10), X7
+
+	LOAD_MSG_AVX_0_2_4_6_1_3_5_7()
+	VMOVDQA X12, 16(R10)
+	VMOVDQA X13, 32(R10)
+	VMOVDQA X14, 48(R10)
+	VMOVDQA X15, 64(R10)
+	HALF_ROUND_AVX(X0, X1, X2, X3, X4, X5, X6, X7, X12, X13, X14, X15, X15, X8, X9)
+	SHUFFLE_AVX()
+	LOAD_MSG_AVX(8, 10, 12, 14, 9, 11, 13, 15)
+	VMOVDQA X12, 80(R10)
+	VMOVDQA X13, 96(R10)
+	VMOVDQA X14, 112(R10)
+	VMOVDQA X15, 128(R10)
+	HALF_ROUND_AVX(X0, X1, X2, X3, X4, X5, X6, X7, X12, X13, X14, X15, X15, X8, X9)
+	SHUFFLE_AVX_INV()
+
+	LOAD_MSG_AVX(14, 4, 9, 13, 10, 8, 15, 6)
+	VMOVDQA X12, 144(R10)
+	VMOVDQA X13, 160(R10)
+	VMOVDQA X14, 176(R10)
+	VMOVDQA X15, 192(R10)
+	HALF_ROUND_AVX(X0, X1, X2, X3, X4, X5, X6, X7, X12, X13, X14, X15, X15, X8, X9)
+	SHUFFLE_AVX()
+	LOAD_MSG_AVX_1_0_11_5_12_2_7_3()
+	VMOVDQA X12, 208(R10)
+	VMOVDQA X13, 224(R10)
+	VMOVDQA X14, 240(R10)
+	VMOVDQA X15, 256(R10)
+	HALF_ROUND_AVX(X0, X1, X2, X3, X4, X5, X6, X7, X12, X13, X14, X15, X15, X8, X9)
+	SHUFFLE_AVX_INV()
+
+	LOAD_MSG_AVX_11_12_5_15_8_0_2_13()
+	HALF_ROUND_AVX(X0, X1, X2, X3, X4, X5, X6, X7, X12, X13, X14, X15, X15, X8, X9)
+	SHUFFLE_AVX()
+	LOAD_MSG_AVX(10, 3, 7, 9, 14, 6, 1, 4)
+	HALF_ROUND_AVX(X0, X1, X2, X3, X4, X5, X6, X7, X12, X13, X14, X15, X15, X8, X9)
+	SHUFFLE_AVX_INV()
+
+	LOAD_MSG_AVX(7, 3, 13, 11, 9, 1, 12, 14)
+	HALF_ROUND_AVX(X0, X1, X2, X3, X4, X5, X6, X7, X12, X13, X14, X15, X15, X8, X9)
+	SHUFFLE_AVX()
+	LOAD_MSG_AVX_2_5_4_15_6_10_0_8()
+	HALF_ROUND_AVX(X0, X1, X2, X3, X4, X5, X6, X7, X12, X13, X14, X15, X15, X8, X9)
+	SHUFFLE_AVX_INV()
+
+	LOAD_MSG_AVX_9_5_2_10_0_7_4_15()
+	HALF_ROUND_AVX(X0, X1, X2, X3, X4, X5, X6, X7, X12, X13, X14, X15, X15, X8, X9)
+	SHUFFLE_AVX()
+	LOAD_MSG_AVX(14, 11, 6, 3, 1, 12, 8, 13)
+	HALF_ROUND_AVX(X0, X1, X2, X3, X4, X5, X6, X7, X12, X13, X14, X15, X15, X8, X9)
+	SHUFFLE_AVX_INV()
+
+	LOAD_MSG_AVX_2_6_0_8_12_10_11_3()
+	HALF_ROUND_AVX(X0, X1, X2, X3, X4, X5, X6, X7, X12, X13, X14, X15, X15, X8, X9)
+	SHUFFLE_AVX()
+	LOAD_MSG_AVX(4, 7, 15, 1, 13, 5, 14, 9)
+	HALF_ROUND_AVX(X0, X1, X2, X3, X4, X5, X6, X7, X12, X13, X14, X15, X15, X8, X9)
+	SHUFFLE_AVX_INV()
+
+	LOAD_MSG_AVX(12, 1, 14, 4, 5, 15, 13, 10)
+	HALF_ROUND_AVX(X0, X1, X2, X3, X4, X5, X6, X7, X12, X13, X14, X15, X15, X8, X9)
+	SHUFFLE_AVX()
+	LOAD_MSG_AVX_0_6_9_8_7_3_2_11()
+	HALF_ROUND_AVX(X0, X1, X2, X3, X4, X5, X6, X7, X12, X13, X14, X15, X15, X8, X9)
+	SHUFFLE_AVX_INV()
+
+	LOAD_MSG_AVX(13, 7, 12, 3, 11, 14, 1, 9)
+	HALF_ROUND_AVX(X0, X1, X2, X3, X4, X5, X6, X7, X12, X13, X14, X15, X15, X8, X9)
+	SHUFFLE_AVX()
+	LOAD_MSG_AVX_5_15_8_2_0_4_6_10()
+	HALF_ROUND_AVX(X0, X1, X2, X3, X4, X5, X6, X7, X12, X13, X14, X15, X15, X8, X9)
+	SHUFFLE_AVX_INV()
+
+	LOAD_MSG_AVX_6_14_11_0_15_9_3_8()
+	HALF_ROUND_AVX(X0, X1, X2, X3, X4, X5, X6, X7, X12, X13, X14, X15, X15, X8, X9)
+	SHUFFLE_AVX()
+	LOAD_MSG_AVX_12_13_1_10_2_7_4_5()
+	HALF_ROUND_AVX(X0, X1, X2, X3, X4, X5, X6, X7, X12, X13, X14, X15, X15, X8, X9)
+	SHUFFLE_AVX_INV()
+
+	LOAD_MSG_AVX(10, 8, 7, 1, 2, 4, 6, 5)
+	HALF_ROUND_AVX(X0, X1, X2, X3, X4, X5, X6, X7, X12, X13, X14, X15, X15, X8, X9)
+	SHUFFLE_AVX()
+	LOAD_MSG_AVX_15_9_3_13_11_14_12_0()
+	HALF_ROUND_AVX(X0, X1, X2, X3, X4, X5, X6, X7, X12, X13, X14, X15, X15, X8, X9)
+	SHUFFLE_AVX_INV()
+
+	HALF_ROUND_AVX(X0, X1, X2, X3, X4, X5, X6, X7, 16(R10), 32(R10), 48(R10), 64(R10), X15, X8, X9)
+	SHUFFLE_AVX()
+	HALF_ROUND_AVX(X0, X1, X2, X3, X4, X5, X6, X7, 80(R10), 96(R10), 112(R10), 128(R10), X15, X8, X9)
+	SHUFFLE_AVX_INV()
+
+	HALF_ROUND_AVX(X0, X1, X2, X3, X4, X5, X6, X7, 144(R10), 160(R10), 176(R10), 192(R10), X15, X8, X9)
+	SHUFFLE_AVX()
+	HALF_ROUND_AVX(X0, X1, X2, X3, X4, X5, X6, X7, 208(R10), 224(R10), 240(R10), 256(R10), X15, X8, X9)
+	SHUFFLE_AVX_INV()
+
+	VMOVDQU 32(AX), X14
+	VMOVDQU 48(AX), X15
+	VPXOR   X0, X10, X10
+	VPXOR   X1, X11, X11
+	VPXOR   X2, X14, X14
+	VPXOR   X3, X15, X15
+	VPXOR   X4, X10, X10
+	VPXOR   X5, X11, X11
+	VPXOR   X6, X14, X2
+	VPXOR   X7, X15, X3
+	VMOVDQU X2, 32(AX)
+	VMOVDQU X3, 48(AX)
+
+	LEAQ 128(SI), SI
+	SUBQ $128, DI
+	JNE  loop
+
+	VMOVDQU X10, 0(AX)
+	VMOVDQU X11, 16(AX)
+
+	MOVQ R8, 0(BX)
+	MOVQ R9, 8(BX)
+	VZEROUPPER
+
+	RET
diff --git a/.ci/providerlint/vendor/golang.org/x/crypto/blake2b/blake2b_amd64.go b/.ci/providerlint/vendor/golang.org/x/crypto/blake2b/blake2b_amd64.go
new file mode 100644
index 00000000000..5fa1b32841d
--- /dev/null
+++ b/.ci/providerlint/vendor/golang.org/x/crypto/blake2b/blake2b_amd64.go
@@ -0,0 +1,25 @@
+// Copyright 2016 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build !go1.7 && amd64 && gc && !purego
+// +build !go1.7,amd64,gc,!purego
+
+package blake2b
+
+import "golang.org/x/sys/cpu"
+
+func init() {
+	useSSE4 = cpu.X86.HasSSE41
+}
+
+//go:noescape
+func hashBlocksSSE4(h *[8]uint64, c *[2]uint64, flag uint64, blocks []byte)
+
+func hashBlocks(h *[8]uint64, c *[2]uint64, flag uint64, blocks []byte) {
+	if useSSE4 {
+		hashBlocksSSE4(h, c, flag, blocks)
+	} else {
+		hashBlocksGeneric(h, c, flag, blocks)
+	}
+}
diff --git a/.ci/providerlint/vendor/golang.org/x/crypto/blake2b/blake2b_amd64.s b/.ci/providerlint/vendor/golang.org/x/crypto/blake2b/blake2b_amd64.s
new file mode 100644
index 00000000000..ae75eb9afcd
--- /dev/null
+++ b/.ci/providerlint/vendor/golang.org/x/crypto/blake2b/blake2b_amd64.s
@@ -0,0 +1,279 @@
+// Copyright 2016 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build amd64 && gc && !purego
+// +build amd64,gc,!purego
+
+#include "textflag.h"
+
+DATA ·iv0<>+0x00(SB)/8, $0x6a09e667f3bcc908
+DATA ·iv0<>+0x08(SB)/8, $0xbb67ae8584caa73b
+GLOBL ·iv0<>(SB), (NOPTR+RODATA), $16
+
+DATA ·iv1<>+0x00(SB)/8, $0x3c6ef372fe94f82b
+DATA ·iv1<>+0x08(SB)/8, $0xa54ff53a5f1d36f1
+GLOBL ·iv1<>(SB), (NOPTR+RODATA), $16
+
+DATA ·iv2<>+0x00(SB)/8, $0x510e527fade682d1
+DATA ·iv2<>+0x08(SB)/8, $0x9b05688c2b3e6c1f
+GLOBL ·iv2<>(SB), (NOPTR+RODATA), $16
+
+DATA ·iv3<>+0x00(SB)/8, $0x1f83d9abfb41bd6b
+DATA ·iv3<>+0x08(SB)/8, $0x5be0cd19137e2179
+GLOBL ·iv3<>(SB), (NOPTR+RODATA), $16
+
+DATA ·c40<>+0x00(SB)/8, $0x0201000706050403
+DATA ·c40<>+0x08(SB)/8, $0x0a09080f0e0d0c0b
+GLOBL ·c40<>(SB), (NOPTR+RODATA), $16
+
+DATA ·c48<>+0x00(SB)/8, $0x0100070605040302
+DATA ·c48<>+0x08(SB)/8, $0x09080f0e0d0c0b0a
+GLOBL ·c48<>(SB), (NOPTR+RODATA), $16
+
+#define SHUFFLE(v2, v3, v4, v5, v6, v7, t1, t2) \
+	MOVO       v4, t1; \
+	MOVO       v5, v4; \
+	MOVO       t1, v5; \
+	MOVO       v6, t1; \
+	PUNPCKLQDQ v6, t2; \
+	PUNPCKHQDQ v7, v6; \
+	PUNPCKHQDQ t2, v6; \
+	PUNPCKLQDQ v7, t2; \
+	MOVO       t1, v7; \
+	MOVO       v2, t1; \
+	PUNPCKHQDQ t2, v7; \
+	PUNPCKLQDQ v3, t2; \
+	PUNPCKHQDQ t2, v2; \
+	PUNPCKLQDQ t1, t2; \
+	PUNPCKHQDQ t2, v3
+
+#define SHUFFLE_INV(v2, v3, v4, v5, v6, v7, t1, t2) \
+	MOVO       v4, t1; \
+	MOVO       v5, v4; \
+	MOVO       t1, v5; \
+	MOVO       v2, t1; \
+	PUNPCKLQDQ v2, t2; \
+	PUNPCKHQDQ v3, v2; \
+	PUNPCKHQDQ t2, v2; \
+	PUNPCKLQDQ v3, t2; \
+	MOVO       t1, v3; \
+	MOVO       v6, t1; \
+	PUNPCKHQDQ t2, v3; \
+	PUNPCKLQDQ v7, t2; \
+	PUNPCKHQDQ t2, v6; \
+	PUNPCKLQDQ t1, t2; \
+	PUNPCKHQDQ t2, v7
+
+#define HALF_ROUND(v0, v1, v2, v3, v4, v5, v6, v7, m0, m1, m2, m3, t0, c40, c48) \
+	PADDQ  m0, v0;        \
+	PADDQ  m1, v1;        \
+	PADDQ  v2, v0;        \
+	PADDQ  v3, v1;        \
+	PXOR   v0, v6;        \
+	PXOR   v1, v7;        \
+	PSHUFD $0xB1, v6, v6; \
+	PSHUFD $0xB1, v7, v7; \
+	PADDQ  v6, v4;        \
+	PADDQ  v7, v5;        \
+	PXOR   v4, v2;        \
+	PXOR   v5, v3;        \
+	PSHUFB c40, v2;       \
+	PSHUFB c40, v3;       \
+	PADDQ  m2, v0;        \
+	PADDQ  m3, v1;        \
+	PADDQ  v2, v0;        \
+	PADDQ  v3, v1;        \
+	PXOR   v0, v6;        \
+	PXOR   v1, v7;        \
+	PSHUFB c48, v6;       \
+	PSHUFB c48, v7;       \
+	PADDQ  v6, v4;        \
+	PADDQ  v7, v5;        \
+	PXOR   v4, v2;        \
+	PXOR   v5, v3;        \
+	MOVOU  v2, t0;        \
+	PADDQ  v2, t0;        \
+	PSRLQ  $63, v2;       \
+	PXOR   t0, v2;        \
+	MOVOU  v3, t0;        \
+	PADDQ  v3, t0;        \
+	PSRLQ  $63, v3;       \
+	PXOR   t0, v3
+
+#define LOAD_MSG(m0, m1, m2, m3, src, i0, i1, i2, i3, i4, i5, i6, i7) \
+	MOVQ   i0*8(src), m0;     \
+	PINSRQ $1, i1*8(src), m0; \
+	MOVQ   i2*8(src), m1;     \
+	PINSRQ $1, i3*8(src), m1; \
+	MOVQ   i4*8(src), m2;     \
+	PINSRQ $1, i5*8(src), m2; \
+	MOVQ   i6*8(src), m3;     \
+	PINSRQ $1, i7*8(src), m3
+
+// func hashBlocksSSE4(h *[8]uint64, c *[2]uint64, flag uint64, blocks []byte)
+TEXT ·hashBlocksSSE4(SB), 4, $288-48 // frame size = 272 + 16 byte alignment
+	MOVQ h+0(FP), AX
+	MOVQ c+8(FP), BX
+	MOVQ flag+16(FP), CX
+	MOVQ blocks_base+24(FP), SI
+	MOVQ blocks_len+32(FP), DI
+
+	MOVQ SP, R10
+	ADDQ $15, R10
+	ANDQ $~15, R10
+
+	MOVOU ·iv3<>(SB), X0
+	MOVO  X0, 0(R10)
+	XORQ  CX, 0(R10)     // 0(R10) = ·iv3 ^ (CX || 0)
+
+	MOVOU ·c40<>(SB), X13
+	MOVOU ·c48<>(SB), X14
+
+	MOVOU 0(AX), X12
+	MOVOU 16(AX), X15
+
+	MOVQ 0(BX), R8
+	MOVQ 8(BX), R9
+
+loop:
+	ADDQ $128, R8
+	CMPQ R8, $128
+	JGE  noinc
+	INCQ R9
+
+noinc:
+	MOVQ R8, X8
+	PINSRQ $1, R9, X8
+
+	MOVO X12, X0
+	MOVO X15, X1
+	MOVOU 32(AX), X2
+	MOVOU 48(AX), X3
+	MOVOU ·iv0<>(SB), X4
+	MOVOU ·iv1<>(SB), X5
+	MOVOU ·iv2<>(SB), X6
+
+	PXOR X8, X6
+	MOVO 0(R10), X7
+
+	LOAD_MSG(X8, X9, X10, X11, SI, 0, 2, 4, 6, 1, 3, 5, 7)
+	MOVO X8, 16(R10)
+	MOVO X9, 32(R10)
+	MOVO X10, 48(R10)
+	MOVO X11, 64(R10)
+	HALF_ROUND(X0, X1, X2, X3, X4, X5, X6, X7, X8, X9, X10, X11, X11, X13, X14)
+	SHUFFLE(X2, X3, X4, X5, X6, X7, X8, X9)
+	LOAD_MSG(X8, X9, X10, X11, SI, 8, 10, 12, 14, 9, 11, 13, 15)
+	MOVO X8, 80(R10)
+	MOVO X9, 96(R10)
+	MOVO X10, 112(R10)
+	MOVO X11, 128(R10)
+	HALF_ROUND(X0, X1, X2, X3, X4, X5, X6, X7, X8, X9, X10, X11, X11, X13, X14)
+	SHUFFLE_INV(X2, X3, X4, X5, X6, X7, X8, X9)
+
+	LOAD_MSG(X8, X9, X10, X11, SI, 14, 4, 9, 13, 10, 8, 15, 6)
+	MOVO X8, 144(R10)
+	MOVO X9, 160(R10)
+	MOVO X10, 176(R10)
+	MOVO X11, 192(R10)
+	HALF_ROUND(X0, X1, X2, X3, X4, X5, X6, X7, X8, X9, X10, X11, X11, X13, X14)
+	SHUFFLE(X2, X3, X4, X5, X6, X7, X8, X9)
+	LOAD_MSG(X8, X9, X10, X11, SI, 1, 0, 11, 5, 12, 2, 7, 3)
+	MOVO X8, 208(R10)
+	MOVO X9, 224(R10)
+	MOVO X10, 240(R10)
+	MOVO X11, 256(R10)
+	HALF_ROUND(X0, X1, X2, X3, X4, X5, X6, X7, X8, X9, X10, X11, X11, X13, X14)
+	SHUFFLE_INV(X2, X3, X4, X5, X6, X7, X8, X9)
+
+	LOAD_MSG(X8, X9, X10, X11, SI, 11, 12, 5, 15, 8, 0, 2, 13)
+	HALF_ROUND(X0, X1, X2, X3, X4, X5, X6, X7, X8, X9, X10, X11, X11, X13, X14)
+	SHUFFLE(X2, X3, X4, X5, X6, X7, X8, X9)
+	LOAD_MSG(X8, X9, X10, X11, SI, 10, 3, 7, 9, 14, 6, 1, 4)
+	HALF_ROUND(X0, X1, X2, X3, X4, X5, X6, X7, X8, X9, X10, X11, X11, X13, X14)
+	SHUFFLE_INV(X2, X3, X4, X5, X6, X7, X8, X9)
+
+	LOAD_MSG(X8, X9, X10, X11, SI, 7, 3, 13, 11, 9, 1, 12, 14)
+	HALF_ROUND(X0, X1, X2, X3, X4, X5, X6, X7, X8, X9, X10, X11, X11, X13, X14)
+	SHUFFLE(X2, X3, X4, X5, X6, X7, X8, X9)
+	LOAD_MSG(X8, X9, X10, X11, SI, 2, 5, 4, 15, 6, 10, 0, 8)
+	HALF_ROUND(X0, X1, X2, X3, X4, X5, X6, X7, X8, X9, X10, X11, X11, X13, X14)
+	SHUFFLE_INV(X2, X3, X4, X5, X6, X7, X8, X9)
+
+	LOAD_MSG(X8, X9, X10, X11, SI, 9, 5, 2, 10, 0, 7, 4, 15)
+	HALF_ROUND(X0, X1, X2, X3, X4, X5, X6, X7, X8, X9, X10, X11, X11, X13, X14)
+	SHUFFLE(X2, X3, X4, X5, X6, X7, X8, X9)
+	LOAD_MSG(X8, X9, X10, X11, SI, 14, 11, 6, 3, 1, 12, 8, 13)
+	HALF_ROUND(X0, X1, X2, X3, X4, X5, X6, X7, X8, X9, X10, X11, X11, X13, X14)
+	SHUFFLE_INV(X2, X3, X4, X5, X6, X7, X8, X9)
+
+	LOAD_MSG(X8, X9, X10, X11, SI, 2, 6, 0, 8, 12, 10, 11, 3)
+	HALF_ROUND(X0, X1, X2, X3, X4, X5, X6, X7, X8, X9, X10, X11, X11, X13, X14)
+	SHUFFLE(X2, X3, X4, X5, X6, X7, X8, X9)
+	LOAD_MSG(X8, X9, X10, X11, SI, 4, 7, 15, 1, 13, 5, 14, 9)
+	HALF_ROUND(X0, X1, X2, X3, X4, X5, X6, X7, X8, X9, X10, X11, X11, X13, X14)
+	SHUFFLE_INV(X2, X3, X4, X5, X6, X7, X8, X9)
+
+	LOAD_MSG(X8, X9, X10, X11, SI, 12, 1, 14, 4, 5, 15, 13, 10)
+	HALF_ROUND(X0, X1, X2, X3, X4, X5, X6, X7, X8, X9, X10, X11, X11, X13, X14)
+	SHUFFLE(X2, X3, X4, X5, X6, X7, X8, X9)
+	LOAD_MSG(X8, X9, X10, X11, SI, 0, 6, 9, 8, 7, 3, 2, 11)
+	HALF_ROUND(X0, X1, X2, X3, X4, X5, X6, X7, X8, X9, X10, X11, X11, X13, X14)
+	SHUFFLE_INV(X2, X3, X4, X5, X6, X7, X8, X9)
+
+	LOAD_MSG(X8, X9, X10, X11, SI, 13, 7, 12, 3, 11, 14, 1, 9)
+	HALF_ROUND(X0, X1, X2, X3, X4, X5, X6, X7, X8, X9, X10, X11, X11, X13, X14)
+	SHUFFLE(X2, X3, X4, X5, X6, X7, X8, X9)
+	LOAD_MSG(X8, X9, X10, X11, SI, 5, 15, 8, 2, 0, 4, 6, 10)
+	HALF_ROUND(X0, X1, X2, X3, X4, X5, X6, X7, X8, X9, X10, X11, X11, X13, X14)
+	SHUFFLE_INV(X2, X3, X4, X5, X6, X7, X8, X9)
+
+	LOAD_MSG(X8, X9, X10, X11, SI, 6, 14, 11, 0, 15, 9, 3, 8)
+	HALF_ROUND(X0, X1, X2, X3, X4, X5, X6, X7, X8, X9, X10, X11, X11, X13, X14)
+	SHUFFLE(X2, X3, X4, X5, X6, X7, X8, X9)
+	LOAD_MSG(X8, X9, X10, X11, SI, 12, 13, 1, 10, 2, 7, 4, 5)
+	HALF_ROUND(X0, X1, X2, X3, X4, X5, X6, X7, X8, X9, X10, X11, X11, X13, X14)
+	SHUFFLE_INV(X2, X3, X4, X5, X6, X7, X8, X9)
+
+	LOAD_MSG(X8, X9, X10, X11, SI, 10, 8, 7, 1, 2, 4, 6, 5)
+	HALF_ROUND(X0, X1, X2, X3, X4, X5, X6, X7, X8, X9, X10, X11, X11, X13, X14)
+	SHUFFLE(X2, X3, X4, X5, X6, X7, X8, X9)
+	LOAD_MSG(X8, X9, X10, X11, SI, 15, 9, 3, 13, 11, 14, 12, 0)
+	HALF_ROUND(X0, X1, X2, X3, X4, X5, X6, X7, X8, X9, X10, X11, X11, X13, X14)
+	SHUFFLE_INV(X2, X3, X4, X5, X6, X7, X8, X9)
+
+	HALF_ROUND(X0, X1, X2, X3, X4, X5, X6, X7, 16(R10), 32(R10), 48(R10), 64(R10), X11, X13, X14)
+	SHUFFLE(X2, X3, X4, X5, X6, X7, X8, X9)
+	HALF_ROUND(X0, X1, X2, X3, X4, X5, X6, X7, 80(R10), 96(R10), 112(R10), 128(R10), X11, X13, X14)
+	SHUFFLE_INV(X2, X3, X4, X5, X6, X7, X8, X9)
+
+	HALF_ROUND(X0, X1, X2, X3, X4, X5, X6, X7, 144(R10), 160(R10), 176(R10), 192(R10), X11, X13, X14)
+	SHUFFLE(X2, X3, X4, X5, X6, X7, X8, X9)
+	HALF_ROUND(X0, X1, X2, X3, X4, X5, X6, X7, 208(R10), 224(R10), 240(R10), 256(R10), X11, X13, X14)
+	SHUFFLE_INV(X2, X3, X4, X5, X6, X7, X8, X9)
+
+	MOVOU 32(AX), X10
+	MOVOU 48(AX), X11
+	PXOR  X0, X12
+	PXOR  X1, X15
+	PXOR  X2, X10
+	PXOR  X3, X11
+	PXOR  X4, X12
+	PXOR  X5, X15
+	PXOR  X6, X10
+	PXOR  X7, X11
+	MOVOU X10, 32(AX)
+	MOVOU X11, 48(AX)
+
+	LEAQ 128(SI), SI
+	SUBQ $128, DI
+	JNE  loop
+
+	MOVOU X12, 0(AX)
+	MOVOU X15, 16(AX)
+
+	MOVQ R8, 0(BX)
+	MOVQ R9, 8(BX)
+
+	RET
diff --git a/.ci/providerlint/vendor/golang.org/x/crypto/blake2b/blake2b_generic.go b/.ci/providerlint/vendor/golang.org/x/crypto/blake2b/blake2b_generic.go
new file mode 100644
index 00000000000..3168a8aa3c8
--- /dev/null
+++ b/.ci/providerlint/vendor/golang.org/x/crypto/blake2b/blake2b_generic.go
@@ -0,0 +1,182 @@
+// Copyright 2016 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package blake2b
+
+import (
+	"encoding/binary"
+	"math/bits"
+)
+
+// the precomputed values for BLAKE2b
+// there are 12 16-byte arrays - one for each round
+// the entries are calculated from the sigma constants.
+var precomputed = [12][16]byte{
+	{0, 2, 4, 6, 1, 3, 5, 7, 8, 10, 12, 14, 9, 11, 13, 15},
+	{14, 4, 9, 13, 10, 8, 15, 6, 1, 0, 11, 5, 12, 2, 7, 3},
+	{11, 12, 5, 15, 8, 0, 2, 13, 10, 3, 7, 9, 14, 6, 1, 4},
+	{7, 3, 13, 11, 9, 1, 12, 14, 2, 5, 4, 15, 6, 10, 0, 8},
+	{9, 5, 2, 10, 0, 7, 4, 15, 14, 11, 6, 3, 1, 12, 8, 13},
+	{2, 6, 0, 8, 12, 10, 11, 3, 4, 7, 15, 1, 13, 5, 14, 9},
+	{12, 1, 14, 4, 5, 15, 13, 10, 0, 6, 9, 8, 7, 3, 2, 11},
+	{13, 7, 12, 3, 11, 14, 1, 9, 5, 15, 8, 2, 0, 4, 6, 10},
+	{6, 14, 11, 0, 15, 9, 3, 8, 12, 13, 1, 10, 2, 7, 4, 5},
+	{10, 8, 7, 1, 2, 4, 6, 5, 15, 9, 3, 13, 11, 14, 12, 0},
+	{0, 2, 4, 6, 1, 3, 5, 7, 8, 10, 12, 14, 9, 11, 13, 15}, // equal to the first
+	{14, 4, 9, 13, 10, 8, 15, 6, 1, 0, 11, 5, 12, 2, 7, 3}, // equal to the second
+}
+
+func hashBlocksGeneric(h *[8]uint64, c *[2]uint64, flag uint64, blocks []byte) {
+	var m [16]uint64
+	c0, c1 := c[0], c[1]
+
+	for i := 0; i < len(blocks); {
+		c0 += BlockSize
+		if c0 < BlockSize {
+			c1++
+		}
+
+		v0, v1, v2, v3, v4, v5, v6, v7 := h[0], h[1], h[2], h[3], h[4], h[5], h[6], h[7]
+		v8, v9, v10, v11, v12, v13, v14, v15 := iv[0], iv[1], iv[2], iv[3], iv[4], iv[5], iv[6], iv[7]
+		v12 ^= c0
+		v13 ^= c1
+		v14 ^= flag
+
+		for j := range m {
+			m[j] = binary.LittleEndian.Uint64(blocks[i:])
+			i += 8
+		}
+
+		for j := range precomputed {
+			s := &(precomputed[j])
+
+			v0 += m[s[0]]
+			v0 += v4
+			v12 ^= v0
+			v12 = bits.RotateLeft64(v12, -32)
+			v8 += v12
+			v4 ^= v8
+			v4 = bits.RotateLeft64(v4, -24)
+			v1 += m[s[1]]
+			v1 += v5
+			v13 ^= v1
+			v13 = bits.RotateLeft64(v13, -32)
+			v9 += v13
+			v5 ^= v9
+			v5 = bits.RotateLeft64(v5, -24)
+			v2 += m[s[2]]
+			v2 += v6
+			v14 ^= v2
+			v14 = bits.RotateLeft64(v14, -32)
+			v10 += v14
+			v6 ^= v10
+			v6 = bits.RotateLeft64(v6, -24)
+			v3 += m[s[3]]
+			v3 += v7
+			v15 ^= v3
+			v15 = bits.RotateLeft64(v15, -32)
+			v11 += v15
+			v7 ^= v11
+			v7 = bits.RotateLeft64(v7, -24)
+
+			v0 += m[s[4]]
+			v0 += v4
+			v12 ^= v0
+			v12 = bits.RotateLeft64(v12, -16)
+			v8 += v12
+			v4 ^= v8
+			v4 = bits.RotateLeft64(v4, -63)
+			v1 += m[s[5]]
+			v1 += v5
+			v13 ^= v1
+			v13 = bits.RotateLeft64(v13, -16)
+			v9 += v13
+			v5 ^= v9
+			v5 = bits.RotateLeft64(v5, -63)
+			v2 += m[s[6]]
+			v2 += v6
+			v14 ^= v2
+			v14 = bits.RotateLeft64(v14, -16)
+			v10 += v14
+			v6 ^= v10
+			v6 = bits.RotateLeft64(v6, -63)
+			v3 += m[s[7]]
+			v3 += v7
+			v15 ^= v3
+			v15 = bits.RotateLeft64(v15, -16)
+			v11 += v15
+			v7 ^= v11
+			v7 = bits.RotateLeft64(v7, -63)
+
+			v0 += m[s[8]]
+			v0 += v5
+			v15 ^= v0
+			v15 = bits.RotateLeft64(v15, -32)
+			v10 += v15
+			v5 ^= v10
+			v5 = bits.RotateLeft64(v5, -24)
+			v1 += m[s[9]]
+			v1 += v6
+			v12 ^= v1
+			v12 = bits.RotateLeft64(v12, -32)
+			v11 += v12
+			v6 ^= v11
+			v6 = bits.RotateLeft64(v6, -24)
+			v2 += m[s[10]]
+			v2 += v7
+			v13 ^= v2
+			v13 = bits.RotateLeft64(v13, -32)
+			v8 += v13
+			v7 ^= v8
+			v7 = bits.RotateLeft64(v7, -24)
+			v3 += m[s[11]]
+			v3 += v4
+			v14 ^= v3
+			v14 = bits.RotateLeft64(v14, -32)
+			v9 += v14
+			v4 ^= v9
+			v4 = bits.RotateLeft64(v4, -24)
+
+			v0 += m[s[12]]
+			v0 += v5
+			v15 ^= v0
+			v15 = bits.RotateLeft64(v15, -16)
+			v10 += v15
+			v5 ^= v10
+			v5 = bits.RotateLeft64(v5, -63)
+			v1 += m[s[13]]
+			v1 += v6
+			v12 ^= v1
+			v12 = bits.RotateLeft64(v12, -16)
+			v11 += v12
+			v6 ^= v11
+			v6 = bits.RotateLeft64(v6, -63)
+			v2 += m[s[14]]
+			v2 += v7
+			v13 ^= v2
+			v13 = bits.RotateLeft64(v13, -16)
+			v8 += v13
+			v7 ^= v8
+			v7 = bits.RotateLeft64(v7, -63)
+			v3 += m[s[15]]
+			v3 += v4
+			v14 ^= v3
+			v14 = bits.RotateLeft64(v14, -16)
+			v9 += v14
+			v4 ^= v9
+			v4 = bits.RotateLeft64(v4, -63)
+
+		}
+
+		h[0] ^= v0 ^ v8
+		h[1] ^= v1 ^ v9
+		h[2] ^= v2 ^ v10
+		h[3] ^= v3 ^ v11
+		h[4] ^= v4 ^ v12
+		h[5] ^= v5 ^ v13
+		h[6] ^= v6 ^ v14
+		h[7] ^= v7 ^ v15
+	}
+	c[0], c[1] = c0, c1
+}
diff --git a/.ci/providerlint/vendor/golang.org/x/crypto/blake2b/blake2b_ref.go b/.ci/providerlint/vendor/golang.org/x/crypto/blake2b/blake2b_ref.go
new file mode 100644
index 00000000000..b0137cdf025
--- /dev/null
+++ b/.ci/providerlint/vendor/golang.org/x/crypto/blake2b/blake2b_ref.go
@@ -0,0 +1,12 @@
+// Copyright 2016 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build !amd64 || purego || !gc
+// +build !amd64 purego !gc
+
+package blake2b
+
+func hashBlocks(h *[8]uint64, c *[2]uint64, flag uint64, blocks []byte) {
+	hashBlocksGeneric(h, c, flag, blocks)
+}
diff --git a/.ci/providerlint/vendor/golang.org/x/crypto/blake2b/blake2x.go b/.ci/providerlint/vendor/golang.org/x/crypto/blake2b/blake2x.go
new file mode 100644
index 00000000000..52c414db0e6
--- /dev/null
+++ b/.ci/providerlint/vendor/golang.org/x/crypto/blake2b/blake2x.go
@@ -0,0 +1,177 @@
+// Copyright 2017 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package blake2b
+
+import (
+	"encoding/binary"
+	"errors"
+	"io"
+)
+
+// XOF defines the interface to hash functions that
+// support arbitrary-length output.
+type XOF interface {
+	// Write absorbs more data into the hash's state. It panics if called
+	// after Read.
+	io.Writer
+
+	// Read reads more output from the hash. It returns io.EOF if the limit
+	// has been reached.
+	io.Reader
+
+	// Clone returns a copy of the XOF in its current state.
+	Clone() XOF
+
+	// Reset resets the XOF to its initial state.
+	Reset()
+}
+
+// OutputLengthUnknown can be used as the size argument to NewXOF to indicate
+// the length of the output is not known in advance.
+const OutputLengthUnknown = 0
+
+// magicUnknownOutputLength is a magic value for the output size that indicates
+// an unknown number of output bytes.
+const magicUnknownOutputLength = (1 << 32) - 1
+
+// maxOutputLength is the absolute maximum number of bytes to produce when the
+// number of output bytes is unknown.
+const maxOutputLength = (1 << 32) * 64
+
+// NewXOF creates a new variable-output-length hash. The hash either produce a
+// known number of bytes (1 <= size < 2**32-1), or an unknown number of bytes
+// (size == OutputLengthUnknown). In the latter case, an absolute limit of
+// 256GiB applies.
+//
+// A non-nil key turns the hash into a MAC. The key must between
+// zero and 32 bytes long.
+func NewXOF(size uint32, key []byte) (XOF, error) {
+	if len(key) > Size {
+		return nil, errKeySize
+	}
+	if size == magicUnknownOutputLength {
+		// 2^32-1 indicates an unknown number of bytes and thus isn't a
+		// valid length.
+		return nil, errors.New("blake2b: XOF length too large")
+	}
+	if size == OutputLengthUnknown {
+		size = magicUnknownOutputLength
+	}
+	x := &xof{
+		d: digest{
+			size:   Size,
+			keyLen: len(key),
+		},
+		length: size,
+	}
+	copy(x.d.key[:], key)
+	x.Reset()
+	return x, nil
+}
+
+type xof struct {
+	d                digest
+	length           uint32
+	remaining        uint64
+	cfg, root, block [Size]byte
+	offset           int
+	nodeOffset       uint32
+	readMode         bool
+}
+
+func (x *xof) Write(p []byte) (n int, err error) {
+	if x.readMode {
+		panic("blake2b: write to XOF after read")
+	}
+	return x.d.Write(p)
+}
+
+func (x *xof) Clone() XOF {
+	clone := *x
+	return &clone
+}
+
+func (x *xof) Reset() {
+	x.cfg[0] = byte(Size)
+	binary.LittleEndian.PutUint32(x.cfg[4:], uint32(Size)) // leaf length
+	binary.LittleEndian.PutUint32(x.cfg[12:], x.length)    // XOF length
+	x.cfg[17] = byte(Size)                                 // inner hash size
+
+	x.d.Reset()
+	x.d.h[1] ^= uint64(x.length) << 32
+
+	x.remaining = uint64(x.length)
+	if x.remaining == magicUnknownOutputLength {
+		x.remaining = maxOutputLength
+	}
+	x.offset, x.nodeOffset = 0, 0
+	x.readMode = false
+}
+
+func (x *xof) Read(p []byte) (n int, err error) {
+	if !x.readMode {
+		x.d.finalize(&x.root)
+		x.readMode = true
+	}
+
+	if x.remaining == 0 {
+		return 0, io.EOF
+	}
+
+	n = len(p)
+	if uint64(n) > x.remaining {
+		n = int(x.remaining)
+		p = p[:n]
+	}
+
+	if x.offset > 0 {
+		blockRemaining := Size - x.offset
+		if n < blockRemaining {
+			x.offset += copy(p, x.block[x.offset:])
+			x.remaining -= uint64(n)
+			return
+		}
+		copy(p, x.block[x.offset:])
+		p = p[blockRemaining:]
+		x.offset = 0
+		x.remaining -= uint64(blockRemaining)
+	}
+
+	for len(p) >= Size {
+		binary.LittleEndian.PutUint32(x.cfg[8:], x.nodeOffset)
+		x.nodeOffset++
+
+		x.d.initConfig(&x.cfg)
+		x.d.Write(x.root[:])
+		x.d.finalize(&x.block)
+
+		copy(p, x.block[:])
+		p = p[Size:]
+		x.remaining -= uint64(Size)
+	}
+
+	if todo := len(p); todo > 0 {
+		if x.remaining < uint64(Size) {
+			x.cfg[0] = byte(x.remaining)
+		}
+		binary.LittleEndian.PutUint32(x.cfg[8:], x.nodeOffset)
+		x.nodeOffset++
+
+		x.d.initConfig(&x.cfg)
+		x.d.Write(x.root[:])
+		x.d.finalize(&x.block)
+
+		x.offset = copy(p, x.block[:todo])
+		x.remaining -= uint64(todo)
+	}
+	return
+}
+
+func (d *digest) initConfig(cfg *[Size]byte) {
+	d.offset, d.c[0], d.c[1] = 0, 0, 0
+	for i := range d.h {
+		d.h[i] = iv[i] ^ binary.LittleEndian.Uint64(cfg[i*8:])
+	}
+}
diff --git a/.ci/providerlint/vendor/golang.org/x/crypto/blake2b/register.go b/.ci/providerlint/vendor/golang.org/x/crypto/blake2b/register.go
new file mode 100644
index 00000000000..9d8633963cb
--- /dev/null
+++ b/.ci/providerlint/vendor/golang.org/x/crypto/blake2b/register.go
@@ -0,0 +1,33 @@
+// Copyright 2017 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build go1.9
+// +build go1.9
+
+package blake2b
+
+import (
+	"crypto"
+	"hash"
+)
+
+func init() {
+	newHash256 := func() hash.Hash {
+		h, _ := New256(nil)
+		return h
+	}
+	newHash384 := func() hash.Hash {
+		h, _ := New384(nil)
+		return h
+	}
+
+	newHash512 := func() hash.Hash {
+		h, _ := New512(nil)
+		return h
+	}
+
+	crypto.RegisterHash(crypto.BLAKE2b_256, newHash256)
+	crypto.RegisterHash(crypto.BLAKE2b_384, newHash384)
+	crypto.RegisterHash(crypto.BLAKE2b_512, newHash512)
+}
diff --git a/.ci/providerlint/vendor/golang.org/x/crypto/hkdf/hkdf.go b/.ci/providerlint/vendor/golang.org/x/crypto/hkdf/hkdf.go
new file mode 100644
index 00000000000..dda3f143bec
--- /dev/null
+++ b/.ci/providerlint/vendor/golang.org/x/crypto/hkdf/hkdf.go
@@ -0,0 +1,93 @@
+// Copyright 2014 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// Package hkdf implements the HMAC-based Extract-and-Expand Key Derivation
+// Function (HKDF) as defined in RFC 5869.
+//
+// HKDF is a cryptographic key derivation function (KDF) with the goal of
+// expanding limited input keying material into one or more cryptographically
+// strong secret keys.
+package hkdf // import "golang.org/x/crypto/hkdf"
+
+import (
+	"crypto/hmac"
+	"errors"
+	"hash"
+	"io"
+)
+
+// Extract generates a pseudorandom key for use with Expand from an input secret
+// and an optional independent salt.
+//
+// Only use this function if you need to reuse the extracted key with multiple
+// Expand invocations and different context values. Most common scenarios,
+// including the generation of multiple keys, should use New instead.
+func Extract(hash func() hash.Hash, secret, salt []byte) []byte {
+	if salt == nil {
+		salt = make([]byte, hash().Size())
+	}
+	extractor := hmac.New(hash, salt)
+	extractor.Write(secret)
+	return extractor.Sum(nil)
+}
+
+type hkdf struct {
+	expander hash.Hash
+	size     int
+
+	info    []byte
+	counter byte
+
+	prev []byte
+	buf  []byte
+}
+
+func (f *hkdf) Read(p []byte) (int, error) {
+	// Check whether enough data can be generated
+	need := len(p)
+	remains := len(f.buf) + int(255-f.counter+1)*f.size
+	if remains < need {
+		return 0, errors.New("hkdf: entropy limit reached")
+	}
+	// Read any leftover from the buffer
+	n := copy(p, f.buf)
+	p = p[n:]
+
+	// Fill the rest of the buffer
+	for len(p) > 0 {
+		f.expander.Reset()
+		f.expander.Write(f.prev)
+		f.expander.Write(f.info)
+		f.expander.Write([]byte{f.counter})
+		f.prev = f.expander.Sum(f.prev[:0])
+		f.counter++
+
+		// Copy the new batch into p
+		f.buf = f.prev
+		n = copy(p, f.buf)
+		p = p[n:]
+	}
+	// Save leftovers for next run
+	f.buf = f.buf[n:]
+
+	return need, nil
+}
+
+// Expand returns a Reader, from which keys can be read, using the given
+// pseudorandom key and optional context info, skipping the extraction step.
+//
+// The pseudorandomKey should have been generated by Extract, or be a uniformly
+// random or pseudorandom cryptographically strong key. See RFC 5869, Section
+// 3.3. Most common scenarios will want to use New instead.
+func Expand(hash func() hash.Hash, pseudorandomKey, info []byte) io.Reader {
+	expander := hmac.New(hash, pseudorandomKey)
+	return &hkdf{expander, expander.Size(), info, 1, nil, nil}
+}
+
+// New returns a Reader, from which keys can be read, using the given hash,
+// secret, salt and context info. Salt and info can be nil.
+func New(hash func() hash.Hash, secret, salt, info []byte) io.Reader {
+	prk := Extract(hash, secret, salt)
+	return Expand(hash, prk, info)
+}
diff --git a/.ci/providerlint/vendor/golang.org/x/crypto/openpgp/errors/errors.go b/.ci/providerlint/vendor/golang.org/x/crypto/openpgp/errors/errors.go
deleted file mode 100644
index 1d7a0ea05ad..00000000000
--- a/.ci/providerlint/vendor/golang.org/x/crypto/openpgp/errors/errors.go
+++ /dev/null
@@ -1,78 +0,0 @@
-// Copyright 2010 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-// Package errors contains common error types for the OpenPGP packages.
-//
-// Deprecated: this package is unmaintained except for security fixes. New
-// applications should consider a more focused, modern alternative to OpenPGP
-// for their specific task. If you are required to interoperate with OpenPGP
-// systems and need a maintained package, consider a community fork.
-// See https://golang.org/issue/44226.
-package errors // import "golang.org/x/crypto/openpgp/errors"
-
-import (
-	"strconv"
-)
-
-// A StructuralError is returned when OpenPGP data is found to be syntactically
-// invalid.
-type StructuralError string
-
-func (s StructuralError) Error() string {
-	return "openpgp: invalid data: " + string(s)
-}
-
-// UnsupportedError indicates that, although the OpenPGP data is valid, it
-// makes use of currently unimplemented features.
-type UnsupportedError string
-
-func (s UnsupportedError) Error() string {
-	return "openpgp: unsupported feature: " + string(s)
-}
-
-// InvalidArgumentError indicates that the caller is in error and passed an
-// incorrect value.
-type InvalidArgumentError string
-
-func (i InvalidArgumentError) Error() string {
-	return "openpgp: invalid argument: " + string(i)
-}
-
-// SignatureError indicates that a syntactically valid signature failed to
-// validate.
-type SignatureError string
-
-func (b SignatureError) Error() string {
-	return "openpgp: invalid signature: " + string(b)
-}
-
-type keyIncorrectError int
-
-func (ki keyIncorrectError) Error() string {
-	return "openpgp: incorrect key"
-}
-
-var ErrKeyIncorrect error = keyIncorrectError(0)
-
-type unknownIssuerError int
-
-func (unknownIssuerError) Error() string {
-	return "openpgp: signature made by unknown entity"
-}
-
-var ErrUnknownIssuer error = unknownIssuerError(0)
-
-type keyRevokedError int
-
-func (keyRevokedError) Error() string {
-	return "openpgp: signature made by revoked key"
-}
-
-var ErrKeyRevoked error = keyRevokedError(0)
-
-type UnknownPacketTypeError uint8
-
-func (upte UnknownPacketTypeError) Error() string {
-	return "openpgp: unknown packet type: " + strconv.Itoa(int(upte))
-}
diff --git a/.ci/providerlint/vendor/golang.org/x/crypto/openpgp/keys.go b/.ci/providerlint/vendor/golang.org/x/crypto/openpgp/keys.go
deleted file mode 100644
index d62f787e9d5..00000000000
--- a/.ci/providerlint/vendor/golang.org/x/crypto/openpgp/keys.go
+++ /dev/null
@@ -1,693 +0,0 @@
-// Copyright 2011 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-package openpgp
-
-import (
-	"crypto/rsa"
-	"io"
-	"time"
-
-	"golang.org/x/crypto/openpgp/armor"
-	"golang.org/x/crypto/openpgp/errors"
-	"golang.org/x/crypto/openpgp/packet"
-)
-
-// PublicKeyType is the armor type for a PGP public key.
-var PublicKeyType = "PGP PUBLIC KEY BLOCK"
-
-// PrivateKeyType is the armor type for a PGP private key.
-var PrivateKeyType = "PGP PRIVATE KEY BLOCK"
-
-// An Entity represents the components of an OpenPGP key: a primary public key
-// (which must be a signing key), one or more identities claimed by that key,
-// and zero or more subkeys, which may be encryption keys.
-type Entity struct {
-	PrimaryKey  *packet.PublicKey
-	PrivateKey  *packet.PrivateKey
-	Identities  map[string]*Identity // indexed by Identity.Name
-	Revocations []*packet.Signature
-	Subkeys     []Subkey
-}
-
-// An Identity represents an identity claimed by an Entity and zero or more
-// assertions by other entities about that claim.
-type Identity struct {
-	Name          string // by convention, has the form "Full Name (comment) <email@example.com>"
-	UserId        *packet.UserId
-	SelfSignature *packet.Signature
-	Signatures    []*packet.Signature
-}
-
-// A Subkey is an additional public key in an Entity. Subkeys can be used for
-// encryption.
-type Subkey struct {
-	PublicKey  *packet.PublicKey
-	PrivateKey *packet.PrivateKey
-	Sig        *packet.Signature
-}
-
-// A Key identifies a specific public key in an Entity. This is either the
-// Entity's primary key or a subkey.
-type Key struct {
-	Entity        *Entity
-	PublicKey     *packet.PublicKey
-	PrivateKey    *packet.PrivateKey
-	SelfSignature *packet.Signature
-}
-
-// A KeyRing provides access to public and private keys.
-type KeyRing interface {
-	// KeysById returns the set of keys that have the given key id.
-	KeysById(id uint64) []Key
-	// KeysByIdUsage returns the set of keys with the given id
-	// that also meet the key usage given by requiredUsage.
-	// The requiredUsage is expressed as the bitwise-OR of
-	// packet.KeyFlag* values.
-	KeysByIdUsage(id uint64, requiredUsage byte) []Key
-	// DecryptionKeys returns all private keys that are valid for
-	// decryption.
-	DecryptionKeys() []Key
-}
-
-// primaryIdentity returns the Identity marked as primary or the first identity
-// if none are so marked.
-func (e *Entity) primaryIdentity() *Identity {
-	var firstIdentity *Identity
-	for _, ident := range e.Identities {
-		if firstIdentity == nil {
-			firstIdentity = ident
-		}
-		if ident.SelfSignature.IsPrimaryId != nil && *ident.SelfSignature.IsPrimaryId {
-			return ident
-		}
-	}
-	return firstIdentity
-}
-
-// encryptionKey returns the best candidate Key for encrypting a message to the
-// given Entity.
-func (e *Entity) encryptionKey(now time.Time) (Key, bool) {
-	candidateSubkey := -1
-
-	// Iterate the keys to find the newest key
-	var maxTime time.Time
-	for i, subkey := range e.Subkeys {
-		if subkey.Sig.FlagsValid &&
-			subkey.Sig.FlagEncryptCommunications &&
-			subkey.PublicKey.PubKeyAlgo.CanEncrypt() &&
-			!subkey.Sig.KeyExpired(now) &&
-			(maxTime.IsZero() || subkey.Sig.CreationTime.After(maxTime)) {
-			candidateSubkey = i
-			maxTime = subkey.Sig.CreationTime
-		}
-	}
-
-	if candidateSubkey != -1 {
-		subkey := e.Subkeys[candidateSubkey]
-		return Key{e, subkey.PublicKey, subkey.PrivateKey, subkey.Sig}, true
-	}
-
-	// If we don't have any candidate subkeys for encryption and
-	// the primary key doesn't have any usage metadata then we
-	// assume that the primary key is ok. Or, if the primary key is
-	// marked as ok to encrypt to, then we can obviously use it.
-	i := e.primaryIdentity()
-	if !i.SelfSignature.FlagsValid || i.SelfSignature.FlagEncryptCommunications &&
-		e.PrimaryKey.PubKeyAlgo.CanEncrypt() &&
-		!i.SelfSignature.KeyExpired(now) {
-		return Key{e, e.PrimaryKey, e.PrivateKey, i.SelfSignature}, true
-	}
-
-	// This Entity appears to be signing only.
-	return Key{}, false
-}
-
-// signingKey return the best candidate Key for signing a message with this
-// Entity.
-func (e *Entity) signingKey(now time.Time) (Key, bool) {
-	candidateSubkey := -1
-
-	for i, subkey := range e.Subkeys {
-		if subkey.Sig.FlagsValid &&
-			subkey.Sig.FlagSign &&
-			subkey.PublicKey.PubKeyAlgo.CanSign() &&
-			!subkey.Sig.KeyExpired(now) {
-			candidateSubkey = i
-			break
-		}
-	}
-
-	if candidateSubkey != -1 {
-		subkey := e.Subkeys[candidateSubkey]
-		return Key{e, subkey.PublicKey, subkey.PrivateKey, subkey.Sig}, true
-	}
-
-	// If we have no candidate subkey then we assume that it's ok to sign
-	// with the primary key.
-	i := e.primaryIdentity()
-	if !i.SelfSignature.FlagsValid || i.SelfSignature.FlagSign &&
-		!i.SelfSignature.KeyExpired(now) {
-		return Key{e, e.PrimaryKey, e.PrivateKey, i.SelfSignature}, true
-	}
-
-	return Key{}, false
-}
-
-// An EntityList contains one or more Entities.
-type EntityList []*Entity
-
-// KeysById returns the set of keys that have the given key id.
-func (el EntityList) KeysById(id uint64) (keys []Key) {
-	for _, e := range el {
-		if e.PrimaryKey.KeyId == id {
-			var selfSig *packet.Signature
-			for _, ident := range e.Identities {
-				if selfSig == nil {
-					selfSig = ident.SelfSignature
-				} else if ident.SelfSignature.IsPrimaryId != nil && *ident.SelfSignature.IsPrimaryId {
-					selfSig = ident.SelfSignature
-					break
-				}
-			}
-			keys = append(keys, Key{e, e.PrimaryKey, e.PrivateKey, selfSig})
-		}
-
-		for _, subKey := range e.Subkeys {
-			if subKey.PublicKey.KeyId == id {
-				keys = append(keys, Key{e, subKey.PublicKey, subKey.PrivateKey, subKey.Sig})
-			}
-		}
-	}
-	return
-}
-
-// KeysByIdUsage returns the set of keys with the given id that also meet
-// the key usage given by requiredUsage.  The requiredUsage is expressed as
-// the bitwise-OR of packet.KeyFlag* values.
-func (el EntityList) KeysByIdUsage(id uint64, requiredUsage byte) (keys []Key) {
-	for _, key := range el.KeysById(id) {
-		if len(key.Entity.Revocations) > 0 {
-			continue
-		}
-
-		if key.SelfSignature.RevocationReason != nil {
-			continue
-		}
-
-		if key.SelfSignature.FlagsValid && requiredUsage != 0 {
-			var usage byte
-			if key.SelfSignature.FlagCertify {
-				usage |= packet.KeyFlagCertify
-			}
-			if key.SelfSignature.FlagSign {
-				usage |= packet.KeyFlagSign
-			}
-			if key.SelfSignature.FlagEncryptCommunications {
-				usage |= packet.KeyFlagEncryptCommunications
-			}
-			if key.SelfSignature.FlagEncryptStorage {
-				usage |= packet.KeyFlagEncryptStorage
-			}
-			if usage&requiredUsage != requiredUsage {
-				continue
-			}
-		}
-
-		keys = append(keys, key)
-	}
-	return
-}
-
-// DecryptionKeys returns all private keys that are valid for decryption.
-func (el EntityList) DecryptionKeys() (keys []Key) {
-	for _, e := range el {
-		for _, subKey := range e.Subkeys {
-			if subKey.PrivateKey != nil && (!subKey.Sig.FlagsValid || subKey.Sig.FlagEncryptStorage || subKey.Sig.FlagEncryptCommunications) {
-				keys = append(keys, Key{e, subKey.PublicKey, subKey.PrivateKey, subKey.Sig})
-			}
-		}
-	}
-	return
-}
-
-// ReadArmoredKeyRing reads one or more public/private keys from an armor keyring file.
-func ReadArmoredKeyRing(r io.Reader) (EntityList, error) {
-	block, err := armor.Decode(r)
-	if err == io.EOF {
-		return nil, errors.InvalidArgumentError("no armored data found")
-	}
-	if err != nil {
-		return nil, err
-	}
-	if block.Type != PublicKeyType && block.Type != PrivateKeyType {
-		return nil, errors.InvalidArgumentError("expected public or private key block, got: " + block.Type)
-	}
-
-	return ReadKeyRing(block.Body)
-}
-
-// ReadKeyRing reads one or more public/private keys. Unsupported keys are
-// ignored as long as at least a single valid key is found.
-func ReadKeyRing(r io.Reader) (el EntityList, err error) {
-	packets := packet.NewReader(r)
-	var lastUnsupportedError error
-
-	for {
-		var e *Entity
-		e, err = ReadEntity(packets)
-		if err != nil {
-			// TODO: warn about skipped unsupported/unreadable keys
-			if _, ok := err.(errors.UnsupportedError); ok {
-				lastUnsupportedError = err
-				err = readToNextPublicKey(packets)
-			} else if _, ok := err.(errors.StructuralError); ok {
-				// Skip unreadable, badly-formatted keys
-				lastUnsupportedError = err
-				err = readToNextPublicKey(packets)
-			}
-			if err == io.EOF {
-				err = nil
-				break
-			}
-			if err != nil {
-				el = nil
-				break
-			}
-		} else {
-			el = append(el, e)
-		}
-	}
-
-	if len(el) == 0 && err == nil {
-		err = lastUnsupportedError
-	}
-	return
-}
-
-// readToNextPublicKey reads packets until the start of the entity and leaves
-// the first packet of the new entity in the Reader.
-func readToNextPublicKey(packets *packet.Reader) (err error) {
-	var p packet.Packet
-	for {
-		p, err = packets.Next()
-		if err == io.EOF {
-			return
-		} else if err != nil {
-			if _, ok := err.(errors.UnsupportedError); ok {
-				err = nil
-				continue
-			}
-			return
-		}
-
-		if pk, ok := p.(*packet.PublicKey); ok && !pk.IsSubkey {
-			packets.Unread(p)
-			return
-		}
-	}
-}
-
-// ReadEntity reads an entity (public key, identities, subkeys etc) from the
-// given Reader.
-func ReadEntity(packets *packet.Reader) (*Entity, error) {
-	e := new(Entity)
-	e.Identities = make(map[string]*Identity)
-
-	p, err := packets.Next()
-	if err != nil {
-		return nil, err
-	}
-
-	var ok bool
-	if e.PrimaryKey, ok = p.(*packet.PublicKey); !ok {
-		if e.PrivateKey, ok = p.(*packet.PrivateKey); !ok {
-			packets.Unread(p)
-			return nil, errors.StructuralError("first packet was not a public/private key")
-		}
-		e.PrimaryKey = &e.PrivateKey.PublicKey
-	}
-
-	if !e.PrimaryKey.PubKeyAlgo.CanSign() {
-		return nil, errors.StructuralError("primary key cannot be used for signatures")
-	}
-
-	var revocations []*packet.Signature
-EachPacket:
-	for {
-		p, err := packets.Next()
-		if err == io.EOF {
-			break
-		} else if err != nil {
-			return nil, err
-		}
-
-		switch pkt := p.(type) {
-		case *packet.UserId:
-			if err := addUserID(e, packets, pkt); err != nil {
-				return nil, err
-			}
-		case *packet.Signature:
-			if pkt.SigType == packet.SigTypeKeyRevocation {
-				revocations = append(revocations, pkt)
-			} else if pkt.SigType == packet.SigTypeDirectSignature {
-				// TODO: RFC4880 5.2.1 permits signatures
-				// directly on keys (eg. to bind additional
-				// revocation keys).
-			}
-			// Else, ignoring the signature as it does not follow anything
-			// we would know to attach it to.
-		case *packet.PrivateKey:
-			if pkt.IsSubkey == false {
-				packets.Unread(p)
-				break EachPacket
-			}
-			err = addSubkey(e, packets, &pkt.PublicKey, pkt)
-			if err != nil {
-				return nil, err
-			}
-		case *packet.PublicKey:
-			if pkt.IsSubkey == false {
-				packets.Unread(p)
-				break EachPacket
-			}
-			err = addSubkey(e, packets, pkt, nil)
-			if err != nil {
-				return nil, err
-			}
-		default:
-			// we ignore unknown packets
-		}
-	}
-
-	if len(e.Identities) == 0 {
-		return nil, errors.StructuralError("entity without any identities")
-	}
-
-	for _, revocation := range revocations {
-		err = e.PrimaryKey.VerifyRevocationSignature(revocation)
-		if err == nil {
-			e.Revocations = append(e.Revocations, revocation)
-		} else {
-			// TODO: RFC 4880 5.2.3.15 defines revocation keys.
-			return nil, errors.StructuralError("revocation signature signed by alternate key")
-		}
-	}
-
-	return e, nil
-}
-
-func addUserID(e *Entity, packets *packet.Reader, pkt *packet.UserId) error {
-	// Make a new Identity object, that we might wind up throwing away.
-	// We'll only add it if we get a valid self-signature over this
-	// userID.
-	identity := new(Identity)
-	identity.Name = pkt.Id
-	identity.UserId = pkt
-
-	for {
-		p, err := packets.Next()
-		if err == io.EOF {
-			break
-		} else if err != nil {
-			return err
-		}
-
-		sig, ok := p.(*packet.Signature)
-		if !ok {
-			packets.Unread(p)
-			break
-		}
-
-		if (sig.SigType == packet.SigTypePositiveCert || sig.SigType == packet.SigTypeGenericCert) && sig.IssuerKeyId != nil && *sig.IssuerKeyId == e.PrimaryKey.KeyId {
-			if err = e.PrimaryKey.VerifyUserIdSignature(pkt.Id, e.PrimaryKey, sig); err != nil {
-				return errors.StructuralError("user ID self-signature invalid: " + err.Error())
-			}
-			identity.SelfSignature = sig
-			e.Identities[pkt.Id] = identity
-		} else {
-			identity.Signatures = append(identity.Signatures, sig)
-		}
-	}
-
-	return nil
-}
-
-func addSubkey(e *Entity, packets *packet.Reader, pub *packet.PublicKey, priv *packet.PrivateKey) error {
-	var subKey Subkey
-	subKey.PublicKey = pub
-	subKey.PrivateKey = priv
-
-	for {
-		p, err := packets.Next()
-		if err == io.EOF {
-			break
-		} else if err != nil {
-			return errors.StructuralError("subkey signature invalid: " + err.Error())
-		}
-
-		sig, ok := p.(*packet.Signature)
-		if !ok {
-			packets.Unread(p)
-			break
-		}
-
-		if sig.SigType != packet.SigTypeSubkeyBinding && sig.SigType != packet.SigTypeSubkeyRevocation {
-			return errors.StructuralError("subkey signature with wrong type")
-		}
-
-		if err := e.PrimaryKey.VerifyKeySignature(subKey.PublicKey, sig); err != nil {
-			return errors.StructuralError("subkey signature invalid: " + err.Error())
-		}
-
-		switch sig.SigType {
-		case packet.SigTypeSubkeyRevocation:
-			subKey.Sig = sig
-		case packet.SigTypeSubkeyBinding:
-
-			if shouldReplaceSubkeySig(subKey.Sig, sig) {
-				subKey.Sig = sig
-			}
-		}
-	}
-
-	if subKey.Sig == nil {
-		return errors.StructuralError("subkey packet not followed by signature")
-	}
-
-	e.Subkeys = append(e.Subkeys, subKey)
-
-	return nil
-}
-
-func shouldReplaceSubkeySig(existingSig, potentialNewSig *packet.Signature) bool {
-	if potentialNewSig == nil {
-		return false
-	}
-
-	if existingSig == nil {
-		return true
-	}
-
-	if existingSig.SigType == packet.SigTypeSubkeyRevocation {
-		return false // never override a revocation signature
-	}
-
-	return potentialNewSig.CreationTime.After(existingSig.CreationTime)
-}
-
-const defaultRSAKeyBits = 2048
-
-// NewEntity returns an Entity that contains a fresh RSA/RSA keypair with a
-// single identity composed of the given full name, comment and email, any of
-// which may be empty but must not contain any of "()<>\x00".
-// If config is nil, sensible defaults will be used.
-func NewEntity(name, comment, email string, config *packet.Config) (*Entity, error) {
-	creationTime := config.Now()
-
-	bits := defaultRSAKeyBits
-	if config != nil && config.RSABits != 0 {
-		bits = config.RSABits
-	}
-
-	uid := packet.NewUserId(name, comment, email)
-	if uid == nil {
-		return nil, errors.InvalidArgumentError("user id field contained invalid characters")
-	}
-	signingPriv, err := rsa.GenerateKey(config.Random(), bits)
-	if err != nil {
-		return nil, err
-	}
-	encryptingPriv, err := rsa.GenerateKey(config.Random(), bits)
-	if err != nil {
-		return nil, err
-	}
-
-	e := &Entity{
-		PrimaryKey: packet.NewRSAPublicKey(creationTime, &signingPriv.PublicKey),
-		PrivateKey: packet.NewRSAPrivateKey(creationTime, signingPriv),
-		Identities: make(map[string]*Identity),
-	}
-	isPrimaryId := true
-	e.Identities[uid.Id] = &Identity{
-		Name:   uid.Id,
-		UserId: uid,
-		SelfSignature: &packet.Signature{
-			CreationTime: creationTime,
-			SigType:      packet.SigTypePositiveCert,
-			PubKeyAlgo:   packet.PubKeyAlgoRSA,
-			Hash:         config.Hash(),
-			IsPrimaryId:  &isPrimaryId,
-			FlagsValid:   true,
-			FlagSign:     true,
-			FlagCertify:  true,
-			IssuerKeyId:  &e.PrimaryKey.KeyId,
-		},
-	}
-	err = e.Identities[uid.Id].SelfSignature.SignUserId(uid.Id, e.PrimaryKey, e.PrivateKey, config)
-	if err != nil {
-		return nil, err
-	}
-
-	// If the user passes in a DefaultHash via packet.Config,
-	// set the PreferredHash for the SelfSignature.
-	if config != nil && config.DefaultHash != 0 {
-		e.Identities[uid.Id].SelfSignature.PreferredHash = []uint8{hashToHashId(config.DefaultHash)}
-	}
-
-	// Likewise for DefaultCipher.
-	if config != nil && config.DefaultCipher != 0 {
-		e.Identities[uid.Id].SelfSignature.PreferredSymmetric = []uint8{uint8(config.DefaultCipher)}
-	}
-
-	e.Subkeys = make([]Subkey, 1)
-	e.Subkeys[0] = Subkey{
-		PublicKey:  packet.NewRSAPublicKey(creationTime, &encryptingPriv.PublicKey),
-		PrivateKey: packet.NewRSAPrivateKey(creationTime, encryptingPriv),
-		Sig: &packet.Signature{
-			CreationTime:              creationTime,
-			SigType:                   packet.SigTypeSubkeyBinding,
-			PubKeyAlgo:                packet.PubKeyAlgoRSA,
-			Hash:                      config.Hash(),
-			FlagsValid:                true,
-			FlagEncryptStorage:        true,
-			FlagEncryptCommunications: true,
-			IssuerKeyId:               &e.PrimaryKey.KeyId,
-		},
-	}
-	e.Subkeys[0].PublicKey.IsSubkey = true
-	e.Subkeys[0].PrivateKey.IsSubkey = true
-	err = e.Subkeys[0].Sig.SignKey(e.Subkeys[0].PublicKey, e.PrivateKey, config)
-	if err != nil {
-		return nil, err
-	}
-	return e, nil
-}
-
-// SerializePrivate serializes an Entity, including private key material, but
-// excluding signatures from other entities, to the given Writer.
-// Identities and subkeys are re-signed in case they changed since NewEntry.
-// If config is nil, sensible defaults will be used.
-func (e *Entity) SerializePrivate(w io.Writer, config *packet.Config) (err error) {
-	err = e.PrivateKey.Serialize(w)
-	if err != nil {
-		return
-	}
-	for _, ident := range e.Identities {
-		err = ident.UserId.Serialize(w)
-		if err != nil {
-			return
-		}
-		err = ident.SelfSignature.SignUserId(ident.UserId.Id, e.PrimaryKey, e.PrivateKey, config)
-		if err != nil {
-			return
-		}
-		err = ident.SelfSignature.Serialize(w)
-		if err != nil {
-			return
-		}
-	}
-	for _, subkey := range e.Subkeys {
-		err = subkey.PrivateKey.Serialize(w)
-		if err != nil {
-			return
-		}
-		err = subkey.Sig.SignKey(subkey.PublicKey, e.PrivateKey, config)
-		if err != nil {
-			return
-		}
-		err = subkey.Sig.Serialize(w)
-		if err != nil {
-			return
-		}
-	}
-	return nil
-}
-
-// Serialize writes the public part of the given Entity to w, including
-// signatures from other entities. No private key material will be output.
-func (e *Entity) Serialize(w io.Writer) error {
-	err := e.PrimaryKey.Serialize(w)
-	if err != nil {
-		return err
-	}
-	for _, ident := range e.Identities {
-		err = ident.UserId.Serialize(w)
-		if err != nil {
-			return err
-		}
-		err = ident.SelfSignature.Serialize(w)
-		if err != nil {
-			return err
-		}
-		for _, sig := range ident.Signatures {
-			err = sig.Serialize(w)
-			if err != nil {
-				return err
-			}
-		}
-	}
-	for _, subkey := range e.Subkeys {
-		err = subkey.PublicKey.Serialize(w)
-		if err != nil {
-			return err
-		}
-		err = subkey.Sig.Serialize(w)
-		if err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-// SignIdentity adds a signature to e, from signer, attesting that identity is
-// associated with e. The provided identity must already be an element of
-// e.Identities and the private key of signer must have been decrypted if
-// necessary.
-// If config is nil, sensible defaults will be used.
-func (e *Entity) SignIdentity(identity string, signer *Entity, config *packet.Config) error {
-	if signer.PrivateKey == nil {
-		return errors.InvalidArgumentError("signing Entity must have a private key")
-	}
-	if signer.PrivateKey.Encrypted {
-		return errors.InvalidArgumentError("signing Entity's private key must be decrypted")
-	}
-	ident, ok := e.Identities[identity]
-	if !ok {
-		return errors.InvalidArgumentError("given identity string not found in Entity")
-	}
-
-	sig := &packet.Signature{
-		SigType:      packet.SigTypeGenericCert,
-		PubKeyAlgo:   signer.PrivateKey.PubKeyAlgo,
-		Hash:         config.Hash(),
-		CreationTime: config.Now(),
-		IssuerKeyId:  &signer.PrivateKey.KeyId,
-	}
-	if err := sig.SignUserId(identity, e.PrimaryKey, signer.PrivateKey, config); err != nil {
-		return err
-	}
-	ident.Signatures = append(ident.Signatures, sig)
-	return nil
-}
diff --git a/.ci/providerlint/vendor/golang.org/x/crypto/openpgp/packet/config.go b/.ci/providerlint/vendor/golang.org/x/crypto/openpgp/packet/config.go
deleted file mode 100644
index c76eecc963a..00000000000
--- a/.ci/providerlint/vendor/golang.org/x/crypto/openpgp/packet/config.go
+++ /dev/null
@@ -1,91 +0,0 @@
-// Copyright 2012 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-package packet
-
-import (
-	"crypto"
-	"crypto/rand"
-	"io"
-	"time"
-)
-
-// Config collects a number of parameters along with sensible defaults.
-// A nil *Config is valid and results in all default values.
-type Config struct {
-	// Rand provides the source of entropy.
-	// If nil, the crypto/rand Reader is used.
-	Rand io.Reader
-	// DefaultHash is the default hash function to be used.
-	// If zero, SHA-256 is used.
-	DefaultHash crypto.Hash
-	// DefaultCipher is the cipher to be used.
-	// If zero, AES-128 is used.
-	DefaultCipher CipherFunction
-	// Time returns the current time as the number of seconds since the
-	// epoch. If Time is nil, time.Now is used.
-	Time func() time.Time
-	// DefaultCompressionAlgo is the compression algorithm to be
-	// applied to the plaintext before encryption. If zero, no
-	// compression is done.
-	DefaultCompressionAlgo CompressionAlgo
-	// CompressionConfig configures the compression settings.
-	CompressionConfig *CompressionConfig
-	// S2KCount is only used for symmetric encryption. It
-	// determines the strength of the passphrase stretching when
-	// the said passphrase is hashed to produce a key. S2KCount
-	// should be between 1024 and 65011712, inclusive. If Config
-	// is nil or S2KCount is 0, the value 65536 used. Not all
-	// values in the above range can be represented. S2KCount will
-	// be rounded up to the next representable value if it cannot
-	// be encoded exactly. When set, it is strongly encrouraged to
-	// use a value that is at least 65536. See RFC 4880 Section
-	// 3.7.1.3.
-	S2KCount int
-	// RSABits is the number of bits in new RSA keys made with NewEntity.
-	// If zero, then 2048 bit keys are created.
-	RSABits int
-}
-
-func (c *Config) Random() io.Reader {
-	if c == nil || c.Rand == nil {
-		return rand.Reader
-	}
-	return c.Rand
-}
-
-func (c *Config) Hash() crypto.Hash {
-	if c == nil || uint(c.DefaultHash) == 0 {
-		return crypto.SHA256
-	}
-	return c.DefaultHash
-}
-
-func (c *Config) Cipher() CipherFunction {
-	if c == nil || uint8(c.DefaultCipher) == 0 {
-		return CipherAES128
-	}
-	return c.DefaultCipher
-}
-
-func (c *Config) Now() time.Time {
-	if c == nil || c.Time == nil {
-		return time.Now()
-	}
-	return c.Time()
-}
-
-func (c *Config) Compression() CompressionAlgo {
-	if c == nil {
-		return CompressionNone
-	}
-	return c.DefaultCompressionAlgo
-}
-
-func (c *Config) PasswordHashIterations() int {
-	if c == nil || c.S2KCount == 0 {
-		return 0
-	}
-	return c.S2KCount
-}
diff --git a/.ci/providerlint/vendor/golang.org/x/crypto/openpgp/packet/encrypted_key.go b/.ci/providerlint/vendor/golang.org/x/crypto/openpgp/packet/encrypted_key.go
deleted file mode 100644
index 6d7639722c9..00000000000
--- a/.ci/providerlint/vendor/golang.org/x/crypto/openpgp/packet/encrypted_key.go
+++ /dev/null
@@ -1,208 +0,0 @@
-// Copyright 2011 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-package packet
-
-import (
-	"crypto"
-	"crypto/rsa"
-	"encoding/binary"
-	"io"
-	"math/big"
-	"strconv"
-
-	"golang.org/x/crypto/openpgp/elgamal"
-	"golang.org/x/crypto/openpgp/errors"
-)
-
-const encryptedKeyVersion = 3
-
-// EncryptedKey represents a public-key encrypted session key. See RFC 4880,
-// section 5.1.
-type EncryptedKey struct {
-	KeyId      uint64
-	Algo       PublicKeyAlgorithm
-	CipherFunc CipherFunction // only valid after a successful Decrypt
-	Key        []byte         // only valid after a successful Decrypt
-
-	encryptedMPI1, encryptedMPI2 parsedMPI
-}
-
-func (e *EncryptedKey) parse(r io.Reader) (err error) {
-	var buf [10]byte
-	_, err = readFull(r, buf[:])
-	if err != nil {
-		return
-	}
-	if buf[0] != encryptedKeyVersion {
-		return errors.UnsupportedError("unknown EncryptedKey version " + strconv.Itoa(int(buf[0])))
-	}
-	e.KeyId = binary.BigEndian.Uint64(buf[1:9])
-	e.Algo = PublicKeyAlgorithm(buf[9])
-	switch e.Algo {
-	case PubKeyAlgoRSA, PubKeyAlgoRSAEncryptOnly:
-		e.encryptedMPI1.bytes, e.encryptedMPI1.bitLength, err = readMPI(r)
-		if err != nil {
-			return
-		}
-	case PubKeyAlgoElGamal:
-		e.encryptedMPI1.bytes, e.encryptedMPI1.bitLength, err = readMPI(r)
-		if err != nil {
-			return
-		}
-		e.encryptedMPI2.bytes, e.encryptedMPI2.bitLength, err = readMPI(r)
-		if err != nil {
-			return
-		}
-	}
-	_, err = consumeAll(r)
-	return
-}
-
-func checksumKeyMaterial(key []byte) uint16 {
-	var checksum uint16
-	for _, v := range key {
-		checksum += uint16(v)
-	}
-	return checksum
-}
-
-// Decrypt decrypts an encrypted session key with the given private key. The
-// private key must have been decrypted first.
-// If config is nil, sensible defaults will be used.
-func (e *EncryptedKey) Decrypt(priv *PrivateKey, config *Config) error {
-	var err error
-	var b []byte
-
-	// TODO(agl): use session key decryption routines here to avoid
-	// padding oracle attacks.
-	switch priv.PubKeyAlgo {
-	case PubKeyAlgoRSA, PubKeyAlgoRSAEncryptOnly:
-		// Supports both *rsa.PrivateKey and crypto.Decrypter
-		k := priv.PrivateKey.(crypto.Decrypter)
-		b, err = k.Decrypt(config.Random(), padToKeySize(k.Public().(*rsa.PublicKey), e.encryptedMPI1.bytes), nil)
-	case PubKeyAlgoElGamal:
-		c1 := new(big.Int).SetBytes(e.encryptedMPI1.bytes)
-		c2 := new(big.Int).SetBytes(e.encryptedMPI2.bytes)
-		b, err = elgamal.Decrypt(priv.PrivateKey.(*elgamal.PrivateKey), c1, c2)
-	default:
-		err = errors.InvalidArgumentError("cannot decrypted encrypted session key with private key of type " + strconv.Itoa(int(priv.PubKeyAlgo)))
-	}
-
-	if err != nil {
-		return err
-	}
-
-	e.CipherFunc = CipherFunction(b[0])
-	e.Key = b[1 : len(b)-2]
-	expectedChecksum := uint16(b[len(b)-2])<<8 | uint16(b[len(b)-1])
-	checksum := checksumKeyMaterial(e.Key)
-	if checksum != expectedChecksum {
-		return errors.StructuralError("EncryptedKey checksum incorrect")
-	}
-
-	return nil
-}
-
-// Serialize writes the encrypted key packet, e, to w.
-func (e *EncryptedKey) Serialize(w io.Writer) error {
-	var mpiLen int
-	switch e.Algo {
-	case PubKeyAlgoRSA, PubKeyAlgoRSAEncryptOnly:
-		mpiLen = 2 + len(e.encryptedMPI1.bytes)
-	case PubKeyAlgoElGamal:
-		mpiLen = 2 + len(e.encryptedMPI1.bytes) + 2 + len(e.encryptedMPI2.bytes)
-	default:
-		return errors.InvalidArgumentError("don't know how to serialize encrypted key type " + strconv.Itoa(int(e.Algo)))
-	}
-
-	serializeHeader(w, packetTypeEncryptedKey, 1 /* version */ +8 /* key id */ +1 /* algo */ +mpiLen)
-
-	w.Write([]byte{encryptedKeyVersion})
-	binary.Write(w, binary.BigEndian, e.KeyId)
-	w.Write([]byte{byte(e.Algo)})
-
-	switch e.Algo {
-	case PubKeyAlgoRSA, PubKeyAlgoRSAEncryptOnly:
-		writeMPIs(w, e.encryptedMPI1)
-	case PubKeyAlgoElGamal:
-		writeMPIs(w, e.encryptedMPI1, e.encryptedMPI2)
-	default:
-		panic("internal error")
-	}
-
-	return nil
-}
-
-// SerializeEncryptedKey serializes an encrypted key packet to w that contains
-// key, encrypted to pub.
-// If config is nil, sensible defaults will be used.
-func SerializeEncryptedKey(w io.Writer, pub *PublicKey, cipherFunc CipherFunction, key []byte, config *Config) error {
-	var buf [10]byte
-	buf[0] = encryptedKeyVersion
-	binary.BigEndian.PutUint64(buf[1:9], pub.KeyId)
-	buf[9] = byte(pub.PubKeyAlgo)
-
-	keyBlock := make([]byte, 1 /* cipher type */ +len(key)+2 /* checksum */)
-	keyBlock[0] = byte(cipherFunc)
-	copy(keyBlock[1:], key)
-	checksum := checksumKeyMaterial(key)
-	keyBlock[1+len(key)] = byte(checksum >> 8)
-	keyBlock[1+len(key)+1] = byte(checksum)
-
-	switch pub.PubKeyAlgo {
-	case PubKeyAlgoRSA, PubKeyAlgoRSAEncryptOnly:
-		return serializeEncryptedKeyRSA(w, config.Random(), buf, pub.PublicKey.(*rsa.PublicKey), keyBlock)
-	case PubKeyAlgoElGamal:
-		return serializeEncryptedKeyElGamal(w, config.Random(), buf, pub.PublicKey.(*elgamal.PublicKey), keyBlock)
-	case PubKeyAlgoDSA, PubKeyAlgoRSASignOnly:
-		return errors.InvalidArgumentError("cannot encrypt to public key of type " + strconv.Itoa(int(pub.PubKeyAlgo)))
-	}
-
-	return errors.UnsupportedError("encrypting a key to public key of type " + strconv.Itoa(int(pub.PubKeyAlgo)))
-}
-
-func serializeEncryptedKeyRSA(w io.Writer, rand io.Reader, header [10]byte, pub *rsa.PublicKey, keyBlock []byte) error {
-	cipherText, err := rsa.EncryptPKCS1v15(rand, pub, keyBlock)
-	if err != nil {
-		return errors.InvalidArgumentError("RSA encryption failed: " + err.Error())
-	}
-
-	packetLen := 10 /* header length */ + 2 /* mpi size */ + len(cipherText)
-
-	err = serializeHeader(w, packetTypeEncryptedKey, packetLen)
-	if err != nil {
-		return err
-	}
-	_, err = w.Write(header[:])
-	if err != nil {
-		return err
-	}
-	return writeMPI(w, 8*uint16(len(cipherText)), cipherText)
-}
-
-func serializeEncryptedKeyElGamal(w io.Writer, rand io.Reader, header [10]byte, pub *elgamal.PublicKey, keyBlock []byte) error {
-	c1, c2, err := elgamal.Encrypt(rand, pub, keyBlock)
-	if err != nil {
-		return errors.InvalidArgumentError("ElGamal encryption failed: " + err.Error())
-	}
-
-	packetLen := 10 /* header length */
-	packetLen += 2 /* mpi size */ + (c1.BitLen()+7)/8
-	packetLen += 2 /* mpi size */ + (c2.BitLen()+7)/8
-
-	err = serializeHeader(w, packetTypeEncryptedKey, packetLen)
-	if err != nil {
-		return err
-	}
-	_, err = w.Write(header[:])
-	if err != nil {
-		return err
-	}
-	err = writeBig(w, c1)
-	if err != nil {
-		return err
-	}
-	return writeBig(w, c2)
-}
diff --git a/.ci/providerlint/vendor/golang.org/x/crypto/openpgp/packet/packet.go b/.ci/providerlint/vendor/golang.org/x/crypto/openpgp/packet/packet.go
deleted file mode 100644
index 0a19794a8e4..00000000000
--- a/.ci/providerlint/vendor/golang.org/x/crypto/openpgp/packet/packet.go
+++ /dev/null
@@ -1,590 +0,0 @@
-// Copyright 2011 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-// Package packet implements parsing and serialization of OpenPGP packets, as
-// specified in RFC 4880.
-//
-// Deprecated: this package is unmaintained except for security fixes. New
-// applications should consider a more focused, modern alternative to OpenPGP
-// for their specific task. If you are required to interoperate with OpenPGP
-// systems and need a maintained package, consider a community fork.
-// See https://golang.org/issue/44226.
-package packet // import "golang.org/x/crypto/openpgp/packet"
-
-import (
-	"bufio"
-	"crypto/aes"
-	"crypto/cipher"
-	"crypto/des"
-	"crypto/rsa"
-	"io"
-	"math/big"
-	"math/bits"
-
-	"golang.org/x/crypto/cast5"
-	"golang.org/x/crypto/openpgp/errors"
-)
-
-// readFull is the same as io.ReadFull except that reading zero bytes returns
-// ErrUnexpectedEOF rather than EOF.
-func readFull(r io.Reader, buf []byte) (n int, err error) {
-	n, err = io.ReadFull(r, buf)
-	if err == io.EOF {
-		err = io.ErrUnexpectedEOF
-	}
-	return
-}
-
-// readLength reads an OpenPGP length from r. See RFC 4880, section 4.2.2.
-func readLength(r io.Reader) (length int64, isPartial bool, err error) {
-	var buf [4]byte
-	_, err = readFull(r, buf[:1])
-	if err != nil {
-		return
-	}
-	switch {
-	case buf[0] < 192:
-		length = int64(buf[0])
-	case buf[0] < 224:
-		length = int64(buf[0]-192) << 8
-		_, err = readFull(r, buf[0:1])
-		if err != nil {
-			return
-		}
-		length += int64(buf[0]) + 192
-	case buf[0] < 255:
-		length = int64(1) << (buf[0] & 0x1f)
-		isPartial = true
-	default:
-		_, err = readFull(r, buf[0:4])
-		if err != nil {
-			return
-		}
-		length = int64(buf[0])<<24 |
-			int64(buf[1])<<16 |
-			int64(buf[2])<<8 |
-			int64(buf[3])
-	}
-	return
-}
-
-// partialLengthReader wraps an io.Reader and handles OpenPGP partial lengths.
-// The continuation lengths are parsed and removed from the stream and EOF is
-// returned at the end of the packet. See RFC 4880, section 4.2.2.4.
-type partialLengthReader struct {
-	r         io.Reader
-	remaining int64
-	isPartial bool
-}
-
-func (r *partialLengthReader) Read(p []byte) (n int, err error) {
-	for r.remaining == 0 {
-		if !r.isPartial {
-			return 0, io.EOF
-		}
-		r.remaining, r.isPartial, err = readLength(r.r)
-		if err != nil {
-			return 0, err
-		}
-	}
-
-	toRead := int64(len(p))
-	if toRead > r.remaining {
-		toRead = r.remaining
-	}
-
-	n, err = r.r.Read(p[:int(toRead)])
-	r.remaining -= int64(n)
-	if n < int(toRead) && err == io.EOF {
-		err = io.ErrUnexpectedEOF
-	}
-	return
-}
-
-// partialLengthWriter writes a stream of data using OpenPGP partial lengths.
-// See RFC 4880, section 4.2.2.4.
-type partialLengthWriter struct {
-	w          io.WriteCloser
-	lengthByte [1]byte
-	sentFirst  bool
-	buf        []byte
-}
-
-// RFC 4880 4.2.2.4: the first partial length MUST be at least 512 octets long.
-const minFirstPartialWrite = 512
-
-func (w *partialLengthWriter) Write(p []byte) (n int, err error) {
-	off := 0
-	if !w.sentFirst {
-		if len(w.buf) > 0 || len(p) < minFirstPartialWrite {
-			off = len(w.buf)
-			w.buf = append(w.buf, p...)
-			if len(w.buf) < minFirstPartialWrite {
-				return len(p), nil
-			}
-			p = w.buf
-			w.buf = nil
-		}
-		w.sentFirst = true
-	}
-
-	power := uint8(30)
-	for len(p) > 0 {
-		l := 1 << power
-		if len(p) < l {
-			power = uint8(bits.Len32(uint32(len(p)))) - 1
-			l = 1 << power
-		}
-		w.lengthByte[0] = 224 + power
-		_, err = w.w.Write(w.lengthByte[:])
-		if err == nil {
-			var m int
-			m, err = w.w.Write(p[:l])
-			n += m
-		}
-		if err != nil {
-			if n < off {
-				return 0, err
-			}
-			return n - off, err
-		}
-		p = p[l:]
-	}
-	return n - off, nil
-}
-
-func (w *partialLengthWriter) Close() error {
-	if len(w.buf) > 0 {
-		// In this case we can't send a 512 byte packet.
-		// Just send what we have.
-		p := w.buf
-		w.sentFirst = true
-		w.buf = nil
-		if _, err := w.Write(p); err != nil {
-			return err
-		}
-	}
-
-	w.lengthByte[0] = 0
-	_, err := w.w.Write(w.lengthByte[:])
-	if err != nil {
-		return err
-	}
-	return w.w.Close()
-}
-
-// A spanReader is an io.LimitReader, but it returns ErrUnexpectedEOF if the
-// underlying Reader returns EOF before the limit has been reached.
-type spanReader struct {
-	r io.Reader
-	n int64
-}
-
-func (l *spanReader) Read(p []byte) (n int, err error) {
-	if l.n <= 0 {
-		return 0, io.EOF
-	}
-	if int64(len(p)) > l.n {
-		p = p[0:l.n]
-	}
-	n, err = l.r.Read(p)
-	l.n -= int64(n)
-	if l.n > 0 && err == io.EOF {
-		err = io.ErrUnexpectedEOF
-	}
-	return
-}
-
-// readHeader parses a packet header and returns an io.Reader which will return
-// the contents of the packet. See RFC 4880, section 4.2.
-func readHeader(r io.Reader) (tag packetType, length int64, contents io.Reader, err error) {
-	var buf [4]byte
-	_, err = io.ReadFull(r, buf[:1])
-	if err != nil {
-		return
-	}
-	if buf[0]&0x80 == 0 {
-		err = errors.StructuralError("tag byte does not have MSB set")
-		return
-	}
-	if buf[0]&0x40 == 0 {
-		// Old format packet
-		tag = packetType((buf[0] & 0x3f) >> 2)
-		lengthType := buf[0] & 3
-		if lengthType == 3 {
-			length = -1
-			contents = r
-			return
-		}
-		lengthBytes := 1 << lengthType
-		_, err = readFull(r, buf[0:lengthBytes])
-		if err != nil {
-			return
-		}
-		for i := 0; i < lengthBytes; i++ {
-			length <<= 8
-			length |= int64(buf[i])
-		}
-		contents = &spanReader{r, length}
-		return
-	}
-
-	// New format packet
-	tag = packetType(buf[0] & 0x3f)
-	length, isPartial, err := readLength(r)
-	if err != nil {
-		return
-	}
-	if isPartial {
-		contents = &partialLengthReader{
-			remaining: length,
-			isPartial: true,
-			r:         r,
-		}
-		length = -1
-	} else {
-		contents = &spanReader{r, length}
-	}
-	return
-}
-
-// serializeHeader writes an OpenPGP packet header to w. See RFC 4880, section
-// 4.2.
-func serializeHeader(w io.Writer, ptype packetType, length int) (err error) {
-	var buf [6]byte
-	var n int
-
-	buf[0] = 0x80 | 0x40 | byte(ptype)
-	if length < 192 {
-		buf[1] = byte(length)
-		n = 2
-	} else if length < 8384 {
-		length -= 192
-		buf[1] = 192 + byte(length>>8)
-		buf[2] = byte(length)
-		n = 3
-	} else {
-		buf[1] = 255
-		buf[2] = byte(length >> 24)
-		buf[3] = byte(length >> 16)
-		buf[4] = byte(length >> 8)
-		buf[5] = byte(length)
-		n = 6
-	}
-
-	_, err = w.Write(buf[:n])
-	return
-}
-
-// serializeStreamHeader writes an OpenPGP packet header to w where the
-// length of the packet is unknown. It returns a io.WriteCloser which can be
-// used to write the contents of the packet. See RFC 4880, section 4.2.
-func serializeStreamHeader(w io.WriteCloser, ptype packetType) (out io.WriteCloser, err error) {
-	var buf [1]byte
-	buf[0] = 0x80 | 0x40 | byte(ptype)
-	_, err = w.Write(buf[:])
-	if err != nil {
-		return
-	}
-	out = &partialLengthWriter{w: w}
-	return
-}
-
-// Packet represents an OpenPGP packet. Users are expected to try casting
-// instances of this interface to specific packet types.
-type Packet interface {
-	parse(io.Reader) error
-}
-
-// consumeAll reads from the given Reader until error, returning the number of
-// bytes read.
-func consumeAll(r io.Reader) (n int64, err error) {
-	var m int
-	var buf [1024]byte
-
-	for {
-		m, err = r.Read(buf[:])
-		n += int64(m)
-		if err == io.EOF {
-			err = nil
-			return
-		}
-		if err != nil {
-			return
-		}
-	}
-}
-
-// packetType represents the numeric ids of the different OpenPGP packet types. See
-// http://www.iana.org/assignments/pgp-parameters/pgp-parameters.xhtml#pgp-parameters-2
-type packetType uint8
-
-const (
-	packetTypeEncryptedKey              packetType = 1
-	packetTypeSignature                 packetType = 2
-	packetTypeSymmetricKeyEncrypted     packetType = 3
-	packetTypeOnePassSignature          packetType = 4
-	packetTypePrivateKey                packetType = 5
-	packetTypePublicKey                 packetType = 6
-	packetTypePrivateSubkey             packetType = 7
-	packetTypeCompressed                packetType = 8
-	packetTypeSymmetricallyEncrypted    packetType = 9
-	packetTypeLiteralData               packetType = 11
-	packetTypeUserId                    packetType = 13
-	packetTypePublicSubkey              packetType = 14
-	packetTypeUserAttribute             packetType = 17
-	packetTypeSymmetricallyEncryptedMDC packetType = 18
-)
-
-// peekVersion detects the version of a public key packet about to
-// be read. A bufio.Reader at the original position of the io.Reader
-// is returned.
-func peekVersion(r io.Reader) (bufr *bufio.Reader, ver byte, err error) {
-	bufr = bufio.NewReader(r)
-	var verBuf []byte
-	if verBuf, err = bufr.Peek(1); err != nil {
-		return
-	}
-	ver = verBuf[0]
-	return
-}
-
-// Read reads a single OpenPGP packet from the given io.Reader. If there is an
-// error parsing a packet, the whole packet is consumed from the input.
-func Read(r io.Reader) (p Packet, err error) {
-	tag, _, contents, err := readHeader(r)
-	if err != nil {
-		return
-	}
-
-	switch tag {
-	case packetTypeEncryptedKey:
-		p = new(EncryptedKey)
-	case packetTypeSignature:
-		var version byte
-		// Detect signature version
-		if contents, version, err = peekVersion(contents); err != nil {
-			return
-		}
-		if version < 4 {
-			p = new(SignatureV3)
-		} else {
-			p = new(Signature)
-		}
-	case packetTypeSymmetricKeyEncrypted:
-		p = new(SymmetricKeyEncrypted)
-	case packetTypeOnePassSignature:
-		p = new(OnePassSignature)
-	case packetTypePrivateKey, packetTypePrivateSubkey:
-		pk := new(PrivateKey)
-		if tag == packetTypePrivateSubkey {
-			pk.IsSubkey = true
-		}
-		p = pk
-	case packetTypePublicKey, packetTypePublicSubkey:
-		var version byte
-		if contents, version, err = peekVersion(contents); err != nil {
-			return
-		}
-		isSubkey := tag == packetTypePublicSubkey
-		if version < 4 {
-			p = &PublicKeyV3{IsSubkey: isSubkey}
-		} else {
-			p = &PublicKey{IsSubkey: isSubkey}
-		}
-	case packetTypeCompressed:
-		p = new(Compressed)
-	case packetTypeSymmetricallyEncrypted:
-		p = new(SymmetricallyEncrypted)
-	case packetTypeLiteralData:
-		p = new(LiteralData)
-	case packetTypeUserId:
-		p = new(UserId)
-	case packetTypeUserAttribute:
-		p = new(UserAttribute)
-	case packetTypeSymmetricallyEncryptedMDC:
-		se := new(SymmetricallyEncrypted)
-		se.MDC = true
-		p = se
-	default:
-		err = errors.UnknownPacketTypeError(tag)
-	}
-	if p != nil {
-		err = p.parse(contents)
-	}
-	if err != nil {
-		consumeAll(contents)
-	}
-	return
-}
-
-// SignatureType represents the different semantic meanings of an OpenPGP
-// signature. See RFC 4880, section 5.2.1.
-type SignatureType uint8
-
-const (
-	SigTypeBinary            SignatureType = 0
-	SigTypeText                            = 1
-	SigTypeGenericCert                     = 0x10
-	SigTypePersonaCert                     = 0x11
-	SigTypeCasualCert                      = 0x12
-	SigTypePositiveCert                    = 0x13
-	SigTypeSubkeyBinding                   = 0x18
-	SigTypePrimaryKeyBinding               = 0x19
-	SigTypeDirectSignature                 = 0x1F
-	SigTypeKeyRevocation                   = 0x20
-	SigTypeSubkeyRevocation                = 0x28
-)
-
-// PublicKeyAlgorithm represents the different public key system specified for
-// OpenPGP. See
-// http://www.iana.org/assignments/pgp-parameters/pgp-parameters.xhtml#pgp-parameters-12
-type PublicKeyAlgorithm uint8
-
-const (
-	PubKeyAlgoRSA     PublicKeyAlgorithm = 1
-	PubKeyAlgoElGamal PublicKeyAlgorithm = 16
-	PubKeyAlgoDSA     PublicKeyAlgorithm = 17
-	// RFC 6637, Section 5.
-	PubKeyAlgoECDH  PublicKeyAlgorithm = 18
-	PubKeyAlgoECDSA PublicKeyAlgorithm = 19
-
-	// Deprecated in RFC 4880, Section 13.5. Use key flags instead.
-	PubKeyAlgoRSAEncryptOnly PublicKeyAlgorithm = 2
-	PubKeyAlgoRSASignOnly    PublicKeyAlgorithm = 3
-)
-
-// CanEncrypt returns true if it's possible to encrypt a message to a public
-// key of the given type.
-func (pka PublicKeyAlgorithm) CanEncrypt() bool {
-	switch pka {
-	case PubKeyAlgoRSA, PubKeyAlgoRSAEncryptOnly, PubKeyAlgoElGamal:
-		return true
-	}
-	return false
-}
-
-// CanSign returns true if it's possible for a public key of the given type to
-// sign a message.
-func (pka PublicKeyAlgorithm) CanSign() bool {
-	switch pka {
-	case PubKeyAlgoRSA, PubKeyAlgoRSASignOnly, PubKeyAlgoDSA, PubKeyAlgoECDSA:
-		return true
-	}
-	return false
-}
-
-// CipherFunction represents the different block ciphers specified for OpenPGP. See
-// http://www.iana.org/assignments/pgp-parameters/pgp-parameters.xhtml#pgp-parameters-13
-type CipherFunction uint8
-
-const (
-	Cipher3DES   CipherFunction = 2
-	CipherCAST5  CipherFunction = 3
-	CipherAES128 CipherFunction = 7
-	CipherAES192 CipherFunction = 8
-	CipherAES256 CipherFunction = 9
-)
-
-// KeySize returns the key size, in bytes, of cipher.
-func (cipher CipherFunction) KeySize() int {
-	switch cipher {
-	case Cipher3DES:
-		return 24
-	case CipherCAST5:
-		return cast5.KeySize
-	case CipherAES128:
-		return 16
-	case CipherAES192:
-		return 24
-	case CipherAES256:
-		return 32
-	}
-	return 0
-}
-
-// blockSize returns the block size, in bytes, of cipher.
-func (cipher CipherFunction) blockSize() int {
-	switch cipher {
-	case Cipher3DES:
-		return des.BlockSize
-	case CipherCAST5:
-		return 8
-	case CipherAES128, CipherAES192, CipherAES256:
-		return 16
-	}
-	return 0
-}
-
-// new returns a fresh instance of the given cipher.
-func (cipher CipherFunction) new(key []byte) (block cipher.Block) {
-	switch cipher {
-	case Cipher3DES:
-		block, _ = des.NewTripleDESCipher(key)
-	case CipherCAST5:
-		block, _ = cast5.NewCipher(key)
-	case CipherAES128, CipherAES192, CipherAES256:
-		block, _ = aes.NewCipher(key)
-	}
-	return
-}
-
-// readMPI reads a big integer from r. The bit length returned is the bit
-// length that was specified in r. This is preserved so that the integer can be
-// reserialized exactly.
-func readMPI(r io.Reader) (mpi []byte, bitLength uint16, err error) {
-	var buf [2]byte
-	_, err = readFull(r, buf[0:])
-	if err != nil {
-		return
-	}
-	bitLength = uint16(buf[0])<<8 | uint16(buf[1])
-	numBytes := (int(bitLength) + 7) / 8
-	mpi = make([]byte, numBytes)
-	_, err = readFull(r, mpi)
-	// According to RFC 4880 3.2. we should check that the MPI has no leading
-	// zeroes (at least when not an encrypted MPI?), but this implementation
-	// does generate leading zeroes, so we keep accepting them.
-	return
-}
-
-// writeMPI serializes a big integer to w.
-func writeMPI(w io.Writer, bitLength uint16, mpiBytes []byte) (err error) {
-	// Note that we can produce leading zeroes, in violation of RFC 4880 3.2.
-	// Implementations seem to be tolerant of them, and stripping them would
-	// make it complex to guarantee matching re-serialization.
-	_, err = w.Write([]byte{byte(bitLength >> 8), byte(bitLength)})
-	if err == nil {
-		_, err = w.Write(mpiBytes)
-	}
-	return
-}
-
-// writeBig serializes a *big.Int to w.
-func writeBig(w io.Writer, i *big.Int) error {
-	return writeMPI(w, uint16(i.BitLen()), i.Bytes())
-}
-
-// padToKeySize left-pads a MPI with zeroes to match the length of the
-// specified RSA public.
-func padToKeySize(pub *rsa.PublicKey, b []byte) []byte {
-	k := (pub.N.BitLen() + 7) / 8
-	if len(b) >= k {
-		return b
-	}
-	bb := make([]byte, k)
-	copy(bb[len(bb)-len(b):], b)
-	return bb
-}
-
-// CompressionAlgo Represents the different compression algorithms
-// supported by OpenPGP (except for BZIP2, which is not currently
-// supported). See Section 9.3 of RFC 4880.
-type CompressionAlgo uint8
-
-const (
-	CompressionNone CompressionAlgo = 0
-	CompressionZIP  CompressionAlgo = 1
-	CompressionZLIB CompressionAlgo = 2
-)
diff --git a/.ci/providerlint/vendor/golang.org/x/crypto/openpgp/packet/private_key.go b/.ci/providerlint/vendor/golang.org/x/crypto/openpgp/packet/private_key.go
deleted file mode 100644
index 192aac376d1..00000000000
--- a/.ci/providerlint/vendor/golang.org/x/crypto/openpgp/packet/private_key.go
+++ /dev/null
@@ -1,384 +0,0 @@
-// Copyright 2011 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-package packet
-
-import (
-	"bytes"
-	"crypto"
-	"crypto/cipher"
-	"crypto/dsa"
-	"crypto/ecdsa"
-	"crypto/rsa"
-	"crypto/sha1"
-	"io"
-	"math/big"
-	"strconv"
-	"time"
-
-	"golang.org/x/crypto/openpgp/elgamal"
-	"golang.org/x/crypto/openpgp/errors"
-	"golang.org/x/crypto/openpgp/s2k"
-)
-
-// PrivateKey represents a possibly encrypted private key. See RFC 4880,
-// section 5.5.3.
-type PrivateKey struct {
-	PublicKey
-	Encrypted     bool // if true then the private key is unavailable until Decrypt has been called.
-	encryptedData []byte
-	cipher        CipherFunction
-	s2k           func(out, in []byte)
-	PrivateKey    interface{} // An *{rsa|dsa|ecdsa}.PrivateKey or crypto.Signer/crypto.Decrypter (Decryptor RSA only).
-	sha1Checksum  bool
-	iv            []byte
-}
-
-func NewRSAPrivateKey(creationTime time.Time, priv *rsa.PrivateKey) *PrivateKey {
-	pk := new(PrivateKey)
-	pk.PublicKey = *NewRSAPublicKey(creationTime, &priv.PublicKey)
-	pk.PrivateKey = priv
-	return pk
-}
-
-func NewDSAPrivateKey(creationTime time.Time, priv *dsa.PrivateKey) *PrivateKey {
-	pk := new(PrivateKey)
-	pk.PublicKey = *NewDSAPublicKey(creationTime, &priv.PublicKey)
-	pk.PrivateKey = priv
-	return pk
-}
-
-func NewElGamalPrivateKey(creationTime time.Time, priv *elgamal.PrivateKey) *PrivateKey {
-	pk := new(PrivateKey)
-	pk.PublicKey = *NewElGamalPublicKey(creationTime, &priv.PublicKey)
-	pk.PrivateKey = priv
-	return pk
-}
-
-func NewECDSAPrivateKey(creationTime time.Time, priv *ecdsa.PrivateKey) *PrivateKey {
-	pk := new(PrivateKey)
-	pk.PublicKey = *NewECDSAPublicKey(creationTime, &priv.PublicKey)
-	pk.PrivateKey = priv
-	return pk
-}
-
-// NewSignerPrivateKey creates a PrivateKey from a crypto.Signer that
-// implements RSA or ECDSA.
-func NewSignerPrivateKey(creationTime time.Time, signer crypto.Signer) *PrivateKey {
-	pk := new(PrivateKey)
-	// In general, the public Keys should be used as pointers. We still
-	// type-switch on the values, for backwards-compatibility.
-	switch pubkey := signer.Public().(type) {
-	case *rsa.PublicKey:
-		pk.PublicKey = *NewRSAPublicKey(creationTime, pubkey)
-	case rsa.PublicKey:
-		pk.PublicKey = *NewRSAPublicKey(creationTime, &pubkey)
-	case *ecdsa.PublicKey:
-		pk.PublicKey = *NewECDSAPublicKey(creationTime, pubkey)
-	case ecdsa.PublicKey:
-		pk.PublicKey = *NewECDSAPublicKey(creationTime, &pubkey)
-	default:
-		panic("openpgp: unknown crypto.Signer type in NewSignerPrivateKey")
-	}
-	pk.PrivateKey = signer
-	return pk
-}
-
-func (pk *PrivateKey) parse(r io.Reader) (err error) {
-	err = (&pk.PublicKey).parse(r)
-	if err != nil {
-		return
-	}
-	var buf [1]byte
-	_, err = readFull(r, buf[:])
-	if err != nil {
-		return
-	}
-
-	s2kType := buf[0]
-
-	switch s2kType {
-	case 0:
-		pk.s2k = nil
-		pk.Encrypted = false
-	case 254, 255:
-		_, err = readFull(r, buf[:])
-		if err != nil {
-			return
-		}
-		pk.cipher = CipherFunction(buf[0])
-		pk.Encrypted = true
-		pk.s2k, err = s2k.Parse(r)
-		if err != nil {
-			return
-		}
-		if s2kType == 254 {
-			pk.sha1Checksum = true
-		}
-	default:
-		return errors.UnsupportedError("deprecated s2k function in private key")
-	}
-
-	if pk.Encrypted {
-		blockSize := pk.cipher.blockSize()
-		if blockSize == 0 {
-			return errors.UnsupportedError("unsupported cipher in private key: " + strconv.Itoa(int(pk.cipher)))
-		}
-		pk.iv = make([]byte, blockSize)
-		_, err = readFull(r, pk.iv)
-		if err != nil {
-			return
-		}
-	}
-
-	pk.encryptedData, err = io.ReadAll(r)
-	if err != nil {
-		return
-	}
-
-	if !pk.Encrypted {
-		return pk.parsePrivateKey(pk.encryptedData)
-	}
-
-	return
-}
-
-func mod64kHash(d []byte) uint16 {
-	var h uint16
-	for _, b := range d {
-		h += uint16(b)
-	}
-	return h
-}
-
-func (pk *PrivateKey) Serialize(w io.Writer) (err error) {
-	// TODO(agl): support encrypted private keys
-	buf := bytes.NewBuffer(nil)
-	err = pk.PublicKey.serializeWithoutHeaders(buf)
-	if err != nil {
-		return
-	}
-	buf.WriteByte(0 /* no encryption */)
-
-	privateKeyBuf := bytes.NewBuffer(nil)
-
-	switch priv := pk.PrivateKey.(type) {
-	case *rsa.PrivateKey:
-		err = serializeRSAPrivateKey(privateKeyBuf, priv)
-	case *dsa.PrivateKey:
-		err = serializeDSAPrivateKey(privateKeyBuf, priv)
-	case *elgamal.PrivateKey:
-		err = serializeElGamalPrivateKey(privateKeyBuf, priv)
-	case *ecdsa.PrivateKey:
-		err = serializeECDSAPrivateKey(privateKeyBuf, priv)
-	default:
-		err = errors.InvalidArgumentError("unknown private key type")
-	}
-	if err != nil {
-		return
-	}
-
-	ptype := packetTypePrivateKey
-	contents := buf.Bytes()
-	privateKeyBytes := privateKeyBuf.Bytes()
-	if pk.IsSubkey {
-		ptype = packetTypePrivateSubkey
-	}
-	err = serializeHeader(w, ptype, len(contents)+len(privateKeyBytes)+2)
-	if err != nil {
-		return
-	}
-	_, err = w.Write(contents)
-	if err != nil {
-		return
-	}
-	_, err = w.Write(privateKeyBytes)
-	if err != nil {
-		return
-	}
-
-	checksum := mod64kHash(privateKeyBytes)
-	var checksumBytes [2]byte
-	checksumBytes[0] = byte(checksum >> 8)
-	checksumBytes[1] = byte(checksum)
-	_, err = w.Write(checksumBytes[:])
-
-	return
-}
-
-func serializeRSAPrivateKey(w io.Writer, priv *rsa.PrivateKey) error {
-	err := writeBig(w, priv.D)
-	if err != nil {
-		return err
-	}
-	err = writeBig(w, priv.Primes[1])
-	if err != nil {
-		return err
-	}
-	err = writeBig(w, priv.Primes[0])
-	if err != nil {
-		return err
-	}
-	return writeBig(w, priv.Precomputed.Qinv)
-}
-
-func serializeDSAPrivateKey(w io.Writer, priv *dsa.PrivateKey) error {
-	return writeBig(w, priv.X)
-}
-
-func serializeElGamalPrivateKey(w io.Writer, priv *elgamal.PrivateKey) error {
-	return writeBig(w, priv.X)
-}
-
-func serializeECDSAPrivateKey(w io.Writer, priv *ecdsa.PrivateKey) error {
-	return writeBig(w, priv.D)
-}
-
-// Decrypt decrypts an encrypted private key using a passphrase.
-func (pk *PrivateKey) Decrypt(passphrase []byte) error {
-	if !pk.Encrypted {
-		return nil
-	}
-
-	key := make([]byte, pk.cipher.KeySize())
-	pk.s2k(key, passphrase)
-	block := pk.cipher.new(key)
-	cfb := cipher.NewCFBDecrypter(block, pk.iv)
-
-	data := make([]byte, len(pk.encryptedData))
-	cfb.XORKeyStream(data, pk.encryptedData)
-
-	if pk.sha1Checksum {
-		if len(data) < sha1.Size {
-			return errors.StructuralError("truncated private key data")
-		}
-		h := sha1.New()
-		h.Write(data[:len(data)-sha1.Size])
-		sum := h.Sum(nil)
-		if !bytes.Equal(sum, data[len(data)-sha1.Size:]) {
-			return errors.StructuralError("private key checksum failure")
-		}
-		data = data[:len(data)-sha1.Size]
-	} else {
-		if len(data) < 2 {
-			return errors.StructuralError("truncated private key data")
-		}
-		var sum uint16
-		for i := 0; i < len(data)-2; i++ {
-			sum += uint16(data[i])
-		}
-		if data[len(data)-2] != uint8(sum>>8) ||
-			data[len(data)-1] != uint8(sum) {
-			return errors.StructuralError("private key checksum failure")
-		}
-		data = data[:len(data)-2]
-	}
-
-	return pk.parsePrivateKey(data)
-}
-
-func (pk *PrivateKey) parsePrivateKey(data []byte) (err error) {
-	switch pk.PublicKey.PubKeyAlgo {
-	case PubKeyAlgoRSA, PubKeyAlgoRSASignOnly, PubKeyAlgoRSAEncryptOnly:
-		return pk.parseRSAPrivateKey(data)
-	case PubKeyAlgoDSA:
-		return pk.parseDSAPrivateKey(data)
-	case PubKeyAlgoElGamal:
-		return pk.parseElGamalPrivateKey(data)
-	case PubKeyAlgoECDSA:
-		return pk.parseECDSAPrivateKey(data)
-	}
-	panic("impossible")
-}
-
-func (pk *PrivateKey) parseRSAPrivateKey(data []byte) (err error) {
-	rsaPub := pk.PublicKey.PublicKey.(*rsa.PublicKey)
-	rsaPriv := new(rsa.PrivateKey)
-	rsaPriv.PublicKey = *rsaPub
-
-	buf := bytes.NewBuffer(data)
-	d, _, err := readMPI(buf)
-	if err != nil {
-		return
-	}
-	p, _, err := readMPI(buf)
-	if err != nil {
-		return
-	}
-	q, _, err := readMPI(buf)
-	if err != nil {
-		return
-	}
-
-	rsaPriv.D = new(big.Int).SetBytes(d)
-	rsaPriv.Primes = make([]*big.Int, 2)
-	rsaPriv.Primes[0] = new(big.Int).SetBytes(p)
-	rsaPriv.Primes[1] = new(big.Int).SetBytes(q)
-	if err := rsaPriv.Validate(); err != nil {
-		return err
-	}
-	rsaPriv.Precompute()
-	pk.PrivateKey = rsaPriv
-	pk.Encrypted = false
-	pk.encryptedData = nil
-
-	return nil
-}
-
-func (pk *PrivateKey) parseDSAPrivateKey(data []byte) (err error) {
-	dsaPub := pk.PublicKey.PublicKey.(*dsa.PublicKey)
-	dsaPriv := new(dsa.PrivateKey)
-	dsaPriv.PublicKey = *dsaPub
-
-	buf := bytes.NewBuffer(data)
-	x, _, err := readMPI(buf)
-	if err != nil {
-		return
-	}
-
-	dsaPriv.X = new(big.Int).SetBytes(x)
-	pk.PrivateKey = dsaPriv
-	pk.Encrypted = false
-	pk.encryptedData = nil
-
-	return nil
-}
-
-func (pk *PrivateKey) parseElGamalPrivateKey(data []byte) (err error) {
-	pub := pk.PublicKey.PublicKey.(*elgamal.PublicKey)
-	priv := new(elgamal.PrivateKey)
-	priv.PublicKey = *pub
-
-	buf := bytes.NewBuffer(data)
-	x, _, err := readMPI(buf)
-	if err != nil {
-		return
-	}
-
-	priv.X = new(big.Int).SetBytes(x)
-	pk.PrivateKey = priv
-	pk.Encrypted = false
-	pk.encryptedData = nil
-
-	return nil
-}
-
-func (pk *PrivateKey) parseECDSAPrivateKey(data []byte) (err error) {
-	ecdsaPub := pk.PublicKey.PublicKey.(*ecdsa.PublicKey)
-
-	buf := bytes.NewBuffer(data)
-	d, _, err := readMPI(buf)
-	if err != nil {
-		return
-	}
-
-	pk.PrivateKey = &ecdsa.PrivateKey{
-		PublicKey: *ecdsaPub,
-		D:         new(big.Int).SetBytes(d),
-	}
-	pk.Encrypted = false
-	pk.encryptedData = nil
-
-	return nil
-}
diff --git a/.ci/providerlint/vendor/golang.org/x/crypto/openpgp/packet/public_key.go b/.ci/providerlint/vendor/golang.org/x/crypto/openpgp/packet/public_key.go
deleted file mode 100644
index fcd5f525196..00000000000
--- a/.ci/providerlint/vendor/golang.org/x/crypto/openpgp/packet/public_key.go
+++ /dev/null
@@ -1,753 +0,0 @@
-// Copyright 2011 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-package packet
-
-import (
-	"bytes"
-	"crypto"
-	"crypto/dsa"
-	"crypto/ecdsa"
-	"crypto/elliptic"
-	"crypto/rsa"
-	"crypto/sha1"
-	_ "crypto/sha256"
-	_ "crypto/sha512"
-	"encoding/binary"
-	"fmt"
-	"hash"
-	"io"
-	"math/big"
-	"strconv"
-	"time"
-
-	"golang.org/x/crypto/openpgp/elgamal"
-	"golang.org/x/crypto/openpgp/errors"
-)
-
-var (
-	// NIST curve P-256
-	oidCurveP256 []byte = []byte{0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x03, 0x01, 0x07}
-	// NIST curve P-384
-	oidCurveP384 []byte = []byte{0x2B, 0x81, 0x04, 0x00, 0x22}
-	// NIST curve P-521
-	oidCurveP521 []byte = []byte{0x2B, 0x81, 0x04, 0x00, 0x23}
-)
-
-const maxOIDLength = 8
-
-// ecdsaKey stores the algorithm-specific fields for ECDSA keys.
-// as defined in RFC 6637, Section 9.
-type ecdsaKey struct {
-	// oid contains the OID byte sequence identifying the elliptic curve used
-	oid []byte
-	// p contains the elliptic curve point that represents the public key
-	p parsedMPI
-}
-
-// parseOID reads the OID for the curve as defined in RFC 6637, Section 9.
-func parseOID(r io.Reader) (oid []byte, err error) {
-	buf := make([]byte, maxOIDLength)
-	if _, err = readFull(r, buf[:1]); err != nil {
-		return
-	}
-	oidLen := buf[0]
-	if int(oidLen) > len(buf) {
-		err = errors.UnsupportedError("invalid oid length: " + strconv.Itoa(int(oidLen)))
-		return
-	}
-	oid = buf[:oidLen]
-	_, err = readFull(r, oid)
-	return
-}
-
-func (f *ecdsaKey) parse(r io.Reader) (err error) {
-	if f.oid, err = parseOID(r); err != nil {
-		return err
-	}
-	f.p.bytes, f.p.bitLength, err = readMPI(r)
-	return
-}
-
-func (f *ecdsaKey) serialize(w io.Writer) (err error) {
-	buf := make([]byte, maxOIDLength+1)
-	buf[0] = byte(len(f.oid))
-	copy(buf[1:], f.oid)
-	if _, err = w.Write(buf[:len(f.oid)+1]); err != nil {
-		return
-	}
-	return writeMPIs(w, f.p)
-}
-
-func (f *ecdsaKey) newECDSA() (*ecdsa.PublicKey, error) {
-	var c elliptic.Curve
-	if bytes.Equal(f.oid, oidCurveP256) {
-		c = elliptic.P256()
-	} else if bytes.Equal(f.oid, oidCurveP384) {
-		c = elliptic.P384()
-	} else if bytes.Equal(f.oid, oidCurveP521) {
-		c = elliptic.P521()
-	} else {
-		return nil, errors.UnsupportedError(fmt.Sprintf("unsupported oid: %x", f.oid))
-	}
-	x, y := elliptic.Unmarshal(c, f.p.bytes)
-	if x == nil {
-		return nil, errors.UnsupportedError("failed to parse EC point")
-	}
-	return &ecdsa.PublicKey{Curve: c, X: x, Y: y}, nil
-}
-
-func (f *ecdsaKey) byteLen() int {
-	return 1 + len(f.oid) + 2 + len(f.p.bytes)
-}
-
-type kdfHashFunction byte
-type kdfAlgorithm byte
-
-// ecdhKdf stores key derivation function parameters
-// used for ECDH encryption. See RFC 6637, Section 9.
-type ecdhKdf struct {
-	KdfHash kdfHashFunction
-	KdfAlgo kdfAlgorithm
-}
-
-func (f *ecdhKdf) parse(r io.Reader) (err error) {
-	buf := make([]byte, 1)
-	if _, err = readFull(r, buf); err != nil {
-		return
-	}
-	kdfLen := int(buf[0])
-	if kdfLen < 3 {
-		return errors.UnsupportedError("Unsupported ECDH KDF length: " + strconv.Itoa(kdfLen))
-	}
-	buf = make([]byte, kdfLen)
-	if _, err = readFull(r, buf); err != nil {
-		return
-	}
-	reserved := int(buf[0])
-	f.KdfHash = kdfHashFunction(buf[1])
-	f.KdfAlgo = kdfAlgorithm(buf[2])
-	if reserved != 0x01 {
-		return errors.UnsupportedError("Unsupported KDF reserved field: " + strconv.Itoa(reserved))
-	}
-	return
-}
-
-func (f *ecdhKdf) serialize(w io.Writer) (err error) {
-	buf := make([]byte, 4)
-	// See RFC 6637, Section 9, Algorithm-Specific Fields for ECDH keys.
-	buf[0] = byte(0x03) // Length of the following fields
-	buf[1] = byte(0x01) // Reserved for future extensions, must be 1 for now
-	buf[2] = byte(f.KdfHash)
-	buf[3] = byte(f.KdfAlgo)
-	_, err = w.Write(buf[:])
-	return
-}
-
-func (f *ecdhKdf) byteLen() int {
-	return 4
-}
-
-// PublicKey represents an OpenPGP public key. See RFC 4880, section 5.5.2.
-type PublicKey struct {
-	CreationTime time.Time
-	PubKeyAlgo   PublicKeyAlgorithm
-	PublicKey    interface{} // *rsa.PublicKey, *dsa.PublicKey or *ecdsa.PublicKey
-	Fingerprint  [20]byte
-	KeyId        uint64
-	IsSubkey     bool
-
-	n, e, p, q, g, y parsedMPI
-
-	// RFC 6637 fields
-	ec   *ecdsaKey
-	ecdh *ecdhKdf
-}
-
-// signingKey provides a convenient abstraction over signature verification
-// for v3 and v4 public keys.
-type signingKey interface {
-	SerializeSignaturePrefix(io.Writer)
-	serializeWithoutHeaders(io.Writer) error
-}
-
-func fromBig(n *big.Int) parsedMPI {
-	return parsedMPI{
-		bytes:     n.Bytes(),
-		bitLength: uint16(n.BitLen()),
-	}
-}
-
-// NewRSAPublicKey returns a PublicKey that wraps the given rsa.PublicKey.
-func NewRSAPublicKey(creationTime time.Time, pub *rsa.PublicKey) *PublicKey {
-	pk := &PublicKey{
-		CreationTime: creationTime,
-		PubKeyAlgo:   PubKeyAlgoRSA,
-		PublicKey:    pub,
-		n:            fromBig(pub.N),
-		e:            fromBig(big.NewInt(int64(pub.E))),
-	}
-
-	pk.setFingerPrintAndKeyId()
-	return pk
-}
-
-// NewDSAPublicKey returns a PublicKey that wraps the given dsa.PublicKey.
-func NewDSAPublicKey(creationTime time.Time, pub *dsa.PublicKey) *PublicKey {
-	pk := &PublicKey{
-		CreationTime: creationTime,
-		PubKeyAlgo:   PubKeyAlgoDSA,
-		PublicKey:    pub,
-		p:            fromBig(pub.P),
-		q:            fromBig(pub.Q),
-		g:            fromBig(pub.G),
-		y:            fromBig(pub.Y),
-	}
-
-	pk.setFingerPrintAndKeyId()
-	return pk
-}
-
-// NewElGamalPublicKey returns a PublicKey that wraps the given elgamal.PublicKey.
-func NewElGamalPublicKey(creationTime time.Time, pub *elgamal.PublicKey) *PublicKey {
-	pk := &PublicKey{
-		CreationTime: creationTime,
-		PubKeyAlgo:   PubKeyAlgoElGamal,
-		PublicKey:    pub,
-		p:            fromBig(pub.P),
-		g:            fromBig(pub.G),
-		y:            fromBig(pub.Y),
-	}
-
-	pk.setFingerPrintAndKeyId()
-	return pk
-}
-
-func NewECDSAPublicKey(creationTime time.Time, pub *ecdsa.PublicKey) *PublicKey {
-	pk := &PublicKey{
-		CreationTime: creationTime,
-		PubKeyAlgo:   PubKeyAlgoECDSA,
-		PublicKey:    pub,
-		ec:           new(ecdsaKey),
-	}
-
-	switch pub.Curve {
-	case elliptic.P256():
-		pk.ec.oid = oidCurveP256
-	case elliptic.P384():
-		pk.ec.oid = oidCurveP384
-	case elliptic.P521():
-		pk.ec.oid = oidCurveP521
-	default:
-		panic("unknown elliptic curve")
-	}
-
-	pk.ec.p.bytes = elliptic.Marshal(pub.Curve, pub.X, pub.Y)
-
-	// The bit length is 3 (for the 0x04 specifying an uncompressed key)
-	// plus two field elements (for x and y), which are rounded up to the
-	// nearest byte. See https://tools.ietf.org/html/rfc6637#section-6
-	fieldBytes := (pub.Curve.Params().BitSize + 7) & ^7
-	pk.ec.p.bitLength = uint16(3 + fieldBytes + fieldBytes)
-
-	pk.setFingerPrintAndKeyId()
-	return pk
-}
-
-func (pk *PublicKey) parse(r io.Reader) (err error) {
-	// RFC 4880, section 5.5.2
-	var buf [6]byte
-	_, err = readFull(r, buf[:])
-	if err != nil {
-		return
-	}
-	if buf[0] != 4 {
-		return errors.UnsupportedError("public key version")
-	}
-	pk.CreationTime = time.Unix(int64(uint32(buf[1])<<24|uint32(buf[2])<<16|uint32(buf[3])<<8|uint32(buf[4])), 0)
-	pk.PubKeyAlgo = PublicKeyAlgorithm(buf[5])
-	switch pk.PubKeyAlgo {
-	case PubKeyAlgoRSA, PubKeyAlgoRSAEncryptOnly, PubKeyAlgoRSASignOnly:
-		err = pk.parseRSA(r)
-	case PubKeyAlgoDSA:
-		err = pk.parseDSA(r)
-	case PubKeyAlgoElGamal:
-		err = pk.parseElGamal(r)
-	case PubKeyAlgoECDSA:
-		pk.ec = new(ecdsaKey)
-		if err = pk.ec.parse(r); err != nil {
-			return err
-		}
-		pk.PublicKey, err = pk.ec.newECDSA()
-	case PubKeyAlgoECDH:
-		pk.ec = new(ecdsaKey)
-		if err = pk.ec.parse(r); err != nil {
-			return
-		}
-		pk.ecdh = new(ecdhKdf)
-		if err = pk.ecdh.parse(r); err != nil {
-			return
-		}
-		// The ECDH key is stored in an ecdsa.PublicKey for convenience.
-		pk.PublicKey, err = pk.ec.newECDSA()
-	default:
-		err = errors.UnsupportedError("public key type: " + strconv.Itoa(int(pk.PubKeyAlgo)))
-	}
-	if err != nil {
-		return
-	}
-
-	pk.setFingerPrintAndKeyId()
-	return
-}
-
-func (pk *PublicKey) setFingerPrintAndKeyId() {
-	// RFC 4880, section 12.2
-	fingerPrint := sha1.New()
-	pk.SerializeSignaturePrefix(fingerPrint)
-	pk.serializeWithoutHeaders(fingerPrint)
-	copy(pk.Fingerprint[:], fingerPrint.Sum(nil))
-	pk.KeyId = binary.BigEndian.Uint64(pk.Fingerprint[12:20])
-}
-
-// parseRSA parses RSA public key material from the given Reader. See RFC 4880,
-// section 5.5.2.
-func (pk *PublicKey) parseRSA(r io.Reader) (err error) {
-	pk.n.bytes, pk.n.bitLength, err = readMPI(r)
-	if err != nil {
-		return
-	}
-	pk.e.bytes, pk.e.bitLength, err = readMPI(r)
-	if err != nil {
-		return
-	}
-
-	if len(pk.e.bytes) > 3 {
-		err = errors.UnsupportedError("large public exponent")
-		return
-	}
-	rsa := &rsa.PublicKey{
-		N: new(big.Int).SetBytes(pk.n.bytes),
-		E: 0,
-	}
-	for i := 0; i < len(pk.e.bytes); i++ {
-		rsa.E <<= 8
-		rsa.E |= int(pk.e.bytes[i])
-	}
-	pk.PublicKey = rsa
-	return
-}
-
-// parseDSA parses DSA public key material from the given Reader. See RFC 4880,
-// section 5.5.2.
-func (pk *PublicKey) parseDSA(r io.Reader) (err error) {
-	pk.p.bytes, pk.p.bitLength, err = readMPI(r)
-	if err != nil {
-		return
-	}
-	pk.q.bytes, pk.q.bitLength, err = readMPI(r)
-	if err != nil {
-		return
-	}
-	pk.g.bytes, pk.g.bitLength, err = readMPI(r)
-	if err != nil {
-		return
-	}
-	pk.y.bytes, pk.y.bitLength, err = readMPI(r)
-	if err != nil {
-		return
-	}
-
-	dsa := new(dsa.PublicKey)
-	dsa.P = new(big.Int).SetBytes(pk.p.bytes)
-	dsa.Q = new(big.Int).SetBytes(pk.q.bytes)
-	dsa.G = new(big.Int).SetBytes(pk.g.bytes)
-	dsa.Y = new(big.Int).SetBytes(pk.y.bytes)
-	pk.PublicKey = dsa
-	return
-}
-
-// parseElGamal parses ElGamal public key material from the given Reader. See
-// RFC 4880, section 5.5.2.
-func (pk *PublicKey) parseElGamal(r io.Reader) (err error) {
-	pk.p.bytes, pk.p.bitLength, err = readMPI(r)
-	if err != nil {
-		return
-	}
-	pk.g.bytes, pk.g.bitLength, err = readMPI(r)
-	if err != nil {
-		return
-	}
-	pk.y.bytes, pk.y.bitLength, err = readMPI(r)
-	if err != nil {
-		return
-	}
-
-	elgamal := new(elgamal.PublicKey)
-	elgamal.P = new(big.Int).SetBytes(pk.p.bytes)
-	elgamal.G = new(big.Int).SetBytes(pk.g.bytes)
-	elgamal.Y = new(big.Int).SetBytes(pk.y.bytes)
-	pk.PublicKey = elgamal
-	return
-}
-
-// SerializeSignaturePrefix writes the prefix for this public key to the given Writer.
-// The prefix is used when calculating a signature over this public key. See
-// RFC 4880, section 5.2.4.
-func (pk *PublicKey) SerializeSignaturePrefix(h io.Writer) {
-	var pLength uint16
-	switch pk.PubKeyAlgo {
-	case PubKeyAlgoRSA, PubKeyAlgoRSAEncryptOnly, PubKeyAlgoRSASignOnly:
-		pLength += 2 + uint16(len(pk.n.bytes))
-		pLength += 2 + uint16(len(pk.e.bytes))
-	case PubKeyAlgoDSA:
-		pLength += 2 + uint16(len(pk.p.bytes))
-		pLength += 2 + uint16(len(pk.q.bytes))
-		pLength += 2 + uint16(len(pk.g.bytes))
-		pLength += 2 + uint16(len(pk.y.bytes))
-	case PubKeyAlgoElGamal:
-		pLength += 2 + uint16(len(pk.p.bytes))
-		pLength += 2 + uint16(len(pk.g.bytes))
-		pLength += 2 + uint16(len(pk.y.bytes))
-	case PubKeyAlgoECDSA:
-		pLength += uint16(pk.ec.byteLen())
-	case PubKeyAlgoECDH:
-		pLength += uint16(pk.ec.byteLen())
-		pLength += uint16(pk.ecdh.byteLen())
-	default:
-		panic("unknown public key algorithm")
-	}
-	pLength += 6
-	h.Write([]byte{0x99, byte(pLength >> 8), byte(pLength)})
-	return
-}
-
-func (pk *PublicKey) Serialize(w io.Writer) (err error) {
-	length := 6 // 6 byte header
-
-	switch pk.PubKeyAlgo {
-	case PubKeyAlgoRSA, PubKeyAlgoRSAEncryptOnly, PubKeyAlgoRSASignOnly:
-		length += 2 + len(pk.n.bytes)
-		length += 2 + len(pk.e.bytes)
-	case PubKeyAlgoDSA:
-		length += 2 + len(pk.p.bytes)
-		length += 2 + len(pk.q.bytes)
-		length += 2 + len(pk.g.bytes)
-		length += 2 + len(pk.y.bytes)
-	case PubKeyAlgoElGamal:
-		length += 2 + len(pk.p.bytes)
-		length += 2 + len(pk.g.bytes)
-		length += 2 + len(pk.y.bytes)
-	case PubKeyAlgoECDSA:
-		length += pk.ec.byteLen()
-	case PubKeyAlgoECDH:
-		length += pk.ec.byteLen()
-		length += pk.ecdh.byteLen()
-	default:
-		panic("unknown public key algorithm")
-	}
-
-	packetType := packetTypePublicKey
-	if pk.IsSubkey {
-		packetType = packetTypePublicSubkey
-	}
-	err = serializeHeader(w, packetType, length)
-	if err != nil {
-		return
-	}
-	return pk.serializeWithoutHeaders(w)
-}
-
-// serializeWithoutHeaders marshals the PublicKey to w in the form of an
-// OpenPGP public key packet, not including the packet header.
-func (pk *PublicKey) serializeWithoutHeaders(w io.Writer) (err error) {
-	var buf [6]byte
-	buf[0] = 4
-	t := uint32(pk.CreationTime.Unix())
-	buf[1] = byte(t >> 24)
-	buf[2] = byte(t >> 16)
-	buf[3] = byte(t >> 8)
-	buf[4] = byte(t)
-	buf[5] = byte(pk.PubKeyAlgo)
-
-	_, err = w.Write(buf[:])
-	if err != nil {
-		return
-	}
-
-	switch pk.PubKeyAlgo {
-	case PubKeyAlgoRSA, PubKeyAlgoRSAEncryptOnly, PubKeyAlgoRSASignOnly:
-		return writeMPIs(w, pk.n, pk.e)
-	case PubKeyAlgoDSA:
-		return writeMPIs(w, pk.p, pk.q, pk.g, pk.y)
-	case PubKeyAlgoElGamal:
-		return writeMPIs(w, pk.p, pk.g, pk.y)
-	case PubKeyAlgoECDSA:
-		return pk.ec.serialize(w)
-	case PubKeyAlgoECDH:
-		if err = pk.ec.serialize(w); err != nil {
-			return
-		}
-		return pk.ecdh.serialize(w)
-	}
-	return errors.InvalidArgumentError("bad public-key algorithm")
-}
-
-// CanSign returns true iff this public key can generate signatures
-func (pk *PublicKey) CanSign() bool {
-	return pk.PubKeyAlgo != PubKeyAlgoRSAEncryptOnly && pk.PubKeyAlgo != PubKeyAlgoElGamal
-}
-
-// VerifySignature returns nil iff sig is a valid signature, made by this
-// public key, of the data hashed into signed. signed is mutated by this call.
-func (pk *PublicKey) VerifySignature(signed hash.Hash, sig *Signature) (err error) {
-	if !pk.CanSign() {
-		return errors.InvalidArgumentError("public key cannot generate signatures")
-	}
-
-	signed.Write(sig.HashSuffix)
-	hashBytes := signed.Sum(nil)
-
-	if hashBytes[0] != sig.HashTag[0] || hashBytes[1] != sig.HashTag[1] {
-		return errors.SignatureError("hash tag doesn't match")
-	}
-
-	if pk.PubKeyAlgo != sig.PubKeyAlgo {
-		return errors.InvalidArgumentError("public key and signature use different algorithms")
-	}
-
-	switch pk.PubKeyAlgo {
-	case PubKeyAlgoRSA, PubKeyAlgoRSASignOnly:
-		rsaPublicKey, _ := pk.PublicKey.(*rsa.PublicKey)
-		err = rsa.VerifyPKCS1v15(rsaPublicKey, sig.Hash, hashBytes, padToKeySize(rsaPublicKey, sig.RSASignature.bytes))
-		if err != nil {
-			return errors.SignatureError("RSA verification failure")
-		}
-		return nil
-	case PubKeyAlgoDSA:
-		dsaPublicKey, _ := pk.PublicKey.(*dsa.PublicKey)
-		// Need to truncate hashBytes to match FIPS 186-3 section 4.6.
-		subgroupSize := (dsaPublicKey.Q.BitLen() + 7) / 8
-		if len(hashBytes) > subgroupSize {
-			hashBytes = hashBytes[:subgroupSize]
-		}
-		if !dsa.Verify(dsaPublicKey, hashBytes, new(big.Int).SetBytes(sig.DSASigR.bytes), new(big.Int).SetBytes(sig.DSASigS.bytes)) {
-			return errors.SignatureError("DSA verification failure")
-		}
-		return nil
-	case PubKeyAlgoECDSA:
-		ecdsaPublicKey := pk.PublicKey.(*ecdsa.PublicKey)
-		if !ecdsa.Verify(ecdsaPublicKey, hashBytes, new(big.Int).SetBytes(sig.ECDSASigR.bytes), new(big.Int).SetBytes(sig.ECDSASigS.bytes)) {
-			return errors.SignatureError("ECDSA verification failure")
-		}
-		return nil
-	default:
-		return errors.SignatureError("Unsupported public key algorithm used in signature")
-	}
-}
-
-// VerifySignatureV3 returns nil iff sig is a valid signature, made by this
-// public key, of the data hashed into signed. signed is mutated by this call.
-func (pk *PublicKey) VerifySignatureV3(signed hash.Hash, sig *SignatureV3) (err error) {
-	if !pk.CanSign() {
-		return errors.InvalidArgumentError("public key cannot generate signatures")
-	}
-
-	suffix := make([]byte, 5)
-	suffix[0] = byte(sig.SigType)
-	binary.BigEndian.PutUint32(suffix[1:], uint32(sig.CreationTime.Unix()))
-	signed.Write(suffix)
-	hashBytes := signed.Sum(nil)
-
-	if hashBytes[0] != sig.HashTag[0] || hashBytes[1] != sig.HashTag[1] {
-		return errors.SignatureError("hash tag doesn't match")
-	}
-
-	if pk.PubKeyAlgo != sig.PubKeyAlgo {
-		return errors.InvalidArgumentError("public key and signature use different algorithms")
-	}
-
-	switch pk.PubKeyAlgo {
-	case PubKeyAlgoRSA, PubKeyAlgoRSASignOnly:
-		rsaPublicKey := pk.PublicKey.(*rsa.PublicKey)
-		if err = rsa.VerifyPKCS1v15(rsaPublicKey, sig.Hash, hashBytes, padToKeySize(rsaPublicKey, sig.RSASignature.bytes)); err != nil {
-			return errors.SignatureError("RSA verification failure")
-		}
-		return
-	case PubKeyAlgoDSA:
-		dsaPublicKey := pk.PublicKey.(*dsa.PublicKey)
-		// Need to truncate hashBytes to match FIPS 186-3 section 4.6.
-		subgroupSize := (dsaPublicKey.Q.BitLen() + 7) / 8
-		if len(hashBytes) > subgroupSize {
-			hashBytes = hashBytes[:subgroupSize]
-		}
-		if !dsa.Verify(dsaPublicKey, hashBytes, new(big.Int).SetBytes(sig.DSASigR.bytes), new(big.Int).SetBytes(sig.DSASigS.bytes)) {
-			return errors.SignatureError("DSA verification failure")
-		}
-		return nil
-	default:
-		panic("shouldn't happen")
-	}
-}
-
-// keySignatureHash returns a Hash of the message that needs to be signed for
-// pk to assert a subkey relationship to signed.
-func keySignatureHash(pk, signed signingKey, hashFunc crypto.Hash) (h hash.Hash, err error) {
-	if !hashFunc.Available() {
-		return nil, errors.UnsupportedError("hash function")
-	}
-	h = hashFunc.New()
-
-	// RFC 4880, section 5.2.4
-	pk.SerializeSignaturePrefix(h)
-	pk.serializeWithoutHeaders(h)
-	signed.SerializeSignaturePrefix(h)
-	signed.serializeWithoutHeaders(h)
-	return
-}
-
-// VerifyKeySignature returns nil iff sig is a valid signature, made by this
-// public key, of signed.
-func (pk *PublicKey) VerifyKeySignature(signed *PublicKey, sig *Signature) error {
-	h, err := keySignatureHash(pk, signed, sig.Hash)
-	if err != nil {
-		return err
-	}
-	if err = pk.VerifySignature(h, sig); err != nil {
-		return err
-	}
-
-	if sig.FlagSign {
-		// Signing subkeys must be cross-signed. See
-		// https://www.gnupg.org/faq/subkey-cross-certify.html.
-		if sig.EmbeddedSignature == nil {
-			return errors.StructuralError("signing subkey is missing cross-signature")
-		}
-		// Verify the cross-signature. This is calculated over the same
-		// data as the main signature, so we cannot just recursively
-		// call signed.VerifyKeySignature(...)
-		if h, err = keySignatureHash(pk, signed, sig.EmbeddedSignature.Hash); err != nil {
-			return errors.StructuralError("error while hashing for cross-signature: " + err.Error())
-		}
-		if err := signed.VerifySignature(h, sig.EmbeddedSignature); err != nil {
-			return errors.StructuralError("error while verifying cross-signature: " + err.Error())
-		}
-	}
-
-	return nil
-}
-
-func keyRevocationHash(pk signingKey, hashFunc crypto.Hash) (h hash.Hash, err error) {
-	if !hashFunc.Available() {
-		return nil, errors.UnsupportedError("hash function")
-	}
-	h = hashFunc.New()
-
-	// RFC 4880, section 5.2.4
-	pk.SerializeSignaturePrefix(h)
-	pk.serializeWithoutHeaders(h)
-
-	return
-}
-
-// VerifyRevocationSignature returns nil iff sig is a valid signature, made by this
-// public key.
-func (pk *PublicKey) VerifyRevocationSignature(sig *Signature) (err error) {
-	h, err := keyRevocationHash(pk, sig.Hash)
-	if err != nil {
-		return err
-	}
-	return pk.VerifySignature(h, sig)
-}
-
-// userIdSignatureHash returns a Hash of the message that needs to be signed
-// to assert that pk is a valid key for id.
-func userIdSignatureHash(id string, pk *PublicKey, hashFunc crypto.Hash) (h hash.Hash, err error) {
-	if !hashFunc.Available() {
-		return nil, errors.UnsupportedError("hash function")
-	}
-	h = hashFunc.New()
-
-	// RFC 4880, section 5.2.4
-	pk.SerializeSignaturePrefix(h)
-	pk.serializeWithoutHeaders(h)
-
-	var buf [5]byte
-	buf[0] = 0xb4
-	buf[1] = byte(len(id) >> 24)
-	buf[2] = byte(len(id) >> 16)
-	buf[3] = byte(len(id) >> 8)
-	buf[4] = byte(len(id))
-	h.Write(buf[:])
-	h.Write([]byte(id))
-
-	return
-}
-
-// VerifyUserIdSignature returns nil iff sig is a valid signature, made by this
-// public key, that id is the identity of pub.
-func (pk *PublicKey) VerifyUserIdSignature(id string, pub *PublicKey, sig *Signature) (err error) {
-	h, err := userIdSignatureHash(id, pub, sig.Hash)
-	if err != nil {
-		return err
-	}
-	return pk.VerifySignature(h, sig)
-}
-
-// VerifyUserIdSignatureV3 returns nil iff sig is a valid signature, made by this
-// public key, that id is the identity of pub.
-func (pk *PublicKey) VerifyUserIdSignatureV3(id string, pub *PublicKey, sig *SignatureV3) (err error) {
-	h, err := userIdSignatureV3Hash(id, pub, sig.Hash)
-	if err != nil {
-		return err
-	}
-	return pk.VerifySignatureV3(h, sig)
-}
-
-// KeyIdString returns the public key's fingerprint in capital hex
-// (e.g. "6C7EE1B8621CC013").
-func (pk *PublicKey) KeyIdString() string {
-	return fmt.Sprintf("%X", pk.Fingerprint[12:20])
-}
-
-// KeyIdShortString returns the short form of public key's fingerprint
-// in capital hex, as shown by gpg --list-keys (e.g. "621CC013").
-func (pk *PublicKey) KeyIdShortString() string {
-	return fmt.Sprintf("%X", pk.Fingerprint[16:20])
-}
-
-// A parsedMPI is used to store the contents of a big integer, along with the
-// bit length that was specified in the original input. This allows the MPI to
-// be reserialized exactly.
-type parsedMPI struct {
-	bytes     []byte
-	bitLength uint16
-}
-
-// writeMPIs is a utility function for serializing several big integers to the
-// given Writer.
-func writeMPIs(w io.Writer, mpis ...parsedMPI) (err error) {
-	for _, mpi := range mpis {
-		err = writeMPI(w, mpi.bitLength, mpi.bytes)
-		if err != nil {
-			return
-		}
-	}
-	return
-}
-
-// BitLength returns the bit length for the given public key.
-func (pk *PublicKey) BitLength() (bitLength uint16, err error) {
-	switch pk.PubKeyAlgo {
-	case PubKeyAlgoRSA, PubKeyAlgoRSAEncryptOnly, PubKeyAlgoRSASignOnly:
-		bitLength = pk.n.bitLength
-	case PubKeyAlgoDSA:
-		bitLength = pk.p.bitLength
-	case PubKeyAlgoElGamal:
-		bitLength = pk.p.bitLength
-	default:
-		err = errors.InvalidArgumentError("bad public-key algorithm")
-	}
-	return
-}
diff --git a/.ci/providerlint/vendor/golang.org/x/crypto/openpgp/packet/public_key_v3.go b/.ci/providerlint/vendor/golang.org/x/crypto/openpgp/packet/public_key_v3.go
deleted file mode 100644
index 5daf7b6cfd4..00000000000
--- a/.ci/providerlint/vendor/golang.org/x/crypto/openpgp/packet/public_key_v3.go
+++ /dev/null
@@ -1,279 +0,0 @@
-// Copyright 2013 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-package packet
-
-import (
-	"crypto"
-	"crypto/md5"
-	"crypto/rsa"
-	"encoding/binary"
-	"fmt"
-	"hash"
-	"io"
-	"math/big"
-	"strconv"
-	"time"
-
-	"golang.org/x/crypto/openpgp/errors"
-)
-
-// PublicKeyV3 represents older, version 3 public keys. These keys are less secure and
-// should not be used for signing or encrypting. They are supported here only for
-// parsing version 3 key material and validating signatures.
-// See RFC 4880, section 5.5.2.
-type PublicKeyV3 struct {
-	CreationTime time.Time
-	DaysToExpire uint16
-	PubKeyAlgo   PublicKeyAlgorithm
-	PublicKey    *rsa.PublicKey
-	Fingerprint  [16]byte
-	KeyId        uint64
-	IsSubkey     bool
-
-	n, e parsedMPI
-}
-
-// newRSAPublicKeyV3 returns a PublicKey that wraps the given rsa.PublicKey.
-// Included here for testing purposes only. RFC 4880, section 5.5.2:
-// "an implementation MUST NOT generate a V3 key, but MAY accept it."
-func newRSAPublicKeyV3(creationTime time.Time, pub *rsa.PublicKey) *PublicKeyV3 {
-	pk := &PublicKeyV3{
-		CreationTime: creationTime,
-		PublicKey:    pub,
-		n:            fromBig(pub.N),
-		e:            fromBig(big.NewInt(int64(pub.E))),
-	}
-
-	pk.setFingerPrintAndKeyId()
-	return pk
-}
-
-func (pk *PublicKeyV3) parse(r io.Reader) (err error) {
-	// RFC 4880, section 5.5.2
-	var buf [8]byte
-	if _, err = readFull(r, buf[:]); err != nil {
-		return
-	}
-	if buf[0] < 2 || buf[0] > 3 {
-		return errors.UnsupportedError("public key version")
-	}
-	pk.CreationTime = time.Unix(int64(uint32(buf[1])<<24|uint32(buf[2])<<16|uint32(buf[3])<<8|uint32(buf[4])), 0)
-	pk.DaysToExpire = binary.BigEndian.Uint16(buf[5:7])
-	pk.PubKeyAlgo = PublicKeyAlgorithm(buf[7])
-	switch pk.PubKeyAlgo {
-	case PubKeyAlgoRSA, PubKeyAlgoRSAEncryptOnly, PubKeyAlgoRSASignOnly:
-		err = pk.parseRSA(r)
-	default:
-		err = errors.UnsupportedError("public key type: " + strconv.Itoa(int(pk.PubKeyAlgo)))
-	}
-	if err != nil {
-		return
-	}
-
-	pk.setFingerPrintAndKeyId()
-	return
-}
-
-func (pk *PublicKeyV3) setFingerPrintAndKeyId() {
-	// RFC 4880, section 12.2
-	fingerPrint := md5.New()
-	fingerPrint.Write(pk.n.bytes)
-	fingerPrint.Write(pk.e.bytes)
-	fingerPrint.Sum(pk.Fingerprint[:0])
-	pk.KeyId = binary.BigEndian.Uint64(pk.n.bytes[len(pk.n.bytes)-8:])
-}
-
-// parseRSA parses RSA public key material from the given Reader. See RFC 4880,
-// section 5.5.2.
-func (pk *PublicKeyV3) parseRSA(r io.Reader) (err error) {
-	if pk.n.bytes, pk.n.bitLength, err = readMPI(r); err != nil {
-		return
-	}
-	if pk.e.bytes, pk.e.bitLength, err = readMPI(r); err != nil {
-		return
-	}
-
-	// RFC 4880 Section 12.2 requires the low 8 bytes of the
-	// modulus to form the key id.
-	if len(pk.n.bytes) < 8 {
-		return errors.StructuralError("v3 public key modulus is too short")
-	}
-	if len(pk.e.bytes) > 3 {
-		err = errors.UnsupportedError("large public exponent")
-		return
-	}
-	rsa := &rsa.PublicKey{N: new(big.Int).SetBytes(pk.n.bytes)}
-	for i := 0; i < len(pk.e.bytes); i++ {
-		rsa.E <<= 8
-		rsa.E |= int(pk.e.bytes[i])
-	}
-	pk.PublicKey = rsa
-	return
-}
-
-// SerializeSignaturePrefix writes the prefix for this public key to the given Writer.
-// The prefix is used when calculating a signature over this public key. See
-// RFC 4880, section 5.2.4.
-func (pk *PublicKeyV3) SerializeSignaturePrefix(w io.Writer) {
-	var pLength uint16
-	switch pk.PubKeyAlgo {
-	case PubKeyAlgoRSA, PubKeyAlgoRSAEncryptOnly, PubKeyAlgoRSASignOnly:
-		pLength += 2 + uint16(len(pk.n.bytes))
-		pLength += 2 + uint16(len(pk.e.bytes))
-	default:
-		panic("unknown public key algorithm")
-	}
-	pLength += 6
-	w.Write([]byte{0x99, byte(pLength >> 8), byte(pLength)})
-	return
-}
-
-func (pk *PublicKeyV3) Serialize(w io.Writer) (err error) {
-	length := 8 // 8 byte header
-
-	switch pk.PubKeyAlgo {
-	case PubKeyAlgoRSA, PubKeyAlgoRSAEncryptOnly, PubKeyAlgoRSASignOnly:
-		length += 2 + len(pk.n.bytes)
-		length += 2 + len(pk.e.bytes)
-	default:
-		panic("unknown public key algorithm")
-	}
-
-	packetType := packetTypePublicKey
-	if pk.IsSubkey {
-		packetType = packetTypePublicSubkey
-	}
-	if err = serializeHeader(w, packetType, length); err != nil {
-		return
-	}
-	return pk.serializeWithoutHeaders(w)
-}
-
-// serializeWithoutHeaders marshals the PublicKey to w in the form of an
-// OpenPGP public key packet, not including the packet header.
-func (pk *PublicKeyV3) serializeWithoutHeaders(w io.Writer) (err error) {
-	var buf [8]byte
-	// Version 3
-	buf[0] = 3
-	// Creation time
-	t := uint32(pk.CreationTime.Unix())
-	buf[1] = byte(t >> 24)
-	buf[2] = byte(t >> 16)
-	buf[3] = byte(t >> 8)
-	buf[4] = byte(t)
-	// Days to expire
-	buf[5] = byte(pk.DaysToExpire >> 8)
-	buf[6] = byte(pk.DaysToExpire)
-	// Public key algorithm
-	buf[7] = byte(pk.PubKeyAlgo)
-
-	if _, err = w.Write(buf[:]); err != nil {
-		return
-	}
-
-	switch pk.PubKeyAlgo {
-	case PubKeyAlgoRSA, PubKeyAlgoRSAEncryptOnly, PubKeyAlgoRSASignOnly:
-		return writeMPIs(w, pk.n, pk.e)
-	}
-	return errors.InvalidArgumentError("bad public-key algorithm")
-}
-
-// CanSign returns true iff this public key can generate signatures
-func (pk *PublicKeyV3) CanSign() bool {
-	return pk.PubKeyAlgo != PubKeyAlgoRSAEncryptOnly
-}
-
-// VerifySignatureV3 returns nil iff sig is a valid signature, made by this
-// public key, of the data hashed into signed. signed is mutated by this call.
-func (pk *PublicKeyV3) VerifySignatureV3(signed hash.Hash, sig *SignatureV3) (err error) {
-	if !pk.CanSign() {
-		return errors.InvalidArgumentError("public key cannot generate signatures")
-	}
-
-	suffix := make([]byte, 5)
-	suffix[0] = byte(sig.SigType)
-	binary.BigEndian.PutUint32(suffix[1:], uint32(sig.CreationTime.Unix()))
-	signed.Write(suffix)
-	hashBytes := signed.Sum(nil)
-
-	if hashBytes[0] != sig.HashTag[0] || hashBytes[1] != sig.HashTag[1] {
-		return errors.SignatureError("hash tag doesn't match")
-	}
-
-	if pk.PubKeyAlgo != sig.PubKeyAlgo {
-		return errors.InvalidArgumentError("public key and signature use different algorithms")
-	}
-
-	switch pk.PubKeyAlgo {
-	case PubKeyAlgoRSA, PubKeyAlgoRSASignOnly:
-		if err = rsa.VerifyPKCS1v15(pk.PublicKey, sig.Hash, hashBytes, sig.RSASignature.bytes); err != nil {
-			return errors.SignatureError("RSA verification failure")
-		}
-		return
-	default:
-		// V3 public keys only support RSA.
-		panic("shouldn't happen")
-	}
-}
-
-// VerifyUserIdSignatureV3 returns nil iff sig is a valid signature, made by this
-// public key, that id is the identity of pub.
-func (pk *PublicKeyV3) VerifyUserIdSignatureV3(id string, pub *PublicKeyV3, sig *SignatureV3) (err error) {
-	h, err := userIdSignatureV3Hash(id, pk, sig.Hash)
-	if err != nil {
-		return err
-	}
-	return pk.VerifySignatureV3(h, sig)
-}
-
-// VerifyKeySignatureV3 returns nil iff sig is a valid signature, made by this
-// public key, of signed.
-func (pk *PublicKeyV3) VerifyKeySignatureV3(signed *PublicKeyV3, sig *SignatureV3) (err error) {
-	h, err := keySignatureHash(pk, signed, sig.Hash)
-	if err != nil {
-		return err
-	}
-	return pk.VerifySignatureV3(h, sig)
-}
-
-// userIdSignatureV3Hash returns a Hash of the message that needs to be signed
-// to assert that pk is a valid key for id.
-func userIdSignatureV3Hash(id string, pk signingKey, hfn crypto.Hash) (h hash.Hash, err error) {
-	if !hfn.Available() {
-		return nil, errors.UnsupportedError("hash function")
-	}
-	h = hfn.New()
-
-	// RFC 4880, section 5.2.4
-	pk.SerializeSignaturePrefix(h)
-	pk.serializeWithoutHeaders(h)
-
-	h.Write([]byte(id))
-
-	return
-}
-
-// KeyIdString returns the public key's fingerprint in capital hex
-// (e.g. "6C7EE1B8621CC013").
-func (pk *PublicKeyV3) KeyIdString() string {
-	return fmt.Sprintf("%X", pk.KeyId)
-}
-
-// KeyIdShortString returns the short form of public key's fingerprint
-// in capital hex, as shown by gpg --list-keys (e.g. "621CC013").
-func (pk *PublicKeyV3) KeyIdShortString() string {
-	return fmt.Sprintf("%X", pk.KeyId&0xFFFFFFFF)
-}
-
-// BitLength returns the bit length for the given public key.
-func (pk *PublicKeyV3) BitLength() (bitLength uint16, err error) {
-	switch pk.PubKeyAlgo {
-	case PubKeyAlgoRSA, PubKeyAlgoRSAEncryptOnly, PubKeyAlgoRSASignOnly:
-		bitLength = pk.n.bitLength
-	default:
-		err = errors.InvalidArgumentError("bad public-key algorithm")
-	}
-	return
-}
diff --git a/.ci/providerlint/vendor/golang.org/x/crypto/openpgp/packet/signature.go b/.ci/providerlint/vendor/golang.org/x/crypto/openpgp/packet/signature.go
deleted file mode 100644
index b2a24a53232..00000000000
--- a/.ci/providerlint/vendor/golang.org/x/crypto/openpgp/packet/signature.go
+++ /dev/null
@@ -1,731 +0,0 @@
-// Copyright 2011 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-package packet
-
-import (
-	"bytes"
-	"crypto"
-	"crypto/dsa"
-	"crypto/ecdsa"
-	"encoding/asn1"
-	"encoding/binary"
-	"hash"
-	"io"
-	"math/big"
-	"strconv"
-	"time"
-
-	"golang.org/x/crypto/openpgp/errors"
-	"golang.org/x/crypto/openpgp/s2k"
-)
-
-const (
-	// See RFC 4880, section 5.2.3.21 for details.
-	KeyFlagCertify = 1 << iota
-	KeyFlagSign
-	KeyFlagEncryptCommunications
-	KeyFlagEncryptStorage
-)
-
-// Signature represents a signature. See RFC 4880, section 5.2.
-type Signature struct {
-	SigType    SignatureType
-	PubKeyAlgo PublicKeyAlgorithm
-	Hash       crypto.Hash
-
-	// HashSuffix is extra data that is hashed in after the signed data.
-	HashSuffix []byte
-	// HashTag contains the first two bytes of the hash for fast rejection
-	// of bad signed data.
-	HashTag      [2]byte
-	CreationTime time.Time
-
-	RSASignature         parsedMPI
-	DSASigR, DSASigS     parsedMPI
-	ECDSASigR, ECDSASigS parsedMPI
-
-	// rawSubpackets contains the unparsed subpackets, in order.
-	rawSubpackets []outputSubpacket
-
-	// The following are optional so are nil when not included in the
-	// signature.
-
-	SigLifetimeSecs, KeyLifetimeSecs                        *uint32
-	PreferredSymmetric, PreferredHash, PreferredCompression []uint8
-	IssuerKeyId                                             *uint64
-	IsPrimaryId                                             *bool
-
-	// FlagsValid is set if any flags were given. See RFC 4880, section
-	// 5.2.3.21 for details.
-	FlagsValid                                                           bool
-	FlagCertify, FlagSign, FlagEncryptCommunications, FlagEncryptStorage bool
-
-	// RevocationReason is set if this signature has been revoked.
-	// See RFC 4880, section 5.2.3.23 for details.
-	RevocationReason     *uint8
-	RevocationReasonText string
-
-	// MDC is set if this signature has a feature packet that indicates
-	// support for MDC subpackets.
-	MDC bool
-
-	// EmbeddedSignature, if non-nil, is a signature of the parent key, by
-	// this key. This prevents an attacker from claiming another's signing
-	// subkey as their own.
-	EmbeddedSignature *Signature
-
-	outSubpackets []outputSubpacket
-}
-
-func (sig *Signature) parse(r io.Reader) (err error) {
-	// RFC 4880, section 5.2.3
-	var buf [5]byte
-	_, err = readFull(r, buf[:1])
-	if err != nil {
-		return
-	}
-	if buf[0] != 4 {
-		err = errors.UnsupportedError("signature packet version " + strconv.Itoa(int(buf[0])))
-		return
-	}
-
-	_, err = readFull(r, buf[:5])
-	if err != nil {
-		return
-	}
-	sig.SigType = SignatureType(buf[0])
-	sig.PubKeyAlgo = PublicKeyAlgorithm(buf[1])
-	switch sig.PubKeyAlgo {
-	case PubKeyAlgoRSA, PubKeyAlgoRSASignOnly, PubKeyAlgoDSA, PubKeyAlgoECDSA:
-	default:
-		err = errors.UnsupportedError("public key algorithm " + strconv.Itoa(int(sig.PubKeyAlgo)))
-		return
-	}
-
-	var ok bool
-	sig.Hash, ok = s2k.HashIdToHash(buf[2])
-	if !ok {
-		return errors.UnsupportedError("hash function " + strconv.Itoa(int(buf[2])))
-	}
-
-	hashedSubpacketsLength := int(buf[3])<<8 | int(buf[4])
-	l := 6 + hashedSubpacketsLength
-	sig.HashSuffix = make([]byte, l+6)
-	sig.HashSuffix[0] = 4
-	copy(sig.HashSuffix[1:], buf[:5])
-	hashedSubpackets := sig.HashSuffix[6:l]
-	_, err = readFull(r, hashedSubpackets)
-	if err != nil {
-		return
-	}
-	// See RFC 4880, section 5.2.4
-	trailer := sig.HashSuffix[l:]
-	trailer[0] = 4
-	trailer[1] = 0xff
-	trailer[2] = uint8(l >> 24)
-	trailer[3] = uint8(l >> 16)
-	trailer[4] = uint8(l >> 8)
-	trailer[5] = uint8(l)
-
-	err = parseSignatureSubpackets(sig, hashedSubpackets, true)
-	if err != nil {
-		return
-	}
-
-	_, err = readFull(r, buf[:2])
-	if err != nil {
-		return
-	}
-	unhashedSubpacketsLength := int(buf[0])<<8 | int(buf[1])
-	unhashedSubpackets := make([]byte, unhashedSubpacketsLength)
-	_, err = readFull(r, unhashedSubpackets)
-	if err != nil {
-		return
-	}
-	err = parseSignatureSubpackets(sig, unhashedSubpackets, false)
-	if err != nil {
-		return
-	}
-
-	_, err = readFull(r, sig.HashTag[:2])
-	if err != nil {
-		return
-	}
-
-	switch sig.PubKeyAlgo {
-	case PubKeyAlgoRSA, PubKeyAlgoRSASignOnly:
-		sig.RSASignature.bytes, sig.RSASignature.bitLength, err = readMPI(r)
-	case PubKeyAlgoDSA:
-		sig.DSASigR.bytes, sig.DSASigR.bitLength, err = readMPI(r)
-		if err == nil {
-			sig.DSASigS.bytes, sig.DSASigS.bitLength, err = readMPI(r)
-		}
-	case PubKeyAlgoECDSA:
-		sig.ECDSASigR.bytes, sig.ECDSASigR.bitLength, err = readMPI(r)
-		if err == nil {
-			sig.ECDSASigS.bytes, sig.ECDSASigS.bitLength, err = readMPI(r)
-		}
-	default:
-		panic("unreachable")
-	}
-	return
-}
-
-// parseSignatureSubpackets parses subpackets of the main signature packet. See
-// RFC 4880, section 5.2.3.1.
-func parseSignatureSubpackets(sig *Signature, subpackets []byte, isHashed bool) (err error) {
-	for len(subpackets) > 0 {
-		subpackets, err = parseSignatureSubpacket(sig, subpackets, isHashed)
-		if err != nil {
-			return
-		}
-	}
-
-	if sig.CreationTime.IsZero() {
-		err = errors.StructuralError("no creation time in signature")
-	}
-
-	return
-}
-
-type signatureSubpacketType uint8
-
-const (
-	creationTimeSubpacket        signatureSubpacketType = 2
-	signatureExpirationSubpacket signatureSubpacketType = 3
-	keyExpirationSubpacket       signatureSubpacketType = 9
-	prefSymmetricAlgosSubpacket  signatureSubpacketType = 11
-	issuerSubpacket              signatureSubpacketType = 16
-	prefHashAlgosSubpacket       signatureSubpacketType = 21
-	prefCompressionSubpacket     signatureSubpacketType = 22
-	primaryUserIdSubpacket       signatureSubpacketType = 25
-	keyFlagsSubpacket            signatureSubpacketType = 27
-	reasonForRevocationSubpacket signatureSubpacketType = 29
-	featuresSubpacket            signatureSubpacketType = 30
-	embeddedSignatureSubpacket   signatureSubpacketType = 32
-)
-
-// parseSignatureSubpacket parses a single subpacket. len(subpacket) is >= 1.
-func parseSignatureSubpacket(sig *Signature, subpacket []byte, isHashed bool) (rest []byte, err error) {
-	// RFC 4880, section 5.2.3.1
-	var (
-		length     uint32
-		packetType signatureSubpacketType
-		isCritical bool
-	)
-	switch {
-	case subpacket[0] < 192:
-		length = uint32(subpacket[0])
-		subpacket = subpacket[1:]
-	case subpacket[0] < 255:
-		if len(subpacket) < 2 {
-			goto Truncated
-		}
-		length = uint32(subpacket[0]-192)<<8 + uint32(subpacket[1]) + 192
-		subpacket = subpacket[2:]
-	default:
-		if len(subpacket) < 5 {
-			goto Truncated
-		}
-		length = uint32(subpacket[1])<<24 |
-			uint32(subpacket[2])<<16 |
-			uint32(subpacket[3])<<8 |
-			uint32(subpacket[4])
-		subpacket = subpacket[5:]
-	}
-	if length > uint32(len(subpacket)) {
-		goto Truncated
-	}
-	rest = subpacket[length:]
-	subpacket = subpacket[:length]
-	if len(subpacket) == 0 {
-		err = errors.StructuralError("zero length signature subpacket")
-		return
-	}
-	packetType = signatureSubpacketType(subpacket[0] & 0x7f)
-	isCritical = subpacket[0]&0x80 == 0x80
-	subpacket = subpacket[1:]
-	sig.rawSubpackets = append(sig.rawSubpackets, outputSubpacket{isHashed, packetType, isCritical, subpacket})
-	switch packetType {
-	case creationTimeSubpacket:
-		if !isHashed {
-			err = errors.StructuralError("signature creation time in non-hashed area")
-			return
-		}
-		if len(subpacket) != 4 {
-			err = errors.StructuralError("signature creation time not four bytes")
-			return
-		}
-		t := binary.BigEndian.Uint32(subpacket)
-		sig.CreationTime = time.Unix(int64(t), 0)
-	case signatureExpirationSubpacket:
-		// Signature expiration time, section 5.2.3.10
-		if !isHashed {
-			return
-		}
-		if len(subpacket) != 4 {
-			err = errors.StructuralError("expiration subpacket with bad length")
-			return
-		}
-		sig.SigLifetimeSecs = new(uint32)
-		*sig.SigLifetimeSecs = binary.BigEndian.Uint32(subpacket)
-	case keyExpirationSubpacket:
-		// Key expiration time, section 5.2.3.6
-		if !isHashed {
-			return
-		}
-		if len(subpacket) != 4 {
-			err = errors.StructuralError("key expiration subpacket with bad length")
-			return
-		}
-		sig.KeyLifetimeSecs = new(uint32)
-		*sig.KeyLifetimeSecs = binary.BigEndian.Uint32(subpacket)
-	case prefSymmetricAlgosSubpacket:
-		// Preferred symmetric algorithms, section 5.2.3.7
-		if !isHashed {
-			return
-		}
-		sig.PreferredSymmetric = make([]byte, len(subpacket))
-		copy(sig.PreferredSymmetric, subpacket)
-	case issuerSubpacket:
-		// Issuer, section 5.2.3.5
-		if len(subpacket) != 8 {
-			err = errors.StructuralError("issuer subpacket with bad length")
-			return
-		}
-		sig.IssuerKeyId = new(uint64)
-		*sig.IssuerKeyId = binary.BigEndian.Uint64(subpacket)
-	case prefHashAlgosSubpacket:
-		// Preferred hash algorithms, section 5.2.3.8
-		if !isHashed {
-			return
-		}
-		sig.PreferredHash = make([]byte, len(subpacket))
-		copy(sig.PreferredHash, subpacket)
-	case prefCompressionSubpacket:
-		// Preferred compression algorithms, section 5.2.3.9
-		if !isHashed {
-			return
-		}
-		sig.PreferredCompression = make([]byte, len(subpacket))
-		copy(sig.PreferredCompression, subpacket)
-	case primaryUserIdSubpacket:
-		// Primary User ID, section 5.2.3.19
-		if !isHashed {
-			return
-		}
-		if len(subpacket) != 1 {
-			err = errors.StructuralError("primary user id subpacket with bad length")
-			return
-		}
-		sig.IsPrimaryId = new(bool)
-		if subpacket[0] > 0 {
-			*sig.IsPrimaryId = true
-		}
-	case keyFlagsSubpacket:
-		// Key flags, section 5.2.3.21
-		if !isHashed {
-			return
-		}
-		if len(subpacket) == 0 {
-			err = errors.StructuralError("empty key flags subpacket")
-			return
-		}
-		sig.FlagsValid = true
-		if subpacket[0]&KeyFlagCertify != 0 {
-			sig.FlagCertify = true
-		}
-		if subpacket[0]&KeyFlagSign != 0 {
-			sig.FlagSign = true
-		}
-		if subpacket[0]&KeyFlagEncryptCommunications != 0 {
-			sig.FlagEncryptCommunications = true
-		}
-		if subpacket[0]&KeyFlagEncryptStorage != 0 {
-			sig.FlagEncryptStorage = true
-		}
-	case reasonForRevocationSubpacket:
-		// Reason For Revocation, section 5.2.3.23
-		if !isHashed {
-			return
-		}
-		if len(subpacket) == 0 {
-			err = errors.StructuralError("empty revocation reason subpacket")
-			return
-		}
-		sig.RevocationReason = new(uint8)
-		*sig.RevocationReason = subpacket[0]
-		sig.RevocationReasonText = string(subpacket[1:])
-	case featuresSubpacket:
-		// Features subpacket, section 5.2.3.24 specifies a very general
-		// mechanism for OpenPGP implementations to signal support for new
-		// features. In practice, the subpacket is used exclusively to
-		// indicate support for MDC-protected encryption.
-		sig.MDC = len(subpacket) >= 1 && subpacket[0]&1 == 1
-	case embeddedSignatureSubpacket:
-		// Only usage is in signatures that cross-certify
-		// signing subkeys. section 5.2.3.26 describes the
-		// format, with its usage described in section 11.1
-		if sig.EmbeddedSignature != nil {
-			err = errors.StructuralError("Cannot have multiple embedded signatures")
-			return
-		}
-		sig.EmbeddedSignature = new(Signature)
-		// Embedded signatures are required to be v4 signatures see
-		// section 12.1. However, we only parse v4 signatures in this
-		// file anyway.
-		if err := sig.EmbeddedSignature.parse(bytes.NewBuffer(subpacket)); err != nil {
-			return nil, err
-		}
-		if sigType := sig.EmbeddedSignature.SigType; sigType != SigTypePrimaryKeyBinding {
-			return nil, errors.StructuralError("cross-signature has unexpected type " + strconv.Itoa(int(sigType)))
-		}
-	default:
-		if isCritical {
-			err = errors.UnsupportedError("unknown critical signature subpacket type " + strconv.Itoa(int(packetType)))
-			return
-		}
-	}
-	return
-
-Truncated:
-	err = errors.StructuralError("signature subpacket truncated")
-	return
-}
-
-// subpacketLengthLength returns the length, in bytes, of an encoded length value.
-func subpacketLengthLength(length int) int {
-	if length < 192 {
-		return 1
-	}
-	if length < 16320 {
-		return 2
-	}
-	return 5
-}
-
-// serializeSubpacketLength marshals the given length into to.
-func serializeSubpacketLength(to []byte, length int) int {
-	// RFC 4880, Section 4.2.2.
-	if length < 192 {
-		to[0] = byte(length)
-		return 1
-	}
-	if length < 16320 {
-		length -= 192
-		to[0] = byte((length >> 8) + 192)
-		to[1] = byte(length)
-		return 2
-	}
-	to[0] = 255
-	to[1] = byte(length >> 24)
-	to[2] = byte(length >> 16)
-	to[3] = byte(length >> 8)
-	to[4] = byte(length)
-	return 5
-}
-
-// subpacketsLength returns the serialized length, in bytes, of the given
-// subpackets.
-func subpacketsLength(subpackets []outputSubpacket, hashed bool) (length int) {
-	for _, subpacket := range subpackets {
-		if subpacket.hashed == hashed {
-			length += subpacketLengthLength(len(subpacket.contents) + 1)
-			length += 1 // type byte
-			length += len(subpacket.contents)
-		}
-	}
-	return
-}
-
-// serializeSubpackets marshals the given subpackets into to.
-func serializeSubpackets(to []byte, subpackets []outputSubpacket, hashed bool) {
-	for _, subpacket := range subpackets {
-		if subpacket.hashed == hashed {
-			n := serializeSubpacketLength(to, len(subpacket.contents)+1)
-			to[n] = byte(subpacket.subpacketType)
-			to = to[1+n:]
-			n = copy(to, subpacket.contents)
-			to = to[n:]
-		}
-	}
-	return
-}
-
-// KeyExpired returns whether sig is a self-signature of a key that has
-// expired.
-func (sig *Signature) KeyExpired(currentTime time.Time) bool {
-	if sig.KeyLifetimeSecs == nil {
-		return false
-	}
-	expiry := sig.CreationTime.Add(time.Duration(*sig.KeyLifetimeSecs) * time.Second)
-	return currentTime.After(expiry)
-}
-
-// buildHashSuffix constructs the HashSuffix member of sig in preparation for signing.
-func (sig *Signature) buildHashSuffix() (err error) {
-	hashedSubpacketsLen := subpacketsLength(sig.outSubpackets, true)
-
-	var ok bool
-	l := 6 + hashedSubpacketsLen
-	sig.HashSuffix = make([]byte, l+6)
-	sig.HashSuffix[0] = 4
-	sig.HashSuffix[1] = uint8(sig.SigType)
-	sig.HashSuffix[2] = uint8(sig.PubKeyAlgo)
-	sig.HashSuffix[3], ok = s2k.HashToHashId(sig.Hash)
-	if !ok {
-		sig.HashSuffix = nil
-		return errors.InvalidArgumentError("hash cannot be represented in OpenPGP: " + strconv.Itoa(int(sig.Hash)))
-	}
-	sig.HashSuffix[4] = byte(hashedSubpacketsLen >> 8)
-	sig.HashSuffix[5] = byte(hashedSubpacketsLen)
-	serializeSubpackets(sig.HashSuffix[6:l], sig.outSubpackets, true)
-	trailer := sig.HashSuffix[l:]
-	trailer[0] = 4
-	trailer[1] = 0xff
-	trailer[2] = byte(l >> 24)
-	trailer[3] = byte(l >> 16)
-	trailer[4] = byte(l >> 8)
-	trailer[5] = byte(l)
-	return
-}
-
-func (sig *Signature) signPrepareHash(h hash.Hash) (digest []byte, err error) {
-	err = sig.buildHashSuffix()
-	if err != nil {
-		return
-	}
-
-	h.Write(sig.HashSuffix)
-	digest = h.Sum(nil)
-	copy(sig.HashTag[:], digest)
-	return
-}
-
-// Sign signs a message with a private key. The hash, h, must contain
-// the hash of the message to be signed and will be mutated by this function.
-// On success, the signature is stored in sig. Call Serialize to write it out.
-// If config is nil, sensible defaults will be used.
-func (sig *Signature) Sign(h hash.Hash, priv *PrivateKey, config *Config) (err error) {
-	sig.outSubpackets = sig.buildSubpackets()
-	digest, err := sig.signPrepareHash(h)
-	if err != nil {
-		return
-	}
-
-	switch priv.PubKeyAlgo {
-	case PubKeyAlgoRSA, PubKeyAlgoRSASignOnly:
-		// supports both *rsa.PrivateKey and crypto.Signer
-		sig.RSASignature.bytes, err = priv.PrivateKey.(crypto.Signer).Sign(config.Random(), digest, sig.Hash)
-		sig.RSASignature.bitLength = uint16(8 * len(sig.RSASignature.bytes))
-	case PubKeyAlgoDSA:
-		dsaPriv := priv.PrivateKey.(*dsa.PrivateKey)
-
-		// Need to truncate hashBytes to match FIPS 186-3 section 4.6.
-		subgroupSize := (dsaPriv.Q.BitLen() + 7) / 8
-		if len(digest) > subgroupSize {
-			digest = digest[:subgroupSize]
-		}
-		r, s, err := dsa.Sign(config.Random(), dsaPriv, digest)
-		if err == nil {
-			sig.DSASigR.bytes = r.Bytes()
-			sig.DSASigR.bitLength = uint16(8 * len(sig.DSASigR.bytes))
-			sig.DSASigS.bytes = s.Bytes()
-			sig.DSASigS.bitLength = uint16(8 * len(sig.DSASigS.bytes))
-		}
-	case PubKeyAlgoECDSA:
-		var r, s *big.Int
-		if pk, ok := priv.PrivateKey.(*ecdsa.PrivateKey); ok {
-			// direct support, avoid asn1 wrapping/unwrapping
-			r, s, err = ecdsa.Sign(config.Random(), pk, digest)
-		} else {
-			var b []byte
-			b, err = priv.PrivateKey.(crypto.Signer).Sign(config.Random(), digest, sig.Hash)
-			if err == nil {
-				r, s, err = unwrapECDSASig(b)
-			}
-		}
-		if err == nil {
-			sig.ECDSASigR = fromBig(r)
-			sig.ECDSASigS = fromBig(s)
-		}
-	default:
-		err = errors.UnsupportedError("public key algorithm: " + strconv.Itoa(int(sig.PubKeyAlgo)))
-	}
-
-	return
-}
-
-// unwrapECDSASig parses the two integer components of an ASN.1-encoded ECDSA
-// signature.
-func unwrapECDSASig(b []byte) (r, s *big.Int, err error) {
-	var ecsdaSig struct {
-		R, S *big.Int
-	}
-	_, err = asn1.Unmarshal(b, &ecsdaSig)
-	if err != nil {
-		return
-	}
-	return ecsdaSig.R, ecsdaSig.S, nil
-}
-
-// SignUserId computes a signature from priv, asserting that pub is a valid
-// key for the identity id.  On success, the signature is stored in sig. Call
-// Serialize to write it out.
-// If config is nil, sensible defaults will be used.
-func (sig *Signature) SignUserId(id string, pub *PublicKey, priv *PrivateKey, config *Config) error {
-	h, err := userIdSignatureHash(id, pub, sig.Hash)
-	if err != nil {
-		return err
-	}
-	return sig.Sign(h, priv, config)
-}
-
-// SignKey computes a signature from priv, asserting that pub is a subkey. On
-// success, the signature is stored in sig. Call Serialize to write it out.
-// If config is nil, sensible defaults will be used.
-func (sig *Signature) SignKey(pub *PublicKey, priv *PrivateKey, config *Config) error {
-	h, err := keySignatureHash(&priv.PublicKey, pub, sig.Hash)
-	if err != nil {
-		return err
-	}
-	return sig.Sign(h, priv, config)
-}
-
-// Serialize marshals sig to w. Sign, SignUserId or SignKey must have been
-// called first.
-func (sig *Signature) Serialize(w io.Writer) (err error) {
-	if len(sig.outSubpackets) == 0 {
-		sig.outSubpackets = sig.rawSubpackets
-	}
-	if sig.RSASignature.bytes == nil && sig.DSASigR.bytes == nil && sig.ECDSASigR.bytes == nil {
-		return errors.InvalidArgumentError("Signature: need to call Sign, SignUserId or SignKey before Serialize")
-	}
-
-	sigLength := 0
-	switch sig.PubKeyAlgo {
-	case PubKeyAlgoRSA, PubKeyAlgoRSASignOnly:
-		sigLength = 2 + len(sig.RSASignature.bytes)
-	case PubKeyAlgoDSA:
-		sigLength = 2 + len(sig.DSASigR.bytes)
-		sigLength += 2 + len(sig.DSASigS.bytes)
-	case PubKeyAlgoECDSA:
-		sigLength = 2 + len(sig.ECDSASigR.bytes)
-		sigLength += 2 + len(sig.ECDSASigS.bytes)
-	default:
-		panic("impossible")
-	}
-
-	unhashedSubpacketsLen := subpacketsLength(sig.outSubpackets, false)
-	length := len(sig.HashSuffix) - 6 /* trailer not included */ +
-		2 /* length of unhashed subpackets */ + unhashedSubpacketsLen +
-		2 /* hash tag */ + sigLength
-	err = serializeHeader(w, packetTypeSignature, length)
-	if err != nil {
-		return
-	}
-
-	_, err = w.Write(sig.HashSuffix[:len(sig.HashSuffix)-6])
-	if err != nil {
-		return
-	}
-
-	unhashedSubpackets := make([]byte, 2+unhashedSubpacketsLen)
-	unhashedSubpackets[0] = byte(unhashedSubpacketsLen >> 8)
-	unhashedSubpackets[1] = byte(unhashedSubpacketsLen)
-	serializeSubpackets(unhashedSubpackets[2:], sig.outSubpackets, false)
-
-	_, err = w.Write(unhashedSubpackets)
-	if err != nil {
-		return
-	}
-	_, err = w.Write(sig.HashTag[:])
-	if err != nil {
-		return
-	}
-
-	switch sig.PubKeyAlgo {
-	case PubKeyAlgoRSA, PubKeyAlgoRSASignOnly:
-		err = writeMPIs(w, sig.RSASignature)
-	case PubKeyAlgoDSA:
-		err = writeMPIs(w, sig.DSASigR, sig.DSASigS)
-	case PubKeyAlgoECDSA:
-		err = writeMPIs(w, sig.ECDSASigR, sig.ECDSASigS)
-	default:
-		panic("impossible")
-	}
-	return
-}
-
-// outputSubpacket represents a subpacket to be marshaled.
-type outputSubpacket struct {
-	hashed        bool // true if this subpacket is in the hashed area.
-	subpacketType signatureSubpacketType
-	isCritical    bool
-	contents      []byte
-}
-
-func (sig *Signature) buildSubpackets() (subpackets []outputSubpacket) {
-	creationTime := make([]byte, 4)
-	binary.BigEndian.PutUint32(creationTime, uint32(sig.CreationTime.Unix()))
-	subpackets = append(subpackets, outputSubpacket{true, creationTimeSubpacket, false, creationTime})
-
-	if sig.IssuerKeyId != nil {
-		keyId := make([]byte, 8)
-		binary.BigEndian.PutUint64(keyId, *sig.IssuerKeyId)
-		subpackets = append(subpackets, outputSubpacket{true, issuerSubpacket, false, keyId})
-	}
-
-	if sig.SigLifetimeSecs != nil && *sig.SigLifetimeSecs != 0 {
-		sigLifetime := make([]byte, 4)
-		binary.BigEndian.PutUint32(sigLifetime, *sig.SigLifetimeSecs)
-		subpackets = append(subpackets, outputSubpacket{true, signatureExpirationSubpacket, true, sigLifetime})
-	}
-
-	// Key flags may only appear in self-signatures or certification signatures.
-
-	if sig.FlagsValid {
-		var flags byte
-		if sig.FlagCertify {
-			flags |= KeyFlagCertify
-		}
-		if sig.FlagSign {
-			flags |= KeyFlagSign
-		}
-		if sig.FlagEncryptCommunications {
-			flags |= KeyFlagEncryptCommunications
-		}
-		if sig.FlagEncryptStorage {
-			flags |= KeyFlagEncryptStorage
-		}
-		subpackets = append(subpackets, outputSubpacket{true, keyFlagsSubpacket, false, []byte{flags}})
-	}
-
-	// The following subpackets may only appear in self-signatures
-
-	if sig.KeyLifetimeSecs != nil && *sig.KeyLifetimeSecs != 0 {
-		keyLifetime := make([]byte, 4)
-		binary.BigEndian.PutUint32(keyLifetime, *sig.KeyLifetimeSecs)
-		subpackets = append(subpackets, outputSubpacket{true, keyExpirationSubpacket, true, keyLifetime})
-	}
-
-	if sig.IsPrimaryId != nil && *sig.IsPrimaryId {
-		subpackets = append(subpackets, outputSubpacket{true, primaryUserIdSubpacket, false, []byte{1}})
-	}
-
-	if len(sig.PreferredSymmetric) > 0 {
-		subpackets = append(subpackets, outputSubpacket{true, prefSymmetricAlgosSubpacket, false, sig.PreferredSymmetric})
-	}
-
-	if len(sig.PreferredHash) > 0 {
-		subpackets = append(subpackets, outputSubpacket{true, prefHashAlgosSubpacket, false, sig.PreferredHash})
-	}
-
-	if len(sig.PreferredCompression) > 0 {
-		subpackets = append(subpackets, outputSubpacket{true, prefCompressionSubpacket, false, sig.PreferredCompression})
-	}
-
-	return
-}
diff --git a/.ci/providerlint/vendor/golang.org/x/crypto/openpgp/packet/signature_v3.go b/.ci/providerlint/vendor/golang.org/x/crypto/openpgp/packet/signature_v3.go
deleted file mode 100644
index 6edff889349..00000000000
--- a/.ci/providerlint/vendor/golang.org/x/crypto/openpgp/packet/signature_v3.go
+++ /dev/null
@@ -1,146 +0,0 @@
-// Copyright 2013 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-package packet
-
-import (
-	"crypto"
-	"encoding/binary"
-	"fmt"
-	"io"
-	"strconv"
-	"time"
-
-	"golang.org/x/crypto/openpgp/errors"
-	"golang.org/x/crypto/openpgp/s2k"
-)
-
-// SignatureV3 represents older version 3 signatures. These signatures are less secure
-// than version 4 and should not be used to create new signatures. They are included
-// here for backwards compatibility to read and validate with older key material.
-// See RFC 4880, section 5.2.2.
-type SignatureV3 struct {
-	SigType      SignatureType
-	CreationTime time.Time
-	IssuerKeyId  uint64
-	PubKeyAlgo   PublicKeyAlgorithm
-	Hash         crypto.Hash
-	HashTag      [2]byte
-
-	RSASignature     parsedMPI
-	DSASigR, DSASigS parsedMPI
-}
-
-func (sig *SignatureV3) parse(r io.Reader) (err error) {
-	// RFC 4880, section 5.2.2
-	var buf [8]byte
-	if _, err = readFull(r, buf[:1]); err != nil {
-		return
-	}
-	if buf[0] < 2 || buf[0] > 3 {
-		err = errors.UnsupportedError("signature packet version " + strconv.Itoa(int(buf[0])))
-		return
-	}
-	if _, err = readFull(r, buf[:1]); err != nil {
-		return
-	}
-	if buf[0] != 5 {
-		err = errors.UnsupportedError(
-			"invalid hashed material length " + strconv.Itoa(int(buf[0])))
-		return
-	}
-
-	// Read hashed material: signature type + creation time
-	if _, err = readFull(r, buf[:5]); err != nil {
-		return
-	}
-	sig.SigType = SignatureType(buf[0])
-	t := binary.BigEndian.Uint32(buf[1:5])
-	sig.CreationTime = time.Unix(int64(t), 0)
-
-	// Eight-octet Key ID of signer.
-	if _, err = readFull(r, buf[:8]); err != nil {
-		return
-	}
-	sig.IssuerKeyId = binary.BigEndian.Uint64(buf[:])
-
-	// Public-key and hash algorithm
-	if _, err = readFull(r, buf[:2]); err != nil {
-		return
-	}
-	sig.PubKeyAlgo = PublicKeyAlgorithm(buf[0])
-	switch sig.PubKeyAlgo {
-	case PubKeyAlgoRSA, PubKeyAlgoRSASignOnly, PubKeyAlgoDSA:
-	default:
-		err = errors.UnsupportedError("public key algorithm " + strconv.Itoa(int(sig.PubKeyAlgo)))
-		return
-	}
-	var ok bool
-	if sig.Hash, ok = s2k.HashIdToHash(buf[1]); !ok {
-		return errors.UnsupportedError("hash function " + strconv.Itoa(int(buf[2])))
-	}
-
-	// Two-octet field holding left 16 bits of signed hash value.
-	if _, err = readFull(r, sig.HashTag[:2]); err != nil {
-		return
-	}
-
-	switch sig.PubKeyAlgo {
-	case PubKeyAlgoRSA, PubKeyAlgoRSASignOnly:
-		sig.RSASignature.bytes, sig.RSASignature.bitLength, err = readMPI(r)
-	case PubKeyAlgoDSA:
-		if sig.DSASigR.bytes, sig.DSASigR.bitLength, err = readMPI(r); err != nil {
-			return
-		}
-		sig.DSASigS.bytes, sig.DSASigS.bitLength, err = readMPI(r)
-	default:
-		panic("unreachable")
-	}
-	return
-}
-
-// Serialize marshals sig to w. Sign, SignUserId or SignKey must have been
-// called first.
-func (sig *SignatureV3) Serialize(w io.Writer) (err error) {
-	buf := make([]byte, 8)
-
-	// Write the sig type and creation time
-	buf[0] = byte(sig.SigType)
-	binary.BigEndian.PutUint32(buf[1:5], uint32(sig.CreationTime.Unix()))
-	if _, err = w.Write(buf[:5]); err != nil {
-		return
-	}
-
-	// Write the issuer long key ID
-	binary.BigEndian.PutUint64(buf[:8], sig.IssuerKeyId)
-	if _, err = w.Write(buf[:8]); err != nil {
-		return
-	}
-
-	// Write public key algorithm, hash ID, and hash value
-	buf[0] = byte(sig.PubKeyAlgo)
-	hashId, ok := s2k.HashToHashId(sig.Hash)
-	if !ok {
-		return errors.UnsupportedError(fmt.Sprintf("hash function %v", sig.Hash))
-	}
-	buf[1] = hashId
-	copy(buf[2:4], sig.HashTag[:])
-	if _, err = w.Write(buf[:4]); err != nil {
-		return
-	}
-
-	if sig.RSASignature.bytes == nil && sig.DSASigR.bytes == nil {
-		return errors.InvalidArgumentError("Signature: need to call Sign, SignUserId or SignKey before Serialize")
-	}
-
-	switch sig.PubKeyAlgo {
-	case PubKeyAlgoRSA, PubKeyAlgoRSASignOnly:
-		err = writeMPIs(w, sig.RSASignature)
-	case PubKeyAlgoDSA:
-		err = writeMPIs(w, sig.DSASigR, sig.DSASigS)
-	default:
-		panic("impossible")
-	}
-	return
-}
diff --git a/.ci/providerlint/vendor/golang.org/x/crypto/openpgp/packet/symmetric_key_encrypted.go b/.ci/providerlint/vendor/golang.org/x/crypto/openpgp/packet/symmetric_key_encrypted.go
deleted file mode 100644
index 744c2d2c42d..00000000000
--- a/.ci/providerlint/vendor/golang.org/x/crypto/openpgp/packet/symmetric_key_encrypted.go
+++ /dev/null
@@ -1,155 +0,0 @@
-// Copyright 2011 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-package packet
-
-import (
-	"bytes"
-	"crypto/cipher"
-	"io"
-	"strconv"
-
-	"golang.org/x/crypto/openpgp/errors"
-	"golang.org/x/crypto/openpgp/s2k"
-)
-
-// This is the largest session key that we'll support. Since no 512-bit cipher
-// has even been seriously used, this is comfortably large.
-const maxSessionKeySizeInBytes = 64
-
-// SymmetricKeyEncrypted represents a passphrase protected session key. See RFC
-// 4880, section 5.3.
-type SymmetricKeyEncrypted struct {
-	CipherFunc   CipherFunction
-	s2k          func(out, in []byte)
-	encryptedKey []byte
-}
-
-const symmetricKeyEncryptedVersion = 4
-
-func (ske *SymmetricKeyEncrypted) parse(r io.Reader) error {
-	// RFC 4880, section 5.3.
-	var buf [2]byte
-	if _, err := readFull(r, buf[:]); err != nil {
-		return err
-	}
-	if buf[0] != symmetricKeyEncryptedVersion {
-		return errors.UnsupportedError("SymmetricKeyEncrypted version")
-	}
-	ske.CipherFunc = CipherFunction(buf[1])
-
-	if ske.CipherFunc.KeySize() == 0 {
-		return errors.UnsupportedError("unknown cipher: " + strconv.Itoa(int(buf[1])))
-	}
-
-	var err error
-	ske.s2k, err = s2k.Parse(r)
-	if err != nil {
-		return err
-	}
-
-	encryptedKey := make([]byte, maxSessionKeySizeInBytes)
-	// The session key may follow. We just have to try and read to find
-	// out. If it exists then we limit it to maxSessionKeySizeInBytes.
-	n, err := readFull(r, encryptedKey)
-	if err != nil && err != io.ErrUnexpectedEOF {
-		return err
-	}
-
-	if n != 0 {
-		if n == maxSessionKeySizeInBytes {
-			return errors.UnsupportedError("oversized encrypted session key")
-		}
-		ske.encryptedKey = encryptedKey[:n]
-	}
-
-	return nil
-}
-
-// Decrypt attempts to decrypt an encrypted session key and returns the key and
-// the cipher to use when decrypting a subsequent Symmetrically Encrypted Data
-// packet.
-func (ske *SymmetricKeyEncrypted) Decrypt(passphrase []byte) ([]byte, CipherFunction, error) {
-	key := make([]byte, ske.CipherFunc.KeySize())
-	ske.s2k(key, passphrase)
-
-	if len(ske.encryptedKey) == 0 {
-		return key, ske.CipherFunc, nil
-	}
-
-	// the IV is all zeros
-	iv := make([]byte, ske.CipherFunc.blockSize())
-	c := cipher.NewCFBDecrypter(ske.CipherFunc.new(key), iv)
-	plaintextKey := make([]byte, len(ske.encryptedKey))
-	c.XORKeyStream(plaintextKey, ske.encryptedKey)
-	cipherFunc := CipherFunction(plaintextKey[0])
-	if cipherFunc.blockSize() == 0 {
-		return nil, ske.CipherFunc, errors.UnsupportedError("unknown cipher: " + strconv.Itoa(int(cipherFunc)))
-	}
-	plaintextKey = plaintextKey[1:]
-	if l, cipherKeySize := len(plaintextKey), cipherFunc.KeySize(); l != cipherFunc.KeySize() {
-		return nil, cipherFunc, errors.StructuralError("length of decrypted key (" + strconv.Itoa(l) + ") " +
-			"not equal to cipher keysize (" + strconv.Itoa(cipherKeySize) + ")")
-	}
-	return plaintextKey, cipherFunc, nil
-}
-
-// SerializeSymmetricKeyEncrypted serializes a symmetric key packet to w. The
-// packet contains a random session key, encrypted by a key derived from the
-// given passphrase. The session key is returned and must be passed to
-// SerializeSymmetricallyEncrypted.
-// If config is nil, sensible defaults will be used.
-func SerializeSymmetricKeyEncrypted(w io.Writer, passphrase []byte, config *Config) (key []byte, err error) {
-	cipherFunc := config.Cipher()
-	keySize := cipherFunc.KeySize()
-	if keySize == 0 {
-		return nil, errors.UnsupportedError("unknown cipher: " + strconv.Itoa(int(cipherFunc)))
-	}
-
-	s2kBuf := new(bytes.Buffer)
-	keyEncryptingKey := make([]byte, keySize)
-	// s2k.Serialize salts and stretches the passphrase, and writes the
-	// resulting key to keyEncryptingKey and the s2k descriptor to s2kBuf.
-	err = s2k.Serialize(s2kBuf, keyEncryptingKey, config.Random(), passphrase, &s2k.Config{Hash: config.Hash(), S2KCount: config.PasswordHashIterations()})
-	if err != nil {
-		return
-	}
-	s2kBytes := s2kBuf.Bytes()
-
-	packetLength := 2 /* header */ + len(s2kBytes) + 1 /* cipher type */ + keySize
-	err = serializeHeader(w, packetTypeSymmetricKeyEncrypted, packetLength)
-	if err != nil {
-		return
-	}
-
-	var buf [2]byte
-	buf[0] = symmetricKeyEncryptedVersion
-	buf[1] = byte(cipherFunc)
-	_, err = w.Write(buf[:])
-	if err != nil {
-		return
-	}
-	_, err = w.Write(s2kBytes)
-	if err != nil {
-		return
-	}
-
-	sessionKey := make([]byte, keySize)
-	_, err = io.ReadFull(config.Random(), sessionKey)
-	if err != nil {
-		return
-	}
-	iv := make([]byte, cipherFunc.blockSize())
-	c := cipher.NewCFBEncrypter(cipherFunc.new(keyEncryptingKey), iv)
-	encryptedCipherAndKey := make([]byte, keySize+1)
-	c.XORKeyStream(encryptedCipherAndKey, buf[1:])
-	c.XORKeyStream(encryptedCipherAndKey[1:], sessionKey)
-	_, err = w.Write(encryptedCipherAndKey)
-	if err != nil {
-		return
-	}
-
-	key = sessionKey
-	return
-}
diff --git a/.ci/providerlint/vendor/golang.org/x/crypto/openpgp/packet/symmetrically_encrypted.go b/.ci/providerlint/vendor/golang.org/x/crypto/openpgp/packet/symmetrically_encrypted.go
deleted file mode 100644
index 1a1a62964fc..00000000000
--- a/.ci/providerlint/vendor/golang.org/x/crypto/openpgp/packet/symmetrically_encrypted.go
+++ /dev/null
@@ -1,290 +0,0 @@
-// Copyright 2011 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-package packet
-
-import (
-	"crypto/cipher"
-	"crypto/sha1"
-	"crypto/subtle"
-	"golang.org/x/crypto/openpgp/errors"
-	"hash"
-	"io"
-	"strconv"
-)
-
-// SymmetricallyEncrypted represents a symmetrically encrypted byte string. The
-// encrypted contents will consist of more OpenPGP packets. See RFC 4880,
-// sections 5.7 and 5.13.
-type SymmetricallyEncrypted struct {
-	MDC      bool // true iff this is a type 18 packet and thus has an embedded MAC.
-	contents io.Reader
-	prefix   []byte
-}
-
-const symmetricallyEncryptedVersion = 1
-
-func (se *SymmetricallyEncrypted) parse(r io.Reader) error {
-	if se.MDC {
-		// See RFC 4880, section 5.13.
-		var buf [1]byte
-		_, err := readFull(r, buf[:])
-		if err != nil {
-			return err
-		}
-		if buf[0] != symmetricallyEncryptedVersion {
-			return errors.UnsupportedError("unknown SymmetricallyEncrypted version")
-		}
-	}
-	se.contents = r
-	return nil
-}
-
-// Decrypt returns a ReadCloser, from which the decrypted contents of the
-// packet can be read. An incorrect key can, with high probability, be detected
-// immediately and this will result in a KeyIncorrect error being returned.
-func (se *SymmetricallyEncrypted) Decrypt(c CipherFunction, key []byte) (io.ReadCloser, error) {
-	keySize := c.KeySize()
-	if keySize == 0 {
-		return nil, errors.UnsupportedError("unknown cipher: " + strconv.Itoa(int(c)))
-	}
-	if len(key) != keySize {
-		return nil, errors.InvalidArgumentError("SymmetricallyEncrypted: incorrect key length")
-	}
-
-	if se.prefix == nil {
-		se.prefix = make([]byte, c.blockSize()+2)
-		_, err := readFull(se.contents, se.prefix)
-		if err != nil {
-			return nil, err
-		}
-	} else if len(se.prefix) != c.blockSize()+2 {
-		return nil, errors.InvalidArgumentError("can't try ciphers with different block lengths")
-	}
-
-	ocfbResync := OCFBResync
-	if se.MDC {
-		// MDC packets use a different form of OCFB mode.
-		ocfbResync = OCFBNoResync
-	}
-
-	s := NewOCFBDecrypter(c.new(key), se.prefix, ocfbResync)
-	if s == nil {
-		return nil, errors.ErrKeyIncorrect
-	}
-
-	plaintext := cipher.StreamReader{S: s, R: se.contents}
-
-	if se.MDC {
-		// MDC packets have an embedded hash that we need to check.
-		h := sha1.New()
-		h.Write(se.prefix)
-		return &seMDCReader{in: plaintext, h: h}, nil
-	}
-
-	// Otherwise, we just need to wrap plaintext so that it's a valid ReadCloser.
-	return seReader{plaintext}, nil
-}
-
-// seReader wraps an io.Reader with a no-op Close method.
-type seReader struct {
-	in io.Reader
-}
-
-func (ser seReader) Read(buf []byte) (int, error) {
-	return ser.in.Read(buf)
-}
-
-func (ser seReader) Close() error {
-	return nil
-}
-
-const mdcTrailerSize = 1 /* tag byte */ + 1 /* length byte */ + sha1.Size
-
-// An seMDCReader wraps an io.Reader, maintains a running hash and keeps hold
-// of the most recent 22 bytes (mdcTrailerSize). Upon EOF, those bytes form an
-// MDC packet containing a hash of the previous contents which is checked
-// against the running hash. See RFC 4880, section 5.13.
-type seMDCReader struct {
-	in          io.Reader
-	h           hash.Hash
-	trailer     [mdcTrailerSize]byte
-	scratch     [mdcTrailerSize]byte
-	trailerUsed int
-	error       bool
-	eof         bool
-}
-
-func (ser *seMDCReader) Read(buf []byte) (n int, err error) {
-	if ser.error {
-		err = io.ErrUnexpectedEOF
-		return
-	}
-	if ser.eof {
-		err = io.EOF
-		return
-	}
-
-	// If we haven't yet filled the trailer buffer then we must do that
-	// first.
-	for ser.trailerUsed < mdcTrailerSize {
-		n, err = ser.in.Read(ser.trailer[ser.trailerUsed:])
-		ser.trailerUsed += n
-		if err == io.EOF {
-			if ser.trailerUsed != mdcTrailerSize {
-				n = 0
-				err = io.ErrUnexpectedEOF
-				ser.error = true
-				return
-			}
-			ser.eof = true
-			n = 0
-			return
-		}
-
-		if err != nil {
-			n = 0
-			return
-		}
-	}
-
-	// If it's a short read then we read into a temporary buffer and shift
-	// the data into the caller's buffer.
-	if len(buf) <= mdcTrailerSize {
-		n, err = readFull(ser.in, ser.scratch[:len(buf)])
-		copy(buf, ser.trailer[:n])
-		ser.h.Write(buf[:n])
-		copy(ser.trailer[:], ser.trailer[n:])
-		copy(ser.trailer[mdcTrailerSize-n:], ser.scratch[:])
-		if n < len(buf) {
-			ser.eof = true
-			err = io.EOF
-		}
-		return
-	}
-
-	n, err = ser.in.Read(buf[mdcTrailerSize:])
-	copy(buf, ser.trailer[:])
-	ser.h.Write(buf[:n])
-	copy(ser.trailer[:], buf[n:])
-
-	if err == io.EOF {
-		ser.eof = true
-	}
-	return
-}
-
-// This is a new-format packet tag byte for a type 19 (MDC) packet.
-const mdcPacketTagByte = byte(0x80) | 0x40 | 19
-
-func (ser *seMDCReader) Close() error {
-	if ser.error {
-		return errors.SignatureError("error during reading")
-	}
-
-	for !ser.eof {
-		// We haven't seen EOF so we need to read to the end
-		var buf [1024]byte
-		_, err := ser.Read(buf[:])
-		if err == io.EOF {
-			break
-		}
-		if err != nil {
-			return errors.SignatureError("error during reading")
-		}
-	}
-
-	if ser.trailer[0] != mdcPacketTagByte || ser.trailer[1] != sha1.Size {
-		return errors.SignatureError("MDC packet not found")
-	}
-	ser.h.Write(ser.trailer[:2])
-
-	final := ser.h.Sum(nil)
-	if subtle.ConstantTimeCompare(final, ser.trailer[2:]) != 1 {
-		return errors.SignatureError("hash mismatch")
-	}
-	return nil
-}
-
-// An seMDCWriter writes through to an io.WriteCloser while maintains a running
-// hash of the data written. On close, it emits an MDC packet containing the
-// running hash.
-type seMDCWriter struct {
-	w io.WriteCloser
-	h hash.Hash
-}
-
-func (w *seMDCWriter) Write(buf []byte) (n int, err error) {
-	w.h.Write(buf)
-	return w.w.Write(buf)
-}
-
-func (w *seMDCWriter) Close() (err error) {
-	var buf [mdcTrailerSize]byte
-
-	buf[0] = mdcPacketTagByte
-	buf[1] = sha1.Size
-	w.h.Write(buf[:2])
-	digest := w.h.Sum(nil)
-	copy(buf[2:], digest)
-
-	_, err = w.w.Write(buf[:])
-	if err != nil {
-		return
-	}
-	return w.w.Close()
-}
-
-// noOpCloser is like an io.NopCloser, but for an io.Writer.
-type noOpCloser struct {
-	w io.Writer
-}
-
-func (c noOpCloser) Write(data []byte) (n int, err error) {
-	return c.w.Write(data)
-}
-
-func (c noOpCloser) Close() error {
-	return nil
-}
-
-// SerializeSymmetricallyEncrypted serializes a symmetrically encrypted packet
-// to w and returns a WriteCloser to which the to-be-encrypted packets can be
-// written.
-// If config is nil, sensible defaults will be used.
-func SerializeSymmetricallyEncrypted(w io.Writer, c CipherFunction, key []byte, config *Config) (contents io.WriteCloser, err error) {
-	if c.KeySize() != len(key) {
-		return nil, errors.InvalidArgumentError("SymmetricallyEncrypted.Serialize: bad key length")
-	}
-	writeCloser := noOpCloser{w}
-	ciphertext, err := serializeStreamHeader(writeCloser, packetTypeSymmetricallyEncryptedMDC)
-	if err != nil {
-		return
-	}
-
-	_, err = ciphertext.Write([]byte{symmetricallyEncryptedVersion})
-	if err != nil {
-		return
-	}
-
-	block := c.new(key)
-	blockSize := block.BlockSize()
-	iv := make([]byte, blockSize)
-	_, err = config.Random().Read(iv)
-	if err != nil {
-		return
-	}
-	s, prefix := NewOCFBEncrypter(block, iv, OCFBNoResync)
-	_, err = ciphertext.Write(prefix)
-	if err != nil {
-		return
-	}
-	plaintext := cipher.StreamWriter{S: s, W: ciphertext}
-
-	h := sha1.New()
-	h.Write(iv)
-	h.Write(iv[blockSize-2:])
-	contents = &seMDCWriter{w: plaintext, h: h}
-	return
-}
diff --git a/.ci/providerlint/vendor/golang.org/x/crypto/openpgp/read.go b/.ci/providerlint/vendor/golang.org/x/crypto/openpgp/read.go
deleted file mode 100644
index 48a89314685..00000000000
--- a/.ci/providerlint/vendor/golang.org/x/crypto/openpgp/read.go
+++ /dev/null
@@ -1,448 +0,0 @@
-// Copyright 2011 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-// Package openpgp implements high level operations on OpenPGP messages.
-//
-// Deprecated: this package is unmaintained except for security fixes. New
-// applications should consider a more focused, modern alternative to OpenPGP
-// for their specific task. If you are required to interoperate with OpenPGP
-// systems and need a maintained package, consider a community fork.
-// See https://golang.org/issue/44226.
-package openpgp // import "golang.org/x/crypto/openpgp"
-
-import (
-	"crypto"
-	_ "crypto/sha256"
-	"hash"
-	"io"
-	"strconv"
-
-	"golang.org/x/crypto/openpgp/armor"
-	"golang.org/x/crypto/openpgp/errors"
-	"golang.org/x/crypto/openpgp/packet"
-)
-
-// SignatureType is the armor type for a PGP signature.
-var SignatureType = "PGP SIGNATURE"
-
-// readArmored reads an armored block with the given type.
-func readArmored(r io.Reader, expectedType string) (body io.Reader, err error) {
-	block, err := armor.Decode(r)
-	if err != nil {
-		return
-	}
-
-	if block.Type != expectedType {
-		return nil, errors.InvalidArgumentError("expected '" + expectedType + "', got: " + block.Type)
-	}
-
-	return block.Body, nil
-}
-
-// MessageDetails contains the result of parsing an OpenPGP encrypted and/or
-// signed message.
-type MessageDetails struct {
-	IsEncrypted              bool                // true if the message was encrypted.
-	EncryptedToKeyIds        []uint64            // the list of recipient key ids.
-	IsSymmetricallyEncrypted bool                // true if a passphrase could have decrypted the message.
-	DecryptedWith            Key                 // the private key used to decrypt the message, if any.
-	IsSigned                 bool                // true if the message is signed.
-	SignedByKeyId            uint64              // the key id of the signer, if any.
-	SignedBy                 *Key                // the key of the signer, if available.
-	LiteralData              *packet.LiteralData // the metadata of the contents
-	UnverifiedBody           io.Reader           // the contents of the message.
-
-	// If IsSigned is true and SignedBy is non-zero then the signature will
-	// be verified as UnverifiedBody is read. The signature cannot be
-	// checked until the whole of UnverifiedBody is read so UnverifiedBody
-	// must be consumed until EOF before the data can be trusted. Even if a
-	// message isn't signed (or the signer is unknown) the data may contain
-	// an authentication code that is only checked once UnverifiedBody has
-	// been consumed. Once EOF has been seen, the following fields are
-	// valid. (An authentication code failure is reported as a
-	// SignatureError error when reading from UnverifiedBody.)
-	SignatureError error               // nil if the signature is good.
-	Signature      *packet.Signature   // the signature packet itself, if v4 (default)
-	SignatureV3    *packet.SignatureV3 // the signature packet if it is a v2 or v3 signature
-
-	decrypted io.ReadCloser
-}
-
-// A PromptFunction is used as a callback by functions that may need to decrypt
-// a private key, or prompt for a passphrase. It is called with a list of
-// acceptable, encrypted private keys and a boolean that indicates whether a
-// passphrase is usable. It should either decrypt a private key or return a
-// passphrase to try. If the decrypted private key or given passphrase isn't
-// correct, the function will be called again, forever. Any error returned will
-// be passed up.
-type PromptFunction func(keys []Key, symmetric bool) ([]byte, error)
-
-// A keyEnvelopePair is used to store a private key with the envelope that
-// contains a symmetric key, encrypted with that key.
-type keyEnvelopePair struct {
-	key          Key
-	encryptedKey *packet.EncryptedKey
-}
-
-// ReadMessage parses an OpenPGP message that may be signed and/or encrypted.
-// The given KeyRing should contain both public keys (for signature
-// verification) and, possibly encrypted, private keys for decrypting.
-// If config is nil, sensible defaults will be used.
-func ReadMessage(r io.Reader, keyring KeyRing, prompt PromptFunction, config *packet.Config) (md *MessageDetails, err error) {
-	var p packet.Packet
-
-	var symKeys []*packet.SymmetricKeyEncrypted
-	var pubKeys []keyEnvelopePair
-	var se *packet.SymmetricallyEncrypted
-
-	packets := packet.NewReader(r)
-	md = new(MessageDetails)
-	md.IsEncrypted = true
-
-	// The message, if encrypted, starts with a number of packets
-	// containing an encrypted decryption key. The decryption key is either
-	// encrypted to a public key, or with a passphrase. This loop
-	// collects these packets.
-ParsePackets:
-	for {
-		p, err = packets.Next()
-		if err != nil {
-			return nil, err
-		}
-		switch p := p.(type) {
-		case *packet.SymmetricKeyEncrypted:
-			// This packet contains the decryption key encrypted with a passphrase.
-			md.IsSymmetricallyEncrypted = true
-			symKeys = append(symKeys, p)
-		case *packet.EncryptedKey:
-			// This packet contains the decryption key encrypted to a public key.
-			md.EncryptedToKeyIds = append(md.EncryptedToKeyIds, p.KeyId)
-			switch p.Algo {
-			case packet.PubKeyAlgoRSA, packet.PubKeyAlgoRSAEncryptOnly, packet.PubKeyAlgoElGamal:
-				break
-			default:
-				continue
-			}
-			var keys []Key
-			if p.KeyId == 0 {
-				keys = keyring.DecryptionKeys()
-			} else {
-				keys = keyring.KeysById(p.KeyId)
-			}
-			for _, k := range keys {
-				pubKeys = append(pubKeys, keyEnvelopePair{k, p})
-			}
-		case *packet.SymmetricallyEncrypted:
-			se = p
-			break ParsePackets
-		case *packet.Compressed, *packet.LiteralData, *packet.OnePassSignature:
-			// This message isn't encrypted.
-			if len(symKeys) != 0 || len(pubKeys) != 0 {
-				return nil, errors.StructuralError("key material not followed by encrypted message")
-			}
-			packets.Unread(p)
-			return readSignedMessage(packets, nil, keyring)
-		}
-	}
-
-	var candidates []Key
-	var decrypted io.ReadCloser
-
-	// Now that we have the list of encrypted keys we need to decrypt at
-	// least one of them or, if we cannot, we need to call the prompt
-	// function so that it can decrypt a key or give us a passphrase.
-FindKey:
-	for {
-		// See if any of the keys already have a private key available
-		candidates = candidates[:0]
-		candidateFingerprints := make(map[string]bool)
-
-		for _, pk := range pubKeys {
-			if pk.key.PrivateKey == nil {
-				continue
-			}
-			if !pk.key.PrivateKey.Encrypted {
-				if len(pk.encryptedKey.Key) == 0 {
-					pk.encryptedKey.Decrypt(pk.key.PrivateKey, config)
-				}
-				if len(pk.encryptedKey.Key) == 0 {
-					continue
-				}
-				decrypted, err = se.Decrypt(pk.encryptedKey.CipherFunc, pk.encryptedKey.Key)
-				if err != nil && err != errors.ErrKeyIncorrect {
-					return nil, err
-				}
-				if decrypted != nil {
-					md.DecryptedWith = pk.key
-					break FindKey
-				}
-			} else {
-				fpr := string(pk.key.PublicKey.Fingerprint[:])
-				if v := candidateFingerprints[fpr]; v {
-					continue
-				}
-				candidates = append(candidates, pk.key)
-				candidateFingerprints[fpr] = true
-			}
-		}
-
-		if len(candidates) == 0 && len(symKeys) == 0 {
-			return nil, errors.ErrKeyIncorrect
-		}
-
-		if prompt == nil {
-			return nil, errors.ErrKeyIncorrect
-		}
-
-		passphrase, err := prompt(candidates, len(symKeys) != 0)
-		if err != nil {
-			return nil, err
-		}
-
-		// Try the symmetric passphrase first
-		if len(symKeys) != 0 && passphrase != nil {
-			for _, s := range symKeys {
-				key, cipherFunc, err := s.Decrypt(passphrase)
-				if err == nil {
-					decrypted, err = se.Decrypt(cipherFunc, key)
-					if err != nil && err != errors.ErrKeyIncorrect {
-						return nil, err
-					}
-					if decrypted != nil {
-						break FindKey
-					}
-				}
-
-			}
-		}
-	}
-
-	md.decrypted = decrypted
-	if err := packets.Push(decrypted); err != nil {
-		return nil, err
-	}
-	return readSignedMessage(packets, md, keyring)
-}
-
-// readSignedMessage reads a possibly signed message if mdin is non-zero then
-// that structure is updated and returned. Otherwise a fresh MessageDetails is
-// used.
-func readSignedMessage(packets *packet.Reader, mdin *MessageDetails, keyring KeyRing) (md *MessageDetails, err error) {
-	if mdin == nil {
-		mdin = new(MessageDetails)
-	}
-	md = mdin
-
-	var p packet.Packet
-	var h hash.Hash
-	var wrappedHash hash.Hash
-FindLiteralData:
-	for {
-		p, err = packets.Next()
-		if err != nil {
-			return nil, err
-		}
-		switch p := p.(type) {
-		case *packet.Compressed:
-			if err := packets.Push(p.Body); err != nil {
-				return nil, err
-			}
-		case *packet.OnePassSignature:
-			if !p.IsLast {
-				return nil, errors.UnsupportedError("nested signatures")
-			}
-
-			h, wrappedHash, err = hashForSignature(p.Hash, p.SigType)
-			if err != nil {
-				md = nil
-				return
-			}
-
-			md.IsSigned = true
-			md.SignedByKeyId = p.KeyId
-			keys := keyring.KeysByIdUsage(p.KeyId, packet.KeyFlagSign)
-			if len(keys) > 0 {
-				md.SignedBy = &keys[0]
-			}
-		case *packet.LiteralData:
-			md.LiteralData = p
-			break FindLiteralData
-		}
-	}
-
-	if md.SignedBy != nil {
-		md.UnverifiedBody = &signatureCheckReader{packets, h, wrappedHash, md}
-	} else if md.decrypted != nil {
-		md.UnverifiedBody = checkReader{md}
-	} else {
-		md.UnverifiedBody = md.LiteralData.Body
-	}
-
-	return md, nil
-}
-
-// hashForSignature returns a pair of hashes that can be used to verify a
-// signature. The signature may specify that the contents of the signed message
-// should be preprocessed (i.e. to normalize line endings). Thus this function
-// returns two hashes. The second should be used to hash the message itself and
-// performs any needed preprocessing.
-func hashForSignature(hashId crypto.Hash, sigType packet.SignatureType) (hash.Hash, hash.Hash, error) {
-	if !hashId.Available() {
-		return nil, nil, errors.UnsupportedError("hash not available: " + strconv.Itoa(int(hashId)))
-	}
-	h := hashId.New()
-
-	switch sigType {
-	case packet.SigTypeBinary:
-		return h, h, nil
-	case packet.SigTypeText:
-		return h, NewCanonicalTextHash(h), nil
-	}
-
-	return nil, nil, errors.UnsupportedError("unsupported signature type: " + strconv.Itoa(int(sigType)))
-}
-
-// checkReader wraps an io.Reader from a LiteralData packet. When it sees EOF
-// it closes the ReadCloser from any SymmetricallyEncrypted packet to trigger
-// MDC checks.
-type checkReader struct {
-	md *MessageDetails
-}
-
-func (cr checkReader) Read(buf []byte) (n int, err error) {
-	n, err = cr.md.LiteralData.Body.Read(buf)
-	if err == io.EOF {
-		mdcErr := cr.md.decrypted.Close()
-		if mdcErr != nil {
-			err = mdcErr
-		}
-	}
-	return
-}
-
-// signatureCheckReader wraps an io.Reader from a LiteralData packet and hashes
-// the data as it is read. When it sees an EOF from the underlying io.Reader
-// it parses and checks a trailing Signature packet and triggers any MDC checks.
-type signatureCheckReader struct {
-	packets        *packet.Reader
-	h, wrappedHash hash.Hash
-	md             *MessageDetails
-}
-
-func (scr *signatureCheckReader) Read(buf []byte) (n int, err error) {
-	n, err = scr.md.LiteralData.Body.Read(buf)
-	scr.wrappedHash.Write(buf[:n])
-	if err == io.EOF {
-		var p packet.Packet
-		p, scr.md.SignatureError = scr.packets.Next()
-		if scr.md.SignatureError != nil {
-			return
-		}
-
-		var ok bool
-		if scr.md.Signature, ok = p.(*packet.Signature); ok {
-			scr.md.SignatureError = scr.md.SignedBy.PublicKey.VerifySignature(scr.h, scr.md.Signature)
-		} else if scr.md.SignatureV3, ok = p.(*packet.SignatureV3); ok {
-			scr.md.SignatureError = scr.md.SignedBy.PublicKey.VerifySignatureV3(scr.h, scr.md.SignatureV3)
-		} else {
-			scr.md.SignatureError = errors.StructuralError("LiteralData not followed by Signature")
-			return
-		}
-
-		// The SymmetricallyEncrypted packet, if any, might have an
-		// unsigned hash of its own. In order to check this we need to
-		// close that Reader.
-		if scr.md.decrypted != nil {
-			mdcErr := scr.md.decrypted.Close()
-			if mdcErr != nil {
-				err = mdcErr
-			}
-		}
-	}
-	return
-}
-
-// CheckDetachedSignature takes a signed file and a detached signature and
-// returns the signer if the signature is valid. If the signer isn't known,
-// ErrUnknownIssuer is returned.
-func CheckDetachedSignature(keyring KeyRing, signed, signature io.Reader) (signer *Entity, err error) {
-	var issuerKeyId uint64
-	var hashFunc crypto.Hash
-	var sigType packet.SignatureType
-	var keys []Key
-	var p packet.Packet
-
-	packets := packet.NewReader(signature)
-	for {
-		p, err = packets.Next()
-		if err == io.EOF {
-			return nil, errors.ErrUnknownIssuer
-		}
-		if err != nil {
-			return nil, err
-		}
-
-		switch sig := p.(type) {
-		case *packet.Signature:
-			if sig.IssuerKeyId == nil {
-				return nil, errors.StructuralError("signature doesn't have an issuer")
-			}
-			issuerKeyId = *sig.IssuerKeyId
-			hashFunc = sig.Hash
-			sigType = sig.SigType
-		case *packet.SignatureV3:
-			issuerKeyId = sig.IssuerKeyId
-			hashFunc = sig.Hash
-			sigType = sig.SigType
-		default:
-			return nil, errors.StructuralError("non signature packet found")
-		}
-
-		keys = keyring.KeysByIdUsage(issuerKeyId, packet.KeyFlagSign)
-		if len(keys) > 0 {
-			break
-		}
-	}
-
-	if len(keys) == 0 {
-		panic("unreachable")
-	}
-
-	h, wrappedHash, err := hashForSignature(hashFunc, sigType)
-	if err != nil {
-		return nil, err
-	}
-
-	if _, err := io.Copy(wrappedHash, signed); err != nil && err != io.EOF {
-		return nil, err
-	}
-
-	for _, key := range keys {
-		switch sig := p.(type) {
-		case *packet.Signature:
-			err = key.PublicKey.VerifySignature(h, sig)
-		case *packet.SignatureV3:
-			err = key.PublicKey.VerifySignatureV3(h, sig)
-		default:
-			panic("unreachable")
-		}
-
-		if err == nil {
-			return key.Entity, nil
-		}
-	}
-
-	return nil, err
-}
-
-// CheckArmoredDetachedSignature performs the same actions as
-// CheckDetachedSignature but expects the signature to be armored.
-func CheckArmoredDetachedSignature(keyring KeyRing, signed, signature io.Reader) (signer *Entity, err error) {
-	body, err := readArmored(signature, SignatureType)
-	if err != nil {
-		return
-	}
-
-	return CheckDetachedSignature(keyring, signed, body)
-}
diff --git a/.ci/providerlint/vendor/golang.org/x/crypto/openpgp/s2k/s2k.go b/.ci/providerlint/vendor/golang.org/x/crypto/openpgp/s2k/s2k.go
deleted file mode 100644
index f53244a1c7b..00000000000
--- a/.ci/providerlint/vendor/golang.org/x/crypto/openpgp/s2k/s2k.go
+++ /dev/null
@@ -1,279 +0,0 @@
-// Copyright 2011 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-// Package s2k implements the various OpenPGP string-to-key transforms as
-// specified in RFC 4800 section 3.7.1.
-//
-// Deprecated: this package is unmaintained except for security fixes. New
-// applications should consider a more focused, modern alternative to OpenPGP
-// for their specific task. If you are required to interoperate with OpenPGP
-// systems and need a maintained package, consider a community fork.
-// See https://golang.org/issue/44226.
-package s2k // import "golang.org/x/crypto/openpgp/s2k"
-
-import (
-	"crypto"
-	"hash"
-	"io"
-	"strconv"
-
-	"golang.org/x/crypto/openpgp/errors"
-)
-
-// Config collects configuration parameters for s2k key-stretching
-// transformatioms. A nil *Config is valid and results in all default
-// values. Currently, Config is used only by the Serialize function in
-// this package.
-type Config struct {
-	// Hash is the default hash function to be used. If
-	// nil, SHA1 is used.
-	Hash crypto.Hash
-	// S2KCount is only used for symmetric encryption. It
-	// determines the strength of the passphrase stretching when
-	// the said passphrase is hashed to produce a key. S2KCount
-	// should be between 1024 and 65011712, inclusive. If Config
-	// is nil or S2KCount is 0, the value 65536 used. Not all
-	// values in the above range can be represented. S2KCount will
-	// be rounded up to the next representable value if it cannot
-	// be encoded exactly. When set, it is strongly encrouraged to
-	// use a value that is at least 65536. See RFC 4880 Section
-	// 3.7.1.3.
-	S2KCount int
-}
-
-func (c *Config) hash() crypto.Hash {
-	if c == nil || uint(c.Hash) == 0 {
-		// SHA1 is the historical default in this package.
-		return crypto.SHA1
-	}
-
-	return c.Hash
-}
-
-func (c *Config) encodedCount() uint8 {
-	if c == nil || c.S2KCount == 0 {
-		return 96 // The common case. Correspoding to 65536
-	}
-
-	i := c.S2KCount
-	switch {
-	// Behave like GPG. Should we make 65536 the lowest value used?
-	case i < 1024:
-		i = 1024
-	case i > 65011712:
-		i = 65011712
-	}
-
-	return encodeCount(i)
-}
-
-// encodeCount converts an iterative "count" in the range 1024 to
-// 65011712, inclusive, to an encoded count. The return value is the
-// octet that is actually stored in the GPG file. encodeCount panics
-// if i is not in the above range (encodedCount above takes care to
-// pass i in the correct range). See RFC 4880 Section 3.7.7.1.
-func encodeCount(i int) uint8 {
-	if i < 1024 || i > 65011712 {
-		panic("count arg i outside the required range")
-	}
-
-	for encoded := 0; encoded < 256; encoded++ {
-		count := decodeCount(uint8(encoded))
-		if count >= i {
-			return uint8(encoded)
-		}
-	}
-
-	return 255
-}
-
-// decodeCount returns the s2k mode 3 iterative "count" corresponding to
-// the encoded octet c.
-func decodeCount(c uint8) int {
-	return (16 + int(c&15)) << (uint32(c>>4) + 6)
-}
-
-// Simple writes to out the result of computing the Simple S2K function (RFC
-// 4880, section 3.7.1.1) using the given hash and input passphrase.
-func Simple(out []byte, h hash.Hash, in []byte) {
-	Salted(out, h, in, nil)
-}
-
-var zero [1]byte
-
-// Salted writes to out the result of computing the Salted S2K function (RFC
-// 4880, section 3.7.1.2) using the given hash, input passphrase and salt.
-func Salted(out []byte, h hash.Hash, in []byte, salt []byte) {
-	done := 0
-	var digest []byte
-
-	for i := 0; done < len(out); i++ {
-		h.Reset()
-		for j := 0; j < i; j++ {
-			h.Write(zero[:])
-		}
-		h.Write(salt)
-		h.Write(in)
-		digest = h.Sum(digest[:0])
-		n := copy(out[done:], digest)
-		done += n
-	}
-}
-
-// Iterated writes to out the result of computing the Iterated and Salted S2K
-// function (RFC 4880, section 3.7.1.3) using the given hash, input passphrase,
-// salt and iteration count.
-func Iterated(out []byte, h hash.Hash, in []byte, salt []byte, count int) {
-	combined := make([]byte, len(in)+len(salt))
-	copy(combined, salt)
-	copy(combined[len(salt):], in)
-
-	if count < len(combined) {
-		count = len(combined)
-	}
-
-	done := 0
-	var digest []byte
-	for i := 0; done < len(out); i++ {
-		h.Reset()
-		for j := 0; j < i; j++ {
-			h.Write(zero[:])
-		}
-		written := 0
-		for written < count {
-			if written+len(combined) > count {
-				todo := count - written
-				h.Write(combined[:todo])
-				written = count
-			} else {
-				h.Write(combined)
-				written += len(combined)
-			}
-		}
-		digest = h.Sum(digest[:0])
-		n := copy(out[done:], digest)
-		done += n
-	}
-}
-
-// Parse reads a binary specification for a string-to-key transformation from r
-// and returns a function which performs that transform.
-func Parse(r io.Reader) (f func(out, in []byte), err error) {
-	var buf [9]byte
-
-	_, err = io.ReadFull(r, buf[:2])
-	if err != nil {
-		return
-	}
-
-	hash, ok := HashIdToHash(buf[1])
-	if !ok {
-		return nil, errors.UnsupportedError("hash for S2K function: " + strconv.Itoa(int(buf[1])))
-	}
-	if !hash.Available() {
-		return nil, errors.UnsupportedError("hash not available: " + strconv.Itoa(int(hash)))
-	}
-	h := hash.New()
-
-	switch buf[0] {
-	case 0:
-		f := func(out, in []byte) {
-			Simple(out, h, in)
-		}
-		return f, nil
-	case 1:
-		_, err = io.ReadFull(r, buf[:8])
-		if err != nil {
-			return
-		}
-		f := func(out, in []byte) {
-			Salted(out, h, in, buf[:8])
-		}
-		return f, nil
-	case 3:
-		_, err = io.ReadFull(r, buf[:9])
-		if err != nil {
-			return
-		}
-		count := decodeCount(buf[8])
-		f := func(out, in []byte) {
-			Iterated(out, h, in, buf[:8], count)
-		}
-		return f, nil
-	}
-
-	return nil, errors.UnsupportedError("S2K function")
-}
-
-// Serialize salts and stretches the given passphrase and writes the
-// resulting key into key. It also serializes an S2K descriptor to
-// w. The key stretching can be configured with c, which may be
-// nil. In that case, sensible defaults will be used.
-func Serialize(w io.Writer, key []byte, rand io.Reader, passphrase []byte, c *Config) error {
-	var buf [11]byte
-	buf[0] = 3 /* iterated and salted */
-	buf[1], _ = HashToHashId(c.hash())
-	salt := buf[2:10]
-	if _, err := io.ReadFull(rand, salt); err != nil {
-		return err
-	}
-	encodedCount := c.encodedCount()
-	count := decodeCount(encodedCount)
-	buf[10] = encodedCount
-	if _, err := w.Write(buf[:]); err != nil {
-		return err
-	}
-
-	Iterated(key, c.hash().New(), passphrase, salt, count)
-	return nil
-}
-
-// hashToHashIdMapping contains pairs relating OpenPGP's hash identifier with
-// Go's crypto.Hash type. See RFC 4880, section 9.4.
-var hashToHashIdMapping = []struct {
-	id   byte
-	hash crypto.Hash
-	name string
-}{
-	{1, crypto.MD5, "MD5"},
-	{2, crypto.SHA1, "SHA1"},
-	{3, crypto.RIPEMD160, "RIPEMD160"},
-	{8, crypto.SHA256, "SHA256"},
-	{9, crypto.SHA384, "SHA384"},
-	{10, crypto.SHA512, "SHA512"},
-	{11, crypto.SHA224, "SHA224"},
-}
-
-// HashIdToHash returns a crypto.Hash which corresponds to the given OpenPGP
-// hash id.
-func HashIdToHash(id byte) (h crypto.Hash, ok bool) {
-	for _, m := range hashToHashIdMapping {
-		if m.id == id {
-			return m.hash, true
-		}
-	}
-	return 0, false
-}
-
-// HashIdToString returns the name of the hash function corresponding to the
-// given OpenPGP hash id.
-func HashIdToString(id byte) (name string, ok bool) {
-	for _, m := range hashToHashIdMapping {
-		if m.id == id {
-			return m.name, true
-		}
-	}
-
-	return "", false
-}
-
-// HashToHashId returns an OpenPGP hash id which corresponds the given Hash.
-func HashToHashId(h crypto.Hash) (id byte, ok bool) {
-	for _, m := range hashToHashIdMapping {
-		if m.hash == h {
-			return m.id, true
-		}
-	}
-	return 0, false
-}
diff --git a/.ci/providerlint/vendor/golang.org/x/crypto/openpgp/write.go b/.ci/providerlint/vendor/golang.org/x/crypto/openpgp/write.go
deleted file mode 100644
index b89d48b81d7..00000000000
--- a/.ci/providerlint/vendor/golang.org/x/crypto/openpgp/write.go
+++ /dev/null
@@ -1,418 +0,0 @@
-// Copyright 2011 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-package openpgp
-
-import (
-	"crypto"
-	"hash"
-	"io"
-	"strconv"
-	"time"
-
-	"golang.org/x/crypto/openpgp/armor"
-	"golang.org/x/crypto/openpgp/errors"
-	"golang.org/x/crypto/openpgp/packet"
-	"golang.org/x/crypto/openpgp/s2k"
-)
-
-// DetachSign signs message with the private key from signer (which must
-// already have been decrypted) and writes the signature to w.
-// If config is nil, sensible defaults will be used.
-func DetachSign(w io.Writer, signer *Entity, message io.Reader, config *packet.Config) error {
-	return detachSign(w, signer, message, packet.SigTypeBinary, config)
-}
-
-// ArmoredDetachSign signs message with the private key from signer (which
-// must already have been decrypted) and writes an armored signature to w.
-// If config is nil, sensible defaults will be used.
-func ArmoredDetachSign(w io.Writer, signer *Entity, message io.Reader, config *packet.Config) (err error) {
-	return armoredDetachSign(w, signer, message, packet.SigTypeBinary, config)
-}
-
-// DetachSignText signs message (after canonicalising the line endings) with
-// the private key from signer (which must already have been decrypted) and
-// writes the signature to w.
-// If config is nil, sensible defaults will be used.
-func DetachSignText(w io.Writer, signer *Entity, message io.Reader, config *packet.Config) error {
-	return detachSign(w, signer, message, packet.SigTypeText, config)
-}
-
-// ArmoredDetachSignText signs message (after canonicalising the line endings)
-// with the private key from signer (which must already have been decrypted)
-// and writes an armored signature to w.
-// If config is nil, sensible defaults will be used.
-func ArmoredDetachSignText(w io.Writer, signer *Entity, message io.Reader, config *packet.Config) error {
-	return armoredDetachSign(w, signer, message, packet.SigTypeText, config)
-}
-
-func armoredDetachSign(w io.Writer, signer *Entity, message io.Reader, sigType packet.SignatureType, config *packet.Config) (err error) {
-	out, err := armor.Encode(w, SignatureType, nil)
-	if err != nil {
-		return
-	}
-	err = detachSign(out, signer, message, sigType, config)
-	if err != nil {
-		return
-	}
-	return out.Close()
-}
-
-func detachSign(w io.Writer, signer *Entity, message io.Reader, sigType packet.SignatureType, config *packet.Config) (err error) {
-	if signer.PrivateKey == nil {
-		return errors.InvalidArgumentError("signing key doesn't have a private key")
-	}
-	if signer.PrivateKey.Encrypted {
-		return errors.InvalidArgumentError("signing key is encrypted")
-	}
-
-	sig := new(packet.Signature)
-	sig.SigType = sigType
-	sig.PubKeyAlgo = signer.PrivateKey.PubKeyAlgo
-	sig.Hash = config.Hash()
-	sig.CreationTime = config.Now()
-	sig.IssuerKeyId = &signer.PrivateKey.KeyId
-
-	h, wrappedHash, err := hashForSignature(sig.Hash, sig.SigType)
-	if err != nil {
-		return
-	}
-	io.Copy(wrappedHash, message)
-
-	err = sig.Sign(h, signer.PrivateKey, config)
-	if err != nil {
-		return
-	}
-
-	return sig.Serialize(w)
-}
-
-// FileHints contains metadata about encrypted files. This metadata is, itself,
-// encrypted.
-type FileHints struct {
-	// IsBinary can be set to hint that the contents are binary data.
-	IsBinary bool
-	// FileName hints at the name of the file that should be written. It's
-	// truncated to 255 bytes if longer. It may be empty to suggest that the
-	// file should not be written to disk. It may be equal to "_CONSOLE" to
-	// suggest the data should not be written to disk.
-	FileName string
-	// ModTime contains the modification time of the file, or the zero time if not applicable.
-	ModTime time.Time
-}
-
-// SymmetricallyEncrypt acts like gpg -c: it encrypts a file with a passphrase.
-// The resulting WriteCloser must be closed after the contents of the file have
-// been written.
-// If config is nil, sensible defaults will be used.
-func SymmetricallyEncrypt(ciphertext io.Writer, passphrase []byte, hints *FileHints, config *packet.Config) (plaintext io.WriteCloser, err error) {
-	if hints == nil {
-		hints = &FileHints{}
-	}
-
-	key, err := packet.SerializeSymmetricKeyEncrypted(ciphertext, passphrase, config)
-	if err != nil {
-		return
-	}
-	w, err := packet.SerializeSymmetricallyEncrypted(ciphertext, config.Cipher(), key, config)
-	if err != nil {
-		return
-	}
-
-	literaldata := w
-	if algo := config.Compression(); algo != packet.CompressionNone {
-		var compConfig *packet.CompressionConfig
-		if config != nil {
-			compConfig = config.CompressionConfig
-		}
-		literaldata, err = packet.SerializeCompressed(w, algo, compConfig)
-		if err != nil {
-			return
-		}
-	}
-
-	var epochSeconds uint32
-	if !hints.ModTime.IsZero() {
-		epochSeconds = uint32(hints.ModTime.Unix())
-	}
-	return packet.SerializeLiteral(literaldata, hints.IsBinary, hints.FileName, epochSeconds)
-}
-
-// intersectPreferences mutates and returns a prefix of a that contains only
-// the values in the intersection of a and b. The order of a is preserved.
-func intersectPreferences(a []uint8, b []uint8) (intersection []uint8) {
-	var j int
-	for _, v := range a {
-		for _, v2 := range b {
-			if v == v2 {
-				a[j] = v
-				j++
-				break
-			}
-		}
-	}
-
-	return a[:j]
-}
-
-func hashToHashId(h crypto.Hash) uint8 {
-	v, ok := s2k.HashToHashId(h)
-	if !ok {
-		panic("tried to convert unknown hash")
-	}
-	return v
-}
-
-// writeAndSign writes the data as a payload package and, optionally, signs
-// it. hints contains optional information, that is also encrypted,
-// that aids the recipients in processing the message. The resulting
-// WriteCloser must be closed after the contents of the file have been
-// written. If config is nil, sensible defaults will be used.
-func writeAndSign(payload io.WriteCloser, candidateHashes []uint8, signed *Entity, hints *FileHints, config *packet.Config) (plaintext io.WriteCloser, err error) {
-	var signer *packet.PrivateKey
-	if signed != nil {
-		signKey, ok := signed.signingKey(config.Now())
-		if !ok {
-			return nil, errors.InvalidArgumentError("no valid signing keys")
-		}
-		signer = signKey.PrivateKey
-		if signer == nil {
-			return nil, errors.InvalidArgumentError("no private key in signing key")
-		}
-		if signer.Encrypted {
-			return nil, errors.InvalidArgumentError("signing key must be decrypted")
-		}
-	}
-
-	var hash crypto.Hash
-	for _, hashId := range candidateHashes {
-		if h, ok := s2k.HashIdToHash(hashId); ok && h.Available() {
-			hash = h
-			break
-		}
-	}
-
-	// If the hash specified by config is a candidate, we'll use that.
-	if configuredHash := config.Hash(); configuredHash.Available() {
-		for _, hashId := range candidateHashes {
-			if h, ok := s2k.HashIdToHash(hashId); ok && h == configuredHash {
-				hash = h
-				break
-			}
-		}
-	}
-
-	if hash == 0 {
-		hashId := candidateHashes[0]
-		name, ok := s2k.HashIdToString(hashId)
-		if !ok {
-			name = "#" + strconv.Itoa(int(hashId))
-		}
-		return nil, errors.InvalidArgumentError("cannot encrypt because no candidate hash functions are compiled in. (Wanted " + name + " in this case.)")
-	}
-
-	if signer != nil {
-		ops := &packet.OnePassSignature{
-			SigType:    packet.SigTypeBinary,
-			Hash:       hash,
-			PubKeyAlgo: signer.PubKeyAlgo,
-			KeyId:      signer.KeyId,
-			IsLast:     true,
-		}
-		if err := ops.Serialize(payload); err != nil {
-			return nil, err
-		}
-	}
-
-	if hints == nil {
-		hints = &FileHints{}
-	}
-
-	w := payload
-	if signer != nil {
-		// If we need to write a signature packet after the literal
-		// data then we need to stop literalData from closing
-		// encryptedData.
-		w = noOpCloser{w}
-
-	}
-	var epochSeconds uint32
-	if !hints.ModTime.IsZero() {
-		epochSeconds = uint32(hints.ModTime.Unix())
-	}
-	literalData, err := packet.SerializeLiteral(w, hints.IsBinary, hints.FileName, epochSeconds)
-	if err != nil {
-		return nil, err
-	}
-
-	if signer != nil {
-		return signatureWriter{payload, literalData, hash, hash.New(), signer, config}, nil
-	}
-	return literalData, nil
-}
-
-// Encrypt encrypts a message to a number of recipients and, optionally, signs
-// it. hints contains optional information, that is also encrypted, that aids
-// the recipients in processing the message. The resulting WriteCloser must
-// be closed after the contents of the file have been written.
-// If config is nil, sensible defaults will be used.
-func Encrypt(ciphertext io.Writer, to []*Entity, signed *Entity, hints *FileHints, config *packet.Config) (plaintext io.WriteCloser, err error) {
-	if len(to) == 0 {
-		return nil, errors.InvalidArgumentError("no encryption recipient provided")
-	}
-
-	// These are the possible ciphers that we'll use for the message.
-	candidateCiphers := []uint8{
-		uint8(packet.CipherAES128),
-		uint8(packet.CipherAES256),
-		uint8(packet.CipherCAST5),
-	}
-	// These are the possible hash functions that we'll use for the signature.
-	candidateHashes := []uint8{
-		hashToHashId(crypto.SHA256),
-		hashToHashId(crypto.SHA384),
-		hashToHashId(crypto.SHA512),
-		hashToHashId(crypto.SHA1),
-		hashToHashId(crypto.RIPEMD160),
-	}
-	// In the event that a recipient doesn't specify any supported ciphers
-	// or hash functions, these are the ones that we assume that every
-	// implementation supports.
-	defaultCiphers := candidateCiphers[len(candidateCiphers)-1:]
-	defaultHashes := candidateHashes[len(candidateHashes)-1:]
-
-	encryptKeys := make([]Key, len(to))
-	for i := range to {
-		var ok bool
-		encryptKeys[i], ok = to[i].encryptionKey(config.Now())
-		if !ok {
-			return nil, errors.InvalidArgumentError("cannot encrypt a message to key id " + strconv.FormatUint(to[i].PrimaryKey.KeyId, 16) + " because it has no encryption keys")
-		}
-
-		sig := to[i].primaryIdentity().SelfSignature
-
-		preferredSymmetric := sig.PreferredSymmetric
-		if len(preferredSymmetric) == 0 {
-			preferredSymmetric = defaultCiphers
-		}
-		preferredHashes := sig.PreferredHash
-		if len(preferredHashes) == 0 {
-			preferredHashes = defaultHashes
-		}
-		candidateCiphers = intersectPreferences(candidateCiphers, preferredSymmetric)
-		candidateHashes = intersectPreferences(candidateHashes, preferredHashes)
-	}
-
-	if len(candidateCiphers) == 0 || len(candidateHashes) == 0 {
-		return nil, errors.InvalidArgumentError("cannot encrypt because recipient set shares no common algorithms")
-	}
-
-	cipher := packet.CipherFunction(candidateCiphers[0])
-	// If the cipher specified by config is a candidate, we'll use that.
-	configuredCipher := config.Cipher()
-	for _, c := range candidateCiphers {
-		cipherFunc := packet.CipherFunction(c)
-		if cipherFunc == configuredCipher {
-			cipher = cipherFunc
-			break
-		}
-	}
-
-	symKey := make([]byte, cipher.KeySize())
-	if _, err := io.ReadFull(config.Random(), symKey); err != nil {
-		return nil, err
-	}
-
-	for _, key := range encryptKeys {
-		if err := packet.SerializeEncryptedKey(ciphertext, key.PublicKey, cipher, symKey, config); err != nil {
-			return nil, err
-		}
-	}
-
-	payload, err := packet.SerializeSymmetricallyEncrypted(ciphertext, cipher, symKey, config)
-	if err != nil {
-		return
-	}
-
-	return writeAndSign(payload, candidateHashes, signed, hints, config)
-}
-
-// Sign signs a message. The resulting WriteCloser must be closed after the
-// contents of the file have been written.  hints contains optional information
-// that aids the recipients in processing the message.
-// If config is nil, sensible defaults will be used.
-func Sign(output io.Writer, signed *Entity, hints *FileHints, config *packet.Config) (input io.WriteCloser, err error) {
-	if signed == nil {
-		return nil, errors.InvalidArgumentError("no signer provided")
-	}
-
-	// These are the possible hash functions that we'll use for the signature.
-	candidateHashes := []uint8{
-		hashToHashId(crypto.SHA256),
-		hashToHashId(crypto.SHA384),
-		hashToHashId(crypto.SHA512),
-		hashToHashId(crypto.SHA1),
-		hashToHashId(crypto.RIPEMD160),
-	}
-	defaultHashes := candidateHashes[len(candidateHashes)-1:]
-	preferredHashes := signed.primaryIdentity().SelfSignature.PreferredHash
-	if len(preferredHashes) == 0 {
-		preferredHashes = defaultHashes
-	}
-	candidateHashes = intersectPreferences(candidateHashes, preferredHashes)
-	return writeAndSign(noOpCloser{output}, candidateHashes, signed, hints, config)
-}
-
-// signatureWriter hashes the contents of a message while passing it along to
-// literalData. When closed, it closes literalData, writes a signature packet
-// to encryptedData and then also closes encryptedData.
-type signatureWriter struct {
-	encryptedData io.WriteCloser
-	literalData   io.WriteCloser
-	hashType      crypto.Hash
-	h             hash.Hash
-	signer        *packet.PrivateKey
-	config        *packet.Config
-}
-
-func (s signatureWriter) Write(data []byte) (int, error) {
-	s.h.Write(data)
-	return s.literalData.Write(data)
-}
-
-func (s signatureWriter) Close() error {
-	sig := &packet.Signature{
-		SigType:      packet.SigTypeBinary,
-		PubKeyAlgo:   s.signer.PubKeyAlgo,
-		Hash:         s.hashType,
-		CreationTime: s.config.Now(),
-		IssuerKeyId:  &s.signer.KeyId,
-	}
-
-	if err := sig.Sign(s.h, s.signer, s.config); err != nil {
-		return err
-	}
-	if err := s.literalData.Close(); err != nil {
-		return err
-	}
-	if err := sig.Serialize(s.encryptedData); err != nil {
-		return err
-	}
-	return s.encryptedData.Close()
-}
-
-// noOpCloser is like an io.NopCloser, but for an io.Writer.
-// TODO: we have two of these in OpenPGP packages alone. This probably needs
-// to be promoted somewhere more common.
-type noOpCloser struct {
-	w io.Writer
-}
-
-func (c noOpCloser) Write(data []byte) (n int, err error) {
-	return c.w.Write(data)
-}
-
-func (c noOpCloser) Close() error {
-	return nil
-}
diff --git a/.ci/providerlint/vendor/golang.org/x/crypto/sha3/doc.go b/.ci/providerlint/vendor/golang.org/x/crypto/sha3/doc.go
new file mode 100644
index 00000000000..decd8cf9bf7
--- /dev/null
+++ b/.ci/providerlint/vendor/golang.org/x/crypto/sha3/doc.go
@@ -0,0 +1,62 @@
+// Copyright 2014 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// Package sha3 implements the SHA-3 fixed-output-length hash functions and
+// the SHAKE variable-output-length hash functions defined by FIPS-202.
+//
+// Both types of hash function use the "sponge" construction and the Keccak
+// permutation. For a detailed specification see http://keccak.noekeon.org/
+//
+// # Guidance
+//
+// If you aren't sure what function you need, use SHAKE256 with at least 64
+// bytes of output. The SHAKE instances are faster than the SHA3 instances;
+// the latter have to allocate memory to conform to the hash.Hash interface.
+//
+// If you need a secret-key MAC (message authentication code), prepend the
+// secret key to the input, hash with SHAKE256 and read at least 32 bytes of
+// output.
+//
+// # Security strengths
+//
+// The SHA3-x (x equals 224, 256, 384, or 512) functions have a security
+// strength against preimage attacks of x bits. Since they only produce "x"
+// bits of output, their collision-resistance is only "x/2" bits.
+//
+// The SHAKE-256 and -128 functions have a generic security strength of 256 and
+// 128 bits against all attacks, provided that at least 2x bits of their output
+// is used.  Requesting more than 64 or 32 bytes of output, respectively, does
+// not increase the collision-resistance of the SHAKE functions.
+//
+// # The sponge construction
+//
+// A sponge builds a pseudo-random function from a public pseudo-random
+// permutation, by applying the permutation to a state of "rate + capacity"
+// bytes, but hiding "capacity" of the bytes.
+//
+// A sponge starts out with a zero state. To hash an input using a sponge, up
+// to "rate" bytes of the input are XORed into the sponge's state. The sponge
+// is then "full" and the permutation is applied to "empty" it. This process is
+// repeated until all the input has been "absorbed". The input is then padded.
+// The digest is "squeezed" from the sponge in the same way, except that output
+// is copied out instead of input being XORed in.
+//
+// A sponge is parameterized by its generic security strength, which is equal
+// to half its capacity; capacity + rate is equal to the permutation's width.
+// Since the KeccakF-1600 permutation is 1600 bits (200 bytes) wide, this means
+// that the security strength of a sponge instance is equal to (1600 - bitrate) / 2.
+//
+// # Recommendations
+//
+// The SHAKE functions are recommended for most new uses. They can produce
+// output of arbitrary length. SHAKE256, with an output length of at least
+// 64 bytes, provides 256-bit security against all attacks.  The Keccak team
+// recommends it for most applications upgrading from SHA2-512. (NIST chose a
+// much stronger, but much slower, sponge instance for SHA3-512.)
+//
+// The SHA-3 functions are "drop-in" replacements for the SHA-2 functions.
+// They produce output of the same length, with the same security strengths
+// against all attacks. This means, in particular, that SHA3-256 only has
+// 128-bit collision resistance, because its output length is 32 bytes.
+package sha3 // import "golang.org/x/crypto/sha3"
diff --git a/.ci/providerlint/vendor/golang.org/x/crypto/sha3/hashes.go b/.ci/providerlint/vendor/golang.org/x/crypto/sha3/hashes.go
new file mode 100644
index 00000000000..0d8043fd2a1
--- /dev/null
+++ b/.ci/providerlint/vendor/golang.org/x/crypto/sha3/hashes.go
@@ -0,0 +1,97 @@
+// Copyright 2014 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package sha3
+
+// This file provides functions for creating instances of the SHA-3
+// and SHAKE hash functions, as well as utility functions for hashing
+// bytes.
+
+import (
+	"hash"
+)
+
+// New224 creates a new SHA3-224 hash.
+// Its generic security strength is 224 bits against preimage attacks,
+// and 112 bits against collision attacks.
+func New224() hash.Hash {
+	if h := new224Asm(); h != nil {
+		return h
+	}
+	return &state{rate: 144, outputLen: 28, dsbyte: 0x06}
+}
+
+// New256 creates a new SHA3-256 hash.
+// Its generic security strength is 256 bits against preimage attacks,
+// and 128 bits against collision attacks.
+func New256() hash.Hash {
+	if h := new256Asm(); h != nil {
+		return h
+	}
+	return &state{rate: 136, outputLen: 32, dsbyte: 0x06}
+}
+
+// New384 creates a new SHA3-384 hash.
+// Its generic security strength is 384 bits against preimage attacks,
+// and 192 bits against collision attacks.
+func New384() hash.Hash {
+	if h := new384Asm(); h != nil {
+		return h
+	}
+	return &state{rate: 104, outputLen: 48, dsbyte: 0x06}
+}
+
+// New512 creates a new SHA3-512 hash.
+// Its generic security strength is 512 bits against preimage attacks,
+// and 256 bits against collision attacks.
+func New512() hash.Hash {
+	if h := new512Asm(); h != nil {
+		return h
+	}
+	return &state{rate: 72, outputLen: 64, dsbyte: 0x06}
+}
+
+// NewLegacyKeccak256 creates a new Keccak-256 hash.
+//
+// Only use this function if you require compatibility with an existing cryptosystem
+// that uses non-standard padding. All other users should use New256 instead.
+func NewLegacyKeccak256() hash.Hash { return &state{rate: 136, outputLen: 32, dsbyte: 0x01} }
+
+// NewLegacyKeccak512 creates a new Keccak-512 hash.
+//
+// Only use this function if you require compatibility with an existing cryptosystem
+// that uses non-standard padding. All other users should use New512 instead.
+func NewLegacyKeccak512() hash.Hash { return &state{rate: 72, outputLen: 64, dsbyte: 0x01} }
+
+// Sum224 returns the SHA3-224 digest of the data.
+func Sum224(data []byte) (digest [28]byte) {
+	h := New224()
+	h.Write(data)
+	h.Sum(digest[:0])
+	return
+}
+
+// Sum256 returns the SHA3-256 digest of the data.
+func Sum256(data []byte) (digest [32]byte) {
+	h := New256()
+	h.Write(data)
+	h.Sum(digest[:0])
+	return
+}
+
+// Sum384 returns the SHA3-384 digest of the data.
+func Sum384(data []byte) (digest [48]byte) {
+	h := New384()
+	h.Write(data)
+	h.Sum(digest[:0])
+	return
+}
+
+// Sum512 returns the SHA3-512 digest of the data.
+func Sum512(data []byte) (digest [64]byte) {
+	h := New512()
+	h.Write(data)
+	h.Sum(digest[:0])
+	return
+}
diff --git a/.ci/providerlint/vendor/golang.org/x/crypto/sha3/hashes_generic.go b/.ci/providerlint/vendor/golang.org/x/crypto/sha3/hashes_generic.go
new file mode 100644
index 00000000000..c74fc20fcb3
--- /dev/null
+++ b/.ci/providerlint/vendor/golang.org/x/crypto/sha3/hashes_generic.go
@@ -0,0 +1,28 @@
+// Copyright 2017 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build !gc || purego || !s390x
+// +build !gc purego !s390x
+
+package sha3
+
+import (
+	"hash"
+)
+
+// new224Asm returns an assembly implementation of SHA3-224 if available,
+// otherwise it returns nil.
+func new224Asm() hash.Hash { return nil }
+
+// new256Asm returns an assembly implementation of SHA3-256 if available,
+// otherwise it returns nil.
+func new256Asm() hash.Hash { return nil }
+
+// new384Asm returns an assembly implementation of SHA3-384 if available,
+// otherwise it returns nil.
+func new384Asm() hash.Hash { return nil }
+
+// new512Asm returns an assembly implementation of SHA3-512 if available,
+// otherwise it returns nil.
+func new512Asm() hash.Hash { return nil }
diff --git a/.ci/providerlint/vendor/golang.org/x/crypto/sha3/keccakf.go b/.ci/providerlint/vendor/golang.org/x/crypto/sha3/keccakf.go
new file mode 100644
index 00000000000..e5faa375c04
--- /dev/null
+++ b/.ci/providerlint/vendor/golang.org/x/crypto/sha3/keccakf.go
@@ -0,0 +1,415 @@
+// Copyright 2014 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build !amd64 || purego || !gc
+// +build !amd64 purego !gc
+
+package sha3
+
+import "math/bits"
+
+// rc stores the round constants for use in the ι step.
+var rc = [24]uint64{
+	0x0000000000000001,
+	0x0000000000008082,
+	0x800000000000808A,
+	0x8000000080008000,
+	0x000000000000808B,
+	0x0000000080000001,
+	0x8000000080008081,
+	0x8000000000008009,
+	0x000000000000008A,
+	0x0000000000000088,
+	0x0000000080008009,
+	0x000000008000000A,
+	0x000000008000808B,
+	0x800000000000008B,
+	0x8000000000008089,
+	0x8000000000008003,
+	0x8000000000008002,
+	0x8000000000000080,
+	0x000000000000800A,
+	0x800000008000000A,
+	0x8000000080008081,
+	0x8000000000008080,
+	0x0000000080000001,
+	0x8000000080008008,
+}
+
+// keccakF1600 applies the Keccak permutation to a 1600b-wide
+// state represented as a slice of 25 uint64s.
+func keccakF1600(a *[25]uint64) {
+	// Implementation translated from Keccak-inplace.c
+	// in the keccak reference code.
+	var t, bc0, bc1, bc2, bc3, bc4, d0, d1, d2, d3, d4 uint64
+
+	for i := 0; i < 24; i += 4 {
+		// Combines the 5 steps in each round into 2 steps.
+		// Unrolls 4 rounds per loop and spreads some steps across rounds.
+
+		// Round 1
+		bc0 = a[0] ^ a[5] ^ a[10] ^ a[15] ^ a[20]
+		bc1 = a[1] ^ a[6] ^ a[11] ^ a[16] ^ a[21]
+		bc2 = a[2] ^ a[7] ^ a[12] ^ a[17] ^ a[22]
+		bc3 = a[3] ^ a[8] ^ a[13] ^ a[18] ^ a[23]
+		bc4 = a[4] ^ a[9] ^ a[14] ^ a[19] ^ a[24]
+		d0 = bc4 ^ (bc1<<1 | bc1>>63)
+		d1 = bc0 ^ (bc2<<1 | bc2>>63)
+		d2 = bc1 ^ (bc3<<1 | bc3>>63)
+		d3 = bc2 ^ (bc4<<1 | bc4>>63)
+		d4 = bc3 ^ (bc0<<1 | bc0>>63)
+
+		bc0 = a[0] ^ d0
+		t = a[6] ^ d1
+		bc1 = bits.RotateLeft64(t, 44)
+		t = a[12] ^ d2
+		bc2 = bits.RotateLeft64(t, 43)
+		t = a[18] ^ d3
+		bc3 = bits.RotateLeft64(t, 21)
+		t = a[24] ^ d4
+		bc4 = bits.RotateLeft64(t, 14)
+		a[0] = bc0 ^ (bc2 &^ bc1) ^ rc[i]
+		a[6] = bc1 ^ (bc3 &^ bc2)
+		a[12] = bc2 ^ (bc4 &^ bc3)
+		a[18] = bc3 ^ (bc0 &^ bc4)
+		a[24] = bc4 ^ (bc1 &^ bc0)
+
+		t = a[10] ^ d0
+		bc2 = bits.RotateLeft64(t, 3)
+		t = a[16] ^ d1
+		bc3 = bits.RotateLeft64(t, 45)
+		t = a[22] ^ d2
+		bc4 = bits.RotateLeft64(t, 61)
+		t = a[3] ^ d3
+		bc0 = bits.RotateLeft64(t, 28)
+		t = a[9] ^ d4
+		bc1 = bits.RotateLeft64(t, 20)
+		a[10] = bc0 ^ (bc2 &^ bc1)
+		a[16] = bc1 ^ (bc3 &^ bc2)
+		a[22] = bc2 ^ (bc4 &^ bc3)
+		a[3] = bc3 ^ (bc0 &^ bc4)
+		a[9] = bc4 ^ (bc1 &^ bc0)
+
+		t = a[20] ^ d0
+		bc4 = bits.RotateLeft64(t, 18)
+		t = a[1] ^ d1
+		bc0 = bits.RotateLeft64(t, 1)
+		t = a[7] ^ d2
+		bc1 = bits.RotateLeft64(t, 6)
+		t = a[13] ^ d3
+		bc2 = bits.RotateLeft64(t, 25)
+		t = a[19] ^ d4
+		bc3 = bits.RotateLeft64(t, 8)
+		a[20] = bc0 ^ (bc2 &^ bc1)
+		a[1] = bc1 ^ (bc3 &^ bc2)
+		a[7] = bc2 ^ (bc4 &^ bc3)
+		a[13] = bc3 ^ (bc0 &^ bc4)
+		a[19] = bc4 ^ (bc1 &^ bc0)
+
+		t = a[5] ^ d0
+		bc1 = bits.RotateLeft64(t, 36)
+		t = a[11] ^ d1
+		bc2 = bits.RotateLeft64(t, 10)
+		t = a[17] ^ d2
+		bc3 = bits.RotateLeft64(t, 15)
+		t = a[23] ^ d3
+		bc4 = bits.RotateLeft64(t, 56)
+		t = a[4] ^ d4
+		bc0 = bits.RotateLeft64(t, 27)
+		a[5] = bc0 ^ (bc2 &^ bc1)
+		a[11] = bc1 ^ (bc3 &^ bc2)
+		a[17] = bc2 ^ (bc4 &^ bc3)
+		a[23] = bc3 ^ (bc0 &^ bc4)
+		a[4] = bc4 ^ (bc1 &^ bc0)
+
+		t = a[15] ^ d0
+		bc3 = bits.RotateLeft64(t, 41)
+		t = a[21] ^ d1
+		bc4 = bits.RotateLeft64(t, 2)
+		t = a[2] ^ d2
+		bc0 = bits.RotateLeft64(t, 62)
+		t = a[8] ^ d3
+		bc1 = bits.RotateLeft64(t, 55)
+		t = a[14] ^ d4
+		bc2 = bits.RotateLeft64(t, 39)
+		a[15] = bc0 ^ (bc2 &^ bc1)
+		a[21] = bc1 ^ (bc3 &^ bc2)
+		a[2] = bc2 ^ (bc4 &^ bc3)
+		a[8] = bc3 ^ (bc0 &^ bc4)
+		a[14] = bc4 ^ (bc1 &^ bc0)
+
+		// Round 2
+		bc0 = a[0] ^ a[5] ^ a[10] ^ a[15] ^ a[20]
+		bc1 = a[1] ^ a[6] ^ a[11] ^ a[16] ^ a[21]
+		bc2 = a[2] ^ a[7] ^ a[12] ^ a[17] ^ a[22]
+		bc3 = a[3] ^ a[8] ^ a[13] ^ a[18] ^ a[23]
+		bc4 = a[4] ^ a[9] ^ a[14] ^ a[19] ^ a[24]
+		d0 = bc4 ^ (bc1<<1 | bc1>>63)
+		d1 = bc0 ^ (bc2<<1 | bc2>>63)
+		d2 = bc1 ^ (bc3<<1 | bc3>>63)
+		d3 = bc2 ^ (bc4<<1 | bc4>>63)
+		d4 = bc3 ^ (bc0<<1 | bc0>>63)
+
+		bc0 = a[0] ^ d0
+		t = a[16] ^ d1
+		bc1 = bits.RotateLeft64(t, 44)
+		t = a[7] ^ d2
+		bc2 = bits.RotateLeft64(t, 43)
+		t = a[23] ^ d3
+		bc3 = bits.RotateLeft64(t, 21)
+		t = a[14] ^ d4
+		bc4 = bits.RotateLeft64(t, 14)
+		a[0] = bc0 ^ (bc2 &^ bc1) ^ rc[i+1]
+		a[16] = bc1 ^ (bc3 &^ bc2)
+		a[7] = bc2 ^ (bc4 &^ bc3)
+		a[23] = bc3 ^ (bc0 &^ bc4)
+		a[14] = bc4 ^ (bc1 &^ bc0)
+
+		t = a[20] ^ d0
+		bc2 = bits.RotateLeft64(t, 3)
+		t = a[11] ^ d1
+		bc3 = bits.RotateLeft64(t, 45)
+		t = a[2] ^ d2
+		bc4 = bits.RotateLeft64(t, 61)
+		t = a[18] ^ d3
+		bc0 = bits.RotateLeft64(t, 28)
+		t = a[9] ^ d4
+		bc1 = bits.RotateLeft64(t, 20)
+		a[20] = bc0 ^ (bc2 &^ bc1)
+		a[11] = bc1 ^ (bc3 &^ bc2)
+		a[2] = bc2 ^ (bc4 &^ bc3)
+		a[18] = bc3 ^ (bc0 &^ bc4)
+		a[9] = bc4 ^ (bc1 &^ bc0)
+
+		t = a[15] ^ d0
+		bc4 = bits.RotateLeft64(t, 18)
+		t = a[6] ^ d1
+		bc0 = bits.RotateLeft64(t, 1)
+		t = a[22] ^ d2
+		bc1 = bits.RotateLeft64(t, 6)
+		t = a[13] ^ d3
+		bc2 = bits.RotateLeft64(t, 25)
+		t = a[4] ^ d4
+		bc3 = bits.RotateLeft64(t, 8)
+		a[15] = bc0 ^ (bc2 &^ bc1)
+		a[6] = bc1 ^ (bc3 &^ bc2)
+		a[22] = bc2 ^ (bc4 &^ bc3)
+		a[13] = bc3 ^ (bc0 &^ bc4)
+		a[4] = bc4 ^ (bc1 &^ bc0)
+
+		t = a[10] ^ d0
+		bc1 = bits.RotateLeft64(t, 36)
+		t = a[1] ^ d1
+		bc2 = bits.RotateLeft64(t, 10)
+		t = a[17] ^ d2
+		bc3 = bits.RotateLeft64(t, 15)
+		t = a[8] ^ d3
+		bc4 = bits.RotateLeft64(t, 56)
+		t = a[24] ^ d4
+		bc0 = bits.RotateLeft64(t, 27)
+		a[10] = bc0 ^ (bc2 &^ bc1)
+		a[1] = bc1 ^ (bc3 &^ bc2)
+		a[17] = bc2 ^ (bc4 &^ bc3)
+		a[8] = bc3 ^ (bc0 &^ bc4)
+		a[24] = bc4 ^ (bc1 &^ bc0)
+
+		t = a[5] ^ d0
+		bc3 = bits.RotateLeft64(t, 41)
+		t = a[21] ^ d1
+		bc4 = bits.RotateLeft64(t, 2)
+		t = a[12] ^ d2
+		bc0 = bits.RotateLeft64(t, 62)
+		t = a[3] ^ d3
+		bc1 = bits.RotateLeft64(t, 55)
+		t = a[19] ^ d4
+		bc2 = bits.RotateLeft64(t, 39)
+		a[5] = bc0 ^ (bc2 &^ bc1)
+		a[21] = bc1 ^ (bc3 &^ bc2)
+		a[12] = bc2 ^ (bc4 &^ bc3)
+		a[3] = bc3 ^ (bc0 &^ bc4)
+		a[19] = bc4 ^ (bc1 &^ bc0)
+
+		// Round 3
+		bc0 = a[0] ^ a[5] ^ a[10] ^ a[15] ^ a[20]
+		bc1 = a[1] ^ a[6] ^ a[11] ^ a[16] ^ a[21]
+		bc2 = a[2] ^ a[7] ^ a[12] ^ a[17] ^ a[22]
+		bc3 = a[3] ^ a[8] ^ a[13] ^ a[18] ^ a[23]
+		bc4 = a[4] ^ a[9] ^ a[14] ^ a[19] ^ a[24]
+		d0 = bc4 ^ (bc1<<1 | bc1>>63)
+		d1 = bc0 ^ (bc2<<1 | bc2>>63)
+		d2 = bc1 ^ (bc3<<1 | bc3>>63)
+		d3 = bc2 ^ (bc4<<1 | bc4>>63)
+		d4 = bc3 ^ (bc0<<1 | bc0>>63)
+
+		bc0 = a[0] ^ d0
+		t = a[11] ^ d1
+		bc1 = bits.RotateLeft64(t, 44)
+		t = a[22] ^ d2
+		bc2 = bits.RotateLeft64(t, 43)
+		t = a[8] ^ d3
+		bc3 = bits.RotateLeft64(t, 21)
+		t = a[19] ^ d4
+		bc4 = bits.RotateLeft64(t, 14)
+		a[0] = bc0 ^ (bc2 &^ bc1) ^ rc[i+2]
+		a[11] = bc1 ^ (bc3 &^ bc2)
+		a[22] = bc2 ^ (bc4 &^ bc3)
+		a[8] = bc3 ^ (bc0 &^ bc4)
+		a[19] = bc4 ^ (bc1 &^ bc0)
+
+		t = a[15] ^ d0
+		bc2 = bits.RotateLeft64(t, 3)
+		t = a[1] ^ d1
+		bc3 = bits.RotateLeft64(t, 45)
+		t = a[12] ^ d2
+		bc4 = bits.RotateLeft64(t, 61)
+		t = a[23] ^ d3
+		bc0 = bits.RotateLeft64(t, 28)
+		t = a[9] ^ d4
+		bc1 = bits.RotateLeft64(t, 20)
+		a[15] = bc0 ^ (bc2 &^ bc1)
+		a[1] = bc1 ^ (bc3 &^ bc2)
+		a[12] = bc2 ^ (bc4 &^ bc3)
+		a[23] = bc3 ^ (bc0 &^ bc4)
+		a[9] = bc4 ^ (bc1 &^ bc0)
+
+		t = a[5] ^ d0
+		bc4 = bits.RotateLeft64(t, 18)
+		t = a[16] ^ d1
+		bc0 = bits.RotateLeft64(t, 1)
+		t = a[2] ^ d2
+		bc1 = bits.RotateLeft64(t, 6)
+		t = a[13] ^ d3
+		bc2 = bits.RotateLeft64(t, 25)
+		t = a[24] ^ d4
+		bc3 = bits.RotateLeft64(t, 8)
+		a[5] = bc0 ^ (bc2 &^ bc1)
+		a[16] = bc1 ^ (bc3 &^ bc2)
+		a[2] = bc2 ^ (bc4 &^ bc3)
+		a[13] = bc3 ^ (bc0 &^ bc4)
+		a[24] = bc4 ^ (bc1 &^ bc0)
+
+		t = a[20] ^ d0
+		bc1 = bits.RotateLeft64(t, 36)
+		t = a[6] ^ d1
+		bc2 = bits.RotateLeft64(t, 10)
+		t = a[17] ^ d2
+		bc3 = bits.RotateLeft64(t, 15)
+		t = a[3] ^ d3
+		bc4 = bits.RotateLeft64(t, 56)
+		t = a[14] ^ d4
+		bc0 = bits.RotateLeft64(t, 27)
+		a[20] = bc0 ^ (bc2 &^ bc1)
+		a[6] = bc1 ^ (bc3 &^ bc2)
+		a[17] = bc2 ^ (bc4 &^ bc3)
+		a[3] = bc3 ^ (bc0 &^ bc4)
+		a[14] = bc4 ^ (bc1 &^ bc0)
+
+		t = a[10] ^ d0
+		bc3 = bits.RotateLeft64(t, 41)
+		t = a[21] ^ d1
+		bc4 = bits.RotateLeft64(t, 2)
+		t = a[7] ^ d2
+		bc0 = bits.RotateLeft64(t, 62)
+		t = a[18] ^ d3
+		bc1 = bits.RotateLeft64(t, 55)
+		t = a[4] ^ d4
+		bc2 = bits.RotateLeft64(t, 39)
+		a[10] = bc0 ^ (bc2 &^ bc1)
+		a[21] = bc1 ^ (bc3 &^ bc2)
+		a[7] = bc2 ^ (bc4 &^ bc3)
+		a[18] = bc3 ^ (bc0 &^ bc4)
+		a[4] = bc4 ^ (bc1 &^ bc0)
+
+		// Round 4
+		bc0 = a[0] ^ a[5] ^ a[10] ^ a[15] ^ a[20]
+		bc1 = a[1] ^ a[6] ^ a[11] ^ a[16] ^ a[21]
+		bc2 = a[2] ^ a[7] ^ a[12] ^ a[17] ^ a[22]
+		bc3 = a[3] ^ a[8] ^ a[13] ^ a[18] ^ a[23]
+		bc4 = a[4] ^ a[9] ^ a[14] ^ a[19] ^ a[24]
+		d0 = bc4 ^ (bc1<<1 | bc1>>63)
+		d1 = bc0 ^ (bc2<<1 | bc2>>63)
+		d2 = bc1 ^ (bc3<<1 | bc3>>63)
+		d3 = bc2 ^ (bc4<<1 | bc4>>63)
+		d4 = bc3 ^ (bc0<<1 | bc0>>63)
+
+		bc0 = a[0] ^ d0
+		t = a[1] ^ d1
+		bc1 = bits.RotateLeft64(t, 44)
+		t = a[2] ^ d2
+		bc2 = bits.RotateLeft64(t, 43)
+		t = a[3] ^ d3
+		bc3 = bits.RotateLeft64(t, 21)
+		t = a[4] ^ d4
+		bc4 = bits.RotateLeft64(t, 14)
+		a[0] = bc0 ^ (bc2 &^ bc1) ^ rc[i+3]
+		a[1] = bc1 ^ (bc3 &^ bc2)
+		a[2] = bc2 ^ (bc4 &^ bc3)
+		a[3] = bc3 ^ (bc0 &^ bc4)
+		a[4] = bc4 ^ (bc1 &^ bc0)
+
+		t = a[5] ^ d0
+		bc2 = bits.RotateLeft64(t, 3)
+		t = a[6] ^ d1
+		bc3 = bits.RotateLeft64(t, 45)
+		t = a[7] ^ d2
+		bc4 = bits.RotateLeft64(t, 61)
+		t = a[8] ^ d3
+		bc0 = bits.RotateLeft64(t, 28)
+		t = a[9] ^ d4
+		bc1 = bits.RotateLeft64(t, 20)
+		a[5] = bc0 ^ (bc2 &^ bc1)
+		a[6] = bc1 ^ (bc3 &^ bc2)
+		a[7] = bc2 ^ (bc4 &^ bc3)
+		a[8] = bc3 ^ (bc0 &^ bc4)
+		a[9] = bc4 ^ (bc1 &^ bc0)
+
+		t = a[10] ^ d0
+		bc4 = bits.RotateLeft64(t, 18)
+		t = a[11] ^ d1
+		bc0 = bits.RotateLeft64(t, 1)
+		t = a[12] ^ d2
+		bc1 = bits.RotateLeft64(t, 6)
+		t = a[13] ^ d3
+		bc2 = bits.RotateLeft64(t, 25)
+		t = a[14] ^ d4
+		bc3 = bits.RotateLeft64(t, 8)
+		a[10] = bc0 ^ (bc2 &^ bc1)
+		a[11] = bc1 ^ (bc3 &^ bc2)
+		a[12] = bc2 ^ (bc4 &^ bc3)
+		a[13] = bc3 ^ (bc0 &^ bc4)
+		a[14] = bc4 ^ (bc1 &^ bc0)
+
+		t = a[15] ^ d0
+		bc1 = bits.RotateLeft64(t, 36)
+		t = a[16] ^ d1
+		bc2 = bits.RotateLeft64(t, 10)
+		t = a[17] ^ d2
+		bc3 = bits.RotateLeft64(t, 15)
+		t = a[18] ^ d3
+		bc4 = bits.RotateLeft64(t, 56)
+		t = a[19] ^ d4
+		bc0 = bits.RotateLeft64(t, 27)
+		a[15] = bc0 ^ (bc2 &^ bc1)
+		a[16] = bc1 ^ (bc3 &^ bc2)
+		a[17] = bc2 ^ (bc4 &^ bc3)
+		a[18] = bc3 ^ (bc0 &^ bc4)
+		a[19] = bc4 ^ (bc1 &^ bc0)
+
+		t = a[20] ^ d0
+		bc3 = bits.RotateLeft64(t, 41)
+		t = a[21] ^ d1
+		bc4 = bits.RotateLeft64(t, 2)
+		t = a[22] ^ d2
+		bc0 = bits.RotateLeft64(t, 62)
+		t = a[23] ^ d3
+		bc1 = bits.RotateLeft64(t, 55)
+		t = a[24] ^ d4
+		bc2 = bits.RotateLeft64(t, 39)
+		a[20] = bc0 ^ (bc2 &^ bc1)
+		a[21] = bc1 ^ (bc3 &^ bc2)
+		a[22] = bc2 ^ (bc4 &^ bc3)
+		a[23] = bc3 ^ (bc0 &^ bc4)
+		a[24] = bc4 ^ (bc1 &^ bc0)
+	}
+}
diff --git a/.ci/providerlint/vendor/golang.org/x/crypto/sha3/keccakf_amd64.go b/.ci/providerlint/vendor/golang.org/x/crypto/sha3/keccakf_amd64.go
new file mode 100644
index 00000000000..248a38241ff
--- /dev/null
+++ b/.ci/providerlint/vendor/golang.org/x/crypto/sha3/keccakf_amd64.go
@@ -0,0 +1,14 @@
+// Copyright 2015 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build amd64 && !purego && gc
+// +build amd64,!purego,gc
+
+package sha3
+
+// This function is implemented in keccakf_amd64.s.
+
+//go:noescape
+
+func keccakF1600(a *[25]uint64)
diff --git a/.ci/providerlint/vendor/golang.org/x/crypto/sha3/keccakf_amd64.s b/.ci/providerlint/vendor/golang.org/x/crypto/sha3/keccakf_amd64.s
new file mode 100644
index 00000000000..4cfa54383bf
--- /dev/null
+++ b/.ci/providerlint/vendor/golang.org/x/crypto/sha3/keccakf_amd64.s
@@ -0,0 +1,391 @@
+// Copyright 2015 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build amd64 && !purego && gc
+// +build amd64,!purego,gc
+
+// This code was translated into a form compatible with 6a from the public
+// domain sources at https://github.com/gvanas/KeccakCodePackage
+
+// Offsets in state
+#define _ba  (0*8)
+#define _be  (1*8)
+#define _bi  (2*8)
+#define _bo  (3*8)
+#define _bu  (4*8)
+#define _ga  (5*8)
+#define _ge  (6*8)
+#define _gi  (7*8)
+#define _go  (8*8)
+#define _gu  (9*8)
+#define _ka (10*8)
+#define _ke (11*8)
+#define _ki (12*8)
+#define _ko (13*8)
+#define _ku (14*8)
+#define _ma (15*8)
+#define _me (16*8)
+#define _mi (17*8)
+#define _mo (18*8)
+#define _mu (19*8)
+#define _sa (20*8)
+#define _se (21*8)
+#define _si (22*8)
+#define _so (23*8)
+#define _su (24*8)
+
+// Temporary registers
+#define rT1  AX
+
+// Round vars
+#define rpState DI
+#define rpStack SP
+
+#define rDa BX
+#define rDe CX
+#define rDi DX
+#define rDo R8
+#define rDu R9
+
+#define rBa R10
+#define rBe R11
+#define rBi R12
+#define rBo R13
+#define rBu R14
+
+#define rCa SI
+#define rCe BP
+#define rCi rBi
+#define rCo rBo
+#define rCu R15
+
+#define MOVQ_RBI_RCE MOVQ rBi, rCe
+#define XORQ_RT1_RCA XORQ rT1, rCa
+#define XORQ_RT1_RCE XORQ rT1, rCe
+#define XORQ_RBA_RCU XORQ rBa, rCu
+#define XORQ_RBE_RCU XORQ rBe, rCu
+#define XORQ_RDU_RCU XORQ rDu, rCu
+#define XORQ_RDA_RCA XORQ rDa, rCa
+#define XORQ_RDE_RCE XORQ rDe, rCe
+
+#define mKeccakRound(iState, oState, rc, B_RBI_RCE, G_RT1_RCA, G_RT1_RCE, G_RBA_RCU, K_RT1_RCA, K_RT1_RCE, K_RBA_RCU, M_RT1_RCA, M_RT1_RCE, M_RBE_RCU, S_RDU_RCU, S_RDA_RCA, S_RDE_RCE) \
+	/* Prepare round */    \
+	MOVQ rCe, rDa;         \
+	ROLQ $1, rDa;          \
+	                       \
+	MOVQ _bi(iState), rCi; \
+	XORQ _gi(iState), rDi; \
+	XORQ rCu, rDa;         \
+	XORQ _ki(iState), rCi; \
+	XORQ _mi(iState), rDi; \
+	XORQ rDi, rCi;         \
+	                       \
+	MOVQ rCi, rDe;         \
+	ROLQ $1, rDe;          \
+	                       \
+	MOVQ _bo(iState), rCo; \
+	XORQ _go(iState), rDo; \
+	XORQ rCa, rDe;         \
+	XORQ _ko(iState), rCo; \
+	XORQ _mo(iState), rDo; \
+	XORQ rDo, rCo;         \
+	                       \
+	MOVQ rCo, rDi;         \
+	ROLQ $1, rDi;          \
+	                       \
+	MOVQ rCu, rDo;         \
+	XORQ rCe, rDi;         \
+	ROLQ $1, rDo;          \
+	                       \
+	MOVQ rCa, rDu;         \
+	XORQ rCi, rDo;         \
+	ROLQ $1, rDu;          \
+	                       \
+	/* Result b */         \
+	MOVQ _ba(iState), rBa; \
+	MOVQ _ge(iState), rBe; \
+	XORQ rCo, rDu;         \
+	MOVQ _ki(iState), rBi; \
+	MOVQ _mo(iState), rBo; \
+	MOVQ _su(iState), rBu; \
+	XORQ rDe, rBe;         \
+	ROLQ $44, rBe;         \
+	XORQ rDi, rBi;         \
+	XORQ rDa, rBa;         \
+	ROLQ $43, rBi;         \
+	                       \
+	MOVQ rBe, rCa;         \
+	MOVQ rc, rT1;          \
+	ORQ  rBi, rCa;         \
+	XORQ rBa, rT1;         \
+	XORQ rT1, rCa;         \
+	MOVQ rCa, _ba(oState); \
+	                       \
+	XORQ rDu, rBu;         \
+	ROLQ $14, rBu;         \
+	MOVQ rBa, rCu;         \
+	ANDQ rBe, rCu;         \
+	XORQ rBu, rCu;         \
+	MOVQ rCu, _bu(oState); \
+	                       \
+	XORQ rDo, rBo;         \
+	ROLQ $21, rBo;         \
+	MOVQ rBo, rT1;         \
+	ANDQ rBu, rT1;         \
+	XORQ rBi, rT1;         \
+	MOVQ rT1, _bi(oState); \
+	                       \
+	NOTQ rBi;              \
+	ORQ  rBa, rBu;         \
+	ORQ  rBo, rBi;         \
+	XORQ rBo, rBu;         \
+	XORQ rBe, rBi;         \
+	MOVQ rBu, _bo(oState); \
+	MOVQ rBi, _be(oState); \
+	B_RBI_RCE;             \
+	                       \
+	/* Result g */         \
+	MOVQ _gu(iState), rBe; \
+	XORQ rDu, rBe;         \
+	MOVQ _ka(iState), rBi; \
+	ROLQ $20, rBe;         \
+	XORQ rDa, rBi;         \
+	ROLQ $3, rBi;          \
+	MOVQ _bo(iState), rBa; \
+	MOVQ rBe, rT1;         \
+	ORQ  rBi, rT1;         \
+	XORQ rDo, rBa;         \
+	MOVQ _me(iState), rBo; \
+	MOVQ _si(iState), rBu; \
+	ROLQ $28, rBa;         \
+	XORQ rBa, rT1;         \
+	MOVQ rT1, _ga(oState); \
+	G_RT1_RCA;             \
+	                       \
+	XORQ rDe, rBo;         \
+	ROLQ $45, rBo;         \
+	MOVQ rBi, rT1;         \
+	ANDQ rBo, rT1;         \
+	XORQ rBe, rT1;         \
+	MOVQ rT1, _ge(oState); \
+	G_RT1_RCE;             \
+	                       \
+	XORQ rDi, rBu;         \
+	ROLQ $61, rBu;         \
+	MOVQ rBu, rT1;         \
+	ORQ  rBa, rT1;         \
+	XORQ rBo, rT1;         \
+	MOVQ rT1, _go(oState); \
+	                       \
+	ANDQ rBe, rBa;         \
+	XORQ rBu, rBa;         \
+	MOVQ rBa, _gu(oState); \
+	NOTQ rBu;              \
+	G_RBA_RCU;             \
+	                       \
+	ORQ  rBu, rBo;         \
+	XORQ rBi, rBo;         \
+	MOVQ rBo, _gi(oState); \
+	                       \
+	/* Result k */         \
+	MOVQ _be(iState), rBa; \
+	MOVQ _gi(iState), rBe; \
+	MOVQ _ko(iState), rBi; \
+	MOVQ _mu(iState), rBo; \
+	MOVQ _sa(iState), rBu; \
+	XORQ rDi, rBe;         \
+	ROLQ $6, rBe;          \
+	XORQ rDo, rBi;         \
+	ROLQ $25, rBi;         \
+	MOVQ rBe, rT1;         \
+	ORQ  rBi, rT1;         \
+	XORQ rDe, rBa;         \
+	ROLQ $1, rBa;          \
+	XORQ rBa, rT1;         \
+	MOVQ rT1, _ka(oState); \
+	K_RT1_RCA;             \
+	                       \
+	XORQ rDu, rBo;         \
+	ROLQ $8, rBo;          \
+	MOVQ rBi, rT1;         \
+	ANDQ rBo, rT1;         \
+	XORQ rBe, rT1;         \
+	MOVQ rT1, _ke(oState); \
+	K_RT1_RCE;             \
+	                       \
+	XORQ rDa, rBu;         \
+	ROLQ $18, rBu;         \
+	NOTQ rBo;              \
+	MOVQ rBo, rT1;         \
+	ANDQ rBu, rT1;         \
+	XORQ rBi, rT1;         \
+	MOVQ rT1, _ki(oState); \
+	                       \
+	MOVQ rBu, rT1;         \
+	ORQ  rBa, rT1;         \
+	XORQ rBo, rT1;         \
+	MOVQ rT1, _ko(oState); \
+	                       \
+	ANDQ rBe, rBa;         \
+	XORQ rBu, rBa;         \
+	MOVQ rBa, _ku(oState); \
+	K_RBA_RCU;             \
+	                       \
+	/* Result m */         \
+	MOVQ _ga(iState), rBe; \
+	XORQ rDa, rBe;         \
+	MOVQ _ke(iState), rBi; \
+	ROLQ $36, rBe;         \
+	XORQ rDe, rBi;         \
+	MOVQ _bu(iState), rBa; \
+	ROLQ $10, rBi;         \
+	MOVQ rBe, rT1;         \
+	MOVQ _mi(iState), rBo; \
+	ANDQ rBi, rT1;         \
+	XORQ rDu, rBa;         \
+	MOVQ _so(iState), rBu; \
+	ROLQ $27, rBa;         \
+	XORQ rBa, rT1;         \
+	MOVQ rT1, _ma(oState); \
+	M_RT1_RCA;             \
+	                       \
+	XORQ rDi, rBo;         \
+	ROLQ $15, rBo;         \
+	MOVQ rBi, rT1;         \
+	ORQ  rBo, rT1;         \
+	XORQ rBe, rT1;         \
+	MOVQ rT1, _me(oState); \
+	M_RT1_RCE;             \
+	                       \
+	XORQ rDo, rBu;         \
+	ROLQ $56, rBu;         \
+	NOTQ rBo;              \
+	MOVQ rBo, rT1;         \
+	ORQ  rBu, rT1;         \
+	XORQ rBi, rT1;         \
+	MOVQ rT1, _mi(oState); \
+	                       \
+	ORQ  rBa, rBe;         \
+	XORQ rBu, rBe;         \
+	MOVQ rBe, _mu(oState); \
+	                       \
+	ANDQ rBa, rBu;         \
+	XORQ rBo, rBu;         \
+	MOVQ rBu, _mo(oState); \
+	M_RBE_RCU;             \
+	                       \
+	/* Result s */         \
+	MOVQ _bi(iState), rBa; \
+	MOVQ _go(iState), rBe; \
+	MOVQ _ku(iState), rBi; \
+	XORQ rDi, rBa;         \
+	MOVQ _ma(iState), rBo; \
+	ROLQ $62, rBa;         \
+	XORQ rDo, rBe;         \
+	MOVQ _se(iState), rBu; \
+	ROLQ $55, rBe;         \
+	                       \
+	XORQ rDu, rBi;         \
+	MOVQ rBa, rDu;         \
+	XORQ rDe, rBu;         \
+	ROLQ $2, rBu;          \
+	ANDQ rBe, rDu;         \
+	XORQ rBu, rDu;         \
+	MOVQ rDu, _su(oState); \
+	                       \
+	ROLQ $39, rBi;         \
+	S_RDU_RCU;             \
+	NOTQ rBe;              \
+	XORQ rDa, rBo;         \
+	MOVQ rBe, rDa;         \
+	ANDQ rBi, rDa;         \
+	XORQ rBa, rDa;         \
+	MOVQ rDa, _sa(oState); \
+	S_RDA_RCA;             \
+	                       \
+	ROLQ $41, rBo;         \
+	MOVQ rBi, rDe;         \
+	ORQ  rBo, rDe;         \
+	XORQ rBe, rDe;         \
+	MOVQ rDe, _se(oState); \
+	S_RDE_RCE;             \
+	                       \
+	MOVQ rBo, rDi;         \
+	MOVQ rBu, rDo;         \
+	ANDQ rBu, rDi;         \
+	ORQ  rBa, rDo;         \
+	XORQ rBi, rDi;         \
+	XORQ rBo, rDo;         \
+	MOVQ rDi, _si(oState); \
+	MOVQ rDo, _so(oState)  \
+
+// func keccakF1600(state *[25]uint64)
+TEXT ·keccakF1600(SB), 0, $200-8
+	MOVQ state+0(FP), rpState
+
+	// Convert the user state into an internal state
+	NOTQ _be(rpState)
+	NOTQ _bi(rpState)
+	NOTQ _go(rpState)
+	NOTQ _ki(rpState)
+	NOTQ _mi(rpState)
+	NOTQ _sa(rpState)
+
+	// Execute the KeccakF permutation
+	MOVQ _ba(rpState), rCa
+	MOVQ _be(rpState), rCe
+	MOVQ _bu(rpState), rCu
+
+	XORQ _ga(rpState), rCa
+	XORQ _ge(rpState), rCe
+	XORQ _gu(rpState), rCu
+
+	XORQ _ka(rpState), rCa
+	XORQ _ke(rpState), rCe
+	XORQ _ku(rpState), rCu
+
+	XORQ _ma(rpState), rCa
+	XORQ _me(rpState), rCe
+	XORQ _mu(rpState), rCu
+
+	XORQ _sa(rpState), rCa
+	XORQ _se(rpState), rCe
+	MOVQ _si(rpState), rDi
+	MOVQ _so(rpState), rDo
+	XORQ _su(rpState), rCu
+
+	mKeccakRound(rpState, rpStack, $0x0000000000000001, MOVQ_RBI_RCE, XORQ_RT1_RCA, XORQ_RT1_RCE, XORQ_RBA_RCU, XORQ_RT1_RCA, XORQ_RT1_RCE, XORQ_RBA_RCU, XORQ_RT1_RCA, XORQ_RT1_RCE, XORQ_RBE_RCU, XORQ_RDU_RCU, XORQ_RDA_RCA, XORQ_RDE_RCE)
+	mKeccakRound(rpStack, rpState, $0x0000000000008082, MOVQ_RBI_RCE, XORQ_RT1_RCA, XORQ_RT1_RCE, XORQ_RBA_RCU, XORQ_RT1_RCA, XORQ_RT1_RCE, XORQ_RBA_RCU, XORQ_RT1_RCA, XORQ_RT1_RCE, XORQ_RBE_RCU, XORQ_RDU_RCU, XORQ_RDA_RCA, XORQ_RDE_RCE)
+	mKeccakRound(rpState, rpStack, $0x800000000000808a, MOVQ_RBI_RCE, XORQ_RT1_RCA, XORQ_RT1_RCE, XORQ_RBA_RCU, XORQ_RT1_RCA, XORQ_RT1_RCE, XORQ_RBA_RCU, XORQ_RT1_RCA, XORQ_RT1_RCE, XORQ_RBE_RCU, XORQ_RDU_RCU, XORQ_RDA_RCA, XORQ_RDE_RCE)
+	mKeccakRound(rpStack, rpState, $0x8000000080008000, MOVQ_RBI_RCE, XORQ_RT1_RCA, XORQ_RT1_RCE, XORQ_RBA_RCU, XORQ_RT1_RCA, XORQ_RT1_RCE, XORQ_RBA_RCU, XORQ_RT1_RCA, XORQ_RT1_RCE, XORQ_RBE_RCU, XORQ_RDU_RCU, XORQ_RDA_RCA, XORQ_RDE_RCE)
+	mKeccakRound(rpState, rpStack, $0x000000000000808b, MOVQ_RBI_RCE, XORQ_RT1_RCA, XORQ_RT1_RCE, XORQ_RBA_RCU, XORQ_RT1_RCA, XORQ_RT1_RCE, XORQ_RBA_RCU, XORQ_RT1_RCA, XORQ_RT1_RCE, XORQ_RBE_RCU, XORQ_RDU_RCU, XORQ_RDA_RCA, XORQ_RDE_RCE)
+	mKeccakRound(rpStack, rpState, $0x0000000080000001, MOVQ_RBI_RCE, XORQ_RT1_RCA, XORQ_RT1_RCE, XORQ_RBA_RCU, XORQ_RT1_RCA, XORQ_RT1_RCE, XORQ_RBA_RCU, XORQ_RT1_RCA, XORQ_RT1_RCE, XORQ_RBE_RCU, XORQ_RDU_RCU, XORQ_RDA_RCA, XORQ_RDE_RCE)
+	mKeccakRound(rpState, rpStack, $0x8000000080008081, MOVQ_RBI_RCE, XORQ_RT1_RCA, XORQ_RT1_RCE, XORQ_RBA_RCU, XORQ_RT1_RCA, XORQ_RT1_RCE, XORQ_RBA_RCU, XORQ_RT1_RCA, XORQ_RT1_RCE, XORQ_RBE_RCU, XORQ_RDU_RCU, XORQ_RDA_RCA, XORQ_RDE_RCE)
+	mKeccakRound(rpStack, rpState, $0x8000000000008009, MOVQ_RBI_RCE, XORQ_RT1_RCA, XORQ_RT1_RCE, XORQ_RBA_RCU, XORQ_RT1_RCA, XORQ_RT1_RCE, XORQ_RBA_RCU, XORQ_RT1_RCA, XORQ_RT1_RCE, XORQ_RBE_RCU, XORQ_RDU_RCU, XORQ_RDA_RCA, XORQ_RDE_RCE)
+	mKeccakRound(rpState, rpStack, $0x000000000000008a, MOVQ_RBI_RCE, XORQ_RT1_RCA, XORQ_RT1_RCE, XORQ_RBA_RCU, XORQ_RT1_RCA, XORQ_RT1_RCE, XORQ_RBA_RCU, XORQ_RT1_RCA, XORQ_RT1_RCE, XORQ_RBE_RCU, XORQ_RDU_RCU, XORQ_RDA_RCA, XORQ_RDE_RCE)
+	mKeccakRound(rpStack, rpState, $0x0000000000000088, MOVQ_RBI_RCE, XORQ_RT1_RCA, XORQ_RT1_RCE, XORQ_RBA_RCU, XORQ_RT1_RCA, XORQ_RT1_RCE, XORQ_RBA_RCU, XORQ_RT1_RCA, XORQ_RT1_RCE, XORQ_RBE_RCU, XORQ_RDU_RCU, XORQ_RDA_RCA, XORQ_RDE_RCE)
+	mKeccakRound(rpState, rpStack, $0x0000000080008009, MOVQ_RBI_RCE, XORQ_RT1_RCA, XORQ_RT1_RCE, XORQ_RBA_RCU, XORQ_RT1_RCA, XORQ_RT1_RCE, XORQ_RBA_RCU, XORQ_RT1_RCA, XORQ_RT1_RCE, XORQ_RBE_RCU, XORQ_RDU_RCU, XORQ_RDA_RCA, XORQ_RDE_RCE)
+	mKeccakRound(rpStack, rpState, $0x000000008000000a, MOVQ_RBI_RCE, XORQ_RT1_RCA, XORQ_RT1_RCE, XORQ_RBA_RCU, XORQ_RT1_RCA, XORQ_RT1_RCE, XORQ_RBA_RCU, XORQ_RT1_RCA, XORQ_RT1_RCE, XORQ_RBE_RCU, XORQ_RDU_RCU, XORQ_RDA_RCA, XORQ_RDE_RCE)
+	mKeccakRound(rpState, rpStack, $0x000000008000808b, MOVQ_RBI_RCE, XORQ_RT1_RCA, XORQ_RT1_RCE, XORQ_RBA_RCU, XORQ_RT1_RCA, XORQ_RT1_RCE, XORQ_RBA_RCU, XORQ_RT1_RCA, XORQ_RT1_RCE, XORQ_RBE_RCU, XORQ_RDU_RCU, XORQ_RDA_RCA, XORQ_RDE_RCE)
+	mKeccakRound(rpStack, rpState, $0x800000000000008b, MOVQ_RBI_RCE, XORQ_RT1_RCA, XORQ_RT1_RCE, XORQ_RBA_RCU, XORQ_RT1_RCA, XORQ_RT1_RCE, XORQ_RBA_RCU, XORQ_RT1_RCA, XORQ_RT1_RCE, XORQ_RBE_RCU, XORQ_RDU_RCU, XORQ_RDA_RCA, XORQ_RDE_RCE)
+	mKeccakRound(rpState, rpStack, $0x8000000000008089, MOVQ_RBI_RCE, XORQ_RT1_RCA, XORQ_RT1_RCE, XORQ_RBA_RCU, XORQ_RT1_RCA, XORQ_RT1_RCE, XORQ_RBA_RCU, XORQ_RT1_RCA, XORQ_RT1_RCE, XORQ_RBE_RCU, XORQ_RDU_RCU, XORQ_RDA_RCA, XORQ_RDE_RCE)
+	mKeccakRound(rpStack, rpState, $0x8000000000008003, MOVQ_RBI_RCE, XORQ_RT1_RCA, XORQ_RT1_RCE, XORQ_RBA_RCU, XORQ_RT1_RCA, XORQ_RT1_RCE, XORQ_RBA_RCU, XORQ_RT1_RCA, XORQ_RT1_RCE, XORQ_RBE_RCU, XORQ_RDU_RCU, XORQ_RDA_RCA, XORQ_RDE_RCE)
+	mKeccakRound(rpState, rpStack, $0x8000000000008002, MOVQ_RBI_RCE, XORQ_RT1_RCA, XORQ_RT1_RCE, XORQ_RBA_RCU, XORQ_RT1_RCA, XORQ_RT1_RCE, XORQ_RBA_RCU, XORQ_RT1_RCA, XORQ_RT1_RCE, XORQ_RBE_RCU, XORQ_RDU_RCU, XORQ_RDA_RCA, XORQ_RDE_RCE)
+	mKeccakRound(rpStack, rpState, $0x8000000000000080, MOVQ_RBI_RCE, XORQ_RT1_RCA, XORQ_RT1_RCE, XORQ_RBA_RCU, XORQ_RT1_RCA, XORQ_RT1_RCE, XORQ_RBA_RCU, XORQ_RT1_RCA, XORQ_RT1_RCE, XORQ_RBE_RCU, XORQ_RDU_RCU, XORQ_RDA_RCA, XORQ_RDE_RCE)
+	mKeccakRound(rpState, rpStack, $0x000000000000800a, MOVQ_RBI_RCE, XORQ_RT1_RCA, XORQ_RT1_RCE, XORQ_RBA_RCU, XORQ_RT1_RCA, XORQ_RT1_RCE, XORQ_RBA_RCU, XORQ_RT1_RCA, XORQ_RT1_RCE, XORQ_RBE_RCU, XORQ_RDU_RCU, XORQ_RDA_RCA, XORQ_RDE_RCE)
+	mKeccakRound(rpStack, rpState, $0x800000008000000a, MOVQ_RBI_RCE, XORQ_RT1_RCA, XORQ_RT1_RCE, XORQ_RBA_RCU, XORQ_RT1_RCA, XORQ_RT1_RCE, XORQ_RBA_RCU, XORQ_RT1_RCA, XORQ_RT1_RCE, XORQ_RBE_RCU, XORQ_RDU_RCU, XORQ_RDA_RCA, XORQ_RDE_RCE)
+	mKeccakRound(rpState, rpStack, $0x8000000080008081, MOVQ_RBI_RCE, XORQ_RT1_RCA, XORQ_RT1_RCE, XORQ_RBA_RCU, XORQ_RT1_RCA, XORQ_RT1_RCE, XORQ_RBA_RCU, XORQ_RT1_RCA, XORQ_RT1_RCE, XORQ_RBE_RCU, XORQ_RDU_RCU, XORQ_RDA_RCA, XORQ_RDE_RCE)
+	mKeccakRound(rpStack, rpState, $0x8000000000008080, MOVQ_RBI_RCE, XORQ_RT1_RCA, XORQ_RT1_RCE, XORQ_RBA_RCU, XORQ_RT1_RCA, XORQ_RT1_RCE, XORQ_RBA_RCU, XORQ_RT1_RCA, XORQ_RT1_RCE, XORQ_RBE_RCU, XORQ_RDU_RCU, XORQ_RDA_RCA, XORQ_RDE_RCE)
+	mKeccakRound(rpState, rpStack, $0x0000000080000001, MOVQ_RBI_RCE, XORQ_RT1_RCA, XORQ_RT1_RCE, XORQ_RBA_RCU, XORQ_RT1_RCA, XORQ_RT1_RCE, XORQ_RBA_RCU, XORQ_RT1_RCA, XORQ_RT1_RCE, XORQ_RBE_RCU, XORQ_RDU_RCU, XORQ_RDA_RCA, XORQ_RDE_RCE)
+	mKeccakRound(rpStack, rpState, $0x8000000080008008, NOP, NOP, NOP, NOP, NOP, NOP, NOP, NOP, NOP, NOP, NOP, NOP, NOP)
+
+	// Revert the internal state to the user state
+	NOTQ _be(rpState)
+	NOTQ _bi(rpState)
+	NOTQ _go(rpState)
+	NOTQ _ki(rpState)
+	NOTQ _mi(rpState)
+	NOTQ _sa(rpState)
+
+	RET
diff --git a/.ci/providerlint/vendor/golang.org/x/crypto/sha3/register.go b/.ci/providerlint/vendor/golang.org/x/crypto/sha3/register.go
new file mode 100644
index 00000000000..8b4453aac3c
--- /dev/null
+++ b/.ci/providerlint/vendor/golang.org/x/crypto/sha3/register.go
@@ -0,0 +1,19 @@
+// Copyright 2014 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build go1.4
+// +build go1.4
+
+package sha3
+
+import (
+	"crypto"
+)
+
+func init() {
+	crypto.RegisterHash(crypto.SHA3_224, New224)
+	crypto.RegisterHash(crypto.SHA3_256, New256)
+	crypto.RegisterHash(crypto.SHA3_384, New384)
+	crypto.RegisterHash(crypto.SHA3_512, New512)
+}
diff --git a/.ci/providerlint/vendor/golang.org/x/crypto/sha3/sha3.go b/.ci/providerlint/vendor/golang.org/x/crypto/sha3/sha3.go
new file mode 100644
index 00000000000..4884d172a49
--- /dev/null
+++ b/.ci/providerlint/vendor/golang.org/x/crypto/sha3/sha3.go
@@ -0,0 +1,197 @@
+// Copyright 2014 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package sha3
+
+// spongeDirection indicates the direction bytes are flowing through the sponge.
+type spongeDirection int
+
+const (
+	// spongeAbsorbing indicates that the sponge is absorbing input.
+	spongeAbsorbing spongeDirection = iota
+	// spongeSqueezing indicates that the sponge is being squeezed.
+	spongeSqueezing
+)
+
+const (
+	// maxRate is the maximum size of the internal buffer. SHAKE-256
+	// currently needs the largest buffer.
+	maxRate = 168
+)
+
+type state struct {
+	// Generic sponge components.
+	a    [25]uint64 // main state of the hash
+	buf  []byte     // points into storage
+	rate int        // the number of bytes of state to use
+
+	// dsbyte contains the "domain separation" bits and the first bit of
+	// the padding. Sections 6.1 and 6.2 of [1] separate the outputs of the
+	// SHA-3 and SHAKE functions by appending bitstrings to the message.
+	// Using a little-endian bit-ordering convention, these are "01" for SHA-3
+	// and "1111" for SHAKE, or 00000010b and 00001111b, respectively. Then the
+	// padding rule from section 5.1 is applied to pad the message to a multiple
+	// of the rate, which involves adding a "1" bit, zero or more "0" bits, and
+	// a final "1" bit. We merge the first "1" bit from the padding into dsbyte,
+	// giving 00000110b (0x06) and 00011111b (0x1f).
+	// [1] http://csrc.nist.gov/publications/drafts/fips-202/fips_202_draft.pdf
+	//     "Draft FIPS 202: SHA-3 Standard: Permutation-Based Hash and
+	//      Extendable-Output Functions (May 2014)"
+	dsbyte byte
+
+	storage storageBuf
+
+	// Specific to SHA-3 and SHAKE.
+	outputLen int             // the default output size in bytes
+	state     spongeDirection // whether the sponge is absorbing or squeezing
+}
+
+// BlockSize returns the rate of sponge underlying this hash function.
+func (d *state) BlockSize() int { return d.rate }
+
+// Size returns the output size of the hash function in bytes.
+func (d *state) Size() int { return d.outputLen }
+
+// Reset clears the internal state by zeroing the sponge state and
+// the byte buffer, and setting Sponge.state to absorbing.
+func (d *state) Reset() {
+	// Zero the permutation's state.
+	for i := range d.a {
+		d.a[i] = 0
+	}
+	d.state = spongeAbsorbing
+	d.buf = d.storage.asBytes()[:0]
+}
+
+func (d *state) clone() *state {
+	ret := *d
+	if ret.state == spongeAbsorbing {
+		ret.buf = ret.storage.asBytes()[:len(ret.buf)]
+	} else {
+		ret.buf = ret.storage.asBytes()[d.rate-cap(d.buf) : d.rate]
+	}
+
+	return &ret
+}
+
+// permute applies the KeccakF-1600 permutation. It handles
+// any input-output buffering.
+func (d *state) permute() {
+	switch d.state {
+	case spongeAbsorbing:
+		// If we're absorbing, we need to xor the input into the state
+		// before applying the permutation.
+		xorIn(d, d.buf)
+		d.buf = d.storage.asBytes()[:0]
+		keccakF1600(&d.a)
+	case spongeSqueezing:
+		// If we're squeezing, we need to apply the permutation before
+		// copying more output.
+		keccakF1600(&d.a)
+		d.buf = d.storage.asBytes()[:d.rate]
+		copyOut(d, d.buf)
+	}
+}
+
+// pads appends the domain separation bits in dsbyte, applies
+// the multi-bitrate 10..1 padding rule, and permutes the state.
+func (d *state) padAndPermute(dsbyte byte) {
+	if d.buf == nil {
+		d.buf = d.storage.asBytes()[:0]
+	}
+	// Pad with this instance's domain-separator bits. We know that there's
+	// at least one byte of space in d.buf because, if it were full,
+	// permute would have been called to empty it. dsbyte also contains the
+	// first one bit for the padding. See the comment in the state struct.
+	d.buf = append(d.buf, dsbyte)
+	zerosStart := len(d.buf)
+	d.buf = d.storage.asBytes()[:d.rate]
+	for i := zerosStart; i < d.rate; i++ {
+		d.buf[i] = 0
+	}
+	// This adds the final one bit for the padding. Because of the way that
+	// bits are numbered from the LSB upwards, the final bit is the MSB of
+	// the last byte.
+	d.buf[d.rate-1] ^= 0x80
+	// Apply the permutation
+	d.permute()
+	d.state = spongeSqueezing
+	d.buf = d.storage.asBytes()[:d.rate]
+	copyOut(d, d.buf)
+}
+
+// Write absorbs more data into the hash's state. It panics if any
+// output has already been read.
+func (d *state) Write(p []byte) (written int, err error) {
+	if d.state != spongeAbsorbing {
+		panic("sha3: Write after Read")
+	}
+	if d.buf == nil {
+		d.buf = d.storage.asBytes()[:0]
+	}
+	written = len(p)
+
+	for len(p) > 0 {
+		if len(d.buf) == 0 && len(p) >= d.rate {
+			// The fast path; absorb a full "rate" bytes of input and apply the permutation.
+			xorIn(d, p[:d.rate])
+			p = p[d.rate:]
+			keccakF1600(&d.a)
+		} else {
+			// The slow path; buffer the input until we can fill the sponge, and then xor it in.
+			todo := d.rate - len(d.buf)
+			if todo > len(p) {
+				todo = len(p)
+			}
+			d.buf = append(d.buf, p[:todo]...)
+			p = p[todo:]
+
+			// If the sponge is full, apply the permutation.
+			if len(d.buf) == d.rate {
+				d.permute()
+			}
+		}
+	}
+
+	return
+}
+
+// Read squeezes an arbitrary number of bytes from the sponge.
+func (d *state) Read(out []byte) (n int, err error) {
+	// If we're still absorbing, pad and apply the permutation.
+	if d.state == spongeAbsorbing {
+		d.padAndPermute(d.dsbyte)
+	}
+
+	n = len(out)
+
+	// Now, do the squeezing.
+	for len(out) > 0 {
+		n := copy(out, d.buf)
+		d.buf = d.buf[n:]
+		out = out[n:]
+
+		// Apply the permutation if we've squeezed the sponge dry.
+		if len(d.buf) == 0 {
+			d.permute()
+		}
+	}
+
+	return
+}
+
+// Sum applies padding to the hash state and then squeezes out the desired
+// number of output bytes. It panics if any output has already been read.
+func (d *state) Sum(in []byte) []byte {
+	if d.state != spongeAbsorbing {
+		panic("sha3: Sum after Read")
+	}
+
+	// Make a copy of the original hash so that caller can keep writing
+	// and summing.
+	dup := d.clone()
+	hash := make([]byte, dup.outputLen, 64) // explicit cap to allow stack allocation
+	dup.Read(hash)
+	return append(in, hash...)
+}
diff --git a/.ci/providerlint/vendor/golang.org/x/crypto/sha3/sha3_s390x.go b/.ci/providerlint/vendor/golang.org/x/crypto/sha3/sha3_s390x.go
new file mode 100644
index 00000000000..ec26f147ff0
--- /dev/null
+++ b/.ci/providerlint/vendor/golang.org/x/crypto/sha3/sha3_s390x.go
@@ -0,0 +1,289 @@
+// Copyright 2017 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build gc && !purego
+// +build gc,!purego
+
+package sha3
+
+// This file contains code for using the 'compute intermediate
+// message digest' (KIMD) and 'compute last message digest' (KLMD)
+// instructions to compute SHA-3 and SHAKE hashes on IBM Z.
+
+import (
+	"hash"
+
+	"golang.org/x/sys/cpu"
+)
+
+// codes represent 7-bit KIMD/KLMD function codes as defined in
+// the Principles of Operation.
+type code uint64
+
+const (
+	// function codes for KIMD/KLMD
+	sha3_224  code = 32
+	sha3_256       = 33
+	sha3_384       = 34
+	sha3_512       = 35
+	shake_128      = 36
+	shake_256      = 37
+	nopad          = 0x100
+)
+
+// kimd is a wrapper for the 'compute intermediate message digest' instruction.
+// src must be a multiple of the rate for the given function code.
+//
+//go:noescape
+func kimd(function code, chain *[200]byte, src []byte)
+
+// klmd is a wrapper for the 'compute last message digest' instruction.
+// src padding is handled by the instruction.
+//
+//go:noescape
+func klmd(function code, chain *[200]byte, dst, src []byte)
+
+type asmState struct {
+	a         [200]byte       // 1600 bit state
+	buf       []byte          // care must be taken to ensure cap(buf) is a multiple of rate
+	rate      int             // equivalent to block size
+	storage   [3072]byte      // underlying storage for buf
+	outputLen int             // output length for full security
+	function  code            // KIMD/KLMD function code
+	state     spongeDirection // whether the sponge is absorbing or squeezing
+}
+
+func newAsmState(function code) *asmState {
+	var s asmState
+	s.function = function
+	switch function {
+	case sha3_224:
+		s.rate = 144
+		s.outputLen = 28
+	case sha3_256:
+		s.rate = 136
+		s.outputLen = 32
+	case sha3_384:
+		s.rate = 104
+		s.outputLen = 48
+	case sha3_512:
+		s.rate = 72
+		s.outputLen = 64
+	case shake_128:
+		s.rate = 168
+		s.outputLen = 32
+	case shake_256:
+		s.rate = 136
+		s.outputLen = 64
+	default:
+		panic("sha3: unrecognized function code")
+	}
+
+	// limit s.buf size to a multiple of s.rate
+	s.resetBuf()
+	return &s
+}
+
+func (s *asmState) clone() *asmState {
+	c := *s
+	c.buf = c.storage[:len(s.buf):cap(s.buf)]
+	return &c
+}
+
+// copyIntoBuf copies b into buf. It will panic if there is not enough space to
+// store all of b.
+func (s *asmState) copyIntoBuf(b []byte) {
+	bufLen := len(s.buf)
+	s.buf = s.buf[:len(s.buf)+len(b)]
+	copy(s.buf[bufLen:], b)
+}
+
+// resetBuf points buf at storage, sets the length to 0 and sets cap to be a
+// multiple of the rate.
+func (s *asmState) resetBuf() {
+	max := (cap(s.storage) / s.rate) * s.rate
+	s.buf = s.storage[:0:max]
+}
+
+// Write (via the embedded io.Writer interface) adds more data to the running hash.
+// It never returns an error.
+func (s *asmState) Write(b []byte) (int, error) {
+	if s.state != spongeAbsorbing {
+		panic("sha3: Write after Read")
+	}
+	length := len(b)
+	for len(b) > 0 {
+		if len(s.buf) == 0 && len(b) >= cap(s.buf) {
+			// Hash the data directly and push any remaining bytes
+			// into the buffer.
+			remainder := len(b) % s.rate
+			kimd(s.function, &s.a, b[:len(b)-remainder])
+			if remainder != 0 {
+				s.copyIntoBuf(b[len(b)-remainder:])
+			}
+			return length, nil
+		}
+
+		if len(s.buf) == cap(s.buf) {
+			// flush the buffer
+			kimd(s.function, &s.a, s.buf)
+			s.buf = s.buf[:0]
+		}
+
+		// copy as much as we can into the buffer
+		n := len(b)
+		if len(b) > cap(s.buf)-len(s.buf) {
+			n = cap(s.buf) - len(s.buf)
+		}
+		s.copyIntoBuf(b[:n])
+		b = b[n:]
+	}
+	return length, nil
+}
+
+// Read squeezes an arbitrary number of bytes from the sponge.
+func (s *asmState) Read(out []byte) (n int, err error) {
+	n = len(out)
+
+	// need to pad if we were absorbing
+	if s.state == spongeAbsorbing {
+		s.state = spongeSqueezing
+
+		// write hash directly into out if possible
+		if len(out)%s.rate == 0 {
+			klmd(s.function, &s.a, out, s.buf) // len(out) may be 0
+			s.buf = s.buf[:0]
+			return
+		}
+
+		// write hash into buffer
+		max := cap(s.buf)
+		if max > len(out) {
+			max = (len(out)/s.rate)*s.rate + s.rate
+		}
+		klmd(s.function, &s.a, s.buf[:max], s.buf)
+		s.buf = s.buf[:max]
+	}
+
+	for len(out) > 0 {
+		// flush the buffer
+		if len(s.buf) != 0 {
+			c := copy(out, s.buf)
+			out = out[c:]
+			s.buf = s.buf[c:]
+			continue
+		}
+
+		// write hash directly into out if possible
+		if len(out)%s.rate == 0 {
+			klmd(s.function|nopad, &s.a, out, nil)
+			return
+		}
+
+		// write hash into buffer
+		s.resetBuf()
+		if cap(s.buf) > len(out) {
+			s.buf = s.buf[:(len(out)/s.rate)*s.rate+s.rate]
+		}
+		klmd(s.function|nopad, &s.a, s.buf, nil)
+	}
+	return
+}
+
+// Sum appends the current hash to b and returns the resulting slice.
+// It does not change the underlying hash state.
+func (s *asmState) Sum(b []byte) []byte {
+	if s.state != spongeAbsorbing {
+		panic("sha3: Sum after Read")
+	}
+
+	// Copy the state to preserve the original.
+	a := s.a
+
+	// Hash the buffer. Note that we don't clear it because we
+	// aren't updating the state.
+	klmd(s.function, &a, nil, s.buf)
+	return append(b, a[:s.outputLen]...)
+}
+
+// Reset resets the Hash to its initial state.
+func (s *asmState) Reset() {
+	for i := range s.a {
+		s.a[i] = 0
+	}
+	s.resetBuf()
+	s.state = spongeAbsorbing
+}
+
+// Size returns the number of bytes Sum will return.
+func (s *asmState) Size() int {
+	return s.outputLen
+}
+
+// BlockSize returns the hash's underlying block size.
+// The Write method must be able to accept any amount
+// of data, but it may operate more efficiently if all writes
+// are a multiple of the block size.
+func (s *asmState) BlockSize() int {
+	return s.rate
+}
+
+// Clone returns a copy of the ShakeHash in its current state.
+func (s *asmState) Clone() ShakeHash {
+	return s.clone()
+}
+
+// new224Asm returns an assembly implementation of SHA3-224 if available,
+// otherwise it returns nil.
+func new224Asm() hash.Hash {
+	if cpu.S390X.HasSHA3 {
+		return newAsmState(sha3_224)
+	}
+	return nil
+}
+
+// new256Asm returns an assembly implementation of SHA3-256 if available,
+// otherwise it returns nil.
+func new256Asm() hash.Hash {
+	if cpu.S390X.HasSHA3 {
+		return newAsmState(sha3_256)
+	}
+	return nil
+}
+
+// new384Asm returns an assembly implementation of SHA3-384 if available,
+// otherwise it returns nil.
+func new384Asm() hash.Hash {
+	if cpu.S390X.HasSHA3 {
+		return newAsmState(sha3_384)
+	}
+	return nil
+}
+
+// new512Asm returns an assembly implementation of SHA3-512 if available,
+// otherwise it returns nil.
+func new512Asm() hash.Hash {
+	if cpu.S390X.HasSHA3 {
+		return newAsmState(sha3_512)
+	}
+	return nil
+}
+
+// newShake128Asm returns an assembly implementation of SHAKE-128 if available,
+// otherwise it returns nil.
+func newShake128Asm() ShakeHash {
+	if cpu.S390X.HasSHA3 {
+		return newAsmState(shake_128)
+	}
+	return nil
+}
+
+// newShake256Asm returns an assembly implementation of SHAKE-256 if available,
+// otherwise it returns nil.
+func newShake256Asm() ShakeHash {
+	if cpu.S390X.HasSHA3 {
+		return newAsmState(shake_256)
+	}
+	return nil
+}
diff --git a/.ci/providerlint/vendor/golang.org/x/crypto/sha3/sha3_s390x.s b/.ci/providerlint/vendor/golang.org/x/crypto/sha3/sha3_s390x.s
new file mode 100644
index 00000000000..a0e051b0451
--- /dev/null
+++ b/.ci/providerlint/vendor/golang.org/x/crypto/sha3/sha3_s390x.s
@@ -0,0 +1,34 @@
+// Copyright 2017 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build gc && !purego
+// +build gc,!purego
+
+#include "textflag.h"
+
+// func kimd(function code, chain *[200]byte, src []byte)
+TEXT ·kimd(SB), NOFRAME|NOSPLIT, $0-40
+	MOVD function+0(FP), R0
+	MOVD chain+8(FP), R1
+	LMG  src+16(FP), R2, R3 // R2=base, R3=len
+
+continue:
+	WORD $0xB93E0002 // KIMD --, R2
+	BVS  continue    // continue if interrupted
+	MOVD $0, R0      // reset R0 for pre-go1.8 compilers
+	RET
+
+// func klmd(function code, chain *[200]byte, dst, src []byte)
+TEXT ·klmd(SB), NOFRAME|NOSPLIT, $0-64
+	// TODO: SHAKE support
+	MOVD function+0(FP), R0
+	MOVD chain+8(FP), R1
+	LMG  dst+16(FP), R2, R3 // R2=base, R3=len
+	LMG  src+40(FP), R4, R5 // R4=base, R5=len
+
+continue:
+	WORD $0xB93F0024 // KLMD R2, R4
+	BVS  continue    // continue if interrupted
+	MOVD $0, R0      // reset R0 for pre-go1.8 compilers
+	RET
diff --git a/.ci/providerlint/vendor/golang.org/x/crypto/sha3/shake.go b/.ci/providerlint/vendor/golang.org/x/crypto/sha3/shake.go
new file mode 100644
index 00000000000..bb69984027f
--- /dev/null
+++ b/.ci/providerlint/vendor/golang.org/x/crypto/sha3/shake.go
@@ -0,0 +1,172 @@
+// Copyright 2014 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package sha3
+
+// This file defines the ShakeHash interface, and provides
+// functions for creating SHAKE and cSHAKE instances, as well as utility
+// functions for hashing bytes to arbitrary-length output.
+//
+//
+// SHAKE implementation is based on FIPS PUB 202 [1]
+// cSHAKE implementations is based on NIST SP 800-185 [2]
+//
+// [1] https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.202.pdf
+// [2] https://doi.org/10.6028/NIST.SP.800-185
+
+import (
+	"encoding/binary"
+	"hash"
+	"io"
+)
+
+// ShakeHash defines the interface to hash functions that support
+// arbitrary-length output. When used as a plain [hash.Hash], it
+// produces minimum-length outputs that provide full-strength generic
+// security.
+type ShakeHash interface {
+	hash.Hash
+
+	// Read reads more output from the hash; reading affects the hash's
+	// state. (ShakeHash.Read is thus very different from Hash.Sum)
+	// It never returns an error, but subsequent calls to Write or Sum
+	// will panic.
+	io.Reader
+
+	// Clone returns a copy of the ShakeHash in its current state.
+	Clone() ShakeHash
+}
+
+// cSHAKE specific context
+type cshakeState struct {
+	*state // SHA-3 state context and Read/Write operations
+
+	// initBlock is the cSHAKE specific initialization set of bytes. It is initialized
+	// by newCShake function and stores concatenation of N followed by S, encoded
+	// by the method specified in 3.3 of [1].
+	// It is stored here in order for Reset() to be able to put context into
+	// initial state.
+	initBlock []byte
+}
+
+// Consts for configuring initial SHA-3 state
+const (
+	dsbyteShake  = 0x1f
+	dsbyteCShake = 0x04
+	rate128      = 168
+	rate256      = 136
+)
+
+func bytepad(input []byte, w int) []byte {
+	// leftEncode always returns max 9 bytes
+	buf := make([]byte, 0, 9+len(input)+w)
+	buf = append(buf, leftEncode(uint64(w))...)
+	buf = append(buf, input...)
+	padlen := w - (len(buf) % w)
+	return append(buf, make([]byte, padlen)...)
+}
+
+func leftEncode(value uint64) []byte {
+	var b [9]byte
+	binary.BigEndian.PutUint64(b[1:], value)
+	// Trim all but last leading zero bytes
+	i := byte(1)
+	for i < 8 && b[i] == 0 {
+		i++
+	}
+	// Prepend number of encoded bytes
+	b[i-1] = 9 - i
+	return b[i-1:]
+}
+
+func newCShake(N, S []byte, rate, outputLen int, dsbyte byte) ShakeHash {
+	c := cshakeState{state: &state{rate: rate, outputLen: outputLen, dsbyte: dsbyte}}
+
+	// leftEncode returns max 9 bytes
+	c.initBlock = make([]byte, 0, 9*2+len(N)+len(S))
+	c.initBlock = append(c.initBlock, leftEncode(uint64(len(N)*8))...)
+	c.initBlock = append(c.initBlock, N...)
+	c.initBlock = append(c.initBlock, leftEncode(uint64(len(S)*8))...)
+	c.initBlock = append(c.initBlock, S...)
+	c.Write(bytepad(c.initBlock, c.rate))
+	return &c
+}
+
+// Reset resets the hash to initial state.
+func (c *cshakeState) Reset() {
+	c.state.Reset()
+	c.Write(bytepad(c.initBlock, c.rate))
+}
+
+// Clone returns copy of a cSHAKE context within its current state.
+func (c *cshakeState) Clone() ShakeHash {
+	b := make([]byte, len(c.initBlock))
+	copy(b, c.initBlock)
+	return &cshakeState{state: c.clone(), initBlock: b}
+}
+
+// Clone returns copy of SHAKE context within its current state.
+func (c *state) Clone() ShakeHash {
+	return c.clone()
+}
+
+// NewShake128 creates a new SHAKE128 variable-output-length ShakeHash.
+// Its generic security strength is 128 bits against all attacks if at
+// least 32 bytes of its output are used.
+func NewShake128() ShakeHash {
+	if h := newShake128Asm(); h != nil {
+		return h
+	}
+	return &state{rate: rate128, outputLen: 32, dsbyte: dsbyteShake}
+}
+
+// NewShake256 creates a new SHAKE256 variable-output-length ShakeHash.
+// Its generic security strength is 256 bits against all attacks if
+// at least 64 bytes of its output are used.
+func NewShake256() ShakeHash {
+	if h := newShake256Asm(); h != nil {
+		return h
+	}
+	return &state{rate: rate256, outputLen: 64, dsbyte: dsbyteShake}
+}
+
+// NewCShake128 creates a new instance of cSHAKE128 variable-output-length ShakeHash,
+// a customizable variant of SHAKE128.
+// N is used to define functions based on cSHAKE, it can be empty when plain cSHAKE is
+// desired. S is a customization byte string used for domain separation - two cSHAKE
+// computations on same input with different S yield unrelated outputs.
+// When N and S are both empty, this is equivalent to NewShake128.
+func NewCShake128(N, S []byte) ShakeHash {
+	if len(N) == 0 && len(S) == 0 {
+		return NewShake128()
+	}
+	return newCShake(N, S, rate128, 32, dsbyteCShake)
+}
+
+// NewCShake256 creates a new instance of cSHAKE256 variable-output-length ShakeHash,
+// a customizable variant of SHAKE256.
+// N is used to define functions based on cSHAKE, it can be empty when plain cSHAKE is
+// desired. S is a customization byte string used for domain separation - two cSHAKE
+// computations on same input with different S yield unrelated outputs.
+// When N and S are both empty, this is equivalent to NewShake256.
+func NewCShake256(N, S []byte) ShakeHash {
+	if len(N) == 0 && len(S) == 0 {
+		return NewShake256()
+	}
+	return newCShake(N, S, rate256, 64, dsbyteCShake)
+}
+
+// ShakeSum128 writes an arbitrary-length digest of data into hash.
+func ShakeSum128(hash, data []byte) {
+	h := NewShake128()
+	h.Write(data)
+	h.Read(hash)
+}
+
+// ShakeSum256 writes an arbitrary-length digest of data into hash.
+func ShakeSum256(hash, data []byte) {
+	h := NewShake256()
+	h.Write(data)
+	h.Read(hash)
+}
diff --git a/.ci/providerlint/vendor/golang.org/x/crypto/sha3/shake_generic.go b/.ci/providerlint/vendor/golang.org/x/crypto/sha3/shake_generic.go
new file mode 100644
index 00000000000..5c0710ef98f
--- /dev/null
+++ b/.ci/providerlint/vendor/golang.org/x/crypto/sha3/shake_generic.go
@@ -0,0 +1,20 @@
+// Copyright 2017 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build !gc || purego || !s390x
+// +build !gc purego !s390x
+
+package sha3
+
+// newShake128Asm returns an assembly implementation of SHAKE-128 if available,
+// otherwise it returns nil.
+func newShake128Asm() ShakeHash {
+	return nil
+}
+
+// newShake256Asm returns an assembly implementation of SHAKE-256 if available,
+// otherwise it returns nil.
+func newShake256Asm() ShakeHash {
+	return nil
+}
diff --git a/.ci/providerlint/vendor/golang.org/x/crypto/sha3/xor.go b/.ci/providerlint/vendor/golang.org/x/crypto/sha3/xor.go
new file mode 100644
index 00000000000..59c8eb94186
--- /dev/null
+++ b/.ci/providerlint/vendor/golang.org/x/crypto/sha3/xor.go
@@ -0,0 +1,24 @@
+// Copyright 2015 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build (!amd64 && !386 && !ppc64le) || purego
+// +build !amd64,!386,!ppc64le purego
+
+package sha3
+
+// A storageBuf is an aligned array of maxRate bytes.
+type storageBuf [maxRate]byte
+
+func (b *storageBuf) asBytes() *[maxRate]byte {
+	return (*[maxRate]byte)(b)
+}
+
+var (
+	xorIn            = xorInGeneric
+	copyOut          = copyOutGeneric
+	xorInUnaligned   = xorInGeneric
+	copyOutUnaligned = copyOutGeneric
+)
+
+const xorImplementationUnaligned = "generic"
diff --git a/.ci/providerlint/vendor/golang.org/x/crypto/sha3/xor_generic.go b/.ci/providerlint/vendor/golang.org/x/crypto/sha3/xor_generic.go
new file mode 100644
index 00000000000..8d947711272
--- /dev/null
+++ b/.ci/providerlint/vendor/golang.org/x/crypto/sha3/xor_generic.go
@@ -0,0 +1,28 @@
+// Copyright 2015 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package sha3
+
+import "encoding/binary"
+
+// xorInGeneric xors the bytes in buf into the state; it
+// makes no non-portable assumptions about memory layout
+// or alignment.
+func xorInGeneric(d *state, buf []byte) {
+	n := len(buf) / 8
+
+	for i := 0; i < n; i++ {
+		a := binary.LittleEndian.Uint64(buf)
+		d.a[i] ^= a
+		buf = buf[8:]
+	}
+}
+
+// copyOutGeneric copies uint64s to a byte buffer.
+func copyOutGeneric(d *state, b []byte) {
+	for i := 0; len(b) >= 8; i++ {
+		binary.LittleEndian.PutUint64(b, d.a[i])
+		b = b[8:]
+	}
+}
diff --git a/.ci/providerlint/vendor/golang.org/x/crypto/sha3/xor_unaligned.go b/.ci/providerlint/vendor/golang.org/x/crypto/sha3/xor_unaligned.go
new file mode 100644
index 00000000000..1ce606246d5
--- /dev/null
+++ b/.ci/providerlint/vendor/golang.org/x/crypto/sha3/xor_unaligned.go
@@ -0,0 +1,68 @@
+// Copyright 2015 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build (amd64 || 386 || ppc64le) && !purego
+// +build amd64 386 ppc64le
+// +build !purego
+
+package sha3
+
+import "unsafe"
+
+// A storageBuf is an aligned array of maxRate bytes.
+type storageBuf [maxRate / 8]uint64
+
+func (b *storageBuf) asBytes() *[maxRate]byte {
+	return (*[maxRate]byte)(unsafe.Pointer(b))
+}
+
+// xorInUnaligned uses unaligned reads and writes to update d.a to contain d.a
+// XOR buf.
+func xorInUnaligned(d *state, buf []byte) {
+	n := len(buf)
+	bw := (*[maxRate / 8]uint64)(unsafe.Pointer(&buf[0]))[: n/8 : n/8]
+	if n >= 72 {
+		d.a[0] ^= bw[0]
+		d.a[1] ^= bw[1]
+		d.a[2] ^= bw[2]
+		d.a[3] ^= bw[3]
+		d.a[4] ^= bw[4]
+		d.a[5] ^= bw[5]
+		d.a[6] ^= bw[6]
+		d.a[7] ^= bw[7]
+		d.a[8] ^= bw[8]
+	}
+	if n >= 104 {
+		d.a[9] ^= bw[9]
+		d.a[10] ^= bw[10]
+		d.a[11] ^= bw[11]
+		d.a[12] ^= bw[12]
+	}
+	if n >= 136 {
+		d.a[13] ^= bw[13]
+		d.a[14] ^= bw[14]
+		d.a[15] ^= bw[15]
+		d.a[16] ^= bw[16]
+	}
+	if n >= 144 {
+		d.a[17] ^= bw[17]
+	}
+	if n >= 168 {
+		d.a[18] ^= bw[18]
+		d.a[19] ^= bw[19]
+		d.a[20] ^= bw[20]
+	}
+}
+
+func copyOutUnaligned(d *state, buf []byte) {
+	ab := (*[maxRate]uint8)(unsafe.Pointer(&d.a[0]))
+	copy(buf, ab[:])
+}
+
+var (
+	xorIn   = xorInUnaligned
+	copyOut = copyOutUnaligned
+)
+
+const xorImplementationUnaligned = "unaligned"
diff --git a/.ci/providerlint/vendor/golang.org/x/mod/internal/lazyregexp/lazyre.go b/.ci/providerlint/vendor/golang.org/x/mod/internal/lazyregexp/lazyre.go
index 2681af35af1..150f887e7a4 100644
--- a/.ci/providerlint/vendor/golang.org/x/mod/internal/lazyregexp/lazyre.go
+++ b/.ci/providerlint/vendor/golang.org/x/mod/internal/lazyregexp/lazyre.go
@@ -13,7 +13,7 @@ import (
 	"sync"
 )
 
-// Regexp is a wrapper around regexp.Regexp, where the underlying regexp will be
+// Regexp is a wrapper around [regexp.Regexp], where the underlying regexp will be
 // compiled the first time it is needed.
 type Regexp struct {
 	str  string
diff --git a/.ci/providerlint/vendor/golang.org/x/mod/modfile/print.go b/.ci/providerlint/vendor/golang.org/x/mod/modfile/print.go
index 524f93022ac..2a0123d4b91 100644
--- a/.ci/providerlint/vendor/golang.org/x/mod/modfile/print.go
+++ b/.ci/providerlint/vendor/golang.org/x/mod/modfile/print.go
@@ -16,7 +16,13 @@ import (
 func Format(f *FileSyntax) []byte {
 	pr := &printer{}
 	pr.file(f)
-	return pr.Bytes()
+
+	// remove trailing blank lines
+	b := pr.Bytes()
+	for len(b) > 0 && b[len(b)-1] == '\n' && (len(b) == 1 || b[len(b)-2] == '\n') {
+		b = b[:len(b)-1]
+	}
+	return b
 }
 
 // A printer collects the state during printing of a file or expression.
@@ -59,7 +65,11 @@ func (p *printer) newline() {
 	}
 
 	p.trim()
-	p.printf("\n")
+	if b := p.Bytes(); len(b) == 0 || (len(b) >= 2 && b[len(b)-1] == '\n' && b[len(b)-2] == '\n') {
+		// skip the blank line at top of file or after a blank line
+	} else {
+		p.printf("\n")
+	}
 	for i := 0; i < p.margin; i++ {
 		p.printf("\t")
 	}
diff --git a/.ci/providerlint/vendor/golang.org/x/mod/modfile/read.go b/.ci/providerlint/vendor/golang.org/x/mod/modfile/read.go
index a503bc2105d..5b5bb5e115b 100644
--- a/.ci/providerlint/vendor/golang.org/x/mod/modfile/read.go
+++ b/.ci/providerlint/vendor/golang.org/x/mod/modfile/read.go
@@ -65,7 +65,7 @@ type Comments struct {
 }
 
 // Comment returns the receiver. This isn't useful by itself, but
-// a Comments struct is embedded into all the expression
+// a [Comments] struct is embedded into all the expression
 // implementation types, and this gives each of those a Comment
 // method to satisfy the Expr interface.
 func (c *Comments) Comment() *Comments {
diff --git a/.ci/providerlint/vendor/golang.org/x/mod/modfile/rule.go b/.ci/providerlint/vendor/golang.org/x/mod/modfile/rule.go
index 6bcde8fabe3..930b6c59bc9 100644
--- a/.ci/providerlint/vendor/golang.org/x/mod/modfile/rule.go
+++ b/.ci/providerlint/vendor/golang.org/x/mod/modfile/rule.go
@@ -5,17 +5,17 @@
 // Package modfile implements a parser and formatter for go.mod files.
 //
 // The go.mod syntax is described in
-// https://golang.org/cmd/go/#hdr-The_go_mod_file.
+// https://pkg.go.dev/cmd/go/#hdr-The_go_mod_file.
 //
-// The Parse and ParseLax functions both parse a go.mod file and return an
+// The [Parse] and [ParseLax] functions both parse a go.mod file and return an
 // abstract syntax tree. ParseLax ignores unknown statements and may be used to
 // parse go.mod files that may have been developed with newer versions of Go.
 //
-// The File struct returned by Parse and ParseLax represent an abstract
-// go.mod file. File has several methods like AddNewRequire and DropReplace
-// that can be used to programmatically edit a file.
+// The [File] struct returned by Parse and ParseLax represent an abstract
+// go.mod file. File has several methods like [File.AddNewRequire] and
+// [File.DropReplace] that can be used to programmatically edit a file.
 //
-// The Format function formats a File back to a byte slice which can be
+// The [Format] function formats a File back to a byte slice which can be
 // written to a file.
 package modfile
 
@@ -35,12 +35,13 @@ import (
 
 // A File is the parsed, interpreted form of a go.mod file.
 type File struct {
-	Module  *Module
-	Go      *Go
-	Require []*Require
-	Exclude []*Exclude
-	Replace []*Replace
-	Retract []*Retract
+	Module    *Module
+	Go        *Go
+	Toolchain *Toolchain
+	Require   []*Require
+	Exclude   []*Exclude
+	Replace   []*Replace
+	Retract   []*Retract
 
 	Syntax *FileSyntax
 }
@@ -58,6 +59,12 @@ type Go struct {
 	Syntax  *Line
 }
 
+// A Toolchain is the toolchain statement.
+type Toolchain struct {
+	Name   string // "go1.21rc1"
+	Syntax *Line
+}
+
 // An Exclude is a single exclude statement.
 type Exclude struct {
 	Mod    module.Version
@@ -219,7 +226,7 @@ var dontFixRetract VersionFixer = func(_, vers string) (string, error) {
 // data is the content of the file.
 //
 // fix is an optional function that canonicalizes module versions.
-// If fix is nil, all module versions must be canonical (module.CanonicalVersion
+// If fix is nil, all module versions must be canonical ([module.CanonicalVersion]
 // must return the same string).
 func Parse(file string, data []byte, fix VersionFixer) (*File, error) {
 	return parseToFile(file, data, fix, true)
@@ -296,9 +303,13 @@ func parseToFile(file string, data []byte, fix VersionFixer, strict bool) (parse
 	return f, nil
 }
 
-var GoVersionRE = lazyregexp.New(`^([1-9][0-9]*)\.(0|[1-9][0-9]*)$`)
+var GoVersionRE = lazyregexp.New(`^([1-9][0-9]*)\.(0|[1-9][0-9]*)(\.(0|[1-9][0-9]*))?([a-z]+[0-9]+)?$`)
 var laxGoVersionRE = lazyregexp.New(`^v?(([1-9][0-9]*)\.(0|[1-9][0-9]*))([^0-9].*)$`)
 
+// Toolchains must be named beginning with `go1`,
+// like "go1.20.3" or "go1.20.3-gccgo". As a special case, "default" is also permitted.
+var ToolchainRE = lazyregexp.New(`^default$|^go1($|\.)`)
+
 func (f *File) add(errs *ErrorList, block *LineBlock, line *Line, verb string, args []string, fix VersionFixer, strict bool) {
 	// If strict is false, this module is a dependency.
 	// We ignore all unknown directives as well as main-module-only
@@ -364,6 +375,21 @@ func (f *File) add(errs *ErrorList, block *LineBlock, line *Line, verb string, a
 		f.Go = &Go{Syntax: line}
 		f.Go.Version = args[0]
 
+	case "toolchain":
+		if f.Toolchain != nil {
+			errorf("repeated toolchain statement")
+			return
+		}
+		if len(args) != 1 {
+			errorf("toolchain directive expects exactly one argument")
+			return
+		} else if strict && !ToolchainRE.MatchString(args[0]) {
+			errorf("invalid toolchain version '%s': must match format go1.23 or local", args[0])
+			return
+		}
+		f.Toolchain = &Toolchain{Syntax: line}
+		f.Toolchain.Name = args[0]
+
 	case "module":
 		if f.Module != nil {
 			errorf("repeated module statement")
@@ -612,6 +638,22 @@ func (f *WorkFile) add(errs *ErrorList, line *Line, verb string, args []string,
 		f.Go = &Go{Syntax: line}
 		f.Go.Version = args[0]
 
+	case "toolchain":
+		if f.Toolchain != nil {
+			errorf("repeated toolchain statement")
+			return
+		}
+		if len(args) != 1 {
+			errorf("toolchain directive expects exactly one argument")
+			return
+		} else if !ToolchainRE.MatchString(args[0]) {
+			errorf("invalid toolchain version '%s': must match format go1.23 or local", args[0])
+			return
+		}
+
+		f.Toolchain = &Toolchain{Syntax: line}
+		f.Toolchain.Name = args[0]
+
 	case "use":
 		if len(args) != 1 {
 			errorf("usage: %s local/dir", verb)
@@ -881,7 +923,7 @@ func (f *File) Format() ([]byte, error) {
 }
 
 // Cleanup cleans up the file f after any edit operations.
-// To avoid quadratic behavior, modifications like DropRequire
+// To avoid quadratic behavior, modifications like [File.DropRequire]
 // clear the entry but do not remove it from the slice.
 // Cleanup cleans out all the cleared entries.
 func (f *File) Cleanup() {
@@ -926,7 +968,7 @@ func (f *File) Cleanup() {
 
 func (f *File) AddGoStmt(version string) error {
 	if !GoVersionRE.MatchString(version) {
-		return fmt.Errorf("invalid language version string %q", version)
+		return fmt.Errorf("invalid language version %q", version)
 	}
 	if f.Go == nil {
 		var hint Expr
@@ -944,6 +986,44 @@ func (f *File) AddGoStmt(version string) error {
 	return nil
 }
 
+// DropGoStmt deletes the go statement from the file.
+func (f *File) DropGoStmt() {
+	if f.Go != nil {
+		f.Go.Syntax.markRemoved()
+		f.Go = nil
+	}
+}
+
+// DropToolchainStmt deletes the toolchain statement from the file.
+func (f *File) DropToolchainStmt() {
+	if f.Toolchain != nil {
+		f.Toolchain.Syntax.markRemoved()
+		f.Toolchain = nil
+	}
+}
+
+func (f *File) AddToolchainStmt(name string) error {
+	if !ToolchainRE.MatchString(name) {
+		return fmt.Errorf("invalid toolchain name %q", name)
+	}
+	if f.Toolchain == nil {
+		var hint Expr
+		if f.Go != nil && f.Go.Syntax != nil {
+			hint = f.Go.Syntax
+		} else if f.Module != nil && f.Module.Syntax != nil {
+			hint = f.Module.Syntax
+		}
+		f.Toolchain = &Toolchain{
+			Name:   name,
+			Syntax: f.Syntax.addLine(hint, "toolchain", name),
+		}
+	} else {
+		f.Toolchain.Name = name
+		f.Syntax.updateLine(f.Toolchain.Syntax, "toolchain", name)
+	}
+	return nil
+}
+
 // AddRequire sets the first require line for path to version vers,
 // preserving any existing comments for that line and removing all
 // other lines for path.
@@ -995,8 +1075,8 @@ func (f *File) AddNewRequire(path, vers string, indirect bool) {
 // The requirements in req must specify at most one distinct version for each
 // module path.
 //
-// If any existing requirements may be removed, the caller should call Cleanup
-// after all edits are complete.
+// If any existing requirements may be removed, the caller should call
+// [File.Cleanup] after all edits are complete.
 func (f *File) SetRequire(req []*Require) {
 	type elem struct {
 		version  string
@@ -1387,13 +1467,21 @@ func (f *File) DropRetract(vi VersionInterval) error {
 func (f *File) SortBlocks() {
 	f.removeDups() // otherwise sorting is unsafe
 
+	// semanticSortForExcludeVersionV is the Go version (plus leading "v") at which
+	// lines in exclude blocks start to use semantic sort instead of lexicographic sort.
+	// See go.dev/issue/60028.
+	const semanticSortForExcludeVersionV = "v1.21"
+	useSemanticSortForExclude := f.Go != nil && semver.Compare("v"+f.Go.Version, semanticSortForExcludeVersionV) >= 0
+
 	for _, stmt := range f.Syntax.Stmt {
 		block, ok := stmt.(*LineBlock)
 		if !ok {
 			continue
 		}
 		less := lineLess
-		if block.Token[0] == "retract" {
+		if block.Token[0] == "exclude" && useSemanticSortForExclude {
+			less = lineExcludeLess
+		} else if block.Token[0] == "retract" {
 			less = lineRetractLess
 		}
 		sort.SliceStable(block.Line, func(i, j int) bool {
@@ -1496,6 +1584,22 @@ func lineLess(li, lj *Line) bool {
 	return len(li.Token) < len(lj.Token)
 }
 
+// lineExcludeLess reports whether li should be sorted before lj for lines in
+// an "exclude" block.
+func lineExcludeLess(li, lj *Line) bool {
+	if len(li.Token) != 2 || len(lj.Token) != 2 {
+		// Not a known exclude specification.
+		// Fall back to sorting lexicographically.
+		return lineLess(li, lj)
+	}
+	// An exclude specification has two tokens: ModulePath and Version.
+	// Compare module path by string order and version by semver rules.
+	if pi, pj := li.Token[0], lj.Token[0]; pi != pj {
+		return pi < pj
+	}
+	return semver.Compare(li.Token[1], lj.Token[1]) < 0
+}
+
 // lineRetractLess returns whether li should be sorted before lj for lines in
 // a "retract" block. It treats each line as a version interval. Single versions
 // are compared as if they were intervals with the same low and high version.
diff --git a/.ci/providerlint/vendor/golang.org/x/mod/modfile/work.go b/.ci/providerlint/vendor/golang.org/x/mod/modfile/work.go
index 0c0e521525a..d7b99376ebe 100644
--- a/.ci/providerlint/vendor/golang.org/x/mod/modfile/work.go
+++ b/.ci/providerlint/vendor/golang.org/x/mod/modfile/work.go
@@ -12,9 +12,10 @@ import (
 
 // A WorkFile is the parsed, interpreted form of a go.work file.
 type WorkFile struct {
-	Go      *Go
-	Use     []*Use
-	Replace []*Replace
+	Go        *Go
+	Toolchain *Toolchain
+	Use       []*Use
+	Replace   []*Replace
 
 	Syntax *FileSyntax
 }
@@ -33,7 +34,7 @@ type Use struct {
 // data is the content of the file.
 //
 // fix is an optional function that canonicalizes module versions.
-// If fix is nil, all module versions must be canonical (module.CanonicalVersion
+// If fix is nil, all module versions must be canonical ([module.CanonicalVersion]
 // must return the same string).
 func ParseWork(file string, data []byte, fix VersionFixer) (*WorkFile, error) {
 	fs, err := parse(file, data)
@@ -82,7 +83,7 @@ func ParseWork(file string, data []byte, fix VersionFixer) (*WorkFile, error) {
 }
 
 // Cleanup cleans up the file f after any edit operations.
-// To avoid quadratic behavior, modifications like DropRequire
+// To avoid quadratic behavior, modifications like [WorkFile.DropRequire]
 // clear the entry but do not remove it from the slice.
 // Cleanup cleans out all the cleared entries.
 func (f *WorkFile) Cleanup() {
@@ -109,7 +110,7 @@ func (f *WorkFile) Cleanup() {
 
 func (f *WorkFile) AddGoStmt(version string) error {
 	if !GoVersionRE.MatchString(version) {
-		return fmt.Errorf("invalid language version string %q", version)
+		return fmt.Errorf("invalid language version %q", version)
 	}
 	if f.Go == nil {
 		stmt := &Line{Token: []string{"go", version}}
@@ -117,7 +118,7 @@ func (f *WorkFile) AddGoStmt(version string) error {
 			Version: version,
 			Syntax:  stmt,
 		}
-		// Find the first non-comment-only block that's and add
+		// Find the first non-comment-only block and add
 		// the go statement before it. That will keep file comments at the top.
 		i := 0
 		for i = 0; i < len(f.Syntax.Stmt); i++ {
@@ -133,6 +134,56 @@ func (f *WorkFile) AddGoStmt(version string) error {
 	return nil
 }
 
+func (f *WorkFile) AddToolchainStmt(name string) error {
+	if !ToolchainRE.MatchString(name) {
+		return fmt.Errorf("invalid toolchain name %q", name)
+	}
+	if f.Toolchain == nil {
+		stmt := &Line{Token: []string{"toolchain", name}}
+		f.Toolchain = &Toolchain{
+			Name:   name,
+			Syntax: stmt,
+		}
+		// Find the go line and add the toolchain line after it.
+		// Or else find the first non-comment-only block and add
+		// the toolchain line before it. That will keep file comments at the top.
+		i := 0
+		for i = 0; i < len(f.Syntax.Stmt); i++ {
+			if line, ok := f.Syntax.Stmt[i].(*Line); ok && len(line.Token) > 0 && line.Token[0] == "go" {
+				i++
+				goto Found
+			}
+		}
+		for i = 0; i < len(f.Syntax.Stmt); i++ {
+			if _, ok := f.Syntax.Stmt[i].(*CommentBlock); !ok {
+				break
+			}
+		}
+	Found:
+		f.Syntax.Stmt = append(append(f.Syntax.Stmt[:i:i], stmt), f.Syntax.Stmt[i:]...)
+	} else {
+		f.Toolchain.Name = name
+		f.Syntax.updateLine(f.Toolchain.Syntax, "toolchain", name)
+	}
+	return nil
+}
+
+// DropGoStmt deletes the go statement from the file.
+func (f *WorkFile) DropGoStmt() {
+	if f.Go != nil {
+		f.Go.Syntax.markRemoved()
+		f.Go = nil
+	}
+}
+
+// DropToolchainStmt deletes the toolchain statement from the file.
+func (f *WorkFile) DropToolchainStmt() {
+	if f.Toolchain != nil {
+		f.Toolchain.Syntax.markRemoved()
+		f.Toolchain = nil
+	}
+}
+
 func (f *WorkFile) AddUse(diskPath, modulePath string) error {
 	need := true
 	for _, d := range f.Use {
diff --git a/.ci/providerlint/vendor/golang.org/x/mod/module/module.go b/.ci/providerlint/vendor/golang.org/x/mod/module/module.go
index e9dec6e6148..2a364b229b9 100644
--- a/.ci/providerlint/vendor/golang.org/x/mod/module/module.go
+++ b/.ci/providerlint/vendor/golang.org/x/mod/module/module.go
@@ -4,7 +4,7 @@
 
 // Package module defines the module.Version type along with support code.
 //
-// The module.Version type is a simple Path, Version pair:
+// The [module.Version] type is a simple Path, Version pair:
 //
 //	type Version struct {
 //		Path string
@@ -12,7 +12,7 @@
 //	}
 //
 // There are no restrictions imposed directly by use of this structure,
-// but additional checking functions, most notably Check, verify that
+// but additional checking functions, most notably [Check], verify that
 // a particular path, version pair is valid.
 //
 // # Escaped Paths
@@ -140,7 +140,7 @@ type ModuleError struct {
 	Err     error
 }
 
-// VersionError returns a ModuleError derived from a Version and error,
+// VersionError returns a [ModuleError] derived from a [Version] and error,
 // or err itself if it is already such an error.
 func VersionError(v Version, err error) error {
 	var mErr *ModuleError
@@ -169,7 +169,7 @@ func (e *ModuleError) Unwrap() error { return e.Err }
 // An InvalidVersionError indicates an error specific to a version, with the
 // module path unknown or specified externally.
 //
-// A ModuleError may wrap an InvalidVersionError, but an InvalidVersionError
+// A [ModuleError] may wrap an InvalidVersionError, but an InvalidVersionError
 // must not wrap a ModuleError.
 type InvalidVersionError struct {
 	Version string
@@ -193,8 +193,8 @@ func (e *InvalidVersionError) Error() string {
 func (e *InvalidVersionError) Unwrap() error { return e.Err }
 
 // An InvalidPathError indicates a module, import, or file path doesn't
-// satisfy all naming constraints. See CheckPath, CheckImportPath,
-// and CheckFilePath for specific restrictions.
+// satisfy all naming constraints. See [CheckPath], [CheckImportPath],
+// and [CheckFilePath] for specific restrictions.
 type InvalidPathError struct {
 	Kind string // "module", "import", or "file"
 	Path string
@@ -294,7 +294,7 @@ func fileNameOK(r rune) bool {
 }
 
 // CheckPath checks that a module path is valid.
-// A valid module path is a valid import path, as checked by CheckImportPath,
+// A valid module path is a valid import path, as checked by [CheckImportPath],
 // with three additional constraints.
 // First, the leading path element (up to the first slash, if any),
 // by convention a domain name, must contain only lower-case ASCII letters,
@@ -380,7 +380,7 @@ const (
 // checkPath returns an error describing why the path is not valid.
 // Because these checks apply to module, import, and file paths,
 // and because other checks may be applied, the caller is expected to wrap
-// this error with InvalidPathError.
+// this error with [InvalidPathError].
 func checkPath(path string, kind pathKind) error {
 	if !utf8.ValidString(path) {
 		return fmt.Errorf("invalid UTF-8")
@@ -532,7 +532,7 @@ var badWindowsNames = []string{
 // they require ".vN" instead of "/vN", and for all N, not just N >= 2.
 // SplitPathVersion returns with ok = false when presented with
 // a path whose last path element does not satisfy the constraints
-// applied by CheckPath, such as "example.com/pkg/v1" or "example.com/pkg/v1.2".
+// applied by [CheckPath], such as "example.com/pkg/v1" or "example.com/pkg/v1.2".
 func SplitPathVersion(path string) (prefix, pathMajor string, ok bool) {
 	if strings.HasPrefix(path, "gopkg.in/") {
 		return splitGopkgIn(path)
@@ -582,7 +582,7 @@ func splitGopkgIn(path string) (prefix, pathMajor string, ok bool) {
 // MatchPathMajor reports whether the semantic version v
 // matches the path major version pathMajor.
 //
-// MatchPathMajor returns true if and only if CheckPathMajor returns nil.
+// MatchPathMajor returns true if and only if [CheckPathMajor] returns nil.
 func MatchPathMajor(v, pathMajor string) bool {
 	return CheckPathMajor(v, pathMajor) == nil
 }
@@ -622,7 +622,7 @@ func CheckPathMajor(v, pathMajor string) error {
 // PathMajorPrefix returns the major-version tag prefix implied by pathMajor.
 // An empty PathMajorPrefix allows either v0 or v1.
 //
-// Note that MatchPathMajor may accept some versions that do not actually begin
+// Note that [MatchPathMajor] may accept some versions that do not actually begin
 // with this prefix: namely, it accepts a 'v0.0.0-' prefix for a '.v1'
 // pathMajor, even though that pathMajor implies 'v1' tagging.
 func PathMajorPrefix(pathMajor string) string {
@@ -643,7 +643,7 @@ func PathMajorPrefix(pathMajor string) string {
 }
 
 // CanonicalVersion returns the canonical form of the version string v.
-// It is the same as semver.Canonical(v) except that it preserves the special build suffix "+incompatible".
+// It is the same as [semver.Canonical] except that it preserves the special build suffix "+incompatible".
 func CanonicalVersion(v string) string {
 	cv := semver.Canonical(v)
 	if semver.Build(v) == "+incompatible" {
@@ -652,8 +652,8 @@ func CanonicalVersion(v string) string {
 	return cv
 }
 
-// Sort sorts the list by Path, breaking ties by comparing Version fields.
-// The Version fields are interpreted as semantic versions (using semver.Compare)
+// Sort sorts the list by Path, breaking ties by comparing [Version] fields.
+// The Version fields are interpreted as semantic versions (using [semver.Compare])
 // optionally followed by a tie-breaking suffix introduced by a slash character,
 // like in "v0.0.1/go.mod".
 func Sort(list []Version) {
@@ -793,7 +793,7 @@ func unescapeString(escaped string) (string, bool) {
 }
 
 // MatchPrefixPatterns reports whether any path prefix of target matches one of
-// the glob patterns (as defined by path.Match) in the comma-separated globs
+// the glob patterns (as defined by [path.Match]) in the comma-separated globs
 // list. This implements the algorithm used when matching a module path to the
 // GOPRIVATE environment variable, as described by 'go help module-private'.
 //
diff --git a/.ci/providerlint/vendor/golang.org/x/mod/module/pseudo.go b/.ci/providerlint/vendor/golang.org/x/mod/module/pseudo.go
index f04ad378869..9cf19d3254e 100644
--- a/.ci/providerlint/vendor/golang.org/x/mod/module/pseudo.go
+++ b/.ci/providerlint/vendor/golang.org/x/mod/module/pseudo.go
@@ -125,7 +125,7 @@ func IsPseudoVersion(v string) bool {
 }
 
 // IsZeroPseudoVersion returns whether v is a pseudo-version with a zero base,
-// timestamp, and revision, as returned by ZeroPseudoVersion.
+// timestamp, and revision, as returned by [ZeroPseudoVersion].
 func IsZeroPseudoVersion(v string) bool {
 	return v == ZeroPseudoVersion(semver.Major(v))
 }
diff --git a/.ci/providerlint/vendor/golang.org/x/mod/semver/semver.go b/.ci/providerlint/vendor/golang.org/x/mod/semver/semver.go
index a30a22bf20f..9a2dfd33a77 100644
--- a/.ci/providerlint/vendor/golang.org/x/mod/semver/semver.go
+++ b/.ci/providerlint/vendor/golang.org/x/mod/semver/semver.go
@@ -140,7 +140,7 @@ func Compare(v, w string) int {
 // Max canonicalizes its arguments and then returns the version string
 // that compares greater.
 //
-// Deprecated: use Compare instead. In most cases, returning a canonicalized
+// Deprecated: use [Compare] instead. In most cases, returning a canonicalized
 // version is not expected or desired.
 func Max(v, w string) string {
 	v = Canonical(v)
@@ -151,7 +151,7 @@ func Max(v, w string) string {
 	return w
 }
 
-// ByVersion implements sort.Interface for sorting semantic version strings.
+// ByVersion implements [sort.Interface] for sorting semantic version strings.
 type ByVersion []string
 
 func (vs ByVersion) Len() int      { return len(vs) }
@@ -164,7 +164,7 @@ func (vs ByVersion) Less(i, j int) bool {
 	return vs[i] < vs[j]
 }
 
-// Sort sorts a list of semantic version strings using ByVersion.
+// Sort sorts a list of semantic version strings using [ByVersion].
 func Sort(list []string) {
 	sort.Sort(ByVersion(list))
 }
diff --git a/.ci/providerlint/vendor/golang.org/x/net/http2/Dockerfile b/.ci/providerlint/vendor/golang.org/x/net/http2/Dockerfile
deleted file mode 100644
index 8512245952b..00000000000
--- a/.ci/providerlint/vendor/golang.org/x/net/http2/Dockerfile
+++ /dev/null
@@ -1,51 +0,0 @@
-#
-# This Dockerfile builds a recent curl with HTTP/2 client support, using
-# a recent nghttp2 build.
-#
-# See the Makefile for how to tag it. If Docker and that image is found, the
-# Go tests use this curl binary for integration tests.
-#
-
-FROM ubuntu:trusty
-
-RUN apt-get update && \
-    apt-get upgrade -y && \
-    apt-get install -y git-core build-essential wget
-
-RUN apt-get install -y --no-install-recommends \
-       autotools-dev libtool pkg-config zlib1g-dev \
-       libcunit1-dev libssl-dev libxml2-dev libevent-dev \
-       automake autoconf
-
-# The list of packages nghttp2 recommends for h2load:
-RUN apt-get install -y --no-install-recommends make binutils \
-        autoconf automake autotools-dev \
-        libtool pkg-config zlib1g-dev libcunit1-dev libssl-dev libxml2-dev \
-        libev-dev libevent-dev libjansson-dev libjemalloc-dev \
-        cython python3.4-dev python-setuptools
-
-# Note: setting NGHTTP2_VER before the git clone, so an old git clone isn't cached:
-ENV NGHTTP2_VER 895da9a
-RUN cd /root && git clone https://github.com/tatsuhiro-t/nghttp2.git
-
-WORKDIR /root/nghttp2
-RUN git reset --hard $NGHTTP2_VER
-RUN autoreconf -i
-RUN automake
-RUN autoconf
-RUN ./configure
-RUN make
-RUN make install
-
-WORKDIR /root
-RUN wget https://curl.se/download/curl-7.45.0.tar.gz
-RUN tar -zxvf curl-7.45.0.tar.gz
-WORKDIR /root/curl-7.45.0
-RUN ./configure --with-ssl --with-nghttp2=/usr/local
-RUN make
-RUN make install
-RUN ldconfig
-
-CMD ["-h"]
-ENTRYPOINT ["/usr/local/bin/curl"]
-
diff --git a/.ci/providerlint/vendor/golang.org/x/net/http2/Makefile b/.ci/providerlint/vendor/golang.org/x/net/http2/Makefile
deleted file mode 100644
index 55fd826f77b..00000000000
--- a/.ci/providerlint/vendor/golang.org/x/net/http2/Makefile
+++ /dev/null
@@ -1,3 +0,0 @@
-curlimage:
-	docker build -t gohttp2/curl .
-
diff --git a/.ci/providerlint/vendor/golang.org/x/net/http2/server.go b/.ci/providerlint/vendor/golang.org/x/net/http2/server.go
index cd057f39824..02c88b6b3e1 100644
--- a/.ci/providerlint/vendor/golang.org/x/net/http2/server.go
+++ b/.ci/providerlint/vendor/golang.org/x/net/http2/server.go
@@ -441,7 +441,7 @@ func (s *Server) ServeConn(c net.Conn, opts *ServeConnOpts) {
 	if s.NewWriteScheduler != nil {
 		sc.writeSched = s.NewWriteScheduler()
 	} else {
-		sc.writeSched = NewPriorityWriteScheduler(nil)
+		sc.writeSched = newRoundRobinWriteScheduler()
 	}
 
 	// These start at the RFC-specified defaults. If there is a higher
@@ -581,9 +581,11 @@ type serverConn struct {
 	advMaxStreams               uint32 // our SETTINGS_MAX_CONCURRENT_STREAMS advertised the client
 	curClientStreams            uint32 // number of open streams initiated by the client
 	curPushedStreams            uint32 // number of open streams initiated by server push
+	curHandlers                 uint32 // number of running handler goroutines
 	maxClientStreamID           uint32 // max ever seen from client (odd), or 0 if there have been no client requests
 	maxPushPromiseID            uint32 // ID of the last push promise (even), or 0 if there have been no pushes
 	streams                     map[uint32]*stream
+	unstartedHandlers           []unstartedHandler
 	initialStreamSendWindowSize int32
 	maxFrameSize                int32
 	peerMaxHeaderListSize       uint32            // zero means unknown (default)
@@ -981,6 +983,8 @@ func (sc *serverConn) serve() {
 					return
 				case gracefulShutdownMsg:
 					sc.startGracefulShutdownInternal()
+				case handlerDoneMsg:
+					sc.handlerDone()
 				default:
 					panic("unknown timer")
 				}
@@ -1012,14 +1016,6 @@ func (sc *serverConn) serve() {
 	}
 }
 
-func (sc *serverConn) awaitGracefulShutdown(sharedCh <-chan struct{}, privateCh chan struct{}) {
-	select {
-	case <-sc.doneServing:
-	case <-sharedCh:
-		close(privateCh)
-	}
-}
-
 type serverMessage int
 
 // Message values sent to serveMsgCh.
@@ -1028,6 +1024,7 @@ var (
 	idleTimerMsg        = new(serverMessage)
 	shutdownTimerMsg    = new(serverMessage)
 	gracefulShutdownMsg = new(serverMessage)
+	handlerDoneMsg      = new(serverMessage)
 )
 
 func (sc *serverConn) onSettingsTimer() { sc.sendServeMsg(settingsTimerMsg) }
@@ -1900,9 +1897,11 @@ func (st *stream) copyTrailersToHandlerRequest() {
 // onReadTimeout is run on its own goroutine (from time.AfterFunc)
 // when the stream's ReadTimeout has fired.
 func (st *stream) onReadTimeout() {
-	// Wrap the ErrDeadlineExceeded to avoid callers depending on us
-	// returning the bare error.
-	st.body.CloseWithError(fmt.Errorf("%w", os.ErrDeadlineExceeded))
+	if st.body != nil {
+		// Wrap the ErrDeadlineExceeded to avoid callers depending on us
+		// returning the bare error.
+		st.body.CloseWithError(fmt.Errorf("%w", os.ErrDeadlineExceeded))
+	}
 }
 
 // onWriteTimeout is run on its own goroutine (from time.AfterFunc)
@@ -2020,13 +2019,10 @@ func (sc *serverConn) processHeaders(f *MetaHeadersFrame) error {
 	// (in Go 1.8), though. That's a more sane option anyway.
 	if sc.hs.ReadTimeout != 0 {
 		sc.conn.SetReadDeadline(time.Time{})
-		if st.body != nil {
-			st.readDeadline = time.AfterFunc(sc.hs.ReadTimeout, st.onReadTimeout)
-		}
+		st.readDeadline = time.AfterFunc(sc.hs.ReadTimeout, st.onReadTimeout)
 	}
 
-	go sc.runHandler(rw, req, handler)
-	return nil
+	return sc.scheduleHandler(id, rw, req, handler)
 }
 
 func (sc *serverConn) upgradeRequest(req *http.Request) {
@@ -2046,6 +2042,10 @@ func (sc *serverConn) upgradeRequest(req *http.Request) {
 		sc.conn.SetReadDeadline(time.Time{})
 	}
 
+	// This is the first request on the connection,
+	// so start the handler directly rather than going
+	// through scheduleHandler.
+	sc.curHandlers++
 	go sc.runHandler(rw, req, sc.handler.ServeHTTP)
 }
 
@@ -2286,8 +2286,62 @@ func (sc *serverConn) newResponseWriter(st *stream, req *http.Request) *response
 	return &responseWriter{rws: rws}
 }
 
+type unstartedHandler struct {
+	streamID uint32
+	rw       *responseWriter
+	req      *http.Request
+	handler  func(http.ResponseWriter, *http.Request)
+}
+
+// scheduleHandler starts a handler goroutine,
+// or schedules one to start as soon as an existing handler finishes.
+func (sc *serverConn) scheduleHandler(streamID uint32, rw *responseWriter, req *http.Request, handler func(http.ResponseWriter, *http.Request)) error {
+	sc.serveG.check()
+	maxHandlers := sc.advMaxStreams
+	if sc.curHandlers < maxHandlers {
+		sc.curHandlers++
+		go sc.runHandler(rw, req, handler)
+		return nil
+	}
+	if len(sc.unstartedHandlers) > int(4*sc.advMaxStreams) {
+		return sc.countError("too_many_early_resets", ConnectionError(ErrCodeEnhanceYourCalm))
+	}
+	sc.unstartedHandlers = append(sc.unstartedHandlers, unstartedHandler{
+		streamID: streamID,
+		rw:       rw,
+		req:      req,
+		handler:  handler,
+	})
+	return nil
+}
+
+func (sc *serverConn) handlerDone() {
+	sc.serveG.check()
+	sc.curHandlers--
+	i := 0
+	maxHandlers := sc.advMaxStreams
+	for ; i < len(sc.unstartedHandlers); i++ {
+		u := sc.unstartedHandlers[i]
+		if sc.streams[u.streamID] == nil {
+			// This stream was reset before its goroutine had a chance to start.
+			continue
+		}
+		if sc.curHandlers >= maxHandlers {
+			break
+		}
+		sc.curHandlers++
+		go sc.runHandler(u.rw, u.req, u.handler)
+		sc.unstartedHandlers[i] = unstartedHandler{} // don't retain references
+	}
+	sc.unstartedHandlers = sc.unstartedHandlers[i:]
+	if len(sc.unstartedHandlers) == 0 {
+		sc.unstartedHandlers = nil
+	}
+}
+
 // Run on its own goroutine.
 func (sc *serverConn) runHandler(rw *responseWriter, req *http.Request, handler func(http.ResponseWriter, *http.Request)) {
+	defer sc.sendServeMsg(handlerDoneMsg)
 	didPanic := true
 	defer func() {
 		rw.rws.stream.cancelCtx()
@@ -2429,7 +2483,7 @@ type requestBody struct {
 	conn          *serverConn
 	closeOnce     sync.Once // for use by Close only
 	sawEOF        bool      // for use by Read only
-	pipe          *pipe     // non-nil if we have a HTTP entity message body
+	pipe          *pipe     // non-nil if we have an HTTP entity message body
 	needsContinue bool      // need to send a 100-continue
 }
 
@@ -2569,7 +2623,8 @@ func (rws *responseWriterState) writeChunk(p []byte) (n int, err error) {
 				clen = ""
 			}
 		}
-		if clen == "" && rws.handlerDone && bodyAllowedForStatus(rws.status) && (len(p) > 0 || !isHeadResp) {
+		_, hasContentLength := rws.snapHeader["Content-Length"]
+		if !hasContentLength && clen == "" && rws.handlerDone && bodyAllowedForStatus(rws.status) && (len(p) > 0 || !isHeadResp) {
 			clen = strconv.Itoa(len(p))
 		}
 		_, hasContentType := rws.snapHeader["Content-Type"]
@@ -2774,7 +2829,7 @@ func (w *responseWriter) FlushError() error {
 		err = rws.bw.Flush()
 	} else {
 		// The bufio.Writer won't call chunkWriter.Write
-		// (writeChunk with zero bytes, so we have to do it
+		// (writeChunk with zero bytes), so we have to do it
 		// ourselves to force the HTTP response header and/or
 		// final DATA frame (with END_STREAM) to be sent.
 		_, err = chunkWriter{rws}.Write(nil)
diff --git a/.ci/providerlint/vendor/golang.org/x/net/http2/transport.go b/.ci/providerlint/vendor/golang.org/x/net/http2/transport.go
index f965579f7d5..4515b22c4a1 100644
--- a/.ci/providerlint/vendor/golang.org/x/net/http2/transport.go
+++ b/.ci/providerlint/vendor/golang.org/x/net/http2/transport.go
@@ -19,6 +19,7 @@ import (
 	"io/fs"
 	"log"
 	"math"
+	"math/bits"
 	mathrand "math/rand"
 	"net"
 	"net/http"
@@ -290,8 +291,7 @@ func (t *Transport) initConnPool() {
 // HTTP/2 server.
 type ClientConn struct {
 	t             *Transport
-	tconn         net.Conn // usually *tls.Conn, except specialized impls
-	tconnClosed   bool
+	tconn         net.Conn             // usually *tls.Conn, except specialized impls
 	tlsState      *tls.ConnectionState // nil only for specialized impls
 	reused        uint32               // whether conn is being reused; atomic
 	singleUse     bool                 // whether being used for a single http.Request
@@ -518,11 +518,14 @@ func (t *Transport) RoundTrip(req *http.Request) (*http.Response, error) {
 func authorityAddr(scheme string, authority string) (addr string) {
 	host, port, err := net.SplitHostPort(authority)
 	if err != nil { // authority didn't have a port
+		host = authority
+		port = ""
+	}
+	if port == "" { // authority's port was empty
 		port = "443"
 		if scheme == "http" {
 			port = "80"
 		}
-		host = authority
 	}
 	if a, err := idna.ToASCII(host); err == nil {
 		host = a
@@ -1266,6 +1269,29 @@ func (cc *ClientConn) RoundTrip(req *http.Request) (*http.Response, error) {
 		return res, nil
 	}
 
+	cancelRequest := func(cs *clientStream, err error) error {
+		cs.cc.mu.Lock()
+		bodyClosed := cs.reqBodyClosed
+		cs.cc.mu.Unlock()
+		// Wait for the request body to be closed.
+		//
+		// If nothing closed the body before now, abortStreamLocked
+		// will have started a goroutine to close it.
+		//
+		// Closing the body before returning avoids a race condition
+		// with net/http checking its readTrackingBody to see if the
+		// body was read from or closed. See golang/go#60041.
+		//
+		// The body is closed in a separate goroutine without the
+		// connection mutex held, but dropping the mutex before waiting
+		// will keep us from holding it indefinitely if the body
+		// close is slow for some reason.
+		if bodyClosed != nil {
+			<-bodyClosed
+		}
+		return err
+	}
+
 	for {
 		select {
 		case <-cs.respHeaderRecv:
@@ -1285,10 +1311,10 @@ func (cc *ClientConn) RoundTrip(req *http.Request) (*http.Response, error) {
 		case <-ctx.Done():
 			err := ctx.Err()
 			cs.abortStream(err)
-			return nil, err
+			return nil, cancelRequest(cs, err)
 		case <-cs.reqCancel:
 			cs.abortStream(errRequestCanceled)
-			return nil, errRequestCanceled
+			return nil, cancelRequest(cs, errRequestCanceled)
 		}
 	}
 }
@@ -1654,7 +1680,27 @@ func (cs *clientStream) frameScratchBufferLen(maxFrameSize int) int {
 	return int(n) // doesn't truncate; max is 512K
 }
 
-var bufPool sync.Pool // of *[]byte
+// Seven bufPools manage different frame sizes. This helps to avoid scenarios where long-running
+// streaming requests using small frame sizes occupy large buffers initially allocated for prior
+// requests needing big buffers. The size ranges are as follows:
+// {0 KB, 16 KB], {16 KB, 32 KB], {32 KB, 64 KB], {64 KB, 128 KB], {128 KB, 256 KB],
+// {256 KB, 512 KB], {512 KB, infinity}
+// In practice, the maximum scratch buffer size should not exceed 512 KB due to
+// frameScratchBufferLen(maxFrameSize), thus the "infinity pool" should never be used.
+// It exists mainly as a safety measure, for potential future increases in max buffer size.
+var bufPools [7]sync.Pool // of *[]byte
+func bufPoolIndex(size int) int {
+	if size <= 16384 {
+		return 0
+	}
+	size -= 1
+	bits := bits.Len(uint(size))
+	index := bits - 14
+	if index >= len(bufPools) {
+		return len(bufPools) - 1
+	}
+	return index
+}
 
 func (cs *clientStream) writeRequestBody(req *http.Request) (err error) {
 	cc := cs.cc
@@ -1672,12 +1718,13 @@ func (cs *clientStream) writeRequestBody(req *http.Request) (err error) {
 	// Scratch buffer for reading into & writing from.
 	scratchLen := cs.frameScratchBufferLen(maxFrameSize)
 	var buf []byte
-	if bp, ok := bufPool.Get().(*[]byte); ok && len(*bp) >= scratchLen {
-		defer bufPool.Put(bp)
+	index := bufPoolIndex(scratchLen)
+	if bp, ok := bufPools[index].Get().(*[]byte); ok && len(*bp) >= scratchLen {
+		defer bufPools[index].Put(bp)
 		buf = *bp
 	} else {
 		buf = make([]byte, scratchLen)
-		defer bufPool.Put(&buf)
+		defer bufPools[index].Put(&buf)
 	}
 
 	var sawEOF bool
@@ -1845,6 +1892,9 @@ func (cc *ClientConn) encodeHeaders(req *http.Request, addGzipHeader bool, trail
 	if err != nil {
 		return nil, err
 	}
+	if !httpguts.ValidHostHeader(host) {
+		return nil, errors.New("http2: invalid Host header")
+	}
 
 	var path string
 	if req.Method != "CONNECT" {
@@ -1881,7 +1931,7 @@ func (cc *ClientConn) encodeHeaders(req *http.Request, addGzipHeader bool, trail
 		// 8.1.2.3 Request Pseudo-Header Fields
 		// The :path pseudo-header field includes the path and query parts of the
 		// target URI (the path-absolute production and optionally a '?' character
-		// followed by the query production (see Sections 3.3 and 3.4 of
+		// followed by the query production, see Sections 3.3 and 3.4 of
 		// [RFC3986]).
 		f(":authority", host)
 		m := req.Method
diff --git a/.ci/providerlint/vendor/golang.org/x/net/http2/writesched.go b/.ci/providerlint/vendor/golang.org/x/net/http2/writesched.go
index c7cd0017392..cc893adc29a 100644
--- a/.ci/providerlint/vendor/golang.org/x/net/http2/writesched.go
+++ b/.ci/providerlint/vendor/golang.org/x/net/http2/writesched.go
@@ -184,7 +184,8 @@ func (wr *FrameWriteRequest) replyToWriter(err error) {
 
 // writeQueue is used by implementations of WriteScheduler.
 type writeQueue struct {
-	s []FrameWriteRequest
+	s          []FrameWriteRequest
+	prev, next *writeQueue
 }
 
 func (q *writeQueue) empty() bool { return len(q.s) == 0 }
diff --git a/.ci/providerlint/vendor/golang.org/x/net/http2/writesched_roundrobin.go b/.ci/providerlint/vendor/golang.org/x/net/http2/writesched_roundrobin.go
new file mode 100644
index 00000000000..54fe86322d2
--- /dev/null
+++ b/.ci/providerlint/vendor/golang.org/x/net/http2/writesched_roundrobin.go
@@ -0,0 +1,119 @@
+// Copyright 2023 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package http2
+
+import (
+	"fmt"
+	"math"
+)
+
+type roundRobinWriteScheduler struct {
+	// control contains control frames (SETTINGS, PING, etc.).
+	control writeQueue
+
+	// streams maps stream ID to a queue.
+	streams map[uint32]*writeQueue
+
+	// stream queues are stored in a circular linked list.
+	// head is the next stream to write, or nil if there are no streams open.
+	head *writeQueue
+
+	// pool of empty queues for reuse.
+	queuePool writeQueuePool
+}
+
+// newRoundRobinWriteScheduler constructs a new write scheduler.
+// The round robin scheduler priorizes control frames
+// like SETTINGS and PING over DATA frames.
+// When there are no control frames to send, it performs a round-robin
+// selection from the ready streams.
+func newRoundRobinWriteScheduler() WriteScheduler {
+	ws := &roundRobinWriteScheduler{
+		streams: make(map[uint32]*writeQueue),
+	}
+	return ws
+}
+
+func (ws *roundRobinWriteScheduler) OpenStream(streamID uint32, options OpenStreamOptions) {
+	if ws.streams[streamID] != nil {
+		panic(fmt.Errorf("stream %d already opened", streamID))
+	}
+	q := ws.queuePool.get()
+	ws.streams[streamID] = q
+	if ws.head == nil {
+		ws.head = q
+		q.next = q
+		q.prev = q
+	} else {
+		// Queues are stored in a ring.
+		// Insert the new stream before ws.head, putting it at the end of the list.
+		q.prev = ws.head.prev
+		q.next = ws.head
+		q.prev.next = q
+		q.next.prev = q
+	}
+}
+
+func (ws *roundRobinWriteScheduler) CloseStream(streamID uint32) {
+	q := ws.streams[streamID]
+	if q == nil {
+		return
+	}
+	if q.next == q {
+		// This was the only open stream.
+		ws.head = nil
+	} else {
+		q.prev.next = q.next
+		q.next.prev = q.prev
+		if ws.head == q {
+			ws.head = q.next
+		}
+	}
+	delete(ws.streams, streamID)
+	ws.queuePool.put(q)
+}
+
+func (ws *roundRobinWriteScheduler) AdjustStream(streamID uint32, priority PriorityParam) {}
+
+func (ws *roundRobinWriteScheduler) Push(wr FrameWriteRequest) {
+	if wr.isControl() {
+		ws.control.push(wr)
+		return
+	}
+	q := ws.streams[wr.StreamID()]
+	if q == nil {
+		// This is a closed stream.
+		// wr should not be a HEADERS or DATA frame.
+		// We push the request onto the control queue.
+		if wr.DataSize() > 0 {
+			panic("add DATA on non-open stream")
+		}
+		ws.control.push(wr)
+		return
+	}
+	q.push(wr)
+}
+
+func (ws *roundRobinWriteScheduler) Pop() (FrameWriteRequest, bool) {
+	// Control and RST_STREAM frames first.
+	if !ws.control.empty() {
+		return ws.control.shift(), true
+	}
+	if ws.head == nil {
+		return FrameWriteRequest{}, false
+	}
+	q := ws.head
+	for {
+		if wr, ok := q.consume(math.MaxInt32); ok {
+			ws.head = q.next
+			return wr, true
+		}
+		q = q.next
+		if q == ws.head {
+			break
+		}
+	}
+	return FrameWriteRequest{}, false
+}
diff --git a/.ci/providerlint/vendor/golang.org/x/net/idna/idna9.0.0.go b/.ci/providerlint/vendor/golang.org/x/net/idna/idna9.0.0.go
index aae6aac872b..ee1698cefbd 100644
--- a/.ci/providerlint/vendor/golang.org/x/net/idna/idna9.0.0.go
+++ b/.ci/providerlint/vendor/golang.org/x/net/idna/idna9.0.0.go
@@ -121,7 +121,7 @@ func CheckJoiners(enable bool) Option {
 	}
 }
 
-// StrictDomainName limits the set of permissable ASCII characters to those
+// StrictDomainName limits the set of permissible ASCII characters to those
 // allowed in domain names as defined in RFC 1034 (A-Z, a-z, 0-9 and the
 // hyphen). This is set by default for MapForLookup and ValidateForRegistration,
 // but is only useful if ValidateLabels is set.
diff --git a/.ci/providerlint/vendor/golang.org/x/net/idna/tables13.0.0.go b/.ci/providerlint/vendor/golang.org/x/net/idna/tables13.0.0.go
index 390c5e56d2a..66701eadfb3 100644
--- a/.ci/providerlint/vendor/golang.org/x/net/idna/tables13.0.0.go
+++ b/.ci/providerlint/vendor/golang.org/x/net/idna/tables13.0.0.go
@@ -1,151 +1,294 @@
 // Code generated by running "go generate" in golang.org/x/text. DO NOT EDIT.
 
-//go:build go1.16
-// +build go1.16
+//go:build go1.16 && !go1.21
+// +build go1.16,!go1.21
 
 package idna
 
 // UnicodeVersion is the Unicode version from which the tables in this package are derived.
 const UnicodeVersion = "13.0.0"
 
-var mappings string = "" + // Size: 8188 bytes
-	"\x00\x01 \x03 ̈\x01a\x03 ̄\x012\x013\x03 ́\x03 ̧\x011\x01o\x051⁄4\x051⁄2" +
-	"\x053⁄4\x03i̇\x03l·\x03ʼn\x01s\x03dž\x03ⱥ\x03ⱦ\x01h\x01j\x01r\x01w\x01y" +
-	"\x03 ̆\x03 ̇\x03 ̊\x03 ̨\x03 ̃\x03 ̋\x01l\x01x\x04̈́\x03 ι\x01;\x05 ̈́" +
-	"\x04եւ\x04اٴ\x04وٴ\x04ۇٴ\x04يٴ\x06क़\x06ख़\x06ग़\x06ज़\x06ड़\x06ढ़\x06फ़" +
-	"\x06य़\x06ড়\x06ঢ়\x06য়\x06ਲ਼\x06ਸ਼\x06ਖ਼\x06ਗ਼\x06ਜ਼\x06ਫ਼\x06ଡ଼\x06ଢ଼" +
-	"\x06ํา\x06ໍາ\x06ຫນ\x06ຫມ\x06གྷ\x06ཌྷ\x06དྷ\x06བྷ\x06ཛྷ\x06ཀྵ\x06ཱི\x06ཱུ" +
-	"\x06ྲྀ\x09ྲཱྀ\x06ླྀ\x09ླཱྀ\x06ཱྀ\x06ྒྷ\x06ྜྷ\x06ྡྷ\x06ྦྷ\x06ྫྷ\x06ྐྵ\x02" +
-	"в\x02д\x02о\x02с\x02т\x02ъ\x02ѣ\x02æ\x01b\x01d\x01e\x02ǝ\x01g\x01i\x01k" +
-	"\x01m\x01n\x02ȣ\x01p\x01t\x01u\x02ɐ\x02ɑ\x02ə\x02ɛ\x02ɜ\x02ŋ\x02ɔ\x02ɯ" +
-	"\x01v\x02β\x02γ\x02δ\x02φ\x02χ\x02ρ\x02н\x02ɒ\x01c\x02ɕ\x02ð\x01f\x02ɟ" +
-	"\x02ɡ\x02ɥ\x02ɨ\x02ɩ\x02ɪ\x02ʝ\x02ɭ\x02ʟ\x02ɱ\x02ɰ\x02ɲ\x02ɳ\x02ɴ\x02ɵ" +
-	"\x02ɸ\x02ʂ\x02ʃ\x02ƫ\x02ʉ\x02ʊ\x02ʋ\x02ʌ\x01z\x02ʐ\x02ʑ\x02ʒ\x02θ\x02ss" +
-	"\x02ά\x02έ\x02ή\x02ί\x02ό\x02ύ\x02ώ\x05ἀι\x05ἁι\x05ἂι\x05ἃι\x05ἄι\x05ἅι" +
-	"\x05ἆι\x05ἇι\x05ἠι\x05ἡι\x05ἢι\x05ἣι\x05ἤι\x05ἥι\x05ἦι\x05ἧι\x05ὠι\x05ὡι" +
-	"\x05ὢι\x05ὣι\x05ὤι\x05ὥι\x05ὦι\x05ὧι\x05ὰι\x04αι\x04άι\x05ᾶι\x02ι\x05 ̈͂" +
-	"\x05ὴι\x04ηι\x04ήι\x05ῆι\x05 ̓̀\x05 ̓́\x05 ̓͂\x02ΐ\x05 ̔̀\x05 ̔́\x05 ̔͂" +
-	"\x02ΰ\x05 ̈̀\x01`\x05ὼι\x04ωι\x04ώι\x05ῶι\x06′′\x09′′′\x06‵‵\x09‵‵‵\x02!" +
-	"!\x02??\x02?!\x02!?\x0c′′′′\x010\x014\x015\x016\x017\x018\x019\x01+\x01=" +
-	"\x01(\x01)\x02rs\x02ħ\x02no\x01q\x02sm\x02tm\x02ω\x02å\x02א\x02ב\x02ג" +
-	"\x02ד\x02π\x051⁄7\x051⁄9\x061⁄10\x051⁄3\x052⁄3\x051⁄5\x052⁄5\x053⁄5\x054" +
-	"⁄5\x051⁄6\x055⁄6\x051⁄8\x053⁄8\x055⁄8\x057⁄8\x041⁄\x02ii\x02iv\x02vi" +
-	"\x04viii\x02ix\x02xi\x050⁄3\x06∫∫\x09∫∫∫\x06∮∮\x09∮∮∮\x0210\x0211\x0212" +
-	"\x0213\x0214\x0215\x0216\x0217\x0218\x0219\x0220\x04(10)\x04(11)\x04(12)" +
-	"\x04(13)\x04(14)\x04(15)\x04(16)\x04(17)\x04(18)\x04(19)\x04(20)\x0c∫∫∫∫" +
-	"\x02==\x05⫝̸\x02ɫ\x02ɽ\x02ȿ\x02ɀ\x01.\x04 ゙\x04 ゚\x06より\x06コト\x05(ᄀ)\x05" +
-	"(ᄂ)\x05(ᄃ)\x05(ᄅ)\x05(ᄆ)\x05(ᄇ)\x05(ᄉ)\x05(ᄋ)\x05(ᄌ)\x05(ᄎ)\x05(ᄏ)\x05(ᄐ" +
-	")\x05(ᄑ)\x05(ᄒ)\x05(가)\x05(나)\x05(다)\x05(라)\x05(마)\x05(바)\x05(사)\x05(아)" +
-	"\x05(자)\x05(차)\x05(카)\x05(타)\x05(파)\x05(하)\x05(주)\x08(오전)\x08(오후)\x05(一)" +
-	"\x05(二)\x05(三)\x05(四)\x05(五)\x05(六)\x05(七)\x05(八)\x05(九)\x05(十)\x05(月)" +
-	"\x05(火)\x05(水)\x05(木)\x05(金)\x05(土)\x05(日)\x05(株)\x05(有)\x05(社)\x05(名)" +
-	"\x05(特)\x05(財)\x05(祝)\x05(労)\x05(代)\x05(呼)\x05(学)\x05(監)\x05(企)\x05(資)" +
-	"\x05(協)\x05(祭)\x05(休)\x05(自)\x05(至)\x0221\x0222\x0223\x0224\x0225\x0226" +
-	"\x0227\x0228\x0229\x0230\x0231\x0232\x0233\x0234\x0235\x06참고\x06주의\x0236" +
-	"\x0237\x0238\x0239\x0240\x0241\x0242\x0243\x0244\x0245\x0246\x0247\x0248" +
-	"\x0249\x0250\x041月\x042月\x043月\x044月\x045月\x046月\x047月\x048月\x049月\x0510" +
-	"月\x0511月\x0512月\x02hg\x02ev\x06令和\x0cアパート\x0cアルファ\x0cアンペア\x09アール\x0cイニ" +
-	"ング\x09インチ\x09ウォン\x0fエスクード\x0cエーカー\x09オンス\x09オーム\x09カイリ\x0cカラット\x0cカロリー" +
-	"\x09ガロン\x09ガンマ\x06ギガ\x09ギニー\x0cキュリー\x0cギルダー\x06キロ\x0fキログラム\x12キロメートル\x0f" +
-	"キロワット\x09グラム\x0fグラムトン\x0fクルゼイロ\x0cクローネ\x09ケース\x09コルナ\x09コーポ\x0cサイクル" +
-	"\x0fサンチーム\x0cシリング\x09センチ\x09セント\x09ダース\x06デシ\x06ドル\x06トン\x06ナノ\x09ノット" +
-	"\x09ハイツ\x0fパーセント\x09パーツ\x0cバーレル\x0fピアストル\x09ピクル\x06ピコ\x06ビル\x0fファラッド\x0c" +
-	"フィート\x0fブッシェル\x09フラン\x0fヘクタール\x06ペソ\x09ペニヒ\x09ヘルツ\x09ペンス\x09ページ\x09ベータ" +
-	"\x0cポイント\x09ボルト\x06ホン\x09ポンド\x09ホール\x09ホーン\x0cマイクロ\x09マイル\x09マッハ\x09マルク" +
-	"\x0fマンション\x0cミクロン\x06ミリ\x0fミリバール\x06メガ\x0cメガトン\x0cメートル\x09ヤード\x09ヤール\x09" +
-	"ユアン\x0cリットル\x06リラ\x09ルピー\x0cルーブル\x06レム\x0fレントゲン\x09ワット\x040点\x041点\x04" +
-	"2点\x043点\x044点\x045点\x046点\x047点\x048点\x049点\x0510点\x0511点\x0512点\x0513点" +
-	"\x0514点\x0515点\x0516点\x0517点\x0518点\x0519点\x0520点\x0521点\x0522点\x0523点" +
-	"\x0524点\x02da\x02au\x02ov\x02pc\x02dm\x02iu\x06平成\x06昭和\x06大正\x06明治\x0c株" +
-	"式会社\x02pa\x02na\x02ma\x02ka\x02kb\x02mb\x02gb\x04kcal\x02pf\x02nf\x02m" +
-	"g\x02kg\x02hz\x02ml\x02dl\x02kl\x02fm\x02nm\x02mm\x02cm\x02km\x02m2\x02m" +
-	"3\x05m∕s\x06m∕s2\x07rad∕s\x08rad∕s2\x02ps\x02ns\x02ms\x02pv\x02nv\x02mv" +
-	"\x02kv\x02pw\x02nw\x02mw\x02kw\x02bq\x02cc\x02cd\x06c∕kg\x02db\x02gy\x02" +
-	"ha\x02hp\x02in\x02kk\x02kt\x02lm\x02ln\x02lx\x02ph\x02pr\x02sr\x02sv\x02" +
-	"wb\x05v∕m\x05a∕m\x041日\x042日\x043日\x044日\x045日\x046日\x047日\x048日\x049日" +
-	"\x0510日\x0511日\x0512日\x0513日\x0514日\x0515日\x0516日\x0517日\x0518日\x0519日" +
-	"\x0520日\x0521日\x0522日\x0523日\x0524日\x0525日\x0526日\x0527日\x0528日\x0529日" +
-	"\x0530日\x0531日\x02ь\x02ɦ\x02ɬ\x02ʞ\x02ʇ\x02œ\x02ʍ\x04𤋮\x04𢡊\x04𢡄\x04𣏕" +
-	"\x04𥉉\x04𥳐\x04𧻓\x02ff\x02fi\x02fl\x02st\x04մն\x04մե\x04մի\x04վն\x04մխ" +
-	"\x04יִ\x04ײַ\x02ע\x02ה\x02כ\x02ל\x02ם\x02ר\x02ת\x04שׁ\x04שׂ\x06שּׁ\x06שּ" +
-	"ׂ\x04אַ\x04אָ\x04אּ\x04בּ\x04גּ\x04דּ\x04הּ\x04וּ\x04זּ\x04טּ\x04יּ\x04" +
-	"ךּ\x04כּ\x04לּ\x04מּ\x04נּ\x04סּ\x04ףּ\x04פּ\x04צּ\x04קּ\x04רּ\x04שּ" +
-	"\x04תּ\x04וֹ\x04בֿ\x04כֿ\x04פֿ\x04אל\x02ٱ\x02ٻ\x02پ\x02ڀ\x02ٺ\x02ٿ\x02ٹ" +
-	"\x02ڤ\x02ڦ\x02ڄ\x02ڃ\x02چ\x02ڇ\x02ڍ\x02ڌ\x02ڎ\x02ڈ\x02ژ\x02ڑ\x02ک\x02گ" +
-	"\x02ڳ\x02ڱ\x02ں\x02ڻ\x02ۀ\x02ہ\x02ھ\x02ے\x02ۓ\x02ڭ\x02ۇ\x02ۆ\x02ۈ\x02ۋ" +
-	"\x02ۅ\x02ۉ\x02ې\x02ى\x04ئا\x04ئە\x04ئو\x04ئۇ\x04ئۆ\x04ئۈ\x04ئې\x04ئى\x02" +
-	"ی\x04ئج\x04ئح\x04ئم\x04ئي\x04بج\x04بح\x04بخ\x04بم\x04بى\x04بي\x04تج\x04" +
-	"تح\x04تخ\x04تم\x04تى\x04تي\x04ثج\x04ثم\x04ثى\x04ثي\x04جح\x04جم\x04حج" +
-	"\x04حم\x04خج\x04خح\x04خم\x04سج\x04سح\x04سخ\x04سم\x04صح\x04صم\x04ضج\x04ضح" +
-	"\x04ضخ\x04ضم\x04طح\x04طم\x04ظم\x04عج\x04عم\x04غج\x04غم\x04فج\x04فح\x04فخ" +
-	"\x04فم\x04فى\x04في\x04قح\x04قم\x04قى\x04قي\x04كا\x04كج\x04كح\x04كخ\x04كل" +
-	"\x04كم\x04كى\x04كي\x04لج\x04لح\x04لخ\x04لم\x04لى\x04لي\x04مج\x04مح\x04مخ" +
-	"\x04مم\x04مى\x04مي\x04نج\x04نح\x04نخ\x04نم\x04نى\x04ني\x04هج\x04هم\x04هى" +
-	"\x04هي\x04يج\x04يح\x04يخ\x04يم\x04يى\x04يي\x04ذٰ\x04رٰ\x04ىٰ\x05 ٌّ\x05 " +
-	"ٍّ\x05 َّ\x05 ُّ\x05 ِّ\x05 ّٰ\x04ئر\x04ئز\x04ئن\x04بر\x04بز\x04بن\x04ت" +
-	"ر\x04تز\x04تن\x04ثر\x04ثز\x04ثن\x04ما\x04نر\x04نز\x04نن\x04ير\x04يز\x04" +
-	"ين\x04ئخ\x04ئه\x04به\x04ته\x04صخ\x04له\x04نه\x04هٰ\x04يه\x04ثه\x04سه" +
-	"\x04شم\x04شه\x06ـَّ\x06ـُّ\x06ـِّ\x04طى\x04طي\x04عى\x04عي\x04غى\x04غي" +
-	"\x04سى\x04سي\x04شى\x04شي\x04حى\x04حي\x04جى\x04جي\x04خى\x04خي\x04صى\x04صي" +
-	"\x04ضى\x04ضي\x04شج\x04شح\x04شخ\x04شر\x04سر\x04صر\x04ضر\x04اً\x06تجم\x06ت" +
-	"حج\x06تحم\x06تخم\x06تمج\x06تمح\x06تمخ\x06جمح\x06حمي\x06حمى\x06سحج\x06سج" +
-	"ح\x06سجى\x06سمح\x06سمج\x06سمم\x06صحح\x06صمم\x06شحم\x06شجي\x06شمخ\x06شمم" +
-	"\x06ضحى\x06ضخم\x06طمح\x06طمم\x06طمي\x06عجم\x06عمم\x06عمى\x06غمم\x06غمي" +
-	"\x06غمى\x06فخم\x06قمح\x06قمم\x06لحم\x06لحي\x06لحى\x06لجج\x06لخم\x06لمح" +
-	"\x06محج\x06محم\x06محي\x06مجح\x06مجم\x06مخج\x06مخم\x06مجخ\x06همج\x06همم" +
-	"\x06نحم\x06نحى\x06نجم\x06نجى\x06نمي\x06نمى\x06يمم\x06بخي\x06تجي\x06تجى" +
-	"\x06تخي\x06تخى\x06تمي\x06تمى\x06جمي\x06جحى\x06جمى\x06سخى\x06صحي\x06شحي" +
-	"\x06ضحي\x06لجي\x06لمي\x06يحي\x06يجي\x06يمي\x06ممي\x06قمي\x06نحي\x06عمي" +
-	"\x06كمي\x06نجح\x06مخي\x06لجم\x06كمم\x06جحي\x06حجي\x06مجي\x06فمي\x06بحي" +
-	"\x06سخي\x06نجي\x06صلے\x06قلے\x08الله\x08اكبر\x08محمد\x08صلعم\x08رسول\x08" +
-	"عليه\x08وسلم\x06صلى!صلى الله عليه وسلم\x0fجل جلاله\x08ریال\x01,\x01:" +
-	"\x01!\x01?\x01_\x01{\x01}\x01[\x01]\x01#\x01&\x01*\x01-\x01<\x01>\x01\\" +
-	"\x01$\x01%\x01@\x04ـً\x04ـَ\x04ـُ\x04ـِ\x04ـّ\x04ـْ\x02ء\x02آ\x02أ\x02ؤ" +
-	"\x02إ\x02ئ\x02ا\x02ب\x02ة\x02ت\x02ث\x02ج\x02ح\x02خ\x02د\x02ذ\x02ر\x02ز" +
-	"\x02س\x02ش\x02ص\x02ض\x02ط\x02ظ\x02ع\x02غ\x02ف\x02ق\x02ك\x02ل\x02م\x02ن" +
-	"\x02ه\x02و\x02ي\x04لآ\x04لأ\x04لإ\x04لا\x01\x22\x01'\x01/\x01^\x01|\x01~" +
-	"\x02¢\x02£\x02¬\x02¦\x02¥\x08𝅗𝅥\x08𝅘𝅥\x0c𝅘𝅥𝅮\x0c𝅘𝅥𝅯\x0c𝅘𝅥𝅰\x0c𝅘𝅥𝅱\x0c𝅘𝅥𝅲" +
-	"\x08𝆹𝅥\x08𝆺𝅥\x0c𝆹𝅥𝅮\x0c𝆺𝅥𝅮\x0c𝆹𝅥𝅯\x0c𝆺𝅥𝅯\x02ı\x02ȷ\x02α\x02ε\x02ζ\x02η" +
-	"\x02κ\x02λ\x02μ\x02ν\x02ξ\x02ο\x02σ\x02τ\x02υ\x02ψ\x03∇\x03∂\x02ϝ\x02ٮ" +
-	"\x02ڡ\x02ٯ\x020,\x021,\x022,\x023,\x024,\x025,\x026,\x027,\x028,\x029," +
-	"\x03(a)\x03(b)\x03(c)\x03(d)\x03(e)\x03(f)\x03(g)\x03(h)\x03(i)\x03(j)" +
-	"\x03(k)\x03(l)\x03(m)\x03(n)\x03(o)\x03(p)\x03(q)\x03(r)\x03(s)\x03(t)" +
-	"\x03(u)\x03(v)\x03(w)\x03(x)\x03(y)\x03(z)\x07〔s〕\x02wz\x02hv\x02sd\x03p" +
-	"pv\x02wc\x02mc\x02md\x02mr\x02dj\x06ほか\x06ココ\x03サ\x03手\x03字\x03双\x03デ" +
-	"\x03二\x03多\x03解\x03天\x03交\x03映\x03無\x03料\x03前\x03後\x03再\x03新\x03初\x03終" +
-	"\x03生\x03販\x03声\x03吹\x03演\x03投\x03捕\x03一\x03三\x03遊\x03左\x03中\x03右\x03指" +
-	"\x03走\x03打\x03禁\x03空\x03合\x03満\x03有\x03月\x03申\x03割\x03営\x03配\x09〔本〕\x09〔" +
-	"三〕\x09〔二〕\x09〔安〕\x09〔点〕\x09〔打〕\x09〔盗〕\x09〔勝〕\x09〔敗〕\x03得\x03可\x03丽\x03" +
-	"丸\x03乁\x03你\x03侮\x03侻\x03倂\x03偺\x03備\x03僧\x03像\x03㒞\x03免\x03兔\x03兤\x03" +
-	"具\x03㒹\x03內\x03冗\x03冤\x03仌\x03冬\x03况\x03凵\x03刃\x03㓟\x03刻\x03剆\x03剷\x03" +
-	"㔕\x03勇\x03勉\x03勤\x03勺\x03包\x03匆\x03北\x03卉\x03卑\x03博\x03即\x03卽\x03卿\x03" +
-	"灰\x03及\x03叟\x03叫\x03叱\x03吆\x03咞\x03吸\x03呈\x03周\x03咢\x03哶\x03唐\x03啓\x03" +
-	"啣\x03善\x03喙\x03喫\x03喳\x03嗂\x03圖\x03嘆\x03圗\x03噑\x03噴\x03切\x03壮\x03城\x03" +
-	"埴\x03堍\x03型\x03堲\x03報\x03墬\x03売\x03壷\x03夆\x03夢\x03奢\x03姬\x03娛\x03娧\x03" +
-	"姘\x03婦\x03㛮\x03嬈\x03嬾\x03寃\x03寘\x03寧\x03寳\x03寿\x03将\x03尢\x03㞁\x03屠\x03" +
-	"屮\x03峀\x03岍\x03嵃\x03嵮\x03嵫\x03嵼\x03巡\x03巢\x03㠯\x03巽\x03帨\x03帽\x03幩\x03" +
-	"㡢\x03㡼\x03庰\x03庳\x03庶\x03廊\x03廾\x03舁\x03弢\x03㣇\x03形\x03彫\x03㣣\x03徚\x03" +
-	"忍\x03志\x03忹\x03悁\x03㤺\x03㤜\x03悔\x03惇\x03慈\x03慌\x03慎\x03慺\x03憎\x03憲\x03" +
-	"憤\x03憯\x03懞\x03懲\x03懶\x03成\x03戛\x03扝\x03抱\x03拔\x03捐\x03挽\x03拼\x03捨\x03" +
-	"掃\x03揤\x03搢\x03揅\x03掩\x03㨮\x03摩\x03摾\x03撝\x03摷\x03㩬\x03敏\x03敬\x03旣\x03" +
-	"書\x03晉\x03㬙\x03暑\x03㬈\x03㫤\x03冒\x03冕\x03最\x03暜\x03肭\x03䏙\x03朗\x03望\x03" +
-	"朡\x03杞\x03杓\x03㭉\x03柺\x03枅\x03桒\x03梅\x03梎\x03栟\x03椔\x03㮝\x03楂\x03榣\x03" +
-	"槪\x03檨\x03櫛\x03㰘\x03次\x03歔\x03㱎\x03歲\x03殟\x03殺\x03殻\x03汎\x03沿\x03泍\x03" +
-	"汧\x03洖\x03派\x03海\x03流\x03浩\x03浸\x03涅\x03洴\x03港\x03湮\x03㴳\x03滋\x03滇\x03" +
-	"淹\x03潮\x03濆\x03瀹\x03瀞\x03瀛\x03㶖\x03灊\x03災\x03灷\x03炭\x03煅\x03熜\x03爨\x03" +
-	"爵\x03牐\x03犀\x03犕\x03獺\x03王\x03㺬\x03玥\x03㺸\x03瑇\x03瑜\x03瑱\x03璅\x03瓊\x03" +
-	"㼛\x03甤\x03甾\x03異\x03瘐\x03㿼\x03䀈\x03直\x03眞\x03真\x03睊\x03䀹\x03瞋\x03䁆\x03" +
-	"䂖\x03硎\x03碌\x03磌\x03䃣\x03祖\x03福\x03秫\x03䄯\x03穀\x03穊\x03穏\x03䈂\x03篆\x03" +
-	"築\x03䈧\x03糒\x03䊠\x03糨\x03糣\x03紀\x03絣\x03䌁\x03緇\x03縂\x03繅\x03䌴\x03䍙\x03" +
-	"罺\x03羕\x03翺\x03者\x03聠\x03聰\x03䏕\x03育\x03脃\x03䐋\x03脾\x03媵\x03舄\x03辞\x03" +
-	"䑫\x03芑\x03芋\x03芝\x03劳\x03花\x03芳\x03芽\x03苦\x03若\x03茝\x03荣\x03莭\x03茣\x03" +
-	"莽\x03菧\x03著\x03荓\x03菊\x03菌\x03菜\x03䔫\x03蓱\x03蓳\x03蔖\x03蕤\x03䕝\x03䕡\x03" +
-	"䕫\x03虐\x03虜\x03虧\x03虩\x03蚩\x03蚈\x03蜎\x03蛢\x03蝹\x03蜨\x03蝫\x03螆\x03蟡\x03" +
-	"蠁\x03䗹\x03衠\x03衣\x03裗\x03裞\x03䘵\x03裺\x03㒻\x03䚾\x03䛇\x03誠\x03諭\x03變\x03" +
-	"豕\x03貫\x03賁\x03贛\x03起\x03跋\x03趼\x03跰\x03軔\x03輸\x03邔\x03郱\x03鄑\x03鄛\x03" +
-	"鈸\x03鋗\x03鋘\x03鉼\x03鏹\x03鐕\x03開\x03䦕\x03閷\x03䧦\x03雃\x03嶲\x03霣\x03䩮\x03" +
-	"䩶\x03韠\x03䪲\x03頋\x03頩\x03飢\x03䬳\x03餩\x03馧\x03駂\x03駾\x03䯎\x03鬒\x03鱀\x03" +
-	"鳽\x03䳎\x03䳭\x03鵧\x03䳸\x03麻\x03䵖\x03黹\x03黾\x03鼅\x03鼏\x03鼖\x03鼻"
+var mappings string = "" + // Size: 6539 bytes
+	"  ̈a ̄23 ́ ̧1o1⁄41⁄23⁄4i̇l·ʼnsdžⱥⱦhjrwy ̆ ̇ ̊ ̨ ̃ ̋lẍ́ ι; ̈́եւاٴوٴۇٴيٴक" +
+	"़ख़ग़ज़ड़ढ़फ़य़ড়ঢ়য়ਲ਼ਸ਼ਖ਼ਗ਼ਜ਼ਫ਼ଡ଼ଢ଼ําໍາຫນຫມགྷཌྷདྷབྷཛྷཀྵཱཱིུྲྀྲཱྀླྀླཱ" +
+	"ཱྀྀྒྷྜྷྡྷྦྷྫྷྐྵвдостъѣæbdeǝgikmnȣptuɐɑəɛɜŋɔɯvβγδφχρнɒcɕðfɟɡɥɨɩɪʝɭʟɱɰɲɳ" +
+	"ɴɵɸʂʃƫʉʊʋʌzʐʑʒθssάέήίόύώἀιἁιἂιἃιἄιἅιἆιἇιἠιἡιἢιἣιἤιἥιἦιἧιὠιὡιὢιὣιὤιὥιὦιὧ" +
+	"ιὰιαιάιᾶιι ̈͂ὴιηιήιῆι ̓̀ ̓́ ̓͂ΐ ̔̀ ̔́ ̔͂ΰ ̈̀`ὼιωιώιῶι′′′′′‵‵‵‵‵!!???!!?" +
+	"′′′′0456789+=()rsħnoqsmtmωåאבגדπ1⁄71⁄91⁄101⁄32⁄31⁄52⁄53⁄54⁄51⁄65⁄61⁄83" +
+	"⁄85⁄87⁄81⁄iiivviviiiixxi0⁄3∫∫∫∫∫∮∮∮∮∮1011121314151617181920(10)(11)(12" +
+	")(13)(14)(15)(16)(17)(18)(19)(20)∫∫∫∫==⫝̸ɫɽȿɀ. ゙ ゚よりコト(ᄀ)(ᄂ)(ᄃ)(ᄅ)(ᄆ)(ᄇ)" +
+	"(ᄉ)(ᄋ)(ᄌ)(ᄎ)(ᄏ)(ᄐ)(ᄑ)(ᄒ)(가)(나)(다)(라)(마)(바)(사)(아)(자)(차)(카)(타)(파)(하)(주)(오전" +
+	")(오후)(一)(二)(三)(四)(五)(六)(七)(八)(九)(十)(月)(火)(水)(木)(金)(土)(日)(株)(有)(社)(名)(特)(" +
+	"財)(祝)(労)(代)(呼)(学)(監)(企)(資)(協)(祭)(休)(自)(至)21222324252627282930313233343" +
+	"5참고주의3637383940414243444546474849501月2月3月4月5月6月7月8月9月10月11月12月hgev令和アパート" +
+	"アルファアンペアアールイニングインチウォンエスクードエーカーオンスオームカイリカラットカロリーガロンガンマギガギニーキュリーギルダーキロキロ" +
+	"グラムキロメートルキロワットグラムグラムトンクルゼイロクローネケースコルナコーポサイクルサンチームシリングセンチセントダースデシドルトンナノ" +
+	"ノットハイツパーセントパーツバーレルピアストルピクルピコビルファラッドフィートブッシェルフランヘクタールペソペニヒヘルツペンスページベータポ" +
+	"イントボルトホンポンドホールホーンマイクロマイルマッハマルクマンションミクロンミリミリバールメガメガトンメートルヤードヤールユアンリットルリ" +
+	"ラルピールーブルレムレントゲンワット0点1点2点3点4点5点6点7点8点9点10点11点12点13点14点15点16点17点18点19点20" +
+	"点21点22点23点24点daauovpcdmiu平成昭和大正明治株式会社panamakakbmbgbkcalpfnfmgkghzmldlk" +
+	"lfmnmmmcmkmm2m3m∕sm∕s2rad∕srad∕s2psnsmspvnvmvkvpwnwmwkwbqcccdc∕kgdbgyhah" +
+	"pinkkktlmlnlxphprsrsvwbv∕ma∕m1日2日3日4日5日6日7日8日9日10日11日12日13日14日15日16日17日1" +
+	"8日19日20日21日22日23日24日25日26日27日28日29日30日31日ьɦɬʞʇœʍ𤋮𢡊𢡄𣏕𥉉𥳐𧻓fffiflstմնմեմիվնմ" +
+	"խיִײַעהכלםרתשׁשׂשּׁשּׂאַאָאּבּגּדּהּוּזּטּיּךּכּלּמּנּסּףּפּצּקּרּשּתּו" +
+	"ֹבֿכֿפֿאלٱٻپڀٺٿٹڤڦڄڃچڇڍڌڎڈژڑکگڳڱںڻۀہھےۓڭۇۆۈۋۅۉېىئائەئوئۇئۆئۈئېئىیئجئحئم" +
+	"ئيبجبحبخبمبىبيتجتحتختمتىتيثجثمثىثيجحجمحجحمخجخحخمسجسحسخسمصحصمضجضحضخضمطحط" +
+	"مظمعجعمغجغمفجفحفخفمفىفيقحقمقىقيكاكجكحكخكلكمكىكيلجلحلخلملىليمجمحمخمممىمي" +
+	"نجنحنخنمنىنيهجهمهىهييجيحيخيميىييذٰرٰىٰ ٌّ ٍّ َّ ُّ ِّ ّٰئرئزئنبربزبنترت" +
+	"زتنثرثزثنمانرنزننيريزينئخئهبهتهصخلهنههٰيهثهسهشمشهـَّـُّـِّطىطيعىعيغىغيس" +
+	"ىسيشىشيحىحيجىجيخىخيصىصيضىضيشجشحشخشرسرصرضراًتجمتحجتحمتخمتمجتمحتمخجمححميح" +
+	"مىسحجسجحسجىسمحسمجسممصححصممشحمشجيشمخشممضحىضخمطمحطممطميعجمعممعمىغممغميغمى" +
+	"فخمقمحقمملحملحيلحىلججلخملمحمحجمحممحيمجحمجممخجمخممجخهمجهممنحمنحىنجمنجىنم" +
+	"ينمىيممبخيتجيتجىتخيتخىتميتمىجميجحىجمىسخىصحيشحيضحيلجيلمييحييجييميمميقمين" +
+	"حيعميكمينجحمخيلجمكممجحيحجيمجيفميبحيسخينجيصلےقلےاللهاكبرمحمدصلعمرسولعليه" +
+	"وسلمصلىصلى الله عليه وسلمجل جلالهریال,:!?_{}[]#&*-<>\\$%@ـًـَـُـِـّـْءآ" +
+	"أؤإئابةتثجحخدذرزسشصضطظعغفقكلمنهويلآلألإلا\x22'/^|~¢£¬¦¥𝅗𝅥𝅘𝅥𝅘𝅥𝅮𝅘𝅥𝅯𝅘𝅥𝅰𝅘𝅥𝅱" +
+	"𝅘𝅥𝅲𝆹𝅥𝆺𝅥𝆹𝅥𝅮𝆺𝅥𝅮𝆹𝅥𝅯𝆺𝅥𝅯ıȷαεζηκλμνξοστυψ∇∂ϝٮڡٯ0,1,2,3,4,5,6,7,8,9,(a)(b)(c" +
+	")(d)(e)(f)(g)(h)(i)(j)(k)(l)(m)(n)(o)(p)(q)(r)(s)(t)(u)(v)(w)(x)(y)(z)〔s" +
+	"〕wzhvsdppvwcmcmdmrdjほかココサ手字双デ二多解天交映無料前後再新初終生販声吹演投捕一三遊左中右指走打禁空合満有月申割営配〔" +
+	"本〕〔三〕〔二〕〔安〕〔点〕〔打〕〔盗〕〔勝〕〔敗〕得可丽丸乁你侮侻倂偺備僧像㒞免兔兤具㒹內冗冤仌冬况凵刃㓟刻剆剷㔕勇勉勤勺包匆北卉卑博即卽" +
+	"卿灰及叟叫叱吆咞吸呈周咢哶唐啓啣善喙喫喳嗂圖嘆圗噑噴切壮城埴堍型堲報墬売壷夆夢奢姬娛娧姘婦㛮嬈嬾寃寘寧寳寿将尢㞁屠屮峀岍嵃嵮嵫嵼巡巢㠯巽帨帽" +
+	"幩㡢㡼庰庳庶廊廾舁弢㣇形彫㣣徚忍志忹悁㤺㤜悔惇慈慌慎慺憎憲憤憯懞懲懶成戛扝抱拔捐挽拼捨掃揤搢揅掩㨮摩摾撝摷㩬敏敬旣書晉㬙暑㬈㫤冒冕最暜肭䏙朗" +
+	"望朡杞杓㭉柺枅桒梅梎栟椔㮝楂榣槪檨櫛㰘次歔㱎歲殟殺殻汎沿泍汧洖派海流浩浸涅洴港湮㴳滋滇淹潮濆瀹瀞瀛㶖灊災灷炭煅熜爨爵牐犀犕獺王㺬玥㺸瑇瑜瑱璅" +
+	"瓊㼛甤甾異瘐㿼䀈直眞真睊䀹瞋䁆䂖硎碌磌䃣祖福秫䄯穀穊穏䈂篆築䈧糒䊠糨糣紀絣䌁緇縂繅䌴䍙罺羕翺者聠聰䏕育脃䐋脾媵舄辞䑫芑芋芝劳花芳芽苦若茝荣莭" +
+	"茣莽菧著荓菊菌菜䔫蓱蓳蔖蕤䕝䕡䕫虐虜虧虩蚩蚈蜎蛢蝹蜨蝫螆蟡蠁䗹衠衣裗裞䘵裺㒻䚾䛇誠諭變豕貫賁贛起跋趼跰軔輸邔郱鄑鄛鈸鋗鋘鉼鏹鐕開䦕閷䧦雃嶲霣" +
+	"䩮䩶韠䪲頋頩飢䬳餩馧駂駾䯎鬒鱀鳽䳎䳭鵧䳸麻䵖黹黾鼅鼏鼖鼻"
+
+var mappingIndex = []uint16{ // 1650 elements
+	// Entry 0 - 3F
+	0x0000, 0x0000, 0x0001, 0x0004, 0x0005, 0x0008, 0x0009, 0x000a,
+	0x000d, 0x0010, 0x0011, 0x0012, 0x0017, 0x001c, 0x0021, 0x0024,
+	0x0027, 0x002a, 0x002b, 0x002e, 0x0031, 0x0034, 0x0035, 0x0036,
+	0x0037, 0x0038, 0x0039, 0x003c, 0x003f, 0x0042, 0x0045, 0x0048,
+	0x004b, 0x004c, 0x004d, 0x0051, 0x0054, 0x0055, 0x005a, 0x005e,
+	0x0062, 0x0066, 0x006a, 0x006e, 0x0074, 0x007a, 0x0080, 0x0086,
+	0x008c, 0x0092, 0x0098, 0x009e, 0x00a4, 0x00aa, 0x00b0, 0x00b6,
+	0x00bc, 0x00c2, 0x00c8, 0x00ce, 0x00d4, 0x00da, 0x00e0, 0x00e6,
+	// Entry 40 - 7F
+	0x00ec, 0x00f2, 0x00f8, 0x00fe, 0x0104, 0x010a, 0x0110, 0x0116,
+	0x011c, 0x0122, 0x0128, 0x012e, 0x0137, 0x013d, 0x0146, 0x014c,
+	0x0152, 0x0158, 0x015e, 0x0164, 0x016a, 0x0170, 0x0172, 0x0174,
+	0x0176, 0x0178, 0x017a, 0x017c, 0x017e, 0x0180, 0x0181, 0x0182,
+	0x0183, 0x0185, 0x0186, 0x0187, 0x0188, 0x0189, 0x018a, 0x018c,
+	0x018d, 0x018e, 0x018f, 0x0191, 0x0193, 0x0195, 0x0197, 0x0199,
+	0x019b, 0x019d, 0x019f, 0x01a0, 0x01a2, 0x01a4, 0x01a6, 0x01a8,
+	0x01aa, 0x01ac, 0x01ae, 0x01b0, 0x01b1, 0x01b3, 0x01b5, 0x01b6,
+	// Entry 80 - BF
+	0x01b8, 0x01ba, 0x01bc, 0x01be, 0x01c0, 0x01c2, 0x01c4, 0x01c6,
+	0x01c8, 0x01ca, 0x01cc, 0x01ce, 0x01d0, 0x01d2, 0x01d4, 0x01d6,
+	0x01d8, 0x01da, 0x01dc, 0x01de, 0x01e0, 0x01e2, 0x01e4, 0x01e5,
+	0x01e7, 0x01e9, 0x01eb, 0x01ed, 0x01ef, 0x01f1, 0x01f3, 0x01f5,
+	0x01f7, 0x01f9, 0x01fb, 0x01fd, 0x0202, 0x0207, 0x020c, 0x0211,
+	0x0216, 0x021b, 0x0220, 0x0225, 0x022a, 0x022f, 0x0234, 0x0239,
+	0x023e, 0x0243, 0x0248, 0x024d, 0x0252, 0x0257, 0x025c, 0x0261,
+	0x0266, 0x026b, 0x0270, 0x0275, 0x027a, 0x027e, 0x0282, 0x0287,
+	// Entry C0 - FF
+	0x0289, 0x028e, 0x0293, 0x0297, 0x029b, 0x02a0, 0x02a5, 0x02aa,
+	0x02af, 0x02b1, 0x02b6, 0x02bb, 0x02c0, 0x02c2, 0x02c7, 0x02c8,
+	0x02cd, 0x02d1, 0x02d5, 0x02da, 0x02e0, 0x02e9, 0x02ef, 0x02f8,
+	0x02fa, 0x02fc, 0x02fe, 0x0300, 0x030c, 0x030d, 0x030e, 0x030f,
+	0x0310, 0x0311, 0x0312, 0x0313, 0x0314, 0x0315, 0x0316, 0x0317,
+	0x0319, 0x031b, 0x031d, 0x031e, 0x0320, 0x0322, 0x0324, 0x0326,
+	0x0328, 0x032a, 0x032c, 0x032e, 0x0330, 0x0335, 0x033a, 0x0340,
+	0x0345, 0x034a, 0x034f, 0x0354, 0x0359, 0x035e, 0x0363, 0x0368,
+	// Entry 100 - 13F
+	0x036d, 0x0372, 0x0377, 0x037c, 0x0380, 0x0382, 0x0384, 0x0386,
+	0x038a, 0x038c, 0x038e, 0x0393, 0x0399, 0x03a2, 0x03a8, 0x03b1,
+	0x03b3, 0x03b5, 0x03b7, 0x03b9, 0x03bb, 0x03bd, 0x03bf, 0x03c1,
+	0x03c3, 0x03c5, 0x03c7, 0x03cb, 0x03cf, 0x03d3, 0x03d7, 0x03db,
+	0x03df, 0x03e3, 0x03e7, 0x03eb, 0x03ef, 0x03f3, 0x03ff, 0x0401,
+	0x0406, 0x0408, 0x040a, 0x040c, 0x040e, 0x040f, 0x0413, 0x0417,
+	0x041d, 0x0423, 0x0428, 0x042d, 0x0432, 0x0437, 0x043c, 0x0441,
+	0x0446, 0x044b, 0x0450, 0x0455, 0x045a, 0x045f, 0x0464, 0x0469,
+	// Entry 140 - 17F
+	0x046e, 0x0473, 0x0478, 0x047d, 0x0482, 0x0487, 0x048c, 0x0491,
+	0x0496, 0x049b, 0x04a0, 0x04a5, 0x04aa, 0x04af, 0x04b4, 0x04bc,
+	0x04c4, 0x04c9, 0x04ce, 0x04d3, 0x04d8, 0x04dd, 0x04e2, 0x04e7,
+	0x04ec, 0x04f1, 0x04f6, 0x04fb, 0x0500, 0x0505, 0x050a, 0x050f,
+	0x0514, 0x0519, 0x051e, 0x0523, 0x0528, 0x052d, 0x0532, 0x0537,
+	0x053c, 0x0541, 0x0546, 0x054b, 0x0550, 0x0555, 0x055a, 0x055f,
+	0x0564, 0x0569, 0x056e, 0x0573, 0x0578, 0x057a, 0x057c, 0x057e,
+	0x0580, 0x0582, 0x0584, 0x0586, 0x0588, 0x058a, 0x058c, 0x058e,
+	// Entry 180 - 1BF
+	0x0590, 0x0592, 0x0594, 0x0596, 0x059c, 0x05a2, 0x05a4, 0x05a6,
+	0x05a8, 0x05aa, 0x05ac, 0x05ae, 0x05b0, 0x05b2, 0x05b4, 0x05b6,
+	0x05b8, 0x05ba, 0x05bc, 0x05be, 0x05c0, 0x05c4, 0x05c8, 0x05cc,
+	0x05d0, 0x05d4, 0x05d8, 0x05dc, 0x05e0, 0x05e4, 0x05e9, 0x05ee,
+	0x05f3, 0x05f5, 0x05f7, 0x05fd, 0x0609, 0x0615, 0x0621, 0x062a,
+	0x0636, 0x063f, 0x0648, 0x0657, 0x0663, 0x066c, 0x0675, 0x067e,
+	0x068a, 0x0696, 0x069f, 0x06a8, 0x06ae, 0x06b7, 0x06c3, 0x06cf,
+	0x06d5, 0x06e4, 0x06f6, 0x0705, 0x070e, 0x071d, 0x072c, 0x0738,
+	// Entry 1C0 - 1FF
+	0x0741, 0x074a, 0x0753, 0x075f, 0x076e, 0x077a, 0x0783, 0x078c,
+	0x0795, 0x079b, 0x07a1, 0x07a7, 0x07ad, 0x07b6, 0x07bf, 0x07ce,
+	0x07d7, 0x07e3, 0x07f2, 0x07fb, 0x0801, 0x0807, 0x0816, 0x0822,
+	0x0831, 0x083a, 0x0849, 0x084f, 0x0858, 0x0861, 0x086a, 0x0873,
+	0x087c, 0x0888, 0x0891, 0x0897, 0x08a0, 0x08a9, 0x08b2, 0x08be,
+	0x08c7, 0x08d0, 0x08d9, 0x08e8, 0x08f4, 0x08fa, 0x0909, 0x090f,
+	0x091b, 0x0927, 0x0930, 0x0939, 0x0942, 0x094e, 0x0954, 0x095d,
+	0x0969, 0x096f, 0x097e, 0x0987, 0x098b, 0x098f, 0x0993, 0x0997,
+	// Entry 200 - 23F
+	0x099b, 0x099f, 0x09a3, 0x09a7, 0x09ab, 0x09af, 0x09b4, 0x09b9,
+	0x09be, 0x09c3, 0x09c8, 0x09cd, 0x09d2, 0x09d7, 0x09dc, 0x09e1,
+	0x09e6, 0x09eb, 0x09f0, 0x09f5, 0x09fa, 0x09fc, 0x09fe, 0x0a00,
+	0x0a02, 0x0a04, 0x0a06, 0x0a0c, 0x0a12, 0x0a18, 0x0a1e, 0x0a2a,
+	0x0a2c, 0x0a2e, 0x0a30, 0x0a32, 0x0a34, 0x0a36, 0x0a38, 0x0a3c,
+	0x0a3e, 0x0a40, 0x0a42, 0x0a44, 0x0a46, 0x0a48, 0x0a4a, 0x0a4c,
+	0x0a4e, 0x0a50, 0x0a52, 0x0a54, 0x0a56, 0x0a58, 0x0a5a, 0x0a5f,
+	0x0a65, 0x0a6c, 0x0a74, 0x0a76, 0x0a78, 0x0a7a, 0x0a7c, 0x0a7e,
+	// Entry 240 - 27F
+	0x0a80, 0x0a82, 0x0a84, 0x0a86, 0x0a88, 0x0a8a, 0x0a8c, 0x0a8e,
+	0x0a90, 0x0a96, 0x0a98, 0x0a9a, 0x0a9c, 0x0a9e, 0x0aa0, 0x0aa2,
+	0x0aa4, 0x0aa6, 0x0aa8, 0x0aaa, 0x0aac, 0x0aae, 0x0ab0, 0x0ab2,
+	0x0ab4, 0x0ab9, 0x0abe, 0x0ac2, 0x0ac6, 0x0aca, 0x0ace, 0x0ad2,
+	0x0ad6, 0x0ada, 0x0ade, 0x0ae2, 0x0ae7, 0x0aec, 0x0af1, 0x0af6,
+	0x0afb, 0x0b00, 0x0b05, 0x0b0a, 0x0b0f, 0x0b14, 0x0b19, 0x0b1e,
+	0x0b23, 0x0b28, 0x0b2d, 0x0b32, 0x0b37, 0x0b3c, 0x0b41, 0x0b46,
+	0x0b4b, 0x0b50, 0x0b52, 0x0b54, 0x0b56, 0x0b58, 0x0b5a, 0x0b5c,
+	// Entry 280 - 2BF
+	0x0b5e, 0x0b62, 0x0b66, 0x0b6a, 0x0b6e, 0x0b72, 0x0b76, 0x0b7a,
+	0x0b7c, 0x0b7e, 0x0b80, 0x0b82, 0x0b86, 0x0b8a, 0x0b8e, 0x0b92,
+	0x0b96, 0x0b9a, 0x0b9e, 0x0ba0, 0x0ba2, 0x0ba4, 0x0ba6, 0x0ba8,
+	0x0baa, 0x0bac, 0x0bb0, 0x0bb4, 0x0bba, 0x0bc0, 0x0bc4, 0x0bc8,
+	0x0bcc, 0x0bd0, 0x0bd4, 0x0bd8, 0x0bdc, 0x0be0, 0x0be4, 0x0be8,
+	0x0bec, 0x0bf0, 0x0bf4, 0x0bf8, 0x0bfc, 0x0c00, 0x0c04, 0x0c08,
+	0x0c0c, 0x0c10, 0x0c14, 0x0c18, 0x0c1c, 0x0c20, 0x0c24, 0x0c28,
+	0x0c2c, 0x0c30, 0x0c34, 0x0c36, 0x0c38, 0x0c3a, 0x0c3c, 0x0c3e,
+	// Entry 2C0 - 2FF
+	0x0c40, 0x0c42, 0x0c44, 0x0c46, 0x0c48, 0x0c4a, 0x0c4c, 0x0c4e,
+	0x0c50, 0x0c52, 0x0c54, 0x0c56, 0x0c58, 0x0c5a, 0x0c5c, 0x0c5e,
+	0x0c60, 0x0c62, 0x0c64, 0x0c66, 0x0c68, 0x0c6a, 0x0c6c, 0x0c6e,
+	0x0c70, 0x0c72, 0x0c74, 0x0c76, 0x0c78, 0x0c7a, 0x0c7c, 0x0c7e,
+	0x0c80, 0x0c82, 0x0c86, 0x0c8a, 0x0c8e, 0x0c92, 0x0c96, 0x0c9a,
+	0x0c9e, 0x0ca2, 0x0ca4, 0x0ca8, 0x0cac, 0x0cb0, 0x0cb4, 0x0cb8,
+	0x0cbc, 0x0cc0, 0x0cc4, 0x0cc8, 0x0ccc, 0x0cd0, 0x0cd4, 0x0cd8,
+	0x0cdc, 0x0ce0, 0x0ce4, 0x0ce8, 0x0cec, 0x0cf0, 0x0cf4, 0x0cf8,
+	// Entry 300 - 33F
+	0x0cfc, 0x0d00, 0x0d04, 0x0d08, 0x0d0c, 0x0d10, 0x0d14, 0x0d18,
+	0x0d1c, 0x0d20, 0x0d24, 0x0d28, 0x0d2c, 0x0d30, 0x0d34, 0x0d38,
+	0x0d3c, 0x0d40, 0x0d44, 0x0d48, 0x0d4c, 0x0d50, 0x0d54, 0x0d58,
+	0x0d5c, 0x0d60, 0x0d64, 0x0d68, 0x0d6c, 0x0d70, 0x0d74, 0x0d78,
+	0x0d7c, 0x0d80, 0x0d84, 0x0d88, 0x0d8c, 0x0d90, 0x0d94, 0x0d98,
+	0x0d9c, 0x0da0, 0x0da4, 0x0da8, 0x0dac, 0x0db0, 0x0db4, 0x0db8,
+	0x0dbc, 0x0dc0, 0x0dc4, 0x0dc8, 0x0dcc, 0x0dd0, 0x0dd4, 0x0dd8,
+	0x0ddc, 0x0de0, 0x0de4, 0x0de8, 0x0dec, 0x0df0, 0x0df4, 0x0df8,
+	// Entry 340 - 37F
+	0x0dfc, 0x0e00, 0x0e04, 0x0e08, 0x0e0c, 0x0e10, 0x0e14, 0x0e18,
+	0x0e1d, 0x0e22, 0x0e27, 0x0e2c, 0x0e31, 0x0e36, 0x0e3a, 0x0e3e,
+	0x0e42, 0x0e46, 0x0e4a, 0x0e4e, 0x0e52, 0x0e56, 0x0e5a, 0x0e5e,
+	0x0e62, 0x0e66, 0x0e6a, 0x0e6e, 0x0e72, 0x0e76, 0x0e7a, 0x0e7e,
+	0x0e82, 0x0e86, 0x0e8a, 0x0e8e, 0x0e92, 0x0e96, 0x0e9a, 0x0e9e,
+	0x0ea2, 0x0ea6, 0x0eaa, 0x0eae, 0x0eb2, 0x0eb6, 0x0ebc, 0x0ec2,
+	0x0ec8, 0x0ecc, 0x0ed0, 0x0ed4, 0x0ed8, 0x0edc, 0x0ee0, 0x0ee4,
+	0x0ee8, 0x0eec, 0x0ef0, 0x0ef4, 0x0ef8, 0x0efc, 0x0f00, 0x0f04,
+	// Entry 380 - 3BF
+	0x0f08, 0x0f0c, 0x0f10, 0x0f14, 0x0f18, 0x0f1c, 0x0f20, 0x0f24,
+	0x0f28, 0x0f2c, 0x0f30, 0x0f34, 0x0f38, 0x0f3e, 0x0f44, 0x0f4a,
+	0x0f50, 0x0f56, 0x0f5c, 0x0f62, 0x0f68, 0x0f6e, 0x0f74, 0x0f7a,
+	0x0f80, 0x0f86, 0x0f8c, 0x0f92, 0x0f98, 0x0f9e, 0x0fa4, 0x0faa,
+	0x0fb0, 0x0fb6, 0x0fbc, 0x0fc2, 0x0fc8, 0x0fce, 0x0fd4, 0x0fda,
+	0x0fe0, 0x0fe6, 0x0fec, 0x0ff2, 0x0ff8, 0x0ffe, 0x1004, 0x100a,
+	0x1010, 0x1016, 0x101c, 0x1022, 0x1028, 0x102e, 0x1034, 0x103a,
+	0x1040, 0x1046, 0x104c, 0x1052, 0x1058, 0x105e, 0x1064, 0x106a,
+	// Entry 3C0 - 3FF
+	0x1070, 0x1076, 0x107c, 0x1082, 0x1088, 0x108e, 0x1094, 0x109a,
+	0x10a0, 0x10a6, 0x10ac, 0x10b2, 0x10b8, 0x10be, 0x10c4, 0x10ca,
+	0x10d0, 0x10d6, 0x10dc, 0x10e2, 0x10e8, 0x10ee, 0x10f4, 0x10fa,
+	0x1100, 0x1106, 0x110c, 0x1112, 0x1118, 0x111e, 0x1124, 0x112a,
+	0x1130, 0x1136, 0x113c, 0x1142, 0x1148, 0x114e, 0x1154, 0x115a,
+	0x1160, 0x1166, 0x116c, 0x1172, 0x1178, 0x1180, 0x1188, 0x1190,
+	0x1198, 0x11a0, 0x11a8, 0x11b0, 0x11b6, 0x11d7, 0x11e6, 0x11ee,
+	0x11ef, 0x11f0, 0x11f1, 0x11f2, 0x11f3, 0x11f4, 0x11f5, 0x11f6,
+	// Entry 400 - 43F
+	0x11f7, 0x11f8, 0x11f9, 0x11fa, 0x11fb, 0x11fc, 0x11fd, 0x11fe,
+	0x11ff, 0x1200, 0x1201, 0x1205, 0x1209, 0x120d, 0x1211, 0x1215,
+	0x1219, 0x121b, 0x121d, 0x121f, 0x1221, 0x1223, 0x1225, 0x1227,
+	0x1229, 0x122b, 0x122d, 0x122f, 0x1231, 0x1233, 0x1235, 0x1237,
+	0x1239, 0x123b, 0x123d, 0x123f, 0x1241, 0x1243, 0x1245, 0x1247,
+	0x1249, 0x124b, 0x124d, 0x124f, 0x1251, 0x1253, 0x1255, 0x1257,
+	0x1259, 0x125b, 0x125d, 0x125f, 0x1263, 0x1267, 0x126b, 0x126f,
+	0x1270, 0x1271, 0x1272, 0x1273, 0x1274, 0x1275, 0x1277, 0x1279,
+	// Entry 440 - 47F
+	0x127b, 0x127d, 0x127f, 0x1287, 0x128f, 0x129b, 0x12a7, 0x12b3,
+	0x12bf, 0x12cb, 0x12d3, 0x12db, 0x12e7, 0x12f3, 0x12ff, 0x130b,
+	0x130d, 0x130f, 0x1311, 0x1313, 0x1315, 0x1317, 0x1319, 0x131b,
+	0x131d, 0x131f, 0x1321, 0x1323, 0x1325, 0x1327, 0x1329, 0x132b,
+	0x132e, 0x1331, 0x1333, 0x1335, 0x1337, 0x1339, 0x133b, 0x133d,
+	0x133f, 0x1341, 0x1343, 0x1345, 0x1347, 0x1349, 0x134b, 0x134d,
+	0x1350, 0x1353, 0x1356, 0x1359, 0x135c, 0x135f, 0x1362, 0x1365,
+	0x1368, 0x136b, 0x136e, 0x1371, 0x1374, 0x1377, 0x137a, 0x137d,
+	// Entry 480 - 4BF
+	0x1380, 0x1383, 0x1386, 0x1389, 0x138c, 0x138f, 0x1392, 0x1395,
+	0x1398, 0x139b, 0x13a2, 0x13a4, 0x13a6, 0x13a8, 0x13ab, 0x13ad,
+	0x13af, 0x13b1, 0x13b3, 0x13b5, 0x13bb, 0x13c1, 0x13c4, 0x13c7,
+	0x13ca, 0x13cd, 0x13d0, 0x13d3, 0x13d6, 0x13d9, 0x13dc, 0x13df,
+	0x13e2, 0x13e5, 0x13e8, 0x13eb, 0x13ee, 0x13f1, 0x13f4, 0x13f7,
+	0x13fa, 0x13fd, 0x1400, 0x1403, 0x1406, 0x1409, 0x140c, 0x140f,
+	0x1412, 0x1415, 0x1418, 0x141b, 0x141e, 0x1421, 0x1424, 0x1427,
+	0x142a, 0x142d, 0x1430, 0x1433, 0x1436, 0x1439, 0x143c, 0x143f,
+	// Entry 4C0 - 4FF
+	0x1442, 0x1445, 0x1448, 0x1451, 0x145a, 0x1463, 0x146c, 0x1475,
+	0x147e, 0x1487, 0x1490, 0x1499, 0x149c, 0x149f, 0x14a2, 0x14a5,
+	0x14a8, 0x14ab, 0x14ae, 0x14b1, 0x14b4, 0x14b7, 0x14ba, 0x14bd,
+	0x14c0, 0x14c3, 0x14c6, 0x14c9, 0x14cc, 0x14cf, 0x14d2, 0x14d5,
+	0x14d8, 0x14db, 0x14de, 0x14e1, 0x14e4, 0x14e7, 0x14ea, 0x14ed,
+	0x14f0, 0x14f3, 0x14f6, 0x14f9, 0x14fc, 0x14ff, 0x1502, 0x1505,
+	0x1508, 0x150b, 0x150e, 0x1511, 0x1514, 0x1517, 0x151a, 0x151d,
+	0x1520, 0x1523, 0x1526, 0x1529, 0x152c, 0x152f, 0x1532, 0x1535,
+	// Entry 500 - 53F
+	0x1538, 0x153b, 0x153e, 0x1541, 0x1544, 0x1547, 0x154a, 0x154d,
+	0x1550, 0x1553, 0x1556, 0x1559, 0x155c, 0x155f, 0x1562, 0x1565,
+	0x1568, 0x156b, 0x156e, 0x1571, 0x1574, 0x1577, 0x157a, 0x157d,
+	0x1580, 0x1583, 0x1586, 0x1589, 0x158c, 0x158f, 0x1592, 0x1595,
+	0x1598, 0x159b, 0x159e, 0x15a1, 0x15a4, 0x15a7, 0x15aa, 0x15ad,
+	0x15b0, 0x15b3, 0x15b6, 0x15b9, 0x15bc, 0x15bf, 0x15c2, 0x15c5,
+	0x15c8, 0x15cb, 0x15ce, 0x15d1, 0x15d4, 0x15d7, 0x15da, 0x15dd,
+	0x15e0, 0x15e3, 0x15e6, 0x15e9, 0x15ec, 0x15ef, 0x15f2, 0x15f5,
+	// Entry 540 - 57F
+	0x15f8, 0x15fb, 0x15fe, 0x1601, 0x1604, 0x1607, 0x160a, 0x160d,
+	0x1610, 0x1613, 0x1616, 0x1619, 0x161c, 0x161f, 0x1622, 0x1625,
+	0x1628, 0x162b, 0x162e, 0x1631, 0x1634, 0x1637, 0x163a, 0x163d,
+	0x1640, 0x1643, 0x1646, 0x1649, 0x164c, 0x164f, 0x1652, 0x1655,
+	0x1658, 0x165b, 0x165e, 0x1661, 0x1664, 0x1667, 0x166a, 0x166d,
+	0x1670, 0x1673, 0x1676, 0x1679, 0x167c, 0x167f, 0x1682, 0x1685,
+	0x1688, 0x168b, 0x168e, 0x1691, 0x1694, 0x1697, 0x169a, 0x169d,
+	0x16a0, 0x16a3, 0x16a6, 0x16a9, 0x16ac, 0x16af, 0x16b2, 0x16b5,
+	// Entry 580 - 5BF
+	0x16b8, 0x16bb, 0x16be, 0x16c1, 0x16c4, 0x16c7, 0x16ca, 0x16cd,
+	0x16d0, 0x16d3, 0x16d6, 0x16d9, 0x16dc, 0x16df, 0x16e2, 0x16e5,
+	0x16e8, 0x16eb, 0x16ee, 0x16f1, 0x16f4, 0x16f7, 0x16fa, 0x16fd,
+	0x1700, 0x1703, 0x1706, 0x1709, 0x170c, 0x170f, 0x1712, 0x1715,
+	0x1718, 0x171b, 0x171e, 0x1721, 0x1724, 0x1727, 0x172a, 0x172d,
+	0x1730, 0x1733, 0x1736, 0x1739, 0x173c, 0x173f, 0x1742, 0x1745,
+	0x1748, 0x174b, 0x174e, 0x1751, 0x1754, 0x1757, 0x175a, 0x175d,
+	0x1760, 0x1763, 0x1766, 0x1769, 0x176c, 0x176f, 0x1772, 0x1775,
+	// Entry 5C0 - 5FF
+	0x1778, 0x177b, 0x177e, 0x1781, 0x1784, 0x1787, 0x178a, 0x178d,
+	0x1790, 0x1793, 0x1796, 0x1799, 0x179c, 0x179f, 0x17a2, 0x17a5,
+	0x17a8, 0x17ab, 0x17ae, 0x17b1, 0x17b4, 0x17b7, 0x17ba, 0x17bd,
+	0x17c0, 0x17c3, 0x17c6, 0x17c9, 0x17cc, 0x17cf, 0x17d2, 0x17d5,
+	0x17d8, 0x17db, 0x17de, 0x17e1, 0x17e4, 0x17e7, 0x17ea, 0x17ed,
+	0x17f0, 0x17f3, 0x17f6, 0x17f9, 0x17fc, 0x17ff, 0x1802, 0x1805,
+	0x1808, 0x180b, 0x180e, 0x1811, 0x1814, 0x1817, 0x181a, 0x181d,
+	0x1820, 0x1823, 0x1826, 0x1829, 0x182c, 0x182f, 0x1832, 0x1835,
+	// Entry 600 - 63F
+	0x1838, 0x183b, 0x183e, 0x1841, 0x1844, 0x1847, 0x184a, 0x184d,
+	0x1850, 0x1853, 0x1856, 0x1859, 0x185c, 0x185f, 0x1862, 0x1865,
+	0x1868, 0x186b, 0x186e, 0x1871, 0x1874, 0x1877, 0x187a, 0x187d,
+	0x1880, 0x1883, 0x1886, 0x1889, 0x188c, 0x188f, 0x1892, 0x1895,
+	0x1898, 0x189b, 0x189e, 0x18a1, 0x18a4, 0x18a7, 0x18aa, 0x18ad,
+	0x18b0, 0x18b3, 0x18b6, 0x18b9, 0x18bc, 0x18bf, 0x18c2, 0x18c5,
+	0x18c8, 0x18cb, 0x18ce, 0x18d1, 0x18d4, 0x18d7, 0x18da, 0x18dd,
+	0x18e0, 0x18e3, 0x18e6, 0x18e9, 0x18ec, 0x18ef, 0x18f2, 0x18f5,
+	// Entry 640 - 67F
+	0x18f8, 0x18fb, 0x18fe, 0x1901, 0x1904, 0x1907, 0x190a, 0x190d,
+	0x1910, 0x1913, 0x1916, 0x1919, 0x191c, 0x191f, 0x1922, 0x1925,
+	0x1928, 0x192b, 0x192e, 0x1931, 0x1934, 0x1937, 0x193a, 0x193d,
+	0x1940, 0x1943, 0x1946, 0x1949, 0x194c, 0x194f, 0x1952, 0x1955,
+	0x1958, 0x195b, 0x195e, 0x1961, 0x1964, 0x1967, 0x196a, 0x196d,
+	0x1970, 0x1973, 0x1976, 0x1979, 0x197c, 0x197f, 0x1982, 0x1985,
+	0x1988, 0x198b,
+} // Size: 3324 bytes
 
 var xorData string = "" + // Size: 4862 bytes
 	"\x02\x0c\x09\x02\xb0\xec\x02\xad\xd8\x02\xad\xd9\x02\x06\x07\x02\x0f\x12" +
@@ -547,7 +690,7 @@ func (t *idnaTrie) lookupStringUnsafe(s string) uint16 {
 	return 0
 }
 
-// idnaTrie. Total size: 30288 bytes (29.58 KiB). Checksum: c0cd84404a2f6f19.
+// idnaTrie. Total size: 30196 bytes (29.49 KiB). Checksum: e2ae95a945f04016.
 type idnaTrie struct{}
 
 func newIdnaTrie(i int) *idnaTrie {
@@ -600,11 +743,11 @@ var idnaValues = [8192]uint16{
 	0xd2: 0x0040, 0xd3: 0x0040, 0xd4: 0x0040, 0xd5: 0x0040, 0xd6: 0x0040, 0xd7: 0x0040,
 	0xd8: 0x0040, 0xd9: 0x0040, 0xda: 0x0040, 0xdb: 0x0040, 0xdc: 0x0040, 0xdd: 0x0040,
 	0xde: 0x0040, 0xdf: 0x0040, 0xe0: 0x000a, 0xe1: 0x0018, 0xe2: 0x0018, 0xe3: 0x0018,
-	0xe4: 0x0018, 0xe5: 0x0018, 0xe6: 0x0018, 0xe7: 0x0018, 0xe8: 0x001a, 0xe9: 0x0018,
-	0xea: 0x0039, 0xeb: 0x0018, 0xec: 0x0018, 0xed: 0x03c0, 0xee: 0x0018, 0xef: 0x004a,
-	0xf0: 0x0018, 0xf1: 0x0018, 0xf2: 0x0069, 0xf3: 0x0079, 0xf4: 0x008a, 0xf5: 0x0005,
-	0xf6: 0x0018, 0xf7: 0x0008, 0xf8: 0x00aa, 0xf9: 0x00c9, 0xfa: 0x00d9, 0xfb: 0x0018,
-	0xfc: 0x00e9, 0xfd: 0x0119, 0xfe: 0x0149, 0xff: 0x0018,
+	0xe4: 0x0018, 0xe5: 0x0018, 0xe6: 0x0018, 0xe7: 0x0018, 0xe8: 0x0012, 0xe9: 0x0018,
+	0xea: 0x0019, 0xeb: 0x0018, 0xec: 0x0018, 0xed: 0x03c0, 0xee: 0x0018, 0xef: 0x0022,
+	0xf0: 0x0018, 0xf1: 0x0018, 0xf2: 0x0029, 0xf3: 0x0031, 0xf4: 0x003a, 0xf5: 0x0005,
+	0xf6: 0x0018, 0xf7: 0x0008, 0xf8: 0x0042, 0xf9: 0x0049, 0xfa: 0x0051, 0xfb: 0x0018,
+	0xfc: 0x0059, 0xfd: 0x0061, 0xfe: 0x0069, 0xff: 0x0018,
 	// Block 0x4, offset 0x100
 	0x100: 0xe00d, 0x101: 0x0008, 0x102: 0xe00d, 0x103: 0x0008, 0x104: 0xe00d, 0x105: 0x0008,
 	0x106: 0xe00d, 0x107: 0x0008, 0x108: 0xe00d, 0x109: 0x0008, 0x10a: 0xe00d, 0x10b: 0x0008,
@@ -614,12 +757,12 @@ var idnaValues = [8192]uint16{
 	0x11e: 0xe00d, 0x11f: 0x0008, 0x120: 0xe00d, 0x121: 0x0008, 0x122: 0xe00d, 0x123: 0x0008,
 	0x124: 0xe00d, 0x125: 0x0008, 0x126: 0xe00d, 0x127: 0x0008, 0x128: 0xe00d, 0x129: 0x0008,
 	0x12a: 0xe00d, 0x12b: 0x0008, 0x12c: 0xe00d, 0x12d: 0x0008, 0x12e: 0xe00d, 0x12f: 0x0008,
-	0x130: 0x0179, 0x131: 0x0008, 0x132: 0x0035, 0x133: 0x004d, 0x134: 0xe00d, 0x135: 0x0008,
+	0x130: 0x0071, 0x131: 0x0008, 0x132: 0x0035, 0x133: 0x004d, 0x134: 0xe00d, 0x135: 0x0008,
 	0x136: 0xe00d, 0x137: 0x0008, 0x138: 0x0008, 0x139: 0xe01d, 0x13a: 0x0008, 0x13b: 0xe03d,
-	0x13c: 0x0008, 0x13d: 0xe01d, 0x13e: 0x0008, 0x13f: 0x0199,
+	0x13c: 0x0008, 0x13d: 0xe01d, 0x13e: 0x0008, 0x13f: 0x0079,
 	// Block 0x5, offset 0x140
-	0x140: 0x0199, 0x141: 0xe01d, 0x142: 0x0008, 0x143: 0xe03d, 0x144: 0x0008, 0x145: 0xe01d,
-	0x146: 0x0008, 0x147: 0xe07d, 0x148: 0x0008, 0x149: 0x01b9, 0x14a: 0xe00d, 0x14b: 0x0008,
+	0x140: 0x0079, 0x141: 0xe01d, 0x142: 0x0008, 0x143: 0xe03d, 0x144: 0x0008, 0x145: 0xe01d,
+	0x146: 0x0008, 0x147: 0xe07d, 0x148: 0x0008, 0x149: 0x0081, 0x14a: 0xe00d, 0x14b: 0x0008,
 	0x14c: 0xe00d, 0x14d: 0x0008, 0x14e: 0xe00d, 0x14f: 0x0008, 0x150: 0xe00d, 0x151: 0x0008,
 	0x152: 0xe00d, 0x153: 0x0008, 0x154: 0xe00d, 0x155: 0x0008, 0x156: 0xe00d, 0x157: 0x0008,
 	0x158: 0xe00d, 0x159: 0x0008, 0x15a: 0xe00d, 0x15b: 0x0008, 0x15c: 0xe00d, 0x15d: 0x0008,
@@ -628,7 +771,7 @@ var idnaValues = [8192]uint16{
 	0x16a: 0xe00d, 0x16b: 0x0008, 0x16c: 0xe00d, 0x16d: 0x0008, 0x16e: 0xe00d, 0x16f: 0x0008,
 	0x170: 0xe00d, 0x171: 0x0008, 0x172: 0xe00d, 0x173: 0x0008, 0x174: 0xe00d, 0x175: 0x0008,
 	0x176: 0xe00d, 0x177: 0x0008, 0x178: 0x0065, 0x179: 0xe01d, 0x17a: 0x0008, 0x17b: 0xe03d,
-	0x17c: 0x0008, 0x17d: 0xe01d, 0x17e: 0x0008, 0x17f: 0x01d9,
+	0x17c: 0x0008, 0x17d: 0xe01d, 0x17e: 0x0008, 0x17f: 0x0089,
 	// Block 0x6, offset 0x180
 	0x180: 0x0008, 0x181: 0x007d, 0x182: 0xe00d, 0x183: 0x0008, 0x184: 0xe00d, 0x185: 0x0008,
 	0x186: 0x007d, 0x187: 0xe07d, 0x188: 0x0008, 0x189: 0x0095, 0x18a: 0x00ad, 0x18b: 0xe03d,
@@ -642,8 +785,8 @@ var idnaValues = [8192]uint16{
 	0x1b6: 0x0008, 0x1b7: 0x01e5, 0x1b8: 0xe00d, 0x1b9: 0x0008, 0x1ba: 0x0008, 0x1bb: 0x0008,
 	0x1bc: 0xe00d, 0x1bd: 0x0008, 0x1be: 0x0008, 0x1bf: 0x0008,
 	// Block 0x7, offset 0x1c0
-	0x1c0: 0x0008, 0x1c1: 0x0008, 0x1c2: 0x0008, 0x1c3: 0x0008, 0x1c4: 0x01e9, 0x1c5: 0x01e9,
-	0x1c6: 0x01e9, 0x1c7: 0x01fd, 0x1c8: 0x0215, 0x1c9: 0x022d, 0x1ca: 0x0245, 0x1cb: 0x025d,
+	0x1c0: 0x0008, 0x1c1: 0x0008, 0x1c2: 0x0008, 0x1c3: 0x0008, 0x1c4: 0x0091, 0x1c5: 0x0091,
+	0x1c6: 0x0091, 0x1c7: 0x01fd, 0x1c8: 0x0215, 0x1c9: 0x022d, 0x1ca: 0x0245, 0x1cb: 0x025d,
 	0x1cc: 0x0275, 0x1cd: 0xe01d, 0x1ce: 0x0008, 0x1cf: 0xe0fd, 0x1d0: 0x0008, 0x1d1: 0xe01d,
 	0x1d2: 0x0008, 0x1d3: 0xe03d, 0x1d4: 0x0008, 0x1d5: 0xe01d, 0x1d6: 0x0008, 0x1d7: 0xe07d,
 	0x1d8: 0x0008, 0x1d9: 0xe01d, 0x1da: 0x0008, 0x1db: 0xe03d, 0x1dc: 0x0008, 0x1dd: 0x0008,
@@ -663,22 +806,22 @@ var idnaValues = [8192]uint16{
 	0x224: 0xe00d, 0x225: 0x0008, 0x226: 0xe00d, 0x227: 0x0008, 0x228: 0xe00d, 0x229: 0x0008,
 	0x22a: 0xe00d, 0x22b: 0x0008, 0x22c: 0xe00d, 0x22d: 0x0008, 0x22e: 0xe00d, 0x22f: 0x0008,
 	0x230: 0xe00d, 0x231: 0x0008, 0x232: 0xe00d, 0x233: 0x0008, 0x234: 0x0008, 0x235: 0x0008,
-	0x236: 0x0008, 0x237: 0x0008, 0x238: 0x0008, 0x239: 0x0008, 0x23a: 0x0209, 0x23b: 0xe03d,
-	0x23c: 0x0008, 0x23d: 0x031d, 0x23e: 0x0229, 0x23f: 0x0008,
+	0x236: 0x0008, 0x237: 0x0008, 0x238: 0x0008, 0x239: 0x0008, 0x23a: 0x0099, 0x23b: 0xe03d,
+	0x23c: 0x0008, 0x23d: 0x031d, 0x23e: 0x00a1, 0x23f: 0x0008,
 	// Block 0x9, offset 0x240
 	0x240: 0x0008, 0x241: 0x0008, 0x242: 0x0018, 0x243: 0x0018, 0x244: 0x0018, 0x245: 0x0018,
 	0x246: 0x0008, 0x247: 0x0008, 0x248: 0x0008, 0x249: 0x0008, 0x24a: 0x0008, 0x24b: 0x0008,
 	0x24c: 0x0008, 0x24d: 0x0008, 0x24e: 0x0008, 0x24f: 0x0008, 0x250: 0x0008, 0x251: 0x0008,
 	0x252: 0x0018, 0x253: 0x0018, 0x254: 0x0018, 0x255: 0x0018, 0x256: 0x0018, 0x257: 0x0018,
-	0x258: 0x029a, 0x259: 0x02ba, 0x25a: 0x02da, 0x25b: 0x02fa, 0x25c: 0x031a, 0x25d: 0x033a,
-	0x25e: 0x0018, 0x25f: 0x0018, 0x260: 0x03ad, 0x261: 0x0359, 0x262: 0x01d9, 0x263: 0x0369,
+	0x258: 0x00d2, 0x259: 0x00da, 0x25a: 0x00e2, 0x25b: 0x00ea, 0x25c: 0x00f2, 0x25d: 0x00fa,
+	0x25e: 0x0018, 0x25f: 0x0018, 0x260: 0x03ad, 0x261: 0x0101, 0x262: 0x0089, 0x263: 0x0109,
 	0x264: 0x03c5, 0x265: 0x0018, 0x266: 0x0018, 0x267: 0x0018, 0x268: 0x0018, 0x269: 0x0018,
 	0x26a: 0x0018, 0x26b: 0x0018, 0x26c: 0x0008, 0x26d: 0x0018, 0x26e: 0x0008, 0x26f: 0x0018,
 	0x270: 0x0018, 0x271: 0x0018, 0x272: 0x0018, 0x273: 0x0018, 0x274: 0x0018, 0x275: 0x0018,
 	0x276: 0x0018, 0x277: 0x0018, 0x278: 0x0018, 0x279: 0x0018, 0x27a: 0x0018, 0x27b: 0x0018,
 	0x27c: 0x0018, 0x27d: 0x0018, 0x27e: 0x0018, 0x27f: 0x0018,
 	// Block 0xa, offset 0x280
-	0x280: 0x03dd, 0x281: 0x03dd, 0x282: 0x3308, 0x283: 0x03f5, 0x284: 0x0379, 0x285: 0x040d,
+	0x280: 0x03dd, 0x281: 0x03dd, 0x282: 0x3308, 0x283: 0x03f5, 0x284: 0x0111, 0x285: 0x040d,
 	0x286: 0x3308, 0x287: 0x3308, 0x288: 0x3308, 0x289: 0x3308, 0x28a: 0x3308, 0x28b: 0x3308,
 	0x28c: 0x3308, 0x28d: 0x3308, 0x28e: 0x3308, 0x28f: 0x33c0, 0x290: 0x3308, 0x291: 0x3308,
 	0x292: 0x3308, 0x293: 0x3308, 0x294: 0x3308, 0x295: 0x3308, 0x296: 0x3308, 0x297: 0x3308,
@@ -687,10 +830,10 @@ var idnaValues = [8192]uint16{
 	0x2a4: 0x3308, 0x2a5: 0x3308, 0x2a6: 0x3308, 0x2a7: 0x3308, 0x2a8: 0x3308, 0x2a9: 0x3308,
 	0x2aa: 0x3308, 0x2ab: 0x3308, 0x2ac: 0x3308, 0x2ad: 0x3308, 0x2ae: 0x3308, 0x2af: 0x3308,
 	0x2b0: 0xe00d, 0x2b1: 0x0008, 0x2b2: 0xe00d, 0x2b3: 0x0008, 0x2b4: 0x0425, 0x2b5: 0x0008,
-	0x2b6: 0xe00d, 0x2b7: 0x0008, 0x2b8: 0x0040, 0x2b9: 0x0040, 0x2ba: 0x03a2, 0x2bb: 0x0008,
-	0x2bc: 0x0008, 0x2bd: 0x0008, 0x2be: 0x03c2, 0x2bf: 0x043d,
+	0x2b6: 0xe00d, 0x2b7: 0x0008, 0x2b8: 0x0040, 0x2b9: 0x0040, 0x2ba: 0x011a, 0x2bb: 0x0008,
+	0x2bc: 0x0008, 0x2bd: 0x0008, 0x2be: 0x0122, 0x2bf: 0x043d,
 	// Block 0xb, offset 0x2c0
-	0x2c0: 0x0040, 0x2c1: 0x0040, 0x2c2: 0x0040, 0x2c3: 0x0040, 0x2c4: 0x008a, 0x2c5: 0x03d2,
+	0x2c0: 0x0040, 0x2c1: 0x0040, 0x2c2: 0x0040, 0x2c3: 0x0040, 0x2c4: 0x003a, 0x2c5: 0x012a,
 	0x2c6: 0xe155, 0x2c7: 0x0455, 0x2c8: 0xe12d, 0x2c9: 0xe13d, 0x2ca: 0xe12d, 0x2cb: 0x0040,
 	0x2cc: 0x03dd, 0x2cd: 0x0040, 0x2ce: 0x046d, 0x2cf: 0x0485, 0x2d0: 0x0008, 0x2d1: 0xe105,
 	0x2d2: 0xe105, 0x2d3: 0xe105, 0x2d4: 0xe105, 0x2d5: 0xe105, 0x2d6: 0xe105, 0x2d7: 0xe105,
@@ -782,8 +925,8 @@ var idnaValues = [8192]uint16{
 	0x49e: 0x3308, 0x49f: 0x3308, 0x4a0: 0x0808, 0x4a1: 0x0808, 0x4a2: 0x0808, 0x4a3: 0x0808,
 	0x4a4: 0x0808, 0x4a5: 0x0808, 0x4a6: 0x0808, 0x4a7: 0x0808, 0x4a8: 0x0808, 0x4a9: 0x0808,
 	0x4aa: 0x0018, 0x4ab: 0x0818, 0x4ac: 0x0818, 0x4ad: 0x0818, 0x4ae: 0x0a08, 0x4af: 0x0a08,
-	0x4b0: 0x3308, 0x4b1: 0x0c08, 0x4b2: 0x0c08, 0x4b3: 0x0c08, 0x4b4: 0x0808, 0x4b5: 0x0429,
-	0x4b6: 0x0451, 0x4b7: 0x0479, 0x4b8: 0x04a1, 0x4b9: 0x0a08, 0x4ba: 0x0a08, 0x4bb: 0x0a08,
+	0x4b0: 0x3308, 0x4b1: 0x0c08, 0x4b2: 0x0c08, 0x4b3: 0x0c08, 0x4b4: 0x0808, 0x4b5: 0x0139,
+	0x4b6: 0x0141, 0x4b7: 0x0149, 0x4b8: 0x0151, 0x4b9: 0x0a08, 0x4ba: 0x0a08, 0x4bb: 0x0a08,
 	0x4bc: 0x0a08, 0x4bd: 0x0a08, 0x4be: 0x0a08, 0x4bf: 0x0a08,
 	// Block 0x13, offset 0x4c0
 	0x4c0: 0x0c08, 0x4c1: 0x0a08, 0x4c2: 0x0a08, 0x4c3: 0x0c08, 0x4c4: 0x0c08, 0x4c5: 0x0c08,
@@ -826,8 +969,8 @@ var idnaValues = [8192]uint16{
 	0x586: 0x3308, 0x587: 0x3308, 0x588: 0x3308, 0x589: 0x3008, 0x58a: 0x3008, 0x58b: 0x3008,
 	0x58c: 0x3008, 0x58d: 0x3b08, 0x58e: 0x3008, 0x58f: 0x3008, 0x590: 0x0008, 0x591: 0x3308,
 	0x592: 0x3308, 0x593: 0x3308, 0x594: 0x3308, 0x595: 0x3308, 0x596: 0x3308, 0x597: 0x3308,
-	0x598: 0x04c9, 0x599: 0x0501, 0x59a: 0x0539, 0x59b: 0x0571, 0x59c: 0x05a9, 0x59d: 0x05e1,
-	0x59e: 0x0619, 0x59f: 0x0651, 0x5a0: 0x0008, 0x5a1: 0x0008, 0x5a2: 0x3308, 0x5a3: 0x3308,
+	0x598: 0x0159, 0x599: 0x0161, 0x59a: 0x0169, 0x59b: 0x0171, 0x59c: 0x0179, 0x59d: 0x0181,
+	0x59e: 0x0189, 0x59f: 0x0191, 0x5a0: 0x0008, 0x5a1: 0x0008, 0x5a2: 0x3308, 0x5a3: 0x3308,
 	0x5a4: 0x0018, 0x5a5: 0x0018, 0x5a6: 0x0008, 0x5a7: 0x0008, 0x5a8: 0x0008, 0x5a9: 0x0008,
 	0x5aa: 0x0008, 0x5ab: 0x0008, 0x5ac: 0x0008, 0x5ad: 0x0008, 0x5ae: 0x0008, 0x5af: 0x0008,
 	0x5b0: 0x0018, 0x5b1: 0x0008, 0x5b2: 0x0008, 0x5b3: 0x0008, 0x5b4: 0x0008, 0x5b5: 0x0008,
@@ -850,8 +993,8 @@ var idnaValues = [8192]uint16{
 	0x606: 0x0040, 0x607: 0x3008, 0x608: 0x3008, 0x609: 0x0040, 0x60a: 0x0040, 0x60b: 0x3008,
 	0x60c: 0x3008, 0x60d: 0x3b08, 0x60e: 0x0008, 0x60f: 0x0040, 0x610: 0x0040, 0x611: 0x0040,
 	0x612: 0x0040, 0x613: 0x0040, 0x614: 0x0040, 0x615: 0x0040, 0x616: 0x0040, 0x617: 0x3008,
-	0x618: 0x0040, 0x619: 0x0040, 0x61a: 0x0040, 0x61b: 0x0040, 0x61c: 0x0689, 0x61d: 0x06c1,
-	0x61e: 0x0040, 0x61f: 0x06f9, 0x620: 0x0008, 0x621: 0x0008, 0x622: 0x3308, 0x623: 0x3308,
+	0x618: 0x0040, 0x619: 0x0040, 0x61a: 0x0040, 0x61b: 0x0040, 0x61c: 0x0199, 0x61d: 0x01a1,
+	0x61e: 0x0040, 0x61f: 0x01a9, 0x620: 0x0008, 0x621: 0x0008, 0x622: 0x3308, 0x623: 0x3308,
 	0x624: 0x0040, 0x625: 0x0040, 0x626: 0x0008, 0x627: 0x0008, 0x628: 0x0008, 0x629: 0x0008,
 	0x62a: 0x0008, 0x62b: 0x0008, 0x62c: 0x0008, 0x62d: 0x0008, 0x62e: 0x0008, 0x62f: 0x0008,
 	0x630: 0x0008, 0x631: 0x0008, 0x632: 0x0018, 0x633: 0x0018, 0x634: 0x0018, 0x635: 0x0018,
@@ -866,16 +1009,16 @@ var idnaValues = [8192]uint16{
 	0x65e: 0x0008, 0x65f: 0x0008, 0x660: 0x0008, 0x661: 0x0008, 0x662: 0x0008, 0x663: 0x0008,
 	0x664: 0x0008, 0x665: 0x0008, 0x666: 0x0008, 0x667: 0x0008, 0x668: 0x0008, 0x669: 0x0040,
 	0x66a: 0x0008, 0x66b: 0x0008, 0x66c: 0x0008, 0x66d: 0x0008, 0x66e: 0x0008, 0x66f: 0x0008,
-	0x670: 0x0008, 0x671: 0x0040, 0x672: 0x0008, 0x673: 0x0731, 0x674: 0x0040, 0x675: 0x0008,
-	0x676: 0x0769, 0x677: 0x0040, 0x678: 0x0008, 0x679: 0x0008, 0x67a: 0x0040, 0x67b: 0x0040,
+	0x670: 0x0008, 0x671: 0x0040, 0x672: 0x0008, 0x673: 0x01b1, 0x674: 0x0040, 0x675: 0x0008,
+	0x676: 0x01b9, 0x677: 0x0040, 0x678: 0x0008, 0x679: 0x0008, 0x67a: 0x0040, 0x67b: 0x0040,
 	0x67c: 0x3308, 0x67d: 0x0040, 0x67e: 0x3008, 0x67f: 0x3008,
 	// Block 0x1a, offset 0x680
 	0x680: 0x3008, 0x681: 0x3308, 0x682: 0x3308, 0x683: 0x0040, 0x684: 0x0040, 0x685: 0x0040,
 	0x686: 0x0040, 0x687: 0x3308, 0x688: 0x3308, 0x689: 0x0040, 0x68a: 0x0040, 0x68b: 0x3308,
 	0x68c: 0x3308, 0x68d: 0x3b08, 0x68e: 0x0040, 0x68f: 0x0040, 0x690: 0x0040, 0x691: 0x3308,
 	0x692: 0x0040, 0x693: 0x0040, 0x694: 0x0040, 0x695: 0x0040, 0x696: 0x0040, 0x697: 0x0040,
-	0x698: 0x0040, 0x699: 0x07a1, 0x69a: 0x07d9, 0x69b: 0x0811, 0x69c: 0x0008, 0x69d: 0x0040,
-	0x69e: 0x0849, 0x69f: 0x0040, 0x6a0: 0x0040, 0x6a1: 0x0040, 0x6a2: 0x0040, 0x6a3: 0x0040,
+	0x698: 0x0040, 0x699: 0x01c1, 0x69a: 0x01c9, 0x69b: 0x01d1, 0x69c: 0x0008, 0x69d: 0x0040,
+	0x69e: 0x01d9, 0x69f: 0x0040, 0x6a0: 0x0040, 0x6a1: 0x0040, 0x6a2: 0x0040, 0x6a3: 0x0040,
 	0x6a4: 0x0040, 0x6a5: 0x0040, 0x6a6: 0x0008, 0x6a7: 0x0008, 0x6a8: 0x0008, 0x6a9: 0x0008,
 	0x6aa: 0x0008, 0x6ab: 0x0008, 0x6ac: 0x0008, 0x6ad: 0x0008, 0x6ae: 0x0008, 0x6af: 0x0008,
 	0x6b0: 0x3308, 0x6b1: 0x3308, 0x6b2: 0x0008, 0x6b3: 0x0008, 0x6b4: 0x0008, 0x6b5: 0x3308,
@@ -922,7 +1065,7 @@ var idnaValues = [8192]uint16{
 	0x786: 0x0040, 0x787: 0x3008, 0x788: 0x3008, 0x789: 0x0040, 0x78a: 0x0040, 0x78b: 0x3008,
 	0x78c: 0x3008, 0x78d: 0x3b08, 0x78e: 0x0040, 0x78f: 0x0040, 0x790: 0x0040, 0x791: 0x0040,
 	0x792: 0x0040, 0x793: 0x0040, 0x794: 0x0040, 0x795: 0x3308, 0x796: 0x3308, 0x797: 0x3008,
-	0x798: 0x0040, 0x799: 0x0040, 0x79a: 0x0040, 0x79b: 0x0040, 0x79c: 0x0881, 0x79d: 0x08b9,
+	0x798: 0x0040, 0x799: 0x0040, 0x79a: 0x0040, 0x79b: 0x0040, 0x79c: 0x01e1, 0x79d: 0x01e9,
 	0x79e: 0x0040, 0x79f: 0x0008, 0x7a0: 0x0008, 0x7a1: 0x0008, 0x7a2: 0x3308, 0x7a3: 0x3308,
 	0x7a4: 0x0040, 0x7a5: 0x0040, 0x7a6: 0x0008, 0x7a7: 0x0008, 0x7a8: 0x0008, 0x7a9: 0x0008,
 	0x7aa: 0x0008, 0x7ab: 0x0008, 0x7ac: 0x0008, 0x7ad: 0x0008, 0x7ae: 0x0008, 0x7af: 0x0008,
@@ -998,32 +1141,32 @@ var idnaValues = [8192]uint16{
 	0x91e: 0x0008, 0x91f: 0x0008, 0x920: 0x0008, 0x921: 0x0008, 0x922: 0x0008, 0x923: 0x0008,
 	0x924: 0x0040, 0x925: 0x0008, 0x926: 0x0040, 0x927: 0x0008, 0x928: 0x0008, 0x929: 0x0008,
 	0x92a: 0x0008, 0x92b: 0x0008, 0x92c: 0x0008, 0x92d: 0x0008, 0x92e: 0x0008, 0x92f: 0x0008,
-	0x930: 0x0008, 0x931: 0x3308, 0x932: 0x0008, 0x933: 0x0929, 0x934: 0x3308, 0x935: 0x3308,
+	0x930: 0x0008, 0x931: 0x3308, 0x932: 0x0008, 0x933: 0x01f9, 0x934: 0x3308, 0x935: 0x3308,
 	0x936: 0x3308, 0x937: 0x3308, 0x938: 0x3308, 0x939: 0x3308, 0x93a: 0x3b08, 0x93b: 0x3308,
 	0x93c: 0x3308, 0x93d: 0x0008, 0x93e: 0x0040, 0x93f: 0x0040,
 	// Block 0x25, offset 0x940
-	0x940: 0x0008, 0x941: 0x0008, 0x942: 0x0008, 0x943: 0x09d1, 0x944: 0x0008, 0x945: 0x0008,
+	0x940: 0x0008, 0x941: 0x0008, 0x942: 0x0008, 0x943: 0x0211, 0x944: 0x0008, 0x945: 0x0008,
 	0x946: 0x0008, 0x947: 0x0008, 0x948: 0x0040, 0x949: 0x0008, 0x94a: 0x0008, 0x94b: 0x0008,
-	0x94c: 0x0008, 0x94d: 0x0a09, 0x94e: 0x0008, 0x94f: 0x0008, 0x950: 0x0008, 0x951: 0x0008,
-	0x952: 0x0a41, 0x953: 0x0008, 0x954: 0x0008, 0x955: 0x0008, 0x956: 0x0008, 0x957: 0x0a79,
-	0x958: 0x0008, 0x959: 0x0008, 0x95a: 0x0008, 0x95b: 0x0008, 0x95c: 0x0ab1, 0x95d: 0x0008,
+	0x94c: 0x0008, 0x94d: 0x0219, 0x94e: 0x0008, 0x94f: 0x0008, 0x950: 0x0008, 0x951: 0x0008,
+	0x952: 0x0221, 0x953: 0x0008, 0x954: 0x0008, 0x955: 0x0008, 0x956: 0x0008, 0x957: 0x0229,
+	0x958: 0x0008, 0x959: 0x0008, 0x95a: 0x0008, 0x95b: 0x0008, 0x95c: 0x0231, 0x95d: 0x0008,
 	0x95e: 0x0008, 0x95f: 0x0008, 0x960: 0x0008, 0x961: 0x0008, 0x962: 0x0008, 0x963: 0x0008,
-	0x964: 0x0008, 0x965: 0x0008, 0x966: 0x0008, 0x967: 0x0008, 0x968: 0x0008, 0x969: 0x0ae9,
+	0x964: 0x0008, 0x965: 0x0008, 0x966: 0x0008, 0x967: 0x0008, 0x968: 0x0008, 0x969: 0x0239,
 	0x96a: 0x0008, 0x96b: 0x0008, 0x96c: 0x0008, 0x96d: 0x0040, 0x96e: 0x0040, 0x96f: 0x0040,
-	0x970: 0x0040, 0x971: 0x3308, 0x972: 0x3308, 0x973: 0x0b21, 0x974: 0x3308, 0x975: 0x0b59,
-	0x976: 0x0b91, 0x977: 0x0bc9, 0x978: 0x0c19, 0x979: 0x0c51, 0x97a: 0x3308, 0x97b: 0x3308,
+	0x970: 0x0040, 0x971: 0x3308, 0x972: 0x3308, 0x973: 0x0241, 0x974: 0x3308, 0x975: 0x0249,
+	0x976: 0x0251, 0x977: 0x0259, 0x978: 0x0261, 0x979: 0x0269, 0x97a: 0x3308, 0x97b: 0x3308,
 	0x97c: 0x3308, 0x97d: 0x3308, 0x97e: 0x3308, 0x97f: 0x3008,
 	// Block 0x26, offset 0x980
-	0x980: 0x3308, 0x981: 0x0ca1, 0x982: 0x3308, 0x983: 0x3308, 0x984: 0x3b08, 0x985: 0x0018,
+	0x980: 0x3308, 0x981: 0x0271, 0x982: 0x3308, 0x983: 0x3308, 0x984: 0x3b08, 0x985: 0x0018,
 	0x986: 0x3308, 0x987: 0x3308, 0x988: 0x0008, 0x989: 0x0008, 0x98a: 0x0008, 0x98b: 0x0008,
 	0x98c: 0x0008, 0x98d: 0x3308, 0x98e: 0x3308, 0x98f: 0x3308, 0x990: 0x3308, 0x991: 0x3308,
-	0x992: 0x3308, 0x993: 0x0cd9, 0x994: 0x3308, 0x995: 0x3308, 0x996: 0x3308, 0x997: 0x3308,
-	0x998: 0x0040, 0x999: 0x3308, 0x99a: 0x3308, 0x99b: 0x3308, 0x99c: 0x3308, 0x99d: 0x0d11,
-	0x99e: 0x3308, 0x99f: 0x3308, 0x9a0: 0x3308, 0x9a1: 0x3308, 0x9a2: 0x0d49, 0x9a3: 0x3308,
-	0x9a4: 0x3308, 0x9a5: 0x3308, 0x9a6: 0x3308, 0x9a7: 0x0d81, 0x9a8: 0x3308, 0x9a9: 0x3308,
-	0x9aa: 0x3308, 0x9ab: 0x3308, 0x9ac: 0x0db9, 0x9ad: 0x3308, 0x9ae: 0x3308, 0x9af: 0x3308,
+	0x992: 0x3308, 0x993: 0x0279, 0x994: 0x3308, 0x995: 0x3308, 0x996: 0x3308, 0x997: 0x3308,
+	0x998: 0x0040, 0x999: 0x3308, 0x99a: 0x3308, 0x99b: 0x3308, 0x99c: 0x3308, 0x99d: 0x0281,
+	0x99e: 0x3308, 0x99f: 0x3308, 0x9a0: 0x3308, 0x9a1: 0x3308, 0x9a2: 0x0289, 0x9a3: 0x3308,
+	0x9a4: 0x3308, 0x9a5: 0x3308, 0x9a6: 0x3308, 0x9a7: 0x0291, 0x9a8: 0x3308, 0x9a9: 0x3308,
+	0x9aa: 0x3308, 0x9ab: 0x3308, 0x9ac: 0x0299, 0x9ad: 0x3308, 0x9ae: 0x3308, 0x9af: 0x3308,
 	0x9b0: 0x3308, 0x9b1: 0x3308, 0x9b2: 0x3308, 0x9b3: 0x3308, 0x9b4: 0x3308, 0x9b5: 0x3308,
-	0x9b6: 0x3308, 0x9b7: 0x3308, 0x9b8: 0x3308, 0x9b9: 0x0df1, 0x9ba: 0x3308, 0x9bb: 0x3308,
+	0x9b6: 0x3308, 0x9b7: 0x3308, 0x9b8: 0x3308, 0x9b9: 0x02a1, 0x9ba: 0x3308, 0x9bb: 0x3308,
 	0x9bc: 0x3308, 0x9bd: 0x0040, 0x9be: 0x0018, 0x9bf: 0x0018,
 	// Block 0x27, offset 0x9c0
 	0x9c0: 0x0008, 0x9c1: 0x0008, 0x9c2: 0x0008, 0x9c3: 0x0008, 0x9c4: 0x0008, 0x9c5: 0x0008,
@@ -1033,34 +1176,34 @@ var idnaValues = [8192]uint16{
 	0x9d8: 0x0008, 0x9d9: 0x0008, 0x9da: 0x0008, 0x9db: 0x0008, 0x9dc: 0x0008, 0x9dd: 0x0008,
 	0x9de: 0x0008, 0x9df: 0x0008, 0x9e0: 0x0008, 0x9e1: 0x0008, 0x9e2: 0x0008, 0x9e3: 0x0008,
 	0x9e4: 0x0008, 0x9e5: 0x0008, 0x9e6: 0x0008, 0x9e7: 0x0008, 0x9e8: 0x0008, 0x9e9: 0x0008,
-	0x9ea: 0x0008, 0x9eb: 0x0008, 0x9ec: 0x0039, 0x9ed: 0x0ed1, 0x9ee: 0x0ee9, 0x9ef: 0x0008,
-	0x9f0: 0x0ef9, 0x9f1: 0x0f09, 0x9f2: 0x0f19, 0x9f3: 0x0f31, 0x9f4: 0x0249, 0x9f5: 0x0f41,
-	0x9f6: 0x0259, 0x9f7: 0x0f51, 0x9f8: 0x0359, 0x9f9: 0x0f61, 0x9fa: 0x0f71, 0x9fb: 0x0008,
-	0x9fc: 0x00d9, 0x9fd: 0x0f81, 0x9fe: 0x0f99, 0x9ff: 0x0269,
+	0x9ea: 0x0008, 0x9eb: 0x0008, 0x9ec: 0x0019, 0x9ed: 0x02e1, 0x9ee: 0x02e9, 0x9ef: 0x0008,
+	0x9f0: 0x02f1, 0x9f1: 0x02f9, 0x9f2: 0x0301, 0x9f3: 0x0309, 0x9f4: 0x00a9, 0x9f5: 0x0311,
+	0x9f6: 0x00b1, 0x9f7: 0x0319, 0x9f8: 0x0101, 0x9f9: 0x0321, 0x9fa: 0x0329, 0x9fb: 0x0008,
+	0x9fc: 0x0051, 0x9fd: 0x0331, 0x9fe: 0x0339, 0x9ff: 0x00b9,
 	// Block 0x28, offset 0xa00
-	0xa00: 0x0fa9, 0xa01: 0x0fb9, 0xa02: 0x0279, 0xa03: 0x0039, 0xa04: 0x0fc9, 0xa05: 0x0fe1,
-	0xa06: 0x05b5, 0xa07: 0x0ee9, 0xa08: 0x0ef9, 0xa09: 0x0f09, 0xa0a: 0x0ff9, 0xa0b: 0x1011,
-	0xa0c: 0x1029, 0xa0d: 0x0f31, 0xa0e: 0x0008, 0xa0f: 0x0f51, 0xa10: 0x0f61, 0xa11: 0x1041,
-	0xa12: 0x00d9, 0xa13: 0x1059, 0xa14: 0x05cd, 0xa15: 0x05cd, 0xa16: 0x0f99, 0xa17: 0x0fa9,
-	0xa18: 0x0fb9, 0xa19: 0x05b5, 0xa1a: 0x1071, 0xa1b: 0x1089, 0xa1c: 0x05e5, 0xa1d: 0x1099,
-	0xa1e: 0x10b1, 0xa1f: 0x10c9, 0xa20: 0x10e1, 0xa21: 0x10f9, 0xa22: 0x0f41, 0xa23: 0x0269,
-	0xa24: 0x0fb9, 0xa25: 0x1089, 0xa26: 0x1099, 0xa27: 0x10b1, 0xa28: 0x1111, 0xa29: 0x10e1,
-	0xa2a: 0x10f9, 0xa2b: 0x0008, 0xa2c: 0x0008, 0xa2d: 0x0008, 0xa2e: 0x0008, 0xa2f: 0x0008,
+	0xa00: 0x0341, 0xa01: 0x0349, 0xa02: 0x00c1, 0xa03: 0x0019, 0xa04: 0x0351, 0xa05: 0x0359,
+	0xa06: 0x05b5, 0xa07: 0x02e9, 0xa08: 0x02f1, 0xa09: 0x02f9, 0xa0a: 0x0361, 0xa0b: 0x0369,
+	0xa0c: 0x0371, 0xa0d: 0x0309, 0xa0e: 0x0008, 0xa0f: 0x0319, 0xa10: 0x0321, 0xa11: 0x0379,
+	0xa12: 0x0051, 0xa13: 0x0381, 0xa14: 0x05cd, 0xa15: 0x05cd, 0xa16: 0x0339, 0xa17: 0x0341,
+	0xa18: 0x0349, 0xa19: 0x05b5, 0xa1a: 0x0389, 0xa1b: 0x0391, 0xa1c: 0x05e5, 0xa1d: 0x0399,
+	0xa1e: 0x03a1, 0xa1f: 0x03a9, 0xa20: 0x03b1, 0xa21: 0x03b9, 0xa22: 0x0311, 0xa23: 0x00b9,
+	0xa24: 0x0349, 0xa25: 0x0391, 0xa26: 0x0399, 0xa27: 0x03a1, 0xa28: 0x03c1, 0xa29: 0x03b1,
+	0xa2a: 0x03b9, 0xa2b: 0x0008, 0xa2c: 0x0008, 0xa2d: 0x0008, 0xa2e: 0x0008, 0xa2f: 0x0008,
 	0xa30: 0x0008, 0xa31: 0x0008, 0xa32: 0x0008, 0xa33: 0x0008, 0xa34: 0x0008, 0xa35: 0x0008,
-	0xa36: 0x0008, 0xa37: 0x0008, 0xa38: 0x1129, 0xa39: 0x0008, 0xa3a: 0x0008, 0xa3b: 0x0008,
+	0xa36: 0x0008, 0xa37: 0x0008, 0xa38: 0x03c9, 0xa39: 0x0008, 0xa3a: 0x0008, 0xa3b: 0x0008,
 	0xa3c: 0x0008, 0xa3d: 0x0008, 0xa3e: 0x0008, 0xa3f: 0x0008,
 	// Block 0x29, offset 0xa40
 	0xa40: 0x0008, 0xa41: 0x0008, 0xa42: 0x0008, 0xa43: 0x0008, 0xa44: 0x0008, 0xa45: 0x0008,
 	0xa46: 0x0008, 0xa47: 0x0008, 0xa48: 0x0008, 0xa49: 0x0008, 0xa4a: 0x0008, 0xa4b: 0x0008,
 	0xa4c: 0x0008, 0xa4d: 0x0008, 0xa4e: 0x0008, 0xa4f: 0x0008, 0xa50: 0x0008, 0xa51: 0x0008,
 	0xa52: 0x0008, 0xa53: 0x0008, 0xa54: 0x0008, 0xa55: 0x0008, 0xa56: 0x0008, 0xa57: 0x0008,
-	0xa58: 0x0008, 0xa59: 0x0008, 0xa5a: 0x0008, 0xa5b: 0x1141, 0xa5c: 0x1159, 0xa5d: 0x1169,
-	0xa5e: 0x1181, 0xa5f: 0x1029, 0xa60: 0x1199, 0xa61: 0x11a9, 0xa62: 0x11c1, 0xa63: 0x11d9,
-	0xa64: 0x11f1, 0xa65: 0x1209, 0xa66: 0x1221, 0xa67: 0x05fd, 0xa68: 0x1239, 0xa69: 0x1251,
-	0xa6a: 0xe17d, 0xa6b: 0x1269, 0xa6c: 0x1281, 0xa6d: 0x1299, 0xa6e: 0x12b1, 0xa6f: 0x12c9,
-	0xa70: 0x12e1, 0xa71: 0x12f9, 0xa72: 0x1311, 0xa73: 0x1329, 0xa74: 0x1341, 0xa75: 0x1359,
-	0xa76: 0x1371, 0xa77: 0x1389, 0xa78: 0x0615, 0xa79: 0x13a1, 0xa7a: 0x13b9, 0xa7b: 0x13d1,
-	0xa7c: 0x13e1, 0xa7d: 0x13f9, 0xa7e: 0x1411, 0xa7f: 0x1429,
+	0xa58: 0x0008, 0xa59: 0x0008, 0xa5a: 0x0008, 0xa5b: 0x03d1, 0xa5c: 0x03d9, 0xa5d: 0x03e1,
+	0xa5e: 0x03e9, 0xa5f: 0x0371, 0xa60: 0x03f1, 0xa61: 0x03f9, 0xa62: 0x0401, 0xa63: 0x0409,
+	0xa64: 0x0411, 0xa65: 0x0419, 0xa66: 0x0421, 0xa67: 0x05fd, 0xa68: 0x0429, 0xa69: 0x0431,
+	0xa6a: 0xe17d, 0xa6b: 0x0439, 0xa6c: 0x0441, 0xa6d: 0x0449, 0xa6e: 0x0451, 0xa6f: 0x0459,
+	0xa70: 0x0461, 0xa71: 0x0469, 0xa72: 0x0471, 0xa73: 0x0479, 0xa74: 0x0481, 0xa75: 0x0489,
+	0xa76: 0x0491, 0xa77: 0x0499, 0xa78: 0x0615, 0xa79: 0x04a1, 0xa7a: 0x04a9, 0xa7b: 0x04b1,
+	0xa7c: 0x04b9, 0xa7d: 0x04c1, 0xa7e: 0x04c9, 0xa7f: 0x04d1,
 	// Block 0x2a, offset 0xa80
 	0xa80: 0xe00d, 0xa81: 0x0008, 0xa82: 0xe00d, 0xa83: 0x0008, 0xa84: 0xe00d, 0xa85: 0x0008,
 	0xa86: 0xe00d, 0xa87: 0x0008, 0xa88: 0xe00d, 0xa89: 0x0008, 0xa8a: 0xe00d, 0xa8b: 0x0008,
@@ -1079,7 +1222,7 @@ var idnaValues = [8192]uint16{
 	0xacc: 0xe00d, 0xacd: 0x0008, 0xace: 0xe00d, 0xacf: 0x0008, 0xad0: 0xe00d, 0xad1: 0x0008,
 	0xad2: 0xe00d, 0xad3: 0x0008, 0xad4: 0xe00d, 0xad5: 0x0008, 0xad6: 0x0008, 0xad7: 0x0008,
 	0xad8: 0x0008, 0xad9: 0x0008, 0xada: 0x062d, 0xadb: 0x064d, 0xadc: 0x0008, 0xadd: 0x0008,
-	0xade: 0x1441, 0xadf: 0x0008, 0xae0: 0xe00d, 0xae1: 0x0008, 0xae2: 0xe00d, 0xae3: 0x0008,
+	0xade: 0x04d9, 0xadf: 0x0008, 0xae0: 0xe00d, 0xae1: 0x0008, 0xae2: 0xe00d, 0xae3: 0x0008,
 	0xae4: 0xe00d, 0xae5: 0x0008, 0xae6: 0xe00d, 0xae7: 0x0008, 0xae8: 0xe00d, 0xae9: 0x0008,
 	0xaea: 0xe00d, 0xaeb: 0x0008, 0xaec: 0xe00d, 0xaed: 0x0008, 0xaee: 0xe00d, 0xaef: 0x0008,
 	0xaf0: 0xe00d, 0xaf1: 0x0008, 0xaf2: 0xe00d, 0xaf3: 0x0008, 0xaf4: 0xe00d, 0xaf5: 0x0008,
@@ -1094,33 +1237,33 @@ var idnaValues = [8192]uint16{
 	0xb1e: 0x0040, 0xb1f: 0xe045, 0xb20: 0x0008, 0xb21: 0x0008, 0xb22: 0x0008, 0xb23: 0x0008,
 	0xb24: 0x0008, 0xb25: 0x0008, 0xb26: 0x0008, 0xb27: 0x0008, 0xb28: 0xe045, 0xb29: 0xe045,
 	0xb2a: 0xe045, 0xb2b: 0xe045, 0xb2c: 0xe045, 0xb2d: 0xe045, 0xb2e: 0xe045, 0xb2f: 0xe045,
-	0xb30: 0x0008, 0xb31: 0x1459, 0xb32: 0x0008, 0xb33: 0x1471, 0xb34: 0x0008, 0xb35: 0x1489,
-	0xb36: 0x0008, 0xb37: 0x14a1, 0xb38: 0x0008, 0xb39: 0x14b9, 0xb3a: 0x0008, 0xb3b: 0x14d1,
-	0xb3c: 0x0008, 0xb3d: 0x14e9, 0xb3e: 0x0040, 0xb3f: 0x0040,
+	0xb30: 0x0008, 0xb31: 0x04e1, 0xb32: 0x0008, 0xb33: 0x04e9, 0xb34: 0x0008, 0xb35: 0x04f1,
+	0xb36: 0x0008, 0xb37: 0x04f9, 0xb38: 0x0008, 0xb39: 0x0501, 0xb3a: 0x0008, 0xb3b: 0x0509,
+	0xb3c: 0x0008, 0xb3d: 0x0511, 0xb3e: 0x0040, 0xb3f: 0x0040,
 	// Block 0x2d, offset 0xb40
-	0xb40: 0x1501, 0xb41: 0x1531, 0xb42: 0x1561, 0xb43: 0x1591, 0xb44: 0x15c1, 0xb45: 0x15f1,
-	0xb46: 0x1621, 0xb47: 0x1651, 0xb48: 0x1501, 0xb49: 0x1531, 0xb4a: 0x1561, 0xb4b: 0x1591,
-	0xb4c: 0x15c1, 0xb4d: 0x15f1, 0xb4e: 0x1621, 0xb4f: 0x1651, 0xb50: 0x1681, 0xb51: 0x16b1,
-	0xb52: 0x16e1, 0xb53: 0x1711, 0xb54: 0x1741, 0xb55: 0x1771, 0xb56: 0x17a1, 0xb57: 0x17d1,
-	0xb58: 0x1681, 0xb59: 0x16b1, 0xb5a: 0x16e1, 0xb5b: 0x1711, 0xb5c: 0x1741, 0xb5d: 0x1771,
-	0xb5e: 0x17a1, 0xb5f: 0x17d1, 0xb60: 0x1801, 0xb61: 0x1831, 0xb62: 0x1861, 0xb63: 0x1891,
-	0xb64: 0x18c1, 0xb65: 0x18f1, 0xb66: 0x1921, 0xb67: 0x1951, 0xb68: 0x1801, 0xb69: 0x1831,
-	0xb6a: 0x1861, 0xb6b: 0x1891, 0xb6c: 0x18c1, 0xb6d: 0x18f1, 0xb6e: 0x1921, 0xb6f: 0x1951,
-	0xb70: 0x0008, 0xb71: 0x0008, 0xb72: 0x1981, 0xb73: 0x19b1, 0xb74: 0x19d9, 0xb75: 0x0040,
-	0xb76: 0x0008, 0xb77: 0x1a01, 0xb78: 0xe045, 0xb79: 0xe045, 0xb7a: 0x0665, 0xb7b: 0x1459,
-	0xb7c: 0x19b1, 0xb7d: 0x067e, 0xb7e: 0x1a31, 0xb7f: 0x069e,
+	0xb40: 0x0519, 0xb41: 0x0521, 0xb42: 0x0529, 0xb43: 0x0531, 0xb44: 0x0539, 0xb45: 0x0541,
+	0xb46: 0x0549, 0xb47: 0x0551, 0xb48: 0x0519, 0xb49: 0x0521, 0xb4a: 0x0529, 0xb4b: 0x0531,
+	0xb4c: 0x0539, 0xb4d: 0x0541, 0xb4e: 0x0549, 0xb4f: 0x0551, 0xb50: 0x0559, 0xb51: 0x0561,
+	0xb52: 0x0569, 0xb53: 0x0571, 0xb54: 0x0579, 0xb55: 0x0581, 0xb56: 0x0589, 0xb57: 0x0591,
+	0xb58: 0x0559, 0xb59: 0x0561, 0xb5a: 0x0569, 0xb5b: 0x0571, 0xb5c: 0x0579, 0xb5d: 0x0581,
+	0xb5e: 0x0589, 0xb5f: 0x0591, 0xb60: 0x0599, 0xb61: 0x05a1, 0xb62: 0x05a9, 0xb63: 0x05b1,
+	0xb64: 0x05b9, 0xb65: 0x05c1, 0xb66: 0x05c9, 0xb67: 0x05d1, 0xb68: 0x0599, 0xb69: 0x05a1,
+	0xb6a: 0x05a9, 0xb6b: 0x05b1, 0xb6c: 0x05b9, 0xb6d: 0x05c1, 0xb6e: 0x05c9, 0xb6f: 0x05d1,
+	0xb70: 0x0008, 0xb71: 0x0008, 0xb72: 0x05d9, 0xb73: 0x05e1, 0xb74: 0x05e9, 0xb75: 0x0040,
+	0xb76: 0x0008, 0xb77: 0x05f1, 0xb78: 0xe045, 0xb79: 0xe045, 0xb7a: 0x0665, 0xb7b: 0x04e1,
+	0xb7c: 0x05e1, 0xb7d: 0x067e, 0xb7e: 0x05f9, 0xb7f: 0x069e,
 	// Block 0x2e, offset 0xb80
-	0xb80: 0x06be, 0xb81: 0x1a4a, 0xb82: 0x1a79, 0xb83: 0x1aa9, 0xb84: 0x1ad1, 0xb85: 0x0040,
-	0xb86: 0x0008, 0xb87: 0x1af9, 0xb88: 0x06dd, 0xb89: 0x1471, 0xb8a: 0x06f5, 0xb8b: 0x1489,
-	0xb8c: 0x1aa9, 0xb8d: 0x1b2a, 0xb8e: 0x1b5a, 0xb8f: 0x1b8a, 0xb90: 0x0008, 0xb91: 0x0008,
-	0xb92: 0x0008, 0xb93: 0x1bb9, 0xb94: 0x0040, 0xb95: 0x0040, 0xb96: 0x0008, 0xb97: 0x0008,
-	0xb98: 0xe045, 0xb99: 0xe045, 0xb9a: 0x070d, 0xb9b: 0x14a1, 0xb9c: 0x0040, 0xb9d: 0x1bd2,
-	0xb9e: 0x1c02, 0xb9f: 0x1c32, 0xba0: 0x0008, 0xba1: 0x0008, 0xba2: 0x0008, 0xba3: 0x1c61,
+	0xb80: 0x06be, 0xb81: 0x0602, 0xb82: 0x0609, 0xb83: 0x0611, 0xb84: 0x0619, 0xb85: 0x0040,
+	0xb86: 0x0008, 0xb87: 0x0621, 0xb88: 0x06dd, 0xb89: 0x04e9, 0xb8a: 0x06f5, 0xb8b: 0x04f1,
+	0xb8c: 0x0611, 0xb8d: 0x062a, 0xb8e: 0x0632, 0xb8f: 0x063a, 0xb90: 0x0008, 0xb91: 0x0008,
+	0xb92: 0x0008, 0xb93: 0x0641, 0xb94: 0x0040, 0xb95: 0x0040, 0xb96: 0x0008, 0xb97: 0x0008,
+	0xb98: 0xe045, 0xb99: 0xe045, 0xb9a: 0x070d, 0xb9b: 0x04f9, 0xb9c: 0x0040, 0xb9d: 0x064a,
+	0xb9e: 0x0652, 0xb9f: 0x065a, 0xba0: 0x0008, 0xba1: 0x0008, 0xba2: 0x0008, 0xba3: 0x0661,
 	0xba4: 0x0008, 0xba5: 0x0008, 0xba6: 0x0008, 0xba7: 0x0008, 0xba8: 0xe045, 0xba9: 0xe045,
-	0xbaa: 0x0725, 0xbab: 0x14d1, 0xbac: 0xe04d, 0xbad: 0x1c7a, 0xbae: 0x03d2, 0xbaf: 0x1caa,
-	0xbb0: 0x0040, 0xbb1: 0x0040, 0xbb2: 0x1cb9, 0xbb3: 0x1ce9, 0xbb4: 0x1d11, 0xbb5: 0x0040,
-	0xbb6: 0x0008, 0xbb7: 0x1d39, 0xbb8: 0x073d, 0xbb9: 0x14b9, 0xbba: 0x0515, 0xbbb: 0x14e9,
-	0xbbc: 0x1ce9, 0xbbd: 0x0756, 0xbbe: 0x0776, 0xbbf: 0x0040,
+	0xbaa: 0x0725, 0xbab: 0x0509, 0xbac: 0xe04d, 0xbad: 0x066a, 0xbae: 0x012a, 0xbaf: 0x0672,
+	0xbb0: 0x0040, 0xbb1: 0x0040, 0xbb2: 0x0679, 0xbb3: 0x0681, 0xbb4: 0x0689, 0xbb5: 0x0040,
+	0xbb6: 0x0008, 0xbb7: 0x0691, 0xbb8: 0x073d, 0xbb9: 0x0501, 0xbba: 0x0515, 0xbbb: 0x0511,
+	0xbbc: 0x0681, 0xbbd: 0x0756, 0xbbe: 0x0776, 0xbbf: 0x0040,
 	// Block 0x2f, offset 0xbc0
 	0xbc0: 0x000a, 0xbc1: 0x000a, 0xbc2: 0x000a, 0xbc3: 0x000a, 0xbc4: 0x000a, 0xbc5: 0x000a,
 	0xbc6: 0x000a, 0xbc7: 0x000a, 0xbc8: 0x000a, 0xbc9: 0x000a, 0xbca: 0x000a, 0xbcb: 0x03c0,
@@ -1130,72 +1273,72 @@ var idnaValues = [8192]uint16{
 	0xbde: 0x0018, 0xbdf: 0x0018, 0xbe0: 0x0018, 0xbe1: 0x0018, 0xbe2: 0x0018, 0xbe3: 0x0018,
 	0xbe4: 0x0040, 0xbe5: 0x0040, 0xbe6: 0x0040, 0xbe7: 0x0018, 0xbe8: 0x0040, 0xbe9: 0x0040,
 	0xbea: 0x0340, 0xbeb: 0x0340, 0xbec: 0x0340, 0xbed: 0x0340, 0xbee: 0x0340, 0xbef: 0x000a,
-	0xbf0: 0x0018, 0xbf1: 0x0018, 0xbf2: 0x0018, 0xbf3: 0x1d69, 0xbf4: 0x1da1, 0xbf5: 0x0018,
-	0xbf6: 0x1df1, 0xbf7: 0x1e29, 0xbf8: 0x0018, 0xbf9: 0x0018, 0xbfa: 0x0018, 0xbfb: 0x0018,
-	0xbfc: 0x1e7a, 0xbfd: 0x0018, 0xbfe: 0x07b6, 0xbff: 0x0018,
+	0xbf0: 0x0018, 0xbf1: 0x0018, 0xbf2: 0x0018, 0xbf3: 0x0699, 0xbf4: 0x06a1, 0xbf5: 0x0018,
+	0xbf6: 0x06a9, 0xbf7: 0x06b1, 0xbf8: 0x0018, 0xbf9: 0x0018, 0xbfa: 0x0018, 0xbfb: 0x0018,
+	0xbfc: 0x06ba, 0xbfd: 0x0018, 0xbfe: 0x07b6, 0xbff: 0x0018,
 	// Block 0x30, offset 0xc00
 	0xc00: 0x0018, 0xc01: 0x0018, 0xc02: 0x0018, 0xc03: 0x0018, 0xc04: 0x0018, 0xc05: 0x0018,
-	0xc06: 0x0018, 0xc07: 0x1e92, 0xc08: 0x1eaa, 0xc09: 0x1ec2, 0xc0a: 0x0018, 0xc0b: 0x0018,
+	0xc06: 0x0018, 0xc07: 0x06c2, 0xc08: 0x06ca, 0xc09: 0x06d2, 0xc0a: 0x0018, 0xc0b: 0x0018,
 	0xc0c: 0x0018, 0xc0d: 0x0018, 0xc0e: 0x0018, 0xc0f: 0x0018, 0xc10: 0x0018, 0xc11: 0x0018,
-	0xc12: 0x0018, 0xc13: 0x0018, 0xc14: 0x0018, 0xc15: 0x0018, 0xc16: 0x0018, 0xc17: 0x1ed9,
+	0xc12: 0x0018, 0xc13: 0x0018, 0xc14: 0x0018, 0xc15: 0x0018, 0xc16: 0x0018, 0xc17: 0x06d9,
 	0xc18: 0x0018, 0xc19: 0x0018, 0xc1a: 0x0018, 0xc1b: 0x0018, 0xc1c: 0x0018, 0xc1d: 0x0018,
 	0xc1e: 0x0018, 0xc1f: 0x000a, 0xc20: 0x03c0, 0xc21: 0x0340, 0xc22: 0x0340, 0xc23: 0x0340,
 	0xc24: 0x03c0, 0xc25: 0x0040, 0xc26: 0x0040, 0xc27: 0x0040, 0xc28: 0x0040, 0xc29: 0x0040,
 	0xc2a: 0x0340, 0xc2b: 0x0340, 0xc2c: 0x0340, 0xc2d: 0x0340, 0xc2e: 0x0340, 0xc2f: 0x0340,
-	0xc30: 0x1f41, 0xc31: 0x0f41, 0xc32: 0x0040, 0xc33: 0x0040, 0xc34: 0x1f51, 0xc35: 0x1f61,
-	0xc36: 0x1f71, 0xc37: 0x1f81, 0xc38: 0x1f91, 0xc39: 0x1fa1, 0xc3a: 0x1fb2, 0xc3b: 0x07d5,
-	0xc3c: 0x1fc2, 0xc3d: 0x1fd2, 0xc3e: 0x1fe2, 0xc3f: 0x0f71,
+	0xc30: 0x06e1, 0xc31: 0x0311, 0xc32: 0x0040, 0xc33: 0x0040, 0xc34: 0x06e9, 0xc35: 0x06f1,
+	0xc36: 0x06f9, 0xc37: 0x0701, 0xc38: 0x0709, 0xc39: 0x0711, 0xc3a: 0x071a, 0xc3b: 0x07d5,
+	0xc3c: 0x0722, 0xc3d: 0x072a, 0xc3e: 0x0732, 0xc3f: 0x0329,
 	// Block 0x31, offset 0xc40
-	0xc40: 0x1f41, 0xc41: 0x00c9, 0xc42: 0x0069, 0xc43: 0x0079, 0xc44: 0x1f51, 0xc45: 0x1f61,
-	0xc46: 0x1f71, 0xc47: 0x1f81, 0xc48: 0x1f91, 0xc49: 0x1fa1, 0xc4a: 0x1fb2, 0xc4b: 0x07ed,
-	0xc4c: 0x1fc2, 0xc4d: 0x1fd2, 0xc4e: 0x1fe2, 0xc4f: 0x0040, 0xc50: 0x0039, 0xc51: 0x0f09,
-	0xc52: 0x00d9, 0xc53: 0x0369, 0xc54: 0x0ff9, 0xc55: 0x0249, 0xc56: 0x0f51, 0xc57: 0x0359,
-	0xc58: 0x0f61, 0xc59: 0x0f71, 0xc5a: 0x0f99, 0xc5b: 0x01d9, 0xc5c: 0x0fa9, 0xc5d: 0x0040,
+	0xc40: 0x06e1, 0xc41: 0x0049, 0xc42: 0x0029, 0xc43: 0x0031, 0xc44: 0x06e9, 0xc45: 0x06f1,
+	0xc46: 0x06f9, 0xc47: 0x0701, 0xc48: 0x0709, 0xc49: 0x0711, 0xc4a: 0x071a, 0xc4b: 0x07ed,
+	0xc4c: 0x0722, 0xc4d: 0x072a, 0xc4e: 0x0732, 0xc4f: 0x0040, 0xc50: 0x0019, 0xc51: 0x02f9,
+	0xc52: 0x0051, 0xc53: 0x0109, 0xc54: 0x0361, 0xc55: 0x00a9, 0xc56: 0x0319, 0xc57: 0x0101,
+	0xc58: 0x0321, 0xc59: 0x0329, 0xc5a: 0x0339, 0xc5b: 0x0089, 0xc5c: 0x0341, 0xc5d: 0x0040,
 	0xc5e: 0x0040, 0xc5f: 0x0040, 0xc60: 0x0018, 0xc61: 0x0018, 0xc62: 0x0018, 0xc63: 0x0018,
-	0xc64: 0x0018, 0xc65: 0x0018, 0xc66: 0x0018, 0xc67: 0x0018, 0xc68: 0x1ff1, 0xc69: 0x0018,
+	0xc64: 0x0018, 0xc65: 0x0018, 0xc66: 0x0018, 0xc67: 0x0018, 0xc68: 0x0739, 0xc69: 0x0018,
 	0xc6a: 0x0018, 0xc6b: 0x0018, 0xc6c: 0x0018, 0xc6d: 0x0018, 0xc6e: 0x0018, 0xc6f: 0x0018,
 	0xc70: 0x0018, 0xc71: 0x0018, 0xc72: 0x0018, 0xc73: 0x0018, 0xc74: 0x0018, 0xc75: 0x0018,
 	0xc76: 0x0018, 0xc77: 0x0018, 0xc78: 0x0018, 0xc79: 0x0018, 0xc7a: 0x0018, 0xc7b: 0x0018,
 	0xc7c: 0x0018, 0xc7d: 0x0018, 0xc7e: 0x0018, 0xc7f: 0x0018,
 	// Block 0x32, offset 0xc80
-	0xc80: 0x0806, 0xc81: 0x0826, 0xc82: 0x1159, 0xc83: 0x0845, 0xc84: 0x0018, 0xc85: 0x0866,
-	0xc86: 0x0886, 0xc87: 0x1011, 0xc88: 0x0018, 0xc89: 0x08a5, 0xc8a: 0x0f31, 0xc8b: 0x0249,
-	0xc8c: 0x0249, 0xc8d: 0x0249, 0xc8e: 0x0249, 0xc8f: 0x2009, 0xc90: 0x0f41, 0xc91: 0x0f41,
-	0xc92: 0x0359, 0xc93: 0x0359, 0xc94: 0x0018, 0xc95: 0x0f71, 0xc96: 0x2021, 0xc97: 0x0018,
-	0xc98: 0x0018, 0xc99: 0x0f99, 0xc9a: 0x2039, 0xc9b: 0x0269, 0xc9c: 0x0269, 0xc9d: 0x0269,
-	0xc9e: 0x0018, 0xc9f: 0x0018, 0xca0: 0x2049, 0xca1: 0x08c5, 0xca2: 0x2061, 0xca3: 0x0018,
-	0xca4: 0x13d1, 0xca5: 0x0018, 0xca6: 0x2079, 0xca7: 0x0018, 0xca8: 0x13d1, 0xca9: 0x0018,
-	0xcaa: 0x0f51, 0xcab: 0x2091, 0xcac: 0x0ee9, 0xcad: 0x1159, 0xcae: 0x0018, 0xcaf: 0x0f09,
-	0xcb0: 0x0f09, 0xcb1: 0x1199, 0xcb2: 0x0040, 0xcb3: 0x0f61, 0xcb4: 0x00d9, 0xcb5: 0x20a9,
-	0xcb6: 0x20c1, 0xcb7: 0x20d9, 0xcb8: 0x20f1, 0xcb9: 0x0f41, 0xcba: 0x0018, 0xcbb: 0x08e5,
-	0xcbc: 0x2109, 0xcbd: 0x10b1, 0xcbe: 0x10b1, 0xcbf: 0x2109,
+	0xc80: 0x0806, 0xc81: 0x0826, 0xc82: 0x03d9, 0xc83: 0x0845, 0xc84: 0x0018, 0xc85: 0x0866,
+	0xc86: 0x0886, 0xc87: 0x0369, 0xc88: 0x0018, 0xc89: 0x08a5, 0xc8a: 0x0309, 0xc8b: 0x00a9,
+	0xc8c: 0x00a9, 0xc8d: 0x00a9, 0xc8e: 0x00a9, 0xc8f: 0x0741, 0xc90: 0x0311, 0xc91: 0x0311,
+	0xc92: 0x0101, 0xc93: 0x0101, 0xc94: 0x0018, 0xc95: 0x0329, 0xc96: 0x0749, 0xc97: 0x0018,
+	0xc98: 0x0018, 0xc99: 0x0339, 0xc9a: 0x0751, 0xc9b: 0x00b9, 0xc9c: 0x00b9, 0xc9d: 0x00b9,
+	0xc9e: 0x0018, 0xc9f: 0x0018, 0xca0: 0x0759, 0xca1: 0x08c5, 0xca2: 0x0761, 0xca3: 0x0018,
+	0xca4: 0x04b1, 0xca5: 0x0018, 0xca6: 0x0769, 0xca7: 0x0018, 0xca8: 0x04b1, 0xca9: 0x0018,
+	0xcaa: 0x0319, 0xcab: 0x0771, 0xcac: 0x02e9, 0xcad: 0x03d9, 0xcae: 0x0018, 0xcaf: 0x02f9,
+	0xcb0: 0x02f9, 0xcb1: 0x03f1, 0xcb2: 0x0040, 0xcb3: 0x0321, 0xcb4: 0x0051, 0xcb5: 0x0779,
+	0xcb6: 0x0781, 0xcb7: 0x0789, 0xcb8: 0x0791, 0xcb9: 0x0311, 0xcba: 0x0018, 0xcbb: 0x08e5,
+	0xcbc: 0x0799, 0xcbd: 0x03a1, 0xcbe: 0x03a1, 0xcbf: 0x0799,
 	// Block 0x33, offset 0xcc0
-	0xcc0: 0x0905, 0xcc1: 0x0018, 0xcc2: 0x0018, 0xcc3: 0x0018, 0xcc4: 0x0018, 0xcc5: 0x0ef9,
-	0xcc6: 0x0ef9, 0xcc7: 0x0f09, 0xcc8: 0x0f41, 0xcc9: 0x0259, 0xcca: 0x0018, 0xccb: 0x0018,
-	0xccc: 0x0018, 0xccd: 0x0018, 0xcce: 0x0008, 0xccf: 0x0018, 0xcd0: 0x2121, 0xcd1: 0x2151,
-	0xcd2: 0x2181, 0xcd3: 0x21b9, 0xcd4: 0x21e9, 0xcd5: 0x2219, 0xcd6: 0x2249, 0xcd7: 0x2279,
-	0xcd8: 0x22a9, 0xcd9: 0x22d9, 0xcda: 0x2309, 0xcdb: 0x2339, 0xcdc: 0x2369, 0xcdd: 0x2399,
-	0xcde: 0x23c9, 0xcdf: 0x23f9, 0xce0: 0x0f41, 0xce1: 0x2421, 0xce2: 0x091d, 0xce3: 0x2439,
-	0xce4: 0x1089, 0xce5: 0x2451, 0xce6: 0x093d, 0xce7: 0x2469, 0xce8: 0x2491, 0xce9: 0x0369,
-	0xcea: 0x24a9, 0xceb: 0x095d, 0xcec: 0x0359, 0xced: 0x1159, 0xcee: 0x0ef9, 0xcef: 0x0f61,
-	0xcf0: 0x0f41, 0xcf1: 0x2421, 0xcf2: 0x097d, 0xcf3: 0x2439, 0xcf4: 0x1089, 0xcf5: 0x2451,
-	0xcf6: 0x099d, 0xcf7: 0x2469, 0xcf8: 0x2491, 0xcf9: 0x0369, 0xcfa: 0x24a9, 0xcfb: 0x09bd,
-	0xcfc: 0x0359, 0xcfd: 0x1159, 0xcfe: 0x0ef9, 0xcff: 0x0f61,
+	0xcc0: 0x0905, 0xcc1: 0x0018, 0xcc2: 0x0018, 0xcc3: 0x0018, 0xcc4: 0x0018, 0xcc5: 0x02f1,
+	0xcc6: 0x02f1, 0xcc7: 0x02f9, 0xcc8: 0x0311, 0xcc9: 0x00b1, 0xcca: 0x0018, 0xccb: 0x0018,
+	0xccc: 0x0018, 0xccd: 0x0018, 0xcce: 0x0008, 0xccf: 0x0018, 0xcd0: 0x07a1, 0xcd1: 0x07a9,
+	0xcd2: 0x07b1, 0xcd3: 0x07b9, 0xcd4: 0x07c1, 0xcd5: 0x07c9, 0xcd6: 0x07d1, 0xcd7: 0x07d9,
+	0xcd8: 0x07e1, 0xcd9: 0x07e9, 0xcda: 0x07f1, 0xcdb: 0x07f9, 0xcdc: 0x0801, 0xcdd: 0x0809,
+	0xcde: 0x0811, 0xcdf: 0x0819, 0xce0: 0x0311, 0xce1: 0x0821, 0xce2: 0x091d, 0xce3: 0x0829,
+	0xce4: 0x0391, 0xce5: 0x0831, 0xce6: 0x093d, 0xce7: 0x0839, 0xce8: 0x0841, 0xce9: 0x0109,
+	0xcea: 0x0849, 0xceb: 0x095d, 0xcec: 0x0101, 0xced: 0x03d9, 0xcee: 0x02f1, 0xcef: 0x0321,
+	0xcf0: 0x0311, 0xcf1: 0x0821, 0xcf2: 0x097d, 0xcf3: 0x0829, 0xcf4: 0x0391, 0xcf5: 0x0831,
+	0xcf6: 0x099d, 0xcf7: 0x0839, 0xcf8: 0x0841, 0xcf9: 0x0109, 0xcfa: 0x0849, 0xcfb: 0x09bd,
+	0xcfc: 0x0101, 0xcfd: 0x03d9, 0xcfe: 0x02f1, 0xcff: 0x0321,
 	// Block 0x34, offset 0xd00
 	0xd00: 0x0018, 0xd01: 0x0018, 0xd02: 0x0018, 0xd03: 0x0018, 0xd04: 0x0018, 0xd05: 0x0018,
 	0xd06: 0x0018, 0xd07: 0x0018, 0xd08: 0x0018, 0xd09: 0x0018, 0xd0a: 0x0018, 0xd0b: 0x0040,
 	0xd0c: 0x0040, 0xd0d: 0x0040, 0xd0e: 0x0040, 0xd0f: 0x0040, 0xd10: 0x0040, 0xd11: 0x0040,
 	0xd12: 0x0040, 0xd13: 0x0040, 0xd14: 0x0040, 0xd15: 0x0040, 0xd16: 0x0040, 0xd17: 0x0040,
 	0xd18: 0x0040, 0xd19: 0x0040, 0xd1a: 0x0040, 0xd1b: 0x0040, 0xd1c: 0x0040, 0xd1d: 0x0040,
-	0xd1e: 0x0040, 0xd1f: 0x0040, 0xd20: 0x00c9, 0xd21: 0x0069, 0xd22: 0x0079, 0xd23: 0x1f51,
-	0xd24: 0x1f61, 0xd25: 0x1f71, 0xd26: 0x1f81, 0xd27: 0x1f91, 0xd28: 0x1fa1, 0xd29: 0x2601,
-	0xd2a: 0x2619, 0xd2b: 0x2631, 0xd2c: 0x2649, 0xd2d: 0x2661, 0xd2e: 0x2679, 0xd2f: 0x2691,
-	0xd30: 0x26a9, 0xd31: 0x26c1, 0xd32: 0x26d9, 0xd33: 0x26f1, 0xd34: 0x0a1e, 0xd35: 0x0a3e,
+	0xd1e: 0x0040, 0xd1f: 0x0040, 0xd20: 0x0049, 0xd21: 0x0029, 0xd22: 0x0031, 0xd23: 0x06e9,
+	0xd24: 0x06f1, 0xd25: 0x06f9, 0xd26: 0x0701, 0xd27: 0x0709, 0xd28: 0x0711, 0xd29: 0x0879,
+	0xd2a: 0x0881, 0xd2b: 0x0889, 0xd2c: 0x0891, 0xd2d: 0x0899, 0xd2e: 0x08a1, 0xd2f: 0x08a9,
+	0xd30: 0x08b1, 0xd31: 0x08b9, 0xd32: 0x08c1, 0xd33: 0x08c9, 0xd34: 0x0a1e, 0xd35: 0x0a3e,
 	0xd36: 0x0a5e, 0xd37: 0x0a7e, 0xd38: 0x0a9e, 0xd39: 0x0abe, 0xd3a: 0x0ade, 0xd3b: 0x0afe,
-	0xd3c: 0x0b1e, 0xd3d: 0x270a, 0xd3e: 0x2732, 0xd3f: 0x275a,
+	0xd3c: 0x0b1e, 0xd3d: 0x08d2, 0xd3e: 0x08da, 0xd3f: 0x08e2,
 	// Block 0x35, offset 0xd40
-	0xd40: 0x2782, 0xd41: 0x27aa, 0xd42: 0x27d2, 0xd43: 0x27fa, 0xd44: 0x2822, 0xd45: 0x284a,
-	0xd46: 0x2872, 0xd47: 0x289a, 0xd48: 0x0040, 0xd49: 0x0040, 0xd4a: 0x0040, 0xd4b: 0x0040,
+	0xd40: 0x08ea, 0xd41: 0x08f2, 0xd42: 0x08fa, 0xd43: 0x0902, 0xd44: 0x090a, 0xd45: 0x0912,
+	0xd46: 0x091a, 0xd47: 0x0922, 0xd48: 0x0040, 0xd49: 0x0040, 0xd4a: 0x0040, 0xd4b: 0x0040,
 	0xd4c: 0x0040, 0xd4d: 0x0040, 0xd4e: 0x0040, 0xd4f: 0x0040, 0xd50: 0x0040, 0xd51: 0x0040,
 	0xd52: 0x0040, 0xd53: 0x0040, 0xd54: 0x0040, 0xd55: 0x0040, 0xd56: 0x0040, 0xd57: 0x0040,
 	0xd58: 0x0040, 0xd59: 0x0040, 0xd5a: 0x0040, 0xd5b: 0x0040, 0xd5c: 0x0b3e, 0xd5d: 0x0b5e,
@@ -1203,17 +1346,17 @@ var idnaValues = [8192]uint16{
 	0xd64: 0x0c3e, 0xd65: 0x0c5e, 0xd66: 0x0c7e, 0xd67: 0x0c9e, 0xd68: 0x0cbe, 0xd69: 0x0cde,
 	0xd6a: 0x0cfe, 0xd6b: 0x0d1e, 0xd6c: 0x0d3e, 0xd6d: 0x0d5e, 0xd6e: 0x0d7e, 0xd6f: 0x0d9e,
 	0xd70: 0x0dbe, 0xd71: 0x0dde, 0xd72: 0x0dfe, 0xd73: 0x0e1e, 0xd74: 0x0e3e, 0xd75: 0x0e5e,
-	0xd76: 0x0039, 0xd77: 0x0ee9, 0xd78: 0x1159, 0xd79: 0x0ef9, 0xd7a: 0x0f09, 0xd7b: 0x1199,
-	0xd7c: 0x0f31, 0xd7d: 0x0249, 0xd7e: 0x0f41, 0xd7f: 0x0259,
+	0xd76: 0x0019, 0xd77: 0x02e9, 0xd78: 0x03d9, 0xd79: 0x02f1, 0xd7a: 0x02f9, 0xd7b: 0x03f1,
+	0xd7c: 0x0309, 0xd7d: 0x00a9, 0xd7e: 0x0311, 0xd7f: 0x00b1,
 	// Block 0x36, offset 0xd80
-	0xd80: 0x0f51, 0xd81: 0x0359, 0xd82: 0x0f61, 0xd83: 0x0f71, 0xd84: 0x00d9, 0xd85: 0x0f99,
-	0xd86: 0x2039, 0xd87: 0x0269, 0xd88: 0x01d9, 0xd89: 0x0fa9, 0xd8a: 0x0fb9, 0xd8b: 0x1089,
-	0xd8c: 0x0279, 0xd8d: 0x0369, 0xd8e: 0x0289, 0xd8f: 0x13d1, 0xd90: 0x0039, 0xd91: 0x0ee9,
-	0xd92: 0x1159, 0xd93: 0x0ef9, 0xd94: 0x0f09, 0xd95: 0x1199, 0xd96: 0x0f31, 0xd97: 0x0249,
-	0xd98: 0x0f41, 0xd99: 0x0259, 0xd9a: 0x0f51, 0xd9b: 0x0359, 0xd9c: 0x0f61, 0xd9d: 0x0f71,
-	0xd9e: 0x00d9, 0xd9f: 0x0f99, 0xda0: 0x2039, 0xda1: 0x0269, 0xda2: 0x01d9, 0xda3: 0x0fa9,
-	0xda4: 0x0fb9, 0xda5: 0x1089, 0xda6: 0x0279, 0xda7: 0x0369, 0xda8: 0x0289, 0xda9: 0x13d1,
-	0xdaa: 0x1f41, 0xdab: 0x0018, 0xdac: 0x0018, 0xdad: 0x0018, 0xdae: 0x0018, 0xdaf: 0x0018,
+	0xd80: 0x0319, 0xd81: 0x0101, 0xd82: 0x0321, 0xd83: 0x0329, 0xd84: 0x0051, 0xd85: 0x0339,
+	0xd86: 0x0751, 0xd87: 0x00b9, 0xd88: 0x0089, 0xd89: 0x0341, 0xd8a: 0x0349, 0xd8b: 0x0391,
+	0xd8c: 0x00c1, 0xd8d: 0x0109, 0xd8e: 0x00c9, 0xd8f: 0x04b1, 0xd90: 0x0019, 0xd91: 0x02e9,
+	0xd92: 0x03d9, 0xd93: 0x02f1, 0xd94: 0x02f9, 0xd95: 0x03f1, 0xd96: 0x0309, 0xd97: 0x00a9,
+	0xd98: 0x0311, 0xd99: 0x00b1, 0xd9a: 0x0319, 0xd9b: 0x0101, 0xd9c: 0x0321, 0xd9d: 0x0329,
+	0xd9e: 0x0051, 0xd9f: 0x0339, 0xda0: 0x0751, 0xda1: 0x00b9, 0xda2: 0x0089, 0xda3: 0x0341,
+	0xda4: 0x0349, 0xda5: 0x0391, 0xda6: 0x00c1, 0xda7: 0x0109, 0xda8: 0x00c9, 0xda9: 0x04b1,
+	0xdaa: 0x06e1, 0xdab: 0x0018, 0xdac: 0x0018, 0xdad: 0x0018, 0xdae: 0x0018, 0xdaf: 0x0018,
 	0xdb0: 0x0018, 0xdb1: 0x0018, 0xdb2: 0x0018, 0xdb3: 0x0018, 0xdb4: 0x0018, 0xdb5: 0x0018,
 	0xdb6: 0x0018, 0xdb7: 0x0018, 0xdb8: 0x0018, 0xdb9: 0x0018, 0xdba: 0x0018, 0xdbb: 0x0018,
 	0xdbc: 0x0018, 0xdbd: 0x0018, 0xdbe: 0x0018, 0xdbf: 0x0018,
@@ -1223,12 +1366,12 @@ var idnaValues = [8192]uint16{
 	0xdcc: 0x0008, 0xdcd: 0x0008, 0xdce: 0x0008, 0xdcf: 0x0008, 0xdd0: 0x0008, 0xdd1: 0x0008,
 	0xdd2: 0x0008, 0xdd3: 0x0008, 0xdd4: 0x0008, 0xdd5: 0x0008, 0xdd6: 0x0008, 0xdd7: 0x0008,
 	0xdd8: 0x0008, 0xdd9: 0x0008, 0xdda: 0x0008, 0xddb: 0x0008, 0xddc: 0x0008, 0xddd: 0x0008,
-	0xdde: 0x0008, 0xddf: 0x0040, 0xde0: 0xe00d, 0xde1: 0x0008, 0xde2: 0x2971, 0xde3: 0x0ed5,
-	0xde4: 0x2989, 0xde5: 0x0008, 0xde6: 0x0008, 0xde7: 0xe07d, 0xde8: 0x0008, 0xde9: 0xe01d,
-	0xdea: 0x0008, 0xdeb: 0xe03d, 0xdec: 0x0008, 0xded: 0x0fe1, 0xdee: 0x1281, 0xdef: 0x0fc9,
-	0xdf0: 0x1141, 0xdf1: 0x0008, 0xdf2: 0xe00d, 0xdf3: 0x0008, 0xdf4: 0x0008, 0xdf5: 0xe01d,
+	0xdde: 0x0008, 0xddf: 0x0040, 0xde0: 0xe00d, 0xde1: 0x0008, 0xde2: 0x0941, 0xde3: 0x0ed5,
+	0xde4: 0x0949, 0xde5: 0x0008, 0xde6: 0x0008, 0xde7: 0xe07d, 0xde8: 0x0008, 0xde9: 0xe01d,
+	0xdea: 0x0008, 0xdeb: 0xe03d, 0xdec: 0x0008, 0xded: 0x0359, 0xdee: 0x0441, 0xdef: 0x0351,
+	0xdf0: 0x03d1, 0xdf1: 0x0008, 0xdf2: 0xe00d, 0xdf3: 0x0008, 0xdf4: 0x0008, 0xdf5: 0xe01d,
 	0xdf6: 0x0008, 0xdf7: 0x0008, 0xdf8: 0x0008, 0xdf9: 0x0008, 0xdfa: 0x0008, 0xdfb: 0x0008,
-	0xdfc: 0x0259, 0xdfd: 0x1089, 0xdfe: 0x29a1, 0xdff: 0x29b9,
+	0xdfc: 0x00b1, 0xdfd: 0x0391, 0xdfe: 0x0951, 0xdff: 0x0959,
 	// Block 0x38, offset 0xe00
 	0xe00: 0xe00d, 0xe01: 0x0008, 0xe02: 0xe00d, 0xe03: 0x0008, 0xe04: 0xe00d, 0xe05: 0x0008,
 	0xe06: 0xe00d, 0xe07: 0x0008, 0xe08: 0xe00d, 0xe09: 0x0008, 0xe0a: 0xe00d, 0xe0b: 0x0008,
@@ -1254,7 +1397,7 @@ var idnaValues = [8192]uint16{
 	0xe76: 0x0040, 0xe77: 0x0040, 0xe78: 0x0040, 0xe79: 0x0040, 0xe7a: 0x0040, 0xe7b: 0x0040,
 	0xe7c: 0x0040, 0xe7d: 0x0040, 0xe7e: 0x0040, 0xe7f: 0x0040,
 	// Block 0x3a, offset 0xe80
-	0xe80: 0x000a, 0xe81: 0x0018, 0xe82: 0x29d1, 0xe83: 0x0018, 0xe84: 0x0018, 0xe85: 0x0008,
+	0xe80: 0x000a, 0xe81: 0x0018, 0xe82: 0x0961, 0xe83: 0x0018, 0xe84: 0x0018, 0xe85: 0x0008,
 	0xe86: 0x0008, 0xe87: 0x0008, 0xe88: 0x0018, 0xe89: 0x0018, 0xe8a: 0x0018, 0xe8b: 0x0018,
 	0xe8c: 0x0018, 0xe8d: 0x0018, 0xe8e: 0x0018, 0xe8f: 0x0018, 0xe90: 0x0018, 0xe91: 0x0018,
 	0xe92: 0x0018, 0xe93: 0x0018, 0xe94: 0x0018, 0xe95: 0x0018, 0xe96: 0x0018, 0xe97: 0x0018,
@@ -1290,17 +1433,17 @@ var idnaValues = [8192]uint16{
 	0xf36: 0x0008, 0xf37: 0x0008, 0xf38: 0x0008, 0xf39: 0x0008, 0xf3a: 0x0008, 0xf3b: 0x0008,
 	0xf3c: 0x0008, 0xf3d: 0x0008, 0xf3e: 0x0008, 0xf3f: 0x0008,
 	// Block 0x3d, offset 0xf40
-	0xf40: 0x36a2, 0xf41: 0x36d2, 0xf42: 0x3702, 0xf43: 0x3732, 0xf44: 0x32d5, 0xf45: 0x32f5,
+	0xf40: 0x0b82, 0xf41: 0x0b8a, 0xf42: 0x0b92, 0xf43: 0x0b9a, 0xf44: 0x32d5, 0xf45: 0x32f5,
 	0xf46: 0x3315, 0xf47: 0x3335, 0xf48: 0x0018, 0xf49: 0x0018, 0xf4a: 0x0018, 0xf4b: 0x0018,
-	0xf4c: 0x0018, 0xf4d: 0x0018, 0xf4e: 0x0018, 0xf4f: 0x0018, 0xf50: 0x3355, 0xf51: 0x3761,
-	0xf52: 0x3779, 0xf53: 0x3791, 0xf54: 0x37a9, 0xf55: 0x37c1, 0xf56: 0x37d9, 0xf57: 0x37f1,
-	0xf58: 0x3809, 0xf59: 0x3821, 0xf5a: 0x3839, 0xf5b: 0x3851, 0xf5c: 0x3869, 0xf5d: 0x3881,
-	0xf5e: 0x3899, 0xf5f: 0x38b1, 0xf60: 0x3375, 0xf61: 0x3395, 0xf62: 0x33b5, 0xf63: 0x33d5,
+	0xf4c: 0x0018, 0xf4d: 0x0018, 0xf4e: 0x0018, 0xf4f: 0x0018, 0xf50: 0x3355, 0xf51: 0x0ba1,
+	0xf52: 0x0ba9, 0xf53: 0x0bb1, 0xf54: 0x0bb9, 0xf55: 0x0bc1, 0xf56: 0x0bc9, 0xf57: 0x0bd1,
+	0xf58: 0x0bd9, 0xf59: 0x0be1, 0xf5a: 0x0be9, 0xf5b: 0x0bf1, 0xf5c: 0x0bf9, 0xf5d: 0x0c01,
+	0xf5e: 0x0c09, 0xf5f: 0x0c11, 0xf60: 0x3375, 0xf61: 0x3395, 0xf62: 0x33b5, 0xf63: 0x33d5,
 	0xf64: 0x33f5, 0xf65: 0x33f5, 0xf66: 0x3415, 0xf67: 0x3435, 0xf68: 0x3455, 0xf69: 0x3475,
 	0xf6a: 0x3495, 0xf6b: 0x34b5, 0xf6c: 0x34d5, 0xf6d: 0x34f5, 0xf6e: 0x3515, 0xf6f: 0x3535,
 	0xf70: 0x3555, 0xf71: 0x3575, 0xf72: 0x3595, 0xf73: 0x35b5, 0xf74: 0x35d5, 0xf75: 0x35f5,
 	0xf76: 0x3615, 0xf77: 0x3635, 0xf78: 0x3655, 0xf79: 0x3675, 0xf7a: 0x3695, 0xf7b: 0x36b5,
-	0xf7c: 0x38c9, 0xf7d: 0x3901, 0xf7e: 0x36d5, 0xf7f: 0x0018,
+	0xf7c: 0x0c19, 0xf7d: 0x0c21, 0xf7e: 0x36d5, 0xf7f: 0x0018,
 	// Block 0x3e, offset 0xf80
 	0xf80: 0x36f5, 0xf81: 0x3715, 0xf82: 0x3735, 0xf83: 0x3755, 0xf84: 0x3775, 0xf85: 0x3795,
 	0xf86: 0x37b5, 0xf87: 0x37d5, 0xf88: 0x37f5, 0xf89: 0x3815, 0xf8a: 0x3835, 0xf8b: 0x3855,
@@ -1310,13 +1453,13 @@ var idnaValues = [8192]uint16{
 	0xf9e: 0x3ab5, 0xf9f: 0x3ad5, 0xfa0: 0x3af5, 0xfa1: 0x3b15, 0xfa2: 0x3b35, 0xfa3: 0x3b55,
 	0xfa4: 0x3b75, 0xfa5: 0x3b95, 0xfa6: 0x1295, 0xfa7: 0x3bb5, 0xfa8: 0x3bd5, 0xfa9: 0x3bf5,
 	0xfaa: 0x3c15, 0xfab: 0x3c35, 0xfac: 0x3c55, 0xfad: 0x3c75, 0xfae: 0x23b5, 0xfaf: 0x3c95,
-	0xfb0: 0x3cb5, 0xfb1: 0x3939, 0xfb2: 0x3951, 0xfb3: 0x3969, 0xfb4: 0x3981, 0xfb5: 0x3999,
-	0xfb6: 0x39b1, 0xfb7: 0x39c9, 0xfb8: 0x39e1, 0xfb9: 0x39f9, 0xfba: 0x3a11, 0xfbb: 0x3a29,
-	0xfbc: 0x3a41, 0xfbd: 0x3a59, 0xfbe: 0x3a71, 0xfbf: 0x3a89,
+	0xfb0: 0x3cb5, 0xfb1: 0x0c29, 0xfb2: 0x0c31, 0xfb3: 0x0c39, 0xfb4: 0x0c41, 0xfb5: 0x0c49,
+	0xfb6: 0x0c51, 0xfb7: 0x0c59, 0xfb8: 0x0c61, 0xfb9: 0x0c69, 0xfba: 0x0c71, 0xfbb: 0x0c79,
+	0xfbc: 0x0c81, 0xfbd: 0x0c89, 0xfbe: 0x0c91, 0xfbf: 0x0c99,
 	// Block 0x3f, offset 0xfc0
-	0xfc0: 0x3aa1, 0xfc1: 0x3ac9, 0xfc2: 0x3af1, 0xfc3: 0x3b19, 0xfc4: 0x3b41, 0xfc5: 0x3b69,
-	0xfc6: 0x3b91, 0xfc7: 0x3bb9, 0xfc8: 0x3be1, 0xfc9: 0x3c09, 0xfca: 0x3c39, 0xfcb: 0x3c69,
-	0xfcc: 0x3c99, 0xfcd: 0x3cd5, 0xfce: 0x3cb1, 0xfcf: 0x3cf5, 0xfd0: 0x3d15, 0xfd1: 0x3d2d,
+	0xfc0: 0x0ca1, 0xfc1: 0x0ca9, 0xfc2: 0x0cb1, 0xfc3: 0x0cb9, 0xfc4: 0x0cc1, 0xfc5: 0x0cc9,
+	0xfc6: 0x0cd1, 0xfc7: 0x0cd9, 0xfc8: 0x0ce1, 0xfc9: 0x0ce9, 0xfca: 0x0cf1, 0xfcb: 0x0cf9,
+	0xfcc: 0x0d01, 0xfcd: 0x3cd5, 0xfce: 0x0d09, 0xfcf: 0x3cf5, 0xfd0: 0x3d15, 0xfd1: 0x3d2d,
 	0xfd2: 0x3d45, 0xfd3: 0x3d5d, 0xfd4: 0x3d75, 0xfd5: 0x3d75, 0xfd6: 0x3d5d, 0xfd7: 0x3d8d,
 	0xfd8: 0x07d5, 0xfd9: 0x3da5, 0xfda: 0x3dbd, 0xfdb: 0x3dd5, 0xfdc: 0x3ded, 0xfdd: 0x3e05,
 	0xfde: 0x3e1d, 0xfdf: 0x3e35, 0xfe0: 0x3e4d, 0xfe1: 0x3e65, 0xfe2: 0x3e7d, 0xfe3: 0x3e95,
@@ -1324,769 +1467,769 @@ var idnaValues = [8192]uint16{
 	0xfea: 0x3ef5, 0xfeb: 0x3f0d, 0xfec: 0x3f25, 0xfed: 0x3f3d, 0xfee: 0x3f55, 0xfef: 0x3f55,
 	0xff0: 0x3f6d, 0xff1: 0x3f6d, 0xff2: 0x3f6d, 0xff3: 0x3f85, 0xff4: 0x3f9d, 0xff5: 0x3fb5,
 	0xff6: 0x3fcd, 0xff7: 0x3fb5, 0xff8: 0x3fe5, 0xff9: 0x3ffd, 0xffa: 0x3f85, 0xffb: 0x4015,
-	0xffc: 0x402d, 0xffd: 0x402d, 0xffe: 0x402d, 0xfff: 0x3cc9,
+	0xffc: 0x402d, 0xffd: 0x402d, 0xffe: 0x402d, 0xfff: 0x0d11,
 	// Block 0x40, offset 0x1000
-	0x1000: 0x3d01, 0x1001: 0x3d69, 0x1002: 0x3dd1, 0x1003: 0x3e39, 0x1004: 0x3e89, 0x1005: 0x3ef1,
-	0x1006: 0x3f41, 0x1007: 0x3f91, 0x1008: 0x4011, 0x1009: 0x4079, 0x100a: 0x40c9, 0x100b: 0x4119,
-	0x100c: 0x4169, 0x100d: 0x41d1, 0x100e: 0x4239, 0x100f: 0x4289, 0x1010: 0x42d9, 0x1011: 0x4311,
-	0x1012: 0x4361, 0x1013: 0x43c9, 0x1014: 0x4431, 0x1015: 0x4469, 0x1016: 0x44e9, 0x1017: 0x4581,
-	0x1018: 0x4601, 0x1019: 0x4651, 0x101a: 0x46d1, 0x101b: 0x4751, 0x101c: 0x47b9, 0x101d: 0x4809,
-	0x101e: 0x4859, 0x101f: 0x48a9, 0x1020: 0x4911, 0x1021: 0x4991, 0x1022: 0x49f9, 0x1023: 0x4a49,
-	0x1024: 0x4a99, 0x1025: 0x4ae9, 0x1026: 0x4b21, 0x1027: 0x4b59, 0x1028: 0x4b91, 0x1029: 0x4bc9,
-	0x102a: 0x4c19, 0x102b: 0x4c69, 0x102c: 0x4ce9, 0x102d: 0x4d39, 0x102e: 0x4da1, 0x102f: 0x4e21,
-	0x1030: 0x4e71, 0x1031: 0x4ea9, 0x1032: 0x4ee1, 0x1033: 0x4f61, 0x1034: 0x4fc9, 0x1035: 0x5049,
-	0x1036: 0x5099, 0x1037: 0x5119, 0x1038: 0x5151, 0x1039: 0x51a1, 0x103a: 0x51f1, 0x103b: 0x5241,
-	0x103c: 0x5291, 0x103d: 0x52e1, 0x103e: 0x5349, 0x103f: 0x5399,
+	0x1000: 0x10f9, 0x1001: 0x1101, 0x1002: 0x40a5, 0x1003: 0x1109, 0x1004: 0x1111, 0x1005: 0x1119,
+	0x1006: 0x1121, 0x1007: 0x1129, 0x1008: 0x40c5, 0x1009: 0x1131, 0x100a: 0x1139, 0x100b: 0x1141,
+	0x100c: 0x40e5, 0x100d: 0x40e5, 0x100e: 0x1149, 0x100f: 0x1151, 0x1010: 0x1159, 0x1011: 0x4105,
+	0x1012: 0x4125, 0x1013: 0x4145, 0x1014: 0x4165, 0x1015: 0x4185, 0x1016: 0x1161, 0x1017: 0x1169,
+	0x1018: 0x1171, 0x1019: 0x1179, 0x101a: 0x1181, 0x101b: 0x41a5, 0x101c: 0x1189, 0x101d: 0x1191,
+	0x101e: 0x1199, 0x101f: 0x41c5, 0x1020: 0x41e5, 0x1021: 0x11a1, 0x1022: 0x4205, 0x1023: 0x4225,
+	0x1024: 0x4245, 0x1025: 0x11a9, 0x1026: 0x4265, 0x1027: 0x11b1, 0x1028: 0x11b9, 0x1029: 0x10f9,
+	0x102a: 0x4285, 0x102b: 0x42a5, 0x102c: 0x42c5, 0x102d: 0x42e5, 0x102e: 0x11c1, 0x102f: 0x11c9,
+	0x1030: 0x11d1, 0x1031: 0x11d9, 0x1032: 0x4305, 0x1033: 0x11e1, 0x1034: 0x11e9, 0x1035: 0x11f1,
+	0x1036: 0x4325, 0x1037: 0x11f9, 0x1038: 0x1201, 0x1039: 0x11f9, 0x103a: 0x1209, 0x103b: 0x1211,
+	0x103c: 0x4345, 0x103d: 0x1219, 0x103e: 0x1221, 0x103f: 0x1219,
 	// Block 0x41, offset 0x1040
-	0x1040: 0x53d1, 0x1041: 0x5421, 0x1042: 0x5471, 0x1043: 0x54c1, 0x1044: 0x5529, 0x1045: 0x5579,
-	0x1046: 0x55c9, 0x1047: 0x5619, 0x1048: 0x5699, 0x1049: 0x5701, 0x104a: 0x5739, 0x104b: 0x57b9,
-	0x104c: 0x57f1, 0x104d: 0x5859, 0x104e: 0x58c1, 0x104f: 0x5911, 0x1050: 0x5961, 0x1051: 0x59b1,
-	0x1052: 0x5a19, 0x1053: 0x5a51, 0x1054: 0x5aa1, 0x1055: 0x5b09, 0x1056: 0x5b41, 0x1057: 0x5bc1,
-	0x1058: 0x5c11, 0x1059: 0x5c39, 0x105a: 0x5c61, 0x105b: 0x5c89, 0x105c: 0x5cb1, 0x105d: 0x5cd9,
-	0x105e: 0x5d01, 0x105f: 0x5d29, 0x1060: 0x5d51, 0x1061: 0x5d79, 0x1062: 0x5da1, 0x1063: 0x5dd1,
-	0x1064: 0x5e01, 0x1065: 0x5e31, 0x1066: 0x5e61, 0x1067: 0x5e91, 0x1068: 0x5ec1, 0x1069: 0x5ef1,
-	0x106a: 0x5f21, 0x106b: 0x5f51, 0x106c: 0x5f81, 0x106d: 0x5fb1, 0x106e: 0x5fe1, 0x106f: 0x6011,
-	0x1070: 0x6041, 0x1071: 0x4045, 0x1072: 0x6071, 0x1073: 0x6089, 0x1074: 0x4065, 0x1075: 0x60a1,
-	0x1076: 0x60b9, 0x1077: 0x60d1, 0x1078: 0x4085, 0x1079: 0x4085, 0x107a: 0x60e9, 0x107b: 0x6101,
-	0x107c: 0x6139, 0x107d: 0x6171, 0x107e: 0x61a9, 0x107f: 0x61e1,
+	0x1040: 0x4365, 0x1041: 0x4385, 0x1042: 0x0040, 0x1043: 0x1229, 0x1044: 0x1231, 0x1045: 0x1239,
+	0x1046: 0x1241, 0x1047: 0x0040, 0x1048: 0x1249, 0x1049: 0x1251, 0x104a: 0x1259, 0x104b: 0x1261,
+	0x104c: 0x1269, 0x104d: 0x1271, 0x104e: 0x1199, 0x104f: 0x1279, 0x1050: 0x1281, 0x1051: 0x1289,
+	0x1052: 0x43a5, 0x1053: 0x1291, 0x1054: 0x1121, 0x1055: 0x43c5, 0x1056: 0x43e5, 0x1057: 0x1299,
+	0x1058: 0x0040, 0x1059: 0x4405, 0x105a: 0x12a1, 0x105b: 0x12a9, 0x105c: 0x12b1, 0x105d: 0x12b9,
+	0x105e: 0x12c1, 0x105f: 0x12c9, 0x1060: 0x12d1, 0x1061: 0x12d9, 0x1062: 0x12e1, 0x1063: 0x12e9,
+	0x1064: 0x12f1, 0x1065: 0x12f9, 0x1066: 0x1301, 0x1067: 0x1309, 0x1068: 0x1311, 0x1069: 0x1319,
+	0x106a: 0x1321, 0x106b: 0x1329, 0x106c: 0x1331, 0x106d: 0x1339, 0x106e: 0x1341, 0x106f: 0x1349,
+	0x1070: 0x1351, 0x1071: 0x1359, 0x1072: 0x1361, 0x1073: 0x1369, 0x1074: 0x1371, 0x1075: 0x1379,
+	0x1076: 0x1381, 0x1077: 0x1389, 0x1078: 0x1391, 0x1079: 0x1399, 0x107a: 0x13a1, 0x107b: 0x13a9,
+	0x107c: 0x13b1, 0x107d: 0x13b9, 0x107e: 0x13c1, 0x107f: 0x4425,
 	// Block 0x42, offset 0x1080
-	0x1080: 0x6249, 0x1081: 0x6261, 0x1082: 0x40a5, 0x1083: 0x6279, 0x1084: 0x6291, 0x1085: 0x62a9,
-	0x1086: 0x62c1, 0x1087: 0x62d9, 0x1088: 0x40c5, 0x1089: 0x62f1, 0x108a: 0x6319, 0x108b: 0x6331,
-	0x108c: 0x40e5, 0x108d: 0x40e5, 0x108e: 0x6349, 0x108f: 0x6361, 0x1090: 0x6379, 0x1091: 0x4105,
-	0x1092: 0x4125, 0x1093: 0x4145, 0x1094: 0x4165, 0x1095: 0x4185, 0x1096: 0x6391, 0x1097: 0x63a9,
-	0x1098: 0x63c1, 0x1099: 0x63d9, 0x109a: 0x63f1, 0x109b: 0x41a5, 0x109c: 0x6409, 0x109d: 0x6421,
-	0x109e: 0x6439, 0x109f: 0x41c5, 0x10a0: 0x41e5, 0x10a1: 0x6451, 0x10a2: 0x4205, 0x10a3: 0x4225,
-	0x10a4: 0x4245, 0x10a5: 0x6469, 0x10a6: 0x4265, 0x10a7: 0x6481, 0x10a8: 0x64b1, 0x10a9: 0x6249,
-	0x10aa: 0x4285, 0x10ab: 0x42a5, 0x10ac: 0x42c5, 0x10ad: 0x42e5, 0x10ae: 0x64e9, 0x10af: 0x6529,
-	0x10b0: 0x6571, 0x10b1: 0x6589, 0x10b2: 0x4305, 0x10b3: 0x65a1, 0x10b4: 0x65b9, 0x10b5: 0x65d1,
-	0x10b6: 0x4325, 0x10b7: 0x65e9, 0x10b8: 0x6601, 0x10b9: 0x65e9, 0x10ba: 0x6619, 0x10bb: 0x6631,
-	0x10bc: 0x4345, 0x10bd: 0x6649, 0x10be: 0x6661, 0x10bf: 0x6649,
+	0x1080: 0xe00d, 0x1081: 0x0008, 0x1082: 0xe00d, 0x1083: 0x0008, 0x1084: 0xe00d, 0x1085: 0x0008,
+	0x1086: 0xe00d, 0x1087: 0x0008, 0x1088: 0xe00d, 0x1089: 0x0008, 0x108a: 0xe00d, 0x108b: 0x0008,
+	0x108c: 0xe00d, 0x108d: 0x0008, 0x108e: 0xe00d, 0x108f: 0x0008, 0x1090: 0xe00d, 0x1091: 0x0008,
+	0x1092: 0xe00d, 0x1093: 0x0008, 0x1094: 0xe00d, 0x1095: 0x0008, 0x1096: 0xe00d, 0x1097: 0x0008,
+	0x1098: 0xe00d, 0x1099: 0x0008, 0x109a: 0xe00d, 0x109b: 0x0008, 0x109c: 0xe00d, 0x109d: 0x0008,
+	0x109e: 0xe00d, 0x109f: 0x0008, 0x10a0: 0xe00d, 0x10a1: 0x0008, 0x10a2: 0xe00d, 0x10a3: 0x0008,
+	0x10a4: 0xe00d, 0x10a5: 0x0008, 0x10a6: 0xe00d, 0x10a7: 0x0008, 0x10a8: 0xe00d, 0x10a9: 0x0008,
+	0x10aa: 0xe00d, 0x10ab: 0x0008, 0x10ac: 0xe00d, 0x10ad: 0x0008, 0x10ae: 0x0008, 0x10af: 0x3308,
+	0x10b0: 0x3318, 0x10b1: 0x3318, 0x10b2: 0x3318, 0x10b3: 0x0018, 0x10b4: 0x3308, 0x10b5: 0x3308,
+	0x10b6: 0x3308, 0x10b7: 0x3308, 0x10b8: 0x3308, 0x10b9: 0x3308, 0x10ba: 0x3308, 0x10bb: 0x3308,
+	0x10bc: 0x3308, 0x10bd: 0x3308, 0x10be: 0x0018, 0x10bf: 0x0008,
 	// Block 0x43, offset 0x10c0
-	0x10c0: 0x4365, 0x10c1: 0x4385, 0x10c2: 0x0040, 0x10c3: 0x6679, 0x10c4: 0x6691, 0x10c5: 0x66a9,
-	0x10c6: 0x66c1, 0x10c7: 0x0040, 0x10c8: 0x66f9, 0x10c9: 0x6711, 0x10ca: 0x6729, 0x10cb: 0x6741,
-	0x10cc: 0x6759, 0x10cd: 0x6771, 0x10ce: 0x6439, 0x10cf: 0x6789, 0x10d0: 0x67a1, 0x10d1: 0x67b9,
-	0x10d2: 0x43a5, 0x10d3: 0x67d1, 0x10d4: 0x62c1, 0x10d5: 0x43c5, 0x10d6: 0x43e5, 0x10d7: 0x67e9,
-	0x10d8: 0x0040, 0x10d9: 0x4405, 0x10da: 0x6801, 0x10db: 0x6819, 0x10dc: 0x6831, 0x10dd: 0x6849,
-	0x10de: 0x6861, 0x10df: 0x6891, 0x10e0: 0x68c1, 0x10e1: 0x68e9, 0x10e2: 0x6911, 0x10e3: 0x6939,
-	0x10e4: 0x6961, 0x10e5: 0x6989, 0x10e6: 0x69b1, 0x10e7: 0x69d9, 0x10e8: 0x6a01, 0x10e9: 0x6a29,
-	0x10ea: 0x6a59, 0x10eb: 0x6a89, 0x10ec: 0x6ab9, 0x10ed: 0x6ae9, 0x10ee: 0x6b19, 0x10ef: 0x6b49,
-	0x10f0: 0x6b79, 0x10f1: 0x6ba9, 0x10f2: 0x6bd9, 0x10f3: 0x6c09, 0x10f4: 0x6c39, 0x10f5: 0x6c69,
-	0x10f6: 0x6c99, 0x10f7: 0x6cc9, 0x10f8: 0x6cf9, 0x10f9: 0x6d29, 0x10fa: 0x6d59, 0x10fb: 0x6d89,
-	0x10fc: 0x6db9, 0x10fd: 0x6de9, 0x10fe: 0x6e19, 0x10ff: 0x4425,
+	0x10c0: 0xe00d, 0x10c1: 0x0008, 0x10c2: 0xe00d, 0x10c3: 0x0008, 0x10c4: 0xe00d, 0x10c5: 0x0008,
+	0x10c6: 0xe00d, 0x10c7: 0x0008, 0x10c8: 0xe00d, 0x10c9: 0x0008, 0x10ca: 0xe00d, 0x10cb: 0x0008,
+	0x10cc: 0xe00d, 0x10cd: 0x0008, 0x10ce: 0xe00d, 0x10cf: 0x0008, 0x10d0: 0xe00d, 0x10d1: 0x0008,
+	0x10d2: 0xe00d, 0x10d3: 0x0008, 0x10d4: 0xe00d, 0x10d5: 0x0008, 0x10d6: 0xe00d, 0x10d7: 0x0008,
+	0x10d8: 0xe00d, 0x10d9: 0x0008, 0x10da: 0xe00d, 0x10db: 0x0008, 0x10dc: 0x02d1, 0x10dd: 0x13c9,
+	0x10de: 0x3308, 0x10df: 0x3308, 0x10e0: 0x0008, 0x10e1: 0x0008, 0x10e2: 0x0008, 0x10e3: 0x0008,
+	0x10e4: 0x0008, 0x10e5: 0x0008, 0x10e6: 0x0008, 0x10e7: 0x0008, 0x10e8: 0x0008, 0x10e9: 0x0008,
+	0x10ea: 0x0008, 0x10eb: 0x0008, 0x10ec: 0x0008, 0x10ed: 0x0008, 0x10ee: 0x0008, 0x10ef: 0x0008,
+	0x10f0: 0x0008, 0x10f1: 0x0008, 0x10f2: 0x0008, 0x10f3: 0x0008, 0x10f4: 0x0008, 0x10f5: 0x0008,
+	0x10f6: 0x0008, 0x10f7: 0x0008, 0x10f8: 0x0008, 0x10f9: 0x0008, 0x10fa: 0x0008, 0x10fb: 0x0008,
+	0x10fc: 0x0008, 0x10fd: 0x0008, 0x10fe: 0x0008, 0x10ff: 0x0008,
 	// Block 0x44, offset 0x1100
-	0x1100: 0xe00d, 0x1101: 0x0008, 0x1102: 0xe00d, 0x1103: 0x0008, 0x1104: 0xe00d, 0x1105: 0x0008,
-	0x1106: 0xe00d, 0x1107: 0x0008, 0x1108: 0xe00d, 0x1109: 0x0008, 0x110a: 0xe00d, 0x110b: 0x0008,
-	0x110c: 0xe00d, 0x110d: 0x0008, 0x110e: 0xe00d, 0x110f: 0x0008, 0x1110: 0xe00d, 0x1111: 0x0008,
-	0x1112: 0xe00d, 0x1113: 0x0008, 0x1114: 0xe00d, 0x1115: 0x0008, 0x1116: 0xe00d, 0x1117: 0x0008,
-	0x1118: 0xe00d, 0x1119: 0x0008, 0x111a: 0xe00d, 0x111b: 0x0008, 0x111c: 0xe00d, 0x111d: 0x0008,
-	0x111e: 0xe00d, 0x111f: 0x0008, 0x1120: 0xe00d, 0x1121: 0x0008, 0x1122: 0xe00d, 0x1123: 0x0008,
+	0x1100: 0x0018, 0x1101: 0x0018, 0x1102: 0x0018, 0x1103: 0x0018, 0x1104: 0x0018, 0x1105: 0x0018,
+	0x1106: 0x0018, 0x1107: 0x0018, 0x1108: 0x0018, 0x1109: 0x0018, 0x110a: 0x0018, 0x110b: 0x0018,
+	0x110c: 0x0018, 0x110d: 0x0018, 0x110e: 0x0018, 0x110f: 0x0018, 0x1110: 0x0018, 0x1111: 0x0018,
+	0x1112: 0x0018, 0x1113: 0x0018, 0x1114: 0x0018, 0x1115: 0x0018, 0x1116: 0x0018, 0x1117: 0x0008,
+	0x1118: 0x0008, 0x1119: 0x0008, 0x111a: 0x0008, 0x111b: 0x0008, 0x111c: 0x0008, 0x111d: 0x0008,
+	0x111e: 0x0008, 0x111f: 0x0008, 0x1120: 0x0018, 0x1121: 0x0018, 0x1122: 0xe00d, 0x1123: 0x0008,
 	0x1124: 0xe00d, 0x1125: 0x0008, 0x1126: 0xe00d, 0x1127: 0x0008, 0x1128: 0xe00d, 0x1129: 0x0008,
-	0x112a: 0xe00d, 0x112b: 0x0008, 0x112c: 0xe00d, 0x112d: 0x0008, 0x112e: 0x0008, 0x112f: 0x3308,
-	0x1130: 0x3318, 0x1131: 0x3318, 0x1132: 0x3318, 0x1133: 0x0018, 0x1134: 0x3308, 0x1135: 0x3308,
-	0x1136: 0x3308, 0x1137: 0x3308, 0x1138: 0x3308, 0x1139: 0x3308, 0x113a: 0x3308, 0x113b: 0x3308,
-	0x113c: 0x3308, 0x113d: 0x3308, 0x113e: 0x0018, 0x113f: 0x0008,
+	0x112a: 0xe00d, 0x112b: 0x0008, 0x112c: 0xe00d, 0x112d: 0x0008, 0x112e: 0xe00d, 0x112f: 0x0008,
+	0x1130: 0x0008, 0x1131: 0x0008, 0x1132: 0xe00d, 0x1133: 0x0008, 0x1134: 0xe00d, 0x1135: 0x0008,
+	0x1136: 0xe00d, 0x1137: 0x0008, 0x1138: 0xe00d, 0x1139: 0x0008, 0x113a: 0xe00d, 0x113b: 0x0008,
+	0x113c: 0xe00d, 0x113d: 0x0008, 0x113e: 0xe00d, 0x113f: 0x0008,
 	// Block 0x45, offset 0x1140
 	0x1140: 0xe00d, 0x1141: 0x0008, 0x1142: 0xe00d, 0x1143: 0x0008, 0x1144: 0xe00d, 0x1145: 0x0008,
 	0x1146: 0xe00d, 0x1147: 0x0008, 0x1148: 0xe00d, 0x1149: 0x0008, 0x114a: 0xe00d, 0x114b: 0x0008,
 	0x114c: 0xe00d, 0x114d: 0x0008, 0x114e: 0xe00d, 0x114f: 0x0008, 0x1150: 0xe00d, 0x1151: 0x0008,
 	0x1152: 0xe00d, 0x1153: 0x0008, 0x1154: 0xe00d, 0x1155: 0x0008, 0x1156: 0xe00d, 0x1157: 0x0008,
-	0x1158: 0xe00d, 0x1159: 0x0008, 0x115a: 0xe00d, 0x115b: 0x0008, 0x115c: 0x0ea1, 0x115d: 0x6e49,
-	0x115e: 0x3308, 0x115f: 0x3308, 0x1160: 0x0008, 0x1161: 0x0008, 0x1162: 0x0008, 0x1163: 0x0008,
-	0x1164: 0x0008, 0x1165: 0x0008, 0x1166: 0x0008, 0x1167: 0x0008, 0x1168: 0x0008, 0x1169: 0x0008,
-	0x116a: 0x0008, 0x116b: 0x0008, 0x116c: 0x0008, 0x116d: 0x0008, 0x116e: 0x0008, 0x116f: 0x0008,
-	0x1170: 0x0008, 0x1171: 0x0008, 0x1172: 0x0008, 0x1173: 0x0008, 0x1174: 0x0008, 0x1175: 0x0008,
-	0x1176: 0x0008, 0x1177: 0x0008, 0x1178: 0x0008, 0x1179: 0x0008, 0x117a: 0x0008, 0x117b: 0x0008,
-	0x117c: 0x0008, 0x117d: 0x0008, 0x117e: 0x0008, 0x117f: 0x0008,
+	0x1158: 0xe00d, 0x1159: 0x0008, 0x115a: 0xe00d, 0x115b: 0x0008, 0x115c: 0xe00d, 0x115d: 0x0008,
+	0x115e: 0xe00d, 0x115f: 0x0008, 0x1160: 0xe00d, 0x1161: 0x0008, 0x1162: 0xe00d, 0x1163: 0x0008,
+	0x1164: 0xe00d, 0x1165: 0x0008, 0x1166: 0xe00d, 0x1167: 0x0008, 0x1168: 0xe00d, 0x1169: 0x0008,
+	0x116a: 0xe00d, 0x116b: 0x0008, 0x116c: 0xe00d, 0x116d: 0x0008, 0x116e: 0xe00d, 0x116f: 0x0008,
+	0x1170: 0xe0fd, 0x1171: 0x0008, 0x1172: 0x0008, 0x1173: 0x0008, 0x1174: 0x0008, 0x1175: 0x0008,
+	0x1176: 0x0008, 0x1177: 0x0008, 0x1178: 0x0008, 0x1179: 0xe01d, 0x117a: 0x0008, 0x117b: 0xe03d,
+	0x117c: 0x0008, 0x117d: 0x4445, 0x117e: 0xe00d, 0x117f: 0x0008,
 	// Block 0x46, offset 0x1180
-	0x1180: 0x0018, 0x1181: 0x0018, 0x1182: 0x0018, 0x1183: 0x0018, 0x1184: 0x0018, 0x1185: 0x0018,
-	0x1186: 0x0018, 0x1187: 0x0018, 0x1188: 0x0018, 0x1189: 0x0018, 0x118a: 0x0018, 0x118b: 0x0018,
-	0x118c: 0x0018, 0x118d: 0x0018, 0x118e: 0x0018, 0x118f: 0x0018, 0x1190: 0x0018, 0x1191: 0x0018,
-	0x1192: 0x0018, 0x1193: 0x0018, 0x1194: 0x0018, 0x1195: 0x0018, 0x1196: 0x0018, 0x1197: 0x0008,
-	0x1198: 0x0008, 0x1199: 0x0008, 0x119a: 0x0008, 0x119b: 0x0008, 0x119c: 0x0008, 0x119d: 0x0008,
-	0x119e: 0x0008, 0x119f: 0x0008, 0x11a0: 0x0018, 0x11a1: 0x0018, 0x11a2: 0xe00d, 0x11a3: 0x0008,
+	0x1180: 0xe00d, 0x1181: 0x0008, 0x1182: 0xe00d, 0x1183: 0x0008, 0x1184: 0xe00d, 0x1185: 0x0008,
+	0x1186: 0xe00d, 0x1187: 0x0008, 0x1188: 0x0008, 0x1189: 0x0018, 0x118a: 0x0018, 0x118b: 0xe03d,
+	0x118c: 0x0008, 0x118d: 0x0409, 0x118e: 0x0008, 0x118f: 0x0008, 0x1190: 0xe00d, 0x1191: 0x0008,
+	0x1192: 0xe00d, 0x1193: 0x0008, 0x1194: 0x0008, 0x1195: 0x0008, 0x1196: 0xe00d, 0x1197: 0x0008,
+	0x1198: 0xe00d, 0x1199: 0x0008, 0x119a: 0xe00d, 0x119b: 0x0008, 0x119c: 0xe00d, 0x119d: 0x0008,
+	0x119e: 0xe00d, 0x119f: 0x0008, 0x11a0: 0xe00d, 0x11a1: 0x0008, 0x11a2: 0xe00d, 0x11a3: 0x0008,
 	0x11a4: 0xe00d, 0x11a5: 0x0008, 0x11a6: 0xe00d, 0x11a7: 0x0008, 0x11a8: 0xe00d, 0x11a9: 0x0008,
-	0x11aa: 0xe00d, 0x11ab: 0x0008, 0x11ac: 0xe00d, 0x11ad: 0x0008, 0x11ae: 0xe00d, 0x11af: 0x0008,
-	0x11b0: 0x0008, 0x11b1: 0x0008, 0x11b2: 0xe00d, 0x11b3: 0x0008, 0x11b4: 0xe00d, 0x11b5: 0x0008,
+	0x11aa: 0x13d1, 0x11ab: 0x0371, 0x11ac: 0x0401, 0x11ad: 0x13d9, 0x11ae: 0x0421, 0x11af: 0x0008,
+	0x11b0: 0x13e1, 0x11b1: 0x13e9, 0x11b2: 0x0429, 0x11b3: 0x4465, 0x11b4: 0xe00d, 0x11b5: 0x0008,
 	0x11b6: 0xe00d, 0x11b7: 0x0008, 0x11b8: 0xe00d, 0x11b9: 0x0008, 0x11ba: 0xe00d, 0x11bb: 0x0008,
 	0x11bc: 0xe00d, 0x11bd: 0x0008, 0x11be: 0xe00d, 0x11bf: 0x0008,
 	// Block 0x47, offset 0x11c0
-	0x11c0: 0xe00d, 0x11c1: 0x0008, 0x11c2: 0xe00d, 0x11c3: 0x0008, 0x11c4: 0xe00d, 0x11c5: 0x0008,
-	0x11c6: 0xe00d, 0x11c7: 0x0008, 0x11c8: 0xe00d, 0x11c9: 0x0008, 0x11ca: 0xe00d, 0x11cb: 0x0008,
-	0x11cc: 0xe00d, 0x11cd: 0x0008, 0x11ce: 0xe00d, 0x11cf: 0x0008, 0x11d0: 0xe00d, 0x11d1: 0x0008,
-	0x11d2: 0xe00d, 0x11d3: 0x0008, 0x11d4: 0xe00d, 0x11d5: 0x0008, 0x11d6: 0xe00d, 0x11d7: 0x0008,
-	0x11d8: 0xe00d, 0x11d9: 0x0008, 0x11da: 0xe00d, 0x11db: 0x0008, 0x11dc: 0xe00d, 0x11dd: 0x0008,
-	0x11de: 0xe00d, 0x11df: 0x0008, 0x11e0: 0xe00d, 0x11e1: 0x0008, 0x11e2: 0xe00d, 0x11e3: 0x0008,
-	0x11e4: 0xe00d, 0x11e5: 0x0008, 0x11e6: 0xe00d, 0x11e7: 0x0008, 0x11e8: 0xe00d, 0x11e9: 0x0008,
-	0x11ea: 0xe00d, 0x11eb: 0x0008, 0x11ec: 0xe00d, 0x11ed: 0x0008, 0x11ee: 0xe00d, 0x11ef: 0x0008,
-	0x11f0: 0xe0fd, 0x11f1: 0x0008, 0x11f2: 0x0008, 0x11f3: 0x0008, 0x11f4: 0x0008, 0x11f5: 0x0008,
-	0x11f6: 0x0008, 0x11f7: 0x0008, 0x11f8: 0x0008, 0x11f9: 0xe01d, 0x11fa: 0x0008, 0x11fb: 0xe03d,
-	0x11fc: 0x0008, 0x11fd: 0x4445, 0x11fe: 0xe00d, 0x11ff: 0x0008,
+	0x11c0: 0x650d, 0x11c1: 0x652d, 0x11c2: 0x654d, 0x11c3: 0x656d, 0x11c4: 0x658d, 0x11c5: 0x65ad,
+	0x11c6: 0x65cd, 0x11c7: 0x65ed, 0x11c8: 0x660d, 0x11c9: 0x662d, 0x11ca: 0x664d, 0x11cb: 0x666d,
+	0x11cc: 0x668d, 0x11cd: 0x66ad, 0x11ce: 0x0008, 0x11cf: 0x0008, 0x11d0: 0x66cd, 0x11d1: 0x0008,
+	0x11d2: 0x66ed, 0x11d3: 0x0008, 0x11d4: 0x0008, 0x11d5: 0x670d, 0x11d6: 0x672d, 0x11d7: 0x674d,
+	0x11d8: 0x676d, 0x11d9: 0x678d, 0x11da: 0x67ad, 0x11db: 0x67cd, 0x11dc: 0x67ed, 0x11dd: 0x680d,
+	0x11de: 0x682d, 0x11df: 0x0008, 0x11e0: 0x684d, 0x11e1: 0x0008, 0x11e2: 0x686d, 0x11e3: 0x0008,
+	0x11e4: 0x0008, 0x11e5: 0x688d, 0x11e6: 0x68ad, 0x11e7: 0x0008, 0x11e8: 0x0008, 0x11e9: 0x0008,
+	0x11ea: 0x68cd, 0x11eb: 0x68ed, 0x11ec: 0x690d, 0x11ed: 0x692d, 0x11ee: 0x694d, 0x11ef: 0x696d,
+	0x11f0: 0x698d, 0x11f1: 0x69ad, 0x11f2: 0x69cd, 0x11f3: 0x69ed, 0x11f4: 0x6a0d, 0x11f5: 0x6a2d,
+	0x11f6: 0x6a4d, 0x11f7: 0x6a6d, 0x11f8: 0x6a8d, 0x11f9: 0x6aad, 0x11fa: 0x6acd, 0x11fb: 0x6aed,
+	0x11fc: 0x6b0d, 0x11fd: 0x6b2d, 0x11fe: 0x6b4d, 0x11ff: 0x6b6d,
 	// Block 0x48, offset 0x1200
-	0x1200: 0xe00d, 0x1201: 0x0008, 0x1202: 0xe00d, 0x1203: 0x0008, 0x1204: 0xe00d, 0x1205: 0x0008,
-	0x1206: 0xe00d, 0x1207: 0x0008, 0x1208: 0x0008, 0x1209: 0x0018, 0x120a: 0x0018, 0x120b: 0xe03d,
-	0x120c: 0x0008, 0x120d: 0x11d9, 0x120e: 0x0008, 0x120f: 0x0008, 0x1210: 0xe00d, 0x1211: 0x0008,
-	0x1212: 0xe00d, 0x1213: 0x0008, 0x1214: 0x0008, 0x1215: 0x0008, 0x1216: 0xe00d, 0x1217: 0x0008,
-	0x1218: 0xe00d, 0x1219: 0x0008, 0x121a: 0xe00d, 0x121b: 0x0008, 0x121c: 0xe00d, 0x121d: 0x0008,
-	0x121e: 0xe00d, 0x121f: 0x0008, 0x1220: 0xe00d, 0x1221: 0x0008, 0x1222: 0xe00d, 0x1223: 0x0008,
-	0x1224: 0xe00d, 0x1225: 0x0008, 0x1226: 0xe00d, 0x1227: 0x0008, 0x1228: 0xe00d, 0x1229: 0x0008,
-	0x122a: 0x6e61, 0x122b: 0x1029, 0x122c: 0x11c1, 0x122d: 0x6e79, 0x122e: 0x1221, 0x122f: 0x0008,
-	0x1230: 0x6e91, 0x1231: 0x6ea9, 0x1232: 0x1239, 0x1233: 0x4465, 0x1234: 0xe00d, 0x1235: 0x0008,
-	0x1236: 0xe00d, 0x1237: 0x0008, 0x1238: 0xe00d, 0x1239: 0x0008, 0x123a: 0xe00d, 0x123b: 0x0008,
-	0x123c: 0xe00d, 0x123d: 0x0008, 0x123e: 0xe00d, 0x123f: 0x0008,
+	0x1200: 0x7acd, 0x1201: 0x7aed, 0x1202: 0x7b0d, 0x1203: 0x7b2d, 0x1204: 0x7b4d, 0x1205: 0x7b6d,
+	0x1206: 0x7b8d, 0x1207: 0x7bad, 0x1208: 0x7bcd, 0x1209: 0x7bed, 0x120a: 0x7c0d, 0x120b: 0x7c2d,
+	0x120c: 0x7c4d, 0x120d: 0x7c6d, 0x120e: 0x7c8d, 0x120f: 0x1409, 0x1210: 0x1411, 0x1211: 0x1419,
+	0x1212: 0x7cad, 0x1213: 0x7ccd, 0x1214: 0x7ced, 0x1215: 0x1421, 0x1216: 0x1429, 0x1217: 0x1431,
+	0x1218: 0x7d0d, 0x1219: 0x7d2d, 0x121a: 0x0040, 0x121b: 0x0040, 0x121c: 0x0040, 0x121d: 0x0040,
+	0x121e: 0x0040, 0x121f: 0x0040, 0x1220: 0x0040, 0x1221: 0x0040, 0x1222: 0x0040, 0x1223: 0x0040,
+	0x1224: 0x0040, 0x1225: 0x0040, 0x1226: 0x0040, 0x1227: 0x0040, 0x1228: 0x0040, 0x1229: 0x0040,
+	0x122a: 0x0040, 0x122b: 0x0040, 0x122c: 0x0040, 0x122d: 0x0040, 0x122e: 0x0040, 0x122f: 0x0040,
+	0x1230: 0x0040, 0x1231: 0x0040, 0x1232: 0x0040, 0x1233: 0x0040, 0x1234: 0x0040, 0x1235: 0x0040,
+	0x1236: 0x0040, 0x1237: 0x0040, 0x1238: 0x0040, 0x1239: 0x0040, 0x123a: 0x0040, 0x123b: 0x0040,
+	0x123c: 0x0040, 0x123d: 0x0040, 0x123e: 0x0040, 0x123f: 0x0040,
 	// Block 0x49, offset 0x1240
-	0x1240: 0x650d, 0x1241: 0x652d, 0x1242: 0x654d, 0x1243: 0x656d, 0x1244: 0x658d, 0x1245: 0x65ad,
-	0x1246: 0x65cd, 0x1247: 0x65ed, 0x1248: 0x660d, 0x1249: 0x662d, 0x124a: 0x664d, 0x124b: 0x666d,
-	0x124c: 0x668d, 0x124d: 0x66ad, 0x124e: 0x0008, 0x124f: 0x0008, 0x1250: 0x66cd, 0x1251: 0x0008,
-	0x1252: 0x66ed, 0x1253: 0x0008, 0x1254: 0x0008, 0x1255: 0x670d, 0x1256: 0x672d, 0x1257: 0x674d,
-	0x1258: 0x676d, 0x1259: 0x678d, 0x125a: 0x67ad, 0x125b: 0x67cd, 0x125c: 0x67ed, 0x125d: 0x680d,
-	0x125e: 0x682d, 0x125f: 0x0008, 0x1260: 0x684d, 0x1261: 0x0008, 0x1262: 0x686d, 0x1263: 0x0008,
-	0x1264: 0x0008, 0x1265: 0x688d, 0x1266: 0x68ad, 0x1267: 0x0008, 0x1268: 0x0008, 0x1269: 0x0008,
-	0x126a: 0x68cd, 0x126b: 0x68ed, 0x126c: 0x690d, 0x126d: 0x692d, 0x126e: 0x694d, 0x126f: 0x696d,
-	0x1270: 0x698d, 0x1271: 0x69ad, 0x1272: 0x69cd, 0x1273: 0x69ed, 0x1274: 0x6a0d, 0x1275: 0x6a2d,
-	0x1276: 0x6a4d, 0x1277: 0x6a6d, 0x1278: 0x6a8d, 0x1279: 0x6aad, 0x127a: 0x6acd, 0x127b: 0x6aed,
-	0x127c: 0x6b0d, 0x127d: 0x6b2d, 0x127e: 0x6b4d, 0x127f: 0x6b6d,
+	0x1240: 0x1439, 0x1241: 0x1441, 0x1242: 0x1449, 0x1243: 0x7d4d, 0x1244: 0x7d6d, 0x1245: 0x1451,
+	0x1246: 0x1451, 0x1247: 0x0040, 0x1248: 0x0040, 0x1249: 0x0040, 0x124a: 0x0040, 0x124b: 0x0040,
+	0x124c: 0x0040, 0x124d: 0x0040, 0x124e: 0x0040, 0x124f: 0x0040, 0x1250: 0x0040, 0x1251: 0x0040,
+	0x1252: 0x0040, 0x1253: 0x1459, 0x1254: 0x1461, 0x1255: 0x1469, 0x1256: 0x1471, 0x1257: 0x1479,
+	0x1258: 0x0040, 0x1259: 0x0040, 0x125a: 0x0040, 0x125b: 0x0040, 0x125c: 0x0040, 0x125d: 0x1481,
+	0x125e: 0x3308, 0x125f: 0x1489, 0x1260: 0x1491, 0x1261: 0x0779, 0x1262: 0x0791, 0x1263: 0x1499,
+	0x1264: 0x14a1, 0x1265: 0x14a9, 0x1266: 0x14b1, 0x1267: 0x14b9, 0x1268: 0x14c1, 0x1269: 0x071a,
+	0x126a: 0x14c9, 0x126b: 0x14d1, 0x126c: 0x14d9, 0x126d: 0x14e1, 0x126e: 0x14e9, 0x126f: 0x14f1,
+	0x1270: 0x14f9, 0x1271: 0x1501, 0x1272: 0x1509, 0x1273: 0x1511, 0x1274: 0x1519, 0x1275: 0x1521,
+	0x1276: 0x1529, 0x1277: 0x0040, 0x1278: 0x1531, 0x1279: 0x1539, 0x127a: 0x1541, 0x127b: 0x1549,
+	0x127c: 0x1551, 0x127d: 0x0040, 0x127e: 0x1559, 0x127f: 0x0040,
 	// Block 0x4a, offset 0x1280
-	0x1280: 0x7acd, 0x1281: 0x7aed, 0x1282: 0x7b0d, 0x1283: 0x7b2d, 0x1284: 0x7b4d, 0x1285: 0x7b6d,
-	0x1286: 0x7b8d, 0x1287: 0x7bad, 0x1288: 0x7bcd, 0x1289: 0x7bed, 0x128a: 0x7c0d, 0x128b: 0x7c2d,
-	0x128c: 0x7c4d, 0x128d: 0x7c6d, 0x128e: 0x7c8d, 0x128f: 0x6f19, 0x1290: 0x6f41, 0x1291: 0x6f69,
-	0x1292: 0x7cad, 0x1293: 0x7ccd, 0x1294: 0x7ced, 0x1295: 0x6f91, 0x1296: 0x6fb9, 0x1297: 0x6fe1,
-	0x1298: 0x7d0d, 0x1299: 0x7d2d, 0x129a: 0x0040, 0x129b: 0x0040, 0x129c: 0x0040, 0x129d: 0x0040,
-	0x129e: 0x0040, 0x129f: 0x0040, 0x12a0: 0x0040, 0x12a1: 0x0040, 0x12a2: 0x0040, 0x12a3: 0x0040,
-	0x12a4: 0x0040, 0x12a5: 0x0040, 0x12a6: 0x0040, 0x12a7: 0x0040, 0x12a8: 0x0040, 0x12a9: 0x0040,
-	0x12aa: 0x0040, 0x12ab: 0x0040, 0x12ac: 0x0040, 0x12ad: 0x0040, 0x12ae: 0x0040, 0x12af: 0x0040,
-	0x12b0: 0x0040, 0x12b1: 0x0040, 0x12b2: 0x0040, 0x12b3: 0x0040, 0x12b4: 0x0040, 0x12b5: 0x0040,
-	0x12b6: 0x0040, 0x12b7: 0x0040, 0x12b8: 0x0040, 0x12b9: 0x0040, 0x12ba: 0x0040, 0x12bb: 0x0040,
-	0x12bc: 0x0040, 0x12bd: 0x0040, 0x12be: 0x0040, 0x12bf: 0x0040,
+	0x1280: 0x1561, 0x1281: 0x1569, 0x1282: 0x0040, 0x1283: 0x1571, 0x1284: 0x1579, 0x1285: 0x0040,
+	0x1286: 0x1581, 0x1287: 0x1589, 0x1288: 0x1591, 0x1289: 0x1599, 0x128a: 0x15a1, 0x128b: 0x15a9,
+	0x128c: 0x15b1, 0x128d: 0x15b9, 0x128e: 0x15c1, 0x128f: 0x15c9, 0x1290: 0x15d1, 0x1291: 0x15d1,
+	0x1292: 0x15d9, 0x1293: 0x15d9, 0x1294: 0x15d9, 0x1295: 0x15d9, 0x1296: 0x15e1, 0x1297: 0x15e1,
+	0x1298: 0x15e1, 0x1299: 0x15e1, 0x129a: 0x15e9, 0x129b: 0x15e9, 0x129c: 0x15e9, 0x129d: 0x15e9,
+	0x129e: 0x15f1, 0x129f: 0x15f1, 0x12a0: 0x15f1, 0x12a1: 0x15f1, 0x12a2: 0x15f9, 0x12a3: 0x15f9,
+	0x12a4: 0x15f9, 0x12a5: 0x15f9, 0x12a6: 0x1601, 0x12a7: 0x1601, 0x12a8: 0x1601, 0x12a9: 0x1601,
+	0x12aa: 0x1609, 0x12ab: 0x1609, 0x12ac: 0x1609, 0x12ad: 0x1609, 0x12ae: 0x1611, 0x12af: 0x1611,
+	0x12b0: 0x1611, 0x12b1: 0x1611, 0x12b2: 0x1619, 0x12b3: 0x1619, 0x12b4: 0x1619, 0x12b5: 0x1619,
+	0x12b6: 0x1621, 0x12b7: 0x1621, 0x12b8: 0x1621, 0x12b9: 0x1621, 0x12ba: 0x1629, 0x12bb: 0x1629,
+	0x12bc: 0x1629, 0x12bd: 0x1629, 0x12be: 0x1631, 0x12bf: 0x1631,
 	// Block 0x4b, offset 0x12c0
-	0x12c0: 0x7009, 0x12c1: 0x7021, 0x12c2: 0x7039, 0x12c3: 0x7d4d, 0x12c4: 0x7d6d, 0x12c5: 0x7051,
-	0x12c6: 0x7051, 0x12c7: 0x0040, 0x12c8: 0x0040, 0x12c9: 0x0040, 0x12ca: 0x0040, 0x12cb: 0x0040,
-	0x12cc: 0x0040, 0x12cd: 0x0040, 0x12ce: 0x0040, 0x12cf: 0x0040, 0x12d0: 0x0040, 0x12d1: 0x0040,
-	0x12d2: 0x0040, 0x12d3: 0x7069, 0x12d4: 0x7091, 0x12d5: 0x70b9, 0x12d6: 0x70e1, 0x12d7: 0x7109,
-	0x12d8: 0x0040, 0x12d9: 0x0040, 0x12da: 0x0040, 0x12db: 0x0040, 0x12dc: 0x0040, 0x12dd: 0x7131,
-	0x12de: 0x3308, 0x12df: 0x7159, 0x12e0: 0x7181, 0x12e1: 0x20a9, 0x12e2: 0x20f1, 0x12e3: 0x7199,
-	0x12e4: 0x71b1, 0x12e5: 0x71c9, 0x12e6: 0x71e1, 0x12e7: 0x71f9, 0x12e8: 0x7211, 0x12e9: 0x1fb2,
-	0x12ea: 0x7229, 0x12eb: 0x7251, 0x12ec: 0x7279, 0x12ed: 0x72b1, 0x12ee: 0x72e9, 0x12ef: 0x7311,
-	0x12f0: 0x7339, 0x12f1: 0x7361, 0x12f2: 0x7389, 0x12f3: 0x73b1, 0x12f4: 0x73d9, 0x12f5: 0x7401,
-	0x12f6: 0x7429, 0x12f7: 0x0040, 0x12f8: 0x7451, 0x12f9: 0x7479, 0x12fa: 0x74a1, 0x12fb: 0x74c9,
-	0x12fc: 0x74f1, 0x12fd: 0x0040, 0x12fe: 0x7519, 0x12ff: 0x0040,
+	0x12c0: 0x1631, 0x12c1: 0x1631, 0x12c2: 0x1639, 0x12c3: 0x1639, 0x12c4: 0x1641, 0x12c5: 0x1641,
+	0x12c6: 0x1649, 0x12c7: 0x1649, 0x12c8: 0x1651, 0x12c9: 0x1651, 0x12ca: 0x1659, 0x12cb: 0x1659,
+	0x12cc: 0x1661, 0x12cd: 0x1661, 0x12ce: 0x1669, 0x12cf: 0x1669, 0x12d0: 0x1669, 0x12d1: 0x1669,
+	0x12d2: 0x1671, 0x12d3: 0x1671, 0x12d4: 0x1671, 0x12d5: 0x1671, 0x12d6: 0x1679, 0x12d7: 0x1679,
+	0x12d8: 0x1679, 0x12d9: 0x1679, 0x12da: 0x1681, 0x12db: 0x1681, 0x12dc: 0x1681, 0x12dd: 0x1681,
+	0x12de: 0x1689, 0x12df: 0x1689, 0x12e0: 0x1691, 0x12e1: 0x1691, 0x12e2: 0x1691, 0x12e3: 0x1691,
+	0x12e4: 0x1699, 0x12e5: 0x1699, 0x12e6: 0x16a1, 0x12e7: 0x16a1, 0x12e8: 0x16a1, 0x12e9: 0x16a1,
+	0x12ea: 0x16a9, 0x12eb: 0x16a9, 0x12ec: 0x16a9, 0x12ed: 0x16a9, 0x12ee: 0x16b1, 0x12ef: 0x16b1,
+	0x12f0: 0x16b9, 0x12f1: 0x16b9, 0x12f2: 0x0818, 0x12f3: 0x0818, 0x12f4: 0x0818, 0x12f5: 0x0818,
+	0x12f6: 0x0818, 0x12f7: 0x0818, 0x12f8: 0x0818, 0x12f9: 0x0818, 0x12fa: 0x0818, 0x12fb: 0x0818,
+	0x12fc: 0x0818, 0x12fd: 0x0818, 0x12fe: 0x0818, 0x12ff: 0x0818,
 	// Block 0x4c, offset 0x1300
-	0x1300: 0x7541, 0x1301: 0x7569, 0x1302: 0x0040, 0x1303: 0x7591, 0x1304: 0x75b9, 0x1305: 0x0040,
-	0x1306: 0x75e1, 0x1307: 0x7609, 0x1308: 0x7631, 0x1309: 0x7659, 0x130a: 0x7681, 0x130b: 0x76a9,
-	0x130c: 0x76d1, 0x130d: 0x76f9, 0x130e: 0x7721, 0x130f: 0x7749, 0x1310: 0x7771, 0x1311: 0x7771,
-	0x1312: 0x7789, 0x1313: 0x7789, 0x1314: 0x7789, 0x1315: 0x7789, 0x1316: 0x77a1, 0x1317: 0x77a1,
-	0x1318: 0x77a1, 0x1319: 0x77a1, 0x131a: 0x77b9, 0x131b: 0x77b9, 0x131c: 0x77b9, 0x131d: 0x77b9,
-	0x131e: 0x77d1, 0x131f: 0x77d1, 0x1320: 0x77d1, 0x1321: 0x77d1, 0x1322: 0x77e9, 0x1323: 0x77e9,
-	0x1324: 0x77e9, 0x1325: 0x77e9, 0x1326: 0x7801, 0x1327: 0x7801, 0x1328: 0x7801, 0x1329: 0x7801,
-	0x132a: 0x7819, 0x132b: 0x7819, 0x132c: 0x7819, 0x132d: 0x7819, 0x132e: 0x7831, 0x132f: 0x7831,
-	0x1330: 0x7831, 0x1331: 0x7831, 0x1332: 0x7849, 0x1333: 0x7849, 0x1334: 0x7849, 0x1335: 0x7849,
-	0x1336: 0x7861, 0x1337: 0x7861, 0x1338: 0x7861, 0x1339: 0x7861, 0x133a: 0x7879, 0x133b: 0x7879,
-	0x133c: 0x7879, 0x133d: 0x7879, 0x133e: 0x7891, 0x133f: 0x7891,
+	0x1300: 0x0818, 0x1301: 0x0818, 0x1302: 0x0040, 0x1303: 0x0040, 0x1304: 0x0040, 0x1305: 0x0040,
+	0x1306: 0x0040, 0x1307: 0x0040, 0x1308: 0x0040, 0x1309: 0x0040, 0x130a: 0x0040, 0x130b: 0x0040,
+	0x130c: 0x0040, 0x130d: 0x0040, 0x130e: 0x0040, 0x130f: 0x0040, 0x1310: 0x0040, 0x1311: 0x0040,
+	0x1312: 0x0040, 0x1313: 0x16c1, 0x1314: 0x16c1, 0x1315: 0x16c1, 0x1316: 0x16c1, 0x1317: 0x16c9,
+	0x1318: 0x16c9, 0x1319: 0x16d1, 0x131a: 0x16d1, 0x131b: 0x16d9, 0x131c: 0x16d9, 0x131d: 0x0149,
+	0x131e: 0x16e1, 0x131f: 0x16e1, 0x1320: 0x16e9, 0x1321: 0x16e9, 0x1322: 0x16f1, 0x1323: 0x16f1,
+	0x1324: 0x16f9, 0x1325: 0x16f9, 0x1326: 0x16f9, 0x1327: 0x16f9, 0x1328: 0x1701, 0x1329: 0x1701,
+	0x132a: 0x1709, 0x132b: 0x1709, 0x132c: 0x1711, 0x132d: 0x1711, 0x132e: 0x1719, 0x132f: 0x1719,
+	0x1330: 0x1721, 0x1331: 0x1721, 0x1332: 0x1729, 0x1333: 0x1729, 0x1334: 0x1731, 0x1335: 0x1731,
+	0x1336: 0x1739, 0x1337: 0x1739, 0x1338: 0x1739, 0x1339: 0x1741, 0x133a: 0x1741, 0x133b: 0x1741,
+	0x133c: 0x1749, 0x133d: 0x1749, 0x133e: 0x1749, 0x133f: 0x1749,
 	// Block 0x4d, offset 0x1340
-	0x1340: 0x7891, 0x1341: 0x7891, 0x1342: 0x78a9, 0x1343: 0x78a9, 0x1344: 0x78c1, 0x1345: 0x78c1,
-	0x1346: 0x78d9, 0x1347: 0x78d9, 0x1348: 0x78f1, 0x1349: 0x78f1, 0x134a: 0x7909, 0x134b: 0x7909,
-	0x134c: 0x7921, 0x134d: 0x7921, 0x134e: 0x7939, 0x134f: 0x7939, 0x1350: 0x7939, 0x1351: 0x7939,
-	0x1352: 0x7951, 0x1353: 0x7951, 0x1354: 0x7951, 0x1355: 0x7951, 0x1356: 0x7969, 0x1357: 0x7969,
-	0x1358: 0x7969, 0x1359: 0x7969, 0x135a: 0x7981, 0x135b: 0x7981, 0x135c: 0x7981, 0x135d: 0x7981,
-	0x135e: 0x7999, 0x135f: 0x7999, 0x1360: 0x79b1, 0x1361: 0x79b1, 0x1362: 0x79b1, 0x1363: 0x79b1,
-	0x1364: 0x79c9, 0x1365: 0x79c9, 0x1366: 0x79e1, 0x1367: 0x79e1, 0x1368: 0x79e1, 0x1369: 0x79e1,
-	0x136a: 0x79f9, 0x136b: 0x79f9, 0x136c: 0x79f9, 0x136d: 0x79f9, 0x136e: 0x7a11, 0x136f: 0x7a11,
-	0x1370: 0x7a29, 0x1371: 0x7a29, 0x1372: 0x0818, 0x1373: 0x0818, 0x1374: 0x0818, 0x1375: 0x0818,
-	0x1376: 0x0818, 0x1377: 0x0818, 0x1378: 0x0818, 0x1379: 0x0818, 0x137a: 0x0818, 0x137b: 0x0818,
-	0x137c: 0x0818, 0x137d: 0x0818, 0x137e: 0x0818, 0x137f: 0x0818,
+	0x1340: 0x1949, 0x1341: 0x1951, 0x1342: 0x1959, 0x1343: 0x1961, 0x1344: 0x1969, 0x1345: 0x1971,
+	0x1346: 0x1979, 0x1347: 0x1981, 0x1348: 0x1989, 0x1349: 0x1991, 0x134a: 0x1999, 0x134b: 0x19a1,
+	0x134c: 0x19a9, 0x134d: 0x19b1, 0x134e: 0x19b9, 0x134f: 0x19c1, 0x1350: 0x19c9, 0x1351: 0x19d1,
+	0x1352: 0x19d9, 0x1353: 0x19e1, 0x1354: 0x19e9, 0x1355: 0x19f1, 0x1356: 0x19f9, 0x1357: 0x1a01,
+	0x1358: 0x1a09, 0x1359: 0x1a11, 0x135a: 0x1a19, 0x135b: 0x1a21, 0x135c: 0x1a29, 0x135d: 0x1a31,
+	0x135e: 0x1a3a, 0x135f: 0x1a42, 0x1360: 0x1a4a, 0x1361: 0x1a52, 0x1362: 0x1a5a, 0x1363: 0x1a62,
+	0x1364: 0x1a69, 0x1365: 0x1a71, 0x1366: 0x1761, 0x1367: 0x1a79, 0x1368: 0x1741, 0x1369: 0x1769,
+	0x136a: 0x1a81, 0x136b: 0x1a89, 0x136c: 0x1789, 0x136d: 0x1a91, 0x136e: 0x1791, 0x136f: 0x1799,
+	0x1370: 0x1a99, 0x1371: 0x1aa1, 0x1372: 0x17b9, 0x1373: 0x1aa9, 0x1374: 0x17c1, 0x1375: 0x17c9,
+	0x1376: 0x1ab1, 0x1377: 0x1ab9, 0x1378: 0x17d9, 0x1379: 0x1ac1, 0x137a: 0x17e1, 0x137b: 0x17e9,
+	0x137c: 0x18d1, 0x137d: 0x18d9, 0x137e: 0x18f1, 0x137f: 0x18f9,
 	// Block 0x4e, offset 0x1380
-	0x1380: 0x0818, 0x1381: 0x0818, 0x1382: 0x0040, 0x1383: 0x0040, 0x1384: 0x0040, 0x1385: 0x0040,
-	0x1386: 0x0040, 0x1387: 0x0040, 0x1388: 0x0040, 0x1389: 0x0040, 0x138a: 0x0040, 0x138b: 0x0040,
-	0x138c: 0x0040, 0x138d: 0x0040, 0x138e: 0x0040, 0x138f: 0x0040, 0x1390: 0x0040, 0x1391: 0x0040,
-	0x1392: 0x0040, 0x1393: 0x7a41, 0x1394: 0x7a41, 0x1395: 0x7a41, 0x1396: 0x7a41, 0x1397: 0x7a59,
-	0x1398: 0x7a59, 0x1399: 0x7a71, 0x139a: 0x7a71, 0x139b: 0x7a89, 0x139c: 0x7a89, 0x139d: 0x0479,
-	0x139e: 0x7aa1, 0x139f: 0x7aa1, 0x13a0: 0x7ab9, 0x13a1: 0x7ab9, 0x13a2: 0x7ad1, 0x13a3: 0x7ad1,
-	0x13a4: 0x7ae9, 0x13a5: 0x7ae9, 0x13a6: 0x7ae9, 0x13a7: 0x7ae9, 0x13a8: 0x7b01, 0x13a9: 0x7b01,
-	0x13aa: 0x7b19, 0x13ab: 0x7b19, 0x13ac: 0x7b41, 0x13ad: 0x7b41, 0x13ae: 0x7b69, 0x13af: 0x7b69,
-	0x13b0: 0x7b91, 0x13b1: 0x7b91, 0x13b2: 0x7bb9, 0x13b3: 0x7bb9, 0x13b4: 0x7be1, 0x13b5: 0x7be1,
-	0x13b6: 0x7c09, 0x13b7: 0x7c09, 0x13b8: 0x7c09, 0x13b9: 0x7c31, 0x13ba: 0x7c31, 0x13bb: 0x7c31,
-	0x13bc: 0x7c59, 0x13bd: 0x7c59, 0x13be: 0x7c59, 0x13bf: 0x7c59,
+	0x1380: 0x1901, 0x1381: 0x1921, 0x1382: 0x1929, 0x1383: 0x1931, 0x1384: 0x1939, 0x1385: 0x1959,
+	0x1386: 0x1961, 0x1387: 0x1969, 0x1388: 0x1ac9, 0x1389: 0x1989, 0x138a: 0x1ad1, 0x138b: 0x1ad9,
+	0x138c: 0x19b9, 0x138d: 0x1ae1, 0x138e: 0x19c1, 0x138f: 0x19c9, 0x1390: 0x1a31, 0x1391: 0x1ae9,
+	0x1392: 0x1af1, 0x1393: 0x1a09, 0x1394: 0x1af9, 0x1395: 0x1a11, 0x1396: 0x1a19, 0x1397: 0x1751,
+	0x1398: 0x1759, 0x1399: 0x1b01, 0x139a: 0x1761, 0x139b: 0x1b09, 0x139c: 0x1771, 0x139d: 0x1779,
+	0x139e: 0x1781, 0x139f: 0x1789, 0x13a0: 0x1b11, 0x13a1: 0x17a1, 0x13a2: 0x17a9, 0x13a3: 0x17b1,
+	0x13a4: 0x17b9, 0x13a5: 0x1b19, 0x13a6: 0x17d9, 0x13a7: 0x17f1, 0x13a8: 0x17f9, 0x13a9: 0x1801,
+	0x13aa: 0x1809, 0x13ab: 0x1811, 0x13ac: 0x1821, 0x13ad: 0x1829, 0x13ae: 0x1831, 0x13af: 0x1839,
+	0x13b0: 0x1841, 0x13b1: 0x1849, 0x13b2: 0x1b21, 0x13b3: 0x1851, 0x13b4: 0x1859, 0x13b5: 0x1861,
+	0x13b6: 0x1869, 0x13b7: 0x1871, 0x13b8: 0x1879, 0x13b9: 0x1889, 0x13ba: 0x1891, 0x13bb: 0x1899,
+	0x13bc: 0x18a1, 0x13bd: 0x18a9, 0x13be: 0x18b1, 0x13bf: 0x18b9,
 	// Block 0x4f, offset 0x13c0
-	0x13c0: 0x8649, 0x13c1: 0x8671, 0x13c2: 0x8699, 0x13c3: 0x86c1, 0x13c4: 0x86e9, 0x13c5: 0x8711,
-	0x13c6: 0x8739, 0x13c7: 0x8761, 0x13c8: 0x8789, 0x13c9: 0x87b1, 0x13ca: 0x87d9, 0x13cb: 0x8801,
-	0x13cc: 0x8829, 0x13cd: 0x8851, 0x13ce: 0x8879, 0x13cf: 0x88a1, 0x13d0: 0x88c9, 0x13d1: 0x88f1,
-	0x13d2: 0x8919, 0x13d3: 0x8941, 0x13d4: 0x8969, 0x13d5: 0x8991, 0x13d6: 0x89b9, 0x13d7: 0x89e1,
-	0x13d8: 0x8a09, 0x13d9: 0x8a31, 0x13da: 0x8a59, 0x13db: 0x8a81, 0x13dc: 0x8aa9, 0x13dd: 0x8ad1,
-	0x13de: 0x8afa, 0x13df: 0x8b2a, 0x13e0: 0x8b5a, 0x13e1: 0x8b8a, 0x13e2: 0x8bba, 0x13e3: 0x8bea,
-	0x13e4: 0x8c19, 0x13e5: 0x8c41, 0x13e6: 0x7cc1, 0x13e7: 0x8c69, 0x13e8: 0x7c31, 0x13e9: 0x7ce9,
-	0x13ea: 0x8c91, 0x13eb: 0x8cb9, 0x13ec: 0x7d89, 0x13ed: 0x8ce1, 0x13ee: 0x7db1, 0x13ef: 0x7dd9,
-	0x13f0: 0x8d09, 0x13f1: 0x8d31, 0x13f2: 0x7e79, 0x13f3: 0x8d59, 0x13f4: 0x7ea1, 0x13f5: 0x7ec9,
-	0x13f6: 0x8d81, 0x13f7: 0x8da9, 0x13f8: 0x7f19, 0x13f9: 0x8dd1, 0x13fa: 0x7f41, 0x13fb: 0x7f69,
-	0x13fc: 0x83f1, 0x13fd: 0x8419, 0x13fe: 0x8491, 0x13ff: 0x84b9,
+	0x13c0: 0x18c1, 0x13c1: 0x18c9, 0x13c2: 0x18e1, 0x13c3: 0x18e9, 0x13c4: 0x1909, 0x13c5: 0x1911,
+	0x13c6: 0x1919, 0x13c7: 0x1921, 0x13c8: 0x1929, 0x13c9: 0x1941, 0x13ca: 0x1949, 0x13cb: 0x1951,
+	0x13cc: 0x1959, 0x13cd: 0x1b29, 0x13ce: 0x1971, 0x13cf: 0x1979, 0x13d0: 0x1981, 0x13d1: 0x1989,
+	0x13d2: 0x19a1, 0x13d3: 0x19a9, 0x13d4: 0x19b1, 0x13d5: 0x19b9, 0x13d6: 0x1b31, 0x13d7: 0x19d1,
+	0x13d8: 0x19d9, 0x13d9: 0x1b39, 0x13da: 0x19f1, 0x13db: 0x19f9, 0x13dc: 0x1a01, 0x13dd: 0x1a09,
+	0x13de: 0x1b41, 0x13df: 0x1761, 0x13e0: 0x1b09, 0x13e1: 0x1789, 0x13e2: 0x1b11, 0x13e3: 0x17b9,
+	0x13e4: 0x1b19, 0x13e5: 0x17d9, 0x13e6: 0x1b49, 0x13e7: 0x1841, 0x13e8: 0x1b51, 0x13e9: 0x1b59,
+	0x13ea: 0x1b61, 0x13eb: 0x1921, 0x13ec: 0x1929, 0x13ed: 0x1959, 0x13ee: 0x19b9, 0x13ef: 0x1b31,
+	0x13f0: 0x1a09, 0x13f1: 0x1b41, 0x13f2: 0x1b69, 0x13f3: 0x1b71, 0x13f4: 0x1b79, 0x13f5: 0x1b81,
+	0x13f6: 0x1b89, 0x13f7: 0x1b91, 0x13f8: 0x1b99, 0x13f9: 0x1ba1, 0x13fa: 0x1ba9, 0x13fb: 0x1bb1,
+	0x13fc: 0x1bb9, 0x13fd: 0x1bc1, 0x13fe: 0x1bc9, 0x13ff: 0x1bd1,
 	// Block 0x50, offset 0x1400
-	0x1400: 0x84e1, 0x1401: 0x8581, 0x1402: 0x85a9, 0x1403: 0x85d1, 0x1404: 0x85f9, 0x1405: 0x8699,
-	0x1406: 0x86c1, 0x1407: 0x86e9, 0x1408: 0x8df9, 0x1409: 0x8789, 0x140a: 0x8e21, 0x140b: 0x8e49,
-	0x140c: 0x8879, 0x140d: 0x8e71, 0x140e: 0x88a1, 0x140f: 0x88c9, 0x1410: 0x8ad1, 0x1411: 0x8e99,
-	0x1412: 0x8ec1, 0x1413: 0x8a09, 0x1414: 0x8ee9, 0x1415: 0x8a31, 0x1416: 0x8a59, 0x1417: 0x7c71,
-	0x1418: 0x7c99, 0x1419: 0x8f11, 0x141a: 0x7cc1, 0x141b: 0x8f39, 0x141c: 0x7d11, 0x141d: 0x7d39,
-	0x141e: 0x7d61, 0x141f: 0x7d89, 0x1420: 0x8f61, 0x1421: 0x7e01, 0x1422: 0x7e29, 0x1423: 0x7e51,
-	0x1424: 0x7e79, 0x1425: 0x8f89, 0x1426: 0x7f19, 0x1427: 0x7f91, 0x1428: 0x7fb9, 0x1429: 0x7fe1,
-	0x142a: 0x8009, 0x142b: 0x8031, 0x142c: 0x8081, 0x142d: 0x80a9, 0x142e: 0x80d1, 0x142f: 0x80f9,
-	0x1430: 0x8121, 0x1431: 0x8149, 0x1432: 0x8fb1, 0x1433: 0x8171, 0x1434: 0x8199, 0x1435: 0x81c1,
-	0x1436: 0x81e9, 0x1437: 0x8211, 0x1438: 0x8239, 0x1439: 0x8289, 0x143a: 0x82b1, 0x143b: 0x82d9,
-	0x143c: 0x8301, 0x143d: 0x8329, 0x143e: 0x8351, 0x143f: 0x8379,
+	0x1400: 0x1bd9, 0x1401: 0x1be1, 0x1402: 0x1be9, 0x1403: 0x1bf1, 0x1404: 0x1bf9, 0x1405: 0x1c01,
+	0x1406: 0x1c09, 0x1407: 0x1c11, 0x1408: 0x1c19, 0x1409: 0x1c21, 0x140a: 0x1c29, 0x140b: 0x1c31,
+	0x140c: 0x1b59, 0x140d: 0x1c39, 0x140e: 0x1c41, 0x140f: 0x1c49, 0x1410: 0x1c51, 0x1411: 0x1b81,
+	0x1412: 0x1b89, 0x1413: 0x1b91, 0x1414: 0x1b99, 0x1415: 0x1ba1, 0x1416: 0x1ba9, 0x1417: 0x1bb1,
+	0x1418: 0x1bb9, 0x1419: 0x1bc1, 0x141a: 0x1bc9, 0x141b: 0x1bd1, 0x141c: 0x1bd9, 0x141d: 0x1be1,
+	0x141e: 0x1be9, 0x141f: 0x1bf1, 0x1420: 0x1bf9, 0x1421: 0x1c01, 0x1422: 0x1c09, 0x1423: 0x1c11,
+	0x1424: 0x1c19, 0x1425: 0x1c21, 0x1426: 0x1c29, 0x1427: 0x1c31, 0x1428: 0x1b59, 0x1429: 0x1c39,
+	0x142a: 0x1c41, 0x142b: 0x1c49, 0x142c: 0x1c51, 0x142d: 0x1c21, 0x142e: 0x1c29, 0x142f: 0x1c31,
+	0x1430: 0x1b59, 0x1431: 0x1b51, 0x1432: 0x1b61, 0x1433: 0x1881, 0x1434: 0x1829, 0x1435: 0x1831,
+	0x1436: 0x1839, 0x1437: 0x1c21, 0x1438: 0x1c29, 0x1439: 0x1c31, 0x143a: 0x1881, 0x143b: 0x1889,
+	0x143c: 0x1c59, 0x143d: 0x1c59, 0x143e: 0x0018, 0x143f: 0x0018,
 	// Block 0x51, offset 0x1440
-	0x1440: 0x83a1, 0x1441: 0x83c9, 0x1442: 0x8441, 0x1443: 0x8469, 0x1444: 0x8509, 0x1445: 0x8531,
-	0x1446: 0x8559, 0x1447: 0x8581, 0x1448: 0x85a9, 0x1449: 0x8621, 0x144a: 0x8649, 0x144b: 0x8671,
-	0x144c: 0x8699, 0x144d: 0x8fd9, 0x144e: 0x8711, 0x144f: 0x8739, 0x1450: 0x8761, 0x1451: 0x8789,
-	0x1452: 0x8801, 0x1453: 0x8829, 0x1454: 0x8851, 0x1455: 0x8879, 0x1456: 0x9001, 0x1457: 0x88f1,
-	0x1458: 0x8919, 0x1459: 0x9029, 0x145a: 0x8991, 0x145b: 0x89b9, 0x145c: 0x89e1, 0x145d: 0x8a09,
-	0x145e: 0x9051, 0x145f: 0x7cc1, 0x1460: 0x8f39, 0x1461: 0x7d89, 0x1462: 0x8f61, 0x1463: 0x7e79,
-	0x1464: 0x8f89, 0x1465: 0x7f19, 0x1466: 0x9079, 0x1467: 0x8121, 0x1468: 0x90a1, 0x1469: 0x90c9,
-	0x146a: 0x90f1, 0x146b: 0x8581, 0x146c: 0x85a9, 0x146d: 0x8699, 0x146e: 0x8879, 0x146f: 0x9001,
-	0x1470: 0x8a09, 0x1471: 0x9051, 0x1472: 0x9119, 0x1473: 0x9151, 0x1474: 0x9189, 0x1475: 0x91c1,
-	0x1476: 0x91e9, 0x1477: 0x9211, 0x1478: 0x9239, 0x1479: 0x9261, 0x147a: 0x9289, 0x147b: 0x92b1,
-	0x147c: 0x92d9, 0x147d: 0x9301, 0x147e: 0x9329, 0x147f: 0x9351,
+	0x1440: 0x0040, 0x1441: 0x0040, 0x1442: 0x0040, 0x1443: 0x0040, 0x1444: 0x0040, 0x1445: 0x0040,
+	0x1446: 0x0040, 0x1447: 0x0040, 0x1448: 0x0040, 0x1449: 0x0040, 0x144a: 0x0040, 0x144b: 0x0040,
+	0x144c: 0x0040, 0x144d: 0x0040, 0x144e: 0x0040, 0x144f: 0x0040, 0x1450: 0x1c61, 0x1451: 0x1c69,
+	0x1452: 0x1c69, 0x1453: 0x1c71, 0x1454: 0x1c79, 0x1455: 0x1c81, 0x1456: 0x1c89, 0x1457: 0x1c91,
+	0x1458: 0x1c99, 0x1459: 0x1c99, 0x145a: 0x1ca1, 0x145b: 0x1ca9, 0x145c: 0x1cb1, 0x145d: 0x1cb9,
+	0x145e: 0x1cc1, 0x145f: 0x1cc9, 0x1460: 0x1cc9, 0x1461: 0x1cd1, 0x1462: 0x1cd9, 0x1463: 0x1cd9,
+	0x1464: 0x1ce1, 0x1465: 0x1ce1, 0x1466: 0x1ce9, 0x1467: 0x1cf1, 0x1468: 0x1cf1, 0x1469: 0x1cf9,
+	0x146a: 0x1d01, 0x146b: 0x1d01, 0x146c: 0x1d09, 0x146d: 0x1d09, 0x146e: 0x1d11, 0x146f: 0x1d19,
+	0x1470: 0x1d19, 0x1471: 0x1d21, 0x1472: 0x1d21, 0x1473: 0x1d29, 0x1474: 0x1d31, 0x1475: 0x1d39,
+	0x1476: 0x1d41, 0x1477: 0x1d41, 0x1478: 0x1d49, 0x1479: 0x1d51, 0x147a: 0x1d59, 0x147b: 0x1d61,
+	0x147c: 0x1d69, 0x147d: 0x1d69, 0x147e: 0x1d71, 0x147f: 0x1d79,
 	// Block 0x52, offset 0x1480
-	0x1480: 0x9379, 0x1481: 0x93a1, 0x1482: 0x93c9, 0x1483: 0x93f1, 0x1484: 0x9419, 0x1485: 0x9441,
-	0x1486: 0x9469, 0x1487: 0x9491, 0x1488: 0x94b9, 0x1489: 0x94e1, 0x148a: 0x9509, 0x148b: 0x9531,
-	0x148c: 0x90c9, 0x148d: 0x9559, 0x148e: 0x9581, 0x148f: 0x95a9, 0x1490: 0x95d1, 0x1491: 0x91c1,
-	0x1492: 0x91e9, 0x1493: 0x9211, 0x1494: 0x9239, 0x1495: 0x9261, 0x1496: 0x9289, 0x1497: 0x92b1,
-	0x1498: 0x92d9, 0x1499: 0x9301, 0x149a: 0x9329, 0x149b: 0x9351, 0x149c: 0x9379, 0x149d: 0x93a1,
-	0x149e: 0x93c9, 0x149f: 0x93f1, 0x14a0: 0x9419, 0x14a1: 0x9441, 0x14a2: 0x9469, 0x14a3: 0x9491,
-	0x14a4: 0x94b9, 0x14a5: 0x94e1, 0x14a6: 0x9509, 0x14a7: 0x9531, 0x14a8: 0x90c9, 0x14a9: 0x9559,
-	0x14aa: 0x9581, 0x14ab: 0x95a9, 0x14ac: 0x95d1, 0x14ad: 0x94e1, 0x14ae: 0x9509, 0x14af: 0x9531,
-	0x14b0: 0x90c9, 0x14b1: 0x90a1, 0x14b2: 0x90f1, 0x14b3: 0x8261, 0x14b4: 0x80a9, 0x14b5: 0x80d1,
-	0x14b6: 0x80f9, 0x14b7: 0x94e1, 0x14b8: 0x9509, 0x14b9: 0x9531, 0x14ba: 0x8261, 0x14bb: 0x8289,
-	0x14bc: 0x95f9, 0x14bd: 0x95f9, 0x14be: 0x0018, 0x14bf: 0x0018,
+	0x1480: 0x1f29, 0x1481: 0x1f31, 0x1482: 0x1f39, 0x1483: 0x1f11, 0x1484: 0x1d39, 0x1485: 0x1ce9,
+	0x1486: 0x1f41, 0x1487: 0x1f49, 0x1488: 0x0040, 0x1489: 0x0040, 0x148a: 0x0040, 0x148b: 0x0040,
+	0x148c: 0x0040, 0x148d: 0x0040, 0x148e: 0x0040, 0x148f: 0x0040, 0x1490: 0x0040, 0x1491: 0x0040,
+	0x1492: 0x0040, 0x1493: 0x0040, 0x1494: 0x0040, 0x1495: 0x0040, 0x1496: 0x0040, 0x1497: 0x0040,
+	0x1498: 0x0040, 0x1499: 0x0040, 0x149a: 0x0040, 0x149b: 0x0040, 0x149c: 0x0040, 0x149d: 0x0040,
+	0x149e: 0x0040, 0x149f: 0x0040, 0x14a0: 0x0040, 0x14a1: 0x0040, 0x14a2: 0x0040, 0x14a3: 0x0040,
+	0x14a4: 0x0040, 0x14a5: 0x0040, 0x14a6: 0x0040, 0x14a7: 0x0040, 0x14a8: 0x0040, 0x14a9: 0x0040,
+	0x14aa: 0x0040, 0x14ab: 0x0040, 0x14ac: 0x0040, 0x14ad: 0x0040, 0x14ae: 0x0040, 0x14af: 0x0040,
+	0x14b0: 0x1f51, 0x14b1: 0x1f59, 0x14b2: 0x1f61, 0x14b3: 0x1f69, 0x14b4: 0x1f71, 0x14b5: 0x1f79,
+	0x14b6: 0x1f81, 0x14b7: 0x1f89, 0x14b8: 0x1f91, 0x14b9: 0x1f99, 0x14ba: 0x1fa2, 0x14bb: 0x1faa,
+	0x14bc: 0x1fb1, 0x14bd: 0x0018, 0x14be: 0x0040, 0x14bf: 0x0040,
 	// Block 0x53, offset 0x14c0
-	0x14c0: 0x0040, 0x14c1: 0x0040, 0x14c2: 0x0040, 0x14c3: 0x0040, 0x14c4: 0x0040, 0x14c5: 0x0040,
-	0x14c6: 0x0040, 0x14c7: 0x0040, 0x14c8: 0x0040, 0x14c9: 0x0040, 0x14ca: 0x0040, 0x14cb: 0x0040,
-	0x14cc: 0x0040, 0x14cd: 0x0040, 0x14ce: 0x0040, 0x14cf: 0x0040, 0x14d0: 0x9621, 0x14d1: 0x9659,
-	0x14d2: 0x9659, 0x14d3: 0x9691, 0x14d4: 0x96c9, 0x14d5: 0x9701, 0x14d6: 0x9739, 0x14d7: 0x9771,
-	0x14d8: 0x97a9, 0x14d9: 0x97a9, 0x14da: 0x97e1, 0x14db: 0x9819, 0x14dc: 0x9851, 0x14dd: 0x9889,
-	0x14de: 0x98c1, 0x14df: 0x98f9, 0x14e0: 0x98f9, 0x14e1: 0x9931, 0x14e2: 0x9969, 0x14e3: 0x9969,
-	0x14e4: 0x99a1, 0x14e5: 0x99a1, 0x14e6: 0x99d9, 0x14e7: 0x9a11, 0x14e8: 0x9a11, 0x14e9: 0x9a49,
-	0x14ea: 0x9a81, 0x14eb: 0x9a81, 0x14ec: 0x9ab9, 0x14ed: 0x9ab9, 0x14ee: 0x9af1, 0x14ef: 0x9b29,
-	0x14f0: 0x9b29, 0x14f1: 0x9b61, 0x14f2: 0x9b61, 0x14f3: 0x9b99, 0x14f4: 0x9bd1, 0x14f5: 0x9c09,
-	0x14f6: 0x9c41, 0x14f7: 0x9c41, 0x14f8: 0x9c79, 0x14f9: 0x9cb1, 0x14fa: 0x9ce9, 0x14fb: 0x9d21,
-	0x14fc: 0x9d59, 0x14fd: 0x9d59, 0x14fe: 0x9d91, 0x14ff: 0x9dc9,
+	0x14c0: 0x33c0, 0x14c1: 0x33c0, 0x14c2: 0x33c0, 0x14c3: 0x33c0, 0x14c4: 0x33c0, 0x14c5: 0x33c0,
+	0x14c6: 0x33c0, 0x14c7: 0x33c0, 0x14c8: 0x33c0, 0x14c9: 0x33c0, 0x14ca: 0x33c0, 0x14cb: 0x33c0,
+	0x14cc: 0x33c0, 0x14cd: 0x33c0, 0x14ce: 0x33c0, 0x14cf: 0x33c0, 0x14d0: 0x1fba, 0x14d1: 0x7d8d,
+	0x14d2: 0x0040, 0x14d3: 0x1fc2, 0x14d4: 0x0122, 0x14d5: 0x1fca, 0x14d6: 0x1fd2, 0x14d7: 0x7dad,
+	0x14d8: 0x7dcd, 0x14d9: 0x0040, 0x14da: 0x0040, 0x14db: 0x0040, 0x14dc: 0x0040, 0x14dd: 0x0040,
+	0x14de: 0x0040, 0x14df: 0x0040, 0x14e0: 0x3308, 0x14e1: 0x3308, 0x14e2: 0x3308, 0x14e3: 0x3308,
+	0x14e4: 0x3308, 0x14e5: 0x3308, 0x14e6: 0x3308, 0x14e7: 0x3308, 0x14e8: 0x3308, 0x14e9: 0x3308,
+	0x14ea: 0x3308, 0x14eb: 0x3308, 0x14ec: 0x3308, 0x14ed: 0x3308, 0x14ee: 0x3308, 0x14ef: 0x3308,
+	0x14f0: 0x0040, 0x14f1: 0x7ded, 0x14f2: 0x7e0d, 0x14f3: 0x1fda, 0x14f4: 0x1fda, 0x14f5: 0x072a,
+	0x14f6: 0x0732, 0x14f7: 0x1fe2, 0x14f8: 0x1fea, 0x14f9: 0x7e2d, 0x14fa: 0x7e4d, 0x14fb: 0x7e6d,
+	0x14fc: 0x7e2d, 0x14fd: 0x7e8d, 0x14fe: 0x7ead, 0x14ff: 0x7e8d,
 	// Block 0x54, offset 0x1500
-	0x1500: 0xa999, 0x1501: 0xa9d1, 0x1502: 0xaa09, 0x1503: 0xa8f1, 0x1504: 0x9c09, 0x1505: 0x99d9,
-	0x1506: 0xaa41, 0x1507: 0xaa79, 0x1508: 0x0040, 0x1509: 0x0040, 0x150a: 0x0040, 0x150b: 0x0040,
-	0x150c: 0x0040, 0x150d: 0x0040, 0x150e: 0x0040, 0x150f: 0x0040, 0x1510: 0x0040, 0x1511: 0x0040,
-	0x1512: 0x0040, 0x1513: 0x0040, 0x1514: 0x0040, 0x1515: 0x0040, 0x1516: 0x0040, 0x1517: 0x0040,
-	0x1518: 0x0040, 0x1519: 0x0040, 0x151a: 0x0040, 0x151b: 0x0040, 0x151c: 0x0040, 0x151d: 0x0040,
-	0x151e: 0x0040, 0x151f: 0x0040, 0x1520: 0x0040, 0x1521: 0x0040, 0x1522: 0x0040, 0x1523: 0x0040,
-	0x1524: 0x0040, 0x1525: 0x0040, 0x1526: 0x0040, 0x1527: 0x0040, 0x1528: 0x0040, 0x1529: 0x0040,
-	0x152a: 0x0040, 0x152b: 0x0040, 0x152c: 0x0040, 0x152d: 0x0040, 0x152e: 0x0040, 0x152f: 0x0040,
-	0x1530: 0xaab1, 0x1531: 0xaae9, 0x1532: 0xab21, 0x1533: 0xab69, 0x1534: 0xabb1, 0x1535: 0xabf9,
-	0x1536: 0xac41, 0x1537: 0xac89, 0x1538: 0xacd1, 0x1539: 0xad19, 0x153a: 0xad52, 0x153b: 0xae62,
-	0x153c: 0xaee1, 0x153d: 0x0018, 0x153e: 0x0040, 0x153f: 0x0040,
+	0x1500: 0x7ecd, 0x1501: 0x7eed, 0x1502: 0x7f0d, 0x1503: 0x7eed, 0x1504: 0x7f2d, 0x1505: 0x0018,
+	0x1506: 0x0018, 0x1507: 0x1ff2, 0x1508: 0x1ffa, 0x1509: 0x7f4e, 0x150a: 0x7f6e, 0x150b: 0x7f8e,
+	0x150c: 0x7fae, 0x150d: 0x1fda, 0x150e: 0x1fda, 0x150f: 0x1fda, 0x1510: 0x1fba, 0x1511: 0x7fcd,
+	0x1512: 0x0040, 0x1513: 0x0040, 0x1514: 0x0122, 0x1515: 0x1fc2, 0x1516: 0x1fd2, 0x1517: 0x1fca,
+	0x1518: 0x7fed, 0x1519: 0x072a, 0x151a: 0x0732, 0x151b: 0x1fe2, 0x151c: 0x1fea, 0x151d: 0x7ecd,
+	0x151e: 0x7f2d, 0x151f: 0x2002, 0x1520: 0x200a, 0x1521: 0x2012, 0x1522: 0x071a, 0x1523: 0x2019,
+	0x1524: 0x2022, 0x1525: 0x202a, 0x1526: 0x0722, 0x1527: 0x0040, 0x1528: 0x2032, 0x1529: 0x203a,
+	0x152a: 0x2042, 0x152b: 0x204a, 0x152c: 0x0040, 0x152d: 0x0040, 0x152e: 0x0040, 0x152f: 0x0040,
+	0x1530: 0x800e, 0x1531: 0x2051, 0x1532: 0x802e, 0x1533: 0x0808, 0x1534: 0x804e, 0x1535: 0x0040,
+	0x1536: 0x806e, 0x1537: 0x2059, 0x1538: 0x808e, 0x1539: 0x2061, 0x153a: 0x80ae, 0x153b: 0x2069,
+	0x153c: 0x80ce, 0x153d: 0x2071, 0x153e: 0x80ee, 0x153f: 0x2079,
 	// Block 0x55, offset 0x1540
-	0x1540: 0x33c0, 0x1541: 0x33c0, 0x1542: 0x33c0, 0x1543: 0x33c0, 0x1544: 0x33c0, 0x1545: 0x33c0,
-	0x1546: 0x33c0, 0x1547: 0x33c0, 0x1548: 0x33c0, 0x1549: 0x33c0, 0x154a: 0x33c0, 0x154b: 0x33c0,
-	0x154c: 0x33c0, 0x154d: 0x33c0, 0x154e: 0x33c0, 0x154f: 0x33c0, 0x1550: 0xaf2a, 0x1551: 0x7d8d,
-	0x1552: 0x0040, 0x1553: 0xaf3a, 0x1554: 0x03c2, 0x1555: 0xaf4a, 0x1556: 0xaf5a, 0x1557: 0x7dad,
-	0x1558: 0x7dcd, 0x1559: 0x0040, 0x155a: 0x0040, 0x155b: 0x0040, 0x155c: 0x0040, 0x155d: 0x0040,
-	0x155e: 0x0040, 0x155f: 0x0040, 0x1560: 0x3308, 0x1561: 0x3308, 0x1562: 0x3308, 0x1563: 0x3308,
-	0x1564: 0x3308, 0x1565: 0x3308, 0x1566: 0x3308, 0x1567: 0x3308, 0x1568: 0x3308, 0x1569: 0x3308,
-	0x156a: 0x3308, 0x156b: 0x3308, 0x156c: 0x3308, 0x156d: 0x3308, 0x156e: 0x3308, 0x156f: 0x3308,
-	0x1570: 0x0040, 0x1571: 0x7ded, 0x1572: 0x7e0d, 0x1573: 0xaf6a, 0x1574: 0xaf6a, 0x1575: 0x1fd2,
-	0x1576: 0x1fe2, 0x1577: 0xaf7a, 0x1578: 0xaf8a, 0x1579: 0x7e2d, 0x157a: 0x7e4d, 0x157b: 0x7e6d,
-	0x157c: 0x7e2d, 0x157d: 0x7e8d, 0x157e: 0x7ead, 0x157f: 0x7e8d,
+	0x1540: 0x2081, 0x1541: 0x2089, 0x1542: 0x2089, 0x1543: 0x2091, 0x1544: 0x2091, 0x1545: 0x2099,
+	0x1546: 0x2099, 0x1547: 0x20a1, 0x1548: 0x20a1, 0x1549: 0x20a9, 0x154a: 0x20a9, 0x154b: 0x20a9,
+	0x154c: 0x20a9, 0x154d: 0x20b1, 0x154e: 0x20b1, 0x154f: 0x20b9, 0x1550: 0x20b9, 0x1551: 0x20b9,
+	0x1552: 0x20b9, 0x1553: 0x20c1, 0x1554: 0x20c1, 0x1555: 0x20c9, 0x1556: 0x20c9, 0x1557: 0x20c9,
+	0x1558: 0x20c9, 0x1559: 0x20d1, 0x155a: 0x20d1, 0x155b: 0x20d1, 0x155c: 0x20d1, 0x155d: 0x20d9,
+	0x155e: 0x20d9, 0x155f: 0x20d9, 0x1560: 0x20d9, 0x1561: 0x20e1, 0x1562: 0x20e1, 0x1563: 0x20e1,
+	0x1564: 0x20e1, 0x1565: 0x20e9, 0x1566: 0x20e9, 0x1567: 0x20e9, 0x1568: 0x20e9, 0x1569: 0x20f1,
+	0x156a: 0x20f1, 0x156b: 0x20f9, 0x156c: 0x20f9, 0x156d: 0x2101, 0x156e: 0x2101, 0x156f: 0x2109,
+	0x1570: 0x2109, 0x1571: 0x2111, 0x1572: 0x2111, 0x1573: 0x2111, 0x1574: 0x2111, 0x1575: 0x2119,
+	0x1576: 0x2119, 0x1577: 0x2119, 0x1578: 0x2119, 0x1579: 0x2121, 0x157a: 0x2121, 0x157b: 0x2121,
+	0x157c: 0x2121, 0x157d: 0x2129, 0x157e: 0x2129, 0x157f: 0x2129,
 	// Block 0x56, offset 0x1580
-	0x1580: 0x7ecd, 0x1581: 0x7eed, 0x1582: 0x7f0d, 0x1583: 0x7eed, 0x1584: 0x7f2d, 0x1585: 0x0018,
-	0x1586: 0x0018, 0x1587: 0xaf9a, 0x1588: 0xafaa, 0x1589: 0x7f4e, 0x158a: 0x7f6e, 0x158b: 0x7f8e,
-	0x158c: 0x7fae, 0x158d: 0xaf6a, 0x158e: 0xaf6a, 0x158f: 0xaf6a, 0x1590: 0xaf2a, 0x1591: 0x7fcd,
-	0x1592: 0x0040, 0x1593: 0x0040, 0x1594: 0x03c2, 0x1595: 0xaf3a, 0x1596: 0xaf5a, 0x1597: 0xaf4a,
-	0x1598: 0x7fed, 0x1599: 0x1fd2, 0x159a: 0x1fe2, 0x159b: 0xaf7a, 0x159c: 0xaf8a, 0x159d: 0x7ecd,
-	0x159e: 0x7f2d, 0x159f: 0xafba, 0x15a0: 0xafca, 0x15a1: 0xafda, 0x15a2: 0x1fb2, 0x15a3: 0xafe9,
-	0x15a4: 0xaffa, 0x15a5: 0xb00a, 0x15a6: 0x1fc2, 0x15a7: 0x0040, 0x15a8: 0xb01a, 0x15a9: 0xb02a,
-	0x15aa: 0xb03a, 0x15ab: 0xb04a, 0x15ac: 0x0040, 0x15ad: 0x0040, 0x15ae: 0x0040, 0x15af: 0x0040,
-	0x15b0: 0x800e, 0x15b1: 0xb059, 0x15b2: 0x802e, 0x15b3: 0x0808, 0x15b4: 0x804e, 0x15b5: 0x0040,
-	0x15b6: 0x806e, 0x15b7: 0xb081, 0x15b8: 0x808e, 0x15b9: 0xb0a9, 0x15ba: 0x80ae, 0x15bb: 0xb0d1,
-	0x15bc: 0x80ce, 0x15bd: 0xb0f9, 0x15be: 0x80ee, 0x15bf: 0xb121,
+	0x1580: 0x2129, 0x1581: 0x2131, 0x1582: 0x2131, 0x1583: 0x2131, 0x1584: 0x2131, 0x1585: 0x2139,
+	0x1586: 0x2139, 0x1587: 0x2139, 0x1588: 0x2139, 0x1589: 0x2141, 0x158a: 0x2141, 0x158b: 0x2141,
+	0x158c: 0x2141, 0x158d: 0x2149, 0x158e: 0x2149, 0x158f: 0x2149, 0x1590: 0x2149, 0x1591: 0x2151,
+	0x1592: 0x2151, 0x1593: 0x2151, 0x1594: 0x2151, 0x1595: 0x2159, 0x1596: 0x2159, 0x1597: 0x2159,
+	0x1598: 0x2159, 0x1599: 0x2161, 0x159a: 0x2161, 0x159b: 0x2161, 0x159c: 0x2161, 0x159d: 0x2169,
+	0x159e: 0x2169, 0x159f: 0x2169, 0x15a0: 0x2169, 0x15a1: 0x2171, 0x15a2: 0x2171, 0x15a3: 0x2171,
+	0x15a4: 0x2171, 0x15a5: 0x2179, 0x15a6: 0x2179, 0x15a7: 0x2179, 0x15a8: 0x2179, 0x15a9: 0x2181,
+	0x15aa: 0x2181, 0x15ab: 0x2181, 0x15ac: 0x2181, 0x15ad: 0x2189, 0x15ae: 0x2189, 0x15af: 0x1701,
+	0x15b0: 0x1701, 0x15b1: 0x2191, 0x15b2: 0x2191, 0x15b3: 0x2191, 0x15b4: 0x2191, 0x15b5: 0x2199,
+	0x15b6: 0x2199, 0x15b7: 0x21a1, 0x15b8: 0x21a1, 0x15b9: 0x21a9, 0x15ba: 0x21a9, 0x15bb: 0x21b1,
+	0x15bc: 0x21b1, 0x15bd: 0x0040, 0x15be: 0x0040, 0x15bf: 0x03c0,
 	// Block 0x57, offset 0x15c0
-	0x15c0: 0xb149, 0x15c1: 0xb161, 0x15c2: 0xb161, 0x15c3: 0xb179, 0x15c4: 0xb179, 0x15c5: 0xb191,
-	0x15c6: 0xb191, 0x15c7: 0xb1a9, 0x15c8: 0xb1a9, 0x15c9: 0xb1c1, 0x15ca: 0xb1c1, 0x15cb: 0xb1c1,
-	0x15cc: 0xb1c1, 0x15cd: 0xb1d9, 0x15ce: 0xb1d9, 0x15cf: 0xb1f1, 0x15d0: 0xb1f1, 0x15d1: 0xb1f1,
-	0x15d2: 0xb1f1, 0x15d3: 0xb209, 0x15d4: 0xb209, 0x15d5: 0xb221, 0x15d6: 0xb221, 0x15d7: 0xb221,
-	0x15d8: 0xb221, 0x15d9: 0xb239, 0x15da: 0xb239, 0x15db: 0xb239, 0x15dc: 0xb239, 0x15dd: 0xb251,
-	0x15de: 0xb251, 0x15df: 0xb251, 0x15e0: 0xb251, 0x15e1: 0xb269, 0x15e2: 0xb269, 0x15e3: 0xb269,
-	0x15e4: 0xb269, 0x15e5: 0xb281, 0x15e6: 0xb281, 0x15e7: 0xb281, 0x15e8: 0xb281, 0x15e9: 0xb299,
-	0x15ea: 0xb299, 0x15eb: 0xb2b1, 0x15ec: 0xb2b1, 0x15ed: 0xb2c9, 0x15ee: 0xb2c9, 0x15ef: 0xb2e1,
-	0x15f0: 0xb2e1, 0x15f1: 0xb2f9, 0x15f2: 0xb2f9, 0x15f3: 0xb2f9, 0x15f4: 0xb2f9, 0x15f5: 0xb311,
-	0x15f6: 0xb311, 0x15f7: 0xb311, 0x15f8: 0xb311, 0x15f9: 0xb329, 0x15fa: 0xb329, 0x15fb: 0xb329,
-	0x15fc: 0xb329, 0x15fd: 0xb341, 0x15fe: 0xb341, 0x15ff: 0xb341,
+	0x15c0: 0x0040, 0x15c1: 0x1fca, 0x15c2: 0x21ba, 0x15c3: 0x2002, 0x15c4: 0x203a, 0x15c5: 0x2042,
+	0x15c6: 0x200a, 0x15c7: 0x21c2, 0x15c8: 0x072a, 0x15c9: 0x0732, 0x15ca: 0x2012, 0x15cb: 0x071a,
+	0x15cc: 0x1fba, 0x15cd: 0x2019, 0x15ce: 0x0961, 0x15cf: 0x21ca, 0x15d0: 0x06e1, 0x15d1: 0x0049,
+	0x15d2: 0x0029, 0x15d3: 0x0031, 0x15d4: 0x06e9, 0x15d5: 0x06f1, 0x15d6: 0x06f9, 0x15d7: 0x0701,
+	0x15d8: 0x0709, 0x15d9: 0x0711, 0x15da: 0x1fc2, 0x15db: 0x0122, 0x15dc: 0x2022, 0x15dd: 0x0722,
+	0x15de: 0x202a, 0x15df: 0x1fd2, 0x15e0: 0x204a, 0x15e1: 0x0019, 0x15e2: 0x02e9, 0x15e3: 0x03d9,
+	0x15e4: 0x02f1, 0x15e5: 0x02f9, 0x15e6: 0x03f1, 0x15e7: 0x0309, 0x15e8: 0x00a9, 0x15e9: 0x0311,
+	0x15ea: 0x00b1, 0x15eb: 0x0319, 0x15ec: 0x0101, 0x15ed: 0x0321, 0x15ee: 0x0329, 0x15ef: 0x0051,
+	0x15f0: 0x0339, 0x15f1: 0x0751, 0x15f2: 0x00b9, 0x15f3: 0x0089, 0x15f4: 0x0341, 0x15f5: 0x0349,
+	0x15f6: 0x0391, 0x15f7: 0x00c1, 0x15f8: 0x0109, 0x15f9: 0x00c9, 0x15fa: 0x04b1, 0x15fb: 0x1ff2,
+	0x15fc: 0x2032, 0x15fd: 0x1ffa, 0x15fe: 0x21d2, 0x15ff: 0x1fda,
 	// Block 0x58, offset 0x1600
-	0x1600: 0xb341, 0x1601: 0xb359, 0x1602: 0xb359, 0x1603: 0xb359, 0x1604: 0xb359, 0x1605: 0xb371,
-	0x1606: 0xb371, 0x1607: 0xb371, 0x1608: 0xb371, 0x1609: 0xb389, 0x160a: 0xb389, 0x160b: 0xb389,
-	0x160c: 0xb389, 0x160d: 0xb3a1, 0x160e: 0xb3a1, 0x160f: 0xb3a1, 0x1610: 0xb3a1, 0x1611: 0xb3b9,
-	0x1612: 0xb3b9, 0x1613: 0xb3b9, 0x1614: 0xb3b9, 0x1615: 0xb3d1, 0x1616: 0xb3d1, 0x1617: 0xb3d1,
-	0x1618: 0xb3d1, 0x1619: 0xb3e9, 0x161a: 0xb3e9, 0x161b: 0xb3e9, 0x161c: 0xb3e9, 0x161d: 0xb401,
-	0x161e: 0xb401, 0x161f: 0xb401, 0x1620: 0xb401, 0x1621: 0xb419, 0x1622: 0xb419, 0x1623: 0xb419,
-	0x1624: 0xb419, 0x1625: 0xb431, 0x1626: 0xb431, 0x1627: 0xb431, 0x1628: 0xb431, 0x1629: 0xb449,
-	0x162a: 0xb449, 0x162b: 0xb449, 0x162c: 0xb449, 0x162d: 0xb461, 0x162e: 0xb461, 0x162f: 0x7b01,
-	0x1630: 0x7b01, 0x1631: 0xb479, 0x1632: 0xb479, 0x1633: 0xb479, 0x1634: 0xb479, 0x1635: 0xb491,
-	0x1636: 0xb491, 0x1637: 0xb4b9, 0x1638: 0xb4b9, 0x1639: 0xb4e1, 0x163a: 0xb4e1, 0x163b: 0xb509,
-	0x163c: 0xb509, 0x163d: 0x0040, 0x163e: 0x0040, 0x163f: 0x03c0,
+	0x1600: 0x0672, 0x1601: 0x0019, 0x1602: 0x02e9, 0x1603: 0x03d9, 0x1604: 0x02f1, 0x1605: 0x02f9,
+	0x1606: 0x03f1, 0x1607: 0x0309, 0x1608: 0x00a9, 0x1609: 0x0311, 0x160a: 0x00b1, 0x160b: 0x0319,
+	0x160c: 0x0101, 0x160d: 0x0321, 0x160e: 0x0329, 0x160f: 0x0051, 0x1610: 0x0339, 0x1611: 0x0751,
+	0x1612: 0x00b9, 0x1613: 0x0089, 0x1614: 0x0341, 0x1615: 0x0349, 0x1616: 0x0391, 0x1617: 0x00c1,
+	0x1618: 0x0109, 0x1619: 0x00c9, 0x161a: 0x04b1, 0x161b: 0x1fe2, 0x161c: 0x21da, 0x161d: 0x1fea,
+	0x161e: 0x21e2, 0x161f: 0x810d, 0x1620: 0x812d, 0x1621: 0x0961, 0x1622: 0x814d, 0x1623: 0x814d,
+	0x1624: 0x816d, 0x1625: 0x818d, 0x1626: 0x81ad, 0x1627: 0x81cd, 0x1628: 0x81ed, 0x1629: 0x820d,
+	0x162a: 0x822d, 0x162b: 0x824d, 0x162c: 0x826d, 0x162d: 0x828d, 0x162e: 0x82ad, 0x162f: 0x82cd,
+	0x1630: 0x82ed, 0x1631: 0x830d, 0x1632: 0x832d, 0x1633: 0x834d, 0x1634: 0x836d, 0x1635: 0x838d,
+	0x1636: 0x83ad, 0x1637: 0x83cd, 0x1638: 0x83ed, 0x1639: 0x840d, 0x163a: 0x842d, 0x163b: 0x844d,
+	0x163c: 0x81ed, 0x163d: 0x846d, 0x163e: 0x848d, 0x163f: 0x824d,
 	// Block 0x59, offset 0x1640
-	0x1640: 0x0040, 0x1641: 0xaf4a, 0x1642: 0xb532, 0x1643: 0xafba, 0x1644: 0xb02a, 0x1645: 0xb03a,
-	0x1646: 0xafca, 0x1647: 0xb542, 0x1648: 0x1fd2, 0x1649: 0x1fe2, 0x164a: 0xafda, 0x164b: 0x1fb2,
-	0x164c: 0xaf2a, 0x164d: 0xafe9, 0x164e: 0x29d1, 0x164f: 0xb552, 0x1650: 0x1f41, 0x1651: 0x00c9,
-	0x1652: 0x0069, 0x1653: 0x0079, 0x1654: 0x1f51, 0x1655: 0x1f61, 0x1656: 0x1f71, 0x1657: 0x1f81,
-	0x1658: 0x1f91, 0x1659: 0x1fa1, 0x165a: 0xaf3a, 0x165b: 0x03c2, 0x165c: 0xaffa, 0x165d: 0x1fc2,
-	0x165e: 0xb00a, 0x165f: 0xaf5a, 0x1660: 0xb04a, 0x1661: 0x0039, 0x1662: 0x0ee9, 0x1663: 0x1159,
-	0x1664: 0x0ef9, 0x1665: 0x0f09, 0x1666: 0x1199, 0x1667: 0x0f31, 0x1668: 0x0249, 0x1669: 0x0f41,
-	0x166a: 0x0259, 0x166b: 0x0f51, 0x166c: 0x0359, 0x166d: 0x0f61, 0x166e: 0x0f71, 0x166f: 0x00d9,
-	0x1670: 0x0f99, 0x1671: 0x2039, 0x1672: 0x0269, 0x1673: 0x01d9, 0x1674: 0x0fa9, 0x1675: 0x0fb9,
-	0x1676: 0x1089, 0x1677: 0x0279, 0x1678: 0x0369, 0x1679: 0x0289, 0x167a: 0x13d1, 0x167b: 0xaf9a,
-	0x167c: 0xb01a, 0x167d: 0xafaa, 0x167e: 0xb562, 0x167f: 0xaf6a,
+	0x1640: 0x84ad, 0x1641: 0x84cd, 0x1642: 0x84ed, 0x1643: 0x850d, 0x1644: 0x852d, 0x1645: 0x854d,
+	0x1646: 0x856d, 0x1647: 0x858d, 0x1648: 0x850d, 0x1649: 0x85ad, 0x164a: 0x850d, 0x164b: 0x85cd,
+	0x164c: 0x85cd, 0x164d: 0x85ed, 0x164e: 0x85ed, 0x164f: 0x860d, 0x1650: 0x854d, 0x1651: 0x862d,
+	0x1652: 0x864d, 0x1653: 0x862d, 0x1654: 0x866d, 0x1655: 0x864d, 0x1656: 0x868d, 0x1657: 0x868d,
+	0x1658: 0x86ad, 0x1659: 0x86ad, 0x165a: 0x86cd, 0x165b: 0x86cd, 0x165c: 0x864d, 0x165d: 0x814d,
+	0x165e: 0x86ed, 0x165f: 0x870d, 0x1660: 0x0040, 0x1661: 0x872d, 0x1662: 0x874d, 0x1663: 0x876d,
+	0x1664: 0x878d, 0x1665: 0x876d, 0x1666: 0x87ad, 0x1667: 0x87cd, 0x1668: 0x87ed, 0x1669: 0x87ed,
+	0x166a: 0x880d, 0x166b: 0x880d, 0x166c: 0x882d, 0x166d: 0x882d, 0x166e: 0x880d, 0x166f: 0x880d,
+	0x1670: 0x884d, 0x1671: 0x886d, 0x1672: 0x888d, 0x1673: 0x88ad, 0x1674: 0x88cd, 0x1675: 0x88ed,
+	0x1676: 0x88ed, 0x1677: 0x88ed, 0x1678: 0x890d, 0x1679: 0x890d, 0x167a: 0x890d, 0x167b: 0x890d,
+	0x167c: 0x87ed, 0x167d: 0x87ed, 0x167e: 0x87ed, 0x167f: 0x0040,
 	// Block 0x5a, offset 0x1680
-	0x1680: 0x1caa, 0x1681: 0x0039, 0x1682: 0x0ee9, 0x1683: 0x1159, 0x1684: 0x0ef9, 0x1685: 0x0f09,
-	0x1686: 0x1199, 0x1687: 0x0f31, 0x1688: 0x0249, 0x1689: 0x0f41, 0x168a: 0x0259, 0x168b: 0x0f51,
-	0x168c: 0x0359, 0x168d: 0x0f61, 0x168e: 0x0f71, 0x168f: 0x00d9, 0x1690: 0x0f99, 0x1691: 0x2039,
-	0x1692: 0x0269, 0x1693: 0x01d9, 0x1694: 0x0fa9, 0x1695: 0x0fb9, 0x1696: 0x1089, 0x1697: 0x0279,
-	0x1698: 0x0369, 0x1699: 0x0289, 0x169a: 0x13d1, 0x169b: 0xaf7a, 0x169c: 0xb572, 0x169d: 0xaf8a,
-	0x169e: 0xb582, 0x169f: 0x810d, 0x16a0: 0x812d, 0x16a1: 0x29d1, 0x16a2: 0x814d, 0x16a3: 0x814d,
-	0x16a4: 0x816d, 0x16a5: 0x818d, 0x16a6: 0x81ad, 0x16a7: 0x81cd, 0x16a8: 0x81ed, 0x16a9: 0x820d,
-	0x16aa: 0x822d, 0x16ab: 0x824d, 0x16ac: 0x826d, 0x16ad: 0x828d, 0x16ae: 0x82ad, 0x16af: 0x82cd,
-	0x16b0: 0x82ed, 0x16b1: 0x830d, 0x16b2: 0x832d, 0x16b3: 0x834d, 0x16b4: 0x836d, 0x16b5: 0x838d,
-	0x16b6: 0x83ad, 0x16b7: 0x83cd, 0x16b8: 0x83ed, 0x16b9: 0x840d, 0x16ba: 0x842d, 0x16bb: 0x844d,
-	0x16bc: 0x81ed, 0x16bd: 0x846d, 0x16be: 0x848d, 0x16bf: 0x824d,
+	0x1680: 0x0040, 0x1681: 0x0040, 0x1682: 0x874d, 0x1683: 0x872d, 0x1684: 0x892d, 0x1685: 0x872d,
+	0x1686: 0x874d, 0x1687: 0x872d, 0x1688: 0x0040, 0x1689: 0x0040, 0x168a: 0x894d, 0x168b: 0x874d,
+	0x168c: 0x896d, 0x168d: 0x892d, 0x168e: 0x896d, 0x168f: 0x874d, 0x1690: 0x0040, 0x1691: 0x0040,
+	0x1692: 0x898d, 0x1693: 0x89ad, 0x1694: 0x88ad, 0x1695: 0x896d, 0x1696: 0x892d, 0x1697: 0x896d,
+	0x1698: 0x0040, 0x1699: 0x0040, 0x169a: 0x89cd, 0x169b: 0x89ed, 0x169c: 0x89cd, 0x169d: 0x0040,
+	0x169e: 0x0040, 0x169f: 0x0040, 0x16a0: 0x21e9, 0x16a1: 0x21f1, 0x16a2: 0x21f9, 0x16a3: 0x8a0e,
+	0x16a4: 0x2201, 0x16a5: 0x2209, 0x16a6: 0x8a2d, 0x16a7: 0x0040, 0x16a8: 0x8a4d, 0x16a9: 0x8a6d,
+	0x16aa: 0x8a8d, 0x16ab: 0x8a6d, 0x16ac: 0x8aad, 0x16ad: 0x8acd, 0x16ae: 0x8aed, 0x16af: 0x0040,
+	0x16b0: 0x0040, 0x16b1: 0x0040, 0x16b2: 0x0040, 0x16b3: 0x0040, 0x16b4: 0x0040, 0x16b5: 0x0040,
+	0x16b6: 0x0040, 0x16b7: 0x0040, 0x16b8: 0x0040, 0x16b9: 0x0340, 0x16ba: 0x0340, 0x16bb: 0x0340,
+	0x16bc: 0x0040, 0x16bd: 0x0040, 0x16be: 0x0040, 0x16bf: 0x0040,
 	// Block 0x5b, offset 0x16c0
-	0x16c0: 0x84ad, 0x16c1: 0x84cd, 0x16c2: 0x84ed, 0x16c3: 0x850d, 0x16c4: 0x852d, 0x16c5: 0x854d,
-	0x16c6: 0x856d, 0x16c7: 0x858d, 0x16c8: 0x850d, 0x16c9: 0x85ad, 0x16ca: 0x850d, 0x16cb: 0x85cd,
-	0x16cc: 0x85cd, 0x16cd: 0x85ed, 0x16ce: 0x85ed, 0x16cf: 0x860d, 0x16d0: 0x854d, 0x16d1: 0x862d,
-	0x16d2: 0x864d, 0x16d3: 0x862d, 0x16d4: 0x866d, 0x16d5: 0x864d, 0x16d6: 0x868d, 0x16d7: 0x868d,
-	0x16d8: 0x86ad, 0x16d9: 0x86ad, 0x16da: 0x86cd, 0x16db: 0x86cd, 0x16dc: 0x864d, 0x16dd: 0x814d,
-	0x16de: 0x86ed, 0x16df: 0x870d, 0x16e0: 0x0040, 0x16e1: 0x872d, 0x16e2: 0x874d, 0x16e3: 0x876d,
-	0x16e4: 0x878d, 0x16e5: 0x876d, 0x16e6: 0x87ad, 0x16e7: 0x87cd, 0x16e8: 0x87ed, 0x16e9: 0x87ed,
-	0x16ea: 0x880d, 0x16eb: 0x880d, 0x16ec: 0x882d, 0x16ed: 0x882d, 0x16ee: 0x880d, 0x16ef: 0x880d,
-	0x16f0: 0x884d, 0x16f1: 0x886d, 0x16f2: 0x888d, 0x16f3: 0x88ad, 0x16f4: 0x88cd, 0x16f5: 0x88ed,
-	0x16f6: 0x88ed, 0x16f7: 0x88ed, 0x16f8: 0x890d, 0x16f9: 0x890d, 0x16fa: 0x890d, 0x16fb: 0x890d,
-	0x16fc: 0x87ed, 0x16fd: 0x87ed, 0x16fe: 0x87ed, 0x16ff: 0x0040,
+	0x16c0: 0x0a08, 0x16c1: 0x0a08, 0x16c2: 0x0a08, 0x16c3: 0x0a08, 0x16c4: 0x0a08, 0x16c5: 0x0c08,
+	0x16c6: 0x0808, 0x16c7: 0x0c08, 0x16c8: 0x0818, 0x16c9: 0x0c08, 0x16ca: 0x0c08, 0x16cb: 0x0808,
+	0x16cc: 0x0808, 0x16cd: 0x0908, 0x16ce: 0x0c08, 0x16cf: 0x0c08, 0x16d0: 0x0c08, 0x16d1: 0x0c08,
+	0x16d2: 0x0c08, 0x16d3: 0x0a08, 0x16d4: 0x0a08, 0x16d5: 0x0a08, 0x16d6: 0x0a08, 0x16d7: 0x0908,
+	0x16d8: 0x0a08, 0x16d9: 0x0a08, 0x16da: 0x0a08, 0x16db: 0x0a08, 0x16dc: 0x0a08, 0x16dd: 0x0c08,
+	0x16de: 0x0a08, 0x16df: 0x0a08, 0x16e0: 0x0a08, 0x16e1: 0x0c08, 0x16e2: 0x0808, 0x16e3: 0x0808,
+	0x16e4: 0x0c08, 0x16e5: 0x3308, 0x16e6: 0x3308, 0x16e7: 0x0040, 0x16e8: 0x0040, 0x16e9: 0x0040,
+	0x16ea: 0x0040, 0x16eb: 0x0a18, 0x16ec: 0x0a18, 0x16ed: 0x0a18, 0x16ee: 0x0a18, 0x16ef: 0x0c18,
+	0x16f0: 0x0818, 0x16f1: 0x0818, 0x16f2: 0x0818, 0x16f3: 0x0818, 0x16f4: 0x0818, 0x16f5: 0x0818,
+	0x16f6: 0x0818, 0x16f7: 0x0040, 0x16f8: 0x0040, 0x16f9: 0x0040, 0x16fa: 0x0040, 0x16fb: 0x0040,
+	0x16fc: 0x0040, 0x16fd: 0x0040, 0x16fe: 0x0040, 0x16ff: 0x0040,
 	// Block 0x5c, offset 0x1700
-	0x1700: 0x0040, 0x1701: 0x0040, 0x1702: 0x874d, 0x1703: 0x872d, 0x1704: 0x892d, 0x1705: 0x872d,
-	0x1706: 0x874d, 0x1707: 0x872d, 0x1708: 0x0040, 0x1709: 0x0040, 0x170a: 0x894d, 0x170b: 0x874d,
-	0x170c: 0x896d, 0x170d: 0x892d, 0x170e: 0x896d, 0x170f: 0x874d, 0x1710: 0x0040, 0x1711: 0x0040,
-	0x1712: 0x898d, 0x1713: 0x89ad, 0x1714: 0x88ad, 0x1715: 0x896d, 0x1716: 0x892d, 0x1717: 0x896d,
-	0x1718: 0x0040, 0x1719: 0x0040, 0x171a: 0x89cd, 0x171b: 0x89ed, 0x171c: 0x89cd, 0x171d: 0x0040,
-	0x171e: 0x0040, 0x171f: 0x0040, 0x1720: 0xb591, 0x1721: 0xb5a9, 0x1722: 0xb5c1, 0x1723: 0x8a0e,
-	0x1724: 0xb5d9, 0x1725: 0xb5f1, 0x1726: 0x8a2d, 0x1727: 0x0040, 0x1728: 0x8a4d, 0x1729: 0x8a6d,
-	0x172a: 0x8a8d, 0x172b: 0x8a6d, 0x172c: 0x8aad, 0x172d: 0x8acd, 0x172e: 0x8aed, 0x172f: 0x0040,
+	0x1700: 0x0a08, 0x1701: 0x0c08, 0x1702: 0x0a08, 0x1703: 0x0c08, 0x1704: 0x0c08, 0x1705: 0x0c08,
+	0x1706: 0x0a08, 0x1707: 0x0a08, 0x1708: 0x0a08, 0x1709: 0x0c08, 0x170a: 0x0a08, 0x170b: 0x0a08,
+	0x170c: 0x0c08, 0x170d: 0x0a08, 0x170e: 0x0c08, 0x170f: 0x0c08, 0x1710: 0x0a08, 0x1711: 0x0c08,
+	0x1712: 0x0040, 0x1713: 0x0040, 0x1714: 0x0040, 0x1715: 0x0040, 0x1716: 0x0040, 0x1717: 0x0040,
+	0x1718: 0x0040, 0x1719: 0x0818, 0x171a: 0x0818, 0x171b: 0x0818, 0x171c: 0x0818, 0x171d: 0x0040,
+	0x171e: 0x0040, 0x171f: 0x0040, 0x1720: 0x0040, 0x1721: 0x0040, 0x1722: 0x0040, 0x1723: 0x0040,
+	0x1724: 0x0040, 0x1725: 0x0040, 0x1726: 0x0040, 0x1727: 0x0040, 0x1728: 0x0040, 0x1729: 0x0c18,
+	0x172a: 0x0c18, 0x172b: 0x0c18, 0x172c: 0x0c18, 0x172d: 0x0a18, 0x172e: 0x0a18, 0x172f: 0x0818,
 	0x1730: 0x0040, 0x1731: 0x0040, 0x1732: 0x0040, 0x1733: 0x0040, 0x1734: 0x0040, 0x1735: 0x0040,
-	0x1736: 0x0040, 0x1737: 0x0040, 0x1738: 0x0040, 0x1739: 0x0340, 0x173a: 0x0340, 0x173b: 0x0340,
+	0x1736: 0x0040, 0x1737: 0x0040, 0x1738: 0x0040, 0x1739: 0x0040, 0x173a: 0x0040, 0x173b: 0x0040,
 	0x173c: 0x0040, 0x173d: 0x0040, 0x173e: 0x0040, 0x173f: 0x0040,
 	// Block 0x5d, offset 0x1740
-	0x1740: 0x0a08, 0x1741: 0x0a08, 0x1742: 0x0a08, 0x1743: 0x0a08, 0x1744: 0x0a08, 0x1745: 0x0c08,
-	0x1746: 0x0808, 0x1747: 0x0c08, 0x1748: 0x0818, 0x1749: 0x0c08, 0x174a: 0x0c08, 0x174b: 0x0808,
-	0x174c: 0x0808, 0x174d: 0x0908, 0x174e: 0x0c08, 0x174f: 0x0c08, 0x1750: 0x0c08, 0x1751: 0x0c08,
-	0x1752: 0x0c08, 0x1753: 0x0a08, 0x1754: 0x0a08, 0x1755: 0x0a08, 0x1756: 0x0a08, 0x1757: 0x0908,
-	0x1758: 0x0a08, 0x1759: 0x0a08, 0x175a: 0x0a08, 0x175b: 0x0a08, 0x175c: 0x0a08, 0x175d: 0x0c08,
-	0x175e: 0x0a08, 0x175f: 0x0a08, 0x1760: 0x0a08, 0x1761: 0x0c08, 0x1762: 0x0808, 0x1763: 0x0808,
-	0x1764: 0x0c08, 0x1765: 0x3308, 0x1766: 0x3308, 0x1767: 0x0040, 0x1768: 0x0040, 0x1769: 0x0040,
-	0x176a: 0x0040, 0x176b: 0x0a18, 0x176c: 0x0a18, 0x176d: 0x0a18, 0x176e: 0x0a18, 0x176f: 0x0c18,
-	0x1770: 0x0818, 0x1771: 0x0818, 0x1772: 0x0818, 0x1773: 0x0818, 0x1774: 0x0818, 0x1775: 0x0818,
-	0x1776: 0x0818, 0x1777: 0x0040, 0x1778: 0x0040, 0x1779: 0x0040, 0x177a: 0x0040, 0x177b: 0x0040,
-	0x177c: 0x0040, 0x177d: 0x0040, 0x177e: 0x0040, 0x177f: 0x0040,
+	0x1740: 0x3308, 0x1741: 0x3308, 0x1742: 0x3008, 0x1743: 0x3008, 0x1744: 0x0040, 0x1745: 0x0008,
+	0x1746: 0x0008, 0x1747: 0x0008, 0x1748: 0x0008, 0x1749: 0x0008, 0x174a: 0x0008, 0x174b: 0x0008,
+	0x174c: 0x0008, 0x174d: 0x0040, 0x174e: 0x0040, 0x174f: 0x0008, 0x1750: 0x0008, 0x1751: 0x0040,
+	0x1752: 0x0040, 0x1753: 0x0008, 0x1754: 0x0008, 0x1755: 0x0008, 0x1756: 0x0008, 0x1757: 0x0008,
+	0x1758: 0x0008, 0x1759: 0x0008, 0x175a: 0x0008, 0x175b: 0x0008, 0x175c: 0x0008, 0x175d: 0x0008,
+	0x175e: 0x0008, 0x175f: 0x0008, 0x1760: 0x0008, 0x1761: 0x0008, 0x1762: 0x0008, 0x1763: 0x0008,
+	0x1764: 0x0008, 0x1765: 0x0008, 0x1766: 0x0008, 0x1767: 0x0008, 0x1768: 0x0008, 0x1769: 0x0040,
+	0x176a: 0x0008, 0x176b: 0x0008, 0x176c: 0x0008, 0x176d: 0x0008, 0x176e: 0x0008, 0x176f: 0x0008,
+	0x1770: 0x0008, 0x1771: 0x0040, 0x1772: 0x0008, 0x1773: 0x0008, 0x1774: 0x0040, 0x1775: 0x0008,
+	0x1776: 0x0008, 0x1777: 0x0008, 0x1778: 0x0008, 0x1779: 0x0008, 0x177a: 0x0040, 0x177b: 0x3308,
+	0x177c: 0x3308, 0x177d: 0x0008, 0x177e: 0x3008, 0x177f: 0x3008,
 	// Block 0x5e, offset 0x1780
-	0x1780: 0x0a08, 0x1781: 0x0c08, 0x1782: 0x0a08, 0x1783: 0x0c08, 0x1784: 0x0c08, 0x1785: 0x0c08,
-	0x1786: 0x0a08, 0x1787: 0x0a08, 0x1788: 0x0a08, 0x1789: 0x0c08, 0x178a: 0x0a08, 0x178b: 0x0a08,
-	0x178c: 0x0c08, 0x178d: 0x0a08, 0x178e: 0x0c08, 0x178f: 0x0c08, 0x1790: 0x0a08, 0x1791: 0x0c08,
-	0x1792: 0x0040, 0x1793: 0x0040, 0x1794: 0x0040, 0x1795: 0x0040, 0x1796: 0x0040, 0x1797: 0x0040,
-	0x1798: 0x0040, 0x1799: 0x0818, 0x179a: 0x0818, 0x179b: 0x0818, 0x179c: 0x0818, 0x179d: 0x0040,
-	0x179e: 0x0040, 0x179f: 0x0040, 0x17a0: 0x0040, 0x17a1: 0x0040, 0x17a2: 0x0040, 0x17a3: 0x0040,
-	0x17a4: 0x0040, 0x17a5: 0x0040, 0x17a6: 0x0040, 0x17a7: 0x0040, 0x17a8: 0x0040, 0x17a9: 0x0c18,
-	0x17aa: 0x0c18, 0x17ab: 0x0c18, 0x17ac: 0x0c18, 0x17ad: 0x0a18, 0x17ae: 0x0a18, 0x17af: 0x0818,
-	0x17b0: 0x0040, 0x17b1: 0x0040, 0x17b2: 0x0040, 0x17b3: 0x0040, 0x17b4: 0x0040, 0x17b5: 0x0040,
+	0x1780: 0x3308, 0x1781: 0x3008, 0x1782: 0x3008, 0x1783: 0x3008, 0x1784: 0x3008, 0x1785: 0x0040,
+	0x1786: 0x0040, 0x1787: 0x3008, 0x1788: 0x3008, 0x1789: 0x0040, 0x178a: 0x0040, 0x178b: 0x3008,
+	0x178c: 0x3008, 0x178d: 0x3808, 0x178e: 0x0040, 0x178f: 0x0040, 0x1790: 0x0008, 0x1791: 0x0040,
+	0x1792: 0x0040, 0x1793: 0x0040, 0x1794: 0x0040, 0x1795: 0x0040, 0x1796: 0x0040, 0x1797: 0x3008,
+	0x1798: 0x0040, 0x1799: 0x0040, 0x179a: 0x0040, 0x179b: 0x0040, 0x179c: 0x0040, 0x179d: 0x0008,
+	0x179e: 0x0008, 0x179f: 0x0008, 0x17a0: 0x0008, 0x17a1: 0x0008, 0x17a2: 0x3008, 0x17a3: 0x3008,
+	0x17a4: 0x0040, 0x17a5: 0x0040, 0x17a6: 0x3308, 0x17a7: 0x3308, 0x17a8: 0x3308, 0x17a9: 0x3308,
+	0x17aa: 0x3308, 0x17ab: 0x3308, 0x17ac: 0x3308, 0x17ad: 0x0040, 0x17ae: 0x0040, 0x17af: 0x0040,
+	0x17b0: 0x3308, 0x17b1: 0x3308, 0x17b2: 0x3308, 0x17b3: 0x3308, 0x17b4: 0x3308, 0x17b5: 0x0040,
 	0x17b6: 0x0040, 0x17b7: 0x0040, 0x17b8: 0x0040, 0x17b9: 0x0040, 0x17ba: 0x0040, 0x17bb: 0x0040,
 	0x17bc: 0x0040, 0x17bd: 0x0040, 0x17be: 0x0040, 0x17bf: 0x0040,
 	// Block 0x5f, offset 0x17c0
-	0x17c0: 0x3308, 0x17c1: 0x3308, 0x17c2: 0x3008, 0x17c3: 0x3008, 0x17c4: 0x0040, 0x17c5: 0x0008,
-	0x17c6: 0x0008, 0x17c7: 0x0008, 0x17c8: 0x0008, 0x17c9: 0x0008, 0x17ca: 0x0008, 0x17cb: 0x0008,
-	0x17cc: 0x0008, 0x17cd: 0x0040, 0x17ce: 0x0040, 0x17cf: 0x0008, 0x17d0: 0x0008, 0x17d1: 0x0040,
-	0x17d2: 0x0040, 0x17d3: 0x0008, 0x17d4: 0x0008, 0x17d5: 0x0008, 0x17d6: 0x0008, 0x17d7: 0x0008,
+	0x17c0: 0x0008, 0x17c1: 0x0008, 0x17c2: 0x0008, 0x17c3: 0x0008, 0x17c4: 0x0008, 0x17c5: 0x0008,
+	0x17c6: 0x0008, 0x17c7: 0x0040, 0x17c8: 0x0040, 0x17c9: 0x0008, 0x17ca: 0x0040, 0x17cb: 0x0040,
+	0x17cc: 0x0008, 0x17cd: 0x0008, 0x17ce: 0x0008, 0x17cf: 0x0008, 0x17d0: 0x0008, 0x17d1: 0x0008,
+	0x17d2: 0x0008, 0x17d3: 0x0008, 0x17d4: 0x0040, 0x17d5: 0x0008, 0x17d6: 0x0008, 0x17d7: 0x0040,
 	0x17d8: 0x0008, 0x17d9: 0x0008, 0x17da: 0x0008, 0x17db: 0x0008, 0x17dc: 0x0008, 0x17dd: 0x0008,
 	0x17de: 0x0008, 0x17df: 0x0008, 0x17e0: 0x0008, 0x17e1: 0x0008, 0x17e2: 0x0008, 0x17e3: 0x0008,
-	0x17e4: 0x0008, 0x17e5: 0x0008, 0x17e6: 0x0008, 0x17e7: 0x0008, 0x17e8: 0x0008, 0x17e9: 0x0040,
+	0x17e4: 0x0008, 0x17e5: 0x0008, 0x17e6: 0x0008, 0x17e7: 0x0008, 0x17e8: 0x0008, 0x17e9: 0x0008,
 	0x17ea: 0x0008, 0x17eb: 0x0008, 0x17ec: 0x0008, 0x17ed: 0x0008, 0x17ee: 0x0008, 0x17ef: 0x0008,
-	0x17f0: 0x0008, 0x17f1: 0x0040, 0x17f2: 0x0008, 0x17f3: 0x0008, 0x17f4: 0x0040, 0x17f5: 0x0008,
-	0x17f6: 0x0008, 0x17f7: 0x0008, 0x17f8: 0x0008, 0x17f9: 0x0008, 0x17fa: 0x0040, 0x17fb: 0x3308,
-	0x17fc: 0x3308, 0x17fd: 0x0008, 0x17fe: 0x3008, 0x17ff: 0x3008,
+	0x17f0: 0x3008, 0x17f1: 0x3008, 0x17f2: 0x3008, 0x17f3: 0x3008, 0x17f4: 0x3008, 0x17f5: 0x3008,
+	0x17f6: 0x0040, 0x17f7: 0x3008, 0x17f8: 0x3008, 0x17f9: 0x0040, 0x17fa: 0x0040, 0x17fb: 0x3308,
+	0x17fc: 0x3308, 0x17fd: 0x3808, 0x17fe: 0x3b08, 0x17ff: 0x0008,
 	// Block 0x60, offset 0x1800
-	0x1800: 0x3308, 0x1801: 0x3008, 0x1802: 0x3008, 0x1803: 0x3008, 0x1804: 0x3008, 0x1805: 0x0040,
-	0x1806: 0x0040, 0x1807: 0x3008, 0x1808: 0x3008, 0x1809: 0x0040, 0x180a: 0x0040, 0x180b: 0x3008,
-	0x180c: 0x3008, 0x180d: 0x3808, 0x180e: 0x0040, 0x180f: 0x0040, 0x1810: 0x0008, 0x1811: 0x0040,
-	0x1812: 0x0040, 0x1813: 0x0040, 0x1814: 0x0040, 0x1815: 0x0040, 0x1816: 0x0040, 0x1817: 0x3008,
-	0x1818: 0x0040, 0x1819: 0x0040, 0x181a: 0x0040, 0x181b: 0x0040, 0x181c: 0x0040, 0x181d: 0x0008,
-	0x181e: 0x0008, 0x181f: 0x0008, 0x1820: 0x0008, 0x1821: 0x0008, 0x1822: 0x3008, 0x1823: 0x3008,
-	0x1824: 0x0040, 0x1825: 0x0040, 0x1826: 0x3308, 0x1827: 0x3308, 0x1828: 0x3308, 0x1829: 0x3308,
-	0x182a: 0x3308, 0x182b: 0x3308, 0x182c: 0x3308, 0x182d: 0x0040, 0x182e: 0x0040, 0x182f: 0x0040,
-	0x1830: 0x3308, 0x1831: 0x3308, 0x1832: 0x3308, 0x1833: 0x3308, 0x1834: 0x3308, 0x1835: 0x0040,
-	0x1836: 0x0040, 0x1837: 0x0040, 0x1838: 0x0040, 0x1839: 0x0040, 0x183a: 0x0040, 0x183b: 0x0040,
-	0x183c: 0x0040, 0x183d: 0x0040, 0x183e: 0x0040, 0x183f: 0x0040,
+	0x1800: 0x0019, 0x1801: 0x02e9, 0x1802: 0x03d9, 0x1803: 0x02f1, 0x1804: 0x02f9, 0x1805: 0x03f1,
+	0x1806: 0x0309, 0x1807: 0x00a9, 0x1808: 0x0311, 0x1809: 0x00b1, 0x180a: 0x0319, 0x180b: 0x0101,
+	0x180c: 0x0321, 0x180d: 0x0329, 0x180e: 0x0051, 0x180f: 0x0339, 0x1810: 0x0751, 0x1811: 0x00b9,
+	0x1812: 0x0089, 0x1813: 0x0341, 0x1814: 0x0349, 0x1815: 0x0391, 0x1816: 0x00c1, 0x1817: 0x0109,
+	0x1818: 0x00c9, 0x1819: 0x04b1, 0x181a: 0x0019, 0x181b: 0x02e9, 0x181c: 0x03d9, 0x181d: 0x02f1,
+	0x181e: 0x02f9, 0x181f: 0x03f1, 0x1820: 0x0309, 0x1821: 0x00a9, 0x1822: 0x0311, 0x1823: 0x00b1,
+	0x1824: 0x0319, 0x1825: 0x0101, 0x1826: 0x0321, 0x1827: 0x0329, 0x1828: 0x0051, 0x1829: 0x0339,
+	0x182a: 0x0751, 0x182b: 0x00b9, 0x182c: 0x0089, 0x182d: 0x0341, 0x182e: 0x0349, 0x182f: 0x0391,
+	0x1830: 0x00c1, 0x1831: 0x0109, 0x1832: 0x00c9, 0x1833: 0x04b1, 0x1834: 0x0019, 0x1835: 0x02e9,
+	0x1836: 0x03d9, 0x1837: 0x02f1, 0x1838: 0x02f9, 0x1839: 0x03f1, 0x183a: 0x0309, 0x183b: 0x00a9,
+	0x183c: 0x0311, 0x183d: 0x00b1, 0x183e: 0x0319, 0x183f: 0x0101,
 	// Block 0x61, offset 0x1840
-	0x1840: 0x0008, 0x1841: 0x0008, 0x1842: 0x0008, 0x1843: 0x0008, 0x1844: 0x0008, 0x1845: 0x0008,
-	0x1846: 0x0008, 0x1847: 0x0040, 0x1848: 0x0040, 0x1849: 0x0008, 0x184a: 0x0040, 0x184b: 0x0040,
-	0x184c: 0x0008, 0x184d: 0x0008, 0x184e: 0x0008, 0x184f: 0x0008, 0x1850: 0x0008, 0x1851: 0x0008,
-	0x1852: 0x0008, 0x1853: 0x0008, 0x1854: 0x0040, 0x1855: 0x0008, 0x1856: 0x0008, 0x1857: 0x0040,
-	0x1858: 0x0008, 0x1859: 0x0008, 0x185a: 0x0008, 0x185b: 0x0008, 0x185c: 0x0008, 0x185d: 0x0008,
-	0x185e: 0x0008, 0x185f: 0x0008, 0x1860: 0x0008, 0x1861: 0x0008, 0x1862: 0x0008, 0x1863: 0x0008,
-	0x1864: 0x0008, 0x1865: 0x0008, 0x1866: 0x0008, 0x1867: 0x0008, 0x1868: 0x0008, 0x1869: 0x0008,
-	0x186a: 0x0008, 0x186b: 0x0008, 0x186c: 0x0008, 0x186d: 0x0008, 0x186e: 0x0008, 0x186f: 0x0008,
-	0x1870: 0x3008, 0x1871: 0x3008, 0x1872: 0x3008, 0x1873: 0x3008, 0x1874: 0x3008, 0x1875: 0x3008,
-	0x1876: 0x0040, 0x1877: 0x3008, 0x1878: 0x3008, 0x1879: 0x0040, 0x187a: 0x0040, 0x187b: 0x3308,
-	0x187c: 0x3308, 0x187d: 0x3808, 0x187e: 0x3b08, 0x187f: 0x0008,
+	0x1840: 0x0321, 0x1841: 0x0329, 0x1842: 0x0051, 0x1843: 0x0339, 0x1844: 0x0751, 0x1845: 0x00b9,
+	0x1846: 0x0089, 0x1847: 0x0341, 0x1848: 0x0349, 0x1849: 0x0391, 0x184a: 0x00c1, 0x184b: 0x0109,
+	0x184c: 0x00c9, 0x184d: 0x04b1, 0x184e: 0x0019, 0x184f: 0x02e9, 0x1850: 0x03d9, 0x1851: 0x02f1,
+	0x1852: 0x02f9, 0x1853: 0x03f1, 0x1854: 0x0309, 0x1855: 0x0040, 0x1856: 0x0311, 0x1857: 0x00b1,
+	0x1858: 0x0319, 0x1859: 0x0101, 0x185a: 0x0321, 0x185b: 0x0329, 0x185c: 0x0051, 0x185d: 0x0339,
+	0x185e: 0x0751, 0x185f: 0x00b9, 0x1860: 0x0089, 0x1861: 0x0341, 0x1862: 0x0349, 0x1863: 0x0391,
+	0x1864: 0x00c1, 0x1865: 0x0109, 0x1866: 0x00c9, 0x1867: 0x04b1, 0x1868: 0x0019, 0x1869: 0x02e9,
+	0x186a: 0x03d9, 0x186b: 0x02f1, 0x186c: 0x02f9, 0x186d: 0x03f1, 0x186e: 0x0309, 0x186f: 0x00a9,
+	0x1870: 0x0311, 0x1871: 0x00b1, 0x1872: 0x0319, 0x1873: 0x0101, 0x1874: 0x0321, 0x1875: 0x0329,
+	0x1876: 0x0051, 0x1877: 0x0339, 0x1878: 0x0751, 0x1879: 0x00b9, 0x187a: 0x0089, 0x187b: 0x0341,
+	0x187c: 0x0349, 0x187d: 0x0391, 0x187e: 0x00c1, 0x187f: 0x0109,
 	// Block 0x62, offset 0x1880
-	0x1880: 0x0039, 0x1881: 0x0ee9, 0x1882: 0x1159, 0x1883: 0x0ef9, 0x1884: 0x0f09, 0x1885: 0x1199,
-	0x1886: 0x0f31, 0x1887: 0x0249, 0x1888: 0x0f41, 0x1889: 0x0259, 0x188a: 0x0f51, 0x188b: 0x0359,
-	0x188c: 0x0f61, 0x188d: 0x0f71, 0x188e: 0x00d9, 0x188f: 0x0f99, 0x1890: 0x2039, 0x1891: 0x0269,
-	0x1892: 0x01d9, 0x1893: 0x0fa9, 0x1894: 0x0fb9, 0x1895: 0x1089, 0x1896: 0x0279, 0x1897: 0x0369,
-	0x1898: 0x0289, 0x1899: 0x13d1, 0x189a: 0x0039, 0x189b: 0x0ee9, 0x189c: 0x1159, 0x189d: 0x0ef9,
-	0x189e: 0x0f09, 0x189f: 0x1199, 0x18a0: 0x0f31, 0x18a1: 0x0249, 0x18a2: 0x0f41, 0x18a3: 0x0259,
-	0x18a4: 0x0f51, 0x18a5: 0x0359, 0x18a6: 0x0f61, 0x18a7: 0x0f71, 0x18a8: 0x00d9, 0x18a9: 0x0f99,
-	0x18aa: 0x2039, 0x18ab: 0x0269, 0x18ac: 0x01d9, 0x18ad: 0x0fa9, 0x18ae: 0x0fb9, 0x18af: 0x1089,
-	0x18b0: 0x0279, 0x18b1: 0x0369, 0x18b2: 0x0289, 0x18b3: 0x13d1, 0x18b4: 0x0039, 0x18b5: 0x0ee9,
-	0x18b6: 0x1159, 0x18b7: 0x0ef9, 0x18b8: 0x0f09, 0x18b9: 0x1199, 0x18ba: 0x0f31, 0x18bb: 0x0249,
-	0x18bc: 0x0f41, 0x18bd: 0x0259, 0x18be: 0x0f51, 0x18bf: 0x0359,
+	0x1880: 0x00c9, 0x1881: 0x04b1, 0x1882: 0x0019, 0x1883: 0x02e9, 0x1884: 0x03d9, 0x1885: 0x02f1,
+	0x1886: 0x02f9, 0x1887: 0x03f1, 0x1888: 0x0309, 0x1889: 0x00a9, 0x188a: 0x0311, 0x188b: 0x00b1,
+	0x188c: 0x0319, 0x188d: 0x0101, 0x188e: 0x0321, 0x188f: 0x0329, 0x1890: 0x0051, 0x1891: 0x0339,
+	0x1892: 0x0751, 0x1893: 0x00b9, 0x1894: 0x0089, 0x1895: 0x0341, 0x1896: 0x0349, 0x1897: 0x0391,
+	0x1898: 0x00c1, 0x1899: 0x0109, 0x189a: 0x00c9, 0x189b: 0x04b1, 0x189c: 0x0019, 0x189d: 0x0040,
+	0x189e: 0x03d9, 0x189f: 0x02f1, 0x18a0: 0x0040, 0x18a1: 0x0040, 0x18a2: 0x0309, 0x18a3: 0x0040,
+	0x18a4: 0x0040, 0x18a5: 0x00b1, 0x18a6: 0x0319, 0x18a7: 0x0040, 0x18a8: 0x0040, 0x18a9: 0x0329,
+	0x18aa: 0x0051, 0x18ab: 0x0339, 0x18ac: 0x0751, 0x18ad: 0x0040, 0x18ae: 0x0089, 0x18af: 0x0341,
+	0x18b0: 0x0349, 0x18b1: 0x0391, 0x18b2: 0x00c1, 0x18b3: 0x0109, 0x18b4: 0x00c9, 0x18b5: 0x04b1,
+	0x18b6: 0x0019, 0x18b7: 0x02e9, 0x18b8: 0x03d9, 0x18b9: 0x02f1, 0x18ba: 0x0040, 0x18bb: 0x03f1,
+	0x18bc: 0x0040, 0x18bd: 0x00a9, 0x18be: 0x0311, 0x18bf: 0x00b1,
 	// Block 0x63, offset 0x18c0
-	0x18c0: 0x0f61, 0x18c1: 0x0f71, 0x18c2: 0x00d9, 0x18c3: 0x0f99, 0x18c4: 0x2039, 0x18c5: 0x0269,
-	0x18c6: 0x01d9, 0x18c7: 0x0fa9, 0x18c8: 0x0fb9, 0x18c9: 0x1089, 0x18ca: 0x0279, 0x18cb: 0x0369,
-	0x18cc: 0x0289, 0x18cd: 0x13d1, 0x18ce: 0x0039, 0x18cf: 0x0ee9, 0x18d0: 0x1159, 0x18d1: 0x0ef9,
-	0x18d2: 0x0f09, 0x18d3: 0x1199, 0x18d4: 0x0f31, 0x18d5: 0x0040, 0x18d6: 0x0f41, 0x18d7: 0x0259,
-	0x18d8: 0x0f51, 0x18d9: 0x0359, 0x18da: 0x0f61, 0x18db: 0x0f71, 0x18dc: 0x00d9, 0x18dd: 0x0f99,
-	0x18de: 0x2039, 0x18df: 0x0269, 0x18e0: 0x01d9, 0x18e1: 0x0fa9, 0x18e2: 0x0fb9, 0x18e3: 0x1089,
-	0x18e4: 0x0279, 0x18e5: 0x0369, 0x18e6: 0x0289, 0x18e7: 0x13d1, 0x18e8: 0x0039, 0x18e9: 0x0ee9,
-	0x18ea: 0x1159, 0x18eb: 0x0ef9, 0x18ec: 0x0f09, 0x18ed: 0x1199, 0x18ee: 0x0f31, 0x18ef: 0x0249,
-	0x18f0: 0x0f41, 0x18f1: 0x0259, 0x18f2: 0x0f51, 0x18f3: 0x0359, 0x18f4: 0x0f61, 0x18f5: 0x0f71,
-	0x18f6: 0x00d9, 0x18f7: 0x0f99, 0x18f8: 0x2039, 0x18f9: 0x0269, 0x18fa: 0x01d9, 0x18fb: 0x0fa9,
-	0x18fc: 0x0fb9, 0x18fd: 0x1089, 0x18fe: 0x0279, 0x18ff: 0x0369,
+	0x18c0: 0x0319, 0x18c1: 0x0101, 0x18c2: 0x0321, 0x18c3: 0x0329, 0x18c4: 0x0040, 0x18c5: 0x0339,
+	0x18c6: 0x0751, 0x18c7: 0x00b9, 0x18c8: 0x0089, 0x18c9: 0x0341, 0x18ca: 0x0349, 0x18cb: 0x0391,
+	0x18cc: 0x00c1, 0x18cd: 0x0109, 0x18ce: 0x00c9, 0x18cf: 0x04b1, 0x18d0: 0x0019, 0x18d1: 0x02e9,
+	0x18d2: 0x03d9, 0x18d3: 0x02f1, 0x18d4: 0x02f9, 0x18d5: 0x03f1, 0x18d6: 0x0309, 0x18d7: 0x00a9,
+	0x18d8: 0x0311, 0x18d9: 0x00b1, 0x18da: 0x0319, 0x18db: 0x0101, 0x18dc: 0x0321, 0x18dd: 0x0329,
+	0x18de: 0x0051, 0x18df: 0x0339, 0x18e0: 0x0751, 0x18e1: 0x00b9, 0x18e2: 0x0089, 0x18e3: 0x0341,
+	0x18e4: 0x0349, 0x18e5: 0x0391, 0x18e6: 0x00c1, 0x18e7: 0x0109, 0x18e8: 0x00c9, 0x18e9: 0x04b1,
+	0x18ea: 0x0019, 0x18eb: 0x02e9, 0x18ec: 0x03d9, 0x18ed: 0x02f1, 0x18ee: 0x02f9, 0x18ef: 0x03f1,
+	0x18f0: 0x0309, 0x18f1: 0x00a9, 0x18f2: 0x0311, 0x18f3: 0x00b1, 0x18f4: 0x0319, 0x18f5: 0x0101,
+	0x18f6: 0x0321, 0x18f7: 0x0329, 0x18f8: 0x0051, 0x18f9: 0x0339, 0x18fa: 0x0751, 0x18fb: 0x00b9,
+	0x18fc: 0x0089, 0x18fd: 0x0341, 0x18fe: 0x0349, 0x18ff: 0x0391,
 	// Block 0x64, offset 0x1900
-	0x1900: 0x0289, 0x1901: 0x13d1, 0x1902: 0x0039, 0x1903: 0x0ee9, 0x1904: 0x1159, 0x1905: 0x0ef9,
-	0x1906: 0x0f09, 0x1907: 0x1199, 0x1908: 0x0f31, 0x1909: 0x0249, 0x190a: 0x0f41, 0x190b: 0x0259,
-	0x190c: 0x0f51, 0x190d: 0x0359, 0x190e: 0x0f61, 0x190f: 0x0f71, 0x1910: 0x00d9, 0x1911: 0x0f99,
-	0x1912: 0x2039, 0x1913: 0x0269, 0x1914: 0x01d9, 0x1915: 0x0fa9, 0x1916: 0x0fb9, 0x1917: 0x1089,
-	0x1918: 0x0279, 0x1919: 0x0369, 0x191a: 0x0289, 0x191b: 0x13d1, 0x191c: 0x0039, 0x191d: 0x0040,
-	0x191e: 0x1159, 0x191f: 0x0ef9, 0x1920: 0x0040, 0x1921: 0x0040, 0x1922: 0x0f31, 0x1923: 0x0040,
-	0x1924: 0x0040, 0x1925: 0x0259, 0x1926: 0x0f51, 0x1927: 0x0040, 0x1928: 0x0040, 0x1929: 0x0f71,
-	0x192a: 0x00d9, 0x192b: 0x0f99, 0x192c: 0x2039, 0x192d: 0x0040, 0x192e: 0x01d9, 0x192f: 0x0fa9,
-	0x1930: 0x0fb9, 0x1931: 0x1089, 0x1932: 0x0279, 0x1933: 0x0369, 0x1934: 0x0289, 0x1935: 0x13d1,
-	0x1936: 0x0039, 0x1937: 0x0ee9, 0x1938: 0x1159, 0x1939: 0x0ef9, 0x193a: 0x0040, 0x193b: 0x1199,
-	0x193c: 0x0040, 0x193d: 0x0249, 0x193e: 0x0f41, 0x193f: 0x0259,
+	0x1900: 0x00c1, 0x1901: 0x0109, 0x1902: 0x00c9, 0x1903: 0x04b1, 0x1904: 0x0019, 0x1905: 0x02e9,
+	0x1906: 0x0040, 0x1907: 0x02f1, 0x1908: 0x02f9, 0x1909: 0x03f1, 0x190a: 0x0309, 0x190b: 0x0040,
+	0x190c: 0x0040, 0x190d: 0x00b1, 0x190e: 0x0319, 0x190f: 0x0101, 0x1910: 0x0321, 0x1911: 0x0329,
+	0x1912: 0x0051, 0x1913: 0x0339, 0x1914: 0x0751, 0x1915: 0x0040, 0x1916: 0x0089, 0x1917: 0x0341,
+	0x1918: 0x0349, 0x1919: 0x0391, 0x191a: 0x00c1, 0x191b: 0x0109, 0x191c: 0x00c9, 0x191d: 0x0040,
+	0x191e: 0x0019, 0x191f: 0x02e9, 0x1920: 0x03d9, 0x1921: 0x02f1, 0x1922: 0x02f9, 0x1923: 0x03f1,
+	0x1924: 0x0309, 0x1925: 0x00a9, 0x1926: 0x0311, 0x1927: 0x00b1, 0x1928: 0x0319, 0x1929: 0x0101,
+	0x192a: 0x0321, 0x192b: 0x0329, 0x192c: 0x0051, 0x192d: 0x0339, 0x192e: 0x0751, 0x192f: 0x00b9,
+	0x1930: 0x0089, 0x1931: 0x0341, 0x1932: 0x0349, 0x1933: 0x0391, 0x1934: 0x00c1, 0x1935: 0x0109,
+	0x1936: 0x00c9, 0x1937: 0x04b1, 0x1938: 0x0019, 0x1939: 0x02e9, 0x193a: 0x0040, 0x193b: 0x02f1,
+	0x193c: 0x02f9, 0x193d: 0x03f1, 0x193e: 0x0309, 0x193f: 0x0040,
 	// Block 0x65, offset 0x1940
-	0x1940: 0x0f51, 0x1941: 0x0359, 0x1942: 0x0f61, 0x1943: 0x0f71, 0x1944: 0x0040, 0x1945: 0x0f99,
-	0x1946: 0x2039, 0x1947: 0x0269, 0x1948: 0x01d9, 0x1949: 0x0fa9, 0x194a: 0x0fb9, 0x194b: 0x1089,
-	0x194c: 0x0279, 0x194d: 0x0369, 0x194e: 0x0289, 0x194f: 0x13d1, 0x1950: 0x0039, 0x1951: 0x0ee9,
-	0x1952: 0x1159, 0x1953: 0x0ef9, 0x1954: 0x0f09, 0x1955: 0x1199, 0x1956: 0x0f31, 0x1957: 0x0249,
-	0x1958: 0x0f41, 0x1959: 0x0259, 0x195a: 0x0f51, 0x195b: 0x0359, 0x195c: 0x0f61, 0x195d: 0x0f71,
-	0x195e: 0x00d9, 0x195f: 0x0f99, 0x1960: 0x2039, 0x1961: 0x0269, 0x1962: 0x01d9, 0x1963: 0x0fa9,
-	0x1964: 0x0fb9, 0x1965: 0x1089, 0x1966: 0x0279, 0x1967: 0x0369, 0x1968: 0x0289, 0x1969: 0x13d1,
-	0x196a: 0x0039, 0x196b: 0x0ee9, 0x196c: 0x1159, 0x196d: 0x0ef9, 0x196e: 0x0f09, 0x196f: 0x1199,
-	0x1970: 0x0f31, 0x1971: 0x0249, 0x1972: 0x0f41, 0x1973: 0x0259, 0x1974: 0x0f51, 0x1975: 0x0359,
-	0x1976: 0x0f61, 0x1977: 0x0f71, 0x1978: 0x00d9, 0x1979: 0x0f99, 0x197a: 0x2039, 0x197b: 0x0269,
-	0x197c: 0x01d9, 0x197d: 0x0fa9, 0x197e: 0x0fb9, 0x197f: 0x1089,
+	0x1940: 0x0311, 0x1941: 0x00b1, 0x1942: 0x0319, 0x1943: 0x0101, 0x1944: 0x0321, 0x1945: 0x0040,
+	0x1946: 0x0051, 0x1947: 0x0040, 0x1948: 0x0040, 0x1949: 0x0040, 0x194a: 0x0089, 0x194b: 0x0341,
+	0x194c: 0x0349, 0x194d: 0x0391, 0x194e: 0x00c1, 0x194f: 0x0109, 0x1950: 0x00c9, 0x1951: 0x0040,
+	0x1952: 0x0019, 0x1953: 0x02e9, 0x1954: 0x03d9, 0x1955: 0x02f1, 0x1956: 0x02f9, 0x1957: 0x03f1,
+	0x1958: 0x0309, 0x1959: 0x00a9, 0x195a: 0x0311, 0x195b: 0x00b1, 0x195c: 0x0319, 0x195d: 0x0101,
+	0x195e: 0x0321, 0x195f: 0x0329, 0x1960: 0x0051, 0x1961: 0x0339, 0x1962: 0x0751, 0x1963: 0x00b9,
+	0x1964: 0x0089, 0x1965: 0x0341, 0x1966: 0x0349, 0x1967: 0x0391, 0x1968: 0x00c1, 0x1969: 0x0109,
+	0x196a: 0x00c9, 0x196b: 0x04b1, 0x196c: 0x0019, 0x196d: 0x02e9, 0x196e: 0x03d9, 0x196f: 0x02f1,
+	0x1970: 0x02f9, 0x1971: 0x03f1, 0x1972: 0x0309, 0x1973: 0x00a9, 0x1974: 0x0311, 0x1975: 0x00b1,
+	0x1976: 0x0319, 0x1977: 0x0101, 0x1978: 0x0321, 0x1979: 0x0329, 0x197a: 0x0051, 0x197b: 0x0339,
+	0x197c: 0x0751, 0x197d: 0x00b9, 0x197e: 0x0089, 0x197f: 0x0341,
 	// Block 0x66, offset 0x1980
-	0x1980: 0x0279, 0x1981: 0x0369, 0x1982: 0x0289, 0x1983: 0x13d1, 0x1984: 0x0039, 0x1985: 0x0ee9,
-	0x1986: 0x0040, 0x1987: 0x0ef9, 0x1988: 0x0f09, 0x1989: 0x1199, 0x198a: 0x0f31, 0x198b: 0x0040,
-	0x198c: 0x0040, 0x198d: 0x0259, 0x198e: 0x0f51, 0x198f: 0x0359, 0x1990: 0x0f61, 0x1991: 0x0f71,
-	0x1992: 0x00d9, 0x1993: 0x0f99, 0x1994: 0x2039, 0x1995: 0x0040, 0x1996: 0x01d9, 0x1997: 0x0fa9,
-	0x1998: 0x0fb9, 0x1999: 0x1089, 0x199a: 0x0279, 0x199b: 0x0369, 0x199c: 0x0289, 0x199d: 0x0040,
-	0x199e: 0x0039, 0x199f: 0x0ee9, 0x19a0: 0x1159, 0x19a1: 0x0ef9, 0x19a2: 0x0f09, 0x19a3: 0x1199,
-	0x19a4: 0x0f31, 0x19a5: 0x0249, 0x19a6: 0x0f41, 0x19a7: 0x0259, 0x19a8: 0x0f51, 0x19a9: 0x0359,
-	0x19aa: 0x0f61, 0x19ab: 0x0f71, 0x19ac: 0x00d9, 0x19ad: 0x0f99, 0x19ae: 0x2039, 0x19af: 0x0269,
-	0x19b0: 0x01d9, 0x19b1: 0x0fa9, 0x19b2: 0x0fb9, 0x19b3: 0x1089, 0x19b4: 0x0279, 0x19b5: 0x0369,
-	0x19b6: 0x0289, 0x19b7: 0x13d1, 0x19b8: 0x0039, 0x19b9: 0x0ee9, 0x19ba: 0x0040, 0x19bb: 0x0ef9,
-	0x19bc: 0x0f09, 0x19bd: 0x1199, 0x19be: 0x0f31, 0x19bf: 0x0040,
+	0x1980: 0x0349, 0x1981: 0x0391, 0x1982: 0x00c1, 0x1983: 0x0109, 0x1984: 0x00c9, 0x1985: 0x04b1,
+	0x1986: 0x0019, 0x1987: 0x02e9, 0x1988: 0x03d9, 0x1989: 0x02f1, 0x198a: 0x02f9, 0x198b: 0x03f1,
+	0x198c: 0x0309, 0x198d: 0x00a9, 0x198e: 0x0311, 0x198f: 0x00b1, 0x1990: 0x0319, 0x1991: 0x0101,
+	0x1992: 0x0321, 0x1993: 0x0329, 0x1994: 0x0051, 0x1995: 0x0339, 0x1996: 0x0751, 0x1997: 0x00b9,
+	0x1998: 0x0089, 0x1999: 0x0341, 0x199a: 0x0349, 0x199b: 0x0391, 0x199c: 0x00c1, 0x199d: 0x0109,
+	0x199e: 0x00c9, 0x199f: 0x04b1, 0x19a0: 0x0019, 0x19a1: 0x02e9, 0x19a2: 0x03d9, 0x19a3: 0x02f1,
+	0x19a4: 0x02f9, 0x19a5: 0x03f1, 0x19a6: 0x0309, 0x19a7: 0x00a9, 0x19a8: 0x0311, 0x19a9: 0x00b1,
+	0x19aa: 0x0319, 0x19ab: 0x0101, 0x19ac: 0x0321, 0x19ad: 0x0329, 0x19ae: 0x0051, 0x19af: 0x0339,
+	0x19b0: 0x0751, 0x19b1: 0x00b9, 0x19b2: 0x0089, 0x19b3: 0x0341, 0x19b4: 0x0349, 0x19b5: 0x0391,
+	0x19b6: 0x00c1, 0x19b7: 0x0109, 0x19b8: 0x00c9, 0x19b9: 0x04b1, 0x19ba: 0x0019, 0x19bb: 0x02e9,
+	0x19bc: 0x03d9, 0x19bd: 0x02f1, 0x19be: 0x02f9, 0x19bf: 0x03f1,
 	// Block 0x67, offset 0x19c0
-	0x19c0: 0x0f41, 0x19c1: 0x0259, 0x19c2: 0x0f51, 0x19c3: 0x0359, 0x19c4: 0x0f61, 0x19c5: 0x0040,
-	0x19c6: 0x00d9, 0x19c7: 0x0040, 0x19c8: 0x0040, 0x19c9: 0x0040, 0x19ca: 0x01d9, 0x19cb: 0x0fa9,
-	0x19cc: 0x0fb9, 0x19cd: 0x1089, 0x19ce: 0x0279, 0x19cf: 0x0369, 0x19d0: 0x0289, 0x19d1: 0x0040,
-	0x19d2: 0x0039, 0x19d3: 0x0ee9, 0x19d4: 0x1159, 0x19d5: 0x0ef9, 0x19d6: 0x0f09, 0x19d7: 0x1199,
-	0x19d8: 0x0f31, 0x19d9: 0x0249, 0x19da: 0x0f41, 0x19db: 0x0259, 0x19dc: 0x0f51, 0x19dd: 0x0359,
-	0x19de: 0x0f61, 0x19df: 0x0f71, 0x19e0: 0x00d9, 0x19e1: 0x0f99, 0x19e2: 0x2039, 0x19e3: 0x0269,
-	0x19e4: 0x01d9, 0x19e5: 0x0fa9, 0x19e6: 0x0fb9, 0x19e7: 0x1089, 0x19e8: 0x0279, 0x19e9: 0x0369,
-	0x19ea: 0x0289, 0x19eb: 0x13d1, 0x19ec: 0x0039, 0x19ed: 0x0ee9, 0x19ee: 0x1159, 0x19ef: 0x0ef9,
-	0x19f0: 0x0f09, 0x19f1: 0x1199, 0x19f2: 0x0f31, 0x19f3: 0x0249, 0x19f4: 0x0f41, 0x19f5: 0x0259,
-	0x19f6: 0x0f51, 0x19f7: 0x0359, 0x19f8: 0x0f61, 0x19f9: 0x0f71, 0x19fa: 0x00d9, 0x19fb: 0x0f99,
-	0x19fc: 0x2039, 0x19fd: 0x0269, 0x19fe: 0x01d9, 0x19ff: 0x0fa9,
+	0x19c0: 0x0309, 0x19c1: 0x00a9, 0x19c2: 0x0311, 0x19c3: 0x00b1, 0x19c4: 0x0319, 0x19c5: 0x0101,
+	0x19c6: 0x0321, 0x19c7: 0x0329, 0x19c8: 0x0051, 0x19c9: 0x0339, 0x19ca: 0x0751, 0x19cb: 0x00b9,
+	0x19cc: 0x0089, 0x19cd: 0x0341, 0x19ce: 0x0349, 0x19cf: 0x0391, 0x19d0: 0x00c1, 0x19d1: 0x0109,
+	0x19d2: 0x00c9, 0x19d3: 0x04b1, 0x19d4: 0x0019, 0x19d5: 0x02e9, 0x19d6: 0x03d9, 0x19d7: 0x02f1,
+	0x19d8: 0x02f9, 0x19d9: 0x03f1, 0x19da: 0x0309, 0x19db: 0x00a9, 0x19dc: 0x0311, 0x19dd: 0x00b1,
+	0x19de: 0x0319, 0x19df: 0x0101, 0x19e0: 0x0321, 0x19e1: 0x0329, 0x19e2: 0x0051, 0x19e3: 0x0339,
+	0x19e4: 0x0751, 0x19e5: 0x00b9, 0x19e6: 0x0089, 0x19e7: 0x0341, 0x19e8: 0x0349, 0x19e9: 0x0391,
+	0x19ea: 0x00c1, 0x19eb: 0x0109, 0x19ec: 0x00c9, 0x19ed: 0x04b1, 0x19ee: 0x0019, 0x19ef: 0x02e9,
+	0x19f0: 0x03d9, 0x19f1: 0x02f1, 0x19f2: 0x02f9, 0x19f3: 0x03f1, 0x19f4: 0x0309, 0x19f5: 0x00a9,
+	0x19f6: 0x0311, 0x19f7: 0x00b1, 0x19f8: 0x0319, 0x19f9: 0x0101, 0x19fa: 0x0321, 0x19fb: 0x0329,
+	0x19fc: 0x0051, 0x19fd: 0x0339, 0x19fe: 0x0751, 0x19ff: 0x00b9,
 	// Block 0x68, offset 0x1a00
-	0x1a00: 0x0fb9, 0x1a01: 0x1089, 0x1a02: 0x0279, 0x1a03: 0x0369, 0x1a04: 0x0289, 0x1a05: 0x13d1,
-	0x1a06: 0x0039, 0x1a07: 0x0ee9, 0x1a08: 0x1159, 0x1a09: 0x0ef9, 0x1a0a: 0x0f09, 0x1a0b: 0x1199,
-	0x1a0c: 0x0f31, 0x1a0d: 0x0249, 0x1a0e: 0x0f41, 0x1a0f: 0x0259, 0x1a10: 0x0f51, 0x1a11: 0x0359,
-	0x1a12: 0x0f61, 0x1a13: 0x0f71, 0x1a14: 0x00d9, 0x1a15: 0x0f99, 0x1a16: 0x2039, 0x1a17: 0x0269,
-	0x1a18: 0x01d9, 0x1a19: 0x0fa9, 0x1a1a: 0x0fb9, 0x1a1b: 0x1089, 0x1a1c: 0x0279, 0x1a1d: 0x0369,
-	0x1a1e: 0x0289, 0x1a1f: 0x13d1, 0x1a20: 0x0039, 0x1a21: 0x0ee9, 0x1a22: 0x1159, 0x1a23: 0x0ef9,
-	0x1a24: 0x0f09, 0x1a25: 0x1199, 0x1a26: 0x0f31, 0x1a27: 0x0249, 0x1a28: 0x0f41, 0x1a29: 0x0259,
-	0x1a2a: 0x0f51, 0x1a2b: 0x0359, 0x1a2c: 0x0f61, 0x1a2d: 0x0f71, 0x1a2e: 0x00d9, 0x1a2f: 0x0f99,
-	0x1a30: 0x2039, 0x1a31: 0x0269, 0x1a32: 0x01d9, 0x1a33: 0x0fa9, 0x1a34: 0x0fb9, 0x1a35: 0x1089,
-	0x1a36: 0x0279, 0x1a37: 0x0369, 0x1a38: 0x0289, 0x1a39: 0x13d1, 0x1a3a: 0x0039, 0x1a3b: 0x0ee9,
-	0x1a3c: 0x1159, 0x1a3d: 0x0ef9, 0x1a3e: 0x0f09, 0x1a3f: 0x1199,
+	0x1a00: 0x0089, 0x1a01: 0x0341, 0x1a02: 0x0349, 0x1a03: 0x0391, 0x1a04: 0x00c1, 0x1a05: 0x0109,
+	0x1a06: 0x00c9, 0x1a07: 0x04b1, 0x1a08: 0x0019, 0x1a09: 0x02e9, 0x1a0a: 0x03d9, 0x1a0b: 0x02f1,
+	0x1a0c: 0x02f9, 0x1a0d: 0x03f1, 0x1a0e: 0x0309, 0x1a0f: 0x00a9, 0x1a10: 0x0311, 0x1a11: 0x00b1,
+	0x1a12: 0x0319, 0x1a13: 0x0101, 0x1a14: 0x0321, 0x1a15: 0x0329, 0x1a16: 0x0051, 0x1a17: 0x0339,
+	0x1a18: 0x0751, 0x1a19: 0x00b9, 0x1a1a: 0x0089, 0x1a1b: 0x0341, 0x1a1c: 0x0349, 0x1a1d: 0x0391,
+	0x1a1e: 0x00c1, 0x1a1f: 0x0109, 0x1a20: 0x00c9, 0x1a21: 0x04b1, 0x1a22: 0x0019, 0x1a23: 0x02e9,
+	0x1a24: 0x03d9, 0x1a25: 0x02f1, 0x1a26: 0x02f9, 0x1a27: 0x03f1, 0x1a28: 0x0309, 0x1a29: 0x00a9,
+	0x1a2a: 0x0311, 0x1a2b: 0x00b1, 0x1a2c: 0x0319, 0x1a2d: 0x0101, 0x1a2e: 0x0321, 0x1a2f: 0x0329,
+	0x1a30: 0x0051, 0x1a31: 0x0339, 0x1a32: 0x0751, 0x1a33: 0x00b9, 0x1a34: 0x0089, 0x1a35: 0x0341,
+	0x1a36: 0x0349, 0x1a37: 0x0391, 0x1a38: 0x00c1, 0x1a39: 0x0109, 0x1a3a: 0x00c9, 0x1a3b: 0x04b1,
+	0x1a3c: 0x0019, 0x1a3d: 0x02e9, 0x1a3e: 0x03d9, 0x1a3f: 0x02f1,
 	// Block 0x69, offset 0x1a40
-	0x1a40: 0x0f31, 0x1a41: 0x0249, 0x1a42: 0x0f41, 0x1a43: 0x0259, 0x1a44: 0x0f51, 0x1a45: 0x0359,
-	0x1a46: 0x0f61, 0x1a47: 0x0f71, 0x1a48: 0x00d9, 0x1a49: 0x0f99, 0x1a4a: 0x2039, 0x1a4b: 0x0269,
-	0x1a4c: 0x01d9, 0x1a4d: 0x0fa9, 0x1a4e: 0x0fb9, 0x1a4f: 0x1089, 0x1a50: 0x0279, 0x1a51: 0x0369,
-	0x1a52: 0x0289, 0x1a53: 0x13d1, 0x1a54: 0x0039, 0x1a55: 0x0ee9, 0x1a56: 0x1159, 0x1a57: 0x0ef9,
-	0x1a58: 0x0f09, 0x1a59: 0x1199, 0x1a5a: 0x0f31, 0x1a5b: 0x0249, 0x1a5c: 0x0f41, 0x1a5d: 0x0259,
-	0x1a5e: 0x0f51, 0x1a5f: 0x0359, 0x1a60: 0x0f61, 0x1a61: 0x0f71, 0x1a62: 0x00d9, 0x1a63: 0x0f99,
-	0x1a64: 0x2039, 0x1a65: 0x0269, 0x1a66: 0x01d9, 0x1a67: 0x0fa9, 0x1a68: 0x0fb9, 0x1a69: 0x1089,
-	0x1a6a: 0x0279, 0x1a6b: 0x0369, 0x1a6c: 0x0289, 0x1a6d: 0x13d1, 0x1a6e: 0x0039, 0x1a6f: 0x0ee9,
-	0x1a70: 0x1159, 0x1a71: 0x0ef9, 0x1a72: 0x0f09, 0x1a73: 0x1199, 0x1a74: 0x0f31, 0x1a75: 0x0249,
-	0x1a76: 0x0f41, 0x1a77: 0x0259, 0x1a78: 0x0f51, 0x1a79: 0x0359, 0x1a7a: 0x0f61, 0x1a7b: 0x0f71,
-	0x1a7c: 0x00d9, 0x1a7d: 0x0f99, 0x1a7e: 0x2039, 0x1a7f: 0x0269,
+	0x1a40: 0x02f9, 0x1a41: 0x03f1, 0x1a42: 0x0309, 0x1a43: 0x00a9, 0x1a44: 0x0311, 0x1a45: 0x00b1,
+	0x1a46: 0x0319, 0x1a47: 0x0101, 0x1a48: 0x0321, 0x1a49: 0x0329, 0x1a4a: 0x0051, 0x1a4b: 0x0339,
+	0x1a4c: 0x0751, 0x1a4d: 0x00b9, 0x1a4e: 0x0089, 0x1a4f: 0x0341, 0x1a50: 0x0349, 0x1a51: 0x0391,
+	0x1a52: 0x00c1, 0x1a53: 0x0109, 0x1a54: 0x00c9, 0x1a55: 0x04b1, 0x1a56: 0x0019, 0x1a57: 0x02e9,
+	0x1a58: 0x03d9, 0x1a59: 0x02f1, 0x1a5a: 0x02f9, 0x1a5b: 0x03f1, 0x1a5c: 0x0309, 0x1a5d: 0x00a9,
+	0x1a5e: 0x0311, 0x1a5f: 0x00b1, 0x1a60: 0x0319, 0x1a61: 0x0101, 0x1a62: 0x0321, 0x1a63: 0x0329,
+	0x1a64: 0x0051, 0x1a65: 0x0339, 0x1a66: 0x0751, 0x1a67: 0x00b9, 0x1a68: 0x0089, 0x1a69: 0x0341,
+	0x1a6a: 0x0349, 0x1a6b: 0x0391, 0x1a6c: 0x00c1, 0x1a6d: 0x0109, 0x1a6e: 0x00c9, 0x1a6f: 0x04b1,
+	0x1a70: 0x0019, 0x1a71: 0x02e9, 0x1a72: 0x03d9, 0x1a73: 0x02f1, 0x1a74: 0x02f9, 0x1a75: 0x03f1,
+	0x1a76: 0x0309, 0x1a77: 0x00a9, 0x1a78: 0x0311, 0x1a79: 0x00b1, 0x1a7a: 0x0319, 0x1a7b: 0x0101,
+	0x1a7c: 0x0321, 0x1a7d: 0x0329, 0x1a7e: 0x0051, 0x1a7f: 0x0339,
 	// Block 0x6a, offset 0x1a80
-	0x1a80: 0x01d9, 0x1a81: 0x0fa9, 0x1a82: 0x0fb9, 0x1a83: 0x1089, 0x1a84: 0x0279, 0x1a85: 0x0369,
-	0x1a86: 0x0289, 0x1a87: 0x13d1, 0x1a88: 0x0039, 0x1a89: 0x0ee9, 0x1a8a: 0x1159, 0x1a8b: 0x0ef9,
-	0x1a8c: 0x0f09, 0x1a8d: 0x1199, 0x1a8e: 0x0f31, 0x1a8f: 0x0249, 0x1a90: 0x0f41, 0x1a91: 0x0259,
-	0x1a92: 0x0f51, 0x1a93: 0x0359, 0x1a94: 0x0f61, 0x1a95: 0x0f71, 0x1a96: 0x00d9, 0x1a97: 0x0f99,
-	0x1a98: 0x2039, 0x1a99: 0x0269, 0x1a9a: 0x01d9, 0x1a9b: 0x0fa9, 0x1a9c: 0x0fb9, 0x1a9d: 0x1089,
-	0x1a9e: 0x0279, 0x1a9f: 0x0369, 0x1aa0: 0x0289, 0x1aa1: 0x13d1, 0x1aa2: 0x0039, 0x1aa3: 0x0ee9,
-	0x1aa4: 0x1159, 0x1aa5: 0x0ef9, 0x1aa6: 0x0f09, 0x1aa7: 0x1199, 0x1aa8: 0x0f31, 0x1aa9: 0x0249,
-	0x1aaa: 0x0f41, 0x1aab: 0x0259, 0x1aac: 0x0f51, 0x1aad: 0x0359, 0x1aae: 0x0f61, 0x1aaf: 0x0f71,
-	0x1ab0: 0x00d9, 0x1ab1: 0x0f99, 0x1ab2: 0x2039, 0x1ab3: 0x0269, 0x1ab4: 0x01d9, 0x1ab5: 0x0fa9,
-	0x1ab6: 0x0fb9, 0x1ab7: 0x1089, 0x1ab8: 0x0279, 0x1ab9: 0x0369, 0x1aba: 0x0289, 0x1abb: 0x13d1,
-	0x1abc: 0x0039, 0x1abd: 0x0ee9, 0x1abe: 0x1159, 0x1abf: 0x0ef9,
+	0x1a80: 0x0751, 0x1a81: 0x00b9, 0x1a82: 0x0089, 0x1a83: 0x0341, 0x1a84: 0x0349, 0x1a85: 0x0391,
+	0x1a86: 0x00c1, 0x1a87: 0x0109, 0x1a88: 0x00c9, 0x1a89: 0x04b1, 0x1a8a: 0x0019, 0x1a8b: 0x02e9,
+	0x1a8c: 0x03d9, 0x1a8d: 0x02f1, 0x1a8e: 0x02f9, 0x1a8f: 0x03f1, 0x1a90: 0x0309, 0x1a91: 0x00a9,
+	0x1a92: 0x0311, 0x1a93: 0x00b1, 0x1a94: 0x0319, 0x1a95: 0x0101, 0x1a96: 0x0321, 0x1a97: 0x0329,
+	0x1a98: 0x0051, 0x1a99: 0x0339, 0x1a9a: 0x0751, 0x1a9b: 0x00b9, 0x1a9c: 0x0089, 0x1a9d: 0x0341,
+	0x1a9e: 0x0349, 0x1a9f: 0x0391, 0x1aa0: 0x00c1, 0x1aa1: 0x0109, 0x1aa2: 0x00c9, 0x1aa3: 0x04b1,
+	0x1aa4: 0x2279, 0x1aa5: 0x2281, 0x1aa6: 0x0040, 0x1aa7: 0x0040, 0x1aa8: 0x2289, 0x1aa9: 0x0399,
+	0x1aaa: 0x03a1, 0x1aab: 0x03a9, 0x1aac: 0x2291, 0x1aad: 0x2299, 0x1aae: 0x22a1, 0x1aaf: 0x04d1,
+	0x1ab0: 0x05f9, 0x1ab1: 0x22a9, 0x1ab2: 0x22b1, 0x1ab3: 0x22b9, 0x1ab4: 0x22c1, 0x1ab5: 0x22c9,
+	0x1ab6: 0x22d1, 0x1ab7: 0x0799, 0x1ab8: 0x03c1, 0x1ab9: 0x04d1, 0x1aba: 0x22d9, 0x1abb: 0x22e1,
+	0x1abc: 0x22e9, 0x1abd: 0x03b1, 0x1abe: 0x03b9, 0x1abf: 0x22f1,
 	// Block 0x6b, offset 0x1ac0
-	0x1ac0: 0x0f09, 0x1ac1: 0x1199, 0x1ac2: 0x0f31, 0x1ac3: 0x0249, 0x1ac4: 0x0f41, 0x1ac5: 0x0259,
-	0x1ac6: 0x0f51, 0x1ac7: 0x0359, 0x1ac8: 0x0f61, 0x1ac9: 0x0f71, 0x1aca: 0x00d9, 0x1acb: 0x0f99,
-	0x1acc: 0x2039, 0x1acd: 0x0269, 0x1ace: 0x01d9, 0x1acf: 0x0fa9, 0x1ad0: 0x0fb9, 0x1ad1: 0x1089,
-	0x1ad2: 0x0279, 0x1ad3: 0x0369, 0x1ad4: 0x0289, 0x1ad5: 0x13d1, 0x1ad6: 0x0039, 0x1ad7: 0x0ee9,
-	0x1ad8: 0x1159, 0x1ad9: 0x0ef9, 0x1ada: 0x0f09, 0x1adb: 0x1199, 0x1adc: 0x0f31, 0x1add: 0x0249,
-	0x1ade: 0x0f41, 0x1adf: 0x0259, 0x1ae0: 0x0f51, 0x1ae1: 0x0359, 0x1ae2: 0x0f61, 0x1ae3: 0x0f71,
-	0x1ae4: 0x00d9, 0x1ae5: 0x0f99, 0x1ae6: 0x2039, 0x1ae7: 0x0269, 0x1ae8: 0x01d9, 0x1ae9: 0x0fa9,
-	0x1aea: 0x0fb9, 0x1aeb: 0x1089, 0x1aec: 0x0279, 0x1aed: 0x0369, 0x1aee: 0x0289, 0x1aef: 0x13d1,
-	0x1af0: 0x0039, 0x1af1: 0x0ee9, 0x1af2: 0x1159, 0x1af3: 0x0ef9, 0x1af4: 0x0f09, 0x1af5: 0x1199,
-	0x1af6: 0x0f31, 0x1af7: 0x0249, 0x1af8: 0x0f41, 0x1af9: 0x0259, 0x1afa: 0x0f51, 0x1afb: 0x0359,
-	0x1afc: 0x0f61, 0x1afd: 0x0f71, 0x1afe: 0x00d9, 0x1aff: 0x0f99,
+	0x1ac0: 0x0769, 0x1ac1: 0x22f9, 0x1ac2: 0x2289, 0x1ac3: 0x0399, 0x1ac4: 0x03a1, 0x1ac5: 0x03a9,
+	0x1ac6: 0x2291, 0x1ac7: 0x2299, 0x1ac8: 0x22a1, 0x1ac9: 0x04d1, 0x1aca: 0x05f9, 0x1acb: 0x22a9,
+	0x1acc: 0x22b1, 0x1acd: 0x22b9, 0x1ace: 0x22c1, 0x1acf: 0x22c9, 0x1ad0: 0x22d1, 0x1ad1: 0x0799,
+	0x1ad2: 0x03c1, 0x1ad3: 0x22d9, 0x1ad4: 0x22d9, 0x1ad5: 0x22e1, 0x1ad6: 0x22e9, 0x1ad7: 0x03b1,
+	0x1ad8: 0x03b9, 0x1ad9: 0x22f1, 0x1ada: 0x0769, 0x1adb: 0x2301, 0x1adc: 0x2291, 0x1add: 0x04d1,
+	0x1ade: 0x22a9, 0x1adf: 0x03b1, 0x1ae0: 0x03c1, 0x1ae1: 0x0799, 0x1ae2: 0x2289, 0x1ae3: 0x0399,
+	0x1ae4: 0x03a1, 0x1ae5: 0x03a9, 0x1ae6: 0x2291, 0x1ae7: 0x2299, 0x1ae8: 0x22a1, 0x1ae9: 0x04d1,
+	0x1aea: 0x05f9, 0x1aeb: 0x22a9, 0x1aec: 0x22b1, 0x1aed: 0x22b9, 0x1aee: 0x22c1, 0x1aef: 0x22c9,
+	0x1af0: 0x22d1, 0x1af1: 0x0799, 0x1af2: 0x03c1, 0x1af3: 0x04d1, 0x1af4: 0x22d9, 0x1af5: 0x22e1,
+	0x1af6: 0x22e9, 0x1af7: 0x03b1, 0x1af8: 0x03b9, 0x1af9: 0x22f1, 0x1afa: 0x0769, 0x1afb: 0x22f9,
+	0x1afc: 0x2289, 0x1afd: 0x0399, 0x1afe: 0x03a1, 0x1aff: 0x03a9,
 	// Block 0x6c, offset 0x1b00
-	0x1b00: 0x2039, 0x1b01: 0x0269, 0x1b02: 0x01d9, 0x1b03: 0x0fa9, 0x1b04: 0x0fb9, 0x1b05: 0x1089,
-	0x1b06: 0x0279, 0x1b07: 0x0369, 0x1b08: 0x0289, 0x1b09: 0x13d1, 0x1b0a: 0x0039, 0x1b0b: 0x0ee9,
-	0x1b0c: 0x1159, 0x1b0d: 0x0ef9, 0x1b0e: 0x0f09, 0x1b0f: 0x1199, 0x1b10: 0x0f31, 0x1b11: 0x0249,
-	0x1b12: 0x0f41, 0x1b13: 0x0259, 0x1b14: 0x0f51, 0x1b15: 0x0359, 0x1b16: 0x0f61, 0x1b17: 0x0f71,
-	0x1b18: 0x00d9, 0x1b19: 0x0f99, 0x1b1a: 0x2039, 0x1b1b: 0x0269, 0x1b1c: 0x01d9, 0x1b1d: 0x0fa9,
-	0x1b1e: 0x0fb9, 0x1b1f: 0x1089, 0x1b20: 0x0279, 0x1b21: 0x0369, 0x1b22: 0x0289, 0x1b23: 0x13d1,
-	0x1b24: 0xbad1, 0x1b25: 0xbae9, 0x1b26: 0x0040, 0x1b27: 0x0040, 0x1b28: 0xbb01, 0x1b29: 0x1099,
-	0x1b2a: 0x10b1, 0x1b2b: 0x10c9, 0x1b2c: 0xbb19, 0x1b2d: 0xbb31, 0x1b2e: 0xbb49, 0x1b2f: 0x1429,
-	0x1b30: 0x1a31, 0x1b31: 0xbb61, 0x1b32: 0xbb79, 0x1b33: 0xbb91, 0x1b34: 0xbba9, 0x1b35: 0xbbc1,
-	0x1b36: 0xbbd9, 0x1b37: 0x2109, 0x1b38: 0x1111, 0x1b39: 0x1429, 0x1b3a: 0xbbf1, 0x1b3b: 0xbc09,
-	0x1b3c: 0xbc21, 0x1b3d: 0x10e1, 0x1b3e: 0x10f9, 0x1b3f: 0xbc39,
+	0x1b00: 0x2291, 0x1b01: 0x2299, 0x1b02: 0x22a1, 0x1b03: 0x04d1, 0x1b04: 0x05f9, 0x1b05: 0x22a9,
+	0x1b06: 0x22b1, 0x1b07: 0x22b9, 0x1b08: 0x22c1, 0x1b09: 0x22c9, 0x1b0a: 0x22d1, 0x1b0b: 0x0799,
+	0x1b0c: 0x03c1, 0x1b0d: 0x22d9, 0x1b0e: 0x22d9, 0x1b0f: 0x22e1, 0x1b10: 0x22e9, 0x1b11: 0x03b1,
+	0x1b12: 0x03b9, 0x1b13: 0x22f1, 0x1b14: 0x0769, 0x1b15: 0x2301, 0x1b16: 0x2291, 0x1b17: 0x04d1,
+	0x1b18: 0x22a9, 0x1b19: 0x03b1, 0x1b1a: 0x03c1, 0x1b1b: 0x0799, 0x1b1c: 0x2289, 0x1b1d: 0x0399,
+	0x1b1e: 0x03a1, 0x1b1f: 0x03a9, 0x1b20: 0x2291, 0x1b21: 0x2299, 0x1b22: 0x22a1, 0x1b23: 0x04d1,
+	0x1b24: 0x05f9, 0x1b25: 0x22a9, 0x1b26: 0x22b1, 0x1b27: 0x22b9, 0x1b28: 0x22c1, 0x1b29: 0x22c9,
+	0x1b2a: 0x22d1, 0x1b2b: 0x0799, 0x1b2c: 0x03c1, 0x1b2d: 0x04d1, 0x1b2e: 0x22d9, 0x1b2f: 0x22e1,
+	0x1b30: 0x22e9, 0x1b31: 0x03b1, 0x1b32: 0x03b9, 0x1b33: 0x22f1, 0x1b34: 0x0769, 0x1b35: 0x22f9,
+	0x1b36: 0x2289, 0x1b37: 0x0399, 0x1b38: 0x03a1, 0x1b39: 0x03a9, 0x1b3a: 0x2291, 0x1b3b: 0x2299,
+	0x1b3c: 0x22a1, 0x1b3d: 0x04d1, 0x1b3e: 0x05f9, 0x1b3f: 0x22a9,
 	// Block 0x6d, offset 0x1b40
-	0x1b40: 0x2079, 0x1b41: 0xbc51, 0x1b42: 0xbb01, 0x1b43: 0x1099, 0x1b44: 0x10b1, 0x1b45: 0x10c9,
-	0x1b46: 0xbb19, 0x1b47: 0xbb31, 0x1b48: 0xbb49, 0x1b49: 0x1429, 0x1b4a: 0x1a31, 0x1b4b: 0xbb61,
-	0x1b4c: 0xbb79, 0x1b4d: 0xbb91, 0x1b4e: 0xbba9, 0x1b4f: 0xbbc1, 0x1b50: 0xbbd9, 0x1b51: 0x2109,
-	0x1b52: 0x1111, 0x1b53: 0xbbf1, 0x1b54: 0xbbf1, 0x1b55: 0xbc09, 0x1b56: 0xbc21, 0x1b57: 0x10e1,
-	0x1b58: 0x10f9, 0x1b59: 0xbc39, 0x1b5a: 0x2079, 0x1b5b: 0xbc71, 0x1b5c: 0xbb19, 0x1b5d: 0x1429,
-	0x1b5e: 0xbb61, 0x1b5f: 0x10e1, 0x1b60: 0x1111, 0x1b61: 0x2109, 0x1b62: 0xbb01, 0x1b63: 0x1099,
-	0x1b64: 0x10b1, 0x1b65: 0x10c9, 0x1b66: 0xbb19, 0x1b67: 0xbb31, 0x1b68: 0xbb49, 0x1b69: 0x1429,
-	0x1b6a: 0x1a31, 0x1b6b: 0xbb61, 0x1b6c: 0xbb79, 0x1b6d: 0xbb91, 0x1b6e: 0xbba9, 0x1b6f: 0xbbc1,
-	0x1b70: 0xbbd9, 0x1b71: 0x2109, 0x1b72: 0x1111, 0x1b73: 0x1429, 0x1b74: 0xbbf1, 0x1b75: 0xbc09,
-	0x1b76: 0xbc21, 0x1b77: 0x10e1, 0x1b78: 0x10f9, 0x1b79: 0xbc39, 0x1b7a: 0x2079, 0x1b7b: 0xbc51,
-	0x1b7c: 0xbb01, 0x1b7d: 0x1099, 0x1b7e: 0x10b1, 0x1b7f: 0x10c9,
+	0x1b40: 0x22b1, 0x1b41: 0x22b9, 0x1b42: 0x22c1, 0x1b43: 0x22c9, 0x1b44: 0x22d1, 0x1b45: 0x0799,
+	0x1b46: 0x03c1, 0x1b47: 0x22d9, 0x1b48: 0x22d9, 0x1b49: 0x22e1, 0x1b4a: 0x22e9, 0x1b4b: 0x03b1,
+	0x1b4c: 0x03b9, 0x1b4d: 0x22f1, 0x1b4e: 0x0769, 0x1b4f: 0x2301, 0x1b50: 0x2291, 0x1b51: 0x04d1,
+	0x1b52: 0x22a9, 0x1b53: 0x03b1, 0x1b54: 0x03c1, 0x1b55: 0x0799, 0x1b56: 0x2289, 0x1b57: 0x0399,
+	0x1b58: 0x03a1, 0x1b59: 0x03a9, 0x1b5a: 0x2291, 0x1b5b: 0x2299, 0x1b5c: 0x22a1, 0x1b5d: 0x04d1,
+	0x1b5e: 0x05f9, 0x1b5f: 0x22a9, 0x1b60: 0x22b1, 0x1b61: 0x22b9, 0x1b62: 0x22c1, 0x1b63: 0x22c9,
+	0x1b64: 0x22d1, 0x1b65: 0x0799, 0x1b66: 0x03c1, 0x1b67: 0x04d1, 0x1b68: 0x22d9, 0x1b69: 0x22e1,
+	0x1b6a: 0x22e9, 0x1b6b: 0x03b1, 0x1b6c: 0x03b9, 0x1b6d: 0x22f1, 0x1b6e: 0x0769, 0x1b6f: 0x22f9,
+	0x1b70: 0x2289, 0x1b71: 0x0399, 0x1b72: 0x03a1, 0x1b73: 0x03a9, 0x1b74: 0x2291, 0x1b75: 0x2299,
+	0x1b76: 0x22a1, 0x1b77: 0x04d1, 0x1b78: 0x05f9, 0x1b79: 0x22a9, 0x1b7a: 0x22b1, 0x1b7b: 0x22b9,
+	0x1b7c: 0x22c1, 0x1b7d: 0x22c9, 0x1b7e: 0x22d1, 0x1b7f: 0x0799,
 	// Block 0x6e, offset 0x1b80
-	0x1b80: 0xbb19, 0x1b81: 0xbb31, 0x1b82: 0xbb49, 0x1b83: 0x1429, 0x1b84: 0x1a31, 0x1b85: 0xbb61,
-	0x1b86: 0xbb79, 0x1b87: 0xbb91, 0x1b88: 0xbba9, 0x1b89: 0xbbc1, 0x1b8a: 0xbbd9, 0x1b8b: 0x2109,
-	0x1b8c: 0x1111, 0x1b8d: 0xbbf1, 0x1b8e: 0xbbf1, 0x1b8f: 0xbc09, 0x1b90: 0xbc21, 0x1b91: 0x10e1,
-	0x1b92: 0x10f9, 0x1b93: 0xbc39, 0x1b94: 0x2079, 0x1b95: 0xbc71, 0x1b96: 0xbb19, 0x1b97: 0x1429,
-	0x1b98: 0xbb61, 0x1b99: 0x10e1, 0x1b9a: 0x1111, 0x1b9b: 0x2109, 0x1b9c: 0xbb01, 0x1b9d: 0x1099,
-	0x1b9e: 0x10b1, 0x1b9f: 0x10c9, 0x1ba0: 0xbb19, 0x1ba1: 0xbb31, 0x1ba2: 0xbb49, 0x1ba3: 0x1429,
-	0x1ba4: 0x1a31, 0x1ba5: 0xbb61, 0x1ba6: 0xbb79, 0x1ba7: 0xbb91, 0x1ba8: 0xbba9, 0x1ba9: 0xbbc1,
-	0x1baa: 0xbbd9, 0x1bab: 0x2109, 0x1bac: 0x1111, 0x1bad: 0x1429, 0x1bae: 0xbbf1, 0x1baf: 0xbc09,
-	0x1bb0: 0xbc21, 0x1bb1: 0x10e1, 0x1bb2: 0x10f9, 0x1bb3: 0xbc39, 0x1bb4: 0x2079, 0x1bb5: 0xbc51,
-	0x1bb6: 0xbb01, 0x1bb7: 0x1099, 0x1bb8: 0x10b1, 0x1bb9: 0x10c9, 0x1bba: 0xbb19, 0x1bbb: 0xbb31,
-	0x1bbc: 0xbb49, 0x1bbd: 0x1429, 0x1bbe: 0x1a31, 0x1bbf: 0xbb61,
+	0x1b80: 0x03c1, 0x1b81: 0x22d9, 0x1b82: 0x22d9, 0x1b83: 0x22e1, 0x1b84: 0x22e9, 0x1b85: 0x03b1,
+	0x1b86: 0x03b9, 0x1b87: 0x22f1, 0x1b88: 0x0769, 0x1b89: 0x2301, 0x1b8a: 0x2291, 0x1b8b: 0x04d1,
+	0x1b8c: 0x22a9, 0x1b8d: 0x03b1, 0x1b8e: 0x03c1, 0x1b8f: 0x0799, 0x1b90: 0x2289, 0x1b91: 0x0399,
+	0x1b92: 0x03a1, 0x1b93: 0x03a9, 0x1b94: 0x2291, 0x1b95: 0x2299, 0x1b96: 0x22a1, 0x1b97: 0x04d1,
+	0x1b98: 0x05f9, 0x1b99: 0x22a9, 0x1b9a: 0x22b1, 0x1b9b: 0x22b9, 0x1b9c: 0x22c1, 0x1b9d: 0x22c9,
+	0x1b9e: 0x22d1, 0x1b9f: 0x0799, 0x1ba0: 0x03c1, 0x1ba1: 0x04d1, 0x1ba2: 0x22d9, 0x1ba3: 0x22e1,
+	0x1ba4: 0x22e9, 0x1ba5: 0x03b1, 0x1ba6: 0x03b9, 0x1ba7: 0x22f1, 0x1ba8: 0x0769, 0x1ba9: 0x22f9,
+	0x1baa: 0x2289, 0x1bab: 0x0399, 0x1bac: 0x03a1, 0x1bad: 0x03a9, 0x1bae: 0x2291, 0x1baf: 0x2299,
+	0x1bb0: 0x22a1, 0x1bb1: 0x04d1, 0x1bb2: 0x05f9, 0x1bb3: 0x22a9, 0x1bb4: 0x22b1, 0x1bb5: 0x22b9,
+	0x1bb6: 0x22c1, 0x1bb7: 0x22c9, 0x1bb8: 0x22d1, 0x1bb9: 0x0799, 0x1bba: 0x03c1, 0x1bbb: 0x22d9,
+	0x1bbc: 0x22d9, 0x1bbd: 0x22e1, 0x1bbe: 0x22e9, 0x1bbf: 0x03b1,
 	// Block 0x6f, offset 0x1bc0
-	0x1bc0: 0xbb79, 0x1bc1: 0xbb91, 0x1bc2: 0xbba9, 0x1bc3: 0xbbc1, 0x1bc4: 0xbbd9, 0x1bc5: 0x2109,
-	0x1bc6: 0x1111, 0x1bc7: 0xbbf1, 0x1bc8: 0xbbf1, 0x1bc9: 0xbc09, 0x1bca: 0xbc21, 0x1bcb: 0x10e1,
-	0x1bcc: 0x10f9, 0x1bcd: 0xbc39, 0x1bce: 0x2079, 0x1bcf: 0xbc71, 0x1bd0: 0xbb19, 0x1bd1: 0x1429,
-	0x1bd2: 0xbb61, 0x1bd3: 0x10e1, 0x1bd4: 0x1111, 0x1bd5: 0x2109, 0x1bd6: 0xbb01, 0x1bd7: 0x1099,
-	0x1bd8: 0x10b1, 0x1bd9: 0x10c9, 0x1bda: 0xbb19, 0x1bdb: 0xbb31, 0x1bdc: 0xbb49, 0x1bdd: 0x1429,
-	0x1bde: 0x1a31, 0x1bdf: 0xbb61, 0x1be0: 0xbb79, 0x1be1: 0xbb91, 0x1be2: 0xbba9, 0x1be3: 0xbbc1,
-	0x1be4: 0xbbd9, 0x1be5: 0x2109, 0x1be6: 0x1111, 0x1be7: 0x1429, 0x1be8: 0xbbf1, 0x1be9: 0xbc09,
-	0x1bea: 0xbc21, 0x1beb: 0x10e1, 0x1bec: 0x10f9, 0x1bed: 0xbc39, 0x1bee: 0x2079, 0x1bef: 0xbc51,
-	0x1bf0: 0xbb01, 0x1bf1: 0x1099, 0x1bf2: 0x10b1, 0x1bf3: 0x10c9, 0x1bf4: 0xbb19, 0x1bf5: 0xbb31,
-	0x1bf6: 0xbb49, 0x1bf7: 0x1429, 0x1bf8: 0x1a31, 0x1bf9: 0xbb61, 0x1bfa: 0xbb79, 0x1bfb: 0xbb91,
-	0x1bfc: 0xbba9, 0x1bfd: 0xbbc1, 0x1bfe: 0xbbd9, 0x1bff: 0x2109,
+	0x1bc0: 0x03b9, 0x1bc1: 0x22f1, 0x1bc2: 0x0769, 0x1bc3: 0x2301, 0x1bc4: 0x2291, 0x1bc5: 0x04d1,
+	0x1bc6: 0x22a9, 0x1bc7: 0x03b1, 0x1bc8: 0x03c1, 0x1bc9: 0x0799, 0x1bca: 0x2309, 0x1bcb: 0x2309,
+	0x1bcc: 0x0040, 0x1bcd: 0x0040, 0x1bce: 0x06e1, 0x1bcf: 0x0049, 0x1bd0: 0x0029, 0x1bd1: 0x0031,
+	0x1bd2: 0x06e9, 0x1bd3: 0x06f1, 0x1bd4: 0x06f9, 0x1bd5: 0x0701, 0x1bd6: 0x0709, 0x1bd7: 0x0711,
+	0x1bd8: 0x06e1, 0x1bd9: 0x0049, 0x1bda: 0x0029, 0x1bdb: 0x0031, 0x1bdc: 0x06e9, 0x1bdd: 0x06f1,
+	0x1bde: 0x06f9, 0x1bdf: 0x0701, 0x1be0: 0x0709, 0x1be1: 0x0711, 0x1be2: 0x06e1, 0x1be3: 0x0049,
+	0x1be4: 0x0029, 0x1be5: 0x0031, 0x1be6: 0x06e9, 0x1be7: 0x06f1, 0x1be8: 0x06f9, 0x1be9: 0x0701,
+	0x1bea: 0x0709, 0x1beb: 0x0711, 0x1bec: 0x06e1, 0x1bed: 0x0049, 0x1bee: 0x0029, 0x1bef: 0x0031,
+	0x1bf0: 0x06e9, 0x1bf1: 0x06f1, 0x1bf2: 0x06f9, 0x1bf3: 0x0701, 0x1bf4: 0x0709, 0x1bf5: 0x0711,
+	0x1bf6: 0x06e1, 0x1bf7: 0x0049, 0x1bf8: 0x0029, 0x1bf9: 0x0031, 0x1bfa: 0x06e9, 0x1bfb: 0x06f1,
+	0x1bfc: 0x06f9, 0x1bfd: 0x0701, 0x1bfe: 0x0709, 0x1bff: 0x0711,
 	// Block 0x70, offset 0x1c00
-	0x1c00: 0x1111, 0x1c01: 0xbbf1, 0x1c02: 0xbbf1, 0x1c03: 0xbc09, 0x1c04: 0xbc21, 0x1c05: 0x10e1,
-	0x1c06: 0x10f9, 0x1c07: 0xbc39, 0x1c08: 0x2079, 0x1c09: 0xbc71, 0x1c0a: 0xbb19, 0x1c0b: 0x1429,
-	0x1c0c: 0xbb61, 0x1c0d: 0x10e1, 0x1c0e: 0x1111, 0x1c0f: 0x2109, 0x1c10: 0xbb01, 0x1c11: 0x1099,
-	0x1c12: 0x10b1, 0x1c13: 0x10c9, 0x1c14: 0xbb19, 0x1c15: 0xbb31, 0x1c16: 0xbb49, 0x1c17: 0x1429,
-	0x1c18: 0x1a31, 0x1c19: 0xbb61, 0x1c1a: 0xbb79, 0x1c1b: 0xbb91, 0x1c1c: 0xbba9, 0x1c1d: 0xbbc1,
-	0x1c1e: 0xbbd9, 0x1c1f: 0x2109, 0x1c20: 0x1111, 0x1c21: 0x1429, 0x1c22: 0xbbf1, 0x1c23: 0xbc09,
-	0x1c24: 0xbc21, 0x1c25: 0x10e1, 0x1c26: 0x10f9, 0x1c27: 0xbc39, 0x1c28: 0x2079, 0x1c29: 0xbc51,
-	0x1c2a: 0xbb01, 0x1c2b: 0x1099, 0x1c2c: 0x10b1, 0x1c2d: 0x10c9, 0x1c2e: 0xbb19, 0x1c2f: 0xbb31,
-	0x1c30: 0xbb49, 0x1c31: 0x1429, 0x1c32: 0x1a31, 0x1c33: 0xbb61, 0x1c34: 0xbb79, 0x1c35: 0xbb91,
-	0x1c36: 0xbba9, 0x1c37: 0xbbc1, 0x1c38: 0xbbd9, 0x1c39: 0x2109, 0x1c3a: 0x1111, 0x1c3b: 0xbbf1,
-	0x1c3c: 0xbbf1, 0x1c3d: 0xbc09, 0x1c3e: 0xbc21, 0x1c3f: 0x10e1,
+	0x1c00: 0xe115, 0x1c01: 0xe115, 0x1c02: 0xe135, 0x1c03: 0xe135, 0x1c04: 0xe115, 0x1c05: 0xe115,
+	0x1c06: 0xe175, 0x1c07: 0xe175, 0x1c08: 0xe115, 0x1c09: 0xe115, 0x1c0a: 0xe135, 0x1c0b: 0xe135,
+	0x1c0c: 0xe115, 0x1c0d: 0xe115, 0x1c0e: 0xe1f5, 0x1c0f: 0xe1f5, 0x1c10: 0xe115, 0x1c11: 0xe115,
+	0x1c12: 0xe135, 0x1c13: 0xe135, 0x1c14: 0xe115, 0x1c15: 0xe115, 0x1c16: 0xe175, 0x1c17: 0xe175,
+	0x1c18: 0xe115, 0x1c19: 0xe115, 0x1c1a: 0xe135, 0x1c1b: 0xe135, 0x1c1c: 0xe115, 0x1c1d: 0xe115,
+	0x1c1e: 0x8b3d, 0x1c1f: 0x8b3d, 0x1c20: 0x04b5, 0x1c21: 0x04b5, 0x1c22: 0x0a08, 0x1c23: 0x0a08,
+	0x1c24: 0x0a08, 0x1c25: 0x0a08, 0x1c26: 0x0a08, 0x1c27: 0x0a08, 0x1c28: 0x0a08, 0x1c29: 0x0a08,
+	0x1c2a: 0x0a08, 0x1c2b: 0x0a08, 0x1c2c: 0x0a08, 0x1c2d: 0x0a08, 0x1c2e: 0x0a08, 0x1c2f: 0x0a08,
+	0x1c30: 0x0a08, 0x1c31: 0x0a08, 0x1c32: 0x0a08, 0x1c33: 0x0a08, 0x1c34: 0x0a08, 0x1c35: 0x0a08,
+	0x1c36: 0x0a08, 0x1c37: 0x0a08, 0x1c38: 0x0a08, 0x1c39: 0x0a08, 0x1c3a: 0x0a08, 0x1c3b: 0x0a08,
+	0x1c3c: 0x0a08, 0x1c3d: 0x0a08, 0x1c3e: 0x0a08, 0x1c3f: 0x0a08,
 	// Block 0x71, offset 0x1c40
-	0x1c40: 0x10f9, 0x1c41: 0xbc39, 0x1c42: 0x2079, 0x1c43: 0xbc71, 0x1c44: 0xbb19, 0x1c45: 0x1429,
-	0x1c46: 0xbb61, 0x1c47: 0x10e1, 0x1c48: 0x1111, 0x1c49: 0x2109, 0x1c4a: 0xbc91, 0x1c4b: 0xbc91,
-	0x1c4c: 0x0040, 0x1c4d: 0x0040, 0x1c4e: 0x1f41, 0x1c4f: 0x00c9, 0x1c50: 0x0069, 0x1c51: 0x0079,
-	0x1c52: 0x1f51, 0x1c53: 0x1f61, 0x1c54: 0x1f71, 0x1c55: 0x1f81, 0x1c56: 0x1f91, 0x1c57: 0x1fa1,
-	0x1c58: 0x1f41, 0x1c59: 0x00c9, 0x1c5a: 0x0069, 0x1c5b: 0x0079, 0x1c5c: 0x1f51, 0x1c5d: 0x1f61,
-	0x1c5e: 0x1f71, 0x1c5f: 0x1f81, 0x1c60: 0x1f91, 0x1c61: 0x1fa1, 0x1c62: 0x1f41, 0x1c63: 0x00c9,
-	0x1c64: 0x0069, 0x1c65: 0x0079, 0x1c66: 0x1f51, 0x1c67: 0x1f61, 0x1c68: 0x1f71, 0x1c69: 0x1f81,
-	0x1c6a: 0x1f91, 0x1c6b: 0x1fa1, 0x1c6c: 0x1f41, 0x1c6d: 0x00c9, 0x1c6e: 0x0069, 0x1c6f: 0x0079,
-	0x1c70: 0x1f51, 0x1c71: 0x1f61, 0x1c72: 0x1f71, 0x1c73: 0x1f81, 0x1c74: 0x1f91, 0x1c75: 0x1fa1,
-	0x1c76: 0x1f41, 0x1c77: 0x00c9, 0x1c78: 0x0069, 0x1c79: 0x0079, 0x1c7a: 0x1f51, 0x1c7b: 0x1f61,
-	0x1c7c: 0x1f71, 0x1c7d: 0x1f81, 0x1c7e: 0x1f91, 0x1c7f: 0x1fa1,
+	0x1c40: 0x20b1, 0x1c41: 0x20b9, 0x1c42: 0x20d9, 0x1c43: 0x20f1, 0x1c44: 0x0040, 0x1c45: 0x2189,
+	0x1c46: 0x2109, 0x1c47: 0x20e1, 0x1c48: 0x2131, 0x1c49: 0x2191, 0x1c4a: 0x2161, 0x1c4b: 0x2169,
+	0x1c4c: 0x2171, 0x1c4d: 0x2179, 0x1c4e: 0x2111, 0x1c4f: 0x2141, 0x1c50: 0x2151, 0x1c51: 0x2121,
+	0x1c52: 0x2159, 0x1c53: 0x2101, 0x1c54: 0x2119, 0x1c55: 0x20c9, 0x1c56: 0x20d1, 0x1c57: 0x20e9,
+	0x1c58: 0x20f9, 0x1c59: 0x2129, 0x1c5a: 0x2139, 0x1c5b: 0x2149, 0x1c5c: 0x2311, 0x1c5d: 0x1689,
+	0x1c5e: 0x2319, 0x1c5f: 0x2321, 0x1c60: 0x0040, 0x1c61: 0x20b9, 0x1c62: 0x20d9, 0x1c63: 0x0040,
+	0x1c64: 0x2181, 0x1c65: 0x0040, 0x1c66: 0x0040, 0x1c67: 0x20e1, 0x1c68: 0x0040, 0x1c69: 0x2191,
+	0x1c6a: 0x2161, 0x1c6b: 0x2169, 0x1c6c: 0x2171, 0x1c6d: 0x2179, 0x1c6e: 0x2111, 0x1c6f: 0x2141,
+	0x1c70: 0x2151, 0x1c71: 0x2121, 0x1c72: 0x2159, 0x1c73: 0x0040, 0x1c74: 0x2119, 0x1c75: 0x20c9,
+	0x1c76: 0x20d1, 0x1c77: 0x20e9, 0x1c78: 0x0040, 0x1c79: 0x2129, 0x1c7a: 0x0040, 0x1c7b: 0x2149,
+	0x1c7c: 0x0040, 0x1c7d: 0x0040, 0x1c7e: 0x0040, 0x1c7f: 0x0040,
 	// Block 0x72, offset 0x1c80
-	0x1c80: 0xe115, 0x1c81: 0xe115, 0x1c82: 0xe135, 0x1c83: 0xe135, 0x1c84: 0xe115, 0x1c85: 0xe115,
-	0x1c86: 0xe175, 0x1c87: 0xe175, 0x1c88: 0xe115, 0x1c89: 0xe115, 0x1c8a: 0xe135, 0x1c8b: 0xe135,
-	0x1c8c: 0xe115, 0x1c8d: 0xe115, 0x1c8e: 0xe1f5, 0x1c8f: 0xe1f5, 0x1c90: 0xe115, 0x1c91: 0xe115,
-	0x1c92: 0xe135, 0x1c93: 0xe135, 0x1c94: 0xe115, 0x1c95: 0xe115, 0x1c96: 0xe175, 0x1c97: 0xe175,
-	0x1c98: 0xe115, 0x1c99: 0xe115, 0x1c9a: 0xe135, 0x1c9b: 0xe135, 0x1c9c: 0xe115, 0x1c9d: 0xe115,
-	0x1c9e: 0x8b3d, 0x1c9f: 0x8b3d, 0x1ca0: 0x04b5, 0x1ca1: 0x04b5, 0x1ca2: 0x0a08, 0x1ca3: 0x0a08,
-	0x1ca4: 0x0a08, 0x1ca5: 0x0a08, 0x1ca6: 0x0a08, 0x1ca7: 0x0a08, 0x1ca8: 0x0a08, 0x1ca9: 0x0a08,
-	0x1caa: 0x0a08, 0x1cab: 0x0a08, 0x1cac: 0x0a08, 0x1cad: 0x0a08, 0x1cae: 0x0a08, 0x1caf: 0x0a08,
-	0x1cb0: 0x0a08, 0x1cb1: 0x0a08, 0x1cb2: 0x0a08, 0x1cb3: 0x0a08, 0x1cb4: 0x0a08, 0x1cb5: 0x0a08,
-	0x1cb6: 0x0a08, 0x1cb7: 0x0a08, 0x1cb8: 0x0a08, 0x1cb9: 0x0a08, 0x1cba: 0x0a08, 0x1cbb: 0x0a08,
-	0x1cbc: 0x0a08, 0x1cbd: 0x0a08, 0x1cbe: 0x0a08, 0x1cbf: 0x0a08,
+	0x1c80: 0x0040, 0x1c81: 0x0040, 0x1c82: 0x20d9, 0x1c83: 0x0040, 0x1c84: 0x0040, 0x1c85: 0x0040,
+	0x1c86: 0x0040, 0x1c87: 0x20e1, 0x1c88: 0x0040, 0x1c89: 0x2191, 0x1c8a: 0x0040, 0x1c8b: 0x2169,
+	0x1c8c: 0x0040, 0x1c8d: 0x2179, 0x1c8e: 0x2111, 0x1c8f: 0x2141, 0x1c90: 0x0040, 0x1c91: 0x2121,
+	0x1c92: 0x2159, 0x1c93: 0x0040, 0x1c94: 0x2119, 0x1c95: 0x0040, 0x1c96: 0x0040, 0x1c97: 0x20e9,
+	0x1c98: 0x0040, 0x1c99: 0x2129, 0x1c9a: 0x0040, 0x1c9b: 0x2149, 0x1c9c: 0x0040, 0x1c9d: 0x1689,
+	0x1c9e: 0x0040, 0x1c9f: 0x2321, 0x1ca0: 0x0040, 0x1ca1: 0x20b9, 0x1ca2: 0x20d9, 0x1ca3: 0x0040,
+	0x1ca4: 0x2181, 0x1ca5: 0x0040, 0x1ca6: 0x0040, 0x1ca7: 0x20e1, 0x1ca8: 0x2131, 0x1ca9: 0x2191,
+	0x1caa: 0x2161, 0x1cab: 0x0040, 0x1cac: 0x2171, 0x1cad: 0x2179, 0x1cae: 0x2111, 0x1caf: 0x2141,
+	0x1cb0: 0x2151, 0x1cb1: 0x2121, 0x1cb2: 0x2159, 0x1cb3: 0x0040, 0x1cb4: 0x2119, 0x1cb5: 0x20c9,
+	0x1cb6: 0x20d1, 0x1cb7: 0x20e9, 0x1cb8: 0x0040, 0x1cb9: 0x2129, 0x1cba: 0x2139, 0x1cbb: 0x2149,
+	0x1cbc: 0x2311, 0x1cbd: 0x0040, 0x1cbe: 0x2319, 0x1cbf: 0x0040,
 	// Block 0x73, offset 0x1cc0
-	0x1cc0: 0xb1d9, 0x1cc1: 0xb1f1, 0x1cc2: 0xb251, 0x1cc3: 0xb299, 0x1cc4: 0x0040, 0x1cc5: 0xb461,
-	0x1cc6: 0xb2e1, 0x1cc7: 0xb269, 0x1cc8: 0xb359, 0x1cc9: 0xb479, 0x1cca: 0xb3e9, 0x1ccb: 0xb401,
-	0x1ccc: 0xb419, 0x1ccd: 0xb431, 0x1cce: 0xb2f9, 0x1ccf: 0xb389, 0x1cd0: 0xb3b9, 0x1cd1: 0xb329,
-	0x1cd2: 0xb3d1, 0x1cd3: 0xb2c9, 0x1cd4: 0xb311, 0x1cd5: 0xb221, 0x1cd6: 0xb239, 0x1cd7: 0xb281,
-	0x1cd8: 0xb2b1, 0x1cd9: 0xb341, 0x1cda: 0xb371, 0x1cdb: 0xb3a1, 0x1cdc: 0xbca9, 0x1cdd: 0x7999,
-	0x1cde: 0xbcc1, 0x1cdf: 0xbcd9, 0x1ce0: 0x0040, 0x1ce1: 0xb1f1, 0x1ce2: 0xb251, 0x1ce3: 0x0040,
-	0x1ce4: 0xb449, 0x1ce5: 0x0040, 0x1ce6: 0x0040, 0x1ce7: 0xb269, 0x1ce8: 0x0040, 0x1ce9: 0xb479,
-	0x1cea: 0xb3e9, 0x1ceb: 0xb401, 0x1cec: 0xb419, 0x1ced: 0xb431, 0x1cee: 0xb2f9, 0x1cef: 0xb389,
-	0x1cf0: 0xb3b9, 0x1cf1: 0xb329, 0x1cf2: 0xb3d1, 0x1cf3: 0x0040, 0x1cf4: 0xb311, 0x1cf5: 0xb221,
-	0x1cf6: 0xb239, 0x1cf7: 0xb281, 0x1cf8: 0x0040, 0x1cf9: 0xb341, 0x1cfa: 0x0040, 0x1cfb: 0xb3a1,
+	0x1cc0: 0x20b1, 0x1cc1: 0x20b9, 0x1cc2: 0x20d9, 0x1cc3: 0x20f1, 0x1cc4: 0x2181, 0x1cc5: 0x2189,
+	0x1cc6: 0x2109, 0x1cc7: 0x20e1, 0x1cc8: 0x2131, 0x1cc9: 0x2191, 0x1cca: 0x0040, 0x1ccb: 0x2169,
+	0x1ccc: 0x2171, 0x1ccd: 0x2179, 0x1cce: 0x2111, 0x1ccf: 0x2141, 0x1cd0: 0x2151, 0x1cd1: 0x2121,
+	0x1cd2: 0x2159, 0x1cd3: 0x2101, 0x1cd4: 0x2119, 0x1cd5: 0x20c9, 0x1cd6: 0x20d1, 0x1cd7: 0x20e9,
+	0x1cd8: 0x20f9, 0x1cd9: 0x2129, 0x1cda: 0x2139, 0x1cdb: 0x2149, 0x1cdc: 0x0040, 0x1cdd: 0x0040,
+	0x1cde: 0x0040, 0x1cdf: 0x0040, 0x1ce0: 0x0040, 0x1ce1: 0x20b9, 0x1ce2: 0x20d9, 0x1ce3: 0x20f1,
+	0x1ce4: 0x0040, 0x1ce5: 0x2189, 0x1ce6: 0x2109, 0x1ce7: 0x20e1, 0x1ce8: 0x2131, 0x1ce9: 0x2191,
+	0x1cea: 0x0040, 0x1ceb: 0x2169, 0x1cec: 0x2171, 0x1ced: 0x2179, 0x1cee: 0x2111, 0x1cef: 0x2141,
+	0x1cf0: 0x2151, 0x1cf1: 0x2121, 0x1cf2: 0x2159, 0x1cf3: 0x2101, 0x1cf4: 0x2119, 0x1cf5: 0x20c9,
+	0x1cf6: 0x20d1, 0x1cf7: 0x20e9, 0x1cf8: 0x20f9, 0x1cf9: 0x2129, 0x1cfa: 0x2139, 0x1cfb: 0x2149,
 	0x1cfc: 0x0040, 0x1cfd: 0x0040, 0x1cfe: 0x0040, 0x1cff: 0x0040,
 	// Block 0x74, offset 0x1d00
-	0x1d00: 0x0040, 0x1d01: 0x0040, 0x1d02: 0xb251, 0x1d03: 0x0040, 0x1d04: 0x0040, 0x1d05: 0x0040,
-	0x1d06: 0x0040, 0x1d07: 0xb269, 0x1d08: 0x0040, 0x1d09: 0xb479, 0x1d0a: 0x0040, 0x1d0b: 0xb401,
-	0x1d0c: 0x0040, 0x1d0d: 0xb431, 0x1d0e: 0xb2f9, 0x1d0f: 0xb389, 0x1d10: 0x0040, 0x1d11: 0xb329,
-	0x1d12: 0xb3d1, 0x1d13: 0x0040, 0x1d14: 0xb311, 0x1d15: 0x0040, 0x1d16: 0x0040, 0x1d17: 0xb281,
-	0x1d18: 0x0040, 0x1d19: 0xb341, 0x1d1a: 0x0040, 0x1d1b: 0xb3a1, 0x1d1c: 0x0040, 0x1d1d: 0x7999,
-	0x1d1e: 0x0040, 0x1d1f: 0xbcd9, 0x1d20: 0x0040, 0x1d21: 0xb1f1, 0x1d22: 0xb251, 0x1d23: 0x0040,
-	0x1d24: 0xb449, 0x1d25: 0x0040, 0x1d26: 0x0040, 0x1d27: 0xb269, 0x1d28: 0xb359, 0x1d29: 0xb479,
-	0x1d2a: 0xb3e9, 0x1d2b: 0x0040, 0x1d2c: 0xb419, 0x1d2d: 0xb431, 0x1d2e: 0xb2f9, 0x1d2f: 0xb389,
-	0x1d30: 0xb3b9, 0x1d31: 0xb329, 0x1d32: 0xb3d1, 0x1d33: 0x0040, 0x1d34: 0xb311, 0x1d35: 0xb221,
-	0x1d36: 0xb239, 0x1d37: 0xb281, 0x1d38: 0x0040, 0x1d39: 0xb341, 0x1d3a: 0xb371, 0x1d3b: 0xb3a1,
-	0x1d3c: 0xbca9, 0x1d3d: 0x0040, 0x1d3e: 0xbcc1, 0x1d3f: 0x0040,
+	0x1d00: 0x0040, 0x1d01: 0x232a, 0x1d02: 0x2332, 0x1d03: 0x233a, 0x1d04: 0x2342, 0x1d05: 0x234a,
+	0x1d06: 0x2352, 0x1d07: 0x235a, 0x1d08: 0x2362, 0x1d09: 0x236a, 0x1d0a: 0x2372, 0x1d0b: 0x0018,
+	0x1d0c: 0x0018, 0x1d0d: 0x0018, 0x1d0e: 0x0018, 0x1d0f: 0x0018, 0x1d10: 0x237a, 0x1d11: 0x2382,
+	0x1d12: 0x238a, 0x1d13: 0x2392, 0x1d14: 0x239a, 0x1d15: 0x23a2, 0x1d16: 0x23aa, 0x1d17: 0x23b2,
+	0x1d18: 0x23ba, 0x1d19: 0x23c2, 0x1d1a: 0x23ca, 0x1d1b: 0x23d2, 0x1d1c: 0x23da, 0x1d1d: 0x23e2,
+	0x1d1e: 0x23ea, 0x1d1f: 0x23f2, 0x1d20: 0x23fa, 0x1d21: 0x2402, 0x1d22: 0x240a, 0x1d23: 0x2412,
+	0x1d24: 0x241a, 0x1d25: 0x2422, 0x1d26: 0x242a, 0x1d27: 0x2432, 0x1d28: 0x243a, 0x1d29: 0x2442,
+	0x1d2a: 0x2449, 0x1d2b: 0x03d9, 0x1d2c: 0x00b9, 0x1d2d: 0x1239, 0x1d2e: 0x2451, 0x1d2f: 0x0018,
+	0x1d30: 0x0019, 0x1d31: 0x02e9, 0x1d32: 0x03d9, 0x1d33: 0x02f1, 0x1d34: 0x02f9, 0x1d35: 0x03f1,
+	0x1d36: 0x0309, 0x1d37: 0x00a9, 0x1d38: 0x0311, 0x1d39: 0x00b1, 0x1d3a: 0x0319, 0x1d3b: 0x0101,
+	0x1d3c: 0x0321, 0x1d3d: 0x0329, 0x1d3e: 0x0051, 0x1d3f: 0x0339,
 	// Block 0x75, offset 0x1d40
-	0x1d40: 0xb1d9, 0x1d41: 0xb1f1, 0x1d42: 0xb251, 0x1d43: 0xb299, 0x1d44: 0xb449, 0x1d45: 0xb461,
-	0x1d46: 0xb2e1, 0x1d47: 0xb269, 0x1d48: 0xb359, 0x1d49: 0xb479, 0x1d4a: 0x0040, 0x1d4b: 0xb401,
-	0x1d4c: 0xb419, 0x1d4d: 0xb431, 0x1d4e: 0xb2f9, 0x1d4f: 0xb389, 0x1d50: 0xb3b9, 0x1d51: 0xb329,
-	0x1d52: 0xb3d1, 0x1d53: 0xb2c9, 0x1d54: 0xb311, 0x1d55: 0xb221, 0x1d56: 0xb239, 0x1d57: 0xb281,
-	0x1d58: 0xb2b1, 0x1d59: 0xb341, 0x1d5a: 0xb371, 0x1d5b: 0xb3a1, 0x1d5c: 0x0040, 0x1d5d: 0x0040,
-	0x1d5e: 0x0040, 0x1d5f: 0x0040, 0x1d60: 0x0040, 0x1d61: 0xb1f1, 0x1d62: 0xb251, 0x1d63: 0xb299,
-	0x1d64: 0x0040, 0x1d65: 0xb461, 0x1d66: 0xb2e1, 0x1d67: 0xb269, 0x1d68: 0xb359, 0x1d69: 0xb479,
-	0x1d6a: 0x0040, 0x1d6b: 0xb401, 0x1d6c: 0xb419, 0x1d6d: 0xb431, 0x1d6e: 0xb2f9, 0x1d6f: 0xb389,
-	0x1d70: 0xb3b9, 0x1d71: 0xb329, 0x1d72: 0xb3d1, 0x1d73: 0xb2c9, 0x1d74: 0xb311, 0x1d75: 0xb221,
-	0x1d76: 0xb239, 0x1d77: 0xb281, 0x1d78: 0xb2b1, 0x1d79: 0xb341, 0x1d7a: 0xb371, 0x1d7b: 0xb3a1,
-	0x1d7c: 0x0040, 0x1d7d: 0x0040, 0x1d7e: 0x0040, 0x1d7f: 0x0040,
+	0x1d40: 0x0751, 0x1d41: 0x00b9, 0x1d42: 0x0089, 0x1d43: 0x0341, 0x1d44: 0x0349, 0x1d45: 0x0391,
+	0x1d46: 0x00c1, 0x1d47: 0x0109, 0x1d48: 0x00c9, 0x1d49: 0x04b1, 0x1d4a: 0x2459, 0x1d4b: 0x11f9,
+	0x1d4c: 0x2461, 0x1d4d: 0x04d9, 0x1d4e: 0x2469, 0x1d4f: 0x2471, 0x1d50: 0x0018, 0x1d51: 0x0018,
+	0x1d52: 0x0018, 0x1d53: 0x0018, 0x1d54: 0x0018, 0x1d55: 0x0018, 0x1d56: 0x0018, 0x1d57: 0x0018,
+	0x1d58: 0x0018, 0x1d59: 0x0018, 0x1d5a: 0x0018, 0x1d5b: 0x0018, 0x1d5c: 0x0018, 0x1d5d: 0x0018,
+	0x1d5e: 0x0018, 0x1d5f: 0x0018, 0x1d60: 0x0018, 0x1d61: 0x0018, 0x1d62: 0x0018, 0x1d63: 0x0018,
+	0x1d64: 0x0018, 0x1d65: 0x0018, 0x1d66: 0x0018, 0x1d67: 0x0018, 0x1d68: 0x0018, 0x1d69: 0x0018,
+	0x1d6a: 0x2479, 0x1d6b: 0x2481, 0x1d6c: 0x2489, 0x1d6d: 0x0018, 0x1d6e: 0x0018, 0x1d6f: 0x0018,
+	0x1d70: 0x0018, 0x1d71: 0x0018, 0x1d72: 0x0018, 0x1d73: 0x0018, 0x1d74: 0x0018, 0x1d75: 0x0018,
+	0x1d76: 0x0018, 0x1d77: 0x0018, 0x1d78: 0x0018, 0x1d79: 0x0018, 0x1d7a: 0x0018, 0x1d7b: 0x0018,
+	0x1d7c: 0x0018, 0x1d7d: 0x0018, 0x1d7e: 0x0018, 0x1d7f: 0x0018,
 	// Block 0x76, offset 0x1d80
-	0x1d80: 0x0040, 0x1d81: 0xbcf2, 0x1d82: 0xbd0a, 0x1d83: 0xbd22, 0x1d84: 0xbd3a, 0x1d85: 0xbd52,
-	0x1d86: 0xbd6a, 0x1d87: 0xbd82, 0x1d88: 0xbd9a, 0x1d89: 0xbdb2, 0x1d8a: 0xbdca, 0x1d8b: 0x0018,
-	0x1d8c: 0x0018, 0x1d8d: 0x0018, 0x1d8e: 0x0018, 0x1d8f: 0x0018, 0x1d90: 0xbde2, 0x1d91: 0xbe02,
-	0x1d92: 0xbe22, 0x1d93: 0xbe42, 0x1d94: 0xbe62, 0x1d95: 0xbe82, 0x1d96: 0xbea2, 0x1d97: 0xbec2,
-	0x1d98: 0xbee2, 0x1d99: 0xbf02, 0x1d9a: 0xbf22, 0x1d9b: 0xbf42, 0x1d9c: 0xbf62, 0x1d9d: 0xbf82,
-	0x1d9e: 0xbfa2, 0x1d9f: 0xbfc2, 0x1da0: 0xbfe2, 0x1da1: 0xc002, 0x1da2: 0xc022, 0x1da3: 0xc042,
-	0x1da4: 0xc062, 0x1da5: 0xc082, 0x1da6: 0xc0a2, 0x1da7: 0xc0c2, 0x1da8: 0xc0e2, 0x1da9: 0xc102,
-	0x1daa: 0xc121, 0x1dab: 0x1159, 0x1dac: 0x0269, 0x1dad: 0x66a9, 0x1dae: 0xc161, 0x1daf: 0x0018,
-	0x1db0: 0x0039, 0x1db1: 0x0ee9, 0x1db2: 0x1159, 0x1db3: 0x0ef9, 0x1db4: 0x0f09, 0x1db5: 0x1199,
-	0x1db6: 0x0f31, 0x1db7: 0x0249, 0x1db8: 0x0f41, 0x1db9: 0x0259, 0x1dba: 0x0f51, 0x1dbb: 0x0359,
-	0x1dbc: 0x0f61, 0x1dbd: 0x0f71, 0x1dbe: 0x00d9, 0x1dbf: 0x0f99,
+	0x1d80: 0x2499, 0x1d81: 0x24a1, 0x1d82: 0x24a9, 0x1d83: 0x0040, 0x1d84: 0x0040, 0x1d85: 0x0040,
+	0x1d86: 0x0040, 0x1d87: 0x0040, 0x1d88: 0x0040, 0x1d89: 0x0040, 0x1d8a: 0x0040, 0x1d8b: 0x0040,
+	0x1d8c: 0x0040, 0x1d8d: 0x0040, 0x1d8e: 0x0040, 0x1d8f: 0x0040, 0x1d90: 0x24b1, 0x1d91: 0x24b9,
+	0x1d92: 0x24c1, 0x1d93: 0x24c9, 0x1d94: 0x24d1, 0x1d95: 0x24d9, 0x1d96: 0x24e1, 0x1d97: 0x24e9,
+	0x1d98: 0x24f1, 0x1d99: 0x24f9, 0x1d9a: 0x2501, 0x1d9b: 0x2509, 0x1d9c: 0x2511, 0x1d9d: 0x2519,
+	0x1d9e: 0x2521, 0x1d9f: 0x2529, 0x1da0: 0x2531, 0x1da1: 0x2539, 0x1da2: 0x2541, 0x1da3: 0x2549,
+	0x1da4: 0x2551, 0x1da5: 0x2559, 0x1da6: 0x2561, 0x1da7: 0x2569, 0x1da8: 0x2571, 0x1da9: 0x2579,
+	0x1daa: 0x2581, 0x1dab: 0x2589, 0x1dac: 0x2591, 0x1dad: 0x2599, 0x1dae: 0x25a1, 0x1daf: 0x25a9,
+	0x1db0: 0x25b1, 0x1db1: 0x25b9, 0x1db2: 0x25c1, 0x1db3: 0x25c9, 0x1db4: 0x25d1, 0x1db5: 0x25d9,
+	0x1db6: 0x25e1, 0x1db7: 0x25e9, 0x1db8: 0x25f1, 0x1db9: 0x25f9, 0x1dba: 0x2601, 0x1dbb: 0x2609,
+	0x1dbc: 0x0040, 0x1dbd: 0x0040, 0x1dbe: 0x0040, 0x1dbf: 0x0040,
 	// Block 0x77, offset 0x1dc0
-	0x1dc0: 0x2039, 0x1dc1: 0x0269, 0x1dc2: 0x01d9, 0x1dc3: 0x0fa9, 0x1dc4: 0x0fb9, 0x1dc5: 0x1089,
-	0x1dc6: 0x0279, 0x1dc7: 0x0369, 0x1dc8: 0x0289, 0x1dc9: 0x13d1, 0x1dca: 0xc179, 0x1dcb: 0x65e9,
-	0x1dcc: 0xc191, 0x1dcd: 0x1441, 0x1dce: 0xc1a9, 0x1dcf: 0xc1c9, 0x1dd0: 0x0018, 0x1dd1: 0x0018,
-	0x1dd2: 0x0018, 0x1dd3: 0x0018, 0x1dd4: 0x0018, 0x1dd5: 0x0018, 0x1dd6: 0x0018, 0x1dd7: 0x0018,
-	0x1dd8: 0x0018, 0x1dd9: 0x0018, 0x1dda: 0x0018, 0x1ddb: 0x0018, 0x1ddc: 0x0018, 0x1ddd: 0x0018,
-	0x1dde: 0x0018, 0x1ddf: 0x0018, 0x1de0: 0x0018, 0x1de1: 0x0018, 0x1de2: 0x0018, 0x1de3: 0x0018,
-	0x1de4: 0x0018, 0x1de5: 0x0018, 0x1de6: 0x0018, 0x1de7: 0x0018, 0x1de8: 0x0018, 0x1de9: 0x0018,
-	0x1dea: 0xc1e1, 0x1deb: 0xc1f9, 0x1dec: 0xc211, 0x1ded: 0x0018, 0x1dee: 0x0018, 0x1def: 0x0018,
-	0x1df0: 0x0018, 0x1df1: 0x0018, 0x1df2: 0x0018, 0x1df3: 0x0018, 0x1df4: 0x0018, 0x1df5: 0x0018,
-	0x1df6: 0x0018, 0x1df7: 0x0018, 0x1df8: 0x0018, 0x1df9: 0x0018, 0x1dfa: 0x0018, 0x1dfb: 0x0018,
-	0x1dfc: 0x0018, 0x1dfd: 0x0018, 0x1dfe: 0x0018, 0x1dff: 0x0018,
+	0x1dc0: 0x2669, 0x1dc1: 0x2671, 0x1dc2: 0x2679, 0x1dc3: 0x8b55, 0x1dc4: 0x2681, 0x1dc5: 0x2689,
+	0x1dc6: 0x2691, 0x1dc7: 0x2699, 0x1dc8: 0x26a1, 0x1dc9: 0x26a9, 0x1dca: 0x26b1, 0x1dcb: 0x26b9,
+	0x1dcc: 0x26c1, 0x1dcd: 0x8b75, 0x1dce: 0x26c9, 0x1dcf: 0x26d1, 0x1dd0: 0x26d9, 0x1dd1: 0x26e1,
+	0x1dd2: 0x8b95, 0x1dd3: 0x26e9, 0x1dd4: 0x26f1, 0x1dd5: 0x2521, 0x1dd6: 0x8bb5, 0x1dd7: 0x26f9,
+	0x1dd8: 0x2701, 0x1dd9: 0x2709, 0x1dda: 0x2711, 0x1ddb: 0x2719, 0x1ddc: 0x8bd5, 0x1ddd: 0x2721,
+	0x1dde: 0x2729, 0x1ddf: 0x2731, 0x1de0: 0x2739, 0x1de1: 0x2741, 0x1de2: 0x25f9, 0x1de3: 0x2749,
+	0x1de4: 0x2751, 0x1de5: 0x2759, 0x1de6: 0x2761, 0x1de7: 0x2769, 0x1de8: 0x2771, 0x1de9: 0x2779,
+	0x1dea: 0x2781, 0x1deb: 0x2789, 0x1dec: 0x2791, 0x1ded: 0x2799, 0x1dee: 0x27a1, 0x1def: 0x27a9,
+	0x1df0: 0x27b1, 0x1df1: 0x27b9, 0x1df2: 0x27b9, 0x1df3: 0x27b9, 0x1df4: 0x8bf5, 0x1df5: 0x27c1,
+	0x1df6: 0x27c9, 0x1df7: 0x27d1, 0x1df8: 0x8c15, 0x1df9: 0x27d9, 0x1dfa: 0x27e1, 0x1dfb: 0x27e9,
+	0x1dfc: 0x27f1, 0x1dfd: 0x27f9, 0x1dfe: 0x2801, 0x1dff: 0x2809,
 	// Block 0x78, offset 0x1e00
-	0x1e00: 0xc241, 0x1e01: 0xc279, 0x1e02: 0xc2b1, 0x1e03: 0x0040, 0x1e04: 0x0040, 0x1e05: 0x0040,
-	0x1e06: 0x0040, 0x1e07: 0x0040, 0x1e08: 0x0040, 0x1e09: 0x0040, 0x1e0a: 0x0040, 0x1e0b: 0x0040,
-	0x1e0c: 0x0040, 0x1e0d: 0x0040, 0x1e0e: 0x0040, 0x1e0f: 0x0040, 0x1e10: 0xc2d1, 0x1e11: 0xc2f1,
-	0x1e12: 0xc311, 0x1e13: 0xc331, 0x1e14: 0xc351, 0x1e15: 0xc371, 0x1e16: 0xc391, 0x1e17: 0xc3b1,
-	0x1e18: 0xc3d1, 0x1e19: 0xc3f1, 0x1e1a: 0xc411, 0x1e1b: 0xc431, 0x1e1c: 0xc451, 0x1e1d: 0xc471,
-	0x1e1e: 0xc491, 0x1e1f: 0xc4b1, 0x1e20: 0xc4d1, 0x1e21: 0xc4f1, 0x1e22: 0xc511, 0x1e23: 0xc531,
-	0x1e24: 0xc551, 0x1e25: 0xc571, 0x1e26: 0xc591, 0x1e27: 0xc5b1, 0x1e28: 0xc5d1, 0x1e29: 0xc5f1,
-	0x1e2a: 0xc611, 0x1e2b: 0xc631, 0x1e2c: 0xc651, 0x1e2d: 0xc671, 0x1e2e: 0xc691, 0x1e2f: 0xc6b1,
-	0x1e30: 0xc6d1, 0x1e31: 0xc6f1, 0x1e32: 0xc711, 0x1e33: 0xc731, 0x1e34: 0xc751, 0x1e35: 0xc771,
-	0x1e36: 0xc791, 0x1e37: 0xc7b1, 0x1e38: 0xc7d1, 0x1e39: 0xc7f1, 0x1e3a: 0xc811, 0x1e3b: 0xc831,
-	0x1e3c: 0x0040, 0x1e3d: 0x0040, 0x1e3e: 0x0040, 0x1e3f: 0x0040,
+	0x1e00: 0x2811, 0x1e01: 0x2819, 0x1e02: 0x2821, 0x1e03: 0x2829, 0x1e04: 0x2831, 0x1e05: 0x2839,
+	0x1e06: 0x2839, 0x1e07: 0x2841, 0x1e08: 0x2849, 0x1e09: 0x2851, 0x1e0a: 0x2859, 0x1e0b: 0x2861,
+	0x1e0c: 0x2869, 0x1e0d: 0x2871, 0x1e0e: 0x2879, 0x1e0f: 0x2881, 0x1e10: 0x2889, 0x1e11: 0x2891,
+	0x1e12: 0x2899, 0x1e13: 0x28a1, 0x1e14: 0x28a9, 0x1e15: 0x28b1, 0x1e16: 0x28b9, 0x1e17: 0x28c1,
+	0x1e18: 0x28c9, 0x1e19: 0x8c35, 0x1e1a: 0x28d1, 0x1e1b: 0x28d9, 0x1e1c: 0x28e1, 0x1e1d: 0x24d9,
+	0x1e1e: 0x28e9, 0x1e1f: 0x28f1, 0x1e20: 0x8c55, 0x1e21: 0x8c75, 0x1e22: 0x28f9, 0x1e23: 0x2901,
+	0x1e24: 0x2909, 0x1e25: 0x2911, 0x1e26: 0x2919, 0x1e27: 0x2921, 0x1e28: 0x2040, 0x1e29: 0x2929,
+	0x1e2a: 0x2931, 0x1e2b: 0x2931, 0x1e2c: 0x8c95, 0x1e2d: 0x2939, 0x1e2e: 0x2941, 0x1e2f: 0x2949,
+	0x1e30: 0x2951, 0x1e31: 0x8cb5, 0x1e32: 0x2959, 0x1e33: 0x2961, 0x1e34: 0x2040, 0x1e35: 0x2969,
+	0x1e36: 0x2971, 0x1e37: 0x2979, 0x1e38: 0x2981, 0x1e39: 0x2989, 0x1e3a: 0x2991, 0x1e3b: 0x8cd5,
+	0x1e3c: 0x2999, 0x1e3d: 0x8cf5, 0x1e3e: 0x29a1, 0x1e3f: 0x29a9,
 	// Block 0x79, offset 0x1e40
-	0x1e40: 0xcb61, 0x1e41: 0xcb81, 0x1e42: 0xcba1, 0x1e43: 0x8b55, 0x1e44: 0xcbc1, 0x1e45: 0xcbe1,
-	0x1e46: 0xcc01, 0x1e47: 0xcc21, 0x1e48: 0xcc41, 0x1e49: 0xcc61, 0x1e4a: 0xcc81, 0x1e4b: 0xcca1,
-	0x1e4c: 0xccc1, 0x1e4d: 0x8b75, 0x1e4e: 0xcce1, 0x1e4f: 0xcd01, 0x1e50: 0xcd21, 0x1e51: 0xcd41,
-	0x1e52: 0x8b95, 0x1e53: 0xcd61, 0x1e54: 0xcd81, 0x1e55: 0xc491, 0x1e56: 0x8bb5, 0x1e57: 0xcda1,
-	0x1e58: 0xcdc1, 0x1e59: 0xcde1, 0x1e5a: 0xce01, 0x1e5b: 0xce21, 0x1e5c: 0x8bd5, 0x1e5d: 0xce41,
-	0x1e5e: 0xce61, 0x1e5f: 0xce81, 0x1e60: 0xcea1, 0x1e61: 0xcec1, 0x1e62: 0xc7f1, 0x1e63: 0xcee1,
-	0x1e64: 0xcf01, 0x1e65: 0xcf21, 0x1e66: 0xcf41, 0x1e67: 0xcf61, 0x1e68: 0xcf81, 0x1e69: 0xcfa1,
-	0x1e6a: 0xcfc1, 0x1e6b: 0xcfe1, 0x1e6c: 0xd001, 0x1e6d: 0xd021, 0x1e6e: 0xd041, 0x1e6f: 0xd061,
-	0x1e70: 0xd081, 0x1e71: 0xd0a1, 0x1e72: 0xd0a1, 0x1e73: 0xd0a1, 0x1e74: 0x8bf5, 0x1e75: 0xd0c1,
-	0x1e76: 0xd0e1, 0x1e77: 0xd101, 0x1e78: 0x8c15, 0x1e79: 0xd121, 0x1e7a: 0xd141, 0x1e7b: 0xd161,
-	0x1e7c: 0xd181, 0x1e7d: 0xd1a1, 0x1e7e: 0xd1c1, 0x1e7f: 0xd1e1,
+	0x1e40: 0x29b1, 0x1e41: 0x29b9, 0x1e42: 0x29c1, 0x1e43: 0x29c9, 0x1e44: 0x29d1, 0x1e45: 0x29d9,
+	0x1e46: 0x29e1, 0x1e47: 0x29e9, 0x1e48: 0x29f1, 0x1e49: 0x8d15, 0x1e4a: 0x29f9, 0x1e4b: 0x2a01,
+	0x1e4c: 0x2a09, 0x1e4d: 0x2a11, 0x1e4e: 0x2a19, 0x1e4f: 0x8d35, 0x1e50: 0x2a21, 0x1e51: 0x8d55,
+	0x1e52: 0x8d75, 0x1e53: 0x2a29, 0x1e54: 0x2a31, 0x1e55: 0x2a31, 0x1e56: 0x2a39, 0x1e57: 0x8d95,
+	0x1e58: 0x8db5, 0x1e59: 0x2a41, 0x1e5a: 0x2a49, 0x1e5b: 0x2a51, 0x1e5c: 0x2a59, 0x1e5d: 0x2a61,
+	0x1e5e: 0x2a69, 0x1e5f: 0x2a71, 0x1e60: 0x2a79, 0x1e61: 0x2a81, 0x1e62: 0x2a89, 0x1e63: 0x2a91,
+	0x1e64: 0x8dd5, 0x1e65: 0x2a99, 0x1e66: 0x2aa1, 0x1e67: 0x2aa9, 0x1e68: 0x2ab1, 0x1e69: 0x2aa9,
+	0x1e6a: 0x2ab9, 0x1e6b: 0x2ac1, 0x1e6c: 0x2ac9, 0x1e6d: 0x2ad1, 0x1e6e: 0x2ad9, 0x1e6f: 0x2ae1,
+	0x1e70: 0x2ae9, 0x1e71: 0x2af1, 0x1e72: 0x2af9, 0x1e73: 0x2b01, 0x1e74: 0x2b09, 0x1e75: 0x2b11,
+	0x1e76: 0x2b19, 0x1e77: 0x2b21, 0x1e78: 0x8df5, 0x1e79: 0x2b29, 0x1e7a: 0x2b31, 0x1e7b: 0x2b39,
+	0x1e7c: 0x2b41, 0x1e7d: 0x2b49, 0x1e7e: 0x8e15, 0x1e7f: 0x2b51,
 	// Block 0x7a, offset 0x1e80
-	0x1e80: 0xd201, 0x1e81: 0xd221, 0x1e82: 0xd241, 0x1e83: 0xd261, 0x1e84: 0xd281, 0x1e85: 0xd2a1,
-	0x1e86: 0xd2a1, 0x1e87: 0xd2c1, 0x1e88: 0xd2e1, 0x1e89: 0xd301, 0x1e8a: 0xd321, 0x1e8b: 0xd341,
-	0x1e8c: 0xd361, 0x1e8d: 0xd381, 0x1e8e: 0xd3a1, 0x1e8f: 0xd3c1, 0x1e90: 0xd3e1, 0x1e91: 0xd401,
-	0x1e92: 0xd421, 0x1e93: 0xd441, 0x1e94: 0xd461, 0x1e95: 0xd481, 0x1e96: 0xd4a1, 0x1e97: 0xd4c1,
-	0x1e98: 0xd4e1, 0x1e99: 0x8c35, 0x1e9a: 0xd501, 0x1e9b: 0xd521, 0x1e9c: 0xd541, 0x1e9d: 0xc371,
-	0x1e9e: 0xd561, 0x1e9f: 0xd581, 0x1ea0: 0x8c55, 0x1ea1: 0x8c75, 0x1ea2: 0xd5a1, 0x1ea3: 0xd5c1,
-	0x1ea4: 0xd5e1, 0x1ea5: 0xd601, 0x1ea6: 0xd621, 0x1ea7: 0xd641, 0x1ea8: 0x2040, 0x1ea9: 0xd661,
-	0x1eaa: 0xd681, 0x1eab: 0xd681, 0x1eac: 0x8c95, 0x1ead: 0xd6a1, 0x1eae: 0xd6c1, 0x1eaf: 0xd6e1,
-	0x1eb0: 0xd701, 0x1eb1: 0x8cb5, 0x1eb2: 0xd721, 0x1eb3: 0xd741, 0x1eb4: 0x2040, 0x1eb5: 0xd761,
-	0x1eb6: 0xd781, 0x1eb7: 0xd7a1, 0x1eb8: 0xd7c1, 0x1eb9: 0xd7e1, 0x1eba: 0xd801, 0x1ebb: 0x8cd5,
-	0x1ebc: 0xd821, 0x1ebd: 0x8cf5, 0x1ebe: 0xd841, 0x1ebf: 0xd861,
+	0x1e80: 0x2b59, 0x1e81: 0x2b61, 0x1e82: 0x2b69, 0x1e83: 0x2b71, 0x1e84: 0x2b79, 0x1e85: 0x2b81,
+	0x1e86: 0x2b89, 0x1e87: 0x2b91, 0x1e88: 0x2b99, 0x1e89: 0x2ba1, 0x1e8a: 0x8e35, 0x1e8b: 0x2ba9,
+	0x1e8c: 0x2bb1, 0x1e8d: 0x2bb9, 0x1e8e: 0x2bc1, 0x1e8f: 0x2bc9, 0x1e90: 0x2bd1, 0x1e91: 0x2bd9,
+	0x1e92: 0x2be1, 0x1e93: 0x2be9, 0x1e94: 0x2bf1, 0x1e95: 0x2bf9, 0x1e96: 0x2c01, 0x1e97: 0x2c09,
+	0x1e98: 0x2c11, 0x1e99: 0x2c19, 0x1e9a: 0x2c21, 0x1e9b: 0x2c29, 0x1e9c: 0x2c31, 0x1e9d: 0x8e55,
+	0x1e9e: 0x2c39, 0x1e9f: 0x2c41, 0x1ea0: 0x2c49, 0x1ea1: 0x2c51, 0x1ea2: 0x2c59, 0x1ea3: 0x8e75,
+	0x1ea4: 0x2c61, 0x1ea5: 0x2c69, 0x1ea6: 0x2c71, 0x1ea7: 0x2c79, 0x1ea8: 0x2c81, 0x1ea9: 0x2c89,
+	0x1eaa: 0x2c91, 0x1eab: 0x2c99, 0x1eac: 0x7f0d, 0x1ead: 0x2ca1, 0x1eae: 0x2ca9, 0x1eaf: 0x2cb1,
+	0x1eb0: 0x8e95, 0x1eb1: 0x2cb9, 0x1eb2: 0x2cc1, 0x1eb3: 0x2cc9, 0x1eb4: 0x2cd1, 0x1eb5: 0x2cd9,
+	0x1eb6: 0x2ce1, 0x1eb7: 0x8eb5, 0x1eb8: 0x8ed5, 0x1eb9: 0x8ef5, 0x1eba: 0x2ce9, 0x1ebb: 0x8f15,
+	0x1ebc: 0x2cf1, 0x1ebd: 0x2cf9, 0x1ebe: 0x2d01, 0x1ebf: 0x2d09,
 	// Block 0x7b, offset 0x1ec0
-	0x1ec0: 0xd881, 0x1ec1: 0xd8a1, 0x1ec2: 0xd8c1, 0x1ec3: 0xd8e1, 0x1ec4: 0xd901, 0x1ec5: 0xd921,
-	0x1ec6: 0xd941, 0x1ec7: 0xd961, 0x1ec8: 0xd981, 0x1ec9: 0x8d15, 0x1eca: 0xd9a1, 0x1ecb: 0xd9c1,
-	0x1ecc: 0xd9e1, 0x1ecd: 0xda01, 0x1ece: 0xda21, 0x1ecf: 0x8d35, 0x1ed0: 0xda41, 0x1ed1: 0x8d55,
-	0x1ed2: 0x8d75, 0x1ed3: 0xda61, 0x1ed4: 0xda81, 0x1ed5: 0xda81, 0x1ed6: 0xdaa1, 0x1ed7: 0x8d95,
-	0x1ed8: 0x8db5, 0x1ed9: 0xdac1, 0x1eda: 0xdae1, 0x1edb: 0xdb01, 0x1edc: 0xdb21, 0x1edd: 0xdb41,
-	0x1ede: 0xdb61, 0x1edf: 0xdb81, 0x1ee0: 0xdba1, 0x1ee1: 0xdbc1, 0x1ee2: 0xdbe1, 0x1ee3: 0xdc01,
-	0x1ee4: 0x8dd5, 0x1ee5: 0xdc21, 0x1ee6: 0xdc41, 0x1ee7: 0xdc61, 0x1ee8: 0xdc81, 0x1ee9: 0xdc61,
-	0x1eea: 0xdca1, 0x1eeb: 0xdcc1, 0x1eec: 0xdce1, 0x1eed: 0xdd01, 0x1eee: 0xdd21, 0x1eef: 0xdd41,
-	0x1ef0: 0xdd61, 0x1ef1: 0xdd81, 0x1ef2: 0xdda1, 0x1ef3: 0xddc1, 0x1ef4: 0xdde1, 0x1ef5: 0xde01,
-	0x1ef6: 0xde21, 0x1ef7: 0xde41, 0x1ef8: 0x8df5, 0x1ef9: 0xde61, 0x1efa: 0xde81, 0x1efb: 0xdea1,
-	0x1efc: 0xdec1, 0x1efd: 0xdee1, 0x1efe: 0x8e15, 0x1eff: 0xdf01,
+	0x1ec0: 0x2d11, 0x1ec1: 0x2d19, 0x1ec2: 0x2d21, 0x1ec3: 0x2d29, 0x1ec4: 0x2d31, 0x1ec5: 0x2d39,
+	0x1ec6: 0x8f35, 0x1ec7: 0x2d41, 0x1ec8: 0x2d49, 0x1ec9: 0x2d51, 0x1eca: 0x2d59, 0x1ecb: 0x2d61,
+	0x1ecc: 0x2d69, 0x1ecd: 0x8f55, 0x1ece: 0x2d71, 0x1ecf: 0x2d79, 0x1ed0: 0x8f75, 0x1ed1: 0x8f95,
+	0x1ed2: 0x2d81, 0x1ed3: 0x2d89, 0x1ed4: 0x2d91, 0x1ed5: 0x2d99, 0x1ed6: 0x2da1, 0x1ed7: 0x2da9,
+	0x1ed8: 0x2db1, 0x1ed9: 0x2db9, 0x1eda: 0x2dc1, 0x1edb: 0x8fb5, 0x1edc: 0x2dc9, 0x1edd: 0x8fd5,
+	0x1ede: 0x2dd1, 0x1edf: 0x2040, 0x1ee0: 0x2dd9, 0x1ee1: 0x2de1, 0x1ee2: 0x2de9, 0x1ee3: 0x8ff5,
+	0x1ee4: 0x2df1, 0x1ee5: 0x2df9, 0x1ee6: 0x9015, 0x1ee7: 0x9035, 0x1ee8: 0x2e01, 0x1ee9: 0x2e09,
+	0x1eea: 0x2e11, 0x1eeb: 0x2e19, 0x1eec: 0x2e21, 0x1eed: 0x2e21, 0x1eee: 0x2e29, 0x1eef: 0x2e31,
+	0x1ef0: 0x2e39, 0x1ef1: 0x2e41, 0x1ef2: 0x2e49, 0x1ef3: 0x2e51, 0x1ef4: 0x2e59, 0x1ef5: 0x9055,
+	0x1ef6: 0x2e61, 0x1ef7: 0x9075, 0x1ef8: 0x2e69, 0x1ef9: 0x9095, 0x1efa: 0x2e71, 0x1efb: 0x90b5,
+	0x1efc: 0x90d5, 0x1efd: 0x90f5, 0x1efe: 0x2e79, 0x1eff: 0x2e81,
 	// Block 0x7c, offset 0x1f00
-	0x1f00: 0xe601, 0x1f01: 0xe621, 0x1f02: 0xe641, 0x1f03: 0xe661, 0x1f04: 0xe681, 0x1f05: 0xe6a1,
-	0x1f06: 0x8f35, 0x1f07: 0xe6c1, 0x1f08: 0xe6e1, 0x1f09: 0xe701, 0x1f0a: 0xe721, 0x1f0b: 0xe741,
-	0x1f0c: 0xe761, 0x1f0d: 0x8f55, 0x1f0e: 0xe781, 0x1f0f: 0xe7a1, 0x1f10: 0x8f75, 0x1f11: 0x8f95,
-	0x1f12: 0xe7c1, 0x1f13: 0xe7e1, 0x1f14: 0xe801, 0x1f15: 0xe821, 0x1f16: 0xe841, 0x1f17: 0xe861,
-	0x1f18: 0xe881, 0x1f19: 0xe8a1, 0x1f1a: 0xe8c1, 0x1f1b: 0x8fb5, 0x1f1c: 0xe8e1, 0x1f1d: 0x8fd5,
-	0x1f1e: 0xe901, 0x1f1f: 0x2040, 0x1f20: 0xe921, 0x1f21: 0xe941, 0x1f22: 0xe961, 0x1f23: 0x8ff5,
-	0x1f24: 0xe981, 0x1f25: 0xe9a1, 0x1f26: 0x9015, 0x1f27: 0x9035, 0x1f28: 0xe9c1, 0x1f29: 0xe9e1,
-	0x1f2a: 0xea01, 0x1f2b: 0xea21, 0x1f2c: 0xea41, 0x1f2d: 0xea41, 0x1f2e: 0xea61, 0x1f2f: 0xea81,
-	0x1f30: 0xeaa1, 0x1f31: 0xeac1, 0x1f32: 0xeae1, 0x1f33: 0xeb01, 0x1f34: 0xeb21, 0x1f35: 0x9055,
-	0x1f36: 0xeb41, 0x1f37: 0x9075, 0x1f38: 0xeb61, 0x1f39: 0x9095, 0x1f3a: 0xeb81, 0x1f3b: 0x90b5,
-	0x1f3c: 0x90d5, 0x1f3d: 0x90f5, 0x1f3e: 0xeba1, 0x1f3f: 0xebc1,
+	0x1f00: 0x2e89, 0x1f01: 0x9115, 0x1f02: 0x9135, 0x1f03: 0x9155, 0x1f04: 0x9175, 0x1f05: 0x2e91,
+	0x1f06: 0x2e99, 0x1f07: 0x2e99, 0x1f08: 0x2ea1, 0x1f09: 0x2ea9, 0x1f0a: 0x2eb1, 0x1f0b: 0x2eb9,
+	0x1f0c: 0x2ec1, 0x1f0d: 0x9195, 0x1f0e: 0x2ec9, 0x1f0f: 0x2ed1, 0x1f10: 0x2ed9, 0x1f11: 0x2ee1,
+	0x1f12: 0x91b5, 0x1f13: 0x2ee9, 0x1f14: 0x91d5, 0x1f15: 0x91f5, 0x1f16: 0x2ef1, 0x1f17: 0x2ef9,
+	0x1f18: 0x2f01, 0x1f19: 0x2f09, 0x1f1a: 0x2f11, 0x1f1b: 0x2f19, 0x1f1c: 0x9215, 0x1f1d: 0x9235,
+	0x1f1e: 0x9255, 0x1f1f: 0x2040, 0x1f20: 0x2f21, 0x1f21: 0x9275, 0x1f22: 0x2f29, 0x1f23: 0x2f31,
+	0x1f24: 0x2f39, 0x1f25: 0x9295, 0x1f26: 0x2f41, 0x1f27: 0x2f49, 0x1f28: 0x2f51, 0x1f29: 0x2f59,
+	0x1f2a: 0x2f61, 0x1f2b: 0x92b5, 0x1f2c: 0x2f69, 0x1f2d: 0x2f71, 0x1f2e: 0x2f79, 0x1f2f: 0x2f81,
+	0x1f30: 0x2f89, 0x1f31: 0x2f91, 0x1f32: 0x92d5, 0x1f33: 0x92f5, 0x1f34: 0x2f99, 0x1f35: 0x9315,
+	0x1f36: 0x2fa1, 0x1f37: 0x9335, 0x1f38: 0x2fa9, 0x1f39: 0x2fb1, 0x1f3a: 0x2fb9, 0x1f3b: 0x9355,
+	0x1f3c: 0x9375, 0x1f3d: 0x2fc1, 0x1f3e: 0x9395, 0x1f3f: 0x2fc9,
 	// Block 0x7d, offset 0x1f40
-	0x1f40: 0xebe1, 0x1f41: 0x9115, 0x1f42: 0x9135, 0x1f43: 0x9155, 0x1f44: 0x9175, 0x1f45: 0xec01,
-	0x1f46: 0xec21, 0x1f47: 0xec21, 0x1f48: 0xec41, 0x1f49: 0xec61, 0x1f4a: 0xec81, 0x1f4b: 0xeca1,
-	0x1f4c: 0xecc1, 0x1f4d: 0x9195, 0x1f4e: 0xece1, 0x1f4f: 0xed01, 0x1f50: 0xed21, 0x1f51: 0xed41,
-	0x1f52: 0x91b5, 0x1f53: 0xed61, 0x1f54: 0x91d5, 0x1f55: 0x91f5, 0x1f56: 0xed81, 0x1f57: 0xeda1,
-	0x1f58: 0xedc1, 0x1f59: 0xede1, 0x1f5a: 0xee01, 0x1f5b: 0xee21, 0x1f5c: 0x9215, 0x1f5d: 0x9235,
-	0x1f5e: 0x9255, 0x1f5f: 0x2040, 0x1f60: 0xee41, 0x1f61: 0x9275, 0x1f62: 0xee61, 0x1f63: 0xee81,
-	0x1f64: 0xeea1, 0x1f65: 0x9295, 0x1f66: 0xeec1, 0x1f67: 0xeee1, 0x1f68: 0xef01, 0x1f69: 0xef21,
-	0x1f6a: 0xef41, 0x1f6b: 0x92b5, 0x1f6c: 0xef61, 0x1f6d: 0xef81, 0x1f6e: 0xefa1, 0x1f6f: 0xefc1,
-	0x1f70: 0xefe1, 0x1f71: 0xf001, 0x1f72: 0x92d5, 0x1f73: 0x92f5, 0x1f74: 0xf021, 0x1f75: 0x9315,
-	0x1f76: 0xf041, 0x1f77: 0x9335, 0x1f78: 0xf061, 0x1f79: 0xf081, 0x1f7a: 0xf0a1, 0x1f7b: 0x9355,
-	0x1f7c: 0x9375, 0x1f7d: 0xf0c1, 0x1f7e: 0x9395, 0x1f7f: 0xf0e1,
+	0x1f40: 0x93b5, 0x1f41: 0x2fd1, 0x1f42: 0x2fd9, 0x1f43: 0x2fe1, 0x1f44: 0x2fe9, 0x1f45: 0x2ff1,
+	0x1f46: 0x2ff9, 0x1f47: 0x93d5, 0x1f48: 0x93f5, 0x1f49: 0x9415, 0x1f4a: 0x9435, 0x1f4b: 0x2a29,
+	0x1f4c: 0x3001, 0x1f4d: 0x3009, 0x1f4e: 0x3011, 0x1f4f: 0x3019, 0x1f50: 0x3021, 0x1f51: 0x3029,
+	0x1f52: 0x3031, 0x1f53: 0x3039, 0x1f54: 0x3041, 0x1f55: 0x3049, 0x1f56: 0x3051, 0x1f57: 0x9455,
+	0x1f58: 0x3059, 0x1f59: 0x3061, 0x1f5a: 0x3069, 0x1f5b: 0x3071, 0x1f5c: 0x3079, 0x1f5d: 0x3081,
+	0x1f5e: 0x3089, 0x1f5f: 0x3091, 0x1f60: 0x3099, 0x1f61: 0x30a1, 0x1f62: 0x30a9, 0x1f63: 0x30b1,
+	0x1f64: 0x9475, 0x1f65: 0x9495, 0x1f66: 0x94b5, 0x1f67: 0x30b9, 0x1f68: 0x30c1, 0x1f69: 0x30c9,
+	0x1f6a: 0x30d1, 0x1f6b: 0x94d5, 0x1f6c: 0x30d9, 0x1f6d: 0x94f5, 0x1f6e: 0x30e1, 0x1f6f: 0x30e9,
+	0x1f70: 0x9515, 0x1f71: 0x9535, 0x1f72: 0x30f1, 0x1f73: 0x30f9, 0x1f74: 0x3101, 0x1f75: 0x3109,
+	0x1f76: 0x3111, 0x1f77: 0x3119, 0x1f78: 0x3121, 0x1f79: 0x3129, 0x1f7a: 0x3131, 0x1f7b: 0x3139,
+	0x1f7c: 0x3141, 0x1f7d: 0x3149, 0x1f7e: 0x3151, 0x1f7f: 0x2040,
 	// Block 0x7e, offset 0x1f80
-	0x1f80: 0xf721, 0x1f81: 0xf741, 0x1f82: 0xf761, 0x1f83: 0xf781, 0x1f84: 0xf7a1, 0x1f85: 0x9555,
-	0x1f86: 0xf7c1, 0x1f87: 0xf7e1, 0x1f88: 0xf801, 0x1f89: 0xf821, 0x1f8a: 0xf841, 0x1f8b: 0x9575,
-	0x1f8c: 0x9595, 0x1f8d: 0xf861, 0x1f8e: 0xf881, 0x1f8f: 0xf8a1, 0x1f90: 0xf8c1, 0x1f91: 0xf8e1,
-	0x1f92: 0xf901, 0x1f93: 0x95b5, 0x1f94: 0xf921, 0x1f95: 0xf941, 0x1f96: 0xf961, 0x1f97: 0xf981,
-	0x1f98: 0x95d5, 0x1f99: 0x95f5, 0x1f9a: 0xf9a1, 0x1f9b: 0xf9c1, 0x1f9c: 0xf9e1, 0x1f9d: 0x9615,
-	0x1f9e: 0xfa01, 0x1f9f: 0xfa21, 0x1fa0: 0x684d, 0x1fa1: 0x9635, 0x1fa2: 0xfa41, 0x1fa3: 0xfa61,
-	0x1fa4: 0xfa81, 0x1fa5: 0x9655, 0x1fa6: 0xfaa1, 0x1fa7: 0xfac1, 0x1fa8: 0xfae1, 0x1fa9: 0xfb01,
-	0x1faa: 0xfb21, 0x1fab: 0xfb41, 0x1fac: 0xfb61, 0x1fad: 0x9675, 0x1fae: 0xfb81, 0x1faf: 0xfba1,
-	0x1fb0: 0xfbc1, 0x1fb1: 0x9695, 0x1fb2: 0xfbe1, 0x1fb3: 0xfc01, 0x1fb4: 0xfc21, 0x1fb5: 0xfc41,
-	0x1fb6: 0x7b6d, 0x1fb7: 0x96b5, 0x1fb8: 0xfc61, 0x1fb9: 0xfc81, 0x1fba: 0xfca1, 0x1fbb: 0x96d5,
-	0x1fbc: 0xfcc1, 0x1fbd: 0x96f5, 0x1fbe: 0xfce1, 0x1fbf: 0xfce1,
+	0x1f80: 0x3159, 0x1f81: 0x3161, 0x1f82: 0x3169, 0x1f83: 0x3171, 0x1f84: 0x3179, 0x1f85: 0x9555,
+	0x1f86: 0x3181, 0x1f87: 0x3189, 0x1f88: 0x3191, 0x1f89: 0x3199, 0x1f8a: 0x31a1, 0x1f8b: 0x9575,
+	0x1f8c: 0x9595, 0x1f8d: 0x31a9, 0x1f8e: 0x31b1, 0x1f8f: 0x31b9, 0x1f90: 0x31c1, 0x1f91: 0x31c9,
+	0x1f92: 0x31d1, 0x1f93: 0x95b5, 0x1f94: 0x31d9, 0x1f95: 0x31e1, 0x1f96: 0x31e9, 0x1f97: 0x31f1,
+	0x1f98: 0x95d5, 0x1f99: 0x95f5, 0x1f9a: 0x31f9, 0x1f9b: 0x3201, 0x1f9c: 0x3209, 0x1f9d: 0x9615,
+	0x1f9e: 0x3211, 0x1f9f: 0x3219, 0x1fa0: 0x684d, 0x1fa1: 0x9635, 0x1fa2: 0x3221, 0x1fa3: 0x3229,
+	0x1fa4: 0x3231, 0x1fa5: 0x9655, 0x1fa6: 0x3239, 0x1fa7: 0x3241, 0x1fa8: 0x3249, 0x1fa9: 0x3251,
+	0x1faa: 0x3259, 0x1fab: 0x3261, 0x1fac: 0x3269, 0x1fad: 0x9675, 0x1fae: 0x3271, 0x1faf: 0x3279,
+	0x1fb0: 0x3281, 0x1fb1: 0x9695, 0x1fb2: 0x3289, 0x1fb3: 0x3291, 0x1fb4: 0x3299, 0x1fb5: 0x32a1,
+	0x1fb6: 0x7b6d, 0x1fb7: 0x96b5, 0x1fb8: 0x32a9, 0x1fb9: 0x32b1, 0x1fba: 0x32b9, 0x1fbb: 0x96d5,
+	0x1fbc: 0x32c1, 0x1fbd: 0x96f5, 0x1fbe: 0x32c9, 0x1fbf: 0x32c9,
 	// Block 0x7f, offset 0x1fc0
-	0x1fc0: 0xfd01, 0x1fc1: 0x9715, 0x1fc2: 0xfd21, 0x1fc3: 0xfd41, 0x1fc4: 0xfd61, 0x1fc5: 0xfd81,
-	0x1fc6: 0xfda1, 0x1fc7: 0xfdc1, 0x1fc8: 0xfde1, 0x1fc9: 0x9735, 0x1fca: 0xfe01, 0x1fcb: 0xfe21,
-	0x1fcc: 0xfe41, 0x1fcd: 0xfe61, 0x1fce: 0xfe81, 0x1fcf: 0xfea1, 0x1fd0: 0x9755, 0x1fd1: 0xfec1,
-	0x1fd2: 0x9775, 0x1fd3: 0x9795, 0x1fd4: 0x97b5, 0x1fd5: 0xfee1, 0x1fd6: 0xff01, 0x1fd7: 0xff21,
-	0x1fd8: 0xff41, 0x1fd9: 0xff61, 0x1fda: 0xff81, 0x1fdb: 0xffa1, 0x1fdc: 0xffc1, 0x1fdd: 0x97d5,
+	0x1fc0: 0x32d1, 0x1fc1: 0x9715, 0x1fc2: 0x32d9, 0x1fc3: 0x32e1, 0x1fc4: 0x32e9, 0x1fc5: 0x32f1,
+	0x1fc6: 0x32f9, 0x1fc7: 0x3301, 0x1fc8: 0x3309, 0x1fc9: 0x9735, 0x1fca: 0x3311, 0x1fcb: 0x3319,
+	0x1fcc: 0x3321, 0x1fcd: 0x3329, 0x1fce: 0x3331, 0x1fcf: 0x3339, 0x1fd0: 0x9755, 0x1fd1: 0x3341,
+	0x1fd2: 0x9775, 0x1fd3: 0x9795, 0x1fd4: 0x97b5, 0x1fd5: 0x3349, 0x1fd6: 0x3351, 0x1fd7: 0x3359,
+	0x1fd8: 0x3361, 0x1fd9: 0x3369, 0x1fda: 0x3371, 0x1fdb: 0x3379, 0x1fdc: 0x3381, 0x1fdd: 0x97d5,
 	0x1fde: 0x0040, 0x1fdf: 0x0040, 0x1fe0: 0x0040, 0x1fe1: 0x0040, 0x1fe2: 0x0040, 0x1fe3: 0x0040,
 	0x1fe4: 0x0040, 0x1fe5: 0x0040, 0x1fe6: 0x0040, 0x1fe7: 0x0040, 0x1fe8: 0x0040, 0x1fe9: 0x0040,
 	0x1fea: 0x0040, 0x1feb: 0x0040, 0x1fec: 0x0040, 0x1fed: 0x0040, 0x1fee: 0x0040, 0x1fef: 0x0040,
@@ -2134,7 +2277,7 @@ var idnaIndex = [2368]uint16{
 	0x1b8: 0xd6, 0x1b9: 0xd7, 0x1ba: 0xd8, 0x1bb: 0xd9, 0x1bc: 0xda, 0x1bd: 0xdb, 0x1be: 0xdc, 0x1bf: 0x37,
 	// Block 0x7, offset 0x1c0
 	0x1c0: 0x38, 0x1c1: 0xdd, 0x1c2: 0xde, 0x1c3: 0xdf, 0x1c4: 0xe0, 0x1c5: 0x39, 0x1c6: 0x3a, 0x1c7: 0xe1,
-	0x1c8: 0xe2, 0x1c9: 0x3b, 0x1ca: 0x3c, 0x1cb: 0x3d, 0x1cc: 0x3e, 0x1cd: 0x3f, 0x1ce: 0x40, 0x1cf: 0x41,
+	0x1c8: 0xe2, 0x1c9: 0x3b, 0x1ca: 0x3c, 0x1cb: 0x3d, 0x1cc: 0xe3, 0x1cd: 0xe4, 0x1ce: 0x3e, 0x1cf: 0x3f,
 	0x1d0: 0xa0, 0x1d1: 0xa0, 0x1d2: 0xa0, 0x1d3: 0xa0, 0x1d4: 0xa0, 0x1d5: 0xa0, 0x1d6: 0xa0, 0x1d7: 0xa0,
 	0x1d8: 0xa0, 0x1d9: 0xa0, 0x1da: 0xa0, 0x1db: 0xa0, 0x1dc: 0xa0, 0x1dd: 0xa0, 0x1de: 0xa0, 0x1df: 0xa0,
 	0x1e0: 0xa0, 0x1e1: 0xa0, 0x1e2: 0xa0, 0x1e3: 0xa0, 0x1e4: 0xa0, 0x1e5: 0xa0, 0x1e6: 0xa0, 0x1e7: 0xa0,
@@ -2167,143 +2310,143 @@ var idnaIndex = [2368]uint16{
 	0x2a0: 0xa0, 0x2a1: 0xa0, 0x2a2: 0xa0, 0x2a3: 0xa0, 0x2a4: 0xa0, 0x2a5: 0xa0, 0x2a6: 0xa0, 0x2a7: 0xa0,
 	0x2a8: 0xa0, 0x2a9: 0xa0, 0x2aa: 0xa0, 0x2ab: 0xa0, 0x2ac: 0xa0, 0x2ad: 0xa0, 0x2ae: 0xa0, 0x2af: 0xa0,
 	0x2b0: 0xa0, 0x2b1: 0xa0, 0x2b2: 0xa0, 0x2b3: 0xa0, 0x2b4: 0xa0, 0x2b5: 0xa0, 0x2b6: 0xa0, 0x2b7: 0xa0,
-	0x2b8: 0xa0, 0x2b9: 0xa0, 0x2ba: 0xa0, 0x2bb: 0xa0, 0x2bc: 0xa0, 0x2bd: 0xa0, 0x2be: 0xa0, 0x2bf: 0xe3,
+	0x2b8: 0xa0, 0x2b9: 0xa0, 0x2ba: 0xa0, 0x2bb: 0xa0, 0x2bc: 0xa0, 0x2bd: 0xa0, 0x2be: 0xa0, 0x2bf: 0xe5,
 	// Block 0xb, offset 0x2c0
 	0x2c0: 0xa0, 0x2c1: 0xa0, 0x2c2: 0xa0, 0x2c3: 0xa0, 0x2c4: 0xa0, 0x2c5: 0xa0, 0x2c6: 0xa0, 0x2c7: 0xa0,
 	0x2c8: 0xa0, 0x2c9: 0xa0, 0x2ca: 0xa0, 0x2cb: 0xa0, 0x2cc: 0xa0, 0x2cd: 0xa0, 0x2ce: 0xa0, 0x2cf: 0xa0,
-	0x2d0: 0xa0, 0x2d1: 0xa0, 0x2d2: 0xe4, 0x2d3: 0xe5, 0x2d4: 0xa0, 0x2d5: 0xa0, 0x2d6: 0xa0, 0x2d7: 0xa0,
-	0x2d8: 0xe6, 0x2d9: 0x42, 0x2da: 0x43, 0x2db: 0xe7, 0x2dc: 0x44, 0x2dd: 0x45, 0x2de: 0x46, 0x2df: 0xe8,
-	0x2e0: 0xe9, 0x2e1: 0xea, 0x2e2: 0xeb, 0x2e3: 0xec, 0x2e4: 0xed, 0x2e5: 0xee, 0x2e6: 0xef, 0x2e7: 0xf0,
-	0x2e8: 0xf1, 0x2e9: 0xf2, 0x2ea: 0xf3, 0x2eb: 0xf4, 0x2ec: 0xf5, 0x2ed: 0xf6, 0x2ee: 0xf7, 0x2ef: 0xf8,
+	0x2d0: 0xa0, 0x2d1: 0xa0, 0x2d2: 0xe6, 0x2d3: 0xe7, 0x2d4: 0xa0, 0x2d5: 0xa0, 0x2d6: 0xa0, 0x2d7: 0xa0,
+	0x2d8: 0xe8, 0x2d9: 0x40, 0x2da: 0x41, 0x2db: 0xe9, 0x2dc: 0x42, 0x2dd: 0x43, 0x2de: 0x44, 0x2df: 0xea,
+	0x2e0: 0xeb, 0x2e1: 0xec, 0x2e2: 0xed, 0x2e3: 0xee, 0x2e4: 0xef, 0x2e5: 0xf0, 0x2e6: 0xf1, 0x2e7: 0xf2,
+	0x2e8: 0xf3, 0x2e9: 0xf4, 0x2ea: 0xf5, 0x2eb: 0xf6, 0x2ec: 0xf7, 0x2ed: 0xf8, 0x2ee: 0xf9, 0x2ef: 0xfa,
 	0x2f0: 0xa0, 0x2f1: 0xa0, 0x2f2: 0xa0, 0x2f3: 0xa0, 0x2f4: 0xa0, 0x2f5: 0xa0, 0x2f6: 0xa0, 0x2f7: 0xa0,
 	0x2f8: 0xa0, 0x2f9: 0xa0, 0x2fa: 0xa0, 0x2fb: 0xa0, 0x2fc: 0xa0, 0x2fd: 0xa0, 0x2fe: 0xa0, 0x2ff: 0xa0,
 	// Block 0xc, offset 0x300
 	0x300: 0xa0, 0x301: 0xa0, 0x302: 0xa0, 0x303: 0xa0, 0x304: 0xa0, 0x305: 0xa0, 0x306: 0xa0, 0x307: 0xa0,
 	0x308: 0xa0, 0x309: 0xa0, 0x30a: 0xa0, 0x30b: 0xa0, 0x30c: 0xa0, 0x30d: 0xa0, 0x30e: 0xa0, 0x30f: 0xa0,
 	0x310: 0xa0, 0x311: 0xa0, 0x312: 0xa0, 0x313: 0xa0, 0x314: 0xa0, 0x315: 0xa0, 0x316: 0xa0, 0x317: 0xa0,
-	0x318: 0xa0, 0x319: 0xa0, 0x31a: 0xa0, 0x31b: 0xa0, 0x31c: 0xa0, 0x31d: 0xa0, 0x31e: 0xf9, 0x31f: 0xfa,
+	0x318: 0xa0, 0x319: 0xa0, 0x31a: 0xa0, 0x31b: 0xa0, 0x31c: 0xa0, 0x31d: 0xa0, 0x31e: 0xfb, 0x31f: 0xfc,
 	// Block 0xd, offset 0x340
-	0x340: 0xfb, 0x341: 0xfb, 0x342: 0xfb, 0x343: 0xfb, 0x344: 0xfb, 0x345: 0xfb, 0x346: 0xfb, 0x347: 0xfb,
-	0x348: 0xfb, 0x349: 0xfb, 0x34a: 0xfb, 0x34b: 0xfb, 0x34c: 0xfb, 0x34d: 0xfb, 0x34e: 0xfb, 0x34f: 0xfb,
-	0x350: 0xfb, 0x351: 0xfb, 0x352: 0xfb, 0x353: 0xfb, 0x354: 0xfb, 0x355: 0xfb, 0x356: 0xfb, 0x357: 0xfb,
-	0x358: 0xfb, 0x359: 0xfb, 0x35a: 0xfb, 0x35b: 0xfb, 0x35c: 0xfb, 0x35d: 0xfb, 0x35e: 0xfb, 0x35f: 0xfb,
-	0x360: 0xfb, 0x361: 0xfb, 0x362: 0xfb, 0x363: 0xfb, 0x364: 0xfb, 0x365: 0xfb, 0x366: 0xfb, 0x367: 0xfb,
-	0x368: 0xfb, 0x369: 0xfb, 0x36a: 0xfb, 0x36b: 0xfb, 0x36c: 0xfb, 0x36d: 0xfb, 0x36e: 0xfb, 0x36f: 0xfb,
-	0x370: 0xfb, 0x371: 0xfb, 0x372: 0xfb, 0x373: 0xfb, 0x374: 0xfb, 0x375: 0xfb, 0x376: 0xfb, 0x377: 0xfb,
-	0x378: 0xfb, 0x379: 0xfb, 0x37a: 0xfb, 0x37b: 0xfb, 0x37c: 0xfb, 0x37d: 0xfb, 0x37e: 0xfb, 0x37f: 0xfb,
+	0x340: 0xfd, 0x341: 0xfd, 0x342: 0xfd, 0x343: 0xfd, 0x344: 0xfd, 0x345: 0xfd, 0x346: 0xfd, 0x347: 0xfd,
+	0x348: 0xfd, 0x349: 0xfd, 0x34a: 0xfd, 0x34b: 0xfd, 0x34c: 0xfd, 0x34d: 0xfd, 0x34e: 0xfd, 0x34f: 0xfd,
+	0x350: 0xfd, 0x351: 0xfd, 0x352: 0xfd, 0x353: 0xfd, 0x354: 0xfd, 0x355: 0xfd, 0x356: 0xfd, 0x357: 0xfd,
+	0x358: 0xfd, 0x359: 0xfd, 0x35a: 0xfd, 0x35b: 0xfd, 0x35c: 0xfd, 0x35d: 0xfd, 0x35e: 0xfd, 0x35f: 0xfd,
+	0x360: 0xfd, 0x361: 0xfd, 0x362: 0xfd, 0x363: 0xfd, 0x364: 0xfd, 0x365: 0xfd, 0x366: 0xfd, 0x367: 0xfd,
+	0x368: 0xfd, 0x369: 0xfd, 0x36a: 0xfd, 0x36b: 0xfd, 0x36c: 0xfd, 0x36d: 0xfd, 0x36e: 0xfd, 0x36f: 0xfd,
+	0x370: 0xfd, 0x371: 0xfd, 0x372: 0xfd, 0x373: 0xfd, 0x374: 0xfd, 0x375: 0xfd, 0x376: 0xfd, 0x377: 0xfd,
+	0x378: 0xfd, 0x379: 0xfd, 0x37a: 0xfd, 0x37b: 0xfd, 0x37c: 0xfd, 0x37d: 0xfd, 0x37e: 0xfd, 0x37f: 0xfd,
 	// Block 0xe, offset 0x380
-	0x380: 0xfb, 0x381: 0xfb, 0x382: 0xfb, 0x383: 0xfb, 0x384: 0xfb, 0x385: 0xfb, 0x386: 0xfb, 0x387: 0xfb,
-	0x388: 0xfb, 0x389: 0xfb, 0x38a: 0xfb, 0x38b: 0xfb, 0x38c: 0xfb, 0x38d: 0xfb, 0x38e: 0xfb, 0x38f: 0xfb,
-	0x390: 0xfb, 0x391: 0xfb, 0x392: 0xfb, 0x393: 0xfb, 0x394: 0xfb, 0x395: 0xfb, 0x396: 0xfb, 0x397: 0xfb,
-	0x398: 0xfb, 0x399: 0xfb, 0x39a: 0xfb, 0x39b: 0xfb, 0x39c: 0xfb, 0x39d: 0xfb, 0x39e: 0xfb, 0x39f: 0xfb,
-	0x3a0: 0xfb, 0x3a1: 0xfb, 0x3a2: 0xfb, 0x3a3: 0xfb, 0x3a4: 0xfc, 0x3a5: 0xfd, 0x3a6: 0xfe, 0x3a7: 0xff,
-	0x3a8: 0x47, 0x3a9: 0x100, 0x3aa: 0x101, 0x3ab: 0x48, 0x3ac: 0x49, 0x3ad: 0x4a, 0x3ae: 0x4b, 0x3af: 0x4c,
-	0x3b0: 0x102, 0x3b1: 0x4d, 0x3b2: 0x4e, 0x3b3: 0x4f, 0x3b4: 0x50, 0x3b5: 0x51, 0x3b6: 0x103, 0x3b7: 0x52,
-	0x3b8: 0x53, 0x3b9: 0x54, 0x3ba: 0x55, 0x3bb: 0x56, 0x3bc: 0x57, 0x3bd: 0x58, 0x3be: 0x59, 0x3bf: 0x5a,
+	0x380: 0xfd, 0x381: 0xfd, 0x382: 0xfd, 0x383: 0xfd, 0x384: 0xfd, 0x385: 0xfd, 0x386: 0xfd, 0x387: 0xfd,
+	0x388: 0xfd, 0x389: 0xfd, 0x38a: 0xfd, 0x38b: 0xfd, 0x38c: 0xfd, 0x38d: 0xfd, 0x38e: 0xfd, 0x38f: 0xfd,
+	0x390: 0xfd, 0x391: 0xfd, 0x392: 0xfd, 0x393: 0xfd, 0x394: 0xfd, 0x395: 0xfd, 0x396: 0xfd, 0x397: 0xfd,
+	0x398: 0xfd, 0x399: 0xfd, 0x39a: 0xfd, 0x39b: 0xfd, 0x39c: 0xfd, 0x39d: 0xfd, 0x39e: 0xfd, 0x39f: 0xfd,
+	0x3a0: 0xfd, 0x3a1: 0xfd, 0x3a2: 0xfd, 0x3a3: 0xfd, 0x3a4: 0xfe, 0x3a5: 0xff, 0x3a6: 0x100, 0x3a7: 0x101,
+	0x3a8: 0x45, 0x3a9: 0x102, 0x3aa: 0x103, 0x3ab: 0x46, 0x3ac: 0x47, 0x3ad: 0x48, 0x3ae: 0x49, 0x3af: 0x4a,
+	0x3b0: 0x104, 0x3b1: 0x4b, 0x3b2: 0x4c, 0x3b3: 0x4d, 0x3b4: 0x4e, 0x3b5: 0x4f, 0x3b6: 0x105, 0x3b7: 0x50,
+	0x3b8: 0x51, 0x3b9: 0x52, 0x3ba: 0x53, 0x3bb: 0x54, 0x3bc: 0x55, 0x3bd: 0x56, 0x3be: 0x57, 0x3bf: 0x58,
 	// Block 0xf, offset 0x3c0
-	0x3c0: 0x104, 0x3c1: 0x105, 0x3c2: 0xa0, 0x3c3: 0x106, 0x3c4: 0x107, 0x3c5: 0x9c, 0x3c6: 0x108, 0x3c7: 0x109,
-	0x3c8: 0xfb, 0x3c9: 0xfb, 0x3ca: 0x10a, 0x3cb: 0x10b, 0x3cc: 0x10c, 0x3cd: 0x10d, 0x3ce: 0x10e, 0x3cf: 0x10f,
-	0x3d0: 0x110, 0x3d1: 0xa0, 0x3d2: 0x111, 0x3d3: 0x112, 0x3d4: 0x113, 0x3d5: 0x114, 0x3d6: 0xfb, 0x3d7: 0xfb,
-	0x3d8: 0xa0, 0x3d9: 0xa0, 0x3da: 0xa0, 0x3db: 0xa0, 0x3dc: 0x115, 0x3dd: 0x116, 0x3de: 0xfb, 0x3df: 0xfb,
-	0x3e0: 0x117, 0x3e1: 0x118, 0x3e2: 0x119, 0x3e3: 0x11a, 0x3e4: 0x11b, 0x3e5: 0xfb, 0x3e6: 0x11c, 0x3e7: 0x11d,
-	0x3e8: 0x11e, 0x3e9: 0x11f, 0x3ea: 0x120, 0x3eb: 0x5b, 0x3ec: 0x121, 0x3ed: 0x122, 0x3ee: 0x5c, 0x3ef: 0xfb,
-	0x3f0: 0x123, 0x3f1: 0x124, 0x3f2: 0x125, 0x3f3: 0x126, 0x3f4: 0x127, 0x3f5: 0xfb, 0x3f6: 0xfb, 0x3f7: 0xfb,
-	0x3f8: 0xfb, 0x3f9: 0x128, 0x3fa: 0x129, 0x3fb: 0xfb, 0x3fc: 0x12a, 0x3fd: 0x12b, 0x3fe: 0x12c, 0x3ff: 0x12d,
+	0x3c0: 0x106, 0x3c1: 0x107, 0x3c2: 0xa0, 0x3c3: 0x108, 0x3c4: 0x109, 0x3c5: 0x9c, 0x3c6: 0x10a, 0x3c7: 0x10b,
+	0x3c8: 0xfd, 0x3c9: 0xfd, 0x3ca: 0x10c, 0x3cb: 0x10d, 0x3cc: 0x10e, 0x3cd: 0x10f, 0x3ce: 0x110, 0x3cf: 0x111,
+	0x3d0: 0x112, 0x3d1: 0xa0, 0x3d2: 0x113, 0x3d3: 0x114, 0x3d4: 0x115, 0x3d5: 0x116, 0x3d6: 0xfd, 0x3d7: 0xfd,
+	0x3d8: 0xa0, 0x3d9: 0xa0, 0x3da: 0xa0, 0x3db: 0xa0, 0x3dc: 0x117, 0x3dd: 0x118, 0x3de: 0xfd, 0x3df: 0xfd,
+	0x3e0: 0x119, 0x3e1: 0x11a, 0x3e2: 0x11b, 0x3e3: 0x11c, 0x3e4: 0x11d, 0x3e5: 0xfd, 0x3e6: 0x11e, 0x3e7: 0x11f,
+	0x3e8: 0x120, 0x3e9: 0x121, 0x3ea: 0x122, 0x3eb: 0x59, 0x3ec: 0x123, 0x3ed: 0x124, 0x3ee: 0x5a, 0x3ef: 0xfd,
+	0x3f0: 0x125, 0x3f1: 0x126, 0x3f2: 0x127, 0x3f3: 0x128, 0x3f4: 0x129, 0x3f5: 0xfd, 0x3f6: 0xfd, 0x3f7: 0xfd,
+	0x3f8: 0xfd, 0x3f9: 0x12a, 0x3fa: 0x12b, 0x3fb: 0xfd, 0x3fc: 0x12c, 0x3fd: 0x12d, 0x3fe: 0x12e, 0x3ff: 0x12f,
 	// Block 0x10, offset 0x400
-	0x400: 0x12e, 0x401: 0x12f, 0x402: 0x130, 0x403: 0x131, 0x404: 0x132, 0x405: 0x133, 0x406: 0x134, 0x407: 0x135,
-	0x408: 0x136, 0x409: 0xfb, 0x40a: 0x137, 0x40b: 0x138, 0x40c: 0x5d, 0x40d: 0x5e, 0x40e: 0xfb, 0x40f: 0xfb,
-	0x410: 0x139, 0x411: 0x13a, 0x412: 0x13b, 0x413: 0x13c, 0x414: 0xfb, 0x415: 0xfb, 0x416: 0x13d, 0x417: 0x13e,
-	0x418: 0x13f, 0x419: 0x140, 0x41a: 0x141, 0x41b: 0x142, 0x41c: 0x143, 0x41d: 0xfb, 0x41e: 0xfb, 0x41f: 0xfb,
-	0x420: 0x144, 0x421: 0xfb, 0x422: 0x145, 0x423: 0x146, 0x424: 0x5f, 0x425: 0x147, 0x426: 0x148, 0x427: 0x149,
-	0x428: 0x14a, 0x429: 0x14b, 0x42a: 0x14c, 0x42b: 0x14d, 0x42c: 0xfb, 0x42d: 0xfb, 0x42e: 0xfb, 0x42f: 0xfb,
-	0x430: 0x14e, 0x431: 0x14f, 0x432: 0x150, 0x433: 0xfb, 0x434: 0x151, 0x435: 0x152, 0x436: 0x153, 0x437: 0xfb,
-	0x438: 0xfb, 0x439: 0xfb, 0x43a: 0xfb, 0x43b: 0x154, 0x43c: 0xfb, 0x43d: 0xfb, 0x43e: 0x155, 0x43f: 0x156,
+	0x400: 0x130, 0x401: 0x131, 0x402: 0x132, 0x403: 0x133, 0x404: 0x134, 0x405: 0x135, 0x406: 0x136, 0x407: 0x137,
+	0x408: 0x138, 0x409: 0xfd, 0x40a: 0x139, 0x40b: 0x13a, 0x40c: 0x5b, 0x40d: 0x5c, 0x40e: 0xfd, 0x40f: 0xfd,
+	0x410: 0x13b, 0x411: 0x13c, 0x412: 0x13d, 0x413: 0x13e, 0x414: 0xfd, 0x415: 0xfd, 0x416: 0x13f, 0x417: 0x140,
+	0x418: 0x141, 0x419: 0x142, 0x41a: 0x143, 0x41b: 0x144, 0x41c: 0x145, 0x41d: 0xfd, 0x41e: 0xfd, 0x41f: 0xfd,
+	0x420: 0x146, 0x421: 0xfd, 0x422: 0x147, 0x423: 0x148, 0x424: 0x5d, 0x425: 0x149, 0x426: 0x14a, 0x427: 0x14b,
+	0x428: 0x14c, 0x429: 0x14d, 0x42a: 0x14e, 0x42b: 0x14f, 0x42c: 0xfd, 0x42d: 0xfd, 0x42e: 0xfd, 0x42f: 0xfd,
+	0x430: 0x150, 0x431: 0x151, 0x432: 0x152, 0x433: 0xfd, 0x434: 0x153, 0x435: 0x154, 0x436: 0x155, 0x437: 0xfd,
+	0x438: 0xfd, 0x439: 0xfd, 0x43a: 0xfd, 0x43b: 0x156, 0x43c: 0xfd, 0x43d: 0xfd, 0x43e: 0x157, 0x43f: 0x158,
 	// Block 0x11, offset 0x440
 	0x440: 0xa0, 0x441: 0xa0, 0x442: 0xa0, 0x443: 0xa0, 0x444: 0xa0, 0x445: 0xa0, 0x446: 0xa0, 0x447: 0xa0,
-	0x448: 0xa0, 0x449: 0xa0, 0x44a: 0xa0, 0x44b: 0xa0, 0x44c: 0xa0, 0x44d: 0xa0, 0x44e: 0x157, 0x44f: 0xfb,
-	0x450: 0x9c, 0x451: 0x158, 0x452: 0xa0, 0x453: 0xa0, 0x454: 0xa0, 0x455: 0x159, 0x456: 0xfb, 0x457: 0xfb,
-	0x458: 0xfb, 0x459: 0xfb, 0x45a: 0xfb, 0x45b: 0xfb, 0x45c: 0xfb, 0x45d: 0xfb, 0x45e: 0xfb, 0x45f: 0xfb,
-	0x460: 0xfb, 0x461: 0xfb, 0x462: 0xfb, 0x463: 0xfb, 0x464: 0xfb, 0x465: 0xfb, 0x466: 0xfb, 0x467: 0xfb,
-	0x468: 0xfb, 0x469: 0xfb, 0x46a: 0xfb, 0x46b: 0xfb, 0x46c: 0xfb, 0x46d: 0xfb, 0x46e: 0xfb, 0x46f: 0xfb,
-	0x470: 0xfb, 0x471: 0xfb, 0x472: 0xfb, 0x473: 0xfb, 0x474: 0xfb, 0x475: 0xfb, 0x476: 0xfb, 0x477: 0xfb,
-	0x478: 0xfb, 0x479: 0xfb, 0x47a: 0xfb, 0x47b: 0xfb, 0x47c: 0xfb, 0x47d: 0xfb, 0x47e: 0xfb, 0x47f: 0xfb,
+	0x448: 0xa0, 0x449: 0xa0, 0x44a: 0xa0, 0x44b: 0xa0, 0x44c: 0xa0, 0x44d: 0xa0, 0x44e: 0x159, 0x44f: 0xfd,
+	0x450: 0x9c, 0x451: 0x15a, 0x452: 0xa0, 0x453: 0xa0, 0x454: 0xa0, 0x455: 0x15b, 0x456: 0xfd, 0x457: 0xfd,
+	0x458: 0xfd, 0x459: 0xfd, 0x45a: 0xfd, 0x45b: 0xfd, 0x45c: 0xfd, 0x45d: 0xfd, 0x45e: 0xfd, 0x45f: 0xfd,
+	0x460: 0xfd, 0x461: 0xfd, 0x462: 0xfd, 0x463: 0xfd, 0x464: 0xfd, 0x465: 0xfd, 0x466: 0xfd, 0x467: 0xfd,
+	0x468: 0xfd, 0x469: 0xfd, 0x46a: 0xfd, 0x46b: 0xfd, 0x46c: 0xfd, 0x46d: 0xfd, 0x46e: 0xfd, 0x46f: 0xfd,
+	0x470: 0xfd, 0x471: 0xfd, 0x472: 0xfd, 0x473: 0xfd, 0x474: 0xfd, 0x475: 0xfd, 0x476: 0xfd, 0x477: 0xfd,
+	0x478: 0xfd, 0x479: 0xfd, 0x47a: 0xfd, 0x47b: 0xfd, 0x47c: 0xfd, 0x47d: 0xfd, 0x47e: 0xfd, 0x47f: 0xfd,
 	// Block 0x12, offset 0x480
 	0x480: 0xa0, 0x481: 0xa0, 0x482: 0xa0, 0x483: 0xa0, 0x484: 0xa0, 0x485: 0xa0, 0x486: 0xa0, 0x487: 0xa0,
 	0x488: 0xa0, 0x489: 0xa0, 0x48a: 0xa0, 0x48b: 0xa0, 0x48c: 0xa0, 0x48d: 0xa0, 0x48e: 0xa0, 0x48f: 0xa0,
-	0x490: 0x15a, 0x491: 0xfb, 0x492: 0xfb, 0x493: 0xfb, 0x494: 0xfb, 0x495: 0xfb, 0x496: 0xfb, 0x497: 0xfb,
-	0x498: 0xfb, 0x499: 0xfb, 0x49a: 0xfb, 0x49b: 0xfb, 0x49c: 0xfb, 0x49d: 0xfb, 0x49e: 0xfb, 0x49f: 0xfb,
-	0x4a0: 0xfb, 0x4a1: 0xfb, 0x4a2: 0xfb, 0x4a3: 0xfb, 0x4a4: 0xfb, 0x4a5: 0xfb, 0x4a6: 0xfb, 0x4a7: 0xfb,
-	0x4a8: 0xfb, 0x4a9: 0xfb, 0x4aa: 0xfb, 0x4ab: 0xfb, 0x4ac: 0xfb, 0x4ad: 0xfb, 0x4ae: 0xfb, 0x4af: 0xfb,
-	0x4b0: 0xfb, 0x4b1: 0xfb, 0x4b2: 0xfb, 0x4b3: 0xfb, 0x4b4: 0xfb, 0x4b5: 0xfb, 0x4b6: 0xfb, 0x4b7: 0xfb,
-	0x4b8: 0xfb, 0x4b9: 0xfb, 0x4ba: 0xfb, 0x4bb: 0xfb, 0x4bc: 0xfb, 0x4bd: 0xfb, 0x4be: 0xfb, 0x4bf: 0xfb,
+	0x490: 0x15c, 0x491: 0xfd, 0x492: 0xfd, 0x493: 0xfd, 0x494: 0xfd, 0x495: 0xfd, 0x496: 0xfd, 0x497: 0xfd,
+	0x498: 0xfd, 0x499: 0xfd, 0x49a: 0xfd, 0x49b: 0xfd, 0x49c: 0xfd, 0x49d: 0xfd, 0x49e: 0xfd, 0x49f: 0xfd,
+	0x4a0: 0xfd, 0x4a1: 0xfd, 0x4a2: 0xfd, 0x4a3: 0xfd, 0x4a4: 0xfd, 0x4a5: 0xfd, 0x4a6: 0xfd, 0x4a7: 0xfd,
+	0x4a8: 0xfd, 0x4a9: 0xfd, 0x4aa: 0xfd, 0x4ab: 0xfd, 0x4ac: 0xfd, 0x4ad: 0xfd, 0x4ae: 0xfd, 0x4af: 0xfd,
+	0x4b0: 0xfd, 0x4b1: 0xfd, 0x4b2: 0xfd, 0x4b3: 0xfd, 0x4b4: 0xfd, 0x4b5: 0xfd, 0x4b6: 0xfd, 0x4b7: 0xfd,
+	0x4b8: 0xfd, 0x4b9: 0xfd, 0x4ba: 0xfd, 0x4bb: 0xfd, 0x4bc: 0xfd, 0x4bd: 0xfd, 0x4be: 0xfd, 0x4bf: 0xfd,
 	// Block 0x13, offset 0x4c0
-	0x4c0: 0xfb, 0x4c1: 0xfb, 0x4c2: 0xfb, 0x4c3: 0xfb, 0x4c4: 0xfb, 0x4c5: 0xfb, 0x4c6: 0xfb, 0x4c7: 0xfb,
-	0x4c8: 0xfb, 0x4c9: 0xfb, 0x4ca: 0xfb, 0x4cb: 0xfb, 0x4cc: 0xfb, 0x4cd: 0xfb, 0x4ce: 0xfb, 0x4cf: 0xfb,
+	0x4c0: 0xfd, 0x4c1: 0xfd, 0x4c2: 0xfd, 0x4c3: 0xfd, 0x4c4: 0xfd, 0x4c5: 0xfd, 0x4c6: 0xfd, 0x4c7: 0xfd,
+	0x4c8: 0xfd, 0x4c9: 0xfd, 0x4ca: 0xfd, 0x4cb: 0xfd, 0x4cc: 0xfd, 0x4cd: 0xfd, 0x4ce: 0xfd, 0x4cf: 0xfd,
 	0x4d0: 0xa0, 0x4d1: 0xa0, 0x4d2: 0xa0, 0x4d3: 0xa0, 0x4d4: 0xa0, 0x4d5: 0xa0, 0x4d6: 0xa0, 0x4d7: 0xa0,
-	0x4d8: 0xa0, 0x4d9: 0x15b, 0x4da: 0xfb, 0x4db: 0xfb, 0x4dc: 0xfb, 0x4dd: 0xfb, 0x4de: 0xfb, 0x4df: 0xfb,
-	0x4e0: 0xfb, 0x4e1: 0xfb, 0x4e2: 0xfb, 0x4e3: 0xfb, 0x4e4: 0xfb, 0x4e5: 0xfb, 0x4e6: 0xfb, 0x4e7: 0xfb,
-	0x4e8: 0xfb, 0x4e9: 0xfb, 0x4ea: 0xfb, 0x4eb: 0xfb, 0x4ec: 0xfb, 0x4ed: 0xfb, 0x4ee: 0xfb, 0x4ef: 0xfb,
-	0x4f0: 0xfb, 0x4f1: 0xfb, 0x4f2: 0xfb, 0x4f3: 0xfb, 0x4f4: 0xfb, 0x4f5: 0xfb, 0x4f6: 0xfb, 0x4f7: 0xfb,
-	0x4f8: 0xfb, 0x4f9: 0xfb, 0x4fa: 0xfb, 0x4fb: 0xfb, 0x4fc: 0xfb, 0x4fd: 0xfb, 0x4fe: 0xfb, 0x4ff: 0xfb,
+	0x4d8: 0xa0, 0x4d9: 0x15d, 0x4da: 0xfd, 0x4db: 0xfd, 0x4dc: 0xfd, 0x4dd: 0xfd, 0x4de: 0xfd, 0x4df: 0xfd,
+	0x4e0: 0xfd, 0x4e1: 0xfd, 0x4e2: 0xfd, 0x4e3: 0xfd, 0x4e4: 0xfd, 0x4e5: 0xfd, 0x4e6: 0xfd, 0x4e7: 0xfd,
+	0x4e8: 0xfd, 0x4e9: 0xfd, 0x4ea: 0xfd, 0x4eb: 0xfd, 0x4ec: 0xfd, 0x4ed: 0xfd, 0x4ee: 0xfd, 0x4ef: 0xfd,
+	0x4f0: 0xfd, 0x4f1: 0xfd, 0x4f2: 0xfd, 0x4f3: 0xfd, 0x4f4: 0xfd, 0x4f5: 0xfd, 0x4f6: 0xfd, 0x4f7: 0xfd,
+	0x4f8: 0xfd, 0x4f9: 0xfd, 0x4fa: 0xfd, 0x4fb: 0xfd, 0x4fc: 0xfd, 0x4fd: 0xfd, 0x4fe: 0xfd, 0x4ff: 0xfd,
 	// Block 0x14, offset 0x500
-	0x500: 0xfb, 0x501: 0xfb, 0x502: 0xfb, 0x503: 0xfb, 0x504: 0xfb, 0x505: 0xfb, 0x506: 0xfb, 0x507: 0xfb,
-	0x508: 0xfb, 0x509: 0xfb, 0x50a: 0xfb, 0x50b: 0xfb, 0x50c: 0xfb, 0x50d: 0xfb, 0x50e: 0xfb, 0x50f: 0xfb,
-	0x510: 0xfb, 0x511: 0xfb, 0x512: 0xfb, 0x513: 0xfb, 0x514: 0xfb, 0x515: 0xfb, 0x516: 0xfb, 0x517: 0xfb,
-	0x518: 0xfb, 0x519: 0xfb, 0x51a: 0xfb, 0x51b: 0xfb, 0x51c: 0xfb, 0x51d: 0xfb, 0x51e: 0xfb, 0x51f: 0xfb,
+	0x500: 0xfd, 0x501: 0xfd, 0x502: 0xfd, 0x503: 0xfd, 0x504: 0xfd, 0x505: 0xfd, 0x506: 0xfd, 0x507: 0xfd,
+	0x508: 0xfd, 0x509: 0xfd, 0x50a: 0xfd, 0x50b: 0xfd, 0x50c: 0xfd, 0x50d: 0xfd, 0x50e: 0xfd, 0x50f: 0xfd,
+	0x510: 0xfd, 0x511: 0xfd, 0x512: 0xfd, 0x513: 0xfd, 0x514: 0xfd, 0x515: 0xfd, 0x516: 0xfd, 0x517: 0xfd,
+	0x518: 0xfd, 0x519: 0xfd, 0x51a: 0xfd, 0x51b: 0xfd, 0x51c: 0xfd, 0x51d: 0xfd, 0x51e: 0xfd, 0x51f: 0xfd,
 	0x520: 0xa0, 0x521: 0xa0, 0x522: 0xa0, 0x523: 0xa0, 0x524: 0xa0, 0x525: 0xa0, 0x526: 0xa0, 0x527: 0xa0,
-	0x528: 0x14d, 0x529: 0x15c, 0x52a: 0xfb, 0x52b: 0x15d, 0x52c: 0x15e, 0x52d: 0x15f, 0x52e: 0x160, 0x52f: 0xfb,
-	0x530: 0xfb, 0x531: 0xfb, 0x532: 0xfb, 0x533: 0xfb, 0x534: 0xfb, 0x535: 0xfb, 0x536: 0xfb, 0x537: 0xfb,
-	0x538: 0xfb, 0x539: 0x161, 0x53a: 0x162, 0x53b: 0xfb, 0x53c: 0xa0, 0x53d: 0x163, 0x53e: 0x164, 0x53f: 0x165,
+	0x528: 0x14f, 0x529: 0x15e, 0x52a: 0xfd, 0x52b: 0x15f, 0x52c: 0x160, 0x52d: 0x161, 0x52e: 0x162, 0x52f: 0xfd,
+	0x530: 0xfd, 0x531: 0xfd, 0x532: 0xfd, 0x533: 0xfd, 0x534: 0xfd, 0x535: 0xfd, 0x536: 0xfd, 0x537: 0xfd,
+	0x538: 0xfd, 0x539: 0x163, 0x53a: 0x164, 0x53b: 0xfd, 0x53c: 0xa0, 0x53d: 0x165, 0x53e: 0x166, 0x53f: 0x167,
 	// Block 0x15, offset 0x540
 	0x540: 0xa0, 0x541: 0xa0, 0x542: 0xa0, 0x543: 0xa0, 0x544: 0xa0, 0x545: 0xa0, 0x546: 0xa0, 0x547: 0xa0,
 	0x548: 0xa0, 0x549: 0xa0, 0x54a: 0xa0, 0x54b: 0xa0, 0x54c: 0xa0, 0x54d: 0xa0, 0x54e: 0xa0, 0x54f: 0xa0,
 	0x550: 0xa0, 0x551: 0xa0, 0x552: 0xa0, 0x553: 0xa0, 0x554: 0xa0, 0x555: 0xa0, 0x556: 0xa0, 0x557: 0xa0,
-	0x558: 0xa0, 0x559: 0xa0, 0x55a: 0xa0, 0x55b: 0xa0, 0x55c: 0xa0, 0x55d: 0xa0, 0x55e: 0xa0, 0x55f: 0x166,
+	0x558: 0xa0, 0x559: 0xa0, 0x55a: 0xa0, 0x55b: 0xa0, 0x55c: 0xa0, 0x55d: 0xa0, 0x55e: 0xa0, 0x55f: 0x168,
 	0x560: 0xa0, 0x561: 0xa0, 0x562: 0xa0, 0x563: 0xa0, 0x564: 0xa0, 0x565: 0xa0, 0x566: 0xa0, 0x567: 0xa0,
 	0x568: 0xa0, 0x569: 0xa0, 0x56a: 0xa0, 0x56b: 0xa0, 0x56c: 0xa0, 0x56d: 0xa0, 0x56e: 0xa0, 0x56f: 0xa0,
-	0x570: 0xa0, 0x571: 0xa0, 0x572: 0xa0, 0x573: 0x167, 0x574: 0x168, 0x575: 0xfb, 0x576: 0xfb, 0x577: 0xfb,
-	0x578: 0xfb, 0x579: 0xfb, 0x57a: 0xfb, 0x57b: 0xfb, 0x57c: 0xfb, 0x57d: 0xfb, 0x57e: 0xfb, 0x57f: 0xfb,
+	0x570: 0xa0, 0x571: 0xa0, 0x572: 0xa0, 0x573: 0x169, 0x574: 0x16a, 0x575: 0xfd, 0x576: 0xfd, 0x577: 0xfd,
+	0x578: 0xfd, 0x579: 0xfd, 0x57a: 0xfd, 0x57b: 0xfd, 0x57c: 0xfd, 0x57d: 0xfd, 0x57e: 0xfd, 0x57f: 0xfd,
 	// Block 0x16, offset 0x580
-	0x580: 0xa0, 0x581: 0xa0, 0x582: 0xa0, 0x583: 0xa0, 0x584: 0x169, 0x585: 0x16a, 0x586: 0xa0, 0x587: 0xa0,
-	0x588: 0xa0, 0x589: 0xa0, 0x58a: 0xa0, 0x58b: 0x16b, 0x58c: 0xfb, 0x58d: 0xfb, 0x58e: 0xfb, 0x58f: 0xfb,
-	0x590: 0xfb, 0x591: 0xfb, 0x592: 0xfb, 0x593: 0xfb, 0x594: 0xfb, 0x595: 0xfb, 0x596: 0xfb, 0x597: 0xfb,
-	0x598: 0xfb, 0x599: 0xfb, 0x59a: 0xfb, 0x59b: 0xfb, 0x59c: 0xfb, 0x59d: 0xfb, 0x59e: 0xfb, 0x59f: 0xfb,
-	0x5a0: 0xfb, 0x5a1: 0xfb, 0x5a2: 0xfb, 0x5a3: 0xfb, 0x5a4: 0xfb, 0x5a5: 0xfb, 0x5a6: 0xfb, 0x5a7: 0xfb,
-	0x5a8: 0xfb, 0x5a9: 0xfb, 0x5aa: 0xfb, 0x5ab: 0xfb, 0x5ac: 0xfb, 0x5ad: 0xfb, 0x5ae: 0xfb, 0x5af: 0xfb,
-	0x5b0: 0xa0, 0x5b1: 0x16c, 0x5b2: 0x16d, 0x5b3: 0xfb, 0x5b4: 0xfb, 0x5b5: 0xfb, 0x5b6: 0xfb, 0x5b7: 0xfb,
-	0x5b8: 0xfb, 0x5b9: 0xfb, 0x5ba: 0xfb, 0x5bb: 0xfb, 0x5bc: 0xfb, 0x5bd: 0xfb, 0x5be: 0xfb, 0x5bf: 0xfb,
+	0x580: 0xa0, 0x581: 0xa0, 0x582: 0xa0, 0x583: 0xa0, 0x584: 0x16b, 0x585: 0x16c, 0x586: 0xa0, 0x587: 0xa0,
+	0x588: 0xa0, 0x589: 0xa0, 0x58a: 0xa0, 0x58b: 0x16d, 0x58c: 0xfd, 0x58d: 0xfd, 0x58e: 0xfd, 0x58f: 0xfd,
+	0x590: 0xfd, 0x591: 0xfd, 0x592: 0xfd, 0x593: 0xfd, 0x594: 0xfd, 0x595: 0xfd, 0x596: 0xfd, 0x597: 0xfd,
+	0x598: 0xfd, 0x599: 0xfd, 0x59a: 0xfd, 0x59b: 0xfd, 0x59c: 0xfd, 0x59d: 0xfd, 0x59e: 0xfd, 0x59f: 0xfd,
+	0x5a0: 0xfd, 0x5a1: 0xfd, 0x5a2: 0xfd, 0x5a3: 0xfd, 0x5a4: 0xfd, 0x5a5: 0xfd, 0x5a6: 0xfd, 0x5a7: 0xfd,
+	0x5a8: 0xfd, 0x5a9: 0xfd, 0x5aa: 0xfd, 0x5ab: 0xfd, 0x5ac: 0xfd, 0x5ad: 0xfd, 0x5ae: 0xfd, 0x5af: 0xfd,
+	0x5b0: 0xa0, 0x5b1: 0x16e, 0x5b2: 0x16f, 0x5b3: 0xfd, 0x5b4: 0xfd, 0x5b5: 0xfd, 0x5b6: 0xfd, 0x5b7: 0xfd,
+	0x5b8: 0xfd, 0x5b9: 0xfd, 0x5ba: 0xfd, 0x5bb: 0xfd, 0x5bc: 0xfd, 0x5bd: 0xfd, 0x5be: 0xfd, 0x5bf: 0xfd,
 	// Block 0x17, offset 0x5c0
-	0x5c0: 0x9c, 0x5c1: 0x9c, 0x5c2: 0x9c, 0x5c3: 0x16e, 0x5c4: 0x16f, 0x5c5: 0x170, 0x5c6: 0x171, 0x5c7: 0x172,
-	0x5c8: 0x9c, 0x5c9: 0x173, 0x5ca: 0xfb, 0x5cb: 0x174, 0x5cc: 0x9c, 0x5cd: 0x175, 0x5ce: 0xfb, 0x5cf: 0xfb,
-	0x5d0: 0x60, 0x5d1: 0x61, 0x5d2: 0x62, 0x5d3: 0x63, 0x5d4: 0x64, 0x5d5: 0x65, 0x5d6: 0x66, 0x5d7: 0x67,
-	0x5d8: 0x68, 0x5d9: 0x69, 0x5da: 0x6a, 0x5db: 0x6b, 0x5dc: 0x6c, 0x5dd: 0x6d, 0x5de: 0x6e, 0x5df: 0x6f,
+	0x5c0: 0x9c, 0x5c1: 0x9c, 0x5c2: 0x9c, 0x5c3: 0x170, 0x5c4: 0x171, 0x5c5: 0x172, 0x5c6: 0x173, 0x5c7: 0x174,
+	0x5c8: 0x9c, 0x5c9: 0x175, 0x5ca: 0xfd, 0x5cb: 0x176, 0x5cc: 0x9c, 0x5cd: 0x177, 0x5ce: 0xfd, 0x5cf: 0xfd,
+	0x5d0: 0x5e, 0x5d1: 0x5f, 0x5d2: 0x60, 0x5d3: 0x61, 0x5d4: 0x62, 0x5d5: 0x63, 0x5d6: 0x64, 0x5d7: 0x65,
+	0x5d8: 0x66, 0x5d9: 0x67, 0x5da: 0x68, 0x5db: 0x69, 0x5dc: 0x6a, 0x5dd: 0x6b, 0x5de: 0x6c, 0x5df: 0x6d,
 	0x5e0: 0x9c, 0x5e1: 0x9c, 0x5e2: 0x9c, 0x5e3: 0x9c, 0x5e4: 0x9c, 0x5e5: 0x9c, 0x5e6: 0x9c, 0x5e7: 0x9c,
-	0x5e8: 0x176, 0x5e9: 0x177, 0x5ea: 0x178, 0x5eb: 0xfb, 0x5ec: 0xfb, 0x5ed: 0xfb, 0x5ee: 0xfb, 0x5ef: 0xfb,
-	0x5f0: 0xfb, 0x5f1: 0xfb, 0x5f2: 0xfb, 0x5f3: 0xfb, 0x5f4: 0xfb, 0x5f5: 0xfb, 0x5f6: 0xfb, 0x5f7: 0xfb,
-	0x5f8: 0xfb, 0x5f9: 0xfb, 0x5fa: 0xfb, 0x5fb: 0xfb, 0x5fc: 0xfb, 0x5fd: 0xfb, 0x5fe: 0xfb, 0x5ff: 0xfb,
+	0x5e8: 0x178, 0x5e9: 0x179, 0x5ea: 0x17a, 0x5eb: 0xfd, 0x5ec: 0xfd, 0x5ed: 0xfd, 0x5ee: 0xfd, 0x5ef: 0xfd,
+	0x5f0: 0xfd, 0x5f1: 0xfd, 0x5f2: 0xfd, 0x5f3: 0xfd, 0x5f4: 0xfd, 0x5f5: 0xfd, 0x5f6: 0xfd, 0x5f7: 0xfd,
+	0x5f8: 0xfd, 0x5f9: 0xfd, 0x5fa: 0xfd, 0x5fb: 0xfd, 0x5fc: 0xfd, 0x5fd: 0xfd, 0x5fe: 0xfd, 0x5ff: 0xfd,
 	// Block 0x18, offset 0x600
-	0x600: 0x179, 0x601: 0xfb, 0x602: 0xfb, 0x603: 0xfb, 0x604: 0x17a, 0x605: 0x17b, 0x606: 0xfb, 0x607: 0xfb,
-	0x608: 0xfb, 0x609: 0xfb, 0x60a: 0xfb, 0x60b: 0x17c, 0x60c: 0xfb, 0x60d: 0xfb, 0x60e: 0xfb, 0x60f: 0xfb,
-	0x610: 0xfb, 0x611: 0xfb, 0x612: 0xfb, 0x613: 0xfb, 0x614: 0xfb, 0x615: 0xfb, 0x616: 0xfb, 0x617: 0xfb,
-	0x618: 0xfb, 0x619: 0xfb, 0x61a: 0xfb, 0x61b: 0xfb, 0x61c: 0xfb, 0x61d: 0xfb, 0x61e: 0xfb, 0x61f: 0xfb,
-	0x620: 0x123, 0x621: 0x123, 0x622: 0x123, 0x623: 0x17d, 0x624: 0x70, 0x625: 0x17e, 0x626: 0xfb, 0x627: 0xfb,
-	0x628: 0xfb, 0x629: 0xfb, 0x62a: 0xfb, 0x62b: 0xfb, 0x62c: 0xfb, 0x62d: 0xfb, 0x62e: 0xfb, 0x62f: 0xfb,
-	0x630: 0xfb, 0x631: 0x17f, 0x632: 0x180, 0x633: 0xfb, 0x634: 0x181, 0x635: 0xfb, 0x636: 0xfb, 0x637: 0xfb,
-	0x638: 0x71, 0x639: 0x72, 0x63a: 0x73, 0x63b: 0x182, 0x63c: 0xfb, 0x63d: 0xfb, 0x63e: 0xfb, 0x63f: 0xfb,
+	0x600: 0x17b, 0x601: 0xfd, 0x602: 0xfd, 0x603: 0xfd, 0x604: 0x17c, 0x605: 0x17d, 0x606: 0xfd, 0x607: 0xfd,
+	0x608: 0xfd, 0x609: 0xfd, 0x60a: 0xfd, 0x60b: 0x17e, 0x60c: 0xfd, 0x60d: 0xfd, 0x60e: 0xfd, 0x60f: 0xfd,
+	0x610: 0xfd, 0x611: 0xfd, 0x612: 0xfd, 0x613: 0xfd, 0x614: 0xfd, 0x615: 0xfd, 0x616: 0xfd, 0x617: 0xfd,
+	0x618: 0xfd, 0x619: 0xfd, 0x61a: 0xfd, 0x61b: 0xfd, 0x61c: 0xfd, 0x61d: 0xfd, 0x61e: 0xfd, 0x61f: 0xfd,
+	0x620: 0x125, 0x621: 0x125, 0x622: 0x125, 0x623: 0x17f, 0x624: 0x6e, 0x625: 0x180, 0x626: 0xfd, 0x627: 0xfd,
+	0x628: 0xfd, 0x629: 0xfd, 0x62a: 0xfd, 0x62b: 0xfd, 0x62c: 0xfd, 0x62d: 0xfd, 0x62e: 0xfd, 0x62f: 0xfd,
+	0x630: 0xfd, 0x631: 0x181, 0x632: 0x182, 0x633: 0xfd, 0x634: 0x183, 0x635: 0xfd, 0x636: 0xfd, 0x637: 0xfd,
+	0x638: 0x6f, 0x639: 0x70, 0x63a: 0x71, 0x63b: 0x184, 0x63c: 0xfd, 0x63d: 0xfd, 0x63e: 0xfd, 0x63f: 0xfd,
 	// Block 0x19, offset 0x640
-	0x640: 0x183, 0x641: 0x9c, 0x642: 0x184, 0x643: 0x185, 0x644: 0x74, 0x645: 0x75, 0x646: 0x186, 0x647: 0x187,
-	0x648: 0x76, 0x649: 0x188, 0x64a: 0xfb, 0x64b: 0xfb, 0x64c: 0x9c, 0x64d: 0x9c, 0x64e: 0x9c, 0x64f: 0x9c,
+	0x640: 0x185, 0x641: 0x9c, 0x642: 0x186, 0x643: 0x187, 0x644: 0x72, 0x645: 0x73, 0x646: 0x188, 0x647: 0x189,
+	0x648: 0x74, 0x649: 0x18a, 0x64a: 0xfd, 0x64b: 0xfd, 0x64c: 0x9c, 0x64d: 0x9c, 0x64e: 0x9c, 0x64f: 0x9c,
 	0x650: 0x9c, 0x651: 0x9c, 0x652: 0x9c, 0x653: 0x9c, 0x654: 0x9c, 0x655: 0x9c, 0x656: 0x9c, 0x657: 0x9c,
-	0x658: 0x9c, 0x659: 0x9c, 0x65a: 0x9c, 0x65b: 0x189, 0x65c: 0x9c, 0x65d: 0x18a, 0x65e: 0x9c, 0x65f: 0x18b,
-	0x660: 0x18c, 0x661: 0x18d, 0x662: 0x18e, 0x663: 0xfb, 0x664: 0x9c, 0x665: 0x18f, 0x666: 0x9c, 0x667: 0x190,
-	0x668: 0x9c, 0x669: 0x191, 0x66a: 0x192, 0x66b: 0x193, 0x66c: 0x9c, 0x66d: 0x9c, 0x66e: 0x194, 0x66f: 0x195,
-	0x670: 0xfb, 0x671: 0xfb, 0x672: 0xfb, 0x673: 0xfb, 0x674: 0xfb, 0x675: 0xfb, 0x676: 0xfb, 0x677: 0xfb,
-	0x678: 0xfb, 0x679: 0xfb, 0x67a: 0xfb, 0x67b: 0xfb, 0x67c: 0xfb, 0x67d: 0xfb, 0x67e: 0xfb, 0x67f: 0xfb,
+	0x658: 0x9c, 0x659: 0x9c, 0x65a: 0x9c, 0x65b: 0x18b, 0x65c: 0x9c, 0x65d: 0x18c, 0x65e: 0x9c, 0x65f: 0x18d,
+	0x660: 0x18e, 0x661: 0x18f, 0x662: 0x190, 0x663: 0xfd, 0x664: 0x9c, 0x665: 0x191, 0x666: 0x9c, 0x667: 0x192,
+	0x668: 0x9c, 0x669: 0x193, 0x66a: 0x194, 0x66b: 0x195, 0x66c: 0x9c, 0x66d: 0x9c, 0x66e: 0x196, 0x66f: 0x197,
+	0x670: 0xfd, 0x671: 0xfd, 0x672: 0xfd, 0x673: 0xfd, 0x674: 0xfd, 0x675: 0xfd, 0x676: 0xfd, 0x677: 0xfd,
+	0x678: 0xfd, 0x679: 0xfd, 0x67a: 0xfd, 0x67b: 0xfd, 0x67c: 0xfd, 0x67d: 0xfd, 0x67e: 0xfd, 0x67f: 0xfd,
 	// Block 0x1a, offset 0x680
 	0x680: 0xa0, 0x681: 0xa0, 0x682: 0xa0, 0x683: 0xa0, 0x684: 0xa0, 0x685: 0xa0, 0x686: 0xa0, 0x687: 0xa0,
 	0x688: 0xa0, 0x689: 0xa0, 0x68a: 0xa0, 0x68b: 0xa0, 0x68c: 0xa0, 0x68d: 0xa0, 0x68e: 0xa0, 0x68f: 0xa0,
 	0x690: 0xa0, 0x691: 0xa0, 0x692: 0xa0, 0x693: 0xa0, 0x694: 0xa0, 0x695: 0xa0, 0x696: 0xa0, 0x697: 0xa0,
-	0x698: 0xa0, 0x699: 0xa0, 0x69a: 0xa0, 0x69b: 0x196, 0x69c: 0xa0, 0x69d: 0xa0, 0x69e: 0xa0, 0x69f: 0xa0,
+	0x698: 0xa0, 0x699: 0xa0, 0x69a: 0xa0, 0x69b: 0x198, 0x69c: 0xa0, 0x69d: 0xa0, 0x69e: 0xa0, 0x69f: 0xa0,
 	0x6a0: 0xa0, 0x6a1: 0xa0, 0x6a2: 0xa0, 0x6a3: 0xa0, 0x6a4: 0xa0, 0x6a5: 0xa0, 0x6a6: 0xa0, 0x6a7: 0xa0,
 	0x6a8: 0xa0, 0x6a9: 0xa0, 0x6aa: 0xa0, 0x6ab: 0xa0, 0x6ac: 0xa0, 0x6ad: 0xa0, 0x6ae: 0xa0, 0x6af: 0xa0,
 	0x6b0: 0xa0, 0x6b1: 0xa0, 0x6b2: 0xa0, 0x6b3: 0xa0, 0x6b4: 0xa0, 0x6b5: 0xa0, 0x6b6: 0xa0, 0x6b7: 0xa0,
@@ -2312,8 +2455,8 @@ var idnaIndex = [2368]uint16{
 	0x6c0: 0xa0, 0x6c1: 0xa0, 0x6c2: 0xa0, 0x6c3: 0xa0, 0x6c4: 0xa0, 0x6c5: 0xa0, 0x6c6: 0xa0, 0x6c7: 0xa0,
 	0x6c8: 0xa0, 0x6c9: 0xa0, 0x6ca: 0xa0, 0x6cb: 0xa0, 0x6cc: 0xa0, 0x6cd: 0xa0, 0x6ce: 0xa0, 0x6cf: 0xa0,
 	0x6d0: 0xa0, 0x6d1: 0xa0, 0x6d2: 0xa0, 0x6d3: 0xa0, 0x6d4: 0xa0, 0x6d5: 0xa0, 0x6d6: 0xa0, 0x6d7: 0xa0,
-	0x6d8: 0xa0, 0x6d9: 0xa0, 0x6da: 0xa0, 0x6db: 0xa0, 0x6dc: 0x197, 0x6dd: 0xa0, 0x6de: 0xa0, 0x6df: 0xa0,
-	0x6e0: 0x198, 0x6e1: 0xa0, 0x6e2: 0xa0, 0x6e3: 0xa0, 0x6e4: 0xa0, 0x6e5: 0xa0, 0x6e6: 0xa0, 0x6e7: 0xa0,
+	0x6d8: 0xa0, 0x6d9: 0xa0, 0x6da: 0xa0, 0x6db: 0xa0, 0x6dc: 0x199, 0x6dd: 0xa0, 0x6de: 0xa0, 0x6df: 0xa0,
+	0x6e0: 0x19a, 0x6e1: 0xa0, 0x6e2: 0xa0, 0x6e3: 0xa0, 0x6e4: 0xa0, 0x6e5: 0xa0, 0x6e6: 0xa0, 0x6e7: 0xa0,
 	0x6e8: 0xa0, 0x6e9: 0xa0, 0x6ea: 0xa0, 0x6eb: 0xa0, 0x6ec: 0xa0, 0x6ed: 0xa0, 0x6ee: 0xa0, 0x6ef: 0xa0,
 	0x6f0: 0xa0, 0x6f1: 0xa0, 0x6f2: 0xa0, 0x6f3: 0xa0, 0x6f4: 0xa0, 0x6f5: 0xa0, 0x6f6: 0xa0, 0x6f7: 0xa0,
 	0x6f8: 0xa0, 0x6f9: 0xa0, 0x6fa: 0xa0, 0x6fb: 0xa0, 0x6fc: 0xa0, 0x6fd: 0xa0, 0x6fe: 0xa0, 0x6ff: 0xa0,
@@ -2325,34 +2468,34 @@ var idnaIndex = [2368]uint16{
 	0x720: 0xa0, 0x721: 0xa0, 0x722: 0xa0, 0x723: 0xa0, 0x724: 0xa0, 0x725: 0xa0, 0x726: 0xa0, 0x727: 0xa0,
 	0x728: 0xa0, 0x729: 0xa0, 0x72a: 0xa0, 0x72b: 0xa0, 0x72c: 0xa0, 0x72d: 0xa0, 0x72e: 0xa0, 0x72f: 0xa0,
 	0x730: 0xa0, 0x731: 0xa0, 0x732: 0xa0, 0x733: 0xa0, 0x734: 0xa0, 0x735: 0xa0, 0x736: 0xa0, 0x737: 0xa0,
-	0x738: 0xa0, 0x739: 0xa0, 0x73a: 0x199, 0x73b: 0xa0, 0x73c: 0xa0, 0x73d: 0xa0, 0x73e: 0xa0, 0x73f: 0xa0,
+	0x738: 0xa0, 0x739: 0xa0, 0x73a: 0x19b, 0x73b: 0xa0, 0x73c: 0xa0, 0x73d: 0xa0, 0x73e: 0xa0, 0x73f: 0xa0,
 	// Block 0x1d, offset 0x740
 	0x740: 0xa0, 0x741: 0xa0, 0x742: 0xa0, 0x743: 0xa0, 0x744: 0xa0, 0x745: 0xa0, 0x746: 0xa0, 0x747: 0xa0,
 	0x748: 0xa0, 0x749: 0xa0, 0x74a: 0xa0, 0x74b: 0xa0, 0x74c: 0xa0, 0x74d: 0xa0, 0x74e: 0xa0, 0x74f: 0xa0,
 	0x750: 0xa0, 0x751: 0xa0, 0x752: 0xa0, 0x753: 0xa0, 0x754: 0xa0, 0x755: 0xa0, 0x756: 0xa0, 0x757: 0xa0,
 	0x758: 0xa0, 0x759: 0xa0, 0x75a: 0xa0, 0x75b: 0xa0, 0x75c: 0xa0, 0x75d: 0xa0, 0x75e: 0xa0, 0x75f: 0xa0,
 	0x760: 0xa0, 0x761: 0xa0, 0x762: 0xa0, 0x763: 0xa0, 0x764: 0xa0, 0x765: 0xa0, 0x766: 0xa0, 0x767: 0xa0,
-	0x768: 0xa0, 0x769: 0xa0, 0x76a: 0xa0, 0x76b: 0xa0, 0x76c: 0xa0, 0x76d: 0xa0, 0x76e: 0xa0, 0x76f: 0x19a,
-	0x770: 0xfb, 0x771: 0xfb, 0x772: 0xfb, 0x773: 0xfb, 0x774: 0xfb, 0x775: 0xfb, 0x776: 0xfb, 0x777: 0xfb,
-	0x778: 0xfb, 0x779: 0xfb, 0x77a: 0xfb, 0x77b: 0xfb, 0x77c: 0xfb, 0x77d: 0xfb, 0x77e: 0xfb, 0x77f: 0xfb,
+	0x768: 0xa0, 0x769: 0xa0, 0x76a: 0xa0, 0x76b: 0xa0, 0x76c: 0xa0, 0x76d: 0xa0, 0x76e: 0xa0, 0x76f: 0x19c,
+	0x770: 0xfd, 0x771: 0xfd, 0x772: 0xfd, 0x773: 0xfd, 0x774: 0xfd, 0x775: 0xfd, 0x776: 0xfd, 0x777: 0xfd,
+	0x778: 0xfd, 0x779: 0xfd, 0x77a: 0xfd, 0x77b: 0xfd, 0x77c: 0xfd, 0x77d: 0xfd, 0x77e: 0xfd, 0x77f: 0xfd,
 	// Block 0x1e, offset 0x780
-	0x780: 0xfb, 0x781: 0xfb, 0x782: 0xfb, 0x783: 0xfb, 0x784: 0xfb, 0x785: 0xfb, 0x786: 0xfb, 0x787: 0xfb,
-	0x788: 0xfb, 0x789: 0xfb, 0x78a: 0xfb, 0x78b: 0xfb, 0x78c: 0xfb, 0x78d: 0xfb, 0x78e: 0xfb, 0x78f: 0xfb,
-	0x790: 0xfb, 0x791: 0xfb, 0x792: 0xfb, 0x793: 0xfb, 0x794: 0xfb, 0x795: 0xfb, 0x796: 0xfb, 0x797: 0xfb,
-	0x798: 0xfb, 0x799: 0xfb, 0x79a: 0xfb, 0x79b: 0xfb, 0x79c: 0xfb, 0x79d: 0xfb, 0x79e: 0xfb, 0x79f: 0xfb,
-	0x7a0: 0x77, 0x7a1: 0x78, 0x7a2: 0x79, 0x7a3: 0x19b, 0x7a4: 0x7a, 0x7a5: 0x7b, 0x7a6: 0x19c, 0x7a7: 0x7c,
-	0x7a8: 0x7d, 0x7a9: 0xfb, 0x7aa: 0xfb, 0x7ab: 0xfb, 0x7ac: 0xfb, 0x7ad: 0xfb, 0x7ae: 0xfb, 0x7af: 0xfb,
-	0x7b0: 0xfb, 0x7b1: 0xfb, 0x7b2: 0xfb, 0x7b3: 0xfb, 0x7b4: 0xfb, 0x7b5: 0xfb, 0x7b6: 0xfb, 0x7b7: 0xfb,
-	0x7b8: 0xfb, 0x7b9: 0xfb, 0x7ba: 0xfb, 0x7bb: 0xfb, 0x7bc: 0xfb, 0x7bd: 0xfb, 0x7be: 0xfb, 0x7bf: 0xfb,
+	0x780: 0xfd, 0x781: 0xfd, 0x782: 0xfd, 0x783: 0xfd, 0x784: 0xfd, 0x785: 0xfd, 0x786: 0xfd, 0x787: 0xfd,
+	0x788: 0xfd, 0x789: 0xfd, 0x78a: 0xfd, 0x78b: 0xfd, 0x78c: 0xfd, 0x78d: 0xfd, 0x78e: 0xfd, 0x78f: 0xfd,
+	0x790: 0xfd, 0x791: 0xfd, 0x792: 0xfd, 0x793: 0xfd, 0x794: 0xfd, 0x795: 0xfd, 0x796: 0xfd, 0x797: 0xfd,
+	0x798: 0xfd, 0x799: 0xfd, 0x79a: 0xfd, 0x79b: 0xfd, 0x79c: 0xfd, 0x79d: 0xfd, 0x79e: 0xfd, 0x79f: 0xfd,
+	0x7a0: 0x75, 0x7a1: 0x76, 0x7a2: 0x77, 0x7a3: 0x78, 0x7a4: 0x79, 0x7a5: 0x7a, 0x7a6: 0x7b, 0x7a7: 0x7c,
+	0x7a8: 0x7d, 0x7a9: 0xfd, 0x7aa: 0xfd, 0x7ab: 0xfd, 0x7ac: 0xfd, 0x7ad: 0xfd, 0x7ae: 0xfd, 0x7af: 0xfd,
+	0x7b0: 0xfd, 0x7b1: 0xfd, 0x7b2: 0xfd, 0x7b3: 0xfd, 0x7b4: 0xfd, 0x7b5: 0xfd, 0x7b6: 0xfd, 0x7b7: 0xfd,
+	0x7b8: 0xfd, 0x7b9: 0xfd, 0x7ba: 0xfd, 0x7bb: 0xfd, 0x7bc: 0xfd, 0x7bd: 0xfd, 0x7be: 0xfd, 0x7bf: 0xfd,
 	// Block 0x1f, offset 0x7c0
 	0x7c0: 0xa0, 0x7c1: 0xa0, 0x7c2: 0xa0, 0x7c3: 0xa0, 0x7c4: 0xa0, 0x7c5: 0xa0, 0x7c6: 0xa0, 0x7c7: 0xa0,
-	0x7c8: 0xa0, 0x7c9: 0xa0, 0x7ca: 0xa0, 0x7cb: 0xa0, 0x7cc: 0xa0, 0x7cd: 0x19d, 0x7ce: 0xfb, 0x7cf: 0xfb,
-	0x7d0: 0xfb, 0x7d1: 0xfb, 0x7d2: 0xfb, 0x7d3: 0xfb, 0x7d4: 0xfb, 0x7d5: 0xfb, 0x7d6: 0xfb, 0x7d7: 0xfb,
-	0x7d8: 0xfb, 0x7d9: 0xfb, 0x7da: 0xfb, 0x7db: 0xfb, 0x7dc: 0xfb, 0x7dd: 0xfb, 0x7de: 0xfb, 0x7df: 0xfb,
-	0x7e0: 0xfb, 0x7e1: 0xfb, 0x7e2: 0xfb, 0x7e3: 0xfb, 0x7e4: 0xfb, 0x7e5: 0xfb, 0x7e6: 0xfb, 0x7e7: 0xfb,
-	0x7e8: 0xfb, 0x7e9: 0xfb, 0x7ea: 0xfb, 0x7eb: 0xfb, 0x7ec: 0xfb, 0x7ed: 0xfb, 0x7ee: 0xfb, 0x7ef: 0xfb,
-	0x7f0: 0xfb, 0x7f1: 0xfb, 0x7f2: 0xfb, 0x7f3: 0xfb, 0x7f4: 0xfb, 0x7f5: 0xfb, 0x7f6: 0xfb, 0x7f7: 0xfb,
-	0x7f8: 0xfb, 0x7f9: 0xfb, 0x7fa: 0xfb, 0x7fb: 0xfb, 0x7fc: 0xfb, 0x7fd: 0xfb, 0x7fe: 0xfb, 0x7ff: 0xfb,
+	0x7c8: 0xa0, 0x7c9: 0xa0, 0x7ca: 0xa0, 0x7cb: 0xa0, 0x7cc: 0xa0, 0x7cd: 0x19d, 0x7ce: 0xfd, 0x7cf: 0xfd,
+	0x7d0: 0xfd, 0x7d1: 0xfd, 0x7d2: 0xfd, 0x7d3: 0xfd, 0x7d4: 0xfd, 0x7d5: 0xfd, 0x7d6: 0xfd, 0x7d7: 0xfd,
+	0x7d8: 0xfd, 0x7d9: 0xfd, 0x7da: 0xfd, 0x7db: 0xfd, 0x7dc: 0xfd, 0x7dd: 0xfd, 0x7de: 0xfd, 0x7df: 0xfd,
+	0x7e0: 0xfd, 0x7e1: 0xfd, 0x7e2: 0xfd, 0x7e3: 0xfd, 0x7e4: 0xfd, 0x7e5: 0xfd, 0x7e6: 0xfd, 0x7e7: 0xfd,
+	0x7e8: 0xfd, 0x7e9: 0xfd, 0x7ea: 0xfd, 0x7eb: 0xfd, 0x7ec: 0xfd, 0x7ed: 0xfd, 0x7ee: 0xfd, 0x7ef: 0xfd,
+	0x7f0: 0xfd, 0x7f1: 0xfd, 0x7f2: 0xfd, 0x7f3: 0xfd, 0x7f4: 0xfd, 0x7f5: 0xfd, 0x7f6: 0xfd, 0x7f7: 0xfd,
+	0x7f8: 0xfd, 0x7f9: 0xfd, 0x7fa: 0xfd, 0x7fb: 0xfd, 0x7fc: 0xfd, 0x7fd: 0xfd, 0x7fe: 0xfd, 0x7ff: 0xfd,
 	// Block 0x20, offset 0x800
 	0x810: 0x0d, 0x811: 0x0e, 0x812: 0x0f, 0x813: 0x10, 0x814: 0x11, 0x815: 0x0b, 0x816: 0x12, 0x817: 0x07,
 	0x818: 0x13, 0x819: 0x0b, 0x81a: 0x0b, 0x81b: 0x14, 0x81c: 0x0b, 0x81d: 0x15, 0x81e: 0x16, 0x81f: 0x17,
@@ -2370,14 +2513,14 @@ var idnaIndex = [2368]uint16{
 	0x870: 0x0b, 0x871: 0x0b, 0x872: 0x0b, 0x873: 0x0b, 0x874: 0x0b, 0x875: 0x0b, 0x876: 0x0b, 0x877: 0x0b,
 	0x878: 0x0b, 0x879: 0x0b, 0x87a: 0x0b, 0x87b: 0x0b, 0x87c: 0x0b, 0x87d: 0x0b, 0x87e: 0x0b, 0x87f: 0x0b,
 	// Block 0x22, offset 0x880
-	0x880: 0x19e, 0x881: 0x19f, 0x882: 0xfb, 0x883: 0xfb, 0x884: 0x1a0, 0x885: 0x1a0, 0x886: 0x1a0, 0x887: 0x1a1,
-	0x888: 0xfb, 0x889: 0xfb, 0x88a: 0xfb, 0x88b: 0xfb, 0x88c: 0xfb, 0x88d: 0xfb, 0x88e: 0xfb, 0x88f: 0xfb,
-	0x890: 0xfb, 0x891: 0xfb, 0x892: 0xfb, 0x893: 0xfb, 0x894: 0xfb, 0x895: 0xfb, 0x896: 0xfb, 0x897: 0xfb,
-	0x898: 0xfb, 0x899: 0xfb, 0x89a: 0xfb, 0x89b: 0xfb, 0x89c: 0xfb, 0x89d: 0xfb, 0x89e: 0xfb, 0x89f: 0xfb,
-	0x8a0: 0xfb, 0x8a1: 0xfb, 0x8a2: 0xfb, 0x8a3: 0xfb, 0x8a4: 0xfb, 0x8a5: 0xfb, 0x8a6: 0xfb, 0x8a7: 0xfb,
-	0x8a8: 0xfb, 0x8a9: 0xfb, 0x8aa: 0xfb, 0x8ab: 0xfb, 0x8ac: 0xfb, 0x8ad: 0xfb, 0x8ae: 0xfb, 0x8af: 0xfb,
-	0x8b0: 0xfb, 0x8b1: 0xfb, 0x8b2: 0xfb, 0x8b3: 0xfb, 0x8b4: 0xfb, 0x8b5: 0xfb, 0x8b6: 0xfb, 0x8b7: 0xfb,
-	0x8b8: 0xfb, 0x8b9: 0xfb, 0x8ba: 0xfb, 0x8bb: 0xfb, 0x8bc: 0xfb, 0x8bd: 0xfb, 0x8be: 0xfb, 0x8bf: 0xfb,
+	0x880: 0x19e, 0x881: 0x19f, 0x882: 0xfd, 0x883: 0xfd, 0x884: 0x1a0, 0x885: 0x1a0, 0x886: 0x1a0, 0x887: 0x1a1,
+	0x888: 0xfd, 0x889: 0xfd, 0x88a: 0xfd, 0x88b: 0xfd, 0x88c: 0xfd, 0x88d: 0xfd, 0x88e: 0xfd, 0x88f: 0xfd,
+	0x890: 0xfd, 0x891: 0xfd, 0x892: 0xfd, 0x893: 0xfd, 0x894: 0xfd, 0x895: 0xfd, 0x896: 0xfd, 0x897: 0xfd,
+	0x898: 0xfd, 0x899: 0xfd, 0x89a: 0xfd, 0x89b: 0xfd, 0x89c: 0xfd, 0x89d: 0xfd, 0x89e: 0xfd, 0x89f: 0xfd,
+	0x8a0: 0xfd, 0x8a1: 0xfd, 0x8a2: 0xfd, 0x8a3: 0xfd, 0x8a4: 0xfd, 0x8a5: 0xfd, 0x8a6: 0xfd, 0x8a7: 0xfd,
+	0x8a8: 0xfd, 0x8a9: 0xfd, 0x8aa: 0xfd, 0x8ab: 0xfd, 0x8ac: 0xfd, 0x8ad: 0xfd, 0x8ae: 0xfd, 0x8af: 0xfd,
+	0x8b0: 0xfd, 0x8b1: 0xfd, 0x8b2: 0xfd, 0x8b3: 0xfd, 0x8b4: 0xfd, 0x8b5: 0xfd, 0x8b6: 0xfd, 0x8b7: 0xfd,
+	0x8b8: 0xfd, 0x8b9: 0xfd, 0x8ba: 0xfd, 0x8bb: 0xfd, 0x8bc: 0xfd, 0x8bd: 0xfd, 0x8be: 0xfd, 0x8bf: 0xfd,
 	// Block 0x23, offset 0x8c0
 	0x8c0: 0x0b, 0x8c1: 0x0b, 0x8c2: 0x0b, 0x8c3: 0x0b, 0x8c4: 0x0b, 0x8c5: 0x0b, 0x8c6: 0x0b, 0x8c7: 0x0b,
 	0x8c8: 0x0b, 0x8c9: 0x0b, 0x8ca: 0x0b, 0x8cb: 0x0b, 0x8cc: 0x0b, 0x8cd: 0x0b, 0x8ce: 0x0b, 0x8cf: 0x0b,
@@ -2393,10 +2536,10 @@ var idnaIndex = [2368]uint16{
 }
 
 // idnaSparseOffset: 292 entries, 584 bytes
-var idnaSparseOffset = []uint16{0x0, 0x8, 0x19, 0x25, 0x27, 0x2c, 0x33, 0x3e, 0x4a, 0x4e, 0x5d, 0x62, 0x6c, 0x78, 0x85, 0x8b, 0x94, 0xa4, 0xb2, 0xbd, 0xca, 0xdb, 0xe5, 0xec, 0xf9, 0x10a, 0x111, 0x11c, 0x12b, 0x139, 0x143, 0x145, 0x14a, 0x14d, 0x150, 0x152, 0x15e, 0x169, 0x171, 0x177, 0x17d, 0x182, 0x187, 0x18a, 0x18e, 0x194, 0x199, 0x1a5, 0x1af, 0x1b5, 0x1c6, 0x1d0, 0x1d3, 0x1db, 0x1de, 0x1eb, 0x1f3, 0x1f7, 0x1fe, 0x206, 0x216, 0x222, 0x225, 0x22f, 0x23b, 0x247, 0x253, 0x25b, 0x260, 0x26d, 0x27e, 0x282, 0x28d, 0x291, 0x29a, 0x2a2, 0x2a8, 0x2ad, 0x2b0, 0x2b4, 0x2ba, 0x2be, 0x2c2, 0x2c6, 0x2cc, 0x2d4, 0x2db, 0x2e6, 0x2f0, 0x2f4, 0x2f7, 0x2fd, 0x301, 0x303, 0x306, 0x308, 0x30b, 0x315, 0x318, 0x327, 0x32b, 0x330, 0x333, 0x337, 0x33c, 0x341, 0x347, 0x358, 0x368, 0x36e, 0x372, 0x381, 0x386, 0x38e, 0x398, 0x3a3, 0x3ab, 0x3bc, 0x3c5, 0x3d5, 0x3e2, 0x3ee, 0x3f3, 0x400, 0x404, 0x409, 0x40b, 0x40d, 0x411, 0x413, 0x417, 0x420, 0x426, 0x42a, 0x43a, 0x444, 0x449, 0x44c, 0x452, 0x459, 0x45e, 0x462, 0x468, 0x46d, 0x476, 0x47b, 0x481, 0x488, 0x48f, 0x496, 0x49a, 0x49f, 0x4a2, 0x4a7, 0x4b3, 0x4b9, 0x4be, 0x4c5, 0x4cd, 0x4d2, 0x4d6, 0x4e6, 0x4ed, 0x4f1, 0x4f5, 0x4fc, 0x4fe, 0x501, 0x504, 0x508, 0x511, 0x515, 0x51d, 0x525, 0x52d, 0x539, 0x545, 0x54b, 0x554, 0x560, 0x567, 0x570, 0x57b, 0x582, 0x591, 0x59e, 0x5ab, 0x5b4, 0x5b8, 0x5c7, 0x5cf, 0x5da, 0x5e3, 0x5e9, 0x5f1, 0x5fa, 0x605, 0x608, 0x614, 0x61d, 0x620, 0x625, 0x62e, 0x633, 0x640, 0x64b, 0x654, 0x65e, 0x661, 0x66b, 0x674, 0x680, 0x68d, 0x69a, 0x6a8, 0x6af, 0x6b3, 0x6b7, 0x6ba, 0x6bf, 0x6c2, 0x6c7, 0x6ca, 0x6d1, 0x6d8, 0x6dc, 0x6e7, 0x6ea, 0x6ed, 0x6f0, 0x6f6, 0x6fc, 0x705, 0x708, 0x70b, 0x70e, 0x711, 0x718, 0x71b, 0x720, 0x72a, 0x72d, 0x731, 0x740, 0x74c, 0x750, 0x755, 0x759, 0x75e, 0x762, 0x767, 0x770, 0x77b, 0x781, 0x787, 0x78d, 0x793, 0x79c, 0x79f, 0x7a2, 0x7a6, 0x7aa, 0x7ae, 0x7b4, 0x7ba, 0x7bf, 0x7c2, 0x7d2, 0x7d9, 0x7dc, 0x7e1, 0x7e5, 0x7eb, 0x7f2, 0x7f6, 0x7fa, 0x803, 0x80a, 0x80f, 0x813, 0x821, 0x824, 0x827, 0x82b, 0x82f, 0x832, 0x842, 0x853, 0x856, 0x85b, 0x85d, 0x85f}
+var idnaSparseOffset = []uint16{0x0, 0x8, 0x19, 0x25, 0x27, 0x2c, 0x33, 0x3e, 0x4a, 0x4e, 0x5d, 0x62, 0x6c, 0x78, 0x85, 0x8b, 0x94, 0xa4, 0xb2, 0xbd, 0xca, 0xdb, 0xe5, 0xec, 0xf9, 0x10a, 0x111, 0x11c, 0x12b, 0x139, 0x143, 0x145, 0x14a, 0x14d, 0x150, 0x152, 0x15e, 0x169, 0x171, 0x177, 0x17d, 0x182, 0x187, 0x18a, 0x18e, 0x194, 0x199, 0x1a5, 0x1af, 0x1b5, 0x1c6, 0x1d0, 0x1d3, 0x1db, 0x1de, 0x1eb, 0x1f3, 0x1f7, 0x1fe, 0x206, 0x216, 0x222, 0x225, 0x22f, 0x23b, 0x247, 0x253, 0x25b, 0x260, 0x26d, 0x27e, 0x282, 0x28d, 0x291, 0x29a, 0x2a2, 0x2a8, 0x2ad, 0x2b0, 0x2b4, 0x2ba, 0x2be, 0x2c2, 0x2c6, 0x2cc, 0x2d4, 0x2db, 0x2e6, 0x2f0, 0x2f4, 0x2f7, 0x2fd, 0x301, 0x303, 0x306, 0x308, 0x30b, 0x315, 0x318, 0x327, 0x32b, 0x32f, 0x331, 0x33a, 0x33d, 0x341, 0x346, 0x34b, 0x351, 0x362, 0x372, 0x378, 0x37c, 0x38b, 0x390, 0x398, 0x3a2, 0x3ad, 0x3b5, 0x3c6, 0x3cf, 0x3df, 0x3ec, 0x3f8, 0x3fd, 0x40a, 0x40e, 0x413, 0x415, 0x417, 0x41b, 0x41d, 0x421, 0x42a, 0x430, 0x434, 0x444, 0x44e, 0x453, 0x456, 0x45c, 0x463, 0x468, 0x46c, 0x472, 0x477, 0x480, 0x485, 0x48b, 0x492, 0x499, 0x4a0, 0x4a4, 0x4a9, 0x4ac, 0x4b1, 0x4bd, 0x4c3, 0x4c8, 0x4cf, 0x4d7, 0x4dc, 0x4e0, 0x4f0, 0x4f7, 0x4fb, 0x4ff, 0x506, 0x508, 0x50b, 0x50e, 0x512, 0x51b, 0x51f, 0x527, 0x52f, 0x537, 0x543, 0x54f, 0x555, 0x55e, 0x56a, 0x571, 0x57a, 0x585, 0x58c, 0x59b, 0x5a8, 0x5b5, 0x5be, 0x5c2, 0x5d1, 0x5d9, 0x5e4, 0x5ed, 0x5f3, 0x5fb, 0x604, 0x60f, 0x612, 0x61e, 0x627, 0x62a, 0x62f, 0x638, 0x63d, 0x64a, 0x655, 0x65e, 0x668, 0x66b, 0x675, 0x67e, 0x68a, 0x697, 0x6a4, 0x6b2, 0x6b9, 0x6bd, 0x6c1, 0x6c4, 0x6c9, 0x6cc, 0x6d1, 0x6d4, 0x6db, 0x6e2, 0x6e6, 0x6f1, 0x6f4, 0x6f7, 0x6fa, 0x700, 0x706, 0x70f, 0x712, 0x715, 0x718, 0x71b, 0x722, 0x725, 0x72a, 0x734, 0x737, 0x73b, 0x74a, 0x756, 0x75a, 0x75f, 0x763, 0x768, 0x76c, 0x771, 0x77a, 0x785, 0x78b, 0x791, 0x797, 0x79d, 0x7a6, 0x7a9, 0x7ac, 0x7b0, 0x7b4, 0x7b8, 0x7be, 0x7c4, 0x7c9, 0x7cc, 0x7dc, 0x7e3, 0x7e6, 0x7eb, 0x7ef, 0x7f5, 0x7fc, 0x800, 0x804, 0x80d, 0x814, 0x819, 0x81d, 0x82b, 0x82e, 0x831, 0x835, 0x839, 0x83c, 0x83f, 0x844, 0x846, 0x848}
 
-// idnaSparseValues: 2146 entries, 8584 bytes
-var idnaSparseValues = [2146]valueRange{
+// idnaSparseValues: 2123 entries, 8492 bytes
+var idnaSparseValues = [2123]valueRange{
 	// Block 0x0, offset 0x0
 	{value: 0x0000, lo: 0x07},
 	{value: 0xe105, lo: 0x80, hi: 0x96},
@@ -2427,15 +2570,15 @@ var idnaSparseValues = [2146]valueRange{
 	// Block 0x2, offset 0x19
 	{value: 0x0000, lo: 0x0b},
 	{value: 0x0008, lo: 0x80, hi: 0xaf},
-	{value: 0x0249, lo: 0xb0, hi: 0xb0},
+	{value: 0x00a9, lo: 0xb0, hi: 0xb0},
 	{value: 0x037d, lo: 0xb1, hi: 0xb1},
-	{value: 0x0259, lo: 0xb2, hi: 0xb2},
-	{value: 0x0269, lo: 0xb3, hi: 0xb3},
+	{value: 0x00b1, lo: 0xb2, hi: 0xb2},
+	{value: 0x00b9, lo: 0xb3, hi: 0xb3},
 	{value: 0x034d, lo: 0xb4, hi: 0xb4},
 	{value: 0x0395, lo: 0xb5, hi: 0xb5},
 	{value: 0xe1bd, lo: 0xb6, hi: 0xb6},
-	{value: 0x0279, lo: 0xb7, hi: 0xb7},
-	{value: 0x0289, lo: 0xb8, hi: 0xb8},
+	{value: 0x00c1, lo: 0xb7, hi: 0xb7},
+	{value: 0x00c9, lo: 0xb8, hi: 0xb8},
 	{value: 0x0008, lo: 0xb9, hi: 0xbf},
 	// Block 0x3, offset 0x25
 	{value: 0x0000, lo: 0x01},
@@ -2457,7 +2600,7 @@ var idnaSparseValues = [2146]valueRange{
 	// Block 0x6, offset 0x33
 	{value: 0x0000, lo: 0x0a},
 	{value: 0x0008, lo: 0x80, hi: 0x86},
-	{value: 0x0401, lo: 0x87, hi: 0x87},
+	{value: 0x0131, lo: 0x87, hi: 0x87},
 	{value: 0x0008, lo: 0x88, hi: 0x88},
 	{value: 0x0018, lo: 0x89, hi: 0x8a},
 	{value: 0x0040, lo: 0x8b, hi: 0x8c},
@@ -2643,7 +2786,7 @@ var idnaSparseValues = [2146]valueRange{
 	{value: 0x0008, lo: 0x81, hi: 0xb0},
 	{value: 0x3308, lo: 0xb1, hi: 0xb1},
 	{value: 0x0008, lo: 0xb2, hi: 0xb2},
-	{value: 0x08f1, lo: 0xb3, hi: 0xb3},
+	{value: 0x01f1, lo: 0xb3, hi: 0xb3},
 	{value: 0x3308, lo: 0xb4, hi: 0xb9},
 	{value: 0x3b08, lo: 0xba, hi: 0xba},
 	{value: 0x0040, lo: 0xbb, hi: 0xbe},
@@ -2666,8 +2809,8 @@ var idnaSparseValues = [2146]valueRange{
 	{value: 0x0040, lo: 0x8e, hi: 0x8f},
 	{value: 0x0008, lo: 0x90, hi: 0x99},
 	{value: 0x0040, lo: 0x9a, hi: 0x9b},
-	{value: 0x0961, lo: 0x9c, hi: 0x9c},
-	{value: 0x0999, lo: 0x9d, hi: 0x9d},
+	{value: 0x0201, lo: 0x9c, hi: 0x9c},
+	{value: 0x0209, lo: 0x9d, hi: 0x9d},
 	{value: 0x0008, lo: 0x9e, hi: 0x9f},
 	{value: 0x0040, lo: 0xa0, hi: 0xbf},
 	// Block 0x18, offset 0xf9
@@ -3075,13 +3218,13 @@ var idnaSparseValues = [2146]valueRange{
 	{value: 0x0018, lo: 0xbe, hi: 0xbf},
 	// Block 0x44, offset 0x260
 	{value: 0x0000, lo: 0x0c},
-	{value: 0x0e29, lo: 0x80, hi: 0x80},
-	{value: 0x0e41, lo: 0x81, hi: 0x81},
-	{value: 0x0e59, lo: 0x82, hi: 0x82},
-	{value: 0x0e71, lo: 0x83, hi: 0x83},
-	{value: 0x0e89, lo: 0x84, hi: 0x85},
-	{value: 0x0ea1, lo: 0x86, hi: 0x86},
-	{value: 0x0eb9, lo: 0x87, hi: 0x87},
+	{value: 0x02a9, lo: 0x80, hi: 0x80},
+	{value: 0x02b1, lo: 0x81, hi: 0x81},
+	{value: 0x02b9, lo: 0x82, hi: 0x82},
+	{value: 0x02c1, lo: 0x83, hi: 0x83},
+	{value: 0x02c9, lo: 0x84, hi: 0x85},
+	{value: 0x02d1, lo: 0x86, hi: 0x86},
+	{value: 0x02d9, lo: 0x87, hi: 0x87},
 	{value: 0x057d, lo: 0x88, hi: 0x88},
 	{value: 0x0040, lo: 0x89, hi: 0x8f},
 	{value: 0x059d, lo: 0x90, hi: 0xba},
@@ -3133,18 +3276,18 @@ var idnaSparseValues = [2146]valueRange{
 	{value: 0x0040, lo: 0x83, hi: 0x83},
 	{value: 0x0008, lo: 0x84, hi: 0x84},
 	{value: 0x0018, lo: 0x85, hi: 0x88},
-	{value: 0x24c1, lo: 0x89, hi: 0x89},
+	{value: 0x0851, lo: 0x89, hi: 0x89},
 	{value: 0x0018, lo: 0x8a, hi: 0x8b},
 	{value: 0x0040, lo: 0x8c, hi: 0x8f},
 	{value: 0x0018, lo: 0x90, hi: 0xbf},
 	// Block 0x4a, offset 0x29a
 	{value: 0x0000, lo: 0x07},
 	{value: 0x0018, lo: 0x80, hi: 0xab},
-	{value: 0x24f1, lo: 0xac, hi: 0xac},
-	{value: 0x2529, lo: 0xad, hi: 0xad},
+	{value: 0x0859, lo: 0xac, hi: 0xac},
+	{value: 0x0861, lo: 0xad, hi: 0xad},
 	{value: 0x0018, lo: 0xae, hi: 0xae},
-	{value: 0x2579, lo: 0xaf, hi: 0xaf},
-	{value: 0x25b1, lo: 0xb0, hi: 0xb0},
+	{value: 0x0869, lo: 0xaf, hi: 0xaf},
+	{value: 0x0871, lo: 0xb0, hi: 0xb0},
 	{value: 0x0018, lo: 0xb1, hi: 0xbf},
 	// Block 0x4b, offset 0x2a2
 	{value: 0x0000, lo: 0x05},
@@ -3166,19 +3309,19 @@ var idnaSparseValues = [2146]valueRange{
 	// Block 0x4e, offset 0x2b0
 	{value: 0x0000, lo: 0x03},
 	{value: 0x0018, lo: 0x80, hi: 0x8b},
-	{value: 0x28c1, lo: 0x8c, hi: 0x8c},
+	{value: 0x0929, lo: 0x8c, hi: 0x8c},
 	{value: 0x0018, lo: 0x8d, hi: 0xbf},
 	// Block 0x4f, offset 0x2b4
 	{value: 0x0000, lo: 0x05},
 	{value: 0x0018, lo: 0x80, hi: 0xb3},
 	{value: 0x0e7e, lo: 0xb4, hi: 0xb4},
-	{value: 0x292a, lo: 0xb5, hi: 0xb5},
+	{value: 0x0932, lo: 0xb5, hi: 0xb5},
 	{value: 0x0e9e, lo: 0xb6, hi: 0xb6},
 	{value: 0x0018, lo: 0xb7, hi: 0xbf},
 	// Block 0x50, offset 0x2ba
 	{value: 0x0000, lo: 0x03},
 	{value: 0x0018, lo: 0x80, hi: 0x9b},
-	{value: 0x2941, lo: 0x9c, hi: 0x9c},
+	{value: 0x0939, lo: 0x9c, hi: 0x9c},
 	{value: 0x0018, lo: 0x9d, hi: 0xbf},
 	// Block 0x51, offset 0x2be
 	{value: 0x0000, lo: 0x03},
@@ -3277,16 +3420,16 @@ var idnaSparseValues = [2146]valueRange{
 	{value: 0x0008, lo: 0x80, hi: 0x96},
 	{value: 0x0040, lo: 0x97, hi: 0x98},
 	{value: 0x3308, lo: 0x99, hi: 0x9a},
-	{value: 0x29e2, lo: 0x9b, hi: 0x9b},
-	{value: 0x2a0a, lo: 0x9c, hi: 0x9c},
+	{value: 0x096a, lo: 0x9b, hi: 0x9b},
+	{value: 0x0972, lo: 0x9c, hi: 0x9c},
 	{value: 0x0008, lo: 0x9d, hi: 0x9e},
-	{value: 0x2a31, lo: 0x9f, hi: 0x9f},
+	{value: 0x0979, lo: 0x9f, hi: 0x9f},
 	{value: 0x0018, lo: 0xa0, hi: 0xa0},
 	{value: 0x0008, lo: 0xa1, hi: 0xbf},
 	// Block 0x61, offset 0x315
 	{value: 0x0000, lo: 0x02},
 	{value: 0x0008, lo: 0x80, hi: 0xbe},
-	{value: 0x2a69, lo: 0xbf, hi: 0xbf},
+	{value: 0x0981, lo: 0xbf, hi: 0xbf},
 	// Block 0x62, offset 0x318
 	{value: 0x0000, lo: 0x0e},
 	{value: 0x0040, lo: 0x80, hi: 0x84},
@@ -3309,46 +3452,58 @@ var idnaSparseValues = [2146]valueRange{
 	{value: 0x0040, lo: 0xa4, hi: 0xaf},
 	{value: 0x0008, lo: 0xb0, hi: 0xbf},
 	// Block 0x64, offset 0x32b
-	{value: 0x0030, lo: 0x04},
-	{value: 0x2aa2, lo: 0x80, hi: 0x9d},
-	{value: 0x305a, lo: 0x9e, hi: 0x9e},
+	{value: 0x0008, lo: 0x03},
+	{value: 0x098a, lo: 0x80, hi: 0x9e},
 	{value: 0x0040, lo: 0x9f, hi: 0x9f},
-	{value: 0x30a2, lo: 0xa0, hi: 0xbf},
-	// Block 0x65, offset 0x330
+	{value: 0x0a82, lo: 0xa0, hi: 0xbf},
+	// Block 0x65, offset 0x32f
+	{value: 0x0008, lo: 0x01},
+	{value: 0x0d19, lo: 0x80, hi: 0xbf},
+	// Block 0x66, offset 0x331
+	{value: 0x0008, lo: 0x08},
+	{value: 0x0f19, lo: 0x80, hi: 0xb0},
+	{value: 0x4045, lo: 0xb1, hi: 0xb1},
+	{value: 0x10a1, lo: 0xb2, hi: 0xb3},
+	{value: 0x4065, lo: 0xb4, hi: 0xb4},
+	{value: 0x10b1, lo: 0xb5, hi: 0xb7},
+	{value: 0x4085, lo: 0xb8, hi: 0xb8},
+	{value: 0x4085, lo: 0xb9, hi: 0xb9},
+	{value: 0x10c9, lo: 0xba, hi: 0xbf},
+	// Block 0x67, offset 0x33a
 	{value: 0x0000, lo: 0x02},
 	{value: 0x0008, lo: 0x80, hi: 0xbc},
 	{value: 0x0040, lo: 0xbd, hi: 0xbf},
-	// Block 0x66, offset 0x333
+	// Block 0x68, offset 0x33d
 	{value: 0x0000, lo: 0x03},
 	{value: 0x0008, lo: 0x80, hi: 0x8c},
 	{value: 0x0040, lo: 0x8d, hi: 0x8f},
 	{value: 0x0018, lo: 0x90, hi: 0xbf},
-	// Block 0x67, offset 0x337
+	// Block 0x69, offset 0x341
 	{value: 0x0000, lo: 0x04},
 	{value: 0x0018, lo: 0x80, hi: 0x86},
 	{value: 0x0040, lo: 0x87, hi: 0x8f},
 	{value: 0x0008, lo: 0x90, hi: 0xbd},
 	{value: 0x0018, lo: 0xbe, hi: 0xbf},
-	// Block 0x68, offset 0x33c
+	// Block 0x6a, offset 0x346
 	{value: 0x0000, lo: 0x04},
 	{value: 0x0008, lo: 0x80, hi: 0x8c},
 	{value: 0x0018, lo: 0x8d, hi: 0x8f},
 	{value: 0x0008, lo: 0x90, hi: 0xab},
 	{value: 0x0040, lo: 0xac, hi: 0xbf},
-	// Block 0x69, offset 0x341
+	// Block 0x6b, offset 0x34b
 	{value: 0x0000, lo: 0x05},
 	{value: 0x0008, lo: 0x80, hi: 0xa5},
 	{value: 0x0018, lo: 0xa6, hi: 0xaf},
 	{value: 0x3308, lo: 0xb0, hi: 0xb1},
 	{value: 0x0018, lo: 0xb2, hi: 0xb7},
 	{value: 0x0040, lo: 0xb8, hi: 0xbf},
-	// Block 0x6a, offset 0x347
+	// Block 0x6c, offset 0x351
 	{value: 0x0000, lo: 0x10},
 	{value: 0x0040, lo: 0x80, hi: 0x81},
 	{value: 0xe00d, lo: 0x82, hi: 0x82},
 	{value: 0x0008, lo: 0x83, hi: 0x83},
 	{value: 0x03f5, lo: 0x84, hi: 0x84},
-	{value: 0x1329, lo: 0x85, hi: 0x85},
+	{value: 0x0479, lo: 0x85, hi: 0x85},
 	{value: 0x447d, lo: 0x86, hi: 0x86},
 	{value: 0xe07d, lo: 0x87, hi: 0x87},
 	{value: 0x0008, lo: 0x88, hi: 0x88},
@@ -3357,10 +3512,10 @@ var idnaSparseValues = [2146]valueRange{
 	{value: 0x0040, lo: 0x8b, hi: 0xb4},
 	{value: 0xe01d, lo: 0xb5, hi: 0xb5},
 	{value: 0x0008, lo: 0xb6, hi: 0xb7},
-	{value: 0x2009, lo: 0xb8, hi: 0xb8},
-	{value: 0x6ec1, lo: 0xb9, hi: 0xb9},
+	{value: 0x0741, lo: 0xb8, hi: 0xb8},
+	{value: 0x13f1, lo: 0xb9, hi: 0xb9},
 	{value: 0x0008, lo: 0xba, hi: 0xbf},
-	// Block 0x6b, offset 0x358
+	// Block 0x6d, offset 0x362
 	{value: 0x0000, lo: 0x0f},
 	{value: 0x0008, lo: 0x80, hi: 0x81},
 	{value: 0x3308, lo: 0x82, hi: 0x82},
@@ -3377,19 +3532,19 @@ var idnaSparseValues = [2146]valueRange{
 	{value: 0x0040, lo: 0xad, hi: 0xaf},
 	{value: 0x0018, lo: 0xb0, hi: 0xb9},
 	{value: 0x0040, lo: 0xba, hi: 0xbf},
-	// Block 0x6c, offset 0x368
+	// Block 0x6e, offset 0x372
 	{value: 0x0000, lo: 0x05},
 	{value: 0x0208, lo: 0x80, hi: 0xb1},
 	{value: 0x0108, lo: 0xb2, hi: 0xb2},
 	{value: 0x0008, lo: 0xb3, hi: 0xb3},
 	{value: 0x0018, lo: 0xb4, hi: 0xb7},
 	{value: 0x0040, lo: 0xb8, hi: 0xbf},
-	// Block 0x6d, offset 0x36e
+	// Block 0x6f, offset 0x378
 	{value: 0x0000, lo: 0x03},
 	{value: 0x3008, lo: 0x80, hi: 0x81},
 	{value: 0x0008, lo: 0x82, hi: 0xb3},
 	{value: 0x3008, lo: 0xb4, hi: 0xbf},
-	// Block 0x6e, offset 0x372
+	// Block 0x70, offset 0x37c
 	{value: 0x0000, lo: 0x0e},
 	{value: 0x3008, lo: 0x80, hi: 0x83},
 	{value: 0x3b08, lo: 0x84, hi: 0x84},
@@ -3405,13 +3560,13 @@ var idnaSparseValues = [2146]valueRange{
 	{value: 0x0018, lo: 0xbc, hi: 0xbc},
 	{value: 0x0008, lo: 0xbd, hi: 0xbe},
 	{value: 0x3308, lo: 0xbf, hi: 0xbf},
-	// Block 0x6f, offset 0x381
+	// Block 0x71, offset 0x38b
 	{value: 0x0000, lo: 0x04},
 	{value: 0x0008, lo: 0x80, hi: 0xa5},
 	{value: 0x3308, lo: 0xa6, hi: 0xad},
 	{value: 0x0018, lo: 0xae, hi: 0xaf},
 	{value: 0x0008, lo: 0xb0, hi: 0xbf},
-	// Block 0x70, offset 0x386
+	// Block 0x72, offset 0x390
 	{value: 0x0000, lo: 0x07},
 	{value: 0x0008, lo: 0x80, hi: 0x86},
 	{value: 0x3308, lo: 0x87, hi: 0x91},
@@ -3420,7 +3575,7 @@ var idnaSparseValues = [2146]valueRange{
 	{value: 0x0040, lo: 0x94, hi: 0x9e},
 	{value: 0x0018, lo: 0x9f, hi: 0xbc},
 	{value: 0x0040, lo: 0xbd, hi: 0xbf},
-	// Block 0x71, offset 0x38e
+	// Block 0x73, offset 0x398
 	{value: 0x0000, lo: 0x09},
 	{value: 0x3308, lo: 0x80, hi: 0x82},
 	{value: 0x3008, lo: 0x83, hi: 0x83},
@@ -3431,7 +3586,7 @@ var idnaSparseValues = [2146]valueRange{
 	{value: 0x3008, lo: 0xba, hi: 0xbb},
 	{value: 0x3308, lo: 0xbc, hi: 0xbd},
 	{value: 0x3008, lo: 0xbe, hi: 0xbf},
-	// Block 0x72, offset 0x398
+	// Block 0x74, offset 0x3a2
 	{value: 0x0000, lo: 0x0a},
 	{value: 0x3808, lo: 0x80, hi: 0x80},
 	{value: 0x0018, lo: 0x81, hi: 0x8d},
@@ -3443,7 +3598,7 @@ var idnaSparseValues = [2146]valueRange{
 	{value: 0x3308, lo: 0xa5, hi: 0xa5},
 	{value: 0x0008, lo: 0xa6, hi: 0xbe},
 	{value: 0x0040, lo: 0xbf, hi: 0xbf},
-	// Block 0x73, offset 0x3a3
+	// Block 0x75, offset 0x3ad
 	{value: 0x0000, lo: 0x07},
 	{value: 0x0008, lo: 0x80, hi: 0xa8},
 	{value: 0x3308, lo: 0xa9, hi: 0xae},
@@ -3452,7 +3607,7 @@ var idnaSparseValues = [2146]valueRange{
 	{value: 0x3008, lo: 0xb3, hi: 0xb4},
 	{value: 0x3308, lo: 0xb5, hi: 0xb6},
 	{value: 0x0040, lo: 0xb7, hi: 0xbf},
-	// Block 0x74, offset 0x3ab
+	// Block 0x76, offset 0x3b5
 	{value: 0x0000, lo: 0x10},
 	{value: 0x0008, lo: 0x80, hi: 0x82},
 	{value: 0x3308, lo: 0x83, hi: 0x83},
@@ -3470,7 +3625,7 @@ var idnaSparseValues = [2146]valueRange{
 	{value: 0x3308, lo: 0xbc, hi: 0xbc},
 	{value: 0x3008, lo: 0xbd, hi: 0xbd},
 	{value: 0x0008, lo: 0xbe, hi: 0xbf},
-	// Block 0x75, offset 0x3bc
+	// Block 0x77, offset 0x3c6
 	{value: 0x0000, lo: 0x08},
 	{value: 0x0008, lo: 0x80, hi: 0xaf},
 	{value: 0x3308, lo: 0xb0, hi: 0xb0},
@@ -3480,7 +3635,7 @@ var idnaSparseValues = [2146]valueRange{
 	{value: 0x3308, lo: 0xb7, hi: 0xb8},
 	{value: 0x0008, lo: 0xb9, hi: 0xbd},
 	{value: 0x3308, lo: 0xbe, hi: 0xbf},
-	// Block 0x76, offset 0x3c5
+	// Block 0x78, offset 0x3cf
 	{value: 0x0000, lo: 0x0f},
 	{value: 0x0008, lo: 0x80, hi: 0x80},
 	{value: 0x3308, lo: 0x81, hi: 0x81},
@@ -3497,7 +3652,7 @@ var idnaSparseValues = [2146]valueRange{
 	{value: 0x3008, lo: 0xb5, hi: 0xb5},
 	{value: 0x3b08, lo: 0xb6, hi: 0xb6},
 	{value: 0x0040, lo: 0xb7, hi: 0xbf},
-	// Block 0x77, offset 0x3d5
+	// Block 0x79, offset 0x3df
 	{value: 0x0000, lo: 0x0c},
 	{value: 0x0040, lo: 0x80, hi: 0x80},
 	{value: 0x0008, lo: 0x81, hi: 0x86},
@@ -3511,26 +3666,26 @@ var idnaSparseValues = [2146]valueRange{
 	{value: 0x0008, lo: 0xa8, hi: 0xae},
 	{value: 0x0040, lo: 0xaf, hi: 0xaf},
 	{value: 0x0008, lo: 0xb0, hi: 0xbf},
-	// Block 0x78, offset 0x3e2
+	// Block 0x7a, offset 0x3ec
 	{value: 0x0000, lo: 0x0b},
 	{value: 0x0008, lo: 0x80, hi: 0x9a},
 	{value: 0x0018, lo: 0x9b, hi: 0x9b},
 	{value: 0x449d, lo: 0x9c, hi: 0x9c},
 	{value: 0x44b5, lo: 0x9d, hi: 0x9d},
-	{value: 0x2971, lo: 0x9e, hi: 0x9e},
+	{value: 0x0941, lo: 0x9e, hi: 0x9e},
 	{value: 0xe06d, lo: 0x9f, hi: 0x9f},
 	{value: 0x0008, lo: 0xa0, hi: 0xa8},
-	{value: 0x6ed9, lo: 0xa9, hi: 0xa9},
+	{value: 0x13f9, lo: 0xa9, hi: 0xa9},
 	{value: 0x0018, lo: 0xaa, hi: 0xab},
 	{value: 0x0040, lo: 0xac, hi: 0xaf},
 	{value: 0x44cd, lo: 0xb0, hi: 0xbf},
-	// Block 0x79, offset 0x3ee
+	// Block 0x7b, offset 0x3f8
 	{value: 0x0000, lo: 0x04},
 	{value: 0x44ed, lo: 0x80, hi: 0x8f},
 	{value: 0x450d, lo: 0x90, hi: 0x9f},
 	{value: 0x452d, lo: 0xa0, hi: 0xaf},
 	{value: 0x450d, lo: 0xb0, hi: 0xbf},
-	// Block 0x7a, offset 0x3f3
+	// Block 0x7c, offset 0x3fd
 	{value: 0x0000, lo: 0x0c},
 	{value: 0x0008, lo: 0x80, hi: 0xa2},
 	{value: 0x3008, lo: 0xa3, hi: 0xa4},
@@ -3544,76 +3699,76 @@ var idnaSparseValues = [2146]valueRange{
 	{value: 0x0040, lo: 0xae, hi: 0xaf},
 	{value: 0x0008, lo: 0xb0, hi: 0xb9},
 	{value: 0x0040, lo: 0xba, hi: 0xbf},
-	// Block 0x7b, offset 0x400
+	// Block 0x7d, offset 0x40a
 	{value: 0x0000, lo: 0x03},
 	{value: 0x0008, lo: 0x80, hi: 0xa3},
 	{value: 0x0040, lo: 0xa4, hi: 0xaf},
 	{value: 0x0018, lo: 0xb0, hi: 0xbf},
-	// Block 0x7c, offset 0x404
+	// Block 0x7e, offset 0x40e
 	{value: 0x0000, lo: 0x04},
 	{value: 0x0018, lo: 0x80, hi: 0x86},
 	{value: 0x0040, lo: 0x87, hi: 0x8a},
 	{value: 0x0018, lo: 0x8b, hi: 0xbb},
 	{value: 0x0040, lo: 0xbc, hi: 0xbf},
-	// Block 0x7d, offset 0x409
+	// Block 0x7f, offset 0x413
 	{value: 0x0000, lo: 0x01},
 	{value: 0x0040, lo: 0x80, hi: 0xbf},
-	// Block 0x7e, offset 0x40b
+	// Block 0x80, offset 0x415
 	{value: 0x0020, lo: 0x01},
 	{value: 0x454d, lo: 0x80, hi: 0xbf},
-	// Block 0x7f, offset 0x40d
+	// Block 0x81, offset 0x417
 	{value: 0x0020, lo: 0x03},
 	{value: 0x4d4d, lo: 0x80, hi: 0x94},
 	{value: 0x4b0d, lo: 0x95, hi: 0x95},
 	{value: 0x4fed, lo: 0x96, hi: 0xbf},
-	// Block 0x80, offset 0x411
+	// Block 0x82, offset 0x41b
 	{value: 0x0020, lo: 0x01},
 	{value: 0x552d, lo: 0x80, hi: 0xbf},
-	// Block 0x81, offset 0x413
+	// Block 0x83, offset 0x41d
 	{value: 0x0020, lo: 0x03},
 	{value: 0x5d2d, lo: 0x80, hi: 0x84},
 	{value: 0x568d, lo: 0x85, hi: 0x85},
 	{value: 0x5dcd, lo: 0x86, hi: 0xbf},
-	// Block 0x82, offset 0x417
+	// Block 0x84, offset 0x421
 	{value: 0x0020, lo: 0x08},
 	{value: 0x6b8d, lo: 0x80, hi: 0x8f},
 	{value: 0x6d4d, lo: 0x90, hi: 0x90},
 	{value: 0x6d8d, lo: 0x91, hi: 0xab},
-	{value: 0x6ef1, lo: 0xac, hi: 0xac},
+	{value: 0x1401, lo: 0xac, hi: 0xac},
 	{value: 0x70ed, lo: 0xad, hi: 0xad},
 	{value: 0x0040, lo: 0xae, hi: 0xae},
 	{value: 0x0040, lo: 0xaf, hi: 0xaf},
 	{value: 0x710d, lo: 0xb0, hi: 0xbf},
-	// Block 0x83, offset 0x420
+	// Block 0x85, offset 0x42a
 	{value: 0x0020, lo: 0x05},
 	{value: 0x730d, lo: 0x80, hi: 0xad},
 	{value: 0x656d, lo: 0xae, hi: 0xae},
 	{value: 0x78cd, lo: 0xaf, hi: 0xb5},
 	{value: 0x6f8d, lo: 0xb6, hi: 0xb6},
 	{value: 0x79ad, lo: 0xb7, hi: 0xbf},
-	// Block 0x84, offset 0x426
-	{value: 0x0028, lo: 0x03},
-	{value: 0x7c71, lo: 0x80, hi: 0x82},
-	{value: 0x7c31, lo: 0x83, hi: 0x83},
-	{value: 0x7ce9, lo: 0x84, hi: 0xbf},
-	// Block 0x85, offset 0x42a
-	{value: 0x0038, lo: 0x0f},
-	{value: 0x9e01, lo: 0x80, hi: 0x83},
-	{value: 0x9ea9, lo: 0x84, hi: 0x85},
-	{value: 0x9ee1, lo: 0x86, hi: 0x87},
-	{value: 0x9f19, lo: 0x88, hi: 0x8f},
+	// Block 0x86, offset 0x430
+	{value: 0x0008, lo: 0x03},
+	{value: 0x1751, lo: 0x80, hi: 0x82},
+	{value: 0x1741, lo: 0x83, hi: 0x83},
+	{value: 0x1769, lo: 0x84, hi: 0xbf},
+	// Block 0x87, offset 0x434
+	{value: 0x0008, lo: 0x0f},
+	{value: 0x1d81, lo: 0x80, hi: 0x83},
+	{value: 0x1d99, lo: 0x84, hi: 0x85},
+	{value: 0x1da1, lo: 0x86, hi: 0x87},
+	{value: 0x1da9, lo: 0x88, hi: 0x8f},
 	{value: 0x0040, lo: 0x90, hi: 0x90},
 	{value: 0x0040, lo: 0x91, hi: 0x91},
-	{value: 0xa0d9, lo: 0x92, hi: 0x97},
-	{value: 0xa1f1, lo: 0x98, hi: 0x9c},
-	{value: 0xa2d1, lo: 0x9d, hi: 0xb3},
-	{value: 0x9d91, lo: 0xb4, hi: 0xb4},
-	{value: 0x9e01, lo: 0xb5, hi: 0xb5},
-	{value: 0xa7d9, lo: 0xb6, hi: 0xbb},
-	{value: 0xa8b9, lo: 0xbc, hi: 0xbc},
-	{value: 0xa849, lo: 0xbd, hi: 0xbd},
-	{value: 0xa929, lo: 0xbe, hi: 0xbf},
-	// Block 0x86, offset 0x43a
+	{value: 0x1de9, lo: 0x92, hi: 0x97},
+	{value: 0x1e11, lo: 0x98, hi: 0x9c},
+	{value: 0x1e31, lo: 0x9d, hi: 0xb3},
+	{value: 0x1d71, lo: 0xb4, hi: 0xb4},
+	{value: 0x1d81, lo: 0xb5, hi: 0xb5},
+	{value: 0x1ee9, lo: 0xb6, hi: 0xbb},
+	{value: 0x1f09, lo: 0xbc, hi: 0xbc},
+	{value: 0x1ef9, lo: 0xbd, hi: 0xbd},
+	{value: 0x1f19, lo: 0xbe, hi: 0xbf},
+	// Block 0x88, offset 0x444
 	{value: 0x0000, lo: 0x09},
 	{value: 0x0008, lo: 0x80, hi: 0x8b},
 	{value: 0x0040, lo: 0x8c, hi: 0x8c},
@@ -3624,24 +3779,24 @@ var idnaSparseValues = [2146]valueRange{
 	{value: 0x0008, lo: 0xbc, hi: 0xbd},
 	{value: 0x0040, lo: 0xbe, hi: 0xbe},
 	{value: 0x0008, lo: 0xbf, hi: 0xbf},
-	// Block 0x87, offset 0x444
+	// Block 0x89, offset 0x44e
 	{value: 0x0000, lo: 0x04},
 	{value: 0x0008, lo: 0x80, hi: 0x8d},
 	{value: 0x0040, lo: 0x8e, hi: 0x8f},
 	{value: 0x0008, lo: 0x90, hi: 0x9d},
 	{value: 0x0040, lo: 0x9e, hi: 0xbf},
-	// Block 0x88, offset 0x449
+	// Block 0x8a, offset 0x453
 	{value: 0x0000, lo: 0x02},
 	{value: 0x0008, lo: 0x80, hi: 0xba},
 	{value: 0x0040, lo: 0xbb, hi: 0xbf},
-	// Block 0x89, offset 0x44c
+	// Block 0x8b, offset 0x456
 	{value: 0x0000, lo: 0x05},
 	{value: 0x0018, lo: 0x80, hi: 0x82},
 	{value: 0x0040, lo: 0x83, hi: 0x86},
 	{value: 0x0018, lo: 0x87, hi: 0xb3},
 	{value: 0x0040, lo: 0xb4, hi: 0xb6},
 	{value: 0x0018, lo: 0xb7, hi: 0xbf},
-	// Block 0x8a, offset 0x452
+	// Block 0x8c, offset 0x45c
 	{value: 0x0000, lo: 0x06},
 	{value: 0x0018, lo: 0x80, hi: 0x8e},
 	{value: 0x0040, lo: 0x8f, hi: 0x8f},
@@ -3649,31 +3804,31 @@ var idnaSparseValues = [2146]valueRange{
 	{value: 0x0040, lo: 0x9d, hi: 0x9f},
 	{value: 0x0018, lo: 0xa0, hi: 0xa0},
 	{value: 0x0040, lo: 0xa1, hi: 0xbf},
-	// Block 0x8b, offset 0x459
+	// Block 0x8d, offset 0x463
 	{value: 0x0000, lo: 0x04},
 	{value: 0x0040, lo: 0x80, hi: 0x8f},
 	{value: 0x0018, lo: 0x90, hi: 0xbc},
 	{value: 0x3308, lo: 0xbd, hi: 0xbd},
 	{value: 0x0040, lo: 0xbe, hi: 0xbf},
-	// Block 0x8c, offset 0x45e
+	// Block 0x8e, offset 0x468
 	{value: 0x0000, lo: 0x03},
 	{value: 0x0008, lo: 0x80, hi: 0x9c},
 	{value: 0x0040, lo: 0x9d, hi: 0x9f},
 	{value: 0x0008, lo: 0xa0, hi: 0xbf},
-	// Block 0x8d, offset 0x462
+	// Block 0x8f, offset 0x46c
 	{value: 0x0000, lo: 0x05},
 	{value: 0x0008, lo: 0x80, hi: 0x90},
 	{value: 0x0040, lo: 0x91, hi: 0x9f},
 	{value: 0x3308, lo: 0xa0, hi: 0xa0},
 	{value: 0x0018, lo: 0xa1, hi: 0xbb},
 	{value: 0x0040, lo: 0xbc, hi: 0xbf},
-	// Block 0x8e, offset 0x468
+	// Block 0x90, offset 0x472
 	{value: 0x0000, lo: 0x04},
 	{value: 0x0008, lo: 0x80, hi: 0x9f},
 	{value: 0x0018, lo: 0xa0, hi: 0xa3},
 	{value: 0x0040, lo: 0xa4, hi: 0xac},
 	{value: 0x0008, lo: 0xad, hi: 0xbf},
-	// Block 0x8f, offset 0x46d
+	// Block 0x91, offset 0x477
 	{value: 0x0000, lo: 0x08},
 	{value: 0x0008, lo: 0x80, hi: 0x80},
 	{value: 0x0018, lo: 0x81, hi: 0x81},
@@ -3683,20 +3838,20 @@ var idnaSparseValues = [2146]valueRange{
 	{value: 0x0008, lo: 0x90, hi: 0xb5},
 	{value: 0x3308, lo: 0xb6, hi: 0xba},
 	{value: 0x0040, lo: 0xbb, hi: 0xbf},
-	// Block 0x90, offset 0x476
+	// Block 0x92, offset 0x480
 	{value: 0x0000, lo: 0x04},
 	{value: 0x0008, lo: 0x80, hi: 0x9d},
 	{value: 0x0040, lo: 0x9e, hi: 0x9e},
 	{value: 0x0018, lo: 0x9f, hi: 0x9f},
 	{value: 0x0008, lo: 0xa0, hi: 0xbf},
-	// Block 0x91, offset 0x47b
+	// Block 0x93, offset 0x485
 	{value: 0x0000, lo: 0x05},
 	{value: 0x0008, lo: 0x80, hi: 0x83},
 	{value: 0x0040, lo: 0x84, hi: 0x87},
 	{value: 0x0008, lo: 0x88, hi: 0x8f},
 	{value: 0x0018, lo: 0x90, hi: 0x95},
 	{value: 0x0040, lo: 0x96, hi: 0xbf},
-	// Block 0x92, offset 0x481
+	// Block 0x94, offset 0x48b
 	{value: 0x0000, lo: 0x06},
 	{value: 0xe145, lo: 0x80, hi: 0x87},
 	{value: 0xe1c5, lo: 0x88, hi: 0x8f},
@@ -3704,7 +3859,7 @@ var idnaSparseValues = [2146]valueRange{
 	{value: 0x8b0d, lo: 0x98, hi: 0x9f},
 	{value: 0x8b25, lo: 0xa0, hi: 0xa7},
 	{value: 0x0008, lo: 0xa8, hi: 0xbf},
-	// Block 0x93, offset 0x488
+	// Block 0x95, offset 0x492
 	{value: 0x0000, lo: 0x06},
 	{value: 0x0008, lo: 0x80, hi: 0x9d},
 	{value: 0x0040, lo: 0x9e, hi: 0x9f},
@@ -3712,7 +3867,7 @@ var idnaSparseValues = [2146]valueRange{
 	{value: 0x0040, lo: 0xaa, hi: 0xaf},
 	{value: 0x8b25, lo: 0xb0, hi: 0xb7},
 	{value: 0x8b0d, lo: 0xb8, hi: 0xbf},
-	// Block 0x94, offset 0x48f
+	// Block 0x96, offset 0x499
 	{value: 0x0000, lo: 0x06},
 	{value: 0xe145, lo: 0x80, hi: 0x87},
 	{value: 0xe1c5, lo: 0x88, hi: 0x8f},
@@ -3720,28 +3875,28 @@ var idnaSparseValues = [2146]valueRange{
 	{value: 0x0040, lo: 0x94, hi: 0x97},
 	{value: 0x0008, lo: 0x98, hi: 0xbb},
 	{value: 0x0040, lo: 0xbc, hi: 0xbf},
-	// Block 0x95, offset 0x496
+	// Block 0x97, offset 0x4a0
 	{value: 0x0000, lo: 0x03},
 	{value: 0x0008, lo: 0x80, hi: 0xa7},
 	{value: 0x0040, lo: 0xa8, hi: 0xaf},
 	{value: 0x0008, lo: 0xb0, hi: 0xbf},
-	// Block 0x96, offset 0x49a
+	// Block 0x98, offset 0x4a4
 	{value: 0x0000, lo: 0x04},
 	{value: 0x0008, lo: 0x80, hi: 0xa3},
 	{value: 0x0040, lo: 0xa4, hi: 0xae},
 	{value: 0x0018, lo: 0xaf, hi: 0xaf},
 	{value: 0x0040, lo: 0xb0, hi: 0xbf},
-	// Block 0x97, offset 0x49f
+	// Block 0x99, offset 0x4a9
 	{value: 0x0000, lo: 0x02},
 	{value: 0x0008, lo: 0x80, hi: 0xb6},
 	{value: 0x0040, lo: 0xb7, hi: 0xbf},
-	// Block 0x98, offset 0x4a2
+	// Block 0x9a, offset 0x4ac
 	{value: 0x0000, lo: 0x04},
 	{value: 0x0008, lo: 0x80, hi: 0x95},
 	{value: 0x0040, lo: 0x96, hi: 0x9f},
 	{value: 0x0008, lo: 0xa0, hi: 0xa7},
 	{value: 0x0040, lo: 0xa8, hi: 0xbf},
-	// Block 0x99, offset 0x4a7
+	// Block 0x9b, offset 0x4b1
 	{value: 0x0000, lo: 0x0b},
 	{value: 0x0808, lo: 0x80, hi: 0x85},
 	{value: 0x0040, lo: 0x86, hi: 0x87},
@@ -3754,20 +3909,20 @@ var idnaSparseValues = [2146]valueRange{
 	{value: 0x0808, lo: 0xbc, hi: 0xbc},
 	{value: 0x0040, lo: 0xbd, hi: 0xbe},
 	{value: 0x0808, lo: 0xbf, hi: 0xbf},
-	// Block 0x9a, offset 0x4b3
+	// Block 0x9c, offset 0x4bd
 	{value: 0x0000, lo: 0x05},
 	{value: 0x0808, lo: 0x80, hi: 0x95},
 	{value: 0x0040, lo: 0x96, hi: 0x96},
 	{value: 0x0818, lo: 0x97, hi: 0x9f},
 	{value: 0x0808, lo: 0xa0, hi: 0xb6},
 	{value: 0x0818, lo: 0xb7, hi: 0xbf},
-	// Block 0x9b, offset 0x4b9
+	// Block 0x9d, offset 0x4c3
 	{value: 0x0000, lo: 0x04},
 	{value: 0x0808, lo: 0x80, hi: 0x9e},
 	{value: 0x0040, lo: 0x9f, hi: 0xa6},
 	{value: 0x0818, lo: 0xa7, hi: 0xaf},
 	{value: 0x0040, lo: 0xb0, hi: 0xbf},
-	// Block 0x9c, offset 0x4be
+	// Block 0x9e, offset 0x4c8
 	{value: 0x0000, lo: 0x06},
 	{value: 0x0040, lo: 0x80, hi: 0x9f},
 	{value: 0x0808, lo: 0xa0, hi: 0xb2},
@@ -3775,7 +3930,7 @@ var idnaSparseValues = [2146]valueRange{
 	{value: 0x0808, lo: 0xb4, hi: 0xb5},
 	{value: 0x0040, lo: 0xb6, hi: 0xba},
 	{value: 0x0818, lo: 0xbb, hi: 0xbf},
-	// Block 0x9d, offset 0x4c5
+	// Block 0x9f, offset 0x4cf
 	{value: 0x0000, lo: 0x07},
 	{value: 0x0808, lo: 0x80, hi: 0x95},
 	{value: 0x0818, lo: 0x96, hi: 0x9b},
@@ -3784,18 +3939,18 @@ var idnaSparseValues = [2146]valueRange{
 	{value: 0x0808, lo: 0xa0, hi: 0xb9},
 	{value: 0x0040, lo: 0xba, hi: 0xbe},
 	{value: 0x0818, lo: 0xbf, hi: 0xbf},
-	// Block 0x9e, offset 0x4cd
+	// Block 0xa0, offset 0x4d7
 	{value: 0x0000, lo: 0x04},
 	{value: 0x0808, lo: 0x80, hi: 0xb7},
 	{value: 0x0040, lo: 0xb8, hi: 0xbb},
 	{value: 0x0818, lo: 0xbc, hi: 0xbd},
 	{value: 0x0808, lo: 0xbe, hi: 0xbf},
-	// Block 0x9f, offset 0x4d2
+	// Block 0xa1, offset 0x4dc
 	{value: 0x0000, lo: 0x03},
 	{value: 0x0818, lo: 0x80, hi: 0x8f},
 	{value: 0x0040, lo: 0x90, hi: 0x91},
 	{value: 0x0818, lo: 0x92, hi: 0xbf},
-	// Block 0xa0, offset 0x4d6
+	// Block 0xa2, offset 0x4e0
 	{value: 0x0000, lo: 0x0f},
 	{value: 0x0808, lo: 0x80, hi: 0x80},
 	{value: 0x3308, lo: 0x81, hi: 0x83},
@@ -3812,7 +3967,7 @@ var idnaSparseValues = [2146]valueRange{
 	{value: 0x3308, lo: 0xb8, hi: 0xba},
 	{value: 0x0040, lo: 0xbb, hi: 0xbe},
 	{value: 0x3b08, lo: 0xbf, hi: 0xbf},
-	// Block 0xa1, offset 0x4e6
+	// Block 0xa3, offset 0x4f0
 	{value: 0x0000, lo: 0x06},
 	{value: 0x0818, lo: 0x80, hi: 0x88},
 	{value: 0x0040, lo: 0x89, hi: 0x8f},
@@ -3820,17 +3975,17 @@ var idnaSparseValues = [2146]valueRange{
 	{value: 0x0040, lo: 0x99, hi: 0x9f},
 	{value: 0x0808, lo: 0xa0, hi: 0xbc},
 	{value: 0x0818, lo: 0xbd, hi: 0xbf},
-	// Block 0xa2, offset 0x4ed
+	// Block 0xa4, offset 0x4f7
 	{value: 0x0000, lo: 0x03},
 	{value: 0x0808, lo: 0x80, hi: 0x9c},
 	{value: 0x0818, lo: 0x9d, hi: 0x9f},
 	{value: 0x0040, lo: 0xa0, hi: 0xbf},
-	// Block 0xa3, offset 0x4f1
+	// Block 0xa5, offset 0x4fb
 	{value: 0x0000, lo: 0x03},
 	{value: 0x0808, lo: 0x80, hi: 0xb5},
 	{value: 0x0040, lo: 0xb6, hi: 0xb8},
 	{value: 0x0018, lo: 0xb9, hi: 0xbf},
-	// Block 0xa4, offset 0x4f5
+	// Block 0xa6, offset 0x4ff
 	{value: 0x0000, lo: 0x06},
 	{value: 0x0808, lo: 0x80, hi: 0x95},
 	{value: 0x0040, lo: 0x96, hi: 0x97},
@@ -3838,23 +3993,23 @@ var idnaSparseValues = [2146]valueRange{
 	{value: 0x0808, lo: 0xa0, hi: 0xb2},
 	{value: 0x0040, lo: 0xb3, hi: 0xb7},
 	{value: 0x0818, lo: 0xb8, hi: 0xbf},
-	// Block 0xa5, offset 0x4fc
+	// Block 0xa7, offset 0x506
 	{value: 0x0000, lo: 0x01},
 	{value: 0x0808, lo: 0x80, hi: 0xbf},
-	// Block 0xa6, offset 0x4fe
+	// Block 0xa8, offset 0x508
 	{value: 0x0000, lo: 0x02},
 	{value: 0x0808, lo: 0x80, hi: 0x88},
 	{value: 0x0040, lo: 0x89, hi: 0xbf},
-	// Block 0xa7, offset 0x501
+	// Block 0xa9, offset 0x50b
 	{value: 0x0000, lo: 0x02},
 	{value: 0x03dd, lo: 0x80, hi: 0xb2},
 	{value: 0x0040, lo: 0xb3, hi: 0xbf},
-	// Block 0xa8, offset 0x504
+	// Block 0xaa, offset 0x50e
 	{value: 0x0000, lo: 0x03},
 	{value: 0x0808, lo: 0x80, hi: 0xb2},
 	{value: 0x0040, lo: 0xb3, hi: 0xb9},
 	{value: 0x0818, lo: 0xba, hi: 0xbf},
-	// Block 0xa9, offset 0x508
+	// Block 0xab, offset 0x512
 	{value: 0x0000, lo: 0x08},
 	{value: 0x0908, lo: 0x80, hi: 0x80},
 	{value: 0x0a08, lo: 0x81, hi: 0xa1},
@@ -3864,12 +4019,12 @@ var idnaSparseValues = [2146]valueRange{
 	{value: 0x0040, lo: 0xa8, hi: 0xaf},
 	{value: 0x0808, lo: 0xb0, hi: 0xb9},
 	{value: 0x0040, lo: 0xba, hi: 0xbf},
-	// Block 0xaa, offset 0x511
+	// Block 0xac, offset 0x51b
 	{value: 0x0000, lo: 0x03},
 	{value: 0x0040, lo: 0x80, hi: 0x9f},
 	{value: 0x0818, lo: 0xa0, hi: 0xbe},
 	{value: 0x0040, lo: 0xbf, hi: 0xbf},
-	// Block 0xab, offset 0x515
+	// Block 0xad, offset 0x51f
 	{value: 0x0000, lo: 0x07},
 	{value: 0x0808, lo: 0x80, hi: 0xa9},
 	{value: 0x0040, lo: 0xaa, hi: 0xaa},
@@ -3878,7 +4033,7 @@ var idnaSparseValues = [2146]valueRange{
 	{value: 0x0040, lo: 0xae, hi: 0xaf},
 	{value: 0x0808, lo: 0xb0, hi: 0xb1},
 	{value: 0x0040, lo: 0xb2, hi: 0xbf},
-	// Block 0xac, offset 0x51d
+	// Block 0xae, offset 0x527
 	{value: 0x0000, lo: 0x07},
 	{value: 0x0808, lo: 0x80, hi: 0x9c},
 	{value: 0x0818, lo: 0x9d, hi: 0xa6},
@@ -3887,7 +4042,7 @@ var idnaSparseValues = [2146]valueRange{
 	{value: 0x0a08, lo: 0xb0, hi: 0xb2},
 	{value: 0x0c08, lo: 0xb3, hi: 0xb3},
 	{value: 0x0a08, lo: 0xb4, hi: 0xbf},
-	// Block 0xad, offset 0x525
+	// Block 0xaf, offset 0x52f
 	{value: 0x0000, lo: 0x07},
 	{value: 0x0a08, lo: 0x80, hi: 0x84},
 	{value: 0x0808, lo: 0x85, hi: 0x85},
@@ -3896,7 +4051,7 @@ var idnaSparseValues = [2146]valueRange{
 	{value: 0x0c18, lo: 0x94, hi: 0x94},
 	{value: 0x0818, lo: 0x95, hi: 0x99},
 	{value: 0x0040, lo: 0x9a, hi: 0xbf},
-	// Block 0xae, offset 0x52d
+	// Block 0xb0, offset 0x537
 	{value: 0x0000, lo: 0x0b},
 	{value: 0x0040, lo: 0x80, hi: 0xaf},
 	{value: 0x0a08, lo: 0xb0, hi: 0xb0},
@@ -3909,7 +4064,7 @@ var idnaSparseValues = [2146]valueRange{
 	{value: 0x0a08, lo: 0xbb, hi: 0xbc},
 	{value: 0x0c08, lo: 0xbd, hi: 0xbd},
 	{value: 0x0a08, lo: 0xbe, hi: 0xbf},
-	// Block 0xaf, offset 0x539
+	// Block 0xb1, offset 0x543
 	{value: 0x0000, lo: 0x0b},
 	{value: 0x0808, lo: 0x80, hi: 0x80},
 	{value: 0x0a08, lo: 0x81, hi: 0x81},
@@ -3922,14 +4077,14 @@ var idnaSparseValues = [2146]valueRange{
 	{value: 0x0040, lo: 0x8c, hi: 0x9f},
 	{value: 0x0808, lo: 0xa0, hi: 0xb6},
 	{value: 0x0040, lo: 0xb7, hi: 0xbf},
-	// Block 0xb0, offset 0x545
+	// Block 0xb2, offset 0x54f
 	{value: 0x0000, lo: 0x05},
 	{value: 0x3008, lo: 0x80, hi: 0x80},
 	{value: 0x3308, lo: 0x81, hi: 0x81},
 	{value: 0x3008, lo: 0x82, hi: 0x82},
 	{value: 0x0008, lo: 0x83, hi: 0xb7},
 	{value: 0x3308, lo: 0xb8, hi: 0xbf},
-	// Block 0xb1, offset 0x54b
+	// Block 0xb3, offset 0x555
 	{value: 0x0000, lo: 0x08},
 	{value: 0x3308, lo: 0x80, hi: 0x85},
 	{value: 0x3b08, lo: 0x86, hi: 0x86},
@@ -3939,7 +4094,7 @@ var idnaSparseValues = [2146]valueRange{
 	{value: 0x0008, lo: 0xa6, hi: 0xaf},
 	{value: 0x0040, lo: 0xb0, hi: 0xbe},
 	{value: 0x3b08, lo: 0xbf, hi: 0xbf},
-	// Block 0xb2, offset 0x554
+	// Block 0xb4, offset 0x55e
 	{value: 0x0000, lo: 0x0b},
 	{value: 0x3308, lo: 0x80, hi: 0x81},
 	{value: 0x3008, lo: 0x82, hi: 0x82},
@@ -3952,7 +4107,7 @@ var idnaSparseValues = [2146]valueRange{
 	{value: 0x0018, lo: 0xbb, hi: 0xbc},
 	{value: 0x0040, lo: 0xbd, hi: 0xbd},
 	{value: 0x0018, lo: 0xbe, hi: 0xbf},
-	// Block 0xb3, offset 0x560
+	// Block 0xb5, offset 0x56a
 	{value: 0x0000, lo: 0x06},
 	{value: 0x0018, lo: 0x80, hi: 0x81},
 	{value: 0x0040, lo: 0x82, hi: 0x8f},
@@ -3960,7 +4115,7 @@ var idnaSparseValues = [2146]valueRange{
 	{value: 0x0040, lo: 0xa9, hi: 0xaf},
 	{value: 0x0008, lo: 0xb0, hi: 0xb9},
 	{value: 0x0040, lo: 0xba, hi: 0xbf},
-	// Block 0xb4, offset 0x567
+	// Block 0xb6, offset 0x571
 	{value: 0x0000, lo: 0x08},
 	{value: 0x3308, lo: 0x80, hi: 0x82},
 	{value: 0x0008, lo: 0x83, hi: 0xa6},
@@ -3970,7 +4125,7 @@ var idnaSparseValues = [2146]valueRange{
 	{value: 0x3b08, lo: 0xb3, hi: 0xb4},
 	{value: 0x0040, lo: 0xb5, hi: 0xb5},
 	{value: 0x0008, lo: 0xb6, hi: 0xbf},
-	// Block 0xb5, offset 0x570
+	// Block 0xb7, offset 0x57a
 	{value: 0x0000, lo: 0x0a},
 	{value: 0x0018, lo: 0x80, hi: 0x83},
 	{value: 0x0008, lo: 0x84, hi: 0x84},
@@ -3982,7 +4137,7 @@ var idnaSparseValues = [2146]valueRange{
 	{value: 0x0018, lo: 0xb4, hi: 0xb5},
 	{value: 0x0008, lo: 0xb6, hi: 0xb6},
 	{value: 0x0040, lo: 0xb7, hi: 0xbf},
-	// Block 0xb6, offset 0x57b
+	// Block 0xb8, offset 0x585
 	{value: 0x0000, lo: 0x06},
 	{value: 0x3308, lo: 0x80, hi: 0x81},
 	{value: 0x3008, lo: 0x82, hi: 0x82},
@@ -3990,7 +4145,7 @@ var idnaSparseValues = [2146]valueRange{
 	{value: 0x3008, lo: 0xb3, hi: 0xb5},
 	{value: 0x3308, lo: 0xb6, hi: 0xbe},
 	{value: 0x3008, lo: 0xbf, hi: 0xbf},
-	// Block 0xb7, offset 0x582
+	// Block 0xb9, offset 0x58c
 	{value: 0x0000, lo: 0x0e},
 	{value: 0x3808, lo: 0x80, hi: 0x80},
 	{value: 0x0008, lo: 0x81, hi: 0x84},
@@ -4006,7 +4161,7 @@ var idnaSparseValues = [2146]valueRange{
 	{value: 0x0040, lo: 0xa0, hi: 0xa0},
 	{value: 0x0018, lo: 0xa1, hi: 0xb4},
 	{value: 0x0040, lo: 0xb5, hi: 0xbf},
-	// Block 0xb8, offset 0x591
+	// Block 0xba, offset 0x59b
 	{value: 0x0000, lo: 0x0c},
 	{value: 0x0008, lo: 0x80, hi: 0x91},
 	{value: 0x0040, lo: 0x92, hi: 0x92},
@@ -4020,7 +4175,7 @@ var idnaSparseValues = [2146]valueRange{
 	{value: 0x0018, lo: 0xb8, hi: 0xbd},
 	{value: 0x3308, lo: 0xbe, hi: 0xbe},
 	{value: 0x0040, lo: 0xbf, hi: 0xbf},
-	// Block 0xb9, offset 0x59e
+	// Block 0xbb, offset 0x5a8
 	{value: 0x0000, lo: 0x0c},
 	{value: 0x0008, lo: 0x80, hi: 0x86},
 	{value: 0x0040, lo: 0x87, hi: 0x87},
@@ -4034,7 +4189,7 @@ var idnaSparseValues = [2146]valueRange{
 	{value: 0x0018, lo: 0xa9, hi: 0xa9},
 	{value: 0x0040, lo: 0xaa, hi: 0xaf},
 	{value: 0x0008, lo: 0xb0, hi: 0xbf},
-	// Block 0xba, offset 0x5ab
+	// Block 0xbc, offset 0x5b5
 	{value: 0x0000, lo: 0x08},
 	{value: 0x0008, lo: 0x80, hi: 0x9e},
 	{value: 0x3308, lo: 0x9f, hi: 0x9f},
@@ -4044,12 +4199,12 @@ var idnaSparseValues = [2146]valueRange{
 	{value: 0x0040, lo: 0xab, hi: 0xaf},
 	{value: 0x0008, lo: 0xb0, hi: 0xb9},
 	{value: 0x0040, lo: 0xba, hi: 0xbf},
-	// Block 0xbb, offset 0x5b4
+	// Block 0xbd, offset 0x5be
 	{value: 0x0000, lo: 0x03},
 	{value: 0x0008, lo: 0x80, hi: 0xb4},
 	{value: 0x3008, lo: 0xb5, hi: 0xb7},
 	{value: 0x3308, lo: 0xb8, hi: 0xbf},
-	// Block 0xbc, offset 0x5b8
+	// Block 0xbe, offset 0x5c2
 	{value: 0x0000, lo: 0x0e},
 	{value: 0x3008, lo: 0x80, hi: 0x81},
 	{value: 0x3b08, lo: 0x82, hi: 0x82},
@@ -4065,7 +4220,7 @@ var idnaSparseValues = [2146]valueRange{
 	{value: 0x3308, lo: 0x9e, hi: 0x9e},
 	{value: 0x0008, lo: 0x9f, hi: 0xa1},
 	{value: 0x0040, lo: 0xa2, hi: 0xbf},
-	// Block 0xbd, offset 0x5c7
+	// Block 0xbf, offset 0x5d1
 	{value: 0x0000, lo: 0x07},
 	{value: 0x0008, lo: 0x80, hi: 0xaf},
 	{value: 0x3008, lo: 0xb0, hi: 0xb2},
@@ -4074,7 +4229,7 @@ var idnaSparseValues = [2146]valueRange{
 	{value: 0x3308, lo: 0xba, hi: 0xba},
 	{value: 0x3008, lo: 0xbb, hi: 0xbe},
 	{value: 0x3308, lo: 0xbf, hi: 0xbf},
-	// Block 0xbe, offset 0x5cf
+	// Block 0xc0, offset 0x5d9
 	{value: 0x0000, lo: 0x0a},
 	{value: 0x3308, lo: 0x80, hi: 0x80},
 	{value: 0x3008, lo: 0x81, hi: 0x81},
@@ -4086,7 +4241,7 @@ var idnaSparseValues = [2146]valueRange{
 	{value: 0x0040, lo: 0x88, hi: 0x8f},
 	{value: 0x0008, lo: 0x90, hi: 0x99},
 	{value: 0x0040, lo: 0x9a, hi: 0xbf},
-	// Block 0xbf, offset 0x5da
+	// Block 0xc1, offset 0x5e4
 	{value: 0x0000, lo: 0x08},
 	{value: 0x0008, lo: 0x80, hi: 0xae},
 	{value: 0x3008, lo: 0xaf, hi: 0xb1},
@@ -4096,14 +4251,14 @@ var idnaSparseValues = [2146]valueRange{
 	{value: 0x3308, lo: 0xbc, hi: 0xbd},
 	{value: 0x3008, lo: 0xbe, hi: 0xbe},
 	{value: 0x3b08, lo: 0xbf, hi: 0xbf},
-	// Block 0xc0, offset 0x5e3
+	// Block 0xc2, offset 0x5ed
 	{value: 0x0000, lo: 0x05},
 	{value: 0x3308, lo: 0x80, hi: 0x80},
 	{value: 0x0018, lo: 0x81, hi: 0x97},
 	{value: 0x0008, lo: 0x98, hi: 0x9b},
 	{value: 0x3308, lo: 0x9c, hi: 0x9d},
 	{value: 0x0040, lo: 0x9e, hi: 0xbf},
-	// Block 0xc1, offset 0x5e9
+	// Block 0xc3, offset 0x5f3
 	{value: 0x0000, lo: 0x07},
 	{value: 0x0008, lo: 0x80, hi: 0xaf},
 	{value: 0x3008, lo: 0xb0, hi: 0xb2},
@@ -4112,7 +4267,7 @@ var idnaSparseValues = [2146]valueRange{
 	{value: 0x3308, lo: 0xbd, hi: 0xbd},
 	{value: 0x3008, lo: 0xbe, hi: 0xbe},
 	{value: 0x3b08, lo: 0xbf, hi: 0xbf},
-	// Block 0xc2, offset 0x5f1
+	// Block 0xc4, offset 0x5fb
 	{value: 0x0000, lo: 0x08},
 	{value: 0x3308, lo: 0x80, hi: 0x80},
 	{value: 0x0018, lo: 0x81, hi: 0x83},
@@ -4122,7 +4277,7 @@ var idnaSparseValues = [2146]valueRange{
 	{value: 0x0040, lo: 0x9a, hi: 0x9f},
 	{value: 0x0018, lo: 0xa0, hi: 0xac},
 	{value: 0x0040, lo: 0xad, hi: 0xbf},
-	// Block 0xc3, offset 0x5fa
+	// Block 0xc5, offset 0x604
 	{value: 0x0000, lo: 0x0a},
 	{value: 0x0008, lo: 0x80, hi: 0xaa},
 	{value: 0x3308, lo: 0xab, hi: 0xab},
@@ -4134,11 +4289,11 @@ var idnaSparseValues = [2146]valueRange{
 	{value: 0x3308, lo: 0xb7, hi: 0xb7},
 	{value: 0x0008, lo: 0xb8, hi: 0xb8},
 	{value: 0x0040, lo: 0xb9, hi: 0xbf},
-	// Block 0xc4, offset 0x605
+	// Block 0xc6, offset 0x60f
 	{value: 0x0000, lo: 0x02},
 	{value: 0x0008, lo: 0x80, hi: 0x89},
 	{value: 0x0040, lo: 0x8a, hi: 0xbf},
-	// Block 0xc5, offset 0x608
+	// Block 0xc7, offset 0x612
 	{value: 0x0000, lo: 0x0b},
 	{value: 0x0008, lo: 0x80, hi: 0x9a},
 	{value: 0x0040, lo: 0x9b, hi: 0x9c},
@@ -4151,7 +4306,7 @@ var idnaSparseValues = [2146]valueRange{
 	{value: 0x0040, lo: 0xac, hi: 0xaf},
 	{value: 0x0008, lo: 0xb0, hi: 0xb9},
 	{value: 0x0018, lo: 0xba, hi: 0xbf},
-	// Block 0xc6, offset 0x614
+	// Block 0xc8, offset 0x61e
 	{value: 0x0000, lo: 0x08},
 	{value: 0x0008, lo: 0x80, hi: 0xab},
 	{value: 0x3008, lo: 0xac, hi: 0xae},
@@ -4161,17 +4316,17 @@ var idnaSparseValues = [2146]valueRange{
 	{value: 0x3308, lo: 0xba, hi: 0xba},
 	{value: 0x0018, lo: 0xbb, hi: 0xbb},
 	{value: 0x0040, lo: 0xbc, hi: 0xbf},
-	// Block 0xc7, offset 0x61d
+	// Block 0xc9, offset 0x627
 	{value: 0x0000, lo: 0x02},
 	{value: 0x0040, lo: 0x80, hi: 0x9f},
 	{value: 0x049d, lo: 0xa0, hi: 0xbf},
-	// Block 0xc8, offset 0x620
+	// Block 0xca, offset 0x62a
 	{value: 0x0000, lo: 0x04},
 	{value: 0x0008, lo: 0x80, hi: 0xa9},
 	{value: 0x0018, lo: 0xaa, hi: 0xb2},
 	{value: 0x0040, lo: 0xb3, hi: 0xbe},
 	{value: 0x0008, lo: 0xbf, hi: 0xbf},
-	// Block 0xc9, offset 0x625
+	// Block 0xcb, offset 0x62f
 	{value: 0x0000, lo: 0x08},
 	{value: 0x3008, lo: 0x80, hi: 0x80},
 	{value: 0x0008, lo: 0x81, hi: 0x81},
@@ -4181,13 +4336,13 @@ var idnaSparseValues = [2146]valueRange{
 	{value: 0x0040, lo: 0x87, hi: 0x8f},
 	{value: 0x0008, lo: 0x90, hi: 0x99},
 	{value: 0x0040, lo: 0x9a, hi: 0xbf},
-	// Block 0xca, offset 0x62e
+	// Block 0xcc, offset 0x638
 	{value: 0x0000, lo: 0x04},
 	{value: 0x0040, lo: 0x80, hi: 0x9f},
 	{value: 0x0008, lo: 0xa0, hi: 0xa7},
 	{value: 0x0040, lo: 0xa8, hi: 0xa9},
 	{value: 0x0008, lo: 0xaa, hi: 0xbf},
-	// Block 0xcb, offset 0x633
+	// Block 0xcd, offset 0x63d
 	{value: 0x0000, lo: 0x0c},
 	{value: 0x0008, lo: 0x80, hi: 0x90},
 	{value: 0x3008, lo: 0x91, hi: 0x93},
@@ -4201,7 +4356,7 @@ var idnaSparseValues = [2146]valueRange{
 	{value: 0x0008, lo: 0xa3, hi: 0xa3},
 	{value: 0x3008, lo: 0xa4, hi: 0xa4},
 	{value: 0x0040, lo: 0xa5, hi: 0xbf},
-	// Block 0xcc, offset 0x640
+	// Block 0xce, offset 0x64a
 	{value: 0x0000, lo: 0x0a},
 	{value: 0x0008, lo: 0x80, hi: 0x80},
 	{value: 0x3308, lo: 0x81, hi: 0x8a},
@@ -4213,7 +4368,7 @@ var idnaSparseValues = [2146]valueRange{
 	{value: 0x0008, lo: 0xba, hi: 0xba},
 	{value: 0x3308, lo: 0xbb, hi: 0xbe},
 	{value: 0x0018, lo: 0xbf, hi: 0xbf},
-	// Block 0xcd, offset 0x64b
+	// Block 0xcf, offset 0x655
 	{value: 0x0000, lo: 0x08},
 	{value: 0x0018, lo: 0x80, hi: 0x86},
 	{value: 0x3b08, lo: 0x87, hi: 0x87},
@@ -4223,7 +4378,7 @@ var idnaSparseValues = [2146]valueRange{
 	{value: 0x3008, lo: 0x97, hi: 0x98},
 	{value: 0x3308, lo: 0x99, hi: 0x9b},
 	{value: 0x0008, lo: 0x9c, hi: 0xbf},
-	// Block 0xce, offset 0x654
+	// Block 0xd0, offset 0x65e
 	{value: 0x0000, lo: 0x09},
 	{value: 0x0008, lo: 0x80, hi: 0x89},
 	{value: 0x3308, lo: 0x8a, hi: 0x96},
@@ -4234,11 +4389,11 @@ var idnaSparseValues = [2146]valueRange{
 	{value: 0x0008, lo: 0x9d, hi: 0x9d},
 	{value: 0x0018, lo: 0x9e, hi: 0xa2},
 	{value: 0x0040, lo: 0xa3, hi: 0xbf},
-	// Block 0xcf, offset 0x65e
+	// Block 0xd1, offset 0x668
 	{value: 0x0000, lo: 0x02},
 	{value: 0x0008, lo: 0x80, hi: 0xb8},
 	{value: 0x0040, lo: 0xb9, hi: 0xbf},
-	// Block 0xd0, offset 0x661
+	// Block 0xd2, offset 0x66b
 	{value: 0x0000, lo: 0x09},
 	{value: 0x0008, lo: 0x80, hi: 0x88},
 	{value: 0x0040, lo: 0x89, hi: 0x89},
@@ -4249,7 +4404,7 @@ var idnaSparseValues = [2146]valueRange{
 	{value: 0x3308, lo: 0xb8, hi: 0xbd},
 	{value: 0x3008, lo: 0xbe, hi: 0xbe},
 	{value: 0x3b08, lo: 0xbf, hi: 0xbf},
-	// Block 0xd1, offset 0x66b
+	// Block 0xd3, offset 0x675
 	{value: 0x0000, lo: 0x08},
 	{value: 0x0008, lo: 0x80, hi: 0x80},
 	{value: 0x0018, lo: 0x81, hi: 0x85},
@@ -4259,7 +4414,7 @@ var idnaSparseValues = [2146]valueRange{
 	{value: 0x0040, lo: 0xad, hi: 0xaf},
 	{value: 0x0018, lo: 0xb0, hi: 0xb1},
 	{value: 0x0008, lo: 0xb2, hi: 0xbf},
-	// Block 0xd2, offset 0x674
+	// Block 0xd4, offset 0x67e
 	{value: 0x0000, lo: 0x0b},
 	{value: 0x0008, lo: 0x80, hi: 0x8f},
 	{value: 0x0040, lo: 0x90, hi: 0x91},
@@ -4272,7 +4427,7 @@ var idnaSparseValues = [2146]valueRange{
 	{value: 0x3008, lo: 0xb4, hi: 0xb4},
 	{value: 0x3308, lo: 0xb5, hi: 0xb6},
 	{value: 0x0040, lo: 0xb7, hi: 0xbf},
-	// Block 0xd3, offset 0x680
+	// Block 0xd5, offset 0x68a
 	{value: 0x0000, lo: 0x0c},
 	{value: 0x0008, lo: 0x80, hi: 0x86},
 	{value: 0x0040, lo: 0x87, hi: 0x87},
@@ -4286,7 +4441,7 @@ var idnaSparseValues = [2146]valueRange{
 	{value: 0x3308, lo: 0xbc, hi: 0xbd},
 	{value: 0x0040, lo: 0xbe, hi: 0xbe},
 	{value: 0x3308, lo: 0xbf, hi: 0xbf},
-	// Block 0xd4, offset 0x68d
+	// Block 0xd6, offset 0x697
 	{value: 0x0000, lo: 0x0c},
 	{value: 0x3308, lo: 0x80, hi: 0x83},
 	{value: 0x3b08, lo: 0x84, hi: 0x85},
@@ -4300,7 +4455,7 @@ var idnaSparseValues = [2146]valueRange{
 	{value: 0x0008, lo: 0xa7, hi: 0xa8},
 	{value: 0x0040, lo: 0xa9, hi: 0xa9},
 	{value: 0x0008, lo: 0xaa, hi: 0xbf},
-	// Block 0xd5, offset 0x69a
+	// Block 0xd7, offset 0x6a4
 	{value: 0x0000, lo: 0x0d},
 	{value: 0x0008, lo: 0x80, hi: 0x89},
 	{value: 0x3008, lo: 0x8a, hi: 0x8e},
@@ -4315,7 +4470,7 @@ var idnaSparseValues = [2146]valueRange{
 	{value: 0x0040, lo: 0x99, hi: 0x9f},
 	{value: 0x0008, lo: 0xa0, hi: 0xa9},
 	{value: 0x0040, lo: 0xaa, hi: 0xbf},
-	// Block 0xd6, offset 0x6a8
+	// Block 0xd8, offset 0x6b2
 	{value: 0x0000, lo: 0x06},
 	{value: 0x0040, lo: 0x80, hi: 0x9f},
 	{value: 0x0008, lo: 0xa0, hi: 0xb2},
@@ -4323,41 +4478,41 @@ var idnaSparseValues = [2146]valueRange{
 	{value: 0x3008, lo: 0xb5, hi: 0xb6},
 	{value: 0x0018, lo: 0xb7, hi: 0xb8},
 	{value: 0x0040, lo: 0xb9, hi: 0xbf},
-	// Block 0xd7, offset 0x6af
+	// Block 0xd9, offset 0x6b9
 	{value: 0x0000, lo: 0x03},
 	{value: 0x0040, lo: 0x80, hi: 0xaf},
 	{value: 0x0008, lo: 0xb0, hi: 0xb0},
 	{value: 0x0040, lo: 0xb1, hi: 0xbf},
-	// Block 0xd8, offset 0x6b3
+	// Block 0xda, offset 0x6bd
 	{value: 0x0000, lo: 0x03},
 	{value: 0x0018, lo: 0x80, hi: 0xb1},
 	{value: 0x0040, lo: 0xb2, hi: 0xbe},
 	{value: 0x0018, lo: 0xbf, hi: 0xbf},
-	// Block 0xd9, offset 0x6b7
+	// Block 0xdb, offset 0x6c1
 	{value: 0x0000, lo: 0x02},
 	{value: 0x0008, lo: 0x80, hi: 0x99},
 	{value: 0x0040, lo: 0x9a, hi: 0xbf},
-	// Block 0xda, offset 0x6ba
+	// Block 0xdc, offset 0x6c4
 	{value: 0x0000, lo: 0x04},
 	{value: 0x0018, lo: 0x80, hi: 0xae},
 	{value: 0x0040, lo: 0xaf, hi: 0xaf},
 	{value: 0x0018, lo: 0xb0, hi: 0xb4},
 	{value: 0x0040, lo: 0xb5, hi: 0xbf},
-	// Block 0xdb, offset 0x6bf
+	// Block 0xdd, offset 0x6c9
 	{value: 0x0000, lo: 0x02},
 	{value: 0x0008, lo: 0x80, hi: 0x83},
 	{value: 0x0040, lo: 0x84, hi: 0xbf},
-	// Block 0xdc, offset 0x6c2
+	// Block 0xde, offset 0x6cc
 	{value: 0x0000, lo: 0x04},
 	{value: 0x0008, lo: 0x80, hi: 0xae},
 	{value: 0x0040, lo: 0xaf, hi: 0xaf},
 	{value: 0x0340, lo: 0xb0, hi: 0xb8},
 	{value: 0x0040, lo: 0xb9, hi: 0xbf},
-	// Block 0xdd, offset 0x6c7
+	// Block 0xdf, offset 0x6d1
 	{value: 0x0000, lo: 0x02},
 	{value: 0x0008, lo: 0x80, hi: 0x86},
 	{value: 0x0040, lo: 0x87, hi: 0xbf},
-	// Block 0xde, offset 0x6ca
+	// Block 0xe0, offset 0x6d4
 	{value: 0x0000, lo: 0x06},
 	{value: 0x0008, lo: 0x80, hi: 0x9e},
 	{value: 0x0040, lo: 0x9f, hi: 0x9f},
@@ -4365,7 +4520,7 @@ var idnaSparseValues = [2146]valueRange{
 	{value: 0x0040, lo: 0xaa, hi: 0xad},
 	{value: 0x0018, lo: 0xae, hi: 0xaf},
 	{value: 0x0040, lo: 0xb0, hi: 0xbf},
-	// Block 0xdf, offset 0x6d1
+	// Block 0xe1, offset 0x6db
 	{value: 0x0000, lo: 0x06},
 	{value: 0x0040, lo: 0x80, hi: 0x8f},
 	{value: 0x0008, lo: 0x90, hi: 0xad},
@@ -4373,12 +4528,12 @@ var idnaSparseValues = [2146]valueRange{
 	{value: 0x3308, lo: 0xb0, hi: 0xb4},
 	{value: 0x0018, lo: 0xb5, hi: 0xb5},
 	{value: 0x0040, lo: 0xb6, hi: 0xbf},
-	// Block 0xe0, offset 0x6d8
+	// Block 0xe2, offset 0x6e2
 	{value: 0x0000, lo: 0x03},
 	{value: 0x0008, lo: 0x80, hi: 0xaf},
 	{value: 0x3308, lo: 0xb0, hi: 0xb6},
 	{value: 0x0018, lo: 0xb7, hi: 0xbf},
-	// Block 0xe1, offset 0x6dc
+	// Block 0xe3, offset 0x6e6
 	{value: 0x0000, lo: 0x0a},
 	{value: 0x0008, lo: 0x80, hi: 0x83},
 	{value: 0x0018, lo: 0x84, hi: 0x85},
@@ -4390,33 +4545,33 @@ var idnaSparseValues = [2146]valueRange{
 	{value: 0x0008, lo: 0xa3, hi: 0xb7},
 	{value: 0x0040, lo: 0xb8, hi: 0xbc},
 	{value: 0x0008, lo: 0xbd, hi: 0xbf},
-	// Block 0xe2, offset 0x6e7
+	// Block 0xe4, offset 0x6f1
 	{value: 0x0000, lo: 0x02},
 	{value: 0x0008, lo: 0x80, hi: 0x8f},
 	{value: 0x0040, lo: 0x90, hi: 0xbf},
-	// Block 0xe3, offset 0x6ea
+	// Block 0xe5, offset 0x6f4
 	{value: 0x0000, lo: 0x02},
 	{value: 0xe105, lo: 0x80, hi: 0x9f},
 	{value: 0x0008, lo: 0xa0, hi: 0xbf},
-	// Block 0xe4, offset 0x6ed
+	// Block 0xe6, offset 0x6f7
 	{value: 0x0000, lo: 0x02},
 	{value: 0x0018, lo: 0x80, hi: 0x9a},
 	{value: 0x0040, lo: 0x9b, hi: 0xbf},
-	// Block 0xe5, offset 0x6f0
+	// Block 0xe7, offset 0x6fa
 	{value: 0x0000, lo: 0x05},
 	{value: 0x0008, lo: 0x80, hi: 0x8a},
 	{value: 0x0040, lo: 0x8b, hi: 0x8e},
 	{value: 0x3308, lo: 0x8f, hi: 0x8f},
 	{value: 0x0008, lo: 0x90, hi: 0x90},
 	{value: 0x3008, lo: 0x91, hi: 0xbf},
-	// Block 0xe6, offset 0x6f6
+	// Block 0xe8, offset 0x700
 	{value: 0x0000, lo: 0x05},
 	{value: 0x3008, lo: 0x80, hi: 0x87},
 	{value: 0x0040, lo: 0x88, hi: 0x8e},
 	{value: 0x3308, lo: 0x8f, hi: 0x92},
 	{value: 0x0008, lo: 0x93, hi: 0x9f},
 	{value: 0x0040, lo: 0xa0, hi: 0xbf},
-	// Block 0xe7, offset 0x6fc
+	// Block 0xe9, offset 0x706
 	{value: 0x0000, lo: 0x08},
 	{value: 0x0040, lo: 0x80, hi: 0x9f},
 	{value: 0x0008, lo: 0xa0, hi: 0xa1},
@@ -4426,23 +4581,23 @@ var idnaSparseValues = [2146]valueRange{
 	{value: 0x0040, lo: 0xa5, hi: 0xaf},
 	{value: 0x3008, lo: 0xb0, hi: 0xb1},
 	{value: 0x0040, lo: 0xb2, hi: 0xbf},
-	// Block 0xe8, offset 0x705
+	// Block 0xea, offset 0x70f
 	{value: 0x0000, lo: 0x02},
 	{value: 0x0008, lo: 0x80, hi: 0xb7},
 	{value: 0x0040, lo: 0xb8, hi: 0xbf},
-	// Block 0xe9, offset 0x708
+	// Block 0xeb, offset 0x712
 	{value: 0x0000, lo: 0x02},
 	{value: 0x0008, lo: 0x80, hi: 0x95},
 	{value: 0x0040, lo: 0x96, hi: 0xbf},
-	// Block 0xea, offset 0x70b
+	// Block 0xec, offset 0x715
 	{value: 0x0000, lo: 0x02},
 	{value: 0x0008, lo: 0x80, hi: 0x88},
 	{value: 0x0040, lo: 0x89, hi: 0xbf},
-	// Block 0xeb, offset 0x70e
+	// Block 0xed, offset 0x718
 	{value: 0x0000, lo: 0x02},
 	{value: 0x0008, lo: 0x80, hi: 0x9e},
 	{value: 0x0040, lo: 0x9f, hi: 0xbf},
-	// Block 0xec, offset 0x711
+	// Block 0xee, offset 0x71b
 	{value: 0x0000, lo: 0x06},
 	{value: 0x0040, lo: 0x80, hi: 0x8f},
 	{value: 0x0008, lo: 0x90, hi: 0x92},
@@ -4450,17 +4605,17 @@ var idnaSparseValues = [2146]valueRange{
 	{value: 0x0008, lo: 0xa4, hi: 0xa7},
 	{value: 0x0040, lo: 0xa8, hi: 0xaf},
 	{value: 0x0008, lo: 0xb0, hi: 0xbf},
-	// Block 0xed, offset 0x718
+	// Block 0xef, offset 0x722
 	{value: 0x0000, lo: 0x02},
 	{value: 0x0008, lo: 0x80, hi: 0xbb},
 	{value: 0x0040, lo: 0xbc, hi: 0xbf},
-	// Block 0xee, offset 0x71b
+	// Block 0xf0, offset 0x725
 	{value: 0x0000, lo: 0x04},
 	{value: 0x0008, lo: 0x80, hi: 0xaa},
 	{value: 0x0040, lo: 0xab, hi: 0xaf},
 	{value: 0x0008, lo: 0xb0, hi: 0xbc},
 	{value: 0x0040, lo: 0xbd, hi: 0xbf},
-	// Block 0xef, offset 0x720
+	// Block 0xf1, offset 0x72a
 	{value: 0x0000, lo: 0x09},
 	{value: 0x0008, lo: 0x80, hi: 0x88},
 	{value: 0x0040, lo: 0x89, hi: 0x8f},
@@ -4471,32 +4626,32 @@ var idnaSparseValues = [2146]valueRange{
 	{value: 0x0018, lo: 0x9f, hi: 0x9f},
 	{value: 0x03c0, lo: 0xa0, hi: 0xa3},
 	{value: 0x0040, lo: 0xa4, hi: 0xbf},
-	// Block 0xf0, offset 0x72a
+	// Block 0xf2, offset 0x734
 	{value: 0x0000, lo: 0x02},
 	{value: 0x0018, lo: 0x80, hi: 0xb5},
 	{value: 0x0040, lo: 0xb6, hi: 0xbf},
-	// Block 0xf1, offset 0x72d
+	// Block 0xf3, offset 0x737
 	{value: 0x0000, lo: 0x03},
 	{value: 0x0018, lo: 0x80, hi: 0xa6},
 	{value: 0x0040, lo: 0xa7, hi: 0xa8},
 	{value: 0x0018, lo: 0xa9, hi: 0xbf},
-	// Block 0xf2, offset 0x731
+	// Block 0xf4, offset 0x73b
 	{value: 0x0000, lo: 0x0e},
 	{value: 0x0018, lo: 0x80, hi: 0x9d},
-	{value: 0xb609, lo: 0x9e, hi: 0x9e},
-	{value: 0xb651, lo: 0x9f, hi: 0x9f},
-	{value: 0xb699, lo: 0xa0, hi: 0xa0},
-	{value: 0xb701, lo: 0xa1, hi: 0xa1},
-	{value: 0xb769, lo: 0xa2, hi: 0xa2},
-	{value: 0xb7d1, lo: 0xa3, hi: 0xa3},
-	{value: 0xb839, lo: 0xa4, hi: 0xa4},
+	{value: 0x2211, lo: 0x9e, hi: 0x9e},
+	{value: 0x2219, lo: 0x9f, hi: 0x9f},
+	{value: 0x2221, lo: 0xa0, hi: 0xa0},
+	{value: 0x2229, lo: 0xa1, hi: 0xa1},
+	{value: 0x2231, lo: 0xa2, hi: 0xa2},
+	{value: 0x2239, lo: 0xa3, hi: 0xa3},
+	{value: 0x2241, lo: 0xa4, hi: 0xa4},
 	{value: 0x3018, lo: 0xa5, hi: 0xa6},
 	{value: 0x3318, lo: 0xa7, hi: 0xa9},
 	{value: 0x0018, lo: 0xaa, hi: 0xac},
 	{value: 0x3018, lo: 0xad, hi: 0xb2},
 	{value: 0x0340, lo: 0xb3, hi: 0xba},
 	{value: 0x3318, lo: 0xbb, hi: 0xbf},
-	// Block 0xf3, offset 0x740
+	// Block 0xf5, offset 0x74a
 	{value: 0x0000, lo: 0x0b},
 	{value: 0x3318, lo: 0x80, hi: 0x82},
 	{value: 0x0018, lo: 0x83, hi: 0x84},
@@ -4504,45 +4659,45 @@ var idnaSparseValues = [2146]valueRange{
 	{value: 0x0018, lo: 0x8c, hi: 0xa9},
 	{value: 0x3318, lo: 0xaa, hi: 0xad},
 	{value: 0x0018, lo: 0xae, hi: 0xba},
-	{value: 0xb8a1, lo: 0xbb, hi: 0xbb},
-	{value: 0xb8e9, lo: 0xbc, hi: 0xbc},
-	{value: 0xb931, lo: 0xbd, hi: 0xbd},
-	{value: 0xb999, lo: 0xbe, hi: 0xbe},
-	{value: 0xba01, lo: 0xbf, hi: 0xbf},
-	// Block 0xf4, offset 0x74c
+	{value: 0x2249, lo: 0xbb, hi: 0xbb},
+	{value: 0x2251, lo: 0xbc, hi: 0xbc},
+	{value: 0x2259, lo: 0xbd, hi: 0xbd},
+	{value: 0x2261, lo: 0xbe, hi: 0xbe},
+	{value: 0x2269, lo: 0xbf, hi: 0xbf},
+	// Block 0xf6, offset 0x756
 	{value: 0x0000, lo: 0x03},
-	{value: 0xba69, lo: 0x80, hi: 0x80},
+	{value: 0x2271, lo: 0x80, hi: 0x80},
 	{value: 0x0018, lo: 0x81, hi: 0xa8},
 	{value: 0x0040, lo: 0xa9, hi: 0xbf},
-	// Block 0xf5, offset 0x750
+	// Block 0xf7, offset 0x75a
 	{value: 0x0000, lo: 0x04},
 	{value: 0x0018, lo: 0x80, hi: 0x81},
 	{value: 0x3318, lo: 0x82, hi: 0x84},
 	{value: 0x0018, lo: 0x85, hi: 0x85},
 	{value: 0x0040, lo: 0x86, hi: 0xbf},
-	// Block 0xf6, offset 0x755
+	// Block 0xf8, offset 0x75f
 	{value: 0x0000, lo: 0x03},
 	{value: 0x0040, lo: 0x80, hi: 0x9f},
 	{value: 0x0018, lo: 0xa0, hi: 0xb3},
 	{value: 0x0040, lo: 0xb4, hi: 0xbf},
-	// Block 0xf7, offset 0x759
+	// Block 0xf9, offset 0x763
 	{value: 0x0000, lo: 0x04},
 	{value: 0x0018, lo: 0x80, hi: 0x96},
 	{value: 0x0040, lo: 0x97, hi: 0x9f},
 	{value: 0x0018, lo: 0xa0, hi: 0xb8},
 	{value: 0x0040, lo: 0xb9, hi: 0xbf},
-	// Block 0xf8, offset 0x75e
+	// Block 0xfa, offset 0x768
 	{value: 0x0000, lo: 0x03},
 	{value: 0x3308, lo: 0x80, hi: 0xb6},
 	{value: 0x0018, lo: 0xb7, hi: 0xba},
 	{value: 0x3308, lo: 0xbb, hi: 0xbf},
-	// Block 0xf9, offset 0x762
+	// Block 0xfb, offset 0x76c
 	{value: 0x0000, lo: 0x04},
 	{value: 0x3308, lo: 0x80, hi: 0xac},
 	{value: 0x0018, lo: 0xad, hi: 0xb4},
 	{value: 0x3308, lo: 0xb5, hi: 0xb5},
 	{value: 0x0018, lo: 0xb6, hi: 0xbf},
-	// Block 0xfa, offset 0x767
+	// Block 0xfc, offset 0x771
 	{value: 0x0000, lo: 0x08},
 	{value: 0x0018, lo: 0x80, hi: 0x83},
 	{value: 0x3308, lo: 0x84, hi: 0x84},
@@ -4552,7 +4707,7 @@ var idnaSparseValues = [2146]valueRange{
 	{value: 0x0040, lo: 0xa0, hi: 0xa0},
 	{value: 0x3308, lo: 0xa1, hi: 0xaf},
 	{value: 0x0040, lo: 0xb0, hi: 0xbf},
-	// Block 0xfb, offset 0x770
+	// Block 0xfd, offset 0x77a
 	{value: 0x0000, lo: 0x0a},
 	{value: 0x3308, lo: 0x80, hi: 0x86},
 	{value: 0x0040, lo: 0x87, hi: 0x87},
@@ -4564,35 +4719,35 @@ var idnaSparseValues = [2146]valueRange{
 	{value: 0x0040, lo: 0xa5, hi: 0xa5},
 	{value: 0x3308, lo: 0xa6, hi: 0xaa},
 	{value: 0x0040, lo: 0xab, hi: 0xbf},
-	// Block 0xfc, offset 0x77b
+	// Block 0xfe, offset 0x785
 	{value: 0x0000, lo: 0x05},
 	{value: 0x0008, lo: 0x80, hi: 0xac},
 	{value: 0x0040, lo: 0xad, hi: 0xaf},
 	{value: 0x3308, lo: 0xb0, hi: 0xb6},
 	{value: 0x0008, lo: 0xb7, hi: 0xbd},
 	{value: 0x0040, lo: 0xbe, hi: 0xbf},
-	// Block 0xfd, offset 0x781
+	// Block 0xff, offset 0x78b
 	{value: 0x0000, lo: 0x05},
 	{value: 0x0008, lo: 0x80, hi: 0x89},
 	{value: 0x0040, lo: 0x8a, hi: 0x8d},
 	{value: 0x0008, lo: 0x8e, hi: 0x8e},
 	{value: 0x0018, lo: 0x8f, hi: 0x8f},
 	{value: 0x0040, lo: 0x90, hi: 0xbf},
-	// Block 0xfe, offset 0x787
+	// Block 0x100, offset 0x791
 	{value: 0x0000, lo: 0x05},
 	{value: 0x0008, lo: 0x80, hi: 0xab},
 	{value: 0x3308, lo: 0xac, hi: 0xaf},
 	{value: 0x0008, lo: 0xb0, hi: 0xb9},
 	{value: 0x0040, lo: 0xba, hi: 0xbe},
 	{value: 0x0018, lo: 0xbf, hi: 0xbf},
-	// Block 0xff, offset 0x78d
+	// Block 0x101, offset 0x797
 	{value: 0x0000, lo: 0x05},
 	{value: 0x0808, lo: 0x80, hi: 0x84},
 	{value: 0x0040, lo: 0x85, hi: 0x86},
 	{value: 0x0818, lo: 0x87, hi: 0x8f},
 	{value: 0x3308, lo: 0x90, hi: 0x96},
 	{value: 0x0040, lo: 0x97, hi: 0xbf},
-	// Block 0x100, offset 0x793
+	// Block 0x102, offset 0x79d
 	{value: 0x0000, lo: 0x08},
 	{value: 0x0a08, lo: 0x80, hi: 0x83},
 	{value: 0x3308, lo: 0x84, hi: 0x8a},
@@ -4602,71 +4757,71 @@ var idnaSparseValues = [2146]valueRange{
 	{value: 0x0040, lo: 0x9a, hi: 0x9d},
 	{value: 0x0818, lo: 0x9e, hi: 0x9f},
 	{value: 0x0040, lo: 0xa0, hi: 0xbf},
-	// Block 0x101, offset 0x79c
+	// Block 0x103, offset 0x7a6
 	{value: 0x0000, lo: 0x02},
 	{value: 0x0040, lo: 0x80, hi: 0xb0},
 	{value: 0x0818, lo: 0xb1, hi: 0xbf},
-	// Block 0x102, offset 0x79f
+	// Block 0x104, offset 0x7a9
 	{value: 0x0000, lo: 0x02},
 	{value: 0x0818, lo: 0x80, hi: 0xb4},
 	{value: 0x0040, lo: 0xb5, hi: 0xbf},
-	// Block 0x103, offset 0x7a2
+	// Block 0x105, offset 0x7ac
 	{value: 0x0000, lo: 0x03},
 	{value: 0x0040, lo: 0x80, hi: 0x80},
 	{value: 0x0818, lo: 0x81, hi: 0xbd},
 	{value: 0x0040, lo: 0xbe, hi: 0xbf},
-	// Block 0x104, offset 0x7a6
+	// Block 0x106, offset 0x7b0
 	{value: 0x0000, lo: 0x03},
 	{value: 0x0040, lo: 0x80, hi: 0xaf},
 	{value: 0x0018, lo: 0xb0, hi: 0xb1},
 	{value: 0x0040, lo: 0xb2, hi: 0xbf},
-	// Block 0x105, offset 0x7aa
+	// Block 0x107, offset 0x7b4
 	{value: 0x0000, lo: 0x03},
 	{value: 0x0018, lo: 0x80, hi: 0xab},
 	{value: 0x0040, lo: 0xac, hi: 0xaf},
 	{value: 0x0018, lo: 0xb0, hi: 0xbf},
-	// Block 0x106, offset 0x7ae
+	// Block 0x108, offset 0x7b8
 	{value: 0x0000, lo: 0x05},
 	{value: 0x0018, lo: 0x80, hi: 0x93},
 	{value: 0x0040, lo: 0x94, hi: 0x9f},
 	{value: 0x0018, lo: 0xa0, hi: 0xae},
 	{value: 0x0040, lo: 0xaf, hi: 0xb0},
 	{value: 0x0018, lo: 0xb1, hi: 0xbf},
-	// Block 0x107, offset 0x7b4
+	// Block 0x109, offset 0x7be
 	{value: 0x0000, lo: 0x05},
 	{value: 0x0040, lo: 0x80, hi: 0x80},
 	{value: 0x0018, lo: 0x81, hi: 0x8f},
 	{value: 0x0040, lo: 0x90, hi: 0x90},
 	{value: 0x0018, lo: 0x91, hi: 0xb5},
 	{value: 0x0040, lo: 0xb6, hi: 0xbf},
-	// Block 0x108, offset 0x7ba
+	// Block 0x10a, offset 0x7c4
 	{value: 0x0000, lo: 0x04},
 	{value: 0x0018, lo: 0x80, hi: 0x8f},
-	{value: 0xc229, lo: 0x90, hi: 0x90},
+	{value: 0x2491, lo: 0x90, hi: 0x90},
 	{value: 0x0018, lo: 0x91, hi: 0xad},
 	{value: 0x0040, lo: 0xae, hi: 0xbf},
-	// Block 0x109, offset 0x7bf
+	// Block 0x10b, offset 0x7c9
 	{value: 0x0000, lo: 0x02},
 	{value: 0x0040, lo: 0x80, hi: 0xa5},
 	{value: 0x0018, lo: 0xa6, hi: 0xbf},
-	// Block 0x10a, offset 0x7c2
+	// Block 0x10c, offset 0x7cc
 	{value: 0x0000, lo: 0x0f},
-	{value: 0xc851, lo: 0x80, hi: 0x80},
-	{value: 0xc8a1, lo: 0x81, hi: 0x81},
-	{value: 0xc8f1, lo: 0x82, hi: 0x82},
-	{value: 0xc941, lo: 0x83, hi: 0x83},
-	{value: 0xc991, lo: 0x84, hi: 0x84},
-	{value: 0xc9e1, lo: 0x85, hi: 0x85},
-	{value: 0xca31, lo: 0x86, hi: 0x86},
-	{value: 0xca81, lo: 0x87, hi: 0x87},
-	{value: 0xcad1, lo: 0x88, hi: 0x88},
+	{value: 0x2611, lo: 0x80, hi: 0x80},
+	{value: 0x2619, lo: 0x81, hi: 0x81},
+	{value: 0x2621, lo: 0x82, hi: 0x82},
+	{value: 0x2629, lo: 0x83, hi: 0x83},
+	{value: 0x2631, lo: 0x84, hi: 0x84},
+	{value: 0x2639, lo: 0x85, hi: 0x85},
+	{value: 0x2641, lo: 0x86, hi: 0x86},
+	{value: 0x2649, lo: 0x87, hi: 0x87},
+	{value: 0x2651, lo: 0x88, hi: 0x88},
 	{value: 0x0040, lo: 0x89, hi: 0x8f},
-	{value: 0xcb21, lo: 0x90, hi: 0x90},
-	{value: 0xcb41, lo: 0x91, hi: 0x91},
+	{value: 0x2659, lo: 0x90, hi: 0x90},
+	{value: 0x2661, lo: 0x91, hi: 0x91},
 	{value: 0x0040, lo: 0x92, hi: 0x9f},
 	{value: 0x0018, lo: 0xa0, hi: 0xa5},
 	{value: 0x0040, lo: 0xa6, hi: 0xbf},
-	// Block 0x10b, offset 0x7d2
+	// Block 0x10d, offset 0x7dc
 	{value: 0x0000, lo: 0x06},
 	{value: 0x0018, lo: 0x80, hi: 0x97},
 	{value: 0x0040, lo: 0x98, hi: 0x9f},
@@ -4674,29 +4829,29 @@ var idnaSparseValues = [2146]valueRange{
 	{value: 0x0040, lo: 0xad, hi: 0xaf},
 	{value: 0x0018, lo: 0xb0, hi: 0xbc},
 	{value: 0x0040, lo: 0xbd, hi: 0xbf},
-	// Block 0x10c, offset 0x7d9
+	// Block 0x10e, offset 0x7e3
 	{value: 0x0000, lo: 0x02},
 	{value: 0x0018, lo: 0x80, hi: 0xb3},
 	{value: 0x0040, lo: 0xb4, hi: 0xbf},
-	// Block 0x10d, offset 0x7dc
+	// Block 0x10f, offset 0x7e6
 	{value: 0x0000, lo: 0x04},
 	{value: 0x0018, lo: 0x80, hi: 0x98},
 	{value: 0x0040, lo: 0x99, hi: 0x9f},
 	{value: 0x0018, lo: 0xa0, hi: 0xab},
 	{value: 0x0040, lo: 0xac, hi: 0xbf},
-	// Block 0x10e, offset 0x7e1
+	// Block 0x110, offset 0x7eb
 	{value: 0x0000, lo: 0x03},
 	{value: 0x0018, lo: 0x80, hi: 0x8b},
 	{value: 0x0040, lo: 0x8c, hi: 0x8f},
 	{value: 0x0018, lo: 0x90, hi: 0xbf},
-	// Block 0x10f, offset 0x7e5
+	// Block 0x111, offset 0x7ef
 	{value: 0x0000, lo: 0x05},
 	{value: 0x0018, lo: 0x80, hi: 0x87},
 	{value: 0x0040, lo: 0x88, hi: 0x8f},
 	{value: 0x0018, lo: 0x90, hi: 0x99},
 	{value: 0x0040, lo: 0x9a, hi: 0x9f},
 	{value: 0x0018, lo: 0xa0, hi: 0xbf},
-	// Block 0x110, offset 0x7eb
+	// Block 0x112, offset 0x7f5
 	{value: 0x0000, lo: 0x06},
 	{value: 0x0018, lo: 0x80, hi: 0x87},
 	{value: 0x0040, lo: 0x88, hi: 0x8f},
@@ -4704,17 +4859,17 @@ var idnaSparseValues = [2146]valueRange{
 	{value: 0x0040, lo: 0xae, hi: 0xaf},
 	{value: 0x0018, lo: 0xb0, hi: 0xb1},
 	{value: 0x0040, lo: 0xb2, hi: 0xbf},
-	// Block 0x111, offset 0x7f2
+	// Block 0x113, offset 0x7fc
 	{value: 0x0000, lo: 0x03},
 	{value: 0x0018, lo: 0x80, hi: 0xb8},
 	{value: 0x0040, lo: 0xb9, hi: 0xb9},
 	{value: 0x0018, lo: 0xba, hi: 0xbf},
-	// Block 0x112, offset 0x7f6
+	// Block 0x114, offset 0x800
 	{value: 0x0000, lo: 0x03},
 	{value: 0x0018, lo: 0x80, hi: 0x8b},
 	{value: 0x0040, lo: 0x8c, hi: 0x8c},
 	{value: 0x0018, lo: 0x8d, hi: 0xbf},
-	// Block 0x113, offset 0x7fa
+	// Block 0x115, offset 0x804
 	{value: 0x0000, lo: 0x08},
 	{value: 0x0018, lo: 0x80, hi: 0x93},
 	{value: 0x0040, lo: 0x94, hi: 0x9f},
@@ -4724,7 +4879,7 @@ var idnaSparseValues = [2146]valueRange{
 	{value: 0x0040, lo: 0xb5, hi: 0xb7},
 	{value: 0x0018, lo: 0xb8, hi: 0xba},
 	{value: 0x0040, lo: 0xbb, hi: 0xbf},
-	// Block 0x114, offset 0x803
+	// Block 0x116, offset 0x80d
 	{value: 0x0000, lo: 0x06},
 	{value: 0x0018, lo: 0x80, hi: 0x86},
 	{value: 0x0040, lo: 0x87, hi: 0x8f},
@@ -4732,109 +4887,74 @@ var idnaSparseValues = [2146]valueRange{
 	{value: 0x0040, lo: 0xa9, hi: 0xaf},
 	{value: 0x0018, lo: 0xb0, hi: 0xb6},
 	{value: 0x0040, lo: 0xb7, hi: 0xbf},
-	// Block 0x115, offset 0x80a
+	// Block 0x117, offset 0x814
 	{value: 0x0000, lo: 0x04},
 	{value: 0x0018, lo: 0x80, hi: 0x82},
 	{value: 0x0040, lo: 0x83, hi: 0x8f},
 	{value: 0x0018, lo: 0x90, hi: 0x96},
 	{value: 0x0040, lo: 0x97, hi: 0xbf},
-	// Block 0x116, offset 0x80f
+	// Block 0x118, offset 0x819
 	{value: 0x0000, lo: 0x03},
 	{value: 0x0018, lo: 0x80, hi: 0x92},
 	{value: 0x0040, lo: 0x93, hi: 0x93},
 	{value: 0x0018, lo: 0x94, hi: 0xbf},
-	// Block 0x117, offset 0x813
+	// Block 0x119, offset 0x81d
 	{value: 0x0000, lo: 0x0d},
 	{value: 0x0018, lo: 0x80, hi: 0x8a},
 	{value: 0x0040, lo: 0x8b, hi: 0xaf},
-	{value: 0x1f41, lo: 0xb0, hi: 0xb0},
-	{value: 0x00c9, lo: 0xb1, hi: 0xb1},
-	{value: 0x0069, lo: 0xb2, hi: 0xb2},
-	{value: 0x0079, lo: 0xb3, hi: 0xb3},
-	{value: 0x1f51, lo: 0xb4, hi: 0xb4},
-	{value: 0x1f61, lo: 0xb5, hi: 0xb5},
-	{value: 0x1f71, lo: 0xb6, hi: 0xb6},
-	{value: 0x1f81, lo: 0xb7, hi: 0xb7},
-	{value: 0x1f91, lo: 0xb8, hi: 0xb8},
-	{value: 0x1fa1, lo: 0xb9, hi: 0xb9},
+	{value: 0x06e1, lo: 0xb0, hi: 0xb0},
+	{value: 0x0049, lo: 0xb1, hi: 0xb1},
+	{value: 0x0029, lo: 0xb2, hi: 0xb2},
+	{value: 0x0031, lo: 0xb3, hi: 0xb3},
+	{value: 0x06e9, lo: 0xb4, hi: 0xb4},
+	{value: 0x06f1, lo: 0xb5, hi: 0xb5},
+	{value: 0x06f9, lo: 0xb6, hi: 0xb6},
+	{value: 0x0701, lo: 0xb7, hi: 0xb7},
+	{value: 0x0709, lo: 0xb8, hi: 0xb8},
+	{value: 0x0711, lo: 0xb9, hi: 0xb9},
 	{value: 0x0040, lo: 0xba, hi: 0xbf},
-	// Block 0x118, offset 0x821
+	// Block 0x11a, offset 0x82b
 	{value: 0x0000, lo: 0x02},
 	{value: 0x0008, lo: 0x80, hi: 0x9d},
 	{value: 0x0040, lo: 0x9e, hi: 0xbf},
-	// Block 0x119, offset 0x824
+	// Block 0x11b, offset 0x82e
 	{value: 0x0000, lo: 0x02},
 	{value: 0x0008, lo: 0x80, hi: 0xb4},
 	{value: 0x0040, lo: 0xb5, hi: 0xbf},
-	// Block 0x11a, offset 0x827
+	// Block 0x11c, offset 0x831
 	{value: 0x0000, lo: 0x03},
 	{value: 0x0008, lo: 0x80, hi: 0x9d},
 	{value: 0x0040, lo: 0x9e, hi: 0x9f},
 	{value: 0x0008, lo: 0xa0, hi: 0xbf},
-	// Block 0x11b, offset 0x82b
+	// Block 0x11d, offset 0x835
 	{value: 0x0000, lo: 0x03},
 	{value: 0x0008, lo: 0x80, hi: 0xa1},
 	{value: 0x0040, lo: 0xa2, hi: 0xaf},
 	{value: 0x0008, lo: 0xb0, hi: 0xbf},
-	// Block 0x11c, offset 0x82f
+	// Block 0x11e, offset 0x839
 	{value: 0x0000, lo: 0x02},
 	{value: 0x0008, lo: 0x80, hi: 0xa0},
 	{value: 0x0040, lo: 0xa1, hi: 0xbf},
-	// Block 0x11d, offset 0x832
-	{value: 0x0020, lo: 0x0f},
-	{value: 0xdf21, lo: 0x80, hi: 0x89},
-	{value: 0x8e35, lo: 0x8a, hi: 0x8a},
-	{value: 0xe061, lo: 0x8b, hi: 0x9c},
-	{value: 0x8e55, lo: 0x9d, hi: 0x9d},
-	{value: 0xe2a1, lo: 0x9e, hi: 0xa2},
-	{value: 0x8e75, lo: 0xa3, hi: 0xa3},
-	{value: 0xe341, lo: 0xa4, hi: 0xab},
-	{value: 0x7f0d, lo: 0xac, hi: 0xac},
-	{value: 0xe441, lo: 0xad, hi: 0xaf},
-	{value: 0x8e95, lo: 0xb0, hi: 0xb0},
-	{value: 0xe4a1, lo: 0xb1, hi: 0xb6},
-	{value: 0x8eb5, lo: 0xb7, hi: 0xb9},
-	{value: 0xe561, lo: 0xba, hi: 0xba},
-	{value: 0x8f15, lo: 0xbb, hi: 0xbb},
-	{value: 0xe581, lo: 0xbc, hi: 0xbf},
-	// Block 0x11e, offset 0x842
-	{value: 0x0020, lo: 0x10},
-	{value: 0x93b5, lo: 0x80, hi: 0x80},
-	{value: 0xf101, lo: 0x81, hi: 0x86},
-	{value: 0x93d5, lo: 0x87, hi: 0x8a},
-	{value: 0xda61, lo: 0x8b, hi: 0x8b},
-	{value: 0xf1c1, lo: 0x8c, hi: 0x96},
-	{value: 0x9455, lo: 0x97, hi: 0x97},
-	{value: 0xf321, lo: 0x98, hi: 0xa3},
-	{value: 0x9475, lo: 0xa4, hi: 0xa6},
-	{value: 0xf4a1, lo: 0xa7, hi: 0xaa},
-	{value: 0x94d5, lo: 0xab, hi: 0xab},
-	{value: 0xf521, lo: 0xac, hi: 0xac},
-	{value: 0x94f5, lo: 0xad, hi: 0xad},
-	{value: 0xf541, lo: 0xae, hi: 0xaf},
-	{value: 0x9515, lo: 0xb0, hi: 0xb1},
-	{value: 0xf581, lo: 0xb2, hi: 0xbe},
-	{value: 0x2040, lo: 0xbf, hi: 0xbf},
-	// Block 0x11f, offset 0x853
+	// Block 0x11f, offset 0x83c
 	{value: 0x0000, lo: 0x02},
 	{value: 0x0008, lo: 0x80, hi: 0x8a},
 	{value: 0x0040, lo: 0x8b, hi: 0xbf},
-	// Block 0x120, offset 0x856
+	// Block 0x120, offset 0x83f
 	{value: 0x0000, lo: 0x04},
 	{value: 0x0040, lo: 0x80, hi: 0x80},
 	{value: 0x0340, lo: 0x81, hi: 0x81},
 	{value: 0x0040, lo: 0x82, hi: 0x9f},
 	{value: 0x0340, lo: 0xa0, hi: 0xbf},
-	// Block 0x121, offset 0x85b
+	// Block 0x121, offset 0x844
 	{value: 0x0000, lo: 0x01},
 	{value: 0x0340, lo: 0x80, hi: 0xbf},
-	// Block 0x122, offset 0x85d
+	// Block 0x122, offset 0x846
 	{value: 0x0000, lo: 0x01},
 	{value: 0x33c0, lo: 0x80, hi: 0xbf},
-	// Block 0x123, offset 0x85f
+	// Block 0x123, offset 0x848
 	{value: 0x0000, lo: 0x02},
 	{value: 0x33c0, lo: 0x80, hi: 0xaf},
 	{value: 0x0040, lo: 0xb0, hi: 0xbf},
 }
 
-// Total table size 43370 bytes (42KiB); checksum: EBD909C0
+// Total table size 44953 bytes (43KiB); checksum: D51909DD
diff --git a/.ci/providerlint/vendor/golang.org/x/net/idna/tables15.0.0.go b/.ci/providerlint/vendor/golang.org/x/net/idna/tables15.0.0.go
new file mode 100644
index 00000000000..40033778f01
--- /dev/null
+++ b/.ci/providerlint/vendor/golang.org/x/net/idna/tables15.0.0.go
@@ -0,0 +1,5145 @@
+// Code generated by running "go generate" in golang.org/x/text. DO NOT EDIT.
+
+//go:build go1.21
+// +build go1.21
+
+package idna
+
+// UnicodeVersion is the Unicode version from which the tables in this package are derived.
+const UnicodeVersion = "15.0.0"
+
+var mappings string = "" + // Size: 6704 bytes
+	"  ̈a ̄23 ́ ̧1o1⁄41⁄23⁄4i̇l·ʼnsdžⱥⱦhjrwy ̆ ̇ ̊ ̨ ̃ ̋lẍ́ ι; ̈́եւاٴوٴۇٴيٴक" +
+	"़ख़ग़ज़ड़ढ़फ़य़ড়ঢ়য়ਲ਼ਸ਼ਖ਼ਗ਼ਜ਼ਫ਼ଡ଼ଢ଼ําໍາຫນຫມགྷཌྷདྷབྷཛྷཀྵཱཱིུྲྀྲཱྀླྀླཱ" +
+	"ཱྀྀྒྷྜྷྡྷྦྷྫྷྐྵвдостъѣæbdeǝgikmnȣptuɐɑəɛɜŋɔɯvβγδφχρнɒcɕðfɟɡɥɨɩɪʝɭʟɱɰɲɳ" +
+	"ɴɵɸʂʃƫʉʊʋʌzʐʑʒθssάέήίόύώἀιἁιἂιἃιἄιἅιἆιἇιἠιἡιἢιἣιἤιἥιἦιἧιὠιὡιὢιὣιὤιὥιὦιὧ" +
+	"ιὰιαιάιᾶιι ̈͂ὴιηιήιῆι ̓̀ ̓́ ̓͂ΐ ̔̀ ̔́ ̔͂ΰ ̈̀`ὼιωιώιῶι′′′′′‵‵‵‵‵!!???!!?" +
+	"′′′′0456789+=()rsħnoqsmtmωåאבגדπ1⁄71⁄91⁄101⁄32⁄31⁄52⁄53⁄54⁄51⁄65⁄61⁄83" +
+	"⁄85⁄87⁄81⁄iiivviviiiixxi0⁄3∫∫∫∫∫∮∮∮∮∮1011121314151617181920(10)(11)(12" +
+	")(13)(14)(15)(16)(17)(18)(19)(20)∫∫∫∫==⫝̸ɫɽȿɀ. ゙ ゚よりコト(ᄀ)(ᄂ)(ᄃ)(ᄅ)(ᄆ)(ᄇ)" +
+	"(ᄉ)(ᄋ)(ᄌ)(ᄎ)(ᄏ)(ᄐ)(ᄑ)(ᄒ)(가)(나)(다)(라)(마)(바)(사)(아)(자)(차)(카)(타)(파)(하)(주)(오전" +
+	")(오후)(一)(二)(三)(四)(五)(六)(七)(八)(九)(十)(月)(火)(水)(木)(金)(土)(日)(株)(有)(社)(名)(特)(" +
+	"財)(祝)(労)(代)(呼)(学)(監)(企)(資)(協)(祭)(休)(自)(至)21222324252627282930313233343" +
+	"5참고주의3637383940414243444546474849501月2月3月4月5月6月7月8月9月10月11月12月hgev令和アパート" +
+	"アルファアンペアアールイニングインチウォンエスクードエーカーオンスオームカイリカラットカロリーガロンガンマギガギニーキュリーギルダーキロキロ" +
+	"グラムキロメートルキロワットグラムグラムトンクルゼイロクローネケースコルナコーポサイクルサンチームシリングセンチセントダースデシドルトンナノ" +
+	"ノットハイツパーセントパーツバーレルピアストルピクルピコビルファラッドフィートブッシェルフランヘクタールペソペニヒヘルツペンスページベータポ" +
+	"イントボルトホンポンドホールホーンマイクロマイルマッハマルクマンションミクロンミリミリバールメガメガトンメートルヤードヤールユアンリットルリ" +
+	"ラルピールーブルレムレントゲンワット0点1点2点3点4点5点6点7点8点9点10点11点12点13点14点15点16点17点18点19点20" +
+	"点21点22点23点24点daauovpcdmiu平成昭和大正明治株式会社panamakakbmbgbkcalpfnfmgkghzmldlk" +
+	"lfmnmmmcmkmm2m3m∕sm∕s2rad∕srad∕s2psnsmspvnvmvkvpwnwmwkwbqcccdc∕kgdbgyhah" +
+	"pinkkktlmlnlxphprsrsvwbv∕ma∕m1日2日3日4日5日6日7日8日9日10日11日12日13日14日15日16日17日1" +
+	"8日19日20日21日22日23日24日25日26日27日28日29日30日31日ьɦɬʞʇœʍ𤋮𢡊𢡄𣏕𥉉𥳐𧻓fffiflstմնմեմիվնմ" +
+	"խיִײַעהכלםרתשׁשׂשּׁשּׂאַאָאּבּגּדּהּוּזּטּיּךּכּלּמּנּסּףּפּצּקּרּשּתּו" +
+	"ֹבֿכֿפֿאלٱٻپڀٺٿٹڤڦڄڃچڇڍڌڎڈژڑکگڳڱںڻۀہھےۓڭۇۆۈۋۅۉېىئائەئوئۇئۆئۈئېئىیئجئحئم" +
+	"ئيبجبحبخبمبىبيتجتحتختمتىتيثجثمثىثيجحجمحجحمخجخحخمسجسحسخسمصحصمضجضحضخضمطحط" +
+	"مظمعجعمغجغمفجفحفخفمفىفيقحقمقىقيكاكجكحكخكلكمكىكيلجلحلخلملىليمجمحمخمممىمي" +
+	"نجنحنخنمنىنيهجهمهىهييجيحيخيميىييذٰرٰىٰ ٌّ ٍّ َّ ُّ ِّ ّٰئرئزئنبربزبنترت" +
+	"زتنثرثزثنمانرنزننيريزينئخئهبهتهصخلهنههٰيهثهسهشمشهـَّـُّـِّطىطيعىعيغىغيس" +
+	"ىسيشىشيحىحيجىجيخىخيصىصيضىضيشجشحشخشرسرصرضراًتجمتحجتحمتخمتمجتمحتمخجمححميح" +
+	"مىسحجسجحسجىسمحسمجسممصححصممشحمشجيشمخشممضحىضخمطمحطممطميعجمعممعمىغممغميغمى" +
+	"فخمقمحقمملحملحيلحىلججلخملمحمحجمحممحيمجحمجممخجمخممجخهمجهممنحمنحىنجمنجىنم" +
+	"ينمىيممبخيتجيتجىتخيتخىتميتمىجميجحىجمىسخىصحيشحيضحيلجيلمييحييجييميمميقمين" +
+	"حيعميكمينجحمخيلجمكممجحيحجيمجيفميبحيسخينجيصلےقلےاللهاكبرمحمدصلعمرسولعليه" +
+	"وسلمصلىصلى الله عليه وسلمجل جلالهریال,:!?_{}[]#&*-<>\\$%@ـًـَـُـِـّـْءآ" +
+	"أؤإئابةتثجحخدذرزسشصضطظعغفقكلمنهويلآلألإلا\x22'/^|~¢£¬¦¥ːˑʙɓʣꭦʥʤɖɗᶑɘɞʩɤɢ" +
+	"ɠʛʜɧʄʪʫꞎɮʎøɶɷɺɾʀʨʦꭧʧʈⱱʏʡʢʘǀǁǂ𝅗𝅥𝅘𝅥𝅘𝅥𝅮𝅘𝅥𝅯𝅘𝅥𝅰𝅘𝅥𝅱𝅘𝅥𝅲𝆹𝅥𝆺𝅥𝆹𝅥𝅮𝆺𝅥𝅮𝆹𝅥𝅯𝆺𝅥𝅯ıȷαεζηκ" +
+	"λμνξοστυψ∇∂ϝабгежзиклмпруфхцчшыэюꚉәіјөүӏґѕџҫꙑұٮڡٯ0,1,2,3,4,5,6,7,8,9,(a" +
+	")(b)(c)(d)(e)(f)(g)(h)(i)(j)(k)(l)(m)(n)(o)(p)(q)(r)(s)(t)(u)(v)(w)(x)(y" +
+	")(z)〔s〕wzhvsdppvwcmcmdmrdjほかココサ手字双デ二多解天交映無料前後再新初終生販声吹演投捕一三遊左中右指走打禁空合満有月申" +
+	"割営配〔本〕〔三〕〔二〕〔安〕〔点〕〔打〕〔盗〕〔勝〕〔敗〕得可丽丸乁你侮侻倂偺備僧像㒞免兔兤具㒹內冗冤仌冬况凵刃㓟刻剆剷㔕勇勉勤勺包匆北卉" +
+	"卑博即卽卿灰及叟叫叱吆咞吸呈周咢哶唐啓啣善喙喫喳嗂圖嘆圗噑噴切壮城埴堍型堲報墬売壷夆夢奢姬娛娧姘婦㛮嬈嬾寃寘寧寳寿将尢㞁屠屮峀岍嵃嵮嵫嵼巡巢" +
+	"㠯巽帨帽幩㡢㡼庰庳庶廊廾舁弢㣇形彫㣣徚忍志忹悁㤺㤜悔惇慈慌慎慺憎憲憤憯懞懲懶成戛扝抱拔捐挽拼捨掃揤搢揅掩㨮摩摾撝摷㩬敏敬旣書晉㬙暑㬈㫤冒冕最" +
+	"暜肭䏙朗望朡杞杓㭉柺枅桒梅梎栟椔㮝楂榣槪檨櫛㰘次歔㱎歲殟殺殻汎沿泍汧洖派海流浩浸涅洴港湮㴳滋滇淹潮濆瀹瀞瀛㶖灊災灷炭煅熜爨爵牐犀犕獺王㺬玥㺸" +
+	"瑇瑜瑱璅瓊㼛甤甾異瘐㿼䀈直眞真睊䀹瞋䁆䂖硎碌磌䃣祖福秫䄯穀穊穏䈂篆築䈧糒䊠糨糣紀絣䌁緇縂繅䌴䍙罺羕翺者聠聰䏕育脃䐋脾媵舄辞䑫芑芋芝劳花芳芽苦" +
+	"若茝荣莭茣莽菧著荓菊菌菜䔫蓱蓳蔖蕤䕝䕡䕫虐虜虧虩蚩蚈蜎蛢蝹蜨蝫螆蟡蠁䗹衠衣裗裞䘵裺㒻䚾䛇誠諭變豕貫賁贛起跋趼跰軔輸邔郱鄑鄛鈸鋗鋘鉼鏹鐕開䦕閷" +
+	"䧦雃嶲霣䩮䩶韠䪲頋頩飢䬳餩馧駂駾䯎鬒鱀鳽䳎䳭鵧䳸麻䵖黹黾鼅鼏鼖鼻"
+
+var mappingIndex = []uint16{ // 1729 elements
+	// Entry 0 - 3F
+	0x0000, 0x0000, 0x0001, 0x0004, 0x0005, 0x0008, 0x0009, 0x000a,
+	0x000d, 0x0010, 0x0011, 0x0012, 0x0017, 0x001c, 0x0021, 0x0024,
+	0x0027, 0x002a, 0x002b, 0x002e, 0x0031, 0x0034, 0x0035, 0x0036,
+	0x0037, 0x0038, 0x0039, 0x003c, 0x003f, 0x0042, 0x0045, 0x0048,
+	0x004b, 0x004c, 0x004d, 0x0051, 0x0054, 0x0055, 0x005a, 0x005e,
+	0x0062, 0x0066, 0x006a, 0x006e, 0x0074, 0x007a, 0x0080, 0x0086,
+	0x008c, 0x0092, 0x0098, 0x009e, 0x00a4, 0x00aa, 0x00b0, 0x00b6,
+	0x00bc, 0x00c2, 0x00c8, 0x00ce, 0x00d4, 0x00da, 0x00e0, 0x00e6,
+	// Entry 40 - 7F
+	0x00ec, 0x00f2, 0x00f8, 0x00fe, 0x0104, 0x010a, 0x0110, 0x0116,
+	0x011c, 0x0122, 0x0128, 0x012e, 0x0137, 0x013d, 0x0146, 0x014c,
+	0x0152, 0x0158, 0x015e, 0x0164, 0x016a, 0x0170, 0x0172, 0x0174,
+	0x0176, 0x0178, 0x017a, 0x017c, 0x017e, 0x0180, 0x0181, 0x0182,
+	0x0183, 0x0185, 0x0186, 0x0187, 0x0188, 0x0189, 0x018a, 0x018c,
+	0x018d, 0x018e, 0x018f, 0x0191, 0x0193, 0x0195, 0x0197, 0x0199,
+	0x019b, 0x019d, 0x019f, 0x01a0, 0x01a2, 0x01a4, 0x01a6, 0x01a8,
+	0x01aa, 0x01ac, 0x01ae, 0x01b0, 0x01b1, 0x01b3, 0x01b5, 0x01b6,
+	// Entry 80 - BF
+	0x01b8, 0x01ba, 0x01bc, 0x01be, 0x01c0, 0x01c2, 0x01c4, 0x01c6,
+	0x01c8, 0x01ca, 0x01cc, 0x01ce, 0x01d0, 0x01d2, 0x01d4, 0x01d6,
+	0x01d8, 0x01da, 0x01dc, 0x01de, 0x01e0, 0x01e2, 0x01e4, 0x01e5,
+	0x01e7, 0x01e9, 0x01eb, 0x01ed, 0x01ef, 0x01f1, 0x01f3, 0x01f5,
+	0x01f7, 0x01f9, 0x01fb, 0x01fd, 0x0202, 0x0207, 0x020c, 0x0211,
+	0x0216, 0x021b, 0x0220, 0x0225, 0x022a, 0x022f, 0x0234, 0x0239,
+	0x023e, 0x0243, 0x0248, 0x024d, 0x0252, 0x0257, 0x025c, 0x0261,
+	0x0266, 0x026b, 0x0270, 0x0275, 0x027a, 0x027e, 0x0282, 0x0287,
+	// Entry C0 - FF
+	0x0289, 0x028e, 0x0293, 0x0297, 0x029b, 0x02a0, 0x02a5, 0x02aa,
+	0x02af, 0x02b1, 0x02b6, 0x02bb, 0x02c0, 0x02c2, 0x02c7, 0x02c8,
+	0x02cd, 0x02d1, 0x02d5, 0x02da, 0x02e0, 0x02e9, 0x02ef, 0x02f8,
+	0x02fa, 0x02fc, 0x02fe, 0x0300, 0x030c, 0x030d, 0x030e, 0x030f,
+	0x0310, 0x0311, 0x0312, 0x0313, 0x0314, 0x0315, 0x0316, 0x0317,
+	0x0319, 0x031b, 0x031d, 0x031e, 0x0320, 0x0322, 0x0324, 0x0326,
+	0x0328, 0x032a, 0x032c, 0x032e, 0x0330, 0x0335, 0x033a, 0x0340,
+	0x0345, 0x034a, 0x034f, 0x0354, 0x0359, 0x035e, 0x0363, 0x0368,
+	// Entry 100 - 13F
+	0x036d, 0x0372, 0x0377, 0x037c, 0x0380, 0x0382, 0x0384, 0x0386,
+	0x038a, 0x038c, 0x038e, 0x0393, 0x0399, 0x03a2, 0x03a8, 0x03b1,
+	0x03b3, 0x03b5, 0x03b7, 0x03b9, 0x03bb, 0x03bd, 0x03bf, 0x03c1,
+	0x03c3, 0x03c5, 0x03c7, 0x03cb, 0x03cf, 0x03d3, 0x03d7, 0x03db,
+	0x03df, 0x03e3, 0x03e7, 0x03eb, 0x03ef, 0x03f3, 0x03ff, 0x0401,
+	0x0406, 0x0408, 0x040a, 0x040c, 0x040e, 0x040f, 0x0413, 0x0417,
+	0x041d, 0x0423, 0x0428, 0x042d, 0x0432, 0x0437, 0x043c, 0x0441,
+	0x0446, 0x044b, 0x0450, 0x0455, 0x045a, 0x045f, 0x0464, 0x0469,
+	// Entry 140 - 17F
+	0x046e, 0x0473, 0x0478, 0x047d, 0x0482, 0x0487, 0x048c, 0x0491,
+	0x0496, 0x049b, 0x04a0, 0x04a5, 0x04aa, 0x04af, 0x04b4, 0x04bc,
+	0x04c4, 0x04c9, 0x04ce, 0x04d3, 0x04d8, 0x04dd, 0x04e2, 0x04e7,
+	0x04ec, 0x04f1, 0x04f6, 0x04fb, 0x0500, 0x0505, 0x050a, 0x050f,
+	0x0514, 0x0519, 0x051e, 0x0523, 0x0528, 0x052d, 0x0532, 0x0537,
+	0x053c, 0x0541, 0x0546, 0x054b, 0x0550, 0x0555, 0x055a, 0x055f,
+	0x0564, 0x0569, 0x056e, 0x0573, 0x0578, 0x057a, 0x057c, 0x057e,
+	0x0580, 0x0582, 0x0584, 0x0586, 0x0588, 0x058a, 0x058c, 0x058e,
+	// Entry 180 - 1BF
+	0x0590, 0x0592, 0x0594, 0x0596, 0x059c, 0x05a2, 0x05a4, 0x05a6,
+	0x05a8, 0x05aa, 0x05ac, 0x05ae, 0x05b0, 0x05b2, 0x05b4, 0x05b6,
+	0x05b8, 0x05ba, 0x05bc, 0x05be, 0x05c0, 0x05c4, 0x05c8, 0x05cc,
+	0x05d0, 0x05d4, 0x05d8, 0x05dc, 0x05e0, 0x05e4, 0x05e9, 0x05ee,
+	0x05f3, 0x05f5, 0x05f7, 0x05fd, 0x0609, 0x0615, 0x0621, 0x062a,
+	0x0636, 0x063f, 0x0648, 0x0657, 0x0663, 0x066c, 0x0675, 0x067e,
+	0x068a, 0x0696, 0x069f, 0x06a8, 0x06ae, 0x06b7, 0x06c3, 0x06cf,
+	0x06d5, 0x06e4, 0x06f6, 0x0705, 0x070e, 0x071d, 0x072c, 0x0738,
+	// Entry 1C0 - 1FF
+	0x0741, 0x074a, 0x0753, 0x075f, 0x076e, 0x077a, 0x0783, 0x078c,
+	0x0795, 0x079b, 0x07a1, 0x07a7, 0x07ad, 0x07b6, 0x07bf, 0x07ce,
+	0x07d7, 0x07e3, 0x07f2, 0x07fb, 0x0801, 0x0807, 0x0816, 0x0822,
+	0x0831, 0x083a, 0x0849, 0x084f, 0x0858, 0x0861, 0x086a, 0x0873,
+	0x087c, 0x0888, 0x0891, 0x0897, 0x08a0, 0x08a9, 0x08b2, 0x08be,
+	0x08c7, 0x08d0, 0x08d9, 0x08e8, 0x08f4, 0x08fa, 0x0909, 0x090f,
+	0x091b, 0x0927, 0x0930, 0x0939, 0x0942, 0x094e, 0x0954, 0x095d,
+	0x0969, 0x096f, 0x097e, 0x0987, 0x098b, 0x098f, 0x0993, 0x0997,
+	// Entry 200 - 23F
+	0x099b, 0x099f, 0x09a3, 0x09a7, 0x09ab, 0x09af, 0x09b4, 0x09b9,
+	0x09be, 0x09c3, 0x09c8, 0x09cd, 0x09d2, 0x09d7, 0x09dc, 0x09e1,
+	0x09e6, 0x09eb, 0x09f0, 0x09f5, 0x09fa, 0x09fc, 0x09fe, 0x0a00,
+	0x0a02, 0x0a04, 0x0a06, 0x0a0c, 0x0a12, 0x0a18, 0x0a1e, 0x0a2a,
+	0x0a2c, 0x0a2e, 0x0a30, 0x0a32, 0x0a34, 0x0a36, 0x0a38, 0x0a3c,
+	0x0a3e, 0x0a40, 0x0a42, 0x0a44, 0x0a46, 0x0a48, 0x0a4a, 0x0a4c,
+	0x0a4e, 0x0a50, 0x0a52, 0x0a54, 0x0a56, 0x0a58, 0x0a5a, 0x0a5f,
+	0x0a65, 0x0a6c, 0x0a74, 0x0a76, 0x0a78, 0x0a7a, 0x0a7c, 0x0a7e,
+	// Entry 240 - 27F
+	0x0a80, 0x0a82, 0x0a84, 0x0a86, 0x0a88, 0x0a8a, 0x0a8c, 0x0a8e,
+	0x0a90, 0x0a96, 0x0a98, 0x0a9a, 0x0a9c, 0x0a9e, 0x0aa0, 0x0aa2,
+	0x0aa4, 0x0aa6, 0x0aa8, 0x0aaa, 0x0aac, 0x0aae, 0x0ab0, 0x0ab2,
+	0x0ab4, 0x0ab9, 0x0abe, 0x0ac2, 0x0ac6, 0x0aca, 0x0ace, 0x0ad2,
+	0x0ad6, 0x0ada, 0x0ade, 0x0ae2, 0x0ae7, 0x0aec, 0x0af1, 0x0af6,
+	0x0afb, 0x0b00, 0x0b05, 0x0b0a, 0x0b0f, 0x0b14, 0x0b19, 0x0b1e,
+	0x0b23, 0x0b28, 0x0b2d, 0x0b32, 0x0b37, 0x0b3c, 0x0b41, 0x0b46,
+	0x0b4b, 0x0b50, 0x0b52, 0x0b54, 0x0b56, 0x0b58, 0x0b5a, 0x0b5c,
+	// Entry 280 - 2BF
+	0x0b5e, 0x0b62, 0x0b66, 0x0b6a, 0x0b6e, 0x0b72, 0x0b76, 0x0b7a,
+	0x0b7c, 0x0b7e, 0x0b80, 0x0b82, 0x0b86, 0x0b8a, 0x0b8e, 0x0b92,
+	0x0b96, 0x0b9a, 0x0b9e, 0x0ba0, 0x0ba2, 0x0ba4, 0x0ba6, 0x0ba8,
+	0x0baa, 0x0bac, 0x0bb0, 0x0bb4, 0x0bba, 0x0bc0, 0x0bc4, 0x0bc8,
+	0x0bcc, 0x0bd0, 0x0bd4, 0x0bd8, 0x0bdc, 0x0be0, 0x0be4, 0x0be8,
+	0x0bec, 0x0bf0, 0x0bf4, 0x0bf8, 0x0bfc, 0x0c00, 0x0c04, 0x0c08,
+	0x0c0c, 0x0c10, 0x0c14, 0x0c18, 0x0c1c, 0x0c20, 0x0c24, 0x0c28,
+	0x0c2c, 0x0c30, 0x0c34, 0x0c36, 0x0c38, 0x0c3a, 0x0c3c, 0x0c3e,
+	// Entry 2C0 - 2FF
+	0x0c40, 0x0c42, 0x0c44, 0x0c46, 0x0c48, 0x0c4a, 0x0c4c, 0x0c4e,
+	0x0c50, 0x0c52, 0x0c54, 0x0c56, 0x0c58, 0x0c5a, 0x0c5c, 0x0c5e,
+	0x0c60, 0x0c62, 0x0c64, 0x0c66, 0x0c68, 0x0c6a, 0x0c6c, 0x0c6e,
+	0x0c70, 0x0c72, 0x0c74, 0x0c76, 0x0c78, 0x0c7a, 0x0c7c, 0x0c7e,
+	0x0c80, 0x0c82, 0x0c86, 0x0c8a, 0x0c8e, 0x0c92, 0x0c96, 0x0c9a,
+	0x0c9e, 0x0ca2, 0x0ca4, 0x0ca8, 0x0cac, 0x0cb0, 0x0cb4, 0x0cb8,
+	0x0cbc, 0x0cc0, 0x0cc4, 0x0cc8, 0x0ccc, 0x0cd0, 0x0cd4, 0x0cd8,
+	0x0cdc, 0x0ce0, 0x0ce4, 0x0ce8, 0x0cec, 0x0cf0, 0x0cf4, 0x0cf8,
+	// Entry 300 - 33F
+	0x0cfc, 0x0d00, 0x0d04, 0x0d08, 0x0d0c, 0x0d10, 0x0d14, 0x0d18,
+	0x0d1c, 0x0d20, 0x0d24, 0x0d28, 0x0d2c, 0x0d30, 0x0d34, 0x0d38,
+	0x0d3c, 0x0d40, 0x0d44, 0x0d48, 0x0d4c, 0x0d50, 0x0d54, 0x0d58,
+	0x0d5c, 0x0d60, 0x0d64, 0x0d68, 0x0d6c, 0x0d70, 0x0d74, 0x0d78,
+	0x0d7c, 0x0d80, 0x0d84, 0x0d88, 0x0d8c, 0x0d90, 0x0d94, 0x0d98,
+	0x0d9c, 0x0da0, 0x0da4, 0x0da8, 0x0dac, 0x0db0, 0x0db4, 0x0db8,
+	0x0dbc, 0x0dc0, 0x0dc4, 0x0dc8, 0x0dcc, 0x0dd0, 0x0dd4, 0x0dd8,
+	0x0ddc, 0x0de0, 0x0de4, 0x0de8, 0x0dec, 0x0df0, 0x0df4, 0x0df8,
+	// Entry 340 - 37F
+	0x0dfc, 0x0e00, 0x0e04, 0x0e08, 0x0e0c, 0x0e10, 0x0e14, 0x0e18,
+	0x0e1d, 0x0e22, 0x0e27, 0x0e2c, 0x0e31, 0x0e36, 0x0e3a, 0x0e3e,
+	0x0e42, 0x0e46, 0x0e4a, 0x0e4e, 0x0e52, 0x0e56, 0x0e5a, 0x0e5e,
+	0x0e62, 0x0e66, 0x0e6a, 0x0e6e, 0x0e72, 0x0e76, 0x0e7a, 0x0e7e,
+	0x0e82, 0x0e86, 0x0e8a, 0x0e8e, 0x0e92, 0x0e96, 0x0e9a, 0x0e9e,
+	0x0ea2, 0x0ea6, 0x0eaa, 0x0eae, 0x0eb2, 0x0eb6, 0x0ebc, 0x0ec2,
+	0x0ec8, 0x0ecc, 0x0ed0, 0x0ed4, 0x0ed8, 0x0edc, 0x0ee0, 0x0ee4,
+	0x0ee8, 0x0eec, 0x0ef0, 0x0ef4, 0x0ef8, 0x0efc, 0x0f00, 0x0f04,
+	// Entry 380 - 3BF
+	0x0f08, 0x0f0c, 0x0f10, 0x0f14, 0x0f18, 0x0f1c, 0x0f20, 0x0f24,
+	0x0f28, 0x0f2c, 0x0f30, 0x0f34, 0x0f38, 0x0f3e, 0x0f44, 0x0f4a,
+	0x0f50, 0x0f56, 0x0f5c, 0x0f62, 0x0f68, 0x0f6e, 0x0f74, 0x0f7a,
+	0x0f80, 0x0f86, 0x0f8c, 0x0f92, 0x0f98, 0x0f9e, 0x0fa4, 0x0faa,
+	0x0fb0, 0x0fb6, 0x0fbc, 0x0fc2, 0x0fc8, 0x0fce, 0x0fd4, 0x0fda,
+	0x0fe0, 0x0fe6, 0x0fec, 0x0ff2, 0x0ff8, 0x0ffe, 0x1004, 0x100a,
+	0x1010, 0x1016, 0x101c, 0x1022, 0x1028, 0x102e, 0x1034, 0x103a,
+	0x1040, 0x1046, 0x104c, 0x1052, 0x1058, 0x105e, 0x1064, 0x106a,
+	// Entry 3C0 - 3FF
+	0x1070, 0x1076, 0x107c, 0x1082, 0x1088, 0x108e, 0x1094, 0x109a,
+	0x10a0, 0x10a6, 0x10ac, 0x10b2, 0x10b8, 0x10be, 0x10c4, 0x10ca,
+	0x10d0, 0x10d6, 0x10dc, 0x10e2, 0x10e8, 0x10ee, 0x10f4, 0x10fa,
+	0x1100, 0x1106, 0x110c, 0x1112, 0x1118, 0x111e, 0x1124, 0x112a,
+	0x1130, 0x1136, 0x113c, 0x1142, 0x1148, 0x114e, 0x1154, 0x115a,
+	0x1160, 0x1166, 0x116c, 0x1172, 0x1178, 0x1180, 0x1188, 0x1190,
+	0x1198, 0x11a0, 0x11a8, 0x11b0, 0x11b6, 0x11d7, 0x11e6, 0x11ee,
+	0x11ef, 0x11f0, 0x11f1, 0x11f2, 0x11f3, 0x11f4, 0x11f5, 0x11f6,
+	// Entry 400 - 43F
+	0x11f7, 0x11f8, 0x11f9, 0x11fa, 0x11fb, 0x11fc, 0x11fd, 0x11fe,
+	0x11ff, 0x1200, 0x1201, 0x1205, 0x1209, 0x120d, 0x1211, 0x1215,
+	0x1219, 0x121b, 0x121d, 0x121f, 0x1221, 0x1223, 0x1225, 0x1227,
+	0x1229, 0x122b, 0x122d, 0x122f, 0x1231, 0x1233, 0x1235, 0x1237,
+	0x1239, 0x123b, 0x123d, 0x123f, 0x1241, 0x1243, 0x1245, 0x1247,
+	0x1249, 0x124b, 0x124d, 0x124f, 0x1251, 0x1253, 0x1255, 0x1257,
+	0x1259, 0x125b, 0x125d, 0x125f, 0x1263, 0x1267, 0x126b, 0x126f,
+	0x1270, 0x1271, 0x1272, 0x1273, 0x1274, 0x1275, 0x1277, 0x1279,
+	// Entry 440 - 47F
+	0x127b, 0x127d, 0x127f, 0x1281, 0x1283, 0x1285, 0x1287, 0x1289,
+	0x128c, 0x128e, 0x1290, 0x1292, 0x1294, 0x1297, 0x1299, 0x129b,
+	0x129d, 0x129f, 0x12a1, 0x12a3, 0x12a5, 0x12a7, 0x12a9, 0x12ab,
+	0x12ad, 0x12af, 0x12b2, 0x12b4, 0x12b6, 0x12b8, 0x12ba, 0x12bc,
+	0x12be, 0x12c0, 0x12c2, 0x12c4, 0x12c6, 0x12c9, 0x12cb, 0x12cd,
+	0x12d0, 0x12d2, 0x12d4, 0x12d6, 0x12d8, 0x12da, 0x12dc, 0x12de,
+	0x12e6, 0x12ee, 0x12fa, 0x1306, 0x1312, 0x131e, 0x132a, 0x1332,
+	0x133a, 0x1346, 0x1352, 0x135e, 0x136a, 0x136c, 0x136e, 0x1370,
+	// Entry 480 - 4BF
+	0x1372, 0x1374, 0x1376, 0x1378, 0x137a, 0x137c, 0x137e, 0x1380,
+	0x1382, 0x1384, 0x1386, 0x1388, 0x138a, 0x138d, 0x1390, 0x1392,
+	0x1394, 0x1396, 0x1398, 0x139a, 0x139c, 0x139e, 0x13a0, 0x13a2,
+	0x13a4, 0x13a6, 0x13a8, 0x13aa, 0x13ac, 0x13ae, 0x13b0, 0x13b2,
+	0x13b4, 0x13b6, 0x13b8, 0x13ba, 0x13bc, 0x13bf, 0x13c1, 0x13c3,
+	0x13c5, 0x13c7, 0x13c9, 0x13cb, 0x13cd, 0x13cf, 0x13d1, 0x13d3,
+	0x13d6, 0x13d8, 0x13da, 0x13dc, 0x13de, 0x13e0, 0x13e2, 0x13e4,
+	0x13e6, 0x13e8, 0x13ea, 0x13ec, 0x13ee, 0x13f0, 0x13f2, 0x13f5,
+	// Entry 4C0 - 4FF
+	0x13f8, 0x13fb, 0x13fe, 0x1401, 0x1404, 0x1407, 0x140a, 0x140d,
+	0x1410, 0x1413, 0x1416, 0x1419, 0x141c, 0x141f, 0x1422, 0x1425,
+	0x1428, 0x142b, 0x142e, 0x1431, 0x1434, 0x1437, 0x143a, 0x143d,
+	0x1440, 0x1447, 0x1449, 0x144b, 0x144d, 0x1450, 0x1452, 0x1454,
+	0x1456, 0x1458, 0x145a, 0x1460, 0x1466, 0x1469, 0x146c, 0x146f,
+	0x1472, 0x1475, 0x1478, 0x147b, 0x147e, 0x1481, 0x1484, 0x1487,
+	0x148a, 0x148d, 0x1490, 0x1493, 0x1496, 0x1499, 0x149c, 0x149f,
+	0x14a2, 0x14a5, 0x14a8, 0x14ab, 0x14ae, 0x14b1, 0x14b4, 0x14b7,
+	// Entry 500 - 53F
+	0x14ba, 0x14bd, 0x14c0, 0x14c3, 0x14c6, 0x14c9, 0x14cc, 0x14cf,
+	0x14d2, 0x14d5, 0x14d8, 0x14db, 0x14de, 0x14e1, 0x14e4, 0x14e7,
+	0x14ea, 0x14ed, 0x14f6, 0x14ff, 0x1508, 0x1511, 0x151a, 0x1523,
+	0x152c, 0x1535, 0x153e, 0x1541, 0x1544, 0x1547, 0x154a, 0x154d,
+	0x1550, 0x1553, 0x1556, 0x1559, 0x155c, 0x155f, 0x1562, 0x1565,
+	0x1568, 0x156b, 0x156e, 0x1571, 0x1574, 0x1577, 0x157a, 0x157d,
+	0x1580, 0x1583, 0x1586, 0x1589, 0x158c, 0x158f, 0x1592, 0x1595,
+	0x1598, 0x159b, 0x159e, 0x15a1, 0x15a4, 0x15a7, 0x15aa, 0x15ad,
+	// Entry 540 - 57F
+	0x15b0, 0x15b3, 0x15b6, 0x15b9, 0x15bc, 0x15bf, 0x15c2, 0x15c5,
+	0x15c8, 0x15cb, 0x15ce, 0x15d1, 0x15d4, 0x15d7, 0x15da, 0x15dd,
+	0x15e0, 0x15e3, 0x15e6, 0x15e9, 0x15ec, 0x15ef, 0x15f2, 0x15f5,
+	0x15f8, 0x15fb, 0x15fe, 0x1601, 0x1604, 0x1607, 0x160a, 0x160d,
+	0x1610, 0x1613, 0x1616, 0x1619, 0x161c, 0x161f, 0x1622, 0x1625,
+	0x1628, 0x162b, 0x162e, 0x1631, 0x1634, 0x1637, 0x163a, 0x163d,
+	0x1640, 0x1643, 0x1646, 0x1649, 0x164c, 0x164f, 0x1652, 0x1655,
+	0x1658, 0x165b, 0x165e, 0x1661, 0x1664, 0x1667, 0x166a, 0x166d,
+	// Entry 580 - 5BF
+	0x1670, 0x1673, 0x1676, 0x1679, 0x167c, 0x167f, 0x1682, 0x1685,
+	0x1688, 0x168b, 0x168e, 0x1691, 0x1694, 0x1697, 0x169a, 0x169d,
+	0x16a0, 0x16a3, 0x16a6, 0x16a9, 0x16ac, 0x16af, 0x16b2, 0x16b5,
+	0x16b8, 0x16bb, 0x16be, 0x16c1, 0x16c4, 0x16c7, 0x16ca, 0x16cd,
+	0x16d0, 0x16d3, 0x16d6, 0x16d9, 0x16dc, 0x16df, 0x16e2, 0x16e5,
+	0x16e8, 0x16eb, 0x16ee, 0x16f1, 0x16f4, 0x16f7, 0x16fa, 0x16fd,
+	0x1700, 0x1703, 0x1706, 0x1709, 0x170c, 0x170f, 0x1712, 0x1715,
+	0x1718, 0x171b, 0x171e, 0x1721, 0x1724, 0x1727, 0x172a, 0x172d,
+	// Entry 5C0 - 5FF
+	0x1730, 0x1733, 0x1736, 0x1739, 0x173c, 0x173f, 0x1742, 0x1745,
+	0x1748, 0x174b, 0x174e, 0x1751, 0x1754, 0x1757, 0x175a, 0x175d,
+	0x1760, 0x1763, 0x1766, 0x1769, 0x176c, 0x176f, 0x1772, 0x1775,
+	0x1778, 0x177b, 0x177e, 0x1781, 0x1784, 0x1787, 0x178a, 0x178d,
+	0x1790, 0x1793, 0x1796, 0x1799, 0x179c, 0x179f, 0x17a2, 0x17a5,
+	0x17a8, 0x17ab, 0x17ae, 0x17b1, 0x17b4, 0x17b7, 0x17ba, 0x17bd,
+	0x17c0, 0x17c3, 0x17c6, 0x17c9, 0x17cc, 0x17cf, 0x17d2, 0x17d5,
+	0x17d8, 0x17db, 0x17de, 0x17e1, 0x17e4, 0x17e7, 0x17ea, 0x17ed,
+	// Entry 600 - 63F
+	0x17f0, 0x17f3, 0x17f6, 0x17f9, 0x17fc, 0x17ff, 0x1802, 0x1805,
+	0x1808, 0x180b, 0x180e, 0x1811, 0x1814, 0x1817, 0x181a, 0x181d,
+	0x1820, 0x1823, 0x1826, 0x1829, 0x182c, 0x182f, 0x1832, 0x1835,
+	0x1838, 0x183b, 0x183e, 0x1841, 0x1844, 0x1847, 0x184a, 0x184d,
+	0x1850, 0x1853, 0x1856, 0x1859, 0x185c, 0x185f, 0x1862, 0x1865,
+	0x1868, 0x186b, 0x186e, 0x1871, 0x1874, 0x1877, 0x187a, 0x187d,
+	0x1880, 0x1883, 0x1886, 0x1889, 0x188c, 0x188f, 0x1892, 0x1895,
+	0x1898, 0x189b, 0x189e, 0x18a1, 0x18a4, 0x18a7, 0x18aa, 0x18ad,
+	// Entry 640 - 67F
+	0x18b0, 0x18b3, 0x18b6, 0x18b9, 0x18bc, 0x18bf, 0x18c2, 0x18c5,
+	0x18c8, 0x18cb, 0x18ce, 0x18d1, 0x18d4, 0x18d7, 0x18da, 0x18dd,
+	0x18e0, 0x18e3, 0x18e6, 0x18e9, 0x18ec, 0x18ef, 0x18f2, 0x18f5,
+	0x18f8, 0x18fb, 0x18fe, 0x1901, 0x1904, 0x1907, 0x190a, 0x190d,
+	0x1910, 0x1913, 0x1916, 0x1919, 0x191c, 0x191f, 0x1922, 0x1925,
+	0x1928, 0x192b, 0x192e, 0x1931, 0x1934, 0x1937, 0x193a, 0x193d,
+	0x1940, 0x1943, 0x1946, 0x1949, 0x194c, 0x194f, 0x1952, 0x1955,
+	0x1958, 0x195b, 0x195e, 0x1961, 0x1964, 0x1967, 0x196a, 0x196d,
+	// Entry 680 - 6BF
+	0x1970, 0x1973, 0x1976, 0x1979, 0x197c, 0x197f, 0x1982, 0x1985,
+	0x1988, 0x198b, 0x198e, 0x1991, 0x1994, 0x1997, 0x199a, 0x199d,
+	0x19a0, 0x19a3, 0x19a6, 0x19a9, 0x19ac, 0x19af, 0x19b2, 0x19b5,
+	0x19b8, 0x19bb, 0x19be, 0x19c1, 0x19c4, 0x19c7, 0x19ca, 0x19cd,
+	0x19d0, 0x19d3, 0x19d6, 0x19d9, 0x19dc, 0x19df, 0x19e2, 0x19e5,
+	0x19e8, 0x19eb, 0x19ee, 0x19f1, 0x19f4, 0x19f7, 0x19fa, 0x19fd,
+	0x1a00, 0x1a03, 0x1a06, 0x1a09, 0x1a0c, 0x1a0f, 0x1a12, 0x1a15,
+	0x1a18, 0x1a1b, 0x1a1e, 0x1a21, 0x1a24, 0x1a27, 0x1a2a, 0x1a2d,
+	// Entry 6C0 - 6FF
+	0x1a30,
+} // Size: 3482 bytes
+
+var xorData string = "" + // Size: 4907 bytes
+	"\x02\x0c\x09\x02\xb0\xec\x02\xad\xd8\x02\xad\xd9\x02\x06\x07\x02\x0f\x12" +
+	"\x02\x0f\x1f\x02\x0f\x1d\x02\x01\x13\x02\x0f\x16\x02\x0f\x0b\x02\x0f3" +
+	"\x02\x0f7\x02\x0f?\x02\x0f/\x02\x0f*\x02\x0c&\x02\x0c*\x02\x0c;\x02\x0c9" +
+	"\x02\x0c%\x02\xab\xed\x02\xab\xe2\x02\xab\xe3\x02\xa9\xe0\x02\xa9\xe1" +
+	"\x02\xa9\xe6\x02\xa3\xcb\x02\xa3\xc8\x02\xa3\xc9\x02\x01#\x02\x01\x08" +
+	"\x02\x0e>\x02\x0e'\x02\x0f\x03\x02\x03\x0d\x02\x03\x09\x02\x03\x17\x02" +
+	"\x03\x0e\x02\x02\x03\x02\x011\x02\x01\x00\x02\x01\x10\x02\x03<\x02\x07" +
+	"\x0d\x02\x02\x0c\x02\x0c0\x02\x01\x03\x02\x01\x01\x02\x01 \x02\x01\x22" +
+	"\x02\x01)\x02\x01\x0a\x02\x01\x0c\x02\x02\x06\x02\x02\x02\x02\x03\x10" +
+	"\x03\x037 \x03\x0b+\x03\x021\x00\x02\x01\x04\x02\x01\x02\x02\x019\x02" +
+	"\x03\x1c\x02\x02$\x03\x80p$\x02\x03:\x02\x03\x0a\x03\xc1r.\x03\xc1r,\x03" +
+	"\xc1r\x02\x02\x02:\x02\x02>\x02\x02,\x02\x02\x10\x02\x02\x00\x03\xc1s<" +
+	"\x03\xc1s*\x03\xc2L$\x03\xc2L;\x02\x09)\x02\x0a\x19\x03\x83\xab\xe3\x03" +
+	"\x83\xab\xf2\x03 4\xe0\x03\x81\xab\xea\x03\x81\xab\xf3\x03 4\xef\x03\x96" +
+	"\xe1\xcd\x03\x84\xe5\xc3\x02\x0d\x11\x03\x8b\xec\xcb\x03\x94\xec\xcf\x03" +
+	"\x9a\xec\xc2\x03\x8b\xec\xdb\x03\x94\xec\xdf\x03\x9a\xec\xd2\x03\x01\x0c" +
+	"!\x03\x01\x0c#\x03ʠ\x9d\x03ʣ\x9c\x03ʢ\x9f\x03ʥ\x9e\x03ʤ\x91\x03ʧ\x90\x03" +
+	"ʦ\x93\x03ʩ\x92\x03ʨ\x95\x03\xca\xf3\xb5\x03\xca\xf0\xb4\x03\xca\xf1\xb7" +
+	"\x03\xca\xf6\xb6\x03\xca\xf7\x89\x03\xca\xf4\x88\x03\xca\xf5\x8b\x03\xca" +
+	"\xfa\x8a\x03\xca\xfb\x8d\x03\xca\xf8\x8c\x03\xca\xf9\x8f\x03\xca\xfe\x8e" +
+	"\x03\xca\xff\x81\x03\xca\xfc\x80\x03\xca\xfd\x83\x03\xca\xe2\x82\x03\xca" +
+	"\xe3\x85\x03\xca\xe0\x84\x03\xca\xe1\x87\x03\xca\xe6\x86\x03\xca\xe7\x99" +
+	"\x03\xca\xe4\x98\x03\xca\xe5\x9b\x03\xca\xea\x9a\x03\xca\xeb\x9d\x03\xca" +
+	"\xe8\x9c\x03ؓ\x89\x03ߔ\x8b\x02\x010\x03\x03\x04\x1e\x03\x04\x15\x12\x03" +
+	"\x0b\x05,\x03\x06\x04\x00\x03\x06\x04)\x03\x06\x044\x03\x06\x04<\x03\x06" +
+	"\x05\x1d\x03\x06\x06\x00\x03\x06\x06\x0a\x03\x06\x06'\x03\x06\x062\x03" +
+	"\x0786\x03\x079/\x03\x079 \x03\x07:\x0e\x03\x07:\x1b\x03\x07:%\x03\x07;/" +
+	"\x03\x07;%\x03\x074\x11\x03\x076\x09\x03\x077*\x03\x070\x01\x03\x070\x0f" +
+	"\x03\x070.\x03\x071\x16\x03\x071\x04\x03\x0710\x03\x072\x18\x03\x072-" +
+	"\x03\x073\x14\x03\x073>\x03\x07'\x09\x03\x07 \x00\x03\x07\x1f\x0b\x03" +
+	"\x07\x18#\x03\x07\x18(\x03\x07\x186\x03\x07\x18\x03\x03\x07\x19\x16\x03" +
+	"\x07\x116\x03\x07\x12'\x03\x07\x13\x10\x03\x07\x0c&\x03\x07\x0c\x08\x03" +
+	"\x07\x0c\x13\x03\x07\x0d\x02\x03\x07\x0d\x1c\x03\x07\x0b5\x03\x07\x0b" +
+	"\x0a\x03\x07\x0b\x01\x03\x07\x0b\x0f\x03\x07\x05\x00\x03\x07\x05\x09\x03" +
+	"\x07\x05\x0b\x03\x07\x07\x01\x03\x07\x07\x08\x03\x07\x00<\x03\x07\x00+" +
+	"\x03\x07\x01)\x03\x07\x01\x1b\x03\x07\x01\x08\x03\x07\x03?\x03\x0445\x03" +
+	"\x044\x08\x03\x0454\x03\x04)/\x03\x04)5\x03\x04+\x05\x03\x04+\x14\x03" +
+	"\x04+ \x03\x04+<\x03\x04*&\x03\x04*\x22\x03\x04&8\x03\x04!\x01\x03\x04!" +
+	"\x22\x03\x04\x11+\x03\x04\x10.\x03\x04\x104\x03\x04\x13=\x03\x04\x12\x04" +
+	"\x03\x04\x12\x0a\x03\x04\x0d\x1d\x03\x04\x0d\x07\x03\x04\x0d \x03\x05<>" +
+	"\x03\x055<\x03\x055!\x03\x055#\x03\x055&\x03\x054\x1d\x03\x054\x02\x03" +
+	"\x054\x07\x03\x0571\x03\x053\x1a\x03\x053\x16\x03\x05.<\x03\x05.\x07\x03" +
+	"\x05):\x03\x05)<\x03\x05)\x0c\x03\x05)\x15\x03\x05+-\x03\x05+5\x03\x05$" +
+	"\x1e\x03\x05$\x14\x03\x05'\x04\x03\x05'\x14\x03\x05&\x02\x03\x05\x226" +
+	"\x03\x05\x22\x0c\x03\x05\x22\x1c\x03\x05\x19\x0a\x03\x05\x1b\x09\x03\x05" +
+	"\x1b\x0c\x03\x05\x14\x07\x03\x05\x16?\x03\x05\x16\x0c\x03\x05\x0c\x05" +
+	"\x03\x05\x0e\x0f\x03\x05\x01\x0e\x03\x05\x00(\x03\x05\x030\x03\x05\x03" +
+	"\x06\x03\x0a==\x03\x0a=1\x03\x0a=,\x03\x0a=\x0c\x03\x0a??\x03\x0a<\x08" +
+	"\x03\x0a9!\x03\x0a9)\x03\x0a97\x03\x0a99\x03\x0a6\x0a\x03\x0a6\x1c\x03" +
+	"\x0a6\x17\x03\x0a7'\x03\x0a78\x03\x0a73\x03\x0a'\x01\x03\x0a'&\x03\x0a" +
+	"\x1f\x0e\x03\x0a\x1f\x03\x03\x0a\x1f3\x03\x0a\x1b/\x03\x0a\x18\x19\x03" +
+	"\x0a\x19\x01\x03\x0a\x16\x14\x03\x0a\x0e\x22\x03\x0a\x0f\x10\x03\x0a\x0f" +
+	"\x02\x03\x0a\x0f \x03\x0a\x0c\x04\x03\x0a\x0b>\x03\x0a\x0b+\x03\x0a\x08/" +
+	"\x03\x0a\x046\x03\x0a\x05\x14\x03\x0a\x00\x04\x03\x0a\x00\x10\x03\x0a" +
+	"\x00\x14\x03\x0b<3\x03\x0b;*\x03\x0b9\x22\x03\x0b9)\x03\x0b97\x03\x0b+" +
+	"\x10\x03\x0b((\x03\x0b&5\x03\x0b$\x1c\x03\x0b$\x12\x03\x0b%\x04\x03\x0b#" +
+	"<\x03\x0b#0\x03\x0b#\x0d\x03\x0b#\x19\x03\x0b!:\x03\x0b!\x1f\x03\x0b!" +
+	"\x00\x03\x0b\x1e5\x03\x0b\x1c\x1d\x03\x0b\x1d-\x03\x0b\x1d(\x03\x0b\x18." +
+	"\x03\x0b\x18 \x03\x0b\x18\x16\x03\x0b\x14\x13\x03\x0b\x15$\x03\x0b\x15" +
+	"\x22\x03\x0b\x12\x1b\x03\x0b\x12\x10\x03\x0b\x132\x03\x0b\x13=\x03\x0b" +
+	"\x12\x18\x03\x0b\x0c&\x03\x0b\x061\x03\x0b\x06:\x03\x0b\x05#\x03\x0b\x05" +
+	"<\x03\x0b\x04\x0b\x03\x0b\x04\x04\x03\x0b\x04\x1b\x03\x0b\x042\x03\x0b" +
+	"\x041\x03\x0b\x03\x03\x03\x0b\x03\x1d\x03\x0b\x03/\x03\x0b\x03+\x03\x0b" +
+	"\x02\x1b\x03\x0b\x02\x00\x03\x0b\x01\x1e\x03\x0b\x01\x08\x03\x0b\x015" +
+	"\x03\x06\x0d9\x03\x06\x0d=\x03\x06\x0d?\x03\x02\x001\x03\x02\x003\x03" +
+	"\x02\x02\x19\x03\x02\x006\x03\x02\x02\x1b\x03\x02\x004\x03\x02\x00<\x03" +
+	"\x02\x02\x0a\x03\x02\x02\x0e\x03\x02\x01\x1a\x03\x02\x01\x07\x03\x02\x01" +
+	"\x05\x03\x02\x01\x0b\x03\x02\x01%\x03\x02\x01\x0c\x03\x02\x01\x04\x03" +
+	"\x02\x01\x1c\x03\x02\x00.\x03\x02\x002\x03\x02\x00>\x03\x02\x00\x12\x03" +
+	"\x02\x00\x16\x03\x02\x011\x03\x02\x013\x03\x02\x02 \x03\x02\x02%\x03\x02" +
+	"\x02$\x03\x02\x028\x03\x02\x02;\x03\x02\x024\x03\x02\x012\x03\x02\x022" +
+	"\x03\x02\x02/\x03\x02\x01,\x03\x02\x01\x13\x03\x02\x01\x16\x03\x02\x01" +
+	"\x11\x03\x02\x01\x1e\x03\x02\x01\x15\x03\x02\x01\x17\x03\x02\x01\x0f\x03" +
+	"\x02\x01\x08\x03\x02\x00?\x03\x02\x03\x07\x03\x02\x03\x0d\x03\x02\x03" +
+	"\x13\x03\x02\x03\x1d\x03\x02\x03\x1f\x03\x02\x00\x03\x03\x02\x00\x0d\x03" +
+	"\x02\x00\x01\x03\x02\x00\x1b\x03\x02\x00\x19\x03\x02\x00\x18\x03\x02\x00" +
+	"\x13\x03\x02\x00/\x03\x07>\x12\x03\x07<\x1f\x03\x07>\x1d\x03\x06\x1d\x0e" +
+	"\x03\x07>\x1c\x03\x07>:\x03\x07>\x13\x03\x04\x12+\x03\x07?\x03\x03\x07>" +
+	"\x02\x03\x06\x224\x03\x06\x1a.\x03\x07<%\x03\x06\x1c\x0b\x03\x0609\x03" +
+	"\x05\x1f\x01\x03\x04'\x08\x03\x93\xfd\xf5\x03\x02\x0d \x03\x02\x0d#\x03" +
+	"\x02\x0d!\x03\x02\x0d&\x03\x02\x0d\x22\x03\x02\x0d/\x03\x02\x0d,\x03\x02" +
+	"\x0d$\x03\x02\x0d'\x03\x02\x0d%\x03\x02\x0d;\x03\x02\x0d=\x03\x02\x0d?" +
+	"\x03\x099.\x03\x08\x0b7\x03\x08\x02\x14\x03\x08\x14\x0d\x03\x08.:\x03" +
+	"\x089'\x03\x0f\x0b\x18\x03\x0f\x1c1\x03\x0f\x17&\x03\x0f9\x1f\x03\x0f0" +
+	"\x0c\x03\x0e\x0a9\x03\x0e\x056\x03\x0e\x1c#\x03\x0f\x13\x0e\x03\x072\x00" +
+	"\x03\x070\x0d\x03\x072\x0b\x03\x06\x11\x18\x03\x070\x10\x03\x06\x0f(\x03" +
+	"\x072\x05\x03\x06\x0f,\x03\x073\x15\x03\x06\x07\x08\x03\x05\x16\x02\x03" +
+	"\x04\x0b \x03\x05:8\x03\x05\x16%\x03\x0a\x0d\x1f\x03\x06\x16\x10\x03\x05" +
+	"\x1d5\x03\x05*;\x03\x05\x16\x1b\x03\x04.-\x03\x06\x1a\x19\x03\x04\x03," +
+	"\x03\x0b87\x03\x04/\x0a\x03\x06\x00,\x03\x04-\x01\x03\x04\x1e-\x03\x06/(" +
+	"\x03\x0a\x0b5\x03\x06\x0e7\x03\x06\x07.\x03\x0597\x03\x0a*%\x03\x0760" +
+	"\x03\x06\x0c;\x03\x05'\x00\x03\x072.\x03\x072\x08\x03\x06=\x01\x03\x06" +
+	"\x05\x1b\x03\x06\x06\x12\x03\x06$=\x03\x06'\x0d\x03\x04\x11\x0f\x03\x076" +
+	",\x03\x06\x07;\x03\x06.,\x03\x86\xf9\xea\x03\x8f\xff\xeb\x02\x092\x02" +
+	"\x095\x02\x094\x02\x09;\x02\x09>\x02\x098\x02\x09*\x02\x09/\x02\x09,\x02" +
+	"\x09%\x02\x09&\x02\x09#\x02\x09 \x02\x08!\x02\x08%\x02\x08$\x02\x08+\x02" +
+	"\x08.\x02\x08*\x02\x08&\x02\x088\x02\x08>\x02\x084\x02\x086\x02\x080\x02" +
+	"\x08\x10\x02\x08\x17\x02\x08\x12\x02\x08\x1d\x02\x08\x1f\x02\x08\x13\x02" +
+	"\x08\x15\x02\x08\x14\x02\x08\x0c\x03\x8b\xfd\xd0\x03\x81\xec\xc6\x03\x87" +
+	"\xe0\x8a\x03-2\xe3\x03\x80\xef\xe4\x03-2\xea\x03\x88\xe6\xeb\x03\x8e\xe6" +
+	"\xe8\x03\x84\xe6\xe9\x03\x97\xe6\xee\x03-2\xf9\x03-2\xf6\x03\x8e\xe3\xad" +
+	"\x03\x80\xe3\x92\x03\x88\xe3\x90\x03\x8e\xe3\x90\x03\x80\xe3\x97\x03\x88" +
+	"\xe3\x95\x03\x88\xfe\xcb\x03\x8e\xfe\xca\x03\x84\xfe\xcd\x03\x91\xef\xc9" +
+	"\x03-2\xc1\x03-2\xc0\x03-2\xcb\x03\x88@\x09\x03\x8e@\x08\x03\x8f\xe0\xf5" +
+	"\x03\x8e\xe6\xf9\x03\x8e\xe0\xfa\x03\x93\xff\xf4\x03\x84\xee\xd3\x03\x0b" +
+	"(\x04\x023 \x03\x0b)\x08\x021;\x02\x01*\x03\x0b#\x10\x03\x0b 0\x03\x0b!" +
+	"\x10\x03\x0b!0\x03\x07\x15\x08\x03\x09?5\x03\x07\x1f\x08\x03\x07\x17\x0b" +
+	"\x03\x09\x1f\x15\x03\x0b\x1c7\x03\x0a+#\x03\x06\x1a\x1b\x03\x06\x1a\x14" +
+	"\x03\x0a\x01\x18\x03\x06#\x1b\x03\x0a2\x0c\x03\x0a\x01\x04\x03\x09#;\x03" +
+	"\x08='\x03\x08\x1a\x0a\x03\x07</\x03\x07:+\x03\x07\x07*\x03\x06&\x1c\x03" +
+	"\x09\x0c\x16\x03\x09\x10\x0e\x03\x08'\x0f\x03\x08+\x09\x03\x074%\x03\x06" +
+	"!3\x03\x06\x03+\x03\x0b\x1e\x19\x03\x0a))\x03\x09\x08\x19\x03\x08,\x05" +
+	"\x03\x07<2\x03\x06\x1c>\x03\x0a\x111\x03\x09\x1b\x09\x03\x073.\x03\x07" +
+	"\x01\x00\x03\x09/,\x03\x07#>\x03\x07\x048\x03\x0a\x1f\x22\x03\x098>\x03" +
+	"\x09\x11\x00\x03\x08/\x17\x03\x06'\x22\x03\x0b\x1a+\x03\x0a\x22\x19\x03" +
+	"\x0a/1\x03\x0974\x03\x09\x0f\x22\x03\x08,\x22\x03\x08?\x14\x03\x07$5\x03" +
+	"\x07<3\x03\x07=*\x03\x07\x13\x18\x03\x068\x0a\x03\x06\x09\x16\x03\x06" +
+	"\x13\x00\x03\x08\x067\x03\x08\x01\x03\x03\x08\x12\x1d\x03\x07+7\x03\x06(" +
+	";\x03\x06\x1c?\x03\x07\x0e\x17\x03\x0a\x06\x1d\x03\x0a\x19\x07\x03\x08" +
+	"\x14$\x03\x07$;\x03\x08,$\x03\x08\x06\x0d\x03\x07\x16\x0a\x03\x06>>\x03" +
+	"\x0a\x06\x12\x03\x0a\x14)\x03\x09\x0d\x1f\x03\x09\x12\x17\x03\x09\x19" +
+	"\x01\x03\x08\x11 \x03\x08\x1d'\x03\x06<\x1a\x03\x0a.\x00\x03\x07'\x18" +
+	"\x03\x0a\x22\x08\x03\x08\x0d\x0a\x03\x08\x13)\x03\x07*)\x03\x06<,\x03" +
+	"\x07\x0b\x1a\x03\x09.\x14\x03\x09\x0d\x1e\x03\x07\x0e#\x03\x0b\x1d'\x03" +
+	"\x0a\x0a8\x03\x09%2\x03\x08+&\x03\x080\x12\x03\x0a)4\x03\x08\x06\x1f\x03" +
+	"\x0b\x1b\x1a\x03\x0a\x1b\x0f\x03\x0b\x1d*\x03\x09\x16$\x03\x090\x11\x03" +
+	"\x08\x11\x08\x03\x0a*(\x03\x0a\x042\x03\x089,\x03\x074'\x03\x07\x0f\x05" +
+	"\x03\x09\x0b\x0a\x03\x07\x1b\x01\x03\x09\x17:\x03\x09.\x0d\x03\x07.\x11" +
+	"\x03\x09+\x15\x03\x080\x13\x03\x0b\x1f\x19\x03\x0a \x11\x03\x0a\x220\x03" +
+	"\x09\x07;\x03\x08\x16\x1c\x03\x07,\x13\x03\x07\x0e/\x03\x06\x221\x03\x0a" +
+	".\x0a\x03\x0a7\x02\x03\x0a\x032\x03\x0a\x1d.\x03\x091\x06\x03\x09\x19:" +
+	"\x03\x08\x02/\x03\x060+\x03\x06\x0f-\x03\x06\x1c\x1f\x03\x06\x1d\x07\x03" +
+	"\x0a,\x11\x03\x09=\x0d\x03\x09\x0b;\x03\x07\x1b/\x03\x0a\x1f:\x03\x09 " +
+	"\x1f\x03\x09.\x10\x03\x094\x0b\x03\x09\x1a1\x03\x08#\x1a\x03\x084\x1d" +
+	"\x03\x08\x01\x1f\x03\x08\x11\x22\x03\x07'8\x03\x07\x1a>\x03\x0757\x03" +
+	"\x06&9\x03\x06+\x11\x03\x0a.\x0b\x03\x0a,>\x03\x0a4#\x03\x08%\x17\x03" +
+	"\x07\x05\x22\x03\x07\x0c\x0b\x03\x0a\x1d+\x03\x0a\x19\x16\x03\x09+\x1f" +
+	"\x03\x09\x08\x0b\x03\x08\x16\x18\x03\x08+\x12\x03\x0b\x1d\x0c\x03\x0a=" +
+	"\x10\x03\x0a\x09\x0d\x03\x0a\x10\x11\x03\x09&0\x03\x08(\x1f\x03\x087\x07" +
+	"\x03\x08\x185\x03\x07'6\x03\x06.\x05\x03\x06=\x04\x03\x06;;\x03\x06\x06," +
+	"\x03\x0b\x18>\x03\x08\x00\x18\x03\x06 \x03\x03\x06<\x00\x03\x09%\x18\x03" +
+	"\x0b\x1c<\x03\x0a%!\x03\x0a\x09\x12\x03\x0a\x16\x02\x03\x090'\x03\x09" +
+	"\x0e=\x03\x08 \x0e\x03\x08>\x03\x03\x074>\x03\x06&?\x03\x06\x19\x09\x03" +
+	"\x06?(\x03\x0a-\x0e\x03\x09:3\x03\x098:\x03\x09\x12\x0b\x03\x09\x1d\x17" +
+	"\x03\x087\x05\x03\x082\x14\x03\x08\x06%\x03\x08\x13\x1f\x03\x06\x06\x0e" +
+	"\x03\x0a\x22<\x03\x09/<\x03\x06>+\x03\x0a'?\x03\x0a\x13\x0c\x03\x09\x10<" +
+	"\x03\x07\x1b=\x03\x0a\x19\x13\x03\x09\x22\x1d\x03\x09\x07\x0d\x03\x08)" +
+	"\x1c\x03\x06=\x1a\x03\x0a/4\x03\x0a7\x11\x03\x0a\x16:\x03\x09?3\x03\x09:" +
+	"/\x03\x09\x05\x0a\x03\x09\x14\x06\x03\x087\x22\x03\x080\x07\x03\x08\x1a" +
+	"\x1f\x03\x07\x04(\x03\x07\x04\x09\x03\x06 %\x03\x06<\x08\x03\x0a+\x14" +
+	"\x03\x09\x1d\x16\x03\x0a70\x03\x08 >\x03\x0857\x03\x070\x0a\x03\x06=\x12" +
+	"\x03\x06\x16%\x03\x06\x1d,\x03\x099#\x03\x09\x10>\x03\x07 \x1e\x03\x08" +
+	"\x0c<\x03\x08\x0b\x18\x03\x08\x15+\x03\x08,:\x03\x08%\x22\x03\x07\x0a$" +
+	"\x03\x0b\x1c=\x03\x07+\x08\x03\x0a/\x05\x03\x0a \x07\x03\x0a\x12'\x03" +
+	"\x09#\x11\x03\x08\x1b\x15\x03\x0a\x06\x01\x03\x09\x1c\x1b\x03\x0922\x03" +
+	"\x07\x14<\x03\x07\x09\x04\x03\x061\x04\x03\x07\x0e\x01\x03\x0a\x13\x18" +
+	"\x03\x0a-\x0c\x03\x0a?\x0d\x03\x0a\x09\x0a\x03\x091&\x03\x0a/\x0b\x03" +
+	"\x08$<\x03\x083\x1d\x03\x08\x0c$\x03\x08\x0d\x07\x03\x08\x0d?\x03\x08" +
+	"\x0e\x14\x03\x065\x0a\x03\x08\x1a#\x03\x08\x16#\x03\x0702\x03\x07\x03" +
+	"\x1a\x03\x06(\x1d\x03\x06+\x1b\x03\x06\x0b\x05\x03\x06\x0b\x17\x03\x06" +
+	"\x0c\x04\x03\x06\x1e\x19\x03\x06+0\x03\x062\x18\x03\x0b\x16\x1e\x03\x0a+" +
+	"\x16\x03\x0a-?\x03\x0a#:\x03\x0a#\x10\x03\x0a%$\x03\x0a>+\x03\x0a01\x03" +
+	"\x0a1\x10\x03\x0a\x099\x03\x0a\x0a\x12\x03\x0a\x19\x1f\x03\x0a\x19\x12" +
+	"\x03\x09*)\x03\x09-\x16\x03\x09.1\x03\x09.2\x03\x09<\x0e\x03\x09> \x03" +
+	"\x093\x12\x03\x09\x0b\x01\x03\x09\x1c2\x03\x09\x11\x1c\x03\x09\x15%\x03" +
+	"\x08,&\x03\x08!\x22\x03\x089(\x03\x08\x0b\x1a\x03\x08\x0d2\x03\x08\x0c" +
+	"\x04\x03\x08\x0c\x06\x03\x08\x0c\x1f\x03\x08\x0c\x0c\x03\x08\x0f\x1f\x03" +
+	"\x08\x0f\x1d\x03\x08\x00\x14\x03\x08\x03\x14\x03\x08\x06\x16\x03\x08\x1e" +
+	"#\x03\x08\x11\x11\x03\x08\x10\x18\x03\x08\x14(\x03\x07)\x1e\x03\x07.1" +
+	"\x03\x07 $\x03\x07 '\x03\x078\x08\x03\x07\x0d0\x03\x07\x0f7\x03\x07\x05#" +
+	"\x03\x07\x05\x1a\x03\x07\x1a7\x03\x07\x1d-\x03\x07\x17\x10\x03\x06)\x1f" +
+	"\x03\x062\x0b\x03\x066\x16\x03\x06\x09\x11\x03\x09(\x1e\x03\x07!5\x03" +
+	"\x0b\x11\x16\x03\x0a/\x04\x03\x0a,\x1a\x03\x0b\x173\x03\x0a,1\x03\x0a/5" +
+	"\x03\x0a\x221\x03\x0a\x22\x0d\x03\x0a?%\x03\x0a<,\x03\x0a?#\x03\x0a>\x19" +
+	"\x03\x0a\x08&\x03\x0a\x0b\x0e\x03\x0a\x0c:\x03\x0a\x0c+\x03\x0a\x03\x22" +
+	"\x03\x0a\x06)\x03\x0a\x11\x10\x03\x0a\x11\x1a\x03\x0a\x17-\x03\x0a\x14(" +
+	"\x03\x09)\x1e\x03\x09/\x09\x03\x09.\x00\x03\x09,\x07\x03\x09/*\x03\x09-9" +
+	"\x03\x09\x228\x03\x09%\x09\x03\x09:\x12\x03\x09;\x1d\x03\x09?\x06\x03" +
+	"\x093%\x03\x096\x05\x03\x096\x08\x03\x097\x02\x03\x09\x07,\x03\x09\x04," +
+	"\x03\x09\x1f\x16\x03\x09\x11\x03\x03\x09\x11\x12\x03\x09\x168\x03\x08*" +
+	"\x05\x03\x08/2\x03\x084:\x03\x08\x22+\x03\x08 0\x03\x08&\x0a\x03\x08;" +
+	"\x10\x03\x08>$\x03\x08>\x18\x03\x0829\x03\x082:\x03\x081,\x03\x081<\x03" +
+	"\x081\x1c\x03\x087#\x03\x087*\x03\x08\x09'\x03\x08\x00\x1d\x03\x08\x05-" +
+	"\x03\x08\x1f4\x03\x08\x1d\x04\x03\x08\x16\x0f\x03\x07*7\x03\x07'!\x03" +
+	"\x07%\x1b\x03\x077\x0c\x03\x07\x0c1\x03\x07\x0c.\x03\x07\x00\x06\x03\x07" +
+	"\x01\x02\x03\x07\x010\x03\x07\x06=\x03\x07\x01\x03\x03\x07\x01\x13\x03" +
+	"\x07\x06\x06\x03\x07\x05\x0a\x03\x07\x1f\x09\x03\x07\x17:\x03\x06*1\x03" +
+	"\x06-\x1d\x03\x06\x223\x03\x062:\x03\x060$\x03\x066\x1e\x03\x064\x12\x03" +
+	"\x0645\x03\x06\x0b\x00\x03\x06\x0b7\x03\x06\x07\x1f\x03\x06\x15\x12\x03" +
+	"\x0c\x05\x0f\x03\x0b+\x0b\x03\x0b+-\x03\x06\x16\x1b\x03\x06\x15\x17\x03" +
+	"\x89\xca\xea\x03\x89\xca\xe8\x03\x0c8\x10\x03\x0c8\x01\x03\x0c8\x0f\x03" +
+	"\x0d8%\x03\x0d8!\x03\x0c8-\x03\x0c8/\x03\x0c8+\x03\x0c87\x03\x0c85\x03" +
+	"\x0c9\x09\x03\x0c9\x0d\x03\x0c9\x0f\x03\x0c9\x0b\x03\xcfu\x0c\x03\xcfu" +
+	"\x0f\x03\xcfu\x0e\x03\xcfu\x09\x03\x0c9\x10\x03\x0d9\x0c\x03\xcf`;\x03" +
+	"\xcf`>\x03\xcf`9\x03\xcf`8\x03\xcf`7\x03\xcf`*\x03\xcf`-\x03\xcf`,\x03" +
+	"\x0d\x1b\x1a\x03\x0d\x1b&\x03\x0c=.\x03\x0c=%\x03\x0c>\x1e\x03\x0c>\x14" +
+	"\x03\x0c?\x06\x03\x0c?\x0b\x03\x0c?\x0c\x03\x0c?\x0d\x03\x0c?\x02\x03" +
+	"\x0c>\x0f\x03\x0c>\x08\x03\x0c>\x09\x03\x0c>,\x03\x0c>\x0c\x03\x0c?\x13" +
+	"\x03\x0c?\x16\x03\x0c?\x15\x03\x0c?\x1c\x03\x0c?\x1f\x03\x0c?\x1d\x03" +
+	"\x0c?\x1a\x03\x0c?\x17\x03\x0c?\x08\x03\x0c?\x09\x03\x0c?\x0e\x03\x0c?" +
+	"\x04\x03\x0c?\x05\x03\x0c<?\x03\x0c=\x00\x03\x0c=\x06\x03\x0c=\x05\x03" +
+	"\x0c=\x0c\x03\x0c=\x0f\x03\x0c=\x0d\x03\x0c=\x0b\x03\x0c=\x07\x03\x0c=" +
+	"\x19\x03\x0c=\x15\x03\x0c=\x11\x03\x0c=1\x03\x0c=3\x03\x0c=0\x03\x0c=>" +
+	"\x03\x0c=2\x03\x0c=6\x03\x0c<\x07\x03\x0c<\x05\x03\x0e:!\x03\x0e:#\x03" +
+	"\x0e8\x09\x03\x0e:&\x03\x0e8\x0b\x03\x0e:$\x03\x0e:,\x03\x0e8\x1a\x03" +
+	"\x0e8\x1e\x03\x0e:*\x03\x0e:7\x03\x0e:5\x03\x0e:;\x03\x0e:\x15\x03\x0e:<" +
+	"\x03\x0e:4\x03\x0e:'\x03\x0e:-\x03\x0e:%\x03\x0e:?\x03\x0e:=\x03\x0e:)" +
+	"\x03\x0e:/\x03\xcfs'\x03\x0d=\x0f\x03\x0d+*\x03\x0d99\x03\x0d9;\x03\x0d9" +
+	"?\x03\x0d)\x0d\x03\x0d(%\x02\x01\x18\x02\x01(\x02\x03'\x02\x03)\x02\x03+" +
+	"\x02\x03/\x02\x03\x19\x02\x03\x1b\x02\x03\x1f\x03\x0d\x22\x18\x03\x0d" +
+	"\x22\x1a\x03\x0d\x22'\x03\x0d\x22/\x03\x0d\x223\x03\x0d\x22$\x02\x01\x1e" +
+	"\x03\x0f$!\x03\x0f87\x03\x0f4\x0e\x03\x0f5\x1d\x03\x06'\x03\x03\x0f\x08" +
+	"\x18\x03\x0f\x0d\x1b\x03\x0e2=\x03\x0e;\x08\x03\x0e:\x0b\x03\x0e\x06$" +
+	"\x03\x0e\x0d)\x03\x0e\x16\x1f\x03\x0e\x16\x1b\x03\x0d$\x0a\x03\x05,\x1d" +
+	"\x03\x0d. \x03\x0d.#\x03\x0c(/\x03\x09%\x02\x03\x0d90\x03\x0d\x0e4\x03" +
+	"\x0d\x0d\x0f\x03\x0c#\x00\x03\x0c,\x1e\x03\x0c2\x0e\x03\x0c\x01\x17\x03" +
+	"\x0c\x09:\x03\x0e\x173\x03\x0c\x08\x03\x03\x0c\x11\x07\x03\x0c\x10\x18" +
+	"\x03\x0c\x1f\x1c\x03\x0c\x19\x0e\x03\x0c\x1a\x1f\x03\x0f0>\x03\x0b->\x03" +
+	"\x0b<+\x03\x0b8\x13\x03\x0b\x043\x03\x0b\x14\x03\x03\x0b\x16%\x03\x0d" +
+	"\x22&\x03\x0b\x1a\x1a\x03\x0b\x1a\x04\x03\x0a%9\x03\x0a&2\x03\x0a&0\x03" +
+	"\x0a!\x1a\x03\x0a!7\x03\x0a5\x10\x03\x0a=4\x03\x0a?\x0e\x03\x0a>\x10\x03" +
+	"\x0a\x00 \x03\x0a\x0f:\x03\x0a\x0f9\x03\x0a\x0b\x0a\x03\x0a\x17%\x03\x0a" +
+	"\x1b-\x03\x09-\x1a\x03\x09,4\x03\x09.,\x03\x09)\x09\x03\x096!\x03\x091" +
+	"\x1f\x03\x093\x16\x03\x0c+\x1f\x03\x098 \x03\x098=\x03\x0c(\x1a\x03\x0c(" +
+	"\x16\x03\x09\x0a+\x03\x09\x16\x12\x03\x09\x13\x0e\x03\x09\x153\x03\x08)!" +
+	"\x03\x09\x1a\x01\x03\x09\x18\x01\x03\x08%#\x03\x08>\x22\x03\x08\x05%\x03" +
+	"\x08\x02*\x03\x08\x15;\x03\x08\x1b7\x03\x0f\x07\x1d\x03\x0f\x04\x03\x03" +
+	"\x070\x0c\x03\x07;\x0b\x03\x07\x08\x17\x03\x07\x12\x06\x03\x06/-\x03\x06" +
+	"71\x03\x065+\x03\x06>7\x03\x06\x049\x03\x05+\x1e\x03\x05,\x17\x03\x05 " +
+	"\x1d\x03\x05\x22\x05\x03\x050\x1d"
+
+// lookup returns the trie value for the first UTF-8 encoding in s and
+// the width in bytes of this encoding. The size will be 0 if s does not
+// hold enough bytes to complete the encoding. len(s) must be greater than 0.
+func (t *idnaTrie) lookup(s []byte) (v uint16, sz int) {
+	c0 := s[0]
+	switch {
+	case c0 < 0x80: // is ASCII
+		return idnaValues[c0], 1
+	case c0 < 0xC2:
+		return 0, 1 // Illegal UTF-8: not a starter, not ASCII.
+	case c0 < 0xE0: // 2-byte UTF-8
+		if len(s) < 2 {
+			return 0, 0
+		}
+		i := idnaIndex[c0]
+		c1 := s[1]
+		if c1 < 0x80 || 0xC0 <= c1 {
+			return 0, 1 // Illegal UTF-8: not a continuation byte.
+		}
+		return t.lookupValue(uint32(i), c1), 2
+	case c0 < 0xF0: // 3-byte UTF-8
+		if len(s) < 3 {
+			return 0, 0
+		}
+		i := idnaIndex[c0]
+		c1 := s[1]
+		if c1 < 0x80 || 0xC0 <= c1 {
+			return 0, 1 // Illegal UTF-8: not a continuation byte.
+		}
+		o := uint32(i)<<6 + uint32(c1)
+		i = idnaIndex[o]
+		c2 := s[2]
+		if c2 < 0x80 || 0xC0 <= c2 {
+			return 0, 2 // Illegal UTF-8: not a continuation byte.
+		}
+		return t.lookupValue(uint32(i), c2), 3
+	case c0 < 0xF8: // 4-byte UTF-8
+		if len(s) < 4 {
+			return 0, 0
+		}
+		i := idnaIndex[c0]
+		c1 := s[1]
+		if c1 < 0x80 || 0xC0 <= c1 {
+			return 0, 1 // Illegal UTF-8: not a continuation byte.
+		}
+		o := uint32(i)<<6 + uint32(c1)
+		i = idnaIndex[o]
+		c2 := s[2]
+		if c2 < 0x80 || 0xC0 <= c2 {
+			return 0, 2 // Illegal UTF-8: not a continuation byte.
+		}
+		o = uint32(i)<<6 + uint32(c2)
+		i = idnaIndex[o]
+		c3 := s[3]
+		if c3 < 0x80 || 0xC0 <= c3 {
+			return 0, 3 // Illegal UTF-8: not a continuation byte.
+		}
+		return t.lookupValue(uint32(i), c3), 4
+	}
+	// Illegal rune
+	return 0, 1
+}
+
+// lookupUnsafe returns the trie value for the first UTF-8 encoding in s.
+// s must start with a full and valid UTF-8 encoded rune.
+func (t *idnaTrie) lookupUnsafe(s []byte) uint16 {
+	c0 := s[0]
+	if c0 < 0x80 { // is ASCII
+		return idnaValues[c0]
+	}
+	i := idnaIndex[c0]
+	if c0 < 0xE0 { // 2-byte UTF-8
+		return t.lookupValue(uint32(i), s[1])
+	}
+	i = idnaIndex[uint32(i)<<6+uint32(s[1])]
+	if c0 < 0xF0 { // 3-byte UTF-8
+		return t.lookupValue(uint32(i), s[2])
+	}
+	i = idnaIndex[uint32(i)<<6+uint32(s[2])]
+	if c0 < 0xF8 { // 4-byte UTF-8
+		return t.lookupValue(uint32(i), s[3])
+	}
+	return 0
+}
+
+// lookupString returns the trie value for the first UTF-8 encoding in s and
+// the width in bytes of this encoding. The size will be 0 if s does not
+// hold enough bytes to complete the encoding. len(s) must be greater than 0.
+func (t *idnaTrie) lookupString(s string) (v uint16, sz int) {
+	c0 := s[0]
+	switch {
+	case c0 < 0x80: // is ASCII
+		return idnaValues[c0], 1
+	case c0 < 0xC2:
+		return 0, 1 // Illegal UTF-8: not a starter, not ASCII.
+	case c0 < 0xE0: // 2-byte UTF-8
+		if len(s) < 2 {
+			return 0, 0
+		}
+		i := idnaIndex[c0]
+		c1 := s[1]
+		if c1 < 0x80 || 0xC0 <= c1 {
+			return 0, 1 // Illegal UTF-8: not a continuation byte.
+		}
+		return t.lookupValue(uint32(i), c1), 2
+	case c0 < 0xF0: // 3-byte UTF-8
+		if len(s) < 3 {
+			return 0, 0
+		}
+		i := idnaIndex[c0]
+		c1 := s[1]
+		if c1 < 0x80 || 0xC0 <= c1 {
+			return 0, 1 // Illegal UTF-8: not a continuation byte.
+		}
+		o := uint32(i)<<6 + uint32(c1)
+		i = idnaIndex[o]
+		c2 := s[2]
+		if c2 < 0x80 || 0xC0 <= c2 {
+			return 0, 2 // Illegal UTF-8: not a continuation byte.
+		}
+		return t.lookupValue(uint32(i), c2), 3
+	case c0 < 0xF8: // 4-byte UTF-8
+		if len(s) < 4 {
+			return 0, 0
+		}
+		i := idnaIndex[c0]
+		c1 := s[1]
+		if c1 < 0x80 || 0xC0 <= c1 {
+			return 0, 1 // Illegal UTF-8: not a continuation byte.
+		}
+		o := uint32(i)<<6 + uint32(c1)
+		i = idnaIndex[o]
+		c2 := s[2]
+		if c2 < 0x80 || 0xC0 <= c2 {
+			return 0, 2 // Illegal UTF-8: not a continuation byte.
+		}
+		o = uint32(i)<<6 + uint32(c2)
+		i = idnaIndex[o]
+		c3 := s[3]
+		if c3 < 0x80 || 0xC0 <= c3 {
+			return 0, 3 // Illegal UTF-8: not a continuation byte.
+		}
+		return t.lookupValue(uint32(i), c3), 4
+	}
+	// Illegal rune
+	return 0, 1
+}
+
+// lookupStringUnsafe returns the trie value for the first UTF-8 encoding in s.
+// s must start with a full and valid UTF-8 encoded rune.
+func (t *idnaTrie) lookupStringUnsafe(s string) uint16 {
+	c0 := s[0]
+	if c0 < 0x80 { // is ASCII
+		return idnaValues[c0]
+	}
+	i := idnaIndex[c0]
+	if c0 < 0xE0 { // 2-byte UTF-8
+		return t.lookupValue(uint32(i), s[1])
+	}
+	i = idnaIndex[uint32(i)<<6+uint32(s[1])]
+	if c0 < 0xF0 { // 3-byte UTF-8
+		return t.lookupValue(uint32(i), s[2])
+	}
+	i = idnaIndex[uint32(i)<<6+uint32(s[2])]
+	if c0 < 0xF8 { // 4-byte UTF-8
+		return t.lookupValue(uint32(i), s[3])
+	}
+	return 0
+}
+
+// idnaTrie. Total size: 31598 bytes (30.86 KiB). Checksum: d3118eda0d6b5360.
+type idnaTrie struct{}
+
+func newIdnaTrie(i int) *idnaTrie {
+	return &idnaTrie{}
+}
+
+// lookupValue determines the type of block n and looks up the value for b.
+func (t *idnaTrie) lookupValue(n uint32, b byte) uint16 {
+	switch {
+	case n < 133:
+		return uint16(idnaValues[n<<6+uint32(b)])
+	default:
+		n -= 133
+		return uint16(idnaSparse.lookup(n, b))
+	}
+}
+
+// idnaValues: 135 blocks, 8640 entries, 17280 bytes
+// The third block is the zero block.
+var idnaValues = [8640]uint16{
+	// Block 0x0, offset 0x0
+	0x00: 0x0080, 0x01: 0x0080, 0x02: 0x0080, 0x03: 0x0080, 0x04: 0x0080, 0x05: 0x0080,
+	0x06: 0x0080, 0x07: 0x0080, 0x08: 0x0080, 0x09: 0x0080, 0x0a: 0x0080, 0x0b: 0x0080,
+	0x0c: 0x0080, 0x0d: 0x0080, 0x0e: 0x0080, 0x0f: 0x0080, 0x10: 0x0080, 0x11: 0x0080,
+	0x12: 0x0080, 0x13: 0x0080, 0x14: 0x0080, 0x15: 0x0080, 0x16: 0x0080, 0x17: 0x0080,
+	0x18: 0x0080, 0x19: 0x0080, 0x1a: 0x0080, 0x1b: 0x0080, 0x1c: 0x0080, 0x1d: 0x0080,
+	0x1e: 0x0080, 0x1f: 0x0080, 0x20: 0x0080, 0x21: 0x0080, 0x22: 0x0080, 0x23: 0x0080,
+	0x24: 0x0080, 0x25: 0x0080, 0x26: 0x0080, 0x27: 0x0080, 0x28: 0x0080, 0x29: 0x0080,
+	0x2a: 0x0080, 0x2b: 0x0080, 0x2c: 0x0080, 0x2d: 0x0008, 0x2e: 0x0008, 0x2f: 0x0080,
+	0x30: 0x0008, 0x31: 0x0008, 0x32: 0x0008, 0x33: 0x0008, 0x34: 0x0008, 0x35: 0x0008,
+	0x36: 0x0008, 0x37: 0x0008, 0x38: 0x0008, 0x39: 0x0008, 0x3a: 0x0080, 0x3b: 0x0080,
+	0x3c: 0x0080, 0x3d: 0x0080, 0x3e: 0x0080, 0x3f: 0x0080,
+	// Block 0x1, offset 0x40
+	0x40: 0x0080, 0x41: 0xe105, 0x42: 0xe105, 0x43: 0xe105, 0x44: 0xe105, 0x45: 0xe105,
+	0x46: 0xe105, 0x47: 0xe105, 0x48: 0xe105, 0x49: 0xe105, 0x4a: 0xe105, 0x4b: 0xe105,
+	0x4c: 0xe105, 0x4d: 0xe105, 0x4e: 0xe105, 0x4f: 0xe105, 0x50: 0xe105, 0x51: 0xe105,
+	0x52: 0xe105, 0x53: 0xe105, 0x54: 0xe105, 0x55: 0xe105, 0x56: 0xe105, 0x57: 0xe105,
+	0x58: 0xe105, 0x59: 0xe105, 0x5a: 0xe105, 0x5b: 0x0080, 0x5c: 0x0080, 0x5d: 0x0080,
+	0x5e: 0x0080, 0x5f: 0x0080, 0x60: 0x0080, 0x61: 0x0008, 0x62: 0x0008, 0x63: 0x0008,
+	0x64: 0x0008, 0x65: 0x0008, 0x66: 0x0008, 0x67: 0x0008, 0x68: 0x0008, 0x69: 0x0008,
+	0x6a: 0x0008, 0x6b: 0x0008, 0x6c: 0x0008, 0x6d: 0x0008, 0x6e: 0x0008, 0x6f: 0x0008,
+	0x70: 0x0008, 0x71: 0x0008, 0x72: 0x0008, 0x73: 0x0008, 0x74: 0x0008, 0x75: 0x0008,
+	0x76: 0x0008, 0x77: 0x0008, 0x78: 0x0008, 0x79: 0x0008, 0x7a: 0x0008, 0x7b: 0x0080,
+	0x7c: 0x0080, 0x7d: 0x0080, 0x7e: 0x0080, 0x7f: 0x0080,
+	// Block 0x2, offset 0x80
+	// Block 0x3, offset 0xc0
+	0xc0: 0x0040, 0xc1: 0x0040, 0xc2: 0x0040, 0xc3: 0x0040, 0xc4: 0x0040, 0xc5: 0x0040,
+	0xc6: 0x0040, 0xc7: 0x0040, 0xc8: 0x0040, 0xc9: 0x0040, 0xca: 0x0040, 0xcb: 0x0040,
+	0xcc: 0x0040, 0xcd: 0x0040, 0xce: 0x0040, 0xcf: 0x0040, 0xd0: 0x0040, 0xd1: 0x0040,
+	0xd2: 0x0040, 0xd3: 0x0040, 0xd4: 0x0040, 0xd5: 0x0040, 0xd6: 0x0040, 0xd7: 0x0040,
+	0xd8: 0x0040, 0xd9: 0x0040, 0xda: 0x0040, 0xdb: 0x0040, 0xdc: 0x0040, 0xdd: 0x0040,
+	0xde: 0x0040, 0xdf: 0x0040, 0xe0: 0x000a, 0xe1: 0x0018, 0xe2: 0x0018, 0xe3: 0x0018,
+	0xe4: 0x0018, 0xe5: 0x0018, 0xe6: 0x0018, 0xe7: 0x0018, 0xe8: 0x0012, 0xe9: 0x0018,
+	0xea: 0x0019, 0xeb: 0x0018, 0xec: 0x0018, 0xed: 0x03c0, 0xee: 0x0018, 0xef: 0x0022,
+	0xf0: 0x0018, 0xf1: 0x0018, 0xf2: 0x0029, 0xf3: 0x0031, 0xf4: 0x003a, 0xf5: 0x0005,
+	0xf6: 0x0018, 0xf7: 0x0008, 0xf8: 0x0042, 0xf9: 0x0049, 0xfa: 0x0051, 0xfb: 0x0018,
+	0xfc: 0x0059, 0xfd: 0x0061, 0xfe: 0x0069, 0xff: 0x0018,
+	// Block 0x4, offset 0x100
+	0x100: 0xe00d, 0x101: 0x0008, 0x102: 0xe00d, 0x103: 0x0008, 0x104: 0xe00d, 0x105: 0x0008,
+	0x106: 0xe00d, 0x107: 0x0008, 0x108: 0xe00d, 0x109: 0x0008, 0x10a: 0xe00d, 0x10b: 0x0008,
+	0x10c: 0xe00d, 0x10d: 0x0008, 0x10e: 0xe00d, 0x10f: 0x0008, 0x110: 0xe00d, 0x111: 0x0008,
+	0x112: 0xe00d, 0x113: 0x0008, 0x114: 0xe00d, 0x115: 0x0008, 0x116: 0xe00d, 0x117: 0x0008,
+	0x118: 0xe00d, 0x119: 0x0008, 0x11a: 0xe00d, 0x11b: 0x0008, 0x11c: 0xe00d, 0x11d: 0x0008,
+	0x11e: 0xe00d, 0x11f: 0x0008, 0x120: 0xe00d, 0x121: 0x0008, 0x122: 0xe00d, 0x123: 0x0008,
+	0x124: 0xe00d, 0x125: 0x0008, 0x126: 0xe00d, 0x127: 0x0008, 0x128: 0xe00d, 0x129: 0x0008,
+	0x12a: 0xe00d, 0x12b: 0x0008, 0x12c: 0xe00d, 0x12d: 0x0008, 0x12e: 0xe00d, 0x12f: 0x0008,
+	0x130: 0x0071, 0x131: 0x0008, 0x132: 0x0035, 0x133: 0x004d, 0x134: 0xe00d, 0x135: 0x0008,
+	0x136: 0xe00d, 0x137: 0x0008, 0x138: 0x0008, 0x139: 0xe01d, 0x13a: 0x0008, 0x13b: 0xe03d,
+	0x13c: 0x0008, 0x13d: 0xe01d, 0x13e: 0x0008, 0x13f: 0x0079,
+	// Block 0x5, offset 0x140
+	0x140: 0x0079, 0x141: 0xe01d, 0x142: 0x0008, 0x143: 0xe03d, 0x144: 0x0008, 0x145: 0xe01d,
+	0x146: 0x0008, 0x147: 0xe07d, 0x148: 0x0008, 0x149: 0x0081, 0x14a: 0xe00d, 0x14b: 0x0008,
+	0x14c: 0xe00d, 0x14d: 0x0008, 0x14e: 0xe00d, 0x14f: 0x0008, 0x150: 0xe00d, 0x151: 0x0008,
+	0x152: 0xe00d, 0x153: 0x0008, 0x154: 0xe00d, 0x155: 0x0008, 0x156: 0xe00d, 0x157: 0x0008,
+	0x158: 0xe00d, 0x159: 0x0008, 0x15a: 0xe00d, 0x15b: 0x0008, 0x15c: 0xe00d, 0x15d: 0x0008,
+	0x15e: 0xe00d, 0x15f: 0x0008, 0x160: 0xe00d, 0x161: 0x0008, 0x162: 0xe00d, 0x163: 0x0008,
+	0x164: 0xe00d, 0x165: 0x0008, 0x166: 0xe00d, 0x167: 0x0008, 0x168: 0xe00d, 0x169: 0x0008,
+	0x16a: 0xe00d, 0x16b: 0x0008, 0x16c: 0xe00d, 0x16d: 0x0008, 0x16e: 0xe00d, 0x16f: 0x0008,
+	0x170: 0xe00d, 0x171: 0x0008, 0x172: 0xe00d, 0x173: 0x0008, 0x174: 0xe00d, 0x175: 0x0008,
+	0x176: 0xe00d, 0x177: 0x0008, 0x178: 0x0065, 0x179: 0xe01d, 0x17a: 0x0008, 0x17b: 0xe03d,
+	0x17c: 0x0008, 0x17d: 0xe01d, 0x17e: 0x0008, 0x17f: 0x0089,
+	// Block 0x6, offset 0x180
+	0x180: 0x0008, 0x181: 0x007d, 0x182: 0xe00d, 0x183: 0x0008, 0x184: 0xe00d, 0x185: 0x0008,
+	0x186: 0x007d, 0x187: 0xe07d, 0x188: 0x0008, 0x189: 0x0095, 0x18a: 0x00ad, 0x18b: 0xe03d,
+	0x18c: 0x0008, 0x18d: 0x0008, 0x18e: 0x00c5, 0x18f: 0x00dd, 0x190: 0x00f5, 0x191: 0xe01d,
+	0x192: 0x0008, 0x193: 0x010d, 0x194: 0x0125, 0x195: 0x0008, 0x196: 0x013d, 0x197: 0x013d,
+	0x198: 0xe00d, 0x199: 0x0008, 0x19a: 0x0008, 0x19b: 0x0008, 0x19c: 0x010d, 0x19d: 0x0155,
+	0x19e: 0x0008, 0x19f: 0x016d, 0x1a0: 0xe00d, 0x1a1: 0x0008, 0x1a2: 0xe00d, 0x1a3: 0x0008,
+	0x1a4: 0xe00d, 0x1a5: 0x0008, 0x1a6: 0x0185, 0x1a7: 0xe07d, 0x1a8: 0x0008, 0x1a9: 0x019d,
+	0x1aa: 0x0008, 0x1ab: 0x0008, 0x1ac: 0xe00d, 0x1ad: 0x0008, 0x1ae: 0x0185, 0x1af: 0xe0fd,
+	0x1b0: 0x0008, 0x1b1: 0x01b5, 0x1b2: 0x01cd, 0x1b3: 0xe03d, 0x1b4: 0x0008, 0x1b5: 0xe01d,
+	0x1b6: 0x0008, 0x1b7: 0x01e5, 0x1b8: 0xe00d, 0x1b9: 0x0008, 0x1ba: 0x0008, 0x1bb: 0x0008,
+	0x1bc: 0xe00d, 0x1bd: 0x0008, 0x1be: 0x0008, 0x1bf: 0x0008,
+	// Block 0x7, offset 0x1c0
+	0x1c0: 0x0008, 0x1c1: 0x0008, 0x1c2: 0x0008, 0x1c3: 0x0008, 0x1c4: 0x0091, 0x1c5: 0x0091,
+	0x1c6: 0x0091, 0x1c7: 0x01fd, 0x1c8: 0x0215, 0x1c9: 0x022d, 0x1ca: 0x0245, 0x1cb: 0x025d,
+	0x1cc: 0x0275, 0x1cd: 0xe01d, 0x1ce: 0x0008, 0x1cf: 0xe0fd, 0x1d0: 0x0008, 0x1d1: 0xe01d,
+	0x1d2: 0x0008, 0x1d3: 0xe03d, 0x1d4: 0x0008, 0x1d5: 0xe01d, 0x1d6: 0x0008, 0x1d7: 0xe07d,
+	0x1d8: 0x0008, 0x1d9: 0xe01d, 0x1da: 0x0008, 0x1db: 0xe03d, 0x1dc: 0x0008, 0x1dd: 0x0008,
+	0x1de: 0xe00d, 0x1df: 0x0008, 0x1e0: 0xe00d, 0x1e1: 0x0008, 0x1e2: 0xe00d, 0x1e3: 0x0008,
+	0x1e4: 0xe00d, 0x1e5: 0x0008, 0x1e6: 0xe00d, 0x1e7: 0x0008, 0x1e8: 0xe00d, 0x1e9: 0x0008,
+	0x1ea: 0xe00d, 0x1eb: 0x0008, 0x1ec: 0xe00d, 0x1ed: 0x0008, 0x1ee: 0xe00d, 0x1ef: 0x0008,
+	0x1f0: 0x0008, 0x1f1: 0x028d, 0x1f2: 0x02a5, 0x1f3: 0x02bd, 0x1f4: 0xe00d, 0x1f5: 0x0008,
+	0x1f6: 0x02d5, 0x1f7: 0x02ed, 0x1f8: 0xe00d, 0x1f9: 0x0008, 0x1fa: 0xe00d, 0x1fb: 0x0008,
+	0x1fc: 0xe00d, 0x1fd: 0x0008, 0x1fe: 0xe00d, 0x1ff: 0x0008,
+	// Block 0x8, offset 0x200
+	0x200: 0xe00d, 0x201: 0x0008, 0x202: 0xe00d, 0x203: 0x0008, 0x204: 0xe00d, 0x205: 0x0008,
+	0x206: 0xe00d, 0x207: 0x0008, 0x208: 0xe00d, 0x209: 0x0008, 0x20a: 0xe00d, 0x20b: 0x0008,
+	0x20c: 0xe00d, 0x20d: 0x0008, 0x20e: 0xe00d, 0x20f: 0x0008, 0x210: 0xe00d, 0x211: 0x0008,
+	0x212: 0xe00d, 0x213: 0x0008, 0x214: 0xe00d, 0x215: 0x0008, 0x216: 0xe00d, 0x217: 0x0008,
+	0x218: 0xe00d, 0x219: 0x0008, 0x21a: 0xe00d, 0x21b: 0x0008, 0x21c: 0xe00d, 0x21d: 0x0008,
+	0x21e: 0xe00d, 0x21f: 0x0008, 0x220: 0x0305, 0x221: 0x0008, 0x222: 0xe00d, 0x223: 0x0008,
+	0x224: 0xe00d, 0x225: 0x0008, 0x226: 0xe00d, 0x227: 0x0008, 0x228: 0xe00d, 0x229: 0x0008,
+	0x22a: 0xe00d, 0x22b: 0x0008, 0x22c: 0xe00d, 0x22d: 0x0008, 0x22e: 0xe00d, 0x22f: 0x0008,
+	0x230: 0xe00d, 0x231: 0x0008, 0x232: 0xe00d, 0x233: 0x0008, 0x234: 0x0008, 0x235: 0x0008,
+	0x236: 0x0008, 0x237: 0x0008, 0x238: 0x0008, 0x239: 0x0008, 0x23a: 0x0099, 0x23b: 0xe03d,
+	0x23c: 0x0008, 0x23d: 0x031d, 0x23e: 0x00a1, 0x23f: 0x0008,
+	// Block 0x9, offset 0x240
+	0x240: 0x0008, 0x241: 0x0008, 0x242: 0x0018, 0x243: 0x0018, 0x244: 0x0018, 0x245: 0x0018,
+	0x246: 0x0008, 0x247: 0x0008, 0x248: 0x0008, 0x249: 0x0008, 0x24a: 0x0008, 0x24b: 0x0008,
+	0x24c: 0x0008, 0x24d: 0x0008, 0x24e: 0x0008, 0x24f: 0x0008, 0x250: 0x0008, 0x251: 0x0008,
+	0x252: 0x0018, 0x253: 0x0018, 0x254: 0x0018, 0x255: 0x0018, 0x256: 0x0018, 0x257: 0x0018,
+	0x258: 0x00d2, 0x259: 0x00da, 0x25a: 0x00e2, 0x25b: 0x00ea, 0x25c: 0x00f2, 0x25d: 0x00fa,
+	0x25e: 0x0018, 0x25f: 0x0018, 0x260: 0x03ad, 0x261: 0x0101, 0x262: 0x0089, 0x263: 0x0109,
+	0x264: 0x03c5, 0x265: 0x0018, 0x266: 0x0018, 0x267: 0x0018, 0x268: 0x0018, 0x269: 0x0018,
+	0x26a: 0x0018, 0x26b: 0x0018, 0x26c: 0x0008, 0x26d: 0x0018, 0x26e: 0x0008, 0x26f: 0x0018,
+	0x270: 0x0018, 0x271: 0x0018, 0x272: 0x0018, 0x273: 0x0018, 0x274: 0x0018, 0x275: 0x0018,
+	0x276: 0x0018, 0x277: 0x0018, 0x278: 0x0018, 0x279: 0x0018, 0x27a: 0x0018, 0x27b: 0x0018,
+	0x27c: 0x0018, 0x27d: 0x0018, 0x27e: 0x0018, 0x27f: 0x0018,
+	// Block 0xa, offset 0x280
+	0x280: 0x03dd, 0x281: 0x03dd, 0x282: 0x3308, 0x283: 0x03f5, 0x284: 0x0111, 0x285: 0x040d,
+	0x286: 0x3308, 0x287: 0x3308, 0x288: 0x3308, 0x289: 0x3308, 0x28a: 0x3308, 0x28b: 0x3308,
+	0x28c: 0x3308, 0x28d: 0x3308, 0x28e: 0x3308, 0x28f: 0x33c0, 0x290: 0x3308, 0x291: 0x3308,
+	0x292: 0x3308, 0x293: 0x3308, 0x294: 0x3308, 0x295: 0x3308, 0x296: 0x3308, 0x297: 0x3308,
+	0x298: 0x3308, 0x299: 0x3308, 0x29a: 0x3308, 0x29b: 0x3308, 0x29c: 0x3308, 0x29d: 0x3308,
+	0x29e: 0x3308, 0x29f: 0x3308, 0x2a0: 0x3308, 0x2a1: 0x3308, 0x2a2: 0x3308, 0x2a3: 0x3308,
+	0x2a4: 0x3308, 0x2a5: 0x3308, 0x2a6: 0x3308, 0x2a7: 0x3308, 0x2a8: 0x3308, 0x2a9: 0x3308,
+	0x2aa: 0x3308, 0x2ab: 0x3308, 0x2ac: 0x3308, 0x2ad: 0x3308, 0x2ae: 0x3308, 0x2af: 0x3308,
+	0x2b0: 0xe00d, 0x2b1: 0x0008, 0x2b2: 0xe00d, 0x2b3: 0x0008, 0x2b4: 0x0425, 0x2b5: 0x0008,
+	0x2b6: 0xe00d, 0x2b7: 0x0008, 0x2b8: 0x0040, 0x2b9: 0x0040, 0x2ba: 0x011a, 0x2bb: 0x0008,
+	0x2bc: 0x0008, 0x2bd: 0x0008, 0x2be: 0x0122, 0x2bf: 0x043d,
+	// Block 0xb, offset 0x2c0
+	0x2c0: 0x0040, 0x2c1: 0x0040, 0x2c2: 0x0040, 0x2c3: 0x0040, 0x2c4: 0x003a, 0x2c5: 0x012a,
+	0x2c6: 0xe155, 0x2c7: 0x0455, 0x2c8: 0xe12d, 0x2c9: 0xe13d, 0x2ca: 0xe12d, 0x2cb: 0x0040,
+	0x2cc: 0x03dd, 0x2cd: 0x0040, 0x2ce: 0x046d, 0x2cf: 0x0485, 0x2d0: 0x0008, 0x2d1: 0xe105,
+	0x2d2: 0xe105, 0x2d3: 0xe105, 0x2d4: 0xe105, 0x2d5: 0xe105, 0x2d6: 0xe105, 0x2d7: 0xe105,
+	0x2d8: 0xe105, 0x2d9: 0xe105, 0x2da: 0xe105, 0x2db: 0xe105, 0x2dc: 0xe105, 0x2dd: 0xe105,
+	0x2de: 0xe105, 0x2df: 0xe105, 0x2e0: 0x049d, 0x2e1: 0x049d, 0x2e2: 0x0040, 0x2e3: 0x049d,
+	0x2e4: 0x049d, 0x2e5: 0x049d, 0x2e6: 0x049d, 0x2e7: 0x049d, 0x2e8: 0x049d, 0x2e9: 0x049d,
+	0x2ea: 0x049d, 0x2eb: 0x049d, 0x2ec: 0x0008, 0x2ed: 0x0008, 0x2ee: 0x0008, 0x2ef: 0x0008,
+	0x2f0: 0x0008, 0x2f1: 0x0008, 0x2f2: 0x0008, 0x2f3: 0x0008, 0x2f4: 0x0008, 0x2f5: 0x0008,
+	0x2f6: 0x0008, 0x2f7: 0x0008, 0x2f8: 0x0008, 0x2f9: 0x0008, 0x2fa: 0x0008, 0x2fb: 0x0008,
+	0x2fc: 0x0008, 0x2fd: 0x0008, 0x2fe: 0x0008, 0x2ff: 0x0008,
+	// Block 0xc, offset 0x300
+	0x300: 0x0008, 0x301: 0x0008, 0x302: 0xe00f, 0x303: 0x0008, 0x304: 0x0008, 0x305: 0x0008,
+	0x306: 0x0008, 0x307: 0x0008, 0x308: 0x0008, 0x309: 0x0008, 0x30a: 0x0008, 0x30b: 0x0008,
+	0x30c: 0x0008, 0x30d: 0x0008, 0x30e: 0x0008, 0x30f: 0xe0c5, 0x310: 0x04b5, 0x311: 0x04cd,
+	0x312: 0xe0bd, 0x313: 0xe0f5, 0x314: 0xe0fd, 0x315: 0xe09d, 0x316: 0xe0b5, 0x317: 0x0008,
+	0x318: 0xe00d, 0x319: 0x0008, 0x31a: 0xe00d, 0x31b: 0x0008, 0x31c: 0xe00d, 0x31d: 0x0008,
+	0x31e: 0xe00d, 0x31f: 0x0008, 0x320: 0xe00d, 0x321: 0x0008, 0x322: 0xe00d, 0x323: 0x0008,
+	0x324: 0xe00d, 0x325: 0x0008, 0x326: 0xe00d, 0x327: 0x0008, 0x328: 0xe00d, 0x329: 0x0008,
+	0x32a: 0xe00d, 0x32b: 0x0008, 0x32c: 0xe00d, 0x32d: 0x0008, 0x32e: 0xe00d, 0x32f: 0x0008,
+	0x330: 0x04e5, 0x331: 0xe185, 0x332: 0xe18d, 0x333: 0x0008, 0x334: 0x04fd, 0x335: 0x03dd,
+	0x336: 0x0018, 0x337: 0xe07d, 0x338: 0x0008, 0x339: 0xe1d5, 0x33a: 0xe00d, 0x33b: 0x0008,
+	0x33c: 0x0008, 0x33d: 0x0515, 0x33e: 0x052d, 0x33f: 0x052d,
+	// Block 0xd, offset 0x340
+	0x340: 0x0008, 0x341: 0x0008, 0x342: 0x0008, 0x343: 0x0008, 0x344: 0x0008, 0x345: 0x0008,
+	0x346: 0x0008, 0x347: 0x0008, 0x348: 0x0008, 0x349: 0x0008, 0x34a: 0x0008, 0x34b: 0x0008,
+	0x34c: 0x0008, 0x34d: 0x0008, 0x34e: 0x0008, 0x34f: 0x0008, 0x350: 0x0008, 0x351: 0x0008,
+	0x352: 0x0008, 0x353: 0x0008, 0x354: 0x0008, 0x355: 0x0008, 0x356: 0x0008, 0x357: 0x0008,
+	0x358: 0x0008, 0x359: 0x0008, 0x35a: 0x0008, 0x35b: 0x0008, 0x35c: 0x0008, 0x35d: 0x0008,
+	0x35e: 0x0008, 0x35f: 0x0008, 0x360: 0xe00d, 0x361: 0x0008, 0x362: 0xe00d, 0x363: 0x0008,
+	0x364: 0xe00d, 0x365: 0x0008, 0x366: 0xe00d, 0x367: 0x0008, 0x368: 0xe00d, 0x369: 0x0008,
+	0x36a: 0xe00d, 0x36b: 0x0008, 0x36c: 0xe00d, 0x36d: 0x0008, 0x36e: 0xe00d, 0x36f: 0x0008,
+	0x370: 0xe00d, 0x371: 0x0008, 0x372: 0xe00d, 0x373: 0x0008, 0x374: 0xe00d, 0x375: 0x0008,
+	0x376: 0xe00d, 0x377: 0x0008, 0x378: 0xe00d, 0x379: 0x0008, 0x37a: 0xe00d, 0x37b: 0x0008,
+	0x37c: 0xe00d, 0x37d: 0x0008, 0x37e: 0xe00d, 0x37f: 0x0008,
+	// Block 0xe, offset 0x380
+	0x380: 0xe00d, 0x381: 0x0008, 0x382: 0x0018, 0x383: 0x3308, 0x384: 0x3308, 0x385: 0x3308,
+	0x386: 0x3308, 0x387: 0x3308, 0x388: 0x3318, 0x389: 0x3318, 0x38a: 0xe00d, 0x38b: 0x0008,
+	0x38c: 0xe00d, 0x38d: 0x0008, 0x38e: 0xe00d, 0x38f: 0x0008, 0x390: 0xe00d, 0x391: 0x0008,
+	0x392: 0xe00d, 0x393: 0x0008, 0x394: 0xe00d, 0x395: 0x0008, 0x396: 0xe00d, 0x397: 0x0008,
+	0x398: 0xe00d, 0x399: 0x0008, 0x39a: 0xe00d, 0x39b: 0x0008, 0x39c: 0xe00d, 0x39d: 0x0008,
+	0x39e: 0xe00d, 0x39f: 0x0008, 0x3a0: 0xe00d, 0x3a1: 0x0008, 0x3a2: 0xe00d, 0x3a3: 0x0008,
+	0x3a4: 0xe00d, 0x3a5: 0x0008, 0x3a6: 0xe00d, 0x3a7: 0x0008, 0x3a8: 0xe00d, 0x3a9: 0x0008,
+	0x3aa: 0xe00d, 0x3ab: 0x0008, 0x3ac: 0xe00d, 0x3ad: 0x0008, 0x3ae: 0xe00d, 0x3af: 0x0008,
+	0x3b0: 0xe00d, 0x3b1: 0x0008, 0x3b2: 0xe00d, 0x3b3: 0x0008, 0x3b4: 0xe00d, 0x3b5: 0x0008,
+	0x3b6: 0xe00d, 0x3b7: 0x0008, 0x3b8: 0xe00d, 0x3b9: 0x0008, 0x3ba: 0xe00d, 0x3bb: 0x0008,
+	0x3bc: 0xe00d, 0x3bd: 0x0008, 0x3be: 0xe00d, 0x3bf: 0x0008,
+	// Block 0xf, offset 0x3c0
+	0x3c0: 0x0040, 0x3c1: 0xe01d, 0x3c2: 0x0008, 0x3c3: 0xe03d, 0x3c4: 0x0008, 0x3c5: 0xe01d,
+	0x3c6: 0x0008, 0x3c7: 0xe07d, 0x3c8: 0x0008, 0x3c9: 0xe01d, 0x3ca: 0x0008, 0x3cb: 0xe03d,
+	0x3cc: 0x0008, 0x3cd: 0xe01d, 0x3ce: 0x0008, 0x3cf: 0x0008, 0x3d0: 0xe00d, 0x3d1: 0x0008,
+	0x3d2: 0xe00d, 0x3d3: 0x0008, 0x3d4: 0xe00d, 0x3d5: 0x0008, 0x3d6: 0xe00d, 0x3d7: 0x0008,
+	0x3d8: 0xe00d, 0x3d9: 0x0008, 0x3da: 0xe00d, 0x3db: 0x0008, 0x3dc: 0xe00d, 0x3dd: 0x0008,
+	0x3de: 0xe00d, 0x3df: 0x0008, 0x3e0: 0xe00d, 0x3e1: 0x0008, 0x3e2: 0xe00d, 0x3e3: 0x0008,
+	0x3e4: 0xe00d, 0x3e5: 0x0008, 0x3e6: 0xe00d, 0x3e7: 0x0008, 0x3e8: 0xe00d, 0x3e9: 0x0008,
+	0x3ea: 0xe00d, 0x3eb: 0x0008, 0x3ec: 0xe00d, 0x3ed: 0x0008, 0x3ee: 0xe00d, 0x3ef: 0x0008,
+	0x3f0: 0xe00d, 0x3f1: 0x0008, 0x3f2: 0xe00d, 0x3f3: 0x0008, 0x3f4: 0xe00d, 0x3f5: 0x0008,
+	0x3f6: 0xe00d, 0x3f7: 0x0008, 0x3f8: 0xe00d, 0x3f9: 0x0008, 0x3fa: 0xe00d, 0x3fb: 0x0008,
+	0x3fc: 0xe00d, 0x3fd: 0x0008, 0x3fe: 0xe00d, 0x3ff: 0x0008,
+	// Block 0x10, offset 0x400
+	0x400: 0xe00d, 0x401: 0x0008, 0x402: 0xe00d, 0x403: 0x0008, 0x404: 0xe00d, 0x405: 0x0008,
+	0x406: 0xe00d, 0x407: 0x0008, 0x408: 0xe00d, 0x409: 0x0008, 0x40a: 0xe00d, 0x40b: 0x0008,
+	0x40c: 0xe00d, 0x40d: 0x0008, 0x40e: 0xe00d, 0x40f: 0x0008, 0x410: 0xe00d, 0x411: 0x0008,
+	0x412: 0xe00d, 0x413: 0x0008, 0x414: 0xe00d, 0x415: 0x0008, 0x416: 0xe00d, 0x417: 0x0008,
+	0x418: 0xe00d, 0x419: 0x0008, 0x41a: 0xe00d, 0x41b: 0x0008, 0x41c: 0xe00d, 0x41d: 0x0008,
+	0x41e: 0xe00d, 0x41f: 0x0008, 0x420: 0xe00d, 0x421: 0x0008, 0x422: 0xe00d, 0x423: 0x0008,
+	0x424: 0xe00d, 0x425: 0x0008, 0x426: 0xe00d, 0x427: 0x0008, 0x428: 0xe00d, 0x429: 0x0008,
+	0x42a: 0xe00d, 0x42b: 0x0008, 0x42c: 0xe00d, 0x42d: 0x0008, 0x42e: 0xe00d, 0x42f: 0x0008,
+	0x430: 0x0040, 0x431: 0x03f5, 0x432: 0x03f5, 0x433: 0x03f5, 0x434: 0x03f5, 0x435: 0x03f5,
+	0x436: 0x03f5, 0x437: 0x03f5, 0x438: 0x03f5, 0x439: 0x03f5, 0x43a: 0x03f5, 0x43b: 0x03f5,
+	0x43c: 0x03f5, 0x43d: 0x03f5, 0x43e: 0x03f5, 0x43f: 0x03f5,
+	// Block 0x11, offset 0x440
+	0x440: 0x0840, 0x441: 0x0840, 0x442: 0x0840, 0x443: 0x0840, 0x444: 0x0840, 0x445: 0x0840,
+	0x446: 0x0018, 0x447: 0x0018, 0x448: 0x0818, 0x449: 0x0018, 0x44a: 0x0018, 0x44b: 0x0818,
+	0x44c: 0x0018, 0x44d: 0x0818, 0x44e: 0x0018, 0x44f: 0x0018, 0x450: 0x3308, 0x451: 0x3308,
+	0x452: 0x3308, 0x453: 0x3308, 0x454: 0x3308, 0x455: 0x3308, 0x456: 0x3308, 0x457: 0x3308,
+	0x458: 0x3308, 0x459: 0x3308, 0x45a: 0x3308, 0x45b: 0x0818, 0x45c: 0x0b40, 0x45d: 0x0818,
+	0x45e: 0x0818, 0x45f: 0x0818, 0x460: 0x0a08, 0x461: 0x0808, 0x462: 0x0c08, 0x463: 0x0c08,
+	0x464: 0x0c08, 0x465: 0x0c08, 0x466: 0x0a08, 0x467: 0x0c08, 0x468: 0x0a08, 0x469: 0x0c08,
+	0x46a: 0x0a08, 0x46b: 0x0a08, 0x46c: 0x0a08, 0x46d: 0x0a08, 0x46e: 0x0a08, 0x46f: 0x0c08,
+	0x470: 0x0c08, 0x471: 0x0c08, 0x472: 0x0c08, 0x473: 0x0a08, 0x474: 0x0a08, 0x475: 0x0a08,
+	0x476: 0x0a08, 0x477: 0x0a08, 0x478: 0x0a08, 0x479: 0x0a08, 0x47a: 0x0a08, 0x47b: 0x0a08,
+	0x47c: 0x0a08, 0x47d: 0x0a08, 0x47e: 0x0a08, 0x47f: 0x0a08,
+	// Block 0x12, offset 0x480
+	0x480: 0x0818, 0x481: 0x0a08, 0x482: 0x0a08, 0x483: 0x0a08, 0x484: 0x0a08, 0x485: 0x0a08,
+	0x486: 0x0a08, 0x487: 0x0a08, 0x488: 0x0c08, 0x489: 0x0a08, 0x48a: 0x0a08, 0x48b: 0x3308,
+	0x48c: 0x3308, 0x48d: 0x3308, 0x48e: 0x3308, 0x48f: 0x3308, 0x490: 0x3308, 0x491: 0x3308,
+	0x492: 0x3308, 0x493: 0x3308, 0x494: 0x3308, 0x495: 0x3308, 0x496: 0x3308, 0x497: 0x3308,
+	0x498: 0x3308, 0x499: 0x3308, 0x49a: 0x3308, 0x49b: 0x3308, 0x49c: 0x3308, 0x49d: 0x3308,
+	0x49e: 0x3308, 0x49f: 0x3308, 0x4a0: 0x0808, 0x4a1: 0x0808, 0x4a2: 0x0808, 0x4a3: 0x0808,
+	0x4a4: 0x0808, 0x4a5: 0x0808, 0x4a6: 0x0808, 0x4a7: 0x0808, 0x4a8: 0x0808, 0x4a9: 0x0808,
+	0x4aa: 0x0018, 0x4ab: 0x0818, 0x4ac: 0x0818, 0x4ad: 0x0818, 0x4ae: 0x0a08, 0x4af: 0x0a08,
+	0x4b0: 0x3308, 0x4b1: 0x0c08, 0x4b2: 0x0c08, 0x4b3: 0x0c08, 0x4b4: 0x0808, 0x4b5: 0x0139,
+	0x4b6: 0x0141, 0x4b7: 0x0149, 0x4b8: 0x0151, 0x4b9: 0x0a08, 0x4ba: 0x0a08, 0x4bb: 0x0a08,
+	0x4bc: 0x0a08, 0x4bd: 0x0a08, 0x4be: 0x0a08, 0x4bf: 0x0a08,
+	// Block 0x13, offset 0x4c0
+	0x4c0: 0x0c08, 0x4c1: 0x0a08, 0x4c2: 0x0a08, 0x4c3: 0x0c08, 0x4c4: 0x0c08, 0x4c5: 0x0c08,
+	0x4c6: 0x0c08, 0x4c7: 0x0c08, 0x4c8: 0x0c08, 0x4c9: 0x0c08, 0x4ca: 0x0c08, 0x4cb: 0x0c08,
+	0x4cc: 0x0a08, 0x4cd: 0x0c08, 0x4ce: 0x0a08, 0x4cf: 0x0c08, 0x4d0: 0x0a08, 0x4d1: 0x0a08,
+	0x4d2: 0x0c08, 0x4d3: 0x0c08, 0x4d4: 0x0818, 0x4d5: 0x0c08, 0x4d6: 0x3308, 0x4d7: 0x3308,
+	0x4d8: 0x3308, 0x4d9: 0x3308, 0x4da: 0x3308, 0x4db: 0x3308, 0x4dc: 0x3308, 0x4dd: 0x0840,
+	0x4de: 0x0018, 0x4df: 0x3308, 0x4e0: 0x3308, 0x4e1: 0x3308, 0x4e2: 0x3308, 0x4e3: 0x3308,
+	0x4e4: 0x3308, 0x4e5: 0x0808, 0x4e6: 0x0808, 0x4e7: 0x3308, 0x4e8: 0x3308, 0x4e9: 0x0018,
+	0x4ea: 0x3308, 0x4eb: 0x3308, 0x4ec: 0x3308, 0x4ed: 0x3308, 0x4ee: 0x0c08, 0x4ef: 0x0c08,
+	0x4f0: 0x0008, 0x4f1: 0x0008, 0x4f2: 0x0008, 0x4f3: 0x0008, 0x4f4: 0x0008, 0x4f5: 0x0008,
+	0x4f6: 0x0008, 0x4f7: 0x0008, 0x4f8: 0x0008, 0x4f9: 0x0008, 0x4fa: 0x0a08, 0x4fb: 0x0a08,
+	0x4fc: 0x0a08, 0x4fd: 0x0808, 0x4fe: 0x0808, 0x4ff: 0x0a08,
+	// Block 0x14, offset 0x500
+	0x500: 0x0818, 0x501: 0x0818, 0x502: 0x0818, 0x503: 0x0818, 0x504: 0x0818, 0x505: 0x0818,
+	0x506: 0x0818, 0x507: 0x0818, 0x508: 0x0818, 0x509: 0x0818, 0x50a: 0x0818, 0x50b: 0x0818,
+	0x50c: 0x0818, 0x50d: 0x0818, 0x50e: 0x0040, 0x50f: 0x0b40, 0x510: 0x0c08, 0x511: 0x3308,
+	0x512: 0x0a08, 0x513: 0x0a08, 0x514: 0x0a08, 0x515: 0x0c08, 0x516: 0x0c08, 0x517: 0x0c08,
+	0x518: 0x0c08, 0x519: 0x0c08, 0x51a: 0x0a08, 0x51b: 0x0a08, 0x51c: 0x0a08, 0x51d: 0x0a08,
+	0x51e: 0x0c08, 0x51f: 0x0a08, 0x520: 0x0a08, 0x521: 0x0a08, 0x522: 0x0a08, 0x523: 0x0a08,
+	0x524: 0x0a08, 0x525: 0x0a08, 0x526: 0x0a08, 0x527: 0x0a08, 0x528: 0x0c08, 0x529: 0x0a08,
+	0x52a: 0x0c08, 0x52b: 0x0a08, 0x52c: 0x0c08, 0x52d: 0x0a08, 0x52e: 0x0a08, 0x52f: 0x0c08,
+	0x530: 0x3308, 0x531: 0x3308, 0x532: 0x3308, 0x533: 0x3308, 0x534: 0x3308, 0x535: 0x3308,
+	0x536: 0x3308, 0x537: 0x3308, 0x538: 0x3308, 0x539: 0x3308, 0x53a: 0x3308, 0x53b: 0x3308,
+	0x53c: 0x3308, 0x53d: 0x3308, 0x53e: 0x3308, 0x53f: 0x3308,
+	// Block 0x15, offset 0x540
+	0x540: 0x0c08, 0x541: 0x0a08, 0x542: 0x0a08, 0x543: 0x0a08, 0x544: 0x0a08, 0x545: 0x0a08,
+	0x546: 0x0c08, 0x547: 0x0c08, 0x548: 0x0a08, 0x549: 0x0c08, 0x54a: 0x0a08, 0x54b: 0x0a08,
+	0x54c: 0x0a08, 0x54d: 0x0a08, 0x54e: 0x0a08, 0x54f: 0x0a08, 0x550: 0x0a08, 0x551: 0x0a08,
+	0x552: 0x0a08, 0x553: 0x0a08, 0x554: 0x0c08, 0x555: 0x0a08, 0x556: 0x0c08, 0x557: 0x0c08,
+	0x558: 0x0c08, 0x559: 0x3308, 0x55a: 0x3308, 0x55b: 0x3308, 0x55c: 0x0040, 0x55d: 0x0040,
+	0x55e: 0x0818, 0x55f: 0x0040, 0x560: 0x0a08, 0x561: 0x0808, 0x562: 0x0a08, 0x563: 0x0a08,
+	0x564: 0x0a08, 0x565: 0x0a08, 0x566: 0x0808, 0x567: 0x0c08, 0x568: 0x0a08, 0x569: 0x0c08,
+	0x56a: 0x0c08, 0x56b: 0x0040, 0x56c: 0x0040, 0x56d: 0x0040, 0x56e: 0x0040, 0x56f: 0x0040,
+	0x570: 0x0c08, 0x571: 0x0c08, 0x572: 0x0c08, 0x573: 0x0c08, 0x574: 0x0c08, 0x575: 0x0c08,
+	0x576: 0x0c08, 0x577: 0x0c08, 0x578: 0x0c08, 0x579: 0x0c08, 0x57a: 0x0c08, 0x57b: 0x0c08,
+	0x57c: 0x0c08, 0x57d: 0x0c08, 0x57e: 0x0c08, 0x57f: 0x0c08,
+	// Block 0x16, offset 0x580
+	0x580: 0x0c08, 0x581: 0x0c08, 0x582: 0x0c08, 0x583: 0x0808, 0x584: 0x0808, 0x585: 0x0808,
+	0x586: 0x0a08, 0x587: 0x0808, 0x588: 0x0818, 0x589: 0x0a08, 0x58a: 0x0a08, 0x58b: 0x0a08,
+	0x58c: 0x0a08, 0x58d: 0x0a08, 0x58e: 0x0c08, 0x58f: 0x0040, 0x590: 0x0840, 0x591: 0x0840,
+	0x592: 0x0040, 0x593: 0x0040, 0x594: 0x0040, 0x595: 0x0040, 0x596: 0x0040, 0x597: 0x0040,
+	0x598: 0x3308, 0x599: 0x3308, 0x59a: 0x3308, 0x59b: 0x3308, 0x59c: 0x3308, 0x59d: 0x3308,
+	0x59e: 0x3308, 0x59f: 0x3308, 0x5a0: 0x0a08, 0x5a1: 0x0a08, 0x5a2: 0x0a08, 0x5a3: 0x0a08,
+	0x5a4: 0x0a08, 0x5a5: 0x0a08, 0x5a6: 0x0a08, 0x5a7: 0x0a08, 0x5a8: 0x0a08, 0x5a9: 0x0a08,
+	0x5aa: 0x0c08, 0x5ab: 0x0c08, 0x5ac: 0x0c08, 0x5ad: 0x0808, 0x5ae: 0x0c08, 0x5af: 0x0a08,
+	0x5b0: 0x0a08, 0x5b1: 0x0c08, 0x5b2: 0x0c08, 0x5b3: 0x0a08, 0x5b4: 0x0a08, 0x5b5: 0x0a08,
+	0x5b6: 0x0a08, 0x5b7: 0x0a08, 0x5b8: 0x0a08, 0x5b9: 0x0c08, 0x5ba: 0x0a08, 0x5bb: 0x0a08,
+	0x5bc: 0x0a08, 0x5bd: 0x0a08, 0x5be: 0x0a08, 0x5bf: 0x0a08,
+	// Block 0x17, offset 0x5c0
+	0x5c0: 0x3008, 0x5c1: 0x3308, 0x5c2: 0x3308, 0x5c3: 0x3308, 0x5c4: 0x3308, 0x5c5: 0x3308,
+	0x5c6: 0x3308, 0x5c7: 0x3308, 0x5c8: 0x3308, 0x5c9: 0x3008, 0x5ca: 0x3008, 0x5cb: 0x3008,
+	0x5cc: 0x3008, 0x5cd: 0x3b08, 0x5ce: 0x3008, 0x5cf: 0x3008, 0x5d0: 0x0008, 0x5d1: 0x3308,
+	0x5d2: 0x3308, 0x5d3: 0x3308, 0x5d4: 0x3308, 0x5d5: 0x3308, 0x5d6: 0x3308, 0x5d7: 0x3308,
+	0x5d8: 0x0159, 0x5d9: 0x0161, 0x5da: 0x0169, 0x5db: 0x0171, 0x5dc: 0x0179, 0x5dd: 0x0181,
+	0x5de: 0x0189, 0x5df: 0x0191, 0x5e0: 0x0008, 0x5e1: 0x0008, 0x5e2: 0x3308, 0x5e3: 0x3308,
+	0x5e4: 0x0018, 0x5e5: 0x0018, 0x5e6: 0x0008, 0x5e7: 0x0008, 0x5e8: 0x0008, 0x5e9: 0x0008,
+	0x5ea: 0x0008, 0x5eb: 0x0008, 0x5ec: 0x0008, 0x5ed: 0x0008, 0x5ee: 0x0008, 0x5ef: 0x0008,
+	0x5f0: 0x0018, 0x5f1: 0x0008, 0x5f2: 0x0008, 0x5f3: 0x0008, 0x5f4: 0x0008, 0x5f5: 0x0008,
+	0x5f6: 0x0008, 0x5f7: 0x0008, 0x5f8: 0x0008, 0x5f9: 0x0008, 0x5fa: 0x0008, 0x5fb: 0x0008,
+	0x5fc: 0x0008, 0x5fd: 0x0008, 0x5fe: 0x0008, 0x5ff: 0x0008,
+	// Block 0x18, offset 0x600
+	0x600: 0x0008, 0x601: 0x3308, 0x602: 0x3008, 0x603: 0x3008, 0x604: 0x0040, 0x605: 0x0008,
+	0x606: 0x0008, 0x607: 0x0008, 0x608: 0x0008, 0x609: 0x0008, 0x60a: 0x0008, 0x60b: 0x0008,
+	0x60c: 0x0008, 0x60d: 0x0040, 0x60e: 0x0040, 0x60f: 0x0008, 0x610: 0x0008, 0x611: 0x0040,
+	0x612: 0x0040, 0x613: 0x0008, 0x614: 0x0008, 0x615: 0x0008, 0x616: 0x0008, 0x617: 0x0008,
+	0x618: 0x0008, 0x619: 0x0008, 0x61a: 0x0008, 0x61b: 0x0008, 0x61c: 0x0008, 0x61d: 0x0008,
+	0x61e: 0x0008, 0x61f: 0x0008, 0x620: 0x0008, 0x621: 0x0008, 0x622: 0x0008, 0x623: 0x0008,
+	0x624: 0x0008, 0x625: 0x0008, 0x626: 0x0008, 0x627: 0x0008, 0x628: 0x0008, 0x629: 0x0040,
+	0x62a: 0x0008, 0x62b: 0x0008, 0x62c: 0x0008, 0x62d: 0x0008, 0x62e: 0x0008, 0x62f: 0x0008,
+	0x630: 0x0008, 0x631: 0x0040, 0x632: 0x0008, 0x633: 0x0040, 0x634: 0x0040, 0x635: 0x0040,
+	0x636: 0x0008, 0x637: 0x0008, 0x638: 0x0008, 0x639: 0x0008, 0x63a: 0x0040, 0x63b: 0x0040,
+	0x63c: 0x3308, 0x63d: 0x0008, 0x63e: 0x3008, 0x63f: 0x3008,
+	// Block 0x19, offset 0x640
+	0x640: 0x3008, 0x641: 0x3308, 0x642: 0x3308, 0x643: 0x3308, 0x644: 0x3308, 0x645: 0x0040,
+	0x646: 0x0040, 0x647: 0x3008, 0x648: 0x3008, 0x649: 0x0040, 0x64a: 0x0040, 0x64b: 0x3008,
+	0x64c: 0x3008, 0x64d: 0x3b08, 0x64e: 0x0008, 0x64f: 0x0040, 0x650: 0x0040, 0x651: 0x0040,
+	0x652: 0x0040, 0x653: 0x0040, 0x654: 0x0040, 0x655: 0x0040, 0x656: 0x0040, 0x657: 0x3008,
+	0x658: 0x0040, 0x659: 0x0040, 0x65a: 0x0040, 0x65b: 0x0040, 0x65c: 0x0199, 0x65d: 0x01a1,
+	0x65e: 0x0040, 0x65f: 0x01a9, 0x660: 0x0008, 0x661: 0x0008, 0x662: 0x3308, 0x663: 0x3308,
+	0x664: 0x0040, 0x665: 0x0040, 0x666: 0x0008, 0x667: 0x0008, 0x668: 0x0008, 0x669: 0x0008,
+	0x66a: 0x0008, 0x66b: 0x0008, 0x66c: 0x0008, 0x66d: 0x0008, 0x66e: 0x0008, 0x66f: 0x0008,
+	0x670: 0x0008, 0x671: 0x0008, 0x672: 0x0018, 0x673: 0x0018, 0x674: 0x0018, 0x675: 0x0018,
+	0x676: 0x0018, 0x677: 0x0018, 0x678: 0x0018, 0x679: 0x0018, 0x67a: 0x0018, 0x67b: 0x0018,
+	0x67c: 0x0008, 0x67d: 0x0018, 0x67e: 0x3308, 0x67f: 0x0040,
+	// Block 0x1a, offset 0x680
+	0x680: 0x0040, 0x681: 0x3308, 0x682: 0x3308, 0x683: 0x3008, 0x684: 0x0040, 0x685: 0x0008,
+	0x686: 0x0008, 0x687: 0x0008, 0x688: 0x0008, 0x689: 0x0008, 0x68a: 0x0008, 0x68b: 0x0040,
+	0x68c: 0x0040, 0x68d: 0x0040, 0x68e: 0x0040, 0x68f: 0x0008, 0x690: 0x0008, 0x691: 0x0040,
+	0x692: 0x0040, 0x693: 0x0008, 0x694: 0x0008, 0x695: 0x0008, 0x696: 0x0008, 0x697: 0x0008,
+	0x698: 0x0008, 0x699: 0x0008, 0x69a: 0x0008, 0x69b: 0x0008, 0x69c: 0x0008, 0x69d: 0x0008,
+	0x69e: 0x0008, 0x69f: 0x0008, 0x6a0: 0x0008, 0x6a1: 0x0008, 0x6a2: 0x0008, 0x6a3: 0x0008,
+	0x6a4: 0x0008, 0x6a5: 0x0008, 0x6a6: 0x0008, 0x6a7: 0x0008, 0x6a8: 0x0008, 0x6a9: 0x0040,
+	0x6aa: 0x0008, 0x6ab: 0x0008, 0x6ac: 0x0008, 0x6ad: 0x0008, 0x6ae: 0x0008, 0x6af: 0x0008,
+	0x6b0: 0x0008, 0x6b1: 0x0040, 0x6b2: 0x0008, 0x6b3: 0x01b1, 0x6b4: 0x0040, 0x6b5: 0x0008,
+	0x6b6: 0x01b9, 0x6b7: 0x0040, 0x6b8: 0x0008, 0x6b9: 0x0008, 0x6ba: 0x0040, 0x6bb: 0x0040,
+	0x6bc: 0x3308, 0x6bd: 0x0040, 0x6be: 0x3008, 0x6bf: 0x3008,
+	// Block 0x1b, offset 0x6c0
+	0x6c0: 0x3008, 0x6c1: 0x3308, 0x6c2: 0x3308, 0x6c3: 0x0040, 0x6c4: 0x0040, 0x6c5: 0x0040,
+	0x6c6: 0x0040, 0x6c7: 0x3308, 0x6c8: 0x3308, 0x6c9: 0x0040, 0x6ca: 0x0040, 0x6cb: 0x3308,
+	0x6cc: 0x3308, 0x6cd: 0x3b08, 0x6ce: 0x0040, 0x6cf: 0x0040, 0x6d0: 0x0040, 0x6d1: 0x3308,
+	0x6d2: 0x0040, 0x6d3: 0x0040, 0x6d4: 0x0040, 0x6d5: 0x0040, 0x6d6: 0x0040, 0x6d7: 0x0040,
+	0x6d8: 0x0040, 0x6d9: 0x01c1, 0x6da: 0x01c9, 0x6db: 0x01d1, 0x6dc: 0x0008, 0x6dd: 0x0040,
+	0x6de: 0x01d9, 0x6df: 0x0040, 0x6e0: 0x0040, 0x6e1: 0x0040, 0x6e2: 0x0040, 0x6e3: 0x0040,
+	0x6e4: 0x0040, 0x6e5: 0x0040, 0x6e6: 0x0008, 0x6e7: 0x0008, 0x6e8: 0x0008, 0x6e9: 0x0008,
+	0x6ea: 0x0008, 0x6eb: 0x0008, 0x6ec: 0x0008, 0x6ed: 0x0008, 0x6ee: 0x0008, 0x6ef: 0x0008,
+	0x6f0: 0x3308, 0x6f1: 0x3308, 0x6f2: 0x0008, 0x6f3: 0x0008, 0x6f4: 0x0008, 0x6f5: 0x3308,
+	0x6f6: 0x0018, 0x6f7: 0x0040, 0x6f8: 0x0040, 0x6f9: 0x0040, 0x6fa: 0x0040, 0x6fb: 0x0040,
+	0x6fc: 0x0040, 0x6fd: 0x0040, 0x6fe: 0x0040, 0x6ff: 0x0040,
+	// Block 0x1c, offset 0x700
+	0x700: 0x0040, 0x701: 0x3308, 0x702: 0x3308, 0x703: 0x3008, 0x704: 0x0040, 0x705: 0x0008,
+	0x706: 0x0008, 0x707: 0x0008, 0x708: 0x0008, 0x709: 0x0008, 0x70a: 0x0008, 0x70b: 0x0008,
+	0x70c: 0x0008, 0x70d: 0x0008, 0x70e: 0x0040, 0x70f: 0x0008, 0x710: 0x0008, 0x711: 0x0008,
+	0x712: 0x0040, 0x713: 0x0008, 0x714: 0x0008, 0x715: 0x0008, 0x716: 0x0008, 0x717: 0x0008,
+	0x718: 0x0008, 0x719: 0x0008, 0x71a: 0x0008, 0x71b: 0x0008, 0x71c: 0x0008, 0x71d: 0x0008,
+	0x71e: 0x0008, 0x71f: 0x0008, 0x720: 0x0008, 0x721: 0x0008, 0x722: 0x0008, 0x723: 0x0008,
+	0x724: 0x0008, 0x725: 0x0008, 0x726: 0x0008, 0x727: 0x0008, 0x728: 0x0008, 0x729: 0x0040,
+	0x72a: 0x0008, 0x72b: 0x0008, 0x72c: 0x0008, 0x72d: 0x0008, 0x72e: 0x0008, 0x72f: 0x0008,
+	0x730: 0x0008, 0x731: 0x0040, 0x732: 0x0008, 0x733: 0x0008, 0x734: 0x0040, 0x735: 0x0008,
+	0x736: 0x0008, 0x737: 0x0008, 0x738: 0x0008, 0x739: 0x0008, 0x73a: 0x0040, 0x73b: 0x0040,
+	0x73c: 0x3308, 0x73d: 0x0008, 0x73e: 0x3008, 0x73f: 0x3008,
+	// Block 0x1d, offset 0x740
+	0x740: 0x3008, 0x741: 0x3308, 0x742: 0x3308, 0x743: 0x3308, 0x744: 0x3308, 0x745: 0x3308,
+	0x746: 0x0040, 0x747: 0x3308, 0x748: 0x3308, 0x749: 0x3008, 0x74a: 0x0040, 0x74b: 0x3008,
+	0x74c: 0x3008, 0x74d: 0x3b08, 0x74e: 0x0040, 0x74f: 0x0040, 0x750: 0x0008, 0x751: 0x0040,
+	0x752: 0x0040, 0x753: 0x0040, 0x754: 0x0040, 0x755: 0x0040, 0x756: 0x0040, 0x757: 0x0040,
+	0x758: 0x0040, 0x759: 0x0040, 0x75a: 0x0040, 0x75b: 0x0040, 0x75c: 0x0040, 0x75d: 0x0040,
+	0x75e: 0x0040, 0x75f: 0x0040, 0x760: 0x0008, 0x761: 0x0008, 0x762: 0x3308, 0x763: 0x3308,
+	0x764: 0x0040, 0x765: 0x0040, 0x766: 0x0008, 0x767: 0x0008, 0x768: 0x0008, 0x769: 0x0008,
+	0x76a: 0x0008, 0x76b: 0x0008, 0x76c: 0x0008, 0x76d: 0x0008, 0x76e: 0x0008, 0x76f: 0x0008,
+	0x770: 0x0018, 0x771: 0x0018, 0x772: 0x0040, 0x773: 0x0040, 0x774: 0x0040, 0x775: 0x0040,
+	0x776: 0x0040, 0x777: 0x0040, 0x778: 0x0040, 0x779: 0x0008, 0x77a: 0x3308, 0x77b: 0x3308,
+	0x77c: 0x3308, 0x77d: 0x3308, 0x77e: 0x3308, 0x77f: 0x3308,
+	// Block 0x1e, offset 0x780
+	0x780: 0x0040, 0x781: 0x3308, 0x782: 0x3008, 0x783: 0x3008, 0x784: 0x0040, 0x785: 0x0008,
+	0x786: 0x0008, 0x787: 0x0008, 0x788: 0x0008, 0x789: 0x0008, 0x78a: 0x0008, 0x78b: 0x0008,
+	0x78c: 0x0008, 0x78d: 0x0040, 0x78e: 0x0040, 0x78f: 0x0008, 0x790: 0x0008, 0x791: 0x0040,
+	0x792: 0x0040, 0x793: 0x0008, 0x794: 0x0008, 0x795: 0x0008, 0x796: 0x0008, 0x797: 0x0008,
+	0x798: 0x0008, 0x799: 0x0008, 0x79a: 0x0008, 0x79b: 0x0008, 0x79c: 0x0008, 0x79d: 0x0008,
+	0x79e: 0x0008, 0x79f: 0x0008, 0x7a0: 0x0008, 0x7a1: 0x0008, 0x7a2: 0x0008, 0x7a3: 0x0008,
+	0x7a4: 0x0008, 0x7a5: 0x0008, 0x7a6: 0x0008, 0x7a7: 0x0008, 0x7a8: 0x0008, 0x7a9: 0x0040,
+	0x7aa: 0x0008, 0x7ab: 0x0008, 0x7ac: 0x0008, 0x7ad: 0x0008, 0x7ae: 0x0008, 0x7af: 0x0008,
+	0x7b0: 0x0008, 0x7b1: 0x0040, 0x7b2: 0x0008, 0x7b3: 0x0008, 0x7b4: 0x0040, 0x7b5: 0x0008,
+	0x7b6: 0x0008, 0x7b7: 0x0008, 0x7b8: 0x0008, 0x7b9: 0x0008, 0x7ba: 0x0040, 0x7bb: 0x0040,
+	0x7bc: 0x3308, 0x7bd: 0x0008, 0x7be: 0x3008, 0x7bf: 0x3308,
+	// Block 0x1f, offset 0x7c0
+	0x7c0: 0x3008, 0x7c1: 0x3308, 0x7c2: 0x3308, 0x7c3: 0x3308, 0x7c4: 0x3308, 0x7c5: 0x0040,
+	0x7c6: 0x0040, 0x7c7: 0x3008, 0x7c8: 0x3008, 0x7c9: 0x0040, 0x7ca: 0x0040, 0x7cb: 0x3008,
+	0x7cc: 0x3008, 0x7cd: 0x3b08, 0x7ce: 0x0040, 0x7cf: 0x0040, 0x7d0: 0x0040, 0x7d1: 0x0040,
+	0x7d2: 0x0040, 0x7d3: 0x0040, 0x7d4: 0x0040, 0x7d5: 0x3308, 0x7d6: 0x3308, 0x7d7: 0x3008,
+	0x7d8: 0x0040, 0x7d9: 0x0040, 0x7da: 0x0040, 0x7db: 0x0040, 0x7dc: 0x01e1, 0x7dd: 0x01e9,
+	0x7de: 0x0040, 0x7df: 0x0008, 0x7e0: 0x0008, 0x7e1: 0x0008, 0x7e2: 0x3308, 0x7e3: 0x3308,
+	0x7e4: 0x0040, 0x7e5: 0x0040, 0x7e6: 0x0008, 0x7e7: 0x0008, 0x7e8: 0x0008, 0x7e9: 0x0008,
+	0x7ea: 0x0008, 0x7eb: 0x0008, 0x7ec: 0x0008, 0x7ed: 0x0008, 0x7ee: 0x0008, 0x7ef: 0x0008,
+	0x7f0: 0x0018, 0x7f1: 0x0008, 0x7f2: 0x0018, 0x7f3: 0x0018, 0x7f4: 0x0018, 0x7f5: 0x0018,
+	0x7f6: 0x0018, 0x7f7: 0x0018, 0x7f8: 0x0040, 0x7f9: 0x0040, 0x7fa: 0x0040, 0x7fb: 0x0040,
+	0x7fc: 0x0040, 0x7fd: 0x0040, 0x7fe: 0x0040, 0x7ff: 0x0040,
+	// Block 0x20, offset 0x800
+	0x800: 0x0040, 0x801: 0x0040, 0x802: 0x3308, 0x803: 0x0008, 0x804: 0x0040, 0x805: 0x0008,
+	0x806: 0x0008, 0x807: 0x0008, 0x808: 0x0008, 0x809: 0x0008, 0x80a: 0x0008, 0x80b: 0x0040,
+	0x80c: 0x0040, 0x80d: 0x0040, 0x80e: 0x0008, 0x80f: 0x0008, 0x810: 0x0008, 0x811: 0x0040,
+	0x812: 0x0008, 0x813: 0x0008, 0x814: 0x0008, 0x815: 0x0008, 0x816: 0x0040, 0x817: 0x0040,
+	0x818: 0x0040, 0x819: 0x0008, 0x81a: 0x0008, 0x81b: 0x0040, 0x81c: 0x0008, 0x81d: 0x0040,
+	0x81e: 0x0008, 0x81f: 0x0008, 0x820: 0x0040, 0x821: 0x0040, 0x822: 0x0040, 0x823: 0x0008,
+	0x824: 0x0008, 0x825: 0x0040, 0x826: 0x0040, 0x827: 0x0040, 0x828: 0x0008, 0x829: 0x0008,
+	0x82a: 0x0008, 0x82b: 0x0040, 0x82c: 0x0040, 0x82d: 0x0040, 0x82e: 0x0008, 0x82f: 0x0008,
+	0x830: 0x0008, 0x831: 0x0008, 0x832: 0x0008, 0x833: 0x0008, 0x834: 0x0008, 0x835: 0x0008,
+	0x836: 0x0008, 0x837: 0x0008, 0x838: 0x0008, 0x839: 0x0008, 0x83a: 0x0040, 0x83b: 0x0040,
+	0x83c: 0x0040, 0x83d: 0x0040, 0x83e: 0x3008, 0x83f: 0x3008,
+	// Block 0x21, offset 0x840
+	0x840: 0x3308, 0x841: 0x3008, 0x842: 0x3008, 0x843: 0x3008, 0x844: 0x3008, 0x845: 0x0040,
+	0x846: 0x3308, 0x847: 0x3308, 0x848: 0x3308, 0x849: 0x0040, 0x84a: 0x3308, 0x84b: 0x3308,
+	0x84c: 0x3308, 0x84d: 0x3b08, 0x84e: 0x0040, 0x84f: 0x0040, 0x850: 0x0040, 0x851: 0x0040,
+	0x852: 0x0040, 0x853: 0x0040, 0x854: 0x0040, 0x855: 0x3308, 0x856: 0x3308, 0x857: 0x0040,
+	0x858: 0x0008, 0x859: 0x0008, 0x85a: 0x0008, 0x85b: 0x0040, 0x85c: 0x0040, 0x85d: 0x0008,
+	0x85e: 0x0040, 0x85f: 0x0040, 0x860: 0x0008, 0x861: 0x0008, 0x862: 0x3308, 0x863: 0x3308,
+	0x864: 0x0040, 0x865: 0x0040, 0x866: 0x0008, 0x867: 0x0008, 0x868: 0x0008, 0x869: 0x0008,
+	0x86a: 0x0008, 0x86b: 0x0008, 0x86c: 0x0008, 0x86d: 0x0008, 0x86e: 0x0008, 0x86f: 0x0008,
+	0x870: 0x0040, 0x871: 0x0040, 0x872: 0x0040, 0x873: 0x0040, 0x874: 0x0040, 0x875: 0x0040,
+	0x876: 0x0040, 0x877: 0x0018, 0x878: 0x0018, 0x879: 0x0018, 0x87a: 0x0018, 0x87b: 0x0018,
+	0x87c: 0x0018, 0x87d: 0x0018, 0x87e: 0x0018, 0x87f: 0x0018,
+	// Block 0x22, offset 0x880
+	0x880: 0x0008, 0x881: 0x3308, 0x882: 0x3008, 0x883: 0x3008, 0x884: 0x0018, 0x885: 0x0008,
+	0x886: 0x0008, 0x887: 0x0008, 0x888: 0x0008, 0x889: 0x0008, 0x88a: 0x0008, 0x88b: 0x0008,
+	0x88c: 0x0008, 0x88d: 0x0040, 0x88e: 0x0008, 0x88f: 0x0008, 0x890: 0x0008, 0x891: 0x0040,
+	0x892: 0x0008, 0x893: 0x0008, 0x894: 0x0008, 0x895: 0x0008, 0x896: 0x0008, 0x897: 0x0008,
+	0x898: 0x0008, 0x899: 0x0008, 0x89a: 0x0008, 0x89b: 0x0008, 0x89c: 0x0008, 0x89d: 0x0008,
+	0x89e: 0x0008, 0x89f: 0x0008, 0x8a0: 0x0008, 0x8a1: 0x0008, 0x8a2: 0x0008, 0x8a3: 0x0008,
+	0x8a4: 0x0008, 0x8a5: 0x0008, 0x8a6: 0x0008, 0x8a7: 0x0008, 0x8a8: 0x0008, 0x8a9: 0x0040,
+	0x8aa: 0x0008, 0x8ab: 0x0008, 0x8ac: 0x0008, 0x8ad: 0x0008, 0x8ae: 0x0008, 0x8af: 0x0008,
+	0x8b0: 0x0008, 0x8b1: 0x0008, 0x8b2: 0x0008, 0x8b3: 0x0008, 0x8b4: 0x0040, 0x8b5: 0x0008,
+	0x8b6: 0x0008, 0x8b7: 0x0008, 0x8b8: 0x0008, 0x8b9: 0x0008, 0x8ba: 0x0040, 0x8bb: 0x0040,
+	0x8bc: 0x3308, 0x8bd: 0x0008, 0x8be: 0x3008, 0x8bf: 0x3308,
+	// Block 0x23, offset 0x8c0
+	0x8c0: 0x3008, 0x8c1: 0x3008, 0x8c2: 0x3008, 0x8c3: 0x3008, 0x8c4: 0x3008, 0x8c5: 0x0040,
+	0x8c6: 0x3308, 0x8c7: 0x3008, 0x8c8: 0x3008, 0x8c9: 0x0040, 0x8ca: 0x3008, 0x8cb: 0x3008,
+	0x8cc: 0x3308, 0x8cd: 0x3b08, 0x8ce: 0x0040, 0x8cf: 0x0040, 0x8d0: 0x0040, 0x8d1: 0x0040,
+	0x8d2: 0x0040, 0x8d3: 0x0040, 0x8d4: 0x0040, 0x8d5: 0x3008, 0x8d6: 0x3008, 0x8d7: 0x0040,
+	0x8d8: 0x0040, 0x8d9: 0x0040, 0x8da: 0x0040, 0x8db: 0x0040, 0x8dc: 0x0040, 0x8dd: 0x0008,
+	0x8de: 0x0008, 0x8df: 0x0040, 0x8e0: 0x0008, 0x8e1: 0x0008, 0x8e2: 0x3308, 0x8e3: 0x3308,
+	0x8e4: 0x0040, 0x8e5: 0x0040, 0x8e6: 0x0008, 0x8e7: 0x0008, 0x8e8: 0x0008, 0x8e9: 0x0008,
+	0x8ea: 0x0008, 0x8eb: 0x0008, 0x8ec: 0x0008, 0x8ed: 0x0008, 0x8ee: 0x0008, 0x8ef: 0x0008,
+	0x8f0: 0x0040, 0x8f1: 0x0008, 0x8f2: 0x0008, 0x8f3: 0x3008, 0x8f4: 0x0040, 0x8f5: 0x0040,
+	0x8f6: 0x0040, 0x8f7: 0x0040, 0x8f8: 0x0040, 0x8f9: 0x0040, 0x8fa: 0x0040, 0x8fb: 0x0040,
+	0x8fc: 0x0040, 0x8fd: 0x0040, 0x8fe: 0x0040, 0x8ff: 0x0040,
+	// Block 0x24, offset 0x900
+	0x900: 0x3008, 0x901: 0x3308, 0x902: 0x3308, 0x903: 0x3308, 0x904: 0x3308, 0x905: 0x0040,
+	0x906: 0x3008, 0x907: 0x3008, 0x908: 0x3008, 0x909: 0x0040, 0x90a: 0x3008, 0x90b: 0x3008,
+	0x90c: 0x3008, 0x90d: 0x3b08, 0x90e: 0x0008, 0x90f: 0x0018, 0x910: 0x0040, 0x911: 0x0040,
+	0x912: 0x0040, 0x913: 0x0040, 0x914: 0x0008, 0x915: 0x0008, 0x916: 0x0008, 0x917: 0x3008,
+	0x918: 0x0018, 0x919: 0x0018, 0x91a: 0x0018, 0x91b: 0x0018, 0x91c: 0x0018, 0x91d: 0x0018,
+	0x91e: 0x0018, 0x91f: 0x0008, 0x920: 0x0008, 0x921: 0x0008, 0x922: 0x3308, 0x923: 0x3308,
+	0x924: 0x0040, 0x925: 0x0040, 0x926: 0x0008, 0x927: 0x0008, 0x928: 0x0008, 0x929: 0x0008,
+	0x92a: 0x0008, 0x92b: 0x0008, 0x92c: 0x0008, 0x92d: 0x0008, 0x92e: 0x0008, 0x92f: 0x0008,
+	0x930: 0x0018, 0x931: 0x0018, 0x932: 0x0018, 0x933: 0x0018, 0x934: 0x0018, 0x935: 0x0018,
+	0x936: 0x0018, 0x937: 0x0018, 0x938: 0x0018, 0x939: 0x0018, 0x93a: 0x0008, 0x93b: 0x0008,
+	0x93c: 0x0008, 0x93d: 0x0008, 0x93e: 0x0008, 0x93f: 0x0008,
+	// Block 0x25, offset 0x940
+	0x940: 0x0040, 0x941: 0x0008, 0x942: 0x0008, 0x943: 0x0040, 0x944: 0x0008, 0x945: 0x0040,
+	0x946: 0x0008, 0x947: 0x0008, 0x948: 0x0008, 0x949: 0x0008, 0x94a: 0x0008, 0x94b: 0x0040,
+	0x94c: 0x0008, 0x94d: 0x0008, 0x94e: 0x0008, 0x94f: 0x0008, 0x950: 0x0008, 0x951: 0x0008,
+	0x952: 0x0008, 0x953: 0x0008, 0x954: 0x0008, 0x955: 0x0008, 0x956: 0x0008, 0x957: 0x0008,
+	0x958: 0x0008, 0x959: 0x0008, 0x95a: 0x0008, 0x95b: 0x0008, 0x95c: 0x0008, 0x95d: 0x0008,
+	0x95e: 0x0008, 0x95f: 0x0008, 0x960: 0x0008, 0x961: 0x0008, 0x962: 0x0008, 0x963: 0x0008,
+	0x964: 0x0040, 0x965: 0x0008, 0x966: 0x0040, 0x967: 0x0008, 0x968: 0x0008, 0x969: 0x0008,
+	0x96a: 0x0008, 0x96b: 0x0008, 0x96c: 0x0008, 0x96d: 0x0008, 0x96e: 0x0008, 0x96f: 0x0008,
+	0x970: 0x0008, 0x971: 0x3308, 0x972: 0x0008, 0x973: 0x01f9, 0x974: 0x3308, 0x975: 0x3308,
+	0x976: 0x3308, 0x977: 0x3308, 0x978: 0x3308, 0x979: 0x3308, 0x97a: 0x3b08, 0x97b: 0x3308,
+	0x97c: 0x3308, 0x97d: 0x0008, 0x97e: 0x0040, 0x97f: 0x0040,
+	// Block 0x26, offset 0x980
+	0x980: 0x0008, 0x981: 0x0008, 0x982: 0x0008, 0x983: 0x0211, 0x984: 0x0008, 0x985: 0x0008,
+	0x986: 0x0008, 0x987: 0x0008, 0x988: 0x0040, 0x989: 0x0008, 0x98a: 0x0008, 0x98b: 0x0008,
+	0x98c: 0x0008, 0x98d: 0x0219, 0x98e: 0x0008, 0x98f: 0x0008, 0x990: 0x0008, 0x991: 0x0008,
+	0x992: 0x0221, 0x993: 0x0008, 0x994: 0x0008, 0x995: 0x0008, 0x996: 0x0008, 0x997: 0x0229,
+	0x998: 0x0008, 0x999: 0x0008, 0x99a: 0x0008, 0x99b: 0x0008, 0x99c: 0x0231, 0x99d: 0x0008,
+	0x99e: 0x0008, 0x99f: 0x0008, 0x9a0: 0x0008, 0x9a1: 0x0008, 0x9a2: 0x0008, 0x9a3: 0x0008,
+	0x9a4: 0x0008, 0x9a5: 0x0008, 0x9a6: 0x0008, 0x9a7: 0x0008, 0x9a8: 0x0008, 0x9a9: 0x0239,
+	0x9aa: 0x0008, 0x9ab: 0x0008, 0x9ac: 0x0008, 0x9ad: 0x0040, 0x9ae: 0x0040, 0x9af: 0x0040,
+	0x9b0: 0x0040, 0x9b1: 0x3308, 0x9b2: 0x3308, 0x9b3: 0x0241, 0x9b4: 0x3308, 0x9b5: 0x0249,
+	0x9b6: 0x0251, 0x9b7: 0x0259, 0x9b8: 0x0261, 0x9b9: 0x0269, 0x9ba: 0x3308, 0x9bb: 0x3308,
+	0x9bc: 0x3308, 0x9bd: 0x3308, 0x9be: 0x3308, 0x9bf: 0x3008,
+	// Block 0x27, offset 0x9c0
+	0x9c0: 0x3308, 0x9c1: 0x0271, 0x9c2: 0x3308, 0x9c3: 0x3308, 0x9c4: 0x3b08, 0x9c5: 0x0018,
+	0x9c6: 0x3308, 0x9c7: 0x3308, 0x9c8: 0x0008, 0x9c9: 0x0008, 0x9ca: 0x0008, 0x9cb: 0x0008,
+	0x9cc: 0x0008, 0x9cd: 0x3308, 0x9ce: 0x3308, 0x9cf: 0x3308, 0x9d0: 0x3308, 0x9d1: 0x3308,
+	0x9d2: 0x3308, 0x9d3: 0x0279, 0x9d4: 0x3308, 0x9d5: 0x3308, 0x9d6: 0x3308, 0x9d7: 0x3308,
+	0x9d8: 0x0040, 0x9d9: 0x3308, 0x9da: 0x3308, 0x9db: 0x3308, 0x9dc: 0x3308, 0x9dd: 0x0281,
+	0x9de: 0x3308, 0x9df: 0x3308, 0x9e0: 0x3308, 0x9e1: 0x3308, 0x9e2: 0x0289, 0x9e3: 0x3308,
+	0x9e4: 0x3308, 0x9e5: 0x3308, 0x9e6: 0x3308, 0x9e7: 0x0291, 0x9e8: 0x3308, 0x9e9: 0x3308,
+	0x9ea: 0x3308, 0x9eb: 0x3308, 0x9ec: 0x0299, 0x9ed: 0x3308, 0x9ee: 0x3308, 0x9ef: 0x3308,
+	0x9f0: 0x3308, 0x9f1: 0x3308, 0x9f2: 0x3308, 0x9f3: 0x3308, 0x9f4: 0x3308, 0x9f5: 0x3308,
+	0x9f6: 0x3308, 0x9f7: 0x3308, 0x9f8: 0x3308, 0x9f9: 0x02a1, 0x9fa: 0x3308, 0x9fb: 0x3308,
+	0x9fc: 0x3308, 0x9fd: 0x0040, 0x9fe: 0x0018, 0x9ff: 0x0018,
+	// Block 0x28, offset 0xa00
+	0xa00: 0x0008, 0xa01: 0x0008, 0xa02: 0x0008, 0xa03: 0x0008, 0xa04: 0x0008, 0xa05: 0x0008,
+	0xa06: 0x0008, 0xa07: 0x0008, 0xa08: 0x0008, 0xa09: 0x0008, 0xa0a: 0x0008, 0xa0b: 0x0008,
+	0xa0c: 0x0008, 0xa0d: 0x0008, 0xa0e: 0x0008, 0xa0f: 0x0008, 0xa10: 0x0008, 0xa11: 0x0008,
+	0xa12: 0x0008, 0xa13: 0x0008, 0xa14: 0x0008, 0xa15: 0x0008, 0xa16: 0x0008, 0xa17: 0x0008,
+	0xa18: 0x0008, 0xa19: 0x0008, 0xa1a: 0x0008, 0xa1b: 0x0008, 0xa1c: 0x0008, 0xa1d: 0x0008,
+	0xa1e: 0x0008, 0xa1f: 0x0008, 0xa20: 0x0008, 0xa21: 0x0008, 0xa22: 0x0008, 0xa23: 0x0008,
+	0xa24: 0x0008, 0xa25: 0x0008, 0xa26: 0x0008, 0xa27: 0x0008, 0xa28: 0x0008, 0xa29: 0x0008,
+	0xa2a: 0x0008, 0xa2b: 0x0008, 0xa2c: 0x0019, 0xa2d: 0x02e1, 0xa2e: 0x02e9, 0xa2f: 0x0008,
+	0xa30: 0x02f1, 0xa31: 0x02f9, 0xa32: 0x0301, 0xa33: 0x0309, 0xa34: 0x00a9, 0xa35: 0x0311,
+	0xa36: 0x00b1, 0xa37: 0x0319, 0xa38: 0x0101, 0xa39: 0x0321, 0xa3a: 0x0329, 0xa3b: 0x0008,
+	0xa3c: 0x0051, 0xa3d: 0x0331, 0xa3e: 0x0339, 0xa3f: 0x00b9,
+	// Block 0x29, offset 0xa40
+	0xa40: 0x0341, 0xa41: 0x0349, 0xa42: 0x00c1, 0xa43: 0x0019, 0xa44: 0x0351, 0xa45: 0x0359,
+	0xa46: 0x05b5, 0xa47: 0x02e9, 0xa48: 0x02f1, 0xa49: 0x02f9, 0xa4a: 0x0361, 0xa4b: 0x0369,
+	0xa4c: 0x0371, 0xa4d: 0x0309, 0xa4e: 0x0008, 0xa4f: 0x0319, 0xa50: 0x0321, 0xa51: 0x0379,
+	0xa52: 0x0051, 0xa53: 0x0381, 0xa54: 0x05cd, 0xa55: 0x05cd, 0xa56: 0x0339, 0xa57: 0x0341,
+	0xa58: 0x0349, 0xa59: 0x05b5, 0xa5a: 0x0389, 0xa5b: 0x0391, 0xa5c: 0x05e5, 0xa5d: 0x0399,
+	0xa5e: 0x03a1, 0xa5f: 0x03a9, 0xa60: 0x03b1, 0xa61: 0x03b9, 0xa62: 0x0311, 0xa63: 0x00b9,
+	0xa64: 0x0349, 0xa65: 0x0391, 0xa66: 0x0399, 0xa67: 0x03a1, 0xa68: 0x03c1, 0xa69: 0x03b1,
+	0xa6a: 0x03b9, 0xa6b: 0x0008, 0xa6c: 0x0008, 0xa6d: 0x0008, 0xa6e: 0x0008, 0xa6f: 0x0008,
+	0xa70: 0x0008, 0xa71: 0x0008, 0xa72: 0x0008, 0xa73: 0x0008, 0xa74: 0x0008, 0xa75: 0x0008,
+	0xa76: 0x0008, 0xa77: 0x0008, 0xa78: 0x03c9, 0xa79: 0x0008, 0xa7a: 0x0008, 0xa7b: 0x0008,
+	0xa7c: 0x0008, 0xa7d: 0x0008, 0xa7e: 0x0008, 0xa7f: 0x0008,
+	// Block 0x2a, offset 0xa80
+	0xa80: 0x0008, 0xa81: 0x0008, 0xa82: 0x0008, 0xa83: 0x0008, 0xa84: 0x0008, 0xa85: 0x0008,
+	0xa86: 0x0008, 0xa87: 0x0008, 0xa88: 0x0008, 0xa89: 0x0008, 0xa8a: 0x0008, 0xa8b: 0x0008,
+	0xa8c: 0x0008, 0xa8d: 0x0008, 0xa8e: 0x0008, 0xa8f: 0x0008, 0xa90: 0x0008, 0xa91: 0x0008,
+	0xa92: 0x0008, 0xa93: 0x0008, 0xa94: 0x0008, 0xa95: 0x0008, 0xa96: 0x0008, 0xa97: 0x0008,
+	0xa98: 0x0008, 0xa99: 0x0008, 0xa9a: 0x0008, 0xa9b: 0x03d1, 0xa9c: 0x03d9, 0xa9d: 0x03e1,
+	0xa9e: 0x03e9, 0xa9f: 0x0371, 0xaa0: 0x03f1, 0xaa1: 0x03f9, 0xaa2: 0x0401, 0xaa3: 0x0409,
+	0xaa4: 0x0411, 0xaa5: 0x0419, 0xaa6: 0x0421, 0xaa7: 0x05fd, 0xaa8: 0x0429, 0xaa9: 0x0431,
+	0xaaa: 0xe17d, 0xaab: 0x0439, 0xaac: 0x0441, 0xaad: 0x0449, 0xaae: 0x0451, 0xaaf: 0x0459,
+	0xab0: 0x0461, 0xab1: 0x0469, 0xab2: 0x0471, 0xab3: 0x0479, 0xab4: 0x0481, 0xab5: 0x0489,
+	0xab6: 0x0491, 0xab7: 0x0499, 0xab8: 0x0615, 0xab9: 0x04a1, 0xaba: 0x04a9, 0xabb: 0x04b1,
+	0xabc: 0x04b9, 0xabd: 0x04c1, 0xabe: 0x04c9, 0xabf: 0x04d1,
+	// Block 0x2b, offset 0xac0
+	0xac0: 0xe00d, 0xac1: 0x0008, 0xac2: 0xe00d, 0xac3: 0x0008, 0xac4: 0xe00d, 0xac5: 0x0008,
+	0xac6: 0xe00d, 0xac7: 0x0008, 0xac8: 0xe00d, 0xac9: 0x0008, 0xaca: 0xe00d, 0xacb: 0x0008,
+	0xacc: 0xe00d, 0xacd: 0x0008, 0xace: 0xe00d, 0xacf: 0x0008, 0xad0: 0xe00d, 0xad1: 0x0008,
+	0xad2: 0xe00d, 0xad3: 0x0008, 0xad4: 0xe00d, 0xad5: 0x0008, 0xad6: 0xe00d, 0xad7: 0x0008,
+	0xad8: 0xe00d, 0xad9: 0x0008, 0xada: 0xe00d, 0xadb: 0x0008, 0xadc: 0xe00d, 0xadd: 0x0008,
+	0xade: 0xe00d, 0xadf: 0x0008, 0xae0: 0xe00d, 0xae1: 0x0008, 0xae2: 0xe00d, 0xae3: 0x0008,
+	0xae4: 0xe00d, 0xae5: 0x0008, 0xae6: 0xe00d, 0xae7: 0x0008, 0xae8: 0xe00d, 0xae9: 0x0008,
+	0xaea: 0xe00d, 0xaeb: 0x0008, 0xaec: 0xe00d, 0xaed: 0x0008, 0xaee: 0xe00d, 0xaef: 0x0008,
+	0xaf0: 0xe00d, 0xaf1: 0x0008, 0xaf2: 0xe00d, 0xaf3: 0x0008, 0xaf4: 0xe00d, 0xaf5: 0x0008,
+	0xaf6: 0xe00d, 0xaf7: 0x0008, 0xaf8: 0xe00d, 0xaf9: 0x0008, 0xafa: 0xe00d, 0xafb: 0x0008,
+	0xafc: 0xe00d, 0xafd: 0x0008, 0xafe: 0xe00d, 0xaff: 0x0008,
+	// Block 0x2c, offset 0xb00
+	0xb00: 0xe00d, 0xb01: 0x0008, 0xb02: 0xe00d, 0xb03: 0x0008, 0xb04: 0xe00d, 0xb05: 0x0008,
+	0xb06: 0xe00d, 0xb07: 0x0008, 0xb08: 0xe00d, 0xb09: 0x0008, 0xb0a: 0xe00d, 0xb0b: 0x0008,
+	0xb0c: 0xe00d, 0xb0d: 0x0008, 0xb0e: 0xe00d, 0xb0f: 0x0008, 0xb10: 0xe00d, 0xb11: 0x0008,
+	0xb12: 0xe00d, 0xb13: 0x0008, 0xb14: 0xe00d, 0xb15: 0x0008, 0xb16: 0x0008, 0xb17: 0x0008,
+	0xb18: 0x0008, 0xb19: 0x0008, 0xb1a: 0x062d, 0xb1b: 0x064d, 0xb1c: 0x0008, 0xb1d: 0x0008,
+	0xb1e: 0x04d9, 0xb1f: 0x0008, 0xb20: 0xe00d, 0xb21: 0x0008, 0xb22: 0xe00d, 0xb23: 0x0008,
+	0xb24: 0xe00d, 0xb25: 0x0008, 0xb26: 0xe00d, 0xb27: 0x0008, 0xb28: 0xe00d, 0xb29: 0x0008,
+	0xb2a: 0xe00d, 0xb2b: 0x0008, 0xb2c: 0xe00d, 0xb2d: 0x0008, 0xb2e: 0xe00d, 0xb2f: 0x0008,
+	0xb30: 0xe00d, 0xb31: 0x0008, 0xb32: 0xe00d, 0xb33: 0x0008, 0xb34: 0xe00d, 0xb35: 0x0008,
+	0xb36: 0xe00d, 0xb37: 0x0008, 0xb38: 0xe00d, 0xb39: 0x0008, 0xb3a: 0xe00d, 0xb3b: 0x0008,
+	0xb3c: 0xe00d, 0xb3d: 0x0008, 0xb3e: 0xe00d, 0xb3f: 0x0008,
+	// Block 0x2d, offset 0xb40
+	0xb40: 0x0008, 0xb41: 0x0008, 0xb42: 0x0008, 0xb43: 0x0008, 0xb44: 0x0008, 0xb45: 0x0008,
+	0xb46: 0x0040, 0xb47: 0x0040, 0xb48: 0xe045, 0xb49: 0xe045, 0xb4a: 0xe045, 0xb4b: 0xe045,
+	0xb4c: 0xe045, 0xb4d: 0xe045, 0xb4e: 0x0040, 0xb4f: 0x0040, 0xb50: 0x0008, 0xb51: 0x0008,
+	0xb52: 0x0008, 0xb53: 0x0008, 0xb54: 0x0008, 0xb55: 0x0008, 0xb56: 0x0008, 0xb57: 0x0008,
+	0xb58: 0x0040, 0xb59: 0xe045, 0xb5a: 0x0040, 0xb5b: 0xe045, 0xb5c: 0x0040, 0xb5d: 0xe045,
+	0xb5e: 0x0040, 0xb5f: 0xe045, 0xb60: 0x0008, 0xb61: 0x0008, 0xb62: 0x0008, 0xb63: 0x0008,
+	0xb64: 0x0008, 0xb65: 0x0008, 0xb66: 0x0008, 0xb67: 0x0008, 0xb68: 0xe045, 0xb69: 0xe045,
+	0xb6a: 0xe045, 0xb6b: 0xe045, 0xb6c: 0xe045, 0xb6d: 0xe045, 0xb6e: 0xe045, 0xb6f: 0xe045,
+	0xb70: 0x0008, 0xb71: 0x04e1, 0xb72: 0x0008, 0xb73: 0x04e9, 0xb74: 0x0008, 0xb75: 0x04f1,
+	0xb76: 0x0008, 0xb77: 0x04f9, 0xb78: 0x0008, 0xb79: 0x0501, 0xb7a: 0x0008, 0xb7b: 0x0509,
+	0xb7c: 0x0008, 0xb7d: 0x0511, 0xb7e: 0x0040, 0xb7f: 0x0040,
+	// Block 0x2e, offset 0xb80
+	0xb80: 0x0519, 0xb81: 0x0521, 0xb82: 0x0529, 0xb83: 0x0531, 0xb84: 0x0539, 0xb85: 0x0541,
+	0xb86: 0x0549, 0xb87: 0x0551, 0xb88: 0x0519, 0xb89: 0x0521, 0xb8a: 0x0529, 0xb8b: 0x0531,
+	0xb8c: 0x0539, 0xb8d: 0x0541, 0xb8e: 0x0549, 0xb8f: 0x0551, 0xb90: 0x0559, 0xb91: 0x0561,
+	0xb92: 0x0569, 0xb93: 0x0571, 0xb94: 0x0579, 0xb95: 0x0581, 0xb96: 0x0589, 0xb97: 0x0591,
+	0xb98: 0x0559, 0xb99: 0x0561, 0xb9a: 0x0569, 0xb9b: 0x0571, 0xb9c: 0x0579, 0xb9d: 0x0581,
+	0xb9e: 0x0589, 0xb9f: 0x0591, 0xba0: 0x0599, 0xba1: 0x05a1, 0xba2: 0x05a9, 0xba3: 0x05b1,
+	0xba4: 0x05b9, 0xba5: 0x05c1, 0xba6: 0x05c9, 0xba7: 0x05d1, 0xba8: 0x0599, 0xba9: 0x05a1,
+	0xbaa: 0x05a9, 0xbab: 0x05b1, 0xbac: 0x05b9, 0xbad: 0x05c1, 0xbae: 0x05c9, 0xbaf: 0x05d1,
+	0xbb0: 0x0008, 0xbb1: 0x0008, 0xbb2: 0x05d9, 0xbb3: 0x05e1, 0xbb4: 0x05e9, 0xbb5: 0x0040,
+	0xbb6: 0x0008, 0xbb7: 0x05f1, 0xbb8: 0xe045, 0xbb9: 0xe045, 0xbba: 0x0665, 0xbbb: 0x04e1,
+	0xbbc: 0x05e1, 0xbbd: 0x067e, 0xbbe: 0x05f9, 0xbbf: 0x069e,
+	// Block 0x2f, offset 0xbc0
+	0xbc0: 0x06be, 0xbc1: 0x0602, 0xbc2: 0x0609, 0xbc3: 0x0611, 0xbc4: 0x0619, 0xbc5: 0x0040,
+	0xbc6: 0x0008, 0xbc7: 0x0621, 0xbc8: 0x06dd, 0xbc9: 0x04e9, 0xbca: 0x06f5, 0xbcb: 0x04f1,
+	0xbcc: 0x0611, 0xbcd: 0x062a, 0xbce: 0x0632, 0xbcf: 0x063a, 0xbd0: 0x0008, 0xbd1: 0x0008,
+	0xbd2: 0x0008, 0xbd3: 0x0641, 0xbd4: 0x0040, 0xbd5: 0x0040, 0xbd6: 0x0008, 0xbd7: 0x0008,
+	0xbd8: 0xe045, 0xbd9: 0xe045, 0xbda: 0x070d, 0xbdb: 0x04f9, 0xbdc: 0x0040, 0xbdd: 0x064a,
+	0xbde: 0x0652, 0xbdf: 0x065a, 0xbe0: 0x0008, 0xbe1: 0x0008, 0xbe2: 0x0008, 0xbe3: 0x0661,
+	0xbe4: 0x0008, 0xbe5: 0x0008, 0xbe6: 0x0008, 0xbe7: 0x0008, 0xbe8: 0xe045, 0xbe9: 0xe045,
+	0xbea: 0x0725, 0xbeb: 0x0509, 0xbec: 0xe04d, 0xbed: 0x066a, 0xbee: 0x012a, 0xbef: 0x0672,
+	0xbf0: 0x0040, 0xbf1: 0x0040, 0xbf2: 0x0679, 0xbf3: 0x0681, 0xbf4: 0x0689, 0xbf5: 0x0040,
+	0xbf6: 0x0008, 0xbf7: 0x0691, 0xbf8: 0x073d, 0xbf9: 0x0501, 0xbfa: 0x0515, 0xbfb: 0x0511,
+	0xbfc: 0x0681, 0xbfd: 0x0756, 0xbfe: 0x0776, 0xbff: 0x0040,
+	// Block 0x30, offset 0xc00
+	0xc00: 0x000a, 0xc01: 0x000a, 0xc02: 0x000a, 0xc03: 0x000a, 0xc04: 0x000a, 0xc05: 0x000a,
+	0xc06: 0x000a, 0xc07: 0x000a, 0xc08: 0x000a, 0xc09: 0x000a, 0xc0a: 0x000a, 0xc0b: 0x03c0,
+	0xc0c: 0x0003, 0xc0d: 0x0003, 0xc0e: 0x0340, 0xc0f: 0x0b40, 0xc10: 0x0018, 0xc11: 0xe00d,
+	0xc12: 0x0018, 0xc13: 0x0018, 0xc14: 0x0018, 0xc15: 0x0018, 0xc16: 0x0018, 0xc17: 0x0796,
+	0xc18: 0x0018, 0xc19: 0x0018, 0xc1a: 0x0018, 0xc1b: 0x0018, 0xc1c: 0x0018, 0xc1d: 0x0018,
+	0xc1e: 0x0018, 0xc1f: 0x0018, 0xc20: 0x0018, 0xc21: 0x0018, 0xc22: 0x0018, 0xc23: 0x0018,
+	0xc24: 0x0040, 0xc25: 0x0040, 0xc26: 0x0040, 0xc27: 0x0018, 0xc28: 0x0040, 0xc29: 0x0040,
+	0xc2a: 0x0340, 0xc2b: 0x0340, 0xc2c: 0x0340, 0xc2d: 0x0340, 0xc2e: 0x0340, 0xc2f: 0x000a,
+	0xc30: 0x0018, 0xc31: 0x0018, 0xc32: 0x0018, 0xc33: 0x0699, 0xc34: 0x06a1, 0xc35: 0x0018,
+	0xc36: 0x06a9, 0xc37: 0x06b1, 0xc38: 0x0018, 0xc39: 0x0018, 0xc3a: 0x0018, 0xc3b: 0x0018,
+	0xc3c: 0x06ba, 0xc3d: 0x0018, 0xc3e: 0x07b6, 0xc3f: 0x0018,
+	// Block 0x31, offset 0xc40
+	0xc40: 0x0018, 0xc41: 0x0018, 0xc42: 0x0018, 0xc43: 0x0018, 0xc44: 0x0018, 0xc45: 0x0018,
+	0xc46: 0x0018, 0xc47: 0x06c2, 0xc48: 0x06ca, 0xc49: 0x06d2, 0xc4a: 0x0018, 0xc4b: 0x0018,
+	0xc4c: 0x0018, 0xc4d: 0x0018, 0xc4e: 0x0018, 0xc4f: 0x0018, 0xc50: 0x0018, 0xc51: 0x0018,
+	0xc52: 0x0018, 0xc53: 0x0018, 0xc54: 0x0018, 0xc55: 0x0018, 0xc56: 0x0018, 0xc57: 0x06d9,
+	0xc58: 0x0018, 0xc59: 0x0018, 0xc5a: 0x0018, 0xc5b: 0x0018, 0xc5c: 0x0018, 0xc5d: 0x0018,
+	0xc5e: 0x0018, 0xc5f: 0x000a, 0xc60: 0x03c0, 0xc61: 0x0340, 0xc62: 0x0340, 0xc63: 0x0340,
+	0xc64: 0x03c0, 0xc65: 0x0040, 0xc66: 0x0040, 0xc67: 0x0040, 0xc68: 0x0040, 0xc69: 0x0040,
+	0xc6a: 0x0340, 0xc6b: 0x0340, 0xc6c: 0x0340, 0xc6d: 0x0340, 0xc6e: 0x0340, 0xc6f: 0x0340,
+	0xc70: 0x06e1, 0xc71: 0x0311, 0xc72: 0x0040, 0xc73: 0x0040, 0xc74: 0x06e9, 0xc75: 0x06f1,
+	0xc76: 0x06f9, 0xc77: 0x0701, 0xc78: 0x0709, 0xc79: 0x0711, 0xc7a: 0x071a, 0xc7b: 0x07d5,
+	0xc7c: 0x0722, 0xc7d: 0x072a, 0xc7e: 0x0732, 0xc7f: 0x0329,
+	// Block 0x32, offset 0xc80
+	0xc80: 0x06e1, 0xc81: 0x0049, 0xc82: 0x0029, 0xc83: 0x0031, 0xc84: 0x06e9, 0xc85: 0x06f1,
+	0xc86: 0x06f9, 0xc87: 0x0701, 0xc88: 0x0709, 0xc89: 0x0711, 0xc8a: 0x071a, 0xc8b: 0x07ed,
+	0xc8c: 0x0722, 0xc8d: 0x072a, 0xc8e: 0x0732, 0xc8f: 0x0040, 0xc90: 0x0019, 0xc91: 0x02f9,
+	0xc92: 0x0051, 0xc93: 0x0109, 0xc94: 0x0361, 0xc95: 0x00a9, 0xc96: 0x0319, 0xc97: 0x0101,
+	0xc98: 0x0321, 0xc99: 0x0329, 0xc9a: 0x0339, 0xc9b: 0x0089, 0xc9c: 0x0341, 0xc9d: 0x0040,
+	0xc9e: 0x0040, 0xc9f: 0x0040, 0xca0: 0x0018, 0xca1: 0x0018, 0xca2: 0x0018, 0xca3: 0x0018,
+	0xca4: 0x0018, 0xca5: 0x0018, 0xca6: 0x0018, 0xca7: 0x0018, 0xca8: 0x0739, 0xca9: 0x0018,
+	0xcaa: 0x0018, 0xcab: 0x0018, 0xcac: 0x0018, 0xcad: 0x0018, 0xcae: 0x0018, 0xcaf: 0x0018,
+	0xcb0: 0x0018, 0xcb1: 0x0018, 0xcb2: 0x0018, 0xcb3: 0x0018, 0xcb4: 0x0018, 0xcb5: 0x0018,
+	0xcb6: 0x0018, 0xcb7: 0x0018, 0xcb8: 0x0018, 0xcb9: 0x0018, 0xcba: 0x0018, 0xcbb: 0x0018,
+	0xcbc: 0x0018, 0xcbd: 0x0018, 0xcbe: 0x0018, 0xcbf: 0x0018,
+	// Block 0x33, offset 0xcc0
+	0xcc0: 0x0806, 0xcc1: 0x0826, 0xcc2: 0x03d9, 0xcc3: 0x0845, 0xcc4: 0x0018, 0xcc5: 0x0866,
+	0xcc6: 0x0886, 0xcc7: 0x0369, 0xcc8: 0x0018, 0xcc9: 0x08a5, 0xcca: 0x0309, 0xccb: 0x00a9,
+	0xccc: 0x00a9, 0xccd: 0x00a9, 0xcce: 0x00a9, 0xccf: 0x0741, 0xcd0: 0x0311, 0xcd1: 0x0311,
+	0xcd2: 0x0101, 0xcd3: 0x0101, 0xcd4: 0x0018, 0xcd5: 0x0329, 0xcd6: 0x0749, 0xcd7: 0x0018,
+	0xcd8: 0x0018, 0xcd9: 0x0339, 0xcda: 0x0751, 0xcdb: 0x00b9, 0xcdc: 0x00b9, 0xcdd: 0x00b9,
+	0xcde: 0x0018, 0xcdf: 0x0018, 0xce0: 0x0759, 0xce1: 0x08c5, 0xce2: 0x0761, 0xce3: 0x0018,
+	0xce4: 0x04b1, 0xce5: 0x0018, 0xce6: 0x0769, 0xce7: 0x0018, 0xce8: 0x04b1, 0xce9: 0x0018,
+	0xcea: 0x0319, 0xceb: 0x0771, 0xcec: 0x02e9, 0xced: 0x03d9, 0xcee: 0x0018, 0xcef: 0x02f9,
+	0xcf0: 0x02f9, 0xcf1: 0x03f1, 0xcf2: 0x0040, 0xcf3: 0x0321, 0xcf4: 0x0051, 0xcf5: 0x0779,
+	0xcf6: 0x0781, 0xcf7: 0x0789, 0xcf8: 0x0791, 0xcf9: 0x0311, 0xcfa: 0x0018, 0xcfb: 0x08e5,
+	0xcfc: 0x0799, 0xcfd: 0x03a1, 0xcfe: 0x03a1, 0xcff: 0x0799,
+	// Block 0x34, offset 0xd00
+	0xd00: 0x0905, 0xd01: 0x0018, 0xd02: 0x0018, 0xd03: 0x0018, 0xd04: 0x0018, 0xd05: 0x02f1,
+	0xd06: 0x02f1, 0xd07: 0x02f9, 0xd08: 0x0311, 0xd09: 0x00b1, 0xd0a: 0x0018, 0xd0b: 0x0018,
+	0xd0c: 0x0018, 0xd0d: 0x0018, 0xd0e: 0x0008, 0xd0f: 0x0018, 0xd10: 0x07a1, 0xd11: 0x07a9,
+	0xd12: 0x07b1, 0xd13: 0x07b9, 0xd14: 0x07c1, 0xd15: 0x07c9, 0xd16: 0x07d1, 0xd17: 0x07d9,
+	0xd18: 0x07e1, 0xd19: 0x07e9, 0xd1a: 0x07f1, 0xd1b: 0x07f9, 0xd1c: 0x0801, 0xd1d: 0x0809,
+	0xd1e: 0x0811, 0xd1f: 0x0819, 0xd20: 0x0311, 0xd21: 0x0821, 0xd22: 0x091d, 0xd23: 0x0829,
+	0xd24: 0x0391, 0xd25: 0x0831, 0xd26: 0x093d, 0xd27: 0x0839, 0xd28: 0x0841, 0xd29: 0x0109,
+	0xd2a: 0x0849, 0xd2b: 0x095d, 0xd2c: 0x0101, 0xd2d: 0x03d9, 0xd2e: 0x02f1, 0xd2f: 0x0321,
+	0xd30: 0x0311, 0xd31: 0x0821, 0xd32: 0x097d, 0xd33: 0x0829, 0xd34: 0x0391, 0xd35: 0x0831,
+	0xd36: 0x099d, 0xd37: 0x0839, 0xd38: 0x0841, 0xd39: 0x0109, 0xd3a: 0x0849, 0xd3b: 0x09bd,
+	0xd3c: 0x0101, 0xd3d: 0x03d9, 0xd3e: 0x02f1, 0xd3f: 0x0321,
+	// Block 0x35, offset 0xd40
+	0xd40: 0x0018, 0xd41: 0x0018, 0xd42: 0x0018, 0xd43: 0x0018, 0xd44: 0x0018, 0xd45: 0x0018,
+	0xd46: 0x0018, 0xd47: 0x0018, 0xd48: 0x0018, 0xd49: 0x0018, 0xd4a: 0x0018, 0xd4b: 0x0040,
+	0xd4c: 0x0040, 0xd4d: 0x0040, 0xd4e: 0x0040, 0xd4f: 0x0040, 0xd50: 0x0040, 0xd51: 0x0040,
+	0xd52: 0x0040, 0xd53: 0x0040, 0xd54: 0x0040, 0xd55: 0x0040, 0xd56: 0x0040, 0xd57: 0x0040,
+	0xd58: 0x0040, 0xd59: 0x0040, 0xd5a: 0x0040, 0xd5b: 0x0040, 0xd5c: 0x0040, 0xd5d: 0x0040,
+	0xd5e: 0x0040, 0xd5f: 0x0040, 0xd60: 0x0049, 0xd61: 0x0029, 0xd62: 0x0031, 0xd63: 0x06e9,
+	0xd64: 0x06f1, 0xd65: 0x06f9, 0xd66: 0x0701, 0xd67: 0x0709, 0xd68: 0x0711, 0xd69: 0x0879,
+	0xd6a: 0x0881, 0xd6b: 0x0889, 0xd6c: 0x0891, 0xd6d: 0x0899, 0xd6e: 0x08a1, 0xd6f: 0x08a9,
+	0xd70: 0x08b1, 0xd71: 0x08b9, 0xd72: 0x08c1, 0xd73: 0x08c9, 0xd74: 0x0a1e, 0xd75: 0x0a3e,
+	0xd76: 0x0a5e, 0xd77: 0x0a7e, 0xd78: 0x0a9e, 0xd79: 0x0abe, 0xd7a: 0x0ade, 0xd7b: 0x0afe,
+	0xd7c: 0x0b1e, 0xd7d: 0x08d2, 0xd7e: 0x08da, 0xd7f: 0x08e2,
+	// Block 0x36, offset 0xd80
+	0xd80: 0x08ea, 0xd81: 0x08f2, 0xd82: 0x08fa, 0xd83: 0x0902, 0xd84: 0x090a, 0xd85: 0x0912,
+	0xd86: 0x091a, 0xd87: 0x0922, 0xd88: 0x0040, 0xd89: 0x0040, 0xd8a: 0x0040, 0xd8b: 0x0040,
+	0xd8c: 0x0040, 0xd8d: 0x0040, 0xd8e: 0x0040, 0xd8f: 0x0040, 0xd90: 0x0040, 0xd91: 0x0040,
+	0xd92: 0x0040, 0xd93: 0x0040, 0xd94: 0x0040, 0xd95: 0x0040, 0xd96: 0x0040, 0xd97: 0x0040,
+	0xd98: 0x0040, 0xd99: 0x0040, 0xd9a: 0x0040, 0xd9b: 0x0040, 0xd9c: 0x0b3e, 0xd9d: 0x0b5e,
+	0xd9e: 0x0b7e, 0xd9f: 0x0b9e, 0xda0: 0x0bbe, 0xda1: 0x0bde, 0xda2: 0x0bfe, 0xda3: 0x0c1e,
+	0xda4: 0x0c3e, 0xda5: 0x0c5e, 0xda6: 0x0c7e, 0xda7: 0x0c9e, 0xda8: 0x0cbe, 0xda9: 0x0cde,
+	0xdaa: 0x0cfe, 0xdab: 0x0d1e, 0xdac: 0x0d3e, 0xdad: 0x0d5e, 0xdae: 0x0d7e, 0xdaf: 0x0d9e,
+	0xdb0: 0x0dbe, 0xdb1: 0x0dde, 0xdb2: 0x0dfe, 0xdb3: 0x0e1e, 0xdb4: 0x0e3e, 0xdb5: 0x0e5e,
+	0xdb6: 0x0019, 0xdb7: 0x02e9, 0xdb8: 0x03d9, 0xdb9: 0x02f1, 0xdba: 0x02f9, 0xdbb: 0x03f1,
+	0xdbc: 0x0309, 0xdbd: 0x00a9, 0xdbe: 0x0311, 0xdbf: 0x00b1,
+	// Block 0x37, offset 0xdc0
+	0xdc0: 0x0319, 0xdc1: 0x0101, 0xdc2: 0x0321, 0xdc3: 0x0329, 0xdc4: 0x0051, 0xdc5: 0x0339,
+	0xdc6: 0x0751, 0xdc7: 0x00b9, 0xdc8: 0x0089, 0xdc9: 0x0341, 0xdca: 0x0349, 0xdcb: 0x0391,
+	0xdcc: 0x00c1, 0xdcd: 0x0109, 0xdce: 0x00c9, 0xdcf: 0x04b1, 0xdd0: 0x0019, 0xdd1: 0x02e9,
+	0xdd2: 0x03d9, 0xdd3: 0x02f1, 0xdd4: 0x02f9, 0xdd5: 0x03f1, 0xdd6: 0x0309, 0xdd7: 0x00a9,
+	0xdd8: 0x0311, 0xdd9: 0x00b1, 0xdda: 0x0319, 0xddb: 0x0101, 0xddc: 0x0321, 0xddd: 0x0329,
+	0xdde: 0x0051, 0xddf: 0x0339, 0xde0: 0x0751, 0xde1: 0x00b9, 0xde2: 0x0089, 0xde3: 0x0341,
+	0xde4: 0x0349, 0xde5: 0x0391, 0xde6: 0x00c1, 0xde7: 0x0109, 0xde8: 0x00c9, 0xde9: 0x04b1,
+	0xdea: 0x06e1, 0xdeb: 0x0018, 0xdec: 0x0018, 0xded: 0x0018, 0xdee: 0x0018, 0xdef: 0x0018,
+	0xdf0: 0x0018, 0xdf1: 0x0018, 0xdf2: 0x0018, 0xdf3: 0x0018, 0xdf4: 0x0018, 0xdf5: 0x0018,
+	0xdf6: 0x0018, 0xdf7: 0x0018, 0xdf8: 0x0018, 0xdf9: 0x0018, 0xdfa: 0x0018, 0xdfb: 0x0018,
+	0xdfc: 0x0018, 0xdfd: 0x0018, 0xdfe: 0x0018, 0xdff: 0x0018,
+	// Block 0x38, offset 0xe00
+	0xe00: 0x0008, 0xe01: 0x0008, 0xe02: 0x0008, 0xe03: 0x0008, 0xe04: 0x0008, 0xe05: 0x0008,
+	0xe06: 0x0008, 0xe07: 0x0008, 0xe08: 0x0008, 0xe09: 0x0008, 0xe0a: 0x0008, 0xe0b: 0x0008,
+	0xe0c: 0x0008, 0xe0d: 0x0008, 0xe0e: 0x0008, 0xe0f: 0x0008, 0xe10: 0x0008, 0xe11: 0x0008,
+	0xe12: 0x0008, 0xe13: 0x0008, 0xe14: 0x0008, 0xe15: 0x0008, 0xe16: 0x0008, 0xe17: 0x0008,
+	0xe18: 0x0008, 0xe19: 0x0008, 0xe1a: 0x0008, 0xe1b: 0x0008, 0xe1c: 0x0008, 0xe1d: 0x0008,
+	0xe1e: 0x0008, 0xe1f: 0x0008, 0xe20: 0xe00d, 0xe21: 0x0008, 0xe22: 0x0941, 0xe23: 0x0ed5,
+	0xe24: 0x0949, 0xe25: 0x0008, 0xe26: 0x0008, 0xe27: 0xe07d, 0xe28: 0x0008, 0xe29: 0xe01d,
+	0xe2a: 0x0008, 0xe2b: 0xe03d, 0xe2c: 0x0008, 0xe2d: 0x0359, 0xe2e: 0x0441, 0xe2f: 0x0351,
+	0xe30: 0x03d1, 0xe31: 0x0008, 0xe32: 0xe00d, 0xe33: 0x0008, 0xe34: 0x0008, 0xe35: 0xe01d,
+	0xe36: 0x0008, 0xe37: 0x0008, 0xe38: 0x0008, 0xe39: 0x0008, 0xe3a: 0x0008, 0xe3b: 0x0008,
+	0xe3c: 0x00b1, 0xe3d: 0x0391, 0xe3e: 0x0951, 0xe3f: 0x0959,
+	// Block 0x39, offset 0xe40
+	0xe40: 0xe00d, 0xe41: 0x0008, 0xe42: 0xe00d, 0xe43: 0x0008, 0xe44: 0xe00d, 0xe45: 0x0008,
+	0xe46: 0xe00d, 0xe47: 0x0008, 0xe48: 0xe00d, 0xe49: 0x0008, 0xe4a: 0xe00d, 0xe4b: 0x0008,
+	0xe4c: 0xe00d, 0xe4d: 0x0008, 0xe4e: 0xe00d, 0xe4f: 0x0008, 0xe50: 0xe00d, 0xe51: 0x0008,
+	0xe52: 0xe00d, 0xe53: 0x0008, 0xe54: 0xe00d, 0xe55: 0x0008, 0xe56: 0xe00d, 0xe57: 0x0008,
+	0xe58: 0xe00d, 0xe59: 0x0008, 0xe5a: 0xe00d, 0xe5b: 0x0008, 0xe5c: 0xe00d, 0xe5d: 0x0008,
+	0xe5e: 0xe00d, 0xe5f: 0x0008, 0xe60: 0xe00d, 0xe61: 0x0008, 0xe62: 0xe00d, 0xe63: 0x0008,
+	0xe64: 0x0008, 0xe65: 0x0018, 0xe66: 0x0018, 0xe67: 0x0018, 0xe68: 0x0018, 0xe69: 0x0018,
+	0xe6a: 0x0018, 0xe6b: 0xe03d, 0xe6c: 0x0008, 0xe6d: 0xe01d, 0xe6e: 0x0008, 0xe6f: 0x3308,
+	0xe70: 0x3308, 0xe71: 0x3308, 0xe72: 0xe00d, 0xe73: 0x0008, 0xe74: 0x0040, 0xe75: 0x0040,
+	0xe76: 0x0040, 0xe77: 0x0040, 0xe78: 0x0040, 0xe79: 0x0018, 0xe7a: 0x0018, 0xe7b: 0x0018,
+	0xe7c: 0x0018, 0xe7d: 0x0018, 0xe7e: 0x0018, 0xe7f: 0x0018,
+	// Block 0x3a, offset 0xe80
+	0xe80: 0x2715, 0xe81: 0x2735, 0xe82: 0x2755, 0xe83: 0x2775, 0xe84: 0x2795, 0xe85: 0x27b5,
+	0xe86: 0x27d5, 0xe87: 0x27f5, 0xe88: 0x2815, 0xe89: 0x2835, 0xe8a: 0x2855, 0xe8b: 0x2875,
+	0xe8c: 0x2895, 0xe8d: 0x28b5, 0xe8e: 0x28d5, 0xe8f: 0x28f5, 0xe90: 0x2915, 0xe91: 0x2935,
+	0xe92: 0x2955, 0xe93: 0x2975, 0xe94: 0x2995, 0xe95: 0x29b5, 0xe96: 0x0040, 0xe97: 0x0040,
+	0xe98: 0x0040, 0xe99: 0x0040, 0xe9a: 0x0040, 0xe9b: 0x0040, 0xe9c: 0x0040, 0xe9d: 0x0040,
+	0xe9e: 0x0040, 0xe9f: 0x0040, 0xea0: 0x0040, 0xea1: 0x0040, 0xea2: 0x0040, 0xea3: 0x0040,
+	0xea4: 0x0040, 0xea5: 0x0040, 0xea6: 0x0040, 0xea7: 0x0040, 0xea8: 0x0040, 0xea9: 0x0040,
+	0xeaa: 0x0040, 0xeab: 0x0040, 0xeac: 0x0040, 0xead: 0x0040, 0xeae: 0x0040, 0xeaf: 0x0040,
+	0xeb0: 0x0040, 0xeb1: 0x0040, 0xeb2: 0x0040, 0xeb3: 0x0040, 0xeb4: 0x0040, 0xeb5: 0x0040,
+	0xeb6: 0x0040, 0xeb7: 0x0040, 0xeb8: 0x0040, 0xeb9: 0x0040, 0xeba: 0x0040, 0xebb: 0x0040,
+	0xebc: 0x0040, 0xebd: 0x0040, 0xebe: 0x0040, 0xebf: 0x0040,
+	// Block 0x3b, offset 0xec0
+	0xec0: 0x000a, 0xec1: 0x0018, 0xec2: 0x0961, 0xec3: 0x0018, 0xec4: 0x0018, 0xec5: 0x0008,
+	0xec6: 0x0008, 0xec7: 0x0008, 0xec8: 0x0018, 0xec9: 0x0018, 0xeca: 0x0018, 0xecb: 0x0018,
+	0xecc: 0x0018, 0xecd: 0x0018, 0xece: 0x0018, 0xecf: 0x0018, 0xed0: 0x0018, 0xed1: 0x0018,
+	0xed2: 0x0018, 0xed3: 0x0018, 0xed4: 0x0018, 0xed5: 0x0018, 0xed6: 0x0018, 0xed7: 0x0018,
+	0xed8: 0x0018, 0xed9: 0x0018, 0xeda: 0x0018, 0xedb: 0x0018, 0xedc: 0x0018, 0xedd: 0x0018,
+	0xede: 0x0018, 0xedf: 0x0018, 0xee0: 0x0018, 0xee1: 0x0018, 0xee2: 0x0018, 0xee3: 0x0018,
+	0xee4: 0x0018, 0xee5: 0x0018, 0xee6: 0x0018, 0xee7: 0x0018, 0xee8: 0x0018, 0xee9: 0x0018,
+	0xeea: 0x3308, 0xeeb: 0x3308, 0xeec: 0x3308, 0xeed: 0x3308, 0xeee: 0x3018, 0xeef: 0x3018,
+	0xef0: 0x0018, 0xef1: 0x0018, 0xef2: 0x0018, 0xef3: 0x0018, 0xef4: 0x0018, 0xef5: 0x0018,
+	0xef6: 0xe125, 0xef7: 0x0018, 0xef8: 0x29d5, 0xef9: 0x29f5, 0xefa: 0x2a15, 0xefb: 0x0018,
+	0xefc: 0x0008, 0xefd: 0x0018, 0xefe: 0x0018, 0xeff: 0x0018,
+	// Block 0x3c, offset 0xf00
+	0xf00: 0x2b55, 0xf01: 0x2b75, 0xf02: 0x2b95, 0xf03: 0x2bb5, 0xf04: 0x2bd5, 0xf05: 0x2bf5,
+	0xf06: 0x2bf5, 0xf07: 0x2bf5, 0xf08: 0x2c15, 0xf09: 0x2c15, 0xf0a: 0x2c15, 0xf0b: 0x2c15,
+	0xf0c: 0x2c35, 0xf0d: 0x2c35, 0xf0e: 0x2c35, 0xf0f: 0x2c55, 0xf10: 0x2c75, 0xf11: 0x2c75,
+	0xf12: 0x2a95, 0xf13: 0x2a95, 0xf14: 0x2c75, 0xf15: 0x2c75, 0xf16: 0x2c95, 0xf17: 0x2c95,
+	0xf18: 0x2c75, 0xf19: 0x2c75, 0xf1a: 0x2a95, 0xf1b: 0x2a95, 0xf1c: 0x2c75, 0xf1d: 0x2c75,
+	0xf1e: 0x2c55, 0xf1f: 0x2c55, 0xf20: 0x2cb5, 0xf21: 0x2cb5, 0xf22: 0x2cd5, 0xf23: 0x2cd5,
+	0xf24: 0x0040, 0xf25: 0x2cf5, 0xf26: 0x2d15, 0xf27: 0x2d35, 0xf28: 0x2d35, 0xf29: 0x2d55,
+	0xf2a: 0x2d75, 0xf2b: 0x2d95, 0xf2c: 0x2db5, 0xf2d: 0x2dd5, 0xf2e: 0x2df5, 0xf2f: 0x2e15,
+	0xf30: 0x2e35, 0xf31: 0x2e55, 0xf32: 0x2e55, 0xf33: 0x2e75, 0xf34: 0x2e95, 0xf35: 0x2e95,
+	0xf36: 0x2eb5, 0xf37: 0x2ed5, 0xf38: 0x2e75, 0xf39: 0x2ef5, 0xf3a: 0x2f15, 0xf3b: 0x2ef5,
+	0xf3c: 0x2e75, 0xf3d: 0x2f35, 0xf3e: 0x2f55, 0xf3f: 0x2f75,
+	// Block 0x3d, offset 0xf40
+	0xf40: 0x2f95, 0xf41: 0x2fb5, 0xf42: 0x2d15, 0xf43: 0x2cf5, 0xf44: 0x2fd5, 0xf45: 0x2ff5,
+	0xf46: 0x3015, 0xf47: 0x3035, 0xf48: 0x3055, 0xf49: 0x3075, 0xf4a: 0x3095, 0xf4b: 0x30b5,
+	0xf4c: 0x30d5, 0xf4d: 0x30f5, 0xf4e: 0x3115, 0xf4f: 0x0040, 0xf50: 0x0018, 0xf51: 0x0018,
+	0xf52: 0x3135, 0xf53: 0x3155, 0xf54: 0x3175, 0xf55: 0x3195, 0xf56: 0x31b5, 0xf57: 0x31d5,
+	0xf58: 0x31f5, 0xf59: 0x3215, 0xf5a: 0x3235, 0xf5b: 0x3255, 0xf5c: 0x3175, 0xf5d: 0x3275,
+	0xf5e: 0x3295, 0xf5f: 0x32b5, 0xf60: 0x0008, 0xf61: 0x0008, 0xf62: 0x0008, 0xf63: 0x0008,
+	0xf64: 0x0008, 0xf65: 0x0008, 0xf66: 0x0008, 0xf67: 0x0008, 0xf68: 0x0008, 0xf69: 0x0008,
+	0xf6a: 0x0008, 0xf6b: 0x0008, 0xf6c: 0x0008, 0xf6d: 0x0008, 0xf6e: 0x0008, 0xf6f: 0x0008,
+	0xf70: 0x0008, 0xf71: 0x0008, 0xf72: 0x0008, 0xf73: 0x0008, 0xf74: 0x0008, 0xf75: 0x0008,
+	0xf76: 0x0008, 0xf77: 0x0008, 0xf78: 0x0008, 0xf79: 0x0008, 0xf7a: 0x0008, 0xf7b: 0x0008,
+	0xf7c: 0x0008, 0xf7d: 0x0008, 0xf7e: 0x0008, 0xf7f: 0x0008,
+	// Block 0x3e, offset 0xf80
+	0xf80: 0x0b82, 0xf81: 0x0b8a, 0xf82: 0x0b92, 0xf83: 0x0b9a, 0xf84: 0x32d5, 0xf85: 0x32f5,
+	0xf86: 0x3315, 0xf87: 0x3335, 0xf88: 0x0018, 0xf89: 0x0018, 0xf8a: 0x0018, 0xf8b: 0x0018,
+	0xf8c: 0x0018, 0xf8d: 0x0018, 0xf8e: 0x0018, 0xf8f: 0x0018, 0xf90: 0x3355, 0xf91: 0x0ba1,
+	0xf92: 0x0ba9, 0xf93: 0x0bb1, 0xf94: 0x0bb9, 0xf95: 0x0bc1, 0xf96: 0x0bc9, 0xf97: 0x0bd1,
+	0xf98: 0x0bd9, 0xf99: 0x0be1, 0xf9a: 0x0be9, 0xf9b: 0x0bf1, 0xf9c: 0x0bf9, 0xf9d: 0x0c01,
+	0xf9e: 0x0c09, 0xf9f: 0x0c11, 0xfa0: 0x3375, 0xfa1: 0x3395, 0xfa2: 0x33b5, 0xfa3: 0x33d5,
+	0xfa4: 0x33f5, 0xfa5: 0x33f5, 0xfa6: 0x3415, 0xfa7: 0x3435, 0xfa8: 0x3455, 0xfa9: 0x3475,
+	0xfaa: 0x3495, 0xfab: 0x34b5, 0xfac: 0x34d5, 0xfad: 0x34f5, 0xfae: 0x3515, 0xfaf: 0x3535,
+	0xfb0: 0x3555, 0xfb1: 0x3575, 0xfb2: 0x3595, 0xfb3: 0x35b5, 0xfb4: 0x35d5, 0xfb5: 0x35f5,
+	0xfb6: 0x3615, 0xfb7: 0x3635, 0xfb8: 0x3655, 0xfb9: 0x3675, 0xfba: 0x3695, 0xfbb: 0x36b5,
+	0xfbc: 0x0c19, 0xfbd: 0x0c21, 0xfbe: 0x36d5, 0xfbf: 0x0018,
+	// Block 0x3f, offset 0xfc0
+	0xfc0: 0x36f5, 0xfc1: 0x3715, 0xfc2: 0x3735, 0xfc3: 0x3755, 0xfc4: 0x3775, 0xfc5: 0x3795,
+	0xfc6: 0x37b5, 0xfc7: 0x37d5, 0xfc8: 0x37f5, 0xfc9: 0x3815, 0xfca: 0x3835, 0xfcb: 0x3855,
+	0xfcc: 0x3875, 0xfcd: 0x3895, 0xfce: 0x38b5, 0xfcf: 0x38d5, 0xfd0: 0x38f5, 0xfd1: 0x3915,
+	0xfd2: 0x3935, 0xfd3: 0x3955, 0xfd4: 0x3975, 0xfd5: 0x3995, 0xfd6: 0x39b5, 0xfd7: 0x39d5,
+	0xfd8: 0x39f5, 0xfd9: 0x3a15, 0xfda: 0x3a35, 0xfdb: 0x3a55, 0xfdc: 0x3a75, 0xfdd: 0x3a95,
+	0xfde: 0x3ab5, 0xfdf: 0x3ad5, 0xfe0: 0x3af5, 0xfe1: 0x3b15, 0xfe2: 0x3b35, 0xfe3: 0x3b55,
+	0xfe4: 0x3b75, 0xfe5: 0x3b95, 0xfe6: 0x1295, 0xfe7: 0x3bb5, 0xfe8: 0x3bd5, 0xfe9: 0x3bf5,
+	0xfea: 0x3c15, 0xfeb: 0x3c35, 0xfec: 0x3c55, 0xfed: 0x3c75, 0xfee: 0x23b5, 0xfef: 0x3c95,
+	0xff0: 0x3cb5, 0xff1: 0x0c29, 0xff2: 0x0c31, 0xff3: 0x0c39, 0xff4: 0x0c41, 0xff5: 0x0c49,
+	0xff6: 0x0c51, 0xff7: 0x0c59, 0xff8: 0x0c61, 0xff9: 0x0c69, 0xffa: 0x0c71, 0xffb: 0x0c79,
+	0xffc: 0x0c81, 0xffd: 0x0c89, 0xffe: 0x0c91, 0xfff: 0x0c99,
+	// Block 0x40, offset 0x1000
+	0x1000: 0x0ca1, 0x1001: 0x0ca9, 0x1002: 0x0cb1, 0x1003: 0x0cb9, 0x1004: 0x0cc1, 0x1005: 0x0cc9,
+	0x1006: 0x0cd1, 0x1007: 0x0cd9, 0x1008: 0x0ce1, 0x1009: 0x0ce9, 0x100a: 0x0cf1, 0x100b: 0x0cf9,
+	0x100c: 0x0d01, 0x100d: 0x3cd5, 0x100e: 0x0d09, 0x100f: 0x3cf5, 0x1010: 0x3d15, 0x1011: 0x3d2d,
+	0x1012: 0x3d45, 0x1013: 0x3d5d, 0x1014: 0x3d75, 0x1015: 0x3d75, 0x1016: 0x3d5d, 0x1017: 0x3d8d,
+	0x1018: 0x07d5, 0x1019: 0x3da5, 0x101a: 0x3dbd, 0x101b: 0x3dd5, 0x101c: 0x3ded, 0x101d: 0x3e05,
+	0x101e: 0x3e1d, 0x101f: 0x3e35, 0x1020: 0x3e4d, 0x1021: 0x3e65, 0x1022: 0x3e7d, 0x1023: 0x3e95,
+	0x1024: 0x3ead, 0x1025: 0x3ead, 0x1026: 0x3ec5, 0x1027: 0x3ec5, 0x1028: 0x3edd, 0x1029: 0x3edd,
+	0x102a: 0x3ef5, 0x102b: 0x3f0d, 0x102c: 0x3f25, 0x102d: 0x3f3d, 0x102e: 0x3f55, 0x102f: 0x3f55,
+	0x1030: 0x3f6d, 0x1031: 0x3f6d, 0x1032: 0x3f6d, 0x1033: 0x3f85, 0x1034: 0x3f9d, 0x1035: 0x3fb5,
+	0x1036: 0x3fcd, 0x1037: 0x3fb5, 0x1038: 0x3fe5, 0x1039: 0x3ffd, 0x103a: 0x3f85, 0x103b: 0x4015,
+	0x103c: 0x402d, 0x103d: 0x402d, 0x103e: 0x402d, 0x103f: 0x0d11,
+	// Block 0x41, offset 0x1040
+	0x1040: 0x10f9, 0x1041: 0x1101, 0x1042: 0x40a5, 0x1043: 0x1109, 0x1044: 0x1111, 0x1045: 0x1119,
+	0x1046: 0x1121, 0x1047: 0x1129, 0x1048: 0x40c5, 0x1049: 0x1131, 0x104a: 0x1139, 0x104b: 0x1141,
+	0x104c: 0x40e5, 0x104d: 0x40e5, 0x104e: 0x1149, 0x104f: 0x1151, 0x1050: 0x1159, 0x1051: 0x4105,
+	0x1052: 0x4125, 0x1053: 0x4145, 0x1054: 0x4165, 0x1055: 0x4185, 0x1056: 0x1161, 0x1057: 0x1169,
+	0x1058: 0x1171, 0x1059: 0x1179, 0x105a: 0x1181, 0x105b: 0x41a5, 0x105c: 0x1189, 0x105d: 0x1191,
+	0x105e: 0x1199, 0x105f: 0x41c5, 0x1060: 0x41e5, 0x1061: 0x11a1, 0x1062: 0x4205, 0x1063: 0x4225,
+	0x1064: 0x4245, 0x1065: 0x11a9, 0x1066: 0x4265, 0x1067: 0x11b1, 0x1068: 0x11b9, 0x1069: 0x10f9,
+	0x106a: 0x4285, 0x106b: 0x42a5, 0x106c: 0x42c5, 0x106d: 0x42e5, 0x106e: 0x11c1, 0x106f: 0x11c9,
+	0x1070: 0x11d1, 0x1071: 0x11d9, 0x1072: 0x4305, 0x1073: 0x11e1, 0x1074: 0x11e9, 0x1075: 0x11f1,
+	0x1076: 0x4325, 0x1077: 0x11f9, 0x1078: 0x1201, 0x1079: 0x11f9, 0x107a: 0x1209, 0x107b: 0x1211,
+	0x107c: 0x4345, 0x107d: 0x1219, 0x107e: 0x1221, 0x107f: 0x1219,
+	// Block 0x42, offset 0x1080
+	0x1080: 0x4365, 0x1081: 0x4385, 0x1082: 0x0040, 0x1083: 0x1229, 0x1084: 0x1231, 0x1085: 0x1239,
+	0x1086: 0x1241, 0x1087: 0x0040, 0x1088: 0x1249, 0x1089: 0x1251, 0x108a: 0x1259, 0x108b: 0x1261,
+	0x108c: 0x1269, 0x108d: 0x1271, 0x108e: 0x1199, 0x108f: 0x1279, 0x1090: 0x1281, 0x1091: 0x1289,
+	0x1092: 0x43a5, 0x1093: 0x1291, 0x1094: 0x1121, 0x1095: 0x43c5, 0x1096: 0x43e5, 0x1097: 0x1299,
+	0x1098: 0x0040, 0x1099: 0x4405, 0x109a: 0x12a1, 0x109b: 0x12a9, 0x109c: 0x12b1, 0x109d: 0x12b9,
+	0x109e: 0x12c1, 0x109f: 0x12c9, 0x10a0: 0x12d1, 0x10a1: 0x12d9, 0x10a2: 0x12e1, 0x10a3: 0x12e9,
+	0x10a4: 0x12f1, 0x10a5: 0x12f9, 0x10a6: 0x1301, 0x10a7: 0x1309, 0x10a8: 0x1311, 0x10a9: 0x1319,
+	0x10aa: 0x1321, 0x10ab: 0x1329, 0x10ac: 0x1331, 0x10ad: 0x1339, 0x10ae: 0x1341, 0x10af: 0x1349,
+	0x10b0: 0x1351, 0x10b1: 0x1359, 0x10b2: 0x1361, 0x10b3: 0x1369, 0x10b4: 0x1371, 0x10b5: 0x1379,
+	0x10b6: 0x1381, 0x10b7: 0x1389, 0x10b8: 0x1391, 0x10b9: 0x1399, 0x10ba: 0x13a1, 0x10bb: 0x13a9,
+	0x10bc: 0x13b1, 0x10bd: 0x13b9, 0x10be: 0x13c1, 0x10bf: 0x4425,
+	// Block 0x43, offset 0x10c0
+	0x10c0: 0xe00d, 0x10c1: 0x0008, 0x10c2: 0xe00d, 0x10c3: 0x0008, 0x10c4: 0xe00d, 0x10c5: 0x0008,
+	0x10c6: 0xe00d, 0x10c7: 0x0008, 0x10c8: 0xe00d, 0x10c9: 0x0008, 0x10ca: 0xe00d, 0x10cb: 0x0008,
+	0x10cc: 0xe00d, 0x10cd: 0x0008, 0x10ce: 0xe00d, 0x10cf: 0x0008, 0x10d0: 0xe00d, 0x10d1: 0x0008,
+	0x10d2: 0xe00d, 0x10d3: 0x0008, 0x10d4: 0xe00d, 0x10d5: 0x0008, 0x10d6: 0xe00d, 0x10d7: 0x0008,
+	0x10d8: 0xe00d, 0x10d9: 0x0008, 0x10da: 0xe00d, 0x10db: 0x0008, 0x10dc: 0xe00d, 0x10dd: 0x0008,
+	0x10de: 0xe00d, 0x10df: 0x0008, 0x10e0: 0xe00d, 0x10e1: 0x0008, 0x10e2: 0xe00d, 0x10e3: 0x0008,
+	0x10e4: 0xe00d, 0x10e5: 0x0008, 0x10e6: 0xe00d, 0x10e7: 0x0008, 0x10e8: 0xe00d, 0x10e9: 0x0008,
+	0x10ea: 0xe00d, 0x10eb: 0x0008, 0x10ec: 0xe00d, 0x10ed: 0x0008, 0x10ee: 0x0008, 0x10ef: 0x3308,
+	0x10f0: 0x3318, 0x10f1: 0x3318, 0x10f2: 0x3318, 0x10f3: 0x0018, 0x10f4: 0x3308, 0x10f5: 0x3308,
+	0x10f6: 0x3308, 0x10f7: 0x3308, 0x10f8: 0x3308, 0x10f9: 0x3308, 0x10fa: 0x3308, 0x10fb: 0x3308,
+	0x10fc: 0x3308, 0x10fd: 0x3308, 0x10fe: 0x0018, 0x10ff: 0x0008,
+	// Block 0x44, offset 0x1100
+	0x1100: 0xe00d, 0x1101: 0x0008, 0x1102: 0xe00d, 0x1103: 0x0008, 0x1104: 0xe00d, 0x1105: 0x0008,
+	0x1106: 0xe00d, 0x1107: 0x0008, 0x1108: 0xe00d, 0x1109: 0x0008, 0x110a: 0xe00d, 0x110b: 0x0008,
+	0x110c: 0xe00d, 0x110d: 0x0008, 0x110e: 0xe00d, 0x110f: 0x0008, 0x1110: 0xe00d, 0x1111: 0x0008,
+	0x1112: 0xe00d, 0x1113: 0x0008, 0x1114: 0xe00d, 0x1115: 0x0008, 0x1116: 0xe00d, 0x1117: 0x0008,
+	0x1118: 0xe00d, 0x1119: 0x0008, 0x111a: 0xe00d, 0x111b: 0x0008, 0x111c: 0x02d1, 0x111d: 0x13c9,
+	0x111e: 0x3308, 0x111f: 0x3308, 0x1120: 0x0008, 0x1121: 0x0008, 0x1122: 0x0008, 0x1123: 0x0008,
+	0x1124: 0x0008, 0x1125: 0x0008, 0x1126: 0x0008, 0x1127: 0x0008, 0x1128: 0x0008, 0x1129: 0x0008,
+	0x112a: 0x0008, 0x112b: 0x0008, 0x112c: 0x0008, 0x112d: 0x0008, 0x112e: 0x0008, 0x112f: 0x0008,
+	0x1130: 0x0008, 0x1131: 0x0008, 0x1132: 0x0008, 0x1133: 0x0008, 0x1134: 0x0008, 0x1135: 0x0008,
+	0x1136: 0x0008, 0x1137: 0x0008, 0x1138: 0x0008, 0x1139: 0x0008, 0x113a: 0x0008, 0x113b: 0x0008,
+	0x113c: 0x0008, 0x113d: 0x0008, 0x113e: 0x0008, 0x113f: 0x0008,
+	// Block 0x45, offset 0x1140
+	0x1140: 0x0018, 0x1141: 0x0018, 0x1142: 0x0018, 0x1143: 0x0018, 0x1144: 0x0018, 0x1145: 0x0018,
+	0x1146: 0x0018, 0x1147: 0x0018, 0x1148: 0x0018, 0x1149: 0x0018, 0x114a: 0x0018, 0x114b: 0x0018,
+	0x114c: 0x0018, 0x114d: 0x0018, 0x114e: 0x0018, 0x114f: 0x0018, 0x1150: 0x0018, 0x1151: 0x0018,
+	0x1152: 0x0018, 0x1153: 0x0018, 0x1154: 0x0018, 0x1155: 0x0018, 0x1156: 0x0018, 0x1157: 0x0008,
+	0x1158: 0x0008, 0x1159: 0x0008, 0x115a: 0x0008, 0x115b: 0x0008, 0x115c: 0x0008, 0x115d: 0x0008,
+	0x115e: 0x0008, 0x115f: 0x0008, 0x1160: 0x0018, 0x1161: 0x0018, 0x1162: 0xe00d, 0x1163: 0x0008,
+	0x1164: 0xe00d, 0x1165: 0x0008, 0x1166: 0xe00d, 0x1167: 0x0008, 0x1168: 0xe00d, 0x1169: 0x0008,
+	0x116a: 0xe00d, 0x116b: 0x0008, 0x116c: 0xe00d, 0x116d: 0x0008, 0x116e: 0xe00d, 0x116f: 0x0008,
+	0x1170: 0x0008, 0x1171: 0x0008, 0x1172: 0xe00d, 0x1173: 0x0008, 0x1174: 0xe00d, 0x1175: 0x0008,
+	0x1176: 0xe00d, 0x1177: 0x0008, 0x1178: 0xe00d, 0x1179: 0x0008, 0x117a: 0xe00d, 0x117b: 0x0008,
+	0x117c: 0xe00d, 0x117d: 0x0008, 0x117e: 0xe00d, 0x117f: 0x0008,
+	// Block 0x46, offset 0x1180
+	0x1180: 0xe00d, 0x1181: 0x0008, 0x1182: 0xe00d, 0x1183: 0x0008, 0x1184: 0xe00d, 0x1185: 0x0008,
+	0x1186: 0xe00d, 0x1187: 0x0008, 0x1188: 0xe00d, 0x1189: 0x0008, 0x118a: 0xe00d, 0x118b: 0x0008,
+	0x118c: 0xe00d, 0x118d: 0x0008, 0x118e: 0xe00d, 0x118f: 0x0008, 0x1190: 0xe00d, 0x1191: 0x0008,
+	0x1192: 0xe00d, 0x1193: 0x0008, 0x1194: 0xe00d, 0x1195: 0x0008, 0x1196: 0xe00d, 0x1197: 0x0008,
+	0x1198: 0xe00d, 0x1199: 0x0008, 0x119a: 0xe00d, 0x119b: 0x0008, 0x119c: 0xe00d, 0x119d: 0x0008,
+	0x119e: 0xe00d, 0x119f: 0x0008, 0x11a0: 0xe00d, 0x11a1: 0x0008, 0x11a2: 0xe00d, 0x11a3: 0x0008,
+	0x11a4: 0xe00d, 0x11a5: 0x0008, 0x11a6: 0xe00d, 0x11a7: 0x0008, 0x11a8: 0xe00d, 0x11a9: 0x0008,
+	0x11aa: 0xe00d, 0x11ab: 0x0008, 0x11ac: 0xe00d, 0x11ad: 0x0008, 0x11ae: 0xe00d, 0x11af: 0x0008,
+	0x11b0: 0xe0fd, 0x11b1: 0x0008, 0x11b2: 0x0008, 0x11b3: 0x0008, 0x11b4: 0x0008, 0x11b5: 0x0008,
+	0x11b6: 0x0008, 0x11b7: 0x0008, 0x11b8: 0x0008, 0x11b9: 0xe01d, 0x11ba: 0x0008, 0x11bb: 0xe03d,
+	0x11bc: 0x0008, 0x11bd: 0x4445, 0x11be: 0xe00d, 0x11bf: 0x0008,
+	// Block 0x47, offset 0x11c0
+	0x11c0: 0xe00d, 0x11c1: 0x0008, 0x11c2: 0xe00d, 0x11c3: 0x0008, 0x11c4: 0xe00d, 0x11c5: 0x0008,
+	0x11c6: 0xe00d, 0x11c7: 0x0008, 0x11c8: 0x0008, 0x11c9: 0x0018, 0x11ca: 0x0018, 0x11cb: 0xe03d,
+	0x11cc: 0x0008, 0x11cd: 0x0409, 0x11ce: 0x0008, 0x11cf: 0x0008, 0x11d0: 0xe00d, 0x11d1: 0x0008,
+	0x11d2: 0xe00d, 0x11d3: 0x0008, 0x11d4: 0x0008, 0x11d5: 0x0008, 0x11d6: 0xe00d, 0x11d7: 0x0008,
+	0x11d8: 0xe00d, 0x11d9: 0x0008, 0x11da: 0xe00d, 0x11db: 0x0008, 0x11dc: 0xe00d, 0x11dd: 0x0008,
+	0x11de: 0xe00d, 0x11df: 0x0008, 0x11e0: 0xe00d, 0x11e1: 0x0008, 0x11e2: 0xe00d, 0x11e3: 0x0008,
+	0x11e4: 0xe00d, 0x11e5: 0x0008, 0x11e6: 0xe00d, 0x11e7: 0x0008, 0x11e8: 0xe00d, 0x11e9: 0x0008,
+	0x11ea: 0x13d1, 0x11eb: 0x0371, 0x11ec: 0x0401, 0x11ed: 0x13d9, 0x11ee: 0x0421, 0x11ef: 0x0008,
+	0x11f0: 0x13e1, 0x11f1: 0x13e9, 0x11f2: 0x0429, 0x11f3: 0x4465, 0x11f4: 0xe00d, 0x11f5: 0x0008,
+	0x11f6: 0xe00d, 0x11f7: 0x0008, 0x11f8: 0xe00d, 0x11f9: 0x0008, 0x11fa: 0xe00d, 0x11fb: 0x0008,
+	0x11fc: 0xe00d, 0x11fd: 0x0008, 0x11fe: 0xe00d, 0x11ff: 0x0008,
+	// Block 0x48, offset 0x1200
+	0x1200: 0xe00d, 0x1201: 0x0008, 0x1202: 0xe00d, 0x1203: 0x0008, 0x1204: 0x03f5, 0x1205: 0x0479,
+	0x1206: 0x447d, 0x1207: 0xe07d, 0x1208: 0x0008, 0x1209: 0xe01d, 0x120a: 0x0008, 0x120b: 0x0040,
+	0x120c: 0x0040, 0x120d: 0x0040, 0x120e: 0x0040, 0x120f: 0x0040, 0x1210: 0xe00d, 0x1211: 0x0008,
+	0x1212: 0x0040, 0x1213: 0x0008, 0x1214: 0x0040, 0x1215: 0x0008, 0x1216: 0xe00d, 0x1217: 0x0008,
+	0x1218: 0xe00d, 0x1219: 0x0008, 0x121a: 0x0040, 0x121b: 0x0040, 0x121c: 0x0040, 0x121d: 0x0040,
+	0x121e: 0x0040, 0x121f: 0x0040, 0x1220: 0x0040, 0x1221: 0x0040, 0x1222: 0x0040, 0x1223: 0x0040,
+	0x1224: 0x0040, 0x1225: 0x0040, 0x1226: 0x0040, 0x1227: 0x0040, 0x1228: 0x0040, 0x1229: 0x0040,
+	0x122a: 0x0040, 0x122b: 0x0040, 0x122c: 0x0040, 0x122d: 0x0040, 0x122e: 0x0040, 0x122f: 0x0040,
+	0x1230: 0x0040, 0x1231: 0x0040, 0x1232: 0x03d9, 0x1233: 0x03f1, 0x1234: 0x0751, 0x1235: 0xe01d,
+	0x1236: 0x0008, 0x1237: 0x0008, 0x1238: 0x0741, 0x1239: 0x13f1, 0x123a: 0x0008, 0x123b: 0x0008,
+	0x123c: 0x0008, 0x123d: 0x0008, 0x123e: 0x0008, 0x123f: 0x0008,
+	// Block 0x49, offset 0x1240
+	0x1240: 0x650d, 0x1241: 0x652d, 0x1242: 0x654d, 0x1243: 0x656d, 0x1244: 0x658d, 0x1245: 0x65ad,
+	0x1246: 0x65cd, 0x1247: 0x65ed, 0x1248: 0x660d, 0x1249: 0x662d, 0x124a: 0x664d, 0x124b: 0x666d,
+	0x124c: 0x668d, 0x124d: 0x66ad, 0x124e: 0x0008, 0x124f: 0x0008, 0x1250: 0x66cd, 0x1251: 0x0008,
+	0x1252: 0x66ed, 0x1253: 0x0008, 0x1254: 0x0008, 0x1255: 0x670d, 0x1256: 0x672d, 0x1257: 0x674d,
+	0x1258: 0x676d, 0x1259: 0x678d, 0x125a: 0x67ad, 0x125b: 0x67cd, 0x125c: 0x67ed, 0x125d: 0x680d,
+	0x125e: 0x682d, 0x125f: 0x0008, 0x1260: 0x684d, 0x1261: 0x0008, 0x1262: 0x686d, 0x1263: 0x0008,
+	0x1264: 0x0008, 0x1265: 0x688d, 0x1266: 0x68ad, 0x1267: 0x0008, 0x1268: 0x0008, 0x1269: 0x0008,
+	0x126a: 0x68cd, 0x126b: 0x68ed, 0x126c: 0x690d, 0x126d: 0x692d, 0x126e: 0x694d, 0x126f: 0x696d,
+	0x1270: 0x698d, 0x1271: 0x69ad, 0x1272: 0x69cd, 0x1273: 0x69ed, 0x1274: 0x6a0d, 0x1275: 0x6a2d,
+	0x1276: 0x6a4d, 0x1277: 0x6a6d, 0x1278: 0x6a8d, 0x1279: 0x6aad, 0x127a: 0x6acd, 0x127b: 0x6aed,
+	0x127c: 0x6b0d, 0x127d: 0x6b2d, 0x127e: 0x6b4d, 0x127f: 0x6b6d,
+	// Block 0x4a, offset 0x1280
+	0x1280: 0x7acd, 0x1281: 0x7aed, 0x1282: 0x7b0d, 0x1283: 0x7b2d, 0x1284: 0x7b4d, 0x1285: 0x7b6d,
+	0x1286: 0x7b8d, 0x1287: 0x7bad, 0x1288: 0x7bcd, 0x1289: 0x7bed, 0x128a: 0x7c0d, 0x128b: 0x7c2d,
+	0x128c: 0x7c4d, 0x128d: 0x7c6d, 0x128e: 0x7c8d, 0x128f: 0x1409, 0x1290: 0x1411, 0x1291: 0x1419,
+	0x1292: 0x7cad, 0x1293: 0x7ccd, 0x1294: 0x7ced, 0x1295: 0x1421, 0x1296: 0x1429, 0x1297: 0x1431,
+	0x1298: 0x7d0d, 0x1299: 0x7d2d, 0x129a: 0x0040, 0x129b: 0x0040, 0x129c: 0x0040, 0x129d: 0x0040,
+	0x129e: 0x0040, 0x129f: 0x0040, 0x12a0: 0x0040, 0x12a1: 0x0040, 0x12a2: 0x0040, 0x12a3: 0x0040,
+	0x12a4: 0x0040, 0x12a5: 0x0040, 0x12a6: 0x0040, 0x12a7: 0x0040, 0x12a8: 0x0040, 0x12a9: 0x0040,
+	0x12aa: 0x0040, 0x12ab: 0x0040, 0x12ac: 0x0040, 0x12ad: 0x0040, 0x12ae: 0x0040, 0x12af: 0x0040,
+	0x12b0: 0x0040, 0x12b1: 0x0040, 0x12b2: 0x0040, 0x12b3: 0x0040, 0x12b4: 0x0040, 0x12b5: 0x0040,
+	0x12b6: 0x0040, 0x12b7: 0x0040, 0x12b8: 0x0040, 0x12b9: 0x0040, 0x12ba: 0x0040, 0x12bb: 0x0040,
+	0x12bc: 0x0040, 0x12bd: 0x0040, 0x12be: 0x0040, 0x12bf: 0x0040,
+	// Block 0x4b, offset 0x12c0
+	0x12c0: 0x1439, 0x12c1: 0x1441, 0x12c2: 0x1449, 0x12c3: 0x7d4d, 0x12c4: 0x7d6d, 0x12c5: 0x1451,
+	0x12c6: 0x1451, 0x12c7: 0x0040, 0x12c8: 0x0040, 0x12c9: 0x0040, 0x12ca: 0x0040, 0x12cb: 0x0040,
+	0x12cc: 0x0040, 0x12cd: 0x0040, 0x12ce: 0x0040, 0x12cf: 0x0040, 0x12d0: 0x0040, 0x12d1: 0x0040,
+	0x12d2: 0x0040, 0x12d3: 0x1459, 0x12d4: 0x1461, 0x12d5: 0x1469, 0x12d6: 0x1471, 0x12d7: 0x1479,
+	0x12d8: 0x0040, 0x12d9: 0x0040, 0x12da: 0x0040, 0x12db: 0x0040, 0x12dc: 0x0040, 0x12dd: 0x1481,
+	0x12de: 0x3308, 0x12df: 0x1489, 0x12e0: 0x1491, 0x12e1: 0x0779, 0x12e2: 0x0791, 0x12e3: 0x1499,
+	0x12e4: 0x14a1, 0x12e5: 0x14a9, 0x12e6: 0x14b1, 0x12e7: 0x14b9, 0x12e8: 0x14c1, 0x12e9: 0x071a,
+	0x12ea: 0x14c9, 0x12eb: 0x14d1, 0x12ec: 0x14d9, 0x12ed: 0x14e1, 0x12ee: 0x14e9, 0x12ef: 0x14f1,
+	0x12f0: 0x14f9, 0x12f1: 0x1501, 0x12f2: 0x1509, 0x12f3: 0x1511, 0x12f4: 0x1519, 0x12f5: 0x1521,
+	0x12f6: 0x1529, 0x12f7: 0x0040, 0x12f8: 0x1531, 0x12f9: 0x1539, 0x12fa: 0x1541, 0x12fb: 0x1549,
+	0x12fc: 0x1551, 0x12fd: 0x0040, 0x12fe: 0x1559, 0x12ff: 0x0040,
+	// Block 0x4c, offset 0x1300
+	0x1300: 0x1561, 0x1301: 0x1569, 0x1302: 0x0040, 0x1303: 0x1571, 0x1304: 0x1579, 0x1305: 0x0040,
+	0x1306: 0x1581, 0x1307: 0x1589, 0x1308: 0x1591, 0x1309: 0x1599, 0x130a: 0x15a1, 0x130b: 0x15a9,
+	0x130c: 0x15b1, 0x130d: 0x15b9, 0x130e: 0x15c1, 0x130f: 0x15c9, 0x1310: 0x15d1, 0x1311: 0x15d1,
+	0x1312: 0x15d9, 0x1313: 0x15d9, 0x1314: 0x15d9, 0x1315: 0x15d9, 0x1316: 0x15e1, 0x1317: 0x15e1,
+	0x1318: 0x15e1, 0x1319: 0x15e1, 0x131a: 0x15e9, 0x131b: 0x15e9, 0x131c: 0x15e9, 0x131d: 0x15e9,
+	0x131e: 0x15f1, 0x131f: 0x15f1, 0x1320: 0x15f1, 0x1321: 0x15f1, 0x1322: 0x15f9, 0x1323: 0x15f9,
+	0x1324: 0x15f9, 0x1325: 0x15f9, 0x1326: 0x1601, 0x1327: 0x1601, 0x1328: 0x1601, 0x1329: 0x1601,
+	0x132a: 0x1609, 0x132b: 0x1609, 0x132c: 0x1609, 0x132d: 0x1609, 0x132e: 0x1611, 0x132f: 0x1611,
+	0x1330: 0x1611, 0x1331: 0x1611, 0x1332: 0x1619, 0x1333: 0x1619, 0x1334: 0x1619, 0x1335: 0x1619,
+	0x1336: 0x1621, 0x1337: 0x1621, 0x1338: 0x1621, 0x1339: 0x1621, 0x133a: 0x1629, 0x133b: 0x1629,
+	0x133c: 0x1629, 0x133d: 0x1629, 0x133e: 0x1631, 0x133f: 0x1631,
+	// Block 0x4d, offset 0x1340
+	0x1340: 0x1631, 0x1341: 0x1631, 0x1342: 0x1639, 0x1343: 0x1639, 0x1344: 0x1641, 0x1345: 0x1641,
+	0x1346: 0x1649, 0x1347: 0x1649, 0x1348: 0x1651, 0x1349: 0x1651, 0x134a: 0x1659, 0x134b: 0x1659,
+	0x134c: 0x1661, 0x134d: 0x1661, 0x134e: 0x1669, 0x134f: 0x1669, 0x1350: 0x1669, 0x1351: 0x1669,
+	0x1352: 0x1671, 0x1353: 0x1671, 0x1354: 0x1671, 0x1355: 0x1671, 0x1356: 0x1679, 0x1357: 0x1679,
+	0x1358: 0x1679, 0x1359: 0x1679, 0x135a: 0x1681, 0x135b: 0x1681, 0x135c: 0x1681, 0x135d: 0x1681,
+	0x135e: 0x1689, 0x135f: 0x1689, 0x1360: 0x1691, 0x1361: 0x1691, 0x1362: 0x1691, 0x1363: 0x1691,
+	0x1364: 0x1699, 0x1365: 0x1699, 0x1366: 0x16a1, 0x1367: 0x16a1, 0x1368: 0x16a1, 0x1369: 0x16a1,
+	0x136a: 0x16a9, 0x136b: 0x16a9, 0x136c: 0x16a9, 0x136d: 0x16a9, 0x136e: 0x16b1, 0x136f: 0x16b1,
+	0x1370: 0x16b9, 0x1371: 0x16b9, 0x1372: 0x0818, 0x1373: 0x0818, 0x1374: 0x0818, 0x1375: 0x0818,
+	0x1376: 0x0818, 0x1377: 0x0818, 0x1378: 0x0818, 0x1379: 0x0818, 0x137a: 0x0818, 0x137b: 0x0818,
+	0x137c: 0x0818, 0x137d: 0x0818, 0x137e: 0x0818, 0x137f: 0x0818,
+	// Block 0x4e, offset 0x1380
+	0x1380: 0x0818, 0x1381: 0x0818, 0x1382: 0x0818, 0x1383: 0x0040, 0x1384: 0x0040, 0x1385: 0x0040,
+	0x1386: 0x0040, 0x1387: 0x0040, 0x1388: 0x0040, 0x1389: 0x0040, 0x138a: 0x0040, 0x138b: 0x0040,
+	0x138c: 0x0040, 0x138d: 0x0040, 0x138e: 0x0040, 0x138f: 0x0040, 0x1390: 0x0040, 0x1391: 0x0040,
+	0x1392: 0x0040, 0x1393: 0x16c1, 0x1394: 0x16c1, 0x1395: 0x16c1, 0x1396: 0x16c1, 0x1397: 0x16c9,
+	0x1398: 0x16c9, 0x1399: 0x16d1, 0x139a: 0x16d1, 0x139b: 0x16d9, 0x139c: 0x16d9, 0x139d: 0x0149,
+	0x139e: 0x16e1, 0x139f: 0x16e1, 0x13a0: 0x16e9, 0x13a1: 0x16e9, 0x13a2: 0x16f1, 0x13a3: 0x16f1,
+	0x13a4: 0x16f9, 0x13a5: 0x16f9, 0x13a6: 0x16f9, 0x13a7: 0x16f9, 0x13a8: 0x1701, 0x13a9: 0x1701,
+	0x13aa: 0x1709, 0x13ab: 0x1709, 0x13ac: 0x1711, 0x13ad: 0x1711, 0x13ae: 0x1719, 0x13af: 0x1719,
+	0x13b0: 0x1721, 0x13b1: 0x1721, 0x13b2: 0x1729, 0x13b3: 0x1729, 0x13b4: 0x1731, 0x13b5: 0x1731,
+	0x13b6: 0x1739, 0x13b7: 0x1739, 0x13b8: 0x1739, 0x13b9: 0x1741, 0x13ba: 0x1741, 0x13bb: 0x1741,
+	0x13bc: 0x1749, 0x13bd: 0x1749, 0x13be: 0x1749, 0x13bf: 0x1749,
+	// Block 0x4f, offset 0x13c0
+	0x13c0: 0x1949, 0x13c1: 0x1951, 0x13c2: 0x1959, 0x13c3: 0x1961, 0x13c4: 0x1969, 0x13c5: 0x1971,
+	0x13c6: 0x1979, 0x13c7: 0x1981, 0x13c8: 0x1989, 0x13c9: 0x1991, 0x13ca: 0x1999, 0x13cb: 0x19a1,
+	0x13cc: 0x19a9, 0x13cd: 0x19b1, 0x13ce: 0x19b9, 0x13cf: 0x19c1, 0x13d0: 0x19c9, 0x13d1: 0x19d1,
+	0x13d2: 0x19d9, 0x13d3: 0x19e1, 0x13d4: 0x19e9, 0x13d5: 0x19f1, 0x13d6: 0x19f9, 0x13d7: 0x1a01,
+	0x13d8: 0x1a09, 0x13d9: 0x1a11, 0x13da: 0x1a19, 0x13db: 0x1a21, 0x13dc: 0x1a29, 0x13dd: 0x1a31,
+	0x13de: 0x1a3a, 0x13df: 0x1a42, 0x13e0: 0x1a4a, 0x13e1: 0x1a52, 0x13e2: 0x1a5a, 0x13e3: 0x1a62,
+	0x13e4: 0x1a69, 0x13e5: 0x1a71, 0x13e6: 0x1761, 0x13e7: 0x1a79, 0x13e8: 0x1741, 0x13e9: 0x1769,
+	0x13ea: 0x1a81, 0x13eb: 0x1a89, 0x13ec: 0x1789, 0x13ed: 0x1a91, 0x13ee: 0x1791, 0x13ef: 0x1799,
+	0x13f0: 0x1a99, 0x13f1: 0x1aa1, 0x13f2: 0x17b9, 0x13f3: 0x1aa9, 0x13f4: 0x17c1, 0x13f5: 0x17c9,
+	0x13f6: 0x1ab1, 0x13f7: 0x1ab9, 0x13f8: 0x17d9, 0x13f9: 0x1ac1, 0x13fa: 0x17e1, 0x13fb: 0x17e9,
+	0x13fc: 0x18d1, 0x13fd: 0x18d9, 0x13fe: 0x18f1, 0x13ff: 0x18f9,
+	// Block 0x50, offset 0x1400
+	0x1400: 0x1901, 0x1401: 0x1921, 0x1402: 0x1929, 0x1403: 0x1931, 0x1404: 0x1939, 0x1405: 0x1959,
+	0x1406: 0x1961, 0x1407: 0x1969, 0x1408: 0x1ac9, 0x1409: 0x1989, 0x140a: 0x1ad1, 0x140b: 0x1ad9,
+	0x140c: 0x19b9, 0x140d: 0x1ae1, 0x140e: 0x19c1, 0x140f: 0x19c9, 0x1410: 0x1a31, 0x1411: 0x1ae9,
+	0x1412: 0x1af1, 0x1413: 0x1a09, 0x1414: 0x1af9, 0x1415: 0x1a11, 0x1416: 0x1a19, 0x1417: 0x1751,
+	0x1418: 0x1759, 0x1419: 0x1b01, 0x141a: 0x1761, 0x141b: 0x1b09, 0x141c: 0x1771, 0x141d: 0x1779,
+	0x141e: 0x1781, 0x141f: 0x1789, 0x1420: 0x1b11, 0x1421: 0x17a1, 0x1422: 0x17a9, 0x1423: 0x17b1,
+	0x1424: 0x17b9, 0x1425: 0x1b19, 0x1426: 0x17d9, 0x1427: 0x17f1, 0x1428: 0x17f9, 0x1429: 0x1801,
+	0x142a: 0x1809, 0x142b: 0x1811, 0x142c: 0x1821, 0x142d: 0x1829, 0x142e: 0x1831, 0x142f: 0x1839,
+	0x1430: 0x1841, 0x1431: 0x1849, 0x1432: 0x1b21, 0x1433: 0x1851, 0x1434: 0x1859, 0x1435: 0x1861,
+	0x1436: 0x1869, 0x1437: 0x1871, 0x1438: 0x1879, 0x1439: 0x1889, 0x143a: 0x1891, 0x143b: 0x1899,
+	0x143c: 0x18a1, 0x143d: 0x18a9, 0x143e: 0x18b1, 0x143f: 0x18b9,
+	// Block 0x51, offset 0x1440
+	0x1440: 0x18c1, 0x1441: 0x18c9, 0x1442: 0x18e1, 0x1443: 0x18e9, 0x1444: 0x1909, 0x1445: 0x1911,
+	0x1446: 0x1919, 0x1447: 0x1921, 0x1448: 0x1929, 0x1449: 0x1941, 0x144a: 0x1949, 0x144b: 0x1951,
+	0x144c: 0x1959, 0x144d: 0x1b29, 0x144e: 0x1971, 0x144f: 0x1979, 0x1450: 0x1981, 0x1451: 0x1989,
+	0x1452: 0x19a1, 0x1453: 0x19a9, 0x1454: 0x19b1, 0x1455: 0x19b9, 0x1456: 0x1b31, 0x1457: 0x19d1,
+	0x1458: 0x19d9, 0x1459: 0x1b39, 0x145a: 0x19f1, 0x145b: 0x19f9, 0x145c: 0x1a01, 0x145d: 0x1a09,
+	0x145e: 0x1b41, 0x145f: 0x1761, 0x1460: 0x1b09, 0x1461: 0x1789, 0x1462: 0x1b11, 0x1463: 0x17b9,
+	0x1464: 0x1b19, 0x1465: 0x17d9, 0x1466: 0x1b49, 0x1467: 0x1841, 0x1468: 0x1b51, 0x1469: 0x1b59,
+	0x146a: 0x1b61, 0x146b: 0x1921, 0x146c: 0x1929, 0x146d: 0x1959, 0x146e: 0x19b9, 0x146f: 0x1b31,
+	0x1470: 0x1a09, 0x1471: 0x1b41, 0x1472: 0x1b69, 0x1473: 0x1b71, 0x1474: 0x1b79, 0x1475: 0x1b81,
+	0x1476: 0x1b89, 0x1477: 0x1b91, 0x1478: 0x1b99, 0x1479: 0x1ba1, 0x147a: 0x1ba9, 0x147b: 0x1bb1,
+	0x147c: 0x1bb9, 0x147d: 0x1bc1, 0x147e: 0x1bc9, 0x147f: 0x1bd1,
+	// Block 0x52, offset 0x1480
+	0x1480: 0x1bd9, 0x1481: 0x1be1, 0x1482: 0x1be9, 0x1483: 0x1bf1, 0x1484: 0x1bf9, 0x1485: 0x1c01,
+	0x1486: 0x1c09, 0x1487: 0x1c11, 0x1488: 0x1c19, 0x1489: 0x1c21, 0x148a: 0x1c29, 0x148b: 0x1c31,
+	0x148c: 0x1b59, 0x148d: 0x1c39, 0x148e: 0x1c41, 0x148f: 0x1c49, 0x1490: 0x1c51, 0x1491: 0x1b81,
+	0x1492: 0x1b89, 0x1493: 0x1b91, 0x1494: 0x1b99, 0x1495: 0x1ba1, 0x1496: 0x1ba9, 0x1497: 0x1bb1,
+	0x1498: 0x1bb9, 0x1499: 0x1bc1, 0x149a: 0x1bc9, 0x149b: 0x1bd1, 0x149c: 0x1bd9, 0x149d: 0x1be1,
+	0x149e: 0x1be9, 0x149f: 0x1bf1, 0x14a0: 0x1bf9, 0x14a1: 0x1c01, 0x14a2: 0x1c09, 0x14a3: 0x1c11,
+	0x14a4: 0x1c19, 0x14a5: 0x1c21, 0x14a6: 0x1c29, 0x14a7: 0x1c31, 0x14a8: 0x1b59, 0x14a9: 0x1c39,
+	0x14aa: 0x1c41, 0x14ab: 0x1c49, 0x14ac: 0x1c51, 0x14ad: 0x1c21, 0x14ae: 0x1c29, 0x14af: 0x1c31,
+	0x14b0: 0x1b59, 0x14b1: 0x1b51, 0x14b2: 0x1b61, 0x14b3: 0x1881, 0x14b4: 0x1829, 0x14b5: 0x1831,
+	0x14b6: 0x1839, 0x14b7: 0x1c21, 0x14b8: 0x1c29, 0x14b9: 0x1c31, 0x14ba: 0x1881, 0x14bb: 0x1889,
+	0x14bc: 0x1c59, 0x14bd: 0x1c59, 0x14be: 0x0018, 0x14bf: 0x0018,
+	// Block 0x53, offset 0x14c0
+	0x14c0: 0x0018, 0x14c1: 0x0018, 0x14c2: 0x0018, 0x14c3: 0x0018, 0x14c4: 0x0018, 0x14c5: 0x0018,
+	0x14c6: 0x0018, 0x14c7: 0x0018, 0x14c8: 0x0018, 0x14c9: 0x0018, 0x14ca: 0x0018, 0x14cb: 0x0018,
+	0x14cc: 0x0018, 0x14cd: 0x0018, 0x14ce: 0x0018, 0x14cf: 0x0018, 0x14d0: 0x1c61, 0x14d1: 0x1c69,
+	0x14d2: 0x1c69, 0x14d3: 0x1c71, 0x14d4: 0x1c79, 0x14d5: 0x1c81, 0x14d6: 0x1c89, 0x14d7: 0x1c91,
+	0x14d8: 0x1c99, 0x14d9: 0x1c99, 0x14da: 0x1ca1, 0x14db: 0x1ca9, 0x14dc: 0x1cb1, 0x14dd: 0x1cb9,
+	0x14de: 0x1cc1, 0x14df: 0x1cc9, 0x14e0: 0x1cc9, 0x14e1: 0x1cd1, 0x14e2: 0x1cd9, 0x14e3: 0x1cd9,
+	0x14e4: 0x1ce1, 0x14e5: 0x1ce1, 0x14e6: 0x1ce9, 0x14e7: 0x1cf1, 0x14e8: 0x1cf1, 0x14e9: 0x1cf9,
+	0x14ea: 0x1d01, 0x14eb: 0x1d01, 0x14ec: 0x1d09, 0x14ed: 0x1d09, 0x14ee: 0x1d11, 0x14ef: 0x1d19,
+	0x14f0: 0x1d19, 0x14f1: 0x1d21, 0x14f2: 0x1d21, 0x14f3: 0x1d29, 0x14f4: 0x1d31, 0x14f5: 0x1d39,
+	0x14f6: 0x1d41, 0x14f7: 0x1d41, 0x14f8: 0x1d49, 0x14f9: 0x1d51, 0x14fa: 0x1d59, 0x14fb: 0x1d61,
+	0x14fc: 0x1d69, 0x14fd: 0x1d69, 0x14fe: 0x1d71, 0x14ff: 0x1d79,
+	// Block 0x54, offset 0x1500
+	0x1500: 0x1f29, 0x1501: 0x1f31, 0x1502: 0x1f39, 0x1503: 0x1f11, 0x1504: 0x1d39, 0x1505: 0x1ce9,
+	0x1506: 0x1f41, 0x1507: 0x1f49, 0x1508: 0x0040, 0x1509: 0x0040, 0x150a: 0x0040, 0x150b: 0x0040,
+	0x150c: 0x0040, 0x150d: 0x0040, 0x150e: 0x0040, 0x150f: 0x0018, 0x1510: 0x0040, 0x1511: 0x0040,
+	0x1512: 0x0040, 0x1513: 0x0040, 0x1514: 0x0040, 0x1515: 0x0040, 0x1516: 0x0040, 0x1517: 0x0040,
+	0x1518: 0x0040, 0x1519: 0x0040, 0x151a: 0x0040, 0x151b: 0x0040, 0x151c: 0x0040, 0x151d: 0x0040,
+	0x151e: 0x0040, 0x151f: 0x0040, 0x1520: 0x0040, 0x1521: 0x0040, 0x1522: 0x0040, 0x1523: 0x0040,
+	0x1524: 0x0040, 0x1525: 0x0040, 0x1526: 0x0040, 0x1527: 0x0040, 0x1528: 0x0040, 0x1529: 0x0040,
+	0x152a: 0x0040, 0x152b: 0x0040, 0x152c: 0x0040, 0x152d: 0x0040, 0x152e: 0x0040, 0x152f: 0x0040,
+	0x1530: 0x1f51, 0x1531: 0x1f59, 0x1532: 0x1f61, 0x1533: 0x1f69, 0x1534: 0x1f71, 0x1535: 0x1f79,
+	0x1536: 0x1f81, 0x1537: 0x1f89, 0x1538: 0x1f91, 0x1539: 0x1f99, 0x153a: 0x1fa2, 0x153b: 0x1faa,
+	0x153c: 0x1fb1, 0x153d: 0x0018, 0x153e: 0x0018, 0x153f: 0x0018,
+	// Block 0x55, offset 0x1540
+	0x1540: 0x33c0, 0x1541: 0x33c0, 0x1542: 0x33c0, 0x1543: 0x33c0, 0x1544: 0x33c0, 0x1545: 0x33c0,
+	0x1546: 0x33c0, 0x1547: 0x33c0, 0x1548: 0x33c0, 0x1549: 0x33c0, 0x154a: 0x33c0, 0x154b: 0x33c0,
+	0x154c: 0x33c0, 0x154d: 0x33c0, 0x154e: 0x33c0, 0x154f: 0x33c0, 0x1550: 0x1fba, 0x1551: 0x7d8d,
+	0x1552: 0x0040, 0x1553: 0x1fc2, 0x1554: 0x0122, 0x1555: 0x1fca, 0x1556: 0x1fd2, 0x1557: 0x7dad,
+	0x1558: 0x7dcd, 0x1559: 0x0040, 0x155a: 0x0040, 0x155b: 0x0040, 0x155c: 0x0040, 0x155d: 0x0040,
+	0x155e: 0x0040, 0x155f: 0x0040, 0x1560: 0x3308, 0x1561: 0x3308, 0x1562: 0x3308, 0x1563: 0x3308,
+	0x1564: 0x3308, 0x1565: 0x3308, 0x1566: 0x3308, 0x1567: 0x3308, 0x1568: 0x3308, 0x1569: 0x3308,
+	0x156a: 0x3308, 0x156b: 0x3308, 0x156c: 0x3308, 0x156d: 0x3308, 0x156e: 0x3308, 0x156f: 0x3308,
+	0x1570: 0x0040, 0x1571: 0x7ded, 0x1572: 0x7e0d, 0x1573: 0x1fda, 0x1574: 0x1fda, 0x1575: 0x072a,
+	0x1576: 0x0732, 0x1577: 0x1fe2, 0x1578: 0x1fea, 0x1579: 0x7e2d, 0x157a: 0x7e4d, 0x157b: 0x7e6d,
+	0x157c: 0x7e2d, 0x157d: 0x7e8d, 0x157e: 0x7ead, 0x157f: 0x7e8d,
+	// Block 0x56, offset 0x1580
+	0x1580: 0x7ecd, 0x1581: 0x7eed, 0x1582: 0x7f0d, 0x1583: 0x7eed, 0x1584: 0x7f2d, 0x1585: 0x0018,
+	0x1586: 0x0018, 0x1587: 0x1ff2, 0x1588: 0x1ffa, 0x1589: 0x7f4e, 0x158a: 0x7f6e, 0x158b: 0x7f8e,
+	0x158c: 0x7fae, 0x158d: 0x1fda, 0x158e: 0x1fda, 0x158f: 0x1fda, 0x1590: 0x1fba, 0x1591: 0x7fcd,
+	0x1592: 0x0040, 0x1593: 0x0040, 0x1594: 0x0122, 0x1595: 0x1fc2, 0x1596: 0x1fd2, 0x1597: 0x1fca,
+	0x1598: 0x7fed, 0x1599: 0x072a, 0x159a: 0x0732, 0x159b: 0x1fe2, 0x159c: 0x1fea, 0x159d: 0x7ecd,
+	0x159e: 0x7f2d, 0x159f: 0x2002, 0x15a0: 0x200a, 0x15a1: 0x2012, 0x15a2: 0x071a, 0x15a3: 0x2019,
+	0x15a4: 0x2022, 0x15a5: 0x202a, 0x15a6: 0x0722, 0x15a7: 0x0040, 0x15a8: 0x2032, 0x15a9: 0x203a,
+	0x15aa: 0x2042, 0x15ab: 0x204a, 0x15ac: 0x0040, 0x15ad: 0x0040, 0x15ae: 0x0040, 0x15af: 0x0040,
+	0x15b0: 0x800e, 0x15b1: 0x2051, 0x15b2: 0x802e, 0x15b3: 0x0808, 0x15b4: 0x804e, 0x15b5: 0x0040,
+	0x15b6: 0x806e, 0x15b7: 0x2059, 0x15b8: 0x808e, 0x15b9: 0x2061, 0x15ba: 0x80ae, 0x15bb: 0x2069,
+	0x15bc: 0x80ce, 0x15bd: 0x2071, 0x15be: 0x80ee, 0x15bf: 0x2079,
+	// Block 0x57, offset 0x15c0
+	0x15c0: 0x2081, 0x15c1: 0x2089, 0x15c2: 0x2089, 0x15c3: 0x2091, 0x15c4: 0x2091, 0x15c5: 0x2099,
+	0x15c6: 0x2099, 0x15c7: 0x20a1, 0x15c8: 0x20a1, 0x15c9: 0x20a9, 0x15ca: 0x20a9, 0x15cb: 0x20a9,
+	0x15cc: 0x20a9, 0x15cd: 0x20b1, 0x15ce: 0x20b1, 0x15cf: 0x20b9, 0x15d0: 0x20b9, 0x15d1: 0x20b9,
+	0x15d2: 0x20b9, 0x15d3: 0x20c1, 0x15d4: 0x20c1, 0x15d5: 0x20c9, 0x15d6: 0x20c9, 0x15d7: 0x20c9,
+	0x15d8: 0x20c9, 0x15d9: 0x20d1, 0x15da: 0x20d1, 0x15db: 0x20d1, 0x15dc: 0x20d1, 0x15dd: 0x20d9,
+	0x15de: 0x20d9, 0x15df: 0x20d9, 0x15e0: 0x20d9, 0x15e1: 0x20e1, 0x15e2: 0x20e1, 0x15e3: 0x20e1,
+	0x15e4: 0x20e1, 0x15e5: 0x20e9, 0x15e6: 0x20e9, 0x15e7: 0x20e9, 0x15e8: 0x20e9, 0x15e9: 0x20f1,
+	0x15ea: 0x20f1, 0x15eb: 0x20f9, 0x15ec: 0x20f9, 0x15ed: 0x2101, 0x15ee: 0x2101, 0x15ef: 0x2109,
+	0x15f0: 0x2109, 0x15f1: 0x2111, 0x15f2: 0x2111, 0x15f3: 0x2111, 0x15f4: 0x2111, 0x15f5: 0x2119,
+	0x15f6: 0x2119, 0x15f7: 0x2119, 0x15f8: 0x2119, 0x15f9: 0x2121, 0x15fa: 0x2121, 0x15fb: 0x2121,
+	0x15fc: 0x2121, 0x15fd: 0x2129, 0x15fe: 0x2129, 0x15ff: 0x2129,
+	// Block 0x58, offset 0x1600
+	0x1600: 0x2129, 0x1601: 0x2131, 0x1602: 0x2131, 0x1603: 0x2131, 0x1604: 0x2131, 0x1605: 0x2139,
+	0x1606: 0x2139, 0x1607: 0x2139, 0x1608: 0x2139, 0x1609: 0x2141, 0x160a: 0x2141, 0x160b: 0x2141,
+	0x160c: 0x2141, 0x160d: 0x2149, 0x160e: 0x2149, 0x160f: 0x2149, 0x1610: 0x2149, 0x1611: 0x2151,
+	0x1612: 0x2151, 0x1613: 0x2151, 0x1614: 0x2151, 0x1615: 0x2159, 0x1616: 0x2159, 0x1617: 0x2159,
+	0x1618: 0x2159, 0x1619: 0x2161, 0x161a: 0x2161, 0x161b: 0x2161, 0x161c: 0x2161, 0x161d: 0x2169,
+	0x161e: 0x2169, 0x161f: 0x2169, 0x1620: 0x2169, 0x1621: 0x2171, 0x1622: 0x2171, 0x1623: 0x2171,
+	0x1624: 0x2171, 0x1625: 0x2179, 0x1626: 0x2179, 0x1627: 0x2179, 0x1628: 0x2179, 0x1629: 0x2181,
+	0x162a: 0x2181, 0x162b: 0x2181, 0x162c: 0x2181, 0x162d: 0x2189, 0x162e: 0x2189, 0x162f: 0x1701,
+	0x1630: 0x1701, 0x1631: 0x2191, 0x1632: 0x2191, 0x1633: 0x2191, 0x1634: 0x2191, 0x1635: 0x2199,
+	0x1636: 0x2199, 0x1637: 0x21a1, 0x1638: 0x21a1, 0x1639: 0x21a9, 0x163a: 0x21a9, 0x163b: 0x21b1,
+	0x163c: 0x21b1, 0x163d: 0x0040, 0x163e: 0x0040, 0x163f: 0x03c0,
+	// Block 0x59, offset 0x1640
+	0x1640: 0x0040, 0x1641: 0x1fca, 0x1642: 0x21ba, 0x1643: 0x2002, 0x1644: 0x203a, 0x1645: 0x2042,
+	0x1646: 0x200a, 0x1647: 0x21c2, 0x1648: 0x072a, 0x1649: 0x0732, 0x164a: 0x2012, 0x164b: 0x071a,
+	0x164c: 0x1fba, 0x164d: 0x2019, 0x164e: 0x0961, 0x164f: 0x21ca, 0x1650: 0x06e1, 0x1651: 0x0049,
+	0x1652: 0x0029, 0x1653: 0x0031, 0x1654: 0x06e9, 0x1655: 0x06f1, 0x1656: 0x06f9, 0x1657: 0x0701,
+	0x1658: 0x0709, 0x1659: 0x0711, 0x165a: 0x1fc2, 0x165b: 0x0122, 0x165c: 0x2022, 0x165d: 0x0722,
+	0x165e: 0x202a, 0x165f: 0x1fd2, 0x1660: 0x204a, 0x1661: 0x0019, 0x1662: 0x02e9, 0x1663: 0x03d9,
+	0x1664: 0x02f1, 0x1665: 0x02f9, 0x1666: 0x03f1, 0x1667: 0x0309, 0x1668: 0x00a9, 0x1669: 0x0311,
+	0x166a: 0x00b1, 0x166b: 0x0319, 0x166c: 0x0101, 0x166d: 0x0321, 0x166e: 0x0329, 0x166f: 0x0051,
+	0x1670: 0x0339, 0x1671: 0x0751, 0x1672: 0x00b9, 0x1673: 0x0089, 0x1674: 0x0341, 0x1675: 0x0349,
+	0x1676: 0x0391, 0x1677: 0x00c1, 0x1678: 0x0109, 0x1679: 0x00c9, 0x167a: 0x04b1, 0x167b: 0x1ff2,
+	0x167c: 0x2032, 0x167d: 0x1ffa, 0x167e: 0x21d2, 0x167f: 0x1fda,
+	// Block 0x5a, offset 0x1680
+	0x1680: 0x0672, 0x1681: 0x0019, 0x1682: 0x02e9, 0x1683: 0x03d9, 0x1684: 0x02f1, 0x1685: 0x02f9,
+	0x1686: 0x03f1, 0x1687: 0x0309, 0x1688: 0x00a9, 0x1689: 0x0311, 0x168a: 0x00b1, 0x168b: 0x0319,
+	0x168c: 0x0101, 0x168d: 0x0321, 0x168e: 0x0329, 0x168f: 0x0051, 0x1690: 0x0339, 0x1691: 0x0751,
+	0x1692: 0x00b9, 0x1693: 0x0089, 0x1694: 0x0341, 0x1695: 0x0349, 0x1696: 0x0391, 0x1697: 0x00c1,
+	0x1698: 0x0109, 0x1699: 0x00c9, 0x169a: 0x04b1, 0x169b: 0x1fe2, 0x169c: 0x21da, 0x169d: 0x1fea,
+	0x169e: 0x21e2, 0x169f: 0x810d, 0x16a0: 0x812d, 0x16a1: 0x0961, 0x16a2: 0x814d, 0x16a3: 0x814d,
+	0x16a4: 0x816d, 0x16a5: 0x818d, 0x16a6: 0x81ad, 0x16a7: 0x81cd, 0x16a8: 0x81ed, 0x16a9: 0x820d,
+	0x16aa: 0x822d, 0x16ab: 0x824d, 0x16ac: 0x826d, 0x16ad: 0x828d, 0x16ae: 0x82ad, 0x16af: 0x82cd,
+	0x16b0: 0x82ed, 0x16b1: 0x830d, 0x16b2: 0x832d, 0x16b3: 0x834d, 0x16b4: 0x836d, 0x16b5: 0x838d,
+	0x16b6: 0x83ad, 0x16b7: 0x83cd, 0x16b8: 0x83ed, 0x16b9: 0x840d, 0x16ba: 0x842d, 0x16bb: 0x844d,
+	0x16bc: 0x81ed, 0x16bd: 0x846d, 0x16be: 0x848d, 0x16bf: 0x824d,
+	// Block 0x5b, offset 0x16c0
+	0x16c0: 0x84ad, 0x16c1: 0x84cd, 0x16c2: 0x84ed, 0x16c3: 0x850d, 0x16c4: 0x852d, 0x16c5: 0x854d,
+	0x16c6: 0x856d, 0x16c7: 0x858d, 0x16c8: 0x850d, 0x16c9: 0x85ad, 0x16ca: 0x850d, 0x16cb: 0x85cd,
+	0x16cc: 0x85cd, 0x16cd: 0x85ed, 0x16ce: 0x85ed, 0x16cf: 0x860d, 0x16d0: 0x854d, 0x16d1: 0x862d,
+	0x16d2: 0x864d, 0x16d3: 0x862d, 0x16d4: 0x866d, 0x16d5: 0x864d, 0x16d6: 0x868d, 0x16d7: 0x868d,
+	0x16d8: 0x86ad, 0x16d9: 0x86ad, 0x16da: 0x86cd, 0x16db: 0x86cd, 0x16dc: 0x864d, 0x16dd: 0x814d,
+	0x16de: 0x86ed, 0x16df: 0x870d, 0x16e0: 0x0040, 0x16e1: 0x872d, 0x16e2: 0x874d, 0x16e3: 0x876d,
+	0x16e4: 0x878d, 0x16e5: 0x876d, 0x16e6: 0x87ad, 0x16e7: 0x87cd, 0x16e8: 0x87ed, 0x16e9: 0x87ed,
+	0x16ea: 0x880d, 0x16eb: 0x880d, 0x16ec: 0x882d, 0x16ed: 0x882d, 0x16ee: 0x880d, 0x16ef: 0x880d,
+	0x16f0: 0x884d, 0x16f1: 0x886d, 0x16f2: 0x888d, 0x16f3: 0x88ad, 0x16f4: 0x88cd, 0x16f5: 0x88ed,
+	0x16f6: 0x88ed, 0x16f7: 0x88ed, 0x16f8: 0x890d, 0x16f9: 0x890d, 0x16fa: 0x890d, 0x16fb: 0x890d,
+	0x16fc: 0x87ed, 0x16fd: 0x87ed, 0x16fe: 0x87ed, 0x16ff: 0x0040,
+	// Block 0x5c, offset 0x1700
+	0x1700: 0x0040, 0x1701: 0x0040, 0x1702: 0x874d, 0x1703: 0x872d, 0x1704: 0x892d, 0x1705: 0x872d,
+	0x1706: 0x874d, 0x1707: 0x872d, 0x1708: 0x0040, 0x1709: 0x0040, 0x170a: 0x894d, 0x170b: 0x874d,
+	0x170c: 0x896d, 0x170d: 0x892d, 0x170e: 0x896d, 0x170f: 0x874d, 0x1710: 0x0040, 0x1711: 0x0040,
+	0x1712: 0x898d, 0x1713: 0x89ad, 0x1714: 0x88ad, 0x1715: 0x896d, 0x1716: 0x892d, 0x1717: 0x896d,
+	0x1718: 0x0040, 0x1719: 0x0040, 0x171a: 0x89cd, 0x171b: 0x89ed, 0x171c: 0x89cd, 0x171d: 0x0040,
+	0x171e: 0x0040, 0x171f: 0x0040, 0x1720: 0x21e9, 0x1721: 0x21f1, 0x1722: 0x21f9, 0x1723: 0x8a0e,
+	0x1724: 0x2201, 0x1725: 0x2209, 0x1726: 0x8a2d, 0x1727: 0x0040, 0x1728: 0x8a4d, 0x1729: 0x8a6d,
+	0x172a: 0x8a8d, 0x172b: 0x8a6d, 0x172c: 0x8aad, 0x172d: 0x8acd, 0x172e: 0x8aed, 0x172f: 0x0040,
+	0x1730: 0x0040, 0x1731: 0x0040, 0x1732: 0x0040, 0x1733: 0x0040, 0x1734: 0x0040, 0x1735: 0x0040,
+	0x1736: 0x0040, 0x1737: 0x0040, 0x1738: 0x0040, 0x1739: 0x0340, 0x173a: 0x0340, 0x173b: 0x0340,
+	0x173c: 0x0040, 0x173d: 0x0040, 0x173e: 0x0040, 0x173f: 0x0040,
+	// Block 0x5d, offset 0x1740
+	0x1740: 0x0008, 0x1741: 0x0008, 0x1742: 0x0008, 0x1743: 0x0008, 0x1744: 0x0008, 0x1745: 0x0008,
+	0x1746: 0x0008, 0x1747: 0x0008, 0x1748: 0x0008, 0x1749: 0x0008, 0x174a: 0x0008, 0x174b: 0x0008,
+	0x174c: 0x0008, 0x174d: 0x0008, 0x174e: 0x0008, 0x174f: 0x0008, 0x1750: 0x0008, 0x1751: 0x0008,
+	0x1752: 0x0008, 0x1753: 0x0008, 0x1754: 0x0008, 0x1755: 0x0008, 0x1756: 0x0008, 0x1757: 0x0008,
+	0x1758: 0x0008, 0x1759: 0x0008, 0x175a: 0x0008, 0x175b: 0x0008, 0x175c: 0x0008, 0x175d: 0x0008,
+	0x175e: 0x0008, 0x175f: 0x0008, 0x1760: 0x0008, 0x1761: 0x0008, 0x1762: 0x0008, 0x1763: 0x0008,
+	0x1764: 0x0040, 0x1765: 0x0040, 0x1766: 0x0040, 0x1767: 0x0040, 0x1768: 0x0040, 0x1769: 0x0040,
+	0x176a: 0x0040, 0x176b: 0x0040, 0x176c: 0x0040, 0x176d: 0x0040, 0x176e: 0x0040, 0x176f: 0x0018,
+	0x1770: 0x8b3d, 0x1771: 0x8b55, 0x1772: 0x8b6d, 0x1773: 0x8b55, 0x1774: 0x8b85, 0x1775: 0x8b55,
+	0x1776: 0x8b6d, 0x1777: 0x8b55, 0x1778: 0x8b3d, 0x1779: 0x8b9d, 0x177a: 0x8bb5, 0x177b: 0x0040,
+	0x177c: 0x8bcd, 0x177d: 0x8b9d, 0x177e: 0x8bb5, 0x177f: 0x8b9d,
+	// Block 0x5e, offset 0x1780
+	0x1780: 0xe13d, 0x1781: 0xe14d, 0x1782: 0xe15d, 0x1783: 0xe14d, 0x1784: 0xe17d, 0x1785: 0xe14d,
+	0x1786: 0xe15d, 0x1787: 0xe14d, 0x1788: 0xe13d, 0x1789: 0xe1cd, 0x178a: 0xe1dd, 0x178b: 0x0040,
+	0x178c: 0xe1fd, 0x178d: 0xe1cd, 0x178e: 0xe1dd, 0x178f: 0xe1cd, 0x1790: 0xe13d, 0x1791: 0xe14d,
+	0x1792: 0xe15d, 0x1793: 0x0040, 0x1794: 0xe17d, 0x1795: 0xe14d, 0x1796: 0x0040, 0x1797: 0x0008,
+	0x1798: 0x0008, 0x1799: 0x0008, 0x179a: 0x0008, 0x179b: 0x0008, 0x179c: 0x0008, 0x179d: 0x0008,
+	0x179e: 0x0008, 0x179f: 0x0008, 0x17a0: 0x0008, 0x17a1: 0x0008, 0x17a2: 0x0040, 0x17a3: 0x0008,
+	0x17a4: 0x0008, 0x17a5: 0x0008, 0x17a6: 0x0008, 0x17a7: 0x0008, 0x17a8: 0x0008, 0x17a9: 0x0008,
+	0x17aa: 0x0008, 0x17ab: 0x0008, 0x17ac: 0x0008, 0x17ad: 0x0008, 0x17ae: 0x0008, 0x17af: 0x0008,
+	0x17b0: 0x0008, 0x17b1: 0x0008, 0x17b2: 0x0040, 0x17b3: 0x0008, 0x17b4: 0x0008, 0x17b5: 0x0008,
+	0x17b6: 0x0008, 0x17b7: 0x0008, 0x17b8: 0x0008, 0x17b9: 0x0008, 0x17ba: 0x0040, 0x17bb: 0x0008,
+	0x17bc: 0x0008, 0x17bd: 0x0040, 0x17be: 0x0040, 0x17bf: 0x0040,
+	// Block 0x5f, offset 0x17c0
+	0x17c0: 0x0008, 0x17c1: 0x2211, 0x17c2: 0x2219, 0x17c3: 0x02e1, 0x17c4: 0x2221, 0x17c5: 0x2229,
+	0x17c6: 0x0040, 0x17c7: 0x2231, 0x17c8: 0x2239, 0x17c9: 0x2241, 0x17ca: 0x2249, 0x17cb: 0x2251,
+	0x17cc: 0x2259, 0x17cd: 0x2261, 0x17ce: 0x2269, 0x17cf: 0x2271, 0x17d0: 0x2279, 0x17d1: 0x2281,
+	0x17d2: 0x2289, 0x17d3: 0x2291, 0x17d4: 0x2299, 0x17d5: 0x0741, 0x17d6: 0x22a1, 0x17d7: 0x22a9,
+	0x17d8: 0x22b1, 0x17d9: 0x22b9, 0x17da: 0x22c1, 0x17db: 0x13d9, 0x17dc: 0x8be5, 0x17dd: 0x22c9,
+	0x17de: 0x22d1, 0x17df: 0x8c05, 0x17e0: 0x22d9, 0x17e1: 0x8c25, 0x17e2: 0x22e1, 0x17e3: 0x22e9,
+	0x17e4: 0x22f1, 0x17e5: 0x0751, 0x17e6: 0x22f9, 0x17e7: 0x8c45, 0x17e8: 0x0949, 0x17e9: 0x2301,
+	0x17ea: 0x2309, 0x17eb: 0x2311, 0x17ec: 0x2319, 0x17ed: 0x2321, 0x17ee: 0x2329, 0x17ef: 0x2331,
+	0x17f0: 0x2339, 0x17f1: 0x0040, 0x17f2: 0x2341, 0x17f3: 0x2349, 0x17f4: 0x2351, 0x17f5: 0x2359,
+	0x17f6: 0x2361, 0x17f7: 0x2369, 0x17f8: 0x2371, 0x17f9: 0x8c65, 0x17fa: 0x8c85, 0x17fb: 0x0040,
+	0x17fc: 0x0040, 0x17fd: 0x0040, 0x17fe: 0x0040, 0x17ff: 0x0040,
+	// Block 0x60, offset 0x1800
+	0x1800: 0x0a08, 0x1801: 0x0a08, 0x1802: 0x0a08, 0x1803: 0x0a08, 0x1804: 0x0a08, 0x1805: 0x0c08,
+	0x1806: 0x0808, 0x1807: 0x0c08, 0x1808: 0x0818, 0x1809: 0x0c08, 0x180a: 0x0c08, 0x180b: 0x0808,
+	0x180c: 0x0808, 0x180d: 0x0908, 0x180e: 0x0c08, 0x180f: 0x0c08, 0x1810: 0x0c08, 0x1811: 0x0c08,
+	0x1812: 0x0c08, 0x1813: 0x0a08, 0x1814: 0x0a08, 0x1815: 0x0a08, 0x1816: 0x0a08, 0x1817: 0x0908,
+	0x1818: 0x0a08, 0x1819: 0x0a08, 0x181a: 0x0a08, 0x181b: 0x0a08, 0x181c: 0x0a08, 0x181d: 0x0c08,
+	0x181e: 0x0a08, 0x181f: 0x0a08, 0x1820: 0x0a08, 0x1821: 0x0c08, 0x1822: 0x0808, 0x1823: 0x0808,
+	0x1824: 0x0c08, 0x1825: 0x3308, 0x1826: 0x3308, 0x1827: 0x0040, 0x1828: 0x0040, 0x1829: 0x0040,
+	0x182a: 0x0040, 0x182b: 0x0a18, 0x182c: 0x0a18, 0x182d: 0x0a18, 0x182e: 0x0a18, 0x182f: 0x0c18,
+	0x1830: 0x0818, 0x1831: 0x0818, 0x1832: 0x0818, 0x1833: 0x0818, 0x1834: 0x0818, 0x1835: 0x0818,
+	0x1836: 0x0818, 0x1837: 0x0040, 0x1838: 0x0040, 0x1839: 0x0040, 0x183a: 0x0040, 0x183b: 0x0040,
+	0x183c: 0x0040, 0x183d: 0x0040, 0x183e: 0x0040, 0x183f: 0x0040,
+	// Block 0x61, offset 0x1840
+	0x1840: 0x0a08, 0x1841: 0x0c08, 0x1842: 0x0a08, 0x1843: 0x0c08, 0x1844: 0x0c08, 0x1845: 0x0c08,
+	0x1846: 0x0a08, 0x1847: 0x0a08, 0x1848: 0x0a08, 0x1849: 0x0c08, 0x184a: 0x0a08, 0x184b: 0x0a08,
+	0x184c: 0x0c08, 0x184d: 0x0a08, 0x184e: 0x0c08, 0x184f: 0x0c08, 0x1850: 0x0a08, 0x1851: 0x0c08,
+	0x1852: 0x0040, 0x1853: 0x0040, 0x1854: 0x0040, 0x1855: 0x0040, 0x1856: 0x0040, 0x1857: 0x0040,
+	0x1858: 0x0040, 0x1859: 0x0818, 0x185a: 0x0818, 0x185b: 0x0818, 0x185c: 0x0818, 0x185d: 0x0040,
+	0x185e: 0x0040, 0x185f: 0x0040, 0x1860: 0x0040, 0x1861: 0x0040, 0x1862: 0x0040, 0x1863: 0x0040,
+	0x1864: 0x0040, 0x1865: 0x0040, 0x1866: 0x0040, 0x1867: 0x0040, 0x1868: 0x0040, 0x1869: 0x0c18,
+	0x186a: 0x0c18, 0x186b: 0x0c18, 0x186c: 0x0c18, 0x186d: 0x0a18, 0x186e: 0x0a18, 0x186f: 0x0818,
+	0x1870: 0x0040, 0x1871: 0x0040, 0x1872: 0x0040, 0x1873: 0x0040, 0x1874: 0x0040, 0x1875: 0x0040,
+	0x1876: 0x0040, 0x1877: 0x0040, 0x1878: 0x0040, 0x1879: 0x0040, 0x187a: 0x0040, 0x187b: 0x0040,
+	0x187c: 0x0040, 0x187d: 0x0040, 0x187e: 0x0040, 0x187f: 0x0040,
+	// Block 0x62, offset 0x1880
+	0x1880: 0x3308, 0x1881: 0x3308, 0x1882: 0x3008, 0x1883: 0x3008, 0x1884: 0x0040, 0x1885: 0x0008,
+	0x1886: 0x0008, 0x1887: 0x0008, 0x1888: 0x0008, 0x1889: 0x0008, 0x188a: 0x0008, 0x188b: 0x0008,
+	0x188c: 0x0008, 0x188d: 0x0040, 0x188e: 0x0040, 0x188f: 0x0008, 0x1890: 0x0008, 0x1891: 0x0040,
+	0x1892: 0x0040, 0x1893: 0x0008, 0x1894: 0x0008, 0x1895: 0x0008, 0x1896: 0x0008, 0x1897: 0x0008,
+	0x1898: 0x0008, 0x1899: 0x0008, 0x189a: 0x0008, 0x189b: 0x0008, 0x189c: 0x0008, 0x189d: 0x0008,
+	0x189e: 0x0008, 0x189f: 0x0008, 0x18a0: 0x0008, 0x18a1: 0x0008, 0x18a2: 0x0008, 0x18a3: 0x0008,
+	0x18a4: 0x0008, 0x18a5: 0x0008, 0x18a6: 0x0008, 0x18a7: 0x0008, 0x18a8: 0x0008, 0x18a9: 0x0040,
+	0x18aa: 0x0008, 0x18ab: 0x0008, 0x18ac: 0x0008, 0x18ad: 0x0008, 0x18ae: 0x0008, 0x18af: 0x0008,
+	0x18b0: 0x0008, 0x18b1: 0x0040, 0x18b2: 0x0008, 0x18b3: 0x0008, 0x18b4: 0x0040, 0x18b5: 0x0008,
+	0x18b6: 0x0008, 0x18b7: 0x0008, 0x18b8: 0x0008, 0x18b9: 0x0008, 0x18ba: 0x0040, 0x18bb: 0x3308,
+	0x18bc: 0x3308, 0x18bd: 0x0008, 0x18be: 0x3008, 0x18bf: 0x3008,
+	// Block 0x63, offset 0x18c0
+	0x18c0: 0x3308, 0x18c1: 0x3008, 0x18c2: 0x3008, 0x18c3: 0x3008, 0x18c4: 0x3008, 0x18c5: 0x0040,
+	0x18c6: 0x0040, 0x18c7: 0x3008, 0x18c8: 0x3008, 0x18c9: 0x0040, 0x18ca: 0x0040, 0x18cb: 0x3008,
+	0x18cc: 0x3008, 0x18cd: 0x3808, 0x18ce: 0x0040, 0x18cf: 0x0040, 0x18d0: 0x0008, 0x18d1: 0x0040,
+	0x18d2: 0x0040, 0x18d3: 0x0040, 0x18d4: 0x0040, 0x18d5: 0x0040, 0x18d6: 0x0040, 0x18d7: 0x3008,
+	0x18d8: 0x0040, 0x18d9: 0x0040, 0x18da: 0x0040, 0x18db: 0x0040, 0x18dc: 0x0040, 0x18dd: 0x0008,
+	0x18de: 0x0008, 0x18df: 0x0008, 0x18e0: 0x0008, 0x18e1: 0x0008, 0x18e2: 0x3008, 0x18e3: 0x3008,
+	0x18e4: 0x0040, 0x18e5: 0x0040, 0x18e6: 0x3308, 0x18e7: 0x3308, 0x18e8: 0x3308, 0x18e9: 0x3308,
+	0x18ea: 0x3308, 0x18eb: 0x3308, 0x18ec: 0x3308, 0x18ed: 0x0040, 0x18ee: 0x0040, 0x18ef: 0x0040,
+	0x18f0: 0x3308, 0x18f1: 0x3308, 0x18f2: 0x3308, 0x18f3: 0x3308, 0x18f4: 0x3308, 0x18f5: 0x0040,
+	0x18f6: 0x0040, 0x18f7: 0x0040, 0x18f8: 0x0040, 0x18f9: 0x0040, 0x18fa: 0x0040, 0x18fb: 0x0040,
+	0x18fc: 0x0040, 0x18fd: 0x0040, 0x18fe: 0x0040, 0x18ff: 0x0040,
+	// Block 0x64, offset 0x1900
+	0x1900: 0x0008, 0x1901: 0x0008, 0x1902: 0x0008, 0x1903: 0x0008, 0x1904: 0x0008, 0x1905: 0x0008,
+	0x1906: 0x0008, 0x1907: 0x0040, 0x1908: 0x0040, 0x1909: 0x0008, 0x190a: 0x0040, 0x190b: 0x0040,
+	0x190c: 0x0008, 0x190d: 0x0008, 0x190e: 0x0008, 0x190f: 0x0008, 0x1910: 0x0008, 0x1911: 0x0008,
+	0x1912: 0x0008, 0x1913: 0x0008, 0x1914: 0x0040, 0x1915: 0x0008, 0x1916: 0x0008, 0x1917: 0x0040,
+	0x1918: 0x0008, 0x1919: 0x0008, 0x191a: 0x0008, 0x191b: 0x0008, 0x191c: 0x0008, 0x191d: 0x0008,
+	0x191e: 0x0008, 0x191f: 0x0008, 0x1920: 0x0008, 0x1921: 0x0008, 0x1922: 0x0008, 0x1923: 0x0008,
+	0x1924: 0x0008, 0x1925: 0x0008, 0x1926: 0x0008, 0x1927: 0x0008, 0x1928: 0x0008, 0x1929: 0x0008,
+	0x192a: 0x0008, 0x192b: 0x0008, 0x192c: 0x0008, 0x192d: 0x0008, 0x192e: 0x0008, 0x192f: 0x0008,
+	0x1930: 0x3008, 0x1931: 0x3008, 0x1932: 0x3008, 0x1933: 0x3008, 0x1934: 0x3008, 0x1935: 0x3008,
+	0x1936: 0x0040, 0x1937: 0x3008, 0x1938: 0x3008, 0x1939: 0x0040, 0x193a: 0x0040, 0x193b: 0x3308,
+	0x193c: 0x3308, 0x193d: 0x3808, 0x193e: 0x3b08, 0x193f: 0x0008,
+	// Block 0x65, offset 0x1940
+	0x1940: 0x0019, 0x1941: 0x02e9, 0x1942: 0x03d9, 0x1943: 0x02f1, 0x1944: 0x02f9, 0x1945: 0x03f1,
+	0x1946: 0x0309, 0x1947: 0x00a9, 0x1948: 0x0311, 0x1949: 0x00b1, 0x194a: 0x0319, 0x194b: 0x0101,
+	0x194c: 0x0321, 0x194d: 0x0329, 0x194e: 0x0051, 0x194f: 0x0339, 0x1950: 0x0751, 0x1951: 0x00b9,
+	0x1952: 0x0089, 0x1953: 0x0341, 0x1954: 0x0349, 0x1955: 0x0391, 0x1956: 0x00c1, 0x1957: 0x0109,
+	0x1958: 0x00c9, 0x1959: 0x04b1, 0x195a: 0x0019, 0x195b: 0x02e9, 0x195c: 0x03d9, 0x195d: 0x02f1,
+	0x195e: 0x02f9, 0x195f: 0x03f1, 0x1960: 0x0309, 0x1961: 0x00a9, 0x1962: 0x0311, 0x1963: 0x00b1,
+	0x1964: 0x0319, 0x1965: 0x0101, 0x1966: 0x0321, 0x1967: 0x0329, 0x1968: 0x0051, 0x1969: 0x0339,
+	0x196a: 0x0751, 0x196b: 0x00b9, 0x196c: 0x0089, 0x196d: 0x0341, 0x196e: 0x0349, 0x196f: 0x0391,
+	0x1970: 0x00c1, 0x1971: 0x0109, 0x1972: 0x00c9, 0x1973: 0x04b1, 0x1974: 0x0019, 0x1975: 0x02e9,
+	0x1976: 0x03d9, 0x1977: 0x02f1, 0x1978: 0x02f9, 0x1979: 0x03f1, 0x197a: 0x0309, 0x197b: 0x00a9,
+	0x197c: 0x0311, 0x197d: 0x00b1, 0x197e: 0x0319, 0x197f: 0x0101,
+	// Block 0x66, offset 0x1980
+	0x1980: 0x0321, 0x1981: 0x0329, 0x1982: 0x0051, 0x1983: 0x0339, 0x1984: 0x0751, 0x1985: 0x00b9,
+	0x1986: 0x0089, 0x1987: 0x0341, 0x1988: 0x0349, 0x1989: 0x0391, 0x198a: 0x00c1, 0x198b: 0x0109,
+	0x198c: 0x00c9, 0x198d: 0x04b1, 0x198e: 0x0019, 0x198f: 0x02e9, 0x1990: 0x03d9, 0x1991: 0x02f1,
+	0x1992: 0x02f9, 0x1993: 0x03f1, 0x1994: 0x0309, 0x1995: 0x0040, 0x1996: 0x0311, 0x1997: 0x00b1,
+	0x1998: 0x0319, 0x1999: 0x0101, 0x199a: 0x0321, 0x199b: 0x0329, 0x199c: 0x0051, 0x199d: 0x0339,
+	0x199e: 0x0751, 0x199f: 0x00b9, 0x19a0: 0x0089, 0x19a1: 0x0341, 0x19a2: 0x0349, 0x19a3: 0x0391,
+	0x19a4: 0x00c1, 0x19a5: 0x0109, 0x19a6: 0x00c9, 0x19a7: 0x04b1, 0x19a8: 0x0019, 0x19a9: 0x02e9,
+	0x19aa: 0x03d9, 0x19ab: 0x02f1, 0x19ac: 0x02f9, 0x19ad: 0x03f1, 0x19ae: 0x0309, 0x19af: 0x00a9,
+	0x19b0: 0x0311, 0x19b1: 0x00b1, 0x19b2: 0x0319, 0x19b3: 0x0101, 0x19b4: 0x0321, 0x19b5: 0x0329,
+	0x19b6: 0x0051, 0x19b7: 0x0339, 0x19b8: 0x0751, 0x19b9: 0x00b9, 0x19ba: 0x0089, 0x19bb: 0x0341,
+	0x19bc: 0x0349, 0x19bd: 0x0391, 0x19be: 0x00c1, 0x19bf: 0x0109,
+	// Block 0x67, offset 0x19c0
+	0x19c0: 0x00c9, 0x19c1: 0x04b1, 0x19c2: 0x0019, 0x19c3: 0x02e9, 0x19c4: 0x03d9, 0x19c5: 0x02f1,
+	0x19c6: 0x02f9, 0x19c7: 0x03f1, 0x19c8: 0x0309, 0x19c9: 0x00a9, 0x19ca: 0x0311, 0x19cb: 0x00b1,
+	0x19cc: 0x0319, 0x19cd: 0x0101, 0x19ce: 0x0321, 0x19cf: 0x0329, 0x19d0: 0x0051, 0x19d1: 0x0339,
+	0x19d2: 0x0751, 0x19d3: 0x00b9, 0x19d4: 0x0089, 0x19d5: 0x0341, 0x19d6: 0x0349, 0x19d7: 0x0391,
+	0x19d8: 0x00c1, 0x19d9: 0x0109, 0x19da: 0x00c9, 0x19db: 0x04b1, 0x19dc: 0x0019, 0x19dd: 0x0040,
+	0x19de: 0x03d9, 0x19df: 0x02f1, 0x19e0: 0x0040, 0x19e1: 0x0040, 0x19e2: 0x0309, 0x19e3: 0x0040,
+	0x19e4: 0x0040, 0x19e5: 0x00b1, 0x19e6: 0x0319, 0x19e7: 0x0040, 0x19e8: 0x0040, 0x19e9: 0x0329,
+	0x19ea: 0x0051, 0x19eb: 0x0339, 0x19ec: 0x0751, 0x19ed: 0x0040, 0x19ee: 0x0089, 0x19ef: 0x0341,
+	0x19f0: 0x0349, 0x19f1: 0x0391, 0x19f2: 0x00c1, 0x19f3: 0x0109, 0x19f4: 0x00c9, 0x19f5: 0x04b1,
+	0x19f6: 0x0019, 0x19f7: 0x02e9, 0x19f8: 0x03d9, 0x19f9: 0x02f1, 0x19fa: 0x0040, 0x19fb: 0x03f1,
+	0x19fc: 0x0040, 0x19fd: 0x00a9, 0x19fe: 0x0311, 0x19ff: 0x00b1,
+	// Block 0x68, offset 0x1a00
+	0x1a00: 0x0319, 0x1a01: 0x0101, 0x1a02: 0x0321, 0x1a03: 0x0329, 0x1a04: 0x0040, 0x1a05: 0x0339,
+	0x1a06: 0x0751, 0x1a07: 0x00b9, 0x1a08: 0x0089, 0x1a09: 0x0341, 0x1a0a: 0x0349, 0x1a0b: 0x0391,
+	0x1a0c: 0x00c1, 0x1a0d: 0x0109, 0x1a0e: 0x00c9, 0x1a0f: 0x04b1, 0x1a10: 0x0019, 0x1a11: 0x02e9,
+	0x1a12: 0x03d9, 0x1a13: 0x02f1, 0x1a14: 0x02f9, 0x1a15: 0x03f1, 0x1a16: 0x0309, 0x1a17: 0x00a9,
+	0x1a18: 0x0311, 0x1a19: 0x00b1, 0x1a1a: 0x0319, 0x1a1b: 0x0101, 0x1a1c: 0x0321, 0x1a1d: 0x0329,
+	0x1a1e: 0x0051, 0x1a1f: 0x0339, 0x1a20: 0x0751, 0x1a21: 0x00b9, 0x1a22: 0x0089, 0x1a23: 0x0341,
+	0x1a24: 0x0349, 0x1a25: 0x0391, 0x1a26: 0x00c1, 0x1a27: 0x0109, 0x1a28: 0x00c9, 0x1a29: 0x04b1,
+	0x1a2a: 0x0019, 0x1a2b: 0x02e9, 0x1a2c: 0x03d9, 0x1a2d: 0x02f1, 0x1a2e: 0x02f9, 0x1a2f: 0x03f1,
+	0x1a30: 0x0309, 0x1a31: 0x00a9, 0x1a32: 0x0311, 0x1a33: 0x00b1, 0x1a34: 0x0319, 0x1a35: 0x0101,
+	0x1a36: 0x0321, 0x1a37: 0x0329, 0x1a38: 0x0051, 0x1a39: 0x0339, 0x1a3a: 0x0751, 0x1a3b: 0x00b9,
+	0x1a3c: 0x0089, 0x1a3d: 0x0341, 0x1a3e: 0x0349, 0x1a3f: 0x0391,
+	// Block 0x69, offset 0x1a40
+	0x1a40: 0x00c1, 0x1a41: 0x0109, 0x1a42: 0x00c9, 0x1a43: 0x04b1, 0x1a44: 0x0019, 0x1a45: 0x02e9,
+	0x1a46: 0x0040, 0x1a47: 0x02f1, 0x1a48: 0x02f9, 0x1a49: 0x03f1, 0x1a4a: 0x0309, 0x1a4b: 0x0040,
+	0x1a4c: 0x0040, 0x1a4d: 0x00b1, 0x1a4e: 0x0319, 0x1a4f: 0x0101, 0x1a50: 0x0321, 0x1a51: 0x0329,
+	0x1a52: 0x0051, 0x1a53: 0x0339, 0x1a54: 0x0751, 0x1a55: 0x0040, 0x1a56: 0x0089, 0x1a57: 0x0341,
+	0x1a58: 0x0349, 0x1a59: 0x0391, 0x1a5a: 0x00c1, 0x1a5b: 0x0109, 0x1a5c: 0x00c9, 0x1a5d: 0x0040,
+	0x1a5e: 0x0019, 0x1a5f: 0x02e9, 0x1a60: 0x03d9, 0x1a61: 0x02f1, 0x1a62: 0x02f9, 0x1a63: 0x03f1,
+	0x1a64: 0x0309, 0x1a65: 0x00a9, 0x1a66: 0x0311, 0x1a67: 0x00b1, 0x1a68: 0x0319, 0x1a69: 0x0101,
+	0x1a6a: 0x0321, 0x1a6b: 0x0329, 0x1a6c: 0x0051, 0x1a6d: 0x0339, 0x1a6e: 0x0751, 0x1a6f: 0x00b9,
+	0x1a70: 0x0089, 0x1a71: 0x0341, 0x1a72: 0x0349, 0x1a73: 0x0391, 0x1a74: 0x00c1, 0x1a75: 0x0109,
+	0x1a76: 0x00c9, 0x1a77: 0x04b1, 0x1a78: 0x0019, 0x1a79: 0x02e9, 0x1a7a: 0x0040, 0x1a7b: 0x02f1,
+	0x1a7c: 0x02f9, 0x1a7d: 0x03f1, 0x1a7e: 0x0309, 0x1a7f: 0x0040,
+	// Block 0x6a, offset 0x1a80
+	0x1a80: 0x0311, 0x1a81: 0x00b1, 0x1a82: 0x0319, 0x1a83: 0x0101, 0x1a84: 0x0321, 0x1a85: 0x0040,
+	0x1a86: 0x0051, 0x1a87: 0x0040, 0x1a88: 0x0040, 0x1a89: 0x0040, 0x1a8a: 0x0089, 0x1a8b: 0x0341,
+	0x1a8c: 0x0349, 0x1a8d: 0x0391, 0x1a8e: 0x00c1, 0x1a8f: 0x0109, 0x1a90: 0x00c9, 0x1a91: 0x0040,
+	0x1a92: 0x0019, 0x1a93: 0x02e9, 0x1a94: 0x03d9, 0x1a95: 0x02f1, 0x1a96: 0x02f9, 0x1a97: 0x03f1,
+	0x1a98: 0x0309, 0x1a99: 0x00a9, 0x1a9a: 0x0311, 0x1a9b: 0x00b1, 0x1a9c: 0x0319, 0x1a9d: 0x0101,
+	0x1a9e: 0x0321, 0x1a9f: 0x0329, 0x1aa0: 0x0051, 0x1aa1: 0x0339, 0x1aa2: 0x0751, 0x1aa3: 0x00b9,
+	0x1aa4: 0x0089, 0x1aa5: 0x0341, 0x1aa6: 0x0349, 0x1aa7: 0x0391, 0x1aa8: 0x00c1, 0x1aa9: 0x0109,
+	0x1aaa: 0x00c9, 0x1aab: 0x04b1, 0x1aac: 0x0019, 0x1aad: 0x02e9, 0x1aae: 0x03d9, 0x1aaf: 0x02f1,
+	0x1ab0: 0x02f9, 0x1ab1: 0x03f1, 0x1ab2: 0x0309, 0x1ab3: 0x00a9, 0x1ab4: 0x0311, 0x1ab5: 0x00b1,
+	0x1ab6: 0x0319, 0x1ab7: 0x0101, 0x1ab8: 0x0321, 0x1ab9: 0x0329, 0x1aba: 0x0051, 0x1abb: 0x0339,
+	0x1abc: 0x0751, 0x1abd: 0x00b9, 0x1abe: 0x0089, 0x1abf: 0x0341,
+	// Block 0x6b, offset 0x1ac0
+	0x1ac0: 0x0349, 0x1ac1: 0x0391, 0x1ac2: 0x00c1, 0x1ac3: 0x0109, 0x1ac4: 0x00c9, 0x1ac5: 0x04b1,
+	0x1ac6: 0x0019, 0x1ac7: 0x02e9, 0x1ac8: 0x03d9, 0x1ac9: 0x02f1, 0x1aca: 0x02f9, 0x1acb: 0x03f1,
+	0x1acc: 0x0309, 0x1acd: 0x00a9, 0x1ace: 0x0311, 0x1acf: 0x00b1, 0x1ad0: 0x0319, 0x1ad1: 0x0101,
+	0x1ad2: 0x0321, 0x1ad3: 0x0329, 0x1ad4: 0x0051, 0x1ad5: 0x0339, 0x1ad6: 0x0751, 0x1ad7: 0x00b9,
+	0x1ad8: 0x0089, 0x1ad9: 0x0341, 0x1ada: 0x0349, 0x1adb: 0x0391, 0x1adc: 0x00c1, 0x1add: 0x0109,
+	0x1ade: 0x00c9, 0x1adf: 0x04b1, 0x1ae0: 0x0019, 0x1ae1: 0x02e9, 0x1ae2: 0x03d9, 0x1ae3: 0x02f1,
+	0x1ae4: 0x02f9, 0x1ae5: 0x03f1, 0x1ae6: 0x0309, 0x1ae7: 0x00a9, 0x1ae8: 0x0311, 0x1ae9: 0x00b1,
+	0x1aea: 0x0319, 0x1aeb: 0x0101, 0x1aec: 0x0321, 0x1aed: 0x0329, 0x1aee: 0x0051, 0x1aef: 0x0339,
+	0x1af0: 0x0751, 0x1af1: 0x00b9, 0x1af2: 0x0089, 0x1af3: 0x0341, 0x1af4: 0x0349, 0x1af5: 0x0391,
+	0x1af6: 0x00c1, 0x1af7: 0x0109, 0x1af8: 0x00c9, 0x1af9: 0x04b1, 0x1afa: 0x0019, 0x1afb: 0x02e9,
+	0x1afc: 0x03d9, 0x1afd: 0x02f1, 0x1afe: 0x02f9, 0x1aff: 0x03f1,
+	// Block 0x6c, offset 0x1b00
+	0x1b00: 0x0309, 0x1b01: 0x00a9, 0x1b02: 0x0311, 0x1b03: 0x00b1, 0x1b04: 0x0319, 0x1b05: 0x0101,
+	0x1b06: 0x0321, 0x1b07: 0x0329, 0x1b08: 0x0051, 0x1b09: 0x0339, 0x1b0a: 0x0751, 0x1b0b: 0x00b9,
+	0x1b0c: 0x0089, 0x1b0d: 0x0341, 0x1b0e: 0x0349, 0x1b0f: 0x0391, 0x1b10: 0x00c1, 0x1b11: 0x0109,
+	0x1b12: 0x00c9, 0x1b13: 0x04b1, 0x1b14: 0x0019, 0x1b15: 0x02e9, 0x1b16: 0x03d9, 0x1b17: 0x02f1,
+	0x1b18: 0x02f9, 0x1b19: 0x03f1, 0x1b1a: 0x0309, 0x1b1b: 0x00a9, 0x1b1c: 0x0311, 0x1b1d: 0x00b1,
+	0x1b1e: 0x0319, 0x1b1f: 0x0101, 0x1b20: 0x0321, 0x1b21: 0x0329, 0x1b22: 0x0051, 0x1b23: 0x0339,
+	0x1b24: 0x0751, 0x1b25: 0x00b9, 0x1b26: 0x0089, 0x1b27: 0x0341, 0x1b28: 0x0349, 0x1b29: 0x0391,
+	0x1b2a: 0x00c1, 0x1b2b: 0x0109, 0x1b2c: 0x00c9, 0x1b2d: 0x04b1, 0x1b2e: 0x0019, 0x1b2f: 0x02e9,
+	0x1b30: 0x03d9, 0x1b31: 0x02f1, 0x1b32: 0x02f9, 0x1b33: 0x03f1, 0x1b34: 0x0309, 0x1b35: 0x00a9,
+	0x1b36: 0x0311, 0x1b37: 0x00b1, 0x1b38: 0x0319, 0x1b39: 0x0101, 0x1b3a: 0x0321, 0x1b3b: 0x0329,
+	0x1b3c: 0x0051, 0x1b3d: 0x0339, 0x1b3e: 0x0751, 0x1b3f: 0x00b9,
+	// Block 0x6d, offset 0x1b40
+	0x1b40: 0x0089, 0x1b41: 0x0341, 0x1b42: 0x0349, 0x1b43: 0x0391, 0x1b44: 0x00c1, 0x1b45: 0x0109,
+	0x1b46: 0x00c9, 0x1b47: 0x04b1, 0x1b48: 0x0019, 0x1b49: 0x02e9, 0x1b4a: 0x03d9, 0x1b4b: 0x02f1,
+	0x1b4c: 0x02f9, 0x1b4d: 0x03f1, 0x1b4e: 0x0309, 0x1b4f: 0x00a9, 0x1b50: 0x0311, 0x1b51: 0x00b1,
+	0x1b52: 0x0319, 0x1b53: 0x0101, 0x1b54: 0x0321, 0x1b55: 0x0329, 0x1b56: 0x0051, 0x1b57: 0x0339,
+	0x1b58: 0x0751, 0x1b59: 0x00b9, 0x1b5a: 0x0089, 0x1b5b: 0x0341, 0x1b5c: 0x0349, 0x1b5d: 0x0391,
+	0x1b5e: 0x00c1, 0x1b5f: 0x0109, 0x1b60: 0x00c9, 0x1b61: 0x04b1, 0x1b62: 0x0019, 0x1b63: 0x02e9,
+	0x1b64: 0x03d9, 0x1b65: 0x02f1, 0x1b66: 0x02f9, 0x1b67: 0x03f1, 0x1b68: 0x0309, 0x1b69: 0x00a9,
+	0x1b6a: 0x0311, 0x1b6b: 0x00b1, 0x1b6c: 0x0319, 0x1b6d: 0x0101, 0x1b6e: 0x0321, 0x1b6f: 0x0329,
+	0x1b70: 0x0051, 0x1b71: 0x0339, 0x1b72: 0x0751, 0x1b73: 0x00b9, 0x1b74: 0x0089, 0x1b75: 0x0341,
+	0x1b76: 0x0349, 0x1b77: 0x0391, 0x1b78: 0x00c1, 0x1b79: 0x0109, 0x1b7a: 0x00c9, 0x1b7b: 0x04b1,
+	0x1b7c: 0x0019, 0x1b7d: 0x02e9, 0x1b7e: 0x03d9, 0x1b7f: 0x02f1,
+	// Block 0x6e, offset 0x1b80
+	0x1b80: 0x02f9, 0x1b81: 0x03f1, 0x1b82: 0x0309, 0x1b83: 0x00a9, 0x1b84: 0x0311, 0x1b85: 0x00b1,
+	0x1b86: 0x0319, 0x1b87: 0x0101, 0x1b88: 0x0321, 0x1b89: 0x0329, 0x1b8a: 0x0051, 0x1b8b: 0x0339,
+	0x1b8c: 0x0751, 0x1b8d: 0x00b9, 0x1b8e: 0x0089, 0x1b8f: 0x0341, 0x1b90: 0x0349, 0x1b91: 0x0391,
+	0x1b92: 0x00c1, 0x1b93: 0x0109, 0x1b94: 0x00c9, 0x1b95: 0x04b1, 0x1b96: 0x0019, 0x1b97: 0x02e9,
+	0x1b98: 0x03d9, 0x1b99: 0x02f1, 0x1b9a: 0x02f9, 0x1b9b: 0x03f1, 0x1b9c: 0x0309, 0x1b9d: 0x00a9,
+	0x1b9e: 0x0311, 0x1b9f: 0x00b1, 0x1ba0: 0x0319, 0x1ba1: 0x0101, 0x1ba2: 0x0321, 0x1ba3: 0x0329,
+	0x1ba4: 0x0051, 0x1ba5: 0x0339, 0x1ba6: 0x0751, 0x1ba7: 0x00b9, 0x1ba8: 0x0089, 0x1ba9: 0x0341,
+	0x1baa: 0x0349, 0x1bab: 0x0391, 0x1bac: 0x00c1, 0x1bad: 0x0109, 0x1bae: 0x00c9, 0x1baf: 0x04b1,
+	0x1bb0: 0x0019, 0x1bb1: 0x02e9, 0x1bb2: 0x03d9, 0x1bb3: 0x02f1, 0x1bb4: 0x02f9, 0x1bb5: 0x03f1,
+	0x1bb6: 0x0309, 0x1bb7: 0x00a9, 0x1bb8: 0x0311, 0x1bb9: 0x00b1, 0x1bba: 0x0319, 0x1bbb: 0x0101,
+	0x1bbc: 0x0321, 0x1bbd: 0x0329, 0x1bbe: 0x0051, 0x1bbf: 0x0339,
+	// Block 0x6f, offset 0x1bc0
+	0x1bc0: 0x0751, 0x1bc1: 0x00b9, 0x1bc2: 0x0089, 0x1bc3: 0x0341, 0x1bc4: 0x0349, 0x1bc5: 0x0391,
+	0x1bc6: 0x00c1, 0x1bc7: 0x0109, 0x1bc8: 0x00c9, 0x1bc9: 0x04b1, 0x1bca: 0x0019, 0x1bcb: 0x02e9,
+	0x1bcc: 0x03d9, 0x1bcd: 0x02f1, 0x1bce: 0x02f9, 0x1bcf: 0x03f1, 0x1bd0: 0x0309, 0x1bd1: 0x00a9,
+	0x1bd2: 0x0311, 0x1bd3: 0x00b1, 0x1bd4: 0x0319, 0x1bd5: 0x0101, 0x1bd6: 0x0321, 0x1bd7: 0x0329,
+	0x1bd8: 0x0051, 0x1bd9: 0x0339, 0x1bda: 0x0751, 0x1bdb: 0x00b9, 0x1bdc: 0x0089, 0x1bdd: 0x0341,
+	0x1bde: 0x0349, 0x1bdf: 0x0391, 0x1be0: 0x00c1, 0x1be1: 0x0109, 0x1be2: 0x00c9, 0x1be3: 0x04b1,
+	0x1be4: 0x23e1, 0x1be5: 0x23e9, 0x1be6: 0x0040, 0x1be7: 0x0040, 0x1be8: 0x23f1, 0x1be9: 0x0399,
+	0x1bea: 0x03a1, 0x1beb: 0x03a9, 0x1bec: 0x23f9, 0x1bed: 0x2401, 0x1bee: 0x2409, 0x1bef: 0x04d1,
+	0x1bf0: 0x05f9, 0x1bf1: 0x2411, 0x1bf2: 0x2419, 0x1bf3: 0x2421, 0x1bf4: 0x2429, 0x1bf5: 0x2431,
+	0x1bf6: 0x2439, 0x1bf7: 0x0799, 0x1bf8: 0x03c1, 0x1bf9: 0x04d1, 0x1bfa: 0x2441, 0x1bfb: 0x2449,
+	0x1bfc: 0x2451, 0x1bfd: 0x03b1, 0x1bfe: 0x03b9, 0x1bff: 0x2459,
+	// Block 0x70, offset 0x1c00
+	0x1c00: 0x0769, 0x1c01: 0x2461, 0x1c02: 0x23f1, 0x1c03: 0x0399, 0x1c04: 0x03a1, 0x1c05: 0x03a9,
+	0x1c06: 0x23f9, 0x1c07: 0x2401, 0x1c08: 0x2409, 0x1c09: 0x04d1, 0x1c0a: 0x05f9, 0x1c0b: 0x2411,
+	0x1c0c: 0x2419, 0x1c0d: 0x2421, 0x1c0e: 0x2429, 0x1c0f: 0x2431, 0x1c10: 0x2439, 0x1c11: 0x0799,
+	0x1c12: 0x03c1, 0x1c13: 0x2441, 0x1c14: 0x2441, 0x1c15: 0x2449, 0x1c16: 0x2451, 0x1c17: 0x03b1,
+	0x1c18: 0x03b9, 0x1c19: 0x2459, 0x1c1a: 0x0769, 0x1c1b: 0x2469, 0x1c1c: 0x23f9, 0x1c1d: 0x04d1,
+	0x1c1e: 0x2411, 0x1c1f: 0x03b1, 0x1c20: 0x03c1, 0x1c21: 0x0799, 0x1c22: 0x23f1, 0x1c23: 0x0399,
+	0x1c24: 0x03a1, 0x1c25: 0x03a9, 0x1c26: 0x23f9, 0x1c27: 0x2401, 0x1c28: 0x2409, 0x1c29: 0x04d1,
+	0x1c2a: 0x05f9, 0x1c2b: 0x2411, 0x1c2c: 0x2419, 0x1c2d: 0x2421, 0x1c2e: 0x2429, 0x1c2f: 0x2431,
+	0x1c30: 0x2439, 0x1c31: 0x0799, 0x1c32: 0x03c1, 0x1c33: 0x04d1, 0x1c34: 0x2441, 0x1c35: 0x2449,
+	0x1c36: 0x2451, 0x1c37: 0x03b1, 0x1c38: 0x03b9, 0x1c39: 0x2459, 0x1c3a: 0x0769, 0x1c3b: 0x2461,
+	0x1c3c: 0x23f1, 0x1c3d: 0x0399, 0x1c3e: 0x03a1, 0x1c3f: 0x03a9,
+	// Block 0x71, offset 0x1c40
+	0x1c40: 0x23f9, 0x1c41: 0x2401, 0x1c42: 0x2409, 0x1c43: 0x04d1, 0x1c44: 0x05f9, 0x1c45: 0x2411,
+	0x1c46: 0x2419, 0x1c47: 0x2421, 0x1c48: 0x2429, 0x1c49: 0x2431, 0x1c4a: 0x2439, 0x1c4b: 0x0799,
+	0x1c4c: 0x03c1, 0x1c4d: 0x2441, 0x1c4e: 0x2441, 0x1c4f: 0x2449, 0x1c50: 0x2451, 0x1c51: 0x03b1,
+	0x1c52: 0x03b9, 0x1c53: 0x2459, 0x1c54: 0x0769, 0x1c55: 0x2469, 0x1c56: 0x23f9, 0x1c57: 0x04d1,
+	0x1c58: 0x2411, 0x1c59: 0x03b1, 0x1c5a: 0x03c1, 0x1c5b: 0x0799, 0x1c5c: 0x23f1, 0x1c5d: 0x0399,
+	0x1c5e: 0x03a1, 0x1c5f: 0x03a9, 0x1c60: 0x23f9, 0x1c61: 0x2401, 0x1c62: 0x2409, 0x1c63: 0x04d1,
+	0x1c64: 0x05f9, 0x1c65: 0x2411, 0x1c66: 0x2419, 0x1c67: 0x2421, 0x1c68: 0x2429, 0x1c69: 0x2431,
+	0x1c6a: 0x2439, 0x1c6b: 0x0799, 0x1c6c: 0x03c1, 0x1c6d: 0x04d1, 0x1c6e: 0x2441, 0x1c6f: 0x2449,
+	0x1c70: 0x2451, 0x1c71: 0x03b1, 0x1c72: 0x03b9, 0x1c73: 0x2459, 0x1c74: 0x0769, 0x1c75: 0x2461,
+	0x1c76: 0x23f1, 0x1c77: 0x0399, 0x1c78: 0x03a1, 0x1c79: 0x03a9, 0x1c7a: 0x23f9, 0x1c7b: 0x2401,
+	0x1c7c: 0x2409, 0x1c7d: 0x04d1, 0x1c7e: 0x05f9, 0x1c7f: 0x2411,
+	// Block 0x72, offset 0x1c80
+	0x1c80: 0x2419, 0x1c81: 0x2421, 0x1c82: 0x2429, 0x1c83: 0x2431, 0x1c84: 0x2439, 0x1c85: 0x0799,
+	0x1c86: 0x03c1, 0x1c87: 0x2441, 0x1c88: 0x2441, 0x1c89: 0x2449, 0x1c8a: 0x2451, 0x1c8b: 0x03b1,
+	0x1c8c: 0x03b9, 0x1c8d: 0x2459, 0x1c8e: 0x0769, 0x1c8f: 0x2469, 0x1c90: 0x23f9, 0x1c91: 0x04d1,
+	0x1c92: 0x2411, 0x1c93: 0x03b1, 0x1c94: 0x03c1, 0x1c95: 0x0799, 0x1c96: 0x23f1, 0x1c97: 0x0399,
+	0x1c98: 0x03a1, 0x1c99: 0x03a9, 0x1c9a: 0x23f9, 0x1c9b: 0x2401, 0x1c9c: 0x2409, 0x1c9d: 0x04d1,
+	0x1c9e: 0x05f9, 0x1c9f: 0x2411, 0x1ca0: 0x2419, 0x1ca1: 0x2421, 0x1ca2: 0x2429, 0x1ca3: 0x2431,
+	0x1ca4: 0x2439, 0x1ca5: 0x0799, 0x1ca6: 0x03c1, 0x1ca7: 0x04d1, 0x1ca8: 0x2441, 0x1ca9: 0x2449,
+	0x1caa: 0x2451, 0x1cab: 0x03b1, 0x1cac: 0x03b9, 0x1cad: 0x2459, 0x1cae: 0x0769, 0x1caf: 0x2461,
+	0x1cb0: 0x23f1, 0x1cb1: 0x0399, 0x1cb2: 0x03a1, 0x1cb3: 0x03a9, 0x1cb4: 0x23f9, 0x1cb5: 0x2401,
+	0x1cb6: 0x2409, 0x1cb7: 0x04d1, 0x1cb8: 0x05f9, 0x1cb9: 0x2411, 0x1cba: 0x2419, 0x1cbb: 0x2421,
+	0x1cbc: 0x2429, 0x1cbd: 0x2431, 0x1cbe: 0x2439, 0x1cbf: 0x0799,
+	// Block 0x73, offset 0x1cc0
+	0x1cc0: 0x03c1, 0x1cc1: 0x2441, 0x1cc2: 0x2441, 0x1cc3: 0x2449, 0x1cc4: 0x2451, 0x1cc5: 0x03b1,
+	0x1cc6: 0x03b9, 0x1cc7: 0x2459, 0x1cc8: 0x0769, 0x1cc9: 0x2469, 0x1cca: 0x23f9, 0x1ccb: 0x04d1,
+	0x1ccc: 0x2411, 0x1ccd: 0x03b1, 0x1cce: 0x03c1, 0x1ccf: 0x0799, 0x1cd0: 0x23f1, 0x1cd1: 0x0399,
+	0x1cd2: 0x03a1, 0x1cd3: 0x03a9, 0x1cd4: 0x23f9, 0x1cd5: 0x2401, 0x1cd6: 0x2409, 0x1cd7: 0x04d1,
+	0x1cd8: 0x05f9, 0x1cd9: 0x2411, 0x1cda: 0x2419, 0x1cdb: 0x2421, 0x1cdc: 0x2429, 0x1cdd: 0x2431,
+	0x1cde: 0x2439, 0x1cdf: 0x0799, 0x1ce0: 0x03c1, 0x1ce1: 0x04d1, 0x1ce2: 0x2441, 0x1ce3: 0x2449,
+	0x1ce4: 0x2451, 0x1ce5: 0x03b1, 0x1ce6: 0x03b9, 0x1ce7: 0x2459, 0x1ce8: 0x0769, 0x1ce9: 0x2461,
+	0x1cea: 0x23f1, 0x1ceb: 0x0399, 0x1cec: 0x03a1, 0x1ced: 0x03a9, 0x1cee: 0x23f9, 0x1cef: 0x2401,
+	0x1cf0: 0x2409, 0x1cf1: 0x04d1, 0x1cf2: 0x05f9, 0x1cf3: 0x2411, 0x1cf4: 0x2419, 0x1cf5: 0x2421,
+	0x1cf6: 0x2429, 0x1cf7: 0x2431, 0x1cf8: 0x2439, 0x1cf9: 0x0799, 0x1cfa: 0x03c1, 0x1cfb: 0x2441,
+	0x1cfc: 0x2441, 0x1cfd: 0x2449, 0x1cfe: 0x2451, 0x1cff: 0x03b1,
+	// Block 0x74, offset 0x1d00
+	0x1d00: 0x03b9, 0x1d01: 0x2459, 0x1d02: 0x0769, 0x1d03: 0x2469, 0x1d04: 0x23f9, 0x1d05: 0x04d1,
+	0x1d06: 0x2411, 0x1d07: 0x03b1, 0x1d08: 0x03c1, 0x1d09: 0x0799, 0x1d0a: 0x2471, 0x1d0b: 0x2471,
+	0x1d0c: 0x0040, 0x1d0d: 0x0040, 0x1d0e: 0x06e1, 0x1d0f: 0x0049, 0x1d10: 0x0029, 0x1d11: 0x0031,
+	0x1d12: 0x06e9, 0x1d13: 0x06f1, 0x1d14: 0x06f9, 0x1d15: 0x0701, 0x1d16: 0x0709, 0x1d17: 0x0711,
+	0x1d18: 0x06e1, 0x1d19: 0x0049, 0x1d1a: 0x0029, 0x1d1b: 0x0031, 0x1d1c: 0x06e9, 0x1d1d: 0x06f1,
+	0x1d1e: 0x06f9, 0x1d1f: 0x0701, 0x1d20: 0x0709, 0x1d21: 0x0711, 0x1d22: 0x06e1, 0x1d23: 0x0049,
+	0x1d24: 0x0029, 0x1d25: 0x0031, 0x1d26: 0x06e9, 0x1d27: 0x06f1, 0x1d28: 0x06f9, 0x1d29: 0x0701,
+	0x1d2a: 0x0709, 0x1d2b: 0x0711, 0x1d2c: 0x06e1, 0x1d2d: 0x0049, 0x1d2e: 0x0029, 0x1d2f: 0x0031,
+	0x1d30: 0x06e9, 0x1d31: 0x06f1, 0x1d32: 0x06f9, 0x1d33: 0x0701, 0x1d34: 0x0709, 0x1d35: 0x0711,
+	0x1d36: 0x06e1, 0x1d37: 0x0049, 0x1d38: 0x0029, 0x1d39: 0x0031, 0x1d3a: 0x06e9, 0x1d3b: 0x06f1,
+	0x1d3c: 0x06f9, 0x1d3d: 0x0701, 0x1d3e: 0x0709, 0x1d3f: 0x0711,
+	// Block 0x75, offset 0x1d40
+	0x1d40: 0x3308, 0x1d41: 0x3308, 0x1d42: 0x3308, 0x1d43: 0x3308, 0x1d44: 0x3308, 0x1d45: 0x3308,
+	0x1d46: 0x3308, 0x1d47: 0x0040, 0x1d48: 0x3308, 0x1d49: 0x3308, 0x1d4a: 0x3308, 0x1d4b: 0x3308,
+	0x1d4c: 0x3308, 0x1d4d: 0x3308, 0x1d4e: 0x3308, 0x1d4f: 0x3308, 0x1d50: 0x3308, 0x1d51: 0x3308,
+	0x1d52: 0x3308, 0x1d53: 0x3308, 0x1d54: 0x3308, 0x1d55: 0x3308, 0x1d56: 0x3308, 0x1d57: 0x3308,
+	0x1d58: 0x3308, 0x1d59: 0x0040, 0x1d5a: 0x0040, 0x1d5b: 0x3308, 0x1d5c: 0x3308, 0x1d5d: 0x3308,
+	0x1d5e: 0x3308, 0x1d5f: 0x3308, 0x1d60: 0x3308, 0x1d61: 0x3308, 0x1d62: 0x0040, 0x1d63: 0x3308,
+	0x1d64: 0x3308, 0x1d65: 0x0040, 0x1d66: 0x3308, 0x1d67: 0x3308, 0x1d68: 0x3308, 0x1d69: 0x3308,
+	0x1d6a: 0x3308, 0x1d6b: 0x0040, 0x1d6c: 0x0040, 0x1d6d: 0x0040, 0x1d6e: 0x0040, 0x1d6f: 0x0040,
+	0x1d70: 0x2479, 0x1d71: 0x2481, 0x1d72: 0x02a9, 0x1d73: 0x2489, 0x1d74: 0x02b1, 0x1d75: 0x2491,
+	0x1d76: 0x2499, 0x1d77: 0x24a1, 0x1d78: 0x24a9, 0x1d79: 0x24b1, 0x1d7a: 0x24b9, 0x1d7b: 0x24c1,
+	0x1d7c: 0x02b9, 0x1d7d: 0x24c9, 0x1d7e: 0x24d1, 0x1d7f: 0x02c1,
+	// Block 0x76, offset 0x1d80
+	0x1d80: 0x02c9, 0x1d81: 0x24d9, 0x1d82: 0x24e1, 0x1d83: 0x24e9, 0x1d84: 0x24f1, 0x1d85: 0x24f9,
+	0x1d86: 0x2501, 0x1d87: 0x2509, 0x1d88: 0x2511, 0x1d89: 0x2519, 0x1d8a: 0x2521, 0x1d8b: 0x2529,
+	0x1d8c: 0x2531, 0x1d8d: 0x2539, 0x1d8e: 0x2541, 0x1d8f: 0x2549, 0x1d90: 0x2551, 0x1d91: 0x2479,
+	0x1d92: 0x2481, 0x1d93: 0x02a9, 0x1d94: 0x2489, 0x1d95: 0x02b1, 0x1d96: 0x2491, 0x1d97: 0x2499,
+	0x1d98: 0x24a1, 0x1d99: 0x24a9, 0x1d9a: 0x24b1, 0x1d9b: 0x24b9, 0x1d9c: 0x02b9, 0x1d9d: 0x24c9,
+	0x1d9e: 0x02c1, 0x1d9f: 0x24d9, 0x1da0: 0x24e1, 0x1da1: 0x24e9, 0x1da2: 0x24f1, 0x1da3: 0x24f9,
+	0x1da4: 0x2501, 0x1da5: 0x02d1, 0x1da6: 0x2509, 0x1da7: 0x2559, 0x1da8: 0x2531, 0x1da9: 0x2561,
+	0x1daa: 0x2569, 0x1dab: 0x2571, 0x1dac: 0x2579, 0x1dad: 0x2581, 0x1dae: 0x0040, 0x1daf: 0x0040,
+	0x1db0: 0x0040, 0x1db1: 0x0040, 0x1db2: 0x0040, 0x1db3: 0x0040, 0x1db4: 0x0040, 0x1db5: 0x0040,
+	0x1db6: 0x0040, 0x1db7: 0x0040, 0x1db8: 0x0040, 0x1db9: 0x0040, 0x1dba: 0x0040, 0x1dbb: 0x0040,
+	0x1dbc: 0x0040, 0x1dbd: 0x0040, 0x1dbe: 0x0040, 0x1dbf: 0x0040,
+	// Block 0x77, offset 0x1dc0
+	0x1dc0: 0xe115, 0x1dc1: 0xe115, 0x1dc2: 0xe135, 0x1dc3: 0xe135, 0x1dc4: 0xe115, 0x1dc5: 0xe115,
+	0x1dc6: 0xe175, 0x1dc7: 0xe175, 0x1dc8: 0xe115, 0x1dc9: 0xe115, 0x1dca: 0xe135, 0x1dcb: 0xe135,
+	0x1dcc: 0xe115, 0x1dcd: 0xe115, 0x1dce: 0xe1f5, 0x1dcf: 0xe1f5, 0x1dd0: 0xe115, 0x1dd1: 0xe115,
+	0x1dd2: 0xe135, 0x1dd3: 0xe135, 0x1dd4: 0xe115, 0x1dd5: 0xe115, 0x1dd6: 0xe175, 0x1dd7: 0xe175,
+	0x1dd8: 0xe115, 0x1dd9: 0xe115, 0x1dda: 0xe135, 0x1ddb: 0xe135, 0x1ddc: 0xe115, 0x1ddd: 0xe115,
+	0x1dde: 0x8ca5, 0x1ddf: 0x8ca5, 0x1de0: 0x04b5, 0x1de1: 0x04b5, 0x1de2: 0x0a08, 0x1de3: 0x0a08,
+	0x1de4: 0x0a08, 0x1de5: 0x0a08, 0x1de6: 0x0a08, 0x1de7: 0x0a08, 0x1de8: 0x0a08, 0x1de9: 0x0a08,
+	0x1dea: 0x0a08, 0x1deb: 0x0a08, 0x1dec: 0x0a08, 0x1ded: 0x0a08, 0x1dee: 0x0a08, 0x1def: 0x0a08,
+	0x1df0: 0x0a08, 0x1df1: 0x0a08, 0x1df2: 0x0a08, 0x1df3: 0x0a08, 0x1df4: 0x0a08, 0x1df5: 0x0a08,
+	0x1df6: 0x0a08, 0x1df7: 0x0a08, 0x1df8: 0x0a08, 0x1df9: 0x0a08, 0x1dfa: 0x0a08, 0x1dfb: 0x0a08,
+	0x1dfc: 0x0a08, 0x1dfd: 0x0a08, 0x1dfe: 0x0a08, 0x1dff: 0x0a08,
+	// Block 0x78, offset 0x1e00
+	0x1e00: 0x20b1, 0x1e01: 0x20b9, 0x1e02: 0x20d9, 0x1e03: 0x20f1, 0x1e04: 0x0040, 0x1e05: 0x2189,
+	0x1e06: 0x2109, 0x1e07: 0x20e1, 0x1e08: 0x2131, 0x1e09: 0x2191, 0x1e0a: 0x2161, 0x1e0b: 0x2169,
+	0x1e0c: 0x2171, 0x1e0d: 0x2179, 0x1e0e: 0x2111, 0x1e0f: 0x2141, 0x1e10: 0x2151, 0x1e11: 0x2121,
+	0x1e12: 0x2159, 0x1e13: 0x2101, 0x1e14: 0x2119, 0x1e15: 0x20c9, 0x1e16: 0x20d1, 0x1e17: 0x20e9,
+	0x1e18: 0x20f9, 0x1e19: 0x2129, 0x1e1a: 0x2139, 0x1e1b: 0x2149, 0x1e1c: 0x2589, 0x1e1d: 0x1689,
+	0x1e1e: 0x2591, 0x1e1f: 0x2599, 0x1e20: 0x0040, 0x1e21: 0x20b9, 0x1e22: 0x20d9, 0x1e23: 0x0040,
+	0x1e24: 0x2181, 0x1e25: 0x0040, 0x1e26: 0x0040, 0x1e27: 0x20e1, 0x1e28: 0x0040, 0x1e29: 0x2191,
+	0x1e2a: 0x2161, 0x1e2b: 0x2169, 0x1e2c: 0x2171, 0x1e2d: 0x2179, 0x1e2e: 0x2111, 0x1e2f: 0x2141,
+	0x1e30: 0x2151, 0x1e31: 0x2121, 0x1e32: 0x2159, 0x1e33: 0x0040, 0x1e34: 0x2119, 0x1e35: 0x20c9,
+	0x1e36: 0x20d1, 0x1e37: 0x20e9, 0x1e38: 0x0040, 0x1e39: 0x2129, 0x1e3a: 0x0040, 0x1e3b: 0x2149,
+	0x1e3c: 0x0040, 0x1e3d: 0x0040, 0x1e3e: 0x0040, 0x1e3f: 0x0040,
+	// Block 0x79, offset 0x1e40
+	0x1e40: 0x0040, 0x1e41: 0x0040, 0x1e42: 0x20d9, 0x1e43: 0x0040, 0x1e44: 0x0040, 0x1e45: 0x0040,
+	0x1e46: 0x0040, 0x1e47: 0x20e1, 0x1e48: 0x0040, 0x1e49: 0x2191, 0x1e4a: 0x0040, 0x1e4b: 0x2169,
+	0x1e4c: 0x0040, 0x1e4d: 0x2179, 0x1e4e: 0x2111, 0x1e4f: 0x2141, 0x1e50: 0x0040, 0x1e51: 0x2121,
+	0x1e52: 0x2159, 0x1e53: 0x0040, 0x1e54: 0x2119, 0x1e55: 0x0040, 0x1e56: 0x0040, 0x1e57: 0x20e9,
+	0x1e58: 0x0040, 0x1e59: 0x2129, 0x1e5a: 0x0040, 0x1e5b: 0x2149, 0x1e5c: 0x0040, 0x1e5d: 0x1689,
+	0x1e5e: 0x0040, 0x1e5f: 0x2599, 0x1e60: 0x0040, 0x1e61: 0x20b9, 0x1e62: 0x20d9, 0x1e63: 0x0040,
+	0x1e64: 0x2181, 0x1e65: 0x0040, 0x1e66: 0x0040, 0x1e67: 0x20e1, 0x1e68: 0x2131, 0x1e69: 0x2191,
+	0x1e6a: 0x2161, 0x1e6b: 0x0040, 0x1e6c: 0x2171, 0x1e6d: 0x2179, 0x1e6e: 0x2111, 0x1e6f: 0x2141,
+	0x1e70: 0x2151, 0x1e71: 0x2121, 0x1e72: 0x2159, 0x1e73: 0x0040, 0x1e74: 0x2119, 0x1e75: 0x20c9,
+	0x1e76: 0x20d1, 0x1e77: 0x20e9, 0x1e78: 0x0040, 0x1e79: 0x2129, 0x1e7a: 0x2139, 0x1e7b: 0x2149,
+	0x1e7c: 0x2589, 0x1e7d: 0x0040, 0x1e7e: 0x2591, 0x1e7f: 0x0040,
+	// Block 0x7a, offset 0x1e80
+	0x1e80: 0x20b1, 0x1e81: 0x20b9, 0x1e82: 0x20d9, 0x1e83: 0x20f1, 0x1e84: 0x2181, 0x1e85: 0x2189,
+	0x1e86: 0x2109, 0x1e87: 0x20e1, 0x1e88: 0x2131, 0x1e89: 0x2191, 0x1e8a: 0x0040, 0x1e8b: 0x2169,
+	0x1e8c: 0x2171, 0x1e8d: 0x2179, 0x1e8e: 0x2111, 0x1e8f: 0x2141, 0x1e90: 0x2151, 0x1e91: 0x2121,
+	0x1e92: 0x2159, 0x1e93: 0x2101, 0x1e94: 0x2119, 0x1e95: 0x20c9, 0x1e96: 0x20d1, 0x1e97: 0x20e9,
+	0x1e98: 0x20f9, 0x1e99: 0x2129, 0x1e9a: 0x2139, 0x1e9b: 0x2149, 0x1e9c: 0x0040, 0x1e9d: 0x0040,
+	0x1e9e: 0x0040, 0x1e9f: 0x0040, 0x1ea0: 0x0040, 0x1ea1: 0x20b9, 0x1ea2: 0x20d9, 0x1ea3: 0x20f1,
+	0x1ea4: 0x0040, 0x1ea5: 0x2189, 0x1ea6: 0x2109, 0x1ea7: 0x20e1, 0x1ea8: 0x2131, 0x1ea9: 0x2191,
+	0x1eaa: 0x0040, 0x1eab: 0x2169, 0x1eac: 0x2171, 0x1ead: 0x2179, 0x1eae: 0x2111, 0x1eaf: 0x2141,
+	0x1eb0: 0x2151, 0x1eb1: 0x2121, 0x1eb2: 0x2159, 0x1eb3: 0x2101, 0x1eb4: 0x2119, 0x1eb5: 0x20c9,
+	0x1eb6: 0x20d1, 0x1eb7: 0x20e9, 0x1eb8: 0x20f9, 0x1eb9: 0x2129, 0x1eba: 0x2139, 0x1ebb: 0x2149,
+	0x1ebc: 0x0040, 0x1ebd: 0x0040, 0x1ebe: 0x0040, 0x1ebf: 0x0040,
+	// Block 0x7b, offset 0x1ec0
+	0x1ec0: 0x0040, 0x1ec1: 0x25a2, 0x1ec2: 0x25aa, 0x1ec3: 0x25b2, 0x1ec4: 0x25ba, 0x1ec5: 0x25c2,
+	0x1ec6: 0x25ca, 0x1ec7: 0x25d2, 0x1ec8: 0x25da, 0x1ec9: 0x25e2, 0x1eca: 0x25ea, 0x1ecb: 0x0018,
+	0x1ecc: 0x0018, 0x1ecd: 0x0018, 0x1ece: 0x0018, 0x1ecf: 0x0018, 0x1ed0: 0x25f2, 0x1ed1: 0x25fa,
+	0x1ed2: 0x2602, 0x1ed3: 0x260a, 0x1ed4: 0x2612, 0x1ed5: 0x261a, 0x1ed6: 0x2622, 0x1ed7: 0x262a,
+	0x1ed8: 0x2632, 0x1ed9: 0x263a, 0x1eda: 0x2642, 0x1edb: 0x264a, 0x1edc: 0x2652, 0x1edd: 0x265a,
+	0x1ede: 0x2662, 0x1edf: 0x266a, 0x1ee0: 0x2672, 0x1ee1: 0x267a, 0x1ee2: 0x2682, 0x1ee3: 0x268a,
+	0x1ee4: 0x2692, 0x1ee5: 0x269a, 0x1ee6: 0x26a2, 0x1ee7: 0x26aa, 0x1ee8: 0x26b2, 0x1ee9: 0x26ba,
+	0x1eea: 0x26c1, 0x1eeb: 0x03d9, 0x1eec: 0x00b9, 0x1eed: 0x1239, 0x1eee: 0x26c9, 0x1eef: 0x0018,
+	0x1ef0: 0x0019, 0x1ef1: 0x02e9, 0x1ef2: 0x03d9, 0x1ef3: 0x02f1, 0x1ef4: 0x02f9, 0x1ef5: 0x03f1,
+	0x1ef6: 0x0309, 0x1ef7: 0x00a9, 0x1ef8: 0x0311, 0x1ef9: 0x00b1, 0x1efa: 0x0319, 0x1efb: 0x0101,
+	0x1efc: 0x0321, 0x1efd: 0x0329, 0x1efe: 0x0051, 0x1eff: 0x0339,
+	// Block 0x7c, offset 0x1f00
+	0x1f00: 0x0751, 0x1f01: 0x00b9, 0x1f02: 0x0089, 0x1f03: 0x0341, 0x1f04: 0x0349, 0x1f05: 0x0391,
+	0x1f06: 0x00c1, 0x1f07: 0x0109, 0x1f08: 0x00c9, 0x1f09: 0x04b1, 0x1f0a: 0x26d1, 0x1f0b: 0x11f9,
+	0x1f0c: 0x26d9, 0x1f0d: 0x04d9, 0x1f0e: 0x26e1, 0x1f0f: 0x26e9, 0x1f10: 0x0018, 0x1f11: 0x0018,
+	0x1f12: 0x0018, 0x1f13: 0x0018, 0x1f14: 0x0018, 0x1f15: 0x0018, 0x1f16: 0x0018, 0x1f17: 0x0018,
+	0x1f18: 0x0018, 0x1f19: 0x0018, 0x1f1a: 0x0018, 0x1f1b: 0x0018, 0x1f1c: 0x0018, 0x1f1d: 0x0018,
+	0x1f1e: 0x0018, 0x1f1f: 0x0018, 0x1f20: 0x0018, 0x1f21: 0x0018, 0x1f22: 0x0018, 0x1f23: 0x0018,
+	0x1f24: 0x0018, 0x1f25: 0x0018, 0x1f26: 0x0018, 0x1f27: 0x0018, 0x1f28: 0x0018, 0x1f29: 0x0018,
+	0x1f2a: 0x26f1, 0x1f2b: 0x26f9, 0x1f2c: 0x2701, 0x1f2d: 0x0018, 0x1f2e: 0x0018, 0x1f2f: 0x0018,
+	0x1f30: 0x0018, 0x1f31: 0x0018, 0x1f32: 0x0018, 0x1f33: 0x0018, 0x1f34: 0x0018, 0x1f35: 0x0018,
+	0x1f36: 0x0018, 0x1f37: 0x0018, 0x1f38: 0x0018, 0x1f39: 0x0018, 0x1f3a: 0x0018, 0x1f3b: 0x0018,
+	0x1f3c: 0x0018, 0x1f3d: 0x0018, 0x1f3e: 0x0018, 0x1f3f: 0x0018,
+	// Block 0x7d, offset 0x1f40
+	0x1f40: 0x2711, 0x1f41: 0x2719, 0x1f42: 0x2721, 0x1f43: 0x0040, 0x1f44: 0x0040, 0x1f45: 0x0040,
+	0x1f46: 0x0040, 0x1f47: 0x0040, 0x1f48: 0x0040, 0x1f49: 0x0040, 0x1f4a: 0x0040, 0x1f4b: 0x0040,
+	0x1f4c: 0x0040, 0x1f4d: 0x0040, 0x1f4e: 0x0040, 0x1f4f: 0x0040, 0x1f50: 0x2729, 0x1f51: 0x2731,
+	0x1f52: 0x2739, 0x1f53: 0x2741, 0x1f54: 0x2749, 0x1f55: 0x2751, 0x1f56: 0x2759, 0x1f57: 0x2761,
+	0x1f58: 0x2769, 0x1f59: 0x2771, 0x1f5a: 0x2779, 0x1f5b: 0x2781, 0x1f5c: 0x2789, 0x1f5d: 0x2791,
+	0x1f5e: 0x2799, 0x1f5f: 0x27a1, 0x1f60: 0x27a9, 0x1f61: 0x27b1, 0x1f62: 0x27b9, 0x1f63: 0x27c1,
+	0x1f64: 0x27c9, 0x1f65: 0x27d1, 0x1f66: 0x27d9, 0x1f67: 0x27e1, 0x1f68: 0x27e9, 0x1f69: 0x27f1,
+	0x1f6a: 0x27f9, 0x1f6b: 0x2801, 0x1f6c: 0x2809, 0x1f6d: 0x2811, 0x1f6e: 0x2819, 0x1f6f: 0x2821,
+	0x1f70: 0x2829, 0x1f71: 0x2831, 0x1f72: 0x2839, 0x1f73: 0x2841, 0x1f74: 0x2849, 0x1f75: 0x2851,
+	0x1f76: 0x2859, 0x1f77: 0x2861, 0x1f78: 0x2869, 0x1f79: 0x2871, 0x1f7a: 0x2879, 0x1f7b: 0x2881,
+	0x1f7c: 0x0040, 0x1f7d: 0x0040, 0x1f7e: 0x0040, 0x1f7f: 0x0040,
+	// Block 0x7e, offset 0x1f80
+	0x1f80: 0x28e1, 0x1f81: 0x28e9, 0x1f82: 0x28f1, 0x1f83: 0x8cbd, 0x1f84: 0x28f9, 0x1f85: 0x2901,
+	0x1f86: 0x2909, 0x1f87: 0x2911, 0x1f88: 0x2919, 0x1f89: 0x2921, 0x1f8a: 0x2929, 0x1f8b: 0x2931,
+	0x1f8c: 0x2939, 0x1f8d: 0x8cdd, 0x1f8e: 0x2941, 0x1f8f: 0x2949, 0x1f90: 0x2951, 0x1f91: 0x2959,
+	0x1f92: 0x8cfd, 0x1f93: 0x2961, 0x1f94: 0x2969, 0x1f95: 0x2799, 0x1f96: 0x8d1d, 0x1f97: 0x2971,
+	0x1f98: 0x2979, 0x1f99: 0x2981, 0x1f9a: 0x2989, 0x1f9b: 0x2991, 0x1f9c: 0x8d3d, 0x1f9d: 0x2999,
+	0x1f9e: 0x29a1, 0x1f9f: 0x29a9, 0x1fa0: 0x29b1, 0x1fa1: 0x29b9, 0x1fa2: 0x2871, 0x1fa3: 0x29c1,
+	0x1fa4: 0x29c9, 0x1fa5: 0x29d1, 0x1fa6: 0x29d9, 0x1fa7: 0x29e1, 0x1fa8: 0x29e9, 0x1fa9: 0x29f1,
+	0x1faa: 0x29f9, 0x1fab: 0x2a01, 0x1fac: 0x2a09, 0x1fad: 0x2a11, 0x1fae: 0x2a19, 0x1faf: 0x2a21,
+	0x1fb0: 0x2a29, 0x1fb1: 0x2a31, 0x1fb2: 0x2a31, 0x1fb3: 0x2a31, 0x1fb4: 0x8d5d, 0x1fb5: 0x2a39,
+	0x1fb6: 0x2a41, 0x1fb7: 0x2a49, 0x1fb8: 0x8d7d, 0x1fb9: 0x2a51, 0x1fba: 0x2a59, 0x1fbb: 0x2a61,
+	0x1fbc: 0x2a69, 0x1fbd: 0x2a71, 0x1fbe: 0x2a79, 0x1fbf: 0x2a81,
+	// Block 0x7f, offset 0x1fc0
+	0x1fc0: 0x2a89, 0x1fc1: 0x2a91, 0x1fc2: 0x2a99, 0x1fc3: 0x2aa1, 0x1fc4: 0x2aa9, 0x1fc5: 0x2ab1,
+	0x1fc6: 0x2ab1, 0x1fc7: 0x2ab9, 0x1fc8: 0x2ac1, 0x1fc9: 0x2ac9, 0x1fca: 0x2ad1, 0x1fcb: 0x2ad9,
+	0x1fcc: 0x2ae1, 0x1fcd: 0x2ae9, 0x1fce: 0x2af1, 0x1fcf: 0x2af9, 0x1fd0: 0x2b01, 0x1fd1: 0x2b09,
+	0x1fd2: 0x2b11, 0x1fd3: 0x2b19, 0x1fd4: 0x2b21, 0x1fd5: 0x2b29, 0x1fd6: 0x2b31, 0x1fd7: 0x2b39,
+	0x1fd8: 0x2b41, 0x1fd9: 0x8d9d, 0x1fda: 0x2b49, 0x1fdb: 0x2b51, 0x1fdc: 0x2b59, 0x1fdd: 0x2751,
+	0x1fde: 0x2b61, 0x1fdf: 0x2b69, 0x1fe0: 0x8dbd, 0x1fe1: 0x8ddd, 0x1fe2: 0x2b71, 0x1fe3: 0x2b79,
+	0x1fe4: 0x2b81, 0x1fe5: 0x2b89, 0x1fe6: 0x2b91, 0x1fe7: 0x2b99, 0x1fe8: 0x2040, 0x1fe9: 0x2ba1,
+	0x1fea: 0x2ba9, 0x1feb: 0x2ba9, 0x1fec: 0x8dfd, 0x1fed: 0x2bb1, 0x1fee: 0x2bb9, 0x1fef: 0x2bc1,
+	0x1ff0: 0x2bc9, 0x1ff1: 0x8e1d, 0x1ff2: 0x2bd1, 0x1ff3: 0x2bd9, 0x1ff4: 0x2040, 0x1ff5: 0x2be1,
+	0x1ff6: 0x2be9, 0x1ff7: 0x2bf1, 0x1ff8: 0x2bf9, 0x1ff9: 0x2c01, 0x1ffa: 0x2c09, 0x1ffb: 0x8e3d,
+	0x1ffc: 0x2c11, 0x1ffd: 0x8e5d, 0x1ffe: 0x2c19, 0x1fff: 0x2c21,
+	// Block 0x80, offset 0x2000
+	0x2000: 0x2c29, 0x2001: 0x2c31, 0x2002: 0x2c39, 0x2003: 0x2c41, 0x2004: 0x2c49, 0x2005: 0x2c51,
+	0x2006: 0x2c59, 0x2007: 0x2c61, 0x2008: 0x2c69, 0x2009: 0x8e7d, 0x200a: 0x2c71, 0x200b: 0x2c79,
+	0x200c: 0x2c81, 0x200d: 0x2c89, 0x200e: 0x2c91, 0x200f: 0x8e9d, 0x2010: 0x2c99, 0x2011: 0x8ebd,
+	0x2012: 0x8edd, 0x2013: 0x2ca1, 0x2014: 0x2ca9, 0x2015: 0x2ca9, 0x2016: 0x2cb1, 0x2017: 0x8efd,
+	0x2018: 0x8f1d, 0x2019: 0x2cb9, 0x201a: 0x2cc1, 0x201b: 0x2cc9, 0x201c: 0x2cd1, 0x201d: 0x2cd9,
+	0x201e: 0x2ce1, 0x201f: 0x2ce9, 0x2020: 0x2cf1, 0x2021: 0x2cf9, 0x2022: 0x2d01, 0x2023: 0x2d09,
+	0x2024: 0x8f3d, 0x2025: 0x2d11, 0x2026: 0x2d19, 0x2027: 0x2d21, 0x2028: 0x2d29, 0x2029: 0x2d21,
+	0x202a: 0x2d31, 0x202b: 0x2d39, 0x202c: 0x2d41, 0x202d: 0x2d49, 0x202e: 0x2d51, 0x202f: 0x2d59,
+	0x2030: 0x2d61, 0x2031: 0x2d69, 0x2032: 0x2d71, 0x2033: 0x2d79, 0x2034: 0x2d81, 0x2035: 0x2d89,
+	0x2036: 0x2d91, 0x2037: 0x2d99, 0x2038: 0x8f5d, 0x2039: 0x2da1, 0x203a: 0x2da9, 0x203b: 0x2db1,
+	0x203c: 0x2db9, 0x203d: 0x2dc1, 0x203e: 0x8f7d, 0x203f: 0x2dc9,
+	// Block 0x81, offset 0x2040
+	0x2040: 0x2dd1, 0x2041: 0x2dd9, 0x2042: 0x2de1, 0x2043: 0x2de9, 0x2044: 0x2df1, 0x2045: 0x2df9,
+	0x2046: 0x2e01, 0x2047: 0x2e09, 0x2048: 0x2e11, 0x2049: 0x2e19, 0x204a: 0x8f9d, 0x204b: 0x2e21,
+	0x204c: 0x2e29, 0x204d: 0x2e31, 0x204e: 0x2e39, 0x204f: 0x2e41, 0x2050: 0x2e49, 0x2051: 0x2e51,
+	0x2052: 0x2e59, 0x2053: 0x2e61, 0x2054: 0x2e69, 0x2055: 0x2e71, 0x2056: 0x2e79, 0x2057: 0x2e81,
+	0x2058: 0x2e89, 0x2059: 0x2e91, 0x205a: 0x2e99, 0x205b: 0x2ea1, 0x205c: 0x2ea9, 0x205d: 0x8fbd,
+	0x205e: 0x2eb1, 0x205f: 0x2eb9, 0x2060: 0x2ec1, 0x2061: 0x2ec9, 0x2062: 0x2ed1, 0x2063: 0x8fdd,
+	0x2064: 0x2ed9, 0x2065: 0x2ee1, 0x2066: 0x2ee9, 0x2067: 0x2ef1, 0x2068: 0x2ef9, 0x2069: 0x2f01,
+	0x206a: 0x2f09, 0x206b: 0x2f11, 0x206c: 0x7f0d, 0x206d: 0x2f19, 0x206e: 0x2f21, 0x206f: 0x2f29,
+	0x2070: 0x8ffd, 0x2071: 0x2f31, 0x2072: 0x2f39, 0x2073: 0x2f41, 0x2074: 0x2f49, 0x2075: 0x2f51,
+	0x2076: 0x2f59, 0x2077: 0x901d, 0x2078: 0x903d, 0x2079: 0x905d, 0x207a: 0x2f61, 0x207b: 0x907d,
+	0x207c: 0x2f69, 0x207d: 0x2f71, 0x207e: 0x2f79, 0x207f: 0x2f81,
+	// Block 0x82, offset 0x2080
+	0x2080: 0x2f89, 0x2081: 0x2f91, 0x2082: 0x2f99, 0x2083: 0x2fa1, 0x2084: 0x2fa9, 0x2085: 0x2fb1,
+	0x2086: 0x909d, 0x2087: 0x2fb9, 0x2088: 0x2fc1, 0x2089: 0x2fc9, 0x208a: 0x2fd1, 0x208b: 0x2fd9,
+	0x208c: 0x2fe1, 0x208d: 0x90bd, 0x208e: 0x2fe9, 0x208f: 0x2ff1, 0x2090: 0x90dd, 0x2091: 0x90fd,
+	0x2092: 0x2ff9, 0x2093: 0x3001, 0x2094: 0x3009, 0x2095: 0x3011, 0x2096: 0x3019, 0x2097: 0x3021,
+	0x2098: 0x3029, 0x2099: 0x3031, 0x209a: 0x3039, 0x209b: 0x911d, 0x209c: 0x3041, 0x209d: 0x913d,
+	0x209e: 0x3049, 0x209f: 0x2040, 0x20a0: 0x3051, 0x20a1: 0x3059, 0x20a2: 0x3061, 0x20a3: 0x915d,
+	0x20a4: 0x3069, 0x20a5: 0x3071, 0x20a6: 0x917d, 0x20a7: 0x919d, 0x20a8: 0x3079, 0x20a9: 0x3081,
+	0x20aa: 0x3089, 0x20ab: 0x3091, 0x20ac: 0x3099, 0x20ad: 0x3099, 0x20ae: 0x30a1, 0x20af: 0x30a9,
+	0x20b0: 0x30b1, 0x20b1: 0x30b9, 0x20b2: 0x30c1, 0x20b3: 0x30c9, 0x20b4: 0x30d1, 0x20b5: 0x91bd,
+	0x20b6: 0x30d9, 0x20b7: 0x91dd, 0x20b8: 0x30e1, 0x20b9: 0x91fd, 0x20ba: 0x30e9, 0x20bb: 0x921d,
+	0x20bc: 0x923d, 0x20bd: 0x925d, 0x20be: 0x30f1, 0x20bf: 0x30f9,
+	// Block 0x83, offset 0x20c0
+	0x20c0: 0x3101, 0x20c1: 0x927d, 0x20c2: 0x929d, 0x20c3: 0x92bd, 0x20c4: 0x92dd, 0x20c5: 0x3109,
+	0x20c6: 0x3111, 0x20c7: 0x3111, 0x20c8: 0x3119, 0x20c9: 0x3121, 0x20ca: 0x3129, 0x20cb: 0x3131,
+	0x20cc: 0x3139, 0x20cd: 0x92fd, 0x20ce: 0x3141, 0x20cf: 0x3149, 0x20d0: 0x3151, 0x20d1: 0x3159,
+	0x20d2: 0x931d, 0x20d3: 0x3161, 0x20d4: 0x933d, 0x20d5: 0x935d, 0x20d6: 0x3169, 0x20d7: 0x3171,
+	0x20d8: 0x3179, 0x20d9: 0x3181, 0x20da: 0x3189, 0x20db: 0x3191, 0x20dc: 0x937d, 0x20dd: 0x939d,
+	0x20de: 0x93bd, 0x20df: 0x2040, 0x20e0: 0x3199, 0x20e1: 0x93dd, 0x20e2: 0x31a1, 0x20e3: 0x31a9,
+	0x20e4: 0x31b1, 0x20e5: 0x93fd, 0x20e6: 0x31b9, 0x20e7: 0x31c1, 0x20e8: 0x31c9, 0x20e9: 0x31d1,
+	0x20ea: 0x31d9, 0x20eb: 0x941d, 0x20ec: 0x31e1, 0x20ed: 0x31e9, 0x20ee: 0x31f1, 0x20ef: 0x31f9,
+	0x20f0: 0x3201, 0x20f1: 0x3209, 0x20f2: 0x943d, 0x20f3: 0x945d, 0x20f4: 0x3211, 0x20f5: 0x947d,
+	0x20f6: 0x3219, 0x20f7: 0x949d, 0x20f8: 0x3221, 0x20f9: 0x3229, 0x20fa: 0x3231, 0x20fb: 0x94bd,
+	0x20fc: 0x94dd, 0x20fd: 0x3239, 0x20fe: 0x94fd, 0x20ff: 0x3241,
+	// Block 0x84, offset 0x2100
+	0x2100: 0x951d, 0x2101: 0x3249, 0x2102: 0x3251, 0x2103: 0x3259, 0x2104: 0x3261, 0x2105: 0x3269,
+	0x2106: 0x3271, 0x2107: 0x953d, 0x2108: 0x955d, 0x2109: 0x957d, 0x210a: 0x959d, 0x210b: 0x2ca1,
+	0x210c: 0x3279, 0x210d: 0x3281, 0x210e: 0x3289, 0x210f: 0x3291, 0x2110: 0x3299, 0x2111: 0x32a1,
+	0x2112: 0x32a9, 0x2113: 0x32b1, 0x2114: 0x32b9, 0x2115: 0x32c1, 0x2116: 0x32c9, 0x2117: 0x95bd,
+	0x2118: 0x32d1, 0x2119: 0x32d9, 0x211a: 0x32e1, 0x211b: 0x32e9, 0x211c: 0x32f1, 0x211d: 0x32f9,
+	0x211e: 0x3301, 0x211f: 0x3309, 0x2120: 0x3311, 0x2121: 0x3319, 0x2122: 0x3321, 0x2123: 0x3329,
+	0x2124: 0x95dd, 0x2125: 0x95fd, 0x2126: 0x961d, 0x2127: 0x3331, 0x2128: 0x3339, 0x2129: 0x3341,
+	0x212a: 0x3349, 0x212b: 0x963d, 0x212c: 0x3351, 0x212d: 0x965d, 0x212e: 0x3359, 0x212f: 0x3361,
+	0x2130: 0x967d, 0x2131: 0x969d, 0x2132: 0x3369, 0x2133: 0x3371, 0x2134: 0x3379, 0x2135: 0x3381,
+	0x2136: 0x3389, 0x2137: 0x3391, 0x2138: 0x3399, 0x2139: 0x33a1, 0x213a: 0x33a9, 0x213b: 0x33b1,
+	0x213c: 0x33b9, 0x213d: 0x33c1, 0x213e: 0x33c9, 0x213f: 0x2040,
+	// Block 0x85, offset 0x2140
+	0x2140: 0x33d1, 0x2141: 0x33d9, 0x2142: 0x33e1, 0x2143: 0x33e9, 0x2144: 0x33f1, 0x2145: 0x96bd,
+	0x2146: 0x33f9, 0x2147: 0x3401, 0x2148: 0x3409, 0x2149: 0x3411, 0x214a: 0x3419, 0x214b: 0x96dd,
+	0x214c: 0x96fd, 0x214d: 0x3421, 0x214e: 0x3429, 0x214f: 0x3431, 0x2150: 0x3439, 0x2151: 0x3441,
+	0x2152: 0x3449, 0x2153: 0x971d, 0x2154: 0x3451, 0x2155: 0x3459, 0x2156: 0x3461, 0x2157: 0x3469,
+	0x2158: 0x973d, 0x2159: 0x975d, 0x215a: 0x3471, 0x215b: 0x3479, 0x215c: 0x3481, 0x215d: 0x977d,
+	0x215e: 0x3489, 0x215f: 0x3491, 0x2160: 0x684d, 0x2161: 0x979d, 0x2162: 0x3499, 0x2163: 0x34a1,
+	0x2164: 0x34a9, 0x2165: 0x97bd, 0x2166: 0x34b1, 0x2167: 0x34b9, 0x2168: 0x34c1, 0x2169: 0x34c9,
+	0x216a: 0x34d1, 0x216b: 0x34d9, 0x216c: 0x34e1, 0x216d: 0x97dd, 0x216e: 0x34e9, 0x216f: 0x34f1,
+	0x2170: 0x34f9, 0x2171: 0x97fd, 0x2172: 0x3501, 0x2173: 0x3509, 0x2174: 0x3511, 0x2175: 0x3519,
+	0x2176: 0x7b6d, 0x2177: 0x981d, 0x2178: 0x3521, 0x2179: 0x3529, 0x217a: 0x3531, 0x217b: 0x983d,
+	0x217c: 0x3539, 0x217d: 0x985d, 0x217e: 0x3541, 0x217f: 0x3541,
+	// Block 0x86, offset 0x2180
+	0x2180: 0x3549, 0x2181: 0x987d, 0x2182: 0x3551, 0x2183: 0x3559, 0x2184: 0x3561, 0x2185: 0x3569,
+	0x2186: 0x3571, 0x2187: 0x3579, 0x2188: 0x3581, 0x2189: 0x989d, 0x218a: 0x3589, 0x218b: 0x3591,
+	0x218c: 0x3599, 0x218d: 0x35a1, 0x218e: 0x35a9, 0x218f: 0x35b1, 0x2190: 0x98bd, 0x2191: 0x35b9,
+	0x2192: 0x98dd, 0x2193: 0x98fd, 0x2194: 0x991d, 0x2195: 0x35c1, 0x2196: 0x35c9, 0x2197: 0x35d1,
+	0x2198: 0x35d9, 0x2199: 0x35e1, 0x219a: 0x35e9, 0x219b: 0x35f1, 0x219c: 0x35f9, 0x219d: 0x993d,
+	0x219e: 0x0040, 0x219f: 0x0040, 0x21a0: 0x0040, 0x21a1: 0x0040, 0x21a2: 0x0040, 0x21a3: 0x0040,
+	0x21a4: 0x0040, 0x21a5: 0x0040, 0x21a6: 0x0040, 0x21a7: 0x0040, 0x21a8: 0x0040, 0x21a9: 0x0040,
+	0x21aa: 0x0040, 0x21ab: 0x0040, 0x21ac: 0x0040, 0x21ad: 0x0040, 0x21ae: 0x0040, 0x21af: 0x0040,
+	0x21b0: 0x0040, 0x21b1: 0x0040, 0x21b2: 0x0040, 0x21b3: 0x0040, 0x21b4: 0x0040, 0x21b5: 0x0040,
+	0x21b6: 0x0040, 0x21b7: 0x0040, 0x21b8: 0x0040, 0x21b9: 0x0040, 0x21ba: 0x0040, 0x21bb: 0x0040,
+	0x21bc: 0x0040, 0x21bd: 0x0040, 0x21be: 0x0040, 0x21bf: 0x0040,
+}
+
+// idnaIndex: 39 blocks, 2496 entries, 4992 bytes
+// Block 0 is the zero block.
+var idnaIndex = [2496]uint16{
+	// Block 0x0, offset 0x0
+	// Block 0x1, offset 0x40
+	// Block 0x2, offset 0x80
+	// Block 0x3, offset 0xc0
+	0xc2: 0x01, 0xc3: 0x85, 0xc4: 0x02, 0xc5: 0x03, 0xc6: 0x04, 0xc7: 0x05,
+	0xc8: 0x06, 0xc9: 0x86, 0xca: 0x87, 0xcb: 0x07, 0xcc: 0x88, 0xcd: 0x08, 0xce: 0x09, 0xcf: 0x0a,
+	0xd0: 0x89, 0xd1: 0x0b, 0xd2: 0x0c, 0xd3: 0x0d, 0xd4: 0x0e, 0xd5: 0x8a, 0xd6: 0x8b, 0xd7: 0x8c,
+	0xd8: 0x0f, 0xd9: 0x10, 0xda: 0x8d, 0xdb: 0x11, 0xdc: 0x12, 0xdd: 0x8e, 0xde: 0x8f, 0xdf: 0x90,
+	0xe0: 0x02, 0xe1: 0x03, 0xe2: 0x04, 0xe3: 0x05, 0xe4: 0x06, 0xe5: 0x07, 0xe6: 0x07, 0xe7: 0x07,
+	0xe8: 0x07, 0xe9: 0x07, 0xea: 0x08, 0xeb: 0x07, 0xec: 0x07, 0xed: 0x09, 0xee: 0x0a, 0xef: 0x0b,
+	0xf0: 0x20, 0xf1: 0x21, 0xf2: 0x21, 0xf3: 0x23, 0xf4: 0x24,
+	// Block 0x4, offset 0x100
+	0x120: 0x91, 0x121: 0x13, 0x122: 0x14, 0x123: 0x92, 0x124: 0x93, 0x125: 0x15, 0x126: 0x16, 0x127: 0x17,
+	0x128: 0x18, 0x129: 0x19, 0x12a: 0x1a, 0x12b: 0x1b, 0x12c: 0x1c, 0x12d: 0x1d, 0x12e: 0x1e, 0x12f: 0x94,
+	0x130: 0x95, 0x131: 0x1f, 0x132: 0x20, 0x133: 0x21, 0x134: 0x96, 0x135: 0x22, 0x136: 0x97, 0x137: 0x98,
+	0x138: 0x99, 0x139: 0x9a, 0x13a: 0x23, 0x13b: 0x9b, 0x13c: 0x9c, 0x13d: 0x24, 0x13e: 0x25, 0x13f: 0x9d,
+	// Block 0x5, offset 0x140
+	0x140: 0x9e, 0x141: 0x9f, 0x142: 0xa0, 0x143: 0xa1, 0x144: 0xa2, 0x145: 0xa3, 0x146: 0xa4, 0x147: 0xa5,
+	0x148: 0xa6, 0x149: 0xa7, 0x14a: 0xa8, 0x14b: 0xa9, 0x14c: 0xaa, 0x14d: 0xab, 0x14e: 0xac, 0x14f: 0xad,
+	0x150: 0xae, 0x151: 0xa6, 0x152: 0xa6, 0x153: 0xa6, 0x154: 0xa6, 0x155: 0xa6, 0x156: 0xa6, 0x157: 0xa6,
+	0x158: 0xa6, 0x159: 0xaf, 0x15a: 0xb0, 0x15b: 0xb1, 0x15c: 0xb2, 0x15d: 0xb3, 0x15e: 0xb4, 0x15f: 0xb5,
+	0x160: 0xb6, 0x161: 0xb7, 0x162: 0xb8, 0x163: 0xb9, 0x164: 0xba, 0x165: 0xbb, 0x166: 0xbc, 0x167: 0xbd,
+	0x168: 0xbe, 0x169: 0xbf, 0x16a: 0xc0, 0x16b: 0xc1, 0x16c: 0xc2, 0x16d: 0xc3, 0x16e: 0xc4, 0x16f: 0xc5,
+	0x170: 0xc6, 0x171: 0xc7, 0x172: 0xc8, 0x173: 0xc9, 0x174: 0x26, 0x175: 0x27, 0x176: 0x28, 0x177: 0x88,
+	0x178: 0x29, 0x179: 0x29, 0x17a: 0x2a, 0x17b: 0x29, 0x17c: 0xca, 0x17d: 0x2b, 0x17e: 0x2c, 0x17f: 0x2d,
+	// Block 0x6, offset 0x180
+	0x180: 0x2e, 0x181: 0x2f, 0x182: 0x30, 0x183: 0xcb, 0x184: 0x31, 0x185: 0x32, 0x186: 0xcc, 0x187: 0xa2,
+	0x188: 0xcd, 0x189: 0xce, 0x18a: 0xa2, 0x18b: 0xa2, 0x18c: 0xcf, 0x18d: 0xa2, 0x18e: 0xa2, 0x18f: 0xa2,
+	0x190: 0xd0, 0x191: 0x33, 0x192: 0x34, 0x193: 0x35, 0x194: 0xa2, 0x195: 0xa2, 0x196: 0xa2, 0x197: 0xa2,
+	0x198: 0xa2, 0x199: 0xa2, 0x19a: 0xa2, 0x19b: 0xa2, 0x19c: 0xa2, 0x19d: 0xa2, 0x19e: 0xa2, 0x19f: 0xa2,
+	0x1a0: 0xa2, 0x1a1: 0xa2, 0x1a2: 0xa2, 0x1a3: 0xa2, 0x1a4: 0xa2, 0x1a5: 0xa2, 0x1a6: 0xa2, 0x1a7: 0xa2,
+	0x1a8: 0xd1, 0x1a9: 0xd2, 0x1aa: 0xa2, 0x1ab: 0xd3, 0x1ac: 0xa2, 0x1ad: 0xd4, 0x1ae: 0xd5, 0x1af: 0xa2,
+	0x1b0: 0xd6, 0x1b1: 0x36, 0x1b2: 0x29, 0x1b3: 0x37, 0x1b4: 0xd7, 0x1b5: 0xd8, 0x1b6: 0xd9, 0x1b7: 0xda,
+	0x1b8: 0xdb, 0x1b9: 0xdc, 0x1ba: 0xdd, 0x1bb: 0xde, 0x1bc: 0xdf, 0x1bd: 0xe0, 0x1be: 0xe1, 0x1bf: 0x38,
+	// Block 0x7, offset 0x1c0
+	0x1c0: 0x39, 0x1c1: 0xe2, 0x1c2: 0xe3, 0x1c3: 0xe4, 0x1c4: 0xe5, 0x1c5: 0x3a, 0x1c6: 0x3b, 0x1c7: 0xe6,
+	0x1c8: 0xe7, 0x1c9: 0x3c, 0x1ca: 0x3d, 0x1cb: 0x3e, 0x1cc: 0xe8, 0x1cd: 0xe9, 0x1ce: 0x3f, 0x1cf: 0x40,
+	0x1d0: 0xa6, 0x1d1: 0xa6, 0x1d2: 0xa6, 0x1d3: 0xa6, 0x1d4: 0xa6, 0x1d5: 0xa6, 0x1d6: 0xa6, 0x1d7: 0xa6,
+	0x1d8: 0xa6, 0x1d9: 0xa6, 0x1da: 0xa6, 0x1db: 0xa6, 0x1dc: 0xa6, 0x1dd: 0xa6, 0x1de: 0xa6, 0x1df: 0xa6,
+	0x1e0: 0xa6, 0x1e1: 0xa6, 0x1e2: 0xa6, 0x1e3: 0xa6, 0x1e4: 0xa6, 0x1e5: 0xa6, 0x1e6: 0xa6, 0x1e7: 0xa6,
+	0x1e8: 0xa6, 0x1e9: 0xa6, 0x1ea: 0xa6, 0x1eb: 0xa6, 0x1ec: 0xa6, 0x1ed: 0xa6, 0x1ee: 0xa6, 0x1ef: 0xa6,
+	0x1f0: 0xa6, 0x1f1: 0xa6, 0x1f2: 0xa6, 0x1f3: 0xa6, 0x1f4: 0xa6, 0x1f5: 0xa6, 0x1f6: 0xa6, 0x1f7: 0xa6,
+	0x1f8: 0xa6, 0x1f9: 0xa6, 0x1fa: 0xa6, 0x1fb: 0xa6, 0x1fc: 0xa6, 0x1fd: 0xa6, 0x1fe: 0xa6, 0x1ff: 0xa6,
+	// Block 0x8, offset 0x200
+	0x200: 0xa6, 0x201: 0xa6, 0x202: 0xa6, 0x203: 0xa6, 0x204: 0xa6, 0x205: 0xa6, 0x206: 0xa6, 0x207: 0xa6,
+	0x208: 0xa6, 0x209: 0xa6, 0x20a: 0xa6, 0x20b: 0xa6, 0x20c: 0xa6, 0x20d: 0xa6, 0x20e: 0xa6, 0x20f: 0xa6,
+	0x210: 0xa6, 0x211: 0xa6, 0x212: 0xa6, 0x213: 0xa6, 0x214: 0xa6, 0x215: 0xa6, 0x216: 0xa6, 0x217: 0xa6,
+	0x218: 0xa6, 0x219: 0xa6, 0x21a: 0xa6, 0x21b: 0xa6, 0x21c: 0xa6, 0x21d: 0xa6, 0x21e: 0xa6, 0x21f: 0xa6,
+	0x220: 0xa6, 0x221: 0xa6, 0x222: 0xa6, 0x223: 0xa6, 0x224: 0xa6, 0x225: 0xa6, 0x226: 0xa6, 0x227: 0xa6,
+	0x228: 0xa6, 0x229: 0xa6, 0x22a: 0xa6, 0x22b: 0xa6, 0x22c: 0xa6, 0x22d: 0xa6, 0x22e: 0xa6, 0x22f: 0xa6,
+	0x230: 0xa6, 0x231: 0xa6, 0x232: 0xa6, 0x233: 0xa6, 0x234: 0xa6, 0x235: 0xa6, 0x236: 0xa6, 0x237: 0xa2,
+	0x238: 0xa6, 0x239: 0xa6, 0x23a: 0xa6, 0x23b: 0xa6, 0x23c: 0xa6, 0x23d: 0xa6, 0x23e: 0xa6, 0x23f: 0xa6,
+	// Block 0x9, offset 0x240
+	0x240: 0xa6, 0x241: 0xa6, 0x242: 0xa6, 0x243: 0xa6, 0x244: 0xa6, 0x245: 0xa6, 0x246: 0xa6, 0x247: 0xa6,
+	0x248: 0xa6, 0x249: 0xa6, 0x24a: 0xa6, 0x24b: 0xa6, 0x24c: 0xa6, 0x24d: 0xa6, 0x24e: 0xa6, 0x24f: 0xa6,
+	0x250: 0xa6, 0x251: 0xa6, 0x252: 0xa6, 0x253: 0xa6, 0x254: 0xa6, 0x255: 0xa6, 0x256: 0xa6, 0x257: 0xa6,
+	0x258: 0xa6, 0x259: 0xa6, 0x25a: 0xa6, 0x25b: 0xa6, 0x25c: 0xa6, 0x25d: 0xa6, 0x25e: 0xa6, 0x25f: 0xa6,
+	0x260: 0xa6, 0x261: 0xa6, 0x262: 0xa6, 0x263: 0xa6, 0x264: 0xa6, 0x265: 0xa6, 0x266: 0xa6, 0x267: 0xa6,
+	0x268: 0xa6, 0x269: 0xa6, 0x26a: 0xa6, 0x26b: 0xa6, 0x26c: 0xa6, 0x26d: 0xa6, 0x26e: 0xa6, 0x26f: 0xa6,
+	0x270: 0xa6, 0x271: 0xa6, 0x272: 0xa6, 0x273: 0xa6, 0x274: 0xa6, 0x275: 0xa6, 0x276: 0xa6, 0x277: 0xa6,
+	0x278: 0xa6, 0x279: 0xa6, 0x27a: 0xa6, 0x27b: 0xa6, 0x27c: 0xa6, 0x27d: 0xa6, 0x27e: 0xa6, 0x27f: 0xa6,
+	// Block 0xa, offset 0x280
+	0x280: 0xa6, 0x281: 0xa6, 0x282: 0xa6, 0x283: 0xa6, 0x284: 0xa6, 0x285: 0xa6, 0x286: 0xa6, 0x287: 0xa6,
+	0x288: 0xa6, 0x289: 0xa6, 0x28a: 0xa6, 0x28b: 0xa6, 0x28c: 0xa6, 0x28d: 0xa6, 0x28e: 0xa6, 0x28f: 0xa6,
+	0x290: 0xa6, 0x291: 0xa6, 0x292: 0xea, 0x293: 0xeb, 0x294: 0xa6, 0x295: 0xa6, 0x296: 0xa6, 0x297: 0xa6,
+	0x298: 0xec, 0x299: 0x41, 0x29a: 0x42, 0x29b: 0xed, 0x29c: 0x43, 0x29d: 0x44, 0x29e: 0x45, 0x29f: 0x46,
+	0x2a0: 0xee, 0x2a1: 0xef, 0x2a2: 0xf0, 0x2a3: 0xf1, 0x2a4: 0xf2, 0x2a5: 0xf3, 0x2a6: 0xf4, 0x2a7: 0xf5,
+	0x2a8: 0xf6, 0x2a9: 0xf7, 0x2aa: 0xf8, 0x2ab: 0xf9, 0x2ac: 0xfa, 0x2ad: 0xfb, 0x2ae: 0xfc, 0x2af: 0xfd,
+	0x2b0: 0xa6, 0x2b1: 0xa6, 0x2b2: 0xa6, 0x2b3: 0xa6, 0x2b4: 0xa6, 0x2b5: 0xa6, 0x2b6: 0xa6, 0x2b7: 0xa6,
+	0x2b8: 0xa6, 0x2b9: 0xa6, 0x2ba: 0xa6, 0x2bb: 0xa6, 0x2bc: 0xa6, 0x2bd: 0xa6, 0x2be: 0xa6, 0x2bf: 0xa6,
+	// Block 0xb, offset 0x2c0
+	0x2c0: 0xa6, 0x2c1: 0xa6, 0x2c2: 0xa6, 0x2c3: 0xa6, 0x2c4: 0xa6, 0x2c5: 0xa6, 0x2c6: 0xa6, 0x2c7: 0xa6,
+	0x2c8: 0xa6, 0x2c9: 0xa6, 0x2ca: 0xa6, 0x2cb: 0xa6, 0x2cc: 0xa6, 0x2cd: 0xa6, 0x2ce: 0xa6, 0x2cf: 0xa6,
+	0x2d0: 0xa6, 0x2d1: 0xa6, 0x2d2: 0xa6, 0x2d3: 0xa6, 0x2d4: 0xa6, 0x2d5: 0xa6, 0x2d6: 0xa6, 0x2d7: 0xa6,
+	0x2d8: 0xa6, 0x2d9: 0xa6, 0x2da: 0xa6, 0x2db: 0xa6, 0x2dc: 0xa6, 0x2dd: 0xa6, 0x2de: 0xfe, 0x2df: 0xff,
+	// Block 0xc, offset 0x300
+	0x300: 0x100, 0x301: 0x100, 0x302: 0x100, 0x303: 0x100, 0x304: 0x100, 0x305: 0x100, 0x306: 0x100, 0x307: 0x100,
+	0x308: 0x100, 0x309: 0x100, 0x30a: 0x100, 0x30b: 0x100, 0x30c: 0x100, 0x30d: 0x100, 0x30e: 0x100, 0x30f: 0x100,
+	0x310: 0x100, 0x311: 0x100, 0x312: 0x100, 0x313: 0x100, 0x314: 0x100, 0x315: 0x100, 0x316: 0x100, 0x317: 0x100,
+	0x318: 0x100, 0x319: 0x100, 0x31a: 0x100, 0x31b: 0x100, 0x31c: 0x100, 0x31d: 0x100, 0x31e: 0x100, 0x31f: 0x100,
+	0x320: 0x100, 0x321: 0x100, 0x322: 0x100, 0x323: 0x100, 0x324: 0x100, 0x325: 0x100, 0x326: 0x100, 0x327: 0x100,
+	0x328: 0x100, 0x329: 0x100, 0x32a: 0x100, 0x32b: 0x100, 0x32c: 0x100, 0x32d: 0x100, 0x32e: 0x100, 0x32f: 0x100,
+	0x330: 0x100, 0x331: 0x100, 0x332: 0x100, 0x333: 0x100, 0x334: 0x100, 0x335: 0x100, 0x336: 0x100, 0x337: 0x100,
+	0x338: 0x100, 0x339: 0x100, 0x33a: 0x100, 0x33b: 0x100, 0x33c: 0x100, 0x33d: 0x100, 0x33e: 0x100, 0x33f: 0x100,
+	// Block 0xd, offset 0x340
+	0x340: 0x100, 0x341: 0x100, 0x342: 0x100, 0x343: 0x100, 0x344: 0x100, 0x345: 0x100, 0x346: 0x100, 0x347: 0x100,
+	0x348: 0x100, 0x349: 0x100, 0x34a: 0x100, 0x34b: 0x100, 0x34c: 0x100, 0x34d: 0x100, 0x34e: 0x100, 0x34f: 0x100,
+	0x350: 0x100, 0x351: 0x100, 0x352: 0x100, 0x353: 0x100, 0x354: 0x100, 0x355: 0x100, 0x356: 0x100, 0x357: 0x100,
+	0x358: 0x100, 0x359: 0x100, 0x35a: 0x100, 0x35b: 0x100, 0x35c: 0x100, 0x35d: 0x100, 0x35e: 0x100, 0x35f: 0x100,
+	0x360: 0x100, 0x361: 0x100, 0x362: 0x100, 0x363: 0x100, 0x364: 0x101, 0x365: 0x102, 0x366: 0x103, 0x367: 0x104,
+	0x368: 0x47, 0x369: 0x105, 0x36a: 0x106, 0x36b: 0x48, 0x36c: 0x49, 0x36d: 0x4a, 0x36e: 0x4b, 0x36f: 0x4c,
+	0x370: 0x107, 0x371: 0x4d, 0x372: 0x4e, 0x373: 0x4f, 0x374: 0x50, 0x375: 0x51, 0x376: 0x108, 0x377: 0x52,
+	0x378: 0x53, 0x379: 0x54, 0x37a: 0x55, 0x37b: 0x56, 0x37c: 0x57, 0x37d: 0x58, 0x37e: 0x59, 0x37f: 0x5a,
+	// Block 0xe, offset 0x380
+	0x380: 0x109, 0x381: 0x10a, 0x382: 0xa6, 0x383: 0x10b, 0x384: 0x10c, 0x385: 0xa2, 0x386: 0x10d, 0x387: 0x10e,
+	0x388: 0x100, 0x389: 0x100, 0x38a: 0x10f, 0x38b: 0x110, 0x38c: 0x111, 0x38d: 0x112, 0x38e: 0x113, 0x38f: 0x114,
+	0x390: 0x115, 0x391: 0xa6, 0x392: 0x116, 0x393: 0x117, 0x394: 0x118, 0x395: 0x5b, 0x396: 0x5c, 0x397: 0x100,
+	0x398: 0xa6, 0x399: 0xa6, 0x39a: 0xa6, 0x39b: 0xa6, 0x39c: 0x119, 0x39d: 0x11a, 0x39e: 0x5d, 0x39f: 0x100,
+	0x3a0: 0x11b, 0x3a1: 0x11c, 0x3a2: 0x11d, 0x3a3: 0x11e, 0x3a4: 0x11f, 0x3a5: 0x100, 0x3a6: 0x120, 0x3a7: 0x121,
+	0x3a8: 0x122, 0x3a9: 0x123, 0x3aa: 0x124, 0x3ab: 0x5e, 0x3ac: 0x125, 0x3ad: 0x126, 0x3ae: 0x5f, 0x3af: 0x100,
+	0x3b0: 0x127, 0x3b1: 0x128, 0x3b2: 0x129, 0x3b3: 0x12a, 0x3b4: 0x12b, 0x3b5: 0x100, 0x3b6: 0x100, 0x3b7: 0x100,
+	0x3b8: 0x100, 0x3b9: 0x12c, 0x3ba: 0x12d, 0x3bb: 0x12e, 0x3bc: 0x12f, 0x3bd: 0x130, 0x3be: 0x131, 0x3bf: 0x132,
+	// Block 0xf, offset 0x3c0
+	0x3c0: 0x133, 0x3c1: 0x134, 0x3c2: 0x135, 0x3c3: 0x136, 0x3c4: 0x137, 0x3c5: 0x138, 0x3c6: 0x139, 0x3c7: 0x13a,
+	0x3c8: 0x13b, 0x3c9: 0x13c, 0x3ca: 0x13d, 0x3cb: 0x13e, 0x3cc: 0x60, 0x3cd: 0x61, 0x3ce: 0x100, 0x3cf: 0x100,
+	0x3d0: 0x13f, 0x3d1: 0x140, 0x3d2: 0x141, 0x3d3: 0x142, 0x3d4: 0x100, 0x3d5: 0x100, 0x3d6: 0x143, 0x3d7: 0x144,
+	0x3d8: 0x145, 0x3d9: 0x146, 0x3da: 0x147, 0x3db: 0x148, 0x3dc: 0x149, 0x3dd: 0x14a, 0x3de: 0x100, 0x3df: 0x100,
+	0x3e0: 0x14b, 0x3e1: 0x100, 0x3e2: 0x14c, 0x3e3: 0x14d, 0x3e4: 0x62, 0x3e5: 0x14e, 0x3e6: 0x14f, 0x3e7: 0x150,
+	0x3e8: 0x151, 0x3e9: 0x152, 0x3ea: 0x153, 0x3eb: 0x154, 0x3ec: 0x155, 0x3ed: 0x100, 0x3ee: 0x100, 0x3ef: 0x100,
+	0x3f0: 0x156, 0x3f1: 0x157, 0x3f2: 0x158, 0x3f3: 0x100, 0x3f4: 0x159, 0x3f5: 0x15a, 0x3f6: 0x15b, 0x3f7: 0x100,
+	0x3f8: 0x100, 0x3f9: 0x100, 0x3fa: 0x100, 0x3fb: 0x15c, 0x3fc: 0x15d, 0x3fd: 0x15e, 0x3fe: 0x15f, 0x3ff: 0x160,
+	// Block 0x10, offset 0x400
+	0x400: 0xa6, 0x401: 0xa6, 0x402: 0xa6, 0x403: 0xa6, 0x404: 0xa6, 0x405: 0xa6, 0x406: 0xa6, 0x407: 0xa6,
+	0x408: 0xa6, 0x409: 0xa6, 0x40a: 0xa6, 0x40b: 0xa6, 0x40c: 0xa6, 0x40d: 0xa6, 0x40e: 0x161, 0x40f: 0x100,
+	0x410: 0xa2, 0x411: 0x162, 0x412: 0xa6, 0x413: 0xa6, 0x414: 0xa6, 0x415: 0x163, 0x416: 0x100, 0x417: 0x100,
+	0x418: 0x100, 0x419: 0x100, 0x41a: 0x100, 0x41b: 0x100, 0x41c: 0x100, 0x41d: 0x100, 0x41e: 0x100, 0x41f: 0x100,
+	0x420: 0x100, 0x421: 0x100, 0x422: 0x100, 0x423: 0x100, 0x424: 0x100, 0x425: 0x100, 0x426: 0x100, 0x427: 0x100,
+	0x428: 0x100, 0x429: 0x100, 0x42a: 0x100, 0x42b: 0x100, 0x42c: 0x100, 0x42d: 0x100, 0x42e: 0x100, 0x42f: 0x100,
+	0x430: 0x100, 0x431: 0x100, 0x432: 0x100, 0x433: 0x100, 0x434: 0x100, 0x435: 0x100, 0x436: 0x100, 0x437: 0x100,
+	0x438: 0x100, 0x439: 0x100, 0x43a: 0x100, 0x43b: 0x100, 0x43c: 0x100, 0x43d: 0x100, 0x43e: 0x164, 0x43f: 0x165,
+	// Block 0x11, offset 0x440
+	0x440: 0xa6, 0x441: 0xa6, 0x442: 0xa6, 0x443: 0xa6, 0x444: 0xa6, 0x445: 0xa6, 0x446: 0xa6, 0x447: 0xa6,
+	0x448: 0xa6, 0x449: 0xa6, 0x44a: 0xa6, 0x44b: 0xa6, 0x44c: 0xa6, 0x44d: 0xa6, 0x44e: 0xa6, 0x44f: 0xa6,
+	0x450: 0x166, 0x451: 0x167, 0x452: 0x100, 0x453: 0x100, 0x454: 0x100, 0x455: 0x100, 0x456: 0x100, 0x457: 0x100,
+	0x458: 0x100, 0x459: 0x100, 0x45a: 0x100, 0x45b: 0x100, 0x45c: 0x100, 0x45d: 0x100, 0x45e: 0x100, 0x45f: 0x100,
+	0x460: 0x100, 0x461: 0x100, 0x462: 0x100, 0x463: 0x100, 0x464: 0x100, 0x465: 0x100, 0x466: 0x100, 0x467: 0x100,
+	0x468: 0x100, 0x469: 0x100, 0x46a: 0x100, 0x46b: 0x100, 0x46c: 0x100, 0x46d: 0x100, 0x46e: 0x100, 0x46f: 0x100,
+	0x470: 0x100, 0x471: 0x100, 0x472: 0x100, 0x473: 0x100, 0x474: 0x100, 0x475: 0x100, 0x476: 0x100, 0x477: 0x100,
+	0x478: 0x100, 0x479: 0x100, 0x47a: 0x100, 0x47b: 0x100, 0x47c: 0x100, 0x47d: 0x100, 0x47e: 0x100, 0x47f: 0x100,
+	// Block 0x12, offset 0x480
+	0x480: 0x100, 0x481: 0x100, 0x482: 0x100, 0x483: 0x100, 0x484: 0x100, 0x485: 0x100, 0x486: 0x100, 0x487: 0x100,
+	0x488: 0x100, 0x489: 0x100, 0x48a: 0x100, 0x48b: 0x100, 0x48c: 0x100, 0x48d: 0x100, 0x48e: 0x100, 0x48f: 0x100,
+	0x490: 0xa6, 0x491: 0xa6, 0x492: 0xa6, 0x493: 0xa6, 0x494: 0xa6, 0x495: 0xa6, 0x496: 0xa6, 0x497: 0xa6,
+	0x498: 0xa6, 0x499: 0x14a, 0x49a: 0x100, 0x49b: 0x100, 0x49c: 0x100, 0x49d: 0x100, 0x49e: 0x100, 0x49f: 0x100,
+	0x4a0: 0x100, 0x4a1: 0x100, 0x4a2: 0x100, 0x4a3: 0x100, 0x4a4: 0x100, 0x4a5: 0x100, 0x4a6: 0x100, 0x4a7: 0x100,
+	0x4a8: 0x100, 0x4a9: 0x100, 0x4aa: 0x100, 0x4ab: 0x100, 0x4ac: 0x100, 0x4ad: 0x100, 0x4ae: 0x100, 0x4af: 0x100,
+	0x4b0: 0x100, 0x4b1: 0x100, 0x4b2: 0x100, 0x4b3: 0x100, 0x4b4: 0x100, 0x4b5: 0x100, 0x4b6: 0x100, 0x4b7: 0x100,
+	0x4b8: 0x100, 0x4b9: 0x100, 0x4ba: 0x100, 0x4bb: 0x100, 0x4bc: 0x100, 0x4bd: 0x100, 0x4be: 0x100, 0x4bf: 0x100,
+	// Block 0x13, offset 0x4c0
+	0x4c0: 0x100, 0x4c1: 0x100, 0x4c2: 0x100, 0x4c3: 0x100, 0x4c4: 0x100, 0x4c5: 0x100, 0x4c6: 0x100, 0x4c7: 0x100,
+	0x4c8: 0x100, 0x4c9: 0x100, 0x4ca: 0x100, 0x4cb: 0x100, 0x4cc: 0x100, 0x4cd: 0x100, 0x4ce: 0x100, 0x4cf: 0x100,
+	0x4d0: 0x100, 0x4d1: 0x100, 0x4d2: 0x100, 0x4d3: 0x100, 0x4d4: 0x100, 0x4d5: 0x100, 0x4d6: 0x100, 0x4d7: 0x100,
+	0x4d8: 0x100, 0x4d9: 0x100, 0x4da: 0x100, 0x4db: 0x100, 0x4dc: 0x100, 0x4dd: 0x100, 0x4de: 0x100, 0x4df: 0x100,
+	0x4e0: 0xa6, 0x4e1: 0xa6, 0x4e2: 0xa6, 0x4e3: 0xa6, 0x4e4: 0xa6, 0x4e5: 0xa6, 0x4e6: 0xa6, 0x4e7: 0xa6,
+	0x4e8: 0x154, 0x4e9: 0x168, 0x4ea: 0x169, 0x4eb: 0x16a, 0x4ec: 0x16b, 0x4ed: 0x16c, 0x4ee: 0x16d, 0x4ef: 0x100,
+	0x4f0: 0x100, 0x4f1: 0x100, 0x4f2: 0x100, 0x4f3: 0x100, 0x4f4: 0x100, 0x4f5: 0x100, 0x4f6: 0x100, 0x4f7: 0x100,
+	0x4f8: 0x100, 0x4f9: 0x16e, 0x4fa: 0x16f, 0x4fb: 0x100, 0x4fc: 0xa6, 0x4fd: 0x170, 0x4fe: 0x171, 0x4ff: 0x172,
+	// Block 0x14, offset 0x500
+	0x500: 0xa6, 0x501: 0xa6, 0x502: 0xa6, 0x503: 0xa6, 0x504: 0xa6, 0x505: 0xa6, 0x506: 0xa6, 0x507: 0xa6,
+	0x508: 0xa6, 0x509: 0xa6, 0x50a: 0xa6, 0x50b: 0xa6, 0x50c: 0xa6, 0x50d: 0xa6, 0x50e: 0xa6, 0x50f: 0xa6,
+	0x510: 0xa6, 0x511: 0xa6, 0x512: 0xa6, 0x513: 0xa6, 0x514: 0xa6, 0x515: 0xa6, 0x516: 0xa6, 0x517: 0xa6,
+	0x518: 0xa6, 0x519: 0xa6, 0x51a: 0xa6, 0x51b: 0xa6, 0x51c: 0xa6, 0x51d: 0xa6, 0x51e: 0xa6, 0x51f: 0x173,
+	0x520: 0xa6, 0x521: 0xa6, 0x522: 0xa6, 0x523: 0xa6, 0x524: 0xa6, 0x525: 0xa6, 0x526: 0xa6, 0x527: 0xa6,
+	0x528: 0xa6, 0x529: 0xa6, 0x52a: 0xa6, 0x52b: 0xa6, 0x52c: 0xa6, 0x52d: 0xa6, 0x52e: 0xa6, 0x52f: 0xa6,
+	0x530: 0xa6, 0x531: 0xa6, 0x532: 0xa6, 0x533: 0x174, 0x534: 0x175, 0x535: 0x100, 0x536: 0x100, 0x537: 0x100,
+	0x538: 0x100, 0x539: 0x100, 0x53a: 0x100, 0x53b: 0x100, 0x53c: 0x100, 0x53d: 0x100, 0x53e: 0x100, 0x53f: 0x100,
+	// Block 0x15, offset 0x540
+	0x540: 0x100, 0x541: 0x100, 0x542: 0x100, 0x543: 0x100, 0x544: 0x100, 0x545: 0x100, 0x546: 0x100, 0x547: 0x100,
+	0x548: 0x100, 0x549: 0x100, 0x54a: 0x100, 0x54b: 0x100, 0x54c: 0x100, 0x54d: 0x100, 0x54e: 0x100, 0x54f: 0x100,
+	0x550: 0x100, 0x551: 0x100, 0x552: 0x100, 0x553: 0x100, 0x554: 0x100, 0x555: 0x100, 0x556: 0x100, 0x557: 0x100,
+	0x558: 0x100, 0x559: 0x100, 0x55a: 0x100, 0x55b: 0x100, 0x55c: 0x100, 0x55d: 0x100, 0x55e: 0x100, 0x55f: 0x100,
+	0x560: 0x100, 0x561: 0x100, 0x562: 0x100, 0x563: 0x100, 0x564: 0x100, 0x565: 0x100, 0x566: 0x100, 0x567: 0x100,
+	0x568: 0x100, 0x569: 0x100, 0x56a: 0x100, 0x56b: 0x100, 0x56c: 0x100, 0x56d: 0x100, 0x56e: 0x100, 0x56f: 0x100,
+	0x570: 0x100, 0x571: 0x100, 0x572: 0x100, 0x573: 0x100, 0x574: 0x100, 0x575: 0x100, 0x576: 0x100, 0x577: 0x100,
+	0x578: 0x100, 0x579: 0x100, 0x57a: 0x100, 0x57b: 0x100, 0x57c: 0x100, 0x57d: 0x100, 0x57e: 0x100, 0x57f: 0x176,
+	// Block 0x16, offset 0x580
+	0x580: 0xa6, 0x581: 0xa6, 0x582: 0xa6, 0x583: 0xa6, 0x584: 0x177, 0x585: 0x178, 0x586: 0xa6, 0x587: 0xa6,
+	0x588: 0xa6, 0x589: 0xa6, 0x58a: 0xa6, 0x58b: 0x179, 0x58c: 0x100, 0x58d: 0x100, 0x58e: 0x100, 0x58f: 0x100,
+	0x590: 0x100, 0x591: 0x100, 0x592: 0x100, 0x593: 0x100, 0x594: 0x100, 0x595: 0x100, 0x596: 0x100, 0x597: 0x100,
+	0x598: 0x100, 0x599: 0x100, 0x59a: 0x100, 0x59b: 0x100, 0x59c: 0x100, 0x59d: 0x100, 0x59e: 0x100, 0x59f: 0x100,
+	0x5a0: 0x100, 0x5a1: 0x100, 0x5a2: 0x100, 0x5a3: 0x100, 0x5a4: 0x100, 0x5a5: 0x100, 0x5a6: 0x100, 0x5a7: 0x100,
+	0x5a8: 0x100, 0x5a9: 0x100, 0x5aa: 0x100, 0x5ab: 0x100, 0x5ac: 0x100, 0x5ad: 0x100, 0x5ae: 0x100, 0x5af: 0x100,
+	0x5b0: 0xa6, 0x5b1: 0x17a, 0x5b2: 0x17b, 0x5b3: 0x100, 0x5b4: 0x100, 0x5b5: 0x100, 0x5b6: 0x100, 0x5b7: 0x100,
+	0x5b8: 0x100, 0x5b9: 0x100, 0x5ba: 0x100, 0x5bb: 0x100, 0x5bc: 0x100, 0x5bd: 0x100, 0x5be: 0x100, 0x5bf: 0x100,
+	// Block 0x17, offset 0x5c0
+	0x5c0: 0x100, 0x5c1: 0x100, 0x5c2: 0x100, 0x5c3: 0x100, 0x5c4: 0x100, 0x5c5: 0x100, 0x5c6: 0x100, 0x5c7: 0x100,
+	0x5c8: 0x100, 0x5c9: 0x100, 0x5ca: 0x100, 0x5cb: 0x100, 0x5cc: 0x100, 0x5cd: 0x100, 0x5ce: 0x100, 0x5cf: 0x100,
+	0x5d0: 0x100, 0x5d1: 0x100, 0x5d2: 0x100, 0x5d3: 0x100, 0x5d4: 0x100, 0x5d5: 0x100, 0x5d6: 0x100, 0x5d7: 0x100,
+	0x5d8: 0x100, 0x5d9: 0x100, 0x5da: 0x100, 0x5db: 0x100, 0x5dc: 0x100, 0x5dd: 0x100, 0x5de: 0x100, 0x5df: 0x100,
+	0x5e0: 0x100, 0x5e1: 0x100, 0x5e2: 0x100, 0x5e3: 0x100, 0x5e4: 0x100, 0x5e5: 0x100, 0x5e6: 0x100, 0x5e7: 0x100,
+	0x5e8: 0x100, 0x5e9: 0x100, 0x5ea: 0x100, 0x5eb: 0x100, 0x5ec: 0x100, 0x5ed: 0x100, 0x5ee: 0x100, 0x5ef: 0x100,
+	0x5f0: 0x100, 0x5f1: 0x100, 0x5f2: 0x100, 0x5f3: 0x100, 0x5f4: 0x100, 0x5f5: 0x100, 0x5f6: 0x100, 0x5f7: 0x100,
+	0x5f8: 0x100, 0x5f9: 0x100, 0x5fa: 0x100, 0x5fb: 0x100, 0x5fc: 0x17c, 0x5fd: 0x17d, 0x5fe: 0xa2, 0x5ff: 0x17e,
+	// Block 0x18, offset 0x600
+	0x600: 0xa2, 0x601: 0xa2, 0x602: 0xa2, 0x603: 0x17f, 0x604: 0x180, 0x605: 0x181, 0x606: 0x182, 0x607: 0x183,
+	0x608: 0xa2, 0x609: 0x184, 0x60a: 0x100, 0x60b: 0x185, 0x60c: 0xa2, 0x60d: 0x186, 0x60e: 0x100, 0x60f: 0x100,
+	0x610: 0x63, 0x611: 0x64, 0x612: 0x65, 0x613: 0x66, 0x614: 0x67, 0x615: 0x68, 0x616: 0x69, 0x617: 0x6a,
+	0x618: 0x6b, 0x619: 0x6c, 0x61a: 0x6d, 0x61b: 0x6e, 0x61c: 0x6f, 0x61d: 0x70, 0x61e: 0x71, 0x61f: 0x72,
+	0x620: 0xa2, 0x621: 0xa2, 0x622: 0xa2, 0x623: 0xa2, 0x624: 0xa2, 0x625: 0xa2, 0x626: 0xa2, 0x627: 0xa2,
+	0x628: 0x187, 0x629: 0x188, 0x62a: 0x189, 0x62b: 0x100, 0x62c: 0x100, 0x62d: 0x100, 0x62e: 0x100, 0x62f: 0x100,
+	0x630: 0x100, 0x631: 0x100, 0x632: 0x100, 0x633: 0x100, 0x634: 0x100, 0x635: 0x100, 0x636: 0x100, 0x637: 0x100,
+	0x638: 0x100, 0x639: 0x100, 0x63a: 0x100, 0x63b: 0x100, 0x63c: 0x18a, 0x63d: 0x100, 0x63e: 0x100, 0x63f: 0x100,
+	// Block 0x19, offset 0x640
+	0x640: 0x73, 0x641: 0x74, 0x642: 0x18b, 0x643: 0x100, 0x644: 0x18c, 0x645: 0x18d, 0x646: 0x100, 0x647: 0x100,
+	0x648: 0x100, 0x649: 0x100, 0x64a: 0x18e, 0x64b: 0x18f, 0x64c: 0x100, 0x64d: 0x100, 0x64e: 0x100, 0x64f: 0x100,
+	0x650: 0x100, 0x651: 0x100, 0x652: 0x100, 0x653: 0x190, 0x654: 0x100, 0x655: 0x100, 0x656: 0x100, 0x657: 0x100,
+	0x658: 0x100, 0x659: 0x100, 0x65a: 0x100, 0x65b: 0x100, 0x65c: 0x100, 0x65d: 0x100, 0x65e: 0x100, 0x65f: 0x191,
+	0x660: 0x127, 0x661: 0x127, 0x662: 0x127, 0x663: 0x192, 0x664: 0x75, 0x665: 0x193, 0x666: 0x100, 0x667: 0x100,
+	0x668: 0x100, 0x669: 0x100, 0x66a: 0x100, 0x66b: 0x100, 0x66c: 0x100, 0x66d: 0x100, 0x66e: 0x100, 0x66f: 0x100,
+	0x670: 0x100, 0x671: 0x194, 0x672: 0x195, 0x673: 0x100, 0x674: 0x196, 0x675: 0x100, 0x676: 0x100, 0x677: 0x100,
+	0x678: 0x76, 0x679: 0x77, 0x67a: 0x78, 0x67b: 0x197, 0x67c: 0x100, 0x67d: 0x100, 0x67e: 0x100, 0x67f: 0x100,
+	// Block 0x1a, offset 0x680
+	0x680: 0x198, 0x681: 0xa2, 0x682: 0x199, 0x683: 0x19a, 0x684: 0x79, 0x685: 0x7a, 0x686: 0x19b, 0x687: 0x19c,
+	0x688: 0x7b, 0x689: 0x19d, 0x68a: 0x100, 0x68b: 0x100, 0x68c: 0xa2, 0x68d: 0xa2, 0x68e: 0xa2, 0x68f: 0xa2,
+	0x690: 0xa2, 0x691: 0xa2, 0x692: 0xa2, 0x693: 0xa2, 0x694: 0xa2, 0x695: 0xa2, 0x696: 0xa2, 0x697: 0xa2,
+	0x698: 0xa2, 0x699: 0xa2, 0x69a: 0xa2, 0x69b: 0x19e, 0x69c: 0xa2, 0x69d: 0x19f, 0x69e: 0xa2, 0x69f: 0x1a0,
+	0x6a0: 0x1a1, 0x6a1: 0x1a2, 0x6a2: 0x1a3, 0x6a3: 0x100, 0x6a4: 0xa2, 0x6a5: 0xa2, 0x6a6: 0xa2, 0x6a7: 0xa2,
+	0x6a8: 0xa2, 0x6a9: 0x1a4, 0x6aa: 0x1a5, 0x6ab: 0x1a6, 0x6ac: 0xa2, 0x6ad: 0xa2, 0x6ae: 0x1a7, 0x6af: 0x1a8,
+	0x6b0: 0x100, 0x6b1: 0x100, 0x6b2: 0x100, 0x6b3: 0x100, 0x6b4: 0x100, 0x6b5: 0x100, 0x6b6: 0x100, 0x6b7: 0x100,
+	0x6b8: 0x100, 0x6b9: 0x100, 0x6ba: 0x100, 0x6bb: 0x100, 0x6bc: 0x100, 0x6bd: 0x100, 0x6be: 0x100, 0x6bf: 0x100,
+	// Block 0x1b, offset 0x6c0
+	0x6c0: 0xa6, 0x6c1: 0xa6, 0x6c2: 0xa6, 0x6c3: 0xa6, 0x6c4: 0xa6, 0x6c5: 0xa6, 0x6c6: 0xa6, 0x6c7: 0xa6,
+	0x6c8: 0xa6, 0x6c9: 0xa6, 0x6ca: 0xa6, 0x6cb: 0xa6, 0x6cc: 0xa6, 0x6cd: 0xa6, 0x6ce: 0xa6, 0x6cf: 0xa6,
+	0x6d0: 0xa6, 0x6d1: 0xa6, 0x6d2: 0xa6, 0x6d3: 0xa6, 0x6d4: 0xa6, 0x6d5: 0xa6, 0x6d6: 0xa6, 0x6d7: 0xa6,
+	0x6d8: 0xa6, 0x6d9: 0xa6, 0x6da: 0xa6, 0x6db: 0x1a9, 0x6dc: 0xa6, 0x6dd: 0xa6, 0x6de: 0xa6, 0x6df: 0xa6,
+	0x6e0: 0xa6, 0x6e1: 0xa6, 0x6e2: 0xa6, 0x6e3: 0xa6, 0x6e4: 0xa6, 0x6e5: 0xa6, 0x6e6: 0xa6, 0x6e7: 0xa6,
+	0x6e8: 0xa6, 0x6e9: 0xa6, 0x6ea: 0xa6, 0x6eb: 0xa6, 0x6ec: 0xa6, 0x6ed: 0xa6, 0x6ee: 0xa6, 0x6ef: 0xa6,
+	0x6f0: 0xa6, 0x6f1: 0xa6, 0x6f2: 0xa6, 0x6f3: 0xa6, 0x6f4: 0xa6, 0x6f5: 0xa6, 0x6f6: 0xa6, 0x6f7: 0xa6,
+	0x6f8: 0xa6, 0x6f9: 0xa6, 0x6fa: 0xa6, 0x6fb: 0xa6, 0x6fc: 0xa6, 0x6fd: 0xa6, 0x6fe: 0xa6, 0x6ff: 0xa6,
+	// Block 0x1c, offset 0x700
+	0x700: 0xa6, 0x701: 0xa6, 0x702: 0xa6, 0x703: 0xa6, 0x704: 0xa6, 0x705: 0xa6, 0x706: 0xa6, 0x707: 0xa6,
+	0x708: 0xa6, 0x709: 0xa6, 0x70a: 0xa6, 0x70b: 0xa6, 0x70c: 0xa6, 0x70d: 0xa6, 0x70e: 0xa6, 0x70f: 0xa6,
+	0x710: 0xa6, 0x711: 0xa6, 0x712: 0xa6, 0x713: 0xa6, 0x714: 0xa6, 0x715: 0xa6, 0x716: 0xa6, 0x717: 0xa6,
+	0x718: 0xa6, 0x719: 0xa6, 0x71a: 0xa6, 0x71b: 0xa6, 0x71c: 0x1aa, 0x71d: 0xa6, 0x71e: 0xa6, 0x71f: 0xa6,
+	0x720: 0x1ab, 0x721: 0xa6, 0x722: 0xa6, 0x723: 0xa6, 0x724: 0xa6, 0x725: 0xa6, 0x726: 0xa6, 0x727: 0xa6,
+	0x728: 0xa6, 0x729: 0xa6, 0x72a: 0xa6, 0x72b: 0xa6, 0x72c: 0xa6, 0x72d: 0xa6, 0x72e: 0xa6, 0x72f: 0xa6,
+	0x730: 0xa6, 0x731: 0xa6, 0x732: 0xa6, 0x733: 0xa6, 0x734: 0xa6, 0x735: 0xa6, 0x736: 0xa6, 0x737: 0xa6,
+	0x738: 0xa6, 0x739: 0xa6, 0x73a: 0xa6, 0x73b: 0xa6, 0x73c: 0xa6, 0x73d: 0xa6, 0x73e: 0xa6, 0x73f: 0xa6,
+	// Block 0x1d, offset 0x740
+	0x740: 0xa6, 0x741: 0xa6, 0x742: 0xa6, 0x743: 0xa6, 0x744: 0xa6, 0x745: 0xa6, 0x746: 0xa6, 0x747: 0xa6,
+	0x748: 0xa6, 0x749: 0xa6, 0x74a: 0xa6, 0x74b: 0xa6, 0x74c: 0xa6, 0x74d: 0xa6, 0x74e: 0xa6, 0x74f: 0xa6,
+	0x750: 0xa6, 0x751: 0xa6, 0x752: 0xa6, 0x753: 0xa6, 0x754: 0xa6, 0x755: 0xa6, 0x756: 0xa6, 0x757: 0xa6,
+	0x758: 0xa6, 0x759: 0xa6, 0x75a: 0xa6, 0x75b: 0xa6, 0x75c: 0xa6, 0x75d: 0xa6, 0x75e: 0xa6, 0x75f: 0xa6,
+	0x760: 0xa6, 0x761: 0xa6, 0x762: 0xa6, 0x763: 0xa6, 0x764: 0xa6, 0x765: 0xa6, 0x766: 0xa6, 0x767: 0xa6,
+	0x768: 0xa6, 0x769: 0xa6, 0x76a: 0xa6, 0x76b: 0xa6, 0x76c: 0xa6, 0x76d: 0xa6, 0x76e: 0xa6, 0x76f: 0xa6,
+	0x770: 0xa6, 0x771: 0xa6, 0x772: 0xa6, 0x773: 0xa6, 0x774: 0xa6, 0x775: 0xa6, 0x776: 0xa6, 0x777: 0xa6,
+	0x778: 0xa6, 0x779: 0xa6, 0x77a: 0x1ac, 0x77b: 0xa6, 0x77c: 0xa6, 0x77d: 0xa6, 0x77e: 0xa6, 0x77f: 0xa6,
+	// Block 0x1e, offset 0x780
+	0x780: 0xa6, 0x781: 0xa6, 0x782: 0xa6, 0x783: 0xa6, 0x784: 0xa6, 0x785: 0xa6, 0x786: 0xa6, 0x787: 0xa6,
+	0x788: 0xa6, 0x789: 0xa6, 0x78a: 0xa6, 0x78b: 0xa6, 0x78c: 0xa6, 0x78d: 0xa6, 0x78e: 0xa6, 0x78f: 0xa6,
+	0x790: 0xa6, 0x791: 0xa6, 0x792: 0xa6, 0x793: 0xa6, 0x794: 0xa6, 0x795: 0xa6, 0x796: 0xa6, 0x797: 0xa6,
+	0x798: 0xa6, 0x799: 0xa6, 0x79a: 0xa6, 0x79b: 0xa6, 0x79c: 0xa6, 0x79d: 0xa6, 0x79e: 0xa6, 0x79f: 0xa6,
+	0x7a0: 0xa6, 0x7a1: 0xa6, 0x7a2: 0xa6, 0x7a3: 0xa6, 0x7a4: 0xa6, 0x7a5: 0xa6, 0x7a6: 0xa6, 0x7a7: 0xa6,
+	0x7a8: 0xa6, 0x7a9: 0xa6, 0x7aa: 0xa6, 0x7ab: 0xa6, 0x7ac: 0xa6, 0x7ad: 0xa6, 0x7ae: 0xa6, 0x7af: 0x1ad,
+	0x7b0: 0x100, 0x7b1: 0x100, 0x7b2: 0x100, 0x7b3: 0x100, 0x7b4: 0x100, 0x7b5: 0x100, 0x7b6: 0x100, 0x7b7: 0x100,
+	0x7b8: 0x100, 0x7b9: 0x100, 0x7ba: 0x100, 0x7bb: 0x100, 0x7bc: 0x100, 0x7bd: 0x100, 0x7be: 0x100, 0x7bf: 0x100,
+	// Block 0x1f, offset 0x7c0
+	0x7c0: 0x100, 0x7c1: 0x100, 0x7c2: 0x100, 0x7c3: 0x100, 0x7c4: 0x100, 0x7c5: 0x100, 0x7c6: 0x100, 0x7c7: 0x100,
+	0x7c8: 0x100, 0x7c9: 0x100, 0x7ca: 0x100, 0x7cb: 0x100, 0x7cc: 0x100, 0x7cd: 0x100, 0x7ce: 0x100, 0x7cf: 0x100,
+	0x7d0: 0x100, 0x7d1: 0x100, 0x7d2: 0x100, 0x7d3: 0x100, 0x7d4: 0x100, 0x7d5: 0x100, 0x7d6: 0x100, 0x7d7: 0x100,
+	0x7d8: 0x100, 0x7d9: 0x100, 0x7da: 0x100, 0x7db: 0x100, 0x7dc: 0x100, 0x7dd: 0x100, 0x7de: 0x100, 0x7df: 0x100,
+	0x7e0: 0x7c, 0x7e1: 0x7d, 0x7e2: 0x7e, 0x7e3: 0x7f, 0x7e4: 0x80, 0x7e5: 0x81, 0x7e6: 0x82, 0x7e7: 0x83,
+	0x7e8: 0x84, 0x7e9: 0x100, 0x7ea: 0x100, 0x7eb: 0x100, 0x7ec: 0x100, 0x7ed: 0x100, 0x7ee: 0x100, 0x7ef: 0x100,
+	0x7f0: 0x100, 0x7f1: 0x100, 0x7f2: 0x100, 0x7f3: 0x100, 0x7f4: 0x100, 0x7f5: 0x100, 0x7f6: 0x100, 0x7f7: 0x100,
+	0x7f8: 0x100, 0x7f9: 0x100, 0x7fa: 0x100, 0x7fb: 0x100, 0x7fc: 0x100, 0x7fd: 0x100, 0x7fe: 0x100, 0x7ff: 0x100,
+	// Block 0x20, offset 0x800
+	0x800: 0xa6, 0x801: 0xa6, 0x802: 0xa6, 0x803: 0xa6, 0x804: 0xa6, 0x805: 0xa6, 0x806: 0xa6, 0x807: 0xa6,
+	0x808: 0xa6, 0x809: 0xa6, 0x80a: 0xa6, 0x80b: 0xa6, 0x80c: 0xa6, 0x80d: 0x1ae, 0x80e: 0xa6, 0x80f: 0xa6,
+	0x810: 0xa6, 0x811: 0xa6, 0x812: 0xa6, 0x813: 0xa6, 0x814: 0xa6, 0x815: 0xa6, 0x816: 0xa6, 0x817: 0xa6,
+	0x818: 0xa6, 0x819: 0xa6, 0x81a: 0xa6, 0x81b: 0xa6, 0x81c: 0xa6, 0x81d: 0xa6, 0x81e: 0xa6, 0x81f: 0xa6,
+	0x820: 0xa6, 0x821: 0xa6, 0x822: 0xa6, 0x823: 0xa6, 0x824: 0xa6, 0x825: 0xa6, 0x826: 0xa6, 0x827: 0xa6,
+	0x828: 0xa6, 0x829: 0xa6, 0x82a: 0xa6, 0x82b: 0xa6, 0x82c: 0xa6, 0x82d: 0xa6, 0x82e: 0xa6, 0x82f: 0xa6,
+	0x830: 0xa6, 0x831: 0xa6, 0x832: 0xa6, 0x833: 0xa6, 0x834: 0xa6, 0x835: 0xa6, 0x836: 0xa6, 0x837: 0xa6,
+	0x838: 0xa6, 0x839: 0xa6, 0x83a: 0xa6, 0x83b: 0xa6, 0x83c: 0xa6, 0x83d: 0xa6, 0x83e: 0xa6, 0x83f: 0xa6,
+	// Block 0x21, offset 0x840
+	0x840: 0xa6, 0x841: 0xa6, 0x842: 0xa6, 0x843: 0xa6, 0x844: 0xa6, 0x845: 0xa6, 0x846: 0xa6, 0x847: 0xa6,
+	0x848: 0xa6, 0x849: 0xa6, 0x84a: 0xa6, 0x84b: 0xa6, 0x84c: 0xa6, 0x84d: 0xa6, 0x84e: 0x1af, 0x84f: 0x100,
+	0x850: 0x100, 0x851: 0x100, 0x852: 0x100, 0x853: 0x100, 0x854: 0x100, 0x855: 0x100, 0x856: 0x100, 0x857: 0x100,
+	0x858: 0x100, 0x859: 0x100, 0x85a: 0x100, 0x85b: 0x100, 0x85c: 0x100, 0x85d: 0x100, 0x85e: 0x100, 0x85f: 0x100,
+	0x860: 0x100, 0x861: 0x100, 0x862: 0x100, 0x863: 0x100, 0x864: 0x100, 0x865: 0x100, 0x866: 0x100, 0x867: 0x100,
+	0x868: 0x100, 0x869: 0x100, 0x86a: 0x100, 0x86b: 0x100, 0x86c: 0x100, 0x86d: 0x100, 0x86e: 0x100, 0x86f: 0x100,
+	0x870: 0x100, 0x871: 0x100, 0x872: 0x100, 0x873: 0x100, 0x874: 0x100, 0x875: 0x100, 0x876: 0x100, 0x877: 0x100,
+	0x878: 0x100, 0x879: 0x100, 0x87a: 0x100, 0x87b: 0x100, 0x87c: 0x100, 0x87d: 0x100, 0x87e: 0x100, 0x87f: 0x100,
+	// Block 0x22, offset 0x880
+	0x890: 0x0c, 0x891: 0x0d, 0x892: 0x0e, 0x893: 0x0f, 0x894: 0x10, 0x895: 0x0a, 0x896: 0x11, 0x897: 0x07,
+	0x898: 0x12, 0x899: 0x0a, 0x89a: 0x13, 0x89b: 0x14, 0x89c: 0x15, 0x89d: 0x16, 0x89e: 0x17, 0x89f: 0x18,
+	0x8a0: 0x07, 0x8a1: 0x07, 0x8a2: 0x07, 0x8a3: 0x07, 0x8a4: 0x07, 0x8a5: 0x07, 0x8a6: 0x07, 0x8a7: 0x07,
+	0x8a8: 0x07, 0x8a9: 0x07, 0x8aa: 0x19, 0x8ab: 0x1a, 0x8ac: 0x1b, 0x8ad: 0x07, 0x8ae: 0x1c, 0x8af: 0x1d,
+	0x8b0: 0x07, 0x8b1: 0x1e, 0x8b2: 0x1f, 0x8b3: 0x0a, 0x8b4: 0x0a, 0x8b5: 0x0a, 0x8b6: 0x0a, 0x8b7: 0x0a,
+	0x8b8: 0x0a, 0x8b9: 0x0a, 0x8ba: 0x0a, 0x8bb: 0x0a, 0x8bc: 0x0a, 0x8bd: 0x0a, 0x8be: 0x0a, 0x8bf: 0x0a,
+	// Block 0x23, offset 0x8c0
+	0x8c0: 0x0a, 0x8c1: 0x0a, 0x8c2: 0x0a, 0x8c3: 0x0a, 0x8c4: 0x0a, 0x8c5: 0x0a, 0x8c6: 0x0a, 0x8c7: 0x0a,
+	0x8c8: 0x0a, 0x8c9: 0x0a, 0x8ca: 0x0a, 0x8cb: 0x0a, 0x8cc: 0x0a, 0x8cd: 0x0a, 0x8ce: 0x0a, 0x8cf: 0x0a,
+	0x8d0: 0x0a, 0x8d1: 0x0a, 0x8d2: 0x0a, 0x8d3: 0x0a, 0x8d4: 0x0a, 0x8d5: 0x0a, 0x8d6: 0x0a, 0x8d7: 0x0a,
+	0x8d8: 0x0a, 0x8d9: 0x0a, 0x8da: 0x0a, 0x8db: 0x0a, 0x8dc: 0x0a, 0x8dd: 0x0a, 0x8de: 0x0a, 0x8df: 0x0a,
+	0x8e0: 0x0a, 0x8e1: 0x0a, 0x8e2: 0x0a, 0x8e3: 0x0a, 0x8e4: 0x0a, 0x8e5: 0x0a, 0x8e6: 0x0a, 0x8e7: 0x0a,
+	0x8e8: 0x0a, 0x8e9: 0x0a, 0x8ea: 0x0a, 0x8eb: 0x0a, 0x8ec: 0x0a, 0x8ed: 0x0a, 0x8ee: 0x0a, 0x8ef: 0x0a,
+	0x8f0: 0x0a, 0x8f1: 0x0a, 0x8f2: 0x0a, 0x8f3: 0x0a, 0x8f4: 0x0a, 0x8f5: 0x0a, 0x8f6: 0x0a, 0x8f7: 0x0a,
+	0x8f8: 0x0a, 0x8f9: 0x0a, 0x8fa: 0x0a, 0x8fb: 0x0a, 0x8fc: 0x0a, 0x8fd: 0x0a, 0x8fe: 0x0a, 0x8ff: 0x0a,
+	// Block 0x24, offset 0x900
+	0x900: 0x1b0, 0x901: 0x1b1, 0x902: 0x100, 0x903: 0x100, 0x904: 0x1b2, 0x905: 0x1b2, 0x906: 0x1b2, 0x907: 0x1b3,
+	0x908: 0x100, 0x909: 0x100, 0x90a: 0x100, 0x90b: 0x100, 0x90c: 0x100, 0x90d: 0x100, 0x90e: 0x100, 0x90f: 0x100,
+	0x910: 0x100, 0x911: 0x100, 0x912: 0x100, 0x913: 0x100, 0x914: 0x100, 0x915: 0x100, 0x916: 0x100, 0x917: 0x100,
+	0x918: 0x100, 0x919: 0x100, 0x91a: 0x100, 0x91b: 0x100, 0x91c: 0x100, 0x91d: 0x100, 0x91e: 0x100, 0x91f: 0x100,
+	0x920: 0x100, 0x921: 0x100, 0x922: 0x100, 0x923: 0x100, 0x924: 0x100, 0x925: 0x100, 0x926: 0x100, 0x927: 0x100,
+	0x928: 0x100, 0x929: 0x100, 0x92a: 0x100, 0x92b: 0x100, 0x92c: 0x100, 0x92d: 0x100, 0x92e: 0x100, 0x92f: 0x100,
+	0x930: 0x100, 0x931: 0x100, 0x932: 0x100, 0x933: 0x100, 0x934: 0x100, 0x935: 0x100, 0x936: 0x100, 0x937: 0x100,
+	0x938: 0x100, 0x939: 0x100, 0x93a: 0x100, 0x93b: 0x100, 0x93c: 0x100, 0x93d: 0x100, 0x93e: 0x100, 0x93f: 0x100,
+	// Block 0x25, offset 0x940
+	0x940: 0x0a, 0x941: 0x0a, 0x942: 0x0a, 0x943: 0x0a, 0x944: 0x0a, 0x945: 0x0a, 0x946: 0x0a, 0x947: 0x0a,
+	0x948: 0x0a, 0x949: 0x0a, 0x94a: 0x0a, 0x94b: 0x0a, 0x94c: 0x0a, 0x94d: 0x0a, 0x94e: 0x0a, 0x94f: 0x0a,
+	0x950: 0x0a, 0x951: 0x0a, 0x952: 0x0a, 0x953: 0x0a, 0x954: 0x0a, 0x955: 0x0a, 0x956: 0x0a, 0x957: 0x0a,
+	0x958: 0x0a, 0x959: 0x0a, 0x95a: 0x0a, 0x95b: 0x0a, 0x95c: 0x0a, 0x95d: 0x0a, 0x95e: 0x0a, 0x95f: 0x0a,
+	0x960: 0x22, 0x961: 0x0a, 0x962: 0x0a, 0x963: 0x0a, 0x964: 0x0a, 0x965: 0x0a, 0x966: 0x0a, 0x967: 0x0a,
+	0x968: 0x0a, 0x969: 0x0a, 0x96a: 0x0a, 0x96b: 0x0a, 0x96c: 0x0a, 0x96d: 0x0a, 0x96e: 0x0a, 0x96f: 0x0a,
+	0x970: 0x0a, 0x971: 0x0a, 0x972: 0x0a, 0x973: 0x0a, 0x974: 0x0a, 0x975: 0x0a, 0x976: 0x0a, 0x977: 0x0a,
+	0x978: 0x0a, 0x979: 0x0a, 0x97a: 0x0a, 0x97b: 0x0a, 0x97c: 0x0a, 0x97d: 0x0a, 0x97e: 0x0a, 0x97f: 0x0a,
+	// Block 0x26, offset 0x980
+	0x980: 0x0a, 0x981: 0x0a, 0x982: 0x0a, 0x983: 0x0a, 0x984: 0x0a, 0x985: 0x0a, 0x986: 0x0a, 0x987: 0x0a,
+	0x988: 0x0a, 0x989: 0x0a, 0x98a: 0x0a, 0x98b: 0x0a, 0x98c: 0x0a, 0x98d: 0x0a, 0x98e: 0x0a, 0x98f: 0x0a,
+}
+
+// idnaSparseOffset: 303 entries, 606 bytes
+var idnaSparseOffset = []uint16{0x0, 0x8, 0x19, 0x25, 0x27, 0x2c, 0x33, 0x3e, 0x4a, 0x4e, 0x5d, 0x62, 0x6c, 0x78, 0x7e, 0x87, 0x97, 0xa6, 0xb1, 0xbe, 0xcf, 0xd9, 0xe0, 0xed, 0xfe, 0x105, 0x110, 0x11f, 0x12d, 0x137, 0x139, 0x13e, 0x141, 0x144, 0x146, 0x152, 0x15d, 0x165, 0x16b, 0x171, 0x176, 0x17b, 0x17e, 0x182, 0x188, 0x18d, 0x198, 0x1a2, 0x1a8, 0x1b9, 0x1c4, 0x1c7, 0x1cf, 0x1d2, 0x1df, 0x1e7, 0x1eb, 0x1f2, 0x1fa, 0x20a, 0x216, 0x219, 0x223, 0x22f, 0x23b, 0x247, 0x24f, 0x254, 0x261, 0x272, 0x27d, 0x282, 0x28b, 0x293, 0x299, 0x29e, 0x2a1, 0x2a5, 0x2ab, 0x2af, 0x2b3, 0x2b7, 0x2bc, 0x2c4, 0x2cb, 0x2d6, 0x2e0, 0x2e4, 0x2e7, 0x2ed, 0x2f1, 0x2f3, 0x2f6, 0x2f8, 0x2fb, 0x305, 0x308, 0x317, 0x31b, 0x31f, 0x321, 0x32a, 0x32e, 0x333, 0x338, 0x33e, 0x34e, 0x354, 0x358, 0x367, 0x36c, 0x374, 0x37e, 0x389, 0x391, 0x3a2, 0x3ab, 0x3bb, 0x3c8, 0x3d4, 0x3d9, 0x3e6, 0x3ea, 0x3ef, 0x3f1, 0x3f3, 0x3f7, 0x3f9, 0x3fd, 0x406, 0x40c, 0x410, 0x420, 0x42a, 0x42f, 0x432, 0x438, 0x43f, 0x444, 0x448, 0x44e, 0x453, 0x45c, 0x461, 0x467, 0x46e, 0x475, 0x47c, 0x480, 0x483, 0x488, 0x494, 0x49a, 0x49f, 0x4a6, 0x4ae, 0x4b3, 0x4b7, 0x4c7, 0x4ce, 0x4d2, 0x4d6, 0x4dd, 0x4df, 0x4e2, 0x4e5, 0x4e9, 0x4f2, 0x4f6, 0x4fe, 0x501, 0x509, 0x514, 0x523, 0x52f, 0x535, 0x542, 0x54e, 0x556, 0x55f, 0x56a, 0x571, 0x580, 0x58d, 0x591, 0x59e, 0x5a7, 0x5ab, 0x5ba, 0x5c2, 0x5cd, 0x5d6, 0x5dc, 0x5e4, 0x5ed, 0x5f9, 0x5fc, 0x608, 0x60b, 0x614, 0x617, 0x61c, 0x625, 0x62a, 0x637, 0x642, 0x64b, 0x656, 0x659, 0x65c, 0x666, 0x66f, 0x67b, 0x688, 0x695, 0x6a3, 0x6aa, 0x6b5, 0x6bc, 0x6c0, 0x6c4, 0x6c7, 0x6cc, 0x6cf, 0x6d2, 0x6d6, 0x6d9, 0x6de, 0x6e5, 0x6e8, 0x6f0, 0x6f4, 0x6ff, 0x702, 0x705, 0x708, 0x70e, 0x714, 0x71d, 0x720, 0x723, 0x726, 0x72e, 0x733, 0x73c, 0x73f, 0x744, 0x74e, 0x752, 0x756, 0x759, 0x75c, 0x760, 0x76f, 0x77b, 0x77f, 0x784, 0x789, 0x78e, 0x792, 0x797, 0x7a0, 0x7a5, 0x7a9, 0x7af, 0x7b5, 0x7ba, 0x7c0, 0x7c6, 0x7d0, 0x7d6, 0x7df, 0x7e2, 0x7e5, 0x7e9, 0x7ed, 0x7f1, 0x7f7, 0x7fd, 0x802, 0x805, 0x815, 0x81c, 0x820, 0x827, 0x82b, 0x831, 0x838, 0x83f, 0x845, 0x84e, 0x852, 0x860, 0x863, 0x866, 0x86a, 0x86e, 0x871, 0x875, 0x878, 0x87d, 0x87f, 0x881}
+
+// idnaSparseValues: 2180 entries, 8720 bytes
+var idnaSparseValues = [2180]valueRange{
+	// Block 0x0, offset 0x0
+	{value: 0x0000, lo: 0x07},
+	{value: 0xe105, lo: 0x80, hi: 0x96},
+	{value: 0x0018, lo: 0x97, hi: 0x97},
+	{value: 0xe105, lo: 0x98, hi: 0x9e},
+	{value: 0x001f, lo: 0x9f, hi: 0x9f},
+	{value: 0x0008, lo: 0xa0, hi: 0xb6},
+	{value: 0x0018, lo: 0xb7, hi: 0xb7},
+	{value: 0x0008, lo: 0xb8, hi: 0xbf},
+	// Block 0x1, offset 0x8
+	{value: 0x0000, lo: 0x10},
+	{value: 0x0008, lo: 0x80, hi: 0x80},
+	{value: 0xe01d, lo: 0x81, hi: 0x81},
+	{value: 0x0008, lo: 0x82, hi: 0x82},
+	{value: 0x0335, lo: 0x83, hi: 0x83},
+	{value: 0x034d, lo: 0x84, hi: 0x84},
+	{value: 0x0365, lo: 0x85, hi: 0x85},
+	{value: 0xe00d, lo: 0x86, hi: 0x86},
+	{value: 0x0008, lo: 0x87, hi: 0x87},
+	{value: 0xe00d, lo: 0x88, hi: 0x88},
+	{value: 0x0008, lo: 0x89, hi: 0x89},
+	{value: 0xe00d, lo: 0x8a, hi: 0x8a},
+	{value: 0x0008, lo: 0x8b, hi: 0x8b},
+	{value: 0xe00d, lo: 0x8c, hi: 0x8c},
+	{value: 0x0008, lo: 0x8d, hi: 0x8d},
+	{value: 0xe00d, lo: 0x8e, hi: 0x8e},
+	{value: 0x0008, lo: 0x8f, hi: 0xbf},
+	// Block 0x2, offset 0x19
+	{value: 0x0000, lo: 0x0b},
+	{value: 0x0008, lo: 0x80, hi: 0xaf},
+	{value: 0x00a9, lo: 0xb0, hi: 0xb0},
+	{value: 0x037d, lo: 0xb1, hi: 0xb1},
+	{value: 0x00b1, lo: 0xb2, hi: 0xb2},
+	{value: 0x00b9, lo: 0xb3, hi: 0xb3},
+	{value: 0x034d, lo: 0xb4, hi: 0xb4},
+	{value: 0x0395, lo: 0xb5, hi: 0xb5},
+	{value: 0xe1bd, lo: 0xb6, hi: 0xb6},
+	{value: 0x00c1, lo: 0xb7, hi: 0xb7},
+	{value: 0x00c9, lo: 0xb8, hi: 0xb8},
+	{value: 0x0008, lo: 0xb9, hi: 0xbf},
+	// Block 0x3, offset 0x25
+	{value: 0x0000, lo: 0x01},
+	{value: 0x3308, lo: 0x80, hi: 0xbf},
+	// Block 0x4, offset 0x27
+	{value: 0x0000, lo: 0x04},
+	{value: 0x03f5, lo: 0x80, hi: 0x8f},
+	{value: 0xe105, lo: 0x90, hi: 0x9f},
+	{value: 0x049d, lo: 0xa0, hi: 0xaf},
+	{value: 0x0008, lo: 0xb0, hi: 0xbf},
+	// Block 0x5, offset 0x2c
+	{value: 0x0000, lo: 0x06},
+	{value: 0xe185, lo: 0x80, hi: 0x8f},
+	{value: 0x0545, lo: 0x90, hi: 0x96},
+	{value: 0x0040, lo: 0x97, hi: 0x98},
+	{value: 0x0008, lo: 0x99, hi: 0x99},
+	{value: 0x0018, lo: 0x9a, hi: 0x9f},
+	{value: 0x0008, lo: 0xa0, hi: 0xbf},
+	// Block 0x6, offset 0x33
+	{value: 0x0000, lo: 0x0a},
+	{value: 0x0008, lo: 0x80, hi: 0x86},
+	{value: 0x0131, lo: 0x87, hi: 0x87},
+	{value: 0x0008, lo: 0x88, hi: 0x88},
+	{value: 0x0018, lo: 0x89, hi: 0x8a},
+	{value: 0x0040, lo: 0x8b, hi: 0x8c},
+	{value: 0x0018, lo: 0x8d, hi: 0x8f},
+	{value: 0x0040, lo: 0x90, hi: 0x90},
+	{value: 0x3308, lo: 0x91, hi: 0xbd},
+	{value: 0x0818, lo: 0xbe, hi: 0xbe},
+	{value: 0x3308, lo: 0xbf, hi: 0xbf},
+	// Block 0x7, offset 0x3e
+	{value: 0x0000, lo: 0x0b},
+	{value: 0x0818, lo: 0x80, hi: 0x80},
+	{value: 0x3308, lo: 0x81, hi: 0x82},
+	{value: 0x0818, lo: 0x83, hi: 0x83},
+	{value: 0x3308, lo: 0x84, hi: 0x85},
+	{value: 0x0818, lo: 0x86, hi: 0x86},
+	{value: 0x3308, lo: 0x87, hi: 0x87},
+	{value: 0x0040, lo: 0x88, hi: 0x8f},
+	{value: 0x0808, lo: 0x90, hi: 0xaa},
+	{value: 0x0040, lo: 0xab, hi: 0xae},
+	{value: 0x0808, lo: 0xaf, hi: 0xb4},
+	{value: 0x0040, lo: 0xb5, hi: 0xbf},
+	// Block 0x8, offset 0x4a
+	{value: 0x0000, lo: 0x03},
+	{value: 0x0a08, lo: 0x80, hi: 0x87},
+	{value: 0x0c08, lo: 0x88, hi: 0x99},
+	{value: 0x0a08, lo: 0x9a, hi: 0xbf},
+	// Block 0x9, offset 0x4e
+	{value: 0x0000, lo: 0x0e},
+	{value: 0x3308, lo: 0x80, hi: 0x8a},
+	{value: 0x0040, lo: 0x8b, hi: 0x8c},
+	{value: 0x0c08, lo: 0x8d, hi: 0x8d},
+	{value: 0x0a08, lo: 0x8e, hi: 0x98},
+	{value: 0x0c08, lo: 0x99, hi: 0x9b},
+	{value: 0x0a08, lo: 0x9c, hi: 0xaa},
+	{value: 0x0c08, lo: 0xab, hi: 0xac},
+	{value: 0x0a08, lo: 0xad, hi: 0xb0},
+	{value: 0x0c08, lo: 0xb1, hi: 0xb1},
+	{value: 0x0a08, lo: 0xb2, hi: 0xb2},
+	{value: 0x0c08, lo: 0xb3, hi: 0xb4},
+	{value: 0x0a08, lo: 0xb5, hi: 0xb7},
+	{value: 0x0c08, lo: 0xb8, hi: 0xb9},
+	{value: 0x0a08, lo: 0xba, hi: 0xbf},
+	// Block 0xa, offset 0x5d
+	{value: 0x0000, lo: 0x04},
+	{value: 0x0808, lo: 0x80, hi: 0xa5},
+	{value: 0x3308, lo: 0xa6, hi: 0xb0},
+	{value: 0x0808, lo: 0xb1, hi: 0xb1},
+	{value: 0x0040, lo: 0xb2, hi: 0xbf},
+	// Block 0xb, offset 0x62
+	{value: 0x0000, lo: 0x09},
+	{value: 0x0808, lo: 0x80, hi: 0x89},
+	{value: 0x0a08, lo: 0x8a, hi: 0xaa},
+	{value: 0x3308, lo: 0xab, hi: 0xb3},
+	{value: 0x0808, lo: 0xb4, hi: 0xb5},
+	{value: 0x0018, lo: 0xb6, hi: 0xb9},
+	{value: 0x0818, lo: 0xba, hi: 0xba},
+	{value: 0x0040, lo: 0xbb, hi: 0xbc},
+	{value: 0x3308, lo: 0xbd, hi: 0xbd},
+	{value: 0x0818, lo: 0xbe, hi: 0xbf},
+	// Block 0xc, offset 0x6c
+	{value: 0x0000, lo: 0x0b},
+	{value: 0x0808, lo: 0x80, hi: 0x95},
+	{value: 0x3308, lo: 0x96, hi: 0x99},
+	{value: 0x0808, lo: 0x9a, hi: 0x9a},
+	{value: 0x3308, lo: 0x9b, hi: 0xa3},
+	{value: 0x0808, lo: 0xa4, hi: 0xa4},
+	{value: 0x3308, lo: 0xa5, hi: 0xa7},
+	{value: 0x0808, lo: 0xa8, hi: 0xa8},
+	{value: 0x3308, lo: 0xa9, hi: 0xad},
+	{value: 0x0040, lo: 0xae, hi: 0xaf},
+	{value: 0x0818, lo: 0xb0, hi: 0xbe},
+	{value: 0x0040, lo: 0xbf, hi: 0xbf},
+	// Block 0xd, offset 0x78
+	{value: 0x0000, lo: 0x05},
+	{value: 0x0a08, lo: 0x80, hi: 0x88},
+	{value: 0x0808, lo: 0x89, hi: 0x89},
+	{value: 0x3308, lo: 0x8a, hi: 0xa1},
+	{value: 0x0840, lo: 0xa2, hi: 0xa2},
+	{value: 0x3308, lo: 0xa3, hi: 0xbf},
+	// Block 0xe, offset 0x7e
+	{value: 0x0000, lo: 0x08},
+	{value: 0x3308, lo: 0x80, hi: 0x82},
+	{value: 0x3008, lo: 0x83, hi: 0x83},
+	{value: 0x0008, lo: 0x84, hi: 0xb9},
+	{value: 0x3308, lo: 0xba, hi: 0xba},
+	{value: 0x3008, lo: 0xbb, hi: 0xbb},
+	{value: 0x3308, lo: 0xbc, hi: 0xbc},
+	{value: 0x0008, lo: 0xbd, hi: 0xbd},
+	{value: 0x3008, lo: 0xbe, hi: 0xbf},
+	// Block 0xf, offset 0x87
+	{value: 0x0000, lo: 0x0f},
+	{value: 0x3308, lo: 0x80, hi: 0x80},
+	{value: 0x3008, lo: 0x81, hi: 0x82},
+	{value: 0x0040, lo: 0x83, hi: 0x85},
+	{value: 0x3008, lo: 0x86, hi: 0x88},
+	{value: 0x0040, lo: 0x89, hi: 0x89},
+	{value: 0x3008, lo: 0x8a, hi: 0x8c},
+	{value: 0x3b08, lo: 0x8d, hi: 0x8d},
+	{value: 0x0040, lo: 0x8e, hi: 0x8f},
+	{value: 0x0008, lo: 0x90, hi: 0x90},
+	{value: 0x0040, lo: 0x91, hi: 0x96},
+	{value: 0x3008, lo: 0x97, hi: 0x97},
+	{value: 0x0040, lo: 0x98, hi: 0xa5},
+	{value: 0x0008, lo: 0xa6, hi: 0xaf},
+	{value: 0x0018, lo: 0xb0, hi: 0xba},
+	{value: 0x0040, lo: 0xbb, hi: 0xbf},
+	// Block 0x10, offset 0x97
+	{value: 0x0000, lo: 0x0e},
+	{value: 0x3308, lo: 0x80, hi: 0x80},
+	{value: 0x3008, lo: 0x81, hi: 0x83},
+	{value: 0x3308, lo: 0x84, hi: 0x84},
+	{value: 0x0008, lo: 0x85, hi: 0x8c},
+	{value: 0x0040, lo: 0x8d, hi: 0x8d},
+	{value: 0x0008, lo: 0x8e, hi: 0x90},
+	{value: 0x0040, lo: 0x91, hi: 0x91},
+	{value: 0x0008, lo: 0x92, hi: 0xa8},
+	{value: 0x0040, lo: 0xa9, hi: 0xa9},
+	{value: 0x0008, lo: 0xaa, hi: 0xb9},
+	{value: 0x0040, lo: 0xba, hi: 0xbb},
+	{value: 0x3308, lo: 0xbc, hi: 0xbc},
+	{value: 0x0008, lo: 0xbd, hi: 0xbd},
+	{value: 0x3308, lo: 0xbe, hi: 0xbf},
+	// Block 0x11, offset 0xa6
+	{value: 0x0000, lo: 0x0a},
+	{value: 0x3308, lo: 0x80, hi: 0x81},
+	{value: 0x3008, lo: 0x82, hi: 0x83},
+	{value: 0x0008, lo: 0x84, hi: 0x8c},
+	{value: 0x0040, lo: 0x8d, hi: 0x8d},
+	{value: 0x0008, lo: 0x8e, hi: 0x90},
+	{value: 0x0040, lo: 0x91, hi: 0x91},
+	{value: 0x0008, lo: 0x92, hi: 0xba},
+	{value: 0x3b08, lo: 0xbb, hi: 0xbc},
+	{value: 0x0008, lo: 0xbd, hi: 0xbd},
+	{value: 0x3008, lo: 0xbe, hi: 0xbf},
+	// Block 0x12, offset 0xb1
+	{value: 0x0000, lo: 0x0c},
+	{value: 0x0040, lo: 0x80, hi: 0x80},
+	{value: 0x3308, lo: 0x81, hi: 0x81},
+	{value: 0x3008, lo: 0x82, hi: 0x83},
+	{value: 0x0040, lo: 0x84, hi: 0x84},
+	{value: 0x0008, lo: 0x85, hi: 0x96},
+	{value: 0x0040, lo: 0x97, hi: 0x99},
+	{value: 0x0008, lo: 0x9a, hi: 0xb1},
+	{value: 0x0040, lo: 0xb2, hi: 0xb2},
+	{value: 0x0008, lo: 0xb3, hi: 0xbb},
+	{value: 0x0040, lo: 0xbc, hi: 0xbc},
+	{value: 0x0008, lo: 0xbd, hi: 0xbd},
+	{value: 0x0040, lo: 0xbe, hi: 0xbf},
+	// Block 0x13, offset 0xbe
+	{value: 0x0000, lo: 0x10},
+	{value: 0x0008, lo: 0x80, hi: 0x86},
+	{value: 0x0040, lo: 0x87, hi: 0x89},
+	{value: 0x3b08, lo: 0x8a, hi: 0x8a},
+	{value: 0x0040, lo: 0x8b, hi: 0x8e},
+	{value: 0x3008, lo: 0x8f, hi: 0x91},
+	{value: 0x3308, lo: 0x92, hi: 0x94},
+	{value: 0x0040, lo: 0x95, hi: 0x95},
+	{value: 0x3308, lo: 0x96, hi: 0x96},
+	{value: 0x0040, lo: 0x97, hi: 0x97},
+	{value: 0x3008, lo: 0x98, hi: 0x9f},
+	{value: 0x0040, lo: 0xa0, hi: 0xa5},
+	{value: 0x0008, lo: 0xa6, hi: 0xaf},
+	{value: 0x0040, lo: 0xb0, hi: 0xb1},
+	{value: 0x3008, lo: 0xb2, hi: 0xb3},
+	{value: 0x0018, lo: 0xb4, hi: 0xb4},
+	{value: 0x0040, lo: 0xb5, hi: 0xbf},
+	// Block 0x14, offset 0xcf
+	{value: 0x0000, lo: 0x09},
+	{value: 0x0040, lo: 0x80, hi: 0x80},
+	{value: 0x0008, lo: 0x81, hi: 0xb0},
+	{value: 0x3308, lo: 0xb1, hi: 0xb1},
+	{value: 0x0008, lo: 0xb2, hi: 0xb2},
+	{value: 0x01f1, lo: 0xb3, hi: 0xb3},
+	{value: 0x3308, lo: 0xb4, hi: 0xb9},
+	{value: 0x3b08, lo: 0xba, hi: 0xba},
+	{value: 0x0040, lo: 0xbb, hi: 0xbe},
+	{value: 0x0018, lo: 0xbf, hi: 0xbf},
+	// Block 0x15, offset 0xd9
+	{value: 0x0000, lo: 0x06},
+	{value: 0x0008, lo: 0x80, hi: 0x86},
+	{value: 0x3308, lo: 0x87, hi: 0x8e},
+	{value: 0x0018, lo: 0x8f, hi: 0x8f},
+	{value: 0x0008, lo: 0x90, hi: 0x99},
+	{value: 0x0018, lo: 0x9a, hi: 0x9b},
+	{value: 0x0040, lo: 0x9c, hi: 0xbf},
+	// Block 0x16, offset 0xe0
+	{value: 0x0000, lo: 0x0c},
+	{value: 0x0008, lo: 0x80, hi: 0x84},
+	{value: 0x0040, lo: 0x85, hi: 0x85},
+	{value: 0x0008, lo: 0x86, hi: 0x86},
+	{value: 0x0040, lo: 0x87, hi: 0x87},
+	{value: 0x3308, lo: 0x88, hi: 0x8e},
+	{value: 0x0040, lo: 0x8f, hi: 0x8f},
+	{value: 0x0008, lo: 0x90, hi: 0x99},
+	{value: 0x0040, lo: 0x9a, hi: 0x9b},
+	{value: 0x0201, lo: 0x9c, hi: 0x9c},
+	{value: 0x0209, lo: 0x9d, hi: 0x9d},
+	{value: 0x0008, lo: 0x9e, hi: 0x9f},
+	{value: 0x0040, lo: 0xa0, hi: 0xbf},
+	// Block 0x17, offset 0xed
+	{value: 0x0000, lo: 0x10},
+	{value: 0x0008, lo: 0x80, hi: 0x80},
+	{value: 0x0018, lo: 0x81, hi: 0x8a},
+	{value: 0x0008, lo: 0x8b, hi: 0x8b},
+	{value: 0xe03d, lo: 0x8c, hi: 0x8c},
+	{value: 0x0018, lo: 0x8d, hi: 0x97},
+	{value: 0x3308, lo: 0x98, hi: 0x99},
+	{value: 0x0018, lo: 0x9a, hi: 0x9f},
+	{value: 0x0008, lo: 0xa0, hi: 0xa9},
+	{value: 0x0018, lo: 0xaa, hi: 0xb4},
+	{value: 0x3308, lo: 0xb5, hi: 0xb5},
+	{value: 0x0018, lo: 0xb6, hi: 0xb6},
+	{value: 0x3308, lo: 0xb7, hi: 0xb7},
+	{value: 0x0018, lo: 0xb8, hi: 0xb8},
+	{value: 0x3308, lo: 0xb9, hi: 0xb9},
+	{value: 0x0018, lo: 0xba, hi: 0xbd},
+	{value: 0x3008, lo: 0xbe, hi: 0xbf},
+	// Block 0x18, offset 0xfe
+	{value: 0x0000, lo: 0x06},
+	{value: 0x0018, lo: 0x80, hi: 0x85},
+	{value: 0x3308, lo: 0x86, hi: 0x86},
+	{value: 0x0018, lo: 0x87, hi: 0x8c},
+	{value: 0x0040, lo: 0x8d, hi: 0x8d},
+	{value: 0x0018, lo: 0x8e, hi: 0x9a},
+	{value: 0x0040, lo: 0x9b, hi: 0xbf},
+	// Block 0x19, offset 0x105
+	{value: 0x0000, lo: 0x0a},
+	{value: 0x0008, lo: 0x80, hi: 0xaa},
+	{value: 0x3008, lo: 0xab, hi: 0xac},
+	{value: 0x3308, lo: 0xad, hi: 0xb0},
+	{value: 0x3008, lo: 0xb1, hi: 0xb1},
+	{value: 0x3308, lo: 0xb2, hi: 0xb7},
+	{value: 0x3008, lo: 0xb8, hi: 0xb8},
+	{value: 0x3b08, lo: 0xb9, hi: 0xba},
+	{value: 0x3008, lo: 0xbb, hi: 0xbc},
+	{value: 0x3308, lo: 0xbd, hi: 0xbe},
+	{value: 0x0008, lo: 0xbf, hi: 0xbf},
+	// Block 0x1a, offset 0x110
+	{value: 0x0000, lo: 0x0e},
+	{value: 0x0008, lo: 0x80, hi: 0x89},
+	{value: 0x0018, lo: 0x8a, hi: 0x8f},
+	{value: 0x0008, lo: 0x90, hi: 0x95},
+	{value: 0x3008, lo: 0x96, hi: 0x97},
+	{value: 0x3308, lo: 0x98, hi: 0x99},
+	{value: 0x0008, lo: 0x9a, hi: 0x9d},
+	{value: 0x3308, lo: 0x9e, hi: 0xa0},
+	{value: 0x0008, lo: 0xa1, hi: 0xa1},
+	{value: 0x3008, lo: 0xa2, hi: 0xa4},
+	{value: 0x0008, lo: 0xa5, hi: 0xa6},
+	{value: 0x3008, lo: 0xa7, hi: 0xad},
+	{value: 0x0008, lo: 0xae, hi: 0xb0},
+	{value: 0x3308, lo: 0xb1, hi: 0xb4},
+	{value: 0x0008, lo: 0xb5, hi: 0xbf},
+	// Block 0x1b, offset 0x11f
+	{value: 0x0000, lo: 0x0d},
+	{value: 0x0008, lo: 0x80, hi: 0x81},
+	{value: 0x3308, lo: 0x82, hi: 0x82},
+	{value: 0x3008, lo: 0x83, hi: 0x84},
+	{value: 0x3308, lo: 0x85, hi: 0x86},
+	{value: 0x3008, lo: 0x87, hi: 0x8c},
+	{value: 0x3308, lo: 0x8d, hi: 0x8d},
+	{value: 0x0008, lo: 0x8e, hi: 0x8e},
+	{value: 0x3008, lo: 0x8f, hi: 0x8f},
+	{value: 0x0008, lo: 0x90, hi: 0x99},
+	{value: 0x3008, lo: 0x9a, hi: 0x9c},
+	{value: 0x3308, lo: 0x9d, hi: 0x9d},
+	{value: 0x0018, lo: 0x9e, hi: 0x9f},
+	{value: 0x0040, lo: 0xa0, hi: 0xbf},
+	// Block 0x1c, offset 0x12d
+	{value: 0x0000, lo: 0x09},
+	{value: 0x0040, lo: 0x80, hi: 0x86},
+	{value: 0x055d, lo: 0x87, hi: 0x87},
+	{value: 0x0040, lo: 0x88, hi: 0x8c},
+	{value: 0x055d, lo: 0x8d, hi: 0x8d},
+	{value: 0x0040, lo: 0x8e, hi: 0x8f},
+	{value: 0x0008, lo: 0x90, hi: 0xba},
+	{value: 0x0018, lo: 0xbb, hi: 0xbb},
+	{value: 0xe105, lo: 0xbc, hi: 0xbc},
+	{value: 0x0008, lo: 0xbd, hi: 0xbf},
+	// Block 0x1d, offset 0x137
+	{value: 0x0000, lo: 0x01},
+	{value: 0x0018, lo: 0x80, hi: 0xbf},
+	// Block 0x1e, offset 0x139
+	{value: 0x0000, lo: 0x04},
+	{value: 0x0018, lo: 0x80, hi: 0x9e},
+	{value: 0x0040, lo: 0x9f, hi: 0xa0},
+	{value: 0x2018, lo: 0xa1, hi: 0xb5},
+	{value: 0x0018, lo: 0xb6, hi: 0xbf},
+	// Block 0x1f, offset 0x13e
+	{value: 0x0000, lo: 0x02},
+	{value: 0x0018, lo: 0x80, hi: 0xa7},
+	{value: 0x2018, lo: 0xa8, hi: 0xbf},
+	// Block 0x20, offset 0x141
+	{value: 0x0000, lo: 0x02},
+	{value: 0x2018, lo: 0x80, hi: 0x82},
+	{value: 0x0018, lo: 0x83, hi: 0xbf},
+	// Block 0x21, offset 0x144
+	{value: 0x0000, lo: 0x01},
+	{value: 0x0008, lo: 0x80, hi: 0xbf},
+	// Block 0x22, offset 0x146
+	{value: 0x0000, lo: 0x0b},
+	{value: 0x0008, lo: 0x80, hi: 0x88},
+	{value: 0x0040, lo: 0x89, hi: 0x89},
+	{value: 0x0008, lo: 0x8a, hi: 0x8d},
+	{value: 0x0040, lo: 0x8e, hi: 0x8f},
+	{value: 0x0008, lo: 0x90, hi: 0x96},
+	{value: 0x0040, lo: 0x97, hi: 0x97},
+	{value: 0x0008, lo: 0x98, hi: 0x98},
+	{value: 0x0040, lo: 0x99, hi: 0x99},
+	{value: 0x0008, lo: 0x9a, hi: 0x9d},
+	{value: 0x0040, lo: 0x9e, hi: 0x9f},
+	{value: 0x0008, lo: 0xa0, hi: 0xbf},
+	// Block 0x23, offset 0x152
+	{value: 0x0000, lo: 0x0a},
+	{value: 0x0008, lo: 0x80, hi: 0x88},
+	{value: 0x0040, lo: 0x89, hi: 0x89},
+	{value: 0x0008, lo: 0x8a, hi: 0x8d},
+	{value: 0x0040, lo: 0x8e, hi: 0x8f},
+	{value: 0x0008, lo: 0x90, hi: 0xb0},
+	{value: 0x0040, lo: 0xb1, hi: 0xb1},
+	{value: 0x0008, lo: 0xb2, hi: 0xb5},
+	{value: 0x0040, lo: 0xb6, hi: 0xb7},
+	{value: 0x0008, lo: 0xb8, hi: 0xbe},
+	{value: 0x0040, lo: 0xbf, hi: 0xbf},
+	// Block 0x24, offset 0x15d
+	{value: 0x0000, lo: 0x07},
+	{value: 0x0008, lo: 0x80, hi: 0x80},
+	{value: 0x0040, lo: 0x81, hi: 0x81},
+	{value: 0x0008, lo: 0x82, hi: 0x85},
+	{value: 0x0040, lo: 0x86, hi: 0x87},
+	{value: 0x0008, lo: 0x88, hi: 0x96},
+	{value: 0x0040, lo: 0x97, hi: 0x97},
+	{value: 0x0008, lo: 0x98, hi: 0xbf},
+	// Block 0x25, offset 0x165
+	{value: 0x0000, lo: 0x05},
+	{value: 0x0008, lo: 0x80, hi: 0x90},
+	{value: 0x0040, lo: 0x91, hi: 0x91},
+	{value: 0x0008, lo: 0x92, hi: 0x95},
+	{value: 0x0040, lo: 0x96, hi: 0x97},
+	{value: 0x0008, lo: 0x98, hi: 0xbf},
+	// Block 0x26, offset 0x16b
+	{value: 0x0000, lo: 0x05},
+	{value: 0x0008, lo: 0x80, hi: 0x9a},
+	{value: 0x0040, lo: 0x9b, hi: 0x9c},
+	{value: 0x3308, lo: 0x9d, hi: 0x9f},
+	{value: 0x0018, lo: 0xa0, hi: 0xbc},
+	{value: 0x0040, lo: 0xbd, hi: 0xbf},
+	// Block 0x27, offset 0x171
+	{value: 0x0000, lo: 0x04},
+	{value: 0x0008, lo: 0x80, hi: 0x8f},
+	{value: 0x0018, lo: 0x90, hi: 0x99},
+	{value: 0x0040, lo: 0x9a, hi: 0x9f},
+	{value: 0x0008, lo: 0xa0, hi: 0xbf},
+	// Block 0x28, offset 0x176
+	{value: 0x0000, lo: 0x04},
+	{value: 0x0008, lo: 0x80, hi: 0xb5},
+	{value: 0x0040, lo: 0xb6, hi: 0xb7},
+	{value: 0xe045, lo: 0xb8, hi: 0xbd},
+	{value: 0x0040, lo: 0xbe, hi: 0xbf},
+	// Block 0x29, offset 0x17b
+	{value: 0x0000, lo: 0x02},
+	{value: 0x0018, lo: 0x80, hi: 0x80},
+	{value: 0x0008, lo: 0x81, hi: 0xbf},
+	// Block 0x2a, offset 0x17e
+	{value: 0x0000, lo: 0x03},
+	{value: 0x0008, lo: 0x80, hi: 0xac},
+	{value: 0x0018, lo: 0xad, hi: 0xae},
+	{value: 0x0008, lo: 0xaf, hi: 0xbf},
+	// Block 0x2b, offset 0x182
+	{value: 0x0000, lo: 0x05},
+	{value: 0x0040, lo: 0x80, hi: 0x80},
+	{value: 0x0008, lo: 0x81, hi: 0x9a},
+	{value: 0x0018, lo: 0x9b, hi: 0x9c},
+	{value: 0x0040, lo: 0x9d, hi: 0x9f},
+	{value: 0x0008, lo: 0xa0, hi: 0xbf},
+	// Block 0x2c, offset 0x188
+	{value: 0x0000, lo: 0x04},
+	{value: 0x0008, lo: 0x80, hi: 0xaa},
+	{value: 0x0018, lo: 0xab, hi: 0xb0},
+	{value: 0x0008, lo: 0xb1, hi: 0xb8},
+	{value: 0x0040, lo: 0xb9, hi: 0xbf},
+	// Block 0x2d, offset 0x18d
+	{value: 0x0000, lo: 0x0a},
+	{value: 0x0008, lo: 0x80, hi: 0x91},
+	{value: 0x3308, lo: 0x92, hi: 0x93},
+	{value: 0x3b08, lo: 0x94, hi: 0x94},
+	{value: 0x3808, lo: 0x95, hi: 0x95},
+	{value: 0x0040, lo: 0x96, hi: 0x9e},
+	{value: 0x0008, lo: 0x9f, hi: 0xb1},
+	{value: 0x3308, lo: 0xb2, hi: 0xb3},
+	{value: 0x3808, lo: 0xb4, hi: 0xb4},
+	{value: 0x0018, lo: 0xb5, hi: 0xb6},
+	{value: 0x0040, lo: 0xb7, hi: 0xbf},
+	// Block 0x2e, offset 0x198
+	{value: 0x0000, lo: 0x09},
+	{value: 0x0008, lo: 0x80, hi: 0x91},
+	{value: 0x3308, lo: 0x92, hi: 0x93},
+	{value: 0x0040, lo: 0x94, hi: 0x9f},
+	{value: 0x0008, lo: 0xa0, hi: 0xac},
+	{value: 0x0040, lo: 0xad, hi: 0xad},
+	{value: 0x0008, lo: 0xae, hi: 0xb0},
+	{value: 0x0040, lo: 0xb1, hi: 0xb1},
+	{value: 0x3308, lo: 0xb2, hi: 0xb3},
+	{value: 0x0040, lo: 0xb4, hi: 0xbf},
+	// Block 0x2f, offset 0x1a2
+	{value: 0x0000, lo: 0x05},
+	{value: 0x0008, lo: 0x80, hi: 0xb3},
+	{value: 0x3340, lo: 0xb4, hi: 0xb5},
+	{value: 0x3008, lo: 0xb6, hi: 0xb6},
+	{value: 0x3308, lo: 0xb7, hi: 0xbd},
+	{value: 0x3008, lo: 0xbe, hi: 0xbf},
+	// Block 0x30, offset 0x1a8
+	{value: 0x0000, lo: 0x10},
+	{value: 0x3008, lo: 0x80, hi: 0x85},
+	{value: 0x3308, lo: 0x86, hi: 0x86},
+	{value: 0x3008, lo: 0x87, hi: 0x88},
+	{value: 0x3308, lo: 0x89, hi: 0x91},
+	{value: 0x3b08, lo: 0x92, hi: 0x92},
+	{value: 0x3308, lo: 0x93, hi: 0x93},
+	{value: 0x0018, lo: 0x94, hi: 0x96},
+	{value: 0x0008, lo: 0x97, hi: 0x97},
+	{value: 0x0018, lo: 0x98, hi: 0x9b},
+	{value: 0x0008, lo: 0x9c, hi: 0x9c},
+	{value: 0x3308, lo: 0x9d, hi: 0x9d},
+	{value: 0x0040, lo: 0x9e, hi: 0x9f},
+	{value: 0x0008, lo: 0xa0, hi: 0xa9},
+	{value: 0x0040, lo: 0xaa, hi: 0xaf},
+	{value: 0x0018, lo: 0xb0, hi: 0xb9},
+	{value: 0x0040, lo: 0xba, hi: 0xbf},
+	// Block 0x31, offset 0x1b9
+	{value: 0x0000, lo: 0x0a},
+	{value: 0x0018, lo: 0x80, hi: 0x85},
+	{value: 0x0040, lo: 0x86, hi: 0x86},
+	{value: 0x0218, lo: 0x87, hi: 0x87},
+	{value: 0x0018, lo: 0x88, hi: 0x8a},
+	{value: 0x33c0, lo: 0x8b, hi: 0x8d},
+	{value: 0x0040, lo: 0x8e, hi: 0x8e},
+	{value: 0x33c0, lo: 0x8f, hi: 0x8f},
+	{value: 0x0008, lo: 0x90, hi: 0x99},
+	{value: 0x0040, lo: 0x9a, hi: 0x9f},
+	{value: 0x0208, lo: 0xa0, hi: 0xbf},
+	// Block 0x32, offset 0x1c4
+	{value: 0x0000, lo: 0x02},
+	{value: 0x0208, lo: 0x80, hi: 0xb8},
+	{value: 0x0040, lo: 0xb9, hi: 0xbf},
+	// Block 0x33, offset 0x1c7
+	{value: 0x0000, lo: 0x07},
+	{value: 0x0008, lo: 0x80, hi: 0x84},
+	{value: 0x3308, lo: 0x85, hi: 0x86},
+	{value: 0x0208, lo: 0x87, hi: 0xa8},
+	{value: 0x3308, lo: 0xa9, hi: 0xa9},
+	{value: 0x0208, lo: 0xaa, hi: 0xaa},
+	{value: 0x0040, lo: 0xab, hi: 0xaf},
+	{value: 0x0008, lo: 0xb0, hi: 0xbf},
+	// Block 0x34, offset 0x1cf
+	{value: 0x0000, lo: 0x02},
+	{value: 0x0008, lo: 0x80, hi: 0xb5},
+	{value: 0x0040, lo: 0xb6, hi: 0xbf},
+	// Block 0x35, offset 0x1d2
+	{value: 0x0000, lo: 0x0c},
+	{value: 0x0008, lo: 0x80, hi: 0x9e},
+	{value: 0x0040, lo: 0x9f, hi: 0x9f},
+	{value: 0x3308, lo: 0xa0, hi: 0xa2},
+	{value: 0x3008, lo: 0xa3, hi: 0xa6},
+	{value: 0x3308, lo: 0xa7, hi: 0xa8},
+	{value: 0x3008, lo: 0xa9, hi: 0xab},
+	{value: 0x0040, lo: 0xac, hi: 0xaf},
+	{value: 0x3008, lo: 0xb0, hi: 0xb1},
+	{value: 0x3308, lo: 0xb2, hi: 0xb2},
+	{value: 0x3008, lo: 0xb3, hi: 0xb8},
+	{value: 0x3308, lo: 0xb9, hi: 0xbb},
+	{value: 0x0040, lo: 0xbc, hi: 0xbf},
+	// Block 0x36, offset 0x1df
+	{value: 0x0000, lo: 0x07},
+	{value: 0x0018, lo: 0x80, hi: 0x80},
+	{value: 0x0040, lo: 0x81, hi: 0x83},
+	{value: 0x0018, lo: 0x84, hi: 0x85},
+	{value: 0x0008, lo: 0x86, hi: 0xad},
+	{value: 0x0040, lo: 0xae, hi: 0xaf},
+	{value: 0x0008, lo: 0xb0, hi: 0xb4},
+	{value: 0x0040, lo: 0xb5, hi: 0xbf},
+	// Block 0x37, offset 0x1e7
+	{value: 0x0000, lo: 0x03},
+	{value: 0x0008, lo: 0x80, hi: 0xab},
+	{value: 0x0040, lo: 0xac, hi: 0xaf},
+	{value: 0x0008, lo: 0xb0, hi: 0xbf},
+	// Block 0x38, offset 0x1eb
+	{value: 0x0000, lo: 0x06},
+	{value: 0x0008, lo: 0x80, hi: 0x89},
+	{value: 0x0040, lo: 0x8a, hi: 0x8f},
+	{value: 0x0008, lo: 0x90, hi: 0x99},
+	{value: 0x0028, lo: 0x9a, hi: 0x9a},
+	{value: 0x0040, lo: 0x9b, hi: 0x9d},
+	{value: 0x0018, lo: 0x9e, hi: 0xbf},
+	// Block 0x39, offset 0x1f2
+	{value: 0x0000, lo: 0x07},
+	{value: 0x0008, lo: 0x80, hi: 0x96},
+	{value: 0x3308, lo: 0x97, hi: 0x98},
+	{value: 0x3008, lo: 0x99, hi: 0x9a},
+	{value: 0x3308, lo: 0x9b, hi: 0x9b},
+	{value: 0x0040, lo: 0x9c, hi: 0x9d},
+	{value: 0x0018, lo: 0x9e, hi: 0x9f},
+	{value: 0x0008, lo: 0xa0, hi: 0xbf},
+	// Block 0x3a, offset 0x1fa
+	{value: 0x0000, lo: 0x0f},
+	{value: 0x0008, lo: 0x80, hi: 0x94},
+	{value: 0x3008, lo: 0x95, hi: 0x95},
+	{value: 0x3308, lo: 0x96, hi: 0x96},
+	{value: 0x3008, lo: 0x97, hi: 0x97},
+	{value: 0x3308, lo: 0x98, hi: 0x9e},
+	{value: 0x0040, lo: 0x9f, hi: 0x9f},
+	{value: 0x3b08, lo: 0xa0, hi: 0xa0},
+	{value: 0x3008, lo: 0xa1, hi: 0xa1},
+	{value: 0x3308, lo: 0xa2, hi: 0xa2},
+	{value: 0x3008, lo: 0xa3, hi: 0xa4},
+	{value: 0x3308, lo: 0xa5, hi: 0xac},
+	{value: 0x3008, lo: 0xad, hi: 0xb2},
+	{value: 0x3308, lo: 0xb3, hi: 0xbc},
+	{value: 0x0040, lo: 0xbd, hi: 0xbe},
+	{value: 0x3308, lo: 0xbf, hi: 0xbf},
+	// Block 0x3b, offset 0x20a
+	{value: 0x0000, lo: 0x0b},
+	{value: 0x0008, lo: 0x80, hi: 0x89},
+	{value: 0x0040, lo: 0x8a, hi: 0x8f},
+	{value: 0x0008, lo: 0x90, hi: 0x99},
+	{value: 0x0040, lo: 0x9a, hi: 0x9f},
+	{value: 0x0018, lo: 0xa0, hi: 0xa6},
+	{value: 0x0008, lo: 0xa7, hi: 0xa7},
+	{value: 0x0018, lo: 0xa8, hi: 0xad},
+	{value: 0x0040, lo: 0xae, hi: 0xaf},
+	{value: 0x3308, lo: 0xb0, hi: 0xbd},
+	{value: 0x3318, lo: 0xbe, hi: 0xbe},
+	{value: 0x3308, lo: 0xbf, hi: 0xbf},
+	// Block 0x3c, offset 0x216
+	{value: 0x0000, lo: 0x02},
+	{value: 0x3308, lo: 0x80, hi: 0x8e},
+	{value: 0x0040, lo: 0x8f, hi: 0xbf},
+	// Block 0x3d, offset 0x219
+	{value: 0x0000, lo: 0x09},
+	{value: 0x3308, lo: 0x80, hi: 0x83},
+	{value: 0x3008, lo: 0x84, hi: 0x84},
+	{value: 0x0008, lo: 0x85, hi: 0xb3},
+	{value: 0x3308, lo: 0xb4, hi: 0xb4},
+	{value: 0x3008, lo: 0xb5, hi: 0xb5},
+	{value: 0x3308, lo: 0xb6, hi: 0xba},
+	{value: 0x3008, lo: 0xbb, hi: 0xbb},
+	{value: 0x3308, lo: 0xbc, hi: 0xbc},
+	{value: 0x3008, lo: 0xbd, hi: 0xbf},
+	// Block 0x3e, offset 0x223
+	{value: 0x0000, lo: 0x0b},
+	{value: 0x3008, lo: 0x80, hi: 0x81},
+	{value: 0x3308, lo: 0x82, hi: 0x82},
+	{value: 0x3008, lo: 0x83, hi: 0x83},
+	{value: 0x3808, lo: 0x84, hi: 0x84},
+	{value: 0x0008, lo: 0x85, hi: 0x8c},
+	{value: 0x0040, lo: 0x8d, hi: 0x8f},
+	{value: 0x0008, lo: 0x90, hi: 0x99},
+	{value: 0x0018, lo: 0x9a, hi: 0xaa},
+	{value: 0x3308, lo: 0xab, hi: 0xb3},
+	{value: 0x0018, lo: 0xb4, hi: 0xbe},
+	{value: 0x0040, lo: 0xbf, hi: 0xbf},
+	// Block 0x3f, offset 0x22f
+	{value: 0x0000, lo: 0x0b},
+	{value: 0x3308, lo: 0x80, hi: 0x81},
+	{value: 0x3008, lo: 0x82, hi: 0x82},
+	{value: 0x0008, lo: 0x83, hi: 0xa0},
+	{value: 0x3008, lo: 0xa1, hi: 0xa1},
+	{value: 0x3308, lo: 0xa2, hi: 0xa5},
+	{value: 0x3008, lo: 0xa6, hi: 0xa7},
+	{value: 0x3308, lo: 0xa8, hi: 0xa9},
+	{value: 0x3808, lo: 0xaa, hi: 0xaa},
+	{value: 0x3b08, lo: 0xab, hi: 0xab},
+	{value: 0x3308, lo: 0xac, hi: 0xad},
+	{value: 0x0008, lo: 0xae, hi: 0xbf},
+	// Block 0x40, offset 0x23b
+	{value: 0x0000, lo: 0x0b},
+	{value: 0x0008, lo: 0x80, hi: 0xa5},
+	{value: 0x3308, lo: 0xa6, hi: 0xa6},
+	{value: 0x3008, lo: 0xa7, hi: 0xa7},
+	{value: 0x3308, lo: 0xa8, hi: 0xa9},
+	{value: 0x3008, lo: 0xaa, hi: 0xac},
+	{value: 0x3308, lo: 0xad, hi: 0xad},
+	{value: 0x3008, lo: 0xae, hi: 0xae},
+	{value: 0x3308, lo: 0xaf, hi: 0xb1},
+	{value: 0x3808, lo: 0xb2, hi: 0xb3},
+	{value: 0x0040, lo: 0xb4, hi: 0xbb},
+	{value: 0x0018, lo: 0xbc, hi: 0xbf},
+	// Block 0x41, offset 0x247
+	{value: 0x0000, lo: 0x07},
+	{value: 0x0008, lo: 0x80, hi: 0xa3},
+	{value: 0x3008, lo: 0xa4, hi: 0xab},
+	{value: 0x3308, lo: 0xac, hi: 0xb3},
+	{value: 0x3008, lo: 0xb4, hi: 0xb5},
+	{value: 0x3308, lo: 0xb6, hi: 0xb7},
+	{value: 0x0040, lo: 0xb8, hi: 0xba},
+	{value: 0x0018, lo: 0xbb, hi: 0xbf},
+	// Block 0x42, offset 0x24f
+	{value: 0x0000, lo: 0x04},
+	{value: 0x0008, lo: 0x80, hi: 0x89},
+	{value: 0x0040, lo: 0x8a, hi: 0x8c},
+	{value: 0x0008, lo: 0x8d, hi: 0xbd},
+	{value: 0x0018, lo: 0xbe, hi: 0xbf},
+	// Block 0x43, offset 0x254
+	{value: 0x0000, lo: 0x0c},
+	{value: 0x02a9, lo: 0x80, hi: 0x80},
+	{value: 0x02b1, lo: 0x81, hi: 0x81},
+	{value: 0x02b9, lo: 0x82, hi: 0x82},
+	{value: 0x02c1, lo: 0x83, hi: 0x83},
+	{value: 0x02c9, lo: 0x84, hi: 0x85},
+	{value: 0x02d1, lo: 0x86, hi: 0x86},
+	{value: 0x02d9, lo: 0x87, hi: 0x87},
+	{value: 0x057d, lo: 0x88, hi: 0x88},
+	{value: 0x0040, lo: 0x89, hi: 0x8f},
+	{value: 0x059d, lo: 0x90, hi: 0xba},
+	{value: 0x0040, lo: 0xbb, hi: 0xbc},
+	{value: 0x059d, lo: 0xbd, hi: 0xbf},
+	// Block 0x44, offset 0x261
+	{value: 0x0000, lo: 0x10},
+	{value: 0x0018, lo: 0x80, hi: 0x87},
+	{value: 0x0040, lo: 0x88, hi: 0x8f},
+	{value: 0x3308, lo: 0x90, hi: 0x92},
+	{value: 0x0018, lo: 0x93, hi: 0x93},
+	{value: 0x3308, lo: 0x94, hi: 0xa0},
+	{value: 0x3008, lo: 0xa1, hi: 0xa1},
+	{value: 0x3308, lo: 0xa2, hi: 0xa8},
+	{value: 0x0008, lo: 0xa9, hi: 0xac},
+	{value: 0x3308, lo: 0xad, hi: 0xad},
+	{value: 0x0008, lo: 0xae, hi: 0xb3},
+	{value: 0x3308, lo: 0xb4, hi: 0xb4},
+	{value: 0x0008, lo: 0xb5, hi: 0xb6},
+	{value: 0x3008, lo: 0xb7, hi: 0xb7},
+	{value: 0x3308, lo: 0xb8, hi: 0xb9},
+	{value: 0x0008, lo: 0xba, hi: 0xba},
+	{value: 0x0040, lo: 0xbb, hi: 0xbf},
+	// Block 0x45, offset 0x272
+	{value: 0x0000, lo: 0x0a},
+	{value: 0x0008, lo: 0x80, hi: 0x87},
+	{value: 0xe045, lo: 0x88, hi: 0x8f},
+	{value: 0x0008, lo: 0x90, hi: 0x95},
+	{value: 0x0040, lo: 0x96, hi: 0x97},
+	{value: 0xe045, lo: 0x98, hi: 0x9d},
+	{value: 0x0040, lo: 0x9e, hi: 0x9f},
+	{value: 0x0008, lo: 0xa0, hi: 0xa7},
+	{value: 0xe045, lo: 0xa8, hi: 0xaf},
+	{value: 0x0008, lo: 0xb0, hi: 0xb7},
+	{value: 0xe045, lo: 0xb8, hi: 0xbf},
+	// Block 0x46, offset 0x27d
+	{value: 0x0000, lo: 0x04},
+	{value: 0x0018, lo: 0x80, hi: 0x80},
+	{value: 0x0040, lo: 0x81, hi: 0x8f},
+	{value: 0x3318, lo: 0x90, hi: 0xb0},
+	{value: 0x0040, lo: 0xb1, hi: 0xbf},
+	// Block 0x47, offset 0x282
+	{value: 0x0000, lo: 0x08},
+	{value: 0x0018, lo: 0x80, hi: 0x82},
+	{value: 0x0040, lo: 0x83, hi: 0x83},
+	{value: 0x0008, lo: 0x84, hi: 0x84},
+	{value: 0x0018, lo: 0x85, hi: 0x88},
+	{value: 0x0851, lo: 0x89, hi: 0x89},
+	{value: 0x0018, lo: 0x8a, hi: 0x8b},
+	{value: 0x0040, lo: 0x8c, hi: 0x8f},
+	{value: 0x0018, lo: 0x90, hi: 0xbf},
+	// Block 0x48, offset 0x28b
+	{value: 0x0000, lo: 0x07},
+	{value: 0x0018, lo: 0x80, hi: 0xab},
+	{value: 0x0859, lo: 0xac, hi: 0xac},
+	{value: 0x0861, lo: 0xad, hi: 0xad},
+	{value: 0x0018, lo: 0xae, hi: 0xae},
+	{value: 0x0869, lo: 0xaf, hi: 0xaf},
+	{value: 0x0871, lo: 0xb0, hi: 0xb0},
+	{value: 0x0018, lo: 0xb1, hi: 0xbf},
+	// Block 0x49, offset 0x293
+	{value: 0x0000, lo: 0x05},
+	{value: 0x0018, lo: 0x80, hi: 0x9f},
+	{value: 0x0080, lo: 0xa0, hi: 0xa0},
+	{value: 0x0018, lo: 0xa1, hi: 0xad},
+	{value: 0x0080, lo: 0xae, hi: 0xaf},
+	{value: 0x0018, lo: 0xb0, hi: 0xbf},
+	// Block 0x4a, offset 0x299
+	{value: 0x0000, lo: 0x04},
+	{value: 0x0018, lo: 0x80, hi: 0xa8},
+	{value: 0x09dd, lo: 0xa9, hi: 0xa9},
+	{value: 0x09fd, lo: 0xaa, hi: 0xaa},
+	{value: 0x0018, lo: 0xab, hi: 0xbf},
+	// Block 0x4b, offset 0x29e
+	{value: 0x0000, lo: 0x02},
+	{value: 0x0018, lo: 0x80, hi: 0xa6},
+	{value: 0x0040, lo: 0xa7, hi: 0xbf},
+	// Block 0x4c, offset 0x2a1
+	{value: 0x0000, lo: 0x03},
+	{value: 0x0018, lo: 0x80, hi: 0x8b},
+	{value: 0x0929, lo: 0x8c, hi: 0x8c},
+	{value: 0x0018, lo: 0x8d, hi: 0xbf},
+	// Block 0x4d, offset 0x2a5
+	{value: 0x0000, lo: 0x05},
+	{value: 0x0018, lo: 0x80, hi: 0xb3},
+	{value: 0x0e7e, lo: 0xb4, hi: 0xb4},
+	{value: 0x0932, lo: 0xb5, hi: 0xb5},
+	{value: 0x0e9e, lo: 0xb6, hi: 0xb6},
+	{value: 0x0018, lo: 0xb7, hi: 0xbf},
+	// Block 0x4e, offset 0x2ab
+	{value: 0x0000, lo: 0x03},
+	{value: 0x0018, lo: 0x80, hi: 0x9b},
+	{value: 0x0939, lo: 0x9c, hi: 0x9c},
+	{value: 0x0018, lo: 0x9d, hi: 0xbf},
+	// Block 0x4f, offset 0x2af
+	{value: 0x0000, lo: 0x03},
+	{value: 0x0018, lo: 0x80, hi: 0xb3},
+	{value: 0x0040, lo: 0xb4, hi: 0xb5},
+	{value: 0x0018, lo: 0xb6, hi: 0xbf},
+	// Block 0x50, offset 0x2b3
+	{value: 0x0000, lo: 0x03},
+	{value: 0x0018, lo: 0x80, hi: 0x95},
+	{value: 0x0040, lo: 0x96, hi: 0x96},
+	{value: 0x0018, lo: 0x97, hi: 0xbf},
+	// Block 0x51, offset 0x2b7
+	{value: 0x0000, lo: 0x04},
+	{value: 0xe185, lo: 0x80, hi: 0x8f},
+	{value: 0x03f5, lo: 0x90, hi: 0x9f},
+	{value: 0x0ebd, lo: 0xa0, hi: 0xaf},
+	{value: 0x0008, lo: 0xb0, hi: 0xbf},
+	// Block 0x52, offset 0x2bc
+	{value: 0x0000, lo: 0x07},
+	{value: 0x0008, lo: 0x80, hi: 0xa5},
+	{value: 0x0040, lo: 0xa6, hi: 0xa6},
+	{value: 0x0008, lo: 0xa7, hi: 0xa7},
+	{value: 0x0040, lo: 0xa8, hi: 0xac},
+	{value: 0x0008, lo: 0xad, hi: 0xad},
+	{value: 0x0040, lo: 0xae, hi: 0xaf},
+	{value: 0x0008, lo: 0xb0, hi: 0xbf},
+	// Block 0x53, offset 0x2c4
+	{value: 0x0000, lo: 0x06},
+	{value: 0x0008, lo: 0x80, hi: 0xa7},
+	{value: 0x0040, lo: 0xa8, hi: 0xae},
+	{value: 0xe075, lo: 0xaf, hi: 0xaf},
+	{value: 0x0018, lo: 0xb0, hi: 0xb0},
+	{value: 0x0040, lo: 0xb1, hi: 0xbe},
+	{value: 0x3b08, lo: 0xbf, hi: 0xbf},
+	// Block 0x54, offset 0x2cb
+	{value: 0x0000, lo: 0x0a},
+	{value: 0x0008, lo: 0x80, hi: 0x96},
+	{value: 0x0040, lo: 0x97, hi: 0x9f},
+	{value: 0x0008, lo: 0xa0, hi: 0xa6},
+	{value: 0x0040, lo: 0xa7, hi: 0xa7},
+	{value: 0x0008, lo: 0xa8, hi: 0xae},
+	{value: 0x0040, lo: 0xaf, hi: 0xaf},
+	{value: 0x0008, lo: 0xb0, hi: 0xb6},
+	{value: 0x0040, lo: 0xb7, hi: 0xb7},
+	{value: 0x0008, lo: 0xb8, hi: 0xbe},
+	{value: 0x0040, lo: 0xbf, hi: 0xbf},
+	// Block 0x55, offset 0x2d6
+	{value: 0x0000, lo: 0x09},
+	{value: 0x0008, lo: 0x80, hi: 0x86},
+	{value: 0x0040, lo: 0x87, hi: 0x87},
+	{value: 0x0008, lo: 0x88, hi: 0x8e},
+	{value: 0x0040, lo: 0x8f, hi: 0x8f},
+	{value: 0x0008, lo: 0x90, hi: 0x96},
+	{value: 0x0040, lo: 0x97, hi: 0x97},
+	{value: 0x0008, lo: 0x98, hi: 0x9e},
+	{value: 0x0040, lo: 0x9f, hi: 0x9f},
+	{value: 0x3308, lo: 0xa0, hi: 0xbf},
+	// Block 0x56, offset 0x2e0
+	{value: 0x0000, lo: 0x03},
+	{value: 0x0018, lo: 0x80, hi: 0xae},
+	{value: 0x0008, lo: 0xaf, hi: 0xaf},
+	{value: 0x0018, lo: 0xb0, hi: 0xbf},
+	// Block 0x57, offset 0x2e4
+	{value: 0x0000, lo: 0x02},
+	{value: 0x0018, lo: 0x80, hi: 0x9d},
+	{value: 0x0040, lo: 0x9e, hi: 0xbf},
+	// Block 0x58, offset 0x2e7
+	{value: 0x0000, lo: 0x05},
+	{value: 0x0018, lo: 0x80, hi: 0x99},
+	{value: 0x0040, lo: 0x9a, hi: 0x9a},
+	{value: 0x0018, lo: 0x9b, hi: 0x9e},
+	{value: 0x0ef5, lo: 0x9f, hi: 0x9f},
+	{value: 0x0018, lo: 0xa0, hi: 0xbf},
+	// Block 0x59, offset 0x2ed
+	{value: 0x0000, lo: 0x03},
+	{value: 0x0018, lo: 0x80, hi: 0xb2},
+	{value: 0x0f15, lo: 0xb3, hi: 0xb3},
+	{value: 0x0040, lo: 0xb4, hi: 0xbf},
+	// Block 0x5a, offset 0x2f1
+	{value: 0x0020, lo: 0x01},
+	{value: 0x0f35, lo: 0x80, hi: 0xbf},
+	// Block 0x5b, offset 0x2f3
+	{value: 0x0020, lo: 0x02},
+	{value: 0x1735, lo: 0x80, hi: 0x8f},
+	{value: 0x1915, lo: 0x90, hi: 0xbf},
+	// Block 0x5c, offset 0x2f6
+	{value: 0x0020, lo: 0x01},
+	{value: 0x1f15, lo: 0x80, hi: 0xbf},
+	// Block 0x5d, offset 0x2f8
+	{value: 0x0000, lo: 0x02},
+	{value: 0x0040, lo: 0x80, hi: 0x80},
+	{value: 0x0008, lo: 0x81, hi: 0xbf},
+	// Block 0x5e, offset 0x2fb
+	{value: 0x0000, lo: 0x09},
+	{value: 0x0008, lo: 0x80, hi: 0x96},
+	{value: 0x0040, lo: 0x97, hi: 0x98},
+	{value: 0x3308, lo: 0x99, hi: 0x9a},
+	{value: 0x096a, lo: 0x9b, hi: 0x9b},
+	{value: 0x0972, lo: 0x9c, hi: 0x9c},
+	{value: 0x0008, lo: 0x9d, hi: 0x9e},
+	{value: 0x0979, lo: 0x9f, hi: 0x9f},
+	{value: 0x0018, lo: 0xa0, hi: 0xa0},
+	{value: 0x0008, lo: 0xa1, hi: 0xbf},
+	// Block 0x5f, offset 0x305
+	{value: 0x0000, lo: 0x02},
+	{value: 0x0008, lo: 0x80, hi: 0xbe},
+	{value: 0x0981, lo: 0xbf, hi: 0xbf},
+	// Block 0x60, offset 0x308
+	{value: 0x0000, lo: 0x0e},
+	{value: 0x0040, lo: 0x80, hi: 0x84},
+	{value: 0x0008, lo: 0x85, hi: 0xaf},
+	{value: 0x0040, lo: 0xb0, hi: 0xb0},
+	{value: 0x2a35, lo: 0xb1, hi: 0xb1},
+	{value: 0x2a55, lo: 0xb2, hi: 0xb2},
+	{value: 0x2a75, lo: 0xb3, hi: 0xb3},
+	{value: 0x2a95, lo: 0xb4, hi: 0xb4},
+	{value: 0x2a75, lo: 0xb5, hi: 0xb5},
+	{value: 0x2ab5, lo: 0xb6, hi: 0xb6},
+	{value: 0x2ad5, lo: 0xb7, hi: 0xb7},
+	{value: 0x2af5, lo: 0xb8, hi: 0xb9},
+	{value: 0x2b15, lo: 0xba, hi: 0xbb},
+	{value: 0x2b35, lo: 0xbc, hi: 0xbd},
+	{value: 0x2b15, lo: 0xbe, hi: 0xbf},
+	// Block 0x61, offset 0x317
+	{value: 0x0000, lo: 0x03},
+	{value: 0x0018, lo: 0x80, hi: 0xa3},
+	{value: 0x0040, lo: 0xa4, hi: 0xaf},
+	{value: 0x0008, lo: 0xb0, hi: 0xbf},
+	// Block 0x62, offset 0x31b
+	{value: 0x0008, lo: 0x03},
+	{value: 0x098a, lo: 0x80, hi: 0x9e},
+	{value: 0x0040, lo: 0x9f, hi: 0x9f},
+	{value: 0x0a82, lo: 0xa0, hi: 0xbf},
+	// Block 0x63, offset 0x31f
+	{value: 0x0008, lo: 0x01},
+	{value: 0x0d19, lo: 0x80, hi: 0xbf},
+	// Block 0x64, offset 0x321
+	{value: 0x0008, lo: 0x08},
+	{value: 0x0f19, lo: 0x80, hi: 0xb0},
+	{value: 0x4045, lo: 0xb1, hi: 0xb1},
+	{value: 0x10a1, lo: 0xb2, hi: 0xb3},
+	{value: 0x4065, lo: 0xb4, hi: 0xb4},
+	{value: 0x10b1, lo: 0xb5, hi: 0xb7},
+	{value: 0x4085, lo: 0xb8, hi: 0xb8},
+	{value: 0x4085, lo: 0xb9, hi: 0xb9},
+	{value: 0x10c9, lo: 0xba, hi: 0xbf},
+	// Block 0x65, offset 0x32a
+	{value: 0x0000, lo: 0x03},
+	{value: 0x0008, lo: 0x80, hi: 0x8c},
+	{value: 0x0040, lo: 0x8d, hi: 0x8f},
+	{value: 0x0018, lo: 0x90, hi: 0xbf},
+	// Block 0x66, offset 0x32e
+	{value: 0x0000, lo: 0x04},
+	{value: 0x0018, lo: 0x80, hi: 0x86},
+	{value: 0x0040, lo: 0x87, hi: 0x8f},
+	{value: 0x0008, lo: 0x90, hi: 0xbd},
+	{value: 0x0018, lo: 0xbe, hi: 0xbf},
+	// Block 0x67, offset 0x333
+	{value: 0x0000, lo: 0x04},
+	{value: 0x0008, lo: 0x80, hi: 0x8c},
+	{value: 0x0018, lo: 0x8d, hi: 0x8f},
+	{value: 0x0008, lo: 0x90, hi: 0xab},
+	{value: 0x0040, lo: 0xac, hi: 0xbf},
+	// Block 0x68, offset 0x338
+	{value: 0x0000, lo: 0x05},
+	{value: 0x0008, lo: 0x80, hi: 0xa5},
+	{value: 0x0018, lo: 0xa6, hi: 0xaf},
+	{value: 0x3308, lo: 0xb0, hi: 0xb1},
+	{value: 0x0018, lo: 0xb2, hi: 0xb7},
+	{value: 0x0040, lo: 0xb8, hi: 0xbf},
+	// Block 0x69, offset 0x33e
+	{value: 0x0000, lo: 0x0f},
+	{value: 0x0008, lo: 0x80, hi: 0x81},
+	{value: 0x3308, lo: 0x82, hi: 0x82},
+	{value: 0x0008, lo: 0x83, hi: 0x85},
+	{value: 0x3b08, lo: 0x86, hi: 0x86},
+	{value: 0x0008, lo: 0x87, hi: 0x8a},
+	{value: 0x3308, lo: 0x8b, hi: 0x8b},
+	{value: 0x0008, lo: 0x8c, hi: 0xa2},
+	{value: 0x3008, lo: 0xa3, hi: 0xa4},
+	{value: 0x3308, lo: 0xa5, hi: 0xa6},
+	{value: 0x3008, lo: 0xa7, hi: 0xa7},
+	{value: 0x0018, lo: 0xa8, hi: 0xab},
+	{value: 0x3b08, lo: 0xac, hi: 0xac},
+	{value: 0x0040, lo: 0xad, hi: 0xaf},
+	{value: 0x0018, lo: 0xb0, hi: 0xb9},
+	{value: 0x0040, lo: 0xba, hi: 0xbf},
+	// Block 0x6a, offset 0x34e
+	{value: 0x0000, lo: 0x05},
+	{value: 0x0208, lo: 0x80, hi: 0xb1},
+	{value: 0x0108, lo: 0xb2, hi: 0xb2},
+	{value: 0x0008, lo: 0xb3, hi: 0xb3},
+	{value: 0x0018, lo: 0xb4, hi: 0xb7},
+	{value: 0x0040, lo: 0xb8, hi: 0xbf},
+	// Block 0x6b, offset 0x354
+	{value: 0x0000, lo: 0x03},
+	{value: 0x3008, lo: 0x80, hi: 0x81},
+	{value: 0x0008, lo: 0x82, hi: 0xb3},
+	{value: 0x3008, lo: 0xb4, hi: 0xbf},
+	// Block 0x6c, offset 0x358
+	{value: 0x0000, lo: 0x0e},
+	{value: 0x3008, lo: 0x80, hi: 0x83},
+	{value: 0x3b08, lo: 0x84, hi: 0x84},
+	{value: 0x3308, lo: 0x85, hi: 0x85},
+	{value: 0x0040, lo: 0x86, hi: 0x8d},
+	{value: 0x0018, lo: 0x8e, hi: 0x8f},
+	{value: 0x0008, lo: 0x90, hi: 0x99},
+	{value: 0x0040, lo: 0x9a, hi: 0x9f},
+	{value: 0x3308, lo: 0xa0, hi: 0xb1},
+	{value: 0x0008, lo: 0xb2, hi: 0xb7},
+	{value: 0x0018, lo: 0xb8, hi: 0xba},
+	{value: 0x0008, lo: 0xbb, hi: 0xbb},
+	{value: 0x0018, lo: 0xbc, hi: 0xbc},
+	{value: 0x0008, lo: 0xbd, hi: 0xbe},
+	{value: 0x3308, lo: 0xbf, hi: 0xbf},
+	// Block 0x6d, offset 0x367
+	{value: 0x0000, lo: 0x04},
+	{value: 0x0008, lo: 0x80, hi: 0xa5},
+	{value: 0x3308, lo: 0xa6, hi: 0xad},
+	{value: 0x0018, lo: 0xae, hi: 0xaf},
+	{value: 0x0008, lo: 0xb0, hi: 0xbf},
+	// Block 0x6e, offset 0x36c
+	{value: 0x0000, lo: 0x07},
+	{value: 0x0008, lo: 0x80, hi: 0x86},
+	{value: 0x3308, lo: 0x87, hi: 0x91},
+	{value: 0x3008, lo: 0x92, hi: 0x92},
+	{value: 0x3808, lo: 0x93, hi: 0x93},
+	{value: 0x0040, lo: 0x94, hi: 0x9e},
+	{value: 0x0018, lo: 0x9f, hi: 0xbc},
+	{value: 0x0040, lo: 0xbd, hi: 0xbf},
+	// Block 0x6f, offset 0x374
+	{value: 0x0000, lo: 0x09},
+	{value: 0x3308, lo: 0x80, hi: 0x82},
+	{value: 0x3008, lo: 0x83, hi: 0x83},
+	{value: 0x0008, lo: 0x84, hi: 0xb2},
+	{value: 0x3308, lo: 0xb3, hi: 0xb3},
+	{value: 0x3008, lo: 0xb4, hi: 0xb5},
+	{value: 0x3308, lo: 0xb6, hi: 0xb9},
+	{value: 0x3008, lo: 0xba, hi: 0xbb},
+	{value: 0x3308, lo: 0xbc, hi: 0xbd},
+	{value: 0x3008, lo: 0xbe, hi: 0xbf},
+	// Block 0x70, offset 0x37e
+	{value: 0x0000, lo: 0x0a},
+	{value: 0x3808, lo: 0x80, hi: 0x80},
+	{value: 0x0018, lo: 0x81, hi: 0x8d},
+	{value: 0x0040, lo: 0x8e, hi: 0x8e},
+	{value: 0x0008, lo: 0x8f, hi: 0x99},
+	{value: 0x0040, lo: 0x9a, hi: 0x9d},
+	{value: 0x0018, lo: 0x9e, hi: 0x9f},
+	{value: 0x0008, lo: 0xa0, hi: 0xa4},
+	{value: 0x3308, lo: 0xa5, hi: 0xa5},
+	{value: 0x0008, lo: 0xa6, hi: 0xbe},
+	{value: 0x0040, lo: 0xbf, hi: 0xbf},
+	// Block 0x71, offset 0x389
+	{value: 0x0000, lo: 0x07},
+	{value: 0x0008, lo: 0x80, hi: 0xa8},
+	{value: 0x3308, lo: 0xa9, hi: 0xae},
+	{value: 0x3008, lo: 0xaf, hi: 0xb0},
+	{value: 0x3308, lo: 0xb1, hi: 0xb2},
+	{value: 0x3008, lo: 0xb3, hi: 0xb4},
+	{value: 0x3308, lo: 0xb5, hi: 0xb6},
+	{value: 0x0040, lo: 0xb7, hi: 0xbf},
+	// Block 0x72, offset 0x391
+	{value: 0x0000, lo: 0x10},
+	{value: 0x0008, lo: 0x80, hi: 0x82},
+	{value: 0x3308, lo: 0x83, hi: 0x83},
+	{value: 0x0008, lo: 0x84, hi: 0x8b},
+	{value: 0x3308, lo: 0x8c, hi: 0x8c},
+	{value: 0x3008, lo: 0x8d, hi: 0x8d},
+	{value: 0x0040, lo: 0x8e, hi: 0x8f},
+	{value: 0x0008, lo: 0x90, hi: 0x99},
+	{value: 0x0040, lo: 0x9a, hi: 0x9b},
+	{value: 0x0018, lo: 0x9c, hi: 0x9f},
+	{value: 0x0008, lo: 0xa0, hi: 0xb6},
+	{value: 0x0018, lo: 0xb7, hi: 0xb9},
+	{value: 0x0008, lo: 0xba, hi: 0xba},
+	{value: 0x3008, lo: 0xbb, hi: 0xbb},
+	{value: 0x3308, lo: 0xbc, hi: 0xbc},
+	{value: 0x3008, lo: 0xbd, hi: 0xbd},
+	{value: 0x0008, lo: 0xbe, hi: 0xbf},
+	// Block 0x73, offset 0x3a2
+	{value: 0x0000, lo: 0x08},
+	{value: 0x0008, lo: 0x80, hi: 0xaf},
+	{value: 0x3308, lo: 0xb0, hi: 0xb0},
+	{value: 0x0008, lo: 0xb1, hi: 0xb1},
+	{value: 0x3308, lo: 0xb2, hi: 0xb4},
+	{value: 0x0008, lo: 0xb5, hi: 0xb6},
+	{value: 0x3308, lo: 0xb7, hi: 0xb8},
+	{value: 0x0008, lo: 0xb9, hi: 0xbd},
+	{value: 0x3308, lo: 0xbe, hi: 0xbf},
+	// Block 0x74, offset 0x3ab
+	{value: 0x0000, lo: 0x0f},
+	{value: 0x0008, lo: 0x80, hi: 0x80},
+	{value: 0x3308, lo: 0x81, hi: 0x81},
+	{value: 0x0008, lo: 0x82, hi: 0x82},
+	{value: 0x0040, lo: 0x83, hi: 0x9a},
+	{value: 0x0008, lo: 0x9b, hi: 0x9d},
+	{value: 0x0018, lo: 0x9e, hi: 0x9f},
+	{value: 0x0008, lo: 0xa0, hi: 0xaa},
+	{value: 0x3008, lo: 0xab, hi: 0xab},
+	{value: 0x3308, lo: 0xac, hi: 0xad},
+	{value: 0x3008, lo: 0xae, hi: 0xaf},
+	{value: 0x0018, lo: 0xb0, hi: 0xb1},
+	{value: 0x0008, lo: 0xb2, hi: 0xb4},
+	{value: 0x3008, lo: 0xb5, hi: 0xb5},
+	{value: 0x3b08, lo: 0xb6, hi: 0xb6},
+	{value: 0x0040, lo: 0xb7, hi: 0xbf},
+	// Block 0x75, offset 0x3bb
+	{value: 0x0000, lo: 0x0c},
+	{value: 0x0040, lo: 0x80, hi: 0x80},
+	{value: 0x0008, lo: 0x81, hi: 0x86},
+	{value: 0x0040, lo: 0x87, hi: 0x88},
+	{value: 0x0008, lo: 0x89, hi: 0x8e},
+	{value: 0x0040, lo: 0x8f, hi: 0x90},
+	{value: 0x0008, lo: 0x91, hi: 0x96},
+	{value: 0x0040, lo: 0x97, hi: 0x9f},
+	{value: 0x0008, lo: 0xa0, hi: 0xa6},
+	{value: 0x0040, lo: 0xa7, hi: 0xa7},
+	{value: 0x0008, lo: 0xa8, hi: 0xae},
+	{value: 0x0040, lo: 0xaf, hi: 0xaf},
+	{value: 0x0008, lo: 0xb0, hi: 0xbf},
+	// Block 0x76, offset 0x3c8
+	{value: 0x0000, lo: 0x0b},
+	{value: 0x0008, lo: 0x80, hi: 0x9a},
+	{value: 0x0018, lo: 0x9b, hi: 0x9b},
+	{value: 0x449d, lo: 0x9c, hi: 0x9c},
+	{value: 0x44b5, lo: 0x9d, hi: 0x9d},
+	{value: 0x0941, lo: 0x9e, hi: 0x9e},
+	{value: 0xe06d, lo: 0x9f, hi: 0x9f},
+	{value: 0x0008, lo: 0xa0, hi: 0xa8},
+	{value: 0x13f9, lo: 0xa9, hi: 0xa9},
+	{value: 0x0018, lo: 0xaa, hi: 0xab},
+	{value: 0x0040, lo: 0xac, hi: 0xaf},
+	{value: 0x44cd, lo: 0xb0, hi: 0xbf},
+	// Block 0x77, offset 0x3d4
+	{value: 0x0000, lo: 0x04},
+	{value: 0x44ed, lo: 0x80, hi: 0x8f},
+	{value: 0x450d, lo: 0x90, hi: 0x9f},
+	{value: 0x452d, lo: 0xa0, hi: 0xaf},
+	{value: 0x450d, lo: 0xb0, hi: 0xbf},
+	// Block 0x78, offset 0x3d9
+	{value: 0x0000, lo: 0x0c},
+	{value: 0x0008, lo: 0x80, hi: 0xa2},
+	{value: 0x3008, lo: 0xa3, hi: 0xa4},
+	{value: 0x3308, lo: 0xa5, hi: 0xa5},
+	{value: 0x3008, lo: 0xa6, hi: 0xa7},
+	{value: 0x3308, lo: 0xa8, hi: 0xa8},
+	{value: 0x3008, lo: 0xa9, hi: 0xaa},
+	{value: 0x0018, lo: 0xab, hi: 0xab},
+	{value: 0x3008, lo: 0xac, hi: 0xac},
+	{value: 0x3b08, lo: 0xad, hi: 0xad},
+	{value: 0x0040, lo: 0xae, hi: 0xaf},
+	{value: 0x0008, lo: 0xb0, hi: 0xb9},
+	{value: 0x0040, lo: 0xba, hi: 0xbf},
+	// Block 0x79, offset 0x3e6
+	{value: 0x0000, lo: 0x03},
+	{value: 0x0008, lo: 0x80, hi: 0xa3},
+	{value: 0x0040, lo: 0xa4, hi: 0xaf},
+	{value: 0x0018, lo: 0xb0, hi: 0xbf},
+	// Block 0x7a, offset 0x3ea
+	{value: 0x0000, lo: 0x04},
+	{value: 0x0018, lo: 0x80, hi: 0x86},
+	{value: 0x0040, lo: 0x87, hi: 0x8a},
+	{value: 0x0018, lo: 0x8b, hi: 0xbb},
+	{value: 0x0040, lo: 0xbc, hi: 0xbf},
+	// Block 0x7b, offset 0x3ef
+	{value: 0x0000, lo: 0x01},
+	{value: 0x0040, lo: 0x80, hi: 0xbf},
+	// Block 0x7c, offset 0x3f1
+	{value: 0x0020, lo: 0x01},
+	{value: 0x454d, lo: 0x80, hi: 0xbf},
+	// Block 0x7d, offset 0x3f3
+	{value: 0x0020, lo: 0x03},
+	{value: 0x4d4d, lo: 0x80, hi: 0x94},
+	{value: 0x4b0d, lo: 0x95, hi: 0x95},
+	{value: 0x4fed, lo: 0x96, hi: 0xbf},
+	// Block 0x7e, offset 0x3f7
+	{value: 0x0020, lo: 0x01},
+	{value: 0x552d, lo: 0x80, hi: 0xbf},
+	// Block 0x7f, offset 0x3f9
+	{value: 0x0020, lo: 0x03},
+	{value: 0x5d2d, lo: 0x80, hi: 0x84},
+	{value: 0x568d, lo: 0x85, hi: 0x85},
+	{value: 0x5dcd, lo: 0x86, hi: 0xbf},
+	// Block 0x80, offset 0x3fd
+	{value: 0x0020, lo: 0x08},
+	{value: 0x6b8d, lo: 0x80, hi: 0x8f},
+	{value: 0x6d4d, lo: 0x90, hi: 0x90},
+	{value: 0x6d8d, lo: 0x91, hi: 0xab},
+	{value: 0x1401, lo: 0xac, hi: 0xac},
+	{value: 0x70ed, lo: 0xad, hi: 0xad},
+	{value: 0x0040, lo: 0xae, hi: 0xae},
+	{value: 0x0040, lo: 0xaf, hi: 0xaf},
+	{value: 0x710d, lo: 0xb0, hi: 0xbf},
+	// Block 0x81, offset 0x406
+	{value: 0x0020, lo: 0x05},
+	{value: 0x730d, lo: 0x80, hi: 0xad},
+	{value: 0x656d, lo: 0xae, hi: 0xae},
+	{value: 0x78cd, lo: 0xaf, hi: 0xb5},
+	{value: 0x6f8d, lo: 0xb6, hi: 0xb6},
+	{value: 0x79ad, lo: 0xb7, hi: 0xbf},
+	// Block 0x82, offset 0x40c
+	{value: 0x0008, lo: 0x03},
+	{value: 0x1751, lo: 0x80, hi: 0x82},
+	{value: 0x1741, lo: 0x83, hi: 0x83},
+	{value: 0x1769, lo: 0x84, hi: 0xbf},
+	// Block 0x83, offset 0x410
+	{value: 0x0008, lo: 0x0f},
+	{value: 0x1d81, lo: 0x80, hi: 0x83},
+	{value: 0x1d99, lo: 0x84, hi: 0x85},
+	{value: 0x1da1, lo: 0x86, hi: 0x87},
+	{value: 0x1da9, lo: 0x88, hi: 0x8f},
+	{value: 0x0040, lo: 0x90, hi: 0x90},
+	{value: 0x0040, lo: 0x91, hi: 0x91},
+	{value: 0x1de9, lo: 0x92, hi: 0x97},
+	{value: 0x1e11, lo: 0x98, hi: 0x9c},
+	{value: 0x1e31, lo: 0x9d, hi: 0xb3},
+	{value: 0x1d71, lo: 0xb4, hi: 0xb4},
+	{value: 0x1d81, lo: 0xb5, hi: 0xb5},
+	{value: 0x1ee9, lo: 0xb6, hi: 0xbb},
+	{value: 0x1f09, lo: 0xbc, hi: 0xbc},
+	{value: 0x1ef9, lo: 0xbd, hi: 0xbd},
+	{value: 0x1f19, lo: 0xbe, hi: 0xbf},
+	// Block 0x84, offset 0x420
+	{value: 0x0000, lo: 0x09},
+	{value: 0x0008, lo: 0x80, hi: 0x8b},
+	{value: 0x0040, lo: 0x8c, hi: 0x8c},
+	{value: 0x0008, lo: 0x8d, hi: 0xa6},
+	{value: 0x0040, lo: 0xa7, hi: 0xa7},
+	{value: 0x0008, lo: 0xa8, hi: 0xba},
+	{value: 0x0040, lo: 0xbb, hi: 0xbb},
+	{value: 0x0008, lo: 0xbc, hi: 0xbd},
+	{value: 0x0040, lo: 0xbe, hi: 0xbe},
+	{value: 0x0008, lo: 0xbf, hi: 0xbf},
+	// Block 0x85, offset 0x42a
+	{value: 0x0000, lo: 0x04},
+	{value: 0x0008, lo: 0x80, hi: 0x8d},
+	{value: 0x0040, lo: 0x8e, hi: 0x8f},
+	{value: 0x0008, lo: 0x90, hi: 0x9d},
+	{value: 0x0040, lo: 0x9e, hi: 0xbf},
+	// Block 0x86, offset 0x42f
+	{value: 0x0000, lo: 0x02},
+	{value: 0x0008, lo: 0x80, hi: 0xba},
+	{value: 0x0040, lo: 0xbb, hi: 0xbf},
+	// Block 0x87, offset 0x432
+	{value: 0x0000, lo: 0x05},
+	{value: 0x0018, lo: 0x80, hi: 0x82},
+	{value: 0x0040, lo: 0x83, hi: 0x86},
+	{value: 0x0018, lo: 0x87, hi: 0xb3},
+	{value: 0x0040, lo: 0xb4, hi: 0xb6},
+	{value: 0x0018, lo: 0xb7, hi: 0xbf},
+	// Block 0x88, offset 0x438
+	{value: 0x0000, lo: 0x06},
+	{value: 0x0018, lo: 0x80, hi: 0x8e},
+	{value: 0x0040, lo: 0x8f, hi: 0x8f},
+	{value: 0x0018, lo: 0x90, hi: 0x9c},
+	{value: 0x0040, lo: 0x9d, hi: 0x9f},
+	{value: 0x0018, lo: 0xa0, hi: 0xa0},
+	{value: 0x0040, lo: 0xa1, hi: 0xbf},
+	// Block 0x89, offset 0x43f
+	{value: 0x0000, lo: 0x04},
+	{value: 0x0040, lo: 0x80, hi: 0x8f},
+	{value: 0x0018, lo: 0x90, hi: 0xbc},
+	{value: 0x3308, lo: 0xbd, hi: 0xbd},
+	{value: 0x0040, lo: 0xbe, hi: 0xbf},
+	// Block 0x8a, offset 0x444
+	{value: 0x0000, lo: 0x03},
+	{value: 0x0008, lo: 0x80, hi: 0x9c},
+	{value: 0x0040, lo: 0x9d, hi: 0x9f},
+	{value: 0x0008, lo: 0xa0, hi: 0xbf},
+	// Block 0x8b, offset 0x448
+	{value: 0x0000, lo: 0x05},
+	{value: 0x0008, lo: 0x80, hi: 0x90},
+	{value: 0x0040, lo: 0x91, hi: 0x9f},
+	{value: 0x3308, lo: 0xa0, hi: 0xa0},
+	{value: 0x0018, lo: 0xa1, hi: 0xbb},
+	{value: 0x0040, lo: 0xbc, hi: 0xbf},
+	// Block 0x8c, offset 0x44e
+	{value: 0x0000, lo: 0x04},
+	{value: 0x0008, lo: 0x80, hi: 0x9f},
+	{value: 0x0018, lo: 0xa0, hi: 0xa3},
+	{value: 0x0040, lo: 0xa4, hi: 0xac},
+	{value: 0x0008, lo: 0xad, hi: 0xbf},
+	// Block 0x8d, offset 0x453
+	{value: 0x0000, lo: 0x08},
+	{value: 0x0008, lo: 0x80, hi: 0x80},
+	{value: 0x0018, lo: 0x81, hi: 0x81},
+	{value: 0x0008, lo: 0x82, hi: 0x89},
+	{value: 0x0018, lo: 0x8a, hi: 0x8a},
+	{value: 0x0040, lo: 0x8b, hi: 0x8f},
+	{value: 0x0008, lo: 0x90, hi: 0xb5},
+	{value: 0x3308, lo: 0xb6, hi: 0xba},
+	{value: 0x0040, lo: 0xbb, hi: 0xbf},
+	// Block 0x8e, offset 0x45c
+	{value: 0x0000, lo: 0x04},
+	{value: 0x0008, lo: 0x80, hi: 0x9d},
+	{value: 0x0040, lo: 0x9e, hi: 0x9e},
+	{value: 0x0018, lo: 0x9f, hi: 0x9f},
+	{value: 0x0008, lo: 0xa0, hi: 0xbf},
+	// Block 0x8f, offset 0x461
+	{value: 0x0000, lo: 0x05},
+	{value: 0x0008, lo: 0x80, hi: 0x83},
+	{value: 0x0040, lo: 0x84, hi: 0x87},
+	{value: 0x0008, lo: 0x88, hi: 0x8f},
+	{value: 0x0018, lo: 0x90, hi: 0x95},
+	{value: 0x0040, lo: 0x96, hi: 0xbf},
+	// Block 0x90, offset 0x467
+	{value: 0x0000, lo: 0x06},
+	{value: 0xe145, lo: 0x80, hi: 0x87},
+	{value: 0xe1c5, lo: 0x88, hi: 0x8f},
+	{value: 0xe145, lo: 0x90, hi: 0x97},
+	{value: 0x8b0d, lo: 0x98, hi: 0x9f},
+	{value: 0x8b25, lo: 0xa0, hi: 0xa7},
+	{value: 0x0008, lo: 0xa8, hi: 0xbf},
+	// Block 0x91, offset 0x46e
+	{value: 0x0000, lo: 0x06},
+	{value: 0x0008, lo: 0x80, hi: 0x9d},
+	{value: 0x0040, lo: 0x9e, hi: 0x9f},
+	{value: 0x0008, lo: 0xa0, hi: 0xa9},
+	{value: 0x0040, lo: 0xaa, hi: 0xaf},
+	{value: 0x8b25, lo: 0xb0, hi: 0xb7},
+	{value: 0x8b0d, lo: 0xb8, hi: 0xbf},
+	// Block 0x92, offset 0x475
+	{value: 0x0000, lo: 0x06},
+	{value: 0xe145, lo: 0x80, hi: 0x87},
+	{value: 0xe1c5, lo: 0x88, hi: 0x8f},
+	{value: 0xe145, lo: 0x90, hi: 0x93},
+	{value: 0x0040, lo: 0x94, hi: 0x97},
+	{value: 0x0008, lo: 0x98, hi: 0xbb},
+	{value: 0x0040, lo: 0xbc, hi: 0xbf},
+	// Block 0x93, offset 0x47c
+	{value: 0x0000, lo: 0x03},
+	{value: 0x0008, lo: 0x80, hi: 0xa7},
+	{value: 0x0040, lo: 0xa8, hi: 0xaf},
+	{value: 0x0008, lo: 0xb0, hi: 0xbf},
+	// Block 0x94, offset 0x480
+	{value: 0x0000, lo: 0x02},
+	{value: 0x0008, lo: 0x80, hi: 0xb6},
+	{value: 0x0040, lo: 0xb7, hi: 0xbf},
+	// Block 0x95, offset 0x483
+	{value: 0x0000, lo: 0x04},
+	{value: 0x0008, lo: 0x80, hi: 0x95},
+	{value: 0x0040, lo: 0x96, hi: 0x9f},
+	{value: 0x0008, lo: 0xa0, hi: 0xa7},
+	{value: 0x0040, lo: 0xa8, hi: 0xbf},
+	// Block 0x96, offset 0x488
+	{value: 0x0000, lo: 0x0b},
+	{value: 0x0808, lo: 0x80, hi: 0x85},
+	{value: 0x0040, lo: 0x86, hi: 0x87},
+	{value: 0x0808, lo: 0x88, hi: 0x88},
+	{value: 0x0040, lo: 0x89, hi: 0x89},
+	{value: 0x0808, lo: 0x8a, hi: 0xb5},
+	{value: 0x0040, lo: 0xb6, hi: 0xb6},
+	{value: 0x0808, lo: 0xb7, hi: 0xb8},
+	{value: 0x0040, lo: 0xb9, hi: 0xbb},
+	{value: 0x0808, lo: 0xbc, hi: 0xbc},
+	{value: 0x0040, lo: 0xbd, hi: 0xbe},
+	{value: 0x0808, lo: 0xbf, hi: 0xbf},
+	// Block 0x97, offset 0x494
+	{value: 0x0000, lo: 0x05},
+	{value: 0x0808, lo: 0x80, hi: 0x95},
+	{value: 0x0040, lo: 0x96, hi: 0x96},
+	{value: 0x0818, lo: 0x97, hi: 0x9f},
+	{value: 0x0808, lo: 0xa0, hi: 0xb6},
+	{value: 0x0818, lo: 0xb7, hi: 0xbf},
+	// Block 0x98, offset 0x49a
+	{value: 0x0000, lo: 0x04},
+	{value: 0x0808, lo: 0x80, hi: 0x9e},
+	{value: 0x0040, lo: 0x9f, hi: 0xa6},
+	{value: 0x0818, lo: 0xa7, hi: 0xaf},
+	{value: 0x0040, lo: 0xb0, hi: 0xbf},
+	// Block 0x99, offset 0x49f
+	{value: 0x0000, lo: 0x06},
+	{value: 0x0040, lo: 0x80, hi: 0x9f},
+	{value: 0x0808, lo: 0xa0, hi: 0xb2},
+	{value: 0x0040, lo: 0xb3, hi: 0xb3},
+	{value: 0x0808, lo: 0xb4, hi: 0xb5},
+	{value: 0x0040, lo: 0xb6, hi: 0xba},
+	{value: 0x0818, lo: 0xbb, hi: 0xbf},
+	// Block 0x9a, offset 0x4a6
+	{value: 0x0000, lo: 0x07},
+	{value: 0x0808, lo: 0x80, hi: 0x95},
+	{value: 0x0818, lo: 0x96, hi: 0x9b},
+	{value: 0x0040, lo: 0x9c, hi: 0x9e},
+	{value: 0x0018, lo: 0x9f, hi: 0x9f},
+	{value: 0x0808, lo: 0xa0, hi: 0xb9},
+	{value: 0x0040, lo: 0xba, hi: 0xbe},
+	{value: 0x0818, lo: 0xbf, hi: 0xbf},
+	// Block 0x9b, offset 0x4ae
+	{value: 0x0000, lo: 0x04},
+	{value: 0x0808, lo: 0x80, hi: 0xb7},
+	{value: 0x0040, lo: 0xb8, hi: 0xbb},
+	{value: 0x0818, lo: 0xbc, hi: 0xbd},
+	{value: 0x0808, lo: 0xbe, hi: 0xbf},
+	// Block 0x9c, offset 0x4b3
+	{value: 0x0000, lo: 0x03},
+	{value: 0x0818, lo: 0x80, hi: 0x8f},
+	{value: 0x0040, lo: 0x90, hi: 0x91},
+	{value: 0x0818, lo: 0x92, hi: 0xbf},
+	// Block 0x9d, offset 0x4b7
+	{value: 0x0000, lo: 0x0f},
+	{value: 0x0808, lo: 0x80, hi: 0x80},
+	{value: 0x3308, lo: 0x81, hi: 0x83},
+	{value: 0x0040, lo: 0x84, hi: 0x84},
+	{value: 0x3308, lo: 0x85, hi: 0x86},
+	{value: 0x0040, lo: 0x87, hi: 0x8b},
+	{value: 0x3308, lo: 0x8c, hi: 0x8f},
+	{value: 0x0808, lo: 0x90, hi: 0x93},
+	{value: 0x0040, lo: 0x94, hi: 0x94},
+	{value: 0x0808, lo: 0x95, hi: 0x97},
+	{value: 0x0040, lo: 0x98, hi: 0x98},
+	{value: 0x0808, lo: 0x99, hi: 0xb5},
+	{value: 0x0040, lo: 0xb6, hi: 0xb7},
+	{value: 0x3308, lo: 0xb8, hi: 0xba},
+	{value: 0x0040, lo: 0xbb, hi: 0xbe},
+	{value: 0x3b08, lo: 0xbf, hi: 0xbf},
+	// Block 0x9e, offset 0x4c7
+	{value: 0x0000, lo: 0x06},
+	{value: 0x0818, lo: 0x80, hi: 0x88},
+	{value: 0x0040, lo: 0x89, hi: 0x8f},
+	{value: 0x0818, lo: 0x90, hi: 0x98},
+	{value: 0x0040, lo: 0x99, hi: 0x9f},
+	{value: 0x0808, lo: 0xa0, hi: 0xbc},
+	{value: 0x0818, lo: 0xbd, hi: 0xbf},
+	// Block 0x9f, offset 0x4ce
+	{value: 0x0000, lo: 0x03},
+	{value: 0x0808, lo: 0x80, hi: 0x9c},
+	{value: 0x0818, lo: 0x9d, hi: 0x9f},
+	{value: 0x0040, lo: 0xa0, hi: 0xbf},
+	// Block 0xa0, offset 0x4d2
+	{value: 0x0000, lo: 0x03},
+	{value: 0x0808, lo: 0x80, hi: 0xb5},
+	{value: 0x0040, lo: 0xb6, hi: 0xb8},
+	{value: 0x0018, lo: 0xb9, hi: 0xbf},
+	// Block 0xa1, offset 0x4d6
+	{value: 0x0000, lo: 0x06},
+	{value: 0x0808, lo: 0x80, hi: 0x95},
+	{value: 0x0040, lo: 0x96, hi: 0x97},
+	{value: 0x0818, lo: 0x98, hi: 0x9f},
+	{value: 0x0808, lo: 0xa0, hi: 0xb2},
+	{value: 0x0040, lo: 0xb3, hi: 0xb7},
+	{value: 0x0818, lo: 0xb8, hi: 0xbf},
+	// Block 0xa2, offset 0x4dd
+	{value: 0x0000, lo: 0x01},
+	{value: 0x0808, lo: 0x80, hi: 0xbf},
+	// Block 0xa3, offset 0x4df
+	{value: 0x0000, lo: 0x02},
+	{value: 0x0808, lo: 0x80, hi: 0x88},
+	{value: 0x0040, lo: 0x89, hi: 0xbf},
+	// Block 0xa4, offset 0x4e2
+	{value: 0x0000, lo: 0x02},
+	{value: 0x03dd, lo: 0x80, hi: 0xb2},
+	{value: 0x0040, lo: 0xb3, hi: 0xbf},
+	// Block 0xa5, offset 0x4e5
+	{value: 0x0000, lo: 0x03},
+	{value: 0x0808, lo: 0x80, hi: 0xb2},
+	{value: 0x0040, lo: 0xb3, hi: 0xb9},
+	{value: 0x0818, lo: 0xba, hi: 0xbf},
+	// Block 0xa6, offset 0x4e9
+	{value: 0x0000, lo: 0x08},
+	{value: 0x0908, lo: 0x80, hi: 0x80},
+	{value: 0x0a08, lo: 0x81, hi: 0xa1},
+	{value: 0x0c08, lo: 0xa2, hi: 0xa2},
+	{value: 0x0a08, lo: 0xa3, hi: 0xa3},
+	{value: 0x3308, lo: 0xa4, hi: 0xa7},
+	{value: 0x0040, lo: 0xa8, hi: 0xaf},
+	{value: 0x0808, lo: 0xb0, hi: 0xb9},
+	{value: 0x0040, lo: 0xba, hi: 0xbf},
+	// Block 0xa7, offset 0x4f2
+	{value: 0x0000, lo: 0x03},
+	{value: 0x0040, lo: 0x80, hi: 0x9f},
+	{value: 0x0818, lo: 0xa0, hi: 0xbe},
+	{value: 0x0040, lo: 0xbf, hi: 0xbf},
+	// Block 0xa8, offset 0x4f6
+	{value: 0x0000, lo: 0x07},
+	{value: 0x0808, lo: 0x80, hi: 0xa9},
+	{value: 0x0040, lo: 0xaa, hi: 0xaa},
+	{value: 0x3308, lo: 0xab, hi: 0xac},
+	{value: 0x0818, lo: 0xad, hi: 0xad},
+	{value: 0x0040, lo: 0xae, hi: 0xaf},
+	{value: 0x0808, lo: 0xb0, hi: 0xb1},
+	{value: 0x0040, lo: 0xb2, hi: 0xbf},
+	// Block 0xa9, offset 0x4fe
+	{value: 0x0000, lo: 0x02},
+	{value: 0x0040, lo: 0x80, hi: 0xbc},
+	{value: 0x3308, lo: 0xbd, hi: 0xbf},
+	// Block 0xaa, offset 0x501
+	{value: 0x0000, lo: 0x07},
+	{value: 0x0808, lo: 0x80, hi: 0x9c},
+	{value: 0x0818, lo: 0x9d, hi: 0xa6},
+	{value: 0x0808, lo: 0xa7, hi: 0xa7},
+	{value: 0x0040, lo: 0xa8, hi: 0xaf},
+	{value: 0x0a08, lo: 0xb0, hi: 0xb2},
+	{value: 0x0c08, lo: 0xb3, hi: 0xb3},
+	{value: 0x0a08, lo: 0xb4, hi: 0xbf},
+	// Block 0xab, offset 0x509
+	{value: 0x0000, lo: 0x0a},
+	{value: 0x0a08, lo: 0x80, hi: 0x84},
+	{value: 0x0808, lo: 0x85, hi: 0x85},
+	{value: 0x3308, lo: 0x86, hi: 0x90},
+	{value: 0x0a18, lo: 0x91, hi: 0x93},
+	{value: 0x0c18, lo: 0x94, hi: 0x94},
+	{value: 0x0818, lo: 0x95, hi: 0x99},
+	{value: 0x0040, lo: 0x9a, hi: 0xaf},
+	{value: 0x0a08, lo: 0xb0, hi: 0xb3},
+	{value: 0x0c08, lo: 0xb4, hi: 0xb5},
+	{value: 0x0a08, lo: 0xb6, hi: 0xbf},
+	// Block 0xac, offset 0x514
+	{value: 0x0000, lo: 0x0e},
+	{value: 0x0a08, lo: 0x80, hi: 0x81},
+	{value: 0x3308, lo: 0x82, hi: 0x85},
+	{value: 0x0818, lo: 0x86, hi: 0x89},
+	{value: 0x0040, lo: 0x8a, hi: 0xaf},
+	{value: 0x0a08, lo: 0xb0, hi: 0xb0},
+	{value: 0x0808, lo: 0xb1, hi: 0xb1},
+	{value: 0x0a08, lo: 0xb2, hi: 0xb3},
+	{value: 0x0c08, lo: 0xb4, hi: 0xb6},
+	{value: 0x0808, lo: 0xb7, hi: 0xb7},
+	{value: 0x0a08, lo: 0xb8, hi: 0xb8},
+	{value: 0x0c08, lo: 0xb9, hi: 0xba},
+	{value: 0x0a08, lo: 0xbb, hi: 0xbc},
+	{value: 0x0c08, lo: 0xbd, hi: 0xbd},
+	{value: 0x0a08, lo: 0xbe, hi: 0xbf},
+	// Block 0xad, offset 0x523
+	{value: 0x0000, lo: 0x0b},
+	{value: 0x0808, lo: 0x80, hi: 0x80},
+	{value: 0x0a08, lo: 0x81, hi: 0x81},
+	{value: 0x0c08, lo: 0x82, hi: 0x83},
+	{value: 0x0a08, lo: 0x84, hi: 0x84},
+	{value: 0x0818, lo: 0x85, hi: 0x88},
+	{value: 0x0c18, lo: 0x89, hi: 0x89},
+	{value: 0x0a18, lo: 0x8a, hi: 0x8a},
+	{value: 0x0918, lo: 0x8b, hi: 0x8b},
+	{value: 0x0040, lo: 0x8c, hi: 0x9f},
+	{value: 0x0808, lo: 0xa0, hi: 0xb6},
+	{value: 0x0040, lo: 0xb7, hi: 0xbf},
+	// Block 0xae, offset 0x52f
+	{value: 0x0000, lo: 0x05},
+	{value: 0x3008, lo: 0x80, hi: 0x80},
+	{value: 0x3308, lo: 0x81, hi: 0x81},
+	{value: 0x3008, lo: 0x82, hi: 0x82},
+	{value: 0x0008, lo: 0x83, hi: 0xb7},
+	{value: 0x3308, lo: 0xb8, hi: 0xbf},
+	// Block 0xaf, offset 0x535
+	{value: 0x0000, lo: 0x0c},
+	{value: 0x3308, lo: 0x80, hi: 0x85},
+	{value: 0x3b08, lo: 0x86, hi: 0x86},
+	{value: 0x0018, lo: 0x87, hi: 0x8d},
+	{value: 0x0040, lo: 0x8e, hi: 0x91},
+	{value: 0x0018, lo: 0x92, hi: 0xa5},
+	{value: 0x0008, lo: 0xa6, hi: 0xaf},
+	{value: 0x3b08, lo: 0xb0, hi: 0xb0},
+	{value: 0x0008, lo: 0xb1, hi: 0xb2},
+	{value: 0x3308, lo: 0xb3, hi: 0xb4},
+	{value: 0x0008, lo: 0xb5, hi: 0xb5},
+	{value: 0x0040, lo: 0xb6, hi: 0xbe},
+	{value: 0x3b08, lo: 0xbf, hi: 0xbf},
+	// Block 0xb0, offset 0x542
+	{value: 0x0000, lo: 0x0b},
+	{value: 0x3308, lo: 0x80, hi: 0x81},
+	{value: 0x3008, lo: 0x82, hi: 0x82},
+	{value: 0x0008, lo: 0x83, hi: 0xaf},
+	{value: 0x3008, lo: 0xb0, hi: 0xb2},
+	{value: 0x3308, lo: 0xb3, hi: 0xb6},
+	{value: 0x3008, lo: 0xb7, hi: 0xb8},
+	{value: 0x3b08, lo: 0xb9, hi: 0xb9},
+	{value: 0x3308, lo: 0xba, hi: 0xba},
+	{value: 0x0018, lo: 0xbb, hi: 0xbc},
+	{value: 0x0040, lo: 0xbd, hi: 0xbd},
+	{value: 0x0018, lo: 0xbe, hi: 0xbf},
+	// Block 0xb1, offset 0x54e
+	{value: 0x0000, lo: 0x07},
+	{value: 0x0018, lo: 0x80, hi: 0x81},
+	{value: 0x3308, lo: 0x82, hi: 0x82},
+	{value: 0x0040, lo: 0x83, hi: 0x8f},
+	{value: 0x0008, lo: 0x90, hi: 0xa8},
+	{value: 0x0040, lo: 0xa9, hi: 0xaf},
+	{value: 0x0008, lo: 0xb0, hi: 0xb9},
+	{value: 0x0040, lo: 0xba, hi: 0xbf},
+	// Block 0xb2, offset 0x556
+	{value: 0x0000, lo: 0x08},
+	{value: 0x3308, lo: 0x80, hi: 0x82},
+	{value: 0x0008, lo: 0x83, hi: 0xa6},
+	{value: 0x3308, lo: 0xa7, hi: 0xab},
+	{value: 0x3008, lo: 0xac, hi: 0xac},
+	{value: 0x3308, lo: 0xad, hi: 0xb2},
+	{value: 0x3b08, lo: 0xb3, hi: 0xb4},
+	{value: 0x0040, lo: 0xb5, hi: 0xb5},
+	{value: 0x0008, lo: 0xb6, hi: 0xbf},
+	// Block 0xb3, offset 0x55f
+	{value: 0x0000, lo: 0x0a},
+	{value: 0x0018, lo: 0x80, hi: 0x83},
+	{value: 0x0008, lo: 0x84, hi: 0x84},
+	{value: 0x3008, lo: 0x85, hi: 0x86},
+	{value: 0x0008, lo: 0x87, hi: 0x87},
+	{value: 0x0040, lo: 0x88, hi: 0x8f},
+	{value: 0x0008, lo: 0x90, hi: 0xb2},
+	{value: 0x3308, lo: 0xb3, hi: 0xb3},
+	{value: 0x0018, lo: 0xb4, hi: 0xb5},
+	{value: 0x0008, lo: 0xb6, hi: 0xb6},
+	{value: 0x0040, lo: 0xb7, hi: 0xbf},
+	// Block 0xb4, offset 0x56a
+	{value: 0x0000, lo: 0x06},
+	{value: 0x3308, lo: 0x80, hi: 0x81},
+	{value: 0x3008, lo: 0x82, hi: 0x82},
+	{value: 0x0008, lo: 0x83, hi: 0xb2},
+	{value: 0x3008, lo: 0xb3, hi: 0xb5},
+	{value: 0x3308, lo: 0xb6, hi: 0xbe},
+	{value: 0x3008, lo: 0xbf, hi: 0xbf},
+	// Block 0xb5, offset 0x571
+	{value: 0x0000, lo: 0x0e},
+	{value: 0x3808, lo: 0x80, hi: 0x80},
+	{value: 0x0008, lo: 0x81, hi: 0x84},
+	{value: 0x0018, lo: 0x85, hi: 0x88},
+	{value: 0x3308, lo: 0x89, hi: 0x8c},
+	{value: 0x0018, lo: 0x8d, hi: 0x8d},
+	{value: 0x3008, lo: 0x8e, hi: 0x8e},
+	{value: 0x3308, lo: 0x8f, hi: 0x8f},
+	{value: 0x0008, lo: 0x90, hi: 0x9a},
+	{value: 0x0018, lo: 0x9b, hi: 0x9b},
+	{value: 0x0008, lo: 0x9c, hi: 0x9c},
+	{value: 0x0018, lo: 0x9d, hi: 0x9f},
+	{value: 0x0040, lo: 0xa0, hi: 0xa0},
+	{value: 0x0018, lo: 0xa1, hi: 0xb4},
+	{value: 0x0040, lo: 0xb5, hi: 0xbf},
+	// Block 0xb6, offset 0x580
+	{value: 0x0000, lo: 0x0c},
+	{value: 0x0008, lo: 0x80, hi: 0x91},
+	{value: 0x0040, lo: 0x92, hi: 0x92},
+	{value: 0x0008, lo: 0x93, hi: 0xab},
+	{value: 0x3008, lo: 0xac, hi: 0xae},
+	{value: 0x3308, lo: 0xaf, hi: 0xb1},
+	{value: 0x3008, lo: 0xb2, hi: 0xb3},
+	{value: 0x3308, lo: 0xb4, hi: 0xb4},
+	{value: 0x3808, lo: 0xb5, hi: 0xb5},
+	{value: 0x3308, lo: 0xb6, hi: 0xb7},
+	{value: 0x0018, lo: 0xb8, hi: 0xbd},
+	{value: 0x3308, lo: 0xbe, hi: 0xbe},
+	{value: 0x0008, lo: 0xbf, hi: 0xbf},
+	// Block 0xb7, offset 0x58d
+	{value: 0x0000, lo: 0x03},
+	{value: 0x0008, lo: 0x80, hi: 0x80},
+	{value: 0x3308, lo: 0x81, hi: 0x81},
+	{value: 0x0040, lo: 0x82, hi: 0xbf},
+	// Block 0xb8, offset 0x591
+	{value: 0x0000, lo: 0x0c},
+	{value: 0x0008, lo: 0x80, hi: 0x86},
+	{value: 0x0040, lo: 0x87, hi: 0x87},
+	{value: 0x0008, lo: 0x88, hi: 0x88},
+	{value: 0x0040, lo: 0x89, hi: 0x89},
+	{value: 0x0008, lo: 0x8a, hi: 0x8d},
+	{value: 0x0040, lo: 0x8e, hi: 0x8e},
+	{value: 0x0008, lo: 0x8f, hi: 0x9d},
+	{value: 0x0040, lo: 0x9e, hi: 0x9e},
+	{value: 0x0008, lo: 0x9f, hi: 0xa8},
+	{value: 0x0018, lo: 0xa9, hi: 0xa9},
+	{value: 0x0040, lo: 0xaa, hi: 0xaf},
+	{value: 0x0008, lo: 0xb0, hi: 0xbf},
+	// Block 0xb9, offset 0x59e
+	{value: 0x0000, lo: 0x08},
+	{value: 0x0008, lo: 0x80, hi: 0x9e},
+	{value: 0x3308, lo: 0x9f, hi: 0x9f},
+	{value: 0x3008, lo: 0xa0, hi: 0xa2},
+	{value: 0x3308, lo: 0xa3, hi: 0xa9},
+	{value: 0x3b08, lo: 0xaa, hi: 0xaa},
+	{value: 0x0040, lo: 0xab, hi: 0xaf},
+	{value: 0x0008, lo: 0xb0, hi: 0xb9},
+	{value: 0x0040, lo: 0xba, hi: 0xbf},
+	// Block 0xba, offset 0x5a7
+	{value: 0x0000, lo: 0x03},
+	{value: 0x0008, lo: 0x80, hi: 0xb4},
+	{value: 0x3008, lo: 0xb5, hi: 0xb7},
+	{value: 0x3308, lo: 0xb8, hi: 0xbf},
+	// Block 0xbb, offset 0x5ab
+	{value: 0x0000, lo: 0x0e},
+	{value: 0x3008, lo: 0x80, hi: 0x81},
+	{value: 0x3b08, lo: 0x82, hi: 0x82},
+	{value: 0x3308, lo: 0x83, hi: 0x84},
+	{value: 0x3008, lo: 0x85, hi: 0x85},
+	{value: 0x3308, lo: 0x86, hi: 0x86},
+	{value: 0x0008, lo: 0x87, hi: 0x8a},
+	{value: 0x0018, lo: 0x8b, hi: 0x8f},
+	{value: 0x0008, lo: 0x90, hi: 0x99},
+	{value: 0x0018, lo: 0x9a, hi: 0x9b},
+	{value: 0x0040, lo: 0x9c, hi: 0x9c},
+	{value: 0x0018, lo: 0x9d, hi: 0x9d},
+	{value: 0x3308, lo: 0x9e, hi: 0x9e},
+	{value: 0x0008, lo: 0x9f, hi: 0xa1},
+	{value: 0x0040, lo: 0xa2, hi: 0xbf},
+	// Block 0xbc, offset 0x5ba
+	{value: 0x0000, lo: 0x07},
+	{value: 0x0008, lo: 0x80, hi: 0xaf},
+	{value: 0x3008, lo: 0xb0, hi: 0xb2},
+	{value: 0x3308, lo: 0xb3, hi: 0xb8},
+	{value: 0x3008, lo: 0xb9, hi: 0xb9},
+	{value: 0x3308, lo: 0xba, hi: 0xba},
+	{value: 0x3008, lo: 0xbb, hi: 0xbe},
+	{value: 0x3308, lo: 0xbf, hi: 0xbf},
+	// Block 0xbd, offset 0x5c2
+	{value: 0x0000, lo: 0x0a},
+	{value: 0x3308, lo: 0x80, hi: 0x80},
+	{value: 0x3008, lo: 0x81, hi: 0x81},
+	{value: 0x3b08, lo: 0x82, hi: 0x82},
+	{value: 0x3308, lo: 0x83, hi: 0x83},
+	{value: 0x0008, lo: 0x84, hi: 0x85},
+	{value: 0x0018, lo: 0x86, hi: 0x86},
+	{value: 0x0008, lo: 0x87, hi: 0x87},
+	{value: 0x0040, lo: 0x88, hi: 0x8f},
+	{value: 0x0008, lo: 0x90, hi: 0x99},
+	{value: 0x0040, lo: 0x9a, hi: 0xbf},
+	// Block 0xbe, offset 0x5cd
+	{value: 0x0000, lo: 0x08},
+	{value: 0x0008, lo: 0x80, hi: 0xae},
+	{value: 0x3008, lo: 0xaf, hi: 0xb1},
+	{value: 0x3308, lo: 0xb2, hi: 0xb5},
+	{value: 0x0040, lo: 0xb6, hi: 0xb7},
+	{value: 0x3008, lo: 0xb8, hi: 0xbb},
+	{value: 0x3308, lo: 0xbc, hi: 0xbd},
+	{value: 0x3008, lo: 0xbe, hi: 0xbe},
+	{value: 0x3b08, lo: 0xbf, hi: 0xbf},
+	// Block 0xbf, offset 0x5d6
+	{value: 0x0000, lo: 0x05},
+	{value: 0x3308, lo: 0x80, hi: 0x80},
+	{value: 0x0018, lo: 0x81, hi: 0x97},
+	{value: 0x0008, lo: 0x98, hi: 0x9b},
+	{value: 0x3308, lo: 0x9c, hi: 0x9d},
+	{value: 0x0040, lo: 0x9e, hi: 0xbf},
+	// Block 0xc0, offset 0x5dc
+	{value: 0x0000, lo: 0x07},
+	{value: 0x0008, lo: 0x80, hi: 0xaf},
+	{value: 0x3008, lo: 0xb0, hi: 0xb2},
+	{value: 0x3308, lo: 0xb3, hi: 0xba},
+	{value: 0x3008, lo: 0xbb, hi: 0xbc},
+	{value: 0x3308, lo: 0xbd, hi: 0xbd},
+	{value: 0x3008, lo: 0xbe, hi: 0xbe},
+	{value: 0x3b08, lo: 0xbf, hi: 0xbf},
+	// Block 0xc1, offset 0x5e4
+	{value: 0x0000, lo: 0x08},
+	{value: 0x3308, lo: 0x80, hi: 0x80},
+	{value: 0x0018, lo: 0x81, hi: 0x83},
+	{value: 0x0008, lo: 0x84, hi: 0x84},
+	{value: 0x0040, lo: 0x85, hi: 0x8f},
+	{value: 0x0008, lo: 0x90, hi: 0x99},
+	{value: 0x0040, lo: 0x9a, hi: 0x9f},
+	{value: 0x0018, lo: 0xa0, hi: 0xac},
+	{value: 0x0040, lo: 0xad, hi: 0xbf},
+	// Block 0xc2, offset 0x5ed
+	{value: 0x0000, lo: 0x0b},
+	{value: 0x0008, lo: 0x80, hi: 0xaa},
+	{value: 0x3308, lo: 0xab, hi: 0xab},
+	{value: 0x3008, lo: 0xac, hi: 0xac},
+	{value: 0x3308, lo: 0xad, hi: 0xad},
+	{value: 0x3008, lo: 0xae, hi: 0xaf},
+	{value: 0x3308, lo: 0xb0, hi: 0xb5},
+	{value: 0x3808, lo: 0xb6, hi: 0xb6},
+	{value: 0x3308, lo: 0xb7, hi: 0xb7},
+	{value: 0x0008, lo: 0xb8, hi: 0xb8},
+	{value: 0x0018, lo: 0xb9, hi: 0xb9},
+	{value: 0x0040, lo: 0xba, hi: 0xbf},
+	// Block 0xc3, offset 0x5f9
+	{value: 0x0000, lo: 0x02},
+	{value: 0x0008, lo: 0x80, hi: 0x89},
+	{value: 0x0040, lo: 0x8a, hi: 0xbf},
+	// Block 0xc4, offset 0x5fc
+	{value: 0x0000, lo: 0x0b},
+	{value: 0x0008, lo: 0x80, hi: 0x9a},
+	{value: 0x0040, lo: 0x9b, hi: 0x9c},
+	{value: 0x3308, lo: 0x9d, hi: 0x9f},
+	{value: 0x3008, lo: 0xa0, hi: 0xa1},
+	{value: 0x3308, lo: 0xa2, hi: 0xa5},
+	{value: 0x3008, lo: 0xa6, hi: 0xa6},
+	{value: 0x3308, lo: 0xa7, hi: 0xaa},
+	{value: 0x3b08, lo: 0xab, hi: 0xab},
+	{value: 0x0040, lo: 0xac, hi: 0xaf},
+	{value: 0x0008, lo: 0xb0, hi: 0xb9},
+	{value: 0x0018, lo: 0xba, hi: 0xbf},
+	// Block 0xc5, offset 0x608
+	{value: 0x0000, lo: 0x02},
+	{value: 0x0008, lo: 0x80, hi: 0x86},
+	{value: 0x0040, lo: 0x87, hi: 0xbf},
+	// Block 0xc6, offset 0x60b
+	{value: 0x0000, lo: 0x08},
+	{value: 0x0008, lo: 0x80, hi: 0xab},
+	{value: 0x3008, lo: 0xac, hi: 0xae},
+	{value: 0x3308, lo: 0xaf, hi: 0xb7},
+	{value: 0x3008, lo: 0xb8, hi: 0xb8},
+	{value: 0x3b08, lo: 0xb9, hi: 0xb9},
+	{value: 0x3308, lo: 0xba, hi: 0xba},
+	{value: 0x0018, lo: 0xbb, hi: 0xbb},
+	{value: 0x0040, lo: 0xbc, hi: 0xbf},
+	// Block 0xc7, offset 0x614
+	{value: 0x0000, lo: 0x02},
+	{value: 0x0040, lo: 0x80, hi: 0x9f},
+	{value: 0x049d, lo: 0xa0, hi: 0xbf},
+	// Block 0xc8, offset 0x617
+	{value: 0x0000, lo: 0x04},
+	{value: 0x0008, lo: 0x80, hi: 0xa9},
+	{value: 0x0018, lo: 0xaa, hi: 0xb2},
+	{value: 0x0040, lo: 0xb3, hi: 0xbe},
+	{value: 0x0008, lo: 0xbf, hi: 0xbf},
+	// Block 0xc9, offset 0x61c
+	{value: 0x0000, lo: 0x08},
+	{value: 0x3008, lo: 0x80, hi: 0x80},
+	{value: 0x0008, lo: 0x81, hi: 0x81},
+	{value: 0x3008, lo: 0x82, hi: 0x82},
+	{value: 0x3308, lo: 0x83, hi: 0x83},
+	{value: 0x0018, lo: 0x84, hi: 0x86},
+	{value: 0x0040, lo: 0x87, hi: 0x8f},
+	{value: 0x0008, lo: 0x90, hi: 0x99},
+	{value: 0x0040, lo: 0x9a, hi: 0xbf},
+	// Block 0xca, offset 0x625
+	{value: 0x0000, lo: 0x04},
+	{value: 0x0040, lo: 0x80, hi: 0x9f},
+	{value: 0x0008, lo: 0xa0, hi: 0xa7},
+	{value: 0x0040, lo: 0xa8, hi: 0xa9},
+	{value: 0x0008, lo: 0xaa, hi: 0xbf},
+	// Block 0xcb, offset 0x62a
+	{value: 0x0000, lo: 0x0c},
+	{value: 0x0008, lo: 0x80, hi: 0x90},
+	{value: 0x3008, lo: 0x91, hi: 0x93},
+	{value: 0x3308, lo: 0x94, hi: 0x97},
+	{value: 0x0040, lo: 0x98, hi: 0x99},
+	{value: 0x3308, lo: 0x9a, hi: 0x9b},
+	{value: 0x3008, lo: 0x9c, hi: 0x9f},
+	{value: 0x3b08, lo: 0xa0, hi: 0xa0},
+	{value: 0x0008, lo: 0xa1, hi: 0xa1},
+	{value: 0x0018, lo: 0xa2, hi: 0xa2},
+	{value: 0x0008, lo: 0xa3, hi: 0xa3},
+	{value: 0x3008, lo: 0xa4, hi: 0xa4},
+	{value: 0x0040, lo: 0xa5, hi: 0xbf},
+	// Block 0xcc, offset 0x637
+	{value: 0x0000, lo: 0x0a},
+	{value: 0x0008, lo: 0x80, hi: 0x80},
+	{value: 0x3308, lo: 0x81, hi: 0x8a},
+	{value: 0x0008, lo: 0x8b, hi: 0xb2},
+	{value: 0x3308, lo: 0xb3, hi: 0xb3},
+	{value: 0x3b08, lo: 0xb4, hi: 0xb4},
+	{value: 0x3308, lo: 0xb5, hi: 0xb8},
+	{value: 0x3008, lo: 0xb9, hi: 0xb9},
+	{value: 0x0008, lo: 0xba, hi: 0xba},
+	{value: 0x3308, lo: 0xbb, hi: 0xbe},
+	{value: 0x0018, lo: 0xbf, hi: 0xbf},
+	// Block 0xcd, offset 0x642
+	{value: 0x0000, lo: 0x08},
+	{value: 0x0018, lo: 0x80, hi: 0x86},
+	{value: 0x3b08, lo: 0x87, hi: 0x87},
+	{value: 0x0040, lo: 0x88, hi: 0x8f},
+	{value: 0x0008, lo: 0x90, hi: 0x90},
+	{value: 0x3308, lo: 0x91, hi: 0x96},
+	{value: 0x3008, lo: 0x97, hi: 0x98},
+	{value: 0x3308, lo: 0x99, hi: 0x9b},
+	{value: 0x0008, lo: 0x9c, hi: 0xbf},
+	// Block 0xce, offset 0x64b
+	{value: 0x0000, lo: 0x0a},
+	{value: 0x0008, lo: 0x80, hi: 0x89},
+	{value: 0x3308, lo: 0x8a, hi: 0x96},
+	{value: 0x3008, lo: 0x97, hi: 0x97},
+	{value: 0x3308, lo: 0x98, hi: 0x98},
+	{value: 0x3b08, lo: 0x99, hi: 0x99},
+	{value: 0x0018, lo: 0x9a, hi: 0x9c},
+	{value: 0x0008, lo: 0x9d, hi: 0x9d},
+	{value: 0x0018, lo: 0x9e, hi: 0xa2},
+	{value: 0x0040, lo: 0xa3, hi: 0xaf},
+	{value: 0x0008, lo: 0xb0, hi: 0xbf},
+	// Block 0xcf, offset 0x656
+	{value: 0x0000, lo: 0x02},
+	{value: 0x0008, lo: 0x80, hi: 0xb8},
+	{value: 0x0040, lo: 0xb9, hi: 0xbf},
+	// Block 0xd0, offset 0x659
+	{value: 0x0000, lo: 0x02},
+	{value: 0x0018, lo: 0x80, hi: 0x89},
+	{value: 0x0040, lo: 0x8a, hi: 0xbf},
+	// Block 0xd1, offset 0x65c
+	{value: 0x0000, lo: 0x09},
+	{value: 0x0008, lo: 0x80, hi: 0x88},
+	{value: 0x0040, lo: 0x89, hi: 0x89},
+	{value: 0x0008, lo: 0x8a, hi: 0xae},
+	{value: 0x3008, lo: 0xaf, hi: 0xaf},
+	{value: 0x3308, lo: 0xb0, hi: 0xb6},
+	{value: 0x0040, lo: 0xb7, hi: 0xb7},
+	{value: 0x3308, lo: 0xb8, hi: 0xbd},
+	{value: 0x3008, lo: 0xbe, hi: 0xbe},
+	{value: 0x3b08, lo: 0xbf, hi: 0xbf},
+	// Block 0xd2, offset 0x666
+	{value: 0x0000, lo: 0x08},
+	{value: 0x0008, lo: 0x80, hi: 0x80},
+	{value: 0x0018, lo: 0x81, hi: 0x85},
+	{value: 0x0040, lo: 0x86, hi: 0x8f},
+	{value: 0x0008, lo: 0x90, hi: 0x99},
+	{value: 0x0018, lo: 0x9a, hi: 0xac},
+	{value: 0x0040, lo: 0xad, hi: 0xaf},
+	{value: 0x0018, lo: 0xb0, hi: 0xb1},
+	{value: 0x0008, lo: 0xb2, hi: 0xbf},
+	// Block 0xd3, offset 0x66f
+	{value: 0x0000, lo: 0x0b},
+	{value: 0x0008, lo: 0x80, hi: 0x8f},
+	{value: 0x0040, lo: 0x90, hi: 0x91},
+	{value: 0x3308, lo: 0x92, hi: 0xa7},
+	{value: 0x0040, lo: 0xa8, hi: 0xa8},
+	{value: 0x3008, lo: 0xa9, hi: 0xa9},
+	{value: 0x3308, lo: 0xaa, hi: 0xb0},
+	{value: 0x3008, lo: 0xb1, hi: 0xb1},
+	{value: 0x3308, lo: 0xb2, hi: 0xb3},
+	{value: 0x3008, lo: 0xb4, hi: 0xb4},
+	{value: 0x3308, lo: 0xb5, hi: 0xb6},
+	{value: 0x0040, lo: 0xb7, hi: 0xbf},
+	// Block 0xd4, offset 0x67b
+	{value: 0x0000, lo: 0x0c},
+	{value: 0x0008, lo: 0x80, hi: 0x86},
+	{value: 0x0040, lo: 0x87, hi: 0x87},
+	{value: 0x0008, lo: 0x88, hi: 0x89},
+	{value: 0x0040, lo: 0x8a, hi: 0x8a},
+	{value: 0x0008, lo: 0x8b, hi: 0xb0},
+	{value: 0x3308, lo: 0xb1, hi: 0xb6},
+	{value: 0x0040, lo: 0xb7, hi: 0xb9},
+	{value: 0x3308, lo: 0xba, hi: 0xba},
+	{value: 0x0040, lo: 0xbb, hi: 0xbb},
+	{value: 0x3308, lo: 0xbc, hi: 0xbd},
+	{value: 0x0040, lo: 0xbe, hi: 0xbe},
+	{value: 0x3308, lo: 0xbf, hi: 0xbf},
+	// Block 0xd5, offset 0x688
+	{value: 0x0000, lo: 0x0c},
+	{value: 0x3308, lo: 0x80, hi: 0x83},
+	{value: 0x3b08, lo: 0x84, hi: 0x85},
+	{value: 0x0008, lo: 0x86, hi: 0x86},
+	{value: 0x3308, lo: 0x87, hi: 0x87},
+	{value: 0x0040, lo: 0x88, hi: 0x8f},
+	{value: 0x0008, lo: 0x90, hi: 0x99},
+	{value: 0x0040, lo: 0x9a, hi: 0x9f},
+	{value: 0x0008, lo: 0xa0, hi: 0xa5},
+	{value: 0x0040, lo: 0xa6, hi: 0xa6},
+	{value: 0x0008, lo: 0xa7, hi: 0xa8},
+	{value: 0x0040, lo: 0xa9, hi: 0xa9},
+	{value: 0x0008, lo: 0xaa, hi: 0xbf},
+	// Block 0xd6, offset 0x695
+	{value: 0x0000, lo: 0x0d},
+	{value: 0x0008, lo: 0x80, hi: 0x89},
+	{value: 0x3008, lo: 0x8a, hi: 0x8e},
+	{value: 0x0040, lo: 0x8f, hi: 0x8f},
+	{value: 0x3308, lo: 0x90, hi: 0x91},
+	{value: 0x0040, lo: 0x92, hi: 0x92},
+	{value: 0x3008, lo: 0x93, hi: 0x94},
+	{value: 0x3308, lo: 0x95, hi: 0x95},
+	{value: 0x3008, lo: 0x96, hi: 0x96},
+	{value: 0x3b08, lo: 0x97, hi: 0x97},
+	{value: 0x0008, lo: 0x98, hi: 0x98},
+	{value: 0x0040, lo: 0x99, hi: 0x9f},
+	{value: 0x0008, lo: 0xa0, hi: 0xa9},
+	{value: 0x0040, lo: 0xaa, hi: 0xbf},
+	// Block 0xd7, offset 0x6a3
+	{value: 0x0000, lo: 0x06},
+	{value: 0x0040, lo: 0x80, hi: 0x9f},
+	{value: 0x0008, lo: 0xa0, hi: 0xb2},
+	{value: 0x3308, lo: 0xb3, hi: 0xb4},
+	{value: 0x3008, lo: 0xb5, hi: 0xb6},
+	{value: 0x0018, lo: 0xb7, hi: 0xb8},
+	{value: 0x0040, lo: 0xb9, hi: 0xbf},
+	// Block 0xd8, offset 0x6aa
+	{value: 0x0000, lo: 0x0a},
+	{value: 0x3308, lo: 0x80, hi: 0x81},
+	{value: 0x0008, lo: 0x82, hi: 0x82},
+	{value: 0x3008, lo: 0x83, hi: 0x83},
+	{value: 0x0008, lo: 0x84, hi: 0x90},
+	{value: 0x0040, lo: 0x91, hi: 0x91},
+	{value: 0x0008, lo: 0x92, hi: 0xb3},
+	{value: 0x3008, lo: 0xb4, hi: 0xb5},
+	{value: 0x3308, lo: 0xb6, hi: 0xba},
+	{value: 0x0040, lo: 0xbb, hi: 0xbd},
+	{value: 0x3008, lo: 0xbe, hi: 0xbf},
+	// Block 0xd9, offset 0x6b5
+	{value: 0x0000, lo: 0x06},
+	{value: 0x3308, lo: 0x80, hi: 0x80},
+	{value: 0x3808, lo: 0x81, hi: 0x81},
+	{value: 0x3b08, lo: 0x82, hi: 0x82},
+	{value: 0x0018, lo: 0x83, hi: 0x8f},
+	{value: 0x0008, lo: 0x90, hi: 0x99},
+	{value: 0x0040, lo: 0x9a, hi: 0xbf},
+	// Block 0xda, offset 0x6bc
+	{value: 0x0000, lo: 0x03},
+	{value: 0x0040, lo: 0x80, hi: 0xaf},
+	{value: 0x0008, lo: 0xb0, hi: 0xb0},
+	{value: 0x0040, lo: 0xb1, hi: 0xbf},
+	// Block 0xdb, offset 0x6c0
+	{value: 0x0000, lo: 0x03},
+	{value: 0x0018, lo: 0x80, hi: 0xb1},
+	{value: 0x0040, lo: 0xb2, hi: 0xbe},
+	{value: 0x0018, lo: 0xbf, hi: 0xbf},
+	// Block 0xdc, offset 0x6c4
+	{value: 0x0000, lo: 0x02},
+	{value: 0x0008, lo: 0x80, hi: 0x99},
+	{value: 0x0040, lo: 0x9a, hi: 0xbf},
+	// Block 0xdd, offset 0x6c7
+	{value: 0x0000, lo: 0x04},
+	{value: 0x0018, lo: 0x80, hi: 0xae},
+	{value: 0x0040, lo: 0xaf, hi: 0xaf},
+	{value: 0x0018, lo: 0xb0, hi: 0xb4},
+	{value: 0x0040, lo: 0xb5, hi: 0xbf},
+	// Block 0xde, offset 0x6cc
+	{value: 0x0000, lo: 0x02},
+	{value: 0x0008, lo: 0x80, hi: 0x83},
+	{value: 0x0040, lo: 0x84, hi: 0xbf},
+	// Block 0xdf, offset 0x6cf
+	{value: 0x0000, lo: 0x02},
+	{value: 0x0040, lo: 0x80, hi: 0x8f},
+	{value: 0x0008, lo: 0x90, hi: 0xbf},
+	// Block 0xe0, offset 0x6d2
+	{value: 0x0000, lo: 0x03},
+	{value: 0x0008, lo: 0x80, hi: 0xb0},
+	{value: 0x0018, lo: 0xb1, hi: 0xb2},
+	{value: 0x0040, lo: 0xb3, hi: 0xbf},
+	// Block 0xe1, offset 0x6d6
+	{value: 0x0000, lo: 0x02},
+	{value: 0x0008, lo: 0x80, hi: 0xaf},
+	{value: 0x0340, lo: 0xb0, hi: 0xbf},
+	// Block 0xe2, offset 0x6d9
+	{value: 0x0000, lo: 0x04},
+	{value: 0x3308, lo: 0x80, hi: 0x80},
+	{value: 0x0008, lo: 0x81, hi: 0x86},
+	{value: 0x3308, lo: 0x87, hi: 0x95},
+	{value: 0x0040, lo: 0x96, hi: 0xbf},
+	// Block 0xe3, offset 0x6de
+	{value: 0x0000, lo: 0x06},
+	{value: 0x0008, lo: 0x80, hi: 0x9e},
+	{value: 0x0040, lo: 0x9f, hi: 0x9f},
+	{value: 0x0008, lo: 0xa0, hi: 0xa9},
+	{value: 0x0040, lo: 0xaa, hi: 0xad},
+	{value: 0x0018, lo: 0xae, hi: 0xaf},
+	{value: 0x0008, lo: 0xb0, hi: 0xbf},
+	// Block 0xe4, offset 0x6e5
+	{value: 0x0000, lo: 0x02},
+	{value: 0x0008, lo: 0x80, hi: 0xbe},
+	{value: 0x0040, lo: 0xbf, hi: 0xbf},
+	// Block 0xe5, offset 0x6e8
+	{value: 0x0000, lo: 0x07},
+	{value: 0x0008, lo: 0x80, hi: 0x89},
+	{value: 0x0040, lo: 0x8a, hi: 0x8f},
+	{value: 0x0008, lo: 0x90, hi: 0xad},
+	{value: 0x0040, lo: 0xae, hi: 0xaf},
+	{value: 0x3308, lo: 0xb0, hi: 0xb4},
+	{value: 0x0018, lo: 0xb5, hi: 0xb5},
+	{value: 0x0040, lo: 0xb6, hi: 0xbf},
+	// Block 0xe6, offset 0x6f0
+	{value: 0x0000, lo: 0x03},
+	{value: 0x0008, lo: 0x80, hi: 0xaf},
+	{value: 0x3308, lo: 0xb0, hi: 0xb6},
+	{value: 0x0018, lo: 0xb7, hi: 0xbf},
+	// Block 0xe7, offset 0x6f4
+	{value: 0x0000, lo: 0x0a},
+	{value: 0x0008, lo: 0x80, hi: 0x83},
+	{value: 0x0018, lo: 0x84, hi: 0x85},
+	{value: 0x0040, lo: 0x86, hi: 0x8f},
+	{value: 0x0008, lo: 0x90, hi: 0x99},
+	{value: 0x0040, lo: 0x9a, hi: 0x9a},
+	{value: 0x0018, lo: 0x9b, hi: 0xa1},
+	{value: 0x0040, lo: 0xa2, hi: 0xa2},
+	{value: 0x0008, lo: 0xa3, hi: 0xb7},
+	{value: 0x0040, lo: 0xb8, hi: 0xbc},
+	{value: 0x0008, lo: 0xbd, hi: 0xbf},
+	// Block 0xe8, offset 0x6ff
+	{value: 0x0000, lo: 0x02},
+	{value: 0x0008, lo: 0x80, hi: 0x8f},
+	{value: 0x0040, lo: 0x90, hi: 0xbf},
+	// Block 0xe9, offset 0x702
+	{value: 0x0000, lo: 0x02},
+	{value: 0xe105, lo: 0x80, hi: 0x9f},
+	{value: 0x0008, lo: 0xa0, hi: 0xbf},
+	// Block 0xea, offset 0x705
+	{value: 0x0000, lo: 0x02},
+	{value: 0x0018, lo: 0x80, hi: 0x9a},
+	{value: 0x0040, lo: 0x9b, hi: 0xbf},
+	// Block 0xeb, offset 0x708
+	{value: 0x0000, lo: 0x05},
+	{value: 0x0008, lo: 0x80, hi: 0x8a},
+	{value: 0x0040, lo: 0x8b, hi: 0x8e},
+	{value: 0x3308, lo: 0x8f, hi: 0x8f},
+	{value: 0x0008, lo: 0x90, hi: 0x90},
+	{value: 0x3008, lo: 0x91, hi: 0xbf},
+	// Block 0xec, offset 0x70e
+	{value: 0x0000, lo: 0x05},
+	{value: 0x3008, lo: 0x80, hi: 0x87},
+	{value: 0x0040, lo: 0x88, hi: 0x8e},
+	{value: 0x3308, lo: 0x8f, hi: 0x92},
+	{value: 0x0008, lo: 0x93, hi: 0x9f},
+	{value: 0x0040, lo: 0xa0, hi: 0xbf},
+	// Block 0xed, offset 0x714
+	{value: 0x0000, lo: 0x08},
+	{value: 0x0040, lo: 0x80, hi: 0x9f},
+	{value: 0x0008, lo: 0xa0, hi: 0xa1},
+	{value: 0x0018, lo: 0xa2, hi: 0xa2},
+	{value: 0x0008, lo: 0xa3, hi: 0xa3},
+	{value: 0x3308, lo: 0xa4, hi: 0xa4},
+	{value: 0x0040, lo: 0xa5, hi: 0xaf},
+	{value: 0x3008, lo: 0xb0, hi: 0xb1},
+	{value: 0x0040, lo: 0xb2, hi: 0xbf},
+	// Block 0xee, offset 0x71d
+	{value: 0x0000, lo: 0x02},
+	{value: 0x0008, lo: 0x80, hi: 0xb7},
+	{value: 0x0040, lo: 0xb8, hi: 0xbf},
+	// Block 0xef, offset 0x720
+	{value: 0x0000, lo: 0x02},
+	{value: 0x0008, lo: 0x80, hi: 0x95},
+	{value: 0x0040, lo: 0x96, hi: 0xbf},
+	// Block 0xf0, offset 0x723
+	{value: 0x0000, lo: 0x02},
+	{value: 0x0008, lo: 0x80, hi: 0x88},
+	{value: 0x0040, lo: 0x89, hi: 0xbf},
+	// Block 0xf1, offset 0x726
+	{value: 0x0000, lo: 0x07},
+	{value: 0x0040, lo: 0x80, hi: 0xaf},
+	{value: 0x0008, lo: 0xb0, hi: 0xb3},
+	{value: 0x0040, lo: 0xb4, hi: 0xb4},
+	{value: 0x0008, lo: 0xb5, hi: 0xbb},
+	{value: 0x0040, lo: 0xbc, hi: 0xbc},
+	{value: 0x0008, lo: 0xbd, hi: 0xbe},
+	{value: 0x0040, lo: 0xbf, hi: 0xbf},
+	// Block 0xf2, offset 0x72e
+	{value: 0x0000, lo: 0x04},
+	{value: 0x0008, lo: 0x80, hi: 0xa2},
+	{value: 0x0040, lo: 0xa3, hi: 0xb1},
+	{value: 0x0008, lo: 0xb2, hi: 0xb2},
+	{value: 0x0040, lo: 0xb3, hi: 0xbf},
+	// Block 0xf3, offset 0x733
+	{value: 0x0000, lo: 0x08},
+	{value: 0x0040, lo: 0x80, hi: 0x8f},
+	{value: 0x0008, lo: 0x90, hi: 0x92},
+	{value: 0x0040, lo: 0x93, hi: 0x94},
+	{value: 0x0008, lo: 0x95, hi: 0x95},
+	{value: 0x0040, lo: 0x96, hi: 0xa3},
+	{value: 0x0008, lo: 0xa4, hi: 0xa7},
+	{value: 0x0040, lo: 0xa8, hi: 0xaf},
+	{value: 0x0008, lo: 0xb0, hi: 0xbf},
+	// Block 0xf4, offset 0x73c
+	{value: 0x0000, lo: 0x02},
+	{value: 0x0008, lo: 0x80, hi: 0xbb},
+	{value: 0x0040, lo: 0xbc, hi: 0xbf},
+	// Block 0xf5, offset 0x73f
+	{value: 0x0000, lo: 0x04},
+	{value: 0x0008, lo: 0x80, hi: 0xaa},
+	{value: 0x0040, lo: 0xab, hi: 0xaf},
+	{value: 0x0008, lo: 0xb0, hi: 0xbc},
+	{value: 0x0040, lo: 0xbd, hi: 0xbf},
+	// Block 0xf6, offset 0x744
+	{value: 0x0000, lo: 0x09},
+	{value: 0x0008, lo: 0x80, hi: 0x88},
+	{value: 0x0040, lo: 0x89, hi: 0x8f},
+	{value: 0x0008, lo: 0x90, hi: 0x99},
+	{value: 0x0040, lo: 0x9a, hi: 0x9b},
+	{value: 0x0018, lo: 0x9c, hi: 0x9c},
+	{value: 0x3308, lo: 0x9d, hi: 0x9e},
+	{value: 0x0018, lo: 0x9f, hi: 0x9f},
+	{value: 0x03c0, lo: 0xa0, hi: 0xa3},
+	{value: 0x0040, lo: 0xa4, hi: 0xbf},
+	// Block 0xf7, offset 0x74e
+	{value: 0x0000, lo: 0x03},
+	{value: 0x3308, lo: 0x80, hi: 0xad},
+	{value: 0x0040, lo: 0xae, hi: 0xaf},
+	{value: 0x3308, lo: 0xb0, hi: 0xbf},
+	// Block 0xf8, offset 0x752
+	{value: 0x0000, lo: 0x03},
+	{value: 0x3308, lo: 0x80, hi: 0x86},
+	{value: 0x0040, lo: 0x87, hi: 0x8f},
+	{value: 0x0018, lo: 0x90, hi: 0xbf},
+	// Block 0xf9, offset 0x756
+	{value: 0x0000, lo: 0x02},
+	{value: 0x0018, lo: 0x80, hi: 0x83},
+	{value: 0x0040, lo: 0x84, hi: 0xbf},
+	// Block 0xfa, offset 0x759
+	{value: 0x0000, lo: 0x02},
+	{value: 0x0018, lo: 0x80, hi: 0xb5},
+	{value: 0x0040, lo: 0xb6, hi: 0xbf},
+	// Block 0xfb, offset 0x75c
+	{value: 0x0000, lo: 0x03},
+	{value: 0x0018, lo: 0x80, hi: 0xa6},
+	{value: 0x0040, lo: 0xa7, hi: 0xa8},
+	{value: 0x0018, lo: 0xa9, hi: 0xbf},
+	// Block 0xfc, offset 0x760
+	{value: 0x0000, lo: 0x0e},
+	{value: 0x0018, lo: 0x80, hi: 0x9d},
+	{value: 0x2379, lo: 0x9e, hi: 0x9e},
+	{value: 0x2381, lo: 0x9f, hi: 0x9f},
+	{value: 0x2389, lo: 0xa0, hi: 0xa0},
+	{value: 0x2391, lo: 0xa1, hi: 0xa1},
+	{value: 0x2399, lo: 0xa2, hi: 0xa2},
+	{value: 0x23a1, lo: 0xa3, hi: 0xa3},
+	{value: 0x23a9, lo: 0xa4, hi: 0xa4},
+	{value: 0x3018, lo: 0xa5, hi: 0xa6},
+	{value: 0x3318, lo: 0xa7, hi: 0xa9},
+	{value: 0x0018, lo: 0xaa, hi: 0xac},
+	{value: 0x3018, lo: 0xad, hi: 0xb2},
+	{value: 0x0340, lo: 0xb3, hi: 0xba},
+	{value: 0x3318, lo: 0xbb, hi: 0xbf},
+	// Block 0xfd, offset 0x76f
+	{value: 0x0000, lo: 0x0b},
+	{value: 0x3318, lo: 0x80, hi: 0x82},
+	{value: 0x0018, lo: 0x83, hi: 0x84},
+	{value: 0x3318, lo: 0x85, hi: 0x8b},
+	{value: 0x0018, lo: 0x8c, hi: 0xa9},
+	{value: 0x3318, lo: 0xaa, hi: 0xad},
+	{value: 0x0018, lo: 0xae, hi: 0xba},
+	{value: 0x23b1, lo: 0xbb, hi: 0xbb},
+	{value: 0x23b9, lo: 0xbc, hi: 0xbc},
+	{value: 0x23c1, lo: 0xbd, hi: 0xbd},
+	{value: 0x23c9, lo: 0xbe, hi: 0xbe},
+	{value: 0x23d1, lo: 0xbf, hi: 0xbf},
+	// Block 0xfe, offset 0x77b
+	{value: 0x0000, lo: 0x03},
+	{value: 0x23d9, lo: 0x80, hi: 0x80},
+	{value: 0x0018, lo: 0x81, hi: 0xaa},
+	{value: 0x0040, lo: 0xab, hi: 0xbf},
+	// Block 0xff, offset 0x77f
+	{value: 0x0000, lo: 0x04},
+	{value: 0x0018, lo: 0x80, hi: 0x81},
+	{value: 0x3318, lo: 0x82, hi: 0x84},
+	{value: 0x0018, lo: 0x85, hi: 0x85},
+	{value: 0x0040, lo: 0x86, hi: 0xbf},
+	// Block 0x100, offset 0x784
+	{value: 0x0000, lo: 0x04},
+	{value: 0x0018, lo: 0x80, hi: 0x93},
+	{value: 0x0040, lo: 0x94, hi: 0x9f},
+	{value: 0x0018, lo: 0xa0, hi: 0xb3},
+	{value: 0x0040, lo: 0xb4, hi: 0xbf},
+	// Block 0x101, offset 0x789
+	{value: 0x0000, lo: 0x04},
+	{value: 0x0018, lo: 0x80, hi: 0x96},
+	{value: 0x0040, lo: 0x97, hi: 0x9f},
+	{value: 0x0018, lo: 0xa0, hi: 0xb8},
+	{value: 0x0040, lo: 0xb9, hi: 0xbf},
+	// Block 0x102, offset 0x78e
+	{value: 0x0000, lo: 0x03},
+	{value: 0x3308, lo: 0x80, hi: 0xb6},
+	{value: 0x0018, lo: 0xb7, hi: 0xba},
+	{value: 0x3308, lo: 0xbb, hi: 0xbf},
+	// Block 0x103, offset 0x792
+	{value: 0x0000, lo: 0x04},
+	{value: 0x3308, lo: 0x80, hi: 0xac},
+	{value: 0x0018, lo: 0xad, hi: 0xb4},
+	{value: 0x3308, lo: 0xb5, hi: 0xb5},
+	{value: 0x0018, lo: 0xb6, hi: 0xbf},
+	// Block 0x104, offset 0x797
+	{value: 0x0000, lo: 0x08},
+	{value: 0x0018, lo: 0x80, hi: 0x83},
+	{value: 0x3308, lo: 0x84, hi: 0x84},
+	{value: 0x0018, lo: 0x85, hi: 0x8b},
+	{value: 0x0040, lo: 0x8c, hi: 0x9a},
+	{value: 0x3308, lo: 0x9b, hi: 0x9f},
+	{value: 0x0040, lo: 0xa0, hi: 0xa0},
+	{value: 0x3308, lo: 0xa1, hi: 0xaf},
+	{value: 0x0040, lo: 0xb0, hi: 0xbf},
+	// Block 0x105, offset 0x7a0
+	{value: 0x0000, lo: 0x04},
+	{value: 0x0008, lo: 0x80, hi: 0x9e},
+	{value: 0x0040, lo: 0x9f, hi: 0xa4},
+	{value: 0x0008, lo: 0xa5, hi: 0xaa},
+	{value: 0x0040, lo: 0xab, hi: 0xbf},
+	// Block 0x106, offset 0x7a5
+	{value: 0x0000, lo: 0x03},
+	{value: 0x0040, lo: 0x80, hi: 0x8e},
+	{value: 0x3308, lo: 0x8f, hi: 0x8f},
+	{value: 0x0040, lo: 0x90, hi: 0xbf},
+	// Block 0x107, offset 0x7a9
+	{value: 0x0000, lo: 0x05},
+	{value: 0x0008, lo: 0x80, hi: 0xac},
+	{value: 0x0040, lo: 0xad, hi: 0xaf},
+	{value: 0x3308, lo: 0xb0, hi: 0xb6},
+	{value: 0x0008, lo: 0xb7, hi: 0xbd},
+	{value: 0x0040, lo: 0xbe, hi: 0xbf},
+	// Block 0x108, offset 0x7af
+	{value: 0x0000, lo: 0x05},
+	{value: 0x0008, lo: 0x80, hi: 0x89},
+	{value: 0x0040, lo: 0x8a, hi: 0x8d},
+	{value: 0x0008, lo: 0x8e, hi: 0x8e},
+	{value: 0x0018, lo: 0x8f, hi: 0x8f},
+	{value: 0x0040, lo: 0x90, hi: 0xbf},
+	// Block 0x109, offset 0x7b5
+	{value: 0x0000, lo: 0x04},
+	{value: 0x0040, lo: 0x80, hi: 0x8f},
+	{value: 0x0008, lo: 0x90, hi: 0xad},
+	{value: 0x3308, lo: 0xae, hi: 0xae},
+	{value: 0x0040, lo: 0xaf, hi: 0xbf},
+	// Block 0x10a, offset 0x7ba
+	{value: 0x0000, lo: 0x05},
+	{value: 0x0008, lo: 0x80, hi: 0xab},
+	{value: 0x3308, lo: 0xac, hi: 0xaf},
+	{value: 0x0008, lo: 0xb0, hi: 0xb9},
+	{value: 0x0040, lo: 0xba, hi: 0xbe},
+	{value: 0x0018, lo: 0xbf, hi: 0xbf},
+	// Block 0x10b, offset 0x7c0
+	{value: 0x0000, lo: 0x05},
+	{value: 0x0040, lo: 0x80, hi: 0x8f},
+	{value: 0x0008, lo: 0x90, hi: 0xab},
+	{value: 0x3308, lo: 0xac, hi: 0xaf},
+	{value: 0x0008, lo: 0xb0, hi: 0xb9},
+	{value: 0x0040, lo: 0xba, hi: 0xbf},
+	// Block 0x10c, offset 0x7c6
+	{value: 0x0000, lo: 0x09},
+	{value: 0x0040, lo: 0x80, hi: 0x9f},
+	{value: 0x0008, lo: 0xa0, hi: 0xa6},
+	{value: 0x0040, lo: 0xa7, hi: 0xa7},
+	{value: 0x0008, lo: 0xa8, hi: 0xab},
+	{value: 0x0040, lo: 0xac, hi: 0xac},
+	{value: 0x0008, lo: 0xad, hi: 0xae},
+	{value: 0x0040, lo: 0xaf, hi: 0xaf},
+	{value: 0x0008, lo: 0xb0, hi: 0xbe},
+	{value: 0x0040, lo: 0xbf, hi: 0xbf},
+	// Block 0x10d, offset 0x7d0
+	{value: 0x0000, lo: 0x05},
+	{value: 0x0808, lo: 0x80, hi: 0x84},
+	{value: 0x0040, lo: 0x85, hi: 0x86},
+	{value: 0x0818, lo: 0x87, hi: 0x8f},
+	{value: 0x3308, lo: 0x90, hi: 0x96},
+	{value: 0x0040, lo: 0x97, hi: 0xbf},
+	// Block 0x10e, offset 0x7d6
+	{value: 0x0000, lo: 0x08},
+	{value: 0x0a08, lo: 0x80, hi: 0x83},
+	{value: 0x3308, lo: 0x84, hi: 0x8a},
+	{value: 0x0b08, lo: 0x8b, hi: 0x8b},
+	{value: 0x0040, lo: 0x8c, hi: 0x8f},
+	{value: 0x0808, lo: 0x90, hi: 0x99},
+	{value: 0x0040, lo: 0x9a, hi: 0x9d},
+	{value: 0x0818, lo: 0x9e, hi: 0x9f},
+	{value: 0x0040, lo: 0xa0, hi: 0xbf},
+	// Block 0x10f, offset 0x7df
+	{value: 0x0000, lo: 0x02},
+	{value: 0x0040, lo: 0x80, hi: 0xb0},
+	{value: 0x0818, lo: 0xb1, hi: 0xbf},
+	// Block 0x110, offset 0x7e2
+	{value: 0x0000, lo: 0x02},
+	{value: 0x0818, lo: 0x80, hi: 0xb4},
+	{value: 0x0040, lo: 0xb5, hi: 0xbf},
+	// Block 0x111, offset 0x7e5
+	{value: 0x0000, lo: 0x03},
+	{value: 0x0040, lo: 0x80, hi: 0x80},
+	{value: 0x0818, lo: 0x81, hi: 0xbd},
+	{value: 0x0040, lo: 0xbe, hi: 0xbf},
+	// Block 0x112, offset 0x7e9
+	{value: 0x0000, lo: 0x03},
+	{value: 0x0040, lo: 0x80, hi: 0xaf},
+	{value: 0x0018, lo: 0xb0, hi: 0xb1},
+	{value: 0x0040, lo: 0xb2, hi: 0xbf},
+	// Block 0x113, offset 0x7ed
+	{value: 0x0000, lo: 0x03},
+	{value: 0x0018, lo: 0x80, hi: 0xab},
+	{value: 0x0040, lo: 0xac, hi: 0xaf},
+	{value: 0x0018, lo: 0xb0, hi: 0xbf},
+	// Block 0x114, offset 0x7f1
+	{value: 0x0000, lo: 0x05},
+	{value: 0x0018, lo: 0x80, hi: 0x93},
+	{value: 0x0040, lo: 0x94, hi: 0x9f},
+	{value: 0x0018, lo: 0xa0, hi: 0xae},
+	{value: 0x0040, lo: 0xaf, hi: 0xb0},
+	{value: 0x0018, lo: 0xb1, hi: 0xbf},
+	// Block 0x115, offset 0x7f7
+	{value: 0x0000, lo: 0x05},
+	{value: 0x0040, lo: 0x80, hi: 0x80},
+	{value: 0x0018, lo: 0x81, hi: 0x8f},
+	{value: 0x0040, lo: 0x90, hi: 0x90},
+	{value: 0x0018, lo: 0x91, hi: 0xb5},
+	{value: 0x0040, lo: 0xb6, hi: 0xbf},
+	// Block 0x116, offset 0x7fd
+	{value: 0x0000, lo: 0x04},
+	{value: 0x0018, lo: 0x80, hi: 0x8f},
+	{value: 0x2709, lo: 0x90, hi: 0x90},
+	{value: 0x0018, lo: 0x91, hi: 0xad},
+	{value: 0x0040, lo: 0xae, hi: 0xbf},
+	// Block 0x117, offset 0x802
+	{value: 0x0000, lo: 0x02},
+	{value: 0x0040, lo: 0x80, hi: 0xa5},
+	{value: 0x0018, lo: 0xa6, hi: 0xbf},
+	// Block 0x118, offset 0x805
+	{value: 0x0000, lo: 0x0f},
+	{value: 0x2889, lo: 0x80, hi: 0x80},
+	{value: 0x2891, lo: 0x81, hi: 0x81},
+	{value: 0x2899, lo: 0x82, hi: 0x82},
+	{value: 0x28a1, lo: 0x83, hi: 0x83},
+	{value: 0x28a9, lo: 0x84, hi: 0x84},
+	{value: 0x28b1, lo: 0x85, hi: 0x85},
+	{value: 0x28b9, lo: 0x86, hi: 0x86},
+	{value: 0x28c1, lo: 0x87, hi: 0x87},
+	{value: 0x28c9, lo: 0x88, hi: 0x88},
+	{value: 0x0040, lo: 0x89, hi: 0x8f},
+	{value: 0x28d1, lo: 0x90, hi: 0x90},
+	{value: 0x28d9, lo: 0x91, hi: 0x91},
+	{value: 0x0040, lo: 0x92, hi: 0x9f},
+	{value: 0x0018, lo: 0xa0, hi: 0xa5},
+	{value: 0x0040, lo: 0xa6, hi: 0xbf},
+	// Block 0x119, offset 0x815
+	{value: 0x0000, lo: 0x06},
+	{value: 0x0018, lo: 0x80, hi: 0x97},
+	{value: 0x0040, lo: 0x98, hi: 0x9b},
+	{value: 0x0018, lo: 0x9c, hi: 0xac},
+	{value: 0x0040, lo: 0xad, hi: 0xaf},
+	{value: 0x0018, lo: 0xb0, hi: 0xbc},
+	{value: 0x0040, lo: 0xbd, hi: 0xbf},
+	// Block 0x11a, offset 0x81c
+	{value: 0x0000, lo: 0x03},
+	{value: 0x0018, lo: 0x80, hi: 0xb6},
+	{value: 0x0040, lo: 0xb7, hi: 0xba},
+	{value: 0x0018, lo: 0xbb, hi: 0xbf},
+	// Block 0x11b, offset 0x820
+	{value: 0x0000, lo: 0x06},
+	{value: 0x0018, lo: 0x80, hi: 0x99},
+	{value: 0x0040, lo: 0x9a, hi: 0x9f},
+	{value: 0x0018, lo: 0xa0, hi: 0xab},
+	{value: 0x0040, lo: 0xac, hi: 0xaf},
+	{value: 0x0018, lo: 0xb0, hi: 0xb0},
+	{value: 0x0040, lo: 0xb1, hi: 0xbf},
+	// Block 0x11c, offset 0x827
+	{value: 0x0000, lo: 0x03},
+	{value: 0x0018, lo: 0x80, hi: 0x8b},
+	{value: 0x0040, lo: 0x8c, hi: 0x8f},
+	{value: 0x0018, lo: 0x90, hi: 0xbf},
+	// Block 0x11d, offset 0x82b
+	{value: 0x0000, lo: 0x05},
+	{value: 0x0018, lo: 0x80, hi: 0x87},
+	{value: 0x0040, lo: 0x88, hi: 0x8f},
+	{value: 0x0018, lo: 0x90, hi: 0x99},
+	{value: 0x0040, lo: 0x9a, hi: 0x9f},
+	{value: 0x0018, lo: 0xa0, hi: 0xbf},
+	// Block 0x11e, offset 0x831
+	{value: 0x0000, lo: 0x06},
+	{value: 0x0018, lo: 0x80, hi: 0x87},
+	{value: 0x0040, lo: 0x88, hi: 0x8f},
+	{value: 0x0018, lo: 0x90, hi: 0xad},
+	{value: 0x0040, lo: 0xae, hi: 0xaf},
+	{value: 0x0018, lo: 0xb0, hi: 0xb1},
+	{value: 0x0040, lo: 0xb2, hi: 0xbf},
+	// Block 0x11f, offset 0x838
+	{value: 0x0000, lo: 0x06},
+	{value: 0x0018, lo: 0x80, hi: 0x93},
+	{value: 0x0040, lo: 0x94, hi: 0x9f},
+	{value: 0x0018, lo: 0xa0, hi: 0xad},
+	{value: 0x0040, lo: 0xae, hi: 0xaf},
+	{value: 0x0018, lo: 0xb0, hi: 0xbc},
+	{value: 0x0040, lo: 0xbd, hi: 0xbf},
+	// Block 0x120, offset 0x83f
+	{value: 0x0000, lo: 0x05},
+	{value: 0x0018, lo: 0x80, hi: 0x88},
+	{value: 0x0040, lo: 0x89, hi: 0x8f},
+	{value: 0x0018, lo: 0x90, hi: 0xbd},
+	{value: 0x0040, lo: 0xbe, hi: 0xbe},
+	{value: 0x0018, lo: 0xbf, hi: 0xbf},
+	// Block 0x121, offset 0x845
+	{value: 0x0000, lo: 0x08},
+	{value: 0x0018, lo: 0x80, hi: 0x85},
+	{value: 0x0040, lo: 0x86, hi: 0x8d},
+	{value: 0x0018, lo: 0x8e, hi: 0x9b},
+	{value: 0x0040, lo: 0x9c, hi: 0x9f},
+	{value: 0x0018, lo: 0xa0, hi: 0xa8},
+	{value: 0x0040, lo: 0xa9, hi: 0xaf},
+	{value: 0x0018, lo: 0xb0, hi: 0xb8},
+	{value: 0x0040, lo: 0xb9, hi: 0xbf},
+	// Block 0x122, offset 0x84e
+	{value: 0x0000, lo: 0x03},
+	{value: 0x0018, lo: 0x80, hi: 0x92},
+	{value: 0x0040, lo: 0x93, hi: 0x93},
+	{value: 0x0018, lo: 0x94, hi: 0xbf},
+	// Block 0x123, offset 0x852
+	{value: 0x0000, lo: 0x0d},
+	{value: 0x0018, lo: 0x80, hi: 0x8a},
+	{value: 0x0040, lo: 0x8b, hi: 0xaf},
+	{value: 0x06e1, lo: 0xb0, hi: 0xb0},
+	{value: 0x0049, lo: 0xb1, hi: 0xb1},
+	{value: 0x0029, lo: 0xb2, hi: 0xb2},
+	{value: 0x0031, lo: 0xb3, hi: 0xb3},
+	{value: 0x06e9, lo: 0xb4, hi: 0xb4},
+	{value: 0x06f1, lo: 0xb5, hi: 0xb5},
+	{value: 0x06f9, lo: 0xb6, hi: 0xb6},
+	{value: 0x0701, lo: 0xb7, hi: 0xb7},
+	{value: 0x0709, lo: 0xb8, hi: 0xb8},
+	{value: 0x0711, lo: 0xb9, hi: 0xb9},
+	{value: 0x0040, lo: 0xba, hi: 0xbf},
+	// Block 0x124, offset 0x860
+	{value: 0x0000, lo: 0x02},
+	{value: 0x0008, lo: 0x80, hi: 0x9f},
+	{value: 0x0040, lo: 0xa0, hi: 0xbf},
+	// Block 0x125, offset 0x863
+	{value: 0x0000, lo: 0x02},
+	{value: 0x0008, lo: 0x80, hi: 0xb9},
+	{value: 0x0040, lo: 0xba, hi: 0xbf},
+	// Block 0x126, offset 0x866
+	{value: 0x0000, lo: 0x03},
+	{value: 0x0008, lo: 0x80, hi: 0x9d},
+	{value: 0x0040, lo: 0x9e, hi: 0x9f},
+	{value: 0x0008, lo: 0xa0, hi: 0xbf},
+	// Block 0x127, offset 0x86a
+	{value: 0x0000, lo: 0x03},
+	{value: 0x0008, lo: 0x80, hi: 0xa1},
+	{value: 0x0040, lo: 0xa2, hi: 0xaf},
+	{value: 0x0008, lo: 0xb0, hi: 0xbf},
+	// Block 0x128, offset 0x86e
+	{value: 0x0000, lo: 0x02},
+	{value: 0x0008, lo: 0x80, hi: 0xa0},
+	{value: 0x0040, lo: 0xa1, hi: 0xbf},
+	// Block 0x129, offset 0x871
+	{value: 0x0000, lo: 0x03},
+	{value: 0x0008, lo: 0x80, hi: 0x8a},
+	{value: 0x0040, lo: 0x8b, hi: 0x8f},
+	{value: 0x0008, lo: 0x90, hi: 0xbf},
+	// Block 0x12a, offset 0x875
+	{value: 0x0000, lo: 0x02},
+	{value: 0x0008, lo: 0x80, hi: 0xaf},
+	{value: 0x0040, lo: 0xb0, hi: 0xbf},
+	// Block 0x12b, offset 0x878
+	{value: 0x0000, lo: 0x04},
+	{value: 0x0040, lo: 0x80, hi: 0x80},
+	{value: 0x0340, lo: 0x81, hi: 0x81},
+	{value: 0x0040, lo: 0x82, hi: 0x9f},
+	{value: 0x0340, lo: 0xa0, hi: 0xbf},
+	// Block 0x12c, offset 0x87d
+	{value: 0x0000, lo: 0x01},
+	{value: 0x0340, lo: 0x80, hi: 0xbf},
+	// Block 0x12d, offset 0x87f
+	{value: 0x0000, lo: 0x01},
+	{value: 0x33c0, lo: 0x80, hi: 0xbf},
+	// Block 0x12e, offset 0x881
+	{value: 0x0000, lo: 0x02},
+	{value: 0x33c0, lo: 0x80, hi: 0xaf},
+	{value: 0x0040, lo: 0xb0, hi: 0xbf},
+}
+
+// Total table size 46723 bytes (45KiB); checksum: 4CF3143A
diff --git a/.ci/providerlint/vendor/golang.org/x/net/idna/trie.go b/.ci/providerlint/vendor/golang.org/x/net/idna/trie.go
index c4ef847e7a3..42127417287 100644
--- a/.ci/providerlint/vendor/golang.org/x/net/idna/trie.go
+++ b/.ci/providerlint/vendor/golang.org/x/net/idna/trie.go
@@ -6,27 +6,6 @@
 
 package idna
 
-// appendMapping appends the mapping for the respective rune. isMapped must be
-// true. A mapping is a categorization of a rune as defined in UTS #46.
-func (c info) appendMapping(b []byte, s string) []byte {
-	index := int(c >> indexShift)
-	if c&xorBit == 0 {
-		s := mappings[index:]
-		return append(b, s[1:s[0]+1]...)
-	}
-	b = append(b, s...)
-	if c&inlineXOR == inlineXOR {
-		// TODO: support and handle two-byte inline masks
-		b[len(b)-1] ^= byte(index)
-	} else {
-		for p := len(b) - int(xorData[index]); p < len(b); p++ {
-			index++
-			b[p] ^= xorData[index]
-		}
-	}
-	return b
-}
-
 // Sparse block handling code.
 
 type valueRange struct {
diff --git a/.ci/providerlint/vendor/golang.org/x/net/idna/trie12.0.0.go b/.ci/providerlint/vendor/golang.org/x/net/idna/trie12.0.0.go
new file mode 100644
index 00000000000..bb63f904b37
--- /dev/null
+++ b/.ci/providerlint/vendor/golang.org/x/net/idna/trie12.0.0.go
@@ -0,0 +1,31 @@
+// Code generated by running "go generate" in golang.org/x/text. DO NOT EDIT.
+
+// Copyright 2016 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build !go1.16
+// +build !go1.16
+
+package idna
+
+// appendMapping appends the mapping for the respective rune. isMapped must be
+// true. A mapping is a categorization of a rune as defined in UTS #46.
+func (c info) appendMapping(b []byte, s string) []byte {
+	index := int(c >> indexShift)
+	if c&xorBit == 0 {
+		s := mappings[index:]
+		return append(b, s[1:s[0]+1]...)
+	}
+	b = append(b, s...)
+	if c&inlineXOR == inlineXOR {
+		// TODO: support and handle two-byte inline masks
+		b[len(b)-1] ^= byte(index)
+	} else {
+		for p := len(b) - int(xorData[index]); p < len(b); p++ {
+			index++
+			b[p] ^= xorData[index]
+		}
+	}
+	return b
+}
diff --git a/.ci/providerlint/vendor/golang.org/x/net/idna/trie13.0.0.go b/.ci/providerlint/vendor/golang.org/x/net/idna/trie13.0.0.go
new file mode 100644
index 00000000000..7d68a8dc13c
--- /dev/null
+++ b/.ci/providerlint/vendor/golang.org/x/net/idna/trie13.0.0.go
@@ -0,0 +1,31 @@
+// Code generated by running "go generate" in golang.org/x/text. DO NOT EDIT.
+
+// Copyright 2016 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build go1.16
+// +build go1.16
+
+package idna
+
+// appendMapping appends the mapping for the respective rune. isMapped must be
+// true. A mapping is a categorization of a rune as defined in UTS #46.
+func (c info) appendMapping(b []byte, s string) []byte {
+	index := int(c >> indexShift)
+	if c&xorBit == 0 {
+		p := index
+		return append(b, mappings[mappingIndex[p]:mappingIndex[p+1]]...)
+	}
+	b = append(b, s...)
+	if c&inlineXOR == inlineXOR {
+		// TODO: support and handle two-byte inline masks
+		b[len(b)-1] ^= byte(index)
+	} else {
+		for p := len(b) - int(xorData[index]); p < len(b); p++ {
+			index++
+			b[p] ^= xorData[index]
+		}
+	}
+	return b
+}
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/cpu/asm_aix_ppc64.s b/.ci/providerlint/vendor/golang.org/x/sys/cpu/asm_aix_ppc64.s
new file mode 100644
index 00000000000..db9171c2e49
--- /dev/null
+++ b/.ci/providerlint/vendor/golang.org/x/sys/cpu/asm_aix_ppc64.s
@@ -0,0 +1,18 @@
+// Copyright 2018 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build gc
+// +build gc
+
+#include "textflag.h"
+
+//
+// System calls for ppc64, AIX are implemented in runtime/syscall_aix.go
+//
+
+TEXT ·syscall6(SB),NOSPLIT,$0-88
+	JMP	syscall·syscall6(SB)
+
+TEXT ·rawSyscall6(SB),NOSPLIT,$0-88
+	JMP	syscall·rawSyscall6(SB)
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/cpu/byteorder.go b/.ci/providerlint/vendor/golang.org/x/sys/cpu/byteorder.go
new file mode 100644
index 00000000000..271055be0b1
--- /dev/null
+++ b/.ci/providerlint/vendor/golang.org/x/sys/cpu/byteorder.go
@@ -0,0 +1,66 @@
+// Copyright 2019 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package cpu
+
+import (
+	"runtime"
+)
+
+// byteOrder is a subset of encoding/binary.ByteOrder.
+type byteOrder interface {
+	Uint32([]byte) uint32
+	Uint64([]byte) uint64
+}
+
+type littleEndian struct{}
+type bigEndian struct{}
+
+func (littleEndian) Uint32(b []byte) uint32 {
+	_ = b[3] // bounds check hint to compiler; see golang.org/issue/14808
+	return uint32(b[0]) | uint32(b[1])<<8 | uint32(b[2])<<16 | uint32(b[3])<<24
+}
+
+func (littleEndian) Uint64(b []byte) uint64 {
+	_ = b[7] // bounds check hint to compiler; see golang.org/issue/14808
+	return uint64(b[0]) | uint64(b[1])<<8 | uint64(b[2])<<16 | uint64(b[3])<<24 |
+		uint64(b[4])<<32 | uint64(b[5])<<40 | uint64(b[6])<<48 | uint64(b[7])<<56
+}
+
+func (bigEndian) Uint32(b []byte) uint32 {
+	_ = b[3] // bounds check hint to compiler; see golang.org/issue/14808
+	return uint32(b[3]) | uint32(b[2])<<8 | uint32(b[1])<<16 | uint32(b[0])<<24
+}
+
+func (bigEndian) Uint64(b []byte) uint64 {
+	_ = b[7] // bounds check hint to compiler; see golang.org/issue/14808
+	return uint64(b[7]) | uint64(b[6])<<8 | uint64(b[5])<<16 | uint64(b[4])<<24 |
+		uint64(b[3])<<32 | uint64(b[2])<<40 | uint64(b[1])<<48 | uint64(b[0])<<56
+}
+
+// hostByteOrder returns littleEndian on little-endian machines and
+// bigEndian on big-endian machines.
+func hostByteOrder() byteOrder {
+	switch runtime.GOARCH {
+	case "386", "amd64", "amd64p32",
+		"alpha",
+		"arm", "arm64",
+		"loong64",
+		"mipsle", "mips64le", "mips64p32le",
+		"nios2",
+		"ppc64le",
+		"riscv", "riscv64",
+		"sh":
+		return littleEndian{}
+	case "armbe", "arm64be",
+		"m68k",
+		"mips", "mips64", "mips64p32",
+		"ppc", "ppc64",
+		"s390", "s390x",
+		"shbe",
+		"sparc", "sparc64":
+		return bigEndian{}
+	}
+	panic("unknown architecture")
+}
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu.go b/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu.go
new file mode 100644
index 00000000000..4756ad5f795
--- /dev/null
+++ b/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu.go
@@ -0,0 +1,290 @@
+// Copyright 2018 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// Package cpu implements processor feature detection for
+// various CPU architectures.
+package cpu
+
+import (
+	"os"
+	"strings"
+)
+
+// Initialized reports whether the CPU features were initialized.
+//
+// For some GOOS/GOARCH combinations initialization of the CPU features depends
+// on reading an operating specific file, e.g. /proc/self/auxv on linux/arm
+// Initialized will report false if reading the file fails.
+var Initialized bool
+
+// CacheLinePad is used to pad structs to avoid false sharing.
+type CacheLinePad struct{ _ [cacheLineSize]byte }
+
+// X86 contains the supported CPU features of the
+// current X86/AMD64 platform. If the current platform
+// is not X86/AMD64 then all feature flags are false.
+//
+// X86 is padded to avoid false sharing. Further the HasAVX
+// and HasAVX2 are only set if the OS supports XMM and YMM
+// registers in addition to the CPUID feature bit being set.
+var X86 struct {
+	_                   CacheLinePad
+	HasAES              bool // AES hardware implementation (AES NI)
+	HasADX              bool // Multi-precision add-carry instruction extensions
+	HasAVX              bool // Advanced vector extension
+	HasAVX2             bool // Advanced vector extension 2
+	HasAVX512           bool // Advanced vector extension 512
+	HasAVX512F          bool // Advanced vector extension 512 Foundation Instructions
+	HasAVX512CD         bool // Advanced vector extension 512 Conflict Detection Instructions
+	HasAVX512ER         bool // Advanced vector extension 512 Exponential and Reciprocal Instructions
+	HasAVX512PF         bool // Advanced vector extension 512 Prefetch Instructions
+	HasAVX512VL         bool // Advanced vector extension 512 Vector Length Extensions
+	HasAVX512BW         bool // Advanced vector extension 512 Byte and Word Instructions
+	HasAVX512DQ         bool // Advanced vector extension 512 Doubleword and Quadword Instructions
+	HasAVX512IFMA       bool // Advanced vector extension 512 Integer Fused Multiply Add
+	HasAVX512VBMI       bool // Advanced vector extension 512 Vector Byte Manipulation Instructions
+	HasAVX5124VNNIW     bool // Advanced vector extension 512 Vector Neural Network Instructions Word variable precision
+	HasAVX5124FMAPS     bool // Advanced vector extension 512 Fused Multiply Accumulation Packed Single precision
+	HasAVX512VPOPCNTDQ  bool // Advanced vector extension 512 Double and quad word population count instructions
+	HasAVX512VPCLMULQDQ bool // Advanced vector extension 512 Vector carry-less multiply operations
+	HasAVX512VNNI       bool // Advanced vector extension 512 Vector Neural Network Instructions
+	HasAVX512GFNI       bool // Advanced vector extension 512 Galois field New Instructions
+	HasAVX512VAES       bool // Advanced vector extension 512 Vector AES instructions
+	HasAVX512VBMI2      bool // Advanced vector extension 512 Vector Byte Manipulation Instructions 2
+	HasAVX512BITALG     bool // Advanced vector extension 512 Bit Algorithms
+	HasAVX512BF16       bool // Advanced vector extension 512 BFloat16 Instructions
+	HasAMXTile          bool // Advanced Matrix Extension Tile instructions
+	HasAMXInt8          bool // Advanced Matrix Extension Int8 instructions
+	HasAMXBF16          bool // Advanced Matrix Extension BFloat16 instructions
+	HasBMI1             bool // Bit manipulation instruction set 1
+	HasBMI2             bool // Bit manipulation instruction set 2
+	HasCX16             bool // Compare and exchange 16 Bytes
+	HasERMS             bool // Enhanced REP for MOVSB and STOSB
+	HasFMA              bool // Fused-multiply-add instructions
+	HasOSXSAVE          bool // OS supports XSAVE/XRESTOR for saving/restoring XMM registers.
+	HasPCLMULQDQ        bool // PCLMULQDQ instruction - most often used for AES-GCM
+	HasPOPCNT           bool // Hamming weight instruction POPCNT.
+	HasRDRAND           bool // RDRAND instruction (on-chip random number generator)
+	HasRDSEED           bool // RDSEED instruction (on-chip random number generator)
+	HasSSE2             bool // Streaming SIMD extension 2 (always available on amd64)
+	HasSSE3             bool // Streaming SIMD extension 3
+	HasSSSE3            bool // Supplemental streaming SIMD extension 3
+	HasSSE41            bool // Streaming SIMD extension 4 and 4.1
+	HasSSE42            bool // Streaming SIMD extension 4 and 4.2
+	_                   CacheLinePad
+}
+
+// ARM64 contains the supported CPU features of the
+// current ARMv8(aarch64) platform. If the current platform
+// is not arm64 then all feature flags are false.
+var ARM64 struct {
+	_           CacheLinePad
+	HasFP       bool // Floating-point instruction set (always available)
+	HasASIMD    bool // Advanced SIMD (always available)
+	HasEVTSTRM  bool // Event stream support
+	HasAES      bool // AES hardware implementation
+	HasPMULL    bool // Polynomial multiplication instruction set
+	HasSHA1     bool // SHA1 hardware implementation
+	HasSHA2     bool // SHA2 hardware implementation
+	HasCRC32    bool // CRC32 hardware implementation
+	HasATOMICS  bool // Atomic memory operation instruction set
+	HasFPHP     bool // Half precision floating-point instruction set
+	HasASIMDHP  bool // Advanced SIMD half precision instruction set
+	HasCPUID    bool // CPUID identification scheme registers
+	HasASIMDRDM bool // Rounding double multiply add/subtract instruction set
+	HasJSCVT    bool // Javascript conversion from floating-point to integer
+	HasFCMA     bool // Floating-point multiplication and addition of complex numbers
+	HasLRCPC    bool // Release Consistent processor consistent support
+	HasDCPOP    bool // Persistent memory support
+	HasSHA3     bool // SHA3 hardware implementation
+	HasSM3      bool // SM3 hardware implementation
+	HasSM4      bool // SM4 hardware implementation
+	HasASIMDDP  bool // Advanced SIMD double precision instruction set
+	HasSHA512   bool // SHA512 hardware implementation
+	HasSVE      bool // Scalable Vector Extensions
+	HasASIMDFHM bool // Advanced SIMD multiplication FP16 to FP32
+	_           CacheLinePad
+}
+
+// ARM contains the supported CPU features of the current ARM (32-bit) platform.
+// All feature flags are false if:
+//  1. the current platform is not arm, or
+//  2. the current operating system is not Linux.
+var ARM struct {
+	_           CacheLinePad
+	HasSWP      bool // SWP instruction support
+	HasHALF     bool // Half-word load and store support
+	HasTHUMB    bool // ARM Thumb instruction set
+	Has26BIT    bool // Address space limited to 26-bits
+	HasFASTMUL  bool // 32-bit operand, 64-bit result multiplication support
+	HasFPA      bool // Floating point arithmetic support
+	HasVFP      bool // Vector floating point support
+	HasEDSP     bool // DSP Extensions support
+	HasJAVA     bool // Java instruction set
+	HasIWMMXT   bool // Intel Wireless MMX technology support
+	HasCRUNCH   bool // MaverickCrunch context switching and handling
+	HasTHUMBEE  bool // Thumb EE instruction set
+	HasNEON     bool // NEON instruction set
+	HasVFPv3    bool // Vector floating point version 3 support
+	HasVFPv3D16 bool // Vector floating point version 3 D8-D15
+	HasTLS      bool // Thread local storage support
+	HasVFPv4    bool // Vector floating point version 4 support
+	HasIDIVA    bool // Integer divide instruction support in ARM mode
+	HasIDIVT    bool // Integer divide instruction support in Thumb mode
+	HasVFPD32   bool // Vector floating point version 3 D15-D31
+	HasLPAE     bool // Large Physical Address Extensions
+	HasEVTSTRM  bool // Event stream support
+	HasAES      bool // AES hardware implementation
+	HasPMULL    bool // Polynomial multiplication instruction set
+	HasSHA1     bool // SHA1 hardware implementation
+	HasSHA2     bool // SHA2 hardware implementation
+	HasCRC32    bool // CRC32 hardware implementation
+	_           CacheLinePad
+}
+
+// MIPS64X contains the supported CPU features of the current mips64/mips64le
+// platforms. If the current platform is not mips64/mips64le or the current
+// operating system is not Linux then all feature flags are false.
+var MIPS64X struct {
+	_      CacheLinePad
+	HasMSA bool // MIPS SIMD architecture
+	_      CacheLinePad
+}
+
+// PPC64 contains the supported CPU features of the current ppc64/ppc64le platforms.
+// If the current platform is not ppc64/ppc64le then all feature flags are false.
+//
+// For ppc64/ppc64le, it is safe to check only for ISA level starting on ISA v3.00,
+// since there are no optional categories. There are some exceptions that also
+// require kernel support to work (DARN, SCV), so there are feature bits for
+// those as well. The struct is padded to avoid false sharing.
+var PPC64 struct {
+	_        CacheLinePad
+	HasDARN  bool // Hardware random number generator (requires kernel enablement)
+	HasSCV   bool // Syscall vectored (requires kernel enablement)
+	IsPOWER8 bool // ISA v2.07 (POWER8)
+	IsPOWER9 bool // ISA v3.00 (POWER9), implies IsPOWER8
+	_        CacheLinePad
+}
+
+// S390X contains the supported CPU features of the current IBM Z
+// (s390x) platform. If the current platform is not IBM Z then all
+// feature flags are false.
+//
+// S390X is padded to avoid false sharing. Further HasVX is only set
+// if the OS supports vector registers in addition to the STFLE
+// feature bit being set.
+var S390X struct {
+	_         CacheLinePad
+	HasZARCH  bool // z/Architecture mode is active [mandatory]
+	HasSTFLE  bool // store facility list extended
+	HasLDISP  bool // long (20-bit) displacements
+	HasEIMM   bool // 32-bit immediates
+	HasDFP    bool // decimal floating point
+	HasETF3EH bool // ETF-3 enhanced
+	HasMSA    bool // message security assist (CPACF)
+	HasAES    bool // KM-AES{128,192,256} functions
+	HasAESCBC bool // KMC-AES{128,192,256} functions
+	HasAESCTR bool // KMCTR-AES{128,192,256} functions
+	HasAESGCM bool // KMA-GCM-AES{128,192,256} functions
+	HasGHASH  bool // KIMD-GHASH function
+	HasSHA1   bool // K{I,L}MD-SHA-1 functions
+	HasSHA256 bool // K{I,L}MD-SHA-256 functions
+	HasSHA512 bool // K{I,L}MD-SHA-512 functions
+	HasSHA3   bool // K{I,L}MD-SHA3-{224,256,384,512} and K{I,L}MD-SHAKE-{128,256} functions
+	HasVX     bool // vector facility
+	HasVXE    bool // vector-enhancements facility 1
+	_         CacheLinePad
+}
+
+func init() {
+	archInit()
+	initOptions()
+	processOptions()
+}
+
+// options contains the cpu debug options that can be used in GODEBUG.
+// Options are arch dependent and are added by the arch specific initOptions functions.
+// Features that are mandatory for the specific GOARCH should have the Required field set
+// (e.g. SSE2 on amd64).
+var options []option
+
+// Option names should be lower case. e.g. avx instead of AVX.
+type option struct {
+	Name      string
+	Feature   *bool
+	Specified bool // whether feature value was specified in GODEBUG
+	Enable    bool // whether feature should be enabled
+	Required  bool // whether feature is mandatory and can not be disabled
+}
+
+func processOptions() {
+	env := os.Getenv("GODEBUG")
+field:
+	for env != "" {
+		field := ""
+		i := strings.IndexByte(env, ',')
+		if i < 0 {
+			field, env = env, ""
+		} else {
+			field, env = env[:i], env[i+1:]
+		}
+		if len(field) < 4 || field[:4] != "cpu." {
+			continue
+		}
+		i = strings.IndexByte(field, '=')
+		if i < 0 {
+			print("GODEBUG sys/cpu: no value specified for \"", field, "\"\n")
+			continue
+		}
+		key, value := field[4:i], field[i+1:] // e.g. "SSE2", "on"
+
+		var enable bool
+		switch value {
+		case "on":
+			enable = true
+		case "off":
+			enable = false
+		default:
+			print("GODEBUG sys/cpu: value \"", value, "\" not supported for cpu option \"", key, "\"\n")
+			continue field
+		}
+
+		if key == "all" {
+			for i := range options {
+				options[i].Specified = true
+				options[i].Enable = enable || options[i].Required
+			}
+			continue field
+		}
+
+		for i := range options {
+			if options[i].Name == key {
+				options[i].Specified = true
+				options[i].Enable = enable
+				continue field
+			}
+		}
+
+		print("GODEBUG sys/cpu: unknown cpu feature \"", key, "\"\n")
+	}
+
+	for _, o := range options {
+		if !o.Specified {
+			continue
+		}
+
+		if o.Enable && !*o.Feature {
+			print("GODEBUG sys/cpu: can not enable \"", o.Name, "\", missing CPU support\n")
+			continue
+		}
+
+		if !o.Enable && o.Required {
+			print("GODEBUG sys/cpu: can not disable \"", o.Name, "\", required CPU feature\n")
+			continue
+		}
+
+		*o.Feature = o.Enable
+	}
+}
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_aix.go b/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_aix.go
new file mode 100644
index 00000000000..8aaeef545a7
--- /dev/null
+++ b/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_aix.go
@@ -0,0 +1,34 @@
+// Copyright 2019 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build aix
+// +build aix
+
+package cpu
+
+const (
+	// getsystemcfg constants
+	_SC_IMPL     = 2
+	_IMPL_POWER8 = 0x10000
+	_IMPL_POWER9 = 0x20000
+)
+
+func archInit() {
+	impl := getsystemcfg(_SC_IMPL)
+	if impl&_IMPL_POWER8 != 0 {
+		PPC64.IsPOWER8 = true
+	}
+	if impl&_IMPL_POWER9 != 0 {
+		PPC64.IsPOWER8 = true
+		PPC64.IsPOWER9 = true
+	}
+
+	Initialized = true
+}
+
+func getsystemcfg(label int) (n uint64) {
+	r0, _ := callgetsystemcfg(label)
+	n = uint64(r0)
+	return
+}
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_arm.go b/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_arm.go
new file mode 100644
index 00000000000..301b752e9c5
--- /dev/null
+++ b/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_arm.go
@@ -0,0 +1,73 @@
+// Copyright 2018 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package cpu
+
+const cacheLineSize = 32
+
+// HWCAP/HWCAP2 bits.
+// These are specific to Linux.
+const (
+	hwcap_SWP       = 1 << 0
+	hwcap_HALF      = 1 << 1
+	hwcap_THUMB     = 1 << 2
+	hwcap_26BIT     = 1 << 3
+	hwcap_FAST_MULT = 1 << 4
+	hwcap_FPA       = 1 << 5
+	hwcap_VFP       = 1 << 6
+	hwcap_EDSP      = 1 << 7
+	hwcap_JAVA      = 1 << 8
+	hwcap_IWMMXT    = 1 << 9
+	hwcap_CRUNCH    = 1 << 10
+	hwcap_THUMBEE   = 1 << 11
+	hwcap_NEON      = 1 << 12
+	hwcap_VFPv3     = 1 << 13
+	hwcap_VFPv3D16  = 1 << 14
+	hwcap_TLS       = 1 << 15
+	hwcap_VFPv4     = 1 << 16
+	hwcap_IDIVA     = 1 << 17
+	hwcap_IDIVT     = 1 << 18
+	hwcap_VFPD32    = 1 << 19
+	hwcap_LPAE      = 1 << 20
+	hwcap_EVTSTRM   = 1 << 21
+
+	hwcap2_AES   = 1 << 0
+	hwcap2_PMULL = 1 << 1
+	hwcap2_SHA1  = 1 << 2
+	hwcap2_SHA2  = 1 << 3
+	hwcap2_CRC32 = 1 << 4
+)
+
+func initOptions() {
+	options = []option{
+		{Name: "pmull", Feature: &ARM.HasPMULL},
+		{Name: "sha1", Feature: &ARM.HasSHA1},
+		{Name: "sha2", Feature: &ARM.HasSHA2},
+		{Name: "swp", Feature: &ARM.HasSWP},
+		{Name: "thumb", Feature: &ARM.HasTHUMB},
+		{Name: "thumbee", Feature: &ARM.HasTHUMBEE},
+		{Name: "tls", Feature: &ARM.HasTLS},
+		{Name: "vfp", Feature: &ARM.HasVFP},
+		{Name: "vfpd32", Feature: &ARM.HasVFPD32},
+		{Name: "vfpv3", Feature: &ARM.HasVFPv3},
+		{Name: "vfpv3d16", Feature: &ARM.HasVFPv3D16},
+		{Name: "vfpv4", Feature: &ARM.HasVFPv4},
+		{Name: "half", Feature: &ARM.HasHALF},
+		{Name: "26bit", Feature: &ARM.Has26BIT},
+		{Name: "fastmul", Feature: &ARM.HasFASTMUL},
+		{Name: "fpa", Feature: &ARM.HasFPA},
+		{Name: "edsp", Feature: &ARM.HasEDSP},
+		{Name: "java", Feature: &ARM.HasJAVA},
+		{Name: "iwmmxt", Feature: &ARM.HasIWMMXT},
+		{Name: "crunch", Feature: &ARM.HasCRUNCH},
+		{Name: "neon", Feature: &ARM.HasNEON},
+		{Name: "idivt", Feature: &ARM.HasIDIVT},
+		{Name: "idiva", Feature: &ARM.HasIDIVA},
+		{Name: "lpae", Feature: &ARM.HasLPAE},
+		{Name: "evtstrm", Feature: &ARM.HasEVTSTRM},
+		{Name: "aes", Feature: &ARM.HasAES},
+		{Name: "crc32", Feature: &ARM.HasCRC32},
+	}
+
+}
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_arm64.go b/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_arm64.go
new file mode 100644
index 00000000000..f3eb993bf24
--- /dev/null
+++ b/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_arm64.go
@@ -0,0 +1,172 @@
+// Copyright 2019 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package cpu
+
+import "runtime"
+
+// cacheLineSize is used to prevent false sharing of cache lines.
+// We choose 128 because Apple Silicon, a.k.a. M1, has 128-byte cache line size.
+// It doesn't cost much and is much more future-proof.
+const cacheLineSize = 128
+
+func initOptions() {
+	options = []option{
+		{Name: "fp", Feature: &ARM64.HasFP},
+		{Name: "asimd", Feature: &ARM64.HasASIMD},
+		{Name: "evstrm", Feature: &ARM64.HasEVTSTRM},
+		{Name: "aes", Feature: &ARM64.HasAES},
+		{Name: "fphp", Feature: &ARM64.HasFPHP},
+		{Name: "jscvt", Feature: &ARM64.HasJSCVT},
+		{Name: "lrcpc", Feature: &ARM64.HasLRCPC},
+		{Name: "pmull", Feature: &ARM64.HasPMULL},
+		{Name: "sha1", Feature: &ARM64.HasSHA1},
+		{Name: "sha2", Feature: &ARM64.HasSHA2},
+		{Name: "sha3", Feature: &ARM64.HasSHA3},
+		{Name: "sha512", Feature: &ARM64.HasSHA512},
+		{Name: "sm3", Feature: &ARM64.HasSM3},
+		{Name: "sm4", Feature: &ARM64.HasSM4},
+		{Name: "sve", Feature: &ARM64.HasSVE},
+		{Name: "crc32", Feature: &ARM64.HasCRC32},
+		{Name: "atomics", Feature: &ARM64.HasATOMICS},
+		{Name: "asimdhp", Feature: &ARM64.HasASIMDHP},
+		{Name: "cpuid", Feature: &ARM64.HasCPUID},
+		{Name: "asimrdm", Feature: &ARM64.HasASIMDRDM},
+		{Name: "fcma", Feature: &ARM64.HasFCMA},
+		{Name: "dcpop", Feature: &ARM64.HasDCPOP},
+		{Name: "asimddp", Feature: &ARM64.HasASIMDDP},
+		{Name: "asimdfhm", Feature: &ARM64.HasASIMDFHM},
+	}
+}
+
+func archInit() {
+	switch runtime.GOOS {
+	case "freebsd":
+		readARM64Registers()
+	case "linux", "netbsd", "openbsd":
+		doinit()
+	default:
+		// Many platforms don't seem to allow reading these registers.
+		setMinimalFeatures()
+	}
+}
+
+// setMinimalFeatures fakes the minimal ARM64 features expected by
+// TestARM64minimalFeatures.
+func setMinimalFeatures() {
+	ARM64.HasASIMD = true
+	ARM64.HasFP = true
+}
+
+func readARM64Registers() {
+	Initialized = true
+
+	parseARM64SystemRegisters(getisar0(), getisar1(), getpfr0())
+}
+
+func parseARM64SystemRegisters(isar0, isar1, pfr0 uint64) {
+	// ID_AA64ISAR0_EL1
+	switch extractBits(isar0, 4, 7) {
+	case 1:
+		ARM64.HasAES = true
+	case 2:
+		ARM64.HasAES = true
+		ARM64.HasPMULL = true
+	}
+
+	switch extractBits(isar0, 8, 11) {
+	case 1:
+		ARM64.HasSHA1 = true
+	}
+
+	switch extractBits(isar0, 12, 15) {
+	case 1:
+		ARM64.HasSHA2 = true
+	case 2:
+		ARM64.HasSHA2 = true
+		ARM64.HasSHA512 = true
+	}
+
+	switch extractBits(isar0, 16, 19) {
+	case 1:
+		ARM64.HasCRC32 = true
+	}
+
+	switch extractBits(isar0, 20, 23) {
+	case 2:
+		ARM64.HasATOMICS = true
+	}
+
+	switch extractBits(isar0, 28, 31) {
+	case 1:
+		ARM64.HasASIMDRDM = true
+	}
+
+	switch extractBits(isar0, 32, 35) {
+	case 1:
+		ARM64.HasSHA3 = true
+	}
+
+	switch extractBits(isar0, 36, 39) {
+	case 1:
+		ARM64.HasSM3 = true
+	}
+
+	switch extractBits(isar0, 40, 43) {
+	case 1:
+		ARM64.HasSM4 = true
+	}
+
+	switch extractBits(isar0, 44, 47) {
+	case 1:
+		ARM64.HasASIMDDP = true
+	}
+
+	// ID_AA64ISAR1_EL1
+	switch extractBits(isar1, 0, 3) {
+	case 1:
+		ARM64.HasDCPOP = true
+	}
+
+	switch extractBits(isar1, 12, 15) {
+	case 1:
+		ARM64.HasJSCVT = true
+	}
+
+	switch extractBits(isar1, 16, 19) {
+	case 1:
+		ARM64.HasFCMA = true
+	}
+
+	switch extractBits(isar1, 20, 23) {
+	case 1:
+		ARM64.HasLRCPC = true
+	}
+
+	// ID_AA64PFR0_EL1
+	switch extractBits(pfr0, 16, 19) {
+	case 0:
+		ARM64.HasFP = true
+	case 1:
+		ARM64.HasFP = true
+		ARM64.HasFPHP = true
+	}
+
+	switch extractBits(pfr0, 20, 23) {
+	case 0:
+		ARM64.HasASIMD = true
+	case 1:
+		ARM64.HasASIMD = true
+		ARM64.HasASIMDHP = true
+	}
+
+	switch extractBits(pfr0, 32, 35) {
+	case 1:
+		ARM64.HasSVE = true
+	}
+}
+
+func extractBits(data uint64, start, end uint) uint {
+	return (uint)(data>>start) & ((1 << (end - start + 1)) - 1)
+}
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_arm64.s b/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_arm64.s
new file mode 100644
index 00000000000..c61f95a05a7
--- /dev/null
+++ b/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_arm64.s
@@ -0,0 +1,32 @@
+// Copyright 2019 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build gc
+// +build gc
+
+#include "textflag.h"
+
+// func getisar0() uint64
+TEXT ·getisar0(SB),NOSPLIT,$0-8
+	// get Instruction Set Attributes 0 into x0
+	// mrs x0, ID_AA64ISAR0_EL1 = d5380600
+	WORD	$0xd5380600
+	MOVD	R0, ret+0(FP)
+	RET
+
+// func getisar1() uint64
+TEXT ·getisar1(SB),NOSPLIT,$0-8
+	// get Instruction Set Attributes 1 into x0
+	// mrs x0, ID_AA64ISAR1_EL1 = d5380620
+	WORD	$0xd5380620
+	MOVD	R0, ret+0(FP)
+	RET
+
+// func getpfr0() uint64
+TEXT ·getpfr0(SB),NOSPLIT,$0-8
+	// get Processor Feature Register 0 into x0
+	// mrs x0, ID_AA64PFR0_EL1 = d5380400
+	WORD	$0xd5380400
+	MOVD	R0, ret+0(FP)
+	RET
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_gc_arm64.go b/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_gc_arm64.go
new file mode 100644
index 00000000000..ccf542a73da
--- /dev/null
+++ b/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_gc_arm64.go
@@ -0,0 +1,12 @@
+// Copyright 2019 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build gc
+// +build gc
+
+package cpu
+
+func getisar0() uint64
+func getisar1() uint64
+func getpfr0() uint64
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_gc_s390x.go b/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_gc_s390x.go
new file mode 100644
index 00000000000..0af2f248412
--- /dev/null
+++ b/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_gc_s390x.go
@@ -0,0 +1,22 @@
+// Copyright 2019 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build gc
+// +build gc
+
+package cpu
+
+// haveAsmFunctions reports whether the other functions in this file can
+// be safely called.
+func haveAsmFunctions() bool { return true }
+
+// The following feature detection functions are defined in cpu_s390x.s.
+// They are likely to be expensive to call so the results should be cached.
+func stfle() facilityList
+func kmQuery() queryResult
+func kmcQuery() queryResult
+func kmctrQuery() queryResult
+func kmaQuery() queryResult
+func kimdQuery() queryResult
+func klmdQuery() queryResult
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_gc_x86.go b/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_gc_x86.go
new file mode 100644
index 00000000000..fa7cdb9bcd5
--- /dev/null
+++ b/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_gc_x86.go
@@ -0,0 +1,17 @@
+// Copyright 2018 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build (386 || amd64 || amd64p32) && gc
+// +build 386 amd64 amd64p32
+// +build gc
+
+package cpu
+
+// cpuid is implemented in cpu_x86.s for gc compiler
+// and in cpu_gccgo.c for gccgo.
+func cpuid(eaxArg, ecxArg uint32) (eax, ebx, ecx, edx uint32)
+
+// xgetbv with ecx = 0 is implemented in cpu_x86.s for gc compiler
+// and in cpu_gccgo.c for gccgo.
+func xgetbv() (eax, edx uint32)
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_gccgo_arm64.go b/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_gccgo_arm64.go
new file mode 100644
index 00000000000..2aff3189116
--- /dev/null
+++ b/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_gccgo_arm64.go
@@ -0,0 +1,12 @@
+// Copyright 2019 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build gccgo
+// +build gccgo
+
+package cpu
+
+func getisar0() uint64 { return 0 }
+func getisar1() uint64 { return 0 }
+func getpfr0() uint64  { return 0 }
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_gccgo_s390x.go b/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_gccgo_s390x.go
new file mode 100644
index 00000000000..4bfbda61993
--- /dev/null
+++ b/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_gccgo_s390x.go
@@ -0,0 +1,23 @@
+// Copyright 2019 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build gccgo
+// +build gccgo
+
+package cpu
+
+// haveAsmFunctions reports whether the other functions in this file can
+// be safely called.
+func haveAsmFunctions() bool { return false }
+
+// TODO(mundaym): the following feature detection functions are currently
+// stubs. See https://golang.org/cl/162887 for how to fix this.
+// They are likely to be expensive to call so the results should be cached.
+func stfle() facilityList     { panic("not implemented for gccgo") }
+func kmQuery() queryResult    { panic("not implemented for gccgo") }
+func kmcQuery() queryResult   { panic("not implemented for gccgo") }
+func kmctrQuery() queryResult { panic("not implemented for gccgo") }
+func kmaQuery() queryResult   { panic("not implemented for gccgo") }
+func kimdQuery() queryResult  { panic("not implemented for gccgo") }
+func klmdQuery() queryResult  { panic("not implemented for gccgo") }
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_gccgo_x86.c b/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_gccgo_x86.c
new file mode 100644
index 00000000000..6cc73109f59
--- /dev/null
+++ b/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_gccgo_x86.c
@@ -0,0 +1,39 @@
+// Copyright 2018 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build (386 || amd64 || amd64p32) && gccgo
+// +build 386 amd64 amd64p32
+// +build gccgo
+
+#include <cpuid.h>
+#include <stdint.h>
+#include <x86intrin.h>
+
+// Need to wrap __get_cpuid_count because it's declared as static.
+int
+gccgoGetCpuidCount(uint32_t leaf, uint32_t subleaf,
+                   uint32_t *eax, uint32_t *ebx,
+                   uint32_t *ecx, uint32_t *edx)
+{
+	return __get_cpuid_count(leaf, subleaf, eax, ebx, ecx, edx);
+}
+
+#pragma GCC diagnostic ignored "-Wunknown-pragmas"
+#pragma GCC push_options
+#pragma GCC target("xsave")
+#pragma clang attribute push (__attribute__((target("xsave"))), apply_to=function)
+
+// xgetbv reads the contents of an XCR (Extended Control Register)
+// specified in the ECX register into registers EDX:EAX.
+// Currently, the only supported value for XCR is 0.
+void
+gccgoXgetbv(uint32_t *eax, uint32_t *edx)
+{
+	uint64_t v = _xgetbv(0);
+	*eax = v & 0xffffffff;
+	*edx = v >> 32;
+}
+
+#pragma clang attribute pop
+#pragma GCC pop_options
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_gccgo_x86.go b/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_gccgo_x86.go
new file mode 100644
index 00000000000..863d415ab49
--- /dev/null
+++ b/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_gccgo_x86.go
@@ -0,0 +1,33 @@
+// Copyright 2018 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build (386 || amd64 || amd64p32) && gccgo
+// +build 386 amd64 amd64p32
+// +build gccgo
+
+package cpu
+
+//extern gccgoGetCpuidCount
+func gccgoGetCpuidCount(eaxArg, ecxArg uint32, eax, ebx, ecx, edx *uint32)
+
+func cpuid(eaxArg, ecxArg uint32) (eax, ebx, ecx, edx uint32) {
+	var a, b, c, d uint32
+	gccgoGetCpuidCount(eaxArg, ecxArg, &a, &b, &c, &d)
+	return a, b, c, d
+}
+
+//extern gccgoXgetbv
+func gccgoXgetbv(eax, edx *uint32)
+
+func xgetbv() (eax, edx uint32) {
+	var a, d uint32
+	gccgoXgetbv(&a, &d)
+	return a, d
+}
+
+// gccgo doesn't build on Darwin, per:
+// https://github.com/Homebrew/homebrew-core/blob/HEAD/Formula/gcc.rb#L76
+func darwinSupportsAVX512() bool {
+	return false
+}
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_linux.go b/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_linux.go
new file mode 100644
index 00000000000..159a686f6f7
--- /dev/null
+++ b/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_linux.go
@@ -0,0 +1,16 @@
+// Copyright 2018 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build !386 && !amd64 && !amd64p32 && !arm64
+// +build !386,!amd64,!amd64p32,!arm64
+
+package cpu
+
+func archInit() {
+	if err := readHWCAP(); err != nil {
+		return
+	}
+	doinit()
+	Initialized = true
+}
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_linux_arm.go b/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_linux_arm.go
new file mode 100644
index 00000000000..2057006dce4
--- /dev/null
+++ b/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_linux_arm.go
@@ -0,0 +1,39 @@
+// Copyright 2019 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package cpu
+
+func doinit() {
+	ARM.HasSWP = isSet(hwCap, hwcap_SWP)
+	ARM.HasHALF = isSet(hwCap, hwcap_HALF)
+	ARM.HasTHUMB = isSet(hwCap, hwcap_THUMB)
+	ARM.Has26BIT = isSet(hwCap, hwcap_26BIT)
+	ARM.HasFASTMUL = isSet(hwCap, hwcap_FAST_MULT)
+	ARM.HasFPA = isSet(hwCap, hwcap_FPA)
+	ARM.HasVFP = isSet(hwCap, hwcap_VFP)
+	ARM.HasEDSP = isSet(hwCap, hwcap_EDSP)
+	ARM.HasJAVA = isSet(hwCap, hwcap_JAVA)
+	ARM.HasIWMMXT = isSet(hwCap, hwcap_IWMMXT)
+	ARM.HasCRUNCH = isSet(hwCap, hwcap_CRUNCH)
+	ARM.HasTHUMBEE = isSet(hwCap, hwcap_THUMBEE)
+	ARM.HasNEON = isSet(hwCap, hwcap_NEON)
+	ARM.HasVFPv3 = isSet(hwCap, hwcap_VFPv3)
+	ARM.HasVFPv3D16 = isSet(hwCap, hwcap_VFPv3D16)
+	ARM.HasTLS = isSet(hwCap, hwcap_TLS)
+	ARM.HasVFPv4 = isSet(hwCap, hwcap_VFPv4)
+	ARM.HasIDIVA = isSet(hwCap, hwcap_IDIVA)
+	ARM.HasIDIVT = isSet(hwCap, hwcap_IDIVT)
+	ARM.HasVFPD32 = isSet(hwCap, hwcap_VFPD32)
+	ARM.HasLPAE = isSet(hwCap, hwcap_LPAE)
+	ARM.HasEVTSTRM = isSet(hwCap, hwcap_EVTSTRM)
+	ARM.HasAES = isSet(hwCap2, hwcap2_AES)
+	ARM.HasPMULL = isSet(hwCap2, hwcap2_PMULL)
+	ARM.HasSHA1 = isSet(hwCap2, hwcap2_SHA1)
+	ARM.HasSHA2 = isSet(hwCap2, hwcap2_SHA2)
+	ARM.HasCRC32 = isSet(hwCap2, hwcap2_CRC32)
+}
+
+func isSet(hwc uint, value uint) bool {
+	return hwc&value != 0
+}
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_linux_arm64.go b/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_linux_arm64.go
new file mode 100644
index 00000000000..a968b80fa6a
--- /dev/null
+++ b/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_linux_arm64.go
@@ -0,0 +1,111 @@
+// Copyright 2018 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package cpu
+
+import (
+	"strings"
+	"syscall"
+)
+
+// HWCAP/HWCAP2 bits. These are exposed by Linux.
+const (
+	hwcap_FP       = 1 << 0
+	hwcap_ASIMD    = 1 << 1
+	hwcap_EVTSTRM  = 1 << 2
+	hwcap_AES      = 1 << 3
+	hwcap_PMULL    = 1 << 4
+	hwcap_SHA1     = 1 << 5
+	hwcap_SHA2     = 1 << 6
+	hwcap_CRC32    = 1 << 7
+	hwcap_ATOMICS  = 1 << 8
+	hwcap_FPHP     = 1 << 9
+	hwcap_ASIMDHP  = 1 << 10
+	hwcap_CPUID    = 1 << 11
+	hwcap_ASIMDRDM = 1 << 12
+	hwcap_JSCVT    = 1 << 13
+	hwcap_FCMA     = 1 << 14
+	hwcap_LRCPC    = 1 << 15
+	hwcap_DCPOP    = 1 << 16
+	hwcap_SHA3     = 1 << 17
+	hwcap_SM3      = 1 << 18
+	hwcap_SM4      = 1 << 19
+	hwcap_ASIMDDP  = 1 << 20
+	hwcap_SHA512   = 1 << 21
+	hwcap_SVE      = 1 << 22
+	hwcap_ASIMDFHM = 1 << 23
+)
+
+// linuxKernelCanEmulateCPUID reports whether we're running
+// on Linux 4.11+. Ideally we'd like to ask the question about
+// whether the current kernel contains
+// https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=77c97b4ee21290f5f083173d957843b615abbff2
+// but the version number will have to do.
+func linuxKernelCanEmulateCPUID() bool {
+	var un syscall.Utsname
+	syscall.Uname(&un)
+	var sb strings.Builder
+	for _, b := range un.Release[:] {
+		if b == 0 {
+			break
+		}
+		sb.WriteByte(byte(b))
+	}
+	major, minor, _, ok := parseRelease(sb.String())
+	return ok && (major > 4 || major == 4 && minor >= 11)
+}
+
+func doinit() {
+	if err := readHWCAP(); err != nil {
+		// We failed to read /proc/self/auxv. This can happen if the binary has
+		// been given extra capabilities(7) with /bin/setcap.
+		//
+		// When this happens, we have two options. If the Linux kernel is new
+		// enough (4.11+), we can read the arm64 registers directly which'll
+		// trap into the kernel and then return back to userspace.
+		//
+		// But on older kernels, such as Linux 4.4.180 as used on many Synology
+		// devices, calling readARM64Registers (specifically getisar0) will
+		// cause a SIGILL and we'll die. So for older kernels, parse /proc/cpuinfo
+		// instead.
+		//
+		// See golang/go#57336.
+		if linuxKernelCanEmulateCPUID() {
+			readARM64Registers()
+		} else {
+			readLinuxProcCPUInfo()
+		}
+		return
+	}
+
+	// HWCAP feature bits
+	ARM64.HasFP = isSet(hwCap, hwcap_FP)
+	ARM64.HasASIMD = isSet(hwCap, hwcap_ASIMD)
+	ARM64.HasEVTSTRM = isSet(hwCap, hwcap_EVTSTRM)
+	ARM64.HasAES = isSet(hwCap, hwcap_AES)
+	ARM64.HasPMULL = isSet(hwCap, hwcap_PMULL)
+	ARM64.HasSHA1 = isSet(hwCap, hwcap_SHA1)
+	ARM64.HasSHA2 = isSet(hwCap, hwcap_SHA2)
+	ARM64.HasCRC32 = isSet(hwCap, hwcap_CRC32)
+	ARM64.HasATOMICS = isSet(hwCap, hwcap_ATOMICS)
+	ARM64.HasFPHP = isSet(hwCap, hwcap_FPHP)
+	ARM64.HasASIMDHP = isSet(hwCap, hwcap_ASIMDHP)
+	ARM64.HasCPUID = isSet(hwCap, hwcap_CPUID)
+	ARM64.HasASIMDRDM = isSet(hwCap, hwcap_ASIMDRDM)
+	ARM64.HasJSCVT = isSet(hwCap, hwcap_JSCVT)
+	ARM64.HasFCMA = isSet(hwCap, hwcap_FCMA)
+	ARM64.HasLRCPC = isSet(hwCap, hwcap_LRCPC)
+	ARM64.HasDCPOP = isSet(hwCap, hwcap_DCPOP)
+	ARM64.HasSHA3 = isSet(hwCap, hwcap_SHA3)
+	ARM64.HasSM3 = isSet(hwCap, hwcap_SM3)
+	ARM64.HasSM4 = isSet(hwCap, hwcap_SM4)
+	ARM64.HasASIMDDP = isSet(hwCap, hwcap_ASIMDDP)
+	ARM64.HasSHA512 = isSet(hwCap, hwcap_SHA512)
+	ARM64.HasSVE = isSet(hwCap, hwcap_SVE)
+	ARM64.HasASIMDFHM = isSet(hwCap, hwcap_ASIMDFHM)
+}
+
+func isSet(hwc uint, value uint) bool {
+	return hwc&value != 0
+}
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_linux_mips64x.go b/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_linux_mips64x.go
new file mode 100644
index 00000000000..6000db4cdd1
--- /dev/null
+++ b/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_linux_mips64x.go
@@ -0,0 +1,24 @@
+// Copyright 2020 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build linux && (mips64 || mips64le)
+// +build linux
+// +build mips64 mips64le
+
+package cpu
+
+// HWCAP bits. These are exposed by the Linux kernel 5.4.
+const (
+	// CPU features
+	hwcap_MIPS_MSA = 1 << 1
+)
+
+func doinit() {
+	// HWCAP feature bits
+	MIPS64X.HasMSA = isSet(hwCap, hwcap_MIPS_MSA)
+}
+
+func isSet(hwc uint, value uint) bool {
+	return hwc&value != 0
+}
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_linux_noinit.go b/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_linux_noinit.go
new file mode 100644
index 00000000000..f4992b1a593
--- /dev/null
+++ b/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_linux_noinit.go
@@ -0,0 +1,10 @@
+// Copyright 2019 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build linux && !arm && !arm64 && !mips64 && !mips64le && !ppc64 && !ppc64le && !s390x
+// +build linux,!arm,!arm64,!mips64,!mips64le,!ppc64,!ppc64le,!s390x
+
+package cpu
+
+func doinit() {}
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_linux_ppc64x.go b/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_linux_ppc64x.go
new file mode 100644
index 00000000000..021356d6deb
--- /dev/null
+++ b/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_linux_ppc64x.go
@@ -0,0 +1,32 @@
+// Copyright 2018 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build linux && (ppc64 || ppc64le)
+// +build linux
+// +build ppc64 ppc64le
+
+package cpu
+
+// HWCAP/HWCAP2 bits. These are exposed by the kernel.
+const (
+	// ISA Level
+	_PPC_FEATURE2_ARCH_2_07 = 0x80000000
+	_PPC_FEATURE2_ARCH_3_00 = 0x00800000
+
+	// CPU features
+	_PPC_FEATURE2_DARN = 0x00200000
+	_PPC_FEATURE2_SCV  = 0x00100000
+)
+
+func doinit() {
+	// HWCAP2 feature bits
+	PPC64.IsPOWER8 = isSet(hwCap2, _PPC_FEATURE2_ARCH_2_07)
+	PPC64.IsPOWER9 = isSet(hwCap2, _PPC_FEATURE2_ARCH_3_00)
+	PPC64.HasDARN = isSet(hwCap2, _PPC_FEATURE2_DARN)
+	PPC64.HasSCV = isSet(hwCap2, _PPC_FEATURE2_SCV)
+}
+
+func isSet(hwc uint, value uint) bool {
+	return hwc&value != 0
+}
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_linux_s390x.go b/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_linux_s390x.go
new file mode 100644
index 00000000000..1517ac61d31
--- /dev/null
+++ b/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_linux_s390x.go
@@ -0,0 +1,40 @@
+// Copyright 2019 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package cpu
+
+const (
+	// bit mask values from /usr/include/bits/hwcap.h
+	hwcap_ZARCH  = 2
+	hwcap_STFLE  = 4
+	hwcap_MSA    = 8
+	hwcap_LDISP  = 16
+	hwcap_EIMM   = 32
+	hwcap_DFP    = 64
+	hwcap_ETF3EH = 256
+	hwcap_VX     = 2048
+	hwcap_VXE    = 8192
+)
+
+func initS390Xbase() {
+	// test HWCAP bit vector
+	has := func(featureMask uint) bool {
+		return hwCap&featureMask == featureMask
+	}
+
+	// mandatory
+	S390X.HasZARCH = has(hwcap_ZARCH)
+
+	// optional
+	S390X.HasSTFLE = has(hwcap_STFLE)
+	S390X.HasLDISP = has(hwcap_LDISP)
+	S390X.HasEIMM = has(hwcap_EIMM)
+	S390X.HasETF3EH = has(hwcap_ETF3EH)
+	S390X.HasDFP = has(hwcap_DFP)
+	S390X.HasMSA = has(hwcap_MSA)
+	S390X.HasVX = has(hwcap_VX)
+	if S390X.HasVX {
+		S390X.HasVXE = has(hwcap_VXE)
+	}
+}
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_loong64.go b/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_loong64.go
new file mode 100644
index 00000000000..0f57b05bdbe
--- /dev/null
+++ b/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_loong64.go
@@ -0,0 +1,13 @@
+// Copyright 2022 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build loong64
+// +build loong64
+
+package cpu
+
+const cacheLineSize = 64
+
+func initOptions() {
+}
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_mips64x.go b/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_mips64x.go
new file mode 100644
index 00000000000..f4063c66423
--- /dev/null
+++ b/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_mips64x.go
@@ -0,0 +1,16 @@
+// Copyright 2018 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build mips64 || mips64le
+// +build mips64 mips64le
+
+package cpu
+
+const cacheLineSize = 32
+
+func initOptions() {
+	options = []option{
+		{Name: "msa", Feature: &MIPS64X.HasMSA},
+	}
+}
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_mipsx.go b/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_mipsx.go
new file mode 100644
index 00000000000..07c4e36d8f5
--- /dev/null
+++ b/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_mipsx.go
@@ -0,0 +1,12 @@
+// Copyright 2018 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build mips || mipsle
+// +build mips mipsle
+
+package cpu
+
+const cacheLineSize = 32
+
+func initOptions() {}
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_netbsd_arm64.go b/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_netbsd_arm64.go
new file mode 100644
index 00000000000..ebfb3fc8e76
--- /dev/null
+++ b/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_netbsd_arm64.go
@@ -0,0 +1,173 @@
+// Copyright 2020 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package cpu
+
+import (
+	"syscall"
+	"unsafe"
+)
+
+// Minimal copy of functionality from x/sys/unix so the cpu package can call
+// sysctl without depending on x/sys/unix.
+
+const (
+	_CTL_QUERY = -2
+
+	_SYSCTL_VERS_1 = 0x1000000
+)
+
+var _zero uintptr
+
+func sysctl(mib []int32, old *byte, oldlen *uintptr, new *byte, newlen uintptr) (err error) {
+	var _p0 unsafe.Pointer
+	if len(mib) > 0 {
+		_p0 = unsafe.Pointer(&mib[0])
+	} else {
+		_p0 = unsafe.Pointer(&_zero)
+	}
+	_, _, errno := syscall.Syscall6(
+		syscall.SYS___SYSCTL,
+		uintptr(_p0),
+		uintptr(len(mib)),
+		uintptr(unsafe.Pointer(old)),
+		uintptr(unsafe.Pointer(oldlen)),
+		uintptr(unsafe.Pointer(new)),
+		uintptr(newlen))
+	if errno != 0 {
+		return errno
+	}
+	return nil
+}
+
+type sysctlNode struct {
+	Flags          uint32
+	Num            int32
+	Name           [32]int8
+	Ver            uint32
+	__rsvd         uint32
+	Un             [16]byte
+	_sysctl_size   [8]byte
+	_sysctl_func   [8]byte
+	_sysctl_parent [8]byte
+	_sysctl_desc   [8]byte
+}
+
+func sysctlNodes(mib []int32) ([]sysctlNode, error) {
+	var olen uintptr
+
+	// Get a list of all sysctl nodes below the given MIB by performing
+	// a sysctl for the given MIB with CTL_QUERY appended.
+	mib = append(mib, _CTL_QUERY)
+	qnode := sysctlNode{Flags: _SYSCTL_VERS_1}
+	qp := (*byte)(unsafe.Pointer(&qnode))
+	sz := unsafe.Sizeof(qnode)
+	if err := sysctl(mib, nil, &olen, qp, sz); err != nil {
+		return nil, err
+	}
+
+	// Now that we know the size, get the actual nodes.
+	nodes := make([]sysctlNode, olen/sz)
+	np := (*byte)(unsafe.Pointer(&nodes[0]))
+	if err := sysctl(mib, np, &olen, qp, sz); err != nil {
+		return nil, err
+	}
+
+	return nodes, nil
+}
+
+func nametomib(name string) ([]int32, error) {
+	// Split name into components.
+	var parts []string
+	last := 0
+	for i := 0; i < len(name); i++ {
+		if name[i] == '.' {
+			parts = append(parts, name[last:i])
+			last = i + 1
+		}
+	}
+	parts = append(parts, name[last:])
+
+	mib := []int32{}
+	// Discover the nodes and construct the MIB OID.
+	for partno, part := range parts {
+		nodes, err := sysctlNodes(mib)
+		if err != nil {
+			return nil, err
+		}
+		for _, node := range nodes {
+			n := make([]byte, 0)
+			for i := range node.Name {
+				if node.Name[i] != 0 {
+					n = append(n, byte(node.Name[i]))
+				}
+			}
+			if string(n) == part {
+				mib = append(mib, int32(node.Num))
+				break
+			}
+		}
+		if len(mib) != partno+1 {
+			return nil, err
+		}
+	}
+
+	return mib, nil
+}
+
+// aarch64SysctlCPUID is struct aarch64_sysctl_cpu_id from NetBSD's <aarch64/armreg.h>
+type aarch64SysctlCPUID struct {
+	midr      uint64 /* Main ID Register */
+	revidr    uint64 /* Revision ID Register */
+	mpidr     uint64 /* Multiprocessor Affinity Register */
+	aa64dfr0  uint64 /* A64 Debug Feature Register 0 */
+	aa64dfr1  uint64 /* A64 Debug Feature Register 1 */
+	aa64isar0 uint64 /* A64 Instruction Set Attribute Register 0 */
+	aa64isar1 uint64 /* A64 Instruction Set Attribute Register 1 */
+	aa64mmfr0 uint64 /* A64 Memory Model Feature Register 0 */
+	aa64mmfr1 uint64 /* A64 Memory Model Feature Register 1 */
+	aa64mmfr2 uint64 /* A64 Memory Model Feature Register 2 */
+	aa64pfr0  uint64 /* A64 Processor Feature Register 0 */
+	aa64pfr1  uint64 /* A64 Processor Feature Register 1 */
+	aa64zfr0  uint64 /* A64 SVE Feature ID Register 0 */
+	mvfr0     uint32 /* Media and VFP Feature Register 0 */
+	mvfr1     uint32 /* Media and VFP Feature Register 1 */
+	mvfr2     uint32 /* Media and VFP Feature Register 2 */
+	pad       uint32
+	clidr     uint64 /* Cache Level ID Register */
+	ctr       uint64 /* Cache Type Register */
+}
+
+func sysctlCPUID(name string) (*aarch64SysctlCPUID, error) {
+	mib, err := nametomib(name)
+	if err != nil {
+		return nil, err
+	}
+
+	out := aarch64SysctlCPUID{}
+	n := unsafe.Sizeof(out)
+	_, _, errno := syscall.Syscall6(
+		syscall.SYS___SYSCTL,
+		uintptr(unsafe.Pointer(&mib[0])),
+		uintptr(len(mib)),
+		uintptr(unsafe.Pointer(&out)),
+		uintptr(unsafe.Pointer(&n)),
+		uintptr(0),
+		uintptr(0))
+	if errno != 0 {
+		return nil, errno
+	}
+	return &out, nil
+}
+
+func doinit() {
+	cpuid, err := sysctlCPUID("machdep.cpu0.cpu_id")
+	if err != nil {
+		setMinimalFeatures()
+		return
+	}
+	parseARM64SystemRegisters(cpuid.aa64isar0, cpuid.aa64isar1, cpuid.aa64pfr0)
+
+	Initialized = true
+}
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_openbsd_arm64.go b/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_openbsd_arm64.go
new file mode 100644
index 00000000000..85b64d5ccb7
--- /dev/null
+++ b/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_openbsd_arm64.go
@@ -0,0 +1,65 @@
+// Copyright 2022 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package cpu
+
+import (
+	"syscall"
+	"unsafe"
+)
+
+// Minimal copy of functionality from x/sys/unix so the cpu package can call
+// sysctl without depending on x/sys/unix.
+
+const (
+	// From OpenBSD's sys/sysctl.h.
+	_CTL_MACHDEP = 7
+
+	// From OpenBSD's machine/cpu.h.
+	_CPU_ID_AA64ISAR0 = 2
+	_CPU_ID_AA64ISAR1 = 3
+)
+
+// Implemented in the runtime package (runtime/sys_openbsd3.go)
+func syscall_syscall6(fn, a1, a2, a3, a4, a5, a6 uintptr) (r1, r2 uintptr, err syscall.Errno)
+
+//go:linkname syscall_syscall6 syscall.syscall6
+
+func sysctl(mib []uint32, old *byte, oldlen *uintptr, new *byte, newlen uintptr) (err error) {
+	_, _, errno := syscall_syscall6(libc_sysctl_trampoline_addr, uintptr(unsafe.Pointer(&mib[0])), uintptr(len(mib)), uintptr(unsafe.Pointer(old)), uintptr(unsafe.Pointer(oldlen)), uintptr(unsafe.Pointer(new)), uintptr(newlen))
+	if errno != 0 {
+		return errno
+	}
+	return nil
+}
+
+var libc_sysctl_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_sysctl sysctl "libc.so"
+
+func sysctlUint64(mib []uint32) (uint64, bool) {
+	var out uint64
+	nout := unsafe.Sizeof(out)
+	if err := sysctl(mib, (*byte)(unsafe.Pointer(&out)), &nout, nil, 0); err != nil {
+		return 0, false
+	}
+	return out, true
+}
+
+func doinit() {
+	setMinimalFeatures()
+
+	// Get ID_AA64ISAR0 and ID_AA64ISAR1 from sysctl.
+	isar0, ok := sysctlUint64([]uint32{_CTL_MACHDEP, _CPU_ID_AA64ISAR0})
+	if !ok {
+		return
+	}
+	isar1, ok := sysctlUint64([]uint32{_CTL_MACHDEP, _CPU_ID_AA64ISAR1})
+	if !ok {
+		return
+	}
+	parseARM64SystemRegisters(isar0, isar1, 0)
+
+	Initialized = true
+}
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_openbsd_arm64.s b/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_openbsd_arm64.s
new file mode 100644
index 00000000000..054ba05d607
--- /dev/null
+++ b/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_openbsd_arm64.s
@@ -0,0 +1,11 @@
+// Copyright 2022 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+#include "textflag.h"
+
+TEXT libc_sysctl_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_sysctl(SB)
+
+GLOBL	·libc_sysctl_trampoline_addr(SB), RODATA, $8
+DATA	·libc_sysctl_trampoline_addr(SB)/8, $libc_sysctl_trampoline<>(SB)
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_other_arm.go b/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_other_arm.go
new file mode 100644
index 00000000000..d7b4fb4ccc2
--- /dev/null
+++ b/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_other_arm.go
@@ -0,0 +1,10 @@
+// Copyright 2020 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build !linux && arm
+// +build !linux,arm
+
+package cpu
+
+func archInit() {}
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_other_arm64.go b/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_other_arm64.go
new file mode 100644
index 00000000000..f3cde129b63
--- /dev/null
+++ b/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_other_arm64.go
@@ -0,0 +1,10 @@
+// Copyright 2019 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build !linux && !netbsd && !openbsd && arm64
+// +build !linux,!netbsd,!openbsd,arm64
+
+package cpu
+
+func doinit() {}
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_other_mips64x.go b/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_other_mips64x.go
new file mode 100644
index 00000000000..0dafe9644a5
--- /dev/null
+++ b/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_other_mips64x.go
@@ -0,0 +1,13 @@
+// Copyright 2020 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build !linux && (mips64 || mips64le)
+// +build !linux
+// +build mips64 mips64le
+
+package cpu
+
+func archInit() {
+	Initialized = true
+}
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_other_ppc64x.go b/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_other_ppc64x.go
new file mode 100644
index 00000000000..060d46b6eac
--- /dev/null
+++ b/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_other_ppc64x.go
@@ -0,0 +1,15 @@
+// Copyright 2022 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build !aix && !linux && (ppc64 || ppc64le)
+// +build !aix
+// +build !linux
+// +build ppc64 ppc64le
+
+package cpu
+
+func archInit() {
+	PPC64.IsPOWER8 = true
+	Initialized = true
+}
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_other_riscv64.go b/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_other_riscv64.go
new file mode 100644
index 00000000000..dd10eb79fee
--- /dev/null
+++ b/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_other_riscv64.go
@@ -0,0 +1,12 @@
+// Copyright 2022 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build !linux && riscv64
+// +build !linux,riscv64
+
+package cpu
+
+func archInit() {
+	Initialized = true
+}
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_ppc64x.go b/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_ppc64x.go
new file mode 100644
index 00000000000..4e8acd16583
--- /dev/null
+++ b/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_ppc64x.go
@@ -0,0 +1,17 @@
+// Copyright 2020 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build ppc64 || ppc64le
+// +build ppc64 ppc64le
+
+package cpu
+
+const cacheLineSize = 128
+
+func initOptions() {
+	options = []option{
+		{Name: "darn", Feature: &PPC64.HasDARN},
+		{Name: "scv", Feature: &PPC64.HasSCV},
+	}
+}
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_riscv64.go b/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_riscv64.go
new file mode 100644
index 00000000000..ff7da60eb8d
--- /dev/null
+++ b/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_riscv64.go
@@ -0,0 +1,12 @@
+// Copyright 2019 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build riscv64
+// +build riscv64
+
+package cpu
+
+const cacheLineSize = 64
+
+func initOptions() {}
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_s390x.go b/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_s390x.go
new file mode 100644
index 00000000000..5881b8833f5
--- /dev/null
+++ b/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_s390x.go
@@ -0,0 +1,172 @@
+// Copyright 2020 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package cpu
+
+const cacheLineSize = 256
+
+func initOptions() {
+	options = []option{
+		{Name: "zarch", Feature: &S390X.HasZARCH, Required: true},
+		{Name: "stfle", Feature: &S390X.HasSTFLE, Required: true},
+		{Name: "ldisp", Feature: &S390X.HasLDISP, Required: true},
+		{Name: "eimm", Feature: &S390X.HasEIMM, Required: true},
+		{Name: "dfp", Feature: &S390X.HasDFP},
+		{Name: "etf3eh", Feature: &S390X.HasETF3EH},
+		{Name: "msa", Feature: &S390X.HasMSA},
+		{Name: "aes", Feature: &S390X.HasAES},
+		{Name: "aescbc", Feature: &S390X.HasAESCBC},
+		{Name: "aesctr", Feature: &S390X.HasAESCTR},
+		{Name: "aesgcm", Feature: &S390X.HasAESGCM},
+		{Name: "ghash", Feature: &S390X.HasGHASH},
+		{Name: "sha1", Feature: &S390X.HasSHA1},
+		{Name: "sha256", Feature: &S390X.HasSHA256},
+		{Name: "sha3", Feature: &S390X.HasSHA3},
+		{Name: "sha512", Feature: &S390X.HasSHA512},
+		{Name: "vx", Feature: &S390X.HasVX},
+		{Name: "vxe", Feature: &S390X.HasVXE},
+	}
+}
+
+// bitIsSet reports whether the bit at index is set. The bit index
+// is in big endian order, so bit index 0 is the leftmost bit.
+func bitIsSet(bits []uint64, index uint) bool {
+	return bits[index/64]&((1<<63)>>(index%64)) != 0
+}
+
+// facility is a bit index for the named facility.
+type facility uint8
+
+const (
+	// mandatory facilities
+	zarch  facility = 1  // z architecture mode is active
+	stflef facility = 7  // store-facility-list-extended
+	ldisp  facility = 18 // long-displacement
+	eimm   facility = 21 // extended-immediate
+
+	// miscellaneous facilities
+	dfp    facility = 42 // decimal-floating-point
+	etf3eh facility = 30 // extended-translation 3 enhancement
+
+	// cryptography facilities
+	msa  facility = 17  // message-security-assist
+	msa3 facility = 76  // message-security-assist extension 3
+	msa4 facility = 77  // message-security-assist extension 4
+	msa5 facility = 57  // message-security-assist extension 5
+	msa8 facility = 146 // message-security-assist extension 8
+	msa9 facility = 155 // message-security-assist extension 9
+
+	// vector facilities
+	vx   facility = 129 // vector facility
+	vxe  facility = 135 // vector-enhancements 1
+	vxe2 facility = 148 // vector-enhancements 2
+)
+
+// facilityList contains the result of an STFLE call.
+// Bits are numbered in big endian order so the
+// leftmost bit (the MSB) is at index 0.
+type facilityList struct {
+	bits [4]uint64
+}
+
+// Has reports whether the given facilities are present.
+func (s *facilityList) Has(fs ...facility) bool {
+	if len(fs) == 0 {
+		panic("no facility bits provided")
+	}
+	for _, f := range fs {
+		if !bitIsSet(s.bits[:], uint(f)) {
+			return false
+		}
+	}
+	return true
+}
+
+// function is the code for the named cryptographic function.
+type function uint8
+
+const (
+	// KM{,A,C,CTR} function codes
+	aes128 function = 18 // AES-128
+	aes192 function = 19 // AES-192
+	aes256 function = 20 // AES-256
+
+	// K{I,L}MD function codes
+	sha1     function = 1  // SHA-1
+	sha256   function = 2  // SHA-256
+	sha512   function = 3  // SHA-512
+	sha3_224 function = 32 // SHA3-224
+	sha3_256 function = 33 // SHA3-256
+	sha3_384 function = 34 // SHA3-384
+	sha3_512 function = 35 // SHA3-512
+	shake128 function = 36 // SHAKE-128
+	shake256 function = 37 // SHAKE-256
+
+	// KLMD function codes
+	ghash function = 65 // GHASH
+)
+
+// queryResult contains the result of a Query function
+// call. Bits are numbered in big endian order so the
+// leftmost bit (the MSB) is at index 0.
+type queryResult struct {
+	bits [2]uint64
+}
+
+// Has reports whether the given functions are present.
+func (q *queryResult) Has(fns ...function) bool {
+	if len(fns) == 0 {
+		panic("no function codes provided")
+	}
+	for _, f := range fns {
+		if !bitIsSet(q.bits[:], uint(f)) {
+			return false
+		}
+	}
+	return true
+}
+
+func doinit() {
+	initS390Xbase()
+
+	// We need implementations of stfle, km and so on
+	// to detect cryptographic features.
+	if !haveAsmFunctions() {
+		return
+	}
+
+	// optional cryptographic functions
+	if S390X.HasMSA {
+		aes := []function{aes128, aes192, aes256}
+
+		// cipher message
+		km, kmc := kmQuery(), kmcQuery()
+		S390X.HasAES = km.Has(aes...)
+		S390X.HasAESCBC = kmc.Has(aes...)
+		if S390X.HasSTFLE {
+			facilities := stfle()
+			if facilities.Has(msa4) {
+				kmctr := kmctrQuery()
+				S390X.HasAESCTR = kmctr.Has(aes...)
+			}
+			if facilities.Has(msa8) {
+				kma := kmaQuery()
+				S390X.HasAESGCM = kma.Has(aes...)
+			}
+		}
+
+		// compute message digest
+		kimd := kimdQuery() // intermediate (no padding)
+		klmd := klmdQuery() // last (padding)
+		S390X.HasSHA1 = kimd.Has(sha1) && klmd.Has(sha1)
+		S390X.HasSHA256 = kimd.Has(sha256) && klmd.Has(sha256)
+		S390X.HasSHA512 = kimd.Has(sha512) && klmd.Has(sha512)
+		S390X.HasGHASH = kimd.Has(ghash) // KLMD-GHASH does not exist
+		sha3 := []function{
+			sha3_224, sha3_256, sha3_384, sha3_512,
+			shake128, shake256,
+		}
+		S390X.HasSHA3 = kimd.Has(sha3...) && klmd.Has(sha3...)
+	}
+}
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_s390x.s b/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_s390x.s
new file mode 100644
index 00000000000..96f81e20971
--- /dev/null
+++ b/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_s390x.s
@@ -0,0 +1,58 @@
+// Copyright 2019 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build gc
+// +build gc
+
+#include "textflag.h"
+
+// func stfle() facilityList
+TEXT ·stfle(SB), NOSPLIT|NOFRAME, $0-32
+	MOVD $ret+0(FP), R1
+	MOVD $3, R0          // last doubleword index to store
+	XC   $32, (R1), (R1) // clear 4 doublewords (32 bytes)
+	WORD $0xb2b01000     // store facility list extended (STFLE)
+	RET
+
+// func kmQuery() queryResult
+TEXT ·kmQuery(SB), NOSPLIT|NOFRAME, $0-16
+	MOVD $0, R0         // set function code to 0 (KM-Query)
+	MOVD $ret+0(FP), R1 // address of 16-byte return value
+	WORD $0xB92E0024    // cipher message (KM)
+	RET
+
+// func kmcQuery() queryResult
+TEXT ·kmcQuery(SB), NOSPLIT|NOFRAME, $0-16
+	MOVD $0, R0         // set function code to 0 (KMC-Query)
+	MOVD $ret+0(FP), R1 // address of 16-byte return value
+	WORD $0xB92F0024    // cipher message with chaining (KMC)
+	RET
+
+// func kmctrQuery() queryResult
+TEXT ·kmctrQuery(SB), NOSPLIT|NOFRAME, $0-16
+	MOVD $0, R0         // set function code to 0 (KMCTR-Query)
+	MOVD $ret+0(FP), R1 // address of 16-byte return value
+	WORD $0xB92D4024    // cipher message with counter (KMCTR)
+	RET
+
+// func kmaQuery() queryResult
+TEXT ·kmaQuery(SB), NOSPLIT|NOFRAME, $0-16
+	MOVD $0, R0         // set function code to 0 (KMA-Query)
+	MOVD $ret+0(FP), R1 // address of 16-byte return value
+	WORD $0xb9296024    // cipher message with authentication (KMA)
+	RET
+
+// func kimdQuery() queryResult
+TEXT ·kimdQuery(SB), NOSPLIT|NOFRAME, $0-16
+	MOVD $0, R0         // set function code to 0 (KIMD-Query)
+	MOVD $ret+0(FP), R1 // address of 16-byte return value
+	WORD $0xB93E0024    // compute intermediate message digest (KIMD)
+	RET
+
+// func klmdQuery() queryResult
+TEXT ·klmdQuery(SB), NOSPLIT|NOFRAME, $0-16
+	MOVD $0, R0         // set function code to 0 (KLMD-Query)
+	MOVD $ret+0(FP), R1 // address of 16-byte return value
+	WORD $0xB93F0024    // compute last message digest (KLMD)
+	RET
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_wasm.go b/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_wasm.go
new file mode 100644
index 00000000000..7747d888a69
--- /dev/null
+++ b/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_wasm.go
@@ -0,0 +1,18 @@
+// Copyright 2019 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build wasm
+// +build wasm
+
+package cpu
+
+// We're compiling the cpu package for an unknown (software-abstracted) CPU.
+// Make CacheLinePad an empty struct and hope that the usual struct alignment
+// rules are good enough.
+
+const cacheLineSize = 0
+
+func initOptions() {}
+
+func archInit() {}
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_x86.go b/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_x86.go
new file mode 100644
index 00000000000..2dcde8285d5
--- /dev/null
+++ b/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_x86.go
@@ -0,0 +1,152 @@
+// Copyright 2018 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build 386 || amd64 || amd64p32
+// +build 386 amd64 amd64p32
+
+package cpu
+
+import "runtime"
+
+const cacheLineSize = 64
+
+func initOptions() {
+	options = []option{
+		{Name: "adx", Feature: &X86.HasADX},
+		{Name: "aes", Feature: &X86.HasAES},
+		{Name: "avx", Feature: &X86.HasAVX},
+		{Name: "avx2", Feature: &X86.HasAVX2},
+		{Name: "avx512", Feature: &X86.HasAVX512},
+		{Name: "avx512f", Feature: &X86.HasAVX512F},
+		{Name: "avx512cd", Feature: &X86.HasAVX512CD},
+		{Name: "avx512er", Feature: &X86.HasAVX512ER},
+		{Name: "avx512pf", Feature: &X86.HasAVX512PF},
+		{Name: "avx512vl", Feature: &X86.HasAVX512VL},
+		{Name: "avx512bw", Feature: &X86.HasAVX512BW},
+		{Name: "avx512dq", Feature: &X86.HasAVX512DQ},
+		{Name: "avx512ifma", Feature: &X86.HasAVX512IFMA},
+		{Name: "avx512vbmi", Feature: &X86.HasAVX512VBMI},
+		{Name: "avx512vnniw", Feature: &X86.HasAVX5124VNNIW},
+		{Name: "avx5124fmaps", Feature: &X86.HasAVX5124FMAPS},
+		{Name: "avx512vpopcntdq", Feature: &X86.HasAVX512VPOPCNTDQ},
+		{Name: "avx512vpclmulqdq", Feature: &X86.HasAVX512VPCLMULQDQ},
+		{Name: "avx512vnni", Feature: &X86.HasAVX512VNNI},
+		{Name: "avx512gfni", Feature: &X86.HasAVX512GFNI},
+		{Name: "avx512vaes", Feature: &X86.HasAVX512VAES},
+		{Name: "avx512vbmi2", Feature: &X86.HasAVX512VBMI2},
+		{Name: "avx512bitalg", Feature: &X86.HasAVX512BITALG},
+		{Name: "avx512bf16", Feature: &X86.HasAVX512BF16},
+		{Name: "amxtile", Feature: &X86.HasAMXTile},
+		{Name: "amxint8", Feature: &X86.HasAMXInt8},
+		{Name: "amxbf16", Feature: &X86.HasAMXBF16},
+		{Name: "bmi1", Feature: &X86.HasBMI1},
+		{Name: "bmi2", Feature: &X86.HasBMI2},
+		{Name: "cx16", Feature: &X86.HasCX16},
+		{Name: "erms", Feature: &X86.HasERMS},
+		{Name: "fma", Feature: &X86.HasFMA},
+		{Name: "osxsave", Feature: &X86.HasOSXSAVE},
+		{Name: "pclmulqdq", Feature: &X86.HasPCLMULQDQ},
+		{Name: "popcnt", Feature: &X86.HasPOPCNT},
+		{Name: "rdrand", Feature: &X86.HasRDRAND},
+		{Name: "rdseed", Feature: &X86.HasRDSEED},
+		{Name: "sse3", Feature: &X86.HasSSE3},
+		{Name: "sse41", Feature: &X86.HasSSE41},
+		{Name: "sse42", Feature: &X86.HasSSE42},
+		{Name: "ssse3", Feature: &X86.HasSSSE3},
+
+		// These capabilities should always be enabled on amd64:
+		{Name: "sse2", Feature: &X86.HasSSE2, Required: runtime.GOARCH == "amd64"},
+	}
+}
+
+func archInit() {
+
+	Initialized = true
+
+	maxID, _, _, _ := cpuid(0, 0)
+
+	if maxID < 1 {
+		return
+	}
+
+	_, _, ecx1, edx1 := cpuid(1, 0)
+	X86.HasSSE2 = isSet(26, edx1)
+
+	X86.HasSSE3 = isSet(0, ecx1)
+	X86.HasPCLMULQDQ = isSet(1, ecx1)
+	X86.HasSSSE3 = isSet(9, ecx1)
+	X86.HasFMA = isSet(12, ecx1)
+	X86.HasCX16 = isSet(13, ecx1)
+	X86.HasSSE41 = isSet(19, ecx1)
+	X86.HasSSE42 = isSet(20, ecx1)
+	X86.HasPOPCNT = isSet(23, ecx1)
+	X86.HasAES = isSet(25, ecx1)
+	X86.HasOSXSAVE = isSet(27, ecx1)
+	X86.HasRDRAND = isSet(30, ecx1)
+
+	var osSupportsAVX, osSupportsAVX512 bool
+	// For XGETBV, OSXSAVE bit is required and sufficient.
+	if X86.HasOSXSAVE {
+		eax, _ := xgetbv()
+		// Check if XMM and YMM registers have OS support.
+		osSupportsAVX = isSet(1, eax) && isSet(2, eax)
+
+		if runtime.GOOS == "darwin" {
+			// Darwin doesn't save/restore AVX-512 mask registers correctly across signal handlers.
+			// Since users can't rely on mask register contents, let's not advertise AVX-512 support.
+			// See issue 49233.
+			osSupportsAVX512 = false
+		} else {
+			// Check if OPMASK and ZMM registers have OS support.
+			osSupportsAVX512 = osSupportsAVX && isSet(5, eax) && isSet(6, eax) && isSet(7, eax)
+		}
+	}
+
+	X86.HasAVX = isSet(28, ecx1) && osSupportsAVX
+
+	if maxID < 7 {
+		return
+	}
+
+	_, ebx7, ecx7, edx7 := cpuid(7, 0)
+	X86.HasBMI1 = isSet(3, ebx7)
+	X86.HasAVX2 = isSet(5, ebx7) && osSupportsAVX
+	X86.HasBMI2 = isSet(8, ebx7)
+	X86.HasERMS = isSet(9, ebx7)
+	X86.HasRDSEED = isSet(18, ebx7)
+	X86.HasADX = isSet(19, ebx7)
+
+	X86.HasAVX512 = isSet(16, ebx7) && osSupportsAVX512 // Because avx-512 foundation is the core required extension
+	if X86.HasAVX512 {
+		X86.HasAVX512F = true
+		X86.HasAVX512CD = isSet(28, ebx7)
+		X86.HasAVX512ER = isSet(27, ebx7)
+		X86.HasAVX512PF = isSet(26, ebx7)
+		X86.HasAVX512VL = isSet(31, ebx7)
+		X86.HasAVX512BW = isSet(30, ebx7)
+		X86.HasAVX512DQ = isSet(17, ebx7)
+		X86.HasAVX512IFMA = isSet(21, ebx7)
+		X86.HasAVX512VBMI = isSet(1, ecx7)
+		X86.HasAVX5124VNNIW = isSet(2, edx7)
+		X86.HasAVX5124FMAPS = isSet(3, edx7)
+		X86.HasAVX512VPOPCNTDQ = isSet(14, ecx7)
+		X86.HasAVX512VPCLMULQDQ = isSet(10, ecx7)
+		X86.HasAVX512VNNI = isSet(11, ecx7)
+		X86.HasAVX512GFNI = isSet(8, ecx7)
+		X86.HasAVX512VAES = isSet(9, ecx7)
+		X86.HasAVX512VBMI2 = isSet(6, ecx7)
+		X86.HasAVX512BITALG = isSet(12, ecx7)
+
+		eax71, _, _, _ := cpuid(7, 1)
+		X86.HasAVX512BF16 = isSet(5, eax71)
+	}
+
+	X86.HasAMXTile = isSet(24, edx7)
+	X86.HasAMXInt8 = isSet(25, edx7)
+	X86.HasAMXBF16 = isSet(22, edx7)
+}
+
+func isSet(bitpos uint, value uint32) bool {
+	return value&(1<<bitpos) != 0
+}
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_x86.s b/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_x86.s
new file mode 100644
index 00000000000..39acab2ff5c
--- /dev/null
+++ b/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_x86.s
@@ -0,0 +1,28 @@
+// Copyright 2018 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build (386 || amd64 || amd64p32) && gc
+// +build 386 amd64 amd64p32
+// +build gc
+
+#include "textflag.h"
+
+// func cpuid(eaxArg, ecxArg uint32) (eax, ebx, ecx, edx uint32)
+TEXT ·cpuid(SB), NOSPLIT, $0-24
+	MOVL eaxArg+0(FP), AX
+	MOVL ecxArg+4(FP), CX
+	CPUID
+	MOVL AX, eax+8(FP)
+	MOVL BX, ebx+12(FP)
+	MOVL CX, ecx+16(FP)
+	MOVL DX, edx+20(FP)
+	RET
+
+// func xgetbv() (eax, edx uint32)
+TEXT ·xgetbv(SB),NOSPLIT,$0-8
+	MOVL $0, CX
+	XGETBV
+	MOVL AX, eax+0(FP)
+	MOVL DX, edx+4(FP)
+	RET
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_zos.go b/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_zos.go
new file mode 100644
index 00000000000..5f54683a22e
--- /dev/null
+++ b/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_zos.go
@@ -0,0 +1,10 @@
+// Copyright 2020 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package cpu
+
+func archInit() {
+	doinit()
+	Initialized = true
+}
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_zos_s390x.go b/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_zos_s390x.go
new file mode 100644
index 00000000000..ccb1b708aba
--- /dev/null
+++ b/.ci/providerlint/vendor/golang.org/x/sys/cpu/cpu_zos_s390x.go
@@ -0,0 +1,25 @@
+// Copyright 2020 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package cpu
+
+func initS390Xbase() {
+	// get the facilities list
+	facilities := stfle()
+
+	// mandatory
+	S390X.HasZARCH = facilities.Has(zarch)
+	S390X.HasSTFLE = facilities.Has(stflef)
+	S390X.HasLDISP = facilities.Has(ldisp)
+	S390X.HasEIMM = facilities.Has(eimm)
+
+	// optional
+	S390X.HasETF3EH = facilities.Has(etf3eh)
+	S390X.HasDFP = facilities.Has(dfp)
+	S390X.HasMSA = facilities.Has(msa)
+	S390X.HasVX = facilities.Has(vx)
+	if S390X.HasVX {
+		S390X.HasVXE = facilities.Has(vxe)
+	}
+}
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/cpu/endian_big.go b/.ci/providerlint/vendor/golang.org/x/sys/cpu/endian_big.go
new file mode 100644
index 00000000000..93ce03a3460
--- /dev/null
+++ b/.ci/providerlint/vendor/golang.org/x/sys/cpu/endian_big.go
@@ -0,0 +1,11 @@
+// Copyright 2023 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build armbe || arm64be || m68k || mips || mips64 || mips64p32 || ppc || ppc64 || s390 || s390x || shbe || sparc || sparc64
+// +build armbe arm64be m68k mips mips64 mips64p32 ppc ppc64 s390 s390x shbe sparc sparc64
+
+package cpu
+
+// IsBigEndian records whether the GOARCH's byte order is big endian.
+const IsBigEndian = true
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/cpu/endian_little.go b/.ci/providerlint/vendor/golang.org/x/sys/cpu/endian_little.go
new file mode 100644
index 00000000000..55db853efbe
--- /dev/null
+++ b/.ci/providerlint/vendor/golang.org/x/sys/cpu/endian_little.go
@@ -0,0 +1,11 @@
+// Copyright 2023 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build 386 || amd64 || amd64p32 || alpha || arm || arm64 || loong64 || mipsle || mips64le || mips64p32le || nios2 || ppc64le || riscv || riscv64 || sh || wasm
+// +build 386 amd64 amd64p32 alpha arm arm64 loong64 mipsle mips64le mips64p32le nios2 ppc64le riscv riscv64 sh wasm
+
+package cpu
+
+// IsBigEndian records whether the GOARCH's byte order is big endian.
+const IsBigEndian = false
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/cpu/hwcap_linux.go b/.ci/providerlint/vendor/golang.org/x/sys/cpu/hwcap_linux.go
new file mode 100644
index 00000000000..34e49f955a8
--- /dev/null
+++ b/.ci/providerlint/vendor/golang.org/x/sys/cpu/hwcap_linux.go
@@ -0,0 +1,71 @@
+// Copyright 2019 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package cpu
+
+import (
+	"os"
+)
+
+const (
+	_AT_HWCAP  = 16
+	_AT_HWCAP2 = 26
+
+	procAuxv = "/proc/self/auxv"
+
+	uintSize = int(32 << (^uint(0) >> 63))
+)
+
+// For those platforms don't have a 'cpuid' equivalent we use HWCAP/HWCAP2
+// These are initialized in cpu_$GOARCH.go
+// and should not be changed after they are initialized.
+var hwCap uint
+var hwCap2 uint
+
+func readHWCAP() error {
+	// For Go 1.21+, get auxv from the Go runtime.
+	if a := getAuxv(); len(a) > 0 {
+		for len(a) >= 2 {
+			tag, val := a[0], uint(a[1])
+			a = a[2:]
+			switch tag {
+			case _AT_HWCAP:
+				hwCap = val
+			case _AT_HWCAP2:
+				hwCap2 = val
+			}
+		}
+		return nil
+	}
+
+	buf, err := os.ReadFile(procAuxv)
+	if err != nil {
+		// e.g. on android /proc/self/auxv is not accessible, so silently
+		// ignore the error and leave Initialized = false. On some
+		// architectures (e.g. arm64) doinit() implements a fallback
+		// readout and will set Initialized = true again.
+		return err
+	}
+	bo := hostByteOrder()
+	for len(buf) >= 2*(uintSize/8) {
+		var tag, val uint
+		switch uintSize {
+		case 32:
+			tag = uint(bo.Uint32(buf[0:]))
+			val = uint(bo.Uint32(buf[4:]))
+			buf = buf[8:]
+		case 64:
+			tag = uint(bo.Uint64(buf[0:]))
+			val = uint(bo.Uint64(buf[8:]))
+			buf = buf[16:]
+		}
+		switch tag {
+		case _AT_HWCAP:
+			hwCap = val
+		case _AT_HWCAP2:
+			hwCap2 = val
+		}
+	}
+	return nil
+}
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/cpu/parse.go b/.ci/providerlint/vendor/golang.org/x/sys/cpu/parse.go
new file mode 100644
index 00000000000..762b63d6882
--- /dev/null
+++ b/.ci/providerlint/vendor/golang.org/x/sys/cpu/parse.go
@@ -0,0 +1,43 @@
+// Copyright 2022 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package cpu
+
+import "strconv"
+
+// parseRelease parses a dot-separated version number. It follows the semver
+// syntax, but allows the minor and patch versions to be elided.
+//
+// This is a copy of the Go runtime's parseRelease from
+// https://golang.org/cl/209597.
+func parseRelease(rel string) (major, minor, patch int, ok bool) {
+	// Strip anything after a dash or plus.
+	for i := 0; i < len(rel); i++ {
+		if rel[i] == '-' || rel[i] == '+' {
+			rel = rel[:i]
+			break
+		}
+	}
+
+	next := func() (int, bool) {
+		for i := 0; i < len(rel); i++ {
+			if rel[i] == '.' {
+				ver, err := strconv.Atoi(rel[:i])
+				rel = rel[i+1:]
+				return ver, err == nil
+			}
+		}
+		ver, err := strconv.Atoi(rel)
+		rel = ""
+		return ver, err == nil
+	}
+	if major, ok = next(); !ok || rel == "" {
+		return
+	}
+	if minor, ok = next(); !ok || rel == "" {
+		return
+	}
+	patch, ok = next()
+	return
+}
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/cpu/proc_cpuinfo_linux.go b/.ci/providerlint/vendor/golang.org/x/sys/cpu/proc_cpuinfo_linux.go
new file mode 100644
index 00000000000..d87bd6b3eb0
--- /dev/null
+++ b/.ci/providerlint/vendor/golang.org/x/sys/cpu/proc_cpuinfo_linux.go
@@ -0,0 +1,54 @@
+// Copyright 2022 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build linux && arm64
+// +build linux,arm64
+
+package cpu
+
+import (
+	"errors"
+	"io"
+	"os"
+	"strings"
+)
+
+func readLinuxProcCPUInfo() error {
+	f, err := os.Open("/proc/cpuinfo")
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+
+	var buf [1 << 10]byte // enough for first CPU
+	n, err := io.ReadFull(f, buf[:])
+	if err != nil && err != io.ErrUnexpectedEOF {
+		return err
+	}
+	in := string(buf[:n])
+	const features = "\nFeatures	: "
+	i := strings.Index(in, features)
+	if i == -1 {
+		return errors.New("no CPU features found")
+	}
+	in = in[i+len(features):]
+	if i := strings.Index(in, "\n"); i != -1 {
+		in = in[:i]
+	}
+	m := map[string]*bool{}
+
+	initOptions() // need it early here; it's harmless to call twice
+	for _, o := range options {
+		m[o.Name] = o.Feature
+	}
+	// The EVTSTRM field has alias "evstrm" in Go, but Linux calls it "evtstrm".
+	m["evtstrm"] = &ARM64.HasEVTSTRM
+
+	for _, f := range strings.Fields(in) {
+		if p, ok := m[f]; ok {
+			*p = true
+		}
+	}
+	return nil
+}
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/cpu/runtime_auxv.go b/.ci/providerlint/vendor/golang.org/x/sys/cpu/runtime_auxv.go
new file mode 100644
index 00000000000..5f92ac9a2e2
--- /dev/null
+++ b/.ci/providerlint/vendor/golang.org/x/sys/cpu/runtime_auxv.go
@@ -0,0 +1,16 @@
+// Copyright 2023 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package cpu
+
+// getAuxvFn is non-nil on Go 1.21+ (via runtime_auxv_go121.go init)
+// on platforms that use auxv.
+var getAuxvFn func() []uintptr
+
+func getAuxv() []uintptr {
+	if getAuxvFn == nil {
+		return nil
+	}
+	return getAuxvFn()
+}
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/cpu/runtime_auxv_go121.go b/.ci/providerlint/vendor/golang.org/x/sys/cpu/runtime_auxv_go121.go
new file mode 100644
index 00000000000..b975ea2a04e
--- /dev/null
+++ b/.ci/providerlint/vendor/golang.org/x/sys/cpu/runtime_auxv_go121.go
@@ -0,0 +1,19 @@
+// Copyright 2023 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build go1.21
+// +build go1.21
+
+package cpu
+
+import (
+	_ "unsafe" // for linkname
+)
+
+//go:linkname runtime_getAuxv runtime.getAuxv
+func runtime_getAuxv() []uintptr
+
+func init() {
+	getAuxvFn = runtime_getAuxv
+}
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/cpu/syscall_aix_gccgo.go b/.ci/providerlint/vendor/golang.org/x/sys/cpu/syscall_aix_gccgo.go
new file mode 100644
index 00000000000..96134157a10
--- /dev/null
+++ b/.ci/providerlint/vendor/golang.org/x/sys/cpu/syscall_aix_gccgo.go
@@ -0,0 +1,27 @@
+// Copyright 2020 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// Recreate a getsystemcfg syscall handler instead of
+// using the one provided by x/sys/unix to avoid having
+// the dependency between them. (See golang.org/issue/32102)
+// Moreover, this file will be used during the building of
+// gccgo's libgo and thus must not used a CGo method.
+
+//go:build aix && gccgo
+// +build aix,gccgo
+
+package cpu
+
+import (
+	"syscall"
+)
+
+//extern getsystemcfg
+func gccgoGetsystemcfg(label uint32) (r uint64)
+
+func callgetsystemcfg(label int) (r1 uintptr, e1 syscall.Errno) {
+	r1 = uintptr(gccgoGetsystemcfg(uint32(label)))
+	e1 = syscall.GetErrno()
+	return
+}
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/cpu/syscall_aix_ppc64_gc.go b/.ci/providerlint/vendor/golang.org/x/sys/cpu/syscall_aix_ppc64_gc.go
new file mode 100644
index 00000000000..904be42ffdc
--- /dev/null
+++ b/.ci/providerlint/vendor/golang.org/x/sys/cpu/syscall_aix_ppc64_gc.go
@@ -0,0 +1,36 @@
+// Copyright 2019 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// Minimal copy of x/sys/unix so the cpu package can make a
+// system call on AIX without depending on x/sys/unix.
+// (See golang.org/issue/32102)
+
+//go:build aix && ppc64 && gc
+// +build aix,ppc64,gc
+
+package cpu
+
+import (
+	"syscall"
+	"unsafe"
+)
+
+//go:cgo_import_dynamic libc_getsystemcfg getsystemcfg "libc.a/shr_64.o"
+
+//go:linkname libc_getsystemcfg libc_getsystemcfg
+
+type syscallFunc uintptr
+
+var libc_getsystemcfg syscallFunc
+
+type errno = syscall.Errno
+
+// Implemented in runtime/syscall_aix.go.
+func rawSyscall6(trap, nargs, a1, a2, a3, a4, a5, a6 uintptr) (r1, r2 uintptr, err errno)
+func syscall6(trap, nargs, a1, a2, a3, a4, a5, a6 uintptr) (r1, r2 uintptr, err errno)
+
+func callgetsystemcfg(label int) (r1 uintptr, e1 errno) {
+	r1, _, e1 = syscall6(uintptr(unsafe.Pointer(&libc_getsystemcfg)), 1, uintptr(label), 0, 0, 0, 0, 0)
+	return
+}
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/mkall.sh b/.ci/providerlint/vendor/golang.org/x/sys/unix/mkall.sh
index 8e3947c3686..e6f31d374df 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/mkall.sh
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/mkall.sh
@@ -50,7 +50,7 @@ if [[ "$GOOS" = "linux" ]]; then
 	# Use the Docker-based build system
 	# Files generated through docker (use $cmd so you can Ctl-C the build or run)
 	$cmd docker build --tag generate:$GOOS $GOOS
-	$cmd docker run --interactive --tty --volume $(cd -- "$(dirname -- "$0")/.." && /bin/pwd):/build generate:$GOOS
+	$cmd docker run --interactive --tty --volume $(cd -- "$(dirname -- "$0")/.." && pwd):/build generate:$GOOS
 	exit
 fi
 
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/mkerrors.sh b/.ci/providerlint/vendor/golang.org/x/sys/unix/mkerrors.sh
index 2045d3dadb8..47fa6a7ebd4 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/mkerrors.sh
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/mkerrors.sh
@@ -204,6 +204,7 @@ struct ltchars {
 #include <sys/timerfd.h>
 #include <sys/uio.h>
 #include <sys/xattr.h>
+#include <netinet/udp.h>
 #include <linux/audit.h>
 #include <linux/bpf.h>
 #include <linux/can.h>
@@ -518,7 +519,7 @@ ccflags="$@"
 		$2 ~ /^LOCK_(SH|EX|NB|UN)$/ ||
 		$2 ~ /^LO_(KEY|NAME)_SIZE$/ ||
 		$2 ~ /^LOOP_(CLR|CTL|GET|SET)_/ ||
-		$2 ~ /^(AF|SOCK|SO|SOL|IPPROTO|IP|IPV6|TCP|MCAST|EVFILT|NOTE|SHUT|PROT|MAP|MFD|T?PACKET|MSG|SCM|MCL|DT|MADV|PR|LOCAL|TCPOPT)_/ ||
+		$2 ~ /^(AF|SOCK|SO|SOL|IPPROTO|IP|IPV6|TCP|MCAST|EVFILT|NOTE|SHUT|PROT|MAP|MREMAP|MFD|T?PACKET|MSG|SCM|MCL|DT|MADV|PR|LOCAL|TCPOPT|UDP)_/ ||
 		$2 ~ /^NFC_(GENL|PROTO|COMM|RF|SE|DIRECTION|LLCP|SOCKPROTO)_/ ||
 		$2 ~ /^NFC_.*_(MAX)?SIZE$/ ||
 		$2 ~ /^RAW_PAYLOAD_/ ||
@@ -582,6 +583,7 @@ ccflags="$@"
 		$2 ~ /^PERF_/ ||
 		$2 ~ /^SECCOMP_MODE_/ ||
 		$2 ~ /^SEEK_/ ||
+		$2 ~ /^SCHED_/ ||
 		$2 ~ /^SPLICE_/ ||
 		$2 ~ /^SYNC_FILE_RANGE_/ ||
 		$2 !~ /IOC_MAGIC/ &&
@@ -623,7 +625,7 @@ ccflags="$@"
 		$2 ~ /^MEM/ ||
 		$2 ~ /^WG/ ||
 		$2 ~ /^FIB_RULE_/ ||
-		$2 ~ /^BLK[A-Z]*(GET$|SET$|BUF$|PART$|SIZE)/ {printf("\t%s = C.%s\n", $2, $2)}
+		$2 ~ /^BLK[A-Z]*(GET$|SET$|BUF$|PART$|SIZE|IOMIN$|IOOPT$|ALIGNOFF$|DISCARD|ROTATIONAL$|ZEROOUT$|GETDISKSEQ$)/ {printf("\t%s = C.%s\n", $2, $2)}
 		$2 ~ /^__WCOREFLAG$/ {next}
 		$2 ~ /^__W[A-Z0-9]+$/ {printf("\t%s = C.%s\n", substr($2,3), $2)}
 
@@ -740,7 +742,8 @@ main(void)
 		e = errors[i].num;
 		if(i > 0 && errors[i-1].num == e)
 			continue;
-		strcpy(buf, strerror(e));
+		strncpy(buf, strerror(e), sizeof(buf) - 1);
+		buf[sizeof(buf) - 1] = '\0';
 		// lowercase first letter: Bad -> bad, but STREAM -> STREAM.
 		if(A <= buf[0] && buf[0] <= Z && a <= buf[1] && buf[1] <= z)
 			buf[0] += a - A;
@@ -759,7 +762,8 @@ main(void)
 		e = signals[i].num;
 		if(i > 0 && signals[i-1].num == e)
 			continue;
-		strcpy(buf, strsignal(e));
+		strncpy(buf, strsignal(e), sizeof(buf) - 1);
+		buf[sizeof(buf) - 1] = '\0';
 		// lowercase first letter: Bad -> bad, but STREAM -> STREAM.
 		if(A <= buf[0] && buf[0] <= Z && a <= buf[1] && buf[1] <= z)
 			buf[0] += a - A;
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/mmap_nomremap.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/mmap_nomremap.go
new file mode 100644
index 00000000000..ca0513632ee
--- /dev/null
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/mmap_nomremap.go
@@ -0,0 +1,14 @@
+// Copyright 2023 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build aix || darwin || dragonfly || freebsd || openbsd || solaris
+// +build aix darwin dragonfly freebsd openbsd solaris
+
+package unix
+
+var mapper = &mmapper{
+	active: make(map[*byte][]byte),
+	mmap:   mmap,
+	munmap: munmap,
+}
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/mremap.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/mremap.go
new file mode 100644
index 00000000000..fa93d0aa904
--- /dev/null
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/mremap.go
@@ -0,0 +1,53 @@
+// Copyright 2023 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build linux || netbsd
+// +build linux netbsd
+
+package unix
+
+import "unsafe"
+
+type mremapMmapper struct {
+	mmapper
+	mremap func(oldaddr uintptr, oldlength uintptr, newlength uintptr, flags int, newaddr uintptr) (xaddr uintptr, err error)
+}
+
+var mapper = &mremapMmapper{
+	mmapper: mmapper{
+		active: make(map[*byte][]byte),
+		mmap:   mmap,
+		munmap: munmap,
+	},
+	mremap: mremap,
+}
+
+func (m *mremapMmapper) Mremap(oldData []byte, newLength int, flags int) (data []byte, err error) {
+	if newLength <= 0 || len(oldData) == 0 || len(oldData) != cap(oldData) || flags&mremapFixed != 0 {
+		return nil, EINVAL
+	}
+
+	pOld := &oldData[cap(oldData)-1]
+	m.Lock()
+	defer m.Unlock()
+	bOld := m.active[pOld]
+	if bOld == nil || &bOld[0] != &oldData[0] {
+		return nil, EINVAL
+	}
+	newAddr, errno := m.mremap(uintptr(unsafe.Pointer(&bOld[0])), uintptr(len(bOld)), uintptr(newLength), flags, 0)
+	if errno != nil {
+		return nil, errno
+	}
+	bNew := unsafe.Slice((*byte)(unsafe.Pointer(newAddr)), newLength)
+	pNew := &bNew[cap(bNew)-1]
+	if flags&mremapDontunmap == 0 {
+		delete(m.active, pOld)
+	}
+	m.active[pNew] = bNew
+	return bNew, nil
+}
+
+func Mremap(oldData []byte, newLength int, flags int) (data []byte, err error) {
+	return mapper.Mremap(oldData, newLength, flags)
+}
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/ptrace_darwin.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/ptrace_darwin.go
index 39dba6ca6a3..463c3eff7fd 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/ptrace_darwin.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/ptrace_darwin.go
@@ -7,12 +7,6 @@
 
 package unix
 
-import "unsafe"
-
 func ptrace(request int, pid int, addr uintptr, data uintptr) error {
 	return ptrace1(request, pid, addr, data)
 }
-
-func ptracePtr(request int, pid int, addr uintptr, data unsafe.Pointer) error {
-	return ptrace1Ptr(request, pid, addr, data)
-}
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/ptrace_ios.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/ptrace_ios.go
index 9ea66330a96..ed0509a0117 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/ptrace_ios.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/ptrace_ios.go
@@ -7,12 +7,6 @@
 
 package unix
 
-import "unsafe"
-
 func ptrace(request int, pid int, addr uintptr, data uintptr) (err error) {
 	return ENOTSUP
 }
-
-func ptracePtr(request int, pid int, addr uintptr, data unsafe.Pointer) (err error) {
-	return ENOTSUP
-}
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/syscall_aix.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/syscall_aix.go
index c406ae00f41..e94e6cdac88 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/syscall_aix.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/syscall_aix.go
@@ -487,8 +487,6 @@ func Fsync(fd int) error {
 //sys	Unlinkat(dirfd int, path string, flags int) (err error)
 //sys	Ustat(dev int, ubuf *Ustat_t) (err error)
 //sys	write(fd int, p []byte) (n int, err error)
-//sys	readlen(fd int, p *byte, np int) (n int, err error) = read
-//sys	writelen(fd int, p *byte, np int) (n int, err error) = write
 
 //sys	Dup2(oldfd int, newfd int) (err error)
 //sys	Fadvise(fd int, offset int64, length int64, advice int) (err error) = posix_fadvise64
@@ -535,21 +533,6 @@ func Fsync(fd int) error {
 //sys	sendmsg(s int, msg *Msghdr, flags int) (n int, err error) = nsendmsg
 
 //sys	munmap(addr uintptr, length uintptr) (err error)
-
-var mapper = &mmapper{
-	active: make(map[*byte][]byte),
-	mmap:   mmap,
-	munmap: munmap,
-}
-
-func Mmap(fd int, offset int64, length int, prot int, flags int) (data []byte, err error) {
-	return mapper.Mmap(fd, offset, length, prot, flags)
-}
-
-func Munmap(b []byte) (err error) {
-	return mapper.Munmap(b)
-}
-
 //sys	Madvise(b []byte, advice int) (err error)
 //sys	Mprotect(b []byte, prot int) (err error)
 //sys	Mlock(b []byte) (err error)
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/syscall_bsd.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/syscall_bsd.go
index 7705c3270b5..4217de518bc 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/syscall_bsd.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/syscall_bsd.go
@@ -601,20 +601,6 @@ func Poll(fds []PollFd, timeout int) (n int, err error) {
 //	Gethostuuid(uuid *byte, timeout *Timespec) (err error)
 //	Ptrace(req int, pid int, addr uintptr, data int) (ret uintptr, err error)
 
-var mapper = &mmapper{
-	active: make(map[*byte][]byte),
-	mmap:   mmap,
-	munmap: munmap,
-}
-
-func Mmap(fd int, offset int64, length int, prot int, flags int) (data []byte, err error) {
-	return mapper.Mmap(fd, offset, length, prot, flags)
-}
-
-func Munmap(b []byte) (err error) {
-	return mapper.Munmap(b)
-}
-
 //sys	Madvise(b []byte, behav int) (err error)
 //sys	Mlock(b []byte) (err error)
 //sys	Mlockall(flags int) (err error)
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/syscall_darwin.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/syscall_darwin.go
index 206921504cb..59542a897d2 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/syscall_darwin.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/syscall_darwin.go
@@ -510,30 +510,36 @@ func SysctlKinfoProcSlice(name string, args ...int) ([]KinfoProc, error) {
 		return nil, err
 	}
 
-	// Find size.
-	n := uintptr(0)
-	if err := sysctl(mib, nil, &n, nil, 0); err != nil {
-		return nil, err
-	}
-	if n == 0 {
-		return nil, nil
-	}
-	if n%SizeofKinfoProc != 0 {
-		return nil, fmt.Errorf("sysctl() returned a size of %d, which is not a multiple of %d", n, SizeofKinfoProc)
-	}
+	for {
+		// Find size.
+		n := uintptr(0)
+		if err := sysctl(mib, nil, &n, nil, 0); err != nil {
+			return nil, err
+		}
+		if n == 0 {
+			return nil, nil
+		}
+		if n%SizeofKinfoProc != 0 {
+			return nil, fmt.Errorf("sysctl() returned a size of %d, which is not a multiple of %d", n, SizeofKinfoProc)
+		}
 
-	// Read into buffer of that size.
-	buf := make([]KinfoProc, n/SizeofKinfoProc)
-	if err := sysctl(mib, (*byte)(unsafe.Pointer(&buf[0])), &n, nil, 0); err != nil {
-		return nil, err
-	}
-	if n%SizeofKinfoProc != 0 {
-		return nil, fmt.Errorf("sysctl() returned a size of %d, which is not a multiple of %d", n, SizeofKinfoProc)
-	}
+		// Read into buffer of that size.
+		buf := make([]KinfoProc, n/SizeofKinfoProc)
+		if err := sysctl(mib, (*byte)(unsafe.Pointer(&buf[0])), &n, nil, 0); err != nil {
+			if err == ENOMEM {
+				// Process table grew. Try again.
+				continue
+			}
+			return nil, err
+		}
+		if n%SizeofKinfoProc != 0 {
+			return nil, fmt.Errorf("sysctl() returned a size of %d, which is not a multiple of %d", n, SizeofKinfoProc)
+		}
 
-	// The actual call may return less than the original reported required
-	// size so ensure we deal with that.
-	return buf[:n/SizeofKinfoProc], nil
+		// The actual call may return less than the original reported required
+		// size so ensure we deal with that.
+		return buf[:n/SizeofKinfoProc], nil
+	}
 }
 
 //sys	sendfile(infd int, outfd int, offset int64, len *int64, hdtr unsafe.Pointer, flags int) (err error)
@@ -638,189 +644,3 @@ func SysctlKinfoProcSlice(name string, args ...int) ([]KinfoProc, error) {
 //sys	write(fd int, p []byte) (n int, err error)
 //sys	mmap(addr uintptr, length uintptr, prot int, flag int, fd int, pos int64) (ret uintptr, err error)
 //sys	munmap(addr uintptr, length uintptr) (err error)
-//sys	readlen(fd int, buf *byte, nbuf int) (n int, err error) = SYS_READ
-//sys	writelen(fd int, buf *byte, nbuf int) (n int, err error) = SYS_WRITE
-
-/*
- * Unimplemented
- */
-// Profil
-// Sigaction
-// Sigprocmask
-// Getlogin
-// Sigpending
-// Sigaltstack
-// Ioctl
-// Reboot
-// Execve
-// Vfork
-// Sbrk
-// Sstk
-// Ovadvise
-// Mincore
-// Setitimer
-// Swapon
-// Select
-// Sigsuspend
-// Readv
-// Writev
-// Nfssvc
-// Getfh
-// Quotactl
-// Csops
-// Waitid
-// Add_profil
-// Kdebug_trace
-// Sigreturn
-// Atsocket
-// Kqueue_from_portset_np
-// Kqueue_portset
-// Getattrlist
-// Getdirentriesattr
-// Searchfs
-// Delete
-// Copyfile
-// Watchevent
-// Waitevent
-// Modwatch
-// Fsctl
-// Initgroups
-// Posix_spawn
-// Nfsclnt
-// Fhopen
-// Minherit
-// Semsys
-// Msgsys
-// Shmsys
-// Semctl
-// Semget
-// Semop
-// Msgctl
-// Msgget
-// Msgsnd
-// Msgrcv
-// Shm_open
-// Shm_unlink
-// Sem_open
-// Sem_close
-// Sem_unlink
-// Sem_wait
-// Sem_trywait
-// Sem_post
-// Sem_getvalue
-// Sem_init
-// Sem_destroy
-// Open_extended
-// Umask_extended
-// Stat_extended
-// Lstat_extended
-// Fstat_extended
-// Chmod_extended
-// Fchmod_extended
-// Access_extended
-// Settid
-// Gettid
-// Setsgroups
-// Getsgroups
-// Setwgroups
-// Getwgroups
-// Mkfifo_extended
-// Mkdir_extended
-// Identitysvc
-// Shared_region_check_np
-// Shared_region_map_np
-// __pthread_mutex_destroy
-// __pthread_mutex_init
-// __pthread_mutex_lock
-// __pthread_mutex_trylock
-// __pthread_mutex_unlock
-// __pthread_cond_init
-// __pthread_cond_destroy
-// __pthread_cond_broadcast
-// __pthread_cond_signal
-// Setsid_with_pid
-// __pthread_cond_timedwait
-// Aio_fsync
-// Aio_return
-// Aio_suspend
-// Aio_cancel
-// Aio_error
-// Aio_read
-// Aio_write
-// Lio_listio
-// __pthread_cond_wait
-// Iopolicysys
-// __pthread_kill
-// __pthread_sigmask
-// __sigwait
-// __disable_threadsignal
-// __pthread_markcancel
-// __pthread_canceled
-// __semwait_signal
-// Proc_info
-// sendfile
-// Stat64_extended
-// Lstat64_extended
-// Fstat64_extended
-// __pthread_chdir
-// __pthread_fchdir
-// Audit
-// Auditon
-// Getauid
-// Setauid
-// Getaudit
-// Setaudit
-// Getaudit_addr
-// Setaudit_addr
-// Auditctl
-// Bsdthread_create
-// Bsdthread_terminate
-// Stack_snapshot
-// Bsdthread_register
-// Workq_open
-// Workq_ops
-// __mac_execve
-// __mac_syscall
-// __mac_get_file
-// __mac_set_file
-// __mac_get_link
-// __mac_set_link
-// __mac_get_proc
-// __mac_set_proc
-// __mac_get_fd
-// __mac_set_fd
-// __mac_get_pid
-// __mac_get_lcid
-// __mac_get_lctx
-// __mac_set_lctx
-// Setlcid
-// Read_nocancel
-// Write_nocancel
-// Open_nocancel
-// Close_nocancel
-// Wait4_nocancel
-// Recvmsg_nocancel
-// Sendmsg_nocancel
-// Recvfrom_nocancel
-// Accept_nocancel
-// Fcntl_nocancel
-// Select_nocancel
-// Fsync_nocancel
-// Connect_nocancel
-// Sigsuspend_nocancel
-// Readv_nocancel
-// Writev_nocancel
-// Sendto_nocancel
-// Pread_nocancel
-// Pwrite_nocancel
-// Waitid_nocancel
-// Poll_nocancel
-// Msgsnd_nocancel
-// Msgrcv_nocancel
-// Sem_wait_nocancel
-// Aio_suspend_nocancel
-// __sigwait_nocancel
-// __semwait_signal_nocancel
-// __mac_mount
-// __mac_get_mount
-// __mac_getfsstat
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/syscall_darwin_amd64.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/syscall_darwin_amd64.go
index 9fa879806bc..b37310ce9b4 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/syscall_darwin_amd64.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/syscall_darwin_amd64.go
@@ -47,6 +47,5 @@ func Syscall9(num, a1, a2, a3, a4, a5, a6, a7, a8, a9 uintptr) (r1, r2 uintptr,
 //sys	getfsstat(buf unsafe.Pointer, size uintptr, flags int) (n int, err error) = SYS_GETFSSTAT64
 //sys	Lstat(path string, stat *Stat_t) (err error) = SYS_LSTAT64
 //sys	ptrace1(request int, pid int, addr uintptr, data uintptr) (err error) = SYS_ptrace
-//sys	ptrace1Ptr(request int, pid int, addr unsafe.Pointer, data uintptr) (err error) = SYS_ptrace
 //sys	Stat(path string, stat *Stat_t) (err error) = SYS_STAT64
 //sys	Statfs(path string, stat *Statfs_t) (err error) = SYS_STATFS64
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/syscall_darwin_arm64.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/syscall_darwin_arm64.go
index f17b8c526a5..d51ec996304 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/syscall_darwin_arm64.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/syscall_darwin_arm64.go
@@ -47,6 +47,5 @@ func Syscall9(num, a1, a2, a3, a4, a5, a6, a7, a8, a9 uintptr) (r1, r2 uintptr,
 //sys	getfsstat(buf unsafe.Pointer, size uintptr, flags int) (n int, err error) = SYS_GETFSSTAT
 //sys	Lstat(path string, stat *Stat_t) (err error)
 //sys	ptrace1(request int, pid int, addr uintptr, data uintptr) (err error) = SYS_ptrace
-//sys	ptrace1Ptr(request int, pid int, addr unsafe.Pointer, data uintptr) (err error) = SYS_ptrace
 //sys	Stat(path string, stat *Stat_t) (err error)
 //sys	Statfs(path string, stat *Statfs_t) (err error)
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/syscall_dragonfly.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/syscall_dragonfly.go
index d4ce988e72f..97cb916f2c9 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/syscall_dragonfly.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/syscall_dragonfly.go
@@ -343,203 +343,5 @@ func Sendfile(outfd int, infd int, offset *int64, count int) (written int, err e
 //sys	write(fd int, p []byte) (n int, err error)
 //sys	mmap(addr uintptr, length uintptr, prot int, flag int, fd int, pos int64) (ret uintptr, err error)
 //sys	munmap(addr uintptr, length uintptr) (err error)
-//sys	readlen(fd int, buf *byte, nbuf int) (n int, err error) = SYS_READ
-//sys	writelen(fd int, buf *byte, nbuf int) (n int, err error) = SYS_WRITE
 //sys	accept4(fd int, rsa *RawSockaddrAny, addrlen *_Socklen, flags int) (nfd int, err error)
 //sys	utimensat(dirfd int, path string, times *[2]Timespec, flags int) (err error)
-
-/*
- * Unimplemented
- * TODO(jsing): Update this list for DragonFly.
- */
-// Profil
-// Sigaction
-// Sigprocmask
-// Getlogin
-// Sigpending
-// Sigaltstack
-// Reboot
-// Execve
-// Vfork
-// Sbrk
-// Sstk
-// Ovadvise
-// Mincore
-// Setitimer
-// Swapon
-// Select
-// Sigsuspend
-// Readv
-// Writev
-// Nfssvc
-// Getfh
-// Quotactl
-// Mount
-// Csops
-// Waitid
-// Add_profil
-// Kdebug_trace
-// Sigreturn
-// Atsocket
-// Kqueue_from_portset_np
-// Kqueue_portset
-// Getattrlist
-// Setattrlist
-// Getdirentriesattr
-// Searchfs
-// Delete
-// Copyfile
-// Watchevent
-// Waitevent
-// Modwatch
-// Getxattr
-// Fgetxattr
-// Setxattr
-// Fsetxattr
-// Removexattr
-// Fremovexattr
-// Listxattr
-// Flistxattr
-// Fsctl
-// Initgroups
-// Posix_spawn
-// Nfsclnt
-// Fhopen
-// Minherit
-// Semsys
-// Msgsys
-// Shmsys
-// Semctl
-// Semget
-// Semop
-// Msgctl
-// Msgget
-// Msgsnd
-// Msgrcv
-// Shmat
-// Shmctl
-// Shmdt
-// Shmget
-// Shm_open
-// Shm_unlink
-// Sem_open
-// Sem_close
-// Sem_unlink
-// Sem_wait
-// Sem_trywait
-// Sem_post
-// Sem_getvalue
-// Sem_init
-// Sem_destroy
-// Open_extended
-// Umask_extended
-// Stat_extended
-// Lstat_extended
-// Fstat_extended
-// Chmod_extended
-// Fchmod_extended
-// Access_extended
-// Settid
-// Gettid
-// Setsgroups
-// Getsgroups
-// Setwgroups
-// Getwgroups
-// Mkfifo_extended
-// Mkdir_extended
-// Identitysvc
-// Shared_region_check_np
-// Shared_region_map_np
-// __pthread_mutex_destroy
-// __pthread_mutex_init
-// __pthread_mutex_lock
-// __pthread_mutex_trylock
-// __pthread_mutex_unlock
-// __pthread_cond_init
-// __pthread_cond_destroy
-// __pthread_cond_broadcast
-// __pthread_cond_signal
-// Setsid_with_pid
-// __pthread_cond_timedwait
-// Aio_fsync
-// Aio_return
-// Aio_suspend
-// Aio_cancel
-// Aio_error
-// Aio_read
-// Aio_write
-// Lio_listio
-// __pthread_cond_wait
-// Iopolicysys
-// __pthread_kill
-// __pthread_sigmask
-// __sigwait
-// __disable_threadsignal
-// __pthread_markcancel
-// __pthread_canceled
-// __semwait_signal
-// Proc_info
-// Stat64_extended
-// Lstat64_extended
-// Fstat64_extended
-// __pthread_chdir
-// __pthread_fchdir
-// Audit
-// Auditon
-// Getauid
-// Setauid
-// Getaudit
-// Setaudit
-// Getaudit_addr
-// Setaudit_addr
-// Auditctl
-// Bsdthread_create
-// Bsdthread_terminate
-// Stack_snapshot
-// Bsdthread_register
-// Workq_open
-// Workq_ops
-// __mac_execve
-// __mac_syscall
-// __mac_get_file
-// __mac_set_file
-// __mac_get_link
-// __mac_set_link
-// __mac_get_proc
-// __mac_set_proc
-// __mac_get_fd
-// __mac_set_fd
-// __mac_get_pid
-// __mac_get_lcid
-// __mac_get_lctx
-// __mac_set_lctx
-// Setlcid
-// Read_nocancel
-// Write_nocancel
-// Open_nocancel
-// Close_nocancel
-// Wait4_nocancel
-// Recvmsg_nocancel
-// Sendmsg_nocancel
-// Recvfrom_nocancel
-// Accept_nocancel
-// Fcntl_nocancel
-// Select_nocancel
-// Fsync_nocancel
-// Connect_nocancel
-// Sigsuspend_nocancel
-// Readv_nocancel
-// Writev_nocancel
-// Sendto_nocancel
-// Pread_nocancel
-// Pwrite_nocancel
-// Waitid_nocancel
-// Msgsnd_nocancel
-// Msgrcv_nocancel
-// Sem_wait_nocancel
-// Aio_suspend_nocancel
-// __sigwait_nocancel
-// __semwait_signal_nocancel
-// __mac_mount
-// __mac_get_mount
-// __mac_getfsstat
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/syscall_freebsd.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/syscall_freebsd.go
index afb10106f6e..64d1bb4dba5 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/syscall_freebsd.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/syscall_freebsd.go
@@ -449,197 +449,5 @@ func Dup3(oldfd, newfd, flags int) error {
 //sys	write(fd int, p []byte) (n int, err error)
 //sys	mmap(addr uintptr, length uintptr, prot int, flag int, fd int, pos int64) (ret uintptr, err error)
 //sys	munmap(addr uintptr, length uintptr) (err error)
-//sys	readlen(fd int, buf *byte, nbuf int) (n int, err error) = SYS_READ
-//sys	writelen(fd int, buf *byte, nbuf int) (n int, err error) = SYS_WRITE
 //sys	accept4(fd int, rsa *RawSockaddrAny, addrlen *_Socklen, flags int) (nfd int, err error)
 //sys	utimensat(dirfd int, path string, times *[2]Timespec, flags int) (err error)
-
-/*
- * Unimplemented
- */
-// Profil
-// Sigaction
-// Sigprocmask
-// Getlogin
-// Sigpending
-// Sigaltstack
-// Ioctl
-// Reboot
-// Execve
-// Vfork
-// Sbrk
-// Sstk
-// Ovadvise
-// Mincore
-// Setitimer
-// Swapon
-// Select
-// Sigsuspend
-// Readv
-// Writev
-// Nfssvc
-// Getfh
-// Quotactl
-// Mount
-// Csops
-// Waitid
-// Add_profil
-// Kdebug_trace
-// Sigreturn
-// Atsocket
-// Kqueue_from_portset_np
-// Kqueue_portset
-// Getattrlist
-// Setattrlist
-// Getdents
-// Getdirentriesattr
-// Searchfs
-// Delete
-// Copyfile
-// Watchevent
-// Waitevent
-// Modwatch
-// Fsctl
-// Initgroups
-// Posix_spawn
-// Nfsclnt
-// Fhopen
-// Minherit
-// Semsys
-// Msgsys
-// Shmsys
-// Semctl
-// Semget
-// Semop
-// Msgctl
-// Msgget
-// Msgsnd
-// Msgrcv
-// Shmat
-// Shmctl
-// Shmdt
-// Shmget
-// Shm_open
-// Shm_unlink
-// Sem_open
-// Sem_close
-// Sem_unlink
-// Sem_wait
-// Sem_trywait
-// Sem_post
-// Sem_getvalue
-// Sem_init
-// Sem_destroy
-// Open_extended
-// Umask_extended
-// Stat_extended
-// Lstat_extended
-// Fstat_extended
-// Chmod_extended
-// Fchmod_extended
-// Access_extended
-// Settid
-// Gettid
-// Setsgroups
-// Getsgroups
-// Setwgroups
-// Getwgroups
-// Mkfifo_extended
-// Mkdir_extended
-// Identitysvc
-// Shared_region_check_np
-// Shared_region_map_np
-// __pthread_mutex_destroy
-// __pthread_mutex_init
-// __pthread_mutex_lock
-// __pthread_mutex_trylock
-// __pthread_mutex_unlock
-// __pthread_cond_init
-// __pthread_cond_destroy
-// __pthread_cond_broadcast
-// __pthread_cond_signal
-// Setsid_with_pid
-// __pthread_cond_timedwait
-// Aio_fsync
-// Aio_return
-// Aio_suspend
-// Aio_cancel
-// Aio_error
-// Aio_read
-// Aio_write
-// Lio_listio
-// __pthread_cond_wait
-// Iopolicysys
-// __pthread_kill
-// __pthread_sigmask
-// __sigwait
-// __disable_threadsignal
-// __pthread_markcancel
-// __pthread_canceled
-// __semwait_signal
-// Proc_info
-// Stat64_extended
-// Lstat64_extended
-// Fstat64_extended
-// __pthread_chdir
-// __pthread_fchdir
-// Audit
-// Auditon
-// Getauid
-// Setauid
-// Getaudit
-// Setaudit
-// Getaudit_addr
-// Setaudit_addr
-// Auditctl
-// Bsdthread_create
-// Bsdthread_terminate
-// Stack_snapshot
-// Bsdthread_register
-// Workq_open
-// Workq_ops
-// __mac_execve
-// __mac_syscall
-// __mac_get_file
-// __mac_set_file
-// __mac_get_link
-// __mac_set_link
-// __mac_get_proc
-// __mac_set_proc
-// __mac_get_fd
-// __mac_set_fd
-// __mac_get_pid
-// __mac_get_lcid
-// __mac_get_lctx
-// __mac_set_lctx
-// Setlcid
-// Read_nocancel
-// Write_nocancel
-// Open_nocancel
-// Close_nocancel
-// Wait4_nocancel
-// Recvmsg_nocancel
-// Sendmsg_nocancel
-// Recvfrom_nocancel
-// Accept_nocancel
-// Fcntl_nocancel
-// Select_nocancel
-// Fsync_nocancel
-// Connect_nocancel
-// Sigsuspend_nocancel
-// Readv_nocancel
-// Writev_nocancel
-// Sendto_nocancel
-// Pread_nocancel
-// Pwrite_nocancel
-// Waitid_nocancel
-// Poll_nocancel
-// Msgsnd_nocancel
-// Msgrcv_nocancel
-// Sem_wait_nocancel
-// Aio_suspend_nocancel
-// __sigwait_nocancel
-// __semwait_signal_nocancel
-// __mac_mount
-// __mac_get_mount
-// __mac_getfsstat
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/syscall_linux.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/syscall_linux.go
index fbaeb5fff14..fb4e50224c9 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/syscall_linux.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/syscall_linux.go
@@ -693,10 +693,10 @@ type SockaddrALG struct {
 
 func (sa *SockaddrALG) sockaddr() (unsafe.Pointer, _Socklen, error) {
 	// Leave room for NUL byte terminator.
-	if len(sa.Type) > 13 {
+	if len(sa.Type) > len(sa.raw.Type)-1 {
 		return nil, 0, EINVAL
 	}
-	if len(sa.Name) > 63 {
+	if len(sa.Name) > len(sa.raw.Name)-1 {
 		return nil, 0, EINVAL
 	}
 
@@ -704,17 +704,8 @@ func (sa *SockaddrALG) sockaddr() (unsafe.Pointer, _Socklen, error) {
 	sa.raw.Feat = sa.Feature
 	sa.raw.Mask = sa.Mask
 
-	typ, err := ByteSliceFromString(sa.Type)
-	if err != nil {
-		return nil, 0, err
-	}
-	name, err := ByteSliceFromString(sa.Name)
-	if err != nil {
-		return nil, 0, err
-	}
-
-	copy(sa.raw.Type[:], typ)
-	copy(sa.raw.Name[:], name)
+	copy(sa.raw.Type[:], sa.Type)
+	copy(sa.raw.Name[:], sa.Name)
 
 	return unsafe.Pointer(&sa.raw), SizeofSockaddrALG, nil
 }
@@ -1699,12 +1690,23 @@ func PtracePokeUser(pid int, addr uintptr, data []byte) (count int, err error) {
 	return ptracePoke(PTRACE_POKEUSR, PTRACE_PEEKUSR, pid, addr, data)
 }
 
+// elfNT_PRSTATUS is a copy of the debug/elf.NT_PRSTATUS constant so
+// x/sys/unix doesn't need to depend on debug/elf and thus
+// compress/zlib, debug/dwarf, and other packages.
+const elfNT_PRSTATUS = 1
+
 func PtraceGetRegs(pid int, regsout *PtraceRegs) (err error) {
-	return ptracePtr(PTRACE_GETREGS, pid, 0, unsafe.Pointer(regsout))
+	var iov Iovec
+	iov.Base = (*byte)(unsafe.Pointer(regsout))
+	iov.SetLen(int(unsafe.Sizeof(*regsout)))
+	return ptracePtr(PTRACE_GETREGSET, pid, uintptr(elfNT_PRSTATUS), unsafe.Pointer(&iov))
 }
 
 func PtraceSetRegs(pid int, regs *PtraceRegs) (err error) {
-	return ptracePtr(PTRACE_SETREGS, pid, 0, unsafe.Pointer(regs))
+	var iov Iovec
+	iov.Base = (*byte)(unsafe.Pointer(regs))
+	iov.SetLen(int(unsafe.Sizeof(*regs)))
+	return ptracePtr(PTRACE_SETREGSET, pid, uintptr(elfNT_PRSTATUS), unsafe.Pointer(&iov))
 }
 
 func PtraceSetOptions(pid int, options int) (err error) {
@@ -1874,7 +1876,7 @@ func Getpgrp() (pid int) {
 //sys	PerfEventOpen(attr *PerfEventAttr, pid int, cpu int, groupFd int, flags int) (fd int, err error)
 //sys	PivotRoot(newroot string, putold string) (err error) = SYS_PIVOT_ROOT
 //sys	Prctl(option int, arg2 uintptr, arg3 uintptr, arg4 uintptr, arg5 uintptr) (err error)
-//sys	Pselect(nfd int, r *FdSet, w *FdSet, e *FdSet, timeout *Timespec, sigmask *Sigset_t) (n int, err error) = SYS_PSELECT6
+//sys	pselect6(nfd int, r *FdSet, w *FdSet, e *FdSet, timeout *Timespec, sigmask *sigset_argpack) (n int, err error)
 //sys	read(fd int, p []byte) (n int, err error)
 //sys	Removexattr(path string, attr string) (err error)
 //sys	Renameat2(olddirfd int, oldpath string, newdirfd int, newpath string, flags uint) (err error)
@@ -1977,8 +1979,6 @@ func Signalfd(fd int, sigmask *Sigset_t, flags int) (newfd int, err error) {
 //sys	Unshare(flags int) (err error)
 //sys	write(fd int, p []byte) (n int, err error)
 //sys	exitThread(code int) (err error) = SYS_EXIT
-//sys	readlen(fd int, p *byte, np int) (n int, err error) = SYS_READ
-//sys	writelen(fd int, p *byte, np int) (n int, err error) = SYS_WRITE
 //sys	readv(fd int, iovs []Iovec) (n int, err error) = SYS_READV
 //sys	writev(fd int, iovs []Iovec) (n int, err error) = SYS_WRITEV
 //sys	preadv(fd int, iovs []Iovec, offs_l uintptr, offs_h uintptr) (n int, err error) = SYS_PREADV
@@ -2113,21 +2113,7 @@ func writevRacedetect(iovecs []Iovec, n int) {
 
 // mmap varies by architecture; see syscall_linux_*.go.
 //sys	munmap(addr uintptr, length uintptr) (err error)
-
-var mapper = &mmapper{
-	active: make(map[*byte][]byte),
-	mmap:   mmap,
-	munmap: munmap,
-}
-
-func Mmap(fd int, offset int64, length int, prot int, flags int) (data []byte, err error) {
-	return mapper.Mmap(fd, offset, length, prot, flags)
-}
-
-func Munmap(b []byte) (err error) {
-	return mapper.Munmap(b)
-}
-
+//sys	mremap(oldaddr uintptr, oldlength uintptr, newlength uintptr, flags int, newaddr uintptr) (xaddr uintptr, err error)
 //sys	Madvise(b []byte, advice int) (err error)
 //sys	Mprotect(b []byte, prot int) (err error)
 //sys	Mlock(b []byte) (err error)
@@ -2136,6 +2122,12 @@ func Munmap(b []byte) (err error) {
 //sys	Munlock(b []byte) (err error)
 //sys	Munlockall() (err error)
 
+const (
+	mremapFixed     = MREMAP_FIXED
+	mremapDontunmap = MREMAP_DONTUNMAP
+	mremapMaymove   = MREMAP_MAYMOVE
+)
+
 // Vmsplice splices user pages from a slice of Iovecs into a pipe specified by fd,
 // using the specified flags.
 func Vmsplice(fd int, iovs []Iovec, flags int) (int, error) {
@@ -2420,99 +2412,73 @@ func PthreadSigmask(how int, set, oldset *Sigset_t) error {
 	return rtSigprocmask(how, set, oldset, _C__NSIG/8)
 }
 
-/*
- * Unimplemented
- */
-// AfsSyscall
-// ArchPrctl
-// Brk
-// ClockNanosleep
-// ClockSettime
-// Clone
-// EpollCtlOld
-// EpollPwait
-// EpollWaitOld
-// Execve
-// Fork
-// Futex
-// GetKernelSyms
-// GetMempolicy
-// GetRobustList
-// GetThreadArea
-// Getpmsg
-// IoCancel
-// IoDestroy
-// IoGetevents
-// IoSetup
-// IoSubmit
-// IoprioGet
-// IoprioSet
-// KexecLoad
-// LookupDcookie
-// Mbind
-// MigratePages
-// Mincore
-// ModifyLdt
-// Mount
-// MovePages
-// MqGetsetattr
-// MqNotify
-// MqOpen
-// MqTimedreceive
-// MqTimedsend
-// MqUnlink
-// Mremap
-// Msgctl
-// Msgget
-// Msgrcv
-// Msgsnd
-// Nfsservctl
-// Personality
-// Pselect6
-// Ptrace
-// Putpmsg
-// Quotactl
-// Readahead
-// Readv
-// RemapFilePages
-// RestartSyscall
-// RtSigaction
-// RtSigpending
-// RtSigqueueinfo
-// RtSigreturn
-// RtSigsuspend
-// RtSigtimedwait
-// SchedGetPriorityMax
-// SchedGetPriorityMin
-// SchedGetparam
-// SchedGetscheduler
-// SchedRrGetInterval
-// SchedSetparam
-// SchedYield
-// Security
-// Semctl
-// Semget
-// Semop
-// Semtimedop
-// SetMempolicy
-// SetRobustList
-// SetThreadArea
-// SetTidAddress
-// Sigaltstack
-// Swapoff
-// Swapon
-// Sysfs
-// TimerCreate
-// TimerDelete
-// TimerGetoverrun
-// TimerGettime
-// TimerSettime
-// Tkill (obsolete)
-// Tuxcall
-// Umount2
-// Uselib
-// Utimensat
-// Vfork
-// Vhangup
-// Vserver
-// _Sysctl
+//sysnb	getresuid(ruid *_C_int, euid *_C_int, suid *_C_int)
+//sysnb	getresgid(rgid *_C_int, egid *_C_int, sgid *_C_int)
+
+func Getresuid() (ruid, euid, suid int) {
+	var r, e, s _C_int
+	getresuid(&r, &e, &s)
+	return int(r), int(e), int(s)
+}
+
+func Getresgid() (rgid, egid, sgid int) {
+	var r, e, s _C_int
+	getresgid(&r, &e, &s)
+	return int(r), int(e), int(s)
+}
+
+// Pselect is a wrapper around the Linux pselect6 system call.
+// This version does not modify the timeout argument.
+func Pselect(nfd int, r *FdSet, w *FdSet, e *FdSet, timeout *Timespec, sigmask *Sigset_t) (n int, err error) {
+	// Per https://man7.org/linux/man-pages/man2/select.2.html#NOTES,
+	// The Linux pselect6() system call modifies its timeout argument.
+	// [Not modifying the argument] is the behavior required by POSIX.1-2001.
+	var mutableTimeout *Timespec
+	if timeout != nil {
+		mutableTimeout = new(Timespec)
+		*mutableTimeout = *timeout
+	}
+
+	// The final argument of the pselect6() system call is not a
+	// sigset_t * pointer, but is instead a structure
+	var kernelMask *sigset_argpack
+	if sigmask != nil {
+		wordBits := 32 << (^uintptr(0) >> 63) // see math.intSize
+
+		// A sigset stores one bit per signal,
+		// offset by 1 (because signal 0 does not exist).
+		// So the number of words needed is ⌈__C_NSIG - 1 / wordBits⌉.
+		sigsetWords := (_C__NSIG - 1 + wordBits - 1) / (wordBits)
+
+		sigsetBytes := uintptr(sigsetWords * (wordBits / 8))
+		kernelMask = &sigset_argpack{
+			ss:    sigmask,
+			ssLen: sigsetBytes,
+		}
+	}
+
+	return pselect6(nfd, r, w, e, mutableTimeout, kernelMask)
+}
+
+//sys	schedSetattr(pid int, attr *SchedAttr, flags uint) (err error)
+//sys	schedGetattr(pid int, attr *SchedAttr, size uint, flags uint) (err error)
+
+// SchedSetAttr is a wrapper for sched_setattr(2) syscall.
+// https://man7.org/linux/man-pages/man2/sched_setattr.2.html
+func SchedSetAttr(pid int, attr *SchedAttr, flags uint) error {
+	if attr == nil {
+		return EINVAL
+	}
+	attr.Size = SizeofSchedAttr
+	return schedSetattr(pid, attr, flags)
+}
+
+// SchedGetAttr is a wrapper for sched_getattr(2) syscall.
+// https://man7.org/linux/man-pages/man2/sched_getattr.2.html
+func SchedGetAttr(pid int, flags uint) (*SchedAttr, error) {
+	attr := &SchedAttr{}
+	if err := schedGetattr(pid, attr, SizeofSchedAttr, flags); err != nil {
+		return nil, err
+	}
+	return attr, nil
+}
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/syscall_linux_amd64.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/syscall_linux_amd64.go
index 5b21fcfd753..70601ce3692 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/syscall_linux_amd64.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/syscall_linux_amd64.go
@@ -40,7 +40,7 @@ func Select(nfd int, r *FdSet, w *FdSet, e *FdSet, timeout *Timeval) (n int, err
 	if timeout != nil {
 		ts = &Timespec{Sec: timeout.Sec, Nsec: timeout.Usec * 1000}
 	}
-	return Pselect(nfd, r, w, e, ts, nil)
+	return pselect6(nfd, r, w, e, ts, nil)
 }
 
 //sys	sendfile(outfd int, infd int, offset *int64, count int) (written int, err error)
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/syscall_linux_arm64.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/syscall_linux_arm64.go
index a81f5742b8a..f5266689af0 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/syscall_linux_arm64.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/syscall_linux_arm64.go
@@ -33,7 +33,7 @@ func Select(nfd int, r *FdSet, w *FdSet, e *FdSet, timeout *Timeval) (n int, err
 	if timeout != nil {
 		ts = &Timespec{Sec: timeout.Sec, Nsec: timeout.Usec * 1000}
 	}
-	return Pselect(nfd, r, w, e, ts, nil)
+	return pselect6(nfd, r, w, e, ts, nil)
 }
 
 //sys	sendfile(outfd int, infd int, offset *int64, count int) (written int, err error)
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/syscall_linux_loong64.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/syscall_linux_loong64.go
index 69d2d7c3db7..f6ab02ec150 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/syscall_linux_loong64.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/syscall_linux_loong64.go
@@ -28,7 +28,7 @@ func Select(nfd int, r *FdSet, w *FdSet, e *FdSet, timeout *Timeval) (n int, err
 	if timeout != nil {
 		ts = &Timespec{Sec: timeout.Sec, Nsec: timeout.Usec * 1000}
 	}
-	return Pselect(nfd, r, w, e, ts, nil)
+	return pselect6(nfd, r, w, e, ts, nil)
 }
 
 //sys	sendfile(outfd int, infd int, offset *int64, count int) (written int, err error)
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/syscall_linux_mips64x.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/syscall_linux_mips64x.go
index 76d564095ef..93fe59d25d9 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/syscall_linux_mips64x.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/syscall_linux_mips64x.go
@@ -31,7 +31,7 @@ func Select(nfd int, r *FdSet, w *FdSet, e *FdSet, timeout *Timeval) (n int, err
 	if timeout != nil {
 		ts = &Timespec{Sec: timeout.Sec, Nsec: timeout.Usec * 1000}
 	}
-	return Pselect(nfd, r, w, e, ts, nil)
+	return pselect6(nfd, r, w, e, ts, nil)
 }
 
 //sys	sendfile(outfd int, infd int, offset *int64, count int) (written int, err error)
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/syscall_linux_riscv64.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/syscall_linux_riscv64.go
index 35851ef70b8..5e6ceee129f 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/syscall_linux_riscv64.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/syscall_linux_riscv64.go
@@ -32,7 +32,7 @@ func Select(nfd int, r *FdSet, w *FdSet, e *FdSet, timeout *Timeval) (n int, err
 	if timeout != nil {
 		ts = &Timespec{Sec: timeout.Sec, Nsec: timeout.Usec * 1000}
 	}
-	return Pselect(nfd, r, w, e, ts, nil)
+	return pselect6(nfd, r, w, e, ts, nil)
 }
 
 //sys	sendfile(outfd int, infd int, offset *int64, count int) (written int, err error)
@@ -177,3 +177,14 @@ func KexecFileLoad(kernelFd int, initrdFd int, cmdline string, flags int) error
 	}
 	return kexecFileLoad(kernelFd, initrdFd, cmdlineLen, cmdline, flags)
 }
+
+//sys	riscvHWProbe(pairs []RISCVHWProbePairs, cpuCount uintptr, cpus *CPUSet, flags uint) (err error)
+
+func RISCVHWProbe(pairs []RISCVHWProbePairs, set *CPUSet, flags uint) (err error) {
+	var setSize uintptr
+
+	if set != nil {
+		setSize = uintptr(unsafe.Sizeof(*set))
+	}
+	return riscvHWProbe(pairs, setSize, set, flags)
+}
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/syscall_netbsd.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/syscall_netbsd.go
index 018d7d47822..88162099af5 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/syscall_netbsd.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/syscall_netbsd.go
@@ -356,266 +356,16 @@ func Statvfs(path string, buf *Statvfs_t) (err error) {
 //sys	write(fd int, p []byte) (n int, err error)
 //sys	mmap(addr uintptr, length uintptr, prot int, flag int, fd int, pos int64) (ret uintptr, err error)
 //sys	munmap(addr uintptr, length uintptr) (err error)
-//sys	readlen(fd int, buf *byte, nbuf int) (n int, err error) = SYS_READ
-//sys	writelen(fd int, buf *byte, nbuf int) (n int, err error) = SYS_WRITE
 //sys	utimensat(dirfd int, path string, times *[2]Timespec, flags int) (err error)
 
-/*
- * Unimplemented
- */
-// ____semctl13
-// __clone
-// __fhopen40
-// __fhstat40
-// __fhstatvfs140
-// __fstat30
-// __getcwd
-// __getfh30
-// __getlogin
-// __lstat30
-// __mount50
-// __msgctl13
-// __msync13
-// __ntp_gettime30
-// __posix_chown
-// __posix_fchown
-// __posix_lchown
-// __posix_rename
-// __setlogin
-// __shmctl13
-// __sigaction_sigtramp
-// __sigaltstack14
-// __sigpending14
-// __sigprocmask14
-// __sigsuspend14
-// __sigtimedwait
-// __stat30
-// __syscall
-// __vfork14
-// _ksem_close
-// _ksem_destroy
-// _ksem_getvalue
-// _ksem_init
-// _ksem_open
-// _ksem_post
-// _ksem_trywait
-// _ksem_unlink
-// _ksem_wait
-// _lwp_continue
-// _lwp_create
-// _lwp_ctl
-// _lwp_detach
-// _lwp_exit
-// _lwp_getname
-// _lwp_getprivate
-// _lwp_kill
-// _lwp_park
-// _lwp_self
-// _lwp_setname
-// _lwp_setprivate
-// _lwp_suspend
-// _lwp_unpark
-// _lwp_unpark_all
-// _lwp_wait
-// _lwp_wakeup
-// _pset_bind
-// _sched_getaffinity
-// _sched_getparam
-// _sched_setaffinity
-// _sched_setparam
-// acct
-// aio_cancel
-// aio_error
-// aio_fsync
-// aio_read
-// aio_return
-// aio_suspend
-// aio_write
-// break
-// clock_getres
-// clock_gettime
-// clock_settime
-// compat_09_ogetdomainname
-// compat_09_osetdomainname
-// compat_09_ouname
-// compat_10_omsgsys
-// compat_10_osemsys
-// compat_10_oshmsys
-// compat_12_fstat12
-// compat_12_getdirentries
-// compat_12_lstat12
-// compat_12_msync
-// compat_12_oreboot
-// compat_12_oswapon
-// compat_12_stat12
-// compat_13_sigaction13
-// compat_13_sigaltstack13
-// compat_13_sigpending13
-// compat_13_sigprocmask13
-// compat_13_sigreturn13
-// compat_13_sigsuspend13
-// compat_14___semctl
-// compat_14_msgctl
-// compat_14_shmctl
-// compat_16___sigaction14
-// compat_16___sigreturn14
-// compat_20_fhstatfs
-// compat_20_fstatfs
-// compat_20_getfsstat
-// compat_20_statfs
-// compat_30___fhstat30
-// compat_30___fstat13
-// compat_30___lstat13
-// compat_30___stat13
-// compat_30_fhopen
-// compat_30_fhstat
-// compat_30_fhstatvfs1
-// compat_30_getdents
-// compat_30_getfh
-// compat_30_ntp_gettime
-// compat_30_socket
-// compat_40_mount
-// compat_43_fstat43
-// compat_43_lstat43
-// compat_43_oaccept
-// compat_43_ocreat
-// compat_43_oftruncate
-// compat_43_ogetdirentries
-// compat_43_ogetdtablesize
-// compat_43_ogethostid
-// compat_43_ogethostname
-// compat_43_ogetkerninfo
-// compat_43_ogetpagesize
-// compat_43_ogetpeername
-// compat_43_ogetrlimit
-// compat_43_ogetsockname
-// compat_43_okillpg
-// compat_43_olseek
-// compat_43_ommap
-// compat_43_oquota
-// compat_43_orecv
-// compat_43_orecvfrom
-// compat_43_orecvmsg
-// compat_43_osend
-// compat_43_osendmsg
-// compat_43_osethostid
-// compat_43_osethostname
-// compat_43_osigblock
-// compat_43_osigsetmask
-// compat_43_osigstack
-// compat_43_osigvec
-// compat_43_otruncate
-// compat_43_owait
-// compat_43_stat43
-// execve
-// extattr_delete_fd
-// extattr_delete_file
-// extattr_delete_link
-// extattr_get_fd
-// extattr_get_file
-// extattr_get_link
-// extattr_list_fd
-// extattr_list_file
-// extattr_list_link
-// extattr_set_fd
-// extattr_set_file
-// extattr_set_link
-// extattrctl
-// fchroot
-// fdatasync
-// fgetxattr
-// fktrace
-// flistxattr
-// fork
-// fremovexattr
-// fsetxattr
-// fstatvfs1
-// fsync_range
-// getcontext
-// getitimer
-// getvfsstat
-// getxattr
-// ktrace
-// lchflags
-// lchmod
-// lfs_bmapv
-// lfs_markv
-// lfs_segclean
-// lfs_segwait
-// lgetxattr
-// lio_listio
-// listxattr
-// llistxattr
-// lremovexattr
-// lseek
-// lsetxattr
-// lutimes
-// madvise
-// mincore
-// minherit
-// modctl
-// mq_close
-// mq_getattr
-// mq_notify
-// mq_open
-// mq_receive
-// mq_send
-// mq_setattr
-// mq_timedreceive
-// mq_timedsend
-// mq_unlink
-// mremap
-// msgget
-// msgrcv
-// msgsnd
-// nfssvc
-// ntp_adjtime
-// pmc_control
-// pmc_get_info
-// pollts
-// preadv
-// profil
-// pselect
-// pset_assign
-// pset_create
-// pset_destroy
-// ptrace
-// pwritev
-// quotactl
-// rasctl
-// readv
-// reboot
-// removexattr
-// sa_enable
-// sa_preempt
-// sa_register
-// sa_setconcurrency
-// sa_stacks
-// sa_yield
-// sbrk
-// sched_yield
-// semconfig
-// semget
-// semop
-// setcontext
-// setitimer
-// setxattr
-// shmat
-// shmdt
-// shmget
-// sstk
-// statvfs1
-// swapctl
-// sysarch
-// syscall
-// timer_create
-// timer_delete
-// timer_getoverrun
-// timer_gettime
-// timer_settime
-// undelete
-// utrace
-// uuidgen
-// vadvise
-// vfork
-// writev
+const (
+	mremapFixed     = MAP_FIXED
+	mremapDontunmap = 0
+	mremapMaymove   = 0
+)
+
+//sys	mremapNetBSD(oldp uintptr, oldsize uintptr, newp uintptr, newsize uintptr, flags int) (xaddr uintptr, err error) = SYS_MREMAP
+
+func mremap(oldaddr uintptr, oldlength uintptr, newlength uintptr, flags int, newaddr uintptr) (uintptr, error) {
+	return mremapNetBSD(oldaddr, oldlength, newaddr, newlength, flags)
+}
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/syscall_openbsd.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/syscall_openbsd.go
index f9c7a9663c6..6f34479b597 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/syscall_openbsd.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/syscall_openbsd.go
@@ -151,6 +151,21 @@ func Getfsstat(buf []Statfs_t, flags int) (n int, err error) {
 	return
 }
 
+//sysnb	getresuid(ruid *_C_int, euid *_C_int, suid *_C_int)
+//sysnb	getresgid(rgid *_C_int, egid *_C_int, sgid *_C_int)
+
+func Getresuid() (ruid, euid, suid int) {
+	var r, e, s _C_int
+	getresuid(&r, &e, &s)
+	return int(r), int(e), int(s)
+}
+
+func Getresgid() (rgid, egid, sgid int) {
+	var r, e, s _C_int
+	getresgid(&r, &e, &s)
+	return int(r), int(e), int(s)
+}
+
 //sys	ioctl(fd int, req uint, arg uintptr) (err error)
 //sys	ioctlPtr(fd int, req uint, arg unsafe.Pointer) (err error) = SYS_IOCTL
 
@@ -311,80 +326,4 @@ func Uname(uname *Utsname) error {
 //sys	write(fd int, p []byte) (n int, err error)
 //sys	mmap(addr uintptr, length uintptr, prot int, flag int, fd int, pos int64) (ret uintptr, err error)
 //sys	munmap(addr uintptr, length uintptr) (err error)
-//sys	readlen(fd int, buf *byte, nbuf int) (n int, err error) = SYS_READ
-//sys	writelen(fd int, buf *byte, nbuf int) (n int, err error) = SYS_WRITE
 //sys	utimensat(dirfd int, path string, times *[2]Timespec, flags int) (err error)
-
-/*
- * Unimplemented
- */
-// __getcwd
-// __semctl
-// __syscall
-// __sysctl
-// adjfreq
-// break
-// clock_getres
-// clock_gettime
-// clock_settime
-// closefrom
-// execve
-// fhopen
-// fhstat
-// fhstatfs
-// fork
-// futimens
-// getfh
-// getgid
-// getitimer
-// getlogin
-// getresgid
-// getresuid
-// getthrid
-// ktrace
-// lfs_bmapv
-// lfs_markv
-// lfs_segclean
-// lfs_segwait
-// mincore
-// minherit
-// mount
-// mquery
-// msgctl
-// msgget
-// msgrcv
-// msgsnd
-// nfssvc
-// nnpfspioctl
-// preadv
-// profil
-// pwritev
-// quotactl
-// readv
-// reboot
-// renameat
-// rfork
-// sched_yield
-// semget
-// semop
-// setgroups
-// setitimer
-// setsockopt
-// shmat
-// shmctl
-// shmdt
-// shmget
-// sigaction
-// sigaltstack
-// sigpending
-// sigprocmask
-// sigreturn
-// sigsuspend
-// sysarch
-// syscall
-// threxit
-// thrsigdivert
-// thrsleep
-// thrwakeup
-// vfork
-// writev
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/syscall_solaris.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/syscall_solaris.go
index b600a289d33..b99cfa1342f 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/syscall_solaris.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/syscall_solaris.go
@@ -698,38 +698,6 @@ func Sendfile(outfd int, infd int, offset *int64, count int) (written int, err e
 //sys	setsockopt(s int, level int, name int, val unsafe.Pointer, vallen uintptr) (err error) = libsocket.setsockopt
 //sys	recvfrom(fd int, p []byte, flags int, from *RawSockaddrAny, fromlen *_Socklen) (n int, err error) = libsocket.recvfrom
 
-func readlen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procread)), 3, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf), 0, 0, 0)
-	n = int(r0)
-	if e1 != 0 {
-		err = e1
-	}
-	return
-}
-
-func writelen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procwrite)), 3, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf), 0, 0, 0)
-	n = int(r0)
-	if e1 != 0 {
-		err = e1
-	}
-	return
-}
-
-var mapper = &mmapper{
-	active: make(map[*byte][]byte),
-	mmap:   mmap,
-	munmap: munmap,
-}
-
-func Mmap(fd int, offset int64, length int, prot int, flags int) (data []byte, err error) {
-	return mapper.Mmap(fd, offset, length, prot, flags)
-}
-
-func Munmap(b []byte) (err error) {
-	return mapper.Munmap(b)
-}
-
 // Event Ports
 
 type fileObjCookie struct {
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/syscall_unix.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/syscall_unix.go
index 8e48c29ec33..f6eda27050d 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/syscall_unix.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/syscall_unix.go
@@ -147,6 +147,14 @@ func (m *mmapper) Munmap(data []byte) (err error) {
 	return nil
 }
 
+func Mmap(fd int, offset int64, length int, prot int, flags int) (data []byte, err error) {
+	return mapper.Mmap(fd, offset, length, prot, flags)
+}
+
+func Munmap(b []byte) (err error) {
+	return mapper.Munmap(b)
+}
+
 func Read(fd int, p []byte) (n int, err error) {
 	n, err = read(fd, p)
 	if raceenabled {
@@ -541,6 +549,9 @@ func SetNonblock(fd int, nonblocking bool) (err error) {
 	if err != nil {
 		return err
 	}
+	if (flag&O_NONBLOCK != 0) == nonblocking {
+		return nil
+	}
 	if nonblocking {
 		flag |= O_NONBLOCK
 	} else {
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/syscall_zos_s390x.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/syscall_zos_s390x.go
index d3d49ec3ed7..4596d041ce3 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/syscall_zos_s390x.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/syscall_zos_s390x.go
@@ -192,7 +192,6 @@ func (cmsg *Cmsghdr) SetLen(length int) {
 
 //sys   fcntl(fd int, cmd int, arg int) (val int, err error)
 //sys	read(fd int, p []byte) (n int, err error)
-//sys   readlen(fd int, buf *byte, nbuf int) (n int, err error) = SYS_READ
 //sys	write(fd int, p []byte) (n int, err error)
 
 //sys	accept(s int, rsa *RawSockaddrAny, addrlen *_Socklen) (fd int, err error) = SYS___ACCEPT_A
@@ -285,25 +284,11 @@ func Close(fd int) (err error) {
 	return
 }
 
-var mapper = &mmapper{
-	active: make(map[*byte][]byte),
-	mmap:   mmap,
-	munmap: munmap,
-}
-
 // Dummy function: there are no semantics for Madvise on z/OS
 func Madvise(b []byte, advice int) (err error) {
 	return
 }
 
-func Mmap(fd int, offset int64, length int, prot int, flags int) (data []byte, err error) {
-	return mapper.Mmap(fd, offset, length, prot, flags)
-}
-
-func Munmap(b []byte) (err error) {
-	return mapper.Munmap(b)
-}
-
 //sys   Gethostname(buf []byte) (err error) = SYS___GETHOSTNAME_A
 //sysnb	Getegid() (egid int)
 //sysnb	Geteuid() (uid int)
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/zerrors_linux.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/zerrors_linux.go
index 398c37e52d6..f9c7f479b03 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/zerrors_linux.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/zerrors_linux.go
@@ -493,6 +493,7 @@ const (
 	BPF_F_TEST_RUN_ON_CPU                       = 0x1
 	BPF_F_TEST_STATE_FREQ                       = 0x8
 	BPF_F_TEST_XDP_LIVE_FRAMES                  = 0x2
+	BPF_F_XDP_DEV_BOUND_ONLY                    = 0x40
 	BPF_F_XDP_HAS_FRAGS                         = 0x20
 	BPF_H                                       = 0x8
 	BPF_IMM                                     = 0x0
@@ -826,9 +827,9 @@ const (
 	DM_UUID_FLAG                                = 0x4000
 	DM_UUID_LEN                                 = 0x81
 	DM_VERSION                                  = 0xc138fd00
-	DM_VERSION_EXTRA                            = "-ioctl (2022-07-28)"
+	DM_VERSION_EXTRA                            = "-ioctl (2023-03-01)"
 	DM_VERSION_MAJOR                            = 0x4
-	DM_VERSION_MINOR                            = 0x2f
+	DM_VERSION_MINOR                            = 0x30
 	DM_VERSION_PATCHLEVEL                       = 0x0
 	DT_BLK                                      = 0x6
 	DT_CHR                                      = 0x2
@@ -1197,6 +1198,7 @@ const (
 	FAN_EVENT_METADATA_LEN                      = 0x18
 	FAN_EVENT_ON_CHILD                          = 0x8000000
 	FAN_FS_ERROR                                = 0x8000
+	FAN_INFO                                    = 0x20
 	FAN_MARK_ADD                                = 0x1
 	FAN_MARK_DONT_FOLLOW                        = 0x4
 	FAN_MARK_EVICTABLE                          = 0x200
@@ -1233,6 +1235,8 @@ const (
 	FAN_REPORT_PIDFD                            = 0x80
 	FAN_REPORT_TARGET_FID                       = 0x1000
 	FAN_REPORT_TID                              = 0x100
+	FAN_RESPONSE_INFO_AUDIT_RULE                = 0x1
+	FAN_RESPONSE_INFO_NONE                      = 0x0
 	FAN_UNLIMITED_MARKS                         = 0x20
 	FAN_UNLIMITED_QUEUE                         = 0x10
 	FD_CLOEXEC                                  = 0x1
@@ -1860,6 +1864,7 @@ const (
 	MEMWRITEOOB64                               = 0xc0184d15
 	MFD_ALLOW_SEALING                           = 0x2
 	MFD_CLOEXEC                                 = 0x1
+	MFD_EXEC                                    = 0x10
 	MFD_HUGETLB                                 = 0x4
 	MFD_HUGE_16GB                               = 0x88000000
 	MFD_HUGE_16MB                               = 0x60000000
@@ -1875,6 +1880,7 @@ const (
 	MFD_HUGE_8MB                                = 0x5c000000
 	MFD_HUGE_MASK                               = 0x3f
 	MFD_HUGE_SHIFT                              = 0x1a
+	MFD_NOEXEC_SEAL                             = 0x8
 	MINIX2_SUPER_MAGIC                          = 0x2468
 	MINIX2_SUPER_MAGIC2                         = 0x2478
 	MINIX3_SUPER_MAGIC                          = 0x4d5a
@@ -1898,6 +1904,9 @@ const (
 	MOUNT_ATTR_SIZE_VER0                        = 0x20
 	MOUNT_ATTR_STRICTATIME                      = 0x20
 	MOUNT_ATTR__ATIME                           = 0x70
+	MREMAP_DONTUNMAP                            = 0x4
+	MREMAP_FIXED                                = 0x2
+	MREMAP_MAYMOVE                              = 0x1
 	MSDOS_SUPER_MAGIC                           = 0x4d44
 	MSG_BATCH                                   = 0x40000
 	MSG_CMSG_CLOEXEC                            = 0x40000000
@@ -2204,6 +2213,7 @@ const (
 	PACKET_USER                                 = 0x6
 	PACKET_VERSION                              = 0xa
 	PACKET_VNET_HDR                             = 0xf
+	PACKET_VNET_HDR_SZ                          = 0x18
 	PARITY_CRC16_PR0                            = 0x2
 	PARITY_CRC16_PR0_CCITT                      = 0x4
 	PARITY_CRC16_PR1                            = 0x3
@@ -2221,6 +2231,7 @@ const (
 	PERF_ATTR_SIZE_VER5                         = 0x70
 	PERF_ATTR_SIZE_VER6                         = 0x78
 	PERF_ATTR_SIZE_VER7                         = 0x80
+	PERF_ATTR_SIZE_VER8                         = 0x88
 	PERF_AUX_FLAG_COLLISION                     = 0x8
 	PERF_AUX_FLAG_CORESIGHT_FORMAT_CORESIGHT    = 0x0
 	PERF_AUX_FLAG_CORESIGHT_FORMAT_RAW          = 0x100
@@ -2361,6 +2372,7 @@ const (
 	PR_FP_EXC_UND                               = 0x40000
 	PR_FP_MODE_FR                               = 0x1
 	PR_FP_MODE_FRE                              = 0x2
+	PR_GET_AUXV                                 = 0x41555856
 	PR_GET_CHILD_SUBREAPER                      = 0x25
 	PR_GET_DUMPABLE                             = 0x3
 	PR_GET_ENDIAN                               = 0x13
@@ -2369,6 +2381,8 @@ const (
 	PR_GET_FP_MODE                              = 0x2e
 	PR_GET_IO_FLUSHER                           = 0x3a
 	PR_GET_KEEPCAPS                             = 0x7
+	PR_GET_MDWE                                 = 0x42
+	PR_GET_MEMORY_MERGE                         = 0x44
 	PR_GET_NAME                                 = 0x10
 	PR_GET_NO_NEW_PRIVS                         = 0x27
 	PR_GET_PDEATHSIG                            = 0x2
@@ -2389,6 +2403,7 @@ const (
 	PR_MCE_KILL_GET                             = 0x22
 	PR_MCE_KILL_LATE                            = 0x0
 	PR_MCE_KILL_SET                             = 0x1
+	PR_MDWE_REFUSE_EXEC_GAIN                    = 0x1
 	PR_MPX_DISABLE_MANAGEMENT                   = 0x2c
 	PR_MPX_ENABLE_MANAGEMENT                    = 0x2b
 	PR_MTE_TAG_MASK                             = 0x7fff8
@@ -2406,6 +2421,15 @@ const (
 	PR_PAC_GET_ENABLED_KEYS                     = 0x3d
 	PR_PAC_RESET_KEYS                           = 0x36
 	PR_PAC_SET_ENABLED_KEYS                     = 0x3c
+	PR_RISCV_V_GET_CONTROL                      = 0x46
+	PR_RISCV_V_SET_CONTROL                      = 0x45
+	PR_RISCV_V_VSTATE_CTRL_CUR_MASK             = 0x3
+	PR_RISCV_V_VSTATE_CTRL_DEFAULT              = 0x0
+	PR_RISCV_V_VSTATE_CTRL_INHERIT              = 0x10
+	PR_RISCV_V_VSTATE_CTRL_MASK                 = 0x1f
+	PR_RISCV_V_VSTATE_CTRL_NEXT_MASK            = 0xc
+	PR_RISCV_V_VSTATE_CTRL_OFF                  = 0x1
+	PR_RISCV_V_VSTATE_CTRL_ON                   = 0x2
 	PR_SCHED_CORE                               = 0x3e
 	PR_SCHED_CORE_CREATE                        = 0x1
 	PR_SCHED_CORE_GET                           = 0x0
@@ -2423,6 +2447,8 @@ const (
 	PR_SET_FP_MODE                              = 0x2d
 	PR_SET_IO_FLUSHER                           = 0x39
 	PR_SET_KEEPCAPS                             = 0x8
+	PR_SET_MDWE                                 = 0x41
+	PR_SET_MEMORY_MERGE                         = 0x43
 	PR_SET_MM                                   = 0x23
 	PR_SET_MM_ARG_END                           = 0x9
 	PR_SET_MM_ARG_START                         = 0x8
@@ -2506,6 +2532,7 @@ const (
 	PTRACE_GETSIGMASK                           = 0x420a
 	PTRACE_GET_RSEQ_CONFIGURATION               = 0x420f
 	PTRACE_GET_SYSCALL_INFO                     = 0x420e
+	PTRACE_GET_SYSCALL_USER_DISPATCH_CONFIG     = 0x4211
 	PTRACE_INTERRUPT                            = 0x4207
 	PTRACE_KILL                                 = 0x8
 	PTRACE_LISTEN                               = 0x4208
@@ -2536,6 +2563,7 @@ const (
 	PTRACE_SETREGSET                            = 0x4205
 	PTRACE_SETSIGINFO                           = 0x4203
 	PTRACE_SETSIGMASK                           = 0x420b
+	PTRACE_SET_SYSCALL_USER_DISPATCH_CONFIG     = 0x4210
 	PTRACE_SINGLESTEP                           = 0x9
 	PTRACE_SYSCALL                              = 0x18
 	PTRACE_SYSCALL_INFO_ENTRY                   = 0x1
@@ -2802,6 +2830,23 @@ const (
 	RWF_SUPPORTED                               = 0x1f
 	RWF_SYNC                                    = 0x4
 	RWF_WRITE_LIFE_NOT_SET                      = 0x0
+	SCHED_BATCH                                 = 0x3
+	SCHED_DEADLINE                              = 0x6
+	SCHED_FIFO                                  = 0x1
+	SCHED_FLAG_ALL                              = 0x7f
+	SCHED_FLAG_DL_OVERRUN                       = 0x4
+	SCHED_FLAG_KEEP_ALL                         = 0x18
+	SCHED_FLAG_KEEP_PARAMS                      = 0x10
+	SCHED_FLAG_KEEP_POLICY                      = 0x8
+	SCHED_FLAG_RECLAIM                          = 0x2
+	SCHED_FLAG_RESET_ON_FORK                    = 0x1
+	SCHED_FLAG_UTIL_CLAMP                       = 0x60
+	SCHED_FLAG_UTIL_CLAMP_MAX                   = 0x40
+	SCHED_FLAG_UTIL_CLAMP_MIN                   = 0x20
+	SCHED_IDLE                                  = 0x5
+	SCHED_NORMAL                                = 0x0
+	SCHED_RESET_ON_FORK                         = 0x40000000
+	SCHED_RR                                    = 0x2
 	SCM_CREDENTIALS                             = 0x2
 	SCM_RIGHTS                                  = 0x1
 	SCM_TIMESTAMP                               = 0x1d
@@ -2967,6 +3012,7 @@ const (
 	SOL_TCP                                     = 0x6
 	SOL_TIPC                                    = 0x10f
 	SOL_TLS                                     = 0x11a
+	SOL_UDP                                     = 0x11
 	SOL_X25                                     = 0x106
 	SOL_XDP                                     = 0x11b
 	SOMAXCONN                                   = 0x1000
@@ -3071,7 +3117,7 @@ const (
 	TASKSTATS_GENL_NAME                         = "TASKSTATS"
 	TASKSTATS_GENL_VERSION                      = 0x1
 	TASKSTATS_TYPE_MAX                          = 0x6
-	TASKSTATS_VERSION                           = 0xd
+	TASKSTATS_VERSION                           = 0xe
 	TCIFLUSH                                    = 0x0
 	TCIOFF                                      = 0x2
 	TCIOFLUSH                                   = 0x2
@@ -3237,6 +3283,7 @@ const (
 	TP_STATUS_COPY                              = 0x2
 	TP_STATUS_CSUMNOTREADY                      = 0x8
 	TP_STATUS_CSUM_VALID                        = 0x80
+	TP_STATUS_GSO_TCP                           = 0x100
 	TP_STATUS_KERNEL                            = 0x0
 	TP_STATUS_LOSING                            = 0x4
 	TP_STATUS_SENDING                           = 0x2
@@ -3251,6 +3298,19 @@ const (
 	TRACEFS_MAGIC                               = 0x74726163
 	TS_COMM_LEN                                 = 0x20
 	UDF_SUPER_MAGIC                             = 0x15013346
+	UDP_CORK                                    = 0x1
+	UDP_ENCAP                                   = 0x64
+	UDP_ENCAP_ESPINUDP                          = 0x2
+	UDP_ENCAP_ESPINUDP_NON_IKE                  = 0x1
+	UDP_ENCAP_GTP0                              = 0x4
+	UDP_ENCAP_GTP1U                             = 0x5
+	UDP_ENCAP_L2TPINUDP                         = 0x3
+	UDP_GRO                                     = 0x68
+	UDP_NO_CHECK6_RX                            = 0x66
+	UDP_NO_CHECK6_TX                            = 0x65
+	UDP_SEGMENT                                 = 0x67
+	UDP_V4_FLOW                                 = 0x2
+	UDP_V6_FLOW                                 = 0x6
 	UMOUNT_NOFOLLOW                             = 0x8
 	USBDEVICE_SUPER_MAGIC                       = 0x9fa2
 	UTIME_NOW                                   = 0x3fffffff
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/zerrors_linux_386.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/zerrors_linux_386.go
index a46df0f1e57..30aee00a537 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/zerrors_linux_386.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/zerrors_linux_386.go
@@ -27,22 +27,31 @@ const (
 	B57600                           = 0x1001
 	B576000                          = 0x1006
 	B921600                          = 0x1007
+	BLKALIGNOFF                      = 0x127a
 	BLKBSZGET                        = 0x80041270
 	BLKBSZSET                        = 0x40041271
+	BLKDISCARD                       = 0x1277
+	BLKDISCARDZEROES                 = 0x127c
 	BLKFLSBUF                        = 0x1261
 	BLKFRAGET                        = 0x1265
 	BLKFRASET                        = 0x1264
+	BLKGETDISKSEQ                    = 0x80081280
 	BLKGETSIZE                       = 0x1260
 	BLKGETSIZE64                     = 0x80041272
+	BLKIOMIN                         = 0x1278
+	BLKIOOPT                         = 0x1279
 	BLKPBSZGET                       = 0x127b
 	BLKRAGET                         = 0x1263
 	BLKRASET                         = 0x1262
 	BLKROGET                         = 0x125e
 	BLKROSET                         = 0x125d
+	BLKROTATIONAL                    = 0x127e
 	BLKRRPART                        = 0x125f
+	BLKSECDISCARD                    = 0x127d
 	BLKSECTGET                       = 0x1267
 	BLKSECTSET                       = 0x1266
 	BLKSSZGET                        = 0x1268
+	BLKZEROOUT                       = 0x127f
 	BOTHER                           = 0x1000
 	BS1                              = 0x2000
 	BSDLY                            = 0x2000
@@ -317,10 +326,12 @@ const (
 	SO_NOFCS                         = 0x2b
 	SO_OOBINLINE                     = 0xa
 	SO_PASSCRED                      = 0x10
+	SO_PASSPIDFD                     = 0x4c
 	SO_PASSSEC                       = 0x22
 	SO_PEEK_OFF                      = 0x2a
 	SO_PEERCRED                      = 0x11
 	SO_PEERGROUPS                    = 0x3b
+	SO_PEERPIDFD                     = 0x4d
 	SO_PEERSEC                       = 0x1f
 	SO_PREFER_BUSY_POLL              = 0x45
 	SO_PROTOCOL                      = 0x26
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/zerrors_linux_amd64.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/zerrors_linux_amd64.go
index 6cd4a3ea9d3..8ebfa512785 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/zerrors_linux_amd64.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/zerrors_linux_amd64.go
@@ -27,22 +27,31 @@ const (
 	B57600                           = 0x1001
 	B576000                          = 0x1006
 	B921600                          = 0x1007
+	BLKALIGNOFF                      = 0x127a
 	BLKBSZGET                        = 0x80081270
 	BLKBSZSET                        = 0x40081271
+	BLKDISCARD                       = 0x1277
+	BLKDISCARDZEROES                 = 0x127c
 	BLKFLSBUF                        = 0x1261
 	BLKFRAGET                        = 0x1265
 	BLKFRASET                        = 0x1264
+	BLKGETDISKSEQ                    = 0x80081280
 	BLKGETSIZE                       = 0x1260
 	BLKGETSIZE64                     = 0x80081272
+	BLKIOMIN                         = 0x1278
+	BLKIOOPT                         = 0x1279
 	BLKPBSZGET                       = 0x127b
 	BLKRAGET                         = 0x1263
 	BLKRASET                         = 0x1262
 	BLKROGET                         = 0x125e
 	BLKROSET                         = 0x125d
+	BLKROTATIONAL                    = 0x127e
 	BLKRRPART                        = 0x125f
+	BLKSECDISCARD                    = 0x127d
 	BLKSECTGET                       = 0x1267
 	BLKSECTSET                       = 0x1266
 	BLKSSZGET                        = 0x1268
+	BLKZEROOUT                       = 0x127f
 	BOTHER                           = 0x1000
 	BS1                              = 0x2000
 	BSDLY                            = 0x2000
@@ -318,10 +327,12 @@ const (
 	SO_NOFCS                         = 0x2b
 	SO_OOBINLINE                     = 0xa
 	SO_PASSCRED                      = 0x10
+	SO_PASSPIDFD                     = 0x4c
 	SO_PASSSEC                       = 0x22
 	SO_PEEK_OFF                      = 0x2a
 	SO_PEERCRED                      = 0x11
 	SO_PEERGROUPS                    = 0x3b
+	SO_PEERPIDFD                     = 0x4d
 	SO_PEERSEC                       = 0x1f
 	SO_PREFER_BUSY_POLL              = 0x45
 	SO_PROTOCOL                      = 0x26
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/zerrors_linux_arm.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/zerrors_linux_arm.go
index c7ebee24df3..271a21cdc7e 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/zerrors_linux_arm.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/zerrors_linux_arm.go
@@ -27,22 +27,31 @@ const (
 	B57600                           = 0x1001
 	B576000                          = 0x1006
 	B921600                          = 0x1007
+	BLKALIGNOFF                      = 0x127a
 	BLKBSZGET                        = 0x80041270
 	BLKBSZSET                        = 0x40041271
+	BLKDISCARD                       = 0x1277
+	BLKDISCARDZEROES                 = 0x127c
 	BLKFLSBUF                        = 0x1261
 	BLKFRAGET                        = 0x1265
 	BLKFRASET                        = 0x1264
+	BLKGETDISKSEQ                    = 0x80081280
 	BLKGETSIZE                       = 0x1260
 	BLKGETSIZE64                     = 0x80041272
+	BLKIOMIN                         = 0x1278
+	BLKIOOPT                         = 0x1279
 	BLKPBSZGET                       = 0x127b
 	BLKRAGET                         = 0x1263
 	BLKRASET                         = 0x1262
 	BLKROGET                         = 0x125e
 	BLKROSET                         = 0x125d
+	BLKROTATIONAL                    = 0x127e
 	BLKRRPART                        = 0x125f
+	BLKSECDISCARD                    = 0x127d
 	BLKSECTGET                       = 0x1267
 	BLKSECTSET                       = 0x1266
 	BLKSSZGET                        = 0x1268
+	BLKZEROOUT                       = 0x127f
 	BOTHER                           = 0x1000
 	BS1                              = 0x2000
 	BSDLY                            = 0x2000
@@ -324,10 +333,12 @@ const (
 	SO_NOFCS                         = 0x2b
 	SO_OOBINLINE                     = 0xa
 	SO_PASSCRED                      = 0x10
+	SO_PASSPIDFD                     = 0x4c
 	SO_PASSSEC                       = 0x22
 	SO_PEEK_OFF                      = 0x2a
 	SO_PEERCRED                      = 0x11
 	SO_PEERGROUPS                    = 0x3b
+	SO_PEERPIDFD                     = 0x4d
 	SO_PEERSEC                       = 0x1f
 	SO_PREFER_BUSY_POLL              = 0x45
 	SO_PROTOCOL                      = 0x26
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/zerrors_linux_arm64.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/zerrors_linux_arm64.go
index 9d5352c3e45..910c330a39c 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/zerrors_linux_arm64.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/zerrors_linux_arm64.go
@@ -27,22 +27,31 @@ const (
 	B57600                           = 0x1001
 	B576000                          = 0x1006
 	B921600                          = 0x1007
+	BLKALIGNOFF                      = 0x127a
 	BLKBSZGET                        = 0x80081270
 	BLKBSZSET                        = 0x40081271
+	BLKDISCARD                       = 0x1277
+	BLKDISCARDZEROES                 = 0x127c
 	BLKFLSBUF                        = 0x1261
 	BLKFRAGET                        = 0x1265
 	BLKFRASET                        = 0x1264
+	BLKGETDISKSEQ                    = 0x80081280
 	BLKGETSIZE                       = 0x1260
 	BLKGETSIZE64                     = 0x80081272
+	BLKIOMIN                         = 0x1278
+	BLKIOOPT                         = 0x1279
 	BLKPBSZGET                       = 0x127b
 	BLKRAGET                         = 0x1263
 	BLKRASET                         = 0x1262
 	BLKROGET                         = 0x125e
 	BLKROSET                         = 0x125d
+	BLKROTATIONAL                    = 0x127e
 	BLKRRPART                        = 0x125f
+	BLKSECDISCARD                    = 0x127d
 	BLKSECTGET                       = 0x1267
 	BLKSECTSET                       = 0x1266
 	BLKSSZGET                        = 0x1268
+	BLKZEROOUT                       = 0x127f
 	BOTHER                           = 0x1000
 	BS1                              = 0x2000
 	BSDLY                            = 0x2000
@@ -314,10 +323,12 @@ const (
 	SO_NOFCS                         = 0x2b
 	SO_OOBINLINE                     = 0xa
 	SO_PASSCRED                      = 0x10
+	SO_PASSPIDFD                     = 0x4c
 	SO_PASSSEC                       = 0x22
 	SO_PEEK_OFF                      = 0x2a
 	SO_PEERCRED                      = 0x11
 	SO_PEERGROUPS                    = 0x3b
+	SO_PEERPIDFD                     = 0x4d
 	SO_PEERSEC                       = 0x1f
 	SO_PREFER_BUSY_POLL              = 0x45
 	SO_PROTOCOL                      = 0x26
@@ -443,6 +454,7 @@ const (
 	TIOCSWINSZ                       = 0x5414
 	TIOCVHANGUP                      = 0x5437
 	TOSTOP                           = 0x100
+	TPIDR2_MAGIC                     = 0x54504902
 	TUNATTACHFILTER                  = 0x401054d5
 	TUNDETACHFILTER                  = 0x401054d6
 	TUNGETDEVNETNS                   = 0x54e3
@@ -515,6 +527,7 @@ const (
 	XCASE                            = 0x4
 	XTABS                            = 0x1800
 	ZA_MAGIC                         = 0x54366345
+	ZT_MAGIC                         = 0x5a544e01
 	_HIDIOCGRAWNAME                  = 0x80804804
 	_HIDIOCGRAWPHYS                  = 0x80404805
 	_HIDIOCGRAWUNIQ                  = 0x80404808
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/zerrors_linux_loong64.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/zerrors_linux_loong64.go
index f26a164f4aa..a640798c933 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/zerrors_linux_loong64.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/zerrors_linux_loong64.go
@@ -27,22 +27,31 @@ const (
 	B57600                           = 0x1001
 	B576000                          = 0x1006
 	B921600                          = 0x1007
+	BLKALIGNOFF                      = 0x127a
 	BLKBSZGET                        = 0x80081270
 	BLKBSZSET                        = 0x40081271
+	BLKDISCARD                       = 0x1277
+	BLKDISCARDZEROES                 = 0x127c
 	BLKFLSBUF                        = 0x1261
 	BLKFRAGET                        = 0x1265
 	BLKFRASET                        = 0x1264
+	BLKGETDISKSEQ                    = 0x80081280
 	BLKGETSIZE                       = 0x1260
 	BLKGETSIZE64                     = 0x80081272
+	BLKIOMIN                         = 0x1278
+	BLKIOOPT                         = 0x1279
 	BLKPBSZGET                       = 0x127b
 	BLKRAGET                         = 0x1263
 	BLKRASET                         = 0x1262
 	BLKROGET                         = 0x125e
 	BLKROSET                         = 0x125d
+	BLKROTATIONAL                    = 0x127e
 	BLKRRPART                        = 0x125f
+	BLKSECDISCARD                    = 0x127d
 	BLKSECTGET                       = 0x1267
 	BLKSECTSET                       = 0x1266
 	BLKSSZGET                        = 0x1268
+	BLKZEROOUT                       = 0x127f
 	BOTHER                           = 0x1000
 	BS1                              = 0x2000
 	BSDLY                            = 0x2000
@@ -109,6 +118,8 @@ const (
 	IUCLC                            = 0x200
 	IXOFF                            = 0x1000
 	IXON                             = 0x400
+	LASX_CTX_MAGIC                   = 0x41535801
+	LSX_CTX_MAGIC                    = 0x53580001
 	MAP_ANON                         = 0x20
 	MAP_ANONYMOUS                    = 0x20
 	MAP_DENYWRITE                    = 0x800
@@ -308,10 +319,12 @@ const (
 	SO_NOFCS                         = 0x2b
 	SO_OOBINLINE                     = 0xa
 	SO_PASSCRED                      = 0x10
+	SO_PASSPIDFD                     = 0x4c
 	SO_PASSSEC                       = 0x22
 	SO_PEEK_OFF                      = 0x2a
 	SO_PEERCRED                      = 0x11
 	SO_PEERGROUPS                    = 0x3b
+	SO_PEERPIDFD                     = 0x4d
 	SO_PEERSEC                       = 0x1f
 	SO_PREFER_BUSY_POLL              = 0x45
 	SO_PROTOCOL                      = 0x26
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/zerrors_linux_mips.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/zerrors_linux_mips.go
index 890bc3c9b70..0d5925d3407 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/zerrors_linux_mips.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/zerrors_linux_mips.go
@@ -27,22 +27,31 @@ const (
 	B57600                           = 0x1001
 	B576000                          = 0x1006
 	B921600                          = 0x1007
+	BLKALIGNOFF                      = 0x2000127a
 	BLKBSZGET                        = 0x40041270
 	BLKBSZSET                        = 0x80041271
+	BLKDISCARD                       = 0x20001277
+	BLKDISCARDZEROES                 = 0x2000127c
 	BLKFLSBUF                        = 0x20001261
 	BLKFRAGET                        = 0x20001265
 	BLKFRASET                        = 0x20001264
+	BLKGETDISKSEQ                    = 0x40081280
 	BLKGETSIZE                       = 0x20001260
 	BLKGETSIZE64                     = 0x40041272
+	BLKIOMIN                         = 0x20001278
+	BLKIOOPT                         = 0x20001279
 	BLKPBSZGET                       = 0x2000127b
 	BLKRAGET                         = 0x20001263
 	BLKRASET                         = 0x20001262
 	BLKROGET                         = 0x2000125e
 	BLKROSET                         = 0x2000125d
+	BLKROTATIONAL                    = 0x2000127e
 	BLKRRPART                        = 0x2000125f
+	BLKSECDISCARD                    = 0x2000127d
 	BLKSECTGET                       = 0x20001267
 	BLKSECTSET                       = 0x20001266
 	BLKSSZGET                        = 0x20001268
+	BLKZEROOUT                       = 0x2000127f
 	BOTHER                           = 0x1000
 	BS1                              = 0x2000
 	BSDLY                            = 0x2000
@@ -317,10 +326,12 @@ const (
 	SO_NOFCS                         = 0x2b
 	SO_OOBINLINE                     = 0x100
 	SO_PASSCRED                      = 0x11
+	SO_PASSPIDFD                     = 0x4c
 	SO_PASSSEC                       = 0x22
 	SO_PEEK_OFF                      = 0x2a
 	SO_PEERCRED                      = 0x12
 	SO_PEERGROUPS                    = 0x3b
+	SO_PEERPIDFD                     = 0x4d
 	SO_PEERSEC                       = 0x1e
 	SO_PREFER_BUSY_POLL              = 0x45
 	SO_PROTOCOL                      = 0x1028
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/zerrors_linux_mips64.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/zerrors_linux_mips64.go
index 549f26ac646..d72a00e0b63 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/zerrors_linux_mips64.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/zerrors_linux_mips64.go
@@ -27,22 +27,31 @@ const (
 	B57600                           = 0x1001
 	B576000                          = 0x1006
 	B921600                          = 0x1007
+	BLKALIGNOFF                      = 0x2000127a
 	BLKBSZGET                        = 0x40081270
 	BLKBSZSET                        = 0x80081271
+	BLKDISCARD                       = 0x20001277
+	BLKDISCARDZEROES                 = 0x2000127c
 	BLKFLSBUF                        = 0x20001261
 	BLKFRAGET                        = 0x20001265
 	BLKFRASET                        = 0x20001264
+	BLKGETDISKSEQ                    = 0x40081280
 	BLKGETSIZE                       = 0x20001260
 	BLKGETSIZE64                     = 0x40081272
+	BLKIOMIN                         = 0x20001278
+	BLKIOOPT                         = 0x20001279
 	BLKPBSZGET                       = 0x2000127b
 	BLKRAGET                         = 0x20001263
 	BLKRASET                         = 0x20001262
 	BLKROGET                         = 0x2000125e
 	BLKROSET                         = 0x2000125d
+	BLKROTATIONAL                    = 0x2000127e
 	BLKRRPART                        = 0x2000125f
+	BLKSECDISCARD                    = 0x2000127d
 	BLKSECTGET                       = 0x20001267
 	BLKSECTSET                       = 0x20001266
 	BLKSSZGET                        = 0x20001268
+	BLKZEROOUT                       = 0x2000127f
 	BOTHER                           = 0x1000
 	BS1                              = 0x2000
 	BSDLY                            = 0x2000
@@ -317,10 +326,12 @@ const (
 	SO_NOFCS                         = 0x2b
 	SO_OOBINLINE                     = 0x100
 	SO_PASSCRED                      = 0x11
+	SO_PASSPIDFD                     = 0x4c
 	SO_PASSSEC                       = 0x22
 	SO_PEEK_OFF                      = 0x2a
 	SO_PEERCRED                      = 0x12
 	SO_PEERGROUPS                    = 0x3b
+	SO_PEERPIDFD                     = 0x4d
 	SO_PEERSEC                       = 0x1e
 	SO_PREFER_BUSY_POLL              = 0x45
 	SO_PROTOCOL                      = 0x1028
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/zerrors_linux_mips64le.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/zerrors_linux_mips64le.go
index e0365e32c17..02ba129f857 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/zerrors_linux_mips64le.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/zerrors_linux_mips64le.go
@@ -27,22 +27,31 @@ const (
 	B57600                           = 0x1001
 	B576000                          = 0x1006
 	B921600                          = 0x1007
+	BLKALIGNOFF                      = 0x2000127a
 	BLKBSZGET                        = 0x40081270
 	BLKBSZSET                        = 0x80081271
+	BLKDISCARD                       = 0x20001277
+	BLKDISCARDZEROES                 = 0x2000127c
 	BLKFLSBUF                        = 0x20001261
 	BLKFRAGET                        = 0x20001265
 	BLKFRASET                        = 0x20001264
+	BLKGETDISKSEQ                    = 0x40081280
 	BLKGETSIZE                       = 0x20001260
 	BLKGETSIZE64                     = 0x40081272
+	BLKIOMIN                         = 0x20001278
+	BLKIOOPT                         = 0x20001279
 	BLKPBSZGET                       = 0x2000127b
 	BLKRAGET                         = 0x20001263
 	BLKRASET                         = 0x20001262
 	BLKROGET                         = 0x2000125e
 	BLKROSET                         = 0x2000125d
+	BLKROTATIONAL                    = 0x2000127e
 	BLKRRPART                        = 0x2000125f
+	BLKSECDISCARD                    = 0x2000127d
 	BLKSECTGET                       = 0x20001267
 	BLKSECTSET                       = 0x20001266
 	BLKSSZGET                        = 0x20001268
+	BLKZEROOUT                       = 0x2000127f
 	BOTHER                           = 0x1000
 	BS1                              = 0x2000
 	BSDLY                            = 0x2000
@@ -317,10 +326,12 @@ const (
 	SO_NOFCS                         = 0x2b
 	SO_OOBINLINE                     = 0x100
 	SO_PASSCRED                      = 0x11
+	SO_PASSPIDFD                     = 0x4c
 	SO_PASSSEC                       = 0x22
 	SO_PEEK_OFF                      = 0x2a
 	SO_PEERCRED                      = 0x12
 	SO_PEERGROUPS                    = 0x3b
+	SO_PEERPIDFD                     = 0x4d
 	SO_PEERSEC                       = 0x1e
 	SO_PREFER_BUSY_POLL              = 0x45
 	SO_PROTOCOL                      = 0x1028
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/zerrors_linux_mipsle.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/zerrors_linux_mipsle.go
index fdccce15ca2..8daa6dd9688 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/zerrors_linux_mipsle.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/zerrors_linux_mipsle.go
@@ -27,22 +27,31 @@ const (
 	B57600                           = 0x1001
 	B576000                          = 0x1006
 	B921600                          = 0x1007
+	BLKALIGNOFF                      = 0x2000127a
 	BLKBSZGET                        = 0x40041270
 	BLKBSZSET                        = 0x80041271
+	BLKDISCARD                       = 0x20001277
+	BLKDISCARDZEROES                 = 0x2000127c
 	BLKFLSBUF                        = 0x20001261
 	BLKFRAGET                        = 0x20001265
 	BLKFRASET                        = 0x20001264
+	BLKGETDISKSEQ                    = 0x40081280
 	BLKGETSIZE                       = 0x20001260
 	BLKGETSIZE64                     = 0x40041272
+	BLKIOMIN                         = 0x20001278
+	BLKIOOPT                         = 0x20001279
 	BLKPBSZGET                       = 0x2000127b
 	BLKRAGET                         = 0x20001263
 	BLKRASET                         = 0x20001262
 	BLKROGET                         = 0x2000125e
 	BLKROSET                         = 0x2000125d
+	BLKROTATIONAL                    = 0x2000127e
 	BLKRRPART                        = 0x2000125f
+	BLKSECDISCARD                    = 0x2000127d
 	BLKSECTGET                       = 0x20001267
 	BLKSECTSET                       = 0x20001266
 	BLKSSZGET                        = 0x20001268
+	BLKZEROOUT                       = 0x2000127f
 	BOTHER                           = 0x1000
 	BS1                              = 0x2000
 	BSDLY                            = 0x2000
@@ -317,10 +326,12 @@ const (
 	SO_NOFCS                         = 0x2b
 	SO_OOBINLINE                     = 0x100
 	SO_PASSCRED                      = 0x11
+	SO_PASSPIDFD                     = 0x4c
 	SO_PASSSEC                       = 0x22
 	SO_PEEK_OFF                      = 0x2a
 	SO_PEERCRED                      = 0x12
 	SO_PEERGROUPS                    = 0x3b
+	SO_PEERPIDFD                     = 0x4d
 	SO_PEERSEC                       = 0x1e
 	SO_PREFER_BUSY_POLL              = 0x45
 	SO_PROTOCOL                      = 0x1028
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/zerrors_linux_ppc.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/zerrors_linux_ppc.go
index b2205c83faa..63c8fa2f7f0 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/zerrors_linux_ppc.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/zerrors_linux_ppc.go
@@ -27,22 +27,31 @@ const (
 	B57600                           = 0x10
 	B576000                          = 0x15
 	B921600                          = 0x16
+	BLKALIGNOFF                      = 0x2000127a
 	BLKBSZGET                        = 0x40041270
 	BLKBSZSET                        = 0x80041271
+	BLKDISCARD                       = 0x20001277
+	BLKDISCARDZEROES                 = 0x2000127c
 	BLKFLSBUF                        = 0x20001261
 	BLKFRAGET                        = 0x20001265
 	BLKFRASET                        = 0x20001264
+	BLKGETDISKSEQ                    = 0x40081280
 	BLKGETSIZE                       = 0x20001260
 	BLKGETSIZE64                     = 0x40041272
+	BLKIOMIN                         = 0x20001278
+	BLKIOOPT                         = 0x20001279
 	BLKPBSZGET                       = 0x2000127b
 	BLKRAGET                         = 0x20001263
 	BLKRASET                         = 0x20001262
 	BLKROGET                         = 0x2000125e
 	BLKROSET                         = 0x2000125d
+	BLKROTATIONAL                    = 0x2000127e
 	BLKRRPART                        = 0x2000125f
+	BLKSECDISCARD                    = 0x2000127d
 	BLKSECTGET                       = 0x20001267
 	BLKSECTSET                       = 0x20001266
 	BLKSSZGET                        = 0x20001268
+	BLKZEROOUT                       = 0x2000127f
 	BOTHER                           = 0x1f
 	BS1                              = 0x8000
 	BSDLY                            = 0x8000
@@ -372,10 +381,12 @@ const (
 	SO_NOFCS                         = 0x2b
 	SO_OOBINLINE                     = 0xa
 	SO_PASSCRED                      = 0x14
+	SO_PASSPIDFD                     = 0x4c
 	SO_PASSSEC                       = 0x22
 	SO_PEEK_OFF                      = 0x2a
 	SO_PEERCRED                      = 0x15
 	SO_PEERGROUPS                    = 0x3b
+	SO_PEERPIDFD                     = 0x4d
 	SO_PEERSEC                       = 0x1f
 	SO_PREFER_BUSY_POLL              = 0x45
 	SO_PROTOCOL                      = 0x26
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/zerrors_linux_ppc64.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/zerrors_linux_ppc64.go
index 81aa5ad0f69..930799ec1b3 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/zerrors_linux_ppc64.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/zerrors_linux_ppc64.go
@@ -27,22 +27,31 @@ const (
 	B57600                           = 0x10
 	B576000                          = 0x15
 	B921600                          = 0x16
+	BLKALIGNOFF                      = 0x2000127a
 	BLKBSZGET                        = 0x40081270
 	BLKBSZSET                        = 0x80081271
+	BLKDISCARD                       = 0x20001277
+	BLKDISCARDZEROES                 = 0x2000127c
 	BLKFLSBUF                        = 0x20001261
 	BLKFRAGET                        = 0x20001265
 	BLKFRASET                        = 0x20001264
+	BLKGETDISKSEQ                    = 0x40081280
 	BLKGETSIZE                       = 0x20001260
 	BLKGETSIZE64                     = 0x40081272
+	BLKIOMIN                         = 0x20001278
+	BLKIOOPT                         = 0x20001279
 	BLKPBSZGET                       = 0x2000127b
 	BLKRAGET                         = 0x20001263
 	BLKRASET                         = 0x20001262
 	BLKROGET                         = 0x2000125e
 	BLKROSET                         = 0x2000125d
+	BLKROTATIONAL                    = 0x2000127e
 	BLKRRPART                        = 0x2000125f
+	BLKSECDISCARD                    = 0x2000127d
 	BLKSECTGET                       = 0x20001267
 	BLKSECTSET                       = 0x20001266
 	BLKSSZGET                        = 0x20001268
+	BLKZEROOUT                       = 0x2000127f
 	BOTHER                           = 0x1f
 	BS1                              = 0x8000
 	BSDLY                            = 0x8000
@@ -376,10 +385,12 @@ const (
 	SO_NOFCS                         = 0x2b
 	SO_OOBINLINE                     = 0xa
 	SO_PASSCRED                      = 0x14
+	SO_PASSPIDFD                     = 0x4c
 	SO_PASSSEC                       = 0x22
 	SO_PEEK_OFF                      = 0x2a
 	SO_PEERCRED                      = 0x15
 	SO_PEERGROUPS                    = 0x3b
+	SO_PEERPIDFD                     = 0x4d
 	SO_PEERSEC                       = 0x1f
 	SO_PREFER_BUSY_POLL              = 0x45
 	SO_PROTOCOL                      = 0x26
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/zerrors_linux_ppc64le.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/zerrors_linux_ppc64le.go
index 76807a1fd4f..8605a7dd7ef 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/zerrors_linux_ppc64le.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/zerrors_linux_ppc64le.go
@@ -27,22 +27,31 @@ const (
 	B57600                           = 0x10
 	B576000                          = 0x15
 	B921600                          = 0x16
+	BLKALIGNOFF                      = 0x2000127a
 	BLKBSZGET                        = 0x40081270
 	BLKBSZSET                        = 0x80081271
+	BLKDISCARD                       = 0x20001277
+	BLKDISCARDZEROES                 = 0x2000127c
 	BLKFLSBUF                        = 0x20001261
 	BLKFRAGET                        = 0x20001265
 	BLKFRASET                        = 0x20001264
+	BLKGETDISKSEQ                    = 0x40081280
 	BLKGETSIZE                       = 0x20001260
 	BLKGETSIZE64                     = 0x40081272
+	BLKIOMIN                         = 0x20001278
+	BLKIOOPT                         = 0x20001279
 	BLKPBSZGET                       = 0x2000127b
 	BLKRAGET                         = 0x20001263
 	BLKRASET                         = 0x20001262
 	BLKROGET                         = 0x2000125e
 	BLKROSET                         = 0x2000125d
+	BLKROTATIONAL                    = 0x2000127e
 	BLKRRPART                        = 0x2000125f
+	BLKSECDISCARD                    = 0x2000127d
 	BLKSECTGET                       = 0x20001267
 	BLKSECTSET                       = 0x20001266
 	BLKSSZGET                        = 0x20001268
+	BLKZEROOUT                       = 0x2000127f
 	BOTHER                           = 0x1f
 	BS1                              = 0x8000
 	BSDLY                            = 0x8000
@@ -376,10 +385,12 @@ const (
 	SO_NOFCS                         = 0x2b
 	SO_OOBINLINE                     = 0xa
 	SO_PASSCRED                      = 0x14
+	SO_PASSPIDFD                     = 0x4c
 	SO_PASSSEC                       = 0x22
 	SO_PEEK_OFF                      = 0x2a
 	SO_PEERCRED                      = 0x15
 	SO_PEERGROUPS                    = 0x3b
+	SO_PEERPIDFD                     = 0x4d
 	SO_PEERSEC                       = 0x1f
 	SO_PREFER_BUSY_POLL              = 0x45
 	SO_PROTOCOL                      = 0x26
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/zerrors_linux_riscv64.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/zerrors_linux_riscv64.go
index d4a5ab9e4e0..95a016f1c01 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/zerrors_linux_riscv64.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/zerrors_linux_riscv64.go
@@ -27,22 +27,31 @@ const (
 	B57600                           = 0x1001
 	B576000                          = 0x1006
 	B921600                          = 0x1007
+	BLKALIGNOFF                      = 0x127a
 	BLKBSZGET                        = 0x80081270
 	BLKBSZSET                        = 0x40081271
+	BLKDISCARD                       = 0x1277
+	BLKDISCARDZEROES                 = 0x127c
 	BLKFLSBUF                        = 0x1261
 	BLKFRAGET                        = 0x1265
 	BLKFRASET                        = 0x1264
+	BLKGETDISKSEQ                    = 0x80081280
 	BLKGETSIZE                       = 0x1260
 	BLKGETSIZE64                     = 0x80081272
+	BLKIOMIN                         = 0x1278
+	BLKIOOPT                         = 0x1279
 	BLKPBSZGET                       = 0x127b
 	BLKRAGET                         = 0x1263
 	BLKRASET                         = 0x1262
 	BLKROGET                         = 0x125e
 	BLKROSET                         = 0x125d
+	BLKROTATIONAL                    = 0x127e
 	BLKRRPART                        = 0x125f
+	BLKSECDISCARD                    = 0x127d
 	BLKSECTGET                       = 0x1267
 	BLKSECTSET                       = 0x1266
 	BLKSSZGET                        = 0x1268
+	BLKZEROOUT                       = 0x127f
 	BOTHER                           = 0x1000
 	BS1                              = 0x2000
 	BSDLY                            = 0x2000
@@ -305,10 +314,12 @@ const (
 	SO_NOFCS                         = 0x2b
 	SO_OOBINLINE                     = 0xa
 	SO_PASSCRED                      = 0x10
+	SO_PASSPIDFD                     = 0x4c
 	SO_PASSSEC                       = 0x22
 	SO_PEEK_OFF                      = 0x2a
 	SO_PEERCRED                      = 0x11
 	SO_PEERGROUPS                    = 0x3b
+	SO_PEERPIDFD                     = 0x4d
 	SO_PEERSEC                       = 0x1f
 	SO_PREFER_BUSY_POLL              = 0x45
 	SO_PROTOCOL                      = 0x26
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/zerrors_linux_s390x.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/zerrors_linux_s390x.go
index 66e65db9519..1ae0108f576 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/zerrors_linux_s390x.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/zerrors_linux_s390x.go
@@ -27,22 +27,31 @@ const (
 	B57600                           = 0x1001
 	B576000                          = 0x1006
 	B921600                          = 0x1007
+	BLKALIGNOFF                      = 0x127a
 	BLKBSZGET                        = 0x80081270
 	BLKBSZSET                        = 0x40081271
+	BLKDISCARD                       = 0x1277
+	BLKDISCARDZEROES                 = 0x127c
 	BLKFLSBUF                        = 0x1261
 	BLKFRAGET                        = 0x1265
 	BLKFRASET                        = 0x1264
+	BLKGETDISKSEQ                    = 0x80081280
 	BLKGETSIZE                       = 0x1260
 	BLKGETSIZE64                     = 0x80081272
+	BLKIOMIN                         = 0x1278
+	BLKIOOPT                         = 0x1279
 	BLKPBSZGET                       = 0x127b
 	BLKRAGET                         = 0x1263
 	BLKRASET                         = 0x1262
 	BLKROGET                         = 0x125e
 	BLKROSET                         = 0x125d
+	BLKROTATIONAL                    = 0x127e
 	BLKRRPART                        = 0x125f
+	BLKSECDISCARD                    = 0x127d
 	BLKSECTGET                       = 0x1267
 	BLKSECTSET                       = 0x1266
 	BLKSSZGET                        = 0x1268
+	BLKZEROOUT                       = 0x127f
 	BOTHER                           = 0x1000
 	BS1                              = 0x2000
 	BSDLY                            = 0x2000
@@ -380,10 +389,12 @@ const (
 	SO_NOFCS                         = 0x2b
 	SO_OOBINLINE                     = 0xa
 	SO_PASSCRED                      = 0x10
+	SO_PASSPIDFD                     = 0x4c
 	SO_PASSSEC                       = 0x22
 	SO_PEEK_OFF                      = 0x2a
 	SO_PEERCRED                      = 0x11
 	SO_PEERGROUPS                    = 0x3b
+	SO_PEERPIDFD                     = 0x4d
 	SO_PEERSEC                       = 0x1f
 	SO_PREFER_BUSY_POLL              = 0x45
 	SO_PROTOCOL                      = 0x26
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/zerrors_linux_sparc64.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/zerrors_linux_sparc64.go
index f619252691e..1bb7c6333b4 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/zerrors_linux_sparc64.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/zerrors_linux_sparc64.go
@@ -30,22 +30,31 @@ const (
 	B57600                           = 0x1001
 	B576000                          = 0x1006
 	B921600                          = 0x1007
+	BLKALIGNOFF                      = 0x2000127a
 	BLKBSZGET                        = 0x40081270
 	BLKBSZSET                        = 0x80081271
+	BLKDISCARD                       = 0x20001277
+	BLKDISCARDZEROES                 = 0x2000127c
 	BLKFLSBUF                        = 0x20001261
 	BLKFRAGET                        = 0x20001265
 	BLKFRASET                        = 0x20001264
+	BLKGETDISKSEQ                    = 0x40081280
 	BLKGETSIZE                       = 0x20001260
 	BLKGETSIZE64                     = 0x40081272
+	BLKIOMIN                         = 0x20001278
+	BLKIOOPT                         = 0x20001279
 	BLKPBSZGET                       = 0x2000127b
 	BLKRAGET                         = 0x20001263
 	BLKRASET                         = 0x20001262
 	BLKROGET                         = 0x2000125e
 	BLKROSET                         = 0x2000125d
+	BLKROTATIONAL                    = 0x2000127e
 	BLKRRPART                        = 0x2000125f
+	BLKSECDISCARD                    = 0x2000127d
 	BLKSECTGET                       = 0x20001267
 	BLKSECTSET                       = 0x20001266
 	BLKSSZGET                        = 0x20001268
+	BLKZEROOUT                       = 0x2000127f
 	BOTHER                           = 0x1000
 	BS1                              = 0x2000
 	BSDLY                            = 0x2000
@@ -329,6 +338,54 @@ const (
 	SCM_WIFI_STATUS                  = 0x25
 	SFD_CLOEXEC                      = 0x400000
 	SFD_NONBLOCK                     = 0x4000
+	SF_FP                            = 0x38
+	SF_I0                            = 0x20
+	SF_I1                            = 0x24
+	SF_I2                            = 0x28
+	SF_I3                            = 0x2c
+	SF_I4                            = 0x30
+	SF_I5                            = 0x34
+	SF_L0                            = 0x0
+	SF_L1                            = 0x4
+	SF_L2                            = 0x8
+	SF_L3                            = 0xc
+	SF_L4                            = 0x10
+	SF_L5                            = 0x14
+	SF_L6                            = 0x18
+	SF_L7                            = 0x1c
+	SF_PC                            = 0x3c
+	SF_RETP                          = 0x40
+	SF_V9_FP                         = 0x70
+	SF_V9_I0                         = 0x40
+	SF_V9_I1                         = 0x48
+	SF_V9_I2                         = 0x50
+	SF_V9_I3                         = 0x58
+	SF_V9_I4                         = 0x60
+	SF_V9_I5                         = 0x68
+	SF_V9_L0                         = 0x0
+	SF_V9_L1                         = 0x8
+	SF_V9_L2                         = 0x10
+	SF_V9_L3                         = 0x18
+	SF_V9_L4                         = 0x20
+	SF_V9_L5                         = 0x28
+	SF_V9_L6                         = 0x30
+	SF_V9_L7                         = 0x38
+	SF_V9_PC                         = 0x78
+	SF_V9_RETP                       = 0x80
+	SF_V9_XARG0                      = 0x88
+	SF_V9_XARG1                      = 0x90
+	SF_V9_XARG2                      = 0x98
+	SF_V9_XARG3                      = 0xa0
+	SF_V9_XARG4                      = 0xa8
+	SF_V9_XARG5                      = 0xb0
+	SF_V9_XXARG                      = 0xb8
+	SF_XARG0                         = 0x44
+	SF_XARG1                         = 0x48
+	SF_XARG2                         = 0x4c
+	SF_XARG3                         = 0x50
+	SF_XARG4                         = 0x54
+	SF_XARG5                         = 0x58
+	SF_XXARG                         = 0x5c
 	SIOCATMARK                       = 0x8905
 	SIOCGPGRP                        = 0x8904
 	SIOCGSTAMPNS_NEW                 = 0x40108907
@@ -371,10 +428,12 @@ const (
 	SO_NOFCS                         = 0x27
 	SO_OOBINLINE                     = 0x100
 	SO_PASSCRED                      = 0x2
+	SO_PASSPIDFD                     = 0x55
 	SO_PASSSEC                       = 0x1f
 	SO_PEEK_OFF                      = 0x26
 	SO_PEERCRED                      = 0x40
 	SO_PEERGROUPS                    = 0x3d
+	SO_PEERPIDFD                     = 0x56
 	SO_PEERSEC                       = 0x1e
 	SO_PREFER_BUSY_POLL              = 0x48
 	SO_PROTOCOL                      = 0x1028
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_aix_ppc.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_aix_ppc.go
index 9a257219d70..d1d1d23311d 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_aix_ppc.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_aix_ppc.go
@@ -817,28 +817,6 @@ func write(fd int, p []byte) (n int, err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func readlen(fd int, p *byte, np int) (n int, err error) {
-	r0, er := C.read(C.int(fd), C.uintptr_t(uintptr(unsafe.Pointer(p))), C.size_t(np))
-	n = int(r0)
-	if r0 == -1 && er != nil {
-		err = er
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func writelen(fd int, p *byte, np int) (n int, err error) {
-	r0, er := C.write(C.int(fd), C.uintptr_t(uintptr(unsafe.Pointer(p))), C.size_t(np))
-	n = int(r0)
-	if r0 == -1 && er != nil {
-		err = er
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func Dup2(oldfd int, newfd int) (err error) {
 	r0, er := C.dup2(C.int(oldfd), C.int(newfd))
 	if r0 == -1 && er != nil {
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_aix_ppc64.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_aix_ppc64.go
index 6de80c20cf2..f99a18adc33 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_aix_ppc64.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_aix_ppc64.go
@@ -762,28 +762,6 @@ func write(fd int, p []byte) (n int, err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func readlen(fd int, p *byte, np int) (n int, err error) {
-	r0, e1 := callread(fd, uintptr(unsafe.Pointer(p)), np)
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func writelen(fd int, p *byte, np int) (n int, err error) {
-	r0, e1 := callwrite(fd, uintptr(unsafe.Pointer(p)), np)
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func Dup2(oldfd int, newfd int) (err error) {
 	_, e1 := calldup2(oldfd, newfd)
 	if e1 != 0 {
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_darwin_amd64.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_darwin_amd64.go
index 4037ccf7a94..1cad561e983 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_darwin_amd64.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_darwin_amd64.go
@@ -725,6 +725,12 @@ func ioctl(fd int, req uint, arg uintptr) (err error) {
 	return
 }
 
+var libc_ioctl_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_ioctl ioctl "/usr/lib/libSystem.B.dylib"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func ioctlPtr(fd int, req uint, arg unsafe.Pointer) (err error) {
 	_, _, e1 := syscall_syscall(libc_ioctl_trampoline_addr, uintptr(fd), uintptr(req), uintptr(arg))
 	if e1 != 0 {
@@ -733,10 +739,6 @@ func ioctlPtr(fd int, req uint, arg unsafe.Pointer) (err error) {
 	return
 }
 
-var libc_ioctl_trampoline_addr uintptr
-
-//go:cgo_import_dynamic libc_ioctl ioctl "/usr/lib/libSystem.B.dylib"
-
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func sysctl(mib []_C_int, old *byte, oldlen *uintptr, new *byte, newlen uintptr) (err error) {
@@ -2410,28 +2412,6 @@ var libc_munmap_trampoline_addr uintptr
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func readlen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := syscall_syscall(libc_read_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func writelen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := syscall_syscall(libc_write_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func Fstat(fd int, stat *Stat_t) (err error) {
 	_, _, e1 := syscall_syscall(libc_fstat64_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(stat)), 0)
 	if e1 != 0 {
@@ -2521,14 +2501,6 @@ func ptrace1(request int, pid int, addr uintptr, data uintptr) (err error) {
 	return
 }
 
-func ptrace1Ptr(request int, pid int, addr uintptr, data unsafe.Pointer) (err error) {
-	_, _, e1 := syscall_syscall6(libc_ptrace_trampoline_addr, uintptr(request), uintptr(pid), addr, uintptr(data), 0, 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
 var libc_ptrace_trampoline_addr uintptr
 
 //go:cgo_import_dynamic libc_ptrace ptrace "/usr/lib/libSystem.B.dylib"
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_darwin_amd64.s b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_darwin_amd64.s
index 4baaed0bc12..8b8bb284028 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_darwin_amd64.s
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_darwin_amd64.s
@@ -5,703 +5,586 @@
 
 TEXT libc_fdopendir_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fdopendir(SB)
-
 GLOBL	·libc_fdopendir_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fdopendir_trampoline_addr(SB)/8, $libc_fdopendir_trampoline<>(SB)
 
 TEXT libc_getgroups_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getgroups(SB)
-
 GLOBL	·libc_getgroups_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getgroups_trampoline_addr(SB)/8, $libc_getgroups_trampoline<>(SB)
 
 TEXT libc_setgroups_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setgroups(SB)
-
 GLOBL	·libc_setgroups_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setgroups_trampoline_addr(SB)/8, $libc_setgroups_trampoline<>(SB)
 
 TEXT libc_wait4_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_wait4(SB)
-
 GLOBL	·libc_wait4_trampoline_addr(SB), RODATA, $8
 DATA	·libc_wait4_trampoline_addr(SB)/8, $libc_wait4_trampoline<>(SB)
 
 TEXT libc_accept_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_accept(SB)
-
 GLOBL	·libc_accept_trampoline_addr(SB), RODATA, $8
 DATA	·libc_accept_trampoline_addr(SB)/8, $libc_accept_trampoline<>(SB)
 
 TEXT libc_bind_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_bind(SB)
-
 GLOBL	·libc_bind_trampoline_addr(SB), RODATA, $8
 DATA	·libc_bind_trampoline_addr(SB)/8, $libc_bind_trampoline<>(SB)
 
 TEXT libc_connect_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_connect(SB)
-
 GLOBL	·libc_connect_trampoline_addr(SB), RODATA, $8
 DATA	·libc_connect_trampoline_addr(SB)/8, $libc_connect_trampoline<>(SB)
 
 TEXT libc_socket_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_socket(SB)
-
 GLOBL	·libc_socket_trampoline_addr(SB), RODATA, $8
 DATA	·libc_socket_trampoline_addr(SB)/8, $libc_socket_trampoline<>(SB)
 
 TEXT libc_getsockopt_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getsockopt(SB)
-
 GLOBL	·libc_getsockopt_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getsockopt_trampoline_addr(SB)/8, $libc_getsockopt_trampoline<>(SB)
 
 TEXT libc_setsockopt_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setsockopt(SB)
-
 GLOBL	·libc_setsockopt_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setsockopt_trampoline_addr(SB)/8, $libc_setsockopt_trampoline<>(SB)
 
 TEXT libc_getpeername_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getpeername(SB)
-
 GLOBL	·libc_getpeername_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getpeername_trampoline_addr(SB)/8, $libc_getpeername_trampoline<>(SB)
 
 TEXT libc_getsockname_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getsockname(SB)
-
 GLOBL	·libc_getsockname_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getsockname_trampoline_addr(SB)/8, $libc_getsockname_trampoline<>(SB)
 
 TEXT libc_shutdown_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_shutdown(SB)
-
 GLOBL	·libc_shutdown_trampoline_addr(SB), RODATA, $8
 DATA	·libc_shutdown_trampoline_addr(SB)/8, $libc_shutdown_trampoline<>(SB)
 
 TEXT libc_socketpair_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_socketpair(SB)
-
 GLOBL	·libc_socketpair_trampoline_addr(SB), RODATA, $8
 DATA	·libc_socketpair_trampoline_addr(SB)/8, $libc_socketpair_trampoline<>(SB)
 
 TEXT libc_recvfrom_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_recvfrom(SB)
-
 GLOBL	·libc_recvfrom_trampoline_addr(SB), RODATA, $8
 DATA	·libc_recvfrom_trampoline_addr(SB)/8, $libc_recvfrom_trampoline<>(SB)
 
 TEXT libc_sendto_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_sendto(SB)
-
 GLOBL	·libc_sendto_trampoline_addr(SB), RODATA, $8
 DATA	·libc_sendto_trampoline_addr(SB)/8, $libc_sendto_trampoline<>(SB)
 
 TEXT libc_recvmsg_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_recvmsg(SB)
-
 GLOBL	·libc_recvmsg_trampoline_addr(SB), RODATA, $8
 DATA	·libc_recvmsg_trampoline_addr(SB)/8, $libc_recvmsg_trampoline<>(SB)
 
 TEXT libc_sendmsg_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_sendmsg(SB)
-
 GLOBL	·libc_sendmsg_trampoline_addr(SB), RODATA, $8
 DATA	·libc_sendmsg_trampoline_addr(SB)/8, $libc_sendmsg_trampoline<>(SB)
 
 TEXT libc_kevent_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_kevent(SB)
-
 GLOBL	·libc_kevent_trampoline_addr(SB), RODATA, $8
 DATA	·libc_kevent_trampoline_addr(SB)/8, $libc_kevent_trampoline<>(SB)
 
 TEXT libc_utimes_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_utimes(SB)
-
 GLOBL	·libc_utimes_trampoline_addr(SB), RODATA, $8
 DATA	·libc_utimes_trampoline_addr(SB)/8, $libc_utimes_trampoline<>(SB)
 
 TEXT libc_futimes_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_futimes(SB)
-
 GLOBL	·libc_futimes_trampoline_addr(SB), RODATA, $8
 DATA	·libc_futimes_trampoline_addr(SB)/8, $libc_futimes_trampoline<>(SB)
 
 TEXT libc_poll_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_poll(SB)
-
 GLOBL	·libc_poll_trampoline_addr(SB), RODATA, $8
 DATA	·libc_poll_trampoline_addr(SB)/8, $libc_poll_trampoline<>(SB)
 
 TEXT libc_madvise_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_madvise(SB)
-
 GLOBL	·libc_madvise_trampoline_addr(SB), RODATA, $8
 DATA	·libc_madvise_trampoline_addr(SB)/8, $libc_madvise_trampoline<>(SB)
 
 TEXT libc_mlock_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_mlock(SB)
-
 GLOBL	·libc_mlock_trampoline_addr(SB), RODATA, $8
 DATA	·libc_mlock_trampoline_addr(SB)/8, $libc_mlock_trampoline<>(SB)
 
 TEXT libc_mlockall_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_mlockall(SB)
-
 GLOBL	·libc_mlockall_trampoline_addr(SB), RODATA, $8
 DATA	·libc_mlockall_trampoline_addr(SB)/8, $libc_mlockall_trampoline<>(SB)
 
 TEXT libc_mprotect_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_mprotect(SB)
-
 GLOBL	·libc_mprotect_trampoline_addr(SB), RODATA, $8
 DATA	·libc_mprotect_trampoline_addr(SB)/8, $libc_mprotect_trampoline<>(SB)
 
 TEXT libc_msync_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_msync(SB)
-
 GLOBL	·libc_msync_trampoline_addr(SB), RODATA, $8
 DATA	·libc_msync_trampoline_addr(SB)/8, $libc_msync_trampoline<>(SB)
 
 TEXT libc_munlock_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_munlock(SB)
-
 GLOBL	·libc_munlock_trampoline_addr(SB), RODATA, $8
 DATA	·libc_munlock_trampoline_addr(SB)/8, $libc_munlock_trampoline<>(SB)
 
 TEXT libc_munlockall_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_munlockall(SB)
-
 GLOBL	·libc_munlockall_trampoline_addr(SB), RODATA, $8
 DATA	·libc_munlockall_trampoline_addr(SB)/8, $libc_munlockall_trampoline<>(SB)
 
 TEXT libc_closedir_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_closedir(SB)
-
 GLOBL	·libc_closedir_trampoline_addr(SB), RODATA, $8
 DATA	·libc_closedir_trampoline_addr(SB)/8, $libc_closedir_trampoline<>(SB)
 
 TEXT libc_readdir_r_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_readdir_r(SB)
-
 GLOBL	·libc_readdir_r_trampoline_addr(SB), RODATA, $8
 DATA	·libc_readdir_r_trampoline_addr(SB)/8, $libc_readdir_r_trampoline<>(SB)
 
 TEXT libc_pipe_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_pipe(SB)
-
 GLOBL	·libc_pipe_trampoline_addr(SB), RODATA, $8
 DATA	·libc_pipe_trampoline_addr(SB)/8, $libc_pipe_trampoline<>(SB)
 
 TEXT libc_getxattr_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getxattr(SB)
-
 GLOBL	·libc_getxattr_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getxattr_trampoline_addr(SB)/8, $libc_getxattr_trampoline<>(SB)
 
 TEXT libc_fgetxattr_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fgetxattr(SB)
-
 GLOBL	·libc_fgetxattr_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fgetxattr_trampoline_addr(SB)/8, $libc_fgetxattr_trampoline<>(SB)
 
 TEXT libc_setxattr_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setxattr(SB)
-
 GLOBL	·libc_setxattr_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setxattr_trampoline_addr(SB)/8, $libc_setxattr_trampoline<>(SB)
 
 TEXT libc_fsetxattr_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fsetxattr(SB)
-
 GLOBL	·libc_fsetxattr_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fsetxattr_trampoline_addr(SB)/8, $libc_fsetxattr_trampoline<>(SB)
 
 TEXT libc_removexattr_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_removexattr(SB)
-
 GLOBL	·libc_removexattr_trampoline_addr(SB), RODATA, $8
 DATA	·libc_removexattr_trampoline_addr(SB)/8, $libc_removexattr_trampoline<>(SB)
 
 TEXT libc_fremovexattr_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fremovexattr(SB)
-
 GLOBL	·libc_fremovexattr_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fremovexattr_trampoline_addr(SB)/8, $libc_fremovexattr_trampoline<>(SB)
 
 TEXT libc_listxattr_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_listxattr(SB)
-
 GLOBL	·libc_listxattr_trampoline_addr(SB), RODATA, $8
 DATA	·libc_listxattr_trampoline_addr(SB)/8, $libc_listxattr_trampoline<>(SB)
 
 TEXT libc_flistxattr_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_flistxattr(SB)
-
 GLOBL	·libc_flistxattr_trampoline_addr(SB), RODATA, $8
 DATA	·libc_flistxattr_trampoline_addr(SB)/8, $libc_flistxattr_trampoline<>(SB)
 
 TEXT libc_utimensat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_utimensat(SB)
-
 GLOBL	·libc_utimensat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_utimensat_trampoline_addr(SB)/8, $libc_utimensat_trampoline<>(SB)
 
 TEXT libc_fcntl_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fcntl(SB)
-
 GLOBL	·libc_fcntl_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fcntl_trampoline_addr(SB)/8, $libc_fcntl_trampoline<>(SB)
 
 TEXT libc_kill_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_kill(SB)
-
 GLOBL	·libc_kill_trampoline_addr(SB), RODATA, $8
 DATA	·libc_kill_trampoline_addr(SB)/8, $libc_kill_trampoline<>(SB)
 
 TEXT libc_ioctl_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_ioctl(SB)
-
 GLOBL	·libc_ioctl_trampoline_addr(SB), RODATA, $8
 DATA	·libc_ioctl_trampoline_addr(SB)/8, $libc_ioctl_trampoline<>(SB)
 
 TEXT libc_sysctl_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_sysctl(SB)
-
 GLOBL	·libc_sysctl_trampoline_addr(SB), RODATA, $8
 DATA	·libc_sysctl_trampoline_addr(SB)/8, $libc_sysctl_trampoline<>(SB)
 
 TEXT libc_sendfile_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_sendfile(SB)
-
 GLOBL	·libc_sendfile_trampoline_addr(SB), RODATA, $8
 DATA	·libc_sendfile_trampoline_addr(SB)/8, $libc_sendfile_trampoline<>(SB)
 
 TEXT libc_shmat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_shmat(SB)
-
 GLOBL	·libc_shmat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_shmat_trampoline_addr(SB)/8, $libc_shmat_trampoline<>(SB)
 
 TEXT libc_shmctl_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_shmctl(SB)
-
 GLOBL	·libc_shmctl_trampoline_addr(SB), RODATA, $8
 DATA	·libc_shmctl_trampoline_addr(SB)/8, $libc_shmctl_trampoline<>(SB)
 
 TEXT libc_shmdt_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_shmdt(SB)
-
 GLOBL	·libc_shmdt_trampoline_addr(SB), RODATA, $8
 DATA	·libc_shmdt_trampoline_addr(SB)/8, $libc_shmdt_trampoline<>(SB)
 
 TEXT libc_shmget_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_shmget(SB)
-
 GLOBL	·libc_shmget_trampoline_addr(SB), RODATA, $8
 DATA	·libc_shmget_trampoline_addr(SB)/8, $libc_shmget_trampoline<>(SB)
 
 TEXT libc_access_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_access(SB)
-
 GLOBL	·libc_access_trampoline_addr(SB), RODATA, $8
 DATA	·libc_access_trampoline_addr(SB)/8, $libc_access_trampoline<>(SB)
 
 TEXT libc_adjtime_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_adjtime(SB)
-
 GLOBL	·libc_adjtime_trampoline_addr(SB), RODATA, $8
 DATA	·libc_adjtime_trampoline_addr(SB)/8, $libc_adjtime_trampoline<>(SB)
 
 TEXT libc_chdir_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_chdir(SB)
-
 GLOBL	·libc_chdir_trampoline_addr(SB), RODATA, $8
 DATA	·libc_chdir_trampoline_addr(SB)/8, $libc_chdir_trampoline<>(SB)
 
 TEXT libc_chflags_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_chflags(SB)
-
 GLOBL	·libc_chflags_trampoline_addr(SB), RODATA, $8
 DATA	·libc_chflags_trampoline_addr(SB)/8, $libc_chflags_trampoline<>(SB)
 
 TEXT libc_chmod_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_chmod(SB)
-
 GLOBL	·libc_chmod_trampoline_addr(SB), RODATA, $8
 DATA	·libc_chmod_trampoline_addr(SB)/8, $libc_chmod_trampoline<>(SB)
 
 TEXT libc_chown_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_chown(SB)
-
 GLOBL	·libc_chown_trampoline_addr(SB), RODATA, $8
 DATA	·libc_chown_trampoline_addr(SB)/8, $libc_chown_trampoline<>(SB)
 
 TEXT libc_chroot_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_chroot(SB)
-
 GLOBL	·libc_chroot_trampoline_addr(SB), RODATA, $8
 DATA	·libc_chroot_trampoline_addr(SB)/8, $libc_chroot_trampoline<>(SB)
 
 TEXT libc_clock_gettime_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_clock_gettime(SB)
-
 GLOBL	·libc_clock_gettime_trampoline_addr(SB), RODATA, $8
 DATA	·libc_clock_gettime_trampoline_addr(SB)/8, $libc_clock_gettime_trampoline<>(SB)
 
 TEXT libc_close_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_close(SB)
-
 GLOBL	·libc_close_trampoline_addr(SB), RODATA, $8
 DATA	·libc_close_trampoline_addr(SB)/8, $libc_close_trampoline<>(SB)
 
 TEXT libc_clonefile_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_clonefile(SB)
-
 GLOBL	·libc_clonefile_trampoline_addr(SB), RODATA, $8
 DATA	·libc_clonefile_trampoline_addr(SB)/8, $libc_clonefile_trampoline<>(SB)
 
 TEXT libc_clonefileat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_clonefileat(SB)
-
 GLOBL	·libc_clonefileat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_clonefileat_trampoline_addr(SB)/8, $libc_clonefileat_trampoline<>(SB)
 
 TEXT libc_dup_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_dup(SB)
-
 GLOBL	·libc_dup_trampoline_addr(SB), RODATA, $8
 DATA	·libc_dup_trampoline_addr(SB)/8, $libc_dup_trampoline<>(SB)
 
 TEXT libc_dup2_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_dup2(SB)
-
 GLOBL	·libc_dup2_trampoline_addr(SB), RODATA, $8
 DATA	·libc_dup2_trampoline_addr(SB)/8, $libc_dup2_trampoline<>(SB)
 
 TEXT libc_exchangedata_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_exchangedata(SB)
-
 GLOBL	·libc_exchangedata_trampoline_addr(SB), RODATA, $8
 DATA	·libc_exchangedata_trampoline_addr(SB)/8, $libc_exchangedata_trampoline<>(SB)
 
 TEXT libc_exit_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_exit(SB)
-
 GLOBL	·libc_exit_trampoline_addr(SB), RODATA, $8
 DATA	·libc_exit_trampoline_addr(SB)/8, $libc_exit_trampoline<>(SB)
 
 TEXT libc_faccessat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_faccessat(SB)
-
 GLOBL	·libc_faccessat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_faccessat_trampoline_addr(SB)/8, $libc_faccessat_trampoline<>(SB)
 
 TEXT libc_fchdir_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fchdir(SB)
-
 GLOBL	·libc_fchdir_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fchdir_trampoline_addr(SB)/8, $libc_fchdir_trampoline<>(SB)
 
 TEXT libc_fchflags_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fchflags(SB)
-
 GLOBL	·libc_fchflags_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fchflags_trampoline_addr(SB)/8, $libc_fchflags_trampoline<>(SB)
 
 TEXT libc_fchmod_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fchmod(SB)
-
 GLOBL	·libc_fchmod_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fchmod_trampoline_addr(SB)/8, $libc_fchmod_trampoline<>(SB)
 
 TEXT libc_fchmodat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fchmodat(SB)
-
 GLOBL	·libc_fchmodat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fchmodat_trampoline_addr(SB)/8, $libc_fchmodat_trampoline<>(SB)
 
 TEXT libc_fchown_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fchown(SB)
-
 GLOBL	·libc_fchown_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fchown_trampoline_addr(SB)/8, $libc_fchown_trampoline<>(SB)
 
 TEXT libc_fchownat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fchownat(SB)
-
 GLOBL	·libc_fchownat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fchownat_trampoline_addr(SB)/8, $libc_fchownat_trampoline<>(SB)
 
 TEXT libc_fclonefileat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fclonefileat(SB)
-
 GLOBL	·libc_fclonefileat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fclonefileat_trampoline_addr(SB)/8, $libc_fclonefileat_trampoline<>(SB)
 
 TEXT libc_flock_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_flock(SB)
-
 GLOBL	·libc_flock_trampoline_addr(SB), RODATA, $8
 DATA	·libc_flock_trampoline_addr(SB)/8, $libc_flock_trampoline<>(SB)
 
 TEXT libc_fpathconf_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fpathconf(SB)
-
 GLOBL	·libc_fpathconf_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fpathconf_trampoline_addr(SB)/8, $libc_fpathconf_trampoline<>(SB)
 
 TEXT libc_fsync_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fsync(SB)
-
 GLOBL	·libc_fsync_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fsync_trampoline_addr(SB)/8, $libc_fsync_trampoline<>(SB)
 
 TEXT libc_ftruncate_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_ftruncate(SB)
-
 GLOBL	·libc_ftruncate_trampoline_addr(SB), RODATA, $8
 DATA	·libc_ftruncate_trampoline_addr(SB)/8, $libc_ftruncate_trampoline<>(SB)
 
 TEXT libc_getcwd_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getcwd(SB)
-
 GLOBL	·libc_getcwd_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getcwd_trampoline_addr(SB)/8, $libc_getcwd_trampoline<>(SB)
 
 TEXT libc_getdtablesize_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getdtablesize(SB)
-
 GLOBL	·libc_getdtablesize_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getdtablesize_trampoline_addr(SB)/8, $libc_getdtablesize_trampoline<>(SB)
 
 TEXT libc_getegid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getegid(SB)
-
 GLOBL	·libc_getegid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getegid_trampoline_addr(SB)/8, $libc_getegid_trampoline<>(SB)
 
 TEXT libc_geteuid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_geteuid(SB)
-
 GLOBL	·libc_geteuid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_geteuid_trampoline_addr(SB)/8, $libc_geteuid_trampoline<>(SB)
 
 TEXT libc_getgid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getgid(SB)
-
 GLOBL	·libc_getgid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getgid_trampoline_addr(SB)/8, $libc_getgid_trampoline<>(SB)
 
 TEXT libc_getpgid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getpgid(SB)
-
 GLOBL	·libc_getpgid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getpgid_trampoline_addr(SB)/8, $libc_getpgid_trampoline<>(SB)
 
 TEXT libc_getpgrp_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getpgrp(SB)
-
 GLOBL	·libc_getpgrp_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getpgrp_trampoline_addr(SB)/8, $libc_getpgrp_trampoline<>(SB)
 
 TEXT libc_getpid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getpid(SB)
-
 GLOBL	·libc_getpid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getpid_trampoline_addr(SB)/8, $libc_getpid_trampoline<>(SB)
 
 TEXT libc_getppid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getppid(SB)
-
 GLOBL	·libc_getppid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getppid_trampoline_addr(SB)/8, $libc_getppid_trampoline<>(SB)
 
 TEXT libc_getpriority_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getpriority(SB)
-
 GLOBL	·libc_getpriority_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getpriority_trampoline_addr(SB)/8, $libc_getpriority_trampoline<>(SB)
 
 TEXT libc_getrlimit_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getrlimit(SB)
-
 GLOBL	·libc_getrlimit_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getrlimit_trampoline_addr(SB)/8, $libc_getrlimit_trampoline<>(SB)
 
 TEXT libc_getrusage_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getrusage(SB)
-
 GLOBL	·libc_getrusage_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getrusage_trampoline_addr(SB)/8, $libc_getrusage_trampoline<>(SB)
 
 TEXT libc_getsid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getsid(SB)
-
 GLOBL	·libc_getsid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getsid_trampoline_addr(SB)/8, $libc_getsid_trampoline<>(SB)
 
 TEXT libc_gettimeofday_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_gettimeofday(SB)
-
 GLOBL	·libc_gettimeofday_trampoline_addr(SB), RODATA, $8
 DATA	·libc_gettimeofday_trampoline_addr(SB)/8, $libc_gettimeofday_trampoline<>(SB)
 
 TEXT libc_getuid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getuid(SB)
-
 GLOBL	·libc_getuid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getuid_trampoline_addr(SB)/8, $libc_getuid_trampoline<>(SB)
 
 TEXT libc_issetugid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_issetugid(SB)
-
 GLOBL	·libc_issetugid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_issetugid_trampoline_addr(SB)/8, $libc_issetugid_trampoline<>(SB)
 
 TEXT libc_kqueue_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_kqueue(SB)
-
 GLOBL	·libc_kqueue_trampoline_addr(SB), RODATA, $8
 DATA	·libc_kqueue_trampoline_addr(SB)/8, $libc_kqueue_trampoline<>(SB)
 
 TEXT libc_lchown_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_lchown(SB)
-
 GLOBL	·libc_lchown_trampoline_addr(SB), RODATA, $8
 DATA	·libc_lchown_trampoline_addr(SB)/8, $libc_lchown_trampoline<>(SB)
 
 TEXT libc_link_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_link(SB)
-
 GLOBL	·libc_link_trampoline_addr(SB), RODATA, $8
 DATA	·libc_link_trampoline_addr(SB)/8, $libc_link_trampoline<>(SB)
 
 TEXT libc_linkat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_linkat(SB)
-
 GLOBL	·libc_linkat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_linkat_trampoline_addr(SB)/8, $libc_linkat_trampoline<>(SB)
 
 TEXT libc_listen_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_listen(SB)
-
 GLOBL	·libc_listen_trampoline_addr(SB), RODATA, $8
 DATA	·libc_listen_trampoline_addr(SB)/8, $libc_listen_trampoline<>(SB)
 
 TEXT libc_mkdir_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_mkdir(SB)
-
 GLOBL	·libc_mkdir_trampoline_addr(SB), RODATA, $8
 DATA	·libc_mkdir_trampoline_addr(SB)/8, $libc_mkdir_trampoline<>(SB)
 
 TEXT libc_mkdirat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_mkdirat(SB)
-
 GLOBL	·libc_mkdirat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_mkdirat_trampoline_addr(SB)/8, $libc_mkdirat_trampoline<>(SB)
 
 TEXT libc_mkfifo_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_mkfifo(SB)
-
 GLOBL	·libc_mkfifo_trampoline_addr(SB), RODATA, $8
 DATA	·libc_mkfifo_trampoline_addr(SB)/8, $libc_mkfifo_trampoline<>(SB)
 
 TEXT libc_mknod_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_mknod(SB)
-
 GLOBL	·libc_mknod_trampoline_addr(SB), RODATA, $8
 DATA	·libc_mknod_trampoline_addr(SB)/8, $libc_mknod_trampoline<>(SB)
 
 TEXT libc_mount_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_mount(SB)
-
 GLOBL	·libc_mount_trampoline_addr(SB), RODATA, $8
 DATA	·libc_mount_trampoline_addr(SB)/8, $libc_mount_trampoline<>(SB)
 
 TEXT libc_open_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_open(SB)
-
 GLOBL	·libc_open_trampoline_addr(SB), RODATA, $8
 DATA	·libc_open_trampoline_addr(SB)/8, $libc_open_trampoline<>(SB)
 
 TEXT libc_openat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_openat(SB)
-
 GLOBL	·libc_openat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_openat_trampoline_addr(SB)/8, $libc_openat_trampoline<>(SB)
 
 TEXT libc_pathconf_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_pathconf(SB)
-
 GLOBL	·libc_pathconf_trampoline_addr(SB), RODATA, $8
 DATA	·libc_pathconf_trampoline_addr(SB)/8, $libc_pathconf_trampoline<>(SB)
 
 TEXT libc_pread_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_pread(SB)
-
 GLOBL	·libc_pread_trampoline_addr(SB), RODATA, $8
 DATA	·libc_pread_trampoline_addr(SB)/8, $libc_pread_trampoline<>(SB)
 
 TEXT libc_pwrite_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_pwrite(SB)
-
 GLOBL	·libc_pwrite_trampoline_addr(SB), RODATA, $8
 DATA	·libc_pwrite_trampoline_addr(SB)/8, $libc_pwrite_trampoline<>(SB)
 
 TEXT libc_read_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_read(SB)
-
 GLOBL	·libc_read_trampoline_addr(SB), RODATA, $8
 DATA	·libc_read_trampoline_addr(SB)/8, $libc_read_trampoline<>(SB)
 
 TEXT libc_readlink_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_readlink(SB)
-
 GLOBL	·libc_readlink_trampoline_addr(SB), RODATA, $8
 DATA	·libc_readlink_trampoline_addr(SB)/8, $libc_readlink_trampoline<>(SB)
 
 TEXT libc_readlinkat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_readlinkat(SB)
-
 GLOBL	·libc_readlinkat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_readlinkat_trampoline_addr(SB)/8, $libc_readlinkat_trampoline<>(SB)
 
 TEXT libc_rename_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_rename(SB)
-
 GLOBL	·libc_rename_trampoline_addr(SB), RODATA, $8
 DATA	·libc_rename_trampoline_addr(SB)/8, $libc_rename_trampoline<>(SB)
 
 TEXT libc_renameat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_renameat(SB)
-
 GLOBL	·libc_renameat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_renameat_trampoline_addr(SB)/8, $libc_renameat_trampoline<>(SB)
 
 TEXT libc_revoke_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_revoke(SB)
-
 GLOBL	·libc_revoke_trampoline_addr(SB), RODATA, $8
 DATA	·libc_revoke_trampoline_addr(SB)/8, $libc_revoke_trampoline<>(SB)
 
 TEXT libc_rmdir_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_rmdir(SB)
-
 GLOBL	·libc_rmdir_trampoline_addr(SB), RODATA, $8
 DATA	·libc_rmdir_trampoline_addr(SB)/8, $libc_rmdir_trampoline<>(SB)
 
 TEXT libc_lseek_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_lseek(SB)
-
 GLOBL	·libc_lseek_trampoline_addr(SB), RODATA, $8
 DATA	·libc_lseek_trampoline_addr(SB)/8, $libc_lseek_trampoline<>(SB)
 
 TEXT libc_select_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_select(SB)
-
 GLOBL	·libc_select_trampoline_addr(SB), RODATA, $8
 DATA	·libc_select_trampoline_addr(SB)/8, $libc_select_trampoline<>(SB)
 
@@ -712,192 +595,160 @@ DATA	·libc_setattrlist_trampoline_addr(SB)/8, $libc_setattrlist_trampoline<>(SB
 
 TEXT libc_setegid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setegid(SB)
-
 GLOBL	·libc_setegid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setegid_trampoline_addr(SB)/8, $libc_setegid_trampoline<>(SB)
 
 TEXT libc_seteuid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_seteuid(SB)
-
 GLOBL	·libc_seteuid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_seteuid_trampoline_addr(SB)/8, $libc_seteuid_trampoline<>(SB)
 
 TEXT libc_setgid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setgid(SB)
-
 GLOBL	·libc_setgid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setgid_trampoline_addr(SB)/8, $libc_setgid_trampoline<>(SB)
 
 TEXT libc_setlogin_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setlogin(SB)
-
 GLOBL	·libc_setlogin_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setlogin_trampoline_addr(SB)/8, $libc_setlogin_trampoline<>(SB)
 
 TEXT libc_setpgid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setpgid(SB)
-
 GLOBL	·libc_setpgid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setpgid_trampoline_addr(SB)/8, $libc_setpgid_trampoline<>(SB)
 
 TEXT libc_setpriority_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setpriority(SB)
-
 GLOBL	·libc_setpriority_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setpriority_trampoline_addr(SB)/8, $libc_setpriority_trampoline<>(SB)
 
 TEXT libc_setprivexec_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setprivexec(SB)
-
 GLOBL	·libc_setprivexec_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setprivexec_trampoline_addr(SB)/8, $libc_setprivexec_trampoline<>(SB)
 
 TEXT libc_setregid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setregid(SB)
-
 GLOBL	·libc_setregid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setregid_trampoline_addr(SB)/8, $libc_setregid_trampoline<>(SB)
 
 TEXT libc_setreuid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setreuid(SB)
-
 GLOBL	·libc_setreuid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setreuid_trampoline_addr(SB)/8, $libc_setreuid_trampoline<>(SB)
 
 TEXT libc_setsid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setsid(SB)
-
 GLOBL	·libc_setsid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setsid_trampoline_addr(SB)/8, $libc_setsid_trampoline<>(SB)
 
 TEXT libc_settimeofday_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_settimeofday(SB)
-
 GLOBL	·libc_settimeofday_trampoline_addr(SB), RODATA, $8
 DATA	·libc_settimeofday_trampoline_addr(SB)/8, $libc_settimeofday_trampoline<>(SB)
 
 TEXT libc_setuid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setuid(SB)
-
 GLOBL	·libc_setuid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setuid_trampoline_addr(SB)/8, $libc_setuid_trampoline<>(SB)
 
 TEXT libc_symlink_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_symlink(SB)
-
 GLOBL	·libc_symlink_trampoline_addr(SB), RODATA, $8
 DATA	·libc_symlink_trampoline_addr(SB)/8, $libc_symlink_trampoline<>(SB)
 
 TEXT libc_symlinkat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_symlinkat(SB)
-
 GLOBL	·libc_symlinkat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_symlinkat_trampoline_addr(SB)/8, $libc_symlinkat_trampoline<>(SB)
 
 TEXT libc_sync_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_sync(SB)
-
 GLOBL	·libc_sync_trampoline_addr(SB), RODATA, $8
 DATA	·libc_sync_trampoline_addr(SB)/8, $libc_sync_trampoline<>(SB)
 
 TEXT libc_truncate_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_truncate(SB)
-
 GLOBL	·libc_truncate_trampoline_addr(SB), RODATA, $8
 DATA	·libc_truncate_trampoline_addr(SB)/8, $libc_truncate_trampoline<>(SB)
 
 TEXT libc_umask_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_umask(SB)
-
 GLOBL	·libc_umask_trampoline_addr(SB), RODATA, $8
 DATA	·libc_umask_trampoline_addr(SB)/8, $libc_umask_trampoline<>(SB)
 
 TEXT libc_undelete_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_undelete(SB)
-
 GLOBL	·libc_undelete_trampoline_addr(SB), RODATA, $8
 DATA	·libc_undelete_trampoline_addr(SB)/8, $libc_undelete_trampoline<>(SB)
 
 TEXT libc_unlink_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_unlink(SB)
-
 GLOBL	·libc_unlink_trampoline_addr(SB), RODATA, $8
 DATA	·libc_unlink_trampoline_addr(SB)/8, $libc_unlink_trampoline<>(SB)
 
 TEXT libc_unlinkat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_unlinkat(SB)
-
 GLOBL	·libc_unlinkat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_unlinkat_trampoline_addr(SB)/8, $libc_unlinkat_trampoline<>(SB)
 
 TEXT libc_unmount_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_unmount(SB)
-
 GLOBL	·libc_unmount_trampoline_addr(SB), RODATA, $8
 DATA	·libc_unmount_trampoline_addr(SB)/8, $libc_unmount_trampoline<>(SB)
 
 TEXT libc_write_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_write(SB)
-
 GLOBL	·libc_write_trampoline_addr(SB), RODATA, $8
 DATA	·libc_write_trampoline_addr(SB)/8, $libc_write_trampoline<>(SB)
 
 TEXT libc_mmap_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_mmap(SB)
-
 GLOBL	·libc_mmap_trampoline_addr(SB), RODATA, $8
 DATA	·libc_mmap_trampoline_addr(SB)/8, $libc_mmap_trampoline<>(SB)
 
 TEXT libc_munmap_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_munmap(SB)
-
 GLOBL	·libc_munmap_trampoline_addr(SB), RODATA, $8
 DATA	·libc_munmap_trampoline_addr(SB)/8, $libc_munmap_trampoline<>(SB)
 
 TEXT libc_fstat64_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fstat64(SB)
-
 GLOBL	·libc_fstat64_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fstat64_trampoline_addr(SB)/8, $libc_fstat64_trampoline<>(SB)
 
 TEXT libc_fstatat64_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fstatat64(SB)
-
 GLOBL	·libc_fstatat64_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fstatat64_trampoline_addr(SB)/8, $libc_fstatat64_trampoline<>(SB)
 
 TEXT libc_fstatfs64_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fstatfs64(SB)
-
 GLOBL	·libc_fstatfs64_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fstatfs64_trampoline_addr(SB)/8, $libc_fstatfs64_trampoline<>(SB)
 
 TEXT libc_getfsstat64_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getfsstat64(SB)
-
 GLOBL	·libc_getfsstat64_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getfsstat64_trampoline_addr(SB)/8, $libc_getfsstat64_trampoline<>(SB)
 
 TEXT libc_lstat64_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_lstat64(SB)
-
 GLOBL	·libc_lstat64_trampoline_addr(SB), RODATA, $8
 DATA	·libc_lstat64_trampoline_addr(SB)/8, $libc_lstat64_trampoline<>(SB)
 
 TEXT libc_ptrace_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_ptrace(SB)
-
 GLOBL	·libc_ptrace_trampoline_addr(SB), RODATA, $8
 DATA	·libc_ptrace_trampoline_addr(SB)/8, $libc_ptrace_trampoline<>(SB)
 
 TEXT libc_stat64_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_stat64(SB)
-
 GLOBL	·libc_stat64_trampoline_addr(SB), RODATA, $8
 DATA	·libc_stat64_trampoline_addr(SB)/8, $libc_stat64_trampoline<>(SB)
 
 TEXT libc_statfs64_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_statfs64(SB)
-
 GLOBL	·libc_statfs64_trampoline_addr(SB), RODATA, $8
 DATA	·libc_statfs64_trampoline_addr(SB)/8, $libc_statfs64_trampoline<>(SB)
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_darwin_arm64.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_darwin_arm64.go
index 51d6f3fb256..b18edbd0e31 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_darwin_arm64.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_darwin_arm64.go
@@ -725,6 +725,12 @@ func ioctl(fd int, req uint, arg uintptr) (err error) {
 	return
 }
 
+var libc_ioctl_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_ioctl ioctl "/usr/lib/libSystem.B.dylib"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func ioctlPtr(fd int, req uint, arg unsafe.Pointer) (err error) {
 	_, _, e1 := syscall_syscall(libc_ioctl_trampoline_addr, uintptr(fd), uintptr(req), uintptr(arg))
 	if e1 != 0 {
@@ -733,10 +739,6 @@ func ioctlPtr(fd int, req uint, arg unsafe.Pointer) (err error) {
 	return
 }
 
-var libc_ioctl_trampoline_addr uintptr
-
-//go:cgo_import_dynamic libc_ioctl ioctl "/usr/lib/libSystem.B.dylib"
-
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func sysctl(mib []_C_int, old *byte, oldlen *uintptr, new *byte, newlen uintptr) (err error) {
@@ -2410,28 +2412,6 @@ var libc_munmap_trampoline_addr uintptr
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func readlen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := syscall_syscall(libc_read_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func writelen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := syscall_syscall(libc_write_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func Fstat(fd int, stat *Stat_t) (err error) {
 	_, _, e1 := syscall_syscall(libc_fstat_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(stat)), 0)
 	if e1 != 0 {
@@ -2521,14 +2501,6 @@ func ptrace1(request int, pid int, addr uintptr, data uintptr) (err error) {
 	return
 }
 
-func ptrace1Ptr(request int, pid int, addr uintptr, data unsafe.Pointer) (err error) {
-	_, _, e1 := syscall_syscall6(libc_ptrace_trampoline_addr, uintptr(request), uintptr(pid), addr, uintptr(data), 0, 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
 var libc_ptrace_trampoline_addr uintptr
 
 //go:cgo_import_dynamic libc_ptrace ptrace "/usr/lib/libSystem.B.dylib"
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_darwin_arm64.s b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_darwin_arm64.s
index c3b82c03793..08362c1ab74 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_darwin_arm64.s
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_darwin_arm64.s
@@ -5,703 +5,586 @@
 
 TEXT libc_fdopendir_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fdopendir(SB)
-
 GLOBL	·libc_fdopendir_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fdopendir_trampoline_addr(SB)/8, $libc_fdopendir_trampoline<>(SB)
 
 TEXT libc_getgroups_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getgroups(SB)
-
 GLOBL	·libc_getgroups_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getgroups_trampoline_addr(SB)/8, $libc_getgroups_trampoline<>(SB)
 
 TEXT libc_setgroups_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setgroups(SB)
-
 GLOBL	·libc_setgroups_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setgroups_trampoline_addr(SB)/8, $libc_setgroups_trampoline<>(SB)
 
 TEXT libc_wait4_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_wait4(SB)
-
 GLOBL	·libc_wait4_trampoline_addr(SB), RODATA, $8
 DATA	·libc_wait4_trampoline_addr(SB)/8, $libc_wait4_trampoline<>(SB)
 
 TEXT libc_accept_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_accept(SB)
-
 GLOBL	·libc_accept_trampoline_addr(SB), RODATA, $8
 DATA	·libc_accept_trampoline_addr(SB)/8, $libc_accept_trampoline<>(SB)
 
 TEXT libc_bind_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_bind(SB)
-
 GLOBL	·libc_bind_trampoline_addr(SB), RODATA, $8
 DATA	·libc_bind_trampoline_addr(SB)/8, $libc_bind_trampoline<>(SB)
 
 TEXT libc_connect_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_connect(SB)
-
 GLOBL	·libc_connect_trampoline_addr(SB), RODATA, $8
 DATA	·libc_connect_trampoline_addr(SB)/8, $libc_connect_trampoline<>(SB)
 
 TEXT libc_socket_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_socket(SB)
-
 GLOBL	·libc_socket_trampoline_addr(SB), RODATA, $8
 DATA	·libc_socket_trampoline_addr(SB)/8, $libc_socket_trampoline<>(SB)
 
 TEXT libc_getsockopt_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getsockopt(SB)
-
 GLOBL	·libc_getsockopt_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getsockopt_trampoline_addr(SB)/8, $libc_getsockopt_trampoline<>(SB)
 
 TEXT libc_setsockopt_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setsockopt(SB)
-
 GLOBL	·libc_setsockopt_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setsockopt_trampoline_addr(SB)/8, $libc_setsockopt_trampoline<>(SB)
 
 TEXT libc_getpeername_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getpeername(SB)
-
 GLOBL	·libc_getpeername_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getpeername_trampoline_addr(SB)/8, $libc_getpeername_trampoline<>(SB)
 
 TEXT libc_getsockname_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getsockname(SB)
-
 GLOBL	·libc_getsockname_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getsockname_trampoline_addr(SB)/8, $libc_getsockname_trampoline<>(SB)
 
 TEXT libc_shutdown_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_shutdown(SB)
-
 GLOBL	·libc_shutdown_trampoline_addr(SB), RODATA, $8
 DATA	·libc_shutdown_trampoline_addr(SB)/8, $libc_shutdown_trampoline<>(SB)
 
 TEXT libc_socketpair_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_socketpair(SB)
-
 GLOBL	·libc_socketpair_trampoline_addr(SB), RODATA, $8
 DATA	·libc_socketpair_trampoline_addr(SB)/8, $libc_socketpair_trampoline<>(SB)
 
 TEXT libc_recvfrom_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_recvfrom(SB)
-
 GLOBL	·libc_recvfrom_trampoline_addr(SB), RODATA, $8
 DATA	·libc_recvfrom_trampoline_addr(SB)/8, $libc_recvfrom_trampoline<>(SB)
 
 TEXT libc_sendto_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_sendto(SB)
-
 GLOBL	·libc_sendto_trampoline_addr(SB), RODATA, $8
 DATA	·libc_sendto_trampoline_addr(SB)/8, $libc_sendto_trampoline<>(SB)
 
 TEXT libc_recvmsg_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_recvmsg(SB)
-
 GLOBL	·libc_recvmsg_trampoline_addr(SB), RODATA, $8
 DATA	·libc_recvmsg_trampoline_addr(SB)/8, $libc_recvmsg_trampoline<>(SB)
 
 TEXT libc_sendmsg_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_sendmsg(SB)
-
 GLOBL	·libc_sendmsg_trampoline_addr(SB), RODATA, $8
 DATA	·libc_sendmsg_trampoline_addr(SB)/8, $libc_sendmsg_trampoline<>(SB)
 
 TEXT libc_kevent_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_kevent(SB)
-
 GLOBL	·libc_kevent_trampoline_addr(SB), RODATA, $8
 DATA	·libc_kevent_trampoline_addr(SB)/8, $libc_kevent_trampoline<>(SB)
 
 TEXT libc_utimes_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_utimes(SB)
-
 GLOBL	·libc_utimes_trampoline_addr(SB), RODATA, $8
 DATA	·libc_utimes_trampoline_addr(SB)/8, $libc_utimes_trampoline<>(SB)
 
 TEXT libc_futimes_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_futimes(SB)
-
 GLOBL	·libc_futimes_trampoline_addr(SB), RODATA, $8
 DATA	·libc_futimes_trampoline_addr(SB)/8, $libc_futimes_trampoline<>(SB)
 
 TEXT libc_poll_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_poll(SB)
-
 GLOBL	·libc_poll_trampoline_addr(SB), RODATA, $8
 DATA	·libc_poll_trampoline_addr(SB)/8, $libc_poll_trampoline<>(SB)
 
 TEXT libc_madvise_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_madvise(SB)
-
 GLOBL	·libc_madvise_trampoline_addr(SB), RODATA, $8
 DATA	·libc_madvise_trampoline_addr(SB)/8, $libc_madvise_trampoline<>(SB)
 
 TEXT libc_mlock_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_mlock(SB)
-
 GLOBL	·libc_mlock_trampoline_addr(SB), RODATA, $8
 DATA	·libc_mlock_trampoline_addr(SB)/8, $libc_mlock_trampoline<>(SB)
 
 TEXT libc_mlockall_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_mlockall(SB)
-
 GLOBL	·libc_mlockall_trampoline_addr(SB), RODATA, $8
 DATA	·libc_mlockall_trampoline_addr(SB)/8, $libc_mlockall_trampoline<>(SB)
 
 TEXT libc_mprotect_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_mprotect(SB)
-
 GLOBL	·libc_mprotect_trampoline_addr(SB), RODATA, $8
 DATA	·libc_mprotect_trampoline_addr(SB)/8, $libc_mprotect_trampoline<>(SB)
 
 TEXT libc_msync_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_msync(SB)
-
 GLOBL	·libc_msync_trampoline_addr(SB), RODATA, $8
 DATA	·libc_msync_trampoline_addr(SB)/8, $libc_msync_trampoline<>(SB)
 
 TEXT libc_munlock_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_munlock(SB)
-
 GLOBL	·libc_munlock_trampoline_addr(SB), RODATA, $8
 DATA	·libc_munlock_trampoline_addr(SB)/8, $libc_munlock_trampoline<>(SB)
 
 TEXT libc_munlockall_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_munlockall(SB)
-
 GLOBL	·libc_munlockall_trampoline_addr(SB), RODATA, $8
 DATA	·libc_munlockall_trampoline_addr(SB)/8, $libc_munlockall_trampoline<>(SB)
 
 TEXT libc_closedir_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_closedir(SB)
-
 GLOBL	·libc_closedir_trampoline_addr(SB), RODATA, $8
 DATA	·libc_closedir_trampoline_addr(SB)/8, $libc_closedir_trampoline<>(SB)
 
 TEXT libc_readdir_r_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_readdir_r(SB)
-
 GLOBL	·libc_readdir_r_trampoline_addr(SB), RODATA, $8
 DATA	·libc_readdir_r_trampoline_addr(SB)/8, $libc_readdir_r_trampoline<>(SB)
 
 TEXT libc_pipe_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_pipe(SB)
-
 GLOBL	·libc_pipe_trampoline_addr(SB), RODATA, $8
 DATA	·libc_pipe_trampoline_addr(SB)/8, $libc_pipe_trampoline<>(SB)
 
 TEXT libc_getxattr_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getxattr(SB)
-
 GLOBL	·libc_getxattr_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getxattr_trampoline_addr(SB)/8, $libc_getxattr_trampoline<>(SB)
 
 TEXT libc_fgetxattr_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fgetxattr(SB)
-
 GLOBL	·libc_fgetxattr_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fgetxattr_trampoline_addr(SB)/8, $libc_fgetxattr_trampoline<>(SB)
 
 TEXT libc_setxattr_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setxattr(SB)
-
 GLOBL	·libc_setxattr_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setxattr_trampoline_addr(SB)/8, $libc_setxattr_trampoline<>(SB)
 
 TEXT libc_fsetxattr_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fsetxattr(SB)
-
 GLOBL	·libc_fsetxattr_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fsetxattr_trampoline_addr(SB)/8, $libc_fsetxattr_trampoline<>(SB)
 
 TEXT libc_removexattr_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_removexattr(SB)
-
 GLOBL	·libc_removexattr_trampoline_addr(SB), RODATA, $8
 DATA	·libc_removexattr_trampoline_addr(SB)/8, $libc_removexattr_trampoline<>(SB)
 
 TEXT libc_fremovexattr_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fremovexattr(SB)
-
 GLOBL	·libc_fremovexattr_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fremovexattr_trampoline_addr(SB)/8, $libc_fremovexattr_trampoline<>(SB)
 
 TEXT libc_listxattr_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_listxattr(SB)
-
 GLOBL	·libc_listxattr_trampoline_addr(SB), RODATA, $8
 DATA	·libc_listxattr_trampoline_addr(SB)/8, $libc_listxattr_trampoline<>(SB)
 
 TEXT libc_flistxattr_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_flistxattr(SB)
-
 GLOBL	·libc_flistxattr_trampoline_addr(SB), RODATA, $8
 DATA	·libc_flistxattr_trampoline_addr(SB)/8, $libc_flistxattr_trampoline<>(SB)
 
 TEXT libc_utimensat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_utimensat(SB)
-
 GLOBL	·libc_utimensat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_utimensat_trampoline_addr(SB)/8, $libc_utimensat_trampoline<>(SB)
 
 TEXT libc_fcntl_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fcntl(SB)
-
 GLOBL	·libc_fcntl_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fcntl_trampoline_addr(SB)/8, $libc_fcntl_trampoline<>(SB)
 
 TEXT libc_kill_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_kill(SB)
-
 GLOBL	·libc_kill_trampoline_addr(SB), RODATA, $8
 DATA	·libc_kill_trampoline_addr(SB)/8, $libc_kill_trampoline<>(SB)
 
 TEXT libc_ioctl_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_ioctl(SB)
-
 GLOBL	·libc_ioctl_trampoline_addr(SB), RODATA, $8
 DATA	·libc_ioctl_trampoline_addr(SB)/8, $libc_ioctl_trampoline<>(SB)
 
 TEXT libc_sysctl_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_sysctl(SB)
-
 GLOBL	·libc_sysctl_trampoline_addr(SB), RODATA, $8
 DATA	·libc_sysctl_trampoline_addr(SB)/8, $libc_sysctl_trampoline<>(SB)
 
 TEXT libc_sendfile_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_sendfile(SB)
-
 GLOBL	·libc_sendfile_trampoline_addr(SB), RODATA, $8
 DATA	·libc_sendfile_trampoline_addr(SB)/8, $libc_sendfile_trampoline<>(SB)
 
 TEXT libc_shmat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_shmat(SB)
-
 GLOBL	·libc_shmat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_shmat_trampoline_addr(SB)/8, $libc_shmat_trampoline<>(SB)
 
 TEXT libc_shmctl_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_shmctl(SB)
-
 GLOBL	·libc_shmctl_trampoline_addr(SB), RODATA, $8
 DATA	·libc_shmctl_trampoline_addr(SB)/8, $libc_shmctl_trampoline<>(SB)
 
 TEXT libc_shmdt_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_shmdt(SB)
-
 GLOBL	·libc_shmdt_trampoline_addr(SB), RODATA, $8
 DATA	·libc_shmdt_trampoline_addr(SB)/8, $libc_shmdt_trampoline<>(SB)
 
 TEXT libc_shmget_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_shmget(SB)
-
 GLOBL	·libc_shmget_trampoline_addr(SB), RODATA, $8
 DATA	·libc_shmget_trampoline_addr(SB)/8, $libc_shmget_trampoline<>(SB)
 
 TEXT libc_access_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_access(SB)
-
 GLOBL	·libc_access_trampoline_addr(SB), RODATA, $8
 DATA	·libc_access_trampoline_addr(SB)/8, $libc_access_trampoline<>(SB)
 
 TEXT libc_adjtime_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_adjtime(SB)
-
 GLOBL	·libc_adjtime_trampoline_addr(SB), RODATA, $8
 DATA	·libc_adjtime_trampoline_addr(SB)/8, $libc_adjtime_trampoline<>(SB)
 
 TEXT libc_chdir_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_chdir(SB)
-
 GLOBL	·libc_chdir_trampoline_addr(SB), RODATA, $8
 DATA	·libc_chdir_trampoline_addr(SB)/8, $libc_chdir_trampoline<>(SB)
 
 TEXT libc_chflags_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_chflags(SB)
-
 GLOBL	·libc_chflags_trampoline_addr(SB), RODATA, $8
 DATA	·libc_chflags_trampoline_addr(SB)/8, $libc_chflags_trampoline<>(SB)
 
 TEXT libc_chmod_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_chmod(SB)
-
 GLOBL	·libc_chmod_trampoline_addr(SB), RODATA, $8
 DATA	·libc_chmod_trampoline_addr(SB)/8, $libc_chmod_trampoline<>(SB)
 
 TEXT libc_chown_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_chown(SB)
-
 GLOBL	·libc_chown_trampoline_addr(SB), RODATA, $8
 DATA	·libc_chown_trampoline_addr(SB)/8, $libc_chown_trampoline<>(SB)
 
 TEXT libc_chroot_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_chroot(SB)
-
 GLOBL	·libc_chroot_trampoline_addr(SB), RODATA, $8
 DATA	·libc_chroot_trampoline_addr(SB)/8, $libc_chroot_trampoline<>(SB)
 
 TEXT libc_clock_gettime_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_clock_gettime(SB)
-
 GLOBL	·libc_clock_gettime_trampoline_addr(SB), RODATA, $8
 DATA	·libc_clock_gettime_trampoline_addr(SB)/8, $libc_clock_gettime_trampoline<>(SB)
 
 TEXT libc_close_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_close(SB)
-
 GLOBL	·libc_close_trampoline_addr(SB), RODATA, $8
 DATA	·libc_close_trampoline_addr(SB)/8, $libc_close_trampoline<>(SB)
 
 TEXT libc_clonefile_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_clonefile(SB)
-
 GLOBL	·libc_clonefile_trampoline_addr(SB), RODATA, $8
 DATA	·libc_clonefile_trampoline_addr(SB)/8, $libc_clonefile_trampoline<>(SB)
 
 TEXT libc_clonefileat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_clonefileat(SB)
-
 GLOBL	·libc_clonefileat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_clonefileat_trampoline_addr(SB)/8, $libc_clonefileat_trampoline<>(SB)
 
 TEXT libc_dup_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_dup(SB)
-
 GLOBL	·libc_dup_trampoline_addr(SB), RODATA, $8
 DATA	·libc_dup_trampoline_addr(SB)/8, $libc_dup_trampoline<>(SB)
 
 TEXT libc_dup2_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_dup2(SB)
-
 GLOBL	·libc_dup2_trampoline_addr(SB), RODATA, $8
 DATA	·libc_dup2_trampoline_addr(SB)/8, $libc_dup2_trampoline<>(SB)
 
 TEXT libc_exchangedata_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_exchangedata(SB)
-
 GLOBL	·libc_exchangedata_trampoline_addr(SB), RODATA, $8
 DATA	·libc_exchangedata_trampoline_addr(SB)/8, $libc_exchangedata_trampoline<>(SB)
 
 TEXT libc_exit_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_exit(SB)
-
 GLOBL	·libc_exit_trampoline_addr(SB), RODATA, $8
 DATA	·libc_exit_trampoline_addr(SB)/8, $libc_exit_trampoline<>(SB)
 
 TEXT libc_faccessat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_faccessat(SB)
-
 GLOBL	·libc_faccessat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_faccessat_trampoline_addr(SB)/8, $libc_faccessat_trampoline<>(SB)
 
 TEXT libc_fchdir_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fchdir(SB)
-
 GLOBL	·libc_fchdir_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fchdir_trampoline_addr(SB)/8, $libc_fchdir_trampoline<>(SB)
 
 TEXT libc_fchflags_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fchflags(SB)
-
 GLOBL	·libc_fchflags_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fchflags_trampoline_addr(SB)/8, $libc_fchflags_trampoline<>(SB)
 
 TEXT libc_fchmod_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fchmod(SB)
-
 GLOBL	·libc_fchmod_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fchmod_trampoline_addr(SB)/8, $libc_fchmod_trampoline<>(SB)
 
 TEXT libc_fchmodat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fchmodat(SB)
-
 GLOBL	·libc_fchmodat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fchmodat_trampoline_addr(SB)/8, $libc_fchmodat_trampoline<>(SB)
 
 TEXT libc_fchown_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fchown(SB)
-
 GLOBL	·libc_fchown_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fchown_trampoline_addr(SB)/8, $libc_fchown_trampoline<>(SB)
 
 TEXT libc_fchownat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fchownat(SB)
-
 GLOBL	·libc_fchownat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fchownat_trampoline_addr(SB)/8, $libc_fchownat_trampoline<>(SB)
 
 TEXT libc_fclonefileat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fclonefileat(SB)
-
 GLOBL	·libc_fclonefileat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fclonefileat_trampoline_addr(SB)/8, $libc_fclonefileat_trampoline<>(SB)
 
 TEXT libc_flock_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_flock(SB)
-
 GLOBL	·libc_flock_trampoline_addr(SB), RODATA, $8
 DATA	·libc_flock_trampoline_addr(SB)/8, $libc_flock_trampoline<>(SB)
 
 TEXT libc_fpathconf_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fpathconf(SB)
-
 GLOBL	·libc_fpathconf_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fpathconf_trampoline_addr(SB)/8, $libc_fpathconf_trampoline<>(SB)
 
 TEXT libc_fsync_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fsync(SB)
-
 GLOBL	·libc_fsync_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fsync_trampoline_addr(SB)/8, $libc_fsync_trampoline<>(SB)
 
 TEXT libc_ftruncate_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_ftruncate(SB)
-
 GLOBL	·libc_ftruncate_trampoline_addr(SB), RODATA, $8
 DATA	·libc_ftruncate_trampoline_addr(SB)/8, $libc_ftruncate_trampoline<>(SB)
 
 TEXT libc_getcwd_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getcwd(SB)
-
 GLOBL	·libc_getcwd_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getcwd_trampoline_addr(SB)/8, $libc_getcwd_trampoline<>(SB)
 
 TEXT libc_getdtablesize_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getdtablesize(SB)
-
 GLOBL	·libc_getdtablesize_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getdtablesize_trampoline_addr(SB)/8, $libc_getdtablesize_trampoline<>(SB)
 
 TEXT libc_getegid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getegid(SB)
-
 GLOBL	·libc_getegid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getegid_trampoline_addr(SB)/8, $libc_getegid_trampoline<>(SB)
 
 TEXT libc_geteuid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_geteuid(SB)
-
 GLOBL	·libc_geteuid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_geteuid_trampoline_addr(SB)/8, $libc_geteuid_trampoline<>(SB)
 
 TEXT libc_getgid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getgid(SB)
-
 GLOBL	·libc_getgid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getgid_trampoline_addr(SB)/8, $libc_getgid_trampoline<>(SB)
 
 TEXT libc_getpgid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getpgid(SB)
-
 GLOBL	·libc_getpgid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getpgid_trampoline_addr(SB)/8, $libc_getpgid_trampoline<>(SB)
 
 TEXT libc_getpgrp_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getpgrp(SB)
-
 GLOBL	·libc_getpgrp_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getpgrp_trampoline_addr(SB)/8, $libc_getpgrp_trampoline<>(SB)
 
 TEXT libc_getpid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getpid(SB)
-
 GLOBL	·libc_getpid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getpid_trampoline_addr(SB)/8, $libc_getpid_trampoline<>(SB)
 
 TEXT libc_getppid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getppid(SB)
-
 GLOBL	·libc_getppid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getppid_trampoline_addr(SB)/8, $libc_getppid_trampoline<>(SB)
 
 TEXT libc_getpriority_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getpriority(SB)
-
 GLOBL	·libc_getpriority_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getpriority_trampoline_addr(SB)/8, $libc_getpriority_trampoline<>(SB)
 
 TEXT libc_getrlimit_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getrlimit(SB)
-
 GLOBL	·libc_getrlimit_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getrlimit_trampoline_addr(SB)/8, $libc_getrlimit_trampoline<>(SB)
 
 TEXT libc_getrusage_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getrusage(SB)
-
 GLOBL	·libc_getrusage_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getrusage_trampoline_addr(SB)/8, $libc_getrusage_trampoline<>(SB)
 
 TEXT libc_getsid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getsid(SB)
-
 GLOBL	·libc_getsid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getsid_trampoline_addr(SB)/8, $libc_getsid_trampoline<>(SB)
 
 TEXT libc_gettimeofday_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_gettimeofday(SB)
-
 GLOBL	·libc_gettimeofday_trampoline_addr(SB), RODATA, $8
 DATA	·libc_gettimeofday_trampoline_addr(SB)/8, $libc_gettimeofday_trampoline<>(SB)
 
 TEXT libc_getuid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getuid(SB)
-
 GLOBL	·libc_getuid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getuid_trampoline_addr(SB)/8, $libc_getuid_trampoline<>(SB)
 
 TEXT libc_issetugid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_issetugid(SB)
-
 GLOBL	·libc_issetugid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_issetugid_trampoline_addr(SB)/8, $libc_issetugid_trampoline<>(SB)
 
 TEXT libc_kqueue_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_kqueue(SB)
-
 GLOBL	·libc_kqueue_trampoline_addr(SB), RODATA, $8
 DATA	·libc_kqueue_trampoline_addr(SB)/8, $libc_kqueue_trampoline<>(SB)
 
 TEXT libc_lchown_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_lchown(SB)
-
 GLOBL	·libc_lchown_trampoline_addr(SB), RODATA, $8
 DATA	·libc_lchown_trampoline_addr(SB)/8, $libc_lchown_trampoline<>(SB)
 
 TEXT libc_link_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_link(SB)
-
 GLOBL	·libc_link_trampoline_addr(SB), RODATA, $8
 DATA	·libc_link_trampoline_addr(SB)/8, $libc_link_trampoline<>(SB)
 
 TEXT libc_linkat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_linkat(SB)
-
 GLOBL	·libc_linkat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_linkat_trampoline_addr(SB)/8, $libc_linkat_trampoline<>(SB)
 
 TEXT libc_listen_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_listen(SB)
-
 GLOBL	·libc_listen_trampoline_addr(SB), RODATA, $8
 DATA	·libc_listen_trampoline_addr(SB)/8, $libc_listen_trampoline<>(SB)
 
 TEXT libc_mkdir_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_mkdir(SB)
-
 GLOBL	·libc_mkdir_trampoline_addr(SB), RODATA, $8
 DATA	·libc_mkdir_trampoline_addr(SB)/8, $libc_mkdir_trampoline<>(SB)
 
 TEXT libc_mkdirat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_mkdirat(SB)
-
 GLOBL	·libc_mkdirat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_mkdirat_trampoline_addr(SB)/8, $libc_mkdirat_trampoline<>(SB)
 
 TEXT libc_mkfifo_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_mkfifo(SB)
-
 GLOBL	·libc_mkfifo_trampoline_addr(SB), RODATA, $8
 DATA	·libc_mkfifo_trampoline_addr(SB)/8, $libc_mkfifo_trampoline<>(SB)
 
 TEXT libc_mknod_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_mknod(SB)
-
 GLOBL	·libc_mknod_trampoline_addr(SB), RODATA, $8
 DATA	·libc_mknod_trampoline_addr(SB)/8, $libc_mknod_trampoline<>(SB)
 
 TEXT libc_mount_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_mount(SB)
-
 GLOBL	·libc_mount_trampoline_addr(SB), RODATA, $8
 DATA	·libc_mount_trampoline_addr(SB)/8, $libc_mount_trampoline<>(SB)
 
 TEXT libc_open_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_open(SB)
-
 GLOBL	·libc_open_trampoline_addr(SB), RODATA, $8
 DATA	·libc_open_trampoline_addr(SB)/8, $libc_open_trampoline<>(SB)
 
 TEXT libc_openat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_openat(SB)
-
 GLOBL	·libc_openat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_openat_trampoline_addr(SB)/8, $libc_openat_trampoline<>(SB)
 
 TEXT libc_pathconf_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_pathconf(SB)
-
 GLOBL	·libc_pathconf_trampoline_addr(SB), RODATA, $8
 DATA	·libc_pathconf_trampoline_addr(SB)/8, $libc_pathconf_trampoline<>(SB)
 
 TEXT libc_pread_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_pread(SB)
-
 GLOBL	·libc_pread_trampoline_addr(SB), RODATA, $8
 DATA	·libc_pread_trampoline_addr(SB)/8, $libc_pread_trampoline<>(SB)
 
 TEXT libc_pwrite_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_pwrite(SB)
-
 GLOBL	·libc_pwrite_trampoline_addr(SB), RODATA, $8
 DATA	·libc_pwrite_trampoline_addr(SB)/8, $libc_pwrite_trampoline<>(SB)
 
 TEXT libc_read_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_read(SB)
-
 GLOBL	·libc_read_trampoline_addr(SB), RODATA, $8
 DATA	·libc_read_trampoline_addr(SB)/8, $libc_read_trampoline<>(SB)
 
 TEXT libc_readlink_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_readlink(SB)
-
 GLOBL	·libc_readlink_trampoline_addr(SB), RODATA, $8
 DATA	·libc_readlink_trampoline_addr(SB)/8, $libc_readlink_trampoline<>(SB)
 
 TEXT libc_readlinkat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_readlinkat(SB)
-
 GLOBL	·libc_readlinkat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_readlinkat_trampoline_addr(SB)/8, $libc_readlinkat_trampoline<>(SB)
 
 TEXT libc_rename_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_rename(SB)
-
 GLOBL	·libc_rename_trampoline_addr(SB), RODATA, $8
 DATA	·libc_rename_trampoline_addr(SB)/8, $libc_rename_trampoline<>(SB)
 
 TEXT libc_renameat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_renameat(SB)
-
 GLOBL	·libc_renameat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_renameat_trampoline_addr(SB)/8, $libc_renameat_trampoline<>(SB)
 
 TEXT libc_revoke_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_revoke(SB)
-
 GLOBL	·libc_revoke_trampoline_addr(SB), RODATA, $8
 DATA	·libc_revoke_trampoline_addr(SB)/8, $libc_revoke_trampoline<>(SB)
 
 TEXT libc_rmdir_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_rmdir(SB)
-
 GLOBL	·libc_rmdir_trampoline_addr(SB), RODATA, $8
 DATA	·libc_rmdir_trampoline_addr(SB)/8, $libc_rmdir_trampoline<>(SB)
 
 TEXT libc_lseek_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_lseek(SB)
-
 GLOBL	·libc_lseek_trampoline_addr(SB), RODATA, $8
 DATA	·libc_lseek_trampoline_addr(SB)/8, $libc_lseek_trampoline<>(SB)
 
 TEXT libc_select_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_select(SB)
-
 GLOBL	·libc_select_trampoline_addr(SB), RODATA, $8
 DATA	·libc_select_trampoline_addr(SB)/8, $libc_select_trampoline<>(SB)
 
@@ -712,192 +595,160 @@ DATA	·libc_setattrlist_trampoline_addr(SB)/8, $libc_setattrlist_trampoline<>(SB
 
 TEXT libc_setegid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setegid(SB)
-
 GLOBL	·libc_setegid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setegid_trampoline_addr(SB)/8, $libc_setegid_trampoline<>(SB)
 
 TEXT libc_seteuid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_seteuid(SB)
-
 GLOBL	·libc_seteuid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_seteuid_trampoline_addr(SB)/8, $libc_seteuid_trampoline<>(SB)
 
 TEXT libc_setgid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setgid(SB)
-
 GLOBL	·libc_setgid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setgid_trampoline_addr(SB)/8, $libc_setgid_trampoline<>(SB)
 
 TEXT libc_setlogin_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setlogin(SB)
-
 GLOBL	·libc_setlogin_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setlogin_trampoline_addr(SB)/8, $libc_setlogin_trampoline<>(SB)
 
 TEXT libc_setpgid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setpgid(SB)
-
 GLOBL	·libc_setpgid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setpgid_trampoline_addr(SB)/8, $libc_setpgid_trampoline<>(SB)
 
 TEXT libc_setpriority_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setpriority(SB)
-
 GLOBL	·libc_setpriority_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setpriority_trampoline_addr(SB)/8, $libc_setpriority_trampoline<>(SB)
 
 TEXT libc_setprivexec_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setprivexec(SB)
-
 GLOBL	·libc_setprivexec_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setprivexec_trampoline_addr(SB)/8, $libc_setprivexec_trampoline<>(SB)
 
 TEXT libc_setregid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setregid(SB)
-
 GLOBL	·libc_setregid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setregid_trampoline_addr(SB)/8, $libc_setregid_trampoline<>(SB)
 
 TEXT libc_setreuid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setreuid(SB)
-
 GLOBL	·libc_setreuid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setreuid_trampoline_addr(SB)/8, $libc_setreuid_trampoline<>(SB)
 
 TEXT libc_setsid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setsid(SB)
-
 GLOBL	·libc_setsid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setsid_trampoline_addr(SB)/8, $libc_setsid_trampoline<>(SB)
 
 TEXT libc_settimeofday_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_settimeofday(SB)
-
 GLOBL	·libc_settimeofday_trampoline_addr(SB), RODATA, $8
 DATA	·libc_settimeofday_trampoline_addr(SB)/8, $libc_settimeofday_trampoline<>(SB)
 
 TEXT libc_setuid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setuid(SB)
-
 GLOBL	·libc_setuid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setuid_trampoline_addr(SB)/8, $libc_setuid_trampoline<>(SB)
 
 TEXT libc_symlink_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_symlink(SB)
-
 GLOBL	·libc_symlink_trampoline_addr(SB), RODATA, $8
 DATA	·libc_symlink_trampoline_addr(SB)/8, $libc_symlink_trampoline<>(SB)
 
 TEXT libc_symlinkat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_symlinkat(SB)
-
 GLOBL	·libc_symlinkat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_symlinkat_trampoline_addr(SB)/8, $libc_symlinkat_trampoline<>(SB)
 
 TEXT libc_sync_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_sync(SB)
-
 GLOBL	·libc_sync_trampoline_addr(SB), RODATA, $8
 DATA	·libc_sync_trampoline_addr(SB)/8, $libc_sync_trampoline<>(SB)
 
 TEXT libc_truncate_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_truncate(SB)
-
 GLOBL	·libc_truncate_trampoline_addr(SB), RODATA, $8
 DATA	·libc_truncate_trampoline_addr(SB)/8, $libc_truncate_trampoline<>(SB)
 
 TEXT libc_umask_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_umask(SB)
-
 GLOBL	·libc_umask_trampoline_addr(SB), RODATA, $8
 DATA	·libc_umask_trampoline_addr(SB)/8, $libc_umask_trampoline<>(SB)
 
 TEXT libc_undelete_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_undelete(SB)
-
 GLOBL	·libc_undelete_trampoline_addr(SB), RODATA, $8
 DATA	·libc_undelete_trampoline_addr(SB)/8, $libc_undelete_trampoline<>(SB)
 
 TEXT libc_unlink_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_unlink(SB)
-
 GLOBL	·libc_unlink_trampoline_addr(SB), RODATA, $8
 DATA	·libc_unlink_trampoline_addr(SB)/8, $libc_unlink_trampoline<>(SB)
 
 TEXT libc_unlinkat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_unlinkat(SB)
-
 GLOBL	·libc_unlinkat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_unlinkat_trampoline_addr(SB)/8, $libc_unlinkat_trampoline<>(SB)
 
 TEXT libc_unmount_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_unmount(SB)
-
 GLOBL	·libc_unmount_trampoline_addr(SB), RODATA, $8
 DATA	·libc_unmount_trampoline_addr(SB)/8, $libc_unmount_trampoline<>(SB)
 
 TEXT libc_write_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_write(SB)
-
 GLOBL	·libc_write_trampoline_addr(SB), RODATA, $8
 DATA	·libc_write_trampoline_addr(SB)/8, $libc_write_trampoline<>(SB)
 
 TEXT libc_mmap_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_mmap(SB)
-
 GLOBL	·libc_mmap_trampoline_addr(SB), RODATA, $8
 DATA	·libc_mmap_trampoline_addr(SB)/8, $libc_mmap_trampoline<>(SB)
 
 TEXT libc_munmap_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_munmap(SB)
-
 GLOBL	·libc_munmap_trampoline_addr(SB), RODATA, $8
 DATA	·libc_munmap_trampoline_addr(SB)/8, $libc_munmap_trampoline<>(SB)
 
 TEXT libc_fstat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fstat(SB)
-
 GLOBL	·libc_fstat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fstat_trampoline_addr(SB)/8, $libc_fstat_trampoline<>(SB)
 
 TEXT libc_fstatat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fstatat(SB)
-
 GLOBL	·libc_fstatat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fstatat_trampoline_addr(SB)/8, $libc_fstatat_trampoline<>(SB)
 
 TEXT libc_fstatfs_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fstatfs(SB)
-
 GLOBL	·libc_fstatfs_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fstatfs_trampoline_addr(SB)/8, $libc_fstatfs_trampoline<>(SB)
 
 TEXT libc_getfsstat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getfsstat(SB)
-
 GLOBL	·libc_getfsstat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getfsstat_trampoline_addr(SB)/8, $libc_getfsstat_trampoline<>(SB)
 
 TEXT libc_lstat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_lstat(SB)
-
 GLOBL	·libc_lstat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_lstat_trampoline_addr(SB)/8, $libc_lstat_trampoline<>(SB)
 
 TEXT libc_ptrace_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_ptrace(SB)
-
 GLOBL	·libc_ptrace_trampoline_addr(SB), RODATA, $8
 DATA	·libc_ptrace_trampoline_addr(SB)/8, $libc_ptrace_trampoline<>(SB)
 
 TEXT libc_stat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_stat(SB)
-
 GLOBL	·libc_stat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_stat_trampoline_addr(SB)/8, $libc_stat_trampoline<>(SB)
 
 TEXT libc_statfs_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_statfs(SB)
-
 GLOBL	·libc_statfs_trampoline_addr(SB), RODATA, $8
 DATA	·libc_statfs_trampoline_addr(SB)/8, $libc_statfs_trampoline<>(SB)
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_dragonfly_amd64.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_dragonfly_amd64.go
index 0eabac7ade2..0c67df64a50 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_dragonfly_amd64.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_dragonfly_amd64.go
@@ -1642,28 +1642,6 @@ func munmap(addr uintptr, length uintptr) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func readlen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := Syscall(SYS_READ, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func writelen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := Syscall(SYS_WRITE, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func accept4(fd int, rsa *RawSockaddrAny, addrlen *_Socklen, flags int) (nfd int, err error) {
 	r0, _, e1 := Syscall6(SYS_ACCEPT4, uintptr(fd), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)), uintptr(flags), 0, 0)
 	nfd = int(r0)
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_freebsd_386.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_freebsd_386.go
index ee313eb0073..e6e05d145bf 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_freebsd_386.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_freebsd_386.go
@@ -1862,28 +1862,6 @@ func munmap(addr uintptr, length uintptr) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func readlen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := Syscall(SYS_READ, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func writelen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := Syscall(SYS_WRITE, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func accept4(fd int, rsa *RawSockaddrAny, addrlen *_Socklen, flags int) (nfd int, err error) {
 	r0, _, e1 := Syscall6(SYS_ACCEPT4, uintptr(fd), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)), uintptr(flags), 0, 0)
 	nfd = int(r0)
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_freebsd_amd64.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_freebsd_amd64.go
index 4c986e448ee..7508accac92 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_freebsd_amd64.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_freebsd_amd64.go
@@ -1862,28 +1862,6 @@ func munmap(addr uintptr, length uintptr) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func readlen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := Syscall(SYS_READ, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func writelen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := Syscall(SYS_WRITE, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func accept4(fd int, rsa *RawSockaddrAny, addrlen *_Socklen, flags int) (nfd int, err error) {
 	r0, _, e1 := Syscall6(SYS_ACCEPT4, uintptr(fd), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)), uintptr(flags), 0, 0)
 	nfd = int(r0)
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_freebsd_arm.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_freebsd_arm.go
index 555216944a0..7b56aead469 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_freebsd_arm.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_freebsd_arm.go
@@ -1862,28 +1862,6 @@ func munmap(addr uintptr, length uintptr) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func readlen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := Syscall(SYS_READ, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func writelen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := Syscall(SYS_WRITE, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func accept4(fd int, rsa *RawSockaddrAny, addrlen *_Socklen, flags int) (nfd int, err error) {
 	r0, _, e1 := Syscall6(SYS_ACCEPT4, uintptr(fd), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)), uintptr(flags), 0, 0)
 	nfd = int(r0)
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_freebsd_arm64.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_freebsd_arm64.go
index 67a226fbf5e..cc623dcaae5 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_freebsd_arm64.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_freebsd_arm64.go
@@ -1862,28 +1862,6 @@ func munmap(addr uintptr, length uintptr) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func readlen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := Syscall(SYS_READ, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func writelen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := Syscall(SYS_WRITE, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func accept4(fd int, rsa *RawSockaddrAny, addrlen *_Socklen, flags int) (nfd int, err error) {
 	r0, _, e1 := Syscall6(SYS_ACCEPT4, uintptr(fd), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)), uintptr(flags), 0, 0)
 	nfd = int(r0)
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_freebsd_riscv64.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_freebsd_riscv64.go
index f0b9ddaaa26..58184919740 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_freebsd_riscv64.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_freebsd_riscv64.go
@@ -1862,28 +1862,6 @@ func munmap(addr uintptr, length uintptr) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func readlen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := Syscall(SYS_READ, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func writelen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := Syscall(SYS_WRITE, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func accept4(fd int, rsa *RawSockaddrAny, addrlen *_Socklen, flags int) (nfd int, err error) {
 	r0, _, e1 := Syscall6(SYS_ACCEPT4, uintptr(fd), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)), uintptr(flags), 0, 0)
 	nfd = int(r0)
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_illumos_amd64.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_illumos_amd64.go
index b57c7050d7a..6be25cd1901 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_illumos_amd64.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_illumos_amd64.go
@@ -40,7 +40,7 @@ func readv(fd int, iovs []Iovec) (n int, err error) {
 	r0, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procreadv)), 3, uintptr(fd), uintptr(unsafe.Pointer(_p0)), uintptr(len(iovs)), 0, 0, 0)
 	n = int(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -55,7 +55,7 @@ func preadv(fd int, iovs []Iovec, off int64) (n int, err error) {
 	r0, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procpreadv)), 4, uintptr(fd), uintptr(unsafe.Pointer(_p0)), uintptr(len(iovs)), uintptr(off), 0, 0)
 	n = int(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -70,7 +70,7 @@ func writev(fd int, iovs []Iovec) (n int, err error) {
 	r0, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procwritev)), 3, uintptr(fd), uintptr(unsafe.Pointer(_p0)), uintptr(len(iovs)), 0, 0, 0)
 	n = int(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -85,7 +85,7 @@ func pwritev(fd int, iovs []Iovec, off int64) (n int, err error) {
 	r0, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procpwritev)), 4, uintptr(fd), uintptr(unsafe.Pointer(_p0)), uintptr(len(iovs)), uintptr(off), 0, 0)
 	n = int(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -96,7 +96,7 @@ func accept4(s int, rsa *RawSockaddrAny, addrlen *_Socklen, flags int) (fd int,
 	r0, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procaccept4)), 4, uintptr(s), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)), uintptr(flags), 0, 0)
 	fd = int(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_linux.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_linux.go
index da63d9d7822..1ff3aec74c5 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_linux.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_linux.go
@@ -1356,7 +1356,7 @@ func Prctl(option int, arg2 uintptr, arg3 uintptr, arg4 uintptr, arg5 uintptr) (
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Pselect(nfd int, r *FdSet, w *FdSet, e *FdSet, timeout *Timespec, sigmask *Sigset_t) (n int, err error) {
+func pselect6(nfd int, r *FdSet, w *FdSet, e *FdSet, timeout *Timespec, sigmask *sigset_argpack) (n int, err error) {
 	r0, _, e1 := Syscall6(SYS_PSELECT6, uintptr(nfd), uintptr(unsafe.Pointer(r)), uintptr(unsafe.Pointer(w)), uintptr(unsafe.Pointer(e)), uintptr(unsafe.Pointer(timeout)), uintptr(unsafe.Pointer(sigmask)))
 	n = int(r0)
 	if e1 != 0 {
@@ -1734,28 +1734,6 @@ func exitThread(code int) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func readlen(fd int, p *byte, np int) (n int, err error) {
-	r0, _, e1 := Syscall(SYS_READ, uintptr(fd), uintptr(unsafe.Pointer(p)), uintptr(np))
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func writelen(fd int, p *byte, np int) (n int, err error) {
-	r0, _, e1 := Syscall(SYS_WRITE, uintptr(fd), uintptr(unsafe.Pointer(p)), uintptr(np))
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func readv(fd int, iovs []Iovec) (n int, err error) {
 	var _p0 unsafe.Pointer
 	if len(iovs) > 0 {
@@ -1868,6 +1846,17 @@ func munmap(addr uintptr, length uintptr) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func mremap(oldaddr uintptr, oldlength uintptr, newlength uintptr, flags int, newaddr uintptr) (xaddr uintptr, err error) {
+	r0, _, e1 := Syscall6(SYS_MREMAP, uintptr(oldaddr), uintptr(oldlength), uintptr(newlength), uintptr(flags), uintptr(newaddr), 0)
+	xaddr = uintptr(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func Madvise(b []byte, advice int) (err error) {
 	var _p0 unsafe.Pointer
 	if len(b) > 0 {
@@ -2172,3 +2161,37 @@ func rtSigprocmask(how int, set *Sigset_t, oldset *Sigset_t, sigsetsize uintptr)
 	}
 	return
 }
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func getresuid(ruid *_C_int, euid *_C_int, suid *_C_int) {
+	RawSyscallNoError(SYS_GETRESUID, uintptr(unsafe.Pointer(ruid)), uintptr(unsafe.Pointer(euid)), uintptr(unsafe.Pointer(suid)))
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func getresgid(rgid *_C_int, egid *_C_int, sgid *_C_int) {
+	RawSyscallNoError(SYS_GETRESGID, uintptr(unsafe.Pointer(rgid)), uintptr(unsafe.Pointer(egid)), uintptr(unsafe.Pointer(sgid)))
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func schedSetattr(pid int, attr *SchedAttr, flags uint) (err error) {
+	_, _, e1 := Syscall(SYS_SCHED_SETATTR, uintptr(pid), uintptr(unsafe.Pointer(attr)), uintptr(flags))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func schedGetattr(pid int, attr *SchedAttr, size uint, flags uint) (err error) {
+	_, _, e1 := Syscall6(SYS_SCHED_GETATTR, uintptr(pid), uintptr(unsafe.Pointer(attr)), uintptr(size), uintptr(flags), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_linux_riscv64.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_linux_riscv64.go
index 0b29239583b..0ab4f2ed720 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_linux_riscv64.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_linux_riscv64.go
@@ -531,3 +531,19 @@ func kexecFileLoad(kernelFd int, initrdFd int, cmdlineLen int, cmdline string, f
 	}
 	return
 }
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func riscvHWProbe(pairs []RISCVHWProbePairs, cpuCount uintptr, cpus *CPUSet, flags uint) (err error) {
+	var _p0 unsafe.Pointer
+	if len(pairs) > 0 {
+		_p0 = unsafe.Pointer(&pairs[0])
+	} else {
+		_p0 = unsafe.Pointer(&_zero)
+	}
+	_, _, e1 := Syscall6(SYS_RISCV_HWPROBE, uintptr(_p0), uintptr(len(pairs)), uintptr(cpuCount), uintptr(unsafe.Pointer(cpus)), uintptr(flags), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_netbsd_386.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_netbsd_386.go
index cdb2af5ae0f..2df3c5bac6d 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_netbsd_386.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_netbsd_386.go
@@ -1824,20 +1824,13 @@ func munmap(addr uintptr, length uintptr) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func readlen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := Syscall(SYS_READ, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
+func utimensat(dirfd int, path string, times *[2]Timespec, flags int) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
 	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func writelen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := Syscall(SYS_WRITE, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
-	n = int(r0)
+	_, _, e1 := Syscall6(SYS_UTIMENSAT, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(times)), uintptr(flags), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
@@ -1846,13 +1839,9 @@ func writelen(fd int, buf *byte, nbuf int) (n int, err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func utimensat(dirfd int, path string, times *[2]Timespec, flags int) (err error) {
-	var _p0 *byte
-	_p0, err = BytePtrFromString(path)
-	if err != nil {
-		return
-	}
-	_, _, e1 := Syscall6(SYS_UTIMENSAT, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(times)), uintptr(flags), 0, 0)
+func mremapNetBSD(oldp uintptr, oldsize uintptr, newp uintptr, newsize uintptr, flags int) (xaddr uintptr, err error) {
+	r0, _, e1 := Syscall6(SYS_MREMAP, uintptr(oldp), uintptr(oldsize), uintptr(newp), uintptr(newsize), uintptr(flags), 0)
+	xaddr = uintptr(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_netbsd_amd64.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_netbsd_amd64.go
index 9d25f76b0bf..a60556babbf 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_netbsd_amd64.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_netbsd_amd64.go
@@ -1824,20 +1824,13 @@ func munmap(addr uintptr, length uintptr) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func readlen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := Syscall(SYS_READ, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
+func utimensat(dirfd int, path string, times *[2]Timespec, flags int) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
 	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func writelen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := Syscall(SYS_WRITE, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
-	n = int(r0)
+	_, _, e1 := Syscall6(SYS_UTIMENSAT, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(times)), uintptr(flags), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
@@ -1846,13 +1839,9 @@ func writelen(fd int, buf *byte, nbuf int) (n int, err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func utimensat(dirfd int, path string, times *[2]Timespec, flags int) (err error) {
-	var _p0 *byte
-	_p0, err = BytePtrFromString(path)
-	if err != nil {
-		return
-	}
-	_, _, e1 := Syscall6(SYS_UTIMENSAT, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(times)), uintptr(flags), 0, 0)
+func mremapNetBSD(oldp uintptr, oldsize uintptr, newp uintptr, newsize uintptr, flags int) (xaddr uintptr, err error) {
+	r0, _, e1 := Syscall6(SYS_MREMAP, uintptr(oldp), uintptr(oldsize), uintptr(newp), uintptr(newsize), uintptr(flags), 0)
+	xaddr = uintptr(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_netbsd_arm.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_netbsd_arm.go
index d3f8035169f..9f788917a44 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_netbsd_arm.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_netbsd_arm.go
@@ -1824,20 +1824,13 @@ func munmap(addr uintptr, length uintptr) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func readlen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := Syscall(SYS_READ, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
+func utimensat(dirfd int, path string, times *[2]Timespec, flags int) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
 	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func writelen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := Syscall(SYS_WRITE, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
-	n = int(r0)
+	_, _, e1 := Syscall6(SYS_UTIMENSAT, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(times)), uintptr(flags), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
@@ -1846,13 +1839,9 @@ func writelen(fd int, buf *byte, nbuf int) (n int, err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func utimensat(dirfd int, path string, times *[2]Timespec, flags int) (err error) {
-	var _p0 *byte
-	_p0, err = BytePtrFromString(path)
-	if err != nil {
-		return
-	}
-	_, _, e1 := Syscall6(SYS_UTIMENSAT, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(times)), uintptr(flags), 0, 0)
+func mremapNetBSD(oldp uintptr, oldsize uintptr, newp uintptr, newsize uintptr, flags int) (xaddr uintptr, err error) {
+	r0, _, e1 := Syscall6(SYS_MREMAP, uintptr(oldp), uintptr(oldsize), uintptr(newp), uintptr(newsize), uintptr(flags), 0)
+	xaddr = uintptr(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_netbsd_arm64.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_netbsd_arm64.go
index 887188a529e..82a4cb2dc43 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_netbsd_arm64.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_netbsd_arm64.go
@@ -1824,20 +1824,13 @@ func munmap(addr uintptr, length uintptr) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func readlen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := Syscall(SYS_READ, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
+func utimensat(dirfd int, path string, times *[2]Timespec, flags int) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
 	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func writelen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := Syscall(SYS_WRITE, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
-	n = int(r0)
+	_, _, e1 := Syscall6(SYS_UTIMENSAT, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(times)), uintptr(flags), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
@@ -1846,13 +1839,9 @@ func writelen(fd int, buf *byte, nbuf int) (n int, err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func utimensat(dirfd int, path string, times *[2]Timespec, flags int) (err error) {
-	var _p0 *byte
-	_p0, err = BytePtrFromString(path)
-	if err != nil {
-		return
-	}
-	_, _, e1 := Syscall6(SYS_UTIMENSAT, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(times)), uintptr(flags), 0, 0)
+func mremapNetBSD(oldp uintptr, oldsize uintptr, newp uintptr, newsize uintptr, flags int) (xaddr uintptr, err error) {
+	r0, _, e1 := Syscall6(SYS_MREMAP, uintptr(oldp), uintptr(oldsize), uintptr(newp), uintptr(newsize), uintptr(flags), 0)
+	xaddr = uintptr(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_openbsd_386.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_openbsd_386.go
index 6699a783e1f..66b3b645633 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_openbsd_386.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_openbsd_386.go
@@ -519,6 +519,28 @@ var libc_getcwd_trampoline_addr uintptr
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func getresuid(ruid *_C_int, euid *_C_int, suid *_C_int) {
+	syscall_rawSyscall(libc_getresuid_trampoline_addr, uintptr(unsafe.Pointer(ruid)), uintptr(unsafe.Pointer(euid)), uintptr(unsafe.Pointer(suid)))
+	return
+}
+
+var libc_getresuid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getresuid getresuid "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func getresgid(rgid *_C_int, egid *_C_int, sgid *_C_int) {
+	syscall_rawSyscall(libc_getresgid_trampoline_addr, uintptr(unsafe.Pointer(rgid)), uintptr(unsafe.Pointer(egid)), uintptr(unsafe.Pointer(sgid)))
+	return
+}
+
+var libc_getresgid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getresgid getresgid "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func ioctl(fd int, req uint, arg uintptr) (err error) {
 	_, _, e1 := syscall_syscall(libc_ioctl_trampoline_addr, uintptr(fd), uintptr(req), uintptr(arg))
 	if e1 != 0 {
@@ -527,6 +549,12 @@ func ioctl(fd int, req uint, arg uintptr) (err error) {
 	return
 }
 
+var libc_ioctl_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_ioctl ioctl "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func ioctlPtr(fd int, req uint, arg unsafe.Pointer) (err error) {
 	_, _, e1 := syscall_syscall(libc_ioctl_trampoline_addr, uintptr(fd), uintptr(req), uintptr(arg))
 	if e1 != 0 {
@@ -535,10 +563,6 @@ func ioctlPtr(fd int, req uint, arg unsafe.Pointer) (err error) {
 	return
 }
 
-var libc_ioctl_trampoline_addr uintptr
-
-//go:cgo_import_dynamic libc_ioctl ioctl "libc.so"
-
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func sysctl(mib []_C_int, old *byte, oldlen *uintptr, new *byte, newlen uintptr) (err error) {
@@ -2189,28 +2213,6 @@ var libc_munmap_trampoline_addr uintptr
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func readlen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := syscall_syscall(libc_read_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func writelen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := syscall_syscall(libc_write_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func utimensat(dirfd int, path string, times *[2]Timespec, flags int) (err error) {
 	var _p0 *byte
 	_p0, err = BytePtrFromString(path)
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_openbsd_386.s b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_openbsd_386.s
index 04f0de34b2e..3dcacd30d7e 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_openbsd_386.s
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_openbsd_386.s
@@ -158,6 +158,16 @@ TEXT libc_getcwd_trampoline<>(SB),NOSPLIT,$0-0
 GLOBL	·libc_getcwd_trampoline_addr(SB), RODATA, $4
 DATA	·libc_getcwd_trampoline_addr(SB)/4, $libc_getcwd_trampoline<>(SB)
 
+TEXT libc_getresuid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getresuid(SB)
+GLOBL	·libc_getresuid_trampoline_addr(SB), RODATA, $4
+DATA	·libc_getresuid_trampoline_addr(SB)/4, $libc_getresuid_trampoline<>(SB)
+
+TEXT libc_getresgid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getresgid(SB)
+GLOBL	·libc_getresgid_trampoline_addr(SB), RODATA, $4
+DATA	·libc_getresgid_trampoline_addr(SB)/4, $libc_getresgid_trampoline<>(SB)
+
 TEXT libc_ioctl_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_ioctl(SB)
 GLOBL	·libc_ioctl_trampoline_addr(SB), RODATA, $4
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_openbsd_amd64.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_openbsd_amd64.go
index 1e775fe0571..c5c4cc112ed 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_openbsd_amd64.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_openbsd_amd64.go
@@ -519,6 +519,28 @@ var libc_getcwd_trampoline_addr uintptr
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func getresuid(ruid *_C_int, euid *_C_int, suid *_C_int) {
+	syscall_rawSyscall(libc_getresuid_trampoline_addr, uintptr(unsafe.Pointer(ruid)), uintptr(unsafe.Pointer(euid)), uintptr(unsafe.Pointer(suid)))
+	return
+}
+
+var libc_getresuid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getresuid getresuid "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func getresgid(rgid *_C_int, egid *_C_int, sgid *_C_int) {
+	syscall_rawSyscall(libc_getresgid_trampoline_addr, uintptr(unsafe.Pointer(rgid)), uintptr(unsafe.Pointer(egid)), uintptr(unsafe.Pointer(sgid)))
+	return
+}
+
+var libc_getresgid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getresgid getresgid "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func ioctl(fd int, req uint, arg uintptr) (err error) {
 	_, _, e1 := syscall_syscall(libc_ioctl_trampoline_addr, uintptr(fd), uintptr(req), uintptr(arg))
 	if e1 != 0 {
@@ -527,6 +549,12 @@ func ioctl(fd int, req uint, arg uintptr) (err error) {
 	return
 }
 
+var libc_ioctl_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_ioctl ioctl "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func ioctlPtr(fd int, req uint, arg unsafe.Pointer) (err error) {
 	_, _, e1 := syscall_syscall(libc_ioctl_trampoline_addr, uintptr(fd), uintptr(req), uintptr(arg))
 	if e1 != 0 {
@@ -535,10 +563,6 @@ func ioctlPtr(fd int, req uint, arg unsafe.Pointer) (err error) {
 	return
 }
 
-var libc_ioctl_trampoline_addr uintptr
-
-//go:cgo_import_dynamic libc_ioctl ioctl "libc.so"
-
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func sysctl(mib []_C_int, old *byte, oldlen *uintptr, new *byte, newlen uintptr) (err error) {
@@ -2189,28 +2213,6 @@ var libc_munmap_trampoline_addr uintptr
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func readlen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := syscall_syscall(libc_read_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func writelen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := syscall_syscall(libc_write_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func utimensat(dirfd int, path string, times *[2]Timespec, flags int) (err error) {
 	var _p0 *byte
 	_p0, err = BytePtrFromString(path)
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_openbsd_amd64.s b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_openbsd_amd64.s
index 27b6f4df74f..2763620b01a 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_openbsd_amd64.s
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_openbsd_amd64.s
@@ -158,6 +158,16 @@ TEXT libc_getcwd_trampoline<>(SB),NOSPLIT,$0-0
 GLOBL	·libc_getcwd_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getcwd_trampoline_addr(SB)/8, $libc_getcwd_trampoline<>(SB)
 
+TEXT libc_getresuid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getresuid(SB)
+GLOBL	·libc_getresuid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getresuid_trampoline_addr(SB)/8, $libc_getresuid_trampoline<>(SB)
+
+TEXT libc_getresgid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getresgid(SB)
+GLOBL	·libc_getresgid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getresgid_trampoline_addr(SB)/8, $libc_getresgid_trampoline<>(SB)
+
 TEXT libc_ioctl_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_ioctl(SB)
 GLOBL	·libc_ioctl_trampoline_addr(SB), RODATA, $8
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_openbsd_arm.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_openbsd_arm.go
index 7f6427899a5..93bfbb32874 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_openbsd_arm.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_openbsd_arm.go
@@ -519,6 +519,28 @@ var libc_getcwd_trampoline_addr uintptr
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func getresuid(ruid *_C_int, euid *_C_int, suid *_C_int) {
+	syscall_rawSyscall(libc_getresuid_trampoline_addr, uintptr(unsafe.Pointer(ruid)), uintptr(unsafe.Pointer(euid)), uintptr(unsafe.Pointer(suid)))
+	return
+}
+
+var libc_getresuid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getresuid getresuid "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func getresgid(rgid *_C_int, egid *_C_int, sgid *_C_int) {
+	syscall_rawSyscall(libc_getresgid_trampoline_addr, uintptr(unsafe.Pointer(rgid)), uintptr(unsafe.Pointer(egid)), uintptr(unsafe.Pointer(sgid)))
+	return
+}
+
+var libc_getresgid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getresgid getresgid "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func ioctl(fd int, req uint, arg uintptr) (err error) {
 	_, _, e1 := syscall_syscall(libc_ioctl_trampoline_addr, uintptr(fd), uintptr(req), uintptr(arg))
 	if e1 != 0 {
@@ -527,6 +549,12 @@ func ioctl(fd int, req uint, arg uintptr) (err error) {
 	return
 }
 
+var libc_ioctl_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_ioctl ioctl "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func ioctlPtr(fd int, req uint, arg unsafe.Pointer) (err error) {
 	_, _, e1 := syscall_syscall(libc_ioctl_trampoline_addr, uintptr(fd), uintptr(req), uintptr(arg))
 	if e1 != 0 {
@@ -535,10 +563,6 @@ func ioctlPtr(fd int, req uint, arg unsafe.Pointer) (err error) {
 	return
 }
 
-var libc_ioctl_trampoline_addr uintptr
-
-//go:cgo_import_dynamic libc_ioctl ioctl "libc.so"
-
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func sysctl(mib []_C_int, old *byte, oldlen *uintptr, new *byte, newlen uintptr) (err error) {
@@ -2189,28 +2213,6 @@ var libc_munmap_trampoline_addr uintptr
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func readlen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := syscall_syscall(libc_read_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func writelen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := syscall_syscall(libc_write_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func utimensat(dirfd int, path string, times *[2]Timespec, flags int) (err error) {
 	var _p0 *byte
 	_p0, err = BytePtrFromString(path)
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_openbsd_arm.s b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_openbsd_arm.s
index b797045fd2d..c922314048f 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_openbsd_arm.s
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_openbsd_arm.s
@@ -158,6 +158,16 @@ TEXT libc_getcwd_trampoline<>(SB),NOSPLIT,$0-0
 GLOBL	·libc_getcwd_trampoline_addr(SB), RODATA, $4
 DATA	·libc_getcwd_trampoline_addr(SB)/4, $libc_getcwd_trampoline<>(SB)
 
+TEXT libc_getresuid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getresuid(SB)
+GLOBL	·libc_getresuid_trampoline_addr(SB), RODATA, $4
+DATA	·libc_getresuid_trampoline_addr(SB)/4, $libc_getresuid_trampoline<>(SB)
+
+TEXT libc_getresgid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getresgid(SB)
+GLOBL	·libc_getresgid_trampoline_addr(SB), RODATA, $4
+DATA	·libc_getresgid_trampoline_addr(SB)/4, $libc_getresgid_trampoline<>(SB)
+
 TEXT libc_ioctl_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_ioctl(SB)
 GLOBL	·libc_ioctl_trampoline_addr(SB), RODATA, $4
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_openbsd_arm64.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_openbsd_arm64.go
index 756ef7b1736..a107b8fda5f 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_openbsd_arm64.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_openbsd_arm64.go
@@ -519,6 +519,28 @@ var libc_getcwd_trampoline_addr uintptr
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func getresuid(ruid *_C_int, euid *_C_int, suid *_C_int) {
+	syscall_rawSyscall(libc_getresuid_trampoline_addr, uintptr(unsafe.Pointer(ruid)), uintptr(unsafe.Pointer(euid)), uintptr(unsafe.Pointer(suid)))
+	return
+}
+
+var libc_getresuid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getresuid getresuid "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func getresgid(rgid *_C_int, egid *_C_int, sgid *_C_int) {
+	syscall_rawSyscall(libc_getresgid_trampoline_addr, uintptr(unsafe.Pointer(rgid)), uintptr(unsafe.Pointer(egid)), uintptr(unsafe.Pointer(sgid)))
+	return
+}
+
+var libc_getresgid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getresgid getresgid "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func ioctl(fd int, req uint, arg uintptr) (err error) {
 	_, _, e1 := syscall_syscall(libc_ioctl_trampoline_addr, uintptr(fd), uintptr(req), uintptr(arg))
 	if e1 != 0 {
@@ -527,6 +549,12 @@ func ioctl(fd int, req uint, arg uintptr) (err error) {
 	return
 }
 
+var libc_ioctl_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_ioctl ioctl "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func ioctlPtr(fd int, req uint, arg unsafe.Pointer) (err error) {
 	_, _, e1 := syscall_syscall(libc_ioctl_trampoline_addr, uintptr(fd), uintptr(req), uintptr(arg))
 	if e1 != 0 {
@@ -535,10 +563,6 @@ func ioctlPtr(fd int, req uint, arg unsafe.Pointer) (err error) {
 	return
 }
 
-var libc_ioctl_trampoline_addr uintptr
-
-//go:cgo_import_dynamic libc_ioctl ioctl "libc.so"
-
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func sysctl(mib []_C_int, old *byte, oldlen *uintptr, new *byte, newlen uintptr) (err error) {
@@ -2189,28 +2213,6 @@ var libc_munmap_trampoline_addr uintptr
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func readlen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := syscall_syscall(libc_read_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func writelen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := syscall_syscall(libc_write_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func utimensat(dirfd int, path string, times *[2]Timespec, flags int) (err error) {
 	var _p0 *byte
 	_p0, err = BytePtrFromString(path)
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_openbsd_arm64.s b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_openbsd_arm64.s
index a871266221e..a6bc32c9220 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_openbsd_arm64.s
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_openbsd_arm64.s
@@ -158,6 +158,16 @@ TEXT libc_getcwd_trampoline<>(SB),NOSPLIT,$0-0
 GLOBL	·libc_getcwd_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getcwd_trampoline_addr(SB)/8, $libc_getcwd_trampoline<>(SB)
 
+TEXT libc_getresuid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getresuid(SB)
+GLOBL	·libc_getresuid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getresuid_trampoline_addr(SB)/8, $libc_getresuid_trampoline<>(SB)
+
+TEXT libc_getresgid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getresgid(SB)
+GLOBL	·libc_getresgid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getresgid_trampoline_addr(SB)/8, $libc_getresgid_trampoline<>(SB)
+
 TEXT libc_ioctl_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_ioctl(SB)
 GLOBL	·libc_ioctl_trampoline_addr(SB), RODATA, $8
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_openbsd_mips64.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_openbsd_mips64.go
index 7bc2e24eb95..c427de509e3 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_openbsd_mips64.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_openbsd_mips64.go
@@ -519,6 +519,28 @@ var libc_getcwd_trampoline_addr uintptr
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func getresuid(ruid *_C_int, euid *_C_int, suid *_C_int) {
+	syscall_rawSyscall(libc_getresuid_trampoline_addr, uintptr(unsafe.Pointer(ruid)), uintptr(unsafe.Pointer(euid)), uintptr(unsafe.Pointer(suid)))
+	return
+}
+
+var libc_getresuid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getresuid getresuid "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func getresgid(rgid *_C_int, egid *_C_int, sgid *_C_int) {
+	syscall_rawSyscall(libc_getresgid_trampoline_addr, uintptr(unsafe.Pointer(rgid)), uintptr(unsafe.Pointer(egid)), uintptr(unsafe.Pointer(sgid)))
+	return
+}
+
+var libc_getresgid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getresgid getresgid "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func ioctl(fd int, req uint, arg uintptr) (err error) {
 	_, _, e1 := syscall_syscall(libc_ioctl_trampoline_addr, uintptr(fd), uintptr(req), uintptr(arg))
 	if e1 != 0 {
@@ -527,6 +549,12 @@ func ioctl(fd int, req uint, arg uintptr) (err error) {
 	return
 }
 
+var libc_ioctl_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_ioctl ioctl "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func ioctlPtr(fd int, req uint, arg unsafe.Pointer) (err error) {
 	_, _, e1 := syscall_syscall(libc_ioctl_trampoline_addr, uintptr(fd), uintptr(req), uintptr(arg))
 	if e1 != 0 {
@@ -535,10 +563,6 @@ func ioctlPtr(fd int, req uint, arg unsafe.Pointer) (err error) {
 	return
 }
 
-var libc_ioctl_trampoline_addr uintptr
-
-//go:cgo_import_dynamic libc_ioctl ioctl "libc.so"
-
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func sysctl(mib []_C_int, old *byte, oldlen *uintptr, new *byte, newlen uintptr) (err error) {
@@ -2189,28 +2213,6 @@ var libc_munmap_trampoline_addr uintptr
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func readlen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := syscall_syscall(libc_read_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func writelen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := syscall_syscall(libc_write_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func utimensat(dirfd int, path string, times *[2]Timespec, flags int) (err error) {
 	var _p0 *byte
 	_p0, err = BytePtrFromString(path)
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_openbsd_mips64.s b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_openbsd_mips64.s
index 05d4bffd791..b4e7bceabf3 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_openbsd_mips64.s
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_openbsd_mips64.s
@@ -158,6 +158,16 @@ TEXT libc_getcwd_trampoline<>(SB),NOSPLIT,$0-0
 GLOBL	·libc_getcwd_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getcwd_trampoline_addr(SB)/8, $libc_getcwd_trampoline<>(SB)
 
+TEXT libc_getresuid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getresuid(SB)
+GLOBL	·libc_getresuid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getresuid_trampoline_addr(SB)/8, $libc_getresuid_trampoline<>(SB)
+
+TEXT libc_getresgid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getresgid(SB)
+GLOBL	·libc_getresgid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getresgid_trampoline_addr(SB)/8, $libc_getresgid_trampoline<>(SB)
+
 TEXT libc_ioctl_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_ioctl(SB)
 GLOBL	·libc_ioctl_trampoline_addr(SB), RODATA, $8
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_openbsd_ppc64.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_openbsd_ppc64.go
index 739be6217a3..60c1a99ae49 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_openbsd_ppc64.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_openbsd_ppc64.go
@@ -519,6 +519,28 @@ var libc_getcwd_trampoline_addr uintptr
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func getresuid(ruid *_C_int, euid *_C_int, suid *_C_int) {
+	syscall_rawSyscall(libc_getresuid_trampoline_addr, uintptr(unsafe.Pointer(ruid)), uintptr(unsafe.Pointer(euid)), uintptr(unsafe.Pointer(suid)))
+	return
+}
+
+var libc_getresuid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getresuid getresuid "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func getresgid(rgid *_C_int, egid *_C_int, sgid *_C_int) {
+	syscall_rawSyscall(libc_getresgid_trampoline_addr, uintptr(unsafe.Pointer(rgid)), uintptr(unsafe.Pointer(egid)), uintptr(unsafe.Pointer(sgid)))
+	return
+}
+
+var libc_getresgid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getresgid getresgid "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func ioctl(fd int, req uint, arg uintptr) (err error) {
 	_, _, e1 := syscall_syscall(libc_ioctl_trampoline_addr, uintptr(fd), uintptr(req), uintptr(arg))
 	if e1 != 0 {
@@ -527,6 +549,12 @@ func ioctl(fd int, req uint, arg uintptr) (err error) {
 	return
 }
 
+var libc_ioctl_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_ioctl ioctl "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func ioctlPtr(fd int, req uint, arg unsafe.Pointer) (err error) {
 	_, _, e1 := syscall_syscall(libc_ioctl_trampoline_addr, uintptr(fd), uintptr(req), uintptr(arg))
 	if e1 != 0 {
@@ -535,10 +563,6 @@ func ioctlPtr(fd int, req uint, arg unsafe.Pointer) (err error) {
 	return
 }
 
-var libc_ioctl_trampoline_addr uintptr
-
-//go:cgo_import_dynamic libc_ioctl ioctl "libc.so"
-
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func sysctl(mib []_C_int, old *byte, oldlen *uintptr, new *byte, newlen uintptr) (err error) {
@@ -2189,28 +2213,6 @@ var libc_munmap_trampoline_addr uintptr
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func readlen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := syscall_syscall(libc_read_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func writelen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := syscall_syscall(libc_write_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func utimensat(dirfd int, path string, times *[2]Timespec, flags int) (err error) {
 	var _p0 *byte
 	_p0, err = BytePtrFromString(path)
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_openbsd_ppc64.s b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_openbsd_ppc64.s
index 74a25f8d643..ca3f766009c 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_openbsd_ppc64.s
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_openbsd_ppc64.s
@@ -189,6 +189,18 @@ TEXT libc_getcwd_trampoline<>(SB),NOSPLIT,$0-0
 GLOBL	·libc_getcwd_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getcwd_trampoline_addr(SB)/8, $libc_getcwd_trampoline<>(SB)
 
+TEXT libc_getresuid_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_getresuid(SB)
+	RET
+GLOBL	·libc_getresuid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getresuid_trampoline_addr(SB)/8, $libc_getresuid_trampoline<>(SB)
+
+TEXT libc_getresgid_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_getresgid(SB)
+	RET
+GLOBL	·libc_getresgid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getresgid_trampoline_addr(SB)/8, $libc_getresgid_trampoline<>(SB)
+
 TEXT libc_ioctl_trampoline<>(SB),NOSPLIT,$0-0
 	CALL	libc_ioctl(SB)
 	RET
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_openbsd_riscv64.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_openbsd_riscv64.go
index 7d95a197803..52eba360f81 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_openbsd_riscv64.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_openbsd_riscv64.go
@@ -519,6 +519,28 @@ var libc_getcwd_trampoline_addr uintptr
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func getresuid(ruid *_C_int, euid *_C_int, suid *_C_int) {
+	syscall_rawSyscall(libc_getresuid_trampoline_addr, uintptr(unsafe.Pointer(ruid)), uintptr(unsafe.Pointer(euid)), uintptr(unsafe.Pointer(suid)))
+	return
+}
+
+var libc_getresuid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getresuid getresuid "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func getresgid(rgid *_C_int, egid *_C_int, sgid *_C_int) {
+	syscall_rawSyscall(libc_getresgid_trampoline_addr, uintptr(unsafe.Pointer(rgid)), uintptr(unsafe.Pointer(egid)), uintptr(unsafe.Pointer(sgid)))
+	return
+}
+
+var libc_getresgid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getresgid getresgid "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func ioctl(fd int, req uint, arg uintptr) (err error) {
 	_, _, e1 := syscall_syscall(libc_ioctl_trampoline_addr, uintptr(fd), uintptr(req), uintptr(arg))
 	if e1 != 0 {
@@ -527,6 +549,12 @@ func ioctl(fd int, req uint, arg uintptr) (err error) {
 	return
 }
 
+var libc_ioctl_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_ioctl ioctl "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func ioctlPtr(fd int, req uint, arg unsafe.Pointer) (err error) {
 	_, _, e1 := syscall_syscall(libc_ioctl_trampoline_addr, uintptr(fd), uintptr(req), uintptr(arg))
 	if e1 != 0 {
@@ -535,10 +563,6 @@ func ioctlPtr(fd int, req uint, arg unsafe.Pointer) (err error) {
 	return
 }
 
-var libc_ioctl_trampoline_addr uintptr
-
-//go:cgo_import_dynamic libc_ioctl ioctl "libc.so"
-
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func sysctl(mib []_C_int, old *byte, oldlen *uintptr, new *byte, newlen uintptr) (err error) {
@@ -2189,28 +2213,6 @@ var libc_munmap_trampoline_addr uintptr
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func readlen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := syscall_syscall(libc_read_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func writelen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := syscall_syscall(libc_write_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func utimensat(dirfd int, path string, times *[2]Timespec, flags int) (err error) {
 	var _p0 *byte
 	_p0, err = BytePtrFromString(path)
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_openbsd_riscv64.s b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_openbsd_riscv64.s
index 990be245740..477a7d5b21e 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_openbsd_riscv64.s
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_openbsd_riscv64.s
@@ -158,6 +158,16 @@ TEXT libc_getcwd_trampoline<>(SB),NOSPLIT,$0-0
 GLOBL	·libc_getcwd_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getcwd_trampoline_addr(SB)/8, $libc_getcwd_trampoline<>(SB)
 
+TEXT libc_getresuid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getresuid(SB)
+GLOBL	·libc_getresuid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getresuid_trampoline_addr(SB)/8, $libc_getresuid_trampoline<>(SB)
+
+TEXT libc_getresgid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getresgid(SB)
+GLOBL	·libc_getresgid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getresgid_trampoline_addr(SB)/8, $libc_getresgid_trampoline<>(SB)
+
 TEXT libc_ioctl_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_ioctl(SB)
 GLOBL	·libc_ioctl_trampoline_addr(SB), RODATA, $8
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_solaris_amd64.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_solaris_amd64.go
index 609d1c598a8..b401894644f 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_solaris_amd64.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_solaris_amd64.go
@@ -436,7 +436,7 @@ func pipe(p *[2]_C_int) (n int, err error) {
 	r0, _, e1 := rawSysvicall6(uintptr(unsafe.Pointer(&procpipe)), 1, uintptr(unsafe.Pointer(p)), 0, 0, 0, 0, 0)
 	n = int(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -446,7 +446,7 @@ func pipe(p *[2]_C_int) (n int, err error) {
 func pipe2(p *[2]_C_int, flags int) (err error) {
 	_, _, e1 := rawSysvicall6(uintptr(unsafe.Pointer(&procpipe2)), 2, uintptr(unsafe.Pointer(p)), uintptr(flags), 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -456,7 +456,7 @@ func pipe2(p *[2]_C_int, flags int) (err error) {
 func getsockname(fd int, rsa *RawSockaddrAny, addrlen *_Socklen) (err error) {
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procgetsockname)), 3, uintptr(fd), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)), 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -471,7 +471,7 @@ func Getcwd(buf []byte) (n int, err error) {
 	r0, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procGetcwd)), 2, uintptr(unsafe.Pointer(_p0)), uintptr(len(buf)), 0, 0, 0, 0)
 	n = int(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -482,7 +482,7 @@ func getgroups(ngid int, gid *_Gid_t) (n int, err error) {
 	r0, _, e1 := rawSysvicall6(uintptr(unsafe.Pointer(&procgetgroups)), 2, uintptr(ngid), uintptr(unsafe.Pointer(gid)), 0, 0, 0, 0)
 	n = int(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -492,7 +492,7 @@ func getgroups(ngid int, gid *_Gid_t) (n int, err error) {
 func setgroups(ngid int, gid *_Gid_t) (err error) {
 	_, _, e1 := rawSysvicall6(uintptr(unsafe.Pointer(&procsetgroups)), 2, uintptr(ngid), uintptr(unsafe.Pointer(gid)), 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -503,7 +503,7 @@ func wait4(pid int32, statusp *_C_int, options int, rusage *Rusage) (wpid int32,
 	r0, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procwait4)), 4, uintptr(pid), uintptr(unsafe.Pointer(statusp)), uintptr(options), uintptr(unsafe.Pointer(rusage)), 0, 0)
 	wpid = int32(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -518,7 +518,7 @@ func gethostname(buf []byte) (n int, err error) {
 	r0, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procgethostname)), 2, uintptr(unsafe.Pointer(_p0)), uintptr(len(buf)), 0, 0, 0, 0)
 	n = int(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -533,7 +533,7 @@ func utimes(path string, times *[2]Timeval) (err error) {
 	}
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procutimes)), 2, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(times)), 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -548,7 +548,7 @@ func utimensat(fd int, path string, times *[2]Timespec, flag int) (err error) {
 	}
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procutimensat)), 4, uintptr(fd), uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(times)), uintptr(flag), 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -559,7 +559,7 @@ func fcntl(fd int, cmd int, arg int) (val int, err error) {
 	r0, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procfcntl)), 3, uintptr(fd), uintptr(cmd), uintptr(arg), 0, 0, 0)
 	val = int(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -569,7 +569,7 @@ func fcntl(fd int, cmd int, arg int) (val int, err error) {
 func futimesat(fildes int, path *byte, times *[2]Timeval) (err error) {
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procfutimesat)), 3, uintptr(fildes), uintptr(unsafe.Pointer(path)), uintptr(unsafe.Pointer(times)), 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -580,7 +580,7 @@ func accept(s int, rsa *RawSockaddrAny, addrlen *_Socklen) (fd int, err error) {
 	r0, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procaccept)), 3, uintptr(s), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)), 0, 0, 0)
 	fd = int(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -591,7 +591,7 @@ func recvmsg(s int, msg *Msghdr, flags int) (n int, err error) {
 	r0, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&proc__xnet_recvmsg)), 3, uintptr(s), uintptr(unsafe.Pointer(msg)), uintptr(flags), 0, 0, 0)
 	n = int(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -602,7 +602,7 @@ func sendmsg(s int, msg *Msghdr, flags int) (n int, err error) {
 	r0, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&proc__xnet_sendmsg)), 3, uintptr(s), uintptr(unsafe.Pointer(msg)), uintptr(flags), 0, 0, 0)
 	n = int(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -612,7 +612,7 @@ func sendmsg(s int, msg *Msghdr, flags int) (n int, err error) {
 func acct(path *byte) (err error) {
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procacct)), 1, uintptr(unsafe.Pointer(path)), 0, 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -647,7 +647,7 @@ func ioctlRet(fd int, req int, arg uintptr) (ret int, err error) {
 	r0, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procioctl)), 3, uintptr(fd), uintptr(req), uintptr(arg), 0, 0, 0)
 	ret = int(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -658,7 +658,7 @@ func ioctlPtrRet(fd int, req int, arg unsafe.Pointer) (ret int, err error) {
 	r0, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procioctl)), 3, uintptr(fd), uintptr(req), uintptr(arg), 0, 0, 0)
 	ret = int(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -669,7 +669,7 @@ func poll(fds *PollFd, nfds int, timeout int) (n int, err error) {
 	r0, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procpoll)), 3, uintptr(unsafe.Pointer(fds)), uintptr(nfds), uintptr(timeout), 0, 0, 0)
 	n = int(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -684,7 +684,7 @@ func Access(path string, mode uint32) (err error) {
 	}
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procAccess)), 2, uintptr(unsafe.Pointer(_p0)), uintptr(mode), 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -694,7 +694,7 @@ func Access(path string, mode uint32) (err error) {
 func Adjtime(delta *Timeval, olddelta *Timeval) (err error) {
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procAdjtime)), 2, uintptr(unsafe.Pointer(delta)), uintptr(unsafe.Pointer(olddelta)), 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -709,7 +709,7 @@ func Chdir(path string) (err error) {
 	}
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procChdir)), 1, uintptr(unsafe.Pointer(_p0)), 0, 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -724,7 +724,7 @@ func Chmod(path string, mode uint32) (err error) {
 	}
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procChmod)), 2, uintptr(unsafe.Pointer(_p0)), uintptr(mode), 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -739,7 +739,7 @@ func Chown(path string, uid int, gid int) (err error) {
 	}
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procChown)), 3, uintptr(unsafe.Pointer(_p0)), uintptr(uid), uintptr(gid), 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -754,7 +754,7 @@ func Chroot(path string) (err error) {
 	}
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procChroot)), 1, uintptr(unsafe.Pointer(_p0)), 0, 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -764,7 +764,7 @@ func Chroot(path string) (err error) {
 func ClockGettime(clockid int32, time *Timespec) (err error) {
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procClockGettime)), 2, uintptr(clockid), uintptr(unsafe.Pointer(time)), 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -774,7 +774,7 @@ func ClockGettime(clockid int32, time *Timespec) (err error) {
 func Close(fd int) (err error) {
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procClose)), 1, uintptr(fd), 0, 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -790,7 +790,7 @@ func Creat(path string, mode uint32) (fd int, err error) {
 	r0, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procCreat)), 2, uintptr(unsafe.Pointer(_p0)), uintptr(mode), 0, 0, 0, 0)
 	fd = int(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -801,7 +801,7 @@ func Dup(fd int) (nfd int, err error) {
 	r0, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procDup)), 1, uintptr(fd), 0, 0, 0, 0, 0)
 	nfd = int(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -811,7 +811,7 @@ func Dup(fd int) (nfd int, err error) {
 func Dup2(oldfd int, newfd int) (err error) {
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procDup2)), 2, uintptr(oldfd), uintptr(newfd), 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -833,7 +833,7 @@ func Faccessat(dirfd int, path string, mode uint32, flags int) (err error) {
 	}
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procFaccessat)), 4, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(flags), 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -843,7 +843,7 @@ func Faccessat(dirfd int, path string, mode uint32, flags int) (err error) {
 func Fchdir(fd int) (err error) {
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procFchdir)), 1, uintptr(fd), 0, 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -853,7 +853,7 @@ func Fchdir(fd int) (err error) {
 func Fchmod(fd int, mode uint32) (err error) {
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procFchmod)), 2, uintptr(fd), uintptr(mode), 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -868,7 +868,7 @@ func Fchmodat(dirfd int, path string, mode uint32, flags int) (err error) {
 	}
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procFchmodat)), 4, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(flags), 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -878,7 +878,7 @@ func Fchmodat(dirfd int, path string, mode uint32, flags int) (err error) {
 func Fchown(fd int, uid int, gid int) (err error) {
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procFchown)), 3, uintptr(fd), uintptr(uid), uintptr(gid), 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -893,7 +893,7 @@ func Fchownat(dirfd int, path string, uid int, gid int, flags int) (err error) {
 	}
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procFchownat)), 5, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(uid), uintptr(gid), uintptr(flags), 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -903,7 +903,7 @@ func Fchownat(dirfd int, path string, uid int, gid int, flags int) (err error) {
 func Fdatasync(fd int) (err error) {
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procFdatasync)), 1, uintptr(fd), 0, 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -913,7 +913,7 @@ func Fdatasync(fd int) (err error) {
 func Flock(fd int, how int) (err error) {
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procFlock)), 2, uintptr(fd), uintptr(how), 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -924,7 +924,7 @@ func Fpathconf(fd int, name int) (val int, err error) {
 	r0, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procFpathconf)), 2, uintptr(fd), uintptr(name), 0, 0, 0, 0)
 	val = int(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -934,7 +934,7 @@ func Fpathconf(fd int, name int) (val int, err error) {
 func Fstat(fd int, stat *Stat_t) (err error) {
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procFstat)), 2, uintptr(fd), uintptr(unsafe.Pointer(stat)), 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -949,7 +949,7 @@ func Fstatat(fd int, path string, stat *Stat_t, flags int) (err error) {
 	}
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procFstatat)), 4, uintptr(fd), uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(stat)), uintptr(flags), 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -959,7 +959,7 @@ func Fstatat(fd int, path string, stat *Stat_t, flags int) (err error) {
 func Fstatvfs(fd int, vfsstat *Statvfs_t) (err error) {
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procFstatvfs)), 2, uintptr(fd), uintptr(unsafe.Pointer(vfsstat)), 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -974,7 +974,7 @@ func Getdents(fd int, buf []byte, basep *uintptr) (n int, err error) {
 	r0, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procGetdents)), 4, uintptr(fd), uintptr(unsafe.Pointer(_p0)), uintptr(len(buf)), uintptr(unsafe.Pointer(basep)), 0, 0)
 	n = int(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1001,7 +1001,7 @@ func Getpgid(pid int) (pgid int, err error) {
 	r0, _, e1 := rawSysvicall6(uintptr(unsafe.Pointer(&procGetpgid)), 1, uintptr(pid), 0, 0, 0, 0, 0)
 	pgid = int(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1012,7 +1012,7 @@ func Getpgrp() (pgid int, err error) {
 	r0, _, e1 := rawSysvicall6(uintptr(unsafe.Pointer(&procGetpgrp)), 0, 0, 0, 0, 0, 0, 0)
 	pgid = int(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1047,7 +1047,7 @@ func Getpriority(which int, who int) (n int, err error) {
 	r0, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procGetpriority)), 2, uintptr(which), uintptr(who), 0, 0, 0, 0)
 	n = int(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1057,7 +1057,7 @@ func Getpriority(which int, who int) (n int, err error) {
 func Getrlimit(which int, lim *Rlimit) (err error) {
 	_, _, e1 := rawSysvicall6(uintptr(unsafe.Pointer(&procGetrlimit)), 2, uintptr(which), uintptr(unsafe.Pointer(lim)), 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1067,7 +1067,7 @@ func Getrlimit(which int, lim *Rlimit) (err error) {
 func Getrusage(who int, rusage *Rusage) (err error) {
 	_, _, e1 := rawSysvicall6(uintptr(unsafe.Pointer(&procGetrusage)), 2, uintptr(who), uintptr(unsafe.Pointer(rusage)), 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1078,7 +1078,7 @@ func Getsid(pid int) (sid int, err error) {
 	r0, _, e1 := rawSysvicall6(uintptr(unsafe.Pointer(&procGetsid)), 1, uintptr(pid), 0, 0, 0, 0, 0)
 	sid = int(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1088,7 +1088,7 @@ func Getsid(pid int) (sid int, err error) {
 func Gettimeofday(tv *Timeval) (err error) {
 	_, _, e1 := rawSysvicall6(uintptr(unsafe.Pointer(&procGettimeofday)), 1, uintptr(unsafe.Pointer(tv)), 0, 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1106,7 +1106,7 @@ func Getuid() (uid int) {
 func Kill(pid int, signum syscall.Signal) (err error) {
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procKill)), 2, uintptr(pid), uintptr(signum), 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1121,7 +1121,7 @@ func Lchown(path string, uid int, gid int) (err error) {
 	}
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procLchown)), 3, uintptr(unsafe.Pointer(_p0)), uintptr(uid), uintptr(gid), 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1141,7 +1141,7 @@ func Link(path string, link string) (err error) {
 	}
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procLink)), 2, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1151,7 +1151,7 @@ func Link(path string, link string) (err error) {
 func Listen(s int, backlog int) (err error) {
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&proc__xnet_llisten)), 2, uintptr(s), uintptr(backlog), 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1166,7 +1166,7 @@ func Lstat(path string, stat *Stat_t) (err error) {
 	}
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procLstat)), 2, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(stat)), 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1180,7 +1180,7 @@ func Madvise(b []byte, advice int) (err error) {
 	}
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procMadvise)), 3, uintptr(unsafe.Pointer(_p0)), uintptr(len(b)), uintptr(advice), 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1195,7 +1195,7 @@ func Mkdir(path string, mode uint32) (err error) {
 	}
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procMkdir)), 2, uintptr(unsafe.Pointer(_p0)), uintptr(mode), 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1210,7 +1210,7 @@ func Mkdirat(dirfd int, path string, mode uint32) (err error) {
 	}
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procMkdirat)), 3, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode), 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1225,7 +1225,7 @@ func Mkfifo(path string, mode uint32) (err error) {
 	}
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procMkfifo)), 2, uintptr(unsafe.Pointer(_p0)), uintptr(mode), 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1240,7 +1240,7 @@ func Mkfifoat(dirfd int, path string, mode uint32) (err error) {
 	}
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procMkfifoat)), 3, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode), 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1255,7 +1255,7 @@ func Mknod(path string, mode uint32, dev int) (err error) {
 	}
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procMknod)), 3, uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(dev), 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1270,7 +1270,7 @@ func Mknodat(dirfd int, path string, mode uint32, dev int) (err error) {
 	}
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procMknodat)), 4, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(dev), 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1284,7 +1284,7 @@ func Mlock(b []byte) (err error) {
 	}
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procMlock)), 2, uintptr(unsafe.Pointer(_p0)), uintptr(len(b)), 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1294,7 +1294,7 @@ func Mlock(b []byte) (err error) {
 func Mlockall(flags int) (err error) {
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procMlockall)), 1, uintptr(flags), 0, 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1308,7 +1308,7 @@ func Mprotect(b []byte, prot int) (err error) {
 	}
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procMprotect)), 3, uintptr(unsafe.Pointer(_p0)), uintptr(len(b)), uintptr(prot), 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1322,7 +1322,7 @@ func Msync(b []byte, flags int) (err error) {
 	}
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procMsync)), 3, uintptr(unsafe.Pointer(_p0)), uintptr(len(b)), uintptr(flags), 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1336,7 +1336,7 @@ func Munlock(b []byte) (err error) {
 	}
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procMunlock)), 2, uintptr(unsafe.Pointer(_p0)), uintptr(len(b)), 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1346,7 +1346,7 @@ func Munlock(b []byte) (err error) {
 func Munlockall() (err error) {
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procMunlockall)), 0, 0, 0, 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1356,7 +1356,7 @@ func Munlockall() (err error) {
 func Nanosleep(time *Timespec, leftover *Timespec) (err error) {
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procNanosleep)), 2, uintptr(unsafe.Pointer(time)), uintptr(unsafe.Pointer(leftover)), 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1372,7 +1372,7 @@ func Open(path string, mode int, perm uint32) (fd int, err error) {
 	r0, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procOpen)), 3, uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(perm), 0, 0, 0)
 	fd = int(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1388,7 +1388,7 @@ func Openat(dirfd int, path string, flags int, mode uint32) (fd int, err error)
 	r0, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procOpenat)), 4, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(flags), uintptr(mode), 0, 0)
 	fd = int(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1404,7 +1404,7 @@ func Pathconf(path string, name int) (val int, err error) {
 	r0, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procPathconf)), 2, uintptr(unsafe.Pointer(_p0)), uintptr(name), 0, 0, 0, 0)
 	val = int(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1414,7 +1414,7 @@ func Pathconf(path string, name int) (val int, err error) {
 func Pause() (err error) {
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procPause)), 0, 0, 0, 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1429,7 +1429,7 @@ func pread(fd int, p []byte, offset int64) (n int, err error) {
 	r0, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procpread)), 4, uintptr(fd), uintptr(unsafe.Pointer(_p0)), uintptr(len(p)), uintptr(offset), 0, 0)
 	n = int(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1444,7 +1444,7 @@ func pwrite(fd int, p []byte, offset int64) (n int, err error) {
 	r0, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procpwrite)), 4, uintptr(fd), uintptr(unsafe.Pointer(_p0)), uintptr(len(p)), uintptr(offset), 0, 0)
 	n = int(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1459,7 +1459,7 @@ func read(fd int, p []byte) (n int, err error) {
 	r0, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procread)), 3, uintptr(fd), uintptr(unsafe.Pointer(_p0)), uintptr(len(p)), 0, 0, 0)
 	n = int(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1479,7 +1479,7 @@ func Readlink(path string, buf []byte) (n int, err error) {
 	r0, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procReadlink)), 3, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), uintptr(len(buf)), 0, 0, 0)
 	n = int(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1499,7 +1499,7 @@ func Rename(from string, to string) (err error) {
 	}
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procRename)), 2, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1519,7 +1519,7 @@ func Renameat(olddirfd int, oldpath string, newdirfd int, newpath string) (err e
 	}
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procRenameat)), 4, uintptr(olddirfd), uintptr(unsafe.Pointer(_p0)), uintptr(newdirfd), uintptr(unsafe.Pointer(_p1)), 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1534,7 +1534,7 @@ func Rmdir(path string) (err error) {
 	}
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procRmdir)), 1, uintptr(unsafe.Pointer(_p0)), 0, 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1545,7 +1545,7 @@ func Seek(fd int, offset int64, whence int) (newoffset int64, err error) {
 	r0, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&proclseek)), 3, uintptr(fd), uintptr(offset), uintptr(whence), 0, 0, 0)
 	newoffset = int64(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1556,7 +1556,7 @@ func Select(nfd int, r *FdSet, w *FdSet, e *FdSet, timeout *Timeval) (n int, err
 	r0, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procSelect)), 5, uintptr(nfd), uintptr(unsafe.Pointer(r)), uintptr(unsafe.Pointer(w)), uintptr(unsafe.Pointer(e)), uintptr(unsafe.Pointer(timeout)), 0)
 	n = int(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1566,7 +1566,7 @@ func Select(nfd int, r *FdSet, w *FdSet, e *FdSet, timeout *Timeval) (n int, err
 func Setegid(egid int) (err error) {
 	_, _, e1 := rawSysvicall6(uintptr(unsafe.Pointer(&procSetegid)), 1, uintptr(egid), 0, 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1576,7 +1576,7 @@ func Setegid(egid int) (err error) {
 func Seteuid(euid int) (err error) {
 	_, _, e1 := rawSysvicall6(uintptr(unsafe.Pointer(&procSeteuid)), 1, uintptr(euid), 0, 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1586,7 +1586,7 @@ func Seteuid(euid int) (err error) {
 func Setgid(gid int) (err error) {
 	_, _, e1 := rawSysvicall6(uintptr(unsafe.Pointer(&procSetgid)), 1, uintptr(gid), 0, 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1600,7 +1600,7 @@ func Sethostname(p []byte) (err error) {
 	}
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procSethostname)), 2, uintptr(unsafe.Pointer(_p0)), uintptr(len(p)), 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1610,7 +1610,7 @@ func Sethostname(p []byte) (err error) {
 func Setpgid(pid int, pgid int) (err error) {
 	_, _, e1 := rawSysvicall6(uintptr(unsafe.Pointer(&procSetpgid)), 2, uintptr(pid), uintptr(pgid), 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1620,7 +1620,7 @@ func Setpgid(pid int, pgid int) (err error) {
 func Setpriority(which int, who int, prio int) (err error) {
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procSetpriority)), 3, uintptr(which), uintptr(who), uintptr(prio), 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1630,7 +1630,7 @@ func Setpriority(which int, who int, prio int) (err error) {
 func Setregid(rgid int, egid int) (err error) {
 	_, _, e1 := rawSysvicall6(uintptr(unsafe.Pointer(&procSetregid)), 2, uintptr(rgid), uintptr(egid), 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1640,7 +1640,7 @@ func Setregid(rgid int, egid int) (err error) {
 func Setreuid(ruid int, euid int) (err error) {
 	_, _, e1 := rawSysvicall6(uintptr(unsafe.Pointer(&procSetreuid)), 2, uintptr(ruid), uintptr(euid), 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1651,7 +1651,7 @@ func Setsid() (pid int, err error) {
 	r0, _, e1 := rawSysvicall6(uintptr(unsafe.Pointer(&procSetsid)), 0, 0, 0, 0, 0, 0, 0)
 	pid = int(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1661,7 +1661,7 @@ func Setsid() (pid int, err error) {
 func Setuid(uid int) (err error) {
 	_, _, e1 := rawSysvicall6(uintptr(unsafe.Pointer(&procSetuid)), 1, uintptr(uid), 0, 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1671,7 +1671,7 @@ func Setuid(uid int) (err error) {
 func Shutdown(s int, how int) (err error) {
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procshutdown)), 2, uintptr(s), uintptr(how), 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1686,7 +1686,7 @@ func Stat(path string, stat *Stat_t) (err error) {
 	}
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procStat)), 2, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(stat)), 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1701,7 +1701,7 @@ func Statvfs(path string, vfsstat *Statvfs_t) (err error) {
 	}
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procStatvfs)), 2, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(vfsstat)), 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1721,7 +1721,7 @@ func Symlink(path string, link string) (err error) {
 	}
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procSymlink)), 2, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1731,7 +1731,7 @@ func Symlink(path string, link string) (err error) {
 func Sync() (err error) {
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procSync)), 0, 0, 0, 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1742,7 +1742,7 @@ func Sysconf(which int) (n int64, err error) {
 	r0, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procSysconf)), 1, uintptr(which), 0, 0, 0, 0, 0)
 	n = int64(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1753,7 +1753,7 @@ func Times(tms *Tms) (ticks uintptr, err error) {
 	r0, _, e1 := rawSysvicall6(uintptr(unsafe.Pointer(&procTimes)), 1, uintptr(unsafe.Pointer(tms)), 0, 0, 0, 0, 0)
 	ticks = uintptr(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1768,7 +1768,7 @@ func Truncate(path string, length int64) (err error) {
 	}
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procTruncate)), 2, uintptr(unsafe.Pointer(_p0)), uintptr(length), 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1778,7 +1778,7 @@ func Truncate(path string, length int64) (err error) {
 func Fsync(fd int) (err error) {
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procFsync)), 1, uintptr(fd), 0, 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1788,7 +1788,7 @@ func Fsync(fd int) (err error) {
 func Ftruncate(fd int, length int64) (err error) {
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procFtruncate)), 2, uintptr(fd), uintptr(length), 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1806,7 +1806,7 @@ func Umask(mask int) (oldmask int) {
 func Uname(buf *Utsname) (err error) {
 	_, _, e1 := rawSysvicall6(uintptr(unsafe.Pointer(&procUname)), 1, uintptr(unsafe.Pointer(buf)), 0, 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1821,7 +1821,7 @@ func Unmount(target string, flags int) (err error) {
 	}
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procumount)), 2, uintptr(unsafe.Pointer(_p0)), uintptr(flags), 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1836,7 +1836,7 @@ func Unlink(path string) (err error) {
 	}
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procUnlink)), 1, uintptr(unsafe.Pointer(_p0)), 0, 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1851,7 +1851,7 @@ func Unlinkat(dirfd int, path string, flags int) (err error) {
 	}
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procUnlinkat)), 3, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(flags), 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1861,7 +1861,7 @@ func Unlinkat(dirfd int, path string, flags int) (err error) {
 func Ustat(dev int, ubuf *Ustat_t) (err error) {
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procUstat)), 2, uintptr(dev), uintptr(unsafe.Pointer(ubuf)), 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1876,7 +1876,7 @@ func Utime(path string, buf *Utimbuf) (err error) {
 	}
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procUtime)), 2, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(buf)), 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1886,7 +1886,7 @@ func Utime(path string, buf *Utimbuf) (err error) {
 func bind(s int, addr unsafe.Pointer, addrlen _Socklen) (err error) {
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&proc__xnet_bind)), 3, uintptr(s), uintptr(addr), uintptr(addrlen), 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1896,7 +1896,7 @@ func bind(s int, addr unsafe.Pointer, addrlen _Socklen) (err error) {
 func connect(s int, addr unsafe.Pointer, addrlen _Socklen) (err error) {
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&proc__xnet_connect)), 3, uintptr(s), uintptr(addr), uintptr(addrlen), 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1907,7 +1907,7 @@ func mmap(addr uintptr, length uintptr, prot int, flag int, fd int, pos int64) (
 	r0, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procmmap)), 6, uintptr(addr), uintptr(length), uintptr(prot), uintptr(flag), uintptr(fd), uintptr(pos))
 	ret = uintptr(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1917,7 +1917,7 @@ func mmap(addr uintptr, length uintptr, prot int, flag int, fd int, pos int64) (
 func munmap(addr uintptr, length uintptr) (err error) {
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procmunmap)), 2, uintptr(addr), uintptr(length), 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1928,7 +1928,7 @@ func sendfile(outfd int, infd int, offset *int64, count int) (written int, err e
 	r0, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procsendfile)), 4, uintptr(outfd), uintptr(infd), uintptr(unsafe.Pointer(offset)), uintptr(count), 0, 0)
 	written = int(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1942,7 +1942,7 @@ func sendto(s int, buf []byte, flags int, to unsafe.Pointer, addrlen _Socklen) (
 	}
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&proc__xnet_sendto)), 6, uintptr(s), uintptr(unsafe.Pointer(_p0)), uintptr(len(buf)), uintptr(flags), uintptr(to), uintptr(addrlen))
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1953,7 +1953,7 @@ func socket(domain int, typ int, proto int) (fd int, err error) {
 	r0, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&proc__xnet_socket)), 3, uintptr(domain), uintptr(typ), uintptr(proto), 0, 0, 0)
 	fd = int(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1963,7 +1963,7 @@ func socket(domain int, typ int, proto int) (fd int, err error) {
 func socketpair(domain int, typ int, proto int, fd *[2]int32) (err error) {
 	_, _, e1 := rawSysvicall6(uintptr(unsafe.Pointer(&proc__xnet_socketpair)), 4, uintptr(domain), uintptr(typ), uintptr(proto), uintptr(unsafe.Pointer(fd)), 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1978,7 +1978,7 @@ func write(fd int, p []byte) (n int, err error) {
 	r0, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procwrite)), 3, uintptr(fd), uintptr(unsafe.Pointer(_p0)), uintptr(len(p)), 0, 0, 0)
 	n = int(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1988,7 +1988,7 @@ func write(fd int, p []byte) (n int, err error) {
 func getsockopt(s int, level int, name int, val unsafe.Pointer, vallen *_Socklen) (err error) {
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&proc__xnet_getsockopt)), 5, uintptr(s), uintptr(level), uintptr(name), uintptr(val), uintptr(unsafe.Pointer(vallen)), 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1998,7 +1998,7 @@ func getsockopt(s int, level int, name int, val unsafe.Pointer, vallen *_Socklen
 func getpeername(fd int, rsa *RawSockaddrAny, addrlen *_Socklen) (err error) {
 	_, _, e1 := rawSysvicall6(uintptr(unsafe.Pointer(&procgetpeername)), 3, uintptr(fd), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)), 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -2008,7 +2008,7 @@ func getpeername(fd int, rsa *RawSockaddrAny, addrlen *_Socklen) (err error) {
 func setsockopt(s int, level int, name int, val unsafe.Pointer, vallen uintptr) (err error) {
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procsetsockopt)), 5, uintptr(s), uintptr(level), uintptr(name), uintptr(val), uintptr(vallen), 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -2023,7 +2023,7 @@ func recvfrom(fd int, p []byte, flags int, from *RawSockaddrAny, fromlen *_Sockl
 	r0, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procrecvfrom)), 6, uintptr(fd), uintptr(unsafe.Pointer(_p0)), uintptr(len(p)), uintptr(flags), uintptr(unsafe.Pointer(from)), uintptr(unsafe.Pointer(fromlen)))
 	n = int(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -2034,7 +2034,7 @@ func port_create() (n int, err error) {
 	r0, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procport_create)), 0, 0, 0, 0, 0, 0, 0)
 	n = int(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -2045,7 +2045,7 @@ func port_associate(port int, source int, object uintptr, events int, user *byte
 	r0, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procport_associate)), 5, uintptr(port), uintptr(source), uintptr(object), uintptr(events), uintptr(unsafe.Pointer(user)), 0)
 	n = int(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -2056,7 +2056,7 @@ func port_dissociate(port int, source int, object uintptr) (n int, err error) {
 	r0, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procport_dissociate)), 3, uintptr(port), uintptr(source), uintptr(object), 0, 0, 0)
 	n = int(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -2067,7 +2067,7 @@ func port_get(port int, pe *portEvent, timeout *Timespec) (n int, err error) {
 	r0, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procport_get)), 3, uintptr(port), uintptr(unsafe.Pointer(pe)), uintptr(unsafe.Pointer(timeout)), 0, 0, 0)
 	n = int(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -2078,7 +2078,7 @@ func port_getn(port int, pe *portEvent, max uint32, nget *uint32, timeout *Times
 	r0, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procport_getn)), 5, uintptr(port), uintptr(unsafe.Pointer(pe)), uintptr(max), uintptr(unsafe.Pointer(nget)), uintptr(unsafe.Pointer(timeout)), 0)
 	n = int(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -2088,7 +2088,7 @@ func port_getn(port int, pe *portEvent, max uint32, nget *uint32, timeout *Times
 func putmsg(fd int, clptr *strbuf, dataptr *strbuf, flags int) (err error) {
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procputmsg)), 4, uintptr(fd), uintptr(unsafe.Pointer(clptr)), uintptr(unsafe.Pointer(dataptr)), uintptr(flags), 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -2098,7 +2098,7 @@ func putmsg(fd int, clptr *strbuf, dataptr *strbuf, flags int) (err error) {
 func getmsg(fd int, clptr *strbuf, dataptr *strbuf, flags *int) (err error) {
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procgetmsg)), 4, uintptr(fd), uintptr(unsafe.Pointer(clptr)), uintptr(unsafe.Pointer(dataptr)), uintptr(unsafe.Pointer(flags)), 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_zos_s390x.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_zos_s390x.go
index c31681743c7..1d8fe1d4b21 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_zos_s390x.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsyscall_zos_s390x.go
@@ -40,17 +40,6 @@ func read(fd int, p []byte) (n int, err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func readlen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := syscall_syscall(SYS_READ, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func write(fd int, p []byte) (n int, err error) {
 	var _p0 unsafe.Pointer
 	if len(p) > 0 {
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsysnum_linux_386.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsysnum_linux_386.go
index c9c4ad0314f..9862853d341 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsysnum_linux_386.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsysnum_linux_386.go
@@ -447,4 +447,5 @@ const (
 	SYS_PROCESS_MRELEASE             = 448
 	SYS_FUTEX_WAITV                  = 449
 	SYS_SET_MEMPOLICY_HOME_NODE      = 450
+	SYS_CACHESTAT                    = 451
 )
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsysnum_linux_amd64.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsysnum_linux_amd64.go
index 12ff3417c5f..8901f0f4e51 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsysnum_linux_amd64.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsysnum_linux_amd64.go
@@ -369,4 +369,5 @@ const (
 	SYS_PROCESS_MRELEASE        = 448
 	SYS_FUTEX_WAITV             = 449
 	SYS_SET_MEMPOLICY_HOME_NODE = 450
+	SYS_CACHESTAT               = 451
 )
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsysnum_linux_arm.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsysnum_linux_arm.go
index c3fb5e77ab4..6902c37eed7 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsysnum_linux_arm.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsysnum_linux_arm.go
@@ -411,4 +411,5 @@ const (
 	SYS_PROCESS_MRELEASE             = 448
 	SYS_FUTEX_WAITV                  = 449
 	SYS_SET_MEMPOLICY_HOME_NODE      = 450
+	SYS_CACHESTAT                    = 451
 )
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsysnum_linux_arm64.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsysnum_linux_arm64.go
index 358c847a40c..a6d3dff811f 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsysnum_linux_arm64.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsysnum_linux_arm64.go
@@ -314,4 +314,5 @@ const (
 	SYS_PROCESS_MRELEASE        = 448
 	SYS_FUTEX_WAITV             = 449
 	SYS_SET_MEMPOLICY_HOME_NODE = 450
+	SYS_CACHESTAT               = 451
 )
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsysnum_linux_loong64.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsysnum_linux_loong64.go
index 81c4849b161..b18f3f71079 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsysnum_linux_loong64.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsysnum_linux_loong64.go
@@ -308,4 +308,5 @@ const (
 	SYS_PROCESS_MRELEASE        = 448
 	SYS_FUTEX_WAITV             = 449
 	SYS_SET_MEMPOLICY_HOME_NODE = 450
+	SYS_CACHESTAT               = 451
 )
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsysnum_linux_mips.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsysnum_linux_mips.go
index 202a57e9008..0302e5e3de1 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsysnum_linux_mips.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsysnum_linux_mips.go
@@ -431,4 +431,5 @@ const (
 	SYS_PROCESS_MRELEASE             = 4448
 	SYS_FUTEX_WAITV                  = 4449
 	SYS_SET_MEMPOLICY_HOME_NODE      = 4450
+	SYS_CACHESTAT                    = 4451
 )
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsysnum_linux_mips64.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsysnum_linux_mips64.go
index 1fbceb52d7c..6693ba4a0f8 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsysnum_linux_mips64.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsysnum_linux_mips64.go
@@ -361,4 +361,5 @@ const (
 	SYS_PROCESS_MRELEASE        = 5448
 	SYS_FUTEX_WAITV             = 5449
 	SYS_SET_MEMPOLICY_HOME_NODE = 5450
+	SYS_CACHESTAT               = 5451
 )
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsysnum_linux_mips64le.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsysnum_linux_mips64le.go
index b4ffb7a207d..fd93f4987c9 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsysnum_linux_mips64le.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsysnum_linux_mips64le.go
@@ -361,4 +361,5 @@ const (
 	SYS_PROCESS_MRELEASE        = 5448
 	SYS_FUTEX_WAITV             = 5449
 	SYS_SET_MEMPOLICY_HOME_NODE = 5450
+	SYS_CACHESTAT               = 5451
 )
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsysnum_linux_mipsle.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsysnum_linux_mipsle.go
index 867985f9b44..760ddcadc2a 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsysnum_linux_mipsle.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsysnum_linux_mipsle.go
@@ -431,4 +431,5 @@ const (
 	SYS_PROCESS_MRELEASE             = 4448
 	SYS_FUTEX_WAITV                  = 4449
 	SYS_SET_MEMPOLICY_HOME_NODE      = 4450
+	SYS_CACHESTAT                    = 4451
 )
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsysnum_linux_ppc.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsysnum_linux_ppc.go
index a8cce69ede2..cff2b2555b7 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsysnum_linux_ppc.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsysnum_linux_ppc.go
@@ -438,4 +438,5 @@ const (
 	SYS_PROCESS_MRELEASE             = 448
 	SYS_FUTEX_WAITV                  = 449
 	SYS_SET_MEMPOLICY_HOME_NODE      = 450
+	SYS_CACHESTAT                    = 451
 )
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsysnum_linux_ppc64.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsysnum_linux_ppc64.go
index d44c5b39d79..a4b2405d09d 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsysnum_linux_ppc64.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsysnum_linux_ppc64.go
@@ -410,4 +410,5 @@ const (
 	SYS_PROCESS_MRELEASE        = 448
 	SYS_FUTEX_WAITV             = 449
 	SYS_SET_MEMPOLICY_HOME_NODE = 450
+	SYS_CACHESTAT               = 451
 )
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsysnum_linux_ppc64le.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsysnum_linux_ppc64le.go
index 4214dd9c03a..aca54b4e3a1 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsysnum_linux_ppc64le.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsysnum_linux_ppc64le.go
@@ -410,4 +410,5 @@ const (
 	SYS_PROCESS_MRELEASE        = 448
 	SYS_FUTEX_WAITV             = 449
 	SYS_SET_MEMPOLICY_HOME_NODE = 450
+	SYS_CACHESTAT               = 451
 )
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsysnum_linux_riscv64.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsysnum_linux_riscv64.go
index 3e594a8c091..9d1738d641f 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsysnum_linux_riscv64.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsysnum_linux_riscv64.go
@@ -251,6 +251,8 @@ const (
 	SYS_ACCEPT4                 = 242
 	SYS_RECVMMSG                = 243
 	SYS_ARCH_SPECIFIC_SYSCALL   = 244
+	SYS_RISCV_HWPROBE           = 258
+	SYS_RISCV_FLUSH_ICACHE      = 259
 	SYS_WAIT4                   = 260
 	SYS_PRLIMIT64               = 261
 	SYS_FANOTIFY_INIT           = 262
@@ -313,4 +315,5 @@ const (
 	SYS_PROCESS_MRELEASE        = 448
 	SYS_FUTEX_WAITV             = 449
 	SYS_SET_MEMPOLICY_HOME_NODE = 450
+	SYS_CACHESTAT               = 451
 )
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsysnum_linux_s390x.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsysnum_linux_s390x.go
index 7ea465204b7..022878dc8df 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsysnum_linux_s390x.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsysnum_linux_s390x.go
@@ -372,7 +372,9 @@ const (
 	SYS_LANDLOCK_CREATE_RULESET = 444
 	SYS_LANDLOCK_ADD_RULE       = 445
 	SYS_LANDLOCK_RESTRICT_SELF  = 446
+	SYS_MEMFD_SECRET            = 447
 	SYS_PROCESS_MRELEASE        = 448
 	SYS_FUTEX_WAITV             = 449
 	SYS_SET_MEMPOLICY_HOME_NODE = 450
+	SYS_CACHESTAT               = 451
 )
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsysnum_linux_sparc64.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsysnum_linux_sparc64.go
index 92f628ef4f2..4100a761c20 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/zsysnum_linux_sparc64.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/zsysnum_linux_sparc64.go
@@ -389,4 +389,5 @@ const (
 	SYS_PROCESS_MRELEASE        = 448
 	SYS_FUTEX_WAITV             = 449
 	SYS_SET_MEMPOLICY_HOME_NODE = 450
+	SYS_CACHESTAT               = 451
 )
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/ztypes_linux.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/ztypes_linux.go
index ca84727cfe8..18aa70b4262 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/ztypes_linux.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/ztypes_linux.go
@@ -866,6 +866,11 @@ const (
 	POLLNVAL = 0x20
 )
 
+type sigset_argpack struct {
+	ss    *Sigset_t
+	ssLen uintptr
+}
+
 type SignalfdSiginfo struct {
 	Signo     uint32
 	Errno     int32
@@ -1538,6 +1543,10 @@ const (
 	IFLA_GRO_MAX_SIZE                          = 0x3a
 	IFLA_TSO_MAX_SIZE                          = 0x3b
 	IFLA_TSO_MAX_SEGS                          = 0x3c
+	IFLA_ALLMULTI                              = 0x3d
+	IFLA_DEVLINK_PORT                          = 0x3e
+	IFLA_GSO_IPV4_MAX_SIZE                     = 0x3f
+	IFLA_GRO_IPV4_MAX_SIZE                     = 0x40
 	IFLA_PROTO_DOWN_REASON_UNSPEC              = 0x0
 	IFLA_PROTO_DOWN_REASON_MASK                = 0x1
 	IFLA_PROTO_DOWN_REASON_VALUE               = 0x2
@@ -1968,7 +1977,7 @@ const (
 	NFT_MSG_GETFLOWTABLE              = 0x17
 	NFT_MSG_DELFLOWTABLE              = 0x18
 	NFT_MSG_GETRULE_RESET             = 0x19
-	NFT_MSG_MAX                       = 0x1a
+	NFT_MSG_MAX                       = 0x22
 	NFTA_LIST_UNSPEC                  = 0x0
 	NFTA_LIST_ELEM                    = 0x1
 	NFTA_HOOK_UNSPEC                  = 0x0
@@ -2555,6 +2564,11 @@ const (
 	BPF_REG_8                                  = 0x8
 	BPF_REG_9                                  = 0x9
 	BPF_REG_10                                 = 0xa
+	BPF_CGROUP_ITER_ORDER_UNSPEC               = 0x0
+	BPF_CGROUP_ITER_SELF_ONLY                  = 0x1
+	BPF_CGROUP_ITER_DESCENDANTS_PRE            = 0x2
+	BPF_CGROUP_ITER_DESCENDANTS_POST           = 0x3
+	BPF_CGROUP_ITER_ANCESTORS_UP               = 0x4
 	BPF_MAP_CREATE                             = 0x0
 	BPF_MAP_LOOKUP_ELEM                        = 0x1
 	BPF_MAP_UPDATE_ELEM                        = 0x2
@@ -2566,6 +2580,7 @@ const (
 	BPF_PROG_ATTACH                            = 0x8
 	BPF_PROG_DETACH                            = 0x9
 	BPF_PROG_TEST_RUN                          = 0xa
+	BPF_PROG_RUN                               = 0xa
 	BPF_PROG_GET_NEXT_ID                       = 0xb
 	BPF_MAP_GET_NEXT_ID                        = 0xc
 	BPF_PROG_GET_FD_BY_ID                      = 0xd
@@ -2610,6 +2625,7 @@ const (
 	BPF_MAP_TYPE_CPUMAP                        = 0x10
 	BPF_MAP_TYPE_XSKMAP                        = 0x11
 	BPF_MAP_TYPE_SOCKHASH                      = 0x12
+	BPF_MAP_TYPE_CGROUP_STORAGE_DEPRECATED     = 0x13
 	BPF_MAP_TYPE_CGROUP_STORAGE                = 0x13
 	BPF_MAP_TYPE_REUSEPORT_SOCKARRAY           = 0x14
 	BPF_MAP_TYPE_PERCPU_CGROUP_STORAGE         = 0x15
@@ -2620,6 +2636,10 @@ const (
 	BPF_MAP_TYPE_STRUCT_OPS                    = 0x1a
 	BPF_MAP_TYPE_RINGBUF                       = 0x1b
 	BPF_MAP_TYPE_INODE_STORAGE                 = 0x1c
+	BPF_MAP_TYPE_TASK_STORAGE                  = 0x1d
+	BPF_MAP_TYPE_BLOOM_FILTER                  = 0x1e
+	BPF_MAP_TYPE_USER_RINGBUF                  = 0x1f
+	BPF_MAP_TYPE_CGRP_STORAGE                  = 0x20
 	BPF_PROG_TYPE_UNSPEC                       = 0x0
 	BPF_PROG_TYPE_SOCKET_FILTER                = 0x1
 	BPF_PROG_TYPE_KPROBE                       = 0x2
@@ -2651,6 +2671,7 @@ const (
 	BPF_PROG_TYPE_EXT                          = 0x1c
 	BPF_PROG_TYPE_LSM                          = 0x1d
 	BPF_PROG_TYPE_SK_LOOKUP                    = 0x1e
+	BPF_PROG_TYPE_SYSCALL                      = 0x1f
 	BPF_CGROUP_INET_INGRESS                    = 0x0
 	BPF_CGROUP_INET_EGRESS                     = 0x1
 	BPF_CGROUP_INET_SOCK_CREATE                = 0x2
@@ -2689,6 +2710,12 @@ const (
 	BPF_XDP_CPUMAP                             = 0x23
 	BPF_SK_LOOKUP                              = 0x24
 	BPF_XDP                                    = 0x25
+	BPF_SK_SKB_VERDICT                         = 0x26
+	BPF_SK_REUSEPORT_SELECT                    = 0x27
+	BPF_SK_REUSEPORT_SELECT_OR_MIGRATE         = 0x28
+	BPF_PERF_EVENT                             = 0x29
+	BPF_TRACE_KPROBE_MULTI                     = 0x2a
+	BPF_LSM_CGROUP                             = 0x2b
 	BPF_LINK_TYPE_UNSPEC                       = 0x0
 	BPF_LINK_TYPE_RAW_TRACEPOINT               = 0x1
 	BPF_LINK_TYPE_TRACING                      = 0x2
@@ -2696,6 +2723,9 @@ const (
 	BPF_LINK_TYPE_ITER                         = 0x4
 	BPF_LINK_TYPE_NETNS                        = 0x5
 	BPF_LINK_TYPE_XDP                          = 0x6
+	BPF_LINK_TYPE_PERF_EVENT                   = 0x7
+	BPF_LINK_TYPE_KPROBE_MULTI                 = 0x8
+	BPF_LINK_TYPE_STRUCT_OPS                   = 0x9
 	BPF_ANY                                    = 0x0
 	BPF_NOEXIST                                = 0x1
 	BPF_EXIST                                  = 0x2
@@ -2733,6 +2763,7 @@ const (
 	BPF_F_ZERO_CSUM_TX                         = 0x2
 	BPF_F_DONT_FRAGMENT                        = 0x4
 	BPF_F_SEQ_NUMBER                           = 0x8
+	BPF_F_TUNINFO_FLAGS                        = 0x10
 	BPF_F_INDEX_MASK                           = 0xffffffff
 	BPF_F_CURRENT_CPU                          = 0xffffffff
 	BPF_F_CTXLEN_MASK                          = 0xfffff00000000
@@ -2747,6 +2778,7 @@ const (
 	BPF_F_ADJ_ROOM_ENCAP_L4_GRE                = 0x8
 	BPF_F_ADJ_ROOM_ENCAP_L4_UDP                = 0x10
 	BPF_F_ADJ_ROOM_NO_CSUM_RESET               = 0x20
+	BPF_F_ADJ_ROOM_ENCAP_L2_ETH                = 0x40
 	BPF_ADJ_ROOM_ENCAP_L2_MASK                 = 0xff
 	BPF_ADJ_ROOM_ENCAP_L2_SHIFT                = 0x38
 	BPF_F_SYSCTL_BASE_NAME                     = 0x1
@@ -2771,10 +2803,16 @@ const (
 	BPF_LWT_ENCAP_SEG6                         = 0x0
 	BPF_LWT_ENCAP_SEG6_INLINE                  = 0x1
 	BPF_LWT_ENCAP_IP                           = 0x2
+	BPF_F_BPRM_SECUREEXEC                      = 0x1
+	BPF_F_BROADCAST                            = 0x8
+	BPF_F_EXCLUDE_INGRESS                      = 0x10
+	BPF_SKB_TSTAMP_UNSPEC                      = 0x0
+	BPF_SKB_TSTAMP_DELIVERY_MONO               = 0x1
 	BPF_OK                                     = 0x0
 	BPF_DROP                                   = 0x2
 	BPF_REDIRECT                               = 0x7
 	BPF_LWT_REROUTE                            = 0x80
+	BPF_FLOW_DISSECTOR_CONTINUE                = 0x81
 	BPF_SOCK_OPS_RTO_CB_FLAG                   = 0x1
 	BPF_SOCK_OPS_RETRANS_CB_FLAG               = 0x2
 	BPF_SOCK_OPS_STATE_CB_FLAG                 = 0x4
@@ -2838,6 +2876,10 @@ const (
 	BPF_FIB_LKUP_RET_UNSUPP_LWT                = 0x6
 	BPF_FIB_LKUP_RET_NO_NEIGH                  = 0x7
 	BPF_FIB_LKUP_RET_FRAG_NEEDED               = 0x8
+	BPF_MTU_CHK_SEGS                           = 0x1
+	BPF_MTU_CHK_RET_SUCCESS                    = 0x0
+	BPF_MTU_CHK_RET_FRAG_NEEDED                = 0x1
+	BPF_MTU_CHK_RET_SEGS_TOOBIG                = 0x2
 	BPF_FD_TYPE_RAW_TRACEPOINT                 = 0x0
 	BPF_FD_TYPE_TRACEPOINT                     = 0x1
 	BPF_FD_TYPE_KPROBE                         = 0x2
@@ -2847,6 +2889,19 @@ const (
 	BPF_FLOW_DISSECTOR_F_PARSE_1ST_FRAG        = 0x1
 	BPF_FLOW_DISSECTOR_F_STOP_AT_FLOW_LABEL    = 0x2
 	BPF_FLOW_DISSECTOR_F_STOP_AT_ENCAP         = 0x4
+	BPF_CORE_FIELD_BYTE_OFFSET                 = 0x0
+	BPF_CORE_FIELD_BYTE_SIZE                   = 0x1
+	BPF_CORE_FIELD_EXISTS                      = 0x2
+	BPF_CORE_FIELD_SIGNED                      = 0x3
+	BPF_CORE_FIELD_LSHIFT_U64                  = 0x4
+	BPF_CORE_FIELD_RSHIFT_U64                  = 0x5
+	BPF_CORE_TYPE_ID_LOCAL                     = 0x6
+	BPF_CORE_TYPE_ID_TARGET                    = 0x7
+	BPF_CORE_TYPE_EXISTS                       = 0x8
+	BPF_CORE_TYPE_SIZE                         = 0x9
+	BPF_CORE_ENUMVAL_EXISTS                    = 0xa
+	BPF_CORE_ENUMVAL_VALUE                     = 0xb
+	BPF_CORE_TYPE_MATCHES                      = 0xc
 )
 
 const (
@@ -3605,7 +3660,7 @@ const (
 	ETHTOOL_MSG_PSE_GET                       = 0x24
 	ETHTOOL_MSG_PSE_SET                       = 0x25
 	ETHTOOL_MSG_RSS_GET                       = 0x26
-	ETHTOOL_MSG_USER_MAX                      = 0x26
+	ETHTOOL_MSG_USER_MAX                      = 0x2b
 	ETHTOOL_MSG_KERNEL_NONE                   = 0x0
 	ETHTOOL_MSG_STRSET_GET_REPLY              = 0x1
 	ETHTOOL_MSG_LINKINFO_GET_REPLY            = 0x2
@@ -3645,7 +3700,7 @@ const (
 	ETHTOOL_MSG_MODULE_NTF                    = 0x24
 	ETHTOOL_MSG_PSE_GET_REPLY                 = 0x25
 	ETHTOOL_MSG_RSS_GET_REPLY                 = 0x26
-	ETHTOOL_MSG_KERNEL_MAX                    = 0x26
+	ETHTOOL_MSG_KERNEL_MAX                    = 0x2b
 	ETHTOOL_A_HEADER_UNSPEC                   = 0x0
 	ETHTOOL_A_HEADER_DEV_INDEX                = 0x1
 	ETHTOOL_A_HEADER_DEV_NAME                 = 0x2
@@ -3749,7 +3804,7 @@ const (
 	ETHTOOL_A_RINGS_TCP_DATA_SPLIT            = 0xb
 	ETHTOOL_A_RINGS_CQE_SIZE                  = 0xc
 	ETHTOOL_A_RINGS_TX_PUSH                   = 0xd
-	ETHTOOL_A_RINGS_MAX                       = 0xd
+	ETHTOOL_A_RINGS_MAX                       = 0x10
 	ETHTOOL_A_CHANNELS_UNSPEC                 = 0x0
 	ETHTOOL_A_CHANNELS_HEADER                 = 0x1
 	ETHTOOL_A_CHANNELS_RX_MAX                 = 0x2
@@ -3787,14 +3842,14 @@ const (
 	ETHTOOL_A_COALESCE_RATE_SAMPLE_INTERVAL   = 0x17
 	ETHTOOL_A_COALESCE_USE_CQE_MODE_TX        = 0x18
 	ETHTOOL_A_COALESCE_USE_CQE_MODE_RX        = 0x19
-	ETHTOOL_A_COALESCE_MAX                    = 0x19
+	ETHTOOL_A_COALESCE_MAX                    = 0x1c
 	ETHTOOL_A_PAUSE_UNSPEC                    = 0x0
 	ETHTOOL_A_PAUSE_HEADER                    = 0x1
 	ETHTOOL_A_PAUSE_AUTONEG                   = 0x2
 	ETHTOOL_A_PAUSE_RX                        = 0x3
 	ETHTOOL_A_PAUSE_TX                        = 0x4
 	ETHTOOL_A_PAUSE_STATS                     = 0x5
-	ETHTOOL_A_PAUSE_MAX                       = 0x5
+	ETHTOOL_A_PAUSE_MAX                       = 0x6
 	ETHTOOL_A_PAUSE_STAT_UNSPEC               = 0x0
 	ETHTOOL_A_PAUSE_STAT_PAD                  = 0x1
 	ETHTOOL_A_PAUSE_STAT_TX_FRAMES            = 0x2
@@ -4444,7 +4499,7 @@ const (
 	NL80211_ATTR_MAC_HINT                                   = 0xc8
 	NL80211_ATTR_MAC_MASK                                   = 0xd7
 	NL80211_ATTR_MAX_AP_ASSOC_STA                           = 0xca
-	NL80211_ATTR_MAX                                        = 0x141
+	NL80211_ATTR_MAX                                        = 0x146
 	NL80211_ATTR_MAX_CRIT_PROT_DURATION                     = 0xb4
 	NL80211_ATTR_MAX_CSA_COUNTERS                           = 0xce
 	NL80211_ATTR_MAX_MATCH_SETS                             = 0x85
@@ -4673,7 +4728,7 @@ const (
 	NL80211_BAND_ATTR_HT_CAPA                               = 0x4
 	NL80211_BAND_ATTR_HT_MCS_SET                            = 0x3
 	NL80211_BAND_ATTR_IFTYPE_DATA                           = 0x9
-	NL80211_BAND_ATTR_MAX                                   = 0xb
+	NL80211_BAND_ATTR_MAX                                   = 0xd
 	NL80211_BAND_ATTR_RATES                                 = 0x2
 	NL80211_BAND_ATTR_VHT_CAPA                              = 0x8
 	NL80211_BAND_ATTR_VHT_MCS_SET                           = 0x7
@@ -4814,7 +4869,7 @@ const (
 	NL80211_CMD_LEAVE_IBSS                                  = 0x2c
 	NL80211_CMD_LEAVE_MESH                                  = 0x45
 	NL80211_CMD_LEAVE_OCB                                   = 0x6d
-	NL80211_CMD_MAX                                         = 0x98
+	NL80211_CMD_MAX                                         = 0x9a
 	NL80211_CMD_MICHAEL_MIC_FAILURE                         = 0x29
 	NL80211_CMD_MODIFY_LINK_STA                             = 0x97
 	NL80211_CMD_NAN_MATCH                                   = 0x78
@@ -5448,7 +5503,7 @@ const (
 	NL80211_RATE_INFO_HE_RU_ALLOC_52                        = 0x1
 	NL80211_RATE_INFO_HE_RU_ALLOC_996                       = 0x5
 	NL80211_RATE_INFO_HE_RU_ALLOC                           = 0x11
-	NL80211_RATE_INFO_MAX                                   = 0x16
+	NL80211_RATE_INFO_MAX                                   = 0x1d
 	NL80211_RATE_INFO_MCS                                   = 0x2
 	NL80211_RATE_INFO_SHORT_GI                              = 0x4
 	NL80211_RATE_INFO_VHT_MCS                               = 0x6
@@ -5795,6 +5850,8 @@ const (
 	TUN_F_TSO6    = 0x4
 	TUN_F_TSO_ECN = 0x8
 	TUN_F_UFO     = 0x10
+	TUN_F_USO4    = 0x20
+	TUN_F_USO6    = 0x40
 )
 
 const (
@@ -5804,9 +5861,25 @@ const (
 )
 
 const (
-	VIRTIO_NET_HDR_GSO_NONE  = 0x0
-	VIRTIO_NET_HDR_GSO_TCPV4 = 0x1
-	VIRTIO_NET_HDR_GSO_UDP   = 0x3
-	VIRTIO_NET_HDR_GSO_TCPV6 = 0x4
-	VIRTIO_NET_HDR_GSO_ECN   = 0x80
+	VIRTIO_NET_HDR_GSO_NONE   = 0x0
+	VIRTIO_NET_HDR_GSO_TCPV4  = 0x1
+	VIRTIO_NET_HDR_GSO_UDP    = 0x3
+	VIRTIO_NET_HDR_GSO_TCPV6  = 0x4
+	VIRTIO_NET_HDR_GSO_UDP_L4 = 0x5
+	VIRTIO_NET_HDR_GSO_ECN    = 0x80
 )
+
+type SchedAttr struct {
+	Size     uint32
+	Policy   uint32
+	Flags    uint64
+	Nice     int32
+	Priority uint32
+	Runtime  uint64
+	Deadline uint64
+	Period   uint64
+	Util_min uint32
+	Util_max uint32
+}
+
+const SizeofSchedAttr = 0x38
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/ztypes_linux_386.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/ztypes_linux_386.go
index 4ecc1495cd0..6d8acbcc570 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/ztypes_linux_386.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/ztypes_linux_386.go
@@ -337,6 +337,8 @@ type Taskstats struct {
 	Ac_exe_inode              uint64
 	Wpcopy_count              uint64
 	Wpcopy_delay_total        uint64
+	Irq_count                 uint64
+	Irq_delay_total           uint64
 }
 
 type cpuMask uint32
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/ztypes_linux_amd64.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/ztypes_linux_amd64.go
index 34fddff964e..59293c68841 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/ztypes_linux_amd64.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/ztypes_linux_amd64.go
@@ -350,6 +350,8 @@ type Taskstats struct {
 	Ac_exe_inode              uint64
 	Wpcopy_count              uint64
 	Wpcopy_delay_total        uint64
+	Irq_count                 uint64
+	Irq_delay_total           uint64
 }
 
 type cpuMask uint64
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/ztypes_linux_arm.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/ztypes_linux_arm.go
index 3b14a6031f3..40cfa38c29f 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/ztypes_linux_arm.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/ztypes_linux_arm.go
@@ -328,6 +328,8 @@ type Taskstats struct {
 	Ac_exe_inode              uint64
 	Wpcopy_count              uint64
 	Wpcopy_delay_total        uint64
+	Irq_count                 uint64
+	Irq_delay_total           uint64
 }
 
 type cpuMask uint32
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/ztypes_linux_arm64.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/ztypes_linux_arm64.go
index 0517651ab3f..055bc4216d4 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/ztypes_linux_arm64.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/ztypes_linux_arm64.go
@@ -329,6 +329,8 @@ type Taskstats struct {
 	Ac_exe_inode              uint64
 	Wpcopy_count              uint64
 	Wpcopy_delay_total        uint64
+	Irq_count                 uint64
+	Irq_delay_total           uint64
 }
 
 type cpuMask uint64
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/ztypes_linux_loong64.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/ztypes_linux_loong64.go
index 3b0c5181345..f28affbc607 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/ztypes_linux_loong64.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/ztypes_linux_loong64.go
@@ -330,6 +330,8 @@ type Taskstats struct {
 	Ac_exe_inode              uint64
 	Wpcopy_count              uint64
 	Wpcopy_delay_total        uint64
+	Irq_count                 uint64
+	Irq_delay_total           uint64
 }
 
 type cpuMask uint64
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/ztypes_linux_mips.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/ztypes_linux_mips.go
index fccdf4dd0f4..9d71e7ccd8b 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/ztypes_linux_mips.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/ztypes_linux_mips.go
@@ -333,6 +333,8 @@ type Taskstats struct {
 	Ac_exe_inode              uint64
 	Wpcopy_count              uint64
 	Wpcopy_delay_total        uint64
+	Irq_count                 uint64
+	Irq_delay_total           uint64
 }
 
 type cpuMask uint32
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/ztypes_linux_mips64.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/ztypes_linux_mips64.go
index 500de8fc07d..fd5ccd332a1 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/ztypes_linux_mips64.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/ztypes_linux_mips64.go
@@ -332,6 +332,8 @@ type Taskstats struct {
 	Ac_exe_inode              uint64
 	Wpcopy_count              uint64
 	Wpcopy_delay_total        uint64
+	Irq_count                 uint64
+	Irq_delay_total           uint64
 }
 
 type cpuMask uint64
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/ztypes_linux_mips64le.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/ztypes_linux_mips64le.go
index d0434cd2c6d..7704de77a2f 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/ztypes_linux_mips64le.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/ztypes_linux_mips64le.go
@@ -332,6 +332,8 @@ type Taskstats struct {
 	Ac_exe_inode              uint64
 	Wpcopy_count              uint64
 	Wpcopy_delay_total        uint64
+	Irq_count                 uint64
+	Irq_delay_total           uint64
 }
 
 type cpuMask uint64
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/ztypes_linux_mipsle.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/ztypes_linux_mipsle.go
index 84206ba5347..df00b87571a 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/ztypes_linux_mipsle.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/ztypes_linux_mipsle.go
@@ -333,6 +333,8 @@ type Taskstats struct {
 	Ac_exe_inode              uint64
 	Wpcopy_count              uint64
 	Wpcopy_delay_total        uint64
+	Irq_count                 uint64
+	Irq_delay_total           uint64
 }
 
 type cpuMask uint32
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/ztypes_linux_ppc.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/ztypes_linux_ppc.go
index ab078cf1f51..0942840db6e 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/ztypes_linux_ppc.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/ztypes_linux_ppc.go
@@ -340,6 +340,8 @@ type Taskstats struct {
 	Ac_exe_inode              uint64
 	Wpcopy_count              uint64
 	Wpcopy_delay_total        uint64
+	Irq_count                 uint64
+	Irq_delay_total           uint64
 }
 
 type cpuMask uint32
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/ztypes_linux_ppc64.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/ztypes_linux_ppc64.go
index 42eb2c4cefd..03487439508 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/ztypes_linux_ppc64.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/ztypes_linux_ppc64.go
@@ -339,6 +339,8 @@ type Taskstats struct {
 	Ac_exe_inode              uint64
 	Wpcopy_count              uint64
 	Wpcopy_delay_total        uint64
+	Irq_count                 uint64
+	Irq_delay_total           uint64
 }
 
 type cpuMask uint64
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/ztypes_linux_ppc64le.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/ztypes_linux_ppc64le.go
index 31304a4e8bb..bad06704757 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/ztypes_linux_ppc64le.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/ztypes_linux_ppc64le.go
@@ -339,6 +339,8 @@ type Taskstats struct {
 	Ac_exe_inode              uint64
 	Wpcopy_count              uint64
 	Wpcopy_delay_total        uint64
+	Irq_count                 uint64
+	Irq_delay_total           uint64
 }
 
 type cpuMask uint64
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/ztypes_linux_riscv64.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/ztypes_linux_riscv64.go
index c311f9612d8..1b4c97c32a6 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/ztypes_linux_riscv64.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/ztypes_linux_riscv64.go
@@ -357,6 +357,8 @@ type Taskstats struct {
 	Ac_exe_inode              uint64
 	Wpcopy_count              uint64
 	Wpcopy_delay_total        uint64
+	Irq_count                 uint64
+	Irq_delay_total           uint64
 }
 
 type cpuMask uint64
@@ -716,3 +718,30 @@ type SysvShmDesc struct {
 	_      uint64
 	_      uint64
 }
+
+type RISCVHWProbePairs struct {
+	Key   int64
+	Value uint64
+}
+
+const (
+	RISCV_HWPROBE_KEY_MVENDORID          = 0x0
+	RISCV_HWPROBE_KEY_MARCHID            = 0x1
+	RISCV_HWPROBE_KEY_MIMPID             = 0x2
+	RISCV_HWPROBE_KEY_BASE_BEHAVIOR      = 0x3
+	RISCV_HWPROBE_BASE_BEHAVIOR_IMA      = 0x1
+	RISCV_HWPROBE_KEY_IMA_EXT_0          = 0x4
+	RISCV_HWPROBE_IMA_FD                 = 0x1
+	RISCV_HWPROBE_IMA_C                  = 0x2
+	RISCV_HWPROBE_IMA_V                  = 0x4
+	RISCV_HWPROBE_EXT_ZBA                = 0x8
+	RISCV_HWPROBE_EXT_ZBB                = 0x10
+	RISCV_HWPROBE_EXT_ZBS                = 0x20
+	RISCV_HWPROBE_KEY_CPUPERF_0          = 0x5
+	RISCV_HWPROBE_MISALIGNED_UNKNOWN     = 0x0
+	RISCV_HWPROBE_MISALIGNED_EMULATED    = 0x1
+	RISCV_HWPROBE_MISALIGNED_SLOW        = 0x2
+	RISCV_HWPROBE_MISALIGNED_FAST        = 0x3
+	RISCV_HWPROBE_MISALIGNED_UNSUPPORTED = 0x4
+	RISCV_HWPROBE_MISALIGNED_MASK        = 0x7
+)
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/ztypes_linux_s390x.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/ztypes_linux_s390x.go
index bba3cefac1d..aa268d025cf 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/ztypes_linux_s390x.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/ztypes_linux_s390x.go
@@ -352,6 +352,8 @@ type Taskstats struct {
 	Ac_exe_inode              uint64
 	Wpcopy_count              uint64
 	Wpcopy_delay_total        uint64
+	Irq_count                 uint64
+	Irq_delay_total           uint64
 }
 
 type cpuMask uint64
diff --git a/.ci/providerlint/vendor/golang.org/x/sys/unix/ztypes_linux_sparc64.go b/.ci/providerlint/vendor/golang.org/x/sys/unix/ztypes_linux_sparc64.go
index ad8a0138046..444045b6c58 100644
--- a/.ci/providerlint/vendor/golang.org/x/sys/unix/ztypes_linux_sparc64.go
+++ b/.ci/providerlint/vendor/golang.org/x/sys/unix/ztypes_linux_sparc64.go
@@ -334,6 +334,8 @@ type Taskstats struct {
 	Ac_exe_inode              uint64
 	Wpcopy_count              uint64
 	Wpcopy_delay_total        uint64
+	Irq_count                 uint64
+	Irq_delay_total           uint64
 }
 
 type cpuMask uint64
diff --git a/.ci/providerlint/vendor/golang.org/x/text/unicode/bidi/tables13.0.0.go b/.ci/providerlint/vendor/golang.org/x/text/unicode/bidi/tables13.0.0.go
index f248effae17..ffadb7bebdb 100644
--- a/.ci/providerlint/vendor/golang.org/x/text/unicode/bidi/tables13.0.0.go
+++ b/.ci/providerlint/vendor/golang.org/x/text/unicode/bidi/tables13.0.0.go
@@ -1,7 +1,7 @@
 // Code generated by running "go generate" in golang.org/x/text. DO NOT EDIT.
 
-//go:build go1.16
-// +build go1.16
+//go:build go1.16 && !go1.21
+// +build go1.16,!go1.21
 
 package bidi
 
diff --git a/.ci/providerlint/vendor/golang.org/x/text/unicode/bidi/tables15.0.0.go b/.ci/providerlint/vendor/golang.org/x/text/unicode/bidi/tables15.0.0.go
new file mode 100644
index 00000000000..92cce5802c6
--- /dev/null
+++ b/.ci/providerlint/vendor/golang.org/x/text/unicode/bidi/tables15.0.0.go
@@ -0,0 +1,2043 @@
+// Code generated by running "go generate" in golang.org/x/text. DO NOT EDIT.
+
+//go:build go1.21
+// +build go1.21
+
+package bidi
+
+// UnicodeVersion is the Unicode version from which the tables in this package are derived.
+const UnicodeVersion = "15.0.0"
+
+// xorMasks contains masks to be xor-ed with brackets to get the reverse
+// version.
+var xorMasks = []int32{ // 8 elements
+	0, 1, 6, 7, 3, 15, 29, 63,
+} // Size: 56 bytes
+
+// lookup returns the trie value for the first UTF-8 encoding in s and
+// the width in bytes of this encoding. The size will be 0 if s does not
+// hold enough bytes to complete the encoding. len(s) must be greater than 0.
+func (t *bidiTrie) lookup(s []byte) (v uint8, sz int) {
+	c0 := s[0]
+	switch {
+	case c0 < 0x80: // is ASCII
+		return bidiValues[c0], 1
+	case c0 < 0xC2:
+		return 0, 1 // Illegal UTF-8: not a starter, not ASCII.
+	case c0 < 0xE0: // 2-byte UTF-8
+		if len(s) < 2 {
+			return 0, 0
+		}
+		i := bidiIndex[c0]
+		c1 := s[1]
+		if c1 < 0x80 || 0xC0 <= c1 {
+			return 0, 1 // Illegal UTF-8: not a continuation byte.
+		}
+		return t.lookupValue(uint32(i), c1), 2
+	case c0 < 0xF0: // 3-byte UTF-8
+		if len(s) < 3 {
+			return 0, 0
+		}
+		i := bidiIndex[c0]
+		c1 := s[1]
+		if c1 < 0x80 || 0xC0 <= c1 {
+			return 0, 1 // Illegal UTF-8: not a continuation byte.
+		}
+		o := uint32(i)<<6 + uint32(c1)
+		i = bidiIndex[o]
+		c2 := s[2]
+		if c2 < 0x80 || 0xC0 <= c2 {
+			return 0, 2 // Illegal UTF-8: not a continuation byte.
+		}
+		return t.lookupValue(uint32(i), c2), 3
+	case c0 < 0xF8: // 4-byte UTF-8
+		if len(s) < 4 {
+			return 0, 0
+		}
+		i := bidiIndex[c0]
+		c1 := s[1]
+		if c1 < 0x80 || 0xC0 <= c1 {
+			return 0, 1 // Illegal UTF-8: not a continuation byte.
+		}
+		o := uint32(i)<<6 + uint32(c1)
+		i = bidiIndex[o]
+		c2 := s[2]
+		if c2 < 0x80 || 0xC0 <= c2 {
+			return 0, 2 // Illegal UTF-8: not a continuation byte.
+		}
+		o = uint32(i)<<6 + uint32(c2)
+		i = bidiIndex[o]
+		c3 := s[3]
+		if c3 < 0x80 || 0xC0 <= c3 {
+			return 0, 3 // Illegal UTF-8: not a continuation byte.
+		}
+		return t.lookupValue(uint32(i), c3), 4
+	}
+	// Illegal rune
+	return 0, 1
+}
+
+// lookupUnsafe returns the trie value for the first UTF-8 encoding in s.
+// s must start with a full and valid UTF-8 encoded rune.
+func (t *bidiTrie) lookupUnsafe(s []byte) uint8 {
+	c0 := s[0]
+	if c0 < 0x80 { // is ASCII
+		return bidiValues[c0]
+	}
+	i := bidiIndex[c0]
+	if c0 < 0xE0 { // 2-byte UTF-8
+		return t.lookupValue(uint32(i), s[1])
+	}
+	i = bidiIndex[uint32(i)<<6+uint32(s[1])]
+	if c0 < 0xF0 { // 3-byte UTF-8
+		return t.lookupValue(uint32(i), s[2])
+	}
+	i = bidiIndex[uint32(i)<<6+uint32(s[2])]
+	if c0 < 0xF8 { // 4-byte UTF-8
+		return t.lookupValue(uint32(i), s[3])
+	}
+	return 0
+}
+
+// lookupString returns the trie value for the first UTF-8 encoding in s and
+// the width in bytes of this encoding. The size will be 0 if s does not
+// hold enough bytes to complete the encoding. len(s) must be greater than 0.
+func (t *bidiTrie) lookupString(s string) (v uint8, sz int) {
+	c0 := s[0]
+	switch {
+	case c0 < 0x80: // is ASCII
+		return bidiValues[c0], 1
+	case c0 < 0xC2:
+		return 0, 1 // Illegal UTF-8: not a starter, not ASCII.
+	case c0 < 0xE0: // 2-byte UTF-8
+		if len(s) < 2 {
+			return 0, 0
+		}
+		i := bidiIndex[c0]
+		c1 := s[1]
+		if c1 < 0x80 || 0xC0 <= c1 {
+			return 0, 1 // Illegal UTF-8: not a continuation byte.
+		}
+		return t.lookupValue(uint32(i), c1), 2
+	case c0 < 0xF0: // 3-byte UTF-8
+		if len(s) < 3 {
+			return 0, 0
+		}
+		i := bidiIndex[c0]
+		c1 := s[1]
+		if c1 < 0x80 || 0xC0 <= c1 {
+			return 0, 1 // Illegal UTF-8: not a continuation byte.
+		}
+		o := uint32(i)<<6 + uint32(c1)
+		i = bidiIndex[o]
+		c2 := s[2]
+		if c2 < 0x80 || 0xC0 <= c2 {
+			return 0, 2 // Illegal UTF-8: not a continuation byte.
+		}
+		return t.lookupValue(uint32(i), c2), 3
+	case c0 < 0xF8: // 4-byte UTF-8
+		if len(s) < 4 {
+			return 0, 0
+		}
+		i := bidiIndex[c0]
+		c1 := s[1]
+		if c1 < 0x80 || 0xC0 <= c1 {
+			return 0, 1 // Illegal UTF-8: not a continuation byte.
+		}
+		o := uint32(i)<<6 + uint32(c1)
+		i = bidiIndex[o]
+		c2 := s[2]
+		if c2 < 0x80 || 0xC0 <= c2 {
+			return 0, 2 // Illegal UTF-8: not a continuation byte.
+		}
+		o = uint32(i)<<6 + uint32(c2)
+		i = bidiIndex[o]
+		c3 := s[3]
+		if c3 < 0x80 || 0xC0 <= c3 {
+			return 0, 3 // Illegal UTF-8: not a continuation byte.
+		}
+		return t.lookupValue(uint32(i), c3), 4
+	}
+	// Illegal rune
+	return 0, 1
+}
+
+// lookupStringUnsafe returns the trie value for the first UTF-8 encoding in s.
+// s must start with a full and valid UTF-8 encoded rune.
+func (t *bidiTrie) lookupStringUnsafe(s string) uint8 {
+	c0 := s[0]
+	if c0 < 0x80 { // is ASCII
+		return bidiValues[c0]
+	}
+	i := bidiIndex[c0]
+	if c0 < 0xE0 { // 2-byte UTF-8
+		return t.lookupValue(uint32(i), s[1])
+	}
+	i = bidiIndex[uint32(i)<<6+uint32(s[1])]
+	if c0 < 0xF0 { // 3-byte UTF-8
+		return t.lookupValue(uint32(i), s[2])
+	}
+	i = bidiIndex[uint32(i)<<6+uint32(s[2])]
+	if c0 < 0xF8 { // 4-byte UTF-8
+		return t.lookupValue(uint32(i), s[3])
+	}
+	return 0
+}
+
+// bidiTrie. Total size: 19904 bytes (19.44 KiB). Checksum: b1f201ed2debb6c8.
+type bidiTrie struct{}
+
+func newBidiTrie(i int) *bidiTrie {
+	return &bidiTrie{}
+}
+
+// lookupValue determines the type of block n and looks up the value for b.
+func (t *bidiTrie) lookupValue(n uint32, b byte) uint8 {
+	switch {
+	default:
+		return uint8(bidiValues[n<<6+uint32(b)])
+	}
+}
+
+// bidiValues: 259 blocks, 16576 entries, 16576 bytes
+// The third block is the zero block.
+var bidiValues = [16576]uint8{
+	// Block 0x0, offset 0x0
+	0x00: 0x000b, 0x01: 0x000b, 0x02: 0x000b, 0x03: 0x000b, 0x04: 0x000b, 0x05: 0x000b,
+	0x06: 0x000b, 0x07: 0x000b, 0x08: 0x000b, 0x09: 0x0008, 0x0a: 0x0007, 0x0b: 0x0008,
+	0x0c: 0x0009, 0x0d: 0x0007, 0x0e: 0x000b, 0x0f: 0x000b, 0x10: 0x000b, 0x11: 0x000b,
+	0x12: 0x000b, 0x13: 0x000b, 0x14: 0x000b, 0x15: 0x000b, 0x16: 0x000b, 0x17: 0x000b,
+	0x18: 0x000b, 0x19: 0x000b, 0x1a: 0x000b, 0x1b: 0x000b, 0x1c: 0x0007, 0x1d: 0x0007,
+	0x1e: 0x0007, 0x1f: 0x0008, 0x20: 0x0009, 0x21: 0x000a, 0x22: 0x000a, 0x23: 0x0004,
+	0x24: 0x0004, 0x25: 0x0004, 0x26: 0x000a, 0x27: 0x000a, 0x28: 0x003a, 0x29: 0x002a,
+	0x2a: 0x000a, 0x2b: 0x0003, 0x2c: 0x0006, 0x2d: 0x0003, 0x2e: 0x0006, 0x2f: 0x0006,
+	0x30: 0x0002, 0x31: 0x0002, 0x32: 0x0002, 0x33: 0x0002, 0x34: 0x0002, 0x35: 0x0002,
+	0x36: 0x0002, 0x37: 0x0002, 0x38: 0x0002, 0x39: 0x0002, 0x3a: 0x0006, 0x3b: 0x000a,
+	0x3c: 0x000a, 0x3d: 0x000a, 0x3e: 0x000a, 0x3f: 0x000a,
+	// Block 0x1, offset 0x40
+	0x40: 0x000a,
+	0x5b: 0x005a, 0x5c: 0x000a, 0x5d: 0x004a,
+	0x5e: 0x000a, 0x5f: 0x000a, 0x60: 0x000a,
+	0x7b: 0x005a,
+	0x7c: 0x000a, 0x7d: 0x004a, 0x7e: 0x000a, 0x7f: 0x000b,
+	// Block 0x2, offset 0x80
+	// Block 0x3, offset 0xc0
+	0xc0: 0x000b, 0xc1: 0x000b, 0xc2: 0x000b, 0xc3: 0x000b, 0xc4: 0x000b, 0xc5: 0x0007,
+	0xc6: 0x000b, 0xc7: 0x000b, 0xc8: 0x000b, 0xc9: 0x000b, 0xca: 0x000b, 0xcb: 0x000b,
+	0xcc: 0x000b, 0xcd: 0x000b, 0xce: 0x000b, 0xcf: 0x000b, 0xd0: 0x000b, 0xd1: 0x000b,
+	0xd2: 0x000b, 0xd3: 0x000b, 0xd4: 0x000b, 0xd5: 0x000b, 0xd6: 0x000b, 0xd7: 0x000b,
+	0xd8: 0x000b, 0xd9: 0x000b, 0xda: 0x000b, 0xdb: 0x000b, 0xdc: 0x000b, 0xdd: 0x000b,
+	0xde: 0x000b, 0xdf: 0x000b, 0xe0: 0x0006, 0xe1: 0x000a, 0xe2: 0x0004, 0xe3: 0x0004,
+	0xe4: 0x0004, 0xe5: 0x0004, 0xe6: 0x000a, 0xe7: 0x000a, 0xe8: 0x000a, 0xe9: 0x000a,
+	0xeb: 0x000a, 0xec: 0x000a, 0xed: 0x000b, 0xee: 0x000a, 0xef: 0x000a,
+	0xf0: 0x0004, 0xf1: 0x0004, 0xf2: 0x0002, 0xf3: 0x0002, 0xf4: 0x000a,
+	0xf6: 0x000a, 0xf7: 0x000a, 0xf8: 0x000a, 0xf9: 0x0002, 0xfb: 0x000a,
+	0xfc: 0x000a, 0xfd: 0x000a, 0xfe: 0x000a, 0xff: 0x000a,
+	// Block 0x4, offset 0x100
+	0x117: 0x000a,
+	0x137: 0x000a,
+	// Block 0x5, offset 0x140
+	0x179: 0x000a, 0x17a: 0x000a,
+	// Block 0x6, offset 0x180
+	0x182: 0x000a, 0x183: 0x000a, 0x184: 0x000a, 0x185: 0x000a,
+	0x186: 0x000a, 0x187: 0x000a, 0x188: 0x000a, 0x189: 0x000a, 0x18a: 0x000a, 0x18b: 0x000a,
+	0x18c: 0x000a, 0x18d: 0x000a, 0x18e: 0x000a, 0x18f: 0x000a,
+	0x192: 0x000a, 0x193: 0x000a, 0x194: 0x000a, 0x195: 0x000a, 0x196: 0x000a, 0x197: 0x000a,
+	0x198: 0x000a, 0x199: 0x000a, 0x19a: 0x000a, 0x19b: 0x000a, 0x19c: 0x000a, 0x19d: 0x000a,
+	0x19e: 0x000a, 0x19f: 0x000a,
+	0x1a5: 0x000a, 0x1a6: 0x000a, 0x1a7: 0x000a, 0x1a8: 0x000a, 0x1a9: 0x000a,
+	0x1aa: 0x000a, 0x1ab: 0x000a, 0x1ac: 0x000a, 0x1ad: 0x000a, 0x1af: 0x000a,
+	0x1b0: 0x000a, 0x1b1: 0x000a, 0x1b2: 0x000a, 0x1b3: 0x000a, 0x1b4: 0x000a, 0x1b5: 0x000a,
+	0x1b6: 0x000a, 0x1b7: 0x000a, 0x1b8: 0x000a, 0x1b9: 0x000a, 0x1ba: 0x000a, 0x1bb: 0x000a,
+	0x1bc: 0x000a, 0x1bd: 0x000a, 0x1be: 0x000a, 0x1bf: 0x000a,
+	// Block 0x7, offset 0x1c0
+	0x1c0: 0x000c, 0x1c1: 0x000c, 0x1c2: 0x000c, 0x1c3: 0x000c, 0x1c4: 0x000c, 0x1c5: 0x000c,
+	0x1c6: 0x000c, 0x1c7: 0x000c, 0x1c8: 0x000c, 0x1c9: 0x000c, 0x1ca: 0x000c, 0x1cb: 0x000c,
+	0x1cc: 0x000c, 0x1cd: 0x000c, 0x1ce: 0x000c, 0x1cf: 0x000c, 0x1d0: 0x000c, 0x1d1: 0x000c,
+	0x1d2: 0x000c, 0x1d3: 0x000c, 0x1d4: 0x000c, 0x1d5: 0x000c, 0x1d6: 0x000c, 0x1d7: 0x000c,
+	0x1d8: 0x000c, 0x1d9: 0x000c, 0x1da: 0x000c, 0x1db: 0x000c, 0x1dc: 0x000c, 0x1dd: 0x000c,
+	0x1de: 0x000c, 0x1df: 0x000c, 0x1e0: 0x000c, 0x1e1: 0x000c, 0x1e2: 0x000c, 0x1e3: 0x000c,
+	0x1e4: 0x000c, 0x1e5: 0x000c, 0x1e6: 0x000c, 0x1e7: 0x000c, 0x1e8: 0x000c, 0x1e9: 0x000c,
+	0x1ea: 0x000c, 0x1eb: 0x000c, 0x1ec: 0x000c, 0x1ed: 0x000c, 0x1ee: 0x000c, 0x1ef: 0x000c,
+	0x1f0: 0x000c, 0x1f1: 0x000c, 0x1f2: 0x000c, 0x1f3: 0x000c, 0x1f4: 0x000c, 0x1f5: 0x000c,
+	0x1f6: 0x000c, 0x1f7: 0x000c, 0x1f8: 0x000c, 0x1f9: 0x000c, 0x1fa: 0x000c, 0x1fb: 0x000c,
+	0x1fc: 0x000c, 0x1fd: 0x000c, 0x1fe: 0x000c, 0x1ff: 0x000c,
+	// Block 0x8, offset 0x200
+	0x200: 0x000c, 0x201: 0x000c, 0x202: 0x000c, 0x203: 0x000c, 0x204: 0x000c, 0x205: 0x000c,
+	0x206: 0x000c, 0x207: 0x000c, 0x208: 0x000c, 0x209: 0x000c, 0x20a: 0x000c, 0x20b: 0x000c,
+	0x20c: 0x000c, 0x20d: 0x000c, 0x20e: 0x000c, 0x20f: 0x000c, 0x210: 0x000c, 0x211: 0x000c,
+	0x212: 0x000c, 0x213: 0x000c, 0x214: 0x000c, 0x215: 0x000c, 0x216: 0x000c, 0x217: 0x000c,
+	0x218: 0x000c, 0x219: 0x000c, 0x21a: 0x000c, 0x21b: 0x000c, 0x21c: 0x000c, 0x21d: 0x000c,
+	0x21e: 0x000c, 0x21f: 0x000c, 0x220: 0x000c, 0x221: 0x000c, 0x222: 0x000c, 0x223: 0x000c,
+	0x224: 0x000c, 0x225: 0x000c, 0x226: 0x000c, 0x227: 0x000c, 0x228: 0x000c, 0x229: 0x000c,
+	0x22a: 0x000c, 0x22b: 0x000c, 0x22c: 0x000c, 0x22d: 0x000c, 0x22e: 0x000c, 0x22f: 0x000c,
+	0x234: 0x000a, 0x235: 0x000a,
+	0x23e: 0x000a,
+	// Block 0x9, offset 0x240
+	0x244: 0x000a, 0x245: 0x000a,
+	0x247: 0x000a,
+	// Block 0xa, offset 0x280
+	0x2b6: 0x000a,
+	// Block 0xb, offset 0x2c0
+	0x2c3: 0x000c, 0x2c4: 0x000c, 0x2c5: 0x000c,
+	0x2c6: 0x000c, 0x2c7: 0x000c, 0x2c8: 0x000c, 0x2c9: 0x000c,
+	// Block 0xc, offset 0x300
+	0x30a: 0x000a,
+	0x30d: 0x000a, 0x30e: 0x000a, 0x30f: 0x0004, 0x310: 0x0001, 0x311: 0x000c,
+	0x312: 0x000c, 0x313: 0x000c, 0x314: 0x000c, 0x315: 0x000c, 0x316: 0x000c, 0x317: 0x000c,
+	0x318: 0x000c, 0x319: 0x000c, 0x31a: 0x000c, 0x31b: 0x000c, 0x31c: 0x000c, 0x31d: 0x000c,
+	0x31e: 0x000c, 0x31f: 0x000c, 0x320: 0x000c, 0x321: 0x000c, 0x322: 0x000c, 0x323: 0x000c,
+	0x324: 0x000c, 0x325: 0x000c, 0x326: 0x000c, 0x327: 0x000c, 0x328: 0x000c, 0x329: 0x000c,
+	0x32a: 0x000c, 0x32b: 0x000c, 0x32c: 0x000c, 0x32d: 0x000c, 0x32e: 0x000c, 0x32f: 0x000c,
+	0x330: 0x000c, 0x331: 0x000c, 0x332: 0x000c, 0x333: 0x000c, 0x334: 0x000c, 0x335: 0x000c,
+	0x336: 0x000c, 0x337: 0x000c, 0x338: 0x000c, 0x339: 0x000c, 0x33a: 0x000c, 0x33b: 0x000c,
+	0x33c: 0x000c, 0x33d: 0x000c, 0x33e: 0x0001, 0x33f: 0x000c,
+	// Block 0xd, offset 0x340
+	0x340: 0x0001, 0x341: 0x000c, 0x342: 0x000c, 0x343: 0x0001, 0x344: 0x000c, 0x345: 0x000c,
+	0x346: 0x0001, 0x347: 0x000c, 0x348: 0x0001, 0x349: 0x0001, 0x34a: 0x0001, 0x34b: 0x0001,
+	0x34c: 0x0001, 0x34d: 0x0001, 0x34e: 0x0001, 0x34f: 0x0001, 0x350: 0x0001, 0x351: 0x0001,
+	0x352: 0x0001, 0x353: 0x0001, 0x354: 0x0001, 0x355: 0x0001, 0x356: 0x0001, 0x357: 0x0001,
+	0x358: 0x0001, 0x359: 0x0001, 0x35a: 0x0001, 0x35b: 0x0001, 0x35c: 0x0001, 0x35d: 0x0001,
+	0x35e: 0x0001, 0x35f: 0x0001, 0x360: 0x0001, 0x361: 0x0001, 0x362: 0x0001, 0x363: 0x0001,
+	0x364: 0x0001, 0x365: 0x0001, 0x366: 0x0001, 0x367: 0x0001, 0x368: 0x0001, 0x369: 0x0001,
+	0x36a: 0x0001, 0x36b: 0x0001, 0x36c: 0x0001, 0x36d: 0x0001, 0x36e: 0x0001, 0x36f: 0x0001,
+	0x370: 0x0001, 0x371: 0x0001, 0x372: 0x0001, 0x373: 0x0001, 0x374: 0x0001, 0x375: 0x0001,
+	0x376: 0x0001, 0x377: 0x0001, 0x378: 0x0001, 0x379: 0x0001, 0x37a: 0x0001, 0x37b: 0x0001,
+	0x37c: 0x0001, 0x37d: 0x0001, 0x37e: 0x0001, 0x37f: 0x0001,
+	// Block 0xe, offset 0x380
+	0x380: 0x0005, 0x381: 0x0005, 0x382: 0x0005, 0x383: 0x0005, 0x384: 0x0005, 0x385: 0x0005,
+	0x386: 0x000a, 0x387: 0x000a, 0x388: 0x000d, 0x389: 0x0004, 0x38a: 0x0004, 0x38b: 0x000d,
+	0x38c: 0x0006, 0x38d: 0x000d, 0x38e: 0x000a, 0x38f: 0x000a, 0x390: 0x000c, 0x391: 0x000c,
+	0x392: 0x000c, 0x393: 0x000c, 0x394: 0x000c, 0x395: 0x000c, 0x396: 0x000c, 0x397: 0x000c,
+	0x398: 0x000c, 0x399: 0x000c, 0x39a: 0x000c, 0x39b: 0x000d, 0x39c: 0x000d, 0x39d: 0x000d,
+	0x39e: 0x000d, 0x39f: 0x000d, 0x3a0: 0x000d, 0x3a1: 0x000d, 0x3a2: 0x000d, 0x3a3: 0x000d,
+	0x3a4: 0x000d, 0x3a5: 0x000d, 0x3a6: 0x000d, 0x3a7: 0x000d, 0x3a8: 0x000d, 0x3a9: 0x000d,
+	0x3aa: 0x000d, 0x3ab: 0x000d, 0x3ac: 0x000d, 0x3ad: 0x000d, 0x3ae: 0x000d, 0x3af: 0x000d,
+	0x3b0: 0x000d, 0x3b1: 0x000d, 0x3b2: 0x000d, 0x3b3: 0x000d, 0x3b4: 0x000d, 0x3b5: 0x000d,
+	0x3b6: 0x000d, 0x3b7: 0x000d, 0x3b8: 0x000d, 0x3b9: 0x000d, 0x3ba: 0x000d, 0x3bb: 0x000d,
+	0x3bc: 0x000d, 0x3bd: 0x000d, 0x3be: 0x000d, 0x3bf: 0x000d,
+	// Block 0xf, offset 0x3c0
+	0x3c0: 0x000d, 0x3c1: 0x000d, 0x3c2: 0x000d, 0x3c3: 0x000d, 0x3c4: 0x000d, 0x3c5: 0x000d,
+	0x3c6: 0x000d, 0x3c7: 0x000d, 0x3c8: 0x000d, 0x3c9: 0x000d, 0x3ca: 0x000d, 0x3cb: 0x000c,
+	0x3cc: 0x000c, 0x3cd: 0x000c, 0x3ce: 0x000c, 0x3cf: 0x000c, 0x3d0: 0x000c, 0x3d1: 0x000c,
+	0x3d2: 0x000c, 0x3d3: 0x000c, 0x3d4: 0x000c, 0x3d5: 0x000c, 0x3d6: 0x000c, 0x3d7: 0x000c,
+	0x3d8: 0x000c, 0x3d9: 0x000c, 0x3da: 0x000c, 0x3db: 0x000c, 0x3dc: 0x000c, 0x3dd: 0x000c,
+	0x3de: 0x000c, 0x3df: 0x000c, 0x3e0: 0x0005, 0x3e1: 0x0005, 0x3e2: 0x0005, 0x3e3: 0x0005,
+	0x3e4: 0x0005, 0x3e5: 0x0005, 0x3e6: 0x0005, 0x3e7: 0x0005, 0x3e8: 0x0005, 0x3e9: 0x0005,
+	0x3ea: 0x0004, 0x3eb: 0x0005, 0x3ec: 0x0005, 0x3ed: 0x000d, 0x3ee: 0x000d, 0x3ef: 0x000d,
+	0x3f0: 0x000c, 0x3f1: 0x000d, 0x3f2: 0x000d, 0x3f3: 0x000d, 0x3f4: 0x000d, 0x3f5: 0x000d,
+	0x3f6: 0x000d, 0x3f7: 0x000d, 0x3f8: 0x000d, 0x3f9: 0x000d, 0x3fa: 0x000d, 0x3fb: 0x000d,
+	0x3fc: 0x000d, 0x3fd: 0x000d, 0x3fe: 0x000d, 0x3ff: 0x000d,
+	// Block 0x10, offset 0x400
+	0x400: 0x000d, 0x401: 0x000d, 0x402: 0x000d, 0x403: 0x000d, 0x404: 0x000d, 0x405: 0x000d,
+	0x406: 0x000d, 0x407: 0x000d, 0x408: 0x000d, 0x409: 0x000d, 0x40a: 0x000d, 0x40b: 0x000d,
+	0x40c: 0x000d, 0x40d: 0x000d, 0x40e: 0x000d, 0x40f: 0x000d, 0x410: 0x000d, 0x411: 0x000d,
+	0x412: 0x000d, 0x413: 0x000d, 0x414: 0x000d, 0x415: 0x000d, 0x416: 0x000d, 0x417: 0x000d,
+	0x418: 0x000d, 0x419: 0x000d, 0x41a: 0x000d, 0x41b: 0x000d, 0x41c: 0x000d, 0x41d: 0x000d,
+	0x41e: 0x000d, 0x41f: 0x000d, 0x420: 0x000d, 0x421: 0x000d, 0x422: 0x000d, 0x423: 0x000d,
+	0x424: 0x000d, 0x425: 0x000d, 0x426: 0x000d, 0x427: 0x000d, 0x428: 0x000d, 0x429: 0x000d,
+	0x42a: 0x000d, 0x42b: 0x000d, 0x42c: 0x000d, 0x42d: 0x000d, 0x42e: 0x000d, 0x42f: 0x000d,
+	0x430: 0x000d, 0x431: 0x000d, 0x432: 0x000d, 0x433: 0x000d, 0x434: 0x000d, 0x435: 0x000d,
+	0x436: 0x000d, 0x437: 0x000d, 0x438: 0x000d, 0x439: 0x000d, 0x43a: 0x000d, 0x43b: 0x000d,
+	0x43c: 0x000d, 0x43d: 0x000d, 0x43e: 0x000d, 0x43f: 0x000d,
+	// Block 0x11, offset 0x440
+	0x440: 0x000d, 0x441: 0x000d, 0x442: 0x000d, 0x443: 0x000d, 0x444: 0x000d, 0x445: 0x000d,
+	0x446: 0x000d, 0x447: 0x000d, 0x448: 0x000d, 0x449: 0x000d, 0x44a: 0x000d, 0x44b: 0x000d,
+	0x44c: 0x000d, 0x44d: 0x000d, 0x44e: 0x000d, 0x44f: 0x000d, 0x450: 0x000d, 0x451: 0x000d,
+	0x452: 0x000d, 0x453: 0x000d, 0x454: 0x000d, 0x455: 0x000d, 0x456: 0x000c, 0x457: 0x000c,
+	0x458: 0x000c, 0x459: 0x000c, 0x45a: 0x000c, 0x45b: 0x000c, 0x45c: 0x000c, 0x45d: 0x0005,
+	0x45e: 0x000a, 0x45f: 0x000c, 0x460: 0x000c, 0x461: 0x000c, 0x462: 0x000c, 0x463: 0x000c,
+	0x464: 0x000c, 0x465: 0x000d, 0x466: 0x000d, 0x467: 0x000c, 0x468: 0x000c, 0x469: 0x000a,
+	0x46a: 0x000c, 0x46b: 0x000c, 0x46c: 0x000c, 0x46d: 0x000c, 0x46e: 0x000d, 0x46f: 0x000d,
+	0x470: 0x0002, 0x471: 0x0002, 0x472: 0x0002, 0x473: 0x0002, 0x474: 0x0002, 0x475: 0x0002,
+	0x476: 0x0002, 0x477: 0x0002, 0x478: 0x0002, 0x479: 0x0002, 0x47a: 0x000d, 0x47b: 0x000d,
+	0x47c: 0x000d, 0x47d: 0x000d, 0x47e: 0x000d, 0x47f: 0x000d,
+	// Block 0x12, offset 0x480
+	0x480: 0x000d, 0x481: 0x000d, 0x482: 0x000d, 0x483: 0x000d, 0x484: 0x000d, 0x485: 0x000d,
+	0x486: 0x000d, 0x487: 0x000d, 0x488: 0x000d, 0x489: 0x000d, 0x48a: 0x000d, 0x48b: 0x000d,
+	0x48c: 0x000d, 0x48d: 0x000d, 0x48e: 0x000d, 0x48f: 0x000d, 0x490: 0x000d, 0x491: 0x000c,
+	0x492: 0x000d, 0x493: 0x000d, 0x494: 0x000d, 0x495: 0x000d, 0x496: 0x000d, 0x497: 0x000d,
+	0x498: 0x000d, 0x499: 0x000d, 0x49a: 0x000d, 0x49b: 0x000d, 0x49c: 0x000d, 0x49d: 0x000d,
+	0x49e: 0x000d, 0x49f: 0x000d, 0x4a0: 0x000d, 0x4a1: 0x000d, 0x4a2: 0x000d, 0x4a3: 0x000d,
+	0x4a4: 0x000d, 0x4a5: 0x000d, 0x4a6: 0x000d, 0x4a7: 0x000d, 0x4a8: 0x000d, 0x4a9: 0x000d,
+	0x4aa: 0x000d, 0x4ab: 0x000d, 0x4ac: 0x000d, 0x4ad: 0x000d, 0x4ae: 0x000d, 0x4af: 0x000d,
+	0x4b0: 0x000c, 0x4b1: 0x000c, 0x4b2: 0x000c, 0x4b3: 0x000c, 0x4b4: 0x000c, 0x4b5: 0x000c,
+	0x4b6: 0x000c, 0x4b7: 0x000c, 0x4b8: 0x000c, 0x4b9: 0x000c, 0x4ba: 0x000c, 0x4bb: 0x000c,
+	0x4bc: 0x000c, 0x4bd: 0x000c, 0x4be: 0x000c, 0x4bf: 0x000c,
+	// Block 0x13, offset 0x4c0
+	0x4c0: 0x000c, 0x4c1: 0x000c, 0x4c2: 0x000c, 0x4c3: 0x000c, 0x4c4: 0x000c, 0x4c5: 0x000c,
+	0x4c6: 0x000c, 0x4c7: 0x000c, 0x4c8: 0x000c, 0x4c9: 0x000c, 0x4ca: 0x000c, 0x4cb: 0x000d,
+	0x4cc: 0x000d, 0x4cd: 0x000d, 0x4ce: 0x000d, 0x4cf: 0x000d, 0x4d0: 0x000d, 0x4d1: 0x000d,
+	0x4d2: 0x000d, 0x4d3: 0x000d, 0x4d4: 0x000d, 0x4d5: 0x000d, 0x4d6: 0x000d, 0x4d7: 0x000d,
+	0x4d8: 0x000d, 0x4d9: 0x000d, 0x4da: 0x000d, 0x4db: 0x000d, 0x4dc: 0x000d, 0x4dd: 0x000d,
+	0x4de: 0x000d, 0x4df: 0x000d, 0x4e0: 0x000d, 0x4e1: 0x000d, 0x4e2: 0x000d, 0x4e3: 0x000d,
+	0x4e4: 0x000d, 0x4e5: 0x000d, 0x4e6: 0x000d, 0x4e7: 0x000d, 0x4e8: 0x000d, 0x4e9: 0x000d,
+	0x4ea: 0x000d, 0x4eb: 0x000d, 0x4ec: 0x000d, 0x4ed: 0x000d, 0x4ee: 0x000d, 0x4ef: 0x000d,
+	0x4f0: 0x000d, 0x4f1: 0x000d, 0x4f2: 0x000d, 0x4f3: 0x000d, 0x4f4: 0x000d, 0x4f5: 0x000d,
+	0x4f6: 0x000d, 0x4f7: 0x000d, 0x4f8: 0x000d, 0x4f9: 0x000d, 0x4fa: 0x000d, 0x4fb: 0x000d,
+	0x4fc: 0x000d, 0x4fd: 0x000d, 0x4fe: 0x000d, 0x4ff: 0x000d,
+	// Block 0x14, offset 0x500
+	0x500: 0x000d, 0x501: 0x000d, 0x502: 0x000d, 0x503: 0x000d, 0x504: 0x000d, 0x505: 0x000d,
+	0x506: 0x000d, 0x507: 0x000d, 0x508: 0x000d, 0x509: 0x000d, 0x50a: 0x000d, 0x50b: 0x000d,
+	0x50c: 0x000d, 0x50d: 0x000d, 0x50e: 0x000d, 0x50f: 0x000d, 0x510: 0x000d, 0x511: 0x000d,
+	0x512: 0x000d, 0x513: 0x000d, 0x514: 0x000d, 0x515: 0x000d, 0x516: 0x000d, 0x517: 0x000d,
+	0x518: 0x000d, 0x519: 0x000d, 0x51a: 0x000d, 0x51b: 0x000d, 0x51c: 0x000d, 0x51d: 0x000d,
+	0x51e: 0x000d, 0x51f: 0x000d, 0x520: 0x000d, 0x521: 0x000d, 0x522: 0x000d, 0x523: 0x000d,
+	0x524: 0x000d, 0x525: 0x000d, 0x526: 0x000c, 0x527: 0x000c, 0x528: 0x000c, 0x529: 0x000c,
+	0x52a: 0x000c, 0x52b: 0x000c, 0x52c: 0x000c, 0x52d: 0x000c, 0x52e: 0x000c, 0x52f: 0x000c,
+	0x530: 0x000c, 0x531: 0x000d, 0x532: 0x000d, 0x533: 0x000d, 0x534: 0x000d, 0x535: 0x000d,
+	0x536: 0x000d, 0x537: 0x000d, 0x538: 0x000d, 0x539: 0x000d, 0x53a: 0x000d, 0x53b: 0x000d,
+	0x53c: 0x000d, 0x53d: 0x000d, 0x53e: 0x000d, 0x53f: 0x000d,
+	// Block 0x15, offset 0x540
+	0x540: 0x0001, 0x541: 0x0001, 0x542: 0x0001, 0x543: 0x0001, 0x544: 0x0001, 0x545: 0x0001,
+	0x546: 0x0001, 0x547: 0x0001, 0x548: 0x0001, 0x549: 0x0001, 0x54a: 0x0001, 0x54b: 0x0001,
+	0x54c: 0x0001, 0x54d: 0x0001, 0x54e: 0x0001, 0x54f: 0x0001, 0x550: 0x0001, 0x551: 0x0001,
+	0x552: 0x0001, 0x553: 0x0001, 0x554: 0x0001, 0x555: 0x0001, 0x556: 0x0001, 0x557: 0x0001,
+	0x558: 0x0001, 0x559: 0x0001, 0x55a: 0x0001, 0x55b: 0x0001, 0x55c: 0x0001, 0x55d: 0x0001,
+	0x55e: 0x0001, 0x55f: 0x0001, 0x560: 0x0001, 0x561: 0x0001, 0x562: 0x0001, 0x563: 0x0001,
+	0x564: 0x0001, 0x565: 0x0001, 0x566: 0x0001, 0x567: 0x0001, 0x568: 0x0001, 0x569: 0x0001,
+	0x56a: 0x0001, 0x56b: 0x000c, 0x56c: 0x000c, 0x56d: 0x000c, 0x56e: 0x000c, 0x56f: 0x000c,
+	0x570: 0x000c, 0x571: 0x000c, 0x572: 0x000c, 0x573: 0x000c, 0x574: 0x0001, 0x575: 0x0001,
+	0x576: 0x000a, 0x577: 0x000a, 0x578: 0x000a, 0x579: 0x000a, 0x57a: 0x0001, 0x57b: 0x0001,
+	0x57c: 0x0001, 0x57d: 0x000c, 0x57e: 0x0001, 0x57f: 0x0001,
+	// Block 0x16, offset 0x580
+	0x580: 0x0001, 0x581: 0x0001, 0x582: 0x0001, 0x583: 0x0001, 0x584: 0x0001, 0x585: 0x0001,
+	0x586: 0x0001, 0x587: 0x0001, 0x588: 0x0001, 0x589: 0x0001, 0x58a: 0x0001, 0x58b: 0x0001,
+	0x58c: 0x0001, 0x58d: 0x0001, 0x58e: 0x0001, 0x58f: 0x0001, 0x590: 0x0001, 0x591: 0x0001,
+	0x592: 0x0001, 0x593: 0x0001, 0x594: 0x0001, 0x595: 0x0001, 0x596: 0x000c, 0x597: 0x000c,
+	0x598: 0x000c, 0x599: 0x000c, 0x59a: 0x0001, 0x59b: 0x000c, 0x59c: 0x000c, 0x59d: 0x000c,
+	0x59e: 0x000c, 0x59f: 0x000c, 0x5a0: 0x000c, 0x5a1: 0x000c, 0x5a2: 0x000c, 0x5a3: 0x000c,
+	0x5a4: 0x0001, 0x5a5: 0x000c, 0x5a6: 0x000c, 0x5a7: 0x000c, 0x5a8: 0x0001, 0x5a9: 0x000c,
+	0x5aa: 0x000c, 0x5ab: 0x000c, 0x5ac: 0x000c, 0x5ad: 0x000c, 0x5ae: 0x0001, 0x5af: 0x0001,
+	0x5b0: 0x0001, 0x5b1: 0x0001, 0x5b2: 0x0001, 0x5b3: 0x0001, 0x5b4: 0x0001, 0x5b5: 0x0001,
+	0x5b6: 0x0001, 0x5b7: 0x0001, 0x5b8: 0x0001, 0x5b9: 0x0001, 0x5ba: 0x0001, 0x5bb: 0x0001,
+	0x5bc: 0x0001, 0x5bd: 0x0001, 0x5be: 0x0001, 0x5bf: 0x0001,
+	// Block 0x17, offset 0x5c0
+	0x5c0: 0x0001, 0x5c1: 0x0001, 0x5c2: 0x0001, 0x5c3: 0x0001, 0x5c4: 0x0001, 0x5c5: 0x0001,
+	0x5c6: 0x0001, 0x5c7: 0x0001, 0x5c8: 0x0001, 0x5c9: 0x0001, 0x5ca: 0x0001, 0x5cb: 0x0001,
+	0x5cc: 0x0001, 0x5cd: 0x0001, 0x5ce: 0x0001, 0x5cf: 0x0001, 0x5d0: 0x0001, 0x5d1: 0x0001,
+	0x5d2: 0x0001, 0x5d3: 0x0001, 0x5d4: 0x0001, 0x5d5: 0x0001, 0x5d6: 0x0001, 0x5d7: 0x0001,
+	0x5d8: 0x0001, 0x5d9: 0x000c, 0x5da: 0x000c, 0x5db: 0x000c, 0x5dc: 0x0001, 0x5dd: 0x0001,
+	0x5de: 0x0001, 0x5df: 0x0001, 0x5e0: 0x000d, 0x5e1: 0x000d, 0x5e2: 0x000d, 0x5e3: 0x000d,
+	0x5e4: 0x000d, 0x5e5: 0x000d, 0x5e6: 0x000d, 0x5e7: 0x000d, 0x5e8: 0x000d, 0x5e9: 0x000d,
+	0x5ea: 0x000d, 0x5eb: 0x0001, 0x5ec: 0x0001, 0x5ed: 0x0001, 0x5ee: 0x0001, 0x5ef: 0x0001,
+	0x5f0: 0x000d, 0x5f1: 0x000d, 0x5f2: 0x000d, 0x5f3: 0x000d, 0x5f4: 0x000d, 0x5f5: 0x000d,
+	0x5f6: 0x000d, 0x5f7: 0x000d, 0x5f8: 0x000d, 0x5f9: 0x000d, 0x5fa: 0x000d, 0x5fb: 0x000d,
+	0x5fc: 0x000d, 0x5fd: 0x000d, 0x5fe: 0x000d, 0x5ff: 0x000d,
+	// Block 0x18, offset 0x600
+	0x600: 0x000d, 0x601: 0x000d, 0x602: 0x000d, 0x603: 0x000d, 0x604: 0x000d, 0x605: 0x000d,
+	0x606: 0x000d, 0x607: 0x000d, 0x608: 0x000d, 0x609: 0x000d, 0x60a: 0x000d, 0x60b: 0x000d,
+	0x60c: 0x000d, 0x60d: 0x000d, 0x60e: 0x000d, 0x60f: 0x0001, 0x610: 0x0005, 0x611: 0x0005,
+	0x612: 0x0001, 0x613: 0x0001, 0x614: 0x0001, 0x615: 0x0001, 0x616: 0x0001, 0x617: 0x0001,
+	0x618: 0x000c, 0x619: 0x000c, 0x61a: 0x000c, 0x61b: 0x000c, 0x61c: 0x000c, 0x61d: 0x000c,
+	0x61e: 0x000c, 0x61f: 0x000c, 0x620: 0x000d, 0x621: 0x000d, 0x622: 0x000d, 0x623: 0x000d,
+	0x624: 0x000d, 0x625: 0x000d, 0x626: 0x000d, 0x627: 0x000d, 0x628: 0x000d, 0x629: 0x000d,
+	0x62a: 0x000d, 0x62b: 0x000d, 0x62c: 0x000d, 0x62d: 0x000d, 0x62e: 0x000d, 0x62f: 0x000d,
+	0x630: 0x000d, 0x631: 0x000d, 0x632: 0x000d, 0x633: 0x000d, 0x634: 0x000d, 0x635: 0x000d,
+	0x636: 0x000d, 0x637: 0x000d, 0x638: 0x000d, 0x639: 0x000d, 0x63a: 0x000d, 0x63b: 0x000d,
+	0x63c: 0x000d, 0x63d: 0x000d, 0x63e: 0x000d, 0x63f: 0x000d,
+	// Block 0x19, offset 0x640
+	0x640: 0x000d, 0x641: 0x000d, 0x642: 0x000d, 0x643: 0x000d, 0x644: 0x000d, 0x645: 0x000d,
+	0x646: 0x000d, 0x647: 0x000d, 0x648: 0x000d, 0x649: 0x000d, 0x64a: 0x000c, 0x64b: 0x000c,
+	0x64c: 0x000c, 0x64d: 0x000c, 0x64e: 0x000c, 0x64f: 0x000c, 0x650: 0x000c, 0x651: 0x000c,
+	0x652: 0x000c, 0x653: 0x000c, 0x654: 0x000c, 0x655: 0x000c, 0x656: 0x000c, 0x657: 0x000c,
+	0x658: 0x000c, 0x659: 0x000c, 0x65a: 0x000c, 0x65b: 0x000c, 0x65c: 0x000c, 0x65d: 0x000c,
+	0x65e: 0x000c, 0x65f: 0x000c, 0x660: 0x000c, 0x661: 0x000c, 0x662: 0x0005, 0x663: 0x000c,
+	0x664: 0x000c, 0x665: 0x000c, 0x666: 0x000c, 0x667: 0x000c, 0x668: 0x000c, 0x669: 0x000c,
+	0x66a: 0x000c, 0x66b: 0x000c, 0x66c: 0x000c, 0x66d: 0x000c, 0x66e: 0x000c, 0x66f: 0x000c,
+	0x670: 0x000c, 0x671: 0x000c, 0x672: 0x000c, 0x673: 0x000c, 0x674: 0x000c, 0x675: 0x000c,
+	0x676: 0x000c, 0x677: 0x000c, 0x678: 0x000c, 0x679: 0x000c, 0x67a: 0x000c, 0x67b: 0x000c,
+	0x67c: 0x000c, 0x67d: 0x000c, 0x67e: 0x000c, 0x67f: 0x000c,
+	// Block 0x1a, offset 0x680
+	0x680: 0x000c, 0x681: 0x000c, 0x682: 0x000c,
+	0x6ba: 0x000c,
+	0x6bc: 0x000c,
+	// Block 0x1b, offset 0x6c0
+	0x6c1: 0x000c, 0x6c2: 0x000c, 0x6c3: 0x000c, 0x6c4: 0x000c, 0x6c5: 0x000c,
+	0x6c6: 0x000c, 0x6c7: 0x000c, 0x6c8: 0x000c,
+	0x6cd: 0x000c, 0x6d1: 0x000c,
+	0x6d2: 0x000c, 0x6d3: 0x000c, 0x6d4: 0x000c, 0x6d5: 0x000c, 0x6d6: 0x000c, 0x6d7: 0x000c,
+	0x6e2: 0x000c, 0x6e3: 0x000c,
+	// Block 0x1c, offset 0x700
+	0x701: 0x000c,
+	0x73c: 0x000c,
+	// Block 0x1d, offset 0x740
+	0x741: 0x000c, 0x742: 0x000c, 0x743: 0x000c, 0x744: 0x000c,
+	0x74d: 0x000c,
+	0x762: 0x000c, 0x763: 0x000c,
+	0x772: 0x0004, 0x773: 0x0004,
+	0x77b: 0x0004,
+	0x77e: 0x000c,
+	// Block 0x1e, offset 0x780
+	0x781: 0x000c, 0x782: 0x000c,
+	0x7bc: 0x000c,
+	// Block 0x1f, offset 0x7c0
+	0x7c1: 0x000c, 0x7c2: 0x000c,
+	0x7c7: 0x000c, 0x7c8: 0x000c, 0x7cb: 0x000c,
+	0x7cc: 0x000c, 0x7cd: 0x000c, 0x7d1: 0x000c,
+	0x7f0: 0x000c, 0x7f1: 0x000c, 0x7f5: 0x000c,
+	// Block 0x20, offset 0x800
+	0x801: 0x000c, 0x802: 0x000c, 0x803: 0x000c, 0x804: 0x000c, 0x805: 0x000c,
+	0x807: 0x000c, 0x808: 0x000c,
+	0x80d: 0x000c,
+	0x822: 0x000c, 0x823: 0x000c,
+	0x831: 0x0004,
+	0x83a: 0x000c, 0x83b: 0x000c,
+	0x83c: 0x000c, 0x83d: 0x000c, 0x83e: 0x000c, 0x83f: 0x000c,
+	// Block 0x21, offset 0x840
+	0x841: 0x000c,
+	0x87c: 0x000c, 0x87f: 0x000c,
+	// Block 0x22, offset 0x880
+	0x881: 0x000c, 0x882: 0x000c, 0x883: 0x000c, 0x884: 0x000c,
+	0x88d: 0x000c,
+	0x895: 0x000c, 0x896: 0x000c,
+	0x8a2: 0x000c, 0x8a3: 0x000c,
+	// Block 0x23, offset 0x8c0
+	0x8c2: 0x000c,
+	// Block 0x24, offset 0x900
+	0x900: 0x000c,
+	0x90d: 0x000c,
+	0x933: 0x000a, 0x934: 0x000a, 0x935: 0x000a,
+	0x936: 0x000a, 0x937: 0x000a, 0x938: 0x000a, 0x939: 0x0004, 0x93a: 0x000a,
+	// Block 0x25, offset 0x940
+	0x940: 0x000c, 0x944: 0x000c,
+	0x97c: 0x000c, 0x97e: 0x000c, 0x97f: 0x000c,
+	// Block 0x26, offset 0x980
+	0x980: 0x000c,
+	0x986: 0x000c, 0x987: 0x000c, 0x988: 0x000c, 0x98a: 0x000c, 0x98b: 0x000c,
+	0x98c: 0x000c, 0x98d: 0x000c,
+	0x995: 0x000c, 0x996: 0x000c,
+	0x9a2: 0x000c, 0x9a3: 0x000c,
+	0x9b8: 0x000a, 0x9b9: 0x000a, 0x9ba: 0x000a, 0x9bb: 0x000a,
+	0x9bc: 0x000a, 0x9bd: 0x000a, 0x9be: 0x000a,
+	// Block 0x27, offset 0x9c0
+	0x9cc: 0x000c, 0x9cd: 0x000c,
+	0x9e2: 0x000c, 0x9e3: 0x000c,
+	// Block 0x28, offset 0xa00
+	0xa00: 0x000c, 0xa01: 0x000c,
+	0xa3b: 0x000c,
+	0xa3c: 0x000c,
+	// Block 0x29, offset 0xa40
+	0xa41: 0x000c, 0xa42: 0x000c, 0xa43: 0x000c, 0xa44: 0x000c,
+	0xa4d: 0x000c,
+	0xa62: 0x000c, 0xa63: 0x000c,
+	// Block 0x2a, offset 0xa80
+	0xa81: 0x000c,
+	// Block 0x2b, offset 0xac0
+	0xaca: 0x000c,
+	0xad2: 0x000c, 0xad3: 0x000c, 0xad4: 0x000c, 0xad6: 0x000c,
+	// Block 0x2c, offset 0xb00
+	0xb31: 0x000c, 0xb34: 0x000c, 0xb35: 0x000c,
+	0xb36: 0x000c, 0xb37: 0x000c, 0xb38: 0x000c, 0xb39: 0x000c, 0xb3a: 0x000c,
+	0xb3f: 0x0004,
+	// Block 0x2d, offset 0xb40
+	0xb47: 0x000c, 0xb48: 0x000c, 0xb49: 0x000c, 0xb4a: 0x000c, 0xb4b: 0x000c,
+	0xb4c: 0x000c, 0xb4d: 0x000c, 0xb4e: 0x000c,
+	// Block 0x2e, offset 0xb80
+	0xbb1: 0x000c, 0xbb4: 0x000c, 0xbb5: 0x000c,
+	0xbb6: 0x000c, 0xbb7: 0x000c, 0xbb8: 0x000c, 0xbb9: 0x000c, 0xbba: 0x000c, 0xbbb: 0x000c,
+	0xbbc: 0x000c,
+	// Block 0x2f, offset 0xbc0
+	0xbc8: 0x000c, 0xbc9: 0x000c, 0xbca: 0x000c, 0xbcb: 0x000c,
+	0xbcc: 0x000c, 0xbcd: 0x000c, 0xbce: 0x000c,
+	// Block 0x30, offset 0xc00
+	0xc18: 0x000c, 0xc19: 0x000c,
+	0xc35: 0x000c,
+	0xc37: 0x000c, 0xc39: 0x000c, 0xc3a: 0x003a, 0xc3b: 0x002a,
+	0xc3c: 0x003a, 0xc3d: 0x002a,
+	// Block 0x31, offset 0xc40
+	0xc71: 0x000c, 0xc72: 0x000c, 0xc73: 0x000c, 0xc74: 0x000c, 0xc75: 0x000c,
+	0xc76: 0x000c, 0xc77: 0x000c, 0xc78: 0x000c, 0xc79: 0x000c, 0xc7a: 0x000c, 0xc7b: 0x000c,
+	0xc7c: 0x000c, 0xc7d: 0x000c, 0xc7e: 0x000c,
+	// Block 0x32, offset 0xc80
+	0xc80: 0x000c, 0xc81: 0x000c, 0xc82: 0x000c, 0xc83: 0x000c, 0xc84: 0x000c,
+	0xc86: 0x000c, 0xc87: 0x000c,
+	0xc8d: 0x000c, 0xc8e: 0x000c, 0xc8f: 0x000c, 0xc90: 0x000c, 0xc91: 0x000c,
+	0xc92: 0x000c, 0xc93: 0x000c, 0xc94: 0x000c, 0xc95: 0x000c, 0xc96: 0x000c, 0xc97: 0x000c,
+	0xc99: 0x000c, 0xc9a: 0x000c, 0xc9b: 0x000c, 0xc9c: 0x000c, 0xc9d: 0x000c,
+	0xc9e: 0x000c, 0xc9f: 0x000c, 0xca0: 0x000c, 0xca1: 0x000c, 0xca2: 0x000c, 0xca3: 0x000c,
+	0xca4: 0x000c, 0xca5: 0x000c, 0xca6: 0x000c, 0xca7: 0x000c, 0xca8: 0x000c, 0xca9: 0x000c,
+	0xcaa: 0x000c, 0xcab: 0x000c, 0xcac: 0x000c, 0xcad: 0x000c, 0xcae: 0x000c, 0xcaf: 0x000c,
+	0xcb0: 0x000c, 0xcb1: 0x000c, 0xcb2: 0x000c, 0xcb3: 0x000c, 0xcb4: 0x000c, 0xcb5: 0x000c,
+	0xcb6: 0x000c, 0xcb7: 0x000c, 0xcb8: 0x000c, 0xcb9: 0x000c, 0xcba: 0x000c, 0xcbb: 0x000c,
+	0xcbc: 0x000c,
+	// Block 0x33, offset 0xcc0
+	0xcc6: 0x000c,
+	// Block 0x34, offset 0xd00
+	0xd2d: 0x000c, 0xd2e: 0x000c, 0xd2f: 0x000c,
+	0xd30: 0x000c, 0xd32: 0x000c, 0xd33: 0x000c, 0xd34: 0x000c, 0xd35: 0x000c,
+	0xd36: 0x000c, 0xd37: 0x000c, 0xd39: 0x000c, 0xd3a: 0x000c,
+	0xd3d: 0x000c, 0xd3e: 0x000c,
+	// Block 0x35, offset 0xd40
+	0xd58: 0x000c, 0xd59: 0x000c,
+	0xd5e: 0x000c, 0xd5f: 0x000c, 0xd60: 0x000c,
+	0xd71: 0x000c, 0xd72: 0x000c, 0xd73: 0x000c, 0xd74: 0x000c,
+	// Block 0x36, offset 0xd80
+	0xd82: 0x000c, 0xd85: 0x000c,
+	0xd86: 0x000c,
+	0xd8d: 0x000c,
+	0xd9d: 0x000c,
+	// Block 0x37, offset 0xdc0
+	0xddd: 0x000c,
+	0xdde: 0x000c, 0xddf: 0x000c,
+	// Block 0x38, offset 0xe00
+	0xe10: 0x000a, 0xe11: 0x000a,
+	0xe12: 0x000a, 0xe13: 0x000a, 0xe14: 0x000a, 0xe15: 0x000a, 0xe16: 0x000a, 0xe17: 0x000a,
+	0xe18: 0x000a, 0xe19: 0x000a,
+	// Block 0x39, offset 0xe40
+	0xe40: 0x000a,
+	// Block 0x3a, offset 0xe80
+	0xe80: 0x0009,
+	0xe9b: 0x007a, 0xe9c: 0x006a,
+	// Block 0x3b, offset 0xec0
+	0xed2: 0x000c, 0xed3: 0x000c, 0xed4: 0x000c,
+	0xef2: 0x000c, 0xef3: 0x000c,
+	// Block 0x3c, offset 0xf00
+	0xf12: 0x000c, 0xf13: 0x000c,
+	0xf32: 0x000c, 0xf33: 0x000c,
+	// Block 0x3d, offset 0xf40
+	0xf74: 0x000c, 0xf75: 0x000c,
+	0xf77: 0x000c, 0xf78: 0x000c, 0xf79: 0x000c, 0xf7a: 0x000c, 0xf7b: 0x000c,
+	0xf7c: 0x000c, 0xf7d: 0x000c,
+	// Block 0x3e, offset 0xf80
+	0xf86: 0x000c, 0xf89: 0x000c, 0xf8a: 0x000c, 0xf8b: 0x000c,
+	0xf8c: 0x000c, 0xf8d: 0x000c, 0xf8e: 0x000c, 0xf8f: 0x000c, 0xf90: 0x000c, 0xf91: 0x000c,
+	0xf92: 0x000c, 0xf93: 0x000c,
+	0xf9b: 0x0004, 0xf9d: 0x000c,
+	0xfb0: 0x000a, 0xfb1: 0x000a, 0xfb2: 0x000a, 0xfb3: 0x000a, 0xfb4: 0x000a, 0xfb5: 0x000a,
+	0xfb6: 0x000a, 0xfb7: 0x000a, 0xfb8: 0x000a, 0xfb9: 0x000a,
+	// Block 0x3f, offset 0xfc0
+	0xfc0: 0x000a, 0xfc1: 0x000a, 0xfc2: 0x000a, 0xfc3: 0x000a, 0xfc4: 0x000a, 0xfc5: 0x000a,
+	0xfc6: 0x000a, 0xfc7: 0x000a, 0xfc8: 0x000a, 0xfc9: 0x000a, 0xfca: 0x000a, 0xfcb: 0x000c,
+	0xfcc: 0x000c, 0xfcd: 0x000c, 0xfce: 0x000b, 0xfcf: 0x000c,
+	// Block 0x40, offset 0x1000
+	0x1005: 0x000c,
+	0x1006: 0x000c,
+	0x1029: 0x000c,
+	// Block 0x41, offset 0x1040
+	0x1060: 0x000c, 0x1061: 0x000c, 0x1062: 0x000c,
+	0x1067: 0x000c, 0x1068: 0x000c,
+	0x1072: 0x000c,
+	0x1079: 0x000c, 0x107a: 0x000c, 0x107b: 0x000c,
+	// Block 0x42, offset 0x1080
+	0x1080: 0x000a, 0x1084: 0x000a, 0x1085: 0x000a,
+	// Block 0x43, offset 0x10c0
+	0x10de: 0x000a, 0x10df: 0x000a, 0x10e0: 0x000a, 0x10e1: 0x000a, 0x10e2: 0x000a, 0x10e3: 0x000a,
+	0x10e4: 0x000a, 0x10e5: 0x000a, 0x10e6: 0x000a, 0x10e7: 0x000a, 0x10e8: 0x000a, 0x10e9: 0x000a,
+	0x10ea: 0x000a, 0x10eb: 0x000a, 0x10ec: 0x000a, 0x10ed: 0x000a, 0x10ee: 0x000a, 0x10ef: 0x000a,
+	0x10f0: 0x000a, 0x10f1: 0x000a, 0x10f2: 0x000a, 0x10f3: 0x000a, 0x10f4: 0x000a, 0x10f5: 0x000a,
+	0x10f6: 0x000a, 0x10f7: 0x000a, 0x10f8: 0x000a, 0x10f9: 0x000a, 0x10fa: 0x000a, 0x10fb: 0x000a,
+	0x10fc: 0x000a, 0x10fd: 0x000a, 0x10fe: 0x000a, 0x10ff: 0x000a,
+	// Block 0x44, offset 0x1100
+	0x1117: 0x000c,
+	0x1118: 0x000c, 0x111b: 0x000c,
+	// Block 0x45, offset 0x1140
+	0x1156: 0x000c,
+	0x1158: 0x000c, 0x1159: 0x000c, 0x115a: 0x000c, 0x115b: 0x000c, 0x115c: 0x000c, 0x115d: 0x000c,
+	0x115e: 0x000c, 0x1160: 0x000c, 0x1162: 0x000c,
+	0x1165: 0x000c, 0x1166: 0x000c, 0x1167: 0x000c, 0x1168: 0x000c, 0x1169: 0x000c,
+	0x116a: 0x000c, 0x116b: 0x000c, 0x116c: 0x000c,
+	0x1173: 0x000c, 0x1174: 0x000c, 0x1175: 0x000c,
+	0x1176: 0x000c, 0x1177: 0x000c, 0x1178: 0x000c, 0x1179: 0x000c, 0x117a: 0x000c, 0x117b: 0x000c,
+	0x117c: 0x000c, 0x117f: 0x000c,
+	// Block 0x46, offset 0x1180
+	0x11b0: 0x000c, 0x11b1: 0x000c, 0x11b2: 0x000c, 0x11b3: 0x000c, 0x11b4: 0x000c, 0x11b5: 0x000c,
+	0x11b6: 0x000c, 0x11b7: 0x000c, 0x11b8: 0x000c, 0x11b9: 0x000c, 0x11ba: 0x000c, 0x11bb: 0x000c,
+	0x11bc: 0x000c, 0x11bd: 0x000c, 0x11be: 0x000c, 0x11bf: 0x000c,
+	// Block 0x47, offset 0x11c0
+	0x11c0: 0x000c, 0x11c1: 0x000c, 0x11c2: 0x000c, 0x11c3: 0x000c, 0x11c4: 0x000c, 0x11c5: 0x000c,
+	0x11c6: 0x000c, 0x11c7: 0x000c, 0x11c8: 0x000c, 0x11c9: 0x000c, 0x11ca: 0x000c, 0x11cb: 0x000c,
+	0x11cc: 0x000c, 0x11cd: 0x000c, 0x11ce: 0x000c,
+	// Block 0x48, offset 0x1200
+	0x1200: 0x000c, 0x1201: 0x000c, 0x1202: 0x000c, 0x1203: 0x000c,
+	0x1234: 0x000c,
+	0x1236: 0x000c, 0x1237: 0x000c, 0x1238: 0x000c, 0x1239: 0x000c, 0x123a: 0x000c,
+	0x123c: 0x000c,
+	// Block 0x49, offset 0x1240
+	0x1242: 0x000c,
+	0x126b: 0x000c, 0x126c: 0x000c, 0x126d: 0x000c, 0x126e: 0x000c, 0x126f: 0x000c,
+	0x1270: 0x000c, 0x1271: 0x000c, 0x1272: 0x000c, 0x1273: 0x000c,
+	// Block 0x4a, offset 0x1280
+	0x1280: 0x000c, 0x1281: 0x000c,
+	0x12a2: 0x000c, 0x12a3: 0x000c,
+	0x12a4: 0x000c, 0x12a5: 0x000c, 0x12a8: 0x000c, 0x12a9: 0x000c,
+	0x12ab: 0x000c, 0x12ac: 0x000c, 0x12ad: 0x000c,
+	// Block 0x4b, offset 0x12c0
+	0x12e6: 0x000c, 0x12e8: 0x000c, 0x12e9: 0x000c,
+	0x12ed: 0x000c, 0x12ef: 0x000c,
+	0x12f0: 0x000c, 0x12f1: 0x000c,
+	// Block 0x4c, offset 0x1300
+	0x132c: 0x000c, 0x132d: 0x000c, 0x132e: 0x000c, 0x132f: 0x000c,
+	0x1330: 0x000c, 0x1331: 0x000c, 0x1332: 0x000c, 0x1333: 0x000c,
+	0x1336: 0x000c, 0x1337: 0x000c,
+	// Block 0x4d, offset 0x1340
+	0x1350: 0x000c, 0x1351: 0x000c,
+	0x1352: 0x000c, 0x1354: 0x000c, 0x1355: 0x000c, 0x1356: 0x000c, 0x1357: 0x000c,
+	0x1358: 0x000c, 0x1359: 0x000c, 0x135a: 0x000c, 0x135b: 0x000c, 0x135c: 0x000c, 0x135d: 0x000c,
+	0x135e: 0x000c, 0x135f: 0x000c, 0x1360: 0x000c, 0x1362: 0x000c, 0x1363: 0x000c,
+	0x1364: 0x000c, 0x1365: 0x000c, 0x1366: 0x000c, 0x1367: 0x000c, 0x1368: 0x000c,
+	0x136d: 0x000c,
+	0x1374: 0x000c,
+	0x1378: 0x000c, 0x1379: 0x000c,
+	// Block 0x4e, offset 0x1380
+	0x13bd: 0x000a, 0x13bf: 0x000a,
+	// Block 0x4f, offset 0x13c0
+	0x13c0: 0x000a, 0x13c1: 0x000a,
+	0x13cd: 0x000a, 0x13ce: 0x000a, 0x13cf: 0x000a,
+	0x13dd: 0x000a,
+	0x13de: 0x000a, 0x13df: 0x000a,
+	0x13ed: 0x000a, 0x13ee: 0x000a, 0x13ef: 0x000a,
+	0x13fd: 0x000a, 0x13fe: 0x000a,
+	// Block 0x50, offset 0x1400
+	0x1400: 0x0009, 0x1401: 0x0009, 0x1402: 0x0009, 0x1403: 0x0009, 0x1404: 0x0009, 0x1405: 0x0009,
+	0x1406: 0x0009, 0x1407: 0x0009, 0x1408: 0x0009, 0x1409: 0x0009, 0x140a: 0x0009, 0x140b: 0x000b,
+	0x140c: 0x000b, 0x140d: 0x000b, 0x140f: 0x0001, 0x1410: 0x000a, 0x1411: 0x000a,
+	0x1412: 0x000a, 0x1413: 0x000a, 0x1414: 0x000a, 0x1415: 0x000a, 0x1416: 0x000a, 0x1417: 0x000a,
+	0x1418: 0x000a, 0x1419: 0x000a, 0x141a: 0x000a, 0x141b: 0x000a, 0x141c: 0x000a, 0x141d: 0x000a,
+	0x141e: 0x000a, 0x141f: 0x000a, 0x1420: 0x000a, 0x1421: 0x000a, 0x1422: 0x000a, 0x1423: 0x000a,
+	0x1424: 0x000a, 0x1425: 0x000a, 0x1426: 0x000a, 0x1427: 0x000a, 0x1428: 0x0009, 0x1429: 0x0007,
+	0x142a: 0x000e, 0x142b: 0x000e, 0x142c: 0x000e, 0x142d: 0x000e, 0x142e: 0x000e, 0x142f: 0x0006,
+	0x1430: 0x0004, 0x1431: 0x0004, 0x1432: 0x0004, 0x1433: 0x0004, 0x1434: 0x0004, 0x1435: 0x000a,
+	0x1436: 0x000a, 0x1437: 0x000a, 0x1438: 0x000a, 0x1439: 0x000a, 0x143a: 0x000a, 0x143b: 0x000a,
+	0x143c: 0x000a, 0x143d: 0x000a, 0x143e: 0x000a, 0x143f: 0x000a,
+	// Block 0x51, offset 0x1440
+	0x1440: 0x000a, 0x1441: 0x000a, 0x1442: 0x000a, 0x1443: 0x000a, 0x1444: 0x0006, 0x1445: 0x009a,
+	0x1446: 0x008a, 0x1447: 0x000a, 0x1448: 0x000a, 0x1449: 0x000a, 0x144a: 0x000a, 0x144b: 0x000a,
+	0x144c: 0x000a, 0x144d: 0x000a, 0x144e: 0x000a, 0x144f: 0x000a, 0x1450: 0x000a, 0x1451: 0x000a,
+	0x1452: 0x000a, 0x1453: 0x000a, 0x1454: 0x000a, 0x1455: 0x000a, 0x1456: 0x000a, 0x1457: 0x000a,
+	0x1458: 0x000a, 0x1459: 0x000a, 0x145a: 0x000a, 0x145b: 0x000a, 0x145c: 0x000a, 0x145d: 0x000a,
+	0x145e: 0x000a, 0x145f: 0x0009, 0x1460: 0x000b, 0x1461: 0x000b, 0x1462: 0x000b, 0x1463: 0x000b,
+	0x1464: 0x000b, 0x1465: 0x000b, 0x1466: 0x000e, 0x1467: 0x000e, 0x1468: 0x000e, 0x1469: 0x000e,
+	0x146a: 0x000b, 0x146b: 0x000b, 0x146c: 0x000b, 0x146d: 0x000b, 0x146e: 0x000b, 0x146f: 0x000b,
+	0x1470: 0x0002, 0x1474: 0x0002, 0x1475: 0x0002,
+	0x1476: 0x0002, 0x1477: 0x0002, 0x1478: 0x0002, 0x1479: 0x0002, 0x147a: 0x0003, 0x147b: 0x0003,
+	0x147c: 0x000a, 0x147d: 0x009a, 0x147e: 0x008a,
+	// Block 0x52, offset 0x1480
+	0x1480: 0x0002, 0x1481: 0x0002, 0x1482: 0x0002, 0x1483: 0x0002, 0x1484: 0x0002, 0x1485: 0x0002,
+	0x1486: 0x0002, 0x1487: 0x0002, 0x1488: 0x0002, 0x1489: 0x0002, 0x148a: 0x0003, 0x148b: 0x0003,
+	0x148c: 0x000a, 0x148d: 0x009a, 0x148e: 0x008a,
+	0x14a0: 0x0004, 0x14a1: 0x0004, 0x14a2: 0x0004, 0x14a3: 0x0004,
+	0x14a4: 0x0004, 0x14a5: 0x0004, 0x14a6: 0x0004, 0x14a7: 0x0004, 0x14a8: 0x0004, 0x14a9: 0x0004,
+	0x14aa: 0x0004, 0x14ab: 0x0004, 0x14ac: 0x0004, 0x14ad: 0x0004, 0x14ae: 0x0004, 0x14af: 0x0004,
+	0x14b0: 0x0004, 0x14b1: 0x0004, 0x14b2: 0x0004, 0x14b3: 0x0004, 0x14b4: 0x0004, 0x14b5: 0x0004,
+	0x14b6: 0x0004, 0x14b7: 0x0004, 0x14b8: 0x0004, 0x14b9: 0x0004, 0x14ba: 0x0004, 0x14bb: 0x0004,
+	0x14bc: 0x0004, 0x14bd: 0x0004, 0x14be: 0x0004, 0x14bf: 0x0004,
+	// Block 0x53, offset 0x14c0
+	0x14c0: 0x0004, 0x14c1: 0x0004, 0x14c2: 0x0004, 0x14c3: 0x0004, 0x14c4: 0x0004, 0x14c5: 0x0004,
+	0x14c6: 0x0004, 0x14c7: 0x0004, 0x14c8: 0x0004, 0x14c9: 0x0004, 0x14ca: 0x0004, 0x14cb: 0x0004,
+	0x14cc: 0x0004, 0x14cd: 0x0004, 0x14ce: 0x0004, 0x14cf: 0x0004, 0x14d0: 0x000c, 0x14d1: 0x000c,
+	0x14d2: 0x000c, 0x14d3: 0x000c, 0x14d4: 0x000c, 0x14d5: 0x000c, 0x14d6: 0x000c, 0x14d7: 0x000c,
+	0x14d8: 0x000c, 0x14d9: 0x000c, 0x14da: 0x000c, 0x14db: 0x000c, 0x14dc: 0x000c, 0x14dd: 0x000c,
+	0x14de: 0x000c, 0x14df: 0x000c, 0x14e0: 0x000c, 0x14e1: 0x000c, 0x14e2: 0x000c, 0x14e3: 0x000c,
+	0x14e4: 0x000c, 0x14e5: 0x000c, 0x14e6: 0x000c, 0x14e7: 0x000c, 0x14e8: 0x000c, 0x14e9: 0x000c,
+	0x14ea: 0x000c, 0x14eb: 0x000c, 0x14ec: 0x000c, 0x14ed: 0x000c, 0x14ee: 0x000c, 0x14ef: 0x000c,
+	0x14f0: 0x000c,
+	// Block 0x54, offset 0x1500
+	0x1500: 0x000a, 0x1501: 0x000a, 0x1503: 0x000a, 0x1504: 0x000a, 0x1505: 0x000a,
+	0x1506: 0x000a, 0x1508: 0x000a, 0x1509: 0x000a,
+	0x1514: 0x000a, 0x1516: 0x000a, 0x1517: 0x000a,
+	0x1518: 0x000a,
+	0x151e: 0x000a, 0x151f: 0x000a, 0x1520: 0x000a, 0x1521: 0x000a, 0x1522: 0x000a, 0x1523: 0x000a,
+	0x1525: 0x000a, 0x1527: 0x000a, 0x1529: 0x000a,
+	0x152e: 0x0004,
+	0x153a: 0x000a, 0x153b: 0x000a,
+	// Block 0x55, offset 0x1540
+	0x1540: 0x000a, 0x1541: 0x000a, 0x1542: 0x000a, 0x1543: 0x000a, 0x1544: 0x000a,
+	0x154a: 0x000a, 0x154b: 0x000a,
+	0x154c: 0x000a, 0x154d: 0x000a, 0x1550: 0x000a, 0x1551: 0x000a,
+	0x1552: 0x000a, 0x1553: 0x000a, 0x1554: 0x000a, 0x1555: 0x000a, 0x1556: 0x000a, 0x1557: 0x000a,
+	0x1558: 0x000a, 0x1559: 0x000a, 0x155a: 0x000a, 0x155b: 0x000a, 0x155c: 0x000a, 0x155d: 0x000a,
+	0x155e: 0x000a, 0x155f: 0x000a,
+	// Block 0x56, offset 0x1580
+	0x1589: 0x000a, 0x158a: 0x000a, 0x158b: 0x000a,
+	0x1590: 0x000a, 0x1591: 0x000a,
+	0x1592: 0x000a, 0x1593: 0x000a, 0x1594: 0x000a, 0x1595: 0x000a, 0x1596: 0x000a, 0x1597: 0x000a,
+	0x1598: 0x000a, 0x1599: 0x000a, 0x159a: 0x000a, 0x159b: 0x000a, 0x159c: 0x000a, 0x159d: 0x000a,
+	0x159e: 0x000a, 0x159f: 0x000a, 0x15a0: 0x000a, 0x15a1: 0x000a, 0x15a2: 0x000a, 0x15a3: 0x000a,
+	0x15a4: 0x000a, 0x15a5: 0x000a, 0x15a6: 0x000a, 0x15a7: 0x000a, 0x15a8: 0x000a, 0x15a9: 0x000a,
+	0x15aa: 0x000a, 0x15ab: 0x000a, 0x15ac: 0x000a, 0x15ad: 0x000a, 0x15ae: 0x000a, 0x15af: 0x000a,
+	0x15b0: 0x000a, 0x15b1: 0x000a, 0x15b2: 0x000a, 0x15b3: 0x000a, 0x15b4: 0x000a, 0x15b5: 0x000a,
+	0x15b6: 0x000a, 0x15b7: 0x000a, 0x15b8: 0x000a, 0x15b9: 0x000a, 0x15ba: 0x000a, 0x15bb: 0x000a,
+	0x15bc: 0x000a, 0x15bd: 0x000a, 0x15be: 0x000a, 0x15bf: 0x000a,
+	// Block 0x57, offset 0x15c0
+	0x15c0: 0x000a, 0x15c1: 0x000a, 0x15c2: 0x000a, 0x15c3: 0x000a, 0x15c4: 0x000a, 0x15c5: 0x000a,
+	0x15c6: 0x000a, 0x15c7: 0x000a, 0x15c8: 0x000a, 0x15c9: 0x000a, 0x15ca: 0x000a, 0x15cb: 0x000a,
+	0x15cc: 0x000a, 0x15cd: 0x000a, 0x15ce: 0x000a, 0x15cf: 0x000a, 0x15d0: 0x000a, 0x15d1: 0x000a,
+	0x15d2: 0x000a, 0x15d3: 0x000a, 0x15d4: 0x000a, 0x15d5: 0x000a, 0x15d6: 0x000a, 0x15d7: 0x000a,
+	0x15d8: 0x000a, 0x15d9: 0x000a, 0x15da: 0x000a, 0x15db: 0x000a, 0x15dc: 0x000a, 0x15dd: 0x000a,
+	0x15de: 0x000a, 0x15df: 0x000a, 0x15e0: 0x000a, 0x15e1: 0x000a, 0x15e2: 0x000a, 0x15e3: 0x000a,
+	0x15e4: 0x000a, 0x15e5: 0x000a, 0x15e6: 0x000a, 0x15e7: 0x000a, 0x15e8: 0x000a, 0x15e9: 0x000a,
+	0x15ea: 0x000a, 0x15eb: 0x000a, 0x15ec: 0x000a, 0x15ed: 0x000a, 0x15ee: 0x000a, 0x15ef: 0x000a,
+	0x15f0: 0x000a, 0x15f1: 0x000a, 0x15f2: 0x000a, 0x15f3: 0x000a, 0x15f4: 0x000a, 0x15f5: 0x000a,
+	0x15f6: 0x000a, 0x15f7: 0x000a, 0x15f8: 0x000a, 0x15f9: 0x000a, 0x15fa: 0x000a, 0x15fb: 0x000a,
+	0x15fc: 0x000a, 0x15fd: 0x000a, 0x15fe: 0x000a, 0x15ff: 0x000a,
+	// Block 0x58, offset 0x1600
+	0x1600: 0x000a, 0x1601: 0x000a, 0x1602: 0x000a, 0x1603: 0x000a, 0x1604: 0x000a, 0x1605: 0x000a,
+	0x1606: 0x000a, 0x1607: 0x000a, 0x1608: 0x000a, 0x1609: 0x000a, 0x160a: 0x000a, 0x160b: 0x000a,
+	0x160c: 0x000a, 0x160d: 0x000a, 0x160e: 0x000a, 0x160f: 0x000a, 0x1610: 0x000a, 0x1611: 0x000a,
+	0x1612: 0x0003, 0x1613: 0x0004, 0x1614: 0x000a, 0x1615: 0x000a, 0x1616: 0x000a, 0x1617: 0x000a,
+	0x1618: 0x000a, 0x1619: 0x000a, 0x161a: 0x000a, 0x161b: 0x000a, 0x161c: 0x000a, 0x161d: 0x000a,
+	0x161e: 0x000a, 0x161f: 0x000a, 0x1620: 0x000a, 0x1621: 0x000a, 0x1622: 0x000a, 0x1623: 0x000a,
+	0x1624: 0x000a, 0x1625: 0x000a, 0x1626: 0x000a, 0x1627: 0x000a, 0x1628: 0x000a, 0x1629: 0x000a,
+	0x162a: 0x000a, 0x162b: 0x000a, 0x162c: 0x000a, 0x162d: 0x000a, 0x162e: 0x000a, 0x162f: 0x000a,
+	0x1630: 0x000a, 0x1631: 0x000a, 0x1632: 0x000a, 0x1633: 0x000a, 0x1634: 0x000a, 0x1635: 0x000a,
+	0x1636: 0x000a, 0x1637: 0x000a, 0x1638: 0x000a, 0x1639: 0x000a, 0x163a: 0x000a, 0x163b: 0x000a,
+	0x163c: 0x000a, 0x163d: 0x000a, 0x163e: 0x000a, 0x163f: 0x000a,
+	// Block 0x59, offset 0x1640
+	0x1640: 0x000a, 0x1641: 0x000a, 0x1642: 0x000a, 0x1643: 0x000a, 0x1644: 0x000a, 0x1645: 0x000a,
+	0x1646: 0x000a, 0x1647: 0x000a, 0x1648: 0x003a, 0x1649: 0x002a, 0x164a: 0x003a, 0x164b: 0x002a,
+	0x164c: 0x000a, 0x164d: 0x000a, 0x164e: 0x000a, 0x164f: 0x000a, 0x1650: 0x000a, 0x1651: 0x000a,
+	0x1652: 0x000a, 0x1653: 0x000a, 0x1654: 0x000a, 0x1655: 0x000a, 0x1656: 0x000a, 0x1657: 0x000a,
+	0x1658: 0x000a, 0x1659: 0x000a, 0x165a: 0x000a, 0x165b: 0x000a, 0x165c: 0x000a, 0x165d: 0x000a,
+	0x165e: 0x000a, 0x165f: 0x000a, 0x1660: 0x000a, 0x1661: 0x000a, 0x1662: 0x000a, 0x1663: 0x000a,
+	0x1664: 0x000a, 0x1665: 0x000a, 0x1666: 0x000a, 0x1667: 0x000a, 0x1668: 0x000a, 0x1669: 0x009a,
+	0x166a: 0x008a, 0x166b: 0x000a, 0x166c: 0x000a, 0x166d: 0x000a, 0x166e: 0x000a, 0x166f: 0x000a,
+	0x1670: 0x000a, 0x1671: 0x000a, 0x1672: 0x000a, 0x1673: 0x000a, 0x1674: 0x000a, 0x1675: 0x000a,
+	// Block 0x5a, offset 0x1680
+	0x16bb: 0x000a,
+	0x16bc: 0x000a, 0x16bd: 0x000a, 0x16be: 0x000a, 0x16bf: 0x000a,
+	// Block 0x5b, offset 0x16c0
+	0x16c0: 0x000a, 0x16c1: 0x000a, 0x16c2: 0x000a, 0x16c3: 0x000a, 0x16c4: 0x000a, 0x16c5: 0x000a,
+	0x16c6: 0x000a, 0x16c7: 0x000a, 0x16c8: 0x000a, 0x16c9: 0x000a, 0x16ca: 0x000a, 0x16cb: 0x000a,
+	0x16cc: 0x000a, 0x16cd: 0x000a, 0x16ce: 0x000a, 0x16cf: 0x000a, 0x16d0: 0x000a, 0x16d1: 0x000a,
+	0x16d2: 0x000a, 0x16d3: 0x000a, 0x16d4: 0x000a, 0x16d6: 0x000a, 0x16d7: 0x000a,
+	0x16d8: 0x000a, 0x16d9: 0x000a, 0x16da: 0x000a, 0x16db: 0x000a, 0x16dc: 0x000a, 0x16dd: 0x000a,
+	0x16de: 0x000a, 0x16df: 0x000a, 0x16e0: 0x000a, 0x16e1: 0x000a, 0x16e2: 0x000a, 0x16e3: 0x000a,
+	0x16e4: 0x000a, 0x16e5: 0x000a, 0x16e6: 0x000a, 0x16e7: 0x000a, 0x16e8: 0x000a, 0x16e9: 0x000a,
+	0x16ea: 0x000a, 0x16eb: 0x000a, 0x16ec: 0x000a, 0x16ed: 0x000a, 0x16ee: 0x000a, 0x16ef: 0x000a,
+	0x16f0: 0x000a, 0x16f1: 0x000a, 0x16f2: 0x000a, 0x16f3: 0x000a, 0x16f4: 0x000a, 0x16f5: 0x000a,
+	0x16f6: 0x000a, 0x16f7: 0x000a, 0x16f8: 0x000a, 0x16f9: 0x000a, 0x16fa: 0x000a, 0x16fb: 0x000a,
+	0x16fc: 0x000a, 0x16fd: 0x000a, 0x16fe: 0x000a, 0x16ff: 0x000a,
+	// Block 0x5c, offset 0x1700
+	0x1700: 0x000a, 0x1701: 0x000a, 0x1702: 0x000a, 0x1703: 0x000a, 0x1704: 0x000a, 0x1705: 0x000a,
+	0x1706: 0x000a, 0x1707: 0x000a, 0x1708: 0x000a, 0x1709: 0x000a, 0x170a: 0x000a, 0x170b: 0x000a,
+	0x170c: 0x000a, 0x170d: 0x000a, 0x170e: 0x000a, 0x170f: 0x000a, 0x1710: 0x000a, 0x1711: 0x000a,
+	0x1712: 0x000a, 0x1713: 0x000a, 0x1714: 0x000a, 0x1715: 0x000a, 0x1716: 0x000a, 0x1717: 0x000a,
+	0x1718: 0x000a, 0x1719: 0x000a, 0x171a: 0x000a, 0x171b: 0x000a, 0x171c: 0x000a, 0x171d: 0x000a,
+	0x171e: 0x000a, 0x171f: 0x000a, 0x1720: 0x000a, 0x1721: 0x000a, 0x1722: 0x000a, 0x1723: 0x000a,
+	0x1724: 0x000a, 0x1725: 0x000a, 0x1726: 0x000a,
+	// Block 0x5d, offset 0x1740
+	0x1740: 0x000a, 0x1741: 0x000a, 0x1742: 0x000a, 0x1743: 0x000a, 0x1744: 0x000a, 0x1745: 0x000a,
+	0x1746: 0x000a, 0x1747: 0x000a, 0x1748: 0x000a, 0x1749: 0x000a, 0x174a: 0x000a,
+	0x1760: 0x000a, 0x1761: 0x000a, 0x1762: 0x000a, 0x1763: 0x000a,
+	0x1764: 0x000a, 0x1765: 0x000a, 0x1766: 0x000a, 0x1767: 0x000a, 0x1768: 0x000a, 0x1769: 0x000a,
+	0x176a: 0x000a, 0x176b: 0x000a, 0x176c: 0x000a, 0x176d: 0x000a, 0x176e: 0x000a, 0x176f: 0x000a,
+	0x1770: 0x000a, 0x1771: 0x000a, 0x1772: 0x000a, 0x1773: 0x000a, 0x1774: 0x000a, 0x1775: 0x000a,
+	0x1776: 0x000a, 0x1777: 0x000a, 0x1778: 0x000a, 0x1779: 0x000a, 0x177a: 0x000a, 0x177b: 0x000a,
+	0x177c: 0x000a, 0x177d: 0x000a, 0x177e: 0x000a, 0x177f: 0x000a,
+	// Block 0x5e, offset 0x1780
+	0x1780: 0x000a, 0x1781: 0x000a, 0x1782: 0x000a, 0x1783: 0x000a, 0x1784: 0x000a, 0x1785: 0x000a,
+	0x1786: 0x000a, 0x1787: 0x000a, 0x1788: 0x0002, 0x1789: 0x0002, 0x178a: 0x0002, 0x178b: 0x0002,
+	0x178c: 0x0002, 0x178d: 0x0002, 0x178e: 0x0002, 0x178f: 0x0002, 0x1790: 0x0002, 0x1791: 0x0002,
+	0x1792: 0x0002, 0x1793: 0x0002, 0x1794: 0x0002, 0x1795: 0x0002, 0x1796: 0x0002, 0x1797: 0x0002,
+	0x1798: 0x0002, 0x1799: 0x0002, 0x179a: 0x0002, 0x179b: 0x0002,
+	// Block 0x5f, offset 0x17c0
+	0x17ea: 0x000a, 0x17eb: 0x000a, 0x17ec: 0x000a, 0x17ed: 0x000a, 0x17ee: 0x000a, 0x17ef: 0x000a,
+	0x17f0: 0x000a, 0x17f1: 0x000a, 0x17f2: 0x000a, 0x17f3: 0x000a, 0x17f4: 0x000a, 0x17f5: 0x000a,
+	0x17f6: 0x000a, 0x17f7: 0x000a, 0x17f8: 0x000a, 0x17f9: 0x000a, 0x17fa: 0x000a, 0x17fb: 0x000a,
+	0x17fc: 0x000a, 0x17fd: 0x000a, 0x17fe: 0x000a, 0x17ff: 0x000a,
+	// Block 0x60, offset 0x1800
+	0x1800: 0x000a, 0x1801: 0x000a, 0x1802: 0x000a, 0x1803: 0x000a, 0x1804: 0x000a, 0x1805: 0x000a,
+	0x1806: 0x000a, 0x1807: 0x000a, 0x1808: 0x000a, 0x1809: 0x000a, 0x180a: 0x000a, 0x180b: 0x000a,
+	0x180c: 0x000a, 0x180d: 0x000a, 0x180e: 0x000a, 0x180f: 0x000a, 0x1810: 0x000a, 0x1811: 0x000a,
+	0x1812: 0x000a, 0x1813: 0x000a, 0x1814: 0x000a, 0x1815: 0x000a, 0x1816: 0x000a, 0x1817: 0x000a,
+	0x1818: 0x000a, 0x1819: 0x000a, 0x181a: 0x000a, 0x181b: 0x000a, 0x181c: 0x000a, 0x181d: 0x000a,
+	0x181e: 0x000a, 0x181f: 0x000a, 0x1820: 0x000a, 0x1821: 0x000a, 0x1822: 0x000a, 0x1823: 0x000a,
+	0x1824: 0x000a, 0x1825: 0x000a, 0x1826: 0x000a, 0x1827: 0x000a, 0x1828: 0x000a, 0x1829: 0x000a,
+	0x182a: 0x000a, 0x182b: 0x000a, 0x182d: 0x000a, 0x182e: 0x000a, 0x182f: 0x000a,
+	0x1830: 0x000a, 0x1831: 0x000a, 0x1832: 0x000a, 0x1833: 0x000a, 0x1834: 0x000a, 0x1835: 0x000a,
+	0x1836: 0x000a, 0x1837: 0x000a, 0x1838: 0x000a, 0x1839: 0x000a, 0x183a: 0x000a, 0x183b: 0x000a,
+	0x183c: 0x000a, 0x183d: 0x000a, 0x183e: 0x000a, 0x183f: 0x000a,
+	// Block 0x61, offset 0x1840
+	0x1840: 0x000a, 0x1841: 0x000a, 0x1842: 0x000a, 0x1843: 0x000a, 0x1844: 0x000a, 0x1845: 0x000a,
+	0x1846: 0x000a, 0x1847: 0x000a, 0x1848: 0x000a, 0x1849: 0x000a, 0x184a: 0x000a, 0x184b: 0x000a,
+	0x184c: 0x000a, 0x184d: 0x000a, 0x184e: 0x000a, 0x184f: 0x000a, 0x1850: 0x000a, 0x1851: 0x000a,
+	0x1852: 0x000a, 0x1853: 0x000a, 0x1854: 0x000a, 0x1855: 0x000a, 0x1856: 0x000a, 0x1857: 0x000a,
+	0x1858: 0x000a, 0x1859: 0x000a, 0x185a: 0x000a, 0x185b: 0x000a, 0x185c: 0x000a, 0x185d: 0x000a,
+	0x185e: 0x000a, 0x185f: 0x000a, 0x1860: 0x000a, 0x1861: 0x000a, 0x1862: 0x000a, 0x1863: 0x000a,
+	0x1864: 0x000a, 0x1865: 0x000a, 0x1866: 0x000a, 0x1867: 0x000a, 0x1868: 0x003a, 0x1869: 0x002a,
+	0x186a: 0x003a, 0x186b: 0x002a, 0x186c: 0x003a, 0x186d: 0x002a, 0x186e: 0x003a, 0x186f: 0x002a,
+	0x1870: 0x003a, 0x1871: 0x002a, 0x1872: 0x003a, 0x1873: 0x002a, 0x1874: 0x003a, 0x1875: 0x002a,
+	0x1876: 0x000a, 0x1877: 0x000a, 0x1878: 0x000a, 0x1879: 0x000a, 0x187a: 0x000a, 0x187b: 0x000a,
+	0x187c: 0x000a, 0x187d: 0x000a, 0x187e: 0x000a, 0x187f: 0x000a,
+	// Block 0x62, offset 0x1880
+	0x1880: 0x000a, 0x1881: 0x000a, 0x1882: 0x000a, 0x1883: 0x000a, 0x1884: 0x000a, 0x1885: 0x009a,
+	0x1886: 0x008a, 0x1887: 0x000a, 0x1888: 0x000a, 0x1889: 0x000a, 0x188a: 0x000a, 0x188b: 0x000a,
+	0x188c: 0x000a, 0x188d: 0x000a, 0x188e: 0x000a, 0x188f: 0x000a, 0x1890: 0x000a, 0x1891: 0x000a,
+	0x1892: 0x000a, 0x1893: 0x000a, 0x1894: 0x000a, 0x1895: 0x000a, 0x1896: 0x000a, 0x1897: 0x000a,
+	0x1898: 0x000a, 0x1899: 0x000a, 0x189a: 0x000a, 0x189b: 0x000a, 0x189c: 0x000a, 0x189d: 0x000a,
+	0x189e: 0x000a, 0x189f: 0x000a, 0x18a0: 0x000a, 0x18a1: 0x000a, 0x18a2: 0x000a, 0x18a3: 0x000a,
+	0x18a4: 0x000a, 0x18a5: 0x000a, 0x18a6: 0x003a, 0x18a7: 0x002a, 0x18a8: 0x003a, 0x18a9: 0x002a,
+	0x18aa: 0x003a, 0x18ab: 0x002a, 0x18ac: 0x003a, 0x18ad: 0x002a, 0x18ae: 0x003a, 0x18af: 0x002a,
+	0x18b0: 0x000a, 0x18b1: 0x000a, 0x18b2: 0x000a, 0x18b3: 0x000a, 0x18b4: 0x000a, 0x18b5: 0x000a,
+	0x18b6: 0x000a, 0x18b7: 0x000a, 0x18b8: 0x000a, 0x18b9: 0x000a, 0x18ba: 0x000a, 0x18bb: 0x000a,
+	0x18bc: 0x000a, 0x18bd: 0x000a, 0x18be: 0x000a, 0x18bf: 0x000a,
+	// Block 0x63, offset 0x18c0
+	0x18c0: 0x000a, 0x18c1: 0x000a, 0x18c2: 0x000a, 0x18c3: 0x007a, 0x18c4: 0x006a, 0x18c5: 0x009a,
+	0x18c6: 0x008a, 0x18c7: 0x00ba, 0x18c8: 0x00aa, 0x18c9: 0x009a, 0x18ca: 0x008a, 0x18cb: 0x007a,
+	0x18cc: 0x006a, 0x18cd: 0x00da, 0x18ce: 0x002a, 0x18cf: 0x003a, 0x18d0: 0x00ca, 0x18d1: 0x009a,
+	0x18d2: 0x008a, 0x18d3: 0x007a, 0x18d4: 0x006a, 0x18d5: 0x009a, 0x18d6: 0x008a, 0x18d7: 0x00ba,
+	0x18d8: 0x00aa, 0x18d9: 0x000a, 0x18da: 0x000a, 0x18db: 0x000a, 0x18dc: 0x000a, 0x18dd: 0x000a,
+	0x18de: 0x000a, 0x18df: 0x000a, 0x18e0: 0x000a, 0x18e1: 0x000a, 0x18e2: 0x000a, 0x18e3: 0x000a,
+	0x18e4: 0x000a, 0x18e5: 0x000a, 0x18e6: 0x000a, 0x18e7: 0x000a, 0x18e8: 0x000a, 0x18e9: 0x000a,
+	0x18ea: 0x000a, 0x18eb: 0x000a, 0x18ec: 0x000a, 0x18ed: 0x000a, 0x18ee: 0x000a, 0x18ef: 0x000a,
+	0x18f0: 0x000a, 0x18f1: 0x000a, 0x18f2: 0x000a, 0x18f3: 0x000a, 0x18f4: 0x000a, 0x18f5: 0x000a,
+	0x18f6: 0x000a, 0x18f7: 0x000a, 0x18f8: 0x000a, 0x18f9: 0x000a, 0x18fa: 0x000a, 0x18fb: 0x000a,
+	0x18fc: 0x000a, 0x18fd: 0x000a, 0x18fe: 0x000a, 0x18ff: 0x000a,
+	// Block 0x64, offset 0x1900
+	0x1900: 0x000a, 0x1901: 0x000a, 0x1902: 0x000a, 0x1903: 0x000a, 0x1904: 0x000a, 0x1905: 0x000a,
+	0x1906: 0x000a, 0x1907: 0x000a, 0x1908: 0x000a, 0x1909: 0x000a, 0x190a: 0x000a, 0x190b: 0x000a,
+	0x190c: 0x000a, 0x190d: 0x000a, 0x190e: 0x000a, 0x190f: 0x000a, 0x1910: 0x000a, 0x1911: 0x000a,
+	0x1912: 0x000a, 0x1913: 0x000a, 0x1914: 0x000a, 0x1915: 0x000a, 0x1916: 0x000a, 0x1917: 0x000a,
+	0x1918: 0x003a, 0x1919: 0x002a, 0x191a: 0x003a, 0x191b: 0x002a, 0x191c: 0x000a, 0x191d: 0x000a,
+	0x191e: 0x000a, 0x191f: 0x000a, 0x1920: 0x000a, 0x1921: 0x000a, 0x1922: 0x000a, 0x1923: 0x000a,
+	0x1924: 0x000a, 0x1925: 0x000a, 0x1926: 0x000a, 0x1927: 0x000a, 0x1928: 0x000a, 0x1929: 0x000a,
+	0x192a: 0x000a, 0x192b: 0x000a, 0x192c: 0x000a, 0x192d: 0x000a, 0x192e: 0x000a, 0x192f: 0x000a,
+	0x1930: 0x000a, 0x1931: 0x000a, 0x1932: 0x000a, 0x1933: 0x000a, 0x1934: 0x000a, 0x1935: 0x000a,
+	0x1936: 0x000a, 0x1937: 0x000a, 0x1938: 0x000a, 0x1939: 0x000a, 0x193a: 0x000a, 0x193b: 0x000a,
+	0x193c: 0x003a, 0x193d: 0x002a, 0x193e: 0x000a, 0x193f: 0x000a,
+	// Block 0x65, offset 0x1940
+	0x1940: 0x000a, 0x1941: 0x000a, 0x1942: 0x000a, 0x1943: 0x000a, 0x1944: 0x000a, 0x1945: 0x000a,
+	0x1946: 0x000a, 0x1947: 0x000a, 0x1948: 0x000a, 0x1949: 0x000a, 0x194a: 0x000a, 0x194b: 0x000a,
+	0x194c: 0x000a, 0x194d: 0x000a, 0x194e: 0x000a, 0x194f: 0x000a, 0x1950: 0x000a, 0x1951: 0x000a,
+	0x1952: 0x000a, 0x1953: 0x000a, 0x1954: 0x000a, 0x1955: 0x000a, 0x1956: 0x000a, 0x1957: 0x000a,
+	0x1958: 0x000a, 0x1959: 0x000a, 0x195a: 0x000a, 0x195b: 0x000a, 0x195c: 0x000a, 0x195d: 0x000a,
+	0x195e: 0x000a, 0x195f: 0x000a, 0x1960: 0x000a, 0x1961: 0x000a, 0x1962: 0x000a, 0x1963: 0x000a,
+	0x1964: 0x000a, 0x1965: 0x000a, 0x1966: 0x000a, 0x1967: 0x000a, 0x1968: 0x000a, 0x1969: 0x000a,
+	0x196a: 0x000a, 0x196b: 0x000a, 0x196c: 0x000a, 0x196d: 0x000a, 0x196e: 0x000a, 0x196f: 0x000a,
+	0x1970: 0x000a, 0x1971: 0x000a, 0x1972: 0x000a, 0x1973: 0x000a,
+	0x1976: 0x000a, 0x1977: 0x000a, 0x1978: 0x000a, 0x1979: 0x000a, 0x197a: 0x000a, 0x197b: 0x000a,
+	0x197c: 0x000a, 0x197d: 0x000a, 0x197e: 0x000a, 0x197f: 0x000a,
+	// Block 0x66, offset 0x1980
+	0x1980: 0x000a, 0x1981: 0x000a, 0x1982: 0x000a, 0x1983: 0x000a, 0x1984: 0x000a, 0x1985: 0x000a,
+	0x1986: 0x000a, 0x1987: 0x000a, 0x1988: 0x000a, 0x1989: 0x000a, 0x198a: 0x000a, 0x198b: 0x000a,
+	0x198c: 0x000a, 0x198d: 0x000a, 0x198e: 0x000a, 0x198f: 0x000a, 0x1990: 0x000a, 0x1991: 0x000a,
+	0x1992: 0x000a, 0x1993: 0x000a, 0x1994: 0x000a, 0x1995: 0x000a, 0x1997: 0x000a,
+	0x1998: 0x000a, 0x1999: 0x000a, 0x199a: 0x000a, 0x199b: 0x000a, 0x199c: 0x000a, 0x199d: 0x000a,
+	0x199e: 0x000a, 0x199f: 0x000a, 0x19a0: 0x000a, 0x19a1: 0x000a, 0x19a2: 0x000a, 0x19a3: 0x000a,
+	0x19a4: 0x000a, 0x19a5: 0x000a, 0x19a6: 0x000a, 0x19a7: 0x000a, 0x19a8: 0x000a, 0x19a9: 0x000a,
+	0x19aa: 0x000a, 0x19ab: 0x000a, 0x19ac: 0x000a, 0x19ad: 0x000a, 0x19ae: 0x000a, 0x19af: 0x000a,
+	0x19b0: 0x000a, 0x19b1: 0x000a, 0x19b2: 0x000a, 0x19b3: 0x000a, 0x19b4: 0x000a, 0x19b5: 0x000a,
+	0x19b6: 0x000a, 0x19b7: 0x000a, 0x19b8: 0x000a, 0x19b9: 0x000a, 0x19ba: 0x000a, 0x19bb: 0x000a,
+	0x19bc: 0x000a, 0x19bd: 0x000a, 0x19be: 0x000a, 0x19bf: 0x000a,
+	// Block 0x67, offset 0x19c0
+	0x19e5: 0x000a, 0x19e6: 0x000a, 0x19e7: 0x000a, 0x19e8: 0x000a, 0x19e9: 0x000a,
+	0x19ea: 0x000a, 0x19ef: 0x000c,
+	0x19f0: 0x000c, 0x19f1: 0x000c,
+	0x19f9: 0x000a, 0x19fa: 0x000a, 0x19fb: 0x000a,
+	0x19fc: 0x000a, 0x19fd: 0x000a, 0x19fe: 0x000a, 0x19ff: 0x000a,
+	// Block 0x68, offset 0x1a00
+	0x1a3f: 0x000c,
+	// Block 0x69, offset 0x1a40
+	0x1a60: 0x000c, 0x1a61: 0x000c, 0x1a62: 0x000c, 0x1a63: 0x000c,
+	0x1a64: 0x000c, 0x1a65: 0x000c, 0x1a66: 0x000c, 0x1a67: 0x000c, 0x1a68: 0x000c, 0x1a69: 0x000c,
+	0x1a6a: 0x000c, 0x1a6b: 0x000c, 0x1a6c: 0x000c, 0x1a6d: 0x000c, 0x1a6e: 0x000c, 0x1a6f: 0x000c,
+	0x1a70: 0x000c, 0x1a71: 0x000c, 0x1a72: 0x000c, 0x1a73: 0x000c, 0x1a74: 0x000c, 0x1a75: 0x000c,
+	0x1a76: 0x000c, 0x1a77: 0x000c, 0x1a78: 0x000c, 0x1a79: 0x000c, 0x1a7a: 0x000c, 0x1a7b: 0x000c,
+	0x1a7c: 0x000c, 0x1a7d: 0x000c, 0x1a7e: 0x000c, 0x1a7f: 0x000c,
+	// Block 0x6a, offset 0x1a80
+	0x1a80: 0x000a, 0x1a81: 0x000a, 0x1a82: 0x000a, 0x1a83: 0x000a, 0x1a84: 0x000a, 0x1a85: 0x000a,
+	0x1a86: 0x000a, 0x1a87: 0x000a, 0x1a88: 0x000a, 0x1a89: 0x000a, 0x1a8a: 0x000a, 0x1a8b: 0x000a,
+	0x1a8c: 0x000a, 0x1a8d: 0x000a, 0x1a8e: 0x000a, 0x1a8f: 0x000a, 0x1a90: 0x000a, 0x1a91: 0x000a,
+	0x1a92: 0x000a, 0x1a93: 0x000a, 0x1a94: 0x000a, 0x1a95: 0x000a, 0x1a96: 0x000a, 0x1a97: 0x000a,
+	0x1a98: 0x000a, 0x1a99: 0x000a, 0x1a9a: 0x000a, 0x1a9b: 0x000a, 0x1a9c: 0x000a, 0x1a9d: 0x000a,
+	0x1a9e: 0x000a, 0x1a9f: 0x000a, 0x1aa0: 0x000a, 0x1aa1: 0x000a, 0x1aa2: 0x003a, 0x1aa3: 0x002a,
+	0x1aa4: 0x003a, 0x1aa5: 0x002a, 0x1aa6: 0x003a, 0x1aa7: 0x002a, 0x1aa8: 0x003a, 0x1aa9: 0x002a,
+	0x1aaa: 0x000a, 0x1aab: 0x000a, 0x1aac: 0x000a, 0x1aad: 0x000a, 0x1aae: 0x000a, 0x1aaf: 0x000a,
+	0x1ab0: 0x000a, 0x1ab1: 0x000a, 0x1ab2: 0x000a, 0x1ab3: 0x000a, 0x1ab4: 0x000a, 0x1ab5: 0x000a,
+	0x1ab6: 0x000a, 0x1ab7: 0x000a, 0x1ab8: 0x000a, 0x1ab9: 0x000a, 0x1aba: 0x000a, 0x1abb: 0x000a,
+	0x1abc: 0x000a, 0x1abd: 0x000a, 0x1abe: 0x000a, 0x1abf: 0x000a,
+	// Block 0x6b, offset 0x1ac0
+	0x1ac0: 0x000a, 0x1ac1: 0x000a, 0x1ac2: 0x000a, 0x1ac3: 0x000a, 0x1ac4: 0x000a, 0x1ac5: 0x000a,
+	0x1ac6: 0x000a, 0x1ac7: 0x000a, 0x1ac8: 0x000a, 0x1ac9: 0x000a, 0x1aca: 0x000a, 0x1acb: 0x000a,
+	0x1acc: 0x000a, 0x1acd: 0x000a, 0x1ace: 0x000a, 0x1acf: 0x000a, 0x1ad0: 0x000a, 0x1ad1: 0x000a,
+	0x1ad2: 0x000a, 0x1ad3: 0x000a, 0x1ad4: 0x000a, 0x1ad5: 0x009a, 0x1ad6: 0x008a, 0x1ad7: 0x00ba,
+	0x1ad8: 0x00aa, 0x1ad9: 0x009a, 0x1ada: 0x008a, 0x1adb: 0x007a, 0x1adc: 0x006a, 0x1add: 0x000a,
+	// Block 0x6c, offset 0x1b00
+	0x1b00: 0x000a, 0x1b01: 0x000a, 0x1b02: 0x000a, 0x1b03: 0x000a, 0x1b04: 0x000a, 0x1b05: 0x000a,
+	0x1b06: 0x000a, 0x1b07: 0x000a, 0x1b08: 0x000a, 0x1b09: 0x000a, 0x1b0a: 0x000a, 0x1b0b: 0x000a,
+	0x1b0c: 0x000a, 0x1b0d: 0x000a, 0x1b0e: 0x000a, 0x1b0f: 0x000a, 0x1b10: 0x000a, 0x1b11: 0x000a,
+	0x1b12: 0x000a, 0x1b13: 0x000a, 0x1b14: 0x000a, 0x1b15: 0x000a, 0x1b16: 0x000a, 0x1b17: 0x000a,
+	0x1b18: 0x000a, 0x1b19: 0x000a, 0x1b1b: 0x000a, 0x1b1c: 0x000a, 0x1b1d: 0x000a,
+	0x1b1e: 0x000a, 0x1b1f: 0x000a, 0x1b20: 0x000a, 0x1b21: 0x000a, 0x1b22: 0x000a, 0x1b23: 0x000a,
+	0x1b24: 0x000a, 0x1b25: 0x000a, 0x1b26: 0x000a, 0x1b27: 0x000a, 0x1b28: 0x000a, 0x1b29: 0x000a,
+	0x1b2a: 0x000a, 0x1b2b: 0x000a, 0x1b2c: 0x000a, 0x1b2d: 0x000a, 0x1b2e: 0x000a, 0x1b2f: 0x000a,
+	0x1b30: 0x000a, 0x1b31: 0x000a, 0x1b32: 0x000a, 0x1b33: 0x000a, 0x1b34: 0x000a, 0x1b35: 0x000a,
+	0x1b36: 0x000a, 0x1b37: 0x000a, 0x1b38: 0x000a, 0x1b39: 0x000a, 0x1b3a: 0x000a, 0x1b3b: 0x000a,
+	0x1b3c: 0x000a, 0x1b3d: 0x000a, 0x1b3e: 0x000a, 0x1b3f: 0x000a,
+	// Block 0x6d, offset 0x1b40
+	0x1b40: 0x000a, 0x1b41: 0x000a, 0x1b42: 0x000a, 0x1b43: 0x000a, 0x1b44: 0x000a, 0x1b45: 0x000a,
+	0x1b46: 0x000a, 0x1b47: 0x000a, 0x1b48: 0x000a, 0x1b49: 0x000a, 0x1b4a: 0x000a, 0x1b4b: 0x000a,
+	0x1b4c: 0x000a, 0x1b4d: 0x000a, 0x1b4e: 0x000a, 0x1b4f: 0x000a, 0x1b50: 0x000a, 0x1b51: 0x000a,
+	0x1b52: 0x000a, 0x1b53: 0x000a, 0x1b54: 0x000a, 0x1b55: 0x000a, 0x1b56: 0x000a, 0x1b57: 0x000a,
+	0x1b58: 0x000a, 0x1b59: 0x000a, 0x1b5a: 0x000a, 0x1b5b: 0x000a, 0x1b5c: 0x000a, 0x1b5d: 0x000a,
+	0x1b5e: 0x000a, 0x1b5f: 0x000a, 0x1b60: 0x000a, 0x1b61: 0x000a, 0x1b62: 0x000a, 0x1b63: 0x000a,
+	0x1b64: 0x000a, 0x1b65: 0x000a, 0x1b66: 0x000a, 0x1b67: 0x000a, 0x1b68: 0x000a, 0x1b69: 0x000a,
+	0x1b6a: 0x000a, 0x1b6b: 0x000a, 0x1b6c: 0x000a, 0x1b6d: 0x000a, 0x1b6e: 0x000a, 0x1b6f: 0x000a,
+	0x1b70: 0x000a, 0x1b71: 0x000a, 0x1b72: 0x000a, 0x1b73: 0x000a,
+	// Block 0x6e, offset 0x1b80
+	0x1b80: 0x000a, 0x1b81: 0x000a, 0x1b82: 0x000a, 0x1b83: 0x000a, 0x1b84: 0x000a, 0x1b85: 0x000a,
+	0x1b86: 0x000a, 0x1b87: 0x000a, 0x1b88: 0x000a, 0x1b89: 0x000a, 0x1b8a: 0x000a, 0x1b8b: 0x000a,
+	0x1b8c: 0x000a, 0x1b8d: 0x000a, 0x1b8e: 0x000a, 0x1b8f: 0x000a, 0x1b90: 0x000a, 0x1b91: 0x000a,
+	0x1b92: 0x000a, 0x1b93: 0x000a, 0x1b94: 0x000a, 0x1b95: 0x000a,
+	0x1bb0: 0x000a, 0x1bb1: 0x000a, 0x1bb2: 0x000a, 0x1bb3: 0x000a, 0x1bb4: 0x000a, 0x1bb5: 0x000a,
+	0x1bb6: 0x000a, 0x1bb7: 0x000a, 0x1bb8: 0x000a, 0x1bb9: 0x000a, 0x1bba: 0x000a, 0x1bbb: 0x000a,
+	// Block 0x6f, offset 0x1bc0
+	0x1bc0: 0x0009, 0x1bc1: 0x000a, 0x1bc2: 0x000a, 0x1bc3: 0x000a, 0x1bc4: 0x000a,
+	0x1bc8: 0x003a, 0x1bc9: 0x002a, 0x1bca: 0x003a, 0x1bcb: 0x002a,
+	0x1bcc: 0x003a, 0x1bcd: 0x002a, 0x1bce: 0x003a, 0x1bcf: 0x002a, 0x1bd0: 0x003a, 0x1bd1: 0x002a,
+	0x1bd2: 0x000a, 0x1bd3: 0x000a, 0x1bd4: 0x003a, 0x1bd5: 0x002a, 0x1bd6: 0x003a, 0x1bd7: 0x002a,
+	0x1bd8: 0x003a, 0x1bd9: 0x002a, 0x1bda: 0x003a, 0x1bdb: 0x002a, 0x1bdc: 0x000a, 0x1bdd: 0x000a,
+	0x1bde: 0x000a, 0x1bdf: 0x000a, 0x1be0: 0x000a,
+	0x1bea: 0x000c, 0x1beb: 0x000c, 0x1bec: 0x000c, 0x1bed: 0x000c,
+	0x1bf0: 0x000a,
+	0x1bf6: 0x000a, 0x1bf7: 0x000a,
+	0x1bfd: 0x000a, 0x1bfe: 0x000a, 0x1bff: 0x000a,
+	// Block 0x70, offset 0x1c00
+	0x1c19: 0x000c, 0x1c1a: 0x000c, 0x1c1b: 0x000a, 0x1c1c: 0x000a,
+	0x1c20: 0x000a,
+	// Block 0x71, offset 0x1c40
+	0x1c7b: 0x000a,
+	// Block 0x72, offset 0x1c80
+	0x1c80: 0x000a, 0x1c81: 0x000a, 0x1c82: 0x000a, 0x1c83: 0x000a, 0x1c84: 0x000a, 0x1c85: 0x000a,
+	0x1c86: 0x000a, 0x1c87: 0x000a, 0x1c88: 0x000a, 0x1c89: 0x000a, 0x1c8a: 0x000a, 0x1c8b: 0x000a,
+	0x1c8c: 0x000a, 0x1c8d: 0x000a, 0x1c8e: 0x000a, 0x1c8f: 0x000a, 0x1c90: 0x000a, 0x1c91: 0x000a,
+	0x1c92: 0x000a, 0x1c93: 0x000a, 0x1c94: 0x000a, 0x1c95: 0x000a, 0x1c96: 0x000a, 0x1c97: 0x000a,
+	0x1c98: 0x000a, 0x1c99: 0x000a, 0x1c9a: 0x000a, 0x1c9b: 0x000a, 0x1c9c: 0x000a, 0x1c9d: 0x000a,
+	0x1c9e: 0x000a, 0x1c9f: 0x000a, 0x1ca0: 0x000a, 0x1ca1: 0x000a, 0x1ca2: 0x000a, 0x1ca3: 0x000a,
+	// Block 0x73, offset 0x1cc0
+	0x1cdd: 0x000a,
+	0x1cde: 0x000a,
+	// Block 0x74, offset 0x1d00
+	0x1d10: 0x000a, 0x1d11: 0x000a,
+	0x1d12: 0x000a, 0x1d13: 0x000a, 0x1d14: 0x000a, 0x1d15: 0x000a, 0x1d16: 0x000a, 0x1d17: 0x000a,
+	0x1d18: 0x000a, 0x1d19: 0x000a, 0x1d1a: 0x000a, 0x1d1b: 0x000a, 0x1d1c: 0x000a, 0x1d1d: 0x000a,
+	0x1d1e: 0x000a, 0x1d1f: 0x000a,
+	0x1d3c: 0x000a, 0x1d3d: 0x000a, 0x1d3e: 0x000a,
+	// Block 0x75, offset 0x1d40
+	0x1d71: 0x000a, 0x1d72: 0x000a, 0x1d73: 0x000a, 0x1d74: 0x000a, 0x1d75: 0x000a,
+	0x1d76: 0x000a, 0x1d77: 0x000a, 0x1d78: 0x000a, 0x1d79: 0x000a, 0x1d7a: 0x000a, 0x1d7b: 0x000a,
+	0x1d7c: 0x000a, 0x1d7d: 0x000a, 0x1d7e: 0x000a, 0x1d7f: 0x000a,
+	// Block 0x76, offset 0x1d80
+	0x1d8c: 0x000a, 0x1d8d: 0x000a, 0x1d8e: 0x000a, 0x1d8f: 0x000a,
+	// Block 0x77, offset 0x1dc0
+	0x1df7: 0x000a, 0x1df8: 0x000a, 0x1df9: 0x000a, 0x1dfa: 0x000a,
+	// Block 0x78, offset 0x1e00
+	0x1e1e: 0x000a, 0x1e1f: 0x000a,
+	0x1e3f: 0x000a,
+	// Block 0x79, offset 0x1e40
+	0x1e50: 0x000a, 0x1e51: 0x000a,
+	0x1e52: 0x000a, 0x1e53: 0x000a, 0x1e54: 0x000a, 0x1e55: 0x000a, 0x1e56: 0x000a, 0x1e57: 0x000a,
+	0x1e58: 0x000a, 0x1e59: 0x000a, 0x1e5a: 0x000a, 0x1e5b: 0x000a, 0x1e5c: 0x000a, 0x1e5d: 0x000a,
+	0x1e5e: 0x000a, 0x1e5f: 0x000a, 0x1e60: 0x000a, 0x1e61: 0x000a, 0x1e62: 0x000a, 0x1e63: 0x000a,
+	0x1e64: 0x000a, 0x1e65: 0x000a, 0x1e66: 0x000a, 0x1e67: 0x000a, 0x1e68: 0x000a, 0x1e69: 0x000a,
+	0x1e6a: 0x000a, 0x1e6b: 0x000a, 0x1e6c: 0x000a, 0x1e6d: 0x000a, 0x1e6e: 0x000a, 0x1e6f: 0x000a,
+	0x1e70: 0x000a, 0x1e71: 0x000a, 0x1e72: 0x000a, 0x1e73: 0x000a, 0x1e74: 0x000a, 0x1e75: 0x000a,
+	0x1e76: 0x000a, 0x1e77: 0x000a, 0x1e78: 0x000a, 0x1e79: 0x000a, 0x1e7a: 0x000a, 0x1e7b: 0x000a,
+	0x1e7c: 0x000a, 0x1e7d: 0x000a, 0x1e7e: 0x000a, 0x1e7f: 0x000a,
+	// Block 0x7a, offset 0x1e80
+	0x1e80: 0x000a, 0x1e81: 0x000a, 0x1e82: 0x000a, 0x1e83: 0x000a, 0x1e84: 0x000a, 0x1e85: 0x000a,
+	0x1e86: 0x000a,
+	// Block 0x7b, offset 0x1ec0
+	0x1ecd: 0x000a, 0x1ece: 0x000a, 0x1ecf: 0x000a,
+	// Block 0x7c, offset 0x1f00
+	0x1f2f: 0x000c,
+	0x1f30: 0x000c, 0x1f31: 0x000c, 0x1f32: 0x000c, 0x1f33: 0x000a, 0x1f34: 0x000c, 0x1f35: 0x000c,
+	0x1f36: 0x000c, 0x1f37: 0x000c, 0x1f38: 0x000c, 0x1f39: 0x000c, 0x1f3a: 0x000c, 0x1f3b: 0x000c,
+	0x1f3c: 0x000c, 0x1f3d: 0x000c, 0x1f3e: 0x000a, 0x1f3f: 0x000a,
+	// Block 0x7d, offset 0x1f40
+	0x1f5e: 0x000c, 0x1f5f: 0x000c,
+	// Block 0x7e, offset 0x1f80
+	0x1fb0: 0x000c, 0x1fb1: 0x000c,
+	// Block 0x7f, offset 0x1fc0
+	0x1fc0: 0x000a, 0x1fc1: 0x000a, 0x1fc2: 0x000a, 0x1fc3: 0x000a, 0x1fc4: 0x000a, 0x1fc5: 0x000a,
+	0x1fc6: 0x000a, 0x1fc7: 0x000a, 0x1fc8: 0x000a, 0x1fc9: 0x000a, 0x1fca: 0x000a, 0x1fcb: 0x000a,
+	0x1fcc: 0x000a, 0x1fcd: 0x000a, 0x1fce: 0x000a, 0x1fcf: 0x000a, 0x1fd0: 0x000a, 0x1fd1: 0x000a,
+	0x1fd2: 0x000a, 0x1fd3: 0x000a, 0x1fd4: 0x000a, 0x1fd5: 0x000a, 0x1fd6: 0x000a, 0x1fd7: 0x000a,
+	0x1fd8: 0x000a, 0x1fd9: 0x000a, 0x1fda: 0x000a, 0x1fdb: 0x000a, 0x1fdc: 0x000a, 0x1fdd: 0x000a,
+	0x1fde: 0x000a, 0x1fdf: 0x000a, 0x1fe0: 0x000a, 0x1fe1: 0x000a,
+	// Block 0x80, offset 0x2000
+	0x2008: 0x000a,
+	// Block 0x81, offset 0x2040
+	0x2042: 0x000c,
+	0x2046: 0x000c, 0x204b: 0x000c,
+	0x2065: 0x000c, 0x2066: 0x000c, 0x2068: 0x000a, 0x2069: 0x000a,
+	0x206a: 0x000a, 0x206b: 0x000a, 0x206c: 0x000c,
+	0x2078: 0x0004, 0x2079: 0x0004,
+	// Block 0x82, offset 0x2080
+	0x20b4: 0x000a, 0x20b5: 0x000a,
+	0x20b6: 0x000a, 0x20b7: 0x000a,
+	// Block 0x83, offset 0x20c0
+	0x20c4: 0x000c, 0x20c5: 0x000c,
+	0x20e0: 0x000c, 0x20e1: 0x000c, 0x20e2: 0x000c, 0x20e3: 0x000c,
+	0x20e4: 0x000c, 0x20e5: 0x000c, 0x20e6: 0x000c, 0x20e7: 0x000c, 0x20e8: 0x000c, 0x20e9: 0x000c,
+	0x20ea: 0x000c, 0x20eb: 0x000c, 0x20ec: 0x000c, 0x20ed: 0x000c, 0x20ee: 0x000c, 0x20ef: 0x000c,
+	0x20f0: 0x000c, 0x20f1: 0x000c,
+	0x20ff: 0x000c,
+	// Block 0x84, offset 0x2100
+	0x2126: 0x000c, 0x2127: 0x000c, 0x2128: 0x000c, 0x2129: 0x000c,
+	0x212a: 0x000c, 0x212b: 0x000c, 0x212c: 0x000c, 0x212d: 0x000c,
+	// Block 0x85, offset 0x2140
+	0x2147: 0x000c, 0x2148: 0x000c, 0x2149: 0x000c, 0x214a: 0x000c, 0x214b: 0x000c,
+	0x214c: 0x000c, 0x214d: 0x000c, 0x214e: 0x000c, 0x214f: 0x000c, 0x2150: 0x000c, 0x2151: 0x000c,
+	// Block 0x86, offset 0x2180
+	0x2180: 0x000c, 0x2181: 0x000c, 0x2182: 0x000c,
+	0x21b3: 0x000c,
+	0x21b6: 0x000c, 0x21b7: 0x000c, 0x21b8: 0x000c, 0x21b9: 0x000c,
+	0x21bc: 0x000c, 0x21bd: 0x000c,
+	// Block 0x87, offset 0x21c0
+	0x21e5: 0x000c,
+	// Block 0x88, offset 0x2200
+	0x2229: 0x000c,
+	0x222a: 0x000c, 0x222b: 0x000c, 0x222c: 0x000c, 0x222d: 0x000c, 0x222e: 0x000c,
+	0x2231: 0x000c, 0x2232: 0x000c, 0x2235: 0x000c,
+	0x2236: 0x000c,
+	// Block 0x89, offset 0x2240
+	0x2243: 0x000c,
+	0x224c: 0x000c,
+	0x227c: 0x000c,
+	// Block 0x8a, offset 0x2280
+	0x22b0: 0x000c, 0x22b2: 0x000c, 0x22b3: 0x000c, 0x22b4: 0x000c,
+	0x22b7: 0x000c, 0x22b8: 0x000c,
+	0x22be: 0x000c, 0x22bf: 0x000c,
+	// Block 0x8b, offset 0x22c0
+	0x22c1: 0x000c,
+	0x22ec: 0x000c, 0x22ed: 0x000c,
+	0x22f6: 0x000c,
+	// Block 0x8c, offset 0x2300
+	0x232a: 0x000a, 0x232b: 0x000a,
+	// Block 0x8d, offset 0x2340
+	0x2365: 0x000c, 0x2368: 0x000c,
+	0x236d: 0x000c,
+	// Block 0x8e, offset 0x2380
+	0x239d: 0x0001,
+	0x239e: 0x000c, 0x239f: 0x0001, 0x23a0: 0x0001, 0x23a1: 0x0001, 0x23a2: 0x0001, 0x23a3: 0x0001,
+	0x23a4: 0x0001, 0x23a5: 0x0001, 0x23a6: 0x0001, 0x23a7: 0x0001, 0x23a8: 0x0001, 0x23a9: 0x0003,
+	0x23aa: 0x0001, 0x23ab: 0x0001, 0x23ac: 0x0001, 0x23ad: 0x0001, 0x23ae: 0x0001, 0x23af: 0x0001,
+	0x23b0: 0x0001, 0x23b1: 0x0001, 0x23b2: 0x0001, 0x23b3: 0x0001, 0x23b4: 0x0001, 0x23b5: 0x0001,
+	0x23b6: 0x0001, 0x23b7: 0x0001, 0x23b8: 0x0001, 0x23b9: 0x0001, 0x23ba: 0x0001, 0x23bb: 0x0001,
+	0x23bc: 0x0001, 0x23bd: 0x0001, 0x23be: 0x0001, 0x23bf: 0x0001,
+	// Block 0x8f, offset 0x23c0
+	0x23c0: 0x0001, 0x23c1: 0x0001, 0x23c2: 0x0001, 0x23c3: 0x0001, 0x23c4: 0x0001, 0x23c5: 0x0001,
+	0x23c6: 0x0001, 0x23c7: 0x0001, 0x23c8: 0x0001, 0x23c9: 0x0001, 0x23ca: 0x0001, 0x23cb: 0x0001,
+	0x23cc: 0x0001, 0x23cd: 0x0001, 0x23ce: 0x0001, 0x23cf: 0x0001, 0x23d0: 0x000d, 0x23d1: 0x000d,
+	0x23d2: 0x000d, 0x23d3: 0x000d, 0x23d4: 0x000d, 0x23d5: 0x000d, 0x23d6: 0x000d, 0x23d7: 0x000d,
+	0x23d8: 0x000d, 0x23d9: 0x000d, 0x23da: 0x000d, 0x23db: 0x000d, 0x23dc: 0x000d, 0x23dd: 0x000d,
+	0x23de: 0x000d, 0x23df: 0x000d, 0x23e0: 0x000d, 0x23e1: 0x000d, 0x23e2: 0x000d, 0x23e3: 0x000d,
+	0x23e4: 0x000d, 0x23e5: 0x000d, 0x23e6: 0x000d, 0x23e7: 0x000d, 0x23e8: 0x000d, 0x23e9: 0x000d,
+	0x23ea: 0x000d, 0x23eb: 0x000d, 0x23ec: 0x000d, 0x23ed: 0x000d, 0x23ee: 0x000d, 0x23ef: 0x000d,
+	0x23f0: 0x000d, 0x23f1: 0x000d, 0x23f2: 0x000d, 0x23f3: 0x000d, 0x23f4: 0x000d, 0x23f5: 0x000d,
+	0x23f6: 0x000d, 0x23f7: 0x000d, 0x23f8: 0x000d, 0x23f9: 0x000d, 0x23fa: 0x000d, 0x23fb: 0x000d,
+	0x23fc: 0x000d, 0x23fd: 0x000d, 0x23fe: 0x000d, 0x23ff: 0x000d,
+	// Block 0x90, offset 0x2400
+	0x2400: 0x000d, 0x2401: 0x000d, 0x2402: 0x000d, 0x2403: 0x000d, 0x2404: 0x000d, 0x2405: 0x000d,
+	0x2406: 0x000d, 0x2407: 0x000d, 0x2408: 0x000d, 0x2409: 0x000d, 0x240a: 0x000d, 0x240b: 0x000d,
+	0x240c: 0x000d, 0x240d: 0x000d, 0x240e: 0x000d, 0x240f: 0x000d, 0x2410: 0x000d, 0x2411: 0x000d,
+	0x2412: 0x000d, 0x2413: 0x000d, 0x2414: 0x000d, 0x2415: 0x000d, 0x2416: 0x000d, 0x2417: 0x000d,
+	0x2418: 0x000d, 0x2419: 0x000d, 0x241a: 0x000d, 0x241b: 0x000d, 0x241c: 0x000d, 0x241d: 0x000d,
+	0x241e: 0x000d, 0x241f: 0x000d, 0x2420: 0x000d, 0x2421: 0x000d, 0x2422: 0x000d, 0x2423: 0x000d,
+	0x2424: 0x000d, 0x2425: 0x000d, 0x2426: 0x000d, 0x2427: 0x000d, 0x2428: 0x000d, 0x2429: 0x000d,
+	0x242a: 0x000d, 0x242b: 0x000d, 0x242c: 0x000d, 0x242d: 0x000d, 0x242e: 0x000d, 0x242f: 0x000d,
+	0x2430: 0x000d, 0x2431: 0x000d, 0x2432: 0x000d, 0x2433: 0x000d, 0x2434: 0x000d, 0x2435: 0x000d,
+	0x2436: 0x000d, 0x2437: 0x000d, 0x2438: 0x000d, 0x2439: 0x000d, 0x243a: 0x000d, 0x243b: 0x000d,
+	0x243c: 0x000d, 0x243d: 0x000d, 0x243e: 0x000a, 0x243f: 0x000a,
+	// Block 0x91, offset 0x2440
+	0x2440: 0x000a, 0x2441: 0x000a, 0x2442: 0x000a, 0x2443: 0x000a, 0x2444: 0x000a, 0x2445: 0x000a,
+	0x2446: 0x000a, 0x2447: 0x000a, 0x2448: 0x000a, 0x2449: 0x000a, 0x244a: 0x000a, 0x244b: 0x000a,
+	0x244c: 0x000a, 0x244d: 0x000a, 0x244e: 0x000a, 0x244f: 0x000a, 0x2450: 0x000d, 0x2451: 0x000d,
+	0x2452: 0x000d, 0x2453: 0x000d, 0x2454: 0x000d, 0x2455: 0x000d, 0x2456: 0x000d, 0x2457: 0x000d,
+	0x2458: 0x000d, 0x2459: 0x000d, 0x245a: 0x000d, 0x245b: 0x000d, 0x245c: 0x000d, 0x245d: 0x000d,
+	0x245e: 0x000d, 0x245f: 0x000d, 0x2460: 0x000d, 0x2461: 0x000d, 0x2462: 0x000d, 0x2463: 0x000d,
+	0x2464: 0x000d, 0x2465: 0x000d, 0x2466: 0x000d, 0x2467: 0x000d, 0x2468: 0x000d, 0x2469: 0x000d,
+	0x246a: 0x000d, 0x246b: 0x000d, 0x246c: 0x000d, 0x246d: 0x000d, 0x246e: 0x000d, 0x246f: 0x000d,
+	0x2470: 0x000d, 0x2471: 0x000d, 0x2472: 0x000d, 0x2473: 0x000d, 0x2474: 0x000d, 0x2475: 0x000d,
+	0x2476: 0x000d, 0x2477: 0x000d, 0x2478: 0x000d, 0x2479: 0x000d, 0x247a: 0x000d, 0x247b: 0x000d,
+	0x247c: 0x000d, 0x247d: 0x000d, 0x247e: 0x000d, 0x247f: 0x000d,
+	// Block 0x92, offset 0x2480
+	0x2480: 0x000d, 0x2481: 0x000d, 0x2482: 0x000d, 0x2483: 0x000d, 0x2484: 0x000d, 0x2485: 0x000d,
+	0x2486: 0x000d, 0x2487: 0x000d, 0x2488: 0x000d, 0x2489: 0x000d, 0x248a: 0x000d, 0x248b: 0x000d,
+	0x248c: 0x000d, 0x248d: 0x000d, 0x248e: 0x000d, 0x248f: 0x000a, 0x2490: 0x000b, 0x2491: 0x000b,
+	0x2492: 0x000b, 0x2493: 0x000b, 0x2494: 0x000b, 0x2495: 0x000b, 0x2496: 0x000b, 0x2497: 0x000b,
+	0x2498: 0x000b, 0x2499: 0x000b, 0x249a: 0x000b, 0x249b: 0x000b, 0x249c: 0x000b, 0x249d: 0x000b,
+	0x249e: 0x000b, 0x249f: 0x000b, 0x24a0: 0x000b, 0x24a1: 0x000b, 0x24a2: 0x000b, 0x24a3: 0x000b,
+	0x24a4: 0x000b, 0x24a5: 0x000b, 0x24a6: 0x000b, 0x24a7: 0x000b, 0x24a8: 0x000b, 0x24a9: 0x000b,
+	0x24aa: 0x000b, 0x24ab: 0x000b, 0x24ac: 0x000b, 0x24ad: 0x000b, 0x24ae: 0x000b, 0x24af: 0x000b,
+	0x24b0: 0x000d, 0x24b1: 0x000d, 0x24b2: 0x000d, 0x24b3: 0x000d, 0x24b4: 0x000d, 0x24b5: 0x000d,
+	0x24b6: 0x000d, 0x24b7: 0x000d, 0x24b8: 0x000d, 0x24b9: 0x000d, 0x24ba: 0x000d, 0x24bb: 0x000d,
+	0x24bc: 0x000d, 0x24bd: 0x000a, 0x24be: 0x000a, 0x24bf: 0x000a,
+	// Block 0x93, offset 0x24c0
+	0x24c0: 0x000c, 0x24c1: 0x000c, 0x24c2: 0x000c, 0x24c3: 0x000c, 0x24c4: 0x000c, 0x24c5: 0x000c,
+	0x24c6: 0x000c, 0x24c7: 0x000c, 0x24c8: 0x000c, 0x24c9: 0x000c, 0x24ca: 0x000c, 0x24cb: 0x000c,
+	0x24cc: 0x000c, 0x24cd: 0x000c, 0x24ce: 0x000c, 0x24cf: 0x000c, 0x24d0: 0x000a, 0x24d1: 0x000a,
+	0x24d2: 0x000a, 0x24d3: 0x000a, 0x24d4: 0x000a, 0x24d5: 0x000a, 0x24d6: 0x000a, 0x24d7: 0x000a,
+	0x24d8: 0x000a, 0x24d9: 0x000a,
+	0x24e0: 0x000c, 0x24e1: 0x000c, 0x24e2: 0x000c, 0x24e3: 0x000c,
+	0x24e4: 0x000c, 0x24e5: 0x000c, 0x24e6: 0x000c, 0x24e7: 0x000c, 0x24e8: 0x000c, 0x24e9: 0x000c,
+	0x24ea: 0x000c, 0x24eb: 0x000c, 0x24ec: 0x000c, 0x24ed: 0x000c, 0x24ee: 0x000c, 0x24ef: 0x000c,
+	0x24f0: 0x000a, 0x24f1: 0x000a, 0x24f2: 0x000a, 0x24f3: 0x000a, 0x24f4: 0x000a, 0x24f5: 0x000a,
+	0x24f6: 0x000a, 0x24f7: 0x000a, 0x24f8: 0x000a, 0x24f9: 0x000a, 0x24fa: 0x000a, 0x24fb: 0x000a,
+	0x24fc: 0x000a, 0x24fd: 0x000a, 0x24fe: 0x000a, 0x24ff: 0x000a,
+	// Block 0x94, offset 0x2500
+	0x2500: 0x000a, 0x2501: 0x000a, 0x2502: 0x000a, 0x2503: 0x000a, 0x2504: 0x000a, 0x2505: 0x000a,
+	0x2506: 0x000a, 0x2507: 0x000a, 0x2508: 0x000a, 0x2509: 0x000a, 0x250a: 0x000a, 0x250b: 0x000a,
+	0x250c: 0x000a, 0x250d: 0x000a, 0x250e: 0x000a, 0x250f: 0x000a, 0x2510: 0x0006, 0x2511: 0x000a,
+	0x2512: 0x0006, 0x2514: 0x000a, 0x2515: 0x0006, 0x2516: 0x000a, 0x2517: 0x000a,
+	0x2518: 0x000a, 0x2519: 0x009a, 0x251a: 0x008a, 0x251b: 0x007a, 0x251c: 0x006a, 0x251d: 0x009a,
+	0x251e: 0x008a, 0x251f: 0x0004, 0x2520: 0x000a, 0x2521: 0x000a, 0x2522: 0x0003, 0x2523: 0x0003,
+	0x2524: 0x000a, 0x2525: 0x000a, 0x2526: 0x000a, 0x2528: 0x000a, 0x2529: 0x0004,
+	0x252a: 0x0004, 0x252b: 0x000a,
+	0x2530: 0x000d, 0x2531: 0x000d, 0x2532: 0x000d, 0x2533: 0x000d, 0x2534: 0x000d, 0x2535: 0x000d,
+	0x2536: 0x000d, 0x2537: 0x000d, 0x2538: 0x000d, 0x2539: 0x000d, 0x253a: 0x000d, 0x253b: 0x000d,
+	0x253c: 0x000d, 0x253d: 0x000d, 0x253e: 0x000d, 0x253f: 0x000d,
+	// Block 0x95, offset 0x2540
+	0x2540: 0x000d, 0x2541: 0x000d, 0x2542: 0x000d, 0x2543: 0x000d, 0x2544: 0x000d, 0x2545: 0x000d,
+	0x2546: 0x000d, 0x2547: 0x000d, 0x2548: 0x000d, 0x2549: 0x000d, 0x254a: 0x000d, 0x254b: 0x000d,
+	0x254c: 0x000d, 0x254d: 0x000d, 0x254e: 0x000d, 0x254f: 0x000d, 0x2550: 0x000d, 0x2551: 0x000d,
+	0x2552: 0x000d, 0x2553: 0x000d, 0x2554: 0x000d, 0x2555: 0x000d, 0x2556: 0x000d, 0x2557: 0x000d,
+	0x2558: 0x000d, 0x2559: 0x000d, 0x255a: 0x000d, 0x255b: 0x000d, 0x255c: 0x000d, 0x255d: 0x000d,
+	0x255e: 0x000d, 0x255f: 0x000d, 0x2560: 0x000d, 0x2561: 0x000d, 0x2562: 0x000d, 0x2563: 0x000d,
+	0x2564: 0x000d, 0x2565: 0x000d, 0x2566: 0x000d, 0x2567: 0x000d, 0x2568: 0x000d, 0x2569: 0x000d,
+	0x256a: 0x000d, 0x256b: 0x000d, 0x256c: 0x000d, 0x256d: 0x000d, 0x256e: 0x000d, 0x256f: 0x000d,
+	0x2570: 0x000d, 0x2571: 0x000d, 0x2572: 0x000d, 0x2573: 0x000d, 0x2574: 0x000d, 0x2575: 0x000d,
+	0x2576: 0x000d, 0x2577: 0x000d, 0x2578: 0x000d, 0x2579: 0x000d, 0x257a: 0x000d, 0x257b: 0x000d,
+	0x257c: 0x000d, 0x257d: 0x000d, 0x257e: 0x000d, 0x257f: 0x000b,
+	// Block 0x96, offset 0x2580
+	0x2581: 0x000a, 0x2582: 0x000a, 0x2583: 0x0004, 0x2584: 0x0004, 0x2585: 0x0004,
+	0x2586: 0x000a, 0x2587: 0x000a, 0x2588: 0x003a, 0x2589: 0x002a, 0x258a: 0x000a, 0x258b: 0x0003,
+	0x258c: 0x0006, 0x258d: 0x0003, 0x258e: 0x0006, 0x258f: 0x0006, 0x2590: 0x0002, 0x2591: 0x0002,
+	0x2592: 0x0002, 0x2593: 0x0002, 0x2594: 0x0002, 0x2595: 0x0002, 0x2596: 0x0002, 0x2597: 0x0002,
+	0x2598: 0x0002, 0x2599: 0x0002, 0x259a: 0x0006, 0x259b: 0x000a, 0x259c: 0x000a, 0x259d: 0x000a,
+	0x259e: 0x000a, 0x259f: 0x000a, 0x25a0: 0x000a,
+	0x25bb: 0x005a,
+	0x25bc: 0x000a, 0x25bd: 0x004a, 0x25be: 0x000a, 0x25bf: 0x000a,
+	// Block 0x97, offset 0x25c0
+	0x25c0: 0x000a,
+	0x25db: 0x005a, 0x25dc: 0x000a, 0x25dd: 0x004a,
+	0x25de: 0x000a, 0x25df: 0x00fa, 0x25e0: 0x00ea, 0x25e1: 0x000a, 0x25e2: 0x003a, 0x25e3: 0x002a,
+	0x25e4: 0x000a, 0x25e5: 0x000a,
+	// Block 0x98, offset 0x2600
+	0x2620: 0x0004, 0x2621: 0x0004, 0x2622: 0x000a, 0x2623: 0x000a,
+	0x2624: 0x000a, 0x2625: 0x0004, 0x2626: 0x0004, 0x2628: 0x000a, 0x2629: 0x000a,
+	0x262a: 0x000a, 0x262b: 0x000a, 0x262c: 0x000a, 0x262d: 0x000a, 0x262e: 0x000a,
+	0x2630: 0x000b, 0x2631: 0x000b, 0x2632: 0x000b, 0x2633: 0x000b, 0x2634: 0x000b, 0x2635: 0x000b,
+	0x2636: 0x000b, 0x2637: 0x000b, 0x2638: 0x000b, 0x2639: 0x000a, 0x263a: 0x000a, 0x263b: 0x000a,
+	0x263c: 0x000a, 0x263d: 0x000a, 0x263e: 0x000b, 0x263f: 0x000b,
+	// Block 0x99, offset 0x2640
+	0x2641: 0x000a,
+	// Block 0x9a, offset 0x2680
+	0x2680: 0x000a, 0x2681: 0x000a, 0x2682: 0x000a, 0x2683: 0x000a, 0x2684: 0x000a, 0x2685: 0x000a,
+	0x2686: 0x000a, 0x2687: 0x000a, 0x2688: 0x000a, 0x2689: 0x000a, 0x268a: 0x000a, 0x268b: 0x000a,
+	0x268c: 0x000a, 0x2690: 0x000a, 0x2691: 0x000a,
+	0x2692: 0x000a, 0x2693: 0x000a, 0x2694: 0x000a, 0x2695: 0x000a, 0x2696: 0x000a, 0x2697: 0x000a,
+	0x2698: 0x000a, 0x2699: 0x000a, 0x269a: 0x000a, 0x269b: 0x000a, 0x269c: 0x000a,
+	0x26a0: 0x000a,
+	// Block 0x9b, offset 0x26c0
+	0x26fd: 0x000c,
+	// Block 0x9c, offset 0x2700
+	0x2720: 0x000c, 0x2721: 0x0002, 0x2722: 0x0002, 0x2723: 0x0002,
+	0x2724: 0x0002, 0x2725: 0x0002, 0x2726: 0x0002, 0x2727: 0x0002, 0x2728: 0x0002, 0x2729: 0x0002,
+	0x272a: 0x0002, 0x272b: 0x0002, 0x272c: 0x0002, 0x272d: 0x0002, 0x272e: 0x0002, 0x272f: 0x0002,
+	0x2730: 0x0002, 0x2731: 0x0002, 0x2732: 0x0002, 0x2733: 0x0002, 0x2734: 0x0002, 0x2735: 0x0002,
+	0x2736: 0x0002, 0x2737: 0x0002, 0x2738: 0x0002, 0x2739: 0x0002, 0x273a: 0x0002, 0x273b: 0x0002,
+	// Block 0x9d, offset 0x2740
+	0x2776: 0x000c, 0x2777: 0x000c, 0x2778: 0x000c, 0x2779: 0x000c, 0x277a: 0x000c,
+	// Block 0x9e, offset 0x2780
+	0x2780: 0x0001, 0x2781: 0x0001, 0x2782: 0x0001, 0x2783: 0x0001, 0x2784: 0x0001, 0x2785: 0x0001,
+	0x2786: 0x0001, 0x2787: 0x0001, 0x2788: 0x0001, 0x2789: 0x0001, 0x278a: 0x0001, 0x278b: 0x0001,
+	0x278c: 0x0001, 0x278d: 0x0001, 0x278e: 0x0001, 0x278f: 0x0001, 0x2790: 0x0001, 0x2791: 0x0001,
+	0x2792: 0x0001, 0x2793: 0x0001, 0x2794: 0x0001, 0x2795: 0x0001, 0x2796: 0x0001, 0x2797: 0x0001,
+	0x2798: 0x0001, 0x2799: 0x0001, 0x279a: 0x0001, 0x279b: 0x0001, 0x279c: 0x0001, 0x279d: 0x0001,
+	0x279e: 0x0001, 0x279f: 0x0001, 0x27a0: 0x0001, 0x27a1: 0x0001, 0x27a2: 0x0001, 0x27a3: 0x0001,
+	0x27a4: 0x0001, 0x27a5: 0x0001, 0x27a6: 0x0001, 0x27a7: 0x0001, 0x27a8: 0x0001, 0x27a9: 0x0001,
+	0x27aa: 0x0001, 0x27ab: 0x0001, 0x27ac: 0x0001, 0x27ad: 0x0001, 0x27ae: 0x0001, 0x27af: 0x0001,
+	0x27b0: 0x0001, 0x27b1: 0x0001, 0x27b2: 0x0001, 0x27b3: 0x0001, 0x27b4: 0x0001, 0x27b5: 0x0001,
+	0x27b6: 0x0001, 0x27b7: 0x0001, 0x27b8: 0x0001, 0x27b9: 0x0001, 0x27ba: 0x0001, 0x27bb: 0x0001,
+	0x27bc: 0x0001, 0x27bd: 0x0001, 0x27be: 0x0001, 0x27bf: 0x0001,
+	// Block 0x9f, offset 0x27c0
+	0x27c0: 0x0001, 0x27c1: 0x0001, 0x27c2: 0x0001, 0x27c3: 0x0001, 0x27c4: 0x0001, 0x27c5: 0x0001,
+	0x27c6: 0x0001, 0x27c7: 0x0001, 0x27c8: 0x0001, 0x27c9: 0x0001, 0x27ca: 0x0001, 0x27cb: 0x0001,
+	0x27cc: 0x0001, 0x27cd: 0x0001, 0x27ce: 0x0001, 0x27cf: 0x0001, 0x27d0: 0x0001, 0x27d1: 0x0001,
+	0x27d2: 0x0001, 0x27d3: 0x0001, 0x27d4: 0x0001, 0x27d5: 0x0001, 0x27d6: 0x0001, 0x27d7: 0x0001,
+	0x27d8: 0x0001, 0x27d9: 0x0001, 0x27da: 0x0001, 0x27db: 0x0001, 0x27dc: 0x0001, 0x27dd: 0x0001,
+	0x27de: 0x0001, 0x27df: 0x000a, 0x27e0: 0x0001, 0x27e1: 0x0001, 0x27e2: 0x0001, 0x27e3: 0x0001,
+	0x27e4: 0x0001, 0x27e5: 0x0001, 0x27e6: 0x0001, 0x27e7: 0x0001, 0x27e8: 0x0001, 0x27e9: 0x0001,
+	0x27ea: 0x0001, 0x27eb: 0x0001, 0x27ec: 0x0001, 0x27ed: 0x0001, 0x27ee: 0x0001, 0x27ef: 0x0001,
+	0x27f0: 0x0001, 0x27f1: 0x0001, 0x27f2: 0x0001, 0x27f3: 0x0001, 0x27f4: 0x0001, 0x27f5: 0x0001,
+	0x27f6: 0x0001, 0x27f7: 0x0001, 0x27f8: 0x0001, 0x27f9: 0x0001, 0x27fa: 0x0001, 0x27fb: 0x0001,
+	0x27fc: 0x0001, 0x27fd: 0x0001, 0x27fe: 0x0001, 0x27ff: 0x0001,
+	// Block 0xa0, offset 0x2800
+	0x2800: 0x0001, 0x2801: 0x000c, 0x2802: 0x000c, 0x2803: 0x000c, 0x2804: 0x0001, 0x2805: 0x000c,
+	0x2806: 0x000c, 0x2807: 0x0001, 0x2808: 0x0001, 0x2809: 0x0001, 0x280a: 0x0001, 0x280b: 0x0001,
+	0x280c: 0x000c, 0x280d: 0x000c, 0x280e: 0x000c, 0x280f: 0x000c, 0x2810: 0x0001, 0x2811: 0x0001,
+	0x2812: 0x0001, 0x2813: 0x0001, 0x2814: 0x0001, 0x2815: 0x0001, 0x2816: 0x0001, 0x2817: 0x0001,
+	0x2818: 0x0001, 0x2819: 0x0001, 0x281a: 0x0001, 0x281b: 0x0001, 0x281c: 0x0001, 0x281d: 0x0001,
+	0x281e: 0x0001, 0x281f: 0x0001, 0x2820: 0x0001, 0x2821: 0x0001, 0x2822: 0x0001, 0x2823: 0x0001,
+	0x2824: 0x0001, 0x2825: 0x0001, 0x2826: 0x0001, 0x2827: 0x0001, 0x2828: 0x0001, 0x2829: 0x0001,
+	0x282a: 0x0001, 0x282b: 0x0001, 0x282c: 0x0001, 0x282d: 0x0001, 0x282e: 0x0001, 0x282f: 0x0001,
+	0x2830: 0x0001, 0x2831: 0x0001, 0x2832: 0x0001, 0x2833: 0x0001, 0x2834: 0x0001, 0x2835: 0x0001,
+	0x2836: 0x0001, 0x2837: 0x0001, 0x2838: 0x000c, 0x2839: 0x000c, 0x283a: 0x000c, 0x283b: 0x0001,
+	0x283c: 0x0001, 0x283d: 0x0001, 0x283e: 0x0001, 0x283f: 0x000c,
+	// Block 0xa1, offset 0x2840
+	0x2840: 0x0001, 0x2841: 0x0001, 0x2842: 0x0001, 0x2843: 0x0001, 0x2844: 0x0001, 0x2845: 0x0001,
+	0x2846: 0x0001, 0x2847: 0x0001, 0x2848: 0x0001, 0x2849: 0x0001, 0x284a: 0x0001, 0x284b: 0x0001,
+	0x284c: 0x0001, 0x284d: 0x0001, 0x284e: 0x0001, 0x284f: 0x0001, 0x2850: 0x0001, 0x2851: 0x0001,
+	0x2852: 0x0001, 0x2853: 0x0001, 0x2854: 0x0001, 0x2855: 0x0001, 0x2856: 0x0001, 0x2857: 0x0001,
+	0x2858: 0x0001, 0x2859: 0x0001, 0x285a: 0x0001, 0x285b: 0x0001, 0x285c: 0x0001, 0x285d: 0x0001,
+	0x285e: 0x0001, 0x285f: 0x0001, 0x2860: 0x0001, 0x2861: 0x0001, 0x2862: 0x0001, 0x2863: 0x0001,
+	0x2864: 0x0001, 0x2865: 0x000c, 0x2866: 0x000c, 0x2867: 0x0001, 0x2868: 0x0001, 0x2869: 0x0001,
+	0x286a: 0x0001, 0x286b: 0x0001, 0x286c: 0x0001, 0x286d: 0x0001, 0x286e: 0x0001, 0x286f: 0x0001,
+	0x2870: 0x0001, 0x2871: 0x0001, 0x2872: 0x0001, 0x2873: 0x0001, 0x2874: 0x0001, 0x2875: 0x0001,
+	0x2876: 0x0001, 0x2877: 0x0001, 0x2878: 0x0001, 0x2879: 0x0001, 0x287a: 0x0001, 0x287b: 0x0001,
+	0x287c: 0x0001, 0x287d: 0x0001, 0x287e: 0x0001, 0x287f: 0x0001,
+	// Block 0xa2, offset 0x2880
+	0x2880: 0x0001, 0x2881: 0x0001, 0x2882: 0x0001, 0x2883: 0x0001, 0x2884: 0x0001, 0x2885: 0x0001,
+	0x2886: 0x0001, 0x2887: 0x0001, 0x2888: 0x0001, 0x2889: 0x0001, 0x288a: 0x0001, 0x288b: 0x0001,
+	0x288c: 0x0001, 0x288d: 0x0001, 0x288e: 0x0001, 0x288f: 0x0001, 0x2890: 0x0001, 0x2891: 0x0001,
+	0x2892: 0x0001, 0x2893: 0x0001, 0x2894: 0x0001, 0x2895: 0x0001, 0x2896: 0x0001, 0x2897: 0x0001,
+	0x2898: 0x0001, 0x2899: 0x0001, 0x289a: 0x0001, 0x289b: 0x0001, 0x289c: 0x0001, 0x289d: 0x0001,
+	0x289e: 0x0001, 0x289f: 0x0001, 0x28a0: 0x0001, 0x28a1: 0x0001, 0x28a2: 0x0001, 0x28a3: 0x0001,
+	0x28a4: 0x0001, 0x28a5: 0x0001, 0x28a6: 0x0001, 0x28a7: 0x0001, 0x28a8: 0x0001, 0x28a9: 0x0001,
+	0x28aa: 0x0001, 0x28ab: 0x0001, 0x28ac: 0x0001, 0x28ad: 0x0001, 0x28ae: 0x0001, 0x28af: 0x0001,
+	0x28b0: 0x0001, 0x28b1: 0x0001, 0x28b2: 0x0001, 0x28b3: 0x0001, 0x28b4: 0x0001, 0x28b5: 0x0001,
+	0x28b6: 0x0001, 0x28b7: 0x0001, 0x28b8: 0x0001, 0x28b9: 0x000a, 0x28ba: 0x000a, 0x28bb: 0x000a,
+	0x28bc: 0x000a, 0x28bd: 0x000a, 0x28be: 0x000a, 0x28bf: 0x000a,
+	// Block 0xa3, offset 0x28c0
+	0x28c0: 0x000d, 0x28c1: 0x000d, 0x28c2: 0x000d, 0x28c3: 0x000d, 0x28c4: 0x000d, 0x28c5: 0x000d,
+	0x28c6: 0x000d, 0x28c7: 0x000d, 0x28c8: 0x000d, 0x28c9: 0x000d, 0x28ca: 0x000d, 0x28cb: 0x000d,
+	0x28cc: 0x000d, 0x28cd: 0x000d, 0x28ce: 0x000d, 0x28cf: 0x000d, 0x28d0: 0x000d, 0x28d1: 0x000d,
+	0x28d2: 0x000d, 0x28d3: 0x000d, 0x28d4: 0x000d, 0x28d5: 0x000d, 0x28d6: 0x000d, 0x28d7: 0x000d,
+	0x28d8: 0x000d, 0x28d9: 0x000d, 0x28da: 0x000d, 0x28db: 0x000d, 0x28dc: 0x000d, 0x28dd: 0x000d,
+	0x28de: 0x000d, 0x28df: 0x000d, 0x28e0: 0x000d, 0x28e1: 0x000d, 0x28e2: 0x000d, 0x28e3: 0x000d,
+	0x28e4: 0x000c, 0x28e5: 0x000c, 0x28e6: 0x000c, 0x28e7: 0x000c, 0x28e8: 0x0001, 0x28e9: 0x0001,
+	0x28ea: 0x0001, 0x28eb: 0x0001, 0x28ec: 0x0001, 0x28ed: 0x0001, 0x28ee: 0x0001, 0x28ef: 0x0001,
+	0x28f0: 0x0005, 0x28f1: 0x0005, 0x28f2: 0x0005, 0x28f3: 0x0005, 0x28f4: 0x0005, 0x28f5: 0x0005,
+	0x28f6: 0x0005, 0x28f7: 0x0005, 0x28f8: 0x0005, 0x28f9: 0x0005, 0x28fa: 0x0001, 0x28fb: 0x0001,
+	0x28fc: 0x0001, 0x28fd: 0x0001, 0x28fe: 0x0001, 0x28ff: 0x0001,
+	// Block 0xa4, offset 0x2900
+	0x2900: 0x0001, 0x2901: 0x0001, 0x2902: 0x0001, 0x2903: 0x0001, 0x2904: 0x0001, 0x2905: 0x0001,
+	0x2906: 0x0001, 0x2907: 0x0001, 0x2908: 0x0001, 0x2909: 0x0001, 0x290a: 0x0001, 0x290b: 0x0001,
+	0x290c: 0x0001, 0x290d: 0x0001, 0x290e: 0x0001, 0x290f: 0x0001, 0x2910: 0x0001, 0x2911: 0x0001,
+	0x2912: 0x0001, 0x2913: 0x0001, 0x2914: 0x0001, 0x2915: 0x0001, 0x2916: 0x0001, 0x2917: 0x0001,
+	0x2918: 0x0001, 0x2919: 0x0001, 0x291a: 0x0001, 0x291b: 0x0001, 0x291c: 0x0001, 0x291d: 0x0001,
+	0x291e: 0x0001, 0x291f: 0x0001, 0x2920: 0x0005, 0x2921: 0x0005, 0x2922: 0x0005, 0x2923: 0x0005,
+	0x2924: 0x0005, 0x2925: 0x0005, 0x2926: 0x0005, 0x2927: 0x0005, 0x2928: 0x0005, 0x2929: 0x0005,
+	0x292a: 0x0005, 0x292b: 0x0005, 0x292c: 0x0005, 0x292d: 0x0005, 0x292e: 0x0005, 0x292f: 0x0005,
+	0x2930: 0x0005, 0x2931: 0x0005, 0x2932: 0x0005, 0x2933: 0x0005, 0x2934: 0x0005, 0x2935: 0x0005,
+	0x2936: 0x0005, 0x2937: 0x0005, 0x2938: 0x0005, 0x2939: 0x0005, 0x293a: 0x0005, 0x293b: 0x0005,
+	0x293c: 0x0005, 0x293d: 0x0005, 0x293e: 0x0005, 0x293f: 0x0001,
+	// Block 0xa5, offset 0x2940
+	0x2940: 0x0001, 0x2941: 0x0001, 0x2942: 0x0001, 0x2943: 0x0001, 0x2944: 0x0001, 0x2945: 0x0001,
+	0x2946: 0x0001, 0x2947: 0x0001, 0x2948: 0x0001, 0x2949: 0x0001, 0x294a: 0x0001, 0x294b: 0x0001,
+	0x294c: 0x0001, 0x294d: 0x0001, 0x294e: 0x0001, 0x294f: 0x0001, 0x2950: 0x0001, 0x2951: 0x0001,
+	0x2952: 0x0001, 0x2953: 0x0001, 0x2954: 0x0001, 0x2955: 0x0001, 0x2956: 0x0001, 0x2957: 0x0001,
+	0x2958: 0x0001, 0x2959: 0x0001, 0x295a: 0x0001, 0x295b: 0x0001, 0x295c: 0x0001, 0x295d: 0x0001,
+	0x295e: 0x0001, 0x295f: 0x0001, 0x2960: 0x0001, 0x2961: 0x0001, 0x2962: 0x0001, 0x2963: 0x0001,
+	0x2964: 0x0001, 0x2965: 0x0001, 0x2966: 0x0001, 0x2967: 0x0001, 0x2968: 0x0001, 0x2969: 0x0001,
+	0x296a: 0x0001, 0x296b: 0x000c, 0x296c: 0x000c, 0x296d: 0x0001, 0x296e: 0x0001, 0x296f: 0x0001,
+	0x2970: 0x0001, 0x2971: 0x0001, 0x2972: 0x0001, 0x2973: 0x0001, 0x2974: 0x0001, 0x2975: 0x0001,
+	0x2976: 0x0001, 0x2977: 0x0001, 0x2978: 0x0001, 0x2979: 0x0001, 0x297a: 0x0001, 0x297b: 0x0001,
+	0x297c: 0x0001, 0x297d: 0x0001, 0x297e: 0x0001, 0x297f: 0x0001,
+	// Block 0xa6, offset 0x2980
+	0x2980: 0x0001, 0x2981: 0x0001, 0x2982: 0x0001, 0x2983: 0x0001, 0x2984: 0x0001, 0x2985: 0x0001,
+	0x2986: 0x0001, 0x2987: 0x0001, 0x2988: 0x0001, 0x2989: 0x0001, 0x298a: 0x0001, 0x298b: 0x0001,
+	0x298c: 0x0001, 0x298d: 0x0001, 0x298e: 0x0001, 0x298f: 0x0001, 0x2990: 0x0001, 0x2991: 0x0001,
+	0x2992: 0x0001, 0x2993: 0x0001, 0x2994: 0x0001, 0x2995: 0x0001, 0x2996: 0x0001, 0x2997: 0x0001,
+	0x2998: 0x0001, 0x2999: 0x0001, 0x299a: 0x0001, 0x299b: 0x0001, 0x299c: 0x0001, 0x299d: 0x0001,
+	0x299e: 0x0001, 0x299f: 0x0001, 0x29a0: 0x0001, 0x29a1: 0x0001, 0x29a2: 0x0001, 0x29a3: 0x0001,
+	0x29a4: 0x0001, 0x29a5: 0x0001, 0x29a6: 0x0001, 0x29a7: 0x0001, 0x29a8: 0x0001, 0x29a9: 0x0001,
+	0x29aa: 0x0001, 0x29ab: 0x0001, 0x29ac: 0x0001, 0x29ad: 0x0001, 0x29ae: 0x0001, 0x29af: 0x0001,
+	0x29b0: 0x0001, 0x29b1: 0x0001, 0x29b2: 0x0001, 0x29b3: 0x0001, 0x29b4: 0x0001, 0x29b5: 0x0001,
+	0x29b6: 0x0001, 0x29b7: 0x0001, 0x29b8: 0x0001, 0x29b9: 0x0001, 0x29ba: 0x0001, 0x29bb: 0x0001,
+	0x29bc: 0x0001, 0x29bd: 0x000c, 0x29be: 0x000c, 0x29bf: 0x000c,
+	// Block 0xa7, offset 0x29c0
+	0x29c0: 0x0001, 0x29c1: 0x0001, 0x29c2: 0x0001, 0x29c3: 0x0001, 0x29c4: 0x0001, 0x29c5: 0x0001,
+	0x29c6: 0x0001, 0x29c7: 0x0001, 0x29c8: 0x0001, 0x29c9: 0x0001, 0x29ca: 0x0001, 0x29cb: 0x0001,
+	0x29cc: 0x0001, 0x29cd: 0x0001, 0x29ce: 0x0001, 0x29cf: 0x0001, 0x29d0: 0x0001, 0x29d1: 0x0001,
+	0x29d2: 0x0001, 0x29d3: 0x0001, 0x29d4: 0x0001, 0x29d5: 0x0001, 0x29d6: 0x0001, 0x29d7: 0x0001,
+	0x29d8: 0x0001, 0x29d9: 0x0001, 0x29da: 0x0001, 0x29db: 0x0001, 0x29dc: 0x0001, 0x29dd: 0x0001,
+	0x29de: 0x0001, 0x29df: 0x0001, 0x29e0: 0x0001, 0x29e1: 0x0001, 0x29e2: 0x0001, 0x29e3: 0x0001,
+	0x29e4: 0x0001, 0x29e5: 0x0001, 0x29e6: 0x0001, 0x29e7: 0x0001, 0x29e8: 0x0001, 0x29e9: 0x0001,
+	0x29ea: 0x0001, 0x29eb: 0x0001, 0x29ec: 0x0001, 0x29ed: 0x0001, 0x29ee: 0x0001, 0x29ef: 0x0001,
+	0x29f0: 0x000d, 0x29f1: 0x000d, 0x29f2: 0x000d, 0x29f3: 0x000d, 0x29f4: 0x000d, 0x29f5: 0x000d,
+	0x29f6: 0x000d, 0x29f7: 0x000d, 0x29f8: 0x000d, 0x29f9: 0x000d, 0x29fa: 0x000d, 0x29fb: 0x000d,
+	0x29fc: 0x000d, 0x29fd: 0x000d, 0x29fe: 0x000d, 0x29ff: 0x000d,
+	// Block 0xa8, offset 0x2a00
+	0x2a00: 0x000d, 0x2a01: 0x000d, 0x2a02: 0x000d, 0x2a03: 0x000d, 0x2a04: 0x000d, 0x2a05: 0x000d,
+	0x2a06: 0x000c, 0x2a07: 0x000c, 0x2a08: 0x000c, 0x2a09: 0x000c, 0x2a0a: 0x000c, 0x2a0b: 0x000c,
+	0x2a0c: 0x000c, 0x2a0d: 0x000c, 0x2a0e: 0x000c, 0x2a0f: 0x000c, 0x2a10: 0x000c, 0x2a11: 0x000d,
+	0x2a12: 0x000d, 0x2a13: 0x000d, 0x2a14: 0x000d, 0x2a15: 0x000d, 0x2a16: 0x000d, 0x2a17: 0x000d,
+	0x2a18: 0x000d, 0x2a19: 0x000d, 0x2a1a: 0x0001, 0x2a1b: 0x0001, 0x2a1c: 0x0001, 0x2a1d: 0x0001,
+	0x2a1e: 0x0001, 0x2a1f: 0x0001, 0x2a20: 0x0001, 0x2a21: 0x0001, 0x2a22: 0x0001, 0x2a23: 0x0001,
+	0x2a24: 0x0001, 0x2a25: 0x0001, 0x2a26: 0x0001, 0x2a27: 0x0001, 0x2a28: 0x0001, 0x2a29: 0x0001,
+	0x2a2a: 0x0001, 0x2a2b: 0x0001, 0x2a2c: 0x0001, 0x2a2d: 0x0001, 0x2a2e: 0x0001, 0x2a2f: 0x0001,
+	0x2a30: 0x0001, 0x2a31: 0x0001, 0x2a32: 0x0001, 0x2a33: 0x0001, 0x2a34: 0x0001, 0x2a35: 0x0001,
+	0x2a36: 0x0001, 0x2a37: 0x0001, 0x2a38: 0x0001, 0x2a39: 0x0001, 0x2a3a: 0x0001, 0x2a3b: 0x0001,
+	0x2a3c: 0x0001, 0x2a3d: 0x0001, 0x2a3e: 0x0001, 0x2a3f: 0x0001,
+	// Block 0xa9, offset 0x2a40
+	0x2a40: 0x0001, 0x2a41: 0x0001, 0x2a42: 0x000c, 0x2a43: 0x000c, 0x2a44: 0x000c, 0x2a45: 0x000c,
+	0x2a46: 0x0001, 0x2a47: 0x0001, 0x2a48: 0x0001, 0x2a49: 0x0001, 0x2a4a: 0x0001, 0x2a4b: 0x0001,
+	0x2a4c: 0x0001, 0x2a4d: 0x0001, 0x2a4e: 0x0001, 0x2a4f: 0x0001, 0x2a50: 0x0001, 0x2a51: 0x0001,
+	0x2a52: 0x0001, 0x2a53: 0x0001, 0x2a54: 0x0001, 0x2a55: 0x0001, 0x2a56: 0x0001, 0x2a57: 0x0001,
+	0x2a58: 0x0001, 0x2a59: 0x0001, 0x2a5a: 0x0001, 0x2a5b: 0x0001, 0x2a5c: 0x0001, 0x2a5d: 0x0001,
+	0x2a5e: 0x0001, 0x2a5f: 0x0001, 0x2a60: 0x0001, 0x2a61: 0x0001, 0x2a62: 0x0001, 0x2a63: 0x0001,
+	0x2a64: 0x0001, 0x2a65: 0x0001, 0x2a66: 0x0001, 0x2a67: 0x0001, 0x2a68: 0x0001, 0x2a69: 0x0001,
+	0x2a6a: 0x0001, 0x2a6b: 0x0001, 0x2a6c: 0x0001, 0x2a6d: 0x0001, 0x2a6e: 0x0001, 0x2a6f: 0x0001,
+	0x2a70: 0x0001, 0x2a71: 0x0001, 0x2a72: 0x0001, 0x2a73: 0x0001, 0x2a74: 0x0001, 0x2a75: 0x0001,
+	0x2a76: 0x0001, 0x2a77: 0x0001, 0x2a78: 0x0001, 0x2a79: 0x0001, 0x2a7a: 0x0001, 0x2a7b: 0x0001,
+	0x2a7c: 0x0001, 0x2a7d: 0x0001, 0x2a7e: 0x0001, 0x2a7f: 0x0001,
+	// Block 0xaa, offset 0x2a80
+	0x2a81: 0x000c,
+	0x2ab8: 0x000c, 0x2ab9: 0x000c, 0x2aba: 0x000c, 0x2abb: 0x000c,
+	0x2abc: 0x000c, 0x2abd: 0x000c, 0x2abe: 0x000c, 0x2abf: 0x000c,
+	// Block 0xab, offset 0x2ac0
+	0x2ac0: 0x000c, 0x2ac1: 0x000c, 0x2ac2: 0x000c, 0x2ac3: 0x000c, 0x2ac4: 0x000c, 0x2ac5: 0x000c,
+	0x2ac6: 0x000c,
+	0x2ad2: 0x000a, 0x2ad3: 0x000a, 0x2ad4: 0x000a, 0x2ad5: 0x000a, 0x2ad6: 0x000a, 0x2ad7: 0x000a,
+	0x2ad8: 0x000a, 0x2ad9: 0x000a, 0x2ada: 0x000a, 0x2adb: 0x000a, 0x2adc: 0x000a, 0x2add: 0x000a,
+	0x2ade: 0x000a, 0x2adf: 0x000a, 0x2ae0: 0x000a, 0x2ae1: 0x000a, 0x2ae2: 0x000a, 0x2ae3: 0x000a,
+	0x2ae4: 0x000a, 0x2ae5: 0x000a,
+	0x2af0: 0x000c, 0x2af3: 0x000c, 0x2af4: 0x000c,
+	0x2aff: 0x000c,
+	// Block 0xac, offset 0x2b00
+	0x2b00: 0x000c, 0x2b01: 0x000c,
+	0x2b33: 0x000c, 0x2b34: 0x000c, 0x2b35: 0x000c,
+	0x2b36: 0x000c, 0x2b39: 0x000c, 0x2b3a: 0x000c,
+	// Block 0xad, offset 0x2b40
+	0x2b40: 0x000c, 0x2b41: 0x000c, 0x2b42: 0x000c,
+	0x2b67: 0x000c, 0x2b68: 0x000c, 0x2b69: 0x000c,
+	0x2b6a: 0x000c, 0x2b6b: 0x000c, 0x2b6d: 0x000c, 0x2b6e: 0x000c, 0x2b6f: 0x000c,
+	0x2b70: 0x000c, 0x2b71: 0x000c, 0x2b72: 0x000c, 0x2b73: 0x000c, 0x2b74: 0x000c,
+	// Block 0xae, offset 0x2b80
+	0x2bb3: 0x000c,
+	// Block 0xaf, offset 0x2bc0
+	0x2bc0: 0x000c, 0x2bc1: 0x000c,
+	0x2bf6: 0x000c, 0x2bf7: 0x000c, 0x2bf8: 0x000c, 0x2bf9: 0x000c, 0x2bfa: 0x000c, 0x2bfb: 0x000c,
+	0x2bfc: 0x000c, 0x2bfd: 0x000c, 0x2bfe: 0x000c,
+	// Block 0xb0, offset 0x2c00
+	0x2c09: 0x000c, 0x2c0a: 0x000c, 0x2c0b: 0x000c,
+	0x2c0c: 0x000c, 0x2c0f: 0x000c,
+	// Block 0xb1, offset 0x2c40
+	0x2c6f: 0x000c,
+	0x2c70: 0x000c, 0x2c71: 0x000c, 0x2c74: 0x000c,
+	0x2c76: 0x000c, 0x2c77: 0x000c,
+	0x2c7e: 0x000c,
+	// Block 0xb2, offset 0x2c80
+	0x2c9f: 0x000c, 0x2ca3: 0x000c,
+	0x2ca4: 0x000c, 0x2ca5: 0x000c, 0x2ca6: 0x000c, 0x2ca7: 0x000c, 0x2ca8: 0x000c, 0x2ca9: 0x000c,
+	0x2caa: 0x000c,
+	// Block 0xb3, offset 0x2cc0
+	0x2cc0: 0x000c,
+	0x2ce6: 0x000c, 0x2ce7: 0x000c, 0x2ce8: 0x000c, 0x2ce9: 0x000c,
+	0x2cea: 0x000c, 0x2ceb: 0x000c, 0x2cec: 0x000c,
+	0x2cf0: 0x000c, 0x2cf1: 0x000c, 0x2cf2: 0x000c, 0x2cf3: 0x000c, 0x2cf4: 0x000c,
+	// Block 0xb4, offset 0x2d00
+	0x2d38: 0x000c, 0x2d39: 0x000c, 0x2d3a: 0x000c, 0x2d3b: 0x000c,
+	0x2d3c: 0x000c, 0x2d3d: 0x000c, 0x2d3e: 0x000c, 0x2d3f: 0x000c,
+	// Block 0xb5, offset 0x2d40
+	0x2d42: 0x000c, 0x2d43: 0x000c, 0x2d44: 0x000c,
+	0x2d46: 0x000c,
+	0x2d5e: 0x000c,
+	// Block 0xb6, offset 0x2d80
+	0x2db3: 0x000c, 0x2db4: 0x000c, 0x2db5: 0x000c,
+	0x2db6: 0x000c, 0x2db7: 0x000c, 0x2db8: 0x000c, 0x2dba: 0x000c,
+	0x2dbf: 0x000c,
+	// Block 0xb7, offset 0x2dc0
+	0x2dc0: 0x000c, 0x2dc2: 0x000c, 0x2dc3: 0x000c,
+	// Block 0xb8, offset 0x2e00
+	0x2e32: 0x000c, 0x2e33: 0x000c, 0x2e34: 0x000c, 0x2e35: 0x000c,
+	0x2e3c: 0x000c, 0x2e3d: 0x000c, 0x2e3f: 0x000c,
+	// Block 0xb9, offset 0x2e40
+	0x2e40: 0x000c,
+	0x2e5c: 0x000c, 0x2e5d: 0x000c,
+	// Block 0xba, offset 0x2e80
+	0x2eb3: 0x000c, 0x2eb4: 0x000c, 0x2eb5: 0x000c,
+	0x2eb6: 0x000c, 0x2eb7: 0x000c, 0x2eb8: 0x000c, 0x2eb9: 0x000c, 0x2eba: 0x000c,
+	0x2ebd: 0x000c, 0x2ebf: 0x000c,
+	// Block 0xbb, offset 0x2ec0
+	0x2ec0: 0x000c,
+	0x2ee0: 0x000a, 0x2ee1: 0x000a, 0x2ee2: 0x000a, 0x2ee3: 0x000a,
+	0x2ee4: 0x000a, 0x2ee5: 0x000a, 0x2ee6: 0x000a, 0x2ee7: 0x000a, 0x2ee8: 0x000a, 0x2ee9: 0x000a,
+	0x2eea: 0x000a, 0x2eeb: 0x000a, 0x2eec: 0x000a,
+	// Block 0xbc, offset 0x2f00
+	0x2f2b: 0x000c, 0x2f2d: 0x000c,
+	0x2f30: 0x000c, 0x2f31: 0x000c, 0x2f32: 0x000c, 0x2f33: 0x000c, 0x2f34: 0x000c, 0x2f35: 0x000c,
+	0x2f37: 0x000c,
+	// Block 0xbd, offset 0x2f40
+	0x2f5d: 0x000c,
+	0x2f5e: 0x000c, 0x2f5f: 0x000c, 0x2f62: 0x000c, 0x2f63: 0x000c,
+	0x2f64: 0x000c, 0x2f65: 0x000c, 0x2f67: 0x000c, 0x2f68: 0x000c, 0x2f69: 0x000c,
+	0x2f6a: 0x000c, 0x2f6b: 0x000c,
+	// Block 0xbe, offset 0x2f80
+	0x2faf: 0x000c,
+	0x2fb0: 0x000c, 0x2fb1: 0x000c, 0x2fb2: 0x000c, 0x2fb3: 0x000c, 0x2fb4: 0x000c, 0x2fb5: 0x000c,
+	0x2fb6: 0x000c, 0x2fb7: 0x000c, 0x2fb9: 0x000c, 0x2fba: 0x000c,
+	// Block 0xbf, offset 0x2fc0
+	0x2ffb: 0x000c,
+	0x2ffc: 0x000c, 0x2ffe: 0x000c,
+	// Block 0xc0, offset 0x3000
+	0x3003: 0x000c,
+	// Block 0xc1, offset 0x3040
+	0x3054: 0x000c, 0x3055: 0x000c, 0x3056: 0x000c, 0x3057: 0x000c,
+	0x305a: 0x000c, 0x305b: 0x000c,
+	0x3060: 0x000c,
+	// Block 0xc2, offset 0x3080
+	0x3081: 0x000c, 0x3082: 0x000c, 0x3083: 0x000c, 0x3084: 0x000c, 0x3085: 0x000c,
+	0x3086: 0x000c, 0x3089: 0x000c, 0x308a: 0x000c,
+	0x30b3: 0x000c, 0x30b4: 0x000c, 0x30b5: 0x000c,
+	0x30b6: 0x000c, 0x30b7: 0x000c, 0x30b8: 0x000c, 0x30bb: 0x000c,
+	0x30bc: 0x000c, 0x30bd: 0x000c, 0x30be: 0x000c,
+	// Block 0xc3, offset 0x30c0
+	0x30c7: 0x000c,
+	0x30d1: 0x000c,
+	0x30d2: 0x000c, 0x30d3: 0x000c, 0x30d4: 0x000c, 0x30d5: 0x000c, 0x30d6: 0x000c,
+	0x30d9: 0x000c, 0x30da: 0x000c, 0x30db: 0x000c,
+	// Block 0xc4, offset 0x3100
+	0x310a: 0x000c, 0x310b: 0x000c,
+	0x310c: 0x000c, 0x310d: 0x000c, 0x310e: 0x000c, 0x310f: 0x000c, 0x3110: 0x000c, 0x3111: 0x000c,
+	0x3112: 0x000c, 0x3113: 0x000c, 0x3114: 0x000c, 0x3115: 0x000c, 0x3116: 0x000c,
+	0x3118: 0x000c, 0x3119: 0x000c,
+	// Block 0xc5, offset 0x3140
+	0x3170: 0x000c, 0x3171: 0x000c, 0x3172: 0x000c, 0x3173: 0x000c, 0x3174: 0x000c, 0x3175: 0x000c,
+	0x3176: 0x000c, 0x3178: 0x000c, 0x3179: 0x000c, 0x317a: 0x000c, 0x317b: 0x000c,
+	0x317c: 0x000c, 0x317d: 0x000c,
+	// Block 0xc6, offset 0x3180
+	0x3192: 0x000c, 0x3193: 0x000c, 0x3194: 0x000c, 0x3195: 0x000c, 0x3196: 0x000c, 0x3197: 0x000c,
+	0x3198: 0x000c, 0x3199: 0x000c, 0x319a: 0x000c, 0x319b: 0x000c, 0x319c: 0x000c, 0x319d: 0x000c,
+	0x319e: 0x000c, 0x319f: 0x000c, 0x31a0: 0x000c, 0x31a1: 0x000c, 0x31a2: 0x000c, 0x31a3: 0x000c,
+	0x31a4: 0x000c, 0x31a5: 0x000c, 0x31a6: 0x000c, 0x31a7: 0x000c,
+	0x31aa: 0x000c, 0x31ab: 0x000c, 0x31ac: 0x000c, 0x31ad: 0x000c, 0x31ae: 0x000c, 0x31af: 0x000c,
+	0x31b0: 0x000c, 0x31b2: 0x000c, 0x31b3: 0x000c, 0x31b5: 0x000c,
+	0x31b6: 0x000c,
+	// Block 0xc7, offset 0x31c0
+	0x31f1: 0x000c, 0x31f2: 0x000c, 0x31f3: 0x000c, 0x31f4: 0x000c, 0x31f5: 0x000c,
+	0x31f6: 0x000c, 0x31fa: 0x000c,
+	0x31fc: 0x000c, 0x31fd: 0x000c, 0x31ff: 0x000c,
+	// Block 0xc8, offset 0x3200
+	0x3200: 0x000c, 0x3201: 0x000c, 0x3202: 0x000c, 0x3203: 0x000c, 0x3204: 0x000c, 0x3205: 0x000c,
+	0x3207: 0x000c,
+	// Block 0xc9, offset 0x3240
+	0x3250: 0x000c, 0x3251: 0x000c,
+	0x3255: 0x000c, 0x3257: 0x000c,
+	// Block 0xca, offset 0x3280
+	0x32b3: 0x000c, 0x32b4: 0x000c,
+	// Block 0xcb, offset 0x32c0
+	0x32c0: 0x000c, 0x32c1: 0x000c,
+	0x32f6: 0x000c, 0x32f7: 0x000c, 0x32f8: 0x000c, 0x32f9: 0x000c, 0x32fa: 0x000c,
+	// Block 0xcc, offset 0x3300
+	0x3300: 0x000c, 0x3302: 0x000c,
+	// Block 0xcd, offset 0x3340
+	0x3355: 0x000a, 0x3356: 0x000a, 0x3357: 0x000a,
+	0x3358: 0x000a, 0x3359: 0x000a, 0x335a: 0x000a, 0x335b: 0x000a, 0x335c: 0x000a, 0x335d: 0x0004,
+	0x335e: 0x0004, 0x335f: 0x0004, 0x3360: 0x0004, 0x3361: 0x000a, 0x3362: 0x000a, 0x3363: 0x000a,
+	0x3364: 0x000a, 0x3365: 0x000a, 0x3366: 0x000a, 0x3367: 0x000a, 0x3368: 0x000a, 0x3369: 0x000a,
+	0x336a: 0x000a, 0x336b: 0x000a, 0x336c: 0x000a, 0x336d: 0x000a, 0x336e: 0x000a, 0x336f: 0x000a,
+	0x3370: 0x000a, 0x3371: 0x000a,
+	// Block 0xce, offset 0x3380
+	0x3380: 0x000c,
+	0x3387: 0x000c, 0x3388: 0x000c, 0x3389: 0x000c, 0x338a: 0x000c, 0x338b: 0x000c,
+	0x338c: 0x000c, 0x338d: 0x000c, 0x338e: 0x000c, 0x338f: 0x000c, 0x3390: 0x000c, 0x3391: 0x000c,
+	0x3392: 0x000c, 0x3393: 0x000c, 0x3394: 0x000c, 0x3395: 0x000c,
+	// Block 0xcf, offset 0x33c0
+	0x33f0: 0x000c, 0x33f1: 0x000c, 0x33f2: 0x000c, 0x33f3: 0x000c, 0x33f4: 0x000c,
+	// Block 0xd0, offset 0x3400
+	0x3430: 0x000c, 0x3431: 0x000c, 0x3432: 0x000c, 0x3433: 0x000c, 0x3434: 0x000c, 0x3435: 0x000c,
+	0x3436: 0x000c,
+	// Block 0xd1, offset 0x3440
+	0x344f: 0x000c,
+	// Block 0xd2, offset 0x3480
+	0x348f: 0x000c, 0x3490: 0x000c, 0x3491: 0x000c,
+	0x3492: 0x000c,
+	// Block 0xd3, offset 0x34c0
+	0x34e2: 0x000a,
+	0x34e4: 0x000c,
+	// Block 0xd4, offset 0x3500
+	0x351d: 0x000c,
+	0x351e: 0x000c, 0x3520: 0x000b, 0x3521: 0x000b, 0x3522: 0x000b, 0x3523: 0x000b,
+	// Block 0xd5, offset 0x3540
+	0x3540: 0x000c, 0x3541: 0x000c, 0x3542: 0x000c, 0x3543: 0x000c, 0x3544: 0x000c, 0x3545: 0x000c,
+	0x3546: 0x000c, 0x3547: 0x000c, 0x3548: 0x000c, 0x3549: 0x000c, 0x354a: 0x000c, 0x354b: 0x000c,
+	0x354c: 0x000c, 0x354d: 0x000c, 0x354e: 0x000c, 0x354f: 0x000c, 0x3550: 0x000c, 0x3551: 0x000c,
+	0x3552: 0x000c, 0x3553: 0x000c, 0x3554: 0x000c, 0x3555: 0x000c, 0x3556: 0x000c, 0x3557: 0x000c,
+	0x3558: 0x000c, 0x3559: 0x000c, 0x355a: 0x000c, 0x355b: 0x000c, 0x355c: 0x000c, 0x355d: 0x000c,
+	0x355e: 0x000c, 0x355f: 0x000c, 0x3560: 0x000c, 0x3561: 0x000c, 0x3562: 0x000c, 0x3563: 0x000c,
+	0x3564: 0x000c, 0x3565: 0x000c, 0x3566: 0x000c, 0x3567: 0x000c, 0x3568: 0x000c, 0x3569: 0x000c,
+	0x356a: 0x000c, 0x356b: 0x000c, 0x356c: 0x000c, 0x356d: 0x000c,
+	0x3570: 0x000c, 0x3571: 0x000c, 0x3572: 0x000c, 0x3573: 0x000c, 0x3574: 0x000c, 0x3575: 0x000c,
+	0x3576: 0x000c, 0x3577: 0x000c, 0x3578: 0x000c, 0x3579: 0x000c, 0x357a: 0x000c, 0x357b: 0x000c,
+	0x357c: 0x000c, 0x357d: 0x000c, 0x357e: 0x000c, 0x357f: 0x000c,
+	// Block 0xd6, offset 0x3580
+	0x3580: 0x000c, 0x3581: 0x000c, 0x3582: 0x000c, 0x3583: 0x000c, 0x3584: 0x000c, 0x3585: 0x000c,
+	0x3586: 0x000c,
+	// Block 0xd7, offset 0x35c0
+	0x35e7: 0x000c, 0x35e8: 0x000c, 0x35e9: 0x000c,
+	0x35f3: 0x000b, 0x35f4: 0x000b, 0x35f5: 0x000b,
+	0x35f6: 0x000b, 0x35f7: 0x000b, 0x35f8: 0x000b, 0x35f9: 0x000b, 0x35fa: 0x000b, 0x35fb: 0x000c,
+	0x35fc: 0x000c, 0x35fd: 0x000c, 0x35fe: 0x000c, 0x35ff: 0x000c,
+	// Block 0xd8, offset 0x3600
+	0x3600: 0x000c, 0x3601: 0x000c, 0x3602: 0x000c, 0x3605: 0x000c,
+	0x3606: 0x000c, 0x3607: 0x000c, 0x3608: 0x000c, 0x3609: 0x000c, 0x360a: 0x000c, 0x360b: 0x000c,
+	0x362a: 0x000c, 0x362b: 0x000c, 0x362c: 0x000c, 0x362d: 0x000c,
+	// Block 0xd9, offset 0x3640
+	0x3669: 0x000a,
+	0x366a: 0x000a,
+	// Block 0xda, offset 0x3680
+	0x3680: 0x000a, 0x3681: 0x000a, 0x3682: 0x000c, 0x3683: 0x000c, 0x3684: 0x000c, 0x3685: 0x000a,
+	// Block 0xdb, offset 0x36c0
+	0x36c0: 0x000a, 0x36c1: 0x000a, 0x36c2: 0x000a, 0x36c3: 0x000a, 0x36c4: 0x000a, 0x36c5: 0x000a,
+	0x36c6: 0x000a, 0x36c7: 0x000a, 0x36c8: 0x000a, 0x36c9: 0x000a, 0x36ca: 0x000a, 0x36cb: 0x000a,
+	0x36cc: 0x000a, 0x36cd: 0x000a, 0x36ce: 0x000a, 0x36cf: 0x000a, 0x36d0: 0x000a, 0x36d1: 0x000a,
+	0x36d2: 0x000a, 0x36d3: 0x000a, 0x36d4: 0x000a, 0x36d5: 0x000a, 0x36d6: 0x000a,
+	// Block 0xdc, offset 0x3700
+	0x371b: 0x000a,
+	// Block 0xdd, offset 0x3740
+	0x3755: 0x000a,
+	// Block 0xde, offset 0x3780
+	0x378f: 0x000a,
+	// Block 0xdf, offset 0x37c0
+	0x37c9: 0x000a,
+	// Block 0xe0, offset 0x3800
+	0x3803: 0x000a,
+	0x380e: 0x0002, 0x380f: 0x0002, 0x3810: 0x0002, 0x3811: 0x0002,
+	0x3812: 0x0002, 0x3813: 0x0002, 0x3814: 0x0002, 0x3815: 0x0002, 0x3816: 0x0002, 0x3817: 0x0002,
+	0x3818: 0x0002, 0x3819: 0x0002, 0x381a: 0x0002, 0x381b: 0x0002, 0x381c: 0x0002, 0x381d: 0x0002,
+	0x381e: 0x0002, 0x381f: 0x0002, 0x3820: 0x0002, 0x3821: 0x0002, 0x3822: 0x0002, 0x3823: 0x0002,
+	0x3824: 0x0002, 0x3825: 0x0002, 0x3826: 0x0002, 0x3827: 0x0002, 0x3828: 0x0002, 0x3829: 0x0002,
+	0x382a: 0x0002, 0x382b: 0x0002, 0x382c: 0x0002, 0x382d: 0x0002, 0x382e: 0x0002, 0x382f: 0x0002,
+	0x3830: 0x0002, 0x3831: 0x0002, 0x3832: 0x0002, 0x3833: 0x0002, 0x3834: 0x0002, 0x3835: 0x0002,
+	0x3836: 0x0002, 0x3837: 0x0002, 0x3838: 0x0002, 0x3839: 0x0002, 0x383a: 0x0002, 0x383b: 0x0002,
+	0x383c: 0x0002, 0x383d: 0x0002, 0x383e: 0x0002, 0x383f: 0x0002,
+	// Block 0xe1, offset 0x3840
+	0x3840: 0x000c, 0x3841: 0x000c, 0x3842: 0x000c, 0x3843: 0x000c, 0x3844: 0x000c, 0x3845: 0x000c,
+	0x3846: 0x000c, 0x3847: 0x000c, 0x3848: 0x000c, 0x3849: 0x000c, 0x384a: 0x000c, 0x384b: 0x000c,
+	0x384c: 0x000c, 0x384d: 0x000c, 0x384e: 0x000c, 0x384f: 0x000c, 0x3850: 0x000c, 0x3851: 0x000c,
+	0x3852: 0x000c, 0x3853: 0x000c, 0x3854: 0x000c, 0x3855: 0x000c, 0x3856: 0x000c, 0x3857: 0x000c,
+	0x3858: 0x000c, 0x3859: 0x000c, 0x385a: 0x000c, 0x385b: 0x000c, 0x385c: 0x000c, 0x385d: 0x000c,
+	0x385e: 0x000c, 0x385f: 0x000c, 0x3860: 0x000c, 0x3861: 0x000c, 0x3862: 0x000c, 0x3863: 0x000c,
+	0x3864: 0x000c, 0x3865: 0x000c, 0x3866: 0x000c, 0x3867: 0x000c, 0x3868: 0x000c, 0x3869: 0x000c,
+	0x386a: 0x000c, 0x386b: 0x000c, 0x386c: 0x000c, 0x386d: 0x000c, 0x386e: 0x000c, 0x386f: 0x000c,
+	0x3870: 0x000c, 0x3871: 0x000c, 0x3872: 0x000c, 0x3873: 0x000c, 0x3874: 0x000c, 0x3875: 0x000c,
+	0x3876: 0x000c, 0x387b: 0x000c,
+	0x387c: 0x000c, 0x387d: 0x000c, 0x387e: 0x000c, 0x387f: 0x000c,
+	// Block 0xe2, offset 0x3880
+	0x3880: 0x000c, 0x3881: 0x000c, 0x3882: 0x000c, 0x3883: 0x000c, 0x3884: 0x000c, 0x3885: 0x000c,
+	0x3886: 0x000c, 0x3887: 0x000c, 0x3888: 0x000c, 0x3889: 0x000c, 0x388a: 0x000c, 0x388b: 0x000c,
+	0x388c: 0x000c, 0x388d: 0x000c, 0x388e: 0x000c, 0x388f: 0x000c, 0x3890: 0x000c, 0x3891: 0x000c,
+	0x3892: 0x000c, 0x3893: 0x000c, 0x3894: 0x000c, 0x3895: 0x000c, 0x3896: 0x000c, 0x3897: 0x000c,
+	0x3898: 0x000c, 0x3899: 0x000c, 0x389a: 0x000c, 0x389b: 0x000c, 0x389c: 0x000c, 0x389d: 0x000c,
+	0x389e: 0x000c, 0x389f: 0x000c, 0x38a0: 0x000c, 0x38a1: 0x000c, 0x38a2: 0x000c, 0x38a3: 0x000c,
+	0x38a4: 0x000c, 0x38a5: 0x000c, 0x38a6: 0x000c, 0x38a7: 0x000c, 0x38a8: 0x000c, 0x38a9: 0x000c,
+	0x38aa: 0x000c, 0x38ab: 0x000c, 0x38ac: 0x000c,
+	0x38b5: 0x000c,
+	// Block 0xe3, offset 0x38c0
+	0x38c4: 0x000c,
+	0x38db: 0x000c, 0x38dc: 0x000c, 0x38dd: 0x000c,
+	0x38de: 0x000c, 0x38df: 0x000c, 0x38e1: 0x000c, 0x38e2: 0x000c, 0x38e3: 0x000c,
+	0x38e4: 0x000c, 0x38e5: 0x000c, 0x38e6: 0x000c, 0x38e7: 0x000c, 0x38e8: 0x000c, 0x38e9: 0x000c,
+	0x38ea: 0x000c, 0x38eb: 0x000c, 0x38ec: 0x000c, 0x38ed: 0x000c, 0x38ee: 0x000c, 0x38ef: 0x000c,
+	// Block 0xe4, offset 0x3900
+	0x3900: 0x000c, 0x3901: 0x000c, 0x3902: 0x000c, 0x3903: 0x000c, 0x3904: 0x000c, 0x3905: 0x000c,
+	0x3906: 0x000c, 0x3908: 0x000c, 0x3909: 0x000c, 0x390a: 0x000c, 0x390b: 0x000c,
+	0x390c: 0x000c, 0x390d: 0x000c, 0x390e: 0x000c, 0x390f: 0x000c, 0x3910: 0x000c, 0x3911: 0x000c,
+	0x3912: 0x000c, 0x3913: 0x000c, 0x3914: 0x000c, 0x3915: 0x000c, 0x3916: 0x000c, 0x3917: 0x000c,
+	0x3918: 0x000c, 0x391b: 0x000c, 0x391c: 0x000c, 0x391d: 0x000c,
+	0x391e: 0x000c, 0x391f: 0x000c, 0x3920: 0x000c, 0x3921: 0x000c, 0x3923: 0x000c,
+	0x3924: 0x000c, 0x3926: 0x000c, 0x3927: 0x000c, 0x3928: 0x000c, 0x3929: 0x000c,
+	0x392a: 0x000c,
+	// Block 0xe5, offset 0x3940
+	0x396e: 0x000c,
+	// Block 0xe6, offset 0x3980
+	0x39ac: 0x000c, 0x39ad: 0x000c, 0x39ae: 0x000c, 0x39af: 0x000c,
+	0x39bf: 0x0004,
+	// Block 0xe7, offset 0x39c0
+	0x39ec: 0x000c, 0x39ed: 0x000c, 0x39ee: 0x000c, 0x39ef: 0x000c,
+	// Block 0xe8, offset 0x3a00
+	0x3a00: 0x0001, 0x3a01: 0x0001, 0x3a02: 0x0001, 0x3a03: 0x0001, 0x3a04: 0x0001, 0x3a05: 0x0001,
+	0x3a06: 0x0001, 0x3a07: 0x0001, 0x3a08: 0x0001, 0x3a09: 0x0001, 0x3a0a: 0x0001, 0x3a0b: 0x0001,
+	0x3a0c: 0x0001, 0x3a0d: 0x0001, 0x3a0e: 0x0001, 0x3a0f: 0x0001, 0x3a10: 0x000c, 0x3a11: 0x000c,
+	0x3a12: 0x000c, 0x3a13: 0x000c, 0x3a14: 0x000c, 0x3a15: 0x000c, 0x3a16: 0x000c, 0x3a17: 0x0001,
+	0x3a18: 0x0001, 0x3a19: 0x0001, 0x3a1a: 0x0001, 0x3a1b: 0x0001, 0x3a1c: 0x0001, 0x3a1d: 0x0001,
+	0x3a1e: 0x0001, 0x3a1f: 0x0001, 0x3a20: 0x0001, 0x3a21: 0x0001, 0x3a22: 0x0001, 0x3a23: 0x0001,
+	0x3a24: 0x0001, 0x3a25: 0x0001, 0x3a26: 0x0001, 0x3a27: 0x0001, 0x3a28: 0x0001, 0x3a29: 0x0001,
+	0x3a2a: 0x0001, 0x3a2b: 0x0001, 0x3a2c: 0x0001, 0x3a2d: 0x0001, 0x3a2e: 0x0001, 0x3a2f: 0x0001,
+	0x3a30: 0x0001, 0x3a31: 0x0001, 0x3a32: 0x0001, 0x3a33: 0x0001, 0x3a34: 0x0001, 0x3a35: 0x0001,
+	0x3a36: 0x0001, 0x3a37: 0x0001, 0x3a38: 0x0001, 0x3a39: 0x0001, 0x3a3a: 0x0001, 0x3a3b: 0x0001,
+	0x3a3c: 0x0001, 0x3a3d: 0x0001, 0x3a3e: 0x0001, 0x3a3f: 0x0001,
+	// Block 0xe9, offset 0x3a40
+	0x3a40: 0x0001, 0x3a41: 0x0001, 0x3a42: 0x0001, 0x3a43: 0x0001, 0x3a44: 0x000c, 0x3a45: 0x000c,
+	0x3a46: 0x000c, 0x3a47: 0x000c, 0x3a48: 0x000c, 0x3a49: 0x000c, 0x3a4a: 0x000c, 0x3a4b: 0x0001,
+	0x3a4c: 0x0001, 0x3a4d: 0x0001, 0x3a4e: 0x0001, 0x3a4f: 0x0001, 0x3a50: 0x0001, 0x3a51: 0x0001,
+	0x3a52: 0x0001, 0x3a53: 0x0001, 0x3a54: 0x0001, 0x3a55: 0x0001, 0x3a56: 0x0001, 0x3a57: 0x0001,
+	0x3a58: 0x0001, 0x3a59: 0x0001, 0x3a5a: 0x0001, 0x3a5b: 0x0001, 0x3a5c: 0x0001, 0x3a5d: 0x0001,
+	0x3a5e: 0x0001, 0x3a5f: 0x0001, 0x3a60: 0x0001, 0x3a61: 0x0001, 0x3a62: 0x0001, 0x3a63: 0x0001,
+	0x3a64: 0x0001, 0x3a65: 0x0001, 0x3a66: 0x0001, 0x3a67: 0x0001, 0x3a68: 0x0001, 0x3a69: 0x0001,
+	0x3a6a: 0x0001, 0x3a6b: 0x0001, 0x3a6c: 0x0001, 0x3a6d: 0x0001, 0x3a6e: 0x0001, 0x3a6f: 0x0001,
+	0x3a70: 0x0001, 0x3a71: 0x0001, 0x3a72: 0x0001, 0x3a73: 0x0001, 0x3a74: 0x0001, 0x3a75: 0x0001,
+	0x3a76: 0x0001, 0x3a77: 0x0001, 0x3a78: 0x0001, 0x3a79: 0x0001, 0x3a7a: 0x0001, 0x3a7b: 0x0001,
+	0x3a7c: 0x0001, 0x3a7d: 0x0001, 0x3a7e: 0x0001, 0x3a7f: 0x0001,
+	// Block 0xea, offset 0x3a80
+	0x3a80: 0x0001, 0x3a81: 0x0001, 0x3a82: 0x0001, 0x3a83: 0x0001, 0x3a84: 0x0001, 0x3a85: 0x0001,
+	0x3a86: 0x0001, 0x3a87: 0x0001, 0x3a88: 0x0001, 0x3a89: 0x0001, 0x3a8a: 0x0001, 0x3a8b: 0x0001,
+	0x3a8c: 0x0001, 0x3a8d: 0x0001, 0x3a8e: 0x0001, 0x3a8f: 0x0001, 0x3a90: 0x0001, 0x3a91: 0x0001,
+	0x3a92: 0x0001, 0x3a93: 0x0001, 0x3a94: 0x0001, 0x3a95: 0x0001, 0x3a96: 0x0001, 0x3a97: 0x0001,
+	0x3a98: 0x0001, 0x3a99: 0x0001, 0x3a9a: 0x0001, 0x3a9b: 0x0001, 0x3a9c: 0x0001, 0x3a9d: 0x0001,
+	0x3a9e: 0x0001, 0x3a9f: 0x0001, 0x3aa0: 0x0001, 0x3aa1: 0x0001, 0x3aa2: 0x0001, 0x3aa3: 0x0001,
+	0x3aa4: 0x0001, 0x3aa5: 0x0001, 0x3aa6: 0x0001, 0x3aa7: 0x0001, 0x3aa8: 0x0001, 0x3aa9: 0x0001,
+	0x3aaa: 0x0001, 0x3aab: 0x0001, 0x3aac: 0x0001, 0x3aad: 0x0001, 0x3aae: 0x0001, 0x3aaf: 0x0001,
+	0x3ab0: 0x0001, 0x3ab1: 0x000d, 0x3ab2: 0x000d, 0x3ab3: 0x000d, 0x3ab4: 0x000d, 0x3ab5: 0x000d,
+	0x3ab6: 0x000d, 0x3ab7: 0x000d, 0x3ab8: 0x000d, 0x3ab9: 0x000d, 0x3aba: 0x000d, 0x3abb: 0x000d,
+	0x3abc: 0x000d, 0x3abd: 0x000d, 0x3abe: 0x000d, 0x3abf: 0x000d,
+	// Block 0xeb, offset 0x3ac0
+	0x3ac0: 0x000d, 0x3ac1: 0x000d, 0x3ac2: 0x000d, 0x3ac3: 0x000d, 0x3ac4: 0x000d, 0x3ac5: 0x000d,
+	0x3ac6: 0x000d, 0x3ac7: 0x000d, 0x3ac8: 0x000d, 0x3ac9: 0x000d, 0x3aca: 0x000d, 0x3acb: 0x000d,
+	0x3acc: 0x000d, 0x3acd: 0x000d, 0x3ace: 0x000d, 0x3acf: 0x000d, 0x3ad0: 0x000d, 0x3ad1: 0x000d,
+	0x3ad2: 0x000d, 0x3ad3: 0x000d, 0x3ad4: 0x000d, 0x3ad5: 0x000d, 0x3ad6: 0x000d, 0x3ad7: 0x000d,
+	0x3ad8: 0x000d, 0x3ad9: 0x000d, 0x3ada: 0x000d, 0x3adb: 0x000d, 0x3adc: 0x000d, 0x3add: 0x000d,
+	0x3ade: 0x000d, 0x3adf: 0x000d, 0x3ae0: 0x000d, 0x3ae1: 0x000d, 0x3ae2: 0x000d, 0x3ae3: 0x000d,
+	0x3ae4: 0x000d, 0x3ae5: 0x000d, 0x3ae6: 0x000d, 0x3ae7: 0x000d, 0x3ae8: 0x000d, 0x3ae9: 0x000d,
+	0x3aea: 0x000d, 0x3aeb: 0x000d, 0x3aec: 0x000d, 0x3aed: 0x000d, 0x3aee: 0x000d, 0x3aef: 0x000d,
+	0x3af0: 0x000d, 0x3af1: 0x000d, 0x3af2: 0x000d, 0x3af3: 0x000d, 0x3af4: 0x000d, 0x3af5: 0x0001,
+	0x3af6: 0x0001, 0x3af7: 0x0001, 0x3af8: 0x0001, 0x3af9: 0x0001, 0x3afa: 0x0001, 0x3afb: 0x0001,
+	0x3afc: 0x0001, 0x3afd: 0x0001, 0x3afe: 0x0001, 0x3aff: 0x0001,
+	// Block 0xec, offset 0x3b00
+	0x3b00: 0x0001, 0x3b01: 0x000d, 0x3b02: 0x000d, 0x3b03: 0x000d, 0x3b04: 0x000d, 0x3b05: 0x000d,
+	0x3b06: 0x000d, 0x3b07: 0x000d, 0x3b08: 0x000d, 0x3b09: 0x000d, 0x3b0a: 0x000d, 0x3b0b: 0x000d,
+	0x3b0c: 0x000d, 0x3b0d: 0x000d, 0x3b0e: 0x000d, 0x3b0f: 0x000d, 0x3b10: 0x000d, 0x3b11: 0x000d,
+	0x3b12: 0x000d, 0x3b13: 0x000d, 0x3b14: 0x000d, 0x3b15: 0x000d, 0x3b16: 0x000d, 0x3b17: 0x000d,
+	0x3b18: 0x000d, 0x3b19: 0x000d, 0x3b1a: 0x000d, 0x3b1b: 0x000d, 0x3b1c: 0x000d, 0x3b1d: 0x000d,
+	0x3b1e: 0x000d, 0x3b1f: 0x000d, 0x3b20: 0x000d, 0x3b21: 0x000d, 0x3b22: 0x000d, 0x3b23: 0x000d,
+	0x3b24: 0x000d, 0x3b25: 0x000d, 0x3b26: 0x000d, 0x3b27: 0x000d, 0x3b28: 0x000d, 0x3b29: 0x000d,
+	0x3b2a: 0x000d, 0x3b2b: 0x000d, 0x3b2c: 0x000d, 0x3b2d: 0x000d, 0x3b2e: 0x000d, 0x3b2f: 0x000d,
+	0x3b30: 0x000d, 0x3b31: 0x000d, 0x3b32: 0x000d, 0x3b33: 0x000d, 0x3b34: 0x000d, 0x3b35: 0x000d,
+	0x3b36: 0x000d, 0x3b37: 0x000d, 0x3b38: 0x000d, 0x3b39: 0x000d, 0x3b3a: 0x000d, 0x3b3b: 0x000d,
+	0x3b3c: 0x000d, 0x3b3d: 0x000d, 0x3b3e: 0x0001, 0x3b3f: 0x0001,
+	// Block 0xed, offset 0x3b40
+	0x3b40: 0x000d, 0x3b41: 0x000d, 0x3b42: 0x000d, 0x3b43: 0x000d, 0x3b44: 0x000d, 0x3b45: 0x000d,
+	0x3b46: 0x000d, 0x3b47: 0x000d, 0x3b48: 0x000d, 0x3b49: 0x000d, 0x3b4a: 0x000d, 0x3b4b: 0x000d,
+	0x3b4c: 0x000d, 0x3b4d: 0x000d, 0x3b4e: 0x000d, 0x3b4f: 0x000d, 0x3b50: 0x000d, 0x3b51: 0x000d,
+	0x3b52: 0x000d, 0x3b53: 0x000d, 0x3b54: 0x000d, 0x3b55: 0x000d, 0x3b56: 0x000d, 0x3b57: 0x000d,
+	0x3b58: 0x000d, 0x3b59: 0x000d, 0x3b5a: 0x000d, 0x3b5b: 0x000d, 0x3b5c: 0x000d, 0x3b5d: 0x000d,
+	0x3b5e: 0x000d, 0x3b5f: 0x000d, 0x3b60: 0x000d, 0x3b61: 0x000d, 0x3b62: 0x000d, 0x3b63: 0x000d,
+	0x3b64: 0x000d, 0x3b65: 0x000d, 0x3b66: 0x000d, 0x3b67: 0x000d, 0x3b68: 0x000d, 0x3b69: 0x000d,
+	0x3b6a: 0x000d, 0x3b6b: 0x000d, 0x3b6c: 0x000d, 0x3b6d: 0x000d, 0x3b6e: 0x000d, 0x3b6f: 0x000d,
+	0x3b70: 0x000a, 0x3b71: 0x000a, 0x3b72: 0x000d, 0x3b73: 0x000d, 0x3b74: 0x000d, 0x3b75: 0x000d,
+	0x3b76: 0x000d, 0x3b77: 0x000d, 0x3b78: 0x000d, 0x3b79: 0x000d, 0x3b7a: 0x000d, 0x3b7b: 0x000d,
+	0x3b7c: 0x000d, 0x3b7d: 0x000d, 0x3b7e: 0x000d, 0x3b7f: 0x000d,
+	// Block 0xee, offset 0x3b80
+	0x3b80: 0x000a, 0x3b81: 0x000a, 0x3b82: 0x000a, 0x3b83: 0x000a, 0x3b84: 0x000a, 0x3b85: 0x000a,
+	0x3b86: 0x000a, 0x3b87: 0x000a, 0x3b88: 0x000a, 0x3b89: 0x000a, 0x3b8a: 0x000a, 0x3b8b: 0x000a,
+	0x3b8c: 0x000a, 0x3b8d: 0x000a, 0x3b8e: 0x000a, 0x3b8f: 0x000a, 0x3b90: 0x000a, 0x3b91: 0x000a,
+	0x3b92: 0x000a, 0x3b93: 0x000a, 0x3b94: 0x000a, 0x3b95: 0x000a, 0x3b96: 0x000a, 0x3b97: 0x000a,
+	0x3b98: 0x000a, 0x3b99: 0x000a, 0x3b9a: 0x000a, 0x3b9b: 0x000a, 0x3b9c: 0x000a, 0x3b9d: 0x000a,
+	0x3b9e: 0x000a, 0x3b9f: 0x000a, 0x3ba0: 0x000a, 0x3ba1: 0x000a, 0x3ba2: 0x000a, 0x3ba3: 0x000a,
+	0x3ba4: 0x000a, 0x3ba5: 0x000a, 0x3ba6: 0x000a, 0x3ba7: 0x000a, 0x3ba8: 0x000a, 0x3ba9: 0x000a,
+	0x3baa: 0x000a, 0x3bab: 0x000a,
+	0x3bb0: 0x000a, 0x3bb1: 0x000a, 0x3bb2: 0x000a, 0x3bb3: 0x000a, 0x3bb4: 0x000a, 0x3bb5: 0x000a,
+	0x3bb6: 0x000a, 0x3bb7: 0x000a, 0x3bb8: 0x000a, 0x3bb9: 0x000a, 0x3bba: 0x000a, 0x3bbb: 0x000a,
+	0x3bbc: 0x000a, 0x3bbd: 0x000a, 0x3bbe: 0x000a, 0x3bbf: 0x000a,
+	// Block 0xef, offset 0x3bc0
+	0x3bc0: 0x000a, 0x3bc1: 0x000a, 0x3bc2: 0x000a, 0x3bc3: 0x000a, 0x3bc4: 0x000a, 0x3bc5: 0x000a,
+	0x3bc6: 0x000a, 0x3bc7: 0x000a, 0x3bc8: 0x000a, 0x3bc9: 0x000a, 0x3bca: 0x000a, 0x3bcb: 0x000a,
+	0x3bcc: 0x000a, 0x3bcd: 0x000a, 0x3bce: 0x000a, 0x3bcf: 0x000a, 0x3bd0: 0x000a, 0x3bd1: 0x000a,
+	0x3bd2: 0x000a, 0x3bd3: 0x000a,
+	0x3be0: 0x000a, 0x3be1: 0x000a, 0x3be2: 0x000a, 0x3be3: 0x000a,
+	0x3be4: 0x000a, 0x3be5: 0x000a, 0x3be6: 0x000a, 0x3be7: 0x000a, 0x3be8: 0x000a, 0x3be9: 0x000a,
+	0x3bea: 0x000a, 0x3beb: 0x000a, 0x3bec: 0x000a, 0x3bed: 0x000a, 0x3bee: 0x000a,
+	0x3bf1: 0x000a, 0x3bf2: 0x000a, 0x3bf3: 0x000a, 0x3bf4: 0x000a, 0x3bf5: 0x000a,
+	0x3bf6: 0x000a, 0x3bf7: 0x000a, 0x3bf8: 0x000a, 0x3bf9: 0x000a, 0x3bfa: 0x000a, 0x3bfb: 0x000a,
+	0x3bfc: 0x000a, 0x3bfd: 0x000a, 0x3bfe: 0x000a, 0x3bff: 0x000a,
+	// Block 0xf0, offset 0x3c00
+	0x3c01: 0x000a, 0x3c02: 0x000a, 0x3c03: 0x000a, 0x3c04: 0x000a, 0x3c05: 0x000a,
+	0x3c06: 0x000a, 0x3c07: 0x000a, 0x3c08: 0x000a, 0x3c09: 0x000a, 0x3c0a: 0x000a, 0x3c0b: 0x000a,
+	0x3c0c: 0x000a, 0x3c0d: 0x000a, 0x3c0e: 0x000a, 0x3c0f: 0x000a, 0x3c11: 0x000a,
+	0x3c12: 0x000a, 0x3c13: 0x000a, 0x3c14: 0x000a, 0x3c15: 0x000a, 0x3c16: 0x000a, 0x3c17: 0x000a,
+	0x3c18: 0x000a, 0x3c19: 0x000a, 0x3c1a: 0x000a, 0x3c1b: 0x000a, 0x3c1c: 0x000a, 0x3c1d: 0x000a,
+	0x3c1e: 0x000a, 0x3c1f: 0x000a, 0x3c20: 0x000a, 0x3c21: 0x000a, 0x3c22: 0x000a, 0x3c23: 0x000a,
+	0x3c24: 0x000a, 0x3c25: 0x000a, 0x3c26: 0x000a, 0x3c27: 0x000a, 0x3c28: 0x000a, 0x3c29: 0x000a,
+	0x3c2a: 0x000a, 0x3c2b: 0x000a, 0x3c2c: 0x000a, 0x3c2d: 0x000a, 0x3c2e: 0x000a, 0x3c2f: 0x000a,
+	0x3c30: 0x000a, 0x3c31: 0x000a, 0x3c32: 0x000a, 0x3c33: 0x000a, 0x3c34: 0x000a, 0x3c35: 0x000a,
+	// Block 0xf1, offset 0x3c40
+	0x3c40: 0x0002, 0x3c41: 0x0002, 0x3c42: 0x0002, 0x3c43: 0x0002, 0x3c44: 0x0002, 0x3c45: 0x0002,
+	0x3c46: 0x0002, 0x3c47: 0x0002, 0x3c48: 0x0002, 0x3c49: 0x0002, 0x3c4a: 0x0002, 0x3c4b: 0x000a,
+	0x3c4c: 0x000a, 0x3c4d: 0x000a, 0x3c4e: 0x000a, 0x3c4f: 0x000a,
+	0x3c6f: 0x000a,
+	// Block 0xf2, offset 0x3c80
+	0x3caa: 0x000a, 0x3cab: 0x000a, 0x3cac: 0x000a, 0x3cad: 0x000a, 0x3cae: 0x000a, 0x3caf: 0x000a,
+	// Block 0xf3, offset 0x3cc0
+	0x3ced: 0x000a,
+	// Block 0xf4, offset 0x3d00
+	0x3d20: 0x000a, 0x3d21: 0x000a, 0x3d22: 0x000a, 0x3d23: 0x000a,
+	0x3d24: 0x000a, 0x3d25: 0x000a,
+	// Block 0xf5, offset 0x3d40
+	0x3d40: 0x000a, 0x3d41: 0x000a, 0x3d42: 0x000a, 0x3d43: 0x000a, 0x3d44: 0x000a, 0x3d45: 0x000a,
+	0x3d46: 0x000a, 0x3d47: 0x000a, 0x3d48: 0x000a, 0x3d49: 0x000a, 0x3d4a: 0x000a, 0x3d4b: 0x000a,
+	0x3d4c: 0x000a, 0x3d4d: 0x000a, 0x3d4e: 0x000a, 0x3d4f: 0x000a, 0x3d50: 0x000a, 0x3d51: 0x000a,
+	0x3d52: 0x000a, 0x3d53: 0x000a, 0x3d54: 0x000a, 0x3d55: 0x000a, 0x3d56: 0x000a, 0x3d57: 0x000a,
+	0x3d5c: 0x000a, 0x3d5d: 0x000a,
+	0x3d5e: 0x000a, 0x3d5f: 0x000a, 0x3d60: 0x000a, 0x3d61: 0x000a, 0x3d62: 0x000a, 0x3d63: 0x000a,
+	0x3d64: 0x000a, 0x3d65: 0x000a, 0x3d66: 0x000a, 0x3d67: 0x000a, 0x3d68: 0x000a, 0x3d69: 0x000a,
+	0x3d6a: 0x000a, 0x3d6b: 0x000a, 0x3d6c: 0x000a,
+	0x3d70: 0x000a, 0x3d71: 0x000a, 0x3d72: 0x000a, 0x3d73: 0x000a, 0x3d74: 0x000a, 0x3d75: 0x000a,
+	0x3d76: 0x000a, 0x3d77: 0x000a, 0x3d78: 0x000a, 0x3d79: 0x000a, 0x3d7a: 0x000a, 0x3d7b: 0x000a,
+	0x3d7c: 0x000a,
+	// Block 0xf6, offset 0x3d80
+	0x3d80: 0x000a, 0x3d81: 0x000a, 0x3d82: 0x000a, 0x3d83: 0x000a, 0x3d84: 0x000a, 0x3d85: 0x000a,
+	0x3d86: 0x000a, 0x3d87: 0x000a, 0x3d88: 0x000a, 0x3d89: 0x000a, 0x3d8a: 0x000a, 0x3d8b: 0x000a,
+	0x3d8c: 0x000a, 0x3d8d: 0x000a, 0x3d8e: 0x000a, 0x3d8f: 0x000a, 0x3d90: 0x000a, 0x3d91: 0x000a,
+	0x3d92: 0x000a, 0x3d93: 0x000a, 0x3d94: 0x000a, 0x3d95: 0x000a, 0x3d96: 0x000a, 0x3d97: 0x000a,
+	0x3d98: 0x000a, 0x3d99: 0x000a, 0x3d9a: 0x000a, 0x3d9b: 0x000a, 0x3d9c: 0x000a, 0x3d9d: 0x000a,
+	0x3d9e: 0x000a, 0x3d9f: 0x000a, 0x3da0: 0x000a, 0x3da1: 0x000a, 0x3da2: 0x000a, 0x3da3: 0x000a,
+	0x3da4: 0x000a, 0x3da5: 0x000a, 0x3da6: 0x000a, 0x3da7: 0x000a, 0x3da8: 0x000a, 0x3da9: 0x000a,
+	0x3daa: 0x000a, 0x3dab: 0x000a, 0x3dac: 0x000a, 0x3dad: 0x000a, 0x3dae: 0x000a, 0x3daf: 0x000a,
+	0x3db0: 0x000a, 0x3db1: 0x000a, 0x3db2: 0x000a, 0x3db3: 0x000a, 0x3db4: 0x000a, 0x3db5: 0x000a,
+	0x3db6: 0x000a, 0x3dbb: 0x000a,
+	0x3dbc: 0x000a, 0x3dbd: 0x000a, 0x3dbe: 0x000a, 0x3dbf: 0x000a,
+	// Block 0xf7, offset 0x3dc0
+	0x3dc0: 0x000a, 0x3dc1: 0x000a, 0x3dc2: 0x000a, 0x3dc3: 0x000a, 0x3dc4: 0x000a, 0x3dc5: 0x000a,
+	0x3dc6: 0x000a, 0x3dc7: 0x000a, 0x3dc8: 0x000a, 0x3dc9: 0x000a, 0x3dca: 0x000a, 0x3dcb: 0x000a,
+	0x3dcc: 0x000a, 0x3dcd: 0x000a, 0x3dce: 0x000a, 0x3dcf: 0x000a, 0x3dd0: 0x000a, 0x3dd1: 0x000a,
+	0x3dd2: 0x000a, 0x3dd3: 0x000a, 0x3dd4: 0x000a, 0x3dd5: 0x000a, 0x3dd6: 0x000a, 0x3dd7: 0x000a,
+	0x3dd8: 0x000a, 0x3dd9: 0x000a,
+	0x3de0: 0x000a, 0x3de1: 0x000a, 0x3de2: 0x000a, 0x3de3: 0x000a,
+	0x3de4: 0x000a, 0x3de5: 0x000a, 0x3de6: 0x000a, 0x3de7: 0x000a, 0x3de8: 0x000a, 0x3de9: 0x000a,
+	0x3dea: 0x000a, 0x3deb: 0x000a,
+	0x3df0: 0x000a,
+	// Block 0xf8, offset 0x3e00
+	0x3e00: 0x000a, 0x3e01: 0x000a, 0x3e02: 0x000a, 0x3e03: 0x000a, 0x3e04: 0x000a, 0x3e05: 0x000a,
+	0x3e06: 0x000a, 0x3e07: 0x000a, 0x3e08: 0x000a, 0x3e09: 0x000a, 0x3e0a: 0x000a, 0x3e0b: 0x000a,
+	0x3e10: 0x000a, 0x3e11: 0x000a,
+	0x3e12: 0x000a, 0x3e13: 0x000a, 0x3e14: 0x000a, 0x3e15: 0x000a, 0x3e16: 0x000a, 0x3e17: 0x000a,
+	0x3e18: 0x000a, 0x3e19: 0x000a, 0x3e1a: 0x000a, 0x3e1b: 0x000a, 0x3e1c: 0x000a, 0x3e1d: 0x000a,
+	0x3e1e: 0x000a, 0x3e1f: 0x000a, 0x3e20: 0x000a, 0x3e21: 0x000a, 0x3e22: 0x000a, 0x3e23: 0x000a,
+	0x3e24: 0x000a, 0x3e25: 0x000a, 0x3e26: 0x000a, 0x3e27: 0x000a, 0x3e28: 0x000a, 0x3e29: 0x000a,
+	0x3e2a: 0x000a, 0x3e2b: 0x000a, 0x3e2c: 0x000a, 0x3e2d: 0x000a, 0x3e2e: 0x000a, 0x3e2f: 0x000a,
+	0x3e30: 0x000a, 0x3e31: 0x000a, 0x3e32: 0x000a, 0x3e33: 0x000a, 0x3e34: 0x000a, 0x3e35: 0x000a,
+	0x3e36: 0x000a, 0x3e37: 0x000a, 0x3e38: 0x000a, 0x3e39: 0x000a, 0x3e3a: 0x000a, 0x3e3b: 0x000a,
+	0x3e3c: 0x000a, 0x3e3d: 0x000a, 0x3e3e: 0x000a, 0x3e3f: 0x000a,
+	// Block 0xf9, offset 0x3e40
+	0x3e40: 0x000a, 0x3e41: 0x000a, 0x3e42: 0x000a, 0x3e43: 0x000a, 0x3e44: 0x000a, 0x3e45: 0x000a,
+	0x3e46: 0x000a, 0x3e47: 0x000a,
+	0x3e50: 0x000a, 0x3e51: 0x000a,
+	0x3e52: 0x000a, 0x3e53: 0x000a, 0x3e54: 0x000a, 0x3e55: 0x000a, 0x3e56: 0x000a, 0x3e57: 0x000a,
+	0x3e58: 0x000a, 0x3e59: 0x000a,
+	0x3e60: 0x000a, 0x3e61: 0x000a, 0x3e62: 0x000a, 0x3e63: 0x000a,
+	0x3e64: 0x000a, 0x3e65: 0x000a, 0x3e66: 0x000a, 0x3e67: 0x000a, 0x3e68: 0x000a, 0x3e69: 0x000a,
+	0x3e6a: 0x000a, 0x3e6b: 0x000a, 0x3e6c: 0x000a, 0x3e6d: 0x000a, 0x3e6e: 0x000a, 0x3e6f: 0x000a,
+	0x3e70: 0x000a, 0x3e71: 0x000a, 0x3e72: 0x000a, 0x3e73: 0x000a, 0x3e74: 0x000a, 0x3e75: 0x000a,
+	0x3e76: 0x000a, 0x3e77: 0x000a, 0x3e78: 0x000a, 0x3e79: 0x000a, 0x3e7a: 0x000a, 0x3e7b: 0x000a,
+	0x3e7c: 0x000a, 0x3e7d: 0x000a, 0x3e7e: 0x000a, 0x3e7f: 0x000a,
+	// Block 0xfa, offset 0x3e80
+	0x3e80: 0x000a, 0x3e81: 0x000a, 0x3e82: 0x000a, 0x3e83: 0x000a, 0x3e84: 0x000a, 0x3e85: 0x000a,
+	0x3e86: 0x000a, 0x3e87: 0x000a,
+	0x3e90: 0x000a, 0x3e91: 0x000a,
+	0x3e92: 0x000a, 0x3e93: 0x000a, 0x3e94: 0x000a, 0x3e95: 0x000a, 0x3e96: 0x000a, 0x3e97: 0x000a,
+	0x3e98: 0x000a, 0x3e99: 0x000a, 0x3e9a: 0x000a, 0x3e9b: 0x000a, 0x3e9c: 0x000a, 0x3e9d: 0x000a,
+	0x3e9e: 0x000a, 0x3e9f: 0x000a, 0x3ea0: 0x000a, 0x3ea1: 0x000a, 0x3ea2: 0x000a, 0x3ea3: 0x000a,
+	0x3ea4: 0x000a, 0x3ea5: 0x000a, 0x3ea6: 0x000a, 0x3ea7: 0x000a, 0x3ea8: 0x000a, 0x3ea9: 0x000a,
+	0x3eaa: 0x000a, 0x3eab: 0x000a, 0x3eac: 0x000a, 0x3ead: 0x000a,
+	0x3eb0: 0x000a, 0x3eb1: 0x000a,
+	// Block 0xfb, offset 0x3ec0
+	0x3ec0: 0x000a, 0x3ec1: 0x000a, 0x3ec2: 0x000a, 0x3ec3: 0x000a, 0x3ec4: 0x000a, 0x3ec5: 0x000a,
+	0x3ec6: 0x000a, 0x3ec7: 0x000a, 0x3ec8: 0x000a, 0x3ec9: 0x000a, 0x3eca: 0x000a, 0x3ecb: 0x000a,
+	0x3ecc: 0x000a, 0x3ecd: 0x000a, 0x3ece: 0x000a, 0x3ecf: 0x000a, 0x3ed0: 0x000a, 0x3ed1: 0x000a,
+	0x3ed2: 0x000a, 0x3ed3: 0x000a,
+	0x3ee0: 0x000a, 0x3ee1: 0x000a, 0x3ee2: 0x000a, 0x3ee3: 0x000a,
+	0x3ee4: 0x000a, 0x3ee5: 0x000a, 0x3ee6: 0x000a, 0x3ee7: 0x000a, 0x3ee8: 0x000a, 0x3ee9: 0x000a,
+	0x3eea: 0x000a, 0x3eeb: 0x000a, 0x3eec: 0x000a, 0x3eed: 0x000a,
+	0x3ef0: 0x000a, 0x3ef1: 0x000a, 0x3ef2: 0x000a, 0x3ef3: 0x000a, 0x3ef4: 0x000a, 0x3ef5: 0x000a,
+	0x3ef6: 0x000a, 0x3ef7: 0x000a, 0x3ef8: 0x000a, 0x3ef9: 0x000a, 0x3efa: 0x000a, 0x3efb: 0x000a,
+	0x3efc: 0x000a,
+	// Block 0xfc, offset 0x3f00
+	0x3f00: 0x000a, 0x3f01: 0x000a, 0x3f02: 0x000a, 0x3f03: 0x000a, 0x3f04: 0x000a, 0x3f05: 0x000a,
+	0x3f06: 0x000a, 0x3f07: 0x000a, 0x3f08: 0x000a,
+	0x3f10: 0x000a, 0x3f11: 0x000a,
+	0x3f12: 0x000a, 0x3f13: 0x000a, 0x3f14: 0x000a, 0x3f15: 0x000a, 0x3f16: 0x000a, 0x3f17: 0x000a,
+	0x3f18: 0x000a, 0x3f19: 0x000a, 0x3f1a: 0x000a, 0x3f1b: 0x000a, 0x3f1c: 0x000a, 0x3f1d: 0x000a,
+	0x3f1e: 0x000a, 0x3f1f: 0x000a, 0x3f20: 0x000a, 0x3f21: 0x000a, 0x3f22: 0x000a, 0x3f23: 0x000a,
+	0x3f24: 0x000a, 0x3f25: 0x000a, 0x3f26: 0x000a, 0x3f27: 0x000a, 0x3f28: 0x000a, 0x3f29: 0x000a,
+	0x3f2a: 0x000a, 0x3f2b: 0x000a, 0x3f2c: 0x000a, 0x3f2d: 0x000a, 0x3f2e: 0x000a, 0x3f2f: 0x000a,
+	0x3f30: 0x000a, 0x3f31: 0x000a, 0x3f32: 0x000a, 0x3f33: 0x000a, 0x3f34: 0x000a, 0x3f35: 0x000a,
+	0x3f36: 0x000a, 0x3f37: 0x000a, 0x3f38: 0x000a, 0x3f39: 0x000a, 0x3f3a: 0x000a, 0x3f3b: 0x000a,
+	0x3f3c: 0x000a, 0x3f3d: 0x000a, 0x3f3f: 0x000a,
+	// Block 0xfd, offset 0x3f40
+	0x3f40: 0x000a, 0x3f41: 0x000a, 0x3f42: 0x000a, 0x3f43: 0x000a, 0x3f44: 0x000a, 0x3f45: 0x000a,
+	0x3f4e: 0x000a, 0x3f4f: 0x000a, 0x3f50: 0x000a, 0x3f51: 0x000a,
+	0x3f52: 0x000a, 0x3f53: 0x000a, 0x3f54: 0x000a, 0x3f55: 0x000a, 0x3f56: 0x000a, 0x3f57: 0x000a,
+	0x3f58: 0x000a, 0x3f59: 0x000a, 0x3f5a: 0x000a, 0x3f5b: 0x000a,
+	0x3f60: 0x000a, 0x3f61: 0x000a, 0x3f62: 0x000a, 0x3f63: 0x000a,
+	0x3f64: 0x000a, 0x3f65: 0x000a, 0x3f66: 0x000a, 0x3f67: 0x000a, 0x3f68: 0x000a,
+	0x3f70: 0x000a, 0x3f71: 0x000a, 0x3f72: 0x000a, 0x3f73: 0x000a, 0x3f74: 0x000a, 0x3f75: 0x000a,
+	0x3f76: 0x000a, 0x3f77: 0x000a, 0x3f78: 0x000a,
+	// Block 0xfe, offset 0x3f80
+	0x3f80: 0x000a, 0x3f81: 0x000a, 0x3f82: 0x000a, 0x3f83: 0x000a, 0x3f84: 0x000a, 0x3f85: 0x000a,
+	0x3f86: 0x000a, 0x3f87: 0x000a, 0x3f88: 0x000a, 0x3f89: 0x000a, 0x3f8a: 0x000a, 0x3f8b: 0x000a,
+	0x3f8c: 0x000a, 0x3f8d: 0x000a, 0x3f8e: 0x000a, 0x3f8f: 0x000a, 0x3f90: 0x000a, 0x3f91: 0x000a,
+	0x3f92: 0x000a, 0x3f94: 0x000a, 0x3f95: 0x000a, 0x3f96: 0x000a, 0x3f97: 0x000a,
+	0x3f98: 0x000a, 0x3f99: 0x000a, 0x3f9a: 0x000a, 0x3f9b: 0x000a, 0x3f9c: 0x000a, 0x3f9d: 0x000a,
+	0x3f9e: 0x000a, 0x3f9f: 0x000a, 0x3fa0: 0x000a, 0x3fa1: 0x000a, 0x3fa2: 0x000a, 0x3fa3: 0x000a,
+	0x3fa4: 0x000a, 0x3fa5: 0x000a, 0x3fa6: 0x000a, 0x3fa7: 0x000a, 0x3fa8: 0x000a, 0x3fa9: 0x000a,
+	0x3faa: 0x000a, 0x3fab: 0x000a, 0x3fac: 0x000a, 0x3fad: 0x000a, 0x3fae: 0x000a, 0x3faf: 0x000a,
+	0x3fb0: 0x000a, 0x3fb1: 0x000a, 0x3fb2: 0x000a, 0x3fb3: 0x000a, 0x3fb4: 0x000a, 0x3fb5: 0x000a,
+	0x3fb6: 0x000a, 0x3fb7: 0x000a, 0x3fb8: 0x000a, 0x3fb9: 0x000a, 0x3fba: 0x000a, 0x3fbb: 0x000a,
+	0x3fbc: 0x000a, 0x3fbd: 0x000a, 0x3fbe: 0x000a, 0x3fbf: 0x000a,
+	// Block 0xff, offset 0x3fc0
+	0x3fc0: 0x000a, 0x3fc1: 0x000a, 0x3fc2: 0x000a, 0x3fc3: 0x000a, 0x3fc4: 0x000a, 0x3fc5: 0x000a,
+	0x3fc6: 0x000a, 0x3fc7: 0x000a, 0x3fc8: 0x000a, 0x3fc9: 0x000a, 0x3fca: 0x000a,
+	0x3ff0: 0x0002, 0x3ff1: 0x0002, 0x3ff2: 0x0002, 0x3ff3: 0x0002, 0x3ff4: 0x0002, 0x3ff5: 0x0002,
+	0x3ff6: 0x0002, 0x3ff7: 0x0002, 0x3ff8: 0x0002, 0x3ff9: 0x0002,
+	// Block 0x100, offset 0x4000
+	0x403e: 0x000b, 0x403f: 0x000b,
+	// Block 0x101, offset 0x4040
+	0x4040: 0x000b, 0x4041: 0x000b, 0x4042: 0x000b, 0x4043: 0x000b, 0x4044: 0x000b, 0x4045: 0x000b,
+	0x4046: 0x000b, 0x4047: 0x000b, 0x4048: 0x000b, 0x4049: 0x000b, 0x404a: 0x000b, 0x404b: 0x000b,
+	0x404c: 0x000b, 0x404d: 0x000b, 0x404e: 0x000b, 0x404f: 0x000b, 0x4050: 0x000b, 0x4051: 0x000b,
+	0x4052: 0x000b, 0x4053: 0x000b, 0x4054: 0x000b, 0x4055: 0x000b, 0x4056: 0x000b, 0x4057: 0x000b,
+	0x4058: 0x000b, 0x4059: 0x000b, 0x405a: 0x000b, 0x405b: 0x000b, 0x405c: 0x000b, 0x405d: 0x000b,
+	0x405e: 0x000b, 0x405f: 0x000b, 0x4060: 0x000b, 0x4061: 0x000b, 0x4062: 0x000b, 0x4063: 0x000b,
+	0x4064: 0x000b, 0x4065: 0x000b, 0x4066: 0x000b, 0x4067: 0x000b, 0x4068: 0x000b, 0x4069: 0x000b,
+	0x406a: 0x000b, 0x406b: 0x000b, 0x406c: 0x000b, 0x406d: 0x000b, 0x406e: 0x000b, 0x406f: 0x000b,
+	0x4070: 0x000b, 0x4071: 0x000b, 0x4072: 0x000b, 0x4073: 0x000b, 0x4074: 0x000b, 0x4075: 0x000b,
+	0x4076: 0x000b, 0x4077: 0x000b, 0x4078: 0x000b, 0x4079: 0x000b, 0x407a: 0x000b, 0x407b: 0x000b,
+	0x407c: 0x000b, 0x407d: 0x000b, 0x407e: 0x000b, 0x407f: 0x000b,
+	// Block 0x102, offset 0x4080
+	0x4080: 0x000c, 0x4081: 0x000c, 0x4082: 0x000c, 0x4083: 0x000c, 0x4084: 0x000c, 0x4085: 0x000c,
+	0x4086: 0x000c, 0x4087: 0x000c, 0x4088: 0x000c, 0x4089: 0x000c, 0x408a: 0x000c, 0x408b: 0x000c,
+	0x408c: 0x000c, 0x408d: 0x000c, 0x408e: 0x000c, 0x408f: 0x000c, 0x4090: 0x000c, 0x4091: 0x000c,
+	0x4092: 0x000c, 0x4093: 0x000c, 0x4094: 0x000c, 0x4095: 0x000c, 0x4096: 0x000c, 0x4097: 0x000c,
+	0x4098: 0x000c, 0x4099: 0x000c, 0x409a: 0x000c, 0x409b: 0x000c, 0x409c: 0x000c, 0x409d: 0x000c,
+	0x409e: 0x000c, 0x409f: 0x000c, 0x40a0: 0x000c, 0x40a1: 0x000c, 0x40a2: 0x000c, 0x40a3: 0x000c,
+	0x40a4: 0x000c, 0x40a5: 0x000c, 0x40a6: 0x000c, 0x40a7: 0x000c, 0x40a8: 0x000c, 0x40a9: 0x000c,
+	0x40aa: 0x000c, 0x40ab: 0x000c, 0x40ac: 0x000c, 0x40ad: 0x000c, 0x40ae: 0x000c, 0x40af: 0x000c,
+	0x40b0: 0x000b, 0x40b1: 0x000b, 0x40b2: 0x000b, 0x40b3: 0x000b, 0x40b4: 0x000b, 0x40b5: 0x000b,
+	0x40b6: 0x000b, 0x40b7: 0x000b, 0x40b8: 0x000b, 0x40b9: 0x000b, 0x40ba: 0x000b, 0x40bb: 0x000b,
+	0x40bc: 0x000b, 0x40bd: 0x000b, 0x40be: 0x000b, 0x40bf: 0x000b,
+}
+
+// bidiIndex: 26 blocks, 1664 entries, 3328 bytes
+// Block 0 is the zero block.
+var bidiIndex = [1664]uint16{
+	// Block 0x0, offset 0x0
+	// Block 0x1, offset 0x40
+	// Block 0x2, offset 0x80
+	// Block 0x3, offset 0xc0
+	0xc2: 0x01, 0xc3: 0x02,
+	0xca: 0x03, 0xcb: 0x04, 0xcc: 0x05, 0xcd: 0x06, 0xce: 0x07, 0xcf: 0x08,
+	0xd2: 0x09, 0xd6: 0x0a, 0xd7: 0x0b,
+	0xd8: 0x0c, 0xd9: 0x0d, 0xda: 0x0e, 0xdb: 0x0f, 0xdc: 0x10, 0xdd: 0x11, 0xde: 0x12, 0xdf: 0x13,
+	0xe0: 0x02, 0xe1: 0x03, 0xe2: 0x04, 0xe3: 0x05, 0xe4: 0x06,
+	0xea: 0x07, 0xef: 0x08,
+	0xf0: 0x13, 0xf1: 0x14, 0xf2: 0x14, 0xf3: 0x16, 0xf4: 0x17,
+	// Block 0x4, offset 0x100
+	0x120: 0x14, 0x121: 0x15, 0x122: 0x16, 0x123: 0x17, 0x124: 0x18, 0x125: 0x19, 0x126: 0x1a, 0x127: 0x1b,
+	0x128: 0x1c, 0x129: 0x1d, 0x12a: 0x1c, 0x12b: 0x1e, 0x12c: 0x1f, 0x12d: 0x20, 0x12e: 0x21, 0x12f: 0x22,
+	0x130: 0x23, 0x131: 0x24, 0x132: 0x1a, 0x133: 0x25, 0x134: 0x26, 0x135: 0x27, 0x136: 0x28, 0x137: 0x29,
+	0x138: 0x2a, 0x139: 0x2b, 0x13a: 0x2c, 0x13b: 0x2d, 0x13c: 0x2e, 0x13d: 0x2f, 0x13e: 0x30, 0x13f: 0x31,
+	// Block 0x5, offset 0x140
+	0x140: 0x32, 0x141: 0x33, 0x142: 0x34,
+	0x14d: 0x35, 0x14e: 0x36,
+	0x150: 0x37,
+	0x15a: 0x38, 0x15c: 0x39, 0x15d: 0x3a, 0x15e: 0x3b, 0x15f: 0x3c,
+	0x160: 0x3d, 0x162: 0x3e, 0x164: 0x3f, 0x165: 0x40, 0x167: 0x41,
+	0x168: 0x42, 0x169: 0x43, 0x16a: 0x44, 0x16b: 0x45, 0x16c: 0x46, 0x16d: 0x47, 0x16e: 0x48, 0x16f: 0x49,
+	0x170: 0x4a, 0x173: 0x4b, 0x177: 0x05,
+	0x17e: 0x4c, 0x17f: 0x4d,
+	// Block 0x6, offset 0x180
+	0x180: 0x4e, 0x181: 0x4f, 0x182: 0x50, 0x183: 0x51, 0x184: 0x52, 0x185: 0x53, 0x186: 0x54, 0x187: 0x55,
+	0x188: 0x56, 0x189: 0x55, 0x18a: 0x55, 0x18b: 0x55, 0x18c: 0x57, 0x18d: 0x58, 0x18e: 0x59, 0x18f: 0x55,
+	0x190: 0x5a, 0x191: 0x5b, 0x192: 0x5c, 0x193: 0x5d, 0x194: 0x55, 0x195: 0x55, 0x196: 0x55, 0x197: 0x55,
+	0x198: 0x55, 0x199: 0x55, 0x19a: 0x5e, 0x19b: 0x55, 0x19c: 0x55, 0x19d: 0x5f, 0x19e: 0x55, 0x19f: 0x60,
+	0x1a4: 0x55, 0x1a5: 0x55, 0x1a6: 0x61, 0x1a7: 0x62,
+	0x1a8: 0x55, 0x1a9: 0x55, 0x1aa: 0x55, 0x1ab: 0x55, 0x1ac: 0x55, 0x1ad: 0x63, 0x1ae: 0x64, 0x1af: 0x55,
+	0x1b3: 0x65, 0x1b5: 0x66, 0x1b7: 0x67,
+	0x1b8: 0x68, 0x1b9: 0x69, 0x1ba: 0x6a, 0x1bb: 0x6b, 0x1bc: 0x55, 0x1bd: 0x55, 0x1be: 0x55, 0x1bf: 0x6c,
+	// Block 0x7, offset 0x1c0
+	0x1c0: 0x6d, 0x1c2: 0x6e, 0x1c3: 0x6f, 0x1c7: 0x70,
+	0x1c8: 0x71, 0x1c9: 0x72, 0x1ca: 0x73, 0x1cb: 0x74, 0x1cd: 0x75, 0x1cf: 0x76,
+	// Block 0x8, offset 0x200
+	0x237: 0x55,
+	// Block 0x9, offset 0x240
+	0x252: 0x77, 0x253: 0x78,
+	0x258: 0x79, 0x259: 0x7a, 0x25a: 0x7b, 0x25b: 0x7c, 0x25c: 0x7d, 0x25e: 0x7e,
+	0x260: 0x7f, 0x261: 0x80, 0x263: 0x81, 0x264: 0x82, 0x265: 0x83, 0x266: 0x84, 0x267: 0x85,
+	0x268: 0x86, 0x269: 0x87, 0x26a: 0x88, 0x26b: 0x89, 0x26d: 0x8a, 0x26f: 0x8b,
+	// Block 0xa, offset 0x280
+	0x2ac: 0x8c, 0x2ad: 0x8d, 0x2ae: 0x0e, 0x2af: 0x0e,
+	0x2b0: 0x0e, 0x2b1: 0x0e, 0x2b2: 0x0e, 0x2b3: 0x0e, 0x2b4: 0x8e, 0x2b5: 0x8f, 0x2b6: 0x0e, 0x2b7: 0x90,
+	0x2b8: 0x91, 0x2b9: 0x92, 0x2ba: 0x0e, 0x2bb: 0x93, 0x2bc: 0x94, 0x2bd: 0x95, 0x2bf: 0x96,
+	// Block 0xb, offset 0x2c0
+	0x2c4: 0x97, 0x2c5: 0x55, 0x2c6: 0x98, 0x2c7: 0x99,
+	0x2cb: 0x9a, 0x2cd: 0x9b,
+	0x2e0: 0x9c, 0x2e1: 0x9c, 0x2e2: 0x9c, 0x2e3: 0x9c, 0x2e4: 0x9d, 0x2e5: 0x9c, 0x2e6: 0x9c, 0x2e7: 0x9c,
+	0x2e8: 0x9e, 0x2e9: 0x9c, 0x2ea: 0x9c, 0x2eb: 0x9f, 0x2ec: 0xa0, 0x2ed: 0x9c, 0x2ee: 0x9c, 0x2ef: 0x9c,
+	0x2f0: 0x9c, 0x2f1: 0x9c, 0x2f2: 0x9c, 0x2f3: 0x9c, 0x2f4: 0xa1, 0x2f5: 0x9c, 0x2f6: 0x9c, 0x2f7: 0x9c,
+	0x2f8: 0x9c, 0x2f9: 0xa2, 0x2fa: 0xa3, 0x2fb: 0xa4, 0x2fc: 0xa5, 0x2fd: 0xa6, 0x2fe: 0xa7, 0x2ff: 0x9c,
+	// Block 0xc, offset 0x300
+	0x300: 0xa8, 0x301: 0xa9, 0x302: 0xaa, 0x303: 0x21, 0x304: 0xab, 0x305: 0xac, 0x306: 0xad, 0x307: 0xae,
+	0x308: 0xaf, 0x309: 0x28, 0x30b: 0xb0, 0x30c: 0x26, 0x30d: 0xb1,
+	0x310: 0xb2, 0x311: 0xb3, 0x312: 0xb4, 0x313: 0xb5, 0x316: 0xb6, 0x317: 0xb7,
+	0x318: 0xb8, 0x319: 0xb9, 0x31a: 0xba, 0x31c: 0xbb,
+	0x320: 0xbc, 0x324: 0xbd, 0x325: 0xbe, 0x327: 0xbf,
+	0x328: 0xc0, 0x329: 0xc1, 0x32a: 0xc2,
+	0x330: 0xc3, 0x332: 0xc4, 0x334: 0xc5, 0x335: 0xc6, 0x336: 0xc7,
+	0x33b: 0xc8, 0x33c: 0xc9, 0x33d: 0xca, 0x33f: 0xcb,
+	// Block 0xd, offset 0x340
+	0x351: 0xcc,
+	// Block 0xe, offset 0x380
+	0x3ab: 0xcd, 0x3ac: 0xce,
+	0x3bd: 0xcf, 0x3be: 0xd0, 0x3bf: 0xd1,
+	// Block 0xf, offset 0x3c0
+	0x3f2: 0xd2,
+	// Block 0x10, offset 0x400
+	0x43c: 0xd3, 0x43d: 0xd4,
+	// Block 0x11, offset 0x440
+	0x445: 0xd5, 0x446: 0xd6, 0x447: 0xd7,
+	0x448: 0x55, 0x449: 0xd8, 0x44c: 0x55, 0x44d: 0xd9,
+	0x45b: 0xda, 0x45c: 0xdb, 0x45d: 0xdc, 0x45e: 0xdd, 0x45f: 0xde,
+	0x468: 0xdf, 0x469: 0xe0, 0x46a: 0xe1,
+	// Block 0x12, offset 0x480
+	0x480: 0xe2, 0x482: 0xcf, 0x484: 0xce,
+	0x48a: 0xe3, 0x48b: 0xe4,
+	0x493: 0xe5,
+	0x4a0: 0x9c, 0x4a1: 0x9c, 0x4a2: 0x9c, 0x4a3: 0xe6, 0x4a4: 0x9c, 0x4a5: 0xe7, 0x4a6: 0x9c, 0x4a7: 0x9c,
+	0x4a8: 0x9c, 0x4a9: 0x9c, 0x4aa: 0x9c, 0x4ab: 0x9c, 0x4ac: 0x9c, 0x4ad: 0x9c, 0x4ae: 0x9c, 0x4af: 0x9c,
+	0x4b0: 0x9c, 0x4b1: 0xe8, 0x4b2: 0xe9, 0x4b3: 0x9c, 0x4b4: 0xea, 0x4b5: 0x9c, 0x4b6: 0x9c, 0x4b7: 0x9c,
+	0x4b8: 0x0e, 0x4b9: 0x0e, 0x4ba: 0x0e, 0x4bb: 0xeb, 0x4bc: 0x9c, 0x4bd: 0x9c, 0x4be: 0x9c, 0x4bf: 0x9c,
+	// Block 0x13, offset 0x4c0
+	0x4c0: 0xec, 0x4c1: 0x55, 0x4c2: 0xed, 0x4c3: 0xee, 0x4c4: 0xef, 0x4c5: 0xf0, 0x4c6: 0xf1,
+	0x4c9: 0xf2, 0x4cc: 0x55, 0x4cd: 0x55, 0x4ce: 0x55, 0x4cf: 0x55,
+	0x4d0: 0x55, 0x4d1: 0x55, 0x4d2: 0x55, 0x4d3: 0x55, 0x4d4: 0x55, 0x4d5: 0x55, 0x4d6: 0x55, 0x4d7: 0x55,
+	0x4d8: 0x55, 0x4d9: 0x55, 0x4da: 0x55, 0x4db: 0xf3, 0x4dc: 0x55, 0x4dd: 0xf4, 0x4de: 0x55, 0x4df: 0xf5,
+	0x4e0: 0xf6, 0x4e1: 0xf7, 0x4e2: 0xf8, 0x4e4: 0x55, 0x4e5: 0x55, 0x4e6: 0x55, 0x4e7: 0x55,
+	0x4e8: 0x55, 0x4e9: 0xf9, 0x4ea: 0xfa, 0x4eb: 0xfb, 0x4ec: 0x55, 0x4ed: 0x55, 0x4ee: 0xfc, 0x4ef: 0xfd,
+	0x4ff: 0xfe,
+	// Block 0x14, offset 0x500
+	0x53f: 0xfe,
+	// Block 0x15, offset 0x540
+	0x550: 0x09, 0x551: 0x0a, 0x553: 0x0b, 0x556: 0x0c,
+	0x55b: 0x0d, 0x55c: 0x0e, 0x55d: 0x0f, 0x55e: 0x10, 0x55f: 0x11,
+	0x56f: 0x12,
+	0x57f: 0x12,
+	// Block 0x16, offset 0x580
+	0x58f: 0x12,
+	0x59f: 0x12,
+	0x5af: 0x12,
+	0x5bf: 0x12,
+	// Block 0x17, offset 0x5c0
+	0x5c0: 0xff, 0x5c1: 0xff, 0x5c2: 0xff, 0x5c3: 0xff, 0x5c4: 0x05, 0x5c5: 0x05, 0x5c6: 0x05, 0x5c7: 0x100,
+	0x5c8: 0xff, 0x5c9: 0xff, 0x5ca: 0xff, 0x5cb: 0xff, 0x5cc: 0xff, 0x5cd: 0xff, 0x5ce: 0xff, 0x5cf: 0xff,
+	0x5d0: 0xff, 0x5d1: 0xff, 0x5d2: 0xff, 0x5d3: 0xff, 0x5d4: 0xff, 0x5d5: 0xff, 0x5d6: 0xff, 0x5d7: 0xff,
+	0x5d8: 0xff, 0x5d9: 0xff, 0x5da: 0xff, 0x5db: 0xff, 0x5dc: 0xff, 0x5dd: 0xff, 0x5de: 0xff, 0x5df: 0xff,
+	0x5e0: 0xff, 0x5e1: 0xff, 0x5e2: 0xff, 0x5e3: 0xff, 0x5e4: 0xff, 0x5e5: 0xff, 0x5e6: 0xff, 0x5e7: 0xff,
+	0x5e8: 0xff, 0x5e9: 0xff, 0x5ea: 0xff, 0x5eb: 0xff, 0x5ec: 0xff, 0x5ed: 0xff, 0x5ee: 0xff, 0x5ef: 0xff,
+	0x5f0: 0xff, 0x5f1: 0xff, 0x5f2: 0xff, 0x5f3: 0xff, 0x5f4: 0xff, 0x5f5: 0xff, 0x5f6: 0xff, 0x5f7: 0xff,
+	0x5f8: 0xff, 0x5f9: 0xff, 0x5fa: 0xff, 0x5fb: 0xff, 0x5fc: 0xff, 0x5fd: 0xff, 0x5fe: 0xff, 0x5ff: 0xff,
+	// Block 0x18, offset 0x600
+	0x60f: 0x12,
+	0x61f: 0x12,
+	0x620: 0x15,
+	0x62f: 0x12,
+	0x63f: 0x12,
+	// Block 0x19, offset 0x640
+	0x64f: 0x12,
+}
+
+// Total table size 19960 bytes (19KiB); checksum: F50EF68C
diff --git a/.ci/providerlint/vendor/golang.org/x/text/unicode/norm/tables13.0.0.go b/.ci/providerlint/vendor/golang.org/x/text/unicode/norm/tables13.0.0.go
index 9115ef257e8..f65785e8ac7 100644
--- a/.ci/providerlint/vendor/golang.org/x/text/unicode/norm/tables13.0.0.go
+++ b/.ci/providerlint/vendor/golang.org/x/text/unicode/norm/tables13.0.0.go
@@ -1,7 +1,7 @@
 // Code generated by running "go generate" in golang.org/x/text. DO NOT EDIT.
 
-//go:build go1.16
-// +build go1.16
+//go:build go1.16 && !go1.21
+// +build go1.16,!go1.21
 
 package norm
 
diff --git a/.ci/providerlint/vendor/golang.org/x/text/unicode/norm/tables15.0.0.go b/.ci/providerlint/vendor/golang.org/x/text/unicode/norm/tables15.0.0.go
new file mode 100644
index 00000000000..e1858b879db
--- /dev/null
+++ b/.ci/providerlint/vendor/golang.org/x/text/unicode/norm/tables15.0.0.go
@@ -0,0 +1,7908 @@
+// Code generated by running "go generate" in golang.org/x/text. DO NOT EDIT.
+
+//go:build go1.21
+// +build go1.21
+
+package norm
+
+import "sync"
+
+const (
+	// Version is the Unicode edition from which the tables are derived.
+	Version = "15.0.0"
+
+	// MaxTransformChunkSize indicates the maximum number of bytes that Transform
+	// may need to write atomically for any Form. Making a destination buffer at
+	// least this size ensures that Transform can always make progress and that
+	// the user does not need to grow the buffer on an ErrShortDst.
+	MaxTransformChunkSize = 35 + maxNonStarters*4
+)
+
+var ccc = [56]uint8{
+	0, 1, 6, 7, 8, 9, 10, 11,
+	12, 13, 14, 15, 16, 17, 18, 19,
+	20, 21, 22, 23, 24, 25, 26, 27,
+	28, 29, 30, 31, 32, 33, 34, 35,
+	36, 84, 91, 103, 107, 118, 122, 129,
+	130, 132, 202, 214, 216, 218, 220, 222,
+	224, 226, 228, 230, 232, 233, 234, 240,
+}
+
+const (
+	firstMulti            = 0x199A
+	firstCCC              = 0x2DD5
+	endMulti              = 0x30A1
+	firstLeadingCCC       = 0x4AEF
+	firstCCCZeroExcept    = 0x4BB9
+	firstStarterWithNLead = 0x4BE0
+	lastDecomp            = 0x4BE2
+	maxDecomp             = 0x8000
+)
+
+// decomps: 19426 bytes
+var decomps = [...]byte{
+	// Bytes 0 - 3f
+	0x00, 0x41, 0x20, 0x41, 0x21, 0x41, 0x22, 0x41,
+	0x23, 0x41, 0x24, 0x41, 0x25, 0x41, 0x26, 0x41,
+	0x27, 0x41, 0x28, 0x41, 0x29, 0x41, 0x2A, 0x41,
+	0x2B, 0x41, 0x2C, 0x41, 0x2D, 0x41, 0x2E, 0x41,
+	0x2F, 0x41, 0x30, 0x41, 0x31, 0x41, 0x32, 0x41,
+	0x33, 0x41, 0x34, 0x41, 0x35, 0x41, 0x36, 0x41,
+	0x37, 0x41, 0x38, 0x41, 0x39, 0x41, 0x3A, 0x41,
+	0x3B, 0x41, 0x3C, 0x41, 0x3D, 0x41, 0x3E, 0x41,
+	// Bytes 40 - 7f
+	0x3F, 0x41, 0x40, 0x41, 0x41, 0x41, 0x42, 0x41,
+	0x43, 0x41, 0x44, 0x41, 0x45, 0x41, 0x46, 0x41,
+	0x47, 0x41, 0x48, 0x41, 0x49, 0x41, 0x4A, 0x41,
+	0x4B, 0x41, 0x4C, 0x41, 0x4D, 0x41, 0x4E, 0x41,
+	0x4F, 0x41, 0x50, 0x41, 0x51, 0x41, 0x52, 0x41,
+	0x53, 0x41, 0x54, 0x41, 0x55, 0x41, 0x56, 0x41,
+	0x57, 0x41, 0x58, 0x41, 0x59, 0x41, 0x5A, 0x41,
+	0x5B, 0x41, 0x5C, 0x41, 0x5D, 0x41, 0x5E, 0x41,
+	// Bytes 80 - bf
+	0x5F, 0x41, 0x60, 0x41, 0x61, 0x41, 0x62, 0x41,
+	0x63, 0x41, 0x64, 0x41, 0x65, 0x41, 0x66, 0x41,
+	0x67, 0x41, 0x68, 0x41, 0x69, 0x41, 0x6A, 0x41,
+	0x6B, 0x41, 0x6C, 0x41, 0x6D, 0x41, 0x6E, 0x41,
+	0x6F, 0x41, 0x70, 0x41, 0x71, 0x41, 0x72, 0x41,
+	0x73, 0x41, 0x74, 0x41, 0x75, 0x41, 0x76, 0x41,
+	0x77, 0x41, 0x78, 0x41, 0x79, 0x41, 0x7A, 0x41,
+	0x7B, 0x41, 0x7C, 0x41, 0x7D, 0x41, 0x7E, 0x42,
+	// Bytes c0 - ff
+	0xC2, 0xA2, 0x42, 0xC2, 0xA3, 0x42, 0xC2, 0xA5,
+	0x42, 0xC2, 0xA6, 0x42, 0xC2, 0xAC, 0x42, 0xC2,
+	0xB7, 0x42, 0xC3, 0x86, 0x42, 0xC3, 0xA6, 0x42,
+	0xC3, 0xB0, 0x42, 0xC3, 0xB8, 0x42, 0xC4, 0xA6,
+	0x42, 0xC4, 0xA7, 0x42, 0xC4, 0xB1, 0x42, 0xC5,
+	0x8B, 0x42, 0xC5, 0x93, 0x42, 0xC6, 0x8E, 0x42,
+	0xC6, 0x90, 0x42, 0xC6, 0xAB, 0x42, 0xC7, 0x80,
+	0x42, 0xC7, 0x81, 0x42, 0xC7, 0x82, 0x42, 0xC8,
+	// Bytes 100 - 13f
+	0xA2, 0x42, 0xC8, 0xB7, 0x42, 0xC9, 0x90, 0x42,
+	0xC9, 0x91, 0x42, 0xC9, 0x92, 0x42, 0xC9, 0x93,
+	0x42, 0xC9, 0x94, 0x42, 0xC9, 0x95, 0x42, 0xC9,
+	0x96, 0x42, 0xC9, 0x97, 0x42, 0xC9, 0x98, 0x42,
+	0xC9, 0x99, 0x42, 0xC9, 0x9B, 0x42, 0xC9, 0x9C,
+	0x42, 0xC9, 0x9E, 0x42, 0xC9, 0x9F, 0x42, 0xC9,
+	0xA0, 0x42, 0xC9, 0xA1, 0x42, 0xC9, 0xA2, 0x42,
+	0xC9, 0xA3, 0x42, 0xC9, 0xA4, 0x42, 0xC9, 0xA5,
+	// Bytes 140 - 17f
+	0x42, 0xC9, 0xA6, 0x42, 0xC9, 0xA7, 0x42, 0xC9,
+	0xA8, 0x42, 0xC9, 0xA9, 0x42, 0xC9, 0xAA, 0x42,
+	0xC9, 0xAB, 0x42, 0xC9, 0xAC, 0x42, 0xC9, 0xAD,
+	0x42, 0xC9, 0xAE, 0x42, 0xC9, 0xAF, 0x42, 0xC9,
+	0xB0, 0x42, 0xC9, 0xB1, 0x42, 0xC9, 0xB2, 0x42,
+	0xC9, 0xB3, 0x42, 0xC9, 0xB4, 0x42, 0xC9, 0xB5,
+	0x42, 0xC9, 0xB6, 0x42, 0xC9, 0xB7, 0x42, 0xC9,
+	0xB8, 0x42, 0xC9, 0xB9, 0x42, 0xC9, 0xBA, 0x42,
+	// Bytes 180 - 1bf
+	0xC9, 0xBB, 0x42, 0xC9, 0xBD, 0x42, 0xC9, 0xBE,
+	0x42, 0xCA, 0x80, 0x42, 0xCA, 0x81, 0x42, 0xCA,
+	0x82, 0x42, 0xCA, 0x83, 0x42, 0xCA, 0x84, 0x42,
+	0xCA, 0x88, 0x42, 0xCA, 0x89, 0x42, 0xCA, 0x8A,
+	0x42, 0xCA, 0x8B, 0x42, 0xCA, 0x8C, 0x42, 0xCA,
+	0x8D, 0x42, 0xCA, 0x8E, 0x42, 0xCA, 0x8F, 0x42,
+	0xCA, 0x90, 0x42, 0xCA, 0x91, 0x42, 0xCA, 0x92,
+	0x42, 0xCA, 0x95, 0x42, 0xCA, 0x98, 0x42, 0xCA,
+	// Bytes 1c0 - 1ff
+	0x99, 0x42, 0xCA, 0x9B, 0x42, 0xCA, 0x9C, 0x42,
+	0xCA, 0x9D, 0x42, 0xCA, 0x9F, 0x42, 0xCA, 0xA1,
+	0x42, 0xCA, 0xA2, 0x42, 0xCA, 0xA3, 0x42, 0xCA,
+	0xA4, 0x42, 0xCA, 0xA5, 0x42, 0xCA, 0xA6, 0x42,
+	0xCA, 0xA7, 0x42, 0xCA, 0xA8, 0x42, 0xCA, 0xA9,
+	0x42, 0xCA, 0xAA, 0x42, 0xCA, 0xAB, 0x42, 0xCA,
+	0xB9, 0x42, 0xCB, 0x90, 0x42, 0xCB, 0x91, 0x42,
+	0xCE, 0x91, 0x42, 0xCE, 0x92, 0x42, 0xCE, 0x93,
+	// Bytes 200 - 23f
+	0x42, 0xCE, 0x94, 0x42, 0xCE, 0x95, 0x42, 0xCE,
+	0x96, 0x42, 0xCE, 0x97, 0x42, 0xCE, 0x98, 0x42,
+	0xCE, 0x99, 0x42, 0xCE, 0x9A, 0x42, 0xCE, 0x9B,
+	0x42, 0xCE, 0x9C, 0x42, 0xCE, 0x9D, 0x42, 0xCE,
+	0x9E, 0x42, 0xCE, 0x9F, 0x42, 0xCE, 0xA0, 0x42,
+	0xCE, 0xA1, 0x42, 0xCE, 0xA3, 0x42, 0xCE, 0xA4,
+	0x42, 0xCE, 0xA5, 0x42, 0xCE, 0xA6, 0x42, 0xCE,
+	0xA7, 0x42, 0xCE, 0xA8, 0x42, 0xCE, 0xA9, 0x42,
+	// Bytes 240 - 27f
+	0xCE, 0xB1, 0x42, 0xCE, 0xB2, 0x42, 0xCE, 0xB3,
+	0x42, 0xCE, 0xB4, 0x42, 0xCE, 0xB5, 0x42, 0xCE,
+	0xB6, 0x42, 0xCE, 0xB7, 0x42, 0xCE, 0xB8, 0x42,
+	0xCE, 0xB9, 0x42, 0xCE, 0xBA, 0x42, 0xCE, 0xBB,
+	0x42, 0xCE, 0xBC, 0x42, 0xCE, 0xBD, 0x42, 0xCE,
+	0xBE, 0x42, 0xCE, 0xBF, 0x42, 0xCF, 0x80, 0x42,
+	0xCF, 0x81, 0x42, 0xCF, 0x82, 0x42, 0xCF, 0x83,
+	0x42, 0xCF, 0x84, 0x42, 0xCF, 0x85, 0x42, 0xCF,
+	// Bytes 280 - 2bf
+	0x86, 0x42, 0xCF, 0x87, 0x42, 0xCF, 0x88, 0x42,
+	0xCF, 0x89, 0x42, 0xCF, 0x9C, 0x42, 0xCF, 0x9D,
+	0x42, 0xD0, 0xB0, 0x42, 0xD0, 0xB1, 0x42, 0xD0,
+	0xB2, 0x42, 0xD0, 0xB3, 0x42, 0xD0, 0xB4, 0x42,
+	0xD0, 0xB5, 0x42, 0xD0, 0xB6, 0x42, 0xD0, 0xB7,
+	0x42, 0xD0, 0xB8, 0x42, 0xD0, 0xBA, 0x42, 0xD0,
+	0xBB, 0x42, 0xD0, 0xBC, 0x42, 0xD0, 0xBD, 0x42,
+	0xD0, 0xBE, 0x42, 0xD0, 0xBF, 0x42, 0xD1, 0x80,
+	// Bytes 2c0 - 2ff
+	0x42, 0xD1, 0x81, 0x42, 0xD1, 0x82, 0x42, 0xD1,
+	0x83, 0x42, 0xD1, 0x84, 0x42, 0xD1, 0x85, 0x42,
+	0xD1, 0x86, 0x42, 0xD1, 0x87, 0x42, 0xD1, 0x88,
+	0x42, 0xD1, 0x8A, 0x42, 0xD1, 0x8B, 0x42, 0xD1,
+	0x8C, 0x42, 0xD1, 0x8D, 0x42, 0xD1, 0x8E, 0x42,
+	0xD1, 0x95, 0x42, 0xD1, 0x96, 0x42, 0xD1, 0x98,
+	0x42, 0xD1, 0x9F, 0x42, 0xD2, 0x91, 0x42, 0xD2,
+	0xAB, 0x42, 0xD2, 0xAF, 0x42, 0xD2, 0xB1, 0x42,
+	// Bytes 300 - 33f
+	0xD3, 0x8F, 0x42, 0xD3, 0x99, 0x42, 0xD3, 0xA9,
+	0x42, 0xD7, 0x90, 0x42, 0xD7, 0x91, 0x42, 0xD7,
+	0x92, 0x42, 0xD7, 0x93, 0x42, 0xD7, 0x94, 0x42,
+	0xD7, 0x9B, 0x42, 0xD7, 0x9C, 0x42, 0xD7, 0x9D,
+	0x42, 0xD7, 0xA2, 0x42, 0xD7, 0xA8, 0x42, 0xD7,
+	0xAA, 0x42, 0xD8, 0xA1, 0x42, 0xD8, 0xA7, 0x42,
+	0xD8, 0xA8, 0x42, 0xD8, 0xA9, 0x42, 0xD8, 0xAA,
+	0x42, 0xD8, 0xAB, 0x42, 0xD8, 0xAC, 0x42, 0xD8,
+	// Bytes 340 - 37f
+	0xAD, 0x42, 0xD8, 0xAE, 0x42, 0xD8, 0xAF, 0x42,
+	0xD8, 0xB0, 0x42, 0xD8, 0xB1, 0x42, 0xD8, 0xB2,
+	0x42, 0xD8, 0xB3, 0x42, 0xD8, 0xB4, 0x42, 0xD8,
+	0xB5, 0x42, 0xD8, 0xB6, 0x42, 0xD8, 0xB7, 0x42,
+	0xD8, 0xB8, 0x42, 0xD8, 0xB9, 0x42, 0xD8, 0xBA,
+	0x42, 0xD9, 0x81, 0x42, 0xD9, 0x82, 0x42, 0xD9,
+	0x83, 0x42, 0xD9, 0x84, 0x42, 0xD9, 0x85, 0x42,
+	0xD9, 0x86, 0x42, 0xD9, 0x87, 0x42, 0xD9, 0x88,
+	// Bytes 380 - 3bf
+	0x42, 0xD9, 0x89, 0x42, 0xD9, 0x8A, 0x42, 0xD9,
+	0xAE, 0x42, 0xD9, 0xAF, 0x42, 0xD9, 0xB1, 0x42,
+	0xD9, 0xB9, 0x42, 0xD9, 0xBA, 0x42, 0xD9, 0xBB,
+	0x42, 0xD9, 0xBE, 0x42, 0xD9, 0xBF, 0x42, 0xDA,
+	0x80, 0x42, 0xDA, 0x83, 0x42, 0xDA, 0x84, 0x42,
+	0xDA, 0x86, 0x42, 0xDA, 0x87, 0x42, 0xDA, 0x88,
+	0x42, 0xDA, 0x8C, 0x42, 0xDA, 0x8D, 0x42, 0xDA,
+	0x8E, 0x42, 0xDA, 0x91, 0x42, 0xDA, 0x98, 0x42,
+	// Bytes 3c0 - 3ff
+	0xDA, 0xA1, 0x42, 0xDA, 0xA4, 0x42, 0xDA, 0xA6,
+	0x42, 0xDA, 0xA9, 0x42, 0xDA, 0xAD, 0x42, 0xDA,
+	0xAF, 0x42, 0xDA, 0xB1, 0x42, 0xDA, 0xB3, 0x42,
+	0xDA, 0xBA, 0x42, 0xDA, 0xBB, 0x42, 0xDA, 0xBE,
+	0x42, 0xDB, 0x81, 0x42, 0xDB, 0x85, 0x42, 0xDB,
+	0x86, 0x42, 0xDB, 0x87, 0x42, 0xDB, 0x88, 0x42,
+	0xDB, 0x89, 0x42, 0xDB, 0x8B, 0x42, 0xDB, 0x8C,
+	0x42, 0xDB, 0x90, 0x42, 0xDB, 0x92, 0x43, 0xE0,
+	// Bytes 400 - 43f
+	0xBC, 0x8B, 0x43, 0xE1, 0x83, 0x9C, 0x43, 0xE1,
+	0x84, 0x80, 0x43, 0xE1, 0x84, 0x81, 0x43, 0xE1,
+	0x84, 0x82, 0x43, 0xE1, 0x84, 0x83, 0x43, 0xE1,
+	0x84, 0x84, 0x43, 0xE1, 0x84, 0x85, 0x43, 0xE1,
+	0x84, 0x86, 0x43, 0xE1, 0x84, 0x87, 0x43, 0xE1,
+	0x84, 0x88, 0x43, 0xE1, 0x84, 0x89, 0x43, 0xE1,
+	0x84, 0x8A, 0x43, 0xE1, 0x84, 0x8B, 0x43, 0xE1,
+	0x84, 0x8C, 0x43, 0xE1, 0x84, 0x8D, 0x43, 0xE1,
+	// Bytes 440 - 47f
+	0x84, 0x8E, 0x43, 0xE1, 0x84, 0x8F, 0x43, 0xE1,
+	0x84, 0x90, 0x43, 0xE1, 0x84, 0x91, 0x43, 0xE1,
+	0x84, 0x92, 0x43, 0xE1, 0x84, 0x94, 0x43, 0xE1,
+	0x84, 0x95, 0x43, 0xE1, 0x84, 0x9A, 0x43, 0xE1,
+	0x84, 0x9C, 0x43, 0xE1, 0x84, 0x9D, 0x43, 0xE1,
+	0x84, 0x9E, 0x43, 0xE1, 0x84, 0xA0, 0x43, 0xE1,
+	0x84, 0xA1, 0x43, 0xE1, 0x84, 0xA2, 0x43, 0xE1,
+	0x84, 0xA3, 0x43, 0xE1, 0x84, 0xA7, 0x43, 0xE1,
+	// Bytes 480 - 4bf
+	0x84, 0xA9, 0x43, 0xE1, 0x84, 0xAB, 0x43, 0xE1,
+	0x84, 0xAC, 0x43, 0xE1, 0x84, 0xAD, 0x43, 0xE1,
+	0x84, 0xAE, 0x43, 0xE1, 0x84, 0xAF, 0x43, 0xE1,
+	0x84, 0xB2, 0x43, 0xE1, 0x84, 0xB6, 0x43, 0xE1,
+	0x85, 0x80, 0x43, 0xE1, 0x85, 0x87, 0x43, 0xE1,
+	0x85, 0x8C, 0x43, 0xE1, 0x85, 0x97, 0x43, 0xE1,
+	0x85, 0x98, 0x43, 0xE1, 0x85, 0x99, 0x43, 0xE1,
+	0x85, 0xA0, 0x43, 0xE1, 0x86, 0x84, 0x43, 0xE1,
+	// Bytes 4c0 - 4ff
+	0x86, 0x85, 0x43, 0xE1, 0x86, 0x88, 0x43, 0xE1,
+	0x86, 0x91, 0x43, 0xE1, 0x86, 0x92, 0x43, 0xE1,
+	0x86, 0x94, 0x43, 0xE1, 0x86, 0x9E, 0x43, 0xE1,
+	0x86, 0xA1, 0x43, 0xE1, 0x87, 0x87, 0x43, 0xE1,
+	0x87, 0x88, 0x43, 0xE1, 0x87, 0x8C, 0x43, 0xE1,
+	0x87, 0x8E, 0x43, 0xE1, 0x87, 0x93, 0x43, 0xE1,
+	0x87, 0x97, 0x43, 0xE1, 0x87, 0x99, 0x43, 0xE1,
+	0x87, 0x9D, 0x43, 0xE1, 0x87, 0x9F, 0x43, 0xE1,
+	// Bytes 500 - 53f
+	0x87, 0xB1, 0x43, 0xE1, 0x87, 0xB2, 0x43, 0xE1,
+	0xB4, 0x82, 0x43, 0xE1, 0xB4, 0x96, 0x43, 0xE1,
+	0xB4, 0x97, 0x43, 0xE1, 0xB4, 0x9C, 0x43, 0xE1,
+	0xB4, 0x9D, 0x43, 0xE1, 0xB4, 0xA5, 0x43, 0xE1,
+	0xB5, 0xBB, 0x43, 0xE1, 0xB6, 0x85, 0x43, 0xE1,
+	0xB6, 0x91, 0x43, 0xE2, 0x80, 0x82, 0x43, 0xE2,
+	0x80, 0x83, 0x43, 0xE2, 0x80, 0x90, 0x43, 0xE2,
+	0x80, 0x93, 0x43, 0xE2, 0x80, 0x94, 0x43, 0xE2,
+	// Bytes 540 - 57f
+	0x82, 0xA9, 0x43, 0xE2, 0x86, 0x90, 0x43, 0xE2,
+	0x86, 0x91, 0x43, 0xE2, 0x86, 0x92, 0x43, 0xE2,
+	0x86, 0x93, 0x43, 0xE2, 0x88, 0x82, 0x43, 0xE2,
+	0x88, 0x87, 0x43, 0xE2, 0x88, 0x91, 0x43, 0xE2,
+	0x88, 0x92, 0x43, 0xE2, 0x94, 0x82, 0x43, 0xE2,
+	0x96, 0xA0, 0x43, 0xE2, 0x97, 0x8B, 0x43, 0xE2,
+	0xA6, 0x85, 0x43, 0xE2, 0xA6, 0x86, 0x43, 0xE2,
+	0xB1, 0xB1, 0x43, 0xE2, 0xB5, 0xA1, 0x43, 0xE3,
+	// Bytes 580 - 5bf
+	0x80, 0x81, 0x43, 0xE3, 0x80, 0x82, 0x43, 0xE3,
+	0x80, 0x88, 0x43, 0xE3, 0x80, 0x89, 0x43, 0xE3,
+	0x80, 0x8A, 0x43, 0xE3, 0x80, 0x8B, 0x43, 0xE3,
+	0x80, 0x8C, 0x43, 0xE3, 0x80, 0x8D, 0x43, 0xE3,
+	0x80, 0x8E, 0x43, 0xE3, 0x80, 0x8F, 0x43, 0xE3,
+	0x80, 0x90, 0x43, 0xE3, 0x80, 0x91, 0x43, 0xE3,
+	0x80, 0x92, 0x43, 0xE3, 0x80, 0x94, 0x43, 0xE3,
+	0x80, 0x95, 0x43, 0xE3, 0x80, 0x96, 0x43, 0xE3,
+	// Bytes 5c0 - 5ff
+	0x80, 0x97, 0x43, 0xE3, 0x82, 0xA1, 0x43, 0xE3,
+	0x82, 0xA2, 0x43, 0xE3, 0x82, 0xA3, 0x43, 0xE3,
+	0x82, 0xA4, 0x43, 0xE3, 0x82, 0xA5, 0x43, 0xE3,
+	0x82, 0xA6, 0x43, 0xE3, 0x82, 0xA7, 0x43, 0xE3,
+	0x82, 0xA8, 0x43, 0xE3, 0x82, 0xA9, 0x43, 0xE3,
+	0x82, 0xAA, 0x43, 0xE3, 0x82, 0xAB, 0x43, 0xE3,
+	0x82, 0xAD, 0x43, 0xE3, 0x82, 0xAF, 0x43, 0xE3,
+	0x82, 0xB1, 0x43, 0xE3, 0x82, 0xB3, 0x43, 0xE3,
+	// Bytes 600 - 63f
+	0x82, 0xB5, 0x43, 0xE3, 0x82, 0xB7, 0x43, 0xE3,
+	0x82, 0xB9, 0x43, 0xE3, 0x82, 0xBB, 0x43, 0xE3,
+	0x82, 0xBD, 0x43, 0xE3, 0x82, 0xBF, 0x43, 0xE3,
+	0x83, 0x81, 0x43, 0xE3, 0x83, 0x83, 0x43, 0xE3,
+	0x83, 0x84, 0x43, 0xE3, 0x83, 0x86, 0x43, 0xE3,
+	0x83, 0x88, 0x43, 0xE3, 0x83, 0x8A, 0x43, 0xE3,
+	0x83, 0x8B, 0x43, 0xE3, 0x83, 0x8C, 0x43, 0xE3,
+	0x83, 0x8D, 0x43, 0xE3, 0x83, 0x8E, 0x43, 0xE3,
+	// Bytes 640 - 67f
+	0x83, 0x8F, 0x43, 0xE3, 0x83, 0x92, 0x43, 0xE3,
+	0x83, 0x95, 0x43, 0xE3, 0x83, 0x98, 0x43, 0xE3,
+	0x83, 0x9B, 0x43, 0xE3, 0x83, 0x9E, 0x43, 0xE3,
+	0x83, 0x9F, 0x43, 0xE3, 0x83, 0xA0, 0x43, 0xE3,
+	0x83, 0xA1, 0x43, 0xE3, 0x83, 0xA2, 0x43, 0xE3,
+	0x83, 0xA3, 0x43, 0xE3, 0x83, 0xA4, 0x43, 0xE3,
+	0x83, 0xA5, 0x43, 0xE3, 0x83, 0xA6, 0x43, 0xE3,
+	0x83, 0xA7, 0x43, 0xE3, 0x83, 0xA8, 0x43, 0xE3,
+	// Bytes 680 - 6bf
+	0x83, 0xA9, 0x43, 0xE3, 0x83, 0xAA, 0x43, 0xE3,
+	0x83, 0xAB, 0x43, 0xE3, 0x83, 0xAC, 0x43, 0xE3,
+	0x83, 0xAD, 0x43, 0xE3, 0x83, 0xAF, 0x43, 0xE3,
+	0x83, 0xB0, 0x43, 0xE3, 0x83, 0xB1, 0x43, 0xE3,
+	0x83, 0xB2, 0x43, 0xE3, 0x83, 0xB3, 0x43, 0xE3,
+	0x83, 0xBB, 0x43, 0xE3, 0x83, 0xBC, 0x43, 0xE3,
+	0x92, 0x9E, 0x43, 0xE3, 0x92, 0xB9, 0x43, 0xE3,
+	0x92, 0xBB, 0x43, 0xE3, 0x93, 0x9F, 0x43, 0xE3,
+	// Bytes 6c0 - 6ff
+	0x94, 0x95, 0x43, 0xE3, 0x9B, 0xAE, 0x43, 0xE3,
+	0x9B, 0xBC, 0x43, 0xE3, 0x9E, 0x81, 0x43, 0xE3,
+	0xA0, 0xAF, 0x43, 0xE3, 0xA1, 0xA2, 0x43, 0xE3,
+	0xA1, 0xBC, 0x43, 0xE3, 0xA3, 0x87, 0x43, 0xE3,
+	0xA3, 0xA3, 0x43, 0xE3, 0xA4, 0x9C, 0x43, 0xE3,
+	0xA4, 0xBA, 0x43, 0xE3, 0xA8, 0xAE, 0x43, 0xE3,
+	0xA9, 0xAC, 0x43, 0xE3, 0xAB, 0xA4, 0x43, 0xE3,
+	0xAC, 0x88, 0x43, 0xE3, 0xAC, 0x99, 0x43, 0xE3,
+	// Bytes 700 - 73f
+	0xAD, 0x89, 0x43, 0xE3, 0xAE, 0x9D, 0x43, 0xE3,
+	0xB0, 0x98, 0x43, 0xE3, 0xB1, 0x8E, 0x43, 0xE3,
+	0xB4, 0xB3, 0x43, 0xE3, 0xB6, 0x96, 0x43, 0xE3,
+	0xBA, 0xAC, 0x43, 0xE3, 0xBA, 0xB8, 0x43, 0xE3,
+	0xBC, 0x9B, 0x43, 0xE3, 0xBF, 0xBC, 0x43, 0xE4,
+	0x80, 0x88, 0x43, 0xE4, 0x80, 0x98, 0x43, 0xE4,
+	0x80, 0xB9, 0x43, 0xE4, 0x81, 0x86, 0x43, 0xE4,
+	0x82, 0x96, 0x43, 0xE4, 0x83, 0xA3, 0x43, 0xE4,
+	// Bytes 740 - 77f
+	0x84, 0xAF, 0x43, 0xE4, 0x88, 0x82, 0x43, 0xE4,
+	0x88, 0xA7, 0x43, 0xE4, 0x8A, 0xA0, 0x43, 0xE4,
+	0x8C, 0x81, 0x43, 0xE4, 0x8C, 0xB4, 0x43, 0xE4,
+	0x8D, 0x99, 0x43, 0xE4, 0x8F, 0x95, 0x43, 0xE4,
+	0x8F, 0x99, 0x43, 0xE4, 0x90, 0x8B, 0x43, 0xE4,
+	0x91, 0xAB, 0x43, 0xE4, 0x94, 0xAB, 0x43, 0xE4,
+	0x95, 0x9D, 0x43, 0xE4, 0x95, 0xA1, 0x43, 0xE4,
+	0x95, 0xAB, 0x43, 0xE4, 0x97, 0x97, 0x43, 0xE4,
+	// Bytes 780 - 7bf
+	0x97, 0xB9, 0x43, 0xE4, 0x98, 0xB5, 0x43, 0xE4,
+	0x9A, 0xBE, 0x43, 0xE4, 0x9B, 0x87, 0x43, 0xE4,
+	0xA6, 0x95, 0x43, 0xE4, 0xA7, 0xA6, 0x43, 0xE4,
+	0xA9, 0xAE, 0x43, 0xE4, 0xA9, 0xB6, 0x43, 0xE4,
+	0xAA, 0xB2, 0x43, 0xE4, 0xAC, 0xB3, 0x43, 0xE4,
+	0xAF, 0x8E, 0x43, 0xE4, 0xB3, 0x8E, 0x43, 0xE4,
+	0xB3, 0xAD, 0x43, 0xE4, 0xB3, 0xB8, 0x43, 0xE4,
+	0xB5, 0x96, 0x43, 0xE4, 0xB8, 0x80, 0x43, 0xE4,
+	// Bytes 7c0 - 7ff
+	0xB8, 0x81, 0x43, 0xE4, 0xB8, 0x83, 0x43, 0xE4,
+	0xB8, 0x89, 0x43, 0xE4, 0xB8, 0x8A, 0x43, 0xE4,
+	0xB8, 0x8B, 0x43, 0xE4, 0xB8, 0x8D, 0x43, 0xE4,
+	0xB8, 0x99, 0x43, 0xE4, 0xB8, 0xA6, 0x43, 0xE4,
+	0xB8, 0xA8, 0x43, 0xE4, 0xB8, 0xAD, 0x43, 0xE4,
+	0xB8, 0xB2, 0x43, 0xE4, 0xB8, 0xB6, 0x43, 0xE4,
+	0xB8, 0xB8, 0x43, 0xE4, 0xB8, 0xB9, 0x43, 0xE4,
+	0xB8, 0xBD, 0x43, 0xE4, 0xB8, 0xBF, 0x43, 0xE4,
+	// Bytes 800 - 83f
+	0xB9, 0x81, 0x43, 0xE4, 0xB9, 0x99, 0x43, 0xE4,
+	0xB9, 0x9D, 0x43, 0xE4, 0xBA, 0x82, 0x43, 0xE4,
+	0xBA, 0x85, 0x43, 0xE4, 0xBA, 0x86, 0x43, 0xE4,
+	0xBA, 0x8C, 0x43, 0xE4, 0xBA, 0x94, 0x43, 0xE4,
+	0xBA, 0xA0, 0x43, 0xE4, 0xBA, 0xA4, 0x43, 0xE4,
+	0xBA, 0xAE, 0x43, 0xE4, 0xBA, 0xBA, 0x43, 0xE4,
+	0xBB, 0x80, 0x43, 0xE4, 0xBB, 0x8C, 0x43, 0xE4,
+	0xBB, 0xA4, 0x43, 0xE4, 0xBC, 0x81, 0x43, 0xE4,
+	// Bytes 840 - 87f
+	0xBC, 0x91, 0x43, 0xE4, 0xBD, 0xA0, 0x43, 0xE4,
+	0xBE, 0x80, 0x43, 0xE4, 0xBE, 0x86, 0x43, 0xE4,
+	0xBE, 0x8B, 0x43, 0xE4, 0xBE, 0xAE, 0x43, 0xE4,
+	0xBE, 0xBB, 0x43, 0xE4, 0xBE, 0xBF, 0x43, 0xE5,
+	0x80, 0x82, 0x43, 0xE5, 0x80, 0xAB, 0x43, 0xE5,
+	0x81, 0xBA, 0x43, 0xE5, 0x82, 0x99, 0x43, 0xE5,
+	0x83, 0x8F, 0x43, 0xE5, 0x83, 0x9A, 0x43, 0xE5,
+	0x83, 0xA7, 0x43, 0xE5, 0x84, 0xAA, 0x43, 0xE5,
+	// Bytes 880 - 8bf
+	0x84, 0xBF, 0x43, 0xE5, 0x85, 0x80, 0x43, 0xE5,
+	0x85, 0x85, 0x43, 0xE5, 0x85, 0x8D, 0x43, 0xE5,
+	0x85, 0x94, 0x43, 0xE5, 0x85, 0xA4, 0x43, 0xE5,
+	0x85, 0xA5, 0x43, 0xE5, 0x85, 0xA7, 0x43, 0xE5,
+	0x85, 0xA8, 0x43, 0xE5, 0x85, 0xA9, 0x43, 0xE5,
+	0x85, 0xAB, 0x43, 0xE5, 0x85, 0xAD, 0x43, 0xE5,
+	0x85, 0xB7, 0x43, 0xE5, 0x86, 0x80, 0x43, 0xE5,
+	0x86, 0x82, 0x43, 0xE5, 0x86, 0x8D, 0x43, 0xE5,
+	// Bytes 8c0 - 8ff
+	0x86, 0x92, 0x43, 0xE5, 0x86, 0x95, 0x43, 0xE5,
+	0x86, 0x96, 0x43, 0xE5, 0x86, 0x97, 0x43, 0xE5,
+	0x86, 0x99, 0x43, 0xE5, 0x86, 0xA4, 0x43, 0xE5,
+	0x86, 0xAB, 0x43, 0xE5, 0x86, 0xAC, 0x43, 0xE5,
+	0x86, 0xB5, 0x43, 0xE5, 0x86, 0xB7, 0x43, 0xE5,
+	0x87, 0x89, 0x43, 0xE5, 0x87, 0x8C, 0x43, 0xE5,
+	0x87, 0x9C, 0x43, 0xE5, 0x87, 0x9E, 0x43, 0xE5,
+	0x87, 0xA0, 0x43, 0xE5, 0x87, 0xB5, 0x43, 0xE5,
+	// Bytes 900 - 93f
+	0x88, 0x80, 0x43, 0xE5, 0x88, 0x83, 0x43, 0xE5,
+	0x88, 0x87, 0x43, 0xE5, 0x88, 0x97, 0x43, 0xE5,
+	0x88, 0x9D, 0x43, 0xE5, 0x88, 0xA9, 0x43, 0xE5,
+	0x88, 0xBA, 0x43, 0xE5, 0x88, 0xBB, 0x43, 0xE5,
+	0x89, 0x86, 0x43, 0xE5, 0x89, 0x8D, 0x43, 0xE5,
+	0x89, 0xB2, 0x43, 0xE5, 0x89, 0xB7, 0x43, 0xE5,
+	0x8A, 0x89, 0x43, 0xE5, 0x8A, 0x9B, 0x43, 0xE5,
+	0x8A, 0xA3, 0x43, 0xE5, 0x8A, 0xB3, 0x43, 0xE5,
+	// Bytes 940 - 97f
+	0x8A, 0xB4, 0x43, 0xE5, 0x8B, 0x87, 0x43, 0xE5,
+	0x8B, 0x89, 0x43, 0xE5, 0x8B, 0x92, 0x43, 0xE5,
+	0x8B, 0x9E, 0x43, 0xE5, 0x8B, 0xA4, 0x43, 0xE5,
+	0x8B, 0xB5, 0x43, 0xE5, 0x8B, 0xB9, 0x43, 0xE5,
+	0x8B, 0xBA, 0x43, 0xE5, 0x8C, 0x85, 0x43, 0xE5,
+	0x8C, 0x86, 0x43, 0xE5, 0x8C, 0x95, 0x43, 0xE5,
+	0x8C, 0x97, 0x43, 0xE5, 0x8C, 0x9A, 0x43, 0xE5,
+	0x8C, 0xB8, 0x43, 0xE5, 0x8C, 0xBB, 0x43, 0xE5,
+	// Bytes 980 - 9bf
+	0x8C, 0xBF, 0x43, 0xE5, 0x8D, 0x81, 0x43, 0xE5,
+	0x8D, 0x84, 0x43, 0xE5, 0x8D, 0x85, 0x43, 0xE5,
+	0x8D, 0x89, 0x43, 0xE5, 0x8D, 0x91, 0x43, 0xE5,
+	0x8D, 0x94, 0x43, 0xE5, 0x8D, 0x9A, 0x43, 0xE5,
+	0x8D, 0x9C, 0x43, 0xE5, 0x8D, 0xA9, 0x43, 0xE5,
+	0x8D, 0xB0, 0x43, 0xE5, 0x8D, 0xB3, 0x43, 0xE5,
+	0x8D, 0xB5, 0x43, 0xE5, 0x8D, 0xBD, 0x43, 0xE5,
+	0x8D, 0xBF, 0x43, 0xE5, 0x8E, 0x82, 0x43, 0xE5,
+	// Bytes 9c0 - 9ff
+	0x8E, 0xB6, 0x43, 0xE5, 0x8F, 0x83, 0x43, 0xE5,
+	0x8F, 0x88, 0x43, 0xE5, 0x8F, 0x8A, 0x43, 0xE5,
+	0x8F, 0x8C, 0x43, 0xE5, 0x8F, 0x9F, 0x43, 0xE5,
+	0x8F, 0xA3, 0x43, 0xE5, 0x8F, 0xA5, 0x43, 0xE5,
+	0x8F, 0xAB, 0x43, 0xE5, 0x8F, 0xAF, 0x43, 0xE5,
+	0x8F, 0xB1, 0x43, 0xE5, 0x8F, 0xB3, 0x43, 0xE5,
+	0x90, 0x86, 0x43, 0xE5, 0x90, 0x88, 0x43, 0xE5,
+	0x90, 0x8D, 0x43, 0xE5, 0x90, 0x8F, 0x43, 0xE5,
+	// Bytes a00 - a3f
+	0x90, 0x9D, 0x43, 0xE5, 0x90, 0xB8, 0x43, 0xE5,
+	0x90, 0xB9, 0x43, 0xE5, 0x91, 0x82, 0x43, 0xE5,
+	0x91, 0x88, 0x43, 0xE5, 0x91, 0xA8, 0x43, 0xE5,
+	0x92, 0x9E, 0x43, 0xE5, 0x92, 0xA2, 0x43, 0xE5,
+	0x92, 0xBD, 0x43, 0xE5, 0x93, 0xB6, 0x43, 0xE5,
+	0x94, 0x90, 0x43, 0xE5, 0x95, 0x8F, 0x43, 0xE5,
+	0x95, 0x93, 0x43, 0xE5, 0x95, 0x95, 0x43, 0xE5,
+	0x95, 0xA3, 0x43, 0xE5, 0x96, 0x84, 0x43, 0xE5,
+	// Bytes a40 - a7f
+	0x96, 0x87, 0x43, 0xE5, 0x96, 0x99, 0x43, 0xE5,
+	0x96, 0x9D, 0x43, 0xE5, 0x96, 0xAB, 0x43, 0xE5,
+	0x96, 0xB3, 0x43, 0xE5, 0x96, 0xB6, 0x43, 0xE5,
+	0x97, 0x80, 0x43, 0xE5, 0x97, 0x82, 0x43, 0xE5,
+	0x97, 0xA2, 0x43, 0xE5, 0x98, 0x86, 0x43, 0xE5,
+	0x99, 0x91, 0x43, 0xE5, 0x99, 0xA8, 0x43, 0xE5,
+	0x99, 0xB4, 0x43, 0xE5, 0x9B, 0x97, 0x43, 0xE5,
+	0x9B, 0x9B, 0x43, 0xE5, 0x9B, 0xB9, 0x43, 0xE5,
+	// Bytes a80 - abf
+	0x9C, 0x96, 0x43, 0xE5, 0x9C, 0x97, 0x43, 0xE5,
+	0x9C, 0x9F, 0x43, 0xE5, 0x9C, 0xB0, 0x43, 0xE5,
+	0x9E, 0x8B, 0x43, 0xE5, 0x9F, 0x8E, 0x43, 0xE5,
+	0x9F, 0xB4, 0x43, 0xE5, 0xA0, 0x8D, 0x43, 0xE5,
+	0xA0, 0xB1, 0x43, 0xE5, 0xA0, 0xB2, 0x43, 0xE5,
+	0xA1, 0x80, 0x43, 0xE5, 0xA1, 0x9A, 0x43, 0xE5,
+	0xA1, 0x9E, 0x43, 0xE5, 0xA2, 0xA8, 0x43, 0xE5,
+	0xA2, 0xAC, 0x43, 0xE5, 0xA2, 0xB3, 0x43, 0xE5,
+	// Bytes ac0 - aff
+	0xA3, 0x98, 0x43, 0xE5, 0xA3, 0x9F, 0x43, 0xE5,
+	0xA3, 0xAB, 0x43, 0xE5, 0xA3, 0xAE, 0x43, 0xE5,
+	0xA3, 0xB0, 0x43, 0xE5, 0xA3, 0xB2, 0x43, 0xE5,
+	0xA3, 0xB7, 0x43, 0xE5, 0xA4, 0x82, 0x43, 0xE5,
+	0xA4, 0x86, 0x43, 0xE5, 0xA4, 0x8A, 0x43, 0xE5,
+	0xA4, 0x95, 0x43, 0xE5, 0xA4, 0x9A, 0x43, 0xE5,
+	0xA4, 0x9C, 0x43, 0xE5, 0xA4, 0xA2, 0x43, 0xE5,
+	0xA4, 0xA7, 0x43, 0xE5, 0xA4, 0xA9, 0x43, 0xE5,
+	// Bytes b00 - b3f
+	0xA5, 0x84, 0x43, 0xE5, 0xA5, 0x88, 0x43, 0xE5,
+	0xA5, 0x91, 0x43, 0xE5, 0xA5, 0x94, 0x43, 0xE5,
+	0xA5, 0xA2, 0x43, 0xE5, 0xA5, 0xB3, 0x43, 0xE5,
+	0xA7, 0x98, 0x43, 0xE5, 0xA7, 0xAC, 0x43, 0xE5,
+	0xA8, 0x9B, 0x43, 0xE5, 0xA8, 0xA7, 0x43, 0xE5,
+	0xA9, 0xA2, 0x43, 0xE5, 0xA9, 0xA6, 0x43, 0xE5,
+	0xAA, 0xB5, 0x43, 0xE5, 0xAC, 0x88, 0x43, 0xE5,
+	0xAC, 0xA8, 0x43, 0xE5, 0xAC, 0xBE, 0x43, 0xE5,
+	// Bytes b40 - b7f
+	0xAD, 0x90, 0x43, 0xE5, 0xAD, 0x97, 0x43, 0xE5,
+	0xAD, 0xA6, 0x43, 0xE5, 0xAE, 0x80, 0x43, 0xE5,
+	0xAE, 0x85, 0x43, 0xE5, 0xAE, 0x97, 0x43, 0xE5,
+	0xAF, 0x83, 0x43, 0xE5, 0xAF, 0x98, 0x43, 0xE5,
+	0xAF, 0xA7, 0x43, 0xE5, 0xAF, 0xAE, 0x43, 0xE5,
+	0xAF, 0xB3, 0x43, 0xE5, 0xAF, 0xB8, 0x43, 0xE5,
+	0xAF, 0xBF, 0x43, 0xE5, 0xB0, 0x86, 0x43, 0xE5,
+	0xB0, 0x8F, 0x43, 0xE5, 0xB0, 0xA2, 0x43, 0xE5,
+	// Bytes b80 - bbf
+	0xB0, 0xB8, 0x43, 0xE5, 0xB0, 0xBF, 0x43, 0xE5,
+	0xB1, 0xA0, 0x43, 0xE5, 0xB1, 0xA2, 0x43, 0xE5,
+	0xB1, 0xA4, 0x43, 0xE5, 0xB1, 0xA5, 0x43, 0xE5,
+	0xB1, 0xAE, 0x43, 0xE5, 0xB1, 0xB1, 0x43, 0xE5,
+	0xB2, 0x8D, 0x43, 0xE5, 0xB3, 0x80, 0x43, 0xE5,
+	0xB4, 0x99, 0x43, 0xE5, 0xB5, 0x83, 0x43, 0xE5,
+	0xB5, 0x90, 0x43, 0xE5, 0xB5, 0xAB, 0x43, 0xE5,
+	0xB5, 0xAE, 0x43, 0xE5, 0xB5, 0xBC, 0x43, 0xE5,
+	// Bytes bc0 - bff
+	0xB6, 0xB2, 0x43, 0xE5, 0xB6, 0xBA, 0x43, 0xE5,
+	0xB7, 0x9B, 0x43, 0xE5, 0xB7, 0xA1, 0x43, 0xE5,
+	0xB7, 0xA2, 0x43, 0xE5, 0xB7, 0xA5, 0x43, 0xE5,
+	0xB7, 0xA6, 0x43, 0xE5, 0xB7, 0xB1, 0x43, 0xE5,
+	0xB7, 0xBD, 0x43, 0xE5, 0xB7, 0xBE, 0x43, 0xE5,
+	0xB8, 0xA8, 0x43, 0xE5, 0xB8, 0xBD, 0x43, 0xE5,
+	0xB9, 0xA9, 0x43, 0xE5, 0xB9, 0xB2, 0x43, 0xE5,
+	0xB9, 0xB4, 0x43, 0xE5, 0xB9, 0xBA, 0x43, 0xE5,
+	// Bytes c00 - c3f
+	0xB9, 0xBC, 0x43, 0xE5, 0xB9, 0xBF, 0x43, 0xE5,
+	0xBA, 0xA6, 0x43, 0xE5, 0xBA, 0xB0, 0x43, 0xE5,
+	0xBA, 0xB3, 0x43, 0xE5, 0xBA, 0xB6, 0x43, 0xE5,
+	0xBB, 0x89, 0x43, 0xE5, 0xBB, 0x8A, 0x43, 0xE5,
+	0xBB, 0x92, 0x43, 0xE5, 0xBB, 0x93, 0x43, 0xE5,
+	0xBB, 0x99, 0x43, 0xE5, 0xBB, 0xAC, 0x43, 0xE5,
+	0xBB, 0xB4, 0x43, 0xE5, 0xBB, 0xBE, 0x43, 0xE5,
+	0xBC, 0x84, 0x43, 0xE5, 0xBC, 0x8B, 0x43, 0xE5,
+	// Bytes c40 - c7f
+	0xBC, 0x93, 0x43, 0xE5, 0xBC, 0xA2, 0x43, 0xE5,
+	0xBD, 0x90, 0x43, 0xE5, 0xBD, 0x93, 0x43, 0xE5,
+	0xBD, 0xA1, 0x43, 0xE5, 0xBD, 0xA2, 0x43, 0xE5,
+	0xBD, 0xA9, 0x43, 0xE5, 0xBD, 0xAB, 0x43, 0xE5,
+	0xBD, 0xB3, 0x43, 0xE5, 0xBE, 0x8B, 0x43, 0xE5,
+	0xBE, 0x8C, 0x43, 0xE5, 0xBE, 0x97, 0x43, 0xE5,
+	0xBE, 0x9A, 0x43, 0xE5, 0xBE, 0xA9, 0x43, 0xE5,
+	0xBE, 0xAD, 0x43, 0xE5, 0xBF, 0x83, 0x43, 0xE5,
+	// Bytes c80 - cbf
+	0xBF, 0x8D, 0x43, 0xE5, 0xBF, 0x97, 0x43, 0xE5,
+	0xBF, 0xB5, 0x43, 0xE5, 0xBF, 0xB9, 0x43, 0xE6,
+	0x80, 0x92, 0x43, 0xE6, 0x80, 0x9C, 0x43, 0xE6,
+	0x81, 0xB5, 0x43, 0xE6, 0x82, 0x81, 0x43, 0xE6,
+	0x82, 0x94, 0x43, 0xE6, 0x83, 0x87, 0x43, 0xE6,
+	0x83, 0x98, 0x43, 0xE6, 0x83, 0xA1, 0x43, 0xE6,
+	0x84, 0x88, 0x43, 0xE6, 0x85, 0x84, 0x43, 0xE6,
+	0x85, 0x88, 0x43, 0xE6, 0x85, 0x8C, 0x43, 0xE6,
+	// Bytes cc0 - cff
+	0x85, 0x8E, 0x43, 0xE6, 0x85, 0xA0, 0x43, 0xE6,
+	0x85, 0xA8, 0x43, 0xE6, 0x85, 0xBA, 0x43, 0xE6,
+	0x86, 0x8E, 0x43, 0xE6, 0x86, 0x90, 0x43, 0xE6,
+	0x86, 0xA4, 0x43, 0xE6, 0x86, 0xAF, 0x43, 0xE6,
+	0x86, 0xB2, 0x43, 0xE6, 0x87, 0x9E, 0x43, 0xE6,
+	0x87, 0xB2, 0x43, 0xE6, 0x87, 0xB6, 0x43, 0xE6,
+	0x88, 0x80, 0x43, 0xE6, 0x88, 0x88, 0x43, 0xE6,
+	0x88, 0x90, 0x43, 0xE6, 0x88, 0x9B, 0x43, 0xE6,
+	// Bytes d00 - d3f
+	0x88, 0xAE, 0x43, 0xE6, 0x88, 0xB4, 0x43, 0xE6,
+	0x88, 0xB6, 0x43, 0xE6, 0x89, 0x8B, 0x43, 0xE6,
+	0x89, 0x93, 0x43, 0xE6, 0x89, 0x9D, 0x43, 0xE6,
+	0x8A, 0x95, 0x43, 0xE6, 0x8A, 0xB1, 0x43, 0xE6,
+	0x8B, 0x89, 0x43, 0xE6, 0x8B, 0x8F, 0x43, 0xE6,
+	0x8B, 0x93, 0x43, 0xE6, 0x8B, 0x94, 0x43, 0xE6,
+	0x8B, 0xBC, 0x43, 0xE6, 0x8B, 0xBE, 0x43, 0xE6,
+	0x8C, 0x87, 0x43, 0xE6, 0x8C, 0xBD, 0x43, 0xE6,
+	// Bytes d40 - d7f
+	0x8D, 0x90, 0x43, 0xE6, 0x8D, 0x95, 0x43, 0xE6,
+	0x8D, 0xA8, 0x43, 0xE6, 0x8D, 0xBB, 0x43, 0xE6,
+	0x8E, 0x83, 0x43, 0xE6, 0x8E, 0xA0, 0x43, 0xE6,
+	0x8E, 0xA9, 0x43, 0xE6, 0x8F, 0x84, 0x43, 0xE6,
+	0x8F, 0x85, 0x43, 0xE6, 0x8F, 0xA4, 0x43, 0xE6,
+	0x90, 0x9C, 0x43, 0xE6, 0x90, 0xA2, 0x43, 0xE6,
+	0x91, 0x92, 0x43, 0xE6, 0x91, 0xA9, 0x43, 0xE6,
+	0x91, 0xB7, 0x43, 0xE6, 0x91, 0xBE, 0x43, 0xE6,
+	// Bytes d80 - dbf
+	0x92, 0x9A, 0x43, 0xE6, 0x92, 0x9D, 0x43, 0xE6,
+	0x93, 0x84, 0x43, 0xE6, 0x94, 0xAF, 0x43, 0xE6,
+	0x94, 0xB4, 0x43, 0xE6, 0x95, 0x8F, 0x43, 0xE6,
+	0x95, 0x96, 0x43, 0xE6, 0x95, 0xAC, 0x43, 0xE6,
+	0x95, 0xB8, 0x43, 0xE6, 0x96, 0x87, 0x43, 0xE6,
+	0x96, 0x97, 0x43, 0xE6, 0x96, 0x99, 0x43, 0xE6,
+	0x96, 0xA4, 0x43, 0xE6, 0x96, 0xB0, 0x43, 0xE6,
+	0x96, 0xB9, 0x43, 0xE6, 0x97, 0x85, 0x43, 0xE6,
+	// Bytes dc0 - dff
+	0x97, 0xA0, 0x43, 0xE6, 0x97, 0xA2, 0x43, 0xE6,
+	0x97, 0xA3, 0x43, 0xE6, 0x97, 0xA5, 0x43, 0xE6,
+	0x98, 0x93, 0x43, 0xE6, 0x98, 0xA0, 0x43, 0xE6,
+	0x99, 0x89, 0x43, 0xE6, 0x99, 0xB4, 0x43, 0xE6,
+	0x9A, 0x88, 0x43, 0xE6, 0x9A, 0x91, 0x43, 0xE6,
+	0x9A, 0x9C, 0x43, 0xE6, 0x9A, 0xB4, 0x43, 0xE6,
+	0x9B, 0x86, 0x43, 0xE6, 0x9B, 0xB0, 0x43, 0xE6,
+	0x9B, 0xB4, 0x43, 0xE6, 0x9B, 0xB8, 0x43, 0xE6,
+	// Bytes e00 - e3f
+	0x9C, 0x80, 0x43, 0xE6, 0x9C, 0x88, 0x43, 0xE6,
+	0x9C, 0x89, 0x43, 0xE6, 0x9C, 0x97, 0x43, 0xE6,
+	0x9C, 0x9B, 0x43, 0xE6, 0x9C, 0xA1, 0x43, 0xE6,
+	0x9C, 0xA8, 0x43, 0xE6, 0x9D, 0x8E, 0x43, 0xE6,
+	0x9D, 0x93, 0x43, 0xE6, 0x9D, 0x96, 0x43, 0xE6,
+	0x9D, 0x9E, 0x43, 0xE6, 0x9D, 0xBB, 0x43, 0xE6,
+	0x9E, 0x85, 0x43, 0xE6, 0x9E, 0x97, 0x43, 0xE6,
+	0x9F, 0xB3, 0x43, 0xE6, 0x9F, 0xBA, 0x43, 0xE6,
+	// Bytes e40 - e7f
+	0xA0, 0x97, 0x43, 0xE6, 0xA0, 0x9F, 0x43, 0xE6,
+	0xA0, 0xAA, 0x43, 0xE6, 0xA1, 0x92, 0x43, 0xE6,
+	0xA2, 0x81, 0x43, 0xE6, 0xA2, 0x85, 0x43, 0xE6,
+	0xA2, 0x8E, 0x43, 0xE6, 0xA2, 0xA8, 0x43, 0xE6,
+	0xA4, 0x94, 0x43, 0xE6, 0xA5, 0x82, 0x43, 0xE6,
+	0xA6, 0xA3, 0x43, 0xE6, 0xA7, 0xAA, 0x43, 0xE6,
+	0xA8, 0x82, 0x43, 0xE6, 0xA8, 0x93, 0x43, 0xE6,
+	0xAA, 0xA8, 0x43, 0xE6, 0xAB, 0x93, 0x43, 0xE6,
+	// Bytes e80 - ebf
+	0xAB, 0x9B, 0x43, 0xE6, 0xAC, 0x84, 0x43, 0xE6,
+	0xAC, 0xA0, 0x43, 0xE6, 0xAC, 0xA1, 0x43, 0xE6,
+	0xAD, 0x94, 0x43, 0xE6, 0xAD, 0xA2, 0x43, 0xE6,
+	0xAD, 0xA3, 0x43, 0xE6, 0xAD, 0xB2, 0x43, 0xE6,
+	0xAD, 0xB7, 0x43, 0xE6, 0xAD, 0xB9, 0x43, 0xE6,
+	0xAE, 0x9F, 0x43, 0xE6, 0xAE, 0xAE, 0x43, 0xE6,
+	0xAE, 0xB3, 0x43, 0xE6, 0xAE, 0xBA, 0x43, 0xE6,
+	0xAE, 0xBB, 0x43, 0xE6, 0xAF, 0x8B, 0x43, 0xE6,
+	// Bytes ec0 - eff
+	0xAF, 0x8D, 0x43, 0xE6, 0xAF, 0x94, 0x43, 0xE6,
+	0xAF, 0x9B, 0x43, 0xE6, 0xB0, 0x8F, 0x43, 0xE6,
+	0xB0, 0x94, 0x43, 0xE6, 0xB0, 0xB4, 0x43, 0xE6,
+	0xB1, 0x8E, 0x43, 0xE6, 0xB1, 0xA7, 0x43, 0xE6,
+	0xB2, 0x88, 0x43, 0xE6, 0xB2, 0xBF, 0x43, 0xE6,
+	0xB3, 0x8C, 0x43, 0xE6, 0xB3, 0x8D, 0x43, 0xE6,
+	0xB3, 0xA5, 0x43, 0xE6, 0xB3, 0xA8, 0x43, 0xE6,
+	0xB4, 0x96, 0x43, 0xE6, 0xB4, 0x9B, 0x43, 0xE6,
+	// Bytes f00 - f3f
+	0xB4, 0x9E, 0x43, 0xE6, 0xB4, 0xB4, 0x43, 0xE6,
+	0xB4, 0xBE, 0x43, 0xE6, 0xB5, 0x81, 0x43, 0xE6,
+	0xB5, 0xA9, 0x43, 0xE6, 0xB5, 0xAA, 0x43, 0xE6,
+	0xB5, 0xB7, 0x43, 0xE6, 0xB5, 0xB8, 0x43, 0xE6,
+	0xB6, 0x85, 0x43, 0xE6, 0xB7, 0x8B, 0x43, 0xE6,
+	0xB7, 0x9A, 0x43, 0xE6, 0xB7, 0xAA, 0x43, 0xE6,
+	0xB7, 0xB9, 0x43, 0xE6, 0xB8, 0x9A, 0x43, 0xE6,
+	0xB8, 0xAF, 0x43, 0xE6, 0xB9, 0xAE, 0x43, 0xE6,
+	// Bytes f40 - f7f
+	0xBA, 0x80, 0x43, 0xE6, 0xBA, 0x9C, 0x43, 0xE6,
+	0xBA, 0xBA, 0x43, 0xE6, 0xBB, 0x87, 0x43, 0xE6,
+	0xBB, 0x8B, 0x43, 0xE6, 0xBB, 0x91, 0x43, 0xE6,
+	0xBB, 0x9B, 0x43, 0xE6, 0xBC, 0x8F, 0x43, 0xE6,
+	0xBC, 0x94, 0x43, 0xE6, 0xBC, 0xA2, 0x43, 0xE6,
+	0xBC, 0xA3, 0x43, 0xE6, 0xBD, 0xAE, 0x43, 0xE6,
+	0xBF, 0x86, 0x43, 0xE6, 0xBF, 0xAB, 0x43, 0xE6,
+	0xBF, 0xBE, 0x43, 0xE7, 0x80, 0x9B, 0x43, 0xE7,
+	// Bytes f80 - fbf
+	0x80, 0x9E, 0x43, 0xE7, 0x80, 0xB9, 0x43, 0xE7,
+	0x81, 0x8A, 0x43, 0xE7, 0x81, 0xAB, 0x43, 0xE7,
+	0x81, 0xB0, 0x43, 0xE7, 0x81, 0xB7, 0x43, 0xE7,
+	0x81, 0xBD, 0x43, 0xE7, 0x82, 0x99, 0x43, 0xE7,
+	0x82, 0xAD, 0x43, 0xE7, 0x83, 0x88, 0x43, 0xE7,
+	0x83, 0x99, 0x43, 0xE7, 0x84, 0xA1, 0x43, 0xE7,
+	0x85, 0x85, 0x43, 0xE7, 0x85, 0x89, 0x43, 0xE7,
+	0x85, 0xAE, 0x43, 0xE7, 0x86, 0x9C, 0x43, 0xE7,
+	// Bytes fc0 - fff
+	0x87, 0x8E, 0x43, 0xE7, 0x87, 0x90, 0x43, 0xE7,
+	0x88, 0x90, 0x43, 0xE7, 0x88, 0x9B, 0x43, 0xE7,
+	0x88, 0xA8, 0x43, 0xE7, 0x88, 0xAA, 0x43, 0xE7,
+	0x88, 0xAB, 0x43, 0xE7, 0x88, 0xB5, 0x43, 0xE7,
+	0x88, 0xB6, 0x43, 0xE7, 0x88, 0xBB, 0x43, 0xE7,
+	0x88, 0xBF, 0x43, 0xE7, 0x89, 0x87, 0x43, 0xE7,
+	0x89, 0x90, 0x43, 0xE7, 0x89, 0x99, 0x43, 0xE7,
+	0x89, 0x9B, 0x43, 0xE7, 0x89, 0xA2, 0x43, 0xE7,
+	// Bytes 1000 - 103f
+	0x89, 0xB9, 0x43, 0xE7, 0x8A, 0x80, 0x43, 0xE7,
+	0x8A, 0x95, 0x43, 0xE7, 0x8A, 0xAC, 0x43, 0xE7,
+	0x8A, 0xAF, 0x43, 0xE7, 0x8B, 0x80, 0x43, 0xE7,
+	0x8B, 0xBC, 0x43, 0xE7, 0x8C, 0xAA, 0x43, 0xE7,
+	0x8D, 0xB5, 0x43, 0xE7, 0x8D, 0xBA, 0x43, 0xE7,
+	0x8E, 0x84, 0x43, 0xE7, 0x8E, 0x87, 0x43, 0xE7,
+	0x8E, 0x89, 0x43, 0xE7, 0x8E, 0x8B, 0x43, 0xE7,
+	0x8E, 0xA5, 0x43, 0xE7, 0x8E, 0xB2, 0x43, 0xE7,
+	// Bytes 1040 - 107f
+	0x8F, 0x9E, 0x43, 0xE7, 0x90, 0x86, 0x43, 0xE7,
+	0x90, 0x89, 0x43, 0xE7, 0x90, 0xA2, 0x43, 0xE7,
+	0x91, 0x87, 0x43, 0xE7, 0x91, 0x9C, 0x43, 0xE7,
+	0x91, 0xA9, 0x43, 0xE7, 0x91, 0xB1, 0x43, 0xE7,
+	0x92, 0x85, 0x43, 0xE7, 0x92, 0x89, 0x43, 0xE7,
+	0x92, 0x98, 0x43, 0xE7, 0x93, 0x8A, 0x43, 0xE7,
+	0x93, 0x9C, 0x43, 0xE7, 0x93, 0xA6, 0x43, 0xE7,
+	0x94, 0x86, 0x43, 0xE7, 0x94, 0x98, 0x43, 0xE7,
+	// Bytes 1080 - 10bf
+	0x94, 0x9F, 0x43, 0xE7, 0x94, 0xA4, 0x43, 0xE7,
+	0x94, 0xA8, 0x43, 0xE7, 0x94, 0xB0, 0x43, 0xE7,
+	0x94, 0xB2, 0x43, 0xE7, 0x94, 0xB3, 0x43, 0xE7,
+	0x94, 0xB7, 0x43, 0xE7, 0x94, 0xBB, 0x43, 0xE7,
+	0x94, 0xBE, 0x43, 0xE7, 0x95, 0x99, 0x43, 0xE7,
+	0x95, 0xA5, 0x43, 0xE7, 0x95, 0xB0, 0x43, 0xE7,
+	0x96, 0x8B, 0x43, 0xE7, 0x96, 0x92, 0x43, 0xE7,
+	0x97, 0xA2, 0x43, 0xE7, 0x98, 0x90, 0x43, 0xE7,
+	// Bytes 10c0 - 10ff
+	0x98, 0x9D, 0x43, 0xE7, 0x98, 0x9F, 0x43, 0xE7,
+	0x99, 0x82, 0x43, 0xE7, 0x99, 0xA9, 0x43, 0xE7,
+	0x99, 0xB6, 0x43, 0xE7, 0x99, 0xBD, 0x43, 0xE7,
+	0x9A, 0xAE, 0x43, 0xE7, 0x9A, 0xBF, 0x43, 0xE7,
+	0x9B, 0x8A, 0x43, 0xE7, 0x9B, 0x9B, 0x43, 0xE7,
+	0x9B, 0xA3, 0x43, 0xE7, 0x9B, 0xA7, 0x43, 0xE7,
+	0x9B, 0xAE, 0x43, 0xE7, 0x9B, 0xB4, 0x43, 0xE7,
+	0x9C, 0x81, 0x43, 0xE7, 0x9C, 0x9E, 0x43, 0xE7,
+	// Bytes 1100 - 113f
+	0x9C, 0x9F, 0x43, 0xE7, 0x9D, 0x80, 0x43, 0xE7,
+	0x9D, 0x8A, 0x43, 0xE7, 0x9E, 0x8B, 0x43, 0xE7,
+	0x9E, 0xA7, 0x43, 0xE7, 0x9F, 0x9B, 0x43, 0xE7,
+	0x9F, 0xA2, 0x43, 0xE7, 0x9F, 0xB3, 0x43, 0xE7,
+	0xA1, 0x8E, 0x43, 0xE7, 0xA1, 0xAB, 0x43, 0xE7,
+	0xA2, 0x8C, 0x43, 0xE7, 0xA2, 0x91, 0x43, 0xE7,
+	0xA3, 0x8A, 0x43, 0xE7, 0xA3, 0x8C, 0x43, 0xE7,
+	0xA3, 0xBB, 0x43, 0xE7, 0xA4, 0xAA, 0x43, 0xE7,
+	// Bytes 1140 - 117f
+	0xA4, 0xBA, 0x43, 0xE7, 0xA4, 0xBC, 0x43, 0xE7,
+	0xA4, 0xBE, 0x43, 0xE7, 0xA5, 0x88, 0x43, 0xE7,
+	0xA5, 0x89, 0x43, 0xE7, 0xA5, 0x90, 0x43, 0xE7,
+	0xA5, 0x96, 0x43, 0xE7, 0xA5, 0x9D, 0x43, 0xE7,
+	0xA5, 0x9E, 0x43, 0xE7, 0xA5, 0xA5, 0x43, 0xE7,
+	0xA5, 0xBF, 0x43, 0xE7, 0xA6, 0x81, 0x43, 0xE7,
+	0xA6, 0x8D, 0x43, 0xE7, 0xA6, 0x8E, 0x43, 0xE7,
+	0xA6, 0x8F, 0x43, 0xE7, 0xA6, 0xAE, 0x43, 0xE7,
+	// Bytes 1180 - 11bf
+	0xA6, 0xB8, 0x43, 0xE7, 0xA6, 0xBE, 0x43, 0xE7,
+	0xA7, 0x8A, 0x43, 0xE7, 0xA7, 0x98, 0x43, 0xE7,
+	0xA7, 0xAB, 0x43, 0xE7, 0xA8, 0x9C, 0x43, 0xE7,
+	0xA9, 0x80, 0x43, 0xE7, 0xA9, 0x8A, 0x43, 0xE7,
+	0xA9, 0x8F, 0x43, 0xE7, 0xA9, 0xB4, 0x43, 0xE7,
+	0xA9, 0xBA, 0x43, 0xE7, 0xAA, 0x81, 0x43, 0xE7,
+	0xAA, 0xB1, 0x43, 0xE7, 0xAB, 0x8B, 0x43, 0xE7,
+	0xAB, 0xAE, 0x43, 0xE7, 0xAB, 0xB9, 0x43, 0xE7,
+	// Bytes 11c0 - 11ff
+	0xAC, 0xA0, 0x43, 0xE7, 0xAE, 0x8F, 0x43, 0xE7,
+	0xAF, 0x80, 0x43, 0xE7, 0xAF, 0x86, 0x43, 0xE7,
+	0xAF, 0x89, 0x43, 0xE7, 0xB0, 0xBE, 0x43, 0xE7,
+	0xB1, 0xA0, 0x43, 0xE7, 0xB1, 0xB3, 0x43, 0xE7,
+	0xB1, 0xBB, 0x43, 0xE7, 0xB2, 0x92, 0x43, 0xE7,
+	0xB2, 0xBE, 0x43, 0xE7, 0xB3, 0x92, 0x43, 0xE7,
+	0xB3, 0x96, 0x43, 0xE7, 0xB3, 0xA3, 0x43, 0xE7,
+	0xB3, 0xA7, 0x43, 0xE7, 0xB3, 0xA8, 0x43, 0xE7,
+	// Bytes 1200 - 123f
+	0xB3, 0xB8, 0x43, 0xE7, 0xB4, 0x80, 0x43, 0xE7,
+	0xB4, 0x90, 0x43, 0xE7, 0xB4, 0xA2, 0x43, 0xE7,
+	0xB4, 0xAF, 0x43, 0xE7, 0xB5, 0x82, 0x43, 0xE7,
+	0xB5, 0x9B, 0x43, 0xE7, 0xB5, 0xA3, 0x43, 0xE7,
+	0xB6, 0xA0, 0x43, 0xE7, 0xB6, 0xBE, 0x43, 0xE7,
+	0xB7, 0x87, 0x43, 0xE7, 0xB7, 0xB4, 0x43, 0xE7,
+	0xB8, 0x82, 0x43, 0xE7, 0xB8, 0x89, 0x43, 0xE7,
+	0xB8, 0xB7, 0x43, 0xE7, 0xB9, 0x81, 0x43, 0xE7,
+	// Bytes 1240 - 127f
+	0xB9, 0x85, 0x43, 0xE7, 0xBC, 0xB6, 0x43, 0xE7,
+	0xBC, 0xBE, 0x43, 0xE7, 0xBD, 0x91, 0x43, 0xE7,
+	0xBD, 0xB2, 0x43, 0xE7, 0xBD, 0xB9, 0x43, 0xE7,
+	0xBD, 0xBA, 0x43, 0xE7, 0xBE, 0x85, 0x43, 0xE7,
+	0xBE, 0x8A, 0x43, 0xE7, 0xBE, 0x95, 0x43, 0xE7,
+	0xBE, 0x9A, 0x43, 0xE7, 0xBE, 0xBD, 0x43, 0xE7,
+	0xBF, 0xBA, 0x43, 0xE8, 0x80, 0x81, 0x43, 0xE8,
+	0x80, 0x85, 0x43, 0xE8, 0x80, 0x8C, 0x43, 0xE8,
+	// Bytes 1280 - 12bf
+	0x80, 0x92, 0x43, 0xE8, 0x80, 0xB3, 0x43, 0xE8,
+	0x81, 0x86, 0x43, 0xE8, 0x81, 0xA0, 0x43, 0xE8,
+	0x81, 0xAF, 0x43, 0xE8, 0x81, 0xB0, 0x43, 0xE8,
+	0x81, 0xBE, 0x43, 0xE8, 0x81, 0xBF, 0x43, 0xE8,
+	0x82, 0x89, 0x43, 0xE8, 0x82, 0x8B, 0x43, 0xE8,
+	0x82, 0xAD, 0x43, 0xE8, 0x82, 0xB2, 0x43, 0xE8,
+	0x84, 0x83, 0x43, 0xE8, 0x84, 0xBE, 0x43, 0xE8,
+	0x87, 0x98, 0x43, 0xE8, 0x87, 0xA3, 0x43, 0xE8,
+	// Bytes 12c0 - 12ff
+	0x87, 0xA8, 0x43, 0xE8, 0x87, 0xAA, 0x43, 0xE8,
+	0x87, 0xAD, 0x43, 0xE8, 0x87, 0xB3, 0x43, 0xE8,
+	0x87, 0xBC, 0x43, 0xE8, 0x88, 0x81, 0x43, 0xE8,
+	0x88, 0x84, 0x43, 0xE8, 0x88, 0x8C, 0x43, 0xE8,
+	0x88, 0x98, 0x43, 0xE8, 0x88, 0x9B, 0x43, 0xE8,
+	0x88, 0x9F, 0x43, 0xE8, 0x89, 0xAE, 0x43, 0xE8,
+	0x89, 0xAF, 0x43, 0xE8, 0x89, 0xB2, 0x43, 0xE8,
+	0x89, 0xB8, 0x43, 0xE8, 0x89, 0xB9, 0x43, 0xE8,
+	// Bytes 1300 - 133f
+	0x8A, 0x8B, 0x43, 0xE8, 0x8A, 0x91, 0x43, 0xE8,
+	0x8A, 0x9D, 0x43, 0xE8, 0x8A, 0xB1, 0x43, 0xE8,
+	0x8A, 0xB3, 0x43, 0xE8, 0x8A, 0xBD, 0x43, 0xE8,
+	0x8B, 0xA5, 0x43, 0xE8, 0x8B, 0xA6, 0x43, 0xE8,
+	0x8C, 0x9D, 0x43, 0xE8, 0x8C, 0xA3, 0x43, 0xE8,
+	0x8C, 0xB6, 0x43, 0xE8, 0x8D, 0x92, 0x43, 0xE8,
+	0x8D, 0x93, 0x43, 0xE8, 0x8D, 0xA3, 0x43, 0xE8,
+	0x8E, 0xAD, 0x43, 0xE8, 0x8E, 0xBD, 0x43, 0xE8,
+	// Bytes 1340 - 137f
+	0x8F, 0x89, 0x43, 0xE8, 0x8F, 0x8A, 0x43, 0xE8,
+	0x8F, 0x8C, 0x43, 0xE8, 0x8F, 0x9C, 0x43, 0xE8,
+	0x8F, 0xA7, 0x43, 0xE8, 0x8F, 0xAF, 0x43, 0xE8,
+	0x8F, 0xB1, 0x43, 0xE8, 0x90, 0xBD, 0x43, 0xE8,
+	0x91, 0x89, 0x43, 0xE8, 0x91, 0x97, 0x43, 0xE8,
+	0x93, 0xAE, 0x43, 0xE8, 0x93, 0xB1, 0x43, 0xE8,
+	0x93, 0xB3, 0x43, 0xE8, 0x93, 0xBC, 0x43, 0xE8,
+	0x94, 0x96, 0x43, 0xE8, 0x95, 0xA4, 0x43, 0xE8,
+	// Bytes 1380 - 13bf
+	0x97, 0x8D, 0x43, 0xE8, 0x97, 0xBA, 0x43, 0xE8,
+	0x98, 0x86, 0x43, 0xE8, 0x98, 0x92, 0x43, 0xE8,
+	0x98, 0xAD, 0x43, 0xE8, 0x98, 0xBF, 0x43, 0xE8,
+	0x99, 0x8D, 0x43, 0xE8, 0x99, 0x90, 0x43, 0xE8,
+	0x99, 0x9C, 0x43, 0xE8, 0x99, 0xA7, 0x43, 0xE8,
+	0x99, 0xA9, 0x43, 0xE8, 0x99, 0xAB, 0x43, 0xE8,
+	0x9A, 0x88, 0x43, 0xE8, 0x9A, 0xA9, 0x43, 0xE8,
+	0x9B, 0xA2, 0x43, 0xE8, 0x9C, 0x8E, 0x43, 0xE8,
+	// Bytes 13c0 - 13ff
+	0x9C, 0xA8, 0x43, 0xE8, 0x9D, 0xAB, 0x43, 0xE8,
+	0x9D, 0xB9, 0x43, 0xE8, 0x9E, 0x86, 0x43, 0xE8,
+	0x9E, 0xBA, 0x43, 0xE8, 0x9F, 0xA1, 0x43, 0xE8,
+	0xA0, 0x81, 0x43, 0xE8, 0xA0, 0x9F, 0x43, 0xE8,
+	0xA1, 0x80, 0x43, 0xE8, 0xA1, 0x8C, 0x43, 0xE8,
+	0xA1, 0xA0, 0x43, 0xE8, 0xA1, 0xA3, 0x43, 0xE8,
+	0xA3, 0x82, 0x43, 0xE8, 0xA3, 0x8F, 0x43, 0xE8,
+	0xA3, 0x97, 0x43, 0xE8, 0xA3, 0x9E, 0x43, 0xE8,
+	// Bytes 1400 - 143f
+	0xA3, 0xA1, 0x43, 0xE8, 0xA3, 0xB8, 0x43, 0xE8,
+	0xA3, 0xBA, 0x43, 0xE8, 0xA4, 0x90, 0x43, 0xE8,
+	0xA5, 0x81, 0x43, 0xE8, 0xA5, 0xA4, 0x43, 0xE8,
+	0xA5, 0xBE, 0x43, 0xE8, 0xA6, 0x86, 0x43, 0xE8,
+	0xA6, 0x8B, 0x43, 0xE8, 0xA6, 0x96, 0x43, 0xE8,
+	0xA7, 0x92, 0x43, 0xE8, 0xA7, 0xA3, 0x43, 0xE8,
+	0xA8, 0x80, 0x43, 0xE8, 0xAA, 0xA0, 0x43, 0xE8,
+	0xAA, 0xAA, 0x43, 0xE8, 0xAA, 0xBF, 0x43, 0xE8,
+	// Bytes 1440 - 147f
+	0xAB, 0x8B, 0x43, 0xE8, 0xAB, 0x92, 0x43, 0xE8,
+	0xAB, 0x96, 0x43, 0xE8, 0xAB, 0xAD, 0x43, 0xE8,
+	0xAB, 0xB8, 0x43, 0xE8, 0xAB, 0xBE, 0x43, 0xE8,
+	0xAC, 0x81, 0x43, 0xE8, 0xAC, 0xB9, 0x43, 0xE8,
+	0xAD, 0x98, 0x43, 0xE8, 0xAE, 0x80, 0x43, 0xE8,
+	0xAE, 0x8A, 0x43, 0xE8, 0xB0, 0xB7, 0x43, 0xE8,
+	0xB1, 0x86, 0x43, 0xE8, 0xB1, 0x88, 0x43, 0xE8,
+	0xB1, 0x95, 0x43, 0xE8, 0xB1, 0xB8, 0x43, 0xE8,
+	// Bytes 1480 - 14bf
+	0xB2, 0x9D, 0x43, 0xE8, 0xB2, 0xA1, 0x43, 0xE8,
+	0xB2, 0xA9, 0x43, 0xE8, 0xB2, 0xAB, 0x43, 0xE8,
+	0xB3, 0x81, 0x43, 0xE8, 0xB3, 0x82, 0x43, 0xE8,
+	0xB3, 0x87, 0x43, 0xE8, 0xB3, 0x88, 0x43, 0xE8,
+	0xB3, 0x93, 0x43, 0xE8, 0xB4, 0x88, 0x43, 0xE8,
+	0xB4, 0x9B, 0x43, 0xE8, 0xB5, 0xA4, 0x43, 0xE8,
+	0xB5, 0xB0, 0x43, 0xE8, 0xB5, 0xB7, 0x43, 0xE8,
+	0xB6, 0xB3, 0x43, 0xE8, 0xB6, 0xBC, 0x43, 0xE8,
+	// Bytes 14c0 - 14ff
+	0xB7, 0x8B, 0x43, 0xE8, 0xB7, 0xAF, 0x43, 0xE8,
+	0xB7, 0xB0, 0x43, 0xE8, 0xBA, 0xAB, 0x43, 0xE8,
+	0xBB, 0x8A, 0x43, 0xE8, 0xBB, 0x94, 0x43, 0xE8,
+	0xBC, 0xA6, 0x43, 0xE8, 0xBC, 0xAA, 0x43, 0xE8,
+	0xBC, 0xB8, 0x43, 0xE8, 0xBC, 0xBB, 0x43, 0xE8,
+	0xBD, 0xA2, 0x43, 0xE8, 0xBE, 0x9B, 0x43, 0xE8,
+	0xBE, 0x9E, 0x43, 0xE8, 0xBE, 0xB0, 0x43, 0xE8,
+	0xBE, 0xB5, 0x43, 0xE8, 0xBE, 0xB6, 0x43, 0xE9,
+	// Bytes 1500 - 153f
+	0x80, 0xA3, 0x43, 0xE9, 0x80, 0xB8, 0x43, 0xE9,
+	0x81, 0x8A, 0x43, 0xE9, 0x81, 0xA9, 0x43, 0xE9,
+	0x81, 0xB2, 0x43, 0xE9, 0x81, 0xBC, 0x43, 0xE9,
+	0x82, 0x8F, 0x43, 0xE9, 0x82, 0x91, 0x43, 0xE9,
+	0x82, 0x94, 0x43, 0xE9, 0x83, 0x8E, 0x43, 0xE9,
+	0x83, 0x9E, 0x43, 0xE9, 0x83, 0xB1, 0x43, 0xE9,
+	0x83, 0xBD, 0x43, 0xE9, 0x84, 0x91, 0x43, 0xE9,
+	0x84, 0x9B, 0x43, 0xE9, 0x85, 0x89, 0x43, 0xE9,
+	// Bytes 1540 - 157f
+	0x85, 0x8D, 0x43, 0xE9, 0x85, 0xAA, 0x43, 0xE9,
+	0x86, 0x99, 0x43, 0xE9, 0x86, 0xB4, 0x43, 0xE9,
+	0x87, 0x86, 0x43, 0xE9, 0x87, 0x8C, 0x43, 0xE9,
+	0x87, 0x8F, 0x43, 0xE9, 0x87, 0x91, 0x43, 0xE9,
+	0x88, 0xB4, 0x43, 0xE9, 0x88, 0xB8, 0x43, 0xE9,
+	0x89, 0xB6, 0x43, 0xE9, 0x89, 0xBC, 0x43, 0xE9,
+	0x8B, 0x97, 0x43, 0xE9, 0x8B, 0x98, 0x43, 0xE9,
+	0x8C, 0x84, 0x43, 0xE9, 0x8D, 0x8A, 0x43, 0xE9,
+	// Bytes 1580 - 15bf
+	0x8F, 0xB9, 0x43, 0xE9, 0x90, 0x95, 0x43, 0xE9,
+	0x95, 0xB7, 0x43, 0xE9, 0x96, 0x80, 0x43, 0xE9,
+	0x96, 0x8B, 0x43, 0xE9, 0x96, 0xAD, 0x43, 0xE9,
+	0x96, 0xB7, 0x43, 0xE9, 0x98, 0x9C, 0x43, 0xE9,
+	0x98, 0xAE, 0x43, 0xE9, 0x99, 0x8B, 0x43, 0xE9,
+	0x99, 0x8D, 0x43, 0xE9, 0x99, 0xB5, 0x43, 0xE9,
+	0x99, 0xB8, 0x43, 0xE9, 0x99, 0xBC, 0x43, 0xE9,
+	0x9A, 0x86, 0x43, 0xE9, 0x9A, 0xA3, 0x43, 0xE9,
+	// Bytes 15c0 - 15ff
+	0x9A, 0xB6, 0x43, 0xE9, 0x9A, 0xB7, 0x43, 0xE9,
+	0x9A, 0xB8, 0x43, 0xE9, 0x9A, 0xB9, 0x43, 0xE9,
+	0x9B, 0x83, 0x43, 0xE9, 0x9B, 0xA2, 0x43, 0xE9,
+	0x9B, 0xA3, 0x43, 0xE9, 0x9B, 0xA8, 0x43, 0xE9,
+	0x9B, 0xB6, 0x43, 0xE9, 0x9B, 0xB7, 0x43, 0xE9,
+	0x9C, 0xA3, 0x43, 0xE9, 0x9C, 0xB2, 0x43, 0xE9,
+	0x9D, 0x88, 0x43, 0xE9, 0x9D, 0x91, 0x43, 0xE9,
+	0x9D, 0x96, 0x43, 0xE9, 0x9D, 0x9E, 0x43, 0xE9,
+	// Bytes 1600 - 163f
+	0x9D, 0xA2, 0x43, 0xE9, 0x9D, 0xA9, 0x43, 0xE9,
+	0x9F, 0x8B, 0x43, 0xE9, 0x9F, 0x9B, 0x43, 0xE9,
+	0x9F, 0xA0, 0x43, 0xE9, 0x9F, 0xAD, 0x43, 0xE9,
+	0x9F, 0xB3, 0x43, 0xE9, 0x9F, 0xBF, 0x43, 0xE9,
+	0xA0, 0x81, 0x43, 0xE9, 0xA0, 0x85, 0x43, 0xE9,
+	0xA0, 0x8B, 0x43, 0xE9, 0xA0, 0x98, 0x43, 0xE9,
+	0xA0, 0xA9, 0x43, 0xE9, 0xA0, 0xBB, 0x43, 0xE9,
+	0xA1, 0x9E, 0x43, 0xE9, 0xA2, 0xA8, 0x43, 0xE9,
+	// Bytes 1640 - 167f
+	0xA3, 0x9B, 0x43, 0xE9, 0xA3, 0x9F, 0x43, 0xE9,
+	0xA3, 0xA2, 0x43, 0xE9, 0xA3, 0xAF, 0x43, 0xE9,
+	0xA3, 0xBC, 0x43, 0xE9, 0xA4, 0xA8, 0x43, 0xE9,
+	0xA4, 0xA9, 0x43, 0xE9, 0xA6, 0x96, 0x43, 0xE9,
+	0xA6, 0x99, 0x43, 0xE9, 0xA6, 0xA7, 0x43, 0xE9,
+	0xA6, 0xAC, 0x43, 0xE9, 0xA7, 0x82, 0x43, 0xE9,
+	0xA7, 0xB1, 0x43, 0xE9, 0xA7, 0xBE, 0x43, 0xE9,
+	0xA9, 0xAA, 0x43, 0xE9, 0xAA, 0xA8, 0x43, 0xE9,
+	// Bytes 1680 - 16bf
+	0xAB, 0x98, 0x43, 0xE9, 0xAB, 0x9F, 0x43, 0xE9,
+	0xAC, 0x92, 0x43, 0xE9, 0xAC, 0xA5, 0x43, 0xE9,
+	0xAC, 0xAF, 0x43, 0xE9, 0xAC, 0xB2, 0x43, 0xE9,
+	0xAC, 0xBC, 0x43, 0xE9, 0xAD, 0x9A, 0x43, 0xE9,
+	0xAD, 0xAF, 0x43, 0xE9, 0xB1, 0x80, 0x43, 0xE9,
+	0xB1, 0x97, 0x43, 0xE9, 0xB3, 0xA5, 0x43, 0xE9,
+	0xB3, 0xBD, 0x43, 0xE9, 0xB5, 0xA7, 0x43, 0xE9,
+	0xB6, 0xB4, 0x43, 0xE9, 0xB7, 0xBA, 0x43, 0xE9,
+	// Bytes 16c0 - 16ff
+	0xB8, 0x9E, 0x43, 0xE9, 0xB9, 0xB5, 0x43, 0xE9,
+	0xB9, 0xBF, 0x43, 0xE9, 0xBA, 0x97, 0x43, 0xE9,
+	0xBA, 0x9F, 0x43, 0xE9, 0xBA, 0xA5, 0x43, 0xE9,
+	0xBA, 0xBB, 0x43, 0xE9, 0xBB, 0x83, 0x43, 0xE9,
+	0xBB, 0x8D, 0x43, 0xE9, 0xBB, 0x8E, 0x43, 0xE9,
+	0xBB, 0x91, 0x43, 0xE9, 0xBB, 0xB9, 0x43, 0xE9,
+	0xBB, 0xBD, 0x43, 0xE9, 0xBB, 0xBE, 0x43, 0xE9,
+	0xBC, 0x85, 0x43, 0xE9, 0xBC, 0x8E, 0x43, 0xE9,
+	// Bytes 1700 - 173f
+	0xBC, 0x8F, 0x43, 0xE9, 0xBC, 0x93, 0x43, 0xE9,
+	0xBC, 0x96, 0x43, 0xE9, 0xBC, 0xA0, 0x43, 0xE9,
+	0xBC, 0xBB, 0x43, 0xE9, 0xBD, 0x83, 0x43, 0xE9,
+	0xBD, 0x8A, 0x43, 0xE9, 0xBD, 0x92, 0x43, 0xE9,
+	0xBE, 0x8D, 0x43, 0xE9, 0xBE, 0x8E, 0x43, 0xE9,
+	0xBE, 0x9C, 0x43, 0xE9, 0xBE, 0x9F, 0x43, 0xE9,
+	0xBE, 0xA0, 0x43, 0xEA, 0x99, 0x91, 0x43, 0xEA,
+	0x9A, 0x89, 0x43, 0xEA, 0x9C, 0xA7, 0x43, 0xEA,
+	// Bytes 1740 - 177f
+	0x9D, 0xAF, 0x43, 0xEA, 0x9E, 0x8E, 0x43, 0xEA,
+	0xAC, 0xB7, 0x43, 0xEA, 0xAD, 0x92, 0x43, 0xEA,
+	0xAD, 0xA6, 0x43, 0xEA, 0xAD, 0xA7, 0x44, 0xF0,
+	0x9D, 0xBC, 0x84, 0x44, 0xF0, 0x9D, 0xBC, 0x85,
+	0x44, 0xF0, 0x9D, 0xBC, 0x86, 0x44, 0xF0, 0x9D,
+	0xBC, 0x88, 0x44, 0xF0, 0x9D, 0xBC, 0x8A, 0x44,
+	0xF0, 0x9D, 0xBC, 0x9E, 0x44, 0xF0, 0xA0, 0x84,
+	0xA2, 0x44, 0xF0, 0xA0, 0x94, 0x9C, 0x44, 0xF0,
+	// Bytes 1780 - 17bf
+	0xA0, 0x94, 0xA5, 0x44, 0xF0, 0xA0, 0x95, 0x8B,
+	0x44, 0xF0, 0xA0, 0x98, 0xBA, 0x44, 0xF0, 0xA0,
+	0xA0, 0x84, 0x44, 0xF0, 0xA0, 0xA3, 0x9E, 0x44,
+	0xF0, 0xA0, 0xA8, 0xAC, 0x44, 0xF0, 0xA0, 0xAD,
+	0xA3, 0x44, 0xF0, 0xA1, 0x93, 0xA4, 0x44, 0xF0,
+	0xA1, 0x9A, 0xA8, 0x44, 0xF0, 0xA1, 0x9B, 0xAA,
+	0x44, 0xF0, 0xA1, 0xA7, 0x88, 0x44, 0xF0, 0xA1,
+	0xAC, 0x98, 0x44, 0xF0, 0xA1, 0xB4, 0x8B, 0x44,
+	// Bytes 17c0 - 17ff
+	0xF0, 0xA1, 0xB7, 0xA4, 0x44, 0xF0, 0xA1, 0xB7,
+	0xA6, 0x44, 0xF0, 0xA2, 0x86, 0x83, 0x44, 0xF0,
+	0xA2, 0x86, 0x9F, 0x44, 0xF0, 0xA2, 0x8C, 0xB1,
+	0x44, 0xF0, 0xA2, 0x9B, 0x94, 0x44, 0xF0, 0xA2,
+	0xA1, 0x84, 0x44, 0xF0, 0xA2, 0xA1, 0x8A, 0x44,
+	0xF0, 0xA2, 0xAC, 0x8C, 0x44, 0xF0, 0xA2, 0xAF,
+	0xB1, 0x44, 0xF0, 0xA3, 0x80, 0x8A, 0x44, 0xF0,
+	0xA3, 0x8A, 0xB8, 0x44, 0xF0, 0xA3, 0x8D, 0x9F,
+	// Bytes 1800 - 183f
+	0x44, 0xF0, 0xA3, 0x8E, 0x93, 0x44, 0xF0, 0xA3,
+	0x8E, 0x9C, 0x44, 0xF0, 0xA3, 0x8F, 0x83, 0x44,
+	0xF0, 0xA3, 0x8F, 0x95, 0x44, 0xF0, 0xA3, 0x91,
+	0xAD, 0x44, 0xF0, 0xA3, 0x9A, 0xA3, 0x44, 0xF0,
+	0xA3, 0xA2, 0xA7, 0x44, 0xF0, 0xA3, 0xAA, 0x8D,
+	0x44, 0xF0, 0xA3, 0xAB, 0xBA, 0x44, 0xF0, 0xA3,
+	0xB2, 0xBC, 0x44, 0xF0, 0xA3, 0xB4, 0x9E, 0x44,
+	0xF0, 0xA3, 0xBB, 0x91, 0x44, 0xF0, 0xA3, 0xBD,
+	// Bytes 1840 - 187f
+	0x9E, 0x44, 0xF0, 0xA3, 0xBE, 0x8E, 0x44, 0xF0,
+	0xA4, 0x89, 0xA3, 0x44, 0xF0, 0xA4, 0x8B, 0xAE,
+	0x44, 0xF0, 0xA4, 0x8E, 0xAB, 0x44, 0xF0, 0xA4,
+	0x98, 0x88, 0x44, 0xF0, 0xA4, 0x9C, 0xB5, 0x44,
+	0xF0, 0xA4, 0xA0, 0x94, 0x44, 0xF0, 0xA4, 0xB0,
+	0xB6, 0x44, 0xF0, 0xA4, 0xB2, 0x92, 0x44, 0xF0,
+	0xA4, 0xBE, 0xA1, 0x44, 0xF0, 0xA4, 0xBE, 0xB8,
+	0x44, 0xF0, 0xA5, 0x81, 0x84, 0x44, 0xF0, 0xA5,
+	// Bytes 1880 - 18bf
+	0x83, 0xB2, 0x44, 0xF0, 0xA5, 0x83, 0xB3, 0x44,
+	0xF0, 0xA5, 0x84, 0x99, 0x44, 0xF0, 0xA5, 0x84,
+	0xB3, 0x44, 0xF0, 0xA5, 0x89, 0x89, 0x44, 0xF0,
+	0xA5, 0x90, 0x9D, 0x44, 0xF0, 0xA5, 0x98, 0xA6,
+	0x44, 0xF0, 0xA5, 0x9A, 0x9A, 0x44, 0xF0, 0xA5,
+	0x9B, 0x85, 0x44, 0xF0, 0xA5, 0xA5, 0xBC, 0x44,
+	0xF0, 0xA5, 0xAA, 0xA7, 0x44, 0xF0, 0xA5, 0xAE,
+	0xAB, 0x44, 0xF0, 0xA5, 0xB2, 0x80, 0x44, 0xF0,
+	// Bytes 18c0 - 18ff
+	0xA5, 0xB3, 0x90, 0x44, 0xF0, 0xA5, 0xBE, 0x86,
+	0x44, 0xF0, 0xA6, 0x87, 0x9A, 0x44, 0xF0, 0xA6,
+	0x88, 0xA8, 0x44, 0xF0, 0xA6, 0x89, 0x87, 0x44,
+	0xF0, 0xA6, 0x8B, 0x99, 0x44, 0xF0, 0xA6, 0x8C,
+	0xBE, 0x44, 0xF0, 0xA6, 0x93, 0x9A, 0x44, 0xF0,
+	0xA6, 0x94, 0xA3, 0x44, 0xF0, 0xA6, 0x96, 0xA8,
+	0x44, 0xF0, 0xA6, 0x9E, 0xA7, 0x44, 0xF0, 0xA6,
+	0x9E, 0xB5, 0x44, 0xF0, 0xA6, 0xAC, 0xBC, 0x44,
+	// Bytes 1900 - 193f
+	0xF0, 0xA6, 0xB0, 0xB6, 0x44, 0xF0, 0xA6, 0xB3,
+	0x95, 0x44, 0xF0, 0xA6, 0xB5, 0xAB, 0x44, 0xF0,
+	0xA6, 0xBC, 0xAC, 0x44, 0xF0, 0xA6, 0xBE, 0xB1,
+	0x44, 0xF0, 0xA7, 0x83, 0x92, 0x44, 0xF0, 0xA7,
+	0x8F, 0x8A, 0x44, 0xF0, 0xA7, 0x99, 0xA7, 0x44,
+	0xF0, 0xA7, 0xA2, 0xAE, 0x44, 0xF0, 0xA7, 0xA5,
+	0xA6, 0x44, 0xF0, 0xA7, 0xB2, 0xA8, 0x44, 0xF0,
+	0xA7, 0xBB, 0x93, 0x44, 0xF0, 0xA7, 0xBC, 0xAF,
+	// Bytes 1940 - 197f
+	0x44, 0xF0, 0xA8, 0x97, 0x92, 0x44, 0xF0, 0xA8,
+	0x97, 0xAD, 0x44, 0xF0, 0xA8, 0x9C, 0xAE, 0x44,
+	0xF0, 0xA8, 0xAF, 0xBA, 0x44, 0xF0, 0xA8, 0xB5,
+	0xB7, 0x44, 0xF0, 0xA9, 0x85, 0x85, 0x44, 0xF0,
+	0xA9, 0x87, 0x9F, 0x44, 0xF0, 0xA9, 0x88, 0x9A,
+	0x44, 0xF0, 0xA9, 0x90, 0x8A, 0x44, 0xF0, 0xA9,
+	0x92, 0x96, 0x44, 0xF0, 0xA9, 0x96, 0xB6, 0x44,
+	0xF0, 0xA9, 0xAC, 0xB0, 0x44, 0xF0, 0xAA, 0x83,
+	// Bytes 1980 - 19bf
+	0x8E, 0x44, 0xF0, 0xAA, 0x84, 0x85, 0x44, 0xF0,
+	0xAA, 0x88, 0x8E, 0x44, 0xF0, 0xAA, 0x8A, 0x91,
+	0x44, 0xF0, 0xAA, 0x8E, 0x92, 0x44, 0xF0, 0xAA,
+	0x98, 0x80, 0x42, 0x21, 0x21, 0x42, 0x21, 0x3F,
+	0x42, 0x2E, 0x2E, 0x42, 0x30, 0x2C, 0x42, 0x30,
+	0x2E, 0x42, 0x31, 0x2C, 0x42, 0x31, 0x2E, 0x42,
+	0x31, 0x30, 0x42, 0x31, 0x31, 0x42, 0x31, 0x32,
+	0x42, 0x31, 0x33, 0x42, 0x31, 0x34, 0x42, 0x31,
+	// Bytes 19c0 - 19ff
+	0x35, 0x42, 0x31, 0x36, 0x42, 0x31, 0x37, 0x42,
+	0x31, 0x38, 0x42, 0x31, 0x39, 0x42, 0x32, 0x2C,
+	0x42, 0x32, 0x2E, 0x42, 0x32, 0x30, 0x42, 0x32,
+	0x31, 0x42, 0x32, 0x32, 0x42, 0x32, 0x33, 0x42,
+	0x32, 0x34, 0x42, 0x32, 0x35, 0x42, 0x32, 0x36,
+	0x42, 0x32, 0x37, 0x42, 0x32, 0x38, 0x42, 0x32,
+	0x39, 0x42, 0x33, 0x2C, 0x42, 0x33, 0x2E, 0x42,
+	0x33, 0x30, 0x42, 0x33, 0x31, 0x42, 0x33, 0x32,
+	// Bytes 1a00 - 1a3f
+	0x42, 0x33, 0x33, 0x42, 0x33, 0x34, 0x42, 0x33,
+	0x35, 0x42, 0x33, 0x36, 0x42, 0x33, 0x37, 0x42,
+	0x33, 0x38, 0x42, 0x33, 0x39, 0x42, 0x34, 0x2C,
+	0x42, 0x34, 0x2E, 0x42, 0x34, 0x30, 0x42, 0x34,
+	0x31, 0x42, 0x34, 0x32, 0x42, 0x34, 0x33, 0x42,
+	0x34, 0x34, 0x42, 0x34, 0x35, 0x42, 0x34, 0x36,
+	0x42, 0x34, 0x37, 0x42, 0x34, 0x38, 0x42, 0x34,
+	0x39, 0x42, 0x35, 0x2C, 0x42, 0x35, 0x2E, 0x42,
+	// Bytes 1a40 - 1a7f
+	0x35, 0x30, 0x42, 0x36, 0x2C, 0x42, 0x36, 0x2E,
+	0x42, 0x37, 0x2C, 0x42, 0x37, 0x2E, 0x42, 0x38,
+	0x2C, 0x42, 0x38, 0x2E, 0x42, 0x39, 0x2C, 0x42,
+	0x39, 0x2E, 0x42, 0x3D, 0x3D, 0x42, 0x3F, 0x21,
+	0x42, 0x3F, 0x3F, 0x42, 0x41, 0x55, 0x42, 0x42,
+	0x71, 0x42, 0x43, 0x44, 0x42, 0x44, 0x4A, 0x42,
+	0x44, 0x5A, 0x42, 0x44, 0x7A, 0x42, 0x47, 0x42,
+	0x42, 0x47, 0x79, 0x42, 0x48, 0x50, 0x42, 0x48,
+	// Bytes 1a80 - 1abf
+	0x56, 0x42, 0x48, 0x67, 0x42, 0x48, 0x7A, 0x42,
+	0x49, 0x49, 0x42, 0x49, 0x4A, 0x42, 0x49, 0x55,
+	0x42, 0x49, 0x56, 0x42, 0x49, 0x58, 0x42, 0x4B,
+	0x42, 0x42, 0x4B, 0x4B, 0x42, 0x4B, 0x4D, 0x42,
+	0x4C, 0x4A, 0x42, 0x4C, 0x6A, 0x42, 0x4D, 0x42,
+	0x42, 0x4D, 0x43, 0x42, 0x4D, 0x44, 0x42, 0x4D,
+	0x52, 0x42, 0x4D, 0x56, 0x42, 0x4D, 0x57, 0x42,
+	0x4E, 0x4A, 0x42, 0x4E, 0x6A, 0x42, 0x4E, 0x6F,
+	// Bytes 1ac0 - 1aff
+	0x42, 0x50, 0x48, 0x42, 0x50, 0x52, 0x42, 0x50,
+	0x61, 0x42, 0x52, 0x73, 0x42, 0x53, 0x44, 0x42,
+	0x53, 0x4D, 0x42, 0x53, 0x53, 0x42, 0x53, 0x76,
+	0x42, 0x54, 0x4D, 0x42, 0x56, 0x49, 0x42, 0x57,
+	0x43, 0x42, 0x57, 0x5A, 0x42, 0x57, 0x62, 0x42,
+	0x58, 0x49, 0x42, 0x63, 0x63, 0x42, 0x63, 0x64,
+	0x42, 0x63, 0x6D, 0x42, 0x64, 0x42, 0x42, 0x64,
+	0x61, 0x42, 0x64, 0x6C, 0x42, 0x64, 0x6D, 0x42,
+	// Bytes 1b00 - 1b3f
+	0x64, 0x7A, 0x42, 0x65, 0x56, 0x42, 0x66, 0x66,
+	0x42, 0x66, 0x69, 0x42, 0x66, 0x6C, 0x42, 0x66,
+	0x6D, 0x42, 0x68, 0x61, 0x42, 0x69, 0x69, 0x42,
+	0x69, 0x6A, 0x42, 0x69, 0x6E, 0x42, 0x69, 0x76,
+	0x42, 0x69, 0x78, 0x42, 0x6B, 0x41, 0x42, 0x6B,
+	0x56, 0x42, 0x6B, 0x57, 0x42, 0x6B, 0x67, 0x42,
+	0x6B, 0x6C, 0x42, 0x6B, 0x6D, 0x42, 0x6B, 0x74,
+	0x42, 0x6C, 0x6A, 0x42, 0x6C, 0x6D, 0x42, 0x6C,
+	// Bytes 1b40 - 1b7f
+	0x6E, 0x42, 0x6C, 0x78, 0x42, 0x6D, 0x32, 0x42,
+	0x6D, 0x33, 0x42, 0x6D, 0x41, 0x42, 0x6D, 0x56,
+	0x42, 0x6D, 0x57, 0x42, 0x6D, 0x62, 0x42, 0x6D,
+	0x67, 0x42, 0x6D, 0x6C, 0x42, 0x6D, 0x6D, 0x42,
+	0x6D, 0x73, 0x42, 0x6E, 0x41, 0x42, 0x6E, 0x46,
+	0x42, 0x6E, 0x56, 0x42, 0x6E, 0x57, 0x42, 0x6E,
+	0x6A, 0x42, 0x6E, 0x6D, 0x42, 0x6E, 0x73, 0x42,
+	0x6F, 0x56, 0x42, 0x70, 0x41, 0x42, 0x70, 0x46,
+	// Bytes 1b80 - 1bbf
+	0x42, 0x70, 0x56, 0x42, 0x70, 0x57, 0x42, 0x70,
+	0x63, 0x42, 0x70, 0x73, 0x42, 0x73, 0x72, 0x42,
+	0x73, 0x74, 0x42, 0x76, 0x69, 0x42, 0x78, 0x69,
+	0x43, 0x28, 0x31, 0x29, 0x43, 0x28, 0x32, 0x29,
+	0x43, 0x28, 0x33, 0x29, 0x43, 0x28, 0x34, 0x29,
+	0x43, 0x28, 0x35, 0x29, 0x43, 0x28, 0x36, 0x29,
+	0x43, 0x28, 0x37, 0x29, 0x43, 0x28, 0x38, 0x29,
+	0x43, 0x28, 0x39, 0x29, 0x43, 0x28, 0x41, 0x29,
+	// Bytes 1bc0 - 1bff
+	0x43, 0x28, 0x42, 0x29, 0x43, 0x28, 0x43, 0x29,
+	0x43, 0x28, 0x44, 0x29, 0x43, 0x28, 0x45, 0x29,
+	0x43, 0x28, 0x46, 0x29, 0x43, 0x28, 0x47, 0x29,
+	0x43, 0x28, 0x48, 0x29, 0x43, 0x28, 0x49, 0x29,
+	0x43, 0x28, 0x4A, 0x29, 0x43, 0x28, 0x4B, 0x29,
+	0x43, 0x28, 0x4C, 0x29, 0x43, 0x28, 0x4D, 0x29,
+	0x43, 0x28, 0x4E, 0x29, 0x43, 0x28, 0x4F, 0x29,
+	0x43, 0x28, 0x50, 0x29, 0x43, 0x28, 0x51, 0x29,
+	// Bytes 1c00 - 1c3f
+	0x43, 0x28, 0x52, 0x29, 0x43, 0x28, 0x53, 0x29,
+	0x43, 0x28, 0x54, 0x29, 0x43, 0x28, 0x55, 0x29,
+	0x43, 0x28, 0x56, 0x29, 0x43, 0x28, 0x57, 0x29,
+	0x43, 0x28, 0x58, 0x29, 0x43, 0x28, 0x59, 0x29,
+	0x43, 0x28, 0x5A, 0x29, 0x43, 0x28, 0x61, 0x29,
+	0x43, 0x28, 0x62, 0x29, 0x43, 0x28, 0x63, 0x29,
+	0x43, 0x28, 0x64, 0x29, 0x43, 0x28, 0x65, 0x29,
+	0x43, 0x28, 0x66, 0x29, 0x43, 0x28, 0x67, 0x29,
+	// Bytes 1c40 - 1c7f
+	0x43, 0x28, 0x68, 0x29, 0x43, 0x28, 0x69, 0x29,
+	0x43, 0x28, 0x6A, 0x29, 0x43, 0x28, 0x6B, 0x29,
+	0x43, 0x28, 0x6C, 0x29, 0x43, 0x28, 0x6D, 0x29,
+	0x43, 0x28, 0x6E, 0x29, 0x43, 0x28, 0x6F, 0x29,
+	0x43, 0x28, 0x70, 0x29, 0x43, 0x28, 0x71, 0x29,
+	0x43, 0x28, 0x72, 0x29, 0x43, 0x28, 0x73, 0x29,
+	0x43, 0x28, 0x74, 0x29, 0x43, 0x28, 0x75, 0x29,
+	0x43, 0x28, 0x76, 0x29, 0x43, 0x28, 0x77, 0x29,
+	// Bytes 1c80 - 1cbf
+	0x43, 0x28, 0x78, 0x29, 0x43, 0x28, 0x79, 0x29,
+	0x43, 0x28, 0x7A, 0x29, 0x43, 0x2E, 0x2E, 0x2E,
+	0x43, 0x31, 0x30, 0x2E, 0x43, 0x31, 0x31, 0x2E,
+	0x43, 0x31, 0x32, 0x2E, 0x43, 0x31, 0x33, 0x2E,
+	0x43, 0x31, 0x34, 0x2E, 0x43, 0x31, 0x35, 0x2E,
+	0x43, 0x31, 0x36, 0x2E, 0x43, 0x31, 0x37, 0x2E,
+	0x43, 0x31, 0x38, 0x2E, 0x43, 0x31, 0x39, 0x2E,
+	0x43, 0x32, 0x30, 0x2E, 0x43, 0x3A, 0x3A, 0x3D,
+	// Bytes 1cc0 - 1cff
+	0x43, 0x3D, 0x3D, 0x3D, 0x43, 0x43, 0x6F, 0x2E,
+	0x43, 0x46, 0x41, 0x58, 0x43, 0x47, 0x48, 0x7A,
+	0x43, 0x47, 0x50, 0x61, 0x43, 0x49, 0x49, 0x49,
+	0x43, 0x4C, 0x54, 0x44, 0x43, 0x4C, 0xC2, 0xB7,
+	0x43, 0x4D, 0x48, 0x7A, 0x43, 0x4D, 0x50, 0x61,
+	0x43, 0x4D, 0xCE, 0xA9, 0x43, 0x50, 0x50, 0x4D,
+	0x43, 0x50, 0x50, 0x56, 0x43, 0x50, 0x54, 0x45,
+	0x43, 0x54, 0x45, 0x4C, 0x43, 0x54, 0x48, 0x7A,
+	// Bytes 1d00 - 1d3f
+	0x43, 0x56, 0x49, 0x49, 0x43, 0x58, 0x49, 0x49,
+	0x43, 0x61, 0x2F, 0x63, 0x43, 0x61, 0x2F, 0x73,
+	0x43, 0x61, 0xCA, 0xBE, 0x43, 0x62, 0x61, 0x72,
+	0x43, 0x63, 0x2F, 0x6F, 0x43, 0x63, 0x2F, 0x75,
+	0x43, 0x63, 0x61, 0x6C, 0x43, 0x63, 0x6D, 0x32,
+	0x43, 0x63, 0x6D, 0x33, 0x43, 0x64, 0x6D, 0x32,
+	0x43, 0x64, 0x6D, 0x33, 0x43, 0x65, 0x72, 0x67,
+	0x43, 0x66, 0x66, 0x69, 0x43, 0x66, 0x66, 0x6C,
+	// Bytes 1d40 - 1d7f
+	0x43, 0x67, 0x61, 0x6C, 0x43, 0x68, 0x50, 0x61,
+	0x43, 0x69, 0x69, 0x69, 0x43, 0x6B, 0x48, 0x7A,
+	0x43, 0x6B, 0x50, 0x61, 0x43, 0x6B, 0x6D, 0x32,
+	0x43, 0x6B, 0x6D, 0x33, 0x43, 0x6B, 0xCE, 0xA9,
+	0x43, 0x6C, 0x6F, 0x67, 0x43, 0x6C, 0xC2, 0xB7,
+	0x43, 0x6D, 0x69, 0x6C, 0x43, 0x6D, 0x6D, 0x32,
+	0x43, 0x6D, 0x6D, 0x33, 0x43, 0x6D, 0x6F, 0x6C,
+	0x43, 0x72, 0x61, 0x64, 0x43, 0x76, 0x69, 0x69,
+	// Bytes 1d80 - 1dbf
+	0x43, 0x78, 0x69, 0x69, 0x43, 0xC2, 0xB0, 0x43,
+	0x43, 0xC2, 0xB0, 0x46, 0x43, 0xCA, 0xBC, 0x6E,
+	0x43, 0xCE, 0xBC, 0x41, 0x43, 0xCE, 0xBC, 0x46,
+	0x43, 0xCE, 0xBC, 0x56, 0x43, 0xCE, 0xBC, 0x57,
+	0x43, 0xCE, 0xBC, 0x67, 0x43, 0xCE, 0xBC, 0x6C,
+	0x43, 0xCE, 0xBC, 0x6D, 0x43, 0xCE, 0xBC, 0x73,
+	0x44, 0x28, 0x31, 0x30, 0x29, 0x44, 0x28, 0x31,
+	0x31, 0x29, 0x44, 0x28, 0x31, 0x32, 0x29, 0x44,
+	// Bytes 1dc0 - 1dff
+	0x28, 0x31, 0x33, 0x29, 0x44, 0x28, 0x31, 0x34,
+	0x29, 0x44, 0x28, 0x31, 0x35, 0x29, 0x44, 0x28,
+	0x31, 0x36, 0x29, 0x44, 0x28, 0x31, 0x37, 0x29,
+	0x44, 0x28, 0x31, 0x38, 0x29, 0x44, 0x28, 0x31,
+	0x39, 0x29, 0x44, 0x28, 0x32, 0x30, 0x29, 0x44,
+	0x30, 0xE7, 0x82, 0xB9, 0x44, 0x31, 0xE2, 0x81,
+	0x84, 0x44, 0x31, 0xE6, 0x97, 0xA5, 0x44, 0x31,
+	0xE6, 0x9C, 0x88, 0x44, 0x31, 0xE7, 0x82, 0xB9,
+	// Bytes 1e00 - 1e3f
+	0x44, 0x32, 0xE6, 0x97, 0xA5, 0x44, 0x32, 0xE6,
+	0x9C, 0x88, 0x44, 0x32, 0xE7, 0x82, 0xB9, 0x44,
+	0x33, 0xE6, 0x97, 0xA5, 0x44, 0x33, 0xE6, 0x9C,
+	0x88, 0x44, 0x33, 0xE7, 0x82, 0xB9, 0x44, 0x34,
+	0xE6, 0x97, 0xA5, 0x44, 0x34, 0xE6, 0x9C, 0x88,
+	0x44, 0x34, 0xE7, 0x82, 0xB9, 0x44, 0x35, 0xE6,
+	0x97, 0xA5, 0x44, 0x35, 0xE6, 0x9C, 0x88, 0x44,
+	0x35, 0xE7, 0x82, 0xB9, 0x44, 0x36, 0xE6, 0x97,
+	// Bytes 1e40 - 1e7f
+	0xA5, 0x44, 0x36, 0xE6, 0x9C, 0x88, 0x44, 0x36,
+	0xE7, 0x82, 0xB9, 0x44, 0x37, 0xE6, 0x97, 0xA5,
+	0x44, 0x37, 0xE6, 0x9C, 0x88, 0x44, 0x37, 0xE7,
+	0x82, 0xB9, 0x44, 0x38, 0xE6, 0x97, 0xA5, 0x44,
+	0x38, 0xE6, 0x9C, 0x88, 0x44, 0x38, 0xE7, 0x82,
+	0xB9, 0x44, 0x39, 0xE6, 0x97, 0xA5, 0x44, 0x39,
+	0xE6, 0x9C, 0x88, 0x44, 0x39, 0xE7, 0x82, 0xB9,
+	0x44, 0x56, 0x49, 0x49, 0x49, 0x44, 0x61, 0x2E,
+	// Bytes 1e80 - 1ebf
+	0x6D, 0x2E, 0x44, 0x6B, 0x63, 0x61, 0x6C, 0x44,
+	0x70, 0x2E, 0x6D, 0x2E, 0x44, 0x76, 0x69, 0x69,
+	0x69, 0x44, 0xD5, 0xA5, 0xD6, 0x82, 0x44, 0xD5,
+	0xB4, 0xD5, 0xA5, 0x44, 0xD5, 0xB4, 0xD5, 0xAB,
+	0x44, 0xD5, 0xB4, 0xD5, 0xAD, 0x44, 0xD5, 0xB4,
+	0xD5, 0xB6, 0x44, 0xD5, 0xBE, 0xD5, 0xB6, 0x44,
+	0xD7, 0x90, 0xD7, 0x9C, 0x44, 0xD8, 0xA7, 0xD9,
+	0xB4, 0x44, 0xD8, 0xA8, 0xD8, 0xAC, 0x44, 0xD8,
+	// Bytes 1ec0 - 1eff
+	0xA8, 0xD8, 0xAD, 0x44, 0xD8, 0xA8, 0xD8, 0xAE,
+	0x44, 0xD8, 0xA8, 0xD8, 0xB1, 0x44, 0xD8, 0xA8,
+	0xD8, 0xB2, 0x44, 0xD8, 0xA8, 0xD9, 0x85, 0x44,
+	0xD8, 0xA8, 0xD9, 0x86, 0x44, 0xD8, 0xA8, 0xD9,
+	0x87, 0x44, 0xD8, 0xA8, 0xD9, 0x89, 0x44, 0xD8,
+	0xA8, 0xD9, 0x8A, 0x44, 0xD8, 0xAA, 0xD8, 0xAC,
+	0x44, 0xD8, 0xAA, 0xD8, 0xAD, 0x44, 0xD8, 0xAA,
+	0xD8, 0xAE, 0x44, 0xD8, 0xAA, 0xD8, 0xB1, 0x44,
+	// Bytes 1f00 - 1f3f
+	0xD8, 0xAA, 0xD8, 0xB2, 0x44, 0xD8, 0xAA, 0xD9,
+	0x85, 0x44, 0xD8, 0xAA, 0xD9, 0x86, 0x44, 0xD8,
+	0xAA, 0xD9, 0x87, 0x44, 0xD8, 0xAA, 0xD9, 0x89,
+	0x44, 0xD8, 0xAA, 0xD9, 0x8A, 0x44, 0xD8, 0xAB,
+	0xD8, 0xAC, 0x44, 0xD8, 0xAB, 0xD8, 0xB1, 0x44,
+	0xD8, 0xAB, 0xD8, 0xB2, 0x44, 0xD8, 0xAB, 0xD9,
+	0x85, 0x44, 0xD8, 0xAB, 0xD9, 0x86, 0x44, 0xD8,
+	0xAB, 0xD9, 0x87, 0x44, 0xD8, 0xAB, 0xD9, 0x89,
+	// Bytes 1f40 - 1f7f
+	0x44, 0xD8, 0xAB, 0xD9, 0x8A, 0x44, 0xD8, 0xAC,
+	0xD8, 0xAD, 0x44, 0xD8, 0xAC, 0xD9, 0x85, 0x44,
+	0xD8, 0xAC, 0xD9, 0x89, 0x44, 0xD8, 0xAC, 0xD9,
+	0x8A, 0x44, 0xD8, 0xAD, 0xD8, 0xAC, 0x44, 0xD8,
+	0xAD, 0xD9, 0x85, 0x44, 0xD8, 0xAD, 0xD9, 0x89,
+	0x44, 0xD8, 0xAD, 0xD9, 0x8A, 0x44, 0xD8, 0xAE,
+	0xD8, 0xAC, 0x44, 0xD8, 0xAE, 0xD8, 0xAD, 0x44,
+	0xD8, 0xAE, 0xD9, 0x85, 0x44, 0xD8, 0xAE, 0xD9,
+	// Bytes 1f80 - 1fbf
+	0x89, 0x44, 0xD8, 0xAE, 0xD9, 0x8A, 0x44, 0xD8,
+	0xB3, 0xD8, 0xAC, 0x44, 0xD8, 0xB3, 0xD8, 0xAD,
+	0x44, 0xD8, 0xB3, 0xD8, 0xAE, 0x44, 0xD8, 0xB3,
+	0xD8, 0xB1, 0x44, 0xD8, 0xB3, 0xD9, 0x85, 0x44,
+	0xD8, 0xB3, 0xD9, 0x87, 0x44, 0xD8, 0xB3, 0xD9,
+	0x89, 0x44, 0xD8, 0xB3, 0xD9, 0x8A, 0x44, 0xD8,
+	0xB4, 0xD8, 0xAC, 0x44, 0xD8, 0xB4, 0xD8, 0xAD,
+	0x44, 0xD8, 0xB4, 0xD8, 0xAE, 0x44, 0xD8, 0xB4,
+	// Bytes 1fc0 - 1fff
+	0xD8, 0xB1, 0x44, 0xD8, 0xB4, 0xD9, 0x85, 0x44,
+	0xD8, 0xB4, 0xD9, 0x87, 0x44, 0xD8, 0xB4, 0xD9,
+	0x89, 0x44, 0xD8, 0xB4, 0xD9, 0x8A, 0x44, 0xD8,
+	0xB5, 0xD8, 0xAD, 0x44, 0xD8, 0xB5, 0xD8, 0xAE,
+	0x44, 0xD8, 0xB5, 0xD8, 0xB1, 0x44, 0xD8, 0xB5,
+	0xD9, 0x85, 0x44, 0xD8, 0xB5, 0xD9, 0x89, 0x44,
+	0xD8, 0xB5, 0xD9, 0x8A, 0x44, 0xD8, 0xB6, 0xD8,
+	0xAC, 0x44, 0xD8, 0xB6, 0xD8, 0xAD, 0x44, 0xD8,
+	// Bytes 2000 - 203f
+	0xB6, 0xD8, 0xAE, 0x44, 0xD8, 0xB6, 0xD8, 0xB1,
+	0x44, 0xD8, 0xB6, 0xD9, 0x85, 0x44, 0xD8, 0xB6,
+	0xD9, 0x89, 0x44, 0xD8, 0xB6, 0xD9, 0x8A, 0x44,
+	0xD8, 0xB7, 0xD8, 0xAD, 0x44, 0xD8, 0xB7, 0xD9,
+	0x85, 0x44, 0xD8, 0xB7, 0xD9, 0x89, 0x44, 0xD8,
+	0xB7, 0xD9, 0x8A, 0x44, 0xD8, 0xB8, 0xD9, 0x85,
+	0x44, 0xD8, 0xB9, 0xD8, 0xAC, 0x44, 0xD8, 0xB9,
+	0xD9, 0x85, 0x44, 0xD8, 0xB9, 0xD9, 0x89, 0x44,
+	// Bytes 2040 - 207f
+	0xD8, 0xB9, 0xD9, 0x8A, 0x44, 0xD8, 0xBA, 0xD8,
+	0xAC, 0x44, 0xD8, 0xBA, 0xD9, 0x85, 0x44, 0xD8,
+	0xBA, 0xD9, 0x89, 0x44, 0xD8, 0xBA, 0xD9, 0x8A,
+	0x44, 0xD9, 0x81, 0xD8, 0xAC, 0x44, 0xD9, 0x81,
+	0xD8, 0xAD, 0x44, 0xD9, 0x81, 0xD8, 0xAE, 0x44,
+	0xD9, 0x81, 0xD9, 0x85, 0x44, 0xD9, 0x81, 0xD9,
+	0x89, 0x44, 0xD9, 0x81, 0xD9, 0x8A, 0x44, 0xD9,
+	0x82, 0xD8, 0xAD, 0x44, 0xD9, 0x82, 0xD9, 0x85,
+	// Bytes 2080 - 20bf
+	0x44, 0xD9, 0x82, 0xD9, 0x89, 0x44, 0xD9, 0x82,
+	0xD9, 0x8A, 0x44, 0xD9, 0x83, 0xD8, 0xA7, 0x44,
+	0xD9, 0x83, 0xD8, 0xAC, 0x44, 0xD9, 0x83, 0xD8,
+	0xAD, 0x44, 0xD9, 0x83, 0xD8, 0xAE, 0x44, 0xD9,
+	0x83, 0xD9, 0x84, 0x44, 0xD9, 0x83, 0xD9, 0x85,
+	0x44, 0xD9, 0x83, 0xD9, 0x89, 0x44, 0xD9, 0x83,
+	0xD9, 0x8A, 0x44, 0xD9, 0x84, 0xD8, 0xA7, 0x44,
+	0xD9, 0x84, 0xD8, 0xAC, 0x44, 0xD9, 0x84, 0xD8,
+	// Bytes 20c0 - 20ff
+	0xAD, 0x44, 0xD9, 0x84, 0xD8, 0xAE, 0x44, 0xD9,
+	0x84, 0xD9, 0x85, 0x44, 0xD9, 0x84, 0xD9, 0x87,
+	0x44, 0xD9, 0x84, 0xD9, 0x89, 0x44, 0xD9, 0x84,
+	0xD9, 0x8A, 0x44, 0xD9, 0x85, 0xD8, 0xA7, 0x44,
+	0xD9, 0x85, 0xD8, 0xAC, 0x44, 0xD9, 0x85, 0xD8,
+	0xAD, 0x44, 0xD9, 0x85, 0xD8, 0xAE, 0x44, 0xD9,
+	0x85, 0xD9, 0x85, 0x44, 0xD9, 0x85, 0xD9, 0x89,
+	0x44, 0xD9, 0x85, 0xD9, 0x8A, 0x44, 0xD9, 0x86,
+	// Bytes 2100 - 213f
+	0xD8, 0xAC, 0x44, 0xD9, 0x86, 0xD8, 0xAD, 0x44,
+	0xD9, 0x86, 0xD8, 0xAE, 0x44, 0xD9, 0x86, 0xD8,
+	0xB1, 0x44, 0xD9, 0x86, 0xD8, 0xB2, 0x44, 0xD9,
+	0x86, 0xD9, 0x85, 0x44, 0xD9, 0x86, 0xD9, 0x86,
+	0x44, 0xD9, 0x86, 0xD9, 0x87, 0x44, 0xD9, 0x86,
+	0xD9, 0x89, 0x44, 0xD9, 0x86, 0xD9, 0x8A, 0x44,
+	0xD9, 0x87, 0xD8, 0xAC, 0x44, 0xD9, 0x87, 0xD9,
+	0x85, 0x44, 0xD9, 0x87, 0xD9, 0x89, 0x44, 0xD9,
+	// Bytes 2140 - 217f
+	0x87, 0xD9, 0x8A, 0x44, 0xD9, 0x88, 0xD9, 0xB4,
+	0x44, 0xD9, 0x8A, 0xD8, 0xAC, 0x44, 0xD9, 0x8A,
+	0xD8, 0xAD, 0x44, 0xD9, 0x8A, 0xD8, 0xAE, 0x44,
+	0xD9, 0x8A, 0xD8, 0xB1, 0x44, 0xD9, 0x8A, 0xD8,
+	0xB2, 0x44, 0xD9, 0x8A, 0xD9, 0x85, 0x44, 0xD9,
+	0x8A, 0xD9, 0x86, 0x44, 0xD9, 0x8A, 0xD9, 0x87,
+	0x44, 0xD9, 0x8A, 0xD9, 0x89, 0x44, 0xD9, 0x8A,
+	0xD9, 0x8A, 0x44, 0xD9, 0x8A, 0xD9, 0xB4, 0x44,
+	// Bytes 2180 - 21bf
+	0xDB, 0x87, 0xD9, 0xB4, 0x45, 0x28, 0xE1, 0x84,
+	0x80, 0x29, 0x45, 0x28, 0xE1, 0x84, 0x82, 0x29,
+	0x45, 0x28, 0xE1, 0x84, 0x83, 0x29, 0x45, 0x28,
+	0xE1, 0x84, 0x85, 0x29, 0x45, 0x28, 0xE1, 0x84,
+	0x86, 0x29, 0x45, 0x28, 0xE1, 0x84, 0x87, 0x29,
+	0x45, 0x28, 0xE1, 0x84, 0x89, 0x29, 0x45, 0x28,
+	0xE1, 0x84, 0x8B, 0x29, 0x45, 0x28, 0xE1, 0x84,
+	0x8C, 0x29, 0x45, 0x28, 0xE1, 0x84, 0x8E, 0x29,
+	// Bytes 21c0 - 21ff
+	0x45, 0x28, 0xE1, 0x84, 0x8F, 0x29, 0x45, 0x28,
+	0xE1, 0x84, 0x90, 0x29, 0x45, 0x28, 0xE1, 0x84,
+	0x91, 0x29, 0x45, 0x28, 0xE1, 0x84, 0x92, 0x29,
+	0x45, 0x28, 0xE4, 0xB8, 0x80, 0x29, 0x45, 0x28,
+	0xE4, 0xB8, 0x83, 0x29, 0x45, 0x28, 0xE4, 0xB8,
+	0x89, 0x29, 0x45, 0x28, 0xE4, 0xB9, 0x9D, 0x29,
+	0x45, 0x28, 0xE4, 0xBA, 0x8C, 0x29, 0x45, 0x28,
+	0xE4, 0xBA, 0x94, 0x29, 0x45, 0x28, 0xE4, 0xBB,
+	// Bytes 2200 - 223f
+	0xA3, 0x29, 0x45, 0x28, 0xE4, 0xBC, 0x81, 0x29,
+	0x45, 0x28, 0xE4, 0xBC, 0x91, 0x29, 0x45, 0x28,
+	0xE5, 0x85, 0xAB, 0x29, 0x45, 0x28, 0xE5, 0x85,
+	0xAD, 0x29, 0x45, 0x28, 0xE5, 0x8A, 0xB4, 0x29,
+	0x45, 0x28, 0xE5, 0x8D, 0x81, 0x29, 0x45, 0x28,
+	0xE5, 0x8D, 0x94, 0x29, 0x45, 0x28, 0xE5, 0x90,
+	0x8D, 0x29, 0x45, 0x28, 0xE5, 0x91, 0xBC, 0x29,
+	0x45, 0x28, 0xE5, 0x9B, 0x9B, 0x29, 0x45, 0x28,
+	// Bytes 2240 - 227f
+	0xE5, 0x9C, 0x9F, 0x29, 0x45, 0x28, 0xE5, 0xAD,
+	0xA6, 0x29, 0x45, 0x28, 0xE6, 0x97, 0xA5, 0x29,
+	0x45, 0x28, 0xE6, 0x9C, 0x88, 0x29, 0x45, 0x28,
+	0xE6, 0x9C, 0x89, 0x29, 0x45, 0x28, 0xE6, 0x9C,
+	0xA8, 0x29, 0x45, 0x28, 0xE6, 0xA0, 0xAA, 0x29,
+	0x45, 0x28, 0xE6, 0xB0, 0xB4, 0x29, 0x45, 0x28,
+	0xE7, 0x81, 0xAB, 0x29, 0x45, 0x28, 0xE7, 0x89,
+	0xB9, 0x29, 0x45, 0x28, 0xE7, 0x9B, 0xA3, 0x29,
+	// Bytes 2280 - 22bf
+	0x45, 0x28, 0xE7, 0xA4, 0xBE, 0x29, 0x45, 0x28,
+	0xE7, 0xA5, 0x9D, 0x29, 0x45, 0x28, 0xE7, 0xA5,
+	0xAD, 0x29, 0x45, 0x28, 0xE8, 0x87, 0xAA, 0x29,
+	0x45, 0x28, 0xE8, 0x87, 0xB3, 0x29, 0x45, 0x28,
+	0xE8, 0xB2, 0xA1, 0x29, 0x45, 0x28, 0xE8, 0xB3,
+	0x87, 0x29, 0x45, 0x28, 0xE9, 0x87, 0x91, 0x29,
+	0x45, 0x30, 0xE2, 0x81, 0x84, 0x33, 0x45, 0x31,
+	0x30, 0xE6, 0x97, 0xA5, 0x45, 0x31, 0x30, 0xE6,
+	// Bytes 22c0 - 22ff
+	0x9C, 0x88, 0x45, 0x31, 0x30, 0xE7, 0x82, 0xB9,
+	0x45, 0x31, 0x31, 0xE6, 0x97, 0xA5, 0x45, 0x31,
+	0x31, 0xE6, 0x9C, 0x88, 0x45, 0x31, 0x31, 0xE7,
+	0x82, 0xB9, 0x45, 0x31, 0x32, 0xE6, 0x97, 0xA5,
+	0x45, 0x31, 0x32, 0xE6, 0x9C, 0x88, 0x45, 0x31,
+	0x32, 0xE7, 0x82, 0xB9, 0x45, 0x31, 0x33, 0xE6,
+	0x97, 0xA5, 0x45, 0x31, 0x33, 0xE7, 0x82, 0xB9,
+	0x45, 0x31, 0x34, 0xE6, 0x97, 0xA5, 0x45, 0x31,
+	// Bytes 2300 - 233f
+	0x34, 0xE7, 0x82, 0xB9, 0x45, 0x31, 0x35, 0xE6,
+	0x97, 0xA5, 0x45, 0x31, 0x35, 0xE7, 0x82, 0xB9,
+	0x45, 0x31, 0x36, 0xE6, 0x97, 0xA5, 0x45, 0x31,
+	0x36, 0xE7, 0x82, 0xB9, 0x45, 0x31, 0x37, 0xE6,
+	0x97, 0xA5, 0x45, 0x31, 0x37, 0xE7, 0x82, 0xB9,
+	0x45, 0x31, 0x38, 0xE6, 0x97, 0xA5, 0x45, 0x31,
+	0x38, 0xE7, 0x82, 0xB9, 0x45, 0x31, 0x39, 0xE6,
+	0x97, 0xA5, 0x45, 0x31, 0x39, 0xE7, 0x82, 0xB9,
+	// Bytes 2340 - 237f
+	0x45, 0x31, 0xE2, 0x81, 0x84, 0x32, 0x45, 0x31,
+	0xE2, 0x81, 0x84, 0x33, 0x45, 0x31, 0xE2, 0x81,
+	0x84, 0x34, 0x45, 0x31, 0xE2, 0x81, 0x84, 0x35,
+	0x45, 0x31, 0xE2, 0x81, 0x84, 0x36, 0x45, 0x31,
+	0xE2, 0x81, 0x84, 0x37, 0x45, 0x31, 0xE2, 0x81,
+	0x84, 0x38, 0x45, 0x31, 0xE2, 0x81, 0x84, 0x39,
+	0x45, 0x32, 0x30, 0xE6, 0x97, 0xA5, 0x45, 0x32,
+	0x30, 0xE7, 0x82, 0xB9, 0x45, 0x32, 0x31, 0xE6,
+	// Bytes 2380 - 23bf
+	0x97, 0xA5, 0x45, 0x32, 0x31, 0xE7, 0x82, 0xB9,
+	0x45, 0x32, 0x32, 0xE6, 0x97, 0xA5, 0x45, 0x32,
+	0x32, 0xE7, 0x82, 0xB9, 0x45, 0x32, 0x33, 0xE6,
+	0x97, 0xA5, 0x45, 0x32, 0x33, 0xE7, 0x82, 0xB9,
+	0x45, 0x32, 0x34, 0xE6, 0x97, 0xA5, 0x45, 0x32,
+	0x34, 0xE7, 0x82, 0xB9, 0x45, 0x32, 0x35, 0xE6,
+	0x97, 0xA5, 0x45, 0x32, 0x36, 0xE6, 0x97, 0xA5,
+	0x45, 0x32, 0x37, 0xE6, 0x97, 0xA5, 0x45, 0x32,
+	// Bytes 23c0 - 23ff
+	0x38, 0xE6, 0x97, 0xA5, 0x45, 0x32, 0x39, 0xE6,
+	0x97, 0xA5, 0x45, 0x32, 0xE2, 0x81, 0x84, 0x33,
+	0x45, 0x32, 0xE2, 0x81, 0x84, 0x35, 0x45, 0x33,
+	0x30, 0xE6, 0x97, 0xA5, 0x45, 0x33, 0x31, 0xE6,
+	0x97, 0xA5, 0x45, 0x33, 0xE2, 0x81, 0x84, 0x34,
+	0x45, 0x33, 0xE2, 0x81, 0x84, 0x35, 0x45, 0x33,
+	0xE2, 0x81, 0x84, 0x38, 0x45, 0x34, 0xE2, 0x81,
+	0x84, 0x35, 0x45, 0x35, 0xE2, 0x81, 0x84, 0x36,
+	// Bytes 2400 - 243f
+	0x45, 0x35, 0xE2, 0x81, 0x84, 0x38, 0x45, 0x37,
+	0xE2, 0x81, 0x84, 0x38, 0x45, 0x41, 0xE2, 0x88,
+	0x95, 0x6D, 0x45, 0x56, 0xE2, 0x88, 0x95, 0x6D,
+	0x45, 0x6D, 0xE2, 0x88, 0x95, 0x73, 0x46, 0x31,
+	0xE2, 0x81, 0x84, 0x31, 0x30, 0x46, 0x43, 0xE2,
+	0x88, 0x95, 0x6B, 0x67, 0x46, 0x6D, 0xE2, 0x88,
+	0x95, 0x73, 0x32, 0x46, 0xD8, 0xA8, 0xD8, 0xAD,
+	0xD9, 0x8A, 0x46, 0xD8, 0xA8, 0xD8, 0xAE, 0xD9,
+	// Bytes 2440 - 247f
+	0x8A, 0x46, 0xD8, 0xAA, 0xD8, 0xAC, 0xD9, 0x85,
+	0x46, 0xD8, 0xAA, 0xD8, 0xAC, 0xD9, 0x89, 0x46,
+	0xD8, 0xAA, 0xD8, 0xAC, 0xD9, 0x8A, 0x46, 0xD8,
+	0xAA, 0xD8, 0xAD, 0xD8, 0xAC, 0x46, 0xD8, 0xAA,
+	0xD8, 0xAD, 0xD9, 0x85, 0x46, 0xD8, 0xAA, 0xD8,
+	0xAE, 0xD9, 0x85, 0x46, 0xD8, 0xAA, 0xD8, 0xAE,
+	0xD9, 0x89, 0x46, 0xD8, 0xAA, 0xD8, 0xAE, 0xD9,
+	0x8A, 0x46, 0xD8, 0xAA, 0xD9, 0x85, 0xD8, 0xAC,
+	// Bytes 2480 - 24bf
+	0x46, 0xD8, 0xAA, 0xD9, 0x85, 0xD8, 0xAD, 0x46,
+	0xD8, 0xAA, 0xD9, 0x85, 0xD8, 0xAE, 0x46, 0xD8,
+	0xAA, 0xD9, 0x85, 0xD9, 0x89, 0x46, 0xD8, 0xAA,
+	0xD9, 0x85, 0xD9, 0x8A, 0x46, 0xD8, 0xAC, 0xD8,
+	0xAD, 0xD9, 0x89, 0x46, 0xD8, 0xAC, 0xD8, 0xAD,
+	0xD9, 0x8A, 0x46, 0xD8, 0xAC, 0xD9, 0x85, 0xD8,
+	0xAD, 0x46, 0xD8, 0xAC, 0xD9, 0x85, 0xD9, 0x89,
+	0x46, 0xD8, 0xAC, 0xD9, 0x85, 0xD9, 0x8A, 0x46,
+	// Bytes 24c0 - 24ff
+	0xD8, 0xAD, 0xD8, 0xAC, 0xD9, 0x8A, 0x46, 0xD8,
+	0xAD, 0xD9, 0x85, 0xD9, 0x89, 0x46, 0xD8, 0xAD,
+	0xD9, 0x85, 0xD9, 0x8A, 0x46, 0xD8, 0xB3, 0xD8,
+	0xAC, 0xD8, 0xAD, 0x46, 0xD8, 0xB3, 0xD8, 0xAC,
+	0xD9, 0x89, 0x46, 0xD8, 0xB3, 0xD8, 0xAD, 0xD8,
+	0xAC, 0x46, 0xD8, 0xB3, 0xD8, 0xAE, 0xD9, 0x89,
+	0x46, 0xD8, 0xB3, 0xD8, 0xAE, 0xD9, 0x8A, 0x46,
+	0xD8, 0xB3, 0xD9, 0x85, 0xD8, 0xAC, 0x46, 0xD8,
+	// Bytes 2500 - 253f
+	0xB3, 0xD9, 0x85, 0xD8, 0xAD, 0x46, 0xD8, 0xB3,
+	0xD9, 0x85, 0xD9, 0x85, 0x46, 0xD8, 0xB4, 0xD8,
+	0xAC, 0xD9, 0x8A, 0x46, 0xD8, 0xB4, 0xD8, 0xAD,
+	0xD9, 0x85, 0x46, 0xD8, 0xB4, 0xD8, 0xAD, 0xD9,
+	0x8A, 0x46, 0xD8, 0xB4, 0xD9, 0x85, 0xD8, 0xAE,
+	0x46, 0xD8, 0xB4, 0xD9, 0x85, 0xD9, 0x85, 0x46,
+	0xD8, 0xB5, 0xD8, 0xAD, 0xD8, 0xAD, 0x46, 0xD8,
+	0xB5, 0xD8, 0xAD, 0xD9, 0x8A, 0x46, 0xD8, 0xB5,
+	// Bytes 2540 - 257f
+	0xD9, 0x84, 0xD9, 0x89, 0x46, 0xD8, 0xB5, 0xD9,
+	0x84, 0xDB, 0x92, 0x46, 0xD8, 0xB5, 0xD9, 0x85,
+	0xD9, 0x85, 0x46, 0xD8, 0xB6, 0xD8, 0xAD, 0xD9,
+	0x89, 0x46, 0xD8, 0xB6, 0xD8, 0xAD, 0xD9, 0x8A,
+	0x46, 0xD8, 0xB6, 0xD8, 0xAE, 0xD9, 0x85, 0x46,
+	0xD8, 0xB7, 0xD9, 0x85, 0xD8, 0xAD, 0x46, 0xD8,
+	0xB7, 0xD9, 0x85, 0xD9, 0x85, 0x46, 0xD8, 0xB7,
+	0xD9, 0x85, 0xD9, 0x8A, 0x46, 0xD8, 0xB9, 0xD8,
+	// Bytes 2580 - 25bf
+	0xAC, 0xD9, 0x85, 0x46, 0xD8, 0xB9, 0xD9, 0x85,
+	0xD9, 0x85, 0x46, 0xD8, 0xB9, 0xD9, 0x85, 0xD9,
+	0x89, 0x46, 0xD8, 0xB9, 0xD9, 0x85, 0xD9, 0x8A,
+	0x46, 0xD8, 0xBA, 0xD9, 0x85, 0xD9, 0x85, 0x46,
+	0xD8, 0xBA, 0xD9, 0x85, 0xD9, 0x89, 0x46, 0xD8,
+	0xBA, 0xD9, 0x85, 0xD9, 0x8A, 0x46, 0xD9, 0x81,
+	0xD8, 0xAE, 0xD9, 0x85, 0x46, 0xD9, 0x81, 0xD9,
+	0x85, 0xD9, 0x8A, 0x46, 0xD9, 0x82, 0xD9, 0x84,
+	// Bytes 25c0 - 25ff
+	0xDB, 0x92, 0x46, 0xD9, 0x82, 0xD9, 0x85, 0xD8,
+	0xAD, 0x46, 0xD9, 0x82, 0xD9, 0x85, 0xD9, 0x85,
+	0x46, 0xD9, 0x82, 0xD9, 0x85, 0xD9, 0x8A, 0x46,
+	0xD9, 0x83, 0xD9, 0x85, 0xD9, 0x85, 0x46, 0xD9,
+	0x83, 0xD9, 0x85, 0xD9, 0x8A, 0x46, 0xD9, 0x84,
+	0xD8, 0xAC, 0xD8, 0xAC, 0x46, 0xD9, 0x84, 0xD8,
+	0xAC, 0xD9, 0x85, 0x46, 0xD9, 0x84, 0xD8, 0xAC,
+	0xD9, 0x8A, 0x46, 0xD9, 0x84, 0xD8, 0xAD, 0xD9,
+	// Bytes 2600 - 263f
+	0x85, 0x46, 0xD9, 0x84, 0xD8, 0xAD, 0xD9, 0x89,
+	0x46, 0xD9, 0x84, 0xD8, 0xAD, 0xD9, 0x8A, 0x46,
+	0xD9, 0x84, 0xD8, 0xAE, 0xD9, 0x85, 0x46, 0xD9,
+	0x84, 0xD9, 0x85, 0xD8, 0xAD, 0x46, 0xD9, 0x84,
+	0xD9, 0x85, 0xD9, 0x8A, 0x46, 0xD9, 0x85, 0xD8,
+	0xAC, 0xD8, 0xAD, 0x46, 0xD9, 0x85, 0xD8, 0xAC,
+	0xD8, 0xAE, 0x46, 0xD9, 0x85, 0xD8, 0xAC, 0xD9,
+	0x85, 0x46, 0xD9, 0x85, 0xD8, 0xAC, 0xD9, 0x8A,
+	// Bytes 2640 - 267f
+	0x46, 0xD9, 0x85, 0xD8, 0xAD, 0xD8, 0xAC, 0x46,
+	0xD9, 0x85, 0xD8, 0xAD, 0xD9, 0x85, 0x46, 0xD9,
+	0x85, 0xD8, 0xAD, 0xD9, 0x8A, 0x46, 0xD9, 0x85,
+	0xD8, 0xAE, 0xD8, 0xAC, 0x46, 0xD9, 0x85, 0xD8,
+	0xAE, 0xD9, 0x85, 0x46, 0xD9, 0x85, 0xD8, 0xAE,
+	0xD9, 0x8A, 0x46, 0xD9, 0x85, 0xD9, 0x85, 0xD9,
+	0x8A, 0x46, 0xD9, 0x86, 0xD8, 0xAC, 0xD8, 0xAD,
+	0x46, 0xD9, 0x86, 0xD8, 0xAC, 0xD9, 0x85, 0x46,
+	// Bytes 2680 - 26bf
+	0xD9, 0x86, 0xD8, 0xAC, 0xD9, 0x89, 0x46, 0xD9,
+	0x86, 0xD8, 0xAC, 0xD9, 0x8A, 0x46, 0xD9, 0x86,
+	0xD8, 0xAD, 0xD9, 0x85, 0x46, 0xD9, 0x86, 0xD8,
+	0xAD, 0xD9, 0x89, 0x46, 0xD9, 0x86, 0xD8, 0xAD,
+	0xD9, 0x8A, 0x46, 0xD9, 0x86, 0xD9, 0x85, 0xD9,
+	0x89, 0x46, 0xD9, 0x86, 0xD9, 0x85, 0xD9, 0x8A,
+	0x46, 0xD9, 0x87, 0xD9, 0x85, 0xD8, 0xAC, 0x46,
+	0xD9, 0x87, 0xD9, 0x85, 0xD9, 0x85, 0x46, 0xD9,
+	// Bytes 26c0 - 26ff
+	0x8A, 0xD8, 0xAC, 0xD9, 0x8A, 0x46, 0xD9, 0x8A,
+	0xD8, 0xAD, 0xD9, 0x8A, 0x46, 0xD9, 0x8A, 0xD9,
+	0x85, 0xD9, 0x85, 0x46, 0xD9, 0x8A, 0xD9, 0x85,
+	0xD9, 0x8A, 0x46, 0xD9, 0x8A, 0xD9, 0x94, 0xD8,
+	0xA7, 0x46, 0xD9, 0x8A, 0xD9, 0x94, 0xD8, 0xAC,
+	0x46, 0xD9, 0x8A, 0xD9, 0x94, 0xD8, 0xAD, 0x46,
+	0xD9, 0x8A, 0xD9, 0x94, 0xD8, 0xAE, 0x46, 0xD9,
+	0x8A, 0xD9, 0x94, 0xD8, 0xB1, 0x46, 0xD9, 0x8A,
+	// Bytes 2700 - 273f
+	0xD9, 0x94, 0xD8, 0xB2, 0x46, 0xD9, 0x8A, 0xD9,
+	0x94, 0xD9, 0x85, 0x46, 0xD9, 0x8A, 0xD9, 0x94,
+	0xD9, 0x86, 0x46, 0xD9, 0x8A, 0xD9, 0x94, 0xD9,
+	0x87, 0x46, 0xD9, 0x8A, 0xD9, 0x94, 0xD9, 0x88,
+	0x46, 0xD9, 0x8A, 0xD9, 0x94, 0xD9, 0x89, 0x46,
+	0xD9, 0x8A, 0xD9, 0x94, 0xD9, 0x8A, 0x46, 0xD9,
+	0x8A, 0xD9, 0x94, 0xDB, 0x86, 0x46, 0xD9, 0x8A,
+	0xD9, 0x94, 0xDB, 0x87, 0x46, 0xD9, 0x8A, 0xD9,
+	// Bytes 2740 - 277f
+	0x94, 0xDB, 0x88, 0x46, 0xD9, 0x8A, 0xD9, 0x94,
+	0xDB, 0x90, 0x46, 0xD9, 0x8A, 0xD9, 0x94, 0xDB,
+	0x95, 0x46, 0xE0, 0xB9, 0x8D, 0xE0, 0xB8, 0xB2,
+	0x46, 0xE0, 0xBA, 0xAB, 0xE0, 0xBA, 0x99, 0x46,
+	0xE0, 0xBA, 0xAB, 0xE0, 0xBA, 0xA1, 0x46, 0xE0,
+	0xBB, 0x8D, 0xE0, 0xBA, 0xB2, 0x46, 0xE0, 0xBD,
+	0x80, 0xE0, 0xBE, 0xB5, 0x46, 0xE0, 0xBD, 0x82,
+	0xE0, 0xBE, 0xB7, 0x46, 0xE0, 0xBD, 0x8C, 0xE0,
+	// Bytes 2780 - 27bf
+	0xBE, 0xB7, 0x46, 0xE0, 0xBD, 0x91, 0xE0, 0xBE,
+	0xB7, 0x46, 0xE0, 0xBD, 0x96, 0xE0, 0xBE, 0xB7,
+	0x46, 0xE0, 0xBD, 0x9B, 0xE0, 0xBE, 0xB7, 0x46,
+	0xE0, 0xBE, 0x90, 0xE0, 0xBE, 0xB5, 0x46, 0xE0,
+	0xBE, 0x92, 0xE0, 0xBE, 0xB7, 0x46, 0xE0, 0xBE,
+	0x9C, 0xE0, 0xBE, 0xB7, 0x46, 0xE0, 0xBE, 0xA1,
+	0xE0, 0xBE, 0xB7, 0x46, 0xE0, 0xBE, 0xA6, 0xE0,
+	0xBE, 0xB7, 0x46, 0xE0, 0xBE, 0xAB, 0xE0, 0xBE,
+	// Bytes 27c0 - 27ff
+	0xB7, 0x46, 0xE2, 0x80, 0xB2, 0xE2, 0x80, 0xB2,
+	0x46, 0xE2, 0x80, 0xB5, 0xE2, 0x80, 0xB5, 0x46,
+	0xE2, 0x88, 0xAB, 0xE2, 0x88, 0xAB, 0x46, 0xE2,
+	0x88, 0xAE, 0xE2, 0x88, 0xAE, 0x46, 0xE3, 0x81,
+	0xBB, 0xE3, 0x81, 0x8B, 0x46, 0xE3, 0x82, 0x88,
+	0xE3, 0x82, 0x8A, 0x46, 0xE3, 0x82, 0xAD, 0xE3,
+	0x83, 0xAD, 0x46, 0xE3, 0x82, 0xB3, 0xE3, 0x82,
+	0xB3, 0x46, 0xE3, 0x82, 0xB3, 0xE3, 0x83, 0x88,
+	// Bytes 2800 - 283f
+	0x46, 0xE3, 0x83, 0x88, 0xE3, 0x83, 0xB3, 0x46,
+	0xE3, 0x83, 0x8A, 0xE3, 0x83, 0x8E, 0x46, 0xE3,
+	0x83, 0x9B, 0xE3, 0x83, 0xB3, 0x46, 0xE3, 0x83,
+	0x9F, 0xE3, 0x83, 0xAA, 0x46, 0xE3, 0x83, 0xAA,
+	0xE3, 0x83, 0xA9, 0x46, 0xE3, 0x83, 0xAC, 0xE3,
+	0x83, 0xA0, 0x46, 0xE4, 0xBB, 0xA4, 0xE5, 0x92,
+	0x8C, 0x46, 0xE5, 0xA4, 0xA7, 0xE6, 0xAD, 0xA3,
+	0x46, 0xE5, 0xB9, 0xB3, 0xE6, 0x88, 0x90, 0x46,
+	// Bytes 2840 - 287f
+	0xE6, 0x98, 0x8E, 0xE6, 0xB2, 0xBB, 0x46, 0xE6,
+	0x98, 0xAD, 0xE5, 0x92, 0x8C, 0x47, 0x72, 0x61,
+	0x64, 0xE2, 0x88, 0x95, 0x73, 0x47, 0xE3, 0x80,
+	0x94, 0x53, 0xE3, 0x80, 0x95, 0x48, 0x28, 0xE1,
+	0x84, 0x80, 0xE1, 0x85, 0xA1, 0x29, 0x48, 0x28,
+	0xE1, 0x84, 0x82, 0xE1, 0x85, 0xA1, 0x29, 0x48,
+	0x28, 0xE1, 0x84, 0x83, 0xE1, 0x85, 0xA1, 0x29,
+	0x48, 0x28, 0xE1, 0x84, 0x85, 0xE1, 0x85, 0xA1,
+	// Bytes 2880 - 28bf
+	0x29, 0x48, 0x28, 0xE1, 0x84, 0x86, 0xE1, 0x85,
+	0xA1, 0x29, 0x48, 0x28, 0xE1, 0x84, 0x87, 0xE1,
+	0x85, 0xA1, 0x29, 0x48, 0x28, 0xE1, 0x84, 0x89,
+	0xE1, 0x85, 0xA1, 0x29, 0x48, 0x28, 0xE1, 0x84,
+	0x8B, 0xE1, 0x85, 0xA1, 0x29, 0x48, 0x28, 0xE1,
+	0x84, 0x8C, 0xE1, 0x85, 0xA1, 0x29, 0x48, 0x28,
+	0xE1, 0x84, 0x8C, 0xE1, 0x85, 0xAE, 0x29, 0x48,
+	0x28, 0xE1, 0x84, 0x8E, 0xE1, 0x85, 0xA1, 0x29,
+	// Bytes 28c0 - 28ff
+	0x48, 0x28, 0xE1, 0x84, 0x8F, 0xE1, 0x85, 0xA1,
+	0x29, 0x48, 0x28, 0xE1, 0x84, 0x90, 0xE1, 0x85,
+	0xA1, 0x29, 0x48, 0x28, 0xE1, 0x84, 0x91, 0xE1,
+	0x85, 0xA1, 0x29, 0x48, 0x28, 0xE1, 0x84, 0x92,
+	0xE1, 0x85, 0xA1, 0x29, 0x48, 0x72, 0x61, 0x64,
+	0xE2, 0x88, 0x95, 0x73, 0x32, 0x48, 0xD8, 0xA7,
+	0xD9, 0x83, 0xD8, 0xA8, 0xD8, 0xB1, 0x48, 0xD8,
+	0xA7, 0xD9, 0x84, 0xD9, 0x84, 0xD9, 0x87, 0x48,
+	// Bytes 2900 - 293f
+	0xD8, 0xB1, 0xD8, 0xB3, 0xD9, 0x88, 0xD9, 0x84,
+	0x48, 0xD8, 0xB1, 0xDB, 0x8C, 0xD8, 0xA7, 0xD9,
+	0x84, 0x48, 0xD8, 0xB5, 0xD9, 0x84, 0xD8, 0xB9,
+	0xD9, 0x85, 0x48, 0xD8, 0xB9, 0xD9, 0x84, 0xD9,
+	0x8A, 0xD9, 0x87, 0x48, 0xD9, 0x85, 0xD8, 0xAD,
+	0xD9, 0x85, 0xD8, 0xAF, 0x48, 0xD9, 0x88, 0xD8,
+	0xB3, 0xD9, 0x84, 0xD9, 0x85, 0x49, 0xE2, 0x80,
+	0xB2, 0xE2, 0x80, 0xB2, 0xE2, 0x80, 0xB2, 0x49,
+	// Bytes 2940 - 297f
+	0xE2, 0x80, 0xB5, 0xE2, 0x80, 0xB5, 0xE2, 0x80,
+	0xB5, 0x49, 0xE2, 0x88, 0xAB, 0xE2, 0x88, 0xAB,
+	0xE2, 0x88, 0xAB, 0x49, 0xE2, 0x88, 0xAE, 0xE2,
+	0x88, 0xAE, 0xE2, 0x88, 0xAE, 0x49, 0xE3, 0x80,
+	0x94, 0xE4, 0xB8, 0x89, 0xE3, 0x80, 0x95, 0x49,
+	0xE3, 0x80, 0x94, 0xE4, 0xBA, 0x8C, 0xE3, 0x80,
+	0x95, 0x49, 0xE3, 0x80, 0x94, 0xE5, 0x8B, 0x9D,
+	0xE3, 0x80, 0x95, 0x49, 0xE3, 0x80, 0x94, 0xE5,
+	// Bytes 2980 - 29bf
+	0xAE, 0x89, 0xE3, 0x80, 0x95, 0x49, 0xE3, 0x80,
+	0x94, 0xE6, 0x89, 0x93, 0xE3, 0x80, 0x95, 0x49,
+	0xE3, 0x80, 0x94, 0xE6, 0x95, 0x97, 0xE3, 0x80,
+	0x95, 0x49, 0xE3, 0x80, 0x94, 0xE6, 0x9C, 0xAC,
+	0xE3, 0x80, 0x95, 0x49, 0xE3, 0x80, 0x94, 0xE7,
+	0x82, 0xB9, 0xE3, 0x80, 0x95, 0x49, 0xE3, 0x80,
+	0x94, 0xE7, 0x9B, 0x97, 0xE3, 0x80, 0x95, 0x49,
+	0xE3, 0x82, 0xA2, 0xE3, 0x83, 0xBC, 0xE3, 0x83,
+	// Bytes 29c0 - 29ff
+	0xAB, 0x49, 0xE3, 0x82, 0xA4, 0xE3, 0x83, 0xB3,
+	0xE3, 0x83, 0x81, 0x49, 0xE3, 0x82, 0xA6, 0xE3,
+	0x82, 0xA9, 0xE3, 0x83, 0xB3, 0x49, 0xE3, 0x82,
+	0xAA, 0xE3, 0x83, 0xB3, 0xE3, 0x82, 0xB9, 0x49,
+	0xE3, 0x82, 0xAA, 0xE3, 0x83, 0xBC, 0xE3, 0x83,
+	0xA0, 0x49, 0xE3, 0x82, 0xAB, 0xE3, 0x82, 0xA4,
+	0xE3, 0x83, 0xAA, 0x49, 0xE3, 0x82, 0xB1, 0xE3,
+	0x83, 0xBC, 0xE3, 0x82, 0xB9, 0x49, 0xE3, 0x82,
+	// Bytes 2a00 - 2a3f
+	0xB3, 0xE3, 0x83, 0xAB, 0xE3, 0x83, 0x8A, 0x49,
+	0xE3, 0x82, 0xBB, 0xE3, 0x83, 0xB3, 0xE3, 0x83,
+	0x81, 0x49, 0xE3, 0x82, 0xBB, 0xE3, 0x83, 0xB3,
+	0xE3, 0x83, 0x88, 0x49, 0xE3, 0x83, 0x86, 0xE3,
+	0x82, 0x99, 0xE3, 0x82, 0xB7, 0x49, 0xE3, 0x83,
+	0x88, 0xE3, 0x82, 0x99, 0xE3, 0x83, 0xAB, 0x49,
+	0xE3, 0x83, 0x8E, 0xE3, 0x83, 0x83, 0xE3, 0x83,
+	0x88, 0x49, 0xE3, 0x83, 0x8F, 0xE3, 0x82, 0xA4,
+	// Bytes 2a40 - 2a7f
+	0xE3, 0x83, 0x84, 0x49, 0xE3, 0x83, 0x92, 0xE3,
+	0x82, 0x99, 0xE3, 0x83, 0xAB, 0x49, 0xE3, 0x83,
+	0x92, 0xE3, 0x82, 0x9A, 0xE3, 0x82, 0xB3, 0x49,
+	0xE3, 0x83, 0x95, 0xE3, 0x83, 0xA9, 0xE3, 0x83,
+	0xB3, 0x49, 0xE3, 0x83, 0x98, 0xE3, 0x82, 0x9A,
+	0xE3, 0x82, 0xBD, 0x49, 0xE3, 0x83, 0x98, 0xE3,
+	0x83, 0xAB, 0xE3, 0x83, 0x84, 0x49, 0xE3, 0x83,
+	0x9B, 0xE3, 0x83, 0xBC, 0xE3, 0x83, 0xAB, 0x49,
+	// Bytes 2a80 - 2abf
+	0xE3, 0x83, 0x9B, 0xE3, 0x83, 0xBC, 0xE3, 0x83,
+	0xB3, 0x49, 0xE3, 0x83, 0x9E, 0xE3, 0x82, 0xA4,
+	0xE3, 0x83, 0xAB, 0x49, 0xE3, 0x83, 0x9E, 0xE3,
+	0x83, 0x83, 0xE3, 0x83, 0x8F, 0x49, 0xE3, 0x83,
+	0x9E, 0xE3, 0x83, 0xAB, 0xE3, 0x82, 0xAF, 0x49,
+	0xE3, 0x83, 0xA4, 0xE3, 0x83, 0xBC, 0xE3, 0x83,
+	0xAB, 0x49, 0xE3, 0x83, 0xA6, 0xE3, 0x82, 0xA2,
+	0xE3, 0x83, 0xB3, 0x49, 0xE3, 0x83, 0xAF, 0xE3,
+	// Bytes 2ac0 - 2aff
+	0x83, 0x83, 0xE3, 0x83, 0x88, 0x4C, 0xE2, 0x80,
+	0xB2, 0xE2, 0x80, 0xB2, 0xE2, 0x80, 0xB2, 0xE2,
+	0x80, 0xB2, 0x4C, 0xE2, 0x88, 0xAB, 0xE2, 0x88,
+	0xAB, 0xE2, 0x88, 0xAB, 0xE2, 0x88, 0xAB, 0x4C,
+	0xE3, 0x82, 0xA2, 0xE3, 0x83, 0xAB, 0xE3, 0x83,
+	0x95, 0xE3, 0x82, 0xA1, 0x4C, 0xE3, 0x82, 0xA8,
+	0xE3, 0x83, 0xBC, 0xE3, 0x82, 0xAB, 0xE3, 0x83,
+	0xBC, 0x4C, 0xE3, 0x82, 0xAB, 0xE3, 0x82, 0x99,
+	// Bytes 2b00 - 2b3f
+	0xE3, 0x83, 0xAD, 0xE3, 0x83, 0xB3, 0x4C, 0xE3,
+	0x82, 0xAB, 0xE3, 0x82, 0x99, 0xE3, 0x83, 0xB3,
+	0xE3, 0x83, 0x9E, 0x4C, 0xE3, 0x82, 0xAB, 0xE3,
+	0x83, 0xA9, 0xE3, 0x83, 0x83, 0xE3, 0x83, 0x88,
+	0x4C, 0xE3, 0x82, 0xAB, 0xE3, 0x83, 0xAD, 0xE3,
+	0x83, 0xAA, 0xE3, 0x83, 0xBC, 0x4C, 0xE3, 0x82,
+	0xAD, 0xE3, 0x82, 0x99, 0xE3, 0x83, 0x8B, 0xE3,
+	0x83, 0xBC, 0x4C, 0xE3, 0x82, 0xAD, 0xE3, 0x83,
+	// Bytes 2b40 - 2b7f
+	0xA5, 0xE3, 0x83, 0xAA, 0xE3, 0x83, 0xBC, 0x4C,
+	0xE3, 0x82, 0xAF, 0xE3, 0x82, 0x99, 0xE3, 0x83,
+	0xA9, 0xE3, 0x83, 0xA0, 0x4C, 0xE3, 0x82, 0xAF,
+	0xE3, 0x83, 0xAD, 0xE3, 0x83, 0xBC, 0xE3, 0x83,
+	0x8D, 0x4C, 0xE3, 0x82, 0xB5, 0xE3, 0x82, 0xA4,
+	0xE3, 0x82, 0xAF, 0xE3, 0x83, 0xAB, 0x4C, 0xE3,
+	0x82, 0xBF, 0xE3, 0x82, 0x99, 0xE3, 0x83, 0xBC,
+	0xE3, 0x82, 0xB9, 0x4C, 0xE3, 0x83, 0x8F, 0xE3,
+	// Bytes 2b80 - 2bbf
+	0x82, 0x9A, 0xE3, 0x83, 0xBC, 0xE3, 0x83, 0x84,
+	0x4C, 0xE3, 0x83, 0x92, 0xE3, 0x82, 0x9A, 0xE3,
+	0x82, 0xAF, 0xE3, 0x83, 0xAB, 0x4C, 0xE3, 0x83,
+	0x95, 0xE3, 0x82, 0xA3, 0xE3, 0x83, 0xBC, 0xE3,
+	0x83, 0x88, 0x4C, 0xE3, 0x83, 0x98, 0xE3, 0x82,
+	0x99, 0xE3, 0x83, 0xBC, 0xE3, 0x82, 0xBF, 0x4C,
+	0xE3, 0x83, 0x98, 0xE3, 0x82, 0x9A, 0xE3, 0x83,
+	0x8B, 0xE3, 0x83, 0x92, 0x4C, 0xE3, 0x83, 0x98,
+	// Bytes 2bc0 - 2bff
+	0xE3, 0x82, 0x9A, 0xE3, 0x83, 0xB3, 0xE3, 0x82,
+	0xB9, 0x4C, 0xE3, 0x83, 0x9B, 0xE3, 0x82, 0x99,
+	0xE3, 0x83, 0xAB, 0xE3, 0x83, 0x88, 0x4C, 0xE3,
+	0x83, 0x9E, 0xE3, 0x82, 0xA4, 0xE3, 0x82, 0xAF,
+	0xE3, 0x83, 0xAD, 0x4C, 0xE3, 0x83, 0x9F, 0xE3,
+	0x82, 0xAF, 0xE3, 0x83, 0xAD, 0xE3, 0x83, 0xB3,
+	0x4C, 0xE3, 0x83, 0xA1, 0xE3, 0x83, 0xBC, 0xE3,
+	0x83, 0x88, 0xE3, 0x83, 0xAB, 0x4C, 0xE3, 0x83,
+	// Bytes 2c00 - 2c3f
+	0xAA, 0xE3, 0x83, 0x83, 0xE3, 0x83, 0x88, 0xE3,
+	0x83, 0xAB, 0x4C, 0xE3, 0x83, 0xAB, 0xE3, 0x83,
+	0x92, 0xE3, 0x82, 0x9A, 0xE3, 0x83, 0xBC, 0x4C,
+	0xE6, 0xA0, 0xAA, 0xE5, 0xBC, 0x8F, 0xE4, 0xBC,
+	0x9A, 0xE7, 0xA4, 0xBE, 0x4E, 0x28, 0xE1, 0x84,
+	0x8B, 0xE1, 0x85, 0xA9, 0xE1, 0x84, 0x92, 0xE1,
+	0x85, 0xAE, 0x29, 0x4F, 0xD8, 0xAC, 0xD9, 0x84,
+	0x20, 0xD8, 0xAC, 0xD9, 0x84, 0xD8, 0xA7, 0xD9,
+	// Bytes 2c40 - 2c7f
+	0x84, 0xD9, 0x87, 0x4F, 0xE3, 0x82, 0xA2, 0xE3,
+	0x83, 0x8F, 0xE3, 0x82, 0x9A, 0xE3, 0x83, 0xBC,
+	0xE3, 0x83, 0x88, 0x4F, 0xE3, 0x82, 0xA2, 0xE3,
+	0x83, 0xB3, 0xE3, 0x83, 0x98, 0xE3, 0x82, 0x9A,
+	0xE3, 0x82, 0xA2, 0x4F, 0xE3, 0x82, 0xAD, 0xE3,
+	0x83, 0xAD, 0xE3, 0x83, 0xAF, 0xE3, 0x83, 0x83,
+	0xE3, 0x83, 0x88, 0x4F, 0xE3, 0x82, 0xB5, 0xE3,
+	0x83, 0xB3, 0xE3, 0x83, 0x81, 0xE3, 0x83, 0xBC,
+	// Bytes 2c80 - 2cbf
+	0xE3, 0x83, 0xA0, 0x4F, 0xE3, 0x83, 0x8F, 0xE3,
+	0x82, 0x99, 0xE3, 0x83, 0xBC, 0xE3, 0x83, 0xAC,
+	0xE3, 0x83, 0xAB, 0x4F, 0xE3, 0x83, 0x98, 0xE3,
+	0x82, 0xAF, 0xE3, 0x82, 0xBF, 0xE3, 0x83, 0xBC,
+	0xE3, 0x83, 0xAB, 0x4F, 0xE3, 0x83, 0x9B, 0xE3,
+	0x82, 0x9A, 0xE3, 0x82, 0xA4, 0xE3, 0x83, 0xB3,
+	0xE3, 0x83, 0x88, 0x4F, 0xE3, 0x83, 0x9E, 0xE3,
+	0x83, 0xB3, 0xE3, 0x82, 0xB7, 0xE3, 0x83, 0xA7,
+	// Bytes 2cc0 - 2cff
+	0xE3, 0x83, 0xB3, 0x4F, 0xE3, 0x83, 0xA1, 0xE3,
+	0x82, 0xAB, 0xE3, 0x82, 0x99, 0xE3, 0x83, 0x88,
+	0xE3, 0x83, 0xB3, 0x4F, 0xE3, 0x83, 0xAB, 0xE3,
+	0x83, 0xBC, 0xE3, 0x83, 0x95, 0xE3, 0x82, 0x99,
+	0xE3, 0x83, 0xAB, 0x51, 0x28, 0xE1, 0x84, 0x8B,
+	0xE1, 0x85, 0xA9, 0xE1, 0x84, 0x8C, 0xE1, 0x85,
+	0xA5, 0xE1, 0x86, 0xAB, 0x29, 0x52, 0xE3, 0x82,
+	0xAD, 0xE3, 0x82, 0x99, 0xE3, 0x83, 0xAB, 0xE3,
+	// Bytes 2d00 - 2d3f
+	0x82, 0xBF, 0xE3, 0x82, 0x99, 0xE3, 0x83, 0xBC,
+	0x52, 0xE3, 0x82, 0xAD, 0xE3, 0x83, 0xAD, 0xE3,
+	0x82, 0xAF, 0xE3, 0x82, 0x99, 0xE3, 0x83, 0xA9,
+	0xE3, 0x83, 0xA0, 0x52, 0xE3, 0x82, 0xAD, 0xE3,
+	0x83, 0xAD, 0xE3, 0x83, 0xA1, 0xE3, 0x83, 0xBC,
+	0xE3, 0x83, 0x88, 0xE3, 0x83, 0xAB, 0x52, 0xE3,
+	0x82, 0xAF, 0xE3, 0x82, 0x99, 0xE3, 0x83, 0xA9,
+	0xE3, 0x83, 0xA0, 0xE3, 0x83, 0x88, 0xE3, 0x83,
+	// Bytes 2d40 - 2d7f
+	0xB3, 0x52, 0xE3, 0x82, 0xAF, 0xE3, 0x83, 0xAB,
+	0xE3, 0x82, 0xBB, 0xE3, 0x82, 0x99, 0xE3, 0x82,
+	0xA4, 0xE3, 0x83, 0xAD, 0x52, 0xE3, 0x83, 0x8F,
+	0xE3, 0x82, 0x9A, 0xE3, 0x83, 0xBC, 0xE3, 0x82,
+	0xBB, 0xE3, 0x83, 0xB3, 0xE3, 0x83, 0x88, 0x52,
+	0xE3, 0x83, 0x92, 0xE3, 0x82, 0x9A, 0xE3, 0x82,
+	0xA2, 0xE3, 0x82, 0xB9, 0xE3, 0x83, 0x88, 0xE3,
+	0x83, 0xAB, 0x52, 0xE3, 0x83, 0x95, 0xE3, 0x82,
+	// Bytes 2d80 - 2dbf
+	0x99, 0xE3, 0x83, 0x83, 0xE3, 0x82, 0xB7, 0xE3,
+	0x82, 0xA7, 0xE3, 0x83, 0xAB, 0x52, 0xE3, 0x83,
+	0x9F, 0xE3, 0x83, 0xAA, 0xE3, 0x83, 0x8F, 0xE3,
+	0x82, 0x99, 0xE3, 0x83, 0xBC, 0xE3, 0x83, 0xAB,
+	0x52, 0xE3, 0x83, 0xAC, 0xE3, 0x83, 0xB3, 0xE3,
+	0x83, 0x88, 0xE3, 0x82, 0xB1, 0xE3, 0x82, 0x99,
+	0xE3, 0x83, 0xB3, 0x61, 0xD8, 0xB5, 0xD9, 0x84,
+	0xD9, 0x89, 0x20, 0xD8, 0xA7, 0xD9, 0x84, 0xD9,
+	// Bytes 2dc0 - 2dff
+	0x84, 0xD9, 0x87, 0x20, 0xD8, 0xB9, 0xD9, 0x84,
+	0xD9, 0x8A, 0xD9, 0x87, 0x20, 0xD9, 0x88, 0xD8,
+	0xB3, 0xD9, 0x84, 0xD9, 0x85, 0x06, 0xE0, 0xA7,
+	0x87, 0xE0, 0xA6, 0xBE, 0x01, 0x06, 0xE0, 0xA7,
+	0x87, 0xE0, 0xA7, 0x97, 0x01, 0x06, 0xE0, 0xAD,
+	0x87, 0xE0, 0xAC, 0xBE, 0x01, 0x06, 0xE0, 0xAD,
+	0x87, 0xE0, 0xAD, 0x96, 0x01, 0x06, 0xE0, 0xAD,
+	0x87, 0xE0, 0xAD, 0x97, 0x01, 0x06, 0xE0, 0xAE,
+	// Bytes 2e00 - 2e3f
+	0x92, 0xE0, 0xAF, 0x97, 0x01, 0x06, 0xE0, 0xAF,
+	0x86, 0xE0, 0xAE, 0xBE, 0x01, 0x06, 0xE0, 0xAF,
+	0x86, 0xE0, 0xAF, 0x97, 0x01, 0x06, 0xE0, 0xAF,
+	0x87, 0xE0, 0xAE, 0xBE, 0x01, 0x06, 0xE0, 0xB2,
+	0xBF, 0xE0, 0xB3, 0x95, 0x01, 0x06, 0xE0, 0xB3,
+	0x86, 0xE0, 0xB3, 0x95, 0x01, 0x06, 0xE0, 0xB3,
+	0x86, 0xE0, 0xB3, 0x96, 0x01, 0x06, 0xE0, 0xB5,
+	0x86, 0xE0, 0xB4, 0xBE, 0x01, 0x06, 0xE0, 0xB5,
+	// Bytes 2e40 - 2e7f
+	0x86, 0xE0, 0xB5, 0x97, 0x01, 0x06, 0xE0, 0xB5,
+	0x87, 0xE0, 0xB4, 0xBE, 0x01, 0x06, 0xE0, 0xB7,
+	0x99, 0xE0, 0xB7, 0x9F, 0x01, 0x06, 0xE1, 0x80,
+	0xA5, 0xE1, 0x80, 0xAE, 0x01, 0x06, 0xE1, 0xAC,
+	0x85, 0xE1, 0xAC, 0xB5, 0x01, 0x06, 0xE1, 0xAC,
+	0x87, 0xE1, 0xAC, 0xB5, 0x01, 0x06, 0xE1, 0xAC,
+	0x89, 0xE1, 0xAC, 0xB5, 0x01, 0x06, 0xE1, 0xAC,
+	0x8B, 0xE1, 0xAC, 0xB5, 0x01, 0x06, 0xE1, 0xAC,
+	// Bytes 2e80 - 2ebf
+	0x8D, 0xE1, 0xAC, 0xB5, 0x01, 0x06, 0xE1, 0xAC,
+	0x91, 0xE1, 0xAC, 0xB5, 0x01, 0x06, 0xE1, 0xAC,
+	0xBA, 0xE1, 0xAC, 0xB5, 0x01, 0x06, 0xE1, 0xAC,
+	0xBC, 0xE1, 0xAC, 0xB5, 0x01, 0x06, 0xE1, 0xAC,
+	0xBE, 0xE1, 0xAC, 0xB5, 0x01, 0x06, 0xE1, 0xAC,
+	0xBF, 0xE1, 0xAC, 0xB5, 0x01, 0x06, 0xE1, 0xAD,
+	0x82, 0xE1, 0xAC, 0xB5, 0x01, 0x08, 0xF0, 0x91,
+	0x84, 0xB1, 0xF0, 0x91, 0x84, 0xA7, 0x01, 0x08,
+	// Bytes 2ec0 - 2eff
+	0xF0, 0x91, 0x84, 0xB2, 0xF0, 0x91, 0x84, 0xA7,
+	0x01, 0x08, 0xF0, 0x91, 0x8D, 0x87, 0xF0, 0x91,
+	0x8C, 0xBE, 0x01, 0x08, 0xF0, 0x91, 0x8D, 0x87,
+	0xF0, 0x91, 0x8D, 0x97, 0x01, 0x08, 0xF0, 0x91,
+	0x92, 0xB9, 0xF0, 0x91, 0x92, 0xB0, 0x01, 0x08,
+	0xF0, 0x91, 0x92, 0xB9, 0xF0, 0x91, 0x92, 0xBA,
+	0x01, 0x08, 0xF0, 0x91, 0x92, 0xB9, 0xF0, 0x91,
+	0x92, 0xBD, 0x01, 0x08, 0xF0, 0x91, 0x96, 0xB8,
+	// Bytes 2f00 - 2f3f
+	0xF0, 0x91, 0x96, 0xAF, 0x01, 0x08, 0xF0, 0x91,
+	0x96, 0xB9, 0xF0, 0x91, 0x96, 0xAF, 0x01, 0x08,
+	0xF0, 0x91, 0xA4, 0xB5, 0xF0, 0x91, 0xA4, 0xB0,
+	0x01, 0x09, 0xE0, 0xB3, 0x86, 0xE0, 0xB3, 0x82,
+	0xE0, 0xB3, 0x95, 0x02, 0x09, 0xE0, 0xB7, 0x99,
+	0xE0, 0xB7, 0x8F, 0xE0, 0xB7, 0x8A, 0x16, 0x44,
+	0x44, 0x5A, 0xCC, 0x8C, 0xCD, 0x44, 0x44, 0x7A,
+	0xCC, 0x8C, 0xCD, 0x44, 0x64, 0x7A, 0xCC, 0x8C,
+	// Bytes 2f40 - 2f7f
+	0xCD, 0x46, 0xD9, 0x84, 0xD8, 0xA7, 0xD9, 0x93,
+	0xCD, 0x46, 0xD9, 0x84, 0xD8, 0xA7, 0xD9, 0x94,
+	0xCD, 0x46, 0xD9, 0x84, 0xD8, 0xA7, 0xD9, 0x95,
+	0xB9, 0x46, 0xE1, 0x84, 0x80, 0xE1, 0x85, 0xA1,
+	0x01, 0x46, 0xE1, 0x84, 0x82, 0xE1, 0x85, 0xA1,
+	0x01, 0x46, 0xE1, 0x84, 0x83, 0xE1, 0x85, 0xA1,
+	0x01, 0x46, 0xE1, 0x84, 0x85, 0xE1, 0x85, 0xA1,
+	0x01, 0x46, 0xE1, 0x84, 0x86, 0xE1, 0x85, 0xA1,
+	// Bytes 2f80 - 2fbf
+	0x01, 0x46, 0xE1, 0x84, 0x87, 0xE1, 0x85, 0xA1,
+	0x01, 0x46, 0xE1, 0x84, 0x89, 0xE1, 0x85, 0xA1,
+	0x01, 0x46, 0xE1, 0x84, 0x8B, 0xE1, 0x85, 0xA1,
+	0x01, 0x46, 0xE1, 0x84, 0x8B, 0xE1, 0x85, 0xAE,
+	0x01, 0x46, 0xE1, 0x84, 0x8C, 0xE1, 0x85, 0xA1,
+	0x01, 0x46, 0xE1, 0x84, 0x8E, 0xE1, 0x85, 0xA1,
+	0x01, 0x46, 0xE1, 0x84, 0x8F, 0xE1, 0x85, 0xA1,
+	0x01, 0x46, 0xE1, 0x84, 0x90, 0xE1, 0x85, 0xA1,
+	// Bytes 2fc0 - 2fff
+	0x01, 0x46, 0xE1, 0x84, 0x91, 0xE1, 0x85, 0xA1,
+	0x01, 0x46, 0xE1, 0x84, 0x92, 0xE1, 0x85, 0xA1,
+	0x01, 0x49, 0xE3, 0x83, 0xA1, 0xE3, 0x82, 0xAB,
+	0xE3, 0x82, 0x99, 0x11, 0x4C, 0xE1, 0x84, 0x8C,
+	0xE1, 0x85, 0xAE, 0xE1, 0x84, 0x8B, 0xE1, 0x85,
+	0xB4, 0x01, 0x4C, 0xE3, 0x82, 0xAD, 0xE3, 0x82,
+	0x99, 0xE3, 0x82, 0xAB, 0xE3, 0x82, 0x99, 0x11,
+	0x4C, 0xE3, 0x82, 0xB3, 0xE3, 0x83, 0xBC, 0xE3,
+	// Bytes 3000 - 303f
+	0x83, 0x9B, 0xE3, 0x82, 0x9A, 0x11, 0x4C, 0xE3,
+	0x83, 0xA4, 0xE3, 0x83, 0xBC, 0xE3, 0x83, 0x88,
+	0xE3, 0x82, 0x99, 0x11, 0x4F, 0xE1, 0x84, 0x8E,
+	0xE1, 0x85, 0xA1, 0xE1, 0x86, 0xB7, 0xE1, 0x84,
+	0x80, 0xE1, 0x85, 0xA9, 0x01, 0x4F, 0xE3, 0x82,
+	0xA4, 0xE3, 0x83, 0x8B, 0xE3, 0x83, 0xB3, 0xE3,
+	0x82, 0xAF, 0xE3, 0x82, 0x99, 0x11, 0x4F, 0xE3,
+	0x82, 0xB7, 0xE3, 0x83, 0xAA, 0xE3, 0x83, 0xB3,
+	// Bytes 3040 - 307f
+	0xE3, 0x82, 0xAF, 0xE3, 0x82, 0x99, 0x11, 0x4F,
+	0xE3, 0x83, 0x98, 0xE3, 0x82, 0x9A, 0xE3, 0x83,
+	0xBC, 0xE3, 0x82, 0xB7, 0xE3, 0x82, 0x99, 0x11,
+	0x4F, 0xE3, 0x83, 0x9B, 0xE3, 0x82, 0x9A, 0xE3,
+	0x83, 0xB3, 0xE3, 0x83, 0x88, 0xE3, 0x82, 0x99,
+	0x11, 0x52, 0xE3, 0x82, 0xA8, 0xE3, 0x82, 0xB9,
+	0xE3, 0x82, 0xAF, 0xE3, 0x83, 0xBC, 0xE3, 0x83,
+	0x88, 0xE3, 0x82, 0x99, 0x11, 0x52, 0xE3, 0x83,
+	// Bytes 3080 - 30bf
+	0x95, 0xE3, 0x82, 0xA1, 0xE3, 0x83, 0xA9, 0xE3,
+	0x83, 0x83, 0xE3, 0x83, 0x88, 0xE3, 0x82, 0x99,
+	0x11, 0x86, 0xE0, 0xB3, 0x86, 0xE0, 0xB3, 0x82,
+	0x01, 0x86, 0xE0, 0xB7, 0x99, 0xE0, 0xB7, 0x8F,
+	0x01, 0x03, 0x3C, 0xCC, 0xB8, 0x05, 0x03, 0x3D,
+	0xCC, 0xB8, 0x05, 0x03, 0x3E, 0xCC, 0xB8, 0x05,
+	0x03, 0x41, 0xCC, 0x80, 0xCD, 0x03, 0x41, 0xCC,
+	0x81, 0xCD, 0x03, 0x41, 0xCC, 0x83, 0xCD, 0x03,
+	// Bytes 30c0 - 30ff
+	0x41, 0xCC, 0x84, 0xCD, 0x03, 0x41, 0xCC, 0x89,
+	0xCD, 0x03, 0x41, 0xCC, 0x8C, 0xCD, 0x03, 0x41,
+	0xCC, 0x8F, 0xCD, 0x03, 0x41, 0xCC, 0x91, 0xCD,
+	0x03, 0x41, 0xCC, 0xA5, 0xB9, 0x03, 0x41, 0xCC,
+	0xA8, 0xA9, 0x03, 0x42, 0xCC, 0x87, 0xCD, 0x03,
+	0x42, 0xCC, 0xA3, 0xB9, 0x03, 0x42, 0xCC, 0xB1,
+	0xB9, 0x03, 0x43, 0xCC, 0x81, 0xCD, 0x03, 0x43,
+	0xCC, 0x82, 0xCD, 0x03, 0x43, 0xCC, 0x87, 0xCD,
+	// Bytes 3100 - 313f
+	0x03, 0x43, 0xCC, 0x8C, 0xCD, 0x03, 0x44, 0xCC,
+	0x87, 0xCD, 0x03, 0x44, 0xCC, 0x8C, 0xCD, 0x03,
+	0x44, 0xCC, 0xA3, 0xB9, 0x03, 0x44, 0xCC, 0xA7,
+	0xA9, 0x03, 0x44, 0xCC, 0xAD, 0xB9, 0x03, 0x44,
+	0xCC, 0xB1, 0xB9, 0x03, 0x45, 0xCC, 0x80, 0xCD,
+	0x03, 0x45, 0xCC, 0x81, 0xCD, 0x03, 0x45, 0xCC,
+	0x83, 0xCD, 0x03, 0x45, 0xCC, 0x86, 0xCD, 0x03,
+	0x45, 0xCC, 0x87, 0xCD, 0x03, 0x45, 0xCC, 0x88,
+	// Bytes 3140 - 317f
+	0xCD, 0x03, 0x45, 0xCC, 0x89, 0xCD, 0x03, 0x45,
+	0xCC, 0x8C, 0xCD, 0x03, 0x45, 0xCC, 0x8F, 0xCD,
+	0x03, 0x45, 0xCC, 0x91, 0xCD, 0x03, 0x45, 0xCC,
+	0xA8, 0xA9, 0x03, 0x45, 0xCC, 0xAD, 0xB9, 0x03,
+	0x45, 0xCC, 0xB0, 0xB9, 0x03, 0x46, 0xCC, 0x87,
+	0xCD, 0x03, 0x47, 0xCC, 0x81, 0xCD, 0x03, 0x47,
+	0xCC, 0x82, 0xCD, 0x03, 0x47, 0xCC, 0x84, 0xCD,
+	0x03, 0x47, 0xCC, 0x86, 0xCD, 0x03, 0x47, 0xCC,
+	// Bytes 3180 - 31bf
+	0x87, 0xCD, 0x03, 0x47, 0xCC, 0x8C, 0xCD, 0x03,
+	0x47, 0xCC, 0xA7, 0xA9, 0x03, 0x48, 0xCC, 0x82,
+	0xCD, 0x03, 0x48, 0xCC, 0x87, 0xCD, 0x03, 0x48,
+	0xCC, 0x88, 0xCD, 0x03, 0x48, 0xCC, 0x8C, 0xCD,
+	0x03, 0x48, 0xCC, 0xA3, 0xB9, 0x03, 0x48, 0xCC,
+	0xA7, 0xA9, 0x03, 0x48, 0xCC, 0xAE, 0xB9, 0x03,
+	0x49, 0xCC, 0x80, 0xCD, 0x03, 0x49, 0xCC, 0x81,
+	0xCD, 0x03, 0x49, 0xCC, 0x82, 0xCD, 0x03, 0x49,
+	// Bytes 31c0 - 31ff
+	0xCC, 0x83, 0xCD, 0x03, 0x49, 0xCC, 0x84, 0xCD,
+	0x03, 0x49, 0xCC, 0x86, 0xCD, 0x03, 0x49, 0xCC,
+	0x87, 0xCD, 0x03, 0x49, 0xCC, 0x89, 0xCD, 0x03,
+	0x49, 0xCC, 0x8C, 0xCD, 0x03, 0x49, 0xCC, 0x8F,
+	0xCD, 0x03, 0x49, 0xCC, 0x91, 0xCD, 0x03, 0x49,
+	0xCC, 0xA3, 0xB9, 0x03, 0x49, 0xCC, 0xA8, 0xA9,
+	0x03, 0x49, 0xCC, 0xB0, 0xB9, 0x03, 0x4A, 0xCC,
+	0x82, 0xCD, 0x03, 0x4B, 0xCC, 0x81, 0xCD, 0x03,
+	// Bytes 3200 - 323f
+	0x4B, 0xCC, 0x8C, 0xCD, 0x03, 0x4B, 0xCC, 0xA3,
+	0xB9, 0x03, 0x4B, 0xCC, 0xA7, 0xA9, 0x03, 0x4B,
+	0xCC, 0xB1, 0xB9, 0x03, 0x4C, 0xCC, 0x81, 0xCD,
+	0x03, 0x4C, 0xCC, 0x8C, 0xCD, 0x03, 0x4C, 0xCC,
+	0xA7, 0xA9, 0x03, 0x4C, 0xCC, 0xAD, 0xB9, 0x03,
+	0x4C, 0xCC, 0xB1, 0xB9, 0x03, 0x4D, 0xCC, 0x81,
+	0xCD, 0x03, 0x4D, 0xCC, 0x87, 0xCD, 0x03, 0x4D,
+	0xCC, 0xA3, 0xB9, 0x03, 0x4E, 0xCC, 0x80, 0xCD,
+	// Bytes 3240 - 327f
+	0x03, 0x4E, 0xCC, 0x81, 0xCD, 0x03, 0x4E, 0xCC,
+	0x83, 0xCD, 0x03, 0x4E, 0xCC, 0x87, 0xCD, 0x03,
+	0x4E, 0xCC, 0x8C, 0xCD, 0x03, 0x4E, 0xCC, 0xA3,
+	0xB9, 0x03, 0x4E, 0xCC, 0xA7, 0xA9, 0x03, 0x4E,
+	0xCC, 0xAD, 0xB9, 0x03, 0x4E, 0xCC, 0xB1, 0xB9,
+	0x03, 0x4F, 0xCC, 0x80, 0xCD, 0x03, 0x4F, 0xCC,
+	0x81, 0xCD, 0x03, 0x4F, 0xCC, 0x86, 0xCD, 0x03,
+	0x4F, 0xCC, 0x89, 0xCD, 0x03, 0x4F, 0xCC, 0x8B,
+	// Bytes 3280 - 32bf
+	0xCD, 0x03, 0x4F, 0xCC, 0x8C, 0xCD, 0x03, 0x4F,
+	0xCC, 0x8F, 0xCD, 0x03, 0x4F, 0xCC, 0x91, 0xCD,
+	0x03, 0x50, 0xCC, 0x81, 0xCD, 0x03, 0x50, 0xCC,
+	0x87, 0xCD, 0x03, 0x52, 0xCC, 0x81, 0xCD, 0x03,
+	0x52, 0xCC, 0x87, 0xCD, 0x03, 0x52, 0xCC, 0x8C,
+	0xCD, 0x03, 0x52, 0xCC, 0x8F, 0xCD, 0x03, 0x52,
+	0xCC, 0x91, 0xCD, 0x03, 0x52, 0xCC, 0xA7, 0xA9,
+	0x03, 0x52, 0xCC, 0xB1, 0xB9, 0x03, 0x53, 0xCC,
+	// Bytes 32c0 - 32ff
+	0x82, 0xCD, 0x03, 0x53, 0xCC, 0x87, 0xCD, 0x03,
+	0x53, 0xCC, 0xA6, 0xB9, 0x03, 0x53, 0xCC, 0xA7,
+	0xA9, 0x03, 0x54, 0xCC, 0x87, 0xCD, 0x03, 0x54,
+	0xCC, 0x8C, 0xCD, 0x03, 0x54, 0xCC, 0xA3, 0xB9,
+	0x03, 0x54, 0xCC, 0xA6, 0xB9, 0x03, 0x54, 0xCC,
+	0xA7, 0xA9, 0x03, 0x54, 0xCC, 0xAD, 0xB9, 0x03,
+	0x54, 0xCC, 0xB1, 0xB9, 0x03, 0x55, 0xCC, 0x80,
+	0xCD, 0x03, 0x55, 0xCC, 0x81, 0xCD, 0x03, 0x55,
+	// Bytes 3300 - 333f
+	0xCC, 0x82, 0xCD, 0x03, 0x55, 0xCC, 0x86, 0xCD,
+	0x03, 0x55, 0xCC, 0x89, 0xCD, 0x03, 0x55, 0xCC,
+	0x8A, 0xCD, 0x03, 0x55, 0xCC, 0x8B, 0xCD, 0x03,
+	0x55, 0xCC, 0x8C, 0xCD, 0x03, 0x55, 0xCC, 0x8F,
+	0xCD, 0x03, 0x55, 0xCC, 0x91, 0xCD, 0x03, 0x55,
+	0xCC, 0xA3, 0xB9, 0x03, 0x55, 0xCC, 0xA4, 0xB9,
+	0x03, 0x55, 0xCC, 0xA8, 0xA9, 0x03, 0x55, 0xCC,
+	0xAD, 0xB9, 0x03, 0x55, 0xCC, 0xB0, 0xB9, 0x03,
+	// Bytes 3340 - 337f
+	0x56, 0xCC, 0x83, 0xCD, 0x03, 0x56, 0xCC, 0xA3,
+	0xB9, 0x03, 0x57, 0xCC, 0x80, 0xCD, 0x03, 0x57,
+	0xCC, 0x81, 0xCD, 0x03, 0x57, 0xCC, 0x82, 0xCD,
+	0x03, 0x57, 0xCC, 0x87, 0xCD, 0x03, 0x57, 0xCC,
+	0x88, 0xCD, 0x03, 0x57, 0xCC, 0xA3, 0xB9, 0x03,
+	0x58, 0xCC, 0x87, 0xCD, 0x03, 0x58, 0xCC, 0x88,
+	0xCD, 0x03, 0x59, 0xCC, 0x80, 0xCD, 0x03, 0x59,
+	0xCC, 0x81, 0xCD, 0x03, 0x59, 0xCC, 0x82, 0xCD,
+	// Bytes 3380 - 33bf
+	0x03, 0x59, 0xCC, 0x83, 0xCD, 0x03, 0x59, 0xCC,
+	0x84, 0xCD, 0x03, 0x59, 0xCC, 0x87, 0xCD, 0x03,
+	0x59, 0xCC, 0x88, 0xCD, 0x03, 0x59, 0xCC, 0x89,
+	0xCD, 0x03, 0x59, 0xCC, 0xA3, 0xB9, 0x03, 0x5A,
+	0xCC, 0x81, 0xCD, 0x03, 0x5A, 0xCC, 0x82, 0xCD,
+	0x03, 0x5A, 0xCC, 0x87, 0xCD, 0x03, 0x5A, 0xCC,
+	0x8C, 0xCD, 0x03, 0x5A, 0xCC, 0xA3, 0xB9, 0x03,
+	0x5A, 0xCC, 0xB1, 0xB9, 0x03, 0x61, 0xCC, 0x80,
+	// Bytes 33c0 - 33ff
+	0xCD, 0x03, 0x61, 0xCC, 0x81, 0xCD, 0x03, 0x61,
+	0xCC, 0x83, 0xCD, 0x03, 0x61, 0xCC, 0x84, 0xCD,
+	0x03, 0x61, 0xCC, 0x89, 0xCD, 0x03, 0x61, 0xCC,
+	0x8C, 0xCD, 0x03, 0x61, 0xCC, 0x8F, 0xCD, 0x03,
+	0x61, 0xCC, 0x91, 0xCD, 0x03, 0x61, 0xCC, 0xA5,
+	0xB9, 0x03, 0x61, 0xCC, 0xA8, 0xA9, 0x03, 0x62,
+	0xCC, 0x87, 0xCD, 0x03, 0x62, 0xCC, 0xA3, 0xB9,
+	0x03, 0x62, 0xCC, 0xB1, 0xB9, 0x03, 0x63, 0xCC,
+	// Bytes 3400 - 343f
+	0x81, 0xCD, 0x03, 0x63, 0xCC, 0x82, 0xCD, 0x03,
+	0x63, 0xCC, 0x87, 0xCD, 0x03, 0x63, 0xCC, 0x8C,
+	0xCD, 0x03, 0x64, 0xCC, 0x87, 0xCD, 0x03, 0x64,
+	0xCC, 0x8C, 0xCD, 0x03, 0x64, 0xCC, 0xA3, 0xB9,
+	0x03, 0x64, 0xCC, 0xA7, 0xA9, 0x03, 0x64, 0xCC,
+	0xAD, 0xB9, 0x03, 0x64, 0xCC, 0xB1, 0xB9, 0x03,
+	0x65, 0xCC, 0x80, 0xCD, 0x03, 0x65, 0xCC, 0x81,
+	0xCD, 0x03, 0x65, 0xCC, 0x83, 0xCD, 0x03, 0x65,
+	// Bytes 3440 - 347f
+	0xCC, 0x86, 0xCD, 0x03, 0x65, 0xCC, 0x87, 0xCD,
+	0x03, 0x65, 0xCC, 0x88, 0xCD, 0x03, 0x65, 0xCC,
+	0x89, 0xCD, 0x03, 0x65, 0xCC, 0x8C, 0xCD, 0x03,
+	0x65, 0xCC, 0x8F, 0xCD, 0x03, 0x65, 0xCC, 0x91,
+	0xCD, 0x03, 0x65, 0xCC, 0xA8, 0xA9, 0x03, 0x65,
+	0xCC, 0xAD, 0xB9, 0x03, 0x65, 0xCC, 0xB0, 0xB9,
+	0x03, 0x66, 0xCC, 0x87, 0xCD, 0x03, 0x67, 0xCC,
+	0x81, 0xCD, 0x03, 0x67, 0xCC, 0x82, 0xCD, 0x03,
+	// Bytes 3480 - 34bf
+	0x67, 0xCC, 0x84, 0xCD, 0x03, 0x67, 0xCC, 0x86,
+	0xCD, 0x03, 0x67, 0xCC, 0x87, 0xCD, 0x03, 0x67,
+	0xCC, 0x8C, 0xCD, 0x03, 0x67, 0xCC, 0xA7, 0xA9,
+	0x03, 0x68, 0xCC, 0x82, 0xCD, 0x03, 0x68, 0xCC,
+	0x87, 0xCD, 0x03, 0x68, 0xCC, 0x88, 0xCD, 0x03,
+	0x68, 0xCC, 0x8C, 0xCD, 0x03, 0x68, 0xCC, 0xA3,
+	0xB9, 0x03, 0x68, 0xCC, 0xA7, 0xA9, 0x03, 0x68,
+	0xCC, 0xAE, 0xB9, 0x03, 0x68, 0xCC, 0xB1, 0xB9,
+	// Bytes 34c0 - 34ff
+	0x03, 0x69, 0xCC, 0x80, 0xCD, 0x03, 0x69, 0xCC,
+	0x81, 0xCD, 0x03, 0x69, 0xCC, 0x82, 0xCD, 0x03,
+	0x69, 0xCC, 0x83, 0xCD, 0x03, 0x69, 0xCC, 0x84,
+	0xCD, 0x03, 0x69, 0xCC, 0x86, 0xCD, 0x03, 0x69,
+	0xCC, 0x89, 0xCD, 0x03, 0x69, 0xCC, 0x8C, 0xCD,
+	0x03, 0x69, 0xCC, 0x8F, 0xCD, 0x03, 0x69, 0xCC,
+	0x91, 0xCD, 0x03, 0x69, 0xCC, 0xA3, 0xB9, 0x03,
+	0x69, 0xCC, 0xA8, 0xA9, 0x03, 0x69, 0xCC, 0xB0,
+	// Bytes 3500 - 353f
+	0xB9, 0x03, 0x6A, 0xCC, 0x82, 0xCD, 0x03, 0x6A,
+	0xCC, 0x8C, 0xCD, 0x03, 0x6B, 0xCC, 0x81, 0xCD,
+	0x03, 0x6B, 0xCC, 0x8C, 0xCD, 0x03, 0x6B, 0xCC,
+	0xA3, 0xB9, 0x03, 0x6B, 0xCC, 0xA7, 0xA9, 0x03,
+	0x6B, 0xCC, 0xB1, 0xB9, 0x03, 0x6C, 0xCC, 0x81,
+	0xCD, 0x03, 0x6C, 0xCC, 0x8C, 0xCD, 0x03, 0x6C,
+	0xCC, 0xA7, 0xA9, 0x03, 0x6C, 0xCC, 0xAD, 0xB9,
+	0x03, 0x6C, 0xCC, 0xB1, 0xB9, 0x03, 0x6D, 0xCC,
+	// Bytes 3540 - 357f
+	0x81, 0xCD, 0x03, 0x6D, 0xCC, 0x87, 0xCD, 0x03,
+	0x6D, 0xCC, 0xA3, 0xB9, 0x03, 0x6E, 0xCC, 0x80,
+	0xCD, 0x03, 0x6E, 0xCC, 0x81, 0xCD, 0x03, 0x6E,
+	0xCC, 0x83, 0xCD, 0x03, 0x6E, 0xCC, 0x87, 0xCD,
+	0x03, 0x6E, 0xCC, 0x8C, 0xCD, 0x03, 0x6E, 0xCC,
+	0xA3, 0xB9, 0x03, 0x6E, 0xCC, 0xA7, 0xA9, 0x03,
+	0x6E, 0xCC, 0xAD, 0xB9, 0x03, 0x6E, 0xCC, 0xB1,
+	0xB9, 0x03, 0x6F, 0xCC, 0x80, 0xCD, 0x03, 0x6F,
+	// Bytes 3580 - 35bf
+	0xCC, 0x81, 0xCD, 0x03, 0x6F, 0xCC, 0x86, 0xCD,
+	0x03, 0x6F, 0xCC, 0x89, 0xCD, 0x03, 0x6F, 0xCC,
+	0x8B, 0xCD, 0x03, 0x6F, 0xCC, 0x8C, 0xCD, 0x03,
+	0x6F, 0xCC, 0x8F, 0xCD, 0x03, 0x6F, 0xCC, 0x91,
+	0xCD, 0x03, 0x70, 0xCC, 0x81, 0xCD, 0x03, 0x70,
+	0xCC, 0x87, 0xCD, 0x03, 0x72, 0xCC, 0x81, 0xCD,
+	0x03, 0x72, 0xCC, 0x87, 0xCD, 0x03, 0x72, 0xCC,
+	0x8C, 0xCD, 0x03, 0x72, 0xCC, 0x8F, 0xCD, 0x03,
+	// Bytes 35c0 - 35ff
+	0x72, 0xCC, 0x91, 0xCD, 0x03, 0x72, 0xCC, 0xA7,
+	0xA9, 0x03, 0x72, 0xCC, 0xB1, 0xB9, 0x03, 0x73,
+	0xCC, 0x82, 0xCD, 0x03, 0x73, 0xCC, 0x87, 0xCD,
+	0x03, 0x73, 0xCC, 0xA6, 0xB9, 0x03, 0x73, 0xCC,
+	0xA7, 0xA9, 0x03, 0x74, 0xCC, 0x87, 0xCD, 0x03,
+	0x74, 0xCC, 0x88, 0xCD, 0x03, 0x74, 0xCC, 0x8C,
+	0xCD, 0x03, 0x74, 0xCC, 0xA3, 0xB9, 0x03, 0x74,
+	0xCC, 0xA6, 0xB9, 0x03, 0x74, 0xCC, 0xA7, 0xA9,
+	// Bytes 3600 - 363f
+	0x03, 0x74, 0xCC, 0xAD, 0xB9, 0x03, 0x74, 0xCC,
+	0xB1, 0xB9, 0x03, 0x75, 0xCC, 0x80, 0xCD, 0x03,
+	0x75, 0xCC, 0x81, 0xCD, 0x03, 0x75, 0xCC, 0x82,
+	0xCD, 0x03, 0x75, 0xCC, 0x86, 0xCD, 0x03, 0x75,
+	0xCC, 0x89, 0xCD, 0x03, 0x75, 0xCC, 0x8A, 0xCD,
+	0x03, 0x75, 0xCC, 0x8B, 0xCD, 0x03, 0x75, 0xCC,
+	0x8C, 0xCD, 0x03, 0x75, 0xCC, 0x8F, 0xCD, 0x03,
+	0x75, 0xCC, 0x91, 0xCD, 0x03, 0x75, 0xCC, 0xA3,
+	// Bytes 3640 - 367f
+	0xB9, 0x03, 0x75, 0xCC, 0xA4, 0xB9, 0x03, 0x75,
+	0xCC, 0xA8, 0xA9, 0x03, 0x75, 0xCC, 0xAD, 0xB9,
+	0x03, 0x75, 0xCC, 0xB0, 0xB9, 0x03, 0x76, 0xCC,
+	0x83, 0xCD, 0x03, 0x76, 0xCC, 0xA3, 0xB9, 0x03,
+	0x77, 0xCC, 0x80, 0xCD, 0x03, 0x77, 0xCC, 0x81,
+	0xCD, 0x03, 0x77, 0xCC, 0x82, 0xCD, 0x03, 0x77,
+	0xCC, 0x87, 0xCD, 0x03, 0x77, 0xCC, 0x88, 0xCD,
+	0x03, 0x77, 0xCC, 0x8A, 0xCD, 0x03, 0x77, 0xCC,
+	// Bytes 3680 - 36bf
+	0xA3, 0xB9, 0x03, 0x78, 0xCC, 0x87, 0xCD, 0x03,
+	0x78, 0xCC, 0x88, 0xCD, 0x03, 0x79, 0xCC, 0x80,
+	0xCD, 0x03, 0x79, 0xCC, 0x81, 0xCD, 0x03, 0x79,
+	0xCC, 0x82, 0xCD, 0x03, 0x79, 0xCC, 0x83, 0xCD,
+	0x03, 0x79, 0xCC, 0x84, 0xCD, 0x03, 0x79, 0xCC,
+	0x87, 0xCD, 0x03, 0x79, 0xCC, 0x88, 0xCD, 0x03,
+	0x79, 0xCC, 0x89, 0xCD, 0x03, 0x79, 0xCC, 0x8A,
+	0xCD, 0x03, 0x79, 0xCC, 0xA3, 0xB9, 0x03, 0x7A,
+	// Bytes 36c0 - 36ff
+	0xCC, 0x81, 0xCD, 0x03, 0x7A, 0xCC, 0x82, 0xCD,
+	0x03, 0x7A, 0xCC, 0x87, 0xCD, 0x03, 0x7A, 0xCC,
+	0x8C, 0xCD, 0x03, 0x7A, 0xCC, 0xA3, 0xB9, 0x03,
+	0x7A, 0xCC, 0xB1, 0xB9, 0x04, 0xC2, 0xA8, 0xCC,
+	0x80, 0xCE, 0x04, 0xC2, 0xA8, 0xCC, 0x81, 0xCE,
+	0x04, 0xC2, 0xA8, 0xCD, 0x82, 0xCE, 0x04, 0xC3,
+	0x86, 0xCC, 0x81, 0xCD, 0x04, 0xC3, 0x86, 0xCC,
+	0x84, 0xCD, 0x04, 0xC3, 0x98, 0xCC, 0x81, 0xCD,
+	// Bytes 3700 - 373f
+	0x04, 0xC3, 0xA6, 0xCC, 0x81, 0xCD, 0x04, 0xC3,
+	0xA6, 0xCC, 0x84, 0xCD, 0x04, 0xC3, 0xB8, 0xCC,
+	0x81, 0xCD, 0x04, 0xC5, 0xBF, 0xCC, 0x87, 0xCD,
+	0x04, 0xC6, 0xB7, 0xCC, 0x8C, 0xCD, 0x04, 0xCA,
+	0x92, 0xCC, 0x8C, 0xCD, 0x04, 0xCE, 0x91, 0xCC,
+	0x80, 0xCD, 0x04, 0xCE, 0x91, 0xCC, 0x81, 0xCD,
+	0x04, 0xCE, 0x91, 0xCC, 0x84, 0xCD, 0x04, 0xCE,
+	0x91, 0xCC, 0x86, 0xCD, 0x04, 0xCE, 0x91, 0xCD,
+	// Bytes 3740 - 377f
+	0x85, 0xDD, 0x04, 0xCE, 0x95, 0xCC, 0x80, 0xCD,
+	0x04, 0xCE, 0x95, 0xCC, 0x81, 0xCD, 0x04, 0xCE,
+	0x97, 0xCC, 0x80, 0xCD, 0x04, 0xCE, 0x97, 0xCC,
+	0x81, 0xCD, 0x04, 0xCE, 0x97, 0xCD, 0x85, 0xDD,
+	0x04, 0xCE, 0x99, 0xCC, 0x80, 0xCD, 0x04, 0xCE,
+	0x99, 0xCC, 0x81, 0xCD, 0x04, 0xCE, 0x99, 0xCC,
+	0x84, 0xCD, 0x04, 0xCE, 0x99, 0xCC, 0x86, 0xCD,
+	0x04, 0xCE, 0x99, 0xCC, 0x88, 0xCD, 0x04, 0xCE,
+	// Bytes 3780 - 37bf
+	0x9F, 0xCC, 0x80, 0xCD, 0x04, 0xCE, 0x9F, 0xCC,
+	0x81, 0xCD, 0x04, 0xCE, 0xA1, 0xCC, 0x94, 0xCD,
+	0x04, 0xCE, 0xA5, 0xCC, 0x80, 0xCD, 0x04, 0xCE,
+	0xA5, 0xCC, 0x81, 0xCD, 0x04, 0xCE, 0xA5, 0xCC,
+	0x84, 0xCD, 0x04, 0xCE, 0xA5, 0xCC, 0x86, 0xCD,
+	0x04, 0xCE, 0xA5, 0xCC, 0x88, 0xCD, 0x04, 0xCE,
+	0xA9, 0xCC, 0x80, 0xCD, 0x04, 0xCE, 0xA9, 0xCC,
+	0x81, 0xCD, 0x04, 0xCE, 0xA9, 0xCD, 0x85, 0xDD,
+	// Bytes 37c0 - 37ff
+	0x04, 0xCE, 0xB1, 0xCC, 0x84, 0xCD, 0x04, 0xCE,
+	0xB1, 0xCC, 0x86, 0xCD, 0x04, 0xCE, 0xB1, 0xCD,
+	0x85, 0xDD, 0x04, 0xCE, 0xB5, 0xCC, 0x80, 0xCD,
+	0x04, 0xCE, 0xB5, 0xCC, 0x81, 0xCD, 0x04, 0xCE,
+	0xB7, 0xCD, 0x85, 0xDD, 0x04, 0xCE, 0xB9, 0xCC,
+	0x80, 0xCD, 0x04, 0xCE, 0xB9, 0xCC, 0x81, 0xCD,
+	0x04, 0xCE, 0xB9, 0xCC, 0x84, 0xCD, 0x04, 0xCE,
+	0xB9, 0xCC, 0x86, 0xCD, 0x04, 0xCE, 0xB9, 0xCD,
+	// Bytes 3800 - 383f
+	0x82, 0xCD, 0x04, 0xCE, 0xBF, 0xCC, 0x80, 0xCD,
+	0x04, 0xCE, 0xBF, 0xCC, 0x81, 0xCD, 0x04, 0xCF,
+	0x81, 0xCC, 0x93, 0xCD, 0x04, 0xCF, 0x81, 0xCC,
+	0x94, 0xCD, 0x04, 0xCF, 0x85, 0xCC, 0x80, 0xCD,
+	0x04, 0xCF, 0x85, 0xCC, 0x81, 0xCD, 0x04, 0xCF,
+	0x85, 0xCC, 0x84, 0xCD, 0x04, 0xCF, 0x85, 0xCC,
+	0x86, 0xCD, 0x04, 0xCF, 0x85, 0xCD, 0x82, 0xCD,
+	0x04, 0xCF, 0x89, 0xCD, 0x85, 0xDD, 0x04, 0xCF,
+	// Bytes 3840 - 387f
+	0x92, 0xCC, 0x81, 0xCD, 0x04, 0xCF, 0x92, 0xCC,
+	0x88, 0xCD, 0x04, 0xD0, 0x86, 0xCC, 0x88, 0xCD,
+	0x04, 0xD0, 0x90, 0xCC, 0x86, 0xCD, 0x04, 0xD0,
+	0x90, 0xCC, 0x88, 0xCD, 0x04, 0xD0, 0x93, 0xCC,
+	0x81, 0xCD, 0x04, 0xD0, 0x95, 0xCC, 0x80, 0xCD,
+	0x04, 0xD0, 0x95, 0xCC, 0x86, 0xCD, 0x04, 0xD0,
+	0x95, 0xCC, 0x88, 0xCD, 0x04, 0xD0, 0x96, 0xCC,
+	0x86, 0xCD, 0x04, 0xD0, 0x96, 0xCC, 0x88, 0xCD,
+	// Bytes 3880 - 38bf
+	0x04, 0xD0, 0x97, 0xCC, 0x88, 0xCD, 0x04, 0xD0,
+	0x98, 0xCC, 0x80, 0xCD, 0x04, 0xD0, 0x98, 0xCC,
+	0x84, 0xCD, 0x04, 0xD0, 0x98, 0xCC, 0x86, 0xCD,
+	0x04, 0xD0, 0x98, 0xCC, 0x88, 0xCD, 0x04, 0xD0,
+	0x9A, 0xCC, 0x81, 0xCD, 0x04, 0xD0, 0x9E, 0xCC,
+	0x88, 0xCD, 0x04, 0xD0, 0xA3, 0xCC, 0x84, 0xCD,
+	0x04, 0xD0, 0xA3, 0xCC, 0x86, 0xCD, 0x04, 0xD0,
+	0xA3, 0xCC, 0x88, 0xCD, 0x04, 0xD0, 0xA3, 0xCC,
+	// Bytes 38c0 - 38ff
+	0x8B, 0xCD, 0x04, 0xD0, 0xA7, 0xCC, 0x88, 0xCD,
+	0x04, 0xD0, 0xAB, 0xCC, 0x88, 0xCD, 0x04, 0xD0,
+	0xAD, 0xCC, 0x88, 0xCD, 0x04, 0xD0, 0xB0, 0xCC,
+	0x86, 0xCD, 0x04, 0xD0, 0xB0, 0xCC, 0x88, 0xCD,
+	0x04, 0xD0, 0xB3, 0xCC, 0x81, 0xCD, 0x04, 0xD0,
+	0xB5, 0xCC, 0x80, 0xCD, 0x04, 0xD0, 0xB5, 0xCC,
+	0x86, 0xCD, 0x04, 0xD0, 0xB5, 0xCC, 0x88, 0xCD,
+	0x04, 0xD0, 0xB6, 0xCC, 0x86, 0xCD, 0x04, 0xD0,
+	// Bytes 3900 - 393f
+	0xB6, 0xCC, 0x88, 0xCD, 0x04, 0xD0, 0xB7, 0xCC,
+	0x88, 0xCD, 0x04, 0xD0, 0xB8, 0xCC, 0x80, 0xCD,
+	0x04, 0xD0, 0xB8, 0xCC, 0x84, 0xCD, 0x04, 0xD0,
+	0xB8, 0xCC, 0x86, 0xCD, 0x04, 0xD0, 0xB8, 0xCC,
+	0x88, 0xCD, 0x04, 0xD0, 0xBA, 0xCC, 0x81, 0xCD,
+	0x04, 0xD0, 0xBE, 0xCC, 0x88, 0xCD, 0x04, 0xD1,
+	0x83, 0xCC, 0x84, 0xCD, 0x04, 0xD1, 0x83, 0xCC,
+	0x86, 0xCD, 0x04, 0xD1, 0x83, 0xCC, 0x88, 0xCD,
+	// Bytes 3940 - 397f
+	0x04, 0xD1, 0x83, 0xCC, 0x8B, 0xCD, 0x04, 0xD1,
+	0x87, 0xCC, 0x88, 0xCD, 0x04, 0xD1, 0x8B, 0xCC,
+	0x88, 0xCD, 0x04, 0xD1, 0x8D, 0xCC, 0x88, 0xCD,
+	0x04, 0xD1, 0x96, 0xCC, 0x88, 0xCD, 0x04, 0xD1,
+	0xB4, 0xCC, 0x8F, 0xCD, 0x04, 0xD1, 0xB5, 0xCC,
+	0x8F, 0xCD, 0x04, 0xD3, 0x98, 0xCC, 0x88, 0xCD,
+	0x04, 0xD3, 0x99, 0xCC, 0x88, 0xCD, 0x04, 0xD3,
+	0xA8, 0xCC, 0x88, 0xCD, 0x04, 0xD3, 0xA9, 0xCC,
+	// Bytes 3980 - 39bf
+	0x88, 0xCD, 0x04, 0xD8, 0xA7, 0xD9, 0x93, 0xCD,
+	0x04, 0xD8, 0xA7, 0xD9, 0x94, 0xCD, 0x04, 0xD8,
+	0xA7, 0xD9, 0x95, 0xB9, 0x04, 0xD9, 0x88, 0xD9,
+	0x94, 0xCD, 0x04, 0xD9, 0x8A, 0xD9, 0x94, 0xCD,
+	0x04, 0xDB, 0x81, 0xD9, 0x94, 0xCD, 0x04, 0xDB,
+	0x92, 0xD9, 0x94, 0xCD, 0x04, 0xDB, 0x95, 0xD9,
+	0x94, 0xCD, 0x05, 0x41, 0xCC, 0x82, 0xCC, 0x80,
+	0xCE, 0x05, 0x41, 0xCC, 0x82, 0xCC, 0x81, 0xCE,
+	// Bytes 39c0 - 39ff
+	0x05, 0x41, 0xCC, 0x82, 0xCC, 0x83, 0xCE, 0x05,
+	0x41, 0xCC, 0x82, 0xCC, 0x89, 0xCE, 0x05, 0x41,
+	0xCC, 0x86, 0xCC, 0x80, 0xCE, 0x05, 0x41, 0xCC,
+	0x86, 0xCC, 0x81, 0xCE, 0x05, 0x41, 0xCC, 0x86,
+	0xCC, 0x83, 0xCE, 0x05, 0x41, 0xCC, 0x86, 0xCC,
+	0x89, 0xCE, 0x05, 0x41, 0xCC, 0x87, 0xCC, 0x84,
+	0xCE, 0x05, 0x41, 0xCC, 0x88, 0xCC, 0x84, 0xCE,
+	0x05, 0x41, 0xCC, 0x8A, 0xCC, 0x81, 0xCE, 0x05,
+	// Bytes 3a00 - 3a3f
+	0x41, 0xCC, 0xA3, 0xCC, 0x82, 0xCE, 0x05, 0x41,
+	0xCC, 0xA3, 0xCC, 0x86, 0xCE, 0x05, 0x43, 0xCC,
+	0xA7, 0xCC, 0x81, 0xCE, 0x05, 0x45, 0xCC, 0x82,
+	0xCC, 0x80, 0xCE, 0x05, 0x45, 0xCC, 0x82, 0xCC,
+	0x81, 0xCE, 0x05, 0x45, 0xCC, 0x82, 0xCC, 0x83,
+	0xCE, 0x05, 0x45, 0xCC, 0x82, 0xCC, 0x89, 0xCE,
+	0x05, 0x45, 0xCC, 0x84, 0xCC, 0x80, 0xCE, 0x05,
+	0x45, 0xCC, 0x84, 0xCC, 0x81, 0xCE, 0x05, 0x45,
+	// Bytes 3a40 - 3a7f
+	0xCC, 0xA3, 0xCC, 0x82, 0xCE, 0x05, 0x45, 0xCC,
+	0xA7, 0xCC, 0x86, 0xCE, 0x05, 0x49, 0xCC, 0x88,
+	0xCC, 0x81, 0xCE, 0x05, 0x4C, 0xCC, 0xA3, 0xCC,
+	0x84, 0xCE, 0x05, 0x4F, 0xCC, 0x82, 0xCC, 0x80,
+	0xCE, 0x05, 0x4F, 0xCC, 0x82, 0xCC, 0x81, 0xCE,
+	0x05, 0x4F, 0xCC, 0x82, 0xCC, 0x83, 0xCE, 0x05,
+	0x4F, 0xCC, 0x82, 0xCC, 0x89, 0xCE, 0x05, 0x4F,
+	0xCC, 0x83, 0xCC, 0x81, 0xCE, 0x05, 0x4F, 0xCC,
+	// Bytes 3a80 - 3abf
+	0x83, 0xCC, 0x84, 0xCE, 0x05, 0x4F, 0xCC, 0x83,
+	0xCC, 0x88, 0xCE, 0x05, 0x4F, 0xCC, 0x84, 0xCC,
+	0x80, 0xCE, 0x05, 0x4F, 0xCC, 0x84, 0xCC, 0x81,
+	0xCE, 0x05, 0x4F, 0xCC, 0x87, 0xCC, 0x84, 0xCE,
+	0x05, 0x4F, 0xCC, 0x88, 0xCC, 0x84, 0xCE, 0x05,
+	0x4F, 0xCC, 0x9B, 0xCC, 0x80, 0xCE, 0x05, 0x4F,
+	0xCC, 0x9B, 0xCC, 0x81, 0xCE, 0x05, 0x4F, 0xCC,
+	0x9B, 0xCC, 0x83, 0xCE, 0x05, 0x4F, 0xCC, 0x9B,
+	// Bytes 3ac0 - 3aff
+	0xCC, 0x89, 0xCE, 0x05, 0x4F, 0xCC, 0x9B, 0xCC,
+	0xA3, 0xBA, 0x05, 0x4F, 0xCC, 0xA3, 0xCC, 0x82,
+	0xCE, 0x05, 0x4F, 0xCC, 0xA8, 0xCC, 0x84, 0xCE,
+	0x05, 0x52, 0xCC, 0xA3, 0xCC, 0x84, 0xCE, 0x05,
+	0x53, 0xCC, 0x81, 0xCC, 0x87, 0xCE, 0x05, 0x53,
+	0xCC, 0x8C, 0xCC, 0x87, 0xCE, 0x05, 0x53, 0xCC,
+	0xA3, 0xCC, 0x87, 0xCE, 0x05, 0x55, 0xCC, 0x83,
+	0xCC, 0x81, 0xCE, 0x05, 0x55, 0xCC, 0x84, 0xCC,
+	// Bytes 3b00 - 3b3f
+	0x88, 0xCE, 0x05, 0x55, 0xCC, 0x88, 0xCC, 0x80,
+	0xCE, 0x05, 0x55, 0xCC, 0x88, 0xCC, 0x81, 0xCE,
+	0x05, 0x55, 0xCC, 0x88, 0xCC, 0x84, 0xCE, 0x05,
+	0x55, 0xCC, 0x88, 0xCC, 0x8C, 0xCE, 0x05, 0x55,
+	0xCC, 0x9B, 0xCC, 0x80, 0xCE, 0x05, 0x55, 0xCC,
+	0x9B, 0xCC, 0x81, 0xCE, 0x05, 0x55, 0xCC, 0x9B,
+	0xCC, 0x83, 0xCE, 0x05, 0x55, 0xCC, 0x9B, 0xCC,
+	0x89, 0xCE, 0x05, 0x55, 0xCC, 0x9B, 0xCC, 0xA3,
+	// Bytes 3b40 - 3b7f
+	0xBA, 0x05, 0x61, 0xCC, 0x82, 0xCC, 0x80, 0xCE,
+	0x05, 0x61, 0xCC, 0x82, 0xCC, 0x81, 0xCE, 0x05,
+	0x61, 0xCC, 0x82, 0xCC, 0x83, 0xCE, 0x05, 0x61,
+	0xCC, 0x82, 0xCC, 0x89, 0xCE, 0x05, 0x61, 0xCC,
+	0x86, 0xCC, 0x80, 0xCE, 0x05, 0x61, 0xCC, 0x86,
+	0xCC, 0x81, 0xCE, 0x05, 0x61, 0xCC, 0x86, 0xCC,
+	0x83, 0xCE, 0x05, 0x61, 0xCC, 0x86, 0xCC, 0x89,
+	0xCE, 0x05, 0x61, 0xCC, 0x87, 0xCC, 0x84, 0xCE,
+	// Bytes 3b80 - 3bbf
+	0x05, 0x61, 0xCC, 0x88, 0xCC, 0x84, 0xCE, 0x05,
+	0x61, 0xCC, 0x8A, 0xCC, 0x81, 0xCE, 0x05, 0x61,
+	0xCC, 0xA3, 0xCC, 0x82, 0xCE, 0x05, 0x61, 0xCC,
+	0xA3, 0xCC, 0x86, 0xCE, 0x05, 0x63, 0xCC, 0xA7,
+	0xCC, 0x81, 0xCE, 0x05, 0x65, 0xCC, 0x82, 0xCC,
+	0x80, 0xCE, 0x05, 0x65, 0xCC, 0x82, 0xCC, 0x81,
+	0xCE, 0x05, 0x65, 0xCC, 0x82, 0xCC, 0x83, 0xCE,
+	0x05, 0x65, 0xCC, 0x82, 0xCC, 0x89, 0xCE, 0x05,
+	// Bytes 3bc0 - 3bff
+	0x65, 0xCC, 0x84, 0xCC, 0x80, 0xCE, 0x05, 0x65,
+	0xCC, 0x84, 0xCC, 0x81, 0xCE, 0x05, 0x65, 0xCC,
+	0xA3, 0xCC, 0x82, 0xCE, 0x05, 0x65, 0xCC, 0xA7,
+	0xCC, 0x86, 0xCE, 0x05, 0x69, 0xCC, 0x88, 0xCC,
+	0x81, 0xCE, 0x05, 0x6C, 0xCC, 0xA3, 0xCC, 0x84,
+	0xCE, 0x05, 0x6F, 0xCC, 0x82, 0xCC, 0x80, 0xCE,
+	0x05, 0x6F, 0xCC, 0x82, 0xCC, 0x81, 0xCE, 0x05,
+	0x6F, 0xCC, 0x82, 0xCC, 0x83, 0xCE, 0x05, 0x6F,
+	// Bytes 3c00 - 3c3f
+	0xCC, 0x82, 0xCC, 0x89, 0xCE, 0x05, 0x6F, 0xCC,
+	0x83, 0xCC, 0x81, 0xCE, 0x05, 0x6F, 0xCC, 0x83,
+	0xCC, 0x84, 0xCE, 0x05, 0x6F, 0xCC, 0x83, 0xCC,
+	0x88, 0xCE, 0x05, 0x6F, 0xCC, 0x84, 0xCC, 0x80,
+	0xCE, 0x05, 0x6F, 0xCC, 0x84, 0xCC, 0x81, 0xCE,
+	0x05, 0x6F, 0xCC, 0x87, 0xCC, 0x84, 0xCE, 0x05,
+	0x6F, 0xCC, 0x88, 0xCC, 0x84, 0xCE, 0x05, 0x6F,
+	0xCC, 0x9B, 0xCC, 0x80, 0xCE, 0x05, 0x6F, 0xCC,
+	// Bytes 3c40 - 3c7f
+	0x9B, 0xCC, 0x81, 0xCE, 0x05, 0x6F, 0xCC, 0x9B,
+	0xCC, 0x83, 0xCE, 0x05, 0x6F, 0xCC, 0x9B, 0xCC,
+	0x89, 0xCE, 0x05, 0x6F, 0xCC, 0x9B, 0xCC, 0xA3,
+	0xBA, 0x05, 0x6F, 0xCC, 0xA3, 0xCC, 0x82, 0xCE,
+	0x05, 0x6F, 0xCC, 0xA8, 0xCC, 0x84, 0xCE, 0x05,
+	0x72, 0xCC, 0xA3, 0xCC, 0x84, 0xCE, 0x05, 0x73,
+	0xCC, 0x81, 0xCC, 0x87, 0xCE, 0x05, 0x73, 0xCC,
+	0x8C, 0xCC, 0x87, 0xCE, 0x05, 0x73, 0xCC, 0xA3,
+	// Bytes 3c80 - 3cbf
+	0xCC, 0x87, 0xCE, 0x05, 0x75, 0xCC, 0x83, 0xCC,
+	0x81, 0xCE, 0x05, 0x75, 0xCC, 0x84, 0xCC, 0x88,
+	0xCE, 0x05, 0x75, 0xCC, 0x88, 0xCC, 0x80, 0xCE,
+	0x05, 0x75, 0xCC, 0x88, 0xCC, 0x81, 0xCE, 0x05,
+	0x75, 0xCC, 0x88, 0xCC, 0x84, 0xCE, 0x05, 0x75,
+	0xCC, 0x88, 0xCC, 0x8C, 0xCE, 0x05, 0x75, 0xCC,
+	0x9B, 0xCC, 0x80, 0xCE, 0x05, 0x75, 0xCC, 0x9B,
+	0xCC, 0x81, 0xCE, 0x05, 0x75, 0xCC, 0x9B, 0xCC,
+	// Bytes 3cc0 - 3cff
+	0x83, 0xCE, 0x05, 0x75, 0xCC, 0x9B, 0xCC, 0x89,
+	0xCE, 0x05, 0x75, 0xCC, 0x9B, 0xCC, 0xA3, 0xBA,
+	0x05, 0xE1, 0xBE, 0xBF, 0xCC, 0x80, 0xCE, 0x05,
+	0xE1, 0xBE, 0xBF, 0xCC, 0x81, 0xCE, 0x05, 0xE1,
+	0xBE, 0xBF, 0xCD, 0x82, 0xCE, 0x05, 0xE1, 0xBF,
+	0xBE, 0xCC, 0x80, 0xCE, 0x05, 0xE1, 0xBF, 0xBE,
+	0xCC, 0x81, 0xCE, 0x05, 0xE1, 0xBF, 0xBE, 0xCD,
+	0x82, 0xCE, 0x05, 0xE2, 0x86, 0x90, 0xCC, 0xB8,
+	// Bytes 3d00 - 3d3f
+	0x05, 0x05, 0xE2, 0x86, 0x92, 0xCC, 0xB8, 0x05,
+	0x05, 0xE2, 0x86, 0x94, 0xCC, 0xB8, 0x05, 0x05,
+	0xE2, 0x87, 0x90, 0xCC, 0xB8, 0x05, 0x05, 0xE2,
+	0x87, 0x92, 0xCC, 0xB8, 0x05, 0x05, 0xE2, 0x87,
+	0x94, 0xCC, 0xB8, 0x05, 0x05, 0xE2, 0x88, 0x83,
+	0xCC, 0xB8, 0x05, 0x05, 0xE2, 0x88, 0x88, 0xCC,
+	0xB8, 0x05, 0x05, 0xE2, 0x88, 0x8B, 0xCC, 0xB8,
+	0x05, 0x05, 0xE2, 0x88, 0xA3, 0xCC, 0xB8, 0x05,
+	// Bytes 3d40 - 3d7f
+	0x05, 0xE2, 0x88, 0xA5, 0xCC, 0xB8, 0x05, 0x05,
+	0xE2, 0x88, 0xBC, 0xCC, 0xB8, 0x05, 0x05, 0xE2,
+	0x89, 0x83, 0xCC, 0xB8, 0x05, 0x05, 0xE2, 0x89,
+	0x85, 0xCC, 0xB8, 0x05, 0x05, 0xE2, 0x89, 0x88,
+	0xCC, 0xB8, 0x05, 0x05, 0xE2, 0x89, 0x8D, 0xCC,
+	0xB8, 0x05, 0x05, 0xE2, 0x89, 0xA1, 0xCC, 0xB8,
+	0x05, 0x05, 0xE2, 0x89, 0xA4, 0xCC, 0xB8, 0x05,
+	0x05, 0xE2, 0x89, 0xA5, 0xCC, 0xB8, 0x05, 0x05,
+	// Bytes 3d80 - 3dbf
+	0xE2, 0x89, 0xB2, 0xCC, 0xB8, 0x05, 0x05, 0xE2,
+	0x89, 0xB3, 0xCC, 0xB8, 0x05, 0x05, 0xE2, 0x89,
+	0xB6, 0xCC, 0xB8, 0x05, 0x05, 0xE2, 0x89, 0xB7,
+	0xCC, 0xB8, 0x05, 0x05, 0xE2, 0x89, 0xBA, 0xCC,
+	0xB8, 0x05, 0x05, 0xE2, 0x89, 0xBB, 0xCC, 0xB8,
+	0x05, 0x05, 0xE2, 0x89, 0xBC, 0xCC, 0xB8, 0x05,
+	0x05, 0xE2, 0x89, 0xBD, 0xCC, 0xB8, 0x05, 0x05,
+	0xE2, 0x8A, 0x82, 0xCC, 0xB8, 0x05, 0x05, 0xE2,
+	// Bytes 3dc0 - 3dff
+	0x8A, 0x83, 0xCC, 0xB8, 0x05, 0x05, 0xE2, 0x8A,
+	0x86, 0xCC, 0xB8, 0x05, 0x05, 0xE2, 0x8A, 0x87,
+	0xCC, 0xB8, 0x05, 0x05, 0xE2, 0x8A, 0x91, 0xCC,
+	0xB8, 0x05, 0x05, 0xE2, 0x8A, 0x92, 0xCC, 0xB8,
+	0x05, 0x05, 0xE2, 0x8A, 0xA2, 0xCC, 0xB8, 0x05,
+	0x05, 0xE2, 0x8A, 0xA8, 0xCC, 0xB8, 0x05, 0x05,
+	0xE2, 0x8A, 0xA9, 0xCC, 0xB8, 0x05, 0x05, 0xE2,
+	0x8A, 0xAB, 0xCC, 0xB8, 0x05, 0x05, 0xE2, 0x8A,
+	// Bytes 3e00 - 3e3f
+	0xB2, 0xCC, 0xB8, 0x05, 0x05, 0xE2, 0x8A, 0xB3,
+	0xCC, 0xB8, 0x05, 0x05, 0xE2, 0x8A, 0xB4, 0xCC,
+	0xB8, 0x05, 0x05, 0xE2, 0x8A, 0xB5, 0xCC, 0xB8,
+	0x05, 0x06, 0xCE, 0x91, 0xCC, 0x93, 0xCD, 0x85,
+	0xDE, 0x06, 0xCE, 0x91, 0xCC, 0x94, 0xCD, 0x85,
+	0xDE, 0x06, 0xCE, 0x95, 0xCC, 0x93, 0xCC, 0x80,
+	0xCE, 0x06, 0xCE, 0x95, 0xCC, 0x93, 0xCC, 0x81,
+	0xCE, 0x06, 0xCE, 0x95, 0xCC, 0x94, 0xCC, 0x80,
+	// Bytes 3e40 - 3e7f
+	0xCE, 0x06, 0xCE, 0x95, 0xCC, 0x94, 0xCC, 0x81,
+	0xCE, 0x06, 0xCE, 0x97, 0xCC, 0x93, 0xCD, 0x85,
+	0xDE, 0x06, 0xCE, 0x97, 0xCC, 0x94, 0xCD, 0x85,
+	0xDE, 0x06, 0xCE, 0x99, 0xCC, 0x93, 0xCC, 0x80,
+	0xCE, 0x06, 0xCE, 0x99, 0xCC, 0x93, 0xCC, 0x81,
+	0xCE, 0x06, 0xCE, 0x99, 0xCC, 0x93, 0xCD, 0x82,
+	0xCE, 0x06, 0xCE, 0x99, 0xCC, 0x94, 0xCC, 0x80,
+	0xCE, 0x06, 0xCE, 0x99, 0xCC, 0x94, 0xCC, 0x81,
+	// Bytes 3e80 - 3ebf
+	0xCE, 0x06, 0xCE, 0x99, 0xCC, 0x94, 0xCD, 0x82,
+	0xCE, 0x06, 0xCE, 0x9F, 0xCC, 0x93, 0xCC, 0x80,
+	0xCE, 0x06, 0xCE, 0x9F, 0xCC, 0x93, 0xCC, 0x81,
+	0xCE, 0x06, 0xCE, 0x9F, 0xCC, 0x94, 0xCC, 0x80,
+	0xCE, 0x06, 0xCE, 0x9F, 0xCC, 0x94, 0xCC, 0x81,
+	0xCE, 0x06, 0xCE, 0xA5, 0xCC, 0x94, 0xCC, 0x80,
+	0xCE, 0x06, 0xCE, 0xA5, 0xCC, 0x94, 0xCC, 0x81,
+	0xCE, 0x06, 0xCE, 0xA5, 0xCC, 0x94, 0xCD, 0x82,
+	// Bytes 3ec0 - 3eff
+	0xCE, 0x06, 0xCE, 0xA9, 0xCC, 0x93, 0xCD, 0x85,
+	0xDE, 0x06, 0xCE, 0xA9, 0xCC, 0x94, 0xCD, 0x85,
+	0xDE, 0x06, 0xCE, 0xB1, 0xCC, 0x80, 0xCD, 0x85,
+	0xDE, 0x06, 0xCE, 0xB1, 0xCC, 0x81, 0xCD, 0x85,
+	0xDE, 0x06, 0xCE, 0xB1, 0xCC, 0x93, 0xCD, 0x85,
+	0xDE, 0x06, 0xCE, 0xB1, 0xCC, 0x94, 0xCD, 0x85,
+	0xDE, 0x06, 0xCE, 0xB1, 0xCD, 0x82, 0xCD, 0x85,
+	0xDE, 0x06, 0xCE, 0xB5, 0xCC, 0x93, 0xCC, 0x80,
+	// Bytes 3f00 - 3f3f
+	0xCE, 0x06, 0xCE, 0xB5, 0xCC, 0x93, 0xCC, 0x81,
+	0xCE, 0x06, 0xCE, 0xB5, 0xCC, 0x94, 0xCC, 0x80,
+	0xCE, 0x06, 0xCE, 0xB5, 0xCC, 0x94, 0xCC, 0x81,
+	0xCE, 0x06, 0xCE, 0xB7, 0xCC, 0x80, 0xCD, 0x85,
+	0xDE, 0x06, 0xCE, 0xB7, 0xCC, 0x81, 0xCD, 0x85,
+	0xDE, 0x06, 0xCE, 0xB7, 0xCC, 0x93, 0xCD, 0x85,
+	0xDE, 0x06, 0xCE, 0xB7, 0xCC, 0x94, 0xCD, 0x85,
+	0xDE, 0x06, 0xCE, 0xB7, 0xCD, 0x82, 0xCD, 0x85,
+	// Bytes 3f40 - 3f7f
+	0xDE, 0x06, 0xCE, 0xB9, 0xCC, 0x88, 0xCC, 0x80,
+	0xCE, 0x06, 0xCE, 0xB9, 0xCC, 0x88, 0xCC, 0x81,
+	0xCE, 0x06, 0xCE, 0xB9, 0xCC, 0x88, 0xCD, 0x82,
+	0xCE, 0x06, 0xCE, 0xB9, 0xCC, 0x93, 0xCC, 0x80,
+	0xCE, 0x06, 0xCE, 0xB9, 0xCC, 0x93, 0xCC, 0x81,
+	0xCE, 0x06, 0xCE, 0xB9, 0xCC, 0x93, 0xCD, 0x82,
+	0xCE, 0x06, 0xCE, 0xB9, 0xCC, 0x94, 0xCC, 0x80,
+	0xCE, 0x06, 0xCE, 0xB9, 0xCC, 0x94, 0xCC, 0x81,
+	// Bytes 3f80 - 3fbf
+	0xCE, 0x06, 0xCE, 0xB9, 0xCC, 0x94, 0xCD, 0x82,
+	0xCE, 0x06, 0xCE, 0xBF, 0xCC, 0x93, 0xCC, 0x80,
+	0xCE, 0x06, 0xCE, 0xBF, 0xCC, 0x93, 0xCC, 0x81,
+	0xCE, 0x06, 0xCE, 0xBF, 0xCC, 0x94, 0xCC, 0x80,
+	0xCE, 0x06, 0xCE, 0xBF, 0xCC, 0x94, 0xCC, 0x81,
+	0xCE, 0x06, 0xCF, 0x85, 0xCC, 0x88, 0xCC, 0x80,
+	0xCE, 0x06, 0xCF, 0x85, 0xCC, 0x88, 0xCC, 0x81,
+	0xCE, 0x06, 0xCF, 0x85, 0xCC, 0x88, 0xCD, 0x82,
+	// Bytes 3fc0 - 3fff
+	0xCE, 0x06, 0xCF, 0x85, 0xCC, 0x93, 0xCC, 0x80,
+	0xCE, 0x06, 0xCF, 0x85, 0xCC, 0x93, 0xCC, 0x81,
+	0xCE, 0x06, 0xCF, 0x85, 0xCC, 0x93, 0xCD, 0x82,
+	0xCE, 0x06, 0xCF, 0x85, 0xCC, 0x94, 0xCC, 0x80,
+	0xCE, 0x06, 0xCF, 0x85, 0xCC, 0x94, 0xCC, 0x81,
+	0xCE, 0x06, 0xCF, 0x85, 0xCC, 0x94, 0xCD, 0x82,
+	0xCE, 0x06, 0xCF, 0x89, 0xCC, 0x80, 0xCD, 0x85,
+	0xDE, 0x06, 0xCF, 0x89, 0xCC, 0x81, 0xCD, 0x85,
+	// Bytes 4000 - 403f
+	0xDE, 0x06, 0xCF, 0x89, 0xCC, 0x93, 0xCD, 0x85,
+	0xDE, 0x06, 0xCF, 0x89, 0xCC, 0x94, 0xCD, 0x85,
+	0xDE, 0x06, 0xCF, 0x89, 0xCD, 0x82, 0xCD, 0x85,
+	0xDE, 0x06, 0xE0, 0xA4, 0xA8, 0xE0, 0xA4, 0xBC,
+	0x0D, 0x06, 0xE0, 0xA4, 0xB0, 0xE0, 0xA4, 0xBC,
+	0x0D, 0x06, 0xE0, 0xA4, 0xB3, 0xE0, 0xA4, 0xBC,
+	0x0D, 0x06, 0xE0, 0xB1, 0x86, 0xE0, 0xB1, 0x96,
+	0x89, 0x06, 0xE0, 0xB7, 0x99, 0xE0, 0xB7, 0x8A,
+	// Bytes 4040 - 407f
+	0x15, 0x06, 0xE3, 0x81, 0x86, 0xE3, 0x82, 0x99,
+	0x11, 0x06, 0xE3, 0x81, 0x8B, 0xE3, 0x82, 0x99,
+	0x11, 0x06, 0xE3, 0x81, 0x8D, 0xE3, 0x82, 0x99,
+	0x11, 0x06, 0xE3, 0x81, 0x8F, 0xE3, 0x82, 0x99,
+	0x11, 0x06, 0xE3, 0x81, 0x91, 0xE3, 0x82, 0x99,
+	0x11, 0x06, 0xE3, 0x81, 0x93, 0xE3, 0x82, 0x99,
+	0x11, 0x06, 0xE3, 0x81, 0x95, 0xE3, 0x82, 0x99,
+	0x11, 0x06, 0xE3, 0x81, 0x97, 0xE3, 0x82, 0x99,
+	// Bytes 4080 - 40bf
+	0x11, 0x06, 0xE3, 0x81, 0x99, 0xE3, 0x82, 0x99,
+	0x11, 0x06, 0xE3, 0x81, 0x9B, 0xE3, 0x82, 0x99,
+	0x11, 0x06, 0xE3, 0x81, 0x9D, 0xE3, 0x82, 0x99,
+	0x11, 0x06, 0xE3, 0x81, 0x9F, 0xE3, 0x82, 0x99,
+	0x11, 0x06, 0xE3, 0x81, 0xA1, 0xE3, 0x82, 0x99,
+	0x11, 0x06, 0xE3, 0x81, 0xA4, 0xE3, 0x82, 0x99,
+	0x11, 0x06, 0xE3, 0x81, 0xA6, 0xE3, 0x82, 0x99,
+	0x11, 0x06, 0xE3, 0x81, 0xA8, 0xE3, 0x82, 0x99,
+	// Bytes 40c0 - 40ff
+	0x11, 0x06, 0xE3, 0x81, 0xAF, 0xE3, 0x82, 0x99,
+	0x11, 0x06, 0xE3, 0x81, 0xAF, 0xE3, 0x82, 0x9A,
+	0x11, 0x06, 0xE3, 0x81, 0xB2, 0xE3, 0x82, 0x99,
+	0x11, 0x06, 0xE3, 0x81, 0xB2, 0xE3, 0x82, 0x9A,
+	0x11, 0x06, 0xE3, 0x81, 0xB5, 0xE3, 0x82, 0x99,
+	0x11, 0x06, 0xE3, 0x81, 0xB5, 0xE3, 0x82, 0x9A,
+	0x11, 0x06, 0xE3, 0x81, 0xB8, 0xE3, 0x82, 0x99,
+	0x11, 0x06, 0xE3, 0x81, 0xB8, 0xE3, 0x82, 0x9A,
+	// Bytes 4100 - 413f
+	0x11, 0x06, 0xE3, 0x81, 0xBB, 0xE3, 0x82, 0x99,
+	0x11, 0x06, 0xE3, 0x81, 0xBB, 0xE3, 0x82, 0x9A,
+	0x11, 0x06, 0xE3, 0x82, 0x9D, 0xE3, 0x82, 0x99,
+	0x11, 0x06, 0xE3, 0x82, 0xA6, 0xE3, 0x82, 0x99,
+	0x11, 0x06, 0xE3, 0x82, 0xAB, 0xE3, 0x82, 0x99,
+	0x11, 0x06, 0xE3, 0x82, 0xAD, 0xE3, 0x82, 0x99,
+	0x11, 0x06, 0xE3, 0x82, 0xAF, 0xE3, 0x82, 0x99,
+	0x11, 0x06, 0xE3, 0x82, 0xB1, 0xE3, 0x82, 0x99,
+	// Bytes 4140 - 417f
+	0x11, 0x06, 0xE3, 0x82, 0xB3, 0xE3, 0x82, 0x99,
+	0x11, 0x06, 0xE3, 0x82, 0xB5, 0xE3, 0x82, 0x99,
+	0x11, 0x06, 0xE3, 0x82, 0xB7, 0xE3, 0x82, 0x99,
+	0x11, 0x06, 0xE3, 0x82, 0xB9, 0xE3, 0x82, 0x99,
+	0x11, 0x06, 0xE3, 0x82, 0xBB, 0xE3, 0x82, 0x99,
+	0x11, 0x06, 0xE3, 0x82, 0xBD, 0xE3, 0x82, 0x99,
+	0x11, 0x06, 0xE3, 0x82, 0xBF, 0xE3, 0x82, 0x99,
+	0x11, 0x06, 0xE3, 0x83, 0x81, 0xE3, 0x82, 0x99,
+	// Bytes 4180 - 41bf
+	0x11, 0x06, 0xE3, 0x83, 0x84, 0xE3, 0x82, 0x99,
+	0x11, 0x06, 0xE3, 0x83, 0x86, 0xE3, 0x82, 0x99,
+	0x11, 0x06, 0xE3, 0x83, 0x88, 0xE3, 0x82, 0x99,
+	0x11, 0x06, 0xE3, 0x83, 0x8F, 0xE3, 0x82, 0x99,
+	0x11, 0x06, 0xE3, 0x83, 0x8F, 0xE3, 0x82, 0x9A,
+	0x11, 0x06, 0xE3, 0x83, 0x92, 0xE3, 0x82, 0x99,
+	0x11, 0x06, 0xE3, 0x83, 0x92, 0xE3, 0x82, 0x9A,
+	0x11, 0x06, 0xE3, 0x83, 0x95, 0xE3, 0x82, 0x99,
+	// Bytes 41c0 - 41ff
+	0x11, 0x06, 0xE3, 0x83, 0x95, 0xE3, 0x82, 0x9A,
+	0x11, 0x06, 0xE3, 0x83, 0x98, 0xE3, 0x82, 0x99,
+	0x11, 0x06, 0xE3, 0x83, 0x98, 0xE3, 0x82, 0x9A,
+	0x11, 0x06, 0xE3, 0x83, 0x9B, 0xE3, 0x82, 0x99,
+	0x11, 0x06, 0xE3, 0x83, 0x9B, 0xE3, 0x82, 0x9A,
+	0x11, 0x06, 0xE3, 0x83, 0xAF, 0xE3, 0x82, 0x99,
+	0x11, 0x06, 0xE3, 0x83, 0xB0, 0xE3, 0x82, 0x99,
+	0x11, 0x06, 0xE3, 0x83, 0xB1, 0xE3, 0x82, 0x99,
+	// Bytes 4200 - 423f
+	0x11, 0x06, 0xE3, 0x83, 0xB2, 0xE3, 0x82, 0x99,
+	0x11, 0x06, 0xE3, 0x83, 0xBD, 0xE3, 0x82, 0x99,
+	0x11, 0x08, 0xCE, 0x91, 0xCC, 0x93, 0xCC, 0x80,
+	0xCD, 0x85, 0xDF, 0x08, 0xCE, 0x91, 0xCC, 0x93,
+	0xCC, 0x81, 0xCD, 0x85, 0xDF, 0x08, 0xCE, 0x91,
+	0xCC, 0x93, 0xCD, 0x82, 0xCD, 0x85, 0xDF, 0x08,
+	0xCE, 0x91, 0xCC, 0x94, 0xCC, 0x80, 0xCD, 0x85,
+	0xDF, 0x08, 0xCE, 0x91, 0xCC, 0x94, 0xCC, 0x81,
+	// Bytes 4240 - 427f
+	0xCD, 0x85, 0xDF, 0x08, 0xCE, 0x91, 0xCC, 0x94,
+	0xCD, 0x82, 0xCD, 0x85, 0xDF, 0x08, 0xCE, 0x97,
+	0xCC, 0x93, 0xCC, 0x80, 0xCD, 0x85, 0xDF, 0x08,
+	0xCE, 0x97, 0xCC, 0x93, 0xCC, 0x81, 0xCD, 0x85,
+	0xDF, 0x08, 0xCE, 0x97, 0xCC, 0x93, 0xCD, 0x82,
+	0xCD, 0x85, 0xDF, 0x08, 0xCE, 0x97, 0xCC, 0x94,
+	0xCC, 0x80, 0xCD, 0x85, 0xDF, 0x08, 0xCE, 0x97,
+	0xCC, 0x94, 0xCC, 0x81, 0xCD, 0x85, 0xDF, 0x08,
+	// Bytes 4280 - 42bf
+	0xCE, 0x97, 0xCC, 0x94, 0xCD, 0x82, 0xCD, 0x85,
+	0xDF, 0x08, 0xCE, 0xA9, 0xCC, 0x93, 0xCC, 0x80,
+	0xCD, 0x85, 0xDF, 0x08, 0xCE, 0xA9, 0xCC, 0x93,
+	0xCC, 0x81, 0xCD, 0x85, 0xDF, 0x08, 0xCE, 0xA9,
+	0xCC, 0x93, 0xCD, 0x82, 0xCD, 0x85, 0xDF, 0x08,
+	0xCE, 0xA9, 0xCC, 0x94, 0xCC, 0x80, 0xCD, 0x85,
+	0xDF, 0x08, 0xCE, 0xA9, 0xCC, 0x94, 0xCC, 0x81,
+	0xCD, 0x85, 0xDF, 0x08, 0xCE, 0xA9, 0xCC, 0x94,
+	// Bytes 42c0 - 42ff
+	0xCD, 0x82, 0xCD, 0x85, 0xDF, 0x08, 0xCE, 0xB1,
+	0xCC, 0x93, 0xCC, 0x80, 0xCD, 0x85, 0xDF, 0x08,
+	0xCE, 0xB1, 0xCC, 0x93, 0xCC, 0x81, 0xCD, 0x85,
+	0xDF, 0x08, 0xCE, 0xB1, 0xCC, 0x93, 0xCD, 0x82,
+	0xCD, 0x85, 0xDF, 0x08, 0xCE, 0xB1, 0xCC, 0x94,
+	0xCC, 0x80, 0xCD, 0x85, 0xDF, 0x08, 0xCE, 0xB1,
+	0xCC, 0x94, 0xCC, 0x81, 0xCD, 0x85, 0xDF, 0x08,
+	0xCE, 0xB1, 0xCC, 0x94, 0xCD, 0x82, 0xCD, 0x85,
+	// Bytes 4300 - 433f
+	0xDF, 0x08, 0xCE, 0xB7, 0xCC, 0x93, 0xCC, 0x80,
+	0xCD, 0x85, 0xDF, 0x08, 0xCE, 0xB7, 0xCC, 0x93,
+	0xCC, 0x81, 0xCD, 0x85, 0xDF, 0x08, 0xCE, 0xB7,
+	0xCC, 0x93, 0xCD, 0x82, 0xCD, 0x85, 0xDF, 0x08,
+	0xCE, 0xB7, 0xCC, 0x94, 0xCC, 0x80, 0xCD, 0x85,
+	0xDF, 0x08, 0xCE, 0xB7, 0xCC, 0x94, 0xCC, 0x81,
+	0xCD, 0x85, 0xDF, 0x08, 0xCE, 0xB7, 0xCC, 0x94,
+	0xCD, 0x82, 0xCD, 0x85, 0xDF, 0x08, 0xCF, 0x89,
+	// Bytes 4340 - 437f
+	0xCC, 0x93, 0xCC, 0x80, 0xCD, 0x85, 0xDF, 0x08,
+	0xCF, 0x89, 0xCC, 0x93, 0xCC, 0x81, 0xCD, 0x85,
+	0xDF, 0x08, 0xCF, 0x89, 0xCC, 0x93, 0xCD, 0x82,
+	0xCD, 0x85, 0xDF, 0x08, 0xCF, 0x89, 0xCC, 0x94,
+	0xCC, 0x80, 0xCD, 0x85, 0xDF, 0x08, 0xCF, 0x89,
+	0xCC, 0x94, 0xCC, 0x81, 0xCD, 0x85, 0xDF, 0x08,
+	0xCF, 0x89, 0xCC, 0x94, 0xCD, 0x82, 0xCD, 0x85,
+	0xDF, 0x08, 0xF0, 0x91, 0x82, 0x99, 0xF0, 0x91,
+	// Bytes 4380 - 43bf
+	0x82, 0xBA, 0x0D, 0x08, 0xF0, 0x91, 0x82, 0x9B,
+	0xF0, 0x91, 0x82, 0xBA, 0x0D, 0x08, 0xF0, 0x91,
+	0x82, 0xA5, 0xF0, 0x91, 0x82, 0xBA, 0x0D, 0x42,
+	0xC2, 0xB4, 0x01, 0x43, 0x20, 0xCC, 0x81, 0xCD,
+	0x43, 0x20, 0xCC, 0x83, 0xCD, 0x43, 0x20, 0xCC,
+	0x84, 0xCD, 0x43, 0x20, 0xCC, 0x85, 0xCD, 0x43,
+	0x20, 0xCC, 0x86, 0xCD, 0x43, 0x20, 0xCC, 0x87,
+	0xCD, 0x43, 0x20, 0xCC, 0x88, 0xCD, 0x43, 0x20,
+	// Bytes 43c0 - 43ff
+	0xCC, 0x8A, 0xCD, 0x43, 0x20, 0xCC, 0x8B, 0xCD,
+	0x43, 0x20, 0xCC, 0x93, 0xCD, 0x43, 0x20, 0xCC,
+	0x94, 0xCD, 0x43, 0x20, 0xCC, 0xA7, 0xA9, 0x43,
+	0x20, 0xCC, 0xA8, 0xA9, 0x43, 0x20, 0xCC, 0xB3,
+	0xB9, 0x43, 0x20, 0xCD, 0x82, 0xCD, 0x43, 0x20,
+	0xCD, 0x85, 0xDD, 0x43, 0x20, 0xD9, 0x8B, 0x5D,
+	0x43, 0x20, 0xD9, 0x8C, 0x61, 0x43, 0x20, 0xD9,
+	0x8D, 0x65, 0x43, 0x20, 0xD9, 0x8E, 0x69, 0x43,
+	// Bytes 4400 - 443f
+	0x20, 0xD9, 0x8F, 0x6D, 0x43, 0x20, 0xD9, 0x90,
+	0x71, 0x43, 0x20, 0xD9, 0x91, 0x75, 0x43, 0x20,
+	0xD9, 0x92, 0x79, 0x43, 0x41, 0xCC, 0x8A, 0xCD,
+	0x43, 0x73, 0xCC, 0x87, 0xCD, 0x44, 0x20, 0xE3,
+	0x82, 0x99, 0x11, 0x44, 0x20, 0xE3, 0x82, 0x9A,
+	0x11, 0x44, 0xC2, 0xA8, 0xCC, 0x81, 0xCE, 0x44,
+	0xCE, 0x91, 0xCC, 0x81, 0xCD, 0x44, 0xCE, 0x95,
+	0xCC, 0x81, 0xCD, 0x44, 0xCE, 0x97, 0xCC, 0x81,
+	// Bytes 4440 - 447f
+	0xCD, 0x44, 0xCE, 0x99, 0xCC, 0x81, 0xCD, 0x44,
+	0xCE, 0x9F, 0xCC, 0x81, 0xCD, 0x44, 0xCE, 0xA5,
+	0xCC, 0x81, 0xCD, 0x44, 0xCE, 0xA5, 0xCC, 0x88,
+	0xCD, 0x44, 0xCE, 0xA9, 0xCC, 0x81, 0xCD, 0x44,
+	0xCE, 0xB1, 0xCC, 0x81, 0xCD, 0x44, 0xCE, 0xB5,
+	0xCC, 0x81, 0xCD, 0x44, 0xCE, 0xB7, 0xCC, 0x81,
+	0xCD, 0x44, 0xCE, 0xB9, 0xCC, 0x81, 0xCD, 0x44,
+	0xCE, 0xBF, 0xCC, 0x81, 0xCD, 0x44, 0xCF, 0x85,
+	// Bytes 4480 - 44bf
+	0xCC, 0x81, 0xCD, 0x44, 0xCF, 0x89, 0xCC, 0x81,
+	0xCD, 0x44, 0xD7, 0x90, 0xD6, 0xB7, 0x35, 0x44,
+	0xD7, 0x90, 0xD6, 0xB8, 0x39, 0x44, 0xD7, 0x90,
+	0xD6, 0xBC, 0x45, 0x44, 0xD7, 0x91, 0xD6, 0xBC,
+	0x45, 0x44, 0xD7, 0x91, 0xD6, 0xBF, 0x4D, 0x44,
+	0xD7, 0x92, 0xD6, 0xBC, 0x45, 0x44, 0xD7, 0x93,
+	0xD6, 0xBC, 0x45, 0x44, 0xD7, 0x94, 0xD6, 0xBC,
+	0x45, 0x44, 0xD7, 0x95, 0xD6, 0xB9, 0x3D, 0x44,
+	// Bytes 44c0 - 44ff
+	0xD7, 0x95, 0xD6, 0xBC, 0x45, 0x44, 0xD7, 0x96,
+	0xD6, 0xBC, 0x45, 0x44, 0xD7, 0x98, 0xD6, 0xBC,
+	0x45, 0x44, 0xD7, 0x99, 0xD6, 0xB4, 0x29, 0x44,
+	0xD7, 0x99, 0xD6, 0xBC, 0x45, 0x44, 0xD7, 0x9A,
+	0xD6, 0xBC, 0x45, 0x44, 0xD7, 0x9B, 0xD6, 0xBC,
+	0x45, 0x44, 0xD7, 0x9B, 0xD6, 0xBF, 0x4D, 0x44,
+	0xD7, 0x9C, 0xD6, 0xBC, 0x45, 0x44, 0xD7, 0x9E,
+	0xD6, 0xBC, 0x45, 0x44, 0xD7, 0xA0, 0xD6, 0xBC,
+	// Bytes 4500 - 453f
+	0x45, 0x44, 0xD7, 0xA1, 0xD6, 0xBC, 0x45, 0x44,
+	0xD7, 0xA3, 0xD6, 0xBC, 0x45, 0x44, 0xD7, 0xA4,
+	0xD6, 0xBC, 0x45, 0x44, 0xD7, 0xA4, 0xD6, 0xBF,
+	0x4D, 0x44, 0xD7, 0xA6, 0xD6, 0xBC, 0x45, 0x44,
+	0xD7, 0xA7, 0xD6, 0xBC, 0x45, 0x44, 0xD7, 0xA8,
+	0xD6, 0xBC, 0x45, 0x44, 0xD7, 0xA9, 0xD6, 0xBC,
+	0x45, 0x44, 0xD7, 0xA9, 0xD7, 0x81, 0x51, 0x44,
+	0xD7, 0xA9, 0xD7, 0x82, 0x55, 0x44, 0xD7, 0xAA,
+	// Bytes 4540 - 457f
+	0xD6, 0xBC, 0x45, 0x44, 0xD7, 0xB2, 0xD6, 0xB7,
+	0x35, 0x44, 0xD8, 0xA7, 0xD9, 0x8B, 0x5D, 0x44,
+	0xD8, 0xA7, 0xD9, 0x93, 0xCD, 0x44, 0xD8, 0xA7,
+	0xD9, 0x94, 0xCD, 0x44, 0xD8, 0xA7, 0xD9, 0x95,
+	0xB9, 0x44, 0xD8, 0xB0, 0xD9, 0xB0, 0x7D, 0x44,
+	0xD8, 0xB1, 0xD9, 0xB0, 0x7D, 0x44, 0xD9, 0x80,
+	0xD9, 0x8B, 0x5D, 0x44, 0xD9, 0x80, 0xD9, 0x8E,
+	0x69, 0x44, 0xD9, 0x80, 0xD9, 0x8F, 0x6D, 0x44,
+	// Bytes 4580 - 45bf
+	0xD9, 0x80, 0xD9, 0x90, 0x71, 0x44, 0xD9, 0x80,
+	0xD9, 0x91, 0x75, 0x44, 0xD9, 0x80, 0xD9, 0x92,
+	0x79, 0x44, 0xD9, 0x87, 0xD9, 0xB0, 0x7D, 0x44,
+	0xD9, 0x88, 0xD9, 0x94, 0xCD, 0x44, 0xD9, 0x89,
+	0xD9, 0xB0, 0x7D, 0x44, 0xD9, 0x8A, 0xD9, 0x94,
+	0xCD, 0x44, 0xDB, 0x92, 0xD9, 0x94, 0xCD, 0x44,
+	0xDB, 0x95, 0xD9, 0x94, 0xCD, 0x45, 0x20, 0xCC,
+	0x88, 0xCC, 0x80, 0xCE, 0x45, 0x20, 0xCC, 0x88,
+	// Bytes 45c0 - 45ff
+	0xCC, 0x81, 0xCE, 0x45, 0x20, 0xCC, 0x88, 0xCD,
+	0x82, 0xCE, 0x45, 0x20, 0xCC, 0x93, 0xCC, 0x80,
+	0xCE, 0x45, 0x20, 0xCC, 0x93, 0xCC, 0x81, 0xCE,
+	0x45, 0x20, 0xCC, 0x93, 0xCD, 0x82, 0xCE, 0x45,
+	0x20, 0xCC, 0x94, 0xCC, 0x80, 0xCE, 0x45, 0x20,
+	0xCC, 0x94, 0xCC, 0x81, 0xCE, 0x45, 0x20, 0xCC,
+	0x94, 0xCD, 0x82, 0xCE, 0x45, 0x20, 0xD9, 0x8C,
+	0xD9, 0x91, 0x76, 0x45, 0x20, 0xD9, 0x8D, 0xD9,
+	// Bytes 4600 - 463f
+	0x91, 0x76, 0x45, 0x20, 0xD9, 0x8E, 0xD9, 0x91,
+	0x76, 0x45, 0x20, 0xD9, 0x8F, 0xD9, 0x91, 0x76,
+	0x45, 0x20, 0xD9, 0x90, 0xD9, 0x91, 0x76, 0x45,
+	0x20, 0xD9, 0x91, 0xD9, 0xB0, 0x7E, 0x45, 0xE2,
+	0xAB, 0x9D, 0xCC, 0xB8, 0x05, 0x46, 0xCE, 0xB9,
+	0xCC, 0x88, 0xCC, 0x81, 0xCE, 0x46, 0xCF, 0x85,
+	0xCC, 0x88, 0xCC, 0x81, 0xCE, 0x46, 0xD7, 0xA9,
+	0xD6, 0xBC, 0xD7, 0x81, 0x52, 0x46, 0xD7, 0xA9,
+	// Bytes 4640 - 467f
+	0xD6, 0xBC, 0xD7, 0x82, 0x56, 0x46, 0xD9, 0x80,
+	0xD9, 0x8E, 0xD9, 0x91, 0x76, 0x46, 0xD9, 0x80,
+	0xD9, 0x8F, 0xD9, 0x91, 0x76, 0x46, 0xD9, 0x80,
+	0xD9, 0x90, 0xD9, 0x91, 0x76, 0x46, 0xE0, 0xA4,
+	0x95, 0xE0, 0xA4, 0xBC, 0x0D, 0x46, 0xE0, 0xA4,
+	0x96, 0xE0, 0xA4, 0xBC, 0x0D, 0x46, 0xE0, 0xA4,
+	0x97, 0xE0, 0xA4, 0xBC, 0x0D, 0x46, 0xE0, 0xA4,
+	0x9C, 0xE0, 0xA4, 0xBC, 0x0D, 0x46, 0xE0, 0xA4,
+	// Bytes 4680 - 46bf
+	0xA1, 0xE0, 0xA4, 0xBC, 0x0D, 0x46, 0xE0, 0xA4,
+	0xA2, 0xE0, 0xA4, 0xBC, 0x0D, 0x46, 0xE0, 0xA4,
+	0xAB, 0xE0, 0xA4, 0xBC, 0x0D, 0x46, 0xE0, 0xA4,
+	0xAF, 0xE0, 0xA4, 0xBC, 0x0D, 0x46, 0xE0, 0xA6,
+	0xA1, 0xE0, 0xA6, 0xBC, 0x0D, 0x46, 0xE0, 0xA6,
+	0xA2, 0xE0, 0xA6, 0xBC, 0x0D, 0x46, 0xE0, 0xA6,
+	0xAF, 0xE0, 0xA6, 0xBC, 0x0D, 0x46, 0xE0, 0xA8,
+	0x96, 0xE0, 0xA8, 0xBC, 0x0D, 0x46, 0xE0, 0xA8,
+	// Bytes 46c0 - 46ff
+	0x97, 0xE0, 0xA8, 0xBC, 0x0D, 0x46, 0xE0, 0xA8,
+	0x9C, 0xE0, 0xA8, 0xBC, 0x0D, 0x46, 0xE0, 0xA8,
+	0xAB, 0xE0, 0xA8, 0xBC, 0x0D, 0x46, 0xE0, 0xA8,
+	0xB2, 0xE0, 0xA8, 0xBC, 0x0D, 0x46, 0xE0, 0xA8,
+	0xB8, 0xE0, 0xA8, 0xBC, 0x0D, 0x46, 0xE0, 0xAC,
+	0xA1, 0xE0, 0xAC, 0xBC, 0x0D, 0x46, 0xE0, 0xAC,
+	0xA2, 0xE0, 0xAC, 0xBC, 0x0D, 0x46, 0xE0, 0xBE,
+	0xB2, 0xE0, 0xBE, 0x80, 0xA1, 0x46, 0xE0, 0xBE,
+	// Bytes 4700 - 473f
+	0xB3, 0xE0, 0xBE, 0x80, 0xA1, 0x46, 0xE3, 0x83,
+	0x86, 0xE3, 0x82, 0x99, 0x11, 0x48, 0xF0, 0x9D,
+	0x85, 0x97, 0xF0, 0x9D, 0x85, 0xA5, 0xB1, 0x48,
+	0xF0, 0x9D, 0x85, 0x98, 0xF0, 0x9D, 0x85, 0xA5,
+	0xB1, 0x48, 0xF0, 0x9D, 0x86, 0xB9, 0xF0, 0x9D,
+	0x85, 0xA5, 0xB1, 0x48, 0xF0, 0x9D, 0x86, 0xBA,
+	0xF0, 0x9D, 0x85, 0xA5, 0xB1, 0x49, 0xE0, 0xBE,
+	0xB2, 0xE0, 0xBD, 0xB1, 0xE0, 0xBE, 0x80, 0xA2,
+	// Bytes 4740 - 477f
+	0x49, 0xE0, 0xBE, 0xB3, 0xE0, 0xBD, 0xB1, 0xE0,
+	0xBE, 0x80, 0xA2, 0x4C, 0xF0, 0x9D, 0x85, 0x98,
+	0xF0, 0x9D, 0x85, 0xA5, 0xF0, 0x9D, 0x85, 0xAE,
+	0xB2, 0x4C, 0xF0, 0x9D, 0x85, 0x98, 0xF0, 0x9D,
+	0x85, 0xA5, 0xF0, 0x9D, 0x85, 0xAF, 0xB2, 0x4C,
+	0xF0, 0x9D, 0x85, 0x98, 0xF0, 0x9D, 0x85, 0xA5,
+	0xF0, 0x9D, 0x85, 0xB0, 0xB2, 0x4C, 0xF0, 0x9D,
+	0x85, 0x98, 0xF0, 0x9D, 0x85, 0xA5, 0xF0, 0x9D,
+	// Bytes 4780 - 47bf
+	0x85, 0xB1, 0xB2, 0x4C, 0xF0, 0x9D, 0x85, 0x98,
+	0xF0, 0x9D, 0x85, 0xA5, 0xF0, 0x9D, 0x85, 0xB2,
+	0xB2, 0x4C, 0xF0, 0x9D, 0x86, 0xB9, 0xF0, 0x9D,
+	0x85, 0xA5, 0xF0, 0x9D, 0x85, 0xAE, 0xB2, 0x4C,
+	0xF0, 0x9D, 0x86, 0xB9, 0xF0, 0x9D, 0x85, 0xA5,
+	0xF0, 0x9D, 0x85, 0xAF, 0xB2, 0x4C, 0xF0, 0x9D,
+	0x86, 0xBA, 0xF0, 0x9D, 0x85, 0xA5, 0xF0, 0x9D,
+	0x85, 0xAE, 0xB2, 0x4C, 0xF0, 0x9D, 0x86, 0xBA,
+	// Bytes 47c0 - 47ff
+	0xF0, 0x9D, 0x85, 0xA5, 0xF0, 0x9D, 0x85, 0xAF,
+	0xB2, 0x83, 0x41, 0xCC, 0x82, 0xCD, 0x83, 0x41,
+	0xCC, 0x86, 0xCD, 0x83, 0x41, 0xCC, 0x87, 0xCD,
+	0x83, 0x41, 0xCC, 0x88, 0xCD, 0x83, 0x41, 0xCC,
+	0x8A, 0xCD, 0x83, 0x41, 0xCC, 0xA3, 0xB9, 0x83,
+	0x43, 0xCC, 0xA7, 0xA9, 0x83, 0x45, 0xCC, 0x82,
+	0xCD, 0x83, 0x45, 0xCC, 0x84, 0xCD, 0x83, 0x45,
+	0xCC, 0xA3, 0xB9, 0x83, 0x45, 0xCC, 0xA7, 0xA9,
+	// Bytes 4800 - 483f
+	0x83, 0x49, 0xCC, 0x88, 0xCD, 0x83, 0x4C, 0xCC,
+	0xA3, 0xB9, 0x83, 0x4F, 0xCC, 0x82, 0xCD, 0x83,
+	0x4F, 0xCC, 0x83, 0xCD, 0x83, 0x4F, 0xCC, 0x84,
+	0xCD, 0x83, 0x4F, 0xCC, 0x87, 0xCD, 0x83, 0x4F,
+	0xCC, 0x88, 0xCD, 0x83, 0x4F, 0xCC, 0x9B, 0xB1,
+	0x83, 0x4F, 0xCC, 0xA3, 0xB9, 0x83, 0x4F, 0xCC,
+	0xA8, 0xA9, 0x83, 0x52, 0xCC, 0xA3, 0xB9, 0x83,
+	0x53, 0xCC, 0x81, 0xCD, 0x83, 0x53, 0xCC, 0x8C,
+	// Bytes 4840 - 487f
+	0xCD, 0x83, 0x53, 0xCC, 0xA3, 0xB9, 0x83, 0x55,
+	0xCC, 0x83, 0xCD, 0x83, 0x55, 0xCC, 0x84, 0xCD,
+	0x83, 0x55, 0xCC, 0x88, 0xCD, 0x83, 0x55, 0xCC,
+	0x9B, 0xB1, 0x83, 0x61, 0xCC, 0x82, 0xCD, 0x83,
+	0x61, 0xCC, 0x86, 0xCD, 0x83, 0x61, 0xCC, 0x87,
+	0xCD, 0x83, 0x61, 0xCC, 0x88, 0xCD, 0x83, 0x61,
+	0xCC, 0x8A, 0xCD, 0x83, 0x61, 0xCC, 0xA3, 0xB9,
+	0x83, 0x63, 0xCC, 0xA7, 0xA9, 0x83, 0x65, 0xCC,
+	// Bytes 4880 - 48bf
+	0x82, 0xCD, 0x83, 0x65, 0xCC, 0x84, 0xCD, 0x83,
+	0x65, 0xCC, 0xA3, 0xB9, 0x83, 0x65, 0xCC, 0xA7,
+	0xA9, 0x83, 0x69, 0xCC, 0x88, 0xCD, 0x83, 0x6C,
+	0xCC, 0xA3, 0xB9, 0x83, 0x6F, 0xCC, 0x82, 0xCD,
+	0x83, 0x6F, 0xCC, 0x83, 0xCD, 0x83, 0x6F, 0xCC,
+	0x84, 0xCD, 0x83, 0x6F, 0xCC, 0x87, 0xCD, 0x83,
+	0x6F, 0xCC, 0x88, 0xCD, 0x83, 0x6F, 0xCC, 0x9B,
+	0xB1, 0x83, 0x6F, 0xCC, 0xA3, 0xB9, 0x83, 0x6F,
+	// Bytes 48c0 - 48ff
+	0xCC, 0xA8, 0xA9, 0x83, 0x72, 0xCC, 0xA3, 0xB9,
+	0x83, 0x73, 0xCC, 0x81, 0xCD, 0x83, 0x73, 0xCC,
+	0x8C, 0xCD, 0x83, 0x73, 0xCC, 0xA3, 0xB9, 0x83,
+	0x75, 0xCC, 0x83, 0xCD, 0x83, 0x75, 0xCC, 0x84,
+	0xCD, 0x83, 0x75, 0xCC, 0x88, 0xCD, 0x83, 0x75,
+	0xCC, 0x9B, 0xB1, 0x84, 0xCE, 0x91, 0xCC, 0x93,
+	0xCD, 0x84, 0xCE, 0x91, 0xCC, 0x94, 0xCD, 0x84,
+	0xCE, 0x95, 0xCC, 0x93, 0xCD, 0x84, 0xCE, 0x95,
+	// Bytes 4900 - 493f
+	0xCC, 0x94, 0xCD, 0x84, 0xCE, 0x97, 0xCC, 0x93,
+	0xCD, 0x84, 0xCE, 0x97, 0xCC, 0x94, 0xCD, 0x84,
+	0xCE, 0x99, 0xCC, 0x93, 0xCD, 0x84, 0xCE, 0x99,
+	0xCC, 0x94, 0xCD, 0x84, 0xCE, 0x9F, 0xCC, 0x93,
+	0xCD, 0x84, 0xCE, 0x9F, 0xCC, 0x94, 0xCD, 0x84,
+	0xCE, 0xA5, 0xCC, 0x94, 0xCD, 0x84, 0xCE, 0xA9,
+	0xCC, 0x93, 0xCD, 0x84, 0xCE, 0xA9, 0xCC, 0x94,
+	0xCD, 0x84, 0xCE, 0xB1, 0xCC, 0x80, 0xCD, 0x84,
+	// Bytes 4940 - 497f
+	0xCE, 0xB1, 0xCC, 0x81, 0xCD, 0x84, 0xCE, 0xB1,
+	0xCC, 0x93, 0xCD, 0x84, 0xCE, 0xB1, 0xCC, 0x94,
+	0xCD, 0x84, 0xCE, 0xB1, 0xCD, 0x82, 0xCD, 0x84,
+	0xCE, 0xB5, 0xCC, 0x93, 0xCD, 0x84, 0xCE, 0xB5,
+	0xCC, 0x94, 0xCD, 0x84, 0xCE, 0xB7, 0xCC, 0x80,
+	0xCD, 0x84, 0xCE, 0xB7, 0xCC, 0x81, 0xCD, 0x84,
+	0xCE, 0xB7, 0xCC, 0x93, 0xCD, 0x84, 0xCE, 0xB7,
+	0xCC, 0x94, 0xCD, 0x84, 0xCE, 0xB7, 0xCD, 0x82,
+	// Bytes 4980 - 49bf
+	0xCD, 0x84, 0xCE, 0xB9, 0xCC, 0x88, 0xCD, 0x84,
+	0xCE, 0xB9, 0xCC, 0x93, 0xCD, 0x84, 0xCE, 0xB9,
+	0xCC, 0x94, 0xCD, 0x84, 0xCE, 0xBF, 0xCC, 0x93,
+	0xCD, 0x84, 0xCE, 0xBF, 0xCC, 0x94, 0xCD, 0x84,
+	0xCF, 0x85, 0xCC, 0x88, 0xCD, 0x84, 0xCF, 0x85,
+	0xCC, 0x93, 0xCD, 0x84, 0xCF, 0x85, 0xCC, 0x94,
+	0xCD, 0x84, 0xCF, 0x89, 0xCC, 0x80, 0xCD, 0x84,
+	0xCF, 0x89, 0xCC, 0x81, 0xCD, 0x84, 0xCF, 0x89,
+	// Bytes 49c0 - 49ff
+	0xCC, 0x93, 0xCD, 0x84, 0xCF, 0x89, 0xCC, 0x94,
+	0xCD, 0x84, 0xCF, 0x89, 0xCD, 0x82, 0xCD, 0x86,
+	0xCE, 0x91, 0xCC, 0x93, 0xCC, 0x80, 0xCE, 0x86,
+	0xCE, 0x91, 0xCC, 0x93, 0xCC, 0x81, 0xCE, 0x86,
+	0xCE, 0x91, 0xCC, 0x93, 0xCD, 0x82, 0xCE, 0x86,
+	0xCE, 0x91, 0xCC, 0x94, 0xCC, 0x80, 0xCE, 0x86,
+	0xCE, 0x91, 0xCC, 0x94, 0xCC, 0x81, 0xCE, 0x86,
+	0xCE, 0x91, 0xCC, 0x94, 0xCD, 0x82, 0xCE, 0x86,
+	// Bytes 4a00 - 4a3f
+	0xCE, 0x97, 0xCC, 0x93, 0xCC, 0x80, 0xCE, 0x86,
+	0xCE, 0x97, 0xCC, 0x93, 0xCC, 0x81, 0xCE, 0x86,
+	0xCE, 0x97, 0xCC, 0x93, 0xCD, 0x82, 0xCE, 0x86,
+	0xCE, 0x97, 0xCC, 0x94, 0xCC, 0x80, 0xCE, 0x86,
+	0xCE, 0x97, 0xCC, 0x94, 0xCC, 0x81, 0xCE, 0x86,
+	0xCE, 0x97, 0xCC, 0x94, 0xCD, 0x82, 0xCE, 0x86,
+	0xCE, 0xA9, 0xCC, 0x93, 0xCC, 0x80, 0xCE, 0x86,
+	0xCE, 0xA9, 0xCC, 0x93, 0xCC, 0x81, 0xCE, 0x86,
+	// Bytes 4a40 - 4a7f
+	0xCE, 0xA9, 0xCC, 0x93, 0xCD, 0x82, 0xCE, 0x86,
+	0xCE, 0xA9, 0xCC, 0x94, 0xCC, 0x80, 0xCE, 0x86,
+	0xCE, 0xA9, 0xCC, 0x94, 0xCC, 0x81, 0xCE, 0x86,
+	0xCE, 0xA9, 0xCC, 0x94, 0xCD, 0x82, 0xCE, 0x86,
+	0xCE, 0xB1, 0xCC, 0x93, 0xCC, 0x80, 0xCE, 0x86,
+	0xCE, 0xB1, 0xCC, 0x93, 0xCC, 0x81, 0xCE, 0x86,
+	0xCE, 0xB1, 0xCC, 0x93, 0xCD, 0x82, 0xCE, 0x86,
+	0xCE, 0xB1, 0xCC, 0x94, 0xCC, 0x80, 0xCE, 0x86,
+	// Bytes 4a80 - 4abf
+	0xCE, 0xB1, 0xCC, 0x94, 0xCC, 0x81, 0xCE, 0x86,
+	0xCE, 0xB1, 0xCC, 0x94, 0xCD, 0x82, 0xCE, 0x86,
+	0xCE, 0xB7, 0xCC, 0x93, 0xCC, 0x80, 0xCE, 0x86,
+	0xCE, 0xB7, 0xCC, 0x93, 0xCC, 0x81, 0xCE, 0x86,
+	0xCE, 0xB7, 0xCC, 0x93, 0xCD, 0x82, 0xCE, 0x86,
+	0xCE, 0xB7, 0xCC, 0x94, 0xCC, 0x80, 0xCE, 0x86,
+	0xCE, 0xB7, 0xCC, 0x94, 0xCC, 0x81, 0xCE, 0x86,
+	0xCE, 0xB7, 0xCC, 0x94, 0xCD, 0x82, 0xCE, 0x86,
+	// Bytes 4ac0 - 4aff
+	0xCF, 0x89, 0xCC, 0x93, 0xCC, 0x80, 0xCE, 0x86,
+	0xCF, 0x89, 0xCC, 0x93, 0xCC, 0x81, 0xCE, 0x86,
+	0xCF, 0x89, 0xCC, 0x93, 0xCD, 0x82, 0xCE, 0x86,
+	0xCF, 0x89, 0xCC, 0x94, 0xCC, 0x80, 0xCE, 0x86,
+	0xCF, 0x89, 0xCC, 0x94, 0xCC, 0x81, 0xCE, 0x86,
+	0xCF, 0x89, 0xCC, 0x94, 0xCD, 0x82, 0xCE, 0x42,
+	0xCC, 0x80, 0xCD, 0x33, 0x42, 0xCC, 0x81, 0xCD,
+	0x33, 0x42, 0xCC, 0x93, 0xCD, 0x33, 0x43, 0xE1,
+	// Bytes 4b00 - 4b3f
+	0x85, 0xA1, 0x01, 0x00, 0x43, 0xE1, 0x85, 0xA2,
+	0x01, 0x00, 0x43, 0xE1, 0x85, 0xA3, 0x01, 0x00,
+	0x43, 0xE1, 0x85, 0xA4, 0x01, 0x00, 0x43, 0xE1,
+	0x85, 0xA5, 0x01, 0x00, 0x43, 0xE1, 0x85, 0xA6,
+	0x01, 0x00, 0x43, 0xE1, 0x85, 0xA7, 0x01, 0x00,
+	0x43, 0xE1, 0x85, 0xA8, 0x01, 0x00, 0x43, 0xE1,
+	0x85, 0xA9, 0x01, 0x00, 0x43, 0xE1, 0x85, 0xAA,
+	0x01, 0x00, 0x43, 0xE1, 0x85, 0xAB, 0x01, 0x00,
+	// Bytes 4b40 - 4b7f
+	0x43, 0xE1, 0x85, 0xAC, 0x01, 0x00, 0x43, 0xE1,
+	0x85, 0xAD, 0x01, 0x00, 0x43, 0xE1, 0x85, 0xAE,
+	0x01, 0x00, 0x43, 0xE1, 0x85, 0xAF, 0x01, 0x00,
+	0x43, 0xE1, 0x85, 0xB0, 0x01, 0x00, 0x43, 0xE1,
+	0x85, 0xB1, 0x01, 0x00, 0x43, 0xE1, 0x85, 0xB2,
+	0x01, 0x00, 0x43, 0xE1, 0x85, 0xB3, 0x01, 0x00,
+	0x43, 0xE1, 0x85, 0xB4, 0x01, 0x00, 0x43, 0xE1,
+	0x85, 0xB5, 0x01, 0x00, 0x43, 0xE1, 0x86, 0xAA,
+	// Bytes 4b80 - 4bbf
+	0x01, 0x00, 0x43, 0xE1, 0x86, 0xAC, 0x01, 0x00,
+	0x43, 0xE1, 0x86, 0xAD, 0x01, 0x00, 0x43, 0xE1,
+	0x86, 0xB0, 0x01, 0x00, 0x43, 0xE1, 0x86, 0xB1,
+	0x01, 0x00, 0x43, 0xE1, 0x86, 0xB2, 0x01, 0x00,
+	0x43, 0xE1, 0x86, 0xB3, 0x01, 0x00, 0x43, 0xE1,
+	0x86, 0xB4, 0x01, 0x00, 0x43, 0xE1, 0x86, 0xB5,
+	0x01, 0x00, 0x44, 0xCC, 0x88, 0xCC, 0x81, 0xCE,
+	0x33, 0x43, 0xE3, 0x82, 0x99, 0x11, 0x04, 0x43,
+	// Bytes 4bc0 - 4bff
+	0xE3, 0x82, 0x9A, 0x11, 0x04, 0x46, 0xE0, 0xBD,
+	0xB1, 0xE0, 0xBD, 0xB2, 0xA2, 0x27, 0x46, 0xE0,
+	0xBD, 0xB1, 0xE0, 0xBD, 0xB4, 0xA6, 0x27, 0x46,
+	0xE0, 0xBD, 0xB1, 0xE0, 0xBE, 0x80, 0xA2, 0x27,
+	0x00, 0x01,
+}
+
+// lookup returns the trie value for the first UTF-8 encoding in s and
+// the width in bytes of this encoding. The size will be 0 if s does not
+// hold enough bytes to complete the encoding. len(s) must be greater than 0.
+func (t *nfcTrie) lookup(s []byte) (v uint16, sz int) {
+	c0 := s[0]
+	switch {
+	case c0 < 0x80: // is ASCII
+		return nfcValues[c0], 1
+	case c0 < 0xC2:
+		return 0, 1 // Illegal UTF-8: not a starter, not ASCII.
+	case c0 < 0xE0: // 2-byte UTF-8
+		if len(s) < 2 {
+			return 0, 0
+		}
+		i := nfcIndex[c0]
+		c1 := s[1]
+		if c1 < 0x80 || 0xC0 <= c1 {
+			return 0, 1 // Illegal UTF-8: not a continuation byte.
+		}
+		return t.lookupValue(uint32(i), c1), 2
+	case c0 < 0xF0: // 3-byte UTF-8
+		if len(s) < 3 {
+			return 0, 0
+		}
+		i := nfcIndex[c0]
+		c1 := s[1]
+		if c1 < 0x80 || 0xC0 <= c1 {
+			return 0, 1 // Illegal UTF-8: not a continuation byte.
+		}
+		o := uint32(i)<<6 + uint32(c1)
+		i = nfcIndex[o]
+		c2 := s[2]
+		if c2 < 0x80 || 0xC0 <= c2 {
+			return 0, 2 // Illegal UTF-8: not a continuation byte.
+		}
+		return t.lookupValue(uint32(i), c2), 3
+	case c0 < 0xF8: // 4-byte UTF-8
+		if len(s) < 4 {
+			return 0, 0
+		}
+		i := nfcIndex[c0]
+		c1 := s[1]
+		if c1 < 0x80 || 0xC0 <= c1 {
+			return 0, 1 // Illegal UTF-8: not a continuation byte.
+		}
+		o := uint32(i)<<6 + uint32(c1)
+		i = nfcIndex[o]
+		c2 := s[2]
+		if c2 < 0x80 || 0xC0 <= c2 {
+			return 0, 2 // Illegal UTF-8: not a continuation byte.
+		}
+		o = uint32(i)<<6 + uint32(c2)
+		i = nfcIndex[o]
+		c3 := s[3]
+		if c3 < 0x80 || 0xC0 <= c3 {
+			return 0, 3 // Illegal UTF-8: not a continuation byte.
+		}
+		return t.lookupValue(uint32(i), c3), 4
+	}
+	// Illegal rune
+	return 0, 1
+}
+
+// lookupUnsafe returns the trie value for the first UTF-8 encoding in s.
+// s must start with a full and valid UTF-8 encoded rune.
+func (t *nfcTrie) lookupUnsafe(s []byte) uint16 {
+	c0 := s[0]
+	if c0 < 0x80 { // is ASCII
+		return nfcValues[c0]
+	}
+	i := nfcIndex[c0]
+	if c0 < 0xE0 { // 2-byte UTF-8
+		return t.lookupValue(uint32(i), s[1])
+	}
+	i = nfcIndex[uint32(i)<<6+uint32(s[1])]
+	if c0 < 0xF0 { // 3-byte UTF-8
+		return t.lookupValue(uint32(i), s[2])
+	}
+	i = nfcIndex[uint32(i)<<6+uint32(s[2])]
+	if c0 < 0xF8 { // 4-byte UTF-8
+		return t.lookupValue(uint32(i), s[3])
+	}
+	return 0
+}
+
+// lookupString returns the trie value for the first UTF-8 encoding in s and
+// the width in bytes of this encoding. The size will be 0 if s does not
+// hold enough bytes to complete the encoding. len(s) must be greater than 0.
+func (t *nfcTrie) lookupString(s string) (v uint16, sz int) {
+	c0 := s[0]
+	switch {
+	case c0 < 0x80: // is ASCII
+		return nfcValues[c0], 1
+	case c0 < 0xC2:
+		return 0, 1 // Illegal UTF-8: not a starter, not ASCII.
+	case c0 < 0xE0: // 2-byte UTF-8
+		if len(s) < 2 {
+			return 0, 0
+		}
+		i := nfcIndex[c0]
+		c1 := s[1]
+		if c1 < 0x80 || 0xC0 <= c1 {
+			return 0, 1 // Illegal UTF-8: not a continuation byte.
+		}
+		return t.lookupValue(uint32(i), c1), 2
+	case c0 < 0xF0: // 3-byte UTF-8
+		if len(s) < 3 {
+			return 0, 0
+		}
+		i := nfcIndex[c0]
+		c1 := s[1]
+		if c1 < 0x80 || 0xC0 <= c1 {
+			return 0, 1 // Illegal UTF-8: not a continuation byte.
+		}
+		o := uint32(i)<<6 + uint32(c1)
+		i = nfcIndex[o]
+		c2 := s[2]
+		if c2 < 0x80 || 0xC0 <= c2 {
+			return 0, 2 // Illegal UTF-8: not a continuation byte.
+		}
+		return t.lookupValue(uint32(i), c2), 3
+	case c0 < 0xF8: // 4-byte UTF-8
+		if len(s) < 4 {
+			return 0, 0
+		}
+		i := nfcIndex[c0]
+		c1 := s[1]
+		if c1 < 0x80 || 0xC0 <= c1 {
+			return 0, 1 // Illegal UTF-8: not a continuation byte.
+		}
+		o := uint32(i)<<6 + uint32(c1)
+		i = nfcIndex[o]
+		c2 := s[2]
+		if c2 < 0x80 || 0xC0 <= c2 {
+			return 0, 2 // Illegal UTF-8: not a continuation byte.
+		}
+		o = uint32(i)<<6 + uint32(c2)
+		i = nfcIndex[o]
+		c3 := s[3]
+		if c3 < 0x80 || 0xC0 <= c3 {
+			return 0, 3 // Illegal UTF-8: not a continuation byte.
+		}
+		return t.lookupValue(uint32(i), c3), 4
+	}
+	// Illegal rune
+	return 0, 1
+}
+
+// lookupStringUnsafe returns the trie value for the first UTF-8 encoding in s.
+// s must start with a full and valid UTF-8 encoded rune.
+func (t *nfcTrie) lookupStringUnsafe(s string) uint16 {
+	c0 := s[0]
+	if c0 < 0x80 { // is ASCII
+		return nfcValues[c0]
+	}
+	i := nfcIndex[c0]
+	if c0 < 0xE0 { // 2-byte UTF-8
+		return t.lookupValue(uint32(i), s[1])
+	}
+	i = nfcIndex[uint32(i)<<6+uint32(s[1])]
+	if c0 < 0xF0 { // 3-byte UTF-8
+		return t.lookupValue(uint32(i), s[2])
+	}
+	i = nfcIndex[uint32(i)<<6+uint32(s[2])]
+	if c0 < 0xF8 { // 4-byte UTF-8
+		return t.lookupValue(uint32(i), s[3])
+	}
+	return 0
+}
+
+// nfcTrie. Total size: 10798 bytes (10.54 KiB). Checksum: b5981cc85e3bd14.
+type nfcTrie struct{}
+
+func newNfcTrie(i int) *nfcTrie {
+	return &nfcTrie{}
+}
+
+// lookupValue determines the type of block n and looks up the value for b.
+func (t *nfcTrie) lookupValue(n uint32, b byte) uint16 {
+	switch {
+	case n < 46:
+		return uint16(nfcValues[n<<6+uint32(b)])
+	default:
+		n -= 46
+		return uint16(nfcSparse.lookup(n, b))
+	}
+}
+
+// nfcValues: 48 blocks, 3072 entries, 6144 bytes
+// The third block is the zero block.
+var nfcValues = [3072]uint16{
+	// Block 0x0, offset 0x0
+	0x3c: 0xa000, 0x3d: 0xa000, 0x3e: 0xa000,
+	// Block 0x1, offset 0x40
+	0x41: 0xa000, 0x42: 0xa000, 0x43: 0xa000, 0x44: 0xa000, 0x45: 0xa000,
+	0x46: 0xa000, 0x47: 0xa000, 0x48: 0xa000, 0x49: 0xa000, 0x4a: 0xa000, 0x4b: 0xa000,
+	0x4c: 0xa000, 0x4d: 0xa000, 0x4e: 0xa000, 0x4f: 0xa000, 0x50: 0xa000,
+	0x52: 0xa000, 0x53: 0xa000, 0x54: 0xa000, 0x55: 0xa000, 0x56: 0xa000, 0x57: 0xa000,
+	0x58: 0xa000, 0x59: 0xa000, 0x5a: 0xa000,
+	0x61: 0xa000, 0x62: 0xa000, 0x63: 0xa000,
+	0x64: 0xa000, 0x65: 0xa000, 0x66: 0xa000, 0x67: 0xa000, 0x68: 0xa000, 0x69: 0xa000,
+	0x6a: 0xa000, 0x6b: 0xa000, 0x6c: 0xa000, 0x6d: 0xa000, 0x6e: 0xa000, 0x6f: 0xa000,
+	0x70: 0xa000, 0x72: 0xa000, 0x73: 0xa000, 0x74: 0xa000, 0x75: 0xa000,
+	0x76: 0xa000, 0x77: 0xa000, 0x78: 0xa000, 0x79: 0xa000, 0x7a: 0xa000,
+	// Block 0x2, offset 0x80
+	// Block 0x3, offset 0xc0
+	0xc0: 0x30b0, 0xc1: 0x30b5, 0xc2: 0x47c9, 0xc3: 0x30ba, 0xc4: 0x47d8, 0xc5: 0x47dd,
+	0xc6: 0xa000, 0xc7: 0x47e7, 0xc8: 0x3123, 0xc9: 0x3128, 0xca: 0x47ec, 0xcb: 0x313c,
+	0xcc: 0x31af, 0xcd: 0x31b4, 0xce: 0x31b9, 0xcf: 0x4800, 0xd1: 0x3245,
+	0xd2: 0x3268, 0xd3: 0x326d, 0xd4: 0x480a, 0xd5: 0x480f, 0xd6: 0x481e,
+	0xd8: 0xa000, 0xd9: 0x32f4, 0xda: 0x32f9, 0xdb: 0x32fe, 0xdc: 0x4850, 0xdd: 0x3376,
+	0xe0: 0x33bc, 0xe1: 0x33c1, 0xe2: 0x485a, 0xe3: 0x33c6,
+	0xe4: 0x4869, 0xe5: 0x486e, 0xe6: 0xa000, 0xe7: 0x4878, 0xe8: 0x342f, 0xe9: 0x3434,
+	0xea: 0x487d, 0xeb: 0x3448, 0xec: 0x34c0, 0xed: 0x34c5, 0xee: 0x34ca, 0xef: 0x4891,
+	0xf1: 0x3556, 0xf2: 0x3579, 0xf3: 0x357e, 0xf4: 0x489b, 0xf5: 0x48a0,
+	0xf6: 0x48af, 0xf8: 0xa000, 0xf9: 0x360a, 0xfa: 0x360f, 0xfb: 0x3614,
+	0xfc: 0x48e1, 0xfd: 0x3691, 0xff: 0x36aa,
+	// Block 0x4, offset 0x100
+	0x100: 0x30bf, 0x101: 0x33cb, 0x102: 0x47ce, 0x103: 0x485f, 0x104: 0x30dd, 0x105: 0x33e9,
+	0x106: 0x30f1, 0x107: 0x33fd, 0x108: 0x30f6, 0x109: 0x3402, 0x10a: 0x30fb, 0x10b: 0x3407,
+	0x10c: 0x3100, 0x10d: 0x340c, 0x10e: 0x310a, 0x10f: 0x3416,
+	0x112: 0x47f1, 0x113: 0x4882, 0x114: 0x3132, 0x115: 0x343e, 0x116: 0x3137, 0x117: 0x3443,
+	0x118: 0x3155, 0x119: 0x3461, 0x11a: 0x3146, 0x11b: 0x3452, 0x11c: 0x316e, 0x11d: 0x347a,
+	0x11e: 0x3178, 0x11f: 0x3484, 0x120: 0x317d, 0x121: 0x3489, 0x122: 0x3187, 0x123: 0x3493,
+	0x124: 0x318c, 0x125: 0x3498, 0x128: 0x31be, 0x129: 0x34cf,
+	0x12a: 0x31c3, 0x12b: 0x34d4, 0x12c: 0x31c8, 0x12d: 0x34d9, 0x12e: 0x31eb, 0x12f: 0x34f7,
+	0x130: 0x31cd, 0x134: 0x31f5, 0x135: 0x3501,
+	0x136: 0x3209, 0x137: 0x351a, 0x139: 0x3213, 0x13a: 0x3524, 0x13b: 0x321d,
+	0x13c: 0x352e, 0x13d: 0x3218, 0x13e: 0x3529,
+	// Block 0x5, offset 0x140
+	0x143: 0x3240, 0x144: 0x3551, 0x145: 0x3259,
+	0x146: 0x356a, 0x147: 0x324f, 0x148: 0x3560,
+	0x14c: 0x4814, 0x14d: 0x48a5, 0x14e: 0x3272, 0x14f: 0x3583, 0x150: 0x327c, 0x151: 0x358d,
+	0x154: 0x329a, 0x155: 0x35ab, 0x156: 0x32b3, 0x157: 0x35c4,
+	0x158: 0x32a4, 0x159: 0x35b5, 0x15a: 0x4837, 0x15b: 0x48c8, 0x15c: 0x32bd, 0x15d: 0x35ce,
+	0x15e: 0x32cc, 0x15f: 0x35dd, 0x160: 0x483c, 0x161: 0x48cd, 0x162: 0x32e5, 0x163: 0x35fb,
+	0x164: 0x32d6, 0x165: 0x35ec, 0x168: 0x4846, 0x169: 0x48d7,
+	0x16a: 0x484b, 0x16b: 0x48dc, 0x16c: 0x3303, 0x16d: 0x3619, 0x16e: 0x330d, 0x16f: 0x3623,
+	0x170: 0x3312, 0x171: 0x3628, 0x172: 0x3330, 0x173: 0x3646, 0x174: 0x3353, 0x175: 0x3669,
+	0x176: 0x337b, 0x177: 0x3696, 0x178: 0x338f, 0x179: 0x339e, 0x17a: 0x36be, 0x17b: 0x33a8,
+	0x17c: 0x36c8, 0x17d: 0x33ad, 0x17e: 0x36cd, 0x17f: 0xa000,
+	// Block 0x6, offset 0x180
+	0x184: 0x8100, 0x185: 0x8100,
+	0x186: 0x8100,
+	0x18d: 0x30c9, 0x18e: 0x33d5, 0x18f: 0x31d7, 0x190: 0x34e3, 0x191: 0x3281,
+	0x192: 0x3592, 0x193: 0x3317, 0x194: 0x362d, 0x195: 0x3b10, 0x196: 0x3c9f, 0x197: 0x3b09,
+	0x198: 0x3c98, 0x199: 0x3b17, 0x19a: 0x3ca6, 0x19b: 0x3b02, 0x19c: 0x3c91,
+	0x19e: 0x39f1, 0x19f: 0x3b80, 0x1a0: 0x39ea, 0x1a1: 0x3b79, 0x1a2: 0x36f4, 0x1a3: 0x3706,
+	0x1a6: 0x3182, 0x1a7: 0x348e, 0x1a8: 0x31ff, 0x1a9: 0x3510,
+	0x1aa: 0x482d, 0x1ab: 0x48be, 0x1ac: 0x3ad1, 0x1ad: 0x3c60, 0x1ae: 0x3718, 0x1af: 0x371e,
+	0x1b0: 0x3506, 0x1b4: 0x3169, 0x1b5: 0x3475,
+	0x1b8: 0x323b, 0x1b9: 0x354c, 0x1ba: 0x39f8, 0x1bb: 0x3b87,
+	0x1bc: 0x36ee, 0x1bd: 0x3700, 0x1be: 0x36fa, 0x1bf: 0x370c,
+	// Block 0x7, offset 0x1c0
+	0x1c0: 0x30ce, 0x1c1: 0x33da, 0x1c2: 0x30d3, 0x1c3: 0x33df, 0x1c4: 0x314b, 0x1c5: 0x3457,
+	0x1c6: 0x3150, 0x1c7: 0x345c, 0x1c8: 0x31dc, 0x1c9: 0x34e8, 0x1ca: 0x31e1, 0x1cb: 0x34ed,
+	0x1cc: 0x3286, 0x1cd: 0x3597, 0x1ce: 0x328b, 0x1cf: 0x359c, 0x1d0: 0x32a9, 0x1d1: 0x35ba,
+	0x1d2: 0x32ae, 0x1d3: 0x35bf, 0x1d4: 0x331c, 0x1d5: 0x3632, 0x1d6: 0x3321, 0x1d7: 0x3637,
+	0x1d8: 0x32c7, 0x1d9: 0x35d8, 0x1da: 0x32e0, 0x1db: 0x35f6,
+	0x1de: 0x319b, 0x1df: 0x34a7,
+	0x1e6: 0x47d3, 0x1e7: 0x4864, 0x1e8: 0x47fb, 0x1e9: 0x488c,
+	0x1ea: 0x3aa0, 0x1eb: 0x3c2f, 0x1ec: 0x3a7d, 0x1ed: 0x3c0c, 0x1ee: 0x4819, 0x1ef: 0x48aa,
+	0x1f0: 0x3a99, 0x1f1: 0x3c28, 0x1f2: 0x3385, 0x1f3: 0x36a0,
+	// Block 0x8, offset 0x200
+	0x200: 0x9933, 0x201: 0x9933, 0x202: 0x9933, 0x203: 0x9933, 0x204: 0x9933, 0x205: 0x8133,
+	0x206: 0x9933, 0x207: 0x9933, 0x208: 0x9933, 0x209: 0x9933, 0x20a: 0x9933, 0x20b: 0x9933,
+	0x20c: 0x9933, 0x20d: 0x8133, 0x20e: 0x8133, 0x20f: 0x9933, 0x210: 0x8133, 0x211: 0x9933,
+	0x212: 0x8133, 0x213: 0x9933, 0x214: 0x9933, 0x215: 0x8134, 0x216: 0x812e, 0x217: 0x812e,
+	0x218: 0x812e, 0x219: 0x812e, 0x21a: 0x8134, 0x21b: 0x992c, 0x21c: 0x812e, 0x21d: 0x812e,
+	0x21e: 0x812e, 0x21f: 0x812e, 0x220: 0x812e, 0x221: 0x812a, 0x222: 0x812a, 0x223: 0x992e,
+	0x224: 0x992e, 0x225: 0x992e, 0x226: 0x992e, 0x227: 0x992a, 0x228: 0x992a, 0x229: 0x812e,
+	0x22a: 0x812e, 0x22b: 0x812e, 0x22c: 0x812e, 0x22d: 0x992e, 0x22e: 0x992e, 0x22f: 0x812e,
+	0x230: 0x992e, 0x231: 0x992e, 0x232: 0x812e, 0x233: 0x812e, 0x234: 0x8101, 0x235: 0x8101,
+	0x236: 0x8101, 0x237: 0x8101, 0x238: 0x9901, 0x239: 0x812e, 0x23a: 0x812e, 0x23b: 0x812e,
+	0x23c: 0x812e, 0x23d: 0x8133, 0x23e: 0x8133, 0x23f: 0x8133,
+	// Block 0x9, offset 0x240
+	0x240: 0x4aef, 0x241: 0x4af4, 0x242: 0x9933, 0x243: 0x4af9, 0x244: 0x4bb2, 0x245: 0x9937,
+	0x246: 0x8133, 0x247: 0x812e, 0x248: 0x812e, 0x249: 0x812e, 0x24a: 0x8133, 0x24b: 0x8133,
+	0x24c: 0x8133, 0x24d: 0x812e, 0x24e: 0x812e, 0x250: 0x8133, 0x251: 0x8133,
+	0x252: 0x8133, 0x253: 0x812e, 0x254: 0x812e, 0x255: 0x812e, 0x256: 0x812e, 0x257: 0x8133,
+	0x258: 0x8134, 0x259: 0x812e, 0x25a: 0x812e, 0x25b: 0x8133, 0x25c: 0x8135, 0x25d: 0x8136,
+	0x25e: 0x8136, 0x25f: 0x8135, 0x260: 0x8136, 0x261: 0x8136, 0x262: 0x8135, 0x263: 0x8133,
+	0x264: 0x8133, 0x265: 0x8133, 0x266: 0x8133, 0x267: 0x8133, 0x268: 0x8133, 0x269: 0x8133,
+	0x26a: 0x8133, 0x26b: 0x8133, 0x26c: 0x8133, 0x26d: 0x8133, 0x26e: 0x8133, 0x26f: 0x8133,
+	0x274: 0x01ee,
+	0x27a: 0x8100,
+	0x27e: 0x0037,
+	// Block 0xa, offset 0x280
+	0x284: 0x8100, 0x285: 0x36e2,
+	0x286: 0x372a, 0x287: 0x00ce, 0x288: 0x3748, 0x289: 0x3754, 0x28a: 0x3766,
+	0x28c: 0x3784, 0x28e: 0x3796, 0x28f: 0x37b4, 0x290: 0x3f49, 0x291: 0xa000,
+	0x295: 0xa000, 0x297: 0xa000,
+	0x299: 0xa000,
+	0x29f: 0xa000, 0x2a1: 0xa000,
+	0x2a5: 0xa000, 0x2a9: 0xa000,
+	0x2aa: 0x3778, 0x2ab: 0x37a8, 0x2ac: 0x493f, 0x2ad: 0x37d8, 0x2ae: 0x4969, 0x2af: 0x37ea,
+	0x2b0: 0x3fb1, 0x2b1: 0xa000, 0x2b5: 0xa000,
+	0x2b7: 0xa000, 0x2b9: 0xa000,
+	0x2bf: 0xa000,
+	// Block 0xb, offset 0x2c0
+	0x2c0: 0x3862, 0x2c1: 0x386e, 0x2c3: 0x385c,
+	0x2c6: 0xa000, 0x2c7: 0x384a,
+	0x2cc: 0x389e, 0x2cd: 0x3886, 0x2ce: 0x38b0, 0x2d0: 0xa000,
+	0x2d3: 0xa000, 0x2d5: 0xa000, 0x2d6: 0xa000, 0x2d7: 0xa000,
+	0x2d8: 0xa000, 0x2d9: 0x3892, 0x2da: 0xa000,
+	0x2de: 0xa000, 0x2e3: 0xa000,
+	0x2e7: 0xa000,
+	0x2eb: 0xa000, 0x2ed: 0xa000,
+	0x2f0: 0xa000, 0x2f3: 0xa000, 0x2f5: 0xa000,
+	0x2f6: 0xa000, 0x2f7: 0xa000, 0x2f8: 0xa000, 0x2f9: 0x3916, 0x2fa: 0xa000,
+	0x2fe: 0xa000,
+	// Block 0xc, offset 0x300
+	0x301: 0x3874, 0x302: 0x38f8,
+	0x310: 0x3850, 0x311: 0x38d4,
+	0x312: 0x3856, 0x313: 0x38da, 0x316: 0x3868, 0x317: 0x38ec,
+	0x318: 0xa000, 0x319: 0xa000, 0x31a: 0x396a, 0x31b: 0x3970, 0x31c: 0x387a, 0x31d: 0x38fe,
+	0x31e: 0x3880, 0x31f: 0x3904, 0x322: 0x388c, 0x323: 0x3910,
+	0x324: 0x3898, 0x325: 0x391c, 0x326: 0x38a4, 0x327: 0x3928, 0x328: 0xa000, 0x329: 0xa000,
+	0x32a: 0x3976, 0x32b: 0x397c, 0x32c: 0x38ce, 0x32d: 0x3952, 0x32e: 0x38aa, 0x32f: 0x392e,
+	0x330: 0x38b6, 0x331: 0x393a, 0x332: 0x38bc, 0x333: 0x3940, 0x334: 0x38c2, 0x335: 0x3946,
+	0x338: 0x38c8, 0x339: 0x394c,
+	// Block 0xd, offset 0x340
+	0x351: 0x812e,
+	0x352: 0x8133, 0x353: 0x8133, 0x354: 0x8133, 0x355: 0x8133, 0x356: 0x812e, 0x357: 0x8133,
+	0x358: 0x8133, 0x359: 0x8133, 0x35a: 0x812f, 0x35b: 0x812e, 0x35c: 0x8133, 0x35d: 0x8133,
+	0x35e: 0x8133, 0x35f: 0x8133, 0x360: 0x8133, 0x361: 0x8133, 0x362: 0x812e, 0x363: 0x812e,
+	0x364: 0x812e, 0x365: 0x812e, 0x366: 0x812e, 0x367: 0x812e, 0x368: 0x8133, 0x369: 0x8133,
+	0x36a: 0x812e, 0x36b: 0x8133, 0x36c: 0x8133, 0x36d: 0x812f, 0x36e: 0x8132, 0x36f: 0x8133,
+	0x370: 0x8106, 0x371: 0x8107, 0x372: 0x8108, 0x373: 0x8109, 0x374: 0x810a, 0x375: 0x810b,
+	0x376: 0x810c, 0x377: 0x810d, 0x378: 0x810e, 0x379: 0x810f, 0x37a: 0x810f, 0x37b: 0x8110,
+	0x37c: 0x8111, 0x37d: 0x8112, 0x37f: 0x8113,
+	// Block 0xe, offset 0x380
+	0x388: 0xa000, 0x38a: 0xa000, 0x38b: 0x8117,
+	0x38c: 0x8118, 0x38d: 0x8119, 0x38e: 0x811a, 0x38f: 0x811b, 0x390: 0x811c, 0x391: 0x811d,
+	0x392: 0x811e, 0x393: 0x9933, 0x394: 0x9933, 0x395: 0x992e, 0x396: 0x812e, 0x397: 0x8133,
+	0x398: 0x8133, 0x399: 0x8133, 0x39a: 0x8133, 0x39b: 0x8133, 0x39c: 0x812e, 0x39d: 0x8133,
+	0x39e: 0x8133, 0x39f: 0x812e,
+	0x3b0: 0x811f,
+	// Block 0xf, offset 0x3c0
+	0x3ca: 0x8133, 0x3cb: 0x8133,
+	0x3cc: 0x8133, 0x3cd: 0x8133, 0x3ce: 0x8133, 0x3cf: 0x812e, 0x3d0: 0x812e, 0x3d1: 0x812e,
+	0x3d2: 0x812e, 0x3d3: 0x812e, 0x3d4: 0x8133, 0x3d5: 0x8133, 0x3d6: 0x8133, 0x3d7: 0x8133,
+	0x3d8: 0x8133, 0x3d9: 0x8133, 0x3da: 0x8133, 0x3db: 0x8133, 0x3dc: 0x8133, 0x3dd: 0x8133,
+	0x3de: 0x8133, 0x3df: 0x8133, 0x3e0: 0x8133, 0x3e1: 0x8133, 0x3e3: 0x812e,
+	0x3e4: 0x8133, 0x3e5: 0x8133, 0x3e6: 0x812e, 0x3e7: 0x8133, 0x3e8: 0x8133, 0x3e9: 0x812e,
+	0x3ea: 0x8133, 0x3eb: 0x8133, 0x3ec: 0x8133, 0x3ed: 0x812e, 0x3ee: 0x812e, 0x3ef: 0x812e,
+	0x3f0: 0x8117, 0x3f1: 0x8118, 0x3f2: 0x8119, 0x3f3: 0x8133, 0x3f4: 0x8133, 0x3f5: 0x8133,
+	0x3f6: 0x812e, 0x3f7: 0x8133, 0x3f8: 0x8133, 0x3f9: 0x812e, 0x3fa: 0x812e, 0x3fb: 0x8133,
+	0x3fc: 0x8133, 0x3fd: 0x8133, 0x3fe: 0x8133, 0x3ff: 0x8133,
+	// Block 0x10, offset 0x400
+	0x405: 0xa000,
+	0x406: 0x2e5d, 0x407: 0xa000, 0x408: 0x2e65, 0x409: 0xa000, 0x40a: 0x2e6d, 0x40b: 0xa000,
+	0x40c: 0x2e75, 0x40d: 0xa000, 0x40e: 0x2e7d, 0x411: 0xa000,
+	0x412: 0x2e85,
+	0x434: 0x8103, 0x435: 0x9900,
+	0x43a: 0xa000, 0x43b: 0x2e8d,
+	0x43c: 0xa000, 0x43d: 0x2e95, 0x43e: 0xa000, 0x43f: 0xa000,
+	// Block 0x11, offset 0x440
+	0x440: 0x8133, 0x441: 0x8133, 0x442: 0x812e, 0x443: 0x8133, 0x444: 0x8133, 0x445: 0x8133,
+	0x446: 0x8133, 0x447: 0x8133, 0x448: 0x8133, 0x449: 0x8133, 0x44a: 0x812e, 0x44b: 0x8133,
+	0x44c: 0x8133, 0x44d: 0x8136, 0x44e: 0x812b, 0x44f: 0x812e, 0x450: 0x812a, 0x451: 0x8133,
+	0x452: 0x8133, 0x453: 0x8133, 0x454: 0x8133, 0x455: 0x8133, 0x456: 0x8133, 0x457: 0x8133,
+	0x458: 0x8133, 0x459: 0x8133, 0x45a: 0x8133, 0x45b: 0x8133, 0x45c: 0x8133, 0x45d: 0x8133,
+	0x45e: 0x8133, 0x45f: 0x8133, 0x460: 0x8133, 0x461: 0x8133, 0x462: 0x8133, 0x463: 0x8133,
+	0x464: 0x8133, 0x465: 0x8133, 0x466: 0x8133, 0x467: 0x8133, 0x468: 0x8133, 0x469: 0x8133,
+	0x46a: 0x8133, 0x46b: 0x8133, 0x46c: 0x8133, 0x46d: 0x8133, 0x46e: 0x8133, 0x46f: 0x8133,
+	0x470: 0x8133, 0x471: 0x8133, 0x472: 0x8133, 0x473: 0x8133, 0x474: 0x8133, 0x475: 0x8133,
+	0x476: 0x8134, 0x477: 0x8132, 0x478: 0x8132, 0x479: 0x812e, 0x47a: 0x812d, 0x47b: 0x8133,
+	0x47c: 0x8135, 0x47d: 0x812e, 0x47e: 0x8133, 0x47f: 0x812e,
+	// Block 0x12, offset 0x480
+	0x480: 0x30d8, 0x481: 0x33e4, 0x482: 0x30e2, 0x483: 0x33ee, 0x484: 0x30e7, 0x485: 0x33f3,
+	0x486: 0x30ec, 0x487: 0x33f8, 0x488: 0x3a0d, 0x489: 0x3b9c, 0x48a: 0x3105, 0x48b: 0x3411,
+	0x48c: 0x310f, 0x48d: 0x341b, 0x48e: 0x311e, 0x48f: 0x342a, 0x490: 0x3114, 0x491: 0x3420,
+	0x492: 0x3119, 0x493: 0x3425, 0x494: 0x3a30, 0x495: 0x3bbf, 0x496: 0x3a37, 0x497: 0x3bc6,
+	0x498: 0x315a, 0x499: 0x3466, 0x49a: 0x315f, 0x49b: 0x346b, 0x49c: 0x3a45, 0x49d: 0x3bd4,
+	0x49e: 0x3164, 0x49f: 0x3470, 0x4a0: 0x3173, 0x4a1: 0x347f, 0x4a2: 0x3191, 0x4a3: 0x349d,
+	0x4a4: 0x31a0, 0x4a5: 0x34ac, 0x4a6: 0x3196, 0x4a7: 0x34a2, 0x4a8: 0x31a5, 0x4a9: 0x34b1,
+	0x4aa: 0x31aa, 0x4ab: 0x34b6, 0x4ac: 0x31f0, 0x4ad: 0x34fc, 0x4ae: 0x3a4c, 0x4af: 0x3bdb,
+	0x4b0: 0x31fa, 0x4b1: 0x350b, 0x4b2: 0x3204, 0x4b3: 0x3515, 0x4b4: 0x320e, 0x4b5: 0x351f,
+	0x4b6: 0x4805, 0x4b7: 0x4896, 0x4b8: 0x3a53, 0x4b9: 0x3be2, 0x4ba: 0x3227, 0x4bb: 0x3538,
+	0x4bc: 0x3222, 0x4bd: 0x3533, 0x4be: 0x322c, 0x4bf: 0x353d,
+	// Block 0x13, offset 0x4c0
+	0x4c0: 0x3231, 0x4c1: 0x3542, 0x4c2: 0x3236, 0x4c3: 0x3547, 0x4c4: 0x324a, 0x4c5: 0x355b,
+	0x4c6: 0x3254, 0x4c7: 0x3565, 0x4c8: 0x3263, 0x4c9: 0x3574, 0x4ca: 0x325e, 0x4cb: 0x356f,
+	0x4cc: 0x3a76, 0x4cd: 0x3c05, 0x4ce: 0x3a84, 0x4cf: 0x3c13, 0x4d0: 0x3a8b, 0x4d1: 0x3c1a,
+	0x4d2: 0x3a92, 0x4d3: 0x3c21, 0x4d4: 0x3290, 0x4d5: 0x35a1, 0x4d6: 0x3295, 0x4d7: 0x35a6,
+	0x4d8: 0x329f, 0x4d9: 0x35b0, 0x4da: 0x4832, 0x4db: 0x48c3, 0x4dc: 0x3ad8, 0x4dd: 0x3c67,
+	0x4de: 0x32b8, 0x4df: 0x35c9, 0x4e0: 0x32c2, 0x4e1: 0x35d3, 0x4e2: 0x4841, 0x4e3: 0x48d2,
+	0x4e4: 0x3adf, 0x4e5: 0x3c6e, 0x4e6: 0x3ae6, 0x4e7: 0x3c75, 0x4e8: 0x3aed, 0x4e9: 0x3c7c,
+	0x4ea: 0x32d1, 0x4eb: 0x35e2, 0x4ec: 0x32db, 0x4ed: 0x35f1, 0x4ee: 0x32ef, 0x4ef: 0x3605,
+	0x4f0: 0x32ea, 0x4f1: 0x3600, 0x4f2: 0x332b, 0x4f3: 0x3641, 0x4f4: 0x333a, 0x4f5: 0x3650,
+	0x4f6: 0x3335, 0x4f7: 0x364b, 0x4f8: 0x3af4, 0x4f9: 0x3c83, 0x4fa: 0x3afb, 0x4fb: 0x3c8a,
+	0x4fc: 0x333f, 0x4fd: 0x3655, 0x4fe: 0x3344, 0x4ff: 0x365a,
+	// Block 0x14, offset 0x500
+	0x500: 0x3349, 0x501: 0x365f, 0x502: 0x334e, 0x503: 0x3664, 0x504: 0x335d, 0x505: 0x3673,
+	0x506: 0x3358, 0x507: 0x366e, 0x508: 0x3362, 0x509: 0x367d, 0x50a: 0x3367, 0x50b: 0x3682,
+	0x50c: 0x336c, 0x50d: 0x3687, 0x50e: 0x338a, 0x50f: 0x36a5, 0x510: 0x33a3, 0x511: 0x36c3,
+	0x512: 0x33b2, 0x513: 0x36d2, 0x514: 0x33b7, 0x515: 0x36d7, 0x516: 0x34bb, 0x517: 0x35e7,
+	0x518: 0x3678, 0x519: 0x36b4, 0x51b: 0x3712,
+	0x520: 0x47e2, 0x521: 0x4873, 0x522: 0x30c4, 0x523: 0x33d0,
+	0x524: 0x39b9, 0x525: 0x3b48, 0x526: 0x39b2, 0x527: 0x3b41, 0x528: 0x39c7, 0x529: 0x3b56,
+	0x52a: 0x39c0, 0x52b: 0x3b4f, 0x52c: 0x39ff, 0x52d: 0x3b8e, 0x52e: 0x39d5, 0x52f: 0x3b64,
+	0x530: 0x39ce, 0x531: 0x3b5d, 0x532: 0x39e3, 0x533: 0x3b72, 0x534: 0x39dc, 0x535: 0x3b6b,
+	0x536: 0x3a06, 0x537: 0x3b95, 0x538: 0x47f6, 0x539: 0x4887, 0x53a: 0x3141, 0x53b: 0x344d,
+	0x53c: 0x312d, 0x53d: 0x3439, 0x53e: 0x3a1b, 0x53f: 0x3baa,
+	// Block 0x15, offset 0x540
+	0x540: 0x3a14, 0x541: 0x3ba3, 0x542: 0x3a29, 0x543: 0x3bb8, 0x544: 0x3a22, 0x545: 0x3bb1,
+	0x546: 0x3a3e, 0x547: 0x3bcd, 0x548: 0x31d2, 0x549: 0x34de, 0x54a: 0x31e6, 0x54b: 0x34f2,
+	0x54c: 0x4828, 0x54d: 0x48b9, 0x54e: 0x3277, 0x54f: 0x3588, 0x550: 0x3a61, 0x551: 0x3bf0,
+	0x552: 0x3a5a, 0x553: 0x3be9, 0x554: 0x3a6f, 0x555: 0x3bfe, 0x556: 0x3a68, 0x557: 0x3bf7,
+	0x558: 0x3aca, 0x559: 0x3c59, 0x55a: 0x3aae, 0x55b: 0x3c3d, 0x55c: 0x3aa7, 0x55d: 0x3c36,
+	0x55e: 0x3abc, 0x55f: 0x3c4b, 0x560: 0x3ab5, 0x561: 0x3c44, 0x562: 0x3ac3, 0x563: 0x3c52,
+	0x564: 0x3326, 0x565: 0x363c, 0x566: 0x3308, 0x567: 0x361e, 0x568: 0x3b25, 0x569: 0x3cb4,
+	0x56a: 0x3b1e, 0x56b: 0x3cad, 0x56c: 0x3b33, 0x56d: 0x3cc2, 0x56e: 0x3b2c, 0x56f: 0x3cbb,
+	0x570: 0x3b3a, 0x571: 0x3cc9, 0x572: 0x3371, 0x573: 0x368c, 0x574: 0x3399, 0x575: 0x36b9,
+	0x576: 0x3394, 0x577: 0x36af, 0x578: 0x3380, 0x579: 0x369b,
+	// Block 0x16, offset 0x580
+	0x580: 0x4945, 0x581: 0x494b, 0x582: 0x4a5f, 0x583: 0x4a77, 0x584: 0x4a67, 0x585: 0x4a7f,
+	0x586: 0x4a6f, 0x587: 0x4a87, 0x588: 0x48eb, 0x589: 0x48f1, 0x58a: 0x49cf, 0x58b: 0x49e7,
+	0x58c: 0x49d7, 0x58d: 0x49ef, 0x58e: 0x49df, 0x58f: 0x49f7, 0x590: 0x4957, 0x591: 0x495d,
+	0x592: 0x3ef9, 0x593: 0x3f09, 0x594: 0x3f01, 0x595: 0x3f11,
+	0x598: 0x48f7, 0x599: 0x48fd, 0x59a: 0x3e29, 0x59b: 0x3e39, 0x59c: 0x3e31, 0x59d: 0x3e41,
+	0x5a0: 0x496f, 0x5a1: 0x4975, 0x5a2: 0x4a8f, 0x5a3: 0x4aa7,
+	0x5a4: 0x4a97, 0x5a5: 0x4aaf, 0x5a6: 0x4a9f, 0x5a7: 0x4ab7, 0x5a8: 0x4903, 0x5a9: 0x4909,
+	0x5aa: 0x49ff, 0x5ab: 0x4a17, 0x5ac: 0x4a07, 0x5ad: 0x4a1f, 0x5ae: 0x4a0f, 0x5af: 0x4a27,
+	0x5b0: 0x4987, 0x5b1: 0x498d, 0x5b2: 0x3f59, 0x5b3: 0x3f71, 0x5b4: 0x3f61, 0x5b5: 0x3f79,
+	0x5b6: 0x3f69, 0x5b7: 0x3f81, 0x5b8: 0x490f, 0x5b9: 0x4915, 0x5ba: 0x3e59, 0x5bb: 0x3e71,
+	0x5bc: 0x3e61, 0x5bd: 0x3e79, 0x5be: 0x3e69, 0x5bf: 0x3e81,
+	// Block 0x17, offset 0x5c0
+	0x5c0: 0x4993, 0x5c1: 0x4999, 0x5c2: 0x3f89, 0x5c3: 0x3f99, 0x5c4: 0x3f91, 0x5c5: 0x3fa1,
+	0x5c8: 0x491b, 0x5c9: 0x4921, 0x5ca: 0x3e89, 0x5cb: 0x3e99,
+	0x5cc: 0x3e91, 0x5cd: 0x3ea1, 0x5d0: 0x49a5, 0x5d1: 0x49ab,
+	0x5d2: 0x3fc1, 0x5d3: 0x3fd9, 0x5d4: 0x3fc9, 0x5d5: 0x3fe1, 0x5d6: 0x3fd1, 0x5d7: 0x3fe9,
+	0x5d9: 0x4927, 0x5db: 0x3ea9, 0x5dd: 0x3eb1,
+	0x5df: 0x3eb9, 0x5e0: 0x49bd, 0x5e1: 0x49c3, 0x5e2: 0x4abf, 0x5e3: 0x4ad7,
+	0x5e4: 0x4ac7, 0x5e5: 0x4adf, 0x5e6: 0x4acf, 0x5e7: 0x4ae7, 0x5e8: 0x492d, 0x5e9: 0x4933,
+	0x5ea: 0x4a2f, 0x5eb: 0x4a47, 0x5ec: 0x4a37, 0x5ed: 0x4a4f, 0x5ee: 0x4a3f, 0x5ef: 0x4a57,
+	0x5f0: 0x4939, 0x5f1: 0x445f, 0x5f2: 0x37d2, 0x5f3: 0x4465, 0x5f4: 0x4963, 0x5f5: 0x446b,
+	0x5f6: 0x37e4, 0x5f7: 0x4471, 0x5f8: 0x3802, 0x5f9: 0x4477, 0x5fa: 0x381a, 0x5fb: 0x447d,
+	0x5fc: 0x49b1, 0x5fd: 0x4483,
+	// Block 0x18, offset 0x600
+	0x600: 0x3ee1, 0x601: 0x3ee9, 0x602: 0x42c5, 0x603: 0x42e3, 0x604: 0x42cf, 0x605: 0x42ed,
+	0x606: 0x42d9, 0x607: 0x42f7, 0x608: 0x3e19, 0x609: 0x3e21, 0x60a: 0x4211, 0x60b: 0x422f,
+	0x60c: 0x421b, 0x60d: 0x4239, 0x60e: 0x4225, 0x60f: 0x4243, 0x610: 0x3f29, 0x611: 0x3f31,
+	0x612: 0x4301, 0x613: 0x431f, 0x614: 0x430b, 0x615: 0x4329, 0x616: 0x4315, 0x617: 0x4333,
+	0x618: 0x3e49, 0x619: 0x3e51, 0x61a: 0x424d, 0x61b: 0x426b, 0x61c: 0x4257, 0x61d: 0x4275,
+	0x61e: 0x4261, 0x61f: 0x427f, 0x620: 0x4001, 0x621: 0x4009, 0x622: 0x433d, 0x623: 0x435b,
+	0x624: 0x4347, 0x625: 0x4365, 0x626: 0x4351, 0x627: 0x436f, 0x628: 0x3ec1, 0x629: 0x3ec9,
+	0x62a: 0x4289, 0x62b: 0x42a7, 0x62c: 0x4293, 0x62d: 0x42b1, 0x62e: 0x429d, 0x62f: 0x42bb,
+	0x630: 0x37c6, 0x631: 0x37c0, 0x632: 0x3ed1, 0x633: 0x37cc, 0x634: 0x3ed9,
+	0x636: 0x4951, 0x637: 0x3ef1, 0x638: 0x3736, 0x639: 0x3730, 0x63a: 0x3724, 0x63b: 0x442f,
+	0x63c: 0x373c, 0x63d: 0x8100, 0x63e: 0x0257, 0x63f: 0xa100,
+	// Block 0x19, offset 0x640
+	0x640: 0x8100, 0x641: 0x36e8, 0x642: 0x3f19, 0x643: 0x37de, 0x644: 0x3f21,
+	0x646: 0x497b, 0x647: 0x3f39, 0x648: 0x3742, 0x649: 0x4435, 0x64a: 0x374e, 0x64b: 0x443b,
+	0x64c: 0x375a, 0x64d: 0x3cd0, 0x64e: 0x3cd7, 0x64f: 0x3cde, 0x650: 0x37f6, 0x651: 0x37f0,
+	0x652: 0x3f41, 0x653: 0x4625, 0x656: 0x37fc, 0x657: 0x3f51,
+	0x658: 0x3772, 0x659: 0x376c, 0x65a: 0x3760, 0x65b: 0x4441, 0x65d: 0x3ce5,
+	0x65e: 0x3cec, 0x65f: 0x3cf3, 0x660: 0x382c, 0x661: 0x3826, 0x662: 0x3fa9, 0x663: 0x462d,
+	0x664: 0x380e, 0x665: 0x3814, 0x666: 0x3832, 0x667: 0x3fb9, 0x668: 0x37a2, 0x669: 0x379c,
+	0x66a: 0x3790, 0x66b: 0x444d, 0x66c: 0x378a, 0x66d: 0x36dc, 0x66e: 0x4429, 0x66f: 0x0081,
+	0x672: 0x3ff1, 0x673: 0x3838, 0x674: 0x3ff9,
+	0x676: 0x49c9, 0x677: 0x4011, 0x678: 0x377e, 0x679: 0x4447, 0x67a: 0x37ae, 0x67b: 0x4459,
+	0x67c: 0x37ba, 0x67d: 0x4397, 0x67e: 0xa100,
+	// Block 0x1a, offset 0x680
+	0x681: 0x3d47, 0x683: 0xa000, 0x684: 0x3d4e, 0x685: 0xa000,
+	0x687: 0x3d55, 0x688: 0xa000, 0x689: 0x3d5c,
+	0x68d: 0xa000,
+	0x6a0: 0x30a6, 0x6a1: 0xa000, 0x6a2: 0x3d6a,
+	0x6a4: 0xa000, 0x6a5: 0xa000,
+	0x6ad: 0x3d63, 0x6ae: 0x30a1, 0x6af: 0x30ab,
+	0x6b0: 0x3d71, 0x6b1: 0x3d78, 0x6b2: 0xa000, 0x6b3: 0xa000, 0x6b4: 0x3d7f, 0x6b5: 0x3d86,
+	0x6b6: 0xa000, 0x6b7: 0xa000, 0x6b8: 0x3d8d, 0x6b9: 0x3d94, 0x6ba: 0xa000, 0x6bb: 0xa000,
+	0x6bc: 0xa000, 0x6bd: 0xa000,
+	// Block 0x1b, offset 0x6c0
+	0x6c0: 0x3d9b, 0x6c1: 0x3da2, 0x6c2: 0xa000, 0x6c3: 0xa000, 0x6c4: 0x3db7, 0x6c5: 0x3dbe,
+	0x6c6: 0xa000, 0x6c7: 0xa000, 0x6c8: 0x3dc5, 0x6c9: 0x3dcc,
+	0x6d1: 0xa000,
+	0x6d2: 0xa000,
+	0x6e2: 0xa000,
+	0x6e8: 0xa000, 0x6e9: 0xa000,
+	0x6eb: 0xa000, 0x6ec: 0x3de1, 0x6ed: 0x3de8, 0x6ee: 0x3def, 0x6ef: 0x3df6,
+	0x6f2: 0xa000, 0x6f3: 0xa000, 0x6f4: 0xa000, 0x6f5: 0xa000,
+	// Block 0x1c, offset 0x700
+	0x706: 0xa000, 0x70b: 0xa000,
+	0x70c: 0x4049, 0x70d: 0xa000, 0x70e: 0x4051, 0x70f: 0xa000, 0x710: 0x4059, 0x711: 0xa000,
+	0x712: 0x4061, 0x713: 0xa000, 0x714: 0x4069, 0x715: 0xa000, 0x716: 0x4071, 0x717: 0xa000,
+	0x718: 0x4079, 0x719: 0xa000, 0x71a: 0x4081, 0x71b: 0xa000, 0x71c: 0x4089, 0x71d: 0xa000,
+	0x71e: 0x4091, 0x71f: 0xa000, 0x720: 0x4099, 0x721: 0xa000, 0x722: 0x40a1,
+	0x724: 0xa000, 0x725: 0x40a9, 0x726: 0xa000, 0x727: 0x40b1, 0x728: 0xa000, 0x729: 0x40b9,
+	0x72f: 0xa000,
+	0x730: 0x40c1, 0x731: 0x40c9, 0x732: 0xa000, 0x733: 0x40d1, 0x734: 0x40d9, 0x735: 0xa000,
+	0x736: 0x40e1, 0x737: 0x40e9, 0x738: 0xa000, 0x739: 0x40f1, 0x73a: 0x40f9, 0x73b: 0xa000,
+	0x73c: 0x4101, 0x73d: 0x4109,
+	// Block 0x1d, offset 0x740
+	0x754: 0x4041,
+	0x759: 0x9904, 0x75a: 0x9904, 0x75b: 0x8100, 0x75c: 0x8100, 0x75d: 0xa000,
+	0x75e: 0x4111,
+	0x766: 0xa000,
+	0x76b: 0xa000, 0x76c: 0x4121, 0x76d: 0xa000, 0x76e: 0x4129, 0x76f: 0xa000,
+	0x770: 0x4131, 0x771: 0xa000, 0x772: 0x4139, 0x773: 0xa000, 0x774: 0x4141, 0x775: 0xa000,
+	0x776: 0x4149, 0x777: 0xa000, 0x778: 0x4151, 0x779: 0xa000, 0x77a: 0x4159, 0x77b: 0xa000,
+	0x77c: 0x4161, 0x77d: 0xa000, 0x77e: 0x4169, 0x77f: 0xa000,
+	// Block 0x1e, offset 0x780
+	0x780: 0x4171, 0x781: 0xa000, 0x782: 0x4179, 0x784: 0xa000, 0x785: 0x4181,
+	0x786: 0xa000, 0x787: 0x4189, 0x788: 0xa000, 0x789: 0x4191,
+	0x78f: 0xa000, 0x790: 0x4199, 0x791: 0x41a1,
+	0x792: 0xa000, 0x793: 0x41a9, 0x794: 0x41b1, 0x795: 0xa000, 0x796: 0x41b9, 0x797: 0x41c1,
+	0x798: 0xa000, 0x799: 0x41c9, 0x79a: 0x41d1, 0x79b: 0xa000, 0x79c: 0x41d9, 0x79d: 0x41e1,
+	0x7af: 0xa000,
+	0x7b0: 0xa000, 0x7b1: 0xa000, 0x7b2: 0xa000, 0x7b4: 0x4119,
+	0x7b7: 0x41e9, 0x7b8: 0x41f1, 0x7b9: 0x41f9, 0x7ba: 0x4201,
+	0x7bd: 0xa000, 0x7be: 0x4209,
+	// Block 0x1f, offset 0x7c0
+	0x7c0: 0x1472, 0x7c1: 0x0df6, 0x7c2: 0x14ce, 0x7c3: 0x149a, 0x7c4: 0x0f52, 0x7c5: 0x07e6,
+	0x7c6: 0x09da, 0x7c7: 0x1726, 0x7c8: 0x1726, 0x7c9: 0x0b06, 0x7ca: 0x155a, 0x7cb: 0x0a3e,
+	0x7cc: 0x0b02, 0x7cd: 0x0cea, 0x7ce: 0x10ca, 0x7cf: 0x125a, 0x7d0: 0x1392, 0x7d1: 0x13ce,
+	0x7d2: 0x1402, 0x7d3: 0x1516, 0x7d4: 0x0e6e, 0x7d5: 0x0efa, 0x7d6: 0x0fa6, 0x7d7: 0x103e,
+	0x7d8: 0x135a, 0x7d9: 0x1542, 0x7da: 0x166e, 0x7db: 0x080a, 0x7dc: 0x09ae, 0x7dd: 0x0e82,
+	0x7de: 0x0fca, 0x7df: 0x138e, 0x7e0: 0x16be, 0x7e1: 0x0bae, 0x7e2: 0x0f72, 0x7e3: 0x137e,
+	0x7e4: 0x1412, 0x7e5: 0x0d1e, 0x7e6: 0x12b6, 0x7e7: 0x13da, 0x7e8: 0x0c1a, 0x7e9: 0x0e0a,
+	0x7ea: 0x0f12, 0x7eb: 0x1016, 0x7ec: 0x1522, 0x7ed: 0x084a, 0x7ee: 0x08e2, 0x7ef: 0x094e,
+	0x7f0: 0x0d86, 0x7f1: 0x0e7a, 0x7f2: 0x0fc6, 0x7f3: 0x10ea, 0x7f4: 0x1272, 0x7f5: 0x1386,
+	0x7f6: 0x139e, 0x7f7: 0x14c2, 0x7f8: 0x15ea, 0x7f9: 0x169e, 0x7fa: 0x16ba, 0x7fb: 0x1126,
+	0x7fc: 0x1166, 0x7fd: 0x121e, 0x7fe: 0x133e, 0x7ff: 0x1576,
+	// Block 0x20, offset 0x800
+	0x800: 0x16c6, 0x801: 0x1446, 0x802: 0x0ac2, 0x803: 0x0c36, 0x804: 0x11d6, 0x805: 0x1296,
+	0x806: 0x0ffa, 0x807: 0x112e, 0x808: 0x1492, 0x809: 0x15e2, 0x80a: 0x0abe, 0x80b: 0x0b8a,
+	0x80c: 0x0e72, 0x80d: 0x0f26, 0x80e: 0x0f5a, 0x80f: 0x120e, 0x810: 0x1236, 0x811: 0x15a2,
+	0x812: 0x094a, 0x813: 0x12a2, 0x814: 0x08ee, 0x815: 0x08ea, 0x816: 0x1192, 0x817: 0x1222,
+	0x818: 0x1356, 0x819: 0x15aa, 0x81a: 0x1462, 0x81b: 0x0d22, 0x81c: 0x0e6e, 0x81d: 0x1452,
+	0x81e: 0x07f2, 0x81f: 0x0b5e, 0x820: 0x0c8e, 0x821: 0x102a, 0x822: 0x10aa, 0x823: 0x096e,
+	0x824: 0x1136, 0x825: 0x085a, 0x826: 0x0c72, 0x827: 0x07d2, 0x828: 0x0ee6, 0x829: 0x0d9e,
+	0x82a: 0x120a, 0x82b: 0x09c2, 0x82c: 0x0aae, 0x82d: 0x10f6, 0x82e: 0x135e, 0x82f: 0x1436,
+	0x830: 0x0eb2, 0x831: 0x14f2, 0x832: 0x0ede, 0x833: 0x0d32, 0x834: 0x1316, 0x835: 0x0d52,
+	0x836: 0x10a6, 0x837: 0x0826, 0x838: 0x08a2, 0x839: 0x08e6, 0x83a: 0x0e4e, 0x83b: 0x11f6,
+	0x83c: 0x12ee, 0x83d: 0x1442, 0x83e: 0x1556, 0x83f: 0x0956,
+	// Block 0x21, offset 0x840
+	0x840: 0x0a0a, 0x841: 0x0b12, 0x842: 0x0c2a, 0x843: 0x0dba, 0x844: 0x0f76, 0x845: 0x113a,
+	0x846: 0x1592, 0x847: 0x1676, 0x848: 0x16ca, 0x849: 0x16e2, 0x84a: 0x0932, 0x84b: 0x0dee,
+	0x84c: 0x0e9e, 0x84d: 0x14e6, 0x84e: 0x0bf6, 0x84f: 0x0cd2, 0x850: 0x0cee, 0x851: 0x0d7e,
+	0x852: 0x0f66, 0x853: 0x0fb2, 0x854: 0x1062, 0x855: 0x1186, 0x856: 0x122a, 0x857: 0x128e,
+	0x858: 0x14d6, 0x859: 0x1366, 0x85a: 0x14fe, 0x85b: 0x157a, 0x85c: 0x090a, 0x85d: 0x0936,
+	0x85e: 0x0a1e, 0x85f: 0x0fa2, 0x860: 0x13ee, 0x861: 0x1436, 0x862: 0x0c16, 0x863: 0x0c86,
+	0x864: 0x0d4a, 0x865: 0x0eaa, 0x866: 0x11d2, 0x867: 0x101e, 0x868: 0x0836, 0x869: 0x0a7a,
+	0x86a: 0x0b5e, 0x86b: 0x0bc2, 0x86c: 0x0c92, 0x86d: 0x103a, 0x86e: 0x1056, 0x86f: 0x1266,
+	0x870: 0x1286, 0x871: 0x155e, 0x872: 0x15de, 0x873: 0x15ee, 0x874: 0x162a, 0x875: 0x084e,
+	0x876: 0x117a, 0x877: 0x154a, 0x878: 0x15c6, 0x879: 0x0caa, 0x87a: 0x0812, 0x87b: 0x0872,
+	0x87c: 0x0b62, 0x87d: 0x0b82, 0x87e: 0x0daa, 0x87f: 0x0e6e,
+	// Block 0x22, offset 0x880
+	0x880: 0x0fbe, 0x881: 0x10c6, 0x882: 0x1372, 0x883: 0x1512, 0x884: 0x171e, 0x885: 0x0dde,
+	0x886: 0x159e, 0x887: 0x092e, 0x888: 0x0e2a, 0x889: 0x0e36, 0x88a: 0x0f0a, 0x88b: 0x0f42,
+	0x88c: 0x1046, 0x88d: 0x10a2, 0x88e: 0x1122, 0x88f: 0x1206, 0x890: 0x1636, 0x891: 0x08aa,
+	0x892: 0x0cfe, 0x893: 0x15ae, 0x894: 0x0862, 0x895: 0x0ba6, 0x896: 0x0f2a, 0x897: 0x14da,
+	0x898: 0x0c62, 0x899: 0x0cb2, 0x89a: 0x0e3e, 0x89b: 0x102a, 0x89c: 0x15b6, 0x89d: 0x0912,
+	0x89e: 0x09fa, 0x89f: 0x0b92, 0x8a0: 0x0dce, 0x8a1: 0x0e1a, 0x8a2: 0x0e5a, 0x8a3: 0x0eee,
+	0x8a4: 0x1042, 0x8a5: 0x10b6, 0x8a6: 0x1252, 0x8a7: 0x13f2, 0x8a8: 0x13fe, 0x8a9: 0x1552,
+	0x8aa: 0x15d2, 0x8ab: 0x097e, 0x8ac: 0x0f46, 0x8ad: 0x09fe, 0x8ae: 0x0fc2, 0x8af: 0x1066,
+	0x8b0: 0x1382, 0x8b1: 0x15ba, 0x8b2: 0x16a6, 0x8b3: 0x16ce, 0x8b4: 0x0e32, 0x8b5: 0x0f22,
+	0x8b6: 0x12be, 0x8b7: 0x11b2, 0x8b8: 0x11be, 0x8b9: 0x11e2, 0x8ba: 0x1012, 0x8bb: 0x0f9a,
+	0x8bc: 0x145e, 0x8bd: 0x082e, 0x8be: 0x1326, 0x8bf: 0x0916,
+	// Block 0x23, offset 0x8c0
+	0x8c0: 0x0906, 0x8c1: 0x0c06, 0x8c2: 0x0d26, 0x8c3: 0x11ee, 0x8c4: 0x0b4e, 0x8c5: 0x0efe,
+	0x8c6: 0x0dea, 0x8c7: 0x14e2, 0x8c8: 0x13e2, 0x8c9: 0x15a6, 0x8ca: 0x141e, 0x8cb: 0x0c22,
+	0x8cc: 0x0882, 0x8cd: 0x0a56, 0x8d0: 0x0aaa,
+	0x8d2: 0x0dda, 0x8d5: 0x08f2, 0x8d6: 0x101a, 0x8d7: 0x10de,
+	0x8d8: 0x1142, 0x8d9: 0x115e, 0x8da: 0x1162, 0x8db: 0x1176, 0x8dc: 0x15f6, 0x8dd: 0x11e6,
+	0x8de: 0x126a, 0x8e0: 0x138a, 0x8e2: 0x144e,
+	0x8e5: 0x1502, 0x8e6: 0x152e,
+	0x8ea: 0x164a, 0x8eb: 0x164e, 0x8ec: 0x1652, 0x8ed: 0x16b6, 0x8ee: 0x1526, 0x8ef: 0x15c2,
+	0x8f0: 0x0852, 0x8f1: 0x0876, 0x8f2: 0x088a, 0x8f3: 0x0946, 0x8f4: 0x0952, 0x8f5: 0x0992,
+	0x8f6: 0x0a46, 0x8f7: 0x0a62, 0x8f8: 0x0a6a, 0x8f9: 0x0aa6, 0x8fa: 0x0ab2, 0x8fb: 0x0b8e,
+	0x8fc: 0x0b96, 0x8fd: 0x0c9e, 0x8fe: 0x0cc6, 0x8ff: 0x0cce,
+	// Block 0x24, offset 0x900
+	0x900: 0x0ce6, 0x901: 0x0d92, 0x902: 0x0dc2, 0x903: 0x0de2, 0x904: 0x0e52, 0x905: 0x0f16,
+	0x906: 0x0f32, 0x907: 0x0f62, 0x908: 0x0fb6, 0x909: 0x0fd6, 0x90a: 0x104a, 0x90b: 0x112a,
+	0x90c: 0x1146, 0x90d: 0x114e, 0x90e: 0x114a, 0x90f: 0x1152, 0x910: 0x1156, 0x911: 0x115a,
+	0x912: 0x116e, 0x913: 0x1172, 0x914: 0x1196, 0x915: 0x11aa, 0x916: 0x11c6, 0x917: 0x122a,
+	0x918: 0x1232, 0x919: 0x123a, 0x91a: 0x124e, 0x91b: 0x1276, 0x91c: 0x12c6, 0x91d: 0x12fa,
+	0x91e: 0x12fa, 0x91f: 0x1362, 0x920: 0x140a, 0x921: 0x1422, 0x922: 0x1456, 0x923: 0x145a,
+	0x924: 0x149e, 0x925: 0x14a2, 0x926: 0x14fa, 0x927: 0x1502, 0x928: 0x15d6, 0x929: 0x161a,
+	0x92a: 0x1632, 0x92b: 0x0c96, 0x92c: 0x184b, 0x92d: 0x12de,
+	0x930: 0x07da, 0x931: 0x08de, 0x932: 0x089e, 0x933: 0x0846, 0x934: 0x0886, 0x935: 0x08b2,
+	0x936: 0x0942, 0x937: 0x095e, 0x938: 0x0a46, 0x939: 0x0a32, 0x93a: 0x0a42, 0x93b: 0x0a5e,
+	0x93c: 0x0aaa, 0x93d: 0x0aba, 0x93e: 0x0afe, 0x93f: 0x0b0a,
+	// Block 0x25, offset 0x940
+	0x940: 0x0b26, 0x941: 0x0b36, 0x942: 0x0c1e, 0x943: 0x0c26, 0x944: 0x0c56, 0x945: 0x0c76,
+	0x946: 0x0ca6, 0x947: 0x0cbe, 0x948: 0x0cae, 0x949: 0x0cce, 0x94a: 0x0cc2, 0x94b: 0x0ce6,
+	0x94c: 0x0d02, 0x94d: 0x0d5a, 0x94e: 0x0d66, 0x94f: 0x0d6e, 0x950: 0x0d96, 0x951: 0x0dda,
+	0x952: 0x0e0a, 0x953: 0x0e0e, 0x954: 0x0e22, 0x955: 0x0ea2, 0x956: 0x0eb2, 0x957: 0x0f0a,
+	0x958: 0x0f56, 0x959: 0x0f4e, 0x95a: 0x0f62, 0x95b: 0x0f7e, 0x95c: 0x0fb6, 0x95d: 0x110e,
+	0x95e: 0x0fda, 0x95f: 0x100e, 0x960: 0x101a, 0x961: 0x105a, 0x962: 0x1076, 0x963: 0x109a,
+	0x964: 0x10be, 0x965: 0x10c2, 0x966: 0x10de, 0x967: 0x10e2, 0x968: 0x10f2, 0x969: 0x1106,
+	0x96a: 0x1102, 0x96b: 0x1132, 0x96c: 0x11ae, 0x96d: 0x11c6, 0x96e: 0x11de, 0x96f: 0x1216,
+	0x970: 0x122a, 0x971: 0x1246, 0x972: 0x1276, 0x973: 0x132a, 0x974: 0x1352, 0x975: 0x13c6,
+	0x976: 0x140e, 0x977: 0x141a, 0x978: 0x1422, 0x979: 0x143a, 0x97a: 0x144e, 0x97b: 0x143e,
+	0x97c: 0x1456, 0x97d: 0x1452, 0x97e: 0x144a, 0x97f: 0x145a,
+	// Block 0x26, offset 0x980
+	0x980: 0x1466, 0x981: 0x14a2, 0x982: 0x14de, 0x983: 0x150e, 0x984: 0x1546, 0x985: 0x1566,
+	0x986: 0x15b2, 0x987: 0x15d6, 0x988: 0x15f6, 0x989: 0x160a, 0x98a: 0x161a, 0x98b: 0x1626,
+	0x98c: 0x1632, 0x98d: 0x1686, 0x98e: 0x1726, 0x98f: 0x17e2, 0x990: 0x17dd, 0x991: 0x180f,
+	0x992: 0x0702, 0x993: 0x072a, 0x994: 0x072e, 0x995: 0x1891, 0x996: 0x18be, 0x997: 0x1936,
+	0x998: 0x1712, 0x999: 0x1722,
+	// Block 0x27, offset 0x9c0
+	0x9c0: 0x07f6, 0x9c1: 0x07ee, 0x9c2: 0x07fe, 0x9c3: 0x1774, 0x9c4: 0x0842, 0x9c5: 0x0852,
+	0x9c6: 0x0856, 0x9c7: 0x085e, 0x9c8: 0x0866, 0x9c9: 0x086a, 0x9ca: 0x0876, 0x9cb: 0x086e,
+	0x9cc: 0x06ae, 0x9cd: 0x1788, 0x9ce: 0x088a, 0x9cf: 0x088e, 0x9d0: 0x0892, 0x9d1: 0x08ae,
+	0x9d2: 0x1779, 0x9d3: 0x06b2, 0x9d4: 0x089a, 0x9d5: 0x08ba, 0x9d6: 0x1783, 0x9d7: 0x08ca,
+	0x9d8: 0x08d2, 0x9d9: 0x0832, 0x9da: 0x08da, 0x9db: 0x08de, 0x9dc: 0x195e, 0x9dd: 0x08fa,
+	0x9de: 0x0902, 0x9df: 0x06ba, 0x9e0: 0x091a, 0x9e1: 0x091e, 0x9e2: 0x0926, 0x9e3: 0x092a,
+	0x9e4: 0x06be, 0x9e5: 0x0942, 0x9e6: 0x0946, 0x9e7: 0x0952, 0x9e8: 0x095e, 0x9e9: 0x0962,
+	0x9ea: 0x0966, 0x9eb: 0x096e, 0x9ec: 0x098e, 0x9ed: 0x0992, 0x9ee: 0x099a, 0x9ef: 0x09aa,
+	0x9f0: 0x09b2, 0x9f1: 0x09b6, 0x9f2: 0x09b6, 0x9f3: 0x09b6, 0x9f4: 0x1797, 0x9f5: 0x0f8e,
+	0x9f6: 0x09ca, 0x9f7: 0x09d2, 0x9f8: 0x179c, 0x9f9: 0x09de, 0x9fa: 0x09e6, 0x9fb: 0x09ee,
+	0x9fc: 0x0a16, 0x9fd: 0x0a02, 0x9fe: 0x0a0e, 0x9ff: 0x0a12,
+	// Block 0x28, offset 0xa00
+	0xa00: 0x0a1a, 0xa01: 0x0a22, 0xa02: 0x0a26, 0xa03: 0x0a2e, 0xa04: 0x0a36, 0xa05: 0x0a3a,
+	0xa06: 0x0a3a, 0xa07: 0x0a42, 0xa08: 0x0a4a, 0xa09: 0x0a4e, 0xa0a: 0x0a5a, 0xa0b: 0x0a7e,
+	0xa0c: 0x0a62, 0xa0d: 0x0a82, 0xa0e: 0x0a66, 0xa0f: 0x0a6e, 0xa10: 0x0906, 0xa11: 0x0aca,
+	0xa12: 0x0a92, 0xa13: 0x0a96, 0xa14: 0x0a9a, 0xa15: 0x0a8e, 0xa16: 0x0aa2, 0xa17: 0x0a9e,
+	0xa18: 0x0ab6, 0xa19: 0x17a1, 0xa1a: 0x0ad2, 0xa1b: 0x0ad6, 0xa1c: 0x0ade, 0xa1d: 0x0aea,
+	0xa1e: 0x0af2, 0xa1f: 0x0b0e, 0xa20: 0x17a6, 0xa21: 0x17ab, 0xa22: 0x0b1a, 0xa23: 0x0b1e,
+	0xa24: 0x0b22, 0xa25: 0x0b16, 0xa26: 0x0b2a, 0xa27: 0x06c2, 0xa28: 0x06c6, 0xa29: 0x0b32,
+	0xa2a: 0x0b3a, 0xa2b: 0x0b3a, 0xa2c: 0x17b0, 0xa2d: 0x0b56, 0xa2e: 0x0b5a, 0xa2f: 0x0b5e,
+	0xa30: 0x0b66, 0xa31: 0x17b5, 0xa32: 0x0b6e, 0xa33: 0x0b72, 0xa34: 0x0c4a, 0xa35: 0x0b7a,
+	0xa36: 0x06ca, 0xa37: 0x0b86, 0xa38: 0x0b96, 0xa39: 0x0ba2, 0xa3a: 0x0b9e, 0xa3b: 0x17bf,
+	0xa3c: 0x0baa, 0xa3d: 0x17c4, 0xa3e: 0x0bb6, 0xa3f: 0x0bb2,
+	// Block 0x29, offset 0xa40
+	0xa40: 0x0bba, 0xa41: 0x0bca, 0xa42: 0x0bce, 0xa43: 0x06ce, 0xa44: 0x0bde, 0xa45: 0x0be6,
+	0xa46: 0x0bea, 0xa47: 0x0bee, 0xa48: 0x06d2, 0xa49: 0x17c9, 0xa4a: 0x06d6, 0xa4b: 0x0c0a,
+	0xa4c: 0x0c0e, 0xa4d: 0x0c12, 0xa4e: 0x0c1a, 0xa4f: 0x1990, 0xa50: 0x0c32, 0xa51: 0x17d3,
+	0xa52: 0x17d3, 0xa53: 0x12d2, 0xa54: 0x0c42, 0xa55: 0x0c42, 0xa56: 0x06da, 0xa57: 0x17f6,
+	0xa58: 0x18c8, 0xa59: 0x0c52, 0xa5a: 0x0c5a, 0xa5b: 0x06de, 0xa5c: 0x0c6e, 0xa5d: 0x0c7e,
+	0xa5e: 0x0c82, 0xa5f: 0x0c8a, 0xa60: 0x0c9a, 0xa61: 0x06e6, 0xa62: 0x06e2, 0xa63: 0x0c9e,
+	0xa64: 0x17d8, 0xa65: 0x0ca2, 0xa66: 0x0cb6, 0xa67: 0x0cba, 0xa68: 0x0cbe, 0xa69: 0x0cba,
+	0xa6a: 0x0cca, 0xa6b: 0x0cce, 0xa6c: 0x0cde, 0xa6d: 0x0cd6, 0xa6e: 0x0cda, 0xa6f: 0x0ce2,
+	0xa70: 0x0ce6, 0xa71: 0x0cea, 0xa72: 0x0cf6, 0xa73: 0x0cfa, 0xa74: 0x0d12, 0xa75: 0x0d1a,
+	0xa76: 0x0d2a, 0xa77: 0x0d3e, 0xa78: 0x17e7, 0xa79: 0x0d3a, 0xa7a: 0x0d2e, 0xa7b: 0x0d46,
+	0xa7c: 0x0d4e, 0xa7d: 0x0d62, 0xa7e: 0x17ec, 0xa7f: 0x0d6a,
+	// Block 0x2a, offset 0xa80
+	0xa80: 0x0d5e, 0xa81: 0x0d56, 0xa82: 0x06ea, 0xa83: 0x0d72, 0xa84: 0x0d7a, 0xa85: 0x0d82,
+	0xa86: 0x0d76, 0xa87: 0x06ee, 0xa88: 0x0d92, 0xa89: 0x0d9a, 0xa8a: 0x17f1, 0xa8b: 0x0dc6,
+	0xa8c: 0x0dfa, 0xa8d: 0x0dd6, 0xa8e: 0x06fa, 0xa8f: 0x0de2, 0xa90: 0x06f6, 0xa91: 0x06f2,
+	0xa92: 0x08be, 0xa93: 0x08c2, 0xa94: 0x0dfe, 0xa95: 0x0de6, 0xa96: 0x12a6, 0xa97: 0x075e,
+	0xa98: 0x0e0a, 0xa99: 0x0e0e, 0xa9a: 0x0e12, 0xa9b: 0x0e26, 0xa9c: 0x0e1e, 0xa9d: 0x180a,
+	0xa9e: 0x06fe, 0xa9f: 0x0e3a, 0xaa0: 0x0e2e, 0xaa1: 0x0e4a, 0xaa2: 0x0e52, 0xaa3: 0x1814,
+	0xaa4: 0x0e56, 0xaa5: 0x0e42, 0xaa6: 0x0e5e, 0xaa7: 0x0702, 0xaa8: 0x0e62, 0xaa9: 0x0e66,
+	0xaaa: 0x0e6a, 0xaab: 0x0e76, 0xaac: 0x1819, 0xaad: 0x0e7e, 0xaae: 0x0706, 0xaaf: 0x0e8a,
+	0xab0: 0x181e, 0xab1: 0x0e8e, 0xab2: 0x070a, 0xab3: 0x0e9a, 0xab4: 0x0ea6, 0xab5: 0x0eb2,
+	0xab6: 0x0eb6, 0xab7: 0x1823, 0xab8: 0x17ba, 0xab9: 0x1828, 0xaba: 0x0ed6, 0xabb: 0x182d,
+	0xabc: 0x0ee2, 0xabd: 0x0eea, 0xabe: 0x0eda, 0xabf: 0x0ef6,
+	// Block 0x2b, offset 0xac0
+	0xac0: 0x0f06, 0xac1: 0x0f16, 0xac2: 0x0f0a, 0xac3: 0x0f0e, 0xac4: 0x0f1a, 0xac5: 0x0f1e,
+	0xac6: 0x1832, 0xac7: 0x0f02, 0xac8: 0x0f36, 0xac9: 0x0f3a, 0xaca: 0x070e, 0xacb: 0x0f4e,
+	0xacc: 0x0f4a, 0xacd: 0x1837, 0xace: 0x0f2e, 0xacf: 0x0f6a, 0xad0: 0x183c, 0xad1: 0x1841,
+	0xad2: 0x0f6e, 0xad3: 0x0f82, 0xad4: 0x0f7e, 0xad5: 0x0f7a, 0xad6: 0x0712, 0xad7: 0x0f86,
+	0xad8: 0x0f96, 0xad9: 0x0f92, 0xada: 0x0f9e, 0xadb: 0x177e, 0xadc: 0x0fae, 0xadd: 0x1846,
+	0xade: 0x0fba, 0xadf: 0x1850, 0xae0: 0x0fce, 0xae1: 0x0fda, 0xae2: 0x0fee, 0xae3: 0x1855,
+	0xae4: 0x1002, 0xae5: 0x1006, 0xae6: 0x185a, 0xae7: 0x185f, 0xae8: 0x1022, 0xae9: 0x1032,
+	0xaea: 0x0716, 0xaeb: 0x1036, 0xaec: 0x071a, 0xaed: 0x071a, 0xaee: 0x104e, 0xaef: 0x1052,
+	0xaf0: 0x105a, 0xaf1: 0x105e, 0xaf2: 0x106a, 0xaf3: 0x071e, 0xaf4: 0x1082, 0xaf5: 0x1864,
+	0xaf6: 0x109e, 0xaf7: 0x1869, 0xaf8: 0x10aa, 0xaf9: 0x17ce, 0xafa: 0x10ba, 0xafb: 0x186e,
+	0xafc: 0x1873, 0xafd: 0x1878, 0xafe: 0x0722, 0xaff: 0x0726,
+	// Block 0x2c, offset 0xb00
+	0xb00: 0x10f2, 0xb01: 0x1882, 0xb02: 0x187d, 0xb03: 0x1887, 0xb04: 0x188c, 0xb05: 0x10fa,
+	0xb06: 0x10fe, 0xb07: 0x10fe, 0xb08: 0x1106, 0xb09: 0x072e, 0xb0a: 0x110a, 0xb0b: 0x0732,
+	0xb0c: 0x0736, 0xb0d: 0x1896, 0xb0e: 0x111e, 0xb0f: 0x1126, 0xb10: 0x1132, 0xb11: 0x073a,
+	0xb12: 0x189b, 0xb13: 0x1156, 0xb14: 0x18a0, 0xb15: 0x18a5, 0xb16: 0x1176, 0xb17: 0x118e,
+	0xb18: 0x073e, 0xb19: 0x1196, 0xb1a: 0x119a, 0xb1b: 0x119e, 0xb1c: 0x18aa, 0xb1d: 0x18af,
+	0xb1e: 0x18af, 0xb1f: 0x11b6, 0xb20: 0x0742, 0xb21: 0x18b4, 0xb22: 0x11ca, 0xb23: 0x11ce,
+	0xb24: 0x0746, 0xb25: 0x18b9, 0xb26: 0x11ea, 0xb27: 0x074a, 0xb28: 0x11fa, 0xb29: 0x11f2,
+	0xb2a: 0x1202, 0xb2b: 0x18c3, 0xb2c: 0x121a, 0xb2d: 0x074e, 0xb2e: 0x1226, 0xb2f: 0x122e,
+	0xb30: 0x123e, 0xb31: 0x0752, 0xb32: 0x18cd, 0xb33: 0x18d2, 0xb34: 0x0756, 0xb35: 0x18d7,
+	0xb36: 0x1256, 0xb37: 0x18dc, 0xb38: 0x1262, 0xb39: 0x126e, 0xb3a: 0x1276, 0xb3b: 0x18e1,
+	0xb3c: 0x18e6, 0xb3d: 0x128a, 0xb3e: 0x18eb, 0xb3f: 0x1292,
+	// Block 0x2d, offset 0xb40
+	0xb40: 0x17fb, 0xb41: 0x075a, 0xb42: 0x12aa, 0xb43: 0x12ae, 0xb44: 0x0762, 0xb45: 0x12b2,
+	0xb46: 0x0b2e, 0xb47: 0x18f0, 0xb48: 0x18f5, 0xb49: 0x1800, 0xb4a: 0x1805, 0xb4b: 0x12d2,
+	0xb4c: 0x12d6, 0xb4d: 0x14ee, 0xb4e: 0x0766, 0xb4f: 0x1302, 0xb50: 0x12fe, 0xb51: 0x1306,
+	0xb52: 0x093a, 0xb53: 0x130a, 0xb54: 0x130e, 0xb55: 0x1312, 0xb56: 0x131a, 0xb57: 0x18fa,
+	0xb58: 0x1316, 0xb59: 0x131e, 0xb5a: 0x1332, 0xb5b: 0x1336, 0xb5c: 0x1322, 0xb5d: 0x133a,
+	0xb5e: 0x134e, 0xb5f: 0x1362, 0xb60: 0x132e, 0xb61: 0x1342, 0xb62: 0x1346, 0xb63: 0x134a,
+	0xb64: 0x18ff, 0xb65: 0x1909, 0xb66: 0x1904, 0xb67: 0x076a, 0xb68: 0x136a, 0xb69: 0x136e,
+	0xb6a: 0x1376, 0xb6b: 0x191d, 0xb6c: 0x137a, 0xb6d: 0x190e, 0xb6e: 0x076e, 0xb6f: 0x0772,
+	0xb70: 0x1913, 0xb71: 0x1918, 0xb72: 0x0776, 0xb73: 0x139a, 0xb74: 0x139e, 0xb75: 0x13a2,
+	0xb76: 0x13a6, 0xb77: 0x13b2, 0xb78: 0x13ae, 0xb79: 0x13ba, 0xb7a: 0x13b6, 0xb7b: 0x13c6,
+	0xb7c: 0x13be, 0xb7d: 0x13c2, 0xb7e: 0x13ca, 0xb7f: 0x077a,
+	// Block 0x2e, offset 0xb80
+	0xb80: 0x13d2, 0xb81: 0x13d6, 0xb82: 0x077e, 0xb83: 0x13e6, 0xb84: 0x13ea, 0xb85: 0x1922,
+	0xb86: 0x13f6, 0xb87: 0x13fa, 0xb88: 0x0782, 0xb89: 0x1406, 0xb8a: 0x06b6, 0xb8b: 0x1927,
+	0xb8c: 0x192c, 0xb8d: 0x0786, 0xb8e: 0x078a, 0xb8f: 0x1432, 0xb90: 0x144a, 0xb91: 0x1466,
+	0xb92: 0x1476, 0xb93: 0x1931, 0xb94: 0x148a, 0xb95: 0x148e, 0xb96: 0x14a6, 0xb97: 0x14b2,
+	0xb98: 0x193b, 0xb99: 0x178d, 0xb9a: 0x14be, 0xb9b: 0x14ba, 0xb9c: 0x14c6, 0xb9d: 0x1792,
+	0xb9e: 0x14d2, 0xb9f: 0x14de, 0xba0: 0x1940, 0xba1: 0x1945, 0xba2: 0x151e, 0xba3: 0x152a,
+	0xba4: 0x1532, 0xba5: 0x194a, 0xba6: 0x1536, 0xba7: 0x1562, 0xba8: 0x156e, 0xba9: 0x1572,
+	0xbaa: 0x156a, 0xbab: 0x157e, 0xbac: 0x1582, 0xbad: 0x194f, 0xbae: 0x158e, 0xbaf: 0x078e,
+	0xbb0: 0x1596, 0xbb1: 0x1954, 0xbb2: 0x0792, 0xbb3: 0x15ce, 0xbb4: 0x0bbe, 0xbb5: 0x15e6,
+	0xbb6: 0x1959, 0xbb7: 0x1963, 0xbb8: 0x0796, 0xbb9: 0x079a, 0xbba: 0x160e, 0xbbb: 0x1968,
+	0xbbc: 0x079e, 0xbbd: 0x196d, 0xbbe: 0x1626, 0xbbf: 0x1626,
+	// Block 0x2f, offset 0xbc0
+	0xbc0: 0x162e, 0xbc1: 0x1972, 0xbc2: 0x1646, 0xbc3: 0x07a2, 0xbc4: 0x1656, 0xbc5: 0x1662,
+	0xbc6: 0x166a, 0xbc7: 0x1672, 0xbc8: 0x07a6, 0xbc9: 0x1977, 0xbca: 0x1686, 0xbcb: 0x16a2,
+	0xbcc: 0x16ae, 0xbcd: 0x07aa, 0xbce: 0x07ae, 0xbcf: 0x16b2, 0xbd0: 0x197c, 0xbd1: 0x07b2,
+	0xbd2: 0x1981, 0xbd3: 0x1986, 0xbd4: 0x198b, 0xbd5: 0x16d6, 0xbd6: 0x07b6, 0xbd7: 0x16ea,
+	0xbd8: 0x16f2, 0xbd9: 0x16f6, 0xbda: 0x16fe, 0xbdb: 0x1706, 0xbdc: 0x170e, 0xbdd: 0x1995,
+}
+
+// nfcIndex: 22 blocks, 1408 entries, 1408 bytes
+// Block 0 is the zero block.
+var nfcIndex = [1408]uint8{
+	// Block 0x0, offset 0x0
+	// Block 0x1, offset 0x40
+	// Block 0x2, offset 0x80
+	// Block 0x3, offset 0xc0
+	0xc2: 0x2e, 0xc3: 0x01, 0xc4: 0x02, 0xc5: 0x03, 0xc6: 0x2f, 0xc7: 0x04,
+	0xc8: 0x05, 0xca: 0x30, 0xcb: 0x31, 0xcc: 0x06, 0xcd: 0x07, 0xce: 0x08, 0xcf: 0x32,
+	0xd0: 0x09, 0xd1: 0x33, 0xd2: 0x34, 0xd3: 0x0a, 0xd6: 0x0b, 0xd7: 0x35,
+	0xd8: 0x36, 0xd9: 0x0c, 0xdb: 0x37, 0xdc: 0x38, 0xdd: 0x39, 0xdf: 0x3a,
+	0xe0: 0x02, 0xe1: 0x03, 0xe2: 0x04, 0xe3: 0x05,
+	0xea: 0x06, 0xeb: 0x07, 0xec: 0x08, 0xed: 0x09, 0xef: 0x0a,
+	0xf0: 0x13,
+	// Block 0x4, offset 0x100
+	0x120: 0x3b, 0x121: 0x3c, 0x122: 0x3d, 0x123: 0x0d, 0x124: 0x3e, 0x125: 0x3f, 0x126: 0x40, 0x127: 0x41,
+	0x128: 0x42, 0x129: 0x43, 0x12a: 0x44, 0x12b: 0x45, 0x12c: 0x40, 0x12d: 0x46, 0x12e: 0x47, 0x12f: 0x48,
+	0x130: 0x44, 0x131: 0x49, 0x132: 0x4a, 0x133: 0x4b, 0x134: 0x4c, 0x135: 0x4d, 0x137: 0x4e,
+	0x138: 0x4f, 0x139: 0x50, 0x13a: 0x51, 0x13b: 0x52, 0x13c: 0x53, 0x13d: 0x54, 0x13e: 0x55, 0x13f: 0x56,
+	// Block 0x5, offset 0x140
+	0x140: 0x57, 0x142: 0x58, 0x144: 0x59, 0x145: 0x5a, 0x146: 0x5b, 0x147: 0x5c,
+	0x14d: 0x5d,
+	0x15c: 0x5e, 0x15f: 0x5f,
+	0x162: 0x60, 0x164: 0x61,
+	0x168: 0x62, 0x169: 0x63, 0x16a: 0x64, 0x16b: 0x65, 0x16c: 0x0e, 0x16d: 0x66, 0x16e: 0x67, 0x16f: 0x68,
+	0x170: 0x69, 0x173: 0x6a, 0x177: 0x0f,
+	0x178: 0x10, 0x179: 0x11, 0x17a: 0x12, 0x17b: 0x13, 0x17c: 0x14, 0x17d: 0x15, 0x17e: 0x16, 0x17f: 0x17,
+	// Block 0x6, offset 0x180
+	0x180: 0x6b, 0x183: 0x6c, 0x184: 0x6d, 0x186: 0x6e, 0x187: 0x6f,
+	0x188: 0x70, 0x189: 0x18, 0x18a: 0x19, 0x18b: 0x71, 0x18c: 0x72,
+	0x1ab: 0x73,
+	0x1b3: 0x74, 0x1b5: 0x75, 0x1b7: 0x76,
+	// Block 0x7, offset 0x1c0
+	0x1c0: 0x77, 0x1c1: 0x1a, 0x1c2: 0x1b, 0x1c3: 0x1c, 0x1c4: 0x78, 0x1c5: 0x79,
+	0x1c9: 0x7a, 0x1cc: 0x7b, 0x1cd: 0x7c,
+	// Block 0x8, offset 0x200
+	0x219: 0x7d, 0x21a: 0x7e, 0x21b: 0x7f,
+	0x220: 0x80, 0x223: 0x81, 0x224: 0x82, 0x225: 0x83, 0x226: 0x84, 0x227: 0x85,
+	0x22a: 0x86, 0x22b: 0x87, 0x22f: 0x88,
+	0x230: 0x89, 0x231: 0x8a, 0x232: 0x8b, 0x233: 0x8c, 0x234: 0x8d, 0x235: 0x8e, 0x236: 0x8f, 0x237: 0x89,
+	0x238: 0x8a, 0x239: 0x8b, 0x23a: 0x8c, 0x23b: 0x8d, 0x23c: 0x8e, 0x23d: 0x8f, 0x23e: 0x89, 0x23f: 0x8a,
+	// Block 0x9, offset 0x240
+	0x240: 0x8b, 0x241: 0x8c, 0x242: 0x8d, 0x243: 0x8e, 0x244: 0x8f, 0x245: 0x89, 0x246: 0x8a, 0x247: 0x8b,
+	0x248: 0x8c, 0x249: 0x8d, 0x24a: 0x8e, 0x24b: 0x8f, 0x24c: 0x89, 0x24d: 0x8a, 0x24e: 0x8b, 0x24f: 0x8c,
+	0x250: 0x8d, 0x251: 0x8e, 0x252: 0x8f, 0x253: 0x89, 0x254: 0x8a, 0x255: 0x8b, 0x256: 0x8c, 0x257: 0x8d,
+	0x258: 0x8e, 0x259: 0x8f, 0x25a: 0x89, 0x25b: 0x8a, 0x25c: 0x8b, 0x25d: 0x8c, 0x25e: 0x8d, 0x25f: 0x8e,
+	0x260: 0x8f, 0x261: 0x89, 0x262: 0x8a, 0x263: 0x8b, 0x264: 0x8c, 0x265: 0x8d, 0x266: 0x8e, 0x267: 0x8f,
+	0x268: 0x89, 0x269: 0x8a, 0x26a: 0x8b, 0x26b: 0x8c, 0x26c: 0x8d, 0x26d: 0x8e, 0x26e: 0x8f, 0x26f: 0x89,
+	0x270: 0x8a, 0x271: 0x8b, 0x272: 0x8c, 0x273: 0x8d, 0x274: 0x8e, 0x275: 0x8f, 0x276: 0x89, 0x277: 0x8a,
+	0x278: 0x8b, 0x279: 0x8c, 0x27a: 0x8d, 0x27b: 0x8e, 0x27c: 0x8f, 0x27d: 0x89, 0x27e: 0x8a, 0x27f: 0x8b,
+	// Block 0xa, offset 0x280
+	0x280: 0x8c, 0x281: 0x8d, 0x282: 0x8e, 0x283: 0x8f, 0x284: 0x89, 0x285: 0x8a, 0x286: 0x8b, 0x287: 0x8c,
+	0x288: 0x8d, 0x289: 0x8e, 0x28a: 0x8f, 0x28b: 0x89, 0x28c: 0x8a, 0x28d: 0x8b, 0x28e: 0x8c, 0x28f: 0x8d,
+	0x290: 0x8e, 0x291: 0x8f, 0x292: 0x89, 0x293: 0x8a, 0x294: 0x8b, 0x295: 0x8c, 0x296: 0x8d, 0x297: 0x8e,
+	0x298: 0x8f, 0x299: 0x89, 0x29a: 0x8a, 0x29b: 0x8b, 0x29c: 0x8c, 0x29d: 0x8d, 0x29e: 0x8e, 0x29f: 0x8f,
+	0x2a0: 0x89, 0x2a1: 0x8a, 0x2a2: 0x8b, 0x2a3: 0x8c, 0x2a4: 0x8d, 0x2a5: 0x8e, 0x2a6: 0x8f, 0x2a7: 0x89,
+	0x2a8: 0x8a, 0x2a9: 0x8b, 0x2aa: 0x8c, 0x2ab: 0x8d, 0x2ac: 0x8e, 0x2ad: 0x8f, 0x2ae: 0x89, 0x2af: 0x8a,
+	0x2b0: 0x8b, 0x2b1: 0x8c, 0x2b2: 0x8d, 0x2b3: 0x8e, 0x2b4: 0x8f, 0x2b5: 0x89, 0x2b6: 0x8a, 0x2b7: 0x8b,
+	0x2b8: 0x8c, 0x2b9: 0x8d, 0x2ba: 0x8e, 0x2bb: 0x8f, 0x2bc: 0x89, 0x2bd: 0x8a, 0x2be: 0x8b, 0x2bf: 0x8c,
+	// Block 0xb, offset 0x2c0
+	0x2c0: 0x8d, 0x2c1: 0x8e, 0x2c2: 0x8f, 0x2c3: 0x89, 0x2c4: 0x8a, 0x2c5: 0x8b, 0x2c6: 0x8c, 0x2c7: 0x8d,
+	0x2c8: 0x8e, 0x2c9: 0x8f, 0x2ca: 0x89, 0x2cb: 0x8a, 0x2cc: 0x8b, 0x2cd: 0x8c, 0x2ce: 0x8d, 0x2cf: 0x8e,
+	0x2d0: 0x8f, 0x2d1: 0x89, 0x2d2: 0x8a, 0x2d3: 0x8b, 0x2d4: 0x8c, 0x2d5: 0x8d, 0x2d6: 0x8e, 0x2d7: 0x8f,
+	0x2d8: 0x89, 0x2d9: 0x8a, 0x2da: 0x8b, 0x2db: 0x8c, 0x2dc: 0x8d, 0x2dd: 0x8e, 0x2de: 0x90,
+	// Block 0xc, offset 0x300
+	0x324: 0x1d, 0x325: 0x1e, 0x326: 0x1f, 0x327: 0x20,
+	0x328: 0x21, 0x329: 0x22, 0x32a: 0x23, 0x32b: 0x24, 0x32c: 0x91, 0x32d: 0x92, 0x32e: 0x93,
+	0x331: 0x94, 0x332: 0x95, 0x333: 0x96, 0x334: 0x97,
+	0x338: 0x98, 0x339: 0x99, 0x33a: 0x9a, 0x33b: 0x9b, 0x33e: 0x9c, 0x33f: 0x9d,
+	// Block 0xd, offset 0x340
+	0x347: 0x9e,
+	0x34b: 0x9f, 0x34d: 0xa0,
+	0x368: 0xa1, 0x36b: 0xa2,
+	0x374: 0xa3,
+	0x37a: 0xa4, 0x37b: 0xa5, 0x37d: 0xa6, 0x37e: 0xa7,
+	// Block 0xe, offset 0x380
+	0x381: 0xa8, 0x382: 0xa9, 0x384: 0xaa, 0x385: 0x84, 0x387: 0xab,
+	0x388: 0xac, 0x38b: 0xad, 0x38c: 0xae, 0x38d: 0xaf,
+	0x391: 0xb0, 0x392: 0xb1, 0x393: 0xb2, 0x396: 0xb3, 0x397: 0xb4,
+	0x398: 0x75, 0x39a: 0xb5, 0x39c: 0xb6,
+	0x3a0: 0xb7, 0x3a4: 0xb8, 0x3a5: 0xb9, 0x3a7: 0xba,
+	0x3a8: 0xbb, 0x3a9: 0xbc, 0x3aa: 0xbd,
+	0x3b0: 0x75, 0x3b5: 0xbe, 0x3b6: 0xbf,
+	0x3bd: 0xc0,
+	// Block 0xf, offset 0x3c0
+	0x3eb: 0xc1, 0x3ec: 0xc2,
+	0x3ff: 0xc3,
+	// Block 0x10, offset 0x400
+	0x432: 0xc4,
+	// Block 0x11, offset 0x440
+	0x445: 0xc5, 0x446: 0xc6, 0x447: 0xc7,
+	0x449: 0xc8,
+	// Block 0x12, offset 0x480
+	0x480: 0xc9, 0x482: 0xca, 0x484: 0xc2,
+	0x48a: 0xcb, 0x48b: 0xcc,
+	0x493: 0xcd,
+	0x4a3: 0xce, 0x4a5: 0xcf,
+	// Block 0x13, offset 0x4c0
+	0x4c8: 0xd0,
+	// Block 0x14, offset 0x500
+	0x520: 0x25, 0x521: 0x26, 0x522: 0x27, 0x523: 0x28, 0x524: 0x29, 0x525: 0x2a, 0x526: 0x2b, 0x527: 0x2c,
+	0x528: 0x2d,
+	// Block 0x15, offset 0x540
+	0x550: 0x0b, 0x551: 0x0c, 0x556: 0x0d,
+	0x55b: 0x0e, 0x55d: 0x0f, 0x55e: 0x10, 0x55f: 0x11,
+	0x56f: 0x12,
+}
+
+// nfcSparseOffset: 163 entries, 326 bytes
+var nfcSparseOffset = []uint16{0x0, 0x5, 0x9, 0xb, 0xd, 0x18, 0x28, 0x2a, 0x2f, 0x3a, 0x49, 0x56, 0x5e, 0x63, 0x68, 0x6a, 0x6e, 0x76, 0x7d, 0x80, 0x88, 0x8c, 0x90, 0x92, 0x94, 0x9d, 0xa1, 0xa8, 0xad, 0xb0, 0xba, 0xbd, 0xc4, 0xcc, 0xcf, 0xd1, 0xd4, 0xd6, 0xdb, 0xec, 0xf8, 0xfa, 0x100, 0x102, 0x104, 0x106, 0x108, 0x10a, 0x10c, 0x10f, 0x112, 0x114, 0x117, 0x11a, 0x11e, 0x124, 0x12b, 0x134, 0x136, 0x139, 0x13b, 0x146, 0x14a, 0x158, 0x15b, 0x161, 0x167, 0x172, 0x176, 0x178, 0x17a, 0x17c, 0x17e, 0x180, 0x186, 0x18a, 0x18c, 0x18e, 0x196, 0x19a, 0x19d, 0x19f, 0x1a1, 0x1a4, 0x1a7, 0x1a9, 0x1ab, 0x1ad, 0x1af, 0x1b5, 0x1b8, 0x1ba, 0x1c1, 0x1c7, 0x1cd, 0x1d5, 0x1db, 0x1e1, 0x1e7, 0x1eb, 0x1f9, 0x202, 0x205, 0x208, 0x20a, 0x20d, 0x20f, 0x213, 0x218, 0x21a, 0x21c, 0x221, 0x227, 0x229, 0x22b, 0x22d, 0x233, 0x236, 0x238, 0x23a, 0x23c, 0x242, 0x246, 0x24a, 0x252, 0x259, 0x25c, 0x25f, 0x261, 0x264, 0x26c, 0x270, 0x277, 0x27a, 0x280, 0x282, 0x285, 0x287, 0x28a, 0x28f, 0x291, 0x293, 0x295, 0x297, 0x299, 0x29c, 0x29e, 0x2a0, 0x2a2, 0x2a4, 0x2a6, 0x2a8, 0x2b5, 0x2bf, 0x2c1, 0x2c3, 0x2c9, 0x2cb, 0x2cd, 0x2cf, 0x2d3, 0x2d5, 0x2d8}
+
+// nfcSparseValues: 730 entries, 2920 bytes
+var nfcSparseValues = [730]valueRange{
+	// Block 0x0, offset 0x0
+	{value: 0x0000, lo: 0x04},
+	{value: 0xa100, lo: 0xa8, hi: 0xa8},
+	{value: 0x8100, lo: 0xaf, hi: 0xaf},
+	{value: 0x8100, lo: 0xb4, hi: 0xb4},
+	{value: 0x8100, lo: 0xb8, hi: 0xb8},
+	// Block 0x1, offset 0x5
+	{value: 0x0091, lo: 0x03},
+	{value: 0x4823, lo: 0xa0, hi: 0xa1},
+	{value: 0x4855, lo: 0xaf, hi: 0xb0},
+	{value: 0xa000, lo: 0xb7, hi: 0xb7},
+	// Block 0x2, offset 0x9
+	{value: 0x0000, lo: 0x01},
+	{value: 0xa000, lo: 0x92, hi: 0x92},
+	// Block 0x3, offset 0xb
+	{value: 0x0000, lo: 0x01},
+	{value: 0x8100, lo: 0x98, hi: 0x9d},
+	// Block 0x4, offset 0xd
+	{value: 0x0006, lo: 0x0a},
+	{value: 0xa000, lo: 0x81, hi: 0x81},
+	{value: 0xa000, lo: 0x85, hi: 0x85},
+	{value: 0xa000, lo: 0x89, hi: 0x89},
+	{value: 0x4981, lo: 0x8a, hi: 0x8a},
+	{value: 0x499f, lo: 0x8b, hi: 0x8b},
+	{value: 0x3808, lo: 0x8c, hi: 0x8c},
+	{value: 0x3820, lo: 0x8d, hi: 0x8d},
+	{value: 0x49b7, lo: 0x8e, hi: 0x8e},
+	{value: 0xa000, lo: 0x92, hi: 0x92},
+	{value: 0x383e, lo: 0x93, hi: 0x94},
+	// Block 0x5, offset 0x18
+	{value: 0x0000, lo: 0x0f},
+	{value: 0xa000, lo: 0x83, hi: 0x83},
+	{value: 0xa000, lo: 0x87, hi: 0x87},
+	{value: 0xa000, lo: 0x8b, hi: 0x8b},
+	{value: 0xa000, lo: 0x8d, hi: 0x8d},
+	{value: 0x38e6, lo: 0x90, hi: 0x90},
+	{value: 0x38f2, lo: 0x91, hi: 0x91},
+	{value: 0x38e0, lo: 0x93, hi: 0x93},
+	{value: 0xa000, lo: 0x96, hi: 0x96},
+	{value: 0x3958, lo: 0x97, hi: 0x97},
+	{value: 0x3922, lo: 0x9c, hi: 0x9c},
+	{value: 0x390a, lo: 0x9d, hi: 0x9d},
+	{value: 0x3934, lo: 0x9e, hi: 0x9e},
+	{value: 0xa000, lo: 0xb4, hi: 0xb5},
+	{value: 0x395e, lo: 0xb6, hi: 0xb6},
+	{value: 0x3964, lo: 0xb7, hi: 0xb7},
+	// Block 0x6, offset 0x28
+	{value: 0x0000, lo: 0x01},
+	{value: 0x8133, lo: 0x83, hi: 0x87},
+	// Block 0x7, offset 0x2a
+	{value: 0x0001, lo: 0x04},
+	{value: 0x8114, lo: 0x81, hi: 0x82},
+	{value: 0x8133, lo: 0x84, hi: 0x84},
+	{value: 0x812e, lo: 0x85, hi: 0x85},
+	{value: 0x810e, lo: 0x87, hi: 0x87},
+	// Block 0x8, offset 0x2f
+	{value: 0x0000, lo: 0x0a},
+	{value: 0x8133, lo: 0x90, hi: 0x97},
+	{value: 0x811a, lo: 0x98, hi: 0x98},
+	{value: 0x811b, lo: 0x99, hi: 0x99},
+	{value: 0x811c, lo: 0x9a, hi: 0x9a},
+	{value: 0x3982, lo: 0xa2, hi: 0xa2},
+	{value: 0x3988, lo: 0xa3, hi: 0xa3},
+	{value: 0x3994, lo: 0xa4, hi: 0xa4},
+	{value: 0x398e, lo: 0xa5, hi: 0xa5},
+	{value: 0x399a, lo: 0xa6, hi: 0xa6},
+	{value: 0xa000, lo: 0xa7, hi: 0xa7},
+	// Block 0x9, offset 0x3a
+	{value: 0x0000, lo: 0x0e},
+	{value: 0x39ac, lo: 0x80, hi: 0x80},
+	{value: 0xa000, lo: 0x81, hi: 0x81},
+	{value: 0x39a0, lo: 0x82, hi: 0x82},
+	{value: 0xa000, lo: 0x92, hi: 0x92},
+	{value: 0x39a6, lo: 0x93, hi: 0x93},
+	{value: 0xa000, lo: 0x95, hi: 0x95},
+	{value: 0x8133, lo: 0x96, hi: 0x9c},
+	{value: 0x8133, lo: 0x9f, hi: 0xa2},
+	{value: 0x812e, lo: 0xa3, hi: 0xa3},
+	{value: 0x8133, lo: 0xa4, hi: 0xa4},
+	{value: 0x8133, lo: 0xa7, hi: 0xa8},
+	{value: 0x812e, lo: 0xaa, hi: 0xaa},
+	{value: 0x8133, lo: 0xab, hi: 0xac},
+	{value: 0x812e, lo: 0xad, hi: 0xad},
+	// Block 0xa, offset 0x49
+	{value: 0x0000, lo: 0x0c},
+	{value: 0x8120, lo: 0x91, hi: 0x91},
+	{value: 0x8133, lo: 0xb0, hi: 0xb0},
+	{value: 0x812e, lo: 0xb1, hi: 0xb1},
+	{value: 0x8133, lo: 0xb2, hi: 0xb3},
+	{value: 0x812e, lo: 0xb4, hi: 0xb4},
+	{value: 0x8133, lo: 0xb5, hi: 0xb6},
+	{value: 0x812e, lo: 0xb7, hi: 0xb9},
+	{value: 0x8133, lo: 0xba, hi: 0xba},
+	{value: 0x812e, lo: 0xbb, hi: 0xbc},
+	{value: 0x8133, lo: 0xbd, hi: 0xbd},
+	{value: 0x812e, lo: 0xbe, hi: 0xbe},
+	{value: 0x8133, lo: 0xbf, hi: 0xbf},
+	// Block 0xb, offset 0x56
+	{value: 0x0005, lo: 0x07},
+	{value: 0x8133, lo: 0x80, hi: 0x80},
+	{value: 0x8133, lo: 0x81, hi: 0x81},
+	{value: 0x812e, lo: 0x82, hi: 0x83},
+	{value: 0x812e, lo: 0x84, hi: 0x85},
+	{value: 0x812e, lo: 0x86, hi: 0x87},
+	{value: 0x812e, lo: 0x88, hi: 0x89},
+	{value: 0x8133, lo: 0x8a, hi: 0x8a},
+	// Block 0xc, offset 0x5e
+	{value: 0x0000, lo: 0x04},
+	{value: 0x8133, lo: 0xab, hi: 0xb1},
+	{value: 0x812e, lo: 0xb2, hi: 0xb2},
+	{value: 0x8133, lo: 0xb3, hi: 0xb3},
+	{value: 0x812e, lo: 0xbd, hi: 0xbd},
+	// Block 0xd, offset 0x63
+	{value: 0x0000, lo: 0x04},
+	{value: 0x8133, lo: 0x96, hi: 0x99},
+	{value: 0x8133, lo: 0x9b, hi: 0xa3},
+	{value: 0x8133, lo: 0xa5, hi: 0xa7},
+	{value: 0x8133, lo: 0xa9, hi: 0xad},
+	// Block 0xe, offset 0x68
+	{value: 0x0000, lo: 0x01},
+	{value: 0x812e, lo: 0x99, hi: 0x9b},
+	// Block 0xf, offset 0x6a
+	{value: 0x0000, lo: 0x03},
+	{value: 0x8133, lo: 0x98, hi: 0x98},
+	{value: 0x812e, lo: 0x99, hi: 0x9b},
+	{value: 0x8133, lo: 0x9c, hi: 0x9f},
+	// Block 0x10, offset 0x6e
+	{value: 0x0000, lo: 0x07},
+	{value: 0xa000, lo: 0xa8, hi: 0xa8},
+	{value: 0x4019, lo: 0xa9, hi: 0xa9},
+	{value: 0xa000, lo: 0xb0, hi: 0xb0},
+	{value: 0x4021, lo: 0xb1, hi: 0xb1},
+	{value: 0xa000, lo: 0xb3, hi: 0xb3},
+	{value: 0x4029, lo: 0xb4, hi: 0xb4},
+	{value: 0x9903, lo: 0xbc, hi: 0xbc},
+	// Block 0x11, offset 0x76
+	{value: 0x0008, lo: 0x06},
+	{value: 0x8105, lo: 0x8d, hi: 0x8d},
+	{value: 0x8133, lo: 0x91, hi: 0x91},
+	{value: 0x812e, lo: 0x92, hi: 0x92},
+	{value: 0x8133, lo: 0x93, hi: 0x93},
+	{value: 0x8133, lo: 0x94, hi: 0x94},
+	{value: 0x465d, lo: 0x98, hi: 0x9f},
+	// Block 0x12, offset 0x7d
+	{value: 0x0000, lo: 0x02},
+	{value: 0x8103, lo: 0xbc, hi: 0xbc},
+	{value: 0x9900, lo: 0xbe, hi: 0xbe},
+	// Block 0x13, offset 0x80
+	{value: 0x0008, lo: 0x07},
+	{value: 0xa000, lo: 0x87, hi: 0x87},
+	{value: 0x2dd5, lo: 0x8b, hi: 0x8c},
+	{value: 0x8105, lo: 0x8d, hi: 0x8d},
+	{value: 0x9900, lo: 0x97, hi: 0x97},
+	{value: 0x469d, lo: 0x9c, hi: 0x9d},
+	{value: 0x46ad, lo: 0x9f, hi: 0x9f},
+	{value: 0x8133, lo: 0xbe, hi: 0xbe},
+	// Block 0x14, offset 0x88
+	{value: 0x0000, lo: 0x03},
+	{value: 0x46d5, lo: 0xb3, hi: 0xb3},
+	{value: 0x46dd, lo: 0xb6, hi: 0xb6},
+	{value: 0x8103, lo: 0xbc, hi: 0xbc},
+	// Block 0x15, offset 0x8c
+	{value: 0x0008, lo: 0x03},
+	{value: 0x8105, lo: 0x8d, hi: 0x8d},
+	{value: 0x46b5, lo: 0x99, hi: 0x9b},
+	{value: 0x46cd, lo: 0x9e, hi: 0x9e},
+	// Block 0x16, offset 0x90
+	{value: 0x0000, lo: 0x01},
+	{value: 0x8103, lo: 0xbc, hi: 0xbc},
+	// Block 0x17, offset 0x92
+	{value: 0x0000, lo: 0x01},
+	{value: 0x8105, lo: 0x8d, hi: 0x8d},
+	// Block 0x18, offset 0x94
+	{value: 0x0000, lo: 0x08},
+	{value: 0xa000, lo: 0x87, hi: 0x87},
+	{value: 0x2ded, lo: 0x88, hi: 0x88},
+	{value: 0x2de5, lo: 0x8b, hi: 0x8b},
+	{value: 0x2df5, lo: 0x8c, hi: 0x8c},
+	{value: 0x8105, lo: 0x8d, hi: 0x8d},
+	{value: 0x9900, lo: 0x96, hi: 0x97},
+	{value: 0x46e5, lo: 0x9c, hi: 0x9c},
+	{value: 0x46ed, lo: 0x9d, hi: 0x9d},
+	// Block 0x19, offset 0x9d
+	{value: 0x0000, lo: 0x03},
+	{value: 0xa000, lo: 0x92, hi: 0x92},
+	{value: 0x2dfd, lo: 0x94, hi: 0x94},
+	{value: 0x9900, lo: 0xbe, hi: 0xbe},
+	// Block 0x1a, offset 0xa1
+	{value: 0x0000, lo: 0x06},
+	{value: 0xa000, lo: 0x86, hi: 0x87},
+	{value: 0x2e05, lo: 0x8a, hi: 0x8a},
+	{value: 0x2e15, lo: 0x8b, hi: 0x8b},
+	{value: 0x2e0d, lo: 0x8c, hi: 0x8c},
+	{value: 0x8105, lo: 0x8d, hi: 0x8d},
+	{value: 0x9900, lo: 0x97, hi: 0x97},
+	// Block 0x1b, offset 0xa8
+	{value: 0x1801, lo: 0x04},
+	{value: 0xa000, lo: 0x86, hi: 0x86},
+	{value: 0x4031, lo: 0x88, hi: 0x88},
+	{value: 0x8105, lo: 0x8d, hi: 0x8d},
+	{value: 0x8121, lo: 0x95, hi: 0x96},
+	// Block 0x1c, offset 0xad
+	{value: 0x0000, lo: 0x02},
+	{value: 0x8103, lo: 0xbc, hi: 0xbc},
+	{value: 0xa000, lo: 0xbf, hi: 0xbf},
+	// Block 0x1d, offset 0xb0
+	{value: 0x0000, lo: 0x09},
+	{value: 0x2e1d, lo: 0x80, hi: 0x80},
+	{value: 0x9900, lo: 0x82, hi: 0x82},
+	{value: 0xa000, lo: 0x86, hi: 0x86},
+	{value: 0x2e25, lo: 0x87, hi: 0x87},
+	{value: 0x2e2d, lo: 0x88, hi: 0x88},
+	{value: 0x3091, lo: 0x8a, hi: 0x8a},
+	{value: 0x2f19, lo: 0x8b, hi: 0x8b},
+	{value: 0x8105, lo: 0x8d, hi: 0x8d},
+	{value: 0x9900, lo: 0x95, hi: 0x96},
+	// Block 0x1e, offset 0xba
+	{value: 0x0000, lo: 0x02},
+	{value: 0x8105, lo: 0xbb, hi: 0xbc},
+	{value: 0x9900, lo: 0xbe, hi: 0xbe},
+	// Block 0x1f, offset 0xbd
+	{value: 0x0000, lo: 0x06},
+	{value: 0xa000, lo: 0x86, hi: 0x87},
+	{value: 0x2e35, lo: 0x8a, hi: 0x8a},
+	{value: 0x2e45, lo: 0x8b, hi: 0x8b},
+	{value: 0x2e3d, lo: 0x8c, hi: 0x8c},
+	{value: 0x8105, lo: 0x8d, hi: 0x8d},
+	{value: 0x9900, lo: 0x97, hi: 0x97},
+	// Block 0x20, offset 0xc4
+	{value: 0x6ab3, lo: 0x07},
+	{value: 0x9905, lo: 0x8a, hi: 0x8a},
+	{value: 0x9900, lo: 0x8f, hi: 0x8f},
+	{value: 0xa000, lo: 0x99, hi: 0x99},
+	{value: 0x4039, lo: 0x9a, hi: 0x9a},
+	{value: 0x3099, lo: 0x9c, hi: 0x9c},
+	{value: 0x2f24, lo: 0x9d, hi: 0x9d},
+	{value: 0x2e4d, lo: 0x9e, hi: 0x9f},
+	// Block 0x21, offset 0xcc
+	{value: 0x0000, lo: 0x02},
+	{value: 0x8123, lo: 0xb8, hi: 0xb9},
+	{value: 0x8105, lo: 0xba, hi: 0xba},
+	// Block 0x22, offset 0xcf
+	{value: 0x0000, lo: 0x01},
+	{value: 0x8124, lo: 0x88, hi: 0x8b},
+	// Block 0x23, offset 0xd1
+	{value: 0x0000, lo: 0x02},
+	{value: 0x8125, lo: 0xb8, hi: 0xb9},
+	{value: 0x8105, lo: 0xba, hi: 0xba},
+	// Block 0x24, offset 0xd4
+	{value: 0x0000, lo: 0x01},
+	{value: 0x8126, lo: 0x88, hi: 0x8b},
+	// Block 0x25, offset 0xd6
+	{value: 0x0000, lo: 0x04},
+	{value: 0x812e, lo: 0x98, hi: 0x99},
+	{value: 0x812e, lo: 0xb5, hi: 0xb5},
+	{value: 0x812e, lo: 0xb7, hi: 0xb7},
+	{value: 0x812c, lo: 0xb9, hi: 0xb9},
+	// Block 0x26, offset 0xdb
+	{value: 0x0000, lo: 0x10},
+	{value: 0x2774, lo: 0x83, hi: 0x83},
+	{value: 0x277b, lo: 0x8d, hi: 0x8d},
+	{value: 0x2782, lo: 0x92, hi: 0x92},
+	{value: 0x2789, lo: 0x97, hi: 0x97},
+	{value: 0x2790, lo: 0x9c, hi: 0x9c},
+	{value: 0x276d, lo: 0xa9, hi: 0xa9},
+	{value: 0x8127, lo: 0xb1, hi: 0xb1},
+	{value: 0x8128, lo: 0xb2, hi: 0xb2},
+	{value: 0x4bc5, lo: 0xb3, hi: 0xb3},
+	{value: 0x8129, lo: 0xb4, hi: 0xb4},
+	{value: 0x4bce, lo: 0xb5, hi: 0xb5},
+	{value: 0x46f5, lo: 0xb6, hi: 0xb6},
+	{value: 0x8200, lo: 0xb7, hi: 0xb7},
+	{value: 0x46fd, lo: 0xb8, hi: 0xb8},
+	{value: 0x8200, lo: 0xb9, hi: 0xb9},
+	{value: 0x8128, lo: 0xba, hi: 0xbd},
+	// Block 0x27, offset 0xec
+	{value: 0x0000, lo: 0x0b},
+	{value: 0x8128, lo: 0x80, hi: 0x80},
+	{value: 0x4bd7, lo: 0x81, hi: 0x81},
+	{value: 0x8133, lo: 0x82, hi: 0x83},
+	{value: 0x8105, lo: 0x84, hi: 0x84},
+	{value: 0x8133, lo: 0x86, hi: 0x87},
+	{value: 0x279e, lo: 0x93, hi: 0x93},
+	{value: 0x27a5, lo: 0x9d, hi: 0x9d},
+	{value: 0x27ac, lo: 0xa2, hi: 0xa2},
+	{value: 0x27b3, lo: 0xa7, hi: 0xa7},
+	{value: 0x27ba, lo: 0xac, hi: 0xac},
+	{value: 0x2797, lo: 0xb9, hi: 0xb9},
+	// Block 0x28, offset 0xf8
+	{value: 0x0000, lo: 0x01},
+	{value: 0x812e, lo: 0x86, hi: 0x86},
+	// Block 0x29, offset 0xfa
+	{value: 0x0000, lo: 0x05},
+	{value: 0xa000, lo: 0xa5, hi: 0xa5},
+	{value: 0x2e55, lo: 0xa6, hi: 0xa6},
+	{value: 0x9900, lo: 0xae, hi: 0xae},
+	{value: 0x8103, lo: 0xb7, hi: 0xb7},
+	{value: 0x8105, lo: 0xb9, hi: 0xba},
+	// Block 0x2a, offset 0x100
+	{value: 0x0000, lo: 0x01},
+	{value: 0x812e, lo: 0x8d, hi: 0x8d},
+	// Block 0x2b, offset 0x102
+	{value: 0x0000, lo: 0x01},
+	{value: 0xa000, lo: 0x80, hi: 0x92},
+	// Block 0x2c, offset 0x104
+	{value: 0x0000, lo: 0x01},
+	{value: 0xb900, lo: 0xa1, hi: 0xb5},
+	// Block 0x2d, offset 0x106
+	{value: 0x0000, lo: 0x01},
+	{value: 0x9900, lo: 0xa8, hi: 0xbf},
+	// Block 0x2e, offset 0x108
+	{value: 0x0000, lo: 0x01},
+	{value: 0x9900, lo: 0x80, hi: 0x82},
+	// Block 0x2f, offset 0x10a
+	{value: 0x0000, lo: 0x01},
+	{value: 0x8133, lo: 0x9d, hi: 0x9f},
+	// Block 0x30, offset 0x10c
+	{value: 0x0000, lo: 0x02},
+	{value: 0x8105, lo: 0x94, hi: 0x95},
+	{value: 0x8105, lo: 0xb4, hi: 0xb4},
+	// Block 0x31, offset 0x10f
+	{value: 0x0000, lo: 0x02},
+	{value: 0x8105, lo: 0x92, hi: 0x92},
+	{value: 0x8133, lo: 0x9d, hi: 0x9d},
+	// Block 0x32, offset 0x112
+	{value: 0x0000, lo: 0x01},
+	{value: 0x8132, lo: 0xa9, hi: 0xa9},
+	// Block 0x33, offset 0x114
+	{value: 0x0004, lo: 0x02},
+	{value: 0x812f, lo: 0xb9, hi: 0xba},
+	{value: 0x812e, lo: 0xbb, hi: 0xbb},
+	// Block 0x34, offset 0x117
+	{value: 0x0000, lo: 0x02},
+	{value: 0x8133, lo: 0x97, hi: 0x97},
+	{value: 0x812e, lo: 0x98, hi: 0x98},
+	// Block 0x35, offset 0x11a
+	{value: 0x0000, lo: 0x03},
+	{value: 0x8105, lo: 0xa0, hi: 0xa0},
+	{value: 0x8133, lo: 0xb5, hi: 0xbc},
+	{value: 0x812e, lo: 0xbf, hi: 0xbf},
+	// Block 0x36, offset 0x11e
+	{value: 0x0000, lo: 0x05},
+	{value: 0x8133, lo: 0xb0, hi: 0xb4},
+	{value: 0x812e, lo: 0xb5, hi: 0xba},
+	{value: 0x8133, lo: 0xbb, hi: 0xbc},
+	{value: 0x812e, lo: 0xbd, hi: 0xbd},
+	{value: 0x812e, lo: 0xbf, hi: 0xbf},
+	// Block 0x37, offset 0x124
+	{value: 0x0000, lo: 0x06},
+	{value: 0x812e, lo: 0x80, hi: 0x80},
+	{value: 0x8133, lo: 0x81, hi: 0x82},
+	{value: 0x812e, lo: 0x83, hi: 0x84},
+	{value: 0x8133, lo: 0x85, hi: 0x89},
+	{value: 0x812e, lo: 0x8a, hi: 0x8a},
+	{value: 0x8133, lo: 0x8b, hi: 0x8e},
+	// Block 0x38, offset 0x12b
+	{value: 0x0000, lo: 0x08},
+	{value: 0x2e9d, lo: 0x80, hi: 0x80},
+	{value: 0x2ea5, lo: 0x81, hi: 0x81},
+	{value: 0xa000, lo: 0x82, hi: 0x82},
+	{value: 0x2ead, lo: 0x83, hi: 0x83},
+	{value: 0x8105, lo: 0x84, hi: 0x84},
+	{value: 0x8133, lo: 0xab, hi: 0xab},
+	{value: 0x812e, lo: 0xac, hi: 0xac},
+	{value: 0x8133, lo: 0xad, hi: 0xb3},
+	// Block 0x39, offset 0x134
+	{value: 0x0000, lo: 0x01},
+	{value: 0x8105, lo: 0xaa, hi: 0xab},
+	// Block 0x3a, offset 0x136
+	{value: 0x0000, lo: 0x02},
+	{value: 0x8103, lo: 0xa6, hi: 0xa6},
+	{value: 0x8105, lo: 0xb2, hi: 0xb3},
+	// Block 0x3b, offset 0x139
+	{value: 0x0000, lo: 0x01},
+	{value: 0x8103, lo: 0xb7, hi: 0xb7},
+	// Block 0x3c, offset 0x13b
+	{value: 0x0000, lo: 0x0a},
+	{value: 0x8133, lo: 0x90, hi: 0x92},
+	{value: 0x8101, lo: 0x94, hi: 0x94},
+	{value: 0x812e, lo: 0x95, hi: 0x99},
+	{value: 0x8133, lo: 0x9a, hi: 0x9b},
+	{value: 0x812e, lo: 0x9c, hi: 0x9f},
+	{value: 0x8133, lo: 0xa0, hi: 0xa0},
+	{value: 0x8101, lo: 0xa2, hi: 0xa8},
+	{value: 0x812e, lo: 0xad, hi: 0xad},
+	{value: 0x8133, lo: 0xb4, hi: 0xb4},
+	{value: 0x8133, lo: 0xb8, hi: 0xb9},
+	// Block 0x3d, offset 0x146
+	{value: 0x0004, lo: 0x03},
+	{value: 0x052a, lo: 0x80, hi: 0x81},
+	{value: 0x8100, lo: 0x97, hi: 0x97},
+	{value: 0x8100, lo: 0xbe, hi: 0xbe},
+	// Block 0x3e, offset 0x14a
+	{value: 0x0000, lo: 0x0d},
+	{value: 0x8133, lo: 0x90, hi: 0x91},
+	{value: 0x8101, lo: 0x92, hi: 0x93},
+	{value: 0x8133, lo: 0x94, hi: 0x97},
+	{value: 0x8101, lo: 0x98, hi: 0x9a},
+	{value: 0x8133, lo: 0x9b, hi: 0x9c},
+	{value: 0x8133, lo: 0xa1, hi: 0xa1},
+	{value: 0x8101, lo: 0xa5, hi: 0xa6},
+	{value: 0x8133, lo: 0xa7, hi: 0xa7},
+	{value: 0x812e, lo: 0xa8, hi: 0xa8},
+	{value: 0x8133, lo: 0xa9, hi: 0xa9},
+	{value: 0x8101, lo: 0xaa, hi: 0xab},
+	{value: 0x812e, lo: 0xac, hi: 0xaf},
+	{value: 0x8133, lo: 0xb0, hi: 0xb0},
+	// Block 0x3f, offset 0x158
+	{value: 0x43bc, lo: 0x02},
+	{value: 0x023c, lo: 0xa6, hi: 0xa6},
+	{value: 0x0057, lo: 0xaa, hi: 0xab},
+	// Block 0x40, offset 0x15b
+	{value: 0x0007, lo: 0x05},
+	{value: 0xa000, lo: 0x90, hi: 0x90},
+	{value: 0xa000, lo: 0x92, hi: 0x92},
+	{value: 0xa000, lo: 0x94, hi: 0x94},
+	{value: 0x3cfa, lo: 0x9a, hi: 0x9b},
+	{value: 0x3d08, lo: 0xae, hi: 0xae},
+	// Block 0x41, offset 0x161
+	{value: 0x000e, lo: 0x05},
+	{value: 0x3d0f, lo: 0x8d, hi: 0x8e},
+	{value: 0x3d16, lo: 0x8f, hi: 0x8f},
+	{value: 0xa000, lo: 0x90, hi: 0x90},
+	{value: 0xa000, lo: 0x92, hi: 0x92},
+	{value: 0xa000, lo: 0x94, hi: 0x94},
+	// Block 0x42, offset 0x167
+	{value: 0x62c7, lo: 0x0a},
+	{value: 0xa000, lo: 0x83, hi: 0x83},
+	{value: 0x3d24, lo: 0x84, hi: 0x84},
+	{value: 0xa000, lo: 0x88, hi: 0x88},
+	{value: 0x3d2b, lo: 0x89, hi: 0x89},
+	{value: 0xa000, lo: 0x8b, hi: 0x8b},
+	{value: 0x3d32, lo: 0x8c, hi: 0x8c},
+	{value: 0xa000, lo: 0xa3, hi: 0xa3},
+	{value: 0x3d39, lo: 0xa4, hi: 0xa5},
+	{value: 0x3d40, lo: 0xa6, hi: 0xa6},
+	{value: 0xa000, lo: 0xbc, hi: 0xbc},
+	// Block 0x43, offset 0x172
+	{value: 0x0007, lo: 0x03},
+	{value: 0x3da9, lo: 0xa0, hi: 0xa1},
+	{value: 0x3dd3, lo: 0xa2, hi: 0xa3},
+	{value: 0x3dfd, lo: 0xaa, hi: 0xad},
+	// Block 0x44, offset 0x176
+	{value: 0x0004, lo: 0x01},
+	{value: 0x0586, lo: 0xa9, hi: 0xaa},
+	// Block 0x45, offset 0x178
+	{value: 0x0000, lo: 0x01},
+	{value: 0x461e, lo: 0x9c, hi: 0x9c},
+	// Block 0x46, offset 0x17a
+	{value: 0x0000, lo: 0x01},
+	{value: 0x8133, lo: 0xaf, hi: 0xb1},
+	// Block 0x47, offset 0x17c
+	{value: 0x0000, lo: 0x01},
+	{value: 0x8105, lo: 0xbf, hi: 0xbf},
+	// Block 0x48, offset 0x17e
+	{value: 0x0000, lo: 0x01},
+	{value: 0x8133, lo: 0xa0, hi: 0xbf},
+	// Block 0x49, offset 0x180
+	{value: 0x0000, lo: 0x05},
+	{value: 0x812d, lo: 0xaa, hi: 0xaa},
+	{value: 0x8132, lo: 0xab, hi: 0xab},
+	{value: 0x8134, lo: 0xac, hi: 0xac},
+	{value: 0x812f, lo: 0xad, hi: 0xad},
+	{value: 0x8130, lo: 0xae, hi: 0xaf},
+	// Block 0x4a, offset 0x186
+	{value: 0x0000, lo: 0x03},
+	{value: 0x4be0, lo: 0xb3, hi: 0xb3},
+	{value: 0x4be0, lo: 0xb5, hi: 0xb6},
+	{value: 0x4be0, lo: 0xba, hi: 0xbf},
+	// Block 0x4b, offset 0x18a
+	{value: 0x0000, lo: 0x01},
+	{value: 0x4be0, lo: 0x8f, hi: 0xa3},
+	// Block 0x4c, offset 0x18c
+	{value: 0x0000, lo: 0x01},
+	{value: 0x8100, lo: 0xae, hi: 0xbe},
+	// Block 0x4d, offset 0x18e
+	{value: 0x0000, lo: 0x07},
+	{value: 0x8100, lo: 0x84, hi: 0x84},
+	{value: 0x8100, lo: 0x87, hi: 0x87},
+	{value: 0x8100, lo: 0x90, hi: 0x90},
+	{value: 0x8100, lo: 0x9e, hi: 0x9e},
+	{value: 0x8100, lo: 0xa1, hi: 0xa1},
+	{value: 0x8100, lo: 0xb2, hi: 0xb2},
+	{value: 0x8100, lo: 0xbb, hi: 0xbb},
+	// Block 0x4e, offset 0x196
+	{value: 0x0000, lo: 0x03},
+	{value: 0x8100, lo: 0x80, hi: 0x80},
+	{value: 0x8100, lo: 0x8b, hi: 0x8b},
+	{value: 0x8100, lo: 0x8e, hi: 0x8e},
+	// Block 0x4f, offset 0x19a
+	{value: 0x0000, lo: 0x02},
+	{value: 0x8133, lo: 0xaf, hi: 0xaf},
+	{value: 0x8133, lo: 0xb4, hi: 0xbd},
+	// Block 0x50, offset 0x19d
+	{value: 0x0000, lo: 0x01},
+	{value: 0x8133, lo: 0x9e, hi: 0x9f},
+	// Block 0x51, offset 0x19f
+	{value: 0x0000, lo: 0x01},
+	{value: 0x8133, lo: 0xb0, hi: 0xb1},
+	// Block 0x52, offset 0x1a1
+	{value: 0x0000, lo: 0x02},
+	{value: 0x8105, lo: 0x86, hi: 0x86},
+	{value: 0x8105, lo: 0xac, hi: 0xac},
+	// Block 0x53, offset 0x1a4
+	{value: 0x0000, lo: 0x02},
+	{value: 0x8105, lo: 0x84, hi: 0x84},
+	{value: 0x8133, lo: 0xa0, hi: 0xb1},
+	// Block 0x54, offset 0x1a7
+	{value: 0x0000, lo: 0x01},
+	{value: 0x812e, lo: 0xab, hi: 0xad},
+	// Block 0x55, offset 0x1a9
+	{value: 0x0000, lo: 0x01},
+	{value: 0x8105, lo: 0x93, hi: 0x93},
+	// Block 0x56, offset 0x1ab
+	{value: 0x0000, lo: 0x01},
+	{value: 0x8103, lo: 0xb3, hi: 0xb3},
+	// Block 0x57, offset 0x1ad
+	{value: 0x0000, lo: 0x01},
+	{value: 0x8105, lo: 0x80, hi: 0x80},
+	// Block 0x58, offset 0x1af
+	{value: 0x0000, lo: 0x05},
+	{value: 0x8133, lo: 0xb0, hi: 0xb0},
+	{value: 0x8133, lo: 0xb2, hi: 0xb3},
+	{value: 0x812e, lo: 0xb4, hi: 0xb4},
+	{value: 0x8133, lo: 0xb7, hi: 0xb8},
+	{value: 0x8133, lo: 0xbe, hi: 0xbf},
+	// Block 0x59, offset 0x1b5
+	{value: 0x0000, lo: 0x02},
+	{value: 0x8133, lo: 0x81, hi: 0x81},
+	{value: 0x8105, lo: 0xb6, hi: 0xb6},
+	// Block 0x5a, offset 0x1b8
+	{value: 0x0000, lo: 0x01},
+	{value: 0x8105, lo: 0xad, hi: 0xad},
+	// Block 0x5b, offset 0x1ba
+	{value: 0x0000, lo: 0x06},
+	{value: 0xe500, lo: 0x80, hi: 0x80},
+	{value: 0xc600, lo: 0x81, hi: 0x9b},
+	{value: 0xe500, lo: 0x9c, hi: 0x9c},
+	{value: 0xc600, lo: 0x9d, hi: 0xb7},
+	{value: 0xe500, lo: 0xb8, hi: 0xb8},
+	{value: 0xc600, lo: 0xb9, hi: 0xbf},
+	// Block 0x5c, offset 0x1c1
+	{value: 0x0000, lo: 0x05},
+	{value: 0xc600, lo: 0x80, hi: 0x93},
+	{value: 0xe500, lo: 0x94, hi: 0x94},
+	{value: 0xc600, lo: 0x95, hi: 0xaf},
+	{value: 0xe500, lo: 0xb0, hi: 0xb0},
+	{value: 0xc600, lo: 0xb1, hi: 0xbf},
+	// Block 0x5d, offset 0x1c7
+	{value: 0x0000, lo: 0x05},
+	{value: 0xc600, lo: 0x80, hi: 0x8b},
+	{value: 0xe500, lo: 0x8c, hi: 0x8c},
+	{value: 0xc600, lo: 0x8d, hi: 0xa7},
+	{value: 0xe500, lo: 0xa8, hi: 0xa8},
+	{value: 0xc600, lo: 0xa9, hi: 0xbf},
+	// Block 0x5e, offset 0x1cd
+	{value: 0x0000, lo: 0x07},
+	{value: 0xc600, lo: 0x80, hi: 0x83},
+	{value: 0xe500, lo: 0x84, hi: 0x84},
+	{value: 0xc600, lo: 0x85, hi: 0x9f},
+	{value: 0xe500, lo: 0xa0, hi: 0xa0},
+	{value: 0xc600, lo: 0xa1, hi: 0xbb},
+	{value: 0xe500, lo: 0xbc, hi: 0xbc},
+	{value: 0xc600, lo: 0xbd, hi: 0xbf},
+	// Block 0x5f, offset 0x1d5
+	{value: 0x0000, lo: 0x05},
+	{value: 0xc600, lo: 0x80, hi: 0x97},
+	{value: 0xe500, lo: 0x98, hi: 0x98},
+	{value: 0xc600, lo: 0x99, hi: 0xb3},
+	{value: 0xe500, lo: 0xb4, hi: 0xb4},
+	{value: 0xc600, lo: 0xb5, hi: 0xbf},
+	// Block 0x60, offset 0x1db
+	{value: 0x0000, lo: 0x05},
+	{value: 0xc600, lo: 0x80, hi: 0x8f},
+	{value: 0xe500, lo: 0x90, hi: 0x90},
+	{value: 0xc600, lo: 0x91, hi: 0xab},
+	{value: 0xe500, lo: 0xac, hi: 0xac},
+	{value: 0xc600, lo: 0xad, hi: 0xbf},
+	// Block 0x61, offset 0x1e1
+	{value: 0x0000, lo: 0x05},
+	{value: 0xc600, lo: 0x80, hi: 0x87},
+	{value: 0xe500, lo: 0x88, hi: 0x88},
+	{value: 0xc600, lo: 0x89, hi: 0xa3},
+	{value: 0xe500, lo: 0xa4, hi: 0xa4},
+	{value: 0xc600, lo: 0xa5, hi: 0xbf},
+	// Block 0x62, offset 0x1e7
+	{value: 0x0000, lo: 0x03},
+	{value: 0xc600, lo: 0x80, hi: 0x87},
+	{value: 0xe500, lo: 0x88, hi: 0x88},
+	{value: 0xc600, lo: 0x89, hi: 0xa3},
+	// Block 0x63, offset 0x1eb
+	{value: 0x0006, lo: 0x0d},
+	{value: 0x44d1, lo: 0x9d, hi: 0x9d},
+	{value: 0x8116, lo: 0x9e, hi: 0x9e},
+	{value: 0x4543, lo: 0x9f, hi: 0x9f},
+	{value: 0x4531, lo: 0xaa, hi: 0xab},
+	{value: 0x4635, lo: 0xac, hi: 0xac},
+	{value: 0x463d, lo: 0xad, hi: 0xad},
+	{value: 0x4489, lo: 0xae, hi: 0xb1},
+	{value: 0x44a7, lo: 0xb2, hi: 0xb4},
+	{value: 0x44bf, lo: 0xb5, hi: 0xb6},
+	{value: 0x44cb, lo: 0xb8, hi: 0xb8},
+	{value: 0x44d7, lo: 0xb9, hi: 0xbb},
+	{value: 0x44ef, lo: 0xbc, hi: 0xbc},
+	{value: 0x44f5, lo: 0xbe, hi: 0xbe},
+	// Block 0x64, offset 0x1f9
+	{value: 0x0006, lo: 0x08},
+	{value: 0x44fb, lo: 0x80, hi: 0x81},
+	{value: 0x4507, lo: 0x83, hi: 0x84},
+	{value: 0x4519, lo: 0x86, hi: 0x89},
+	{value: 0x453d, lo: 0x8a, hi: 0x8a},
+	{value: 0x44b9, lo: 0x8b, hi: 0x8b},
+	{value: 0x44a1, lo: 0x8c, hi: 0x8c},
+	{value: 0x44e9, lo: 0x8d, hi: 0x8d},
+	{value: 0x4513, lo: 0x8e, hi: 0x8e},
+	// Block 0x65, offset 0x202
+	{value: 0x0000, lo: 0x02},
+	{value: 0x8100, lo: 0xa4, hi: 0xa5},
+	{value: 0x8100, lo: 0xb0, hi: 0xb1},
+	// Block 0x66, offset 0x205
+	{value: 0x0000, lo: 0x02},
+	{value: 0x8100, lo: 0x9b, hi: 0x9d},
+	{value: 0x8200, lo: 0x9e, hi: 0xa3},
+	// Block 0x67, offset 0x208
+	{value: 0x0000, lo: 0x01},
+	{value: 0x8100, lo: 0x90, hi: 0x90},
+	// Block 0x68, offset 0x20a
+	{value: 0x0000, lo: 0x02},
+	{value: 0x8100, lo: 0x99, hi: 0x99},
+	{value: 0x8200, lo: 0xb2, hi: 0xb4},
+	// Block 0x69, offset 0x20d
+	{value: 0x0000, lo: 0x01},
+	{value: 0x8100, lo: 0xbc, hi: 0xbd},
+	// Block 0x6a, offset 0x20f
+	{value: 0x0000, lo: 0x03},
+	{value: 0x8133, lo: 0xa0, hi: 0xa6},
+	{value: 0x812e, lo: 0xa7, hi: 0xad},
+	{value: 0x8133, lo: 0xae, hi: 0xaf},
+	// Block 0x6b, offset 0x213
+	{value: 0x0000, lo: 0x04},
+	{value: 0x8100, lo: 0x89, hi: 0x8c},
+	{value: 0x8100, lo: 0xb0, hi: 0xb2},
+	{value: 0x8100, lo: 0xb4, hi: 0xb4},
+	{value: 0x8100, lo: 0xb6, hi: 0xbf},
+	// Block 0x6c, offset 0x218
+	{value: 0x0000, lo: 0x01},
+	{value: 0x8100, lo: 0x81, hi: 0x8c},
+	// Block 0x6d, offset 0x21a
+	{value: 0x0000, lo: 0x01},
+	{value: 0x8100, lo: 0xb5, hi: 0xba},
+	// Block 0x6e, offset 0x21c
+	{value: 0x0000, lo: 0x04},
+	{value: 0x4be0, lo: 0x9e, hi: 0x9f},
+	{value: 0x4be0, lo: 0xa3, hi: 0xa3},
+	{value: 0x4be0, lo: 0xa5, hi: 0xa6},
+	{value: 0x4be0, lo: 0xaa, hi: 0xaf},
+	// Block 0x6f, offset 0x221
+	{value: 0x0000, lo: 0x05},
+	{value: 0x4be0, lo: 0x82, hi: 0x87},
+	{value: 0x4be0, lo: 0x8a, hi: 0x8f},
+	{value: 0x4be0, lo: 0x92, hi: 0x97},
+	{value: 0x4be0, lo: 0x9a, hi: 0x9c},
+	{value: 0x8100, lo: 0xa3, hi: 0xa3},
+	// Block 0x70, offset 0x227
+	{value: 0x0000, lo: 0x01},
+	{value: 0x812e, lo: 0xbd, hi: 0xbd},
+	// Block 0x71, offset 0x229
+	{value: 0x0000, lo: 0x01},
+	{value: 0x812e, lo: 0xa0, hi: 0xa0},
+	// Block 0x72, offset 0x22b
+	{value: 0x0000, lo: 0x01},
+	{value: 0x8133, lo: 0xb6, hi: 0xba},
+	// Block 0x73, offset 0x22d
+	{value: 0x002d, lo: 0x05},
+	{value: 0x812e, lo: 0x8d, hi: 0x8d},
+	{value: 0x8133, lo: 0x8f, hi: 0x8f},
+	{value: 0x8133, lo: 0xb8, hi: 0xb8},
+	{value: 0x8101, lo: 0xb9, hi: 0xba},
+	{value: 0x8105, lo: 0xbf, hi: 0xbf},
+	// Block 0x74, offset 0x233
+	{value: 0x0000, lo: 0x02},
+	{value: 0x8133, lo: 0xa5, hi: 0xa5},
+	{value: 0x812e, lo: 0xa6, hi: 0xa6},
+	// Block 0x75, offset 0x236
+	{value: 0x0000, lo: 0x01},
+	{value: 0x8133, lo: 0xa4, hi: 0xa7},
+	// Block 0x76, offset 0x238
+	{value: 0x0000, lo: 0x01},
+	{value: 0x8133, lo: 0xab, hi: 0xac},
+	// Block 0x77, offset 0x23a
+	{value: 0x0000, lo: 0x01},
+	{value: 0x812e, lo: 0xbd, hi: 0xbf},
+	// Block 0x78, offset 0x23c
+	{value: 0x0000, lo: 0x05},
+	{value: 0x812e, lo: 0x86, hi: 0x87},
+	{value: 0x8133, lo: 0x88, hi: 0x8a},
+	{value: 0x812e, lo: 0x8b, hi: 0x8b},
+	{value: 0x8133, lo: 0x8c, hi: 0x8c},
+	{value: 0x812e, lo: 0x8d, hi: 0x90},
+	// Block 0x79, offset 0x242
+	{value: 0x0005, lo: 0x03},
+	{value: 0x8133, lo: 0x82, hi: 0x82},
+	{value: 0x812e, lo: 0x83, hi: 0x84},
+	{value: 0x812e, lo: 0x85, hi: 0x85},
+	// Block 0x7a, offset 0x246
+	{value: 0x0000, lo: 0x03},
+	{value: 0x8105, lo: 0x86, hi: 0x86},
+	{value: 0x8105, lo: 0xb0, hi: 0xb0},
+	{value: 0x8105, lo: 0xbf, hi: 0xbf},
+	// Block 0x7b, offset 0x24a
+	{value: 0x17fe, lo: 0x07},
+	{value: 0xa000, lo: 0x99, hi: 0x99},
+	{value: 0x4379, lo: 0x9a, hi: 0x9a},
+	{value: 0xa000, lo: 0x9b, hi: 0x9b},
+	{value: 0x4383, lo: 0x9c, hi: 0x9c},
+	{value: 0xa000, lo: 0xa5, hi: 0xa5},
+	{value: 0x438d, lo: 0xab, hi: 0xab},
+	{value: 0x8105, lo: 0xb9, hi: 0xba},
+	// Block 0x7c, offset 0x252
+	{value: 0x0000, lo: 0x06},
+	{value: 0x8133, lo: 0x80, hi: 0x82},
+	{value: 0x9900, lo: 0xa7, hi: 0xa7},
+	{value: 0x2eb5, lo: 0xae, hi: 0xae},
+	{value: 0x2ebf, lo: 0xaf, hi: 0xaf},
+	{value: 0xa000, lo: 0xb1, hi: 0xb2},
+	{value: 0x8105, lo: 0xb3, hi: 0xb4},
+	// Block 0x7d, offset 0x259
+	{value: 0x0000, lo: 0x02},
+	{value: 0x8105, lo: 0x80, hi: 0x80},
+	{value: 0x8103, lo: 0x8a, hi: 0x8a},
+	// Block 0x7e, offset 0x25c
+	{value: 0x0000, lo: 0x02},
+	{value: 0x8105, lo: 0xb5, hi: 0xb5},
+	{value: 0x8103, lo: 0xb6, hi: 0xb6},
+	// Block 0x7f, offset 0x25f
+	{value: 0x0002, lo: 0x01},
+	{value: 0x8103, lo: 0xa9, hi: 0xaa},
+	// Block 0x80, offset 0x261
+	{value: 0x0000, lo: 0x02},
+	{value: 0x8103, lo: 0xbb, hi: 0xbc},
+	{value: 0x9900, lo: 0xbe, hi: 0xbe},
+	// Block 0x81, offset 0x264
+	{value: 0x0000, lo: 0x07},
+	{value: 0xa000, lo: 0x87, hi: 0x87},
+	{value: 0x2ec9, lo: 0x8b, hi: 0x8b},
+	{value: 0x2ed3, lo: 0x8c, hi: 0x8c},
+	{value: 0x8105, lo: 0x8d, hi: 0x8d},
+	{value: 0x9900, lo: 0x97, hi: 0x97},
+	{value: 0x8133, lo: 0xa6, hi: 0xac},
+	{value: 0x8133, lo: 0xb0, hi: 0xb4},
+	// Block 0x82, offset 0x26c
+	{value: 0x0000, lo: 0x03},
+	{value: 0x8105, lo: 0x82, hi: 0x82},
+	{value: 0x8103, lo: 0x86, hi: 0x86},
+	{value: 0x8133, lo: 0x9e, hi: 0x9e},
+	// Block 0x83, offset 0x270
+	{value: 0x6a23, lo: 0x06},
+	{value: 0x9900, lo: 0xb0, hi: 0xb0},
+	{value: 0xa000, lo: 0xb9, hi: 0xb9},
+	{value: 0x9900, lo: 0xba, hi: 0xba},
+	{value: 0x2ee7, lo: 0xbb, hi: 0xbb},
+	{value: 0x2edd, lo: 0xbc, hi: 0xbd},
+	{value: 0x2ef1, lo: 0xbe, hi: 0xbe},
+	// Block 0x84, offset 0x277
+	{value: 0x0000, lo: 0x02},
+	{value: 0x8105, lo: 0x82, hi: 0x82},
+	{value: 0x8103, lo: 0x83, hi: 0x83},
+	// Block 0x85, offset 0x27a
+	{value: 0x0000, lo: 0x05},
+	{value: 0x9900, lo: 0xaf, hi: 0xaf},
+	{value: 0xa000, lo: 0xb8, hi: 0xb9},
+	{value: 0x2efb, lo: 0xba, hi: 0xba},
+	{value: 0x2f05, lo: 0xbb, hi: 0xbb},
+	{value: 0x8105, lo: 0xbf, hi: 0xbf},
+	// Block 0x86, offset 0x280
+	{value: 0x0000, lo: 0x01},
+	{value: 0x8103, lo: 0x80, hi: 0x80},
+	// Block 0x87, offset 0x282
+	{value: 0x0000, lo: 0x02},
+	{value: 0x8105, lo: 0xb6, hi: 0xb6},
+	{value: 0x8103, lo: 0xb7, hi: 0xb7},
+	// Block 0x88, offset 0x285
+	{value: 0x0000, lo: 0x01},
+	{value: 0x8105, lo: 0xab, hi: 0xab},
+	// Block 0x89, offset 0x287
+	{value: 0x0000, lo: 0x02},
+	{value: 0x8105, lo: 0xb9, hi: 0xb9},
+	{value: 0x8103, lo: 0xba, hi: 0xba},
+	// Block 0x8a, offset 0x28a
+	{value: 0x0000, lo: 0x04},
+	{value: 0x9900, lo: 0xb0, hi: 0xb0},
+	{value: 0xa000, lo: 0xb5, hi: 0xb5},
+	{value: 0x2f0f, lo: 0xb8, hi: 0xb8},
+	{value: 0x8105, lo: 0xbd, hi: 0xbe},
+	// Block 0x8b, offset 0x28f
+	{value: 0x0000, lo: 0x01},
+	{value: 0x8103, lo: 0x83, hi: 0x83},
+	// Block 0x8c, offset 0x291
+	{value: 0x0000, lo: 0x01},
+	{value: 0x8105, lo: 0xa0, hi: 0xa0},
+	// Block 0x8d, offset 0x293
+	{value: 0x0000, lo: 0x01},
+	{value: 0x8105, lo: 0xb4, hi: 0xb4},
+	// Block 0x8e, offset 0x295
+	{value: 0x0000, lo: 0x01},
+	{value: 0x8105, lo: 0x87, hi: 0x87},
+	// Block 0x8f, offset 0x297
+	{value: 0x0000, lo: 0x01},
+	{value: 0x8105, lo: 0x99, hi: 0x99},
+	// Block 0x90, offset 0x299
+	{value: 0x0000, lo: 0x02},
+	{value: 0x8103, lo: 0x82, hi: 0x82},
+	{value: 0x8105, lo: 0x84, hi: 0x85},
+	// Block 0x91, offset 0x29c
+	{value: 0x0000, lo: 0x01},
+	{value: 0x8105, lo: 0x97, hi: 0x97},
+	// Block 0x92, offset 0x29e
+	{value: 0x0000, lo: 0x01},
+	{value: 0x8105, lo: 0x81, hi: 0x82},
+	// Block 0x93, offset 0x2a0
+	{value: 0x0000, lo: 0x01},
+	{value: 0x8101, lo: 0xb0, hi: 0xb4},
+	// Block 0x94, offset 0x2a2
+	{value: 0x0000, lo: 0x01},
+	{value: 0x8133, lo: 0xb0, hi: 0xb6},
+	// Block 0x95, offset 0x2a4
+	{value: 0x0000, lo: 0x01},
+	{value: 0x8102, lo: 0xb0, hi: 0xb1},
+	// Block 0x96, offset 0x2a6
+	{value: 0x0000, lo: 0x01},
+	{value: 0x8101, lo: 0x9e, hi: 0x9e},
+	// Block 0x97, offset 0x2a8
+	{value: 0x0000, lo: 0x0c},
+	{value: 0x470d, lo: 0x9e, hi: 0x9e},
+	{value: 0x4717, lo: 0x9f, hi: 0x9f},
+	{value: 0x474b, lo: 0xa0, hi: 0xa0},
+	{value: 0x4759, lo: 0xa1, hi: 0xa1},
+	{value: 0x4767, lo: 0xa2, hi: 0xa2},
+	{value: 0x4775, lo: 0xa3, hi: 0xa3},
+	{value: 0x4783, lo: 0xa4, hi: 0xa4},
+	{value: 0x812c, lo: 0xa5, hi: 0xa6},
+	{value: 0x8101, lo: 0xa7, hi: 0xa9},
+	{value: 0x8131, lo: 0xad, hi: 0xad},
+	{value: 0x812c, lo: 0xae, hi: 0xb2},
+	{value: 0x812e, lo: 0xbb, hi: 0xbf},
+	// Block 0x98, offset 0x2b5
+	{value: 0x0000, lo: 0x09},
+	{value: 0x812e, lo: 0x80, hi: 0x82},
+	{value: 0x8133, lo: 0x85, hi: 0x89},
+	{value: 0x812e, lo: 0x8a, hi: 0x8b},
+	{value: 0x8133, lo: 0xaa, hi: 0xad},
+	{value: 0x4721, lo: 0xbb, hi: 0xbb},
+	{value: 0x472b, lo: 0xbc, hi: 0xbc},
+	{value: 0x4791, lo: 0xbd, hi: 0xbd},
+	{value: 0x47ad, lo: 0xbe, hi: 0xbe},
+	{value: 0x479f, lo: 0xbf, hi: 0xbf},
+	// Block 0x99, offset 0x2bf
+	{value: 0x0000, lo: 0x01},
+	{value: 0x47bb, lo: 0x80, hi: 0x80},
+	// Block 0x9a, offset 0x2c1
+	{value: 0x0000, lo: 0x01},
+	{value: 0x8133, lo: 0x82, hi: 0x84},
+	// Block 0x9b, offset 0x2c3
+	{value: 0x0000, lo: 0x05},
+	{value: 0x8133, lo: 0x80, hi: 0x86},
+	{value: 0x8133, lo: 0x88, hi: 0x98},
+	{value: 0x8133, lo: 0x9b, hi: 0xa1},
+	{value: 0x8133, lo: 0xa3, hi: 0xa4},
+	{value: 0x8133, lo: 0xa6, hi: 0xaa},
+	// Block 0x9c, offset 0x2c9
+	{value: 0x0000, lo: 0x01},
+	{value: 0x8133, lo: 0x8f, hi: 0x8f},
+	// Block 0x9d, offset 0x2cb
+	{value: 0x0000, lo: 0x01},
+	{value: 0x8133, lo: 0xae, hi: 0xae},
+	// Block 0x9e, offset 0x2cd
+	{value: 0x0000, lo: 0x01},
+	{value: 0x8133, lo: 0xac, hi: 0xaf},
+	// Block 0x9f, offset 0x2cf
+	{value: 0x0000, lo: 0x03},
+	{value: 0x8134, lo: 0xac, hi: 0xad},
+	{value: 0x812e, lo: 0xae, hi: 0xae},
+	{value: 0x8133, lo: 0xaf, hi: 0xaf},
+	// Block 0xa0, offset 0x2d3
+	{value: 0x0000, lo: 0x01},
+	{value: 0x812e, lo: 0x90, hi: 0x96},
+	// Block 0xa1, offset 0x2d5
+	{value: 0x0000, lo: 0x02},
+	{value: 0x8133, lo: 0x84, hi: 0x89},
+	{value: 0x8103, lo: 0x8a, hi: 0x8a},
+	// Block 0xa2, offset 0x2d8
+	{value: 0x0000, lo: 0x01},
+	{value: 0x8100, lo: 0x93, hi: 0x93},
+}
+
+// lookup returns the trie value for the first UTF-8 encoding in s and
+// the width in bytes of this encoding. The size will be 0 if s does not
+// hold enough bytes to complete the encoding. len(s) must be greater than 0.
+func (t *nfkcTrie) lookup(s []byte) (v uint16, sz int) {
+	c0 := s[0]
+	switch {
+	case c0 < 0x80: // is ASCII
+		return nfkcValues[c0], 1
+	case c0 < 0xC2:
+		return 0, 1 // Illegal UTF-8: not a starter, not ASCII.
+	case c0 < 0xE0: // 2-byte UTF-8
+		if len(s) < 2 {
+			return 0, 0
+		}
+		i := nfkcIndex[c0]
+		c1 := s[1]
+		if c1 < 0x80 || 0xC0 <= c1 {
+			return 0, 1 // Illegal UTF-8: not a continuation byte.
+		}
+		return t.lookupValue(uint32(i), c1), 2
+	case c0 < 0xF0: // 3-byte UTF-8
+		if len(s) < 3 {
+			return 0, 0
+		}
+		i := nfkcIndex[c0]
+		c1 := s[1]
+		if c1 < 0x80 || 0xC0 <= c1 {
+			return 0, 1 // Illegal UTF-8: not a continuation byte.
+		}
+		o := uint32(i)<<6 + uint32(c1)
+		i = nfkcIndex[o]
+		c2 := s[2]
+		if c2 < 0x80 || 0xC0 <= c2 {
+			return 0, 2 // Illegal UTF-8: not a continuation byte.
+		}
+		return t.lookupValue(uint32(i), c2), 3
+	case c0 < 0xF8: // 4-byte UTF-8
+		if len(s) < 4 {
+			return 0, 0
+		}
+		i := nfkcIndex[c0]
+		c1 := s[1]
+		if c1 < 0x80 || 0xC0 <= c1 {
+			return 0, 1 // Illegal UTF-8: not a continuation byte.
+		}
+		o := uint32(i)<<6 + uint32(c1)
+		i = nfkcIndex[o]
+		c2 := s[2]
+		if c2 < 0x80 || 0xC0 <= c2 {
+			return 0, 2 // Illegal UTF-8: not a continuation byte.
+		}
+		o = uint32(i)<<6 + uint32(c2)
+		i = nfkcIndex[o]
+		c3 := s[3]
+		if c3 < 0x80 || 0xC0 <= c3 {
+			return 0, 3 // Illegal UTF-8: not a continuation byte.
+		}
+		return t.lookupValue(uint32(i), c3), 4
+	}
+	// Illegal rune
+	return 0, 1
+}
+
+// lookupUnsafe returns the trie value for the first UTF-8 encoding in s.
+// s must start with a full and valid UTF-8 encoded rune.
+func (t *nfkcTrie) lookupUnsafe(s []byte) uint16 {
+	c0 := s[0]
+	if c0 < 0x80 { // is ASCII
+		return nfkcValues[c0]
+	}
+	i := nfkcIndex[c0]
+	if c0 < 0xE0 { // 2-byte UTF-8
+		return t.lookupValue(uint32(i), s[1])
+	}
+	i = nfkcIndex[uint32(i)<<6+uint32(s[1])]
+	if c0 < 0xF0 { // 3-byte UTF-8
+		return t.lookupValue(uint32(i), s[2])
+	}
+	i = nfkcIndex[uint32(i)<<6+uint32(s[2])]
+	if c0 < 0xF8 { // 4-byte UTF-8
+		return t.lookupValue(uint32(i), s[3])
+	}
+	return 0
+}
+
+// lookupString returns the trie value for the first UTF-8 encoding in s and
+// the width in bytes of this encoding. The size will be 0 if s does not
+// hold enough bytes to complete the encoding. len(s) must be greater than 0.
+func (t *nfkcTrie) lookupString(s string) (v uint16, sz int) {
+	c0 := s[0]
+	switch {
+	case c0 < 0x80: // is ASCII
+		return nfkcValues[c0], 1
+	case c0 < 0xC2:
+		return 0, 1 // Illegal UTF-8: not a starter, not ASCII.
+	case c0 < 0xE0: // 2-byte UTF-8
+		if len(s) < 2 {
+			return 0, 0
+		}
+		i := nfkcIndex[c0]
+		c1 := s[1]
+		if c1 < 0x80 || 0xC0 <= c1 {
+			return 0, 1 // Illegal UTF-8: not a continuation byte.
+		}
+		return t.lookupValue(uint32(i), c1), 2
+	case c0 < 0xF0: // 3-byte UTF-8
+		if len(s) < 3 {
+			return 0, 0
+		}
+		i := nfkcIndex[c0]
+		c1 := s[1]
+		if c1 < 0x80 || 0xC0 <= c1 {
+			return 0, 1 // Illegal UTF-8: not a continuation byte.
+		}
+		o := uint32(i)<<6 + uint32(c1)
+		i = nfkcIndex[o]
+		c2 := s[2]
+		if c2 < 0x80 || 0xC0 <= c2 {
+			return 0, 2 // Illegal UTF-8: not a continuation byte.
+		}
+		return t.lookupValue(uint32(i), c2), 3
+	case c0 < 0xF8: // 4-byte UTF-8
+		if len(s) < 4 {
+			return 0, 0
+		}
+		i := nfkcIndex[c0]
+		c1 := s[1]
+		if c1 < 0x80 || 0xC0 <= c1 {
+			return 0, 1 // Illegal UTF-8: not a continuation byte.
+		}
+		o := uint32(i)<<6 + uint32(c1)
+		i = nfkcIndex[o]
+		c2 := s[2]
+		if c2 < 0x80 || 0xC0 <= c2 {
+			return 0, 2 // Illegal UTF-8: not a continuation byte.
+		}
+		o = uint32(i)<<6 + uint32(c2)
+		i = nfkcIndex[o]
+		c3 := s[3]
+		if c3 < 0x80 || 0xC0 <= c3 {
+			return 0, 3 // Illegal UTF-8: not a continuation byte.
+		}
+		return t.lookupValue(uint32(i), c3), 4
+	}
+	// Illegal rune
+	return 0, 1
+}
+
+// lookupStringUnsafe returns the trie value for the first UTF-8 encoding in s.
+// s must start with a full and valid UTF-8 encoded rune.
+func (t *nfkcTrie) lookupStringUnsafe(s string) uint16 {
+	c0 := s[0]
+	if c0 < 0x80 { // is ASCII
+		return nfkcValues[c0]
+	}
+	i := nfkcIndex[c0]
+	if c0 < 0xE0 { // 2-byte UTF-8
+		return t.lookupValue(uint32(i), s[1])
+	}
+	i = nfkcIndex[uint32(i)<<6+uint32(s[1])]
+	if c0 < 0xF0 { // 3-byte UTF-8
+		return t.lookupValue(uint32(i), s[2])
+	}
+	i = nfkcIndex[uint32(i)<<6+uint32(s[2])]
+	if c0 < 0xF8 { // 4-byte UTF-8
+		return t.lookupValue(uint32(i), s[3])
+	}
+	return 0
+}
+
+// nfkcTrie. Total size: 19260 bytes (18.81 KiB). Checksum: 1a0bbc4c8c24da49.
+type nfkcTrie struct{}
+
+func newNfkcTrie(i int) *nfkcTrie {
+	return &nfkcTrie{}
+}
+
+// lookupValue determines the type of block n and looks up the value for b.
+func (t *nfkcTrie) lookupValue(n uint32, b byte) uint16 {
+	switch {
+	case n < 95:
+		return uint16(nfkcValues[n<<6+uint32(b)])
+	default:
+		n -= 95
+		return uint16(nfkcSparse.lookup(n, b))
+	}
+}
+
+// nfkcValues: 97 blocks, 6208 entries, 12416 bytes
+// The third block is the zero block.
+var nfkcValues = [6208]uint16{
+	// Block 0x0, offset 0x0
+	0x3c: 0xa000, 0x3d: 0xa000, 0x3e: 0xa000,
+	// Block 0x1, offset 0x40
+	0x41: 0xa000, 0x42: 0xa000, 0x43: 0xa000, 0x44: 0xa000, 0x45: 0xa000,
+	0x46: 0xa000, 0x47: 0xa000, 0x48: 0xa000, 0x49: 0xa000, 0x4a: 0xa000, 0x4b: 0xa000,
+	0x4c: 0xa000, 0x4d: 0xa000, 0x4e: 0xa000, 0x4f: 0xa000, 0x50: 0xa000,
+	0x52: 0xa000, 0x53: 0xa000, 0x54: 0xa000, 0x55: 0xa000, 0x56: 0xa000, 0x57: 0xa000,
+	0x58: 0xa000, 0x59: 0xa000, 0x5a: 0xa000,
+	0x61: 0xa000, 0x62: 0xa000, 0x63: 0xa000,
+	0x64: 0xa000, 0x65: 0xa000, 0x66: 0xa000, 0x67: 0xa000, 0x68: 0xa000, 0x69: 0xa000,
+	0x6a: 0xa000, 0x6b: 0xa000, 0x6c: 0xa000, 0x6d: 0xa000, 0x6e: 0xa000, 0x6f: 0xa000,
+	0x70: 0xa000, 0x72: 0xa000, 0x73: 0xa000, 0x74: 0xa000, 0x75: 0xa000,
+	0x76: 0xa000, 0x77: 0xa000, 0x78: 0xa000, 0x79: 0xa000, 0x7a: 0xa000,
+	// Block 0x2, offset 0x80
+	// Block 0x3, offset 0xc0
+	0xc0: 0x30b0, 0xc1: 0x30b5, 0xc2: 0x47c9, 0xc3: 0x30ba, 0xc4: 0x47d8, 0xc5: 0x47dd,
+	0xc6: 0xa000, 0xc7: 0x47e7, 0xc8: 0x3123, 0xc9: 0x3128, 0xca: 0x47ec, 0xcb: 0x313c,
+	0xcc: 0x31af, 0xcd: 0x31b4, 0xce: 0x31b9, 0xcf: 0x4800, 0xd1: 0x3245,
+	0xd2: 0x3268, 0xd3: 0x326d, 0xd4: 0x480a, 0xd5: 0x480f, 0xd6: 0x481e,
+	0xd8: 0xa000, 0xd9: 0x32f4, 0xda: 0x32f9, 0xdb: 0x32fe, 0xdc: 0x4850, 0xdd: 0x3376,
+	0xe0: 0x33bc, 0xe1: 0x33c1, 0xe2: 0x485a, 0xe3: 0x33c6,
+	0xe4: 0x4869, 0xe5: 0x486e, 0xe6: 0xa000, 0xe7: 0x4878, 0xe8: 0x342f, 0xe9: 0x3434,
+	0xea: 0x487d, 0xeb: 0x3448, 0xec: 0x34c0, 0xed: 0x34c5, 0xee: 0x34ca, 0xef: 0x4891,
+	0xf1: 0x3556, 0xf2: 0x3579, 0xf3: 0x357e, 0xf4: 0x489b, 0xf5: 0x48a0,
+	0xf6: 0x48af, 0xf8: 0xa000, 0xf9: 0x360a, 0xfa: 0x360f, 0xfb: 0x3614,
+	0xfc: 0x48e1, 0xfd: 0x3691, 0xff: 0x36aa,
+	// Block 0x4, offset 0x100
+	0x100: 0x30bf, 0x101: 0x33cb, 0x102: 0x47ce, 0x103: 0x485f, 0x104: 0x30dd, 0x105: 0x33e9,
+	0x106: 0x30f1, 0x107: 0x33fd, 0x108: 0x30f6, 0x109: 0x3402, 0x10a: 0x30fb, 0x10b: 0x3407,
+	0x10c: 0x3100, 0x10d: 0x340c, 0x10e: 0x310a, 0x10f: 0x3416,
+	0x112: 0x47f1, 0x113: 0x4882, 0x114: 0x3132, 0x115: 0x343e, 0x116: 0x3137, 0x117: 0x3443,
+	0x118: 0x3155, 0x119: 0x3461, 0x11a: 0x3146, 0x11b: 0x3452, 0x11c: 0x316e, 0x11d: 0x347a,
+	0x11e: 0x3178, 0x11f: 0x3484, 0x120: 0x317d, 0x121: 0x3489, 0x122: 0x3187, 0x123: 0x3493,
+	0x124: 0x318c, 0x125: 0x3498, 0x128: 0x31be, 0x129: 0x34cf,
+	0x12a: 0x31c3, 0x12b: 0x34d4, 0x12c: 0x31c8, 0x12d: 0x34d9, 0x12e: 0x31eb, 0x12f: 0x34f7,
+	0x130: 0x31cd, 0x132: 0x1a8a, 0x133: 0x1b17, 0x134: 0x31f5, 0x135: 0x3501,
+	0x136: 0x3209, 0x137: 0x351a, 0x139: 0x3213, 0x13a: 0x3524, 0x13b: 0x321d,
+	0x13c: 0x352e, 0x13d: 0x3218, 0x13e: 0x3529, 0x13f: 0x1cdc,
+	// Block 0x5, offset 0x140
+	0x140: 0x1d64, 0x143: 0x3240, 0x144: 0x3551, 0x145: 0x3259,
+	0x146: 0x356a, 0x147: 0x324f, 0x148: 0x3560, 0x149: 0x1d8c,
+	0x14c: 0x4814, 0x14d: 0x48a5, 0x14e: 0x3272, 0x14f: 0x3583, 0x150: 0x327c, 0x151: 0x358d,
+	0x154: 0x329a, 0x155: 0x35ab, 0x156: 0x32b3, 0x157: 0x35c4,
+	0x158: 0x32a4, 0x159: 0x35b5, 0x15a: 0x4837, 0x15b: 0x48c8, 0x15c: 0x32bd, 0x15d: 0x35ce,
+	0x15e: 0x32cc, 0x15f: 0x35dd, 0x160: 0x483c, 0x161: 0x48cd, 0x162: 0x32e5, 0x163: 0x35fb,
+	0x164: 0x32d6, 0x165: 0x35ec, 0x168: 0x4846, 0x169: 0x48d7,
+	0x16a: 0x484b, 0x16b: 0x48dc, 0x16c: 0x3303, 0x16d: 0x3619, 0x16e: 0x330d, 0x16f: 0x3623,
+	0x170: 0x3312, 0x171: 0x3628, 0x172: 0x3330, 0x173: 0x3646, 0x174: 0x3353, 0x175: 0x3669,
+	0x176: 0x337b, 0x177: 0x3696, 0x178: 0x338f, 0x179: 0x339e, 0x17a: 0x36be, 0x17b: 0x33a8,
+	0x17c: 0x36c8, 0x17d: 0x33ad, 0x17e: 0x36cd, 0x17f: 0x00a7,
+	// Block 0x6, offset 0x180
+	0x184: 0x2f2f, 0x185: 0x2f35,
+	0x186: 0x2f3b, 0x187: 0x1a9f, 0x188: 0x1aa2, 0x189: 0x1b38, 0x18a: 0x1ab7, 0x18b: 0x1aba,
+	0x18c: 0x1b6e, 0x18d: 0x30c9, 0x18e: 0x33d5, 0x18f: 0x31d7, 0x190: 0x34e3, 0x191: 0x3281,
+	0x192: 0x3592, 0x193: 0x3317, 0x194: 0x362d, 0x195: 0x3b10, 0x196: 0x3c9f, 0x197: 0x3b09,
+	0x198: 0x3c98, 0x199: 0x3b17, 0x19a: 0x3ca6, 0x19b: 0x3b02, 0x19c: 0x3c91,
+	0x19e: 0x39f1, 0x19f: 0x3b80, 0x1a0: 0x39ea, 0x1a1: 0x3b79, 0x1a2: 0x36f4, 0x1a3: 0x3706,
+	0x1a6: 0x3182, 0x1a7: 0x348e, 0x1a8: 0x31ff, 0x1a9: 0x3510,
+	0x1aa: 0x482d, 0x1ab: 0x48be, 0x1ac: 0x3ad1, 0x1ad: 0x3c60, 0x1ae: 0x3718, 0x1af: 0x371e,
+	0x1b0: 0x3506, 0x1b1: 0x1a6f, 0x1b2: 0x1a72, 0x1b3: 0x1aff, 0x1b4: 0x3169, 0x1b5: 0x3475,
+	0x1b8: 0x323b, 0x1b9: 0x354c, 0x1ba: 0x39f8, 0x1bb: 0x3b87,
+	0x1bc: 0x36ee, 0x1bd: 0x3700, 0x1be: 0x36fa, 0x1bf: 0x370c,
+	// Block 0x7, offset 0x1c0
+	0x1c0: 0x30ce, 0x1c1: 0x33da, 0x1c2: 0x30d3, 0x1c3: 0x33df, 0x1c4: 0x314b, 0x1c5: 0x3457,
+	0x1c6: 0x3150, 0x1c7: 0x345c, 0x1c8: 0x31dc, 0x1c9: 0x34e8, 0x1ca: 0x31e1, 0x1cb: 0x34ed,
+	0x1cc: 0x3286, 0x1cd: 0x3597, 0x1ce: 0x328b, 0x1cf: 0x359c, 0x1d0: 0x32a9, 0x1d1: 0x35ba,
+	0x1d2: 0x32ae, 0x1d3: 0x35bf, 0x1d4: 0x331c, 0x1d5: 0x3632, 0x1d6: 0x3321, 0x1d7: 0x3637,
+	0x1d8: 0x32c7, 0x1d9: 0x35d8, 0x1da: 0x32e0, 0x1db: 0x35f6,
+	0x1de: 0x319b, 0x1df: 0x34a7,
+	0x1e6: 0x47d3, 0x1e7: 0x4864, 0x1e8: 0x47fb, 0x1e9: 0x488c,
+	0x1ea: 0x3aa0, 0x1eb: 0x3c2f, 0x1ec: 0x3a7d, 0x1ed: 0x3c0c, 0x1ee: 0x4819, 0x1ef: 0x48aa,
+	0x1f0: 0x3a99, 0x1f1: 0x3c28, 0x1f2: 0x3385, 0x1f3: 0x36a0,
+	// Block 0x8, offset 0x200
+	0x200: 0x9933, 0x201: 0x9933, 0x202: 0x9933, 0x203: 0x9933, 0x204: 0x9933, 0x205: 0x8133,
+	0x206: 0x9933, 0x207: 0x9933, 0x208: 0x9933, 0x209: 0x9933, 0x20a: 0x9933, 0x20b: 0x9933,
+	0x20c: 0x9933, 0x20d: 0x8133, 0x20e: 0x8133, 0x20f: 0x9933, 0x210: 0x8133, 0x211: 0x9933,
+	0x212: 0x8133, 0x213: 0x9933, 0x214: 0x9933, 0x215: 0x8134, 0x216: 0x812e, 0x217: 0x812e,
+	0x218: 0x812e, 0x219: 0x812e, 0x21a: 0x8134, 0x21b: 0x992c, 0x21c: 0x812e, 0x21d: 0x812e,
+	0x21e: 0x812e, 0x21f: 0x812e, 0x220: 0x812e, 0x221: 0x812a, 0x222: 0x812a, 0x223: 0x992e,
+	0x224: 0x992e, 0x225: 0x992e, 0x226: 0x992e, 0x227: 0x992a, 0x228: 0x992a, 0x229: 0x812e,
+	0x22a: 0x812e, 0x22b: 0x812e, 0x22c: 0x812e, 0x22d: 0x992e, 0x22e: 0x992e, 0x22f: 0x812e,
+	0x230: 0x992e, 0x231: 0x992e, 0x232: 0x812e, 0x233: 0x812e, 0x234: 0x8101, 0x235: 0x8101,
+	0x236: 0x8101, 0x237: 0x8101, 0x238: 0x9901, 0x239: 0x812e, 0x23a: 0x812e, 0x23b: 0x812e,
+	0x23c: 0x812e, 0x23d: 0x8133, 0x23e: 0x8133, 0x23f: 0x8133,
+	// Block 0x9, offset 0x240
+	0x240: 0x4aef, 0x241: 0x4af4, 0x242: 0x9933, 0x243: 0x4af9, 0x244: 0x4bb2, 0x245: 0x9937,
+	0x246: 0x8133, 0x247: 0x812e, 0x248: 0x812e, 0x249: 0x812e, 0x24a: 0x8133, 0x24b: 0x8133,
+	0x24c: 0x8133, 0x24d: 0x812e, 0x24e: 0x812e, 0x250: 0x8133, 0x251: 0x8133,
+	0x252: 0x8133, 0x253: 0x812e, 0x254: 0x812e, 0x255: 0x812e, 0x256: 0x812e, 0x257: 0x8133,
+	0x258: 0x8134, 0x259: 0x812e, 0x25a: 0x812e, 0x25b: 0x8133, 0x25c: 0x8135, 0x25d: 0x8136,
+	0x25e: 0x8136, 0x25f: 0x8135, 0x260: 0x8136, 0x261: 0x8136, 0x262: 0x8135, 0x263: 0x8133,
+	0x264: 0x8133, 0x265: 0x8133, 0x266: 0x8133, 0x267: 0x8133, 0x268: 0x8133, 0x269: 0x8133,
+	0x26a: 0x8133, 0x26b: 0x8133, 0x26c: 0x8133, 0x26d: 0x8133, 0x26e: 0x8133, 0x26f: 0x8133,
+	0x274: 0x01ee,
+	0x27a: 0x43e6,
+	0x27e: 0x0037,
+	// Block 0xa, offset 0x280
+	0x284: 0x439b, 0x285: 0x45bc,
+	0x286: 0x372a, 0x287: 0x00ce, 0x288: 0x3748, 0x289: 0x3754, 0x28a: 0x3766,
+	0x28c: 0x3784, 0x28e: 0x3796, 0x28f: 0x37b4, 0x290: 0x3f49, 0x291: 0xa000,
+	0x295: 0xa000, 0x297: 0xa000,
+	0x299: 0xa000,
+	0x29f: 0xa000, 0x2a1: 0xa000,
+	0x2a5: 0xa000, 0x2a9: 0xa000,
+	0x2aa: 0x3778, 0x2ab: 0x37a8, 0x2ac: 0x493f, 0x2ad: 0x37d8, 0x2ae: 0x4969, 0x2af: 0x37ea,
+	0x2b0: 0x3fb1, 0x2b1: 0xa000, 0x2b5: 0xa000,
+	0x2b7: 0xa000, 0x2b9: 0xa000,
+	0x2bf: 0xa000,
+	// Block 0xb, offset 0x2c0
+	0x2c1: 0xa000, 0x2c5: 0xa000,
+	0x2c9: 0xa000, 0x2ca: 0x4981, 0x2cb: 0x499f,
+	0x2cc: 0x3808, 0x2cd: 0x3820, 0x2ce: 0x49b7, 0x2d0: 0x0242, 0x2d1: 0x0254,
+	0x2d2: 0x0230, 0x2d3: 0x444d, 0x2d4: 0x4453, 0x2d5: 0x027e, 0x2d6: 0x026c,
+	0x2f0: 0x025a, 0x2f1: 0x026f, 0x2f2: 0x0272, 0x2f4: 0x020c, 0x2f5: 0x024b,
+	0x2f9: 0x022a,
+	// Block 0xc, offset 0x300
+	0x300: 0x3862, 0x301: 0x386e, 0x303: 0x385c,
+	0x306: 0xa000, 0x307: 0x384a,
+	0x30c: 0x389e, 0x30d: 0x3886, 0x30e: 0x38b0, 0x310: 0xa000,
+	0x313: 0xa000, 0x315: 0xa000, 0x316: 0xa000, 0x317: 0xa000,
+	0x318: 0xa000, 0x319: 0x3892, 0x31a: 0xa000,
+	0x31e: 0xa000, 0x323: 0xa000,
+	0x327: 0xa000,
+	0x32b: 0xa000, 0x32d: 0xa000,
+	0x330: 0xa000, 0x333: 0xa000, 0x335: 0xa000,
+	0x336: 0xa000, 0x337: 0xa000, 0x338: 0xa000, 0x339: 0x3916, 0x33a: 0xa000,
+	0x33e: 0xa000,
+	// Block 0xd, offset 0x340
+	0x341: 0x3874, 0x342: 0x38f8,
+	0x350: 0x3850, 0x351: 0x38d4,
+	0x352: 0x3856, 0x353: 0x38da, 0x356: 0x3868, 0x357: 0x38ec,
+	0x358: 0xa000, 0x359: 0xa000, 0x35a: 0x396a, 0x35b: 0x3970, 0x35c: 0x387a, 0x35d: 0x38fe,
+	0x35e: 0x3880, 0x35f: 0x3904, 0x362: 0x388c, 0x363: 0x3910,
+	0x364: 0x3898, 0x365: 0x391c, 0x366: 0x38a4, 0x367: 0x3928, 0x368: 0xa000, 0x369: 0xa000,
+	0x36a: 0x3976, 0x36b: 0x397c, 0x36c: 0x38ce, 0x36d: 0x3952, 0x36e: 0x38aa, 0x36f: 0x392e,
+	0x370: 0x38b6, 0x371: 0x393a, 0x372: 0x38bc, 0x373: 0x3940, 0x374: 0x38c2, 0x375: 0x3946,
+	0x378: 0x38c8, 0x379: 0x394c,
+	// Block 0xe, offset 0x380
+	0x387: 0x1e91,
+	0x391: 0x812e,
+	0x392: 0x8133, 0x393: 0x8133, 0x394: 0x8133, 0x395: 0x8133, 0x396: 0x812e, 0x397: 0x8133,
+	0x398: 0x8133, 0x399: 0x8133, 0x39a: 0x812f, 0x39b: 0x812e, 0x39c: 0x8133, 0x39d: 0x8133,
+	0x39e: 0x8133, 0x39f: 0x8133, 0x3a0: 0x8133, 0x3a1: 0x8133, 0x3a2: 0x812e, 0x3a3: 0x812e,
+	0x3a4: 0x812e, 0x3a5: 0x812e, 0x3a6: 0x812e, 0x3a7: 0x812e, 0x3a8: 0x8133, 0x3a9: 0x8133,
+	0x3aa: 0x812e, 0x3ab: 0x8133, 0x3ac: 0x8133, 0x3ad: 0x812f, 0x3ae: 0x8132, 0x3af: 0x8133,
+	0x3b0: 0x8106, 0x3b1: 0x8107, 0x3b2: 0x8108, 0x3b3: 0x8109, 0x3b4: 0x810a, 0x3b5: 0x810b,
+	0x3b6: 0x810c, 0x3b7: 0x810d, 0x3b8: 0x810e, 0x3b9: 0x810f, 0x3ba: 0x810f, 0x3bb: 0x8110,
+	0x3bc: 0x8111, 0x3bd: 0x8112, 0x3bf: 0x8113,
+	// Block 0xf, offset 0x3c0
+	0x3c8: 0xa000, 0x3ca: 0xa000, 0x3cb: 0x8117,
+	0x3cc: 0x8118, 0x3cd: 0x8119, 0x3ce: 0x811a, 0x3cf: 0x811b, 0x3d0: 0x811c, 0x3d1: 0x811d,
+	0x3d2: 0x811e, 0x3d3: 0x9933, 0x3d4: 0x9933, 0x3d5: 0x992e, 0x3d6: 0x812e, 0x3d7: 0x8133,
+	0x3d8: 0x8133, 0x3d9: 0x8133, 0x3da: 0x8133, 0x3db: 0x8133, 0x3dc: 0x812e, 0x3dd: 0x8133,
+	0x3de: 0x8133, 0x3df: 0x812e,
+	0x3f0: 0x811f, 0x3f5: 0x1eb4,
+	0x3f6: 0x2143, 0x3f7: 0x217f, 0x3f8: 0x217a,
+	// Block 0x10, offset 0x400
+	0x40a: 0x8133, 0x40b: 0x8133,
+	0x40c: 0x8133, 0x40d: 0x8133, 0x40e: 0x8133, 0x40f: 0x812e, 0x410: 0x812e, 0x411: 0x812e,
+	0x412: 0x812e, 0x413: 0x812e, 0x414: 0x8133, 0x415: 0x8133, 0x416: 0x8133, 0x417: 0x8133,
+	0x418: 0x8133, 0x419: 0x8133, 0x41a: 0x8133, 0x41b: 0x8133, 0x41c: 0x8133, 0x41d: 0x8133,
+	0x41e: 0x8133, 0x41f: 0x8133, 0x420: 0x8133, 0x421: 0x8133, 0x423: 0x812e,
+	0x424: 0x8133, 0x425: 0x8133, 0x426: 0x812e, 0x427: 0x8133, 0x428: 0x8133, 0x429: 0x812e,
+	0x42a: 0x8133, 0x42b: 0x8133, 0x42c: 0x8133, 0x42d: 0x812e, 0x42e: 0x812e, 0x42f: 0x812e,
+	0x430: 0x8117, 0x431: 0x8118, 0x432: 0x8119, 0x433: 0x8133, 0x434: 0x8133, 0x435: 0x8133,
+	0x436: 0x812e, 0x437: 0x8133, 0x438: 0x8133, 0x439: 0x812e, 0x43a: 0x812e, 0x43b: 0x8133,
+	0x43c: 0x8133, 0x43d: 0x8133, 0x43e: 0x8133, 0x43f: 0x8133,
+	// Block 0x11, offset 0x440
+	0x445: 0xa000,
+	0x446: 0x2e5d, 0x447: 0xa000, 0x448: 0x2e65, 0x449: 0xa000, 0x44a: 0x2e6d, 0x44b: 0xa000,
+	0x44c: 0x2e75, 0x44d: 0xa000, 0x44e: 0x2e7d, 0x451: 0xa000,
+	0x452: 0x2e85,
+	0x474: 0x8103, 0x475: 0x9900,
+	0x47a: 0xa000, 0x47b: 0x2e8d,
+	0x47c: 0xa000, 0x47d: 0x2e95, 0x47e: 0xa000, 0x47f: 0xa000,
+	// Block 0x12, offset 0x480
+	0x480: 0x0069, 0x481: 0x006b, 0x482: 0x006f, 0x483: 0x0083, 0x484: 0x0104, 0x485: 0x0107,
+	0x486: 0x0506, 0x487: 0x0085, 0x488: 0x0089, 0x489: 0x008b, 0x48a: 0x011f, 0x48b: 0x0122,
+	0x48c: 0x0125, 0x48d: 0x008f, 0x48f: 0x0097, 0x490: 0x009b, 0x491: 0x00e6,
+	0x492: 0x009f, 0x493: 0x0110, 0x494: 0x050a, 0x495: 0x050e, 0x496: 0x00a1, 0x497: 0x00a9,
+	0x498: 0x00ab, 0x499: 0x0516, 0x49a: 0x015b, 0x49b: 0x00ad, 0x49c: 0x051a, 0x49d: 0x0242,
+	0x49e: 0x0245, 0x49f: 0x0248, 0x4a0: 0x027e, 0x4a1: 0x0281, 0x4a2: 0x0093, 0x4a3: 0x00a5,
+	0x4a4: 0x00ab, 0x4a5: 0x00ad, 0x4a6: 0x0242, 0x4a7: 0x0245, 0x4a8: 0x026f, 0x4a9: 0x027e,
+	0x4aa: 0x0281,
+	0x4b8: 0x02b4,
+	// Block 0x13, offset 0x4c0
+	0x4db: 0x010a, 0x4dc: 0x0087, 0x4dd: 0x0113,
+	0x4de: 0x00d7, 0x4df: 0x0125, 0x4e0: 0x008d, 0x4e1: 0x012b, 0x4e2: 0x0131, 0x4e3: 0x013d,
+	0x4e4: 0x0146, 0x4e5: 0x0149, 0x4e6: 0x014c, 0x4e7: 0x051e, 0x4e8: 0x01c7, 0x4e9: 0x0155,
+	0x4ea: 0x0522, 0x4eb: 0x01ca, 0x4ec: 0x0161, 0x4ed: 0x015e, 0x4ee: 0x0164, 0x4ef: 0x0167,
+	0x4f0: 0x016a, 0x4f1: 0x016d, 0x4f2: 0x0176, 0x4f3: 0x018e, 0x4f4: 0x0191, 0x4f5: 0x00f2,
+	0x4f6: 0x019a, 0x4f7: 0x019d, 0x4f8: 0x0512, 0x4f9: 0x01a0, 0x4fa: 0x01a3, 0x4fb: 0x00b5,
+	0x4fc: 0x01af, 0x4fd: 0x01b2, 0x4fe: 0x01b5, 0x4ff: 0x0254,
+	// Block 0x14, offset 0x500
+	0x500: 0x8133, 0x501: 0x8133, 0x502: 0x812e, 0x503: 0x8133, 0x504: 0x8133, 0x505: 0x8133,
+	0x506: 0x8133, 0x507: 0x8133, 0x508: 0x8133, 0x509: 0x8133, 0x50a: 0x812e, 0x50b: 0x8133,
+	0x50c: 0x8133, 0x50d: 0x8136, 0x50e: 0x812b, 0x50f: 0x812e, 0x510: 0x812a, 0x511: 0x8133,
+	0x512: 0x8133, 0x513: 0x8133, 0x514: 0x8133, 0x515: 0x8133, 0x516: 0x8133, 0x517: 0x8133,
+	0x518: 0x8133, 0x519: 0x8133, 0x51a: 0x8133, 0x51b: 0x8133, 0x51c: 0x8133, 0x51d: 0x8133,
+	0x51e: 0x8133, 0x51f: 0x8133, 0x520: 0x8133, 0x521: 0x8133, 0x522: 0x8133, 0x523: 0x8133,
+	0x524: 0x8133, 0x525: 0x8133, 0x526: 0x8133, 0x527: 0x8133, 0x528: 0x8133, 0x529: 0x8133,
+	0x52a: 0x8133, 0x52b: 0x8133, 0x52c: 0x8133, 0x52d: 0x8133, 0x52e: 0x8133, 0x52f: 0x8133,
+	0x530: 0x8133, 0x531: 0x8133, 0x532: 0x8133, 0x533: 0x8133, 0x534: 0x8133, 0x535: 0x8133,
+	0x536: 0x8134, 0x537: 0x8132, 0x538: 0x8132, 0x539: 0x812e, 0x53a: 0x812d, 0x53b: 0x8133,
+	0x53c: 0x8135, 0x53d: 0x812e, 0x53e: 0x8133, 0x53f: 0x812e,
+	// Block 0x15, offset 0x540
+	0x540: 0x30d8, 0x541: 0x33e4, 0x542: 0x30e2, 0x543: 0x33ee, 0x544: 0x30e7, 0x545: 0x33f3,
+	0x546: 0x30ec, 0x547: 0x33f8, 0x548: 0x3a0d, 0x549: 0x3b9c, 0x54a: 0x3105, 0x54b: 0x3411,
+	0x54c: 0x310f, 0x54d: 0x341b, 0x54e: 0x311e, 0x54f: 0x342a, 0x550: 0x3114, 0x551: 0x3420,
+	0x552: 0x3119, 0x553: 0x3425, 0x554: 0x3a30, 0x555: 0x3bbf, 0x556: 0x3a37, 0x557: 0x3bc6,
+	0x558: 0x315a, 0x559: 0x3466, 0x55a: 0x315f, 0x55b: 0x346b, 0x55c: 0x3a45, 0x55d: 0x3bd4,
+	0x55e: 0x3164, 0x55f: 0x3470, 0x560: 0x3173, 0x561: 0x347f, 0x562: 0x3191, 0x563: 0x349d,
+	0x564: 0x31a0, 0x565: 0x34ac, 0x566: 0x3196, 0x567: 0x34a2, 0x568: 0x31a5, 0x569: 0x34b1,
+	0x56a: 0x31aa, 0x56b: 0x34b6, 0x56c: 0x31f0, 0x56d: 0x34fc, 0x56e: 0x3a4c, 0x56f: 0x3bdb,
+	0x570: 0x31fa, 0x571: 0x350b, 0x572: 0x3204, 0x573: 0x3515, 0x574: 0x320e, 0x575: 0x351f,
+	0x576: 0x4805, 0x577: 0x4896, 0x578: 0x3a53, 0x579: 0x3be2, 0x57a: 0x3227, 0x57b: 0x3538,
+	0x57c: 0x3222, 0x57d: 0x3533, 0x57e: 0x322c, 0x57f: 0x353d,
+	// Block 0x16, offset 0x580
+	0x580: 0x3231, 0x581: 0x3542, 0x582: 0x3236, 0x583: 0x3547, 0x584: 0x324a, 0x585: 0x355b,
+	0x586: 0x3254, 0x587: 0x3565, 0x588: 0x3263, 0x589: 0x3574, 0x58a: 0x325e, 0x58b: 0x356f,
+	0x58c: 0x3a76, 0x58d: 0x3c05, 0x58e: 0x3a84, 0x58f: 0x3c13, 0x590: 0x3a8b, 0x591: 0x3c1a,
+	0x592: 0x3a92, 0x593: 0x3c21, 0x594: 0x3290, 0x595: 0x35a1, 0x596: 0x3295, 0x597: 0x35a6,
+	0x598: 0x329f, 0x599: 0x35b0, 0x59a: 0x4832, 0x59b: 0x48c3, 0x59c: 0x3ad8, 0x59d: 0x3c67,
+	0x59e: 0x32b8, 0x59f: 0x35c9, 0x5a0: 0x32c2, 0x5a1: 0x35d3, 0x5a2: 0x4841, 0x5a3: 0x48d2,
+	0x5a4: 0x3adf, 0x5a5: 0x3c6e, 0x5a6: 0x3ae6, 0x5a7: 0x3c75, 0x5a8: 0x3aed, 0x5a9: 0x3c7c,
+	0x5aa: 0x32d1, 0x5ab: 0x35e2, 0x5ac: 0x32db, 0x5ad: 0x35f1, 0x5ae: 0x32ef, 0x5af: 0x3605,
+	0x5b0: 0x32ea, 0x5b1: 0x3600, 0x5b2: 0x332b, 0x5b3: 0x3641, 0x5b4: 0x333a, 0x5b5: 0x3650,
+	0x5b6: 0x3335, 0x5b7: 0x364b, 0x5b8: 0x3af4, 0x5b9: 0x3c83, 0x5ba: 0x3afb, 0x5bb: 0x3c8a,
+	0x5bc: 0x333f, 0x5bd: 0x3655, 0x5be: 0x3344, 0x5bf: 0x365a,
+	// Block 0x17, offset 0x5c0
+	0x5c0: 0x3349, 0x5c1: 0x365f, 0x5c2: 0x334e, 0x5c3: 0x3664, 0x5c4: 0x335d, 0x5c5: 0x3673,
+	0x5c6: 0x3358, 0x5c7: 0x366e, 0x5c8: 0x3362, 0x5c9: 0x367d, 0x5ca: 0x3367, 0x5cb: 0x3682,
+	0x5cc: 0x336c, 0x5cd: 0x3687, 0x5ce: 0x338a, 0x5cf: 0x36a5, 0x5d0: 0x33a3, 0x5d1: 0x36c3,
+	0x5d2: 0x33b2, 0x5d3: 0x36d2, 0x5d4: 0x33b7, 0x5d5: 0x36d7, 0x5d6: 0x34bb, 0x5d7: 0x35e7,
+	0x5d8: 0x3678, 0x5d9: 0x36b4, 0x5da: 0x1d10, 0x5db: 0x4418,
+	0x5e0: 0x47e2, 0x5e1: 0x4873, 0x5e2: 0x30c4, 0x5e3: 0x33d0,
+	0x5e4: 0x39b9, 0x5e5: 0x3b48, 0x5e6: 0x39b2, 0x5e7: 0x3b41, 0x5e8: 0x39c7, 0x5e9: 0x3b56,
+	0x5ea: 0x39c0, 0x5eb: 0x3b4f, 0x5ec: 0x39ff, 0x5ed: 0x3b8e, 0x5ee: 0x39d5, 0x5ef: 0x3b64,
+	0x5f0: 0x39ce, 0x5f1: 0x3b5d, 0x5f2: 0x39e3, 0x5f3: 0x3b72, 0x5f4: 0x39dc, 0x5f5: 0x3b6b,
+	0x5f6: 0x3a06, 0x5f7: 0x3b95, 0x5f8: 0x47f6, 0x5f9: 0x4887, 0x5fa: 0x3141, 0x5fb: 0x344d,
+	0x5fc: 0x312d, 0x5fd: 0x3439, 0x5fe: 0x3a1b, 0x5ff: 0x3baa,
+	// Block 0x18, offset 0x600
+	0x600: 0x3a14, 0x601: 0x3ba3, 0x602: 0x3a29, 0x603: 0x3bb8, 0x604: 0x3a22, 0x605: 0x3bb1,
+	0x606: 0x3a3e, 0x607: 0x3bcd, 0x608: 0x31d2, 0x609: 0x34de, 0x60a: 0x31e6, 0x60b: 0x34f2,
+	0x60c: 0x4828, 0x60d: 0x48b9, 0x60e: 0x3277, 0x60f: 0x3588, 0x610: 0x3a61, 0x611: 0x3bf0,
+	0x612: 0x3a5a, 0x613: 0x3be9, 0x614: 0x3a6f, 0x615: 0x3bfe, 0x616: 0x3a68, 0x617: 0x3bf7,
+	0x618: 0x3aca, 0x619: 0x3c59, 0x61a: 0x3aae, 0x61b: 0x3c3d, 0x61c: 0x3aa7, 0x61d: 0x3c36,
+	0x61e: 0x3abc, 0x61f: 0x3c4b, 0x620: 0x3ab5, 0x621: 0x3c44, 0x622: 0x3ac3, 0x623: 0x3c52,
+	0x624: 0x3326, 0x625: 0x363c, 0x626: 0x3308, 0x627: 0x361e, 0x628: 0x3b25, 0x629: 0x3cb4,
+	0x62a: 0x3b1e, 0x62b: 0x3cad, 0x62c: 0x3b33, 0x62d: 0x3cc2, 0x62e: 0x3b2c, 0x62f: 0x3cbb,
+	0x630: 0x3b3a, 0x631: 0x3cc9, 0x632: 0x3371, 0x633: 0x368c, 0x634: 0x3399, 0x635: 0x36b9,
+	0x636: 0x3394, 0x637: 0x36af, 0x638: 0x3380, 0x639: 0x369b,
+	// Block 0x19, offset 0x640
+	0x640: 0x4945, 0x641: 0x494b, 0x642: 0x4a5f, 0x643: 0x4a77, 0x644: 0x4a67, 0x645: 0x4a7f,
+	0x646: 0x4a6f, 0x647: 0x4a87, 0x648: 0x48eb, 0x649: 0x48f1, 0x64a: 0x49cf, 0x64b: 0x49e7,
+	0x64c: 0x49d7, 0x64d: 0x49ef, 0x64e: 0x49df, 0x64f: 0x49f7, 0x650: 0x4957, 0x651: 0x495d,
+	0x652: 0x3ef9, 0x653: 0x3f09, 0x654: 0x3f01, 0x655: 0x3f11,
+	0x658: 0x48f7, 0x659: 0x48fd, 0x65a: 0x3e29, 0x65b: 0x3e39, 0x65c: 0x3e31, 0x65d: 0x3e41,
+	0x660: 0x496f, 0x661: 0x4975, 0x662: 0x4a8f, 0x663: 0x4aa7,
+	0x664: 0x4a97, 0x665: 0x4aaf, 0x666: 0x4a9f, 0x667: 0x4ab7, 0x668: 0x4903, 0x669: 0x4909,
+	0x66a: 0x49ff, 0x66b: 0x4a17, 0x66c: 0x4a07, 0x66d: 0x4a1f, 0x66e: 0x4a0f, 0x66f: 0x4a27,
+	0x670: 0x4987, 0x671: 0x498d, 0x672: 0x3f59, 0x673: 0x3f71, 0x674: 0x3f61, 0x675: 0x3f79,
+	0x676: 0x3f69, 0x677: 0x3f81, 0x678: 0x490f, 0x679: 0x4915, 0x67a: 0x3e59, 0x67b: 0x3e71,
+	0x67c: 0x3e61, 0x67d: 0x3e79, 0x67e: 0x3e69, 0x67f: 0x3e81,
+	// Block 0x1a, offset 0x680
+	0x680: 0x4993, 0x681: 0x4999, 0x682: 0x3f89, 0x683: 0x3f99, 0x684: 0x3f91, 0x685: 0x3fa1,
+	0x688: 0x491b, 0x689: 0x4921, 0x68a: 0x3e89, 0x68b: 0x3e99,
+	0x68c: 0x3e91, 0x68d: 0x3ea1, 0x690: 0x49a5, 0x691: 0x49ab,
+	0x692: 0x3fc1, 0x693: 0x3fd9, 0x694: 0x3fc9, 0x695: 0x3fe1, 0x696: 0x3fd1, 0x697: 0x3fe9,
+	0x699: 0x4927, 0x69b: 0x3ea9, 0x69d: 0x3eb1,
+	0x69f: 0x3eb9, 0x6a0: 0x49bd, 0x6a1: 0x49c3, 0x6a2: 0x4abf, 0x6a3: 0x4ad7,
+	0x6a4: 0x4ac7, 0x6a5: 0x4adf, 0x6a6: 0x4acf, 0x6a7: 0x4ae7, 0x6a8: 0x492d, 0x6a9: 0x4933,
+	0x6aa: 0x4a2f, 0x6ab: 0x4a47, 0x6ac: 0x4a37, 0x6ad: 0x4a4f, 0x6ae: 0x4a3f, 0x6af: 0x4a57,
+	0x6b0: 0x4939, 0x6b1: 0x445f, 0x6b2: 0x37d2, 0x6b3: 0x4465, 0x6b4: 0x4963, 0x6b5: 0x446b,
+	0x6b6: 0x37e4, 0x6b7: 0x4471, 0x6b8: 0x3802, 0x6b9: 0x4477, 0x6ba: 0x381a, 0x6bb: 0x447d,
+	0x6bc: 0x49b1, 0x6bd: 0x4483,
+	// Block 0x1b, offset 0x6c0
+	0x6c0: 0x3ee1, 0x6c1: 0x3ee9, 0x6c2: 0x42c5, 0x6c3: 0x42e3, 0x6c4: 0x42cf, 0x6c5: 0x42ed,
+	0x6c6: 0x42d9, 0x6c7: 0x42f7, 0x6c8: 0x3e19, 0x6c9: 0x3e21, 0x6ca: 0x4211, 0x6cb: 0x422f,
+	0x6cc: 0x421b, 0x6cd: 0x4239, 0x6ce: 0x4225, 0x6cf: 0x4243, 0x6d0: 0x3f29, 0x6d1: 0x3f31,
+	0x6d2: 0x4301, 0x6d3: 0x431f, 0x6d4: 0x430b, 0x6d5: 0x4329, 0x6d6: 0x4315, 0x6d7: 0x4333,
+	0x6d8: 0x3e49, 0x6d9: 0x3e51, 0x6da: 0x424d, 0x6db: 0x426b, 0x6dc: 0x4257, 0x6dd: 0x4275,
+	0x6de: 0x4261, 0x6df: 0x427f, 0x6e0: 0x4001, 0x6e1: 0x4009, 0x6e2: 0x433d, 0x6e3: 0x435b,
+	0x6e4: 0x4347, 0x6e5: 0x4365, 0x6e6: 0x4351, 0x6e7: 0x436f, 0x6e8: 0x3ec1, 0x6e9: 0x3ec9,
+	0x6ea: 0x4289, 0x6eb: 0x42a7, 0x6ec: 0x4293, 0x6ed: 0x42b1, 0x6ee: 0x429d, 0x6ef: 0x42bb,
+	0x6f0: 0x37c6, 0x6f1: 0x37c0, 0x6f2: 0x3ed1, 0x6f3: 0x37cc, 0x6f4: 0x3ed9,
+	0x6f6: 0x4951, 0x6f7: 0x3ef1, 0x6f8: 0x3736, 0x6f9: 0x3730, 0x6fa: 0x3724, 0x6fb: 0x442f,
+	0x6fc: 0x373c, 0x6fd: 0x43c8, 0x6fe: 0x0257, 0x6ff: 0x43c8,
+	// Block 0x1c, offset 0x700
+	0x700: 0x43e1, 0x701: 0x45c3, 0x702: 0x3f19, 0x703: 0x37de, 0x704: 0x3f21,
+	0x706: 0x497b, 0x707: 0x3f39, 0x708: 0x3742, 0x709: 0x4435, 0x70a: 0x374e, 0x70b: 0x443b,
+	0x70c: 0x375a, 0x70d: 0x45ca, 0x70e: 0x45d1, 0x70f: 0x45d8, 0x710: 0x37f6, 0x711: 0x37f0,
+	0x712: 0x3f41, 0x713: 0x4625, 0x716: 0x37fc, 0x717: 0x3f51,
+	0x718: 0x3772, 0x719: 0x376c, 0x71a: 0x3760, 0x71b: 0x4441, 0x71d: 0x45df,
+	0x71e: 0x45e6, 0x71f: 0x45ed, 0x720: 0x382c, 0x721: 0x3826, 0x722: 0x3fa9, 0x723: 0x462d,
+	0x724: 0x380e, 0x725: 0x3814, 0x726: 0x3832, 0x727: 0x3fb9, 0x728: 0x37a2, 0x729: 0x379c,
+	0x72a: 0x3790, 0x72b: 0x444d, 0x72c: 0x378a, 0x72d: 0x45b5, 0x72e: 0x45bc, 0x72f: 0x0081,
+	0x732: 0x3ff1, 0x733: 0x3838, 0x734: 0x3ff9,
+	0x736: 0x49c9, 0x737: 0x4011, 0x738: 0x377e, 0x739: 0x4447, 0x73a: 0x37ae, 0x73b: 0x4459,
+	0x73c: 0x37ba, 0x73d: 0x439b, 0x73e: 0x43cd,
+	// Block 0x1d, offset 0x740
+	0x740: 0x1d08, 0x741: 0x1d0c, 0x742: 0x0047, 0x743: 0x1d84, 0x745: 0x1d18,
+	0x746: 0x1d1c, 0x747: 0x00ef, 0x749: 0x1d88, 0x74a: 0x008f, 0x74b: 0x0051,
+	0x74c: 0x0051, 0x74d: 0x0051, 0x74e: 0x0091, 0x74f: 0x00e0, 0x750: 0x0053, 0x751: 0x0053,
+	0x752: 0x0059, 0x753: 0x0099, 0x755: 0x005d, 0x756: 0x1abd,
+	0x759: 0x0061, 0x75a: 0x0063, 0x75b: 0x0065, 0x75c: 0x0065, 0x75d: 0x0065,
+	0x760: 0x1acf, 0x761: 0x1cf8, 0x762: 0x1ad8,
+	0x764: 0x0075, 0x766: 0x023c, 0x768: 0x0075,
+	0x76a: 0x0057, 0x76b: 0x4413, 0x76c: 0x0045, 0x76d: 0x0047, 0x76f: 0x008b,
+	0x770: 0x004b, 0x771: 0x004d, 0x773: 0x005b, 0x774: 0x009f, 0x775: 0x0308,
+	0x776: 0x030b, 0x777: 0x030e, 0x778: 0x0311, 0x779: 0x0093, 0x77b: 0x1cc8,
+	0x77c: 0x026c, 0x77d: 0x0245, 0x77e: 0x01fd, 0x77f: 0x0224,
+	// Block 0x1e, offset 0x780
+	0x780: 0x055a, 0x785: 0x0049,
+	0x786: 0x0089, 0x787: 0x008b, 0x788: 0x0093, 0x789: 0x0095,
+	0x790: 0x235e, 0x791: 0x236a,
+	0x792: 0x241e, 0x793: 0x2346, 0x794: 0x23ca, 0x795: 0x2352, 0x796: 0x23d0, 0x797: 0x23e8,
+	0x798: 0x23f4, 0x799: 0x2358, 0x79a: 0x23fa, 0x79b: 0x2364, 0x79c: 0x23ee, 0x79d: 0x2400,
+	0x79e: 0x2406, 0x79f: 0x1dec, 0x7a0: 0x0053, 0x7a1: 0x1a87, 0x7a2: 0x1cd4, 0x7a3: 0x1a90,
+	0x7a4: 0x006d, 0x7a5: 0x1adb, 0x7a6: 0x1d00, 0x7a7: 0x1e78, 0x7a8: 0x1a93, 0x7a9: 0x0071,
+	0x7aa: 0x1ae7, 0x7ab: 0x1d04, 0x7ac: 0x0059, 0x7ad: 0x0047, 0x7ae: 0x0049, 0x7af: 0x005b,
+	0x7b0: 0x0093, 0x7b1: 0x1b14, 0x7b2: 0x1d48, 0x7b3: 0x1b1d, 0x7b4: 0x00ad, 0x7b5: 0x1b92,
+	0x7b6: 0x1d7c, 0x7b7: 0x1e8c, 0x7b8: 0x1b20, 0x7b9: 0x00b1, 0x7ba: 0x1b95, 0x7bb: 0x1d80,
+	0x7bc: 0x0099, 0x7bd: 0x0087, 0x7be: 0x0089, 0x7bf: 0x009b,
+	// Block 0x1f, offset 0x7c0
+	0x7c1: 0x3d47, 0x7c3: 0xa000, 0x7c4: 0x3d4e, 0x7c5: 0xa000,
+	0x7c7: 0x3d55, 0x7c8: 0xa000, 0x7c9: 0x3d5c,
+	0x7cd: 0xa000,
+	0x7e0: 0x30a6, 0x7e1: 0xa000, 0x7e2: 0x3d6a,
+	0x7e4: 0xa000, 0x7e5: 0xa000,
+	0x7ed: 0x3d63, 0x7ee: 0x30a1, 0x7ef: 0x30ab,
+	0x7f0: 0x3d71, 0x7f1: 0x3d78, 0x7f2: 0xa000, 0x7f3: 0xa000, 0x7f4: 0x3d7f, 0x7f5: 0x3d86,
+	0x7f6: 0xa000, 0x7f7: 0xa000, 0x7f8: 0x3d8d, 0x7f9: 0x3d94, 0x7fa: 0xa000, 0x7fb: 0xa000,
+	0x7fc: 0xa000, 0x7fd: 0xa000,
+	// Block 0x20, offset 0x800
+	0x800: 0x3d9b, 0x801: 0x3da2, 0x802: 0xa000, 0x803: 0xa000, 0x804: 0x3db7, 0x805: 0x3dbe,
+	0x806: 0xa000, 0x807: 0xa000, 0x808: 0x3dc5, 0x809: 0x3dcc,
+	0x811: 0xa000,
+	0x812: 0xa000,
+	0x822: 0xa000,
+	0x828: 0xa000, 0x829: 0xa000,
+	0x82b: 0xa000, 0x82c: 0x3de1, 0x82d: 0x3de8, 0x82e: 0x3def, 0x82f: 0x3df6,
+	0x832: 0xa000, 0x833: 0xa000, 0x834: 0xa000, 0x835: 0xa000,
+	// Block 0x21, offset 0x840
+	0x860: 0x0023, 0x861: 0x0025, 0x862: 0x0027, 0x863: 0x0029,
+	0x864: 0x002b, 0x865: 0x002d, 0x866: 0x002f, 0x867: 0x0031, 0x868: 0x0033, 0x869: 0x19af,
+	0x86a: 0x19b2, 0x86b: 0x19b5, 0x86c: 0x19b8, 0x86d: 0x19bb, 0x86e: 0x19be, 0x86f: 0x19c1,
+	0x870: 0x19c4, 0x871: 0x19c7, 0x872: 0x19ca, 0x873: 0x19d3, 0x874: 0x1b98, 0x875: 0x1b9c,
+	0x876: 0x1ba0, 0x877: 0x1ba4, 0x878: 0x1ba8, 0x879: 0x1bac, 0x87a: 0x1bb0, 0x87b: 0x1bb4,
+	0x87c: 0x1bb8, 0x87d: 0x1db0, 0x87e: 0x1db5, 0x87f: 0x1dba,
+	// Block 0x22, offset 0x880
+	0x880: 0x1dbf, 0x881: 0x1dc4, 0x882: 0x1dc9, 0x883: 0x1dce, 0x884: 0x1dd3, 0x885: 0x1dd8,
+	0x886: 0x1ddd, 0x887: 0x1de2, 0x888: 0x19ac, 0x889: 0x19d0, 0x88a: 0x19f4, 0x88b: 0x1a18,
+	0x88c: 0x1a3c, 0x88d: 0x1a45, 0x88e: 0x1a4b, 0x88f: 0x1a51, 0x890: 0x1a57, 0x891: 0x1c90,
+	0x892: 0x1c94, 0x893: 0x1c98, 0x894: 0x1c9c, 0x895: 0x1ca0, 0x896: 0x1ca4, 0x897: 0x1ca8,
+	0x898: 0x1cac, 0x899: 0x1cb0, 0x89a: 0x1cb4, 0x89b: 0x1cb8, 0x89c: 0x1c24, 0x89d: 0x1c28,
+	0x89e: 0x1c2c, 0x89f: 0x1c30, 0x8a0: 0x1c34, 0x8a1: 0x1c38, 0x8a2: 0x1c3c, 0x8a3: 0x1c40,
+	0x8a4: 0x1c44, 0x8a5: 0x1c48, 0x8a6: 0x1c4c, 0x8a7: 0x1c50, 0x8a8: 0x1c54, 0x8a9: 0x1c58,
+	0x8aa: 0x1c5c, 0x8ab: 0x1c60, 0x8ac: 0x1c64, 0x8ad: 0x1c68, 0x8ae: 0x1c6c, 0x8af: 0x1c70,
+	0x8b0: 0x1c74, 0x8b1: 0x1c78, 0x8b2: 0x1c7c, 0x8b3: 0x1c80, 0x8b4: 0x1c84, 0x8b5: 0x1c88,
+	0x8b6: 0x0043, 0x8b7: 0x0045, 0x8b8: 0x0047, 0x8b9: 0x0049, 0x8ba: 0x004b, 0x8bb: 0x004d,
+	0x8bc: 0x004f, 0x8bd: 0x0051, 0x8be: 0x0053, 0x8bf: 0x0055,
+	// Block 0x23, offset 0x8c0
+	0x8c0: 0x07ba, 0x8c1: 0x07de, 0x8c2: 0x07ea, 0x8c3: 0x07fa, 0x8c4: 0x0802, 0x8c5: 0x080e,
+	0x8c6: 0x0816, 0x8c7: 0x081e, 0x8c8: 0x082a, 0x8c9: 0x087e, 0x8ca: 0x0896, 0x8cb: 0x08a6,
+	0x8cc: 0x08b6, 0x8cd: 0x08c6, 0x8ce: 0x08d6, 0x8cf: 0x08f6, 0x8d0: 0x08fa, 0x8d1: 0x08fe,
+	0x8d2: 0x0932, 0x8d3: 0x095a, 0x8d4: 0x096a, 0x8d5: 0x0972, 0x8d6: 0x0976, 0x8d7: 0x0982,
+	0x8d8: 0x099e, 0x8d9: 0x09a2, 0x8da: 0x09ba, 0x8db: 0x09be, 0x8dc: 0x09c6, 0x8dd: 0x09d6,
+	0x8de: 0x0a72, 0x8df: 0x0a86, 0x8e0: 0x0ac6, 0x8e1: 0x0ada, 0x8e2: 0x0ae2, 0x8e3: 0x0ae6,
+	0x8e4: 0x0af6, 0x8e5: 0x0b12, 0x8e6: 0x0b3e, 0x8e7: 0x0b4a, 0x8e8: 0x0b6a, 0x8e9: 0x0b76,
+	0x8ea: 0x0b7a, 0x8eb: 0x0b7e, 0x8ec: 0x0b96, 0x8ed: 0x0b9a, 0x8ee: 0x0bc6, 0x8ef: 0x0bd2,
+	0x8f0: 0x0bda, 0x8f1: 0x0be2, 0x8f2: 0x0bf2, 0x8f3: 0x0bfa, 0x8f4: 0x0c02, 0x8f5: 0x0c2e,
+	0x8f6: 0x0c32, 0x8f7: 0x0c3a, 0x8f8: 0x0c3e, 0x8f9: 0x0c46, 0x8fa: 0x0c4e, 0x8fb: 0x0c5e,
+	0x8fc: 0x0c7a, 0x8fd: 0x0cf2, 0x8fe: 0x0d06, 0x8ff: 0x0d0a,
+	// Block 0x24, offset 0x900
+	0x900: 0x0d8a, 0x901: 0x0d8e, 0x902: 0x0da2, 0x903: 0x0da6, 0x904: 0x0dae, 0x905: 0x0db6,
+	0x906: 0x0dbe, 0x907: 0x0dca, 0x908: 0x0df2, 0x909: 0x0e02, 0x90a: 0x0e16, 0x90b: 0x0e86,
+	0x90c: 0x0e92, 0x90d: 0x0ea2, 0x90e: 0x0eae, 0x90f: 0x0eba, 0x910: 0x0ec2, 0x911: 0x0ec6,
+	0x912: 0x0eca, 0x913: 0x0ece, 0x914: 0x0ed2, 0x915: 0x0f8a, 0x916: 0x0fd2, 0x917: 0x0fde,
+	0x918: 0x0fe2, 0x919: 0x0fe6, 0x91a: 0x0fea, 0x91b: 0x0ff2, 0x91c: 0x0ff6, 0x91d: 0x100a,
+	0x91e: 0x1026, 0x91f: 0x102e, 0x920: 0x106e, 0x921: 0x1072, 0x922: 0x107a, 0x923: 0x107e,
+	0x924: 0x1086, 0x925: 0x108a, 0x926: 0x10ae, 0x927: 0x10b2, 0x928: 0x10ce, 0x929: 0x10d2,
+	0x92a: 0x10d6, 0x92b: 0x10da, 0x92c: 0x10ee, 0x92d: 0x1112, 0x92e: 0x1116, 0x92f: 0x111a,
+	0x930: 0x113e, 0x931: 0x117e, 0x932: 0x1182, 0x933: 0x11a2, 0x934: 0x11b2, 0x935: 0x11ba,
+	0x936: 0x11da, 0x937: 0x11fe, 0x938: 0x1242, 0x939: 0x124a, 0x93a: 0x125e, 0x93b: 0x126a,
+	0x93c: 0x1272, 0x93d: 0x127a, 0x93e: 0x127e, 0x93f: 0x1282,
+	// Block 0x25, offset 0x940
+	0x940: 0x129a, 0x941: 0x129e, 0x942: 0x12ba, 0x943: 0x12c2, 0x944: 0x12ca, 0x945: 0x12ce,
+	0x946: 0x12da, 0x947: 0x12e2, 0x948: 0x12e6, 0x949: 0x12ea, 0x94a: 0x12f2, 0x94b: 0x12f6,
+	0x94c: 0x1396, 0x94d: 0x13aa, 0x94e: 0x13de, 0x94f: 0x13e2, 0x950: 0x13ea, 0x951: 0x1416,
+	0x952: 0x141e, 0x953: 0x1426, 0x954: 0x142e, 0x955: 0x146a, 0x956: 0x146e, 0x957: 0x1476,
+	0x958: 0x147a, 0x959: 0x147e, 0x95a: 0x14aa, 0x95b: 0x14ae, 0x95c: 0x14b6, 0x95d: 0x14ca,
+	0x95e: 0x14ce, 0x95f: 0x14ea, 0x960: 0x14f2, 0x961: 0x14f6, 0x962: 0x151a, 0x963: 0x153a,
+	0x964: 0x154e, 0x965: 0x1552, 0x966: 0x155a, 0x967: 0x1586, 0x968: 0x158a, 0x969: 0x159a,
+	0x96a: 0x15be, 0x96b: 0x15ca, 0x96c: 0x15da, 0x96d: 0x15f2, 0x96e: 0x15fa, 0x96f: 0x15fe,
+	0x970: 0x1602, 0x971: 0x1606, 0x972: 0x1612, 0x973: 0x1616, 0x974: 0x161e, 0x975: 0x163a,
+	0x976: 0x163e, 0x977: 0x1642, 0x978: 0x165a, 0x979: 0x165e, 0x97a: 0x1666, 0x97b: 0x167a,
+	0x97c: 0x167e, 0x97d: 0x1682, 0x97e: 0x168a, 0x97f: 0x168e,
+	// Block 0x26, offset 0x980
+	0x986: 0xa000, 0x98b: 0xa000,
+	0x98c: 0x4049, 0x98d: 0xa000, 0x98e: 0x4051, 0x98f: 0xa000, 0x990: 0x4059, 0x991: 0xa000,
+	0x992: 0x4061, 0x993: 0xa000, 0x994: 0x4069, 0x995: 0xa000, 0x996: 0x4071, 0x997: 0xa000,
+	0x998: 0x4079, 0x999: 0xa000, 0x99a: 0x4081, 0x99b: 0xa000, 0x99c: 0x4089, 0x99d: 0xa000,
+	0x99e: 0x4091, 0x99f: 0xa000, 0x9a0: 0x4099, 0x9a1: 0xa000, 0x9a2: 0x40a1,
+	0x9a4: 0xa000, 0x9a5: 0x40a9, 0x9a6: 0xa000, 0x9a7: 0x40b1, 0x9a8: 0xa000, 0x9a9: 0x40b9,
+	0x9af: 0xa000,
+	0x9b0: 0x40c1, 0x9b1: 0x40c9, 0x9b2: 0xa000, 0x9b3: 0x40d1, 0x9b4: 0x40d9, 0x9b5: 0xa000,
+	0x9b6: 0x40e1, 0x9b7: 0x40e9, 0x9b8: 0xa000, 0x9b9: 0x40f1, 0x9ba: 0x40f9, 0x9bb: 0xa000,
+	0x9bc: 0x4101, 0x9bd: 0x4109,
+	// Block 0x27, offset 0x9c0
+	0x9d4: 0x4041,
+	0x9d9: 0x9904, 0x9da: 0x9904, 0x9db: 0x441d, 0x9dc: 0x4423, 0x9dd: 0xa000,
+	0x9de: 0x4111, 0x9df: 0x27e4,
+	0x9e6: 0xa000,
+	0x9eb: 0xa000, 0x9ec: 0x4121, 0x9ed: 0xa000, 0x9ee: 0x4129, 0x9ef: 0xa000,
+	0x9f0: 0x4131, 0x9f1: 0xa000, 0x9f2: 0x4139, 0x9f3: 0xa000, 0x9f4: 0x4141, 0x9f5: 0xa000,
+	0x9f6: 0x4149, 0x9f7: 0xa000, 0x9f8: 0x4151, 0x9f9: 0xa000, 0x9fa: 0x4159, 0x9fb: 0xa000,
+	0x9fc: 0x4161, 0x9fd: 0xa000, 0x9fe: 0x4169, 0x9ff: 0xa000,
+	// Block 0x28, offset 0xa00
+	0xa00: 0x4171, 0xa01: 0xa000, 0xa02: 0x4179, 0xa04: 0xa000, 0xa05: 0x4181,
+	0xa06: 0xa000, 0xa07: 0x4189, 0xa08: 0xa000, 0xa09: 0x4191,
+	0xa0f: 0xa000, 0xa10: 0x4199, 0xa11: 0x41a1,
+	0xa12: 0xa000, 0xa13: 0x41a9, 0xa14: 0x41b1, 0xa15: 0xa000, 0xa16: 0x41b9, 0xa17: 0x41c1,
+	0xa18: 0xa000, 0xa19: 0x41c9, 0xa1a: 0x41d1, 0xa1b: 0xa000, 0xa1c: 0x41d9, 0xa1d: 0x41e1,
+	0xa2f: 0xa000,
+	0xa30: 0xa000, 0xa31: 0xa000, 0xa32: 0xa000, 0xa34: 0x4119,
+	0xa37: 0x41e9, 0xa38: 0x41f1, 0xa39: 0x41f9, 0xa3a: 0x4201,
+	0xa3d: 0xa000, 0xa3e: 0x4209, 0xa3f: 0x27f9,
+	// Block 0x29, offset 0xa40
+	0xa40: 0x045a, 0xa41: 0x041e, 0xa42: 0x0422, 0xa43: 0x0426, 0xa44: 0x046e, 0xa45: 0x042a,
+	0xa46: 0x042e, 0xa47: 0x0432, 0xa48: 0x0436, 0xa49: 0x043a, 0xa4a: 0x043e, 0xa4b: 0x0442,
+	0xa4c: 0x0446, 0xa4d: 0x044a, 0xa4e: 0x044e, 0xa4f: 0x4afe, 0xa50: 0x4b04, 0xa51: 0x4b0a,
+	0xa52: 0x4b10, 0xa53: 0x4b16, 0xa54: 0x4b1c, 0xa55: 0x4b22, 0xa56: 0x4b28, 0xa57: 0x4b2e,
+	0xa58: 0x4b34, 0xa59: 0x4b3a, 0xa5a: 0x4b40, 0xa5b: 0x4b46, 0xa5c: 0x4b4c, 0xa5d: 0x4b52,
+	0xa5e: 0x4b58, 0xa5f: 0x4b5e, 0xa60: 0x4b64, 0xa61: 0x4b6a, 0xa62: 0x4b70, 0xa63: 0x4b76,
+	0xa64: 0x04b6, 0xa65: 0x0452, 0xa66: 0x0456, 0xa67: 0x04da, 0xa68: 0x04de, 0xa69: 0x04e2,
+	0xa6a: 0x04e6, 0xa6b: 0x04ea, 0xa6c: 0x04ee, 0xa6d: 0x04f2, 0xa6e: 0x045e, 0xa6f: 0x04f6,
+	0xa70: 0x04fa, 0xa71: 0x0462, 0xa72: 0x0466, 0xa73: 0x046a, 0xa74: 0x0472, 0xa75: 0x0476,
+	0xa76: 0x047a, 0xa77: 0x047e, 0xa78: 0x0482, 0xa79: 0x0486, 0xa7a: 0x048a, 0xa7b: 0x048e,
+	0xa7c: 0x0492, 0xa7d: 0x0496, 0xa7e: 0x049a, 0xa7f: 0x049e,
+	// Block 0x2a, offset 0xa80
+	0xa80: 0x04a2, 0xa81: 0x04a6, 0xa82: 0x04fe, 0xa83: 0x0502, 0xa84: 0x04aa, 0xa85: 0x04ae,
+	0xa86: 0x04b2, 0xa87: 0x04ba, 0xa88: 0x04be, 0xa89: 0x04c2, 0xa8a: 0x04c6, 0xa8b: 0x04ca,
+	0xa8c: 0x04ce, 0xa8d: 0x04d2, 0xa8e: 0x04d6,
+	0xa92: 0x07ba, 0xa93: 0x0816, 0xa94: 0x07c6, 0xa95: 0x0a76, 0xa96: 0x07ca, 0xa97: 0x07e2,
+	0xa98: 0x07ce, 0xa99: 0x108e, 0xa9a: 0x0802, 0xa9b: 0x07d6, 0xa9c: 0x07be, 0xa9d: 0x0afa,
+	0xa9e: 0x0a8a, 0xa9f: 0x082a,
+	// Block 0x2b, offset 0xac0
+	0xac0: 0x2184, 0xac1: 0x218a, 0xac2: 0x2190, 0xac3: 0x2196, 0xac4: 0x219c, 0xac5: 0x21a2,
+	0xac6: 0x21a8, 0xac7: 0x21ae, 0xac8: 0x21b4, 0xac9: 0x21ba, 0xaca: 0x21c0, 0xacb: 0x21c6,
+	0xacc: 0x21cc, 0xacd: 0x21d2, 0xace: 0x285d, 0xacf: 0x2866, 0xad0: 0x286f, 0xad1: 0x2878,
+	0xad2: 0x2881, 0xad3: 0x288a, 0xad4: 0x2893, 0xad5: 0x289c, 0xad6: 0x28a5, 0xad7: 0x28b7,
+	0xad8: 0x28c0, 0xad9: 0x28c9, 0xada: 0x28d2, 0xadb: 0x28db, 0xadc: 0x28ae, 0xadd: 0x2ce3,
+	0xade: 0x2c24, 0xae0: 0x21d8, 0xae1: 0x21f0, 0xae2: 0x21e4, 0xae3: 0x2238,
+	0xae4: 0x21f6, 0xae5: 0x2214, 0xae6: 0x21de, 0xae7: 0x220e, 0xae8: 0x21ea, 0xae9: 0x2220,
+	0xaea: 0x2250, 0xaeb: 0x226e, 0xaec: 0x2268, 0xaed: 0x225c, 0xaee: 0x22aa, 0xaef: 0x223e,
+	0xaf0: 0x224a, 0xaf1: 0x2262, 0xaf2: 0x2256, 0xaf3: 0x2280, 0xaf4: 0x222c, 0xaf5: 0x2274,
+	0xaf6: 0x229e, 0xaf7: 0x2286, 0xaf8: 0x221a, 0xaf9: 0x21fc, 0xafa: 0x2232, 0xafb: 0x2244,
+	0xafc: 0x227a, 0xafd: 0x2202, 0xafe: 0x22a4, 0xaff: 0x2226,
+	// Block 0x2c, offset 0xb00
+	0xb00: 0x228c, 0xb01: 0x2208, 0xb02: 0x2292, 0xb03: 0x2298, 0xb04: 0x0a2a, 0xb05: 0x0bfe,
+	0xb06: 0x0da2, 0xb07: 0x11c2,
+	0xb10: 0x1cf4, 0xb11: 0x19d6,
+	0xb12: 0x19d9, 0xb13: 0x19dc, 0xb14: 0x19df, 0xb15: 0x19e2, 0xb16: 0x19e5, 0xb17: 0x19e8,
+	0xb18: 0x19eb, 0xb19: 0x19ee, 0xb1a: 0x19f7, 0xb1b: 0x19fa, 0xb1c: 0x19fd, 0xb1d: 0x1a00,
+	0xb1e: 0x1a03, 0xb1f: 0x1a06, 0xb20: 0x0406, 0xb21: 0x040e, 0xb22: 0x0412, 0xb23: 0x041a,
+	0xb24: 0x041e, 0xb25: 0x0422, 0xb26: 0x042a, 0xb27: 0x0432, 0xb28: 0x0436, 0xb29: 0x043e,
+	0xb2a: 0x0442, 0xb2b: 0x0446, 0xb2c: 0x044a, 0xb2d: 0x044e, 0xb2e: 0x2f59, 0xb2f: 0x2f61,
+	0xb30: 0x2f69, 0xb31: 0x2f71, 0xb32: 0x2f79, 0xb33: 0x2f81, 0xb34: 0x2f89, 0xb35: 0x2f91,
+	0xb36: 0x2fa1, 0xb37: 0x2fa9, 0xb38: 0x2fb1, 0xb39: 0x2fb9, 0xb3a: 0x2fc1, 0xb3b: 0x2fc9,
+	0xb3c: 0x3014, 0xb3d: 0x2fdc, 0xb3e: 0x2f99,
+	// Block 0x2d, offset 0xb40
+	0xb40: 0x07ba, 0xb41: 0x0816, 0xb42: 0x07c6, 0xb43: 0x0a76, 0xb44: 0x081a, 0xb45: 0x08aa,
+	0xb46: 0x07c2, 0xb47: 0x08a6, 0xb48: 0x0806, 0xb49: 0x0982, 0xb4a: 0x0e02, 0xb4b: 0x0f8a,
+	0xb4c: 0x0ed2, 0xb4d: 0x0e16, 0xb4e: 0x155a, 0xb4f: 0x0a86, 0xb50: 0x0dca, 0xb51: 0x0e46,
+	0xb52: 0x0e06, 0xb53: 0x1146, 0xb54: 0x09f6, 0xb55: 0x0ffe, 0xb56: 0x1482, 0xb57: 0x115a,
+	0xb58: 0x093e, 0xb59: 0x118a, 0xb5a: 0x1096, 0xb5b: 0x0b12, 0xb5c: 0x150a, 0xb5d: 0x087a,
+	0xb5e: 0x09a6, 0xb5f: 0x0ef2, 0xb60: 0x1622, 0xb61: 0x083e, 0xb62: 0x08ce, 0xb63: 0x0e96,
+	0xb64: 0x07ca, 0xb65: 0x07e2, 0xb66: 0x07ce, 0xb67: 0x0bd6, 0xb68: 0x09ea, 0xb69: 0x097a,
+	0xb6a: 0x0b52, 0xb6b: 0x0b46, 0xb6c: 0x10e6, 0xb6d: 0x083a, 0xb6e: 0x1496, 0xb6f: 0x0996,
+	0xb70: 0x0aee, 0xb71: 0x1a09, 0xb72: 0x1a0c, 0xb73: 0x1a0f, 0xb74: 0x1a12, 0xb75: 0x1a1b,
+	0xb76: 0x1a1e, 0xb77: 0x1a21, 0xb78: 0x1a24, 0xb79: 0x1a27, 0xb7a: 0x1a2a, 0xb7b: 0x1a2d,
+	0xb7c: 0x1a30, 0xb7d: 0x1a33, 0xb7e: 0x1a36, 0xb7f: 0x1a3f,
+	// Block 0x2e, offset 0xb80
+	0xb80: 0x1df6, 0xb81: 0x1e05, 0xb82: 0x1e14, 0xb83: 0x1e23, 0xb84: 0x1e32, 0xb85: 0x1e41,
+	0xb86: 0x1e50, 0xb87: 0x1e5f, 0xb88: 0x1e6e, 0xb89: 0x22bc, 0xb8a: 0x22ce, 0xb8b: 0x22e0,
+	0xb8c: 0x1a81, 0xb8d: 0x1d34, 0xb8e: 0x1b02, 0xb8f: 0x1cd8, 0xb90: 0x05c6, 0xb91: 0x05ce,
+	0xb92: 0x05d6, 0xb93: 0x05de, 0xb94: 0x05e6, 0xb95: 0x05ea, 0xb96: 0x05ee, 0xb97: 0x05f2,
+	0xb98: 0x05f6, 0xb99: 0x05fa, 0xb9a: 0x05fe, 0xb9b: 0x0602, 0xb9c: 0x0606, 0xb9d: 0x060a,
+	0xb9e: 0x060e, 0xb9f: 0x0612, 0xba0: 0x0616, 0xba1: 0x061e, 0xba2: 0x0622, 0xba3: 0x0626,
+	0xba4: 0x062a, 0xba5: 0x062e, 0xba6: 0x0632, 0xba7: 0x0636, 0xba8: 0x063a, 0xba9: 0x063e,
+	0xbaa: 0x0642, 0xbab: 0x0646, 0xbac: 0x064a, 0xbad: 0x064e, 0xbae: 0x0652, 0xbaf: 0x0656,
+	0xbb0: 0x065a, 0xbb1: 0x065e, 0xbb2: 0x0662, 0xbb3: 0x066a, 0xbb4: 0x0672, 0xbb5: 0x067a,
+	0xbb6: 0x067e, 0xbb7: 0x0682, 0xbb8: 0x0686, 0xbb9: 0x068a, 0xbba: 0x068e, 0xbbb: 0x0692,
+	0xbbc: 0x0696, 0xbbd: 0x069a, 0xbbe: 0x069e, 0xbbf: 0x282a,
+	// Block 0x2f, offset 0xbc0
+	0xbc0: 0x2c43, 0xbc1: 0x2adf, 0xbc2: 0x2c53, 0xbc3: 0x29b7, 0xbc4: 0x3025, 0xbc5: 0x29c1,
+	0xbc6: 0x29cb, 0xbc7: 0x3069, 0xbc8: 0x2aec, 0xbc9: 0x29d5, 0xbca: 0x29df, 0xbcb: 0x29e9,
+	0xbcc: 0x2b13, 0xbcd: 0x2b20, 0xbce: 0x2af9, 0xbcf: 0x2b06, 0xbd0: 0x2fea, 0xbd1: 0x2b2d,
+	0xbd2: 0x2b3a, 0xbd3: 0x2cf5, 0xbd4: 0x27eb, 0xbd5: 0x2d08, 0xbd6: 0x2d1b, 0xbd7: 0x2c63,
+	0xbd8: 0x2b47, 0xbd9: 0x2d2e, 0xbda: 0x2d41, 0xbdb: 0x2b54, 0xbdc: 0x29f3, 0xbdd: 0x29fd,
+	0xbde: 0x2ff8, 0xbdf: 0x2b61, 0xbe0: 0x2c73, 0xbe1: 0x3036, 0xbe2: 0x2a07, 0xbe3: 0x2a11,
+	0xbe4: 0x2b6e, 0xbe5: 0x2a1b, 0xbe6: 0x2a25, 0xbe7: 0x2800, 0xbe8: 0x2807, 0xbe9: 0x2a2f,
+	0xbea: 0x2a39, 0xbeb: 0x2d54, 0xbec: 0x2b7b, 0xbed: 0x2c83, 0xbee: 0x2d67, 0xbef: 0x2b88,
+	0xbf0: 0x2a4d, 0xbf1: 0x2a43, 0xbf2: 0x307d, 0xbf3: 0x2b95, 0xbf4: 0x2d7a, 0xbf5: 0x2a57,
+	0xbf6: 0x2c93, 0xbf7: 0x2a61, 0xbf8: 0x2baf, 0xbf9: 0x2a6b, 0xbfa: 0x2bbc, 0xbfb: 0x3047,
+	0xbfc: 0x2ba2, 0xbfd: 0x2ca3, 0xbfe: 0x2bc9, 0xbff: 0x280e,
+	// Block 0x30, offset 0xc00
+	0xc00: 0x3058, 0xc01: 0x2a75, 0xc02: 0x2a7f, 0xc03: 0x2bd6, 0xc04: 0x2a89, 0xc05: 0x2a93,
+	0xc06: 0x2a9d, 0xc07: 0x2cb3, 0xc08: 0x2be3, 0xc09: 0x2815, 0xc0a: 0x2d8d, 0xc0b: 0x2fd1,
+	0xc0c: 0x2cc3, 0xc0d: 0x2bf0, 0xc0e: 0x3006, 0xc0f: 0x2aa7, 0xc10: 0x2ab1, 0xc11: 0x2bfd,
+	0xc12: 0x281c, 0xc13: 0x2c0a, 0xc14: 0x2cd3, 0xc15: 0x2823, 0xc16: 0x2da0, 0xc17: 0x2abb,
+	0xc18: 0x1de7, 0xc19: 0x1dfb, 0xc1a: 0x1e0a, 0xc1b: 0x1e19, 0xc1c: 0x1e28, 0xc1d: 0x1e37,
+	0xc1e: 0x1e46, 0xc1f: 0x1e55, 0xc20: 0x1e64, 0xc21: 0x1e73, 0xc22: 0x22c2, 0xc23: 0x22d4,
+	0xc24: 0x22e6, 0xc25: 0x22f2, 0xc26: 0x22fe, 0xc27: 0x230a, 0xc28: 0x2316, 0xc29: 0x2322,
+	0xc2a: 0x232e, 0xc2b: 0x233a, 0xc2c: 0x2376, 0xc2d: 0x2382, 0xc2e: 0x238e, 0xc2f: 0x239a,
+	0xc30: 0x23a6, 0xc31: 0x1d44, 0xc32: 0x1af6, 0xc33: 0x1a63, 0xc34: 0x1d14, 0xc35: 0x1b77,
+	0xc36: 0x1b86, 0xc37: 0x1afc, 0xc38: 0x1d2c, 0xc39: 0x1d30, 0xc3a: 0x1a8d, 0xc3b: 0x2838,
+	0xc3c: 0x2846, 0xc3d: 0x2831, 0xc3e: 0x283f, 0xc3f: 0x2c17,
+	// Block 0x31, offset 0xc40
+	0xc40: 0x1b7a, 0xc41: 0x1b62, 0xc42: 0x1d90, 0xc43: 0x1b4a, 0xc44: 0x1b23, 0xc45: 0x1a96,
+	0xc46: 0x1aa5, 0xc47: 0x1a75, 0xc48: 0x1d20, 0xc49: 0x1e82, 0xc4a: 0x1b7d, 0xc4b: 0x1b65,
+	0xc4c: 0x1d94, 0xc4d: 0x1da0, 0xc4e: 0x1b56, 0xc4f: 0x1b2c, 0xc50: 0x1a84, 0xc51: 0x1d4c,
+	0xc52: 0x1ce0, 0xc53: 0x1ccc, 0xc54: 0x1cfc, 0xc55: 0x1da4, 0xc56: 0x1b59, 0xc57: 0x1af9,
+	0xc58: 0x1b2f, 0xc59: 0x1b0e, 0xc5a: 0x1b71, 0xc5b: 0x1da8, 0xc5c: 0x1b5c, 0xc5d: 0x1af0,
+	0xc5e: 0x1b32, 0xc5f: 0x1d6c, 0xc60: 0x1d24, 0xc61: 0x1b44, 0xc62: 0x1d54, 0xc63: 0x1d70,
+	0xc64: 0x1d28, 0xc65: 0x1b47, 0xc66: 0x1d58, 0xc67: 0x2418, 0xc68: 0x242c, 0xc69: 0x1ac6,
+	0xc6a: 0x1d50, 0xc6b: 0x1ce4, 0xc6c: 0x1cd0, 0xc6d: 0x1d78, 0xc6e: 0x284d, 0xc6f: 0x28e4,
+	0xc70: 0x1b89, 0xc71: 0x1b74, 0xc72: 0x1dac, 0xc73: 0x1b5f, 0xc74: 0x1b80, 0xc75: 0x1b68,
+	0xc76: 0x1d98, 0xc77: 0x1b4d, 0xc78: 0x1b26, 0xc79: 0x1ab1, 0xc7a: 0x1b83, 0xc7b: 0x1b6b,
+	0xc7c: 0x1d9c, 0xc7d: 0x1b50, 0xc7e: 0x1b29, 0xc7f: 0x1ab4,
+	// Block 0x32, offset 0xc80
+	0xc80: 0x1d5c, 0xc81: 0x1ce8, 0xc82: 0x1e7d, 0xc83: 0x1a66, 0xc84: 0x1aea, 0xc85: 0x1aed,
+	0xc86: 0x2425, 0xc87: 0x1cc4, 0xc88: 0x1af3, 0xc89: 0x1a78, 0xc8a: 0x1b11, 0xc8b: 0x1a7b,
+	0xc8c: 0x1b1a, 0xc8d: 0x1a99, 0xc8e: 0x1a9c, 0xc8f: 0x1b35, 0xc90: 0x1b3b, 0xc91: 0x1b3e,
+	0xc92: 0x1d60, 0xc93: 0x1b41, 0xc94: 0x1b53, 0xc95: 0x1d68, 0xc96: 0x1d74, 0xc97: 0x1ac0,
+	0xc98: 0x1e87, 0xc99: 0x1cec, 0xc9a: 0x1ac3, 0xc9b: 0x1b8c, 0xc9c: 0x1ad5, 0xc9d: 0x1ae4,
+	0xc9e: 0x2412, 0xc9f: 0x240c, 0xca0: 0x1df1, 0xca1: 0x1e00, 0xca2: 0x1e0f, 0xca3: 0x1e1e,
+	0xca4: 0x1e2d, 0xca5: 0x1e3c, 0xca6: 0x1e4b, 0xca7: 0x1e5a, 0xca8: 0x1e69, 0xca9: 0x22b6,
+	0xcaa: 0x22c8, 0xcab: 0x22da, 0xcac: 0x22ec, 0xcad: 0x22f8, 0xcae: 0x2304, 0xcaf: 0x2310,
+	0xcb0: 0x231c, 0xcb1: 0x2328, 0xcb2: 0x2334, 0xcb3: 0x2370, 0xcb4: 0x237c, 0xcb5: 0x2388,
+	0xcb6: 0x2394, 0xcb7: 0x23a0, 0xcb8: 0x23ac, 0xcb9: 0x23b2, 0xcba: 0x23b8, 0xcbb: 0x23be,
+	0xcbc: 0x23c4, 0xcbd: 0x23d6, 0xcbe: 0x23dc, 0xcbf: 0x1d40,
+	// Block 0x33, offset 0xcc0
+	0xcc0: 0x1472, 0xcc1: 0x0df6, 0xcc2: 0x14ce, 0xcc3: 0x149a, 0xcc4: 0x0f52, 0xcc5: 0x07e6,
+	0xcc6: 0x09da, 0xcc7: 0x1726, 0xcc8: 0x1726, 0xcc9: 0x0b06, 0xcca: 0x155a, 0xccb: 0x0a3e,
+	0xccc: 0x0b02, 0xccd: 0x0cea, 0xcce: 0x10ca, 0xccf: 0x125a, 0xcd0: 0x1392, 0xcd1: 0x13ce,
+	0xcd2: 0x1402, 0xcd3: 0x1516, 0xcd4: 0x0e6e, 0xcd5: 0x0efa, 0xcd6: 0x0fa6, 0xcd7: 0x103e,
+	0xcd8: 0x135a, 0xcd9: 0x1542, 0xcda: 0x166e, 0xcdb: 0x080a, 0xcdc: 0x09ae, 0xcdd: 0x0e82,
+	0xcde: 0x0fca, 0xcdf: 0x138e, 0xce0: 0x16be, 0xce1: 0x0bae, 0xce2: 0x0f72, 0xce3: 0x137e,
+	0xce4: 0x1412, 0xce5: 0x0d1e, 0xce6: 0x12b6, 0xce7: 0x13da, 0xce8: 0x0c1a, 0xce9: 0x0e0a,
+	0xcea: 0x0f12, 0xceb: 0x1016, 0xcec: 0x1522, 0xced: 0x084a, 0xcee: 0x08e2, 0xcef: 0x094e,
+	0xcf0: 0x0d86, 0xcf1: 0x0e7a, 0xcf2: 0x0fc6, 0xcf3: 0x10ea, 0xcf4: 0x1272, 0xcf5: 0x1386,
+	0xcf6: 0x139e, 0xcf7: 0x14c2, 0xcf8: 0x15ea, 0xcf9: 0x169e, 0xcfa: 0x16ba, 0xcfb: 0x1126,
+	0xcfc: 0x1166, 0xcfd: 0x121e, 0xcfe: 0x133e, 0xcff: 0x1576,
+	// Block 0x34, offset 0xd00
+	0xd00: 0x16c6, 0xd01: 0x1446, 0xd02: 0x0ac2, 0xd03: 0x0c36, 0xd04: 0x11d6, 0xd05: 0x1296,
+	0xd06: 0x0ffa, 0xd07: 0x112e, 0xd08: 0x1492, 0xd09: 0x15e2, 0xd0a: 0x0abe, 0xd0b: 0x0b8a,
+	0xd0c: 0x0e72, 0xd0d: 0x0f26, 0xd0e: 0x0f5a, 0xd0f: 0x120e, 0xd10: 0x1236, 0xd11: 0x15a2,
+	0xd12: 0x094a, 0xd13: 0x12a2, 0xd14: 0x08ee, 0xd15: 0x08ea, 0xd16: 0x1192, 0xd17: 0x1222,
+	0xd18: 0x1356, 0xd19: 0x15aa, 0xd1a: 0x1462, 0xd1b: 0x0d22, 0xd1c: 0x0e6e, 0xd1d: 0x1452,
+	0xd1e: 0x07f2, 0xd1f: 0x0b5e, 0xd20: 0x0c8e, 0xd21: 0x102a, 0xd22: 0x10aa, 0xd23: 0x096e,
+	0xd24: 0x1136, 0xd25: 0x085a, 0xd26: 0x0c72, 0xd27: 0x07d2, 0xd28: 0x0ee6, 0xd29: 0x0d9e,
+	0xd2a: 0x120a, 0xd2b: 0x09c2, 0xd2c: 0x0aae, 0xd2d: 0x10f6, 0xd2e: 0x135e, 0xd2f: 0x1436,
+	0xd30: 0x0eb2, 0xd31: 0x14f2, 0xd32: 0x0ede, 0xd33: 0x0d32, 0xd34: 0x1316, 0xd35: 0x0d52,
+	0xd36: 0x10a6, 0xd37: 0x0826, 0xd38: 0x08a2, 0xd39: 0x08e6, 0xd3a: 0x0e4e, 0xd3b: 0x11f6,
+	0xd3c: 0x12ee, 0xd3d: 0x1442, 0xd3e: 0x1556, 0xd3f: 0x0956,
+	// Block 0x35, offset 0xd40
+	0xd40: 0x0a0a, 0xd41: 0x0b12, 0xd42: 0x0c2a, 0xd43: 0x0dba, 0xd44: 0x0f76, 0xd45: 0x113a,
+	0xd46: 0x1592, 0xd47: 0x1676, 0xd48: 0x16ca, 0xd49: 0x16e2, 0xd4a: 0x0932, 0xd4b: 0x0dee,
+	0xd4c: 0x0e9e, 0xd4d: 0x14e6, 0xd4e: 0x0bf6, 0xd4f: 0x0cd2, 0xd50: 0x0cee, 0xd51: 0x0d7e,
+	0xd52: 0x0f66, 0xd53: 0x0fb2, 0xd54: 0x1062, 0xd55: 0x1186, 0xd56: 0x122a, 0xd57: 0x128e,
+	0xd58: 0x14d6, 0xd59: 0x1366, 0xd5a: 0x14fe, 0xd5b: 0x157a, 0xd5c: 0x090a, 0xd5d: 0x0936,
+	0xd5e: 0x0a1e, 0xd5f: 0x0fa2, 0xd60: 0x13ee, 0xd61: 0x1436, 0xd62: 0x0c16, 0xd63: 0x0c86,
+	0xd64: 0x0d4a, 0xd65: 0x0eaa, 0xd66: 0x11d2, 0xd67: 0x101e, 0xd68: 0x0836, 0xd69: 0x0a7a,
+	0xd6a: 0x0b5e, 0xd6b: 0x0bc2, 0xd6c: 0x0c92, 0xd6d: 0x103a, 0xd6e: 0x1056, 0xd6f: 0x1266,
+	0xd70: 0x1286, 0xd71: 0x155e, 0xd72: 0x15de, 0xd73: 0x15ee, 0xd74: 0x162a, 0xd75: 0x084e,
+	0xd76: 0x117a, 0xd77: 0x154a, 0xd78: 0x15c6, 0xd79: 0x0caa, 0xd7a: 0x0812, 0xd7b: 0x0872,
+	0xd7c: 0x0b62, 0xd7d: 0x0b82, 0xd7e: 0x0daa, 0xd7f: 0x0e6e,
+	// Block 0x36, offset 0xd80
+	0xd80: 0x0fbe, 0xd81: 0x10c6, 0xd82: 0x1372, 0xd83: 0x1512, 0xd84: 0x171e, 0xd85: 0x0dde,
+	0xd86: 0x159e, 0xd87: 0x092e, 0xd88: 0x0e2a, 0xd89: 0x0e36, 0xd8a: 0x0f0a, 0xd8b: 0x0f42,
+	0xd8c: 0x1046, 0xd8d: 0x10a2, 0xd8e: 0x1122, 0xd8f: 0x1206, 0xd90: 0x1636, 0xd91: 0x08aa,
+	0xd92: 0x0cfe, 0xd93: 0x15ae, 0xd94: 0x0862, 0xd95: 0x0ba6, 0xd96: 0x0f2a, 0xd97: 0x14da,
+	0xd98: 0x0c62, 0xd99: 0x0cb2, 0xd9a: 0x0e3e, 0xd9b: 0x102a, 0xd9c: 0x15b6, 0xd9d: 0x0912,
+	0xd9e: 0x09fa, 0xd9f: 0x0b92, 0xda0: 0x0dce, 0xda1: 0x0e1a, 0xda2: 0x0e5a, 0xda3: 0x0eee,
+	0xda4: 0x1042, 0xda5: 0x10b6, 0xda6: 0x1252, 0xda7: 0x13f2, 0xda8: 0x13fe, 0xda9: 0x1552,
+	0xdaa: 0x15d2, 0xdab: 0x097e, 0xdac: 0x0f46, 0xdad: 0x09fe, 0xdae: 0x0fc2, 0xdaf: 0x1066,
+	0xdb0: 0x1382, 0xdb1: 0x15ba, 0xdb2: 0x16a6, 0xdb3: 0x16ce, 0xdb4: 0x0e32, 0xdb5: 0x0f22,
+	0xdb6: 0x12be, 0xdb7: 0x11b2, 0xdb8: 0x11be, 0xdb9: 0x11e2, 0xdba: 0x1012, 0xdbb: 0x0f9a,
+	0xdbc: 0x145e, 0xdbd: 0x082e, 0xdbe: 0x1326, 0xdbf: 0x0916,
+	// Block 0x37, offset 0xdc0
+	0xdc0: 0x0906, 0xdc1: 0x0c06, 0xdc2: 0x0d26, 0xdc3: 0x11ee, 0xdc4: 0x0b4e, 0xdc5: 0x0efe,
+	0xdc6: 0x0dea, 0xdc7: 0x14e2, 0xdc8: 0x13e2, 0xdc9: 0x15a6, 0xdca: 0x141e, 0xdcb: 0x0c22,
+	0xdcc: 0x0882, 0xdcd: 0x0a56, 0xdd0: 0x0aaa,
+	0xdd2: 0x0dda, 0xdd5: 0x08f2, 0xdd6: 0x101a, 0xdd7: 0x10de,
+	0xdd8: 0x1142, 0xdd9: 0x115e, 0xdda: 0x1162, 0xddb: 0x1176, 0xddc: 0x15f6, 0xddd: 0x11e6,
+	0xdde: 0x126a, 0xde0: 0x138a, 0xde2: 0x144e,
+	0xde5: 0x1502, 0xde6: 0x152e,
+	0xdea: 0x164a, 0xdeb: 0x164e, 0xdec: 0x1652, 0xded: 0x16b6, 0xdee: 0x1526, 0xdef: 0x15c2,
+	0xdf0: 0x0852, 0xdf1: 0x0876, 0xdf2: 0x088a, 0xdf3: 0x0946, 0xdf4: 0x0952, 0xdf5: 0x0992,
+	0xdf6: 0x0a46, 0xdf7: 0x0a62, 0xdf8: 0x0a6a, 0xdf9: 0x0aa6, 0xdfa: 0x0ab2, 0xdfb: 0x0b8e,
+	0xdfc: 0x0b96, 0xdfd: 0x0c9e, 0xdfe: 0x0cc6, 0xdff: 0x0cce,
+	// Block 0x38, offset 0xe00
+	0xe00: 0x0ce6, 0xe01: 0x0d92, 0xe02: 0x0dc2, 0xe03: 0x0de2, 0xe04: 0x0e52, 0xe05: 0x0f16,
+	0xe06: 0x0f32, 0xe07: 0x0f62, 0xe08: 0x0fb6, 0xe09: 0x0fd6, 0xe0a: 0x104a, 0xe0b: 0x112a,
+	0xe0c: 0x1146, 0xe0d: 0x114e, 0xe0e: 0x114a, 0xe0f: 0x1152, 0xe10: 0x1156, 0xe11: 0x115a,
+	0xe12: 0x116e, 0xe13: 0x1172, 0xe14: 0x1196, 0xe15: 0x11aa, 0xe16: 0x11c6, 0xe17: 0x122a,
+	0xe18: 0x1232, 0xe19: 0x123a, 0xe1a: 0x124e, 0xe1b: 0x1276, 0xe1c: 0x12c6, 0xe1d: 0x12fa,
+	0xe1e: 0x12fa, 0xe1f: 0x1362, 0xe20: 0x140a, 0xe21: 0x1422, 0xe22: 0x1456, 0xe23: 0x145a,
+	0xe24: 0x149e, 0xe25: 0x14a2, 0xe26: 0x14fa, 0xe27: 0x1502, 0xe28: 0x15d6, 0xe29: 0x161a,
+	0xe2a: 0x1632, 0xe2b: 0x0c96, 0xe2c: 0x184b, 0xe2d: 0x12de,
+	0xe30: 0x07da, 0xe31: 0x08de, 0xe32: 0x089e, 0xe33: 0x0846, 0xe34: 0x0886, 0xe35: 0x08b2,
+	0xe36: 0x0942, 0xe37: 0x095e, 0xe38: 0x0a46, 0xe39: 0x0a32, 0xe3a: 0x0a42, 0xe3b: 0x0a5e,
+	0xe3c: 0x0aaa, 0xe3d: 0x0aba, 0xe3e: 0x0afe, 0xe3f: 0x0b0a,
+	// Block 0x39, offset 0xe40
+	0xe40: 0x0b26, 0xe41: 0x0b36, 0xe42: 0x0c1e, 0xe43: 0x0c26, 0xe44: 0x0c56, 0xe45: 0x0c76,
+	0xe46: 0x0ca6, 0xe47: 0x0cbe, 0xe48: 0x0cae, 0xe49: 0x0cce, 0xe4a: 0x0cc2, 0xe4b: 0x0ce6,
+	0xe4c: 0x0d02, 0xe4d: 0x0d5a, 0xe4e: 0x0d66, 0xe4f: 0x0d6e, 0xe50: 0x0d96, 0xe51: 0x0dda,
+	0xe52: 0x0e0a, 0xe53: 0x0e0e, 0xe54: 0x0e22, 0xe55: 0x0ea2, 0xe56: 0x0eb2, 0xe57: 0x0f0a,
+	0xe58: 0x0f56, 0xe59: 0x0f4e, 0xe5a: 0x0f62, 0xe5b: 0x0f7e, 0xe5c: 0x0fb6, 0xe5d: 0x110e,
+	0xe5e: 0x0fda, 0xe5f: 0x100e, 0xe60: 0x101a, 0xe61: 0x105a, 0xe62: 0x1076, 0xe63: 0x109a,
+	0xe64: 0x10be, 0xe65: 0x10c2, 0xe66: 0x10de, 0xe67: 0x10e2, 0xe68: 0x10f2, 0xe69: 0x1106,
+	0xe6a: 0x1102, 0xe6b: 0x1132, 0xe6c: 0x11ae, 0xe6d: 0x11c6, 0xe6e: 0x11de, 0xe6f: 0x1216,
+	0xe70: 0x122a, 0xe71: 0x1246, 0xe72: 0x1276, 0xe73: 0x132a, 0xe74: 0x1352, 0xe75: 0x13c6,
+	0xe76: 0x140e, 0xe77: 0x141a, 0xe78: 0x1422, 0xe79: 0x143a, 0xe7a: 0x144e, 0xe7b: 0x143e,
+	0xe7c: 0x1456, 0xe7d: 0x1452, 0xe7e: 0x144a, 0xe7f: 0x145a,
+	// Block 0x3a, offset 0xe80
+	0xe80: 0x1466, 0xe81: 0x14a2, 0xe82: 0x14de, 0xe83: 0x150e, 0xe84: 0x1546, 0xe85: 0x1566,
+	0xe86: 0x15b2, 0xe87: 0x15d6, 0xe88: 0x15f6, 0xe89: 0x160a, 0xe8a: 0x161a, 0xe8b: 0x1626,
+	0xe8c: 0x1632, 0xe8d: 0x1686, 0xe8e: 0x1726, 0xe8f: 0x17e2, 0xe90: 0x17dd, 0xe91: 0x180f,
+	0xe92: 0x0702, 0xe93: 0x072a, 0xe94: 0x072e, 0xe95: 0x1891, 0xe96: 0x18be, 0xe97: 0x1936,
+	0xe98: 0x1712, 0xe99: 0x1722,
+	// Block 0x3b, offset 0xec0
+	0xec0: 0x1b05, 0xec1: 0x1b08, 0xec2: 0x1b0b, 0xec3: 0x1d38, 0xec4: 0x1d3c, 0xec5: 0x1b8f,
+	0xec6: 0x1b8f,
+	0xed3: 0x1ea5, 0xed4: 0x1e96, 0xed5: 0x1e9b, 0xed6: 0x1eaa, 0xed7: 0x1ea0,
+	0xedd: 0x44d1,
+	0xede: 0x8116, 0xedf: 0x4543, 0xee0: 0x0320, 0xee1: 0x0308, 0xee2: 0x0311, 0xee3: 0x0314,
+	0xee4: 0x0317, 0xee5: 0x031a, 0xee6: 0x031d, 0xee7: 0x0323, 0xee8: 0x0326, 0xee9: 0x0017,
+	0xeea: 0x4531, 0xeeb: 0x4537, 0xeec: 0x4635, 0xeed: 0x463d, 0xeee: 0x4489, 0xeef: 0x448f,
+	0xef0: 0x4495, 0xef1: 0x449b, 0xef2: 0x44a7, 0xef3: 0x44ad, 0xef4: 0x44b3, 0xef5: 0x44bf,
+	0xef6: 0x44c5, 0xef8: 0x44cb, 0xef9: 0x44d7, 0xefa: 0x44dd, 0xefb: 0x44e3,
+	0xefc: 0x44ef, 0xefe: 0x44f5,
+	// Block 0x3c, offset 0xf00
+	0xf00: 0x44fb, 0xf01: 0x4501, 0xf03: 0x4507, 0xf04: 0x450d,
+	0xf06: 0x4519, 0xf07: 0x451f, 0xf08: 0x4525, 0xf09: 0x452b, 0xf0a: 0x453d, 0xf0b: 0x44b9,
+	0xf0c: 0x44a1, 0xf0d: 0x44e9, 0xf0e: 0x4513, 0xf0f: 0x1eaf, 0xf10: 0x038c, 0xf11: 0x038c,
+	0xf12: 0x0395, 0xf13: 0x0395, 0xf14: 0x0395, 0xf15: 0x0395, 0xf16: 0x0398, 0xf17: 0x0398,
+	0xf18: 0x0398, 0xf19: 0x0398, 0xf1a: 0x039e, 0xf1b: 0x039e, 0xf1c: 0x039e, 0xf1d: 0x039e,
+	0xf1e: 0x0392, 0xf1f: 0x0392, 0xf20: 0x0392, 0xf21: 0x0392, 0xf22: 0x039b, 0xf23: 0x039b,
+	0xf24: 0x039b, 0xf25: 0x039b, 0xf26: 0x038f, 0xf27: 0x038f, 0xf28: 0x038f, 0xf29: 0x038f,
+	0xf2a: 0x03c2, 0xf2b: 0x03c2, 0xf2c: 0x03c2, 0xf2d: 0x03c2, 0xf2e: 0x03c5, 0xf2f: 0x03c5,
+	0xf30: 0x03c5, 0xf31: 0x03c5, 0xf32: 0x03a4, 0xf33: 0x03a4, 0xf34: 0x03a4, 0xf35: 0x03a4,
+	0xf36: 0x03a1, 0xf37: 0x03a1, 0xf38: 0x03a1, 0xf39: 0x03a1, 0xf3a: 0x03a7, 0xf3b: 0x03a7,
+	0xf3c: 0x03a7, 0xf3d: 0x03a7, 0xf3e: 0x03aa, 0xf3f: 0x03aa,
+	// Block 0x3d, offset 0xf40
+	0xf40: 0x03aa, 0xf41: 0x03aa, 0xf42: 0x03b3, 0xf43: 0x03b3, 0xf44: 0x03b0, 0xf45: 0x03b0,
+	0xf46: 0x03b6, 0xf47: 0x03b6, 0xf48: 0x03ad, 0xf49: 0x03ad, 0xf4a: 0x03bc, 0xf4b: 0x03bc,
+	0xf4c: 0x03b9, 0xf4d: 0x03b9, 0xf4e: 0x03c8, 0xf4f: 0x03c8, 0xf50: 0x03c8, 0xf51: 0x03c8,
+	0xf52: 0x03ce, 0xf53: 0x03ce, 0xf54: 0x03ce, 0xf55: 0x03ce, 0xf56: 0x03d4, 0xf57: 0x03d4,
+	0xf58: 0x03d4, 0xf59: 0x03d4, 0xf5a: 0x03d1, 0xf5b: 0x03d1, 0xf5c: 0x03d1, 0xf5d: 0x03d1,
+	0xf5e: 0x03d7, 0xf5f: 0x03d7, 0xf60: 0x03da, 0xf61: 0x03da, 0xf62: 0x03da, 0xf63: 0x03da,
+	0xf64: 0x45af, 0xf65: 0x45af, 0xf66: 0x03e0, 0xf67: 0x03e0, 0xf68: 0x03e0, 0xf69: 0x03e0,
+	0xf6a: 0x03dd, 0xf6b: 0x03dd, 0xf6c: 0x03dd, 0xf6d: 0x03dd, 0xf6e: 0x03fb, 0xf6f: 0x03fb,
+	0xf70: 0x45a9, 0xf71: 0x45a9,
+	// Block 0x3e, offset 0xf80
+	0xf93: 0x03cb, 0xf94: 0x03cb, 0xf95: 0x03cb, 0xf96: 0x03cb, 0xf97: 0x03e9,
+	0xf98: 0x03e9, 0xf99: 0x03e6, 0xf9a: 0x03e6, 0xf9b: 0x03ec, 0xf9c: 0x03ec, 0xf9d: 0x217f,
+	0xf9e: 0x03f2, 0xf9f: 0x03f2, 0xfa0: 0x03e3, 0xfa1: 0x03e3, 0xfa2: 0x03ef, 0xfa3: 0x03ef,
+	0xfa4: 0x03f8, 0xfa5: 0x03f8, 0xfa6: 0x03f8, 0xfa7: 0x03f8, 0xfa8: 0x0380, 0xfa9: 0x0380,
+	0xfaa: 0x26da, 0xfab: 0x26da, 0xfac: 0x274a, 0xfad: 0x274a, 0xfae: 0x2719, 0xfaf: 0x2719,
+	0xfb0: 0x2735, 0xfb1: 0x2735, 0xfb2: 0x272e, 0xfb3: 0x272e, 0xfb4: 0x273c, 0xfb5: 0x273c,
+	0xfb6: 0x2743, 0xfb7: 0x2743, 0xfb8: 0x2743, 0xfb9: 0x2720, 0xfba: 0x2720, 0xfbb: 0x2720,
+	0xfbc: 0x03f5, 0xfbd: 0x03f5, 0xfbe: 0x03f5, 0xfbf: 0x03f5,
+	// Block 0x3f, offset 0xfc0
+	0xfc0: 0x26e1, 0xfc1: 0x26e8, 0xfc2: 0x2704, 0xfc3: 0x2720, 0xfc4: 0x2727, 0xfc5: 0x1eb9,
+	0xfc6: 0x1ebe, 0xfc7: 0x1ec3, 0xfc8: 0x1ed2, 0xfc9: 0x1ee1, 0xfca: 0x1ee6, 0xfcb: 0x1eeb,
+	0xfcc: 0x1ef0, 0xfcd: 0x1ef5, 0xfce: 0x1f04, 0xfcf: 0x1f13, 0xfd0: 0x1f18, 0xfd1: 0x1f1d,
+	0xfd2: 0x1f2c, 0xfd3: 0x1f3b, 0xfd4: 0x1f40, 0xfd5: 0x1f45, 0xfd6: 0x1f4a, 0xfd7: 0x1f59,
+	0xfd8: 0x1f5e, 0xfd9: 0x1f6d, 0xfda: 0x1f72, 0xfdb: 0x1f77, 0xfdc: 0x1f86, 0xfdd: 0x1f8b,
+	0xfde: 0x1f90, 0xfdf: 0x1f9a, 0xfe0: 0x1fd6, 0xfe1: 0x1fe5, 0xfe2: 0x1ff4, 0xfe3: 0x1ff9,
+	0xfe4: 0x1ffe, 0xfe5: 0x2008, 0xfe6: 0x2017, 0xfe7: 0x201c, 0xfe8: 0x202b, 0xfe9: 0x2030,
+	0xfea: 0x2035, 0xfeb: 0x2044, 0xfec: 0x2049, 0xfed: 0x2058, 0xfee: 0x205d, 0xfef: 0x2062,
+	0xff0: 0x2067, 0xff1: 0x206c, 0xff2: 0x2071, 0xff3: 0x2076, 0xff4: 0x207b, 0xff5: 0x2080,
+	0xff6: 0x2085, 0xff7: 0x208a, 0xff8: 0x208f, 0xff9: 0x2094, 0xffa: 0x2099, 0xffb: 0x209e,
+	0xffc: 0x20a3, 0xffd: 0x20a8, 0xffe: 0x20ad, 0xfff: 0x20b7,
+	// Block 0x40, offset 0x1000
+	0x1000: 0x20bc, 0x1001: 0x20c1, 0x1002: 0x20c6, 0x1003: 0x20d0, 0x1004: 0x20d5, 0x1005: 0x20df,
+	0x1006: 0x20e4, 0x1007: 0x20e9, 0x1008: 0x20ee, 0x1009: 0x20f3, 0x100a: 0x20f8, 0x100b: 0x20fd,
+	0x100c: 0x2102, 0x100d: 0x2107, 0x100e: 0x2116, 0x100f: 0x2125, 0x1010: 0x212a, 0x1011: 0x212f,
+	0x1012: 0x2134, 0x1013: 0x2139, 0x1014: 0x213e, 0x1015: 0x2148, 0x1016: 0x214d, 0x1017: 0x2152,
+	0x1018: 0x2161, 0x1019: 0x2170, 0x101a: 0x2175, 0x101b: 0x4561, 0x101c: 0x4567, 0x101d: 0x459d,
+	0x101e: 0x45f4, 0x101f: 0x45fb, 0x1020: 0x4602, 0x1021: 0x4609, 0x1022: 0x4610, 0x1023: 0x4617,
+	0x1024: 0x26f6, 0x1025: 0x26fd, 0x1026: 0x2704, 0x1027: 0x270b, 0x1028: 0x2720, 0x1029: 0x2727,
+	0x102a: 0x1ec8, 0x102b: 0x1ecd, 0x102c: 0x1ed2, 0x102d: 0x1ed7, 0x102e: 0x1ee1, 0x102f: 0x1ee6,
+	0x1030: 0x1efa, 0x1031: 0x1eff, 0x1032: 0x1f04, 0x1033: 0x1f09, 0x1034: 0x1f13, 0x1035: 0x1f18,
+	0x1036: 0x1f22, 0x1037: 0x1f27, 0x1038: 0x1f2c, 0x1039: 0x1f31, 0x103a: 0x1f3b, 0x103b: 0x1f40,
+	0x103c: 0x206c, 0x103d: 0x2071, 0x103e: 0x2080, 0x103f: 0x2085,
+	// Block 0x41, offset 0x1040
+	0x1040: 0x208a, 0x1041: 0x209e, 0x1042: 0x20a3, 0x1043: 0x20a8, 0x1044: 0x20ad, 0x1045: 0x20c6,
+	0x1046: 0x20d0, 0x1047: 0x20d5, 0x1048: 0x20da, 0x1049: 0x20ee, 0x104a: 0x210c, 0x104b: 0x2111,
+	0x104c: 0x2116, 0x104d: 0x211b, 0x104e: 0x2125, 0x104f: 0x212a, 0x1050: 0x459d, 0x1051: 0x2157,
+	0x1052: 0x215c, 0x1053: 0x2161, 0x1054: 0x2166, 0x1055: 0x2170, 0x1056: 0x2175, 0x1057: 0x26e1,
+	0x1058: 0x26e8, 0x1059: 0x26ef, 0x105a: 0x2704, 0x105b: 0x2712, 0x105c: 0x1eb9, 0x105d: 0x1ebe,
+	0x105e: 0x1ec3, 0x105f: 0x1ed2, 0x1060: 0x1edc, 0x1061: 0x1eeb, 0x1062: 0x1ef0, 0x1063: 0x1ef5,
+	0x1064: 0x1f04, 0x1065: 0x1f0e, 0x1066: 0x1f2c, 0x1067: 0x1f45, 0x1068: 0x1f4a, 0x1069: 0x1f59,
+	0x106a: 0x1f5e, 0x106b: 0x1f6d, 0x106c: 0x1f77, 0x106d: 0x1f86, 0x106e: 0x1f8b, 0x106f: 0x1f90,
+	0x1070: 0x1f9a, 0x1071: 0x1fd6, 0x1072: 0x1fdb, 0x1073: 0x1fe5, 0x1074: 0x1ff4, 0x1075: 0x1ff9,
+	0x1076: 0x1ffe, 0x1077: 0x2008, 0x1078: 0x2017, 0x1079: 0x202b, 0x107a: 0x2030, 0x107b: 0x2035,
+	0x107c: 0x2044, 0x107d: 0x2049, 0x107e: 0x2058, 0x107f: 0x205d,
+	// Block 0x42, offset 0x1080
+	0x1080: 0x2062, 0x1081: 0x2067, 0x1082: 0x2076, 0x1083: 0x207b, 0x1084: 0x208f, 0x1085: 0x2094,
+	0x1086: 0x2099, 0x1087: 0x209e, 0x1088: 0x20a3, 0x1089: 0x20b7, 0x108a: 0x20bc, 0x108b: 0x20c1,
+	0x108c: 0x20c6, 0x108d: 0x20cb, 0x108e: 0x20df, 0x108f: 0x20e4, 0x1090: 0x20e9, 0x1091: 0x20ee,
+	0x1092: 0x20fd, 0x1093: 0x2102, 0x1094: 0x2107, 0x1095: 0x2116, 0x1096: 0x2120, 0x1097: 0x212f,
+	0x1098: 0x2134, 0x1099: 0x4591, 0x109a: 0x2148, 0x109b: 0x214d, 0x109c: 0x2152, 0x109d: 0x2161,
+	0x109e: 0x216b, 0x109f: 0x2704, 0x10a0: 0x2712, 0x10a1: 0x1ed2, 0x10a2: 0x1edc, 0x10a3: 0x1f04,
+	0x10a4: 0x1f0e, 0x10a5: 0x1f2c, 0x10a6: 0x1f36, 0x10a7: 0x1f9a, 0x10a8: 0x1f9f, 0x10a9: 0x1fc2,
+	0x10aa: 0x1fc7, 0x10ab: 0x209e, 0x10ac: 0x20a3, 0x10ad: 0x20c6, 0x10ae: 0x2116, 0x10af: 0x2120,
+	0x10b0: 0x2161, 0x10b1: 0x216b, 0x10b2: 0x4645, 0x10b3: 0x464d, 0x10b4: 0x4655, 0x10b5: 0x2021,
+	0x10b6: 0x2026, 0x10b7: 0x203a, 0x10b8: 0x203f, 0x10b9: 0x204e, 0x10ba: 0x2053, 0x10bb: 0x1fa4,
+	0x10bc: 0x1fa9, 0x10bd: 0x1fcc, 0x10be: 0x1fd1, 0x10bf: 0x1f63,
+	// Block 0x43, offset 0x10c0
+	0x10c0: 0x1f68, 0x10c1: 0x1f4f, 0x10c2: 0x1f54, 0x10c3: 0x1f7c, 0x10c4: 0x1f81, 0x10c5: 0x1fea,
+	0x10c6: 0x1fef, 0x10c7: 0x200d, 0x10c8: 0x2012, 0x10c9: 0x1fae, 0x10ca: 0x1fb3, 0x10cb: 0x1fb8,
+	0x10cc: 0x1fc2, 0x10cd: 0x1fbd, 0x10ce: 0x1f95, 0x10cf: 0x1fe0, 0x10d0: 0x2003, 0x10d1: 0x2021,
+	0x10d2: 0x2026, 0x10d3: 0x203a, 0x10d4: 0x203f, 0x10d5: 0x204e, 0x10d6: 0x2053, 0x10d7: 0x1fa4,
+	0x10d8: 0x1fa9, 0x10d9: 0x1fcc, 0x10da: 0x1fd1, 0x10db: 0x1f63, 0x10dc: 0x1f68, 0x10dd: 0x1f4f,
+	0x10de: 0x1f54, 0x10df: 0x1f7c, 0x10e0: 0x1f81, 0x10e1: 0x1fea, 0x10e2: 0x1fef, 0x10e3: 0x200d,
+	0x10e4: 0x2012, 0x10e5: 0x1fae, 0x10e6: 0x1fb3, 0x10e7: 0x1fb8, 0x10e8: 0x1fc2, 0x10e9: 0x1fbd,
+	0x10ea: 0x1f95, 0x10eb: 0x1fe0, 0x10ec: 0x2003, 0x10ed: 0x1fae, 0x10ee: 0x1fb3, 0x10ef: 0x1fb8,
+	0x10f0: 0x1fc2, 0x10f1: 0x1f9f, 0x10f2: 0x1fc7, 0x10f3: 0x201c, 0x10f4: 0x1f86, 0x10f5: 0x1f8b,
+	0x10f6: 0x1f90, 0x10f7: 0x1fae, 0x10f8: 0x1fb3, 0x10f9: 0x1fb8, 0x10fa: 0x201c, 0x10fb: 0x202b,
+	0x10fc: 0x4549, 0x10fd: 0x4549,
+	// Block 0x44, offset 0x1100
+	0x1110: 0x2441, 0x1111: 0x2456,
+	0x1112: 0x2456, 0x1113: 0x245d, 0x1114: 0x2464, 0x1115: 0x2479, 0x1116: 0x2480, 0x1117: 0x2487,
+	0x1118: 0x24aa, 0x1119: 0x24aa, 0x111a: 0x24cd, 0x111b: 0x24c6, 0x111c: 0x24e2, 0x111d: 0x24d4,
+	0x111e: 0x24db, 0x111f: 0x24fe, 0x1120: 0x24fe, 0x1121: 0x24f7, 0x1122: 0x2505, 0x1123: 0x2505,
+	0x1124: 0x252f, 0x1125: 0x252f, 0x1126: 0x254b, 0x1127: 0x2513, 0x1128: 0x2513, 0x1129: 0x250c,
+	0x112a: 0x2521, 0x112b: 0x2521, 0x112c: 0x2528, 0x112d: 0x2528, 0x112e: 0x2552, 0x112f: 0x2560,
+	0x1130: 0x2560, 0x1131: 0x2567, 0x1132: 0x2567, 0x1133: 0x256e, 0x1134: 0x2575, 0x1135: 0x257c,
+	0x1136: 0x2583, 0x1137: 0x2583, 0x1138: 0x258a, 0x1139: 0x2598, 0x113a: 0x25a6, 0x113b: 0x259f,
+	0x113c: 0x25ad, 0x113d: 0x25ad, 0x113e: 0x25c2, 0x113f: 0x25c9,
+	// Block 0x45, offset 0x1140
+	0x1140: 0x25fa, 0x1141: 0x2608, 0x1142: 0x2601, 0x1143: 0x25e5, 0x1144: 0x25e5, 0x1145: 0x260f,
+	0x1146: 0x260f, 0x1147: 0x2616, 0x1148: 0x2616, 0x1149: 0x2640, 0x114a: 0x2647, 0x114b: 0x264e,
+	0x114c: 0x2624, 0x114d: 0x2632, 0x114e: 0x2655, 0x114f: 0x265c,
+	0x1152: 0x262b, 0x1153: 0x26b0, 0x1154: 0x26b7, 0x1155: 0x268d, 0x1156: 0x2694, 0x1157: 0x2678,
+	0x1158: 0x2678, 0x1159: 0x267f, 0x115a: 0x26a9, 0x115b: 0x26a2, 0x115c: 0x26cc, 0x115d: 0x26cc,
+	0x115e: 0x243a, 0x115f: 0x244f, 0x1160: 0x2448, 0x1161: 0x2472, 0x1162: 0x246b, 0x1163: 0x2495,
+	0x1164: 0x248e, 0x1165: 0x24b8, 0x1166: 0x249c, 0x1167: 0x24b1, 0x1168: 0x24e9, 0x1169: 0x2536,
+	0x116a: 0x251a, 0x116b: 0x2559, 0x116c: 0x25f3, 0x116d: 0x261d, 0x116e: 0x26c5, 0x116f: 0x26be,
+	0x1170: 0x26d3, 0x1171: 0x266a, 0x1172: 0x25d0, 0x1173: 0x269b, 0x1174: 0x25c2, 0x1175: 0x25fa,
+	0x1176: 0x2591, 0x1177: 0x25de, 0x1178: 0x2671, 0x1179: 0x2663, 0x117a: 0x25ec, 0x117b: 0x25d7,
+	0x117c: 0x25ec, 0x117d: 0x2671, 0x117e: 0x24a3, 0x117f: 0x24bf,
+	// Block 0x46, offset 0x1180
+	0x1180: 0x2639, 0x1181: 0x25b4, 0x1182: 0x2433, 0x1183: 0x25d7, 0x1184: 0x257c, 0x1185: 0x254b,
+	0x1186: 0x24f0, 0x1187: 0x2686,
+	0x11b0: 0x2544, 0x11b1: 0x25bb, 0x11b2: 0x28f6, 0x11b3: 0x28ed, 0x11b4: 0x2923, 0x11b5: 0x2911,
+	0x11b6: 0x28ff, 0x11b7: 0x291a, 0x11b8: 0x292c, 0x11b9: 0x253d, 0x11ba: 0x2db3, 0x11bb: 0x2c33,
+	0x11bc: 0x2908,
+	// Block 0x47, offset 0x11c0
+	0x11d0: 0x0019, 0x11d1: 0x057e,
+	0x11d2: 0x0582, 0x11d3: 0x0035, 0x11d4: 0x0037, 0x11d5: 0x0003, 0x11d6: 0x003f, 0x11d7: 0x05ba,
+	0x11d8: 0x05be, 0x11d9: 0x1c8c,
+	0x11e0: 0x8133, 0x11e1: 0x8133, 0x11e2: 0x8133, 0x11e3: 0x8133,
+	0x11e4: 0x8133, 0x11e5: 0x8133, 0x11e6: 0x8133, 0x11e7: 0x812e, 0x11e8: 0x812e, 0x11e9: 0x812e,
+	0x11ea: 0x812e, 0x11eb: 0x812e, 0x11ec: 0x812e, 0x11ed: 0x812e, 0x11ee: 0x8133, 0x11ef: 0x8133,
+	0x11f0: 0x19a0, 0x11f1: 0x053a, 0x11f2: 0x0536, 0x11f3: 0x007f, 0x11f4: 0x007f, 0x11f5: 0x0011,
+	0x11f6: 0x0013, 0x11f7: 0x00b7, 0x11f8: 0x00bb, 0x11f9: 0x05b2, 0x11fa: 0x05b6, 0x11fb: 0x05a6,
+	0x11fc: 0x05aa, 0x11fd: 0x058e, 0x11fe: 0x0592, 0x11ff: 0x0586,
+	// Block 0x48, offset 0x1200
+	0x1200: 0x058a, 0x1201: 0x0596, 0x1202: 0x059a, 0x1203: 0x059e, 0x1204: 0x05a2,
+	0x1207: 0x0077, 0x1208: 0x007b, 0x1209: 0x43aa, 0x120a: 0x43aa, 0x120b: 0x43aa,
+	0x120c: 0x43aa, 0x120d: 0x007f, 0x120e: 0x007f, 0x120f: 0x007f, 0x1210: 0x0019, 0x1211: 0x057e,
+	0x1212: 0x001d, 0x1214: 0x0037, 0x1215: 0x0035, 0x1216: 0x003f, 0x1217: 0x0003,
+	0x1218: 0x053a, 0x1219: 0x0011, 0x121a: 0x0013, 0x121b: 0x00b7, 0x121c: 0x00bb, 0x121d: 0x05b2,
+	0x121e: 0x05b6, 0x121f: 0x0007, 0x1220: 0x000d, 0x1221: 0x0015, 0x1222: 0x0017, 0x1223: 0x001b,
+	0x1224: 0x0039, 0x1225: 0x003d, 0x1226: 0x003b, 0x1228: 0x0079, 0x1229: 0x0009,
+	0x122a: 0x000b, 0x122b: 0x0041,
+	0x1230: 0x43eb, 0x1231: 0x456d, 0x1232: 0x43f0, 0x1234: 0x43f5,
+	0x1236: 0x43fa, 0x1237: 0x4573, 0x1238: 0x43ff, 0x1239: 0x4579, 0x123a: 0x4404, 0x123b: 0x457f,
+	0x123c: 0x4409, 0x123d: 0x4585, 0x123e: 0x440e, 0x123f: 0x458b,
+	// Block 0x49, offset 0x1240
+	0x1240: 0x0329, 0x1241: 0x454f, 0x1242: 0x454f, 0x1243: 0x4555, 0x1244: 0x4555, 0x1245: 0x4597,
+	0x1246: 0x4597, 0x1247: 0x455b, 0x1248: 0x455b, 0x1249: 0x45a3, 0x124a: 0x45a3, 0x124b: 0x45a3,
+	0x124c: 0x45a3, 0x124d: 0x032c, 0x124e: 0x032c, 0x124f: 0x032f, 0x1250: 0x032f, 0x1251: 0x032f,
+	0x1252: 0x032f, 0x1253: 0x0332, 0x1254: 0x0332, 0x1255: 0x0335, 0x1256: 0x0335, 0x1257: 0x0335,
+	0x1258: 0x0335, 0x1259: 0x0338, 0x125a: 0x0338, 0x125b: 0x0338, 0x125c: 0x0338, 0x125d: 0x033b,
+	0x125e: 0x033b, 0x125f: 0x033b, 0x1260: 0x033b, 0x1261: 0x033e, 0x1262: 0x033e, 0x1263: 0x033e,
+	0x1264: 0x033e, 0x1265: 0x0341, 0x1266: 0x0341, 0x1267: 0x0341, 0x1268: 0x0341, 0x1269: 0x0344,
+	0x126a: 0x0344, 0x126b: 0x0347, 0x126c: 0x0347, 0x126d: 0x034a, 0x126e: 0x034a, 0x126f: 0x034d,
+	0x1270: 0x034d, 0x1271: 0x0350, 0x1272: 0x0350, 0x1273: 0x0350, 0x1274: 0x0350, 0x1275: 0x0353,
+	0x1276: 0x0353, 0x1277: 0x0353, 0x1278: 0x0353, 0x1279: 0x0356, 0x127a: 0x0356, 0x127b: 0x0356,
+	0x127c: 0x0356, 0x127d: 0x0359, 0x127e: 0x0359, 0x127f: 0x0359,
+	// Block 0x4a, offset 0x1280
+	0x1280: 0x0359, 0x1281: 0x035c, 0x1282: 0x035c, 0x1283: 0x035c, 0x1284: 0x035c, 0x1285: 0x035f,
+	0x1286: 0x035f, 0x1287: 0x035f, 0x1288: 0x035f, 0x1289: 0x0362, 0x128a: 0x0362, 0x128b: 0x0362,
+	0x128c: 0x0362, 0x128d: 0x0365, 0x128e: 0x0365, 0x128f: 0x0365, 0x1290: 0x0365, 0x1291: 0x0368,
+	0x1292: 0x0368, 0x1293: 0x0368, 0x1294: 0x0368, 0x1295: 0x036b, 0x1296: 0x036b, 0x1297: 0x036b,
+	0x1298: 0x036b, 0x1299: 0x036e, 0x129a: 0x036e, 0x129b: 0x036e, 0x129c: 0x036e, 0x129d: 0x0371,
+	0x129e: 0x0371, 0x129f: 0x0371, 0x12a0: 0x0371, 0x12a1: 0x0374, 0x12a2: 0x0374, 0x12a3: 0x0374,
+	0x12a4: 0x0374, 0x12a5: 0x0377, 0x12a6: 0x0377, 0x12a7: 0x0377, 0x12a8: 0x0377, 0x12a9: 0x037a,
+	0x12aa: 0x037a, 0x12ab: 0x037a, 0x12ac: 0x037a, 0x12ad: 0x037d, 0x12ae: 0x037d, 0x12af: 0x0380,
+	0x12b0: 0x0380, 0x12b1: 0x0383, 0x12b2: 0x0383, 0x12b3: 0x0383, 0x12b4: 0x0383, 0x12b5: 0x2f41,
+	0x12b6: 0x2f41, 0x12b7: 0x2f49, 0x12b8: 0x2f49, 0x12b9: 0x2f51, 0x12ba: 0x2f51, 0x12bb: 0x20b2,
+	0x12bc: 0x20b2,
+	// Block 0x4b, offset 0x12c0
+	0x12c0: 0x0081, 0x12c1: 0x0083, 0x12c2: 0x0085, 0x12c3: 0x0087, 0x12c4: 0x0089, 0x12c5: 0x008b,
+	0x12c6: 0x008d, 0x12c7: 0x008f, 0x12c8: 0x0091, 0x12c9: 0x0093, 0x12ca: 0x0095, 0x12cb: 0x0097,
+	0x12cc: 0x0099, 0x12cd: 0x009b, 0x12ce: 0x009d, 0x12cf: 0x009f, 0x12d0: 0x00a1, 0x12d1: 0x00a3,
+	0x12d2: 0x00a5, 0x12d3: 0x00a7, 0x12d4: 0x00a9, 0x12d5: 0x00ab, 0x12d6: 0x00ad, 0x12d7: 0x00af,
+	0x12d8: 0x00b1, 0x12d9: 0x00b3, 0x12da: 0x00b5, 0x12db: 0x00b7, 0x12dc: 0x00b9, 0x12dd: 0x00bb,
+	0x12de: 0x00bd, 0x12df: 0x056e, 0x12e0: 0x0572, 0x12e1: 0x0582, 0x12e2: 0x0596, 0x12e3: 0x059a,
+	0x12e4: 0x057e, 0x12e5: 0x06a6, 0x12e6: 0x069e, 0x12e7: 0x05c2, 0x12e8: 0x05ca, 0x12e9: 0x05d2,
+	0x12ea: 0x05da, 0x12eb: 0x05e2, 0x12ec: 0x0666, 0x12ed: 0x066e, 0x12ee: 0x0676, 0x12ef: 0x061a,
+	0x12f0: 0x06aa, 0x12f1: 0x05c6, 0x12f2: 0x05ce, 0x12f3: 0x05d6, 0x12f4: 0x05de, 0x12f5: 0x05e6,
+	0x12f6: 0x05ea, 0x12f7: 0x05ee, 0x12f8: 0x05f2, 0x12f9: 0x05f6, 0x12fa: 0x05fa, 0x12fb: 0x05fe,
+	0x12fc: 0x0602, 0x12fd: 0x0606, 0x12fe: 0x060a, 0x12ff: 0x060e,
+	// Block 0x4c, offset 0x1300
+	0x1300: 0x0612, 0x1301: 0x0616, 0x1302: 0x061e, 0x1303: 0x0622, 0x1304: 0x0626, 0x1305: 0x062a,
+	0x1306: 0x062e, 0x1307: 0x0632, 0x1308: 0x0636, 0x1309: 0x063a, 0x130a: 0x063e, 0x130b: 0x0642,
+	0x130c: 0x0646, 0x130d: 0x064a, 0x130e: 0x064e, 0x130f: 0x0652, 0x1310: 0x0656, 0x1311: 0x065a,
+	0x1312: 0x065e, 0x1313: 0x0662, 0x1314: 0x066a, 0x1315: 0x0672, 0x1316: 0x067a, 0x1317: 0x067e,
+	0x1318: 0x0682, 0x1319: 0x0686, 0x131a: 0x068a, 0x131b: 0x068e, 0x131c: 0x0692, 0x131d: 0x06a2,
+	0x131e: 0x4bb9, 0x131f: 0x4bbf, 0x1320: 0x04b6, 0x1321: 0x0406, 0x1322: 0x040a, 0x1323: 0x4b7c,
+	0x1324: 0x040e, 0x1325: 0x4b82, 0x1326: 0x4b88, 0x1327: 0x0412, 0x1328: 0x0416, 0x1329: 0x041a,
+	0x132a: 0x4b8e, 0x132b: 0x4b94, 0x132c: 0x4b9a, 0x132d: 0x4ba0, 0x132e: 0x4ba6, 0x132f: 0x4bac,
+	0x1330: 0x045a, 0x1331: 0x041e, 0x1332: 0x0422, 0x1333: 0x0426, 0x1334: 0x046e, 0x1335: 0x042a,
+	0x1336: 0x042e, 0x1337: 0x0432, 0x1338: 0x0436, 0x1339: 0x043a, 0x133a: 0x043e, 0x133b: 0x0442,
+	0x133c: 0x0446, 0x133d: 0x044a, 0x133e: 0x044e,
+	// Block 0x4d, offset 0x1340
+	0x1342: 0x4afe, 0x1343: 0x4b04, 0x1344: 0x4b0a, 0x1345: 0x4b10,
+	0x1346: 0x4b16, 0x1347: 0x4b1c, 0x134a: 0x4b22, 0x134b: 0x4b28,
+	0x134c: 0x4b2e, 0x134d: 0x4b34, 0x134e: 0x4b3a, 0x134f: 0x4b40,
+	0x1352: 0x4b46, 0x1353: 0x4b4c, 0x1354: 0x4b52, 0x1355: 0x4b58, 0x1356: 0x4b5e, 0x1357: 0x4b64,
+	0x135a: 0x4b6a, 0x135b: 0x4b70, 0x135c: 0x4b76,
+	0x1360: 0x00bf, 0x1361: 0x00c2, 0x1362: 0x00cb, 0x1363: 0x43a5,
+	0x1364: 0x00c8, 0x1365: 0x00c5, 0x1366: 0x053e, 0x1368: 0x0562, 0x1369: 0x0542,
+	0x136a: 0x0546, 0x136b: 0x054a, 0x136c: 0x054e, 0x136d: 0x0566, 0x136e: 0x056a,
+	// Block 0x4e, offset 0x1380
+	0x1381: 0x01f1, 0x1382: 0x01f4, 0x1383: 0x00d4, 0x1384: 0x01be, 0x1385: 0x010d,
+	0x1387: 0x01d3, 0x1388: 0x174e, 0x1389: 0x01d9, 0x138a: 0x01d6, 0x138b: 0x0116,
+	0x138c: 0x0119, 0x138d: 0x0526, 0x138e: 0x011c, 0x138f: 0x0128, 0x1390: 0x01e5, 0x1391: 0x013a,
+	0x1392: 0x0134, 0x1393: 0x012e, 0x1394: 0x01c1, 0x1395: 0x00e0, 0x1396: 0x01c4, 0x1397: 0x0143,
+	0x1398: 0x0194, 0x1399: 0x01e8, 0x139a: 0x01eb, 0x139b: 0x0152, 0x139c: 0x1756, 0x139d: 0x1742,
+	0x139e: 0x0158, 0x139f: 0x175b, 0x13a0: 0x01a9, 0x13a1: 0x1760, 0x13a2: 0x00da, 0x13a3: 0x0170,
+	0x13a4: 0x0173, 0x13a5: 0x00a3, 0x13a6: 0x017c, 0x13a7: 0x1765, 0x13a8: 0x0182, 0x13a9: 0x0185,
+	0x13aa: 0x0188, 0x13ab: 0x01e2, 0x13ac: 0x01dc, 0x13ad: 0x1752, 0x13ae: 0x01df, 0x13af: 0x0197,
+	0x13b0: 0x0576, 0x13b2: 0x01ac, 0x13b3: 0x01cd, 0x13b4: 0x01d0, 0x13b5: 0x01bb,
+	0x13b6: 0x00f5, 0x13b7: 0x00f8, 0x13b8: 0x00fb, 0x13b9: 0x176a, 0x13ba: 0x176f,
+	// Block 0x4f, offset 0x13c0
+	0x13c0: 0x0063, 0x13c1: 0x0065, 0x13c2: 0x0067, 0x13c3: 0x0069, 0x13c4: 0x006b, 0x13c5: 0x006d,
+	0x13c6: 0x006f, 0x13c7: 0x0071, 0x13c8: 0x0073, 0x13c9: 0x0075, 0x13ca: 0x0083, 0x13cb: 0x0085,
+	0x13cc: 0x0087, 0x13cd: 0x0089, 0x13ce: 0x008b, 0x13cf: 0x008d, 0x13d0: 0x008f, 0x13d1: 0x0091,
+	0x13d2: 0x0093, 0x13d3: 0x0095, 0x13d4: 0x0097, 0x13d5: 0x0099, 0x13d6: 0x009b, 0x13d7: 0x009d,
+	0x13d8: 0x009f, 0x13d9: 0x00a1, 0x13da: 0x00a3, 0x13db: 0x00a5, 0x13dc: 0x00a7, 0x13dd: 0x00a9,
+	0x13de: 0x00ab, 0x13df: 0x00ad, 0x13e0: 0x00af, 0x13e1: 0x00b1, 0x13e2: 0x00b3, 0x13e3: 0x00b5,
+	0x13e4: 0x00e3, 0x13e5: 0x0101, 0x13e8: 0x01f7, 0x13e9: 0x01fa,
+	0x13ea: 0x01fd, 0x13eb: 0x0200, 0x13ec: 0x0203, 0x13ed: 0x0206, 0x13ee: 0x0209, 0x13ef: 0x020c,
+	0x13f0: 0x020f, 0x13f1: 0x0212, 0x13f2: 0x0215, 0x13f3: 0x0218, 0x13f4: 0x021b, 0x13f5: 0x021e,
+	0x13f6: 0x0221, 0x13f7: 0x0224, 0x13f8: 0x0227, 0x13f9: 0x020c, 0x13fa: 0x022a, 0x13fb: 0x022d,
+	0x13fc: 0x0230, 0x13fd: 0x0233, 0x13fe: 0x0236, 0x13ff: 0x0239,
+	// Block 0x50, offset 0x1400
+	0x1400: 0x0281, 0x1401: 0x0284, 0x1402: 0x0287, 0x1403: 0x0552, 0x1404: 0x024b, 0x1405: 0x0254,
+	0x1406: 0x025a, 0x1407: 0x027e, 0x1408: 0x026f, 0x1409: 0x026c, 0x140a: 0x028a, 0x140b: 0x028d,
+	0x140e: 0x0021, 0x140f: 0x0023, 0x1410: 0x0025, 0x1411: 0x0027,
+	0x1412: 0x0029, 0x1413: 0x002b, 0x1414: 0x002d, 0x1415: 0x002f, 0x1416: 0x0031, 0x1417: 0x0033,
+	0x1418: 0x0021, 0x1419: 0x0023, 0x141a: 0x0025, 0x141b: 0x0027, 0x141c: 0x0029, 0x141d: 0x002b,
+	0x141e: 0x002d, 0x141f: 0x002f, 0x1420: 0x0031, 0x1421: 0x0033, 0x1422: 0x0021, 0x1423: 0x0023,
+	0x1424: 0x0025, 0x1425: 0x0027, 0x1426: 0x0029, 0x1427: 0x002b, 0x1428: 0x002d, 0x1429: 0x002f,
+	0x142a: 0x0031, 0x142b: 0x0033, 0x142c: 0x0021, 0x142d: 0x0023, 0x142e: 0x0025, 0x142f: 0x0027,
+	0x1430: 0x0029, 0x1431: 0x002b, 0x1432: 0x002d, 0x1433: 0x002f, 0x1434: 0x0031, 0x1435: 0x0033,
+	0x1436: 0x0021, 0x1437: 0x0023, 0x1438: 0x0025, 0x1439: 0x0027, 0x143a: 0x0029, 0x143b: 0x002b,
+	0x143c: 0x002d, 0x143d: 0x002f, 0x143e: 0x0031, 0x143f: 0x0033,
+	// Block 0x51, offset 0x1440
+	0x1440: 0x8133, 0x1441: 0x8133, 0x1442: 0x8133, 0x1443: 0x8133, 0x1444: 0x8133, 0x1445: 0x8133,
+	0x1446: 0x8133, 0x1448: 0x8133, 0x1449: 0x8133, 0x144a: 0x8133, 0x144b: 0x8133,
+	0x144c: 0x8133, 0x144d: 0x8133, 0x144e: 0x8133, 0x144f: 0x8133, 0x1450: 0x8133, 0x1451: 0x8133,
+	0x1452: 0x8133, 0x1453: 0x8133, 0x1454: 0x8133, 0x1455: 0x8133, 0x1456: 0x8133, 0x1457: 0x8133,
+	0x1458: 0x8133, 0x145b: 0x8133, 0x145c: 0x8133, 0x145d: 0x8133,
+	0x145e: 0x8133, 0x145f: 0x8133, 0x1460: 0x8133, 0x1461: 0x8133, 0x1463: 0x8133,
+	0x1464: 0x8133, 0x1466: 0x8133, 0x1467: 0x8133, 0x1468: 0x8133, 0x1469: 0x8133,
+	0x146a: 0x8133,
+	0x1470: 0x0290, 0x1471: 0x0293, 0x1472: 0x0296, 0x1473: 0x0299, 0x1474: 0x029c, 0x1475: 0x029f,
+	0x1476: 0x02a2, 0x1477: 0x02a5, 0x1478: 0x02a8, 0x1479: 0x02ab, 0x147a: 0x02ae, 0x147b: 0x02b1,
+	0x147c: 0x02b7, 0x147d: 0x02ba, 0x147e: 0x02bd, 0x147f: 0x02c0,
+	// Block 0x52, offset 0x1480
+	0x1480: 0x02c3, 0x1481: 0x02c6, 0x1482: 0x02c9, 0x1483: 0x02cc, 0x1484: 0x02cf, 0x1485: 0x02d2,
+	0x1486: 0x02d5, 0x1487: 0x02db, 0x1488: 0x02e1, 0x1489: 0x02e4, 0x148a: 0x1736, 0x148b: 0x0302,
+	0x148c: 0x02ea, 0x148d: 0x02ed, 0x148e: 0x0305, 0x148f: 0x02f9, 0x1490: 0x02ff, 0x1491: 0x0290,
+	0x1492: 0x0293, 0x1493: 0x0296, 0x1494: 0x0299, 0x1495: 0x029c, 0x1496: 0x029f, 0x1497: 0x02a2,
+	0x1498: 0x02a5, 0x1499: 0x02a8, 0x149a: 0x02ab, 0x149b: 0x02ae, 0x149c: 0x02b7, 0x149d: 0x02ba,
+	0x149e: 0x02c0, 0x149f: 0x02c6, 0x14a0: 0x02c9, 0x14a1: 0x02cc, 0x14a2: 0x02cf, 0x14a3: 0x02d2,
+	0x14a4: 0x02d5, 0x14a5: 0x02d8, 0x14a6: 0x02db, 0x14a7: 0x02f3, 0x14a8: 0x02ea, 0x14a9: 0x02e7,
+	0x14aa: 0x02f0, 0x14ab: 0x02f6, 0x14ac: 0x1732, 0x14ad: 0x02fc,
+	// Block 0x53, offset 0x14c0
+	0x14c0: 0x032c, 0x14c1: 0x032f, 0x14c2: 0x033b, 0x14c3: 0x0344, 0x14c5: 0x037d,
+	0x14c6: 0x034d, 0x14c7: 0x033e, 0x14c8: 0x035c, 0x14c9: 0x0383, 0x14ca: 0x036e, 0x14cb: 0x0371,
+	0x14cc: 0x0374, 0x14cd: 0x0377, 0x14ce: 0x0350, 0x14cf: 0x0362, 0x14d0: 0x0368, 0x14d1: 0x0356,
+	0x14d2: 0x036b, 0x14d3: 0x034a, 0x14d4: 0x0353, 0x14d5: 0x0335, 0x14d6: 0x0338, 0x14d7: 0x0341,
+	0x14d8: 0x0347, 0x14d9: 0x0359, 0x14da: 0x035f, 0x14db: 0x0365, 0x14dc: 0x0386, 0x14dd: 0x03d7,
+	0x14de: 0x03bf, 0x14df: 0x0389, 0x14e1: 0x032f, 0x14e2: 0x033b,
+	0x14e4: 0x037a, 0x14e7: 0x033e, 0x14e9: 0x0383,
+	0x14ea: 0x036e, 0x14eb: 0x0371, 0x14ec: 0x0374, 0x14ed: 0x0377, 0x14ee: 0x0350, 0x14ef: 0x0362,
+	0x14f0: 0x0368, 0x14f1: 0x0356, 0x14f2: 0x036b, 0x14f4: 0x0353, 0x14f5: 0x0335,
+	0x14f6: 0x0338, 0x14f7: 0x0341, 0x14f9: 0x0359, 0x14fb: 0x0365,
+	// Block 0x54, offset 0x1500
+	0x1502: 0x033b,
+	0x1507: 0x033e, 0x1509: 0x0383, 0x150b: 0x0371,
+	0x150d: 0x0377, 0x150e: 0x0350, 0x150f: 0x0362, 0x1511: 0x0356,
+	0x1512: 0x036b, 0x1514: 0x0353, 0x1517: 0x0341,
+	0x1519: 0x0359, 0x151b: 0x0365, 0x151d: 0x03d7,
+	0x151f: 0x0389, 0x1521: 0x032f, 0x1522: 0x033b,
+	0x1524: 0x037a, 0x1527: 0x033e, 0x1528: 0x035c, 0x1529: 0x0383,
+	0x152a: 0x036e, 0x152c: 0x0374, 0x152d: 0x0377, 0x152e: 0x0350, 0x152f: 0x0362,
+	0x1530: 0x0368, 0x1531: 0x0356, 0x1532: 0x036b, 0x1534: 0x0353, 0x1535: 0x0335,
+	0x1536: 0x0338, 0x1537: 0x0341, 0x1539: 0x0359, 0x153a: 0x035f, 0x153b: 0x0365,
+	0x153c: 0x0386, 0x153e: 0x03bf,
+	// Block 0x55, offset 0x1540
+	0x1540: 0x032c, 0x1541: 0x032f, 0x1542: 0x033b, 0x1543: 0x0344, 0x1544: 0x037a, 0x1545: 0x037d,
+	0x1546: 0x034d, 0x1547: 0x033e, 0x1548: 0x035c, 0x1549: 0x0383, 0x154b: 0x0371,
+	0x154c: 0x0374, 0x154d: 0x0377, 0x154e: 0x0350, 0x154f: 0x0362, 0x1550: 0x0368, 0x1551: 0x0356,
+	0x1552: 0x036b, 0x1553: 0x034a, 0x1554: 0x0353, 0x1555: 0x0335, 0x1556: 0x0338, 0x1557: 0x0341,
+	0x1558: 0x0347, 0x1559: 0x0359, 0x155a: 0x035f, 0x155b: 0x0365,
+	0x1561: 0x032f, 0x1562: 0x033b, 0x1563: 0x0344,
+	0x1565: 0x037d, 0x1566: 0x034d, 0x1567: 0x033e, 0x1568: 0x035c, 0x1569: 0x0383,
+	0x156b: 0x0371, 0x156c: 0x0374, 0x156d: 0x0377, 0x156e: 0x0350, 0x156f: 0x0362,
+	0x1570: 0x0368, 0x1571: 0x0356, 0x1572: 0x036b, 0x1573: 0x034a, 0x1574: 0x0353, 0x1575: 0x0335,
+	0x1576: 0x0338, 0x1577: 0x0341, 0x1578: 0x0347, 0x1579: 0x0359, 0x157a: 0x035f, 0x157b: 0x0365,
+	// Block 0x56, offset 0x1580
+	0x1580: 0x19a6, 0x1581: 0x19a3, 0x1582: 0x19a9, 0x1583: 0x19cd, 0x1584: 0x19f1, 0x1585: 0x1a15,
+	0x1586: 0x1a39, 0x1587: 0x1a42, 0x1588: 0x1a48, 0x1589: 0x1a4e, 0x158a: 0x1a54,
+	0x1590: 0x1bbc, 0x1591: 0x1bc0,
+	0x1592: 0x1bc4, 0x1593: 0x1bc8, 0x1594: 0x1bcc, 0x1595: 0x1bd0, 0x1596: 0x1bd4, 0x1597: 0x1bd8,
+	0x1598: 0x1bdc, 0x1599: 0x1be0, 0x159a: 0x1be4, 0x159b: 0x1be8, 0x159c: 0x1bec, 0x159d: 0x1bf0,
+	0x159e: 0x1bf4, 0x159f: 0x1bf8, 0x15a0: 0x1bfc, 0x15a1: 0x1c00, 0x15a2: 0x1c04, 0x15a3: 0x1c08,
+	0x15a4: 0x1c0c, 0x15a5: 0x1c10, 0x15a6: 0x1c14, 0x15a7: 0x1c18, 0x15a8: 0x1c1c, 0x15a9: 0x1c20,
+	0x15aa: 0x2855, 0x15ab: 0x0047, 0x15ac: 0x0065, 0x15ad: 0x1a69, 0x15ae: 0x1ae1,
+	0x15b0: 0x0043, 0x15b1: 0x0045, 0x15b2: 0x0047, 0x15b3: 0x0049, 0x15b4: 0x004b, 0x15b5: 0x004d,
+	0x15b6: 0x004f, 0x15b7: 0x0051, 0x15b8: 0x0053, 0x15b9: 0x0055, 0x15ba: 0x0057, 0x15bb: 0x0059,
+	0x15bc: 0x005b, 0x15bd: 0x005d, 0x15be: 0x005f, 0x15bf: 0x0061,
+	// Block 0x57, offset 0x15c0
+	0x15c0: 0x27dd, 0x15c1: 0x27f2, 0x15c2: 0x05fe,
+	0x15d0: 0x0d0a, 0x15d1: 0x0b42,
+	0x15d2: 0x09ce, 0x15d3: 0x4705, 0x15d4: 0x0816, 0x15d5: 0x0aea, 0x15d6: 0x142a, 0x15d7: 0x0afa,
+	0x15d8: 0x0822, 0x15d9: 0x0dd2, 0x15da: 0x0faa, 0x15db: 0x0daa, 0x15dc: 0x0922, 0x15dd: 0x0c66,
+	0x15de: 0x08ba, 0x15df: 0x0db2, 0x15e0: 0x090e, 0x15e1: 0x1212, 0x15e2: 0x107e, 0x15e3: 0x1486,
+	0x15e4: 0x0ace, 0x15e5: 0x0a06, 0x15e6: 0x0f5e, 0x15e7: 0x0d16, 0x15e8: 0x0d42, 0x15e9: 0x07ba,
+	0x15ea: 0x07c6, 0x15eb: 0x1506, 0x15ec: 0x0bd6, 0x15ed: 0x07e2, 0x15ee: 0x09ea, 0x15ef: 0x0d36,
+	0x15f0: 0x14ae, 0x15f1: 0x0d0e, 0x15f2: 0x116a, 0x15f3: 0x11a6, 0x15f4: 0x09f2, 0x15f5: 0x0f3e,
+	0x15f6: 0x0e06, 0x15f7: 0x0e02, 0x15f8: 0x1092, 0x15f9: 0x0926, 0x15fa: 0x0a52, 0x15fb: 0x153e,
+	// Block 0x58, offset 0x1600
+	0x1600: 0x07f6, 0x1601: 0x07ee, 0x1602: 0x07fe, 0x1603: 0x1774, 0x1604: 0x0842, 0x1605: 0x0852,
+	0x1606: 0x0856, 0x1607: 0x085e, 0x1608: 0x0866, 0x1609: 0x086a, 0x160a: 0x0876, 0x160b: 0x086e,
+	0x160c: 0x06ae, 0x160d: 0x1788, 0x160e: 0x088a, 0x160f: 0x088e, 0x1610: 0x0892, 0x1611: 0x08ae,
+	0x1612: 0x1779, 0x1613: 0x06b2, 0x1614: 0x089a, 0x1615: 0x08ba, 0x1616: 0x1783, 0x1617: 0x08ca,
+	0x1618: 0x08d2, 0x1619: 0x0832, 0x161a: 0x08da, 0x161b: 0x08de, 0x161c: 0x195e, 0x161d: 0x08fa,
+	0x161e: 0x0902, 0x161f: 0x06ba, 0x1620: 0x091a, 0x1621: 0x091e, 0x1622: 0x0926, 0x1623: 0x092a,
+	0x1624: 0x06be, 0x1625: 0x0942, 0x1626: 0x0946, 0x1627: 0x0952, 0x1628: 0x095e, 0x1629: 0x0962,
+	0x162a: 0x0966, 0x162b: 0x096e, 0x162c: 0x098e, 0x162d: 0x0992, 0x162e: 0x099a, 0x162f: 0x09aa,
+	0x1630: 0x09b2, 0x1631: 0x09b6, 0x1632: 0x09b6, 0x1633: 0x09b6, 0x1634: 0x1797, 0x1635: 0x0f8e,
+	0x1636: 0x09ca, 0x1637: 0x09d2, 0x1638: 0x179c, 0x1639: 0x09de, 0x163a: 0x09e6, 0x163b: 0x09ee,
+	0x163c: 0x0a16, 0x163d: 0x0a02, 0x163e: 0x0a0e, 0x163f: 0x0a12,
+	// Block 0x59, offset 0x1640
+	0x1640: 0x0a1a, 0x1641: 0x0a22, 0x1642: 0x0a26, 0x1643: 0x0a2e, 0x1644: 0x0a36, 0x1645: 0x0a3a,
+	0x1646: 0x0a3a, 0x1647: 0x0a42, 0x1648: 0x0a4a, 0x1649: 0x0a4e, 0x164a: 0x0a5a, 0x164b: 0x0a7e,
+	0x164c: 0x0a62, 0x164d: 0x0a82, 0x164e: 0x0a66, 0x164f: 0x0a6e, 0x1650: 0x0906, 0x1651: 0x0aca,
+	0x1652: 0x0a92, 0x1653: 0x0a96, 0x1654: 0x0a9a, 0x1655: 0x0a8e, 0x1656: 0x0aa2, 0x1657: 0x0a9e,
+	0x1658: 0x0ab6, 0x1659: 0x17a1, 0x165a: 0x0ad2, 0x165b: 0x0ad6, 0x165c: 0x0ade, 0x165d: 0x0aea,
+	0x165e: 0x0af2, 0x165f: 0x0b0e, 0x1660: 0x17a6, 0x1661: 0x17ab, 0x1662: 0x0b1a, 0x1663: 0x0b1e,
+	0x1664: 0x0b22, 0x1665: 0x0b16, 0x1666: 0x0b2a, 0x1667: 0x06c2, 0x1668: 0x06c6, 0x1669: 0x0b32,
+	0x166a: 0x0b3a, 0x166b: 0x0b3a, 0x166c: 0x17b0, 0x166d: 0x0b56, 0x166e: 0x0b5a, 0x166f: 0x0b5e,
+	0x1670: 0x0b66, 0x1671: 0x17b5, 0x1672: 0x0b6e, 0x1673: 0x0b72, 0x1674: 0x0c4a, 0x1675: 0x0b7a,
+	0x1676: 0x06ca, 0x1677: 0x0b86, 0x1678: 0x0b96, 0x1679: 0x0ba2, 0x167a: 0x0b9e, 0x167b: 0x17bf,
+	0x167c: 0x0baa, 0x167d: 0x17c4, 0x167e: 0x0bb6, 0x167f: 0x0bb2,
+	// Block 0x5a, offset 0x1680
+	0x1680: 0x0bba, 0x1681: 0x0bca, 0x1682: 0x0bce, 0x1683: 0x06ce, 0x1684: 0x0bde, 0x1685: 0x0be6,
+	0x1686: 0x0bea, 0x1687: 0x0bee, 0x1688: 0x06d2, 0x1689: 0x17c9, 0x168a: 0x06d6, 0x168b: 0x0c0a,
+	0x168c: 0x0c0e, 0x168d: 0x0c12, 0x168e: 0x0c1a, 0x168f: 0x1990, 0x1690: 0x0c32, 0x1691: 0x17d3,
+	0x1692: 0x17d3, 0x1693: 0x12d2, 0x1694: 0x0c42, 0x1695: 0x0c42, 0x1696: 0x06da, 0x1697: 0x17f6,
+	0x1698: 0x18c8, 0x1699: 0x0c52, 0x169a: 0x0c5a, 0x169b: 0x06de, 0x169c: 0x0c6e, 0x169d: 0x0c7e,
+	0x169e: 0x0c82, 0x169f: 0x0c8a, 0x16a0: 0x0c9a, 0x16a1: 0x06e6, 0x16a2: 0x06e2, 0x16a3: 0x0c9e,
+	0x16a4: 0x17d8, 0x16a5: 0x0ca2, 0x16a6: 0x0cb6, 0x16a7: 0x0cba, 0x16a8: 0x0cbe, 0x16a9: 0x0cba,
+	0x16aa: 0x0cca, 0x16ab: 0x0cce, 0x16ac: 0x0cde, 0x16ad: 0x0cd6, 0x16ae: 0x0cda, 0x16af: 0x0ce2,
+	0x16b0: 0x0ce6, 0x16b1: 0x0cea, 0x16b2: 0x0cf6, 0x16b3: 0x0cfa, 0x16b4: 0x0d12, 0x16b5: 0x0d1a,
+	0x16b6: 0x0d2a, 0x16b7: 0x0d3e, 0x16b8: 0x17e7, 0x16b9: 0x0d3a, 0x16ba: 0x0d2e, 0x16bb: 0x0d46,
+	0x16bc: 0x0d4e, 0x16bd: 0x0d62, 0x16be: 0x17ec, 0x16bf: 0x0d6a,
+	// Block 0x5b, offset 0x16c0
+	0x16c0: 0x0d5e, 0x16c1: 0x0d56, 0x16c2: 0x06ea, 0x16c3: 0x0d72, 0x16c4: 0x0d7a, 0x16c5: 0x0d82,
+	0x16c6: 0x0d76, 0x16c7: 0x06ee, 0x16c8: 0x0d92, 0x16c9: 0x0d9a, 0x16ca: 0x17f1, 0x16cb: 0x0dc6,
+	0x16cc: 0x0dfa, 0x16cd: 0x0dd6, 0x16ce: 0x06fa, 0x16cf: 0x0de2, 0x16d0: 0x06f6, 0x16d1: 0x06f2,
+	0x16d2: 0x08be, 0x16d3: 0x08c2, 0x16d4: 0x0dfe, 0x16d5: 0x0de6, 0x16d6: 0x12a6, 0x16d7: 0x075e,
+	0x16d8: 0x0e0a, 0x16d9: 0x0e0e, 0x16da: 0x0e12, 0x16db: 0x0e26, 0x16dc: 0x0e1e, 0x16dd: 0x180a,
+	0x16de: 0x06fe, 0x16df: 0x0e3a, 0x16e0: 0x0e2e, 0x16e1: 0x0e4a, 0x16e2: 0x0e52, 0x16e3: 0x1814,
+	0x16e4: 0x0e56, 0x16e5: 0x0e42, 0x16e6: 0x0e5e, 0x16e7: 0x0702, 0x16e8: 0x0e62, 0x16e9: 0x0e66,
+	0x16ea: 0x0e6a, 0x16eb: 0x0e76, 0x16ec: 0x1819, 0x16ed: 0x0e7e, 0x16ee: 0x0706, 0x16ef: 0x0e8a,
+	0x16f0: 0x181e, 0x16f1: 0x0e8e, 0x16f2: 0x070a, 0x16f3: 0x0e9a, 0x16f4: 0x0ea6, 0x16f5: 0x0eb2,
+	0x16f6: 0x0eb6, 0x16f7: 0x1823, 0x16f8: 0x17ba, 0x16f9: 0x1828, 0x16fa: 0x0ed6, 0x16fb: 0x182d,
+	0x16fc: 0x0ee2, 0x16fd: 0x0eea, 0x16fe: 0x0eda, 0x16ff: 0x0ef6,
+	// Block 0x5c, offset 0x1700
+	0x1700: 0x0f06, 0x1701: 0x0f16, 0x1702: 0x0f0a, 0x1703: 0x0f0e, 0x1704: 0x0f1a, 0x1705: 0x0f1e,
+	0x1706: 0x1832, 0x1707: 0x0f02, 0x1708: 0x0f36, 0x1709: 0x0f3a, 0x170a: 0x070e, 0x170b: 0x0f4e,
+	0x170c: 0x0f4a, 0x170d: 0x1837, 0x170e: 0x0f2e, 0x170f: 0x0f6a, 0x1710: 0x183c, 0x1711: 0x1841,
+	0x1712: 0x0f6e, 0x1713: 0x0f82, 0x1714: 0x0f7e, 0x1715: 0x0f7a, 0x1716: 0x0712, 0x1717: 0x0f86,
+	0x1718: 0x0f96, 0x1719: 0x0f92, 0x171a: 0x0f9e, 0x171b: 0x177e, 0x171c: 0x0fae, 0x171d: 0x1846,
+	0x171e: 0x0fba, 0x171f: 0x1850, 0x1720: 0x0fce, 0x1721: 0x0fda, 0x1722: 0x0fee, 0x1723: 0x1855,
+	0x1724: 0x1002, 0x1725: 0x1006, 0x1726: 0x185a, 0x1727: 0x185f, 0x1728: 0x1022, 0x1729: 0x1032,
+	0x172a: 0x0716, 0x172b: 0x1036, 0x172c: 0x071a, 0x172d: 0x071a, 0x172e: 0x104e, 0x172f: 0x1052,
+	0x1730: 0x105a, 0x1731: 0x105e, 0x1732: 0x106a, 0x1733: 0x071e, 0x1734: 0x1082, 0x1735: 0x1864,
+	0x1736: 0x109e, 0x1737: 0x1869, 0x1738: 0x10aa, 0x1739: 0x17ce, 0x173a: 0x10ba, 0x173b: 0x186e,
+	0x173c: 0x1873, 0x173d: 0x1878, 0x173e: 0x0722, 0x173f: 0x0726,
+	// Block 0x5d, offset 0x1740
+	0x1740: 0x10f2, 0x1741: 0x1882, 0x1742: 0x187d, 0x1743: 0x1887, 0x1744: 0x188c, 0x1745: 0x10fa,
+	0x1746: 0x10fe, 0x1747: 0x10fe, 0x1748: 0x1106, 0x1749: 0x072e, 0x174a: 0x110a, 0x174b: 0x0732,
+	0x174c: 0x0736, 0x174d: 0x1896, 0x174e: 0x111e, 0x174f: 0x1126, 0x1750: 0x1132, 0x1751: 0x073a,
+	0x1752: 0x189b, 0x1753: 0x1156, 0x1754: 0x18a0, 0x1755: 0x18a5, 0x1756: 0x1176, 0x1757: 0x118e,
+	0x1758: 0x073e, 0x1759: 0x1196, 0x175a: 0x119a, 0x175b: 0x119e, 0x175c: 0x18aa, 0x175d: 0x18af,
+	0x175e: 0x18af, 0x175f: 0x11b6, 0x1760: 0x0742, 0x1761: 0x18b4, 0x1762: 0x11ca, 0x1763: 0x11ce,
+	0x1764: 0x0746, 0x1765: 0x18b9, 0x1766: 0x11ea, 0x1767: 0x074a, 0x1768: 0x11fa, 0x1769: 0x11f2,
+	0x176a: 0x1202, 0x176b: 0x18c3, 0x176c: 0x121a, 0x176d: 0x074e, 0x176e: 0x1226, 0x176f: 0x122e,
+	0x1770: 0x123e, 0x1771: 0x0752, 0x1772: 0x18cd, 0x1773: 0x18d2, 0x1774: 0x0756, 0x1775: 0x18d7,
+	0x1776: 0x1256, 0x1777: 0x18dc, 0x1778: 0x1262, 0x1779: 0x126e, 0x177a: 0x1276, 0x177b: 0x18e1,
+	0x177c: 0x18e6, 0x177d: 0x128a, 0x177e: 0x18eb, 0x177f: 0x1292,
+	// Block 0x5e, offset 0x1780
+	0x1780: 0x17fb, 0x1781: 0x075a, 0x1782: 0x12aa, 0x1783: 0x12ae, 0x1784: 0x0762, 0x1785: 0x12b2,
+	0x1786: 0x0b2e, 0x1787: 0x18f0, 0x1788: 0x18f5, 0x1789: 0x1800, 0x178a: 0x1805, 0x178b: 0x12d2,
+	0x178c: 0x12d6, 0x178d: 0x14ee, 0x178e: 0x0766, 0x178f: 0x1302, 0x1790: 0x12fe, 0x1791: 0x1306,
+	0x1792: 0x093a, 0x1793: 0x130a, 0x1794: 0x130e, 0x1795: 0x1312, 0x1796: 0x131a, 0x1797: 0x18fa,
+	0x1798: 0x1316, 0x1799: 0x131e, 0x179a: 0x1332, 0x179b: 0x1336, 0x179c: 0x1322, 0x179d: 0x133a,
+	0x179e: 0x134e, 0x179f: 0x1362, 0x17a0: 0x132e, 0x17a1: 0x1342, 0x17a2: 0x1346, 0x17a3: 0x134a,
+	0x17a4: 0x18ff, 0x17a5: 0x1909, 0x17a6: 0x1904, 0x17a7: 0x076a, 0x17a8: 0x136a, 0x17a9: 0x136e,
+	0x17aa: 0x1376, 0x17ab: 0x191d, 0x17ac: 0x137a, 0x17ad: 0x190e, 0x17ae: 0x076e, 0x17af: 0x0772,
+	0x17b0: 0x1913, 0x17b1: 0x1918, 0x17b2: 0x0776, 0x17b3: 0x139a, 0x17b4: 0x139e, 0x17b5: 0x13a2,
+	0x17b6: 0x13a6, 0x17b7: 0x13b2, 0x17b8: 0x13ae, 0x17b9: 0x13ba, 0x17ba: 0x13b6, 0x17bb: 0x13c6,
+	0x17bc: 0x13be, 0x17bd: 0x13c2, 0x17be: 0x13ca, 0x17bf: 0x077a,
+	// Block 0x5f, offset 0x17c0
+	0x17c0: 0x13d2, 0x17c1: 0x13d6, 0x17c2: 0x077e, 0x17c3: 0x13e6, 0x17c4: 0x13ea, 0x17c5: 0x1922,
+	0x17c6: 0x13f6, 0x17c7: 0x13fa, 0x17c8: 0x0782, 0x17c9: 0x1406, 0x17ca: 0x06b6, 0x17cb: 0x1927,
+	0x17cc: 0x192c, 0x17cd: 0x0786, 0x17ce: 0x078a, 0x17cf: 0x1432, 0x17d0: 0x144a, 0x17d1: 0x1466,
+	0x17d2: 0x1476, 0x17d3: 0x1931, 0x17d4: 0x148a, 0x17d5: 0x148e, 0x17d6: 0x14a6, 0x17d7: 0x14b2,
+	0x17d8: 0x193b, 0x17d9: 0x178d, 0x17da: 0x14be, 0x17db: 0x14ba, 0x17dc: 0x14c6, 0x17dd: 0x1792,
+	0x17de: 0x14d2, 0x17df: 0x14de, 0x17e0: 0x1940, 0x17e1: 0x1945, 0x17e2: 0x151e, 0x17e3: 0x152a,
+	0x17e4: 0x1532, 0x17e5: 0x194a, 0x17e6: 0x1536, 0x17e7: 0x1562, 0x17e8: 0x156e, 0x17e9: 0x1572,
+	0x17ea: 0x156a, 0x17eb: 0x157e, 0x17ec: 0x1582, 0x17ed: 0x194f, 0x17ee: 0x158e, 0x17ef: 0x078e,
+	0x17f0: 0x1596, 0x17f1: 0x1954, 0x17f2: 0x0792, 0x17f3: 0x15ce, 0x17f4: 0x0bbe, 0x17f5: 0x15e6,
+	0x17f6: 0x1959, 0x17f7: 0x1963, 0x17f8: 0x0796, 0x17f9: 0x079a, 0x17fa: 0x160e, 0x17fb: 0x1968,
+	0x17fc: 0x079e, 0x17fd: 0x196d, 0x17fe: 0x1626, 0x17ff: 0x1626,
+	// Block 0x60, offset 0x1800
+	0x1800: 0x162e, 0x1801: 0x1972, 0x1802: 0x1646, 0x1803: 0x07a2, 0x1804: 0x1656, 0x1805: 0x1662,
+	0x1806: 0x166a, 0x1807: 0x1672, 0x1808: 0x07a6, 0x1809: 0x1977, 0x180a: 0x1686, 0x180b: 0x16a2,
+	0x180c: 0x16ae, 0x180d: 0x07aa, 0x180e: 0x07ae, 0x180f: 0x16b2, 0x1810: 0x197c, 0x1811: 0x07b2,
+	0x1812: 0x1981, 0x1813: 0x1986, 0x1814: 0x198b, 0x1815: 0x16d6, 0x1816: 0x07b6, 0x1817: 0x16ea,
+	0x1818: 0x16f2, 0x1819: 0x16f6, 0x181a: 0x16fe, 0x181b: 0x1706, 0x181c: 0x170e, 0x181d: 0x1995,
+}
+
+// nfkcIndex: 22 blocks, 1408 entries, 2816 bytes
+// Block 0 is the zero block.
+var nfkcIndex = [1408]uint16{
+	// Block 0x0, offset 0x0
+	// Block 0x1, offset 0x40
+	// Block 0x2, offset 0x80
+	// Block 0x3, offset 0xc0
+	0xc2: 0x5f, 0xc3: 0x01, 0xc4: 0x02, 0xc5: 0x03, 0xc6: 0x60, 0xc7: 0x04,
+	0xc8: 0x05, 0xca: 0x61, 0xcb: 0x62, 0xcc: 0x06, 0xcd: 0x07, 0xce: 0x08, 0xcf: 0x09,
+	0xd0: 0x0a, 0xd1: 0x63, 0xd2: 0x64, 0xd3: 0x0b, 0xd6: 0x0c, 0xd7: 0x65,
+	0xd8: 0x66, 0xd9: 0x0d, 0xdb: 0x67, 0xdc: 0x68, 0xdd: 0x69, 0xdf: 0x6a,
+	0xe0: 0x02, 0xe1: 0x03, 0xe2: 0x04, 0xe3: 0x05,
+	0xea: 0x06, 0xeb: 0x07, 0xec: 0x08, 0xed: 0x09, 0xef: 0x0a,
+	0xf0: 0x13,
+	// Block 0x4, offset 0x100
+	0x120: 0x6b, 0x121: 0x6c, 0x122: 0x6d, 0x123: 0x0e, 0x124: 0x6e, 0x125: 0x6f, 0x126: 0x70, 0x127: 0x71,
+	0x128: 0x72, 0x129: 0x73, 0x12a: 0x74, 0x12b: 0x75, 0x12c: 0x70, 0x12d: 0x76, 0x12e: 0x77, 0x12f: 0x78,
+	0x130: 0x74, 0x131: 0x79, 0x132: 0x7a, 0x133: 0x7b, 0x134: 0x7c, 0x135: 0x7d, 0x137: 0x7e,
+	0x138: 0x7f, 0x139: 0x80, 0x13a: 0x81, 0x13b: 0x82, 0x13c: 0x83, 0x13d: 0x84, 0x13e: 0x85, 0x13f: 0x86,
+	// Block 0x5, offset 0x140
+	0x140: 0x87, 0x142: 0x88, 0x143: 0x89, 0x144: 0x8a, 0x145: 0x8b, 0x146: 0x8c, 0x147: 0x8d,
+	0x14d: 0x8e,
+	0x15c: 0x8f, 0x15f: 0x90,
+	0x162: 0x91, 0x164: 0x92,
+	0x168: 0x93, 0x169: 0x94, 0x16a: 0x95, 0x16b: 0x96, 0x16c: 0x0f, 0x16d: 0x97, 0x16e: 0x98, 0x16f: 0x99,
+	0x170: 0x9a, 0x173: 0x9b, 0x174: 0x9c, 0x175: 0x10, 0x176: 0x11, 0x177: 0x12,
+	0x178: 0x13, 0x179: 0x14, 0x17a: 0x15, 0x17b: 0x16, 0x17c: 0x17, 0x17d: 0x18, 0x17e: 0x19, 0x17f: 0x1a,
+	// Block 0x6, offset 0x180
+	0x180: 0x9d, 0x181: 0x9e, 0x182: 0x9f, 0x183: 0xa0, 0x184: 0x1b, 0x185: 0x1c, 0x186: 0xa1, 0x187: 0xa2,
+	0x188: 0xa3, 0x189: 0x1d, 0x18a: 0x1e, 0x18b: 0xa4, 0x18c: 0xa5,
+	0x191: 0x1f, 0x192: 0x20, 0x193: 0xa6,
+	0x1a8: 0xa7, 0x1a9: 0xa8, 0x1ab: 0xa9,
+	0x1b1: 0xaa, 0x1b3: 0xab, 0x1b5: 0xac, 0x1b7: 0xad,
+	0x1ba: 0xae, 0x1bb: 0xaf, 0x1bc: 0x21, 0x1bd: 0x22, 0x1be: 0x23, 0x1bf: 0xb0,
+	// Block 0x7, offset 0x1c0
+	0x1c0: 0xb1, 0x1c1: 0x24, 0x1c2: 0x25, 0x1c3: 0x26, 0x1c4: 0xb2, 0x1c5: 0x27, 0x1c6: 0x28,
+	0x1c8: 0x29, 0x1c9: 0x2a, 0x1ca: 0x2b, 0x1cb: 0x2c, 0x1cc: 0x2d, 0x1cd: 0x2e, 0x1ce: 0x2f, 0x1cf: 0x30,
+	// Block 0x8, offset 0x200
+	0x219: 0xb3, 0x21a: 0xb4, 0x21b: 0xb5, 0x21d: 0xb6, 0x21f: 0xb7,
+	0x220: 0xb8, 0x223: 0xb9, 0x224: 0xba, 0x225: 0xbb, 0x226: 0xbc, 0x227: 0xbd,
+	0x22a: 0xbe, 0x22b: 0xbf, 0x22d: 0xc0, 0x22f: 0xc1,
+	0x230: 0xc2, 0x231: 0xc3, 0x232: 0xc4, 0x233: 0xc5, 0x234: 0xc6, 0x235: 0xc7, 0x236: 0xc8, 0x237: 0xc2,
+	0x238: 0xc3, 0x239: 0xc4, 0x23a: 0xc5, 0x23b: 0xc6, 0x23c: 0xc7, 0x23d: 0xc8, 0x23e: 0xc2, 0x23f: 0xc3,
+	// Block 0x9, offset 0x240
+	0x240: 0xc4, 0x241: 0xc5, 0x242: 0xc6, 0x243: 0xc7, 0x244: 0xc8, 0x245: 0xc2, 0x246: 0xc3, 0x247: 0xc4,
+	0x248: 0xc5, 0x249: 0xc6, 0x24a: 0xc7, 0x24b: 0xc8, 0x24c: 0xc2, 0x24d: 0xc3, 0x24e: 0xc4, 0x24f: 0xc5,
+	0x250: 0xc6, 0x251: 0xc7, 0x252: 0xc8, 0x253: 0xc2, 0x254: 0xc3, 0x255: 0xc4, 0x256: 0xc5, 0x257: 0xc6,
+	0x258: 0xc7, 0x259: 0xc8, 0x25a: 0xc2, 0x25b: 0xc3, 0x25c: 0xc4, 0x25d: 0xc5, 0x25e: 0xc6, 0x25f: 0xc7,
+	0x260: 0xc8, 0x261: 0xc2, 0x262: 0xc3, 0x263: 0xc4, 0x264: 0xc5, 0x265: 0xc6, 0x266: 0xc7, 0x267: 0xc8,
+	0x268: 0xc2, 0x269: 0xc3, 0x26a: 0xc4, 0x26b: 0xc5, 0x26c: 0xc6, 0x26d: 0xc7, 0x26e: 0xc8, 0x26f: 0xc2,
+	0x270: 0xc3, 0x271: 0xc4, 0x272: 0xc5, 0x273: 0xc6, 0x274: 0xc7, 0x275: 0xc8, 0x276: 0xc2, 0x277: 0xc3,
+	0x278: 0xc4, 0x279: 0xc5, 0x27a: 0xc6, 0x27b: 0xc7, 0x27c: 0xc8, 0x27d: 0xc2, 0x27e: 0xc3, 0x27f: 0xc4,
+	// Block 0xa, offset 0x280
+	0x280: 0xc5, 0x281: 0xc6, 0x282: 0xc7, 0x283: 0xc8, 0x284: 0xc2, 0x285: 0xc3, 0x286: 0xc4, 0x287: 0xc5,
+	0x288: 0xc6, 0x289: 0xc7, 0x28a: 0xc8, 0x28b: 0xc2, 0x28c: 0xc3, 0x28d: 0xc4, 0x28e: 0xc5, 0x28f: 0xc6,
+	0x290: 0xc7, 0x291: 0xc8, 0x292: 0xc2, 0x293: 0xc3, 0x294: 0xc4, 0x295: 0xc5, 0x296: 0xc6, 0x297: 0xc7,
+	0x298: 0xc8, 0x299: 0xc2, 0x29a: 0xc3, 0x29b: 0xc4, 0x29c: 0xc5, 0x29d: 0xc6, 0x29e: 0xc7, 0x29f: 0xc8,
+	0x2a0: 0xc2, 0x2a1: 0xc3, 0x2a2: 0xc4, 0x2a3: 0xc5, 0x2a4: 0xc6, 0x2a5: 0xc7, 0x2a6: 0xc8, 0x2a7: 0xc2,
+	0x2a8: 0xc3, 0x2a9: 0xc4, 0x2aa: 0xc5, 0x2ab: 0xc6, 0x2ac: 0xc7, 0x2ad: 0xc8, 0x2ae: 0xc2, 0x2af: 0xc3,
+	0x2b0: 0xc4, 0x2b1: 0xc5, 0x2b2: 0xc6, 0x2b3: 0xc7, 0x2b4: 0xc8, 0x2b5: 0xc2, 0x2b6: 0xc3, 0x2b7: 0xc4,
+	0x2b8: 0xc5, 0x2b9: 0xc6, 0x2ba: 0xc7, 0x2bb: 0xc8, 0x2bc: 0xc2, 0x2bd: 0xc3, 0x2be: 0xc4, 0x2bf: 0xc5,
+	// Block 0xb, offset 0x2c0
+	0x2c0: 0xc6, 0x2c1: 0xc7, 0x2c2: 0xc8, 0x2c3: 0xc2, 0x2c4: 0xc3, 0x2c5: 0xc4, 0x2c6: 0xc5, 0x2c7: 0xc6,
+	0x2c8: 0xc7, 0x2c9: 0xc8, 0x2ca: 0xc2, 0x2cb: 0xc3, 0x2cc: 0xc4, 0x2cd: 0xc5, 0x2ce: 0xc6, 0x2cf: 0xc7,
+	0x2d0: 0xc8, 0x2d1: 0xc2, 0x2d2: 0xc3, 0x2d3: 0xc4, 0x2d4: 0xc5, 0x2d5: 0xc6, 0x2d6: 0xc7, 0x2d7: 0xc8,
+	0x2d8: 0xc2, 0x2d9: 0xc3, 0x2da: 0xc4, 0x2db: 0xc5, 0x2dc: 0xc6, 0x2dd: 0xc7, 0x2de: 0xc9,
+	// Block 0xc, offset 0x300
+	0x324: 0x31, 0x325: 0x32, 0x326: 0x33, 0x327: 0x34,
+	0x328: 0x35, 0x329: 0x36, 0x32a: 0x37, 0x32b: 0x38, 0x32c: 0x39, 0x32d: 0x3a, 0x32e: 0x3b, 0x32f: 0x3c,
+	0x330: 0x3d, 0x331: 0x3e, 0x332: 0x3f, 0x333: 0x40, 0x334: 0x41, 0x335: 0x42, 0x336: 0x43, 0x337: 0x44,
+	0x338: 0x45, 0x339: 0x46, 0x33a: 0x47, 0x33b: 0x48, 0x33c: 0xca, 0x33d: 0x49, 0x33e: 0x4a, 0x33f: 0x4b,
+	// Block 0xd, offset 0x340
+	0x347: 0xcb,
+	0x34b: 0xcc, 0x34d: 0xcd,
+	0x35e: 0x4c,
+	0x368: 0xce, 0x36b: 0xcf,
+	0x374: 0xd0,
+	0x37a: 0xd1, 0x37b: 0xd2, 0x37d: 0xd3, 0x37e: 0xd4,
+	// Block 0xe, offset 0x380
+	0x381: 0xd5, 0x382: 0xd6, 0x384: 0xd7, 0x385: 0xbc, 0x387: 0xd8,
+	0x388: 0xd9, 0x38b: 0xda, 0x38c: 0xdb, 0x38d: 0xdc,
+	0x391: 0xdd, 0x392: 0xde, 0x393: 0xdf, 0x396: 0xe0, 0x397: 0xe1,
+	0x398: 0xe2, 0x39a: 0xe3, 0x39c: 0xe4,
+	0x3a0: 0xe5, 0x3a4: 0xe6, 0x3a5: 0xe7, 0x3a7: 0xe8,
+	0x3a8: 0xe9, 0x3a9: 0xea, 0x3aa: 0xeb,
+	0x3b0: 0xe2, 0x3b5: 0xec, 0x3b6: 0xed,
+	0x3bd: 0xee,
+	// Block 0xf, offset 0x3c0
+	0x3eb: 0xef, 0x3ec: 0xf0,
+	0x3ff: 0xf1,
+	// Block 0x10, offset 0x400
+	0x432: 0xf2,
+	// Block 0x11, offset 0x440
+	0x445: 0xf3, 0x446: 0xf4, 0x447: 0xf5,
+	0x449: 0xf6,
+	0x450: 0xf7, 0x451: 0xf8, 0x452: 0xf9, 0x453: 0xfa, 0x454: 0xfb, 0x455: 0xfc, 0x456: 0xfd, 0x457: 0xfe,
+	0x458: 0xff, 0x459: 0x100, 0x45a: 0x4d, 0x45b: 0x101, 0x45c: 0x102, 0x45d: 0x103, 0x45e: 0x104, 0x45f: 0x4e,
+	// Block 0x12, offset 0x480
+	0x480: 0x4f, 0x481: 0x50, 0x482: 0x105, 0x484: 0xf0,
+	0x48a: 0x106, 0x48b: 0x107,
+	0x493: 0x108,
+	0x4a3: 0x109, 0x4a5: 0x10a,
+	0x4b8: 0x51, 0x4b9: 0x52, 0x4ba: 0x53,
+	// Block 0x13, offset 0x4c0
+	0x4c4: 0x54, 0x4c5: 0x10b, 0x4c6: 0x10c,
+	0x4c8: 0x55, 0x4c9: 0x10d,
+	0x4ef: 0x10e,
+	// Block 0x14, offset 0x500
+	0x520: 0x56, 0x521: 0x57, 0x522: 0x58, 0x523: 0x59, 0x524: 0x5a, 0x525: 0x5b, 0x526: 0x5c, 0x527: 0x5d,
+	0x528: 0x5e,
+	// Block 0x15, offset 0x540
+	0x550: 0x0b, 0x551: 0x0c, 0x556: 0x0d,
+	0x55b: 0x0e, 0x55d: 0x0f, 0x55e: 0x10, 0x55f: 0x11,
+	0x56f: 0x12,
+}
+
+// nfkcSparseOffset: 176 entries, 352 bytes
+var nfkcSparseOffset = []uint16{0x0, 0xe, 0x12, 0x1c, 0x26, 0x36, 0x38, 0x3d, 0x48, 0x57, 0x64, 0x6c, 0x71, 0x76, 0x78, 0x7c, 0x84, 0x8b, 0x8e, 0x96, 0x9a, 0x9e, 0xa0, 0xa2, 0xab, 0xaf, 0xb6, 0xbb, 0xbe, 0xc8, 0xcb, 0xd2, 0xda, 0xde, 0xe0, 0xe4, 0xe8, 0xee, 0xff, 0x10b, 0x10d, 0x113, 0x115, 0x117, 0x119, 0x11b, 0x11d, 0x11f, 0x121, 0x124, 0x127, 0x129, 0x12c, 0x12f, 0x133, 0x139, 0x140, 0x149, 0x14b, 0x14e, 0x150, 0x15b, 0x166, 0x174, 0x182, 0x192, 0x1a0, 0x1a7, 0x1ad, 0x1bc, 0x1c0, 0x1c2, 0x1c6, 0x1c8, 0x1cb, 0x1cd, 0x1d0, 0x1d2, 0x1d5, 0x1d7, 0x1d9, 0x1db, 0x1e7, 0x1f1, 0x1fb, 0x1fe, 0x202, 0x204, 0x206, 0x20b, 0x20e, 0x211, 0x213, 0x215, 0x217, 0x219, 0x21f, 0x222, 0x227, 0x229, 0x230, 0x236, 0x23c, 0x244, 0x24a, 0x250, 0x256, 0x25a, 0x25c, 0x25e, 0x260, 0x262, 0x268, 0x26b, 0x26d, 0x26f, 0x271, 0x277, 0x27b, 0x27f, 0x287, 0x28e, 0x291, 0x294, 0x296, 0x299, 0x2a1, 0x2a5, 0x2ac, 0x2af, 0x2b5, 0x2b7, 0x2b9, 0x2bc, 0x2be, 0x2c1, 0x2c6, 0x2c8, 0x2ca, 0x2cc, 0x2ce, 0x2d0, 0x2d3, 0x2d5, 0x2d7, 0x2d9, 0x2db, 0x2dd, 0x2df, 0x2ec, 0x2f6, 0x2f8, 0x2fa, 0x2fe, 0x303, 0x30f, 0x314, 0x31d, 0x323, 0x328, 0x32c, 0x331, 0x335, 0x345, 0x353, 0x361, 0x36f, 0x371, 0x373, 0x375, 0x379, 0x37b, 0x37e, 0x389, 0x38b, 0x395}
+
+// nfkcSparseValues: 919 entries, 3676 bytes
+var nfkcSparseValues = [919]valueRange{
+	// Block 0x0, offset 0x0
+	{value: 0x0002, lo: 0x0d},
+	{value: 0x0001, lo: 0xa0, hi: 0xa0},
+	{value: 0x43b9, lo: 0xa8, hi: 0xa8},
+	{value: 0x0083, lo: 0xaa, hi: 0xaa},
+	{value: 0x43a5, lo: 0xaf, hi: 0xaf},
+	{value: 0x0025, lo: 0xb2, hi: 0xb3},
+	{value: 0x439b, lo: 0xb4, hi: 0xb4},
+	{value: 0x0260, lo: 0xb5, hi: 0xb5},
+	{value: 0x43d2, lo: 0xb8, hi: 0xb8},
+	{value: 0x0023, lo: 0xb9, hi: 0xb9},
+	{value: 0x009f, lo: 0xba, hi: 0xba},
+	{value: 0x234c, lo: 0xbc, hi: 0xbc},
+	{value: 0x2340, lo: 0xbd, hi: 0xbd},
+	{value: 0x23e2, lo: 0xbe, hi: 0xbe},
+	// Block 0x1, offset 0xe
+	{value: 0x0091, lo: 0x03},
+	{value: 0x4823, lo: 0xa0, hi: 0xa1},
+	{value: 0x4855, lo: 0xaf, hi: 0xb0},
+	{value: 0xa000, lo: 0xb7, hi: 0xb7},
+	// Block 0x2, offset 0x12
+	{value: 0x0004, lo: 0x09},
+	{value: 0xa000, lo: 0x92, hi: 0x92},
+	{value: 0x0091, lo: 0xb0, hi: 0xb0},
+	{value: 0x0140, lo: 0xb1, hi: 0xb1},
+	{value: 0x0095, lo: 0xb2, hi: 0xb2},
+	{value: 0x00a5, lo: 0xb3, hi: 0xb3},
+	{value: 0x0179, lo: 0xb4, hi: 0xb4},
+	{value: 0x017f, lo: 0xb5, hi: 0xb5},
+	{value: 0x018b, lo: 0xb6, hi: 0xb6},
+	{value: 0x00af, lo: 0xb7, hi: 0xb8},
+	// Block 0x3, offset 0x1c
+	{value: 0x000a, lo: 0x09},
+	{value: 0x43af, lo: 0x98, hi: 0x98},
+	{value: 0x43b4, lo: 0x99, hi: 0x9a},
+	{value: 0x43d7, lo: 0x9b, hi: 0x9b},
+	{value: 0x43a0, lo: 0x9c, hi: 0x9c},
+	{value: 0x43c3, lo: 0x9d, hi: 0x9d},
+	{value: 0x0137, lo: 0xa0, hi: 0xa0},
+	{value: 0x0099, lo: 0xa1, hi: 0xa1},
+	{value: 0x00a7, lo: 0xa2, hi: 0xa3},
+	{value: 0x01b8, lo: 0xa4, hi: 0xa4},
+	// Block 0x4, offset 0x26
+	{value: 0x0000, lo: 0x0f},
+	{value: 0xa000, lo: 0x83, hi: 0x83},
+	{value: 0xa000, lo: 0x87, hi: 0x87},
+	{value: 0xa000, lo: 0x8b, hi: 0x8b},
+	{value: 0xa000, lo: 0x8d, hi: 0x8d},
+	{value: 0x38e6, lo: 0x90, hi: 0x90},
+	{value: 0x38f2, lo: 0x91, hi: 0x91},
+	{value: 0x38e0, lo: 0x93, hi: 0x93},
+	{value: 0xa000, lo: 0x96, hi: 0x96},
+	{value: 0x3958, lo: 0x97, hi: 0x97},
+	{value: 0x3922, lo: 0x9c, hi: 0x9c},
+	{value: 0x390a, lo: 0x9d, hi: 0x9d},
+	{value: 0x3934, lo: 0x9e, hi: 0x9e},
+	{value: 0xa000, lo: 0xb4, hi: 0xb5},
+	{value: 0x395e, lo: 0xb6, hi: 0xb6},
+	{value: 0x3964, lo: 0xb7, hi: 0xb7},
+	// Block 0x5, offset 0x36
+	{value: 0x0000, lo: 0x01},
+	{value: 0x8133, lo: 0x83, hi: 0x87},
+	// Block 0x6, offset 0x38
+	{value: 0x0001, lo: 0x04},
+	{value: 0x8114, lo: 0x81, hi: 0x82},
+	{value: 0x8133, lo: 0x84, hi: 0x84},
+	{value: 0x812e, lo: 0x85, hi: 0x85},
+	{value: 0x810e, lo: 0x87, hi: 0x87},
+	// Block 0x7, offset 0x3d
+	{value: 0x0000, lo: 0x0a},
+	{value: 0x8133, lo: 0x90, hi: 0x97},
+	{value: 0x811a, lo: 0x98, hi: 0x98},
+	{value: 0x811b, lo: 0x99, hi: 0x99},
+	{value: 0x811c, lo: 0x9a, hi: 0x9a},
+	{value: 0x3982, lo: 0xa2, hi: 0xa2},
+	{value: 0x3988, lo: 0xa3, hi: 0xa3},
+	{value: 0x3994, lo: 0xa4, hi: 0xa4},
+	{value: 0x398e, lo: 0xa5, hi: 0xa5},
+	{value: 0x399a, lo: 0xa6, hi: 0xa6},
+	{value: 0xa000, lo: 0xa7, hi: 0xa7},
+	// Block 0x8, offset 0x48
+	{value: 0x0000, lo: 0x0e},
+	{value: 0x39ac, lo: 0x80, hi: 0x80},
+	{value: 0xa000, lo: 0x81, hi: 0x81},
+	{value: 0x39a0, lo: 0x82, hi: 0x82},
+	{value: 0xa000, lo: 0x92, hi: 0x92},
+	{value: 0x39a6, lo: 0x93, hi: 0x93},
+	{value: 0xa000, lo: 0x95, hi: 0x95},
+	{value: 0x8133, lo: 0x96, hi: 0x9c},
+	{value: 0x8133, lo: 0x9f, hi: 0xa2},
+	{value: 0x812e, lo: 0xa3, hi: 0xa3},
+	{value: 0x8133, lo: 0xa4, hi: 0xa4},
+	{value: 0x8133, lo: 0xa7, hi: 0xa8},
+	{value: 0x812e, lo: 0xaa, hi: 0xaa},
+	{value: 0x8133, lo: 0xab, hi: 0xac},
+	{value: 0x812e, lo: 0xad, hi: 0xad},
+	// Block 0x9, offset 0x57
+	{value: 0x0000, lo: 0x0c},
+	{value: 0x8120, lo: 0x91, hi: 0x91},
+	{value: 0x8133, lo: 0xb0, hi: 0xb0},
+	{value: 0x812e, lo: 0xb1, hi: 0xb1},
+	{value: 0x8133, lo: 0xb2, hi: 0xb3},
+	{value: 0x812e, lo: 0xb4, hi: 0xb4},
+	{value: 0x8133, lo: 0xb5, hi: 0xb6},
+	{value: 0x812e, lo: 0xb7, hi: 0xb9},
+	{value: 0x8133, lo: 0xba, hi: 0xba},
+	{value: 0x812e, lo: 0xbb, hi: 0xbc},
+	{value: 0x8133, lo: 0xbd, hi: 0xbd},
+	{value: 0x812e, lo: 0xbe, hi: 0xbe},
+	{value: 0x8133, lo: 0xbf, hi: 0xbf},
+	// Block 0xa, offset 0x64
+	{value: 0x0005, lo: 0x07},
+	{value: 0x8133, lo: 0x80, hi: 0x80},
+	{value: 0x8133, lo: 0x81, hi: 0x81},
+	{value: 0x812e, lo: 0x82, hi: 0x83},
+	{value: 0x812e, lo: 0x84, hi: 0x85},
+	{value: 0x812e, lo: 0x86, hi: 0x87},
+	{value: 0x812e, lo: 0x88, hi: 0x89},
+	{value: 0x8133, lo: 0x8a, hi: 0x8a},
+	// Block 0xb, offset 0x6c
+	{value: 0x0000, lo: 0x04},
+	{value: 0x8133, lo: 0xab, hi: 0xb1},
+	{value: 0x812e, lo: 0xb2, hi: 0xb2},
+	{value: 0x8133, lo: 0xb3, hi: 0xb3},
+	{value: 0x812e, lo: 0xbd, hi: 0xbd},
+	// Block 0xc, offset 0x71
+	{value: 0x0000, lo: 0x04},
+	{value: 0x8133, lo: 0x96, hi: 0x99},
+	{value: 0x8133, lo: 0x9b, hi: 0xa3},
+	{value: 0x8133, lo: 0xa5, hi: 0xa7},
+	{value: 0x8133, lo: 0xa9, hi: 0xad},
+	// Block 0xd, offset 0x76
+	{value: 0x0000, lo: 0x01},
+	{value: 0x812e, lo: 0x99, hi: 0x9b},
+	// Block 0xe, offset 0x78
+	{value: 0x0000, lo: 0x03},
+	{value: 0x8133, lo: 0x98, hi: 0x98},
+	{value: 0x812e, lo: 0x99, hi: 0x9b},
+	{value: 0x8133, lo: 0x9c, hi: 0x9f},
+	// Block 0xf, offset 0x7c
+	{value: 0x0000, lo: 0x07},
+	{value: 0xa000, lo: 0xa8, hi: 0xa8},
+	{value: 0x4019, lo: 0xa9, hi: 0xa9},
+	{value: 0xa000, lo: 0xb0, hi: 0xb0},
+	{value: 0x4021, lo: 0xb1, hi: 0xb1},
+	{value: 0xa000, lo: 0xb3, hi: 0xb3},
+	{value: 0x4029, lo: 0xb4, hi: 0xb4},
+	{value: 0x9903, lo: 0xbc, hi: 0xbc},
+	// Block 0x10, offset 0x84
+	{value: 0x0008, lo: 0x06},
+	{value: 0x8105, lo: 0x8d, hi: 0x8d},
+	{value: 0x8133, lo: 0x91, hi: 0x91},
+	{value: 0x812e, lo: 0x92, hi: 0x92},
+	{value: 0x8133, lo: 0x93, hi: 0x93},
+	{value: 0x8133, lo: 0x94, hi: 0x94},
+	{value: 0x465d, lo: 0x98, hi: 0x9f},
+	// Block 0x11, offset 0x8b
+	{value: 0x0000, lo: 0x02},
+	{value: 0x8103, lo: 0xbc, hi: 0xbc},
+	{value: 0x9900, lo: 0xbe, hi: 0xbe},
+	// Block 0x12, offset 0x8e
+	{value: 0x0008, lo: 0x07},
+	{value: 0xa000, lo: 0x87, hi: 0x87},
+	{value: 0x2dd5, lo: 0x8b, hi: 0x8c},
+	{value: 0x8105, lo: 0x8d, hi: 0x8d},
+	{value: 0x9900, lo: 0x97, hi: 0x97},
+	{value: 0x469d, lo: 0x9c, hi: 0x9d},
+	{value: 0x46ad, lo: 0x9f, hi: 0x9f},
+	{value: 0x8133, lo: 0xbe, hi: 0xbe},
+	// Block 0x13, offset 0x96
+	{value: 0x0000, lo: 0x03},
+	{value: 0x46d5, lo: 0xb3, hi: 0xb3},
+	{value: 0x46dd, lo: 0xb6, hi: 0xb6},
+	{value: 0x8103, lo: 0xbc, hi: 0xbc},
+	// Block 0x14, offset 0x9a
+	{value: 0x0008, lo: 0x03},
+	{value: 0x8105, lo: 0x8d, hi: 0x8d},
+	{value: 0x46b5, lo: 0x99, hi: 0x9b},
+	{value: 0x46cd, lo: 0x9e, hi: 0x9e},
+	// Block 0x15, offset 0x9e
+	{value: 0x0000, lo: 0x01},
+	{value: 0x8103, lo: 0xbc, hi: 0xbc},
+	// Block 0x16, offset 0xa0
+	{value: 0x0000, lo: 0x01},
+	{value: 0x8105, lo: 0x8d, hi: 0x8d},
+	// Block 0x17, offset 0xa2
+	{value: 0x0000, lo: 0x08},
+	{value: 0xa000, lo: 0x87, hi: 0x87},
+	{value: 0x2ded, lo: 0x88, hi: 0x88},
+	{value: 0x2de5, lo: 0x8b, hi: 0x8b},
+	{value: 0x2df5, lo: 0x8c, hi: 0x8c},
+	{value: 0x8105, lo: 0x8d, hi: 0x8d},
+	{value: 0x9900, lo: 0x96, hi: 0x97},
+	{value: 0x46e5, lo: 0x9c, hi: 0x9c},
+	{value: 0x46ed, lo: 0x9d, hi: 0x9d},
+	// Block 0x18, offset 0xab
+	{value: 0x0000, lo: 0x03},
+	{value: 0xa000, lo: 0x92, hi: 0x92},
+	{value: 0x2dfd, lo: 0x94, hi: 0x94},
+	{value: 0x9900, lo: 0xbe, hi: 0xbe},
+	// Block 0x19, offset 0xaf
+	{value: 0x0000, lo: 0x06},
+	{value: 0xa000, lo: 0x86, hi: 0x87},
+	{value: 0x2e05, lo: 0x8a, hi: 0x8a},
+	{value: 0x2e15, lo: 0x8b, hi: 0x8b},
+	{value: 0x2e0d, lo: 0x8c, hi: 0x8c},
+	{value: 0x8105, lo: 0x8d, hi: 0x8d},
+	{value: 0x9900, lo: 0x97, hi: 0x97},
+	// Block 0x1a, offset 0xb6
+	{value: 0x1801, lo: 0x04},
+	{value: 0xa000, lo: 0x86, hi: 0x86},
+	{value: 0x4031, lo: 0x88, hi: 0x88},
+	{value: 0x8105, lo: 0x8d, hi: 0x8d},
+	{value: 0x8121, lo: 0x95, hi: 0x96},
+	// Block 0x1b, offset 0xbb
+	{value: 0x0000, lo: 0x02},
+	{value: 0x8103, lo: 0xbc, hi: 0xbc},
+	{value: 0xa000, lo: 0xbf, hi: 0xbf},
+	// Block 0x1c, offset 0xbe
+	{value: 0x0000, lo: 0x09},
+	{value: 0x2e1d, lo: 0x80, hi: 0x80},
+	{value: 0x9900, lo: 0x82, hi: 0x82},
+	{value: 0xa000, lo: 0x86, hi: 0x86},
+	{value: 0x2e25, lo: 0x87, hi: 0x87},
+	{value: 0x2e2d, lo: 0x88, hi: 0x88},
+	{value: 0x3091, lo: 0x8a, hi: 0x8a},
+	{value: 0x2f19, lo: 0x8b, hi: 0x8b},
+	{value: 0x8105, lo: 0x8d, hi: 0x8d},
+	{value: 0x9900, lo: 0x95, hi: 0x96},
+	// Block 0x1d, offset 0xc8
+	{value: 0x0000, lo: 0x02},
+	{value: 0x8105, lo: 0xbb, hi: 0xbc},
+	{value: 0x9900, lo: 0xbe, hi: 0xbe},
+	// Block 0x1e, offset 0xcb
+	{value: 0x0000, lo: 0x06},
+	{value: 0xa000, lo: 0x86, hi: 0x87},
+	{value: 0x2e35, lo: 0x8a, hi: 0x8a},
+	{value: 0x2e45, lo: 0x8b, hi: 0x8b},
+	{value: 0x2e3d, lo: 0x8c, hi: 0x8c},
+	{value: 0x8105, lo: 0x8d, hi: 0x8d},
+	{value: 0x9900, lo: 0x97, hi: 0x97},
+	// Block 0x1f, offset 0xd2
+	{value: 0x6ab3, lo: 0x07},
+	{value: 0x9905, lo: 0x8a, hi: 0x8a},
+	{value: 0x9900, lo: 0x8f, hi: 0x8f},
+	{value: 0xa000, lo: 0x99, hi: 0x99},
+	{value: 0x4039, lo: 0x9a, hi: 0x9a},
+	{value: 0x3099, lo: 0x9c, hi: 0x9c},
+	{value: 0x2f24, lo: 0x9d, hi: 0x9d},
+	{value: 0x2e4d, lo: 0x9e, hi: 0x9f},
+	// Block 0x20, offset 0xda
+	{value: 0x0000, lo: 0x03},
+	{value: 0x2751, lo: 0xb3, hi: 0xb3},
+	{value: 0x8123, lo: 0xb8, hi: 0xb9},
+	{value: 0x8105, lo: 0xba, hi: 0xba},
+	// Block 0x21, offset 0xde
+	{value: 0x0000, lo: 0x01},
+	{value: 0x8124, lo: 0x88, hi: 0x8b},
+	// Block 0x22, offset 0xe0
+	{value: 0x0000, lo: 0x03},
+	{value: 0x2766, lo: 0xb3, hi: 0xb3},
+	{value: 0x8125, lo: 0xb8, hi: 0xb9},
+	{value: 0x8105, lo: 0xba, hi: 0xba},
+	// Block 0x23, offset 0xe4
+	{value: 0x0000, lo: 0x03},
+	{value: 0x8126, lo: 0x88, hi: 0x8b},
+	{value: 0x2758, lo: 0x9c, hi: 0x9c},
+	{value: 0x275f, lo: 0x9d, hi: 0x9d},
+	// Block 0x24, offset 0xe8
+	{value: 0x0000, lo: 0x05},
+	{value: 0x03fe, lo: 0x8c, hi: 0x8c},
+	{value: 0x812e, lo: 0x98, hi: 0x99},
+	{value: 0x812e, lo: 0xb5, hi: 0xb5},
+	{value: 0x812e, lo: 0xb7, hi: 0xb7},
+	{value: 0x812c, lo: 0xb9, hi: 0xb9},
+	// Block 0x25, offset 0xee
+	{value: 0x0000, lo: 0x10},
+	{value: 0x2774, lo: 0x83, hi: 0x83},
+	{value: 0x277b, lo: 0x8d, hi: 0x8d},
+	{value: 0x2782, lo: 0x92, hi: 0x92},
+	{value: 0x2789, lo: 0x97, hi: 0x97},
+	{value: 0x2790, lo: 0x9c, hi: 0x9c},
+	{value: 0x276d, lo: 0xa9, hi: 0xa9},
+	{value: 0x8127, lo: 0xb1, hi: 0xb1},
+	{value: 0x8128, lo: 0xb2, hi: 0xb2},
+	{value: 0x4bc5, lo: 0xb3, hi: 0xb3},
+	{value: 0x8129, lo: 0xb4, hi: 0xb4},
+	{value: 0x4bce, lo: 0xb5, hi: 0xb5},
+	{value: 0x46f5, lo: 0xb6, hi: 0xb6},
+	{value: 0x4735, lo: 0xb7, hi: 0xb7},
+	{value: 0x46fd, lo: 0xb8, hi: 0xb8},
+	{value: 0x4740, lo: 0xb9, hi: 0xb9},
+	{value: 0x8128, lo: 0xba, hi: 0xbd},
+	// Block 0x26, offset 0xff
+	{value: 0x0000, lo: 0x0b},
+	{value: 0x8128, lo: 0x80, hi: 0x80},
+	{value: 0x4bd7, lo: 0x81, hi: 0x81},
+	{value: 0x8133, lo: 0x82, hi: 0x83},
+	{value: 0x8105, lo: 0x84, hi: 0x84},
+	{value: 0x8133, lo: 0x86, hi: 0x87},
+	{value: 0x279e, lo: 0x93, hi: 0x93},
+	{value: 0x27a5, lo: 0x9d, hi: 0x9d},
+	{value: 0x27ac, lo: 0xa2, hi: 0xa2},
+	{value: 0x27b3, lo: 0xa7, hi: 0xa7},
+	{value: 0x27ba, lo: 0xac, hi: 0xac},
+	{value: 0x2797, lo: 0xb9, hi: 0xb9},
+	// Block 0x27, offset 0x10b
+	{value: 0x0000, lo: 0x01},
+	{value: 0x812e, lo: 0x86, hi: 0x86},
+	// Block 0x28, offset 0x10d
+	{value: 0x0000, lo: 0x05},
+	{value: 0xa000, lo: 0xa5, hi: 0xa5},
+	{value: 0x2e55, lo: 0xa6, hi: 0xa6},
+	{value: 0x9900, lo: 0xae, hi: 0xae},
+	{value: 0x8103, lo: 0xb7, hi: 0xb7},
+	{value: 0x8105, lo: 0xb9, hi: 0xba},
+	// Block 0x29, offset 0x113
+	{value: 0x0000, lo: 0x01},
+	{value: 0x812e, lo: 0x8d, hi: 0x8d},
+	// Block 0x2a, offset 0x115
+	{value: 0x0000, lo: 0x01},
+	{value: 0x0402, lo: 0xbc, hi: 0xbc},
+	// Block 0x2b, offset 0x117
+	{value: 0x0000, lo: 0x01},
+	{value: 0xa000, lo: 0x80, hi: 0x92},
+	// Block 0x2c, offset 0x119
+	{value: 0x0000, lo: 0x01},
+	{value: 0xb900, lo: 0xa1, hi: 0xb5},
+	// Block 0x2d, offset 0x11b
+	{value: 0x0000, lo: 0x01},
+	{value: 0x9900, lo: 0xa8, hi: 0xbf},
+	// Block 0x2e, offset 0x11d
+	{value: 0x0000, lo: 0x01},
+	{value: 0x9900, lo: 0x80, hi: 0x82},
+	// Block 0x2f, offset 0x11f
+	{value: 0x0000, lo: 0x01},
+	{value: 0x8133, lo: 0x9d, hi: 0x9f},
+	// Block 0x30, offset 0x121
+	{value: 0x0000, lo: 0x02},
+	{value: 0x8105, lo: 0x94, hi: 0x95},
+	{value: 0x8105, lo: 0xb4, hi: 0xb4},
+	// Block 0x31, offset 0x124
+	{value: 0x0000, lo: 0x02},
+	{value: 0x8105, lo: 0x92, hi: 0x92},
+	{value: 0x8133, lo: 0x9d, hi: 0x9d},
+	// Block 0x32, offset 0x127
+	{value: 0x0000, lo: 0x01},
+	{value: 0x8132, lo: 0xa9, hi: 0xa9},
+	// Block 0x33, offset 0x129
+	{value: 0x0004, lo: 0x02},
+	{value: 0x812f, lo: 0xb9, hi: 0xba},
+	{value: 0x812e, lo: 0xbb, hi: 0xbb},
+	// Block 0x34, offset 0x12c
+	{value: 0x0000, lo: 0x02},
+	{value: 0x8133, lo: 0x97, hi: 0x97},
+	{value: 0x812e, lo: 0x98, hi: 0x98},
+	// Block 0x35, offset 0x12f
+	{value: 0x0000, lo: 0x03},
+	{value: 0x8105, lo: 0xa0, hi: 0xa0},
+	{value: 0x8133, lo: 0xb5, hi: 0xbc},
+	{value: 0x812e, lo: 0xbf, hi: 0xbf},
+	// Block 0x36, offset 0x133
+	{value: 0x0000, lo: 0x05},
+	{value: 0x8133, lo: 0xb0, hi: 0xb4},
+	{value: 0x812e, lo: 0xb5, hi: 0xba},
+	{value: 0x8133, lo: 0xbb, hi: 0xbc},
+	{value: 0x812e, lo: 0xbd, hi: 0xbd},
+	{value: 0x812e, lo: 0xbf, hi: 0xbf},
+	// Block 0x37, offset 0x139
+	{value: 0x0000, lo: 0x06},
+	{value: 0x812e, lo: 0x80, hi: 0x80},
+	{value: 0x8133, lo: 0x81, hi: 0x82},
+	{value: 0x812e, lo: 0x83, hi: 0x84},
+	{value: 0x8133, lo: 0x85, hi: 0x89},
+	{value: 0x812e, lo: 0x8a, hi: 0x8a},
+	{value: 0x8133, lo: 0x8b, hi: 0x8e},
+	// Block 0x38, offset 0x140
+	{value: 0x0000, lo: 0x08},
+	{value: 0x2e9d, lo: 0x80, hi: 0x80},
+	{value: 0x2ea5, lo: 0x81, hi: 0x81},
+	{value: 0xa000, lo: 0x82, hi: 0x82},
+	{value: 0x2ead, lo: 0x83, hi: 0x83},
+	{value: 0x8105, lo: 0x84, hi: 0x84},
+	{value: 0x8133, lo: 0xab, hi: 0xab},
+	{value: 0x812e, lo: 0xac, hi: 0xac},
+	{value: 0x8133, lo: 0xad, hi: 0xb3},
+	// Block 0x39, offset 0x149
+	{value: 0x0000, lo: 0x01},
+	{value: 0x8105, lo: 0xaa, hi: 0xab},
+	// Block 0x3a, offset 0x14b
+	{value: 0x0000, lo: 0x02},
+	{value: 0x8103, lo: 0xa6, hi: 0xa6},
+	{value: 0x8105, lo: 0xb2, hi: 0xb3},
+	// Block 0x3b, offset 0x14e
+	{value: 0x0000, lo: 0x01},
+	{value: 0x8103, lo: 0xb7, hi: 0xb7},
+	// Block 0x3c, offset 0x150
+	{value: 0x0000, lo: 0x0a},
+	{value: 0x8133, lo: 0x90, hi: 0x92},
+	{value: 0x8101, lo: 0x94, hi: 0x94},
+	{value: 0x812e, lo: 0x95, hi: 0x99},
+	{value: 0x8133, lo: 0x9a, hi: 0x9b},
+	{value: 0x812e, lo: 0x9c, hi: 0x9f},
+	{value: 0x8133, lo: 0xa0, hi: 0xa0},
+	{value: 0x8101, lo: 0xa2, hi: 0xa8},
+	{value: 0x812e, lo: 0xad, hi: 0xad},
+	{value: 0x8133, lo: 0xb4, hi: 0xb4},
+	{value: 0x8133, lo: 0xb8, hi: 0xb9},
+	// Block 0x3d, offset 0x15b
+	{value: 0x0002, lo: 0x0a},
+	{value: 0x0043, lo: 0xac, hi: 0xac},
+	{value: 0x00d1, lo: 0xad, hi: 0xad},
+	{value: 0x0045, lo: 0xae, hi: 0xae},
+	{value: 0x0049, lo: 0xb0, hi: 0xb1},
+	{value: 0x00ec, lo: 0xb2, hi: 0xb2},
+	{value: 0x004f, lo: 0xb3, hi: 0xba},
+	{value: 0x005f, lo: 0xbc, hi: 0xbc},
+	{value: 0x00fe, lo: 0xbd, hi: 0xbd},
+	{value: 0x0061, lo: 0xbe, hi: 0xbe},
+	{value: 0x0065, lo: 0xbf, hi: 0xbf},
+	// Block 0x3e, offset 0x166
+	{value: 0x0000, lo: 0x0d},
+	{value: 0x0001, lo: 0x80, hi: 0x8a},
+	{value: 0x0532, lo: 0x91, hi: 0x91},
+	{value: 0x43dc, lo: 0x97, hi: 0x97},
+	{value: 0x001d, lo: 0xa4, hi: 0xa4},
+	{value: 0x19a0, lo: 0xa5, hi: 0xa5},
+	{value: 0x1c8c, lo: 0xa6, hi: 0xa6},
+	{value: 0x0001, lo: 0xaf, hi: 0xaf},
+	{value: 0x27c1, lo: 0xb3, hi: 0xb3},
+	{value: 0x2935, lo: 0xb4, hi: 0xb4},
+	{value: 0x27c8, lo: 0xb6, hi: 0xb6},
+	{value: 0x293f, lo: 0xb7, hi: 0xb7},
+	{value: 0x199a, lo: 0xbc, hi: 0xbc},
+	{value: 0x43aa, lo: 0xbe, hi: 0xbe},
+	// Block 0x3f, offset 0x174
+	{value: 0x0002, lo: 0x0d},
+	{value: 0x1a60, lo: 0x87, hi: 0x87},
+	{value: 0x1a5d, lo: 0x88, hi: 0x88},
+	{value: 0x199d, lo: 0x89, hi: 0x89},
+	{value: 0x2ac5, lo: 0x97, hi: 0x97},
+	{value: 0x0001, lo: 0x9f, hi: 0x9f},
+	{value: 0x0021, lo: 0xb0, hi: 0xb0},
+	{value: 0x0093, lo: 0xb1, hi: 0xb1},
+	{value: 0x0029, lo: 0xb4, hi: 0xb9},
+	{value: 0x0017, lo: 0xba, hi: 0xba},
+	{value: 0x055e, lo: 0xbb, hi: 0xbb},
+	{value: 0x003b, lo: 0xbc, hi: 0xbc},
+	{value: 0x0011, lo: 0xbd, hi: 0xbe},
+	{value: 0x009d, lo: 0xbf, hi: 0xbf},
+	// Block 0x40, offset 0x182
+	{value: 0x0002, lo: 0x0f},
+	{value: 0x0021, lo: 0x80, hi: 0x89},
+	{value: 0x0017, lo: 0x8a, hi: 0x8a},
+	{value: 0x055e, lo: 0x8b, hi: 0x8b},
+	{value: 0x003b, lo: 0x8c, hi: 0x8c},
+	{value: 0x0011, lo: 0x8d, hi: 0x8e},
+	{value: 0x0083, lo: 0x90, hi: 0x90},
+	{value: 0x008b, lo: 0x91, hi: 0x91},
+	{value: 0x009f, lo: 0x92, hi: 0x92},
+	{value: 0x00b1, lo: 0x93, hi: 0x93},
+	{value: 0x011f, lo: 0x94, hi: 0x94},
+	{value: 0x0091, lo: 0x95, hi: 0x95},
+	{value: 0x0097, lo: 0x96, hi: 0x99},
+	{value: 0x00a1, lo: 0x9a, hi: 0x9a},
+	{value: 0x00a7, lo: 0x9b, hi: 0x9c},
+	{value: 0x1ac9, lo: 0xa8, hi: 0xa8},
+	// Block 0x41, offset 0x192
+	{value: 0x0000, lo: 0x0d},
+	{value: 0x8133, lo: 0x90, hi: 0x91},
+	{value: 0x8101, lo: 0x92, hi: 0x93},
+	{value: 0x8133, lo: 0x94, hi: 0x97},
+	{value: 0x8101, lo: 0x98, hi: 0x9a},
+	{value: 0x8133, lo: 0x9b, hi: 0x9c},
+	{value: 0x8133, lo: 0xa1, hi: 0xa1},
+	{value: 0x8101, lo: 0xa5, hi: 0xa6},
+	{value: 0x8133, lo: 0xa7, hi: 0xa7},
+	{value: 0x812e, lo: 0xa8, hi: 0xa8},
+	{value: 0x8133, lo: 0xa9, hi: 0xa9},
+	{value: 0x8101, lo: 0xaa, hi: 0xab},
+	{value: 0x812e, lo: 0xac, hi: 0xaf},
+	{value: 0x8133, lo: 0xb0, hi: 0xb0},
+	// Block 0x42, offset 0x1a0
+	{value: 0x0007, lo: 0x06},
+	{value: 0x22b0, lo: 0x89, hi: 0x89},
+	{value: 0xa000, lo: 0x90, hi: 0x90},
+	{value: 0xa000, lo: 0x92, hi: 0x92},
+	{value: 0xa000, lo: 0x94, hi: 0x94},
+	{value: 0x3cfa, lo: 0x9a, hi: 0x9b},
+	{value: 0x3d08, lo: 0xae, hi: 0xae},
+	// Block 0x43, offset 0x1a7
+	{value: 0x000e, lo: 0x05},
+	{value: 0x3d0f, lo: 0x8d, hi: 0x8e},
+	{value: 0x3d16, lo: 0x8f, hi: 0x8f},
+	{value: 0xa000, lo: 0x90, hi: 0x90},
+	{value: 0xa000, lo: 0x92, hi: 0x92},
+	{value: 0xa000, lo: 0x94, hi: 0x94},
+	// Block 0x44, offset 0x1ad
+	{value: 0x017a, lo: 0x0e},
+	{value: 0xa000, lo: 0x83, hi: 0x83},
+	{value: 0x3d24, lo: 0x84, hi: 0x84},
+	{value: 0xa000, lo: 0x88, hi: 0x88},
+	{value: 0x3d2b, lo: 0x89, hi: 0x89},
+	{value: 0xa000, lo: 0x8b, hi: 0x8b},
+	{value: 0x3d32, lo: 0x8c, hi: 0x8c},
+	{value: 0xa000, lo: 0xa3, hi: 0xa3},
+	{value: 0x3d39, lo: 0xa4, hi: 0xa4},
+	{value: 0xa000, lo: 0xa5, hi: 0xa5},
+	{value: 0x3d40, lo: 0xa6, hi: 0xa6},
+	{value: 0x27cf, lo: 0xac, hi: 0xad},
+	{value: 0x27d6, lo: 0xaf, hi: 0xaf},
+	{value: 0x2953, lo: 0xb0, hi: 0xb0},
+	{value: 0xa000, lo: 0xbc, hi: 0xbc},
+	// Block 0x45, offset 0x1bc
+	{value: 0x0007, lo: 0x03},
+	{value: 0x3da9, lo: 0xa0, hi: 0xa1},
+	{value: 0x3dd3, lo: 0xa2, hi: 0xa3},
+	{value: 0x3dfd, lo: 0xaa, hi: 0xad},
+	// Block 0x46, offset 0x1c0
+	{value: 0x0004, lo: 0x01},
+	{value: 0x0586, lo: 0xa9, hi: 0xaa},
+	// Block 0x47, offset 0x1c2
+	{value: 0x0002, lo: 0x03},
+	{value: 0x0057, lo: 0x80, hi: 0x8f},
+	{value: 0x0083, lo: 0x90, hi: 0xa9},
+	{value: 0x0021, lo: 0xaa, hi: 0xaa},
+	// Block 0x48, offset 0x1c6
+	{value: 0x0000, lo: 0x01},
+	{value: 0x2ad2, lo: 0x8c, hi: 0x8c},
+	// Block 0x49, offset 0x1c8
+	{value: 0x0266, lo: 0x02},
+	{value: 0x1cbc, lo: 0xb4, hi: 0xb4},
+	{value: 0x1a5a, lo: 0xb5, hi: 0xb6},
+	// Block 0x4a, offset 0x1cb
+	{value: 0x0000, lo: 0x01},
+	{value: 0x461e, lo: 0x9c, hi: 0x9c},
+	// Block 0x4b, offset 0x1cd
+	{value: 0x0000, lo: 0x02},
+	{value: 0x0095, lo: 0xbc, hi: 0xbc},
+	{value: 0x006d, lo: 0xbd, hi: 0xbd},
+	// Block 0x4c, offset 0x1d0
+	{value: 0x0000, lo: 0x01},
+	{value: 0x8133, lo: 0xaf, hi: 0xb1},
+	// Block 0x4d, offset 0x1d2
+	{value: 0x0000, lo: 0x02},
+	{value: 0x057a, lo: 0xaf, hi: 0xaf},
+	{value: 0x8105, lo: 0xbf, hi: 0xbf},
+	// Block 0x4e, offset 0x1d5
+	{value: 0x0000, lo: 0x01},
+	{value: 0x8133, lo: 0xa0, hi: 0xbf},
+	// Block 0x4f, offset 0x1d7
+	{value: 0x0000, lo: 0x01},
+	{value: 0x0ebe, lo: 0x9f, hi: 0x9f},
+	// Block 0x50, offset 0x1d9
+	{value: 0x0000, lo: 0x01},
+	{value: 0x172a, lo: 0xb3, hi: 0xb3},
+	// Block 0x51, offset 0x1db
+	{value: 0x0004, lo: 0x0b},
+	{value: 0x1692, lo: 0x80, hi: 0x82},
+	{value: 0x16aa, lo: 0x83, hi: 0x83},
+	{value: 0x16c2, lo: 0x84, hi: 0x85},
+	{value: 0x16d2, lo: 0x86, hi: 0x89},
+	{value: 0x16e6, lo: 0x8a, hi: 0x8c},
+	{value: 0x16fa, lo: 0x8d, hi: 0x8d},
+	{value: 0x1702, lo: 0x8e, hi: 0x8e},
+	{value: 0x170a, lo: 0x8f, hi: 0x90},
+	{value: 0x1716, lo: 0x91, hi: 0x93},
+	{value: 0x1726, lo: 0x94, hi: 0x94},
+	{value: 0x172e, lo: 0x95, hi: 0x95},
+	// Block 0x52, offset 0x1e7
+	{value: 0x0004, lo: 0x09},
+	{value: 0x0001, lo: 0x80, hi: 0x80},
+	{value: 0x812d, lo: 0xaa, hi: 0xaa},
+	{value: 0x8132, lo: 0xab, hi: 0xab},
+	{value: 0x8134, lo: 0xac, hi: 0xac},
+	{value: 0x812f, lo: 0xad, hi: 0xad},
+	{value: 0x8130, lo: 0xae, hi: 0xae},
+	{value: 0x8130, lo: 0xaf, hi: 0xaf},
+	{value: 0x05ae, lo: 0xb6, hi: 0xb6},
+	{value: 0x0982, lo: 0xb8, hi: 0xba},
+	// Block 0x53, offset 0x1f1
+	{value: 0x0006, lo: 0x09},
+	{value: 0x0406, lo: 0xb1, hi: 0xb1},
+	{value: 0x040a, lo: 0xb2, hi: 0xb2},
+	{value: 0x4b7c, lo: 0xb3, hi: 0xb3},
+	{value: 0x040e, lo: 0xb4, hi: 0xb4},
+	{value: 0x4b82, lo: 0xb5, hi: 0xb6},
+	{value: 0x0412, lo: 0xb7, hi: 0xb7},
+	{value: 0x0416, lo: 0xb8, hi: 0xb8},
+	{value: 0x041a, lo: 0xb9, hi: 0xb9},
+	{value: 0x4b8e, lo: 0xba, hi: 0xbf},
+	// Block 0x54, offset 0x1fb
+	{value: 0x0000, lo: 0x02},
+	{value: 0x8133, lo: 0xaf, hi: 0xaf},
+	{value: 0x8133, lo: 0xb4, hi: 0xbd},
+	// Block 0x55, offset 0x1fe
+	{value: 0x0000, lo: 0x03},
+	{value: 0x02d8, lo: 0x9c, hi: 0x9c},
+	{value: 0x02de, lo: 0x9d, hi: 0x9d},
+	{value: 0x8133, lo: 0x9e, hi: 0x9f},
+	// Block 0x56, offset 0x202
+	{value: 0x0000, lo: 0x01},
+	{value: 0x8133, lo: 0xb0, hi: 0xb1},
+	// Block 0x57, offset 0x204
+	{value: 0x0000, lo: 0x01},
+	{value: 0x173e, lo: 0xb0, hi: 0xb0},
+	// Block 0x58, offset 0x206
+	{value: 0x0006, lo: 0x04},
+	{value: 0x0047, lo: 0xb2, hi: 0xb3},
+	{value: 0x0063, lo: 0xb4, hi: 0xb4},
+	{value: 0x00dd, lo: 0xb8, hi: 0xb8},
+	{value: 0x00e9, lo: 0xb9, hi: 0xb9},
+	// Block 0x59, offset 0x20b
+	{value: 0x0000, lo: 0x02},
+	{value: 0x8105, lo: 0x86, hi: 0x86},
+	{value: 0x8105, lo: 0xac, hi: 0xac},
+	// Block 0x5a, offset 0x20e
+	{value: 0x0000, lo: 0x02},
+	{value: 0x8105, lo: 0x84, hi: 0x84},
+	{value: 0x8133, lo: 0xa0, hi: 0xb1},
+	// Block 0x5b, offset 0x211
+	{value: 0x0000, lo: 0x01},
+	{value: 0x812e, lo: 0xab, hi: 0xad},
+	// Block 0x5c, offset 0x213
+	{value: 0x0000, lo: 0x01},
+	{value: 0x8105, lo: 0x93, hi: 0x93},
+	// Block 0x5d, offset 0x215
+	{value: 0x0000, lo: 0x01},
+	{value: 0x8103, lo: 0xb3, hi: 0xb3},
+	// Block 0x5e, offset 0x217
+	{value: 0x0000, lo: 0x01},
+	{value: 0x8105, lo: 0x80, hi: 0x80},
+	// Block 0x5f, offset 0x219
+	{value: 0x0000, lo: 0x05},
+	{value: 0x8133, lo: 0xb0, hi: 0xb0},
+	{value: 0x8133, lo: 0xb2, hi: 0xb3},
+	{value: 0x812e, lo: 0xb4, hi: 0xb4},
+	{value: 0x8133, lo: 0xb7, hi: 0xb8},
+	{value: 0x8133, lo: 0xbe, hi: 0xbf},
+	// Block 0x60, offset 0x21f
+	{value: 0x0000, lo: 0x02},
+	{value: 0x8133, lo: 0x81, hi: 0x81},
+	{value: 0x8105, lo: 0xb6, hi: 0xb6},
+	// Block 0x61, offset 0x222
+	{value: 0x000c, lo: 0x04},
+	{value: 0x173a, lo: 0x9c, hi: 0x9d},
+	{value: 0x014f, lo: 0x9e, hi: 0x9e},
+	{value: 0x174a, lo: 0x9f, hi: 0x9f},
+	{value: 0x01a6, lo: 0xa9, hi: 0xa9},
+	// Block 0x62, offset 0x227
+	{value: 0x0000, lo: 0x01},
+	{value: 0x8105, lo: 0xad, hi: 0xad},
+	// Block 0x63, offset 0x229
+	{value: 0x0000, lo: 0x06},
+	{value: 0xe500, lo: 0x80, hi: 0x80},
+	{value: 0xc600, lo: 0x81, hi: 0x9b},
+	{value: 0xe500, lo: 0x9c, hi: 0x9c},
+	{value: 0xc600, lo: 0x9d, hi: 0xb7},
+	{value: 0xe500, lo: 0xb8, hi: 0xb8},
+	{value: 0xc600, lo: 0xb9, hi: 0xbf},
+	// Block 0x64, offset 0x230
+	{value: 0x0000, lo: 0x05},
+	{value: 0xc600, lo: 0x80, hi: 0x93},
+	{value: 0xe500, lo: 0x94, hi: 0x94},
+	{value: 0xc600, lo: 0x95, hi: 0xaf},
+	{value: 0xe500, lo: 0xb0, hi: 0xb0},
+	{value: 0xc600, lo: 0xb1, hi: 0xbf},
+	// Block 0x65, offset 0x236
+	{value: 0x0000, lo: 0x05},
+	{value: 0xc600, lo: 0x80, hi: 0x8b},
+	{value: 0xe500, lo: 0x8c, hi: 0x8c},
+	{value: 0xc600, lo: 0x8d, hi: 0xa7},
+	{value: 0xe500, lo: 0xa8, hi: 0xa8},
+	{value: 0xc600, lo: 0xa9, hi: 0xbf},
+	// Block 0x66, offset 0x23c
+	{value: 0x0000, lo: 0x07},
+	{value: 0xc600, lo: 0x80, hi: 0x83},
+	{value: 0xe500, lo: 0x84, hi: 0x84},
+	{value: 0xc600, lo: 0x85, hi: 0x9f},
+	{value: 0xe500, lo: 0xa0, hi: 0xa0},
+	{value: 0xc600, lo: 0xa1, hi: 0xbb},
+	{value: 0xe500, lo: 0xbc, hi: 0xbc},
+	{value: 0xc600, lo: 0xbd, hi: 0xbf},
+	// Block 0x67, offset 0x244
+	{value: 0x0000, lo: 0x05},
+	{value: 0xc600, lo: 0x80, hi: 0x97},
+	{value: 0xe500, lo: 0x98, hi: 0x98},
+	{value: 0xc600, lo: 0x99, hi: 0xb3},
+	{value: 0xe500, lo: 0xb4, hi: 0xb4},
+	{value: 0xc600, lo: 0xb5, hi: 0xbf},
+	// Block 0x68, offset 0x24a
+	{value: 0x0000, lo: 0x05},
+	{value: 0xc600, lo: 0x80, hi: 0x8f},
+	{value: 0xe500, lo: 0x90, hi: 0x90},
+	{value: 0xc600, lo: 0x91, hi: 0xab},
+	{value: 0xe500, lo: 0xac, hi: 0xac},
+	{value: 0xc600, lo: 0xad, hi: 0xbf},
+	// Block 0x69, offset 0x250
+	{value: 0x0000, lo: 0x05},
+	{value: 0xc600, lo: 0x80, hi: 0x87},
+	{value: 0xe500, lo: 0x88, hi: 0x88},
+	{value: 0xc600, lo: 0x89, hi: 0xa3},
+	{value: 0xe500, lo: 0xa4, hi: 0xa4},
+	{value: 0xc600, lo: 0xa5, hi: 0xbf},
+	// Block 0x6a, offset 0x256
+	{value: 0x0000, lo: 0x03},
+	{value: 0xc600, lo: 0x80, hi: 0x87},
+	{value: 0xe500, lo: 0x88, hi: 0x88},
+	{value: 0xc600, lo: 0x89, hi: 0xa3},
+	// Block 0x6b, offset 0x25a
+	{value: 0x0002, lo: 0x01},
+	{value: 0x0003, lo: 0x81, hi: 0xbf},
+	// Block 0x6c, offset 0x25c
+	{value: 0x0000, lo: 0x01},
+	{value: 0x812e, lo: 0xbd, hi: 0xbd},
+	// Block 0x6d, offset 0x25e
+	{value: 0x0000, lo: 0x01},
+	{value: 0x812e, lo: 0xa0, hi: 0xa0},
+	// Block 0x6e, offset 0x260
+	{value: 0x0000, lo: 0x01},
+	{value: 0x8133, lo: 0xb6, hi: 0xba},
+	// Block 0x6f, offset 0x262
+	{value: 0x002d, lo: 0x05},
+	{value: 0x812e, lo: 0x8d, hi: 0x8d},
+	{value: 0x8133, lo: 0x8f, hi: 0x8f},
+	{value: 0x8133, lo: 0xb8, hi: 0xb8},
+	{value: 0x8101, lo: 0xb9, hi: 0xba},
+	{value: 0x8105, lo: 0xbf, hi: 0xbf},
+	// Block 0x70, offset 0x268
+	{value: 0x0000, lo: 0x02},
+	{value: 0x8133, lo: 0xa5, hi: 0xa5},
+	{value: 0x812e, lo: 0xa6, hi: 0xa6},
+	// Block 0x71, offset 0x26b
+	{value: 0x0000, lo: 0x01},
+	{value: 0x8133, lo: 0xa4, hi: 0xa7},
+	// Block 0x72, offset 0x26d
+	{value: 0x0000, lo: 0x01},
+	{value: 0x8133, lo: 0xab, hi: 0xac},
+	// Block 0x73, offset 0x26f
+	{value: 0x0000, lo: 0x01},
+	{value: 0x812e, lo: 0xbd, hi: 0xbf},
+	// Block 0x74, offset 0x271
+	{value: 0x0000, lo: 0x05},
+	{value: 0x812e, lo: 0x86, hi: 0x87},
+	{value: 0x8133, lo: 0x88, hi: 0x8a},
+	{value: 0x812e, lo: 0x8b, hi: 0x8b},
+	{value: 0x8133, lo: 0x8c, hi: 0x8c},
+	{value: 0x812e, lo: 0x8d, hi: 0x90},
+	// Block 0x75, offset 0x277
+	{value: 0x0005, lo: 0x03},
+	{value: 0x8133, lo: 0x82, hi: 0x82},
+	{value: 0x812e, lo: 0x83, hi: 0x84},
+	{value: 0x812e, lo: 0x85, hi: 0x85},
+	// Block 0x76, offset 0x27b
+	{value: 0x0000, lo: 0x03},
+	{value: 0x8105, lo: 0x86, hi: 0x86},
+	{value: 0x8105, lo: 0xb0, hi: 0xb0},
+	{value: 0x8105, lo: 0xbf, hi: 0xbf},
+	// Block 0x77, offset 0x27f
+	{value: 0x17fe, lo: 0x07},
+	{value: 0xa000, lo: 0x99, hi: 0x99},
+	{value: 0x4379, lo: 0x9a, hi: 0x9a},
+	{value: 0xa000, lo: 0x9b, hi: 0x9b},
+	{value: 0x4383, lo: 0x9c, hi: 0x9c},
+	{value: 0xa000, lo: 0xa5, hi: 0xa5},
+	{value: 0x438d, lo: 0xab, hi: 0xab},
+	{value: 0x8105, lo: 0xb9, hi: 0xba},
+	// Block 0x78, offset 0x287
+	{value: 0x0000, lo: 0x06},
+	{value: 0x8133, lo: 0x80, hi: 0x82},
+	{value: 0x9900, lo: 0xa7, hi: 0xa7},
+	{value: 0x2eb5, lo: 0xae, hi: 0xae},
+	{value: 0x2ebf, lo: 0xaf, hi: 0xaf},
+	{value: 0xa000, lo: 0xb1, hi: 0xb2},
+	{value: 0x8105, lo: 0xb3, hi: 0xb4},
+	// Block 0x79, offset 0x28e
+	{value: 0x0000, lo: 0x02},
+	{value: 0x8105, lo: 0x80, hi: 0x80},
+	{value: 0x8103, lo: 0x8a, hi: 0x8a},
+	// Block 0x7a, offset 0x291
+	{value: 0x0000, lo: 0x02},
+	{value: 0x8105, lo: 0xb5, hi: 0xb5},
+	{value: 0x8103, lo: 0xb6, hi: 0xb6},
+	// Block 0x7b, offset 0x294
+	{value: 0x0002, lo: 0x01},
+	{value: 0x8103, lo: 0xa9, hi: 0xaa},
+	// Block 0x7c, offset 0x296
+	{value: 0x0000, lo: 0x02},
+	{value: 0x8103, lo: 0xbb, hi: 0xbc},
+	{value: 0x9900, lo: 0xbe, hi: 0xbe},
+	// Block 0x7d, offset 0x299
+	{value: 0x0000, lo: 0x07},
+	{value: 0xa000, lo: 0x87, hi: 0x87},
+	{value: 0x2ec9, lo: 0x8b, hi: 0x8b},
+	{value: 0x2ed3, lo: 0x8c, hi: 0x8c},
+	{value: 0x8105, lo: 0x8d, hi: 0x8d},
+	{value: 0x9900, lo: 0x97, hi: 0x97},
+	{value: 0x8133, lo: 0xa6, hi: 0xac},
+	{value: 0x8133, lo: 0xb0, hi: 0xb4},
+	// Block 0x7e, offset 0x2a1
+	{value: 0x0000, lo: 0x03},
+	{value: 0x8105, lo: 0x82, hi: 0x82},
+	{value: 0x8103, lo: 0x86, hi: 0x86},
+	{value: 0x8133, lo: 0x9e, hi: 0x9e},
+	// Block 0x7f, offset 0x2a5
+	{value: 0x6a23, lo: 0x06},
+	{value: 0x9900, lo: 0xb0, hi: 0xb0},
+	{value: 0xa000, lo: 0xb9, hi: 0xb9},
+	{value: 0x9900, lo: 0xba, hi: 0xba},
+	{value: 0x2ee7, lo: 0xbb, hi: 0xbb},
+	{value: 0x2edd, lo: 0xbc, hi: 0xbd},
+	{value: 0x2ef1, lo: 0xbe, hi: 0xbe},
+	// Block 0x80, offset 0x2ac
+	{value: 0x0000, lo: 0x02},
+	{value: 0x8105, lo: 0x82, hi: 0x82},
+	{value: 0x8103, lo: 0x83, hi: 0x83},
+	// Block 0x81, offset 0x2af
+	{value: 0x0000, lo: 0x05},
+	{value: 0x9900, lo: 0xaf, hi: 0xaf},
+	{value: 0xa000, lo: 0xb8, hi: 0xb9},
+	{value: 0x2efb, lo: 0xba, hi: 0xba},
+	{value: 0x2f05, lo: 0xbb, hi: 0xbb},
+	{value: 0x8105, lo: 0xbf, hi: 0xbf},
+	// Block 0x82, offset 0x2b5
+	{value: 0x0000, lo: 0x01},
+	{value: 0x8103, lo: 0x80, hi: 0x80},
+	// Block 0x83, offset 0x2b7
+	{value: 0x0000, lo: 0x01},
+	{value: 0x8105, lo: 0xbf, hi: 0xbf},
+	// Block 0x84, offset 0x2b9
+	{value: 0x0000, lo: 0x02},
+	{value: 0x8105, lo: 0xb6, hi: 0xb6},
+	{value: 0x8103, lo: 0xb7, hi: 0xb7},
+	// Block 0x85, offset 0x2bc
+	{value: 0x0000, lo: 0x01},
+	{value: 0x8105, lo: 0xab, hi: 0xab},
+	// Block 0x86, offset 0x2be
+	{value: 0x0000, lo: 0x02},
+	{value: 0x8105, lo: 0xb9, hi: 0xb9},
+	{value: 0x8103, lo: 0xba, hi: 0xba},
+	// Block 0x87, offset 0x2c1
+	{value: 0x0000, lo: 0x04},
+	{value: 0x9900, lo: 0xb0, hi: 0xb0},
+	{value: 0xa000, lo: 0xb5, hi: 0xb5},
+	{value: 0x2f0f, lo: 0xb8, hi: 0xb8},
+	{value: 0x8105, lo: 0xbd, hi: 0xbe},
+	// Block 0x88, offset 0x2c6
+	{value: 0x0000, lo: 0x01},
+	{value: 0x8103, lo: 0x83, hi: 0x83},
+	// Block 0x89, offset 0x2c8
+	{value: 0x0000, lo: 0x01},
+	{value: 0x8105, lo: 0xa0, hi: 0xa0},
+	// Block 0x8a, offset 0x2ca
+	{value: 0x0000, lo: 0x01},
+	{value: 0x8105, lo: 0xb4, hi: 0xb4},
+	// Block 0x8b, offset 0x2cc
+	{value: 0x0000, lo: 0x01},
+	{value: 0x8105, lo: 0x87, hi: 0x87},
+	// Block 0x8c, offset 0x2ce
+	{value: 0x0000, lo: 0x01},
+	{value: 0x8105, lo: 0x99, hi: 0x99},
+	// Block 0x8d, offset 0x2d0
+	{value: 0x0000, lo: 0x02},
+	{value: 0x8103, lo: 0x82, hi: 0x82},
+	{value: 0x8105, lo: 0x84, hi: 0x85},
+	// Block 0x8e, offset 0x2d3
+	{value: 0x0000, lo: 0x01},
+	{value: 0x8105, lo: 0x97, hi: 0x97},
+	// Block 0x8f, offset 0x2d5
+	{value: 0x0000, lo: 0x01},
+	{value: 0x8105, lo: 0x81, hi: 0x82},
+	// Block 0x90, offset 0x2d7
+	{value: 0x0000, lo: 0x01},
+	{value: 0x8101, lo: 0xb0, hi: 0xb4},
+	// Block 0x91, offset 0x2d9
+	{value: 0x0000, lo: 0x01},
+	{value: 0x8133, lo: 0xb0, hi: 0xb6},
+	// Block 0x92, offset 0x2db
+	{value: 0x0000, lo: 0x01},
+	{value: 0x8102, lo: 0xb0, hi: 0xb1},
+	// Block 0x93, offset 0x2dd
+	{value: 0x0000, lo: 0x01},
+	{value: 0x8101, lo: 0x9e, hi: 0x9e},
+	// Block 0x94, offset 0x2df
+	{value: 0x0000, lo: 0x0c},
+	{value: 0x470d, lo: 0x9e, hi: 0x9e},
+	{value: 0x4717, lo: 0x9f, hi: 0x9f},
+	{value: 0x474b, lo: 0xa0, hi: 0xa0},
+	{value: 0x4759, lo: 0xa1, hi: 0xa1},
+	{value: 0x4767, lo: 0xa2, hi: 0xa2},
+	{value: 0x4775, lo: 0xa3, hi: 0xa3},
+	{value: 0x4783, lo: 0xa4, hi: 0xa4},
+	{value: 0x812c, lo: 0xa5, hi: 0xa6},
+	{value: 0x8101, lo: 0xa7, hi: 0xa9},
+	{value: 0x8131, lo: 0xad, hi: 0xad},
+	{value: 0x812c, lo: 0xae, hi: 0xb2},
+	{value: 0x812e, lo: 0xbb, hi: 0xbf},
+	// Block 0x95, offset 0x2ec
+	{value: 0x0000, lo: 0x09},
+	{value: 0x812e, lo: 0x80, hi: 0x82},
+	{value: 0x8133, lo: 0x85, hi: 0x89},
+	{value: 0x812e, lo: 0x8a, hi: 0x8b},
+	{value: 0x8133, lo: 0xaa, hi: 0xad},
+	{value: 0x4721, lo: 0xbb, hi: 0xbb},
+	{value: 0x472b, lo: 0xbc, hi: 0xbc},
+	{value: 0x4791, lo: 0xbd, hi: 0xbd},
+	{value: 0x47ad, lo: 0xbe, hi: 0xbe},
+	{value: 0x479f, lo: 0xbf, hi: 0xbf},
+	// Block 0x96, offset 0x2f6
+	{value: 0x0000, lo: 0x01},
+	{value: 0x47bb, lo: 0x80, hi: 0x80},
+	// Block 0x97, offset 0x2f8
+	{value: 0x0000, lo: 0x01},
+	{value: 0x8133, lo: 0x82, hi: 0x84},
+	// Block 0x98, offset 0x2fa
+	{value: 0x0002, lo: 0x03},
+	{value: 0x0043, lo: 0x80, hi: 0x99},
+	{value: 0x0083, lo: 0x9a, hi: 0xb3},
+	{value: 0x0043, lo: 0xb4, hi: 0xbf},
+	// Block 0x99, offset 0x2fe
+	{value: 0x0002, lo: 0x04},
+	{value: 0x005b, lo: 0x80, hi: 0x8d},
+	{value: 0x0083, lo: 0x8e, hi: 0x94},
+	{value: 0x0093, lo: 0x96, hi: 0xa7},
+	{value: 0x0043, lo: 0xa8, hi: 0xbf},
+	// Block 0x9a, offset 0x303
+	{value: 0x0002, lo: 0x0b},
+	{value: 0x0073, lo: 0x80, hi: 0x81},
+	{value: 0x0083, lo: 0x82, hi: 0x9b},
+	{value: 0x0043, lo: 0x9c, hi: 0x9c},
+	{value: 0x0047, lo: 0x9e, hi: 0x9f},
+	{value: 0x004f, lo: 0xa2, hi: 0xa2},
+	{value: 0x0055, lo: 0xa5, hi: 0xa6},
+	{value: 0x005d, lo: 0xa9, hi: 0xac},
+	{value: 0x0067, lo: 0xae, hi: 0xb5},
+	{value: 0x0083, lo: 0xb6, hi: 0xb9},
+	{value: 0x008d, lo: 0xbb, hi: 0xbb},
+	{value: 0x0091, lo: 0xbd, hi: 0xbf},
+	// Block 0x9b, offset 0x30f
+	{value: 0x0002, lo: 0x04},
+	{value: 0x0097, lo: 0x80, hi: 0x83},
+	{value: 0x00a1, lo: 0x85, hi: 0x8f},
+	{value: 0x0043, lo: 0x90, hi: 0xa9},
+	{value: 0x0083, lo: 0xaa, hi: 0xbf},
+	// Block 0x9c, offset 0x314
+	{value: 0x0002, lo: 0x08},
+	{value: 0x00af, lo: 0x80, hi: 0x83},
+	{value: 0x0043, lo: 0x84, hi: 0x85},
+	{value: 0x0049, lo: 0x87, hi: 0x8a},
+	{value: 0x0055, lo: 0x8d, hi: 0x94},
+	{value: 0x0067, lo: 0x96, hi: 0x9c},
+	{value: 0x0083, lo: 0x9e, hi: 0xb7},
+	{value: 0x0043, lo: 0xb8, hi: 0xb9},
+	{value: 0x0049, lo: 0xbb, hi: 0xbe},
+	// Block 0x9d, offset 0x31d
+	{value: 0x0002, lo: 0x05},
+	{value: 0x0053, lo: 0x80, hi: 0x84},
+	{value: 0x005f, lo: 0x86, hi: 0x86},
+	{value: 0x0067, lo: 0x8a, hi: 0x90},
+	{value: 0x0083, lo: 0x92, hi: 0xab},
+	{value: 0x0043, lo: 0xac, hi: 0xbf},
+	// Block 0x9e, offset 0x323
+	{value: 0x0002, lo: 0x04},
+	{value: 0x006b, lo: 0x80, hi: 0x85},
+	{value: 0x0083, lo: 0x86, hi: 0x9f},
+	{value: 0x0043, lo: 0xa0, hi: 0xb9},
+	{value: 0x0083, lo: 0xba, hi: 0xbf},
+	// Block 0x9f, offset 0x328
+	{value: 0x0002, lo: 0x03},
+	{value: 0x008f, lo: 0x80, hi: 0x93},
+	{value: 0x0043, lo: 0x94, hi: 0xad},
+	{value: 0x0083, lo: 0xae, hi: 0xbf},
+	// Block 0xa0, offset 0x32c
+	{value: 0x0002, lo: 0x04},
+	{value: 0x00a7, lo: 0x80, hi: 0x87},
+	{value: 0x0043, lo: 0x88, hi: 0xa1},
+	{value: 0x0083, lo: 0xa2, hi: 0xbb},
+	{value: 0x0043, lo: 0xbc, hi: 0xbf},
+	// Block 0xa1, offset 0x331
+	{value: 0x0002, lo: 0x03},
+	{value: 0x004b, lo: 0x80, hi: 0x95},
+	{value: 0x0083, lo: 0x96, hi: 0xaf},
+	{value: 0x0043, lo: 0xb0, hi: 0xbf},
+	// Block 0xa2, offset 0x335
+	{value: 0x0003, lo: 0x0f},
+	{value: 0x023c, lo: 0x80, hi: 0x80},
+	{value: 0x0556, lo: 0x81, hi: 0x81},
+	{value: 0x023f, lo: 0x82, hi: 0x9a},
+	{value: 0x0552, lo: 0x9b, hi: 0x9b},
+	{value: 0x024b, lo: 0x9c, hi: 0x9c},
+	{value: 0x0254, lo: 0x9d, hi: 0x9d},
+	{value: 0x025a, lo: 0x9e, hi: 0x9e},
+	{value: 0x027e, lo: 0x9f, hi: 0x9f},
+	{value: 0x026f, lo: 0xa0, hi: 0xa0},
+	{value: 0x026c, lo: 0xa1, hi: 0xa1},
+	{value: 0x01f7, lo: 0xa2, hi: 0xb2},
+	{value: 0x020c, lo: 0xb3, hi: 0xb3},
+	{value: 0x022a, lo: 0xb4, hi: 0xba},
+	{value: 0x0556, lo: 0xbb, hi: 0xbb},
+	{value: 0x023f, lo: 0xbc, hi: 0xbf},
+	// Block 0xa3, offset 0x345
+	{value: 0x0003, lo: 0x0d},
+	{value: 0x024b, lo: 0x80, hi: 0x94},
+	{value: 0x0552, lo: 0x95, hi: 0x95},
+	{value: 0x024b, lo: 0x96, hi: 0x96},
+	{value: 0x0254, lo: 0x97, hi: 0x97},
+	{value: 0x025a, lo: 0x98, hi: 0x98},
+	{value: 0x027e, lo: 0x99, hi: 0x99},
+	{value: 0x026f, lo: 0x9a, hi: 0x9a},
+	{value: 0x026c, lo: 0x9b, hi: 0x9b},
+	{value: 0x01f7, lo: 0x9c, hi: 0xac},
+	{value: 0x020c, lo: 0xad, hi: 0xad},
+	{value: 0x022a, lo: 0xae, hi: 0xb4},
+	{value: 0x0556, lo: 0xb5, hi: 0xb5},
+	{value: 0x023f, lo: 0xb6, hi: 0xbf},
+	// Block 0xa4, offset 0x353
+	{value: 0x0003, lo: 0x0d},
+	{value: 0x025d, lo: 0x80, hi: 0x8e},
+	{value: 0x0552, lo: 0x8f, hi: 0x8f},
+	{value: 0x024b, lo: 0x90, hi: 0x90},
+	{value: 0x0254, lo: 0x91, hi: 0x91},
+	{value: 0x025a, lo: 0x92, hi: 0x92},
+	{value: 0x027e, lo: 0x93, hi: 0x93},
+	{value: 0x026f, lo: 0x94, hi: 0x94},
+	{value: 0x026c, lo: 0x95, hi: 0x95},
+	{value: 0x01f7, lo: 0x96, hi: 0xa6},
+	{value: 0x020c, lo: 0xa7, hi: 0xa7},
+	{value: 0x022a, lo: 0xa8, hi: 0xae},
+	{value: 0x0556, lo: 0xaf, hi: 0xaf},
+	{value: 0x023f, lo: 0xb0, hi: 0xbf},
+	// Block 0xa5, offset 0x361
+	{value: 0x0003, lo: 0x0d},
+	{value: 0x026f, lo: 0x80, hi: 0x88},
+	{value: 0x0552, lo: 0x89, hi: 0x89},
+	{value: 0x024b, lo: 0x8a, hi: 0x8a},
+	{value: 0x0254, lo: 0x8b, hi: 0x8b},
+	{value: 0x025a, lo: 0x8c, hi: 0x8c},
+	{value: 0x027e, lo: 0x8d, hi: 0x8d},
+	{value: 0x026f, lo: 0x8e, hi: 0x8e},
+	{value: 0x026c, lo: 0x8f, hi: 0x8f},
+	{value: 0x01f7, lo: 0x90, hi: 0xa0},
+	{value: 0x020c, lo: 0xa1, hi: 0xa1},
+	{value: 0x022a, lo: 0xa2, hi: 0xa8},
+	{value: 0x0556, lo: 0xa9, hi: 0xa9},
+	{value: 0x023f, lo: 0xaa, hi: 0xbf},
+	// Block 0xa6, offset 0x36f
+	{value: 0x0000, lo: 0x01},
+	{value: 0x8133, lo: 0x8f, hi: 0x8f},
+	// Block 0xa7, offset 0x371
+	{value: 0x0000, lo: 0x01},
+	{value: 0x8133, lo: 0xae, hi: 0xae},
+	// Block 0xa8, offset 0x373
+	{value: 0x0000, lo: 0x01},
+	{value: 0x8133, lo: 0xac, hi: 0xaf},
+	// Block 0xa9, offset 0x375
+	{value: 0x0000, lo: 0x03},
+	{value: 0x8134, lo: 0xac, hi: 0xad},
+	{value: 0x812e, lo: 0xae, hi: 0xae},
+	{value: 0x8133, lo: 0xaf, hi: 0xaf},
+	// Block 0xaa, offset 0x379
+	{value: 0x0000, lo: 0x01},
+	{value: 0x812e, lo: 0x90, hi: 0x96},
+	// Block 0xab, offset 0x37b
+	{value: 0x0000, lo: 0x02},
+	{value: 0x8133, lo: 0x84, hi: 0x89},
+	{value: 0x8103, lo: 0x8a, hi: 0x8a},
+	// Block 0xac, offset 0x37e
+	{value: 0x0002, lo: 0x0a},
+	{value: 0x0063, lo: 0x80, hi: 0x89},
+	{value: 0x1a7e, lo: 0x8a, hi: 0x8a},
+	{value: 0x1ab1, lo: 0x8b, hi: 0x8b},
+	{value: 0x1acc, lo: 0x8c, hi: 0x8c},
+	{value: 0x1ad2, lo: 0x8d, hi: 0x8d},
+	{value: 0x1cf0, lo: 0x8e, hi: 0x8e},
+	{value: 0x1ade, lo: 0x8f, hi: 0x8f},
+	{value: 0x1aa8, lo: 0xaa, hi: 0xaa},
+	{value: 0x1aab, lo: 0xab, hi: 0xab},
+	{value: 0x1aae, lo: 0xac, hi: 0xac},
+	// Block 0xad, offset 0x389
+	{value: 0x0000, lo: 0x01},
+	{value: 0x1a6c, lo: 0x90, hi: 0x90},
+	// Block 0xae, offset 0x38b
+	{value: 0x0028, lo: 0x09},
+	{value: 0x2999, lo: 0x80, hi: 0x80},
+	{value: 0x295d, lo: 0x81, hi: 0x81},
+	{value: 0x2967, lo: 0x82, hi: 0x82},
+	{value: 0x297b, lo: 0x83, hi: 0x84},
+	{value: 0x2985, lo: 0x85, hi: 0x86},
+	{value: 0x2971, lo: 0x87, hi: 0x87},
+	{value: 0x298f, lo: 0x88, hi: 0x88},
+	{value: 0x0c6a, lo: 0x90, hi: 0x90},
+	{value: 0x09e2, lo: 0x91, hi: 0x91},
+	// Block 0xaf, offset 0x395
+	{value: 0x0002, lo: 0x01},
+	{value: 0x0021, lo: 0xb0, hi: 0xb9},
+}
+
+// recompMap: 7528 bytes (entries only)
+var recompMap map[uint32]rune
+var recompMapOnce sync.Once
+
+const recompMapPacked = "" +
+	"\x00A\x03\x00\x00\x00\x00\xc0" + // 0x00410300: 0x000000C0
+	"\x00A\x03\x01\x00\x00\x00\xc1" + // 0x00410301: 0x000000C1
+	"\x00A\x03\x02\x00\x00\x00\xc2" + // 0x00410302: 0x000000C2
+	"\x00A\x03\x03\x00\x00\x00\xc3" + // 0x00410303: 0x000000C3
+	"\x00A\x03\b\x00\x00\x00\xc4" + // 0x00410308: 0x000000C4
+	"\x00A\x03\n\x00\x00\x00\xc5" + // 0x0041030A: 0x000000C5
+	"\x00C\x03'\x00\x00\x00\xc7" + // 0x00430327: 0x000000C7
+	"\x00E\x03\x00\x00\x00\x00\xc8" + // 0x00450300: 0x000000C8
+	"\x00E\x03\x01\x00\x00\x00\xc9" + // 0x00450301: 0x000000C9
+	"\x00E\x03\x02\x00\x00\x00\xca" + // 0x00450302: 0x000000CA
+	"\x00E\x03\b\x00\x00\x00\xcb" + // 0x00450308: 0x000000CB
+	"\x00I\x03\x00\x00\x00\x00\xcc" + // 0x00490300: 0x000000CC
+	"\x00I\x03\x01\x00\x00\x00\xcd" + // 0x00490301: 0x000000CD
+	"\x00I\x03\x02\x00\x00\x00\xce" + // 0x00490302: 0x000000CE
+	"\x00I\x03\b\x00\x00\x00\xcf" + // 0x00490308: 0x000000CF
+	"\x00N\x03\x03\x00\x00\x00\xd1" + // 0x004E0303: 0x000000D1
+	"\x00O\x03\x00\x00\x00\x00\xd2" + // 0x004F0300: 0x000000D2
+	"\x00O\x03\x01\x00\x00\x00\xd3" + // 0x004F0301: 0x000000D3
+	"\x00O\x03\x02\x00\x00\x00\xd4" + // 0x004F0302: 0x000000D4
+	"\x00O\x03\x03\x00\x00\x00\xd5" + // 0x004F0303: 0x000000D5
+	"\x00O\x03\b\x00\x00\x00\xd6" + // 0x004F0308: 0x000000D6
+	"\x00U\x03\x00\x00\x00\x00\xd9" + // 0x00550300: 0x000000D9
+	"\x00U\x03\x01\x00\x00\x00\xda" + // 0x00550301: 0x000000DA
+	"\x00U\x03\x02\x00\x00\x00\xdb" + // 0x00550302: 0x000000DB
+	"\x00U\x03\b\x00\x00\x00\xdc" + // 0x00550308: 0x000000DC
+	"\x00Y\x03\x01\x00\x00\x00\xdd" + // 0x00590301: 0x000000DD
+	"\x00a\x03\x00\x00\x00\x00\xe0" + // 0x00610300: 0x000000E0
+	"\x00a\x03\x01\x00\x00\x00\xe1" + // 0x00610301: 0x000000E1
+	"\x00a\x03\x02\x00\x00\x00\xe2" + // 0x00610302: 0x000000E2
+	"\x00a\x03\x03\x00\x00\x00\xe3" + // 0x00610303: 0x000000E3
+	"\x00a\x03\b\x00\x00\x00\xe4" + // 0x00610308: 0x000000E4
+	"\x00a\x03\n\x00\x00\x00\xe5" + // 0x0061030A: 0x000000E5
+	"\x00c\x03'\x00\x00\x00\xe7" + // 0x00630327: 0x000000E7
+	"\x00e\x03\x00\x00\x00\x00\xe8" + // 0x00650300: 0x000000E8
+	"\x00e\x03\x01\x00\x00\x00\xe9" + // 0x00650301: 0x000000E9
+	"\x00e\x03\x02\x00\x00\x00\xea" + // 0x00650302: 0x000000EA
+	"\x00e\x03\b\x00\x00\x00\xeb" + // 0x00650308: 0x000000EB
+	"\x00i\x03\x00\x00\x00\x00\xec" + // 0x00690300: 0x000000EC
+	"\x00i\x03\x01\x00\x00\x00\xed" + // 0x00690301: 0x000000ED
+	"\x00i\x03\x02\x00\x00\x00\xee" + // 0x00690302: 0x000000EE
+	"\x00i\x03\b\x00\x00\x00\xef" + // 0x00690308: 0x000000EF
+	"\x00n\x03\x03\x00\x00\x00\xf1" + // 0x006E0303: 0x000000F1
+	"\x00o\x03\x00\x00\x00\x00\xf2" + // 0x006F0300: 0x000000F2
+	"\x00o\x03\x01\x00\x00\x00\xf3" + // 0x006F0301: 0x000000F3
+	"\x00o\x03\x02\x00\x00\x00\xf4" + // 0x006F0302: 0x000000F4
+	"\x00o\x03\x03\x00\x00\x00\xf5" + // 0x006F0303: 0x000000F5
+	"\x00o\x03\b\x00\x00\x00\xf6" + // 0x006F0308: 0x000000F6
+	"\x00u\x03\x00\x00\x00\x00\xf9" + // 0x00750300: 0x000000F9
+	"\x00u\x03\x01\x00\x00\x00\xfa" + // 0x00750301: 0x000000FA
+	"\x00u\x03\x02\x00\x00\x00\xfb" + // 0x00750302: 0x000000FB
+	"\x00u\x03\b\x00\x00\x00\xfc" + // 0x00750308: 0x000000FC
+	"\x00y\x03\x01\x00\x00\x00\xfd" + // 0x00790301: 0x000000FD
+	"\x00y\x03\b\x00\x00\x00\xff" + // 0x00790308: 0x000000FF
+	"\x00A\x03\x04\x00\x00\x01\x00" + // 0x00410304: 0x00000100
+	"\x00a\x03\x04\x00\x00\x01\x01" + // 0x00610304: 0x00000101
+	"\x00A\x03\x06\x00\x00\x01\x02" + // 0x00410306: 0x00000102
+	"\x00a\x03\x06\x00\x00\x01\x03" + // 0x00610306: 0x00000103
+	"\x00A\x03(\x00\x00\x01\x04" + // 0x00410328: 0x00000104
+	"\x00a\x03(\x00\x00\x01\x05" + // 0x00610328: 0x00000105
+	"\x00C\x03\x01\x00\x00\x01\x06" + // 0x00430301: 0x00000106
+	"\x00c\x03\x01\x00\x00\x01\a" + // 0x00630301: 0x00000107
+	"\x00C\x03\x02\x00\x00\x01\b" + // 0x00430302: 0x00000108
+	"\x00c\x03\x02\x00\x00\x01\t" + // 0x00630302: 0x00000109
+	"\x00C\x03\a\x00\x00\x01\n" + // 0x00430307: 0x0000010A
+	"\x00c\x03\a\x00\x00\x01\v" + // 0x00630307: 0x0000010B
+	"\x00C\x03\f\x00\x00\x01\f" + // 0x0043030C: 0x0000010C
+	"\x00c\x03\f\x00\x00\x01\r" + // 0x0063030C: 0x0000010D
+	"\x00D\x03\f\x00\x00\x01\x0e" + // 0x0044030C: 0x0000010E
+	"\x00d\x03\f\x00\x00\x01\x0f" + // 0x0064030C: 0x0000010F
+	"\x00E\x03\x04\x00\x00\x01\x12" + // 0x00450304: 0x00000112
+	"\x00e\x03\x04\x00\x00\x01\x13" + // 0x00650304: 0x00000113
+	"\x00E\x03\x06\x00\x00\x01\x14" + // 0x00450306: 0x00000114
+	"\x00e\x03\x06\x00\x00\x01\x15" + // 0x00650306: 0x00000115
+	"\x00E\x03\a\x00\x00\x01\x16" + // 0x00450307: 0x00000116
+	"\x00e\x03\a\x00\x00\x01\x17" + // 0x00650307: 0x00000117
+	"\x00E\x03(\x00\x00\x01\x18" + // 0x00450328: 0x00000118
+	"\x00e\x03(\x00\x00\x01\x19" + // 0x00650328: 0x00000119
+	"\x00E\x03\f\x00\x00\x01\x1a" + // 0x0045030C: 0x0000011A
+	"\x00e\x03\f\x00\x00\x01\x1b" + // 0x0065030C: 0x0000011B
+	"\x00G\x03\x02\x00\x00\x01\x1c" + // 0x00470302: 0x0000011C
+	"\x00g\x03\x02\x00\x00\x01\x1d" + // 0x00670302: 0x0000011D
+	"\x00G\x03\x06\x00\x00\x01\x1e" + // 0x00470306: 0x0000011E
+	"\x00g\x03\x06\x00\x00\x01\x1f" + // 0x00670306: 0x0000011F
+	"\x00G\x03\a\x00\x00\x01 " + // 0x00470307: 0x00000120
+	"\x00g\x03\a\x00\x00\x01!" + // 0x00670307: 0x00000121
+	"\x00G\x03'\x00\x00\x01\"" + // 0x00470327: 0x00000122
+	"\x00g\x03'\x00\x00\x01#" + // 0x00670327: 0x00000123
+	"\x00H\x03\x02\x00\x00\x01$" + // 0x00480302: 0x00000124
+	"\x00h\x03\x02\x00\x00\x01%" + // 0x00680302: 0x00000125
+	"\x00I\x03\x03\x00\x00\x01(" + // 0x00490303: 0x00000128
+	"\x00i\x03\x03\x00\x00\x01)" + // 0x00690303: 0x00000129
+	"\x00I\x03\x04\x00\x00\x01*" + // 0x00490304: 0x0000012A
+	"\x00i\x03\x04\x00\x00\x01+" + // 0x00690304: 0x0000012B
+	"\x00I\x03\x06\x00\x00\x01," + // 0x00490306: 0x0000012C
+	"\x00i\x03\x06\x00\x00\x01-" + // 0x00690306: 0x0000012D
+	"\x00I\x03(\x00\x00\x01." + // 0x00490328: 0x0000012E
+	"\x00i\x03(\x00\x00\x01/" + // 0x00690328: 0x0000012F
+	"\x00I\x03\a\x00\x00\x010" + // 0x00490307: 0x00000130
+	"\x00J\x03\x02\x00\x00\x014" + // 0x004A0302: 0x00000134
+	"\x00j\x03\x02\x00\x00\x015" + // 0x006A0302: 0x00000135
+	"\x00K\x03'\x00\x00\x016" + // 0x004B0327: 0x00000136
+	"\x00k\x03'\x00\x00\x017" + // 0x006B0327: 0x00000137
+	"\x00L\x03\x01\x00\x00\x019" + // 0x004C0301: 0x00000139
+	"\x00l\x03\x01\x00\x00\x01:" + // 0x006C0301: 0x0000013A
+	"\x00L\x03'\x00\x00\x01;" + // 0x004C0327: 0x0000013B
+	"\x00l\x03'\x00\x00\x01<" + // 0x006C0327: 0x0000013C
+	"\x00L\x03\f\x00\x00\x01=" + // 0x004C030C: 0x0000013D
+	"\x00l\x03\f\x00\x00\x01>" + // 0x006C030C: 0x0000013E
+	"\x00N\x03\x01\x00\x00\x01C" + // 0x004E0301: 0x00000143
+	"\x00n\x03\x01\x00\x00\x01D" + // 0x006E0301: 0x00000144
+	"\x00N\x03'\x00\x00\x01E" + // 0x004E0327: 0x00000145
+	"\x00n\x03'\x00\x00\x01F" + // 0x006E0327: 0x00000146
+	"\x00N\x03\f\x00\x00\x01G" + // 0x004E030C: 0x00000147
+	"\x00n\x03\f\x00\x00\x01H" + // 0x006E030C: 0x00000148
+	"\x00O\x03\x04\x00\x00\x01L" + // 0x004F0304: 0x0000014C
+	"\x00o\x03\x04\x00\x00\x01M" + // 0x006F0304: 0x0000014D
+	"\x00O\x03\x06\x00\x00\x01N" + // 0x004F0306: 0x0000014E
+	"\x00o\x03\x06\x00\x00\x01O" + // 0x006F0306: 0x0000014F
+	"\x00O\x03\v\x00\x00\x01P" + // 0x004F030B: 0x00000150
+	"\x00o\x03\v\x00\x00\x01Q" + // 0x006F030B: 0x00000151
+	"\x00R\x03\x01\x00\x00\x01T" + // 0x00520301: 0x00000154
+	"\x00r\x03\x01\x00\x00\x01U" + // 0x00720301: 0x00000155
+	"\x00R\x03'\x00\x00\x01V" + // 0x00520327: 0x00000156
+	"\x00r\x03'\x00\x00\x01W" + // 0x00720327: 0x00000157
+	"\x00R\x03\f\x00\x00\x01X" + // 0x0052030C: 0x00000158
+	"\x00r\x03\f\x00\x00\x01Y" + // 0x0072030C: 0x00000159
+	"\x00S\x03\x01\x00\x00\x01Z" + // 0x00530301: 0x0000015A
+	"\x00s\x03\x01\x00\x00\x01[" + // 0x00730301: 0x0000015B
+	"\x00S\x03\x02\x00\x00\x01\\" + // 0x00530302: 0x0000015C
+	"\x00s\x03\x02\x00\x00\x01]" + // 0x00730302: 0x0000015D
+	"\x00S\x03'\x00\x00\x01^" + // 0x00530327: 0x0000015E
+	"\x00s\x03'\x00\x00\x01_" + // 0x00730327: 0x0000015F
+	"\x00S\x03\f\x00\x00\x01`" + // 0x0053030C: 0x00000160
+	"\x00s\x03\f\x00\x00\x01a" + // 0x0073030C: 0x00000161
+	"\x00T\x03'\x00\x00\x01b" + // 0x00540327: 0x00000162
+	"\x00t\x03'\x00\x00\x01c" + // 0x00740327: 0x00000163
+	"\x00T\x03\f\x00\x00\x01d" + // 0x0054030C: 0x00000164
+	"\x00t\x03\f\x00\x00\x01e" + // 0x0074030C: 0x00000165
+	"\x00U\x03\x03\x00\x00\x01h" + // 0x00550303: 0x00000168
+	"\x00u\x03\x03\x00\x00\x01i" + // 0x00750303: 0x00000169
+	"\x00U\x03\x04\x00\x00\x01j" + // 0x00550304: 0x0000016A
+	"\x00u\x03\x04\x00\x00\x01k" + // 0x00750304: 0x0000016B
+	"\x00U\x03\x06\x00\x00\x01l" + // 0x00550306: 0x0000016C
+	"\x00u\x03\x06\x00\x00\x01m" + // 0x00750306: 0x0000016D
+	"\x00U\x03\n\x00\x00\x01n" + // 0x0055030A: 0x0000016E
+	"\x00u\x03\n\x00\x00\x01o" + // 0x0075030A: 0x0000016F
+	"\x00U\x03\v\x00\x00\x01p" + // 0x0055030B: 0x00000170
+	"\x00u\x03\v\x00\x00\x01q" + // 0x0075030B: 0x00000171
+	"\x00U\x03(\x00\x00\x01r" + // 0x00550328: 0x00000172
+	"\x00u\x03(\x00\x00\x01s" + // 0x00750328: 0x00000173
+	"\x00W\x03\x02\x00\x00\x01t" + // 0x00570302: 0x00000174
+	"\x00w\x03\x02\x00\x00\x01u" + // 0x00770302: 0x00000175
+	"\x00Y\x03\x02\x00\x00\x01v" + // 0x00590302: 0x00000176
+	"\x00y\x03\x02\x00\x00\x01w" + // 0x00790302: 0x00000177
+	"\x00Y\x03\b\x00\x00\x01x" + // 0x00590308: 0x00000178
+	"\x00Z\x03\x01\x00\x00\x01y" + // 0x005A0301: 0x00000179
+	"\x00z\x03\x01\x00\x00\x01z" + // 0x007A0301: 0x0000017A
+	"\x00Z\x03\a\x00\x00\x01{" + // 0x005A0307: 0x0000017B
+	"\x00z\x03\a\x00\x00\x01|" + // 0x007A0307: 0x0000017C
+	"\x00Z\x03\f\x00\x00\x01}" + // 0x005A030C: 0x0000017D
+	"\x00z\x03\f\x00\x00\x01~" + // 0x007A030C: 0x0000017E
+	"\x00O\x03\x1b\x00\x00\x01\xa0" + // 0x004F031B: 0x000001A0
+	"\x00o\x03\x1b\x00\x00\x01\xa1" + // 0x006F031B: 0x000001A1
+	"\x00U\x03\x1b\x00\x00\x01\xaf" + // 0x0055031B: 0x000001AF
+	"\x00u\x03\x1b\x00\x00\x01\xb0" + // 0x0075031B: 0x000001B0
+	"\x00A\x03\f\x00\x00\x01\xcd" + // 0x0041030C: 0x000001CD
+	"\x00a\x03\f\x00\x00\x01\xce" + // 0x0061030C: 0x000001CE
+	"\x00I\x03\f\x00\x00\x01\xcf" + // 0x0049030C: 0x000001CF
+	"\x00i\x03\f\x00\x00\x01\xd0" + // 0x0069030C: 0x000001D0
+	"\x00O\x03\f\x00\x00\x01\xd1" + // 0x004F030C: 0x000001D1
+	"\x00o\x03\f\x00\x00\x01\xd2" + // 0x006F030C: 0x000001D2
+	"\x00U\x03\f\x00\x00\x01\xd3" + // 0x0055030C: 0x000001D3
+	"\x00u\x03\f\x00\x00\x01\xd4" + // 0x0075030C: 0x000001D4
+	"\x00\xdc\x03\x04\x00\x00\x01\xd5" + // 0x00DC0304: 0x000001D5
+	"\x00\xfc\x03\x04\x00\x00\x01\xd6" + // 0x00FC0304: 0x000001D6
+	"\x00\xdc\x03\x01\x00\x00\x01\xd7" + // 0x00DC0301: 0x000001D7
+	"\x00\xfc\x03\x01\x00\x00\x01\xd8" + // 0x00FC0301: 0x000001D8
+	"\x00\xdc\x03\f\x00\x00\x01\xd9" + // 0x00DC030C: 0x000001D9
+	"\x00\xfc\x03\f\x00\x00\x01\xda" + // 0x00FC030C: 0x000001DA
+	"\x00\xdc\x03\x00\x00\x00\x01\xdb" + // 0x00DC0300: 0x000001DB
+	"\x00\xfc\x03\x00\x00\x00\x01\xdc" + // 0x00FC0300: 0x000001DC
+	"\x00\xc4\x03\x04\x00\x00\x01\xde" + // 0x00C40304: 0x000001DE
+	"\x00\xe4\x03\x04\x00\x00\x01\xdf" + // 0x00E40304: 0x000001DF
+	"\x02&\x03\x04\x00\x00\x01\xe0" + // 0x02260304: 0x000001E0
+	"\x02'\x03\x04\x00\x00\x01\xe1" + // 0x02270304: 0x000001E1
+	"\x00\xc6\x03\x04\x00\x00\x01\xe2" + // 0x00C60304: 0x000001E2
+	"\x00\xe6\x03\x04\x00\x00\x01\xe3" + // 0x00E60304: 0x000001E3
+	"\x00G\x03\f\x00\x00\x01\xe6" + // 0x0047030C: 0x000001E6
+	"\x00g\x03\f\x00\x00\x01\xe7" + // 0x0067030C: 0x000001E7
+	"\x00K\x03\f\x00\x00\x01\xe8" + // 0x004B030C: 0x000001E8
+	"\x00k\x03\f\x00\x00\x01\xe9" + // 0x006B030C: 0x000001E9
+	"\x00O\x03(\x00\x00\x01\xea" + // 0x004F0328: 0x000001EA
+	"\x00o\x03(\x00\x00\x01\xeb" + // 0x006F0328: 0x000001EB
+	"\x01\xea\x03\x04\x00\x00\x01\xec" + // 0x01EA0304: 0x000001EC
+	"\x01\xeb\x03\x04\x00\x00\x01\xed" + // 0x01EB0304: 0x000001ED
+	"\x01\xb7\x03\f\x00\x00\x01\xee" + // 0x01B7030C: 0x000001EE
+	"\x02\x92\x03\f\x00\x00\x01\xef" + // 0x0292030C: 0x000001EF
+	"\x00j\x03\f\x00\x00\x01\xf0" + // 0x006A030C: 0x000001F0
+	"\x00G\x03\x01\x00\x00\x01\xf4" + // 0x00470301: 0x000001F4
+	"\x00g\x03\x01\x00\x00\x01\xf5" + // 0x00670301: 0x000001F5
+	"\x00N\x03\x00\x00\x00\x01\xf8" + // 0x004E0300: 0x000001F8
+	"\x00n\x03\x00\x00\x00\x01\xf9" + // 0x006E0300: 0x000001F9
+	"\x00\xc5\x03\x01\x00\x00\x01\xfa" + // 0x00C50301: 0x000001FA
+	"\x00\xe5\x03\x01\x00\x00\x01\xfb" + // 0x00E50301: 0x000001FB
+	"\x00\xc6\x03\x01\x00\x00\x01\xfc" + // 0x00C60301: 0x000001FC
+	"\x00\xe6\x03\x01\x00\x00\x01\xfd" + // 0x00E60301: 0x000001FD
+	"\x00\xd8\x03\x01\x00\x00\x01\xfe" + // 0x00D80301: 0x000001FE
+	"\x00\xf8\x03\x01\x00\x00\x01\xff" + // 0x00F80301: 0x000001FF
+	"\x00A\x03\x0f\x00\x00\x02\x00" + // 0x0041030F: 0x00000200
+	"\x00a\x03\x0f\x00\x00\x02\x01" + // 0x0061030F: 0x00000201
+	"\x00A\x03\x11\x00\x00\x02\x02" + // 0x00410311: 0x00000202
+	"\x00a\x03\x11\x00\x00\x02\x03" + // 0x00610311: 0x00000203
+	"\x00E\x03\x0f\x00\x00\x02\x04" + // 0x0045030F: 0x00000204
+	"\x00e\x03\x0f\x00\x00\x02\x05" + // 0x0065030F: 0x00000205
+	"\x00E\x03\x11\x00\x00\x02\x06" + // 0x00450311: 0x00000206
+	"\x00e\x03\x11\x00\x00\x02\a" + // 0x00650311: 0x00000207
+	"\x00I\x03\x0f\x00\x00\x02\b" + // 0x0049030F: 0x00000208
+	"\x00i\x03\x0f\x00\x00\x02\t" + // 0x0069030F: 0x00000209
+	"\x00I\x03\x11\x00\x00\x02\n" + // 0x00490311: 0x0000020A
+	"\x00i\x03\x11\x00\x00\x02\v" + // 0x00690311: 0x0000020B
+	"\x00O\x03\x0f\x00\x00\x02\f" + // 0x004F030F: 0x0000020C
+	"\x00o\x03\x0f\x00\x00\x02\r" + // 0x006F030F: 0x0000020D
+	"\x00O\x03\x11\x00\x00\x02\x0e" + // 0x004F0311: 0x0000020E
+	"\x00o\x03\x11\x00\x00\x02\x0f" + // 0x006F0311: 0x0000020F
+	"\x00R\x03\x0f\x00\x00\x02\x10" + // 0x0052030F: 0x00000210
+	"\x00r\x03\x0f\x00\x00\x02\x11" + // 0x0072030F: 0x00000211
+	"\x00R\x03\x11\x00\x00\x02\x12" + // 0x00520311: 0x00000212
+	"\x00r\x03\x11\x00\x00\x02\x13" + // 0x00720311: 0x00000213
+	"\x00U\x03\x0f\x00\x00\x02\x14" + // 0x0055030F: 0x00000214
+	"\x00u\x03\x0f\x00\x00\x02\x15" + // 0x0075030F: 0x00000215
+	"\x00U\x03\x11\x00\x00\x02\x16" + // 0x00550311: 0x00000216
+	"\x00u\x03\x11\x00\x00\x02\x17" + // 0x00750311: 0x00000217
+	"\x00S\x03&\x00\x00\x02\x18" + // 0x00530326: 0x00000218
+	"\x00s\x03&\x00\x00\x02\x19" + // 0x00730326: 0x00000219
+	"\x00T\x03&\x00\x00\x02\x1a" + // 0x00540326: 0x0000021A
+	"\x00t\x03&\x00\x00\x02\x1b" + // 0x00740326: 0x0000021B
+	"\x00H\x03\f\x00\x00\x02\x1e" + // 0x0048030C: 0x0000021E
+	"\x00h\x03\f\x00\x00\x02\x1f" + // 0x0068030C: 0x0000021F
+	"\x00A\x03\a\x00\x00\x02&" + // 0x00410307: 0x00000226
+	"\x00a\x03\a\x00\x00\x02'" + // 0x00610307: 0x00000227
+	"\x00E\x03'\x00\x00\x02(" + // 0x00450327: 0x00000228
+	"\x00e\x03'\x00\x00\x02)" + // 0x00650327: 0x00000229
+	"\x00\xd6\x03\x04\x00\x00\x02*" + // 0x00D60304: 0x0000022A
+	"\x00\xf6\x03\x04\x00\x00\x02+" + // 0x00F60304: 0x0000022B
+	"\x00\xd5\x03\x04\x00\x00\x02," + // 0x00D50304: 0x0000022C
+	"\x00\xf5\x03\x04\x00\x00\x02-" + // 0x00F50304: 0x0000022D
+	"\x00O\x03\a\x00\x00\x02." + // 0x004F0307: 0x0000022E
+	"\x00o\x03\a\x00\x00\x02/" + // 0x006F0307: 0x0000022F
+	"\x02.\x03\x04\x00\x00\x020" + // 0x022E0304: 0x00000230
+	"\x02/\x03\x04\x00\x00\x021" + // 0x022F0304: 0x00000231
+	"\x00Y\x03\x04\x00\x00\x022" + // 0x00590304: 0x00000232
+	"\x00y\x03\x04\x00\x00\x023" + // 0x00790304: 0x00000233
+	"\x00\xa8\x03\x01\x00\x00\x03\x85" + // 0x00A80301: 0x00000385
+	"\x03\x91\x03\x01\x00\x00\x03\x86" + // 0x03910301: 0x00000386
+	"\x03\x95\x03\x01\x00\x00\x03\x88" + // 0x03950301: 0x00000388
+	"\x03\x97\x03\x01\x00\x00\x03\x89" + // 0x03970301: 0x00000389
+	"\x03\x99\x03\x01\x00\x00\x03\x8a" + // 0x03990301: 0x0000038A
+	"\x03\x9f\x03\x01\x00\x00\x03\x8c" + // 0x039F0301: 0x0000038C
+	"\x03\xa5\x03\x01\x00\x00\x03\x8e" + // 0x03A50301: 0x0000038E
+	"\x03\xa9\x03\x01\x00\x00\x03\x8f" + // 0x03A90301: 0x0000038F
+	"\x03\xca\x03\x01\x00\x00\x03\x90" + // 0x03CA0301: 0x00000390
+	"\x03\x99\x03\b\x00\x00\x03\xaa" + // 0x03990308: 0x000003AA
+	"\x03\xa5\x03\b\x00\x00\x03\xab" + // 0x03A50308: 0x000003AB
+	"\x03\xb1\x03\x01\x00\x00\x03\xac" + // 0x03B10301: 0x000003AC
+	"\x03\xb5\x03\x01\x00\x00\x03\xad" + // 0x03B50301: 0x000003AD
+	"\x03\xb7\x03\x01\x00\x00\x03\xae" + // 0x03B70301: 0x000003AE
+	"\x03\xb9\x03\x01\x00\x00\x03\xaf" + // 0x03B90301: 0x000003AF
+	"\x03\xcb\x03\x01\x00\x00\x03\xb0" + // 0x03CB0301: 0x000003B0
+	"\x03\xb9\x03\b\x00\x00\x03\xca" + // 0x03B90308: 0x000003CA
+	"\x03\xc5\x03\b\x00\x00\x03\xcb" + // 0x03C50308: 0x000003CB
+	"\x03\xbf\x03\x01\x00\x00\x03\xcc" + // 0x03BF0301: 0x000003CC
+	"\x03\xc5\x03\x01\x00\x00\x03\xcd" + // 0x03C50301: 0x000003CD
+	"\x03\xc9\x03\x01\x00\x00\x03\xce" + // 0x03C90301: 0x000003CE
+	"\x03\xd2\x03\x01\x00\x00\x03\xd3" + // 0x03D20301: 0x000003D3
+	"\x03\xd2\x03\b\x00\x00\x03\xd4" + // 0x03D20308: 0x000003D4
+	"\x04\x15\x03\x00\x00\x00\x04\x00" + // 0x04150300: 0x00000400
+	"\x04\x15\x03\b\x00\x00\x04\x01" + // 0x04150308: 0x00000401
+	"\x04\x13\x03\x01\x00\x00\x04\x03" + // 0x04130301: 0x00000403
+	"\x04\x06\x03\b\x00\x00\x04\a" + // 0x04060308: 0x00000407
+	"\x04\x1a\x03\x01\x00\x00\x04\f" + // 0x041A0301: 0x0000040C
+	"\x04\x18\x03\x00\x00\x00\x04\r" + // 0x04180300: 0x0000040D
+	"\x04#\x03\x06\x00\x00\x04\x0e" + // 0x04230306: 0x0000040E
+	"\x04\x18\x03\x06\x00\x00\x04\x19" + // 0x04180306: 0x00000419
+	"\x048\x03\x06\x00\x00\x049" + // 0x04380306: 0x00000439
+	"\x045\x03\x00\x00\x00\x04P" + // 0x04350300: 0x00000450
+	"\x045\x03\b\x00\x00\x04Q" + // 0x04350308: 0x00000451
+	"\x043\x03\x01\x00\x00\x04S" + // 0x04330301: 0x00000453
+	"\x04V\x03\b\x00\x00\x04W" + // 0x04560308: 0x00000457
+	"\x04:\x03\x01\x00\x00\x04\\" + // 0x043A0301: 0x0000045C
+	"\x048\x03\x00\x00\x00\x04]" + // 0x04380300: 0x0000045D
+	"\x04C\x03\x06\x00\x00\x04^" + // 0x04430306: 0x0000045E
+	"\x04t\x03\x0f\x00\x00\x04v" + // 0x0474030F: 0x00000476
+	"\x04u\x03\x0f\x00\x00\x04w" + // 0x0475030F: 0x00000477
+	"\x04\x16\x03\x06\x00\x00\x04\xc1" + // 0x04160306: 0x000004C1
+	"\x046\x03\x06\x00\x00\x04\xc2" + // 0x04360306: 0x000004C2
+	"\x04\x10\x03\x06\x00\x00\x04\xd0" + // 0x04100306: 0x000004D0
+	"\x040\x03\x06\x00\x00\x04\xd1" + // 0x04300306: 0x000004D1
+	"\x04\x10\x03\b\x00\x00\x04\xd2" + // 0x04100308: 0x000004D2
+	"\x040\x03\b\x00\x00\x04\xd3" + // 0x04300308: 0x000004D3
+	"\x04\x15\x03\x06\x00\x00\x04\xd6" + // 0x04150306: 0x000004D6
+	"\x045\x03\x06\x00\x00\x04\xd7" + // 0x04350306: 0x000004D7
+	"\x04\xd8\x03\b\x00\x00\x04\xda" + // 0x04D80308: 0x000004DA
+	"\x04\xd9\x03\b\x00\x00\x04\xdb" + // 0x04D90308: 0x000004DB
+	"\x04\x16\x03\b\x00\x00\x04\xdc" + // 0x04160308: 0x000004DC
+	"\x046\x03\b\x00\x00\x04\xdd" + // 0x04360308: 0x000004DD
+	"\x04\x17\x03\b\x00\x00\x04\xde" + // 0x04170308: 0x000004DE
+	"\x047\x03\b\x00\x00\x04\xdf" + // 0x04370308: 0x000004DF
+	"\x04\x18\x03\x04\x00\x00\x04\xe2" + // 0x04180304: 0x000004E2
+	"\x048\x03\x04\x00\x00\x04\xe3" + // 0x04380304: 0x000004E3
+	"\x04\x18\x03\b\x00\x00\x04\xe4" + // 0x04180308: 0x000004E4
+	"\x048\x03\b\x00\x00\x04\xe5" + // 0x04380308: 0x000004E5
+	"\x04\x1e\x03\b\x00\x00\x04\xe6" + // 0x041E0308: 0x000004E6
+	"\x04>\x03\b\x00\x00\x04\xe7" + // 0x043E0308: 0x000004E7
+	"\x04\xe8\x03\b\x00\x00\x04\xea" + // 0x04E80308: 0x000004EA
+	"\x04\xe9\x03\b\x00\x00\x04\xeb" + // 0x04E90308: 0x000004EB
+	"\x04-\x03\b\x00\x00\x04\xec" + // 0x042D0308: 0x000004EC
+	"\x04M\x03\b\x00\x00\x04\xed" + // 0x044D0308: 0x000004ED
+	"\x04#\x03\x04\x00\x00\x04\xee" + // 0x04230304: 0x000004EE
+	"\x04C\x03\x04\x00\x00\x04\xef" + // 0x04430304: 0x000004EF
+	"\x04#\x03\b\x00\x00\x04\xf0" + // 0x04230308: 0x000004F0
+	"\x04C\x03\b\x00\x00\x04\xf1" + // 0x04430308: 0x000004F1
+	"\x04#\x03\v\x00\x00\x04\xf2" + // 0x0423030B: 0x000004F2
+	"\x04C\x03\v\x00\x00\x04\xf3" + // 0x0443030B: 0x000004F3
+	"\x04'\x03\b\x00\x00\x04\xf4" + // 0x04270308: 0x000004F4
+	"\x04G\x03\b\x00\x00\x04\xf5" + // 0x04470308: 0x000004F5
+	"\x04+\x03\b\x00\x00\x04\xf8" + // 0x042B0308: 0x000004F8
+	"\x04K\x03\b\x00\x00\x04\xf9" + // 0x044B0308: 0x000004F9
+	"\x06'\x06S\x00\x00\x06\"" + // 0x06270653: 0x00000622
+	"\x06'\x06T\x00\x00\x06#" + // 0x06270654: 0x00000623
+	"\x06H\x06T\x00\x00\x06$" + // 0x06480654: 0x00000624
+	"\x06'\x06U\x00\x00\x06%" + // 0x06270655: 0x00000625
+	"\x06J\x06T\x00\x00\x06&" + // 0x064A0654: 0x00000626
+	"\x06\xd5\x06T\x00\x00\x06\xc0" + // 0x06D50654: 0x000006C0
+	"\x06\xc1\x06T\x00\x00\x06\xc2" + // 0x06C10654: 0x000006C2
+	"\x06\xd2\x06T\x00\x00\x06\xd3" + // 0x06D20654: 0x000006D3
+	"\t(\t<\x00\x00\t)" + // 0x0928093C: 0x00000929
+	"\t0\t<\x00\x00\t1" + // 0x0930093C: 0x00000931
+	"\t3\t<\x00\x00\t4" + // 0x0933093C: 0x00000934
+	"\t\xc7\t\xbe\x00\x00\t\xcb" + // 0x09C709BE: 0x000009CB
+	"\t\xc7\t\xd7\x00\x00\t\xcc" + // 0x09C709D7: 0x000009CC
+	"\vG\vV\x00\x00\vH" + // 0x0B470B56: 0x00000B48
+	"\vG\v>\x00\x00\vK" + // 0x0B470B3E: 0x00000B4B
+	"\vG\vW\x00\x00\vL" + // 0x0B470B57: 0x00000B4C
+	"\v\x92\v\xd7\x00\x00\v\x94" + // 0x0B920BD7: 0x00000B94
+	"\v\xc6\v\xbe\x00\x00\v\xca" + // 0x0BC60BBE: 0x00000BCA
+	"\v\xc7\v\xbe\x00\x00\v\xcb" + // 0x0BC70BBE: 0x00000BCB
+	"\v\xc6\v\xd7\x00\x00\v\xcc" + // 0x0BC60BD7: 0x00000BCC
+	"\fF\fV\x00\x00\fH" + // 0x0C460C56: 0x00000C48
+	"\f\xbf\f\xd5\x00\x00\f\xc0" + // 0x0CBF0CD5: 0x00000CC0
+	"\f\xc6\f\xd5\x00\x00\f\xc7" + // 0x0CC60CD5: 0x00000CC7
+	"\f\xc6\f\xd6\x00\x00\f\xc8" + // 0x0CC60CD6: 0x00000CC8
+	"\f\xc6\f\xc2\x00\x00\f\xca" + // 0x0CC60CC2: 0x00000CCA
+	"\f\xca\f\xd5\x00\x00\f\xcb" + // 0x0CCA0CD5: 0x00000CCB
+	"\rF\r>\x00\x00\rJ" + // 0x0D460D3E: 0x00000D4A
+	"\rG\r>\x00\x00\rK" + // 0x0D470D3E: 0x00000D4B
+	"\rF\rW\x00\x00\rL" + // 0x0D460D57: 0x00000D4C
+	"\r\xd9\r\xca\x00\x00\r\xda" + // 0x0DD90DCA: 0x00000DDA
+	"\r\xd9\r\xcf\x00\x00\r\xdc" + // 0x0DD90DCF: 0x00000DDC
+	"\r\xdc\r\xca\x00\x00\r\xdd" + // 0x0DDC0DCA: 0x00000DDD
+	"\r\xd9\r\xdf\x00\x00\r\xde" + // 0x0DD90DDF: 0x00000DDE
+	"\x10%\x10.\x00\x00\x10&" + // 0x1025102E: 0x00001026
+	"\x1b\x05\x1b5\x00\x00\x1b\x06" + // 0x1B051B35: 0x00001B06
+	"\x1b\a\x1b5\x00\x00\x1b\b" + // 0x1B071B35: 0x00001B08
+	"\x1b\t\x1b5\x00\x00\x1b\n" + // 0x1B091B35: 0x00001B0A
+	"\x1b\v\x1b5\x00\x00\x1b\f" + // 0x1B0B1B35: 0x00001B0C
+	"\x1b\r\x1b5\x00\x00\x1b\x0e" + // 0x1B0D1B35: 0x00001B0E
+	"\x1b\x11\x1b5\x00\x00\x1b\x12" + // 0x1B111B35: 0x00001B12
+	"\x1b:\x1b5\x00\x00\x1b;" + // 0x1B3A1B35: 0x00001B3B
+	"\x1b<\x1b5\x00\x00\x1b=" + // 0x1B3C1B35: 0x00001B3D
+	"\x1b>\x1b5\x00\x00\x1b@" + // 0x1B3E1B35: 0x00001B40
+	"\x1b?\x1b5\x00\x00\x1bA" + // 0x1B3F1B35: 0x00001B41
+	"\x1bB\x1b5\x00\x00\x1bC" + // 0x1B421B35: 0x00001B43
+	"\x00A\x03%\x00\x00\x1e\x00" + // 0x00410325: 0x00001E00
+	"\x00a\x03%\x00\x00\x1e\x01" + // 0x00610325: 0x00001E01
+	"\x00B\x03\a\x00\x00\x1e\x02" + // 0x00420307: 0x00001E02
+	"\x00b\x03\a\x00\x00\x1e\x03" + // 0x00620307: 0x00001E03
+	"\x00B\x03#\x00\x00\x1e\x04" + // 0x00420323: 0x00001E04
+	"\x00b\x03#\x00\x00\x1e\x05" + // 0x00620323: 0x00001E05
+	"\x00B\x031\x00\x00\x1e\x06" + // 0x00420331: 0x00001E06
+	"\x00b\x031\x00\x00\x1e\a" + // 0x00620331: 0x00001E07
+	"\x00\xc7\x03\x01\x00\x00\x1e\b" + // 0x00C70301: 0x00001E08
+	"\x00\xe7\x03\x01\x00\x00\x1e\t" + // 0x00E70301: 0x00001E09
+	"\x00D\x03\a\x00\x00\x1e\n" + // 0x00440307: 0x00001E0A
+	"\x00d\x03\a\x00\x00\x1e\v" + // 0x00640307: 0x00001E0B
+	"\x00D\x03#\x00\x00\x1e\f" + // 0x00440323: 0x00001E0C
+	"\x00d\x03#\x00\x00\x1e\r" + // 0x00640323: 0x00001E0D
+	"\x00D\x031\x00\x00\x1e\x0e" + // 0x00440331: 0x00001E0E
+	"\x00d\x031\x00\x00\x1e\x0f" + // 0x00640331: 0x00001E0F
+	"\x00D\x03'\x00\x00\x1e\x10" + // 0x00440327: 0x00001E10
+	"\x00d\x03'\x00\x00\x1e\x11" + // 0x00640327: 0x00001E11
+	"\x00D\x03-\x00\x00\x1e\x12" + // 0x0044032D: 0x00001E12
+	"\x00d\x03-\x00\x00\x1e\x13" + // 0x0064032D: 0x00001E13
+	"\x01\x12\x03\x00\x00\x00\x1e\x14" + // 0x01120300: 0x00001E14
+	"\x01\x13\x03\x00\x00\x00\x1e\x15" + // 0x01130300: 0x00001E15
+	"\x01\x12\x03\x01\x00\x00\x1e\x16" + // 0x01120301: 0x00001E16
+	"\x01\x13\x03\x01\x00\x00\x1e\x17" + // 0x01130301: 0x00001E17
+	"\x00E\x03-\x00\x00\x1e\x18" + // 0x0045032D: 0x00001E18
+	"\x00e\x03-\x00\x00\x1e\x19" + // 0x0065032D: 0x00001E19
+	"\x00E\x030\x00\x00\x1e\x1a" + // 0x00450330: 0x00001E1A
+	"\x00e\x030\x00\x00\x1e\x1b" + // 0x00650330: 0x00001E1B
+	"\x02(\x03\x06\x00\x00\x1e\x1c" + // 0x02280306: 0x00001E1C
+	"\x02)\x03\x06\x00\x00\x1e\x1d" + // 0x02290306: 0x00001E1D
+	"\x00F\x03\a\x00\x00\x1e\x1e" + // 0x00460307: 0x00001E1E
+	"\x00f\x03\a\x00\x00\x1e\x1f" + // 0x00660307: 0x00001E1F
+	"\x00G\x03\x04\x00\x00\x1e " + // 0x00470304: 0x00001E20
+	"\x00g\x03\x04\x00\x00\x1e!" + // 0x00670304: 0x00001E21
+	"\x00H\x03\a\x00\x00\x1e\"" + // 0x00480307: 0x00001E22
+	"\x00h\x03\a\x00\x00\x1e#" + // 0x00680307: 0x00001E23
+	"\x00H\x03#\x00\x00\x1e$" + // 0x00480323: 0x00001E24
+	"\x00h\x03#\x00\x00\x1e%" + // 0x00680323: 0x00001E25
+	"\x00H\x03\b\x00\x00\x1e&" + // 0x00480308: 0x00001E26
+	"\x00h\x03\b\x00\x00\x1e'" + // 0x00680308: 0x00001E27
+	"\x00H\x03'\x00\x00\x1e(" + // 0x00480327: 0x00001E28
+	"\x00h\x03'\x00\x00\x1e)" + // 0x00680327: 0x00001E29
+	"\x00H\x03.\x00\x00\x1e*" + // 0x0048032E: 0x00001E2A
+	"\x00h\x03.\x00\x00\x1e+" + // 0x0068032E: 0x00001E2B
+	"\x00I\x030\x00\x00\x1e," + // 0x00490330: 0x00001E2C
+	"\x00i\x030\x00\x00\x1e-" + // 0x00690330: 0x00001E2D
+	"\x00\xcf\x03\x01\x00\x00\x1e." + // 0x00CF0301: 0x00001E2E
+	"\x00\xef\x03\x01\x00\x00\x1e/" + // 0x00EF0301: 0x00001E2F
+	"\x00K\x03\x01\x00\x00\x1e0" + // 0x004B0301: 0x00001E30
+	"\x00k\x03\x01\x00\x00\x1e1" + // 0x006B0301: 0x00001E31
+	"\x00K\x03#\x00\x00\x1e2" + // 0x004B0323: 0x00001E32
+	"\x00k\x03#\x00\x00\x1e3" + // 0x006B0323: 0x00001E33
+	"\x00K\x031\x00\x00\x1e4" + // 0x004B0331: 0x00001E34
+	"\x00k\x031\x00\x00\x1e5" + // 0x006B0331: 0x00001E35
+	"\x00L\x03#\x00\x00\x1e6" + // 0x004C0323: 0x00001E36
+	"\x00l\x03#\x00\x00\x1e7" + // 0x006C0323: 0x00001E37
+	"\x1e6\x03\x04\x00\x00\x1e8" + // 0x1E360304: 0x00001E38
+	"\x1e7\x03\x04\x00\x00\x1e9" + // 0x1E370304: 0x00001E39
+	"\x00L\x031\x00\x00\x1e:" + // 0x004C0331: 0x00001E3A
+	"\x00l\x031\x00\x00\x1e;" + // 0x006C0331: 0x00001E3B
+	"\x00L\x03-\x00\x00\x1e<" + // 0x004C032D: 0x00001E3C
+	"\x00l\x03-\x00\x00\x1e=" + // 0x006C032D: 0x00001E3D
+	"\x00M\x03\x01\x00\x00\x1e>" + // 0x004D0301: 0x00001E3E
+	"\x00m\x03\x01\x00\x00\x1e?" + // 0x006D0301: 0x00001E3F
+	"\x00M\x03\a\x00\x00\x1e@" + // 0x004D0307: 0x00001E40
+	"\x00m\x03\a\x00\x00\x1eA" + // 0x006D0307: 0x00001E41
+	"\x00M\x03#\x00\x00\x1eB" + // 0x004D0323: 0x00001E42
+	"\x00m\x03#\x00\x00\x1eC" + // 0x006D0323: 0x00001E43
+	"\x00N\x03\a\x00\x00\x1eD" + // 0x004E0307: 0x00001E44
+	"\x00n\x03\a\x00\x00\x1eE" + // 0x006E0307: 0x00001E45
+	"\x00N\x03#\x00\x00\x1eF" + // 0x004E0323: 0x00001E46
+	"\x00n\x03#\x00\x00\x1eG" + // 0x006E0323: 0x00001E47
+	"\x00N\x031\x00\x00\x1eH" + // 0x004E0331: 0x00001E48
+	"\x00n\x031\x00\x00\x1eI" + // 0x006E0331: 0x00001E49
+	"\x00N\x03-\x00\x00\x1eJ" + // 0x004E032D: 0x00001E4A
+	"\x00n\x03-\x00\x00\x1eK" + // 0x006E032D: 0x00001E4B
+	"\x00\xd5\x03\x01\x00\x00\x1eL" + // 0x00D50301: 0x00001E4C
+	"\x00\xf5\x03\x01\x00\x00\x1eM" + // 0x00F50301: 0x00001E4D
+	"\x00\xd5\x03\b\x00\x00\x1eN" + // 0x00D50308: 0x00001E4E
+	"\x00\xf5\x03\b\x00\x00\x1eO" + // 0x00F50308: 0x00001E4F
+	"\x01L\x03\x00\x00\x00\x1eP" + // 0x014C0300: 0x00001E50
+	"\x01M\x03\x00\x00\x00\x1eQ" + // 0x014D0300: 0x00001E51
+	"\x01L\x03\x01\x00\x00\x1eR" + // 0x014C0301: 0x00001E52
+	"\x01M\x03\x01\x00\x00\x1eS" + // 0x014D0301: 0x00001E53
+	"\x00P\x03\x01\x00\x00\x1eT" + // 0x00500301: 0x00001E54
+	"\x00p\x03\x01\x00\x00\x1eU" + // 0x00700301: 0x00001E55
+	"\x00P\x03\a\x00\x00\x1eV" + // 0x00500307: 0x00001E56
+	"\x00p\x03\a\x00\x00\x1eW" + // 0x00700307: 0x00001E57
+	"\x00R\x03\a\x00\x00\x1eX" + // 0x00520307: 0x00001E58
+	"\x00r\x03\a\x00\x00\x1eY" + // 0x00720307: 0x00001E59
+	"\x00R\x03#\x00\x00\x1eZ" + // 0x00520323: 0x00001E5A
+	"\x00r\x03#\x00\x00\x1e[" + // 0x00720323: 0x00001E5B
+	"\x1eZ\x03\x04\x00\x00\x1e\\" + // 0x1E5A0304: 0x00001E5C
+	"\x1e[\x03\x04\x00\x00\x1e]" + // 0x1E5B0304: 0x00001E5D
+	"\x00R\x031\x00\x00\x1e^" + // 0x00520331: 0x00001E5E
+	"\x00r\x031\x00\x00\x1e_" + // 0x00720331: 0x00001E5F
+	"\x00S\x03\a\x00\x00\x1e`" + // 0x00530307: 0x00001E60
+	"\x00s\x03\a\x00\x00\x1ea" + // 0x00730307: 0x00001E61
+	"\x00S\x03#\x00\x00\x1eb" + // 0x00530323: 0x00001E62
+	"\x00s\x03#\x00\x00\x1ec" + // 0x00730323: 0x00001E63
+	"\x01Z\x03\a\x00\x00\x1ed" + // 0x015A0307: 0x00001E64
+	"\x01[\x03\a\x00\x00\x1ee" + // 0x015B0307: 0x00001E65
+	"\x01`\x03\a\x00\x00\x1ef" + // 0x01600307: 0x00001E66
+	"\x01a\x03\a\x00\x00\x1eg" + // 0x01610307: 0x00001E67
+	"\x1eb\x03\a\x00\x00\x1eh" + // 0x1E620307: 0x00001E68
+	"\x1ec\x03\a\x00\x00\x1ei" + // 0x1E630307: 0x00001E69
+	"\x00T\x03\a\x00\x00\x1ej" + // 0x00540307: 0x00001E6A
+	"\x00t\x03\a\x00\x00\x1ek" + // 0x00740307: 0x00001E6B
+	"\x00T\x03#\x00\x00\x1el" + // 0x00540323: 0x00001E6C
+	"\x00t\x03#\x00\x00\x1em" + // 0x00740323: 0x00001E6D
+	"\x00T\x031\x00\x00\x1en" + // 0x00540331: 0x00001E6E
+	"\x00t\x031\x00\x00\x1eo" + // 0x00740331: 0x00001E6F
+	"\x00T\x03-\x00\x00\x1ep" + // 0x0054032D: 0x00001E70
+	"\x00t\x03-\x00\x00\x1eq" + // 0x0074032D: 0x00001E71
+	"\x00U\x03$\x00\x00\x1er" + // 0x00550324: 0x00001E72
+	"\x00u\x03$\x00\x00\x1es" + // 0x00750324: 0x00001E73
+	"\x00U\x030\x00\x00\x1et" + // 0x00550330: 0x00001E74
+	"\x00u\x030\x00\x00\x1eu" + // 0x00750330: 0x00001E75
+	"\x00U\x03-\x00\x00\x1ev" + // 0x0055032D: 0x00001E76
+	"\x00u\x03-\x00\x00\x1ew" + // 0x0075032D: 0x00001E77
+	"\x01h\x03\x01\x00\x00\x1ex" + // 0x01680301: 0x00001E78
+	"\x01i\x03\x01\x00\x00\x1ey" + // 0x01690301: 0x00001E79
+	"\x01j\x03\b\x00\x00\x1ez" + // 0x016A0308: 0x00001E7A
+	"\x01k\x03\b\x00\x00\x1e{" + // 0x016B0308: 0x00001E7B
+	"\x00V\x03\x03\x00\x00\x1e|" + // 0x00560303: 0x00001E7C
+	"\x00v\x03\x03\x00\x00\x1e}" + // 0x00760303: 0x00001E7D
+	"\x00V\x03#\x00\x00\x1e~" + // 0x00560323: 0x00001E7E
+	"\x00v\x03#\x00\x00\x1e\x7f" + // 0x00760323: 0x00001E7F
+	"\x00W\x03\x00\x00\x00\x1e\x80" + // 0x00570300: 0x00001E80
+	"\x00w\x03\x00\x00\x00\x1e\x81" + // 0x00770300: 0x00001E81
+	"\x00W\x03\x01\x00\x00\x1e\x82" + // 0x00570301: 0x00001E82
+	"\x00w\x03\x01\x00\x00\x1e\x83" + // 0x00770301: 0x00001E83
+	"\x00W\x03\b\x00\x00\x1e\x84" + // 0x00570308: 0x00001E84
+	"\x00w\x03\b\x00\x00\x1e\x85" + // 0x00770308: 0x00001E85
+	"\x00W\x03\a\x00\x00\x1e\x86" + // 0x00570307: 0x00001E86
+	"\x00w\x03\a\x00\x00\x1e\x87" + // 0x00770307: 0x00001E87
+	"\x00W\x03#\x00\x00\x1e\x88" + // 0x00570323: 0x00001E88
+	"\x00w\x03#\x00\x00\x1e\x89" + // 0x00770323: 0x00001E89
+	"\x00X\x03\a\x00\x00\x1e\x8a" + // 0x00580307: 0x00001E8A
+	"\x00x\x03\a\x00\x00\x1e\x8b" + // 0x00780307: 0x00001E8B
+	"\x00X\x03\b\x00\x00\x1e\x8c" + // 0x00580308: 0x00001E8C
+	"\x00x\x03\b\x00\x00\x1e\x8d" + // 0x00780308: 0x00001E8D
+	"\x00Y\x03\a\x00\x00\x1e\x8e" + // 0x00590307: 0x00001E8E
+	"\x00y\x03\a\x00\x00\x1e\x8f" + // 0x00790307: 0x00001E8F
+	"\x00Z\x03\x02\x00\x00\x1e\x90" + // 0x005A0302: 0x00001E90
+	"\x00z\x03\x02\x00\x00\x1e\x91" + // 0x007A0302: 0x00001E91
+	"\x00Z\x03#\x00\x00\x1e\x92" + // 0x005A0323: 0x00001E92
+	"\x00z\x03#\x00\x00\x1e\x93" + // 0x007A0323: 0x00001E93
+	"\x00Z\x031\x00\x00\x1e\x94" + // 0x005A0331: 0x00001E94
+	"\x00z\x031\x00\x00\x1e\x95" + // 0x007A0331: 0x00001E95
+	"\x00h\x031\x00\x00\x1e\x96" + // 0x00680331: 0x00001E96
+	"\x00t\x03\b\x00\x00\x1e\x97" + // 0x00740308: 0x00001E97
+	"\x00w\x03\n\x00\x00\x1e\x98" + // 0x0077030A: 0x00001E98
+	"\x00y\x03\n\x00\x00\x1e\x99" + // 0x0079030A: 0x00001E99
+	"\x01\x7f\x03\a\x00\x00\x1e\x9b" + // 0x017F0307: 0x00001E9B
+	"\x00A\x03#\x00\x00\x1e\xa0" + // 0x00410323: 0x00001EA0
+	"\x00a\x03#\x00\x00\x1e\xa1" + // 0x00610323: 0x00001EA1
+	"\x00A\x03\t\x00\x00\x1e\xa2" + // 0x00410309: 0x00001EA2
+	"\x00a\x03\t\x00\x00\x1e\xa3" + // 0x00610309: 0x00001EA3
+	"\x00\xc2\x03\x01\x00\x00\x1e\xa4" + // 0x00C20301: 0x00001EA4
+	"\x00\xe2\x03\x01\x00\x00\x1e\xa5" + // 0x00E20301: 0x00001EA5
+	"\x00\xc2\x03\x00\x00\x00\x1e\xa6" + // 0x00C20300: 0x00001EA6
+	"\x00\xe2\x03\x00\x00\x00\x1e\xa7" + // 0x00E20300: 0x00001EA7
+	"\x00\xc2\x03\t\x00\x00\x1e\xa8" + // 0x00C20309: 0x00001EA8
+	"\x00\xe2\x03\t\x00\x00\x1e\xa9" + // 0x00E20309: 0x00001EA9
+	"\x00\xc2\x03\x03\x00\x00\x1e\xaa" + // 0x00C20303: 0x00001EAA
+	"\x00\xe2\x03\x03\x00\x00\x1e\xab" + // 0x00E20303: 0x00001EAB
+	"\x1e\xa0\x03\x02\x00\x00\x1e\xac" + // 0x1EA00302: 0x00001EAC
+	"\x1e\xa1\x03\x02\x00\x00\x1e\xad" + // 0x1EA10302: 0x00001EAD
+	"\x01\x02\x03\x01\x00\x00\x1e\xae" + // 0x01020301: 0x00001EAE
+	"\x01\x03\x03\x01\x00\x00\x1e\xaf" + // 0x01030301: 0x00001EAF
+	"\x01\x02\x03\x00\x00\x00\x1e\xb0" + // 0x01020300: 0x00001EB0
+	"\x01\x03\x03\x00\x00\x00\x1e\xb1" + // 0x01030300: 0x00001EB1
+	"\x01\x02\x03\t\x00\x00\x1e\xb2" + // 0x01020309: 0x00001EB2
+	"\x01\x03\x03\t\x00\x00\x1e\xb3" + // 0x01030309: 0x00001EB3
+	"\x01\x02\x03\x03\x00\x00\x1e\xb4" + // 0x01020303: 0x00001EB4
+	"\x01\x03\x03\x03\x00\x00\x1e\xb5" + // 0x01030303: 0x00001EB5
+	"\x1e\xa0\x03\x06\x00\x00\x1e\xb6" + // 0x1EA00306: 0x00001EB6
+	"\x1e\xa1\x03\x06\x00\x00\x1e\xb7" + // 0x1EA10306: 0x00001EB7
+	"\x00E\x03#\x00\x00\x1e\xb8" + // 0x00450323: 0x00001EB8
+	"\x00e\x03#\x00\x00\x1e\xb9" + // 0x00650323: 0x00001EB9
+	"\x00E\x03\t\x00\x00\x1e\xba" + // 0x00450309: 0x00001EBA
+	"\x00e\x03\t\x00\x00\x1e\xbb" + // 0x00650309: 0x00001EBB
+	"\x00E\x03\x03\x00\x00\x1e\xbc" + // 0x00450303: 0x00001EBC
+	"\x00e\x03\x03\x00\x00\x1e\xbd" + // 0x00650303: 0x00001EBD
+	"\x00\xca\x03\x01\x00\x00\x1e\xbe" + // 0x00CA0301: 0x00001EBE
+	"\x00\xea\x03\x01\x00\x00\x1e\xbf" + // 0x00EA0301: 0x00001EBF
+	"\x00\xca\x03\x00\x00\x00\x1e\xc0" + // 0x00CA0300: 0x00001EC0
+	"\x00\xea\x03\x00\x00\x00\x1e\xc1" + // 0x00EA0300: 0x00001EC1
+	"\x00\xca\x03\t\x00\x00\x1e\xc2" + // 0x00CA0309: 0x00001EC2
+	"\x00\xea\x03\t\x00\x00\x1e\xc3" + // 0x00EA0309: 0x00001EC3
+	"\x00\xca\x03\x03\x00\x00\x1e\xc4" + // 0x00CA0303: 0x00001EC4
+	"\x00\xea\x03\x03\x00\x00\x1e\xc5" + // 0x00EA0303: 0x00001EC5
+	"\x1e\xb8\x03\x02\x00\x00\x1e\xc6" + // 0x1EB80302: 0x00001EC6
+	"\x1e\xb9\x03\x02\x00\x00\x1e\xc7" + // 0x1EB90302: 0x00001EC7
+	"\x00I\x03\t\x00\x00\x1e\xc8" + // 0x00490309: 0x00001EC8
+	"\x00i\x03\t\x00\x00\x1e\xc9" + // 0x00690309: 0x00001EC9
+	"\x00I\x03#\x00\x00\x1e\xca" + // 0x00490323: 0x00001ECA
+	"\x00i\x03#\x00\x00\x1e\xcb" + // 0x00690323: 0x00001ECB
+	"\x00O\x03#\x00\x00\x1e\xcc" + // 0x004F0323: 0x00001ECC
+	"\x00o\x03#\x00\x00\x1e\xcd" + // 0x006F0323: 0x00001ECD
+	"\x00O\x03\t\x00\x00\x1e\xce" + // 0x004F0309: 0x00001ECE
+	"\x00o\x03\t\x00\x00\x1e\xcf" + // 0x006F0309: 0x00001ECF
+	"\x00\xd4\x03\x01\x00\x00\x1e\xd0" + // 0x00D40301: 0x00001ED0
+	"\x00\xf4\x03\x01\x00\x00\x1e\xd1" + // 0x00F40301: 0x00001ED1
+	"\x00\xd4\x03\x00\x00\x00\x1e\xd2" + // 0x00D40300: 0x00001ED2
+	"\x00\xf4\x03\x00\x00\x00\x1e\xd3" + // 0x00F40300: 0x00001ED3
+	"\x00\xd4\x03\t\x00\x00\x1e\xd4" + // 0x00D40309: 0x00001ED4
+	"\x00\xf4\x03\t\x00\x00\x1e\xd5" + // 0x00F40309: 0x00001ED5
+	"\x00\xd4\x03\x03\x00\x00\x1e\xd6" + // 0x00D40303: 0x00001ED6
+	"\x00\xf4\x03\x03\x00\x00\x1e\xd7" + // 0x00F40303: 0x00001ED7
+	"\x1e\xcc\x03\x02\x00\x00\x1e\xd8" + // 0x1ECC0302: 0x00001ED8
+	"\x1e\xcd\x03\x02\x00\x00\x1e\xd9" + // 0x1ECD0302: 0x00001ED9
+	"\x01\xa0\x03\x01\x00\x00\x1e\xda" + // 0x01A00301: 0x00001EDA
+	"\x01\xa1\x03\x01\x00\x00\x1e\xdb" + // 0x01A10301: 0x00001EDB
+	"\x01\xa0\x03\x00\x00\x00\x1e\xdc" + // 0x01A00300: 0x00001EDC
+	"\x01\xa1\x03\x00\x00\x00\x1e\xdd" + // 0x01A10300: 0x00001EDD
+	"\x01\xa0\x03\t\x00\x00\x1e\xde" + // 0x01A00309: 0x00001EDE
+	"\x01\xa1\x03\t\x00\x00\x1e\xdf" + // 0x01A10309: 0x00001EDF
+	"\x01\xa0\x03\x03\x00\x00\x1e\xe0" + // 0x01A00303: 0x00001EE0
+	"\x01\xa1\x03\x03\x00\x00\x1e\xe1" + // 0x01A10303: 0x00001EE1
+	"\x01\xa0\x03#\x00\x00\x1e\xe2" + // 0x01A00323: 0x00001EE2
+	"\x01\xa1\x03#\x00\x00\x1e\xe3" + // 0x01A10323: 0x00001EE3
+	"\x00U\x03#\x00\x00\x1e\xe4" + // 0x00550323: 0x00001EE4
+	"\x00u\x03#\x00\x00\x1e\xe5" + // 0x00750323: 0x00001EE5
+	"\x00U\x03\t\x00\x00\x1e\xe6" + // 0x00550309: 0x00001EE6
+	"\x00u\x03\t\x00\x00\x1e\xe7" + // 0x00750309: 0x00001EE7
+	"\x01\xaf\x03\x01\x00\x00\x1e\xe8" + // 0x01AF0301: 0x00001EE8
+	"\x01\xb0\x03\x01\x00\x00\x1e\xe9" + // 0x01B00301: 0x00001EE9
+	"\x01\xaf\x03\x00\x00\x00\x1e\xea" + // 0x01AF0300: 0x00001EEA
+	"\x01\xb0\x03\x00\x00\x00\x1e\xeb" + // 0x01B00300: 0x00001EEB
+	"\x01\xaf\x03\t\x00\x00\x1e\xec" + // 0x01AF0309: 0x00001EEC
+	"\x01\xb0\x03\t\x00\x00\x1e\xed" + // 0x01B00309: 0x00001EED
+	"\x01\xaf\x03\x03\x00\x00\x1e\xee" + // 0x01AF0303: 0x00001EEE
+	"\x01\xb0\x03\x03\x00\x00\x1e\xef" + // 0x01B00303: 0x00001EEF
+	"\x01\xaf\x03#\x00\x00\x1e\xf0" + // 0x01AF0323: 0x00001EF0
+	"\x01\xb0\x03#\x00\x00\x1e\xf1" + // 0x01B00323: 0x00001EF1
+	"\x00Y\x03\x00\x00\x00\x1e\xf2" + // 0x00590300: 0x00001EF2
+	"\x00y\x03\x00\x00\x00\x1e\xf3" + // 0x00790300: 0x00001EF3
+	"\x00Y\x03#\x00\x00\x1e\xf4" + // 0x00590323: 0x00001EF4
+	"\x00y\x03#\x00\x00\x1e\xf5" + // 0x00790323: 0x00001EF5
+	"\x00Y\x03\t\x00\x00\x1e\xf6" + // 0x00590309: 0x00001EF6
+	"\x00y\x03\t\x00\x00\x1e\xf7" + // 0x00790309: 0x00001EF7
+	"\x00Y\x03\x03\x00\x00\x1e\xf8" + // 0x00590303: 0x00001EF8
+	"\x00y\x03\x03\x00\x00\x1e\xf9" + // 0x00790303: 0x00001EF9
+	"\x03\xb1\x03\x13\x00\x00\x1f\x00" + // 0x03B10313: 0x00001F00
+	"\x03\xb1\x03\x14\x00\x00\x1f\x01" + // 0x03B10314: 0x00001F01
+	"\x1f\x00\x03\x00\x00\x00\x1f\x02" + // 0x1F000300: 0x00001F02
+	"\x1f\x01\x03\x00\x00\x00\x1f\x03" + // 0x1F010300: 0x00001F03
+	"\x1f\x00\x03\x01\x00\x00\x1f\x04" + // 0x1F000301: 0x00001F04
+	"\x1f\x01\x03\x01\x00\x00\x1f\x05" + // 0x1F010301: 0x00001F05
+	"\x1f\x00\x03B\x00\x00\x1f\x06" + // 0x1F000342: 0x00001F06
+	"\x1f\x01\x03B\x00\x00\x1f\a" + // 0x1F010342: 0x00001F07
+	"\x03\x91\x03\x13\x00\x00\x1f\b" + // 0x03910313: 0x00001F08
+	"\x03\x91\x03\x14\x00\x00\x1f\t" + // 0x03910314: 0x00001F09
+	"\x1f\b\x03\x00\x00\x00\x1f\n" + // 0x1F080300: 0x00001F0A
+	"\x1f\t\x03\x00\x00\x00\x1f\v" + // 0x1F090300: 0x00001F0B
+	"\x1f\b\x03\x01\x00\x00\x1f\f" + // 0x1F080301: 0x00001F0C
+	"\x1f\t\x03\x01\x00\x00\x1f\r" + // 0x1F090301: 0x00001F0D
+	"\x1f\b\x03B\x00\x00\x1f\x0e" + // 0x1F080342: 0x00001F0E
+	"\x1f\t\x03B\x00\x00\x1f\x0f" + // 0x1F090342: 0x00001F0F
+	"\x03\xb5\x03\x13\x00\x00\x1f\x10" + // 0x03B50313: 0x00001F10
+	"\x03\xb5\x03\x14\x00\x00\x1f\x11" + // 0x03B50314: 0x00001F11
+	"\x1f\x10\x03\x00\x00\x00\x1f\x12" + // 0x1F100300: 0x00001F12
+	"\x1f\x11\x03\x00\x00\x00\x1f\x13" + // 0x1F110300: 0x00001F13
+	"\x1f\x10\x03\x01\x00\x00\x1f\x14" + // 0x1F100301: 0x00001F14
+	"\x1f\x11\x03\x01\x00\x00\x1f\x15" + // 0x1F110301: 0x00001F15
+	"\x03\x95\x03\x13\x00\x00\x1f\x18" + // 0x03950313: 0x00001F18
+	"\x03\x95\x03\x14\x00\x00\x1f\x19" + // 0x03950314: 0x00001F19
+	"\x1f\x18\x03\x00\x00\x00\x1f\x1a" + // 0x1F180300: 0x00001F1A
+	"\x1f\x19\x03\x00\x00\x00\x1f\x1b" + // 0x1F190300: 0x00001F1B
+	"\x1f\x18\x03\x01\x00\x00\x1f\x1c" + // 0x1F180301: 0x00001F1C
+	"\x1f\x19\x03\x01\x00\x00\x1f\x1d" + // 0x1F190301: 0x00001F1D
+	"\x03\xb7\x03\x13\x00\x00\x1f " + // 0x03B70313: 0x00001F20
+	"\x03\xb7\x03\x14\x00\x00\x1f!" + // 0x03B70314: 0x00001F21
+	"\x1f \x03\x00\x00\x00\x1f\"" + // 0x1F200300: 0x00001F22
+	"\x1f!\x03\x00\x00\x00\x1f#" + // 0x1F210300: 0x00001F23
+	"\x1f \x03\x01\x00\x00\x1f$" + // 0x1F200301: 0x00001F24
+	"\x1f!\x03\x01\x00\x00\x1f%" + // 0x1F210301: 0x00001F25
+	"\x1f \x03B\x00\x00\x1f&" + // 0x1F200342: 0x00001F26
+	"\x1f!\x03B\x00\x00\x1f'" + // 0x1F210342: 0x00001F27
+	"\x03\x97\x03\x13\x00\x00\x1f(" + // 0x03970313: 0x00001F28
+	"\x03\x97\x03\x14\x00\x00\x1f)" + // 0x03970314: 0x00001F29
+	"\x1f(\x03\x00\x00\x00\x1f*" + // 0x1F280300: 0x00001F2A
+	"\x1f)\x03\x00\x00\x00\x1f+" + // 0x1F290300: 0x00001F2B
+	"\x1f(\x03\x01\x00\x00\x1f," + // 0x1F280301: 0x00001F2C
+	"\x1f)\x03\x01\x00\x00\x1f-" + // 0x1F290301: 0x00001F2D
+	"\x1f(\x03B\x00\x00\x1f." + // 0x1F280342: 0x00001F2E
+	"\x1f)\x03B\x00\x00\x1f/" + // 0x1F290342: 0x00001F2F
+	"\x03\xb9\x03\x13\x00\x00\x1f0" + // 0x03B90313: 0x00001F30
+	"\x03\xb9\x03\x14\x00\x00\x1f1" + // 0x03B90314: 0x00001F31
+	"\x1f0\x03\x00\x00\x00\x1f2" + // 0x1F300300: 0x00001F32
+	"\x1f1\x03\x00\x00\x00\x1f3" + // 0x1F310300: 0x00001F33
+	"\x1f0\x03\x01\x00\x00\x1f4" + // 0x1F300301: 0x00001F34
+	"\x1f1\x03\x01\x00\x00\x1f5" + // 0x1F310301: 0x00001F35
+	"\x1f0\x03B\x00\x00\x1f6" + // 0x1F300342: 0x00001F36
+	"\x1f1\x03B\x00\x00\x1f7" + // 0x1F310342: 0x00001F37
+	"\x03\x99\x03\x13\x00\x00\x1f8" + // 0x03990313: 0x00001F38
+	"\x03\x99\x03\x14\x00\x00\x1f9" + // 0x03990314: 0x00001F39
+	"\x1f8\x03\x00\x00\x00\x1f:" + // 0x1F380300: 0x00001F3A
+	"\x1f9\x03\x00\x00\x00\x1f;" + // 0x1F390300: 0x00001F3B
+	"\x1f8\x03\x01\x00\x00\x1f<" + // 0x1F380301: 0x00001F3C
+	"\x1f9\x03\x01\x00\x00\x1f=" + // 0x1F390301: 0x00001F3D
+	"\x1f8\x03B\x00\x00\x1f>" + // 0x1F380342: 0x00001F3E
+	"\x1f9\x03B\x00\x00\x1f?" + // 0x1F390342: 0x00001F3F
+	"\x03\xbf\x03\x13\x00\x00\x1f@" + // 0x03BF0313: 0x00001F40
+	"\x03\xbf\x03\x14\x00\x00\x1fA" + // 0x03BF0314: 0x00001F41
+	"\x1f@\x03\x00\x00\x00\x1fB" + // 0x1F400300: 0x00001F42
+	"\x1fA\x03\x00\x00\x00\x1fC" + // 0x1F410300: 0x00001F43
+	"\x1f@\x03\x01\x00\x00\x1fD" + // 0x1F400301: 0x00001F44
+	"\x1fA\x03\x01\x00\x00\x1fE" + // 0x1F410301: 0x00001F45
+	"\x03\x9f\x03\x13\x00\x00\x1fH" + // 0x039F0313: 0x00001F48
+	"\x03\x9f\x03\x14\x00\x00\x1fI" + // 0x039F0314: 0x00001F49
+	"\x1fH\x03\x00\x00\x00\x1fJ" + // 0x1F480300: 0x00001F4A
+	"\x1fI\x03\x00\x00\x00\x1fK" + // 0x1F490300: 0x00001F4B
+	"\x1fH\x03\x01\x00\x00\x1fL" + // 0x1F480301: 0x00001F4C
+	"\x1fI\x03\x01\x00\x00\x1fM" + // 0x1F490301: 0x00001F4D
+	"\x03\xc5\x03\x13\x00\x00\x1fP" + // 0x03C50313: 0x00001F50
+	"\x03\xc5\x03\x14\x00\x00\x1fQ" + // 0x03C50314: 0x00001F51
+	"\x1fP\x03\x00\x00\x00\x1fR" + // 0x1F500300: 0x00001F52
+	"\x1fQ\x03\x00\x00\x00\x1fS" + // 0x1F510300: 0x00001F53
+	"\x1fP\x03\x01\x00\x00\x1fT" + // 0x1F500301: 0x00001F54
+	"\x1fQ\x03\x01\x00\x00\x1fU" + // 0x1F510301: 0x00001F55
+	"\x1fP\x03B\x00\x00\x1fV" + // 0x1F500342: 0x00001F56
+	"\x1fQ\x03B\x00\x00\x1fW" + // 0x1F510342: 0x00001F57
+	"\x03\xa5\x03\x14\x00\x00\x1fY" + // 0x03A50314: 0x00001F59
+	"\x1fY\x03\x00\x00\x00\x1f[" + // 0x1F590300: 0x00001F5B
+	"\x1fY\x03\x01\x00\x00\x1f]" + // 0x1F590301: 0x00001F5D
+	"\x1fY\x03B\x00\x00\x1f_" + // 0x1F590342: 0x00001F5F
+	"\x03\xc9\x03\x13\x00\x00\x1f`" + // 0x03C90313: 0x00001F60
+	"\x03\xc9\x03\x14\x00\x00\x1fa" + // 0x03C90314: 0x00001F61
+	"\x1f`\x03\x00\x00\x00\x1fb" + // 0x1F600300: 0x00001F62
+	"\x1fa\x03\x00\x00\x00\x1fc" + // 0x1F610300: 0x00001F63
+	"\x1f`\x03\x01\x00\x00\x1fd" + // 0x1F600301: 0x00001F64
+	"\x1fa\x03\x01\x00\x00\x1fe" + // 0x1F610301: 0x00001F65
+	"\x1f`\x03B\x00\x00\x1ff" + // 0x1F600342: 0x00001F66
+	"\x1fa\x03B\x00\x00\x1fg" + // 0x1F610342: 0x00001F67
+	"\x03\xa9\x03\x13\x00\x00\x1fh" + // 0x03A90313: 0x00001F68
+	"\x03\xa9\x03\x14\x00\x00\x1fi" + // 0x03A90314: 0x00001F69
+	"\x1fh\x03\x00\x00\x00\x1fj" + // 0x1F680300: 0x00001F6A
+	"\x1fi\x03\x00\x00\x00\x1fk" + // 0x1F690300: 0x00001F6B
+	"\x1fh\x03\x01\x00\x00\x1fl" + // 0x1F680301: 0x00001F6C
+	"\x1fi\x03\x01\x00\x00\x1fm" + // 0x1F690301: 0x00001F6D
+	"\x1fh\x03B\x00\x00\x1fn" + // 0x1F680342: 0x00001F6E
+	"\x1fi\x03B\x00\x00\x1fo" + // 0x1F690342: 0x00001F6F
+	"\x03\xb1\x03\x00\x00\x00\x1fp" + // 0x03B10300: 0x00001F70
+	"\x03\xb5\x03\x00\x00\x00\x1fr" + // 0x03B50300: 0x00001F72
+	"\x03\xb7\x03\x00\x00\x00\x1ft" + // 0x03B70300: 0x00001F74
+	"\x03\xb9\x03\x00\x00\x00\x1fv" + // 0x03B90300: 0x00001F76
+	"\x03\xbf\x03\x00\x00\x00\x1fx" + // 0x03BF0300: 0x00001F78
+	"\x03\xc5\x03\x00\x00\x00\x1fz" + // 0x03C50300: 0x00001F7A
+	"\x03\xc9\x03\x00\x00\x00\x1f|" + // 0x03C90300: 0x00001F7C
+	"\x1f\x00\x03E\x00\x00\x1f\x80" + // 0x1F000345: 0x00001F80
+	"\x1f\x01\x03E\x00\x00\x1f\x81" + // 0x1F010345: 0x00001F81
+	"\x1f\x02\x03E\x00\x00\x1f\x82" + // 0x1F020345: 0x00001F82
+	"\x1f\x03\x03E\x00\x00\x1f\x83" + // 0x1F030345: 0x00001F83
+	"\x1f\x04\x03E\x00\x00\x1f\x84" + // 0x1F040345: 0x00001F84
+	"\x1f\x05\x03E\x00\x00\x1f\x85" + // 0x1F050345: 0x00001F85
+	"\x1f\x06\x03E\x00\x00\x1f\x86" + // 0x1F060345: 0x00001F86
+	"\x1f\a\x03E\x00\x00\x1f\x87" + // 0x1F070345: 0x00001F87
+	"\x1f\b\x03E\x00\x00\x1f\x88" + // 0x1F080345: 0x00001F88
+	"\x1f\t\x03E\x00\x00\x1f\x89" + // 0x1F090345: 0x00001F89
+	"\x1f\n\x03E\x00\x00\x1f\x8a" + // 0x1F0A0345: 0x00001F8A
+	"\x1f\v\x03E\x00\x00\x1f\x8b" + // 0x1F0B0345: 0x00001F8B
+	"\x1f\f\x03E\x00\x00\x1f\x8c" + // 0x1F0C0345: 0x00001F8C
+	"\x1f\r\x03E\x00\x00\x1f\x8d" + // 0x1F0D0345: 0x00001F8D
+	"\x1f\x0e\x03E\x00\x00\x1f\x8e" + // 0x1F0E0345: 0x00001F8E
+	"\x1f\x0f\x03E\x00\x00\x1f\x8f" + // 0x1F0F0345: 0x00001F8F
+	"\x1f \x03E\x00\x00\x1f\x90" + // 0x1F200345: 0x00001F90
+	"\x1f!\x03E\x00\x00\x1f\x91" + // 0x1F210345: 0x00001F91
+	"\x1f\"\x03E\x00\x00\x1f\x92" + // 0x1F220345: 0x00001F92
+	"\x1f#\x03E\x00\x00\x1f\x93" + // 0x1F230345: 0x00001F93
+	"\x1f$\x03E\x00\x00\x1f\x94" + // 0x1F240345: 0x00001F94
+	"\x1f%\x03E\x00\x00\x1f\x95" + // 0x1F250345: 0x00001F95
+	"\x1f&\x03E\x00\x00\x1f\x96" + // 0x1F260345: 0x00001F96
+	"\x1f'\x03E\x00\x00\x1f\x97" + // 0x1F270345: 0x00001F97
+	"\x1f(\x03E\x00\x00\x1f\x98" + // 0x1F280345: 0x00001F98
+	"\x1f)\x03E\x00\x00\x1f\x99" + // 0x1F290345: 0x00001F99
+	"\x1f*\x03E\x00\x00\x1f\x9a" + // 0x1F2A0345: 0x00001F9A
+	"\x1f+\x03E\x00\x00\x1f\x9b" + // 0x1F2B0345: 0x00001F9B
+	"\x1f,\x03E\x00\x00\x1f\x9c" + // 0x1F2C0345: 0x00001F9C
+	"\x1f-\x03E\x00\x00\x1f\x9d" + // 0x1F2D0345: 0x00001F9D
+	"\x1f.\x03E\x00\x00\x1f\x9e" + // 0x1F2E0345: 0x00001F9E
+	"\x1f/\x03E\x00\x00\x1f\x9f" + // 0x1F2F0345: 0x00001F9F
+	"\x1f`\x03E\x00\x00\x1f\xa0" + // 0x1F600345: 0x00001FA0
+	"\x1fa\x03E\x00\x00\x1f\xa1" + // 0x1F610345: 0x00001FA1
+	"\x1fb\x03E\x00\x00\x1f\xa2" + // 0x1F620345: 0x00001FA2
+	"\x1fc\x03E\x00\x00\x1f\xa3" + // 0x1F630345: 0x00001FA3
+	"\x1fd\x03E\x00\x00\x1f\xa4" + // 0x1F640345: 0x00001FA4
+	"\x1fe\x03E\x00\x00\x1f\xa5" + // 0x1F650345: 0x00001FA5
+	"\x1ff\x03E\x00\x00\x1f\xa6" + // 0x1F660345: 0x00001FA6
+	"\x1fg\x03E\x00\x00\x1f\xa7" + // 0x1F670345: 0x00001FA7
+	"\x1fh\x03E\x00\x00\x1f\xa8" + // 0x1F680345: 0x00001FA8
+	"\x1fi\x03E\x00\x00\x1f\xa9" + // 0x1F690345: 0x00001FA9
+	"\x1fj\x03E\x00\x00\x1f\xaa" + // 0x1F6A0345: 0x00001FAA
+	"\x1fk\x03E\x00\x00\x1f\xab" + // 0x1F6B0345: 0x00001FAB
+	"\x1fl\x03E\x00\x00\x1f\xac" + // 0x1F6C0345: 0x00001FAC
+	"\x1fm\x03E\x00\x00\x1f\xad" + // 0x1F6D0345: 0x00001FAD
+	"\x1fn\x03E\x00\x00\x1f\xae" + // 0x1F6E0345: 0x00001FAE
+	"\x1fo\x03E\x00\x00\x1f\xaf" + // 0x1F6F0345: 0x00001FAF
+	"\x03\xb1\x03\x06\x00\x00\x1f\xb0" + // 0x03B10306: 0x00001FB0
+	"\x03\xb1\x03\x04\x00\x00\x1f\xb1" + // 0x03B10304: 0x00001FB1
+	"\x1fp\x03E\x00\x00\x1f\xb2" + // 0x1F700345: 0x00001FB2
+	"\x03\xb1\x03E\x00\x00\x1f\xb3" + // 0x03B10345: 0x00001FB3
+	"\x03\xac\x03E\x00\x00\x1f\xb4" + // 0x03AC0345: 0x00001FB4
+	"\x03\xb1\x03B\x00\x00\x1f\xb6" + // 0x03B10342: 0x00001FB6
+	"\x1f\xb6\x03E\x00\x00\x1f\xb7" + // 0x1FB60345: 0x00001FB7
+	"\x03\x91\x03\x06\x00\x00\x1f\xb8" + // 0x03910306: 0x00001FB8
+	"\x03\x91\x03\x04\x00\x00\x1f\xb9" + // 0x03910304: 0x00001FB9
+	"\x03\x91\x03\x00\x00\x00\x1f\xba" + // 0x03910300: 0x00001FBA
+	"\x03\x91\x03E\x00\x00\x1f\xbc" + // 0x03910345: 0x00001FBC
+	"\x00\xa8\x03B\x00\x00\x1f\xc1" + // 0x00A80342: 0x00001FC1
+	"\x1ft\x03E\x00\x00\x1f\xc2" + // 0x1F740345: 0x00001FC2
+	"\x03\xb7\x03E\x00\x00\x1f\xc3" + // 0x03B70345: 0x00001FC3
+	"\x03\xae\x03E\x00\x00\x1f\xc4" + // 0x03AE0345: 0x00001FC4
+	"\x03\xb7\x03B\x00\x00\x1f\xc6" + // 0x03B70342: 0x00001FC6
+	"\x1f\xc6\x03E\x00\x00\x1f\xc7" + // 0x1FC60345: 0x00001FC7
+	"\x03\x95\x03\x00\x00\x00\x1f\xc8" + // 0x03950300: 0x00001FC8
+	"\x03\x97\x03\x00\x00\x00\x1f\xca" + // 0x03970300: 0x00001FCA
+	"\x03\x97\x03E\x00\x00\x1f\xcc" + // 0x03970345: 0x00001FCC
+	"\x1f\xbf\x03\x00\x00\x00\x1f\xcd" + // 0x1FBF0300: 0x00001FCD
+	"\x1f\xbf\x03\x01\x00\x00\x1f\xce" + // 0x1FBF0301: 0x00001FCE
+	"\x1f\xbf\x03B\x00\x00\x1f\xcf" + // 0x1FBF0342: 0x00001FCF
+	"\x03\xb9\x03\x06\x00\x00\x1f\xd0" + // 0x03B90306: 0x00001FD0
+	"\x03\xb9\x03\x04\x00\x00\x1f\xd1" + // 0x03B90304: 0x00001FD1
+	"\x03\xca\x03\x00\x00\x00\x1f\xd2" + // 0x03CA0300: 0x00001FD2
+	"\x03\xb9\x03B\x00\x00\x1f\xd6" + // 0x03B90342: 0x00001FD6
+	"\x03\xca\x03B\x00\x00\x1f\xd7" + // 0x03CA0342: 0x00001FD7
+	"\x03\x99\x03\x06\x00\x00\x1f\xd8" + // 0x03990306: 0x00001FD8
+	"\x03\x99\x03\x04\x00\x00\x1f\xd9" + // 0x03990304: 0x00001FD9
+	"\x03\x99\x03\x00\x00\x00\x1f\xda" + // 0x03990300: 0x00001FDA
+	"\x1f\xfe\x03\x00\x00\x00\x1f\xdd" + // 0x1FFE0300: 0x00001FDD
+	"\x1f\xfe\x03\x01\x00\x00\x1f\xde" + // 0x1FFE0301: 0x00001FDE
+	"\x1f\xfe\x03B\x00\x00\x1f\xdf" + // 0x1FFE0342: 0x00001FDF
+	"\x03\xc5\x03\x06\x00\x00\x1f\xe0" + // 0x03C50306: 0x00001FE0
+	"\x03\xc5\x03\x04\x00\x00\x1f\xe1" + // 0x03C50304: 0x00001FE1
+	"\x03\xcb\x03\x00\x00\x00\x1f\xe2" + // 0x03CB0300: 0x00001FE2
+	"\x03\xc1\x03\x13\x00\x00\x1f\xe4" + // 0x03C10313: 0x00001FE4
+	"\x03\xc1\x03\x14\x00\x00\x1f\xe5" + // 0x03C10314: 0x00001FE5
+	"\x03\xc5\x03B\x00\x00\x1f\xe6" + // 0x03C50342: 0x00001FE6
+	"\x03\xcb\x03B\x00\x00\x1f\xe7" + // 0x03CB0342: 0x00001FE7
+	"\x03\xa5\x03\x06\x00\x00\x1f\xe8" + // 0x03A50306: 0x00001FE8
+	"\x03\xa5\x03\x04\x00\x00\x1f\xe9" + // 0x03A50304: 0x00001FE9
+	"\x03\xa5\x03\x00\x00\x00\x1f\xea" + // 0x03A50300: 0x00001FEA
+	"\x03\xa1\x03\x14\x00\x00\x1f\xec" + // 0x03A10314: 0x00001FEC
+	"\x00\xa8\x03\x00\x00\x00\x1f\xed" + // 0x00A80300: 0x00001FED
+	"\x1f|\x03E\x00\x00\x1f\xf2" + // 0x1F7C0345: 0x00001FF2
+	"\x03\xc9\x03E\x00\x00\x1f\xf3" + // 0x03C90345: 0x00001FF3
+	"\x03\xce\x03E\x00\x00\x1f\xf4" + // 0x03CE0345: 0x00001FF4
+	"\x03\xc9\x03B\x00\x00\x1f\xf6" + // 0x03C90342: 0x00001FF6
+	"\x1f\xf6\x03E\x00\x00\x1f\xf7" + // 0x1FF60345: 0x00001FF7
+	"\x03\x9f\x03\x00\x00\x00\x1f\xf8" + // 0x039F0300: 0x00001FF8
+	"\x03\xa9\x03\x00\x00\x00\x1f\xfa" + // 0x03A90300: 0x00001FFA
+	"\x03\xa9\x03E\x00\x00\x1f\xfc" + // 0x03A90345: 0x00001FFC
+	"!\x90\x038\x00\x00!\x9a" + // 0x21900338: 0x0000219A
+	"!\x92\x038\x00\x00!\x9b" + // 0x21920338: 0x0000219B
+	"!\x94\x038\x00\x00!\xae" + // 0x21940338: 0x000021AE
+	"!\xd0\x038\x00\x00!\xcd" + // 0x21D00338: 0x000021CD
+	"!\xd4\x038\x00\x00!\xce" + // 0x21D40338: 0x000021CE
+	"!\xd2\x038\x00\x00!\xcf" + // 0x21D20338: 0x000021CF
+	"\"\x03\x038\x00\x00\"\x04" + // 0x22030338: 0x00002204
+	"\"\b\x038\x00\x00\"\t" + // 0x22080338: 0x00002209
+	"\"\v\x038\x00\x00\"\f" + // 0x220B0338: 0x0000220C
+	"\"#\x038\x00\x00\"$" + // 0x22230338: 0x00002224
+	"\"%\x038\x00\x00\"&" + // 0x22250338: 0x00002226
+	"\"<\x038\x00\x00\"A" + // 0x223C0338: 0x00002241
+	"\"C\x038\x00\x00\"D" + // 0x22430338: 0x00002244
+	"\"E\x038\x00\x00\"G" + // 0x22450338: 0x00002247
+	"\"H\x038\x00\x00\"I" + // 0x22480338: 0x00002249
+	"\x00=\x038\x00\x00\"`" + // 0x003D0338: 0x00002260
+	"\"a\x038\x00\x00\"b" + // 0x22610338: 0x00002262
+	"\"M\x038\x00\x00\"m" + // 0x224D0338: 0x0000226D
+	"\x00<\x038\x00\x00\"n" + // 0x003C0338: 0x0000226E
+	"\x00>\x038\x00\x00\"o" + // 0x003E0338: 0x0000226F
+	"\"d\x038\x00\x00\"p" + // 0x22640338: 0x00002270
+	"\"e\x038\x00\x00\"q" + // 0x22650338: 0x00002271
+	"\"r\x038\x00\x00\"t" + // 0x22720338: 0x00002274
+	"\"s\x038\x00\x00\"u" + // 0x22730338: 0x00002275
+	"\"v\x038\x00\x00\"x" + // 0x22760338: 0x00002278
+	"\"w\x038\x00\x00\"y" + // 0x22770338: 0x00002279
+	"\"z\x038\x00\x00\"\x80" + // 0x227A0338: 0x00002280
+	"\"{\x038\x00\x00\"\x81" + // 0x227B0338: 0x00002281
+	"\"\x82\x038\x00\x00\"\x84" + // 0x22820338: 0x00002284
+	"\"\x83\x038\x00\x00\"\x85" + // 0x22830338: 0x00002285
+	"\"\x86\x038\x00\x00\"\x88" + // 0x22860338: 0x00002288
+	"\"\x87\x038\x00\x00\"\x89" + // 0x22870338: 0x00002289
+	"\"\xa2\x038\x00\x00\"\xac" + // 0x22A20338: 0x000022AC
+	"\"\xa8\x038\x00\x00\"\xad" + // 0x22A80338: 0x000022AD
+	"\"\xa9\x038\x00\x00\"\xae" + // 0x22A90338: 0x000022AE
+	"\"\xab\x038\x00\x00\"\xaf" + // 0x22AB0338: 0x000022AF
+	"\"|\x038\x00\x00\"\xe0" + // 0x227C0338: 0x000022E0
+	"\"}\x038\x00\x00\"\xe1" + // 0x227D0338: 0x000022E1
+	"\"\x91\x038\x00\x00\"\xe2" + // 0x22910338: 0x000022E2
+	"\"\x92\x038\x00\x00\"\xe3" + // 0x22920338: 0x000022E3
+	"\"\xb2\x038\x00\x00\"\xea" + // 0x22B20338: 0x000022EA
+	"\"\xb3\x038\x00\x00\"\xeb" + // 0x22B30338: 0x000022EB
+	"\"\xb4\x038\x00\x00\"\xec" + // 0x22B40338: 0x000022EC
+	"\"\xb5\x038\x00\x00\"\xed" + // 0x22B50338: 0x000022ED
+	"0K0\x99\x00\x000L" + // 0x304B3099: 0x0000304C
+	"0M0\x99\x00\x000N" + // 0x304D3099: 0x0000304E
+	"0O0\x99\x00\x000P" + // 0x304F3099: 0x00003050
+	"0Q0\x99\x00\x000R" + // 0x30513099: 0x00003052
+	"0S0\x99\x00\x000T" + // 0x30533099: 0x00003054
+	"0U0\x99\x00\x000V" + // 0x30553099: 0x00003056
+	"0W0\x99\x00\x000X" + // 0x30573099: 0x00003058
+	"0Y0\x99\x00\x000Z" + // 0x30593099: 0x0000305A
+	"0[0\x99\x00\x000\\" + // 0x305B3099: 0x0000305C
+	"0]0\x99\x00\x000^" + // 0x305D3099: 0x0000305E
+	"0_0\x99\x00\x000`" + // 0x305F3099: 0x00003060
+	"0a0\x99\x00\x000b" + // 0x30613099: 0x00003062
+	"0d0\x99\x00\x000e" + // 0x30643099: 0x00003065
+	"0f0\x99\x00\x000g" + // 0x30663099: 0x00003067
+	"0h0\x99\x00\x000i" + // 0x30683099: 0x00003069
+	"0o0\x99\x00\x000p" + // 0x306F3099: 0x00003070
+	"0o0\x9a\x00\x000q" + // 0x306F309A: 0x00003071
+	"0r0\x99\x00\x000s" + // 0x30723099: 0x00003073
+	"0r0\x9a\x00\x000t" + // 0x3072309A: 0x00003074
+	"0u0\x99\x00\x000v" + // 0x30753099: 0x00003076
+	"0u0\x9a\x00\x000w" + // 0x3075309A: 0x00003077
+	"0x0\x99\x00\x000y" + // 0x30783099: 0x00003079
+	"0x0\x9a\x00\x000z" + // 0x3078309A: 0x0000307A
+	"0{0\x99\x00\x000|" + // 0x307B3099: 0x0000307C
+	"0{0\x9a\x00\x000}" + // 0x307B309A: 0x0000307D
+	"0F0\x99\x00\x000\x94" + // 0x30463099: 0x00003094
+	"0\x9d0\x99\x00\x000\x9e" + // 0x309D3099: 0x0000309E
+	"0\xab0\x99\x00\x000\xac" + // 0x30AB3099: 0x000030AC
+	"0\xad0\x99\x00\x000\xae" + // 0x30AD3099: 0x000030AE
+	"0\xaf0\x99\x00\x000\xb0" + // 0x30AF3099: 0x000030B0
+	"0\xb10\x99\x00\x000\xb2" + // 0x30B13099: 0x000030B2
+	"0\xb30\x99\x00\x000\xb4" + // 0x30B33099: 0x000030B4
+	"0\xb50\x99\x00\x000\xb6" + // 0x30B53099: 0x000030B6
+	"0\xb70\x99\x00\x000\xb8" + // 0x30B73099: 0x000030B8
+	"0\xb90\x99\x00\x000\xba" + // 0x30B93099: 0x000030BA
+	"0\xbb0\x99\x00\x000\xbc" + // 0x30BB3099: 0x000030BC
+	"0\xbd0\x99\x00\x000\xbe" + // 0x30BD3099: 0x000030BE
+	"0\xbf0\x99\x00\x000\xc0" + // 0x30BF3099: 0x000030C0
+	"0\xc10\x99\x00\x000\xc2" + // 0x30C13099: 0x000030C2
+	"0\xc40\x99\x00\x000\xc5" + // 0x30C43099: 0x000030C5
+	"0\xc60\x99\x00\x000\xc7" + // 0x30C63099: 0x000030C7
+	"0\xc80\x99\x00\x000\xc9" + // 0x30C83099: 0x000030C9
+	"0\xcf0\x99\x00\x000\xd0" + // 0x30CF3099: 0x000030D0
+	"0\xcf0\x9a\x00\x000\xd1" + // 0x30CF309A: 0x000030D1
+	"0\xd20\x99\x00\x000\xd3" + // 0x30D23099: 0x000030D3
+	"0\xd20\x9a\x00\x000\xd4" + // 0x30D2309A: 0x000030D4
+	"0\xd50\x99\x00\x000\xd6" + // 0x30D53099: 0x000030D6
+	"0\xd50\x9a\x00\x000\xd7" + // 0x30D5309A: 0x000030D7
+	"0\xd80\x99\x00\x000\xd9" + // 0x30D83099: 0x000030D9
+	"0\xd80\x9a\x00\x000\xda" + // 0x30D8309A: 0x000030DA
+	"0\xdb0\x99\x00\x000\xdc" + // 0x30DB3099: 0x000030DC
+	"0\xdb0\x9a\x00\x000\xdd" + // 0x30DB309A: 0x000030DD
+	"0\xa60\x99\x00\x000\xf4" + // 0x30A63099: 0x000030F4
+	"0\xef0\x99\x00\x000\xf7" + // 0x30EF3099: 0x000030F7
+	"0\xf00\x99\x00\x000\xf8" + // 0x30F03099: 0x000030F8
+	"0\xf10\x99\x00\x000\xf9" + // 0x30F13099: 0x000030F9
+	"0\xf20\x99\x00\x000\xfa" + // 0x30F23099: 0x000030FA
+	"0\xfd0\x99\x00\x000\xfe" + // 0x30FD3099: 0x000030FE
+	"\x10\x99\x10\xba\x00\x01\x10\x9a" + // 0x109910BA: 0x0001109A
+	"\x10\x9b\x10\xba\x00\x01\x10\x9c" + // 0x109B10BA: 0x0001109C
+	"\x10\xa5\x10\xba\x00\x01\x10\xab" + // 0x10A510BA: 0x000110AB
+	"\x111\x11'\x00\x01\x11." + // 0x11311127: 0x0001112E
+	"\x112\x11'\x00\x01\x11/" + // 0x11321127: 0x0001112F
+	"\x13G\x13>\x00\x01\x13K" + // 0x1347133E: 0x0001134B
+	"\x13G\x13W\x00\x01\x13L" + // 0x13471357: 0x0001134C
+	"\x14\xb9\x14\xba\x00\x01\x14\xbb" + // 0x14B914BA: 0x000114BB
+	"\x14\xb9\x14\xb0\x00\x01\x14\xbc" + // 0x14B914B0: 0x000114BC
+	"\x14\xb9\x14\xbd\x00\x01\x14\xbe" + // 0x14B914BD: 0x000114BE
+	"\x15\xb8\x15\xaf\x00\x01\x15\xba" + // 0x15B815AF: 0x000115BA
+	"\x15\xb9\x15\xaf\x00\x01\x15\xbb" + // 0x15B915AF: 0x000115BB
+	"\x195\x190\x00\x01\x198" + // 0x19351930: 0x00011938
+	""
+	// Total size of tables: 56KB (57068 bytes)
diff --git a/.ci/providerlint/vendor/golang.org/x/text/unicode/norm/trie.go b/.ci/providerlint/vendor/golang.org/x/text/unicode/norm/trie.go
index 423386bf436..e4250ae22ce 100644
--- a/.ci/providerlint/vendor/golang.org/x/text/unicode/norm/trie.go
+++ b/.ci/providerlint/vendor/golang.org/x/text/unicode/norm/trie.go
@@ -29,7 +29,7 @@ var (
 	nfkcData = newNfkcTrie(0)
 )
 
-// lookupValue determines the type of block n and looks up the value for b.
+// lookup determines the type of block n and looks up the value for b.
 // For n < t.cutoff, the block is a simple lookup table. Otherwise, the block
 // is a list of ranges with an accompanying value. Given a matching range r,
 // the value for b is by r.value + (b - r.lo) * stride.
diff --git a/.ci/providerlint/vendor/google.golang.org/appengine/datastore/save.go b/.ci/providerlint/vendor/google.golang.org/appengine/datastore/save.go
index 7b045a59556..b9a2a8f07a7 100644
--- a/.ci/providerlint/vendor/google.golang.org/appengine/datastore/save.go
+++ b/.ci/providerlint/vendor/google.golang.org/appengine/datastore/save.go
@@ -310,14 +310,14 @@ func propertiesToProto(defaultAppID string, key *Key, props []Property) (*pb.Ent
 func isEmptyValue(v reflect.Value) bool {
 	switch v.Kind() {
 	case reflect.Array, reflect.Map, reflect.Slice, reflect.String:
-		// TODO(perfomance): Only reflect.String needed, other property types are not supported (copy/paste from json package)
+		// TODO(performance): Only reflect.String needed, other property types are not supported (copy/paste from json package)
 		return v.Len() == 0
 	case reflect.Bool:
 		return !v.Bool()
 	case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
 		return v.Int() == 0
 	case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64, reflect.Uintptr:
-		// TODO(perfomance): Uint* are unsupported property types - should be removed (copy/paste from json package)
+		// TODO(performance): Uint* are unsupported property types - should be removed (copy/paste from json package)
 		return v.Uint() == 0
 	case reflect.Float32, reflect.Float64:
 		return v.Float() == 0
diff --git a/.ci/providerlint/vendor/google.golang.org/genproto/LICENSE b/.ci/providerlint/vendor/google.golang.org/genproto/googleapis/rpc/LICENSE
similarity index 100%
rename from .ci/providerlint/vendor/google.golang.org/genproto/LICENSE
rename to .ci/providerlint/vendor/google.golang.org/genproto/googleapis/rpc/LICENSE
diff --git a/.ci/providerlint/vendor/google.golang.org/genproto/googleapis/rpc/status/status.pb.go b/.ci/providerlint/vendor/google.golang.org/genproto/googleapis/rpc/status/status.pb.go
index e79a5388465..a6b5081888b 100644
--- a/.ci/providerlint/vendor/google.golang.org/genproto/googleapis/rpc/status/status.pb.go
+++ b/.ci/providerlint/vendor/google.golang.org/genproto/googleapis/rpc/status/status.pb.go
@@ -1,4 +1,4 @@
-// Copyright 2020 Google LLC
+// Copyright 2022 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -14,8 +14,8 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.25.0
-// 	protoc        v3.13.0
+// 	protoc-gen-go v1.26.0
+// 	protoc        v3.21.9
 // source: google/rpc/status.proto
 
 package status
@@ -24,7 +24,6 @@ import (
 	reflect "reflect"
 	sync "sync"
 
-	proto "github.com/golang/protobuf/proto"
 	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
 	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
 	anypb "google.golang.org/protobuf/types/known/anypb"
@@ -37,10 +36,6 @@ const (
 	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
 )
 
-// This is a compile-time assertion that a sufficiently up-to-date version
-// of the legacy proto package is being used.
-const _ = proto.ProtoPackageIsVersion4
-
 // The `Status` type defines a logical error model that is suitable for
 // different programming environments, including REST APIs and RPC APIs. It is
 // used by [gRPC](https://github.com/grpc). Each `Status` message contains
@@ -53,11 +48,13 @@ type Status struct {
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	// The status code, which should be an enum value of [google.rpc.Code][google.rpc.Code].
+	// The status code, which should be an enum value of
+	// [google.rpc.Code][google.rpc.Code].
 	Code int32 `protobuf:"varint,1,opt,name=code,proto3" json:"code,omitempty"`
 	// A developer-facing error message, which should be in English. Any
 	// user-facing error message should be localized and sent in the
-	// [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client.
+	// [google.rpc.Status.details][google.rpc.Status.details] field, or localized
+	// by the client.
 	Message string `protobuf:"bytes,2,opt,name=message,proto3" json:"message,omitempty"`
 	// A list of messages that carry the error details.  There is a common set of
 	// message types for APIs to use.
diff --git a/.ci/providerlint/vendor/google.golang.org/grpc/CONTRIBUTING.md b/.ci/providerlint/vendor/google.golang.org/grpc/CONTRIBUTING.md
index 52338d004ce..608aa6e1ac5 100644
--- a/.ci/providerlint/vendor/google.golang.org/grpc/CONTRIBUTING.md
+++ b/.ci/providerlint/vendor/google.golang.org/grpc/CONTRIBUTING.md
@@ -20,6 +20,15 @@ How to get your contributions merged smoothly and quickly.
   both author's & review's time is wasted. Create more PRs to address different
   concerns and everyone will be happy.
 
+- If you are searching for features to work on, issues labeled [Status: Help
+  Wanted](https://github.com/grpc/grpc-go/issues?q=is%3Aissue+is%3Aopen+sort%3Aupdated-desc+label%3A%22Status%3A+Help+Wanted%22)
+  is a great place to start. These issues are well-documented and usually can be
+  resolved with a single pull request.
+
+- If you are adding a new file, make sure it has the copyright message template 
+  at the top as a comment. You can copy over the message from an existing file 
+  and update the year.
+
 - The grpc package should only depend on standard Go packages and a small number
   of exceptions. If your contribution introduces new dependencies which are NOT
   in the [list](https://godoc.org/google.golang.org/grpc?imports), you need a
@@ -32,14 +41,18 @@ How to get your contributions merged smoothly and quickly.
 - Provide a good **PR description** as a record of **what** change is being made
   and **why** it was made. Link to a github issue if it exists.
 
-- Don't fix code style and formatting unless you are already changing that line
-  to address an issue. PRs with irrelevant changes won't be merged. If you do
-  want to fix formatting or style, do that in a separate PR.
+- If you want to fix formatting or style, consider whether your changes are an 
+  obvious improvement or might be considered a personal preference. If a style 
+  change is based on preference, it likely will not be accepted. If it corrects 
+  widely agreed-upon anti-patterns, then please do create a PR and explain the 
+  benefits of the change.
 
 - Unless your PR is trivial, you should expect there will be reviewer comments
-  that you'll need to address before merging. We expect you to be reasonably
-  responsive to those comments, otherwise the PR will be closed after 2-3 weeks
-  of inactivity.
+  that you'll need to address before merging. We'll mark it as `Status: Requires
+  Reporter Clarification` if we expect you to respond to these comments in a
+  timely manner. If the PR remains inactive for 6 days, it will be marked as
+  `stale` and automatically close 7 days after that if we don't hear back from
+  you.
 
 - Maintain **clean commit history** and use **meaningful commit messages**. PRs
   with messy commit history are difficult to review and won't be merged. Use
diff --git a/.ci/providerlint/vendor/google.golang.org/grpc/attributes/attributes.go b/.ci/providerlint/vendor/google.golang.org/grpc/attributes/attributes.go
index 02f5dc53189..49712aca33a 100644
--- a/.ci/providerlint/vendor/google.golang.org/grpc/attributes/attributes.go
+++ b/.ci/providerlint/vendor/google.golang.org/grpc/attributes/attributes.go
@@ -25,6 +25,11 @@
 // later release.
 package attributes
 
+import (
+	"fmt"
+	"strings"
+)
+
 // Attributes is an immutable struct for storing and retrieving generic
 // key/value pairs.  Keys must be hashable, and users should define their own
 // types for keys.  Values should not be modified after they are added to an
@@ -99,3 +104,39 @@ func (a *Attributes) Equal(o *Attributes) bool {
 	}
 	return true
 }
+
+// String prints the attribute map. If any key or values throughout the map
+// implement fmt.Stringer, it calls that method and appends.
+func (a *Attributes) String() string {
+	var sb strings.Builder
+	sb.WriteString("{")
+	first := true
+	for k, v := range a.m {
+		if !first {
+			sb.WriteString(", ")
+		}
+		sb.WriteString(fmt.Sprintf("%q: %q ", str(k), str(v)))
+		first = false
+	}
+	sb.WriteString("}")
+	return sb.String()
+}
+
+func str(x interface{}) string {
+	if v, ok := x.(fmt.Stringer); ok {
+		return v.String()
+	} else if v, ok := x.(string); ok {
+		return v
+	}
+	return fmt.Sprintf("<%p>", x)
+}
+
+// MarshalJSON helps implement the json.Marshaler interface, thereby rendering
+// the Attributes correctly when printing (via pretty.JSON) structs containing
+// Attributes as fields.
+//
+// Is it impossible to unmarshal attributes from a JSON representation and this
+// method is meant only for debugging purposes.
+func (a *Attributes) MarshalJSON() ([]byte, error) {
+	return []byte(a.String()), nil
+}
diff --git a/.ci/providerlint/vendor/google.golang.org/grpc/balancer/balancer.go b/.ci/providerlint/vendor/google.golang.org/grpc/balancer/balancer.go
index 392b21fb2d8..8f00523c0e2 100644
--- a/.ci/providerlint/vendor/google.golang.org/grpc/balancer/balancer.go
+++ b/.ci/providerlint/vendor/google.golang.org/grpc/balancer/balancer.go
@@ -279,6 +279,14 @@ type PickResult struct {
 	// type, Done may not be called.  May be nil if the balancer does not wish
 	// to be notified when the RPC completes.
 	Done func(DoneInfo)
+
+	// Metadata provides a way for LB policies to inject arbitrary per-call
+	// metadata. Any metadata returned here will be merged with existing
+	// metadata added by the client application.
+	//
+	// LB policies with child policies are responsible for propagating metadata
+	// injected by their children to the ClientConn, as part of Pick().
+	Metadata metadata.MD
 }
 
 // TransientFailureError returns e.  It exists for backward compatibility and
diff --git a/.ci/providerlint/vendor/google.golang.org/grpc/balancer_conn_wrappers.go b/.ci/providerlint/vendor/google.golang.org/grpc/balancer_conn_wrappers.go
index 0359956d36f..04b9ad41169 100644
--- a/.ci/providerlint/vendor/google.golang.org/grpc/balancer_conn_wrappers.go
+++ b/.ci/providerlint/vendor/google.golang.org/grpc/balancer_conn_wrappers.go
@@ -25,14 +25,20 @@ import (
 	"sync"
 
 	"google.golang.org/grpc/balancer"
-	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/connectivity"
 	"google.golang.org/grpc/internal/balancer/gracefulswitch"
-	"google.golang.org/grpc/internal/buffer"
 	"google.golang.org/grpc/internal/channelz"
 	"google.golang.org/grpc/internal/grpcsync"
 	"google.golang.org/grpc/resolver"
-	"google.golang.org/grpc/status"
+)
+
+type ccbMode int
+
+const (
+	ccbModeActive = iota
+	ccbModeIdle
+	ccbModeClosed
+	ccbModeExitingIdle
 )
 
 // ccBalancerWrapper sits between the ClientConn and the Balancer.
@@ -49,192 +55,101 @@ import (
 // It uses the gracefulswitch.Balancer internally to ensure that balancer
 // switches happen in a graceful manner.
 type ccBalancerWrapper struct {
-	cc *ClientConn
-
-	// Since these fields are accessed only from handleXxx() methods which are
-	// synchronized by the watcher goroutine, we do not need a mutex to protect
-	// these fields.
+	// The following fields are initialized when the wrapper is created and are
+	// read-only afterwards, and therefore can be accessed without a mutex.
+	cc   *ClientConn
+	opts balancer.BuildOptions
+
+	// Outgoing (gRPC --> balancer) calls are guaranteed to execute in a
+	// mutually exclusive manner as they are scheduled in the serializer. Fields
+	// accessed *only* in these serializer callbacks, can therefore be accessed
+	// without a mutex.
 	balancer        *gracefulswitch.Balancer
 	curBalancerName string
 
-	updateCh *buffer.Unbounded // Updates written on this channel are processed by watcher().
-	resultCh *buffer.Unbounded // Results of calls to UpdateClientConnState() are pushed here.
-	closed   *grpcsync.Event   // Indicates if close has been called.
-	done     *grpcsync.Event   // Indicates if close has completed its work.
+	// mu guards access to the below fields. Access to the serializer and its
+	// cancel function needs to be mutex protected because they are overwritten
+	// when the wrapper exits idle mode.
+	mu               sync.Mutex
+	serializer       *grpcsync.CallbackSerializer // To serialize all outoing calls.
+	serializerCancel context.CancelFunc           // To close the seralizer at close/enterIdle time.
+	mode             ccbMode                      // Tracks the current mode of the wrapper.
 }
 
 // newCCBalancerWrapper creates a new balancer wrapper. The underlying balancer
 // is not created until the switchTo() method is invoked.
 func newCCBalancerWrapper(cc *ClientConn, bopts balancer.BuildOptions) *ccBalancerWrapper {
+	ctx, cancel := context.WithCancel(context.Background())
 	ccb := &ccBalancerWrapper{
-		cc:       cc,
-		updateCh: buffer.NewUnbounded(),
-		resultCh: buffer.NewUnbounded(),
-		closed:   grpcsync.NewEvent(),
-		done:     grpcsync.NewEvent(),
+		cc:               cc,
+		opts:             bopts,
+		serializer:       grpcsync.NewCallbackSerializer(ctx),
+		serializerCancel: cancel,
 	}
-	go ccb.watcher()
 	ccb.balancer = gracefulswitch.NewBalancer(ccb, bopts)
 	return ccb
 }
 
-// The following xxxUpdate structs wrap the arguments received as part of the
-// corresponding update. The watcher goroutine uses the 'type' of the update to
-// invoke the appropriate handler routine to handle the update.
-
-type ccStateUpdate struct {
-	ccs *balancer.ClientConnState
-}
-
-type scStateUpdate struct {
-	sc    balancer.SubConn
-	state connectivity.State
-	err   error
-}
-
-type exitIdleUpdate struct{}
-
-type resolverErrorUpdate struct {
-	err error
-}
-
-type switchToUpdate struct {
-	name string
-}
-
-type subConnUpdate struct {
-	acbw *acBalancerWrapper
-}
-
-// watcher is a long-running goroutine which reads updates from a channel and
-// invokes corresponding methods on the underlying balancer. It ensures that
-// these methods are invoked in a synchronous fashion. It also ensures that
-// these methods are invoked in the order in which the updates were received.
-func (ccb *ccBalancerWrapper) watcher() {
-	for {
-		select {
-		case u := <-ccb.updateCh.Get():
-			ccb.updateCh.Load()
-			if ccb.closed.HasFired() {
-				break
-			}
-			switch update := u.(type) {
-			case *ccStateUpdate:
-				ccb.handleClientConnStateChange(update.ccs)
-			case *scStateUpdate:
-				ccb.handleSubConnStateChange(update)
-			case *exitIdleUpdate:
-				ccb.handleExitIdle()
-			case *resolverErrorUpdate:
-				ccb.handleResolverError(update.err)
-			case *switchToUpdate:
-				ccb.handleSwitchTo(update.name)
-			case *subConnUpdate:
-				ccb.handleRemoveSubConn(update.acbw)
-			default:
-				logger.Errorf("ccBalancerWrapper.watcher: unknown update %+v, type %T", update, update)
-			}
-		case <-ccb.closed.Done():
-		}
-
-		if ccb.closed.HasFired() {
-			ccb.handleClose()
-			return
-		}
-	}
-}
-
 // updateClientConnState is invoked by grpc to push a ClientConnState update to
 // the underlying balancer.
-//
-// Unlike other methods invoked by grpc to push updates to the underlying
-// balancer, this method cannot simply push the update onto the update channel
-// and return. It needs to return the error returned by the underlying balancer
-// back to grpc which propagates that to the resolver.
 func (ccb *ccBalancerWrapper) updateClientConnState(ccs *balancer.ClientConnState) error {
-	ccb.updateCh.Put(&ccStateUpdate{ccs: ccs})
-
-	var res interface{}
-	select {
-	case res = <-ccb.resultCh.Get():
-		ccb.resultCh.Load()
-	case <-ccb.closed.Done():
-		// Return early if the balancer wrapper is closed while we are waiting for
-		// the underlying balancer to process a ClientConnState update.
-		return nil
-	}
-	// If the returned error is nil, attempting to type assert to error leads to
-	// panic. So, this needs to handled separately.
-	if res == nil {
-		return nil
-	}
-	return res.(error)
-}
-
-// handleClientConnStateChange handles a ClientConnState update from the update
-// channel and invokes the appropriate method on the underlying balancer.
-//
-// If the addresses specified in the update contain addresses of type "grpclb"
-// and the selected LB policy is not "grpclb", these addresses will be filtered
-// out and ccs will be modified with the updated address list.
-func (ccb *ccBalancerWrapper) handleClientConnStateChange(ccs *balancer.ClientConnState) {
-	if ccb.curBalancerName != grpclbName {
-		// Filter any grpclb addresses since we don't have the grpclb balancer.
-		var addrs []resolver.Address
-		for _, addr := range ccs.ResolverState.Addresses {
-			if addr.Type == resolver.GRPCLB {
-				continue
+	ccb.mu.Lock()
+	errCh := make(chan error, 1)
+	// Here and everywhere else where Schedule() is called, it is done with the
+	// lock held. But the lock guards only the scheduling part. The actual
+	// callback is called asynchronously without the lock being held.
+	ok := ccb.serializer.Schedule(func(_ context.Context) {
+		// If the addresses specified in the update contain addresses of type
+		// "grpclb" and the selected LB policy is not "grpclb", these addresses
+		// will be filtered out and ccs will be modified with the updated
+		// address list.
+		if ccb.curBalancerName != grpclbName {
+			var addrs []resolver.Address
+			for _, addr := range ccs.ResolverState.Addresses {
+				if addr.Type == resolver.GRPCLB {
+					continue
+				}
+				addrs = append(addrs, addr)
 			}
-			addrs = append(addrs, addr)
+			ccs.ResolverState.Addresses = addrs
 		}
-		ccs.ResolverState.Addresses = addrs
+		errCh <- ccb.balancer.UpdateClientConnState(*ccs)
+	})
+	if !ok {
+		// If we are unable to schedule a function with the serializer, it
+		// indicates that it has been closed. A serializer is only closed when
+		// the wrapper is closed or is in idle.
+		ccb.mu.Unlock()
+		return fmt.Errorf("grpc: cannot send state update to a closed or idle balancer")
 	}
-	ccb.resultCh.Put(ccb.balancer.UpdateClientConnState(*ccs))
+	ccb.mu.Unlock()
+
+	// We get here only if the above call to Schedule succeeds, in which case it
+	// is guaranteed that the scheduled function will run. Therefore it is safe
+	// to block on this channel.
+	err := <-errCh
+	if logger.V(2) && err != nil {
+		logger.Infof("error from balancer.UpdateClientConnState: %v", err)
+	}
+	return err
 }
 
 // updateSubConnState is invoked by grpc to push a subConn state update to the
 // underlying balancer.
 func (ccb *ccBalancerWrapper) updateSubConnState(sc balancer.SubConn, s connectivity.State, err error) {
-	// When updating addresses for a SubConn, if the address in use is not in
-	// the new addresses, the old ac will be tearDown() and a new ac will be
-	// created. tearDown() generates a state change with Shutdown state, we
-	// don't want the balancer to receive this state change. So before
-	// tearDown() on the old ac, ac.acbw (acWrapper) will be set to nil, and
-	// this function will be called with (nil, Shutdown). We don't need to call
-	// balancer method in this case.
-	if sc == nil {
-		return
-	}
-	ccb.updateCh.Put(&scStateUpdate{
-		sc:    sc,
-		state: s,
-		err:   err,
+	ccb.mu.Lock()
+	ccb.serializer.Schedule(func(_ context.Context) {
+		ccb.balancer.UpdateSubConnState(sc, balancer.SubConnState{ConnectivityState: s, ConnectionError: err})
 	})
-}
-
-// handleSubConnStateChange handles a SubConnState update from the update
-// channel and invokes the appropriate method on the underlying balancer.
-func (ccb *ccBalancerWrapper) handleSubConnStateChange(update *scStateUpdate) {
-	ccb.balancer.UpdateSubConnState(update.sc, balancer.SubConnState{ConnectivityState: update.state, ConnectionError: update.err})
-}
-
-func (ccb *ccBalancerWrapper) exitIdle() {
-	ccb.updateCh.Put(&exitIdleUpdate{})
-}
-
-func (ccb *ccBalancerWrapper) handleExitIdle() {
-	if ccb.cc.GetState() != connectivity.Idle {
-		return
-	}
-	ccb.balancer.ExitIdle()
+	ccb.mu.Unlock()
 }
 
 func (ccb *ccBalancerWrapper) resolverError(err error) {
-	ccb.updateCh.Put(&resolverErrorUpdate{err: err})
-}
-
-func (ccb *ccBalancerWrapper) handleResolverError(err error) {
-	ccb.balancer.ResolverError(err)
+	ccb.mu.Lock()
+	ccb.serializer.Schedule(func(_ context.Context) {
+		ccb.balancer.ResolverError(err)
+	})
+	ccb.mu.Unlock()
 }
 
 // switchTo is invoked by grpc to instruct the balancer wrapper to switch to the
@@ -248,24 +163,27 @@ func (ccb *ccBalancerWrapper) handleResolverError(err error) {
 // the ccBalancerWrapper keeps track of the current LB policy name, and skips
 // the graceful balancer switching process if the name does not change.
 func (ccb *ccBalancerWrapper) switchTo(name string) {
-	ccb.updateCh.Put(&switchToUpdate{name: name})
+	ccb.mu.Lock()
+	ccb.serializer.Schedule(func(_ context.Context) {
+		// TODO: Other languages use case-sensitive balancer registries. We should
+		// switch as well. See: https://github.com/grpc/grpc-go/issues/5288.
+		if strings.EqualFold(ccb.curBalancerName, name) {
+			return
+		}
+		ccb.buildLoadBalancingPolicy(name)
+	})
+	ccb.mu.Unlock()
 }
 
-// handleSwitchTo handles a balancer switch update from the update channel. It
-// calls the SwitchTo() method on the gracefulswitch.Balancer with a
-// balancer.Builder corresponding to name. If no balancer.Builder is registered
-// for the given name, it uses the default LB policy which is "pick_first".
-func (ccb *ccBalancerWrapper) handleSwitchTo(name string) {
-	// TODO: Other languages use case-insensitive balancer registries. We should
-	// switch as well. See: https://github.com/grpc/grpc-go/issues/5288.
-	if strings.EqualFold(ccb.curBalancerName, name) {
-		return
-	}
-
-	// TODO: Ensure that name is a registered LB policy when we get here.
-	// We currently only validate the `loadBalancingConfig` field. We need to do
-	// the same for the `loadBalancingPolicy` field and reject the service config
-	// if the specified policy is not registered.
+// buildLoadBalancingPolicy performs the following:
+//   - retrieve a balancer builder for the given name. Use the default LB
+//     policy, pick_first, if no LB policy with name is found in the registry.
+//   - instruct the gracefulswitch balancer to switch to the above builder. This
+//     will actually build the new balancer.
+//   - update the `curBalancerName` field
+//
+// Must be called from a serializer callback.
+func (ccb *ccBalancerWrapper) buildLoadBalancingPolicy(name string) {
 	builder := balancer.Get(name)
 	if builder == nil {
 		channelz.Warningf(logger, ccb.cc.channelzID, "Channel switches to new LB policy %q, since the specified LB policy %q was not registered", PickFirstBalancerName, name)
@@ -281,26 +199,114 @@ func (ccb *ccBalancerWrapper) handleSwitchTo(name string) {
 	ccb.curBalancerName = builder.Name()
 }
 
-// handleRemoveSucConn handles a request from the underlying balancer to remove
-// a subConn.
-//
-// See comments in RemoveSubConn() for more details.
-func (ccb *ccBalancerWrapper) handleRemoveSubConn(acbw *acBalancerWrapper) {
-	ccb.cc.removeAddrConn(acbw.getAddrConn(), errConnDrain)
+func (ccb *ccBalancerWrapper) close() {
+	channelz.Info(logger, ccb.cc.channelzID, "ccBalancerWrapper: closing")
+	ccb.closeBalancer(ccbModeClosed)
 }
 
-func (ccb *ccBalancerWrapper) close() {
-	ccb.closed.Fire()
-	<-ccb.done.Done()
+// enterIdleMode is invoked by grpc when the channel enters idle mode upon
+// expiry of idle_timeout. This call blocks until the balancer is closed.
+func (ccb *ccBalancerWrapper) enterIdleMode() {
+	channelz.Info(logger, ccb.cc.channelzID, "ccBalancerWrapper: entering idle mode")
+	ccb.closeBalancer(ccbModeIdle)
+}
+
+// closeBalancer is invoked when the channel is being closed or when it enters
+// idle mode upon expiry of idle_timeout.
+func (ccb *ccBalancerWrapper) closeBalancer(m ccbMode) {
+	ccb.mu.Lock()
+	if ccb.mode == ccbModeClosed || ccb.mode == ccbModeIdle {
+		ccb.mu.Unlock()
+		return
+	}
+
+	ccb.mode = m
+	done := ccb.serializer.Done
+	b := ccb.balancer
+	ok := ccb.serializer.Schedule(func(_ context.Context) {
+		// Close the serializer to ensure that no more calls from gRPC are sent
+		// to the balancer.
+		ccb.serializerCancel()
+		// Empty the current balancer name because we don't have a balancer
+		// anymore and also so that we act on the next call to switchTo by
+		// creating a new balancer specified by the new resolver.
+		ccb.curBalancerName = ""
+	})
+	if !ok {
+		ccb.mu.Unlock()
+		return
+	}
+	ccb.mu.Unlock()
+
+	// Give enqueued callbacks a chance to finish.
+	<-done
+	// Spawn a goroutine to close the balancer (since it may block trying to
+	// cleanup all allocated resources) and return early.
+	go b.Close()
 }
 
-func (ccb *ccBalancerWrapper) handleClose() {
-	ccb.balancer.Close()
-	ccb.done.Fire()
+// exitIdleMode is invoked by grpc when the channel exits idle mode either
+// because of an RPC or because of an invocation of the Connect() API. This
+// recreates the balancer that was closed previously when entering idle mode.
+//
+// If the channel is not in idle mode, we know for a fact that we are here as a
+// result of the user calling the Connect() method on the ClientConn. In this
+// case, we can simply forward the call to the underlying balancer, instructing
+// it to reconnect to the backends.
+func (ccb *ccBalancerWrapper) exitIdleMode() {
+	ccb.mu.Lock()
+	if ccb.mode == ccbModeClosed {
+		// Request to exit idle is a no-op when wrapper is already closed.
+		ccb.mu.Unlock()
+		return
+	}
+
+	if ccb.mode == ccbModeIdle {
+		// Recreate the serializer which was closed when we entered idle.
+		ctx, cancel := context.WithCancel(context.Background())
+		ccb.serializer = grpcsync.NewCallbackSerializer(ctx)
+		ccb.serializerCancel = cancel
+	}
+
+	// The ClientConn guarantees that mutual exclusion between close() and
+	// exitIdleMode(), and since we just created a new serializer, we can be
+	// sure that the below function will be scheduled.
+	done := make(chan struct{})
+	ccb.serializer.Schedule(func(_ context.Context) {
+		defer close(done)
+
+		ccb.mu.Lock()
+		defer ccb.mu.Unlock()
+
+		if ccb.mode != ccbModeIdle {
+			ccb.balancer.ExitIdle()
+			return
+		}
+
+		// Gracefulswitch balancer does not support a switchTo operation after
+		// being closed. Hence we need to create a new one here.
+		ccb.balancer = gracefulswitch.NewBalancer(ccb, ccb.opts)
+		ccb.mode = ccbModeActive
+		channelz.Info(logger, ccb.cc.channelzID, "ccBalancerWrapper: exiting idle mode")
+
+	})
+	ccb.mu.Unlock()
+
+	<-done
+}
+
+func (ccb *ccBalancerWrapper) isIdleOrClosed() bool {
+	ccb.mu.Lock()
+	defer ccb.mu.Unlock()
+	return ccb.mode == ccbModeIdle || ccb.mode == ccbModeClosed
 }
 
 func (ccb *ccBalancerWrapper) NewSubConn(addrs []resolver.Address, opts balancer.NewSubConnOptions) (balancer.SubConn, error) {
-	if len(addrs) <= 0 {
+	if ccb.isIdleOrClosed() {
+		return nil, fmt.Errorf("grpc: cannot create SubConn when balancer is closed or idle")
+	}
+
+	if len(addrs) == 0 {
 		return nil, fmt.Errorf("grpc: cannot create SubConn with empty address list")
 	}
 	ac, err := ccb.cc.newAddrConn(addrs, opts)
@@ -309,31 +315,35 @@ func (ccb *ccBalancerWrapper) NewSubConn(addrs []resolver.Address, opts balancer
 		return nil, err
 	}
 	acbw := &acBalancerWrapper{ac: ac, producers: make(map[balancer.ProducerBuilder]*refCountedProducer)}
-	acbw.ac.mu.Lock()
 	ac.acbw = acbw
-	acbw.ac.mu.Unlock()
 	return acbw, nil
 }
 
 func (ccb *ccBalancerWrapper) RemoveSubConn(sc balancer.SubConn) {
-	// Before we switched the ccBalancerWrapper to use gracefulswitch.Balancer, it
-	// was required to handle the RemoveSubConn() method asynchronously by pushing
-	// the update onto the update channel. This was done to avoid a deadlock as
-	// switchBalancer() was holding cc.mu when calling Close() on the old
-	// balancer, which would in turn call RemoveSubConn().
-	//
-	// With the use of gracefulswitch.Balancer in ccBalancerWrapper, handling this
-	// asynchronously is probably not required anymore since the switchTo() method
-	// handles the balancer switch by pushing the update onto the channel.
-	// TODO(easwars): Handle this inline.
+	if ccb.isIdleOrClosed() {
+		// It it safe to ignore this call when the balancer is closed or in idle
+		// because the ClientConn takes care of closing the connections.
+		//
+		// Not returning early from here when the balancer is closed or in idle
+		// leads to a deadlock though, because of the following sequence of
+		// calls when holding cc.mu:
+		// cc.exitIdleMode --> ccb.enterIdleMode --> gsw.Close -->
+		// ccb.RemoveAddrConn --> cc.removeAddrConn
+		return
+	}
+
 	acbw, ok := sc.(*acBalancerWrapper)
 	if !ok {
 		return
 	}
-	ccb.updateCh.Put(&subConnUpdate{acbw: acbw})
+	ccb.cc.removeAddrConn(acbw.ac, errConnDrain)
 }
 
 func (ccb *ccBalancerWrapper) UpdateAddresses(sc balancer.SubConn, addrs []resolver.Address) {
+	if ccb.isIdleOrClosed() {
+		return
+	}
+
 	acbw, ok := sc.(*acBalancerWrapper)
 	if !ok {
 		return
@@ -342,6 +352,10 @@ func (ccb *ccBalancerWrapper) UpdateAddresses(sc balancer.SubConn, addrs []resol
 }
 
 func (ccb *ccBalancerWrapper) UpdateState(s balancer.State) {
+	if ccb.isIdleOrClosed() {
+		return
+	}
+
 	// Update picker before updating state.  Even though the ordering here does
 	// not matter, it can lead to multiple calls of Pick in the common start-up
 	// case where we wait for ready and then perform an RPC.  If the picker is
@@ -352,6 +366,10 @@ func (ccb *ccBalancerWrapper) UpdateState(s balancer.State) {
 }
 
 func (ccb *ccBalancerWrapper) ResolveNow(o resolver.ResolveNowOptions) {
+	if ccb.isIdleOrClosed() {
+		return
+	}
+
 	ccb.cc.resolveNow(o)
 }
 
@@ -362,71 +380,31 @@ func (ccb *ccBalancerWrapper) Target() string {
 // acBalancerWrapper is a wrapper on top of ac for balancers.
 // It implements balancer.SubConn interface.
 type acBalancerWrapper struct {
+	ac *addrConn // read-only
+
 	mu        sync.Mutex
-	ac        *addrConn
 	producers map[balancer.ProducerBuilder]*refCountedProducer
 }
 
-func (acbw *acBalancerWrapper) UpdateAddresses(addrs []resolver.Address) {
-	acbw.mu.Lock()
-	defer acbw.mu.Unlock()
-	if len(addrs) <= 0 {
-		acbw.ac.cc.removeAddrConn(acbw.ac, errConnDrain)
-		return
-	}
-	if !acbw.ac.tryUpdateAddrs(addrs) {
-		cc := acbw.ac.cc
-		opts := acbw.ac.scopts
-		acbw.ac.mu.Lock()
-		// Set old ac.acbw to nil so the Shutdown state update will be ignored
-		// by balancer.
-		//
-		// TODO(bar) the state transition could be wrong when tearDown() old ac
-		// and creating new ac, fix the transition.
-		acbw.ac.acbw = nil
-		acbw.ac.mu.Unlock()
-		acState := acbw.ac.getState()
-		acbw.ac.cc.removeAddrConn(acbw.ac, errConnDrain)
-
-		if acState == connectivity.Shutdown {
-			return
-		}
+func (acbw *acBalancerWrapper) String() string {
+	return fmt.Sprintf("SubConn(id:%d)", acbw.ac.channelzID.Int())
+}
 
-		newAC, err := cc.newAddrConn(addrs, opts)
-		if err != nil {
-			channelz.Warningf(logger, acbw.ac.channelzID, "acBalancerWrapper: UpdateAddresses: failed to newAddrConn: %v", err)
-			return
-		}
-		acbw.ac = newAC
-		newAC.mu.Lock()
-		newAC.acbw = acbw
-		newAC.mu.Unlock()
-		if acState != connectivity.Idle {
-			go newAC.connect()
-		}
-	}
+func (acbw *acBalancerWrapper) UpdateAddresses(addrs []resolver.Address) {
+	acbw.ac.updateAddrs(addrs)
 }
 
 func (acbw *acBalancerWrapper) Connect() {
-	acbw.mu.Lock()
-	defer acbw.mu.Unlock()
 	go acbw.ac.connect()
 }
 
-func (acbw *acBalancerWrapper) getAddrConn() *addrConn {
-	acbw.mu.Lock()
-	defer acbw.mu.Unlock()
-	return acbw.ac
-}
-
-var errSubConnNotReady = status.Error(codes.Unavailable, "SubConn not currently connected")
-
 // NewStream begins a streaming RPC on the addrConn.  If the addrConn is not
-// ready, returns errSubConnNotReady.
+// ready, blocks until it is or ctx expires.  Returns an error when the context
+// expires or the addrConn is shut down.
 func (acbw *acBalancerWrapper) NewStream(ctx context.Context, desc *StreamDesc, method string, opts ...CallOption) (ClientStream, error) {
-	transport := acbw.ac.getReadyTransport()
-	if transport == nil {
-		return nil, errSubConnNotReady
+	transport, err := acbw.ac.getTransport(ctx)
+	if err != nil {
+		return nil, err
 	}
 	return newNonRetryClientStream(ctx, desc, method, transport, acbw.ac, opts...)
 }
diff --git a/.ci/providerlint/vendor/google.golang.org/grpc/binarylog/grpc_binarylog_v1/binarylog.pb.go b/.ci/providerlint/vendor/google.golang.org/grpc/binarylog/grpc_binarylog_v1/binarylog.pb.go
index 64a232f2811..ec2c2fa14dd 100644
--- a/.ci/providerlint/vendor/google.golang.org/grpc/binarylog/grpc_binarylog_v1/binarylog.pb.go
+++ b/.ci/providerlint/vendor/google.golang.org/grpc/binarylog/grpc_binarylog_v1/binarylog.pb.go
@@ -18,14 +18,13 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.25.0
-// 	protoc        v3.14.0
+// 	protoc-gen-go v1.30.0
+// 	protoc        v4.22.0
 // source: grpc/binlog/v1/binarylog.proto
 
 package grpc_binarylog_v1
 
 import (
-	proto "github.com/golang/protobuf/proto"
 	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
 	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
 	durationpb "google.golang.org/protobuf/types/known/durationpb"
@@ -41,10 +40,6 @@ const (
 	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
 )
 
-// This is a compile-time assertion that a sufficiently up-to-date version
-// of the legacy proto package is being used.
-const _ = proto.ProtoPackageIsVersion4
-
 // Enumerates the type of event
 // Note the terminology is different from the RPC semantics
 // definition, but the same meaning is expressed here.
diff --git a/.ci/providerlint/vendor/google.golang.org/grpc/call.go b/.ci/providerlint/vendor/google.golang.org/grpc/call.go
index 9e20e4d385f..e6a1dc5d75e 100644
--- a/.ci/providerlint/vendor/google.golang.org/grpc/call.go
+++ b/.ci/providerlint/vendor/google.golang.org/grpc/call.go
@@ -27,6 +27,11 @@ import (
 //
 // All errors returned by Invoke are compatible with the status package.
 func (cc *ClientConn) Invoke(ctx context.Context, method string, args, reply interface{}, opts ...CallOption) error {
+	if err := cc.idlenessMgr.onCallBegin(); err != nil {
+		return err
+	}
+	defer cc.idlenessMgr.onCallEnd()
+
 	// allow interceptor to see all applicable call options, which means those
 	// configured as defaults from dial option as well as per-call options
 	opts = combine(cc.dopts.callOptions, opts)
diff --git a/.ci/providerlint/vendor/google.golang.org/grpc/clientconn.go b/.ci/providerlint/vendor/google.golang.org/grpc/clientconn.go
index 422639c79db..bfd7555a8bf 100644
--- a/.ci/providerlint/vendor/google.golang.org/grpc/clientconn.go
+++ b/.ci/providerlint/vendor/google.golang.org/grpc/clientconn.go
@@ -24,7 +24,6 @@ import (
 	"fmt"
 	"math"
 	"net/url"
-	"reflect"
 	"strings"
 	"sync"
 	"sync/atomic"
@@ -38,6 +37,7 @@ import (
 	"google.golang.org/grpc/internal/backoff"
 	"google.golang.org/grpc/internal/channelz"
 	"google.golang.org/grpc/internal/grpcsync"
+	"google.golang.org/grpc/internal/pretty"
 	iresolver "google.golang.org/grpc/internal/resolver"
 	"google.golang.org/grpc/internal/transport"
 	"google.golang.org/grpc/keepalive"
@@ -69,6 +69,9 @@ var (
 	errConnDrain = errors.New("grpc: the connection is drained")
 	// errConnClosing indicates that the connection is closing.
 	errConnClosing = errors.New("grpc: the connection is closing")
+	// errConnIdling indicates the the connection is being closed as the channel
+	// is moving to an idle mode due to inactivity.
+	errConnIdling = errors.New("grpc: the connection is closing due to channel idleness")
 	// invalidDefaultServiceConfigErrPrefix is used to prefix the json parsing error for the default
 	// service config.
 	invalidDefaultServiceConfigErrPrefix = "grpc: the provided default service config is invalid"
@@ -134,20 +137,42 @@ func (dcs *defaultConfigSelector) SelectConfig(rpcInfo iresolver.RPCInfo) (*ires
 // e.g. to use dns resolver, a "dns:///" prefix should be applied to the target.
 func DialContext(ctx context.Context, target string, opts ...DialOption) (conn *ClientConn, err error) {
 	cc := &ClientConn{
-		target:            target,
-		csMgr:             &connectivityStateManager{},
-		conns:             make(map[*addrConn]struct{}),
-		dopts:             defaultDialOptions(),
-		blockingpicker:    newPickerWrapper(),
-		czData:            new(channelzData),
-		firstResolveEvent: grpcsync.NewEvent(),
-	}
+		target: target,
+		csMgr:  &connectivityStateManager{},
+		conns:  make(map[*addrConn]struct{}),
+		dopts:  defaultDialOptions(),
+		czData: new(channelzData),
+	}
+
+	// We start the channel off in idle mode, but kick it out of idle at the end
+	// of this method, instead of waiting for the first RPC. Other gRPC
+	// implementations do wait for the first RPC to kick the channel out of
+	// idle. But doing so would be a major behavior change for our users who are
+	// used to seeing the channel active after Dial.
+	//
+	// Taking this approach of kicking it out of idle at the end of this method
+	// allows us to share the code between channel creation and exiting idle
+	// mode. This will also make it easy for us to switch to starting the
+	// channel off in idle, if at all we ever get to do that.
+	cc.idlenessState = ccIdlenessStateIdle
+
 	cc.retryThrottler.Store((*retryThrottler)(nil))
 	cc.safeConfigSelector.UpdateConfigSelector(&defaultConfigSelector{nil})
 	cc.ctx, cc.cancel = context.WithCancel(context.Background())
+	cc.exitIdleCond = sync.NewCond(&cc.mu)
 
-	for _, opt := range extraDialOptions {
-		opt.apply(&cc.dopts)
+	disableGlobalOpts := false
+	for _, opt := range opts {
+		if _, ok := opt.(*disableGlobalDialOptions); ok {
+			disableGlobalOpts = true
+			break
+		}
+	}
+
+	if !disableGlobalOpts {
+		for _, opt := range globalDialOptions {
+			opt.apply(&cc.dopts)
+		}
 	}
 
 	for _, opt := range opts {
@@ -163,40 +188,11 @@ func DialContext(ctx context.Context, target string, opts ...DialOption) (conn *
 		}
 	}()
 
-	pid := cc.dopts.channelzParentID
-	cc.channelzID = channelz.RegisterChannel(&channelzChannel{cc}, pid, target)
-	ted := &channelz.TraceEventDesc{
-		Desc:     "Channel created",
-		Severity: channelz.CtInfo,
-	}
-	if cc.dopts.channelzParentID != nil {
-		ted.Parent = &channelz.TraceEventDesc{
-			Desc:     fmt.Sprintf("Nested Channel(id:%d) created", cc.channelzID.Int()),
-			Severity: channelz.CtInfo,
-		}
-	}
-	channelz.AddTraceEvent(logger, cc.channelzID, 1, ted)
-	cc.csMgr.channelzID = cc.channelzID
+	// Register ClientConn with channelz.
+	cc.channelzRegistration(target)
 
-	if cc.dopts.copts.TransportCredentials == nil && cc.dopts.copts.CredsBundle == nil {
-		return nil, errNoTransportSecurity
-	}
-	if cc.dopts.copts.TransportCredentials != nil && cc.dopts.copts.CredsBundle != nil {
-		return nil, errTransportCredsAndBundle
-	}
-	if cc.dopts.copts.CredsBundle != nil && cc.dopts.copts.CredsBundle.TransportCredentials() == nil {
-		return nil, errNoTransportCredsInBundle
-	}
-	transportCreds := cc.dopts.copts.TransportCredentials
-	if transportCreds == nil {
-		transportCreds = cc.dopts.copts.CredsBundle.TransportCredentials()
-	}
-	if transportCreds.Info().SecurityProtocol == "insecure" {
-		for _, cd := range cc.dopts.copts.PerRPCCredentials {
-			if cd.RequireTransportSecurity() {
-				return nil, errTransportCredentialsMissing
-			}
-		}
+	if err := cc.validateTransportCredentials(); err != nil {
+		return nil, err
 	}
 
 	if cc.dopts.defaultServiceConfigRawJSON != nil {
@@ -234,35 +230,19 @@ func DialContext(ctx context.Context, target string, opts ...DialOption) (conn *
 		}
 	}()
 
-	scSet := false
-	if cc.dopts.scChan != nil {
-		// Try to get an initial service config.
-		select {
-		case sc, ok := <-cc.dopts.scChan:
-			if ok {
-				cc.sc = &sc
-				cc.safeConfigSelector.UpdateConfigSelector(&defaultConfigSelector{&sc})
-				scSet = true
-			}
-		default:
-		}
-	}
 	if cc.dopts.bs == nil {
 		cc.dopts.bs = backoff.DefaultExponential
 	}
 
 	// Determine the resolver to use.
-	resolverBuilder, err := cc.parseTargetAndFindResolver()
-	if err != nil {
+	if err := cc.parseTargetAndFindResolver(); err != nil {
 		return nil, err
 	}
-	cc.authority, err = determineAuthority(cc.parsedTarget.Endpoint, cc.target, cc.dopts)
-	if err != nil {
+	if err = cc.determineAuthority(); err != nil {
 		return nil, err
 	}
-	channelz.Infof(logger, cc.channelzID, "Channel authority set to %q", cc.authority)
 
-	if cc.dopts.scChan != nil && !scSet {
+	if cc.dopts.scChan != nil {
 		// Blocking wait for the initial service config.
 		select {
 		case sc, ok := <-cc.dopts.scChan:
@@ -278,57 +258,224 @@ func DialContext(ctx context.Context, target string, opts ...DialOption) (conn *
 		go cc.scWatcher()
 	}
 
+	// This creates the name resolver, load balancer, blocking picker etc.
+	if err := cc.exitIdleMode(); err != nil {
+		return nil, err
+	}
+
+	// Configure idleness support with configured idle timeout or default idle
+	// timeout duration. Idleness can be explicitly disabled by the user, by
+	// setting the dial option to 0.
+	cc.idlenessMgr = newIdlenessManager(cc, cc.dopts.idleTimeout)
+
+	// Return early for non-blocking dials.
+	if !cc.dopts.block {
+		return cc, nil
+	}
+
+	// A blocking dial blocks until the clientConn is ready.
+	for {
+		s := cc.GetState()
+		if s == connectivity.Idle {
+			cc.Connect()
+		}
+		if s == connectivity.Ready {
+			return cc, nil
+		} else if cc.dopts.copts.FailOnNonTempDialError && s == connectivity.TransientFailure {
+			if err = cc.connectionError(); err != nil {
+				terr, ok := err.(interface {
+					Temporary() bool
+				})
+				if ok && !terr.Temporary() {
+					return nil, err
+				}
+			}
+		}
+		if !cc.WaitForStateChange(ctx, s) {
+			// ctx got timeout or canceled.
+			if err = cc.connectionError(); err != nil && cc.dopts.returnLastError {
+				return nil, err
+			}
+			return nil, ctx.Err()
+		}
+	}
+}
+
+// addTraceEvent is a helper method to add a trace event on the channel. If the
+// channel is a nested one, the same event is also added on the parent channel.
+func (cc *ClientConn) addTraceEvent(msg string) {
+	ted := &channelz.TraceEventDesc{
+		Desc:     fmt.Sprintf("Channel %s", msg),
+		Severity: channelz.CtInfo,
+	}
+	if cc.dopts.channelzParentID != nil {
+		ted.Parent = &channelz.TraceEventDesc{
+			Desc:     fmt.Sprintf("Nested channel(id:%d) %s", cc.channelzID.Int(), msg),
+			Severity: channelz.CtInfo,
+		}
+	}
+	channelz.AddTraceEvent(logger, cc.channelzID, 0, ted)
+}
+
+// exitIdleMode moves the channel out of idle mode by recreating the name
+// resolver and load balancer.
+func (cc *ClientConn) exitIdleMode() error {
+	cc.mu.Lock()
+	if cc.conns == nil {
+		cc.mu.Unlock()
+		return errConnClosing
+	}
+	if cc.idlenessState != ccIdlenessStateIdle {
+		cc.mu.Unlock()
+		logger.Info("ClientConn asked to exit idle mode when not in idle mode")
+		return nil
+	}
+
+	defer func() {
+		// When Close() and exitIdleMode() race against each other, one of the
+		// following two can happen:
+		// - Close() wins the race and runs first. exitIdleMode() runs after, and
+		//   sees that the ClientConn is already closed and hence returns early.
+		// - exitIdleMode() wins the race and runs first and recreates the balancer
+		//   and releases the lock before recreating the resolver. If Close() runs
+		//   in this window, it will wait for exitIdleMode to complete.
+		//
+		// We achieve this synchronization using the below condition variable.
+		cc.mu.Lock()
+		cc.idlenessState = ccIdlenessStateActive
+		cc.exitIdleCond.Signal()
+		cc.mu.Unlock()
+	}()
+
+	cc.idlenessState = ccIdlenessStateExitingIdle
+	exitedIdle := false
+	if cc.blockingpicker == nil {
+		cc.blockingpicker = newPickerWrapper()
+	} else {
+		cc.blockingpicker.exitIdleMode()
+		exitedIdle = true
+	}
+
 	var credsClone credentials.TransportCredentials
 	if creds := cc.dopts.copts.TransportCredentials; creds != nil {
 		credsClone = creds.Clone()
 	}
-	cc.balancerWrapper = newCCBalancerWrapper(cc, balancer.BuildOptions{
-		DialCreds:        credsClone,
-		CredsBundle:      cc.dopts.copts.CredsBundle,
-		Dialer:           cc.dopts.copts.Dialer,
-		Authority:        cc.authority,
-		CustomUserAgent:  cc.dopts.copts.UserAgent,
-		ChannelzParentID: cc.channelzID,
-		Target:           cc.parsedTarget,
-	})
+	if cc.balancerWrapper == nil {
+		cc.balancerWrapper = newCCBalancerWrapper(cc, balancer.BuildOptions{
+			DialCreds:        credsClone,
+			CredsBundle:      cc.dopts.copts.CredsBundle,
+			Dialer:           cc.dopts.copts.Dialer,
+			Authority:        cc.authority,
+			CustomUserAgent:  cc.dopts.copts.UserAgent,
+			ChannelzParentID: cc.channelzID,
+			Target:           cc.parsedTarget,
+		})
+	} else {
+		cc.balancerWrapper.exitIdleMode()
+	}
+	cc.firstResolveEvent = grpcsync.NewEvent()
+	cc.mu.Unlock()
 
-	// Build the resolver.
-	rWrapper, err := newCCResolverWrapper(cc, resolverBuilder)
-	if err != nil {
-		return nil, fmt.Errorf("failed to build resolver: %v", err)
+	// This needs to be called without cc.mu because this builds a new resolver
+	// which might update state or report error inline which needs to be handled
+	// by cc.updateResolverState() which also grabs cc.mu.
+	if err := cc.initResolverWrapper(credsClone); err != nil {
+		return err
+	}
+
+	if exitedIdle {
+		cc.addTraceEvent("exiting idle mode")
 	}
+	return nil
+}
+
+// enterIdleMode puts the channel in idle mode, and as part of it shuts down the
+// name resolver, load balancer and any subchannels.
+func (cc *ClientConn) enterIdleMode() error {
 	cc.mu.Lock()
-	cc.resolverWrapper = rWrapper
+	if cc.conns == nil {
+		cc.mu.Unlock()
+		return ErrClientConnClosing
+	}
+	if cc.idlenessState != ccIdlenessStateActive {
+		logger.Error("ClientConn asked to enter idle mode when not active")
+		return nil
+	}
+
+	// cc.conns == nil is a proxy for the ClientConn being closed. So, instead
+	// of setting it to nil here, we recreate the map. This also means that we
+	// don't have to do this when exiting idle mode.
+	conns := cc.conns
+	cc.conns = make(map[*addrConn]struct{})
+
+	// TODO: Currently, we close the resolver wrapper upon entering idle mode
+	// and create a new one upon exiting idle mode. This means that the
+	// `cc.resolverWrapper` field would be overwritten everytime we exit idle
+	// mode. While this means that we need to hold `cc.mu` when accessing
+	// `cc.resolverWrapper`, it makes the code simpler in the wrapper. We should
+	// try to do the same for the balancer and picker wrappers too.
+	cc.resolverWrapper.close()
+	cc.blockingpicker.enterIdleMode()
+	cc.balancerWrapper.enterIdleMode()
+	cc.csMgr.updateState(connectivity.Idle)
+	cc.idlenessState = ccIdlenessStateIdle
 	cc.mu.Unlock()
 
-	// A blocking dial blocks until the clientConn is ready.
-	if cc.dopts.block {
-		for {
-			cc.Connect()
-			s := cc.GetState()
-			if s == connectivity.Ready {
-				break
-			} else if cc.dopts.copts.FailOnNonTempDialError && s == connectivity.TransientFailure {
-				if err = cc.connectionError(); err != nil {
-					terr, ok := err.(interface {
-						Temporary() bool
-					})
-					if ok && !terr.Temporary() {
-						return nil, err
-					}
-				}
-			}
-			if !cc.WaitForStateChange(ctx, s) {
-				// ctx got timeout or canceled.
-				if err = cc.connectionError(); err != nil && cc.dopts.returnLastError {
-					return nil, err
-				}
-				return nil, ctx.Err()
+	go func() {
+		cc.addTraceEvent("entering idle mode")
+		for ac := range conns {
+			ac.tearDown(errConnIdling)
+		}
+	}()
+	return nil
+}
+
+// validateTransportCredentials performs a series of checks on the configured
+// transport credentials. It returns a non-nil error if any of these conditions
+// are met:
+//   - no transport creds and no creds bundle is configured
+//   - both transport creds and creds bundle are configured
+//   - creds bundle is configured, but it lacks a transport credentials
+//   - insecure transport creds configured alongside call creds that require
+//     transport level security
+//
+// If none of the above conditions are met, the configured credentials are
+// deemed valid and a nil error is returned.
+func (cc *ClientConn) validateTransportCredentials() error {
+	if cc.dopts.copts.TransportCredentials == nil && cc.dopts.copts.CredsBundle == nil {
+		return errNoTransportSecurity
+	}
+	if cc.dopts.copts.TransportCredentials != nil && cc.dopts.copts.CredsBundle != nil {
+		return errTransportCredsAndBundle
+	}
+	if cc.dopts.copts.CredsBundle != nil && cc.dopts.copts.CredsBundle.TransportCredentials() == nil {
+		return errNoTransportCredsInBundle
+	}
+	transportCreds := cc.dopts.copts.TransportCredentials
+	if transportCreds == nil {
+		transportCreds = cc.dopts.copts.CredsBundle.TransportCredentials()
+	}
+	if transportCreds.Info().SecurityProtocol == "insecure" {
+		for _, cd := range cc.dopts.copts.PerRPCCredentials {
+			if cd.RequireTransportSecurity() {
+				return errTransportCredentialsMissing
 			}
 		}
 	}
+	return nil
+}
 
-	return cc, nil
+// channelzRegistration registers the newly created ClientConn with channelz and
+// stores the returned identifier in `cc.channelzID` and `cc.csMgr.channelzID`.
+// A channelz trace event is emitted for ClientConn creation. If the newly
+// created ClientConn is a nested one, i.e a valid parent ClientConn ID is
+// specified via a dial option, the trace event is also added to the parent.
+//
+// Doesn't grab cc.mu as this method is expected to be called only at Dial time.
+func (cc *ClientConn) channelzRegistration(target string) {
+	cc.channelzID = channelz.RegisterChannel(&channelzChannel{cc}, cc.dopts.channelzParentID, target)
+	cc.addTraceEvent("created")
+	cc.csMgr.channelzID = cc.channelzID
 }
 
 // chainUnaryClientInterceptors chains all unary client interceptors into one.
@@ -474,7 +621,9 @@ type ClientConn struct {
 	authority       string               // See determineAuthority().
 	dopts           dialOptions          // Default and user specified dial options.
 	channelzID      *channelz.Identifier // Channelz identifier for the channel.
+	resolverBuilder resolver.Builder     // See parseTargetAndFindResolver().
 	balancerWrapper *ccBalancerWrapper   // Uses gracefulswitch.balancer underneath.
+	idlenessMgr     idlenessManager
 
 	// The following provide their own synchronization, and therefore don't
 	// require cc.mu to be held to access them.
@@ -495,11 +644,31 @@ type ClientConn struct {
 	sc              *ServiceConfig             // Latest service config received from the resolver.
 	conns           map[*addrConn]struct{}     // Set to nil on close.
 	mkp             keepalive.ClientParameters // May be updated upon receipt of a GoAway.
+	idlenessState   ccIdlenessState            // Tracks idleness state of the channel.
+	exitIdleCond    *sync.Cond                 // Signalled when channel exits idle.
 
 	lceMu               sync.Mutex // protects lastConnectionError
 	lastConnectionError error
 }
 
+// ccIdlenessState tracks the idleness state of the channel.
+//
+// Channels start off in `active` and move to `idle` after a period of
+// inactivity. When moving back to `active` upon an incoming RPC, they
+// transition through `exiting_idle`. This state is useful for synchronization
+// with Close().
+//
+// This state tracking is mostly for self-protection. The idlenessManager is
+// expected to keep track of the state as well, and is expected not to call into
+// the ClientConn unnecessarily.
+type ccIdlenessState int8
+
+const (
+	ccIdlenessStateActive ccIdlenessState = iota
+	ccIdlenessStateIdle
+	ccIdlenessStateExitingIdle
+)
+
 // WaitForStateChange waits until the connectivity.State of ClientConn changes from sourceState or
 // ctx expires. A true value is returned in former case and false in latter.
 //
@@ -539,7 +708,10 @@ func (cc *ClientConn) GetState() connectivity.State {
 // Notice: This API is EXPERIMENTAL and may be changed or removed in a later
 // release.
 func (cc *ClientConn) Connect() {
-	cc.balancerWrapper.exitIdle()
+	cc.exitIdleMode()
+	// If the ClientConn was not in idle mode, we need to call ExitIdle on the
+	// LB policy so that connections can be created.
+	cc.balancerWrapper.exitIdleMode()
 }
 
 func (cc *ClientConn) scWatcher() {
@@ -696,6 +868,20 @@ func (cc *ClientConn) handleSubConnStateChange(sc balancer.SubConn, s connectivi
 	cc.balancerWrapper.updateSubConnState(sc, s, err)
 }
 
+// Makes a copy of the input addresses slice and clears out the balancer
+// attributes field. Addresses are passed during subconn creation and address
+// update operations. In both cases, we will clear the balancer attributes by
+// calling this function, and therefore we will be able to use the Equal method
+// provided by the resolver.Address type for comparison.
+func copyAddressesWithoutBalancerAttributes(in []resolver.Address) []resolver.Address {
+	out := make([]resolver.Address, len(in))
+	for i := range in {
+		out[i] = in[i]
+		out[i].BalancerAttributes = nil
+	}
+	return out
+}
+
 // newAddrConn creates an addrConn for addrs and adds it to cc.conns.
 //
 // Caller needs to make sure len(addrs) > 0.
@@ -703,11 +889,12 @@ func (cc *ClientConn) newAddrConn(addrs []resolver.Address, opts balancer.NewSub
 	ac := &addrConn{
 		state:        connectivity.Idle,
 		cc:           cc,
-		addrs:        addrs,
+		addrs:        copyAddressesWithoutBalancerAttributes(addrs),
 		scopts:       opts,
 		dopts:        cc.dopts,
 		czData:       new(channelzData),
 		resetBackoff: make(chan struct{}),
+		stateChan:    make(chan struct{}),
 	}
 	ac.ctx, ac.cancel = context.WithCancel(cc.ctx)
 	// Track ac in cc. This needs to be done before any getTransport(...) is called.
@@ -788,16 +975,19 @@ func (cc *ClientConn) incrCallsFailed() {
 func (ac *addrConn) connect() error {
 	ac.mu.Lock()
 	if ac.state == connectivity.Shutdown {
+		if logger.V(2) {
+			logger.Infof("connect called on shutdown addrConn; ignoring.")
+		}
 		ac.mu.Unlock()
 		return errConnClosing
 	}
 	if ac.state != connectivity.Idle {
+		if logger.V(2) {
+			logger.Infof("connect called on addrConn in non-idle state (%v); ignoring.", ac.state)
+		}
 		ac.mu.Unlock()
 		return nil
 	}
-	// Update connectivity state within the lock to prevent subsequent or
-	// concurrent calls from resetting the transport more than once.
-	ac.updateConnectivityState(connectivity.Connecting, nil)
 	ac.mu.Unlock()
 
 	ac.resetTransport()
@@ -816,58 +1006,63 @@ func equalAddresses(a, b []resolver.Address) bool {
 	return true
 }
 
-// tryUpdateAddrs tries to update ac.addrs with the new addresses list.
-//
-// If ac is TransientFailure, it updates ac.addrs and returns true. The updated
-// addresses will be picked up by retry in the next iteration after backoff.
-//
-// If ac is Shutdown or Idle, it updates ac.addrs and returns true.
-//
-// If the addresses is the same as the old list, it does nothing and returns
-// true.
-//
-// If ac is Connecting, it returns false. The caller should tear down the ac and
-// create a new one. Note that the backoff will be reset when this happens.
-//
-// If ac is Ready, it checks whether current connected address of ac is in the
-// new addrs list.
-//   - If true, it updates ac.addrs and returns true. The ac will keep using
-//     the existing connection.
-//   - If false, it does nothing and returns false.
-func (ac *addrConn) tryUpdateAddrs(addrs []resolver.Address) bool {
+// updateAddrs updates ac.addrs with the new addresses list and handles active
+// connections or connection attempts.
+func (ac *addrConn) updateAddrs(addrs []resolver.Address) {
 	ac.mu.Lock()
-	defer ac.mu.Unlock()
-	channelz.Infof(logger, ac.channelzID, "addrConn: tryUpdateAddrs curAddr: %v, addrs: %v", ac.curAddr, addrs)
+	channelz.Infof(logger, ac.channelzID, "addrConn: updateAddrs curAddr: %v, addrs: %v", pretty.ToJSON(ac.curAddr), pretty.ToJSON(addrs))
+
+	addrs = copyAddressesWithoutBalancerAttributes(addrs)
+	if equalAddresses(ac.addrs, addrs) {
+		ac.mu.Unlock()
+		return
+	}
+
+	ac.addrs = addrs
+
 	if ac.state == connectivity.Shutdown ||
 		ac.state == connectivity.TransientFailure ||
 		ac.state == connectivity.Idle {
-		ac.addrs = addrs
-		return true
+		// We were not connecting, so do nothing but update the addresses.
+		ac.mu.Unlock()
+		return
 	}
 
-	if equalAddresses(ac.addrs, addrs) {
-		return true
+	if ac.state == connectivity.Ready {
+		// Try to find the connected address.
+		for _, a := range addrs {
+			a.ServerName = ac.cc.getServerName(a)
+			if a.Equal(ac.curAddr) {
+				// We are connected to a valid address, so do nothing but
+				// update the addresses.
+				ac.mu.Unlock()
+				return
+			}
+		}
 	}
 
-	if ac.state == connectivity.Connecting {
-		return false
-	}
+	// We are either connected to the wrong address or currently connecting.
+	// Stop the current iteration and restart.
 
-	// ac.state is Ready, try to find the connected address.
-	var curAddrFound bool
-	for _, a := range addrs {
-		a.ServerName = ac.cc.getServerName(a)
-		if reflect.DeepEqual(ac.curAddr, a) {
-			curAddrFound = true
-			break
-		}
+	ac.cancel()
+	ac.ctx, ac.cancel = context.WithCancel(ac.cc.ctx)
+
+	// We have to defer here because GracefulClose => Close => onClose, which
+	// requires locking ac.mu.
+	if ac.transport != nil {
+		defer ac.transport.GracefulClose()
+		ac.transport = nil
 	}
-	channelz.Infof(logger, ac.channelzID, "addrConn: tryUpdateAddrs curAddrFound: %v", curAddrFound)
-	if curAddrFound {
-		ac.addrs = addrs
+
+	if len(addrs) == 0 {
+		ac.updateConnectivityState(connectivity.Idle, nil)
 	}
 
-	return curAddrFound
+	ac.mu.Unlock()
+
+	// Since we were connecting/connected, we should start a new connection
+	// attempt.
+	go ac.resetTransport()
 }
 
 // getServerName determines the serverName to be used in the connection
@@ -928,7 +1123,7 @@ func (cc *ClientConn) healthCheckConfig() *healthCheckConfig {
 	return cc.sc.healthCheckConfig
 }
 
-func (cc *ClientConn) getTransport(ctx context.Context, failfast bool, method string) (transport.ClientTransport, func(balancer.DoneInfo), error) {
+func (cc *ClientConn) getTransport(ctx context.Context, failfast bool, method string) (transport.ClientTransport, balancer.PickResult, error) {
 	return cc.blockingpicker.pick(ctx, failfast, balancer.PickInfo{
 		Ctx:            ctx,
 		FullMethodName: method,
@@ -1020,39 +1215,40 @@ func (cc *ClientConn) Close() error {
 		cc.mu.Unlock()
 		return ErrClientConnClosing
 	}
+
+	for cc.idlenessState == ccIdlenessStateExitingIdle {
+		cc.exitIdleCond.Wait()
+	}
+
 	conns := cc.conns
 	cc.conns = nil
 	cc.csMgr.updateState(connectivity.Shutdown)
 
+	pWrapper := cc.blockingpicker
 	rWrapper := cc.resolverWrapper
-	cc.resolverWrapper = nil
 	bWrapper := cc.balancerWrapper
+	idlenessMgr := cc.idlenessMgr
 	cc.mu.Unlock()
 
 	// The order of closing matters here since the balancer wrapper assumes the
 	// picker is closed before it is closed.
-	cc.blockingpicker.close()
+	if pWrapper != nil {
+		pWrapper.close()
+	}
 	if bWrapper != nil {
 		bWrapper.close()
 	}
 	if rWrapper != nil {
 		rWrapper.close()
 	}
+	if idlenessMgr != nil {
+		idlenessMgr.close()
+	}
 
 	for ac := range conns {
 		ac.tearDown(ErrClientConnClosing)
 	}
-	ted := &channelz.TraceEventDesc{
-		Desc:     "Channel deleted",
-		Severity: channelz.CtInfo,
-	}
-	if cc.dopts.channelzParentID != nil {
-		ted.Parent = &channelz.TraceEventDesc{
-			Desc:     fmt.Sprintf("Nested channel(id:%d) deleted", cc.channelzID.Int()),
-			Severity: channelz.CtInfo,
-		}
-	}
-	channelz.AddTraceEvent(logger, cc.channelzID, 0, ted)
+	cc.addTraceEvent("deleted")
 	// TraceEvent needs to be called before RemoveEntry, as TraceEvent may add
 	// trace reference to the entity being deleted, and thus prevent it from being
 	// deleted right away.
@@ -1082,7 +1278,8 @@ type addrConn struct {
 	addrs   []resolver.Address // All addresses that the resolver resolved to.
 
 	// Use updateConnectivityState for updating addrConn's connectivity state.
-	state connectivity.State
+	state     connectivity.State
+	stateChan chan struct{} // closed and recreated on every state change.
 
 	backoffIdx   int // Needs to be stateful for resetConnectBackoff.
 	resetBackoff chan struct{}
@@ -1096,8 +1293,15 @@ func (ac *addrConn) updateConnectivityState(s connectivity.State, lastErr error)
 	if ac.state == s {
 		return
 	}
+	// When changing states, reset the state change channel.
+	close(ac.stateChan)
+	ac.stateChan = make(chan struct{})
 	ac.state = s
-	channelz.Infof(logger, ac.channelzID, "Subchannel Connectivity change to %v", s)
+	if lastErr == nil {
+		channelz.Infof(logger, ac.channelzID, "Subchannel Connectivity change to %v", s)
+	} else {
+		channelz.Infof(logger, ac.channelzID, "Subchannel Connectivity change to %v, last error: %s", s, lastErr)
+	}
 	ac.cc.handleSubConnStateChange(ac.acbw, s, lastErr)
 }
 
@@ -1117,7 +1321,8 @@ func (ac *addrConn) adjustParams(r transport.GoAwayReason) {
 
 func (ac *addrConn) resetTransport() {
 	ac.mu.Lock()
-	if ac.state == connectivity.Shutdown {
+	acCtx := ac.ctx
+	if acCtx.Err() != nil {
 		ac.mu.Unlock()
 		return
 	}
@@ -1145,15 +1350,14 @@ func (ac *addrConn) resetTransport() {
 	ac.updateConnectivityState(connectivity.Connecting, nil)
 	ac.mu.Unlock()
 
-	if err := ac.tryAllAddrs(addrs, connectDeadline); err != nil {
+	if err := ac.tryAllAddrs(acCtx, addrs, connectDeadline); err != nil {
 		ac.cc.resolveNow(resolver.ResolveNowOptions{})
 		// After exhausting all addresses, the addrConn enters
 		// TRANSIENT_FAILURE.
-		ac.mu.Lock()
-		if ac.state == connectivity.Shutdown {
-			ac.mu.Unlock()
+		if acCtx.Err() != nil {
 			return
 		}
+		ac.mu.Lock()
 		ac.updateConnectivityState(connectivity.TransientFailure, err)
 
 		// Backoff.
@@ -1168,13 +1372,13 @@ func (ac *addrConn) resetTransport() {
 			ac.mu.Unlock()
 		case <-b:
 			timer.Stop()
-		case <-ac.ctx.Done():
+		case <-acCtx.Done():
 			timer.Stop()
 			return
 		}
 
 		ac.mu.Lock()
-		if ac.state != connectivity.Shutdown {
+		if acCtx.Err() == nil {
 			ac.updateConnectivityState(connectivity.Idle, err)
 		}
 		ac.mu.Unlock()
@@ -1189,14 +1393,13 @@ func (ac *addrConn) resetTransport() {
 // tryAllAddrs tries to creates a connection to the addresses, and stop when at
 // the first successful one. It returns an error if no address was successfully
 // connected, or updates ac appropriately with the new transport.
-func (ac *addrConn) tryAllAddrs(addrs []resolver.Address, connectDeadline time.Time) error {
+func (ac *addrConn) tryAllAddrs(ctx context.Context, addrs []resolver.Address, connectDeadline time.Time) error {
 	var firstConnErr error
 	for _, addr := range addrs {
-		ac.mu.Lock()
-		if ac.state == connectivity.Shutdown {
-			ac.mu.Unlock()
+		if ctx.Err() != nil {
 			return errConnClosing
 		}
+		ac.mu.Lock()
 
 		ac.cc.mu.RLock()
 		ac.dopts.copts.KeepaliveParams = ac.cc.mkp
@@ -1210,7 +1413,7 @@ func (ac *addrConn) tryAllAddrs(addrs []resolver.Address, connectDeadline time.T
 
 		channelz.Infof(logger, ac.channelzID, "Subchannel picks a new address %q to connect", addr.Addr)
 
-		err := ac.createTransport(addr, copts, connectDeadline)
+		err := ac.createTransport(ctx, addr, copts, connectDeadline)
 		if err == nil {
 			return nil
 		}
@@ -1227,17 +1430,20 @@ func (ac *addrConn) tryAllAddrs(addrs []resolver.Address, connectDeadline time.T
 // createTransport creates a connection to addr. It returns an error if the
 // address was not successfully connected, or updates ac appropriately with the
 // new transport.
-func (ac *addrConn) createTransport(addr resolver.Address, copts transport.ConnectOptions, connectDeadline time.Time) error {
+func (ac *addrConn) createTransport(ctx context.Context, addr resolver.Address, copts transport.ConnectOptions, connectDeadline time.Time) error {
 	addr.ServerName = ac.cc.getServerName(addr)
-	hctx, hcancel := context.WithCancel(ac.ctx)
+	hctx, hcancel := context.WithCancel(ctx)
 
-	onClose := grpcsync.OnceFunc(func() {
+	onClose := func(r transport.GoAwayReason) {
 		ac.mu.Lock()
 		defer ac.mu.Unlock()
-		if ac.state == connectivity.Shutdown {
-			// Already shut down.  tearDown() already cleared the transport and
-			// canceled hctx via ac.ctx, and we expected this connection to be
-			// closed, so do nothing here.
+		// adjust params based on GoAwayReason
+		ac.adjustParams(r)
+		if ctx.Err() != nil {
+			// Already shut down or connection attempt canceled.  tearDown() or
+			// updateAddrs() already cleared the transport and canceled hctx
+			// via ac.ctx, and we expected this connection to be closed, so do
+			// nothing here.
 			return
 		}
 		hcancel()
@@ -1254,20 +1460,17 @@ func (ac *addrConn) createTransport(addr resolver.Address, copts transport.Conne
 		// Always go idle and wait for the LB policy to initiate a new
 		// connection attempt.
 		ac.updateConnectivityState(connectivity.Idle, nil)
-	})
-	onGoAway := func(r transport.GoAwayReason) {
-		ac.mu.Lock()
-		ac.adjustParams(r)
-		ac.mu.Unlock()
-		onClose()
 	}
 
-	connectCtx, cancel := context.WithDeadline(ac.ctx, connectDeadline)
+	connectCtx, cancel := context.WithDeadline(ctx, connectDeadline)
 	defer cancel()
 	copts.ChannelzParentID = ac.channelzID
 
-	newTr, err := transport.NewClientTransport(connectCtx, ac.cc.ctx, addr, copts, onGoAway, onClose)
+	newTr, err := transport.NewClientTransport(connectCtx, ac.cc.ctx, addr, copts, onClose)
 	if err != nil {
+		if logger.V(2) {
+			logger.Infof("Creating new client transport to %q: %v", addr, err)
+		}
 		// newTr is either nil, or closed.
 		hcancel()
 		channelz.Warningf(logger, ac.channelzID, "grpc: addrConn.createTransport failed to connect to %s. Err: %v", addr, err)
@@ -1276,7 +1479,7 @@ func (ac *addrConn) createTransport(addr resolver.Address, copts transport.Conne
 
 	ac.mu.Lock()
 	defer ac.mu.Unlock()
-	if ac.state == connectivity.Shutdown {
+	if ctx.Err() != nil {
 		// This can happen if the subConn was removed while in `Connecting`
 		// state. tearDown() would have set the state to `Shutdown`, but
 		// would not have closed the transport since ac.transport would not
@@ -1288,6 +1491,9 @@ func (ac *addrConn) createTransport(addr resolver.Address, copts transport.Conne
 		// The error we pass to Close() is immaterial since there are no open
 		// streams at this point, so no trailers with error details will be sent
 		// out. We just need to pass a non-nil error.
+		//
+		// This can also happen when updateAddrs is called during a connection
+		// attempt.
 		go newTr.Close(transport.ErrConnClosing)
 		return nil
 	}
@@ -1371,7 +1577,7 @@ func (ac *addrConn) startHealthCheck(ctx context.Context) {
 			if status.Code(err) == codes.Unimplemented {
 				channelz.Error(logger, ac.channelzID, "Subchannel health check is unimplemented at server side, thus health check is disabled")
 			} else {
-				channelz.Errorf(logger, ac.channelzID, "HealthCheckFunc exits with unexpected error %v", err)
+				channelz.Errorf(logger, ac.channelzID, "Health checking failed: %v", err)
 			}
 		}
 	}()
@@ -1395,6 +1601,29 @@ func (ac *addrConn) getReadyTransport() transport.ClientTransport {
 	return nil
 }
 
+// getTransport waits until the addrconn is ready and returns the transport.
+// If the context expires first, returns an appropriate status.  If the
+// addrConn is stopped first, returns an Unavailable status error.
+func (ac *addrConn) getTransport(ctx context.Context) (transport.ClientTransport, error) {
+	for ctx.Err() == nil {
+		ac.mu.Lock()
+		t, state, sc := ac.transport, ac.state, ac.stateChan
+		ac.mu.Unlock()
+		if state == connectivity.Ready {
+			return t, nil
+		}
+		if state == connectivity.Shutdown {
+			return nil, status.Errorf(codes.Unavailable, "SubConn shutting down")
+		}
+
+		select {
+		case <-ctx.Done():
+		case <-sc:
+		}
+	}
+	return nil, status.FromContextError(ctx.Err()).Err()
+}
+
 // tearDown starts to tear down the addrConn.
 //
 // Note that tearDown doesn't remove ac from ac.cc.conns, so the addrConn struct
@@ -1522,6 +1751,9 @@ func (c *channelzChannel) ChannelzMetric() *channelz.ChannelInternalMetric {
 // referenced by users.
 var ErrClientConnTimeout = errors.New("grpc: timed out when dialing")
 
+// getResolver finds the scheme in the cc's resolvers or the global registry.
+// scheme should always be lowercase (typically by virtue of url.Parse()
+// performing proper RFC3986 behavior).
 func (cc *ClientConn) getResolver(scheme string) resolver.Builder {
 	for _, rb := range cc.dopts.resolvers {
 		if scheme == rb.Scheme() {
@@ -1543,7 +1775,14 @@ func (cc *ClientConn) connectionError() error {
 	return cc.lastConnectionError
 }
 
-func (cc *ClientConn) parseTargetAndFindResolver() (resolver.Builder, error) {
+// parseTargetAndFindResolver parses the user's dial target and stores the
+// parsed target in `cc.parsedTarget`.
+//
+// The resolver to use is determined based on the scheme in the parsed target
+// and the same is stored in `cc.resolverBuilder`.
+//
+// Doesn't grab cc.mu as this method is expected to be called only at Dial time.
+func (cc *ClientConn) parseTargetAndFindResolver() error {
 	channelz.Infof(logger, cc.channelzID, "original dial target is: %q", cc.target)
 
 	var rb resolver.Builder
@@ -1555,7 +1794,8 @@ func (cc *ClientConn) parseTargetAndFindResolver() (resolver.Builder, error) {
 		rb = cc.getResolver(parsedTarget.URL.Scheme)
 		if rb != nil {
 			cc.parsedTarget = parsedTarget
-			return rb, nil
+			cc.resolverBuilder = rb
+			return nil
 		}
 	}
 
@@ -1570,51 +1810,98 @@ func (cc *ClientConn) parseTargetAndFindResolver() (resolver.Builder, error) {
 	parsedTarget, err = parseTarget(canonicalTarget)
 	if err != nil {
 		channelz.Infof(logger, cc.channelzID, "dial target %q parse failed: %v", canonicalTarget, err)
-		return nil, err
+		return err
 	}
 	channelz.Infof(logger, cc.channelzID, "parsed dial target is: %+v", parsedTarget)
 	rb = cc.getResolver(parsedTarget.URL.Scheme)
 	if rb == nil {
-		return nil, fmt.Errorf("could not get resolver for default scheme: %q", parsedTarget.URL.Scheme)
+		return fmt.Errorf("could not get resolver for default scheme: %q", parsedTarget.URL.Scheme)
 	}
 	cc.parsedTarget = parsedTarget
-	return rb, nil
+	cc.resolverBuilder = rb
+	return nil
 }
 
 // parseTarget uses RFC 3986 semantics to parse the given target into a
-// resolver.Target struct containing scheme, authority and endpoint. Query
-// params are stripped from the endpoint.
+// resolver.Target struct containing url. Query params are stripped from the
+// endpoint.
 func parseTarget(target string) (resolver.Target, error) {
 	u, err := url.Parse(target)
 	if err != nil {
 		return resolver.Target{}, err
 	}
-	// For targets of the form "[scheme]://[authority]/endpoint, the endpoint
-	// value returned from url.Parse() contains a leading "/". Although this is
-	// in accordance with RFC 3986, we do not want to break existing resolver
-	// implementations which expect the endpoint without the leading "/". So, we
-	// end up stripping the leading "/" here. But this will result in an
-	// incorrect parsing for something like "unix:///path/to/socket". Since we
-	// own the "unix" resolver, we can workaround in the unix resolver by using
-	// the `URL` field instead of the `Endpoint` field.
-	endpoint := u.Path
-	if endpoint == "" {
-		endpoint = u.Opaque
-	}
-	endpoint = strings.TrimPrefix(endpoint, "/")
-	return resolver.Target{
-		Scheme:    u.Scheme,
-		Authority: u.Host,
-		Endpoint:  endpoint,
-		URL:       *u,
-	}, nil
+
+	return resolver.Target{URL: *u}, nil
+}
+
+func encodeAuthority(authority string) string {
+	const upperhex = "0123456789ABCDEF"
+
+	// Return for characters that must be escaped as per
+	// Valid chars are mentioned here:
+	// https://datatracker.ietf.org/doc/html/rfc3986#section-3.2
+	shouldEscape := func(c byte) bool {
+		// Alphanum are always allowed.
+		if 'a' <= c && c <= 'z' || 'A' <= c && c <= 'Z' || '0' <= c && c <= '9' {
+			return false
+		}
+		switch c {
+		case '-', '_', '.', '~': // Unreserved characters
+			return false
+		case '!', '$', '&', '\'', '(', ')', '*', '+', ',', ';', '=': // Subdelim characters
+			return false
+		case ':', '[', ']', '@': // Authority related delimeters
+			return false
+		}
+		// Everything else must be escaped.
+		return true
+	}
+
+	hexCount := 0
+	for i := 0; i < len(authority); i++ {
+		c := authority[i]
+		if shouldEscape(c) {
+			hexCount++
+		}
+	}
+
+	if hexCount == 0 {
+		return authority
+	}
+
+	required := len(authority) + 2*hexCount
+	t := make([]byte, required)
+
+	j := 0
+	// This logic is a barebones version of escape in the go net/url library.
+	for i := 0; i < len(authority); i++ {
+		switch c := authority[i]; {
+		case shouldEscape(c):
+			t[j] = '%'
+			t[j+1] = upperhex[c>>4]
+			t[j+2] = upperhex[c&15]
+			j += 3
+		default:
+			t[j] = authority[i]
+			j++
+		}
+	}
+	return string(t)
 }
 
 // Determine channel authority. The order of precedence is as follows:
 // - user specified authority override using `WithAuthority` dial option
 // - creds' notion of server name for the authentication handshake
 // - endpoint from dial target of the form "scheme://[authority]/endpoint"
-func determineAuthority(endpoint, target string, dopts dialOptions) (string, error) {
+//
+// Stores the determined authority in `cc.authority`.
+//
+// Returns a non-nil error if the authority returned by the transport
+// credentials do not match the authority configured through the dial option.
+//
+// Doesn't grab cc.mu as this method is expected to be called only at Dial time.
+func (cc *ClientConn) determineAuthority() error {
+	dopts := cc.dopts
 	// Historically, we had two options for users to specify the serverName or
 	// authority for a channel. One was through the transport credentials
 	// (either in its constructor, or through the OverrideServerName() method).
@@ -1631,25 +1918,62 @@ func determineAuthority(endpoint, target string, dopts dialOptions) (string, err
 	}
 	authorityFromDialOption := dopts.authority
 	if (authorityFromCreds != "" && authorityFromDialOption != "") && authorityFromCreds != authorityFromDialOption {
-		return "", fmt.Errorf("ClientConn's authority from transport creds %q and dial option %q don't match", authorityFromCreds, authorityFromDialOption)
+		return fmt.Errorf("ClientConn's authority from transport creds %q and dial option %q don't match", authorityFromCreds, authorityFromDialOption)
 	}
 
+	endpoint := cc.parsedTarget.Endpoint()
+	target := cc.target
 	switch {
 	case authorityFromDialOption != "":
-		return authorityFromDialOption, nil
+		cc.authority = authorityFromDialOption
 	case authorityFromCreds != "":
-		return authorityFromCreds, nil
+		cc.authority = authorityFromCreds
 	case strings.HasPrefix(target, "unix:") || strings.HasPrefix(target, "unix-abstract:"):
 		// TODO: remove when the unix resolver implements optional interface to
 		// return channel authority.
-		return "localhost", nil
+		cc.authority = "localhost"
 	case strings.HasPrefix(endpoint, ":"):
-		return "localhost" + endpoint, nil
+		cc.authority = "localhost" + endpoint
 	default:
 		// TODO: Define an optional interface on the resolver builder to return
 		// the channel authority given the user's dial target. For resolvers
 		// which don't implement this interface, we will use the endpoint from
 		// "scheme://authority/endpoint" as the default authority.
-		return endpoint, nil
+		// Escape the endpoint to handle use cases where the endpoint
+		// might not be a valid authority by default.
+		// For example an endpoint which has multiple paths like
+		// 'a/b/c', which is not a valid authority by default.
+		cc.authority = encodeAuthority(endpoint)
 	}
+	channelz.Infof(logger, cc.channelzID, "Channel authority set to %q", cc.authority)
+	return nil
+}
+
+// initResolverWrapper creates a ccResolverWrapper, which builds the name
+// resolver. This method grabs the lock to assign the newly built resolver
+// wrapper to the cc.resolverWrapper field.
+func (cc *ClientConn) initResolverWrapper(creds credentials.TransportCredentials) error {
+	rw, err := newCCResolverWrapper(cc, ccResolverWrapperOpts{
+		target:  cc.parsedTarget,
+		builder: cc.resolverBuilder,
+		bOpts: resolver.BuildOptions{
+			DisableServiceConfig: cc.dopts.disableServiceConfig,
+			DialCreds:            creds,
+			CredsBundle:          cc.dopts.copts.CredsBundle,
+			Dialer:               cc.dopts.copts.Dialer,
+		},
+		channelzID: cc.channelzID,
+	})
+	if err != nil {
+		return fmt.Errorf("failed to build resolver: %v", err)
+	}
+	// Resolver implementations may report state update or error inline when
+	// built (or right after), and this is handled in cc.updateResolverState.
+	// Also, an error from the resolver might lead to a re-resolution request
+	// from the balancer, which is handled in resolveNow() where
+	// `cc.resolverWrapper` is accessed. Hence, we need to hold the lock here.
+	cc.mu.Lock()
+	cc.resolverWrapper = rw
+	cc.mu.Unlock()
+	return nil
 }
diff --git a/.ci/providerlint/vendor/google.golang.org/grpc/codes/code_string.go b/.ci/providerlint/vendor/google.golang.org/grpc/codes/code_string.go
index 0b206a57822..934fac2b090 100644
--- a/.ci/providerlint/vendor/google.golang.org/grpc/codes/code_string.go
+++ b/.ci/providerlint/vendor/google.golang.org/grpc/codes/code_string.go
@@ -18,7 +18,15 @@
 
 package codes
 
-import "strconv"
+import (
+	"strconv"
+
+	"google.golang.org/grpc/internal"
+)
+
+func init() {
+	internal.CanonicalString = canonicalString
+}
 
 func (c Code) String() string {
 	switch c {
@@ -60,3 +68,44 @@ func (c Code) String() string {
 		return "Code(" + strconv.FormatInt(int64(c), 10) + ")"
 	}
 }
+
+func canonicalString(c Code) string {
+	switch c {
+	case OK:
+		return "OK"
+	case Canceled:
+		return "CANCELLED"
+	case Unknown:
+		return "UNKNOWN"
+	case InvalidArgument:
+		return "INVALID_ARGUMENT"
+	case DeadlineExceeded:
+		return "DEADLINE_EXCEEDED"
+	case NotFound:
+		return "NOT_FOUND"
+	case AlreadyExists:
+		return "ALREADY_EXISTS"
+	case PermissionDenied:
+		return "PERMISSION_DENIED"
+	case ResourceExhausted:
+		return "RESOURCE_EXHAUSTED"
+	case FailedPrecondition:
+		return "FAILED_PRECONDITION"
+	case Aborted:
+		return "ABORTED"
+	case OutOfRange:
+		return "OUT_OF_RANGE"
+	case Unimplemented:
+		return "UNIMPLEMENTED"
+	case Internal:
+		return "INTERNAL"
+	case Unavailable:
+		return "UNAVAILABLE"
+	case DataLoss:
+		return "DATA_LOSS"
+	case Unauthenticated:
+		return "UNAUTHENTICATED"
+	default:
+		return "CODE(" + strconv.FormatInt(int64(c), 10) + ")"
+	}
+}
diff --git a/.ci/providerlint/vendor/google.golang.org/grpc/credentials/tls.go b/.ci/providerlint/vendor/google.golang.org/grpc/credentials/tls.go
index ce2bbc10a14..877b7cd21af 100644
--- a/.ci/providerlint/vendor/google.golang.org/grpc/credentials/tls.go
+++ b/.ci/providerlint/vendor/google.golang.org/grpc/credentials/tls.go
@@ -23,9 +23,9 @@ import (
 	"crypto/tls"
 	"crypto/x509"
 	"fmt"
-	"io/ioutil"
 	"net"
 	"net/url"
+	"os"
 
 	credinternal "google.golang.org/grpc/internal/credentials"
 )
@@ -166,7 +166,7 @@ func NewClientTLSFromCert(cp *x509.CertPool, serverNameOverride string) Transpor
 // it will override the virtual host name of authority (e.g. :authority header
 // field) in requests.
 func NewClientTLSFromFile(certFile, serverNameOverride string) (TransportCredentials, error) {
-	b, err := ioutil.ReadFile(certFile)
+	b, err := os.ReadFile(certFile)
 	if err != nil {
 		return nil, err
 	}
diff --git a/.ci/providerlint/vendor/google.golang.org/grpc/dialoptions.go b/.ci/providerlint/vendor/google.golang.org/grpc/dialoptions.go
index 9372dc322e8..23ea95237ea 100644
--- a/.ci/providerlint/vendor/google.golang.org/grpc/dialoptions.go
+++ b/.ci/providerlint/vendor/google.golang.org/grpc/dialoptions.go
@@ -38,12 +38,14 @@ import (
 
 func init() {
 	internal.AddGlobalDialOptions = func(opt ...DialOption) {
-		extraDialOptions = append(extraDialOptions, opt...)
+		globalDialOptions = append(globalDialOptions, opt...)
 	}
 	internal.ClearGlobalDialOptions = func() {
-		extraDialOptions = nil
+		globalDialOptions = nil
 	}
 	internal.WithBinaryLogger = withBinaryLogger
+	internal.JoinDialOptions = newJoinDialOption
+	internal.DisableGlobalDialOptions = newDisableGlobalDialOptions
 }
 
 // dialOptions configure a Dial call. dialOptions are set by the DialOption
@@ -75,6 +77,8 @@ type dialOptions struct {
 	defaultServiceConfig        *ServiceConfig // defaultServiceConfig is parsed from defaultServiceConfigRawJSON.
 	defaultServiceConfigRawJSON *string
 	resolvers                   []resolver.Builder
+	idleTimeout                 time.Duration
+	recvBufferPool              SharedBufferPool
 }
 
 // DialOption configures how we set up the connection.
@@ -82,7 +86,7 @@ type DialOption interface {
 	apply(*dialOptions)
 }
 
-var extraDialOptions []DialOption
+var globalDialOptions []DialOption
 
 // EmptyDialOption does not alter the dial configuration. It can be embedded in
 // another structure to build custom dial options.
@@ -95,6 +99,16 @@ type EmptyDialOption struct{}
 
 func (EmptyDialOption) apply(*dialOptions) {}
 
+type disableGlobalDialOptions struct{}
+
+func (disableGlobalDialOptions) apply(*dialOptions) {}
+
+// newDisableGlobalDialOptions returns a DialOption that prevents the ClientConn
+// from applying the global DialOptions (set via AddGlobalDialOptions).
+func newDisableGlobalDialOptions() DialOption {
+	return &disableGlobalDialOptions{}
+}
+
 // funcDialOption wraps a function that modifies dialOptions into an
 // implementation of the DialOption interface.
 type funcDialOption struct {
@@ -111,13 +125,28 @@ func newFuncDialOption(f func(*dialOptions)) *funcDialOption {
 	}
 }
 
+type joinDialOption struct {
+	opts []DialOption
+}
+
+func (jdo *joinDialOption) apply(do *dialOptions) {
+	for _, opt := range jdo.opts {
+		opt.apply(do)
+	}
+}
+
+func newJoinDialOption(opts ...DialOption) DialOption {
+	return &joinDialOption{opts: opts}
+}
+
 // WithWriteBufferSize determines how much data can be batched before doing a
 // write on the wire. The corresponding memory allocation for this buffer will
 // be twice the size to keep syscalls low. The default value for this buffer is
 // 32KB.
 //
-// Zero will disable the write buffer such that each write will be on underlying
-// connection. Note: A Send call may not directly translate to a write.
+// Zero or negative values will disable the write buffer such that each write
+// will be on underlying connection. Note: A Send call may not directly
+// translate to a write.
 func WithWriteBufferSize(s int) DialOption {
 	return newFuncDialOption(func(o *dialOptions) {
 		o.copts.WriteBufferSize = s
@@ -127,8 +156,9 @@ func WithWriteBufferSize(s int) DialOption {
 // WithReadBufferSize lets you set the size of read buffer, this determines how
 // much data can be read at most for each read syscall.
 //
-// The default value for this buffer is 32KB. Zero will disable read buffer for
-// a connection so data framer can access the underlying conn directly.
+// The default value for this buffer is 32KB. Zero or negative values will
+// disable read buffer for a connection so data framer can access the
+// underlying conn directly.
 func WithReadBufferSize(s int) DialOption {
 	return newFuncDialOption(func(o *dialOptions) {
 		o.copts.ReadBufferSize = s
@@ -267,6 +297,9 @@ func withBackoff(bs internalbackoff.Strategy) DialOption {
 // WithBlock returns a DialOption which makes callers of Dial block until the
 // underlying connection is up. Without this, Dial returns immediately and
 // connecting the server happens in background.
+//
+// Use of this feature is not recommended.  For more information, please see:
+// https://github.com/grpc/grpc-go/blob/master/Documentation/anti-patterns.md
 func WithBlock() DialOption {
 	return newFuncDialOption(func(o *dialOptions) {
 		o.block = true
@@ -278,6 +311,9 @@ func WithBlock() DialOption {
 // the context.DeadlineExceeded error.
 // Implies WithBlock()
 //
+// Use of this feature is not recommended.  For more information, please see:
+// https://github.com/grpc/grpc-go/blob/master/Documentation/anti-patterns.md
+//
 // # Experimental
 //
 // Notice: This API is EXPERIMENTAL and may be changed or removed in a
@@ -420,6 +456,9 @@ func withBinaryLogger(bl binarylog.Logger) DialOption {
 // FailOnNonTempDialError only affects the initial dial, and does not do
 // anything useful unless you are also using WithBlock().
 //
+// Use of this feature is not recommended.  For more information, please see:
+// https://github.com/grpc/grpc-go/blob/master/Documentation/anti-patterns.md
+//
 // # Experimental
 //
 // Notice: This API is EXPERIMENTAL and may be changed or removed in a
@@ -590,6 +629,7 @@ func defaultDialOptions() dialOptions {
 			ReadBufferSize:  defaultReadBufSize,
 			UseProxy:        true,
 		},
+		recvBufferPool: nopBufferPool{},
 	}
 }
 
@@ -618,3 +658,44 @@ func WithResolvers(rs ...resolver.Builder) DialOption {
 		o.resolvers = append(o.resolvers, rs...)
 	})
 }
+
+// WithIdleTimeout returns a DialOption that configures an idle timeout for the
+// channel. If the channel is idle for the configured timeout, i.e there are no
+// ongoing RPCs and no new RPCs are initiated, the channel will enter idle mode
+// and as a result the name resolver and load balancer will be shut down. The
+// channel will exit idle mode when the Connect() method is called or when an
+// RPC is initiated.
+//
+// By default this feature is disabled, which can also be explicitly configured
+// by passing zero to this function.
+//
+// # Experimental
+//
+// Notice: This API is EXPERIMENTAL and may be changed or removed in a
+// later release.
+func WithIdleTimeout(d time.Duration) DialOption {
+	return newFuncDialOption(func(o *dialOptions) {
+		o.idleTimeout = d
+	})
+}
+
+// WithRecvBufferPool returns a DialOption that configures the ClientConn
+// to use the provided shared buffer pool for parsing incoming messages. Depending
+// on the application's workload, this could result in reduced memory allocation.
+//
+// If you are unsure about how to implement a memory pool but want to utilize one,
+// begin with grpc.NewSharedBufferPool.
+//
+// Note: The shared buffer pool feature will not be active if any of the following
+// options are used: WithStatsHandler, EnableTracing, or binary logging. In such
+// cases, the shared buffer pool will be ignored.
+//
+// # Experimental
+//
+// Notice: This API is EXPERIMENTAL and may be changed or removed in a
+// later release.
+func WithRecvBufferPool(bufferPool SharedBufferPool) DialOption {
+	return newFuncDialOption(func(o *dialOptions) {
+		o.recvBufferPool = bufferPool
+	})
+}
diff --git a/.ci/providerlint/vendor/google.golang.org/grpc/encoding/encoding.go b/.ci/providerlint/vendor/google.golang.org/grpc/encoding/encoding.go
index 711763d54fb..07a5861352a 100644
--- a/.ci/providerlint/vendor/google.golang.org/grpc/encoding/encoding.go
+++ b/.ci/providerlint/vendor/google.golang.org/grpc/encoding/encoding.go
@@ -75,7 +75,9 @@ var registeredCompressor = make(map[string]Compressor)
 // registered with the same name, the one registered last will take effect.
 func RegisterCompressor(c Compressor) {
 	registeredCompressor[c.Name()] = c
-	grpcutil.RegisteredCompressorNames = append(grpcutil.RegisteredCompressorNames, c.Name())
+	if !grpcutil.IsCompressorNameRegistered(c.Name()) {
+		grpcutil.RegisteredCompressorNames = append(grpcutil.RegisteredCompressorNames, c.Name())
+	}
 }
 
 // GetCompressor returns Compressor for the given compressor name.
diff --git a/.ci/providerlint/vendor/google.golang.org/grpc/grpclog/loggerv2.go b/.ci/providerlint/vendor/google.golang.org/grpc/grpclog/loggerv2.go
index b5560b47ec4..5de66e40d36 100644
--- a/.ci/providerlint/vendor/google.golang.org/grpc/grpclog/loggerv2.go
+++ b/.ci/providerlint/vendor/google.golang.org/grpc/grpclog/loggerv2.go
@@ -22,7 +22,6 @@ import (
 	"encoding/json"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"log"
 	"os"
 	"strconv"
@@ -140,9 +139,9 @@ func newLoggerV2WithConfig(infoW, warningW, errorW io.Writer, c loggerV2Config)
 // newLoggerV2 creates a loggerV2 to be used as default logger.
 // All logs are written to stderr.
 func newLoggerV2() LoggerV2 {
-	errorW := ioutil.Discard
-	warningW := ioutil.Discard
-	infoW := ioutil.Discard
+	errorW := io.Discard
+	warningW := io.Discard
+	infoW := io.Discard
 
 	logLevel := os.Getenv("GRPC_GO_LOG_SEVERITY_LEVEL")
 	switch logLevel {
diff --git a/.ci/providerlint/vendor/google.golang.org/grpc/health/grpc_health_v1/health.pb.go b/.ci/providerlint/vendor/google.golang.org/grpc/health/grpc_health_v1/health.pb.go
index a66024d23e3..142d35f753e 100644
--- a/.ci/providerlint/vendor/google.golang.org/grpc/health/grpc_health_v1/health.pb.go
+++ b/.ci/providerlint/vendor/google.golang.org/grpc/health/grpc_health_v1/health.pb.go
@@ -17,14 +17,13 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.25.0
-// 	protoc        v3.14.0
+// 	protoc-gen-go v1.30.0
+// 	protoc        v4.22.0
 // source: grpc/health/v1/health.proto
 
 package grpc_health_v1
 
 import (
-	proto "github.com/golang/protobuf/proto"
 	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
 	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
 	reflect "reflect"
@@ -38,10 +37,6 @@ const (
 	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
 )
 
-// This is a compile-time assertion that a sufficiently up-to-date version
-// of the legacy proto package is being used.
-const _ = proto.ProtoPackageIsVersion4
-
 type HealthCheckResponse_ServingStatus int32
 
 const (
diff --git a/.ci/providerlint/vendor/google.golang.org/grpc/health/grpc_health_v1/health_grpc.pb.go b/.ci/providerlint/vendor/google.golang.org/grpc/health/grpc_health_v1/health_grpc.pb.go
index a332dfd7b54..a01a1b4d54b 100644
--- a/.ci/providerlint/vendor/google.golang.org/grpc/health/grpc_health_v1/health_grpc.pb.go
+++ b/.ci/providerlint/vendor/google.golang.org/grpc/health/grpc_health_v1/health_grpc.pb.go
@@ -17,8 +17,8 @@
 
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.2.0
-// - protoc             v3.14.0
+// - protoc-gen-go-grpc v1.3.0
+// - protoc             v4.22.0
 // source: grpc/health/v1/health.proto
 
 package grpc_health_v1
@@ -35,6 +35,11 @@ import (
 // Requires gRPC-Go v1.32.0 or later.
 const _ = grpc.SupportPackageIsVersion7
 
+const (
+	Health_Check_FullMethodName = "/grpc.health.v1.Health/Check"
+	Health_Watch_FullMethodName = "/grpc.health.v1.Health/Watch"
+)
+
 // HealthClient is the client API for Health service.
 //
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
@@ -70,7 +75,7 @@ func NewHealthClient(cc grpc.ClientConnInterface) HealthClient {
 
 func (c *healthClient) Check(ctx context.Context, in *HealthCheckRequest, opts ...grpc.CallOption) (*HealthCheckResponse, error) {
 	out := new(HealthCheckResponse)
-	err := c.cc.Invoke(ctx, "/grpc.health.v1.Health/Check", in, out, opts...)
+	err := c.cc.Invoke(ctx, Health_Check_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -78,7 +83,7 @@ func (c *healthClient) Check(ctx context.Context, in *HealthCheckRequest, opts .
 }
 
 func (c *healthClient) Watch(ctx context.Context, in *HealthCheckRequest, opts ...grpc.CallOption) (Health_WatchClient, error) {
-	stream, err := c.cc.NewStream(ctx, &Health_ServiceDesc.Streams[0], "/grpc.health.v1.Health/Watch", opts...)
+	stream, err := c.cc.NewStream(ctx, &Health_ServiceDesc.Streams[0], Health_Watch_FullMethodName, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -166,7 +171,7 @@ func _Health_Check_Handler(srv interface{}, ctx context.Context, dec func(interf
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/grpc.health.v1.Health/Check",
+		FullMethod: Health_Check_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(HealthServer).Check(ctx, req.(*HealthCheckRequest))
diff --git a/.ci/providerlint/vendor/google.golang.org/grpc/idle.go b/.ci/providerlint/vendor/google.golang.org/grpc/idle.go
new file mode 100644
index 00000000000..dc3dc72f6b0
--- /dev/null
+++ b/.ci/providerlint/vendor/google.golang.org/grpc/idle.go
@@ -0,0 +1,287 @@
+/*
+ *
+ * Copyright 2023 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package grpc
+
+import (
+	"fmt"
+	"math"
+	"sync"
+	"sync/atomic"
+	"time"
+)
+
+// For overriding in unit tests.
+var timeAfterFunc = func(d time.Duration, f func()) *time.Timer {
+	return time.AfterFunc(d, f)
+}
+
+// idlenessEnforcer is the functionality provided by grpc.ClientConn to enter
+// and exit from idle mode.
+type idlenessEnforcer interface {
+	exitIdleMode() error
+	enterIdleMode() error
+}
+
+// idlenessManager defines the functionality required to track RPC activity on a
+// channel.
+type idlenessManager interface {
+	onCallBegin() error
+	onCallEnd()
+	close()
+}
+
+type noopIdlenessManager struct{}
+
+func (noopIdlenessManager) onCallBegin() error { return nil }
+func (noopIdlenessManager) onCallEnd()         {}
+func (noopIdlenessManager) close()             {}
+
+// idlenessManagerImpl implements the idlenessManager interface. It uses atomic
+// operations to synchronize access to shared state and a mutex to guarantee
+// mutual exclusion in a critical section.
+type idlenessManagerImpl struct {
+	// State accessed atomically.
+	lastCallEndTime           int64 // Unix timestamp in nanos; time when the most recent RPC completed.
+	activeCallsCount          int32 // Count of active RPCs; -math.MaxInt32 means channel is idle or is trying to get there.
+	activeSinceLastTimerCheck int32 // Boolean; True if there was an RPC since the last timer callback.
+	closed                    int32 // Boolean; True when the manager is closed.
+
+	// Can be accessed without atomics or mutex since these are set at creation
+	// time and read-only after that.
+	enforcer idlenessEnforcer // Functionality provided by grpc.ClientConn.
+	timeout  int64            // Idle timeout duration nanos stored as an int64.
+
+	// idleMu is used to guarantee mutual exclusion in two scenarios:
+	// - Opposing intentions:
+	//   - a: Idle timeout has fired and handleIdleTimeout() is trying to put
+	//     the channel in idle mode because the channel has been inactive.
+	//   - b: At the same time an RPC is made on the channel, and onCallBegin()
+	//     is trying to prevent the channel from going idle.
+	// - Competing intentions:
+	//   - The channel is in idle mode and there are multiple RPCs starting at
+	//     the same time, all trying to move the channel out of idle. Only one
+	//     of them should succeed in doing so, while the other RPCs should
+	//     piggyback on the first one and be successfully handled.
+	idleMu       sync.RWMutex
+	actuallyIdle bool
+	timer        *time.Timer
+}
+
+// newIdlenessManager creates a new idleness manager implementation for the
+// given idle timeout.
+func newIdlenessManager(enforcer idlenessEnforcer, idleTimeout time.Duration) idlenessManager {
+	if idleTimeout == 0 {
+		return noopIdlenessManager{}
+	}
+
+	i := &idlenessManagerImpl{
+		enforcer: enforcer,
+		timeout:  int64(idleTimeout),
+	}
+	i.timer = timeAfterFunc(idleTimeout, i.handleIdleTimeout)
+	return i
+}
+
+// resetIdleTimer resets the idle timer to the given duration. This method
+// should only be called from the timer callback.
+func (i *idlenessManagerImpl) resetIdleTimer(d time.Duration) {
+	i.idleMu.Lock()
+	defer i.idleMu.Unlock()
+
+	if i.timer == nil {
+		// Only close sets timer to nil. We are done.
+		return
+	}
+
+	// It is safe to ignore the return value from Reset() because this method is
+	// only ever called from the timer callback, which means the timer has
+	// already fired.
+	i.timer.Reset(d)
+}
+
+// handleIdleTimeout is the timer callback that is invoked upon expiry of the
+// configured idle timeout. The channel is considered inactive if there are no
+// ongoing calls and no RPC activity since the last time the timer fired.
+func (i *idlenessManagerImpl) handleIdleTimeout() {
+	if i.isClosed() {
+		return
+	}
+
+	if atomic.LoadInt32(&i.activeCallsCount) > 0 {
+		i.resetIdleTimer(time.Duration(i.timeout))
+		return
+	}
+
+	// There has been activity on the channel since we last got here. Reset the
+	// timer and return.
+	if atomic.LoadInt32(&i.activeSinceLastTimerCheck) == 1 {
+		// Set the timer to fire after a duration of idle timeout, calculated
+		// from the time the most recent RPC completed.
+		atomic.StoreInt32(&i.activeSinceLastTimerCheck, 0)
+		i.resetIdleTimer(time.Duration(atomic.LoadInt64(&i.lastCallEndTime) + i.timeout - time.Now().UnixNano()))
+		return
+	}
+
+	// This CAS operation is extremely likely to succeed given that there has
+	// been no activity since the last time we were here.  Setting the
+	// activeCallsCount to -math.MaxInt32 indicates to onCallBegin() that the
+	// channel is either in idle mode or is trying to get there.
+	if !atomic.CompareAndSwapInt32(&i.activeCallsCount, 0, -math.MaxInt32) {
+		// This CAS operation can fail if an RPC started after we checked for
+		// activity at the top of this method, or one was ongoing from before
+		// the last time we were here. In both case, reset the timer and return.
+		i.resetIdleTimer(time.Duration(i.timeout))
+		return
+	}
+
+	// Now that we've set the active calls count to -math.MaxInt32, it's time to
+	// actually move to idle mode.
+	if i.tryEnterIdleMode() {
+		// Successfully entered idle mode. No timer needed until we exit idle.
+		return
+	}
+
+	// Failed to enter idle mode due to a concurrent RPC that kept the channel
+	// active, or because of an error from the channel. Undo the attempt to
+	// enter idle, and reset the timer to try again later.
+	atomic.AddInt32(&i.activeCallsCount, math.MaxInt32)
+	i.resetIdleTimer(time.Duration(i.timeout))
+}
+
+// tryEnterIdleMode instructs the channel to enter idle mode. But before
+// that, it performs a last minute check to ensure that no new RPC has come in,
+// making the channel active.
+//
+// Return value indicates whether or not the channel moved to idle mode.
+//
+// Holds idleMu which ensures mutual exclusion with exitIdleMode.
+func (i *idlenessManagerImpl) tryEnterIdleMode() bool {
+	i.idleMu.Lock()
+	defer i.idleMu.Unlock()
+
+	if atomic.LoadInt32(&i.activeCallsCount) != -math.MaxInt32 {
+		// We raced and lost to a new RPC. Very rare, but stop entering idle.
+		return false
+	}
+	if atomic.LoadInt32(&i.activeSinceLastTimerCheck) == 1 {
+		// An very short RPC could have come in (and also finished) after we
+		// checked for calls count and activity in handleIdleTimeout(), but
+		// before the CAS operation. So, we need to check for activity again.
+		return false
+	}
+
+	// No new RPCs have come in since we last set the active calls count value
+	// -math.MaxInt32 in the timer callback. And since we have the lock, it is
+	// safe to enter idle mode now.
+	if err := i.enforcer.enterIdleMode(); err != nil {
+		logger.Errorf("Failed to enter idle mode: %v", err)
+		return false
+	}
+
+	// Successfully entered idle mode.
+	i.actuallyIdle = true
+	return true
+}
+
+// onCallBegin is invoked at the start of every RPC.
+func (i *idlenessManagerImpl) onCallBegin() error {
+	if i.isClosed() {
+		return nil
+	}
+
+	if atomic.AddInt32(&i.activeCallsCount, 1) > 0 {
+		// Channel is not idle now. Set the activity bit and allow the call.
+		atomic.StoreInt32(&i.activeSinceLastTimerCheck, 1)
+		return nil
+	}
+
+	// Channel is either in idle mode or is in the process of moving to idle
+	// mode. Attempt to exit idle mode to allow this RPC.
+	if err := i.exitIdleMode(); err != nil {
+		// Undo the increment to calls count, and return an error causing the
+		// RPC to fail.
+		atomic.AddInt32(&i.activeCallsCount, -1)
+		return err
+	}
+
+	atomic.StoreInt32(&i.activeSinceLastTimerCheck, 1)
+	return nil
+}
+
+// exitIdleMode instructs the channel to exit idle mode.
+//
+// Holds idleMu which ensures mutual exclusion with tryEnterIdleMode.
+func (i *idlenessManagerImpl) exitIdleMode() error {
+	i.idleMu.Lock()
+	defer i.idleMu.Unlock()
+
+	if !i.actuallyIdle {
+		// This can happen in two scenarios:
+		// - handleIdleTimeout() set the calls count to -math.MaxInt32 and called
+		//   tryEnterIdleMode(). But before the latter could grab the lock, an RPC
+		//   came in and onCallBegin() noticed that the calls count is negative.
+		// - Channel is in idle mode, and multiple new RPCs come in at the same
+		//   time, all of them notice a negative calls count in onCallBegin and get
+		//   here. The first one to get the lock would got the channel to exit idle.
+		//
+		// Either way, nothing to do here.
+		return nil
+	}
+
+	if err := i.enforcer.exitIdleMode(); err != nil {
+		return fmt.Errorf("channel failed to exit idle mode: %v", err)
+	}
+
+	// Undo the idle entry process. This also respects any new RPC attempts.
+	atomic.AddInt32(&i.activeCallsCount, math.MaxInt32)
+	i.actuallyIdle = false
+
+	// Start a new timer to fire after the configured idle timeout.
+	i.timer = timeAfterFunc(time.Duration(i.timeout), i.handleIdleTimeout)
+	return nil
+}
+
+// onCallEnd is invoked at the end of every RPC.
+func (i *idlenessManagerImpl) onCallEnd() {
+	if i.isClosed() {
+		return
+	}
+
+	// Record the time at which the most recent call finished.
+	atomic.StoreInt64(&i.lastCallEndTime, time.Now().UnixNano())
+
+	// Decrement the active calls count. This count can temporarily go negative
+	// when the timer callback is in the process of moving the channel to idle
+	// mode, but one or more RPCs come in and complete before the timer callback
+	// can get done with the process of moving to idle mode.
+	atomic.AddInt32(&i.activeCallsCount, -1)
+}
+
+func (i *idlenessManagerImpl) isClosed() bool {
+	return atomic.LoadInt32(&i.closed) == 1
+}
+
+func (i *idlenessManagerImpl) close() {
+	atomic.StoreInt32(&i.closed, 1)
+
+	i.idleMu.Lock()
+	i.timer.Stop()
+	i.timer = nil
+	i.idleMu.Unlock()
+}
diff --git a/.ci/providerlint/vendor/google.golang.org/grpc/internal/binarylog/binarylog.go b/.ci/providerlint/vendor/google.golang.org/grpc/internal/binarylog/binarylog.go
index 809d73ccafb..755fdebc1b1 100644
--- a/.ci/providerlint/vendor/google.golang.org/grpc/internal/binarylog/binarylog.go
+++ b/.ci/providerlint/vendor/google.golang.org/grpc/internal/binarylog/binarylog.go
@@ -28,8 +28,13 @@ import (
 	"google.golang.org/grpc/internal/grpcutil"
 )
 
-// Logger is the global binary logger. It can be used to get binary logger for
-// each method.
+var grpclogLogger = grpclog.Component("binarylog")
+
+// Logger specifies MethodLoggers for method names with a Log call that
+// takes a context.
+//
+// This is used in the 1.0 release of gcp/observability, and thus must not be
+// deleted or changed.
 type Logger interface {
 	GetMethodLogger(methodName string) MethodLogger
 }
@@ -40,8 +45,6 @@ type Logger interface {
 // It is used to get a MethodLogger for each individual method.
 var binLogger Logger
 
-var grpclogLogger = grpclog.Component("binarylog")
-
 // SetLogger sets the binary logger.
 //
 // Only call this at init time.
diff --git a/.ci/providerlint/vendor/google.golang.org/grpc/internal/binarylog/method_logger.go b/.ci/providerlint/vendor/google.golang.org/grpc/internal/binarylog/method_logger.go
index 179f4a26d13..6c3f632215f 100644
--- a/.ci/providerlint/vendor/google.golang.org/grpc/internal/binarylog/method_logger.go
+++ b/.ci/providerlint/vendor/google.golang.org/grpc/internal/binarylog/method_logger.go
@@ -19,6 +19,7 @@
 package binarylog
 
 import (
+	"context"
 	"net"
 	"strings"
 	"sync/atomic"
@@ -26,7 +27,7 @@ import (
 
 	"github.com/golang/protobuf/proto"
 	"github.com/golang/protobuf/ptypes"
-	pb "google.golang.org/grpc/binarylog/grpc_binarylog_v1"
+	binlogpb "google.golang.org/grpc/binarylog/grpc_binarylog_v1"
 	"google.golang.org/grpc/metadata"
 	"google.golang.org/grpc/status"
 )
@@ -48,8 +49,11 @@ func (g *callIDGenerator) reset() {
 var idGen callIDGenerator
 
 // MethodLogger is the sub-logger for each method.
+//
+// This is used in the 1.0 release of gcp/observability, and thus must not be
+// deleted or changed.
 type MethodLogger interface {
-	Log(LogEntryConfig)
+	Log(context.Context, LogEntryConfig)
 }
 
 // TruncatingMethodLogger is a method logger that truncates headers and messages
@@ -64,6 +68,9 @@ type TruncatingMethodLogger struct {
 }
 
 // NewTruncatingMethodLogger returns a new truncating method logger.
+//
+// This is used in the 1.0 release of gcp/observability, and thus must not be
+// deleted or changed.
 func NewTruncatingMethodLogger(h, m uint64) *TruncatingMethodLogger {
 	return &TruncatingMethodLogger{
 		headerMaxLen:  h,
@@ -79,7 +86,7 @@ func NewTruncatingMethodLogger(h, m uint64) *TruncatingMethodLogger {
 // Build is an internal only method for building the proto message out of the
 // input event. It's made public to enable other library to reuse as much logic
 // in TruncatingMethodLogger as possible.
-func (ml *TruncatingMethodLogger) Build(c LogEntryConfig) *pb.GrpcLogEntry {
+func (ml *TruncatingMethodLogger) Build(c LogEntryConfig) *binlogpb.GrpcLogEntry {
 	m := c.toProto()
 	timestamp, _ := ptypes.TimestampProto(time.Now())
 	m.Timestamp = timestamp
@@ -87,22 +94,22 @@ func (ml *TruncatingMethodLogger) Build(c LogEntryConfig) *pb.GrpcLogEntry {
 	m.SequenceIdWithinCall = ml.idWithinCallGen.next()
 
 	switch pay := m.Payload.(type) {
-	case *pb.GrpcLogEntry_ClientHeader:
+	case *binlogpb.GrpcLogEntry_ClientHeader:
 		m.PayloadTruncated = ml.truncateMetadata(pay.ClientHeader.GetMetadata())
-	case *pb.GrpcLogEntry_ServerHeader:
+	case *binlogpb.GrpcLogEntry_ServerHeader:
 		m.PayloadTruncated = ml.truncateMetadata(pay.ServerHeader.GetMetadata())
-	case *pb.GrpcLogEntry_Message:
+	case *binlogpb.GrpcLogEntry_Message:
 		m.PayloadTruncated = ml.truncateMessage(pay.Message)
 	}
 	return m
 }
 
 // Log creates a proto binary log entry, and logs it to the sink.
-func (ml *TruncatingMethodLogger) Log(c LogEntryConfig) {
+func (ml *TruncatingMethodLogger) Log(ctx context.Context, c LogEntryConfig) {
 	ml.sink.Write(ml.Build(c))
 }
 
-func (ml *TruncatingMethodLogger) truncateMetadata(mdPb *pb.Metadata) (truncated bool) {
+func (ml *TruncatingMethodLogger) truncateMetadata(mdPb *binlogpb.Metadata) (truncated bool) {
 	if ml.headerMaxLen == maxUInt {
 		return false
 	}
@@ -121,7 +128,7 @@ func (ml *TruncatingMethodLogger) truncateMetadata(mdPb *pb.Metadata) (truncated
 			// but not counted towards the size limit.
 			continue
 		}
-		currentEntryLen := uint64(len(entry.Value))
+		currentEntryLen := uint64(len(entry.GetKey())) + uint64(len(entry.GetValue()))
 		if currentEntryLen > bytesLimit {
 			break
 		}
@@ -132,7 +139,7 @@ func (ml *TruncatingMethodLogger) truncateMetadata(mdPb *pb.Metadata) (truncated
 	return truncated
 }
 
-func (ml *TruncatingMethodLogger) truncateMessage(msgPb *pb.Message) (truncated bool) {
+func (ml *TruncatingMethodLogger) truncateMessage(msgPb *binlogpb.Message) (truncated bool) {
 	if ml.messageMaxLen == maxUInt {
 		return false
 	}
@@ -144,8 +151,11 @@ func (ml *TruncatingMethodLogger) truncateMessage(msgPb *pb.Message) (truncated
 }
 
 // LogEntryConfig represents the configuration for binary log entry.
+//
+// This is used in the 1.0 release of gcp/observability, and thus must not be
+// deleted or changed.
 type LogEntryConfig interface {
-	toProto() *pb.GrpcLogEntry
+	toProto() *binlogpb.GrpcLogEntry
 }
 
 // ClientHeader configs the binary log entry to be a ClientHeader entry.
@@ -159,10 +169,10 @@ type ClientHeader struct {
 	PeerAddr net.Addr
 }
 
-func (c *ClientHeader) toProto() *pb.GrpcLogEntry {
+func (c *ClientHeader) toProto() *binlogpb.GrpcLogEntry {
 	// This function doesn't need to set all the fields (e.g. seq ID). The Log
 	// function will set the fields when necessary.
-	clientHeader := &pb.ClientHeader{
+	clientHeader := &binlogpb.ClientHeader{
 		Metadata:   mdToMetadataProto(c.Header),
 		MethodName: c.MethodName,
 		Authority:  c.Authority,
@@ -170,16 +180,16 @@ func (c *ClientHeader) toProto() *pb.GrpcLogEntry {
 	if c.Timeout > 0 {
 		clientHeader.Timeout = ptypes.DurationProto(c.Timeout)
 	}
-	ret := &pb.GrpcLogEntry{
-		Type: pb.GrpcLogEntry_EVENT_TYPE_CLIENT_HEADER,
-		Payload: &pb.GrpcLogEntry_ClientHeader{
+	ret := &binlogpb.GrpcLogEntry{
+		Type: binlogpb.GrpcLogEntry_EVENT_TYPE_CLIENT_HEADER,
+		Payload: &binlogpb.GrpcLogEntry_ClientHeader{
 			ClientHeader: clientHeader,
 		},
 	}
 	if c.OnClientSide {
-		ret.Logger = pb.GrpcLogEntry_LOGGER_CLIENT
+		ret.Logger = binlogpb.GrpcLogEntry_LOGGER_CLIENT
 	} else {
-		ret.Logger = pb.GrpcLogEntry_LOGGER_SERVER
+		ret.Logger = binlogpb.GrpcLogEntry_LOGGER_SERVER
 	}
 	if c.PeerAddr != nil {
 		ret.Peer = addrToProto(c.PeerAddr)
@@ -195,19 +205,19 @@ type ServerHeader struct {
 	PeerAddr net.Addr
 }
 
-func (c *ServerHeader) toProto() *pb.GrpcLogEntry {
-	ret := &pb.GrpcLogEntry{
-		Type: pb.GrpcLogEntry_EVENT_TYPE_SERVER_HEADER,
-		Payload: &pb.GrpcLogEntry_ServerHeader{
-			ServerHeader: &pb.ServerHeader{
+func (c *ServerHeader) toProto() *binlogpb.GrpcLogEntry {
+	ret := &binlogpb.GrpcLogEntry{
+		Type: binlogpb.GrpcLogEntry_EVENT_TYPE_SERVER_HEADER,
+		Payload: &binlogpb.GrpcLogEntry_ServerHeader{
+			ServerHeader: &binlogpb.ServerHeader{
 				Metadata: mdToMetadataProto(c.Header),
 			},
 		},
 	}
 	if c.OnClientSide {
-		ret.Logger = pb.GrpcLogEntry_LOGGER_CLIENT
+		ret.Logger = binlogpb.GrpcLogEntry_LOGGER_CLIENT
 	} else {
-		ret.Logger = pb.GrpcLogEntry_LOGGER_SERVER
+		ret.Logger = binlogpb.GrpcLogEntry_LOGGER_SERVER
 	}
 	if c.PeerAddr != nil {
 		ret.Peer = addrToProto(c.PeerAddr)
@@ -223,7 +233,7 @@ type ClientMessage struct {
 	Message interface{}
 }
 
-func (c *ClientMessage) toProto() *pb.GrpcLogEntry {
+func (c *ClientMessage) toProto() *binlogpb.GrpcLogEntry {
 	var (
 		data []byte
 		err  error
@@ -238,19 +248,19 @@ func (c *ClientMessage) toProto() *pb.GrpcLogEntry {
 	} else {
 		grpclogLogger.Infof("binarylogging: message to log is neither proto.message nor []byte")
 	}
-	ret := &pb.GrpcLogEntry{
-		Type: pb.GrpcLogEntry_EVENT_TYPE_CLIENT_MESSAGE,
-		Payload: &pb.GrpcLogEntry_Message{
-			Message: &pb.Message{
+	ret := &binlogpb.GrpcLogEntry{
+		Type: binlogpb.GrpcLogEntry_EVENT_TYPE_CLIENT_MESSAGE,
+		Payload: &binlogpb.GrpcLogEntry_Message{
+			Message: &binlogpb.Message{
 				Length: uint32(len(data)),
 				Data:   data,
 			},
 		},
 	}
 	if c.OnClientSide {
-		ret.Logger = pb.GrpcLogEntry_LOGGER_CLIENT
+		ret.Logger = binlogpb.GrpcLogEntry_LOGGER_CLIENT
 	} else {
-		ret.Logger = pb.GrpcLogEntry_LOGGER_SERVER
+		ret.Logger = binlogpb.GrpcLogEntry_LOGGER_SERVER
 	}
 	return ret
 }
@@ -263,7 +273,7 @@ type ServerMessage struct {
 	Message interface{}
 }
 
-func (c *ServerMessage) toProto() *pb.GrpcLogEntry {
+func (c *ServerMessage) toProto() *binlogpb.GrpcLogEntry {
 	var (
 		data []byte
 		err  error
@@ -278,19 +288,19 @@ func (c *ServerMessage) toProto() *pb.GrpcLogEntry {
 	} else {
 		grpclogLogger.Infof("binarylogging: message to log is neither proto.message nor []byte")
 	}
-	ret := &pb.GrpcLogEntry{
-		Type: pb.GrpcLogEntry_EVENT_TYPE_SERVER_MESSAGE,
-		Payload: &pb.GrpcLogEntry_Message{
-			Message: &pb.Message{
+	ret := &binlogpb.GrpcLogEntry{
+		Type: binlogpb.GrpcLogEntry_EVENT_TYPE_SERVER_MESSAGE,
+		Payload: &binlogpb.GrpcLogEntry_Message{
+			Message: &binlogpb.Message{
 				Length: uint32(len(data)),
 				Data:   data,
 			},
 		},
 	}
 	if c.OnClientSide {
-		ret.Logger = pb.GrpcLogEntry_LOGGER_CLIENT
+		ret.Logger = binlogpb.GrpcLogEntry_LOGGER_CLIENT
 	} else {
-		ret.Logger = pb.GrpcLogEntry_LOGGER_SERVER
+		ret.Logger = binlogpb.GrpcLogEntry_LOGGER_SERVER
 	}
 	return ret
 }
@@ -300,15 +310,15 @@ type ClientHalfClose struct {
 	OnClientSide bool
 }
 
-func (c *ClientHalfClose) toProto() *pb.GrpcLogEntry {
-	ret := &pb.GrpcLogEntry{
-		Type:    pb.GrpcLogEntry_EVENT_TYPE_CLIENT_HALF_CLOSE,
+func (c *ClientHalfClose) toProto() *binlogpb.GrpcLogEntry {
+	ret := &binlogpb.GrpcLogEntry{
+		Type:    binlogpb.GrpcLogEntry_EVENT_TYPE_CLIENT_HALF_CLOSE,
 		Payload: nil, // No payload here.
 	}
 	if c.OnClientSide {
-		ret.Logger = pb.GrpcLogEntry_LOGGER_CLIENT
+		ret.Logger = binlogpb.GrpcLogEntry_LOGGER_CLIENT
 	} else {
-		ret.Logger = pb.GrpcLogEntry_LOGGER_SERVER
+		ret.Logger = binlogpb.GrpcLogEntry_LOGGER_SERVER
 	}
 	return ret
 }
@@ -324,7 +334,7 @@ type ServerTrailer struct {
 	PeerAddr net.Addr
 }
 
-func (c *ServerTrailer) toProto() *pb.GrpcLogEntry {
+func (c *ServerTrailer) toProto() *binlogpb.GrpcLogEntry {
 	st, ok := status.FromError(c.Err)
 	if !ok {
 		grpclogLogger.Info("binarylogging: error in trailer is not a status error")
@@ -340,10 +350,10 @@ func (c *ServerTrailer) toProto() *pb.GrpcLogEntry {
 			grpclogLogger.Infof("binarylogging: failed to marshal status proto: %v", err)
 		}
 	}
-	ret := &pb.GrpcLogEntry{
-		Type: pb.GrpcLogEntry_EVENT_TYPE_SERVER_TRAILER,
-		Payload: &pb.GrpcLogEntry_Trailer{
-			Trailer: &pb.Trailer{
+	ret := &binlogpb.GrpcLogEntry{
+		Type: binlogpb.GrpcLogEntry_EVENT_TYPE_SERVER_TRAILER,
+		Payload: &binlogpb.GrpcLogEntry_Trailer{
+			Trailer: &binlogpb.Trailer{
 				Metadata:      mdToMetadataProto(c.Trailer),
 				StatusCode:    uint32(st.Code()),
 				StatusMessage: st.Message(),
@@ -352,9 +362,9 @@ func (c *ServerTrailer) toProto() *pb.GrpcLogEntry {
 		},
 	}
 	if c.OnClientSide {
-		ret.Logger = pb.GrpcLogEntry_LOGGER_CLIENT
+		ret.Logger = binlogpb.GrpcLogEntry_LOGGER_CLIENT
 	} else {
-		ret.Logger = pb.GrpcLogEntry_LOGGER_SERVER
+		ret.Logger = binlogpb.GrpcLogEntry_LOGGER_SERVER
 	}
 	if c.PeerAddr != nil {
 		ret.Peer = addrToProto(c.PeerAddr)
@@ -367,15 +377,15 @@ type Cancel struct {
 	OnClientSide bool
 }
 
-func (c *Cancel) toProto() *pb.GrpcLogEntry {
-	ret := &pb.GrpcLogEntry{
-		Type:    pb.GrpcLogEntry_EVENT_TYPE_CANCEL,
+func (c *Cancel) toProto() *binlogpb.GrpcLogEntry {
+	ret := &binlogpb.GrpcLogEntry{
+		Type:    binlogpb.GrpcLogEntry_EVENT_TYPE_CANCEL,
 		Payload: nil,
 	}
 	if c.OnClientSide {
-		ret.Logger = pb.GrpcLogEntry_LOGGER_CLIENT
+		ret.Logger = binlogpb.GrpcLogEntry_LOGGER_CLIENT
 	} else {
-		ret.Logger = pb.GrpcLogEntry_LOGGER_SERVER
+		ret.Logger = binlogpb.GrpcLogEntry_LOGGER_SERVER
 	}
 	return ret
 }
@@ -392,15 +402,15 @@ func metadataKeyOmit(key string) bool {
 	return strings.HasPrefix(key, "grpc-")
 }
 
-func mdToMetadataProto(md metadata.MD) *pb.Metadata {
-	ret := &pb.Metadata{}
+func mdToMetadataProto(md metadata.MD) *binlogpb.Metadata {
+	ret := &binlogpb.Metadata{}
 	for k, vv := range md {
 		if metadataKeyOmit(k) {
 			continue
 		}
 		for _, v := range vv {
 			ret.Entry = append(ret.Entry,
-				&pb.MetadataEntry{
+				&binlogpb.MetadataEntry{
 					Key:   k,
 					Value: []byte(v),
 				},
@@ -410,26 +420,26 @@ func mdToMetadataProto(md metadata.MD) *pb.Metadata {
 	return ret
 }
 
-func addrToProto(addr net.Addr) *pb.Address {
-	ret := &pb.Address{}
+func addrToProto(addr net.Addr) *binlogpb.Address {
+	ret := &binlogpb.Address{}
 	switch a := addr.(type) {
 	case *net.TCPAddr:
 		if a.IP.To4() != nil {
-			ret.Type = pb.Address_TYPE_IPV4
+			ret.Type = binlogpb.Address_TYPE_IPV4
 		} else if a.IP.To16() != nil {
-			ret.Type = pb.Address_TYPE_IPV6
+			ret.Type = binlogpb.Address_TYPE_IPV6
 		} else {
-			ret.Type = pb.Address_TYPE_UNKNOWN
+			ret.Type = binlogpb.Address_TYPE_UNKNOWN
 			// Do not set address and port fields.
 			break
 		}
 		ret.Address = a.IP.String()
 		ret.IpPort = uint32(a.Port)
 	case *net.UnixAddr:
-		ret.Type = pb.Address_TYPE_UNIX
+		ret.Type = binlogpb.Address_TYPE_UNIX
 		ret.Address = a.String()
 	default:
-		ret.Type = pb.Address_TYPE_UNKNOWN
+		ret.Type = binlogpb.Address_TYPE_UNKNOWN
 	}
 	return ret
 }
diff --git a/.ci/providerlint/vendor/google.golang.org/grpc/internal/binarylog/sink.go b/.ci/providerlint/vendor/google.golang.org/grpc/internal/binarylog/sink.go
index c2fdd58b319..264de387c2a 100644
--- a/.ci/providerlint/vendor/google.golang.org/grpc/internal/binarylog/sink.go
+++ b/.ci/providerlint/vendor/google.golang.org/grpc/internal/binarylog/sink.go
@@ -26,7 +26,7 @@ import (
 	"time"
 
 	"github.com/golang/protobuf/proto"
-	pb "google.golang.org/grpc/binarylog/grpc_binarylog_v1"
+	binlogpb "google.golang.org/grpc/binarylog/grpc_binarylog_v1"
 )
 
 var (
@@ -42,15 +42,15 @@ type Sink interface {
 	// Write will be called to write the log entry into the sink.
 	//
 	// It should be thread-safe so it can be called in parallel.
-	Write(*pb.GrpcLogEntry) error
+	Write(*binlogpb.GrpcLogEntry) error
 	// Close will be called when the Sink is replaced by a new Sink.
 	Close() error
 }
 
 type noopSink struct{}
 
-func (ns *noopSink) Write(*pb.GrpcLogEntry) error { return nil }
-func (ns *noopSink) Close() error                 { return nil }
+func (ns *noopSink) Write(*binlogpb.GrpcLogEntry) error { return nil }
+func (ns *noopSink) Close() error                       { return nil }
 
 // newWriterSink creates a binary log sink with the given writer.
 //
@@ -66,7 +66,7 @@ type writerSink struct {
 	out io.Writer
 }
 
-func (ws *writerSink) Write(e *pb.GrpcLogEntry) error {
+func (ws *writerSink) Write(e *binlogpb.GrpcLogEntry) error {
 	b, err := proto.Marshal(e)
 	if err != nil {
 		grpclogLogger.Errorf("binary logging: failed to marshal proto message: %v", err)
@@ -96,7 +96,7 @@ type bufferedSink struct {
 	done        chan struct{}
 }
 
-func (fs *bufferedSink) Write(e *pb.GrpcLogEntry) error {
+func (fs *bufferedSink) Write(e *binlogpb.GrpcLogEntry) error {
 	fs.mu.Lock()
 	defer fs.mu.Unlock()
 	if !fs.flusherStarted {
diff --git a/.ci/providerlint/vendor/google.golang.org/grpc/internal/buffer/unbounded.go b/.ci/providerlint/vendor/google.golang.org/grpc/internal/buffer/unbounded.go
index 9f6a0c1200d..81c2f5fd761 100644
--- a/.ci/providerlint/vendor/google.golang.org/grpc/internal/buffer/unbounded.go
+++ b/.ci/providerlint/vendor/google.golang.org/grpc/internal/buffer/unbounded.go
@@ -35,6 +35,7 @@ import "sync"
 // internal/transport/transport.go for an example of this.
 type Unbounded struct {
 	c       chan interface{}
+	closed  bool
 	mu      sync.Mutex
 	backlog []interface{}
 }
@@ -47,16 +48,18 @@ func NewUnbounded() *Unbounded {
 // Put adds t to the unbounded buffer.
 func (b *Unbounded) Put(t interface{}) {
 	b.mu.Lock()
+	defer b.mu.Unlock()
+	if b.closed {
+		return
+	}
 	if len(b.backlog) == 0 {
 		select {
 		case b.c <- t:
-			b.mu.Unlock()
 			return
 		default:
 		}
 	}
 	b.backlog = append(b.backlog, t)
-	b.mu.Unlock()
 }
 
 // Load sends the earliest buffered data, if any, onto the read channel
@@ -64,6 +67,10 @@ func (b *Unbounded) Put(t interface{}) {
 // value from the read channel.
 func (b *Unbounded) Load() {
 	b.mu.Lock()
+	defer b.mu.Unlock()
+	if b.closed {
+		return
+	}
 	if len(b.backlog) > 0 {
 		select {
 		case b.c <- b.backlog[0]:
@@ -72,7 +79,6 @@ func (b *Unbounded) Load() {
 		default:
 		}
 	}
-	b.mu.Unlock()
 }
 
 // Get returns a read channel on which values added to the buffer, via Put(),
@@ -80,6 +86,20 @@ func (b *Unbounded) Load() {
 //
 // Upon reading a value from this channel, users are expected to call Load() to
 // send the next buffered value onto the channel if there is any.
+//
+// If the unbounded buffer is closed, the read channel returned by this method
+// is closed.
 func (b *Unbounded) Get() <-chan interface{} {
 	return b.c
 }
+
+// Close closes the unbounded buffer.
+func (b *Unbounded) Close() {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	if b.closed {
+		return
+	}
+	b.closed = true
+	close(b.c)
+}
diff --git a/.ci/providerlint/vendor/google.golang.org/grpc/internal/envconfig/envconfig.go b/.ci/providerlint/vendor/google.golang.org/grpc/internal/envconfig/envconfig.go
index 7edd196bd3d..77c2c0b89f6 100644
--- a/.ci/providerlint/vendor/google.golang.org/grpc/internal/envconfig/envconfig.go
+++ b/.ci/providerlint/vendor/google.golang.org/grpc/internal/envconfig/envconfig.go
@@ -21,19 +21,49 @@ package envconfig
 
 import (
 	"os"
+	"strconv"
 	"strings"
 )
 
-const (
-	prefix                  = "GRPC_GO_"
-	txtErrIgnoreStr         = prefix + "IGNORE_TXT_ERRORS"
-	advertiseCompressorsStr = prefix + "ADVERTISE_COMPRESSORS"
-)
-
 var (
 	// TXTErrIgnore is set if TXT errors should be ignored ("GRPC_GO_IGNORE_TXT_ERRORS" is not "false").
-	TXTErrIgnore = !strings.EqualFold(os.Getenv(txtErrIgnoreStr), "false")
+	TXTErrIgnore = boolFromEnv("GRPC_GO_IGNORE_TXT_ERRORS", true)
 	// AdvertiseCompressors is set if registered compressor should be advertised
 	// ("GRPC_GO_ADVERTISE_COMPRESSORS" is not "false").
-	AdvertiseCompressors = !strings.EqualFold(os.Getenv(advertiseCompressorsStr), "false")
+	AdvertiseCompressors = boolFromEnv("GRPC_GO_ADVERTISE_COMPRESSORS", true)
+	// RingHashCap indicates the maximum ring size which defaults to 4096
+	// entries but may be overridden by setting the environment variable
+	// "GRPC_RING_HASH_CAP".  This does not override the default bounds
+	// checking which NACKs configs specifying ring sizes > 8*1024*1024 (~8M).
+	RingHashCap = uint64FromEnv("GRPC_RING_HASH_CAP", 4096, 1, 8*1024*1024)
+	// PickFirstLBConfig is set if we should support configuration of the
+	// pick_first LB policy, which can be enabled by setting the environment
+	// variable "GRPC_EXPERIMENTAL_PICKFIRST_LB_CONFIG" to "true".
+	PickFirstLBConfig = boolFromEnv("GRPC_EXPERIMENTAL_PICKFIRST_LB_CONFIG", false)
+	// ALTSMaxConcurrentHandshakes is the maximum number of concurrent ALTS
+	// handshakes that can be performed.
+	ALTSMaxConcurrentHandshakes = uint64FromEnv("GRPC_ALTS_MAX_CONCURRENT_HANDSHAKES", 100, 1, 100)
 )
+
+func boolFromEnv(envVar string, def bool) bool {
+	if def {
+		// The default is true; return true unless the variable is "false".
+		return !strings.EqualFold(os.Getenv(envVar), "false")
+	}
+	// The default is false; return false unless the variable is "true".
+	return strings.EqualFold(os.Getenv(envVar), "true")
+}
+
+func uint64FromEnv(envVar string, def, min, max uint64) uint64 {
+	v, err := strconv.ParseUint(os.Getenv(envVar), 10, 64)
+	if err != nil {
+		return def
+	}
+	if v < min {
+		return min
+	}
+	if v > max {
+		return max
+	}
+	return v
+}
diff --git a/.ci/providerlint/vendor/google.golang.org/grpc/internal/envconfig/observability.go b/.ci/providerlint/vendor/google.golang.org/grpc/internal/envconfig/observability.go
index 821dd0a7c19..dd314cfb18f 100644
--- a/.ci/providerlint/vendor/google.golang.org/grpc/internal/envconfig/observability.go
+++ b/.ci/providerlint/vendor/google.golang.org/grpc/internal/envconfig/observability.go
@@ -28,9 +28,15 @@ const (
 var (
 	// ObservabilityConfig is the json configuration for the gcp/observability
 	// package specified directly in the envObservabilityConfig env var.
+	//
+	// This is used in the 1.0 release of gcp/observability, and thus must not be
+	// deleted or changed.
 	ObservabilityConfig = os.Getenv(envObservabilityConfig)
 	// ObservabilityConfigFile is the json configuration for the
 	// gcp/observability specified in a file with the location specified in
 	// envObservabilityConfigFile env var.
+	//
+	// This is used in the 1.0 release of gcp/observability, and thus must not be
+	// deleted or changed.
 	ObservabilityConfigFile = os.Getenv(envObservabilityConfigFile)
 )
diff --git a/.ci/providerlint/vendor/google.golang.org/grpc/internal/envconfig/xds.go b/.ci/providerlint/vendor/google.golang.org/grpc/internal/envconfig/xds.go
index af09711a3e8..02b4b6a1c10 100644
--- a/.ci/providerlint/vendor/google.golang.org/grpc/internal/envconfig/xds.go
+++ b/.ci/providerlint/vendor/google.golang.org/grpc/internal/envconfig/xds.go
@@ -20,7 +20,6 @@ package envconfig
 
 import (
 	"os"
-	"strings"
 )
 
 const (
@@ -36,16 +35,6 @@ const (
 	//
 	// When both bootstrap FileName and FileContent are set, FileName is used.
 	XDSBootstrapFileContentEnv = "GRPC_XDS_BOOTSTRAP_CONFIG"
-
-	ringHashSupportEnv           = "GRPC_XDS_EXPERIMENTAL_ENABLE_RING_HASH"
-	clientSideSecuritySupportEnv = "GRPC_XDS_EXPERIMENTAL_SECURITY_SUPPORT"
-	aggregateAndDNSSupportEnv    = "GRPC_XDS_EXPERIMENTAL_ENABLE_AGGREGATE_AND_LOGICAL_DNS_CLUSTER"
-	rbacSupportEnv               = "GRPC_XDS_EXPERIMENTAL_RBAC"
-	outlierDetectionSupportEnv   = "GRPC_EXPERIMENTAL_ENABLE_OUTLIER_DETECTION"
-	federationEnv                = "GRPC_EXPERIMENTAL_XDS_FEDERATION"
-	rlsInXDSEnv                  = "GRPC_EXPERIMENTAL_XDS_RLS_LB"
-
-	c2pResolverTestOnlyTrafficDirectorURIEnv = "GRPC_TEST_ONLY_GOOGLE_C2P_RESOLVER_TRAFFIC_DIRECTOR_URI"
 )
 
 var (
@@ -64,38 +53,43 @@ var (
 	// XDSRingHash indicates whether ring hash support is enabled, which can be
 	// disabled by setting the environment variable
 	// "GRPC_XDS_EXPERIMENTAL_ENABLE_RING_HASH" to "false".
-	XDSRingHash = !strings.EqualFold(os.Getenv(ringHashSupportEnv), "false")
+	XDSRingHash = boolFromEnv("GRPC_XDS_EXPERIMENTAL_ENABLE_RING_HASH", true)
 	// XDSClientSideSecurity is used to control processing of security
 	// configuration on the client-side.
 	//
 	// Note that there is no env var protection for the server-side because we
 	// have a brand new API on the server-side and users explicitly need to use
 	// the new API to get security integration on the server.
-	XDSClientSideSecurity = !strings.EqualFold(os.Getenv(clientSideSecuritySupportEnv), "false")
-	// XDSAggregateAndDNS indicates whether processing of aggregated cluster
-	// and DNS cluster is enabled, which can be enabled by setting the
-	// environment variable
-	// "GRPC_XDS_EXPERIMENTAL_ENABLE_AGGREGATE_AND_LOGICAL_DNS_CLUSTER" to
-	// "true".
-	XDSAggregateAndDNS = !strings.EqualFold(os.Getenv(aggregateAndDNSSupportEnv), "false")
+	XDSClientSideSecurity = boolFromEnv("GRPC_XDS_EXPERIMENTAL_SECURITY_SUPPORT", true)
+	// XDSAggregateAndDNS indicates whether processing of aggregated cluster and
+	// DNS cluster is enabled, which can be disabled by setting the environment
+	// variable "GRPC_XDS_EXPERIMENTAL_ENABLE_AGGREGATE_AND_LOGICAL_DNS_CLUSTER"
+	// to "false".
+	XDSAggregateAndDNS = boolFromEnv("GRPC_XDS_EXPERIMENTAL_ENABLE_AGGREGATE_AND_LOGICAL_DNS_CLUSTER", true)
 
 	// XDSRBAC indicates whether xDS configured RBAC HTTP Filter is enabled,
 	// which can be disabled by setting the environment variable
 	// "GRPC_XDS_EXPERIMENTAL_RBAC" to "false".
-	XDSRBAC = !strings.EqualFold(os.Getenv(rbacSupportEnv), "false")
+	XDSRBAC = boolFromEnv("GRPC_XDS_EXPERIMENTAL_RBAC", true)
 	// XDSOutlierDetection indicates whether outlier detection support is
 	// enabled, which can be disabled by setting the environment variable
 	// "GRPC_EXPERIMENTAL_ENABLE_OUTLIER_DETECTION" to "false".
-	XDSOutlierDetection = !strings.EqualFold(os.Getenv(outlierDetectionSupportEnv), "false")
-	// XDSFederation indicates whether federation support is enabled.
-	XDSFederation = strings.EqualFold(os.Getenv(federationEnv), "true")
+	XDSOutlierDetection = boolFromEnv("GRPC_EXPERIMENTAL_ENABLE_OUTLIER_DETECTION", true)
+	// XDSFederation indicates whether federation support is enabled, which can
+	// be enabled by setting the environment variable
+	// "GRPC_EXPERIMENTAL_XDS_FEDERATION" to "true".
+	XDSFederation = boolFromEnv("GRPC_EXPERIMENTAL_XDS_FEDERATION", true)
 
 	// XDSRLS indicates whether processing of Cluster Specifier plugins and
-	// support for the RLS CLuster Specifier is enabled, which can be enabled by
+	// support for the RLS CLuster Specifier is enabled, which can be disabled by
 	// setting the environment variable "GRPC_EXPERIMENTAL_XDS_RLS_LB" to
-	// "true".
-	XDSRLS = strings.EqualFold(os.Getenv(rlsInXDSEnv), "true")
+	// "false".
+	XDSRLS = boolFromEnv("GRPC_EXPERIMENTAL_XDS_RLS_LB", true)
 
 	// C2PResolverTestOnlyTrafficDirectorURI is the TD URI for testing.
-	C2PResolverTestOnlyTrafficDirectorURI = os.Getenv(c2pResolverTestOnlyTrafficDirectorURIEnv)
+	C2PResolverTestOnlyTrafficDirectorURI = os.Getenv("GRPC_TEST_ONLY_GOOGLE_C2P_RESOLVER_TRAFFIC_DIRECTOR_URI")
+	// XDSCustomLBPolicy indicates whether Custom LB Policies are enabled, which
+	// can be disabled by setting the environment variable
+	// "GRPC_EXPERIMENTAL_XDS_CUSTOM_LB_CONFIG" to "false".
+	XDSCustomLBPolicy = boolFromEnv("GRPC_EXPERIMENTAL_XDS_CUSTOM_LB_CONFIG", true)
 )
diff --git a/.ci/providerlint/vendor/google.golang.org/grpc/internal/grpclog/prefixLogger.go b/.ci/providerlint/vendor/google.golang.org/grpc/internal/grpclog/prefixLogger.go
index 82af70e96f1..02224b42ca8 100644
--- a/.ci/providerlint/vendor/google.golang.org/grpc/internal/grpclog/prefixLogger.go
+++ b/.ci/providerlint/vendor/google.golang.org/grpc/internal/grpclog/prefixLogger.go
@@ -63,6 +63,9 @@ func (pl *PrefixLogger) Errorf(format string, args ...interface{}) {
 
 // Debugf does info logging at verbose level 2.
 func (pl *PrefixLogger) Debugf(format string, args ...interface{}) {
+	// TODO(6044): Refactor interfaces LoggerV2 and DepthLogger, and maybe
+	// rewrite PrefixLogger a little to ensure that we don't use the global
+	// `Logger` here, and instead use the `logger` field.
 	if !Logger.V(2) {
 		return
 	}
@@ -73,6 +76,15 @@ func (pl *PrefixLogger) Debugf(format string, args ...interface{}) {
 		return
 	}
 	InfoDepth(1, fmt.Sprintf(format, args...))
+
+}
+
+// V reports whether verbosity level l is at least the requested verbose level.
+func (pl *PrefixLogger) V(l int) bool {
+	// TODO(6044): Refactor interfaces LoggerV2 and DepthLogger, and maybe
+	// rewrite PrefixLogger a little to ensure that we don't use the global
+	// `Logger` here, and instead use the `logger` field.
+	return Logger.V(l)
 }
 
 // NewPrefixLogger creates a prefix logger with the given prefix.
diff --git a/.ci/providerlint/vendor/google.golang.org/grpc/internal/grpcrand/grpcrand.go b/.ci/providerlint/vendor/google.golang.org/grpc/internal/grpcrand/grpcrand.go
index 517ea70642a..aa97273e7d1 100644
--- a/.ci/providerlint/vendor/google.golang.org/grpc/internal/grpcrand/grpcrand.go
+++ b/.ci/providerlint/vendor/google.golang.org/grpc/internal/grpcrand/grpcrand.go
@@ -72,3 +72,24 @@ func Uint64() uint64 {
 	defer mu.Unlock()
 	return r.Uint64()
 }
+
+// Uint32 implements rand.Uint32 on the grpcrand global source.
+func Uint32() uint32 {
+	mu.Lock()
+	defer mu.Unlock()
+	return r.Uint32()
+}
+
+// ExpFloat64 implements rand.ExpFloat64 on the grpcrand global source.
+func ExpFloat64() float64 {
+	mu.Lock()
+	defer mu.Unlock()
+	return r.ExpFloat64()
+}
+
+// Shuffle implements rand.Shuffle on the grpcrand global source.
+var Shuffle = func(n int, f func(int, int)) {
+	mu.Lock()
+	defer mu.Unlock()
+	r.Shuffle(n, f)
+}
diff --git a/.ci/providerlint/vendor/google.golang.org/grpc/internal/grpcsync/callback_serializer.go b/.ci/providerlint/vendor/google.golang.org/grpc/internal/grpcsync/callback_serializer.go
new file mode 100644
index 00000000000..37b8d4117e7
--- /dev/null
+++ b/.ci/providerlint/vendor/google.golang.org/grpc/internal/grpcsync/callback_serializer.go
@@ -0,0 +1,119 @@
+/*
+ *
+ * Copyright 2022 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package grpcsync
+
+import (
+	"context"
+	"sync"
+
+	"google.golang.org/grpc/internal/buffer"
+)
+
+// CallbackSerializer provides a mechanism to schedule callbacks in a
+// synchronized manner. It provides a FIFO guarantee on the order of execution
+// of scheduled callbacks. New callbacks can be scheduled by invoking the
+// Schedule() method.
+//
+// This type is safe for concurrent access.
+type CallbackSerializer struct {
+	// Done is closed once the serializer is shut down completely, i.e all
+	// scheduled callbacks are executed and the serializer has deallocated all
+	// its resources.
+	Done chan struct{}
+
+	callbacks *buffer.Unbounded
+	closedMu  sync.Mutex
+	closed    bool
+}
+
+// NewCallbackSerializer returns a new CallbackSerializer instance. The provided
+// context will be passed to the scheduled callbacks. Users should cancel the
+// provided context to shutdown the CallbackSerializer. It is guaranteed that no
+// callbacks will be added once this context is canceled, and any pending un-run
+// callbacks will be executed before the serializer is shut down.
+func NewCallbackSerializer(ctx context.Context) *CallbackSerializer {
+	t := &CallbackSerializer{
+		Done:      make(chan struct{}),
+		callbacks: buffer.NewUnbounded(),
+	}
+	go t.run(ctx)
+	return t
+}
+
+// Schedule adds a callback to be scheduled after existing callbacks are run.
+//
+// Callbacks are expected to honor the context when performing any blocking
+// operations, and should return early when the context is canceled.
+//
+// Return value indicates if the callback was successfully added to the list of
+// callbacks to be executed by the serializer. It is not possible to add
+// callbacks once the context passed to NewCallbackSerializer is cancelled.
+func (t *CallbackSerializer) Schedule(f func(ctx context.Context)) bool {
+	t.closedMu.Lock()
+	defer t.closedMu.Unlock()
+
+	if t.closed {
+		return false
+	}
+	t.callbacks.Put(f)
+	return true
+}
+
+func (t *CallbackSerializer) run(ctx context.Context) {
+	var backlog []func(context.Context)
+
+	defer close(t.Done)
+	for ctx.Err() == nil {
+		select {
+		case <-ctx.Done():
+			// Do nothing here. Next iteration of the for loop will not happen,
+			// since ctx.Err() would be non-nil.
+		case callback, ok := <-t.callbacks.Get():
+			if !ok {
+				return
+			}
+			t.callbacks.Load()
+			callback.(func(ctx context.Context))(ctx)
+		}
+	}
+
+	// Fetch pending callbacks if any, and execute them before returning from
+	// this method and closing t.Done.
+	t.closedMu.Lock()
+	t.closed = true
+	backlog = t.fetchPendingCallbacks()
+	t.callbacks.Close()
+	t.closedMu.Unlock()
+	for _, b := range backlog {
+		b(ctx)
+	}
+}
+
+func (t *CallbackSerializer) fetchPendingCallbacks() []func(context.Context) {
+	var backlog []func(context.Context)
+	for {
+		select {
+		case b := <-t.callbacks.Get():
+			backlog = append(backlog, b.(func(context.Context)))
+			t.callbacks.Load()
+		default:
+			return backlog
+		}
+	}
+}
diff --git a/.ci/providerlint/vendor/google.golang.org/grpc/internal/grpcsync/pubsub.go b/.ci/providerlint/vendor/google.golang.org/grpc/internal/grpcsync/pubsub.go
new file mode 100644
index 00000000000..f58b5ffa6b1
--- /dev/null
+++ b/.ci/providerlint/vendor/google.golang.org/grpc/internal/grpcsync/pubsub.go
@@ -0,0 +1,136 @@
+/*
+ *
+ * Copyright 2023 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package grpcsync
+
+import (
+	"context"
+	"sync"
+)
+
+// Subscriber represents an entity that is subscribed to messages published on
+// a PubSub. It wraps the callback to be invoked by the PubSub when a new
+// message is published.
+type Subscriber interface {
+	// OnMessage is invoked when a new message is published. Implementations
+	// must not block in this method.
+	OnMessage(msg interface{})
+}
+
+// PubSub is a simple one-to-many publish-subscribe system that supports
+// messages of arbitrary type. It guarantees that messages are delivered in
+// the same order in which they were published.
+//
+// Publisher invokes the Publish() method to publish new messages, while
+// subscribers interested in receiving these messages register a callback
+// via the Subscribe() method.
+//
+// Once a PubSub is stopped, no more messages can be published, and
+// it is guaranteed that no more subscriber callback will be invoked.
+type PubSub struct {
+	cs     *CallbackSerializer
+	cancel context.CancelFunc
+
+	// Access to the below fields are guarded by this mutex.
+	mu          sync.Mutex
+	msg         interface{}
+	subscribers map[Subscriber]bool
+	stopped     bool
+}
+
+// NewPubSub returns a new PubSub instance.
+func NewPubSub() *PubSub {
+	ctx, cancel := context.WithCancel(context.Background())
+	return &PubSub{
+		cs:          NewCallbackSerializer(ctx),
+		cancel:      cancel,
+		subscribers: map[Subscriber]bool{},
+	}
+}
+
+// Subscribe registers the provided Subscriber to the PubSub.
+//
+// If the PubSub contains a previously published message, the Subscriber's
+// OnMessage() callback will be invoked asynchronously with the existing
+// message to begin with, and subsequently for every newly published message.
+//
+// The caller is responsible for invoking the returned cancel function to
+// unsubscribe itself from the PubSub.
+func (ps *PubSub) Subscribe(sub Subscriber) (cancel func()) {
+	ps.mu.Lock()
+	defer ps.mu.Unlock()
+
+	if ps.stopped {
+		return func() {}
+	}
+
+	ps.subscribers[sub] = true
+
+	if ps.msg != nil {
+		msg := ps.msg
+		ps.cs.Schedule(func(context.Context) {
+			ps.mu.Lock()
+			defer ps.mu.Unlock()
+			if !ps.subscribers[sub] {
+				return
+			}
+			sub.OnMessage(msg)
+		})
+	}
+
+	return func() {
+		ps.mu.Lock()
+		defer ps.mu.Unlock()
+		delete(ps.subscribers, sub)
+	}
+}
+
+// Publish publishes the provided message to the PubSub, and invokes
+// callbacks registered by subscribers asynchronously.
+func (ps *PubSub) Publish(msg interface{}) {
+	ps.mu.Lock()
+	defer ps.mu.Unlock()
+
+	if ps.stopped {
+		return
+	}
+
+	ps.msg = msg
+	for sub := range ps.subscribers {
+		s := sub
+		ps.cs.Schedule(func(context.Context) {
+			ps.mu.Lock()
+			defer ps.mu.Unlock()
+			if !ps.subscribers[s] {
+				return
+			}
+			s.OnMessage(msg)
+		})
+	}
+}
+
+// Stop shuts down the PubSub and releases any resources allocated by it.
+// It is guaranteed that no subscriber callbacks would be invoked once this
+// method returns.
+func (ps *PubSub) Stop() {
+	ps.mu.Lock()
+	defer ps.mu.Unlock()
+	ps.stopped = true
+
+	ps.cancel()
+}
diff --git a/.ci/providerlint/vendor/google.golang.org/grpc/internal/internal.go b/.ci/providerlint/vendor/google.golang.org/grpc/internal/internal.go
index fd0ee3dcaf1..42ff39c8444 100644
--- a/.ci/providerlint/vendor/google.golang.org/grpc/internal/internal.go
+++ b/.ci/providerlint/vendor/google.golang.org/grpc/internal/internal.go
@@ -58,6 +58,12 @@ var (
 	// gRPC server. An xDS-enabled server needs to know what type of credentials
 	// is configured on the underlying gRPC server. This is set by server.go.
 	GetServerCredentials interface{} // func (*grpc.Server) credentials.TransportCredentials
+	// CanonicalString returns the canonical string of the code defined here:
+	// https://github.com/grpc/grpc/blob/master/doc/statuscodes.md.
+	//
+	// This is used in the 1.0 release of gcp/observability, and thus must not be
+	// deleted or changed.
+	CanonicalString interface{} // func (codes.Code) string
 	// DrainServerTransports initiates a graceful close of existing connections
 	// on a gRPC server accepted on the provided listener address. An
 	// xDS-enabled server invokes this method on a grpc.Server when a particular
@@ -66,26 +72,54 @@ var (
 	// AddGlobalServerOptions adds an array of ServerOption that will be
 	// effective globally for newly created servers. The priority will be: 1.
 	// user-provided; 2. this method; 3. default values.
+	//
+	// This is used in the 1.0 release of gcp/observability, and thus must not be
+	// deleted or changed.
 	AddGlobalServerOptions interface{} // func(opt ...ServerOption)
 	// ClearGlobalServerOptions clears the array of extra ServerOption. This
 	// method is useful in testing and benchmarking.
+	//
+	// This is used in the 1.0 release of gcp/observability, and thus must not be
+	// deleted or changed.
 	ClearGlobalServerOptions func()
 	// AddGlobalDialOptions adds an array of DialOption that will be effective
 	// globally for newly created client channels. The priority will be: 1.
 	// user-provided; 2. this method; 3. default values.
+	//
+	// This is used in the 1.0 release of gcp/observability, and thus must not be
+	// deleted or changed.
 	AddGlobalDialOptions interface{} // func(opt ...DialOption)
+	// DisableGlobalDialOptions returns a DialOption that prevents the
+	// ClientConn from applying the global DialOptions (set via
+	// AddGlobalDialOptions).
+	//
+	// This is used in the 1.0 release of gcp/observability, and thus must not be
+	// deleted or changed.
+	DisableGlobalDialOptions interface{} // func() grpc.DialOption
 	// ClearGlobalDialOptions clears the array of extra DialOption. This
 	// method is useful in testing and benchmarking.
+	//
+	// This is used in the 1.0 release of gcp/observability, and thus must not be
+	// deleted or changed.
 	ClearGlobalDialOptions func()
+	// JoinDialOptions combines the dial options passed as arguments into a
+	// single dial option.
+	JoinDialOptions interface{} // func(...grpc.DialOption) grpc.DialOption
 	// JoinServerOptions combines the server options passed as arguments into a
 	// single server option.
 	JoinServerOptions interface{} // func(...grpc.ServerOption) grpc.ServerOption
 
 	// WithBinaryLogger returns a DialOption that specifies the binary logger
 	// for a ClientConn.
+	//
+	// This is used in the 1.0 release of gcp/observability, and thus must not be
+	// deleted or changed.
 	WithBinaryLogger interface{} // func(binarylog.Logger) grpc.DialOption
 	// BinaryLogger returns a ServerOption that can set the binary logger for a
 	// server.
+	//
+	// This is used in the 1.0 release of gcp/observability, and thus must not be
+	// deleted or changed.
 	BinaryLogger interface{} // func(binarylog.Logger) grpc.ServerOption
 
 	// NewXDSResolverWithConfigForTesting creates a new xds resolver builder using
@@ -127,6 +161,9 @@ var (
 	//
 	// TODO: Remove this function once the RBAC env var is removed.
 	UnregisterRBACHTTPFilterForTesting func()
+
+	// ORCAAllowAnyMinReportingInterval is for examples/orca use ONLY.
+	ORCAAllowAnyMinReportingInterval interface{} // func(so *orca.ServiceOptions)
 )
 
 // HealthChecker defines the signature of the client-side LB channel health checking function.
diff --git a/.ci/providerlint/vendor/google.golang.org/grpc/internal/metadata/metadata.go b/.ci/providerlint/vendor/google.golang.org/grpc/internal/metadata/metadata.go
index b2980f8ac44..c82e608e077 100644
--- a/.ci/providerlint/vendor/google.golang.org/grpc/internal/metadata/metadata.go
+++ b/.ci/providerlint/vendor/google.golang.org/grpc/internal/metadata/metadata.go
@@ -76,33 +76,11 @@ func Set(addr resolver.Address, md metadata.MD) resolver.Address {
 	return addr
 }
 
-// Validate returns an error if the input md contains invalid keys or values.
-//
-// If the header is not a pseudo-header, the following items are checked:
-// - header names must contain one or more characters from this set [0-9 a-z _ - .].
-// - if the header-name ends with a "-bin" suffix, no validation of the header value is performed.
-// - otherwise, the header value must contain one or more characters from the set [%x20-%x7E].
+// Validate validates every pair in md with ValidatePair.
 func Validate(md metadata.MD) error {
 	for k, vals := range md {
-		// pseudo-header will be ignored
-		if k[0] == ':' {
-			continue
-		}
-		// check key, for i that saving a conversion if not using for range
-		for i := 0; i < len(k); i++ {
-			r := k[i]
-			if !(r >= 'a' && r <= 'z') && !(r >= '0' && r <= '9') && r != '.' && r != '-' && r != '_' {
-				return fmt.Errorf("header key %q contains illegal characters not in [0-9a-z-_.]", k)
-			}
-		}
-		if strings.HasSuffix(k, "-bin") {
-			continue
-		}
-		// check value
-		for _, val := range vals {
-			if hasNotPrintable(val) {
-				return fmt.Errorf("header key %q contains value with non-printable ASCII characters", k)
-			}
+		if err := ValidatePair(k, vals...); err != nil {
+			return err
 		}
 	}
 	return nil
@@ -118,3 +96,37 @@ func hasNotPrintable(msg string) bool {
 	}
 	return false
 }
+
+// ValidatePair validate a key-value pair with the following rules (the pseudo-header will be skipped) :
+//
+// - key must contain one or more characters.
+// - the characters in the key must be contained in [0-9 a-z _ - .].
+// - if the key ends with a "-bin" suffix, no validation of the corresponding value is performed.
+// - the characters in the every value must be printable (in [%x20-%x7E]).
+func ValidatePair(key string, vals ...string) error {
+	// key should not be empty
+	if key == "" {
+		return fmt.Errorf("there is an empty key in the header")
+	}
+	// pseudo-header will be ignored
+	if key[0] == ':' {
+		return nil
+	}
+	// check key, for i that saving a conversion if not using for range
+	for i := 0; i < len(key); i++ {
+		r := key[i]
+		if !(r >= 'a' && r <= 'z') && !(r >= '0' && r <= '9') && r != '.' && r != '-' && r != '_' {
+			return fmt.Errorf("header key %q contains illegal characters not in [0-9a-z-_.]", key)
+		}
+	}
+	if strings.HasSuffix(key, "-bin") {
+		return nil
+	}
+	// check value
+	for _, val := range vals {
+		if hasNotPrintable(val) {
+			return fmt.Errorf("header key %q contains value with non-printable ASCII characters", key)
+		}
+	}
+	return nil
+}
diff --git a/.ci/providerlint/vendor/google.golang.org/grpc/internal/resolver/dns/dns_resolver.go b/.ci/providerlint/vendor/google.golang.org/grpc/internal/resolver/dns/dns_resolver.go
index 75301c51491..99e1e5b36c8 100644
--- a/.ci/providerlint/vendor/google.golang.org/grpc/internal/resolver/dns/dns_resolver.go
+++ b/.ci/providerlint/vendor/google.golang.org/grpc/internal/resolver/dns/dns_resolver.go
@@ -62,7 +62,8 @@ const (
 	defaultPort       = "443"
 	defaultDNSSvrPort = "53"
 	golang            = "GO"
-	// txtPrefix is the prefix string to be prepended to the host name for txt record lookup.
+	// txtPrefix is the prefix string to be prepended to the host name for txt
+	// record lookup.
 	txtPrefix = "_grpc_config."
 	// In DNS, service config is encoded in a TXT record via the mechanism
 	// described in RFC-1464 using the attribute name grpc_config.
@@ -86,14 +87,14 @@ var (
 	minDNSResRate = 30 * time.Second
 )
 
-var customAuthorityDialler = func(authority string) func(ctx context.Context, network, address string) (net.Conn, error) {
-	return func(ctx context.Context, network, address string) (net.Conn, error) {
+var addressDialer = func(address string) func(context.Context, string, string) (net.Conn, error) {
+	return func(ctx context.Context, network, _ string) (net.Conn, error) {
 		var dialer net.Dialer
-		return dialer.DialContext(ctx, network, authority)
+		return dialer.DialContext(ctx, network, address)
 	}
 }
 
-var customAuthorityResolver = func(authority string) (netResolver, error) {
+var newNetResolver = func(authority string) (netResolver, error) {
 	host, port, err := parseTarget(authority, defaultDNSSvrPort)
 	if err != nil {
 		return nil, err
@@ -103,7 +104,7 @@ var customAuthorityResolver = func(authority string) (netResolver, error) {
 
 	return &net.Resolver{
 		PreferGo: true,
-		Dial:     customAuthorityDialler(authorityWithPort),
+		Dial:     addressDialer(authorityWithPort),
 	}, nil
 }
 
@@ -114,9 +115,10 @@ func NewBuilder() resolver.Builder {
 
 type dnsBuilder struct{}
 
-// Build creates and starts a DNS resolver that watches the name resolution of the target.
+// Build creates and starts a DNS resolver that watches the name resolution of
+// the target.
 func (b *dnsBuilder) Build(target resolver.Target, cc resolver.ClientConn, opts resolver.BuildOptions) (resolver.Resolver, error) {
-	host, port, err := parseTarget(target.Endpoint, defaultPort)
+	host, port, err := parseTarget(target.Endpoint(), defaultPort)
 	if err != nil {
 		return nil, err
 	}
@@ -140,10 +142,10 @@ func (b *dnsBuilder) Build(target resolver.Target, cc resolver.ClientConn, opts
 		disableServiceConfig: opts.DisableServiceConfig,
 	}
 
-	if target.Authority == "" {
+	if target.URL.Host == "" {
 		d.resolver = defaultResolver
 	} else {
-		d.resolver, err = customAuthorityResolver(target.Authority)
+		d.resolver, err = newNetResolver(target.URL.Host)
 		if err != nil {
 			return nil, err
 		}
@@ -180,19 +182,22 @@ type dnsResolver struct {
 	ctx      context.Context
 	cancel   context.CancelFunc
 	cc       resolver.ClientConn
-	// rn channel is used by ResolveNow() to force an immediate resolution of the target.
+	// rn channel is used by ResolveNow() to force an immediate resolution of the
+	// target.
 	rn chan struct{}
-	// wg is used to enforce Close() to return after the watcher() goroutine has finished.
-	// Otherwise, data race will be possible. [Race Example] in dns_resolver_test we
-	// replace the real lookup functions with mocked ones to facilitate testing.
-	// If Close() doesn't wait for watcher() goroutine finishes, race detector sometimes
-	// will warns lookup (READ the lookup function pointers) inside watcher() goroutine
-	// has data race with replaceNetFunc (WRITE the lookup function pointers).
+	// wg is used to enforce Close() to return after the watcher() goroutine has
+	// finished. Otherwise, data race will be possible. [Race Example] in
+	// dns_resolver_test we replace the real lookup functions with mocked ones to
+	// facilitate testing. If Close() doesn't wait for watcher() goroutine
+	// finishes, race detector sometimes will warns lookup (READ the lookup
+	// function pointers) inside watcher() goroutine has data race with
+	// replaceNetFunc (WRITE the lookup function pointers).
 	wg                   sync.WaitGroup
 	disableServiceConfig bool
 }
 
-// ResolveNow invoke an immediate resolution of the target that this dnsResolver watches.
+// ResolveNow invoke an immediate resolution of the target that this
+// dnsResolver watches.
 func (d *dnsResolver) ResolveNow(resolver.ResolveNowOptions) {
 	select {
 	case d.rn <- struct{}{}:
@@ -220,8 +225,8 @@ func (d *dnsResolver) watcher() {
 
 		var timer *time.Timer
 		if err == nil {
-			// Success resolving, wait for the next ResolveNow. However, also wait 30 seconds at the very least
-			// to prevent constantly re-resolving.
+			// Success resolving, wait for the next ResolveNow. However, also wait 30
+			// seconds at the very least to prevent constantly re-resolving.
 			backoffIndex = 1
 			timer = newTimerDNSResRate(minDNSResRate)
 			select {
@@ -231,7 +236,8 @@ func (d *dnsResolver) watcher() {
 			case <-d.rn:
 			}
 		} else {
-			// Poll on an error found in DNS Resolver or an error received from ClientConn.
+			// Poll on an error found in DNS Resolver or an error received from
+			// ClientConn.
 			timer = newTimer(backoff.DefaultExponential.Backoff(backoffIndex))
 			backoffIndex++
 		}
@@ -278,7 +284,8 @@ func (d *dnsResolver) lookupSRV() ([]resolver.Address, error) {
 }
 
 func handleDNSError(err error, lookupType string) error {
-	if dnsErr, ok := err.(*net.DNSError); ok && !dnsErr.IsTimeout && !dnsErr.IsTemporary {
+	dnsErr, ok := err.(*net.DNSError)
+	if ok && !dnsErr.IsTimeout && !dnsErr.IsTemporary {
 		// Timeouts and temporary errors should be communicated to gRPC to
 		// attempt another DNS query (with backoff).  Other errors should be
 		// suppressed (they may represent the absence of a TXT record).
@@ -307,10 +314,12 @@ func (d *dnsResolver) lookupTXT() *serviceconfig.ParseResult {
 		res += s
 	}
 
-	// TXT record must have "grpc_config=" attribute in order to be used as service config.
+	// TXT record must have "grpc_config=" attribute in order to be used as
+	// service config.
 	if !strings.HasPrefix(res, txtAttribute) {
 		logger.Warningf("dns: TXT record %v missing %v attribute", res, txtAttribute)
-		// This is not an error; it is the equivalent of not having a service config.
+		// This is not an error; it is the equivalent of not having a service
+		// config.
 		return nil
 	}
 	sc := canaryingSC(strings.TrimPrefix(res, txtAttribute))
@@ -352,9 +361,10 @@ func (d *dnsResolver) lookup() (*resolver.State, error) {
 	return &state, nil
 }
 
-// formatIP returns ok = false if addr is not a valid textual representation of an IP address.
-// If addr is an IPv4 address, return the addr and ok = true.
-// If addr is an IPv6 address, return the addr enclosed in square brackets and ok = true.
+// formatIP returns ok = false if addr is not a valid textual representation of
+// an IP address. If addr is an IPv4 address, return the addr and ok = true.
+// If addr is an IPv6 address, return the addr enclosed in square brackets and
+// ok = true.
 func formatIP(addr string) (addrIP string, ok bool) {
 	ip := net.ParseIP(addr)
 	if ip == nil {
@@ -366,10 +376,10 @@ func formatIP(addr string) (addrIP string, ok bool) {
 	return "[" + addr + "]", true
 }
 
-// parseTarget takes the user input target string and default port, returns formatted host and port info.
-// If target doesn't specify a port, set the port to be the defaultPort.
-// If target is in IPv6 format and host-name is enclosed in square brackets, brackets
-// are stripped when setting the host.
+// parseTarget takes the user input target string and default port, returns
+// formatted host and port info. If target doesn't specify a port, set the port
+// to be the defaultPort. If target is in IPv6 format and host-name is enclosed
+// in square brackets, brackets are stripped when setting the host.
 // examples:
 // target: "www.google.com" defaultPort: "443" returns host: "www.google.com", port: "443"
 // target: "ipv4-host:80" defaultPort: "443" returns host: "ipv4-host", port: "80"
@@ -385,12 +395,14 @@ func parseTarget(target, defaultPort string) (host, port string, err error) {
 	}
 	if host, port, err = net.SplitHostPort(target); err == nil {
 		if port == "" {
-			// If the port field is empty (target ends with colon), e.g. "[::1]:", this is an error.
+			// If the port field is empty (target ends with colon), e.g. "[::1]:",
+			// this is an error.
 			return "", "", errEndsWithColon
 		}
 		// target has port, i.e ipv4-host:port, [ipv6-host]:port, host-name:port
 		if host == "" {
-			// Keep consistent with net.Dial(): If the host is empty, as in ":80", the local system is assumed.
+			// Keep consistent with net.Dial(): If the host is empty, as in ":80",
+			// the local system is assumed.
 			host = "localhost"
 		}
 		return host, port, nil
diff --git a/.ci/providerlint/vendor/google.golang.org/grpc/internal/resolver/passthrough/passthrough.go b/.ci/providerlint/vendor/google.golang.org/grpc/internal/resolver/passthrough/passthrough.go
index 520d9229e1e..afac56572ad 100644
--- a/.ci/providerlint/vendor/google.golang.org/grpc/internal/resolver/passthrough/passthrough.go
+++ b/.ci/providerlint/vendor/google.golang.org/grpc/internal/resolver/passthrough/passthrough.go
@@ -20,13 +20,20 @@
 // name without scheme back to gRPC as resolved address.
 package passthrough
 
-import "google.golang.org/grpc/resolver"
+import (
+	"errors"
+
+	"google.golang.org/grpc/resolver"
+)
 
 const scheme = "passthrough"
 
 type passthroughBuilder struct{}
 
 func (*passthroughBuilder) Build(target resolver.Target, cc resolver.ClientConn, opts resolver.BuildOptions) (resolver.Resolver, error) {
+	if target.Endpoint() == "" && opts.Dialer == nil {
+		return nil, errors.New("passthrough: received empty target in Build()")
+	}
 	r := &passthroughResolver{
 		target: target,
 		cc:     cc,
@@ -45,7 +52,7 @@ type passthroughResolver struct {
 }
 
 func (r *passthroughResolver) start() {
-	r.cc.UpdateState(resolver.State{Addresses: []resolver.Address{{Addr: r.target.Endpoint}}})
+	r.cc.UpdateState(resolver.State{Addresses: []resolver.Address{{Addr: r.target.Endpoint()}}})
 }
 
 func (*passthroughResolver) ResolveNow(o resolver.ResolveNowOptions) {}
diff --git a/.ci/providerlint/vendor/google.golang.org/grpc/internal/resolver/unix/unix.go b/.ci/providerlint/vendor/google.golang.org/grpc/internal/resolver/unix/unix.go
index 7f1a702cacb..16091168773 100644
--- a/.ci/providerlint/vendor/google.golang.org/grpc/internal/resolver/unix/unix.go
+++ b/.ci/providerlint/vendor/google.golang.org/grpc/internal/resolver/unix/unix.go
@@ -34,8 +34,8 @@ type builder struct {
 }
 
 func (b *builder) Build(target resolver.Target, cc resolver.ClientConn, _ resolver.BuildOptions) (resolver.Resolver, error) {
-	if target.Authority != "" {
-		return nil, fmt.Errorf("invalid (non-empty) authority: %v", target.Authority)
+	if target.URL.Host != "" {
+		return nil, fmt.Errorf("invalid (non-empty) authority: %v", target.URL.Host)
 	}
 
 	// gRPC was parsing the dial target manually before PR #4817, and we
diff --git a/.ci/providerlint/vendor/google.golang.org/grpc/internal/serviceconfig/duration.go b/.ci/providerlint/vendor/google.golang.org/grpc/internal/serviceconfig/duration.go
new file mode 100644
index 00000000000..11d82afcc7e
--- /dev/null
+++ b/.ci/providerlint/vendor/google.golang.org/grpc/internal/serviceconfig/duration.go
@@ -0,0 +1,130 @@
+/*
+ *
+ * Copyright 2023 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package serviceconfig
+
+import (
+	"encoding/json"
+	"fmt"
+	"math"
+	"strconv"
+	"strings"
+	"time"
+)
+
+// Duration defines JSON marshal and unmarshal methods to conform to the
+// protobuf JSON spec defined [here].
+//
+// [here]: https://protobuf.dev/reference/protobuf/google.protobuf/#duration
+type Duration time.Duration
+
+func (d Duration) String() string {
+	return fmt.Sprint(time.Duration(d))
+}
+
+// MarshalJSON converts from d to a JSON string output.
+func (d Duration) MarshalJSON() ([]byte, error) {
+	ns := time.Duration(d).Nanoseconds()
+	sec := ns / int64(time.Second)
+	ns = ns % int64(time.Second)
+
+	var sign string
+	if sec < 0 || ns < 0 {
+		sign, sec, ns = "-", -1*sec, -1*ns
+	}
+
+	// Generated output always contains 0, 3, 6, or 9 fractional digits,
+	// depending on required precision.
+	str := fmt.Sprintf("%s%d.%09d", sign, sec, ns)
+	str = strings.TrimSuffix(str, "000")
+	str = strings.TrimSuffix(str, "000")
+	str = strings.TrimSuffix(str, ".000")
+	return []byte(fmt.Sprintf("\"%ss\"", str)), nil
+}
+
+// UnmarshalJSON unmarshals b as a duration JSON string into d.
+func (d *Duration) UnmarshalJSON(b []byte) error {
+	var s string
+	if err := json.Unmarshal(b, &s); err != nil {
+		return err
+	}
+	if !strings.HasSuffix(s, "s") {
+		return fmt.Errorf("malformed duration %q: missing seconds unit", s)
+	}
+	neg := false
+	if s[0] == '-' {
+		neg = true
+		s = s[1:]
+	}
+	ss := strings.SplitN(s[:len(s)-1], ".", 3)
+	if len(ss) > 2 {
+		return fmt.Errorf("malformed duration %q: too many decimals", s)
+	}
+	// hasDigits is set if either the whole or fractional part of the number is
+	// present, since both are optional but one is required.
+	hasDigits := false
+	var sec, ns int64
+	if len(ss[0]) > 0 {
+		var err error
+		if sec, err = strconv.ParseInt(ss[0], 10, 64); err != nil {
+			return fmt.Errorf("malformed duration %q: %v", s, err)
+		}
+		// Maximum seconds value per the durationpb spec.
+		const maxProtoSeconds = 315_576_000_000
+		if sec > maxProtoSeconds {
+			return fmt.Errorf("out of range: %q", s)
+		}
+		hasDigits = true
+	}
+	if len(ss) == 2 && len(ss[1]) > 0 {
+		if len(ss[1]) > 9 {
+			return fmt.Errorf("malformed duration %q: too many digits after decimal", s)
+		}
+		var err error
+		if ns, err = strconv.ParseInt(ss[1], 10, 64); err != nil {
+			return fmt.Errorf("malformed duration %q: %v", s, err)
+		}
+		for i := 9; i > len(ss[1]); i-- {
+			ns *= 10
+		}
+		hasDigits = true
+	}
+	if !hasDigits {
+		return fmt.Errorf("malformed duration %q: contains no numbers", s)
+	}
+
+	if neg {
+		sec *= -1
+		ns *= -1
+	}
+
+	// Maximum/minimum seconds/nanoseconds representable by Go's time.Duration.
+	const maxSeconds = math.MaxInt64 / int64(time.Second)
+	const maxNanosAtMaxSeconds = math.MaxInt64 % int64(time.Second)
+	const minSeconds = math.MinInt64 / int64(time.Second)
+	const minNanosAtMinSeconds = math.MinInt64 % int64(time.Second)
+
+	if sec > maxSeconds || (sec == maxSeconds && ns >= maxNanosAtMaxSeconds) {
+		*d = Duration(math.MaxInt64)
+	} else if sec < minSeconds || (sec == minSeconds && ns <= minNanosAtMinSeconds) {
+		*d = Duration(math.MinInt64)
+	} else {
+		*d = Duration(sec*int64(time.Second) + ns)
+	}
+	return nil
+}
diff --git a/.ci/providerlint/vendor/google.golang.org/grpc/internal/transport/controlbuf.go b/.ci/providerlint/vendor/google.golang.org/grpc/internal/transport/controlbuf.go
index 409769f48fd..be5a9c81eb9 100644
--- a/.ci/providerlint/vendor/google.golang.org/grpc/internal/transport/controlbuf.go
+++ b/.ci/providerlint/vendor/google.golang.org/grpc/internal/transport/controlbuf.go
@@ -22,6 +22,7 @@ import (
 	"bytes"
 	"errors"
 	"fmt"
+	"net"
 	"runtime"
 	"strconv"
 	"sync"
@@ -29,6 +30,7 @@ import (
 
 	"golang.org/x/net/http2"
 	"golang.org/x/net/http2/hpack"
+	"google.golang.org/grpc/internal/grpclog"
 	"google.golang.org/grpc/internal/grpcutil"
 	"google.golang.org/grpc/status"
 )
@@ -191,7 +193,7 @@ type goAway struct {
 	code      http2.ErrCode
 	debugData []byte
 	headsUp   bool
-	closeConn bool
+	closeConn error // if set, loopyWriter will exit, resulting in conn closure
 }
 
 func (*goAway) isTransportResponseFrame() bool { return false }
@@ -209,6 +211,14 @@ type outFlowControlSizeRequest struct {
 
 func (*outFlowControlSizeRequest) isTransportResponseFrame() bool { return false }
 
+// closeConnection is an instruction to tell the loopy writer to flush the
+// framer and exit, which will cause the transport's connection to be closed
+// (by the client or server).  The transport itself will close after the reader
+// encounters the EOF caused by the connection closure.
+type closeConnection struct{}
+
+func (closeConnection) isTransportResponseFrame() bool { return false }
+
 type outStreamState int
 
 const (
@@ -408,7 +418,7 @@ func (c *controlBuffer) get(block bool) (interface{}, error) {
 		select {
 		case <-c.ch:
 		case <-c.done:
-			return nil, ErrConnClosing
+			return nil, errors.New("transport closed by client")
 		}
 	}
 }
@@ -478,12 +488,14 @@ type loopyWriter struct {
 	hEnc          *hpack.Encoder // HPACK encoder.
 	bdpEst        *bdpEstimator
 	draining      bool
+	conn          net.Conn
+	logger        *grpclog.PrefixLogger
 
 	// Side-specific handlers
 	ssGoAwayHandler func(*goAway) (bool, error)
 }
 
-func newLoopyWriter(s side, fr *framer, cbuf *controlBuffer, bdpEst *bdpEstimator) *loopyWriter {
+func newLoopyWriter(s side, fr *framer, cbuf *controlBuffer, bdpEst *bdpEstimator, conn net.Conn, logger *grpclog.PrefixLogger) *loopyWriter {
 	var buf bytes.Buffer
 	l := &loopyWriter{
 		side:          s,
@@ -496,6 +508,8 @@ func newLoopyWriter(s side, fr *framer, cbuf *controlBuffer, bdpEst *bdpEstimato
 		hBuf:          &buf,
 		hEnc:          hpack.NewEncoder(&buf),
 		bdpEst:        bdpEst,
+		conn:          conn,
+		logger:        logger,
 	}
 	return l
 }
@@ -513,23 +527,26 @@ const minBatchSize = 1000
 // 2. Stream level flow control quota available.
 //
 // In each iteration of run loop, other than processing the incoming control
-// frame, loopy calls processData, which processes one node from the activeStreams linked-list.
-// This results in writing of HTTP2 frames into an underlying write buffer.
-// When there's no more control frames to read from controlBuf, loopy flushes the write buffer.
-// As an optimization, to increase the batch size for each flush, loopy yields the processor, once
-// if the batch size is too low to give stream goroutines a chance to fill it up.
+// frame, loopy calls processData, which processes one node from the
+// activeStreams linked-list.  This results in writing of HTTP2 frames into an
+// underlying write buffer.  When there's no more control frames to read from
+// controlBuf, loopy flushes the write buffer.  As an optimization, to increase
+// the batch size for each flush, loopy yields the processor, once if the batch
+// size is too low to give stream goroutines a chance to fill it up.
+//
+// Upon exiting, if the error causing the exit is not an I/O error, run()
+// flushes and closes the underlying connection.  Otherwise, the connection is
+// left open to allow the I/O error to be encountered by the reader instead.
 func (l *loopyWriter) run() (err error) {
 	defer func() {
-		if err == ErrConnClosing {
-			// Don't log ErrConnClosing as error since it happens
-			// 1. When the connection is closed by some other known issue.
-			// 2. User closed the connection.
-			// 3. A graceful close of connection.
-			if logger.V(logLevel) {
-				logger.Infof("transport: loopyWriter.run returning. %v", err)
-			}
-			err = nil
+		if l.logger.V(logLevel) {
+			l.logger.Infof("loopyWriter exiting with error: %v", err)
 		}
+		if !isIOError(err) {
+			l.framer.writer.Flush()
+			l.conn.Close()
+		}
+		l.cbuf.finish()
 	}()
 	for {
 		it, err := l.cbuf.get(true)
@@ -574,7 +591,6 @@ func (l *loopyWriter) run() (err error) {
 			}
 			l.framer.writer.Flush()
 			break hasdata
-
 		}
 	}
 }
@@ -583,11 +599,11 @@ func (l *loopyWriter) outgoingWindowUpdateHandler(w *outgoingWindowUpdate) error
 	return l.framer.fr.WriteWindowUpdate(w.streamID, w.increment)
 }
 
-func (l *loopyWriter) incomingWindowUpdateHandler(w *incomingWindowUpdate) error {
+func (l *loopyWriter) incomingWindowUpdateHandler(w *incomingWindowUpdate) {
 	// Otherwise update the quota.
 	if w.streamID == 0 {
 		l.sendQuota += w.increment
-		return nil
+		return
 	}
 	// Find the stream and update it.
 	if str, ok := l.estdStreams[w.streamID]; ok {
@@ -595,10 +611,9 @@ func (l *loopyWriter) incomingWindowUpdateHandler(w *incomingWindowUpdate) error
 		if strQuota := int(l.oiws) - str.bytesOutStanding; strQuota > 0 && str.state == waitingOnStreamQuota {
 			str.state = active
 			l.activeStreams.enqueue(str)
-			return nil
+			return
 		}
 	}
-	return nil
 }
 
 func (l *loopyWriter) outgoingSettingsHandler(s *outgoingSettings) error {
@@ -606,13 +621,11 @@ func (l *loopyWriter) outgoingSettingsHandler(s *outgoingSettings) error {
 }
 
 func (l *loopyWriter) incomingSettingsHandler(s *incomingSettings) error {
-	if err := l.applySettings(s.ss); err != nil {
-		return err
-	}
+	l.applySettings(s.ss)
 	return l.framer.fr.WriteSettingsAck()
 }
 
-func (l *loopyWriter) registerStreamHandler(h *registerStream) error {
+func (l *loopyWriter) registerStreamHandler(h *registerStream) {
 	str := &outStream{
 		id:    h.streamID,
 		state: empty,
@@ -620,15 +633,14 @@ func (l *loopyWriter) registerStreamHandler(h *registerStream) error {
 		wq:    h.wq,
 	}
 	l.estdStreams[h.streamID] = str
-	return nil
 }
 
 func (l *loopyWriter) headerHandler(h *headerFrame) error {
 	if l.side == serverSide {
 		str, ok := l.estdStreams[h.streamID]
 		if !ok {
-			if logger.V(logLevel) {
-				logger.Warningf("transport: loopy doesn't recognize the stream: %d", h.streamID)
+			if l.logger.V(logLevel) {
+				l.logger.Infof("Unrecognized streamID %d in loopyWriter", h.streamID)
 			}
 			return nil
 		}
@@ -655,19 +667,20 @@ func (l *loopyWriter) headerHandler(h *headerFrame) error {
 		itl:   &itemList{},
 		wq:    h.wq,
 	}
-	str.itl.enqueue(h)
-	return l.originateStream(str)
+	return l.originateStream(str, h)
 }
 
-func (l *loopyWriter) originateStream(str *outStream) error {
-	hdr := str.itl.dequeue().(*headerFrame)
-	if err := hdr.initStream(str.id); err != nil {
-		if err == ErrConnClosing {
-			return err
-		}
-		// Other errors(errStreamDrain) need not close transport.
+func (l *loopyWriter) originateStream(str *outStream, hdr *headerFrame) error {
+	// l.draining is set when handling GoAway. In which case, we want to avoid
+	// creating new streams.
+	if l.draining {
+		// TODO: provide a better error with the reason we are in draining.
+		hdr.onOrphaned(errStreamDrain)
 		return nil
 	}
+	if err := hdr.initStream(str.id); err != nil {
+		return err
+	}
 	if err := l.writeHeader(str.id, hdr.endStream, hdr.hf, hdr.onWrite); err != nil {
 		return err
 	}
@@ -682,8 +695,8 @@ func (l *loopyWriter) writeHeader(streamID uint32, endStream bool, hf []hpack.He
 	l.hBuf.Reset()
 	for _, f := range hf {
 		if err := l.hEnc.WriteField(f); err != nil {
-			if logger.V(logLevel) {
-				logger.Warningf("transport: loopyWriter.writeHeader encountered error while encoding headers: %v", err)
+			if l.logger.V(logLevel) {
+				l.logger.Warningf("Encountered error while encoding headers: %v", err)
 			}
 		}
 	}
@@ -721,10 +734,10 @@ func (l *loopyWriter) writeHeader(streamID uint32, endStream bool, hf []hpack.He
 	return nil
 }
 
-func (l *loopyWriter) preprocessData(df *dataFrame) error {
+func (l *loopyWriter) preprocessData(df *dataFrame) {
 	str, ok := l.estdStreams[df.streamID]
 	if !ok {
-		return nil
+		return
 	}
 	// If we got data for a stream it means that
 	// stream was originated and the headers were sent out.
@@ -733,7 +746,6 @@ func (l *loopyWriter) preprocessData(df *dataFrame) error {
 		str.state = active
 		l.activeStreams.enqueue(str)
 	}
-	return nil
 }
 
 func (l *loopyWriter) pingHandler(p *ping) error {
@@ -744,9 +756,8 @@ func (l *loopyWriter) pingHandler(p *ping) error {
 
 }
 
-func (l *loopyWriter) outFlowControlSizeRequestHandler(o *outFlowControlSizeRequest) error {
+func (l *loopyWriter) outFlowControlSizeRequestHandler(o *outFlowControlSizeRequest) {
 	o.resp <- l.sendQuota
-	return nil
 }
 
 func (l *loopyWriter) cleanupStreamHandler(c *cleanupStream) error {
@@ -763,8 +774,9 @@ func (l *loopyWriter) cleanupStreamHandler(c *cleanupStream) error {
 			return err
 		}
 	}
-	if l.side == clientSide && l.draining && len(l.estdStreams) == 0 {
-		return ErrConnClosing
+	if l.draining && len(l.estdStreams) == 0 {
+		// Flush and close the connection; we are done with it.
+		return errors.New("finished processing active streams while in draining mode")
 	}
 	return nil
 }
@@ -799,7 +811,8 @@ func (l *loopyWriter) incomingGoAwayHandler(*incomingGoAway) error {
 	if l.side == clientSide {
 		l.draining = true
 		if len(l.estdStreams) == 0 {
-			return ErrConnClosing
+			// Flush and close the connection; we are done with it.
+			return errors.New("received GOAWAY with no active streams")
 		}
 	}
 	return nil
@@ -820,7 +833,7 @@ func (l *loopyWriter) goAwayHandler(g *goAway) error {
 func (l *loopyWriter) handle(i interface{}) error {
 	switch i := i.(type) {
 	case *incomingWindowUpdate:
-		return l.incomingWindowUpdateHandler(i)
+		l.incomingWindowUpdateHandler(i)
 	case *outgoingWindowUpdate:
 		return l.outgoingWindowUpdateHandler(i)
 	case *incomingSettings:
@@ -830,7 +843,7 @@ func (l *loopyWriter) handle(i interface{}) error {
 	case *headerFrame:
 		return l.headerHandler(i)
 	case *registerStream:
-		return l.registerStreamHandler(i)
+		l.registerStreamHandler(i)
 	case *cleanupStream:
 		return l.cleanupStreamHandler(i)
 	case *earlyAbortStream:
@@ -838,19 +851,24 @@ func (l *loopyWriter) handle(i interface{}) error {
 	case *incomingGoAway:
 		return l.incomingGoAwayHandler(i)
 	case *dataFrame:
-		return l.preprocessData(i)
+		l.preprocessData(i)
 	case *ping:
 		return l.pingHandler(i)
 	case *goAway:
 		return l.goAwayHandler(i)
 	case *outFlowControlSizeRequest:
-		return l.outFlowControlSizeRequestHandler(i)
+		l.outFlowControlSizeRequestHandler(i)
+	case closeConnection:
+		// Just return a non-I/O error and run() will flush and close the
+		// connection.
+		return ErrConnClosing
 	default:
 		return fmt.Errorf("transport: unknown control message type %T", i)
 	}
+	return nil
 }
 
-func (l *loopyWriter) applySettings(ss []http2.Setting) error {
+func (l *loopyWriter) applySettings(ss []http2.Setting) {
 	for _, s := range ss {
 		switch s.ID {
 		case http2.SettingInitialWindowSize:
@@ -869,7 +887,6 @@ func (l *loopyWriter) applySettings(ss []http2.Setting) error {
 			updateHeaderTblSize(l.hEnc, s.Val)
 		}
 	}
-	return nil
 }
 
 // processData removes the first stream from active streams, writes out at most 16KB
@@ -903,7 +920,7 @@ func (l *loopyWriter) processData() (bool, error) {
 				return false, err
 			}
 			if err := l.cleanupStreamHandler(trailer.cleanup); err != nil {
-				return false, nil
+				return false, err
 			}
 		} else {
 			l.activeStreams.enqueue(str)
diff --git a/.ci/providerlint/vendor/google.golang.org/grpc/internal/transport/defaults.go b/.ci/providerlint/vendor/google.golang.org/grpc/internal/transport/defaults.go
index 9fa306b2e07..bc8ee074749 100644
--- a/.ci/providerlint/vendor/google.golang.org/grpc/internal/transport/defaults.go
+++ b/.ci/providerlint/vendor/google.golang.org/grpc/internal/transport/defaults.go
@@ -47,3 +47,9 @@ const (
 	defaultClientMaxHeaderListSize = uint32(16 << 20)
 	defaultServerMaxHeaderListSize = uint32(16 << 20)
 )
+
+// MaxStreamID is the upper bound for the stream ID before the current
+// transport gracefully closes and new transport is created for subsequent RPCs.
+// This is set to 75% of 2^31-1. Streams are identified with an unsigned 31-bit
+// integer. It's exported so that tests can override it.
+var MaxStreamID = uint32(math.MaxInt32 * 3 / 4)
diff --git a/.ci/providerlint/vendor/google.golang.org/grpc/internal/transport/handler_server.go b/.ci/providerlint/vendor/google.golang.org/grpc/internal/transport/handler_server.go
index fb272235d81..98f80e3fa00 100644
--- a/.ci/providerlint/vendor/google.golang.org/grpc/internal/transport/handler_server.go
+++ b/.ci/providerlint/vendor/google.golang.org/grpc/internal/transport/handler_server.go
@@ -39,6 +39,7 @@ import (
 	"golang.org/x/net/http2"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/credentials"
+	"google.golang.org/grpc/internal/grpclog"
 	"google.golang.org/grpc/internal/grpcutil"
 	"google.golang.org/grpc/metadata"
 	"google.golang.org/grpc/peer"
@@ -46,24 +47,32 @@ import (
 	"google.golang.org/grpc/status"
 )
 
-// NewServerHandlerTransport returns a ServerTransport handling gRPC
-// from inside an http.Handler. It requires that the http Server
-// supports HTTP/2.
+// NewServerHandlerTransport returns a ServerTransport handling gRPC from
+// inside an http.Handler, or writes an HTTP error to w and returns an error.
+// It requires that the http Server supports HTTP/2.
 func NewServerHandlerTransport(w http.ResponseWriter, r *http.Request, stats []stats.Handler) (ServerTransport, error) {
 	if r.ProtoMajor != 2 {
-		return nil, errors.New("gRPC requires HTTP/2")
+		msg := "gRPC requires HTTP/2"
+		http.Error(w, msg, http.StatusBadRequest)
+		return nil, errors.New(msg)
 	}
 	if r.Method != "POST" {
-		return nil, errors.New("invalid gRPC request method")
+		msg := fmt.Sprintf("invalid gRPC request method %q", r.Method)
+		http.Error(w, msg, http.StatusBadRequest)
+		return nil, errors.New(msg)
 	}
 	contentType := r.Header.Get("Content-Type")
 	// TODO: do we assume contentType is lowercase? we did before
 	contentSubtype, validContentType := grpcutil.ContentSubtype(contentType)
 	if !validContentType {
-		return nil, errors.New("invalid gRPC request content-type")
+		msg := fmt.Sprintf("invalid gRPC request content-type %q", contentType)
+		http.Error(w, msg, http.StatusUnsupportedMediaType)
+		return nil, errors.New(msg)
 	}
 	if _, ok := w.(http.Flusher); !ok {
-		return nil, errors.New("gRPC requires a ResponseWriter supporting http.Flusher")
+		msg := "gRPC requires a ResponseWriter supporting http.Flusher"
+		http.Error(w, msg, http.StatusInternalServerError)
+		return nil, errors.New(msg)
 	}
 
 	st := &serverHandlerTransport{
@@ -75,11 +84,14 @@ func NewServerHandlerTransport(w http.ResponseWriter, r *http.Request, stats []s
 		contentSubtype: contentSubtype,
 		stats:          stats,
 	}
+	st.logger = prefixLoggerForServerHandlerTransport(st)
 
 	if v := r.Header.Get("grpc-timeout"); v != "" {
 		to, err := decodeTimeout(v)
 		if err != nil {
-			return nil, status.Errorf(codes.Internal, "malformed time-out: %v", err)
+			msg := fmt.Sprintf("malformed grpc-timeout: %v", err)
+			http.Error(w, msg, http.StatusBadRequest)
+			return nil, status.Error(codes.Internal, msg)
 		}
 		st.timeoutSet = true
 		st.timeout = to
@@ -97,7 +109,9 @@ func NewServerHandlerTransport(w http.ResponseWriter, r *http.Request, stats []s
 		for _, v := range vv {
 			v, err := decodeMetadataHeader(k, v)
 			if err != nil {
-				return nil, status.Errorf(codes.Internal, "malformed binary metadata: %v", err)
+				msg := fmt.Sprintf("malformed binary metadata %q in header %q: %v", v, k, err)
+				http.Error(w, msg, http.StatusBadRequest)
+				return nil, status.Error(codes.Internal, msg)
 			}
 			metakv = append(metakv, k, v)
 		}
@@ -138,15 +152,19 @@ type serverHandlerTransport struct {
 	// TODO make sure this is consistent across handler_server and http2_server
 	contentSubtype string
 
-	stats []stats.Handler
+	stats  []stats.Handler
+	logger *grpclog.PrefixLogger
 }
 
-func (ht *serverHandlerTransport) Close() {
-	ht.closeOnce.Do(ht.closeCloseChanOnce)
+func (ht *serverHandlerTransport) Close(err error) {
+	ht.closeOnce.Do(func() {
+		if ht.logger.V(logLevel) {
+			ht.logger.Infof("Closing: %v", err)
+		}
+		close(ht.closedCh)
+	})
 }
 
-func (ht *serverHandlerTransport) closeCloseChanOnce() { close(ht.closedCh) }
-
 func (ht *serverHandlerTransport) RemoteAddr() net.Addr { return strAddr(ht.req.RemoteAddr) }
 
 // strAddr is a net.Addr backed by either a TCP "ip:port" string, or
@@ -236,7 +254,7 @@ func (ht *serverHandlerTransport) WriteStatus(s *Stream, st *status.Status) erro
 			})
 		}
 	}
-	ht.Close()
+	ht.Close(errors.New("finished writing status"))
 	return err
 }
 
@@ -346,7 +364,7 @@ func (ht *serverHandlerTransport) HandleStreams(startStream func(*Stream), trace
 		case <-ht.req.Context().Done():
 		}
 		cancel()
-		ht.Close()
+		ht.Close(errors.New("request is done processing"))
 	}()
 
 	req := ht.req
@@ -435,7 +453,7 @@ func (ht *serverHandlerTransport) IncrMsgSent() {}
 
 func (ht *serverHandlerTransport) IncrMsgRecv() {}
 
-func (ht *serverHandlerTransport) Drain() {
+func (ht *serverHandlerTransport) Drain(debugData string) {
 	panic("Drain() is not implemented")
 }
 
diff --git a/.ci/providerlint/vendor/google.golang.org/grpc/internal/transport/http2_client.go b/.ci/providerlint/vendor/google.golang.org/grpc/internal/transport/http2_client.go
index d518b07e16f..326bf084800 100644
--- a/.ci/providerlint/vendor/google.golang.org/grpc/internal/transport/http2_client.go
+++ b/.ci/providerlint/vendor/google.golang.org/grpc/internal/transport/http2_client.go
@@ -38,6 +38,7 @@ import (
 	"google.golang.org/grpc/credentials"
 	"google.golang.org/grpc/internal/channelz"
 	icredentials "google.golang.org/grpc/internal/credentials"
+	"google.golang.org/grpc/internal/grpclog"
 	"google.golang.org/grpc/internal/grpcsync"
 	"google.golang.org/grpc/internal/grpcutil"
 	imetadata "google.golang.org/grpc/internal/metadata"
@@ -59,11 +60,15 @@ var clientConnectionCounter uint64
 
 // http2Client implements the ClientTransport interface with HTTP2.
 type http2Client struct {
-	lastRead   int64 // Keep this field 64-bit aligned. Accessed atomically.
-	ctx        context.Context
-	cancel     context.CancelFunc
-	ctxDone    <-chan struct{} // Cache the ctx.Done() chan.
-	userAgent  string
+	lastRead  int64 // Keep this field 64-bit aligned. Accessed atomically.
+	ctx       context.Context
+	cancel    context.CancelFunc
+	ctxDone   <-chan struct{} // Cache the ctx.Done() chan.
+	userAgent string
+	// address contains the resolver returned address for this transport.
+	// If the `ServerName` field is set, it takes precedence over `CallHdr.Host`
+	// passed to `NewStream`, when determining the :authority header.
+	address    resolver.Address
 	md         metadata.MD
 	conn       net.Conn // underlying communication channel
 	loopy      *loopyWriter
@@ -136,12 +141,12 @@ type http2Client struct {
 	channelzID *channelz.Identifier
 	czData     *channelzData
 
-	onGoAway func(GoAwayReason)
-	onClose  func()
+	onClose func(GoAwayReason)
 
 	bufferPool *bufferPool
 
 	connectionID uint64
+	logger       *grpclog.PrefixLogger
 }
 
 func dial(ctx context.Context, fn func(context.Context, string) (net.Conn, error), addr resolver.Address, useProxy bool, grpcUA string) (net.Conn, error) {
@@ -193,7 +198,7 @@ func isTemporary(err error) bool {
 // newHTTP2Client constructs a connected ClientTransport to addr based on HTTP2
 // and starts to receive messages on it. Non-nil error returns if construction
 // fails.
-func newHTTP2Client(connectCtx, ctx context.Context, addr resolver.Address, opts ConnectOptions, onGoAway func(GoAwayReason), onClose func()) (_ *http2Client, err error) {
+func newHTTP2Client(connectCtx, ctx context.Context, addr resolver.Address, opts ConnectOptions, onClose func(GoAwayReason)) (_ *http2Client, err error) {
 	scheme := "http"
 	ctx, cancel := context.WithCancel(ctx)
 	defer func() {
@@ -213,7 +218,7 @@ func newHTTP2Client(connectCtx, ctx context.Context, addr resolver.Address, opts
 		if opts.FailOnNonTempDialError {
 			return nil, connectionErrorf(isTemporary(err), err, "transport: error while dialing: %v", err)
 		}
-		return nil, connectionErrorf(true, err, "transport: Error while dialing %v", err)
+		return nil, connectionErrorf(true, err, "transport: Error while dialing: %v", err)
 	}
 
 	// Any further errors will close the underlying connection
@@ -238,8 +243,11 @@ func newHTTP2Client(connectCtx, ctx context.Context, addr resolver.Address, opts
 	go func(conn net.Conn) {
 		defer ctxMonitorDone.Fire() // Signal this goroutine has exited.
 		<-newClientCtx.Done()       // Block until connectCtx expires or the defer above executes.
-		if connectCtx.Err() != nil {
+		if err := connectCtx.Err(); err != nil {
 			// connectCtx expired before exiting the function.  Hard close the connection.
+			if logger.V(logLevel) {
+				logger.Infof("Aborting due to connect deadline expiring: %v", err)
+			}
 			conn.Close()
 		}
 	}(conn)
@@ -314,6 +322,7 @@ func newHTTP2Client(connectCtx, ctx context.Context, addr resolver.Address, opts
 		cancel:                cancel,
 		userAgent:             opts.UserAgent,
 		registeredCompressors: grpcutil.RegisteredCompressors(),
+		address:               addr,
 		conn:                  conn,
 		remoteAddr:            conn.RemoteAddr(),
 		localAddr:             conn.LocalAddr(),
@@ -335,11 +344,11 @@ func newHTTP2Client(connectCtx, ctx context.Context, addr resolver.Address, opts
 		streamQuota:           defaultMaxStreamsClient,
 		streamsQuotaAvailable: make(chan struct{}, 1),
 		czData:                new(channelzData),
-		onGoAway:              onGoAway,
 		keepaliveEnabled:      keepaliveEnabled,
 		bufferPool:            newBufferPool(),
 		onClose:               onClose,
 	}
+	t.logger = prefixLoggerForClientTransport(t)
 	// Add peer information to the http2client context.
 	t.ctx = peer.NewContext(t.ctx, t.getPeer())
 
@@ -438,17 +447,8 @@ func newHTTP2Client(connectCtx, ctx context.Context, addr resolver.Address, opts
 		return nil, err
 	}
 	go func() {
-		t.loopy = newLoopyWriter(clientSide, t.framer, t.controlBuf, t.bdpEst)
-		err := t.loopy.run()
-		if err != nil {
-			if logger.V(logLevel) {
-				logger.Errorf("transport: loopyWriter.run returning. Err: %v", err)
-			}
-		}
-		// Do not close the transport.  Let reader goroutine handle it since
-		// there might be data in the buffers.
-		t.conn.Close()
-		t.controlBuf.finish()
+		t.loopy = newLoopyWriter(clientSide, t.framer, t.controlBuf, t.bdpEst, t.conn, t.logger)
+		t.loopy.run()
 		close(t.writerDone)
 	}()
 	return t, nil
@@ -702,6 +702,18 @@ func (e NewStreamError) Error() string {
 // streams.  All non-nil errors returned will be *NewStreamError.
 func (t *http2Client) NewStream(ctx context.Context, callHdr *CallHdr) (*Stream, error) {
 	ctx = peer.NewContext(ctx, t.getPeer())
+
+	// ServerName field of the resolver returned address takes precedence over
+	// Host field of CallHdr to determine the :authority header. This is because,
+	// the ServerName field takes precedence for server authentication during
+	// TLS handshake, and the :authority header should match the value used
+	// for server authentication.
+	if t.address.ServerName != "" {
+		newCallHdr := *callHdr
+		newCallHdr.Host = t.address.ServerName
+		callHdr = &newCallHdr
+	}
+
 	headerFields, err := t.createHeaderFields(ctx, callHdr)
 	if err != nil {
 		return nil, &NewStreamError{Err: err, AllowTransparentRetry: false}
@@ -726,15 +738,12 @@ func (t *http2Client) NewStream(ctx context.Context, callHdr *CallHdr) (*Stream,
 		endStream: false,
 		initStream: func(id uint32) error {
 			t.mu.Lock()
-			if state := t.state; state != reachable {
+			// TODO: handle transport closure in loopy instead and remove this
+			// initStream is never called when transport is draining.
+			if t.state == closing {
 				t.mu.Unlock()
-				// Do a quick cleanup.
-				err := error(errStreamDrain)
-				if state == closing {
-					err = ErrConnClosing
-				}
-				cleanup(err)
-				return err
+				cleanup(ErrConnClosing)
+				return ErrConnClosing
 			}
 			if channelz.IsOn() {
 				atomic.AddInt64(&t.czData.streamsStarted, 1)
@@ -752,6 +761,7 @@ func (t *http2Client) NewStream(ctx context.Context, callHdr *CallHdr) (*Stream,
 	}
 	firstTry := true
 	var ch chan struct{}
+	transportDrainRequired := false
 	checkForStreamQuota := func(it interface{}) bool {
 		if t.streamQuota <= 0 { // Can go negative if server decreases it.
 			if firstTry {
@@ -767,10 +777,15 @@ func (t *http2Client) NewStream(ctx context.Context, callHdr *CallHdr) (*Stream,
 		h := it.(*headerFrame)
 		h.streamID = t.nextID
 		t.nextID += 2
+
+		// Drain client transport if nextID > MaxStreamID which signals gRPC that
+		// the connection is closed and a new one must be created for subsequent RPCs.
+		transportDrainRequired = t.nextID > MaxStreamID
+
 		s.id = h.streamID
 		s.fc = &inFlow{limit: uint32(t.initialWindowSize)}
 		t.mu.Lock()
-		if t.activeStreams == nil { // Can be niled from Close().
+		if t.state == draining || t.activeStreams == nil { // Can be niled from Close().
 			t.mu.Unlock()
 			return false // Don't create a stream if the transport is already closed.
 		}
@@ -846,6 +861,12 @@ func (t *http2Client) NewStream(ctx context.Context, callHdr *CallHdr) (*Stream,
 			sh.HandleRPC(s.ctx, outHeader)
 		}
 	}
+	if transportDrainRequired {
+		if t.logger.V(logLevel) {
+			t.logger.Infof("Draining transport: t.nextID > MaxStreamID")
+		}
+		t.GracefulClose()
+	}
 	return s, nil
 }
 
@@ -934,9 +955,14 @@ func (t *http2Client) Close(err error) {
 		t.mu.Unlock()
 		return
 	}
+	if t.logger.V(logLevel) {
+		t.logger.Infof("Closing: %v", err)
+	}
 	// Call t.onClose ASAP to prevent the client from attempting to create new
 	// streams.
-	t.onClose()
+	if t.state != draining {
+		t.onClose(GoAwayInvalid)
+	}
 	t.state = closing
 	streams := t.activeStreams
 	t.activeStreams = nil
@@ -986,11 +1012,15 @@ func (t *http2Client) GracefulClose() {
 		t.mu.Unlock()
 		return
 	}
+	if t.logger.V(logLevel) {
+		t.logger.Infof("GracefulClose called")
+	}
+	t.onClose(GoAwayInvalid)
 	t.state = draining
 	active := len(t.activeStreams)
 	t.mu.Unlock()
 	if active == 0 {
-		t.Close(ErrConnClosing)
+		t.Close(connectionErrorf(true, nil, "no active streams left to process while draining"))
 		return
 	}
 	t.controlBuf.put(&incomingGoAway{})
@@ -1147,8 +1177,8 @@ func (t *http2Client) handleRSTStream(f *http2.RSTStreamFrame) {
 	}
 	statusCode, ok := http2ErrConvTab[f.ErrCode]
 	if !ok {
-		if logger.V(logLevel) {
-			logger.Warningf("transport: http2Client.handleRSTStream found no mapped gRPC status for the received http2 error %v", f.ErrCode)
+		if t.logger.V(logLevel) {
+			t.logger.Infof("Received a RST_STREAM frame with code %q, but found no mapped gRPC status", f.ErrCode)
 		}
 		statusCode = codes.Unknown
 	}
@@ -1230,10 +1260,12 @@ func (t *http2Client) handleGoAway(f *http2.GoAwayFrame) {
 		t.mu.Unlock()
 		return
 	}
-	if f.ErrCode == http2.ErrCodeEnhanceYourCalm {
-		if logger.V(logLevel) {
-			logger.Infof("Client received GoAway with http2.ErrCodeEnhanceYourCalm.")
-		}
+	if f.ErrCode == http2.ErrCodeEnhanceYourCalm && string(f.DebugData()) == "too_many_pings" {
+		// When a client receives a GOAWAY with error code ENHANCE_YOUR_CALM and debug
+		// data equal to ASCII "too_many_pings", it should log the occurrence at a log level that is
+		// enabled by default and double the configure KEEPALIVE_TIME used for new connections
+		// on that channel.
+		logger.Errorf("Client received GoAway with error code ENHANCE_YOUR_CALM and debug data equal to ASCII \"too_many_pings\".")
 	}
 	id := f.LastStreamID
 	if id > 0 && id%2 == 0 {
@@ -1266,8 +1298,10 @@ func (t *http2Client) handleGoAway(f *http2.GoAwayFrame) {
 		// Notify the clientconn about the GOAWAY before we set the state to
 		// draining, to allow the client to stop attempting to create streams
 		// before disallowing new streams on this connection.
-		t.onGoAway(t.goAwayReason)
-		t.state = draining
+		if t.state != draining {
+			t.onClose(t.goAwayReason)
+			t.state = draining
+		}
 	}
 	// All streams with IDs greater than the GoAwayId
 	// and smaller than the previous GoAway ID should be killed.
@@ -1303,7 +1337,7 @@ func (t *http2Client) handleGoAway(f *http2.GoAwayFrame) {
 
 // setGoAwayReason sets the value of t.goAwayReason based
 // on the GoAway frame received.
-// It expects a lock on transport's mutext to be held by
+// It expects a lock on transport's mutex to be held by
 // the caller.
 func (t *http2Client) setGoAwayReason(f *http2.GoAwayFrame) {
 	t.goAwayReason = GoAwayNoReason
@@ -1756,3 +1790,9 @@ func (t *http2Client) getOutFlowWindow() int64 {
 		return -2
 	}
 }
+
+func (t *http2Client) stateForTesting() transportState {
+	t.mu.Lock()
+	defer t.mu.Unlock()
+	return t.state
+}
diff --git a/.ci/providerlint/vendor/google.golang.org/grpc/internal/transport/http2_server.go b/.ci/providerlint/vendor/google.golang.org/grpc/internal/transport/http2_server.go
index 3dd15647bc8..f9606401289 100644
--- a/.ci/providerlint/vendor/google.golang.org/grpc/internal/transport/http2_server.go
+++ b/.ci/providerlint/vendor/google.golang.org/grpc/internal/transport/http2_server.go
@@ -21,6 +21,7 @@ package transport
 import (
 	"bytes"
 	"context"
+	"errors"
 	"fmt"
 	"io"
 	"math"
@@ -34,13 +35,16 @@ import (
 	"github.com/golang/protobuf/proto"
 	"golang.org/x/net/http2"
 	"golang.org/x/net/http2/hpack"
+	"google.golang.org/grpc/internal/grpclog"
 	"google.golang.org/grpc/internal/grpcutil"
+	"google.golang.org/grpc/internal/pretty"
 	"google.golang.org/grpc/internal/syscall"
 
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/credentials"
 	"google.golang.org/grpc/internal/channelz"
 	"google.golang.org/grpc/internal/grpcrand"
+	"google.golang.org/grpc/internal/grpcsync"
 	"google.golang.org/grpc/keepalive"
 	"google.golang.org/grpc/metadata"
 	"google.golang.org/grpc/peer"
@@ -101,13 +105,13 @@ type http2Server struct {
 
 	mu sync.Mutex // guard the following
 
-	// drainChan is initialized when Drain() is called the first time.
-	// After which the server writes out the first GoAway(with ID 2^31-1) frame.
-	// Then an independent goroutine will be launched to later send the second GoAway.
-	// During this time we don't want to write another first GoAway(with ID 2^31 -1) frame.
-	// Thus call to Drain() will be a no-op if drainChan is already initialized since draining is
-	// already underway.
-	drainChan     chan struct{}
+	// drainEvent is initialized when Drain() is called the first time. After
+	// which the server writes out the first GoAway(with ID 2^31-1) frame. Then
+	// an independent goroutine will be launched to later send the second
+	// GoAway. During this time we don't want to write another first GoAway(with
+	// ID 2^31 -1) frame. Thus call to Drain() will be a no-op if drainEvent is
+	// already initialized since draining is already underway.
+	drainEvent    *grpcsync.Event
 	state         transportState
 	activeStreams map[uint32]*Stream
 	// idle is the time instant when the connection went idle.
@@ -127,6 +131,8 @@ type http2Server struct {
 	// This lock may not be taken if mu is already held.
 	maxStreamMu sync.Mutex
 	maxStreamID uint32 // max stream ID ever seen
+
+	logger *grpclog.PrefixLogger
 }
 
 // NewServerTransport creates a http2 transport with conn and configuration
@@ -232,7 +238,7 @@ func NewServerTransport(conn net.Conn, config *ServerConfig) (_ ServerTransport,
 		kp.Timeout = defaultServerKeepaliveTimeout
 	}
 	if kp.Time != infinity {
-		if err = syscall.SetTCPUserTimeout(conn, kp.Timeout); err != nil {
+		if err = syscall.SetTCPUserTimeout(rawConn, kp.Timeout); err != nil {
 			return nil, connectionErrorf(false, err, "transport: failed to set TCP_USER_TIMEOUT: %v", err)
 		}
 	}
@@ -265,6 +271,7 @@ func NewServerTransport(conn net.Conn, config *ServerConfig) (_ ServerTransport,
 		czData:            new(channelzData),
 		bufferPool:        newBufferPool(),
 	}
+	t.logger = prefixLoggerForServerTransport(t)
 	// Add peer information to the http2server context.
 	t.ctx = peer.NewContext(t.ctx, t.getPeer())
 
@@ -293,7 +300,7 @@ func NewServerTransport(conn net.Conn, config *ServerConfig) (_ ServerTransport,
 
 	defer func() {
 		if err != nil {
-			t.Close()
+			t.Close(err)
 		}
 	}()
 
@@ -329,23 +336,18 @@ func NewServerTransport(conn net.Conn, config *ServerConfig) (_ ServerTransport,
 	t.handleSettings(sf)
 
 	go func() {
-		t.loopy = newLoopyWriter(serverSide, t.framer, t.controlBuf, t.bdpEst)
+		t.loopy = newLoopyWriter(serverSide, t.framer, t.controlBuf, t.bdpEst, t.conn, t.logger)
 		t.loopy.ssGoAwayHandler = t.outgoingGoAwayHandler
-		if err := t.loopy.run(); err != nil {
-			if logger.V(logLevel) {
-				logger.Errorf("transport: loopyWriter.run returning. Err: %v", err)
-			}
-		}
-		t.conn.Close()
-		t.controlBuf.finish()
+		t.loopy.run()
 		close(t.writerDone)
 	}()
 	go t.keepalive()
 	return t, nil
 }
 
-// operateHeader takes action on the decoded headers.
-func (t *http2Server) operateHeaders(frame *http2.MetaHeadersFrame, handle func(*Stream), traceCtx func(context.Context, string) context.Context) (fatal bool) {
+// operateHeaders takes action on the decoded headers. Returns an error if fatal
+// error encountered and transport needs to close, otherwise returns nil.
+func (t *http2Server) operateHeaders(frame *http2.MetaHeadersFrame, handle func(*Stream), traceCtx func(context.Context, string) context.Context) error {
 	// Acquire max stream ID lock for entire duration
 	t.maxStreamMu.Lock()
 	defer t.maxStreamMu.Unlock()
@@ -361,15 +363,12 @@ func (t *http2Server) operateHeaders(frame *http2.MetaHeadersFrame, handle func(
 			rstCode:  http2.ErrCodeFrameSize,
 			onWrite:  func() {},
 		})
-		return false
+		return nil
 	}
 
 	if streamID%2 != 1 || streamID <= t.maxStreamID {
 		// illegal gRPC stream id.
-		if logger.V(logLevel) {
-			logger.Errorf("transport: http2Server.HandleStreams received an illegal stream id: %v", streamID)
-		}
-		return true
+		return fmt.Errorf("received an illegal stream id: %v. headers frame: %+v", streamID, frame)
 	}
 	t.maxStreamID = streamID
 
@@ -381,13 +380,14 @@ func (t *http2Server) operateHeaders(frame *http2.MetaHeadersFrame, handle func(
 		fc:  &inFlow{limit: uint32(t.initialWindowSize)},
 	}
 	var (
-		// If a gRPC Response-Headers has already been received, then it means
-		// that the peer is speaking gRPC and we are in gRPC mode.
-		isGRPC     = false
-		mdata      = make(map[string][]string)
-		httpMethod string
-		// headerError is set if an error is encountered while parsing the headers
-		headerError bool
+		// if false, content-type was missing or invalid
+		isGRPC      = false
+		contentType = ""
+		mdata       = make(metadata.MD, len(frame.Fields))
+		httpMethod  string
+		// these are set if an error is encountered while parsing the headers
+		protocolError bool
+		headerError   *status.Status
 
 		timeoutSet bool
 		timeout    time.Duration
@@ -398,11 +398,23 @@ func (t *http2Server) operateHeaders(frame *http2.MetaHeadersFrame, handle func(
 		case "content-type":
 			contentSubtype, validContentType := grpcutil.ContentSubtype(hf.Value)
 			if !validContentType {
+				contentType = hf.Value
 				break
 			}
 			mdata[hf.Name] = append(mdata[hf.Name], hf.Value)
 			s.contentSubtype = contentSubtype
 			isGRPC = true
+
+		case "grpc-accept-encoding":
+			mdata[hf.Name] = append(mdata[hf.Name], hf.Value)
+			if hf.Value == "" {
+				continue
+			}
+			compressors := hf.Value
+			if s.clientAdvertisedCompressors != "" {
+				compressors = s.clientAdvertisedCompressors + "," + compressors
+			}
+			s.clientAdvertisedCompressors = compressors
 		case "grpc-encoding":
 			s.recvCompress = hf.Value
 		case ":method":
@@ -413,23 +425,23 @@ func (t *http2Server) operateHeaders(frame *http2.MetaHeadersFrame, handle func(
 			timeoutSet = true
 			var err error
 			if timeout, err = decodeTimeout(hf.Value); err != nil {
-				headerError = true
+				headerError = status.Newf(codes.Internal, "malformed grpc-timeout: %v", err)
 			}
 		// "Transports must consider requests containing the Connection header
 		// as malformed." - A41
 		case "connection":
-			if logger.V(logLevel) {
-				logger.Errorf("transport: http2Server.operateHeaders parsed a :connection header which makes a request malformed as per the HTTP/2 spec")
+			if t.logger.V(logLevel) {
+				t.logger.Infof("Received a HEADERS frame with a :connection header which makes the request malformed, as per the HTTP/2 spec")
 			}
-			headerError = true
+			protocolError = true
 		default:
 			if isReservedHeader(hf.Name) && !isWhitelistedHeader(hf.Name) {
 				break
 			}
 			v, err := decodeMetadataHeader(hf.Name, hf.Value)
 			if err != nil {
-				headerError = true
-				logger.Warningf("Failed to decode metadata header (%q, %q): %v", hf.Name, hf.Value, err)
+				headerError = status.Newf(codes.Internal, "malformed binary metadata %q in header %q: %v", hf.Value, hf.Name, err)
+				t.logger.Warningf("Failed to decode metadata header (%q, %q): %v", hf.Name, hf.Value, err)
 				break
 			}
 			mdata[hf.Name] = append(mdata[hf.Name], v)
@@ -443,27 +455,47 @@ func (t *http2Server) operateHeaders(frame *http2.MetaHeadersFrame, handle func(
 	// error, this takes precedence over a client not speaking gRPC.
 	if len(mdata[":authority"]) > 1 || len(mdata["host"]) > 1 {
 		errMsg := fmt.Sprintf("num values of :authority: %v, num values of host: %v, both must only have 1 value as per HTTP/2 spec", len(mdata[":authority"]), len(mdata["host"]))
-		if logger.V(logLevel) {
-			logger.Errorf("transport: %v", errMsg)
+		if t.logger.V(logLevel) {
+			t.logger.Infof("Aborting the stream early: %v", errMsg)
 		}
 		t.controlBuf.put(&earlyAbortStream{
-			httpStatus:     400,
+			httpStatus:     http.StatusBadRequest,
 			streamID:       streamID,
 			contentSubtype: s.contentSubtype,
 			status:         status.New(codes.Internal, errMsg),
 			rst:            !frame.StreamEnded(),
 		})
-		return false
+		return nil
 	}
 
-	if !isGRPC || headerError {
+	if protocolError {
 		t.controlBuf.put(&cleanupStream{
 			streamID: streamID,
 			rst:      true,
 			rstCode:  http2.ErrCodeProtocol,
 			onWrite:  func() {},
 		})
-		return false
+		return nil
+	}
+	if !isGRPC {
+		t.controlBuf.put(&earlyAbortStream{
+			httpStatus:     http.StatusUnsupportedMediaType,
+			streamID:       streamID,
+			contentSubtype: s.contentSubtype,
+			status:         status.Newf(codes.InvalidArgument, "invalid gRPC request content-type %q", contentType),
+			rst:            !frame.StreamEnded(),
+		})
+		return nil
+	}
+	if headerError != nil {
+		t.controlBuf.put(&earlyAbortStream{
+			httpStatus:     http.StatusBadRequest,
+			streamID:       streamID,
+			contentSubtype: s.contentSubtype,
+			status:         headerError,
+			rst:            !frame.StreamEnded(),
+		})
+		return nil
 	}
 
 	// "If :authority is missing, Host must be renamed to :authority." - A41
@@ -503,7 +535,7 @@ func (t *http2Server) operateHeaders(frame *http2.MetaHeadersFrame, handle func(
 	if t.state != reachable {
 		t.mu.Unlock()
 		s.cancel()
-		return false
+		return nil
 	}
 	if uint32(len(t.activeStreams)) >= t.maxStreams {
 		t.mu.Unlock()
@@ -514,13 +546,13 @@ func (t *http2Server) operateHeaders(frame *http2.MetaHeadersFrame, handle func(
 			onWrite:  func() {},
 		})
 		s.cancel()
-		return false
+		return nil
 	}
 	if httpMethod != http.MethodPost {
 		t.mu.Unlock()
-		errMsg := fmt.Sprintf("http2Server.operateHeaders parsed a :method field: %v which should be POST", httpMethod)
-		if logger.V(logLevel) {
-			logger.Infof("transport: %v", errMsg)
+		errMsg := fmt.Sprintf("Received a HEADERS frame with :method %q which should be POST", httpMethod)
+		if t.logger.V(logLevel) {
+			t.logger.Infof("Aborting the stream early: %v", errMsg)
 		}
 		t.controlBuf.put(&earlyAbortStream{
 			httpStatus:     405,
@@ -530,14 +562,14 @@ func (t *http2Server) operateHeaders(frame *http2.MetaHeadersFrame, handle func(
 			rst:            !frame.StreamEnded(),
 		})
 		s.cancel()
-		return false
+		return nil
 	}
 	if t.inTapHandle != nil {
 		var err error
 		if s.ctx, err = t.inTapHandle(s.ctx, &tap.Info{FullMethodName: s.method}); err != nil {
 			t.mu.Unlock()
-			if logger.V(logLevel) {
-				logger.Infof("transport: http2Server.operateHeaders got an error from InTapHandle: %v", err)
+			if t.logger.V(logLevel) {
+				t.logger.Infof("Aborting the stream early due to InTapHandle failure: %v", err)
 			}
 			stat, ok := status.FromError(err)
 			if !ok {
@@ -550,7 +582,7 @@ func (t *http2Server) operateHeaders(frame *http2.MetaHeadersFrame, handle func(
 				status:         stat,
 				rst:            !frame.StreamEnded(),
 			})
-			return false
+			return nil
 		}
 	}
 	t.activeStreams[streamID] = s
@@ -574,7 +606,7 @@ func (t *http2Server) operateHeaders(frame *http2.MetaHeadersFrame, handle func(
 			LocalAddr:   t.localAddr,
 			Compression: s.recvCompress,
 			WireLength:  int(frame.Header().Length),
-			Header:      metadata.MD(mdata).Copy(),
+			Header:      mdata.Copy(),
 		}
 		sh.HandleRPC(s.ctx, inHeader)
 	}
@@ -597,7 +629,7 @@ func (t *http2Server) operateHeaders(frame *http2.MetaHeadersFrame, handle func(
 		wq:       s.wq,
 	})
 	handle(s)
-	return false
+	return nil
 }
 
 // HandleStreams receives incoming streams using the given handler. This is
@@ -611,8 +643,8 @@ func (t *http2Server) HandleStreams(handle func(*Stream), traceCtx func(context.
 		atomic.StoreInt64(&t.lastRead, time.Now().UnixNano())
 		if err != nil {
 			if se, ok := err.(http2.StreamError); ok {
-				if logger.V(logLevel) {
-					logger.Warningf("transport: http2Server.HandleStreams encountered http2.StreamError: %v", se)
+				if t.logger.V(logLevel) {
+					t.logger.Warningf("Encountered http2.StreamError: %v", se)
 				}
 				t.mu.Lock()
 				s := t.activeStreams[se.StreamID]
@@ -630,19 +662,16 @@ func (t *http2Server) HandleStreams(handle func(*Stream), traceCtx func(context.
 				continue
 			}
 			if err == io.EOF || err == io.ErrUnexpectedEOF {
-				t.Close()
+				t.Close(err)
 				return
 			}
-			if logger.V(logLevel) {
-				logger.Warningf("transport: http2Server.HandleStreams failed to read frame: %v", err)
-			}
-			t.Close()
+			t.Close(err)
 			return
 		}
 		switch frame := frame.(type) {
 		case *http2.MetaHeadersFrame:
-			if t.operateHeaders(frame, handle, traceCtx) {
-				t.Close()
+			if err := t.operateHeaders(frame, handle, traceCtx); err != nil {
+				t.Close(err)
 				break
 			}
 		case *http2.DataFrame:
@@ -658,8 +687,8 @@ func (t *http2Server) HandleStreams(handle func(*Stream), traceCtx func(context.
 		case *http2.GoAwayFrame:
 			// TODO: Handle GoAway from the client appropriately.
 		default:
-			if logger.V(logLevel) {
-				logger.Errorf("transport: http2Server.HandleStreams found unhandled frame type %v.", frame)
+			if t.logger.V(logLevel) {
+				t.logger.Infof("Received unsupported frame type %T", frame)
 			}
 		}
 	}
@@ -843,8 +872,8 @@ const (
 
 func (t *http2Server) handlePing(f *http2.PingFrame) {
 	if f.IsAck() {
-		if f.Data == goAwayPing.data && t.drainChan != nil {
-			close(t.drainChan)
+		if f.Data == goAwayPing.data && t.drainEvent != nil {
+			t.drainEvent.Fire()
 			return
 		}
 		// Maybe it's a BDP ping.
@@ -886,10 +915,7 @@ func (t *http2Server) handlePing(f *http2.PingFrame) {
 
 	if t.pingStrikes > maxPingStrikes {
 		// Send goaway and close the connection.
-		if logger.V(logLevel) {
-			logger.Errorf("transport: Got too many pings from the client, closing the connection.")
-		}
-		t.controlBuf.put(&goAway{code: http2.ErrCodeEnhanceYourCalm, debugData: []byte("too_many_pings"), closeConn: true})
+		t.controlBuf.put(&goAway{code: http2.ErrCodeEnhanceYourCalm, debugData: []byte("too_many_pings"), closeConn: errors.New("got too many pings from the client")})
 	}
 }
 
@@ -921,8 +947,8 @@ func (t *http2Server) checkForHeaderListSize(it interface{}) bool {
 	var sz int64
 	for _, f := range hdrFrame.hf {
 		if sz += int64(f.Size()); sz > int64(*t.maxSendHeaderListSize) {
-			if logger.V(logLevel) {
-				logger.Errorf("header list size to send violates the maximum size (%d bytes) set by client", *t.maxSendHeaderListSize)
+			if t.logger.V(logLevel) {
+				t.logger.Infof("Header list size to send violates the maximum size (%d bytes) set by client", *t.maxSendHeaderListSize)
 			}
 			return false
 		}
@@ -1035,7 +1061,7 @@ func (t *http2Server) WriteStatus(s *Stream, st *status.Status) error {
 		stBytes, err := proto.Marshal(p)
 		if err != nil {
 			// TODO: return error instead, when callers are able to handle it.
-			logger.Errorf("transport: failed to marshal rpc status: %v, error: %v", p, err)
+			t.logger.Errorf("Failed to marshal rpc status: %s, error: %v", pretty.ToJSON(p), err)
 		} else {
 			headerFields = append(headerFields, hpack.HeaderField{Name: "grpc-status-details-bin", Value: encodeBinHeader(stBytes)})
 		}
@@ -1140,20 +1166,20 @@ func (t *http2Server) keepalive() {
 			if val <= 0 {
 				// The connection has been idle for a duration of keepalive.MaxConnectionIdle or more.
 				// Gracefully close the connection.
-				t.Drain()
+				t.Drain("max_idle")
 				return
 			}
 			idleTimer.Reset(val)
 		case <-ageTimer.C:
-			t.Drain()
+			t.Drain("max_age")
 			ageTimer.Reset(t.kp.MaxConnectionAgeGrace)
 			select {
 			case <-ageTimer.C:
 				// Close the connection after grace period.
-				if logger.V(logLevel) {
-					logger.Infof("transport: closing server transport due to maximum connection age.")
+				if t.logger.V(logLevel) {
+					t.logger.Infof("Closing server transport due to maximum connection age")
 				}
-				t.Close()
+				t.controlBuf.put(closeConnection{})
 			case <-t.done:
 			}
 			return
@@ -1169,10 +1195,7 @@ func (t *http2Server) keepalive() {
 				continue
 			}
 			if outstandingPing && kpTimeoutLeft <= 0 {
-				if logger.V(logLevel) {
-					logger.Infof("transport: closing server transport due to idleness.")
-				}
-				t.Close()
+				t.Close(fmt.Errorf("keepalive ping not acked within timeout %s", t.kp.Time))
 				return
 			}
 			if !outstandingPing {
@@ -1199,20 +1222,23 @@ func (t *http2Server) keepalive() {
 // Close starts shutting down the http2Server transport.
 // TODO(zhaoq): Now the destruction is not blocked on any pending streams. This
 // could cause some resource issue. Revisit this later.
-func (t *http2Server) Close() {
+func (t *http2Server) Close(err error) {
 	t.mu.Lock()
 	if t.state == closing {
 		t.mu.Unlock()
 		return
 	}
+	if t.logger.V(logLevel) {
+		t.logger.Infof("Closing: %v", err)
+	}
 	t.state = closing
 	streams := t.activeStreams
 	t.activeStreams = nil
 	t.mu.Unlock()
 	t.controlBuf.finish()
 	close(t.done)
-	if err := t.conn.Close(); err != nil && logger.V(logLevel) {
-		logger.Infof("transport: error closing conn during Close: %v", err)
+	if err := t.conn.Close(); err != nil && t.logger.V(logLevel) {
+		t.logger.Infof("Error closing underlying net.Conn during Close: %v", err)
 	}
 	channelz.RemoveEntry(t.channelzID)
 	// Cancel all active streams.
@@ -1292,14 +1318,14 @@ func (t *http2Server) RemoteAddr() net.Addr {
 	return t.remoteAddr
 }
 
-func (t *http2Server) Drain() {
+func (t *http2Server) Drain(debugData string) {
 	t.mu.Lock()
 	defer t.mu.Unlock()
-	if t.drainChan != nil {
+	if t.drainEvent != nil {
 		return
 	}
-	t.drainChan = make(chan struct{})
-	t.controlBuf.put(&goAway{code: http2.ErrCodeNo, debugData: []byte{}, headsUp: true})
+	t.drainEvent = grpcsync.NewEvent()
+	t.controlBuf.put(&goAway{code: http2.ErrCodeNo, debugData: []byte(debugData), headsUp: true})
 }
 
 var goAwayPing = &ping{data: [8]byte{1, 6, 1, 8, 0, 3, 3, 9}}
@@ -1319,19 +1345,17 @@ func (t *http2Server) outgoingGoAwayHandler(g *goAway) (bool, error) {
 		// Stop accepting more streams now.
 		t.state = draining
 		sid := t.maxStreamID
+		retErr := g.closeConn
 		if len(t.activeStreams) == 0 {
-			g.closeConn = true
+			retErr = errors.New("second GOAWAY written and no active streams left to process")
 		}
 		t.mu.Unlock()
 		t.maxStreamMu.Unlock()
 		if err := t.framer.fr.WriteGoAway(sid, g.code, g.debugData); err != nil {
 			return false, err
 		}
-		if g.closeConn {
-			// Abruptly close the connection following the GoAway (via
-			// loopywriter).  But flush out what's inside the buffer first.
-			t.framer.writer.Flush()
-			return false, fmt.Errorf("transport: Connection closing")
+		if retErr != nil {
+			return false, retErr
 		}
 		return true, nil
 	}
@@ -1343,7 +1367,7 @@ func (t *http2Server) outgoingGoAwayHandler(g *goAway) (bool, error) {
 	// originated before the GoAway reaches the client.
 	// After getting the ack or timer expiration send out another GoAway this
 	// time with an ID of the max stream server intends to process.
-	if err := t.framer.fr.WriteGoAway(math.MaxUint32, http2.ErrCodeNo, []byte{}); err != nil {
+	if err := t.framer.fr.WriteGoAway(math.MaxUint32, http2.ErrCodeNo, g.debugData); err != nil {
 		return false, err
 	}
 	if err := t.framer.fr.WritePing(false, goAwayPing.data); err != nil {
@@ -1353,7 +1377,7 @@ func (t *http2Server) outgoingGoAwayHandler(g *goAway) (bool, error) {
 		timer := time.NewTimer(time.Minute)
 		defer timer.Stop()
 		select {
-		case <-t.drainChan:
+		case <-t.drainEvent.Done():
 		case <-timer.C:
 		case <-t.done:
 			return
diff --git a/.ci/providerlint/vendor/google.golang.org/grpc/internal/transport/http_util.go b/.ci/providerlint/vendor/google.golang.org/grpc/internal/transport/http_util.go
index 2c601a864d9..19cbb18f5ab 100644
--- a/.ci/providerlint/vendor/google.golang.org/grpc/internal/transport/http_util.go
+++ b/.ci/providerlint/vendor/google.golang.org/grpc/internal/transport/http_util.go
@@ -21,6 +21,7 @@ package transport
 import (
 	"bufio"
 	"encoding/base64"
+	"errors"
 	"fmt"
 	"io"
 	"math"
@@ -37,7 +38,6 @@ import (
 	"golang.org/x/net/http2/hpack"
 	spb "google.golang.org/genproto/googleapis/rpc/status"
 	"google.golang.org/grpc/codes"
-	"google.golang.org/grpc/grpclog"
 	"google.golang.org/grpc/status"
 )
 
@@ -85,7 +85,6 @@ var (
 		// 504 Gateway timeout - UNAVAILABLE.
 		http.StatusGatewayTimeout: codes.Unavailable,
 	}
-	logger = grpclog.Component("transport")
 )
 
 // isReservedHeader checks whether hdr belongs to HTTP2 headers
@@ -330,7 +329,8 @@ func (w *bufWriter) Write(b []byte) (n int, err error) {
 		return 0, w.err
 	}
 	if w.batchSize == 0 { // Buffer has been disabled.
-		return w.conn.Write(b)
+		n, err = w.conn.Write(b)
+		return n, toIOError(err)
 	}
 	for len(b) > 0 {
 		nn := copy(w.buf[w.offset:], b)
@@ -352,10 +352,30 @@ func (w *bufWriter) Flush() error {
 		return nil
 	}
 	_, w.err = w.conn.Write(w.buf[:w.offset])
+	w.err = toIOError(w.err)
 	w.offset = 0
 	return w.err
 }
 
+type ioError struct {
+	error
+}
+
+func (i ioError) Unwrap() error {
+	return i.error
+}
+
+func isIOError(err error) bool {
+	return errors.As(err, &ioError{})
+}
+
+func toIOError(err error) error {
+	if err == nil {
+		return nil
+	}
+	return ioError{error: err}
+}
+
 type framer struct {
 	writer *bufWriter
 	fr     *http2.Framer
diff --git a/.ci/providerlint/vendor/google.golang.org/grpc/internal/transport/logging.go b/.ci/providerlint/vendor/google.golang.org/grpc/internal/transport/logging.go
new file mode 100644
index 00000000000..42ed2b07af6
--- /dev/null
+++ b/.ci/providerlint/vendor/google.golang.org/grpc/internal/transport/logging.go
@@ -0,0 +1,40 @@
+/*
+ *
+ * Copyright 2023 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package transport
+
+import (
+	"fmt"
+
+	"google.golang.org/grpc/grpclog"
+	internalgrpclog "google.golang.org/grpc/internal/grpclog"
+)
+
+var logger = grpclog.Component("transport")
+
+func prefixLoggerForServerTransport(p *http2Server) *internalgrpclog.PrefixLogger {
+	return internalgrpclog.NewPrefixLogger(logger, fmt.Sprintf("[server-transport %p] ", p))
+}
+
+func prefixLoggerForServerHandlerTransport(p *serverHandlerTransport) *internalgrpclog.PrefixLogger {
+	return internalgrpclog.NewPrefixLogger(logger, fmt.Sprintf("[server-handler-transport %p] ", p))
+}
+
+func prefixLoggerForClientTransport(p *http2Client) *internalgrpclog.PrefixLogger {
+	return internalgrpclog.NewPrefixLogger(logger, fmt.Sprintf("[client-transport %p] ", p))
+}
diff --git a/.ci/providerlint/vendor/google.golang.org/grpc/internal/transport/transport.go b/.ci/providerlint/vendor/google.golang.org/grpc/internal/transport/transport.go
index 2e615ee20cc..aa1c896595d 100644
--- a/.ci/providerlint/vendor/google.golang.org/grpc/internal/transport/transport.go
+++ b/.ci/providerlint/vendor/google.golang.org/grpc/internal/transport/transport.go
@@ -257,6 +257,9 @@ type Stream struct {
 	fc           *inFlow
 	wq           *writeQuota
 
+	// Holds compressor names passed in grpc-accept-encoding metadata from the
+	// client. This is empty for the client side stream.
+	clientAdvertisedCompressors string
 	// Callback to state application's intentions to read data. This
 	// is used to adjust flow control, if needed.
 	requestRead func(int)
@@ -345,8 +348,24 @@ func (s *Stream) RecvCompress() string {
 }
 
 // SetSendCompress sets the compression algorithm to the stream.
-func (s *Stream) SetSendCompress(str string) {
-	s.sendCompress = str
+func (s *Stream) SetSendCompress(name string) error {
+	if s.isHeaderSent() || s.getState() == streamDone {
+		return errors.New("transport: set send compressor called after headers sent or stream done")
+	}
+
+	s.sendCompress = name
+	return nil
+}
+
+// SendCompress returns the send compressor name.
+func (s *Stream) SendCompress() string {
+	return s.sendCompress
+}
+
+// ClientAdvertisedCompressors returns the compressor names advertised by the
+// client via grpc-accept-encoding header.
+func (s *Stream) ClientAdvertisedCompressors() string {
+	return s.clientAdvertisedCompressors
 }
 
 // Done returns a channel which is closed when it receives the final status
@@ -583,8 +602,8 @@ type ConnectOptions struct {
 
 // NewClientTransport establishes the transport with the required ConnectOptions
 // and returns it to the caller.
-func NewClientTransport(connectCtx, ctx context.Context, addr resolver.Address, opts ConnectOptions, onGoAway func(GoAwayReason), onClose func()) (ClientTransport, error) {
-	return newHTTP2Client(connectCtx, ctx, addr, opts, onGoAway, onClose)
+func NewClientTransport(connectCtx, ctx context.Context, addr resolver.Address, opts ConnectOptions, onClose func(GoAwayReason)) (ClientTransport, error) {
+	return newHTTP2Client(connectCtx, ctx, addr, opts, onClose)
 }
 
 // Options provides additional hints and information for message
@@ -701,13 +720,13 @@ type ServerTransport interface {
 	// Close tears down the transport. Once it is called, the transport
 	// should not be accessed any more. All the pending streams and their
 	// handlers will be terminated asynchronously.
-	Close()
+	Close(err error)
 
 	// RemoteAddr returns the remote network address.
 	RemoteAddr() net.Addr
 
 	// Drain notifies the client this ServerTransport stops accepting new RPCs.
-	Drain()
+	Drain(debugData string)
 
 	// IncrMsgSent increments the number of message sent through this transport.
 	IncrMsgSent()
diff --git a/.ci/providerlint/vendor/google.golang.org/grpc/metadata/metadata.go b/.ci/providerlint/vendor/google.golang.org/grpc/metadata/metadata.go
index fb4a88f59bd..a2cdcaf12a8 100644
--- a/.ci/providerlint/vendor/google.golang.org/grpc/metadata/metadata.go
+++ b/.ci/providerlint/vendor/google.golang.org/grpc/metadata/metadata.go
@@ -91,7 +91,11 @@ func (md MD) Len() int {
 
 // Copy returns a copy of md.
 func (md MD) Copy() MD {
-	return Join(md)
+	out := make(MD, len(md))
+	for k, v := range md {
+		out[k] = copyOf(v)
+	}
+	return out
 }
 
 // Get obtains the values for a given key.
@@ -171,8 +175,11 @@ func AppendToOutgoingContext(ctx context.Context, kv ...string) context.Context
 	md, _ := ctx.Value(mdOutgoingKey{}).(rawMD)
 	added := make([][]string, len(md.added)+1)
 	copy(added, md.added)
-	added[len(added)-1] = make([]string, len(kv))
-	copy(added[len(added)-1], kv)
+	kvCopy := make([]string, 0, len(kv))
+	for i := 0; i < len(kv); i += 2 {
+		kvCopy = append(kvCopy, strings.ToLower(kv[i]), kv[i+1])
+	}
+	added[len(added)-1] = kvCopy
 	return context.WithValue(ctx, mdOutgoingKey{}, rawMD{md: md.md, added: added})
 }
 
diff --git a/.ci/providerlint/vendor/google.golang.org/grpc/picker_wrapper.go b/.ci/providerlint/vendor/google.golang.org/grpc/picker_wrapper.go
index a5d5516ee06..02f97595124 100644
--- a/.ci/providerlint/vendor/google.golang.org/grpc/picker_wrapper.go
+++ b/.ci/providerlint/vendor/google.golang.org/grpc/picker_wrapper.go
@@ -36,6 +36,7 @@ import (
 type pickerWrapper struct {
 	mu         sync.Mutex
 	done       bool
+	idle       bool
 	blockingCh chan struct{}
 	picker     balancer.Picker
 }
@@ -47,7 +48,11 @@ func newPickerWrapper() *pickerWrapper {
 // updatePicker is called by UpdateBalancerState. It unblocks all blocked pick.
 func (pw *pickerWrapper) updatePicker(p balancer.Picker) {
 	pw.mu.Lock()
-	if pw.done {
+	if pw.done || pw.idle {
+		// There is a small window where a picker update from the LB policy can
+		// race with the channel going to idle mode. If the picker is idle here,
+		// it is because the channel asked it to do so, and therefore it is sage
+		// to ignore the update from the LB policy.
 		pw.mu.Unlock()
 		return
 	}
@@ -58,12 +63,16 @@ func (pw *pickerWrapper) updatePicker(p balancer.Picker) {
 	pw.mu.Unlock()
 }
 
-func doneChannelzWrapper(acw *acBalancerWrapper, done func(balancer.DoneInfo)) func(balancer.DoneInfo) {
-	acw.mu.Lock()
-	ac := acw.ac
-	acw.mu.Unlock()
+// doneChannelzWrapper performs the following:
+//   - increments the calls started channelz counter
+//   - wraps the done function in the passed in result to increment the calls
+//     failed or calls succeeded channelz counter before invoking the actual
+//     done function.
+func doneChannelzWrapper(acbw *acBalancerWrapper, result *balancer.PickResult) {
+	ac := acbw.ac
 	ac.incrCallsStarted()
-	return func(b balancer.DoneInfo) {
+	done := result.Done
+	result.Done = func(b balancer.DoneInfo) {
 		if b.Err != nil && b.Err != io.EOF {
 			ac.incrCallsFailed()
 		} else {
@@ -82,7 +91,7 @@ func doneChannelzWrapper(acw *acBalancerWrapper, done func(balancer.DoneInfo)) f
 // - the current picker returns other errors and failfast is false.
 // - the subConn returned by the current picker is not READY
 // When one of these situations happens, pick blocks until the picker gets updated.
-func (pw *pickerWrapper) pick(ctx context.Context, failfast bool, info balancer.PickInfo) (transport.ClientTransport, func(balancer.DoneInfo), error) {
+func (pw *pickerWrapper) pick(ctx context.Context, failfast bool, info balancer.PickInfo) (transport.ClientTransport, balancer.PickResult, error) {
 	var ch chan struct{}
 
 	var lastPickErr error
@@ -90,7 +99,7 @@ func (pw *pickerWrapper) pick(ctx context.Context, failfast bool, info balancer.
 		pw.mu.Lock()
 		if pw.done {
 			pw.mu.Unlock()
-			return nil, nil, ErrClientConnClosing
+			return nil, balancer.PickResult{}, ErrClientConnClosing
 		}
 
 		if pw.picker == nil {
@@ -111,9 +120,9 @@ func (pw *pickerWrapper) pick(ctx context.Context, failfast bool, info balancer.
 				}
 				switch ctx.Err() {
 				case context.DeadlineExceeded:
-					return nil, nil, status.Error(codes.DeadlineExceeded, errStr)
+					return nil, balancer.PickResult{}, status.Error(codes.DeadlineExceeded, errStr)
 				case context.Canceled:
-					return nil, nil, status.Error(codes.Canceled, errStr)
+					return nil, balancer.PickResult{}, status.Error(codes.Canceled, errStr)
 				}
 			case <-ch:
 			}
@@ -125,7 +134,6 @@ func (pw *pickerWrapper) pick(ctx context.Context, failfast bool, info balancer.
 		pw.mu.Unlock()
 
 		pickResult, err := p.Pick(info)
-
 		if err != nil {
 			if err == balancer.ErrNoSubConnAvailable {
 				continue
@@ -136,7 +144,7 @@ func (pw *pickerWrapper) pick(ctx context.Context, failfast bool, info balancer.
 				if istatus.IsRestrictedControlPlaneCode(st) {
 					err = status.Errorf(codes.Internal, "received picker error with illegal status: %v", err)
 				}
-				return nil, nil, dropError{error: err}
+				return nil, balancer.PickResult{}, dropError{error: err}
 			}
 			// For all other errors, wait for ready RPCs should block and other
 			// RPCs should fail with unavailable.
@@ -144,19 +152,20 @@ func (pw *pickerWrapper) pick(ctx context.Context, failfast bool, info balancer.
 				lastPickErr = err
 				continue
 			}
-			return nil, nil, status.Error(codes.Unavailable, err.Error())
+			return nil, balancer.PickResult{}, status.Error(codes.Unavailable, err.Error())
 		}
 
-		acw, ok := pickResult.SubConn.(*acBalancerWrapper)
+		acbw, ok := pickResult.SubConn.(*acBalancerWrapper)
 		if !ok {
 			logger.Errorf("subconn returned from pick is type %T, not *acBalancerWrapper", pickResult.SubConn)
 			continue
 		}
-		if t := acw.getAddrConn().getReadyTransport(); t != nil {
+		if t := acbw.ac.getReadyTransport(); t != nil {
 			if channelz.IsOn() {
-				return t, doneChannelzWrapper(acw, pickResult.Done), nil
+				doneChannelzWrapper(acbw, &pickResult)
+				return t, pickResult, nil
 			}
-			return t, pickResult.Done, nil
+			return t, pickResult, nil
 		}
 		if pickResult.Done != nil {
 			// Calling done with nil error, no bytes sent and no bytes received.
@@ -181,6 +190,25 @@ func (pw *pickerWrapper) close() {
 	close(pw.blockingCh)
 }
 
+func (pw *pickerWrapper) enterIdleMode() {
+	pw.mu.Lock()
+	defer pw.mu.Unlock()
+	if pw.done {
+		return
+	}
+	pw.idle = true
+}
+
+func (pw *pickerWrapper) exitIdleMode() {
+	pw.mu.Lock()
+	defer pw.mu.Unlock()
+	if pw.done {
+		return
+	}
+	pw.blockingCh = make(chan struct{})
+	pw.idle = false
+}
+
 // dropError is a wrapper error that indicates the LB policy wishes to drop the
 // RPC and not retry it.
 type dropError struct {
diff --git a/.ci/providerlint/vendor/google.golang.org/grpc/pickfirst.go b/.ci/providerlint/vendor/google.golang.org/grpc/pickfirst.go
index fb7a99e0a27..abe266b021d 100644
--- a/.ci/providerlint/vendor/google.golang.org/grpc/pickfirst.go
+++ b/.ci/providerlint/vendor/google.golang.org/grpc/pickfirst.go
@@ -19,11 +19,15 @@
 package grpc
 
 import (
+	"encoding/json"
 	"errors"
 	"fmt"
 
 	"google.golang.org/grpc/balancer"
 	"google.golang.org/grpc/connectivity"
+	"google.golang.org/grpc/internal/envconfig"
+	"google.golang.org/grpc/internal/grpcrand"
+	"google.golang.org/grpc/serviceconfig"
 )
 
 // PickFirstBalancerName is the name of the pick_first balancer.
@@ -43,15 +47,33 @@ func (*pickfirstBuilder) Name() string {
 	return PickFirstBalancerName
 }
 
+type pfConfig struct {
+	serviceconfig.LoadBalancingConfig `json:"-"`
+
+	// If set to true, instructs the LB policy to shuffle the order of the list
+	// of addresses received from the name resolver before attempting to
+	// connect to them.
+	ShuffleAddressList bool `json:"shuffleAddressList"`
+}
+
+func (*pickfirstBuilder) ParseConfig(js json.RawMessage) (serviceconfig.LoadBalancingConfig, error) {
+	cfg := &pfConfig{}
+	if err := json.Unmarshal(js, cfg); err != nil {
+		return nil, fmt.Errorf("pickfirst: unable to unmarshal LB policy config: %s, error: %v", string(js), err)
+	}
+	return cfg, nil
+}
+
 type pickfirstBalancer struct {
 	state   connectivity.State
 	cc      balancer.ClientConn
 	subConn balancer.SubConn
+	cfg     *pfConfig
 }
 
 func (b *pickfirstBalancer) ResolverError(err error) {
 	if logger.V(2) {
-		logger.Infof("pickfirstBalancer: ResolverError called with error %v", err)
+		logger.Infof("pickfirstBalancer: ResolverError called with error: %v", err)
 	}
 	if b.subConn == nil {
 		b.state = connectivity.TransientFailure
@@ -69,7 +91,8 @@ func (b *pickfirstBalancer) ResolverError(err error) {
 }
 
 func (b *pickfirstBalancer) UpdateClientConnState(state balancer.ClientConnState) error {
-	if len(state.ResolverState.Addresses) == 0 {
+	addrs := state.ResolverState.Addresses
+	if len(addrs) == 0 {
 		// The resolver reported an empty address list. Treat it like an error by
 		// calling b.ResolverError.
 		if b.subConn != nil {
@@ -82,12 +105,23 @@ func (b *pickfirstBalancer) UpdateClientConnState(state balancer.ClientConnState
 		return balancer.ErrBadResolverState
 	}
 
+	if state.BalancerConfig != nil {
+		cfg, ok := state.BalancerConfig.(*pfConfig)
+		if !ok {
+			return fmt.Errorf("pickfirstBalancer: received nil or illegal BalancerConfig (type %T): %v", state.BalancerConfig, state.BalancerConfig)
+		}
+		b.cfg = cfg
+	}
+
+	if envconfig.PickFirstLBConfig && b.cfg != nil && b.cfg.ShuffleAddressList {
+		grpcrand.Shuffle(len(addrs), func(i, j int) { addrs[i], addrs[j] = addrs[j], addrs[i] })
+	}
 	if b.subConn != nil {
-		b.cc.UpdateAddresses(b.subConn, state.ResolverState.Addresses)
+		b.cc.UpdateAddresses(b.subConn, addrs)
 		return nil
 	}
 
-	subConn, err := b.cc.NewSubConn(state.ResolverState.Addresses, balancer.NewSubConnOptions{})
+	subConn, err := b.cc.NewSubConn(addrs, balancer.NewSubConnOptions{})
 	if err != nil {
 		if logger.V(2) {
 			logger.Errorf("pickfirstBalancer: failed to NewSubConn: %v", err)
@@ -102,8 +136,8 @@ func (b *pickfirstBalancer) UpdateClientConnState(state balancer.ClientConnState
 	b.subConn = subConn
 	b.state = connectivity.Idle
 	b.cc.UpdateState(balancer.State{
-		ConnectivityState: connectivity.Idle,
-		Picker:            &picker{result: balancer.PickResult{SubConn: b.subConn}},
+		ConnectivityState: connectivity.Connecting,
+		Picker:            &picker{err: balancer.ErrNoSubConnAvailable},
 	})
 	b.subConn.Connect()
 	return nil
@@ -119,7 +153,6 @@ func (b *pickfirstBalancer) UpdateSubConnState(subConn balancer.SubConn, state b
 		}
 		return
 	}
-	b.state = state.ConnectivityState
 	if state.ConnectivityState == connectivity.Shutdown {
 		b.subConn = nil
 		return
@@ -132,11 +165,21 @@ func (b *pickfirstBalancer) UpdateSubConnState(subConn balancer.SubConn, state b
 			Picker:            &picker{result: balancer.PickResult{SubConn: subConn}},
 		})
 	case connectivity.Connecting:
+		if b.state == connectivity.TransientFailure {
+			// We stay in TransientFailure until we are Ready. See A62.
+			return
+		}
 		b.cc.UpdateState(balancer.State{
 			ConnectivityState: state.ConnectivityState,
 			Picker:            &picker{err: balancer.ErrNoSubConnAvailable},
 		})
 	case connectivity.Idle:
+		if b.state == connectivity.TransientFailure {
+			// We stay in TransientFailure until we are Ready. Also kick the
+			// subConn out of Idle into Connecting. See A62.
+			b.subConn.Connect()
+			return
+		}
 		b.cc.UpdateState(balancer.State{
 			ConnectivityState: state.ConnectivityState,
 			Picker:            &idlePicker{subConn: subConn},
@@ -147,6 +190,7 @@ func (b *pickfirstBalancer) UpdateSubConnState(subConn balancer.SubConn, state b
 			Picker:            &picker{err: state.ConnectionError},
 		})
 	}
+	b.state = state.ConnectivityState
 }
 
 func (b *pickfirstBalancer) Close() {
diff --git a/.ci/providerlint/vendor/google.golang.org/grpc/reflection/adapt.go b/.ci/providerlint/vendor/google.golang.org/grpc/reflection/adapt.go
new file mode 100644
index 00000000000..33b907a36da
--- /dev/null
+++ b/.ci/providerlint/vendor/google.golang.org/grpc/reflection/adapt.go
@@ -0,0 +1,187 @@
+/*
+ *
+ * Copyright 2023 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package reflection
+
+import (
+	v1reflectiongrpc "google.golang.org/grpc/reflection/grpc_reflection_v1"
+	v1reflectionpb "google.golang.org/grpc/reflection/grpc_reflection_v1"
+	v1alphareflectiongrpc "google.golang.org/grpc/reflection/grpc_reflection_v1alpha"
+	v1alphareflectionpb "google.golang.org/grpc/reflection/grpc_reflection_v1alpha"
+)
+
+// asV1Alpha returns an implementation of the v1alpha version of the reflection
+// interface that delegates all calls to the given v1 version.
+func asV1Alpha(svr v1reflectiongrpc.ServerReflectionServer) v1alphareflectiongrpc.ServerReflectionServer {
+	return v1AlphaServerImpl{svr: svr}
+}
+
+type v1AlphaServerImpl struct {
+	svr v1reflectiongrpc.ServerReflectionServer
+}
+
+func (s v1AlphaServerImpl) ServerReflectionInfo(stream v1alphareflectiongrpc.ServerReflection_ServerReflectionInfoServer) error {
+	return s.svr.ServerReflectionInfo(v1AlphaServerStreamAdapter{stream})
+}
+
+type v1AlphaServerStreamAdapter struct {
+	v1alphareflectiongrpc.ServerReflection_ServerReflectionInfoServer
+}
+
+func (s v1AlphaServerStreamAdapter) Send(response *v1reflectionpb.ServerReflectionResponse) error {
+	return s.ServerReflection_ServerReflectionInfoServer.Send(v1ToV1AlphaResponse(response))
+}
+
+func (s v1AlphaServerStreamAdapter) Recv() (*v1reflectionpb.ServerReflectionRequest, error) {
+	resp, err := s.ServerReflection_ServerReflectionInfoServer.Recv()
+	if err != nil {
+		return nil, err
+	}
+	return v1AlphaToV1Request(resp), nil
+}
+
+func v1ToV1AlphaResponse(v1 *v1reflectionpb.ServerReflectionResponse) *v1alphareflectionpb.ServerReflectionResponse {
+	var v1alpha v1alphareflectionpb.ServerReflectionResponse
+	v1alpha.ValidHost = v1.ValidHost
+	if v1.OriginalRequest != nil {
+		v1alpha.OriginalRequest = v1ToV1AlphaRequest(v1.OriginalRequest)
+	}
+	switch mr := v1.MessageResponse.(type) {
+	case *v1reflectionpb.ServerReflectionResponse_FileDescriptorResponse:
+		if mr != nil {
+			v1alpha.MessageResponse = &v1alphareflectionpb.ServerReflectionResponse_FileDescriptorResponse{
+				FileDescriptorResponse: &v1alphareflectionpb.FileDescriptorResponse{
+					FileDescriptorProto: mr.FileDescriptorResponse.GetFileDescriptorProto(),
+				},
+			}
+		}
+	case *v1reflectionpb.ServerReflectionResponse_AllExtensionNumbersResponse:
+		if mr != nil {
+			v1alpha.MessageResponse = &v1alphareflectionpb.ServerReflectionResponse_AllExtensionNumbersResponse{
+				AllExtensionNumbersResponse: &v1alphareflectionpb.ExtensionNumberResponse{
+					BaseTypeName:    mr.AllExtensionNumbersResponse.GetBaseTypeName(),
+					ExtensionNumber: mr.AllExtensionNumbersResponse.GetExtensionNumber(),
+				},
+			}
+		}
+	case *v1reflectionpb.ServerReflectionResponse_ListServicesResponse:
+		if mr != nil {
+			svcs := make([]*v1alphareflectionpb.ServiceResponse, len(mr.ListServicesResponse.GetService()))
+			for i, svc := range mr.ListServicesResponse.GetService() {
+				svcs[i] = &v1alphareflectionpb.ServiceResponse{
+					Name: svc.GetName(),
+				}
+			}
+			v1alpha.MessageResponse = &v1alphareflectionpb.ServerReflectionResponse_ListServicesResponse{
+				ListServicesResponse: &v1alphareflectionpb.ListServiceResponse{
+					Service: svcs,
+				},
+			}
+		}
+	case *v1reflectionpb.ServerReflectionResponse_ErrorResponse:
+		if mr != nil {
+			v1alpha.MessageResponse = &v1alphareflectionpb.ServerReflectionResponse_ErrorResponse{
+				ErrorResponse: &v1alphareflectionpb.ErrorResponse{
+					ErrorCode:    mr.ErrorResponse.GetErrorCode(),
+					ErrorMessage: mr.ErrorResponse.GetErrorMessage(),
+				},
+			}
+		}
+	default:
+		// no value set
+	}
+	return &v1alpha
+}
+
+func v1AlphaToV1Request(v1alpha *v1alphareflectionpb.ServerReflectionRequest) *v1reflectionpb.ServerReflectionRequest {
+	var v1 v1reflectionpb.ServerReflectionRequest
+	v1.Host = v1alpha.Host
+	switch mr := v1alpha.MessageRequest.(type) {
+	case *v1alphareflectionpb.ServerReflectionRequest_FileByFilename:
+		v1.MessageRequest = &v1reflectionpb.ServerReflectionRequest_FileByFilename{
+			FileByFilename: mr.FileByFilename,
+		}
+	case *v1alphareflectionpb.ServerReflectionRequest_FileContainingSymbol:
+		v1.MessageRequest = &v1reflectionpb.ServerReflectionRequest_FileContainingSymbol{
+			FileContainingSymbol: mr.FileContainingSymbol,
+		}
+	case *v1alphareflectionpb.ServerReflectionRequest_FileContainingExtension:
+		if mr.FileContainingExtension != nil {
+			v1.MessageRequest = &v1reflectionpb.ServerReflectionRequest_FileContainingExtension{
+				FileContainingExtension: &v1reflectionpb.ExtensionRequest{
+					ContainingType:  mr.FileContainingExtension.GetContainingType(),
+					ExtensionNumber: mr.FileContainingExtension.GetExtensionNumber(),
+				},
+			}
+		}
+	case *v1alphareflectionpb.ServerReflectionRequest_AllExtensionNumbersOfType:
+		v1.MessageRequest = &v1reflectionpb.ServerReflectionRequest_AllExtensionNumbersOfType{
+			AllExtensionNumbersOfType: mr.AllExtensionNumbersOfType,
+		}
+	case *v1alphareflectionpb.ServerReflectionRequest_ListServices:
+		v1.MessageRequest = &v1reflectionpb.ServerReflectionRequest_ListServices{
+			ListServices: mr.ListServices,
+		}
+	default:
+		// no value set
+	}
+	return &v1
+}
+
+func v1ToV1AlphaRequest(v1 *v1reflectionpb.ServerReflectionRequest) *v1alphareflectionpb.ServerReflectionRequest {
+	var v1alpha v1alphareflectionpb.ServerReflectionRequest
+	v1alpha.Host = v1.Host
+	switch mr := v1.MessageRequest.(type) {
+	case *v1reflectionpb.ServerReflectionRequest_FileByFilename:
+		if mr != nil {
+			v1alpha.MessageRequest = &v1alphareflectionpb.ServerReflectionRequest_FileByFilename{
+				FileByFilename: mr.FileByFilename,
+			}
+		}
+	case *v1reflectionpb.ServerReflectionRequest_FileContainingSymbol:
+		if mr != nil {
+			v1alpha.MessageRequest = &v1alphareflectionpb.ServerReflectionRequest_FileContainingSymbol{
+				FileContainingSymbol: mr.FileContainingSymbol,
+			}
+		}
+	case *v1reflectionpb.ServerReflectionRequest_FileContainingExtension:
+		if mr != nil {
+			v1alpha.MessageRequest = &v1alphareflectionpb.ServerReflectionRequest_FileContainingExtension{
+				FileContainingExtension: &v1alphareflectionpb.ExtensionRequest{
+					ContainingType:  mr.FileContainingExtension.GetContainingType(),
+					ExtensionNumber: mr.FileContainingExtension.GetExtensionNumber(),
+				},
+			}
+		}
+	case *v1reflectionpb.ServerReflectionRequest_AllExtensionNumbersOfType:
+		if mr != nil {
+			v1alpha.MessageRequest = &v1alphareflectionpb.ServerReflectionRequest_AllExtensionNumbersOfType{
+				AllExtensionNumbersOfType: mr.AllExtensionNumbersOfType,
+			}
+		}
+	case *v1reflectionpb.ServerReflectionRequest_ListServices:
+		if mr != nil {
+			v1alpha.MessageRequest = &v1alphareflectionpb.ServerReflectionRequest_ListServices{
+				ListServices: mr.ListServices,
+			}
+		}
+	default:
+		// no value set
+	}
+	return &v1alpha
+}
diff --git a/.ci/providerlint/vendor/google.golang.org/grpc/reflection/grpc_reflection_v1/reflection.pb.go b/.ci/providerlint/vendor/google.golang.org/grpc/reflection/grpc_reflection_v1/reflection.pb.go
new file mode 100644
index 00000000000..ececdb89c97
--- /dev/null
+++ b/.ci/providerlint/vendor/google.golang.org/grpc/reflection/grpc_reflection_v1/reflection.pb.go
@@ -0,0 +1,953 @@
+// Copyright 2016 The gRPC Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Service exported by server reflection.  A more complete description of how
+// server reflection works can be found at
+// https://github.com/grpc/grpc/blob/master/doc/server-reflection.md
+//
+// The canonical version of this proto can be found at
+// https://github.com/grpc/grpc-proto/blob/master/grpc/reflection/v1/reflection.proto
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.30.0
+// 	protoc        v4.22.0
+// source: grpc/reflection/v1/reflection.proto
+
+package grpc_reflection_v1
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// The message sent by the client when calling ServerReflectionInfo method.
+type ServerReflectionRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Host string `protobuf:"bytes,1,opt,name=host,proto3" json:"host,omitempty"`
+	// To use reflection service, the client should set one of the following
+	// fields in message_request. The server distinguishes requests by their
+	// defined field and then handles them using corresponding methods.
+	//
+	// Types that are assignable to MessageRequest:
+	//
+	//	*ServerReflectionRequest_FileByFilename
+	//	*ServerReflectionRequest_FileContainingSymbol
+	//	*ServerReflectionRequest_FileContainingExtension
+	//	*ServerReflectionRequest_AllExtensionNumbersOfType
+	//	*ServerReflectionRequest_ListServices
+	MessageRequest isServerReflectionRequest_MessageRequest `protobuf_oneof:"message_request"`
+}
+
+func (x *ServerReflectionRequest) Reset() {
+	*x = ServerReflectionRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_grpc_reflection_v1_reflection_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ServerReflectionRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ServerReflectionRequest) ProtoMessage() {}
+
+func (x *ServerReflectionRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_grpc_reflection_v1_reflection_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ServerReflectionRequest.ProtoReflect.Descriptor instead.
+func (*ServerReflectionRequest) Descriptor() ([]byte, []int) {
+	return file_grpc_reflection_v1_reflection_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *ServerReflectionRequest) GetHost() string {
+	if x != nil {
+		return x.Host
+	}
+	return ""
+}
+
+func (m *ServerReflectionRequest) GetMessageRequest() isServerReflectionRequest_MessageRequest {
+	if m != nil {
+		return m.MessageRequest
+	}
+	return nil
+}
+
+func (x *ServerReflectionRequest) GetFileByFilename() string {
+	if x, ok := x.GetMessageRequest().(*ServerReflectionRequest_FileByFilename); ok {
+		return x.FileByFilename
+	}
+	return ""
+}
+
+func (x *ServerReflectionRequest) GetFileContainingSymbol() string {
+	if x, ok := x.GetMessageRequest().(*ServerReflectionRequest_FileContainingSymbol); ok {
+		return x.FileContainingSymbol
+	}
+	return ""
+}
+
+func (x *ServerReflectionRequest) GetFileContainingExtension() *ExtensionRequest {
+	if x, ok := x.GetMessageRequest().(*ServerReflectionRequest_FileContainingExtension); ok {
+		return x.FileContainingExtension
+	}
+	return nil
+}
+
+func (x *ServerReflectionRequest) GetAllExtensionNumbersOfType() string {
+	if x, ok := x.GetMessageRequest().(*ServerReflectionRequest_AllExtensionNumbersOfType); ok {
+		return x.AllExtensionNumbersOfType
+	}
+	return ""
+}
+
+func (x *ServerReflectionRequest) GetListServices() string {
+	if x, ok := x.GetMessageRequest().(*ServerReflectionRequest_ListServices); ok {
+		return x.ListServices
+	}
+	return ""
+}
+
+type isServerReflectionRequest_MessageRequest interface {
+	isServerReflectionRequest_MessageRequest()
+}
+
+type ServerReflectionRequest_FileByFilename struct {
+	// Find a proto file by the file name.
+	FileByFilename string `protobuf:"bytes,3,opt,name=file_by_filename,json=fileByFilename,proto3,oneof"`
+}
+
+type ServerReflectionRequest_FileContainingSymbol struct {
+	// Find the proto file that declares the given fully-qualified symbol name.
+	// This field should be a fully-qualified symbol name
+	// (e.g. <package>.<service>[.<method>] or <package>.<type>).
+	FileContainingSymbol string `protobuf:"bytes,4,opt,name=file_containing_symbol,json=fileContainingSymbol,proto3,oneof"`
+}
+
+type ServerReflectionRequest_FileContainingExtension struct {
+	// Find the proto file which defines an extension extending the given
+	// message type with the given field number.
+	FileContainingExtension *ExtensionRequest `protobuf:"bytes,5,opt,name=file_containing_extension,json=fileContainingExtension,proto3,oneof"`
+}
+
+type ServerReflectionRequest_AllExtensionNumbersOfType struct {
+	// Finds the tag numbers used by all known extensions of the given message
+	// type, and appends them to ExtensionNumberResponse in an undefined order.
+	// Its corresponding method is best-effort: it's not guaranteed that the
+	// reflection service will implement this method, and it's not guaranteed
+	// that this method will provide all extensions. Returns
+	// StatusCode::UNIMPLEMENTED if it's not implemented.
+	// This field should be a fully-qualified type name. The format is
+	// <package>.<type>
+	AllExtensionNumbersOfType string `protobuf:"bytes,6,opt,name=all_extension_numbers_of_type,json=allExtensionNumbersOfType,proto3,oneof"`
+}
+
+type ServerReflectionRequest_ListServices struct {
+	// List the full names of registered services. The content will not be
+	// checked.
+	ListServices string `protobuf:"bytes,7,opt,name=list_services,json=listServices,proto3,oneof"`
+}
+
+func (*ServerReflectionRequest_FileByFilename) isServerReflectionRequest_MessageRequest() {}
+
+func (*ServerReflectionRequest_FileContainingSymbol) isServerReflectionRequest_MessageRequest() {}
+
+func (*ServerReflectionRequest_FileContainingExtension) isServerReflectionRequest_MessageRequest() {}
+
+func (*ServerReflectionRequest_AllExtensionNumbersOfType) isServerReflectionRequest_MessageRequest() {
+}
+
+func (*ServerReflectionRequest_ListServices) isServerReflectionRequest_MessageRequest() {}
+
+// The type name and extension number sent by the client when requesting
+// file_containing_extension.
+type ExtensionRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Fully-qualified type name. The format should be <package>.<type>
+	ContainingType  string `protobuf:"bytes,1,opt,name=containing_type,json=containingType,proto3" json:"containing_type,omitempty"`
+	ExtensionNumber int32  `protobuf:"varint,2,opt,name=extension_number,json=extensionNumber,proto3" json:"extension_number,omitempty"`
+}
+
+func (x *ExtensionRequest) Reset() {
+	*x = ExtensionRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_grpc_reflection_v1_reflection_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ExtensionRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ExtensionRequest) ProtoMessage() {}
+
+func (x *ExtensionRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_grpc_reflection_v1_reflection_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ExtensionRequest.ProtoReflect.Descriptor instead.
+func (*ExtensionRequest) Descriptor() ([]byte, []int) {
+	return file_grpc_reflection_v1_reflection_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *ExtensionRequest) GetContainingType() string {
+	if x != nil {
+		return x.ContainingType
+	}
+	return ""
+}
+
+func (x *ExtensionRequest) GetExtensionNumber() int32 {
+	if x != nil {
+		return x.ExtensionNumber
+	}
+	return 0
+}
+
+// The message sent by the server to answer ServerReflectionInfo method.
+type ServerReflectionResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	ValidHost       string                   `protobuf:"bytes,1,opt,name=valid_host,json=validHost,proto3" json:"valid_host,omitempty"`
+	OriginalRequest *ServerReflectionRequest `protobuf:"bytes,2,opt,name=original_request,json=originalRequest,proto3" json:"original_request,omitempty"`
+	// The server sets one of the following fields according to the message_request
+	// in the request.
+	//
+	// Types that are assignable to MessageResponse:
+	//
+	//	*ServerReflectionResponse_FileDescriptorResponse
+	//	*ServerReflectionResponse_AllExtensionNumbersResponse
+	//	*ServerReflectionResponse_ListServicesResponse
+	//	*ServerReflectionResponse_ErrorResponse
+	MessageResponse isServerReflectionResponse_MessageResponse `protobuf_oneof:"message_response"`
+}
+
+func (x *ServerReflectionResponse) Reset() {
+	*x = ServerReflectionResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_grpc_reflection_v1_reflection_proto_msgTypes[2]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ServerReflectionResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ServerReflectionResponse) ProtoMessage() {}
+
+func (x *ServerReflectionResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_grpc_reflection_v1_reflection_proto_msgTypes[2]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ServerReflectionResponse.ProtoReflect.Descriptor instead.
+func (*ServerReflectionResponse) Descriptor() ([]byte, []int) {
+	return file_grpc_reflection_v1_reflection_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *ServerReflectionResponse) GetValidHost() string {
+	if x != nil {
+		return x.ValidHost
+	}
+	return ""
+}
+
+func (x *ServerReflectionResponse) GetOriginalRequest() *ServerReflectionRequest {
+	if x != nil {
+		return x.OriginalRequest
+	}
+	return nil
+}
+
+func (m *ServerReflectionResponse) GetMessageResponse() isServerReflectionResponse_MessageResponse {
+	if m != nil {
+		return m.MessageResponse
+	}
+	return nil
+}
+
+func (x *ServerReflectionResponse) GetFileDescriptorResponse() *FileDescriptorResponse {
+	if x, ok := x.GetMessageResponse().(*ServerReflectionResponse_FileDescriptorResponse); ok {
+		return x.FileDescriptorResponse
+	}
+	return nil
+}
+
+func (x *ServerReflectionResponse) GetAllExtensionNumbersResponse() *ExtensionNumberResponse {
+	if x, ok := x.GetMessageResponse().(*ServerReflectionResponse_AllExtensionNumbersResponse); ok {
+		return x.AllExtensionNumbersResponse
+	}
+	return nil
+}
+
+func (x *ServerReflectionResponse) GetListServicesResponse() *ListServiceResponse {
+	if x, ok := x.GetMessageResponse().(*ServerReflectionResponse_ListServicesResponse); ok {
+		return x.ListServicesResponse
+	}
+	return nil
+}
+
+func (x *ServerReflectionResponse) GetErrorResponse() *ErrorResponse {
+	if x, ok := x.GetMessageResponse().(*ServerReflectionResponse_ErrorResponse); ok {
+		return x.ErrorResponse
+	}
+	return nil
+}
+
+type isServerReflectionResponse_MessageResponse interface {
+	isServerReflectionResponse_MessageResponse()
+}
+
+type ServerReflectionResponse_FileDescriptorResponse struct {
+	// This message is used to answer file_by_filename, file_containing_symbol,
+	// file_containing_extension requests with transitive dependencies.
+	// As the repeated label is not allowed in oneof fields, we use a
+	// FileDescriptorResponse message to encapsulate the repeated fields.
+	// The reflection service is allowed to avoid sending FileDescriptorProtos
+	// that were previously sent in response to earlier requests in the stream.
+	FileDescriptorResponse *FileDescriptorResponse `protobuf:"bytes,4,opt,name=file_descriptor_response,json=fileDescriptorResponse,proto3,oneof"`
+}
+
+type ServerReflectionResponse_AllExtensionNumbersResponse struct {
+	// This message is used to answer all_extension_numbers_of_type requests.
+	AllExtensionNumbersResponse *ExtensionNumberResponse `protobuf:"bytes,5,opt,name=all_extension_numbers_response,json=allExtensionNumbersResponse,proto3,oneof"`
+}
+
+type ServerReflectionResponse_ListServicesResponse struct {
+	// This message is used to answer list_services requests.
+	ListServicesResponse *ListServiceResponse `protobuf:"bytes,6,opt,name=list_services_response,json=listServicesResponse,proto3,oneof"`
+}
+
+type ServerReflectionResponse_ErrorResponse struct {
+	// This message is used when an error occurs.
+	ErrorResponse *ErrorResponse `protobuf:"bytes,7,opt,name=error_response,json=errorResponse,proto3,oneof"`
+}
+
+func (*ServerReflectionResponse_FileDescriptorResponse) isServerReflectionResponse_MessageResponse() {
+}
+
+func (*ServerReflectionResponse_AllExtensionNumbersResponse) isServerReflectionResponse_MessageResponse() {
+}
+
+func (*ServerReflectionResponse_ListServicesResponse) isServerReflectionResponse_MessageResponse() {}
+
+func (*ServerReflectionResponse_ErrorResponse) isServerReflectionResponse_MessageResponse() {}
+
+// Serialized FileDescriptorProto messages sent by the server answering
+// a file_by_filename, file_containing_symbol, or file_containing_extension
+// request.
+type FileDescriptorResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Serialized FileDescriptorProto messages. We avoid taking a dependency on
+	// descriptor.proto, which uses proto2 only features, by making them opaque
+	// bytes instead.
+	FileDescriptorProto [][]byte `protobuf:"bytes,1,rep,name=file_descriptor_proto,json=fileDescriptorProto,proto3" json:"file_descriptor_proto,omitempty"`
+}
+
+func (x *FileDescriptorResponse) Reset() {
+	*x = FileDescriptorResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_grpc_reflection_v1_reflection_proto_msgTypes[3]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *FileDescriptorResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*FileDescriptorResponse) ProtoMessage() {}
+
+func (x *FileDescriptorResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_grpc_reflection_v1_reflection_proto_msgTypes[3]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use FileDescriptorResponse.ProtoReflect.Descriptor instead.
+func (*FileDescriptorResponse) Descriptor() ([]byte, []int) {
+	return file_grpc_reflection_v1_reflection_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *FileDescriptorResponse) GetFileDescriptorProto() [][]byte {
+	if x != nil {
+		return x.FileDescriptorProto
+	}
+	return nil
+}
+
+// A list of extension numbers sent by the server answering
+// all_extension_numbers_of_type request.
+type ExtensionNumberResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Full name of the base type, including the package name. The format
+	// is <package>.<type>
+	BaseTypeName    string  `protobuf:"bytes,1,opt,name=base_type_name,json=baseTypeName,proto3" json:"base_type_name,omitempty"`
+	ExtensionNumber []int32 `protobuf:"varint,2,rep,packed,name=extension_number,json=extensionNumber,proto3" json:"extension_number,omitempty"`
+}
+
+func (x *ExtensionNumberResponse) Reset() {
+	*x = ExtensionNumberResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_grpc_reflection_v1_reflection_proto_msgTypes[4]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ExtensionNumberResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ExtensionNumberResponse) ProtoMessage() {}
+
+func (x *ExtensionNumberResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_grpc_reflection_v1_reflection_proto_msgTypes[4]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ExtensionNumberResponse.ProtoReflect.Descriptor instead.
+func (*ExtensionNumberResponse) Descriptor() ([]byte, []int) {
+	return file_grpc_reflection_v1_reflection_proto_rawDescGZIP(), []int{4}
+}
+
+func (x *ExtensionNumberResponse) GetBaseTypeName() string {
+	if x != nil {
+		return x.BaseTypeName
+	}
+	return ""
+}
+
+func (x *ExtensionNumberResponse) GetExtensionNumber() []int32 {
+	if x != nil {
+		return x.ExtensionNumber
+	}
+	return nil
+}
+
+// A list of ServiceResponse sent by the server answering list_services request.
+type ListServiceResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// The information of each service may be expanded in the future, so we use
+	// ServiceResponse message to encapsulate it.
+	Service []*ServiceResponse `protobuf:"bytes,1,rep,name=service,proto3" json:"service,omitempty"`
+}
+
+func (x *ListServiceResponse) Reset() {
+	*x = ListServiceResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_grpc_reflection_v1_reflection_proto_msgTypes[5]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ListServiceResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListServiceResponse) ProtoMessage() {}
+
+func (x *ListServiceResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_grpc_reflection_v1_reflection_proto_msgTypes[5]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListServiceResponse.ProtoReflect.Descriptor instead.
+func (*ListServiceResponse) Descriptor() ([]byte, []int) {
+	return file_grpc_reflection_v1_reflection_proto_rawDescGZIP(), []int{5}
+}
+
+func (x *ListServiceResponse) GetService() []*ServiceResponse {
+	if x != nil {
+		return x.Service
+	}
+	return nil
+}
+
+// The information of a single service used by ListServiceResponse to answer
+// list_services request.
+type ServiceResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Full name of a registered service, including its package name. The format
+	// is <package>.<service>
+	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+}
+
+func (x *ServiceResponse) Reset() {
+	*x = ServiceResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_grpc_reflection_v1_reflection_proto_msgTypes[6]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ServiceResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ServiceResponse) ProtoMessage() {}
+
+func (x *ServiceResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_grpc_reflection_v1_reflection_proto_msgTypes[6]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ServiceResponse.ProtoReflect.Descriptor instead.
+func (*ServiceResponse) Descriptor() ([]byte, []int) {
+	return file_grpc_reflection_v1_reflection_proto_rawDescGZIP(), []int{6}
+}
+
+func (x *ServiceResponse) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+// The error code and error message sent by the server when an error occurs.
+type ErrorResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// This field uses the error codes defined in grpc::StatusCode.
+	ErrorCode    int32  `protobuf:"varint,1,opt,name=error_code,json=errorCode,proto3" json:"error_code,omitempty"`
+	ErrorMessage string `protobuf:"bytes,2,opt,name=error_message,json=errorMessage,proto3" json:"error_message,omitempty"`
+}
+
+func (x *ErrorResponse) Reset() {
+	*x = ErrorResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_grpc_reflection_v1_reflection_proto_msgTypes[7]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ErrorResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ErrorResponse) ProtoMessage() {}
+
+func (x *ErrorResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_grpc_reflection_v1_reflection_proto_msgTypes[7]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ErrorResponse.ProtoReflect.Descriptor instead.
+func (*ErrorResponse) Descriptor() ([]byte, []int) {
+	return file_grpc_reflection_v1_reflection_proto_rawDescGZIP(), []int{7}
+}
+
+func (x *ErrorResponse) GetErrorCode() int32 {
+	if x != nil {
+		return x.ErrorCode
+	}
+	return 0
+}
+
+func (x *ErrorResponse) GetErrorMessage() string {
+	if x != nil {
+		return x.ErrorMessage
+	}
+	return ""
+}
+
+var File_grpc_reflection_v1_reflection_proto protoreflect.FileDescriptor
+
+var file_grpc_reflection_v1_reflection_proto_rawDesc = []byte{
+	0x0a, 0x23, 0x67, 0x72, 0x70, 0x63, 0x2f, 0x72, 0x65, 0x66, 0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f,
+	0x6e, 0x2f, 0x76, 0x31, 0x2f, 0x72, 0x65, 0x66, 0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x2e,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x12, 0x67, 0x72, 0x70, 0x63, 0x2e, 0x72, 0x65, 0x66, 0x6c,
+	0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x76, 0x31, 0x22, 0xf3, 0x02, 0x0a, 0x17, 0x53, 0x65,
+	0x72, 0x76, 0x65, 0x72, 0x52, 0x65, 0x66, 0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65,
+	0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x12, 0x0a, 0x04, 0x68, 0x6f, 0x73, 0x74, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x04, 0x68, 0x6f, 0x73, 0x74, 0x12, 0x2a, 0x0a, 0x10, 0x66, 0x69, 0x6c,
+	0x65, 0x5f, 0x62, 0x79, 0x5f, 0x66, 0x69, 0x6c, 0x65, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x03, 0x20,
+	0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x0e, 0x66, 0x69, 0x6c, 0x65, 0x42, 0x79, 0x46, 0x69, 0x6c,
+	0x65, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x36, 0x0a, 0x16, 0x66, 0x69, 0x6c, 0x65, 0x5f, 0x63, 0x6f,
+	0x6e, 0x74, 0x61, 0x69, 0x6e, 0x69, 0x6e, 0x67, 0x5f, 0x73, 0x79, 0x6d, 0x62, 0x6f, 0x6c, 0x18,
+	0x04, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x14, 0x66, 0x69, 0x6c, 0x65, 0x43, 0x6f, 0x6e,
+	0x74, 0x61, 0x69, 0x6e, 0x69, 0x6e, 0x67, 0x53, 0x79, 0x6d, 0x62, 0x6f, 0x6c, 0x12, 0x62, 0x0a,
+	0x19, 0x66, 0x69, 0x6c, 0x65, 0x5f, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x69, 0x6e, 0x67,
+	0x5f, 0x65, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x24, 0x2e, 0x67, 0x72, 0x70, 0x63, 0x2e, 0x72, 0x65, 0x66, 0x6c, 0x65, 0x63, 0x74, 0x69,
+	0x6f, 0x6e, 0x2e, 0x76, 0x31, 0x2e, 0x45, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x52,
+	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x48, 0x00, 0x52, 0x17, 0x66, 0x69, 0x6c, 0x65, 0x43, 0x6f,
+	0x6e, 0x74, 0x61, 0x69, 0x6e, 0x69, 0x6e, 0x67, 0x45, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f,
+	0x6e, 0x12, 0x42, 0x0a, 0x1d, 0x61, 0x6c, 0x6c, 0x5f, 0x65, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69,
+	0x6f, 0x6e, 0x5f, 0x6e, 0x75, 0x6d, 0x62, 0x65, 0x72, 0x73, 0x5f, 0x6f, 0x66, 0x5f, 0x74, 0x79,
+	0x70, 0x65, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x19, 0x61, 0x6c, 0x6c, 0x45,
+	0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x4e, 0x75, 0x6d, 0x62, 0x65, 0x72, 0x73, 0x4f,
+	0x66, 0x54, 0x79, 0x70, 0x65, 0x12, 0x25, 0x0a, 0x0d, 0x6c, 0x69, 0x73, 0x74, 0x5f, 0x73, 0x65,
+	0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x0c,
+	0x6c, 0x69, 0x73, 0x74, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x42, 0x11, 0x0a, 0x0f,
+	0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x5f, 0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x22,
+	0x66, 0x0a, 0x10, 0x45, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75,
+	0x65, 0x73, 0x74, 0x12, 0x27, 0x0a, 0x0f, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x69, 0x6e,
+	0x67, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0e, 0x63, 0x6f,
+	0x6e, 0x74, 0x61, 0x69, 0x6e, 0x69, 0x6e, 0x67, 0x54, 0x79, 0x70, 0x65, 0x12, 0x29, 0x0a, 0x10,
+	0x65, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x6e, 0x75, 0x6d, 0x62, 0x65, 0x72,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x05, 0x52, 0x0f, 0x65, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f,
+	0x6e, 0x4e, 0x75, 0x6d, 0x62, 0x65, 0x72, 0x22, 0xae, 0x04, 0x0a, 0x18, 0x53, 0x65, 0x72, 0x76,
+	0x65, 0x72, 0x52, 0x65, 0x66, 0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70,
+	0x6f, 0x6e, 0x73, 0x65, 0x12, 0x1d, 0x0a, 0x0a, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x5f, 0x68, 0x6f,
+	0x73, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x48,
+	0x6f, 0x73, 0x74, 0x12, 0x56, 0x0a, 0x10, 0x6f, 0x72, 0x69, 0x67, 0x69, 0x6e, 0x61, 0x6c, 0x5f,
+	0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2b, 0x2e,
+	0x67, 0x72, 0x70, 0x63, 0x2e, 0x72, 0x65, 0x66, 0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x2e,
+	0x76, 0x31, 0x2e, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x52, 0x65, 0x66, 0x6c, 0x65, 0x63, 0x74,
+	0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x52, 0x0f, 0x6f, 0x72, 0x69, 0x67,
+	0x69, 0x6e, 0x61, 0x6c, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x66, 0x0a, 0x18, 0x66,
+	0x69, 0x6c, 0x65, 0x5f, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x6f, 0x72, 0x5f, 0x72,
+	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2a, 0x2e,
+	0x67, 0x72, 0x70, 0x63, 0x2e, 0x72, 0x65, 0x66, 0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x2e,
+	0x76, 0x31, 0x2e, 0x46, 0x69, 0x6c, 0x65, 0x44, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x6f,
+	0x72, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x48, 0x00, 0x52, 0x16, 0x66, 0x69, 0x6c,
+	0x65, 0x44, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x6f, 0x72, 0x52, 0x65, 0x73, 0x70, 0x6f,
+	0x6e, 0x73, 0x65, 0x12, 0x72, 0x0a, 0x1e, 0x61, 0x6c, 0x6c, 0x5f, 0x65, 0x78, 0x74, 0x65, 0x6e,
+	0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x6e, 0x75, 0x6d, 0x62, 0x65, 0x72, 0x73, 0x5f, 0x72, 0x65, 0x73,
+	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2b, 0x2e, 0x67, 0x72,
+	0x70, 0x63, 0x2e, 0x72, 0x65, 0x66, 0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x76, 0x31,
+	0x2e, 0x45, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x4e, 0x75, 0x6d, 0x62, 0x65, 0x72,
+	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x48, 0x00, 0x52, 0x1b, 0x61, 0x6c, 0x6c, 0x45,
+	0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x4e, 0x75, 0x6d, 0x62, 0x65, 0x72, 0x73, 0x52,
+	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x5f, 0x0a, 0x16, 0x6c, 0x69, 0x73, 0x74, 0x5f,
+	0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x5f, 0x72, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
+	0x65, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x27, 0x2e, 0x67, 0x72, 0x70, 0x63, 0x2e, 0x72,
+	0x65, 0x66, 0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x76, 0x31, 0x2e, 0x4c, 0x69, 0x73,
+	0x74, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
+	0x48, 0x00, 0x52, 0x14, 0x6c, 0x69, 0x73, 0x74, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73,
+	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x4a, 0x0a, 0x0e, 0x65, 0x72, 0x72, 0x6f,
+	0x72, 0x5f, 0x72, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x21, 0x2e, 0x67, 0x72, 0x70, 0x63, 0x2e, 0x72, 0x65, 0x66, 0x6c, 0x65, 0x63, 0x74, 0x69,
+	0x6f, 0x6e, 0x2e, 0x76, 0x31, 0x2e, 0x45, 0x72, 0x72, 0x6f, 0x72, 0x52, 0x65, 0x73, 0x70, 0x6f,
+	0x6e, 0x73, 0x65, 0x48, 0x00, 0x52, 0x0d, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x52, 0x65, 0x73, 0x70,
+	0x6f, 0x6e, 0x73, 0x65, 0x42, 0x12, 0x0a, 0x10, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x5f,
+	0x72, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x4c, 0x0a, 0x16, 0x46, 0x69, 0x6c, 0x65,
+	0x44, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x6f, 0x72, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
+	0x73, 0x65, 0x12, 0x32, 0x0a, 0x15, 0x66, 0x69, 0x6c, 0x65, 0x5f, 0x64, 0x65, 0x73, 0x63, 0x72,
+	0x69, 0x70, 0x74, 0x6f, 0x72, 0x5f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x18, 0x01, 0x20, 0x03, 0x28,
+	0x0c, 0x52, 0x13, 0x66, 0x69, 0x6c, 0x65, 0x44, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x6f,
+	0x72, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x6a, 0x0a, 0x17, 0x45, 0x78, 0x74, 0x65, 0x6e, 0x73,
+	0x69, 0x6f, 0x6e, 0x4e, 0x75, 0x6d, 0x62, 0x65, 0x72, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
+	0x65, 0x12, 0x24, 0x0a, 0x0e, 0x62, 0x61, 0x73, 0x65, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x5f, 0x6e,
+	0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x62, 0x61, 0x73, 0x65, 0x54,
+	0x79, 0x70, 0x65, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x29, 0x0a, 0x10, 0x65, 0x78, 0x74, 0x65, 0x6e,
+	0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x6e, 0x75, 0x6d, 0x62, 0x65, 0x72, 0x18, 0x02, 0x20, 0x03, 0x28,
+	0x05, 0x52, 0x0f, 0x65, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x4e, 0x75, 0x6d, 0x62,
+	0x65, 0x72, 0x22, 0x54, 0x0a, 0x13, 0x4c, 0x69, 0x73, 0x74, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63,
+	0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x3d, 0x0a, 0x07, 0x73, 0x65, 0x72,
+	0x76, 0x69, 0x63, 0x65, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x23, 0x2e, 0x67, 0x72, 0x70,
+	0x63, 0x2e, 0x72, 0x65, 0x66, 0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x76, 0x31, 0x2e,
+	0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x52,
+	0x07, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x22, 0x25, 0x0a, 0x0f, 0x53, 0x65, 0x72, 0x76,
+	0x69, 0x63, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x6e,
+	0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x22,
+	0x53, 0x0a, 0x0d, 0x45, 0x72, 0x72, 0x6f, 0x72, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
+	0x12, 0x1d, 0x0a, 0x0a, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x5f, 0x63, 0x6f, 0x64, 0x65, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x05, 0x52, 0x09, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x43, 0x6f, 0x64, 0x65, 0x12,
+	0x23, 0x0a, 0x0d, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x5f, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x4d, 0x65, 0x73,
+	0x73, 0x61, 0x67, 0x65, 0x32, 0x89, 0x01, 0x0a, 0x10, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x52,
+	0x65, 0x66, 0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x75, 0x0a, 0x14, 0x53, 0x65, 0x72,
+	0x76, 0x65, 0x72, 0x52, 0x65, 0x66, 0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x49, 0x6e, 0x66,
+	0x6f, 0x12, 0x2b, 0x2e, 0x67, 0x72, 0x70, 0x63, 0x2e, 0x72, 0x65, 0x66, 0x6c, 0x65, 0x63, 0x74,
+	0x69, 0x6f, 0x6e, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x52, 0x65, 0x66,
+	0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x2c,
+	0x2e, 0x67, 0x72, 0x70, 0x63, 0x2e, 0x72, 0x65, 0x66, 0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e,
+	0x2e, 0x76, 0x31, 0x2e, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x52, 0x65, 0x66, 0x6c, 0x65, 0x63,
+	0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x28, 0x01, 0x30, 0x01,
+	0x42, 0x66, 0x0a, 0x15, 0x69, 0x6f, 0x2e, 0x67, 0x72, 0x70, 0x63, 0x2e, 0x72, 0x65, 0x66, 0x6c,
+	0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x76, 0x31, 0x42, 0x15, 0x53, 0x65, 0x72, 0x76, 0x65,
+	0x72, 0x52, 0x65, 0x66, 0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x50, 0x72, 0x6f, 0x74, 0x6f,
+	0x50, 0x01, 0x5a, 0x34, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x67, 0x6f, 0x6c, 0x61, 0x6e,
+	0x67, 0x2e, 0x6f, 0x72, 0x67, 0x2f, 0x67, 0x72, 0x70, 0x63, 0x2f, 0x72, 0x65, 0x66, 0x6c, 0x65,
+	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x2f, 0x67, 0x72, 0x70, 0x63, 0x5f, 0x72, 0x65, 0x66, 0x6c, 0x65,
+	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x76, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_grpc_reflection_v1_reflection_proto_rawDescOnce sync.Once
+	file_grpc_reflection_v1_reflection_proto_rawDescData = file_grpc_reflection_v1_reflection_proto_rawDesc
+)
+
+func file_grpc_reflection_v1_reflection_proto_rawDescGZIP() []byte {
+	file_grpc_reflection_v1_reflection_proto_rawDescOnce.Do(func() {
+		file_grpc_reflection_v1_reflection_proto_rawDescData = protoimpl.X.CompressGZIP(file_grpc_reflection_v1_reflection_proto_rawDescData)
+	})
+	return file_grpc_reflection_v1_reflection_proto_rawDescData
+}
+
+var file_grpc_reflection_v1_reflection_proto_msgTypes = make([]protoimpl.MessageInfo, 8)
+var file_grpc_reflection_v1_reflection_proto_goTypes = []interface{}{
+	(*ServerReflectionRequest)(nil),  // 0: grpc.reflection.v1.ServerReflectionRequest
+	(*ExtensionRequest)(nil),         // 1: grpc.reflection.v1.ExtensionRequest
+	(*ServerReflectionResponse)(nil), // 2: grpc.reflection.v1.ServerReflectionResponse
+	(*FileDescriptorResponse)(nil),   // 3: grpc.reflection.v1.FileDescriptorResponse
+	(*ExtensionNumberResponse)(nil),  // 4: grpc.reflection.v1.ExtensionNumberResponse
+	(*ListServiceResponse)(nil),      // 5: grpc.reflection.v1.ListServiceResponse
+	(*ServiceResponse)(nil),          // 6: grpc.reflection.v1.ServiceResponse
+	(*ErrorResponse)(nil),            // 7: grpc.reflection.v1.ErrorResponse
+}
+var file_grpc_reflection_v1_reflection_proto_depIdxs = []int32{
+	1, // 0: grpc.reflection.v1.ServerReflectionRequest.file_containing_extension:type_name -> grpc.reflection.v1.ExtensionRequest
+	0, // 1: grpc.reflection.v1.ServerReflectionResponse.original_request:type_name -> grpc.reflection.v1.ServerReflectionRequest
+	3, // 2: grpc.reflection.v1.ServerReflectionResponse.file_descriptor_response:type_name -> grpc.reflection.v1.FileDescriptorResponse
+	4, // 3: grpc.reflection.v1.ServerReflectionResponse.all_extension_numbers_response:type_name -> grpc.reflection.v1.ExtensionNumberResponse
+	5, // 4: grpc.reflection.v1.ServerReflectionResponse.list_services_response:type_name -> grpc.reflection.v1.ListServiceResponse
+	7, // 5: grpc.reflection.v1.ServerReflectionResponse.error_response:type_name -> grpc.reflection.v1.ErrorResponse
+	6, // 6: grpc.reflection.v1.ListServiceResponse.service:type_name -> grpc.reflection.v1.ServiceResponse
+	0, // 7: grpc.reflection.v1.ServerReflection.ServerReflectionInfo:input_type -> grpc.reflection.v1.ServerReflectionRequest
+	2, // 8: grpc.reflection.v1.ServerReflection.ServerReflectionInfo:output_type -> grpc.reflection.v1.ServerReflectionResponse
+	8, // [8:9] is the sub-list for method output_type
+	7, // [7:8] is the sub-list for method input_type
+	7, // [7:7] is the sub-list for extension type_name
+	7, // [7:7] is the sub-list for extension extendee
+	0, // [0:7] is the sub-list for field type_name
+}
+
+func init() { file_grpc_reflection_v1_reflection_proto_init() }
+func file_grpc_reflection_v1_reflection_proto_init() {
+	if File_grpc_reflection_v1_reflection_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_grpc_reflection_v1_reflection_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ServerReflectionRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_grpc_reflection_v1_reflection_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ExtensionRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_grpc_reflection_v1_reflection_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ServerReflectionResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_grpc_reflection_v1_reflection_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*FileDescriptorResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_grpc_reflection_v1_reflection_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ExtensionNumberResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_grpc_reflection_v1_reflection_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ListServiceResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_grpc_reflection_v1_reflection_proto_msgTypes[6].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ServiceResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_grpc_reflection_v1_reflection_proto_msgTypes[7].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ErrorResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	file_grpc_reflection_v1_reflection_proto_msgTypes[0].OneofWrappers = []interface{}{
+		(*ServerReflectionRequest_FileByFilename)(nil),
+		(*ServerReflectionRequest_FileContainingSymbol)(nil),
+		(*ServerReflectionRequest_FileContainingExtension)(nil),
+		(*ServerReflectionRequest_AllExtensionNumbersOfType)(nil),
+		(*ServerReflectionRequest_ListServices)(nil),
+	}
+	file_grpc_reflection_v1_reflection_proto_msgTypes[2].OneofWrappers = []interface{}{
+		(*ServerReflectionResponse_FileDescriptorResponse)(nil),
+		(*ServerReflectionResponse_AllExtensionNumbersResponse)(nil),
+		(*ServerReflectionResponse_ListServicesResponse)(nil),
+		(*ServerReflectionResponse_ErrorResponse)(nil),
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_grpc_reflection_v1_reflection_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   8,
+			NumExtensions: 0,
+			NumServices:   1,
+		},
+		GoTypes:           file_grpc_reflection_v1_reflection_proto_goTypes,
+		DependencyIndexes: file_grpc_reflection_v1_reflection_proto_depIdxs,
+		MessageInfos:      file_grpc_reflection_v1_reflection_proto_msgTypes,
+	}.Build()
+	File_grpc_reflection_v1_reflection_proto = out.File
+	file_grpc_reflection_v1_reflection_proto_rawDesc = nil
+	file_grpc_reflection_v1_reflection_proto_goTypes = nil
+	file_grpc_reflection_v1_reflection_proto_depIdxs = nil
+}
diff --git a/.ci/providerlint/vendor/google.golang.org/grpc/reflection/grpc_reflection_v1/reflection_grpc.pb.go b/.ci/providerlint/vendor/google.golang.org/grpc/reflection/grpc_reflection_v1/reflection_grpc.pb.go
new file mode 100644
index 00000000000..62b56a8be0e
--- /dev/null
+++ b/.ci/providerlint/vendor/google.golang.org/grpc/reflection/grpc_reflection_v1/reflection_grpc.pb.go
@@ -0,0 +1,164 @@
+// Copyright 2016 The gRPC Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Service exported by server reflection.  A more complete description of how
+// server reflection works can be found at
+// https://github.com/grpc/grpc/blob/master/doc/server-reflection.md
+//
+// The canonical version of this proto can be found at
+// https://github.com/grpc/grpc-proto/blob/master/grpc/reflection/v1/reflection.proto
+
+// Code generated by protoc-gen-go-grpc. DO NOT EDIT.
+// versions:
+// - protoc-gen-go-grpc v1.3.0
+// - protoc             v4.22.0
+// source: grpc/reflection/v1/reflection.proto
+
+package grpc_reflection_v1
+
+import (
+	context "context"
+	grpc "google.golang.org/grpc"
+	codes "google.golang.org/grpc/codes"
+	status "google.golang.org/grpc/status"
+)
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the grpc package it is being compiled against.
+// Requires gRPC-Go v1.32.0 or later.
+const _ = grpc.SupportPackageIsVersion7
+
+const (
+	ServerReflection_ServerReflectionInfo_FullMethodName = "/grpc.reflection.v1.ServerReflection/ServerReflectionInfo"
+)
+
+// ServerReflectionClient is the client API for ServerReflection service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+type ServerReflectionClient interface {
+	// The reflection service is structured as a bidirectional stream, ensuring
+	// all related requests go to a single server.
+	ServerReflectionInfo(ctx context.Context, opts ...grpc.CallOption) (ServerReflection_ServerReflectionInfoClient, error)
+}
+
+type serverReflectionClient struct {
+	cc grpc.ClientConnInterface
+}
+
+func NewServerReflectionClient(cc grpc.ClientConnInterface) ServerReflectionClient {
+	return &serverReflectionClient{cc}
+}
+
+func (c *serverReflectionClient) ServerReflectionInfo(ctx context.Context, opts ...grpc.CallOption) (ServerReflection_ServerReflectionInfoClient, error) {
+	stream, err := c.cc.NewStream(ctx, &ServerReflection_ServiceDesc.Streams[0], ServerReflection_ServerReflectionInfo_FullMethodName, opts...)
+	if err != nil {
+		return nil, err
+	}
+	x := &serverReflectionServerReflectionInfoClient{stream}
+	return x, nil
+}
+
+type ServerReflection_ServerReflectionInfoClient interface {
+	Send(*ServerReflectionRequest) error
+	Recv() (*ServerReflectionResponse, error)
+	grpc.ClientStream
+}
+
+type serverReflectionServerReflectionInfoClient struct {
+	grpc.ClientStream
+}
+
+func (x *serverReflectionServerReflectionInfoClient) Send(m *ServerReflectionRequest) error {
+	return x.ClientStream.SendMsg(m)
+}
+
+func (x *serverReflectionServerReflectionInfoClient) Recv() (*ServerReflectionResponse, error) {
+	m := new(ServerReflectionResponse)
+	if err := x.ClientStream.RecvMsg(m); err != nil {
+		return nil, err
+	}
+	return m, nil
+}
+
+// ServerReflectionServer is the server API for ServerReflection service.
+// All implementations should embed UnimplementedServerReflectionServer
+// for forward compatibility
+type ServerReflectionServer interface {
+	// The reflection service is structured as a bidirectional stream, ensuring
+	// all related requests go to a single server.
+	ServerReflectionInfo(ServerReflection_ServerReflectionInfoServer) error
+}
+
+// UnimplementedServerReflectionServer should be embedded to have forward compatible implementations.
+type UnimplementedServerReflectionServer struct {
+}
+
+func (UnimplementedServerReflectionServer) ServerReflectionInfo(ServerReflection_ServerReflectionInfoServer) error {
+	return status.Errorf(codes.Unimplemented, "method ServerReflectionInfo not implemented")
+}
+
+// UnsafeServerReflectionServer may be embedded to opt out of forward compatibility for this service.
+// Use of this interface is not recommended, as added methods to ServerReflectionServer will
+// result in compilation errors.
+type UnsafeServerReflectionServer interface {
+	mustEmbedUnimplementedServerReflectionServer()
+}
+
+func RegisterServerReflectionServer(s grpc.ServiceRegistrar, srv ServerReflectionServer) {
+	s.RegisterService(&ServerReflection_ServiceDesc, srv)
+}
+
+func _ServerReflection_ServerReflectionInfo_Handler(srv interface{}, stream grpc.ServerStream) error {
+	return srv.(ServerReflectionServer).ServerReflectionInfo(&serverReflectionServerReflectionInfoServer{stream})
+}
+
+type ServerReflection_ServerReflectionInfoServer interface {
+	Send(*ServerReflectionResponse) error
+	Recv() (*ServerReflectionRequest, error)
+	grpc.ServerStream
+}
+
+type serverReflectionServerReflectionInfoServer struct {
+	grpc.ServerStream
+}
+
+func (x *serverReflectionServerReflectionInfoServer) Send(m *ServerReflectionResponse) error {
+	return x.ServerStream.SendMsg(m)
+}
+
+func (x *serverReflectionServerReflectionInfoServer) Recv() (*ServerReflectionRequest, error) {
+	m := new(ServerReflectionRequest)
+	if err := x.ServerStream.RecvMsg(m); err != nil {
+		return nil, err
+	}
+	return m, nil
+}
+
+// ServerReflection_ServiceDesc is the grpc.ServiceDesc for ServerReflection service.
+// It's only intended for direct use with grpc.RegisterService,
+// and not to be introspected or modified (even as a copy)
+var ServerReflection_ServiceDesc = grpc.ServiceDesc{
+	ServiceName: "grpc.reflection.v1.ServerReflection",
+	HandlerType: (*ServerReflectionServer)(nil),
+	Methods:     []grpc.MethodDesc{},
+	Streams: []grpc.StreamDesc{
+		{
+			StreamName:    "ServerReflectionInfo",
+			Handler:       _ServerReflection_ServerReflectionInfo_Handler,
+			ServerStreams: true,
+			ClientStreams: true,
+		},
+	},
+	Metadata: "grpc/reflection/v1/reflection.proto",
+}
diff --git a/.ci/providerlint/vendor/google.golang.org/grpc/reflection/grpc_reflection_v1alpha/reflection.pb.go b/.ci/providerlint/vendor/google.golang.org/grpc/reflection/grpc_reflection_v1alpha/reflection.pb.go
index c22f9a52db4..d54c07676d5 100644
--- a/.ci/providerlint/vendor/google.golang.org/grpc/reflection/grpc_reflection_v1alpha/reflection.pb.go
+++ b/.ci/providerlint/vendor/google.golang.org/grpc/reflection/grpc_reflection_v1alpha/reflection.pb.go
@@ -1,4 +1,4 @@
-// Copyright 2016 gRPC authors.
+// Copyright 2016 The gRPC Authors
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -11,19 +11,20 @@
 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 // See the License for the specific language governing permissions and
 // limitations under the License.
-
 // Service exported by server reflection
 
+// Warning: this entire file is deprecated. Use this instead:
+// https://github.com/grpc/grpc-proto/blob/master/grpc/reflection/v1/reflection.proto
+
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.25.0
-// 	protoc        v3.14.0
-// source: reflection/grpc_reflection_v1alpha/reflection.proto
+// 	protoc-gen-go v1.30.0
+// 	protoc        v4.22.0
+// grpc/reflection/v1alpha/reflection.proto is a deprecated file.
 
 package grpc_reflection_v1alpha
 
 import (
-	proto "github.com/golang/protobuf/proto"
 	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
 	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
 	reflect "reflect"
@@ -37,16 +38,15 @@ const (
 	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
 )
 
-// This is a compile-time assertion that a sufficiently up-to-date version
-// of the legacy proto package is being used.
-const _ = proto.ProtoPackageIsVersion4
-
 // The message sent by the client when calling ServerReflectionInfo method.
+//
+// Deprecated: The entire proto file grpc/reflection/v1alpha/reflection.proto is marked as deprecated.
 type ServerReflectionRequest struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
+	// Deprecated: The entire proto file grpc/reflection/v1alpha/reflection.proto is marked as deprecated.
 	Host string `protobuf:"bytes,1,opt,name=host,proto3" json:"host,omitempty"`
 	// To use reflection service, the client should set one of the following
 	// fields in message_request. The server distinguishes requests by their
@@ -65,7 +65,7 @@ type ServerReflectionRequest struct {
 func (x *ServerReflectionRequest) Reset() {
 	*x = ServerReflectionRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_reflection_grpc_reflection_v1alpha_reflection_proto_msgTypes[0]
+		mi := &file_grpc_reflection_v1alpha_reflection_proto_msgTypes[0]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -78,7 +78,7 @@ func (x *ServerReflectionRequest) String() string {
 func (*ServerReflectionRequest) ProtoMessage() {}
 
 func (x *ServerReflectionRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_reflection_grpc_reflection_v1alpha_reflection_proto_msgTypes[0]
+	mi := &file_grpc_reflection_v1alpha_reflection_proto_msgTypes[0]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -91,9 +91,10 @@ func (x *ServerReflectionRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ServerReflectionRequest.ProtoReflect.Descriptor instead.
 func (*ServerReflectionRequest) Descriptor() ([]byte, []int) {
-	return file_reflection_grpc_reflection_v1alpha_reflection_proto_rawDescGZIP(), []int{0}
+	return file_grpc_reflection_v1alpha_reflection_proto_rawDescGZIP(), []int{0}
 }
 
+// Deprecated: The entire proto file grpc/reflection/v1alpha/reflection.proto is marked as deprecated.
 func (x *ServerReflectionRequest) GetHost() string {
 	if x != nil {
 		return x.Host
@@ -108,6 +109,7 @@ func (m *ServerReflectionRequest) GetMessageRequest() isServerReflectionRequest_
 	return nil
 }
 
+// Deprecated: The entire proto file grpc/reflection/v1alpha/reflection.proto is marked as deprecated.
 func (x *ServerReflectionRequest) GetFileByFilename() string {
 	if x, ok := x.GetMessageRequest().(*ServerReflectionRequest_FileByFilename); ok {
 		return x.FileByFilename
@@ -115,6 +117,7 @@ func (x *ServerReflectionRequest) GetFileByFilename() string {
 	return ""
 }
 
+// Deprecated: The entire proto file grpc/reflection/v1alpha/reflection.proto is marked as deprecated.
 func (x *ServerReflectionRequest) GetFileContainingSymbol() string {
 	if x, ok := x.GetMessageRequest().(*ServerReflectionRequest_FileContainingSymbol); ok {
 		return x.FileContainingSymbol
@@ -122,6 +125,7 @@ func (x *ServerReflectionRequest) GetFileContainingSymbol() string {
 	return ""
 }
 
+// Deprecated: The entire proto file grpc/reflection/v1alpha/reflection.proto is marked as deprecated.
 func (x *ServerReflectionRequest) GetFileContainingExtension() *ExtensionRequest {
 	if x, ok := x.GetMessageRequest().(*ServerReflectionRequest_FileContainingExtension); ok {
 		return x.FileContainingExtension
@@ -129,6 +133,7 @@ func (x *ServerReflectionRequest) GetFileContainingExtension() *ExtensionRequest
 	return nil
 }
 
+// Deprecated: The entire proto file grpc/reflection/v1alpha/reflection.proto is marked as deprecated.
 func (x *ServerReflectionRequest) GetAllExtensionNumbersOfType() string {
 	if x, ok := x.GetMessageRequest().(*ServerReflectionRequest_AllExtensionNumbersOfType); ok {
 		return x.AllExtensionNumbersOfType
@@ -136,6 +141,7 @@ func (x *ServerReflectionRequest) GetAllExtensionNumbersOfType() string {
 	return ""
 }
 
+// Deprecated: The entire proto file grpc/reflection/v1alpha/reflection.proto is marked as deprecated.
 func (x *ServerReflectionRequest) GetListServices() string {
 	if x, ok := x.GetMessageRequest().(*ServerReflectionRequest_ListServices); ok {
 		return x.ListServices
@@ -149,6 +155,8 @@ type isServerReflectionRequest_MessageRequest interface {
 
 type ServerReflectionRequest_FileByFilename struct {
 	// Find a proto file by the file name.
+	//
+	// Deprecated: The entire proto file grpc/reflection/v1alpha/reflection.proto is marked as deprecated.
 	FileByFilename string `protobuf:"bytes,3,opt,name=file_by_filename,json=fileByFilename,proto3,oneof"`
 }
 
@@ -156,12 +164,16 @@ type ServerReflectionRequest_FileContainingSymbol struct {
 	// Find the proto file that declares the given fully-qualified symbol name.
 	// This field should be a fully-qualified symbol name
 	// (e.g. <package>.<service>[.<method>] or <package>.<type>).
+	//
+	// Deprecated: The entire proto file grpc/reflection/v1alpha/reflection.proto is marked as deprecated.
 	FileContainingSymbol string `protobuf:"bytes,4,opt,name=file_containing_symbol,json=fileContainingSymbol,proto3,oneof"`
 }
 
 type ServerReflectionRequest_FileContainingExtension struct {
 	// Find the proto file which defines an extension extending the given
 	// message type with the given field number.
+	//
+	// Deprecated: The entire proto file grpc/reflection/v1alpha/reflection.proto is marked as deprecated.
 	FileContainingExtension *ExtensionRequest `protobuf:"bytes,5,opt,name=file_containing_extension,json=fileContainingExtension,proto3,oneof"`
 }
 
@@ -174,12 +186,16 @@ type ServerReflectionRequest_AllExtensionNumbersOfType struct {
 	// StatusCode::UNIMPLEMENTED if it's not implemented.
 	// This field should be a fully-qualified type name. The format is
 	// <package>.<type>
+	//
+	// Deprecated: The entire proto file grpc/reflection/v1alpha/reflection.proto is marked as deprecated.
 	AllExtensionNumbersOfType string `protobuf:"bytes,6,opt,name=all_extension_numbers_of_type,json=allExtensionNumbersOfType,proto3,oneof"`
 }
 
 type ServerReflectionRequest_ListServices struct {
 	// List the full names of registered services. The content will not be
 	// checked.
+	//
+	// Deprecated: The entire proto file grpc/reflection/v1alpha/reflection.proto is marked as deprecated.
 	ListServices string `protobuf:"bytes,7,opt,name=list_services,json=listServices,proto3,oneof"`
 }
 
@@ -196,20 +212,25 @@ func (*ServerReflectionRequest_ListServices) isServerReflectionRequest_MessageRe
 
 // The type name and extension number sent by the client when requesting
 // file_containing_extension.
+//
+// Deprecated: The entire proto file grpc/reflection/v1alpha/reflection.proto is marked as deprecated.
 type ExtensionRequest struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
 	// Fully-qualified type name. The format should be <package>.<type>
-	ContainingType  string `protobuf:"bytes,1,opt,name=containing_type,json=containingType,proto3" json:"containing_type,omitempty"`
-	ExtensionNumber int32  `protobuf:"varint,2,opt,name=extension_number,json=extensionNumber,proto3" json:"extension_number,omitempty"`
+	//
+	// Deprecated: The entire proto file grpc/reflection/v1alpha/reflection.proto is marked as deprecated.
+	ContainingType string `protobuf:"bytes,1,opt,name=containing_type,json=containingType,proto3" json:"containing_type,omitempty"`
+	// Deprecated: The entire proto file grpc/reflection/v1alpha/reflection.proto is marked as deprecated.
+	ExtensionNumber int32 `protobuf:"varint,2,opt,name=extension_number,json=extensionNumber,proto3" json:"extension_number,omitempty"`
 }
 
 func (x *ExtensionRequest) Reset() {
 	*x = ExtensionRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_reflection_grpc_reflection_v1alpha_reflection_proto_msgTypes[1]
+		mi := &file_grpc_reflection_v1alpha_reflection_proto_msgTypes[1]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -222,7 +243,7 @@ func (x *ExtensionRequest) String() string {
 func (*ExtensionRequest) ProtoMessage() {}
 
 func (x *ExtensionRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_reflection_grpc_reflection_v1alpha_reflection_proto_msgTypes[1]
+	mi := &file_grpc_reflection_v1alpha_reflection_proto_msgTypes[1]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -235,9 +256,10 @@ func (x *ExtensionRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ExtensionRequest.ProtoReflect.Descriptor instead.
 func (*ExtensionRequest) Descriptor() ([]byte, []int) {
-	return file_reflection_grpc_reflection_v1alpha_reflection_proto_rawDescGZIP(), []int{1}
+	return file_grpc_reflection_v1alpha_reflection_proto_rawDescGZIP(), []int{1}
 }
 
+// Deprecated: The entire proto file grpc/reflection/v1alpha/reflection.proto is marked as deprecated.
 func (x *ExtensionRequest) GetContainingType() string {
 	if x != nil {
 		return x.ContainingType
@@ -245,6 +267,7 @@ func (x *ExtensionRequest) GetContainingType() string {
 	return ""
 }
 
+// Deprecated: The entire proto file grpc/reflection/v1alpha/reflection.proto is marked as deprecated.
 func (x *ExtensionRequest) GetExtensionNumber() int32 {
 	if x != nil {
 		return x.ExtensionNumber
@@ -253,15 +276,19 @@ func (x *ExtensionRequest) GetExtensionNumber() int32 {
 }
 
 // The message sent by the server to answer ServerReflectionInfo method.
+//
+// Deprecated: The entire proto file grpc/reflection/v1alpha/reflection.proto is marked as deprecated.
 type ServerReflectionResponse struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	ValidHost       string                   `protobuf:"bytes,1,opt,name=valid_host,json=validHost,proto3" json:"valid_host,omitempty"`
+	// Deprecated: The entire proto file grpc/reflection/v1alpha/reflection.proto is marked as deprecated.
+	ValidHost string `protobuf:"bytes,1,opt,name=valid_host,json=validHost,proto3" json:"valid_host,omitempty"`
+	// Deprecated: The entire proto file grpc/reflection/v1alpha/reflection.proto is marked as deprecated.
 	OriginalRequest *ServerReflectionRequest `protobuf:"bytes,2,opt,name=original_request,json=originalRequest,proto3" json:"original_request,omitempty"`
-	// The server sets one of the following fields according to the
-	// message_request in the request.
+	// The server set one of the following fields according to the message_request
+	// in the request.
 	//
 	// Types that are assignable to MessageResponse:
 	//
@@ -275,7 +302,7 @@ type ServerReflectionResponse struct {
 func (x *ServerReflectionResponse) Reset() {
 	*x = ServerReflectionResponse{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_reflection_grpc_reflection_v1alpha_reflection_proto_msgTypes[2]
+		mi := &file_grpc_reflection_v1alpha_reflection_proto_msgTypes[2]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -288,7 +315,7 @@ func (x *ServerReflectionResponse) String() string {
 func (*ServerReflectionResponse) ProtoMessage() {}
 
 func (x *ServerReflectionResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_reflection_grpc_reflection_v1alpha_reflection_proto_msgTypes[2]
+	mi := &file_grpc_reflection_v1alpha_reflection_proto_msgTypes[2]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -301,9 +328,10 @@ func (x *ServerReflectionResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ServerReflectionResponse.ProtoReflect.Descriptor instead.
 func (*ServerReflectionResponse) Descriptor() ([]byte, []int) {
-	return file_reflection_grpc_reflection_v1alpha_reflection_proto_rawDescGZIP(), []int{2}
+	return file_grpc_reflection_v1alpha_reflection_proto_rawDescGZIP(), []int{2}
 }
 
+// Deprecated: The entire proto file grpc/reflection/v1alpha/reflection.proto is marked as deprecated.
 func (x *ServerReflectionResponse) GetValidHost() string {
 	if x != nil {
 		return x.ValidHost
@@ -311,6 +339,7 @@ func (x *ServerReflectionResponse) GetValidHost() string {
 	return ""
 }
 
+// Deprecated: The entire proto file grpc/reflection/v1alpha/reflection.proto is marked as deprecated.
 func (x *ServerReflectionResponse) GetOriginalRequest() *ServerReflectionRequest {
 	if x != nil {
 		return x.OriginalRequest
@@ -325,6 +354,7 @@ func (m *ServerReflectionResponse) GetMessageResponse() isServerReflectionRespon
 	return nil
 }
 
+// Deprecated: The entire proto file grpc/reflection/v1alpha/reflection.proto is marked as deprecated.
 func (x *ServerReflectionResponse) GetFileDescriptorResponse() *FileDescriptorResponse {
 	if x, ok := x.GetMessageResponse().(*ServerReflectionResponse_FileDescriptorResponse); ok {
 		return x.FileDescriptorResponse
@@ -332,6 +362,7 @@ func (x *ServerReflectionResponse) GetFileDescriptorResponse() *FileDescriptorRe
 	return nil
 }
 
+// Deprecated: The entire proto file grpc/reflection/v1alpha/reflection.proto is marked as deprecated.
 func (x *ServerReflectionResponse) GetAllExtensionNumbersResponse() *ExtensionNumberResponse {
 	if x, ok := x.GetMessageResponse().(*ServerReflectionResponse_AllExtensionNumbersResponse); ok {
 		return x.AllExtensionNumbersResponse
@@ -339,6 +370,7 @@ func (x *ServerReflectionResponse) GetAllExtensionNumbersResponse() *ExtensionNu
 	return nil
 }
 
+// Deprecated: The entire proto file grpc/reflection/v1alpha/reflection.proto is marked as deprecated.
 func (x *ServerReflectionResponse) GetListServicesResponse() *ListServiceResponse {
 	if x, ok := x.GetMessageResponse().(*ServerReflectionResponse_ListServicesResponse); ok {
 		return x.ListServicesResponse
@@ -346,6 +378,7 @@ func (x *ServerReflectionResponse) GetListServicesResponse() *ListServiceRespons
 	return nil
 }
 
+// Deprecated: The entire proto file grpc/reflection/v1alpha/reflection.proto is marked as deprecated.
 func (x *ServerReflectionResponse) GetErrorResponse() *ErrorResponse {
 	if x, ok := x.GetMessageResponse().(*ServerReflectionResponse_ErrorResponse); ok {
 		return x.ErrorResponse
@@ -359,26 +392,34 @@ type isServerReflectionResponse_MessageResponse interface {
 
 type ServerReflectionResponse_FileDescriptorResponse struct {
 	// This message is used to answer file_by_filename, file_containing_symbol,
-	// file_containing_extension requests with transitive dependencies.
-	// As the repeated label is not allowed in oneof fields, we use a
+	// file_containing_extension requests with transitive dependencies. As
+	// the repeated label is not allowed in oneof fields, we use a
 	// FileDescriptorResponse message to encapsulate the repeated fields.
 	// The reflection service is allowed to avoid sending FileDescriptorProtos
 	// that were previously sent in response to earlier requests in the stream.
+	//
+	// Deprecated: The entire proto file grpc/reflection/v1alpha/reflection.proto is marked as deprecated.
 	FileDescriptorResponse *FileDescriptorResponse `protobuf:"bytes,4,opt,name=file_descriptor_response,json=fileDescriptorResponse,proto3,oneof"`
 }
 
 type ServerReflectionResponse_AllExtensionNumbersResponse struct {
-	// This message is used to answer all_extension_numbers_of_type requests.
+	// This message is used to answer all_extension_numbers_of_type requst.
+	//
+	// Deprecated: The entire proto file grpc/reflection/v1alpha/reflection.proto is marked as deprecated.
 	AllExtensionNumbersResponse *ExtensionNumberResponse `protobuf:"bytes,5,opt,name=all_extension_numbers_response,json=allExtensionNumbersResponse,proto3,oneof"`
 }
 
 type ServerReflectionResponse_ListServicesResponse struct {
-	// This message is used to answer list_services requests.
+	// This message is used to answer list_services request.
+	//
+	// Deprecated: The entire proto file grpc/reflection/v1alpha/reflection.proto is marked as deprecated.
 	ListServicesResponse *ListServiceResponse `protobuf:"bytes,6,opt,name=list_services_response,json=listServicesResponse,proto3,oneof"`
 }
 
 type ServerReflectionResponse_ErrorResponse struct {
 	// This message is used when an error occurs.
+	//
+	// Deprecated: The entire proto file grpc/reflection/v1alpha/reflection.proto is marked as deprecated.
 	ErrorResponse *ErrorResponse `protobuf:"bytes,7,opt,name=error_response,json=errorResponse,proto3,oneof"`
 }
 
@@ -395,6 +436,8 @@ func (*ServerReflectionResponse_ErrorResponse) isServerReflectionResponse_Messag
 // Serialized FileDescriptorProto messages sent by the server answering
 // a file_by_filename, file_containing_symbol, or file_containing_extension
 // request.
+//
+// Deprecated: The entire proto file grpc/reflection/v1alpha/reflection.proto is marked as deprecated.
 type FileDescriptorResponse struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -403,13 +446,15 @@ type FileDescriptorResponse struct {
 	// Serialized FileDescriptorProto messages. We avoid taking a dependency on
 	// descriptor.proto, which uses proto2 only features, by making them opaque
 	// bytes instead.
+	//
+	// Deprecated: The entire proto file grpc/reflection/v1alpha/reflection.proto is marked as deprecated.
 	FileDescriptorProto [][]byte `protobuf:"bytes,1,rep,name=file_descriptor_proto,json=fileDescriptorProto,proto3" json:"file_descriptor_proto,omitempty"`
 }
 
 func (x *FileDescriptorResponse) Reset() {
 	*x = FileDescriptorResponse{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_reflection_grpc_reflection_v1alpha_reflection_proto_msgTypes[3]
+		mi := &file_grpc_reflection_v1alpha_reflection_proto_msgTypes[3]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -422,7 +467,7 @@ func (x *FileDescriptorResponse) String() string {
 func (*FileDescriptorResponse) ProtoMessage() {}
 
 func (x *FileDescriptorResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_reflection_grpc_reflection_v1alpha_reflection_proto_msgTypes[3]
+	mi := &file_grpc_reflection_v1alpha_reflection_proto_msgTypes[3]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -435,9 +480,10 @@ func (x *FileDescriptorResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use FileDescriptorResponse.ProtoReflect.Descriptor instead.
 func (*FileDescriptorResponse) Descriptor() ([]byte, []int) {
-	return file_reflection_grpc_reflection_v1alpha_reflection_proto_rawDescGZIP(), []int{3}
+	return file_grpc_reflection_v1alpha_reflection_proto_rawDescGZIP(), []int{3}
 }
 
+// Deprecated: The entire proto file grpc/reflection/v1alpha/reflection.proto is marked as deprecated.
 func (x *FileDescriptorResponse) GetFileDescriptorProto() [][]byte {
 	if x != nil {
 		return x.FileDescriptorProto
@@ -447,6 +493,8 @@ func (x *FileDescriptorResponse) GetFileDescriptorProto() [][]byte {
 
 // A list of extension numbers sent by the server answering
 // all_extension_numbers_of_type request.
+//
+// Deprecated: The entire proto file grpc/reflection/v1alpha/reflection.proto is marked as deprecated.
 type ExtensionNumberResponse struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -454,14 +502,17 @@ type ExtensionNumberResponse struct {
 
 	// Full name of the base type, including the package name. The format
 	// is <package>.<type>
-	BaseTypeName    string  `protobuf:"bytes,1,opt,name=base_type_name,json=baseTypeName,proto3" json:"base_type_name,omitempty"`
+	//
+	// Deprecated: The entire proto file grpc/reflection/v1alpha/reflection.proto is marked as deprecated.
+	BaseTypeName string `protobuf:"bytes,1,opt,name=base_type_name,json=baseTypeName,proto3" json:"base_type_name,omitempty"`
+	// Deprecated: The entire proto file grpc/reflection/v1alpha/reflection.proto is marked as deprecated.
 	ExtensionNumber []int32 `protobuf:"varint,2,rep,packed,name=extension_number,json=extensionNumber,proto3" json:"extension_number,omitempty"`
 }
 
 func (x *ExtensionNumberResponse) Reset() {
 	*x = ExtensionNumberResponse{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_reflection_grpc_reflection_v1alpha_reflection_proto_msgTypes[4]
+		mi := &file_grpc_reflection_v1alpha_reflection_proto_msgTypes[4]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -474,7 +525,7 @@ func (x *ExtensionNumberResponse) String() string {
 func (*ExtensionNumberResponse) ProtoMessage() {}
 
 func (x *ExtensionNumberResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_reflection_grpc_reflection_v1alpha_reflection_proto_msgTypes[4]
+	mi := &file_grpc_reflection_v1alpha_reflection_proto_msgTypes[4]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -487,9 +538,10 @@ func (x *ExtensionNumberResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ExtensionNumberResponse.ProtoReflect.Descriptor instead.
 func (*ExtensionNumberResponse) Descriptor() ([]byte, []int) {
-	return file_reflection_grpc_reflection_v1alpha_reflection_proto_rawDescGZIP(), []int{4}
+	return file_grpc_reflection_v1alpha_reflection_proto_rawDescGZIP(), []int{4}
 }
 
+// Deprecated: The entire proto file grpc/reflection/v1alpha/reflection.proto is marked as deprecated.
 func (x *ExtensionNumberResponse) GetBaseTypeName() string {
 	if x != nil {
 		return x.BaseTypeName
@@ -497,6 +549,7 @@ func (x *ExtensionNumberResponse) GetBaseTypeName() string {
 	return ""
 }
 
+// Deprecated: The entire proto file grpc/reflection/v1alpha/reflection.proto is marked as deprecated.
 func (x *ExtensionNumberResponse) GetExtensionNumber() []int32 {
 	if x != nil {
 		return x.ExtensionNumber
@@ -505,6 +558,8 @@ func (x *ExtensionNumberResponse) GetExtensionNumber() []int32 {
 }
 
 // A list of ServiceResponse sent by the server answering list_services request.
+//
+// Deprecated: The entire proto file grpc/reflection/v1alpha/reflection.proto is marked as deprecated.
 type ListServiceResponse struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -512,13 +567,15 @@ type ListServiceResponse struct {
 
 	// The information of each service may be expanded in the future, so we use
 	// ServiceResponse message to encapsulate it.
+	//
+	// Deprecated: The entire proto file grpc/reflection/v1alpha/reflection.proto is marked as deprecated.
 	Service []*ServiceResponse `protobuf:"bytes,1,rep,name=service,proto3" json:"service,omitempty"`
 }
 
 func (x *ListServiceResponse) Reset() {
 	*x = ListServiceResponse{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_reflection_grpc_reflection_v1alpha_reflection_proto_msgTypes[5]
+		mi := &file_grpc_reflection_v1alpha_reflection_proto_msgTypes[5]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -531,7 +588,7 @@ func (x *ListServiceResponse) String() string {
 func (*ListServiceResponse) ProtoMessage() {}
 
 func (x *ListServiceResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_reflection_grpc_reflection_v1alpha_reflection_proto_msgTypes[5]
+	mi := &file_grpc_reflection_v1alpha_reflection_proto_msgTypes[5]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -544,9 +601,10 @@ func (x *ListServiceResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ListServiceResponse.ProtoReflect.Descriptor instead.
 func (*ListServiceResponse) Descriptor() ([]byte, []int) {
-	return file_reflection_grpc_reflection_v1alpha_reflection_proto_rawDescGZIP(), []int{5}
+	return file_grpc_reflection_v1alpha_reflection_proto_rawDescGZIP(), []int{5}
 }
 
+// Deprecated: The entire proto file grpc/reflection/v1alpha/reflection.proto is marked as deprecated.
 func (x *ListServiceResponse) GetService() []*ServiceResponse {
 	if x != nil {
 		return x.Service
@@ -556,6 +614,8 @@ func (x *ListServiceResponse) GetService() []*ServiceResponse {
 
 // The information of a single service used by ListServiceResponse to answer
 // list_services request.
+//
+// Deprecated: The entire proto file grpc/reflection/v1alpha/reflection.proto is marked as deprecated.
 type ServiceResponse struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -563,13 +623,15 @@ type ServiceResponse struct {
 
 	// Full name of a registered service, including its package name. The format
 	// is <package>.<service>
+	//
+	// Deprecated: The entire proto file grpc/reflection/v1alpha/reflection.proto is marked as deprecated.
 	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
 }
 
 func (x *ServiceResponse) Reset() {
 	*x = ServiceResponse{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_reflection_grpc_reflection_v1alpha_reflection_proto_msgTypes[6]
+		mi := &file_grpc_reflection_v1alpha_reflection_proto_msgTypes[6]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -582,7 +644,7 @@ func (x *ServiceResponse) String() string {
 func (*ServiceResponse) ProtoMessage() {}
 
 func (x *ServiceResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_reflection_grpc_reflection_v1alpha_reflection_proto_msgTypes[6]
+	mi := &file_grpc_reflection_v1alpha_reflection_proto_msgTypes[6]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -595,9 +657,10 @@ func (x *ServiceResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ServiceResponse.ProtoReflect.Descriptor instead.
 func (*ServiceResponse) Descriptor() ([]byte, []int) {
-	return file_reflection_grpc_reflection_v1alpha_reflection_proto_rawDescGZIP(), []int{6}
+	return file_grpc_reflection_v1alpha_reflection_proto_rawDescGZIP(), []int{6}
 }
 
+// Deprecated: The entire proto file grpc/reflection/v1alpha/reflection.proto is marked as deprecated.
 func (x *ServiceResponse) GetName() string {
 	if x != nil {
 		return x.Name
@@ -606,20 +669,25 @@ func (x *ServiceResponse) GetName() string {
 }
 
 // The error code and error message sent by the server when an error occurs.
+//
+// Deprecated: The entire proto file grpc/reflection/v1alpha/reflection.proto is marked as deprecated.
 type ErrorResponse struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
 	// This field uses the error codes defined in grpc::StatusCode.
-	ErrorCode    int32  `protobuf:"varint,1,opt,name=error_code,json=errorCode,proto3" json:"error_code,omitempty"`
+	//
+	// Deprecated: The entire proto file grpc/reflection/v1alpha/reflection.proto is marked as deprecated.
+	ErrorCode int32 `protobuf:"varint,1,opt,name=error_code,json=errorCode,proto3" json:"error_code,omitempty"`
+	// Deprecated: The entire proto file grpc/reflection/v1alpha/reflection.proto is marked as deprecated.
 	ErrorMessage string `protobuf:"bytes,2,opt,name=error_message,json=errorMessage,proto3" json:"error_message,omitempty"`
 }
 
 func (x *ErrorResponse) Reset() {
 	*x = ErrorResponse{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_reflection_grpc_reflection_v1alpha_reflection_proto_msgTypes[7]
+		mi := &file_grpc_reflection_v1alpha_reflection_proto_msgTypes[7]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -632,7 +700,7 @@ func (x *ErrorResponse) String() string {
 func (*ErrorResponse) ProtoMessage() {}
 
 func (x *ErrorResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_reflection_grpc_reflection_v1alpha_reflection_proto_msgTypes[7]
+	mi := &file_grpc_reflection_v1alpha_reflection_proto_msgTypes[7]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -645,9 +713,10 @@ func (x *ErrorResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ErrorResponse.ProtoReflect.Descriptor instead.
 func (*ErrorResponse) Descriptor() ([]byte, []int) {
-	return file_reflection_grpc_reflection_v1alpha_reflection_proto_rawDescGZIP(), []int{7}
+	return file_grpc_reflection_v1alpha_reflection_proto_rawDescGZIP(), []int{7}
 }
 
+// Deprecated: The entire proto file grpc/reflection/v1alpha/reflection.proto is marked as deprecated.
 func (x *ErrorResponse) GetErrorCode() int32 {
 	if x != nil {
 		return x.ErrorCode
@@ -655,6 +724,7 @@ func (x *ErrorResponse) GetErrorCode() int32 {
 	return 0
 }
 
+// Deprecated: The entire proto file grpc/reflection/v1alpha/reflection.proto is marked as deprecated.
 func (x *ErrorResponse) GetErrorMessage() string {
 	if x != nil {
 		return x.ErrorMessage
@@ -662,136 +732,139 @@ func (x *ErrorResponse) GetErrorMessage() string {
 	return ""
 }
 
-var File_reflection_grpc_reflection_v1alpha_reflection_proto protoreflect.FileDescriptor
-
-var file_reflection_grpc_reflection_v1alpha_reflection_proto_rawDesc = []byte{
-	0x0a, 0x33, 0x72, 0x65, 0x66, 0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x2f, 0x67, 0x72, 0x70,
-	0x63, 0x5f, 0x72, 0x65, 0x66, 0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x76, 0x31, 0x61,
-	0x6c, 0x70, 0x68, 0x61, 0x2f, 0x72, 0x65, 0x66, 0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x2e,
-	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x17, 0x67, 0x72, 0x70, 0x63, 0x2e, 0x72, 0x65, 0x66, 0x6c,
-	0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x22, 0xf8,
-	0x02, 0x0a, 0x17, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x52, 0x65, 0x66, 0x6c, 0x65, 0x63, 0x74,
-	0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x12, 0x0a, 0x04, 0x68, 0x6f,
-	0x73, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x68, 0x6f, 0x73, 0x74, 0x12, 0x2a,
-	0x0a, 0x10, 0x66, 0x69, 0x6c, 0x65, 0x5f, 0x62, 0x79, 0x5f, 0x66, 0x69, 0x6c, 0x65, 0x6e, 0x61,
-	0x6d, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x0e, 0x66, 0x69, 0x6c, 0x65,
-	0x42, 0x79, 0x46, 0x69, 0x6c, 0x65, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x36, 0x0a, 0x16, 0x66, 0x69,
-	0x6c, 0x65, 0x5f, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x69, 0x6e, 0x67, 0x5f, 0x73, 0x79,
-	0x6d, 0x62, 0x6f, 0x6c, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x14, 0x66, 0x69,
-	0x6c, 0x65, 0x43, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x69, 0x6e, 0x67, 0x53, 0x79, 0x6d, 0x62,
-	0x6f, 0x6c, 0x12, 0x67, 0x0a, 0x19, 0x66, 0x69, 0x6c, 0x65, 0x5f, 0x63, 0x6f, 0x6e, 0x74, 0x61,
-	0x69, 0x6e, 0x69, 0x6e, 0x67, 0x5f, 0x65, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x18,
-	0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x29, 0x2e, 0x67, 0x72, 0x70, 0x63, 0x2e, 0x72, 0x65, 0x66,
-	0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e,
-	0x45, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
-	0x48, 0x00, 0x52, 0x17, 0x66, 0x69, 0x6c, 0x65, 0x43, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x69,
-	0x6e, 0x67, 0x45, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x42, 0x0a, 0x1d, 0x61,
-	0x6c, 0x6c, 0x5f, 0x65, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x6e, 0x75, 0x6d,
-	0x62, 0x65, 0x72, 0x73, 0x5f, 0x6f, 0x66, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x18, 0x06, 0x20, 0x01,
-	0x28, 0x09, 0x48, 0x00, 0x52, 0x19, 0x61, 0x6c, 0x6c, 0x45, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69,
-	0x6f, 0x6e, 0x4e, 0x75, 0x6d, 0x62, 0x65, 0x72, 0x73, 0x4f, 0x66, 0x54, 0x79, 0x70, 0x65, 0x12,
-	0x25, 0x0a, 0x0d, 0x6c, 0x69, 0x73, 0x74, 0x5f, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73,
-	0x18, 0x07, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x0c, 0x6c, 0x69, 0x73, 0x74, 0x53, 0x65,
-	0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x42, 0x11, 0x0a, 0x0f, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67,
-	0x65, 0x5f, 0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x22, 0x66, 0x0a, 0x10, 0x45, 0x78, 0x74,
-	0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x27, 0x0a,
-	0x0f, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x69, 0x6e, 0x67, 0x5f, 0x74, 0x79, 0x70, 0x65,
-	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0e, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x69,
-	0x6e, 0x67, 0x54, 0x79, 0x70, 0x65, 0x12, 0x29, 0x0a, 0x10, 0x65, 0x78, 0x74, 0x65, 0x6e, 0x73,
-	0x69, 0x6f, 0x6e, 0x5f, 0x6e, 0x75, 0x6d, 0x62, 0x65, 0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x05,
-	0x52, 0x0f, 0x65, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x4e, 0x75, 0x6d, 0x62, 0x65,
-	0x72, 0x22, 0xc7, 0x04, 0x0a, 0x18, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x52, 0x65, 0x66, 0x6c,
-	0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x1d,
-	0x0a, 0x0a, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x5f, 0x68, 0x6f, 0x73, 0x74, 0x18, 0x01, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x09, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x48, 0x6f, 0x73, 0x74, 0x12, 0x5b, 0x0a,
-	0x10, 0x6f, 0x72, 0x69, 0x67, 0x69, 0x6e, 0x61, 0x6c, 0x5f, 0x72, 0x65, 0x71, 0x75, 0x65, 0x73,
-	0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x30, 0x2e, 0x67, 0x72, 0x70, 0x63, 0x2e, 0x72,
-	0x65, 0x66, 0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68,
-	0x61, 0x2e, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x52, 0x65, 0x66, 0x6c, 0x65, 0x63, 0x74, 0x69,
-	0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x52, 0x0f, 0x6f, 0x72, 0x69, 0x67, 0x69,
-	0x6e, 0x61, 0x6c, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x6b, 0x0a, 0x18, 0x66, 0x69,
-	0x6c, 0x65, 0x5f, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x6f, 0x72, 0x5f, 0x72, 0x65,
-	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2f, 0x2e, 0x67,
+var File_grpc_reflection_v1alpha_reflection_proto protoreflect.FileDescriptor
+
+var file_grpc_reflection_v1alpha_reflection_proto_rawDesc = []byte{
+	0x0a, 0x28, 0x67, 0x72, 0x70, 0x63, 0x2f, 0x72, 0x65, 0x66, 0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f,
+	0x6e, 0x2f, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2f, 0x72, 0x65, 0x66, 0x6c, 0x65, 0x63,
+	0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x17, 0x67, 0x72, 0x70, 0x63,
+	0x2e, 0x72, 0x65, 0x66, 0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x76, 0x31, 0x61, 0x6c,
+	0x70, 0x68, 0x61, 0x22, 0xf8, 0x02, 0x0a, 0x17, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x52, 0x65,
+	0x66, 0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12,
+	0x12, 0x0a, 0x04, 0x68, 0x6f, 0x73, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x68,
+	0x6f, 0x73, 0x74, 0x12, 0x2a, 0x0a, 0x10, 0x66, 0x69, 0x6c, 0x65, 0x5f, 0x62, 0x79, 0x5f, 0x66,
+	0x69, 0x6c, 0x65, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00, 0x52,
+	0x0e, 0x66, 0x69, 0x6c, 0x65, 0x42, 0x79, 0x46, 0x69, 0x6c, 0x65, 0x6e, 0x61, 0x6d, 0x65, 0x12,
+	0x36, 0x0a, 0x16, 0x66, 0x69, 0x6c, 0x65, 0x5f, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x69,
+	0x6e, 0x67, 0x5f, 0x73, 0x79, 0x6d, 0x62, 0x6f, 0x6c, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x48,
+	0x00, 0x52, 0x14, 0x66, 0x69, 0x6c, 0x65, 0x43, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x69, 0x6e,
+	0x67, 0x53, 0x79, 0x6d, 0x62, 0x6f, 0x6c, 0x12, 0x67, 0x0a, 0x19, 0x66, 0x69, 0x6c, 0x65, 0x5f,
+	0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x69, 0x6e, 0x67, 0x5f, 0x65, 0x78, 0x74, 0x65, 0x6e,
+	0x73, 0x69, 0x6f, 0x6e, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x29, 0x2e, 0x67, 0x72, 0x70,
+	0x63, 0x2e, 0x72, 0x65, 0x66, 0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x76, 0x31, 0x61,
+	0x6c, 0x70, 0x68, 0x61, 0x2e, 0x45, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65,
+	0x71, 0x75, 0x65, 0x73, 0x74, 0x48, 0x00, 0x52, 0x17, 0x66, 0x69, 0x6c, 0x65, 0x43, 0x6f, 0x6e,
+	0x74, 0x61, 0x69, 0x6e, 0x69, 0x6e, 0x67, 0x45, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e,
+	0x12, 0x42, 0x0a, 0x1d, 0x61, 0x6c, 0x6c, 0x5f, 0x65, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f,
+	0x6e, 0x5f, 0x6e, 0x75, 0x6d, 0x62, 0x65, 0x72, 0x73, 0x5f, 0x6f, 0x66, 0x5f, 0x74, 0x79, 0x70,
+	0x65, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x19, 0x61, 0x6c, 0x6c, 0x45, 0x78,
+	0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x4e, 0x75, 0x6d, 0x62, 0x65, 0x72, 0x73, 0x4f, 0x66,
+	0x54, 0x79, 0x70, 0x65, 0x12, 0x25, 0x0a, 0x0d, 0x6c, 0x69, 0x73, 0x74, 0x5f, 0x73, 0x65, 0x72,
+	0x76, 0x69, 0x63, 0x65, 0x73, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x0c, 0x6c,
+	0x69, 0x73, 0x74, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x42, 0x11, 0x0a, 0x0f, 0x6d,
+	0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x5f, 0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x22, 0x66,
+	0x0a, 0x10, 0x45, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65,
+	0x73, 0x74, 0x12, 0x27, 0x0a, 0x0f, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x69, 0x6e, 0x67,
+	0x5f, 0x74, 0x79, 0x70, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0e, 0x63, 0x6f, 0x6e,
+	0x74, 0x61, 0x69, 0x6e, 0x69, 0x6e, 0x67, 0x54, 0x79, 0x70, 0x65, 0x12, 0x29, 0x0a, 0x10, 0x65,
+	0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x6e, 0x75, 0x6d, 0x62, 0x65, 0x72, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x05, 0x52, 0x0f, 0x65, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e,
+	0x4e, 0x75, 0x6d, 0x62, 0x65, 0x72, 0x22, 0xc7, 0x04, 0x0a, 0x18, 0x53, 0x65, 0x72, 0x76, 0x65,
+	0x72, 0x52, 0x65, 0x66, 0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f,
+	0x6e, 0x73, 0x65, 0x12, 0x1d, 0x0a, 0x0a, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x5f, 0x68, 0x6f, 0x73,
+	0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x48, 0x6f,
+	0x73, 0x74, 0x12, 0x5b, 0x0a, 0x10, 0x6f, 0x72, 0x69, 0x67, 0x69, 0x6e, 0x61, 0x6c, 0x5f, 0x72,
+	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x30, 0x2e, 0x67,
 	0x72, 0x70, 0x63, 0x2e, 0x72, 0x65, 0x66, 0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x76,
-	0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x46, 0x69, 0x6c, 0x65, 0x44, 0x65, 0x73, 0x63, 0x72,
-	0x69, 0x70, 0x74, 0x6f, 0x72, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x48, 0x00, 0x52,
-	0x16, 0x66, 0x69, 0x6c, 0x65, 0x44, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x6f, 0x72, 0x52,
-	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x77, 0x0a, 0x1e, 0x61, 0x6c, 0x6c, 0x5f, 0x65,
-	0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x6e, 0x75, 0x6d, 0x62, 0x65, 0x72, 0x73,
-	0x5f, 0x72, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32,
-	0x30, 0x2e, 0x67, 0x72, 0x70, 0x63, 0x2e, 0x72, 0x65, 0x66, 0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f,
-	0x6e, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x45, 0x78, 0x74, 0x65, 0x6e, 0x73,
-	0x69, 0x6f, 0x6e, 0x4e, 0x75, 0x6d, 0x62, 0x65, 0x72, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
-	0x65, 0x48, 0x00, 0x52, 0x1b, 0x61, 0x6c, 0x6c, 0x45, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f,
-	0x6e, 0x4e, 0x75, 0x6d, 0x62, 0x65, 0x72, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
-	0x12, 0x64, 0x0a, 0x16, 0x6c, 0x69, 0x73, 0x74, 0x5f, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65,
-	0x73, 0x5f, 0x72, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0b,
-	0x32, 0x2c, 0x2e, 0x67, 0x72, 0x70, 0x63, 0x2e, 0x72, 0x65, 0x66, 0x6c, 0x65, 0x63, 0x74, 0x69,
-	0x6f, 0x6e, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x53,
-	0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x48, 0x00,
-	0x52, 0x14, 0x6c, 0x69, 0x73, 0x74, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x52, 0x65,
-	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x4f, 0x0a, 0x0e, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x5f,
-	0x72, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x26,
+	0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x52, 0x65, 0x66,
+	0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x52, 0x0f,
+	0x6f, 0x72, 0x69, 0x67, 0x69, 0x6e, 0x61, 0x6c, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12,
+	0x6b, 0x0a, 0x18, 0x66, 0x69, 0x6c, 0x65, 0x5f, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74,
+	0x6f, 0x72, 0x5f, 0x72, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x2f, 0x2e, 0x67, 0x72, 0x70, 0x63, 0x2e, 0x72, 0x65, 0x66, 0x6c, 0x65, 0x63, 0x74,
+	0x69, 0x6f, 0x6e, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x46, 0x69, 0x6c, 0x65,
+	0x44, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x6f, 0x72, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
+	0x73, 0x65, 0x48, 0x00, 0x52, 0x16, 0x66, 0x69, 0x6c, 0x65, 0x44, 0x65, 0x73, 0x63, 0x72, 0x69,
+	0x70, 0x74, 0x6f, 0x72, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x77, 0x0a, 0x1e,
+	0x61, 0x6c, 0x6c, 0x5f, 0x65, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x6e, 0x75,
+	0x6d, 0x62, 0x65, 0x72, 0x73, 0x5f, 0x72, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x18, 0x05,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x30, 0x2e, 0x67, 0x72, 0x70, 0x63, 0x2e, 0x72, 0x65, 0x66, 0x6c,
+	0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x45,
+	0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x4e, 0x75, 0x6d, 0x62, 0x65, 0x72, 0x52, 0x65,
+	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x48, 0x00, 0x52, 0x1b, 0x61, 0x6c, 0x6c, 0x45, 0x78, 0x74,
+	0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x4e, 0x75, 0x6d, 0x62, 0x65, 0x72, 0x73, 0x52, 0x65, 0x73,
+	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x64, 0x0a, 0x16, 0x6c, 0x69, 0x73, 0x74, 0x5f, 0x73, 0x65,
+	0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x5f, 0x72, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x18,
+	0x06, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2c, 0x2e, 0x67, 0x72, 0x70, 0x63, 0x2e, 0x72, 0x65, 0x66,
+	0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e,
+	0x4c, 0x69, 0x73, 0x74, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f,
+	0x6e, 0x73, 0x65, 0x48, 0x00, 0x52, 0x14, 0x6c, 0x69, 0x73, 0x74, 0x53, 0x65, 0x72, 0x76, 0x69,
+	0x63, 0x65, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x4f, 0x0a, 0x0e, 0x65,
+	0x72, 0x72, 0x6f, 0x72, 0x5f, 0x72, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x18, 0x07, 0x20,
+	0x01, 0x28, 0x0b, 0x32, 0x26, 0x2e, 0x67, 0x72, 0x70, 0x63, 0x2e, 0x72, 0x65, 0x66, 0x6c, 0x65,
+	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x45, 0x72,
+	0x72, 0x6f, 0x72, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x48, 0x00, 0x52, 0x0d, 0x65,
+	0x72, 0x72, 0x6f, 0x72, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x42, 0x12, 0x0a, 0x10,
+	0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x5f, 0x72, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
+	0x22, 0x4c, 0x0a, 0x16, 0x46, 0x69, 0x6c, 0x65, 0x44, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74,
+	0x6f, 0x72, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x32, 0x0a, 0x15, 0x66, 0x69,
+	0x6c, 0x65, 0x5f, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x6f, 0x72, 0x5f, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0c, 0x52, 0x13, 0x66, 0x69, 0x6c, 0x65, 0x44,
+	0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x6f, 0x72, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x6a,
+	0x0a, 0x17, 0x45, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x4e, 0x75, 0x6d, 0x62, 0x65,
+	0x72, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x24, 0x0a, 0x0e, 0x62, 0x61, 0x73,
+	0x65, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x0c, 0x62, 0x61, 0x73, 0x65, 0x54, 0x79, 0x70, 0x65, 0x4e, 0x61, 0x6d, 0x65, 0x12,
+	0x29, 0x0a, 0x10, 0x65, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x6e, 0x75, 0x6d,
+	0x62, 0x65, 0x72, 0x18, 0x02, 0x20, 0x03, 0x28, 0x05, 0x52, 0x0f, 0x65, 0x78, 0x74, 0x65, 0x6e,
+	0x73, 0x69, 0x6f, 0x6e, 0x4e, 0x75, 0x6d, 0x62, 0x65, 0x72, 0x22, 0x59, 0x0a, 0x13, 0x4c, 0x69,
+	0x73, 0x74, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
+	0x65, 0x12, 0x42, 0x0a, 0x07, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x18, 0x01, 0x20, 0x03,
+	0x28, 0x0b, 0x32, 0x28, 0x2e, 0x67, 0x72, 0x70, 0x63, 0x2e, 0x72, 0x65, 0x66, 0x6c, 0x65, 0x63,
+	0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x53, 0x65, 0x72,
+	0x76, 0x69, 0x63, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x52, 0x07, 0x73, 0x65,
+	0x72, 0x76, 0x69, 0x63, 0x65, 0x22, 0x25, 0x0a, 0x0f, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65,
+	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x22, 0x53, 0x0a, 0x0d,
+	0x45, 0x72, 0x72, 0x6f, 0x72, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x1d, 0x0a,
+	0x0a, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x5f, 0x63, 0x6f, 0x64, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x05, 0x52, 0x09, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x43, 0x6f, 0x64, 0x65, 0x12, 0x23, 0x0a, 0x0d,
+	0x65, 0x72, 0x72, 0x6f, 0x72, 0x5f, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x18, 0x02, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x0c, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67,
+	0x65, 0x32, 0x93, 0x01, 0x0a, 0x10, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x52, 0x65, 0x66, 0x6c,
+	0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x7f, 0x0a, 0x14, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72,
+	0x52, 0x65, 0x66, 0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x49, 0x6e, 0x66, 0x6f, 0x12, 0x30,
 	0x2e, 0x67, 0x72, 0x70, 0x63, 0x2e, 0x72, 0x65, 0x66, 0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e,
-	0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x45, 0x72, 0x72, 0x6f, 0x72, 0x52, 0x65,
-	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x48, 0x00, 0x52, 0x0d, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x52,
-	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x42, 0x12, 0x0a, 0x10, 0x6d, 0x65, 0x73, 0x73, 0x61,
-	0x67, 0x65, 0x5f, 0x72, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x4c, 0x0a, 0x16, 0x46,
-	0x69, 0x6c, 0x65, 0x44, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x6f, 0x72, 0x52, 0x65, 0x73,
-	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x32, 0x0a, 0x15, 0x66, 0x69, 0x6c, 0x65, 0x5f, 0x64, 0x65,
-	0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x6f, 0x72, 0x5f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x18, 0x01,
-	0x20, 0x03, 0x28, 0x0c, 0x52, 0x13, 0x66, 0x69, 0x6c, 0x65, 0x44, 0x65, 0x73, 0x63, 0x72, 0x69,
-	0x70, 0x74, 0x6f, 0x72, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x6a, 0x0a, 0x17, 0x45, 0x78, 0x74,
-	0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x4e, 0x75, 0x6d, 0x62, 0x65, 0x72, 0x52, 0x65, 0x73, 0x70,
-	0x6f, 0x6e, 0x73, 0x65, 0x12, 0x24, 0x0a, 0x0e, 0x62, 0x61, 0x73, 0x65, 0x5f, 0x74, 0x79, 0x70,
-	0x65, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x62, 0x61,
-	0x73, 0x65, 0x54, 0x79, 0x70, 0x65, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x29, 0x0a, 0x10, 0x65, 0x78,
-	0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x6e, 0x75, 0x6d, 0x62, 0x65, 0x72, 0x18, 0x02,
-	0x20, 0x03, 0x28, 0x05, 0x52, 0x0f, 0x65, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x4e,
-	0x75, 0x6d, 0x62, 0x65, 0x72, 0x22, 0x59, 0x0a, 0x13, 0x4c, 0x69, 0x73, 0x74, 0x53, 0x65, 0x72,
-	0x76, 0x69, 0x63, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x42, 0x0a, 0x07,
-	0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x28, 0x2e,
-	0x67, 0x72, 0x70, 0x63, 0x2e, 0x72, 0x65, 0x66, 0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x2e,
-	0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x52,
-	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x52, 0x07, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65,
-	0x22, 0x25, 0x0a, 0x0f, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f,
-	0x6e, 0x73, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x22, 0x53, 0x0a, 0x0d, 0x45, 0x72, 0x72, 0x6f, 0x72,
-	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x1d, 0x0a, 0x0a, 0x65, 0x72, 0x72, 0x6f,
-	0x72, 0x5f, 0x63, 0x6f, 0x64, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x05, 0x52, 0x09, 0x65, 0x72,
-	0x72, 0x6f, 0x72, 0x43, 0x6f, 0x64, 0x65, 0x12, 0x23, 0x0a, 0x0d, 0x65, 0x72, 0x72, 0x6f, 0x72,
-	0x5f, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c,
-	0x65, 0x72, 0x72, 0x6f, 0x72, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x32, 0x93, 0x01, 0x0a,
-	0x10, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x52, 0x65, 0x66, 0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f,
-	0x6e, 0x12, 0x7f, 0x0a, 0x14, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x52, 0x65, 0x66, 0x6c, 0x65,
-	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x49, 0x6e, 0x66, 0x6f, 0x12, 0x30, 0x2e, 0x67, 0x72, 0x70, 0x63,
-	0x2e, 0x72, 0x65, 0x66, 0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x76, 0x31, 0x61, 0x6c,
-	0x70, 0x68, 0x61, 0x2e, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x52, 0x65, 0x66, 0x6c, 0x65, 0x63,
-	0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x31, 0x2e, 0x67, 0x72,
+	0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x52,
+	0x65, 0x66, 0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
+	0x1a, 0x31, 0x2e, 0x67, 0x72, 0x70, 0x63, 0x2e, 0x72, 0x65, 0x66, 0x6c, 0x65, 0x63, 0x74, 0x69,
+	0x6f, 0x6e, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x53, 0x65, 0x72, 0x76, 0x65,
+	0x72, 0x52, 0x65, 0x66, 0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f,
+	0x6e, 0x73, 0x65, 0x28, 0x01, 0x30, 0x01, 0x42, 0x73, 0x0a, 0x1a, 0x69, 0x6f, 0x2e, 0x67, 0x72,
 	0x70, 0x63, 0x2e, 0x72, 0x65, 0x66, 0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x76, 0x31,
-	0x61, 0x6c, 0x70, 0x68, 0x61, 0x2e, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x52, 0x65, 0x66, 0x6c,
-	0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x28, 0x01,
-	0x30, 0x01, 0x42, 0x3b, 0x5a, 0x39, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x67, 0x6f, 0x6c,
-	0x61, 0x6e, 0x67, 0x2e, 0x6f, 0x72, 0x67, 0x2f, 0x67, 0x72, 0x70, 0x63, 0x2f, 0x72, 0x65, 0x66,
-	0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x2f, 0x67, 0x72, 0x70, 0x63, 0x5f, 0x72, 0x65, 0x66,
-	0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x62,
-	0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x61, 0x6c, 0x70, 0x68, 0x61, 0x42, 0x15, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x52, 0x65, 0x66,
+	0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a, 0x39,
+	0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x67, 0x6f, 0x6c, 0x61, 0x6e, 0x67, 0x2e, 0x6f, 0x72,
+	0x67, 0x2f, 0x67, 0x72, 0x70, 0x63, 0x2f, 0x72, 0x65, 0x66, 0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f,
+	0x6e, 0x2f, 0x67, 0x72, 0x70, 0x63, 0x5f, 0x72, 0x65, 0x66, 0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f,
+	0x6e, 0x5f, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0xb8, 0x01, 0x01, 0x62, 0x06, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
-	file_reflection_grpc_reflection_v1alpha_reflection_proto_rawDescOnce sync.Once
-	file_reflection_grpc_reflection_v1alpha_reflection_proto_rawDescData = file_reflection_grpc_reflection_v1alpha_reflection_proto_rawDesc
+	file_grpc_reflection_v1alpha_reflection_proto_rawDescOnce sync.Once
+	file_grpc_reflection_v1alpha_reflection_proto_rawDescData = file_grpc_reflection_v1alpha_reflection_proto_rawDesc
 )
 
-func file_reflection_grpc_reflection_v1alpha_reflection_proto_rawDescGZIP() []byte {
-	file_reflection_grpc_reflection_v1alpha_reflection_proto_rawDescOnce.Do(func() {
-		file_reflection_grpc_reflection_v1alpha_reflection_proto_rawDescData = protoimpl.X.CompressGZIP(file_reflection_grpc_reflection_v1alpha_reflection_proto_rawDescData)
+func file_grpc_reflection_v1alpha_reflection_proto_rawDescGZIP() []byte {
+	file_grpc_reflection_v1alpha_reflection_proto_rawDescOnce.Do(func() {
+		file_grpc_reflection_v1alpha_reflection_proto_rawDescData = protoimpl.X.CompressGZIP(file_grpc_reflection_v1alpha_reflection_proto_rawDescData)
 	})
-	return file_reflection_grpc_reflection_v1alpha_reflection_proto_rawDescData
+	return file_grpc_reflection_v1alpha_reflection_proto_rawDescData
 }
 
-var file_reflection_grpc_reflection_v1alpha_reflection_proto_msgTypes = make([]protoimpl.MessageInfo, 8)
-var file_reflection_grpc_reflection_v1alpha_reflection_proto_goTypes = []interface{}{
+var file_grpc_reflection_v1alpha_reflection_proto_msgTypes = make([]protoimpl.MessageInfo, 8)
+var file_grpc_reflection_v1alpha_reflection_proto_goTypes = []interface{}{
 	(*ServerReflectionRequest)(nil),  // 0: grpc.reflection.v1alpha.ServerReflectionRequest
 	(*ExtensionRequest)(nil),         // 1: grpc.reflection.v1alpha.ExtensionRequest
 	(*ServerReflectionResponse)(nil), // 2: grpc.reflection.v1alpha.ServerReflectionResponse
@@ -801,7 +874,7 @@ var file_reflection_grpc_reflection_v1alpha_reflection_proto_goTypes = []interfa
 	(*ServiceResponse)(nil),          // 6: grpc.reflection.v1alpha.ServiceResponse
 	(*ErrorResponse)(nil),            // 7: grpc.reflection.v1alpha.ErrorResponse
 }
-var file_reflection_grpc_reflection_v1alpha_reflection_proto_depIdxs = []int32{
+var file_grpc_reflection_v1alpha_reflection_proto_depIdxs = []int32{
 	1, // 0: grpc.reflection.v1alpha.ServerReflectionRequest.file_containing_extension:type_name -> grpc.reflection.v1alpha.ExtensionRequest
 	0, // 1: grpc.reflection.v1alpha.ServerReflectionResponse.original_request:type_name -> grpc.reflection.v1alpha.ServerReflectionRequest
 	3, // 2: grpc.reflection.v1alpha.ServerReflectionResponse.file_descriptor_response:type_name -> grpc.reflection.v1alpha.FileDescriptorResponse
@@ -818,13 +891,13 @@ var file_reflection_grpc_reflection_v1alpha_reflection_proto_depIdxs = []int32{
 	0, // [0:7] is the sub-list for field type_name
 }
 
-func init() { file_reflection_grpc_reflection_v1alpha_reflection_proto_init() }
-func file_reflection_grpc_reflection_v1alpha_reflection_proto_init() {
-	if File_reflection_grpc_reflection_v1alpha_reflection_proto != nil {
+func init() { file_grpc_reflection_v1alpha_reflection_proto_init() }
+func file_grpc_reflection_v1alpha_reflection_proto_init() {
+	if File_grpc_reflection_v1alpha_reflection_proto != nil {
 		return
 	}
 	if !protoimpl.UnsafeEnabled {
-		file_reflection_grpc_reflection_v1alpha_reflection_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+		file_grpc_reflection_v1alpha_reflection_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*ServerReflectionRequest); i {
 			case 0:
 				return &v.state
@@ -836,7 +909,7 @@ func file_reflection_grpc_reflection_v1alpha_reflection_proto_init() {
 				return nil
 			}
 		}
-		file_reflection_grpc_reflection_v1alpha_reflection_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+		file_grpc_reflection_v1alpha_reflection_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*ExtensionRequest); i {
 			case 0:
 				return &v.state
@@ -848,7 +921,7 @@ func file_reflection_grpc_reflection_v1alpha_reflection_proto_init() {
 				return nil
 			}
 		}
-		file_reflection_grpc_reflection_v1alpha_reflection_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
+		file_grpc_reflection_v1alpha_reflection_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*ServerReflectionResponse); i {
 			case 0:
 				return &v.state
@@ -860,7 +933,7 @@ func file_reflection_grpc_reflection_v1alpha_reflection_proto_init() {
 				return nil
 			}
 		}
-		file_reflection_grpc_reflection_v1alpha_reflection_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
+		file_grpc_reflection_v1alpha_reflection_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*FileDescriptorResponse); i {
 			case 0:
 				return &v.state
@@ -872,7 +945,7 @@ func file_reflection_grpc_reflection_v1alpha_reflection_proto_init() {
 				return nil
 			}
 		}
-		file_reflection_grpc_reflection_v1alpha_reflection_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
+		file_grpc_reflection_v1alpha_reflection_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*ExtensionNumberResponse); i {
 			case 0:
 				return &v.state
@@ -884,7 +957,7 @@ func file_reflection_grpc_reflection_v1alpha_reflection_proto_init() {
 				return nil
 			}
 		}
-		file_reflection_grpc_reflection_v1alpha_reflection_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
+		file_grpc_reflection_v1alpha_reflection_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*ListServiceResponse); i {
 			case 0:
 				return &v.state
@@ -896,7 +969,7 @@ func file_reflection_grpc_reflection_v1alpha_reflection_proto_init() {
 				return nil
 			}
 		}
-		file_reflection_grpc_reflection_v1alpha_reflection_proto_msgTypes[6].Exporter = func(v interface{}, i int) interface{} {
+		file_grpc_reflection_v1alpha_reflection_proto_msgTypes[6].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*ServiceResponse); i {
 			case 0:
 				return &v.state
@@ -908,7 +981,7 @@ func file_reflection_grpc_reflection_v1alpha_reflection_proto_init() {
 				return nil
 			}
 		}
-		file_reflection_grpc_reflection_v1alpha_reflection_proto_msgTypes[7].Exporter = func(v interface{}, i int) interface{} {
+		file_grpc_reflection_v1alpha_reflection_proto_msgTypes[7].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*ErrorResponse); i {
 			case 0:
 				return &v.state
@@ -921,14 +994,14 @@ func file_reflection_grpc_reflection_v1alpha_reflection_proto_init() {
 			}
 		}
 	}
-	file_reflection_grpc_reflection_v1alpha_reflection_proto_msgTypes[0].OneofWrappers = []interface{}{
+	file_grpc_reflection_v1alpha_reflection_proto_msgTypes[0].OneofWrappers = []interface{}{
 		(*ServerReflectionRequest_FileByFilename)(nil),
 		(*ServerReflectionRequest_FileContainingSymbol)(nil),
 		(*ServerReflectionRequest_FileContainingExtension)(nil),
 		(*ServerReflectionRequest_AllExtensionNumbersOfType)(nil),
 		(*ServerReflectionRequest_ListServices)(nil),
 	}
-	file_reflection_grpc_reflection_v1alpha_reflection_proto_msgTypes[2].OneofWrappers = []interface{}{
+	file_grpc_reflection_v1alpha_reflection_proto_msgTypes[2].OneofWrappers = []interface{}{
 		(*ServerReflectionResponse_FileDescriptorResponse)(nil),
 		(*ServerReflectionResponse_AllExtensionNumbersResponse)(nil),
 		(*ServerReflectionResponse_ListServicesResponse)(nil),
@@ -938,18 +1011,18 @@ func file_reflection_grpc_reflection_v1alpha_reflection_proto_init() {
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
-			RawDescriptor: file_reflection_grpc_reflection_v1alpha_reflection_proto_rawDesc,
+			RawDescriptor: file_grpc_reflection_v1alpha_reflection_proto_rawDesc,
 			NumEnums:      0,
 			NumMessages:   8,
 			NumExtensions: 0,
 			NumServices:   1,
 		},
-		GoTypes:           file_reflection_grpc_reflection_v1alpha_reflection_proto_goTypes,
-		DependencyIndexes: file_reflection_grpc_reflection_v1alpha_reflection_proto_depIdxs,
-		MessageInfos:      file_reflection_grpc_reflection_v1alpha_reflection_proto_msgTypes,
+		GoTypes:           file_grpc_reflection_v1alpha_reflection_proto_goTypes,
+		DependencyIndexes: file_grpc_reflection_v1alpha_reflection_proto_depIdxs,
+		MessageInfos:      file_grpc_reflection_v1alpha_reflection_proto_msgTypes,
 	}.Build()
-	File_reflection_grpc_reflection_v1alpha_reflection_proto = out.File
-	file_reflection_grpc_reflection_v1alpha_reflection_proto_rawDesc = nil
-	file_reflection_grpc_reflection_v1alpha_reflection_proto_goTypes = nil
-	file_reflection_grpc_reflection_v1alpha_reflection_proto_depIdxs = nil
+	File_grpc_reflection_v1alpha_reflection_proto = out.File
+	file_grpc_reflection_v1alpha_reflection_proto_rawDesc = nil
+	file_grpc_reflection_v1alpha_reflection_proto_goTypes = nil
+	file_grpc_reflection_v1alpha_reflection_proto_depIdxs = nil
 }
diff --git a/.ci/providerlint/vendor/google.golang.org/grpc/reflection/grpc_reflection_v1alpha/reflection.proto b/.ci/providerlint/vendor/google.golang.org/grpc/reflection/grpc_reflection_v1alpha/reflection.proto
deleted file mode 100644
index ee2b82c0a5b..00000000000
--- a/.ci/providerlint/vendor/google.golang.org/grpc/reflection/grpc_reflection_v1alpha/reflection.proto
+++ /dev/null
@@ -1,138 +0,0 @@
-// Copyright 2016 gRPC authors.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-// Service exported by server reflection
-
-syntax = "proto3";
-
-option go_package = "google.golang.org/grpc/reflection/grpc_reflection_v1alpha";
-
-package grpc.reflection.v1alpha;
-
-service ServerReflection {
-  // The reflection service is structured as a bidirectional stream, ensuring
-  // all related requests go to a single server.
-  rpc ServerReflectionInfo(stream ServerReflectionRequest)
-      returns (stream ServerReflectionResponse);
-}
-
-// The message sent by the client when calling ServerReflectionInfo method.
-message ServerReflectionRequest {
-  string host = 1;
-  // To use reflection service, the client should set one of the following
-  // fields in message_request. The server distinguishes requests by their
-  // defined field and then handles them using corresponding methods.
-  oneof message_request {
-    // Find a proto file by the file name.
-    string file_by_filename = 3;
-
-    // Find the proto file that declares the given fully-qualified symbol name.
-    // This field should be a fully-qualified symbol name
-    // (e.g. <package>.<service>[.<method>] or <package>.<type>).
-    string file_containing_symbol = 4;
-
-    // Find the proto file which defines an extension extending the given
-    // message type with the given field number.
-    ExtensionRequest file_containing_extension = 5;
-
-    // Finds the tag numbers used by all known extensions of extendee_type, and
-    // appends them to ExtensionNumberResponse in an undefined order.
-    // Its corresponding method is best-effort: it's not guaranteed that the
-    // reflection service will implement this method, and it's not guaranteed
-    // that this method will provide all extensions. Returns
-    // StatusCode::UNIMPLEMENTED if it's not implemented.
-    // This field should be a fully-qualified type name. The format is
-    // <package>.<type>
-    string all_extension_numbers_of_type = 6;
-
-    // List the full names of registered services. The content will not be
-    // checked.
-    string list_services = 7;
-  }
-}
-
-// The type name and extension number sent by the client when requesting
-// file_containing_extension.
-message ExtensionRequest {
-  // Fully-qualified type name. The format should be <package>.<type>
-  string containing_type = 1;
-  int32 extension_number = 2;
-}
-
-// The message sent by the server to answer ServerReflectionInfo method.
-message ServerReflectionResponse {
-  string valid_host = 1;
-  ServerReflectionRequest original_request = 2;
-  // The server sets one of the following fields according to the
-  // message_request in the request.
-  oneof message_response {
-    // This message is used to answer file_by_filename, file_containing_symbol,
-    // file_containing_extension requests with transitive dependencies.
-    // As the repeated label is not allowed in oneof fields, we use a
-    // FileDescriptorResponse message to encapsulate the repeated fields.
-    // The reflection service is allowed to avoid sending FileDescriptorProtos
-    // that were previously sent in response to earlier requests in the stream.
-    FileDescriptorResponse file_descriptor_response = 4;
-
-    // This message is used to answer all_extension_numbers_of_type requests.
-    ExtensionNumberResponse all_extension_numbers_response = 5;
-
-    // This message is used to answer list_services requests.
-    ListServiceResponse list_services_response = 6;
-
-    // This message is used when an error occurs.
-    ErrorResponse error_response = 7;
-  }
-}
-
-// Serialized FileDescriptorProto messages sent by the server answering
-// a file_by_filename, file_containing_symbol, or file_containing_extension
-// request.
-message FileDescriptorResponse {
-  // Serialized FileDescriptorProto messages. We avoid taking a dependency on
-  // descriptor.proto, which uses proto2 only features, by making them opaque
-  // bytes instead.
-  repeated bytes file_descriptor_proto = 1;
-}
-
-// A list of extension numbers sent by the server answering
-// all_extension_numbers_of_type request.
-message ExtensionNumberResponse {
-  // Full name of the base type, including the package name. The format
-  // is <package>.<type>
-  string base_type_name = 1;
-  repeated int32 extension_number = 2;
-}
-
-// A list of ServiceResponse sent by the server answering list_services request.
-message ListServiceResponse {
-  // The information of each service may be expanded in the future, so we use
-  // ServiceResponse message to encapsulate it.
-  repeated ServiceResponse service = 1;
-}
-
-// The information of a single service used by ListServiceResponse to answer
-// list_services request.
-message ServiceResponse {
-  // Full name of a registered service, including its package name. The format
-  // is <package>.<service>
-  string name = 1;
-}
-
-// The error code and error message sent by the server when an error occurs.
-message ErrorResponse {
-  // This field uses the error codes defined in grpc::StatusCode.
-  int32 error_code = 1;
-  string error_message = 2;
-}
diff --git a/.ci/providerlint/vendor/google.golang.org/grpc/reflection/grpc_reflection_v1alpha/reflection_grpc.pb.go b/.ci/providerlint/vendor/google.golang.org/grpc/reflection/grpc_reflection_v1alpha/reflection_grpc.pb.go
index b8e76a87dca..367a029be6b 100644
--- a/.ci/providerlint/vendor/google.golang.org/grpc/reflection/grpc_reflection_v1alpha/reflection_grpc.pb.go
+++ b/.ci/providerlint/vendor/google.golang.org/grpc/reflection/grpc_reflection_v1alpha/reflection_grpc.pb.go
@@ -1,4 +1,4 @@
-// Copyright 2016 gRPC authors.
+// Copyright 2016 The gRPC Authors
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -11,14 +11,16 @@
 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 // See the License for the specific language governing permissions and
 // limitations under the License.
-
 // Service exported by server reflection
 
+// Warning: this entire file is deprecated. Use this instead:
+// https://github.com/grpc/grpc-proto/blob/master/grpc/reflection/v1/reflection.proto
+
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.2.0
-// - protoc             v3.14.0
-// source: reflection/grpc_reflection_v1alpha/reflection.proto
+// - protoc-gen-go-grpc v1.3.0
+// - protoc             v4.22.0
+// grpc/reflection/v1alpha/reflection.proto is a deprecated file.
 
 package grpc_reflection_v1alpha
 
@@ -34,6 +36,10 @@ import (
 // Requires gRPC-Go v1.32.0 or later.
 const _ = grpc.SupportPackageIsVersion7
 
+const (
+	ServerReflection_ServerReflectionInfo_FullMethodName = "/grpc.reflection.v1alpha.ServerReflection/ServerReflectionInfo"
+)
+
 // ServerReflectionClient is the client API for ServerReflection service.
 //
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
@@ -52,7 +58,7 @@ func NewServerReflectionClient(cc grpc.ClientConnInterface) ServerReflectionClie
 }
 
 func (c *serverReflectionClient) ServerReflectionInfo(ctx context.Context, opts ...grpc.CallOption) (ServerReflection_ServerReflectionInfoClient, error) {
-	stream, err := c.cc.NewStream(ctx, &ServerReflection_ServiceDesc.Streams[0], "/grpc.reflection.v1alpha.ServerReflection/ServerReflectionInfo", opts...)
+	stream, err := c.cc.NewStream(ctx, &ServerReflection_ServiceDesc.Streams[0], ServerReflection_ServerReflectionInfo_FullMethodName, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -151,5 +157,5 @@ var ServerReflection_ServiceDesc = grpc.ServiceDesc{
 			ClientStreams: true,
 		},
 	},
-	Metadata: "reflection/grpc_reflection_v1alpha/reflection.proto",
+	Metadata: "grpc/reflection/v1alpha/reflection.proto",
 }
diff --git a/.ci/providerlint/vendor/google.golang.org/grpc/reflection/serverreflection.go b/.ci/providerlint/vendor/google.golang.org/grpc/reflection/serverreflection.go
index 0b41783aa53..76dae09d888 100644
--- a/.ci/providerlint/vendor/google.golang.org/grpc/reflection/serverreflection.go
+++ b/.ci/providerlint/vendor/google.golang.org/grpc/reflection/serverreflection.go
@@ -42,12 +42,15 @@ import (
 
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/codes"
-	rpb "google.golang.org/grpc/reflection/grpc_reflection_v1alpha"
 	"google.golang.org/grpc/status"
 	"google.golang.org/protobuf/proto"
 	"google.golang.org/protobuf/reflect/protodesc"
 	"google.golang.org/protobuf/reflect/protoreflect"
 	"google.golang.org/protobuf/reflect/protoregistry"
+
+	v1reflectiongrpc "google.golang.org/grpc/reflection/grpc_reflection_v1"
+	v1reflectionpb "google.golang.org/grpc/reflection/grpc_reflection_v1"
+	v1alphareflectiongrpc "google.golang.org/grpc/reflection/grpc_reflection_v1alpha"
 )
 
 // GRPCServer is the interface provided by a gRPC server. It is implemented by
@@ -61,9 +64,19 @@ type GRPCServer interface {
 var _ GRPCServer = (*grpc.Server)(nil)
 
 // Register registers the server reflection service on the given gRPC server.
+// Both the v1 and v1alpha versions are registered.
 func Register(s GRPCServer) {
-	svr := NewServer(ServerOptions{Services: s})
-	rpb.RegisterServerReflectionServer(s, svr)
+	svr := NewServerV1(ServerOptions{Services: s})
+	v1alphareflectiongrpc.RegisterServerReflectionServer(s, asV1Alpha(svr))
+	v1reflectiongrpc.RegisterServerReflectionServer(s, svr)
+}
+
+// RegisterV1 registers only the v1 version of the server reflection service
+// on the given gRPC server. Many clients may only support v1alpha so most
+// users should use Register instead, at least until clients have upgraded.
+func RegisterV1(s GRPCServer) {
+	svr := NewServerV1(ServerOptions{Services: s})
+	v1reflectiongrpc.RegisterServerReflectionServer(s, svr)
 }
 
 // ServiceInfoProvider is an interface used to retrieve metadata about the
@@ -118,13 +131,27 @@ type ServerOptions struct {
 
 // NewServer returns a reflection server implementation using the given options.
 // This can be used to customize behavior of the reflection service. Most usages
+// should prefer to use Register instead. For backwards compatibility reasons,
+// this returns the v1alpha version of the reflection server. For a v1 version
+// of the reflection server, see NewServerV1.
+//
+// # Experimental
+//
+// Notice: This function is EXPERIMENTAL and may be changed or removed in a
+// later release.
+func NewServer(opts ServerOptions) v1alphareflectiongrpc.ServerReflectionServer {
+	return asV1Alpha(NewServerV1(opts))
+}
+
+// NewServerV1 returns a reflection server implementation using the given options.
+// This can be used to customize behavior of the reflection service. Most usages
 // should prefer to use Register instead.
 //
 // # Experimental
 //
 // Notice: This function is EXPERIMENTAL and may be changed or removed in a
 // later release.
-func NewServer(opts ServerOptions) rpb.ServerReflectionServer {
+func NewServerV1(opts ServerOptions) v1reflectiongrpc.ServerReflectionServer {
 	if opts.DescriptorResolver == nil {
 		opts.DescriptorResolver = protoregistry.GlobalFiles
 	}
@@ -139,7 +166,7 @@ func NewServer(opts ServerOptions) rpb.ServerReflectionServer {
 }
 
 type serverReflectionServer struct {
-	rpb.UnimplementedServerReflectionServer
+	v1alphareflectiongrpc.UnimplementedServerReflectionServer
 	s            ServiceInfoProvider
 	descResolver protodesc.Resolver
 	extResolver  ExtensionResolver
@@ -213,11 +240,11 @@ func (s *serverReflectionServer) allExtensionNumbersForTypeName(name string) ([]
 }
 
 // listServices returns the names of services this server exposes.
-func (s *serverReflectionServer) listServices() []*rpb.ServiceResponse {
+func (s *serverReflectionServer) listServices() []*v1reflectionpb.ServiceResponse {
 	serviceInfo := s.s.GetServiceInfo()
-	resp := make([]*rpb.ServiceResponse, 0, len(serviceInfo))
+	resp := make([]*v1reflectionpb.ServiceResponse, 0, len(serviceInfo))
 	for svc := range serviceInfo {
-		resp = append(resp, &rpb.ServiceResponse{Name: svc})
+		resp = append(resp, &v1reflectionpb.ServiceResponse{Name: svc})
 	}
 	sort.Slice(resp, func(i, j int) bool {
 		return resp[i].Name < resp[j].Name
@@ -226,7 +253,7 @@ func (s *serverReflectionServer) listServices() []*rpb.ServiceResponse {
 }
 
 // ServerReflectionInfo is the reflection service handler.
-func (s *serverReflectionServer) ServerReflectionInfo(stream rpb.ServerReflection_ServerReflectionInfoServer) error {
+func (s *serverReflectionServer) ServerReflectionInfo(stream v1reflectiongrpc.ServerReflection_ServerReflectionInfoServer) error {
 	sentFileDescriptors := make(map[string]bool)
 	for {
 		in, err := stream.Recv()
@@ -237,79 +264,79 @@ func (s *serverReflectionServer) ServerReflectionInfo(stream rpb.ServerReflectio
 			return err
 		}
 
-		out := &rpb.ServerReflectionResponse{
+		out := &v1reflectionpb.ServerReflectionResponse{
 			ValidHost:       in.Host,
 			OriginalRequest: in,
 		}
 		switch req := in.MessageRequest.(type) {
-		case *rpb.ServerReflectionRequest_FileByFilename:
+		case *v1reflectionpb.ServerReflectionRequest_FileByFilename:
 			var b [][]byte
 			fd, err := s.descResolver.FindFileByPath(req.FileByFilename)
 			if err == nil {
 				b, err = s.fileDescWithDependencies(fd, sentFileDescriptors)
 			}
 			if err != nil {
-				out.MessageResponse = &rpb.ServerReflectionResponse_ErrorResponse{
-					ErrorResponse: &rpb.ErrorResponse{
+				out.MessageResponse = &v1reflectionpb.ServerReflectionResponse_ErrorResponse{
+					ErrorResponse: &v1reflectionpb.ErrorResponse{
 						ErrorCode:    int32(codes.NotFound),
 						ErrorMessage: err.Error(),
 					},
 				}
 			} else {
-				out.MessageResponse = &rpb.ServerReflectionResponse_FileDescriptorResponse{
-					FileDescriptorResponse: &rpb.FileDescriptorResponse{FileDescriptorProto: b},
+				out.MessageResponse = &v1reflectionpb.ServerReflectionResponse_FileDescriptorResponse{
+					FileDescriptorResponse: &v1reflectionpb.FileDescriptorResponse{FileDescriptorProto: b},
 				}
 			}
-		case *rpb.ServerReflectionRequest_FileContainingSymbol:
+		case *v1reflectionpb.ServerReflectionRequest_FileContainingSymbol:
 			b, err := s.fileDescEncodingContainingSymbol(req.FileContainingSymbol, sentFileDescriptors)
 			if err != nil {
-				out.MessageResponse = &rpb.ServerReflectionResponse_ErrorResponse{
-					ErrorResponse: &rpb.ErrorResponse{
+				out.MessageResponse = &v1reflectionpb.ServerReflectionResponse_ErrorResponse{
+					ErrorResponse: &v1reflectionpb.ErrorResponse{
 						ErrorCode:    int32(codes.NotFound),
 						ErrorMessage: err.Error(),
 					},
 				}
 			} else {
-				out.MessageResponse = &rpb.ServerReflectionResponse_FileDescriptorResponse{
-					FileDescriptorResponse: &rpb.FileDescriptorResponse{FileDescriptorProto: b},
+				out.MessageResponse = &v1reflectionpb.ServerReflectionResponse_FileDescriptorResponse{
+					FileDescriptorResponse: &v1reflectionpb.FileDescriptorResponse{FileDescriptorProto: b},
 				}
 			}
-		case *rpb.ServerReflectionRequest_FileContainingExtension:
+		case *v1reflectionpb.ServerReflectionRequest_FileContainingExtension:
 			typeName := req.FileContainingExtension.ContainingType
 			extNum := req.FileContainingExtension.ExtensionNumber
 			b, err := s.fileDescEncodingContainingExtension(typeName, extNum, sentFileDescriptors)
 			if err != nil {
-				out.MessageResponse = &rpb.ServerReflectionResponse_ErrorResponse{
-					ErrorResponse: &rpb.ErrorResponse{
+				out.MessageResponse = &v1reflectionpb.ServerReflectionResponse_ErrorResponse{
+					ErrorResponse: &v1reflectionpb.ErrorResponse{
 						ErrorCode:    int32(codes.NotFound),
 						ErrorMessage: err.Error(),
 					},
 				}
 			} else {
-				out.MessageResponse = &rpb.ServerReflectionResponse_FileDescriptorResponse{
-					FileDescriptorResponse: &rpb.FileDescriptorResponse{FileDescriptorProto: b},
+				out.MessageResponse = &v1reflectionpb.ServerReflectionResponse_FileDescriptorResponse{
+					FileDescriptorResponse: &v1reflectionpb.FileDescriptorResponse{FileDescriptorProto: b},
 				}
 			}
-		case *rpb.ServerReflectionRequest_AllExtensionNumbersOfType:
+		case *v1reflectionpb.ServerReflectionRequest_AllExtensionNumbersOfType:
 			extNums, err := s.allExtensionNumbersForTypeName(req.AllExtensionNumbersOfType)
 			if err != nil {
-				out.MessageResponse = &rpb.ServerReflectionResponse_ErrorResponse{
-					ErrorResponse: &rpb.ErrorResponse{
+				out.MessageResponse = &v1reflectionpb.ServerReflectionResponse_ErrorResponse{
+					ErrorResponse: &v1reflectionpb.ErrorResponse{
 						ErrorCode:    int32(codes.NotFound),
 						ErrorMessage: err.Error(),
 					},
 				}
 			} else {
-				out.MessageResponse = &rpb.ServerReflectionResponse_AllExtensionNumbersResponse{
-					AllExtensionNumbersResponse: &rpb.ExtensionNumberResponse{
+				out.MessageResponse = &v1reflectionpb.ServerReflectionResponse_AllExtensionNumbersResponse{
+					AllExtensionNumbersResponse: &v1reflectionpb.ExtensionNumberResponse{
 						BaseTypeName:    req.AllExtensionNumbersOfType,
 						ExtensionNumber: extNums,
 					},
 				}
 			}
-		case *rpb.ServerReflectionRequest_ListServices:
-			out.MessageResponse = &rpb.ServerReflectionResponse_ListServicesResponse{
-				ListServicesResponse: &rpb.ListServiceResponse{
+		case *v1reflectionpb.ServerReflectionRequest_ListServices:
+			out.MessageResponse = &v1reflectionpb.ServerReflectionResponse_ListServicesResponse{
+				ListServicesResponse: &v1reflectionpb.ListServiceResponse{
 					Service: s.listServices(),
 				},
 			}
diff --git a/.ci/providerlint/vendor/google.golang.org/grpc/regenerate.sh b/.ci/providerlint/vendor/google.golang.org/grpc/regenerate.sh
index 99db79fafcf..a6f26c8ab0f 100644
--- a/.ci/providerlint/vendor/google.golang.org/grpc/regenerate.sh
+++ b/.ci/providerlint/vendor/google.golang.org/grpc/regenerate.sh
@@ -57,7 +57,8 @@ LEGACY_SOURCES=(
   ${WORKDIR}/grpc-proto/grpc/health/v1/health.proto
   ${WORKDIR}/grpc-proto/grpc/lb/v1/load_balancer.proto
   profiling/proto/service.proto
-  reflection/grpc_reflection_v1alpha/reflection.proto
+  ${WORKDIR}/grpc-proto/grpc/reflection/v1alpha/reflection.proto
+  ${WORKDIR}/grpc-proto/grpc/reflection/v1/reflection.proto
 )
 
 # Generates only the new gRPC Service symbols
@@ -119,8 +120,4 @@ mv ${WORKDIR}/out/google.golang.org/grpc/lookup/grpc_lookup_v1/* ${WORKDIR}/out/
 # see grpc_testing_not_regenerate/README.md for details.
 rm ${WORKDIR}/out/google.golang.org/grpc/reflection/grpc_testing_not_regenerate/*.pb.go
 
-# grpc/testing does not have a go_package option.
-mv ${WORKDIR}/out/grpc/testing/*.pb.go interop/grpc_testing/
-mv ${WORKDIR}/out/grpc/core/*.pb.go interop/grpc_testing/core/
-
 cp -R ${WORKDIR}/out/google.golang.org/grpc/* .
diff --git a/.ci/providerlint/vendor/google.golang.org/grpc/resolver/resolver.go b/.ci/providerlint/vendor/google.golang.org/grpc/resolver/resolver.go
index 967cbc7373a..d8db6f5d34e 100644
--- a/.ci/providerlint/vendor/google.golang.org/grpc/resolver/resolver.go
+++ b/.ci/providerlint/vendor/google.golang.org/grpc/resolver/resolver.go
@@ -22,12 +22,13 @@ package resolver
 
 import (
 	"context"
+	"fmt"
 	"net"
 	"net/url"
+	"strings"
 
 	"google.golang.org/grpc/attributes"
 	"google.golang.org/grpc/credentials"
-	"google.golang.org/grpc/internal/pretty"
 	"google.golang.org/grpc/serviceconfig"
 )
 
@@ -40,8 +41,9 @@ var (
 
 // TODO(bar) install dns resolver in init(){}.
 
-// Register registers the resolver builder to the resolver map. b.Scheme will be
-// used as the scheme registered with this builder.
+// Register registers the resolver builder to the resolver map. b.Scheme will
+// be used as the scheme registered with this builder. The registry is case
+// sensitive, and schemes should not contain any uppercase characters.
 //
 // NOTE: this function must only be called during initialization time (i.e. in
 // an init() function), and is not thread-safe. If multiple Resolvers are
@@ -122,7 +124,7 @@ type Address struct {
 	Attributes *attributes.Attributes
 
 	// BalancerAttributes contains arbitrary data about this address intended
-	// for consumption by the LB policy.  These attribes do not affect SubConn
+	// for consumption by the LB policy.  These attributes do not affect SubConn
 	// creation, connection establishment, handshaking, etc.
 	BalancerAttributes *attributes.Attributes
 
@@ -140,6 +142,10 @@ type Address struct {
 
 // Equal returns whether a and o are identical.  Metadata is compared directly,
 // not with any recursive introspection.
+//
+// This method compares all fields of the address. When used to tell apart
+// addresses during subchannel creation or connection establishment, it might be
+// more appropriate for the caller to implement custom equality logic.
 func (a Address) Equal(o Address) bool {
 	return a.Addr == o.Addr && a.ServerName == o.ServerName &&
 		a.Attributes.Equal(o.Attributes) &&
@@ -149,7 +155,17 @@ func (a Address) Equal(o Address) bool {
 
 // String returns JSON formatted string representation of the address.
 func (a Address) String() string {
-	return pretty.ToJSON(a)
+	var sb strings.Builder
+	sb.WriteString(fmt.Sprintf("{Addr: %q, ", a.Addr))
+	sb.WriteString(fmt.Sprintf("ServerName: %q, ", a.ServerName))
+	if a.Attributes != nil {
+		sb.WriteString(fmt.Sprintf("Attributes: %v, ", a.Attributes.String()))
+	}
+	if a.BalancerAttributes != nil {
+		sb.WriteString(fmt.Sprintf("BalancerAttributes: %v", a.BalancerAttributes.String()))
+	}
+	sb.WriteString("}")
+	return sb.String()
 }
 
 // BuildOptions includes additional information for the builder to create
@@ -202,6 +218,15 @@ type State struct {
 // gRPC to add new methods to this interface.
 type ClientConn interface {
 	// UpdateState updates the state of the ClientConn appropriately.
+	//
+	// If an error is returned, the resolver should try to resolve the
+	// target again. The resolver should use a backoff timer to prevent
+	// overloading the server with requests. If a resolver is certain that
+	// reresolving will not change the result, e.g. because it is
+	// a watch-based resolver, returned errors can be ignored.
+	//
+	// If the resolved State is the same as the last reported one, calling
+	// UpdateState can be omitted.
 	UpdateState(State) error
 	// ReportError notifies the ClientConn that the Resolver encountered an
 	// error.  The ClientConn will notify the load balancer and begin calling
@@ -243,13 +268,6 @@ type ClientConn interface {
 //   - "unknown_scheme://authority/endpoint"
 //     Target{Scheme: resolver.GetDefaultScheme(), Endpoint: "unknown_scheme://authority/endpoint"}
 type Target struct {
-	// Deprecated: use URL.Scheme instead.
-	Scheme string
-	// Deprecated: use URL.Host instead.
-	Authority string
-	// Deprecated: use URL.Path or URL.Opaque instead. The latter is set when
-	// the former is empty.
-	Endpoint string
 	// URL contains the parsed dial target with an optional default scheme added
 	// to it if the original dial target contained no scheme or contained an
 	// unregistered scheme. Any query params specified in the original dial
@@ -257,6 +275,24 @@ type Target struct {
 	URL url.URL
 }
 
+// Endpoint retrieves endpoint without leading "/" from either `URL.Path`
+// or `URL.Opaque`. The latter is used when the former is empty.
+func (t Target) Endpoint() string {
+	endpoint := t.URL.Path
+	if endpoint == "" {
+		endpoint = t.URL.Opaque
+	}
+	// For targets of the form "[scheme]://[authority]/endpoint, the endpoint
+	// value returned from url.Parse() contains a leading "/". Although this is
+	// in accordance with RFC 3986, we do not want to break existing resolver
+	// implementations which expect the endpoint without the leading "/". So, we
+	// end up stripping the leading "/" here. But this will result in an
+	// incorrect parsing for something like "unix:///path/to/socket". Since we
+	// own the "unix" resolver, we can workaround in the unix resolver by using
+	// the `URL` field.
+	return strings.TrimPrefix(endpoint, "/")
+}
+
 // Builder creates a resolver that will be used to watch name resolution updates.
 type Builder interface {
 	// Build creates a new resolver for the given target.
@@ -264,8 +300,10 @@ type Builder interface {
 	// gRPC dial calls Build synchronously, and fails if the returned error is
 	// not nil.
 	Build(target Target, cc ClientConn, opts BuildOptions) (Resolver, error)
-	// Scheme returns the scheme supported by this resolver.
-	// Scheme is defined at https://github.com/grpc/grpc/blob/master/doc/naming.md.
+	// Scheme returns the scheme supported by this resolver.  Scheme is defined
+	// at https://github.com/grpc/grpc/blob/master/doc/naming.md.  The returned
+	// string should not contain uppercase characters, as they will not match
+	// the parsed target's scheme as defined in RFC 3986.
 	Scheme() string
 }
 
diff --git a/.ci/providerlint/vendor/google.golang.org/grpc/resolver_conn_wrapper.go b/.ci/providerlint/vendor/google.golang.org/grpc/resolver_conn_wrapper.go
index 05a9d4e0bac..b408b3688f2 100644
--- a/.ci/providerlint/vendor/google.golang.org/grpc/resolver_conn_wrapper.go
+++ b/.ci/providerlint/vendor/google.golang.org/grpc/resolver_conn_wrapper.go
@@ -19,11 +19,11 @@
 package grpc
 
 import (
+	"context"
 	"strings"
 	"sync"
 
 	"google.golang.org/grpc/balancer"
-	"google.golang.org/grpc/credentials"
 	"google.golang.org/grpc/internal/channelz"
 	"google.golang.org/grpc/internal/grpcsync"
 	"google.golang.org/grpc/internal/pretty"
@@ -31,129 +31,192 @@ import (
 	"google.golang.org/grpc/serviceconfig"
 )
 
+// resolverStateUpdater wraps the single method used by ccResolverWrapper to
+// report a state update from the actual resolver implementation.
+type resolverStateUpdater interface {
+	updateResolverState(s resolver.State, err error) error
+}
+
 // ccResolverWrapper is a wrapper on top of cc for resolvers.
 // It implements resolver.ClientConn interface.
 type ccResolverWrapper struct {
-	cc         *ClientConn
-	resolverMu sync.Mutex
-	resolver   resolver.Resolver
-	done       *grpcsync.Event
-	curState   resolver.State
+	// The following fields are initialized when the wrapper is created and are
+	// read-only afterwards, and therefore can be accessed without a mutex.
+	cc                  resolverStateUpdater
+	channelzID          *channelz.Identifier
+	ignoreServiceConfig bool
+	opts                ccResolverWrapperOpts
+	serializer          *grpcsync.CallbackSerializer // To serialize all incoming calls.
+	serializerCancel    context.CancelFunc           // To close the serializer, accessed only from close().
+
+	// All incoming (resolver --> gRPC) calls are guaranteed to execute in a
+	// mutually exclusive manner as they are scheduled on the serializer.
+	// Fields accessed *only* in these serializer callbacks, can therefore be
+	// accessed without a mutex.
+	curState resolver.State
+
+	// mu guards access to the below fields.
+	mu       sync.Mutex
+	closed   bool
+	resolver resolver.Resolver // Accessed only from outgoing calls.
+}
 
-	incomingMu sync.Mutex // Synchronizes all the incoming calls.
+// ccResolverWrapperOpts wraps the arguments to be passed when creating a new
+// ccResolverWrapper.
+type ccResolverWrapperOpts struct {
+	target     resolver.Target       // User specified dial target to resolve.
+	builder    resolver.Builder      // Resolver builder to use.
+	bOpts      resolver.BuildOptions // Resolver build options to use.
+	channelzID *channelz.Identifier  // Channelz identifier for the channel.
 }
 
 // newCCResolverWrapper uses the resolver.Builder to build a Resolver and
 // returns a ccResolverWrapper object which wraps the newly built resolver.
-func newCCResolverWrapper(cc *ClientConn, rb resolver.Builder) (*ccResolverWrapper, error) {
+func newCCResolverWrapper(cc resolverStateUpdater, opts ccResolverWrapperOpts) (*ccResolverWrapper, error) {
+	ctx, cancel := context.WithCancel(context.Background())
 	ccr := &ccResolverWrapper{
-		cc:   cc,
-		done: grpcsync.NewEvent(),
-	}
-
-	var credsClone credentials.TransportCredentials
-	if creds := cc.dopts.copts.TransportCredentials; creds != nil {
-		credsClone = creds.Clone()
-	}
-	rbo := resolver.BuildOptions{
-		DisableServiceConfig: cc.dopts.disableServiceConfig,
-		DialCreds:            credsClone,
-		CredsBundle:          cc.dopts.copts.CredsBundle,
-		Dialer:               cc.dopts.copts.Dialer,
-	}
-
-	var err error
-	// We need to hold the lock here while we assign to the ccr.resolver field
-	// to guard against a data race caused by the following code path,
-	// rb.Build-->ccr.ReportError-->ccr.poll-->ccr.resolveNow, would end up
-	// accessing ccr.resolver which is being assigned here.
-	ccr.resolverMu.Lock()
-	defer ccr.resolverMu.Unlock()
-	ccr.resolver, err = rb.Build(cc.parsedTarget, ccr, rbo)
+		cc:                  cc,
+		channelzID:          opts.channelzID,
+		ignoreServiceConfig: opts.bOpts.DisableServiceConfig,
+		opts:                opts,
+		serializer:          grpcsync.NewCallbackSerializer(ctx),
+		serializerCancel:    cancel,
+	}
+
+	// Cannot hold the lock at build time because the resolver can send an
+	// update or error inline and these incoming calls grab the lock to schedule
+	// a callback in the serializer.
+	r, err := opts.builder.Build(opts.target, ccr, opts.bOpts)
 	if err != nil {
+		cancel()
 		return nil, err
 	}
+
+	// Any error reported by the resolver at build time that leads to a
+	// re-resolution request from the balancer is dropped by grpc until we
+	// return from this function. So, we don't have to handle pending resolveNow
+	// requests here.
+	ccr.mu.Lock()
+	ccr.resolver = r
+	ccr.mu.Unlock()
+
 	return ccr, nil
 }
 
 func (ccr *ccResolverWrapper) resolveNow(o resolver.ResolveNowOptions) {
-	ccr.resolverMu.Lock()
-	if !ccr.done.HasFired() {
-		ccr.resolver.ResolveNow(o)
+	ccr.mu.Lock()
+	defer ccr.mu.Unlock()
+
+	// ccr.resolver field is set only after the call to Build() returns. But in
+	// the process of building, the resolver may send an error update which when
+	// propagated to the balancer may result in a re-resolution request.
+	if ccr.closed || ccr.resolver == nil {
+		return
 	}
-	ccr.resolverMu.Unlock()
+	ccr.resolver.ResolveNow(o)
 }
 
 func (ccr *ccResolverWrapper) close() {
-	ccr.resolverMu.Lock()
-	ccr.resolver.Close()
-	ccr.done.Fire()
-	ccr.resolverMu.Unlock()
+	ccr.mu.Lock()
+	if ccr.closed {
+		ccr.mu.Unlock()
+		return
+	}
+
+	channelz.Info(logger, ccr.channelzID, "Closing the name resolver")
+
+	// Close the serializer to ensure that no more calls from the resolver are
+	// handled, before actually closing the resolver.
+	ccr.serializerCancel()
+	ccr.closed = true
+	r := ccr.resolver
+	ccr.mu.Unlock()
+
+	// Give enqueued callbacks a chance to finish.
+	<-ccr.serializer.Done
+
+	// Spawn a goroutine to close the resolver (since it may block trying to
+	// cleanup all allocated resources) and return early.
+	go r.Close()
+}
+
+// serializerScheduleLocked is a convenience method to schedule a function to be
+// run on the serializer while holding ccr.mu.
+func (ccr *ccResolverWrapper) serializerScheduleLocked(f func(context.Context)) {
+	ccr.mu.Lock()
+	ccr.serializer.Schedule(f)
+	ccr.mu.Unlock()
 }
 
+// UpdateState is called by resolver implementations to report new state to gRPC
+// which includes addresses and service config.
 func (ccr *ccResolverWrapper) UpdateState(s resolver.State) error {
-	ccr.incomingMu.Lock()
-	defer ccr.incomingMu.Unlock()
-	if ccr.done.HasFired() {
+	errCh := make(chan error, 1)
+	ok := ccr.serializer.Schedule(func(context.Context) {
+		ccr.addChannelzTraceEvent(s)
+		ccr.curState = s
+		if err := ccr.cc.updateResolverState(ccr.curState, nil); err == balancer.ErrBadResolverState {
+			errCh <- balancer.ErrBadResolverState
+			return
+		}
+		errCh <- nil
+	})
+	if !ok {
+		// The only time when Schedule() fail to add the callback to the
+		// serializer is when the serializer is closed, and this happens only
+		// when the resolver wrapper is closed.
 		return nil
 	}
-	ccr.addChannelzTraceEvent(s)
-	ccr.curState = s
-	if err := ccr.cc.updateResolverState(ccr.curState, nil); err == balancer.ErrBadResolverState {
-		return balancer.ErrBadResolverState
-	}
-	return nil
+	return <-errCh
 }
 
+// ReportError is called by resolver implementations to report errors
+// encountered during name resolution to gRPC.
 func (ccr *ccResolverWrapper) ReportError(err error) {
-	ccr.incomingMu.Lock()
-	defer ccr.incomingMu.Unlock()
-	if ccr.done.HasFired() {
-		return
-	}
-	channelz.Warningf(logger, ccr.cc.channelzID, "ccResolverWrapper: reporting error to cc: %v", err)
-	ccr.cc.updateResolverState(resolver.State{}, err)
+	ccr.serializerScheduleLocked(func(_ context.Context) {
+		channelz.Warningf(logger, ccr.channelzID, "ccResolverWrapper: reporting error to cc: %v", err)
+		ccr.cc.updateResolverState(resolver.State{}, err)
+	})
 }
 
-// NewAddress is called by the resolver implementation to send addresses to gRPC.
+// NewAddress is called by the resolver implementation to send addresses to
+// gRPC.
 func (ccr *ccResolverWrapper) NewAddress(addrs []resolver.Address) {
-	ccr.incomingMu.Lock()
-	defer ccr.incomingMu.Unlock()
-	if ccr.done.HasFired() {
-		return
-	}
-	ccr.addChannelzTraceEvent(resolver.State{Addresses: addrs, ServiceConfig: ccr.curState.ServiceConfig})
-	ccr.curState.Addresses = addrs
-	ccr.cc.updateResolverState(ccr.curState, nil)
+	ccr.serializerScheduleLocked(func(_ context.Context) {
+		ccr.addChannelzTraceEvent(resolver.State{Addresses: addrs, ServiceConfig: ccr.curState.ServiceConfig})
+		ccr.curState.Addresses = addrs
+		ccr.cc.updateResolverState(ccr.curState, nil)
+	})
 }
 
 // NewServiceConfig is called by the resolver implementation to send service
 // configs to gRPC.
 func (ccr *ccResolverWrapper) NewServiceConfig(sc string) {
-	ccr.incomingMu.Lock()
-	defer ccr.incomingMu.Unlock()
-	if ccr.done.HasFired() {
-		return
-	}
-	channelz.Infof(logger, ccr.cc.channelzID, "ccResolverWrapper: got new service config: %s", sc)
-	if ccr.cc.dopts.disableServiceConfig {
-		channelz.Info(logger, ccr.cc.channelzID, "Service config lookups disabled; ignoring config")
-		return
-	}
-	scpr := parseServiceConfig(sc)
-	if scpr.Err != nil {
-		channelz.Warningf(logger, ccr.cc.channelzID, "ccResolverWrapper: error parsing service config: %v", scpr.Err)
-		return
-	}
-	ccr.addChannelzTraceEvent(resolver.State{Addresses: ccr.curState.Addresses, ServiceConfig: scpr})
-	ccr.curState.ServiceConfig = scpr
-	ccr.cc.updateResolverState(ccr.curState, nil)
+	ccr.serializerScheduleLocked(func(_ context.Context) {
+		channelz.Infof(logger, ccr.channelzID, "ccResolverWrapper: got new service config: %s", sc)
+		if ccr.ignoreServiceConfig {
+			channelz.Info(logger, ccr.channelzID, "Service config lookups disabled; ignoring config")
+			return
+		}
+		scpr := parseServiceConfig(sc)
+		if scpr.Err != nil {
+			channelz.Warningf(logger, ccr.channelzID, "ccResolverWrapper: error parsing service config: %v", scpr.Err)
+			return
+		}
+		ccr.addChannelzTraceEvent(resolver.State{Addresses: ccr.curState.Addresses, ServiceConfig: scpr})
+		ccr.curState.ServiceConfig = scpr
+		ccr.cc.updateResolverState(ccr.curState, nil)
+	})
 }
 
+// ParseServiceConfig is called by resolver implementations to parse a JSON
+// representation of the service config.
 func (ccr *ccResolverWrapper) ParseServiceConfig(scJSON string) *serviceconfig.ParseResult {
 	return parseServiceConfig(scJSON)
 }
 
+// addChannelzTraceEvent adds a channelz trace event containing the new
+// state received from resolver implementations.
 func (ccr *ccResolverWrapper) addChannelzTraceEvent(s resolver.State) {
 	var updates []string
 	var oldSC, newSC *ServiceConfig
@@ -172,5 +235,5 @@ func (ccr *ccResolverWrapper) addChannelzTraceEvent(s resolver.State) {
 	} else if len(ccr.curState.Addresses) == 0 && len(s.Addresses) > 0 {
 		updates = append(updates, "resolver returned new addresses")
 	}
-	channelz.Infof(logger, ccr.cc.channelzID, "Resolver state updated: %s (%v)", pretty.ToJSON(s), strings.Join(updates, "; "))
+	channelz.Infof(logger, ccr.channelzID, "Resolver state updated: %s (%v)", pretty.ToJSON(s), strings.Join(updates, "; "))
 }
diff --git a/.ci/providerlint/vendor/google.golang.org/grpc/rpc_util.go b/.ci/providerlint/vendor/google.golang.org/grpc/rpc_util.go
index 934fc1aa015..a844d28f49d 100644
--- a/.ci/providerlint/vendor/google.golang.org/grpc/rpc_util.go
+++ b/.ci/providerlint/vendor/google.golang.org/grpc/rpc_util.go
@@ -25,7 +25,6 @@ import (
 	"encoding/binary"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"math"
 	"strings"
 	"sync"
@@ -77,7 +76,7 @@ func NewGZIPCompressorWithLevel(level int) (Compressor, error) {
 	return &gzipCompressor{
 		pool: sync.Pool{
 			New: func() interface{} {
-				w, err := gzip.NewWriterLevel(ioutil.Discard, level)
+				w, err := gzip.NewWriterLevel(io.Discard, level)
 				if err != nil {
 					panic(err)
 				}
@@ -143,7 +142,7 @@ func (d *gzipDecompressor) Do(r io.Reader) ([]byte, error) {
 		z.Close()
 		d.pool.Put(z)
 	}()
-	return ioutil.ReadAll(z)
+	return io.ReadAll(z)
 }
 
 func (d *gzipDecompressor) Type() string {
@@ -160,6 +159,7 @@ type callInfo struct {
 	contentSubtype        string
 	codec                 baseCodec
 	maxRetryRPCBufferSize int
+	onFinish              []func(err error)
 }
 
 func defaultCallInfo() *callInfo {
@@ -296,8 +296,44 @@ func (o FailFastCallOption) before(c *callInfo) error {
 }
 func (o FailFastCallOption) after(c *callInfo, attempt *csAttempt) {}
 
+// OnFinish returns a CallOption that configures a callback to be called when
+// the call completes. The error passed to the callback is the status of the
+// RPC, and may be nil. The onFinish callback provided will only be called once
+// by gRPC. This is mainly used to be used by streaming interceptors, to be
+// notified when the RPC completes along with information about the status of
+// the RPC.
+//
+// # Experimental
+//
+// Notice: This API is EXPERIMENTAL and may be changed or removed in a
+// later release.
+func OnFinish(onFinish func(err error)) CallOption {
+	return OnFinishCallOption{
+		OnFinish: onFinish,
+	}
+}
+
+// OnFinishCallOption is CallOption that indicates a callback to be called when
+// the call completes.
+//
+// # Experimental
+//
+// Notice: This type is EXPERIMENTAL and may be changed or removed in a
+// later release.
+type OnFinishCallOption struct {
+	OnFinish func(error)
+}
+
+func (o OnFinishCallOption) before(c *callInfo) error {
+	c.onFinish = append(c.onFinish, o.OnFinish)
+	return nil
+}
+
+func (o OnFinishCallOption) after(c *callInfo, attempt *csAttempt) {}
+
 // MaxCallRecvMsgSize returns a CallOption which sets the maximum message size
-// in bytes the client can receive.
+// in bytes the client can receive. If this is not set, gRPC uses the default
+// 4MB.
 func MaxCallRecvMsgSize(bytes int) CallOption {
 	return MaxRecvMsgSizeCallOption{MaxRecvMsgSize: bytes}
 }
@@ -320,7 +356,8 @@ func (o MaxRecvMsgSizeCallOption) before(c *callInfo) error {
 func (o MaxRecvMsgSizeCallOption) after(c *callInfo, attempt *csAttempt) {}
 
 // MaxCallSendMsgSize returns a CallOption which sets the maximum message size
-// in bytes the client can send.
+// in bytes the client can send. If this is not set, gRPC uses the default
+// `math.MaxInt32`.
 func MaxCallSendMsgSize(bytes int) CallOption {
 	return MaxSendMsgSizeCallOption{MaxSendMsgSize: bytes}
 }
@@ -540,6 +577,9 @@ type parser struct {
 	// The header of a gRPC message. Find more detail at
 	// https://github.com/grpc/grpc/blob/master/doc/PROTOCOL-HTTP2.md
 	header [5]byte
+
+	// recvBufferPool is the pool of shared receive buffers.
+	recvBufferPool SharedBufferPool
 }
 
 // recvMsg reads a complete gRPC message from the stream.
@@ -573,9 +613,7 @@ func (p *parser) recvMsg(maxReceiveMessageSize int) (pf payloadFormat, msg []byt
 	if int(length) > maxReceiveMessageSize {
 		return 0, nil, status.Errorf(codes.ResourceExhausted, "grpc: received message larger than max (%d vs. %d)", length, maxReceiveMessageSize)
 	}
-	// TODO(bradfitz,zhaoq): garbage. reuse buffer after proto decoding instead
-	// of making it for each message:
-	msg = make([]byte, int(length))
+	msg = p.recvBufferPool.Get(int(length))
 	if _, err := p.r.Read(msg); err != nil {
 		if err == io.EOF {
 			err = io.ErrUnexpectedEOF
@@ -657,12 +695,13 @@ func msgHeader(data, compData []byte) (hdr []byte, payload []byte) {
 
 func outPayload(client bool, msg interface{}, data, payload []byte, t time.Time) *stats.OutPayload {
 	return &stats.OutPayload{
-		Client:     client,
-		Payload:    msg,
-		Data:       data,
-		Length:     len(data),
-		WireLength: len(payload) + headerLen,
-		SentTime:   t,
+		Client:           client,
+		Payload:          msg,
+		Data:             data,
+		Length:           len(data),
+		WireLength:       len(payload) + headerLen,
+		CompressedLength: len(payload),
+		SentTime:         t,
 	}
 }
 
@@ -683,17 +722,17 @@ func checkRecvPayload(pf payloadFormat, recvCompress string, haveCompressor bool
 }
 
 type payloadInfo struct {
-	wireLength        int // The compressed length got from wire.
+	compressedLength  int // The compressed length got from wire.
 	uncompressedBytes []byte
 }
 
 func recvAndDecompress(p *parser, s *transport.Stream, dc Decompressor, maxReceiveMessageSize int, payInfo *payloadInfo, compressor encoding.Compressor) ([]byte, error) {
-	pf, d, err := p.recvMsg(maxReceiveMessageSize)
+	pf, buf, err := p.recvMsg(maxReceiveMessageSize)
 	if err != nil {
 		return nil, err
 	}
 	if payInfo != nil {
-		payInfo.wireLength = len(d)
+		payInfo.compressedLength = len(buf)
 	}
 
 	if st := checkRecvPayload(pf, s.RecvCompress(), compressor != nil || dc != nil); st != nil {
@@ -705,13 +744,13 @@ func recvAndDecompress(p *parser, s *transport.Stream, dc Decompressor, maxRecei
 		// To match legacy behavior, if the decompressor is set by WithDecompressor or RPCDecompressor,
 		// use this decompressor as the default.
 		if dc != nil {
-			d, err = dc.Do(bytes.NewReader(d))
-			size = len(d)
+			buf, err = dc.Do(bytes.NewReader(buf))
+			size = len(buf)
 		} else {
-			d, size, err = decompress(compressor, d, maxReceiveMessageSize)
+			buf, size, err = decompress(compressor, buf, maxReceiveMessageSize)
 		}
 		if err != nil {
-			return nil, status.Errorf(codes.Internal, "grpc: failed to decompress the received message %v", err)
+			return nil, status.Errorf(codes.Internal, "grpc: failed to decompress the received message: %v", err)
 		}
 		if size > maxReceiveMessageSize {
 			// TODO: Revisit the error code. Currently keep it consistent with java
@@ -719,7 +758,7 @@ func recvAndDecompress(p *parser, s *transport.Stream, dc Decompressor, maxRecei
 			return nil, status.Errorf(codes.ResourceExhausted, "grpc: received message after decompression larger than max (%d vs. %d)", size, maxReceiveMessageSize)
 		}
 	}
-	return d, nil
+	return buf, nil
 }
 
 // Using compressor, decompress d, returning data and size.
@@ -746,7 +785,7 @@ func decompress(compressor encoding.Compressor, d []byte, maxReceiveMessageSize
 	}
 	// Read from LimitReader with limit max+1. So if the underlying
 	// reader is over limit, the result will be bigger than max.
-	d, err = ioutil.ReadAll(io.LimitReader(dcReader, int64(maxReceiveMessageSize)+1))
+	d, err = io.ReadAll(io.LimitReader(dcReader, int64(maxReceiveMessageSize)+1))
 	return d, len(d), err
 }
 
@@ -754,15 +793,17 @@ func decompress(compressor encoding.Compressor, d []byte, maxReceiveMessageSize
 // dc takes precedence over compressor.
 // TODO(dfawley): wrap the old compressor/decompressor using the new API?
 func recv(p *parser, c baseCodec, s *transport.Stream, dc Decompressor, m interface{}, maxReceiveMessageSize int, payInfo *payloadInfo, compressor encoding.Compressor) error {
-	d, err := recvAndDecompress(p, s, dc, maxReceiveMessageSize, payInfo, compressor)
+	buf, err := recvAndDecompress(p, s, dc, maxReceiveMessageSize, payInfo, compressor)
 	if err != nil {
 		return err
 	}
-	if err := c.Unmarshal(d, m); err != nil {
-		return status.Errorf(codes.Internal, "grpc: failed to unmarshal the received message %v", err)
+	if err := c.Unmarshal(buf, m); err != nil {
+		return status.Errorf(codes.Internal, "grpc: failed to unmarshal the received message: %v", err)
 	}
 	if payInfo != nil {
-		payInfo.uncompressedBytes = d
+		payInfo.uncompressedBytes = buf
+	} else {
+		p.recvBufferPool.Put(&buf)
 	}
 	return nil
 }
diff --git a/.ci/providerlint/vendor/google.golang.org/grpc/server.go b/.ci/providerlint/vendor/google.golang.org/grpc/server.go
index f4dde72b41f..e076ec7143b 100644
--- a/.ci/providerlint/vendor/google.golang.org/grpc/server.go
+++ b/.ci/providerlint/vendor/google.golang.org/grpc/server.go
@@ -43,8 +43,8 @@ import (
 	"google.golang.org/grpc/internal"
 	"google.golang.org/grpc/internal/binarylog"
 	"google.golang.org/grpc/internal/channelz"
-	"google.golang.org/grpc/internal/grpcrand"
 	"google.golang.org/grpc/internal/grpcsync"
+	"google.golang.org/grpc/internal/grpcutil"
 	"google.golang.org/grpc/internal/transport"
 	"google.golang.org/grpc/keepalive"
 	"google.golang.org/grpc/metadata"
@@ -74,10 +74,10 @@ func init() {
 		srv.drainServerTransports(addr)
 	}
 	internal.AddGlobalServerOptions = func(opt ...ServerOption) {
-		extraServerOptions = append(extraServerOptions, opt...)
+		globalServerOptions = append(globalServerOptions, opt...)
 	}
 	internal.ClearGlobalServerOptions = func() {
-		extraServerOptions = nil
+		globalServerOptions = nil
 	}
 	internal.BinaryLogger = binaryLogger
 	internal.JoinServerOptions = newJoinServerOption
@@ -145,7 +145,7 @@ type Server struct {
 	channelzID *channelz.Identifier
 	czData     *channelzData
 
-	serverWorkerChannels []chan *serverWorkerData
+	serverWorkerChannel chan *serverWorkerData
 }
 
 type serverOptions struct {
@@ -174,6 +174,7 @@ type serverOptions struct {
 	maxHeaderListSize     *uint32
 	headerTableSize       *uint32
 	numServerWorkers      uint32
+	recvBufferPool        SharedBufferPool
 }
 
 var defaultServerOptions = serverOptions{
@@ -182,8 +183,9 @@ var defaultServerOptions = serverOptions{
 	connectionTimeout:     120 * time.Second,
 	writeBufferSize:       defaultWriteBufSize,
 	readBufferSize:        defaultReadBufSize,
+	recvBufferPool:        nopBufferPool{},
 }
-var extraServerOptions []ServerOption
+var globalServerOptions []ServerOption
 
 // A ServerOption sets options such as credentials, codec and keepalive parameters, etc.
 type ServerOption interface {
@@ -233,10 +235,11 @@ func newJoinServerOption(opts ...ServerOption) ServerOption {
 	return &joinServerOption{opts: opts}
 }
 
-// WriteBufferSize determines how much data can be batched before doing a write on the wire.
-// The corresponding memory allocation for this buffer will be twice the size to keep syscalls low.
-// The default value for this buffer is 32KB.
-// Zero will disable the write buffer such that each write will be on underlying connection.
+// WriteBufferSize determines how much data can be batched before doing a write
+// on the wire. The corresponding memory allocation for this buffer will be
+// twice the size to keep syscalls low. The default value for this buffer is
+// 32KB. Zero or negative values will disable the write buffer such that each
+// write will be on underlying connection.
 // Note: A Send call may not directly translate to a write.
 func WriteBufferSize(s int) ServerOption {
 	return newFuncServerOption(func(o *serverOptions) {
@@ -244,11 +247,10 @@ func WriteBufferSize(s int) ServerOption {
 	})
 }
 
-// ReadBufferSize lets you set the size of read buffer, this determines how much data can be read at most
-// for one read syscall.
-// The default value for this buffer is 32KB.
-// Zero will disable read buffer for a connection so data framer can access the underlying
-// conn directly.
+// ReadBufferSize lets you set the size of read buffer, this determines how much
+// data can be read at most for one read syscall. The default value for this
+// buffer is 32KB. Zero or negative values will disable read buffer for a
+// connection so data framer can access the underlying conn directly.
 func ReadBufferSize(s int) ServerOption {
 	return newFuncServerOption(func(o *serverOptions) {
 		o.readBufferSize = s
@@ -552,6 +554,27 @@ func NumStreamWorkers(numServerWorkers uint32) ServerOption {
 	})
 }
 
+// RecvBufferPool returns a ServerOption that configures the server
+// to use the provided shared buffer pool for parsing incoming messages. Depending
+// on the application's workload, this could result in reduced memory allocation.
+//
+// If you are unsure about how to implement a memory pool but want to utilize one,
+// begin with grpc.NewSharedBufferPool.
+//
+// Note: The shared buffer pool feature will not be active if any of the following
+// options are used: StatsHandler, EnableTracing, or binary logging. In such
+// cases, the shared buffer pool will be ignored.
+//
+// # Experimental
+//
+// Notice: This API is EXPERIMENTAL and may be changed or removed in a
+// later release.
+func RecvBufferPool(bufferPool SharedBufferPool) ServerOption {
+	return newFuncServerOption(func(o *serverOptions) {
+		o.recvBufferPool = bufferPool
+	})
+}
+
 // serverWorkerResetThreshold defines how often the stack must be reset. Every
 // N requests, by spawning a new goroutine in its place, a worker can reset its
 // stack so that large stacks don't live in memory forever. 2^16 should allow
@@ -560,47 +583,45 @@ func NumStreamWorkers(numServerWorkers uint32) ServerOption {
 const serverWorkerResetThreshold = 1 << 16
 
 // serverWorkers blocks on a *transport.Stream channel forever and waits for
-// data to be fed by serveStreams. This allows different requests to be
+// data to be fed by serveStreams. This allows multiple requests to be
 // processed by the same goroutine, removing the need for expensive stack
 // re-allocations (see the runtime.morestack problem [1]).
 //
 // [1] https://github.com/golang/go/issues/18138
-func (s *Server) serverWorker(ch chan *serverWorkerData) {
-	// To make sure all server workers don't reset at the same time, choose a
-	// random number of iterations before resetting.
-	threshold := serverWorkerResetThreshold + grpcrand.Intn(serverWorkerResetThreshold)
-	for completed := 0; completed < threshold; completed++ {
-		data, ok := <-ch
+func (s *Server) serverWorker() {
+	for completed := 0; completed < serverWorkerResetThreshold; completed++ {
+		data, ok := <-s.serverWorkerChannel
 		if !ok {
 			return
 		}
-		s.handleStream(data.st, data.stream, s.traceInfo(data.st, data.stream))
-		data.wg.Done()
+		s.handleSingleStream(data)
 	}
-	go s.serverWorker(ch)
+	go s.serverWorker()
+}
+
+func (s *Server) handleSingleStream(data *serverWorkerData) {
+	defer data.wg.Done()
+	s.handleStream(data.st, data.stream, s.traceInfo(data.st, data.stream))
 }
 
-// initServerWorkers creates worker goroutines and channels to process incoming
+// initServerWorkers creates worker goroutines and a channel to process incoming
 // connections to reduce the time spent overall on runtime.morestack.
 func (s *Server) initServerWorkers() {
-	s.serverWorkerChannels = make([]chan *serverWorkerData, s.opts.numServerWorkers)
+	s.serverWorkerChannel = make(chan *serverWorkerData)
 	for i := uint32(0); i < s.opts.numServerWorkers; i++ {
-		s.serverWorkerChannels[i] = make(chan *serverWorkerData)
-		go s.serverWorker(s.serverWorkerChannels[i])
+		go s.serverWorker()
 	}
 }
 
 func (s *Server) stopServerWorkers() {
-	for i := uint32(0); i < s.opts.numServerWorkers; i++ {
-		close(s.serverWorkerChannels[i])
-	}
+	close(s.serverWorkerChannel)
 }
 
 // NewServer creates a gRPC server which has no service registered and has not
 // started to accept requests yet.
 func NewServer(opt ...ServerOption) *Server {
 	opts := defaultServerOptions
-	for _, o := range extraServerOptions {
+	for _, o := range globalServerOptions {
 		o.apply(&opts)
 	}
 	for _, o := range opt {
@@ -897,7 +918,7 @@ func (s *Server) drainServerTransports(addr string) {
 	s.mu.Lock()
 	conns := s.conns[addr]
 	for st := range conns {
-		st.Drain()
+		st.Drain("")
 	}
 	s.mu.Unlock()
 }
@@ -942,29 +963,24 @@ func (s *Server) newHTTP2Transport(c net.Conn) transport.ServerTransport {
 }
 
 func (s *Server) serveStreams(st transport.ServerTransport) {
-	defer st.Close()
+	defer st.Close(errors.New("finished serving streams for the server transport"))
 	var wg sync.WaitGroup
 
-	var roundRobinCounter uint32
 	st.HandleStreams(func(stream *transport.Stream) {
 		wg.Add(1)
 		if s.opts.numServerWorkers > 0 {
 			data := &serverWorkerData{st: st, wg: &wg, stream: stream}
 			select {
-			case s.serverWorkerChannels[atomic.AddUint32(&roundRobinCounter, 1)%s.opts.numServerWorkers] <- data:
+			case s.serverWorkerChannel <- data:
+				return
 			default:
 				// If all stream workers are busy, fallback to the default code path.
-				go func() {
-					s.handleStream(st, stream, s.traceInfo(st, stream))
-					wg.Done()
-				}()
 			}
-		} else {
-			go func() {
-				defer wg.Done()
-				s.handleStream(st, stream, s.traceInfo(st, stream))
-			}()
 		}
+		go func() {
+			defer wg.Done()
+			s.handleStream(st, stream, s.traceInfo(st, stream))
+		}()
 	}, func(ctx context.Context, method string) context.Context {
 		if !EnableTracing {
 			return ctx
@@ -1008,7 +1024,8 @@ var _ http.Handler = (*Server)(nil)
 func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	st, err := transport.NewServerHandlerTransport(w, r, s.opts.statsHandlers)
 	if err != nil {
-		http.Error(w, err.Error(), http.StatusInternalServerError)
+		// Errors returned from transport.NewServerHandlerTransport have
+		// already been written to w.
 		return
 	}
 	if !s.addConn(listenerAddressForServeHTTP, st) {
@@ -1046,13 +1063,13 @@ func (s *Server) addConn(addr string, st transport.ServerTransport) bool {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 	if s.conns == nil {
-		st.Close()
+		st.Close(errors.New("Server.addConn called when server has already been stopped"))
 		return false
 	}
 	if s.drain {
 		// Transport added after we drained our existing conns: drain it
 		// immediately.
-		st.Drain()
+		st.Drain("")
 	}
 
 	if s.conns[addr] == nil {
@@ -1150,21 +1167,16 @@ func chainUnaryServerInterceptors(s *Server) {
 
 func chainUnaryInterceptors(interceptors []UnaryServerInterceptor) UnaryServerInterceptor {
 	return func(ctx context.Context, req interface{}, info *UnaryServerInfo, handler UnaryHandler) (interface{}, error) {
-		// the struct ensures the variables are allocated together, rather than separately, since we
-		// know they should be garbage collected together. This saves 1 allocation and decreases
-		// time/call by about 10% on the microbenchmark.
-		var state struct {
-			i    int
-			next UnaryHandler
-		}
-		state.next = func(ctx context.Context, req interface{}) (interface{}, error) {
-			if state.i == len(interceptors)-1 {
-				return interceptors[state.i](ctx, req, info, handler)
-			}
-			state.i++
-			return interceptors[state.i-1](ctx, req, info, state.next)
-		}
-		return state.next(ctx, req)
+		return interceptors[0](ctx, req, info, getChainUnaryHandler(interceptors, 0, info, handler))
+	}
+}
+
+func getChainUnaryHandler(interceptors []UnaryServerInterceptor, curr int, info *UnaryServerInfo, finalHandler UnaryHandler) UnaryHandler {
+	if curr == len(interceptors)-1 {
+		return finalHandler
+	}
+	return func(ctx context.Context, req interface{}) (interface{}, error) {
+		return interceptors[curr+1](ctx, req, info, getChainUnaryHandler(interceptors, curr+1, info, finalHandler))
 	}
 }
 
@@ -1256,7 +1268,7 @@ func (s *Server) processUnaryRPC(t transport.ServerTransport, stream *transport.
 			logEntry.PeerAddr = peer.Addr
 		}
 		for _, binlog := range binlogs {
-			binlog.Log(logEntry)
+			binlog.Log(ctx, logEntry)
 		}
 	}
 
@@ -1267,6 +1279,7 @@ func (s *Server) processUnaryRPC(t transport.ServerTransport, stream *transport.
 	var comp, decomp encoding.Compressor
 	var cp Compressor
 	var dc Decompressor
+	var sendCompressorName string
 
 	// If dc is set and matches the stream's compression, use it.  Otherwise, try
 	// to find a matching registered compressor for decomp.
@@ -1287,12 +1300,18 @@ func (s *Server) processUnaryRPC(t transport.ServerTransport, stream *transport.
 	// NOTE: this needs to be ahead of all handling, https://github.com/grpc/grpc-go/issues/686.
 	if s.opts.cp != nil {
 		cp = s.opts.cp
-		stream.SetSendCompress(cp.Type())
+		sendCompressorName = cp.Type()
 	} else if rc := stream.RecvCompress(); rc != "" && rc != encoding.Identity {
 		// Legacy compressor not specified; attempt to respond with same encoding.
 		comp = encoding.GetCompressor(rc)
 		if comp != nil {
-			stream.SetSendCompress(rc)
+			sendCompressorName = comp.Name()
+		}
+	}
+
+	if sendCompressorName != "" {
+		if err := stream.SetSendCompress(sendCompressorName); err != nil {
+			return status.Errorf(codes.Internal, "grpc: failed to set send compressor: %v", err)
 		}
 	}
 
@@ -1300,10 +1319,10 @@ func (s *Server) processUnaryRPC(t transport.ServerTransport, stream *transport.
 	if len(shs) != 0 || len(binlogs) != 0 {
 		payInfo = &payloadInfo{}
 	}
-	d, err := recvAndDecompress(&parser{r: stream}, stream, dc, s.opts.maxReceiveMessageSize, payInfo, decomp)
+	d, err := recvAndDecompress(&parser{r: stream, recvBufferPool: s.opts.recvBufferPool}, stream, dc, s.opts.maxReceiveMessageSize, payInfo, decomp)
 	if err != nil {
 		if e := t.WriteStatus(stream, status.Convert(err)); e != nil {
-			channelz.Warningf(logger, s.channelzID, "grpc: Server.processUnaryRPC failed to write status %v", e)
+			channelz.Warningf(logger, s.channelzID, "grpc: Server.processUnaryRPC failed to write status: %v", e)
 		}
 		return err
 	}
@@ -1316,11 +1335,12 @@ func (s *Server) processUnaryRPC(t transport.ServerTransport, stream *transport.
 		}
 		for _, sh := range shs {
 			sh.HandleRPC(stream.Context(), &stats.InPayload{
-				RecvTime:   time.Now(),
-				Payload:    v,
-				WireLength: payInfo.wireLength + headerLen,
-				Data:       d,
-				Length:     len(d),
+				RecvTime:         time.Now(),
+				Payload:          v,
+				Length:           len(d),
+				WireLength:       payInfo.compressedLength + headerLen,
+				CompressedLength: payInfo.compressedLength,
+				Data:             d,
 			})
 		}
 		if len(binlogs) != 0 {
@@ -1328,7 +1348,7 @@ func (s *Server) processUnaryRPC(t transport.ServerTransport, stream *transport.
 				Message: d,
 			}
 			for _, binlog := range binlogs {
-				binlog.Log(cm)
+				binlog.Log(stream.Context(), cm)
 			}
 		}
 		if trInfo != nil {
@@ -1361,7 +1381,7 @@ func (s *Server) processUnaryRPC(t transport.ServerTransport, stream *transport.
 					Header: h,
 				}
 				for _, binlog := range binlogs {
-					binlog.Log(sh)
+					binlog.Log(stream.Context(), sh)
 				}
 			}
 			st := &binarylog.ServerTrailer{
@@ -1369,7 +1389,7 @@ func (s *Server) processUnaryRPC(t transport.ServerTransport, stream *transport.
 				Err:     appErr,
 			}
 			for _, binlog := range binlogs {
-				binlog.Log(st)
+				binlog.Log(stream.Context(), st)
 			}
 		}
 		return appErr
@@ -1379,6 +1399,11 @@ func (s *Server) processUnaryRPC(t transport.ServerTransport, stream *transport.
 	}
 	opts := &transport.Options{Last: true}
 
+	// Server handler could have set new compressor by calling SetSendCompressor.
+	// In case it is set, we need to use it for compressing outbound message.
+	if stream.SendCompress() != sendCompressorName {
+		comp = encoding.GetCompressor(stream.SendCompress())
+	}
 	if err := s.sendResponse(t, stream, reply, cp, opts, comp); err != nil {
 		if err == io.EOF {
 			// The entire stream is done (for unary RPC only).
@@ -1406,8 +1431,8 @@ func (s *Server) processUnaryRPC(t transport.ServerTransport, stream *transport.
 				Err:     appErr,
 			}
 			for _, binlog := range binlogs {
-				binlog.Log(sh)
-				binlog.Log(st)
+				binlog.Log(stream.Context(), sh)
+				binlog.Log(stream.Context(), st)
 			}
 		}
 		return err
@@ -1421,8 +1446,8 @@ func (s *Server) processUnaryRPC(t transport.ServerTransport, stream *transport.
 			Message: reply,
 		}
 		for _, binlog := range binlogs {
-			binlog.Log(sh)
-			binlog.Log(sm)
+			binlog.Log(stream.Context(), sh)
+			binlog.Log(stream.Context(), sm)
 		}
 	}
 	if channelz.IsOn() {
@@ -1434,17 +1459,16 @@ func (s *Server) processUnaryRPC(t transport.ServerTransport, stream *transport.
 	// TODO: Should we be logging if writing status failed here, like above?
 	// Should the logging be in WriteStatus?  Should we ignore the WriteStatus
 	// error or allow the stats handler to see it?
-	err = t.WriteStatus(stream, statusOK)
 	if len(binlogs) != 0 {
 		st := &binarylog.ServerTrailer{
 			Trailer: stream.Trailer(),
 			Err:     appErr,
 		}
 		for _, binlog := range binlogs {
-			binlog.Log(st)
+			binlog.Log(stream.Context(), st)
 		}
 	}
-	return err
+	return t.WriteStatus(stream, statusOK)
 }
 
 // chainStreamServerInterceptors chains all stream server interceptors into one.
@@ -1470,21 +1494,16 @@ func chainStreamServerInterceptors(s *Server) {
 
 func chainStreamInterceptors(interceptors []StreamServerInterceptor) StreamServerInterceptor {
 	return func(srv interface{}, ss ServerStream, info *StreamServerInfo, handler StreamHandler) error {
-		// the struct ensures the variables are allocated together, rather than separately, since we
-		// know they should be garbage collected together. This saves 1 allocation and decreases
-		// time/call by about 10% on the microbenchmark.
-		var state struct {
-			i    int
-			next StreamHandler
-		}
-		state.next = func(srv interface{}, ss ServerStream) error {
-			if state.i == len(interceptors)-1 {
-				return interceptors[state.i](srv, ss, info, handler)
-			}
-			state.i++
-			return interceptors[state.i-1](srv, ss, info, state.next)
-		}
-		return state.next(srv, ss)
+		return interceptors[0](srv, ss, info, getChainStreamHandler(interceptors, 0, info, handler))
+	}
+}
+
+func getChainStreamHandler(interceptors []StreamServerInterceptor, curr int, info *StreamServerInfo, finalHandler StreamHandler) StreamHandler {
+	if curr == len(interceptors)-1 {
+		return finalHandler
+	}
+	return func(srv interface{}, stream ServerStream) error {
+		return interceptors[curr+1](srv, stream, info, getChainStreamHandler(interceptors, curr+1, info, finalHandler))
 	}
 }
 
@@ -1510,7 +1529,7 @@ func (s *Server) processStreamingRPC(t transport.ServerTransport, stream *transp
 		ctx:                   ctx,
 		t:                     t,
 		s:                     stream,
-		p:                     &parser{r: stream},
+		p:                     &parser{r: stream, recvBufferPool: s.opts.recvBufferPool},
 		codec:                 s.getCodec(stream.ContentSubtype()),
 		maxReceiveMessageSize: s.opts.maxReceiveMessageSize,
 		maxSendMessageSize:    s.opts.maxSendMessageSize,
@@ -1583,7 +1602,7 @@ func (s *Server) processStreamingRPC(t transport.ServerTransport, stream *transp
 			logEntry.PeerAddr = peer.Addr
 		}
 		for _, binlog := range ss.binlogs {
-			binlog.Log(logEntry)
+			binlog.Log(stream.Context(), logEntry)
 		}
 	}
 
@@ -1606,12 +1625,18 @@ func (s *Server) processStreamingRPC(t transport.ServerTransport, stream *transp
 	// NOTE: this needs to be ahead of all handling, https://github.com/grpc/grpc-go/issues/686.
 	if s.opts.cp != nil {
 		ss.cp = s.opts.cp
-		stream.SetSendCompress(s.opts.cp.Type())
+		ss.sendCompressorName = s.opts.cp.Type()
 	} else if rc := stream.RecvCompress(); rc != "" && rc != encoding.Identity {
 		// Legacy compressor not specified; attempt to respond with same encoding.
 		ss.comp = encoding.GetCompressor(rc)
 		if ss.comp != nil {
-			stream.SetSendCompress(rc)
+			ss.sendCompressorName = rc
+		}
+	}
+
+	if ss.sendCompressorName != "" {
+		if err := stream.SetSendCompress(ss.sendCompressorName); err != nil {
+			return status.Errorf(codes.Internal, "grpc: failed to set send compressor: %v", err)
 		}
 	}
 
@@ -1649,16 +1674,16 @@ func (s *Server) processStreamingRPC(t transport.ServerTransport, stream *transp
 			ss.trInfo.tr.SetError()
 			ss.mu.Unlock()
 		}
-		t.WriteStatus(ss.s, appStatus)
 		if len(ss.binlogs) != 0 {
 			st := &binarylog.ServerTrailer{
 				Trailer: ss.s.Trailer(),
 				Err:     appErr,
 			}
 			for _, binlog := range ss.binlogs {
-				binlog.Log(st)
+				binlog.Log(stream.Context(), st)
 			}
 		}
+		t.WriteStatus(ss.s, appStatus)
 		// TODO: Should we log an error from WriteStatus here and below?
 		return appErr
 	}
@@ -1667,17 +1692,16 @@ func (s *Server) processStreamingRPC(t transport.ServerTransport, stream *transp
 		ss.trInfo.tr.LazyLog(stringer("OK"), false)
 		ss.mu.Unlock()
 	}
-	err = t.WriteStatus(ss.s, statusOK)
 	if len(ss.binlogs) != 0 {
 		st := &binarylog.ServerTrailer{
 			Trailer: ss.s.Trailer(),
 			Err:     appErr,
 		}
 		for _, binlog := range ss.binlogs {
-			binlog.Log(st)
+			binlog.Log(stream.Context(), st)
 		}
 	}
-	return err
+	return t.WriteStatus(ss.s, statusOK)
 }
 
 func (s *Server) handleStream(t transport.ServerTransport, stream *transport.Stream, trInfo *traceInfo) {
@@ -1819,7 +1843,7 @@ func (s *Server) Stop() {
 	}
 	for _, cs := range conns {
 		for st := range cs {
-			st.Close()
+			st.Close(errors.New("Server.Stop called"))
 		}
 	}
 	if s.opts.numServerWorkers > 0 {
@@ -1855,7 +1879,7 @@ func (s *Server) GracefulStop() {
 	if !s.drain {
 		for _, conns := range s.conns {
 			for st := range conns {
-				st.Drain()
+				st.Drain("graceful_stop")
 			}
 		}
 		s.drain = true
@@ -1944,6 +1968,60 @@ func SendHeader(ctx context.Context, md metadata.MD) error {
 	return nil
 }
 
+// SetSendCompressor sets a compressor for outbound messages from the server.
+// It must not be called after any event that causes headers to be sent
+// (see ServerStream.SetHeader for the complete list). Provided compressor is
+// used when below conditions are met:
+//
+//   - compressor is registered via encoding.RegisterCompressor
+//   - compressor name must exist in the client advertised compressor names
+//     sent in grpc-accept-encoding header. Use ClientSupportedCompressors to
+//     get client supported compressor names.
+//
+// The context provided must be the context passed to the server's handler.
+// It must be noted that compressor name encoding.Identity disables the
+// outbound compression.
+// By default, server messages will be sent using the same compressor with
+// which request messages were sent.
+//
+// It is not safe to call SetSendCompressor concurrently with SendHeader and
+// SendMsg.
+//
+// # Experimental
+//
+// Notice: This function is EXPERIMENTAL and may be changed or removed in a
+// later release.
+func SetSendCompressor(ctx context.Context, name string) error {
+	stream, ok := ServerTransportStreamFromContext(ctx).(*transport.Stream)
+	if !ok || stream == nil {
+		return fmt.Errorf("failed to fetch the stream from the given context")
+	}
+
+	if err := validateSendCompressor(name, stream.ClientAdvertisedCompressors()); err != nil {
+		return fmt.Errorf("unable to set send compressor: %w", err)
+	}
+
+	return stream.SetSendCompress(name)
+}
+
+// ClientSupportedCompressors returns compressor names advertised by the client
+// via grpc-accept-encoding header.
+//
+// The context provided must be the context passed to the server's handler.
+//
+// # Experimental
+//
+// Notice: This function is EXPERIMENTAL and may be changed or removed in a
+// later release.
+func ClientSupportedCompressors(ctx context.Context) ([]string, error) {
+	stream, ok := ServerTransportStreamFromContext(ctx).(*transport.Stream)
+	if !ok || stream == nil {
+		return nil, fmt.Errorf("failed to fetch the stream from the given context %v", ctx)
+	}
+
+	return strings.Split(stream.ClientAdvertisedCompressors(), ","), nil
+}
+
 // SetTrailer sets the trailer metadata that will be sent when an RPC returns.
 // When called more than once, all the provided metadata will be merged.
 //
@@ -1978,3 +2056,22 @@ type channelzServer struct {
 func (c *channelzServer) ChannelzMetric() *channelz.ServerInternalMetric {
 	return c.s.channelzMetric()
 }
+
+// validateSendCompressor returns an error when given compressor name cannot be
+// handled by the server or the client based on the advertised compressors.
+func validateSendCompressor(name, clientCompressors string) error {
+	if name == encoding.Identity {
+		return nil
+	}
+
+	if !grpcutil.IsCompressorNameRegistered(name) {
+		return fmt.Errorf("compressor not registered %q", name)
+	}
+
+	for _, c := range strings.Split(clientCompressors, ",") {
+		if c == name {
+			return nil // found match
+		}
+	}
+	return fmt.Errorf("client does not support compressor %q", name)
+}
diff --git a/.ci/providerlint/vendor/google.golang.org/grpc/service_config.go b/.ci/providerlint/vendor/google.golang.org/grpc/service_config.go
index 01bbb2025ae..0df11fc0988 100644
--- a/.ci/providerlint/vendor/google.golang.org/grpc/service_config.go
+++ b/.ci/providerlint/vendor/google.golang.org/grpc/service_config.go
@@ -23,8 +23,6 @@ import (
 	"errors"
 	"fmt"
 	"reflect"
-	"strconv"
-	"strings"
 	"time"
 
 	"google.golang.org/grpc/codes"
@@ -106,8 +104,8 @@ type healthCheckConfig struct {
 
 type jsonRetryPolicy struct {
 	MaxAttempts          int
-	InitialBackoff       string
-	MaxBackoff           string
+	InitialBackoff       internalserviceconfig.Duration
+	MaxBackoff           internalserviceconfig.Duration
 	BackoffMultiplier    float64
 	RetryableStatusCodes []codes.Code
 }
@@ -129,50 +127,6 @@ type retryThrottlingPolicy struct {
 	TokenRatio float64
 }
 
-func parseDuration(s *string) (*time.Duration, error) {
-	if s == nil {
-		return nil, nil
-	}
-	if !strings.HasSuffix(*s, "s") {
-		return nil, fmt.Errorf("malformed duration %q", *s)
-	}
-	ss := strings.SplitN((*s)[:len(*s)-1], ".", 3)
-	if len(ss) > 2 {
-		return nil, fmt.Errorf("malformed duration %q", *s)
-	}
-	// hasDigits is set if either the whole or fractional part of the number is
-	// present, since both are optional but one is required.
-	hasDigits := false
-	var d time.Duration
-	if len(ss[0]) > 0 {
-		i, err := strconv.ParseInt(ss[0], 10, 32)
-		if err != nil {
-			return nil, fmt.Errorf("malformed duration %q: %v", *s, err)
-		}
-		d = time.Duration(i) * time.Second
-		hasDigits = true
-	}
-	if len(ss) == 2 && len(ss[1]) > 0 {
-		if len(ss[1]) > 9 {
-			return nil, fmt.Errorf("malformed duration %q", *s)
-		}
-		f, err := strconv.ParseInt(ss[1], 10, 64)
-		if err != nil {
-			return nil, fmt.Errorf("malformed duration %q: %v", *s, err)
-		}
-		for i := 9; i > len(ss[1]); i-- {
-			f *= 10
-		}
-		d += time.Duration(f)
-		hasDigits = true
-	}
-	if !hasDigits {
-		return nil, fmt.Errorf("malformed duration %q", *s)
-	}
-
-	return &d, nil
-}
-
 type jsonName struct {
 	Service string
 	Method  string
@@ -201,7 +155,7 @@ func (j jsonName) generatePath() (string, error) {
 type jsonMC struct {
 	Name                    *[]jsonName
 	WaitForReady            *bool
-	Timeout                 *string
+	Timeout                 *internalserviceconfig.Duration
 	MaxRequestMessageBytes  *int64
 	MaxResponseMessageBytes *int64
 	RetryPolicy             *jsonRetryPolicy
@@ -226,7 +180,7 @@ func parseServiceConfig(js string) *serviceconfig.ParseResult {
 	var rsc jsonSC
 	err := json.Unmarshal([]byte(js), &rsc)
 	if err != nil {
-		logger.Warningf("grpc: parseServiceConfig error unmarshaling %s due to %v", js, err)
+		logger.Warningf("grpc: unmarshaling service config %s: %v", js, err)
 		return &serviceconfig.ParseResult{Err: err}
 	}
 	sc := ServiceConfig{
@@ -252,18 +206,13 @@ func parseServiceConfig(js string) *serviceconfig.ParseResult {
 		if m.Name == nil {
 			continue
 		}
-		d, err := parseDuration(m.Timeout)
-		if err != nil {
-			logger.Warningf("grpc: parseServiceConfig error unmarshaling %s due to %v", js, err)
-			return &serviceconfig.ParseResult{Err: err}
-		}
 
 		mc := MethodConfig{
 			WaitForReady: m.WaitForReady,
-			Timeout:      d,
+			Timeout:      (*time.Duration)(m.Timeout),
 		}
 		if mc.RetryPolicy, err = convertRetryPolicy(m.RetryPolicy); err != nil {
-			logger.Warningf("grpc: parseServiceConfig error unmarshaling %s due to %v", js, err)
+			logger.Warningf("grpc: unmarshaling service config %s: %v", js, err)
 			return &serviceconfig.ParseResult{Err: err}
 		}
 		if m.MaxRequestMessageBytes != nil {
@@ -283,13 +232,13 @@ func parseServiceConfig(js string) *serviceconfig.ParseResult {
 		for i, n := range *m.Name {
 			path, err := n.generatePath()
 			if err != nil {
-				logger.Warningf("grpc: parseServiceConfig error unmarshaling %s due to methodConfig[%d]: %v", js, i, err)
+				logger.Warningf("grpc: error unmarshaling service config %s due to methodConfig[%d]: %v", js, i, err)
 				return &serviceconfig.ParseResult{Err: err}
 			}
 
 			if _, ok := paths[path]; ok {
 				err = errDuplicatedName
-				logger.Warningf("grpc: parseServiceConfig error unmarshaling %s due to methodConfig[%d]: %v", js, i, err)
+				logger.Warningf("grpc: error unmarshaling service config %s due to methodConfig[%d]: %v", js, i, err)
 				return &serviceconfig.ParseResult{Err: err}
 			}
 			paths[path] = struct{}{}
@@ -312,18 +261,10 @@ func convertRetryPolicy(jrp *jsonRetryPolicy) (p *internalserviceconfig.RetryPol
 	if jrp == nil {
 		return nil, nil
 	}
-	ib, err := parseDuration(&jrp.InitialBackoff)
-	if err != nil {
-		return nil, err
-	}
-	mb, err := parseDuration(&jrp.MaxBackoff)
-	if err != nil {
-		return nil, err
-	}
 
 	if jrp.MaxAttempts <= 1 ||
-		*ib <= 0 ||
-		*mb <= 0 ||
+		jrp.InitialBackoff <= 0 ||
+		jrp.MaxBackoff <= 0 ||
 		jrp.BackoffMultiplier <= 0 ||
 		len(jrp.RetryableStatusCodes) == 0 {
 		logger.Warningf("grpc: ignoring retry policy %v due to illegal configuration", jrp)
@@ -332,8 +273,8 @@ func convertRetryPolicy(jrp *jsonRetryPolicy) (p *internalserviceconfig.RetryPol
 
 	rp := &internalserviceconfig.RetryPolicy{
 		MaxAttempts:          jrp.MaxAttempts,
-		InitialBackoff:       *ib,
-		MaxBackoff:           *mb,
+		InitialBackoff:       time.Duration(jrp.InitialBackoff),
+		MaxBackoff:           time.Duration(jrp.MaxBackoff),
 		BackoffMultiplier:    jrp.BackoffMultiplier,
 		RetryableStatusCodes: make(map[codes.Code]bool),
 	}
diff --git a/.ci/providerlint/vendor/google.golang.org/grpc/shared_buffer_pool.go b/.ci/providerlint/vendor/google.golang.org/grpc/shared_buffer_pool.go
new file mode 100644
index 00000000000..c3a5a9ac1f1
--- /dev/null
+++ b/.ci/providerlint/vendor/google.golang.org/grpc/shared_buffer_pool.go
@@ -0,0 +1,154 @@
+/*
+ *
+ * Copyright 2023 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package grpc
+
+import "sync"
+
+// SharedBufferPool is a pool of buffers that can be shared, resulting in
+// decreased memory allocation. Currently, in gRPC-go, it is only utilized
+// for parsing incoming messages.
+//
+// # Experimental
+//
+// Notice: This API is EXPERIMENTAL and may be changed or removed in a
+// later release.
+type SharedBufferPool interface {
+	// Get returns a buffer with specified length from the pool.
+	//
+	// The returned byte slice may be not zero initialized.
+	Get(length int) []byte
+
+	// Put returns a buffer to the pool.
+	Put(*[]byte)
+}
+
+// NewSharedBufferPool creates a simple SharedBufferPool with buckets
+// of different sizes to optimize memory usage. This prevents the pool from
+// wasting large amounts of memory, even when handling messages of varying sizes.
+//
+// # Experimental
+//
+// Notice: This API is EXPERIMENTAL and may be changed or removed in a
+// later release.
+func NewSharedBufferPool() SharedBufferPool {
+	return &simpleSharedBufferPool{
+		pools: [poolArraySize]simpleSharedBufferChildPool{
+			newBytesPool(level0PoolMaxSize),
+			newBytesPool(level1PoolMaxSize),
+			newBytesPool(level2PoolMaxSize),
+			newBytesPool(level3PoolMaxSize),
+			newBytesPool(level4PoolMaxSize),
+			newBytesPool(0),
+		},
+	}
+}
+
+// simpleSharedBufferPool is a simple implementation of SharedBufferPool.
+type simpleSharedBufferPool struct {
+	pools [poolArraySize]simpleSharedBufferChildPool
+}
+
+func (p *simpleSharedBufferPool) Get(size int) []byte {
+	return p.pools[p.poolIdx(size)].Get(size)
+}
+
+func (p *simpleSharedBufferPool) Put(bs *[]byte) {
+	p.pools[p.poolIdx(cap(*bs))].Put(bs)
+}
+
+func (p *simpleSharedBufferPool) poolIdx(size int) int {
+	switch {
+	case size <= level0PoolMaxSize:
+		return level0PoolIdx
+	case size <= level1PoolMaxSize:
+		return level1PoolIdx
+	case size <= level2PoolMaxSize:
+		return level2PoolIdx
+	case size <= level3PoolMaxSize:
+		return level3PoolIdx
+	case size <= level4PoolMaxSize:
+		return level4PoolIdx
+	default:
+		return levelMaxPoolIdx
+	}
+}
+
+const (
+	level0PoolMaxSize = 16                     //  16  B
+	level1PoolMaxSize = level0PoolMaxSize * 16 // 256  B
+	level2PoolMaxSize = level1PoolMaxSize * 16 //   4 KB
+	level3PoolMaxSize = level2PoolMaxSize * 16 //  64 KB
+	level4PoolMaxSize = level3PoolMaxSize * 16 //   1 MB
+)
+
+const (
+	level0PoolIdx = iota
+	level1PoolIdx
+	level2PoolIdx
+	level3PoolIdx
+	level4PoolIdx
+	levelMaxPoolIdx
+	poolArraySize
+)
+
+type simpleSharedBufferChildPool interface {
+	Get(size int) []byte
+	Put(interface{})
+}
+
+type bufferPool struct {
+	sync.Pool
+
+	defaultSize int
+}
+
+func (p *bufferPool) Get(size int) []byte {
+	bs := p.Pool.Get().(*[]byte)
+
+	if cap(*bs) < size {
+		p.Pool.Put(bs)
+
+		return make([]byte, size)
+	}
+
+	return (*bs)[:size]
+}
+
+func newBytesPool(size int) simpleSharedBufferChildPool {
+	return &bufferPool{
+		Pool: sync.Pool{
+			New: func() interface{} {
+				bs := make([]byte, size)
+				return &bs
+			},
+		},
+		defaultSize: size,
+	}
+}
+
+// nopBufferPool is a buffer pool just makes new buffer without pooling.
+type nopBufferPool struct {
+}
+
+func (nopBufferPool) Get(length int) []byte {
+	return make([]byte, length)
+}
+
+func (nopBufferPool) Put(*[]byte) {
+}
diff --git a/.ci/providerlint/vendor/google.golang.org/grpc/stats/stats.go b/.ci/providerlint/vendor/google.golang.org/grpc/stats/stats.go
index 0285dcc6a26..7a552a9b787 100644
--- a/.ci/providerlint/vendor/google.golang.org/grpc/stats/stats.go
+++ b/.ci/providerlint/vendor/google.golang.org/grpc/stats/stats.go
@@ -67,10 +67,18 @@ type InPayload struct {
 	Payload interface{}
 	// Data is the serialized message payload.
 	Data []byte
-	// Length is the length of uncompressed data.
+
+	// Length is the size of the uncompressed payload data. Does not include any
+	// framing (gRPC or HTTP/2).
 	Length int
-	// WireLength is the length of data on wire (compressed, signed, encrypted).
+	// CompressedLength is the size of the compressed payload data. Does not
+	// include any framing (gRPC or HTTP/2). Same as Length if compression not
+	// enabled.
+	CompressedLength int
+	// WireLength is the size of the compressed payload data plus gRPC framing.
+	// Does not include HTTP/2 framing.
 	WireLength int
+
 	// RecvTime is the time when the payload is received.
 	RecvTime time.Time
 }
@@ -129,9 +137,15 @@ type OutPayload struct {
 	Payload interface{}
 	// Data is the serialized message payload.
 	Data []byte
-	// Length is the length of uncompressed data.
+	// Length is the size of the uncompressed payload data. Does not include any
+	// framing (gRPC or HTTP/2).
 	Length int
-	// WireLength is the length of data on wire (compressed, signed, encrypted).
+	// CompressedLength is the size of the compressed payload data. Does not
+	// include any framing (gRPC or HTTP/2). Same as Length if compression not
+	// enabled.
+	CompressedLength int
+	// WireLength is the size of the compressed payload data plus gRPC framing.
+	// Does not include HTTP/2 framing.
 	WireLength int
 	// SentTime is the time when the payload is sent.
 	SentTime time.Time
diff --git a/.ci/providerlint/vendor/google.golang.org/grpc/status/status.go b/.ci/providerlint/vendor/google.golang.org/grpc/status/status.go
index 623be39f26b..bcf2e4d81be 100644
--- a/.ci/providerlint/vendor/google.golang.org/grpc/status/status.go
+++ b/.ci/providerlint/vendor/google.golang.org/grpc/status/status.go
@@ -77,9 +77,18 @@ func FromProto(s *spb.Status) *Status {
 // FromError returns a Status representation of err.
 //
 //   - If err was produced by this package or implements the method `GRPCStatus()
-//     *Status`, the appropriate Status is returned.
+//     *Status` and `GRPCStatus()` does not return nil, or if err wraps a type
+//     satisfying this, the Status from `GRPCStatus()` is returned.  For wrapped
+//     errors, the message returned contains the entire err.Error() text and not
+//     just the wrapped status. In that case, ok is true.
 //
-//   - If err is nil, a Status is returned with codes.OK and no message.
+//   - If err is nil, a Status is returned with codes.OK and no message, and ok
+//     is true.
+//
+//   - If err implements the method `GRPCStatus() *Status` and `GRPCStatus()`
+//     returns nil (which maps to Codes.OK), or if err wraps a type
+//     satisfying this, a Status is returned with codes.Unknown and err's
+//     Error() message, and ok is false.
 //
 //   - Otherwise, err is an error not compatible with this package.  In this
 //     case, a Status is returned with codes.Unknown and err's Error() message,
@@ -88,10 +97,29 @@ func FromError(err error) (s *Status, ok bool) {
 	if err == nil {
 		return nil, true
 	}
-	if se, ok := err.(interface {
-		GRPCStatus() *Status
-	}); ok {
-		return se.GRPCStatus(), true
+	type grpcstatus interface{ GRPCStatus() *Status }
+	if gs, ok := err.(grpcstatus); ok {
+		if gs.GRPCStatus() == nil {
+			// Error has status nil, which maps to codes.OK. There
+			// is no sensible behavior for this, so we turn it into
+			// an error with codes.Unknown and discard the existing
+			// status.
+			return New(codes.Unknown, err.Error()), false
+		}
+		return gs.GRPCStatus(), true
+	}
+	var gs grpcstatus
+	if errors.As(err, &gs) {
+		if gs.GRPCStatus() == nil {
+			// Error wraps an error that has status nil, which maps
+			// to codes.OK.  There is no sensible behavior for this,
+			// so we turn it into an error with codes.Unknown and
+			// discard the existing status.
+			return New(codes.Unknown, err.Error()), false
+		}
+		p := gs.GRPCStatus().Proto()
+		p.Message = err.Error()
+		return status.FromProto(p), true
 	}
 	return New(codes.Unknown, err.Error()), false
 }
@@ -103,19 +131,16 @@ func Convert(err error) *Status {
 	return s
 }
 
-// Code returns the Code of the error if it is a Status error, codes.OK if err
-// is nil, or codes.Unknown otherwise.
+// Code returns the Code of the error if it is a Status error or if it wraps a
+// Status error. If that is not the case, it returns codes.OK if err is nil, or
+// codes.Unknown otherwise.
 func Code(err error) codes.Code {
 	// Don't use FromError to avoid allocation of OK status.
 	if err == nil {
 		return codes.OK
 	}
-	if se, ok := err.(interface {
-		GRPCStatus() *Status
-	}); ok {
-		return se.GRPCStatus().Code()
-	}
-	return codes.Unknown
+
+	return Convert(err).Code()
 }
 
 // FromContextError converts a context error or wrapped context error into a
diff --git a/.ci/providerlint/vendor/google.golang.org/grpc/stream.go b/.ci/providerlint/vendor/google.golang.org/grpc/stream.go
index 960c3e33dfd..de32a759714 100644
--- a/.ci/providerlint/vendor/google.golang.org/grpc/stream.go
+++ b/.ci/providerlint/vendor/google.golang.org/grpc/stream.go
@@ -123,6 +123,9 @@ type ClientStream interface {
 	// calling RecvMsg on the same stream at the same time, but it is not safe
 	// to call SendMsg on the same stream in different goroutines. It is also
 	// not safe to call CloseSend concurrently with SendMsg.
+	//
+	// It is not safe to modify the message after calling SendMsg. Tracing
+	// libraries and stats handlers may use the message lazily.
 	SendMsg(m interface{}) error
 	// RecvMsg blocks until it receives a message into m or the stream is
 	// done. It returns io.EOF when the stream completes successfully. On
@@ -152,6 +155,11 @@ type ClientStream interface {
 // If none of the above happen, a goroutine and a context will be leaked, and grpc
 // will not call the optionally-configured stats handler with a stats.End message.
 func (cc *ClientConn) NewStream(ctx context.Context, desc *StreamDesc, method string, opts ...CallOption) (ClientStream, error) {
+	if err := cc.idlenessMgr.onCallBegin(); err != nil {
+		return nil, err
+	}
+	defer cc.idlenessMgr.onCallEnd()
+
 	// allow interceptor to see all applicable call options, which means those
 	// configured as defaults from dial option as well as per-call options
 	opts = combine(cc.dopts.callOptions, opts)
@@ -168,10 +176,19 @@ func NewClientStream(ctx context.Context, desc *StreamDesc, cc *ClientConn, meth
 }
 
 func newClientStream(ctx context.Context, desc *StreamDesc, cc *ClientConn, method string, opts ...CallOption) (_ ClientStream, err error) {
-	if md, _, ok := metadata.FromOutgoingContextRaw(ctx); ok {
+	if md, added, ok := metadata.FromOutgoingContextRaw(ctx); ok {
+		// validate md
 		if err := imetadata.Validate(md); err != nil {
 			return nil, status.Error(codes.Internal, err.Error())
 		}
+		// validate added
+		for _, kvs := range added {
+			for i := 0; i < len(kvs); i += 2 {
+				if err := imetadata.ValidatePair(kvs[i], kvs[i+1]); err != nil {
+					return nil, status.Error(codes.Internal, err.Error())
+				}
+			}
+		}
 	}
 	if channelz.IsOn() {
 		cc.incrCallsStarted()
@@ -352,7 +369,7 @@ func newClientStreamWithParams(ctx context.Context, desc *StreamDesc, cc *Client
 			}
 		}
 		for _, binlog := range cs.binlogs {
-			binlog.Log(logEntry)
+			binlog.Log(cs.ctx, logEntry)
 		}
 	}
 
@@ -416,7 +433,7 @@ func (cs *clientStream) newAttemptLocked(isTransparent bool) (*csAttempt, error)
 		ctx = trace.NewContext(ctx, trInfo.tr)
 	}
 
-	if cs.cc.parsedTarget.Scheme == "xds" {
+	if cs.cc.parsedTarget.URL.Scheme == "xds" {
 		// Add extra metadata (metadata that will be added by transport) to context
 		// so the balancer can see them.
 		ctx = grpcutil.WithExtraMetadata(ctx, metadata.Pairs(
@@ -438,7 +455,7 @@ func (a *csAttempt) getTransport() error {
 	cs := a.cs
 
 	var err error
-	a.t, a.done, err = cs.cc.getTransport(a.ctx, cs.callInfo.failFast, cs.callHdr.Method)
+	a.t, a.pickResult, err = cs.cc.getTransport(a.ctx, cs.callInfo.failFast, cs.callHdr.Method)
 	if err != nil {
 		if de, ok := err.(dropError); ok {
 			err = de.error
@@ -455,6 +472,25 @@ func (a *csAttempt) getTransport() error {
 func (a *csAttempt) newStream() error {
 	cs := a.cs
 	cs.callHdr.PreviousAttempts = cs.numRetries
+
+	// Merge metadata stored in PickResult, if any, with existing call metadata.
+	// It is safe to overwrite the csAttempt's context here, since all state
+	// maintained in it are local to the attempt. When the attempt has to be
+	// retried, a new instance of csAttempt will be created.
+	if a.pickResult.Metadata != nil {
+		// We currently do not have a function it the metadata package which
+		// merges given metadata with existing metadata in a context. Existing
+		// function `AppendToOutgoingContext()` takes a variadic argument of key
+		// value pairs.
+		//
+		// TODO: Make it possible to retrieve key value pairs from metadata.MD
+		// in a form passable to AppendToOutgoingContext(), or create a version
+		// of AppendToOutgoingContext() that accepts a metadata.MD.
+		md, _ := metadata.FromOutgoingContext(a.ctx)
+		md = metadata.Join(md, a.pickResult.Metadata)
+		a.ctx = metadata.NewOutgoingContext(a.ctx, md)
+	}
+
 	s, err := a.t.NewStream(a.ctx, cs.callHdr)
 	if err != nil {
 		nse, ok := err.(*transport.NewStreamError)
@@ -471,7 +507,7 @@ func (a *csAttempt) newStream() error {
 		return toRPCErr(nse.Err)
 	}
 	a.s = s
-	a.p = &parser{r: s}
+	a.p = &parser{r: s, recvBufferPool: a.cs.cc.dopts.recvBufferPool}
 	return nil
 }
 
@@ -529,12 +565,12 @@ type clientStream struct {
 // csAttempt implements a single transport stream attempt within a
 // clientStream.
 type csAttempt struct {
-	ctx  context.Context
-	cs   *clientStream
-	t    transport.ClientTransport
-	s    *transport.Stream
-	p    *parser
-	done func(balancer.DoneInfo)
+	ctx        context.Context
+	cs         *clientStream
+	t          transport.ClientTransport
+	s          *transport.Stream
+	p          *parser
+	pickResult balancer.PickResult
 
 	finished  bool
 	dc        Decompressor
@@ -781,7 +817,7 @@ func (cs *clientStream) Header() (metadata.MD, error) {
 		}
 		cs.serverHeaderBinlogged = true
 		for _, binlog := range cs.binlogs {
-			binlog.Log(logEntry)
+			binlog.Log(cs.ctx, logEntry)
 		}
 	}
 	return m, nil
@@ -862,7 +898,7 @@ func (cs *clientStream) SendMsg(m interface{}) (err error) {
 			Message:      data,
 		}
 		for _, binlog := range cs.binlogs {
-			binlog.Log(cm)
+			binlog.Log(cs.ctx, cm)
 		}
 	}
 	return err
@@ -886,7 +922,7 @@ func (cs *clientStream) RecvMsg(m interface{}) error {
 			Message:      recvInfo.uncompressedBytes,
 		}
 		for _, binlog := range cs.binlogs {
-			binlog.Log(sm)
+			binlog.Log(cs.ctx, sm)
 		}
 	}
 	if err != nil || !cs.desc.ServerStreams {
@@ -907,7 +943,7 @@ func (cs *clientStream) RecvMsg(m interface{}) error {
 				logEntry.PeerAddr = peer.Addr
 			}
 			for _, binlog := range cs.binlogs {
-				binlog.Log(logEntry)
+				binlog.Log(cs.ctx, logEntry)
 			}
 		}
 	}
@@ -934,7 +970,7 @@ func (cs *clientStream) CloseSend() error {
 			OnClientSide: true,
 		}
 		for _, binlog := range cs.binlogs {
-			binlog.Log(chc)
+			binlog.Log(cs.ctx, chc)
 		}
 	}
 	// We never returned an error here for reasons.
@@ -952,6 +988,9 @@ func (cs *clientStream) finish(err error) {
 		return
 	}
 	cs.finished = true
+	for _, onFinish := range cs.callInfo.onFinish {
+		onFinish(err)
+	}
 	cs.commitAttemptLocked()
 	if cs.attempt != nil {
 		cs.attempt.finish(err)
@@ -973,7 +1012,7 @@ func (cs *clientStream) finish(err error) {
 			OnClientSide: true,
 		}
 		for _, binlog := range cs.binlogs {
-			binlog.Log(c)
+			binlog.Log(cs.ctx, c)
 		}
 	}
 	if err == nil {
@@ -1062,9 +1101,10 @@ func (a *csAttempt) recvMsg(m interface{}, payInfo *payloadInfo) (err error) {
 			RecvTime: time.Now(),
 			Payload:  m,
 			// TODO truncate large payload.
-			Data:       payInfo.uncompressedBytes,
-			WireLength: payInfo.wireLength + headerLen,
-			Length:     len(payInfo.uncompressedBytes),
+			Data:             payInfo.uncompressedBytes,
+			WireLength:       payInfo.compressedLength + headerLen,
+			CompressedLength: payInfo.compressedLength,
+			Length:           len(payInfo.uncompressedBytes),
 		})
 	}
 	if channelz.IsOn() {
@@ -1103,12 +1143,12 @@ func (a *csAttempt) finish(err error) {
 		tr = a.s.Trailer()
 	}
 
-	if a.done != nil {
+	if a.pickResult.Done != nil {
 		br := false
 		if a.s != nil {
 			br = a.s.BytesReceived()
 		}
-		a.done(balancer.DoneInfo{
+		a.pickResult.Done(balancer.DoneInfo{
 			Err:           err,
 			Trailer:       tr,
 			BytesSent:     a.s != nil,
@@ -1230,17 +1270,22 @@ func newNonRetryClientStream(ctx context.Context, desc *StreamDesc, method strin
 		return nil, err
 	}
 	as.s = s
-	as.p = &parser{r: s}
+	as.p = &parser{r: s, recvBufferPool: ac.dopts.recvBufferPool}
 	ac.incrCallsStarted()
 	if desc != unaryStreamDesc {
-		// Listen on cc and stream contexts to cleanup when the user closes the
-		// ClientConn or cancels the stream context.  In all other cases, an error
-		// should already be injected into the recv buffer by the transport, which
-		// the client will eventually receive, and then we will cancel the stream's
-		// context in clientStream.finish.
+		// Listen on stream context to cleanup when the stream context is
+		// canceled.  Also listen for the addrConn's context in case the
+		// addrConn is closed or reconnects to a different address.  In all
+		// other cases, an error should already be injected into the recv
+		// buffer by the transport, which the client will eventually receive,
+		// and then we will cancel the stream's context in
+		// addrConnStream.finish.
 		go func() {
+			ac.mu.Lock()
+			acCtx := ac.ctx
+			ac.mu.Unlock()
 			select {
-			case <-ac.ctx.Done():
+			case <-acCtx.Done():
 				as.finish(status.Error(codes.Canceled, "grpc: the SubConn is closing"))
 			case <-ctx.Done():
 				as.finish(toRPCErr(ctx.Err()))
@@ -1464,6 +1509,9 @@ type ServerStream interface {
 	// It is safe to have a goroutine calling SendMsg and another goroutine
 	// calling RecvMsg on the same stream at the same time, but it is not safe
 	// to call SendMsg on the same stream in different goroutines.
+	//
+	// It is not safe to modify the message after calling SendMsg. Tracing
+	// libraries and stats handlers may use the message lazily.
 	SendMsg(m interface{}) error
 	// RecvMsg blocks until it receives a message into m or the stream is
 	// done. It returns io.EOF when the client has performed a CloseSend. On
@@ -1489,6 +1537,8 @@ type serverStream struct {
 	comp   encoding.Compressor
 	decomp encoding.Compressor
 
+	sendCompressorName string
+
 	maxReceiveMessageSize int
 	maxSendMessageSize    int
 	trInfo                *traceInfo
@@ -1536,7 +1586,7 @@ func (ss *serverStream) SendHeader(md metadata.MD) error {
 		}
 		ss.serverHeaderBinlogged = true
 		for _, binlog := range ss.binlogs {
-			binlog.Log(sh)
+			binlog.Log(ss.ctx, sh)
 		}
 	}
 	return err
@@ -1581,6 +1631,13 @@ func (ss *serverStream) SendMsg(m interface{}) (err error) {
 		}
 	}()
 
+	// Server handler could have set new compressor by calling SetSendCompressor.
+	// In case it is set, we need to use it for compressing outbound message.
+	if sendCompressorsName := ss.s.SendCompress(); sendCompressorsName != ss.sendCompressorName {
+		ss.comp = encoding.GetCompressor(sendCompressorsName)
+		ss.sendCompressorName = sendCompressorsName
+	}
+
 	// load hdr, payload, data
 	hdr, payload, data, err := prepareMsg(m, ss.codec, ss.cp, ss.comp)
 	if err != nil {
@@ -1602,14 +1659,14 @@ func (ss *serverStream) SendMsg(m interface{}) (err error) {
 			}
 			ss.serverHeaderBinlogged = true
 			for _, binlog := range ss.binlogs {
-				binlog.Log(sh)
+				binlog.Log(ss.ctx, sh)
 			}
 		}
 		sm := &binarylog.ServerMessage{
 			Message: data,
 		}
 		for _, binlog := range ss.binlogs {
-			binlog.Log(sm)
+			binlog.Log(ss.ctx, sm)
 		}
 	}
 	if len(ss.statsHandler) != 0 {
@@ -1657,7 +1714,7 @@ func (ss *serverStream) RecvMsg(m interface{}) (err error) {
 			if len(ss.binlogs) != 0 {
 				chc := &binarylog.ClientHalfClose{}
 				for _, binlog := range ss.binlogs {
-					binlog.Log(chc)
+					binlog.Log(ss.ctx, chc)
 				}
 			}
 			return err
@@ -1673,9 +1730,10 @@ func (ss *serverStream) RecvMsg(m interface{}) (err error) {
 				RecvTime: time.Now(),
 				Payload:  m,
 				// TODO truncate large payload.
-				Data:       payInfo.uncompressedBytes,
-				WireLength: payInfo.wireLength + headerLen,
-				Length:     len(payInfo.uncompressedBytes),
+				Data:             payInfo.uncompressedBytes,
+				Length:           len(payInfo.uncompressedBytes),
+				WireLength:       payInfo.compressedLength + headerLen,
+				CompressedLength: payInfo.compressedLength,
 			})
 		}
 	}
@@ -1684,7 +1742,7 @@ func (ss *serverStream) RecvMsg(m interface{}) (err error) {
 			Message: payInfo.uncompressedBytes,
 		}
 		for _, binlog := range ss.binlogs {
-			binlog.Log(cm)
+			binlog.Log(ss.ctx, cm)
 		}
 	}
 	return nil
diff --git a/.ci/providerlint/vendor/google.golang.org/grpc/version.go b/.ci/providerlint/vendor/google.golang.org/grpc/version.go
index 2198e7098d7..353cfd52862 100644
--- a/.ci/providerlint/vendor/google.golang.org/grpc/version.go
+++ b/.ci/providerlint/vendor/google.golang.org/grpc/version.go
@@ -19,4 +19,4 @@
 package grpc
 
 // Version is the current grpc version.
-const Version = "1.51.0"
+const Version = "1.57.0"
diff --git a/.ci/providerlint/vendor/google.golang.org/grpc/vet.sh b/.ci/providerlint/vendor/google.golang.org/grpc/vet.sh
index bd8e0cdb33c..a8e4732b3d2 100644
--- a/.ci/providerlint/vendor/google.golang.org/grpc/vet.sh
+++ b/.ci/providerlint/vendor/google.golang.org/grpc/vet.sh
@@ -41,16 +41,8 @@ if [[ "$1" = "-install" ]]; then
     github.com/client9/misspell/cmd/misspell
   popd
   if [[ -z "${VET_SKIP_PROTO}" ]]; then
-    if [[ "${TRAVIS}" = "true" ]]; then
-      PROTOBUF_VERSION=3.14.0
-      PROTOC_FILENAME=protoc-${PROTOBUF_VERSION}-linux-x86_64.zip
-      pushd /home/travis
-      wget https://github.com/google/protobuf/releases/download/v${PROTOBUF_VERSION}/${PROTOC_FILENAME}
-      unzip ${PROTOC_FILENAME}
-      bin/protoc --version
-      popd
-    elif [[ "${GITHUB_ACTIONS}" = "true" ]]; then
-      PROTOBUF_VERSION=3.14.0
+    if [[ "${GITHUB_ACTIONS}" = "true" ]]; then
+      PROTOBUF_VERSION=22.0 # a.k.a v4.22.0 in pb.go files.
       PROTOC_FILENAME=protoc-${PROTOBUF_VERSION}-linux-x86_64.zip
       pushd /home/runner/go
       wget https://github.com/google/protobuf/releases/download/v${PROTOBUF_VERSION}/${PROTOC_FILENAME}
@@ -66,6 +58,16 @@ elif [[ "$#" -ne 0 ]]; then
   die "Unknown argument(s): $*"
 fi
 
+# - Check that generated proto files are up to date.
+if [[ -z "${VET_SKIP_PROTO}" ]]; then
+  make proto && git status --porcelain 2>&1 | fail_on_output || \
+    (git status; git --no-pager diff; exit 1)
+fi
+
+if [[ -n "${VET_ONLY_PROTO}" ]]; then
+  exit 0
+fi
+
 # - Ensure all source files contain a copyright message.
 # (Done in two parts because Darwin "git grep" has broken support for compound
 # exclusion matches.)
@@ -93,13 +95,6 @@ git grep '"github.com/envoyproxy/go-control-plane/envoy' -- '*.go' ':(exclude)*.
 
 misspell -error .
 
-# - Check that generated proto files are up to date.
-if [[ -z "${VET_SKIP_PROTO}" ]]; then
-  PATH="/home/travis/bin:${PATH}" make proto && \
-    git status --porcelain 2>&1 | fail_on_output || \
-    (git status; git --no-pager diff; exit 1)
-fi
-
 # - gofmt, goimports, golint (with exceptions for generated code), go vet,
 # go mod tidy.
 # Perform these checks on each module inside gRPC.
@@ -111,7 +106,7 @@ for MOD_FILE in $(find . -name 'go.mod'); do
   goimports -l . 2>&1 | not grep -vE "\.pb\.go"
   golint ./... 2>&1 | not grep -vE "/grpc_testing_not_regenerate/.*\.pb\.go:"
 
-  go mod tidy
+  go mod tidy -compat=1.17
   git status --porcelain 2>&1 | fail_on_output || \
     (git status; git --no-pager diff; exit 1)
   popd
@@ -121,8 +116,9 @@ done
 #
 # TODO(dfawley): don't use deprecated functions in examples or first-party
 # plugins.
+# TODO(dfawley): enable ST1019 (duplicate imports) but allow for protobufs.
 SC_OUT="$(mktemp)"
-staticcheck -go 1.9 -checks 'inherit,-ST1015' ./... > "${SC_OUT}" || true
+staticcheck -go 1.19 -checks 'inherit,-ST1015,-ST1019,-SA1019' ./... > "${SC_OUT}" || true
 # Error if anything other than deprecation warnings are printed.
 not grep -v "is deprecated:.*SA1019" "${SC_OUT}"
 # Only ignore the following deprecated types/fields/functions.
diff --git a/.ci/providerlint/vendor/google.golang.org/protobuf/encoding/protojson/doc.go b/.ci/providerlint/vendor/google.golang.org/protobuf/encoding/protojson/doc.go
index 00ea2fecfb7..21d5d2cb18e 100644
--- a/.ci/providerlint/vendor/google.golang.org/protobuf/encoding/protojson/doc.go
+++ b/.ci/providerlint/vendor/google.golang.org/protobuf/encoding/protojson/doc.go
@@ -4,7 +4,7 @@
 
 // Package protojson marshals and unmarshals protocol buffer messages as JSON
 // format. It follows the guide at
-// https://developers.google.com/protocol-buffers/docs/proto3#json.
+// https://protobuf.dev/programming-guides/proto3#json.
 //
 // This package produces a different output than the standard "encoding/json"
 // package, which does not operate correctly on protocol buffer messages.
diff --git a/.ci/providerlint/vendor/google.golang.org/protobuf/encoding/protojson/encode.go b/.ci/providerlint/vendor/google.golang.org/protobuf/encoding/protojson/encode.go
index d09d22e139b..66b95870e97 100644
--- a/.ci/providerlint/vendor/google.golang.org/protobuf/encoding/protojson/encode.go
+++ b/.ci/providerlint/vendor/google.golang.org/protobuf/encoding/protojson/encode.go
@@ -106,13 +106,19 @@ func (o MarshalOptions) Format(m proto.Message) string {
 // MarshalOptions. Do not depend on the output being stable. It may change over
 // time across different versions of the program.
 func (o MarshalOptions) Marshal(m proto.Message) ([]byte, error) {
-	return o.marshal(m)
+	return o.marshal(nil, m)
+}
+
+// MarshalAppend appends the JSON format encoding of m to b,
+// returning the result.
+func (o MarshalOptions) MarshalAppend(b []byte, m proto.Message) ([]byte, error) {
+	return o.marshal(b, m)
 }
 
 // marshal is a centralized function that all marshal operations go through.
 // For profiling purposes, avoid changing the name of this function or
 // introducing other code paths for marshal that do not go through this.
-func (o MarshalOptions) marshal(m proto.Message) ([]byte, error) {
+func (o MarshalOptions) marshal(b []byte, m proto.Message) ([]byte, error) {
 	if o.Multiline && o.Indent == "" {
 		o.Indent = defaultIndent
 	}
@@ -120,7 +126,7 @@ func (o MarshalOptions) marshal(m proto.Message) ([]byte, error) {
 		o.Resolver = protoregistry.GlobalTypes
 	}
 
-	internalEnc, err := json.NewEncoder(o.Indent)
+	internalEnc, err := json.NewEncoder(b, o.Indent)
 	if err != nil {
 		return nil, err
 	}
@@ -128,7 +134,7 @@ func (o MarshalOptions) marshal(m proto.Message) ([]byte, error) {
 	// Treat nil message interface as an empty message,
 	// in which case the output in an empty JSON object.
 	if m == nil {
-		return []byte("{}"), nil
+		return append(b, '{', '}'), nil
 	}
 
 	enc := encoder{internalEnc, o}
diff --git a/.ci/providerlint/vendor/google.golang.org/protobuf/encoding/protojson/well_known_types.go b/.ci/providerlint/vendor/google.golang.org/protobuf/encoding/protojson/well_known_types.go
index c85f8469480..6c37d417449 100644
--- a/.ci/providerlint/vendor/google.golang.org/protobuf/encoding/protojson/well_known_types.go
+++ b/.ci/providerlint/vendor/google.golang.org/protobuf/encoding/protojson/well_known_types.go
@@ -814,16 +814,22 @@ func (d decoder) unmarshalTimestamp(m protoreflect.Message) error {
 		return d.unexpectedTokenError(tok)
 	}
 
-	t, err := time.Parse(time.RFC3339Nano, tok.ParsedString())
+	s := tok.ParsedString()
+	t, err := time.Parse(time.RFC3339Nano, s)
 	if err != nil {
 		return d.newError(tok.Pos(), "invalid %v value %v", genid.Timestamp_message_fullname, tok.RawString())
 	}
-	// Validate seconds. No need to validate nanos because time.Parse would have
-	// covered that already.
+	// Validate seconds.
 	secs := t.Unix()
 	if secs < minTimestampSeconds || secs > maxTimestampSeconds {
 		return d.newError(tok.Pos(), "%v value out of range: %v", genid.Timestamp_message_fullname, tok.RawString())
 	}
+	// Validate subseconds.
+	i := strings.LastIndexByte(s, '.')  // start of subsecond field
+	j := strings.LastIndexAny(s, "Z-+") // start of timezone field
+	if i >= 0 && j >= i && j-i > len(".999999999") {
+		return d.newError(tok.Pos(), "invalid %v value %v", genid.Timestamp_message_fullname, tok.RawString())
+	}
 
 	fds := m.Descriptor().Fields()
 	fdSeconds := fds.ByNumber(genid.Timestamp_Seconds_field_number)
diff --git a/.ci/providerlint/vendor/google.golang.org/protobuf/encoding/prototext/encode.go b/.ci/providerlint/vendor/google.golang.org/protobuf/encoding/prototext/encode.go
index ebf6c65284d..722a7b41df3 100644
--- a/.ci/providerlint/vendor/google.golang.org/protobuf/encoding/prototext/encode.go
+++ b/.ci/providerlint/vendor/google.golang.org/protobuf/encoding/prototext/encode.go
@@ -101,13 +101,19 @@ func (o MarshalOptions) Format(m proto.Message) string {
 // MarshalOptions object. Do not depend on the output being stable. It may
 // change over time across different versions of the program.
 func (o MarshalOptions) Marshal(m proto.Message) ([]byte, error) {
-	return o.marshal(m)
+	return o.marshal(nil, m)
+}
+
+// MarshalAppend appends the textproto format encoding of m to b,
+// returning the result.
+func (o MarshalOptions) MarshalAppend(b []byte, m proto.Message) ([]byte, error) {
+	return o.marshal(b, m)
 }
 
 // marshal is a centralized function that all marshal operations go through.
 // For profiling purposes, avoid changing the name of this function or
 // introducing other code paths for marshal that do not go through this.
-func (o MarshalOptions) marshal(m proto.Message) ([]byte, error) {
+func (o MarshalOptions) marshal(b []byte, m proto.Message) ([]byte, error) {
 	var delims = [2]byte{'{', '}'}
 
 	if o.Multiline && o.Indent == "" {
@@ -117,7 +123,7 @@ func (o MarshalOptions) marshal(m proto.Message) ([]byte, error) {
 		o.Resolver = protoregistry.GlobalTypes
 	}
 
-	internalEnc, err := text.NewEncoder(o.Indent, delims, o.EmitASCII)
+	internalEnc, err := text.NewEncoder(b, o.Indent, delims, o.EmitASCII)
 	if err != nil {
 		return nil, err
 	}
@@ -125,7 +131,7 @@ func (o MarshalOptions) marshal(m proto.Message) ([]byte, error) {
 	// Treat nil message interface as an empty message,
 	// in which case there is nothing to output.
 	if m == nil {
-		return []byte{}, nil
+		return b, nil
 	}
 
 	enc := encoder{internalEnc, o}
diff --git a/.ci/providerlint/vendor/google.golang.org/protobuf/encoding/protowire/wire.go b/.ci/providerlint/vendor/google.golang.org/protobuf/encoding/protowire/wire.go
index ce57f57ebd4..f4b4686cf9d 100644
--- a/.ci/providerlint/vendor/google.golang.org/protobuf/encoding/protowire/wire.go
+++ b/.ci/providerlint/vendor/google.golang.org/protobuf/encoding/protowire/wire.go
@@ -3,7 +3,7 @@
 // license that can be found in the LICENSE file.
 
 // Package protowire parses and formats the raw wire encoding.
-// See https://developers.google.com/protocol-buffers/docs/encoding.
+// See https://protobuf.dev/programming-guides/encoding.
 //
 // For marshaling and unmarshaling entire protobuf messages,
 // use the "google.golang.org/protobuf/proto" package instead.
@@ -29,12 +29,8 @@ const (
 )
 
 // IsValid reports whether the field number is semantically valid.
-//
-// Note that while numbers within the reserved range are semantically invalid,
-// they are syntactically valid in the wire format.
-// Implementations may treat records with reserved field numbers as unknown.
 func (n Number) IsValid() bool {
-	return MinValidNumber <= n && n < FirstReservedNumber || LastReservedNumber < n && n <= MaxValidNumber
+	return MinValidNumber <= n && n <= MaxValidNumber
 }
 
 // Type represents the wire type.
diff --git a/.ci/providerlint/vendor/google.golang.org/protobuf/internal/encoding/json/decode.go b/.ci/providerlint/vendor/google.golang.org/protobuf/internal/encoding/json/decode.go
index b13fd29e81e..d043a6ebe0b 100644
--- a/.ci/providerlint/vendor/google.golang.org/protobuf/internal/encoding/json/decode.go
+++ b/.ci/providerlint/vendor/google.golang.org/protobuf/internal/encoding/json/decode.go
@@ -294,7 +294,7 @@ func (d *Decoder) isValueNext() bool {
 }
 
 // consumeToken constructs a Token for given Kind with raw value derived from
-// current d.in and given size, and consumes the given size-lenght of it.
+// current d.in and given size, and consumes the given size-length of it.
 func (d *Decoder) consumeToken(kind Kind, size int) Token {
 	tok := Token{
 		kind: kind,
diff --git a/.ci/providerlint/vendor/google.golang.org/protobuf/internal/encoding/json/encode.go b/.ci/providerlint/vendor/google.golang.org/protobuf/internal/encoding/json/encode.go
index fbdf3487342..934f2dcb39d 100644
--- a/.ci/providerlint/vendor/google.golang.org/protobuf/internal/encoding/json/encode.go
+++ b/.ci/providerlint/vendor/google.golang.org/protobuf/internal/encoding/json/encode.go
@@ -41,8 +41,10 @@ type Encoder struct {
 //
 // If indent is a non-empty string, it causes every entry for an Array or Object
 // to be preceded by the indent and trailed by a newline.
-func NewEncoder(indent string) (*Encoder, error) {
-	e := &Encoder{}
+func NewEncoder(buf []byte, indent string) (*Encoder, error) {
+	e := &Encoder{
+		out: buf,
+	}
 	if len(indent) > 0 {
 		if strings.Trim(indent, " \t") != "" {
 			return nil, errors.New("indent may only be composed of space or tab characters")
@@ -176,13 +178,13 @@ func appendFloat(out []byte, n float64, bitSize int) []byte {
 // WriteInt writes out the given signed integer in JSON number value.
 func (e *Encoder) WriteInt(n int64) {
 	e.prepareNext(scalar)
-	e.out = append(e.out, strconv.FormatInt(n, 10)...)
+	e.out = strconv.AppendInt(e.out, n, 10)
 }
 
 // WriteUint writes out the given unsigned integer in JSON number value.
 func (e *Encoder) WriteUint(n uint64) {
 	e.prepareNext(scalar)
-	e.out = append(e.out, strconv.FormatUint(n, 10)...)
+	e.out = strconv.AppendUint(e.out, n, 10)
 }
 
 // StartObject writes out the '{' symbol.
diff --git a/.ci/providerlint/vendor/google.golang.org/protobuf/internal/encoding/text/decode.go b/.ci/providerlint/vendor/google.golang.org/protobuf/internal/encoding/text/decode.go
index 427c62d037f..87853e786d0 100644
--- a/.ci/providerlint/vendor/google.golang.org/protobuf/internal/encoding/text/decode.go
+++ b/.ci/providerlint/vendor/google.golang.org/protobuf/internal/encoding/text/decode.go
@@ -412,12 +412,13 @@ func (d *Decoder) parseFieldName() (tok Token, err error) {
 	// Field number. Identify if input is a valid number that is not negative
 	// and is decimal integer within 32-bit range.
 	if num := parseNumber(d.in); num.size > 0 {
+		str := num.string(d.in)
 		if !num.neg && num.kind == numDec {
-			if _, err := strconv.ParseInt(string(d.in[:num.size]), 10, 32); err == nil {
+			if _, err := strconv.ParseInt(str, 10, 32); err == nil {
 				return d.consumeToken(Name, num.size, uint8(FieldNumber)), nil
 			}
 		}
-		return Token{}, d.newSyntaxError("invalid field number: %s", d.in[:num.size])
+		return Token{}, d.newSyntaxError("invalid field number: %s", str)
 	}
 
 	return Token{}, d.newSyntaxError("invalid field name: %s", errId(d.in))
diff --git a/.ci/providerlint/vendor/google.golang.org/protobuf/internal/encoding/text/decode_number.go b/.ci/providerlint/vendor/google.golang.org/protobuf/internal/encoding/text/decode_number.go
index 81a5d8c8613..45c81f0298e 100644
--- a/.ci/providerlint/vendor/google.golang.org/protobuf/internal/encoding/text/decode_number.go
+++ b/.ci/providerlint/vendor/google.golang.org/protobuf/internal/encoding/text/decode_number.go
@@ -15,17 +15,12 @@ func (d *Decoder) parseNumberValue() (Token, bool) {
 	if num.neg {
 		numAttrs |= isNegative
 	}
-	strSize := num.size
-	last := num.size - 1
-	if num.kind == numFloat && (d.in[last] == 'f' || d.in[last] == 'F') {
-		strSize = last
-	}
 	tok := Token{
 		kind:     Scalar,
 		attrs:    numberValue,
 		pos:      len(d.orig) - len(d.in),
 		raw:      d.in[:num.size],
-		str:      string(d.in[:strSize]),
+		str:      num.string(d.in),
 		numAttrs: numAttrs,
 	}
 	d.consume(num.size)
@@ -46,6 +41,27 @@ type number struct {
 	kind uint8
 	neg  bool
 	size int
+	// if neg, this is the length of whitespace and comments between
+	// the minus sign and the rest fo the number literal
+	sep int
+}
+
+func (num number) string(data []byte) string {
+	strSize := num.size
+	last := num.size - 1
+	if num.kind == numFloat && (data[last] == 'f' || data[last] == 'F') {
+		strSize = last
+	}
+	if num.neg && num.sep > 0 {
+		// strip whitespace/comments between negative sign and the rest
+		strLen := strSize - num.sep
+		str := make([]byte, strLen)
+		str[0] = data[0]
+		copy(str[1:], data[num.sep+1:strSize])
+		return string(str)
+	}
+	return string(data[:strSize])
+
 }
 
 // parseNumber constructs a number object from given input. It allows for the
@@ -67,19 +83,22 @@ func parseNumber(input []byte) number {
 	}
 
 	// Optional -
+	var sep int
 	if s[0] == '-' {
 		neg = true
 		s = s[1:]
 		size++
+		// Consume any whitespace or comments between the
+		// negative sign and the rest of the number
+		lenBefore := len(s)
+		s = consume(s, 0)
+		sep = lenBefore - len(s)
+		size += sep
 		if len(s) == 0 {
 			return number{}
 		}
 	}
 
-	// C++ allows for whitespace and comments in between the negative sign and
-	// the rest of the number. This logic currently does not but is consistent
-	// with v1.
-
 	switch {
 	case s[0] == '0':
 		if len(s) > 1 {
@@ -116,7 +135,7 @@ func parseNumber(input []byte) number {
 				if len(s) > 0 && !isDelim(s[0]) {
 					return number{}
 				}
-				return number{kind: kind, neg: neg, size: size}
+				return number{kind: kind, neg: neg, size: size, sep: sep}
 			}
 		}
 		s = s[1:]
@@ -188,5 +207,5 @@ func parseNumber(input []byte) number {
 		return number{}
 	}
 
-	return number{kind: kind, neg: neg, size: size}
+	return number{kind: kind, neg: neg, size: size, sep: sep}
 }
diff --git a/.ci/providerlint/vendor/google.golang.org/protobuf/internal/encoding/text/encode.go b/.ci/providerlint/vendor/google.golang.org/protobuf/internal/encoding/text/encode.go
index da289ccce6e..cf7aed77bc3 100644
--- a/.ci/providerlint/vendor/google.golang.org/protobuf/internal/encoding/text/encode.go
+++ b/.ci/providerlint/vendor/google.golang.org/protobuf/internal/encoding/text/encode.go
@@ -53,8 +53,10 @@ type encoderState struct {
 // If outputASCII is true, strings will be serialized in such a way that
 // multi-byte UTF-8 sequences are escaped. This property ensures that the
 // overall output is ASCII (as opposed to UTF-8).
-func NewEncoder(indent string, delims [2]byte, outputASCII bool) (*Encoder, error) {
-	e := &Encoder{}
+func NewEncoder(buf []byte, indent string, delims [2]byte, outputASCII bool) (*Encoder, error) {
+	e := &Encoder{
+		encoderState: encoderState{out: buf},
+	}
 	if len(indent) > 0 {
 		if strings.Trim(indent, " \t") != "" {
 			return nil, errors.New("indent may only be composed of space and tab characters")
@@ -195,13 +197,13 @@ func appendFloat(out []byte, n float64, bitSize int) []byte {
 // WriteInt writes out the given signed integer value.
 func (e *Encoder) WriteInt(n int64) {
 	e.prepareNext(scalar)
-	e.out = append(e.out, strconv.FormatInt(n, 10)...)
+	e.out = strconv.AppendInt(e.out, n, 10)
 }
 
 // WriteUint writes out the given unsigned integer value.
 func (e *Encoder) WriteUint(n uint64) {
 	e.prepareNext(scalar)
-	e.out = append(e.out, strconv.FormatUint(n, 10)...)
+	e.out = strconv.AppendUint(e.out, n, 10)
 }
 
 // WriteLiteral writes out the given string as a literal value without quotes.
diff --git a/.ci/providerlint/vendor/google.golang.org/protobuf/internal/genid/descriptor_gen.go b/.ci/providerlint/vendor/google.golang.org/protobuf/internal/genid/descriptor_gen.go
index e3cdf1c2059..136f1b21573 100644
--- a/.ci/providerlint/vendor/google.golang.org/protobuf/internal/genid/descriptor_gen.go
+++ b/.ci/providerlint/vendor/google.golang.org/protobuf/internal/genid/descriptor_gen.go
@@ -50,6 +50,7 @@ const (
 	FileDescriptorProto_Options_field_name          protoreflect.Name = "options"
 	FileDescriptorProto_SourceCodeInfo_field_name   protoreflect.Name = "source_code_info"
 	FileDescriptorProto_Syntax_field_name           protoreflect.Name = "syntax"
+	FileDescriptorProto_Edition_field_name          protoreflect.Name = "edition"
 
 	FileDescriptorProto_Name_field_fullname             protoreflect.FullName = "google.protobuf.FileDescriptorProto.name"
 	FileDescriptorProto_Package_field_fullname          protoreflect.FullName = "google.protobuf.FileDescriptorProto.package"
@@ -63,6 +64,7 @@ const (
 	FileDescriptorProto_Options_field_fullname          protoreflect.FullName = "google.protobuf.FileDescriptorProto.options"
 	FileDescriptorProto_SourceCodeInfo_field_fullname   protoreflect.FullName = "google.protobuf.FileDescriptorProto.source_code_info"
 	FileDescriptorProto_Syntax_field_fullname           protoreflect.FullName = "google.protobuf.FileDescriptorProto.syntax"
+	FileDescriptorProto_Edition_field_fullname          protoreflect.FullName = "google.protobuf.FileDescriptorProto.edition"
 )
 
 // Field numbers for google.protobuf.FileDescriptorProto.
@@ -79,6 +81,7 @@ const (
 	FileDescriptorProto_Options_field_number          protoreflect.FieldNumber = 8
 	FileDescriptorProto_SourceCodeInfo_field_number   protoreflect.FieldNumber = 9
 	FileDescriptorProto_Syntax_field_number           protoreflect.FieldNumber = 12
+	FileDescriptorProto_Edition_field_number          protoreflect.FieldNumber = 13
 )
 
 // Names for google.protobuf.DescriptorProto.
@@ -180,13 +183,58 @@ const (
 // Field names for google.protobuf.ExtensionRangeOptions.
 const (
 	ExtensionRangeOptions_UninterpretedOption_field_name protoreflect.Name = "uninterpreted_option"
+	ExtensionRangeOptions_Declaration_field_name         protoreflect.Name = "declaration"
+	ExtensionRangeOptions_Verification_field_name        protoreflect.Name = "verification"
 
 	ExtensionRangeOptions_UninterpretedOption_field_fullname protoreflect.FullName = "google.protobuf.ExtensionRangeOptions.uninterpreted_option"
+	ExtensionRangeOptions_Declaration_field_fullname         protoreflect.FullName = "google.protobuf.ExtensionRangeOptions.declaration"
+	ExtensionRangeOptions_Verification_field_fullname        protoreflect.FullName = "google.protobuf.ExtensionRangeOptions.verification"
 )
 
 // Field numbers for google.protobuf.ExtensionRangeOptions.
 const (
 	ExtensionRangeOptions_UninterpretedOption_field_number protoreflect.FieldNumber = 999
+	ExtensionRangeOptions_Declaration_field_number         protoreflect.FieldNumber = 2
+	ExtensionRangeOptions_Verification_field_number        protoreflect.FieldNumber = 3
+)
+
+// Full and short names for google.protobuf.ExtensionRangeOptions.VerificationState.
+const (
+	ExtensionRangeOptions_VerificationState_enum_fullname = "google.protobuf.ExtensionRangeOptions.VerificationState"
+	ExtensionRangeOptions_VerificationState_enum_name     = "VerificationState"
+)
+
+// Names for google.protobuf.ExtensionRangeOptions.Declaration.
+const (
+	ExtensionRangeOptions_Declaration_message_name     protoreflect.Name     = "Declaration"
+	ExtensionRangeOptions_Declaration_message_fullname protoreflect.FullName = "google.protobuf.ExtensionRangeOptions.Declaration"
+)
+
+// Field names for google.protobuf.ExtensionRangeOptions.Declaration.
+const (
+	ExtensionRangeOptions_Declaration_Number_field_name     protoreflect.Name = "number"
+	ExtensionRangeOptions_Declaration_FullName_field_name   protoreflect.Name = "full_name"
+	ExtensionRangeOptions_Declaration_Type_field_name       protoreflect.Name = "type"
+	ExtensionRangeOptions_Declaration_IsRepeated_field_name protoreflect.Name = "is_repeated"
+	ExtensionRangeOptions_Declaration_Reserved_field_name   protoreflect.Name = "reserved"
+	ExtensionRangeOptions_Declaration_Repeated_field_name   protoreflect.Name = "repeated"
+
+	ExtensionRangeOptions_Declaration_Number_field_fullname     protoreflect.FullName = "google.protobuf.ExtensionRangeOptions.Declaration.number"
+	ExtensionRangeOptions_Declaration_FullName_field_fullname   protoreflect.FullName = "google.protobuf.ExtensionRangeOptions.Declaration.full_name"
+	ExtensionRangeOptions_Declaration_Type_field_fullname       protoreflect.FullName = "google.protobuf.ExtensionRangeOptions.Declaration.type"
+	ExtensionRangeOptions_Declaration_IsRepeated_field_fullname protoreflect.FullName = "google.protobuf.ExtensionRangeOptions.Declaration.is_repeated"
+	ExtensionRangeOptions_Declaration_Reserved_field_fullname   protoreflect.FullName = "google.protobuf.ExtensionRangeOptions.Declaration.reserved"
+	ExtensionRangeOptions_Declaration_Repeated_field_fullname   protoreflect.FullName = "google.protobuf.ExtensionRangeOptions.Declaration.repeated"
+)
+
+// Field numbers for google.protobuf.ExtensionRangeOptions.Declaration.
+const (
+	ExtensionRangeOptions_Declaration_Number_field_number     protoreflect.FieldNumber = 1
+	ExtensionRangeOptions_Declaration_FullName_field_number   protoreflect.FieldNumber = 2
+	ExtensionRangeOptions_Declaration_Type_field_number       protoreflect.FieldNumber = 3
+	ExtensionRangeOptions_Declaration_IsRepeated_field_number protoreflect.FieldNumber = 4
+	ExtensionRangeOptions_Declaration_Reserved_field_number   protoreflect.FieldNumber = 5
+	ExtensionRangeOptions_Declaration_Repeated_field_number   protoreflect.FieldNumber = 6
 )
 
 // Names for google.protobuf.FieldDescriptorProto.
@@ -494,26 +542,29 @@ const (
 
 // Field names for google.protobuf.MessageOptions.
 const (
-	MessageOptions_MessageSetWireFormat_field_name         protoreflect.Name = "message_set_wire_format"
-	MessageOptions_NoStandardDescriptorAccessor_field_name protoreflect.Name = "no_standard_descriptor_accessor"
-	MessageOptions_Deprecated_field_name                   protoreflect.Name = "deprecated"
-	MessageOptions_MapEntry_field_name                     protoreflect.Name = "map_entry"
-	MessageOptions_UninterpretedOption_field_name          protoreflect.Name = "uninterpreted_option"
+	MessageOptions_MessageSetWireFormat_field_name               protoreflect.Name = "message_set_wire_format"
+	MessageOptions_NoStandardDescriptorAccessor_field_name       protoreflect.Name = "no_standard_descriptor_accessor"
+	MessageOptions_Deprecated_field_name                         protoreflect.Name = "deprecated"
+	MessageOptions_MapEntry_field_name                           protoreflect.Name = "map_entry"
+	MessageOptions_DeprecatedLegacyJsonFieldConflicts_field_name protoreflect.Name = "deprecated_legacy_json_field_conflicts"
+	MessageOptions_UninterpretedOption_field_name                protoreflect.Name = "uninterpreted_option"
 
-	MessageOptions_MessageSetWireFormat_field_fullname         protoreflect.FullName = "google.protobuf.MessageOptions.message_set_wire_format"
-	MessageOptions_NoStandardDescriptorAccessor_field_fullname protoreflect.FullName = "google.protobuf.MessageOptions.no_standard_descriptor_accessor"
-	MessageOptions_Deprecated_field_fullname                   protoreflect.FullName = "google.protobuf.MessageOptions.deprecated"
-	MessageOptions_MapEntry_field_fullname                     protoreflect.FullName = "google.protobuf.MessageOptions.map_entry"
-	MessageOptions_UninterpretedOption_field_fullname          protoreflect.FullName = "google.protobuf.MessageOptions.uninterpreted_option"
+	MessageOptions_MessageSetWireFormat_field_fullname               protoreflect.FullName = "google.protobuf.MessageOptions.message_set_wire_format"
+	MessageOptions_NoStandardDescriptorAccessor_field_fullname       protoreflect.FullName = "google.protobuf.MessageOptions.no_standard_descriptor_accessor"
+	MessageOptions_Deprecated_field_fullname                         protoreflect.FullName = "google.protobuf.MessageOptions.deprecated"
+	MessageOptions_MapEntry_field_fullname                           protoreflect.FullName = "google.protobuf.MessageOptions.map_entry"
+	MessageOptions_DeprecatedLegacyJsonFieldConflicts_field_fullname protoreflect.FullName = "google.protobuf.MessageOptions.deprecated_legacy_json_field_conflicts"
+	MessageOptions_UninterpretedOption_field_fullname                protoreflect.FullName = "google.protobuf.MessageOptions.uninterpreted_option"
 )
 
 // Field numbers for google.protobuf.MessageOptions.
 const (
-	MessageOptions_MessageSetWireFormat_field_number         protoreflect.FieldNumber = 1
-	MessageOptions_NoStandardDescriptorAccessor_field_number protoreflect.FieldNumber = 2
-	MessageOptions_Deprecated_field_number                   protoreflect.FieldNumber = 3
-	MessageOptions_MapEntry_field_number                     protoreflect.FieldNumber = 7
-	MessageOptions_UninterpretedOption_field_number          protoreflect.FieldNumber = 999
+	MessageOptions_MessageSetWireFormat_field_number               protoreflect.FieldNumber = 1
+	MessageOptions_NoStandardDescriptorAccessor_field_number       protoreflect.FieldNumber = 2
+	MessageOptions_Deprecated_field_number                         protoreflect.FieldNumber = 3
+	MessageOptions_MapEntry_field_number                           protoreflect.FieldNumber = 7
+	MessageOptions_DeprecatedLegacyJsonFieldConflicts_field_number protoreflect.FieldNumber = 11
+	MessageOptions_UninterpretedOption_field_number                protoreflect.FieldNumber = 999
 )
 
 // Names for google.protobuf.FieldOptions.
@@ -528,16 +579,26 @@ const (
 	FieldOptions_Packed_field_name              protoreflect.Name = "packed"
 	FieldOptions_Jstype_field_name              protoreflect.Name = "jstype"
 	FieldOptions_Lazy_field_name                protoreflect.Name = "lazy"
+	FieldOptions_UnverifiedLazy_field_name      protoreflect.Name = "unverified_lazy"
 	FieldOptions_Deprecated_field_name          protoreflect.Name = "deprecated"
 	FieldOptions_Weak_field_name                protoreflect.Name = "weak"
+	FieldOptions_DebugRedact_field_name         protoreflect.Name = "debug_redact"
+	FieldOptions_Retention_field_name           protoreflect.Name = "retention"
+	FieldOptions_Target_field_name              protoreflect.Name = "target"
+	FieldOptions_Targets_field_name             protoreflect.Name = "targets"
 	FieldOptions_UninterpretedOption_field_name protoreflect.Name = "uninterpreted_option"
 
 	FieldOptions_Ctype_field_fullname               protoreflect.FullName = "google.protobuf.FieldOptions.ctype"
 	FieldOptions_Packed_field_fullname              protoreflect.FullName = "google.protobuf.FieldOptions.packed"
 	FieldOptions_Jstype_field_fullname              protoreflect.FullName = "google.protobuf.FieldOptions.jstype"
 	FieldOptions_Lazy_field_fullname                protoreflect.FullName = "google.protobuf.FieldOptions.lazy"
+	FieldOptions_UnverifiedLazy_field_fullname      protoreflect.FullName = "google.protobuf.FieldOptions.unverified_lazy"
 	FieldOptions_Deprecated_field_fullname          protoreflect.FullName = "google.protobuf.FieldOptions.deprecated"
 	FieldOptions_Weak_field_fullname                protoreflect.FullName = "google.protobuf.FieldOptions.weak"
+	FieldOptions_DebugRedact_field_fullname         protoreflect.FullName = "google.protobuf.FieldOptions.debug_redact"
+	FieldOptions_Retention_field_fullname           protoreflect.FullName = "google.protobuf.FieldOptions.retention"
+	FieldOptions_Target_field_fullname              protoreflect.FullName = "google.protobuf.FieldOptions.target"
+	FieldOptions_Targets_field_fullname             protoreflect.FullName = "google.protobuf.FieldOptions.targets"
 	FieldOptions_UninterpretedOption_field_fullname protoreflect.FullName = "google.protobuf.FieldOptions.uninterpreted_option"
 )
 
@@ -547,8 +608,13 @@ const (
 	FieldOptions_Packed_field_number              protoreflect.FieldNumber = 2
 	FieldOptions_Jstype_field_number              protoreflect.FieldNumber = 6
 	FieldOptions_Lazy_field_number                protoreflect.FieldNumber = 5
+	FieldOptions_UnverifiedLazy_field_number      protoreflect.FieldNumber = 15
 	FieldOptions_Deprecated_field_number          protoreflect.FieldNumber = 3
 	FieldOptions_Weak_field_number                protoreflect.FieldNumber = 10
+	FieldOptions_DebugRedact_field_number         protoreflect.FieldNumber = 16
+	FieldOptions_Retention_field_number           protoreflect.FieldNumber = 17
+	FieldOptions_Target_field_number              protoreflect.FieldNumber = 18
+	FieldOptions_Targets_field_number             protoreflect.FieldNumber = 19
 	FieldOptions_UninterpretedOption_field_number protoreflect.FieldNumber = 999
 )
 
@@ -564,6 +630,18 @@ const (
 	FieldOptions_JSType_enum_name     = "JSType"
 )
 
+// Full and short names for google.protobuf.FieldOptions.OptionRetention.
+const (
+	FieldOptions_OptionRetention_enum_fullname = "google.protobuf.FieldOptions.OptionRetention"
+	FieldOptions_OptionRetention_enum_name     = "OptionRetention"
+)
+
+// Full and short names for google.protobuf.FieldOptions.OptionTargetType.
+const (
+	FieldOptions_OptionTargetType_enum_fullname = "google.protobuf.FieldOptions.OptionTargetType"
+	FieldOptions_OptionTargetType_enum_name     = "OptionTargetType"
+)
+
 // Names for google.protobuf.OneofOptions.
 const (
 	OneofOptions_message_name     protoreflect.Name     = "OneofOptions"
@@ -590,20 +668,23 @@ const (
 
 // Field names for google.protobuf.EnumOptions.
 const (
-	EnumOptions_AllowAlias_field_name          protoreflect.Name = "allow_alias"
-	EnumOptions_Deprecated_field_name          protoreflect.Name = "deprecated"
-	EnumOptions_UninterpretedOption_field_name protoreflect.Name = "uninterpreted_option"
+	EnumOptions_AllowAlias_field_name                         protoreflect.Name = "allow_alias"
+	EnumOptions_Deprecated_field_name                         protoreflect.Name = "deprecated"
+	EnumOptions_DeprecatedLegacyJsonFieldConflicts_field_name protoreflect.Name = "deprecated_legacy_json_field_conflicts"
+	EnumOptions_UninterpretedOption_field_name                protoreflect.Name = "uninterpreted_option"
 
-	EnumOptions_AllowAlias_field_fullname          protoreflect.FullName = "google.protobuf.EnumOptions.allow_alias"
-	EnumOptions_Deprecated_field_fullname          protoreflect.FullName = "google.protobuf.EnumOptions.deprecated"
-	EnumOptions_UninterpretedOption_field_fullname protoreflect.FullName = "google.protobuf.EnumOptions.uninterpreted_option"
+	EnumOptions_AllowAlias_field_fullname                         protoreflect.FullName = "google.protobuf.EnumOptions.allow_alias"
+	EnumOptions_Deprecated_field_fullname                         protoreflect.FullName = "google.protobuf.EnumOptions.deprecated"
+	EnumOptions_DeprecatedLegacyJsonFieldConflicts_field_fullname protoreflect.FullName = "google.protobuf.EnumOptions.deprecated_legacy_json_field_conflicts"
+	EnumOptions_UninterpretedOption_field_fullname                protoreflect.FullName = "google.protobuf.EnumOptions.uninterpreted_option"
 )
 
 // Field numbers for google.protobuf.EnumOptions.
 const (
-	EnumOptions_AllowAlias_field_number          protoreflect.FieldNumber = 2
-	EnumOptions_Deprecated_field_number          protoreflect.FieldNumber = 3
-	EnumOptions_UninterpretedOption_field_number protoreflect.FieldNumber = 999
+	EnumOptions_AllowAlias_field_number                         protoreflect.FieldNumber = 2
+	EnumOptions_Deprecated_field_number                         protoreflect.FieldNumber = 3
+	EnumOptions_DeprecatedLegacyJsonFieldConflicts_field_number protoreflect.FieldNumber = 6
+	EnumOptions_UninterpretedOption_field_number                protoreflect.FieldNumber = 999
 )
 
 // Names for google.protobuf.EnumValueOptions.
@@ -813,11 +894,13 @@ const (
 	GeneratedCodeInfo_Annotation_SourceFile_field_name protoreflect.Name = "source_file"
 	GeneratedCodeInfo_Annotation_Begin_field_name      protoreflect.Name = "begin"
 	GeneratedCodeInfo_Annotation_End_field_name        protoreflect.Name = "end"
+	GeneratedCodeInfo_Annotation_Semantic_field_name   protoreflect.Name = "semantic"
 
 	GeneratedCodeInfo_Annotation_Path_field_fullname       protoreflect.FullName = "google.protobuf.GeneratedCodeInfo.Annotation.path"
 	GeneratedCodeInfo_Annotation_SourceFile_field_fullname protoreflect.FullName = "google.protobuf.GeneratedCodeInfo.Annotation.source_file"
 	GeneratedCodeInfo_Annotation_Begin_field_fullname      protoreflect.FullName = "google.protobuf.GeneratedCodeInfo.Annotation.begin"
 	GeneratedCodeInfo_Annotation_End_field_fullname        protoreflect.FullName = "google.protobuf.GeneratedCodeInfo.Annotation.end"
+	GeneratedCodeInfo_Annotation_Semantic_field_fullname   protoreflect.FullName = "google.protobuf.GeneratedCodeInfo.Annotation.semantic"
 )
 
 // Field numbers for google.protobuf.GeneratedCodeInfo.Annotation.
@@ -826,4 +909,11 @@ const (
 	GeneratedCodeInfo_Annotation_SourceFile_field_number protoreflect.FieldNumber = 2
 	GeneratedCodeInfo_Annotation_Begin_field_number      protoreflect.FieldNumber = 3
 	GeneratedCodeInfo_Annotation_End_field_number        protoreflect.FieldNumber = 4
+	GeneratedCodeInfo_Annotation_Semantic_field_number   protoreflect.FieldNumber = 5
+)
+
+// Full and short names for google.protobuf.GeneratedCodeInfo.Annotation.Semantic.
+const (
+	GeneratedCodeInfo_Annotation_Semantic_enum_fullname = "google.protobuf.GeneratedCodeInfo.Annotation.Semantic"
+	GeneratedCodeInfo_Annotation_Semantic_enum_name     = "Semantic"
 )
diff --git a/.ci/providerlint/vendor/google.golang.org/protobuf/internal/genid/type_gen.go b/.ci/providerlint/vendor/google.golang.org/protobuf/internal/genid/type_gen.go
index 3bc710138ad..e0f75fea0a1 100644
--- a/.ci/providerlint/vendor/google.golang.org/protobuf/internal/genid/type_gen.go
+++ b/.ci/providerlint/vendor/google.golang.org/protobuf/internal/genid/type_gen.go
@@ -32,6 +32,7 @@ const (
 	Type_Options_field_name       protoreflect.Name = "options"
 	Type_SourceContext_field_name protoreflect.Name = "source_context"
 	Type_Syntax_field_name        protoreflect.Name = "syntax"
+	Type_Edition_field_name       protoreflect.Name = "edition"
 
 	Type_Name_field_fullname          protoreflect.FullName = "google.protobuf.Type.name"
 	Type_Fields_field_fullname        protoreflect.FullName = "google.protobuf.Type.fields"
@@ -39,6 +40,7 @@ const (
 	Type_Options_field_fullname       protoreflect.FullName = "google.protobuf.Type.options"
 	Type_SourceContext_field_fullname protoreflect.FullName = "google.protobuf.Type.source_context"
 	Type_Syntax_field_fullname        protoreflect.FullName = "google.protobuf.Type.syntax"
+	Type_Edition_field_fullname       protoreflect.FullName = "google.protobuf.Type.edition"
 )
 
 // Field numbers for google.protobuf.Type.
@@ -49,6 +51,7 @@ const (
 	Type_Options_field_number       protoreflect.FieldNumber = 4
 	Type_SourceContext_field_number protoreflect.FieldNumber = 5
 	Type_Syntax_field_number        protoreflect.FieldNumber = 6
+	Type_Edition_field_number       protoreflect.FieldNumber = 7
 )
 
 // Names for google.protobuf.Field.
@@ -121,12 +124,14 @@ const (
 	Enum_Options_field_name       protoreflect.Name = "options"
 	Enum_SourceContext_field_name protoreflect.Name = "source_context"
 	Enum_Syntax_field_name        protoreflect.Name = "syntax"
+	Enum_Edition_field_name       protoreflect.Name = "edition"
 
 	Enum_Name_field_fullname          protoreflect.FullName = "google.protobuf.Enum.name"
 	Enum_Enumvalue_field_fullname     protoreflect.FullName = "google.protobuf.Enum.enumvalue"
 	Enum_Options_field_fullname       protoreflect.FullName = "google.protobuf.Enum.options"
 	Enum_SourceContext_field_fullname protoreflect.FullName = "google.protobuf.Enum.source_context"
 	Enum_Syntax_field_fullname        protoreflect.FullName = "google.protobuf.Enum.syntax"
+	Enum_Edition_field_fullname       protoreflect.FullName = "google.protobuf.Enum.edition"
 )
 
 // Field numbers for google.protobuf.Enum.
@@ -136,6 +141,7 @@ const (
 	Enum_Options_field_number       protoreflect.FieldNumber = 3
 	Enum_SourceContext_field_number protoreflect.FieldNumber = 4
 	Enum_Syntax_field_number        protoreflect.FieldNumber = 5
+	Enum_Edition_field_number       protoreflect.FieldNumber = 6
 )
 
 // Names for google.protobuf.EnumValue.
diff --git a/.ci/providerlint/vendor/google.golang.org/protobuf/internal/impl/convert.go b/.ci/providerlint/vendor/google.golang.org/protobuf/internal/impl/convert.go
index 11a6128ba56..185ef2efa5b 100644
--- a/.ci/providerlint/vendor/google.golang.org/protobuf/internal/impl/convert.go
+++ b/.ci/providerlint/vendor/google.golang.org/protobuf/internal/impl/convert.go
@@ -59,7 +59,6 @@ func NewConverter(t reflect.Type, fd protoreflect.FieldDescriptor) Converter {
 	default:
 		return newSingularConverter(t, fd)
 	}
-	panic(fmt.Sprintf("invalid Go type %v for field %v", t, fd.FullName()))
 }
 
 var (
diff --git a/.ci/providerlint/vendor/google.golang.org/protobuf/internal/order/order.go b/.ci/providerlint/vendor/google.golang.org/protobuf/internal/order/order.go
index 33745ed0625..dea522e127d 100644
--- a/.ci/providerlint/vendor/google.golang.org/protobuf/internal/order/order.go
+++ b/.ci/providerlint/vendor/google.golang.org/protobuf/internal/order/order.go
@@ -33,7 +33,7 @@ var (
 			return !inOneof(ox) && inOneof(oy)
 		}
 		// Fields in disjoint oneof sets are sorted by declaration index.
-		if ox != nil && oy != nil && ox != oy {
+		if inOneof(ox) && inOneof(oy) && ox != oy {
 			return ox.Index() < oy.Index()
 		}
 		// Fields sorted by field number.
diff --git a/.ci/providerlint/vendor/google.golang.org/protobuf/internal/strs/strings_unsafe.go b/.ci/providerlint/vendor/google.golang.org/protobuf/internal/strs/strings_unsafe.go
index fea589c457e..61a84d34185 100644
--- a/.ci/providerlint/vendor/google.golang.org/protobuf/internal/strs/strings_unsafe.go
+++ b/.ci/providerlint/vendor/google.golang.org/protobuf/internal/strs/strings_unsafe.go
@@ -87,7 +87,7 @@ func (sb *Builder) grow(n int) {
 	// Unlike strings.Builder, we do not need to copy over the contents
 	// of the old buffer since our builder provides no API for
 	// retrieving previously created strings.
-	sb.buf = make([]byte, 2*(cap(sb.buf)+n))
+	sb.buf = make([]byte, 0, 2*(cap(sb.buf)+n))
 }
 
 func (sb *Builder) last(n int) string {
diff --git a/.ci/providerlint/vendor/google.golang.org/protobuf/internal/version/version.go b/.ci/providerlint/vendor/google.golang.org/protobuf/internal/version/version.go
index b480c5010f1..0999f29d501 100644
--- a/.ci/providerlint/vendor/google.golang.org/protobuf/internal/version/version.go
+++ b/.ci/providerlint/vendor/google.golang.org/protobuf/internal/version/version.go
@@ -51,8 +51,8 @@ import (
 //  10. Send out the CL for review and submit it.
 const (
 	Major      = 1
-	Minor      = 28
-	Patch      = 1
+	Minor      = 31
+	Patch      = 0
 	PreRelease = ""
 )
 
diff --git a/.ci/providerlint/vendor/google.golang.org/protobuf/proto/doc.go b/.ci/providerlint/vendor/google.golang.org/protobuf/proto/doc.go
index 08d2a46f535..ec71e717fe7 100644
--- a/.ci/providerlint/vendor/google.golang.org/protobuf/proto/doc.go
+++ b/.ci/providerlint/vendor/google.golang.org/protobuf/proto/doc.go
@@ -5,16 +5,13 @@
 // Package proto provides functions operating on protocol buffer messages.
 //
 // For documentation on protocol buffers in general, see:
-//
-//	https://developers.google.com/protocol-buffers
+// https://protobuf.dev.
 //
 // For a tutorial on using protocol buffers with Go, see:
-//
-//	https://developers.google.com/protocol-buffers/docs/gotutorial
+// https://protobuf.dev/getting-started/gotutorial.
 //
 // For a guide to generated Go protocol buffer code, see:
-//
-//	https://developers.google.com/protocol-buffers/docs/reference/go-generated
+// https://protobuf.dev/reference/go/go-generated.
 //
 // # Binary serialization
 //
diff --git a/.ci/providerlint/vendor/google.golang.org/protobuf/proto/equal.go b/.ci/providerlint/vendor/google.golang.org/protobuf/proto/equal.go
index 67948dd1df8..1a0be1b03c7 100644
--- a/.ci/providerlint/vendor/google.golang.org/protobuf/proto/equal.go
+++ b/.ci/providerlint/vendor/google.golang.org/protobuf/proto/equal.go
@@ -5,30 +5,39 @@
 package proto
 
 import (
-	"bytes"
-	"math"
 	"reflect"
 
-	"google.golang.org/protobuf/encoding/protowire"
 	"google.golang.org/protobuf/reflect/protoreflect"
 )
 
-// Equal reports whether two messages are equal.
-// If two messages marshal to the same bytes under deterministic serialization,
-// then Equal is guaranteed to report true.
+// Equal reports whether two messages are equal,
+// by recursively comparing the fields of the message.
 //
-// Two messages are equal if they belong to the same message descriptor,
-// have the same set of populated known and extension field values,
-// and the same set of unknown fields values. If either of the top-level
-// messages are invalid, then Equal reports true only if both are invalid.
+//   - Bytes fields are equal if they contain identical bytes.
+//     Empty bytes (regardless of nil-ness) are considered equal.
 //
-// Scalar values are compared with the equivalent of the == operator in Go,
-// except bytes values which are compared using bytes.Equal and
-// floating point values which specially treat NaNs as equal.
-// Message values are compared by recursively calling Equal.
-// Lists are equal if each element value is also equal.
-// Maps are equal if they have the same set of keys, where the pair of values
-// for each key is also equal.
+//   - Floating-point fields are equal if they contain the same value.
+//     Unlike the == operator, a NaN is equal to another NaN.
+//
+//   - Other scalar fields are equal if they contain the same value.
+//
+//   - Message fields are equal if they have
+//     the same set of populated known and extension field values, and
+//     the same set of unknown fields values.
+//
+//   - Lists are equal if they are the same length and
+//     each corresponding element is equal.
+//
+//   - Maps are equal if they have the same set of keys and
+//     the corresponding value for each key is equal.
+//
+// An invalid message is not equal to a valid message.
+// An invalid message is only equal to another invalid message of the
+// same type. An invalid message often corresponds to a nil pointer
+// of the concrete message type. For example, (*pb.M)(nil) is not equal
+// to &pb.M{}.
+// If two valid messages marshal to the same bytes under deterministic
+// serialization, then Equal is guaranteed to report true.
 func Equal(x, y Message) bool {
 	if x == nil || y == nil {
 		return x == nil && y == nil
@@ -42,130 +51,7 @@ func Equal(x, y Message) bool {
 	if mx.IsValid() != my.IsValid() {
 		return false
 	}
-	return equalMessage(mx, my)
-}
-
-// equalMessage compares two messages.
-func equalMessage(mx, my protoreflect.Message) bool {
-	if mx.Descriptor() != my.Descriptor() {
-		return false
-	}
-
-	nx := 0
-	equal := true
-	mx.Range(func(fd protoreflect.FieldDescriptor, vx protoreflect.Value) bool {
-		nx++
-		vy := my.Get(fd)
-		equal = my.Has(fd) && equalField(fd, vx, vy)
-		return equal
-	})
-	if !equal {
-		return false
-	}
-	ny := 0
-	my.Range(func(fd protoreflect.FieldDescriptor, vx protoreflect.Value) bool {
-		ny++
-		return true
-	})
-	if nx != ny {
-		return false
-	}
-
-	return equalUnknown(mx.GetUnknown(), my.GetUnknown())
-}
-
-// equalField compares two fields.
-func equalField(fd protoreflect.FieldDescriptor, x, y protoreflect.Value) bool {
-	switch {
-	case fd.IsList():
-		return equalList(fd, x.List(), y.List())
-	case fd.IsMap():
-		return equalMap(fd, x.Map(), y.Map())
-	default:
-		return equalValue(fd, x, y)
-	}
-}
-
-// equalMap compares two maps.
-func equalMap(fd protoreflect.FieldDescriptor, x, y protoreflect.Map) bool {
-	if x.Len() != y.Len() {
-		return false
-	}
-	equal := true
-	x.Range(func(k protoreflect.MapKey, vx protoreflect.Value) bool {
-		vy := y.Get(k)
-		equal = y.Has(k) && equalValue(fd.MapValue(), vx, vy)
-		return equal
-	})
-	return equal
-}
-
-// equalList compares two lists.
-func equalList(fd protoreflect.FieldDescriptor, x, y protoreflect.List) bool {
-	if x.Len() != y.Len() {
-		return false
-	}
-	for i := x.Len() - 1; i >= 0; i-- {
-		if !equalValue(fd, x.Get(i), y.Get(i)) {
-			return false
-		}
-	}
-	return true
-}
-
-// equalValue compares two singular values.
-func equalValue(fd protoreflect.FieldDescriptor, x, y protoreflect.Value) bool {
-	switch fd.Kind() {
-	case protoreflect.BoolKind:
-		return x.Bool() == y.Bool()
-	case protoreflect.EnumKind:
-		return x.Enum() == y.Enum()
-	case protoreflect.Int32Kind, protoreflect.Sint32Kind,
-		protoreflect.Int64Kind, protoreflect.Sint64Kind,
-		protoreflect.Sfixed32Kind, protoreflect.Sfixed64Kind:
-		return x.Int() == y.Int()
-	case protoreflect.Uint32Kind, protoreflect.Uint64Kind,
-		protoreflect.Fixed32Kind, protoreflect.Fixed64Kind:
-		return x.Uint() == y.Uint()
-	case protoreflect.FloatKind, protoreflect.DoubleKind:
-		fx := x.Float()
-		fy := y.Float()
-		if math.IsNaN(fx) || math.IsNaN(fy) {
-			return math.IsNaN(fx) && math.IsNaN(fy)
-		}
-		return fx == fy
-	case protoreflect.StringKind:
-		return x.String() == y.String()
-	case protoreflect.BytesKind:
-		return bytes.Equal(x.Bytes(), y.Bytes())
-	case protoreflect.MessageKind, protoreflect.GroupKind:
-		return equalMessage(x.Message(), y.Message())
-	default:
-		return x.Interface() == y.Interface()
-	}
-}
-
-// equalUnknown compares unknown fields by direct comparison on the raw bytes
-// of each individual field number.
-func equalUnknown(x, y protoreflect.RawFields) bool {
-	if len(x) != len(y) {
-		return false
-	}
-	if bytes.Equal([]byte(x), []byte(y)) {
-		return true
-	}
-
-	mx := make(map[protoreflect.FieldNumber]protoreflect.RawFields)
-	my := make(map[protoreflect.FieldNumber]protoreflect.RawFields)
-	for len(x) > 0 {
-		fnum, _, n := protowire.ConsumeField(x)
-		mx[fnum] = append(mx[fnum], x[:n]...)
-		x = x[n:]
-	}
-	for len(y) > 0 {
-		fnum, _, n := protowire.ConsumeField(y)
-		my[fnum] = append(my[fnum], y[:n]...)
-		y = y[n:]
-	}
-	return reflect.DeepEqual(mx, my)
+	vx := protoreflect.ValueOfMessage(mx)
+	vy := protoreflect.ValueOfMessage(my)
+	return vx.Equal(vy)
 }
diff --git a/.ci/providerlint/vendor/google.golang.org/protobuf/proto/size.go b/.ci/providerlint/vendor/google.golang.org/protobuf/proto/size.go
index 554b9c6c09a..f1692b49b6c 100644
--- a/.ci/providerlint/vendor/google.golang.org/protobuf/proto/size.go
+++ b/.ci/providerlint/vendor/google.golang.org/protobuf/proto/size.go
@@ -73,23 +73,27 @@ func (o MarshalOptions) sizeField(fd protoreflect.FieldDescriptor, value protore
 }
 
 func (o MarshalOptions) sizeList(num protowire.Number, fd protoreflect.FieldDescriptor, list protoreflect.List) (size int) {
+	sizeTag := protowire.SizeTag(num)
+
 	if fd.IsPacked() && list.Len() > 0 {
 		content := 0
 		for i, llen := 0, list.Len(); i < llen; i++ {
 			content += o.sizeSingular(num, fd.Kind(), list.Get(i))
 		}
-		return protowire.SizeTag(num) + protowire.SizeBytes(content)
+		return sizeTag + protowire.SizeBytes(content)
 	}
 
 	for i, llen := 0, list.Len(); i < llen; i++ {
-		size += protowire.SizeTag(num) + o.sizeSingular(num, fd.Kind(), list.Get(i))
+		size += sizeTag + o.sizeSingular(num, fd.Kind(), list.Get(i))
 	}
 	return size
 }
 
 func (o MarshalOptions) sizeMap(num protowire.Number, fd protoreflect.FieldDescriptor, mapv protoreflect.Map) (size int) {
+	sizeTag := protowire.SizeTag(num)
+
 	mapv.Range(func(key protoreflect.MapKey, value protoreflect.Value) bool {
-		size += protowire.SizeTag(num)
+		size += sizeTag
 		size += protowire.SizeBytes(o.sizeField(fd.MapKey(), key.Value()) + o.sizeField(fd.MapValue(), value))
 		return true
 	})
diff --git a/.ci/providerlint/vendor/google.golang.org/protobuf/reflect/protoreflect/source_gen.go b/.ci/providerlint/vendor/google.golang.org/protobuf/reflect/protoreflect/source_gen.go
index b03c1223c4a..717b106f3da 100644
--- a/.ci/providerlint/vendor/google.golang.org/protobuf/reflect/protoreflect/source_gen.go
+++ b/.ci/providerlint/vendor/google.golang.org/protobuf/reflect/protoreflect/source_gen.go
@@ -35,6 +35,8 @@ func (p *SourcePath) appendFileDescriptorProto(b []byte) []byte {
 		b = p.appendSingularField(b, "source_code_info", (*SourcePath).appendSourceCodeInfo)
 	case 12:
 		b = p.appendSingularField(b, "syntax", nil)
+	case 13:
+		b = p.appendSingularField(b, "edition", nil)
 	}
 	return b
 }
@@ -236,6 +238,8 @@ func (p *SourcePath) appendMessageOptions(b []byte) []byte {
 		b = p.appendSingularField(b, "deprecated", nil)
 	case 7:
 		b = p.appendSingularField(b, "map_entry", nil)
+	case 11:
+		b = p.appendSingularField(b, "deprecated_legacy_json_field_conflicts", nil)
 	case 999:
 		b = p.appendRepeatedField(b, "uninterpreted_option", (*SourcePath).appendUninterpretedOption)
 	}
@@ -279,6 +283,8 @@ func (p *SourcePath) appendEnumOptions(b []byte) []byte {
 		b = p.appendSingularField(b, "allow_alias", nil)
 	case 3:
 		b = p.appendSingularField(b, "deprecated", nil)
+	case 6:
+		b = p.appendSingularField(b, "deprecated_legacy_json_field_conflicts", nil)
 	case 999:
 		b = p.appendRepeatedField(b, "uninterpreted_option", (*SourcePath).appendUninterpretedOption)
 	}
@@ -345,10 +351,20 @@ func (p *SourcePath) appendFieldOptions(b []byte) []byte {
 		b = p.appendSingularField(b, "jstype", nil)
 	case 5:
 		b = p.appendSingularField(b, "lazy", nil)
+	case 15:
+		b = p.appendSingularField(b, "unverified_lazy", nil)
 	case 3:
 		b = p.appendSingularField(b, "deprecated", nil)
 	case 10:
 		b = p.appendSingularField(b, "weak", nil)
+	case 16:
+		b = p.appendSingularField(b, "debug_redact", nil)
+	case 17:
+		b = p.appendSingularField(b, "retention", nil)
+	case 18:
+		b = p.appendSingularField(b, "target", nil)
+	case 19:
+		b = p.appendRepeatedField(b, "targets", nil)
 	case 999:
 		b = p.appendRepeatedField(b, "uninterpreted_option", (*SourcePath).appendUninterpretedOption)
 	}
@@ -404,6 +420,10 @@ func (p *SourcePath) appendExtensionRangeOptions(b []byte) []byte {
 	switch (*p)[0] {
 	case 999:
 		b = p.appendRepeatedField(b, "uninterpreted_option", (*SourcePath).appendUninterpretedOption)
+	case 2:
+		b = p.appendRepeatedField(b, "declaration", (*SourcePath).appendExtensionRangeOptions_Declaration)
+	case 3:
+		b = p.appendSingularField(b, "verification", nil)
 	}
 	return b
 }
@@ -459,3 +479,24 @@ func (p *SourcePath) appendUninterpretedOption_NamePart(b []byte) []byte {
 	}
 	return b
 }
+
+func (p *SourcePath) appendExtensionRangeOptions_Declaration(b []byte) []byte {
+	if len(*p) == 0 {
+		return b
+	}
+	switch (*p)[0] {
+	case 1:
+		b = p.appendSingularField(b, "number", nil)
+	case 2:
+		b = p.appendSingularField(b, "full_name", nil)
+	case 3:
+		b = p.appendSingularField(b, "type", nil)
+	case 4:
+		b = p.appendSingularField(b, "is_repeated", nil)
+	case 5:
+		b = p.appendSingularField(b, "reserved", nil)
+	case 6:
+		b = p.appendSingularField(b, "repeated", nil)
+	}
+	return b
+}
diff --git a/.ci/providerlint/vendor/google.golang.org/protobuf/reflect/protoreflect/value.go b/.ci/providerlint/vendor/google.golang.org/protobuf/reflect/protoreflect/value.go
index f3198107782..37601b78199 100644
--- a/.ci/providerlint/vendor/google.golang.org/protobuf/reflect/protoreflect/value.go
+++ b/.ci/providerlint/vendor/google.golang.org/protobuf/reflect/protoreflect/value.go
@@ -148,7 +148,7 @@ type Message interface {
 	// be preserved in marshaling or other operations.
 	IsValid() bool
 
-	// ProtoMethods returns optional fast-path implementions of various operations.
+	// ProtoMethods returns optional fast-path implementations of various operations.
 	// This method may return nil.
 	//
 	// The returned methods type is identical to
diff --git a/.ci/providerlint/vendor/google.golang.org/protobuf/reflect/protoreflect/value_equal.go b/.ci/providerlint/vendor/google.golang.org/protobuf/reflect/protoreflect/value_equal.go
new file mode 100644
index 00000000000..591652541f2
--- /dev/null
+++ b/.ci/providerlint/vendor/google.golang.org/protobuf/reflect/protoreflect/value_equal.go
@@ -0,0 +1,168 @@
+// Copyright 2022 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package protoreflect
+
+import (
+	"bytes"
+	"fmt"
+	"math"
+	"reflect"
+
+	"google.golang.org/protobuf/encoding/protowire"
+)
+
+// Equal reports whether v1 and v2 are recursively equal.
+//
+//   - Values of different types are always unequal.
+//
+//   - Bytes values are equal if they contain identical bytes.
+//     Empty bytes (regardless of nil-ness) are considered equal.
+//
+//   - Floating point values are equal if they contain the same value.
+//     Unlike the == operator, a NaN is equal to another NaN.
+//
+//   - Enums are equal if they contain the same number.
+//     Since Value does not contain an enum descriptor,
+//     enum values do not consider the type of the enum.
+//
+//   - Other scalar values are equal if they contain the same value.
+//
+//   - Message values are equal if they belong to the same message descriptor,
+//     have the same set of populated known and extension field values,
+//     and the same set of unknown fields values.
+//
+//   - Lists are equal if they are the same length and
+//     each corresponding element is equal.
+//
+//   - Maps are equal if they have the same set of keys and
+//     the corresponding value for each key is equal.
+func (v1 Value) Equal(v2 Value) bool {
+	return equalValue(v1, v2)
+}
+
+func equalValue(x, y Value) bool {
+	eqType := x.typ == y.typ
+	switch x.typ {
+	case nilType:
+		return eqType
+	case boolType:
+		return eqType && x.Bool() == y.Bool()
+	case int32Type, int64Type:
+		return eqType && x.Int() == y.Int()
+	case uint32Type, uint64Type:
+		return eqType && x.Uint() == y.Uint()
+	case float32Type, float64Type:
+		return eqType && equalFloat(x.Float(), y.Float())
+	case stringType:
+		return eqType && x.String() == y.String()
+	case bytesType:
+		return eqType && bytes.Equal(x.Bytes(), y.Bytes())
+	case enumType:
+		return eqType && x.Enum() == y.Enum()
+	default:
+		switch x := x.Interface().(type) {
+		case Message:
+			y, ok := y.Interface().(Message)
+			return ok && equalMessage(x, y)
+		case List:
+			y, ok := y.Interface().(List)
+			return ok && equalList(x, y)
+		case Map:
+			y, ok := y.Interface().(Map)
+			return ok && equalMap(x, y)
+		default:
+			panic(fmt.Sprintf("unknown type: %T", x))
+		}
+	}
+}
+
+// equalFloat compares two floats, where NaNs are treated as equal.
+func equalFloat(x, y float64) bool {
+	if math.IsNaN(x) || math.IsNaN(y) {
+		return math.IsNaN(x) && math.IsNaN(y)
+	}
+	return x == y
+}
+
+// equalMessage compares two messages.
+func equalMessage(mx, my Message) bool {
+	if mx.Descriptor() != my.Descriptor() {
+		return false
+	}
+
+	nx := 0
+	equal := true
+	mx.Range(func(fd FieldDescriptor, vx Value) bool {
+		nx++
+		vy := my.Get(fd)
+		equal = my.Has(fd) && equalValue(vx, vy)
+		return equal
+	})
+	if !equal {
+		return false
+	}
+	ny := 0
+	my.Range(func(fd FieldDescriptor, vx Value) bool {
+		ny++
+		return true
+	})
+	if nx != ny {
+		return false
+	}
+
+	return equalUnknown(mx.GetUnknown(), my.GetUnknown())
+}
+
+// equalList compares two lists.
+func equalList(x, y List) bool {
+	if x.Len() != y.Len() {
+		return false
+	}
+	for i := x.Len() - 1; i >= 0; i-- {
+		if !equalValue(x.Get(i), y.Get(i)) {
+			return false
+		}
+	}
+	return true
+}
+
+// equalMap compares two maps.
+func equalMap(x, y Map) bool {
+	if x.Len() != y.Len() {
+		return false
+	}
+	equal := true
+	x.Range(func(k MapKey, vx Value) bool {
+		vy := y.Get(k)
+		equal = y.Has(k) && equalValue(vx, vy)
+		return equal
+	})
+	return equal
+}
+
+// equalUnknown compares unknown fields by direct comparison on the raw bytes
+// of each individual field number.
+func equalUnknown(x, y RawFields) bool {
+	if len(x) != len(y) {
+		return false
+	}
+	if bytes.Equal([]byte(x), []byte(y)) {
+		return true
+	}
+
+	mx := make(map[FieldNumber]RawFields)
+	my := make(map[FieldNumber]RawFields)
+	for len(x) > 0 {
+		fnum, _, n := protowire.ConsumeField(x)
+		mx[fnum] = append(mx[fnum], x[:n]...)
+		x = x[n:]
+	}
+	for len(y) > 0 {
+		fnum, _, n := protowire.ConsumeField(y)
+		my[fnum] = append(my[fnum], y[:n]...)
+		y = y[n:]
+	}
+	return reflect.DeepEqual(mx, my)
+}
diff --git a/.ci/providerlint/vendor/google.golang.org/protobuf/reflect/protoreflect/value_union.go b/.ci/providerlint/vendor/google.golang.org/protobuf/reflect/protoreflect/value_union.go
index ca8e28c5bc8..08e5ef73fc0 100644
--- a/.ci/providerlint/vendor/google.golang.org/protobuf/reflect/protoreflect/value_union.go
+++ b/.ci/providerlint/vendor/google.golang.org/protobuf/reflect/protoreflect/value_union.go
@@ -54,11 +54,11 @@ import (
 //	// Append a 0 to a "repeated int32" field.
 //	// Since the Value returned by Mutable is guaranteed to alias
 //	// the source message, modifying the Value modifies the message.
-//	message.Mutable(fieldDesc).(List).Append(protoreflect.ValueOfInt32(0))
+//	message.Mutable(fieldDesc).List().Append(protoreflect.ValueOfInt32(0))
 //
 //	// Assign [0] to a "repeated int32" field by creating a new Value,
 //	// modifying it, and assigning it.
-//	list := message.NewField(fieldDesc).(List)
+//	list := message.NewField(fieldDesc).List()
 //	list.Append(protoreflect.ValueOfInt32(0))
 //	message.Set(fieldDesc, list)
 //	// ERROR: Since it is not defined whether Set aliases the source,
diff --git a/.ci/providerlint/vendor/google.golang.org/protobuf/reflect/protoregistry/registry.go b/.ci/providerlint/vendor/google.golang.org/protobuf/reflect/protoregistry/registry.go
index 58352a6978b..aeb55977446 100644
--- a/.ci/providerlint/vendor/google.golang.org/protobuf/reflect/protoregistry/registry.go
+++ b/.ci/providerlint/vendor/google.golang.org/protobuf/reflect/protoregistry/registry.go
@@ -46,7 +46,7 @@ var conflictPolicy = "panic" // "panic" | "warn" | "ignore"
 // It is a variable so that the behavior is easily overridden in another file.
 var ignoreConflict = func(d protoreflect.Descriptor, err error) bool {
 	const env = "GOLANG_PROTOBUF_REGISTRATION_CONFLICT"
-	const faq = "https://developers.google.com/protocol-buffers/docs/reference/go/faq#namespace-conflict"
+	const faq = "https://protobuf.dev/reference/go/faq#namespace-conflict"
 	policy := conflictPolicy
 	if v := os.Getenv(env); v != "" {
 		policy = v
diff --git a/.ci/providerlint/vendor/google.golang.org/protobuf/types/descriptorpb/descriptor.pb.go b/.ci/providerlint/vendor/google.golang.org/protobuf/types/descriptorpb/descriptor.pb.go
index abe4ab5115b..04c00f737c1 100644
--- a/.ci/providerlint/vendor/google.golang.org/protobuf/types/descriptorpb/descriptor.pb.go
+++ b/.ci/providerlint/vendor/google.golang.org/protobuf/types/descriptorpb/descriptor.pb.go
@@ -48,6 +48,64 @@ import (
 	sync "sync"
 )
 
+// The verification state of the extension range.
+type ExtensionRangeOptions_VerificationState int32
+
+const (
+	// All the extensions of the range must be declared.
+	ExtensionRangeOptions_DECLARATION ExtensionRangeOptions_VerificationState = 0
+	ExtensionRangeOptions_UNVERIFIED  ExtensionRangeOptions_VerificationState = 1
+)
+
+// Enum value maps for ExtensionRangeOptions_VerificationState.
+var (
+	ExtensionRangeOptions_VerificationState_name = map[int32]string{
+		0: "DECLARATION",
+		1: "UNVERIFIED",
+	}
+	ExtensionRangeOptions_VerificationState_value = map[string]int32{
+		"DECLARATION": 0,
+		"UNVERIFIED":  1,
+	}
+)
+
+func (x ExtensionRangeOptions_VerificationState) Enum() *ExtensionRangeOptions_VerificationState {
+	p := new(ExtensionRangeOptions_VerificationState)
+	*p = x
+	return p
+}
+
+func (x ExtensionRangeOptions_VerificationState) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (ExtensionRangeOptions_VerificationState) Descriptor() protoreflect.EnumDescriptor {
+	return file_google_protobuf_descriptor_proto_enumTypes[0].Descriptor()
+}
+
+func (ExtensionRangeOptions_VerificationState) Type() protoreflect.EnumType {
+	return &file_google_protobuf_descriptor_proto_enumTypes[0]
+}
+
+func (x ExtensionRangeOptions_VerificationState) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Do not use.
+func (x *ExtensionRangeOptions_VerificationState) UnmarshalJSON(b []byte) error {
+	num, err := protoimpl.X.UnmarshalJSONEnum(x.Descriptor(), b)
+	if err != nil {
+		return err
+	}
+	*x = ExtensionRangeOptions_VerificationState(num)
+	return nil
+}
+
+// Deprecated: Use ExtensionRangeOptions_VerificationState.Descriptor instead.
+func (ExtensionRangeOptions_VerificationState) EnumDescriptor() ([]byte, []int) {
+	return file_google_protobuf_descriptor_proto_rawDescGZIP(), []int{3, 0}
+}
+
 type FieldDescriptorProto_Type int32
 
 const (
@@ -137,11 +195,11 @@ func (x FieldDescriptorProto_Type) String() string {
 }
 
 func (FieldDescriptorProto_Type) Descriptor() protoreflect.EnumDescriptor {
-	return file_google_protobuf_descriptor_proto_enumTypes[0].Descriptor()
+	return file_google_protobuf_descriptor_proto_enumTypes[1].Descriptor()
 }
 
 func (FieldDescriptorProto_Type) Type() protoreflect.EnumType {
-	return &file_google_protobuf_descriptor_proto_enumTypes[0]
+	return &file_google_protobuf_descriptor_proto_enumTypes[1]
 }
 
 func (x FieldDescriptorProto_Type) Number() protoreflect.EnumNumber {
@@ -197,11 +255,11 @@ func (x FieldDescriptorProto_Label) String() string {
 }
 
 func (FieldDescriptorProto_Label) Descriptor() protoreflect.EnumDescriptor {
-	return file_google_protobuf_descriptor_proto_enumTypes[1].Descriptor()
+	return file_google_protobuf_descriptor_proto_enumTypes[2].Descriptor()
 }
 
 func (FieldDescriptorProto_Label) Type() protoreflect.EnumType {
-	return &file_google_protobuf_descriptor_proto_enumTypes[1]
+	return &file_google_protobuf_descriptor_proto_enumTypes[2]
 }
 
 func (x FieldDescriptorProto_Label) Number() protoreflect.EnumNumber {
@@ -258,11 +316,11 @@ func (x FileOptions_OptimizeMode) String() string {
 }
 
 func (FileOptions_OptimizeMode) Descriptor() protoreflect.EnumDescriptor {
-	return file_google_protobuf_descriptor_proto_enumTypes[2].Descriptor()
+	return file_google_protobuf_descriptor_proto_enumTypes[3].Descriptor()
 }
 
 func (FileOptions_OptimizeMode) Type() protoreflect.EnumType {
-	return &file_google_protobuf_descriptor_proto_enumTypes[2]
+	return &file_google_protobuf_descriptor_proto_enumTypes[3]
 }
 
 func (x FileOptions_OptimizeMode) Number() protoreflect.EnumNumber {
@@ -288,7 +346,13 @@ type FieldOptions_CType int32
 
 const (
 	// Default mode.
-	FieldOptions_STRING       FieldOptions_CType = 0
+	FieldOptions_STRING FieldOptions_CType = 0
+	// The option [ctype=CORD] may be applied to a non-repeated field of type
+	// "bytes". It indicates that in C++, the data should be stored in a Cord
+	// instead of a string.  For very large strings, this may reduce memory
+	// fragmentation. It may also allow better performance when parsing from a
+	// Cord, or when parsing with aliasing enabled, as the parsed Cord may then
+	// alias the original buffer.
 	FieldOptions_CORD         FieldOptions_CType = 1
 	FieldOptions_STRING_PIECE FieldOptions_CType = 2
 )
@@ -318,11 +382,11 @@ func (x FieldOptions_CType) String() string {
 }
 
 func (FieldOptions_CType) Descriptor() protoreflect.EnumDescriptor {
-	return file_google_protobuf_descriptor_proto_enumTypes[3].Descriptor()
+	return file_google_protobuf_descriptor_proto_enumTypes[4].Descriptor()
 }
 
 func (FieldOptions_CType) Type() protoreflect.EnumType {
-	return &file_google_protobuf_descriptor_proto_enumTypes[3]
+	return &file_google_protobuf_descriptor_proto_enumTypes[4]
 }
 
 func (x FieldOptions_CType) Number() protoreflect.EnumNumber {
@@ -380,11 +444,11 @@ func (x FieldOptions_JSType) String() string {
 }
 
 func (FieldOptions_JSType) Descriptor() protoreflect.EnumDescriptor {
-	return file_google_protobuf_descriptor_proto_enumTypes[4].Descriptor()
+	return file_google_protobuf_descriptor_proto_enumTypes[5].Descriptor()
 }
 
 func (FieldOptions_JSType) Type() protoreflect.EnumType {
-	return &file_google_protobuf_descriptor_proto_enumTypes[4]
+	return &file_google_protobuf_descriptor_proto_enumTypes[5]
 }
 
 func (x FieldOptions_JSType) Number() protoreflect.EnumNumber {
@@ -406,6 +470,152 @@ func (FieldOptions_JSType) EnumDescriptor() ([]byte, []int) {
 	return file_google_protobuf_descriptor_proto_rawDescGZIP(), []int{12, 1}
 }
 
+// If set to RETENTION_SOURCE, the option will be omitted from the binary.
+// Note: as of January 2023, support for this is in progress and does not yet
+// have an effect (b/264593489).
+type FieldOptions_OptionRetention int32
+
+const (
+	FieldOptions_RETENTION_UNKNOWN FieldOptions_OptionRetention = 0
+	FieldOptions_RETENTION_RUNTIME FieldOptions_OptionRetention = 1
+	FieldOptions_RETENTION_SOURCE  FieldOptions_OptionRetention = 2
+)
+
+// Enum value maps for FieldOptions_OptionRetention.
+var (
+	FieldOptions_OptionRetention_name = map[int32]string{
+		0: "RETENTION_UNKNOWN",
+		1: "RETENTION_RUNTIME",
+		2: "RETENTION_SOURCE",
+	}
+	FieldOptions_OptionRetention_value = map[string]int32{
+		"RETENTION_UNKNOWN": 0,
+		"RETENTION_RUNTIME": 1,
+		"RETENTION_SOURCE":  2,
+	}
+)
+
+func (x FieldOptions_OptionRetention) Enum() *FieldOptions_OptionRetention {
+	p := new(FieldOptions_OptionRetention)
+	*p = x
+	return p
+}
+
+func (x FieldOptions_OptionRetention) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (FieldOptions_OptionRetention) Descriptor() protoreflect.EnumDescriptor {
+	return file_google_protobuf_descriptor_proto_enumTypes[6].Descriptor()
+}
+
+func (FieldOptions_OptionRetention) Type() protoreflect.EnumType {
+	return &file_google_protobuf_descriptor_proto_enumTypes[6]
+}
+
+func (x FieldOptions_OptionRetention) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Do not use.
+func (x *FieldOptions_OptionRetention) UnmarshalJSON(b []byte) error {
+	num, err := protoimpl.X.UnmarshalJSONEnum(x.Descriptor(), b)
+	if err != nil {
+		return err
+	}
+	*x = FieldOptions_OptionRetention(num)
+	return nil
+}
+
+// Deprecated: Use FieldOptions_OptionRetention.Descriptor instead.
+func (FieldOptions_OptionRetention) EnumDescriptor() ([]byte, []int) {
+	return file_google_protobuf_descriptor_proto_rawDescGZIP(), []int{12, 2}
+}
+
+// This indicates the types of entities that the field may apply to when used
+// as an option. If it is unset, then the field may be freely used as an
+// option on any kind of entity. Note: as of January 2023, support for this is
+// in progress and does not yet have an effect (b/264593489).
+type FieldOptions_OptionTargetType int32
+
+const (
+	FieldOptions_TARGET_TYPE_UNKNOWN         FieldOptions_OptionTargetType = 0
+	FieldOptions_TARGET_TYPE_FILE            FieldOptions_OptionTargetType = 1
+	FieldOptions_TARGET_TYPE_EXTENSION_RANGE FieldOptions_OptionTargetType = 2
+	FieldOptions_TARGET_TYPE_MESSAGE         FieldOptions_OptionTargetType = 3
+	FieldOptions_TARGET_TYPE_FIELD           FieldOptions_OptionTargetType = 4
+	FieldOptions_TARGET_TYPE_ONEOF           FieldOptions_OptionTargetType = 5
+	FieldOptions_TARGET_TYPE_ENUM            FieldOptions_OptionTargetType = 6
+	FieldOptions_TARGET_TYPE_ENUM_ENTRY      FieldOptions_OptionTargetType = 7
+	FieldOptions_TARGET_TYPE_SERVICE         FieldOptions_OptionTargetType = 8
+	FieldOptions_TARGET_TYPE_METHOD          FieldOptions_OptionTargetType = 9
+)
+
+// Enum value maps for FieldOptions_OptionTargetType.
+var (
+	FieldOptions_OptionTargetType_name = map[int32]string{
+		0: "TARGET_TYPE_UNKNOWN",
+		1: "TARGET_TYPE_FILE",
+		2: "TARGET_TYPE_EXTENSION_RANGE",
+		3: "TARGET_TYPE_MESSAGE",
+		4: "TARGET_TYPE_FIELD",
+		5: "TARGET_TYPE_ONEOF",
+		6: "TARGET_TYPE_ENUM",
+		7: "TARGET_TYPE_ENUM_ENTRY",
+		8: "TARGET_TYPE_SERVICE",
+		9: "TARGET_TYPE_METHOD",
+	}
+	FieldOptions_OptionTargetType_value = map[string]int32{
+		"TARGET_TYPE_UNKNOWN":         0,
+		"TARGET_TYPE_FILE":            1,
+		"TARGET_TYPE_EXTENSION_RANGE": 2,
+		"TARGET_TYPE_MESSAGE":         3,
+		"TARGET_TYPE_FIELD":           4,
+		"TARGET_TYPE_ONEOF":           5,
+		"TARGET_TYPE_ENUM":            6,
+		"TARGET_TYPE_ENUM_ENTRY":      7,
+		"TARGET_TYPE_SERVICE":         8,
+		"TARGET_TYPE_METHOD":          9,
+	}
+)
+
+func (x FieldOptions_OptionTargetType) Enum() *FieldOptions_OptionTargetType {
+	p := new(FieldOptions_OptionTargetType)
+	*p = x
+	return p
+}
+
+func (x FieldOptions_OptionTargetType) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (FieldOptions_OptionTargetType) Descriptor() protoreflect.EnumDescriptor {
+	return file_google_protobuf_descriptor_proto_enumTypes[7].Descriptor()
+}
+
+func (FieldOptions_OptionTargetType) Type() protoreflect.EnumType {
+	return &file_google_protobuf_descriptor_proto_enumTypes[7]
+}
+
+func (x FieldOptions_OptionTargetType) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Do not use.
+func (x *FieldOptions_OptionTargetType) UnmarshalJSON(b []byte) error {
+	num, err := protoimpl.X.UnmarshalJSONEnum(x.Descriptor(), b)
+	if err != nil {
+		return err
+	}
+	*x = FieldOptions_OptionTargetType(num)
+	return nil
+}
+
+// Deprecated: Use FieldOptions_OptionTargetType.Descriptor instead.
+func (FieldOptions_OptionTargetType) EnumDescriptor() ([]byte, []int) {
+	return file_google_protobuf_descriptor_proto_rawDescGZIP(), []int{12, 3}
+}
+
 // Is this method side-effect-free (or safe in HTTP parlance), or idempotent,
 // or neither? HTTP based RPC implementation may choose GET verb for safe
 // methods, and PUT verb for idempotent methods instead of the default POST.
@@ -442,11 +652,11 @@ func (x MethodOptions_IdempotencyLevel) String() string {
 }
 
 func (MethodOptions_IdempotencyLevel) Descriptor() protoreflect.EnumDescriptor {
-	return file_google_protobuf_descriptor_proto_enumTypes[5].Descriptor()
+	return file_google_protobuf_descriptor_proto_enumTypes[8].Descriptor()
 }
 
 func (MethodOptions_IdempotencyLevel) Type() protoreflect.EnumType {
-	return &file_google_protobuf_descriptor_proto_enumTypes[5]
+	return &file_google_protobuf_descriptor_proto_enumTypes[8]
 }
 
 func (x MethodOptions_IdempotencyLevel) Number() protoreflect.EnumNumber {
@@ -468,6 +678,70 @@ func (MethodOptions_IdempotencyLevel) EnumDescriptor() ([]byte, []int) {
 	return file_google_protobuf_descriptor_proto_rawDescGZIP(), []int{17, 0}
 }
 
+// Represents the identified object's effect on the element in the original
+// .proto file.
+type GeneratedCodeInfo_Annotation_Semantic int32
+
+const (
+	// There is no effect or the effect is indescribable.
+	GeneratedCodeInfo_Annotation_NONE GeneratedCodeInfo_Annotation_Semantic = 0
+	// The element is set or otherwise mutated.
+	GeneratedCodeInfo_Annotation_SET GeneratedCodeInfo_Annotation_Semantic = 1
+	// An alias to the element is returned.
+	GeneratedCodeInfo_Annotation_ALIAS GeneratedCodeInfo_Annotation_Semantic = 2
+)
+
+// Enum value maps for GeneratedCodeInfo_Annotation_Semantic.
+var (
+	GeneratedCodeInfo_Annotation_Semantic_name = map[int32]string{
+		0: "NONE",
+		1: "SET",
+		2: "ALIAS",
+	}
+	GeneratedCodeInfo_Annotation_Semantic_value = map[string]int32{
+		"NONE":  0,
+		"SET":   1,
+		"ALIAS": 2,
+	}
+)
+
+func (x GeneratedCodeInfo_Annotation_Semantic) Enum() *GeneratedCodeInfo_Annotation_Semantic {
+	p := new(GeneratedCodeInfo_Annotation_Semantic)
+	*p = x
+	return p
+}
+
+func (x GeneratedCodeInfo_Annotation_Semantic) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (GeneratedCodeInfo_Annotation_Semantic) Descriptor() protoreflect.EnumDescriptor {
+	return file_google_protobuf_descriptor_proto_enumTypes[9].Descriptor()
+}
+
+func (GeneratedCodeInfo_Annotation_Semantic) Type() protoreflect.EnumType {
+	return &file_google_protobuf_descriptor_proto_enumTypes[9]
+}
+
+func (x GeneratedCodeInfo_Annotation_Semantic) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Do not use.
+func (x *GeneratedCodeInfo_Annotation_Semantic) UnmarshalJSON(b []byte) error {
+	num, err := protoimpl.X.UnmarshalJSONEnum(x.Descriptor(), b)
+	if err != nil {
+		return err
+	}
+	*x = GeneratedCodeInfo_Annotation_Semantic(num)
+	return nil
+}
+
+// Deprecated: Use GeneratedCodeInfo_Annotation_Semantic.Descriptor instead.
+func (GeneratedCodeInfo_Annotation_Semantic) EnumDescriptor() ([]byte, []int) {
+	return file_google_protobuf_descriptor_proto_rawDescGZIP(), []int{20, 0, 0}
+}
+
 // The protocol compiler can output a FileDescriptorSet containing the .proto
 // files it parses.
 type FileDescriptorSet struct {
@@ -544,8 +818,12 @@ type FileDescriptorProto struct {
 	// development tools.
 	SourceCodeInfo *SourceCodeInfo `protobuf:"bytes,9,opt,name=source_code_info,json=sourceCodeInfo" json:"source_code_info,omitempty"`
 	// The syntax of the proto file.
-	// The supported values are "proto2" and "proto3".
+	// The supported values are "proto2", "proto3", and "editions".
+	//
+	// If `edition` is present, this value must be "editions".
 	Syntax *string `protobuf:"bytes,12,opt,name=syntax" json:"syntax,omitempty"`
+	// The edition of the proto file, which is an opaque string.
+	Edition *string `protobuf:"bytes,13,opt,name=edition" json:"edition,omitempty"`
 }
 
 func (x *FileDescriptorProto) Reset() {
@@ -664,6 +942,13 @@ func (x *FileDescriptorProto) GetSyntax() string {
 	return ""
 }
 
+func (x *FileDescriptorProto) GetEdition() string {
+	if x != nil && x.Edition != nil {
+		return *x.Edition
+	}
+	return ""
+}
+
 // Describes a message type.
 type DescriptorProto struct {
 	state         protoimpl.MessageState
@@ -794,7 +1079,21 @@ type ExtensionRangeOptions struct {
 
 	// The parser stores options it doesn't recognize here. See above.
 	UninterpretedOption []*UninterpretedOption `protobuf:"bytes,999,rep,name=uninterpreted_option,json=uninterpretedOption" json:"uninterpreted_option,omitempty"`
-}
+	// go/protobuf-stripping-extension-declarations
+	// Like Metadata, but we use a repeated field to hold all extension
+	// declarations. This should avoid the size increases of transforming a large
+	// extension range into small ranges in generated binaries.
+	Declaration []*ExtensionRangeOptions_Declaration `protobuf:"bytes,2,rep,name=declaration" json:"declaration,omitempty"`
+	// The verification state of the range.
+	// TODO(b/278783756): flip the default to DECLARATION once all empty ranges
+	// are marked as UNVERIFIED.
+	Verification *ExtensionRangeOptions_VerificationState `protobuf:"varint,3,opt,name=verification,enum=google.protobuf.ExtensionRangeOptions_VerificationState,def=1" json:"verification,omitempty"`
+}
+
+// Default values for ExtensionRangeOptions fields.
+const (
+	Default_ExtensionRangeOptions_Verification = ExtensionRangeOptions_UNVERIFIED
+)
 
 func (x *ExtensionRangeOptions) Reset() {
 	*x = ExtensionRangeOptions{}
@@ -835,6 +1134,20 @@ func (x *ExtensionRangeOptions) GetUninterpretedOption() []*UninterpretedOption
 	return nil
 }
 
+func (x *ExtensionRangeOptions) GetDeclaration() []*ExtensionRangeOptions_Declaration {
+	if x != nil {
+		return x.Declaration
+	}
+	return nil
+}
+
+func (x *ExtensionRangeOptions) GetVerification() ExtensionRangeOptions_VerificationState {
+	if x != nil && x.Verification != nil {
+		return *x.Verification
+	}
+	return Default_ExtensionRangeOptions_Verification
+}
+
 // Describes a field within a message.
 type FieldDescriptorProto struct {
 	state         protoimpl.MessageState
@@ -860,7 +1173,6 @@ type FieldDescriptorProto struct {
 	// For booleans, "true" or "false".
 	// For strings, contains the default text contents (not escaped in any way).
 	// For bytes, contains the C escaped value.  All bytes >= 128 are escaped.
-	// TODO(kenton):  Base-64 encode?
 	DefaultValue *string `protobuf:"bytes,7,opt,name=default_value,json=defaultValue" json:"default_value,omitempty"`
 	// If set, gives the index of a oneof in the containing type's oneof_decl
 	// list.  This field is a member of that oneof.
@@ -1382,22 +1694,22 @@ type FileOptions struct {
 	// inappropriate because proto packages do not normally start with backwards
 	// domain names.
 	JavaPackage *string `protobuf:"bytes,1,opt,name=java_package,json=javaPackage" json:"java_package,omitempty"`
-	// If set, all the classes from the .proto file are wrapped in a single
-	// outer class with the given name.  This applies to both Proto1
-	// (equivalent to the old "--one_java_file" option) and Proto2 (where
-	// a .proto always translates to a single class, but you may want to
-	// explicitly choose the class name).
+	// Controls the name of the wrapper Java class generated for the .proto file.
+	// That class will always contain the .proto file's getDescriptor() method as
+	// well as any top-level extensions defined in the .proto file.
+	// If java_multiple_files is disabled, then all the other classes from the
+	// .proto file will be nested inside the single wrapper outer class.
 	JavaOuterClassname *string `protobuf:"bytes,8,opt,name=java_outer_classname,json=javaOuterClassname" json:"java_outer_classname,omitempty"`
-	// If set true, then the Java code generator will generate a separate .java
+	// If enabled, then the Java code generator will generate a separate .java
 	// file for each top-level message, enum, and service defined in the .proto
-	// file.  Thus, these types will *not* be nested inside the outer class
-	// named by java_outer_classname.  However, the outer class will still be
+	// file.  Thus, these types will *not* be nested inside the wrapper class
+	// named by java_outer_classname.  However, the wrapper class will still be
 	// generated to contain the file's getDescriptor() method as well as any
 	// top-level extensions defined in the file.
 	JavaMultipleFiles *bool `protobuf:"varint,10,opt,name=java_multiple_files,json=javaMultipleFiles,def=0" json:"java_multiple_files,omitempty"`
 	// This option does nothing.
 	//
-	// Deprecated: Do not use.
+	// Deprecated: Marked as deprecated in google/protobuf/descriptor.proto.
 	JavaGenerateEqualsAndHash *bool `protobuf:"varint,20,opt,name=java_generate_equals_and_hash,json=javaGenerateEqualsAndHash" json:"java_generate_equals_and_hash,omitempty"`
 	// If set true, then the Java2 code generator will generate code that
 	// throws an exception whenever an attempt is made to assign a non-UTF-8
@@ -1531,7 +1843,7 @@ func (x *FileOptions) GetJavaMultipleFiles() bool {
 	return Default_FileOptions_JavaMultipleFiles
 }
 
-// Deprecated: Do not use.
+// Deprecated: Marked as deprecated in google/protobuf/descriptor.proto.
 func (x *FileOptions) GetJavaGenerateEqualsAndHash() bool {
 	if x != nil && x.JavaGenerateEqualsAndHash != nil {
 		return *x.JavaGenerateEqualsAndHash
@@ -1670,10 +1982,12 @@ type MessageOptions struct {
 	// efficient, has fewer features, and is more complicated.
 	//
 	// The message must be defined exactly as follows:
-	//   message Foo {
-	//     option message_set_wire_format = true;
-	//     extensions 4 to max;
-	//   }
+	//
+	//	message Foo {
+	//	  option message_set_wire_format = true;
+	//	  extensions 4 to max;
+	//	}
+	//
 	// Note that the message cannot have any defined fields; MessageSets only
 	// have extensions.
 	//
@@ -1692,28 +2006,44 @@ type MessageOptions struct {
 	// for the message, or it will be completely ignored; in the very least,
 	// this is a formalization for deprecating messages.
 	Deprecated *bool `protobuf:"varint,3,opt,name=deprecated,def=0" json:"deprecated,omitempty"`
+	// NOTE: Do not set the option in .proto files. Always use the maps syntax
+	// instead. The option should only be implicitly set by the proto compiler
+	// parser.
+	//
 	// Whether the message is an automatically generated map entry type for the
 	// maps field.
 	//
 	// For maps fields:
-	//     map<KeyType, ValueType> map_field = 1;
+	//
+	//	map<KeyType, ValueType> map_field = 1;
+	//
 	// The parsed descriptor looks like:
-	//     message MapFieldEntry {
-	//         option map_entry = true;
-	//         optional KeyType key = 1;
-	//         optional ValueType value = 2;
-	//     }
-	//     repeated MapFieldEntry map_field = 1;
+	//
+	//	message MapFieldEntry {
+	//	    option map_entry = true;
+	//	    optional KeyType key = 1;
+	//	    optional ValueType value = 2;
+	//	}
+	//	repeated MapFieldEntry map_field = 1;
 	//
 	// Implementations may choose not to generate the map_entry=true message, but
 	// use a native map in the target language to hold the keys and values.
 	// The reflection APIs in such implementations still need to work as
 	// if the field is a repeated message field.
-	//
-	// NOTE: Do not set the option in .proto files. Always use the maps syntax
-	// instead. The option should only be implicitly set by the proto compiler
-	// parser.
 	MapEntry *bool `protobuf:"varint,7,opt,name=map_entry,json=mapEntry" json:"map_entry,omitempty"`
+	// Enable the legacy handling of JSON field name conflicts.  This lowercases
+	// and strips underscored from the fields before comparison in proto3 only.
+	// The new behavior takes `json_name` into account and applies to proto2 as
+	// well.
+	//
+	// This should only be used as a temporary measure against broken builds due
+	// to the change in behavior for JSON field name conflicts.
+	//
+	// TODO(b/261750190) This is legacy behavior we plan to remove once downstream
+	// teams have had time to migrate.
+	//
+	// Deprecated: Marked as deprecated in google/protobuf/descriptor.proto.
+	DeprecatedLegacyJsonFieldConflicts *bool `protobuf:"varint,11,opt,name=deprecated_legacy_json_field_conflicts,json=deprecatedLegacyJsonFieldConflicts" json:"deprecated_legacy_json_field_conflicts,omitempty"`
 	// The parser stores options it doesn't recognize here. See above.
 	UninterpretedOption []*UninterpretedOption `protobuf:"bytes,999,rep,name=uninterpreted_option,json=uninterpretedOption" json:"uninterpreted_option,omitempty"`
 }
@@ -1785,6 +2115,14 @@ func (x *MessageOptions) GetMapEntry() bool {
 	return false
 }
 
+// Deprecated: Marked as deprecated in google/protobuf/descriptor.proto.
+func (x *MessageOptions) GetDeprecatedLegacyJsonFieldConflicts() bool {
+	if x != nil && x.DeprecatedLegacyJsonFieldConflicts != nil {
+		return *x.DeprecatedLegacyJsonFieldConflicts
+	}
+	return false
+}
+
 func (x *MessageOptions) GetUninterpretedOption() []*UninterpretedOption {
 	if x != nil {
 		return x.UninterpretedOption
@@ -1800,8 +2138,10 @@ type FieldOptions struct {
 
 	// The ctype option instructs the C++ code generator to use a different
 	// representation of the field than it normally would.  See the specific
-	// options below.  This option is not yet implemented in the open source
-	// release -- sorry, we'll try to include it in a future version!
+	// options below.  This option is only implemented to support use of
+	// [ctype=CORD] and [ctype=STRING] (the default) on non-repeated fields of
+	// type "bytes" in the open source release -- sorry, we'll try to include
+	// other types in a future version!
 	Ctype *FieldOptions_CType `protobuf:"varint,1,opt,name=ctype,enum=google.protobuf.FieldOptions_CType,def=0" json:"ctype,omitempty"`
 	// The packed option can be enabled for repeated primitive fields to enable
 	// a more efficient representation on the wire. Rather than repeatedly
@@ -1838,7 +2178,6 @@ type FieldOptions struct {
 	// call from multiple threads concurrently, while non-const methods continue
 	// to require exclusive access.
 	//
-	//
 	// Note that implementations may choose not to check required fields within
 	// a lazy sub-message.  That is, calling IsInitialized() on the outer message
 	// may return true even if the inner message has missing required fields.
@@ -1849,7 +2188,14 @@ type FieldOptions struct {
 	// implementation must either *always* check its required fields, or *never*
 	// check its required fields, regardless of whether or not the message has
 	// been parsed.
+	//
+	// As of May 2022, lazy verifies the contents of the byte stream during
+	// parsing.  An invalid byte stream will cause the overall parsing to fail.
 	Lazy *bool `protobuf:"varint,5,opt,name=lazy,def=0" json:"lazy,omitempty"`
+	// unverified_lazy does no correctness checks on the byte stream. This should
+	// only be used where lazy with verification is prohibitive for performance
+	// reasons.
+	UnverifiedLazy *bool `protobuf:"varint,15,opt,name=unverified_lazy,json=unverifiedLazy,def=0" json:"unverified_lazy,omitempty"`
 	// Is this field deprecated?
 	// Depending on the target platform, this can emit Deprecated annotations
 	// for accessors, or it will be completely ignored; in the very least, this
@@ -1857,17 +2203,26 @@ type FieldOptions struct {
 	Deprecated *bool `protobuf:"varint,3,opt,name=deprecated,def=0" json:"deprecated,omitempty"`
 	// For Google-internal migration only. Do not use.
 	Weak *bool `protobuf:"varint,10,opt,name=weak,def=0" json:"weak,omitempty"`
+	// Indicate that the field value should not be printed out when using debug
+	// formats, e.g. when the field contains sensitive credentials.
+	DebugRedact *bool                         `protobuf:"varint,16,opt,name=debug_redact,json=debugRedact,def=0" json:"debug_redact,omitempty"`
+	Retention   *FieldOptions_OptionRetention `protobuf:"varint,17,opt,name=retention,enum=google.protobuf.FieldOptions_OptionRetention" json:"retention,omitempty"`
+	// Deprecated: Marked as deprecated in google/protobuf/descriptor.proto.
+	Target  *FieldOptions_OptionTargetType  `protobuf:"varint,18,opt,name=target,enum=google.protobuf.FieldOptions_OptionTargetType" json:"target,omitempty"`
+	Targets []FieldOptions_OptionTargetType `protobuf:"varint,19,rep,name=targets,enum=google.protobuf.FieldOptions_OptionTargetType" json:"targets,omitempty"`
 	// The parser stores options it doesn't recognize here. See above.
 	UninterpretedOption []*UninterpretedOption `protobuf:"bytes,999,rep,name=uninterpreted_option,json=uninterpretedOption" json:"uninterpreted_option,omitempty"`
 }
 
 // Default values for FieldOptions fields.
 const (
-	Default_FieldOptions_Ctype      = FieldOptions_STRING
-	Default_FieldOptions_Jstype     = FieldOptions_JS_NORMAL
-	Default_FieldOptions_Lazy       = bool(false)
-	Default_FieldOptions_Deprecated = bool(false)
-	Default_FieldOptions_Weak       = bool(false)
+	Default_FieldOptions_Ctype          = FieldOptions_STRING
+	Default_FieldOptions_Jstype         = FieldOptions_JS_NORMAL
+	Default_FieldOptions_Lazy           = bool(false)
+	Default_FieldOptions_UnverifiedLazy = bool(false)
+	Default_FieldOptions_Deprecated     = bool(false)
+	Default_FieldOptions_Weak           = bool(false)
+	Default_FieldOptions_DebugRedact    = bool(false)
 )
 
 func (x *FieldOptions) Reset() {
@@ -1930,6 +2285,13 @@ func (x *FieldOptions) GetLazy() bool {
 	return Default_FieldOptions_Lazy
 }
 
+func (x *FieldOptions) GetUnverifiedLazy() bool {
+	if x != nil && x.UnverifiedLazy != nil {
+		return *x.UnverifiedLazy
+	}
+	return Default_FieldOptions_UnverifiedLazy
+}
+
 func (x *FieldOptions) GetDeprecated() bool {
 	if x != nil && x.Deprecated != nil {
 		return *x.Deprecated
@@ -1944,6 +2306,35 @@ func (x *FieldOptions) GetWeak() bool {
 	return Default_FieldOptions_Weak
 }
 
+func (x *FieldOptions) GetDebugRedact() bool {
+	if x != nil && x.DebugRedact != nil {
+		return *x.DebugRedact
+	}
+	return Default_FieldOptions_DebugRedact
+}
+
+func (x *FieldOptions) GetRetention() FieldOptions_OptionRetention {
+	if x != nil && x.Retention != nil {
+		return *x.Retention
+	}
+	return FieldOptions_RETENTION_UNKNOWN
+}
+
+// Deprecated: Marked as deprecated in google/protobuf/descriptor.proto.
+func (x *FieldOptions) GetTarget() FieldOptions_OptionTargetType {
+	if x != nil && x.Target != nil {
+		return *x.Target
+	}
+	return FieldOptions_TARGET_TYPE_UNKNOWN
+}
+
+func (x *FieldOptions) GetTargets() []FieldOptions_OptionTargetType {
+	if x != nil {
+		return x.Targets
+	}
+	return nil
+}
+
 func (x *FieldOptions) GetUninterpretedOption() []*UninterpretedOption {
 	if x != nil {
 		return x.UninterpretedOption
@@ -2014,6 +2405,15 @@ type EnumOptions struct {
 	// for the enum, or it will be completely ignored; in the very least, this
 	// is a formalization for deprecating enums.
 	Deprecated *bool `protobuf:"varint,3,opt,name=deprecated,def=0" json:"deprecated,omitempty"`
+	// Enable the legacy handling of JSON field name conflicts.  This lowercases
+	// and strips underscored from the fields before comparison in proto3 only.
+	// The new behavior takes `json_name` into account and applies to proto2 as
+	// well.
+	// TODO(b/261750190) Remove this legacy behavior once downstream teams have
+	// had time to migrate.
+	//
+	// Deprecated: Marked as deprecated in google/protobuf/descriptor.proto.
+	DeprecatedLegacyJsonFieldConflicts *bool `protobuf:"varint,6,opt,name=deprecated_legacy_json_field_conflicts,json=deprecatedLegacyJsonFieldConflicts" json:"deprecated_legacy_json_field_conflicts,omitempty"`
 	// The parser stores options it doesn't recognize here. See above.
 	UninterpretedOption []*UninterpretedOption `protobuf:"bytes,999,rep,name=uninterpreted_option,json=uninterpretedOption" json:"uninterpreted_option,omitempty"`
 }
@@ -2069,6 +2469,14 @@ func (x *EnumOptions) GetDeprecated() bool {
 	return Default_EnumOptions_Deprecated
 }
 
+// Deprecated: Marked as deprecated in google/protobuf/descriptor.proto.
+func (x *EnumOptions) GetDeprecatedLegacyJsonFieldConflicts() bool {
+	if x != nil && x.DeprecatedLegacyJsonFieldConflicts != nil {
+		return *x.DeprecatedLegacyJsonFieldConflicts
+	}
+	return false
+}
+
 func (x *EnumOptions) GetUninterpretedOption() []*UninterpretedOption {
 	if x != nil {
 		return x.UninterpretedOption
@@ -2399,43 +2807,48 @@ type SourceCodeInfo struct {
 	// tools.
 	//
 	// For example, say we have a file like:
-	//   message Foo {
-	//     optional string foo = 1;
-	//   }
+	//
+	//	message Foo {
+	//	  optional string foo = 1;
+	//	}
+	//
 	// Let's look at just the field definition:
-	//   optional string foo = 1;
-	//   ^       ^^     ^^  ^  ^^^
-	//   a       bc     de  f  ghi
+	//
+	//	optional string foo = 1;
+	//	^       ^^     ^^  ^  ^^^
+	//	a       bc     de  f  ghi
+	//
 	// We have the following locations:
-	//   span   path               represents
-	//   [a,i)  [ 4, 0, 2, 0 ]     The whole field definition.
-	//   [a,b)  [ 4, 0, 2, 0, 4 ]  The label (optional).
-	//   [c,d)  [ 4, 0, 2, 0, 5 ]  The type (string).
-	//   [e,f)  [ 4, 0, 2, 0, 1 ]  The name (foo).
-	//   [g,h)  [ 4, 0, 2, 0, 3 ]  The number (1).
+	//
+	//	span   path               represents
+	//	[a,i)  [ 4, 0, 2, 0 ]     The whole field definition.
+	//	[a,b)  [ 4, 0, 2, 0, 4 ]  The label (optional).
+	//	[c,d)  [ 4, 0, 2, 0, 5 ]  The type (string).
+	//	[e,f)  [ 4, 0, 2, 0, 1 ]  The name (foo).
+	//	[g,h)  [ 4, 0, 2, 0, 3 ]  The number (1).
 	//
 	// Notes:
-	// - A location may refer to a repeated field itself (i.e. not to any
-	//   particular index within it).  This is used whenever a set of elements are
-	//   logically enclosed in a single code segment.  For example, an entire
-	//   extend block (possibly containing multiple extension definitions) will
-	//   have an outer location whose path refers to the "extensions" repeated
-	//   field without an index.
-	// - Multiple locations may have the same path.  This happens when a single
-	//   logical declaration is spread out across multiple places.  The most
-	//   obvious example is the "extend" block again -- there may be multiple
-	//   extend blocks in the same scope, each of which will have the same path.
-	// - A location's span is not always a subset of its parent's span.  For
-	//   example, the "extendee" of an extension declaration appears at the
-	//   beginning of the "extend" block and is shared by all extensions within
-	//   the block.
-	// - Just because a location's span is a subset of some other location's span
-	//   does not mean that it is a descendant.  For example, a "group" defines
-	//   both a type and a field in a single declaration.  Thus, the locations
-	//   corresponding to the type and field and their components will overlap.
-	// - Code which tries to interpret locations should probably be designed to
-	//   ignore those that it doesn't understand, as more types of locations could
-	//   be recorded in the future.
+	//   - A location may refer to a repeated field itself (i.e. not to any
+	//     particular index within it).  This is used whenever a set of elements are
+	//     logically enclosed in a single code segment.  For example, an entire
+	//     extend block (possibly containing multiple extension definitions) will
+	//     have an outer location whose path refers to the "extensions" repeated
+	//     field without an index.
+	//   - Multiple locations may have the same path.  This happens when a single
+	//     logical declaration is spread out across multiple places.  The most
+	//     obvious example is the "extend" block again -- there may be multiple
+	//     extend blocks in the same scope, each of which will have the same path.
+	//   - A location's span is not always a subset of its parent's span.  For
+	//     example, the "extendee" of an extension declaration appears at the
+	//     beginning of the "extend" block and is shared by all extensions within
+	//     the block.
+	//   - Just because a location's span is a subset of some other location's span
+	//     does not mean that it is a descendant.  For example, a "group" defines
+	//     both a type and a field in a single declaration.  Thus, the locations
+	//     corresponding to the type and field and their components will overlap.
+	//   - Code which tries to interpret locations should probably be designed to
+	//     ignore those that it doesn't understand, as more types of locations could
+	//     be recorded in the future.
 	Location []*SourceCodeInfo_Location `protobuf:"bytes,1,rep,name=location" json:"location,omitempty"`
 }
 
@@ -2651,6 +3064,108 @@ func (x *DescriptorProto_ReservedRange) GetEnd() int32 {
 	return 0
 }
 
+type ExtensionRangeOptions_Declaration struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// The extension number declared within the extension range.
+	Number *int32 `protobuf:"varint,1,opt,name=number" json:"number,omitempty"`
+	// The fully-qualified name of the extension field. There must be a leading
+	// dot in front of the full name.
+	FullName *string `protobuf:"bytes,2,opt,name=full_name,json=fullName" json:"full_name,omitempty"`
+	// The fully-qualified type name of the extension field. Unlike
+	// Metadata.type, Declaration.type must have a leading dot for messages
+	// and enums.
+	Type *string `protobuf:"bytes,3,opt,name=type" json:"type,omitempty"`
+	// Deprecated. Please use "repeated".
+	//
+	// Deprecated: Marked as deprecated in google/protobuf/descriptor.proto.
+	IsRepeated *bool `protobuf:"varint,4,opt,name=is_repeated,json=isRepeated" json:"is_repeated,omitempty"`
+	// If true, indicates that the number is reserved in the extension range,
+	// and any extension field with the number will fail to compile. Set this
+	// when a declared extension field is deleted.
+	Reserved *bool `protobuf:"varint,5,opt,name=reserved" json:"reserved,omitempty"`
+	// If true, indicates that the extension must be defined as repeated.
+	// Otherwise the extension must be defined as optional.
+	Repeated *bool `protobuf:"varint,6,opt,name=repeated" json:"repeated,omitempty"`
+}
+
+func (x *ExtensionRangeOptions_Declaration) Reset() {
+	*x = ExtensionRangeOptions_Declaration{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_google_protobuf_descriptor_proto_msgTypes[23]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ExtensionRangeOptions_Declaration) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ExtensionRangeOptions_Declaration) ProtoMessage() {}
+
+func (x *ExtensionRangeOptions_Declaration) ProtoReflect() protoreflect.Message {
+	mi := &file_google_protobuf_descriptor_proto_msgTypes[23]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ExtensionRangeOptions_Declaration.ProtoReflect.Descriptor instead.
+func (*ExtensionRangeOptions_Declaration) Descriptor() ([]byte, []int) {
+	return file_google_protobuf_descriptor_proto_rawDescGZIP(), []int{3, 0}
+}
+
+func (x *ExtensionRangeOptions_Declaration) GetNumber() int32 {
+	if x != nil && x.Number != nil {
+		return *x.Number
+	}
+	return 0
+}
+
+func (x *ExtensionRangeOptions_Declaration) GetFullName() string {
+	if x != nil && x.FullName != nil {
+		return *x.FullName
+	}
+	return ""
+}
+
+func (x *ExtensionRangeOptions_Declaration) GetType() string {
+	if x != nil && x.Type != nil {
+		return *x.Type
+	}
+	return ""
+}
+
+// Deprecated: Marked as deprecated in google/protobuf/descriptor.proto.
+func (x *ExtensionRangeOptions_Declaration) GetIsRepeated() bool {
+	if x != nil && x.IsRepeated != nil {
+		return *x.IsRepeated
+	}
+	return false
+}
+
+func (x *ExtensionRangeOptions_Declaration) GetReserved() bool {
+	if x != nil && x.Reserved != nil {
+		return *x.Reserved
+	}
+	return false
+}
+
+func (x *ExtensionRangeOptions_Declaration) GetRepeated() bool {
+	if x != nil && x.Repeated != nil {
+		return *x.Repeated
+	}
+	return false
+}
+
 // Range of reserved numeric values. Reserved values may not be used by
 // entries in the same enum. Reserved ranges may not overlap.
 //
@@ -2669,7 +3184,7 @@ type EnumDescriptorProto_EnumReservedRange struct {
 func (x *EnumDescriptorProto_EnumReservedRange) Reset() {
 	*x = EnumDescriptorProto_EnumReservedRange{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_google_protobuf_descriptor_proto_msgTypes[23]
+		mi := &file_google_protobuf_descriptor_proto_msgTypes[24]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2682,7 +3197,7 @@ func (x *EnumDescriptorProto_EnumReservedRange) String() string {
 func (*EnumDescriptorProto_EnumReservedRange) ProtoMessage() {}
 
 func (x *EnumDescriptorProto_EnumReservedRange) ProtoReflect() protoreflect.Message {
-	mi := &file_google_protobuf_descriptor_proto_msgTypes[23]
+	mi := &file_google_protobuf_descriptor_proto_msgTypes[24]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2715,8 +3230,8 @@ func (x *EnumDescriptorProto_EnumReservedRange) GetEnd() int32 {
 // The name of the uninterpreted option.  Each string represents a segment in
 // a dot-separated name.  is_extension is true iff a segment represents an
 // extension (denoted with parentheses in options specs in .proto files).
-// E.g.,{ ["foo", false], ["bar.baz", true], ["qux", false] } represents
-// "foo.(bar.baz).qux".
+// E.g.,{ ["foo", false], ["bar.baz", true], ["moo", false] } represents
+// "foo.(bar.baz).moo".
 type UninterpretedOption_NamePart struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -2729,7 +3244,7 @@ type UninterpretedOption_NamePart struct {
 func (x *UninterpretedOption_NamePart) Reset() {
 	*x = UninterpretedOption_NamePart{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_google_protobuf_descriptor_proto_msgTypes[24]
+		mi := &file_google_protobuf_descriptor_proto_msgTypes[25]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2742,7 +3257,7 @@ func (x *UninterpretedOption_NamePart) String() string {
 func (*UninterpretedOption_NamePart) ProtoMessage() {}
 
 func (x *UninterpretedOption_NamePart) ProtoReflect() protoreflect.Message {
-	mi := &file_google_protobuf_descriptor_proto_msgTypes[24]
+	mi := &file_google_protobuf_descriptor_proto_msgTypes[25]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2781,23 +3296,34 @@ type SourceCodeInfo_Location struct {
 	// location.
 	//
 	// Each element is a field number or an index.  They form a path from
-	// the root FileDescriptorProto to the place where the definition.  For
-	// example, this path:
-	//   [ 4, 3, 2, 7, 1 ]
+	// the root FileDescriptorProto to the place where the definition occurs.
+	// For example, this path:
+	//
+	//	[ 4, 3, 2, 7, 1 ]
+	//
 	// refers to:
-	//   file.message_type(3)  // 4, 3
-	//       .field(7)         // 2, 7
-	//       .name()           // 1
+	//
+	//	file.message_type(3)  // 4, 3
+	//	    .field(7)         // 2, 7
+	//	    .name()           // 1
+	//
 	// This is because FileDescriptorProto.message_type has field number 4:
-	//   repeated DescriptorProto message_type = 4;
+	//
+	//	repeated DescriptorProto message_type = 4;
+	//
 	// and DescriptorProto.field has field number 2:
-	//   repeated FieldDescriptorProto field = 2;
+	//
+	//	repeated FieldDescriptorProto field = 2;
+	//
 	// and FieldDescriptorProto.name has field number 1:
-	//   optional string name = 1;
+	//
+	//	optional string name = 1;
 	//
 	// Thus, the above path gives the location of a field name.  If we removed
 	// the last element:
-	//   [ 4, 3, 2, 7 ]
+	//
+	//	[ 4, 3, 2, 7 ]
+	//
 	// this path refers to the whole field declaration (from the beginning
 	// of the label to the terminating semicolon).
 	Path []int32 `protobuf:"varint,1,rep,packed,name=path" json:"path,omitempty"`
@@ -2826,34 +3352,34 @@ type SourceCodeInfo_Location struct {
 	//
 	// Examples:
 	//
-	//   optional int32 foo = 1;  // Comment attached to foo.
-	//   // Comment attached to bar.
-	//   optional int32 bar = 2;
+	//	optional int32 foo = 1;  // Comment attached to foo.
+	//	// Comment attached to bar.
+	//	optional int32 bar = 2;
 	//
-	//   optional string baz = 3;
-	//   // Comment attached to baz.
-	//   // Another line attached to baz.
+	//	optional string baz = 3;
+	//	// Comment attached to baz.
+	//	// Another line attached to baz.
 	//
-	//   // Comment attached to qux.
-	//   //
-	//   // Another line attached to qux.
-	//   optional double qux = 4;
+	//	// Comment attached to moo.
+	//	//
+	//	// Another line attached to moo.
+	//	optional double moo = 4;
 	//
-	//   // Detached comment for corge. This is not leading or trailing comments
-	//   // to qux or corge because there are blank lines separating it from
-	//   // both.
+	//	// Detached comment for corge. This is not leading or trailing comments
+	//	// to moo or corge because there are blank lines separating it from
+	//	// both.
 	//
-	//   // Detached comment for corge paragraph 2.
+	//	// Detached comment for corge paragraph 2.
 	//
-	//   optional string corge = 5;
-	//   /* Block comment attached
-	//    * to corge.  Leading asterisks
-	//    * will be removed. */
-	//   /* Block comment attached to
-	//    * grault. */
-	//   optional int32 grault = 6;
+	//	optional string corge = 5;
+	//	/* Block comment attached
+	//	 * to corge.  Leading asterisks
+	//	 * will be removed. */
+	//	/* Block comment attached to
+	//	 * grault. */
+	//	optional int32 grault = 6;
 	//
-	//   // ignored detached comments.
+	//	// ignored detached comments.
 	LeadingComments         *string  `protobuf:"bytes,3,opt,name=leading_comments,json=leadingComments" json:"leading_comments,omitempty"`
 	TrailingComments        *string  `protobuf:"bytes,4,opt,name=trailing_comments,json=trailingComments" json:"trailing_comments,omitempty"`
 	LeadingDetachedComments []string `protobuf:"bytes,6,rep,name=leading_detached_comments,json=leadingDetachedComments" json:"leading_detached_comments,omitempty"`
@@ -2862,7 +3388,7 @@ type SourceCodeInfo_Location struct {
 func (x *SourceCodeInfo_Location) Reset() {
 	*x = SourceCodeInfo_Location{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_google_protobuf_descriptor_proto_msgTypes[25]
+		mi := &file_google_protobuf_descriptor_proto_msgTypes[26]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2875,7 +3401,7 @@ func (x *SourceCodeInfo_Location) String() string {
 func (*SourceCodeInfo_Location) ProtoMessage() {}
 
 func (x *SourceCodeInfo_Location) ProtoReflect() protoreflect.Message {
-	mi := &file_google_protobuf_descriptor_proto_msgTypes[25]
+	mi := &file_google_protobuf_descriptor_proto_msgTypes[26]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2940,15 +3466,16 @@ type GeneratedCodeInfo_Annotation struct {
 	// that relates to the identified object.
 	Begin *int32 `protobuf:"varint,3,opt,name=begin" json:"begin,omitempty"`
 	// Identifies the ending offset in bytes in the generated code that
-	// relates to the identified offset. The end offset should be one past
+	// relates to the identified object. The end offset should be one past
 	// the last relevant byte (so the length of the text = end - begin).
-	End *int32 `protobuf:"varint,4,opt,name=end" json:"end,omitempty"`
+	End      *int32                                 `protobuf:"varint,4,opt,name=end" json:"end,omitempty"`
+	Semantic *GeneratedCodeInfo_Annotation_Semantic `protobuf:"varint,5,opt,name=semantic,enum=google.protobuf.GeneratedCodeInfo_Annotation_Semantic" json:"semantic,omitempty"`
 }
 
 func (x *GeneratedCodeInfo_Annotation) Reset() {
 	*x = GeneratedCodeInfo_Annotation{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_google_protobuf_descriptor_proto_msgTypes[26]
+		mi := &file_google_protobuf_descriptor_proto_msgTypes[27]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2961,7 +3488,7 @@ func (x *GeneratedCodeInfo_Annotation) String() string {
 func (*GeneratedCodeInfo_Annotation) ProtoMessage() {}
 
 func (x *GeneratedCodeInfo_Annotation) ProtoReflect() protoreflect.Message {
-	mi := &file_google_protobuf_descriptor_proto_msgTypes[26]
+	mi := &file_google_protobuf_descriptor_proto_msgTypes[27]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3005,6 +3532,13 @@ func (x *GeneratedCodeInfo_Annotation) GetEnd() int32 {
 	return 0
 }
 
+func (x *GeneratedCodeInfo_Annotation) GetSemantic() GeneratedCodeInfo_Annotation_Semantic {
+	if x != nil && x.Semantic != nil {
+		return *x.Semantic
+	}
+	return GeneratedCodeInfo_Annotation_NONE
+}
+
 var File_google_protobuf_descriptor_proto protoreflect.FileDescriptor
 
 var file_google_protobuf_descriptor_proto_rawDesc = []byte{
@@ -3016,7 +3550,7 @@ var file_google_protobuf_descriptor_proto_rawDesc = []byte{
 	0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e,
 	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x46, 0x69, 0x6c, 0x65, 0x44, 0x65, 0x73,
 	0x63, 0x72, 0x69, 0x70, 0x74, 0x6f, 0x72, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x52, 0x04, 0x66, 0x69,
-	0x6c, 0x65, 0x22, 0xe4, 0x04, 0x0a, 0x13, 0x46, 0x69, 0x6c, 0x65, 0x44, 0x65, 0x73, 0x63, 0x72,
+	0x6c, 0x65, 0x22, 0xfe, 0x04, 0x0a, 0x13, 0x46, 0x69, 0x6c, 0x65, 0x44, 0x65, 0x73, 0x63, 0x72,
 	0x69, 0x70, 0x74, 0x6f, 0x72, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61,
 	0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x18,
 	0x0a, 0x07, 0x70, 0x61, 0x63, 0x6b, 0x61, 0x67, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52,
@@ -3054,330 +3588,423 @@ var file_google_protobuf_descriptor_proto_rawDesc = []byte{
 	0x75, 0x66, 0x2e, 0x53, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x43, 0x6f, 0x64, 0x65, 0x49, 0x6e, 0x66,
 	0x6f, 0x52, 0x0e, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x43, 0x6f, 0x64, 0x65, 0x49, 0x6e, 0x66,
 	0x6f, 0x12, 0x16, 0x0a, 0x06, 0x73, 0x79, 0x6e, 0x74, 0x61, 0x78, 0x18, 0x0c, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x06, 0x73, 0x79, 0x6e, 0x74, 0x61, 0x78, 0x22, 0xb9, 0x06, 0x0a, 0x0f, 0x44, 0x65,
-	0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x6f, 0x72, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x12, 0x0a,
-	0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d,
-	0x65, 0x12, 0x3b, 0x0a, 0x05, 0x66, 0x69, 0x65, 0x6c, 0x64, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b,
-	0x32, 0x25, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62,
-	0x75, 0x66, 0x2e, 0x46, 0x69, 0x65, 0x6c, 0x64, 0x44, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74,
-	0x6f, 0x72, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x52, 0x05, 0x66, 0x69, 0x65, 0x6c, 0x64, 0x12, 0x43,
-	0x0a, 0x09, 0x65, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x06, 0x20, 0x03, 0x28,
-	0x0b, 0x32, 0x25, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
-	0x62, 0x75, 0x66, 0x2e, 0x46, 0x69, 0x65, 0x6c, 0x64, 0x44, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70,
-	0x74, 0x6f, 0x72, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x52, 0x09, 0x65, 0x78, 0x74, 0x65, 0x6e, 0x73,
-	0x69, 0x6f, 0x6e, 0x12, 0x41, 0x0a, 0x0b, 0x6e, 0x65, 0x73, 0x74, 0x65, 0x64, 0x5f, 0x74, 0x79,
-	0x70, 0x65, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x20, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
-	0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x44, 0x65, 0x73, 0x63, 0x72,
-	0x69, 0x70, 0x74, 0x6f, 0x72, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x52, 0x0a, 0x6e, 0x65, 0x73, 0x74,
-	0x65, 0x64, 0x54, 0x79, 0x70, 0x65, 0x12, 0x41, 0x0a, 0x09, 0x65, 0x6e, 0x75, 0x6d, 0x5f, 0x74,
-	0x79, 0x70, 0x65, 0x18, 0x04, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x67, 0x6f, 0x6f, 0x67,
-	0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6e, 0x75, 0x6d,
-	0x44, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x6f, 0x72, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x52,
-	0x08, 0x65, 0x6e, 0x75, 0x6d, 0x54, 0x79, 0x70, 0x65, 0x12, 0x58, 0x0a, 0x0f, 0x65, 0x78, 0x74,
-	0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x72, 0x61, 0x6e, 0x67, 0x65, 0x18, 0x05, 0x20, 0x03,
-	0x28, 0x0b, 0x32, 0x2f, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74,
+	0x09, 0x52, 0x06, 0x73, 0x79, 0x6e, 0x74, 0x61, 0x78, 0x12, 0x18, 0x0a, 0x07, 0x65, 0x64, 0x69,
+	0x74, 0x69, 0x6f, 0x6e, 0x18, 0x0d, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x65, 0x64, 0x69, 0x74,
+	0x69, 0x6f, 0x6e, 0x22, 0xb9, 0x06, 0x0a, 0x0f, 0x44, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74,
+	0x6f, 0x72, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x3b, 0x0a, 0x05, 0x66,
+	0x69, 0x65, 0x6c, 0x64, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x25, 0x2e, 0x67, 0x6f, 0x6f,
+	0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x46, 0x69, 0x65,
+	0x6c, 0x64, 0x44, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x6f, 0x72, 0x50, 0x72, 0x6f, 0x74,
+	0x6f, 0x52, 0x05, 0x66, 0x69, 0x65, 0x6c, 0x64, 0x12, 0x43, 0x0a, 0x09, 0x65, 0x78, 0x74, 0x65,
+	0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x06, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x25, 0x2e, 0x67, 0x6f,
+	0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x46, 0x69,
+	0x65, 0x6c, 0x64, 0x44, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x6f, 0x72, 0x50, 0x72, 0x6f,
+	0x74, 0x6f, 0x52, 0x09, 0x65, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x41, 0x0a,
+	0x0b, 0x6e, 0x65, 0x73, 0x74, 0x65, 0x64, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x18, 0x03, 0x20, 0x03,
+	0x28, 0x0b, 0x32, 0x20, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74,
 	0x6f, 0x62, 0x75, 0x66, 0x2e, 0x44, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x6f, 0x72, 0x50,
-	0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x45, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x61,
-	0x6e, 0x67, 0x65, 0x52, 0x0e, 0x65, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x61,
-	0x6e, 0x67, 0x65, 0x12, 0x44, 0x0a, 0x0a, 0x6f, 0x6e, 0x65, 0x6f, 0x66, 0x5f, 0x64, 0x65, 0x63,
-	0x6c, 0x18, 0x08, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x25, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65,
-	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x4f, 0x6e, 0x65, 0x6f, 0x66, 0x44,
-	0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x6f, 0x72, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x52, 0x09,
-	0x6f, 0x6e, 0x65, 0x6f, 0x66, 0x44, 0x65, 0x63, 0x6c, 0x12, 0x39, 0x0a, 0x07, 0x6f, 0x70, 0x74,
-	0x69, 0x6f, 0x6e, 0x73, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1f, 0x2e, 0x67, 0x6f, 0x6f,
-	0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x4d, 0x65, 0x73,
-	0x73, 0x61, 0x67, 0x65, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x52, 0x07, 0x6f, 0x70, 0x74,
-	0x69, 0x6f, 0x6e, 0x73, 0x12, 0x55, 0x0a, 0x0e, 0x72, 0x65, 0x73, 0x65, 0x72, 0x76, 0x65, 0x64,
-	0x5f, 0x72, 0x61, 0x6e, 0x67, 0x65, 0x18, 0x09, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x2e, 0x2e, 0x67,
+	0x72, 0x6f, 0x74, 0x6f, 0x52, 0x0a, 0x6e, 0x65, 0x73, 0x74, 0x65, 0x64, 0x54, 0x79, 0x70, 0x65,
+	0x12, 0x41, 0x0a, 0x09, 0x65, 0x6e, 0x75, 0x6d, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x18, 0x04, 0x20,
+	0x03, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f,
+	0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6e, 0x75, 0x6d, 0x44, 0x65, 0x73, 0x63, 0x72, 0x69,
+	0x70, 0x74, 0x6f, 0x72, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x52, 0x08, 0x65, 0x6e, 0x75, 0x6d, 0x54,
+	0x79, 0x70, 0x65, 0x12, 0x58, 0x0a, 0x0f, 0x65, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e,
+	0x5f, 0x72, 0x61, 0x6e, 0x67, 0x65, 0x18, 0x05, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x2f, 0x2e, 0x67,
 	0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x44,
-	0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x6f, 0x72, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x52,
-	0x65, 0x73, 0x65, 0x72, 0x76, 0x65, 0x64, 0x52, 0x61, 0x6e, 0x67, 0x65, 0x52, 0x0d, 0x72, 0x65,
-	0x73, 0x65, 0x72, 0x76, 0x65, 0x64, 0x52, 0x61, 0x6e, 0x67, 0x65, 0x12, 0x23, 0x0a, 0x0d, 0x72,
-	0x65, 0x73, 0x65, 0x72, 0x76, 0x65, 0x64, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x0a, 0x20, 0x03,
-	0x28, 0x09, 0x52, 0x0c, 0x72, 0x65, 0x73, 0x65, 0x72, 0x76, 0x65, 0x64, 0x4e, 0x61, 0x6d, 0x65,
-	0x1a, 0x7a, 0x0a, 0x0e, 0x45, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x61, 0x6e,
-	0x67, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x73, 0x74, 0x61, 0x72, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28,
-	0x05, 0x52, 0x05, 0x73, 0x74, 0x61, 0x72, 0x74, 0x12, 0x10, 0x0a, 0x03, 0x65, 0x6e, 0x64, 0x18,
-	0x02, 0x20, 0x01, 0x28, 0x05, 0x52, 0x03, 0x65, 0x6e, 0x64, 0x12, 0x40, 0x0a, 0x07, 0x6f, 0x70,
-	0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x26, 0x2e, 0x67, 0x6f,
-	0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x78,
-	0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x61, 0x6e, 0x67, 0x65, 0x4f, 0x70, 0x74, 0x69,
-	0x6f, 0x6e, 0x73, 0x52, 0x07, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x1a, 0x37, 0x0a, 0x0d,
-	0x52, 0x65, 0x73, 0x65, 0x72, 0x76, 0x65, 0x64, 0x52, 0x61, 0x6e, 0x67, 0x65, 0x12, 0x14, 0x0a,
-	0x05, 0x73, 0x74, 0x61, 0x72, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x05, 0x52, 0x05, 0x73, 0x74,
-	0x61, 0x72, 0x74, 0x12, 0x10, 0x0a, 0x03, 0x65, 0x6e, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x05,
-	0x52, 0x03, 0x65, 0x6e, 0x64, 0x22, 0x7c, 0x0a, 0x15, 0x45, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69,
-	0x6f, 0x6e, 0x52, 0x61, 0x6e, 0x67, 0x65, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x58,
-	0x0a, 0x14, 0x75, 0x6e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x70, 0x72, 0x65, 0x74, 0x65, 0x64, 0x5f,
-	0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0xe7, 0x07, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x24, 0x2e,
-	0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e,
-	0x55, 0x6e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x70, 0x72, 0x65, 0x74, 0x65, 0x64, 0x4f, 0x70, 0x74,
-	0x69, 0x6f, 0x6e, 0x52, 0x13, 0x75, 0x6e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x70, 0x72, 0x65, 0x74,
-	0x65, 0x64, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x2a, 0x09, 0x08, 0xe8, 0x07, 0x10, 0x80, 0x80,
-	0x80, 0x80, 0x02, 0x22, 0xc1, 0x06, 0x0a, 0x14, 0x46, 0x69, 0x65, 0x6c, 0x64, 0x44, 0x65, 0x73,
-	0x63, 0x72, 0x69, 0x70, 0x74, 0x6f, 0x72, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x12, 0x0a, 0x04,
-	0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65,
-	0x12, 0x16, 0x0a, 0x06, 0x6e, 0x75, 0x6d, 0x62, 0x65, 0x72, 0x18, 0x03, 0x20, 0x01, 0x28, 0x05,
-	0x52, 0x06, 0x6e, 0x75, 0x6d, 0x62, 0x65, 0x72, 0x12, 0x41, 0x0a, 0x05, 0x6c, 0x61, 0x62, 0x65,
-	0x6c, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x2b, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65,
-	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x46, 0x69, 0x65, 0x6c, 0x64, 0x44,
-	0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x6f, 0x72, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x4c,
-	0x61, 0x62, 0x65, 0x6c, 0x52, 0x05, 0x6c, 0x61, 0x62, 0x65, 0x6c, 0x12, 0x3e, 0x0a, 0x04, 0x74,
-	0x79, 0x70, 0x65, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x2a, 0x2e, 0x67, 0x6f, 0x6f, 0x67,
-	0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x46, 0x69, 0x65, 0x6c,
-	0x64, 0x44, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x6f, 0x72, 0x50, 0x72, 0x6f, 0x74, 0x6f,
-	0x2e, 0x54, 0x79, 0x70, 0x65, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x1b, 0x0a, 0x09, 0x74,
-	0x79, 0x70, 0x65, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08,
-	0x74, 0x79, 0x70, 0x65, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x1a, 0x0a, 0x08, 0x65, 0x78, 0x74, 0x65,
-	0x6e, 0x64, 0x65, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x65, 0x78, 0x74, 0x65,
-	0x6e, 0x64, 0x65, 0x65, 0x12, 0x23, 0x0a, 0x0d, 0x64, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x5f,
-	0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x64, 0x65, 0x66,
-	0x61, 0x75, 0x6c, 0x74, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x1f, 0x0a, 0x0b, 0x6f, 0x6e, 0x65,
-	0x6f, 0x66, 0x5f, 0x69, 0x6e, 0x64, 0x65, 0x78, 0x18, 0x09, 0x20, 0x01, 0x28, 0x05, 0x52, 0x0a,
-	0x6f, 0x6e, 0x65, 0x6f, 0x66, 0x49, 0x6e, 0x64, 0x65, 0x78, 0x12, 0x1b, 0x0a, 0x09, 0x6a, 0x73,
-	0x6f, 0x6e, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x6a,
-	0x73, 0x6f, 0x6e, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x37, 0x0a, 0x07, 0x6f, 0x70, 0x74, 0x69, 0x6f,
-	0x6e, 0x73, 0x18, 0x08, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
-	0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x46, 0x69, 0x65, 0x6c, 0x64,
-	0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x52, 0x07, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73,
-	0x12, 0x27, 0x0a, 0x0f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33, 0x5f, 0x6f, 0x70, 0x74, 0x69, 0x6f,
-	0x6e, 0x61, 0x6c, 0x18, 0x11, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
-	0x33, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x22, 0xb6, 0x02, 0x0a, 0x04, 0x54, 0x79,
-	0x70, 0x65, 0x12, 0x0f, 0x0a, 0x0b, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x44, 0x4f, 0x55, 0x42, 0x4c,
-	0x45, 0x10, 0x01, 0x12, 0x0e, 0x0a, 0x0a, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x46, 0x4c, 0x4f, 0x41,
-	0x54, 0x10, 0x02, 0x12, 0x0e, 0x0a, 0x0a, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x49, 0x4e, 0x54, 0x36,
-	0x34, 0x10, 0x03, 0x12, 0x0f, 0x0a, 0x0b, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x55, 0x49, 0x4e, 0x54,
-	0x36, 0x34, 0x10, 0x04, 0x12, 0x0e, 0x0a, 0x0a, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x49, 0x4e, 0x54,
-	0x33, 0x32, 0x10, 0x05, 0x12, 0x10, 0x0a, 0x0c, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x46, 0x49, 0x58,
-	0x45, 0x44, 0x36, 0x34, 0x10, 0x06, 0x12, 0x10, 0x0a, 0x0c, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x46,
-	0x49, 0x58, 0x45, 0x44, 0x33, 0x32, 0x10, 0x07, 0x12, 0x0d, 0x0a, 0x09, 0x54, 0x59, 0x50, 0x45,
-	0x5f, 0x42, 0x4f, 0x4f, 0x4c, 0x10, 0x08, 0x12, 0x0f, 0x0a, 0x0b, 0x54, 0x59, 0x50, 0x45, 0x5f,
-	0x53, 0x54, 0x52, 0x49, 0x4e, 0x47, 0x10, 0x09, 0x12, 0x0e, 0x0a, 0x0a, 0x54, 0x59, 0x50, 0x45,
-	0x5f, 0x47, 0x52, 0x4f, 0x55, 0x50, 0x10, 0x0a, 0x12, 0x10, 0x0a, 0x0c, 0x54, 0x59, 0x50, 0x45,
-	0x5f, 0x4d, 0x45, 0x53, 0x53, 0x41, 0x47, 0x45, 0x10, 0x0b, 0x12, 0x0e, 0x0a, 0x0a, 0x54, 0x59,
-	0x50, 0x45, 0x5f, 0x42, 0x59, 0x54, 0x45, 0x53, 0x10, 0x0c, 0x12, 0x0f, 0x0a, 0x0b, 0x54, 0x59,
-	0x50, 0x45, 0x5f, 0x55, 0x49, 0x4e, 0x54, 0x33, 0x32, 0x10, 0x0d, 0x12, 0x0d, 0x0a, 0x09, 0x54,
-	0x59, 0x50, 0x45, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x10, 0x0e, 0x12, 0x11, 0x0a, 0x0d, 0x54, 0x59,
-	0x50, 0x45, 0x5f, 0x53, 0x46, 0x49, 0x58, 0x45, 0x44, 0x33, 0x32, 0x10, 0x0f, 0x12, 0x11, 0x0a,
-	0x0d, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x53, 0x46, 0x49, 0x58, 0x45, 0x44, 0x36, 0x34, 0x10, 0x10,
-	0x12, 0x0f, 0x0a, 0x0b, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x53, 0x49, 0x4e, 0x54, 0x33, 0x32, 0x10,
-	0x11, 0x12, 0x0f, 0x0a, 0x0b, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x53, 0x49, 0x4e, 0x54, 0x36, 0x34,
-	0x10, 0x12, 0x22, 0x43, 0x0a, 0x05, 0x4c, 0x61, 0x62, 0x65, 0x6c, 0x12, 0x12, 0x0a, 0x0e, 0x4c,
-	0x41, 0x42, 0x45, 0x4c, 0x5f, 0x4f, 0x50, 0x54, 0x49, 0x4f, 0x4e, 0x41, 0x4c, 0x10, 0x01, 0x12,
-	0x12, 0x0a, 0x0e, 0x4c, 0x41, 0x42, 0x45, 0x4c, 0x5f, 0x52, 0x45, 0x51, 0x55, 0x49, 0x52, 0x45,
-	0x44, 0x10, 0x02, 0x12, 0x12, 0x0a, 0x0e, 0x4c, 0x41, 0x42, 0x45, 0x4c, 0x5f, 0x52, 0x45, 0x50,
-	0x45, 0x41, 0x54, 0x45, 0x44, 0x10, 0x03, 0x22, 0x63, 0x0a, 0x14, 0x4f, 0x6e, 0x65, 0x6f, 0x66,
-	0x44, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x6f, 0x72, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x12,
-	0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e,
-	0x61, 0x6d, 0x65, 0x12, 0x37, 0x0a, 0x07, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x02,
+	0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x6f, 0x72, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x45,
+	0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x61, 0x6e, 0x67, 0x65, 0x52, 0x0e, 0x65,
+	0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x61, 0x6e, 0x67, 0x65, 0x12, 0x44, 0x0a,
+	0x0a, 0x6f, 0x6e, 0x65, 0x6f, 0x66, 0x5f, 0x64, 0x65, 0x63, 0x6c, 0x18, 0x08, 0x20, 0x03, 0x28,
+	0x0b, 0x32, 0x25, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x62, 0x75, 0x66, 0x2e, 0x4f, 0x6e, 0x65, 0x6f, 0x66, 0x44, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70,
+	0x74, 0x6f, 0x72, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x52, 0x09, 0x6f, 0x6e, 0x65, 0x6f, 0x66, 0x44,
+	0x65, 0x63, 0x6c, 0x12, 0x39, 0x0a, 0x07, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x07,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x1f, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x4f, 0x70,
+	0x74, 0x69, 0x6f, 0x6e, 0x73, 0x52, 0x07, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x55,
+	0x0a, 0x0e, 0x72, 0x65, 0x73, 0x65, 0x72, 0x76, 0x65, 0x64, 0x5f, 0x72, 0x61, 0x6e, 0x67, 0x65,
+	0x18, 0x09, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x2e, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x44, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70,
+	0x74, 0x6f, 0x72, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x52, 0x65, 0x73, 0x65, 0x72, 0x76, 0x65,
+	0x64, 0x52, 0x61, 0x6e, 0x67, 0x65, 0x52, 0x0d, 0x72, 0x65, 0x73, 0x65, 0x72, 0x76, 0x65, 0x64,
+	0x52, 0x61, 0x6e, 0x67, 0x65, 0x12, 0x23, 0x0a, 0x0d, 0x72, 0x65, 0x73, 0x65, 0x72, 0x76, 0x65,
+	0x64, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x0a, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0c, 0x72, 0x65,
+	0x73, 0x65, 0x72, 0x76, 0x65, 0x64, 0x4e, 0x61, 0x6d, 0x65, 0x1a, 0x7a, 0x0a, 0x0e, 0x45, 0x78,
+	0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x61, 0x6e, 0x67, 0x65, 0x12, 0x14, 0x0a, 0x05,
+	0x73, 0x74, 0x61, 0x72, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x05, 0x52, 0x05, 0x73, 0x74, 0x61,
+	0x72, 0x74, 0x12, 0x10, 0x0a, 0x03, 0x65, 0x6e, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x05, 0x52,
+	0x03, 0x65, 0x6e, 0x64, 0x12, 0x40, 0x0a, 0x07, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18,
+	0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x26, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f,
+	0x6e, 0x52, 0x61, 0x6e, 0x67, 0x65, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x52, 0x07, 0x6f,
+	0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x1a, 0x37, 0x0a, 0x0d, 0x52, 0x65, 0x73, 0x65, 0x72, 0x76,
+	0x65, 0x64, 0x52, 0x61, 0x6e, 0x67, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x73, 0x74, 0x61, 0x72, 0x74,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x05, 0x52, 0x05, 0x73, 0x74, 0x61, 0x72, 0x74, 0x12, 0x10, 0x0a,
+	0x03, 0x65, 0x6e, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x05, 0x52, 0x03, 0x65, 0x6e, 0x64, 0x22,
+	0xad, 0x04, 0x0a, 0x15, 0x45, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x61, 0x6e,
+	0x67, 0x65, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x58, 0x0a, 0x14, 0x75, 0x6e, 0x69,
+	0x6e, 0x74, 0x65, 0x72, 0x70, 0x72, 0x65, 0x74, 0x65, 0x64, 0x5f, 0x6f, 0x70, 0x74, 0x69, 0x6f,
+	0x6e, 0x18, 0xe7, 0x07, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
+	0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x55, 0x6e, 0x69, 0x6e, 0x74,
+	0x65, 0x72, 0x70, 0x72, 0x65, 0x74, 0x65, 0x64, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x13,
+	0x75, 0x6e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x70, 0x72, 0x65, 0x74, 0x65, 0x64, 0x4f, 0x70, 0x74,
+	0x69, 0x6f, 0x6e, 0x12, 0x59, 0x0a, 0x0b, 0x64, 0x65, 0x63, 0x6c, 0x61, 0x72, 0x61, 0x74, 0x69,
+	0x6f, 0x6e, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x32, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
+	0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x78, 0x74, 0x65, 0x6e,
+	0x73, 0x69, 0x6f, 0x6e, 0x52, 0x61, 0x6e, 0x67, 0x65, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73,
+	0x2e, 0x44, 0x65, 0x63, 0x6c, 0x61, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x42, 0x03, 0x88, 0x01,
+	0x02, 0x52, 0x0b, 0x64, 0x65, 0x63, 0x6c, 0x61, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x68,
+	0x0a, 0x0c, 0x76, 0x65, 0x72, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x03,
+	0x20, 0x01, 0x28, 0x0e, 0x32, 0x38, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e,
+	0x52, 0x61, 0x6e, 0x67, 0x65, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x56, 0x65, 0x72,
+	0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x53, 0x74, 0x61, 0x74, 0x65, 0x3a, 0x0a,
+	0x55, 0x4e, 0x56, 0x45, 0x52, 0x49, 0x46, 0x49, 0x45, 0x44, 0x52, 0x0c, 0x76, 0x65, 0x72, 0x69,
+	0x66, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x1a, 0xb3, 0x01, 0x0a, 0x0b, 0x44, 0x65, 0x63,
+	0x6c, 0x61, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x16, 0x0a, 0x06, 0x6e, 0x75, 0x6d, 0x62,
+	0x65, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28, 0x05, 0x52, 0x06, 0x6e, 0x75, 0x6d, 0x62, 0x65, 0x72,
+	0x12, 0x1b, 0x0a, 0x09, 0x66, 0x75, 0x6c, 0x6c, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x08, 0x66, 0x75, 0x6c, 0x6c, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x12, 0x0a,
+	0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x74, 0x79, 0x70,
+	0x65, 0x12, 0x23, 0x0a, 0x0b, 0x69, 0x73, 0x5f, 0x72, 0x65, 0x70, 0x65, 0x61, 0x74, 0x65, 0x64,
+	0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x42, 0x02, 0x18, 0x01, 0x52, 0x0a, 0x69, 0x73, 0x52, 0x65,
+	0x70, 0x65, 0x61, 0x74, 0x65, 0x64, 0x12, 0x1a, 0x0a, 0x08, 0x72, 0x65, 0x73, 0x65, 0x72, 0x76,
+	0x65, 0x64, 0x18, 0x05, 0x20, 0x01, 0x28, 0x08, 0x52, 0x08, 0x72, 0x65, 0x73, 0x65, 0x72, 0x76,
+	0x65, 0x64, 0x12, 0x1a, 0x0a, 0x08, 0x72, 0x65, 0x70, 0x65, 0x61, 0x74, 0x65, 0x64, 0x18, 0x06,
+	0x20, 0x01, 0x28, 0x08, 0x52, 0x08, 0x72, 0x65, 0x70, 0x65, 0x61, 0x74, 0x65, 0x64, 0x22, 0x34,
+	0x0a, 0x11, 0x56, 0x65, 0x72, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x53, 0x74,
+	0x61, 0x74, 0x65, 0x12, 0x0f, 0x0a, 0x0b, 0x44, 0x45, 0x43, 0x4c, 0x41, 0x52, 0x41, 0x54, 0x49,
+	0x4f, 0x4e, 0x10, 0x00, 0x12, 0x0e, 0x0a, 0x0a, 0x55, 0x4e, 0x56, 0x45, 0x52, 0x49, 0x46, 0x49,
+	0x45, 0x44, 0x10, 0x01, 0x2a, 0x09, 0x08, 0xe8, 0x07, 0x10, 0x80, 0x80, 0x80, 0x80, 0x02, 0x22,
+	0xc1, 0x06, 0x0a, 0x14, 0x46, 0x69, 0x65, 0x6c, 0x64, 0x44, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70,
+	0x74, 0x6f, 0x72, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x16, 0x0a, 0x06,
+	0x6e, 0x75, 0x6d, 0x62, 0x65, 0x72, 0x18, 0x03, 0x20, 0x01, 0x28, 0x05, 0x52, 0x06, 0x6e, 0x75,
+	0x6d, 0x62, 0x65, 0x72, 0x12, 0x41, 0x0a, 0x05, 0x6c, 0x61, 0x62, 0x65, 0x6c, 0x18, 0x04, 0x20,
+	0x01, 0x28, 0x0e, 0x32, 0x2b, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f,
+	0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x46, 0x69, 0x65, 0x6c, 0x64, 0x44, 0x65, 0x73, 0x63, 0x72,
+	0x69, 0x70, 0x74, 0x6f, 0x72, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x4c, 0x61, 0x62, 0x65, 0x6c,
+	0x52, 0x05, 0x6c, 0x61, 0x62, 0x65, 0x6c, 0x12, 0x3e, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18,
+	0x05, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x2a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x46, 0x69, 0x65, 0x6c, 0x64, 0x44, 0x65, 0x73,
+	0x63, 0x72, 0x69, 0x70, 0x74, 0x6f, 0x72, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x54, 0x79, 0x70,
+	0x65, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x1b, 0x0a, 0x09, 0x74, 0x79, 0x70, 0x65, 0x5f,
+	0x6e, 0x61, 0x6d, 0x65, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x74, 0x79, 0x70, 0x65,
+	0x4e, 0x61, 0x6d, 0x65, 0x12, 0x1a, 0x0a, 0x08, 0x65, 0x78, 0x74, 0x65, 0x6e, 0x64, 0x65, 0x65,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x65, 0x78, 0x74, 0x65, 0x6e, 0x64, 0x65, 0x65,
+	0x12, 0x23, 0x0a, 0x0d, 0x64, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x5f, 0x76, 0x61, 0x6c, 0x75,
+	0x65, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x64, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74,
+	0x56, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x1f, 0x0a, 0x0b, 0x6f, 0x6e, 0x65, 0x6f, 0x66, 0x5f, 0x69,
+	0x6e, 0x64, 0x65, 0x78, 0x18, 0x09, 0x20, 0x01, 0x28, 0x05, 0x52, 0x0a, 0x6f, 0x6e, 0x65, 0x6f,
+	0x66, 0x49, 0x6e, 0x64, 0x65, 0x78, 0x12, 0x1b, 0x0a, 0x09, 0x6a, 0x73, 0x6f, 0x6e, 0x5f, 0x6e,
+	0x61, 0x6d, 0x65, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x6a, 0x73, 0x6f, 0x6e, 0x4e,
+	0x61, 0x6d, 0x65, 0x12, 0x37, 0x0a, 0x07, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x08,
 	0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72,
-	0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x4f, 0x6e, 0x65, 0x6f, 0x66, 0x4f, 0x70, 0x74, 0x69,
-	0x6f, 0x6e, 0x73, 0x52, 0x07, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x22, 0xe3, 0x02, 0x0a,
-	0x13, 0x45, 0x6e, 0x75, 0x6d, 0x44, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x6f, 0x72, 0x50,
-	0x72, 0x6f, 0x74, 0x6f, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x3f, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75,
-	0x65, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x29, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65,
-	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6e, 0x75, 0x6d, 0x56, 0x61,
-	0x6c, 0x75, 0x65, 0x44, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x6f, 0x72, 0x50, 0x72, 0x6f,
-	0x74, 0x6f, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x36, 0x0a, 0x07, 0x6f, 0x70, 0x74,
-	0x69, 0x6f, 0x6e, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x67, 0x6f, 0x6f,
-	0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6e, 0x75,
-	0x6d, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x52, 0x07, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e,
-	0x73, 0x12, 0x5d, 0x0a, 0x0e, 0x72, 0x65, 0x73, 0x65, 0x72, 0x76, 0x65, 0x64, 0x5f, 0x72, 0x61,
-	0x6e, 0x67, 0x65, 0x18, 0x04, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x36, 0x2e, 0x67, 0x6f, 0x6f, 0x67,
-	0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6e, 0x75, 0x6d,
-	0x44, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x6f, 0x72, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x2e,
-	0x45, 0x6e, 0x75, 0x6d, 0x52, 0x65, 0x73, 0x65, 0x72, 0x76, 0x65, 0x64, 0x52, 0x61, 0x6e, 0x67,
-	0x65, 0x52, 0x0d, 0x72, 0x65, 0x73, 0x65, 0x72, 0x76, 0x65, 0x64, 0x52, 0x61, 0x6e, 0x67, 0x65,
-	0x12, 0x23, 0x0a, 0x0d, 0x72, 0x65, 0x73, 0x65, 0x72, 0x76, 0x65, 0x64, 0x5f, 0x6e, 0x61, 0x6d,
-	0x65, 0x18, 0x05, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0c, 0x72, 0x65, 0x73, 0x65, 0x72, 0x76, 0x65,
-	0x64, 0x4e, 0x61, 0x6d, 0x65, 0x1a, 0x3b, 0x0a, 0x11, 0x45, 0x6e, 0x75, 0x6d, 0x52, 0x65, 0x73,
-	0x65, 0x72, 0x76, 0x65, 0x64, 0x52, 0x61, 0x6e, 0x67, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x73, 0x74,
-	0x61, 0x72, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x05, 0x52, 0x05, 0x73, 0x74, 0x61, 0x72, 0x74,
-	0x12, 0x10, 0x0a, 0x03, 0x65, 0x6e, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x05, 0x52, 0x03, 0x65,
-	0x6e, 0x64, 0x22, 0x83, 0x01, 0x0a, 0x18, 0x45, 0x6e, 0x75, 0x6d, 0x56, 0x61, 0x6c, 0x75, 0x65,
+	0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x46, 0x69, 0x65, 0x6c, 0x64, 0x4f, 0x70, 0x74, 0x69,
+	0x6f, 0x6e, 0x73, 0x52, 0x07, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x27, 0x0a, 0x0f,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33, 0x5f, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x18,
+	0x11, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33, 0x4f, 0x70, 0x74,
+	0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x22, 0xb6, 0x02, 0x0a, 0x04, 0x54, 0x79, 0x70, 0x65, 0x12, 0x0f,
+	0x0a, 0x0b, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x44, 0x4f, 0x55, 0x42, 0x4c, 0x45, 0x10, 0x01, 0x12,
+	0x0e, 0x0a, 0x0a, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x46, 0x4c, 0x4f, 0x41, 0x54, 0x10, 0x02, 0x12,
+	0x0e, 0x0a, 0x0a, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x49, 0x4e, 0x54, 0x36, 0x34, 0x10, 0x03, 0x12,
+	0x0f, 0x0a, 0x0b, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x55, 0x49, 0x4e, 0x54, 0x36, 0x34, 0x10, 0x04,
+	0x12, 0x0e, 0x0a, 0x0a, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x49, 0x4e, 0x54, 0x33, 0x32, 0x10, 0x05,
+	0x12, 0x10, 0x0a, 0x0c, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x46, 0x49, 0x58, 0x45, 0x44, 0x36, 0x34,
+	0x10, 0x06, 0x12, 0x10, 0x0a, 0x0c, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x46, 0x49, 0x58, 0x45, 0x44,
+	0x33, 0x32, 0x10, 0x07, 0x12, 0x0d, 0x0a, 0x09, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x42, 0x4f, 0x4f,
+	0x4c, 0x10, 0x08, 0x12, 0x0f, 0x0a, 0x0b, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x53, 0x54, 0x52, 0x49,
+	0x4e, 0x47, 0x10, 0x09, 0x12, 0x0e, 0x0a, 0x0a, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x47, 0x52, 0x4f,
+	0x55, 0x50, 0x10, 0x0a, 0x12, 0x10, 0x0a, 0x0c, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x4d, 0x45, 0x53,
+	0x53, 0x41, 0x47, 0x45, 0x10, 0x0b, 0x12, 0x0e, 0x0a, 0x0a, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x42,
+	0x59, 0x54, 0x45, 0x53, 0x10, 0x0c, 0x12, 0x0f, 0x0a, 0x0b, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x55,
+	0x49, 0x4e, 0x54, 0x33, 0x32, 0x10, 0x0d, 0x12, 0x0d, 0x0a, 0x09, 0x54, 0x59, 0x50, 0x45, 0x5f,
+	0x45, 0x4e, 0x55, 0x4d, 0x10, 0x0e, 0x12, 0x11, 0x0a, 0x0d, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x53,
+	0x46, 0x49, 0x58, 0x45, 0x44, 0x33, 0x32, 0x10, 0x0f, 0x12, 0x11, 0x0a, 0x0d, 0x54, 0x59, 0x50,
+	0x45, 0x5f, 0x53, 0x46, 0x49, 0x58, 0x45, 0x44, 0x36, 0x34, 0x10, 0x10, 0x12, 0x0f, 0x0a, 0x0b,
+	0x54, 0x59, 0x50, 0x45, 0x5f, 0x53, 0x49, 0x4e, 0x54, 0x33, 0x32, 0x10, 0x11, 0x12, 0x0f, 0x0a,
+	0x0b, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x53, 0x49, 0x4e, 0x54, 0x36, 0x34, 0x10, 0x12, 0x22, 0x43,
+	0x0a, 0x05, 0x4c, 0x61, 0x62, 0x65, 0x6c, 0x12, 0x12, 0x0a, 0x0e, 0x4c, 0x41, 0x42, 0x45, 0x4c,
+	0x5f, 0x4f, 0x50, 0x54, 0x49, 0x4f, 0x4e, 0x41, 0x4c, 0x10, 0x01, 0x12, 0x12, 0x0a, 0x0e, 0x4c,
+	0x41, 0x42, 0x45, 0x4c, 0x5f, 0x52, 0x45, 0x51, 0x55, 0x49, 0x52, 0x45, 0x44, 0x10, 0x02, 0x12,
+	0x12, 0x0a, 0x0e, 0x4c, 0x41, 0x42, 0x45, 0x4c, 0x5f, 0x52, 0x45, 0x50, 0x45, 0x41, 0x54, 0x45,
+	0x44, 0x10, 0x03, 0x22, 0x63, 0x0a, 0x14, 0x4f, 0x6e, 0x65, 0x6f, 0x66, 0x44, 0x65, 0x73, 0x63,
+	0x72, 0x69, 0x70, 0x74, 0x6f, 0x72, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x12, 0x0a, 0x04, 0x6e,
+	0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12,
+	0x37, 0x0a, 0x07, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x1d, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62,
+	0x75, 0x66, 0x2e, 0x4f, 0x6e, 0x65, 0x6f, 0x66, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x52,
+	0x07, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x22, 0xe3, 0x02, 0x0a, 0x13, 0x45, 0x6e, 0x75,
+	0x6d, 0x44, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x6f, 0x72, 0x50, 0x72, 0x6f, 0x74, 0x6f,
+	0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04,
+	0x6e, 0x61, 0x6d, 0x65, 0x12, 0x3f, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20,
+	0x03, 0x28, 0x0b, 0x32, 0x29, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f,
+	0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6e, 0x75, 0x6d, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x44,
+	0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x6f, 0x72, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x52, 0x05,
+	0x76, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x36, 0x0a, 0x07, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73,
+	0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6e, 0x75, 0x6d, 0x4f, 0x70, 0x74,
+	0x69, 0x6f, 0x6e, 0x73, 0x52, 0x07, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x5d, 0x0a,
+	0x0e, 0x72, 0x65, 0x73, 0x65, 0x72, 0x76, 0x65, 0x64, 0x5f, 0x72, 0x61, 0x6e, 0x67, 0x65, 0x18,
+	0x04, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x36, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6e, 0x75, 0x6d, 0x44, 0x65, 0x73, 0x63,
+	0x72, 0x69, 0x70, 0x74, 0x6f, 0x72, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x45, 0x6e, 0x75, 0x6d,
+	0x52, 0x65, 0x73, 0x65, 0x72, 0x76, 0x65, 0x64, 0x52, 0x61, 0x6e, 0x67, 0x65, 0x52, 0x0d, 0x72,
+	0x65, 0x73, 0x65, 0x72, 0x76, 0x65, 0x64, 0x52, 0x61, 0x6e, 0x67, 0x65, 0x12, 0x23, 0x0a, 0x0d,
+	0x72, 0x65, 0x73, 0x65, 0x72, 0x76, 0x65, 0x64, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x05, 0x20,
+	0x03, 0x28, 0x09, 0x52, 0x0c, 0x72, 0x65, 0x73, 0x65, 0x72, 0x76, 0x65, 0x64, 0x4e, 0x61, 0x6d,
+	0x65, 0x1a, 0x3b, 0x0a, 0x11, 0x45, 0x6e, 0x75, 0x6d, 0x52, 0x65, 0x73, 0x65, 0x72, 0x76, 0x65,
+	0x64, 0x52, 0x61, 0x6e, 0x67, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x73, 0x74, 0x61, 0x72, 0x74, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x05, 0x52, 0x05, 0x73, 0x74, 0x61, 0x72, 0x74, 0x12, 0x10, 0x0a, 0x03,
+	0x65, 0x6e, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x05, 0x52, 0x03, 0x65, 0x6e, 0x64, 0x22, 0x83,
+	0x01, 0x0a, 0x18, 0x45, 0x6e, 0x75, 0x6d, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x44, 0x65, 0x73, 0x63,
+	0x72, 0x69, 0x70, 0x74, 0x6f, 0x72, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x12, 0x0a, 0x04, 0x6e,
+	0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12,
+	0x16, 0x0a, 0x06, 0x6e, 0x75, 0x6d, 0x62, 0x65, 0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x05, 0x52,
+	0x06, 0x6e, 0x75, 0x6d, 0x62, 0x65, 0x72, 0x12, 0x3b, 0x0a, 0x07, 0x6f, 0x70, 0x74, 0x69, 0x6f,
+	0x6e, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x21, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
+	0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6e, 0x75, 0x6d, 0x56,
+	0x61, 0x6c, 0x75, 0x65, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x52, 0x07, 0x6f, 0x70, 0x74,
+	0x69, 0x6f, 0x6e, 0x73, 0x22, 0xa7, 0x01, 0x0a, 0x16, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65,
 	0x44, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x6f, 0x72, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x12,
 	0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e,
-	0x61, 0x6d, 0x65, 0x12, 0x16, 0x0a, 0x06, 0x6e, 0x75, 0x6d, 0x62, 0x65, 0x72, 0x18, 0x02, 0x20,
-	0x01, 0x28, 0x05, 0x52, 0x06, 0x6e, 0x75, 0x6d, 0x62, 0x65, 0x72, 0x12, 0x3b, 0x0a, 0x07, 0x6f,
-	0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x21, 0x2e, 0x67,
-	0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45,
-	0x6e, 0x75, 0x6d, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x52,
-	0x07, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x22, 0xa7, 0x01, 0x0a, 0x16, 0x53, 0x65, 0x72,
-	0x76, 0x69, 0x63, 0x65, 0x44, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x6f, 0x72, 0x50, 0x72,
-	0x6f, 0x74, 0x6f, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x3e, 0x0a, 0x06, 0x6d, 0x65, 0x74, 0x68, 0x6f,
-	0x64, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x26, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65,
-	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64,
-	0x44, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x6f, 0x72, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x52,
-	0x06, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x12, 0x39, 0x0a, 0x07, 0x6f, 0x70, 0x74, 0x69, 0x6f,
-	0x6e, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1f, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
-	0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x53, 0x65, 0x72, 0x76, 0x69,
-	0x63, 0x65, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x52, 0x07, 0x6f, 0x70, 0x74, 0x69, 0x6f,
-	0x6e, 0x73, 0x22, 0x89, 0x02, 0x0a, 0x15, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x44, 0x65, 0x73,
-	0x63, 0x72, 0x69, 0x70, 0x74, 0x6f, 0x72, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x12, 0x0a, 0x04,
-	0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65,
-	0x12, 0x1d, 0x0a, 0x0a, 0x69, 0x6e, 0x70, 0x75, 0x74, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x18, 0x02,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x69, 0x6e, 0x70, 0x75, 0x74, 0x54, 0x79, 0x70, 0x65, 0x12,
-	0x1f, 0x0a, 0x0b, 0x6f, 0x75, 0x74, 0x70, 0x75, 0x74, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x18, 0x03,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x6f, 0x75, 0x74, 0x70, 0x75, 0x74, 0x54, 0x79, 0x70, 0x65,
-	0x12, 0x38, 0x0a, 0x07, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x04, 0x20, 0x01, 0x28,
-	0x0b, 0x32, 0x1e, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
-	0x62, 0x75, 0x66, 0x2e, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e,
-	0x73, 0x52, 0x07, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x30, 0x0a, 0x10, 0x63, 0x6c,
-	0x69, 0x65, 0x6e, 0x74, 0x5f, 0x73, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x69, 0x6e, 0x67, 0x18, 0x05,
-	0x20, 0x01, 0x28, 0x08, 0x3a, 0x05, 0x66, 0x61, 0x6c, 0x73, 0x65, 0x52, 0x0f, 0x63, 0x6c, 0x69,
-	0x65, 0x6e, 0x74, 0x53, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x69, 0x6e, 0x67, 0x12, 0x30, 0x0a, 0x10,
-	0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x5f, 0x73, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x69, 0x6e, 0x67,
-	0x18, 0x06, 0x20, 0x01, 0x28, 0x08, 0x3a, 0x05, 0x66, 0x61, 0x6c, 0x73, 0x65, 0x52, 0x0f, 0x73,
-	0x65, 0x72, 0x76, 0x65, 0x72, 0x53, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x69, 0x6e, 0x67, 0x22, 0x91,
-	0x09, 0x0a, 0x0b, 0x46, 0x69, 0x6c, 0x65, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x21,
-	0x0a, 0x0c, 0x6a, 0x61, 0x76, 0x61, 0x5f, 0x70, 0x61, 0x63, 0x6b, 0x61, 0x67, 0x65, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x6a, 0x61, 0x76, 0x61, 0x50, 0x61, 0x63, 0x6b, 0x61, 0x67,
-	0x65, 0x12, 0x30, 0x0a, 0x14, 0x6a, 0x61, 0x76, 0x61, 0x5f, 0x6f, 0x75, 0x74, 0x65, 0x72, 0x5f,
-	0x63, 0x6c, 0x61, 0x73, 0x73, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x08, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x12, 0x6a, 0x61, 0x76, 0x61, 0x4f, 0x75, 0x74, 0x65, 0x72, 0x43, 0x6c, 0x61, 0x73, 0x73, 0x6e,
-	0x61, 0x6d, 0x65, 0x12, 0x35, 0x0a, 0x13, 0x6a, 0x61, 0x76, 0x61, 0x5f, 0x6d, 0x75, 0x6c, 0x74,
-	0x69, 0x70, 0x6c, 0x65, 0x5f, 0x66, 0x69, 0x6c, 0x65, 0x73, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x08,
-	0x3a, 0x05, 0x66, 0x61, 0x6c, 0x73, 0x65, 0x52, 0x11, 0x6a, 0x61, 0x76, 0x61, 0x4d, 0x75, 0x6c,
-	0x74, 0x69, 0x70, 0x6c, 0x65, 0x46, 0x69, 0x6c, 0x65, 0x73, 0x12, 0x44, 0x0a, 0x1d, 0x6a, 0x61,
-	0x76, 0x61, 0x5f, 0x67, 0x65, 0x6e, 0x65, 0x72, 0x61, 0x74, 0x65, 0x5f, 0x65, 0x71, 0x75, 0x61,
-	0x6c, 0x73, 0x5f, 0x61, 0x6e, 0x64, 0x5f, 0x68, 0x61, 0x73, 0x68, 0x18, 0x14, 0x20, 0x01, 0x28,
-	0x08, 0x42, 0x02, 0x18, 0x01, 0x52, 0x19, 0x6a, 0x61, 0x76, 0x61, 0x47, 0x65, 0x6e, 0x65, 0x72,
-	0x61, 0x74, 0x65, 0x45, 0x71, 0x75, 0x61, 0x6c, 0x73, 0x41, 0x6e, 0x64, 0x48, 0x61, 0x73, 0x68,
-	0x12, 0x3a, 0x0a, 0x16, 0x6a, 0x61, 0x76, 0x61, 0x5f, 0x73, 0x74, 0x72, 0x69, 0x6e, 0x67, 0x5f,
-	0x63, 0x68, 0x65, 0x63, 0x6b, 0x5f, 0x75, 0x74, 0x66, 0x38, 0x18, 0x1b, 0x20, 0x01, 0x28, 0x08,
-	0x3a, 0x05, 0x66, 0x61, 0x6c, 0x73, 0x65, 0x52, 0x13, 0x6a, 0x61, 0x76, 0x61, 0x53, 0x74, 0x72,
-	0x69, 0x6e, 0x67, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x55, 0x74, 0x66, 0x38, 0x12, 0x53, 0x0a, 0x0c,
-	0x6f, 0x70, 0x74, 0x69, 0x6d, 0x69, 0x7a, 0x65, 0x5f, 0x66, 0x6f, 0x72, 0x18, 0x09, 0x20, 0x01,
-	0x28, 0x0e, 0x32, 0x29, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74,
-	0x6f, 0x62, 0x75, 0x66, 0x2e, 0x46, 0x69, 0x6c, 0x65, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73,
-	0x2e, 0x4f, 0x70, 0x74, 0x69, 0x6d, 0x69, 0x7a, 0x65, 0x4d, 0x6f, 0x64, 0x65, 0x3a, 0x05, 0x53,
-	0x50, 0x45, 0x45, 0x44, 0x52, 0x0b, 0x6f, 0x70, 0x74, 0x69, 0x6d, 0x69, 0x7a, 0x65, 0x46, 0x6f,
-	0x72, 0x12, 0x1d, 0x0a, 0x0a, 0x67, 0x6f, 0x5f, 0x70, 0x61, 0x63, 0x6b, 0x61, 0x67, 0x65, 0x18,
-	0x0b, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x67, 0x6f, 0x50, 0x61, 0x63, 0x6b, 0x61, 0x67, 0x65,
-	0x12, 0x35, 0x0a, 0x13, 0x63, 0x63, 0x5f, 0x67, 0x65, 0x6e, 0x65, 0x72, 0x69, 0x63, 0x5f, 0x73,
-	0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x18, 0x10, 0x20, 0x01, 0x28, 0x08, 0x3a, 0x05, 0x66,
-	0x61, 0x6c, 0x73, 0x65, 0x52, 0x11, 0x63, 0x63, 0x47, 0x65, 0x6e, 0x65, 0x72, 0x69, 0x63, 0x53,
-	0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x12, 0x39, 0x0a, 0x15, 0x6a, 0x61, 0x76, 0x61, 0x5f,
-	0x67, 0x65, 0x6e, 0x65, 0x72, 0x69, 0x63, 0x5f, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73,
-	0x18, 0x11, 0x20, 0x01, 0x28, 0x08, 0x3a, 0x05, 0x66, 0x61, 0x6c, 0x73, 0x65, 0x52, 0x13, 0x6a,
-	0x61, 0x76, 0x61, 0x47, 0x65, 0x6e, 0x65, 0x72, 0x69, 0x63, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63,
-	0x65, 0x73, 0x12, 0x35, 0x0a, 0x13, 0x70, 0x79, 0x5f, 0x67, 0x65, 0x6e, 0x65, 0x72, 0x69, 0x63,
-	0x5f, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x18, 0x12, 0x20, 0x01, 0x28, 0x08, 0x3a,
-	0x05, 0x66, 0x61, 0x6c, 0x73, 0x65, 0x52, 0x11, 0x70, 0x79, 0x47, 0x65, 0x6e, 0x65, 0x72, 0x69,
-	0x63, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x12, 0x37, 0x0a, 0x14, 0x70, 0x68, 0x70,
-	0x5f, 0x67, 0x65, 0x6e, 0x65, 0x72, 0x69, 0x63, 0x5f, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65,
-	0x73, 0x18, 0x2a, 0x20, 0x01, 0x28, 0x08, 0x3a, 0x05, 0x66, 0x61, 0x6c, 0x73, 0x65, 0x52, 0x12,
-	0x70, 0x68, 0x70, 0x47, 0x65, 0x6e, 0x65, 0x72, 0x69, 0x63, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63,
-	0x65, 0x73, 0x12, 0x25, 0x0a, 0x0a, 0x64, 0x65, 0x70, 0x72, 0x65, 0x63, 0x61, 0x74, 0x65, 0x64,
-	0x18, 0x17, 0x20, 0x01, 0x28, 0x08, 0x3a, 0x05, 0x66, 0x61, 0x6c, 0x73, 0x65, 0x52, 0x0a, 0x64,
-	0x65, 0x70, 0x72, 0x65, 0x63, 0x61, 0x74, 0x65, 0x64, 0x12, 0x2e, 0x0a, 0x10, 0x63, 0x63, 0x5f,
-	0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x5f, 0x61, 0x72, 0x65, 0x6e, 0x61, 0x73, 0x18, 0x1f, 0x20,
-	0x01, 0x28, 0x08, 0x3a, 0x04, 0x74, 0x72, 0x75, 0x65, 0x52, 0x0e, 0x63, 0x63, 0x45, 0x6e, 0x61,
-	0x62, 0x6c, 0x65, 0x41, 0x72, 0x65, 0x6e, 0x61, 0x73, 0x12, 0x2a, 0x0a, 0x11, 0x6f, 0x62, 0x6a,
-	0x63, 0x5f, 0x63, 0x6c, 0x61, 0x73, 0x73, 0x5f, 0x70, 0x72, 0x65, 0x66, 0x69, 0x78, 0x18, 0x24,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x0f, 0x6f, 0x62, 0x6a, 0x63, 0x43, 0x6c, 0x61, 0x73, 0x73, 0x50,
-	0x72, 0x65, 0x66, 0x69, 0x78, 0x12, 0x29, 0x0a, 0x10, 0x63, 0x73, 0x68, 0x61, 0x72, 0x70, 0x5f,
-	0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x18, 0x25, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x0f, 0x63, 0x73, 0x68, 0x61, 0x72, 0x70, 0x4e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65,
-	0x12, 0x21, 0x0a, 0x0c, 0x73, 0x77, 0x69, 0x66, 0x74, 0x5f, 0x70, 0x72, 0x65, 0x66, 0x69, 0x78,
-	0x18, 0x27, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x73, 0x77, 0x69, 0x66, 0x74, 0x50, 0x72, 0x65,
-	0x66, 0x69, 0x78, 0x12, 0x28, 0x0a, 0x10, 0x70, 0x68, 0x70, 0x5f, 0x63, 0x6c, 0x61, 0x73, 0x73,
-	0x5f, 0x70, 0x72, 0x65, 0x66, 0x69, 0x78, 0x18, 0x28, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0e, 0x70,
-	0x68, 0x70, 0x43, 0x6c, 0x61, 0x73, 0x73, 0x50, 0x72, 0x65, 0x66, 0x69, 0x78, 0x12, 0x23, 0x0a,
-	0x0d, 0x70, 0x68, 0x70, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x18, 0x29,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x70, 0x68, 0x70, 0x4e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61,
-	0x63, 0x65, 0x12, 0x34, 0x0a, 0x16, 0x70, 0x68, 0x70, 0x5f, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61,
-	0x74, 0x61, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x18, 0x2c, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x14, 0x70, 0x68, 0x70, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x4e,
-	0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x12, 0x21, 0x0a, 0x0c, 0x72, 0x75, 0x62, 0x79,
-	0x5f, 0x70, 0x61, 0x63, 0x6b, 0x61, 0x67, 0x65, 0x18, 0x2d, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b,
-	0x72, 0x75, 0x62, 0x79, 0x50, 0x61, 0x63, 0x6b, 0x61, 0x67, 0x65, 0x12, 0x58, 0x0a, 0x14, 0x75,
-	0x6e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x70, 0x72, 0x65, 0x74, 0x65, 0x64, 0x5f, 0x6f, 0x70, 0x74,
-	0x69, 0x6f, 0x6e, 0x18, 0xe7, 0x07, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x67, 0x6f, 0x6f,
-	0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x55, 0x6e, 0x69,
-	0x6e, 0x74, 0x65, 0x72, 0x70, 0x72, 0x65, 0x74, 0x65, 0x64, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e,
-	0x52, 0x13, 0x75, 0x6e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x70, 0x72, 0x65, 0x74, 0x65, 0x64, 0x4f,
-	0x70, 0x74, 0x69, 0x6f, 0x6e, 0x22, 0x3a, 0x0a, 0x0c, 0x4f, 0x70, 0x74, 0x69, 0x6d, 0x69, 0x7a,
-	0x65, 0x4d, 0x6f, 0x64, 0x65, 0x12, 0x09, 0x0a, 0x05, 0x53, 0x50, 0x45, 0x45, 0x44, 0x10, 0x01,
-	0x12, 0x0d, 0x0a, 0x09, 0x43, 0x4f, 0x44, 0x45, 0x5f, 0x53, 0x49, 0x5a, 0x45, 0x10, 0x02, 0x12,
-	0x10, 0x0a, 0x0c, 0x4c, 0x49, 0x54, 0x45, 0x5f, 0x52, 0x55, 0x4e, 0x54, 0x49, 0x4d, 0x45, 0x10,
-	0x03, 0x2a, 0x09, 0x08, 0xe8, 0x07, 0x10, 0x80, 0x80, 0x80, 0x80, 0x02, 0x4a, 0x04, 0x08, 0x26,
-	0x10, 0x27, 0x22, 0xd1, 0x02, 0x0a, 0x0e, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x4f, 0x70,
-	0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x3c, 0x0a, 0x17, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65,
-	0x5f, 0x73, 0x65, 0x74, 0x5f, 0x77, 0x69, 0x72, 0x65, 0x5f, 0x66, 0x6f, 0x72, 0x6d, 0x61, 0x74,
-	0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x3a, 0x05, 0x66, 0x61, 0x6c, 0x73, 0x65, 0x52, 0x14, 0x6d,
-	0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x53, 0x65, 0x74, 0x57, 0x69, 0x72, 0x65, 0x46, 0x6f, 0x72,
-	0x6d, 0x61, 0x74, 0x12, 0x4c, 0x0a, 0x1f, 0x6e, 0x6f, 0x5f, 0x73, 0x74, 0x61, 0x6e, 0x64, 0x61,
-	0x72, 0x64, 0x5f, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x6f, 0x72, 0x5f, 0x61, 0x63,
-	0x63, 0x65, 0x73, 0x73, 0x6f, 0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x3a, 0x05, 0x66, 0x61,
-	0x6c, 0x73, 0x65, 0x52, 0x1c, 0x6e, 0x6f, 0x53, 0x74, 0x61, 0x6e, 0x64, 0x61, 0x72, 0x64, 0x44,
-	0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x6f, 0x72, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x6f,
-	0x72, 0x12, 0x25, 0x0a, 0x0a, 0x64, 0x65, 0x70, 0x72, 0x65, 0x63, 0x61, 0x74, 0x65, 0x64, 0x18,
-	0x03, 0x20, 0x01, 0x28, 0x08, 0x3a, 0x05, 0x66, 0x61, 0x6c, 0x73, 0x65, 0x52, 0x0a, 0x64, 0x65,
-	0x70, 0x72, 0x65, 0x63, 0x61, 0x74, 0x65, 0x64, 0x12, 0x1b, 0x0a, 0x09, 0x6d, 0x61, 0x70, 0x5f,
-	0x65, 0x6e, 0x74, 0x72, 0x79, 0x18, 0x07, 0x20, 0x01, 0x28, 0x08, 0x52, 0x08, 0x6d, 0x61, 0x70,
-	0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x58, 0x0a, 0x14, 0x75, 0x6e, 0x69, 0x6e, 0x74, 0x65, 0x72,
-	0x70, 0x72, 0x65, 0x74, 0x65, 0x64, 0x5f, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0xe7, 0x07,
-	0x20, 0x03, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72,
-	0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x55, 0x6e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x70, 0x72,
-	0x65, 0x74, 0x65, 0x64, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x13, 0x75, 0x6e, 0x69, 0x6e,
-	0x74, 0x65, 0x72, 0x70, 0x72, 0x65, 0x74, 0x65, 0x64, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x2a,
-	0x09, 0x08, 0xe8, 0x07, 0x10, 0x80, 0x80, 0x80, 0x80, 0x02, 0x4a, 0x04, 0x08, 0x08, 0x10, 0x09,
-	0x4a, 0x04, 0x08, 0x09, 0x10, 0x0a, 0x22, 0xe2, 0x03, 0x0a, 0x0c, 0x46, 0x69, 0x65, 0x6c, 0x64,
-	0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x41, 0x0a, 0x05, 0x63, 0x74, 0x79, 0x70, 0x65,
-	0x18, 0x01, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x23, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e,
-	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x46, 0x69, 0x65, 0x6c, 0x64, 0x4f, 0x70,
-	0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x43, 0x54, 0x79, 0x70, 0x65, 0x3a, 0x06, 0x53, 0x54, 0x52,
-	0x49, 0x4e, 0x47, 0x52, 0x05, 0x63, 0x74, 0x79, 0x70, 0x65, 0x12, 0x16, 0x0a, 0x06, 0x70, 0x61,
-	0x63, 0x6b, 0x65, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x06, 0x70, 0x61, 0x63, 0x6b,
-	0x65, 0x64, 0x12, 0x47, 0x0a, 0x06, 0x6a, 0x73, 0x74, 0x79, 0x70, 0x65, 0x18, 0x06, 0x20, 0x01,
-	0x28, 0x0e, 0x32, 0x24, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74,
+	0x61, 0x6d, 0x65, 0x12, 0x3e, 0x0a, 0x06, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x18, 0x02, 0x20,
+	0x03, 0x28, 0x0b, 0x32, 0x26, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f,
+	0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x44, 0x65, 0x73, 0x63,
+	0x72, 0x69, 0x70, 0x74, 0x6f, 0x72, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x52, 0x06, 0x6d, 0x65, 0x74,
+	0x68, 0x6f, 0x64, 0x12, 0x39, 0x0a, 0x07, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x03,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x1f, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x4f, 0x70,
+	0x74, 0x69, 0x6f, 0x6e, 0x73, 0x52, 0x07, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x22, 0x89,
+	0x02, 0x0a, 0x15, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x44, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70,
+	0x74, 0x6f, 0x72, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x1d, 0x0a, 0x0a,
+	0x69, 0x6e, 0x70, 0x75, 0x74, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x09, 0x69, 0x6e, 0x70, 0x75, 0x74, 0x54, 0x79, 0x70, 0x65, 0x12, 0x1f, 0x0a, 0x0b, 0x6f,
+	0x75, 0x74, 0x70, 0x75, 0x74, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x0a, 0x6f, 0x75, 0x74, 0x70, 0x75, 0x74, 0x54, 0x79, 0x70, 0x65, 0x12, 0x38, 0x0a, 0x07,
+	0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1e, 0x2e,
+	0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e,
+	0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x52, 0x07, 0x6f,
+	0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x30, 0x0a, 0x10, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74,
+	0x5f, 0x73, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x69, 0x6e, 0x67, 0x18, 0x05, 0x20, 0x01, 0x28, 0x08,
+	0x3a, 0x05, 0x66, 0x61, 0x6c, 0x73, 0x65, 0x52, 0x0f, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x53,
+	0x74, 0x72, 0x65, 0x61, 0x6d, 0x69, 0x6e, 0x67, 0x12, 0x30, 0x0a, 0x10, 0x73, 0x65, 0x72, 0x76,
+	0x65, 0x72, 0x5f, 0x73, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x69, 0x6e, 0x67, 0x18, 0x06, 0x20, 0x01,
+	0x28, 0x08, 0x3a, 0x05, 0x66, 0x61, 0x6c, 0x73, 0x65, 0x52, 0x0f, 0x73, 0x65, 0x72, 0x76, 0x65,
+	0x72, 0x53, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x69, 0x6e, 0x67, 0x22, 0x91, 0x09, 0x0a, 0x0b, 0x46,
+	0x69, 0x6c, 0x65, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x21, 0x0a, 0x0c, 0x6a, 0x61,
+	0x76, 0x61, 0x5f, 0x70, 0x61, 0x63, 0x6b, 0x61, 0x67, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x0b, 0x6a, 0x61, 0x76, 0x61, 0x50, 0x61, 0x63, 0x6b, 0x61, 0x67, 0x65, 0x12, 0x30, 0x0a,
+	0x14, 0x6a, 0x61, 0x76, 0x61, 0x5f, 0x6f, 0x75, 0x74, 0x65, 0x72, 0x5f, 0x63, 0x6c, 0x61, 0x73,
+	0x73, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x08, 0x20, 0x01, 0x28, 0x09, 0x52, 0x12, 0x6a, 0x61, 0x76,
+	0x61, 0x4f, 0x75, 0x74, 0x65, 0x72, 0x43, 0x6c, 0x61, 0x73, 0x73, 0x6e, 0x61, 0x6d, 0x65, 0x12,
+	0x35, 0x0a, 0x13, 0x6a, 0x61, 0x76, 0x61, 0x5f, 0x6d, 0x75, 0x6c, 0x74, 0x69, 0x70, 0x6c, 0x65,
+	0x5f, 0x66, 0x69, 0x6c, 0x65, 0x73, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x08, 0x3a, 0x05, 0x66, 0x61,
+	0x6c, 0x73, 0x65, 0x52, 0x11, 0x6a, 0x61, 0x76, 0x61, 0x4d, 0x75, 0x6c, 0x74, 0x69, 0x70, 0x6c,
+	0x65, 0x46, 0x69, 0x6c, 0x65, 0x73, 0x12, 0x44, 0x0a, 0x1d, 0x6a, 0x61, 0x76, 0x61, 0x5f, 0x67,
+	0x65, 0x6e, 0x65, 0x72, 0x61, 0x74, 0x65, 0x5f, 0x65, 0x71, 0x75, 0x61, 0x6c, 0x73, 0x5f, 0x61,
+	0x6e, 0x64, 0x5f, 0x68, 0x61, 0x73, 0x68, 0x18, 0x14, 0x20, 0x01, 0x28, 0x08, 0x42, 0x02, 0x18,
+	0x01, 0x52, 0x19, 0x6a, 0x61, 0x76, 0x61, 0x47, 0x65, 0x6e, 0x65, 0x72, 0x61, 0x74, 0x65, 0x45,
+	0x71, 0x75, 0x61, 0x6c, 0x73, 0x41, 0x6e, 0x64, 0x48, 0x61, 0x73, 0x68, 0x12, 0x3a, 0x0a, 0x16,
+	0x6a, 0x61, 0x76, 0x61, 0x5f, 0x73, 0x74, 0x72, 0x69, 0x6e, 0x67, 0x5f, 0x63, 0x68, 0x65, 0x63,
+	0x6b, 0x5f, 0x75, 0x74, 0x66, 0x38, 0x18, 0x1b, 0x20, 0x01, 0x28, 0x08, 0x3a, 0x05, 0x66, 0x61,
+	0x6c, 0x73, 0x65, 0x52, 0x13, 0x6a, 0x61, 0x76, 0x61, 0x53, 0x74, 0x72, 0x69, 0x6e, 0x67, 0x43,
+	0x68, 0x65, 0x63, 0x6b, 0x55, 0x74, 0x66, 0x38, 0x12, 0x53, 0x0a, 0x0c, 0x6f, 0x70, 0x74, 0x69,
+	0x6d, 0x69, 0x7a, 0x65, 0x5f, 0x66, 0x6f, 0x72, 0x18, 0x09, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x29,
+	0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66,
+	0x2e, 0x46, 0x69, 0x6c, 0x65, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x4f, 0x70, 0x74,
+	0x69, 0x6d, 0x69, 0x7a, 0x65, 0x4d, 0x6f, 0x64, 0x65, 0x3a, 0x05, 0x53, 0x50, 0x45, 0x45, 0x44,
+	0x52, 0x0b, 0x6f, 0x70, 0x74, 0x69, 0x6d, 0x69, 0x7a, 0x65, 0x46, 0x6f, 0x72, 0x12, 0x1d, 0x0a,
+	0x0a, 0x67, 0x6f, 0x5f, 0x70, 0x61, 0x63, 0x6b, 0x61, 0x67, 0x65, 0x18, 0x0b, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x09, 0x67, 0x6f, 0x50, 0x61, 0x63, 0x6b, 0x61, 0x67, 0x65, 0x12, 0x35, 0x0a, 0x13,
+	0x63, 0x63, 0x5f, 0x67, 0x65, 0x6e, 0x65, 0x72, 0x69, 0x63, 0x5f, 0x73, 0x65, 0x72, 0x76, 0x69,
+	0x63, 0x65, 0x73, 0x18, 0x10, 0x20, 0x01, 0x28, 0x08, 0x3a, 0x05, 0x66, 0x61, 0x6c, 0x73, 0x65,
+	0x52, 0x11, 0x63, 0x63, 0x47, 0x65, 0x6e, 0x65, 0x72, 0x69, 0x63, 0x53, 0x65, 0x72, 0x76, 0x69,
+	0x63, 0x65, 0x73, 0x12, 0x39, 0x0a, 0x15, 0x6a, 0x61, 0x76, 0x61, 0x5f, 0x67, 0x65, 0x6e, 0x65,
+	0x72, 0x69, 0x63, 0x5f, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x18, 0x11, 0x20, 0x01,
+	0x28, 0x08, 0x3a, 0x05, 0x66, 0x61, 0x6c, 0x73, 0x65, 0x52, 0x13, 0x6a, 0x61, 0x76, 0x61, 0x47,
+	0x65, 0x6e, 0x65, 0x72, 0x69, 0x63, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x12, 0x35,
+	0x0a, 0x13, 0x70, 0x79, 0x5f, 0x67, 0x65, 0x6e, 0x65, 0x72, 0x69, 0x63, 0x5f, 0x73, 0x65, 0x72,
+	0x76, 0x69, 0x63, 0x65, 0x73, 0x18, 0x12, 0x20, 0x01, 0x28, 0x08, 0x3a, 0x05, 0x66, 0x61, 0x6c,
+	0x73, 0x65, 0x52, 0x11, 0x70, 0x79, 0x47, 0x65, 0x6e, 0x65, 0x72, 0x69, 0x63, 0x53, 0x65, 0x72,
+	0x76, 0x69, 0x63, 0x65, 0x73, 0x12, 0x37, 0x0a, 0x14, 0x70, 0x68, 0x70, 0x5f, 0x67, 0x65, 0x6e,
+	0x65, 0x72, 0x69, 0x63, 0x5f, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x18, 0x2a, 0x20,
+	0x01, 0x28, 0x08, 0x3a, 0x05, 0x66, 0x61, 0x6c, 0x73, 0x65, 0x52, 0x12, 0x70, 0x68, 0x70, 0x47,
+	0x65, 0x6e, 0x65, 0x72, 0x69, 0x63, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x12, 0x25,
+	0x0a, 0x0a, 0x64, 0x65, 0x70, 0x72, 0x65, 0x63, 0x61, 0x74, 0x65, 0x64, 0x18, 0x17, 0x20, 0x01,
+	0x28, 0x08, 0x3a, 0x05, 0x66, 0x61, 0x6c, 0x73, 0x65, 0x52, 0x0a, 0x64, 0x65, 0x70, 0x72, 0x65,
+	0x63, 0x61, 0x74, 0x65, 0x64, 0x12, 0x2e, 0x0a, 0x10, 0x63, 0x63, 0x5f, 0x65, 0x6e, 0x61, 0x62,
+	0x6c, 0x65, 0x5f, 0x61, 0x72, 0x65, 0x6e, 0x61, 0x73, 0x18, 0x1f, 0x20, 0x01, 0x28, 0x08, 0x3a,
+	0x04, 0x74, 0x72, 0x75, 0x65, 0x52, 0x0e, 0x63, 0x63, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x41,
+	0x72, 0x65, 0x6e, 0x61, 0x73, 0x12, 0x2a, 0x0a, 0x11, 0x6f, 0x62, 0x6a, 0x63, 0x5f, 0x63, 0x6c,
+	0x61, 0x73, 0x73, 0x5f, 0x70, 0x72, 0x65, 0x66, 0x69, 0x78, 0x18, 0x24, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x0f, 0x6f, 0x62, 0x6a, 0x63, 0x43, 0x6c, 0x61, 0x73, 0x73, 0x50, 0x72, 0x65, 0x66, 0x69,
+	0x78, 0x12, 0x29, 0x0a, 0x10, 0x63, 0x73, 0x68, 0x61, 0x72, 0x70, 0x5f, 0x6e, 0x61, 0x6d, 0x65,
+	0x73, 0x70, 0x61, 0x63, 0x65, 0x18, 0x25, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0f, 0x63, 0x73, 0x68,
+	0x61, 0x72, 0x70, 0x4e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x12, 0x21, 0x0a, 0x0c,
+	0x73, 0x77, 0x69, 0x66, 0x74, 0x5f, 0x70, 0x72, 0x65, 0x66, 0x69, 0x78, 0x18, 0x27, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x0b, 0x73, 0x77, 0x69, 0x66, 0x74, 0x50, 0x72, 0x65, 0x66, 0x69, 0x78, 0x12,
+	0x28, 0x0a, 0x10, 0x70, 0x68, 0x70, 0x5f, 0x63, 0x6c, 0x61, 0x73, 0x73, 0x5f, 0x70, 0x72, 0x65,
+	0x66, 0x69, 0x78, 0x18, 0x28, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0e, 0x70, 0x68, 0x70, 0x43, 0x6c,
+	0x61, 0x73, 0x73, 0x50, 0x72, 0x65, 0x66, 0x69, 0x78, 0x12, 0x23, 0x0a, 0x0d, 0x70, 0x68, 0x70,
+	0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x18, 0x29, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x0c, 0x70, 0x68, 0x70, 0x4e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x12, 0x34,
+	0x0a, 0x16, 0x70, 0x68, 0x70, 0x5f, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x5f, 0x6e,
+	0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x18, 0x2c, 0x20, 0x01, 0x28, 0x09, 0x52, 0x14,
+	0x70, 0x68, 0x70, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x4e, 0x61, 0x6d, 0x65, 0x73,
+	0x70, 0x61, 0x63, 0x65, 0x12, 0x21, 0x0a, 0x0c, 0x72, 0x75, 0x62, 0x79, 0x5f, 0x70, 0x61, 0x63,
+	0x6b, 0x61, 0x67, 0x65, 0x18, 0x2d, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x72, 0x75, 0x62, 0x79,
+	0x50, 0x61, 0x63, 0x6b, 0x61, 0x67, 0x65, 0x12, 0x58, 0x0a, 0x14, 0x75, 0x6e, 0x69, 0x6e, 0x74,
+	0x65, 0x72, 0x70, 0x72, 0x65, 0x74, 0x65, 0x64, 0x5f, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x18,
+	0xe7, 0x07, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x55, 0x6e, 0x69, 0x6e, 0x74, 0x65, 0x72,
+	0x70, 0x72, 0x65, 0x74, 0x65, 0x64, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x13, 0x75, 0x6e,
+	0x69, 0x6e, 0x74, 0x65, 0x72, 0x70, 0x72, 0x65, 0x74, 0x65, 0x64, 0x4f, 0x70, 0x74, 0x69, 0x6f,
+	0x6e, 0x22, 0x3a, 0x0a, 0x0c, 0x4f, 0x70, 0x74, 0x69, 0x6d, 0x69, 0x7a, 0x65, 0x4d, 0x6f, 0x64,
+	0x65, 0x12, 0x09, 0x0a, 0x05, 0x53, 0x50, 0x45, 0x45, 0x44, 0x10, 0x01, 0x12, 0x0d, 0x0a, 0x09,
+	0x43, 0x4f, 0x44, 0x45, 0x5f, 0x53, 0x49, 0x5a, 0x45, 0x10, 0x02, 0x12, 0x10, 0x0a, 0x0c, 0x4c,
+	0x49, 0x54, 0x45, 0x5f, 0x52, 0x55, 0x4e, 0x54, 0x49, 0x4d, 0x45, 0x10, 0x03, 0x2a, 0x09, 0x08,
+	0xe8, 0x07, 0x10, 0x80, 0x80, 0x80, 0x80, 0x02, 0x4a, 0x04, 0x08, 0x26, 0x10, 0x27, 0x22, 0xbb,
+	0x03, 0x0a, 0x0e, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e,
+	0x73, 0x12, 0x3c, 0x0a, 0x17, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x5f, 0x73, 0x65, 0x74,
+	0x5f, 0x77, 0x69, 0x72, 0x65, 0x5f, 0x66, 0x6f, 0x72, 0x6d, 0x61, 0x74, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x08, 0x3a, 0x05, 0x66, 0x61, 0x6c, 0x73, 0x65, 0x52, 0x14, 0x6d, 0x65, 0x73, 0x73, 0x61,
+	0x67, 0x65, 0x53, 0x65, 0x74, 0x57, 0x69, 0x72, 0x65, 0x46, 0x6f, 0x72, 0x6d, 0x61, 0x74, 0x12,
+	0x4c, 0x0a, 0x1f, 0x6e, 0x6f, 0x5f, 0x73, 0x74, 0x61, 0x6e, 0x64, 0x61, 0x72, 0x64, 0x5f, 0x64,
+	0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x6f, 0x72, 0x5f, 0x61, 0x63, 0x63, 0x65, 0x73, 0x73,
+	0x6f, 0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x3a, 0x05, 0x66, 0x61, 0x6c, 0x73, 0x65, 0x52,
+	0x1c, 0x6e, 0x6f, 0x53, 0x74, 0x61, 0x6e, 0x64, 0x61, 0x72, 0x64, 0x44, 0x65, 0x73, 0x63, 0x72,
+	0x69, 0x70, 0x74, 0x6f, 0x72, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x6f, 0x72, 0x12, 0x25, 0x0a,
+	0x0a, 0x64, 0x65, 0x70, 0x72, 0x65, 0x63, 0x61, 0x74, 0x65, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28,
+	0x08, 0x3a, 0x05, 0x66, 0x61, 0x6c, 0x73, 0x65, 0x52, 0x0a, 0x64, 0x65, 0x70, 0x72, 0x65, 0x63,
+	0x61, 0x74, 0x65, 0x64, 0x12, 0x1b, 0x0a, 0x09, 0x6d, 0x61, 0x70, 0x5f, 0x65, 0x6e, 0x74, 0x72,
+	0x79, 0x18, 0x07, 0x20, 0x01, 0x28, 0x08, 0x52, 0x08, 0x6d, 0x61, 0x70, 0x45, 0x6e, 0x74, 0x72,
+	0x79, 0x12, 0x56, 0x0a, 0x26, 0x64, 0x65, 0x70, 0x72, 0x65, 0x63, 0x61, 0x74, 0x65, 0x64, 0x5f,
+	0x6c, 0x65, 0x67, 0x61, 0x63, 0x79, 0x5f, 0x6a, 0x73, 0x6f, 0x6e, 0x5f, 0x66, 0x69, 0x65, 0x6c,
+	0x64, 0x5f, 0x63, 0x6f, 0x6e, 0x66, 0x6c, 0x69, 0x63, 0x74, 0x73, 0x18, 0x0b, 0x20, 0x01, 0x28,
+	0x08, 0x42, 0x02, 0x18, 0x01, 0x52, 0x22, 0x64, 0x65, 0x70, 0x72, 0x65, 0x63, 0x61, 0x74, 0x65,
+	0x64, 0x4c, 0x65, 0x67, 0x61, 0x63, 0x79, 0x4a, 0x73, 0x6f, 0x6e, 0x46, 0x69, 0x65, 0x6c, 0x64,
+	0x43, 0x6f, 0x6e, 0x66, 0x6c, 0x69, 0x63, 0x74, 0x73, 0x12, 0x58, 0x0a, 0x14, 0x75, 0x6e, 0x69,
+	0x6e, 0x74, 0x65, 0x72, 0x70, 0x72, 0x65, 0x74, 0x65, 0x64, 0x5f, 0x6f, 0x70, 0x74, 0x69, 0x6f,
+	0x6e, 0x18, 0xe7, 0x07, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
+	0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x55, 0x6e, 0x69, 0x6e, 0x74,
+	0x65, 0x72, 0x70, 0x72, 0x65, 0x74, 0x65, 0x64, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x13,
+	0x75, 0x6e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x70, 0x72, 0x65, 0x74, 0x65, 0x64, 0x4f, 0x70, 0x74,
+	0x69, 0x6f, 0x6e, 0x2a, 0x09, 0x08, 0xe8, 0x07, 0x10, 0x80, 0x80, 0x80, 0x80, 0x02, 0x4a, 0x04,
+	0x08, 0x04, 0x10, 0x05, 0x4a, 0x04, 0x08, 0x05, 0x10, 0x06, 0x4a, 0x04, 0x08, 0x06, 0x10, 0x07,
+	0x4a, 0x04, 0x08, 0x08, 0x10, 0x09, 0x4a, 0x04, 0x08, 0x09, 0x10, 0x0a, 0x22, 0x85, 0x09, 0x0a,
+	0x0c, 0x46, 0x69, 0x65, 0x6c, 0x64, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x41, 0x0a,
+	0x05, 0x63, 0x74, 0x79, 0x70, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x23, 0x2e, 0x67,
+	0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x46,
+	0x69, 0x65, 0x6c, 0x64, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x43, 0x54, 0x79, 0x70,
+	0x65, 0x3a, 0x06, 0x53, 0x54, 0x52, 0x49, 0x4e, 0x47, 0x52, 0x05, 0x63, 0x74, 0x79, 0x70, 0x65,
+	0x12, 0x16, 0x0a, 0x06, 0x70, 0x61, 0x63, 0x6b, 0x65, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08,
+	0x52, 0x06, 0x70, 0x61, 0x63, 0x6b, 0x65, 0x64, 0x12, 0x47, 0x0a, 0x06, 0x6a, 0x73, 0x74, 0x79,
+	0x70, 0x65, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x24, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
+	0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x46, 0x69, 0x65, 0x6c, 0x64,
+	0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x4a, 0x53, 0x54, 0x79, 0x70, 0x65, 0x3a, 0x09,
+	0x4a, 0x53, 0x5f, 0x4e, 0x4f, 0x52, 0x4d, 0x41, 0x4c, 0x52, 0x06, 0x6a, 0x73, 0x74, 0x79, 0x70,
+	0x65, 0x12, 0x19, 0x0a, 0x04, 0x6c, 0x61, 0x7a, 0x79, 0x18, 0x05, 0x20, 0x01, 0x28, 0x08, 0x3a,
+	0x05, 0x66, 0x61, 0x6c, 0x73, 0x65, 0x52, 0x04, 0x6c, 0x61, 0x7a, 0x79, 0x12, 0x2e, 0x0a, 0x0f,
+	0x75, 0x6e, 0x76, 0x65, 0x72, 0x69, 0x66, 0x69, 0x65, 0x64, 0x5f, 0x6c, 0x61, 0x7a, 0x79, 0x18,
+	0x0f, 0x20, 0x01, 0x28, 0x08, 0x3a, 0x05, 0x66, 0x61, 0x6c, 0x73, 0x65, 0x52, 0x0e, 0x75, 0x6e,
+	0x76, 0x65, 0x72, 0x69, 0x66, 0x69, 0x65, 0x64, 0x4c, 0x61, 0x7a, 0x79, 0x12, 0x25, 0x0a, 0x0a,
+	0x64, 0x65, 0x70, 0x72, 0x65, 0x63, 0x61, 0x74, 0x65, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08,
+	0x3a, 0x05, 0x66, 0x61, 0x6c, 0x73, 0x65, 0x52, 0x0a, 0x64, 0x65, 0x70, 0x72, 0x65, 0x63, 0x61,
+	0x74, 0x65, 0x64, 0x12, 0x19, 0x0a, 0x04, 0x77, 0x65, 0x61, 0x6b, 0x18, 0x0a, 0x20, 0x01, 0x28,
+	0x08, 0x3a, 0x05, 0x66, 0x61, 0x6c, 0x73, 0x65, 0x52, 0x04, 0x77, 0x65, 0x61, 0x6b, 0x12, 0x28,
+	0x0a, 0x0c, 0x64, 0x65, 0x62, 0x75, 0x67, 0x5f, 0x72, 0x65, 0x64, 0x61, 0x63, 0x74, 0x18, 0x10,
+	0x20, 0x01, 0x28, 0x08, 0x3a, 0x05, 0x66, 0x61, 0x6c, 0x73, 0x65, 0x52, 0x0b, 0x64, 0x65, 0x62,
+	0x75, 0x67, 0x52, 0x65, 0x64, 0x61, 0x63, 0x74, 0x12, 0x4b, 0x0a, 0x09, 0x72, 0x65, 0x74, 0x65,
+	0x6e, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x11, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x2d, 0x2e, 0x67, 0x6f,
+	0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x46, 0x69,
+	0x65, 0x6c, 0x64, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x4f, 0x70, 0x74, 0x69, 0x6f,
+	0x6e, 0x52, 0x65, 0x74, 0x65, 0x6e, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x09, 0x72, 0x65, 0x74, 0x65,
+	0x6e, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x4a, 0x0a, 0x06, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x18,
+	0x12, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x2e, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x46, 0x69, 0x65, 0x6c, 0x64, 0x4f, 0x70, 0x74,
+	0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x54, 0x61, 0x72, 0x67, 0x65,
+	0x74, 0x54, 0x79, 0x70, 0x65, 0x42, 0x02, 0x18, 0x01, 0x52, 0x06, 0x74, 0x61, 0x72, 0x67, 0x65,
+	0x74, 0x12, 0x48, 0x0a, 0x07, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x73, 0x18, 0x13, 0x20, 0x03,
+	0x28, 0x0e, 0x32, 0x2e, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74,
 	0x6f, 0x62, 0x75, 0x66, 0x2e, 0x46, 0x69, 0x65, 0x6c, 0x64, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e,
-	0x73, 0x2e, 0x4a, 0x53, 0x54, 0x79, 0x70, 0x65, 0x3a, 0x09, 0x4a, 0x53, 0x5f, 0x4e, 0x4f, 0x52,
-	0x4d, 0x41, 0x4c, 0x52, 0x06, 0x6a, 0x73, 0x74, 0x79, 0x70, 0x65, 0x12, 0x19, 0x0a, 0x04, 0x6c,
-	0x61, 0x7a, 0x79, 0x18, 0x05, 0x20, 0x01, 0x28, 0x08, 0x3a, 0x05, 0x66, 0x61, 0x6c, 0x73, 0x65,
-	0x52, 0x04, 0x6c, 0x61, 0x7a, 0x79, 0x12, 0x25, 0x0a, 0x0a, 0x64, 0x65, 0x70, 0x72, 0x65, 0x63,
-	0x61, 0x74, 0x65, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x3a, 0x05, 0x66, 0x61, 0x6c, 0x73,
-	0x65, 0x52, 0x0a, 0x64, 0x65, 0x70, 0x72, 0x65, 0x63, 0x61, 0x74, 0x65, 0x64, 0x12, 0x19, 0x0a,
-	0x04, 0x77, 0x65, 0x61, 0x6b, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x08, 0x3a, 0x05, 0x66, 0x61, 0x6c,
-	0x73, 0x65, 0x52, 0x04, 0x77, 0x65, 0x61, 0x6b, 0x12, 0x58, 0x0a, 0x14, 0x75, 0x6e, 0x69, 0x6e,
-	0x74, 0x65, 0x72, 0x70, 0x72, 0x65, 0x74, 0x65, 0x64, 0x5f, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e,
-	0x18, 0xe7, 0x07, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65,
-	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x55, 0x6e, 0x69, 0x6e, 0x74, 0x65,
-	0x72, 0x70, 0x72, 0x65, 0x74, 0x65, 0x64, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x13, 0x75,
-	0x6e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x70, 0x72, 0x65, 0x74, 0x65, 0x64, 0x4f, 0x70, 0x74, 0x69,
-	0x6f, 0x6e, 0x22, 0x2f, 0x0a, 0x05, 0x43, 0x54, 0x79, 0x70, 0x65, 0x12, 0x0a, 0x0a, 0x06, 0x53,
-	0x54, 0x52, 0x49, 0x4e, 0x47, 0x10, 0x00, 0x12, 0x08, 0x0a, 0x04, 0x43, 0x4f, 0x52, 0x44, 0x10,
-	0x01, 0x12, 0x10, 0x0a, 0x0c, 0x53, 0x54, 0x52, 0x49, 0x4e, 0x47, 0x5f, 0x50, 0x49, 0x45, 0x43,
-	0x45, 0x10, 0x02, 0x22, 0x35, 0x0a, 0x06, 0x4a, 0x53, 0x54, 0x79, 0x70, 0x65, 0x12, 0x0d, 0x0a,
-	0x09, 0x4a, 0x53, 0x5f, 0x4e, 0x4f, 0x52, 0x4d, 0x41, 0x4c, 0x10, 0x00, 0x12, 0x0d, 0x0a, 0x09,
-	0x4a, 0x53, 0x5f, 0x53, 0x54, 0x52, 0x49, 0x4e, 0x47, 0x10, 0x01, 0x12, 0x0d, 0x0a, 0x09, 0x4a,
-	0x53, 0x5f, 0x4e, 0x55, 0x4d, 0x42, 0x45, 0x52, 0x10, 0x02, 0x2a, 0x09, 0x08, 0xe8, 0x07, 0x10,
-	0x80, 0x80, 0x80, 0x80, 0x02, 0x4a, 0x04, 0x08, 0x04, 0x10, 0x05, 0x22, 0x73, 0x0a, 0x0c, 0x4f,
-	0x6e, 0x65, 0x6f, 0x66, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x58, 0x0a, 0x14, 0x75,
+	0x73, 0x2e, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x54, 0x61, 0x72, 0x67, 0x65, 0x74, 0x54, 0x79,
+	0x70, 0x65, 0x52, 0x07, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x73, 0x12, 0x58, 0x0a, 0x14, 0x75,
 	0x6e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x70, 0x72, 0x65, 0x74, 0x65, 0x64, 0x5f, 0x6f, 0x70, 0x74,
 	0x69, 0x6f, 0x6e, 0x18, 0xe7, 0x07, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x67, 0x6f, 0x6f,
 	0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x55, 0x6e, 0x69,
 	0x6e, 0x74, 0x65, 0x72, 0x70, 0x72, 0x65, 0x74, 0x65, 0x64, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e,
 	0x52, 0x13, 0x75, 0x6e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x70, 0x72, 0x65, 0x74, 0x65, 0x64, 0x4f,
-	0x70, 0x74, 0x69, 0x6f, 0x6e, 0x2a, 0x09, 0x08, 0xe8, 0x07, 0x10, 0x80, 0x80, 0x80, 0x80, 0x02,
-	0x22, 0xc0, 0x01, 0x0a, 0x0b, 0x45, 0x6e, 0x75, 0x6d, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73,
-	0x12, 0x1f, 0x0a, 0x0b, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x5f, 0x61, 0x6c, 0x69, 0x61, 0x73, 0x18,
-	0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0a, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x41, 0x6c, 0x69, 0x61,
-	0x73, 0x12, 0x25, 0x0a, 0x0a, 0x64, 0x65, 0x70, 0x72, 0x65, 0x63, 0x61, 0x74, 0x65, 0x64, 0x18,
-	0x03, 0x20, 0x01, 0x28, 0x08, 0x3a, 0x05, 0x66, 0x61, 0x6c, 0x73, 0x65, 0x52, 0x0a, 0x64, 0x65,
-	0x70, 0x72, 0x65, 0x63, 0x61, 0x74, 0x65, 0x64, 0x12, 0x58, 0x0a, 0x14, 0x75, 0x6e, 0x69, 0x6e,
-	0x74, 0x65, 0x72, 0x70, 0x72, 0x65, 0x74, 0x65, 0x64, 0x5f, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e,
-	0x18, 0xe7, 0x07, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65,
-	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x55, 0x6e, 0x69, 0x6e, 0x74, 0x65,
-	0x72, 0x70, 0x72, 0x65, 0x74, 0x65, 0x64, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x13, 0x75,
-	0x6e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x70, 0x72, 0x65, 0x74, 0x65, 0x64, 0x4f, 0x70, 0x74, 0x69,
-	0x6f, 0x6e, 0x2a, 0x09, 0x08, 0xe8, 0x07, 0x10, 0x80, 0x80, 0x80, 0x80, 0x02, 0x4a, 0x04, 0x08,
-	0x05, 0x10, 0x06, 0x22, 0x9e, 0x01, 0x0a, 0x10, 0x45, 0x6e, 0x75, 0x6d, 0x56, 0x61, 0x6c, 0x75,
+	0x70, 0x74, 0x69, 0x6f, 0x6e, 0x22, 0x2f, 0x0a, 0x05, 0x43, 0x54, 0x79, 0x70, 0x65, 0x12, 0x0a,
+	0x0a, 0x06, 0x53, 0x54, 0x52, 0x49, 0x4e, 0x47, 0x10, 0x00, 0x12, 0x08, 0x0a, 0x04, 0x43, 0x4f,
+	0x52, 0x44, 0x10, 0x01, 0x12, 0x10, 0x0a, 0x0c, 0x53, 0x54, 0x52, 0x49, 0x4e, 0x47, 0x5f, 0x50,
+	0x49, 0x45, 0x43, 0x45, 0x10, 0x02, 0x22, 0x35, 0x0a, 0x06, 0x4a, 0x53, 0x54, 0x79, 0x70, 0x65,
+	0x12, 0x0d, 0x0a, 0x09, 0x4a, 0x53, 0x5f, 0x4e, 0x4f, 0x52, 0x4d, 0x41, 0x4c, 0x10, 0x00, 0x12,
+	0x0d, 0x0a, 0x09, 0x4a, 0x53, 0x5f, 0x53, 0x54, 0x52, 0x49, 0x4e, 0x47, 0x10, 0x01, 0x12, 0x0d,
+	0x0a, 0x09, 0x4a, 0x53, 0x5f, 0x4e, 0x55, 0x4d, 0x42, 0x45, 0x52, 0x10, 0x02, 0x22, 0x55, 0x0a,
+	0x0f, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x74, 0x65, 0x6e, 0x74, 0x69, 0x6f, 0x6e,
+	0x12, 0x15, 0x0a, 0x11, 0x52, 0x45, 0x54, 0x45, 0x4e, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x55, 0x4e,
+	0x4b, 0x4e, 0x4f, 0x57, 0x4e, 0x10, 0x00, 0x12, 0x15, 0x0a, 0x11, 0x52, 0x45, 0x54, 0x45, 0x4e,
+	0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x52, 0x55, 0x4e, 0x54, 0x49, 0x4d, 0x45, 0x10, 0x01, 0x12, 0x14,
+	0x0a, 0x10, 0x52, 0x45, 0x54, 0x45, 0x4e, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x53, 0x4f, 0x55, 0x52,
+	0x43, 0x45, 0x10, 0x02, 0x22, 0x8c, 0x02, 0x0a, 0x10, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x54,
+	0x61, 0x72, 0x67, 0x65, 0x74, 0x54, 0x79, 0x70, 0x65, 0x12, 0x17, 0x0a, 0x13, 0x54, 0x41, 0x52,
+	0x47, 0x45, 0x54, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x55, 0x4e, 0x4b, 0x4e, 0x4f, 0x57, 0x4e,
+	0x10, 0x00, 0x12, 0x14, 0x0a, 0x10, 0x54, 0x41, 0x52, 0x47, 0x45, 0x54, 0x5f, 0x54, 0x59, 0x50,
+	0x45, 0x5f, 0x46, 0x49, 0x4c, 0x45, 0x10, 0x01, 0x12, 0x1f, 0x0a, 0x1b, 0x54, 0x41, 0x52, 0x47,
+	0x45, 0x54, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x45, 0x58, 0x54, 0x45, 0x4e, 0x53, 0x49, 0x4f,
+	0x4e, 0x5f, 0x52, 0x41, 0x4e, 0x47, 0x45, 0x10, 0x02, 0x12, 0x17, 0x0a, 0x13, 0x54, 0x41, 0x52,
+	0x47, 0x45, 0x54, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x4d, 0x45, 0x53, 0x53, 0x41, 0x47, 0x45,
+	0x10, 0x03, 0x12, 0x15, 0x0a, 0x11, 0x54, 0x41, 0x52, 0x47, 0x45, 0x54, 0x5f, 0x54, 0x59, 0x50,
+	0x45, 0x5f, 0x46, 0x49, 0x45, 0x4c, 0x44, 0x10, 0x04, 0x12, 0x15, 0x0a, 0x11, 0x54, 0x41, 0x52,
+	0x47, 0x45, 0x54, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x4f, 0x4e, 0x45, 0x4f, 0x46, 0x10, 0x05,
+	0x12, 0x14, 0x0a, 0x10, 0x54, 0x41, 0x52, 0x47, 0x45, 0x54, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f,
+	0x45, 0x4e, 0x55, 0x4d, 0x10, 0x06, 0x12, 0x1a, 0x0a, 0x16, 0x54, 0x41, 0x52, 0x47, 0x45, 0x54,
+	0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x45, 0x4e, 0x54, 0x52, 0x59,
+	0x10, 0x07, 0x12, 0x17, 0x0a, 0x13, 0x54, 0x41, 0x52, 0x47, 0x45, 0x54, 0x5f, 0x54, 0x59, 0x50,
+	0x45, 0x5f, 0x53, 0x45, 0x52, 0x56, 0x49, 0x43, 0x45, 0x10, 0x08, 0x12, 0x16, 0x0a, 0x12, 0x54,
+	0x41, 0x52, 0x47, 0x45, 0x54, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x4d, 0x45, 0x54, 0x48, 0x4f,
+	0x44, 0x10, 0x09, 0x2a, 0x09, 0x08, 0xe8, 0x07, 0x10, 0x80, 0x80, 0x80, 0x80, 0x02, 0x4a, 0x04,
+	0x08, 0x04, 0x10, 0x05, 0x22, 0x73, 0x0a, 0x0c, 0x4f, 0x6e, 0x65, 0x6f, 0x66, 0x4f, 0x70, 0x74,
+	0x69, 0x6f, 0x6e, 0x73, 0x12, 0x58, 0x0a, 0x14, 0x75, 0x6e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x70,
+	0x72, 0x65, 0x74, 0x65, 0x64, 0x5f, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0xe7, 0x07, 0x20,
+	0x03, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f,
+	0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x55, 0x6e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x70, 0x72, 0x65,
+	0x74, 0x65, 0x64, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x13, 0x75, 0x6e, 0x69, 0x6e, 0x74,
+	0x65, 0x72, 0x70, 0x72, 0x65, 0x74, 0x65, 0x64, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x2a, 0x09,
+	0x08, 0xe8, 0x07, 0x10, 0x80, 0x80, 0x80, 0x80, 0x02, 0x22, 0x98, 0x02, 0x0a, 0x0b, 0x45, 0x6e,
+	0x75, 0x6d, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x1f, 0x0a, 0x0b, 0x61, 0x6c, 0x6c,
+	0x6f, 0x77, 0x5f, 0x61, 0x6c, 0x69, 0x61, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0a,
+	0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x41, 0x6c, 0x69, 0x61, 0x73, 0x12, 0x25, 0x0a, 0x0a, 0x64, 0x65,
+	0x70, 0x72, 0x65, 0x63, 0x61, 0x74, 0x65, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x3a, 0x05,
+	0x66, 0x61, 0x6c, 0x73, 0x65, 0x52, 0x0a, 0x64, 0x65, 0x70, 0x72, 0x65, 0x63, 0x61, 0x74, 0x65,
+	0x64, 0x12, 0x56, 0x0a, 0x26, 0x64, 0x65, 0x70, 0x72, 0x65, 0x63, 0x61, 0x74, 0x65, 0x64, 0x5f,
+	0x6c, 0x65, 0x67, 0x61, 0x63, 0x79, 0x5f, 0x6a, 0x73, 0x6f, 0x6e, 0x5f, 0x66, 0x69, 0x65, 0x6c,
+	0x64, 0x5f, 0x63, 0x6f, 0x6e, 0x66, 0x6c, 0x69, 0x63, 0x74, 0x73, 0x18, 0x06, 0x20, 0x01, 0x28,
+	0x08, 0x42, 0x02, 0x18, 0x01, 0x52, 0x22, 0x64, 0x65, 0x70, 0x72, 0x65, 0x63, 0x61, 0x74, 0x65,
+	0x64, 0x4c, 0x65, 0x67, 0x61, 0x63, 0x79, 0x4a, 0x73, 0x6f, 0x6e, 0x46, 0x69, 0x65, 0x6c, 0x64,
+	0x43, 0x6f, 0x6e, 0x66, 0x6c, 0x69, 0x63, 0x74, 0x73, 0x12, 0x58, 0x0a, 0x14, 0x75, 0x6e, 0x69,
+	0x6e, 0x74, 0x65, 0x72, 0x70, 0x72, 0x65, 0x74, 0x65, 0x64, 0x5f, 0x6f, 0x70, 0x74, 0x69, 0x6f,
+	0x6e, 0x18, 0xe7, 0x07, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
+	0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x55, 0x6e, 0x69, 0x6e, 0x74,
+	0x65, 0x72, 0x70, 0x72, 0x65, 0x74, 0x65, 0x64, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x13,
+	0x75, 0x6e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x70, 0x72, 0x65, 0x74, 0x65, 0x64, 0x4f, 0x70, 0x74,
+	0x69, 0x6f, 0x6e, 0x2a, 0x09, 0x08, 0xe8, 0x07, 0x10, 0x80, 0x80, 0x80, 0x80, 0x02, 0x4a, 0x04,
+	0x08, 0x05, 0x10, 0x06, 0x22, 0x9e, 0x01, 0x0a, 0x10, 0x45, 0x6e, 0x75, 0x6d, 0x56, 0x61, 0x6c,
+	0x75, 0x65, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x25, 0x0a, 0x0a, 0x64, 0x65, 0x70,
+	0x72, 0x65, 0x63, 0x61, 0x74, 0x65, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x3a, 0x05, 0x66,
+	0x61, 0x6c, 0x73, 0x65, 0x52, 0x0a, 0x64, 0x65, 0x70, 0x72, 0x65, 0x63, 0x61, 0x74, 0x65, 0x64,
+	0x12, 0x58, 0x0a, 0x14, 0x75, 0x6e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x70, 0x72, 0x65, 0x74, 0x65,
+	0x64, 0x5f, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0xe7, 0x07, 0x20, 0x03, 0x28, 0x0b, 0x32,
+	0x24, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75,
+	0x66, 0x2e, 0x55, 0x6e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x70, 0x72, 0x65, 0x74, 0x65, 0x64, 0x4f,
+	0x70, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x13, 0x75, 0x6e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x70, 0x72,
+	0x65, 0x74, 0x65, 0x64, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x2a, 0x09, 0x08, 0xe8, 0x07, 0x10,
+	0x80, 0x80, 0x80, 0x80, 0x02, 0x22, 0x9c, 0x01, 0x0a, 0x0e, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63,
 	0x65, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x25, 0x0a, 0x0a, 0x64, 0x65, 0x70, 0x72,
-	0x65, 0x63, 0x61, 0x74, 0x65, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x3a, 0x05, 0x66, 0x61,
+	0x65, 0x63, 0x61, 0x74, 0x65, 0x64, 0x18, 0x21, 0x20, 0x01, 0x28, 0x08, 0x3a, 0x05, 0x66, 0x61,
 	0x6c, 0x73, 0x65, 0x52, 0x0a, 0x64, 0x65, 0x70, 0x72, 0x65, 0x63, 0x61, 0x74, 0x65, 0x64, 0x12,
 	0x58, 0x0a, 0x14, 0x75, 0x6e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x70, 0x72, 0x65, 0x74, 0x65, 0x64,
 	0x5f, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0xe7, 0x07, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x24,
@@ -3385,97 +4012,95 @@ var file_google_protobuf_descriptor_proto_rawDesc = []byte{
 	0x2e, 0x55, 0x6e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x70, 0x72, 0x65, 0x74, 0x65, 0x64, 0x4f, 0x70,
 	0x74, 0x69, 0x6f, 0x6e, 0x52, 0x13, 0x75, 0x6e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x70, 0x72, 0x65,
 	0x74, 0x65, 0x64, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x2a, 0x09, 0x08, 0xe8, 0x07, 0x10, 0x80,
-	0x80, 0x80, 0x80, 0x02, 0x22, 0x9c, 0x01, 0x0a, 0x0e, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65,
-	0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x25, 0x0a, 0x0a, 0x64, 0x65, 0x70, 0x72, 0x65,
-	0x63, 0x61, 0x74, 0x65, 0x64, 0x18, 0x21, 0x20, 0x01, 0x28, 0x08, 0x3a, 0x05, 0x66, 0x61, 0x6c,
-	0x73, 0x65, 0x52, 0x0a, 0x64, 0x65, 0x70, 0x72, 0x65, 0x63, 0x61, 0x74, 0x65, 0x64, 0x12, 0x58,
-	0x0a, 0x14, 0x75, 0x6e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x70, 0x72, 0x65, 0x74, 0x65, 0x64, 0x5f,
-	0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0xe7, 0x07, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x24, 0x2e,
+	0x80, 0x80, 0x80, 0x02, 0x22, 0xe0, 0x02, 0x0a, 0x0d, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x4f,
+	0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x25, 0x0a, 0x0a, 0x64, 0x65, 0x70, 0x72, 0x65, 0x63,
+	0x61, 0x74, 0x65, 0x64, 0x18, 0x21, 0x20, 0x01, 0x28, 0x08, 0x3a, 0x05, 0x66, 0x61, 0x6c, 0x73,
+	0x65, 0x52, 0x0a, 0x64, 0x65, 0x70, 0x72, 0x65, 0x63, 0x61, 0x74, 0x65, 0x64, 0x12, 0x71, 0x0a,
+	0x11, 0x69, 0x64, 0x65, 0x6d, 0x70, 0x6f, 0x74, 0x65, 0x6e, 0x63, 0x79, 0x5f, 0x6c, 0x65, 0x76,
+	0x65, 0x6c, 0x18, 0x22, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x2f, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
+	0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x4d, 0x65, 0x74, 0x68, 0x6f,
+	0x64, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x49, 0x64, 0x65, 0x6d, 0x70, 0x6f, 0x74,
+	0x65, 0x6e, 0x63, 0x79, 0x4c, 0x65, 0x76, 0x65, 0x6c, 0x3a, 0x13, 0x49, 0x44, 0x45, 0x4d, 0x50,
+	0x4f, 0x54, 0x45, 0x4e, 0x43, 0x59, 0x5f, 0x55, 0x4e, 0x4b, 0x4e, 0x4f, 0x57, 0x4e, 0x52, 0x10,
+	0x69, 0x64, 0x65, 0x6d, 0x70, 0x6f, 0x74, 0x65, 0x6e, 0x63, 0x79, 0x4c, 0x65, 0x76, 0x65, 0x6c,
+	0x12, 0x58, 0x0a, 0x14, 0x75, 0x6e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x70, 0x72, 0x65, 0x74, 0x65,
+	0x64, 0x5f, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0xe7, 0x07, 0x20, 0x03, 0x28, 0x0b, 0x32,
+	0x24, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75,
+	0x66, 0x2e, 0x55, 0x6e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x70, 0x72, 0x65, 0x74, 0x65, 0x64, 0x4f,
+	0x70, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x13, 0x75, 0x6e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x70, 0x72,
+	0x65, 0x74, 0x65, 0x64, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x22, 0x50, 0x0a, 0x10, 0x49, 0x64,
+	0x65, 0x6d, 0x70, 0x6f, 0x74, 0x65, 0x6e, 0x63, 0x79, 0x4c, 0x65, 0x76, 0x65, 0x6c, 0x12, 0x17,
+	0x0a, 0x13, 0x49, 0x44, 0x45, 0x4d, 0x50, 0x4f, 0x54, 0x45, 0x4e, 0x43, 0x59, 0x5f, 0x55, 0x4e,
+	0x4b, 0x4e, 0x4f, 0x57, 0x4e, 0x10, 0x00, 0x12, 0x13, 0x0a, 0x0f, 0x4e, 0x4f, 0x5f, 0x53, 0x49,
+	0x44, 0x45, 0x5f, 0x45, 0x46, 0x46, 0x45, 0x43, 0x54, 0x53, 0x10, 0x01, 0x12, 0x0e, 0x0a, 0x0a,
+	0x49, 0x44, 0x45, 0x4d, 0x50, 0x4f, 0x54, 0x45, 0x4e, 0x54, 0x10, 0x02, 0x2a, 0x09, 0x08, 0xe8,
+	0x07, 0x10, 0x80, 0x80, 0x80, 0x80, 0x02, 0x22, 0x9a, 0x03, 0x0a, 0x13, 0x55, 0x6e, 0x69, 0x6e,
+	0x74, 0x65, 0x72, 0x70, 0x72, 0x65, 0x74, 0x65, 0x64, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x12,
+	0x41, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x2d, 0x2e,
 	0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e,
 	0x55, 0x6e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x70, 0x72, 0x65, 0x74, 0x65, 0x64, 0x4f, 0x70, 0x74,
-	0x69, 0x6f, 0x6e, 0x52, 0x13, 0x75, 0x6e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x70, 0x72, 0x65, 0x74,
-	0x65, 0x64, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x2a, 0x09, 0x08, 0xe8, 0x07, 0x10, 0x80, 0x80,
-	0x80, 0x80, 0x02, 0x22, 0xe0, 0x02, 0x0a, 0x0d, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x4f, 0x70,
-	0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x25, 0x0a, 0x0a, 0x64, 0x65, 0x70, 0x72, 0x65, 0x63, 0x61,
-	0x74, 0x65, 0x64, 0x18, 0x21, 0x20, 0x01, 0x28, 0x08, 0x3a, 0x05, 0x66, 0x61, 0x6c, 0x73, 0x65,
-	0x52, 0x0a, 0x64, 0x65, 0x70, 0x72, 0x65, 0x63, 0x61, 0x74, 0x65, 0x64, 0x12, 0x71, 0x0a, 0x11,
-	0x69, 0x64, 0x65, 0x6d, 0x70, 0x6f, 0x74, 0x65, 0x6e, 0x63, 0x79, 0x5f, 0x6c, 0x65, 0x76, 0x65,
-	0x6c, 0x18, 0x22, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x2f, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65,
-	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64,
-	0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x49, 0x64, 0x65, 0x6d, 0x70, 0x6f, 0x74, 0x65,
-	0x6e, 0x63, 0x79, 0x4c, 0x65, 0x76, 0x65, 0x6c, 0x3a, 0x13, 0x49, 0x44, 0x45, 0x4d, 0x50, 0x4f,
-	0x54, 0x45, 0x4e, 0x43, 0x59, 0x5f, 0x55, 0x4e, 0x4b, 0x4e, 0x4f, 0x57, 0x4e, 0x52, 0x10, 0x69,
-	0x64, 0x65, 0x6d, 0x70, 0x6f, 0x74, 0x65, 0x6e, 0x63, 0x79, 0x4c, 0x65, 0x76, 0x65, 0x6c, 0x12,
-	0x58, 0x0a, 0x14, 0x75, 0x6e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x70, 0x72, 0x65, 0x74, 0x65, 0x64,
-	0x5f, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0xe7, 0x07, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x24,
-	0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66,
-	0x2e, 0x55, 0x6e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x70, 0x72, 0x65, 0x74, 0x65, 0x64, 0x4f, 0x70,
-	0x74, 0x69, 0x6f, 0x6e, 0x52, 0x13, 0x75, 0x6e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x70, 0x72, 0x65,
-	0x74, 0x65, 0x64, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x22, 0x50, 0x0a, 0x10, 0x49, 0x64, 0x65,
-	0x6d, 0x70, 0x6f, 0x74, 0x65, 0x6e, 0x63, 0x79, 0x4c, 0x65, 0x76, 0x65, 0x6c, 0x12, 0x17, 0x0a,
-	0x13, 0x49, 0x44, 0x45, 0x4d, 0x50, 0x4f, 0x54, 0x45, 0x4e, 0x43, 0x59, 0x5f, 0x55, 0x4e, 0x4b,
-	0x4e, 0x4f, 0x57, 0x4e, 0x10, 0x00, 0x12, 0x13, 0x0a, 0x0f, 0x4e, 0x4f, 0x5f, 0x53, 0x49, 0x44,
-	0x45, 0x5f, 0x45, 0x46, 0x46, 0x45, 0x43, 0x54, 0x53, 0x10, 0x01, 0x12, 0x0e, 0x0a, 0x0a, 0x49,
-	0x44, 0x45, 0x4d, 0x50, 0x4f, 0x54, 0x45, 0x4e, 0x54, 0x10, 0x02, 0x2a, 0x09, 0x08, 0xe8, 0x07,
-	0x10, 0x80, 0x80, 0x80, 0x80, 0x02, 0x22, 0x9a, 0x03, 0x0a, 0x13, 0x55, 0x6e, 0x69, 0x6e, 0x74,
-	0x65, 0x72, 0x70, 0x72, 0x65, 0x74, 0x65, 0x64, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x41,
-	0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x2d, 0x2e, 0x67,
-	0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x55,
-	0x6e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x70, 0x72, 0x65, 0x74, 0x65, 0x64, 0x4f, 0x70, 0x74, 0x69,
-	0x6f, 0x6e, 0x2e, 0x4e, 0x61, 0x6d, 0x65, 0x50, 0x61, 0x72, 0x74, 0x52, 0x04, 0x6e, 0x61, 0x6d,
-	0x65, 0x12, 0x29, 0x0a, 0x10, 0x69, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x66, 0x69, 0x65, 0x72, 0x5f,
-	0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0f, 0x69, 0x64, 0x65,
-	0x6e, 0x74, 0x69, 0x66, 0x69, 0x65, 0x72, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x2c, 0x0a, 0x12,
-	0x70, 0x6f, 0x73, 0x69, 0x74, 0x69, 0x76, 0x65, 0x5f, 0x69, 0x6e, 0x74, 0x5f, 0x76, 0x61, 0x6c,
-	0x75, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x04, 0x52, 0x10, 0x70, 0x6f, 0x73, 0x69, 0x74, 0x69,
-	0x76, 0x65, 0x49, 0x6e, 0x74, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x2c, 0x0a, 0x12, 0x6e, 0x65,
-	0x67, 0x61, 0x74, 0x69, 0x76, 0x65, 0x5f, 0x69, 0x6e, 0x74, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65,
-	0x18, 0x05, 0x20, 0x01, 0x28, 0x03, 0x52, 0x10, 0x6e, 0x65, 0x67, 0x61, 0x74, 0x69, 0x76, 0x65,
-	0x49, 0x6e, 0x74, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x21, 0x0a, 0x0c, 0x64, 0x6f, 0x75, 0x62,
-	0x6c, 0x65, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x06, 0x20, 0x01, 0x28, 0x01, 0x52, 0x0b,
-	0x64, 0x6f, 0x75, 0x62, 0x6c, 0x65, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x21, 0x0a, 0x0c, 0x73,
-	0x74, 0x72, 0x69, 0x6e, 0x67, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x07, 0x20, 0x01, 0x28,
-	0x0c, 0x52, 0x0b, 0x73, 0x74, 0x72, 0x69, 0x6e, 0x67, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x27,
-	0x0a, 0x0f, 0x61, 0x67, 0x67, 0x72, 0x65, 0x67, 0x61, 0x74, 0x65, 0x5f, 0x76, 0x61, 0x6c, 0x75,
-	0x65, 0x18, 0x08, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0e, 0x61, 0x67, 0x67, 0x72, 0x65, 0x67, 0x61,
-	0x74, 0x65, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x1a, 0x4a, 0x0a, 0x08, 0x4e, 0x61, 0x6d, 0x65, 0x50,
-	0x61, 0x72, 0x74, 0x12, 0x1b, 0x0a, 0x09, 0x6e, 0x61, 0x6d, 0x65, 0x5f, 0x70, 0x61, 0x72, 0x74,
-	0x18, 0x01, 0x20, 0x02, 0x28, 0x09, 0x52, 0x08, 0x6e, 0x61, 0x6d, 0x65, 0x50, 0x61, 0x72, 0x74,
-	0x12, 0x21, 0x0a, 0x0c, 0x69, 0x73, 0x5f, 0x65, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e,
-	0x18, 0x02, 0x20, 0x02, 0x28, 0x08, 0x52, 0x0b, 0x69, 0x73, 0x45, 0x78, 0x74, 0x65, 0x6e, 0x73,
-	0x69, 0x6f, 0x6e, 0x22, 0xa7, 0x02, 0x0a, 0x0e, 0x53, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x43, 0x6f,
-	0x64, 0x65, 0x49, 0x6e, 0x66, 0x6f, 0x12, 0x44, 0x0a, 0x08, 0x6c, 0x6f, 0x63, 0x61, 0x74, 0x69,
-	0x6f, 0x6e, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x28, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
-	0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x53, 0x6f, 0x75, 0x72, 0x63,
-	0x65, 0x43, 0x6f, 0x64, 0x65, 0x49, 0x6e, 0x66, 0x6f, 0x2e, 0x4c, 0x6f, 0x63, 0x61, 0x74, 0x69,
-	0x6f, 0x6e, 0x52, 0x08, 0x6c, 0x6f, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x1a, 0xce, 0x01, 0x0a,
-	0x08, 0x4c, 0x6f, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x16, 0x0a, 0x04, 0x70, 0x61, 0x74,
-	0x68, 0x18, 0x01, 0x20, 0x03, 0x28, 0x05, 0x42, 0x02, 0x10, 0x01, 0x52, 0x04, 0x70, 0x61, 0x74,
-	0x68, 0x12, 0x16, 0x0a, 0x04, 0x73, 0x70, 0x61, 0x6e, 0x18, 0x02, 0x20, 0x03, 0x28, 0x05, 0x42,
-	0x02, 0x10, 0x01, 0x52, 0x04, 0x73, 0x70, 0x61, 0x6e, 0x12, 0x29, 0x0a, 0x10, 0x6c, 0x65, 0x61,
-	0x64, 0x69, 0x6e, 0x67, 0x5f, 0x63, 0x6f, 0x6d, 0x6d, 0x65, 0x6e, 0x74, 0x73, 0x18, 0x03, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x0f, 0x6c, 0x65, 0x61, 0x64, 0x69, 0x6e, 0x67, 0x43, 0x6f, 0x6d, 0x6d,
-	0x65, 0x6e, 0x74, 0x73, 0x12, 0x2b, 0x0a, 0x11, 0x74, 0x72, 0x61, 0x69, 0x6c, 0x69, 0x6e, 0x67,
-	0x5f, 0x63, 0x6f, 0x6d, 0x6d, 0x65, 0x6e, 0x74, 0x73, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x10, 0x74, 0x72, 0x61, 0x69, 0x6c, 0x69, 0x6e, 0x67, 0x43, 0x6f, 0x6d, 0x6d, 0x65, 0x6e, 0x74,
-	0x73, 0x12, 0x3a, 0x0a, 0x19, 0x6c, 0x65, 0x61, 0x64, 0x69, 0x6e, 0x67, 0x5f, 0x64, 0x65, 0x74,
-	0x61, 0x63, 0x68, 0x65, 0x64, 0x5f, 0x63, 0x6f, 0x6d, 0x6d, 0x65, 0x6e, 0x74, 0x73, 0x18, 0x06,
-	0x20, 0x03, 0x28, 0x09, 0x52, 0x17, 0x6c, 0x65, 0x61, 0x64, 0x69, 0x6e, 0x67, 0x44, 0x65, 0x74,
-	0x61, 0x63, 0x68, 0x65, 0x64, 0x43, 0x6f, 0x6d, 0x6d, 0x65, 0x6e, 0x74, 0x73, 0x22, 0xd1, 0x01,
-	0x0a, 0x11, 0x47, 0x65, 0x6e, 0x65, 0x72, 0x61, 0x74, 0x65, 0x64, 0x43, 0x6f, 0x64, 0x65, 0x49,
-	0x6e, 0x66, 0x6f, 0x12, 0x4d, 0x0a, 0x0a, 0x61, 0x6e, 0x6e, 0x6f, 0x74, 0x61, 0x74, 0x69, 0x6f,
-	0x6e, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x2d, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65,
-	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x47, 0x65, 0x6e, 0x65, 0x72, 0x61,
-	0x74, 0x65, 0x64, 0x43, 0x6f, 0x64, 0x65, 0x49, 0x6e, 0x66, 0x6f, 0x2e, 0x41, 0x6e, 0x6e, 0x6f,
-	0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x0a, 0x61, 0x6e, 0x6e, 0x6f, 0x74, 0x61, 0x74, 0x69,
-	0x6f, 0x6e, 0x1a, 0x6d, 0x0a, 0x0a, 0x41, 0x6e, 0x6e, 0x6f, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e,
-	0x12, 0x16, 0x0a, 0x04, 0x70, 0x61, 0x74, 0x68, 0x18, 0x01, 0x20, 0x03, 0x28, 0x05, 0x42, 0x02,
-	0x10, 0x01, 0x52, 0x04, 0x70, 0x61, 0x74, 0x68, 0x12, 0x1f, 0x0a, 0x0b, 0x73, 0x6f, 0x75, 0x72,
-	0x63, 0x65, 0x5f, 0x66, 0x69, 0x6c, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x73,
-	0x6f, 0x75, 0x72, 0x63, 0x65, 0x46, 0x69, 0x6c, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x62, 0x65, 0x67,
-	0x69, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x05, 0x52, 0x05, 0x62, 0x65, 0x67, 0x69, 0x6e, 0x12,
-	0x10, 0x0a, 0x03, 0x65, 0x6e, 0x64, 0x18, 0x04, 0x20, 0x01, 0x28, 0x05, 0x52, 0x03, 0x65, 0x6e,
-	0x64, 0x42, 0x7e, 0x0a, 0x13, 0x63, 0x6f, 0x6d, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e,
+	0x69, 0x6f, 0x6e, 0x2e, 0x4e, 0x61, 0x6d, 0x65, 0x50, 0x61, 0x72, 0x74, 0x52, 0x04, 0x6e, 0x61,
+	0x6d, 0x65, 0x12, 0x29, 0x0a, 0x10, 0x69, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x66, 0x69, 0x65, 0x72,
+	0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0f, 0x69, 0x64,
+	0x65, 0x6e, 0x74, 0x69, 0x66, 0x69, 0x65, 0x72, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x2c, 0x0a,
+	0x12, 0x70, 0x6f, 0x73, 0x69, 0x74, 0x69, 0x76, 0x65, 0x5f, 0x69, 0x6e, 0x74, 0x5f, 0x76, 0x61,
+	0x6c, 0x75, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x04, 0x52, 0x10, 0x70, 0x6f, 0x73, 0x69, 0x74,
+	0x69, 0x76, 0x65, 0x49, 0x6e, 0x74, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x2c, 0x0a, 0x12, 0x6e,
+	0x65, 0x67, 0x61, 0x74, 0x69, 0x76, 0x65, 0x5f, 0x69, 0x6e, 0x74, 0x5f, 0x76, 0x61, 0x6c, 0x75,
+	0x65, 0x18, 0x05, 0x20, 0x01, 0x28, 0x03, 0x52, 0x10, 0x6e, 0x65, 0x67, 0x61, 0x74, 0x69, 0x76,
+	0x65, 0x49, 0x6e, 0x74, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x21, 0x0a, 0x0c, 0x64, 0x6f, 0x75,
+	0x62, 0x6c, 0x65, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x06, 0x20, 0x01, 0x28, 0x01, 0x52,
+	0x0b, 0x64, 0x6f, 0x75, 0x62, 0x6c, 0x65, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x21, 0x0a, 0x0c,
+	0x73, 0x74, 0x72, 0x69, 0x6e, 0x67, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x07, 0x20, 0x01,
+	0x28, 0x0c, 0x52, 0x0b, 0x73, 0x74, 0x72, 0x69, 0x6e, 0x67, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x12,
+	0x27, 0x0a, 0x0f, 0x61, 0x67, 0x67, 0x72, 0x65, 0x67, 0x61, 0x74, 0x65, 0x5f, 0x76, 0x61, 0x6c,
+	0x75, 0x65, 0x18, 0x08, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0e, 0x61, 0x67, 0x67, 0x72, 0x65, 0x67,
+	0x61, 0x74, 0x65, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x1a, 0x4a, 0x0a, 0x08, 0x4e, 0x61, 0x6d, 0x65,
+	0x50, 0x61, 0x72, 0x74, 0x12, 0x1b, 0x0a, 0x09, 0x6e, 0x61, 0x6d, 0x65, 0x5f, 0x70, 0x61, 0x72,
+	0x74, 0x18, 0x01, 0x20, 0x02, 0x28, 0x09, 0x52, 0x08, 0x6e, 0x61, 0x6d, 0x65, 0x50, 0x61, 0x72,
+	0x74, 0x12, 0x21, 0x0a, 0x0c, 0x69, 0x73, 0x5f, 0x65, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f,
+	0x6e, 0x18, 0x02, 0x20, 0x02, 0x28, 0x08, 0x52, 0x0b, 0x69, 0x73, 0x45, 0x78, 0x74, 0x65, 0x6e,
+	0x73, 0x69, 0x6f, 0x6e, 0x22, 0xa7, 0x02, 0x0a, 0x0e, 0x53, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x43,
+	0x6f, 0x64, 0x65, 0x49, 0x6e, 0x66, 0x6f, 0x12, 0x44, 0x0a, 0x08, 0x6c, 0x6f, 0x63, 0x61, 0x74,
+	0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x28, 0x2e, 0x67, 0x6f, 0x6f, 0x67,
+	0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x53, 0x6f, 0x75, 0x72,
+	0x63, 0x65, 0x43, 0x6f, 0x64, 0x65, 0x49, 0x6e, 0x66, 0x6f, 0x2e, 0x4c, 0x6f, 0x63, 0x61, 0x74,
+	0x69, 0x6f, 0x6e, 0x52, 0x08, 0x6c, 0x6f, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x1a, 0xce, 0x01,
+	0x0a, 0x08, 0x4c, 0x6f, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x16, 0x0a, 0x04, 0x70, 0x61,
+	0x74, 0x68, 0x18, 0x01, 0x20, 0x03, 0x28, 0x05, 0x42, 0x02, 0x10, 0x01, 0x52, 0x04, 0x70, 0x61,
+	0x74, 0x68, 0x12, 0x16, 0x0a, 0x04, 0x73, 0x70, 0x61, 0x6e, 0x18, 0x02, 0x20, 0x03, 0x28, 0x05,
+	0x42, 0x02, 0x10, 0x01, 0x52, 0x04, 0x73, 0x70, 0x61, 0x6e, 0x12, 0x29, 0x0a, 0x10, 0x6c, 0x65,
+	0x61, 0x64, 0x69, 0x6e, 0x67, 0x5f, 0x63, 0x6f, 0x6d, 0x6d, 0x65, 0x6e, 0x74, 0x73, 0x18, 0x03,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x0f, 0x6c, 0x65, 0x61, 0x64, 0x69, 0x6e, 0x67, 0x43, 0x6f, 0x6d,
+	0x6d, 0x65, 0x6e, 0x74, 0x73, 0x12, 0x2b, 0x0a, 0x11, 0x74, 0x72, 0x61, 0x69, 0x6c, 0x69, 0x6e,
+	0x67, 0x5f, 0x63, 0x6f, 0x6d, 0x6d, 0x65, 0x6e, 0x74, 0x73, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x10, 0x74, 0x72, 0x61, 0x69, 0x6c, 0x69, 0x6e, 0x67, 0x43, 0x6f, 0x6d, 0x6d, 0x65, 0x6e,
+	0x74, 0x73, 0x12, 0x3a, 0x0a, 0x19, 0x6c, 0x65, 0x61, 0x64, 0x69, 0x6e, 0x67, 0x5f, 0x64, 0x65,
+	0x74, 0x61, 0x63, 0x68, 0x65, 0x64, 0x5f, 0x63, 0x6f, 0x6d, 0x6d, 0x65, 0x6e, 0x74, 0x73, 0x18,
+	0x06, 0x20, 0x03, 0x28, 0x09, 0x52, 0x17, 0x6c, 0x65, 0x61, 0x64, 0x69, 0x6e, 0x67, 0x44, 0x65,
+	0x74, 0x61, 0x63, 0x68, 0x65, 0x64, 0x43, 0x6f, 0x6d, 0x6d, 0x65, 0x6e, 0x74, 0x73, 0x22, 0xd0,
+	0x02, 0x0a, 0x11, 0x47, 0x65, 0x6e, 0x65, 0x72, 0x61, 0x74, 0x65, 0x64, 0x43, 0x6f, 0x64, 0x65,
+	0x49, 0x6e, 0x66, 0x6f, 0x12, 0x4d, 0x0a, 0x0a, 0x61, 0x6e, 0x6e, 0x6f, 0x74, 0x61, 0x74, 0x69,
+	0x6f, 0x6e, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x2d, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
+	0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x47, 0x65, 0x6e, 0x65, 0x72,
+	0x61, 0x74, 0x65, 0x64, 0x43, 0x6f, 0x64, 0x65, 0x49, 0x6e, 0x66, 0x6f, 0x2e, 0x41, 0x6e, 0x6e,
+	0x6f, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x0a, 0x61, 0x6e, 0x6e, 0x6f, 0x74, 0x61, 0x74,
+	0x69, 0x6f, 0x6e, 0x1a, 0xeb, 0x01, 0x0a, 0x0a, 0x41, 0x6e, 0x6e, 0x6f, 0x74, 0x61, 0x74, 0x69,
+	0x6f, 0x6e, 0x12, 0x16, 0x0a, 0x04, 0x70, 0x61, 0x74, 0x68, 0x18, 0x01, 0x20, 0x03, 0x28, 0x05,
+	0x42, 0x02, 0x10, 0x01, 0x52, 0x04, 0x70, 0x61, 0x74, 0x68, 0x12, 0x1f, 0x0a, 0x0b, 0x73, 0x6f,
+	0x75, 0x72, 0x63, 0x65, 0x5f, 0x66, 0x69, 0x6c, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x0a, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x46, 0x69, 0x6c, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x62,
+	0x65, 0x67, 0x69, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x05, 0x52, 0x05, 0x62, 0x65, 0x67, 0x69,
+	0x6e, 0x12, 0x10, 0x0a, 0x03, 0x65, 0x6e, 0x64, 0x18, 0x04, 0x20, 0x01, 0x28, 0x05, 0x52, 0x03,
+	0x65, 0x6e, 0x64, 0x12, 0x52, 0x0a, 0x08, 0x73, 0x65, 0x6d, 0x61, 0x6e, 0x74, 0x69, 0x63, 0x18,
+	0x05, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x36, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x47, 0x65, 0x6e, 0x65, 0x72, 0x61, 0x74, 0x65,
+	0x64, 0x43, 0x6f, 0x64, 0x65, 0x49, 0x6e, 0x66, 0x6f, 0x2e, 0x41, 0x6e, 0x6e, 0x6f, 0x74, 0x61,
+	0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x53, 0x65, 0x6d, 0x61, 0x6e, 0x74, 0x69, 0x63, 0x52, 0x08, 0x73,
+	0x65, 0x6d, 0x61, 0x6e, 0x74, 0x69, 0x63, 0x22, 0x28, 0x0a, 0x08, 0x53, 0x65, 0x6d, 0x61, 0x6e,
+	0x74, 0x69, 0x63, 0x12, 0x08, 0x0a, 0x04, 0x4e, 0x4f, 0x4e, 0x45, 0x10, 0x00, 0x12, 0x07, 0x0a,
+	0x03, 0x53, 0x45, 0x54, 0x10, 0x01, 0x12, 0x09, 0x0a, 0x05, 0x41, 0x4c, 0x49, 0x41, 0x53, 0x10,
+	0x02, 0x42, 0x7e, 0x0a, 0x13, 0x63, 0x6f, 0x6d, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e,
 	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x42, 0x10, 0x44, 0x65, 0x73, 0x63, 0x72, 0x69,
 	0x70, 0x74, 0x6f, 0x72, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x73, 0x48, 0x01, 0x5a, 0x2d, 0x67, 0x6f,
 	0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x67, 0x6f, 0x6c, 0x61, 0x6e, 0x67, 0x2e, 0x6f, 0x72, 0x67, 0x2f,
@@ -3498,92 +4123,103 @@ func file_google_protobuf_descriptor_proto_rawDescGZIP() []byte {
 	return file_google_protobuf_descriptor_proto_rawDescData
 }
 
-var file_google_protobuf_descriptor_proto_enumTypes = make([]protoimpl.EnumInfo, 6)
-var file_google_protobuf_descriptor_proto_msgTypes = make([]protoimpl.MessageInfo, 27)
+var file_google_protobuf_descriptor_proto_enumTypes = make([]protoimpl.EnumInfo, 10)
+var file_google_protobuf_descriptor_proto_msgTypes = make([]protoimpl.MessageInfo, 28)
 var file_google_protobuf_descriptor_proto_goTypes = []interface{}{
-	(FieldDescriptorProto_Type)(0),                // 0: google.protobuf.FieldDescriptorProto.Type
-	(FieldDescriptorProto_Label)(0),               // 1: google.protobuf.FieldDescriptorProto.Label
-	(FileOptions_OptimizeMode)(0),                 // 2: google.protobuf.FileOptions.OptimizeMode
-	(FieldOptions_CType)(0),                       // 3: google.protobuf.FieldOptions.CType
-	(FieldOptions_JSType)(0),                      // 4: google.protobuf.FieldOptions.JSType
-	(MethodOptions_IdempotencyLevel)(0),           // 5: google.protobuf.MethodOptions.IdempotencyLevel
-	(*FileDescriptorSet)(nil),                     // 6: google.protobuf.FileDescriptorSet
-	(*FileDescriptorProto)(nil),                   // 7: google.protobuf.FileDescriptorProto
-	(*DescriptorProto)(nil),                       // 8: google.protobuf.DescriptorProto
-	(*ExtensionRangeOptions)(nil),                 // 9: google.protobuf.ExtensionRangeOptions
-	(*FieldDescriptorProto)(nil),                  // 10: google.protobuf.FieldDescriptorProto
-	(*OneofDescriptorProto)(nil),                  // 11: google.protobuf.OneofDescriptorProto
-	(*EnumDescriptorProto)(nil),                   // 12: google.protobuf.EnumDescriptorProto
-	(*EnumValueDescriptorProto)(nil),              // 13: google.protobuf.EnumValueDescriptorProto
-	(*ServiceDescriptorProto)(nil),                // 14: google.protobuf.ServiceDescriptorProto
-	(*MethodDescriptorProto)(nil),                 // 15: google.protobuf.MethodDescriptorProto
-	(*FileOptions)(nil),                           // 16: google.protobuf.FileOptions
-	(*MessageOptions)(nil),                        // 17: google.protobuf.MessageOptions
-	(*FieldOptions)(nil),                          // 18: google.protobuf.FieldOptions
-	(*OneofOptions)(nil),                          // 19: google.protobuf.OneofOptions
-	(*EnumOptions)(nil),                           // 20: google.protobuf.EnumOptions
-	(*EnumValueOptions)(nil),                      // 21: google.protobuf.EnumValueOptions
-	(*ServiceOptions)(nil),                        // 22: google.protobuf.ServiceOptions
-	(*MethodOptions)(nil),                         // 23: google.protobuf.MethodOptions
-	(*UninterpretedOption)(nil),                   // 24: google.protobuf.UninterpretedOption
-	(*SourceCodeInfo)(nil),                        // 25: google.protobuf.SourceCodeInfo
-	(*GeneratedCodeInfo)(nil),                     // 26: google.protobuf.GeneratedCodeInfo
-	(*DescriptorProto_ExtensionRange)(nil),        // 27: google.protobuf.DescriptorProto.ExtensionRange
-	(*DescriptorProto_ReservedRange)(nil),         // 28: google.protobuf.DescriptorProto.ReservedRange
-	(*EnumDescriptorProto_EnumReservedRange)(nil), // 29: google.protobuf.EnumDescriptorProto.EnumReservedRange
-	(*UninterpretedOption_NamePart)(nil),          // 30: google.protobuf.UninterpretedOption.NamePart
-	(*SourceCodeInfo_Location)(nil),               // 31: google.protobuf.SourceCodeInfo.Location
-	(*GeneratedCodeInfo_Annotation)(nil),          // 32: google.protobuf.GeneratedCodeInfo.Annotation
+	(ExtensionRangeOptions_VerificationState)(0),  // 0: google.protobuf.ExtensionRangeOptions.VerificationState
+	(FieldDescriptorProto_Type)(0),                // 1: google.protobuf.FieldDescriptorProto.Type
+	(FieldDescriptorProto_Label)(0),               // 2: google.protobuf.FieldDescriptorProto.Label
+	(FileOptions_OptimizeMode)(0),                 // 3: google.protobuf.FileOptions.OptimizeMode
+	(FieldOptions_CType)(0),                       // 4: google.protobuf.FieldOptions.CType
+	(FieldOptions_JSType)(0),                      // 5: google.protobuf.FieldOptions.JSType
+	(FieldOptions_OptionRetention)(0),             // 6: google.protobuf.FieldOptions.OptionRetention
+	(FieldOptions_OptionTargetType)(0),            // 7: google.protobuf.FieldOptions.OptionTargetType
+	(MethodOptions_IdempotencyLevel)(0),           // 8: google.protobuf.MethodOptions.IdempotencyLevel
+	(GeneratedCodeInfo_Annotation_Semantic)(0),    // 9: google.protobuf.GeneratedCodeInfo.Annotation.Semantic
+	(*FileDescriptorSet)(nil),                     // 10: google.protobuf.FileDescriptorSet
+	(*FileDescriptorProto)(nil),                   // 11: google.protobuf.FileDescriptorProto
+	(*DescriptorProto)(nil),                       // 12: google.protobuf.DescriptorProto
+	(*ExtensionRangeOptions)(nil),                 // 13: google.protobuf.ExtensionRangeOptions
+	(*FieldDescriptorProto)(nil),                  // 14: google.protobuf.FieldDescriptorProto
+	(*OneofDescriptorProto)(nil),                  // 15: google.protobuf.OneofDescriptorProto
+	(*EnumDescriptorProto)(nil),                   // 16: google.protobuf.EnumDescriptorProto
+	(*EnumValueDescriptorProto)(nil),              // 17: google.protobuf.EnumValueDescriptorProto
+	(*ServiceDescriptorProto)(nil),                // 18: google.protobuf.ServiceDescriptorProto
+	(*MethodDescriptorProto)(nil),                 // 19: google.protobuf.MethodDescriptorProto
+	(*FileOptions)(nil),                           // 20: google.protobuf.FileOptions
+	(*MessageOptions)(nil),                        // 21: google.protobuf.MessageOptions
+	(*FieldOptions)(nil),                          // 22: google.protobuf.FieldOptions
+	(*OneofOptions)(nil),                          // 23: google.protobuf.OneofOptions
+	(*EnumOptions)(nil),                           // 24: google.protobuf.EnumOptions
+	(*EnumValueOptions)(nil),                      // 25: google.protobuf.EnumValueOptions
+	(*ServiceOptions)(nil),                        // 26: google.protobuf.ServiceOptions
+	(*MethodOptions)(nil),                         // 27: google.protobuf.MethodOptions
+	(*UninterpretedOption)(nil),                   // 28: google.protobuf.UninterpretedOption
+	(*SourceCodeInfo)(nil),                        // 29: google.protobuf.SourceCodeInfo
+	(*GeneratedCodeInfo)(nil),                     // 30: google.protobuf.GeneratedCodeInfo
+	(*DescriptorProto_ExtensionRange)(nil),        // 31: google.protobuf.DescriptorProto.ExtensionRange
+	(*DescriptorProto_ReservedRange)(nil),         // 32: google.protobuf.DescriptorProto.ReservedRange
+	(*ExtensionRangeOptions_Declaration)(nil),     // 33: google.protobuf.ExtensionRangeOptions.Declaration
+	(*EnumDescriptorProto_EnumReservedRange)(nil), // 34: google.protobuf.EnumDescriptorProto.EnumReservedRange
+	(*UninterpretedOption_NamePart)(nil),          // 35: google.protobuf.UninterpretedOption.NamePart
+	(*SourceCodeInfo_Location)(nil),               // 36: google.protobuf.SourceCodeInfo.Location
+	(*GeneratedCodeInfo_Annotation)(nil),          // 37: google.protobuf.GeneratedCodeInfo.Annotation
 }
 var file_google_protobuf_descriptor_proto_depIdxs = []int32{
-	7,  // 0: google.protobuf.FileDescriptorSet.file:type_name -> google.protobuf.FileDescriptorProto
-	8,  // 1: google.protobuf.FileDescriptorProto.message_type:type_name -> google.protobuf.DescriptorProto
-	12, // 2: google.protobuf.FileDescriptorProto.enum_type:type_name -> google.protobuf.EnumDescriptorProto
-	14, // 3: google.protobuf.FileDescriptorProto.service:type_name -> google.protobuf.ServiceDescriptorProto
-	10, // 4: google.protobuf.FileDescriptorProto.extension:type_name -> google.protobuf.FieldDescriptorProto
-	16, // 5: google.protobuf.FileDescriptorProto.options:type_name -> google.protobuf.FileOptions
-	25, // 6: google.protobuf.FileDescriptorProto.source_code_info:type_name -> google.protobuf.SourceCodeInfo
-	10, // 7: google.protobuf.DescriptorProto.field:type_name -> google.protobuf.FieldDescriptorProto
-	10, // 8: google.protobuf.DescriptorProto.extension:type_name -> google.protobuf.FieldDescriptorProto
-	8,  // 9: google.protobuf.DescriptorProto.nested_type:type_name -> google.protobuf.DescriptorProto
-	12, // 10: google.protobuf.DescriptorProto.enum_type:type_name -> google.protobuf.EnumDescriptorProto
-	27, // 11: google.protobuf.DescriptorProto.extension_range:type_name -> google.protobuf.DescriptorProto.ExtensionRange
-	11, // 12: google.protobuf.DescriptorProto.oneof_decl:type_name -> google.protobuf.OneofDescriptorProto
-	17, // 13: google.protobuf.DescriptorProto.options:type_name -> google.protobuf.MessageOptions
-	28, // 14: google.protobuf.DescriptorProto.reserved_range:type_name -> google.protobuf.DescriptorProto.ReservedRange
-	24, // 15: google.protobuf.ExtensionRangeOptions.uninterpreted_option:type_name -> google.protobuf.UninterpretedOption
-	1,  // 16: google.protobuf.FieldDescriptorProto.label:type_name -> google.protobuf.FieldDescriptorProto.Label
-	0,  // 17: google.protobuf.FieldDescriptorProto.type:type_name -> google.protobuf.FieldDescriptorProto.Type
-	18, // 18: google.protobuf.FieldDescriptorProto.options:type_name -> google.protobuf.FieldOptions
-	19, // 19: google.protobuf.OneofDescriptorProto.options:type_name -> google.protobuf.OneofOptions
-	13, // 20: google.protobuf.EnumDescriptorProto.value:type_name -> google.protobuf.EnumValueDescriptorProto
-	20, // 21: google.protobuf.EnumDescriptorProto.options:type_name -> google.protobuf.EnumOptions
-	29, // 22: google.protobuf.EnumDescriptorProto.reserved_range:type_name -> google.protobuf.EnumDescriptorProto.EnumReservedRange
-	21, // 23: google.protobuf.EnumValueDescriptorProto.options:type_name -> google.protobuf.EnumValueOptions
-	15, // 24: google.protobuf.ServiceDescriptorProto.method:type_name -> google.protobuf.MethodDescriptorProto
-	22, // 25: google.protobuf.ServiceDescriptorProto.options:type_name -> google.protobuf.ServiceOptions
-	23, // 26: google.protobuf.MethodDescriptorProto.options:type_name -> google.protobuf.MethodOptions
-	2,  // 27: google.protobuf.FileOptions.optimize_for:type_name -> google.protobuf.FileOptions.OptimizeMode
-	24, // 28: google.protobuf.FileOptions.uninterpreted_option:type_name -> google.protobuf.UninterpretedOption
-	24, // 29: google.protobuf.MessageOptions.uninterpreted_option:type_name -> google.protobuf.UninterpretedOption
-	3,  // 30: google.protobuf.FieldOptions.ctype:type_name -> google.protobuf.FieldOptions.CType
-	4,  // 31: google.protobuf.FieldOptions.jstype:type_name -> google.protobuf.FieldOptions.JSType
-	24, // 32: google.protobuf.FieldOptions.uninterpreted_option:type_name -> google.protobuf.UninterpretedOption
-	24, // 33: google.protobuf.OneofOptions.uninterpreted_option:type_name -> google.protobuf.UninterpretedOption
-	24, // 34: google.protobuf.EnumOptions.uninterpreted_option:type_name -> google.protobuf.UninterpretedOption
-	24, // 35: google.protobuf.EnumValueOptions.uninterpreted_option:type_name -> google.protobuf.UninterpretedOption
-	24, // 36: google.protobuf.ServiceOptions.uninterpreted_option:type_name -> google.protobuf.UninterpretedOption
-	5,  // 37: google.protobuf.MethodOptions.idempotency_level:type_name -> google.protobuf.MethodOptions.IdempotencyLevel
-	24, // 38: google.protobuf.MethodOptions.uninterpreted_option:type_name -> google.protobuf.UninterpretedOption
-	30, // 39: google.protobuf.UninterpretedOption.name:type_name -> google.protobuf.UninterpretedOption.NamePart
-	31, // 40: google.protobuf.SourceCodeInfo.location:type_name -> google.protobuf.SourceCodeInfo.Location
-	32, // 41: google.protobuf.GeneratedCodeInfo.annotation:type_name -> google.protobuf.GeneratedCodeInfo.Annotation
-	9,  // 42: google.protobuf.DescriptorProto.ExtensionRange.options:type_name -> google.protobuf.ExtensionRangeOptions
-	43, // [43:43] is the sub-list for method output_type
-	43, // [43:43] is the sub-list for method input_type
-	43, // [43:43] is the sub-list for extension type_name
-	43, // [43:43] is the sub-list for extension extendee
-	0,  // [0:43] is the sub-list for field type_name
+	11, // 0: google.protobuf.FileDescriptorSet.file:type_name -> google.protobuf.FileDescriptorProto
+	12, // 1: google.protobuf.FileDescriptorProto.message_type:type_name -> google.protobuf.DescriptorProto
+	16, // 2: google.protobuf.FileDescriptorProto.enum_type:type_name -> google.protobuf.EnumDescriptorProto
+	18, // 3: google.protobuf.FileDescriptorProto.service:type_name -> google.protobuf.ServiceDescriptorProto
+	14, // 4: google.protobuf.FileDescriptorProto.extension:type_name -> google.protobuf.FieldDescriptorProto
+	20, // 5: google.protobuf.FileDescriptorProto.options:type_name -> google.protobuf.FileOptions
+	29, // 6: google.protobuf.FileDescriptorProto.source_code_info:type_name -> google.protobuf.SourceCodeInfo
+	14, // 7: google.protobuf.DescriptorProto.field:type_name -> google.protobuf.FieldDescriptorProto
+	14, // 8: google.protobuf.DescriptorProto.extension:type_name -> google.protobuf.FieldDescriptorProto
+	12, // 9: google.protobuf.DescriptorProto.nested_type:type_name -> google.protobuf.DescriptorProto
+	16, // 10: google.protobuf.DescriptorProto.enum_type:type_name -> google.protobuf.EnumDescriptorProto
+	31, // 11: google.protobuf.DescriptorProto.extension_range:type_name -> google.protobuf.DescriptorProto.ExtensionRange
+	15, // 12: google.protobuf.DescriptorProto.oneof_decl:type_name -> google.protobuf.OneofDescriptorProto
+	21, // 13: google.protobuf.DescriptorProto.options:type_name -> google.protobuf.MessageOptions
+	32, // 14: google.protobuf.DescriptorProto.reserved_range:type_name -> google.protobuf.DescriptorProto.ReservedRange
+	28, // 15: google.protobuf.ExtensionRangeOptions.uninterpreted_option:type_name -> google.protobuf.UninterpretedOption
+	33, // 16: google.protobuf.ExtensionRangeOptions.declaration:type_name -> google.protobuf.ExtensionRangeOptions.Declaration
+	0,  // 17: google.protobuf.ExtensionRangeOptions.verification:type_name -> google.protobuf.ExtensionRangeOptions.VerificationState
+	2,  // 18: google.protobuf.FieldDescriptorProto.label:type_name -> google.protobuf.FieldDescriptorProto.Label
+	1,  // 19: google.protobuf.FieldDescriptorProto.type:type_name -> google.protobuf.FieldDescriptorProto.Type
+	22, // 20: google.protobuf.FieldDescriptorProto.options:type_name -> google.protobuf.FieldOptions
+	23, // 21: google.protobuf.OneofDescriptorProto.options:type_name -> google.protobuf.OneofOptions
+	17, // 22: google.protobuf.EnumDescriptorProto.value:type_name -> google.protobuf.EnumValueDescriptorProto
+	24, // 23: google.protobuf.EnumDescriptorProto.options:type_name -> google.protobuf.EnumOptions
+	34, // 24: google.protobuf.EnumDescriptorProto.reserved_range:type_name -> google.protobuf.EnumDescriptorProto.EnumReservedRange
+	25, // 25: google.protobuf.EnumValueDescriptorProto.options:type_name -> google.protobuf.EnumValueOptions
+	19, // 26: google.protobuf.ServiceDescriptorProto.method:type_name -> google.protobuf.MethodDescriptorProto
+	26, // 27: google.protobuf.ServiceDescriptorProto.options:type_name -> google.protobuf.ServiceOptions
+	27, // 28: google.protobuf.MethodDescriptorProto.options:type_name -> google.protobuf.MethodOptions
+	3,  // 29: google.protobuf.FileOptions.optimize_for:type_name -> google.protobuf.FileOptions.OptimizeMode
+	28, // 30: google.protobuf.FileOptions.uninterpreted_option:type_name -> google.protobuf.UninterpretedOption
+	28, // 31: google.protobuf.MessageOptions.uninterpreted_option:type_name -> google.protobuf.UninterpretedOption
+	4,  // 32: google.protobuf.FieldOptions.ctype:type_name -> google.protobuf.FieldOptions.CType
+	5,  // 33: google.protobuf.FieldOptions.jstype:type_name -> google.protobuf.FieldOptions.JSType
+	6,  // 34: google.protobuf.FieldOptions.retention:type_name -> google.protobuf.FieldOptions.OptionRetention
+	7,  // 35: google.protobuf.FieldOptions.target:type_name -> google.protobuf.FieldOptions.OptionTargetType
+	7,  // 36: google.protobuf.FieldOptions.targets:type_name -> google.protobuf.FieldOptions.OptionTargetType
+	28, // 37: google.protobuf.FieldOptions.uninterpreted_option:type_name -> google.protobuf.UninterpretedOption
+	28, // 38: google.protobuf.OneofOptions.uninterpreted_option:type_name -> google.protobuf.UninterpretedOption
+	28, // 39: google.protobuf.EnumOptions.uninterpreted_option:type_name -> google.protobuf.UninterpretedOption
+	28, // 40: google.protobuf.EnumValueOptions.uninterpreted_option:type_name -> google.protobuf.UninterpretedOption
+	28, // 41: google.protobuf.ServiceOptions.uninterpreted_option:type_name -> google.protobuf.UninterpretedOption
+	8,  // 42: google.protobuf.MethodOptions.idempotency_level:type_name -> google.protobuf.MethodOptions.IdempotencyLevel
+	28, // 43: google.protobuf.MethodOptions.uninterpreted_option:type_name -> google.protobuf.UninterpretedOption
+	35, // 44: google.protobuf.UninterpretedOption.name:type_name -> google.protobuf.UninterpretedOption.NamePart
+	36, // 45: google.protobuf.SourceCodeInfo.location:type_name -> google.protobuf.SourceCodeInfo.Location
+	37, // 46: google.protobuf.GeneratedCodeInfo.annotation:type_name -> google.protobuf.GeneratedCodeInfo.Annotation
+	13, // 47: google.protobuf.DescriptorProto.ExtensionRange.options:type_name -> google.protobuf.ExtensionRangeOptions
+	9,  // 48: google.protobuf.GeneratedCodeInfo.Annotation.semantic:type_name -> google.protobuf.GeneratedCodeInfo.Annotation.Semantic
+	49, // [49:49] is the sub-list for method output_type
+	49, // [49:49] is the sub-list for method input_type
+	49, // [49:49] is the sub-list for extension type_name
+	49, // [49:49] is the sub-list for extension extendee
+	0,  // [0:49] is the sub-list for field type_name
 }
 
 func init() { file_google_protobuf_descriptor_proto_init() }
@@ -3887,7 +4523,7 @@ func file_google_protobuf_descriptor_proto_init() {
 			}
 		}
 		file_google_protobuf_descriptor_proto_msgTypes[23].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*EnumDescriptorProto_EnumReservedRange); i {
+			switch v := v.(*ExtensionRangeOptions_Declaration); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -3899,7 +4535,7 @@ func file_google_protobuf_descriptor_proto_init() {
 			}
 		}
 		file_google_protobuf_descriptor_proto_msgTypes[24].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*UninterpretedOption_NamePart); i {
+			switch v := v.(*EnumDescriptorProto_EnumReservedRange); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -3911,7 +4547,7 @@ func file_google_protobuf_descriptor_proto_init() {
 			}
 		}
 		file_google_protobuf_descriptor_proto_msgTypes[25].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*SourceCodeInfo_Location); i {
+			switch v := v.(*UninterpretedOption_NamePart); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -3923,6 +4559,18 @@ func file_google_protobuf_descriptor_proto_init() {
 			}
 		}
 		file_google_protobuf_descriptor_proto_msgTypes[26].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*SourceCodeInfo_Location); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_google_protobuf_descriptor_proto_msgTypes[27].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*GeneratedCodeInfo_Annotation); i {
 			case 0:
 				return &v.state
@@ -3940,8 +4588,8 @@ func file_google_protobuf_descriptor_proto_init() {
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: file_google_protobuf_descriptor_proto_rawDesc,
-			NumEnums:      6,
-			NumMessages:   27,
+			NumEnums:      10,
+			NumMessages:   28,
 			NumExtensions: 0,
 			NumServices:   0,
 		},
diff --git a/.ci/providerlint/vendor/google.golang.org/protobuf/types/known/anypb/any.pb.go b/.ci/providerlint/vendor/google.golang.org/protobuf/types/known/anypb/any.pb.go
index 8c10797b905..580b232f477 100644
--- a/.ci/providerlint/vendor/google.golang.org/protobuf/types/known/anypb/any.pb.go
+++ b/.ci/providerlint/vendor/google.golang.org/protobuf/types/known/anypb/any.pb.go
@@ -37,8 +37,7 @@
 // It is functionally a tuple of the full name of the remote message type and
 // the serialized bytes of the remote message value.
 //
-//
-// Constructing an Any
+// # Constructing an Any
 //
 // An Any message containing another message value is constructed using New:
 //
@@ -48,8 +47,7 @@
 //	}
 //	... // make use of any
 //
-//
-// Unmarshaling an Any
+// # Unmarshaling an Any
 //
 // With a populated Any message, the underlying message can be serialized into
 // a remote concrete message value in a few ways.
@@ -95,8 +93,7 @@
 // listed in the case clauses are linked into the Go binary and therefore also
 // registered in the global registry.
 //
-//
-// Type checking an Any
+// # Type checking an Any
 //
 // In order to type check whether an Any message represents some other message,
 // then use the MessageIs method:
@@ -115,7 +112,6 @@
 //		}
 //		... // make use of m
 //	}
-//
 package anypb
 
 import (
@@ -136,45 +132,49 @@ import (
 //
 // Example 1: Pack and unpack a message in C++.
 //
-//     Foo foo = ...;
-//     Any any;
-//     any.PackFrom(foo);
-//     ...
-//     if (any.UnpackTo(&foo)) {
-//       ...
-//     }
+//	Foo foo = ...;
+//	Any any;
+//	any.PackFrom(foo);
+//	...
+//	if (any.UnpackTo(&foo)) {
+//	  ...
+//	}
 //
 // Example 2: Pack and unpack a message in Java.
 //
-//     Foo foo = ...;
-//     Any any = Any.pack(foo);
-//     ...
-//     if (any.is(Foo.class)) {
-//       foo = any.unpack(Foo.class);
-//     }
-//
-//  Example 3: Pack and unpack a message in Python.
-//
-//     foo = Foo(...)
-//     any = Any()
-//     any.Pack(foo)
-//     ...
-//     if any.Is(Foo.DESCRIPTOR):
-//       any.Unpack(foo)
-//       ...
-//
-//  Example 4: Pack and unpack a message in Go
-//
-//      foo := &pb.Foo{...}
-//      any, err := anypb.New(foo)
-//      if err != nil {
-//        ...
-//      }
-//      ...
-//      foo := &pb.Foo{}
-//      if err := any.UnmarshalTo(foo); err != nil {
-//        ...
-//      }
+//	   Foo foo = ...;
+//	   Any any = Any.pack(foo);
+//	   ...
+//	   if (any.is(Foo.class)) {
+//	     foo = any.unpack(Foo.class);
+//	   }
+//	   // or ...
+//	   if (any.isSameTypeAs(Foo.getDefaultInstance())) {
+//	     foo = any.unpack(Foo.getDefaultInstance());
+//	   }
+//
+//	Example 3: Pack and unpack a message in Python.
+//
+//	   foo = Foo(...)
+//	   any = Any()
+//	   any.Pack(foo)
+//	   ...
+//	   if any.Is(Foo.DESCRIPTOR):
+//	     any.Unpack(foo)
+//	     ...
+//
+//	Example 4: Pack and unpack a message in Go
+//
+//	    foo := &pb.Foo{...}
+//	    any, err := anypb.New(foo)
+//	    if err != nil {
+//	      ...
+//	    }
+//	    ...
+//	    foo := &pb.Foo{}
+//	    if err := any.UnmarshalTo(foo); err != nil {
+//	      ...
+//	    }
 //
 // The pack methods provided by protobuf library will by default use
 // 'type.googleapis.com/full.type.name' as the type URL and the unpack
@@ -182,35 +182,33 @@ import (
 // in the type URL, for example "foo.bar.com/x/y.z" will yield type
 // name "y.z".
 //
-//
 // JSON
 // ====
 // The JSON representation of an `Any` value uses the regular
 // representation of the deserialized, embedded message, with an
 // additional field `@type` which contains the type URL. Example:
 //
-//     package google.profile;
-//     message Person {
-//       string first_name = 1;
-//       string last_name = 2;
-//     }
+//	package google.profile;
+//	message Person {
+//	  string first_name = 1;
+//	  string last_name = 2;
+//	}
 //
-//     {
-//       "@type": "type.googleapis.com/google.profile.Person",
-//       "firstName": <string>,
-//       "lastName": <string>
-//     }
+//	{
+//	  "@type": "type.googleapis.com/google.profile.Person",
+//	  "firstName": <string>,
+//	  "lastName": <string>
+//	}
 //
 // If the embedded message type is well-known and has a custom JSON
 // representation, that representation will be embedded adding a field
 // `value` which holds the custom JSON in addition to the `@type`
 // field. Example (for message [google.protobuf.Duration][]):
 //
-//     {
-//       "@type": "type.googleapis.com/google.protobuf.Duration",
-//       "value": "1.212s"
-//     }
-//
+//	{
+//	  "@type": "type.googleapis.com/google.protobuf.Duration",
+//	  "value": "1.212s"
+//	}
 type Any struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -228,14 +226,14 @@ type Any struct {
 	// scheme `http`, `https`, or no scheme, one can optionally set up a type
 	// server that maps type URLs to message definitions as follows:
 	//
-	// * If no scheme is provided, `https` is assumed.
-	// * An HTTP GET on the URL must yield a [google.protobuf.Type][]
-	//   value in binary format, or produce an error.
-	// * Applications are allowed to cache lookup results based on the
-	//   URL, or have them precompiled into a binary to avoid any
-	//   lookup. Therefore, binary compatibility needs to be preserved
-	//   on changes to types. (Use versioned type names to manage
-	//   breaking changes.)
+	//   - If no scheme is provided, `https` is assumed.
+	//   - An HTTP GET on the URL must yield a [google.protobuf.Type][]
+	//     value in binary format, or produce an error.
+	//   - Applications are allowed to cache lookup results based on the
+	//     URL, or have them precompiled into a binary to avoid any
+	//     lookup. Therefore, binary compatibility needs to be preserved
+	//     on changes to types. (Use versioned type names to manage
+	//     breaking changes.)
 	//
 	// Note: this functionality is not currently available in the official
 	// protobuf release, and it is not used for type URLs beginning with
@@ -243,7 +241,6 @@ type Any struct {
 	//
 	// Schemes other than `http`, `https` (or the empty scheme) might be
 	// used with implementation specific semantics.
-	//
 	TypeUrl string `protobuf:"bytes,1,opt,name=type_url,json=typeUrl,proto3" json:"type_url,omitempty"`
 	// Must be a valid serialized protocol buffer of the above specified type.
 	Value []byte `protobuf:"bytes,2,opt,name=value,proto3" json:"value,omitempty"`
diff --git a/.ci/providerlint/vendor/google.golang.org/protobuf/types/known/durationpb/duration.pb.go b/.ci/providerlint/vendor/google.golang.org/protobuf/types/known/durationpb/duration.pb.go
index a583ca2f6c7..df709a8dd4c 100644
--- a/.ci/providerlint/vendor/google.golang.org/protobuf/types/known/durationpb/duration.pb.go
+++ b/.ci/providerlint/vendor/google.golang.org/protobuf/types/known/durationpb/duration.pb.go
@@ -35,8 +35,7 @@
 //
 // The Duration message represents a signed span of time.
 //
-//
-// Conversion to a Go Duration
+// # Conversion to a Go Duration
 //
 // The AsDuration method can be used to convert a Duration message to a
 // standard Go time.Duration value:
@@ -65,15 +64,13 @@
 // the resulting value to the closest representable value (e.g., math.MaxInt64
 // for positive overflow and math.MinInt64 for negative overflow).
 //
-//
-// Conversion from a Go Duration
+// # Conversion from a Go Duration
 //
 // The durationpb.New function can be used to construct a Duration message
 // from a standard Go time.Duration value:
 //
 //	dur := durationpb.New(d)
 //	... // make use of d as a *durationpb.Duration
-//
 package durationpb
 
 import (
@@ -96,43 +93,43 @@ import (
 //
 // Example 1: Compute Duration from two Timestamps in pseudo code.
 //
-//     Timestamp start = ...;
-//     Timestamp end = ...;
-//     Duration duration = ...;
+//	Timestamp start = ...;
+//	Timestamp end = ...;
+//	Duration duration = ...;
 //
-//     duration.seconds = end.seconds - start.seconds;
-//     duration.nanos = end.nanos - start.nanos;
+//	duration.seconds = end.seconds - start.seconds;
+//	duration.nanos = end.nanos - start.nanos;
 //
-//     if (duration.seconds < 0 && duration.nanos > 0) {
-//       duration.seconds += 1;
-//       duration.nanos -= 1000000000;
-//     } else if (duration.seconds > 0 && duration.nanos < 0) {
-//       duration.seconds -= 1;
-//       duration.nanos += 1000000000;
-//     }
+//	if (duration.seconds < 0 && duration.nanos > 0) {
+//	  duration.seconds += 1;
+//	  duration.nanos -= 1000000000;
+//	} else if (duration.seconds > 0 && duration.nanos < 0) {
+//	  duration.seconds -= 1;
+//	  duration.nanos += 1000000000;
+//	}
 //
 // Example 2: Compute Timestamp from Timestamp + Duration in pseudo code.
 //
-//     Timestamp start = ...;
-//     Duration duration = ...;
-//     Timestamp end = ...;
+//	Timestamp start = ...;
+//	Duration duration = ...;
+//	Timestamp end = ...;
 //
-//     end.seconds = start.seconds + duration.seconds;
-//     end.nanos = start.nanos + duration.nanos;
+//	end.seconds = start.seconds + duration.seconds;
+//	end.nanos = start.nanos + duration.nanos;
 //
-//     if (end.nanos < 0) {
-//       end.seconds -= 1;
-//       end.nanos += 1000000000;
-//     } else if (end.nanos >= 1000000000) {
-//       end.seconds += 1;
-//       end.nanos -= 1000000000;
-//     }
+//	if (end.nanos < 0) {
+//	  end.seconds -= 1;
+//	  end.nanos += 1000000000;
+//	} else if (end.nanos >= 1000000000) {
+//	  end.seconds += 1;
+//	  end.nanos -= 1000000000;
+//	}
 //
 // Example 3: Compute Duration from datetime.timedelta in Python.
 //
-//     td = datetime.timedelta(days=3, minutes=10)
-//     duration = Duration()
-//     duration.FromTimedelta(td)
+//	td = datetime.timedelta(days=3, minutes=10)
+//	duration = Duration()
+//	duration.FromTimedelta(td)
 //
 // # JSON Mapping
 //
@@ -143,8 +140,6 @@ import (
 // encoded in JSON format as "3s", while 3 seconds and 1 nanosecond should
 // be expressed in JSON format as "3.000000001s", and 3 seconds and 1
 // microsecond should be expressed in JSON format as "3.000001s".
-//
-//
 type Duration struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
diff --git a/.ci/providerlint/vendor/google.golang.org/protobuf/types/known/emptypb/empty.pb.go b/.ci/providerlint/vendor/google.golang.org/protobuf/types/known/emptypb/empty.pb.go
index e7fcea31f62..9a7277ba394 100644
--- a/.ci/providerlint/vendor/google.golang.org/protobuf/types/known/emptypb/empty.pb.go
+++ b/.ci/providerlint/vendor/google.golang.org/protobuf/types/known/emptypb/empty.pb.go
@@ -44,11 +44,9 @@ import (
 // empty messages in your APIs. A typical example is to use it as the request
 // or the response type of an API method. For instance:
 //
-//     service Foo {
-//       rpc Bar(google.protobuf.Empty) returns (google.protobuf.Empty);
-//     }
-//
-// The JSON representation for `Empty` is empty JSON object `{}`.
+//	service Foo {
+//	  rpc Bar(google.protobuf.Empty) returns (google.protobuf.Empty);
+//	}
 type Empty struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
diff --git a/.ci/providerlint/vendor/google.golang.org/protobuf/types/known/timestamppb/timestamp.pb.go b/.ci/providerlint/vendor/google.golang.org/protobuf/types/known/timestamppb/timestamp.pb.go
index c9ae92132aa..81511a3363e 100644
--- a/.ci/providerlint/vendor/google.golang.org/protobuf/types/known/timestamppb/timestamp.pb.go
+++ b/.ci/providerlint/vendor/google.golang.org/protobuf/types/known/timestamppb/timestamp.pb.go
@@ -36,8 +36,7 @@
 // The Timestamp message represents a timestamp,
 // an instant in time since the Unix epoch (January 1st, 1970).
 //
-//
-// Conversion to a Go Time
+// # Conversion to a Go Time
 //
 // The AsTime method can be used to convert a Timestamp message to a
 // standard Go time.Time value in UTC:
@@ -59,8 +58,7 @@
 //		... // handle error
 //	}
 //
-//
-// Conversion from a Go Time
+// # Conversion from a Go Time
 //
 // The timestamppb.New function can be used to construct a Timestamp message
 // from a standard Go time.Time value:
@@ -72,7 +70,6 @@
 //
 //	ts := timestamppb.Now()
 //	... // make use of ts as a *timestamppb.Timestamp
-//
 package timestamppb
 
 import (
@@ -101,52 +98,50 @@ import (
 //
 // Example 1: Compute Timestamp from POSIX `time()`.
 //
-//     Timestamp timestamp;
-//     timestamp.set_seconds(time(NULL));
-//     timestamp.set_nanos(0);
+//	Timestamp timestamp;
+//	timestamp.set_seconds(time(NULL));
+//	timestamp.set_nanos(0);
 //
 // Example 2: Compute Timestamp from POSIX `gettimeofday()`.
 //
-//     struct timeval tv;
-//     gettimeofday(&tv, NULL);
+//	struct timeval tv;
+//	gettimeofday(&tv, NULL);
 //
-//     Timestamp timestamp;
-//     timestamp.set_seconds(tv.tv_sec);
-//     timestamp.set_nanos(tv.tv_usec * 1000);
+//	Timestamp timestamp;
+//	timestamp.set_seconds(tv.tv_sec);
+//	timestamp.set_nanos(tv.tv_usec * 1000);
 //
 // Example 3: Compute Timestamp from Win32 `GetSystemTimeAsFileTime()`.
 //
-//     FILETIME ft;
-//     GetSystemTimeAsFileTime(&ft);
-//     UINT64 ticks = (((UINT64)ft.dwHighDateTime) << 32) | ft.dwLowDateTime;
+//	FILETIME ft;
+//	GetSystemTimeAsFileTime(&ft);
+//	UINT64 ticks = (((UINT64)ft.dwHighDateTime) << 32) | ft.dwLowDateTime;
 //
-//     // A Windows tick is 100 nanoseconds. Windows epoch 1601-01-01T00:00:00Z
-//     // is 11644473600 seconds before Unix epoch 1970-01-01T00:00:00Z.
-//     Timestamp timestamp;
-//     timestamp.set_seconds((INT64) ((ticks / 10000000) - 11644473600LL));
-//     timestamp.set_nanos((INT32) ((ticks % 10000000) * 100));
+//	// A Windows tick is 100 nanoseconds. Windows epoch 1601-01-01T00:00:00Z
+//	// is 11644473600 seconds before Unix epoch 1970-01-01T00:00:00Z.
+//	Timestamp timestamp;
+//	timestamp.set_seconds((INT64) ((ticks / 10000000) - 11644473600LL));
+//	timestamp.set_nanos((INT32) ((ticks % 10000000) * 100));
 //
 // Example 4: Compute Timestamp from Java `System.currentTimeMillis()`.
 //
-//     long millis = System.currentTimeMillis();
-//
-//     Timestamp timestamp = Timestamp.newBuilder().setSeconds(millis / 1000)
-//         .setNanos((int) ((millis % 1000) * 1000000)).build();
+//	long millis = System.currentTimeMillis();
 //
+//	Timestamp timestamp = Timestamp.newBuilder().setSeconds(millis / 1000)
+//	    .setNanos((int) ((millis % 1000) * 1000000)).build();
 //
 // Example 5: Compute Timestamp from Java `Instant.now()`.
 //
-//     Instant now = Instant.now();
-//
-//     Timestamp timestamp =
-//         Timestamp.newBuilder().setSeconds(now.getEpochSecond())
-//             .setNanos(now.getNano()).build();
+//	Instant now = Instant.now();
 //
+//	Timestamp timestamp =
+//	    Timestamp.newBuilder().setSeconds(now.getEpochSecond())
+//	        .setNanos(now.getNano()).build();
 //
 // Example 6: Compute Timestamp from current time in Python.
 //
-//     timestamp = Timestamp()
-//     timestamp.GetCurrentTime()
+//	timestamp = Timestamp()
+//	timestamp.GetCurrentTime()
 //
 // # JSON Mapping
 //
@@ -172,10 +167,8 @@ import (
 // [`strftime`](https://docs.python.org/2/library/time.html#time.strftime) with
 // the time format spec '%Y-%m-%dT%H:%M:%S.%fZ'. Likewise, in Java, one can use
 // the Joda Time's [`ISODateTimeFormat.dateTime()`](
-// http://www.joda.org/joda-time/apidocs/org/joda/time/format/ISODateTimeFormat.html#dateTime%2D%2D
+// http://joda-time.sourceforge.net/apidocs/org/joda/time/format/ISODateTimeFormat.html#dateTime()
 // ) to obtain a formatter capable of generating timestamps in this format.
-//
-//
 type Timestamp struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
diff --git a/.ci/providerlint/vendor/modules.txt b/.ci/providerlint/vendor/modules.txt
index b46b56d4716..5a6cdcfe0e3 100644
--- a/.ci/providerlint/vendor/modules.txt
+++ b/.ci/providerlint/vendor/modules.txt
@@ -1,10 +1,30 @@
+# github.com/ProtonMail/go-crypto v0.0.0-20230717121422-5aa5874ade95
+## explicit; go 1.13
+github.com/ProtonMail/go-crypto/bitcurves
+github.com/ProtonMail/go-crypto/brainpool
+github.com/ProtonMail/go-crypto/eax
+github.com/ProtonMail/go-crypto/internal/byteutil
+github.com/ProtonMail/go-crypto/ocb
+github.com/ProtonMail/go-crypto/openpgp
+github.com/ProtonMail/go-crypto/openpgp/aes/keywrap
+github.com/ProtonMail/go-crypto/openpgp/armor
+github.com/ProtonMail/go-crypto/openpgp/ecdh
+github.com/ProtonMail/go-crypto/openpgp/ecdsa
+github.com/ProtonMail/go-crypto/openpgp/eddsa
+github.com/ProtonMail/go-crypto/openpgp/elgamal
+github.com/ProtonMail/go-crypto/openpgp/errors
+github.com/ProtonMail/go-crypto/openpgp/internal/algorithm
+github.com/ProtonMail/go-crypto/openpgp/internal/ecc
+github.com/ProtonMail/go-crypto/openpgp/internal/encoding
+github.com/ProtonMail/go-crypto/openpgp/packet
+github.com/ProtonMail/go-crypto/openpgp/s2k
 # github.com/agext/levenshtein v1.2.2
 ## explicit
 github.com/agext/levenshtein
-# github.com/apparentlymart/go-textseg/v13 v13.0.0
+# github.com/apparentlymart/go-textseg/v15 v15.0.0
 ## explicit; go 1.16
-github.com/apparentlymart/go-textseg/v13/textseg
-# github.com/aws/aws-sdk-go v1.44.285
+github.com/apparentlymart/go-textseg/v15/textseg
+# github.com/aws/aws-sdk-go v1.46.6
 ## explicit; go 1.11
 github.com/aws/aws-sdk-go/aws/awserr
 github.com/aws/aws-sdk-go/aws/endpoints
@@ -163,10 +183,24 @@ github.com/bflad/tfproviderlint/xpasses/XR007
 github.com/bflad/tfproviderlint/xpasses/XR008
 github.com/bflad/tfproviderlint/xpasses/XS001
 github.com/bflad/tfproviderlint/xpasses/XS002
+# github.com/cloudflare/circl v1.3.3
+## explicit; go 1.19
+github.com/cloudflare/circl/dh/x25519
+github.com/cloudflare/circl/dh/x448
+github.com/cloudflare/circl/ecc/goldilocks
+github.com/cloudflare/circl/internal/conv
+github.com/cloudflare/circl/internal/sha3
+github.com/cloudflare/circl/math
+github.com/cloudflare/circl/math/fp25519
+github.com/cloudflare/circl/math/fp448
+github.com/cloudflare/circl/math/mlsbset
+github.com/cloudflare/circl/sign
+github.com/cloudflare/circl/sign/ed25519
+github.com/cloudflare/circl/sign/ed448
 # github.com/fatih/color v1.13.0
 ## explicit; go 1.13
 github.com/fatih/color
-# github.com/golang/protobuf v1.5.2
+# github.com/golang/protobuf v1.5.3
 ## explicit; go 1.9
 github.com/golang/protobuf/jsonpb
 github.com/golang/protobuf/proto
@@ -199,24 +233,26 @@ github.com/hashicorp/go-cty/cty/gocty
 github.com/hashicorp/go-cty/cty/json
 github.com/hashicorp/go-cty/cty/msgpack
 github.com/hashicorp/go-cty/cty/set
-# github.com/hashicorp/go-hclog v1.4.0
+# github.com/hashicorp/go-hclog v1.5.0
 ## explicit; go 1.13
 github.com/hashicorp/go-hclog
 # github.com/hashicorp/go-multierror v1.1.1
 ## explicit; go 1.13
 github.com/hashicorp/go-multierror
-# github.com/hashicorp/go-plugin v1.4.8
+# github.com/hashicorp/go-plugin v1.5.1
 ## explicit; go 1.17
 github.com/hashicorp/go-plugin
+github.com/hashicorp/go-plugin/internal/cmdrunner
 github.com/hashicorp/go-plugin/internal/plugin
+github.com/hashicorp/go-plugin/runner
 # github.com/hashicorp/go-uuid v1.0.3
 ## explicit
 github.com/hashicorp/go-uuid
 # github.com/hashicorp/go-version v1.6.0
 ## explicit
 github.com/hashicorp/go-version
-# github.com/hashicorp/hc-install v0.5.0
-## explicit; go 1.16
+# github.com/hashicorp/hc-install v0.6.0
+## explicit; go 1.18
 github.com/hashicorp/hc-install
 github.com/hashicorp/hc-install/checkpoint
 github.com/hashicorp/hc-install/errors
@@ -231,7 +267,7 @@ github.com/hashicorp/hc-install/product
 github.com/hashicorp/hc-install/releases
 github.com/hashicorp/hc-install/src
 github.com/hashicorp/hc-install/version
-# github.com/hashicorp/hcl/v2 v2.16.2
+# github.com/hashicorp/hcl/v2 v2.18.0
 ## explicit; go 1.18
 github.com/hashicorp/hcl/v2
 github.com/hashicorp/hcl/v2/ext/customdecode
@@ -239,15 +275,15 @@ github.com/hashicorp/hcl/v2/hclsyntax
 # github.com/hashicorp/logutils v1.0.0
 ## explicit
 github.com/hashicorp/logutils
-# github.com/hashicorp/terraform-exec v0.18.1
+# github.com/hashicorp/terraform-exec v0.19.0
 ## explicit; go 1.18
 github.com/hashicorp/terraform-exec/internal/version
 github.com/hashicorp/terraform-exec/tfexec
-# github.com/hashicorp/terraform-json v0.16.0
+# github.com/hashicorp/terraform-json v0.17.1
 ## explicit; go 1.18
 github.com/hashicorp/terraform-json
-# github.com/hashicorp/terraform-plugin-go v0.14.3
-## explicit; go 1.18
+# github.com/hashicorp/terraform-plugin-go v0.19.0
+## explicit; go 1.20
 github.com/hashicorp/terraform-plugin-go/internal/logging
 github.com/hashicorp/terraform-plugin-go/tfprotov5
 github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/diag
@@ -264,15 +300,15 @@ github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/tfplugin6
 github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/toproto
 github.com/hashicorp/terraform-plugin-go/tfprotov6/tf6server
 github.com/hashicorp/terraform-plugin-go/tftypes
-# github.com/hashicorp/terraform-plugin-log v0.8.0
-## explicit; go 1.18
+# github.com/hashicorp/terraform-plugin-log v0.9.0
+## explicit; go 1.19
 github.com/hashicorp/terraform-plugin-log/internal/fieldutils
 github.com/hashicorp/terraform-plugin-log/internal/hclogutils
 github.com/hashicorp/terraform-plugin-log/internal/logging
 github.com/hashicorp/terraform-plugin-log/tflog
 github.com/hashicorp/terraform-plugin-log/tfsdklog
-# github.com/hashicorp/terraform-plugin-sdk/v2 v2.26.1
-## explicit; go 1.19
+# github.com/hashicorp/terraform-plugin-sdk/v2 v2.29.0
+## explicit; go 1.20
 github.com/hashicorp/terraform-plugin-sdk/v2/diag
 github.com/hashicorp/terraform-plugin-sdk/v2/helper/id
 github.com/hashicorp/terraform-plugin-sdk/v2/helper/logging
@@ -293,11 +329,11 @@ github.com/hashicorp/terraform-plugin-sdk/v2/internal/tfdiags
 github.com/hashicorp/terraform-plugin-sdk/v2/meta
 github.com/hashicorp/terraform-plugin-sdk/v2/plugin
 github.com/hashicorp/terraform-plugin-sdk/v2/terraform
-# github.com/hashicorp/terraform-registry-address v0.1.0
-## explicit; go 1.14
+# github.com/hashicorp/terraform-registry-address v0.2.2
+## explicit; go 1.19
 github.com/hashicorp/terraform-registry-address
-# github.com/hashicorp/terraform-svchost v0.0.0-20200729002733-f050f53b9734
-## explicit; go 1.12
+# github.com/hashicorp/terraform-svchost v0.1.1
+## explicit; go 1.19
 github.com/hashicorp/terraform-svchost
 # github.com/hashicorp/yamux v0.0.0-20181012175058-2f1d1f20f75d
 ## explicit
@@ -330,16 +366,16 @@ github.com/oklog/run
 ## explicit
 github.com/vmihailenco/msgpack
 github.com/vmihailenco/msgpack/codes
-# github.com/vmihailenco/msgpack/v4 v4.3.12
+# github.com/vmihailenco/msgpack/v5 v5.3.5
 ## explicit; go 1.11
-github.com/vmihailenco/msgpack/v4
-github.com/vmihailenco/msgpack/v4/codes
-# github.com/vmihailenco/tagparser v0.1.1
-## explicit; go 1.13
-github.com/vmihailenco/tagparser
-github.com/vmihailenco/tagparser/internal
-github.com/vmihailenco/tagparser/internal/parser
-# github.com/zclconf/go-cty v1.13.1
+github.com/vmihailenco/msgpack/v5
+github.com/vmihailenco/msgpack/v5/msgpcode
+# github.com/vmihailenco/tagparser/v2 v2.0.0
+## explicit; go 1.15
+github.com/vmihailenco/tagparser/v2
+github.com/vmihailenco/tagparser/v2/internal
+github.com/vmihailenco/tagparser/v2/internal/parser
+# github.com/zclconf/go-cty v1.14.0
 ## explicit; go 1.18
 github.com/zclconf/go-cty/cty
 github.com/zclconf/go-cty/cty/convert
@@ -349,22 +385,20 @@ github.com/zclconf/go-cty/cty/function/stdlib
 github.com/zclconf/go-cty/cty/gocty
 github.com/zclconf/go-cty/cty/json
 github.com/zclconf/go-cty/cty/set
-# golang.org/x/crypto v0.8.0
+# golang.org/x/crypto v0.14.0
 ## explicit; go 1.17
+golang.org/x/crypto/argon2
+golang.org/x/crypto/blake2b
 golang.org/x/crypto/cast5
-golang.org/x/crypto/openpgp
-golang.org/x/crypto/openpgp/armor
-golang.org/x/crypto/openpgp/elgamal
-golang.org/x/crypto/openpgp/errors
-golang.org/x/crypto/openpgp/packet
-golang.org/x/crypto/openpgp/s2k
-# golang.org/x/mod v0.10.0
+golang.org/x/crypto/hkdf
+golang.org/x/crypto/sha3
+# golang.org/x/mod v0.12.0
 ## explicit; go 1.17
 golang.org/x/mod/internal/lazyregexp
 golang.org/x/mod/modfile
 golang.org/x/mod/module
 golang.org/x/mod/semver
-# golang.org/x/net v0.9.0
+# golang.org/x/net v0.17.0
 ## explicit; go 1.17
 golang.org/x/net/context
 golang.org/x/net/http/httpguts
@@ -373,11 +407,12 @@ golang.org/x/net/http2/hpack
 golang.org/x/net/idna
 golang.org/x/net/internal/timeseries
 golang.org/x/net/trace
-# golang.org/x/sys v0.7.0
+# golang.org/x/sys v0.13.0
 ## explicit; go 1.17
+golang.org/x/sys/cpu
 golang.org/x/sys/execabs
 golang.org/x/sys/unix
-# golang.org/x/text v0.9.0
+# golang.org/x/text v0.13.0
 ## explicit; go 1.17
 golang.org/x/text/secure/bidirule
 golang.org/x/text/transform
@@ -415,7 +450,7 @@ golang.org/x/tools/internal/tokeninternal
 golang.org/x/tools/internal/typeparams
 golang.org/x/tools/internal/typesinternal
 golang.org/x/tools/txtar
-# google.golang.org/appengine v1.6.6
+# google.golang.org/appengine v1.6.7
 ## explicit; go 1.11
 google.golang.org/appengine
 google.golang.org/appengine/datastore
@@ -428,10 +463,10 @@ google.golang.org/appengine/internal/datastore
 google.golang.org/appengine/internal/log
 google.golang.org/appengine/internal/modules
 google.golang.org/appengine/internal/remote_api
-# google.golang.org/genproto v0.0.0-20200904004341-0bd0a958aa1d
-## explicit; go 1.11
+# google.golang.org/genproto/googleapis/rpc v0.0.0-20230525234030-28d5490b6b19
+## explicit; go 1.19
 google.golang.org/genproto/googleapis/rpc/status
-# google.golang.org/grpc v1.51.0
+# google.golang.org/grpc v1.57.0
 ## explicit; go 1.17
 google.golang.org/grpc
 google.golang.org/grpc/attributes
@@ -479,13 +514,14 @@ google.golang.org/grpc/keepalive
 google.golang.org/grpc/metadata
 google.golang.org/grpc/peer
 google.golang.org/grpc/reflection
+google.golang.org/grpc/reflection/grpc_reflection_v1
 google.golang.org/grpc/reflection/grpc_reflection_v1alpha
 google.golang.org/grpc/resolver
 google.golang.org/grpc/serviceconfig
 google.golang.org/grpc/stats
 google.golang.org/grpc/status
 google.golang.org/grpc/tap
-# google.golang.org/protobuf v1.28.1
+# google.golang.org/protobuf v1.31.0
 ## explicit; go 1.11
 google.golang.org/protobuf/encoding/protojson
 google.golang.org/protobuf/encoding/prototext
diff --git a/.ci/scripts/add-to-milestone.sh b/.ci/scripts/add-to-milestone.sh
new file mode 100755
index 00000000000..aff0d18df41
--- /dev/null
+++ b/.ci/scripts/add-to-milestone.sh
@@ -0,0 +1,82 @@
+#!/bin/bash
+
+MILESTONE_NAME=$(gh api graphql -F current="$MILESTONE" -f query='
+query($current: String!) {
+  repository(name: "terraform-provider-aws", owner: "hashicorp") {
+    milestones(query: $current, first: 1) {
+      nodes {
+        title
+      }
+    }
+  }
+}' --jq '.data.repository.milestones.nodes[].title')
+
+# Get the issues related to this pull request and
+DATA=$(gh api graphql --paginate -F number="$PR_NUMBER" -f query='
+query($number: Int!, $endCursor: String) {
+  repository(name: "terraform-provider-aws", owner: "hashicorp") {
+    pullRequest(number: $number) {
+      id
+      url
+      closingIssuesReferences(first: 1, after: $endCursor) {
+        pageInfo {
+          endCursor
+          hasNextPage
+        }
+        edges {
+          node {
+            url
+            state
+            timelineItems(itemTypes: CLOSED_EVENT, last: 3) {
+              nodes {
+                ... on ClosedEvent {
+                  closer {
+                    ... on PullRequest {
+                      id
+                    }
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+}' | jq --slurp '. | tojson')
+
+# Due to --slurp, we'll have a list of multiple objects starting at .data
+# but we only need the PR ID once. Needed for comparing against the closer
+# on the related issues.
+PULL_ID=$(jq \
+  --null-input \
+  --argjson data "$DATA" \
+  '$data | fromjson | .[0].data.repository.pullRequest.id')
+
+# Similar comment to above, but we need the URL for the gh call.
+PULL_URL=$(jq \
+  --null-input \
+  --raw-output \
+  --argjson data "$DATA" \
+  '$data | fromjson | .[0].data.repository.pullRequest.url')
+
+# Get the URLs for all issues closed by this pull request. Needed for the gh call.
+ISSUES_URLS=($(jq \
+  --null-input \
+  --raw-output \
+  --argjson data "$DATA" \
+  --argjson pull "$PULL_ID" \
+  '$data
+  | fromjson
+  | .[].data.repository.pullRequest.closingIssuesReferences.edges[]
+  | select(.node.state == "CLOSED")
+  | select(.node.timelineItems.nodes[].closer.id == $pull).node.url'))
+
+
+# Add pull request to milestone
+gh pr edit "$PULL_URL" --milestone "$MILESTONE_NAME"
+
+# Add issues to milestone
+if [[ "${#ISSUES_URLS[@]}" -ne 0 ]]; then
+  gh issue edit "${ISSUES_URLS[@]}" --milestone "$MILESTONE_NAME"
+fi
diff --git a/.ci/scripts/archive-on-milestone-closed.sh b/.ci/scripts/archive-on-milestone-closed.sh
new file mode 100755
index 00000000000..c7813e41393
--- /dev/null
+++ b/.ci/scripts/archive-on-milestone-closed.sh
@@ -0,0 +1,78 @@
+#!/bin/bash
+
+PROJECT_NUMBER=196
+PROJECT_ID="PVT_kwDOAAuecM4AF-7h"
+
+main () {
+  ISSUES=$(gh api graphql --paginate -F milestone="$MILESTONE" -f query='
+    query($milestone: Int!, $endCursor: String) {
+      organization(login: "hashicorp") {
+        repository(name: "terraform-provider-aws") {
+          milestone(number: $milestone) {
+            issues(first: 10, after: $endCursor) {
+              edges {
+                node {
+                  id
+                  projectItems(includeArchived: false, first: 10) {
+                    nodes {
+                      id
+                      project {
+                        id
+                      }
+                    }
+                  }
+                }
+              }
+              pageInfo {
+                endCursor
+                hasNextPage
+              }
+            }
+          }
+        }
+      }
+    }' --jq '.data.organization.repository.milestone.issues.edges[].node.projectItems.nodes[]' | jq --slurp '. | tojson')
+
+  PULLS=$(gh api graphql --paginate -F milestone="$MILESTONE" -f query='
+    query($milestone: Int!, $endCursor: String) {
+      organization(login: "hashicorp") {
+        repository(name: "terraform-provider-aws") {
+          milestone(number: $milestone) {
+            pullRequests(first: 10, after: $endCursor) {
+              edges {
+                node {
+                  id
+                  projectItems(includeArchived: false, first: 10) {
+                    nodes {
+                      id
+                      project {
+                        id
+                      }
+                    }
+                  }
+                }
+              }
+              pageInfo {
+                endCursor
+                hasNextPage
+              }
+            }
+          }
+        }
+      }
+    }' --jq '.data.organization.repository.milestone.pullRequests.edges[].node.projectItems.nodes[]' | jq --slurp '. | tojson')
+
+  PROJECT_ITEMS=$(jq \
+    --null-input \
+    --arg project "$PROJECT_ID" \
+    --argjson issues "$ISSUES" \
+    --argjson pulls "$PULLS" \
+    '$issues, $pulls | fromjson | .[] | select(.project.id == $project).id')
+
+  for item in $PROJECT_ITEMS; do
+    echo "Archiving $item"
+    gh project item-archive "$PROJECT_NUMBER" --owner "hashicorp" --id "$item"
+  done
+}
+
+main
diff --git a/.ci/scripts/markdown-link-check.sh b/.ci/scripts/markdown-link-check.sh
index 89c447c6455..cbb0f5a3f43 100755
--- a/.ci/scripts/markdown-link-check.sh
+++ b/.ci/scripts/markdown-link-check.sh
@@ -36,7 +36,7 @@ docker run --rm -i -t \
   -w /github/workspace \
   --entrypoint /usr/bin/find \
   "${link_check_container}" \
-  website \( -type f -name "*.md" -or -name "*.markdown" \) -exec /src/markdown-link-check --config .ci/.markdownlinkcheck.json --quiet --verbose {} \; \
+  website \( -type f -name "*.md" -or -name "*.markdown" \) -not -path "website/docs/cdktf/*" -exec /src/markdown-link-check --config .ci/.markdownlinkcheck.json --quiet --verbose {} \; \
   | tee -a "${output_file}"
 
 touch "${error_file}"
diff --git a/.ci/scripts/unlabel-on-milestone-closed.sh b/.ci/scripts/unlabel-on-milestone-closed.sh
new file mode 100755
index 00000000000..9ae5119c7b3
--- /dev/null
+++ b/.ci/scripts/unlabel-on-milestone-closed.sh
@@ -0,0 +1,55 @@
+#!/bin/bash
+
+main () {
+  ISSUES=$(gh api graphql --paginate -F milestone="$MILESTONE" -f query='
+    query($milestone: Int!, $endCursor: String) {
+      organization(login: "hashicorp") {
+        repository(name: "terraform-provider-aws") {
+          milestone(number: $milestone) {
+            issues(first: 10, after: $endCursor, labels: ["prioritized"]) {
+              edges {
+                node {
+                  url
+                }
+              }
+              pageInfo {
+                endCursor
+                hasNextPage
+              }
+            }
+          }
+        }
+      }
+    }' --jq '.data.organization.repository.milestone.issues.edges[].node' | jq --raw-output --slurp '[.[].url] | join(" ")')
+
+  PULLS=$(gh api graphql --paginate -F milestone="$MILESTONE" -f query='
+    query($milestone: Int!, $endCursor: String) {
+      organization(login: "hashicorp") {
+        repository(name: "terraform-provider-aws") {
+          milestone(number: $milestone) {
+            pullRequests(first: 10, after: $endCursor, labels: ["prioritized"]) {
+              edges {
+                node {
+                  url
+                }
+              }
+              pageInfo {
+                endCursor
+                hasNextPage
+              }
+            }
+          }
+        }
+      }
+    }' --jq '.data.organization.repository.milestone.pullRequests.edges[].node' | jq --raw-output --slurp '.[] | .url')
+
+  # gh issues allows passing multiple URLs at once
+  gh issue edit $ISSUES --remove-label bug
+
+  # gh pr does not allow passing multiple URLs at once
+  for item in $PULLS; do
+    gh pr edit "$item" --remove-label bug
+  done
+}
+
+main
diff --git a/.ci/scripts/update-aws-sdk-go-v2-dependencies.sh b/.ci/scripts/update-aws-sdk-go-v2-dependencies.sh
new file mode 100755
index 00000000000..b5c8130f8a3
--- /dev/null
+++ b/.ci/scripts/update-aws-sdk-go-v2-dependencies.sh
@@ -0,0 +1,9 @@
+#!/bin/sh
+
+# Update all AWS SDK for Go v2 dependencies.
+declare -a StringArray=(`grep github.com/aws/aws-sdk-go-v2 go.mod | grep -v indirect | cut -f2 | cut -d ' ' -f1`)
+for val in "${StringArray[@]}"; do
+  go get $val && go mod tidy
+  git add -u
+  git commit -m "go get $val."
+done
\ No newline at end of file
diff --git a/.ci/scripts/validate-terraform-file.sh b/.ci/scripts/validate-terraform-file.sh
index 87525bbcf24..4f93a4abe20 100755
--- a/.ci/scripts/validate-terraform-file.sh
+++ b/.ci/scripts/validate-terraform-file.sh
@@ -31,7 +31,7 @@ while IFS= read -r block ; do
 
     # We need to capture the output and error code here. We don't want to exit on the first error
     set +e
-    tflint_output=$(tflint --config .ci/.tflint.hcl "${rules[@]}" "$tf" 2>&1)
+    tflint_output=$(tflint --config .ci/.tflint.hcl --filter=$tf "${rules[@]}" 2>&1)
     tflint_exitcode=$?
     set -e
 
diff --git a/.ci/scripts/validate-terraform.sh b/.ci/scripts/validate-terraform.sh
index 5771b834a89..c37620c2f5e 100755
--- a/.ci/scripts/validate-terraform.sh
+++ b/.ci/scripts/validate-terraform.sh
@@ -43,7 +43,7 @@ while read -r filename ; do
 
         # We need to capture the output and error code here. We don't want to exit on the first error
         set +e
-        tflint_output=$(${TFLINT_CMD} --config .ci/.tflint.hcl "${rules[@]}" "$tf" 2>&1)
+        tflint_output=$(${TFLINT_CMD} --config .ci/.tflint.hcl --filter=$tf "${rules[@]}" 2>&1)
         tflint_exitcode=$?
         set -e
 
diff --git a/.ci/semgrep/migrate/context.yml b/.ci/semgrep/migrate/context.yml
index 7222f086859..e8674d7eaa8 100644
--- a/.ci/semgrep/migrate/context.yml
+++ b/.ci/semgrep/migrate/context.yml
@@ -18,11 +18,11 @@ rules:
       - metavariable-regex:
           metavariable: $API
           # This weird construction is to get around greedy matching
-          regex: ^(?!.*(WithContext|_Values)).*$
+          regex: ^(?!.*(WithContext|_Values|Paginator)).*$
       - pattern-not: |
           $CONN.$APIV2(ctx, ...)
-      - pattern-not: tfconnect.$API(...)
       - pattern-not: tfcodestarconnections.$API()
+      - pattern-not: tfconnect.$API(...)
       - pattern-not: tfdirectconnect.$API()
       - pattern-not: tfkafkaconnect.$API()
       - pattern-not: conn.Handlers.$X(...)
diff --git a/.ci/semgrep/pluginsdk/diags.yml b/.ci/semgrep/pluginsdk/diags.yml
new file mode 100644
index 00000000000..ee9e92faaf2
--- /dev/null
+++ b/.ci/semgrep/pluginsdk/diags.yml
@@ -0,0 +1,24 @@
+rules:
+  - id: avoid-diag_FromErr
+    fix: sdkdiag.AppendFromErr(diags, $ERR)
+    languages: [go]
+    message: Prefer `sdkdiag.AppendFromErr` to `diag.FromErr`
+    paths:
+      exclude:
+        - internal/service
+    patterns:
+      - pattern: diag.FromErr($ERR)
+    severity: WARNING
+
+  - id: avoid-diag_Errorf
+    fix-regex:
+      regex: diag\.Errorf\((.*)\)
+      replacement: sdkdiag.AppendErrorf(diags, \1)
+    languages: [go]
+    message: Prefer `sdkdiag.AppendErrorf` to `diag.Errorf`
+    paths:
+      exclude:
+        - internal/service
+    patterns:
+      - pattern: diag.Errorf(...)
+    severity: WARNING
diff --git a/.ci/tools/go.mod b/.ci/tools/go.mod
index dd3bc59394b..7868ac22b48 100644
--- a/.ci/tools/go.mod
+++ b/.ci/tools/go.mod
@@ -1,50 +1,56 @@
 module github.com/hashicorp/terraform-provider-aws/tools
 
-go 1.19
+go 1.20
 
 require (
-	github.com/bflad/tfproviderdocs v0.11.0
+	github.com/YakDriver/tfproviderdocs v0.11.0
 	github.com/client9/misspell v0.3.4
-	github.com/golangci/golangci-lint v1.53.3
+	github.com/golangci/golangci-lint v1.55.1
+	github.com/hashicorp/copywrite v0.16.6
 	github.com/hashicorp/go-changelog v0.0.0-20201005170154-56335215ce3a
 	github.com/katbyte/terrafmt v0.5.2
 	github.com/pavius/impi v0.0.3
-	github.com/rhysd/actionlint v1.6.25
-	github.com/terraform-linters/tflint v0.46.1
+	github.com/rhysd/actionlint v1.6.26
+	github.com/terraform-linters/tflint v0.48.0
 	mvdan.cc/gofumpt v0.5.0
 )
 
 require (
 	4d63.com/gocheckcompilerdirectives v1.2.1 // indirect
 	4d63.com/gochecknoglobals v0.2.1 // indirect
-	cloud.google.com/go v0.107.0 // indirect
-	cloud.google.com/go/compute v1.15.1 // indirect
+	cloud.google.com/go v0.110.2 // indirect
+	cloud.google.com/go/compute v1.20.1 // indirect
 	cloud.google.com/go/compute/metadata v0.2.3 // indirect
-	cloud.google.com/go/iam v0.8.0 // indirect
-	cloud.google.com/go/storage v1.27.0 // indirect
-	github.com/4meepo/tagalign v1.2.2 // indirect
-	github.com/Abirdcfly/dupword v0.0.11 // indirect
-	github.com/Antonboom/errname v0.1.10 // indirect
-	github.com/Antonboom/nilnil v0.1.5 // indirect
+	cloud.google.com/go/iam v0.13.0 // indirect
+	cloud.google.com/go/storage v1.29.0 // indirect
+	github.com/4meepo/tagalign v1.3.3 // indirect
+	github.com/Abirdcfly/dupword v0.0.13 // indirect
+	github.com/AlecAivazis/survey/v2 v2.3.6 // indirect
+	github.com/Antonboom/errname v0.1.12 // indirect
+	github.com/Antonboom/nilnil v0.1.7 // indirect
+	github.com/Antonboom/testifylint v0.2.3 // indirect
 	github.com/BurntSushi/toml v1.3.2 // indirect
 	github.com/Djarvur/go-err113 v0.0.0-20210108212216-aea10b59be24 // indirect
-	github.com/GaijinEntertainment/go-exhaustruct/v2 v2.3.0 // indirect
+	github.com/GaijinEntertainment/go-exhaustruct/v3 v3.1.0 // indirect
 	github.com/Masterminds/goutils v1.1.1 // indirect
 	github.com/Masterminds/semver v1.5.0 // indirect
-	github.com/Masterminds/semver/v3 v3.2.0 // indirect
+	github.com/Masterminds/semver/v3 v3.2.1 // indirect
 	github.com/Masterminds/sprig/v3 v3.2.1 // indirect
 	github.com/Microsoft/go-winio v0.4.16 // indirect
 	github.com/OpenPeeDeeP/depguard/v2 v2.1.0 // indirect
-	github.com/ProtonMail/go-crypto v0.0.0-20210428141323-04723f9f07d7 // indirect
+	github.com/ProtonMail/go-crypto v0.0.0-20230217124315-7d5c6f04bbb8 // indirect
 	github.com/acomagu/bufpipe v1.0.3 // indirect
 	github.com/agext/levenshtein v1.2.3 // indirect
+	github.com/alecthomas/go-check-sumtype v0.1.3 // indirect
 	github.com/alexkohler/nakedret/v2 v2.0.2 // indirect
 	github.com/alexkohler/prealloc v1.0.0 // indirect
 	github.com/alingse/asasalint v0.0.11 // indirect
 	github.com/apparentlymart/go-cidr v1.1.0 // indirect
 	github.com/apparentlymart/go-textseg/v13 v13.0.0 // indirect
+	github.com/apparentlymart/go-textseg/v15 v15.0.0 // indirect
 	github.com/armon/go-radix v1.0.0 // indirect
-	github.com/ashanbrown/forbidigo v1.5.3 // indirect
+	github.com/asaskevich/govalidator v0.0.0-20200907205600-7a23bdc65eef // indirect
+	github.com/ashanbrown/forbidigo v1.6.0 // indirect
 	github.com/ashanbrown/makezero v1.1.1 // indirect
 	github.com/aws/aws-sdk-go v1.44.122 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
@@ -53,16 +59,24 @@ require (
 	github.com/bkielbasa/cyclop v1.2.1 // indirect
 	github.com/blizzy78/varnamelen v0.8.0 // indirect
 	github.com/bmatcuk/doublestar v1.3.4 // indirect
+	github.com/bmatcuk/doublestar/v4 v4.6.0 // indirect
 	github.com/bombsimon/wsl/v3 v3.4.0 // indirect
-	github.com/breml/bidichk v0.2.4 // indirect
-	github.com/breml/errchkjson v0.3.1 // indirect
-	github.com/butuzov/ireturn v0.2.0 // indirect
+	github.com/bradleyfalzon/ghinstallation/v2 v2.5.0 // indirect
+	github.com/breml/bidichk v0.2.7 // indirect
+	github.com/breml/errchkjson v0.3.6 // indirect
+	github.com/butuzov/ireturn v0.2.1 // indirect
 	github.com/butuzov/mirror v1.1.0 // indirect
+	github.com/catenacyber/perfsprint v0.2.0 // indirect
+	github.com/ccojocar/zxcvbn-go v1.0.1 // indirect
 	github.com/cespare/xxhash/v2 v2.2.0 // indirect
 	github.com/charithe/durationcheck v0.0.10 // indirect
-	github.com/chavacava/garif v0.0.0-20230227094218-b8c73b2037b8 // indirect
+	github.com/chavacava/garif v0.1.0 // indirect
+	github.com/cli/go-gh v1.2.1 // indirect
+	github.com/cli/safeexec v1.0.0 // indirect
+	github.com/cli/shurcooL-graphql v0.0.2 // indirect
+	github.com/cloudflare/circl v1.3.3 // indirect
 	github.com/curioswitch/go-reassign v0.2.0 // indirect
-	github.com/daixiang0/gci v0.10.1 // indirect
+	github.com/daixiang0/gci v0.11.2 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/denis-tingaikin/go-header v0.4.3 // indirect
 	github.com/emirpasic/gods v1.12.0 // indirect
@@ -73,10 +87,13 @@ require (
 	github.com/firefart/nonamedreturns v1.0.4 // indirect
 	github.com/fsnotify/fsnotify v1.5.4 // indirect
 	github.com/fzipp/gocyclo v0.6.0 // indirect
-	github.com/go-critic/go-critic v0.8.1 // indirect
+	github.com/ghostiam/protogetter v0.2.3 // indirect
+	github.com/go-critic/go-critic v0.9.0 // indirect
 	github.com/go-git/gcfg v1.5.0 // indirect
 	github.com/go-git/go-billy/v5 v5.3.1 // indirect
 	github.com/go-git/go-git/v5 v5.4.2 // indirect
+	github.com/go-openapi/errors v0.20.2 // indirect
+	github.com/go-openapi/strfmt v0.21.3 // indirect
 	github.com/go-toolsmith/astcast v1.1.0 // indirect
 	github.com/go-toolsmith/astcopy v1.1.0 // indirect
 	github.com/go-toolsmith/astequal v1.1.0 // indirect
@@ -87,24 +104,27 @@ require (
 	github.com/go-xmlfmt/xmlfmt v1.1.2 // indirect
 	github.com/gobwas/glob v0.2.3 // indirect
 	github.com/gofrs/flock v0.8.1 // indirect
+	github.com/golang-jwt/jwt/v4 v4.5.0 // indirect
 	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
-	github.com/golang/protobuf v1.5.2 // indirect
+	github.com/golang/protobuf v1.5.3 // indirect
 	github.com/golangci/check v0.0.0-20180506172741-cfe4005ccda2 // indirect
 	github.com/golangci/dupl v0.0.0-20180902072040-3e9179ac440a // indirect
 	github.com/golangci/go-misc v0.0.0-20220329215616-d24fe342adfe // indirect
-	github.com/golangci/gofmt v0.0.0-20220901101216-f2edd75033f2 // indirect
+	github.com/golangci/gofmt v0.0.0-20231018234816-f50ced29576e // indirect
 	github.com/golangci/lint-1 v0.0.0-20191013205115-297bf364a8e0 // indirect
 	github.com/golangci/maligned v0.0.0-20180506175553-b1d89398deca // indirect
-	github.com/golangci/misspell v0.4.0 // indirect
-	github.com/golangci/revgrep v0.0.0-20220804021717-745bb2f7c2e6 // indirect
+	github.com/golangci/misspell v0.4.1 // indirect
+	github.com/golangci/revgrep v0.5.2 // indirect
 	github.com/golangci/unconvert v0.0.0-20180507085042-28b1c447d1f4 // indirect
-	github.com/google/go-cmp v0.5.9 // indirect
-	github.com/google/go-github/v35 v35.3.0 // indirect
-	github.com/google/go-querystring v1.0.0 // indirect
-	github.com/google/uuid v1.3.0 // indirect
-	github.com/googleapis/enterprise-certificate-proxy v0.2.0 // indirect
-	github.com/googleapis/gax-go/v2 v2.7.0 // indirect
-	github.com/gookit/color v1.5.3 // indirect
+	github.com/google/go-cmp v0.6.0 // indirect
+	github.com/google/go-github/v45 v45.2.0 // indirect
+	github.com/google/go-github/v53 v53.2.0 // indirect
+	github.com/google/go-querystring v1.1.0 // indirect
+	github.com/google/s2a-go v0.1.4 // indirect
+	github.com/google/uuid v1.3.1 // indirect
+	github.com/googleapis/enterprise-certificate-proxy v0.2.3 // indirect
+	github.com/googleapis/gax-go/v2 v2.11.0 // indirect
+	github.com/gookit/color v1.5.4 // indirect
 	github.com/gordonklaus/ineffassign v0.0.0-20230610083614-0e73809eb601 // indirect
 	github.com/gostaticanalysis/analysisutil v0.7.1 // indirect
 	github.com/gostaticanalysis/comment v1.4.2 // indirect
@@ -112,58 +132,68 @@ require (
 	github.com/gostaticanalysis/nilerr v0.1.1 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
-	github.com/hashicorp/go-getter v1.7.0 // indirect
+	github.com/hashicorp/go-getter v1.7.1 // indirect
 	github.com/hashicorp/go-hclog v1.5.0 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
-	github.com/hashicorp/go-plugin v1.4.9 // indirect
+	github.com/hashicorp/go-plugin v1.4.10 // indirect
 	github.com/hashicorp/go-safetemp v1.0.0 // indirect
 	github.com/hashicorp/go-uuid v1.0.3 // indirect
 	github.com/hashicorp/go-version v1.6.0 // indirect
 	github.com/hashicorp/hc-install v0.4.0 // indirect
 	github.com/hashicorp/hcl v1.0.0 // indirect
-	github.com/hashicorp/hcl/v2 v2.16.2 // indirect
+	github.com/hashicorp/hcl/v2 v2.18.0 // indirect
 	github.com/hashicorp/logutils v1.0.0 // indirect
 	github.com/hashicorp/terraform-exec v0.17.2 // indirect
-	github.com/hashicorp/terraform-json v0.16.0 // indirect
-	github.com/hashicorp/terraform-registry-address v0.1.0 // indirect
-	github.com/hashicorp/terraform-svchost v0.0.0-20200729002733-f050f53b9734 // indirect
+	github.com/hashicorp/terraform-json v0.17.1 // indirect
+	github.com/hashicorp/terraform-registry-address v0.2.0 // indirect
+	github.com/hashicorp/terraform-svchost v0.0.1 // indirect
 	github.com/hashicorp/yamux v0.0.0-20181012175058-2f1d1f20f75d // indirect
+	github.com/henvic/httpretty v0.0.6 // indirect
 	github.com/hexops/gotextdiff v1.0.3 // indirect
 	github.com/huandu/xstrings v1.3.2 // indirect
 	github.com/imdario/mergo v0.3.12 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
+	github.com/jedib0t/go-pretty v4.3.0+incompatible // indirect
+	github.com/jedib0t/go-pretty/v6 v6.4.6 // indirect
 	github.com/jessevdk/go-flags v1.5.0 // indirect
-	github.com/jgautheron/goconst v1.5.1 // indirect
+	github.com/jgautheron/goconst v1.6.0 // indirect
 	github.com/jingyugao/rowserrcheck v1.1.1 // indirect
 	github.com/jirfag/go-printf-func-name v0.0.0-20200119135958-7558a9eaa5af // indirect
 	github.com/jmespath/go-jmespath v0.4.0 // indirect
+	github.com/joho/godotenv v1.3.0 // indirect
 	github.com/jstemmer/go-junit-report v1.0.0 // indirect
 	github.com/julz/importas v0.1.0 // indirect
 	github.com/katbyte/andreyvit-diff v0.0.1 // indirect
 	github.com/katbyte/sergi-go-diff v1.1.1 // indirect
+	github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 // indirect
 	github.com/kevinburke/ssh_config v0.0.0-20201106050909-4977a11b4351 // indirect
 	github.com/kisielk/errcheck v1.6.3 // indirect
 	github.com/kisielk/gotool v1.0.0 // indirect
 	github.com/kkHAIKE/contextcheck v1.1.4 // indirect
 	github.com/klauspost/compress v1.15.11 // indirect
+	github.com/knadh/koanf v1.5.0 // indirect
 	github.com/kulti/thelper v0.6.3 // indirect
-	github.com/kunwardeep/paralleltest v1.0.7 // indirect
+	github.com/kunwardeep/paralleltest v1.0.8 // indirect
 	github.com/kyoh86/exportloopref v0.1.11 // indirect
 	github.com/ldez/gomoddirectives v0.2.3 // indirect
 	github.com/ldez/tagliatelle v0.5.0 // indirect
 	github.com/leonklingele/grouper v1.1.1 // indirect
+	github.com/lucasb-eyer/go-colorful v1.2.0 // indirect
 	github.com/lufeee/execinquery v1.2.1 // indirect
+	github.com/macabu/inamedparam v0.1.2 // indirect
 	github.com/magiconair/properties v1.8.6 // indirect
 	github.com/maratori/testableexamples v1.0.0 // indirect
 	github.com/maratori/testpackage v1.1.1 // indirect
 	github.com/matoous/godox v0.0.0-20230222163458-006bad1f9d26 // indirect
 	github.com/mattn/go-colorable v0.1.13 // indirect
 	github.com/mattn/go-isatty v0.0.19 // indirect
-	github.com/mattn/go-runewidth v0.0.14 // indirect
+	github.com/mattn/go-runewidth v0.0.15 // indirect
 	github.com/matttproud/golang_protobuf_extensions v1.0.1 // indirect
 	github.com/mbilski/exhaustivestruct v1.2.0 // indirect
-	github.com/mgechev/revive v1.3.2 // indirect
+	github.com/mergestat/timediff v0.0.3 // indirect
+	github.com/mgechev/revive v1.3.4 // indirect
+	github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d // indirect
 	github.com/mitchellh/cli v1.1.5 // indirect
 	github.com/mitchellh/copystructure v1.2.0 // indirect
 	github.com/mitchellh/go-homedir v1.1.0 // indirect
@@ -172,35 +202,37 @@ require (
 	github.com/mitchellh/mapstructure v1.5.0 // indirect
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
 	github.com/moricho/tparallel v0.3.1 // indirect
+	github.com/muesli/termenv v0.12.0 // indirect
 	github.com/nakabonne/nestif v0.3.1 // indirect
-	github.com/nbutton23/zxcvbn-go v0.0.0-20210217022336-fa2cb2858354 // indirect
 	github.com/nishanths/exhaustive v0.11.0 // indirect
 	github.com/nishanths/predeclared v0.2.2 // indirect
-	github.com/nunnatsa/ginkgolinter v0.12.1 // indirect
+	github.com/nunnatsa/ginkgolinter v0.14.0 // indirect
 	github.com/oklog/run v1.0.0 // indirect
+	github.com/oklog/ulid v1.3.1 // indirect
 	github.com/olekukonko/tablewriter v0.0.5 // indirect
 	github.com/owenrumney/go-sarif v1.1.1 // indirect
 	github.com/pelletier/go-toml v1.9.5 // indirect
 	github.com/pelletier/go-toml/v2 v2.0.5 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
-	github.com/polyfloyd/go-errorlint v1.4.2 // indirect
+	github.com/polyfloyd/go-errorlint v1.4.5 // indirect
 	github.com/posener/complete v1.2.3 // indirect
 	github.com/prometheus/client_golang v1.12.1 // indirect
 	github.com/prometheus/client_model v0.2.0 // indirect
 	github.com/prometheus/common v0.32.1 // indirect
 	github.com/prometheus/procfs v0.7.3 // indirect
-	github.com/quasilyte/go-ruleguard v0.3.19 // indirect
+	github.com/quasilyte/go-ruleguard v0.4.0 // indirect
 	github.com/quasilyte/gogrep v0.5.0 // indirect
 	github.com/quasilyte/regex/syntax v0.0.0-20210819130434-b3f0c404a727 // indirect
 	github.com/quasilyte/stdinfo v0.0.0-20220114132959-f7386bf02567 // indirect
 	github.com/rivo/uniseg v0.4.4 // indirect
-	github.com/robfig/cron v1.2.0 // indirect
+	github.com/robfig/cron/v3 v3.0.1 // indirect
 	github.com/ryancurrah/gomodguard v1.3.0 // indirect
-	github.com/ryanrolds/sqlclosecheck v0.4.0 // indirect
+	github.com/ryanrolds/sqlclosecheck v0.5.1 // indirect
+	github.com/samber/lo v1.37.0 // indirect
 	github.com/sanposhiho/wastedassign/v2 v2.0.7 // indirect
 	github.com/sashamelentyev/interfacebloat v1.1.0 // indirect
-	github.com/sashamelentyev/usestdlibvars v1.23.0 // indirect
-	github.com/securego/gosec/v2 v2.16.0 // indirect
+	github.com/sashamelentyev/usestdlibvars v1.24.0 // indirect
+	github.com/securego/gosec/v2 v2.18.2 // indirect
 	github.com/sergi/go-diff v1.2.0 // indirect
 	github.com/shazow/go-diff v0.0.0-20160112020656-b6b7b6733b8c // indirect
 	github.com/shopspring/decimal v1.2.0 // indirect
@@ -225,57 +257,63 @@ require (
 	github.com/subosito/gotenv v1.4.1 // indirect
 	github.com/t-yuki/gocover-cobertura v0.0.0-20180217150009-aaee18c8195c // indirect
 	github.com/tdakkota/asciicheck v0.2.0 // indirect
-	github.com/terraform-linters/tflint-plugin-sdk v0.16.1 // indirect
-	github.com/terraform-linters/tflint-ruleset-terraform v0.2.2 // indirect
-	github.com/tetafro/godot v1.4.11 // indirect
+	github.com/terraform-linters/tflint-plugin-sdk v0.18.0 // indirect
+	github.com/terraform-linters/tflint-ruleset-terraform v0.4.0 // indirect
+	github.com/tetafro/godot v1.4.15 // indirect
+	github.com/thanhpk/randstr v1.0.4 // indirect
+	github.com/thlib/go-timezone-local v0.0.0-20210907160436-ef149e42d28e // indirect
 	github.com/timakin/bodyclose v0.0.0-20230421092635-574207250966 // indirect
 	github.com/timonwong/loggercheck v0.9.4 // indirect
 	github.com/tomarrell/wrapcheck/v2 v2.8.1 // indirect
 	github.com/tommy-muehle/go-mnd/v2 v2.5.1 // indirect
 	github.com/ulikunitz/xz v0.5.10 // indirect
-	github.com/ultraware/funlen v0.0.3 // indirect
+	github.com/ultraware/funlen v0.1.0 // indirect
 	github.com/ultraware/whitespace v0.0.5 // indirect
-	github.com/uudashr/gocognit v1.0.6 // indirect
+	github.com/uudashr/gocognit v1.1.2 // indirect
 	github.com/vmihailenco/msgpack/v5 v5.3.5 // indirect
 	github.com/vmihailenco/tagparser/v2 v2.0.0 // indirect
 	github.com/xanzy/ssh-agent v0.3.0 // indirect
-	github.com/xen0n/gosmopolitan v1.2.1 // indirect
+	github.com/xen0n/gosmopolitan v1.2.2 // indirect
 	github.com/xo/terminfo v0.0.0-20210125001918-ca9a967f8778 // indirect
 	github.com/yagipy/maintidx v1.0.0 // indirect
 	github.com/yeya24/promlinter v0.2.0 // indirect
-	github.com/ykadowak/zerologlint v0.1.2 // indirect
-	github.com/yuin/goldmark v1.5.4 // indirect
+	github.com/ykadowak/zerologlint v0.1.3 // indirect
+	github.com/yuin/goldmark v1.5.6 // indirect
 	github.com/yuin/goldmark-meta v1.1.0 // indirect
-	github.com/zclconf/go-cty v1.13.1 // indirect
+	github.com/zclconf/go-cty v1.13.2 // indirect
 	github.com/zclconf/go-cty-yaml v1.0.3 // indirect
-	gitlab.com/bosi/decorder v0.2.3 // indirect
+	gitlab.com/bosi/decorder v0.4.1 // indirect
+	go-simpler.org/sloglint v0.1.2 // indirect
+	go.mongodb.org/mongo-driver v1.10.0 // indirect
 	go.opencensus.io v0.24.0 // indirect
-	go.tmz.dev/musttag v0.7.0 // indirect
+	go.tmz.dev/musttag v0.7.2 // indirect
 	go.uber.org/atomic v1.7.0 // indirect
 	go.uber.org/multierr v1.6.0 // indirect
 	go.uber.org/zap v1.24.0 // indirect
-	golang.org/x/crypto v0.9.0 // indirect
+	golang.org/x/crypto v0.14.0 // indirect
 	golang.org/x/exp v0.0.0-20230510235704-dd950f8aeaea // indirect
-	golang.org/x/exp/typeparams v0.0.0-20230224173230-c95f2b4c22f2 // indirect
-	golang.org/x/lint v0.0.0-20210508222113-6edffad5e616 // indirect
-	golang.org/x/mod v0.10.0 // indirect
-	golang.org/x/net v0.10.0 // indirect
-	golang.org/x/oauth2 v0.7.0 // indirect
-	golang.org/x/sync v0.2.0 // indirect
-	golang.org/x/sys v0.8.0 // indirect
-	golang.org/x/text v0.9.0 // indirect
-	golang.org/x/tools v0.9.3 // indirect
+	golang.org/x/exp/typeparams v0.0.0-20230307190834-24139beb5833 // indirect
+	golang.org/x/mod v0.13.0 // indirect
+	golang.org/x/net v0.17.0 // indirect
+	golang.org/x/oauth2 v0.11.0 // indirect
+	golang.org/x/sync v0.4.0 // indirect
+	golang.org/x/sys v0.13.0 // indirect
+	golang.org/x/term v0.13.0 // indirect
+	golang.org/x/text v0.13.0 // indirect
+	golang.org/x/tools v0.14.0 // indirect
 	golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 // indirect
-	google.golang.org/api v0.103.0 // indirect
+	google.golang.org/api v0.126.0 // indirect
 	google.golang.org/appengine v1.6.7 // indirect
-	google.golang.org/genproto v0.0.0-20230110181048-76db0878b65f // indirect
-	google.golang.org/grpc v1.54.0 // indirect
-	google.golang.org/protobuf v1.30.0 // indirect
+	google.golang.org/genproto v0.0.0-20230530153820-e85fd2cbaebc // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20230530153820-e85fd2cbaebc // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20230530153820-e85fd2cbaebc // indirect
+	google.golang.org/grpc v1.57.0 // indirect
+	google.golang.org/protobuf v1.31.0 // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	honnef.co/go/tools v0.4.3 // indirect
+	honnef.co/go/tools v0.4.6 // indirect
 	mvdan.cc/interfacer v0.0.0-20180901003855-c20040233aed // indirect
 	mvdan.cc/lint v0.0.0-20170908181259-adc824a0674b // indirect
 	mvdan.cc/unparam v0.0.0-20221223090309-7455f1af531d // indirect
diff --git a/.ci/tools/go.sum b/.ci/tools/go.sum
index bb829985c56..92dad60fff3 100644
--- a/.ci/tools/go.sum
+++ b/.ci/tools/go.sum
@@ -36,8 +36,8 @@ cloud.google.com/go v0.100.2/go.mod h1:4Xra9TjzAeYHrl5+oeLlzbM2k3mjVhZh4UqTZ//w9
 cloud.google.com/go v0.102.0/go.mod h1:oWcCzKlqJ5zgHQt9YsaeTY9KzIvjyy0ArmiBUgpQ+nc=
 cloud.google.com/go v0.102.1/go.mod h1:XZ77E9qnTEnrgEOvr4xzfdX5TRo7fB4T2F4O6+34hIU=
 cloud.google.com/go v0.104.0/go.mod h1:OO6xxXdJyvuJPcEPBLN9BJPD+jep5G1+2U5B5gkRYtA=
-cloud.google.com/go v0.107.0 h1:qkj22L7bgkl6vIeZDlOY2po43Mx/TIa2Wsa7VR+PEww=
-cloud.google.com/go v0.107.0/go.mod h1:wpc2eNrD7hXUTy8EKS10jkxpZBjASrORK7goS+3YX2I=
+cloud.google.com/go v0.110.2 h1:sdFPBr6xG9/wkBbfhmUz/JmZC7X6LavQgcrVINrKiVA=
+cloud.google.com/go v0.110.2/go.mod h1:k04UEeEtb6ZBRTv3dZz4CeJC3jKGxyhl0sAiVVquxiw=
 cloud.google.com/go/aiplatform v1.22.0/go.mod h1:ig5Nct50bZlzV6NvKaTwmplLLddFx0YReh9WfTO5jKw=
 cloud.google.com/go/aiplatform v1.24.0/go.mod h1:67UUvRBKG6GTayHKV8DBv2RtR1t93YRu5B1P3x99mYY=
 cloud.google.com/go/analytics v0.11.0/go.mod h1:DjEWCu41bVbYcKyvlws9Er60YE4a//bK6mnhWvQeFNI=
@@ -74,8 +74,9 @@ cloud.google.com/go/compute v1.6.0/go.mod h1:T29tfhtVbq1wvAPo0E3+7vhgmkOYeXjhFvz
 cloud.google.com/go/compute v1.6.1/go.mod h1:g85FgpzFvNULZ+S8AYq87axRKuf2Kh7deLqV/jJ3thU=
 cloud.google.com/go/compute v1.7.0/go.mod h1:435lt8av5oL9P3fv1OEzSbSUe+ybHXGMPQHHZWZxy9U=
 cloud.google.com/go/compute v1.10.0/go.mod h1:ER5CLbMxl90o2jtNbGSbtfOpQKR0t15FOtRsugnLrlU=
-cloud.google.com/go/compute v1.15.1 h1:7UGq3QknM33pw5xATlpzeoomNxsacIVvTqTTvbfajmE=
-cloud.google.com/go/compute v1.15.1/go.mod h1:bjjoF/NtFUrkD/urWfdHaKuOPDR5nWIs63rR+SXhcpA=
+cloud.google.com/go/compute v1.20.1 h1:6aKEtlUiwEpJzM001l0yFkpXmUVXaN8W+fbkb2AZNbg=
+cloud.google.com/go/compute v1.20.1/go.mod h1:4tCnrn48xsqlwSAiLf1HXMQk8CONslYbdiEZc9FEIbM=
+cloud.google.com/go/compute/metadata v0.2.0/go.mod h1:zFmK7XCadkQkj6TtorcaGlCW1hT1fIilQDwofLpJ20k=
 cloud.google.com/go/compute/metadata v0.2.3 h1:mg4jlk7mCAj6xXp9UJ4fjI9VUI5rubuGBW5aJ7UnBMY=
 cloud.google.com/go/compute/metadata v0.2.3/go.mod h1:VAV5nSsACxMJvgaAuX6Pk2AawlZn8kiOGuCv6gTkwuA=
 cloud.google.com/go/containeranalysis v0.5.1/go.mod h1:1D92jd8gRR/c0fGMlymRgxWD3Qw9C1ff6/T7mLgVL8I=
@@ -115,13 +116,12 @@ cloud.google.com/go/gkehub v0.10.0/go.mod h1:UIPwxI0DsrpsVoWpLB0stwKCP+WFVG9+y97
 cloud.google.com/go/grafeas v0.2.0/go.mod h1:KhxgtF2hb0P191HlY5besjYm6MqTSTj3LSI+M+ByZHc=
 cloud.google.com/go/iam v0.3.0/go.mod h1:XzJPvDayI+9zsASAFO68Hk07u3z+f+JrT2xXNdp4bnY=
 cloud.google.com/go/iam v0.5.0/go.mod h1:wPU9Vt0P4UmCux7mqtRu6jcpPAb74cP1fh50J3QpkUc=
-cloud.google.com/go/iam v0.8.0 h1:E2osAkZzxI/+8pZcxVLcDtAQx/u+hZXVryUaYQ5O0Kk=
-cloud.google.com/go/iam v0.8.0/go.mod h1:lga0/y3iH6CX7sYqypWJ33hf7kkfXJag67naqGESjkE=
+cloud.google.com/go/iam v0.13.0 h1:+CmB+K0J/33d0zSQ9SlFWUeCCEn5XJA0ZMZ3pHE9u8k=
+cloud.google.com/go/iam v0.13.0/go.mod h1:ljOg+rcNfzZ5d6f1nAUJ8ZIxOaZUVoS14bKCtaLZ/D0=
 cloud.google.com/go/language v1.4.0/go.mod h1:F9dRpNFQmJbkaop6g0JhSBXCNlO90e1KWx5iDdxbWic=
 cloud.google.com/go/language v1.6.0/go.mod h1:6dJ8t3B+lUYfStgls25GusK04NLh3eDLQnWM3mdEbhI=
 cloud.google.com/go/lifesciences v0.5.0/go.mod h1:3oIKy8ycWGPUyZDR/8RNnTOYevhaMLqh5vLUXs9zvT8=
 cloud.google.com/go/lifesciences v0.6.0/go.mod h1:ddj6tSX/7BOnhxCSd3ZcETvtNr8NZ6t/iPhY2Tyfu08=
-cloud.google.com/go/longrunning v0.3.0 h1:NjljC+FYPV3uh5/OwWT6pVU+doBqMg2x/rZlE+CamDs=
 cloud.google.com/go/mediatranslation v0.5.0/go.mod h1:jGPUhGTybqsPQn91pNXw0xVHfuJ3leR1wj37oU3y1f4=
 cloud.google.com/go/mediatranslation v0.6.0/go.mod h1:hHdBCTYNigsBxshbznuIMFNe5QXEowAuNmmC7h8pu5w=
 cloud.google.com/go/memcache v1.4.0/go.mod h1:rTOfiGZtJX1AaFUrOgsMHX5kAzaTQ8azHiuDoTPzNsE=
@@ -178,8 +178,9 @@ cloud.google.com/go/storage v1.10.0/go.mod h1:FLPqc6j+Ki4BU591ie1oL6qBQGu2Bl/tZ9
 cloud.google.com/go/storage v1.14.0/go.mod h1:GrKmX003DSIwi9o29oFT7YDnHYwZoctc3fOKtUw0Xmo=
 cloud.google.com/go/storage v1.22.1/go.mod h1:S8N1cAStu7BOeFfE8KAQzmyyLkK8p/vmRq6kuBTW58Y=
 cloud.google.com/go/storage v1.23.0/go.mod h1:vOEEDNFnciUMhBeT6hsJIn3ieU5cFRmzeLgDvXzfIXc=
-cloud.google.com/go/storage v1.27.0 h1:YOO045NZI9RKfCj1c5A/ZtuuENUc8OAW+gHdGnDgyMQ=
 cloud.google.com/go/storage v1.27.0/go.mod h1:x9DOL8TK/ygDUMieqwfhdpQryTeEkhGKMi80i/iqR2s=
+cloud.google.com/go/storage v1.29.0 h1:6weCgzRvMg7lzuUurI4697AqIRPU1SvzHhynwpW31jI=
+cloud.google.com/go/storage v1.29.0/go.mod h1:4puEjyTKnku6gfKoTfNOU/W+a9JyuVNxjpS5GBrB8h4=
 cloud.google.com/go/talent v1.1.0/go.mod h1:Vl4pt9jiHKvOgF9KoZo6Kob9oV4lwd/ZD5Cto54zDRw=
 cloud.google.com/go/talent v1.2.0/go.mod h1:MoNF9bhFQbiJ6eFD3uSsg0uBALw4n4gaCaEjBw9zo8g=
 cloud.google.com/go/videointelligence v1.6.0/go.mod h1:w0DIDlVRKtwPCn/C4iwZIJdvC69yInhW0cfi+p546uU=
@@ -192,44 +193,58 @@ cloud.google.com/go/webrisk v1.5.0/go.mod h1:iPG6fr52Tv7sGk0H6qUFzmL3HHZev1htXuW
 cloud.google.com/go/workflows v1.6.0/go.mod h1:6t9F5h/unJz41YqfBmqSASJSXccBLtD1Vwf+KmJENM0=
 cloud.google.com/go/workflows v1.7.0/go.mod h1:JhSrZuVZWuiDfKEFxU0/F1PQjmpnpcoISEXH2bcHC3M=
 dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU=
-github.com/4meepo/tagalign v1.2.2 h1:kQeUTkFTaBRtd/7jm8OKJl9iHk0gAO+TDFPHGSna0aw=
-github.com/4meepo/tagalign v1.2.2/go.mod h1:Q9c1rYMZJc9dPRkbQPpcBNCLEmY2njbAsXhQOZFE2dE=
-github.com/Abirdcfly/dupword v0.0.11 h1:z6v8rMETchZXUIuHxYNmlUAuKuB21PeaSymTed16wgU=
-github.com/Abirdcfly/dupword v0.0.11/go.mod h1:wH8mVGuf3CP5fsBTkfWwwwKTjDnVVCxtU8d8rgeVYXA=
-github.com/Antonboom/errname v0.1.10 h1:RZ7cYo/GuZqjr1nuJLNe8ZH+a+Jd9DaZzttWzak9Bls=
-github.com/Antonboom/errname v0.1.10/go.mod h1:xLeiCIrvVNpUtsN0wxAh05bNIZpqE22/qDMnTBTttiA=
-github.com/Antonboom/nilnil v0.1.5 h1:X2JAdEVcbPaOom2TUa1FxZ3uyuUlex0XMLGYMemu6l0=
-github.com/Antonboom/nilnil v0.1.5/go.mod h1:I24toVuBKhfP5teihGWctrRiPbRKHwZIFOvc6v3HZXk=
+github.com/4meepo/tagalign v1.3.3 h1:ZsOxcwGD/jP4U/aw7qeWu58i7dwYemfy5Y+IF1ACoNw=
+github.com/4meepo/tagalign v1.3.3/go.mod h1:Q9c1rYMZJc9dPRkbQPpcBNCLEmY2njbAsXhQOZFE2dE=
+github.com/Abirdcfly/dupword v0.0.13 h1:SMS17YXypwP000fA7Lr+kfyBQyW14tTT+nRv9ASwUUo=
+github.com/Abirdcfly/dupword v0.0.13/go.mod h1:Ut6Ue2KgF/kCOawpW4LnExT+xZLQviJPE4klBPMK/5Y=
+github.com/AlecAivazis/survey/v2 v2.3.6 h1:NvTuVHISgTHEHeBFqt6BHOe4Ny/NwGZr7w+F8S9ziyw=
+github.com/AlecAivazis/survey/v2 v2.3.6/go.mod h1:4AuI9b7RjAR+G7v9+C4YSlX/YL3K3cWNXgWXOhllqvI=
+github.com/Antonboom/errname v0.1.12 h1:oh9ak2zUtsLp5oaEd/erjB4GPu9w19NyoIskZClDcQY=
+github.com/Antonboom/errname v0.1.12/go.mod h1:bK7todrzvlaZoQagP1orKzWXv59X/x0W0Io2XT1Ssro=
+github.com/Antonboom/nilnil v0.1.7 h1:ofgL+BA7vlA1K2wNQOsHzLJ2Pw5B5DpWRLdDAVvvTow=
+github.com/Antonboom/nilnil v0.1.7/go.mod h1:TP+ScQWVEq0eSIxqU8CbdT5DFWoHp0MbP+KMUO1BKYQ=
+github.com/Antonboom/testifylint v0.2.3 h1:MFq9zyL+rIVpsvLX4vDPLojgN7qODzWsrnftNX2Qh60=
+github.com/Antonboom/testifylint v0.2.3/go.mod h1:IYaXaOX9NbfAyO+Y04nfjGI8wDemC1rUyM/cYolz018=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
 github.com/BurntSushi/toml v1.3.2 h1:o7IhLm0Msx3BaB+n3Ag7L8EVlByGnpq14C4YWiu/gL8=
 github.com/BurntSushi/toml v1.3.2/go.mod h1:CxXYINrC8qIiEnFrOxCa7Jy5BFHlXnUU2pbicEuybxQ=
 github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
 github.com/Djarvur/go-err113 v0.0.0-20210108212216-aea10b59be24 h1:sHglBQTwgx+rWPdisA5ynNEsoARbiCBOyGcJM4/OzsM=
 github.com/Djarvur/go-err113 v0.0.0-20210108212216-aea10b59be24/go.mod h1:4UJr5HIiMZrwgkSPdsjy2uOQExX/WEILpIrO9UPGuXs=
-github.com/GaijinEntertainment/go-exhaustruct/v2 v2.3.0 h1:+r1rSv4gvYn0wmRjC8X7IAzX8QezqtFV9m0MUHFJgts=
-github.com/GaijinEntertainment/go-exhaustruct/v2 v2.3.0/go.mod h1:b3g59n2Y+T5xmcxJL+UEG2f8cQploZm1mR/v6BW0mU0=
+github.com/GaijinEntertainment/go-exhaustruct/v3 v3.1.0 h1:3ZBs7LAezy8gh0uECsA6CGU43FF3zsx5f4eah5FxTMA=
+github.com/GaijinEntertainment/go-exhaustruct/v3 v3.1.0/go.mod h1:rZLTje5A9kFBe0pzhpe2TdhRniBF++PRHQuRpR8esVc=
+github.com/MakeNowJust/heredoc v1.0.0 h1:cXCdzVdstXyiTqTvfqk9SDHpKNjxuom+DOlyEeQ4pzQ=
 github.com/Masterminds/goutils v1.1.1 h1:5nUrii3FMTL5diU80unEVvNevw1nH4+ZV4DSLVJLSYI=
 github.com/Masterminds/goutils v1.1.1/go.mod h1:8cTjp+g8YejhMuvIA5y2vz3BpJxksy863GQaJW2MFNU=
 github.com/Masterminds/semver v1.5.0 h1:H65muMkzWKEuNDnfl9d70GUjFniHKHRbFPGBuZ3QEww=
 github.com/Masterminds/semver v1.5.0/go.mod h1:MB6lktGJrhw8PrUyiEoblNEGEQ+RzHPF078ddwwvV3Y=
 github.com/Masterminds/semver/v3 v3.1.1/go.mod h1:VPu/7SZ7ePZ3QOrcuXROw5FAcLl4a0cBrbBpGY/8hQs=
-github.com/Masterminds/semver/v3 v3.2.0 h1:3MEsd0SM6jqZojhjLWWeBY+Kcjy9i6MQAeY7YgDP83g=
-github.com/Masterminds/semver/v3 v3.2.0/go.mod h1:qvl/7zhW3nngYb5+80sSMF+FG2BjYrf8m9wsX0PNOMQ=
+github.com/Masterminds/semver/v3 v3.2.1 h1:RN9w6+7QoMeJVGyfmbcgs28Br8cvmnucEXnY0rYXWg0=
+github.com/Masterminds/semver/v3 v3.2.1/go.mod h1:qvl/7zhW3nngYb5+80sSMF+FG2BjYrf8m9wsX0PNOMQ=
 github.com/Masterminds/sprig/v3 v3.2.1 h1:n6EPaDyLSvCEa3frruQvAiHuNp2dhBlMSmkEr+HuzGc=
 github.com/Masterminds/sprig/v3 v3.2.1/go.mod h1:UoaO7Yp8KlPnJIYWTFkMaqPUYKTfGFPhxNuwnnxkKlk=
 github.com/Microsoft/go-winio v0.4.14/go.mod h1:qXqCSQ3Xa7+6tgxaGTIe4Kpcdsi+P8jBhyzoq1bpyYA=
 github.com/Microsoft/go-winio v0.4.16 h1:FtSW/jqD+l4ba5iPBj9CODVtgfYAD8w2wS923g/cFDk=
 github.com/Microsoft/go-winio v0.4.16/go.mod h1:XB6nPKklQyQ7GC9LdcBEcBl8PF76WugXOPRXwdLnMv0=
+github.com/Netflix/go-expect v0.0.0-20220104043353-73e0943537d2 h1:+vx7roKuyA63nhn5WAunQHLTznkw5W8b1Xc0dNjp83s=
+github.com/Netflix/go-expect v0.0.0-20220104043353-73e0943537d2/go.mod h1:HBCaDeC1lPdgDeDbhX8XFpy1jqjK0IBG8W5K+xYqA0w=
 github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU=
 github.com/OpenPeeDeeP/depguard/v2 v2.1.0 h1:aQl70G173h/GZYhWf36aE5H0KaujXfVMnn/f1kSDVYY=
 github.com/OpenPeeDeeP/depguard/v2 v2.1.0/go.mod h1:PUBgk35fX4i7JDmwzlJwJ+GMe6NfO1723wmJMgPThNQ=
-github.com/ProtonMail/go-crypto v0.0.0-20210428141323-04723f9f07d7 h1:YoJbenK9C67SkzkDfmQuVln04ygHj3vjZfd9FL+GmQQ=
 github.com/ProtonMail/go-crypto v0.0.0-20210428141323-04723f9f07d7/go.mod h1:z4/9nQmJSSwwds7ejkxaJwO37dru3geImFUdJlaLzQo=
+github.com/ProtonMail/go-crypto v0.0.0-20230217124315-7d5c6f04bbb8 h1:wPbRQzjjwFc0ih8puEVAOFGELsn1zoIIYdxvML7mDxA=
+github.com/ProtonMail/go-crypto v0.0.0-20230217124315-7d5c6f04bbb8/go.mod h1:I0gYDMZ6Z5GRU7l58bNFSkPTFN6Yl12dsUlAZ8xy98g=
+github.com/YakDriver/tfproviderdocs v0.11.0 h1:IIdqZ/7ZpZ8V8EK33b8APQuVWqdgSV2HbAWxttljEKw=
+github.com/YakDriver/tfproviderdocs v0.11.0/go.mod h1:cmvxw7mRCeXngkZzN5rgygQqujN0irc5OJOCPfOJ9cQ=
 github.com/acomagu/bufpipe v1.0.3 h1:fxAGrHZTgQ9w5QqVItgzwj235/uYZYgbXitB+dLupOk=
 github.com/acomagu/bufpipe v1.0.3/go.mod h1:mxdxdup/WdsKVreO5GpW4+M/1CE2sMG4jeGJ2sYmHc4=
 github.com/agext/levenshtein v1.2.3 h1:YB2fHEn0UJagG8T1rrWknE3ZQzWM06O8AMAatNn7lmo=
 github.com/agext/levenshtein v1.2.3/go.mod h1:JEDfjyjHDjOF/1e4FlBE/PkbqA9OfWu2ki2W0IB5558=
 github.com/alcortesm/tgz v0.0.0-20161220082320-9c5fe88206d7/go.mod h1:6zEj6s6u/ghQa61ZWa/C2Aw3RkjiTBOix7dkqa1VLIs=
+github.com/alecthomas/assert/v2 v2.2.2 h1:Z/iVC0xZfWTaFNE6bA3z07T86hd45Xe2eLt6WVy2bbk=
+github.com/alecthomas/go-check-sumtype v0.1.3 h1:M+tqMxB68hcgccRXBMVCPI4UJ+QUfdSx0xdbypKCqA8=
+github.com/alecthomas/go-check-sumtype v0.1.3/go.mod h1:WyYPfhfkdhyrdaligV6svFopZV8Lqdzn5pyVBaV6jhQ=
+github.com/alecthomas/repr v0.2.0 h1:HAzS41CIzNW5syS8Mf9UwXhNH1J9aix/BvDRf1Ml2Yk=
 github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
 github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
 github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
@@ -247,27 +262,40 @@ github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kd
 github.com/apparentlymart/go-cidr v1.1.0 h1:2mAhrMoF+nhXqxTzSZMUzDHkLjmIHC+Zzn4tdgBZjnU=
 github.com/apparentlymart/go-cidr v1.1.0/go.mod h1:EBcsNrHc3zQeuaeCeCtQruQm+n9/YjEn/vI25Lg7Gwc=
 github.com/apparentlymart/go-dump v0.0.0-20180507223929-23540a00eaa3 h1:ZSTrOEhiM5J5RFxEaFvMZVEAM1KvT1YzbEOwB2EAGjA=
-github.com/apparentlymart/go-textseg v1.0.0/go.mod h1:z96Txxhf3xSFMPmb5X/1W05FF/Nj9VFpLOpjS5yuumk=
 github.com/apparentlymart/go-textseg/v13 v13.0.0 h1:Y+KvPE1NYz0xl601PVImeQfFyEy6iT90AvPUL1NNfNw=
 github.com/apparentlymart/go-textseg/v13 v13.0.0/go.mod h1:ZK2fH7c4NqDTLtiYLvIkEghdlcqw7yxLeM89kiTRPUo=
+github.com/apparentlymart/go-textseg/v15 v15.0.0 h1:uYvfpb3DyLSCGWnctWKGj857c6ew1u1fNQOlOtuGxQY=
+github.com/apparentlymart/go-textseg/v15 v15.0.0/go.mod h1:K8XmNZdhEBkdlyDdvbmmsvpAG721bKi0joRfFdHIWJ4=
+github.com/armon/circbuf v0.0.0-20150827004946-bbbad097214e/go.mod h1:3U/XgcO3hCbHZ8TKRvWD2dDTCfh9M9ya+I9JpbB7O8o=
+github.com/armon/go-metrics v0.0.0-20180917152333-f0300d1749da/go.mod h1:Q73ZrmVTwzkszR9V5SSuryQ31EELlFMUz1kKyl939pY=
 github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
 github.com/armon/go-radix v1.0.0 h1:F4z6KzEeeQIMeLFa97iZU6vupzoecKdU5TX24SNppXI=
 github.com/armon/go-radix v1.0.0/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio=
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs=
-github.com/ashanbrown/forbidigo v1.5.3 h1:jfg+fkm/snMx+V9FBwsl1d340BV/99kZGv5jN9hBoXk=
-github.com/ashanbrown/forbidigo v1.5.3/go.mod h1:Y8j9jy9ZYAEHXdu723cUlraTqbzjKF1MUyfOKL+AjcU=
+github.com/asaskevich/govalidator v0.0.0-20200907205600-7a23bdc65eef h1:46PFijGLmAjMPwCCCo7Jf0W6f9slllCkkv7vyc1yOSg=
+github.com/asaskevich/govalidator v0.0.0-20200907205600-7a23bdc65eef/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw=
+github.com/ashanbrown/forbidigo v1.6.0 h1:D3aewfM37Yb3pxHujIPSpTf6oQk9sc9WZi8gerOIVIY=
+github.com/ashanbrown/forbidigo v1.6.0/go.mod h1:Y8j9jy9ZYAEHXdu723cUlraTqbzjKF1MUyfOKL+AjcU=
 github.com/ashanbrown/makezero v1.1.1 h1:iCQ87C0V0vSyO+M9E/FZYbu65auqH0lnsOkf5FcB28s=
 github.com/ashanbrown/makezero v1.1.1/go.mod h1:i1bJLCRSCHOcOa9Y6MyF2FTfMZMFdHvxKHxgO5Z1axI=
 github.com/aws/aws-sdk-go v1.44.122 h1:p6mw01WBaNpbdP2xrisz5tIkcNwzj/HysobNoaAHjgo=
 github.com/aws/aws-sdk-go v1.44.122/go.mod h1:y4AeaBuwd2Lk+GepC1E9v0qOiTws0MIWAX4oIKwKHZo=
+github.com/aws/aws-sdk-go-v2 v1.9.2/go.mod h1:cK/D0BBs0b/oWPIcX/Z/obahJK1TT7IPVjy53i/mX/4=
+github.com/aws/aws-sdk-go-v2/config v1.8.3/go.mod h1:4AEiLtAb8kLs7vgw2ZV3p2VZ1+hBavOc84hqxVNpCyw=
+github.com/aws/aws-sdk-go-v2/credentials v1.4.3/go.mod h1:FNNC6nQZQUuyhq5aE5c7ata8o9e4ECGmS4lAXC7o1mQ=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.6.0/go.mod h1:gqlclDEZp4aqJOancXK6TN24aKhT0W0Ae9MHk3wzTMM=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.2.4/go.mod h1:ZcBrrI3zBKlhGFNYWvju0I3TR93I7YIgAfy82Fh4lcQ=
+github.com/aws/aws-sdk-go-v2/service/appconfig v1.4.2/go.mod h1:FZ3HkCe+b10uFZZkFdvf98LHW21k49W8o8J366lqVKY=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.3.2/go.mod h1:72HRZDLMtmVQiLG2tLfQcaWLCssELvGl+Zf2WVxMmR8=
+github.com/aws/aws-sdk-go-v2/service/sso v1.4.2/go.mod h1:NBvT9R1MEF+Ud6ApJKM0G+IkPchKS7p7c2YPKwHmBOk=
+github.com/aws/aws-sdk-go-v2/service/sts v1.7.2/go.mod h1:8EzeIqfWt2wWT4rJVu3f21TfrhJ8AEMzVybRNSb/b4g=
+github.com/aws/smithy-go v1.8.0/go.mod h1:SObp3lf9smib00L/v3U2eAKG8FyQ7iLrJnQiAmR5n+E=
 github.com/benbjohnson/clock v1.1.0 h1:Q92kusRqC1XV2MjkWETPvjJVqKetz1OzxZB7mHJLju8=
 github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
 github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+CedLV8=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
-github.com/bflad/tfproviderdocs v0.11.0 h1:Ckoplhi2vBiSOsmB7P+qiaWhMnr388bbNdg4HN+jDJk=
-github.com/bflad/tfproviderdocs v0.11.0/go.mod h1:RhPZXM7mBDiZCAquDReEeHy5aEdH938rZHpkrz9Qoac=
 github.com/bgentry/go-netrc v0.0.0-20140422174119-9fd32a8b3d3d h1:xDfNPAt8lFiC1UJrqV3uuy861HCTo708pDMbjHHdCas=
 github.com/bgentry/go-netrc v0.0.0-20140422174119-9fd32a8b3d3d/go.mod h1:6QX/PXZ00z/TKoufEY6K/a0k6AhaJrQKdFe6OfVXsa4=
 github.com/bgentry/speakeasy v0.1.0 h1:ByYyxL9InA1OWqxJqqp2A5pYHUrCiAL6K3J+LKSsQkY=
@@ -278,18 +306,28 @@ github.com/blizzy78/varnamelen v0.8.0 h1:oqSblyuQvFsW1hbBHh1zfwrKe3kcSj0rnXkKzsQ
 github.com/blizzy78/varnamelen v0.8.0/go.mod h1:V9TzQZ4fLJ1DSrjVDfl89H7aMnTvKkApdHeyESmyR7k=
 github.com/bmatcuk/doublestar v1.3.4 h1:gPypJ5xD31uhX6Tf54sDPUOBXTqKH4c9aPY66CyQrS0=
 github.com/bmatcuk/doublestar v1.3.4/go.mod h1:wiQtGV+rzVYxB7WIlirSN++5HPtPlXEo9MEoZQC/PmE=
+github.com/bmatcuk/doublestar/v4 v4.6.0 h1:HTuxyug8GyFbRkrffIpzNCSK4luc0TY3wzXvzIZhEXc=
+github.com/bmatcuk/doublestar/v4 v4.6.0/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc=
 github.com/bombsimon/wsl/v3 v3.4.0 h1:RkSxjT3tmlptwfgEgTgU+KYKLI35p/tviNXNXiL2aNU=
 github.com/bombsimon/wsl/v3 v3.4.0/go.mod h1:KkIB+TXkqy6MvK9BDZVbZxKNYsE1/oLRJbIFtf14qqo=
+github.com/bradleyfalzon/ghinstallation/v2 v2.5.0 h1:yaYcGQ7yEIGbsJfW/9z7v1sLiZg/5rSNNXwmMct5XaE=
+github.com/bradleyfalzon/ghinstallation/v2 v2.5.0/go.mod h1:amcvPQMrRkWNdueWOjPytGL25xQGzox7425qMgzo+Vo=
 github.com/breathingdust/go-changelog v0.0.0-20210127001721-f985d5709c15 h1:OUv8PSGE8S6CPWWKc+2T7tyLwcKKERcvWn19O4KiUu4=
 github.com/breathingdust/go-changelog v0.0.0-20210127001721-f985d5709c15/go.mod h1:3cN0yNLxr97LobXDDmNQBh8tgBssK7ftuGC5y1sc17M=
-github.com/breml/bidichk v0.2.4 h1:i3yedFWWQ7YzjdZJHnPo9d/xURinSq3OM+gyM43K4/8=
-github.com/breml/bidichk v0.2.4/go.mod h1:7Zk0kRFt1LIZxtQdl9W9JwGAcLTTkOs+tN7wuEYGJ3s=
-github.com/breml/errchkjson v0.3.1 h1:hlIeXuspTyt8Y/UmP5qy1JocGNR00KQHgfaNtRAjoxQ=
-github.com/breml/errchkjson v0.3.1/go.mod h1:XroxrzKjdiutFyW3nWhw34VGg7kiMsDQox73yWCGI2U=
-github.com/butuzov/ireturn v0.2.0 h1:kCHi+YzC150GE98WFuZQu9yrTn6GEydO2AuPLbTgnO4=
-github.com/butuzov/ireturn v0.2.0/go.mod h1:Wh6Zl3IMtTpaIKbmwzqi6olnM9ptYQxxVacMsOEFPoc=
+github.com/breml/bidichk v0.2.7 h1:dAkKQPLl/Qrk7hnP6P+E0xOodrq8Us7+U0o4UBOAlQY=
+github.com/breml/bidichk v0.2.7/go.mod h1:YodjipAGI9fGcYM7II6wFvGhdMYsC5pHDlGzqvEW3tQ=
+github.com/breml/errchkjson v0.3.6 h1:VLhVkqSBH96AvXEyclMR37rZslRrY2kcyq+31HCsVrA=
+github.com/breml/errchkjson v0.3.6/go.mod h1:jhSDoFheAF2RSDOlCfhHO9KqhZgAYLyvHe7bRCX8f/U=
+github.com/butuzov/ireturn v0.2.1 h1:w5Ks4tnfeFDZskGJ2x1GAkx5gaQV+kdU3NKNr3NEBzY=
+github.com/butuzov/ireturn v0.2.1/go.mod h1:RfGHUvvAuFFxoHKf4Z8Yxuh6OjlCw1KvR2zM1NFHeBk=
 github.com/butuzov/mirror v1.1.0 h1:ZqX54gBVMXu78QLoiqdwpl2mgmoOJTk7s4p4o+0avZI=
 github.com/butuzov/mirror v1.1.0/go.mod h1:8Q0BdQU6rC6WILDiBM60DBfvV78OLJmMmixe7GF45AE=
+github.com/bwesterb/go-ristretto v1.2.0/go.mod h1:fUIoIZaG73pV5biE2Blr2xEzDoMj7NFEuV9ekS419A0=
+github.com/bwesterb/go-ristretto v1.2.3/go.mod h1:fUIoIZaG73pV5biE2Blr2xEzDoMj7NFEuV9ekS419A0=
+github.com/catenacyber/perfsprint v0.2.0 h1:azOocHLscPjqXVJ7Mf14Zjlkn4uNua0+Hcg1wTR6vUo=
+github.com/catenacyber/perfsprint v0.2.0/go.mod h1:/wclWYompEyjUD2FuIIDVKNkqz7IgBIWXIH3V0Zol50=
+github.com/ccojocar/zxcvbn-go v1.0.1 h1:+sxrANSCj6CdadkcMnvde/GWU1vZiiXRbqYSCalV4/4=
+github.com/ccojocar/zxcvbn-go v1.0.1/go.mod h1:g1qkXtUSvHP8lhHp5GrSmTz6uWALGRMQdw6Qnz/hi60=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
 github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
 github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
@@ -298,14 +336,23 @@ github.com/cespare/xxhash/v2 v2.2.0 h1:DC2CZ1Ep5Y4k3ZQ899DldepgrayRUGE6BBZ/cd9Cj
 github.com/cespare/xxhash/v2 v2.2.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/charithe/durationcheck v0.0.10 h1:wgw73BiocdBDQPik+zcEoBG/ob8uyBHf2iyoHGPf5w4=
 github.com/charithe/durationcheck v0.0.10/go.mod h1:bCWXb7gYRysD1CU3C+u4ceO49LoGOY1C1L6uouGNreQ=
-github.com/chavacava/garif v0.0.0-20230227094218-b8c73b2037b8 h1:W9o46d2kbNL06lq7UNDPV0zYLzkrde/bjIqO02eoll0=
-github.com/chavacava/garif v0.0.0-20230227094218-b8c73b2037b8/go.mod h1:gakxgyXaaPkxvLw1XQxNGK4I37ys9iBRzNUx/B7pUCo=
+github.com/chavacava/garif v0.1.0 h1:2JHa3hbYf5D9dsgseMKAmc/MZ109otzgNFk5s87H9Pc=
+github.com/chavacava/garif v0.1.0/go.mod h1:XMyYCkEL58DF0oyW4qDjjnPWONs2HBqYKI+UIPD+Gww=
 github.com/cheggaaa/pb v1.0.27/go.mod h1:pQciLPpbU0oxA0h+VJYYLxO+XeDQb5pZijXscXHm81s=
 github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
 github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
 github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
+github.com/cli/go-gh v1.2.1 h1:xFrjejSsgPiwXFP6VYynKWwxLQcNJy3Twbu82ZDlR/o=
+github.com/cli/go-gh v1.2.1/go.mod h1:Jxk8X+TCO4Ui/GarwY9tByWm/8zp4jJktzVZNlTW5VM=
+github.com/cli/safeexec v1.0.0 h1:0VngyaIyqACHdcMNWfo6+KdUYnqEr2Sg+bSP1pdF+dI=
+github.com/cli/safeexec v1.0.0/go.mod h1:Z/D4tTN8Vs5gXYHDCbaM1S/anmEDnJb1iW0+EJ5zx3Q=
+github.com/cli/shurcooL-graphql v0.0.2 h1:rwP5/qQQ2fM0TzkUTwtt6E2LbIYf6R+39cUXTa04NYk=
+github.com/cli/shurcooL-graphql v0.0.2/go.mod h1:tlrLmw/n5Q/+4qSvosT+9/W5zc8ZMjnJeYBxSdb4nWA=
 github.com/client9/misspell v0.3.4 h1:ta993UF76GwbvJcIo3Y68y/M3WxlpEHPWIGDkJYwzJI=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
+github.com/cloudflare/circl v1.1.0/go.mod h1:prBCrKB9DV4poKZY1l9zBXg2QJY7mvgRvtMxxK7fi4I=
+github.com/cloudflare/circl v1.3.3 h1:fE/Qz0QdIGqeWfnwq0RE0R7MI51s0M2E4Ga9kq5AEMs=
+github.com/cloudflare/circl v1.3.3/go.mod h1:5XYMA4rFBvNIrhs50XuiBJ15vF2pZn4nnUKZrLbUZFA=
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
 github.com/cncf/udpa/go v0.0.0-20200629203442-efcf912fb354/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
 github.com/cncf/udpa/go v0.0.0-20201120205902-5459f2c99403/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
@@ -315,17 +362,22 @@ github.com/cncf/xds/go v0.0.0-20210805033703-aa0b78936158/go.mod h1:eXthEFrGJvWH
 github.com/cncf/xds/go v0.0.0-20210922020428-25de7278fc84/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/cncf/xds/go v0.0.0-20211001041855-01bcc9b48dfe/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/cncf/xds/go v0.0.0-20211011173535-cb28da3451f1/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
+github.com/coreos/go-semver v0.3.0/go.mod h1:nnelYz7RCh+5ahJtPPxZlU+153eP4D4r3EedlOD2RNk=
+github.com/coreos/go-systemd/v22 v22.3.2/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
 github.com/cpuguy83/go-md2man/v2 v2.0.2/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
+github.com/creack/pty v1.1.17 h1:QeVUsEDNrLBW4tMgZHvxy18sKtr6VI492kBhUfhDJNI=
+github.com/creack/pty v1.1.17/go.mod h1:MOBLtS5ELjhRRrroQr9kyvTxUAFNvYEK993ew/Vr4O4=
 github.com/curioswitch/go-reassign v0.2.0 h1:G9UZyOcpk/d7Gd6mqYgd8XYWFMw/znxwGDUstnC9DIo=
 github.com/curioswitch/go-reassign v0.2.0/go.mod h1:x6OpXuWvgfQaMGks2BZybTngWjT84hqJfKoO8Tt/Roc=
-github.com/daixiang0/gci v0.10.1 h1:eheNA3ljF6SxnPD/vE4lCBusVHmV3Rs3dkKvFrJ7MR0=
-github.com/daixiang0/gci v0.10.1/go.mod h1:xtHP9N7AHdNvtRNfcx9gwTDfw7FRJx4bZUsiEfiNNAI=
+github.com/daixiang0/gci v0.11.2 h1:Oji+oPsp3bQ6bNNgX30NBAVT18P4uBH4sRZnlOlTj7Y=
+github.com/daixiang0/gci v0.11.2/go.mod h1:xtHP9N7AHdNvtRNfcx9gwTDfw7FRJx4bZUsiEfiNNAI=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/denis-tingaikin/go-header v0.4.3 h1:tEaZKAlqql6SKCY++utLmkPLd6K8IBM20Ha7UVm+mtU=
 github.com/denis-tingaikin/go-header v0.4.3/go.mod h1:0wOCWuN71D5qIgE2nz9KrKmuYBAC2Mra5RassOIQ2/c=
+github.com/dustin/go-humanize v1.0.0/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk=
 github.com/emirpasic/gods v1.12.0 h1:QAUIPSaCu4G+POclxeqb3F+WPpdKqFGlw36+yOzGlrg=
 github.com/emirpasic/gods v1.12.0/go.mod h1:YfzfFFoVP/catgzJb4IKIqXjX78Ha8FMSDh3ymbK86o=
 github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
@@ -343,24 +395,29 @@ github.com/esimonov/ifshort v1.0.4/go.mod h1:Pe8zjlRrJ80+q2CxHLfEOfTwxCZ4O+MuhcH
 github.com/ettle/strcase v0.1.1 h1:htFueZyVeE1XNnMEfbqp5r67qAN/4r6ya1ysq8Q+Zcw=
 github.com/ettle/strcase v0.1.1/go.mod h1:hzDLsPC7/lwKyBOywSHEP89nt2pDgdy+No1NBA9o9VY=
 github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
+github.com/fatih/color v1.9.0/go.mod h1:eQcE1qtQxscV5RaZvpXrrb8Drkc3/DdQ+uUYCNjL+zU=
 github.com/fatih/color v1.13.0/go.mod h1:kLAiJbzzSOZDVNGyDpeOxJ47H46qBXwg5ILebYFFOfk=
 github.com/fatih/color v1.15.0 h1:kOqh6YHBtK8aywxGerMG2Eq3H6Qgoqeo13Bk2Mv/nBs=
 github.com/fatih/color v1.15.0/go.mod h1:0h5ZqXfHYED7Bhv2ZJamyIOUej9KtShiJESRwBDUSsw=
+github.com/fatih/structs v1.1.0/go.mod h1:9NiDSp5zOcgEDl+j00MP/WkGVPOlPRLejGD8Ga6PJ7M=
 github.com/fatih/structtag v1.2.0 h1:/OdNE99OxoI/PqaW/SuSK9uxxT3f/tcSZgon/ssNSx4=
 github.com/fatih/structtag v1.2.0/go.mod h1:mBJUNpUnHmRKrKlQQlmCrh5PuhftFbNv8Ys4/aAZl94=
 github.com/firefart/nonamedreturns v1.0.4 h1:abzI1p7mAEPYuR4A+VLKn4eNDOycjYo2phmY9sfv40Y=
 github.com/firefart/nonamedreturns v1.0.4/go.mod h1:TDhe/tjI1BXo48CmYbUduTV7BdIga8MAO/xbKdcVsGI=
 github.com/flynn/go-shlex v0.0.0-20150515145356-3f9db97f8568/go.mod h1:xEzjJPgXI435gkrCt3MPfRiAkVrwSbHsst4LCFVfpJc=
 github.com/frankban/quicktest v1.14.4 h1:g2rn0vABPOOXmZUj+vbmUp0lPoXEMuhTpIluN0XL9UY=
+github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ=
 github.com/fsnotify/fsnotify v1.5.4 h1:jRbGcIw6P2Meqdwuo0H1p6JVLbL5DHKAKlYndzMwVZI=
 github.com/fsnotify/fsnotify v1.5.4/go.mod h1:OVB6XrOHzAwXMpEM7uPOzcehqUV2UqJxmVXmkdnm1bU=
 github.com/fzipp/gocyclo v0.6.0 h1:lsblElZG7d3ALtGMx9fmxeTKZaLLpU8mET09yN4BBLo=
 github.com/fzipp/gocyclo v0.6.0/go.mod h1:rXPyn8fnlpa0R2csP/31uerbiVBugk5whMdlyaLkLoA=
 github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
+github.com/ghostiam/protogetter v0.2.3 h1:qdv2pzo3BpLqezwqfGDLZ+nHEYmc5bUpIdsMbBVwMjw=
+github.com/ghostiam/protogetter v0.2.3/go.mod h1:KmNLOsy1v04hKbvZs8EfGI1fk39AgTdRDxWNYPfXVc4=
 github.com/gliderlabs/ssh v0.2.2 h1:6zsha5zo/TWhRhwqCD3+EarCAgZ2yN28ipRnGPnwkI0=
 github.com/gliderlabs/ssh v0.2.2/go.mod h1:U7qILu1NlMHj9FlMhZLlkCdDnU1DBEAqr0aevW3Awn0=
-github.com/go-critic/go-critic v0.8.1 h1:16omCF1gN3gTzt4j4J6fKI/HnRojhEp+Eks6EuKw3vw=
-github.com/go-critic/go-critic v0.8.1/go.mod h1:kpzXl09SIJX1cr9TB/g/sAG+eFEl7ZS9f9cqvZtyNl0=
+github.com/go-critic/go-critic v0.9.0 h1:Pmys9qvU3pSML/3GEQ2Xd9RZ/ip+aXHKILuxczKGV/U=
+github.com/go-critic/go-critic v0.9.0/go.mod h1:5P8tdXL7m/6qnyG6oRAlYLORvoXH0WDypYgAEmagT40=
 github.com/go-git/gcfg v1.5.0 h1:Q5ViNfGF8zFgyJWPqYwA7qGFoMTEiBmdlkcfRmpIMa4=
 github.com/go-git/gcfg v1.5.0/go.mod h1:5m20vg6GwYabIxaOonVkTdrILxQMpEShl1xiMF4ua+E=
 github.com/go-git/go-billy/v5 v5.0.0/go.mod h1:pmpqyWchKfYfrkb/UVH4otLvyi/5gJlGI4Hb3ZqZ3W0=
@@ -379,12 +436,18 @@ github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2
 github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
 github.com/go-kit/kit v0.9.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
 github.com/go-kit/log v0.1.0/go.mod h1:zbhenjAZHb184qTLMA9ZjW7ThYL0H2mk7Q6pNt4vbaY=
+github.com/go-ldap/ldap v3.0.2+incompatible/go.mod h1:qfd9rJvER9Q0/D/Sqn1DfHRoBp40uXYvFoEVrNEPqRc=
 github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE=
 github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk=
 github.com/go-logfmt/logfmt v0.5.0/go.mod h1:wCYkCAKZfumFQihp8CzCvQ3paCTfi41vtzG1KdI/P7A=
 github.com/go-logr/logr v1.2.4 h1:g01GSCwiDw2xSZfjJ2/T9M+S6pFdcNtFYsp+Y43HYDQ=
+github.com/go-openapi/errors v0.20.2 h1:dxy7PGTqEh94zj2E3h1cUmQQWiM1+aeCROfAr02EmK8=
+github.com/go-openapi/errors v0.20.2/go.mod h1:cM//ZKUKyO06HSwqAelJ5NsEMMcpa6VpXe8DOa1Mi1M=
+github.com/go-openapi/strfmt v0.21.3 h1:xwhj5X6CjXEZZHMWy1zKJxvW9AfHC9pkyUjLvHtKG7o=
+github.com/go-openapi/strfmt v0.21.3/go.mod h1:k+RzNO0Da+k3FrrynSNN8F7n/peCmQQqbbXjtDfvmGg=
 github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
 github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572 h1:tfuBGBXKqDEevZMzYi5KSi8KkcZtzBcTgAUUtapy0OI=
+github.com/go-test/deep v1.0.2-0.20181118220953-042da051cf31/go.mod h1:wGDj63lr65AM2AQyKZd/NYHGb0R+1RLqB8NKt3aSFNA=
 github.com/go-test/deep v1.1.0 h1:WOcxcdHcvdgThNXjw0t76K42FXTU7HpNQWHpA2HHNlg=
 github.com/go-toolsmith/astcast v1.1.0 h1:+JN9xZV1A+Re+95pgnMgDboWNVnIMMQXwfBwLRPgSC8=
 github.com/go-toolsmith/astcast v1.1.0/go.mod h1:qdcuFWeGGS2xX5bLM/c3U9lewg7+Zu4mr+xPwZIB4ZU=
@@ -407,9 +470,13 @@ github.com/go-xmlfmt/xmlfmt v1.1.2 h1:Nea7b4icn8s57fTx1M5AI4qQT5HEM3rVUO8MuE6g80
 github.com/go-xmlfmt/xmlfmt v1.1.2/go.mod h1:aUCEOzzezBEjDBbFBoSiya/gduyIiWYRP6CnSFIV8AM=
 github.com/gobwas/glob v0.2.3 h1:A4xDbljILXROh+kObIiy5kIaPYD8e96x1tgBhUI5J+Y=
 github.com/gobwas/glob v0.2.3/go.mod h1:d3Ez4x06l9bZtSvzIay5+Yzi0fmZzPgnTbPcKjJAkT8=
+github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
 github.com/gofrs/flock v0.8.1 h1:+gYjHKf32LDeiEEFhQaotPbLuUXjY5ZqxKgXy7n59aw=
 github.com/gofrs/flock v0.8.1/go.mod h1:F1TvTiK9OcQqauNUHlbJvyl9Qa1QvF/gOUDKA14jxHU=
 github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
+github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
+github.com/golang-jwt/jwt/v4 v4.5.0 h1:7cYmW1XlMY7h7ii7UhUyChSgS5wUJEnm9uZVTGqOWzg=
+github.com/golang-jwt/jwt/v4 v4.5.0/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
 github.com/golang/groupcache v0.0.0-20190702054246-869f871628b6/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/groupcache v0.0.0-20191227052852-215e87163ea7/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
@@ -425,7 +492,6 @@ github.com/golang/mock v1.4.3/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt
 github.com/golang/mock v1.4.4/go.mod h1:l3mdAwkq5BuhzHwde/uurv3sEJeZMXNpwsxVWU71h+4=
 github.com/golang/mock v1.5.0/go.mod h1:CWnOUgYIOo4TcNZ0wHX3YZCqsaM1I1Jvs6v3mP3KVu8=
 github.com/golang/mock v1.6.0/go.mod h1:p6yTPP+5HYm5mzsMV8JkE6ZKdX+/wYM6Hr+LicevLPs=
-github.com/golang/protobuf v1.1.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
@@ -442,8 +508,10 @@ github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw
 github.com/golang/protobuf v1.4.3/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
 github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
 github.com/golang/protobuf v1.5.1/go.mod h1:DopwsBzvsk0Fs44TXzsVbJyPhcCPeIwnvohx4u74HPM=
-github.com/golang/protobuf v1.5.2 h1:ROPKBNFfQgOUMifHyP+KYbvpjbdoFNs+aK7DXlji0Tw=
 github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
+github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg=
+github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
+github.com/golang/snappy v0.0.1/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
 github.com/golang/snappy v0.0.3/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
 github.com/golangci/check v0.0.0-20180506172741-cfe4005ccda2 h1:23T5iq8rbUYlhpt5DB4XJkc6BU31uODLD1o1gKvZmD0=
 github.com/golangci/check v0.0.0-20180506172741-cfe4005ccda2/go.mod h1:k9Qvh+8juN+UKMCS/3jFtGICgW8O96FVaZsaxdzDkR4=
@@ -451,18 +519,18 @@ github.com/golangci/dupl v0.0.0-20180902072040-3e9179ac440a h1:w8hkcTqaFpzKqonE9
 github.com/golangci/dupl v0.0.0-20180902072040-3e9179ac440a/go.mod h1:ryS0uhF+x9jgbj/N71xsEqODy9BN81/GonCZiOzirOk=
 github.com/golangci/go-misc v0.0.0-20220329215616-d24fe342adfe h1:6RGUuS7EGotKx6J5HIP8ZtyMdiDscjMLfRBSPuzVVeo=
 github.com/golangci/go-misc v0.0.0-20220329215616-d24fe342adfe/go.mod h1:gjqyPShc/m8pEMpk0a3SeagVb0kaqvhscv+i9jI5ZhQ=
-github.com/golangci/gofmt v0.0.0-20220901101216-f2edd75033f2 h1:amWTbTGqOZ71ruzrdA+Nx5WA3tV1N0goTspwmKCQvBY=
-github.com/golangci/gofmt v0.0.0-20220901101216-f2edd75033f2/go.mod h1:9wOXstvyDRshQ9LggQuzBCGysxs3b6Uo/1MvYCR2NMs=
-github.com/golangci/golangci-lint v1.53.3 h1:CUcRafczT4t1F+mvdkUm6KuOpxUZTl0yWN/rSU6sSMo=
-github.com/golangci/golangci-lint v1.53.3/go.mod h1:W4Gg3ONq6p3Jl+0s/h9Gr0j7yEgHJWWZO2bHl2tBUXM=
+github.com/golangci/gofmt v0.0.0-20231018234816-f50ced29576e h1:ULcKCDV1LOZPFxGZaA6TlQbiM3J2GCPnkx/bGF6sX/g=
+github.com/golangci/gofmt v0.0.0-20231018234816-f50ced29576e/go.mod h1:Pm5KhLPA8gSnQwrQ6ukebRcapGb/BG9iUkdaiCcGHJM=
+github.com/golangci/golangci-lint v1.55.1 h1:DL2j9Eeapg1N3WEkKnQFX5L40SYtjZZJjGVdyEgNrDc=
+github.com/golangci/golangci-lint v1.55.1/go.mod h1:z00biPRqjo5MISKV1+RWgONf2KvrPDmfqxHpHKB6bI4=
 github.com/golangci/lint-1 v0.0.0-20191013205115-297bf364a8e0 h1:MfyDlzVjl1hoaPzPD4Gpb/QgoRfSBR0jdhwGyAWwMSA=
 github.com/golangci/lint-1 v0.0.0-20191013205115-297bf364a8e0/go.mod h1:66R6K6P6VWk9I95jvqGxkqJxVWGFy9XlDwLwVz1RCFg=
 github.com/golangci/maligned v0.0.0-20180506175553-b1d89398deca h1:kNY3/svz5T29MYHubXix4aDDuE3RWHkPvopM/EDv/MA=
 github.com/golangci/maligned v0.0.0-20180506175553-b1d89398deca/go.mod h1:tvlJhZqDe4LMs4ZHD0oMUlt9G2LWuDGoisJTBzLMV9o=
-github.com/golangci/misspell v0.4.0 h1:KtVB/hTK4bbL/S6bs64rYyk8adjmh1BygbBiaAiX+a0=
-github.com/golangci/misspell v0.4.0/go.mod h1:W6O/bwV6lGDxUCChm2ykw9NQdd5bYd1Xkjo88UcWyJc=
-github.com/golangci/revgrep v0.0.0-20220804021717-745bb2f7c2e6 h1:DIPQnGy2Gv2FSA4B/hh8Q7xx3B7AIDk3DAMeHclH1vQ=
-github.com/golangci/revgrep v0.0.0-20220804021717-745bb2f7c2e6/go.mod h1:0AKcRCkMoKvUvlf89F6O7H2LYdhr1zBh736mBItOdRs=
+github.com/golangci/misspell v0.4.1 h1:+y73iSicVy2PqyX7kmUefHusENlrP9YwuHZHPLGQj/g=
+github.com/golangci/misspell v0.4.1/go.mod h1:9mAN1quEo3DlpbaIKKyEvRxK1pwqR9s/Sea1bJCtlNI=
+github.com/golangci/revgrep v0.5.2 h1:EndcWoRhcnfj2NHQ+28hyuXpLMF+dQmCN+YaeeIl4FU=
+github.com/golangci/revgrep v0.5.2/go.mod h1:bjAMA+Sh/QUfTDcHzxfyHxr4xKvllVr/0sCv2e7jJHA=
 github.com/golangci/unconvert v0.0.0-20180507085042-28b1c447d1f4 h1:zwtduBRr5SSWhqsYNgcuWO2kFlpdOZbP0+yRjmvPGys=
 github.com/golangci/unconvert v0.0.0-20180507085042-28b1c447d1f4/go.mod h1:Izgrg8RkN3rCIMLGE9CyYmU9pY2Jer6DgANEnZ/L/cQ=
 github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
@@ -481,20 +549,25 @@ github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/
 github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.7/go.mod h1:n+brtR0CgQNWTVd5ZUFpTBC8YFBDLK/h/bpaJ8/DtOE=
 github.com/google/go-cmp v0.5.8/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
-github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
 github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
+github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-github v17.0.0+incompatible/go.mod h1:zLgOLi98H3fifZn+44m+umXrS52loVEgC2AApnigrVQ=
-github.com/google/go-github/v35 v35.3.0 h1:fU+WBzuukn0VssbayTT+Zo3/ESKX9JYWjbZTLOTEyho=
-github.com/google/go-github/v35 v35.3.0/go.mod h1:yWB7uCcVWaUbUP74Aq3whuMySRMatyRmq5U9FTNlbio=
-github.com/google/go-querystring v1.0.0 h1:Xkwi/a1rcvNg1PPYe5vI8GbeBY/jrVuDX5ASuANWTrk=
+github.com/google/go-github/v45 v45.2.0 h1:5oRLszbrkvxDDqBCNj2hjDZMKmvexaZ1xw/FCD+K3FI=
+github.com/google/go-github/v45 v45.2.0/go.mod h1:FObaZJEDSTa/WGCzZ2Z3eoCDXWJKMenWWTrd8jrta28=
+github.com/google/go-github/v53 v53.0.0/go.mod h1:XhFRObz+m/l+UCm9b7KSIC3lT3NWSXGt7mOsAWEloao=
+github.com/google/go-github/v53 v53.2.0 h1:wvz3FyF53v4BK+AsnvCmeNhf8AkTaeh2SoYu/XUvTtI=
+github.com/google/go-github/v53 v53.2.0/go.mod h1:XhFRObz+m/l+UCm9b7KSIC3lT3NWSXGt7mOsAWEloao=
 github.com/google/go-querystring v1.0.0/go.mod h1:odCYkC5MyYFN7vkCjXpyrEuKhc/BUO6wN/zVPAxq5ck=
+github.com/google/go-querystring v1.1.0 h1:AnCroh3fv4ZBgVIf1Iwtovgjaw/GiKJo8M8yD/fhyJ8=
+github.com/google/go-querystring v1.1.0/go.mod h1:Kcdr2DB4koayq7X8pmAG4sNG59So17icRSOU623lUBU=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/martian v2.1.0+incompatible h1:/CP5g8u/VJHijgedC/Legn3BAbAaWPgecwXBIDzw5no=
 github.com/google/martian v2.1.0+incompatible/go.mod h1:9I4somxYTbIHy5NJKHRl3wXiIaQGbYVAs8BPL6v8lEs=
 github.com/google/martian/v3 v3.0.0/go.mod h1:y5Zk1BBys9G+gd6Jrk0W3cC1+ELVxBWuIGO+w/tUAp0=
 github.com/google/martian/v3 v3.1.0/go.mod h1:y5Zk1BBys9G+gd6Jrk0W3cC1+ELVxBWuIGO+w/tUAp0=
-github.com/google/martian/v3 v3.2.1 h1:d8MncMlErDFTwQGBK1xhv026j9kqhvw1Qv9IbWT1VLQ=
 github.com/google/martian/v3 v3.2.1/go.mod h1:oBOf6HBosgwRXnUGWUB05QECsc6uvmMiJ3+6W4l/CUk=
+github.com/google/martian/v3 v3.3.2 h1:IqNFLAmvJOgVlpdEBiQbDc2EwKW77amAycfTuWKdfvw=
 github.com/google/pprof v0.0.0-20181206194817-3ea8567a2e57/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
 github.com/google/pprof v0.0.0-20190515194954-54271f7e092f/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
 github.com/google/pprof v0.0.0-20191218002539-d4f498aebedc/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
@@ -512,14 +585,18 @@ github.com/google/pprof v0.0.0-20210609004039-a478d1d731e9/go.mod h1:kpwsk12EmLe
 github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1 h1:K6RDEckDVWvDI9JAJYCmNdQXq6neHJOYx3V6jnqNEec=
 github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
 github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
+github.com/google/s2a-go v0.1.4 h1:1kZ/sQM3srePvKs3tXAvQzo66XfcReoqFpIpIccE7Oc=
+github.com/google/s2a-go v0.1.4/go.mod h1:Ej+mSEMGRnqRzjc7VtF+jdBwYG5fuJfiZ8ELkjEwM0A=
 github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/google/uuid v1.3.0 h1:t6JiXgmwXMjEs8VusXIJk2BXHsn+wx8BZdTaoZ5fu7I=
 github.com/google/uuid v1.3.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/google/uuid v1.3.1 h1:KjJaJ9iWZ3jOFZIf1Lqf4laDRCasjl0BCmnEGxkdLb4=
+github.com/google/uuid v1.3.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/googleapis/enterprise-certificate-proxy v0.0.0-20220520183353-fd19c99a87aa/go.mod h1:17drOmN3MwGY7t0e+Ei9b45FFGA3fBs3x36SsCg1hq8=
 github.com/googleapis/enterprise-certificate-proxy v0.1.0/go.mod h1:17drOmN3MwGY7t0e+Ei9b45FFGA3fBs3x36SsCg1hq8=
-github.com/googleapis/enterprise-certificate-proxy v0.2.0 h1:y8Yozv7SZtlU//QXbezB6QkpuE6jMD2/gfzk4AftXjs=
 github.com/googleapis/enterprise-certificate-proxy v0.2.0/go.mod h1:8C0jb7/mgJe/9KK8Lm7X9ctZC2t60YyIpYEI16jx0Qg=
+github.com/googleapis/enterprise-certificate-proxy v0.2.3 h1:yk9/cqRKtT9wXZSsRH9aurXEpJX+U6FLtpYTdC3R06k=
+github.com/googleapis/enterprise-certificate-proxy v0.2.3/go.mod h1:AwSRAtLfXpU5Nm3pW+v7rGDHp09LsPtGY9MduiEsR9k=
 github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg=
 github.com/googleapis/gax-go/v2 v2.0.5/go.mod h1:DWXyrwAJ9X0FpwwEdw+IPEYBICEFu5mhpdKc/us6bOk=
 github.com/googleapis/gax-go/v2 v2.1.0/go.mod h1:Q3nei7sK6ybPYH7twZdmQpAd1MKb7pfu6SK+H1/DsU0=
@@ -529,12 +606,12 @@ github.com/googleapis/gax-go/v2 v2.3.0/go.mod h1:b8LNqSzNabLiUpXKkY7HAR5jr6bIT99
 github.com/googleapis/gax-go/v2 v2.4.0/go.mod h1:XOTVJ59hdnfJLIP/dh8n5CGryZR2LxK9wbMD5+iXC6c=
 github.com/googleapis/gax-go/v2 v2.5.1/go.mod h1:h6B0KMMFNtI2ddbGJn3T3ZbwkeT6yqEF02fYlzkUCyo=
 github.com/googleapis/gax-go/v2 v2.6.0/go.mod h1:1mjbznJAPHFpesgE5ucqfYEscaz5kMdcIDwU/6+DDoY=
-github.com/googleapis/gax-go/v2 v2.7.0 h1:IcsPKeInNvYi7eqSaDjiZqDDKu5rsmunY0Y1YupQSSQ=
-github.com/googleapis/gax-go/v2 v2.7.0/go.mod h1:TEop28CZZQ2y+c0VxMUmu1lV+fQx57QpBWsYpwqHJx8=
+github.com/googleapis/gax-go/v2 v2.11.0 h1:9V9PWXEsWnPpQhu/PeQIkS4eGzMlTLGgt80cUUI8Ki4=
+github.com/googleapis/gax-go/v2 v2.11.0/go.mod h1:DxmR61SGKkGLa2xigwuZIQpkCI2S5iydzRfb3peWZJI=
 github.com/googleapis/go-type-adapters v1.0.0/go.mod h1:zHW75FOG2aur7gAO2B+MLby+cLsWGBF62rFAi7WjWO4=
 github.com/googleapis/google-cloud-go-testing v0.0.0-20200911160855-bcd43fbb19e8/go.mod h1:dvDLG8qkwmyD9a/MJJN3XJcT3xFxOKAvTZGvuZmac9g=
-github.com/gookit/color v1.5.3 h1:twfIhZs4QLCtimkP7MOxlF3A0U/5cDPseRT9M/+2SCE=
-github.com/gookit/color v1.5.3/go.mod h1:NUzwzeehUfl7GIb36pqId+UGmRfQcU/WiiyTTeNjHtE=
+github.com/gookit/color v1.5.4 h1:FZmqs7XOyGgCAxmWyPslpiok1k05wmY3SJTytgvYFs0=
+github.com/gookit/color v1.5.4/go.mod h1:pZJOeOS8DM43rXbp4AZo1n9zCU2qjpcRko0b6/QJi9w=
 github.com/gordonklaus/ineffassign v0.0.0-20230610083614-0e73809eb601 h1:mrEEilTAUmaAORhssPPkxj84TsHrPMLBGW2Z4SoTxm8=
 github.com/gordonklaus/ineffassign v0.0.0-20230610083614-0e73809eb601/go.mod h1:Qcp2HIAYhR7mNUVSIxZww3Guk4it82ghYcEXIAk+QT0=
 github.com/gorilla/websocket v1.4.1 h1:q7AeDBpnBk8AogcD4DSag/Ukw/KV+YhzLj2bP5HvKCM=
@@ -550,7 +627,13 @@ github.com/gostaticanalysis/nilerr v0.1.1 h1:ThE+hJP0fEp4zWLkWHWcRyI2Od0p7DlgYG3
 github.com/gostaticanalysis/nilerr v0.1.1/go.mod h1:wZYb6YI5YAxxq0i1+VJbY0s2YONW0HU0GPE3+5PWN4A=
 github.com/gostaticanalysis/testutil v0.3.1-0.20210208050101-bfb5c8eec0e4/go.mod h1:D+FIZ+7OahH3ePw/izIEeH5I06eKs1IKI4Xr64/Am3M=
 github.com/gostaticanalysis/testutil v0.4.0 h1:nhdCmubdmDF6VEatUNjgUZBJKWRqugoISdUv3PPQgHY=
+github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0/go.mod h1:8NvIoxWQoOIhqOTXgfV/d3M/q6VIi02HzZEHgUlZvzk=
 github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw=
+github.com/h2non/parth v0.0.0-20190131123155-b4df798d6542 h1:2VTzZjLZBgl62/EtslCrtky5vbi9dd7HrQPQIx6wqiw=
+github.com/hashicorp/consul/api v1.13.0/go.mod h1:ZlVrynguJKcYr54zGaDbaL3fOvKC9m72FhPvA8T35KQ=
+github.com/hashicorp/consul/sdk v0.8.0/go.mod h1:GBvyrGALthsZObzUGsfgHZQDXjg4lOjagTIwIR1vPms=
+github.com/hashicorp/copywrite v0.16.6 h1:tTkXQiFwK/INXptOgxQ8Vu2i2+GjAf8iE8HRw3IhLA0=
+github.com/hashicorp/copywrite v0.16.6/go.mod h1:6wvQH+ICDoD2bpjO1RJ6fi+h3aY5NeLEM12oTkEtFoc=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
 github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
@@ -559,21 +642,35 @@ github.com/hashicorp/go-cleanhttp v0.5.0/go.mod h1:JpRdi6/HCYpAwUzNwuwqhbovhLtng
 github.com/hashicorp/go-cleanhttp v0.5.1/go.mod h1:JpRdi6/HCYpAwUzNwuwqhbovhLtngrth3wmdIIUrZ80=
 github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ=
 github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48=
-github.com/hashicorp/go-getter v1.7.0 h1:bzrYP+qu/gMrL1au7/aDvkoOVGUJpeKBgbqRHACAFDY=
-github.com/hashicorp/go-getter v1.7.0/go.mod h1:W7TalhMmbPmsSMdNjD0ZskARur/9GJ17cfHTRtXV744=
+github.com/hashicorp/go-getter v1.7.1 h1:SWiSWN/42qdpR0MdhaOc/bLR48PLuP1ZQtYLRlM69uY=
+github.com/hashicorp/go-getter v1.7.1/go.mod h1:W7TalhMmbPmsSMdNjD0ZskARur/9GJ17cfHTRtXV744=
+github.com/hashicorp/go-hclog v0.0.0-20180709165350-ff2cf002a8dd/go.mod h1:9bjs9uLqI8l75knNv3lV1kA55veR+WUPSiKIWcQHudI=
+github.com/hashicorp/go-hclog v0.8.0/go.mod h1:5CU+agLiy3J7N7QjHK5d05KxGsuXiQLrjA0H7acj2lQ=
+github.com/hashicorp/go-hclog v0.12.0/go.mod h1:whpDNt7SSdeAju8AWKIWsul05p54N/39EeqMAyrmvFQ=
 github.com/hashicorp/go-hclog v1.5.0 h1:bI2ocEMgcVlz55Oj1xZNBsVi900c7II+fWDyV9o+13c=
 github.com/hashicorp/go-hclog v1.5.0/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M=
+github.com/hashicorp/go-immutable-radix v1.0.0/go.mod h1:0y9vanUI8NX6FsYoO3zeMjhV/C5i9g4Q3DwcSNZ4P60=
+github.com/hashicorp/go-msgpack v0.5.3/go.mod h1:ahLV/dePpqEmjfWmKiqvPkv/twdG7iPBM1vqhUKIvfM=
 github.com/hashicorp/go-multierror v1.0.0/go.mod h1:dHtQlpGsu+cZNNAkkCN/P3hoUDHhCYQXV3UM06sGGrk=
+github.com/hashicorp/go-multierror v1.1.0/go.mod h1:spPvp8C1qA32ftKqdAHm4hHTbPw+vmowP0z+KUhOZdA=
 github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
-github.com/hashicorp/go-plugin v1.4.9 h1:ESiK220/qE0aGxWdzKIvRH69iLiuN/PjoLTm69RoWtU=
-github.com/hashicorp/go-plugin v1.4.9/go.mod h1:viDMjcLJuDui6pXb8U4HVfb8AamCWhHGUjr2IrTF67s=
+github.com/hashicorp/go-plugin v1.0.1/go.mod h1:++UyYGoz3o5w9ZzAdZxtQKrWWP+iqPBn3cQptSMzBuY=
+github.com/hashicorp/go-plugin v1.4.10 h1:xUbmA4jC6Dq163/fWcp8P3JuHilrHHMLNRxzGQJ9hNk=
+github.com/hashicorp/go-plugin v1.4.10/go.mod h1:6/1TEzT0eQznvI/gV2CM29DLSkAK/e58mUWKVsPaph0=
+github.com/hashicorp/go-retryablehttp v0.5.4/go.mod h1:9B5zBasrRhHXnJnui7y6sL7es7NDiJgTc6Er0maI1Xs=
+github.com/hashicorp/go-rootcerts v1.0.1/go.mod h1:pqUvnprVnM5bf7AOirdbb01K4ccR319Vf4pU3K5EGc8=
+github.com/hashicorp/go-rootcerts v1.0.2/go.mod h1:pqUvnprVnM5bf7AOirdbb01K4ccR319Vf4pU3K5EGc8=
 github.com/hashicorp/go-safetemp v1.0.0 h1:2HR189eFNrjHQyENnQMMpCiBAsRxzbTMIgBhEyExpmo=
 github.com/hashicorp/go-safetemp v1.0.0/go.mod h1:oaerMy3BhqiTbVye6QuFhFtIceqFoDHxNAB65b+Rj1I=
+github.com/hashicorp/go-sockaddr v1.0.0/go.mod h1:7Xibr9yA9JjQq1JpNB2Vw7kxv8xerXegt+ozgdvDeDU=
+github.com/hashicorp/go-sockaddr v1.0.2/go.mod h1:rB4wwRAUzs07qva3c5SdrY/NEtAUjGlgmH/UkBUC97A=
+github.com/hashicorp/go-syslog v1.0.0/go.mod h1:qPfqrKkXGihmCqbJM2mZgkZGvKG1dFdvsLplgctolz4=
 github.com/hashicorp/go-uuid v1.0.0/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
+github.com/hashicorp/go-uuid v1.0.1/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
 github.com/hashicorp/go-uuid v1.0.3 h1:2gKiV6YVmrJ1i2CKKa9obLvRieoRGviZFL26PcT/Co8=
 github.com/hashicorp/go-uuid v1.0.3/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
-github.com/hashicorp/go-version v1.2.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
+github.com/hashicorp/go-version v1.1.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
 github.com/hashicorp/go-version v1.2.1/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
 github.com/hashicorp/go-version v1.5.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
 github.com/hashicorp/go-version v1.6.0 h1:feTTfFNnjP967rlCxM/I9g701jU+RN74YKx2mOkIeek=
@@ -584,22 +681,34 @@ github.com/hashicorp/hc-install v0.4.0 h1:cZkRFr1WVa0Ty6x5fTvL1TuO1flul231rWkGH9
 github.com/hashicorp/hc-install v0.4.0/go.mod h1:5d155H8EC5ewegao9A4PUTMNPZaq+TbOzkJJZ4vrXeI=
 github.com/hashicorp/hcl v1.0.0 h1:0Anlzjpi4vEasTeNFn2mLJgTSwt0+6sfsiTG8qcWGx4=
 github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
-github.com/hashicorp/hcl/v2 v2.16.2 h1:mpkHZh/Tv+xet3sy3F9Ld4FyI2tUpWe9x3XtPx9f1a0=
-github.com/hashicorp/hcl/v2 v2.16.2/go.mod h1:JRmR89jycNkrrqnMmvPDMd56n1rQJ2Q6KocSLCMCXng=
+github.com/hashicorp/hcl/v2 v2.18.0 h1:wYnG7Lt31t2zYkcquwgKo6MWXzRUDIeIVU5naZwHLl8=
+github.com/hashicorp/hcl/v2 v2.18.0/go.mod h1:ThLC89FV4p9MPW804KVbe/cEXoQ8NZEh+JtMeeGErHE=
 github.com/hashicorp/logutils v1.0.0 h1:dLEQVugN8vlakKOUE3ihGLTZJRB4j+M2cdTm/ORI65Y=
 github.com/hashicorp/logutils v1.0.0/go.mod h1:QIAnNjmIWmVIIkWDTG1z5v++HQmx9WQRO+LraFDTW64=
+github.com/hashicorp/mdns v1.0.4/go.mod h1:mtBihi+LeNXGtG8L9dX59gAEa12BDtBQSp4v/YAJqrc=
+github.com/hashicorp/memberlist v0.3.0/go.mod h1:MS2lj3INKhZjWNqd3N0m3J+Jxf3DAOnAH9VT3Sh9MUE=
+github.com/hashicorp/serf v0.9.6/go.mod h1:TXZNMjZQijwlDvp+r0b63xZ45H7JmCmgg4gpTwn9UV4=
 github.com/hashicorp/terraform-exec v0.17.2 h1:EU7i3Fh7vDUI9nNRdMATCEfnm9axzTnad8zszYZ73Go=
 github.com/hashicorp/terraform-exec v0.17.2/go.mod h1:tuIbsL2l4MlwwIZx9HPM+LOV9vVyEfBYu2GsO1uH3/8=
-github.com/hashicorp/terraform-json v0.16.0 h1:UKkeWRWb23do5LNAFlh/K3N0ymn1qTOO8c+85Albo3s=
-github.com/hashicorp/terraform-json v0.16.0/go.mod h1:v0Ufk9jJnk6tcIZvScHvetlKfiNTC+WS21mnXIlc0B0=
-github.com/hashicorp/terraform-registry-address v0.1.0 h1:W6JkV9wbum+m516rCl5/NjKxCyTVaaUBbzYcMzBDO3U=
-github.com/hashicorp/terraform-registry-address v0.1.0/go.mod h1:EnyO2jYO6j29DTHbJcm00E5nQTFeTtyZH3H5ycydQ5A=
-github.com/hashicorp/terraform-svchost v0.0.0-20200729002733-f050f53b9734 h1:HKLsbzeOsfXmKNpr3GiT18XAblV0BjCbzL8KQAMZGa0=
-github.com/hashicorp/terraform-svchost v0.0.0-20200729002733-f050f53b9734/go.mod h1:kNDNcF7sN4DocDLBkQYz73HGKwN1ANB1blq4lIYLYvg=
+github.com/hashicorp/terraform-json v0.17.1 h1:eMfvh/uWggKmY7Pmb3T85u86E2EQg6EQHgyRwf3RkyA=
+github.com/hashicorp/terraform-json v0.17.1/go.mod h1:Huy6zt6euxaY9knPAFKjUITn8QxUFIe9VuSzb4zn/0o=
+github.com/hashicorp/terraform-registry-address v0.2.0 h1:92LUg03NhfgZv44zpNTLBGIbiyTokQCDcdH5BhVHT3s=
+github.com/hashicorp/terraform-registry-address v0.2.0/go.mod h1:478wuzJPzdmqT6OGbB/iH82EDcI8VFM4yujknh/1nIs=
+github.com/hashicorp/terraform-svchost v0.0.1 h1:Zj6fR5wnpOHnJUmLyWozjMeDaVuE+cstMPj41/eKmSQ=
+github.com/hashicorp/terraform-svchost v0.0.1/go.mod h1:ut8JaH0vumgdCfJaihdcZULqkAwHdQNwNH7taIDdsZM=
+github.com/hashicorp/vault/api v1.0.4/go.mod h1:gDcqh3WGcR1cpF5AJz/B1UFheUEneMoIospckxBxk6Q=
+github.com/hashicorp/vault/sdk v0.1.13/go.mod h1:B+hVj7TpuQY1Y/GPbCpffmgd+tSEwvhkWnjtSYCaS2M=
+github.com/hashicorp/yamux v0.0.0-20180604194846-3520598351bb/go.mod h1:+NfK9FKeTrX5uv1uIXGdwYDTeHna2qgaIlx54MXqjAM=
 github.com/hashicorp/yamux v0.0.0-20181012175058-2f1d1f20f75d h1:kJCB4vdITiW1eC1vq2e6IsrXKrZit1bv/TDYFGMp4BQ=
 github.com/hashicorp/yamux v0.0.0-20181012175058-2f1d1f20f75d/go.mod h1:+NfK9FKeTrX5uv1uIXGdwYDTeHna2qgaIlx54MXqjAM=
+github.com/henvic/httpretty v0.0.6 h1:JdzGzKZBajBfnvlMALXXMVQWxWMF/ofTy8C3/OSUTxs=
+github.com/henvic/httpretty v0.0.6/go.mod h1:X38wLjWXHkXT7r2+uK8LjCMne9rsuNaBLJ+5cU2/Pmo=
 github.com/hexops/gotextdiff v1.0.3 h1:gitA9+qJrrTCsiCl7+kh75nPqQt1cx4ZkudSTLoUqJM=
 github.com/hexops/gotextdiff v1.0.3/go.mod h1:pSWU5MAI3yDq+fZBTazCSJysOMbxWL1BSow5/V2vxeg=
+github.com/hinshun/vt10x v0.0.0-20220119200601-820417d04eec h1:qv2VnGeEQHchGaZ/u7lxST/RaJw+cv273q79D81Xbog=
+github.com/hinshun/vt10x v0.0.0-20220119200601-820417d04eec/go.mod h1:Q48J4R4DvxnHolD5P8pOtXigYlRuPLGl6moFx3ulM68=
+github.com/hjson/hjson-go/v4 v4.0.0 h1:wlm6IYYqHjOdXH1gHev4VoXCaW20HdQAGCxdOEEg2cs=
+github.com/hjson/hjson-go/v4 v4.0.0/go.mod h1:KaYt3bTw3zhBjYqnXkYywcYctk0A2nxeEFTse3rH13E=
 github.com/huandu/xstrings v1.3.1/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE=
 github.com/huandu/xstrings v1.3.2 h1:L18LIDzqlW6xN2rEkpdV8+oL/IXWJ1APd+vsdYy4Wdw=
 github.com/huandu/xstrings v1.3.2/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE=
@@ -613,11 +722,15 @@ github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 h1:BQSFePA1RWJOlocH6Fxy8MmwDt+yVQYULKfN0RoTN8A=
 github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99/go.mod h1:1lJo3i6rXxKeerYnT8Nvf0QmHCRC1n8sfWVwXF2Frvo=
+github.com/jedib0t/go-pretty v4.3.0+incompatible h1:CGs8AVhEKg/n9YbUenWmNStRW2PHJzaeDodcfvRAbIo=
+github.com/jedib0t/go-pretty v4.3.0+incompatible/go.mod h1:XemHduiw8R651AF9Pt4FwCTKeG3oo7hrHJAoznj9nag=
+github.com/jedib0t/go-pretty/v6 v6.4.6 h1:v6aG9h6Uby3IusSSEjHaZNXpHFhzqMmjXcPq1Rjl9Jw=
+github.com/jedib0t/go-pretty/v6 v6.4.6/go.mod h1:Ndk3ase2CkQbXLLNf5QDHoYb6J9WtVfmHZu9n8rk2xs=
 github.com/jessevdk/go-flags v1.4.0/go.mod h1:4FA24M0QyGHXBuZZK/XkWh8h0e1EYbRYJSGM75WSRxI=
 github.com/jessevdk/go-flags v1.5.0 h1:1jKYvbxEjfUl0fmqTCOfonvskHHXMjBySTLW4y9LFvc=
 github.com/jessevdk/go-flags v1.5.0/go.mod h1:Fw0T6WPc1dYxT4mKEZRfG5kJhaTDP9pj1c2EWnYs/m4=
-github.com/jgautheron/goconst v1.5.1 h1:HxVbL1MhydKs8R8n/HE5NPvzfaYmQJA3o879lE4+WcM=
-github.com/jgautheron/goconst v1.5.1/go.mod h1:aAosetZ5zaeC/2EfMeRswtxUFBpe2Hr7HzkgX4fanO4=
+github.com/jgautheron/goconst v1.6.0 h1:gbMLWKRMkzAc6kYsQL6/TxaoBUg3Jm9LSF/Ih1ADWGA=
+github.com/jgautheron/goconst v1.6.0/go.mod h1:aAosetZ5zaeC/2EfMeRswtxUFBpe2Hr7HzkgX4fanO4=
 github.com/jhump/protoreflect v1.6.0 h1:h5jfMVslIg6l29nsMs0D8Wj17RDVdNYti0vDN/PZZoE=
 github.com/jingyugao/rowserrcheck v1.1.1 h1:zibz55j/MJtLsjP1OF4bSdgXxwL1b+Vn7Tjzq7gFzUs=
 github.com/jingyugao/rowserrcheck v1.1.1/go.mod h1:4yvlZSDb3IyDTUZJUmpZfm2Hwok+Dtp+nu2qOq+er9c=
@@ -627,6 +740,8 @@ github.com/jmespath/go-jmespath v0.4.0 h1:BEgLn5cpjn8UN1mAw4NjwDrS35OdebyEtFe+9Y
 github.com/jmespath/go-jmespath v0.4.0/go.mod h1:T8mJZnbsbmF+m6zOOFylbeCJqk5+pHWvzYPziyZiYoo=
 github.com/jmespath/go-jmespath/internal/testify v1.5.1 h1:shLQSRRSCCPj3f2gpwzGwWFoC7ycTf1rcQZHOlsJ6N8=
 github.com/jmespath/go-jmespath/internal/testify v1.5.1/go.mod h1:L3OGu8Wl2/fWfCI6z80xFu9LTZmf1ZRjMHUOPmWr69U=
+github.com/joho/godotenv v1.3.0 h1:Zjp+RcGpHhGlrMbJzXTrZZPrWj+1vfm90La1wgB6Bhc=
+github.com/joho/godotenv v1.3.0/go.mod h1:7hK45KPybAkOC6peb+G5yklZfMxEjkZhHbwpqxOKXbg=
 github.com/jpillora/backoff v1.0.0/go.mod h1:J/6gKK9jxlEcS3zixgDgUAsiuZ7yrSoa/FX5e0EB2j4=
 github.com/json-iterator/go v1.1.6/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
 github.com/json-iterator/go v1.1.10/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
@@ -646,22 +761,29 @@ github.com/katbyte/sergi-go-diff v1.1.1 h1:HelbPXYFHziR633zFq8QzwDY44jQ0Xy7COcLx
 github.com/katbyte/sergi-go-diff v1.1.1/go.mod h1:BxkLLDDB1iVQsnURErqoQMjkyXIlR0DefDKzZCUHNEw=
 github.com/katbyte/terrafmt v0.5.2 h1:s9FiRKPgh7fHomEXYbhuoeDpFjWnr/h9nusUUK3TPbI=
 github.com/katbyte/terrafmt v0.5.2/go.mod h1:xGuDBw9hFBIrP8c/BWiJgVPn16DV2AnSUlIFc2OMLYU=
+github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 h1:Z9n2FFNUXsshfwJMBgNA0RU6/i7WVaAegv3PtuIHPMs=
+github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51/go.mod h1:CzGEWj7cYgsdH8dAjBGEr58BoE7ScuLd+fwFZ44+/x8=
 github.com/kevinburke/ssh_config v0.0.0-20190725054713-01f96b0aa0cd/go.mod h1:CT57kijsi8u/K/BOFA39wgDQJ9CxiF4nAY/ojJ6r6mM=
 github.com/kevinburke/ssh_config v0.0.0-20201106050909-4977a11b4351 h1:DowS9hvgyYSX4TO5NpyC606/Z4SxnNYbT+WX27or6Ck=
 github.com/kevinburke/ssh_config v0.0.0-20201106050909-4977a11b4351/go.mod h1:CT57kijsi8u/K/BOFA39wgDQJ9CxiF4nAY/ojJ6r6mM=
+github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
 github.com/kisielk/errcheck v1.6.3 h1:dEKh+GLHcWm2oN34nMvDzn1sqI0i0WxPvrgiJA5JuM8=
 github.com/kisielk/errcheck v1.6.3/go.mod h1:nXw/i/MfnvRHqXa7XXmQMUB0oNFGuBrNI8d8NLy0LPw=
 github.com/kisielk/gotool v1.0.0 h1:AV2c/EiW3KqPNT9ZKl07ehoAGi4C5/01Cfbblndcapg=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
 github.com/kkHAIKE/contextcheck v1.1.4 h1:B6zAaLhOEEcjvUgIYEqystmnFk1Oemn8bvJhbt0GMb8=
 github.com/kkHAIKE/contextcheck v1.1.4/go.mod h1:1+i/gWqokIa+dm31mqGLZhZJ7Uh44DJGZVmr6QRBNJg=
+github.com/klauspost/compress v1.13.6/go.mod h1:/3/Vjq9QcHkK5uEr5lBEmyoZ1iFhe47etQ6QUkpK6sk=
 github.com/klauspost/compress v1.15.11 h1:Lcadnb3RKGin4FYM/orgq0qde+nc15E5Cbqg4B9Sx9c=
 github.com/klauspost/compress v1.15.11/go.mod h1:QPwzmACJjUTFsnSHH934V6woptycfrDDJnH7hvFVbGM=
+github.com/knadh/koanf v1.5.0 h1:q2TSd/3Pyc/5yP9ldIrSdIz26MCcyNQzW0pEAugLPNs=
+github.com/knadh/koanf v1.5.0/go.mod h1:Hgyjp4y8v44hpZtPzs7JZfRAW5AhN7KfZcwv1RYggDs=
 github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
 github.com/konsorten/go-windows-terminal-sequences v1.0.3/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
 github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
 github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFBFZlji/RkVcI2GknAs/DXo4wKdlNEc=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
+github.com/kr/pretty v0.2.0/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
 github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
@@ -670,9 +792,8 @@ github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/kulti/thelper v0.6.3 h1:ElhKf+AlItIu+xGnI990no4cE2+XaSu1ULymV2Yulxs=
 github.com/kulti/thelper v0.6.3/go.mod h1:DsqKShOvP40epevkFrvIwkCMNYxMeTNjdWL4dqWHZ6I=
-github.com/kunwardeep/paralleltest v1.0.7 h1:2uCk94js0+nVNQoHZNLBkAR1DQJrVzw6T0RMzJn55dQ=
-github.com/kunwardeep/paralleltest v1.0.7/go.mod h1:2C7s65hONVqY7Q5Efj5aLzRCNLjw2h4eMc9EcypGjcY=
-github.com/kylelemons/godebug v0.0.0-20170820004349-d65d576e9348/go.mod h1:B69LEHPfb2qLo0BaaOLcbitczOKLWTsrBG9LczfCD4k=
+github.com/kunwardeep/paralleltest v1.0.8 h1:Ul2KsqtzFxTlSU7IP0JusWlLiNqQaloB9vguyjbE558=
+github.com/kunwardeep/paralleltest v1.0.8/go.mod h1:2C7s65hONVqY7Q5Efj5aLzRCNLjw2h4eMc9EcypGjcY=
 github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
 github.com/kyoh86/exportloopref v0.1.11 h1:1Z0bcmTypkL3Q4k+IDHMWTcnCliEZcaPiIe0/ymEyhQ=
 github.com/kyoh86/exportloopref v0.1.11/go.mod h1:qkV4UF1zGl6EkF1ox8L5t9SwyeBAZ3qLMd6up458uqA=
@@ -682,8 +803,12 @@ github.com/ldez/tagliatelle v0.5.0 h1:epgfuYt9v0CG3fms0pEgIMNPuFf/LpPIfjk4kyqSio
 github.com/ldez/tagliatelle v0.5.0/go.mod h1:rj1HmWiL1MiKQuOONhd09iySTEkUuE/8+5jtPYz9xa4=
 github.com/leonklingele/grouper v1.1.1 h1:suWXRU57D4/Enn6pXR0QVqqWWrnJ9Osrz+5rjt8ivzU=
 github.com/leonklingele/grouper v1.1.1/go.mod h1:uk3I3uDfi9B6PeUjsCKi6ndcf63Uy7snXgR4yDYQVDY=
+github.com/lucasb-eyer/go-colorful v1.2.0 h1:1nnpGOrhyZZuNyfu1QjKiUICQ74+3FNCN69Aj6K7nkY=
+github.com/lucasb-eyer/go-colorful v1.2.0/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0=
 github.com/lufeee/execinquery v1.2.1 h1:hf0Ems4SHcUGBxpGN7Jz78z1ppVkP/837ZlETPCEtOM=
 github.com/lufeee/execinquery v1.2.1/go.mod h1:EC7DrEKView09ocscGHC+apXMIaorh4xqSxS/dy8SbM=
+github.com/macabu/inamedparam v0.1.2 h1:RR5cnayM6Q7cDhQol32DE2BGAPGMnffJ31LFE+UklaU=
+github.com/macabu/inamedparam v0.1.2/go.mod h1:Xg25QvY7IBRl1KLPV9Rbml8JOMZtF/iAkNkmV7eQgjw=
 github.com/magiconair/properties v1.8.6 h1:5ibWZ6iY0NctNGWo87LalDlEZ6R41TqbbDamhfG/Qzo=
 github.com/magiconair/properties v1.8.6/go.mod h1:y3VJvCyxH9uVvJTWEGAELF3aiYNyPKd5NZ3oSwXrF60=
 github.com/maratori/testableexamples v1.0.0 h1:dU5alXRrD8WKSjOUnmJZuzdxWOEQ57+7s93SLMxb2vI=
@@ -696,12 +821,18 @@ github.com/matryer/is v1.2.0/go.mod h1:2fLPjFQM9rhQ15aVEtbuwhJinnOqrmgXPNdZsdwlW
 github.com/matryer/is v1.4.0 h1:sosSmIWwkYITGrxZ25ULNDeKiMNzFSr4V/eqBQP0PeE=
 github.com/matryer/is v1.4.0/go.mod h1:8I/i5uYgLzgsgEloJE1U6xx5HkBQpAZvepWuujKwMRU=
 github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU=
+github.com/mattn/go-colorable v0.1.2/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=
+github.com/mattn/go-colorable v0.1.4/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=
+github.com/mattn/go-colorable v0.1.6/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
 github.com/mattn/go-colorable v0.1.9/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
 github.com/mattn/go-colorable v0.1.12/go.mod h1:u5H1YNBxpqRaxsYJYSkiCWKzEfiAb1Gb520KVy5xxl4=
 github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
 github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
 github.com/mattn/go-isatty v0.0.3/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
 github.com/mattn/go-isatty v0.0.4/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
+github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
+github.com/mattn/go-isatty v0.0.10/go.mod h1:qgIWMr58cqv1PHHyhnkY9lrL7etaEgOFcMEpPG5Rm84=
+github.com/mattn/go-isatty v0.0.11/go.mod h1:PhnuNfih5lzO57/f3n+odYbM4JtupLOxQOAqxQCu2WE=
 github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU=
 github.com/mattn/go-isatty v0.0.14/go.mod h1:7GGIvUiUoEMVVmxf/4nioHXj79iQHKdU27kJ6hsGG94=
 github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
@@ -709,14 +840,24 @@ github.com/mattn/go-isatty v0.0.19 h1:JITubQf0MOLdlGRuRq+jtsDlekdYPia9ZFsB8h/APP
 github.com/mattn/go-isatty v0.0.19/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
 github.com/mattn/go-runewidth v0.0.4/go.mod h1:LwmH8dsx7+W8Uxz3IHJYH5QSwggIsqBzpuz5H//U1FU=
 github.com/mattn/go-runewidth v0.0.9/go.mod h1:H031xJmbD/WCDINGzjvQ9THkh0rPKHF+m2gUSrubnMI=
-github.com/mattn/go-runewidth v0.0.14 h1:+xnbZSEeDbOIg5/mE6JF0w6n9duR1l3/WmbinWVwUuU=
-github.com/mattn/go-runewidth v0.0.14/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
+github.com/mattn/go-runewidth v0.0.13/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
+github.com/mattn/go-runewidth v0.0.15 h1:UNAjwbU9l54TA3KzvqLGxwWjHmMgBUVhBiTjelZgg3U=
+github.com/mattn/go-runewidth v0.0.15/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
 github.com/matttproud/golang_protobuf_extensions v1.0.1 h1:4hp9jkHxhMHkqkrB3Ix0jegS5sx/RkqARlsWZ6pIwiU=
 github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
 github.com/mbilski/exhaustivestruct v1.2.0 h1:wCBmUnSYufAHO6J4AVWY6ff+oxWxsVFrwgOdMUQePUo=
 github.com/mbilski/exhaustivestruct v1.2.0/go.mod h1:OeTBVxQWoEmB2J2JCHmXWPJ0aksxSUOUy+nvtVEfzXc=
-github.com/mgechev/revive v1.3.2 h1:Wb8NQKBaALBJ3xrrj4zpwJwqwNA6nDpyJSEQWcCka6U=
-github.com/mgechev/revive v1.3.2/go.mod h1:UCLtc7o5vg5aXCwdUTU1kEBQ1v+YXPAkYDIDXbrs5I0=
+github.com/mergestat/timediff v0.0.3 h1:ucCNh4/ZrTPjFZ081PccNbhx9spymCJkFxSzgVuPU+Y=
+github.com/mergestat/timediff v0.0.3/go.mod h1:yvMUaRu2oetc+9IbPLYBJviz6sA7xz8OXMDfhBl7YSI=
+github.com/mgechev/revive v1.3.4 h1:k/tO3XTaWY4DEHal9tWBkkUMJYO/dLDVyMmAQxmIMDc=
+github.com/mgechev/revive v1.3.4/go.mod h1:W+pZCMu9qj8Uhfs1iJMQsEFLRozUfvwFwqVvRbSNLVw=
+github.com/mgutz/ansi v0.0.0-20170206155736-9520e82c474b/go.mod h1:01TrycV0kFyexm33Z7vhZRXopbI8J3TDReVlkTgMUxE=
+github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d h1:5PJl274Y63IEHC+7izoQE9x6ikvDFZS2mDVS3drnohI=
+github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d/go.mod h1:01TrycV0kFyexm33Z7vhZRXopbI8J3TDReVlkTgMUxE=
+github.com/miekg/dns v1.1.26/go.mod h1:bPDLeHnStXmXAq1m/Ch/hvfNHr14JKNPMBo3VZKjuso=
+github.com/miekg/dns v1.1.41/go.mod h1:p6aan82bvRIyn+zDIv9xYNUpwa73JcSh9BKwknJysuI=
+github.com/mitchellh/cli v1.0.0/go.mod h1:hNIlj7HEI86fIcpObd7a0FcrxTWetlwJDGcceTlRvqc=
+github.com/mitchellh/cli v1.1.0/go.mod h1:xcISNoH86gajksDmfB23e/pu+B+GeFRMYmoHXxx3xhI=
 github.com/mitchellh/cli v1.1.5 h1:OxRIeJXpAMztws/XHlN2vu6imG5Dpq+j61AzAX5fLng=
 github.com/mitchellh/cli v1.1.5/go.mod h1:v8+iFts2sPIKUV1ltktPXMCC8fumSKFItNcD2cLtRR4=
 github.com/mitchellh/copystructure v1.0.0/go.mod h1:SNtv71yrdKgLRyLFxmLdkAbkKEFWgYaq1OVrnRcwhnw=
@@ -724,10 +865,16 @@ github.com/mitchellh/copystructure v1.2.0 h1:vpKXTN4ewci03Vljg/q9QvCGUDttBOGBIa1
 github.com/mitchellh/copystructure v1.2.0/go.mod h1:qLl+cE2AmVv+CoeAwDPye/v+N2HKCj9FbZEVFJRxO9s=
 github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
 github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
+github.com/mitchellh/go-testing-interface v0.0.0-20171004221916-a61a99592b77/go.mod h1:kRemZodwjscx+RGhAo8eIhFbs2+BFgRtFPeD/KE+zxI=
+github.com/mitchellh/go-testing-interface v1.0.0/go.mod h1:kRemZodwjscx+RGhAo8eIhFbs2+BFgRtFPeD/KE+zxI=
 github.com/mitchellh/go-testing-interface v1.14.1 h1:jrgshOhYAUVNMAJiKbEu7EqAwgJJ2JqpQmpLJOu07cU=
 github.com/mitchellh/go-testing-interface v1.14.1/go.mod h1:gfgS7OtZj6MA4U1UrDRp04twqAjfvlZyCfX3sDjEym8=
+github.com/mitchellh/go-wordwrap v1.0.0/go.mod h1:ZXFpozHsX6DPmq2I0TCekCxypsnAUbP2oI0UX1GXzOo=
 github.com/mitchellh/go-wordwrap v1.0.1 h1:TLuKupo69TCn6TQSyGxwI1EblZZEsQ0vMlAFQflz0v0=
 github.com/mitchellh/go-wordwrap v1.0.1/go.mod h1:R62XHJLzvMFRBbcrT7m7WgmE1eOyTSsCt+hzestvNj0=
+github.com/mitchellh/mapstructure v0.0.0-20160808181253-ca63d7c062ee/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
+github.com/mitchellh/mapstructure v1.1.2/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
+github.com/mitchellh/mapstructure v1.3.3/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
 github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
 github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
 github.com/mitchellh/reflectwalk v1.0.0/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
@@ -738,50 +885,60 @@ github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJ
 github.com/modern-go/reflect2 v0.0.0-20180701023420-4b7aa43c6742/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
 github.com/modern-go/reflect2 v1.0.1/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
 github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
+github.com/montanaflynn/stats v0.0.0-20171201202039-1bf9dbcd8cbe/go.mod h1:wL8QJuTMNUDYhXwkmfOly8iTdp5TEcJFWZD2D7SIkUc=
 github.com/moricho/tparallel v0.3.1 h1:fQKD4U1wRMAYNngDonW5XupoB/ZGJHdpzrWqgyg9krA=
 github.com/moricho/tparallel v0.3.1/go.mod h1:leENX2cUv7Sv2qDgdi0D0fCftN8fRC67Bcn8pqzeYNI=
+github.com/muesli/reflow v0.3.0 h1:IFsN6K9NfGtjeggFP+68I4chLZV2yIKsXJFNZ+eWh6s=
+github.com/muesli/termenv v0.12.0 h1:KuQRUE3PgxRFWhq4gHvZtPSLCGDqM5q/cYr1pZ39ytc=
+github.com/muesli/termenv v0.12.0/go.mod h1:WCCv32tusQ/EEZ5S8oUIIrC/nIuBcxCVqlN4Xfkv+7A=
 github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
 github.com/mwitkow/go-conntrack v0.0.0-20190716064945-2f068394615f/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
 github.com/nakabonne/nestif v0.3.1 h1:wm28nZjhQY5HyYPx+weN3Q65k6ilSBxDb8v5S81B81U=
 github.com/nakabonne/nestif v0.3.1/go.mod h1:9EtoZochLn5iUprVDmDjqGKPofoUEBL8U4Ngq6aY7OE=
-github.com/nbutton23/zxcvbn-go v0.0.0-20210217022336-fa2cb2858354 h1:4kuARK6Y6FxaNu/BnU2OAaLF86eTVhP2hjTB6iMvItA=
-github.com/nbutton23/zxcvbn-go v0.0.0-20210217022336-fa2cb2858354/go.mod h1:KSVJerMDfblTH7p5MZaTt+8zaT2iEk3AkVb9PQdZuE8=
 github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno=
 github.com/nishanths/exhaustive v0.11.0 h1:T3I8nUGhl/Cwu5Z2hfc92l0e04D2GEW6e0l8pzda2l0=
 github.com/nishanths/exhaustive v0.11.0/go.mod h1:RqwDsZ1xY0dNdqHho2z6X+bgzizwbLYOWnZbbl2wLB4=
 github.com/nishanths/predeclared v0.2.2 h1:V2EPdZPliZymNAn79T8RkNApBjMmVKh5XRpLm/w98Vk=
 github.com/nishanths/predeclared v0.2.2/go.mod h1:RROzoN6TnGQupbC+lqggsOlcgysk3LMK/HI84Mp280c=
-github.com/nunnatsa/ginkgolinter v0.12.1 h1:vwOqb5Nu05OikTXqhvLdHCGcx5uthIYIl0t79UVrERQ=
-github.com/nunnatsa/ginkgolinter v0.12.1/go.mod h1:AK8Ab1PypVrcGUusuKD8RDcl2KgsIwvNaaxAlyHSzso=
+github.com/npillmayer/nestext v0.1.3/go.mod h1:h2lrijH8jpicr25dFY+oAJLyzlya6jhnuG+zWp9L0Uk=
+github.com/nunnatsa/ginkgolinter v0.14.0 h1:XQPNmw+kZz5cC/HbFK3mQutpjzAQv1dHregRA+4CGGg=
+github.com/nunnatsa/ginkgolinter v0.14.0/go.mod h1:cm2xaqCUCRd7qcP4DqbVvpcyEMkuLM9CF0wY6VASohk=
 github.com/oklog/run v1.0.0 h1:Ru7dDtJNOyC66gQ5dQmaCa0qIsAUFY3sFpK1Xk8igrw=
 github.com/oklog/run v1.0.0/go.mod h1:dlhp/R75TPv97u0XWUtDeV/lRKWPKSdTuV0TZvrmrQA=
+github.com/oklog/ulid v1.3.1 h1:EGfNDEx6MqHz8B3uNV6QAib1UR2Lm97sHi3ocA6ESJ4=
+github.com/oklog/ulid v1.3.1/go.mod h1:CirwcVhetQ6Lv90oh/F+FBtV6XMibvdAFo93nm5qn4U=
 github.com/olekukonko/tablewriter v0.0.5 h1:P2Ga83D34wi1o9J6Wh1mRuqd4mF/x/lgBS7N7AbDhec=
 github.com/olekukonko/tablewriter v0.0.5/go.mod h1:hPp6KlRPjbx+hW8ykQs1w3UBbZlj6HuIJcUGPhkA7kY=
-github.com/onsi/ginkgo/v2 v2.9.4 h1:xR7vG4IXt5RWx6FfIjyAtsoMAtnc3C/rFXBBd2AjZwE=
-github.com/onsi/gomega v1.27.6 h1:ENqfyGeS5AX/rlXDd/ETokDz93u0YufY1Pgxuy/PvWE=
-github.com/otiai10/copy v1.2.0 h1:HvG945u96iNadPoG2/Ja2+AUJeW5YuFQMixq9yirC+k=
+github.com/onsi/ginkgo/v2 v2.13.0 h1:0jY9lJquiL8fcf3M4LAXN5aMlS/b2BV86HFFPCPMgE4=
+github.com/onsi/gomega v1.28.1 h1:MijcGUbfYuznzK/5R4CPNoUP/9Xvuo20sXfEm6XxoTA=
 github.com/otiai10/copy v1.2.0/go.mod h1:rrF5dJ5F0t/EWSYODDu4j9/vEeYHMkc8jt0zJChqQWw=
+github.com/otiai10/copy v1.11.0 h1:OKBD80J/mLBrwnzXqGtFCzprFSGioo30JcmR4APsNwc=
 github.com/otiai10/curr v0.0.0-20150429015615-9b4961190c95/go.mod h1:9qAhocn7zKJG+0mI8eUu6xqkFDYS2kb2saOteoSB3cE=
 github.com/otiai10/curr v1.0.0/go.mod h1:LskTG5wDwr8Rs+nNQ+1LlxRjAtTZZjtJW4rMXl6j4vs=
 github.com/otiai10/mint v1.3.0/go.mod h1:F5AjcsTsWUqX+Na9fpHb52P8pcRX2CI6A3ctIT91xUo=
 github.com/otiai10/mint v1.3.1/go.mod h1:/yxELlJQ0ufhjUwhshSj+wFjZ78CnZ48/1wtmBH1OTc=
 github.com/owenrumney/go-sarif v1.1.1 h1:QNObu6YX1igyFKhdzd7vgzmw7XsWN3/6NMGuDzBgXmE=
 github.com/owenrumney/go-sarif v1.1.1/go.mod h1:dNDiPlF04ESR/6fHlPyq7gHKmrM0sHUvAGjsoh8ZH0U=
+github.com/pascaldekloe/goe v0.0.0-20180627143212-57f6aae5913c/go.mod h1:lzWF7FIEvWOWxwDKqyGYQf6ZUaNfKdP144TG7ZOy1lc=
+github.com/pascaldekloe/goe v0.1.0/go.mod h1:lzWF7FIEvWOWxwDKqyGYQf6ZUaNfKdP144TG7ZOy1lc=
 github.com/pavius/impi v0.0.3 h1:DND6MzU+BLABhOZXbELR3FU8b+zDgcq4dOCNLhiTYuI=
 github.com/pavius/impi v0.0.3/go.mod h1:x/hU0bfdWIhuOT1SKwiJg++yvkk6EuOtJk8WtDZqgr8=
+github.com/pelletier/go-toml v1.7.0/go.mod h1:vwGMzjaWMwyfHwgIBhI2YUM4fB6nL6lVAvS1LBMMhTE=
 github.com/pelletier/go-toml v1.9.5 h1:4yBQzkHv+7BHq2PQUZF3Mx0IYxG7LsP222s7Agd3ve8=
 github.com/pelletier/go-toml v1.9.5/go.mod h1:u1nR/EPcESfeI/szUZKdtJ0xRNbUoANCkoOuaOx1Y+c=
 github.com/pelletier/go-toml/v2 v2.0.5 h1:ipoSadvV8oGUjnUbMub59IDPPwfxF694nG/jwbMiyQg=
 github.com/pelletier/go-toml/v2 v2.0.5/go.mod h1:OMHamSCAODeSsVrwwvcJOaoN0LIUIaFVNZzmWyNfXas=
+github.com/pierrec/lz4 v2.0.5+incompatible/go.mod h1:pdkljMzZIN41W+lC3N2tnIh5sFi+IEE17M5jbnwPHcY=
 github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pkg/profile v1.6.0/go.mod h1:qBsxPvzyUincmltOk6iyRVxHYg4adc0OFOv72ZdLa18=
 github.com/pkg/sftp v1.13.1/go.mod h1:3HaPG6Dq1ILlpPZRO0HVMrsydcdLt6HRDccSgb87qRg=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/polyfloyd/go-errorlint v1.4.2 h1:CU+O4181IxFDdPH6t/HT7IiDj1I7zxNi1RIUxYwn8d0=
-github.com/polyfloyd/go-errorlint v1.4.2/go.mod h1:k6fU/+fQe38ednoZS51T7gSIGQW1y94d6TkSr35OzH8=
+github.com/polyfloyd/go-errorlint v1.4.5 h1:70YWmMy4FgRHehGNOUask3HtSFSOLKgmDn7ryNe7LqI=
+github.com/polyfloyd/go-errorlint v1.4.5/go.mod h1:sIZEbFoDOCnTYYZoVkjc4hTnM459tuWA9H/EkdXwsKk=
 github.com/posener/complete v1.1.1/go.mod h1:em0nMJCgc9GFtwrmVmEMR/ZL6WyhyjMBndrE9hABlRI=
 github.com/posener/complete v1.2.3 h1:NP0eAhjcjImqslEwo/1hq7gpajME0fTLTezBKDqfXqo=
 github.com/posener/complete v1.2.3/go.mod h1:WZIdtGGp+qx0sLrYKtIRAruyNpv6hFCicSgv7Sy7s/s=
@@ -789,6 +946,7 @@ github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXP
 github.com/prometheus/client_golang v1.0.0/go.mod h1:db9x61etRT2tGnBNRi70OPL5FsnadC4Ky3P0J6CfImo=
 github.com/prometheus/client_golang v1.7.1/go.mod h1:PY5Wy2awLA44sXw4AOSfFBetzPP4j5+D6mVACh+pe2M=
 github.com/prometheus/client_golang v1.11.0/go.mod h1:Z6t4BnS23TR94PD6BsDNk8yVqroYurpAkEiz0P2BEV0=
+github.com/prometheus/client_golang v1.11.1/go.mod h1:Z6t4BnS23TR94PD6BsDNk8yVqroYurpAkEiz0P2BEV0=
 github.com/prometheus/client_golang v1.12.1 h1:ZiaPsmm9uiBeaSMRznKsCDNtPCS0T3JVDGF+06gjBzk=
 github.com/prometheus/client_golang v1.12.1/go.mod h1:3Z9XVyYiZYEO+YQWt3RD2R3jrbd179Rt297l4aS6nDY=
 github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
@@ -807,37 +965,44 @@ github.com/prometheus/procfs v0.1.3/go.mod h1:lV6e/gmhEcM9IjHGsFOCxxuZ+z1YqCvr4O
 github.com/prometheus/procfs v0.6.0/go.mod h1:cz+aTbrPOrUb4q7XlbU9ygM+/jj0fzG6c1xBZuNvfVA=
 github.com/prometheus/procfs v0.7.3 h1:4jVXhlkAyzOScmCkXBTOLRLTz8EeU+eyjrwB/EPq0VU=
 github.com/prometheus/procfs v0.7.3/go.mod h1:cz+aTbrPOrUb4q7XlbU9ygM+/jj0fzG6c1xBZuNvfVA=
-github.com/quasilyte/go-ruleguard v0.3.19 h1:tfMnabXle/HzOb5Xe9CUZYWXKfkS1KwRmZyPmD9nVcc=
-github.com/quasilyte/go-ruleguard v0.3.19/go.mod h1:lHSn69Scl48I7Gt9cX3VrbsZYvYiBYszZOZW4A+oTEw=
+github.com/quasilyte/go-ruleguard v0.4.0 h1:DyM6r+TKL+xbKB4Nm7Afd1IQh9kEUKQs2pboWGKtvQo=
+github.com/quasilyte/go-ruleguard v0.4.0/go.mod h1:Eu76Z/R8IXtViWUIHkE3p8gdH3/PKk1eh3YGfaEof10=
 github.com/quasilyte/gogrep v0.5.0 h1:eTKODPXbI8ffJMN+W2aE0+oL0z/nh8/5eNdiO34SOAo=
 github.com/quasilyte/gogrep v0.5.0/go.mod h1:Cm9lpz9NZjEoL1tgZ2OgeUKPIxL1meE7eo60Z6Sk+Ng=
 github.com/quasilyte/regex/syntax v0.0.0-20210819130434-b3f0c404a727 h1:TCg2WBOl980XxGFEZSS6KlBGIV0diGdySzxATTWoqaU=
 github.com/quasilyte/regex/syntax v0.0.0-20210819130434-b3f0c404a727/go.mod h1:rlzQ04UMyJXu/aOvhd8qT+hvDrFpiwqp8MRXDY9szc0=
 github.com/quasilyte/stdinfo v0.0.0-20220114132959-f7386bf02567 h1:M8mH9eK4OUR4lu7Gd+PU1fV2/qnDNfzT635KRSObncs=
 github.com/quasilyte/stdinfo v0.0.0-20220114132959-f7386bf02567/go.mod h1:DWNGW8A4Y+GyBgPuaQJuWiy0XYftx4Xm/y5Jqk9I6VQ=
-github.com/rhysd/actionlint v1.6.25 h1:0Is99a51w1iocdxKUzNYiBNwjoSlO2Klqzll98joVj4=
-github.com/rhysd/actionlint v1.6.25/go.mod h1:Q+MtZKm1MdmJ9woOSKxLscMW7kU44/PShvjNy5ZKHA8=
+github.com/rhnvrm/simples3 v0.6.1/go.mod h1:Y+3vYm2V7Y4VijFoJHHTrja6OgPrJ2cBti8dPGkC3sA=
+github.com/rhysd/actionlint v1.6.26 h1:zi7jPZf3Ks14gCXYAAL47uBziyFlX7+Xwilqhexct9g=
+github.com/rhysd/actionlint v1.6.26/go.mod h1:TIj1DlCgtYLOv5CH9wCK+WJTOr1qAdnFzkGi0IgSCO4=
 github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
 github.com/rivo/uniseg v0.4.4 h1:8TfxU8dW6PdqD27gjM8MVNuicgxIjxpm4K7x4jp8sis=
 github.com/rivo/uniseg v0.4.4/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=
-github.com/robfig/cron v1.2.0 h1:ZjScXvvxeQ63Dbyxy76Fj3AT3Ut0aKsyd2/tl3DTMuQ=
-github.com/robfig/cron v1.2.0/go.mod h1:JGuDeoQd7Z6yL4zQhZ3OPEVHB7fL6Ka6skscFHfmt2k=
+github.com/robfig/cron/v3 v3.0.1 h1:WdRxkvbJztn8LMz/QEvLN5sBU+xKpSqwwUO1Pjr4qDs=
+github.com/robfig/cron/v3 v3.0.1/go.mod h1:eQICP3HwyT7UooqI/z+Ov+PtYAWygg1TEWWzGIFLtro=
 github.com/rogpeppe/fastuuid v1.2.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6LYCDYWNEvQ=
 github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
 github.com/rogpeppe/go-internal v1.10.0 h1:TMyTOH3F/DB16zRVcYyreMH6GnZZrwQVAoYjRBZyWFQ=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/ryancurrah/gomodguard v1.3.0 h1:q15RT/pd6UggBXVBuLps8BXRvl5GPBcwVA7BJHMLuTw=
 github.com/ryancurrah/gomodguard v1.3.0/go.mod h1:ggBxb3luypPEzqVtq33ee7YSN35V28XeGnid8dnni50=
-github.com/ryanrolds/sqlclosecheck v0.4.0 h1:i8SX60Rppc1wRuyQjMciLqIzV3xnoHB7/tXbr6RGYNI=
-github.com/ryanrolds/sqlclosecheck v0.4.0/go.mod h1:TBRRjzL31JONc9i4XMinicuo+s+E8yKZ5FN8X3G6CKQ=
+github.com/ryanrolds/sqlclosecheck v0.5.1 h1:dibWW826u0P8jNLsLN+En7+RqWWTYrjCB9fJfSfdyCU=
+github.com/ryanrolds/sqlclosecheck v0.5.1/go.mod h1:2g3dUjoS6AL4huFdv6wn55WpLIDjY7ZgUR4J8HOO/XQ=
+github.com/ryanuber/columnize v0.0.0-20160712163229-9b3edd62028f/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
+github.com/ryanuber/columnize v2.1.0+incompatible/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
+github.com/ryanuber/go-glob v1.0.0/go.mod h1:807d1WSdnB0XRJzKNil9Om6lcp/3a0v4qIHxIXzX/Yc=
+github.com/samber/lo v1.37.0 h1:XjVcB8g6tgUp8rsPsJ2CvhClfImrpL04YpQHXeHPhRw=
+github.com/samber/lo v1.37.0/go.mod h1:9vaz2O4o8oOnK23pd2TrXufcbdbJIa3b6cstBWKpopA=
 github.com/sanposhiho/wastedassign/v2 v2.0.7 h1:J+6nrY4VW+gC9xFzUc+XjPD3g3wF3je/NsJFwFK7Uxc=
 github.com/sanposhiho/wastedassign/v2 v2.0.7/go.mod h1:KyZ0MWTwxxBmfwn33zh3k1dmsbF2ud9pAAGfoLfjhtI=
 github.com/sashamelentyev/interfacebloat v1.1.0 h1:xdRdJp0irL086OyW1H/RTZTr1h/tMEOsumirXcOJqAw=
 github.com/sashamelentyev/interfacebloat v1.1.0/go.mod h1:+Y9yU5YdTkrNvoX0xHc84dxiN1iBi9+G8zZIhPVoNjQ=
-github.com/sashamelentyev/usestdlibvars v1.23.0 h1:01h+/2Kd+NblNItNeux0veSL5cBF1jbEOPrEhDzGYq0=
-github.com/sashamelentyev/usestdlibvars v1.23.0/go.mod h1:YPwr/Y1LATzHI93CqoPUN/2BzGQ/6N/cl/KwgR0B/aU=
-github.com/securego/gosec/v2 v2.16.0 h1:Pi0JKoasQQ3NnoRao/ww/N/XdynIB9NRYYZT5CyOs5U=
-github.com/securego/gosec/v2 v2.16.0/go.mod h1:xvLcVZqUfo4aAQu56TNv7/Ltz6emAOQAEsrZrt7uGlI=
+github.com/sashamelentyev/usestdlibvars v1.24.0 h1:MKNzmXtGh5N0y74Z/CIaJh4GlB364l0K1RUT08WSWAc=
+github.com/sashamelentyev/usestdlibvars v1.24.0/go.mod h1:9cYkq+gYJ+a5W2RPdhfaSCnTVUC1OQP/bSiiBhq3OZE=
+github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529/go.mod h1:DxrIzT+xaE7yg65j358z/aeFdxmN0P9QXhEzd20vsDc=
+github.com/securego/gosec/v2 v2.18.2 h1:DkDt3wCiOtAHf1XkiXZBhQ6m6mK/b9T/wD257R3/c+I=
+github.com/securego/gosec/v2 v2.18.2/go.mod h1:xUuqSF6i0So56Y2wwohWAmB07EdBkUN6crbLlHwbyJs=
 github.com/sergi/go-diff v1.1.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
 github.com/sergi/go-diff v1.2.0 h1:XU+rvMAioB0UC3q1MFrIQy4Vo5/4VsRDQQXHsEya6xQ=
 github.com/sergi/go-diff v1.2.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
@@ -890,7 +1055,6 @@ github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
 github.com/stretchr/objx v0.5.0 h1:1zr/of2m5FGMsad5YfcqgdqdWrIhu+EBEJRhR1U7z/c=
 github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
-github.com/stretchr/testify v1.1.4/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
@@ -899,9 +1063,9 @@ github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.2/go.mod h1:R6va5+xMeoiuVRoj+gSkQ7d3FALtqAAGI1FQKckRals=
+github.com/stretchr/testify v1.7.4/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
-github.com/stretchr/testify v1.8.2/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
 github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
 github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
 github.com/subosito/gotenv v1.4.1 h1:jyEFiXpy21Wm81FBN71l9VoMMV8H8jG+qIK3GCpY6Qs=
@@ -914,14 +1078,20 @@ github.com/tenntenn/modver v1.0.1 h1:2klLppGhDgzJrScMpkj9Ujy3rXPUspSjAcev9tSEBgA
 github.com/tenntenn/modver v1.0.1/go.mod h1:bePIyQPb7UeioSRkw3Q0XeMhYZSMx9B8ePqg6SAMGH0=
 github.com/tenntenn/text/transform v0.0.0-20200319021203-7eef512accb3 h1:f+jULpRQGxTSkNYKJ51yaw6ChIqO+Je8UqsTKN/cDag=
 github.com/tenntenn/text/transform v0.0.0-20200319021203-7eef512accb3/go.mod h1:ON8b8w4BN/kE1EOhwT0o+d62W65a6aPw1nouo9LMgyY=
-github.com/terraform-linters/tflint v0.46.1 h1:Z2Psh60BgINuSwQQV+iL64P/61Bd9m5pXeP9LqJo8EM=
-github.com/terraform-linters/tflint v0.46.1/go.mod h1:5DtZb3Zza9rQyZDcVWrcdJAZsrzCogPOseJlk0vUadI=
-github.com/terraform-linters/tflint-plugin-sdk v0.16.1 h1:fBfLL8KzP3pkQrNp3iQxaGoKBoMo2sFYoqmhuo6yc+A=
-github.com/terraform-linters/tflint-plugin-sdk v0.16.1/go.mod h1:ltxVy04PRwptL6P/Ugz2ZeTNclYapClrLn/kVFXJGzo=
-github.com/terraform-linters/tflint-ruleset-terraform v0.2.2 h1:iTE09KkaZ0DE29xvp6IIM1/gmas9V0h8CER28SyBmQ8=
-github.com/terraform-linters/tflint-ruleset-terraform v0.2.2/go.mod h1:bCkvH8Vqzr16bWEE3e6Q3hvdZlmSAOR8i6G3M5y+M+k=
-github.com/tetafro/godot v1.4.11 h1:BVoBIqAf/2QdbFmSwAWnaIqDivZdOV0ZRwEm6jivLKw=
-github.com/tetafro/godot v1.4.11/go.mod h1:LR3CJpxDVGlYOWn3ZZg1PgNZdTUvzsZWu8xaEohUpn8=
+github.com/terraform-linters/tflint v0.48.0 h1:HLviQhGDYGgDhBB0TUG21KQOrZRLwKvNfeocuGfL+fA=
+github.com/terraform-linters/tflint v0.48.0/go.mod h1:JjgTVLkhyG4pG481CRiwtcHX7gK2fQkP0tl8CU8EY7U=
+github.com/terraform-linters/tflint-plugin-sdk v0.18.0 h1:XqQS6/RfUU6J3ySDTdN5c/KvNu6sOYdGqtTo4zgRPXE=
+github.com/terraform-linters/tflint-plugin-sdk v0.18.0/go.mod h1:OvyC1d9NyIFxNZQeKM7vSGrRWq0cuq27zAQUMpJH5h8=
+github.com/terraform-linters/tflint-ruleset-terraform v0.4.0 h1:HOkKth3zhtpEo4J0f122ln6xAo1RKnroDYzP+gnZWbM=
+github.com/terraform-linters/tflint-ruleset-terraform v0.4.0/go.mod h1:rcgg6YCJIvU2zL2aJlYE9s1u0HirSunjJg7Gu/mqUNY=
+github.com/tetafro/godot v1.4.15 h1:QzdIs+XB8q+U1WmQEWKHQbKmCw06QuQM7gLx/dky2RM=
+github.com/tetafro/godot v1.4.15/go.mod h1:2oVxTBSftRTh4+MVfUaUXR6bn2GDXCaMcOG4Dk3rfio=
+github.com/thanhpk/randstr v1.0.4 h1:IN78qu/bR+My+gHCvMEXhR/i5oriVHcTB/BJJIRTsNo=
+github.com/thanhpk/randstr v1.0.4/go.mod h1:M/H2P1eNLZzlDwAzpkkkUvoyNNMbzRGhESZuEQk3r0U=
+github.com/thlib/go-timezone-local v0.0.0-20210907160436-ef149e42d28e h1:BuzhfgfWQbX0dWzYzT1zsORLnHRv3bcRcsaUk0VmXA8=
+github.com/thlib/go-timezone-local v0.0.0-20210907160436-ef149e42d28e/go.mod h1:/Tnicc6m/lsJE0irFMA0LfIwTBo4QP7A8IfyIv4zZKI=
+github.com/tidwall/pretty v1.0.0 h1:HsD+QiTn7sK6flMKIvNmpqz1qrpP3Ps6jOKIKMooyg4=
+github.com/tidwall/pretty v1.0.0/go.mod h1:XNkn88O1ChpSDQmQeStsy+sBenx6DDtFZJxhVysOjyk=
 github.com/timakin/bodyclose v0.0.0-20230421092635-574207250966 h1:quvGphlmUVU+nhpFa4gg4yJyTRJ13reZMDHrKwYw53M=
 github.com/timakin/bodyclose v0.0.0-20230421092635-574207250966/go.mod h1:27bSVNWSBOHm+qRp1T9qzaIpsWEP6TbUnei/43HK+PQ=
 github.com/timonwong/loggercheck v0.9.4 h1:HKKhqrjcVj8sxL7K77beXh0adEm6DLjV/QOGeMXEVi4=
@@ -932,13 +1102,12 @@ github.com/tommy-muehle/go-mnd/v2 v2.5.1 h1:NowYhSdyE/1zwK9QCLeRb6USWdoif80Ie+v+
 github.com/tommy-muehle/go-mnd/v2 v2.5.1/go.mod h1:WsUAkMJMYww6l/ufffCD3m+P7LEvr8TnZn9lwVDlgzw=
 github.com/ulikunitz/xz v0.5.10 h1:t92gobL9l3HE202wg3rlk19F6X+JOxl9BBrCCMYEYd8=
 github.com/ulikunitz/xz v0.5.10/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
-github.com/ultraware/funlen v0.0.3 h1:5ylVWm8wsNwH5aWo9438pwvsK0QiqVuUrt9bn7S/iLA=
-github.com/ultraware/funlen v0.0.3/go.mod h1:Dp4UiAus7Wdb9KUZsYWZEWiRzGuM2kXM1lPbfaF6xhA=
+github.com/ultraware/funlen v0.1.0 h1:BuqclbkY6pO+cvxoq7OsktIXZpgBSkYTQtmwhAK81vI=
+github.com/ultraware/funlen v0.1.0/go.mod h1:XJqmOQja6DpxarLj6Jj1U7JuoS8PvL4nEqDaQhy22p4=
 github.com/ultraware/whitespace v0.0.5 h1:hh+/cpIcopyMYbZNVov9iSxvJU3OYQg78Sfaqzi/CzI=
 github.com/ultraware/whitespace v0.0.5/go.mod h1:aVMh/gQve5Maj9hQ/hg+F75lr/X5A89uZnzAmWSineA=
-github.com/uudashr/gocognit v1.0.6 h1:2Cgi6MweCsdB6kpcVQp7EW4U23iBFQWfTXiWlyp842Y=
-github.com/uudashr/gocognit v1.0.6/go.mod h1:nAIUuVBnYU7pcninia3BHOvQkpQCeO76Uscky5BOwcY=
-github.com/vmihailenco/msgpack v3.3.3+incompatible/go.mod h1:fy3FlTQTDXWkZ7Bh6AcGMlsjHatGryHQYUTf1ShIgkk=
+github.com/uudashr/gocognit v1.1.2 h1:l6BAEKJqQH2UpKAPKdMfZf5kE4W/2xk8pfU1OVLvniI=
+github.com/uudashr/gocognit v1.1.2/go.mod h1:aAVdLURqcanke8h3vg35BC++eseDm66Z7KmchI5et4k=
 github.com/vmihailenco/msgpack/v4 v4.3.12/go.mod h1:gborTTJjAo/GWTqqRjrLCn9pgNN+NXzzngzBKDPIqw4=
 github.com/vmihailenco/msgpack/v5 v5.3.5 h1:5gO0H1iULLWGhs2H5tbAHIZTV8/cYafcFOr9znI5mJU=
 github.com/vmihailenco/msgpack/v5 v5.3.5/go.mod h1:7xyJ9e+0+9SaZT0Wt1RGleJXzli6Q/V5KbhBonMG9jc=
@@ -948,19 +1117,23 @@ github.com/vmihailenco/tagparser/v2 v2.0.0/go.mod h1:Wri+At7QHww0WTrCBeu4J6bNtoV
 github.com/xanzy/ssh-agent v0.2.1/go.mod h1:mLlQY/MoOhWBj+gOGMQkOeiEvkx+8pJSI+0Bx9h2kr4=
 github.com/xanzy/ssh-agent v0.3.0 h1:wUMzuKtKilRgBAD1sUb8gOwwRr2FGoBVumcjoOACClI=
 github.com/xanzy/ssh-agent v0.3.0/go.mod h1:3s9xbODqPuuhK9JV1R321M/FlMZSBvE5aY6eAcqrDh0=
+github.com/xdg-go/pbkdf2 v1.0.0/go.mod h1:jrpuAogTd400dnrH08LKmI/xc1MbPOebTwRqcT5RDeI=
+github.com/xdg-go/scram v1.1.1/go.mod h1:RaEWvsqvNKKvBPvcKeFjrG2cJqOkHTiyTpzz23ni57g=
+github.com/xdg-go/stringprep v1.0.3/go.mod h1:W3f5j4i+9rC0kuIEJL0ky1VpHXQU3ocBgklLGvcBnW8=
 github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f h1:J9EGpcZtP0E/raorCMxlFGSTBrsSlaDGf3jU/qvAE2c=
 github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 h1:EzJWgHovont7NscjpAxXsDA8S8BMYve8Y5+7cuRE7R0=
 github.com/xeipuuv/gojsonschema v1.2.0 h1:LhYJRs+L4fBtjZUfuSZIKGeVu0QRy8e5Xi7D17UxZ74=
-github.com/xen0n/gosmopolitan v1.2.1 h1:3pttnTuFumELBRSh+KQs1zcz4fN6Zy7aB0xlnQSn1Iw=
-github.com/xen0n/gosmopolitan v1.2.1/go.mod h1:JsHq/Brs1o050OOdmzHeOr0N7OtlnKRAGAsElF8xBQA=
+github.com/xen0n/gosmopolitan v1.2.2 h1:/p2KTnMzwRexIW8GlKawsTWOxn7UHA+jCMF/V8HHtvU=
+github.com/xen0n/gosmopolitan v1.2.2/go.mod h1:7XX7Mj61uLYrj0qmeN0zi7XDon9JRAEhYQqAPLVNTeg=
 github.com/xo/terminfo v0.0.0-20210125001918-ca9a967f8778 h1:QldyIu/L63oPpyvQmHgvgickp1Yw510KJOqX7H24mg8=
 github.com/xo/terminfo v0.0.0-20210125001918-ca9a967f8778/go.mod h1:2MuV+tbUrU1zIOPMxZ5EncGwgmMJsa+9ucAQZXxsObs=
 github.com/yagipy/maintidx v1.0.0 h1:h5NvIsCz+nRDapQ0exNv4aJ0yXSI0420omVANTv3GJM=
 github.com/yagipy/maintidx v1.0.0/go.mod h1:0qNf/I/CCZXSMhsRsrEPDZ+DkekpKLXAJfsTACwgXLk=
 github.com/yeya24/promlinter v0.2.0 h1:xFKDQ82orCU5jQujdaD8stOHiv8UN68BSdn2a8u8Y3o=
 github.com/yeya24/promlinter v0.2.0/go.mod h1:u54lkmBOZrpEbQQ6gox2zWKKLKu2SGe+2KOiextY+IA=
-github.com/ykadowak/zerologlint v0.1.2 h1:Um4P5RMmelfjQqQJKtE8ZW+dLZrXrENeIzWWKw800U4=
-github.com/ykadowak/zerologlint v0.1.2/go.mod h1:KaUskqF3e/v59oPmdq1U1DnKcuHokl2/K1U4pmIELKg=
+github.com/ykadowak/zerologlint v0.1.3 h1:TLy1dTW3Nuc+YE3bYRPToG1Q9Ej78b5UUN6bjbGdxPE=
+github.com/ykadowak/zerologlint v0.1.3/go.mod h1:KaUskqF3e/v59oPmdq1U1DnKcuHokl2/K1U4pmIELKg=
+github.com/youmark/pkcs8 v0.0.0-20181117223130-1be2e3e5546d/go.mod h1:rHwXgn7JulP+udvsHwJoVG1YGAP6VLg4y9I5dyZdqmA=
 github.com/yuin/goldmark v1.1.25/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.1.32/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
@@ -968,19 +1141,26 @@ github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9dec
 github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
 github.com/yuin/goldmark v1.4.1/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
-github.com/yuin/goldmark v1.5.4 h1:2uY/xC0roWy8IBEGLgB1ywIoEJFGmRrX21YQcvGZzjU=
-github.com/yuin/goldmark v1.5.4/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
+github.com/yuin/goldmark v1.5.6 h1:COmQAWTCcGetChm3Ig7G/t8AFAN00t+o8Mt4cf7JpwA=
+github.com/yuin/goldmark v1.5.6/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
 github.com/yuin/goldmark-meta v1.1.0 h1:pWw+JLHGZe8Rk0EGsMVssiNb/AaPMHfSRszZeUeiOUc=
 github.com/yuin/goldmark-meta v1.1.0/go.mod h1:U4spWENafuA7Zyg+Lj5RqK/MF+ovMYtBvXi1lBb2VP0=
-github.com/zclconf/go-cty v1.1.0/go.mod h1:xnAOWiHeOqg2nWS62VtQ7pbOu17FtxJNW8RLEih+O3s=
 github.com/zclconf/go-cty v1.10.0/go.mod h1:vVKLxnk3puL4qRAv72AO+W99LUD4da90g3uUAzyuvAk=
-github.com/zclconf/go-cty v1.13.1 h1:0a6bRwuiSHtAmqCqNOE+c2oHgepv0ctoxU4FUe43kwc=
-github.com/zclconf/go-cty v1.13.1/go.mod h1:YKQzy/7pZ7iq2jNFzy5go57xdxdWoLLpaEp4u238AE0=
+github.com/zclconf/go-cty v1.13.2 h1:4GvrUxe/QUDYuJKAav4EYqdM47/kZa672LwmXFmEKT0=
+github.com/zclconf/go-cty v1.13.2/go.mod h1:YKQzy/7pZ7iq2jNFzy5go57xdxdWoLLpaEp4u238AE0=
+github.com/zclconf/go-cty-debug v0.0.0-20191215020915-b22d67c1ba0b h1:FosyBZYxY34Wul7O/MSKey3txpPYyCqVO5ZyceuQJEI=
 github.com/zclconf/go-cty-yaml v1.0.3 h1:og/eOQ7lvA/WWhHGFETVWNduJM7Rjsv2RRpx1sdFMLc=
 github.com/zclconf/go-cty-yaml v1.0.3/go.mod h1:9YLUH4g7lOhVWqUbctnVlZ5KLpg7JAprQNgxSZ1Gyxs=
-gitlab.com/bosi/decorder v0.2.3 h1:gX4/RgK16ijY8V+BRQHAySfQAb354T7/xQpDB2n10P0=
-gitlab.com/bosi/decorder v0.2.3/go.mod h1:9K1RB5+VPNQYtXtTDAzd2OEftsZb1oV0IrJrzChSdGE=
-go-simpler.org/assert v0.5.0 h1:+5L/lajuQtzmbtEfh69sr5cRf2/xZzyJhFjoOz/PPqs=
+gitlab.com/bosi/decorder v0.4.1 h1:VdsdfxhstabyhZovHafFw+9eJ6eU0d2CkFNJcZz/NU4=
+gitlab.com/bosi/decorder v0.4.1/go.mod h1:jecSqWUew6Yle1pCr2eLWTensJMmsxHsBwt+PVbkAqA=
+go-simpler.org/assert v0.6.0 h1:QxSrXa4oRuo/1eHMXSBFHKvJIpWABayzKldqZyugG7E=
+go-simpler.org/sloglint v0.1.2 h1:IjdhF8NPxyn0Ckn2+fuIof7ntSnVUAqBFcQRrnG9AiM=
+go-simpler.org/sloglint v0.1.2/go.mod h1:2LL+QImPfTslD5muNPydAEYmpXIj6o/WYcqnJjLi4o4=
+go.etcd.io/etcd/api/v3 v3.5.4/go.mod h1:5GB2vv4A4AOn3yk7MftYGHkUfGtDHnEraIjym4dYz5A=
+go.etcd.io/etcd/client/pkg/v3 v3.5.4/go.mod h1:IJHfcCEKxYu1Os13ZdwCwIUTUVGYTSAM3YSwc9/Ac1g=
+go.etcd.io/etcd/client/v3 v3.5.4/go.mod h1:ZaRkVgBZC+L+dLCjTcF1hRXpgZXQPOvnA/Ak/gq3kiY=
+go.mongodb.org/mongo-driver v1.10.0 h1:UtV6N5k14upNp4LTduX0QCufG124fSu25Wz9tu94GLg=
+go.mongodb.org/mongo-driver v1.10.0/go.mod h1:wsihk0Kdgv8Kqu1Anit4sfK+22vSFbUrAVEYRhCXrA8=
 go.opencensus.io v0.21.0/go.mod h1:mSImk1erAIZhrmZN+AvHh14ztQfjbGwt4TtuofqLduU=
 go.opencensus.io v0.22.0/go.mod h1:+kGneAE2xo2IficOXnaByMWTGM9T73dGwxeWcUqIpI8=
 go.opencensus.io v0.22.2/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
@@ -991,13 +1171,14 @@ go.opencensus.io v0.23.0/go.mod h1:XItmlyltB5F7CS4xOC1DcqMoFqwtC6OG2xF7mCv7P7E=
 go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0=
 go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo=
 go.opentelemetry.io/proto/otlp v0.7.0/go.mod h1:PqfVotwruBrMGOCsRd/89rSnXhoiJIqeYNgFYFoEGnI=
-go.tmz.dev/musttag v0.7.0 h1:QfytzjTWGXZmChoX0L++7uQN+yRCPfyFm+whsM+lfGc=
-go.tmz.dev/musttag v0.7.0/go.mod h1:oTFPvgOkJmp5kYL02S8+jrH0eLrBIl57rzWeA26zDEM=
+go.tmz.dev/musttag v0.7.2 h1:1J6S9ipDbalBSODNT5jCep8dhZyMr4ttnjQagmGYR5s=
+go.tmz.dev/musttag v0.7.2/go.mod h1:m6q5NiiSKMnQYokefa2xGoyoXnrswCbJ0AWYzf4Zs28=
 go.uber.org/atomic v1.7.0 h1:ADUqmZGgLDDfbSL9ZmPxKTybcoEYHgpYfELNoN+7hsw=
 go.uber.org/atomic v1.7.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
 go.uber.org/goleak v1.1.11 h1:wy28qYRKZgnJTxGxvye5/wgWr1EKjmUDGYox5mGlRlI=
 go.uber.org/multierr v1.6.0 h1:y6IPFStTAIT5Ytl7/XYmHvzXQ7S3g/IeZW9hyZ5thw4=
 go.uber.org/multierr v1.6.0/go.mod h1:cdWPpRnG4AhwMwsgIHip0KRBQjJy5kYEpYjJxpXp9iU=
+go.uber.org/zap v1.17.0/go.mod h1:MXVU+bhUf/A7Xi2HNOnopQOrmycQ5Ih87HtOu4q5SSo=
 go.uber.org/zap v1.24.0 h1:FiJd5l1UOLj0wCgbSE0rwwXHzEdAZS6hiiSnxJN/D60=
 go.uber.org/zap v1.24.0/go.mod h1:2kMP+WWQ8aoFoedH3T2sq6iJ2yDWpHbP0f6MQbS9Gkg=
 golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
@@ -1005,6 +1186,7 @@ golang.org/x/crypto v0.0.0-20190219172222-a4c6cb3142f2/go.mod h1:6SG95UA2DQfeDnf
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20190605123033-f99c8df09eb5/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/crypto v0.0.0-20190923035154-9ee001bba392/go.mod h1:/lpIB1dKB+9EgE3H3cr1v9wB50oz8l4C4h62xy7jSTY=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200302210943-78000ba7a073/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20200414173820-0848c9571904/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
@@ -1014,10 +1196,14 @@ golang.org/x/crypto v0.0.0-20210322153248-0c34fe9e7dc2/go.mod h1:T9bdIzuCu7OtxOm
 golang.org/x/crypto v0.0.0-20210421170649-83a5a9bb288b/go.mod h1:T9bdIzuCu7OtxOm1hfPfRQxPLYneinmdGuTeoZ9dtd4=
 golang.org/x/crypto v0.0.0-20210616213533-5ff15b29337e/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
+golang.org/x/crypto v0.0.0-20220314234659-1baeb1ce4c0b/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
+golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
 golang.org/x/crypto v0.0.0-20220722155217-630584e8d5aa/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
 golang.org/x/crypto v0.1.0/go.mod h1:RecgLatLF4+eUMCP1PoPZQb+cVrJcOPbHkTkbkB9sbw=
-golang.org/x/crypto v0.9.0 h1:LF6fAI+IutBocDJ2OT0Q1g8plpYljMZ4+lty+dsqw3g=
-golang.org/x/crypto v0.9.0/go.mod h1:yrmDGqONDYtNj3tH8X9dzUun2m2lzPa9ngI6/RUPGR0=
+golang.org/x/crypto v0.3.1-0.20221117191849-2c476679df9a/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
+golang.org/x/crypto v0.7.0/go.mod h1:pYwdfH91IfpZVANVyUOhSIPZaFoJGxTFbZhFTx+dXZU=
+golang.org/x/crypto v0.14.0 h1:wBqGXzWJW6m1XrIKlAH0Hs1JJ7+9KBwnIO8v66Q9cHc=
+golang.org/x/crypto v0.14.0/go.mod h1:MVFd36DqK4CsrnJYDkBA3VC4m2GkXAM0PvzMCn4JQf4=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -1032,8 +1218,8 @@ golang.org/x/exp v0.0.0-20230510235704-dd950f8aeaea h1:vLCWI/yYrdEHyN2JzIzPO3aaQ
 golang.org/x/exp v0.0.0-20230510235704-dd950f8aeaea/go.mod h1:V1LtkGg67GoY2N1AnLN78QLrzxkLyJw7RJb1gzOOz9w=
 golang.org/x/exp/typeparams v0.0.0-20220428152302-39d4317da171/go.mod h1:AbB0pIl9nAr9wVwH+Z2ZpaocVmF5I4GyWCDIsVjR0bk=
 golang.org/x/exp/typeparams v0.0.0-20230203172020-98cc5a0785f9/go.mod h1:AbB0pIl9nAr9wVwH+Z2ZpaocVmF5I4GyWCDIsVjR0bk=
-golang.org/x/exp/typeparams v0.0.0-20230224173230-c95f2b4c22f2 h1:J74nGeMgeFnYQJN59eFwh06jX/V8g0lB7LWpjSLxtgU=
-golang.org/x/exp/typeparams v0.0.0-20230224173230-c95f2b4c22f2/go.mod h1:AbB0pIl9nAr9wVwH+Z2ZpaocVmF5I4GyWCDIsVjR0bk=
+golang.org/x/exp/typeparams v0.0.0-20230307190834-24139beb5833 h1:jWGQJV4niP+CCmFW9ekjA9Zx8vYORzOUH2/Nl5WPuLQ=
+golang.org/x/exp/typeparams v0.0.0-20230307190834-24139beb5833/go.mod h1:AbB0pIl9nAr9wVwH+Z2ZpaocVmF5I4GyWCDIsVjR0bk=
 golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
 golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
@@ -1047,7 +1233,6 @@ golang.org/x/lint v0.0.0-20191125180803-fdd1cda4f05f/go.mod h1:5qLYkcX4OjUUV8bRu
 golang.org/x/lint v0.0.0-20200130185559-910be7a94367/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
 golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
 golang.org/x/lint v0.0.0-20201208152925-83fdc39ff7b5/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
-golang.org/x/lint v0.0.0-20210508222113-6edffad5e616 h1:VLliZ0d+/avPrXXH+OakdXhpJuEoBZuwh1m2j7U6Iug=
 golang.org/x/lint v0.0.0-20210508222113-6edffad5e616/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
 golang.org/x/mobile v0.0.0-20190312151609-d3739f865fa6/go.mod h1:z+o9i4GpDbdi3rU15maQ/Ox0txvL9dWGYEHz965HBQE=
 golang.org/x/mobile v0.0.0-20190719004257-d2bd2a29d028/go.mod h1:E/iHnbuqvinMTCcRqshq8CkpyQDoeVncDDYHnLhea+o=
@@ -1066,10 +1251,9 @@ golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91
 golang.org/x/mod v0.6.0/go.mod h1:4mET923SAdbXp2ki8ey+zGs1SLqsuM2Y0uvdZR/fUNI=
 golang.org/x/mod v0.7.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/mod v0.10.0 h1:lFO9qtOdlre5W1jxS3r/4szv2/6iXxScdzjoBMXNhYk=
-golang.org/x/mod v0.10.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/mod v0.13.0 h1:I/DsJXRlw/8l/0c24sM9yb0T4z9liZTduXvdAWYiysY=
+golang.org/x/mod v0.13.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20180811021610-c39426892332/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20181114220301-adae6a3d119a/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -1083,7 +1267,7 @@ golang.org/x/net v0.0.0-20190613194153-d28f0bde5980/go.mod h1:z5CRVTTTmAJ677TzLL
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20190628185345-da137c7871d7/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20190724013045-ca1201d0de80/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20191009170851-d66e71096ffb/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20190923162816-aa69164e4478/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20191209160850-c0dbc17a3553/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200114155413-6afb5195e5aa/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200202094626-16171245cfb2/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
@@ -1108,6 +1292,7 @@ golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v
 golang.org/x/net v0.0.0-20210316092652-d523dce5a7f4/go.mod h1:RBQZq4jEuRlivfhVLdyRGr576XBO4/greRjx4P4O3yc=
 golang.org/x/net v0.0.0-20210326060303-6b1517762897/go.mod h1:uSPa2vr4CLtc/ILN5odXGNXS6mhrKVzTaCXzk9m6W3k=
 golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
+golang.org/x/net v0.0.0-20210410081132-afb366fc7cd1/go.mod h1:9tjilg8BloeKEkVJvy7fQ90B1CfIiPueXVOjqfkSzI8=
 golang.org/x/net v0.0.0-20210503060351-7fd8e65b6420/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20210525063256-abc453219eb5/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20211015210444-4f30a5c0130f/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
@@ -1122,13 +1307,16 @@ golang.org/x/net v0.0.0-20220617184016-355a448f1bc9/go.mod h1:XRhObCWvk6IyKnWLug
 golang.org/x/net v0.0.0-20220624214902-1bab6f366d9e/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.0.0-20220909164309-bea034e7d591/go.mod h1:YDH+HFinaLZZlnHAfSS6ZXJJ9M9t4Dl22yv3iI2vPwk=
+golang.org/x/net v0.0.0-20220923203811-8be639271d50/go.mod h1:YDH+HFinaLZZlnHAfSS6ZXJJ9M9t4Dl22yv3iI2vPwk=
 golang.org/x/net v0.0.0-20221014081412-f15817d10f9b/go.mod h1:YDH+HFinaLZZlnHAfSS6ZXJJ9M9t4Dl22yv3iI2vPwk=
 golang.org/x/net v0.1.0/go.mod h1:Cx3nUiGt4eDBEyega/BKRp+/AlGL8hYe7U9odMt2Cco=
 golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY=
 golang.org/x/net v0.5.0/go.mod h1:DivGGAXEgPSlEBzxGzZI+ZLohi+xUj054jfeKui00ws=
 golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
-golang.org/x/net v0.10.0 h1:X2//UzNDwYmtCLn7To6G58Wr6f5ahEAQgKNzv9Y951M=
+golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc=
 golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
+golang.org/x/net v0.17.0 h1:pVaXccu2ozPjCXewfr1S7xza/zcXTity9cCdXQYSjIM=
+golang.org/x/net v0.17.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -1154,8 +1342,9 @@ golang.org/x/oauth2 v0.0.0-20220822191816-0ebed06d0094/go.mod h1:h4gKUeWbJ4rQPri
 golang.org/x/oauth2 v0.0.0-20220909003341-f21342109be1/go.mod h1:h4gKUeWbJ4rQPri7E0u6Gs4e9Ri2zaLxzw5DI5XGrYg=
 golang.org/x/oauth2 v0.0.0-20221014153046-6fdb5e3db783/go.mod h1:h4gKUeWbJ4rQPri7E0u6Gs4e9Ri2zaLxzw5DI5XGrYg=
 golang.org/x/oauth2 v0.1.0/go.mod h1:G9FE4dLTsbXUu90h/Pf85g4w1D+SSAgR+q46nJZ8M4A=
-golang.org/x/oauth2 v0.7.0 h1:qe6s0zUXlPX80/dITx3440hWZ7GwMwgDDyrSGTPJG/g=
-golang.org/x/oauth2 v0.7.0/go.mod h1:hPLQkd9LyjfXTiRohC/41GhcFqxisoUQ99sCUOHO9x4=
+golang.org/x/oauth2 v0.8.0/go.mod h1:yr7u4HXZRm1R1kBWqr/xKNqewf0plRYoB7sla+BCIXE=
+golang.org/x/oauth2 v0.11.0 h1:vPL4xzxBM4niKCW6g9whtaWVXTJf1U5e4aZxxFx/gbU=
+golang.org/x/oauth2 v0.11.0/go.mod h1:LdF7O/8bLR/qWK9DrpXmbHLTouvRHK0SgJl0GmDBchk=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -1171,14 +1360,18 @@ golang.org/x/sync v0.0.0-20220601150217-0de741cfad7f/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220929204114-8fcdb60fdcc0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.2.0 h1:PUR+T4wwASmuSTYdKjYHI5TD22Wy5ogLU5qZCOLxBrI=
-golang.org/x/sync v0.2.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.4.0 h1:zxkM55ReGkDlKSM+Fu41A+zmbZuaPVbGMzvvdUPznYQ=
+golang.org/x/sync v0.4.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
+golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20181116152217-5ac8a444bdc5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190129075346-302c3dd5f1cc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190221075227-b4e8571b14e0/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190312061237-fead79001313/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190403152447-81d4e9dc473e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190422165155-953cdadca894/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190502145724-3ef323f4f1fd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -1187,13 +1380,19 @@ golang.org/x/sys v0.0.0-20190606165138-5da285871e9c/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20190624142023-c5567b49c5d0/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190726091711-fc99dfbffb4e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190922100055-0a153f010e69/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190924154521-2837fb4f24fe/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191001151750-bb3f8db39f24/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191005200804-aed5e4c7ecf9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191008105621-543471e840be/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191204072324-ce4227a45e2e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191228213918-04cbcbbfeed8/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200106162015-b016eb3dc98e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200113162924-86b910548bc1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200116001909-b77594299b42/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200122134326-e047566fdf82/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200124204421-9fbb57f87de9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200202164722-d101bd2416d5/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200212091648-12a6c2dcc1e4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -1216,11 +1415,13 @@ golang.org/x/sys v0.0.0-20210119212857-b64e53b001e4/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210220050731-9a76102bfb43/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210225134936-a50acf3fe073/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210303074136-134d130e1a04/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210305230114-8fe3ee5dd75b/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210315160823-c6e025ad8005/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210320140829-1e4c9ba3b0c4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210324051608-47abb6519492/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210330210617-4fbd30eecc44/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210403161142-5e06dd20ab57/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210423185535-09eb48e85fd7/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210502180810-71e4cd670f79/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -1233,8 +1434,10 @@ golang.org/x/sys v0.0.0-20210616094352-59db8d763f22/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210806184541-e5e7981a1069/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210823070655-63515b42dcdf/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210831042530-f4d43177bf5e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210908233432-aa78b53d3365/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210927094055-39ccf1dd6fa6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20211007075335-d3039528d8ac/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211019181941-9d821ace8654/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211105183446-c75c47738b0c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211124211545-fe61309f8881/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
@@ -1246,6 +1449,7 @@ golang.org/x/sys v0.0.0-20220209214540-3681064d5158/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220227234510-4e6760a101f9/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220328115105-d36c6a25d886/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220412211240-33da011f77ad/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220422013727-9388b58f7150/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220502124256-b6088ccd6cba/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220503163025-988cb79eb6c6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
@@ -1259,32 +1463,42 @@ golang.org/x/sys v0.0.0-20220728004956-3c1f35247d10/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.3.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.4.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.8.0 h1:EBmGv8NaZBZTWvrbjNoL6HVt+IVy3QDQpJs7VRIw3tU=
 golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.13.0 h1:Af8nKPmuFypiUBjVoU9V20FiaFXOcuZI21p0ycVYYGE=
+golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
+golang.org/x/term v0.0.0-20210503060354-a79de5458b56/go.mod h1:tfny5GFUkzUvx4ps4ajbZsCe5lw1metzhBm9T3x7oIY=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.1.0/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
 golang.org/x/term v0.4.0/go.mod h1:9P2UbLfCdcvo3p/nzKvsmas4TnlujnuoV9hGgYzW1lQ=
 golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
-golang.org/x/term v0.8.0 h1:n5xxQn2i3PC0yLAbjTpNT85q/Kgzcr2gIoX9OrJUols=
+golang.org/x/term v0.6.0/go.mod h1:m6U89DPEgQRMq3DNkDClhWw02AUbt2daBVO4cn4Hv9U=
+golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
+golang.org/x/term v0.13.0 h1:bb+I9cTfFazGW51MZqBVmZy7+JEJMouUHTUSKVQLBek=
+golang.org/x/term v0.13.0/go.mod h1:LTmsnFJwVN6bCy1rVCoS+qHT1HhALEFxKncY3WNNh4U=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.1-0.20181227161524-e6919f6577db/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.4/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
+golang.org/x/text v0.3.8/go.mod h1:E6s5w1FMmriuDzIBO73fBruAKo1PCIq6d2Q6DHfQ8WQ=
 golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.6.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.9.0 h1:2sjJmO8cDvYveuX97RDLsxlyUxLl+GHoLxBiRdHllBE=
+golang.org/x/text v0.8.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
 golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
+golang.org/x/text v0.13.0 h1:ablQoSUd0tRdKxZewP80B+BaqeKJuVhuRxj/dkrun3k=
+golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
@@ -1302,6 +1516,7 @@ golang.org/x/tools v0.0.0-20190606124116-d0a3d012864b/go.mod h1:/rFqwRUd4F7ZHNgw
 golang.org/x/tools v0.0.0-20190621195816-6e04913cbbac/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
 golang.org/x/tools v0.0.0-20190628153133-6cdbf07be9d0/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
 golang.org/x/tools v0.0.0-20190816200558-6889da9d5479/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20190907020128-2ca718005c18/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20190910044552-dd2b5c81c578/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20190911174233-4f2ddba30aff/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20191012152004-8de300cfc20a/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
@@ -1330,6 +1545,7 @@ golang.org/x/tools v0.0.0-20200501065659-ab2804fb9c9d/go.mod h1:EkVYQZoAsY45+roY
 golang.org/x/tools v0.0.0-20200512131952-2bc93b1c0c88/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20200515010526-7d3b6ebf133d/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20200618134242-20370b0cb4b2/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
+golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20200724022722-7017fd6b1305/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
 golang.org/x/tools v0.0.0-20200729194436-6467de6f59a7/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
 golang.org/x/tools v0.0.0-20200804011535-6c149bb5ef0d/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
@@ -1342,6 +1558,7 @@ golang.org/x/tools v0.0.0-20201110124207-079ba7bd75cd/go.mod h1:emZCQorbCU4vsT4f
 golang.org/x/tools v0.0.0-20201201161351-ac6f37ff4c2a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.0.0-20201208233053-a543418bbed2/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.0.0-20210105154028-b0ab187a4818/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
+golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.0.0-20210108195828-e2f9c7f1fc8e/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.1.0/go.mod h1:xkSsbof2nBLbhDlRMhhhyNLN/zl3eTqcnHD5viDpcZ0=
 golang.org/x/tools v0.1.1-0.20210205202024-ef80cdb6ec6d/go.mod h1:9bzcO0MWcOuT0tm1iBGzDVPshzfwoVvREIui8C+MHqU=
@@ -1359,8 +1576,8 @@ golang.org/x/tools v0.2.0/go.mod h1:y4OqIKeOV/fWJetJ8bXPU1sEVniLMIyDAZWeHdV+NTA=
 golang.org/x/tools v0.3.0/go.mod h1:/rWhSS2+zyEVwoJf8YAX6L2f0ntZ7Kn/mGgAWcipA5k=
 golang.org/x/tools v0.5.0/go.mod h1:N+Kgy78s5I24c24dU8OfWNEotWjutIs8SnJvn5IDq+k=
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
-golang.org/x/tools v0.9.3 h1:Gn1I8+64MsuTb/HpH+LmQtNas23LhUVr3rYZ0eKuaMM=
-golang.org/x/tools v0.9.3/go.mod h1:owI94Op576fPu3cIGQeHs3joujW/2Oc6MtlxbF5dfNc=
+golang.org/x/tools v0.14.0 h1:jvNa2pY0M4r62jkRQ6RwEZZyPcymeL9XZMLBbV7U2nc=
+golang.org/x/tools v0.14.0/go.mod h1:uYBEerGOWcJyEORxN+Ek8+TT266gXkNlHdJBwexUsBg=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -1418,8 +1635,8 @@ google.golang.org/api v0.96.0/go.mod h1:w7wJQLTM+wvQpNf5JyEcBoxK0RH7EDrh/L4qfsuJ
 google.golang.org/api v0.97.0/go.mod h1:w7wJQLTM+wvQpNf5JyEcBoxK0RH7EDrh/L4qfsuJ13s=
 google.golang.org/api v0.98.0/go.mod h1:w7wJQLTM+wvQpNf5JyEcBoxK0RH7EDrh/L4qfsuJ13s=
 google.golang.org/api v0.100.0/go.mod h1:ZE3Z2+ZOr87Rx7dqFsdRQkRBk36kDtp/h+QpHbB7a70=
-google.golang.org/api v0.103.0 h1:9yuVqlu2JCvcLg9p8S3fcFLZij8EPSyvODIY1rkMizQ=
-google.golang.org/api v0.103.0/go.mod h1:hGtW6nK1AC+d9si/UBhw8Xli+QMOf6xyNAyJw4qU9w0=
+google.golang.org/api v0.126.0 h1:q4GJq+cAdMAC7XP7njvQ4tvohGLiSlytuL4BQxbIZ+o=
+google.golang.org/api v0.126.0/go.mod h1:mBwVAtz+87bEN6CbA1GtZPDOqY2R5ONPqJeIlvyo4Aw=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
 google.golang.org/appengine v1.5.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
@@ -1430,6 +1647,7 @@ google.golang.org/appengine v1.6.7 h1:FZR1q0exgwxzPzp/aF+VccGrSfxfPpkBqjIIEq3ru6
 google.golang.org/appengine v1.6.7/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
 google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
 google.golang.org/genproto v0.0.0-20190307195333-5fe7a883aa19/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
+google.golang.org/genproto v0.0.0-20190404172233-64821d5d2107/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
 google.golang.org/genproto v0.0.0-20190418145605-e7d98fc518a7/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
 google.golang.org/genproto v0.0.0-20190425155659-357c62f0e4bb/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
 google.golang.org/genproto v0.0.0-20190502173448-54afdca5d873/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
@@ -1531,11 +1749,17 @@ google.golang.org/genproto v0.0.0-20221010155953-15ba04fc1c0e/go.mod h1:3526vdqw
 google.golang.org/genproto v0.0.0-20221014173430-6e2ab493f96b/go.mod h1:1vXfmgAz9N9Jx0QA82PqRVauvCz1SGSz739p0f183jM=
 google.golang.org/genproto v0.0.0-20221014213838-99cd37c6964a/go.mod h1:1vXfmgAz9N9Jx0QA82PqRVauvCz1SGSz739p0f183jM=
 google.golang.org/genproto v0.0.0-20221025140454-527a21cfbd71/go.mod h1:9qHF0xnpdSfF6knlcsnpzUu5y+rpwgbvsyGAZPBMg4s=
-google.golang.org/genproto v0.0.0-20230110181048-76db0878b65f h1:BWUVssLB0HVOSY78gIdvk1dTVYtT1y8SBWtPYuTJ/6w=
-google.golang.org/genproto v0.0.0-20230110181048-76db0878b65f/go.mod h1:RGgjbofJ8xD9Sq1VVhDM1Vok1vRONV+rg+CjzG4SZKM=
+google.golang.org/genproto v0.0.0-20230530153820-e85fd2cbaebc h1:8DyZCyvI8mE1IdLy/60bS+52xfymkE72wv1asokgtao=
+google.golang.org/genproto v0.0.0-20230530153820-e85fd2cbaebc/go.mod h1:xZnkP7mREFX5MORlOPEzLMr+90PPZQ2QWzrVTWfAq64=
+google.golang.org/genproto/googleapis/api v0.0.0-20230530153820-e85fd2cbaebc h1:kVKPf/IiYSBWEWtkIn6wZXwWGCnLKcC8oWfZvXjsGnM=
+google.golang.org/genproto/googleapis/api v0.0.0-20230530153820-e85fd2cbaebc/go.mod h1:vHYtlOoi6TsQ3Uk2yxR7NI5z8uoV+3pZtR4jmHIkRig=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20230530153820-e85fd2cbaebc h1:XSJ8Vk1SWuNr8S18z1NZSziL0CPIXLCCMDOEFtHBOFc=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20230530153820-e85fd2cbaebc/go.mod h1:66JfowdXAEgad5O9NnYcsNPLCPZJD++2L9X0PCMODrA=
+google.golang.org/grpc v1.14.0/go.mod h1:yo6s7OP7yaDglbqo1J04qKzAhqBH6lvTonzMVmEdcZw=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
 google.golang.org/grpc v1.21.1/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM=
+google.golang.org/grpc v1.22.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
 google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
 google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY=
 google.golang.org/grpc v1.26.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
@@ -1568,8 +1792,8 @@ google.golang.org/grpc v1.48.0/go.mod h1:vN9eftEi1UMyUsIF80+uQXhHjbXYbm0uXoFCACu
 google.golang.org/grpc v1.49.0/go.mod h1:ZgQEeidpAuNRZ8iRrlBKXZQP1ghovWIVhdJRyCDK+GI=
 google.golang.org/grpc v1.50.0/go.mod h1:ZgQEeidpAuNRZ8iRrlBKXZQP1ghovWIVhdJRyCDK+GI=
 google.golang.org/grpc v1.50.1/go.mod h1:ZgQEeidpAuNRZ8iRrlBKXZQP1ghovWIVhdJRyCDK+GI=
-google.golang.org/grpc v1.54.0 h1:EhTqbhiYeixwWQtAEZAxmV9MGqcjEU2mFx52xCzNyag=
-google.golang.org/grpc v1.54.0/go.mod h1:PUSEXI6iWghWaB6lXM4knEgpJNu2qUcKfDtNci3EC2g=
+google.golang.org/grpc v1.57.0 h1:kfzNeI/klCGD2YPMUlaGNT3pxvYfga7smW3Vth8Zsiw=
+google.golang.org/grpc v1.57.0/go.mod h1:Sd+9RMTACXwmub0zcNY2c4arhtrbBYD1AUHI/dt16Mo=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.1.0/go.mod h1:6Kw0yEErY5E/yWrBtf03jp27GLLJujG4z/JK95pnjjw=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
@@ -1586,9 +1810,10 @@ google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQ
 google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
 google.golang.org/protobuf v1.28.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
 google.golang.org/protobuf v1.28.1/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
-google.golang.org/protobuf v1.30.0 h1:kPPoIgf3TsEvrm0PFe15JQ+570QVxYzEvvHqChK+cng=
-google.golang.org/protobuf v1.30.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
+google.golang.org/protobuf v1.31.0 h1:g0LDEJHgrBl9N9r17Ru3sqWhkIx2NB67okBHPwC7hs8=
+google.golang.org/protobuf v1.31.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
 gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
+gopkg.in/asn1-ber.v1 v1.0.0-20181015200546-f715ec2f112d/go.mod h1:cuepJuh7vyXfUyUwEgHQXw849cJrilpS5NeIjOWESAw=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
@@ -1597,8 +1822,10 @@ gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntN
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
 gopkg.in/cheggaaa/pb.v1 v1.0.27/go.mod h1:V/YB90LKu/1FcN3WVnfiiE5oMCibMjukxqG/qStrOgw=
 gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
+gopkg.in/h2non/gock.v1 v1.1.2 h1:jBbHXgGBK/AoPVfJh5x4r/WxIrElvbLel8TCZkkZJoY=
 gopkg.in/ini.v1 v1.67.0 h1:Dgnx+6+nfE+IfzjUEISNeydPJh9AXNNsWbGP9KzCsOA=
 gopkg.in/ini.v1 v1.67.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
+gopkg.in/square/go-jose.v2 v2.3.1/go.mod h1:M9dMgbHiYLoDGQrXy7OpJDJWiKiU//h+vD76mk0e1AI=
 gopkg.in/warnings.v0 v0.1.2 h1:wFXVbFY8DY5/xOe1ECiWdKCzZlxgshcYVNkBHstARME=
 gopkg.in/warnings.v0 v0.1.2/go.mod h1:jksf8JmL6Qr/oQM2OXTHunEvvTAsrWBLb6OOjuVWRNI=
 gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
@@ -1611,6 +1838,8 @@ gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
 gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.0-20200605160147-a5ece683394c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
@@ -1620,8 +1849,8 @@ honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWh
 honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg=
 honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
 honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
-honnef.co/go/tools v0.4.3 h1:o/n5/K5gXqk8Gozvs2cnL0F2S1/g1vcGCAx2vETjITw=
-honnef.co/go/tools v0.4.3/go.mod h1:36ZgoUOrqOk1GxwHhyryEkq8FQWkUO2xGuSMhUCcdvA=
+honnef.co/go/tools v0.4.6 h1:oFEHCKeID7to/3autwsWfnuv69j3NsfcXbvJKuIcep8=
+honnef.co/go/tools v0.4.6/go.mod h1:+rnGS1THNh8zMwnd2oVOTL9QF6vmfyG6ZXBULae2uc0=
 mvdan.cc/gofumpt v0.5.0 h1:0EQ+Z56k8tXjj/6TQD25BFNKQXpCvT0rnansIc7Ug5E=
 mvdan.cc/gofumpt v0.5.0/go.mod h1:HBeVDtMKRZpXyxFciAirzdKklDlGu8aAy1wEbH5Y9js=
 mvdan.cc/interfacer v0.0.0-20180901003855-c20040233aed h1:WX1yoOaKQfddO/mLzdV4wptyWgoH/6hwLs7QHTixo0I=
@@ -1633,3 +1862,4 @@ mvdan.cc/unparam v0.0.0-20221223090309-7455f1af531d/go.mod h1:IeHQjmn6TOD+e4Z3RF
 rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
 rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=
 rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=
+sigs.k8s.io/yaml v1.2.0/go.mod h1:yfXDCHCao9+ENCvLSE62v9VSji2MKu5jeNfTrofGhJc=
diff --git a/.ci/tools/main.go b/.ci/tools/main.go
index 9651e086dd5..362a3679208 100644
--- a/.ci/tools/main.go
+++ b/.ci/tools/main.go
@@ -4,9 +4,10 @@
 package main
 
 import (
-	_ "github.com/bflad/tfproviderdocs"
+	_ "github.com/YakDriver/tfproviderdocs"
 	_ "github.com/client9/misspell/cmd/misspell"
 	_ "github.com/golangci/golangci-lint/cmd/golangci-lint"
+	_ "github.com/hashicorp/copywrite"
 	_ "github.com/hashicorp/go-changelog/cmd/changelog-build"
 	_ "github.com/katbyte/terrafmt"
 	_ "github.com/pavius/impi/cmd/impi"
diff --git a/.copywrite.hcl b/.copywrite.hcl
new file mode 100644
index 00000000000..86475faf338
--- /dev/null
+++ b/.copywrite.hcl
@@ -0,0 +1,18 @@
+schema_version = 1
+
+project {
+  license        = "MPL-2.0"
+  copyright_year = 2023
+
+  # (OPTIONAL) A list of globs that should not have copyright/license headers.
+  # Supports doublestar glob patterns for more flexibility in defining which
+  # files or folders should be ignored
+  header_ignore = [
+    ".ci/**",
+    ".github/**",
+    ".teamcity/**",
+    ".release/**",
+    "infrastructure/repository/labels-service.tf",
+    ".goreleaser.yml",
+  ]
+}
diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json
new file mode 100644
index 00000000000..28f6b1a060f
--- /dev/null
+++ b/.devcontainer/devcontainer.json
@@ -0,0 +1,7 @@
+// For format details, see https://aka.ms/devcontainer.json. For config options, see the
+// README at: https://github.com/devcontainers/templates/tree/main/src/go
+{
+	"name": "Go",
+	// Or use a Dockerfile or Docker Compose file. More info: https://containers.dev/guide/dockerfile
+	"image": "mcr.microsoft.com/devcontainers/go:1.20"
+}
diff --git a/.github/ISSUE_TEMPLATE/00_bug_report.yml b/.github/ISSUE_TEMPLATE/00_bug_report.yml
index 63d3bfbf00c..882d6ba8be4 100644
--- a/.github/ISSUE_TEMPLATE/00_bug_report.yml
+++ b/.github/ISSUE_TEMPLATE/00_bug_report.yml
@@ -1,7 +1,7 @@
 name: "Report a Bug"
 description: "Choose this option to let us know about an unexpected error, a crash, or otherwise incorrect behavior."
 title: "[Bug]: "
-labels: ["bug", "needs-triage"]
+labels: ["bug"]
 body:
   - type: markdown
     attributes:
diff --git a/.github/ISSUE_TEMPLATE/01_documentation.yml b/.github/ISSUE_TEMPLATE/01_documentation.yml
index a999274a10c..c07e67fe023 100644
--- a/.github/ISSUE_TEMPLATE/01_documentation.yml
+++ b/.github/ISSUE_TEMPLATE/01_documentation.yml
@@ -1,7 +1,7 @@
 name: "Report a Documentation Error"
 description: "Choose this option if you've found an error in the provider documentation or contribution guides."
 title: "[Docs]: "
-labels: ["documentation", "needs-triage"]
+labels: ["documentation"]
 body:
   - type: markdown
     attributes:
diff --git a/.github/ISSUE_TEMPLATE/02_enhancement.yml b/.github/ISSUE_TEMPLATE/02_enhancement.yml
index 2abdf6cfcab..b3c54c39786 100644
--- a/.github/ISSUE_TEMPLATE/02_enhancement.yml
+++ b/.github/ISSUE_TEMPLATE/02_enhancement.yml
@@ -1,7 +1,7 @@
 name: "Request an Enhancement"
 description: "Choose this option when you would like to request an enhancement to an existing resource, data source, or the provider itself."
 title: "[Enhancement]: "
-labels: ["enhancement", "needs-triage"]
+labels: ["enhancement"]
 body:
   - type: markdown
     attributes:
diff --git a/.github/ISSUE_TEMPLATE/03_new_resource.yml b/.github/ISSUE_TEMPLATE/03_new_resource.yml
index d009e76fbb1..44dfd3244e2 100644
--- a/.github/ISSUE_TEMPLATE/03_new_resource.yml
+++ b/.github/ISSUE_TEMPLATE/03_new_resource.yml
@@ -1,7 +1,6 @@
 name: "Request a New Resource, Data Source, or AWS Service"
 description: "Choose this option to request an entirely new resource, data source, or AWS service be added to the provider."
 title: "[New]: "
-labels: ["needs-triage"]
 body:
   - type: markdown
     attributes:
diff --git a/.github/ISSUE_TEMPLATE/04_repository.yml b/.github/ISSUE_TEMPLATE/04_repository.yml
index 9b11f218b4d..5952b267804 100644
--- a/.github/ISSUE_TEMPLATE/04_repository.yml
+++ b/.github/ISSUE_TEMPLATE/04_repository.yml
@@ -1,7 +1,7 @@
 name: "Repository/Meta"
 description: Choose this option when the issue has to do with the repository itself, including GitHub Actions, labels, workflows, etc.
 title: "[Repo]: "
-labels: ["repository", "needs-triage"]
+labels: ["repository"]
 body:
   - type: markdown
     attributes:
diff --git a/.github/ISSUE_TEMPLATE/05_other.yml b/.github/ISSUE_TEMPLATE/05_other.yml
index 0450f756016..8eafc99eb11 100644
--- a/.github/ISSUE_TEMPLATE/05_other.yml
+++ b/.github/ISSUE_TEMPLATE/05_other.yml
@@ -1,6 +1,5 @@
 name: "Other"
 description: "Choose this option if your issue does not fit the description of the others."
-labels: ["needs-triage"]
 body:
   - type: markdown
     attributes:
diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
index fb840ce3860..5487b0d90d3 100644
--- a/.github/PULL_REQUEST_TEMPLATE.md
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@@ -35,8 +35,8 @@ Replace ec2 with the service package corresponding to your tests.
 For more information on the `-run` flag, see the `go test` documentation at https://tip.golang.org/cmd/go/#hdr-Testing_flags.
 -->
 
-```
-$ make testacc TESTS=TestAccXXX PKG=ec2
+```console
+% make testacc TESTS=TestAccXXX PKG=ec2
 
 ...
 ```
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 3e06ccdb1b5..1154c60bc56 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,11 +1,30 @@
 version: 2
 updates:
-  - package-ecosystem: "github-actions"
-    directory: "/"
+  - directory: "/"
+    package-ecosystem: "github-actions"
     schedule:
       interval: "daily"
-  - package-ecosystem: "gomod"
-    directory: "/"
+
+  - directory: "/"
+    package-ecosystem: "gomod"
+    groups:
+      aws-sdk-go:
+        patterns:
+          - "github.com/aws/aws-sdk-go"
+          - "github.com/aws/aws-sdk-go-v2"
+          - "github.com/aws/aws-sdk-go-v2/*"
+      aws-sdk-go-base:
+        patterns:
+          - "github.com/hashicorp/aws-sdk-go-base/v2"
+          - "github.com/hashicorp/aws-sdk-go-base/v2/*"
+      terraform-devex:
+        patterns:
+          - "github.com/hashicorp/terraform-plugin-framework"
+          - "github.com/hashicorp/terraform-plugin-framework-timeouts"
+          - "github.com/hashicorp/terraform-plugin-framework-validators"
+          - "github.com/hashicorp/terraform-plugin-mux"
+          - "github.com/hashicorp/terraform-plugin-sdk/v2"
+          - "github.com/hashicorp/terraform-plugin-testing"
     ignore:
       # hcl/v2 should only be updated via terraform-plugin-sdk
       - dependency-name: "github.com/hashicorp/hcl/v2"
@@ -20,28 +39,44 @@ updates:
     schedule:
       interval: "daily"
     open-pull-requests-limit: 30
-  - package-ecosystem: "gomod"
-    directory: "/.ci/providerlint"
+
+  - directory: "/.ci/providerlint"
+    package-ecosystem: "gomod"
     ignore:
       - dependency-name: "golang.org/x/tools"
       - dependency-name: "google.golang.org/grpc"
     schedule:
       interval: "daily"
-  - package-ecosystem: "gomod"
-    directory: "/.ci/tools"
+
+  - directory: "/.ci/tools"
+    package-ecosystem: "gomod"
     ignore:
       - dependency-name: "golang.org/x/tools"
       - dependency-name: "google.golang.org/grpc"
     schedule:
       interval: "daily"
-  - package-ecosystem: "gomod"
-    directory: "/skaff"
+
+  - directory: "/skaff"
+    package-ecosystem: "gomod"
     ignore:
       - dependency-name: "golang.org/x/tools"
       - dependency-name: "google.golang.org/grpc"
     schedule:
       interval: "daily"
-  - package-ecosystem: "terraform"
-    directory: "/infrastructure/repository"
+
+  - directory: "/tools/tfsdk2fw"
+    package-ecosystem: "gomod"
+    allow:
+      - dependency-type: direct
+    ignore:
+      # terraform-plugin-sdk/v2 should only be updated via terraform-provider-aws
+      - dependency-name: "github.com/hashicorp/terraform-plugin-sdk/v2"
+      - dependency-name: "golang.org/x/tools"
+      - dependency-name: "google.golang.org/grpc"
+    schedule:
+      interval: "daily"
+
+  - directory: "/infrastructure/repository"
+    package-ecosystem: "terraform"
     schedule:
       interval: "daily"
diff --git a/.github/labeler-issue-triage.yml b/.github/labeler-issue-triage.yml
index db45cd30ab3..49114209abf 100644
--- a/.github/labeler-issue-triage.yml
+++ b/.github/labeler-issue-triage.yml
@@ -87,6 +87,8 @@ service/backupgateway:
   - '((\*|-)\s*`?|(data|resource)\s+"?)aws_backupgateway_'
 service/batch:
   - '((\*|-)\s*`?|(data|resource)\s+"?)aws_batch_'
+service/bedrock:
+  - '((\*|-)\s*`?|(data|resource)\s+"?)aws_bedrock_'
 service/billingconductor:
   - '((\*|-)\s*`?|(data|resource)\s+"?)aws_billingconductor_'
 service/braket:
@@ -133,6 +135,8 @@ service/codeartifact:
   - '((\*|-)\s*`?|(data|resource)\s+"?)aws_codeartifact_'
 service/codebuild:
   - '((\*|-)\s*`?|(data|resource)\s+"?)aws_codebuild_'
+service/codecatalyst:
+  - '((\*|-)\s*`?|(data|resource)\s+"?)aws_codecatalyst_'
 service/codecommit:
   - '((\*|-)\s*`?|(data|resource)\s+"?)aws_codecommit_'
 service/codeguruprofiler:
@@ -375,12 +379,12 @@ service/lambda:
   - '((\*|-)\s*`?|(data|resource)\s+"?)aws_lambda_'
 service/lexmodels:
   - '((\*|-)\s*`?|(data|resource)\s+"?)aws_lex_'
-service/lexmodelsv2:
-  - '((\*|-)\s*`?|(data|resource)\s+"?)aws_lexmodelsv2_'
 service/lexruntime:
   - '((\*|-)\s*`?|(data|resource)\s+"?)aws_lexruntime_'
 service/lexruntimev2:
   - '((\*|-)\s*`?|(data|resource)\s+"?)aws_lexruntimev2_'
+service/lexv2models:
+  - '((\*|-)\s*`?|(data|resource)\s+"?)aws_lexv2models_'
 service/licensemanager:
   - '((\*|-)\s*`?|(data|resource)\s+"?)aws_licensemanager_'
 service/lightsail:
@@ -643,6 +647,8 @@ service/translate:
   - '((\*|-)\s*`?|(data|resource)\s+"?)aws_translate_'
 service/verifiedaccess:
   - '((\*|-)\s*`?|(data|resource)\s+"?)aws_verifiedaccess'
+service/verifiedpermissions:
+  - '((\*|-)\s*`?|(data|resource)\s+"?)aws_verifiedpermissions_'
 service/voiceid:
   - '((\*|-)\s*`?|(data|resource)\s+"?)aws_voiceid_'
 service/vpc:
diff --git a/.github/labeler-pr-triage.yml b/.github/labeler-pr-triage.yml
index c291ad111bc..c925a6637de 100644
--- a/.github/labeler-pr-triage.yml
+++ b/.github/labeler-pr-triage.yml
@@ -26,7 +26,7 @@ linter:
   - '.github/workflows/acctest-terraform-lint.yml'
   - '.github/workflows/providerlint.yml'
   - '.github/workflows/semgrep-ci.yml'
-  - '.github/workflows/terraform_provider.yml'
+  - '.github/workflows/provider.yml'
   - '.github/workflows/website.yml'
   - '.github/workflows/workflow-lint.yml'
 pre-service-packages:
@@ -155,6 +155,9 @@ service/backupgateway:
 service/batch:
   - 'internal/service/batch/**/*'
   - 'website/**/batch_*'
+service/bedrock:
+  - 'internal/service/bedrock/**/*'
+  - 'website/**/bedrock_*'
 service/billingconductor:
   - 'internal/service/billingconductor/**/*'
   - 'website/**/billingconductor_*'
@@ -226,6 +229,9 @@ service/codeartifact:
 service/codebuild:
   - 'internal/service/codebuild/**/*'
   - 'website/**/codebuild_*'
+service/codecatalyst:
+  - 'internal/service/codecatalyst/**/*'
+  - 'website/**/codecatalyst_*'
 service/codecommit:
   - 'internal/service/codecommit/**/*'
   - 'website/**/codecommit_*'
@@ -358,6 +364,7 @@ service/ec2:
   - 'website/**/ec2_capacity_*'
   - 'website/**/ec2_fleet*'
   - 'website/**/ec2_host*'
+  - 'website/**/ec2_image_*'
   - 'website/**/ec2_instance_*'
   - 'website/**/ec2_public_ipv4_pool*'
   - 'website/**/ec2_serial_*'
@@ -620,15 +627,15 @@ service/lambda:
 service/lexmodels:
   - 'internal/service/lexmodels/**/*'
   - 'website/**/lex_*'
-service/lexmodelsv2:
-  - 'internal/service/lexmodelsv2/**/*'
-  - 'website/**/lexmodelsv2_*'
 service/lexruntime:
   - 'internal/service/lexruntime/**/*'
   - 'website/**/lexruntime_*'
 service/lexruntimev2:
   - 'internal/service/lexruntimev2/**/*'
   - 'website/**/lexruntimev2_*'
+service/lexv2models:
+  - 'internal/service/lexv2models/**/*'
+  - 'website/**/lexv2models_*'
 service/licensemanager:
   - 'internal/service/licensemanager/**/*'
   - 'website/**/licensemanager_*'
@@ -677,7 +684,7 @@ service/marketplacemetering:
   - 'website/**/marketplacemetering_*'
 service/mediaconnect:
   - 'internal/service/mediaconnect/**/*'
-  - 'website/**/media_connect_*'
+  - 'website/**/mediaconnect_*'
 service/mediaconvert:
   - 'internal/service/mediaconvert/**/*'
   - 'website/**/media_convert_*'
@@ -1042,7 +1049,10 @@ service/translate:
   - 'website/**/translate_*'
 service/verifiedaccess:
   - 'internal/service/ec2/**/verifiedaccess_*'
-  - 'website/**/verifiedaccess*'
+  - 'website/**/verifiedaccess_*'
+service/verifiedpermissions:
+  - 'internal/service/verifiedpermissions/**/*'
+  - 'website/**/verifiedpermissions_*'
 service/voiceid:
   - 'internal/service/voiceid/**/*'
   - 'website/**/voiceid_*'
diff --git a/.github/workflows/acctest-terraform-lint.yml b/.github/workflows/acctest-terraform-lint.yml
index b378915d9ee..4e0ce9d305e 100644
--- a/.github/workflows/acctest-terraform-lint.yml
+++ b/.github/workflows/acctest-terraform-lint.yml
@@ -17,11 +17,11 @@ jobs:
   terrafmt:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9
-      - uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
         with:
           go-version-file: go.mod
-      - uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8
+      - uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
         continue-on-error: true
         timeout-minutes: 2
         with:
@@ -37,7 +37,7 @@ jobs:
 
   tflint:
     name: Validate Acceptance Tests
-    runs-on: [custom, linux, medium]
+    runs-on: [custom, linux, xl]
     strategy:
       matrix:
         path: ['[a-f]', '[g-z]']
@@ -45,17 +45,17 @@ jobs:
       TEST_FILES_PARTITION: '\./internal/service/${{ matrix.path }}.*/.*_test\.go'
 
     steps:
-      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9
-      - uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
         with:
           go-version-file: go.mod
-      - uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8
+      - uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
         continue-on-error: true
         timeout-minutes: 2
         with:
           path: ~/go/pkg/mod
           key: ${{ runner.os }}-go-pkg-mod-${{ hashFiles('go.sum') }}
-      - uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8
+      - uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
         name: Cache plugin dir
         continue-on-error: true
         timeout-minutes: 2
diff --git a/.github/workflows/autoremove_labels.yml b/.github/workflows/autoremove_labels.yml
deleted file mode 100644
index e090fb6a626..00000000000
--- a/.github/workflows/autoremove_labels.yml
+++ /dev/null
@@ -1,27 +0,0 @@
-name: Autoremove Labels
-
-on:
-  issues:
-    types: [closed, opened]
-  pull_request_target:
-    types: [closed]
-
-jobs:
-  community_check:
-    uses: ./.github/workflows/community-check.yml
-    secrets: inherit
-
-  RemoveNeedsTriageFromMaintainers:
-    name: 'Remove needs-triage for Maintainers'
-    needs: community_check
-    if: github.event.action == 'opened' && needs.community_check.outputs.maintainer == 'true'
-    uses: ./.github/workflows/reusable-add-or-remove-labels.yml
-    with:
-      remove: needs-triage
-
-  RemoveTriagingLabelsFromClosedIssueOrPR:
-    name: 'Remove Triaging Labels from Closed Items'
-    if: github.event.action == 'closed'
-    uses: ./.github/workflows/reusable-add-or-remove-labels.yml
-    with:
-      remove: needs-triage,waiting-response
diff --git a/.github/workflows/cdktf-documentation.yml b/.github/workflows/cdktf-documentation.yml
index 2a28184f20a..287dd94a080 100644
--- a/.github/workflows/cdktf-documentation.yml
+++ b/.github/workflows/cdktf-documentation.yml
@@ -9,49 +9,30 @@ permissions:
   pull-requests: write
 
 jobs:
-  cdktfDocs:
-    runs-on:
-      - custom
-      - linux
-      - custom-linux-medium
-    container:
-      image: docker.mirror.hashicorp.services/hashicorp/jsii-terraform
-    env:
-      CHECKPOINT_DISABLE: "1"
-    timeout-minutes: 120
+  generateToken:
+    runs-on: ubuntu-latest
+    outputs:
+      token: ${{ steps.generate_token.outputs.token }}
     steps:
-      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
-      - run: git config --global user.email "github-team-tf-cdk@hashicorp.com"
-      - run: git config --global user.name "team-tf-cdk"
-      - name: Get yarn cache directory path
-        id: global-cache-dir-path
-        run: echo "dir=$(yarn cache dir)" >> $GITHUB_OUTPUT
-      - uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
-        id: global-cache
-        with:
-          path: ${{ steps.global-cache-dir-path.outputs.dir }}
-          key: ${{ runner.os }}-integration-yarn-${{ hashFiles('**/yarn.lock') }}
-      - name: Setup Node.js
-        uses: actions/setup-node@64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c # v3.6.0
+      - name: Generate Token
+        id: generate_token
+        uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a # v2.1.0
         with:
-          node-version: "18.x"
-      - name: Install cdktf-registry-docs
-        run: npm install -g cdktf-registry-docs@1.12.0
-      - name: Run conversion
-        run: |
-          cdktf-registry-docs convert \
-            --files='*/ec2_*.html.markdown' \
-            --languages='typescript,python' \
-            --parallel-file-conversions=1 \
-            --provider-from-registry="hashicorp/aws" \
-            .
-        env:
-          TF_PLUGIN_CACHE_DIR: ${{ steps.global-cache-dir-path.outputs.dir }}/terraform-plugins
+          app_id: ${{ secrets.APP_ID }}
+          installation_retrieval_mode: id
+          installation_retrieval_payload: ${{ secrets.INSTALLATION_ID }}
+          private_key: ${{secrets.APP_PEM }}
 
-      - name: Create Pull Request
-        uses: peter-evans/create-pull-request@153407881ec5c347639a548ade7d8ad1d6740e38 # v5.0.2
-        with:
-          commit-message: "docs: update cdktf documentation"
-          title: "docs: update cdktf documentation"
-          body: "This PR updates the cdktf related documentation based on the current HCL-based documentation. It is automatically created by the cdktf-documentation GitHub action."
-          token: ${{ secrets.ORGSCOPED_GITHUB_TOKEN }}
+  cdktfDocs:
+    needs:
+      - generateToken
+    uses: hashicorp/terraform-cdk/.github/workflows/registry-docs-pr-based.yml@304e2507209c9657135dc7b4b7ee68030327468f
+    secrets:
+      GH_PR_TOKEN: ${{ needs.generateToken.outputs.token }}
+    with:
+      providerFqn: "hashicorp/aws"
+      languages: "typescript,python"
+      files: "d/*.html.markdown,r/*.html.markdown"
+      parallelFileConversions: 1
+      maxRunners: 20
+      cdktfRegistryDocsVersion: "1.14.2"
diff --git a/.github/workflows/changelog.yml b/.github/workflows/changelog.yml
index 315cc3bc167..45c61c3ea67 100644
--- a/.github/workflows/changelog.yml
+++ b/.github/workflows/changelog.yml
@@ -8,8 +8,11 @@ on:
 
 jobs:
   community_check:
+    if: github.event_name == 'pull_request_target'
     uses: ./.github/workflows/community-check.yml
     secrets: inherit
+    with:
+      username: ${{ github.event.pull_request.user.login }}
 
   changes:
     needs: community_check
@@ -18,8 +21,8 @@ jobs:
     outputs:
       changed: ${{ steps.filter.outputs.changed }}
     steps:
-      - uses: dorny/paths-filter@4512585405083f25c027a35db413c2b3b9006d50
-        if: github.event_name == 'pull_request_target' && needs.community_check.outputs.maintainer == 'false'
+      - uses: dorny/paths-filter@4512585405083f25c027a35db413c2b3b9006d50 # v2.11.1
+        if: needs.community_check.outputs.maintainer == 'false'
         id: filter
         with:
           filters: |
@@ -34,7 +37,7 @@ jobs:
     steps:
       - name: Find Existing PR Comment
         id: prc
-        uses: peter-evans/find-comment@a54c31d7fa095754bfef525c0c8e5e5674c4b4b1
+        uses: peter-evans/find-comment@a54c31d7fa095754bfef525c0c8e5e5674c4b4b1 # v2.4.0
         with:
           issue-number: ${{ github.event.pull_request.number }}
           comment-author: "github-actions[bot]"
@@ -42,7 +45,7 @@ jobs:
       - run: echo ${{ steps.prc.outputs.comment-id }}
       - name: PR Comment
         if: steps.prc.outputs.comment-id == ''
-        uses: peter-evans/create-or-update-comment@c6c9a1a66007646a28c153e2a8580a5bad27bcfa
+        uses: peter-evans/create-or-update-comment@23ff15729ef2fc348714a3bb66d2f655ca9066f2 # v3.1.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
diff --git a/.github/workflows/changelog_misspell.yml b/.github/workflows/changelog_misspell.yml
index 115da54c72a..7b7999906c7 100644
--- a/.github/workflows/changelog_misspell.yml
+++ b/.github/workflows/changelog_misspell.yml
@@ -14,11 +14,11 @@ jobs:
   misspell:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9
-      - uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
         with:
           go-version-file: go.mod
-      - uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8
+      - uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
         continue-on-error: true
         timeout-minutes: 2
         with:
diff --git a/.github/workflows/community-check.yml b/.github/workflows/community-check.yml
index 07d40497eae..cf18e5ca6e4 100644
--- a/.github/workflows/community-check.yml
+++ b/.github/workflows/community-check.yml
@@ -2,12 +2,21 @@ name: Community Check
 
 on:
   workflow_call:
+    inputs:
+      username:
+        description: The username to check the association of
+        type: string
+        required: true
+
     outputs:
       core_contributor:
+        description: Whether or not the user is a core contributor
         value: ${{ jobs.community_check.outputs.is_core_contributor }}
       maintainer:
+        description: Whether or not the user is a maintainer
         value: ${{ jobs.community_check.outputs.is_maintainer }}
       partner:
+        description: Whether or not the user is a partner
         value: ${{ jobs.community_check.outputs.is_partner }}
 
 jobs:
@@ -40,13 +49,10 @@ jobs:
           echo "core_contributors_list=$CORE_CONTRIBUTORS_DECODED" >> $GITHUB_OUTPUT
           echo "maintainers_list=$MAINTAINERS_DECODED" >> $GITHUB_OUTPUT
           echo "partners_list=$PARTNERS_DECODED" >> $GITHUB_OUTPUT
+
       - name: Determine if user is in lists
         id: determination
-        env:
-          IS_CORE_CONTRIBUTOR: ${{ contains(fromJSON(steps.decode.outputs.core_contributors_list), github.actor) }}
-          IS_MAINTAINER: ${{ contains(fromJSON(steps.decode.outputs.maintainers_list), github.actor) }}
-          IS_PARTNER: ${{ contains(fromJSON(steps.decode.outputs.partners_list), github.actor) }}
         run: |
-          echo "is_core_contributor=$IS_CORE_CONTRIBUTOR" >> $GITHUB_OUTPUT
-          echo "is_maintainer=$IS_MAINTAINER" >> $GITHUB_OUTPUT
-          echo "is_partner=$IS_PARTNER" >> $GITHUB_OUTPUT
+          echo "is_core_contributor="${{ contains(fromJSON(steps.decode.outputs.core_contributors_list), inputs.username) }} >> $GITHUB_OUTPUT
+          echo "is_maintainer="${{ contains(fromJSON(steps.decode.outputs.maintainers_list), inputs.username) }} >> $GITHUB_OUTPUT
+          echo "is_partner="${{ contains(fromJSON(steps.decode.outputs.partners_list), inputs.username) }} >> $GITHUB_OUTPUT
diff --git a/.github/workflows/community-comment.yml b/.github/workflows/community-comment.yml
deleted file mode 100644
index a854300f1b4..00000000000
--- a/.github/workflows/community-comment.yml
+++ /dev/null
@@ -1,50 +0,0 @@
-on:
-  issues:
-    types: [opened]
-  pull_request_target:
-    types: [opened]
-
-name: Add Community Note to Issues and PRs
-
-jobs:
-  AddCommunityComment:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Add community note to new Issues
-        if: github.event_name == 'issues'
-        uses: peter-evans/create-or-update-comment@c6c9a1a66007646a28c153e2a8580a5bad27bcfa
-        with:
-          issue-number: ${{ github.event.issue.number }}
-          body: |
-            # Community Note
-
-            **Voting for Prioritization**
-
-            * Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original post to help the community and maintainers prioritize this request.
-            * Please see our [prioritization guide](https://hashicorp.github.io/terraform-provider-aws/prioritization/) for information on how we prioritize.
-            * Please **do not** leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.
-
-            **Volunteering to Work on This Issue**
-
-            * If you are interested in working on this issue, please leave a comment.
-            * If this would be your first contribution, please review the [contribution guide](https://hashicorp.github.io/terraform-provider-aws/).
-
-      - name: Add community note to new Pull Requests
-        uses: peter-evans/create-or-update-comment@c6c9a1a66007646a28c153e2a8580a5bad27bcfa
-        if: github.event_name == 'pull_request_target'
-        with:
-          issue-number: ${{ github.event.pull_request.number }}
-          body: |
-            # Community Note
-
-            **Voting for Prioritization**
-
-            * Please vote on this pull request by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original post to help the community and maintainers prioritize this pull request.
-            * Please see our [prioritization guide](https://hashicorp.github.io/terraform-provider-aws/prioritization/) for information on how we prioritize.
-            * Please **do not** leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.
-
-            **For Submitters**
-
-            * Review the [contribution guide](https://hashicorp.github.io/terraform-provider-aws/) relating to the type of change you are making to ensure all of the necessary steps have been taken.
-            * For new resources and data sources, use [skaff](https://hashicorp.github.io/terraform-provider-aws/skaff/) to generate scaffolding with comments detailing common expectations.
-            * Whether or not the branch has been rebased will **not** impact prioritization, but doing so is always a welcome surprise.
diff --git a/.github/workflows/copyright.yml b/.github/workflows/copyright.yml
new file mode 100644
index 00000000000..4320b20c23c
--- /dev/null
+++ b/.github/workflows/copyright.yml
@@ -0,0 +1,47 @@
+name: Copyright Checks
+
+on:
+  push:
+    branches:
+      - main
+      - "release/**"
+  pull_request:
+    paths-ignore:
+      - .ci/**
+      - .github/**
+      - .teamcity/**
+      - .release/**
+      - infrastructure/repository/labels-service.tf
+      - .goreleaser.yml
+
+jobs:
+  go_generate:
+    name: add headers check
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
+        with:
+          go-version-file: go.mod
+      # See also: https://github.com/actions/setup-go/issues/54
+      - name: go env
+        run: |
+          echo "GOCACHE=$(go env GOCACHE)" >> $GITHUB_ENV
+      - uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
+        continue-on-error: true
+        timeout-minutes: 2
+        with:
+          path: ${{ env.GOCACHE }}
+          key: ${{ runner.os }}-GOCACHE-${{ hashFiles('go.sum') }}-${{ hashFiles('internal/**') }}
+      - uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
+        continue-on-error: true
+        timeout-minutes: 2
+        with:
+          path: ~/go/pkg/mod
+          key: ${{ runner.os }}-go-pkg-mod-${{ hashFiles('go.sum') }}
+      - run: go install github.com/hashicorp/copywrite@latest
+      - run: copywrite headers
+      - name: Check for Git Differences
+        run: |
+          git diff --compact-summary --exit-code || \
+            (echo; echo "Unexpected difference in directories after adding copyright headers. Run 'copywrite headers' command and commit."; exit 1)
diff --git a/.github/workflows/dependencies.yml b/.github/workflows/dependencies.yml
index 21a15ae8a86..08669ae7adb 100644
--- a/.github/workflows/dependencies.yml
+++ b/.github/workflows/dependencies.yml
@@ -9,8 +9,11 @@ on:
 
 jobs:
   community_check:
+    if: github.event_name == 'pull_request_target'
     uses: ./.github/workflows/community-check.yml
     secrets: inherit
+    with:
+      username: ${{ github.event.pull_request.user.login }}
 
   changes:
     needs: community_check
@@ -19,8 +22,8 @@ jobs:
     outputs:
       changed: ${{ steps.filter.outputs.changed }}
     steps:
-      - uses: dorny/paths-filter@4512585405083f25c027a35db413c2b3b9006d50
-        if: github.event_name == 'pull_request_target' && needs.community_check.outputs.maintainer == 'false'
+      - uses: dorny/paths-filter@4512585405083f25c027a35db413c2b3b9006d50 # v2.11.1
+        if: needs.community_check.outputs.maintainer == 'false'
         id: filter
         with:
           filters: |
@@ -37,7 +40,7 @@ jobs:
     steps:
       - name: Find Existing PR Comment
         id: prc
-        uses: peter-evans/find-comment@a54c31d7fa095754bfef525c0c8e5e5674c4b4b1
+        uses: peter-evans/find-comment@a54c31d7fa095754bfef525c0c8e5e5674c4b4b1 # v2.4.0
         with:
           issue-number: ${{ github.event.pull_request.number }}
           comment-author: "github-actions[bot]"
@@ -45,7 +48,7 @@ jobs:
       - run: echo ${{ steps.prc.outputs.comment-id }}
       - name: PR Comment
         if: steps.prc.outputs.comment-id == ''
-        uses: peter-evans/create-or-update-comment@c6c9a1a66007646a28c153e2a8580a5bad27bcfa
+        uses: peter-evans/create-or-update-comment@23ff15729ef2fc348714a3bb66d2f655ca9066f2 # v3.1.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
@@ -60,15 +63,15 @@ jobs:
             * Check [open pull requests with the `dependencies` label](https://github.com/hashicorp/terraform-provider-aws/pulls?q=is%3Aopen+is%3Apr+label%3Adependencies) to view other dependency updates.
             * If this pull request includes an update the AWS Go SDK (or any other dependency) version, only updates submitted via dependabot will be merged. This pull request will need to remove these changes and will need to be rebased after the existing dependency update via dependabot has been merged for this pull request to be reviewed.
             * If this pull request is for supporting a new AWS service:
-              * Ensure the new AWS service changes are following the [Contributing Guide section on new services](https://github.com/hashicorp/terraform-provider-aws/blob/main/docs/contributing/contribution-checklists.md#new-service), in particular that the dependency addition and initial provider support are in a separate pull request from other changes (e.g. new resources). Contributions not following this item will not be reviewed until the changes are split.
+              * Ensure the new AWS service changes are following the [Contributing Guide section on new services](https://github.com/hashicorp/terraform-provider-aws/blob/main/docs/add-a-new-service.md), in particular that the dependency addition and initial provider support are in a separate pull request from other changes (e.g. new resources). Contributions not following this item will not be reviewed until the changes are split.
               * If this pull request is already a separate pull request from the above item, you can ignore this message.
 
   go_mod:
     name: go mod
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9
-      - uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
         with:
           go-version-file: go.mod
       - name: go mod
diff --git a/.github/workflows/documentation.yml b/.github/workflows/documentation.yml
index b5dc6d3a645..f5791f537b0 100644
--- a/.github/workflows/documentation.yml
+++ b/.github/workflows/documentation.yml
@@ -17,8 +17,8 @@ jobs:
     env:
       UV_THREADPOOL_SIZE: 128
     steps:
-      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9
-      - uses: YakDriver/md-check-links@9044b7162323b91150cef35355e1a3514564aa82
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: YakDriver/md-check-links@7450f426b758f0bf97f99ceb1aadcf57640a9ede # v2.0.6
         with:
           use-quiet-mode: 'yes'
           use-verbose-mode: 'yes'
@@ -30,18 +30,18 @@ jobs:
   markdown-lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9
-      - uses: avto-dev/markdown-lint@04d43ee9191307b50935a753da3b775ab695eceb
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: avto-dev/markdown-lint@04d43ee9191307b50935a753da3b775ab695eceb # v1.5.0
         with:
           args: 'docs'
   misspell:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9
-      - uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
         with:
           go-version-file: go.mod
-      - uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8
+      - uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
         continue-on-error: true
         timeout-minutes: 2
         with:
diff --git a/.github/workflows/examples.yml b/.github/workflows/examples.yml
index 337c7504eff..649892d8e68 100644
--- a/.github/workflows/examples.yml
+++ b/.github/workflows/examples.yml
@@ -18,21 +18,21 @@ jobs:
   tflint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
           fetch-depth: 0
-      - uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8
+      - uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
         with:
           path: ~/go/pkg/mod
           key: ${{ runner.os }}-go-pkg-mod-${{ hashFiles('go.sum') }}
-      - uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753
+      - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
         with:
           go-version-file: go.mod
 
       - name: install tflint
         run: cd .ci/tools && go install github.com/terraform-linters/tflint
 
-      - uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8
+      - uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
         name: Cache plugin dir
         with:
           path: ~/.tflint.d/plugins
@@ -59,7 +59,7 @@ jobs:
           exit $exit_code
 
   validate-terraform:
-    runs-on: ubuntu-latest
+    runs-on: [custom, linux, large]
     strategy:
       fail-fast: false
       matrix:
@@ -67,14 +67,14 @@ jobs:
     env:
       TF_IN_AUTOMATION: "1"
     steps:
-      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
           fetch-depth: 0
-      - uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8
+      - uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
         with:
           path: ~/go/pkg/mod
           key: ${{ runner.os }}-go-pkg-mod-${{ hashFiles('go.sum') }}
-      - uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753
+      - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
         with:
           go-version-file: go.mod
       - name: go build
diff --git a/.github/workflows/firewatch.yml b/.github/workflows/firewatch.yml
index 4cba48794f4..b574606f1be 100644
--- a/.github/workflows/firewatch.yml
+++ b/.github/workflows/firewatch.yml
@@ -9,7 +9,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Firewatch
-        uses: breathingdust/firewatch@d44ea4b76b7ed38b97cfe8b0388cfc249ef1c7f2
+        uses: breathingdust/firewatch@d44ea4b76b7ed38b97cfe8b0388cfc249ef1c7f2 # v2.0.4
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           alert_threshold: 10
@@ -17,7 +17,7 @@ jobs:
           slack_token: ${{ secrets.SLACK_BOT_TOKEN }}
           slack_channel: ${{ secrets.SLACK_CHANNEL }}
       - name: UploadArtifact
-        uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce
+        uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
         with:
           name: firewatch
           path: firewatch.data
diff --git a/.github/workflows/gen-teamcity.yml b/.github/workflows/gen-teamcity.yml
index 46303161731..b7c00cba152 100644
--- a/.github/workflows/gen-teamcity.yml
+++ b/.github/workflows/gen-teamcity.yml
@@ -13,13 +13,14 @@ jobs:
     name: Validate TeamCity Configuration
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
-      - uses: actions/setup-java@5ffc13f4174014e2d4d4572b3d74c3fa61aeb2c2 # v3.11.0
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/setup-java@0ab4596768b603586c0de567f2430c30f5b0d2b0 # v3.13.0
         with:
           distribution: adopt
-          java-version: 11
+          java-version: 17
           cache: maven
       - name: Build TeamCity Configuration
         run: |
           cd .teamcity
-          mvn org.jetbrains.teamcity:teamcity-configs-maven-plugin:generate
+          make tools
+          make validate
diff --git a/.github/workflows/generate_changelog.yml b/.github/workflows/generate_changelog.yml
index 5781909e9e0..18ad67e1568 100644
--- a/.github/workflows/generate_changelog.yml
+++ b/.github/workflows/generate_changelog.yml
@@ -8,7 +8,7 @@ jobs:
     if: github.event.pull_request.merged || github.event_name == 'workflow_dispatch'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
           fetch-depth: 0
       - run: cd .ci/tools && go install github.com/hashicorp/go-changelog/cmd/changelog-build
diff --git a/.github/workflows/golangci-lint.yml b/.github/workflows/golangci-lint.yml
index 797953127bd..7575a42731a 100644
--- a/.github/workflows/golangci-lint.yml
+++ b/.github/workflows/golangci-lint.yml
@@ -19,12 +19,13 @@ on:
 jobs:
   golangci-linta:
     name: 1 of 2
-    runs-on: ubuntu-latest
+    runs-on: [custom, linux, large]
     steps:
-      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9
-      - uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
         with:
           go-version-file: go.mod
+          cache: false
       - id: golangci-lint-version
         working-directory: .ci/tools
         run: >-
@@ -34,7 +35,7 @@ jobs:
             awk '{print $2}'
           )" >> $GITHUB_OUTPUT
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@v3
+        uses: golangci/golangci-lint-action@3a919529898de77ec3da873e3063ca4b10e7f5cc # v3.7.0
         with:
           version: "${{ steps.golangci-lint-version.outputs.version }}"
           args: --config .ci/.golangci.yml
@@ -43,10 +44,11 @@ jobs:
     needs: [golangci-linta]
     runs-on: [custom, linux, xl]
     steps:
-      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9
-      - uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
         with:
           go-version-file: go.mod
+          cache: false
       - id: golangci-lint-version
         working-directory: .ci/tools
         run: >-
@@ -56,7 +58,12 @@ jobs:
             awk '{print $2}'
           )" >> $GITHUB_OUTPUT
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@v3
+        uses: golangci/golangci-lint-action@3a919529898de77ec3da873e3063ca4b10e7f5cc # v3.7.0
         with:
           version: "${{ steps.golangci-lint-version.outputs.version }}"
           args: --config .ci/.golangci2.yml
+        env:
+          # Trigger garbage collection more frequently to reduce the likelihood
+          # of OOM errors.
+          # ref: https://golangci-lint.run/usage/performance/#memory-usage
+          GOGC: "50"
diff --git a/.github/workflows/goreleaser-ci.yml b/.github/workflows/goreleaser-ci.yml
index 7bd1de6c7fd..2e526e3ead6 100644
--- a/.github/workflows/goreleaser-ci.yml
+++ b/.github/workflows/goreleaser-ci.yml
@@ -23,8 +23,8 @@ jobs:
     outputs:
       goreleaser: ${{ steps.filter.outputs.goreleaser }}
     steps:
-      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9
-      - uses: dorny/paths-filter@4512585405083f25c027a35db413c2b3b9006d50
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: dorny/paths-filter@4512585405083f25c027a35db413c2b3b9006d50 # v2.11.1
         id: filter
         with:
           filters: |
@@ -37,18 +37,18 @@ jobs:
     if: ${{ needs.changes.outputs.goreleaser == 'true' }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9
-      - uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
         with:
           go-version-file: go.mod
-      - uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8
+      - uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
         continue-on-error: true
         timeout-minutes: 2
         with:
           path: ~/go/pkg/mod
           key: ${{ runner.os }}-go-pkg-mod-${{ hashFiles('go.sum') }}
       - name: goreleaser check
-        uses: goreleaser/goreleaser-action@v4
+        uses: goreleaser/goreleaser-action@7ec5c2b0c6cdda6e8bbb49444bc797dd33d74dd8 # v5.0.0
         with:
           args: check
 
@@ -57,17 +57,17 @@ jobs:
     # Ref: https://github.com/hashicorp/terraform-provider-aws/issues/8988
     runs-on: [custom, linux, small]
     steps:
-      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9
-      - uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
         with:
           go-version-file: go.mod
-      - uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8
+      - uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
         continue-on-error: true
         timeout-minutes: 2
         with:
           path: ~/go/pkg/mod
           key: ${{ runner.os }}-go-pkg-mod-${{ hashFiles('go.sum') }}
       - name: goreleaser build
-        uses: goreleaser/goreleaser-action@v4
+        uses: goreleaser/goreleaser-action@7ec5c2b0c6cdda6e8bbb49444bc797dd33d74dd8 # v5.0.0
         with:
           args: build --config .github/goreleaser-cross-compiler-test.yml --id 32-bit-arch --snapshot
diff --git a/.github/workflows/issue-comment-created.yml b/.github/workflows/issue-comment-created.yml
deleted file mode 100644
index 99a801b9cbf..00000000000
--- a/.github/workflows/issue-comment-created.yml
+++ /dev/null
@@ -1,18 +0,0 @@
-name: Issue Comment Created Triage
-
-on:
-  issue_comment:
-    types: [created]
-
-jobs:
-  community_check:
-    uses: ./.github/workflows/community-check.yml
-    secrets: inherit
-
-  issue_comment_triage:
-    name: 'Remove stale and waiting-response Labels on Response'
-    needs: community_check
-    if: github.event_name == 'issue_comment' && needs.community_check.outputs.maintainer == 'false'
-    uses: ./.github/workflows/reusable-add-or-remove-labels.yml
-    with:
-      remove: stale,waiting-response
diff --git a/.github/workflows/issue_comment.yml b/.github/workflows/issue_comment.yml
new file mode 100644
index 00000000000..bd4b2609c57
--- /dev/null
+++ b/.github/workflows/issue_comment.yml
@@ -0,0 +1,35 @@
+name: 'Process issue_comment Events'
+
+on:
+  issue_comment:
+    types: [created]
+
+jobs:
+  community_check:
+    name: 'Community Check'
+    uses: ./.github/workflows/community-check.yml
+    secrets: inherit
+    with:
+      username: ${{ github.event.comment.user.login }}
+
+  automation_labeler:
+    name: 'Automation Labeler'
+    needs: community_check
+    runs-on: ubuntu-latest
+    # Since the only step in this job requires non-maintainer, skip the job entirely if that's not met.
+    if: needs.community_check.outputs.maintainer == 'false'
+    env:
+      # This is a ternary that sets the variable to the assigned user's login on assigned events,
+      # and otherwise sets it to the username of the pull request's author. For more information:
+      # https://docs.github.com/en/actions/learn-github-actions/expressions#example
+      #
+      # issue_comment events are triggered by comments on issues and pull requests. Checking the
+      # value of github.event.issue.pull_request tells us whether the issue is an issue or is
+      # actually a pull request, allowing us to dynamically set the gh subcommand:
+      # https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#issue_comment-on-issues-only-or-pull-requests-only
+      COMMAND: ${{ github.event.issue.pull_request && 'pr' || 'issue' }}
+      GH_TOKEN: ${{ github.token }}
+    steps:
+      - name: 'Remove stale and waiting-response on non-maintainer comment'
+        # https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#issue_comment-on-issues-only-or-pull-requests-only
+        run: gh ${{ env.COMMAND }} edit ${{ github.event.issue.html_url }} --remove-label stale,waiting-response
diff --git a/.github/workflows/issues.yml b/.github/workflows/issues.yml
index 4c38574830f..8e8e66e8ca1 100644
--- a/.github/workflows/issues.yml
+++ b/.github/workflows/issues.yml
@@ -1,17 +1,143 @@
-name: Issue triage
+name: 'Process issues Events'
 
 on:
   issues:
-    types: [opened]
+    types:
+      - assigned
+      - closed
+      - edited
+      - opened
+      - labeled
 
 jobs:
-  AddLabelsForIssueTriage:
+  community_check:
+    name: 'Community Check'
+    uses: ./.github/workflows/community-check.yml
+    secrets: inherit
+    with:
+      # This is a ternary that sets the variable to the assigned user's login on assigned events,
+      # and otherwise sets it to the username of the pull request's author. For more information:
+      # https://docs.github.com/en/actions/learn-github-actions/expressions#example
+      username: ${{ github.event.action == 'assigned' && github.event.assignee.login || github.event.issue.user.login }}
+
+  automation_labeler:
+    name: 'Automation Labeler'
+    needs: community_check
+    runs-on: ubuntu-latest
+    env:
+      ISSUE_URL: ${{ github.event.issue.html_url }}
+    steps:
+      - name: 'Generate Token'
+        id: token
+        uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a # v2.1.0
+        with:
+          app_id: ${{ secrets.APP_ID }}
+          installation_retrieval_mode: id
+          installation_retrieval_payload: ${{ secrets.INSTALLATION_ID }}
+          private_key: ${{ secrets.APP_PEM }}
+
+      - name: 'Add needs-triage for non-maintainer'
+        if: github.event.action == 'opened' && needs.community_check.outputs.maintainer == 'false'
+        env:
+          GH_TOKEN: ${{ steps.token.outputs.token }}
+        run: gh issue edit ${{ env.ISSUE_URL }} --add-label needs-triage
+
+      - name: 'Add prioritized when assigned to maintainers'
+        if: github.event.action == 'assigned' && needs.community_check.outputs.maintainer == 'true'
+        env:
+          GH_TOKEN: ${{ steps.token.outputs.token }}
+        run: gh issue edit ${{ env.ISSUE_URL }} --add-label prioritized
+
+      - name: 'Add prioritized to regressions'
+        if: github.event.label.name == 'regression'
+        env:
+          GH_TOKEN: ${{ steps.token.outputs.token }}
+        run: gh issue edit ${{ env.ISSUE_URL }} --add-label prioritized
+
+      - name: 'Remove unnecessary labels on closure'
+        if: github.event.action == 'closed'
+        env:
+          GH_TOKEN: ${{ steps.token.outputs.token }}
+        run: gh issue edit ${{ env.ISSUE_URL }} --remove-label needs-triage,waiting-response
+
+  service_labeler:
+    name: 'Service Labeler'
+    if: contains(fromJSON('["opened", "edited"]'), github.event.action)
     runs-on: ubuntu-latest
     steps:
-      - name: Apply Issue Triage Labels
-        uses: github/issue-labeler@v3.1
+      - name: 'Apply Labels'
+        uses: github/issue-labeler@98b5412841f6c4b0b3d9c29d53c13fad16bd7de2 # v3.2
         with:
-          repo-token: "${{ secrets.GITHUB_TOKEN }}"
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
           configuration-path: .github/labeler-issue-triage.yml
           enable-versioned-regex: 0
           include-title: 1
+
+  add_to_project:
+    name: 'Add to Project'
+    runs-on: ubuntu-latest
+    needs: community_check
+    env:
+      # Some gh project calls take the project's ID, some take the project's number
+      PROJECT_ID: "PVT_kwDOAAuecM4AF-7h"
+      PROJECT_NUMBER: "196"
+      STATUS_FIELD_ID: "PVTSSF_lADOAAuecM4AF-7hzgDcsQA"
+      VIEW_FIELD_ID: "PVTSSF_lADOAAuecM4AF-7hzgMRB34"
+      ITEM_URL: ${{ github.event.issue.html_url }}
+    steps:
+      - name: 'Generate Token'
+        id: token
+        uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a # v2.1.0
+        with:
+          app_id: ${{ secrets.APP_ID }}
+          installation_retrieval_mode: id
+          installation_retrieval_payload: ${{ secrets.INSTALLATION_ID }}
+          private_key: ${{ secrets.APP_PEM }}
+
+      - name: 'Assigned to Maintainer'
+        if: github.event.action == 'assigned' && needs.community_check.outputs.maintainer == 'true'
+        env:
+          GH_TOKEN: ${{ steps.token.outputs.token }}
+        run: |
+          PROJECT_ITEM_ID=$(gh project item-add ${{ env.PROJECT_NUMBER }} --owner "hashicorp" --url ${{ env.ITEM_URL }} --format json | jq '.id')
+          gh project item-edit --id "$PROJECT_ITEM_ID" --project-id ${{ env.PROJECT_ID }} --field-id ${{ env.STATUS_FIELD_ID }} --single-select-option-id ${{ vars.team_project_status_in_progress }}
+          gh project item-edit --id "$PROJECT_ITEM_ID" --project-id ${{ env.PROJECT_ID }} --field-id ${{ env.VIEW_FIELD_ID }} --single-select-option-id ${{ vars.team_project_view_working_board }}
+
+      - name: 'Labeled Prioritized or Regression'
+        if: contains(fromJSON('["prioritized", "regression"]'), github.event.label.name)
+        env:
+          GH_TOKEN: ${{ steps.token.outputs.token }}
+        run: |
+          PROJECT_ITEM_ID=$(gh project item-add ${{ env.PROJECT_NUMBER }} --owner "hashicorp" --url ${{ env.ITEM_URL }} --format json | jq '.id')
+          gh project item-edit --id "$PROJECT_ITEM_ID" --project-id ${{ env.PROJECT_ID }} --field-id ${{ env.VIEW_FIELD_ID }} --single-select-option-id ${{ vars.team_project_view_working_board }}
+
+      - name: 'Labeled Engineering Initiative'
+        if: github.event.label.name == 'engineering-initiative'
+        env:
+          GH_TOKEN: ${{ steps.token.outputs.token }}
+        run: |
+          PROJECT_ITEM_ID=$(gh project item-add ${{ env.PROJECT_NUMBER }} --owner "hashicorp" --url ${{ env.ITEM_URL }} --format json | jq '.id')
+          gh project item-edit --id "$PROJECT_ITEM_ID" --project-id ${{ env.PROJECT_ID }} --field-id ${{ env.VIEW_FIELD_ID }} --single-select-option-id ${{ vars.team_project_view_engineering_initiative }}
+
+  community_note:
+    name: 'Add Community Note'
+    if: github.event.action == 'opened'
+    runs-on: ubuntu-latest
+    steps:
+      - name: 'Add community note to new Issues'
+        uses: peter-evans/create-or-update-comment@23ff15729ef2fc348714a3bb66d2f655ca9066f2 # v3.1.0
+        with:
+          issue-number: ${{ github.event.issue.number }}
+          body: |
+            # Community Note
+
+            **Voting for Prioritization**
+
+            * Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original post to help the community and maintainers prioritize this request.
+            * Please see our [prioritization guide](https://hashicorp.github.io/terraform-provider-aws/prioritization/) for information on how we prioritize.
+            * Please **do not** leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.
+
+            **Volunteering to Work on This Issue**
+
+            * If you are interested in working on this issue, please leave a comment.
+            * If this would be your first contribution, please review the [contribution guide](https://hashicorp.github.io/terraform-provider-aws/).
diff --git a/.github/workflows/library_versions.yml b/.github/workflows/library_versions.yml
new file mode 100644
index 00000000000..7bd0a4a8591
--- /dev/null
+++ b/.github/workflows/library_versions.yml
@@ -0,0 +1,63 @@
+name: Preferred Library Version Check
+
+# This check verifies that preferred library versions are used in development
+# of net-new resources. This is done by inspecting the pull request diff for any
+# occurrence of a non-preferred library name, typically seen in an import block.
+# At this time the only check is for AWS SDK for Go V1, but it may be extended
+# in the future. This check will not fail if a non-preferred library version is
+# detected, but will leave a comment on the pull request linking to the relevant
+# contributor documentation.
+
+on:
+  pull_request:
+    branches:
+      - main
+
+jobs:
+  diffgrep:
+    runs-on: ubuntu-latest
+    outputs:
+      found: ${{ steps.diff.outputs.found }}
+    steps:
+      # checkout base ref
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        with:
+          ref: ${{ github.event.pull_request.base.ref }}
+
+      # checkout pull request head ref
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+
+      - name: Check diff for AWS SDK Go V1
+        id: diff
+        run: |
+          git diff origin/${{ github.event.pull_request.base.ref }} internal/ |
+            (grep '^\+\s*"github.com/aws/aws-sdk-go/' && echo "found=true" >> "$GITHUB_OUTPUT") || echo "found=false" >> "$GITHUB_OUTPUT"
+
+  comment:
+    runs-on: ubuntu-latest
+    needs: diffgrep
+    if: needs.diffgrep.outputs.found == 'true'
+    steps:
+      - name: Find Existing PR Comment
+        id: prc
+        uses: peter-evans/find-comment@a54c31d7fa095754bfef525c0c8e5e5674c4b4b1 # v2.4.0
+        with:
+          issue-number: ${{ github.event.pull_request.number }}
+          comment-author: "github-actions[bot]"
+          body-includes: "A new usage of AWS SDK for Go V1 was detected"
+
+      - run: echo ${{ steps.prc.outputs.comment-id }}
+
+      - name: PR Comment
+        if: steps.prc.outputs.comment-id == ''
+        uses: peter-evans/create-or-update-comment@23ff15729ef2fc348714a3bb66d2f655ca9066f2 # v3.1.0
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          issue-number: ${{ github.event.pull_request.number }}
+          body: |-
+            Thank you for your contribution! :rocket:
+
+            A new usage of AWS SDK for Go V1 was detected. Please prefer AWS SDK for Go V2 for all net-new services. If this is an enhancement or bug fix to an existing AWS SDK Go V1 based resource, this comment can be safely ignored.
+
+            For additional information refer to the [AWS SDK for Go Versions](https://hashicorp.github.io/terraform-provider-aws/aws-go-sdk-versions/) page in the contributor guide.
diff --git a/.github/workflows/lock.yml b/.github/workflows/lock.yml
index e17ec7a8308..4ccc86a21fb 100644
--- a/.github/workflows/lock.yml
+++ b/.github/workflows/lock.yml
@@ -8,7 +8,7 @@ jobs:
   lock:
     runs-on: ubuntu-latest
     steps:
-      - uses: dessant/lock-threads@v4
+      - uses: dessant/lock-threads@be8aa5be94131386884a6da4189effda9b14aa21 # v4.0.1
         with:
           github-token: ${{ github.token }}
           issue-comment: >
diff --git a/.github/workflows/maintainer-edit.yml b/.github/workflows/maintainer-edit.yml
deleted file mode 100644
index 2184a2d0d65..00000000000
--- a/.github/workflows/maintainer-edit.yml
+++ /dev/null
@@ -1,23 +0,0 @@
-name: "Check Maintainer Edit Permissions"
-on:
-  pull_request_target:
-    types:
-      - opened
-jobs:
-  community_check:
-    uses: ./.github/workflows/community-check.yml
-    secrets: inherit
-
-  PermissionsCheck:
-    needs: community_check
-    runs-on: ubuntu-latest
-    steps:
-      - name: Comment if maintainers cannot edit
-        if: (!github.event.pull_request.maintainer_can_modify && needs.community_check.outputs.maintainer == 'false')
-        uses: peter-evans/create-or-update-comment@c6c9a1a66007646a28c153e2a8580a5bad27bcfa
-        with:
-          issue-number: ${{ github.event.pull_request.number }}
-          body: |
-            Hey @${{ github.actor }} :wave: Thank you very much for your contribution! At times, our maintainers need to make direct edits to pull requests in order to help get it ready to be merged. Your current settings do not allow maintainers to make such edits. To help facilitate this, update your pull request to allow such edits as described in GitHub's [Allowing changes to a pull request branch created from a fork][1] documentation. (If you're using a fork owned by an organization, your organization may not allow you to change this setting. If that is the case, let us know.)
-
-            [1]: https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/allowing-changes-to-a-pull-request-branch-created-from-a-fork
diff --git a/.github/workflows/milestone-closed.yml b/.github/workflows/milestone-closed.yml
deleted file mode 100644
index 2ac8888bf9f..00000000000
--- a/.github/workflows/milestone-closed.yml
+++ /dev/null
@@ -1,20 +0,0 @@
-name: Closed Milestones
-
-on:
-  milestone:
-    types: [closed]
-
-permissions:
-  issues: write
-  pull-requests: write
-
-jobs:
-  Comment:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: bflad/action-milestone-comment@v1
-        with:
-          body: |
-            This functionality has been released in [${{ github.event.milestone.title }} of the Terraform AWS Provider](https://github.com/${{ github.repository }}/blob/${{ github.event.milestone.title }}/CHANGELOG.md).  Please see the [Terraform documentation on provider versioning](https://www.terraform.io/docs/configuration/providers.html#provider-versions) or reach out if you need any assistance upgrading.
-
-            For further feature requests or bug reports with this functionality, please create a [new GitHub issue](https://github.com/${{ github.repository }}/issues/new/choose) following the template. Thank you!
diff --git a/.github/workflows/milestone.yml b/.github/workflows/milestone.yml
index 1b9b83205c2..06b1b69691a 100644
--- a/.github/workflows/milestone.yml
+++ b/.github/workflows/milestone.yml
@@ -1,25 +1,42 @@
+name: 'Process milestone Events'
+
 on:
-  pull_request_target:
+  milestone:
     types: [closed]
-name: Add merged PR and linked issues to current milestone of target branch
+
+permissions:
+  issues: write
+  pull-requests: write
+
 jobs:
-  AddMergedToCurrentMilestone:
-    if: github.event.pull_request.merged
+  Comment:
+    name: 'Post-Release Comment'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9
+      - uses: bflad/action-milestone-comment@ae6c9fdf5778064d4e09b4632604a16b7289096c # v1.0.2
         with:
-          ref: ${{ github.event.pull_request.base.ref }}
-      - id: get-current-milestone
-        run: |
-            echo "current_milestone=v$(head -1 CHANGELOG.md | cut -d " " -f 2)" >> "$GITHUB_OUTPUT"
-      - run: echo ${{ steps.get-current-milestone.outputs.current_milestone }}
-      - id: get-milestone-id
-        run: |
-          echo "milestone_id=$(curl -H "Authorization: Bearer ${{secrets.GITHUB_TOKEN}}" https://api.github.com/repos/${{ github.repository_owner }}/${{ github.event.repository.name }}/milestones | jq 'map(select(.title == "${{ steps.get-current-milestone.outputs.current_milestone }}"))[0].number')" >> "$GITHUB_OUTPUT"
-      - run: echo ${{ steps.get-milestone-id.outputs.milestone_id }}
-      - uses: breathingdust/current-milestone-action@e74e4e4baaa22653aeef90db0c7894db093af076
-        with:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          pull_number: ${{ github.event.pull_request.number }}
-          milestone_number: ${{ steps.get-milestone-id.outputs.milestone_id }}
+          body: |
+            This functionality has been released in [${{ github.event.milestone.title }} of the Terraform AWS Provider](https://github.com/${{ github.repository }}/blob/${{ github.event.milestone.title }}/CHANGELOG.md).  Please see the [Terraform documentation on provider versioning](https://www.terraform.io/docs/configuration/providers.html#provider-versions) or reach out if you need any assistance upgrading.
+
+            For further feature requests or bug reports with this functionality, please create a [new GitHub issue](https://github.com/${{ github.repository }}/issues/new/choose) following the template. Thank you!
+
+  archive_and_unlabel:
+    name: 'Archive Project Items & Remove Label on Milestone Closed'
+    runs-on: ubuntu-latest
+    env:
+      MILESTONE: ${{ github.event.milestone.number }}
+    steps:
+      - name: 'Checkout Repo'
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+
+      - name: 'Remove Prioritized Label'
+        env:
+          GH_TOKEN: ${{ github.token }}
+        shell: bash
+        run: ./.ci/scripts/unlabel-on-milestone-closed.sh
+
+      - name: 'Archive Project Items'
+        env:
+          GH_TOKEN: ${{ secrets.PROJECT_SCOPED_TOKEN }}
+        shell: bash
+        run: ./.ci/scripts/archive-on-milestone-closed.sh
diff --git a/.github/workflows/mkdocs.yml b/.github/workflows/mkdocs.yml
index deabaed92d0..bfc1caf0645 100644
--- a/.github/workflows/mkdocs.yml
+++ b/.github/workflows/mkdocs.yml
@@ -11,10 +11,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout main
-        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
       - name: Deploy docs
-        uses: mhausenblas/mkdocs-deploy-gh-pages@master
+        uses: mhausenblas/mkdocs-deploy-gh-pages@d77dd03172e96abbcdb081d8c948224762033653 # 1.26
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           CONFIG_FILE: mkdocs.yml
diff --git a/.github/workflows/post_publish.yml b/.github/workflows/post_publish.yml
index bfe7a092345..65c36399a03 100644
--- a/.github/workflows/post_publish.yml
+++ b/.github/workflows/post_publish.yml
@@ -19,7 +19,7 @@ jobs:
     steps:
       - if: github.event_name == 'workflow_run'
         name: Download Artifact from Release workflow
-        uses: dawidd6/action-download-artifact@v2
+        uses: dawidd6/action-download-artifact@268677152d06ba59fcec7a7f0b5d961b6ccd7e1e # v2.28.0
         with:
           workflow: release.yml
           name: release-tag
@@ -37,7 +37,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Tidy Jira
-        uses: breathingdust/github-jira-tidy@77daa2cf0f0574bb7be001eb6380939c1af31672
+        uses: breathingdust/github-jira-tidy@77daa2cf0f0574bb7be001eb6380939c1af31672 # v0.9.0
         with:
           jira_host: 'hashicorp.atlassian.net'
           jira_username: 'sdavis@hashicorp.com'
@@ -47,16 +47,6 @@ jobs:
           jira_github_url_field_id: 'cf[10089]'
           github_release_name: ${{ needs.on-success-or-workflow-dispatch.outputs.release-tag }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-  archive-release-cards:
-    needs: [on-success-or-workflow-dispatch]
-    runs-on: ubuntu-latest
-    steps:
-      - name: Archive Release Cards
-        uses: breathingdust/github-project-archive@4be60b012447c51a5d60d988168f6360815d9ec9
-        with:
-          github_done_column_id: 11513756
-          github_release_name: ${{ needs.on-success-or-workflow-dispatch.outputs.release-tag }}
-          github_token: ${{ secrets.ORGSCOPED_GITHUB_TOKEN }}
   on-failure:
     runs-on: ubuntu-latest
     if: ${{ github.event.workflow_run.conclusion == 'failure' }}
diff --git a/.github/workflows/project-partner-label.yml b/.github/workflows/project-partner-label.yml
deleted file mode 100644
index 932297d23b7..00000000000
--- a/.github/workflows/project-partner-label.yml
+++ /dev/null
@@ -1,39 +0,0 @@
-name: "Project: Partner Label"
-on:
-  pull_request_target:
-    types:
-      - labeled
-env:
-  DESTINATION_COLUMN_ID: 'PC_lAPOAAuecM4AXZPtzgC5Sak'
-  GH_TOKEN: ${{ secrets.ORGSCOPED_GITHUB_TOKEN }}
-jobs:
-  tag-created:
-    if: ${{ github.event.label.name == 'partner' }}
-    runs-on: ubuntu-latest
-    steps:
-      - name: AddIssueToPartnerBoard
-        run: |
-          PROJCOLUMNS=$(gh api graphql -f query='
-              query {
-                repository(name: "${{ github.event.repository.name }}", owner: "${{ github.repository_owner }}") {
-                  pullRequest(number: ${{ github.event.number }}) {
-                  projectCards {
-                    nodes {
-                      column {
-                        name
-                        id
-                      }
-                    }
-                  }
-                }
-              }
-            }')
-          INPROJECT=$(echo $PROJCOLUMNS | jq '.data.repository.pullRequest.projectCards.nodes[].column | select(.id=="${{ env.DESTINATION_COLUMN_ID }}")')
-          if [ -z "$INPROJECT" ];
-          then
-            gh api graphql -f query='mutation {
-              addProjectCard(input: {projectColumnId: "${{ env.DESTINATION_COLUMN_ID }}", contentId: "${{ github.event.pull_request.node_id }}"}) {
-                clientMutationId
-              }
-            }'
-          fi
diff --git a/.github/workflows/project-roadmap-label.yml b/.github/workflows/project-roadmap-label.yml
deleted file mode 100644
index 4a446b8ed7b..00000000000
--- a/.github/workflows/project-roadmap-label.yml
+++ /dev/null
@@ -1,73 +0,0 @@
-name: "Project: Roadmap"
-on:
-  issues:
-    types:
-      - labeled
-      - milestoned
-  pull_request:
-    types:
-      - labeled
-env:
-  DESTINATION_COLUMN_ID: 'MDEzOlByb2plY3RDb2x1bW4xMTUxMzUyOQ=='
-  GH_TOKEN: ${{ secrets.ORGSCOPED_GITHUB_TOKEN }}
-
-jobs:
-  tag-created:
-    if: ${{ github.event.label.name == 'roadmap' || github.event.issue.milestone.title == 'Roadmap' }}
-    runs-on: ubuntu-latest
-    steps:
-      - name: 'Add Roadmapped or Milestoned Issue to Working Board'
-        if: github.event_name == 'issues'
-        run: |
-          PROJCOLUMNS=$(gh api graphql -f query='
-              query {
-                repository(name: "${{ github.event.repository.name }}", owner: "${{ github.repository_owner }}") {
-                  issue(number: ${{ github.event.issue.number }}) {
-                  projectCards {
-                    nodes {
-                      column {
-                        name
-                        id
-                      }
-                    }
-                  }
-                }
-              }
-            }')
-          INPROJECT=$(echo $PROJCOLUMNS | jq '.data.repository.issue.projectCards.nodes[].column | select(.id=="${{ env.DESTINATION_COLUMN_ID }}")')
-          if [ -z "$INPROJECT" ];
-          then
-            gh api graphql -f query='mutation {
-              addProjectCard(input: {projectColumnId: "${{ env.DESTINATION_COLUMN_ID }}", contentId: "${{ github.event.issue.node_id }}"}) {
-                clientMutationId
-              }
-            }'
-          fi
-
-      - name: 'Add Roadmapped Pull Requests to Working Board'
-        if: github.event_name == 'pull_request'
-        run: |
-          PROJCOLUMNS=$(gh api graphql -f query='
-              query {
-                repository(name: "${{ github.event.repository.name }}", owner: "${{ github.repository_owner }}") {
-                  pullRequest(number: ${{ github.event.pull_request.number }}) {
-                  projectCards {
-                    nodes {
-                      column {
-                        name
-                        id
-                      }
-                    }
-                  }
-                }
-              }
-            }')
-          INPROJECT=$(echo $PROJCOLUMNS | jq '.data.repository.pullRequest.projectCards.nodes[].column | select(.id=="${{ env.DESTINATION_COLUMN_ID }}")')
-          if [ -z "$INPROJECT" ];
-          then
-            gh api graphql -f query='mutation {
-              addProjectCard(input: {projectColumnId: "${{ env.DESTINATION_COLUMN_ID }}", contentId: "${{ github.event.pull_request.node_id }}"}) {
-                clientMutationId
-              }
-            }'
-          fi
diff --git a/.github/workflows/project.yml b/.github/workflows/project.yml
deleted file mode 100644
index a265e4d478c..00000000000
--- a/.github/workflows/project.yml
+++ /dev/null
@@ -1,45 +0,0 @@
-name: Pull Request Project Automation
-
-on:
-  pull_request_target:
-    types: [opened, ready_for_review]
-
-jobs:
-  community_check:
-    uses: ./.github/workflows/community-check.yml
-    secrets: inherit
-
-  WorkingBoardReview:
-    needs: community_check
-    runs-on: ubuntu-latest
-    steps:
-      - name: 'Move team PRs to Review column'
-        if: github.event.pull_request.draft == false && needs.community_check.outputs.maintainer == 'true'
-        env:
-          DESTINATION_COLUMN_ID: 'MDEzOlByb2plY3RDb2x1bW4xMTUxMzYzOA=='
-          GH_TOKEN: ${{ secrets.ORGSCOPED_GITHUB_TOKEN }}
-        run: |
-          PROJCOLUMNS=$(gh api graphql -f query='
-              query {
-                repository(name: "${{ github.event.repository.name }}", owner: "${{ github.repository_owner }}") {
-                  pullRequest(number: ${{ github.event.pull_request.number }}) {
-                  projectCards {
-                    nodes {
-                      column {
-                        name
-                        id
-                      }
-                    }
-                  }
-                }
-              }
-            }')
-          INPROJECT=$(echo $PROJCOLUMNS | jq '.data.repository.pullRequest.projectCards.nodes[].column | select(.id=="${{ env.DESTINATION_COLUMN_ID }}")')
-          if [ -z "$INPROJECT" ];
-          then
-            gh api graphql -f query='mutation {
-              addProjectCard(input: {projectColumnId: "${{ env.DESTINATION_COLUMN_ID }}", contentId: "${{ github.event.pull_request.node_id }}"}) {
-                clientMutationId
-              }
-            }'
-          fi
diff --git a/.github/workflows/provider.yml b/.github/workflows/provider.yml
new file mode 100644
index 00000000000..2e3197dde1b
--- /dev/null
+++ b/.github/workflows/provider.yml
@@ -0,0 +1,309 @@
+name: Provider Checks
+
+on:
+  push:
+    branches:
+      - main
+      - "release/**"
+  pull_request:
+    paths:
+      - .github/workflows/provider.yml
+      - .ci/.golangci.yml
+      - .ci/tools/go.mod
+      - .markdownlint.yml
+      - internal/**
+      - docs/index.md
+      - docs/data-sources/**
+      - docs/guides/**
+      - docs/resources/**
+      - go.sum
+      - GNUmakefile
+      - main.go
+      - names/**
+      - website/**
+
+env:
+  AWS_DEFAULT_REGION: us-west-2
+  TERRAFORM_VERSION: "1.0.6"
+
+jobs:
+  go_mod_download:
+    name: go mod download
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
+        with:
+          go-version-file: go.mod
+      - uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
+        continue-on-error: true
+        id: cache-go-pkg-mod
+        timeout-minutes: 2
+        with:
+          path: ~/go/pkg/mod
+          key: ${{ runner.os }}-go-pkg-mod-${{ hashFiles('go.sum') }}
+      - if: steps.cache-go-pkg-mod.outputs.cache-hit != 'true' || steps.cache-go-pkg-mod.outcome == 'failure'
+        run: go mod download
+
+  go_build:
+    name: go build
+    needs: [go_mod_download]
+    runs-on: [custom, linux, medium]
+    steps:
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
+        continue-on-error: true
+        id: cache-terraform-plugin-dir
+        timeout-minutes: 2
+        with:
+          path: terraform-plugin-dir
+          key: ${{ runner.os }}-terraform-plugin-dir-${{ hashFiles('go.sum') }}-${{ hashFiles('internal/**') }}
+      - if: steps.cache-terraform-plugin-dir.outputs.cache-hit != 'true' || steps.cache-terraform-plugin-dir.outcome == 'failure'
+        uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
+        with:
+          go-version-file: go.mod
+      # See also: https://github.com/actions/setup-go/issues/54
+      - if: steps.cache-terraform-plugin-dir.outputs.cache-hit != 'true' || steps.cache-terraform-plugin-dir.outcome == 'failure'
+        name: go env
+        run: |
+          echo "GOCACHE=$(go env GOCACHE)" >> $GITHUB_ENV
+      - if: steps.cache-terraform-plugin-dir.outputs.cache-hit != 'true' || steps.cache-terraform-plugin-dir.outcome == 'failure'
+        uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
+        with:
+          path: ${{ env.GOCACHE }}
+          key: ${{ runner.os }}-GOCACHE-${{ hashFiles('go.sum') }}-${{ hashFiles('internal/**') }}
+      - if: steps.cache-terraform-plugin-dir.outputs.cache-hit != 'true' || steps.cache-terraform-plugin-dir.outcome == 'failure'
+        uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
+        with:
+          path: ~/go/pkg/mod
+          key: ${{ runner.os }}-go-pkg-mod-${{ hashFiles('go.sum') }}
+      - if: steps.cache-terraform-plugin-dir.outputs.cache-hit != 'true' || steps.cache-terraform-plugin-dir.outcome == 'failure'
+        name: go build
+        run: go build -o terraform-plugin-dir/registry.terraform.io/hashicorp/aws/99.99.99/$(go env GOOS)_$(go env GOARCH)/terraform-provider-aws .
+
+  go_generate:
+    name: go generate
+    needs: [go_build]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
+        with:
+          go-version-file: go.mod
+      # See also: https://github.com/actions/setup-go/issues/54
+      - name: go env
+        run: |
+          echo "GOCACHE=$(go env GOCACHE)" >> $GITHUB_ENV
+      - uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
+        continue-on-error: true
+        timeout-minutes: 2
+        with:
+          path: ${{ env.GOCACHE }}
+          key: ${{ runner.os }}-GOCACHE-${{ hashFiles('go.sum') }}-${{ hashFiles('internal/**') }}
+      - uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
+        continue-on-error: true
+        timeout-minutes: 2
+        with:
+          path: ~/go/pkg/mod
+          key: ${{ runner.os }}-go-pkg-mod-${{ hashFiles('go.sum') }}
+      - run: go install golang.org/x/tools/cmd/goimports@latest
+      - run: make gen
+      - name: Check for Git Differences
+        run: |
+          git diff --compact-summary --exit-code || \
+            (echo; echo "Unexpected difference in directories after code generation. Run 'make gen' command and commit."; exit 1)
+
+  go_test:
+    name: go test
+    needs: [go_build]
+    runs-on: [custom, linux, xl]
+    steps:
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
+        with:
+          go-version-file: go.mod
+      # See also: https://github.com/actions/setup-go/issues/54
+      - name: go env
+        run: |
+          echo "GOCACHE=$(go env GOCACHE)" >> $GITHUB_ENV
+      - uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
+        continue-on-error: true
+        timeout-minutes: 2
+        with:
+          path: ${{ env.GOCACHE }}
+          key: ${{ runner.os }}-GOCACHE-${{ hashFiles('go.sum') }}-${{ hashFiles('internal/**') }}
+      - uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
+        continue-on-error: true
+        timeout-minutes: 2
+        with:
+          path: ~/go/pkg/mod
+          key: ${{ runner.os }}-go-pkg-mod-${{ hashFiles('go.sum') }}
+      - name: Go Test
+        run: go test ./...
+
+  importlint:
+    needs: [go_build]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
+        with:
+          go-version-file: go.mod
+      # See also: https://github.com/actions/setup-go/issues/54
+      - name: go env
+        run: |
+          echo "GOCACHE=$(go env GOCACHE)" >> $GITHUB_ENV
+      - uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
+        continue-on-error: true
+        timeout-minutes: 2
+        with:
+          path: ${{ env.GOCACHE }}
+          key: ${{ runner.os }}-GOCACHE-${{ hashFiles('go.sum') }}-${{ hashFiles('internal/**') }}
+      - uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
+        continue-on-error: true
+        timeout-minutes: 2
+        with:
+          path: ~/go/pkg/mod
+          key: ${{ runner.os }}-go-pkg-mod-${{ hashFiles('go.sum') }}
+      - run: cd .ci/tools && go install github.com/pavius/impi/cmd/impi
+      - run: impi --local . --scheme stdThirdPartyLocal ./...
+
+  # validate_sweepers_unlinked checks that the sweeper functions are not linked in the provider binary.
+  # As a pre-check, to validate that the check will work, it confirms that `strings` will find the function
+  # names in the compiled sweeper binary.
+  validate_sweepers_unlinked:
+    name: Sweeper Functions Not Linked
+    needs: [go_build]
+    runs-on: [custom, linux, medium]
+    steps:
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
+        with:
+          go-version-file: go.mod
+      # See also: https://github.com/actions/setup-go/issues/54
+      - name: go env
+        run: |
+          echo "GOCACHE=$(go env GOCACHE)" >> $GITHUB_ENV
+      - uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
+        continue-on-error: true
+        timeout-minutes: 2
+        with:
+          path: ${{ env.GOCACHE }}
+          key: ${{ runner.os }}-GOCACHE-${{ hashFiles('go.sum') }}-${{ hashFiles('internal/**') }}
+      - uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
+        continue-on-error: true
+        timeout-minutes: 2
+        with:
+          path: ~/go/pkg/mod
+          key: ${{ runner.os }}-go-pkg-mod-${{ hashFiles('go.sum') }}
+
+      - name: Pre-Check sweeper binary
+        run: |
+          go test -c -o ./sweeper-bin ./internal/sweep/
+          count=$(strings ./sweeper-bin | \
+            grep --count --extended-regexp 'internal/service/[a-zA-Z0-9]+\.sweep[a-zA-Z0-9]+$')
+          [ $count -gt 0 ] || \
+            (echo; echo "Expected `strings` to detect sweeper function names in sweeper binary."; exit 1)
+
+      # Use cached provider or rebuild
+      - uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84
+        continue-on-error: true
+        id: cache-terraform-plugin-dir
+        timeout-minutes: 2
+        with:
+          path: terraform-plugin-dir
+          key: ${{ runner.os }}-terraform-plugin-dir-${{ hashFiles('go.sum') }}-${{ hashFiles('internal/**') }}
+      - if: steps.cache-terraform-plugin-dir.outputs.cache-hit != 'true' || steps.cache-terraform-plugin-dir.outcome == 'failure'
+        name: go build
+        run: go build -o terraform-plugin-dir/registry.terraform.io/hashicorp/aws/99.99.99/$(go env GOOS)_$(go env GOARCH)/terraform-provider-aws .
+
+      - name: Check provider binary
+        run: |
+          # grep returns the exit code 1 if there are no results. Disable immediate exit.
+          set +e
+          count=$(strings "terraform-plugin-dir/registry.terraform.io/hashicorp/aws/99.99.99/$(go env GOOS)_$(go env GOARCH)/terraform-provider-aws" | \
+            grep --count --extended-regexp 'internal/service/[a-zA-Z0-9]+\.sweep[a-zA-Z0-9]+$')
+          set -e
+          [ $count -eq 0 ] || \
+            (echo; echo "Expected `strings` to detect no sweeper function names in provider binary."; exit 1)
+
+  terraform_providers_schema:
+    name: terraform providers schema
+    needs: [go_build]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
+        continue-on-error: true
+        id: cache-terraform-providers-schema
+        timeout-minutes: 2
+        with:
+          path: terraform-providers-schema
+          key: ${{ runner.os }}-terraform-providers-schema-${{ hashFiles('go.sum') }}-${{ hashFiles('internal/**') }}
+      - if: steps.cache-terraform-providers-schema.outputs.cache-hit != 'true' || steps.cache-terraform-providers-schema.outcome == 'failure'
+        uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
+        timeout-minutes: 2
+        with:
+          path: terraform-plugin-dir
+          key: ${{ runner.os }}-terraform-plugin-dir-${{ hashFiles('go.sum') }}-${{ hashFiles('internal/**') }}
+      - if: steps.cache-terraform-providers-schema.outputs.cache-hit != 'true' || steps.cache-terraform-providers-schema.outcome == 'failure'
+        uses: hashicorp/setup-terraform@633666f66e0061ca3b725c73b2ec20cd13a8fdd1
+        with:
+          terraform_version: ${{ env.TERRAFORM_VERSION }}
+          terraform_wrapper: false
+      - if: steps.cache-terraform-providers-schema.outputs.cache-hit != 'true' || steps.cache-terraform-providers-schema.outcome == 'failure'
+        name: terraform init
+        run: |
+          # We need a file to initialize the provider
+          echo 'data "aws_partition" "example" {}' > example.tf
+          terraform init -plugin-dir terraform-plugin-dir
+      - if: steps.cache-terraform-providers-schema.outputs.cache-hit != 'true' || steps.cache-terraform-providers-schema.outcome == 'failure'
+        name: terraform providers schema
+        run: |
+          mkdir terraform-providers-schema
+          terraform providers schema -json > terraform-providers-schema/schema.json
+
+  tfproviderdocs:
+    needs: [terraform_providers_schema]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
+        with:
+          go-version-file: go.mod
+      - uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
+        continue-on-error: true
+        timeout-minutes: 2
+        with:
+          path: ~/go/pkg/mod
+          key: ${{ runner.os }}-go-pkg-mod-${{ hashFiles('go.sum') }}
+      - run: cd .ci/tools && go install github.com/YakDriver/tfproviderdocs
+      - uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
+        timeout-minutes: 2
+        with:
+          path: terraform-providers-schema
+          key: ${{ runner.os }}-terraform-providers-schema-${{ hashFiles('go.sum') }}-${{ hashFiles('internal/**') }}
+      - name: tfproviderdocs check
+        run: |
+          tfproviderdocs check \
+            -allowed-resource-subcategories-file website/allowed-subcategories.txt \
+            -enable-contents-check \
+            -ignore-file-missing-data-sources aws_alb,aws_alb_listener,aws_alb_target_group,aws_albs \
+            -ignore-file-missing-resources aws_alb,aws_alb_listener,aws_alb_listener_certificate,aws_alb_listener_rule,aws_alb_target_group,aws_alb_target_group_attachment \
+            -provider-source registry.terraform.io/hashicorp/aws \
+            -providers-schema-json terraform-providers-schema/schema.json \
+            -require-resource-subcategory \
+            -ignore-cdktf-missing-files
+
+  markdown-lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: avto-dev/markdown-lint@04d43ee9191307b50935a753da3b775ab695eceb # v1.5.0
+        with:
+          args: "."
+          ignore: "./docs ./website/docs ./CHANGELOG.md ./internal/service/cloudformation/testdata/examplecompany-exampleservice-exampleresource/docs"
diff --git a/.github/workflows/providerlint.yml b/.github/workflows/providerlint.yml
index 678f5b36948..d5473b24a8d 100644
--- a/.github/workflows/providerlint.yml
+++ b/.github/workflows/providerlint.yml
@@ -17,19 +17,19 @@ jobs:
   providerlint:
     runs-on: [custom, linux, medium]
     steps:
-      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9
-      - uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
         with:
           go-version-file: go.mod
       - name: go env
         run: echo "GOCACHE=$(go env GOCACHE)" >> $GITHUB_ENV
-      - uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8
+      - uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
         continue-on-error: true
         timeout-minutes: 2
         with:
           path: ${{ env.GOCACHE }}
           key: ${{ runner.os }}-GOCACHE-${{ hashFiles('go.sum') }}-${{ hashFiles('internal/**') }}
-      - uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8
+      - uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
         continue-on-error: true
         timeout-minutes: 2
         with:
diff --git a/.github/workflows/pull_request_feed.yml b/.github/workflows/pull_request_feed.yml
index 7eec09cd8e2..78845233595 100644
--- a/.github/workflows/pull_request_feed.yml
+++ b/.github/workflows/pull_request_feed.yml
@@ -1,4 +1,5 @@
 name: "Pull Request Feed"
+
 on:
   pull_request_target:
     types: [opened, closed]
@@ -12,12 +13,15 @@ jobs:
   community_check:
     uses: ./.github/workflows/community-check.yml
     secrets: inherit
+    with:
+      username: ${{ github.event.pull_request.user.login }}
+
   NotificationPRMerged:
     if: github.event.pull_request.merged == true
     runs-on: ubuntu-latest
     steps:
       - name: Notification PR Merged
-        uses: slackapi/slack-github-action@e28cf165c92ffef168d23c5c9000cffc8a25e117
+        uses: slackapi/slack-github-action@e28cf165c92ffef168d23c5c9000cffc8a25e117 # v1.24.0
         with:
           payload: |
             {
@@ -31,12 +35,13 @@ jobs:
                 }
               ]
             }
+
   NotificationMaintainerPROpened:
     needs: community_check
     runs-on: ubuntu-latest
     steps:
       - name: Notification Maintainer PR Opened
-        uses: slackapi/slack-github-action@e28cf165c92ffef168d23c5c9000cffc8a25e117
+        uses: slackapi/slack-github-action@e28cf165c92ffef168d23c5c9000cffc8a25e117 # v1.24.0
         if: github.event.action == 'opened' && needs.community_check.outputs.maintainer == 'true' && github.actor != 'dependabot[bot]'
         with:
           payload: |
@@ -51,12 +56,13 @@ jobs:
                 }
               ]
             }
+
   NotificationPartnerPROpened:
     needs: community_check
     runs-on: ubuntu-latest
     steps:
       - name: Notification Partner PR Opened
-        uses: slackapi/slack-github-action@e28cf165c92ffef168d23c5c9000cffc8a25e117
+        uses: slackapi/slack-github-action@e28cf165c92ffef168d23c5c9000cffc8a25e117 # v1.24.0
         if: github.event.action == 'opened' && needs.community_check.outputs.partner == 'true'
         with:
           payload: |
diff --git a/.github/workflows/pull_request_target.yml b/.github/workflows/pull_request_target.yml
new file mode 100644
index 00000000000..1d73d51caa2
--- /dev/null
+++ b/.github/workflows/pull_request_target.yml
@@ -0,0 +1,259 @@
+name: Process pull_request_target Events
+
+on:
+  pull_request_target:
+    types:
+      - assigned
+      - closed
+      - edited
+      - labeled
+      - opened
+      - ready_for_review
+
+jobs:
+  community_check:
+    name: 'Community Check'
+    uses: ./.github/workflows/community-check.yml
+    secrets: inherit
+    with:
+      # This is a ternary that sets the variable to the assigned user's login on assigned events,
+      # and otherwise sets it to the username of the pull request's author. For more information:
+      # https://docs.github.com/en/actions/learn-github-actions/expressions#example
+      username: ${{ github.event.action == 'assigned' && github.event.assignee.login || github.event.pull_request.user.login }}
+
+  labeler:
+    name: 'Automation Labeler'
+    needs: community_check
+    runs-on: ubuntu-latest
+    env:
+      PR_URL: ${{ github.event.pull_request.html_url }}
+    steps:
+      - name: 'Generate Token'
+        id: token
+        uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a # v2.1.0
+        with:
+          app_id: ${{ secrets.APP_ID }}
+          installation_retrieval_mode: id
+          installation_retrieval_payload: ${{ secrets.INSTALLATION_ID }}
+          private_key: ${{ secrets.APP_PEM }}
+
+      - name: 'Add needs-triage for non-maintainers'
+        if: github.event.action == 'opened' && needs.community_check.outputs.maintainer == 'false'
+        env:
+          GH_TOKEN: ${{ steps.token.outputs.token }}
+        run: gh pr edit ${{ env.PR_URL }} --add-label needs-triage
+
+      - name: 'Add prioritized to pull requests authored by or assigned to maintainers'
+        # This conditional is basically an exact copy of an example provided by GitHub:
+        # https://docs.github.com/en/actions/learn-github-actions/expressions#example-matching-an-array-of-strings
+        if: contains(fromJSON('["opened", "assigned"]'), github.event.action) && needs.community_check.outputs.maintainer == 'true'
+        env:
+          GH_TOKEN: ${{ steps.token.outputs.token }}
+        run: gh pr edit ${{ env.PR_URL }} --add-label prioritized
+
+      - name: 'Add partner to partner pull requests'
+        if: github.event.action == 'opened' && needs.community_check.outputs.partner == 'true'
+        env:
+          GH_TOKEN: ${{ steps.token.outputs.token }}
+        run: gh pr edit ${{ env.PR_URL }} --add-label partner
+
+      - name: 'Add external-maintainer to external maintainer pull requests'
+        if: github.event.action == 'opened' && needs.community_check.outputs.core_contributor == 'true'
+        env:
+          GH_TOKEN: ${{ steps.token.outputs.token }}
+        run: gh pr edit ${{ env.PR_URL }} --add-label external-maintainer
+
+      - name: 'Add prioritized to regressions'
+        if: github.event.label.name == 'regression'
+        env:
+          GH_TOKEN: ${{ steps.token.outputs.token }}
+        run: gh pr edit ${{ env.PR_URL }} --add-label prioritized
+
+      - name: 'Remove unnecessary labels on closure'
+        if: github.event.action == 'closed'
+        env:
+          GH_TOKEN: ${{ steps.token.outputs.token }}
+        run: gh pr edit ${{ env.PR_URL }} --remove-label needs-triage,waiting-response
+
+  service_labeler:
+    name: 'Service Labeler'
+    if: contains(fromJSON('["opened", "edited"]'), github.event.action)
+    runs-on: ubuntu-latest
+    steps:
+      - name: 'Checkout Repo'
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+
+      - name: 'Apply Labels'
+        uses: actions/labeler@ac9175f8a1f3625fd0d4fb234536d26811351594 # v4.3.0
+        with:
+          configuration-path: .github/labeler-pr-triage.yml
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+
+  size_labeler:
+    name: 'Size Labeler'
+    if: contains(fromJSON('["opened", "edited"]'), github.event.action)
+    runs-on: ubuntu-latest
+    steps:
+      - name: 'Apply Size Labels'
+        uses: codelytv/pr-size-labeler@54ef36785e9f4cb5ecf1949cfc9b00dbb621d761 # v1.8.1
+        with:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          xs_label: 'size/XS'
+          xs_max_size: '30'
+          s_label: 'size/S'
+          s_max_size: '60'
+          m_label: 'size/M'
+          m_max_size: '150'
+          l_label: 'size/L'
+          l_max_size: '300'
+          xl_label: 'size/XL'
+          message_if_xl: ''
+
+  add_to_project:
+    name: 'Add to Project'
+    runs-on: ubuntu-latest
+    needs: community_check
+    env:
+      # Some gh project calls take the project's ID, some take the project's number
+      PROJECT_ID: "PVT_kwDOAAuecM4AF-7h"
+      PROJECT_NUMBER: "196"
+      STATUS_FIELD_ID: "PVTSSF_lADOAAuecM4AF-7hzgDcsQA"
+      VIEW_FIELD_ID: "PVTSSF_lADOAAuecM4AF-7hzgMRB34"
+      ITEM_URL: ${{ github.event.pull_request.html_url }}
+    steps:
+      - name: 'Generate Token'
+        id: token
+        uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a # v2.1.0
+        with:
+          app_id: ${{ secrets.APP_ID }}
+          installation_retrieval_mode: id
+          installation_retrieval_payload: ${{ secrets.INSTALLATION_ID }}
+          private_key: ${{ secrets.APP_PEM }}
+
+      - name: 'Maintainer Pull Requests'
+        if: github.event.action == 'opened' && needs.community_check.outputs.maintainer == 'true'
+        env:
+          GH_TOKEN: ${{ steps.token.outputs.token }}
+        run: |
+          # In order to update the item's Status field, we need to capture the project item id from the output
+          PROJECT_ITEM_ID=$(gh project item-add ${{ env.PROJECT_NUMBER }} --owner "hashicorp" --url ${{ env.ITEM_URL }} --format json | jq '.id')
+          gh project item-edit --id "$PROJECT_ITEM_ID" --project-id ${{ env.PROJECT_ID }} --field-id ${{ env.STATUS_FIELD_ID }} --single-select-option-id ${{ vars.team_project_status_maintainer_pr }}
+          gh project item-edit --id "$PROJECT_ITEM_ID" --project-id ${{ env.PROJECT_ID }} --field-id ${{ env.VIEW_FIELD_ID }} --single-select-option-id ${{ vars.team_project_view_working_board }}
+
+      - name: 'Assigned to Maintainers'
+        if: github.event.action == 'assigned' && needs.community_check.outputs.maintainer == 'true'
+        env:
+          GH_TOKEN: ${{ steps.token.outputs.token }}
+        run: |
+          PROJECT_ITEM_ID=$(gh project item-add ${{ env.PROJECT_NUMBER }} --owner "hashicorp" --url ${{ env.ITEM_URL }} --format json | jq '.id')
+          gh project item-edit --id "$PROJECT_ITEM_ID" --project-id ${{ env.PROJECT_ID }} --field-id ${{ env.STATUS_FIELD_ID }} --single-select-option-id ${{ vars.team_project_status_in_progress }}
+          gh project item-edit --id "$PROJECT_ITEM_ID" --project-id ${{ env.PROJECT_ID }} --field-id ${{ env.VIEW_FIELD_ID }} --single-select-option-id ${{ vars.team_project_view_working_board }}
+
+      - name: 'Partner Pull Requests'
+        if: github.event.label.name == 'partner'
+        env:
+          GH_TOKEN: ${{ steps.token.outputs.token }}
+        run: |
+          PROJECT_ITEM_ID=$(gh project item-add ${{ env.PROJECT_NUMBER }} --owner "hashicorp" --url ${{ env.ITEM_URL }} --format json | jq '.id')
+          gh project item-edit --id "$PROJECT_ITEM_ID" --project-id ${{ env.PROJECT_ID }} --field-id ${{ env.VIEW_FIELD_ID }} --single-select-option-id ${{ vars.team_project_view_partner_contribution }}
+
+      - name: 'External Maintainer Pull Requests'
+        if: github.event.label.name == 'external-maintainer'
+        env:
+          GH_TOKEN: ${{ steps.token.outputs.token }}
+        run: |
+          PROJECT_ITEM_ID=$(gh project item-add ${{ env.PROJECT_NUMBER }} --owner "hashicorp" --url ${{ env.ITEM_URL }} --format json | jq '.id')
+          gh project item-edit --id "$PROJECT_ITEM_ID" --project-id ${{ env.PROJECT_ID }} --field-id ${{ env.VIEW_FIELD_ID }} --single-select-option-id ${{ vars.team_project_view_external_maintainer }}
+
+      - name: 'Labeled Prioritized or Regression'
+        if: contains(fromJSON('["prioritized", "regression"]'), github.event.label.name)
+        env:
+          GH_TOKEN: ${{ steps.token.outputs.token }}
+        run: |
+          PROJECT_ITEM_ID=$(gh project item-add ${{ env.PROJECT_NUMBER }} --owner "hashicorp" --url ${{ env.ITEM_URL }} --format json | jq '.id')
+          gh project item-edit --id "$PROJECT_ITEM_ID" --project-id ${{ env.PROJECT_ID }} --field-id ${{ env.VIEW_FIELD_ID }} --single-select-option-id ${{ vars.team_project_view_working_board }}
+
+      - name: 'Labeled Engineering Initiative'
+        if: github.event.label.name == 'engineering-initiative'
+        env:
+          GH_TOKEN: ${{ steps.token.outputs.token }}
+        run: |
+          PROJECT_ITEM_ID=$(gh project item-add ${{ env.PROJECT_NUMBER }} --owner "hashicorp" --url ${{ env.ITEM_URL }} --format json | jq '.id')
+          gh project item-edit --id "$PROJECT_ITEM_ID" --project-id ${{ env.PROJECT_ID }} --field-id ${{ env.VIEW_FIELD_ID }} --single-select-option-id ${{ vars.team_project_view_engineering_initiative }}
+
+  add_to_milestone:
+    name: 'Add Merged Pull Requests and Related Issues to Milestone'
+    if: github.event.action == 'closed' && github.event.pull_request.merged
+    runs-on: ubuntu-latest
+    steps:
+      - name: 'Checkout'
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+
+      - name: 'Get Current Milestone Name'
+        id: get-current-milestone
+        run: echo "current_milestone=v$(head -1 CHANGELOG.md | cut -d " " -f 2)" >> "$GITHUB_OUTPUT"
+
+      - name: 'Add Items to Milestone'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          MILESTONE: ${{ steps.get-current-milestone.outputs.current_milestone }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        shell: bash
+        run: ./.ci/scripts/add-to-milestone.sh
+
+  community_note:
+    name: 'Community Note'
+    if: github.event.action == 'opened'
+    runs-on: ubuntu-latest
+    steps:
+      - name: 'Add community note to new Pull Requests'
+        uses: peter-evans/create-or-update-comment@23ff15729ef2fc348714a3bb66d2f655ca9066f2 # v3.1.0
+        with:
+          issue-number: ${{ github.event.pull_request.number }}
+          body: |
+            # Community Note
+
+            **Voting for Prioritization**
+
+            * Please vote on this pull request by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original post to help the community and maintainers prioritize this pull request.
+            * Please see our [prioritization guide](https://hashicorp.github.io/terraform-provider-aws/prioritization/) for information on how we prioritize.
+            * Please **do not** leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.
+
+            **For Submitters**
+
+            * Review the [contribution guide](https://hashicorp.github.io/terraform-provider-aws/) relating to the type of change you are making to ensure all of the necessary steps have been taken.
+            * For new resources and data sources, use [skaff](https://hashicorp.github.io/terraform-provider-aws/skaff/) to generate scaffolding with comments detailing common expectations.
+            * Whether or not the branch has been rebased will **not** impact prioritization, but doing so is always a welcome surprise.
+
+  first_contribution_note:
+    name: 'New Contributor Note'
+    if: github.event.action == 'opened'
+    runs-on: ubuntu-latest
+    steps:
+      - name: 'Add comment to add helpful context for new contributors'
+        uses: actions/first-interaction@1dbfe1ba5525b8257e1f259b09745bee346d62d8 # v1.2.0
+        with:
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+          pr-message: |-
+            Welcome @${{github.actor}} :wave:
+
+            It looks like this is your first Pull Request submission to the [Terraform AWS Provider](https://github.com/hashicorp/terraform-provider-aws)! If you haven’t already done so please make sure you have checked out our [CONTRIBUTOR](https://hashicorp.github.io/terraform-provider-aws/) guide and [FAQ](https://hashicorp.github.io/terraform-provider-aws/faq/) to make sure your contribution is adhering to best practice and has all the necessary elements in place for a successful approval.
+
+            Also take a look at our [FAQ](https://hashicorp.github.io/terraform-provider-aws/faq/) which details how we prioritize Pull Requests for inclusion.
+
+            Thanks again, and welcome to the community! :smiley:
+
+  permissions_check:
+    name: 'Verify Maintainers Editable'
+    needs: community_check
+    if: github.event.action == 'opened' && needs.community_check.outputs.maintainer == 'false' && !github.event.pull_request.maintainer_can_modify
+    runs-on: ubuntu-latest
+    steps:
+      - name: 'Comment if maintainers cannot edit'
+        uses: peter-evans/create-or-update-comment@23ff15729ef2fc348714a3bb66d2f655ca9066f2 # v3.1.0
+        with:
+          issue-number: ${{ github.event.pull_request.number }}
+          body: |
+            Hey @${{ github.actor }} :wave: Thank you very much for your contribution! At times, our maintainers need to make direct edits to pull requests in order to help get it ready to be merged. Your current settings do not allow maintainers to make such edits. To help facilitate this, update your pull request to allow such edits as described in GitHub's [Allowing changes to a pull request branch created from a fork][1] documentation. (If you're using a fork owned by an organization, your organization may not allow you to change this setting. If that is the case, let us know.)
+
+            [1]: https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/allowing-changes-to-a-pull-request-branch-created-from-a-fork
diff --git a/.github/workflows/pull_requests.yml b/.github/workflows/pull_requests.yml
deleted file mode 100644
index bbdf2f3ab2b..00000000000
--- a/.github/workflows/pull_requests.yml
+++ /dev/null
@@ -1,69 +0,0 @@
-on:
-  - pull_request_target
-
-name: Pull Request Target (All types)
-
-jobs:
-  community_check:
-    uses: ./.github/workflows/community-check.yml
-    secrets: inherit
-
-  Labeler:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9
-      - name: Apply Labels
-        uses: actions/labeler@v4
-        with:
-          configuration-path: .github/labeler-pr-triage.yml
-          repo-token: ${{ secrets.GITHUB_TOKEN }}
-
-  NeedsTriageLabeler:
-    needs: community_check
-    name: 'Apply needs-triage to New Pull Requests'
-    if: github.event.action == 'opened' && needs.community_check.outputs.maintainer == 'false'
-    uses: ./.github/workflows/reusable-add-or-remove-labels.yml
-    with:
-      add: needs-triage
-
-  PartnerLabeler:
-    needs: community_check
-    name: 'Apply Partner Label'
-    if: github.event.action == 'opened' && needs.community_check.outputs.partner == 'true'
-    uses: ./.github/workflows/reusable-add-or-remove-labels.yml
-    with:
-      add: partner
-
-  SizeLabeler:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Apply Size Label
-        uses: codelytv/pr-size-labeler@v1
-        with:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          xs_label: 'size/XS'
-          xs_max_size: '30'
-          s_label: 'size/S'
-          s_max_size: '60'
-          m_label: 'size/M'
-          m_max_size: '150'
-          l_label: 'size/L'
-          l_max_size: '300'
-          xl_label: 'size/XL'
-          message_if_xl: ''
-
-  PullRequestComments:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Add comment to add helpful context for new contributors
-        uses: actions/first-interaction@v1.1.1
-        with:
-          repo-token: ${{ secrets.GITHUB_TOKEN }}
-          pr-message: |-
-            Welcome @${{github.actor}} :wave:
-
-            It looks like this is your first Pull Request submission to the [Terraform AWS Provider](https://github.com/hashicorp/terraform-provider-aws)! If you haven’t already done so please make sure you have checked out our [CONTRIBUTOR](https://hashicorp.github.io/terraform-provider-aws/) guide and [FAQ](https://hashicorp.github.io/terraform-provider-aws/faq/) to make sure your contribution is adhering to best practice and has all the necessary elements in place for a successful approval.
-
-            Also take a look at our [FAQ](https://hashicorp.github.io/terraform-provider-aws/faq/) which details how we prioritize Pull Requests for inclusion.
-
-            Thanks again, and welcome to the community! :smiley:
diff --git a/.github/workflows/regressions.yml b/.github/workflows/regressions.yml
index 7a6f7be612a..cef285d04b9 100644
--- a/.github/workflows/regressions.yml
+++ b/.github/workflows/regressions.yml
@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Send Slack Notification
-        uses: slackapi/slack-github-action@e28cf165c92ffef168d23c5c9000cffc8a25e117
+        uses: slackapi/slack-github-action@e28cf165c92ffef168d23c5c9000cffc8a25e117 # v1.24.0
         env:
           SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
           EVENT_URL: ${{ github.event.issue.html_url || github.event.pull_request.html_url }}
@@ -39,67 +39,3 @@ jobs:
             		}
             	]
             }
-
-  AddToWorkingBoard:
-    name: Add regression to Working Board
-    if: github.event.label.name == 'regression'
-    env:
-      DESTINATION_COLUMN_ID: 'MDEzOlByb2plY3RDb2x1bW4xMTUxMzUyOQ=='
-      GH_TOKEN: ${{ secrets.ORGSCOPED_GITHUB_TOKEN }}
-    runs-on: ubuntu-latest
-    steps:
-      - name: 'Add Regression Issues to To Do column'
-        if: github.event_name == 'issues'
-        run: |
-          PROJCOLUMNS=$(gh api graphql -f query='
-              query {
-                repository(name: "${{ github.event.repository.name }}", owner: "${{ github.repository_owner }}") {
-                  issue(number: ${{ github.event.issue.number }}) {
-                  projectCards {
-                    nodes {
-                      column {
-                        name
-                        id
-                      }
-                    }
-                  }
-                }
-              }
-            }')
-          INPROJECT=$(echo $PROJCOLUMNS | jq '.data.repository.issue.projectCards.nodes[].column | select(.id=="${{ env.DESTINATION_COLUMN_ID }}")')
-          if [ -z "$INPROJECT" ];
-          then
-            gh api graphql -f query='mutation {
-              addProjectCard(input: {projectColumnId: "${{ env.DESTINATION_COLUMN_ID }}", contentId: "${{ github.event.issue.node_id }}"}) {
-                clientMutationId
-              }
-            }'
-          fi
-
-      - name: 'Add Regression Pull Requests to To Do column'
-        if: github.event_name == 'pull_request'
-        run: |
-          PROJCOLUMNS=$(gh api graphql -f query='
-              query {
-                repository(name: "${{ github.event.repository.name }}", owner: "${{ github.repository_owner }}") {
-                  pullRequest(number: ${{ github.event.pull_request.number }}) {
-                  projectCards {
-                    nodes {
-                      column {
-                        name
-                        id
-                      }
-                    }
-                  }
-                }
-              }
-            }')
-          INPROJECT=$(echo $PROJCOLUMNS | jq '.data.repository.pullRequest.projectCards.nodes[].column | select(.id=="${{ env.DESTINATION_COLUMN_ID }}")')
-          if [ -z "$INPROJECT" ];
-          then
-            gh api graphql -f query='mutation {
-              addProjectCard(input: {projectColumnId: "${{ env.DESTINATION_COLUMN_ID }}", contentId: "${{ github.event.pull_request.node_id }}"}) {
-                clientMutationId
-              }
-            }'
-          fi
diff --git a/.github/workflows/release-tag.yml b/.github/workflows/release-tag.yml
index 1cbd32c3457..0afc8c6c4a0 100644
--- a/.github/workflows/release-tag.yml
+++ b/.github/workflows/release-tag.yml
@@ -9,7 +9,7 @@ jobs:
     steps:
       - name: Notify Slack
         id: slack
-        uses: slackapi/slack-github-action@e28cf165c92ffef168d23c5c9000cffc8a25e117
+        uses: slackapi/slack-github-action@e28cf165c92ffef168d23c5c9000cffc8a25e117 # v1.24.0
         with:
           payload: |
             {
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 383e018eb55..f296ca84ecb 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -12,12 +12,12 @@ jobs:
   release-notes:
     runs-on: macos-latest
     steps:
-      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
           fetch-depth: 0
       - name: Generate Release Notes
         run: sed -n -e "1{/# /d;}" -e "2{/^$/d;}" -e "/# $(git describe --abbrev=0 --exclude="$(git describe --abbrev=0 --match='v*.*.*' --tags)" --match='v*.*.*' --tags | tr -d v)/q;p" CHANGELOG.md > release-notes.txt
-      - uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce
+      - uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
         with:
           name: release-notes
           path: release-notes.txt
@@ -48,7 +48,7 @@ jobs:
     outputs:
       tag: ${{ steps.highest-version-tag.outputs.tag }}
     steps:
-      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
           # Allow tag to be fetched when ref is a commit
           fetch-depth: 0
@@ -66,7 +66,7 @@ jobs:
     if: github.ref_name == needs.highest-version-tag.outputs.tag
     runs-on: macos-latest
     steps:
-      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
           fetch-depth: 0
           ref: main
@@ -103,7 +103,7 @@ jobs:
     steps:
       - name: Save Release Tag
         run: echo ${{ github.ref_name }} > release-tag.data
-      - uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce
+      - uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
         with:
           name: release-tag
           path: release-tag.data
diff --git a/.github/workflows/resource-counts.yml b/.github/workflows/resource-counts.yml
new file mode 100644
index 00000000000..ec2aa874ad1
--- /dev/null
+++ b/.github/workflows/resource-counts.yml
@@ -0,0 +1,49 @@
+name: Resource Counts
+on:
+  workflow_dispatch: {}
+  schedule:
+    - cron: '0 9 * * WED'
+permissions:
+  contents: write
+  pull-requests: write
+jobs:
+  coverage:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Generate Token
+        id: generate_token
+        uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a # v2.1.0
+        with:
+          app_id: ${{ secrets.APP_ID }}
+          installation_retrieval_mode: id
+          installation_retrieval_payload: ${{ secrets.INSTALLATION_ID }}
+          private_key: ${{secrets.APP_PEM }}
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - run: |
+          touch main.tf
+          cat << EOF > main.tf
+          terraform {
+          required_providers {
+          aws = {
+          source  = "hashicorp/aws"
+          }
+          }
+          }
+          EOF
+      - run: terraform init
+      - run: |
+          datasources=$(terraform providers schema -json | jq '.provider_schemas[] .data_source_schemas | length')
+          resources=$(terraform providers schema -json | jq '.provider_schemas[] .resource_schemas | length')
+          sed -r -i "s/There are currently ([0-9]+) resources and ([0-9]+)(.*)/There are currently $resources resources and $datasources\3/" website/docs/index.html.markdown
+      - run: |
+          rm main.tf
+          rm .terraform.lock.hcl
+          rm -rf .terraform
+      - name: Create Pull Request
+        uses: peter-evans/create-pull-request@153407881ec5c347639a548ade7d8ad1d6740e38 # v5.0.2
+        with:
+          token: ${{ steps.generate_token.outputs.token }}
+          branch: "resource-counts"
+          commit-message: "docs: update resource counts"
+          title: "docs: update resource counts"
+          body: "This PR updates the resource/data source counts included on the provider documentation index page."
diff --git a/.github/workflows/reusable-add-or-remove-labels.yml b/.github/workflows/reusable-add-or-remove-labels.yml
deleted file mode 100644
index b517d72f540..00000000000
--- a/.github/workflows/reusable-add-or-remove-labels.yml
+++ /dev/null
@@ -1,42 +0,0 @@
-name: 'Modify Issue or Pull Request Labels'
-
-on:
-  workflow_call:
-    inputs:
-      add:
-        description: '(Optional) The comma-separated label(s) to add to the Issue or Pull Request.'
-        required: false
-        type: string
-      remove:
-        description: '(Optional) The comma-separated label(s) to remove from the Issue or Pull Request.'
-        required: false
-        type: string
-
-env:
-  GH_TOKEN: ${{ github.token }}
-  ITEM_URL: ${{ github.event.issue.html_url || github.event.pull_request.html_url }}
-
-jobs:
-  modify-labels:
-    name: 'Modify Label(s)'
-    runs-on: ubuntu-latest
-    env:
-      ITEM_TYPE: 'issue'
-    steps:
-      - name: 'Determine if the Item is an Issue or Pull Request'
-        # The issue_comment trigger happens for issues and pull requests.
-        # The best way to determine if an issue_comment trigger is related to an issue or pull request is to check
-        # whether or not github.event.issue.pull_request is empty.
-        if: github.event.pull_request || github.event.issue.pull_request
-        run: |
-          echo 'ITEM_TYPE=pr' >> $GITHUB_ENV
-
-      - name: 'Add Label(s) to Issue or Pull Request'
-        if: inputs.add != ''
-        run: |
-          gh $ITEM_TYPE edit $ITEM_URL --add-label ${{ inputs.add }}
-
-      - name: 'Remove Label(s) From Issue or Pull Request'
-        if: inputs.remove != ''
-        run: |
-          gh $ITEM_TYPE edit $ITEM_URL --remove-label ${{ inputs.remove }}
diff --git a/.github/workflows/semgrep-ci.yml b/.github/workflows/semgrep-ci.yml
index 76e521ecc5f..c466ddb5b2d 100644
--- a/.github/workflows/semgrep-ci.yml
+++ b/.github/workflows/semgrep-ci.yml
@@ -23,7 +23,7 @@ jobs:
     container:
       image: returntocorp/semgrep
     steps:
-      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       - run: |
           semgrep --validate \
             --config .ci/.semgrep.yml \
@@ -46,7 +46,7 @@ jobs:
       image: returntocorp/semgrep
     if: (github.action != 'dependabot[bot]')
     steps:
-      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       - run: semgrep --validate --config .ci/.semgrep-caps-aws-ec2.yml
       - run: semgrep $COMMON_PARAMS --config .ci/.semgrep-caps-aws-ec2.yml
 
@@ -57,7 +57,7 @@ jobs:
       image: returntocorp/semgrep
     if: (github.action != 'dependabot[bot]')
     steps:
-      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       - run: semgrep --validate --config .ci/.semgrep-configs.yml
       - run: semgrep $COMMON_PARAMS --config .ci/.semgrep-configs.yml
 
@@ -68,7 +68,7 @@ jobs:
       image: returntocorp/semgrep
     if: (github.action != 'dependabot[bot]')
     steps:
-      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       - run: semgrep --validate --config .ci/.semgrep-service-name0.yml
       - run: semgrep $COMMON_PARAMS --config .ci/.semgrep-service-name0.yml
 
@@ -79,7 +79,7 @@ jobs:
       image: returntocorp/semgrep
     if: (github.action != 'dependabot[bot]')
     steps:
-      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       - run: semgrep --validate --config .ci/.semgrep-service-name1.yml
       - run: semgrep $COMMON_PARAMS --config .ci/.semgrep-service-name1.yml
 
@@ -90,7 +90,7 @@ jobs:
       image: returntocorp/semgrep
     if: (github.action != 'dependabot[bot]')
     steps:
-      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       - run: semgrep --validate --config .ci/.semgrep-service-name2.yml
       - run: semgrep $COMMON_PARAMS --config .ci/.semgrep-service-name2.yml
 
@@ -101,6 +101,6 @@ jobs:
       image: returntocorp/semgrep
     if: (github.action != 'dependabot[bot]')
     steps:
-      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       - run: semgrep --validate --config .ci/.semgrep-service-name3.yml
       - run: semgrep $COMMON_PARAMS --config .ci/.semgrep-service-name3.yml
diff --git a/.github/workflows/skaff.yml b/.github/workflows/skaff.yml
index 47bbdc1948d..bc3c6177928 100644
--- a/.github/workflows/skaff.yml
+++ b/.github/workflows/skaff.yml
@@ -15,23 +15,23 @@ jobs:
     name: Compile skaff
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
           fetch-depth: 0
-      - uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753
+      - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
         with:
           go-version-file: skaff/go.mod
       # See also: https://github.com/actions/setup-go/issues/54
       - name: go env
         run: |
           echo "GOCACHE=$(go env GOCACHE)" >> $GITHUB_ENV
-      - uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8
+      - uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
         continue-on-error: true
         timeout-minutes: 2
         with:
           path: ${{ env.GOCACHE }}
           key: ${{ runner.os }}-GOCACHE-${{ hashFiles('go.sum') }}-${{ hashFiles('internal/**') }}
-      - uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8
+      - uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
         continue-on-error: true
         timeout-minutes: 2
         with:
diff --git a/.github/workflows/snapshot.yml b/.github/workflows/snapshot.yml
index 926e80a2057..69dffbaabea 100644
--- a/.github/workflows/snapshot.yml
+++ b/.github/workflows/snapshot.yml
@@ -9,18 +9,18 @@ jobs:
   goreleaser:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9
-      - uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
         with:
           go-version-file: go.mod
-      - uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8
+      - uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
         continue-on-error: true
         timeout-minutes: 2
         with:
           path: ~/go/pkg/mod
           key: ${{ runner.os }}-go-pkg-mod-${{ hashFiles('go.sum') }}
       - name: goreleaser release
-        uses: goreleaser/goreleaser-action@v4
+        uses: goreleaser/goreleaser-action@7ec5c2b0c6cdda6e8bbb49444bc797dd33d74dd8 # v5.0.0
         with:
           args: release --rm-dist --skip-sign --snapshot --timeout 2h
       - name: artifact naming
@@ -36,7 +36,7 @@ jobs:
             ARTIFACT="${GITHUB_REF}";;
           esac
           echo "artifact=$ARTIFACT-$(date -u +'%Y-%m-%dT%H-%M')" >> "$GITHUB_OUTPUT"
-      - uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce
+      - uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
         with:
           name: ${{steps.naming.outputs.artifact}}
           path: dist/*.zip
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
index 55f5e7108ed..b1cf1cc26c3 100644
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -7,7 +7,7 @@ jobs:
   stale:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@v8
+      - uses: actions/stale@1160a2240286f5da8ec72b1c0816ce2481aabf84 # v8.0.0
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           days-before-stale: 720
diff --git a/.github/workflows/team_slack_bot.yml b/.github/workflows/team_slack_bot.yml
index eedbdd47995..0252f3b154c 100644
--- a/.github/workflows/team_slack_bot.yml
+++ b/.github/workflows/team_slack_bot.yml
@@ -11,7 +11,7 @@ jobs:
     if: github.repository_owner == 'hashicorp'
     steps:
       - name: open-pr-stats
-        uses: breathingdust/github-team-slackbot@8f1053f9b472b94e6564ebc499a92136c48ace1f
+        uses: breathingdust/github-team-slackbot@8f1053f9b472b94e6564ebc499a92136c48ace1f # v18.5.1
         with:
           github_token: ${{ secrets.ORGSCOPED_GITHUB_TOKEN}}
           org: hashicorp
diff --git a/.github/workflows/terraform_provider.yml b/.github/workflows/terraform_provider.yml
deleted file mode 100644
index e929babf477..00000000000
--- a/.github/workflows/terraform_provider.yml
+++ /dev/null
@@ -1,278 +0,0 @@
-name: Provider Checks
-
-on:
-  push:
-    branches:
-      - main
-      - "release/**"
-  pull_request:
-    paths:
-      - .github/workflows/terraform_provider.yml
-      - .ci/.golangci.yml
-      - .ci/tools/go.mod
-      - .markdownlint.yml
-      - internal/**
-      - docs/index.md
-      - docs/data-sources/**
-      - docs/guides/**
-      - docs/resources/**
-      - go.sum
-      - GNUmakefile
-      - main.go
-      - names/**
-      - website/**
-
-env:
-  AWS_DEFAULT_REGION: us-west-2
-  TERRAFORM_VERSION: "1.0.6"
-
-jobs:
-  go_mod_download:
-    name: go mod download
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9
-      - uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753
-        with:
-          go-version-file: go.mod
-      - uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8
-        continue-on-error: true
-        id: cache-go-pkg-mod
-        timeout-minutes: 2
-        with:
-          path: ~/go/pkg/mod
-          key: ${{ runner.os }}-go-pkg-mod-${{ hashFiles('go.sum') }}
-      - if: steps.cache-go-pkg-mod.outputs.cache-hit != 'true' || steps.cache-go-pkg-mod.outcome == 'failure'
-        run: go mod download
-
-  go_build:
-    name: go build
-    needs: [go_mod_download]
-    runs-on: [custom, linux, medium]
-    steps:
-      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9
-      - uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8
-        continue-on-error: true
-        id: cache-terraform-plugin-dir
-        timeout-minutes: 2
-        with:
-          path: terraform-plugin-dir
-          key: ${{ runner.os }}-terraform-plugin-dir-${{ hashFiles('go.sum') }}-${{ hashFiles('internal/**') }}
-      - if: steps.cache-terraform-plugin-dir.outputs.cache-hit != 'true' || steps.cache-terraform-plugin-dir.outcome == 'failure'
-        uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753
-        with:
-          go-version-file: go.mod
-      # See also: https://github.com/actions/setup-go/issues/54
-      - if: steps.cache-terraform-plugin-dir.outputs.cache-hit != 'true' || steps.cache-terraform-plugin-dir.outcome == 'failure'
-        name: go env
-        run: |
-          echo "GOCACHE=$(go env GOCACHE)" >> $GITHUB_ENV
-      - if: steps.cache-terraform-plugin-dir.outputs.cache-hit != 'true' || steps.cache-terraform-plugin-dir.outcome == 'failure'
-        uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8
-        with:
-          path: ${{ env.GOCACHE }}
-          key: ${{ runner.os }}-GOCACHE-${{ hashFiles('go.sum') }}-${{ hashFiles('internal/**') }}
-      - if: steps.cache-terraform-plugin-dir.outputs.cache-hit != 'true' || steps.cache-terraform-plugin-dir.outcome == 'failure'
-        uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8
-        with:
-          path: ~/go/pkg/mod
-          key: ${{ runner.os }}-go-pkg-mod-${{ hashFiles('go.sum') }}
-      - if: steps.cache-terraform-plugin-dir.outputs.cache-hit != 'true' || steps.cache-terraform-plugin-dir.outcome == 'failure'
-        name: go build
-        run: go build -o terraform-plugin-dir/registry.terraform.io/hashicorp/aws/99.99.99/$(go env GOOS)_$(go env GOARCH)/terraform-provider-aws .
-
-  go_generate:
-    name: go generate
-    needs: [go_build]
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9
-      - uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753
-        with:
-          go-version-file: go.mod
-      # See also: https://github.com/actions/setup-go/issues/54
-      - name: go env
-        run: |
-          echo "GOCACHE=$(go env GOCACHE)" >> $GITHUB_ENV
-      - uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8
-        continue-on-error: true
-        timeout-minutes: 2
-        with:
-          path: ${{ env.GOCACHE }}
-          key: ${{ runner.os }}-GOCACHE-${{ hashFiles('go.sum') }}-${{ hashFiles('internal/**') }}
-      - uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8
-        continue-on-error: true
-        timeout-minutes: 2
-        with:
-          path: ~/go/pkg/mod
-          key: ${{ runner.os }}-go-pkg-mod-${{ hashFiles('go.sum') }}
-      - run: go install golang.org/x/tools/cmd/goimports@latest
-      - run: make gen
-      - name: Check for Git Differences
-        run: |
-          git diff --compact-summary --exit-code || \
-            (echo; echo "Unexpected difference in directories after code generation. Run 'make gen' command and commit."; exit 1)
-
-  go_test:
-    name: go test
-    needs: [go_build]
-    runs-on: [custom, linux, large]
-    steps:
-      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9
-        with:
-          fetch-depth: 0
-      - uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753
-        with:
-          go-version-file: go.mod
-      # See also: https://github.com/actions/setup-go/issues/54
-      - name: go env
-        run: |
-          echo "GOCACHE=$(go env GOCACHE)" >> $GITHUB_ENV
-      - uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8
-        continue-on-error: true
-        timeout-minutes: 2
-        with:
-          path: ${{ env.GOCACHE }}
-          key: ${{ runner.os }}-GOCACHE-${{ hashFiles('go.sum') }}-${{ hashFiles('internal/**') }}
-      - uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8
-        continue-on-error: true
-        timeout-minutes: 2
-        with:
-          path: ~/go/pkg/mod
-          key: ${{ runner.os }}-go-pkg-mod-${{ hashFiles('go.sum') }}
-      - name: Go Test
-        run: go test ./...
-
-  importlint:
-    needs: [go_build]
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9
-      - uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753
-        with:
-          go-version-file: go.mod
-      # See also: https://github.com/actions/setup-go/issues/54
-      - name: go env
-        run: |
-          echo "GOCACHE=$(go env GOCACHE)" >> $GITHUB_ENV
-      - uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8
-        continue-on-error: true
-        timeout-minutes: 2
-        with:
-          path: ${{ env.GOCACHE }}
-          key: ${{ runner.os }}-GOCACHE-${{ hashFiles('go.sum') }}-${{ hashFiles('internal/**') }}
-      - uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8
-        continue-on-error: true
-        timeout-minutes: 2
-        with:
-          path: ~/go/pkg/mod
-          key: ${{ runner.os }}-go-pkg-mod-${{ hashFiles('go.sum') }}
-      - run: cd .ci/tools && go install github.com/pavius/impi/cmd/impi
-      - run: impi --local . --scheme stdThirdPartyLocal ./...
-
-  compile_sweepers:
-    name: Compile sweepers
-    needs: [go_build]
-    runs-on: [custom, linux, medium]
-    steps:
-      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9
-        with:
-          fetch-depth: 0
-      - uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753
-        with:
-          go-version-file: go.mod
-      # See also: https://github.com/actions/setup-go/issues/54
-      - name: go env
-        run: |
-          echo "GOCACHE=$(go env GOCACHE)" >> $GITHUB_ENV
-      - uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8
-        continue-on-error: true
-        timeout-minutes: 2
-        with:
-          path: ${{ env.GOCACHE }}
-          key: ${{ runner.os }}-GOCACHE-${{ hashFiles('go.sum') }}-${{ hashFiles('internal/**') }}
-      - uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8
-        continue-on-error: true
-        timeout-minutes: 2
-        with:
-          path: ~/go/pkg/mod
-          key: ${{ runner.os }}-go-pkg-mod-${{ hashFiles('go.sum') }}
-      - name: Try building
-        run: go build -tags=sweep
-
-  terraform_providers_schema:
-    name: terraform providers schema
-    needs: [go_build]
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9
-      - uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8
-        continue-on-error: true
-        id: cache-terraform-providers-schema
-        timeout-minutes: 2
-        with:
-          path: terraform-providers-schema
-          key: ${{ runner.os }}-terraform-providers-schema-${{ hashFiles('go.sum') }}-${{ hashFiles('internal/**') }}
-      - if: steps.cache-terraform-providers-schema.outputs.cache-hit != 'true' || steps.cache-terraform-providers-schema.outcome == 'failure'
-        uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8
-        timeout-minutes: 2
-        with:
-          path: terraform-plugin-dir
-          key: ${{ runner.os }}-terraform-plugin-dir-${{ hashFiles('go.sum') }}-${{ hashFiles('internal/**') }}
-      - if: steps.cache-terraform-providers-schema.outputs.cache-hit != 'true' || steps.cache-terraform-providers-schema.outcome == 'failure'
-        uses: hashicorp/setup-terraform@633666f66e0061ca3b725c73b2ec20cd13a8fdd1
-        with:
-          terraform_version: ${{ env.TERRAFORM_VERSION }}
-          terraform_wrapper: false
-      - if: steps.cache-terraform-providers-schema.outputs.cache-hit != 'true' || steps.cache-terraform-providers-schema.outcome == 'failure'
-        name: terraform init
-        run: |
-          # We need a file to initialize the provider
-          echo 'data "aws_partition" "example" {}' > example.tf
-          terraform init -plugin-dir terraform-plugin-dir
-      - if: steps.cache-terraform-providers-schema.outputs.cache-hit != 'true' || steps.cache-terraform-providers-schema.outcome == 'failure'
-        name: terraform providers schema
-        run: |
-          mkdir terraform-providers-schema
-          terraform providers schema -json > terraform-providers-schema/schema.json
-
-  tfproviderdocs:
-    needs: [terraform_providers_schema]
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9
-      - uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753
-        with:
-          go-version-file: go.mod
-      - uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8
-        continue-on-error: true
-        timeout-minutes: 2
-        with:
-          path: ~/go/pkg/mod
-          key: ${{ runner.os }}-go-pkg-mod-${{ hashFiles('go.sum') }}
-      - run: cd .ci/tools && go install github.com/bflad/tfproviderdocs
-      - uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8
-        timeout-minutes: 2
-        with:
-          path: terraform-providers-schema
-          key: ${{ runner.os }}-terraform-providers-schema-${{ hashFiles('go.sum') }}-${{ hashFiles('internal/**') }}
-      - name: tfproviderdocs check
-        run: |
-          tfproviderdocs check \
-            -allowed-resource-subcategories-file website/allowed-subcategories.txt \
-            -enable-contents-check \
-            -ignore-file-missing-data-sources aws_alb,aws_alb_listener,aws_alb_target_group,aws_albs \
-            -ignore-file-missing-resources aws_alb,aws_alb_listener,aws_alb_listener_certificate,aws_alb_listener_rule,aws_alb_target_group,aws_alb_target_group_attachment \
-            -provider-source registry.terraform.io/hashicorp/aws \
-            -providers-schema-json terraform-providers-schema/schema.json \
-            -require-resource-subcategory \
-            -ignore-cdktf-missing-files
-
-  markdown-lint:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9
-      - uses: avto-dev/markdown-lint@04d43ee9191307b50935a753da3b775ab695eceb
-        with:
-          args: "."
-          ignore: "./docs ./website/docs ./CHANGELOG.md ./internal/service/cloudformation/testdata/examplecompany-exampleservice-exampleresource/docs"
diff --git a/.github/workflows/website.yml b/.github/workflows/website.yml
index c9f8c933447..c77c4a69e18 100644
--- a/.github/workflows/website.yml
+++ b/.github/workflows/website.yml
@@ -20,14 +20,14 @@ jobs:
   markdown-link-check-a-h-markdown:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9
-      - uses: YakDriver/md-check-links@9044b7162323b91150cef35355e1a3514564aa82
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: YakDriver/md-check-links@7450f426b758f0bf97f99ceb1aadcf57640a9ede # v2.0.6
         name: markdown-link-check website/docs/**/[a-h].markdown
         with:
           use-quiet-mode: "yes"
           use-verbose-mode: "yes"
           config-file: ".ci/.markdownlinkcheck.json"
-          folder-path: "website/docs"
+          folder-path: "website/docs/r, website/docs/d"
           file-prefix: "[a-h]"
           file-extension: ".markdown"
           base-branch: "main"
@@ -36,14 +36,14 @@ jobs:
   markdown-link-check-i-z-markdown:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9
-      - uses: YakDriver/md-check-links@9044b7162323b91150cef35355e1a3514564aa82
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: YakDriver/md-check-links@7450f426b758f0bf97f99ceb1aadcf57640a9ede # v2.0.6
         name: markdown-link-check website/docs/**/[i-z].markdown
         with:
           use-quiet-mode: "yes"
           use-verbose-mode: "yes"
           config-file: ".ci/.markdownlinkcheck.json"
-          folder-path: "website/docs"
+          folder-path: "website/docs/r, website/docs/d"
           file-prefix: "[i-z]"
           file-extension: ".markdown"
           base-branch: "main"
@@ -52,34 +52,39 @@ jobs:
   markdown-link-check-md:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9
-      - uses: YakDriver/md-check-links@9044b7162323b91150cef35355e1a3514564aa82
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: YakDriver/md-check-links@7450f426b758f0bf97f99ceb1aadcf57640a9ede # v2.0.6
         name: markdown-link-check website/docs/**/*.md
         with:
           use-quiet-mode: "yes"
           use-verbose-mode: "yes"
           config-file: ".ci/.markdownlinkcheck.json"
           folder-path: "website/docs"
+          # Don't check CDKTF translated guides, e.g. website/docs/cdktf/typescript/guides/version-4-upgrade.html.md.
+          max-depth: 2
           file-extension: ".md"
-          base-branch: "main"
-          check-modified-files-only: "yes"
+          # Checking only modified files in the PR does not respect 'mex-depth'.
+          # base-branch: "main"
+          # check-modified-files-only: "yes"
 
   markdown-lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9
-      - uses: avto-dev/markdown-lint@04d43ee9191307b50935a753da3b775ab695eceb
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: avto-dev/markdown-lint@04d43ee9191307b50935a753da3b775ab695eceb # v1.5.0
         with:
           args: "website/docs"
+          # Ignore CDKTF translated guides.
+          ignore: "website/docs/cdktf/*/guides/*"
 
   misspell:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9
-      - uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
         with:
           go-version-file: .ci/tools/go.mod
-      - uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8
+      - uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
         continue-on-error: true
         timeout-minutes: 2
         with:
@@ -91,11 +96,11 @@ jobs:
   terrafmt:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9
-      - uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
         with:
           go-version-file: .ci/tools/go.mod
-      - uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8
+      - uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
         continue-on-error: true
         timeout-minutes: 2
         with:
@@ -105,15 +110,15 @@ jobs:
       - run: terrafmt diff ./website --check --pattern '*.markdown'
 
   tflint:
-    runs-on: ubuntu-latest
+    runs-on: [custom, linux, xl]
     steps:
-      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
           fetch-depth: 0
-      - uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753
+      - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
         with:
           go-version-file: .ci/tools/go.mod
-      - uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8
+      - uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
         continue-on-error: true
         timeout-minutes: 2
         with:
@@ -123,7 +128,7 @@ jobs:
       - run: cd .ci/tools && go install github.com/katbyte/terrafmt
       - run: cd .ci/tools && go install github.com/terraform-linters/tflint
 
-      - uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8
+      - uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
         name: Cache plugin dir
         with:
           path: ~/.tflint.d/plugins
@@ -140,10 +145,6 @@ jobs:
           # being carried over from test cases.
           shared_rules=(
               "--enable-rule=terraform_comment_syntax"
-              "--disable-rule=aws_appsync_function_invalid_request_mapping_template"
-              "--disable-rule=aws_appsync_function_invalid_response_mapping_template"
-              "--disable-rule=aws_appsync_resolver_invalid_request_template"
-              "--disable-rule=aws_appsync_resolver_invalid_response_template"
               "--disable-rule=aws_cloudwatch_event_target_invalid_arn"
               "--disable-rule=aws_db_instance_default_parameter_group"
               "--disable-rule=aws_elasticache_cluster_default_parameter_group"
diff --git a/.github/workflows/workflow-lint.yml b/.github/workflows/workflow-lint.yml
index deb82720ee4..4d3dd8e0002 100644
--- a/.github/workflows/workflow-lint.yml
+++ b/.github/workflows/workflow-lint.yml
@@ -12,8 +12,8 @@ jobs:
   actionlint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9
-      - uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
         with:
           go-version-file: .ci/tools/go.mod
       - name: Install actionlint
diff --git a/.github/workflows/yamllint.yml b/.github/workflows/yamllint.yml
index 2714d7f34dc..4ad45df1ea4 100644
--- a/.github/workflows/yamllint.yml
+++ b/.github/workflows/yamllint.yml
@@ -12,9 +12,9 @@ jobs:
   yamllint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       - name: Run yamllint
-        uses: ibiqlik/action-yamllint@v3
+        uses: ibiqlik/action-yamllint@2576378a8e339169678f9939646ee3ee325e845c # v3.1.1
         with:
           format: github
         env:
diff --git a/.gitignore b/.gitignore
index e4623aa36be..da47be06b86 100644
--- a/.gitignore
+++ b/.gitignore
@@ -26,6 +26,7 @@ website/node_modules
 .vscode
 *.iml
 *.test
+*.prof
 *.iml
 log.txt
 markdown-link-check*.txt
diff --git a/.go-version b/.go-version
index 1b92e588b79..7bf9455f08c 100644
--- a/.go-version
+++ b/.go-version
@@ -1 +1 @@
-1.19.3
+1.20.5
diff --git a/.goreleaser.yml b/.goreleaser.yml
index c6dd5fac85d..10d53e75f6f 100644
--- a/.goreleaser.yml
+++ b/.goreleaser.yml
@@ -4,7 +4,6 @@ archives:
       - 'none*'
     format: zip
     name_template: '{{ .ProjectName }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}'
-    rlcp: true
 before:
   hooks:
     - 'go mod download'
diff --git a/.markdownlint.yml b/.markdownlint.yml
index e34dd1f6963..03e409bab2a 100644
--- a/.markdownlint.yml
+++ b/.markdownlint.yml
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 # Configuration for markdownlint
 # https://github.com/DavidAnson/markdownlint#configuration
 
diff --git a/.teamcity/.java-version b/.teamcity/.java-version
index 5f3c84a4912..0b495a50c11 100644
--- a/.teamcity/.java-version
+++ b/.teamcity/.java-version
@@ -1 +1 @@
-corretto64-11.0.13
+corretto64-17.0.7
diff --git a/.teamcity/GNUmakefile b/.teamcity/GNUmakefile
new file mode 100644
index 00000000000..667ef9283a4
--- /dev/null
+++ b/.teamcity/GNUmakefile
@@ -0,0 +1,7 @@
+default: tools
+
+tools:
+	mvn -U dependency:sources
+
+validate:
+	mvn teamcity-configs:generate
diff --git a/.teamcity/components/generated/services_all.kt b/.teamcity/components/generated/services_all.kt
index bd6736ce938..648a8178ad3 100644
--- a/.teamcity/components/generated/services_all.kt
+++ b/.teamcity/components/generated/services_all.kt
@@ -7,8 +7,8 @@ val services = mapOf(
     "acmpca" to ServiceSpec("ACM PCA (Certificate Manager Private Certificate Authority)"),
     "amp" to ServiceSpec("AMP (Managed Prometheus)"),
     "amplify" to ServiceSpec("Amplify"),
-    "apigateway" to ServiceSpec("API Gateway"),
-    "apigatewayv2" to ServiceSpec("API Gateway V2"),
+    "apigateway" to ServiceSpec("API Gateway", vpcLock = true),
+    "apigatewayv2" to ServiceSpec("API Gateway V2", vpcLock = true),
     "appautoscaling" to ServiceSpec("Application Auto Scaling", vpcLock = true),
     "appconfig" to ServiceSpec("AppConfig"),
     "appflow" to ServiceSpec("AppFlow"),
@@ -24,6 +24,7 @@ val services = mapOf(
     "autoscalingplans" to ServiceSpec("Auto Scaling Plans"),
     "backup" to ServiceSpec("Backup"),
     "batch" to ServiceSpec("Batch", vpcLock = true),
+    "bedrock" to ServiceSpec("Amazon Bedrock"),
     "budgets" to ServiceSpec("Web Services Budgets"),
     "ce" to ServiceSpec("CE (Cost Explorer)"),
     "chime" to ServiceSpec("Chime"),
@@ -40,6 +41,7 @@ val services = mapOf(
     "cloudwatch" to ServiceSpec("CloudWatch"),
     "codeartifact" to ServiceSpec("CodeArtifact"),
     "codebuild" to ServiceSpec("CodeBuild"),
+    "codecatalyst" to ServiceSpec("CodeCatalyst"),
     "codecommit" to ServiceSpec("CodeCommit"),
     "codegurureviewer" to ServiceSpec("CodeGuru Reviewer"),
     "codepipeline" to ServiceSpec("CodePipeline"),
@@ -57,7 +59,7 @@ val services = mapOf(
     "datapipeline" to ServiceSpec("Data Pipeline"),
     "datasync" to ServiceSpec("DataSync", vpcLock = true),
     "dax" to ServiceSpec("DynamoDB Accelerator (DAX)"),
-    "deploy" to ServiceSpec("CodeDeploy"),
+    "deploy" to ServiceSpec("CodeDeploy", vpcLock = true),
     "detective" to ServiceSpec("Detective"),
     "devicefarm" to ServiceSpec("Device Farm"),
     "directconnect" to ServiceSpec("Direct Connect", vpcLock = true),
@@ -70,7 +72,7 @@ val services = mapOf(
     "ec2" to ServiceSpec("EC2 (Elastic Compute Cloud)", vpcLock = true),
     "ecr" to ServiceSpec("ECR (Elastic Container Registry)"),
     "ecrpublic" to ServiceSpec("ECR Public", regionOverride = "us-east-1"),
-    "ecs" to ServiceSpec("ECS (Elastic Container)"),
+    "ecs" to ServiceSpec("ECS (Elastic Container)", vpcLock = true),
     "efs" to ServiceSpec("EFS (Elastic File System)", vpcLock = true),
     "eks" to ServiceSpec("EKS (Elastic Kubernetes)", vpcLock = true),
     "elasticache" to ServiceSpec("ElastiCache", vpcLock = true),
@@ -99,7 +101,7 @@ val services = mapOf(
     "healthlake" to ServiceSpec("HealthLake"),
     "iam" to ServiceSpec("IAM (Identity & Access Management)"),
     "identitystore" to ServiceSpec("SSO Identity Store"),
-    "imagebuilder" to ServiceSpec("EC2 Image Builder"),
+    "imagebuilder" to ServiceSpec("EC2 Image Builder", vpcLock = true),
     "inspector" to ServiceSpec("Inspector Classic"),
     "inspector2" to ServiceSpec("Inspector"),
     "internetmonitor" to ServiceSpec("CloudWatch Internet Monitor"),
@@ -117,6 +119,7 @@ val services = mapOf(
     "lakeformation" to ServiceSpec("Lake Formation"),
     "lambda" to ServiceSpec("Lambda", vpcLock = true),
     "lexmodels" to ServiceSpec("Lex Model Building"),
+    "lexv2models" to ServiceSpec("Lex V2 Models"),
     "licensemanager" to ServiceSpec("License Manager"),
     "lightsail" to ServiceSpec("Lightsail", regionOverride = "us-east-1"),
     "location" to ServiceSpec("Location"),
@@ -132,9 +135,9 @@ val services = mapOf(
     "mwaa" to ServiceSpec("MWAA (Managed Workflows for Apache Airflow)", vpcLock = true),
     "neptune" to ServiceSpec("Neptune"),
     "networkfirewall" to ServiceSpec("Network Firewall", vpcLock = true),
-    "networkmanager" to ServiceSpec("Network Manager"),
+    "networkmanager" to ServiceSpec("Network Manager", vpcLock = true),
     "oam" to ServiceSpec("CloudWatch Observability Access Manager"),
-    "opensearch" to ServiceSpec("OpenSearch"),
+    "opensearch" to ServiceSpec("OpenSearch", vpcLock = true),
     "opensearchserverless" to ServiceSpec("OpenSearch Serverless"),
     "opsworks" to ServiceSpec("OpsWorks", vpcLock = true),
     "organizations" to ServiceSpec("Organizations"),
@@ -192,6 +195,7 @@ val services = mapOf(
     "timestreamwrite" to ServiceSpec("Timestream Write"),
     "transcribe" to ServiceSpec("Transcribe"),
     "transfer" to ServiceSpec("Transfer Family", vpcLock = true),
+    "verifiedpermissions" to ServiceSpec("Verified Permissions"),
     "vpclattice" to ServiceSpec("VPC Lattice"),
     "waf" to ServiceSpec("WAF Classic", regionOverride = "us-east-1"),
     "wafregional" to ServiceSpec("WAF Classic Regional"),
diff --git a/.teamcity/components/service_build_config.kt b/.teamcity/components/service_build_config.kt
index 7619964a1ca..5626fe8cb11 100644
--- a/.teamcity/components/service_build_config.kt
+++ b/.teamcity/components/service_build_config.kt
@@ -1,10 +1,14 @@
+import jetbrains.buildServer.configs.kotlin.AbsoluteId
+import jetbrains.buildServer.configs.kotlin.BuildSteps
+import jetbrains.buildServer.configs.kotlin.BuildType
+import jetbrains.buildServer.configs.kotlin.DslContext
+import jetbrains.buildServer.configs.kotlin.ParameterDisplay
+import jetbrains.buildServer.configs.kotlin.buildFeatures.notifications
+import jetbrains.buildServer.configs.kotlin.buildSteps.ScriptBuildStep
+import jetbrains.buildServer.configs.kotlin.buildSteps.script
+import jetbrains.buildServer.configs.kotlin.failureConditions.failOnText
+import jetbrains.buildServer.configs.kotlin.failureConditions.BuildFailureOnText
 import java.io.File
-import jetbrains.buildServer.configs.kotlin.v2019_2.AbsoluteId
-import jetbrains.buildServer.configs.kotlin.v2019_2.BuildType
-import jetbrains.buildServer.configs.kotlin.v2019_2.DslContext
-import jetbrains.buildServer.configs.kotlin.v2019_2.ParameterDisplay
-import jetbrains.buildServer.configs.kotlin.v2019_2.buildFeatures.notifications
-import jetbrains.buildServer.configs.kotlin.v2019_2.buildSteps.script
 
 data class ServiceSpec(
     val readableName: String,
@@ -52,10 +56,7 @@ class Service(name: String, spec: ServiceSpec) {
 
             val serviceDir = "./internal/service/$packageName"
             steps {
-                script {
-                    name = "Setup GOENV"
-                    scriptContent = File("./scripts/setup_goenv.sh").readText()
-                }
+                ConfigureGoEnv()
                 script {
                     name = "Compile Test Binary"
                     workingDir = serviceDir
@@ -73,6 +74,17 @@ class Service(name: String, spec: ServiceSpec) {
                 }
             }
 
+            failureConditions {
+                failOnText {
+                    conditionType = BuildFailureOnText.ConditionType.REGEXP
+                    pattern = """(?i)build canceled"""
+                    failureMessage = "build canceled when agent unregistered"
+                    reverse = false
+                    stopBuildOnFailure = true
+                    reportOnlyFirstMatch = false
+                }
+            }
+
             features {
                 if (spec.vpcLock) {
                     feature {
@@ -105,3 +117,10 @@ class Service(name: String, spec: ServiceSpec) {
         }
     }
 }
+
+fun BuildSteps.ConfigureGoEnv() {
+    step(ScriptBuildStep {
+        name = "Configure GOENV"
+        scriptContent = File("./scripts/configure_goenv.sh").readText()
+    })
+}
diff --git a/.teamcity/pom.xml b/.teamcity/pom.xml
index 75834555f55..ba5c9571263 100644
--- a/.teamcity/pom.xml
+++ b/.teamcity/pom.xml
@@ -1,9 +1,9 @@
 <?xml version="1.0"?>
 <project>
     <modelVersion>4.0.0</modelVersion>
-    <name>AWS TeamCity Config DSL Script</name>
-    <groupId>TeamCity-Config-DSL-Script</groupId>
-    <artifactId>TeamCity-Config-DSL-Script</artifactId>
+    <name>Terraform-Provider-AWS Config DSL Script</name>
+    <groupId>TerraformProviderAWS</groupId>
+    <artifactId>TerraformProviderAWS</artifactId>
     <version>1.0-SNAPSHOT</version>
 
     <parent>
@@ -22,7 +22,7 @@
         </repository>
         <repository>
             <id>teamcity-server</id>
-            <url>https://ci-oss.hashicorp.engineering/app/dsl-plugins-repository</url>
+            <url>https://teamcity.jetbrains.com/app/dsl-plugins-repository</url>
             <snapshots>
                 <enabled>true</enabled>
             </snapshots>
@@ -70,10 +70,12 @@
                     <format>kotlin</format>
                     <dstDir>target/generated-configs</dstDir>
                     <!-- For testing -->
-                    <!--<contextParameters>
+                    <!--
+                    <contextParameters>
                         <run_nightly_build>true</run_nightly_build>
                         <trigger_time>02:05 America/Vancouver</trigger_time>
-                    </contextParameters>-->
+                    </contextParameters>
+                    -->
                 </configuration>
             </plugin>
         </plugins>
@@ -82,13 +84,13 @@
     <dependencies>
         <dependency>
             <groupId>org.jetbrains.teamcity</groupId>
-            <artifactId>configs-dsl-kotlin</artifactId>
+            <artifactId>configs-dsl-kotlin-latest</artifactId>
             <version>${teamcity.dsl.version}</version>
             <scope>compile</scope>
         </dependency>
         <dependency>
             <groupId>org.jetbrains.teamcity</groupId>
-            <artifactId>configs-dsl-kotlin-plugins</artifactId>
+            <artifactId>configs-dsl-kotlin-plugins-latest</artifactId>
             <version>1.0-SNAPSHOT</version>
             <type>pom</type>
             <scope>compile</scope>
diff --git a/.teamcity/scripts/configure_goenv.sh b/.teamcity/scripts/configure_goenv.sh
new file mode 100644
index 00000000000..8d406c61c3e
--- /dev/null
+++ b/.teamcity/scripts/configure_goenv.sh
@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+go_version="$(goenv local)"
+goenv install --skip-existing "${go_version}" && goenv rehash
diff --git a/.teamcity/scripts/performance.sh b/.teamcity/scripts/performance.sh
new file mode 100644
index 00000000000..87eec9a86bd
--- /dev/null
+++ b/.teamcity/scripts/performance.sh
@@ -0,0 +1,157 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+if [[ -n "%ACCTEST_ROLE_ARN%" ]]; then
+    conf=$(pwd)/aws.conf
+
+    function cleanup {
+        rm "${conf}"
+    }
+    trap cleanup EXIT
+
+    touch "${conf}"
+    chmod 600 "${conf}"
+    cat <<EOF >"${conf}"
+[profile perftest]
+role_arn       = %ACCTEST_ROLE_ARN%
+source_profile = source
+
+[profile source]
+aws_access_key_id     = %AWS_ACCESS_KEY_ID%
+aws_secret_access_key = %AWS_SECRET_ACCESS_KEY%
+EOF
+
+    unset AWS_ACCESS_KEY_ID
+    unset AWS_SECRET_ACCESS_KEY
+
+    export AWS_CONFIG_FILE="${conf}"
+    export AWS_PROFILE=perftest
+fi
+
+function vpctest {
+    local suffix=$1
+    TF_ACC=1 go test \
+        ./internal/service/ec2/... \
+        -v \
+        -run='^TestAccVPC_basic$' \
+        -cpuprofile cpu"${suffix}".prof \
+        -memprofile mem"${suffix}".prof \
+        -bench \
+        -timeout 60m
+}
+
+function ssmtest {
+    local suffix=$1
+    TF_ACC=1 go test \
+        ./internal/service/ssm/... \
+        -v \
+        -run='^TestAccSSMParameter_basic$' \
+        -cpuprofile cpu"${suffix}".prof \
+        -memprofile mem"${suffix}".prof \
+        -bench \
+        -timeout 60m
+}
+
+function analysis {
+    if ! command -v pprof &> /dev/null ; then
+        go install github.com/google/pprof@latest
+        goenv rehash
+    fi
+    if ! command -v pprof &> /dev/null ; then
+        go install github.com/google/pprof@latest
+        goenv rehash
+        if command -v rehash &> /dev/null ; then
+            rehash
+        fi
+    fi
+    if ! command -v pprof &> /dev/null ; then
+        echo "pprof not found after 3 attempts to install"
+        exit 1
+    fi
+
+    local perf_main_memalloc1=$( pprof -top -flat -sample_index=alloc_space -unit=mb memvpcmain.prof | head -5 | tr '\n' ' ' | sed -E 's/.*%% of ([0-9.]+)MB total.*/\1/g' )
+    local perf_main_meminuse1=$( pprof -top -flat -sample_index=inuse_space -unit=mb memvpcmain.prof | head -5 | tr '\n' ' ' | sed -E 's/.*%% of ([0-9.]+)MB total.*/\1/g' )
+    local perf_main_cputime1=$( pprof -top -flat -sample_index=cpu cpuvpcmain.prof | head -5 | tr '\n' ' ' | sed -E 's/.*%% of ([0-9.]+)s total.*/\1/g' ) 2>/dev/null
+
+    local perf_main_memalloc2=$( pprof -top -flat -sample_index=alloc_space -unit=mb memssmmain.prof | head -5 | tr '\n' ' ' | sed -E 's/.*%% of ([0-9.]+)MB total.*/\1/g' )
+    local perf_main_meminuse2=$( pprof -top -flat -sample_index=inuse_space -unit=mb memssmmain.prof | head -5 | tr '\n' ' ' | sed -E 's/.*%% of ([0-9.]+)MB total.*/\1/g' )
+    local perf_main_cputime2=$( pprof -top -flat -sample_index=cpu cpussmmain.prof | head -5 | tr '\n' ' ' | sed -E 's/.*%% of ([0-9.]+)s total.*/\1/g' ) 2>/dev/null
+
+    local perf_latest_memalloc1=$( pprof -top -flat -sample_index=alloc_space -unit=mb memvpclatest.prof | head -5 | tr '\n' ' ' | sed -E 's/.*%% of ([0-9.]+)MB total.*/\1/g' )
+    local perf_latest_meminuse1=$( pprof -top -flat -sample_index=inuse_space -unit=mb memvpclatest.prof | head -5 | tr '\n' ' ' | sed -E 's/.*%% of ([0-9.]+)MB total.*/\1/g' )
+    local perf_latest_cputime1=$( pprof -top -flat -sample_index=cpu cpuvpclatest.prof | head -5 | tr '\n' ' ' | sed -E 's/.*%% of ([0-9.]+)s total.*/\1/g' ) 2>/dev/null
+
+    local perf_latest_memalloc2=$( pprof -top -flat -sample_index=alloc_space -unit=mb memssmlatest.prof | head -5 | tr '\n' ' ' | sed -E 's/.*%% of ([0-9.]+)MB total.*/\1/g' )
+    local perf_latest_meminuse2=$( pprof -top -flat -sample_index=inuse_space -unit=mb memssmlatest.prof | head -5 | tr '\n' ' ' | sed -E 's/.*%% of ([0-9.]+)MB total.*/\1/g' )
+    local perf_latest_cputime2=$( pprof -top -flat -sample_index=cpu cpussmlatest.prof | head -5 | tr '\n' ' ' | sed -E 's/.*%% of ([0-9.]+)s total.*/\1/g' ) 2>/dev/null
+
+    local alloc=$( bc -l <<< "(((${perf_main_memalloc1}+${perf_main_memalloc2})/2)/((${perf_latest_memalloc1}+${perf_latest_memalloc2})/2)-1)*100" )
+    local inuse=$( bc -l <<< "(((${perf_main_meminuse1}+${perf_main_meminuse2})/2)/((${perf_latest_meminuse1}+${perf_latest_meminuse2})/2)-1)*100" )
+    local cputime=$( bc -l <<< "(((${perf_main_cputime1}+${perf_main_cputime2})/2)/((${perf_latest_cputime1}+${perf_latest_cputime2})/2)-1)*100" )
+
+    local alloc_mb_main=$( bc -l <<< "(${perf_main_memalloc1}+${perf_main_memalloc2})/2" )
+    local alloc_mb_latest=$( bc -l <<< "(${perf_latest_memalloc1}+${perf_latest_memalloc2})/2" )
+    local inuse_mb_main=$( bc -l <<< "(${perf_main_meminuse1}+${perf_main_meminuse2})/2" )
+    local inuse_mb_latest=$( bc -l <<< "(${perf_latest_meminuse1}+${perf_latest_meminuse2})/2" )
+    local cputime_s_main=$( bc -l <<< "(${perf_main_cputime1}+${perf_main_cputime2})/2" )
+    local cputime_s_latest=$( bc -l <<< "(${perf_latest_cputime1}+${perf_latest_cputime2})/2" )
+
+    local alloc_bw="Worse"
+    if (( $( echo "${alloc} < 0" | bc -l) )); then
+        alloc_bw="Better"
+    fi
+
+    local inuse_bw="Worse"
+    if (( $( echo "${inuse} < 0" | bc -l) )); then
+        inuse_bw="Better"
+    fi
+
+    local cputime_bw="Worse"
+    if (( $( echo "${cputime} < 0" | bc -l) )); then
+        cputime_bw="Better"
+    fi
+
+    local alloc_emoji=""
+    if (( $( echo "${alloc} > 4.99999" | bc -l) )); then
+        alloc_emoji=":x:"
+    elif (( $( echo "${alloc} < -4.99999" | bc -l) )); then
+        alloc_emoji=":white_check_mark:"
+    fi
+
+    local cputime_emoji=""
+    if (( $( echo "${cputime} > 4.99999" | bc -l) )); then
+        cputime_emoji=":x:"
+    elif (( $( echo "${cputime} < -4.99999" | bc -l) )); then
+        cputime_emoji=":white_check_mark:"
+    fi
+
+    printf "##teamcity[notification notifier='slack' message='*Performance changes from latest version (%%s) to main* |nAllocated memory: %%.1f%%%% (%%.1fMB to %%.1fMB) (%%s) %%s |nIn-use memory: %%.1f%%%% (%%.1fMB to %%.1fMB) (%%s) (wide-fluctuations normal) |nCPU time: %%.1f%%%% (%%.1fs to %%.1fs) (%%s) %%s' sendTo='CN0G9S7M4' connectionId='PROJECT_EXT_8']\n" "$(basename $(curl -Ls -o /dev/null -w %%{url_effective} https://github.com/hashicorp/terraform-provider-aws/releases/latest))" "${alloc}" "${alloc_mb_latest}" "${alloc_mb_main}" "${alloc_bw}" "${alloc_emoji}" "${inuse}" "${inuse_mb_latest}" "${inuse_mb_main}" "${inuse_bw}" "${cputime}" "${cputime_s_latest}" "${cputime_s_main}" "${cputime_bw}" "${cputime_emoji}"
+}
+
+if [ -f "memvpcmain.prof" -a -f "memssmmain.prof" -a -f "memvpclatest.prof" -a -f "memssmlatest.prof" ]; then
+    echo "Tests complete. Analyzing results..."
+    analysis
+fi
+
+if [ -f "memvpcmain.prof" -a -f "memssmmain.prof" -a -f "memvpclatest.prof" -a ! -f "memssmlatest.prof" ]; then
+    echo "Running SSM latest version ($(basename $(curl -Ls -o /dev/null -w %%{url_effective} https://github.com/hashicorp/terraform-provider-aws/releases/latest))) test..."
+    ssmtest ssmlatest
+fi
+
+if [ -f "memvpcmain.prof" -a -f "memssmmain.prof" -a ! -f "memvpclatest.prof" ]; then
+    echo "Running VPC latest version ($(basename $(curl -Ls -o /dev/null -w %%{url_effective} https://github.com/hashicorp/terraform-provider-aws/releases/latest))) test..."
+    git checkout $(basename $(curl -Ls -o /dev/null -w %%{url_effective} https://github.com/hashicorp/terraform-provider-aws/releases/latest))
+    vpctest vpclatest
+fi
+
+if [ -f "memvpcmain.prof" -a ! -f "memssmmain.prof" ]; then
+    echo "Running SSM main branch test..."
+    ssmtest ssmmain
+fi
+
+if [ ! -f "memvpcmain.prof" ]; then
+    go install github.com/google/pprof@latest
+    echo "Running VPC main branch test..."
+    vpctest vpcmain
+fi
diff --git a/.teamcity/scripts/provider_tests/acceptance_tests.sh b/.teamcity/scripts/provider_tests/acceptance_tests.sh
index 944f176cd92..2a7a03f2444 100644
--- a/.teamcity/scripts/provider_tests/acceptance_tests.sh
+++ b/.teamcity/scripts/provider_tests/acceptance_tests.sh
@@ -44,6 +44,7 @@ TF_ACC=1 go test \
     ./internal/flex/... \
     ./internal/framework/... \
     ./internal/generate/... \
+    ./internal/logging/... \
     ./internal/maps/... \
     ./internal/provider/... \
     ./internal/sdktypes/... \
diff --git a/.teamcity/scripts/provider_tests/unit_tests.sh b/.teamcity/scripts/provider_tests/unit_tests.sh
index 7658a6c4896..3a496319630 100644
--- a/.teamcity/scripts/provider_tests/unit_tests.sh
+++ b/.teamcity/scripts/provider_tests/unit_tests.sh
@@ -16,6 +16,7 @@ go test \
     ./internal/flex/... \
     ./internal/framework/... \
     ./internal/generate/... \
+    ./internal/logging/... \
     ./internal/maps/... \
     ./internal/provider/... \
     ./internal/sdktypes/... \
diff --git a/.teamcity/scripts/sanity.sh b/.teamcity/scripts/sanity.sh
new file mode 100644
index 00000000000..922e9e61cfd
--- /dev/null
+++ b/.teamcity/scripts/sanity.sh
@@ -0,0 +1,127 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+if [[ -n "%ACCTEST_ROLE_ARN%" ]]; then
+    conf=$(pwd)/aws.conf
+
+    function cleanup {
+        rm "${conf}"
+    }
+    trap cleanup EXIT
+
+    touch "${conf}"
+    chmod 600 "${conf}"
+    cat <<EOF >"${conf}"
+[profile perftest]
+role_arn       = %ACCTEST_ROLE_ARN%
+source_profile = source
+
+[profile source]
+aws_access_key_id     = %AWS_ACCESS_KEY_ID%
+aws_secret_access_key = %AWS_SECRET_ACCESS_KEY%
+EOF
+
+    unset AWS_ACCESS_KEY_ID
+    unset AWS_SECRET_ACCESS_KEY
+
+    export AWS_CONFIG_FILE="${conf}"
+    export AWS_PROFILE=perftest
+fi
+
+unset TF_LOG
+
+function tester {
+    local service=$1
+    local tests=$2
+
+    local results=`TF_ACC=1 go test ./internal/service/"${service}"/... -v -parallel 4 -run="${tests}" -timeout 60m 2>&1`
+    local exit_code=$?
+
+    echo "${results}"
+
+    if [[ "${results}" == *"text file busy"* ]]; then
+        echo "FAILED attempt to run tests"
+        echo "Trying again..."
+        sleep 5
+        tester "${service}" "${tests}"
+    fi
+
+    if [ "${exit_code}" -ne 0 ]; then
+        exit "${exit_code}"
+    fi
+}
+
+if [ ! -f "iamsanity.test" ]; then
+    tester "iam" 'TestAccIAMRole_basic|TestAccIAMRole_namePrefix|TestAccIAMRole_disappears|TestAccIAMRole_InlinePolicy_basic|TestAccIAMPolicyDocumentDataSource_basic|TestAccIAMPolicyDocumentDataSource_sourceConflicting|TestAccIAMPolicyDocumentDataSource_sourceJSONValidJSON|TestAccIAMRolePolicyAttachment_basic|TestAccIAMRolePolicyAttachment_disappears|TestAccIAMRolePolicyAttachment_Disappears_role|TestAccIAMPolicy_basic|TestAccIAMPolicy_policy|TestAccIAMPolicy_tags|TestAccIAMRolePolicy_basic|TestAccIAMRolePolicy_unknownsInPolicy|TestAccIAMInstanceProfile_basic|TestAccIAMInstanceProfile_tags'
+    touch iamsanity.test
+    exit 0
+fi
+
+if [ ! -f "logssanity.test" ]; then
+    tester "logs" 'TestAccLogsGroup_basic|TestAccLogsGroup_multiple'
+    touch logssanity.test
+    exit 0
+fi
+
+if [ ! -f "ec2sanity.test" ]; then
+    tester "ec2" 'TestAccVPCSecurityGroup_basic|TestAccVPCSecurityGroup_ipRangesWithSameRules|TestAccVPCSecurityGroup_vpcAllEgress|TestAccVPCSecurityGroupRule_race|TestAccVPCSecurityGroupRule_protocolChange|TestAccVPCDataSource_basic|TestAccVPCSubnet_basic|TestAccVPC_tenancy|TestAccVPCRouteTableAssociation_Subnet_basic|TestAccVPCRouteTable_basic'
+    touch ec2sanity.test
+    exit 0
+fi
+
+if [ ! -f "ecssanity.test" ]; then
+    tester "ecs" 'TestAccECSTaskDefinition_basic|TestAccECSService_basic'
+    touch ecssanity.test
+    exit 0
+fi
+
+if [ ! -f "elbv2sanity.test" ]; then
+    tester "elbv2" 'TestAccELBV2TargetGroup_basic'
+    touch elbv2sanity.test
+    exit 0
+fi
+
+if [ ! -f "kmssanity.test" ]; then
+    tester "kms" 'TestAccKMSKey_basic'
+    touch kmssanity.test
+    exit 0
+fi
+
+if [ ! -f "lambdasanity.test" ]; then
+    tester "lambda" 'TestAccLambdaFunction_basic|TestAccLambdaPermission_basic'
+    touch lambdasanity.test
+    exit 0
+fi
+
+if [ ! -f "metasanity.test" ]; then
+    tester "meta" 'TestAccMetaRegionDataSource_basic|TestAccMetaRegionDataSource_endpoint|TestAccMetaPartitionDataSource_basic'
+    touch metasanity.test
+    exit 0
+fi
+
+if [ ! -f "route53sanity.test" ]; then
+    tester "route53" 'TestAccRoute53Record_basic|TestAccRoute53Record_Latency_basic|TestAccRoute53ZoneDataSource_name'
+    touch route53sanity.test
+    exit 0
+fi
+
+if [ ! -f "s3sanity.test" ]; then
+    tester "s3" 'TestAccS3Bucket_Basic_basic|TestAccS3Bucket_Security_corsUpdate|TestAccS3BucketPublicAccessBlock_basic|TestAccS3BucketPolicy_basic|TestAccS3BucketACL_updateACL'
+    touch s3sanity.test
+    exit 0
+fi
+
+if [ ! -f "secretsmanagersanity.test" ]; then
+    tester "secretsmanager" 'TestAccSecretsManagerSecret_basic'
+    touch secretsmanagersanity.test
+    exit 0
+fi
+
+if [ ! -f "stssanity.test" ]; then
+    tester "sts" 'TestAccSTSCallerIdentityDataSource_basic'
+    touch stssanity.test
+    exit 0
+fi
+
+echo "##teamcity[notification notifier='slack' message='*Sanity Tests Passed!*:white_check_mark:' sendTo='CN0G9S7M4' connectionId='PROJECT_EXT_8']\n"
diff --git a/.teamcity/scripts/setup_goenv.sh b/.teamcity/scripts/setup_goenv.sh
deleted file mode 100644
index 82de04b051d..00000000000
--- a/.teamcity/scripts/setup_goenv.sh
+++ /dev/null
@@ -1,16 +0,0 @@
-#!/usr/bin/env bash
-
-set -euo pipefail
-
-pushd "${GOENV_ROOT}"
-# Make sure we're using the main `goenv`
-if ! git remote | grep -q syndbg; then
-  printf '\nInstalling syndbg/goenv\n'
-  git remote add -f syndbg https://github.com/syndbg/goenv.git
-fi
-printf '\nUpdating goenv to %s...\n' "${GOENV_TOOL_VERSION}"
-git reset --hard syndbg/"${GOENV_TOOL_VERSION}"
-popd
-
-go_version="$(goenv local)"
-goenv install --skip-existing "${go_version}" && goenv rehash
diff --git a/.teamcity/scripts/sweeper.sh b/.teamcity/scripts/sweeper.sh
index addf19603fc..29bda80948e 100644
--- a/.teamcity/scripts/sweeper.sh
+++ b/.teamcity/scripts/sweeper.sh
@@ -30,4 +30,4 @@ EOF
     export AWS_PROFILE=sweeper
 fi
 
-go test ./internal/sweep -v -tags=sweep -sweep="%SWEEPER_REGIONS%" -sweep-allow-failures -timeout=4h
+go test ./internal/sweep -v -sweep="%SWEEPER_REGIONS%" -sweep-allow-failures -timeout=4h
diff --git a/.teamcity/settings.kts b/.teamcity/settings.kts
index 31dafafbb10..8de00d0e177 100644
--- a/.teamcity/settings.kts
+++ b/.teamcity/settings.kts
@@ -1,15 +1,17 @@
-import jetbrains.buildServer.configs.kotlin.v2019_2.* // ktlint-disable no-wildcard-imports
-import jetbrains.buildServer.configs.kotlin.v2019_2.buildFeatures.golang
-import jetbrains.buildServer.configs.kotlin.v2019_2.buildFeatures.notifications
-import jetbrains.buildServer.configs.kotlin.v2019_2.buildSteps.script
-import jetbrains.buildServer.configs.kotlin.v2019_2.triggers.schedule
+import jetbrains.buildServer.configs.kotlin.* // ktlint-disable no-wildcard-imports
+import jetbrains.buildServer.configs.kotlin.buildFeatures.golang
+import jetbrains.buildServer.configs.kotlin.buildFeatures.notifications
+import jetbrains.buildServer.configs.kotlin.buildSteps.script
+import jetbrains.buildServer.configs.kotlin.failureConditions.failOnText
+import jetbrains.buildServer.configs.kotlin.failureConditions.BuildFailureOnText
+import jetbrains.buildServer.configs.kotlin.triggers.schedule
 import java.io.File
 import java.time.Duration
 import java.time.LocalTime
 import java.time.ZoneId
 import java.time.format.DateTimeFormatter
 
-version = "2020.2"
+version = "2023.05"
 
 val defaultRegion = DslContext.getParameter("default_region")
 val alternateRegion = DslContext.getParameter("alternate_region", "")
@@ -52,6 +54,9 @@ project {
         buildType(Sweeper)
     }
 
+    buildType(Sanity)
+    buildType(Performance)
+
     params {
         if (acctestParallelism != "") {
             text("ACCTEST_PARALLELISM", acctestParallelism, allowEmpty = false)
@@ -112,10 +117,15 @@ project {
         // Define this parameter even when not set to allow individual builds to set the value
         text("env.TF_ACC_TERRAFORM_VERSION", DslContext.getParameter("terraform_version", ""))
 
-        // These should be overridden in the base AWS project
-        param("env.GOPATH", "")
-        param("env.GO111MODULE", "") // No longer needed as of Go 1.16
-        param("env.GO_VERSION", "") // We're using `goenv` and `.go-version`
+        // These overrides exist because of the inherited dependency in the existing project structure and can
+        // be removed when this is moved outside of it
+        val isOnPrem = DslContext.getParameter("is_on_prem", "true").equals("true", ignoreCase = true)
+        if (isOnPrem) {
+            // These should be overridden in the base AWS project
+            param("env.GOPATH", "")
+            param("env.GO111MODULE", "") // No longer needed as of Go 1.16
+            param("env.GO_VERSION", "") // We're using `goenv` and `.go-version`
+        }
     }
 
     subProject(Services)
@@ -137,10 +147,7 @@ object PullRequest : BuildType({
 
     val accTestRoleARN = DslContext.getParameter("aws_account.role_arn", "")
     steps {
-        script {
-            name = "Setup GOENV"
-            scriptContent = File("./scripts/setup_goenv.sh").readText()
-        }
+        ConfigureGoEnv()
         script {
             name = "Run Tests"
             scriptContent = File("./scripts/pullrequest_tests/tests.sh").readText()
@@ -240,20 +247,24 @@ object FullBuild : BuildType({
         } else {
             "Sun-Thu"
         }
-        triggers {
-            schedule {
-                schedulingPolicy = cron {
-                    dayOfWeek = triggerDay
-                    val triggerHM = LocalTime.from(triggerTime)
-                    hours = triggerHM.getHour().toString()
-                    minutes = triggerHM.getMinute().toString()
-                    timezone = ZoneId.from(triggerTime).toString()
+
+        val enableTestTriggersGlobally = DslContext.getParameter("enable_test_triggers_globally", "true").equals("true", ignoreCase = true)
+        if (enableTestTriggersGlobally) {
+            triggers {
+                schedule {
+                    schedulingPolicy = cron {
+                        dayOfWeek = triggerDay
+                        val triggerHM = LocalTime.from(triggerTime)
+                        hours = triggerHM.getHour().toString()
+                        minutes = triggerHM.getMinute().toString()
+                        timezone = ZoneId.from(triggerTime).toString()
+                    }
+                    branchFilter = "" // For a Composite build, the branch filter must be empty
+                    triggerBuild = always()
+                    withPendingChangesOnly = false
+                    enableQueueOptimization = false
+                    enforceCleanCheckoutForDependencies = true
                 }
-                branchFilter = "" // For a Composite build, the branch filter must be empty
-                triggerBuild = always()
-                withPendingChangesOnly = false
-                enableQueueOptimization = false
-                enforceCleanCheckoutForDependencies = true
             }
         }
     }
@@ -298,10 +309,7 @@ object SetUp : BuildType({
     }
 
     steps {
-        script {
-            name = "Setup GOENV"
-            scriptContent = File("./scripts/setup_goenv.sh").readText()
-        }
+        ConfigureGoEnv()
         script {
             name = "Run provider unit tests"
             scriptContent = File("./scripts/provider_tests/unit_tests.sh").readText()
@@ -394,11 +402,7 @@ object CleanUp : BuildType({
     }
 
     steps {
-        script {
-            name = "Setup GOENV"
-            enabled = false
-            scriptContent = File("./scripts/setup_goenv.sh").readText()
-        }
+        ConfigureGoEnv()
         script {
             name = "Post-Sweeper"
             enabled = false
@@ -417,10 +421,7 @@ object Sweeper : BuildType({
     }
 
     steps {
-        script {
-            name = "Setup GOENV"
-            scriptContent = File("./scripts/setup_goenv.sh").readText()
-        }
+        ConfigureGoEnv()
         script {
             name = "Sweeper"
             scriptContent = File("./scripts/sweeper.sh").readText()
@@ -431,23 +432,36 @@ object Sweeper : BuildType({
     if (triggerTimeRaw != "") {
         val formatter = DateTimeFormatter.ofPattern("HH':'mm' 'VV")
         val triggerTime = formatter.parse(triggerTimeRaw)
-        triggers {
-            schedule {
-                schedulingPolicy = daily {
-                    val triggerHM = LocalTime.from(triggerTime)
-                    hour = triggerHM.getHour()
-                    minute = triggerHM.getMinute()
-                    timezone = ZoneId.from(triggerTime).toString()
+        val enableTestTriggersGlobally = DslContext.getParameter("enable_test_triggers_globally", "true").equals("true", ignoreCase = true)
+        if (enableTestTriggersGlobally) {
+            triggers {
+                schedule {
+                    schedulingPolicy = daily {
+                        val triggerHM = LocalTime.from(triggerTime)
+                        hour = triggerHM.getHour()
+                        minute = triggerHM.getMinute()
+                        timezone = ZoneId.from(triggerTime).toString()
+                    }
+                    branchFilter = "+:refs/heads/main"
+                    triggerBuild = always()
+                    withPendingChangesOnly = false
+                    enableQueueOptimization = true
+                    enforceCleanCheckoutForDependencies = true
                 }
-                branchFilter = "+:refs/heads/main"
-                triggerBuild = always()
-                withPendingChangesOnly = false
-                enableQueueOptimization = false
-                enforceCleanCheckoutForDependencies = true
             }
         }
     }
 
+    failureConditions {
+        failOnText {
+            conditionType = BuildFailureOnText.ConditionType.REGEXP
+            pattern = """Sweeper Tests for region \(([-a-z0-9]+)\) ran unsuccessfully"""
+            failureMessage = """Sweeper failure for region "${'$'}1""""
+            reverse = false
+            reportOnlyFirstMatch = false
+        }
+    }
+
     features {
         feature {
             type = "JetBrains.SharedResources"
@@ -481,3 +495,165 @@ object Sweeper : BuildType({
         }
     }
 })
+
+object Sanity : BuildType({
+    name = "Sanity"
+
+    vcs {
+        root(AbsoluteId(DslContext.getParameter("vcs_root_id")))
+
+        cleanCheckout = true
+    }
+
+    steps {
+        ConfigureGoEnv()
+        script {
+            name = "IAM"
+            scriptContent = File("./scripts/sanity.sh").readText()
+        }
+        script {
+            name = "Logs"
+            scriptContent = File("./scripts/sanity.sh").readText()
+        }
+        script {
+            name = "EC2"
+            scriptContent = File("./scripts/sanity.sh").readText()
+        }
+        script {
+            name = "ECS"
+            scriptContent = File("./scripts/sanity.sh").readText()
+        }
+        script {
+            name = "ELBv2"
+            scriptContent = File("./scripts/sanity.sh").readText()
+        }
+        script {
+            name = "KMS"
+            scriptContent = File("./scripts/sanity.sh").readText()
+        }
+        script {
+            name = "IAM"
+            scriptContent = File("./scripts/sanity.sh").readText()
+        }
+        script {
+            name = "Lambda"
+            scriptContent = File("./scripts/sanity.sh").readText()
+        }
+        script {
+            name = "Meta"
+            scriptContent = File("./scripts/sanity.sh").readText()
+        }
+        script {
+            name = "Route53"
+            scriptContent = File("./scripts/sanity.sh").readText()
+        }
+        script {
+            name = "S3"
+            scriptContent = File("./scripts/sanity.sh").readText()
+        }
+        script {
+            name = "Secrets Manager"
+            scriptContent = File("./scripts/sanity.sh").readText()
+        }
+        script {
+            name = "STS"
+            scriptContent = File("./scripts/sanity.sh").readText()
+        }  
+        script {
+            name = "Report Success"
+            scriptContent = File("./scripts/sanity.sh").readText()
+        }    
+    }
+
+    val triggerTimeRaw = DslContext.getParameter("sanity_trigger_time", "")
+    if (triggerTimeRaw != "") {
+        val formatter = DateTimeFormatter.ofPattern("HH':'mm' 'VV")
+        val triggerTime = formatter.parse(triggerTimeRaw)
+        val enableTestTriggersGlobally = DslContext.getParameter("enable_test_triggers_globally", "true").equals("true", ignoreCase = true)
+        if (enableTestTriggersGlobally) {
+            triggers {
+                schedule {
+                    schedulingPolicy = daily {
+                        val triggerHM = LocalTime.from(triggerTime)
+                        hour = triggerHM.getHour()
+                        minute = triggerHM.getMinute()
+                        timezone = ZoneId.from(triggerTime).toString()
+                    }
+                    branchFilter = "+:refs/heads/main"
+                    triggerBuild = always()
+                    withPendingChangesOnly = false
+                    enableQueueOptimization = true
+                    enforceCleanCheckoutForDependencies = true
+                }
+            }
+        }
+    }
+
+    features {
+        feature {
+            type = "JetBrains.SharedResources"
+            param("locks-param", "${DslContext.getParameter("aws_account.lock_id")} writeLock")
+        }
+    }
+})
+
+object Performance : BuildType({
+    name = "Performance"
+
+    vcs {
+        root(AbsoluteId(DslContext.getParameter("vcs_root_id")))
+
+        cleanCheckout = true
+    }
+
+    steps {
+        script {
+            name = "Configure Go"
+            scriptContent = File("./scripts/configure_goenv.sh").readText()
+        }
+        script {
+            name = "VPC Main"
+            scriptContent = File("./scripts/performance.sh").readText()
+        }
+        script {
+            name = "SSM Main"
+            scriptContent = File("./scripts/performance.sh").readText()
+        }
+        script {
+            name = "VPC Latest Version"
+            scriptContent = File("./scripts/performance.sh").readText()
+        }
+        script {
+            name = "SSM Latest Version"
+            scriptContent = File("./scripts/performance.sh").readText()
+        }
+        script {
+            name = "Analysis"
+            scriptContent = File("./scripts/performance.sh").readText()
+        }
+    }
+
+    val triggerTimeRaw = DslContext.getParameter("performance_trigger_time", "")
+    if (triggerTimeRaw != "") {
+        val formatter = DateTimeFormatter.ofPattern("HH':'mm' 'VV")
+        val triggerTime = formatter.parse(triggerTimeRaw)
+        val enableTestTriggersGlobally = DslContext.getParameter("enable_test_triggers_globally", "true").equals("true", ignoreCase = true)
+        if (enableTestTriggersGlobally) {
+            triggers {
+                schedule {
+                    schedulingPolicy = daily {
+                        val triggerHM = LocalTime.from(triggerTime)
+                        hour = triggerHM.getHour()
+                        minute = triggerHM.getMinute()
+                        timezone = ZoneId.from(triggerTime).toString()
+                    }
+                    branchFilter = "+:refs/heads/main"
+                    triggerBuild = always()
+                    withPendingChangesOnly = false
+                    enableQueueOptimization = true
+                    enforceCleanCheckoutForDependencies = true
+                }
+            }
+        }
+    }
+})
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8854f7a4210..1308ff1c45a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,24 +1,819 @@
-## 5.5.0 (Unreleased)
+## 5.24.0 (Unreleased)
+
+ENHANCEMENTS:
+
+* resource/aws_networkmanager_connect_attachment: Add `NO_ENCAP` as a valid `options.protocol` value ([#34109](https://github.com/hashicorp/terraform-provider-aws/issues/34109))
+* resource/aws_networkmanager_connect_peer: Add `subnet_arn` argument to support [Tunnel-less Connect attachments](https://docs.aws.amazon.com/network-manager/latest/cloudwan/cloudwan-connect-attachment.html#cloudwan-connect-tlc) ([#34109](https://github.com/hashicorp/terraform-provider-aws/issues/34109))
+* resource/aws_networkmanager_connect_peer: `inside_cidr_blocks` is Optional ([#34109](https://github.com/hashicorp/terraform-provider-aws/issues/34109))
+
+## 5.23.1 (October 27, 2023)
+
+BUG FIXES:
+
+* data-source/aws_lambda_function: Add `vpc_config.ipv6_allowed_for_dual_stack` attribute, fixing `Invalid address to set: []string{"vpc_config", "0", "ipv6_allowed_for_dual_stack"}` errors ([#34134](https://github.com/hashicorp/terraform-provider-aws/issues/34134))
+
+## 5.23.0 (October 26, 2023)
+
+NOTES:
+
+* provider: This release includes an update to the AWS SDK for Go v2 with breaking type changes to several services: `finspace`, `kafka`, `medialive`, `rds`, `s3control`, `timestreamwrite`, and `xray`. These changes primarily affect how arguments with default values are serialized for outbound requests, changing scalar types to pointers. See [this AWS SDK for Go V2 issue](https://github.com/aws/aws-sdk-go-v2/issues/2162) for additional context. The corresponding provider changes should make this breakfix transparent to users, but as with any breaking change there is the potential for missed edge cases. If errors are observed in the impacted resources, please link to this dependency update pull request in the bug report. ([#34096](https://github.com/hashicorp/terraform-provider-aws/issues/34096))
+
+FEATURES:
+
+* **New Resource:** `aws_iot_domain_configuration` ([#24765](https://github.com/hashicorp/terraform-provider-aws/issues/24765))
+
+ENHANCEMENTS:
+
+* data-source/aws_imagebuilder_image: Add `image_scanning_configuration` attribute ([#34049](https://github.com/hashicorp/terraform-provider-aws/issues/34049))
+* resource/aws_config_config_rule: Add `evaluation_mode` attribute ([#34033](https://github.com/hashicorp/terraform-provider-aws/issues/34033))
+* resource/aws_elasticache_replication_group: Add `ip_discovery` and `network_type` arguments ([#34019](https://github.com/hashicorp/terraform-provider-aws/issues/34019))
+* resource/aws_imagebuilder_image: Add `image_scanning_configuration` configuration block ([#34049](https://github.com/hashicorp/terraform-provider-aws/issues/34049))
+* resource/aws_kms_key: Add configurable timeouts ([#34112](https://github.com/hashicorp/terraform-provider-aws/issues/34112))
+* resource/aws_lambda_function: Add `vpc_config.ipv6_allowed_for_dual_stack` argument ([#34045](https://github.com/hashicorp/terraform-provider-aws/issues/34045))
+* resource/aws_lb: Add `dns_record_client_routing_policy` attribute to configure Availability Zonal DNS affinity on Network Load Balancer (NLB) ([#33992](https://github.com/hashicorp/terraform-provider-aws/issues/33992))
+* resource/aws_lb_target_group: Add `target_health_state` configuration block ([#34070](https://github.com/hashicorp/terraform-provider-aws/issues/34070))
+* resource/aws_lb_target_group: Remove default value (`false`) for `connection_termination` argument and mark as Computed, to support new default behavior for UDP/TCP_UDP target groups ([#34070](https://github.com/hashicorp/terraform-provider-aws/issues/34070))
+* resource/aws_neptune_cluster: Add `slowquery` as a valid `enable_cloudwatch_logs_exports` value ([#34053](https://github.com/hashicorp/terraform-provider-aws/issues/34053))
+
+BUG FIXES:
+
+* provider/tags: Prevent crash when `tags_all` is null ([#34073](https://github.com/hashicorp/terraform-provider-aws/issues/34073))
+* resource/aws_autoscaling_group: Fix error when `launch_template` name is updated. ([#34086](https://github.com/hashicorp/terraform-provider-aws/issues/34086))
+* resource/aws_dms_s3_endpoint: Don't send the default value of `false` for `add_trailing_padding_character`, maintaining compatibility with older ([pre-3.4.7](https://docs.aws.amazon.com/dms/latest/userguide/CHAP_ReleaseNotes.html#CHAP_ReleaseNotes.DMS347)) DMS engine versions ([#34048](https://github.com/hashicorp/terraform-provider-aws/issues/34048))
+* resource/aws_ecs_task_definition: Add `0` as a valid value for `volume.efs_volume_configuration.transit_encryption_port`, preventing unexpected drift ([#34020](https://github.com/hashicorp/terraform-provider-aws/issues/34020))
+* resource/aws_identitystore_group: Fix updating `description` attribute when it is changed ([#34037](https://github.com/hashicorp/terraform-provider-aws/issues/34037))
+* resource/aws_iot_indexing_configuration: Add `thing_indexing_configuration.filter` attribute, resolving `InvalidRequestException: NamedShadowNames Filter must not be empty for enabling NamedShadowIndexingMode` errors ([#26859](https://github.com/hashicorp/terraform-provider-aws/issues/26859))
+* resource/aws_storagegateway_gateway: Support the value `0` (representing Sunday) for `maintenance_start_time.day_of_week` ([#34015](https://github.com/hashicorp/terraform-provider-aws/issues/34015))
+* resource/aws_verifiedaccess_group: Fix `InvalidParameterValue: Policy Document cannot be provided when Policy Enabled is false or missing` errors when updating `policy_document` ([#34054](https://github.com/hashicorp/terraform-provider-aws/issues/34054))
+
+## 5.22.0 (October 19, 2023)
+
+FEATURES:
+
+* **New Data Source:** `aws_media_convert_queue` ([#27075](https://github.com/hashicorp/terraform-provider-aws/issues/27075))
+* **New Resource:** `aws_elasticsearch_vpc_endpoint` ([#33925](https://github.com/hashicorp/terraform-provider-aws/issues/33925))
+* **New Resource:** `aws_msk_replicator` ([#33973](https://github.com/hashicorp/terraform-provider-aws/issues/33973))
+
+ENHANCEMENTS:
+
+* data-source/aws_ec2_client_vpn_endpoint: Add `self_service_portal_url` attribute ([#34007](https://github.com/hashicorp/terraform-provider-aws/issues/34007))
+* resource/aws_alb: Support import of `name_prefix` argument ([#33852](https://github.com/hashicorp/terraform-provider-aws/issues/33852))
+* resource/aws_alb_target_group: Support import of `name_prefix` argument ([#33852](https://github.com/hashicorp/terraform-provider-aws/issues/33852))
+* resource/aws_cloudfront_public_key: Support import of `name_prefix` argument ([#33852](https://github.com/hashicorp/terraform-provider-aws/issues/33852))
+* resource/aws_db_option_group: Support import of `name_prefix` argument ([#33852](https://github.com/hashicorp/terraform-provider-aws/issues/33852))
+* resource/aws_docdb_cluster: Support import of `cluster_identifier_prefix` argument ([#33852](https://github.com/hashicorp/terraform-provider-aws/issues/33852))
+* resource/aws_docdb_cluster_instance: Support import of `identifier_prefix` argument ([#33852](https://github.com/hashicorp/terraform-provider-aws/issues/33852))
+* resource/aws_docdb_cluster_parameter_group: Support import of `name_prefix` argument ([#33852](https://github.com/hashicorp/terraform-provider-aws/issues/33852))
+* resource/aws_docdb_subnet_group: Support import of `name_prefix` argument ([#33852](https://github.com/hashicorp/terraform-provider-aws/issues/33852))
+* resource/aws_ec2_client_vpn_endpoint: Add `self_service_portal_url` attribute ([#34007](https://github.com/hashicorp/terraform-provider-aws/issues/34007))
+* resource/aws_elb: Support import of `name_prefix` argument ([#33852](https://github.com/hashicorp/terraform-provider-aws/issues/33852))
+* resource/aws_emr_security_configuration: Support import of `name_prefix` argument ([#33852](https://github.com/hashicorp/terraform-provider-aws/issues/33852))
+* resource/aws_iam_group_policy: Support import of `name_prefix` argument ([#33852](https://github.com/hashicorp/terraform-provider-aws/issues/33852))
+* resource/aws_iam_role_policy: Support import of `name_prefix` argument ([#33852](https://github.com/hashicorp/terraform-provider-aws/issues/33852))
+* resource/aws_iam_user_policy: Support import of `name_prefix` argument ([#33852](https://github.com/hashicorp/terraform-provider-aws/issues/33852))
+* resource/aws_iot_provisioning_template: Add `type` attribute ([#33950](https://github.com/hashicorp/terraform-provider-aws/issues/33950))
+* resource/aws_lb: Support import of `name_prefix` argument ([#33852](https://github.com/hashicorp/terraform-provider-aws/issues/33852))
+* resource/aws_lb_target_group: Support import of `name_prefix` argument ([#33852](https://github.com/hashicorp/terraform-provider-aws/issues/33852))
+* resource/aws_neptune_cluster: Support import of `cluster_identifier_prefix` argument ([#33852](https://github.com/hashicorp/terraform-provider-aws/issues/33852))
+* resource/aws_neptune_cluster_instance: Support import of `identifier_prefix` argument ([#33852](https://github.com/hashicorp/terraform-provider-aws/issues/33852))
+* resource/aws_neptune_cluster_parameter_group: Support import of `name_prefix` argument ([#33852](https://github.com/hashicorp/terraform-provider-aws/issues/33852))
+* resource/aws_neptune_event_subscription: Support import of `name_prefix` argument ([#33852](https://github.com/hashicorp/terraform-provider-aws/issues/33852))
+* resource/aws_pinpoint_app: Support import of `name_prefix` argument ([#33852](https://github.com/hashicorp/terraform-provider-aws/issues/33852))
+* resource/aws_rds_cluster: Support import of `cluster_identifier_prefix` argument ([#33852](https://github.com/hashicorp/terraform-provider-aws/issues/33852))
+* resource/aws_rds_cluster_instance: Support import of `identifier_prefix` argument ([#33852](https://github.com/hashicorp/terraform-provider-aws/issues/33852))
+* resource/aws_signer_signing_profile: Support import of `name_prefix` argument ([#33852](https://github.com/hashicorp/terraform-provider-aws/issues/33852))
+* resource/aws_signer_signing_profile_permission: Add `signer:SignPayload` as a valid `action` value ([#33852](https://github.com/hashicorp/terraform-provider-aws/issues/33852))
+* resource/aws_signer_signing_profile_permission: Support import of `statement_id_prefix` argument ([#33852](https://github.com/hashicorp/terraform-provider-aws/issues/33852))
+* resource/aws_transfer_server: Change `pre_authentication_login_banner` and `post_authentication_login_banner` length limits to 4096 ([#33937](https://github.com/hashicorp/terraform-provider-aws/issues/33937))
+* resource/aws_wafv2_web_acl: Add `ja3_fingerprint` to `field_to_match` configuration blocks ([#33933](https://github.com/hashicorp/terraform-provider-aws/issues/33933))
+
+BUG FIXES:
+
+* data-source/aws_dms_certificate: Fix crash when certificate not found ([#34012](https://github.com/hashicorp/terraform-provider-aws/issues/34012))
+* resource/aws_cloudformation_stack: Fix error when `computed` values are not set when there is no update ([#33969](https://github.com/hashicorp/terraform-provider-aws/issues/33969))
+* resource/aws_codecommit_repository: Doesn't force replacement when renaming ([#32207](https://github.com/hashicorp/terraform-provider-aws/issues/32207))
+* resource/aws_db_instance: Creating resource from snapshot or point-in-time recovery now handles `manage_master_user_password` and `master_user_secret_kms_key_id` attributes correctly ([#33699](https://github.com/hashicorp/terraform-provider-aws/issues/33699))
+* resource/aws_elasticache_replication_group: Fix error when switching `engine_version` from `6.x` to a specific `6.<digit>` version number ([#33954](https://github.com/hashicorp/terraform-provider-aws/issues/33954))
+* resource/aws_iam_role: Fix refreshing `permission_boundary` when deleted outside of Terraform ([#33963](https://github.com/hashicorp/terraform-provider-aws/issues/33963))
+* resource/aws_iam_user: Fix refreshing `permission_boundary` when deleted outside of Terraform ([#33963](https://github.com/hashicorp/terraform-provider-aws/issues/33963))
+* resource/aws_inspector2_enabler: Fix `Value at 'resourceTypes' failed to satisfy constraint` errors ([#33348](https://github.com/hashicorp/terraform-provider-aws/issues/33348))
+* resource/aws_neptune_cluster_instance: Remove [ForceNew](https://developer.hashicorp.com/terraform/plugin/sdkv2/schemas/schema-behaviors#forcenew) from `engine_version` ([#33487](https://github.com/hashicorp/terraform-provider-aws/issues/33487))
+* resource/aws_neptune_cluster_parameter_group: Fix condition where defined cluster parameters with system default values are seen as updates ([#33487](https://github.com/hashicorp/terraform-provider-aws/issues/33487))
+* resource/aws_s3_bucket_object_lock_configuration: Fix `found resource` errors on Delete ([#33966](https://github.com/hashicorp/terraform-provider-aws/issues/33966))
+
+## 5.21.0 (October 12, 2023)
+
+FEATURES:
+
+* **New Data Source:** `aws_servicequotas_templates` ([#33871](https://github.com/hashicorp/terraform-provider-aws/issues/33871))
+* **New Resource:** `aws_ec2_image_block_public_access` ([#33810](https://github.com/hashicorp/terraform-provider-aws/issues/33810))
+* **New Resource:** `aws_guardduty_organization_configuration_feature` ([#33913](https://github.com/hashicorp/terraform-provider-aws/issues/33913))
+* **New Resource:** `aws_servicequotas_template_association` ([#33725](https://github.com/hashicorp/terraform-provider-aws/issues/33725))
+* **New Resource:** `aws_verifiedaccess_group` ([#33297](https://github.com/hashicorp/terraform-provider-aws/issues/33297))
+* **New Resource:** `aws_verifiedaccess_instance_logging_configuration` ([#33864](https://github.com/hashicorp/terraform-provider-aws/issues/33864))
+
+ENHANCEMENTS:
+
+* data-source/aws_dms_endpoint: Add `s3_settings.glue_catalog_generation` attribute ([#33778](https://github.com/hashicorp/terraform-provider-aws/issues/33778))
+* data-source/aws_msk_cluster: Add `cluster_uuid` attribute ([#33805](https://github.com/hashicorp/terraform-provider-aws/issues/33805))
+* resource/aws_codedeploy_deployment_group: Add `outdated_instances_strategy` argument ([#33844](https://github.com/hashicorp/terraform-provider-aws/issues/33844))
+* resource/aws_dms_endpoint: Add `s3_settings.glue_catalog_generation` attribute ([#33778](https://github.com/hashicorp/terraform-provider-aws/issues/33778))
+* resource/aws_dms_s3_endpoint: Add `glue_catalog_generation` attribute ([#33778](https://github.com/hashicorp/terraform-provider-aws/issues/33778))
+* resource/aws_docdb_cluster: Add `allow_major_version_upgrade` argument ([#33790](https://github.com/hashicorp/terraform-provider-aws/issues/33790))
+* resource/aws_docdb_cluster_instance: Add `copy_tags_to_snapshot` argument ([#31022](https://github.com/hashicorp/terraform-provider-aws/issues/31022))
+* resource/aws_dynamodb_table: Add `import_table` configuration block ([#33802](https://github.com/hashicorp/terraform-provider-aws/issues/33802))
+* resource/aws_msk_cluster: Add `cluster_uuid` attribute ([#33805](https://github.com/hashicorp/terraform-provider-aws/issues/33805))
+* resource/aws_msk_serverless_cluster: Add `cluster_uuid` attribute ([#33805](https://github.com/hashicorp/terraform-provider-aws/issues/33805))
+* resource/aws_networkmanager_core_network: Add `base_policy_document` argument ([#33712](https://github.com/hashicorp/terraform-provider-aws/issues/33712))
+* resource/aws_redshiftserverless_workgroup: Allow `require_ssl` and `use_fips_ssl` `config_parameters` keys ([#33916](https://github.com/hashicorp/terraform-provider-aws/issues/33916))
+* resource/aws_s3_bucket: Use configurable timeout for resource Delete ([#33845](https://github.com/hashicorp/terraform-provider-aws/issues/33845))
+* resource/aws_verifiedaccess_instance: Add `fips_enabled` argument ([#33880](https://github.com/hashicorp/terraform-provider-aws/issues/33880))
+* resource/aws_vpclattice_target_group: Add `config.lambda_event_structure_version` argument ([#33804](https://github.com/hashicorp/terraform-provider-aws/issues/33804))
+* resource/aws_vpclattice_target_group: Make `config.port`, `config.protocol` and `config.vpc_identifier` optional ([#33804](https://github.com/hashicorp/terraform-provider-aws/issues/33804))
+* resource/aws_wafv2_web_acl: Add `aws_managed_rules_acfp_rule_set` to `managed_rule_group_configs` configuration block ([#33915](https://github.com/hashicorp/terraform-provider-aws/issues/33915))
+
+BUG FIXES:
+
+* provider: Respect valid values for the `AWS_S3_US_EAST_1_REGIONAL_ENDPOINT` environment variable when configuring the S3 API client ([#33874](https://github.com/hashicorp/terraform-provider-aws/issues/33874))
+* resource/aws_appflow_connector_profile: Fix various crashes ([#33856](https://github.com/hashicorp/terraform-provider-aws/issues/33856))
+* resource/aws_db_parameter_group: Group names containing periods (`.`) no longer fail validation ([#33704](https://github.com/hashicorp/terraform-provider-aws/issues/33704))
+* resource/aws_opensearchserverless_collection: Fix crash when error is returned ([#33918](https://github.com/hashicorp/terraform-provider-aws/issues/33918))
+* resource/aws_rds_cluster_parameter_group: Group names containing periods (`.`) no longer fail validation ([#33704](https://github.com/hashicorp/terraform-provider-aws/issues/33704))
+
+## 5.20.1 (October 10, 2023)
+
+NOTES:
+
+* provider: Build with [Terraform Plugin Framework v1.4.1](https://github.com/hashicorp/terraform-plugin-framework/blob/main/CHANGELOG.md#141-october-09-2023), fixing potential [initialization errors](https://github.com/hashicorp/terraform/issues/33990) when using v1.6 of the Terraform CLI.
+
+## 5.20.0 (October  6, 2023)
+
+FEATURES:
+
+* **New Resource:** `aws_guardduty_detector_feature` ([#31463](https://github.com/hashicorp/terraform-provider-aws/issues/31463))
+* **New Resource:** `aws_servicequotas_template` ([#33688](https://github.com/hashicorp/terraform-provider-aws/issues/33688))
+* **New Resource:** `aws_sesv2_account_vdm_attributes` ([#33705](https://github.com/hashicorp/terraform-provider-aws/issues/33705))
+* **New Resource:** `aws_verifiedaccess_instance_trust_provider_attachment` ([#33734](https://github.com/hashicorp/terraform-provider-aws/issues/33734))
+
+ENHANCEMENTS:
+
+* data-source/aws_guardduty_detector: Add `features` attribute ([#31463](https://github.com/hashicorp/terraform-provider-aws/issues/31463))
+* resource/aws_finspace_kx_cluster: Increase default creation timeout to 45 minutes, default deletion timeout to 60 minutes ([#33745](https://github.com/hashicorp/terraform-provider-aws/issues/33745))
+* resource/aws_finspace_kx_environment: Increase default deletion timeout to 45 minutes ([#33745](https://github.com/hashicorp/terraform-provider-aws/issues/33745))
+* resource/aws_guardduty_filter: Add plan-time validation of `name` ([#21030](https://github.com/hashicorp/terraform-provider-aws/issues/21030))
+* resource/aws_kinesis_firehose_delivery_stream: Add `opensearchserverless_configuration` and `msk_source_configuration` configuration blocks ([#33101](https://github.com/hashicorp/terraform-provider-aws/issues/33101))
+* resource/aws_kinesis_firehose_delivery_stream: Add `opensearchserverless` as a valid `destination` value ([#33101](https://github.com/hashicorp/terraform-provider-aws/issues/33101))
+
+BUG FIXES:
+
+* data-source/aws_fsx_ontap_storage_virtual_machine: Fix crash when `active_directory_configuration.self_managed_active_directory_configuration.file_system_administrators_group` is not configured ([#33800](https://github.com/hashicorp/terraform-provider-aws/issues/33800))
+* resource/aws_ec2_transit_gateway_route : Fix TGW route search filter to avoid routes being missed when more than 1,000 static routes are in a TGW route table ([#33765](https://github.com/hashicorp/terraform-provider-aws/issues/33765))
+* resource/aws_fsx_ontap_storage_virtual_machine: Fix crash when `active_directory_configuration.self_managed_active_directory_configuration.file_system_administrators_group` is not configured ([#33800](https://github.com/hashicorp/terraform-provider-aws/issues/33800))
+* resource/aws_medialive_channel: Fix VPC settings flatten/expand/docs. ([#33558](https://github.com/hashicorp/terraform-provider-aws/issues/33558))
+* resource/aws_vpc_endpoint: Set `dns_options.dns_record_ip_type` to `Computed` to prevent diffs ([#33743](https://github.com/hashicorp/terraform-provider-aws/issues/33743))
+
+## 5.19.0 (September 29, 2023)
+
+BREAKING CHANGES:
+
+* data-source/aws_s3_bucket_object: Following migration to [AWS SDK for Go v2](https://aws.github.io/aws-sdk-go-v2/), the `metadata` attribute's [keys](https://developer.hashicorp.com/terraform/language/expressions/types#maps-objects) are always [returned in lowercase](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/service/s3#HeadObjectOutput) ([#33660](https://github.com/hashicorp/terraform-provider-aws/issues/33660))
+* data-source/aws_s3_object: Following migration to [AWS SDK for Go v2](https://aws.github.io/aws-sdk-go-v2/), the `metadata` attribute's [keys](https://developer.hashicorp.com/terraform/language/expressions/types#maps-objects) are always [returned in lowercase](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/service/s3#HeadObjectOutput) ([#33660](https://github.com/hashicorp/terraform-provider-aws/issues/33660))
+
+NOTES:
+
+* data-source/aws_s3_bucket_object: The `metadata` attribute's keys are now always returned in lowercase. Please modify configurations as necessary ([#33660](https://github.com/hashicorp/terraform-provider-aws/issues/33660))
+* data-source/aws_s3_object: The `metadata` attribute's keys are now always returned in lowercase. Please modify configurations as necessary ([#33660](https://github.com/hashicorp/terraform-provider-aws/issues/33660))
+* resource/aws_iam_*: This release introduces additional validation of IAM policy JSON arguments to detect duplicate keys. Previously, arguments with duplicated keys resulted in all but one of the key values being overwritten. Since this results in unexpected IAM policies being submitted to AWS, we have updated the validation logic to error in these cases. This may cause existing IAM policy arguments to fail validation, however, those policies are likely not what was originally intended. ([#33570](https://github.com/hashicorp/terraform-provider-aws/issues/33570))
+
+FEATURES:
+
+* **New Resource:** `aws_cleanrooms_configured_table` ([#33602](https://github.com/hashicorp/terraform-provider-aws/issues/33602))
+* **New Resource:** `aws_dms_replication_config` ([#32908](https://github.com/hashicorp/terraform-provider-aws/issues/32908))
+* **New Resource:** `aws_lexv2models_bot` ([#33475](https://github.com/hashicorp/terraform-provider-aws/issues/33475))
+* **New Resource:** `aws_rds_custom_db_engine_version` ([#33285](https://github.com/hashicorp/terraform-provider-aws/issues/33285))
+
+ENHANCEMENTS:
+
+* resource/aws_cloud9_environment_ec2: Add `ubuntu-22.04-x86_64` and `resolve:ssm:/aws/service/cloud9/amis/ubuntu-22.04-x86_64` as valid values for `image_id` ([#33662](https://github.com/hashicorp/terraform-provider-aws/issues/33662))
+* resource/aws_fsx_ontap_volume: Add `bypass_snaplock_enterprise_retention` argument and `snaplock_configuration` configuration block to support [SnapLock](https://docs.aws.amazon.com/fsx/latest/ONTAPGuide/snaplock.html) ([#32530](https://github.com/hashicorp/terraform-provider-aws/issues/32530))
+* resource/aws_fsx_ontap_volume: Add `copy_tags_to_backups` and `snapshot_policy` arguments ([#32530](https://github.com/hashicorp/terraform-provider-aws/issues/32530))
+* resource/aws_fsx_openzfs_volume: Add `delete_volume_options` argument ([#32530](https://github.com/hashicorp/terraform-provider-aws/issues/32530))
+* resource/aws_lightsail_bucket: Add `force_delete` argument ([#33586](https://github.com/hashicorp/terraform-provider-aws/issues/33586))
+* resource/aws_opensearch_outbound_connection: Add `connection_properties`, `connection_mode` and `accept_connection` arguments ([#32990](https://github.com/hashicorp/terraform-provider-aws/issues/32990))
+* resource/aws_wafv2_rule_group: Add `rate_based_statement.custom_key` configuration block ([#33594](https://github.com/hashicorp/terraform-provider-aws/issues/33594))
+* resource/aws_wafv2_web_acl: Add `rate_based_statement.custom_key` configuration block ([#33594](https://github.com/hashicorp/terraform-provider-aws/issues/33594))
+
+BUG FIXES:
+
+* resource/aws_batch_job_queue: Correctly validates elements of `compute_environments` as ARNs ([#33577](https://github.com/hashicorp/terraform-provider-aws/issues/33577))
+* resource/aws_cloudfront_continuous_deployment_policy: Fix `IllegalUpdate` errors when updating a staging `aws_cloudfront_distribution` that is part of continuous deployment ([#33578](https://github.com/hashicorp/terraform-provider-aws/issues/33578))
+* resource/aws_cloudfront_distribution: Fix `IllegalUpdate` errors when updating a staging distribution associated with an `aws_cloudfront_continuous_deployment_policy` ([#33578](https://github.com/hashicorp/terraform-provider-aws/issues/33578))
+* resource/aws_cloudfront_distribution: Fix `PreconditionFailed` errors when destroying a distribution associated with an `aws_cloudfront_continuous_deployment_policy` ([#33578](https://github.com/hashicorp/terraform-provider-aws/issues/33578))
+* resource/aws_cloudfront_distribution: Fix `StagingDistributionInUse` errors when destroying a distribution associated with an `aws_cloudfront_continuous_deployment_policy` ([#33578](https://github.com/hashicorp/terraform-provider-aws/issues/33578))
+* resource/aws_datasync_location_fsx_ontap_file_system: Correct handling of `protocol.smb.domain`, `protocol.smb.user` and `protocol.smb.password` ([#33641](https://github.com/hashicorp/terraform-provider-aws/issues/33641))
+* resource/aws_glacier_vault_lock: Fail validation if duplicated keys are found in `policy` ([#33570](https://github.com/hashicorp/terraform-provider-aws/issues/33570))
+* resource/aws_iam_group_policy: Fail validation if duplicated keys are found in `policy` ([#33570](https://github.com/hashicorp/terraform-provider-aws/issues/33570))
+* resource/aws_iam_policy: Fail validation if duplicated keys are found in `policy` ([#33570](https://github.com/hashicorp/terraform-provider-aws/issues/33570))
+* resource/aws_iam_role: Fail validation if duplicated keys are found in `assume_role_policy` ([#33570](https://github.com/hashicorp/terraform-provider-aws/issues/33570))
+* resource/aws_iam_role_policy: Fail validation if duplicated keys are found in `policy` ([#33570](https://github.com/hashicorp/terraform-provider-aws/issues/33570))
+* resource/aws_iam_user_policy: Fail validation if duplicated keys are found in `policy` ([#33570](https://github.com/hashicorp/terraform-provider-aws/issues/33570))
+* resource/aws_mediastore_container_policy: Fail validation if duplicated keys are found in `policy` ([#33570](https://github.com/hashicorp/terraform-provider-aws/issues/33570))
+* resource/aws_s3_bucket_policy: Fix intermittent `couldn't find resource` errors on resource Create ([#33537](https://github.com/hashicorp/terraform-provider-aws/issues/33537))
+* resource/aws_ssoadmin_permission_set_inline_policy: Fail validation if duplicated keys are found in `inline_policy` ([#33570](https://github.com/hashicorp/terraform-provider-aws/issues/33570))
+* resource/aws_transfer_access: Fail validation if duplicated keys are found in `policy` ([#33570](https://github.com/hashicorp/terraform-provider-aws/issues/33570))
+* resource/aws_transfer_user: Fail validation if duplicated keys are found in `policy` ([#33570](https://github.com/hashicorp/terraform-provider-aws/issues/33570))
+
+## 5.18.1 (September 26, 2023)
+
+NOTES:
+
+* documentation: Duplicate CDKTF guides with differing file extensions have been removed to resolve failures in the provider release workflow. ([#33630](https://github.com/hashicorp/terraform-provider-aws/issues/33630))
+
+## 5.18.0 (September 21, 2023)
+
+FEATURES:
+
+* **New Data Source:** `aws_fsx_ontap_file_system` ([#32503](https://github.com/hashicorp/terraform-provider-aws/issues/32503))
+* **New Data Source:** `aws_fsx_ontap_storage_virtual_machine` ([#32621](https://github.com/hashicorp/terraform-provider-aws/issues/32621))
+* **New Data Source:** `aws_fsx_ontap_storage_virtual_machines` ([#32624](https://github.com/hashicorp/terraform-provider-aws/issues/32624))
+* **New Data Source:** `aws_organizations_organizational_unit` ([#33408](https://github.com/hashicorp/terraform-provider-aws/issues/33408))
+* **New Resource:** `aws_opensearch_package` ([#33227](https://github.com/hashicorp/terraform-provider-aws/issues/33227))
+* **New Resource:** `aws_opensearch_package_association` ([#33227](https://github.com/hashicorp/terraform-provider-aws/issues/33227))
+
+ENHANCEMENTS:
+
+* resource/aws_fsx_ontap_storage_virtual_machine: Remove [ForceNew](https://developer.hashicorp.com/terraform/plugin/sdkv2/schemas/schema-behaviors#forcenew) from `active_directory_configuration.self_managed_active_directory_configuration.domain_name`, `active_directory_configuration.self_managed_active_directory_configuration.file_system_administrators_group` and `active_directory_configuration.self_managed_active_directory_configuration.organizational_unit_distinguished_name` allowing an SVM to join AD after creation ([#33466](https://github.com/hashicorp/terraform-provider-aws/issues/33466))
+
+BUG FIXES:
+
+* data-source/aws_sesv2_email_identity: Mark `dkim_signing_attributes.domain_signing_private_key` as sensitive ([#33477](https://github.com/hashicorp/terraform-provider-aws/issues/33477))
+* resource/aws_db_instance: Fix so that `storage_throughput` can be changed when `iops` and `allocated_storage` are not changed ([#33529](https://github.com/hashicorp/terraform-provider-aws/issues/33529))
+* resource/aws_db_option_group: Avoid erroneous differences being reported when an `option` `port` and/or `version` is not set ([#33511](https://github.com/hashicorp/terraform-provider-aws/issues/33511))
+* resource/aws_fsx_ontap_storage_virtual_machine: Avoid recreating resource when `active_directory_configuration.self_managed_active_directory_configuration.file_system_administrators_group` is configured ([#33466](https://github.com/hashicorp/terraform-provider-aws/issues/33466))
+* resource/aws_fsx_ontap_storage_virtual_machine: Change `file_system_id` to [ForceNew](https://developer.hashicorp.com/terraform/plugin/sdkv2/schemas/schema-behaviors#forcenew) ([#32621](https://github.com/hashicorp/terraform-provider-aws/issues/32621))
+* resource/aws_s3_bucket_accelerate_configuration: Retry resource Delete on `OperationAborted: A conflicting conditional operation is currently in progress against this resource` errors ([#33531](https://github.com/hashicorp/terraform-provider-aws/issues/33531))
+* resource/aws_s3_bucket_policy: Retry resource Delete on `OperationAborted: A conflicting conditional operation is currently in progress against this resource` errors ([#33531](https://github.com/hashicorp/terraform-provider-aws/issues/33531))
+* resource/aws_s3_bucket_versioning: Retry resource Delete on `OperationAborted: A conflicting conditional operation is currently in progress against this resource` errors ([#33531](https://github.com/hashicorp/terraform-provider-aws/issues/33531))
+* resource/aws_sesv2_email_identity: Mark `dkim_signing_attributes.domain_signing_private_key` as sensitive ([#33477](https://github.com/hashicorp/terraform-provider-aws/issues/33477))
+
+## 5.17.0 (September 14, 2023)
+
+NOTES:
+
+* data-source/aws_s3_object: Migration to [AWS SDK for Go v2](https://aws.github.io/aws-sdk-go-v2/) means that the edge case of specifying a single `/` as the value for `key` is no longer supported ([#33358](https://github.com/hashicorp/terraform-provider-aws/issues/33358))
+
+FEATURES:
+
+* **New Resource:** `aws_shield_application_layer_automatic_response` ([#33432](https://github.com/hashicorp/terraform-provider-aws/issues/33432))
+* **New Resource:** `aws_verifiedaccess_instance` ([#33459](https://github.com/hashicorp/terraform-provider-aws/issues/33459))
+
+ENHANCEMENTS:
+
+* data-source/aws_s3_object: Add `checksum_mode` argument and `checksum_crc32`, `checksum_crc32c`, `checksum_sha1` and `checksum_sha256` attributes ([#33358](https://github.com/hashicorp/terraform-provider-aws/issues/33358))
+* data-source/aws_s3control_multi_region_access_point: Add `details.region.bucket_account_id` attribute ([#33416](https://github.com/hashicorp/terraform-provider-aws/issues/33416))
+* resource/aws_s3_object: Add `checksum_algorithm` argument and `checksum_crc32`, `checksum_crc32c`, `checksum_sha1` and `checksum_sha256` attributes ([#33358](https://github.com/hashicorp/terraform-provider-aws/issues/33358))
+* resource/aws_s3_object_copy: Add `checksum_algorithm` argument and `checksum_crc32`, `checksum_crc32c`, `checksum_sha1` and `checksum_sha256` attributes ([#33358](https://github.com/hashicorp/terraform-provider-aws/issues/33358))
+* resource/aws_s3control_multi_region_access_point: Add `details.region.bucket_account_id` argument to support [cross-account Multi-Region Access Points](https://docs.aws.amazon.com/AmazonS3/latest/userguide/multi-region-access-point-buckets.html) ([#33416](https://github.com/hashicorp/terraform-provider-aws/issues/33416))
+* resource/aws_s3control_multi_region_access_point: Add `details.region.region` attribute ([#33416](https://github.com/hashicorp/terraform-provider-aws/issues/33416))
+* resource/aws_schemas_schema: Add `JSONSchemaDraft4` schema type support ([#33442](https://github.com/hashicorp/terraform-provider-aws/issues/33442))
+* resource/aws_transfer_connector: Add `sftp_config` argument and make `as2_config` optional ([#32741](https://github.com/hashicorp/terraform-provider-aws/issues/32741))
+* resource/aws_wafv2_web_acl: Retry resource Update on `WAFOptimisticLockException` errors ([#33432](https://github.com/hashicorp/terraform-provider-aws/issues/33432))
+
+BUG FIXES:
+
+* resource/aws_dms_replication_task: Fix error when `replication_task_settings` is `nil` ([#33456](https://github.com/hashicorp/terraform-provider-aws/issues/33456))
+* resource/aws_elasticache_cluster: Fix regression for `redis` engine types caused by the new `transit_encryption_enabled` argument ([#33451](https://github.com/hashicorp/terraform-provider-aws/issues/33451))
+* resource/aws_neptune_cluster: Fix ignored `kms_key_arn` on restore from DB cluster snapshot ([#33413](https://github.com/hashicorp/terraform-provider-aws/issues/33413))
+* resource/aws_servicecatalog_product: Allow import on `provisioning_artifact_parameters` attribute ([#33448](https://github.com/hashicorp/terraform-provider-aws/issues/33448))
+* resource/aws_subnet: Fix destroy error when there is a lingering ENI for DMS ([#33375](https://github.com/hashicorp/terraform-provider-aws/issues/33375))
+
+## 5.16.2 (September 11, 2023)
+
+FEATURES:
+
+* **New Data Source:** `aws_cognito_identity_pool` ([#33053](https://github.com/hashicorp/terraform-provider-aws/issues/33053))
+* **New Resource:** `aws_verifiedaccess_trust_provider` ([#33195](https://github.com/hashicorp/terraform-provider-aws/issues/33195))
+
+ENHANCEMENTS:
+
+* resource/aws_autoscaling_group: Change the default values of `instance_refresh.preferences.scale_in_protected_instances` and `instance_refresh.preferences.standby_instances` from `Wait` to the [Amazon EC2 Auto Scaling console recommended value](https://docs.aws.amazon.com/autoscaling/ec2/userguide/understand-instance-refresh-default-values.html) of `Ignore` ([#33382](https://github.com/hashicorp/terraform-provider-aws/issues/33382))
+* resource/aws_s3control_object_lambda_access_point: Add `alias` attribute ([#33388](https://github.com/hashicorp/terraform-provider-aws/issues/33388))
+
+BUG FIXES:
+
+* resource/aws_autoscaling_group: Fix `ValidationError` errors when starting Auto Scaling group instance refresh ([#33382](https://github.com/hashicorp/terraform-provider-aws/issues/33382))
+* resource/aws_iot_topic_rule: Fix `InvalidParameter` errors on Update with Kafka destinations ([#33360](https://github.com/hashicorp/terraform-provider-aws/issues/33360))
+* resource/aws_lightsail_certificate: Fix validation of `name` ([#33405](https://github.com/hashicorp/terraform-provider-aws/issues/33405))
+* resource/aws_lightsail_database: Fix validation of `name` ([#33405](https://github.com/hashicorp/terraform-provider-aws/issues/33405))
+* resource/aws_lightsail_disk: Fix validation of `name` ([#33405](https://github.com/hashicorp/terraform-provider-aws/issues/33405))
+* resource/aws_lightsail_instance: Fix validation of `name` ([#33405](https://github.com/hashicorp/terraform-provider-aws/issues/33405))
+* resource/aws_lightsail_lb: Fix validation of `lb_name` ([#33405](https://github.com/hashicorp/terraform-provider-aws/issues/33405))
+* resource/aws_lightsail_lb_attachment: Fix validation of `lb_name` ([#33405](https://github.com/hashicorp/terraform-provider-aws/issues/33405))
+* resource/aws_lightsail_lb_certificate: Fix validation of `lb_name` ([#33405](https://github.com/hashicorp/terraform-provider-aws/issues/33405))
+* resource/aws_lightsail_lb_certificate_attachment: Fix validation of `lb_name` ([#33405](https://github.com/hashicorp/terraform-provider-aws/issues/33405))
+* resource/aws_lightsail_lb_https_redirection_policy: Fix validation of `lb_name` ([#33405](https://github.com/hashicorp/terraform-provider-aws/issues/33405))
+* resource/aws_lightsail_lb_stickiness_policy: Fix validation of `lb_name` ([#33405](https://github.com/hashicorp/terraform-provider-aws/issues/33405))
+
+## 5.16.1 (September  8, 2023)
+
+BUG FIXES:
+
+* data-source/aws_efs_file_system: Fix `Search returned 0 results` errors when there are more than 101 file systems in the configured Region ([#33336](https://github.com/hashicorp/terraform-provider-aws/issues/33336))
+* resource/aws_db_instance_automated_backups_replication: Fix `unexpected state` errors on resource Create ([#33369](https://github.com/hashicorp/terraform-provider-aws/issues/33369))
+* resource/aws_glue_catalog_table: Fix removal of `metadata_location` and `table_type` `parameters` when updating Iceberg tables ([#33374](https://github.com/hashicorp/terraform-provider-aws/issues/33374))
+* resource/aws_service_discovery_instance: Fix validation error "expected to match regular expression" ([#33371](https://github.com/hashicorp/terraform-provider-aws/issues/33371))
+
+## 5.16.0 (September  8, 2023)
+
+NOTES:
+
+* provider: Performance regression introduced in v5.14.0 should be largely mitigated ([#33317](https://github.com/hashicorp/terraform-provider-aws/issues/33317))
+
+FEATURES:
+
+* **New Resource:** `aws_shield_drt_access_log_bucket_association` ([#33328](https://github.com/hashicorp/terraform-provider-aws/issues/33328))
+* **New Resource:** `aws_shield_drt_access_role_arn_association` ([#33328](https://github.com/hashicorp/terraform-provider-aws/issues/33328))
+
+ENHANCEMENTS:
+
+* data-source/aws_api_gateway_api_key: Add `customer_id` attribute ([#33281](https://github.com/hashicorp/terraform-provider-aws/issues/33281))
+* data-source/aws_fsx_windows_file_system: Add `disk_iops_configuration` attribute ([#33303](https://github.com/hashicorp/terraform-provider-aws/issues/33303))
+* data-source/aws_opensearch_domain: Add `software_update_options` attribute ([#32234](https://github.com/hashicorp/terraform-provider-aws/issues/32234))
+* data-source/aws_s3_objects: Add `request_payer` argument and `request_charged` attribute ([#33304](https://github.com/hashicorp/terraform-provider-aws/issues/33304))
+* data-source/aws_s3_objects: Add plan-time validation of `encoding_type` ([#33304](https://github.com/hashicorp/terraform-provider-aws/issues/33304))
+* resource/aws_api_gateway_account: Add `api_key_version` and `features` attributes ([#33279](https://github.com/hashicorp/terraform-provider-aws/issues/33279))
+* resource/aws_api_gateway_api_key: Add `customer_id` argument ([#33281](https://github.com/hashicorp/terraform-provider-aws/issues/33281))
+* resource/aws_api_gateway_api_key: Allow updating `name` ([#33281](https://github.com/hashicorp/terraform-provider-aws/issues/33281))
+* resource/aws_autoscaling_group: Add `scale_in_protected_instances` and `standby_instances` attributes to `instance_refresh.preferences` configuration block ([#33310](https://github.com/hashicorp/terraform-provider-aws/issues/33310))
+* resource/aws_dms_endpoint: Add `redshift-serverless` as valid value for `engine_name` ([#33316](https://github.com/hashicorp/terraform-provider-aws/issues/33316))
+* resource/aws_elasticache_cluster: Add `transit_encryption_enabled` argument, enabling in-transit encryption for Memcached clusters inside a VPC ([#26987](https://github.com/hashicorp/terraform-provider-aws/issues/26987))
+* resource/aws_fsx_windows_file_system: Add `disk_iops_configuration` configuration block ([#33303](https://github.com/hashicorp/terraform-provider-aws/issues/33303))
+* resource/aws_glue_catalog_table: Add `open_table_format_input` configuration block to support open table formats such as [Apache Iceberg](https://iceberg.apache.org/) ([#33274](https://github.com/hashicorp/terraform-provider-aws/issues/33274))
+* resource/aws_medialive_channel: Implement expand/flatten functions for `automatic_input_failover_settings` in `input_attachments` ([#33129](https://github.com/hashicorp/terraform-provider-aws/issues/33129))
+* resource/aws_opensearch_domain: Add `software_update_options` attribute ([#32234](https://github.com/hashicorp/terraform-provider-aws/issues/32234))
+* resource/aws_ssm_association: Add `sync_compliance` attribute ([#23515](https://github.com/hashicorp/terraform-provider-aws/issues/23515))
+
+BUG FIXES:
+
+* data-source/aws_identitystore_group: Restore `filter` argument to prevent `UnknownOperationException` errors in certain Regions ([#33311](https://github.com/hashicorp/terraform-provider-aws/issues/33311))
+* data-source/aws_identitystore_user: Restore `filter` argument to prevent `UnknownOperationException` errors in certain Regions ([#33311](https://github.com/hashicorp/terraform-provider-aws/issues/33311))
+* data-source/aws_s3_objects: Respect configured `max_keys` value if it's greater than `1000` ([#33304](https://github.com/hashicorp/terraform-provider-aws/issues/33304))
+* resource/aws_api_gateway_account: Allow setting `cloudwatch_role_arn` to an empty value and set it correctly on Read, allowing its value to be determined on import ([#33279](https://github.com/hashicorp/terraform-provider-aws/issues/33279))
+* resource/aws_fsx_ontap_file_system: Increase maximum value of `disk_iops_configuration.iops` to `160000` ([#33263](https://github.com/hashicorp/terraform-provider-aws/issues/33263))
+* resource/aws_servicecatalog_principal_portfolio_association: Fix `ResourceNotFoundException` errors on resource Delete when configured `principal_type` is `IAM_PATTERN` ([#32243](https://github.com/hashicorp/terraform-provider-aws/issues/32243))
+
+## 5.15.0 (August 31, 2023)
+
+ENHANCEMENTS:
+
+* data-source/aws_efs_file_system: Add `name` attribute ([#33243](https://github.com/hashicorp/terraform-provider-aws/issues/33243))
+* data-source/aws_lakeformation_data_lake_settings: Add `read_only_admins` attribute ([#33189](https://github.com/hashicorp/terraform-provider-aws/issues/33189))
+* data-source/aws_opensearch_domain: Add `cluster_config.multi_az_with_standby_enabled` attribute ([#33031](https://github.com/hashicorp/terraform-provider-aws/issues/33031))
+* resource/aws_cloudformation_stack_set: Support resource import with `call_as = "DELEGATED_ADMIN"` via _StackSetName_,_CallAs_ syntax for `import` block or `terraform import` command ([#19092](https://github.com/hashicorp/terraform-provider-aws/issues/19092))
+* resource/aws_cloudformation_stack_set_instance: Support resource import with `call_as = "DELEGATED_ADMIN"` via _StackSetName_,_AccountID_,_Region_,_CallAs_ syntax for `import` block or `terraform import` command ([#19092](https://github.com/hashicorp/terraform-provider-aws/issues/19092))
+* resource/aws_datasync_location_fsx_openzfs_file_system: Fix `setting protocol: Invalid address to set` errors ([#33225](https://github.com/hashicorp/terraform-provider-aws/issues/33225))
+* resource/aws_efs_file_system: Add `name` attribute ([#33243](https://github.com/hashicorp/terraform-provider-aws/issues/33243))
+* resource/aws_fsx_openzfs_file_system: Add `endpoint_ip_address_range`, `preferred_subnet_id` and `route_table_ids` arguments to support the [Multi-AZ deployment type](https://docs.aws.amazon.com/fsx/latest/OpenZFSGuide/availability-durability.html#choosing-single-or-multi) ([#33245](https://github.com/hashicorp/terraform-provider-aws/issues/33245))
+* resource/aws_lakeformation_data_lake_settings: Add `read_only_admins` argument ([#33189](https://github.com/hashicorp/terraform-provider-aws/issues/33189))
+* resource/aws_opensearch_domain: Add `cluster_config.multi_az_with_standby_enabled` argument ([#33031](https://github.com/hashicorp/terraform-provider-aws/issues/33031))
+* resource/aws_wafv2_rule_group: Add `name_prefix` argument ([#33206](https://github.com/hashicorp/terraform-provider-aws/issues/33206))
+* resource/aws_wafv2_web_acl: Add `statement.managed_rule_group_statement.managed_rule_group_configs.aws_managed_rules_atp_rule_set.enable_regex_in_path` argument ([#33217](https://github.com/hashicorp/terraform-provider-aws/issues/33217))
+
+BUG FIXES:
+
+* provider: Correctly use old and new tag values when updating `tags` that are `computed` ([#33226](https://github.com/hashicorp/terraform-provider-aws/issues/33226))
+* resource/aws_appflow_connector_profile: Fix validation on `oauth2` in `custom_connector_profile` ([#33192](https://github.com/hashicorp/terraform-provider-aws/issues/33192))
+* resource/aws_cloudformation_stack_set: Fix `Can only set RetainStacksOnAccountRemoval if AutoDeployment is enabled` errors ([#19092](https://github.com/hashicorp/terraform-provider-aws/issues/19092))
+* resource/aws_cloudwatch_event_bus_policy: Fix error during plan when the associated aws_cloudwatch_event_bus resource is manually deleted ([#33203](https://github.com/hashicorp/terraform-provider-aws/issues/33203))
+* resource/aws_codeartifact_domain: Change the type of asset_size_bytes to `TypeString` instead of `TypeInt` to prevent `value out of range` panic ([#33220](https://github.com/hashicorp/terraform-provider-aws/issues/33220))
+* resource/aws_efs_file_system_policy: Retry IAM eventual consistency errors ([#21734](https://github.com/hashicorp/terraform-provider-aws/issues/21734))
+* resource/aws_fsx_openzfs_file_system: Wait for administrative action completion when updating root volume ([#33245](https://github.com/hashicorp/terraform-provider-aws/issues/33245))
+* resource/aws_iot_thing_type: Fix error during plan when resource is manually deleted ([#33203](https://github.com/hashicorp/terraform-provider-aws/issues/33203))
+* resource/aws_kms_key: Fix `tag propagation: timeout while waiting for state to become 'TRUE'` errors when any tag value is empty (`""`) ([#33226](https://github.com/hashicorp/terraform-provider-aws/issues/33226))
+* resource/aws_wafv2_web_acl: Prevent deletion of the AWS-managed `ShieldMitigationRuleGroup` rule on resource Update ([#33216](https://github.com/hashicorp/terraform-provider-aws/issues/33216))
+
+## 5.14.0 (August 24, 2023)
+
+NOTES:
+
+* data-source/aws_iam_policy_document: In some cases, `statement.*.condition` blocks with the same `test` and `variable` arguments were incorrectly handled by the provider. Since this results in unexpected IAM Policies being submitted to AWS, we have updated the logic to merge `values` lists in this case. This may cause existing IAM Policy documents to report a difference. However, those policies are likely not what was originally intended. ([#33093](https://github.com/hashicorp/terraform-provider-aws/issues/33093))
+
+FEATURES:
+
+* **New Resource:** `aws_datasync_location_azure_blob` ([#32632](https://github.com/hashicorp/terraform-provider-aws/issues/32632))
+* **New Resource:** `aws_datasync_location_fsx_ontap_file_system` ([#32632](https://github.com/hashicorp/terraform-provider-aws/issues/32632))
+
+ENHANCEMENTS:
+
+* data-source/aws_dms_endpoint: Fix crash when specified endpoint not found ([#33158](https://github.com/hashicorp/terraform-provider-aws/issues/33158))
+* data-source/aws_dms_replication_instance: Add `network_type` attribute ([#33158](https://github.com/hashicorp/terraform-provider-aws/issues/33158))
+* data-source/aws_ec2_network_insights_path: Add `destination_arn` and `source_arn` attributes ([#33168](https://github.com/hashicorp/terraform-provider-aws/issues/33168))
+* resource/aws_dms_replication_instance: Add `network_type` argument ([#33158](https://github.com/hashicorp/terraform-provider-aws/issues/33158))
+* resource/aws_ec2_network_insights_path: Add `destination_arn` and `source_arn` attributes ([#33168](https://github.com/hashicorp/terraform-provider-aws/issues/33168))
+* resource/aws_finspace_kx_environment: Add `transit_gateway_configuration.*.attachment_network_acl_configuration` argument. ([#33123](https://github.com/hashicorp/terraform-provider-aws/issues/33123))
+* resource/aws_medialive_channel: Updates schemas for `selector_settings` for `audio_selector` and `selector_settings` for `caption_selector` ([#32714](https://github.com/hashicorp/terraform-provider-aws/issues/32714))
+* resource/aws_ssoadmin_account_assignment: Add configurable timeouts ([#33121](https://github.com/hashicorp/terraform-provider-aws/issues/33121))
+* resource/aws_ssoadmin_customer_managed_policy_attachment: Add configurable timeouts ([#33121](https://github.com/hashicorp/terraform-provider-aws/issues/33121))
+* resource/aws_ssoadmin_managed_policy_attachment: Add configurable timeouts ([#33121](https://github.com/hashicorp/terraform-provider-aws/issues/33121))
+* resource/aws_ssoadmin_permission_set: Add configurable timeouts ([#33121](https://github.com/hashicorp/terraform-provider-aws/issues/33121))
+* resource/aws_ssoadmin_permission_set_inline_policy: Add configurable timeouts ([#33121](https://github.com/hashicorp/terraform-provider-aws/issues/33121))
+* resource/aws_ssoadmin_permissions_boundary_attachment: Add configurable timeouts ([#33121](https://github.com/hashicorp/terraform-provider-aws/issues/33121))
+
+BUG FIXES:
+
+* data-source/aws_iam_policy_document: Fix inconsistent handling of `condition` blocks with duplicated `test` and `variable` arguments ([#33093](https://github.com/hashicorp/terraform-provider-aws/issues/33093))
+* resource/aws_ec2_host: Fixed a bug that caused resource recreation when specifying an `outpost_arn` without an `asset_id` ([#33142](https://github.com/hashicorp/terraform-provider-aws/issues/33142))
+* resource/aws_ec2_network_insights_analysis: Fix `setting forward_path_components: Invalid address to set` errors ([#33168](https://github.com/hashicorp/terraform-provider-aws/issues/33168))
+* resource/aws_ec2_network_insights_path: Avoid recreating resource when passing an ARN as `source` or `destination` ([#33168](https://github.com/hashicorp/terraform-provider-aws/issues/33168))
+* resource/aws_ec2_network_insights_path: Retry `AnalysisExistsForNetworkInsightsPath` errors on resource Delete ([#33168](https://github.com/hashicorp/terraform-provider-aws/issues/33168))
+* resource/aws_kms_key: Fix `tag propagation: timeout while waiting for state to become 'TRUE'` errors when [`ignore_tags`](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#ignore_tags) has been configured ([#33167](https://github.com/hashicorp/terraform-provider-aws/issues/33167))
+* resource/aws_licensemanager_license_configuration: Surface `InvalidParameterValueException` errors during resource Delete ([#32845](https://github.com/hashicorp/terraform-provider-aws/issues/32845))
+* resource/aws_msk_cluster_policy: Fix `Current cluster policy version needed for Update` errors ([#33118](https://github.com/hashicorp/terraform-provider-aws/issues/33118))
+* resource/aws_quicksight_analysis: Change `definition.*.parameter_declarations` to a set type, preventing persistent differences ([#33120](https://github.com/hashicorp/terraform-provider-aws/issues/33120))
+* resource/aws_quicksight_analysis: Fixed a bug that caused errors related to the `word_orientation` argument when using word cloud visuals. ([#33122](https://github.com/hashicorp/terraform-provider-aws/issues/33122))
+* resource/aws_quicksight_analysis: Skip setting `definition.*.parameter_declarations.*.*_parameter_declaration.static_values` when empty, preventing persistent differences. ([#33161](https://github.com/hashicorp/terraform-provider-aws/issues/33161))
+* resource/aws_quicksight_dashboard: Change `definition.*.parameter_declarations` to a set type, preventing persistent differences ([#33120](https://github.com/hashicorp/terraform-provider-aws/issues/33120))
+* resource/aws_quicksight_dashboard: Fixed a bug that caused errors related to the `word_orientation` argument when using word cloud visuals. ([#33122](https://github.com/hashicorp/terraform-provider-aws/issues/33122))
+* resource/aws_quicksight_dashboard: Skip setting `definition.*.parameter_declarations.*.*_parameter_declaration.static_values` when empty, preventing persistent differences. ([#33161](https://github.com/hashicorp/terraform-provider-aws/issues/33161))
+* resource/aws_quicksight_template: Change `definition.*.parameter_declarations` to a set type, preventing persistent differences ([#33120](https://github.com/hashicorp/terraform-provider-aws/issues/33120))
+* resource/aws_quicksight_template: Fixed a bug that caused errors related to the `word_orientation` argument when using word cloud visuals. ([#33122](https://github.com/hashicorp/terraform-provider-aws/issues/33122))
+* resource/aws_quicksight_template: Skip setting `definition.*.parameter_declarations.*.*_parameter_declaration.static_values` when empty, preventing persistent differences. ([#33161](https://github.com/hashicorp/terraform-provider-aws/issues/33161))
+* resource/aws_route53_zone: Skip disabling DNS SEC in unsupported partitions ([#33103](https://github.com/hashicorp/terraform-provider-aws/issues/33103))
+* resource/aws_s3_object: Mark `acl` as Computed. This suppresses the diffs shown when migrating resources with no configured `acl` attribute value from v4.67.0 (or earlier) ([#33138](https://github.com/hashicorp/terraform-provider-aws/issues/33138))
+* resource/aws_s3_object_copy: Mark `acl` as Computed. This suppresses the diffs shown when migrating resources with no configured `acl` attribute value from v4.67.0 (or earlier) ([#33138](https://github.com/hashicorp/terraform-provider-aws/issues/33138))
+* resource/aws_securityhub_account: Remove default value (`SECURITY_CONTROL`) for `control_finding_generator` argument and mark as Computed ([#33095](https://github.com/hashicorp/terraform-provider-aws/issues/33095))
+
+## 5.13.1 (August 18, 2023)
+
+BUG FIXES:
+
+* resource/aws_lambda_layer_version: Change `source_code_hash` back to [ForceNew](https://developer.hashicorp.com/terraform/plugin/sdkv2/schemas/schema-behaviors#forcenew). This fixes `doesn't support update` errors ([#33097](https://github.com/hashicorp/terraform-provider-aws/issues/33097))
+* resource/aws_organizations_organization: Fix `current Organization ID (o-xxxxxxxxxx) does not match` errors on resource Read ([#33091](https://github.com/hashicorp/terraform-provider-aws/issues/33091))
+
+## 5.13.0 (August 18, 2023)
+
+FEATURES:
+
+* **New Resource:** `aws_msk_cluster_policy` ([#32848](https://github.com/hashicorp/terraform-provider-aws/issues/32848))
+* **New Resource:** `aws_opensearch_vpc_endpoint` ([#32435](https://github.com/hashicorp/terraform-provider-aws/issues/32435))
+* **New Resource:** `aws_ram_sharing_with_organization` ([#25433](https://github.com/hashicorp/terraform-provider-aws/issues/25433))
+
+ENHANCEMENTS:
+
+* data-source/aws_imagebuilder_image_pipeline: Add `image_scanning_configuration` attribute ([#33005](https://github.com/hashicorp/terraform-provider-aws/issues/33005))
+* data-source/aws_ram_resource_share: Add `resource_arns` attribute ([#22591](https://github.com/hashicorp/terraform-provider-aws/issues/22591))
+* provider: Adds the `s3_us_east_1_regional_endpoint` attribute to support using the regional S3 API endpoint in `us-east-1`. ([#33024](https://github.com/hashicorp/terraform-provider-aws/issues/33024))
+* resource/aws_appstream_fleet: Retry ConcurrentModificationException errors during creation ([#32958](https://github.com/hashicorp/terraform-provider-aws/issues/32958))
+* resource/aws_dms_endpoint: Add `babelfish` as an `engine_name` option ([#32975](https://github.com/hashicorp/terraform-provider-aws/issues/32975))
+* resource/aws_imagebuilder_image_pipeline: Add `image_scanning_configuration` configuration block ([#33005](https://github.com/hashicorp/terraform-provider-aws/issues/33005))
+* resource/aws_lb: Changes to `security_groups` for Network Load Balancers force a new resource if either the old or new set of security group IDs is empty ([#32987](https://github.com/hashicorp/terraform-provider-aws/issues/32987))
+* resource/aws_rds_global_cluster: Add plan-time validation of `global_cluster_identifier` ([#30996](https://github.com/hashicorp/terraform-provider-aws/issues/30996))
+
+BUG FIXES:
+
+* data-source/aws_ecr_repository: Correctly set `most_recent_image_tags` when only a single image is found ([#31757](https://github.com/hashicorp/terraform-provider-aws/issues/31757))
+* resource/aws_budgets_budget_action: No longer times out when creating a non-triggered action ([#33015](https://github.com/hashicorp/terraform-provider-aws/issues/33015))
+* resource/aws_cloudformation_stack: Marks `outputs` as Computed when there are potential changes. ([#33059](https://github.com/hashicorp/terraform-provider-aws/issues/33059))
+* resource/aws_cloudwatch_event_rule: Fix ARN-based partner event bus rule ID parsing error ([#30293](https://github.com/hashicorp/terraform-provider-aws/issues/30293))
+* resource/aws_ecr_registry_scanning_configuration: Correctly delete rules on resource Update ([#31449](https://github.com/hashicorp/terraform-provider-aws/issues/31449))
+* resource/aws_lambda_layer_version: Fix bug causing new version to be created on every apply when `source_code_hash` is used but not changed ([#32535](https://github.com/hashicorp/terraform-provider-aws/issues/32535))
+* resource/aws_lb_listener_certificate: Remove from state when listener not found ([#32412](https://github.com/hashicorp/terraform-provider-aws/issues/32412))
+* resource/aws_organizations_organization: Ensure that the Organization ID specified in `terraform import` is the current Organization ([#31796](https://github.com/hashicorp/terraform-provider-aws/issues/31796))
+* resource/aws_quicksight_analysis: Adjust max length of `definition.*.calculated_fields.*.expression` to 32000 characters ([#33012](https://github.com/hashicorp/terraform-provider-aws/issues/33012))
+* resource/aws_quicksight_analysis: Convert `definition.*.calculated_fields` to a set type, preventing persistent differences ([#33040](https://github.com/hashicorp/terraform-provider-aws/issues/33040))
+* resource/aws_quicksight_analysis: Convert `permissions` argument to TypeSet, preventing persistent differences ([#33023](https://github.com/hashicorp/terraform-provider-aws/issues/33023))
+* resource/aws_quicksight_analysis: Enable `font_configuration` to be set for table header styles ([#33018](https://github.com/hashicorp/terraform-provider-aws/issues/33018))
+* resource/aws_quicksight_analysis: Enable `font_configuration` to be set for table header styles ([#33018](https://github.com/hashicorp/terraform-provider-aws/issues/33018))
+* resource/aws_quicksight_analysis: Enable `font_configuration` to be set for table header styles ([#33018](https://github.com/hashicorp/terraform-provider-aws/issues/33018))
+* resource/aws_quicksight_analysis: Raise limit for maximum allowed `visuals` blocks per sheet to 50 ([#32856](https://github.com/hashicorp/terraform-provider-aws/issues/32856))
+* resource/aws_quicksight_dashboard: Adjust max length of `definition.*.calculated_fields.*.expression` to 32000 characters ([#33012](https://github.com/hashicorp/terraform-provider-aws/issues/33012))
+* resource/aws_quicksight_dashboard: Convert `definition.*.calculated_fields` to a set type, preventing persistent differences ([#33040](https://github.com/hashicorp/terraform-provider-aws/issues/33040))
+* resource/aws_quicksight_dashboard: Convert `permissions` argument to TypeSet, preventing persistent differences ([#33023](https://github.com/hashicorp/terraform-provider-aws/issues/33023))
+* resource/aws_quicksight_data_set: Change permission attribute type from TypeList to TypeSet ([#32984](https://github.com/hashicorp/terraform-provider-aws/issues/32984))
+* resource/aws_quicksight_template: Adjust max items of `definition.*.calculated_fields` to 500 ([#33012](https://github.com/hashicorp/terraform-provider-aws/issues/33012))
+* resource/aws_quicksight_template: Adjust max length of `definition.*.calculated_fields.*.expression` to 32000 characters ([#33012](https://github.com/hashicorp/terraform-provider-aws/issues/33012))
+* resource/aws_quicksight_template: Convert `definition.*.calculated_fields` to a set type, preventing persistent differences ([#33040](https://github.com/hashicorp/terraform-provider-aws/issues/33040))
+* resource/aws_quicksight_template: Convert `permissions` argument to TypeSet, preventing persistent differences ([#33023](https://github.com/hashicorp/terraform-provider-aws/issues/33023))
+* resource/aws_s3_bucket_logging: Fix perpetual drift when `expected_bucket_owner` is configured ([#32989](https://github.com/hashicorp/terraform-provider-aws/issues/32989))
+* resource/aws_sagemaker_domain: Fix validation on `s3_kms_key_id` in `sharing_settings` and `kms_key_id` ([#32661](https://github.com/hashicorp/terraform-provider-aws/issues/32661))
+* resource/aws_subnet: Fix allowing IPv6 to be enabled in an update after initial creation with IPv4 only ([#32896](https://github.com/hashicorp/terraform-provider-aws/issues/32896))
+* resource/aws_wafv2_web_acl: Adds `rule_group_reference_statement.rule_action_override.action_to_use.challenge` argument ([#31127](https://github.com/hashicorp/terraform-provider-aws/issues/31127))
+
+## 5.12.0 (August 10, 2023)
+
+NOTES:
+
+* data-source/aws_codecatalyst_dev_environment: Because we cannot easily test this functionality, it is best effort and we ask for community help in testing ([#32886](https://github.com/hashicorp/terraform-provider-aws/issues/32886))
+* resource/aws_codecatalyst_dev_environment: Because we cannot easily test this functionality, it is best effort and we ask for community help in testing ([#32366](https://github.com/hashicorp/terraform-provider-aws/issues/32366))
+* resource/aws_codecatalyst_project: Because we cannot easily test this functionality, it is best effort and we ask for community help in testing ([#32883](https://github.com/hashicorp/terraform-provider-aws/issues/32883))
+* resource/aws_codecatalyst_source_repository: Because we cannot easily test this functionality, it is best effort and we ask for community help in testing ([#32899](https://github.com/hashicorp/terraform-provider-aws/issues/32899))
+
+FEATURES:
+
+* **New Data Source:** `aws_codecatalyst_dev_environment` ([#32886](https://github.com/hashicorp/terraform-provider-aws/issues/32886))
+* **New Data Source:** `aws_ec2_transit_gateway_route_table_routes` ([#30771](https://github.com/hashicorp/terraform-provider-aws/issues/30771))
+* **New Data Source:** `aws_msk_vpc_connection` ([#31062](https://github.com/hashicorp/terraform-provider-aws/issues/31062))
+* **New Resource:** `aws_cloudfront_continuous_deployment_policy` ([#32936](https://github.com/hashicorp/terraform-provider-aws/issues/32936))
+* **New Resource:** `aws_codecatalyst_dev_environment` ([#32366](https://github.com/hashicorp/terraform-provider-aws/issues/32366))
+* **New Resource:** `aws_codecatalyst_project` ([#32883](https://github.com/hashicorp/terraform-provider-aws/issues/32883))
+* **New Resource:** `aws_codecatalyst_source_repository` ([#32899](https://github.com/hashicorp/terraform-provider-aws/issues/32899))
+* **New Resource:** `aws_msk_vpc_connection` ([#31062](https://github.com/hashicorp/terraform-provider-aws/issues/31062))
+
+ENHANCEMENTS:
+
+* data-source/aws_instance: Add `metadata_options.http_protocol_ipv6` attribute ([#32759](https://github.com/hashicorp/terraform-provider-aws/issues/32759))
+* data-source/aws_rds_cluster: Add `db_system_id` attribute ([#32846](https://github.com/hashicorp/terraform-provider-aws/issues/32846))
+* provider: Support `il-central-1` as a valid AWS Region ([#32878](https://github.com/hashicorp/terraform-provider-aws/issues/32878))
+* resource/aws_autoscaling_group: Add `ignore_failed_scaling_activities` argument ([#32914](https://github.com/hashicorp/terraform-provider-aws/issues/32914))
+* resource/aws_cloudfront_distribution: Add `continuous_deployment_policy_id` and `staging` arguments to support continuous deployments ([#32936](https://github.com/hashicorp/terraform-provider-aws/issues/32936))
+* resource/aws_cloudwatch_composite_alarm: Add `actions_suppressor` configuration block ([#32751](https://github.com/hashicorp/terraform-provider-aws/issues/32751))
+* resource/aws_cloudwatch_events_target: Add `sagemaker_pipeline_target` argument ([#32882](https://github.com/hashicorp/terraform-provider-aws/issues/32882))
+* resource/aws_fms_admin_account: Add configurable timeouts ([#32860](https://github.com/hashicorp/terraform-provider-aws/issues/32860))
+* resource/aws_glue_crawler: Add `hudi_target` argument ([#32898](https://github.com/hashicorp/terraform-provider-aws/issues/32898))
+* resource/aws_instance: Add `http_protocol_ipv6` attribute to `metadata_options` configuration block ([#32759](https://github.com/hashicorp/terraform-provider-aws/issues/32759))
+* resource/aws_lambda_event_source_mapping: Increased the maximum number of filters to 10 ([#32890](https://github.com/hashicorp/terraform-provider-aws/issues/32890))
+* resource/aws_msk_broker: Add `bootstrap_brokers_vpc_connectivity_sasl_iam`, `bootstrap_brokers_vpc_connectivity_sasl_scram` and `bootstrap_brokers_vpc_connectivity_tls` attributes ([#31062](https://github.com/hashicorp/terraform-provider-aws/issues/31062))
+* resource/aws_msk_broker: Add `vpc_connectivity` attribute to the `broker_node_group_info.connectivity_info` configuration block ([#31062](https://github.com/hashicorp/terraform-provider-aws/issues/31062))
+* resource/aws_rds_cluster: Add `db_system_id` argument to support RDS Custom engine types ([#32846](https://github.com/hashicorp/terraform-provider-aws/issues/32846))
+* resource/aws_rds_cluster_instance: Add `custom_iam_instance_profile` argument to allow RDS Custom users to specify an IAM Instance Profile for the RDS Cluster Instance ([#32846](https://github.com/hashicorp/terraform-provider-aws/issues/32846))
+* resource/aws_rds_cluster_instance: Update `engine` plan-time validation to allow for RDS Custom engine types ([#32846](https://github.com/hashicorp/terraform-provider-aws/issues/32846))
+
+BUG FIXES:
+
+* data-source/aws_vpclattice_service: Avoid listing tags when the service has been shared to the current account via AWS Resource Access Manager (RAM) ([#32939](https://github.com/hashicorp/terraform-provider-aws/issues/32939))
+* data-source/aws_vpclattice_service_network: Avoid listing tags when the service network has been shared to the current account via AWS Resource Access Manager (RAM) ([#32939](https://github.com/hashicorp/terraform-provider-aws/issues/32939))
+* resource/aws_appstream_fleet: Increased upper limit of `max_user_duration_in_seconds` to 432000 ([#32933](https://github.com/hashicorp/terraform-provider-aws/issues/32933))
+* resource/aws_cloudfront_distribution: Don't call `UpdateDistribution` API if only tags are updated ([#32865](https://github.com/hashicorp/terraform-provider-aws/issues/32865))
+* resource/aws_db_instance: Fix crash creating resource with empty `restore_to_point_in_time` configuration block ([#32928](https://github.com/hashicorp/terraform-provider-aws/issues/32928))
+* resource/aws_emr_cluster: Fix to allow empty `args` for `bootstrap_action` ([#32956](https://github.com/hashicorp/terraform-provider-aws/issues/32956))
+* resource/aws_emr_instance_fleet: Fix fleet deletion failing for terminated clusters ([#32866](https://github.com/hashicorp/terraform-provider-aws/issues/32866))
+* resource/aws_fms_policy: Prevent erroneous diffs on `security_service_policy_data.managed_service_data` ([#32860](https://github.com/hashicorp/terraform-provider-aws/issues/32860))
+* resource/aws_instance: Fix `InvalidParameterCombination: Network interfaces and an instance-level security groups may not be specified on the same request` errors creating Instances with `subnet_id` configured and `launch_template` referencing an `aws_launch_template` with configured `vpc_security_group_ids` ([#32854](https://github.com/hashicorp/terraform-provider-aws/issues/32854))
+* resource/aws_lb: Fix to avoid creating a load balancer with same name as an existing load balancer ([#32941](https://github.com/hashicorp/terraform-provider-aws/issues/32941))
+
+## 5.11.0 (August  3, 2023)
+
+FEATURES:
+
+* **New Resource:** `aws_sagemaker_pipeline` ([#32527](https://github.com/hashicorp/terraform-provider-aws/issues/32527))
+
+ENHANCEMENTS:
+
+* data-source/aws_cloudtrail_service_account: Add service account ID for `il-central-1` AWS Region ([#32840](https://github.com/hashicorp/terraform-provider-aws/issues/32840))
+* data-source/aws_db_cluster_snapshot: Add `tags` argument ([#31602](https://github.com/hashicorp/terraform-provider-aws/issues/31602))
+* data-source/aws_db_instance: Add ability to filter by `tags` ([#32740](https://github.com/hashicorp/terraform-provider-aws/issues/32740))
+* data-source/aws_db_instances: Add ability to filter by `tags` ([#32740](https://github.com/hashicorp/terraform-provider-aws/issues/32740))
+* data-source/aws_db_snapshot: Add `tags` argument ([#31600](https://github.com/hashicorp/terraform-provider-aws/issues/31600))
+* data-source/aws_elb_hosted_zone_id: Add hosted zone ID for `il-central-1` AWS Region ([#32840](https://github.com/hashicorp/terraform-provider-aws/issues/32840))
+* data-source/aws_lb_hosted_zone_id: Add hosted zone IDs for `il-central-1` AWS Region ([#32840](https://github.com/hashicorp/terraform-provider-aws/issues/32840))
+* data-source/aws_s3_bucket: Add hosted zone ID for `il-central-1` AWS Region ([#32840](https://github.com/hashicorp/terraform-provider-aws/issues/32840))
+* data-source/aws_vpclattice_service: Add ability to find by `name` ([#32177](https://github.com/hashicorp/terraform-provider-aws/issues/32177))
+* resource/aws_finspace_kx_cluster: Adjusted `savedown_storage_configuration.size` minimum value to `10` GB. ([#32800](https://github.com/hashicorp/terraform-provider-aws/issues/32800))
+* resource/aws_lambda_function: Add support for `python3.11` `runtime` value ([#32729](https://github.com/hashicorp/terraform-provider-aws/issues/32729))
+* resource/aws_lambda_layer_version: Add support for `python3.11` `compatible_runtimes` value ([#32729](https://github.com/hashicorp/terraform-provider-aws/issues/32729))
+* resource/aws_networkfirewall_rule_group: Add support for `REJECT` action in stateful rule actions ([#32746](https://github.com/hashicorp/terraform-provider-aws/issues/32746))
+* resource/aws_route_table: Allow an existing local route to be adopted or imported and the target to be updated ([#32794](https://github.com/hashicorp/terraform-provider-aws/issues/32794))
+* resource/aws_sagemaker_endpoint: Add `deployment_config.rolling_update_policy` argument ([#32418](https://github.com/hashicorp/terraform-provider-aws/issues/32418))
+* resource/aws_sagemaker_endpoint: Make `deployment_config.blue_green_update_policy` optional ([#32418](https://github.com/hashicorp/terraform-provider-aws/issues/32418))
+
+BUG FIXES:
+
+* data-source/aws_ecs_task_execution: Fixed bug that incorrectly mapped the value of `container_overrides.memory` to `container_overrides.memory_reservation` ([#32793](https://github.com/hashicorp/terraform-provider-aws/issues/32793))
+* resource/aws_db_instance_automated_backups_replication: Fix `unexpected state 'Pending'` errors on resource Create ([#31600](https://github.com/hashicorp/terraform-provider-aws/issues/31600))
+* resource/aws_ec2_transit_gateway_vpc_attachment: Change `transit_gateway_default_route_table_association` and `transit_gateway_default_route_table_propagation` to Computed ([#32821](https://github.com/hashicorp/terraform-provider-aws/issues/32821))
+* resource/aws_emr_studio_session_mapping: Fix `InvalidRequestException: IdentityId is invalid` errors reading resources created with `identity_name` ([#32416](https://github.com/hashicorp/terraform-provider-aws/issues/32416))
+* resource/aws_quicksight_analysis: Fix an error related to setting the value for `definition.sheets.visuals.insight_visual.insight_configuration.computation` ([#32791](https://github.com/hashicorp/terraform-provider-aws/issues/32791))
+* resource/aws_quicksight_analysis: Fixed a bug that incorrectly determined the valid `select_all_options` values for `custom_filter_configuration`, `custom_filter_list_configuration`, `filter_list_configuration`, `numeric_equality_filter`, and `numeric_range_filter` ([#32822](https://github.com/hashicorp/terraform-provider-aws/issues/32822))
+* resource/aws_quicksight_dashboard: Fix an error related to setting the value for `definition.sheets.visuals.insight_visual.insight_configuration.computation` ([#32791](https://github.com/hashicorp/terraform-provider-aws/issues/32791))
+* resource/aws_quicksight_template: Fix an error related to setting the value for `definition.sheets.visuals.insight_visual.insight_configuration.computation` ([#32791](https://github.com/hashicorp/terraform-provider-aws/issues/32791))
+* resource/aws_quicksight_template: Fixed a bug that incorrectly determined the valid `select_all_options` values for `custom_filter_configuration`, `custom_filter_list_configuration`, `filter_list_configuration`, `numeric_equality_filter`, and `numeric_range_filter` ([#32822](https://github.com/hashicorp/terraform-provider-aws/issues/32822))
+* resource/aws_sfn_state_machine: Fix `Provider produced inconsistent final plan` errors for `publish` ([#32844](https://github.com/hashicorp/terraform-provider-aws/issues/32844))
+
+## 5.10.0 (July 27, 2023)
+
+FEATURES:
+
+* **New Resource:** `aws_iam_security_token_service_preferences` ([#32091](https://github.com/hashicorp/terraform-provider-aws/issues/32091))
+
+ENHANCEMENTS:
+
+* data-source/aws_nat_gateway: Add `secondary_allocation_ids`, `secondary_private_ip_addresses` and `secondary_private_ip_address_count` attributes ([#31778](https://github.com/hashicorp/terraform-provider-aws/issues/31778))
+* data-source/aws_transfer_server: Add `structured_log_destinations` attribute ([#32654](https://github.com/hashicorp/terraform-provider-aws/issues/32654))
+* resource/aws_batch_compute_environment: `compute_resources.allocation_strategy`, `compute_resources.bid_percentage`, `compute_resources.ec2_configuration.image_id_override`, `compute_resources.ec2_configuration.image_type`, `compute_resources.ec2_key_pair`, `compute_resources.image_id`, `compute_resources.instance_role`, `compute_resources.launch_template.launch_template_id`
+, `compute_resources.launch_template.launch_template_name`, `compute_resources.tags` and `compute_resources.type` can now be updated in-place ([#30438](https://github.com/hashicorp/terraform-provider-aws/issues/30438))
+* resource/aws_glue_job: Add `command.runtime` attribute ([#32528](https://github.com/hashicorp/terraform-provider-aws/issues/32528))
+* resource/aws_grafana_workspace: Allow `grafana_version` to be updated in-place ([#32679](https://github.com/hashicorp/terraform-provider-aws/issues/32679))
+* resource/aws_kms_grant: Allow usage of service principal as grantee and revoker ([#32595](https://github.com/hashicorp/terraform-provider-aws/issues/32595))
+* resource/aws_medialive_channel: Adds schemas for `caption_descriptions`, `global_configuration`, `motion_graphics_configuration`, and `nielsen_configuration` support to `encoder settings` ([#32233](https://github.com/hashicorp/terraform-provider-aws/issues/32233))
+* resource/aws_nat_gateway: Add `secondary_allocation_ids`, `secondary_private_ip_addresses` and `secondary_private_ip_address_count` arguments ([#31778](https://github.com/hashicorp/terraform-provider-aws/issues/31778))
+* resource/aws_nat_gateway: Add configurable timeouts ([#31778](https://github.com/hashicorp/terraform-provider-aws/issues/31778))
+* resource/aws_networkfirewall_firewall_policy: Add `firewall_policy.policy_variables` configuration block to support Suricata HOME_NET variable override ([#32400](https://github.com/hashicorp/terraform-provider-aws/issues/32400))
+* resource/aws_sagemaker_domain: Add `default_user_settings.canvas_app_settings.workspace_settings` attribute ([#32526](https://github.com/hashicorp/terraform-provider-aws/issues/32526))
+* resource/aws_sagemaker_user_profile: Add `user_settings.canvas_app_settings.workspace_settings` attribute ([#32526](https://github.com/hashicorp/terraform-provider-aws/issues/32526))
+* resource/aws_transfer_server: Add `structured_log_destinations` argument ([#32654](https://github.com/hashicorp/terraform-provider-aws/issues/32654))
+
+BUG FIXES:
+
+* resource/aws_account_primary_contact: Correct plan-time validation of `phone_number` ([#32715](https://github.com/hashicorp/terraform-provider-aws/issues/32715))
+* resource/aws_apigatewayv2_authorizer: Skip setting authorizer TTL when there are no identity sources ([#32629](https://github.com/hashicorp/terraform-provider-aws/issues/32629))
+* resource/aws_elasticache_parameter_group: Remove from state on resource Read if deleted outside of Terraform ([#32669](https://github.com/hashicorp/terraform-provider-aws/issues/32669))
+* resource/aws_elasticsearch_domain: Omit `ebs_options.throughput` and `ebs_options.iops` for unsupported volume types ([#32659](https://github.com/hashicorp/terraform-provider-aws/issues/32659))
+* resource/aws_finspace_kx_cluster: `database.cache_configurations.db_paths` argument is now optional ([#32579](https://github.com/hashicorp/terraform-provider-aws/issues/32579))
+* resource/aws_finspace_kx_cluster: `database.cache_configurations` argument is now optional ([#32579](https://github.com/hashicorp/terraform-provider-aws/issues/32579))
+* resource/aws_lambda_invocation: Fix plan failing with deferred input values ([#32706](https://github.com/hashicorp/terraform-provider-aws/issues/32706))
+* resource/aws_lightsail_domain_entry: Add support for `AAAA` `type` value ([#32664](https://github.com/hashicorp/terraform-provider-aws/issues/32664))
+* resource/aws_opensearch_domain: Correctly handle `off_peak_window_options.off_peak_window.window_start_time` value of `00:00` ([#32716](https://github.com/hashicorp/terraform-provider-aws/issues/32716))
+* resource/aws_quicksight_analysis: Fix exception thrown when setting the value for `definition.sheets.visuals.pie_chart_visual.chart_configuration.data_labels.measure_label_visibility` ([#32668](https://github.com/hashicorp/terraform-provider-aws/issues/32668))
+* resource/aws_quicksight_analysis: Grid layout `optimized_view_port_width` argument changed to Optional ([#32644](https://github.com/hashicorp/terraform-provider-aws/issues/32644))
+* resource/aws_quicksight_dashboard: Fix exception thrown when setting the value for `definition.sheets.visuals.pie_chart_visual.chart_configuration.data_labels.measure_label_visibility` ([#32668](https://github.com/hashicorp/terraform-provider-aws/issues/32668))
+* resource/aws_quicksight_dashboard: Grid layout `optimized_view_port_width` argument changed to Optional ([#32644](https://github.com/hashicorp/terraform-provider-aws/issues/32644))
+* resource/aws_quicksight_template: Fix exception thrown when setting the value for `definition.sheets.visuals.pie_chart_visual.chart_configuration.data_labels.measure_label_visibility` ([#32668](https://github.com/hashicorp/terraform-provider-aws/issues/32668))
+* resource/aws_quicksight_template: Grid layout `optimized_view_port_width` argument changed to Optional ([#32644](https://github.com/hashicorp/terraform-provider-aws/issues/32644))
+* resource/aws_vpclattice_access_log_subscription: Avoid recreating resource when passing a non-wildcard CloudWatch Logs log group ARN as `destination_arn` ([#32186](https://github.com/hashicorp/terraform-provider-aws/issues/32186))
+* resource/aws_vpclattice_access_log_subscription: Avoid recreating resource when passing an ARN as `resource_identifier` ([#32186](https://github.com/hashicorp/terraform-provider-aws/issues/32186))
+* resource/aws_vpclattice_service_network_service_association: Avoid recreating resource when passing an ARN as `service_identifier` or `service_network_identifier` ([#32658](https://github.com/hashicorp/terraform-provider-aws/issues/32658))
+* resource/aws_vpclattice_service_network_vpc_association: Avoid recreating resource when passing an ARN as `service_network_identifier` ([#32658](https://github.com/hashicorp/terraform-provider-aws/issues/32658))
+
+## 5.9.0 (July 20, 2023)
+
+FEATURES:
+
+* **New Resource:** `aws_workspaces_connection_alias` ([#32482](https://github.com/hashicorp/terraform-provider-aws/issues/32482))
+
+ENHANCEMENTS:
+
+* data-source/aws_appmesh_gateway_route: Add `path` to the `spec.http_route.action.rewrite` and `spec.http2_route.action.rewrite` configuration blocks ([#32449](https://github.com/hashicorp/terraform-provider-aws/issues/32449))
+* data-source/aws_db_instance: Add `max_allocated_storage` attribute ([#32477](https://github.com/hashicorp/terraform-provider-aws/issues/32477))
+* data-source/aws_ec2_host: Add `asset_id` attribute ([#32388](https://github.com/hashicorp/terraform-provider-aws/issues/32388))
+* resource/aws_appmesh_gateway_route: Add `path` to the `spec.http_route.action.rewrite` and `spec.http2_route.action.rewrite` configuration blocks ([#32449](https://github.com/hashicorp/terraform-provider-aws/issues/32449))
+* resource/aws_cloudformation_stack_set_instance: Added the `stack_instance_summaries` attribute to track all account and stack IDs for deployments to organizational units. ([#24523](https://github.com/hashicorp/terraform-provider-aws/issues/24523))
+* resource/aws_cloudformation_stack_set_instance: Changes to `deployment_targets` now force a new resource. ([#24523](https://github.com/hashicorp/terraform-provider-aws/issues/24523))
+* resource/aws_connect_queue: add delete function ([#32538](https://github.com/hashicorp/terraform-provider-aws/issues/32538))
+* resource/aws_connect_routing_profile: add delete function ([#32540](https://github.com/hashicorp/terraform-provider-aws/issues/32540))
+* resource/aws_db_instance: Add `backup_target` attribute ([#32609](https://github.com/hashicorp/terraform-provider-aws/issues/32609))
+* resource/aws_ec2_host: Add `asset_id` argument ([#32388](https://github.com/hashicorp/terraform-provider-aws/issues/32388))
+* resource/aws_ec2_traffic_mirror_filter_rule: Fix crash when updating `rule_number` ([#32594](https://github.com/hashicorp/terraform-provider-aws/issues/32594))
+* resource/aws_lightsail_key_pair: Add `tags` attribute ([#32606](https://github.com/hashicorp/terraform-provider-aws/issues/32606))
+* resource/aws_signer_signing_profile: Add `signing_material` attribute. ([#32414](https://github.com/hashicorp/terraform-provider-aws/issues/32414))
+* resource/aws_signer_signing_profile: Update `platform_id` validation. ([#32414](https://github.com/hashicorp/terraform-provider-aws/issues/32414))
+* resource/aws_wafv2_web_acl: Add `association_config` argument ([#31668](https://github.com/hashicorp/terraform-provider-aws/issues/31668))
+
+BUG FIXES:
+
+* data-source/aws_dms_replication_instance: Fixed bug that caused `replication_instance_private_ips`, `replication_instance_public_ips`, and `vpc_security_group_ids` to always return `null` ([#32551](https://github.com/hashicorp/terraform-provider-aws/issues/32551))
+* data-source/aws_mq_broker: Fix `setting user: Invalid address to set` errors ([#32593](https://github.com/hashicorp/terraform-provider-aws/issues/32593))
+* data-source/aws_vpc_endpoint: Add `dns_options.private_dns_only_for_inbound_resolver_endpoint` ([#32517](https://github.com/hashicorp/terraform-provider-aws/issues/32517))
+* resource/aws_appflow_flow: Fix tasks not updating properly due to empty task being processed ([#26614](https://github.com/hashicorp/terraform-provider-aws/issues/26614))
+* resource/aws_cloudformation_stack_set_instance: Fix error when deploying to organizational units with no accounts. ([#24523](https://github.com/hashicorp/terraform-provider-aws/issues/24523))
+* resource/aws_cognito_user_pool: Suppress diff when `schema.string_attribute_constraints` is omitted for `String` attribute types ([#32445](https://github.com/hashicorp/terraform-provider-aws/issues/32445))
+* resource/aws_config_config_rule: Prevent crash from unhandled read error ([#32520](https://github.com/hashicorp/terraform-provider-aws/issues/32520))
+* resource/aws_datasync_agent: Prevent persistent diffs when `private_link_endpoint` is not explicitly configured. ([#32546](https://github.com/hashicorp/terraform-provider-aws/issues/32546))
+* resource/aws_globalaccelerator_custom_routing_endpoint_group: Respect configured `endpoint_group_region` value on resource Create ([#32393](https://github.com/hashicorp/terraform-provider-aws/issues/32393))
+* resource/aws_pipes_pipe: Fix `Error: setting target_parameters: Invalid address to set` errors when creating pipes with ecs task targets ([#32432](https://github.com/hashicorp/terraform-provider-aws/issues/32432))
+* resource/aws_pipes_pipe: Fix `ValidationException` errors when updating pipe ([#32622](https://github.com/hashicorp/terraform-provider-aws/issues/32622))
+* resource/aws_quicksight_analysis: Correctly expand comparison method ([#32285](https://github.com/hashicorp/terraform-provider-aws/issues/32285))
+* resource/aws_quicksight_folder: Fix misidentification of parent folder at grandchild level or deeper ([#32592](https://github.com/hashicorp/terraform-provider-aws/issues/32592))
+* resource/aws_quicksight_group_membership: Allow non `default` value for namespace ([#32494](https://github.com/hashicorp/terraform-provider-aws/issues/32494))
+* resource/aws_route53_cidr_location: Fix `Value Conversion Error` errors ([#32596](https://github.com/hashicorp/terraform-provider-aws/issues/32596))
+* resource/aws_wafv2_web_acl: Fixed error handling `response_inspection` parameters ([#31111](https://github.com/hashicorp/terraform-provider-aws/issues/31111))
+
+## 5.8.0 (July 13, 2023)
+
+ENHANCEMENTS:
+
+* data-source/aws_ssm_parameter: Add `insecure_value` attribute ([#30817](https://github.com/hashicorp/terraform-provider-aws/issues/30817))
+* resource/aws_fms_policy: Add `policy_option` attribute for `security_service_policy_data` block ([#25362](https://github.com/hashicorp/terraform-provider-aws/issues/25362))
+* resource/aws_iam_virtual_mfa_device: Add `enable_date` and `user_name` attributes ([#32462](https://github.com/hashicorp/terraform-provider-aws/issues/32462))
+
+BUG FIXES:
+
+* resource/aws_config_config_rule: Prevent crash on nil describe output ([#32439](https://github.com/hashicorp/terraform-provider-aws/issues/32439))
+* resource/aws_mq_broker: default `replication_user` to `false` ([#32454](https://github.com/hashicorp/terraform-provider-aws/issues/32454))
+* resource/aws_quicksight_analysis: Fix exception thrown when specifying `definition.sheets.visuals.bar_chart_visual.chart_configuration.category_axis.scrollbar_options.visible_range` ([#32464](https://github.com/hashicorp/terraform-provider-aws/issues/32464))
+* resource/aws_quicksight_analysis: Fix exception thrown when specifying `definition.sheets.visuals.pivot_table_visual.chart_configuration.field_options.selected_field_options.visibility` ([#32464](https://github.com/hashicorp/terraform-provider-aws/issues/32464))
+* resource/aws_quicksight_analysis: Fix exception thrown when specifying `definition.sheets.visuals.pivot_table_visual.chart_configuration.field_wells.pivot_table_aggregated_field_wells.rows` ([#32464](https://github.com/hashicorp/terraform-provider-aws/issues/32464))
+* resource/aws_quicksight_dashboard: Fix exception thrown when specifying `definition.sheets.visuals.bar_chart_visual.chart_configuration.category_axis.scrollbar_options.visible_range` ([#32464](https://github.com/hashicorp/terraform-provider-aws/issues/32464))
+* resource/aws_quicksight_dashboard: Fix exception thrown when specifying `definition.sheets.visuals.pivot_table_visual.chart_configuration.field_options.selected_field_options.visibility` ([#32464](https://github.com/hashicorp/terraform-provider-aws/issues/32464))
+* resource/aws_quicksight_dashboard: Fix exception thrown when specifying `definition.sheets.visuals.pivot_table_visual.chart_configuration.field_wells.pivot_table_aggregated_field_wells.rows` ([#32464](https://github.com/hashicorp/terraform-provider-aws/issues/32464))
+* resource/aws_quicksight_template: Fix exception thrown when specifying `definition.sheets.visuals.bar_chart_visual.chart_configuration.category_axis.scrollbar_options.visible_range` ([#32464](https://github.com/hashicorp/terraform-provider-aws/issues/32464))
+* resource/aws_quicksight_template: Fix exception thrown when specifying `definition.sheets.visuals.pivot_table_visual.chart_configuration.field_options.selected_field_options.visibility` ([#32464](https://github.com/hashicorp/terraform-provider-aws/issues/32464))
+* resource/aws_quicksight_template: Fix exception thrown when specifying `definition.sheets.visuals.pivot_table_visual.chart_configuration.field_wells.pivot_table_aggregated_field_wells.rows` ([#32464](https://github.com/hashicorp/terraform-provider-aws/issues/32464))
+
+## 5.7.0 (July  7, 2023)
+
+FEATURES:
+
+* **New Data Source:** `aws_opensearchserverless_security_config` ([#32321](https://github.com/hashicorp/terraform-provider-aws/issues/32321))
+* **New Data Source:** `aws_opensearchserverless_security_policy` ([#32226](https://github.com/hashicorp/terraform-provider-aws/issues/32226))
+* **New Data Source:** `aws_opensearchserverless_vpc_endpoint` ([#32276](https://github.com/hashicorp/terraform-provider-aws/issues/32276))
+* **New Resource:** `aws_cleanrooms_collaboration` ([#31680](https://github.com/hashicorp/terraform-provider-aws/issues/31680))
+
+ENHANCEMENTS:
+
+* resource/aws_aws_keyspaces_table: Add `client_side_timestamps` configuration block ([#32339](https://github.com/hashicorp/terraform-provider-aws/issues/32339))
+* resource/aws_glue_catalog_database: Add `target_database.region` argument ([#32283](https://github.com/hashicorp/terraform-provider-aws/issues/32283))
+* resource/aws_glue_crawler: Add `iceberg_target` configuration block ([#32332](https://github.com/hashicorp/terraform-provider-aws/issues/32332))
+* resource/aws_internetmonitor_monitor: Add `health_events_config` configuration block ([#32343](https://github.com/hashicorp/terraform-provider-aws/issues/32343))
+* resource/aws_lambda_function: Support `code_signing_config_arn` in the `ap-east-1` AWS Region ([#32327](https://github.com/hashicorp/terraform-provider-aws/issues/32327))
+* resource/aws_qldb_stream: Add configurable Create and Delete timeouts ([#32345](https://github.com/hashicorp/terraform-provider-aws/issues/32345))
+* resource/aws_service_discovery_private_dns_namespace: Allow `description` to be updated in-place ([#32342](https://github.com/hashicorp/terraform-provider-aws/issues/32342))
+* resource/aws_service_discovery_public_dns_namespace: Allow `description` to be updated in-place ([#32342](https://github.com/hashicorp/terraform-provider-aws/issues/32342))
+* resource/aws_timestreamwrite_table: Add `schema` configuration block ([#32354](https://github.com/hashicorp/terraform-provider-aws/issues/32354))
+
+BUG FIXES:
+
+* provider: Correctly handle `forbidden_account_ids` ([#32352](https://github.com/hashicorp/terraform-provider-aws/issues/32352))
+* resource/aws_kms_external_key: Correctly remove all tags ([#32371](https://github.com/hashicorp/terraform-provider-aws/issues/32371))
+* resource/aws_kms_key: Correctly remove all tags ([#32371](https://github.com/hashicorp/terraform-provider-aws/issues/32371))
+* resource/aws_kms_replica_external_key: Correctly remove all tags ([#32371](https://github.com/hashicorp/terraform-provider-aws/issues/32371))
+* resource/aws_kms_replica_key: Correctly remove all tags ([#32371](https://github.com/hashicorp/terraform-provider-aws/issues/32371))
+* resource/aws_secretsmanager_secret_rotation: Fix `InvalidParameterException: You cannot specify both rotation frequency and schedule expression together` errors on resource Update ([#31915](https://github.com/hashicorp/terraform-provider-aws/issues/31915))
+* resource/aws_ssm_parameter: Skip Update if only `overwrite` parameter changes ([#32372](https://github.com/hashicorp/terraform-provider-aws/issues/32372))
+* resource/aws_vpc_endpoint: Fix `InvalidParameter: PrivateDnsOnlyForInboundResolverEndpoint not supported for this service` errors creating S3 _Interface_ VPC endpoints ([#32355](https://github.com/hashicorp/terraform-provider-aws/issues/32355))
+
+## 5.6.2 (June 30, 2023)
+
+BUG FIXES:
+
+* resource/aws_s3_bucket: Fix `InvalidArgument: Invalid attribute name specified` errors when listing S3 Bucket objects, caused by an [AWS SDK for Go regression](https://github.com/aws/aws-sdk-go/issues/4897) ([#32317](https://github.com/hashicorp/terraform-provider-aws/issues/32317))
+
+## 5.6.1 (June 30, 2023)
+
+BUG FIXES:
+
+* provider: Prevent resource recreation if `tags` or `tags_all` are updated ([#32297](https://github.com/hashicorp/terraform-provider-aws/issues/32297))
+
+## 5.6.0 (June 29, 2023)
+
+FEATURES:
+
+* **New Data Source:** `aws_opensearchserverless_access_policy` ([#32231](https://github.com/hashicorp/terraform-provider-aws/issues/32231))
+* **New Data Source:** `aws_opensearchserverless_collection` ([#32247](https://github.com/hashicorp/terraform-provider-aws/issues/32247))
+* **New Data Source:** `aws_sfn_alias` ([#32176](https://github.com/hashicorp/terraform-provider-aws/issues/32176))
+* **New Data Source:** `aws_sfn_state_machine_versions` ([#32176](https://github.com/hashicorp/terraform-provider-aws/issues/32176))
+* **New Resource:** `aws_ec2_instance_connect_endpoint` ([#31858](https://github.com/hashicorp/terraform-provider-aws/issues/31858))
+* **New Resource:** `aws_sfn_alias` ([#32176](https://github.com/hashicorp/terraform-provider-aws/issues/32176))
+* **New Resource:** `aws_transfer_agreement` ([#32203](https://github.com/hashicorp/terraform-provider-aws/issues/32203))
+* **New Resource:** `aws_transfer_certificate` ([#32203](https://github.com/hashicorp/terraform-provider-aws/issues/32203))
+* **New Resource:** `aws_transfer_connector` ([#32203](https://github.com/hashicorp/terraform-provider-aws/issues/32203))
+* **New Resource:** `aws_transfer_profile` ([#32203](https://github.com/hashicorp/terraform-provider-aws/issues/32203))
+
+ENHANCEMENTS:
+
+* resource/aws_batch_compute_environment: Add `placement_group` attribute to the `compute_resources` configuration block ([#32200](https://github.com/hashicorp/terraform-provider-aws/issues/32200))
+* resource/aws_emrserverless_application: Do not recreate the resource if `release_label` changes ([#32278](https://github.com/hashicorp/terraform-provider-aws/issues/32278))
+* resource/aws_fis_experiment_template: Add `log_configuration` configuration block ([#32102](https://github.com/hashicorp/terraform-provider-aws/issues/32102))
+* resource/aws_fis_experiment_template: Add `parameters` attribute to the `target` configuration block ([#32160](https://github.com/hashicorp/terraform-provider-aws/issues/32160))
+* resource/aws_fis_experiment_template: Add support for `Pods` and `Tasks` to `action.*.target` ([#32152](https://github.com/hashicorp/terraform-provider-aws/issues/32152))
+* resource/aws_lambda_event_source_mapping: The `queues` argument has changed from a set to a list with a maximum of one element. ([#31931](https://github.com/hashicorp/terraform-provider-aws/issues/31931))
+* resource/aws_pipes_pipe: Add `activemq_broker_parameters`, `dynamodb_stream_parameters`, `kinesis_stream_parameters`, `managed_streaming_kafka_parameters`, `rabbitmq_broker_parameters`, `self_managed_kafka_parameters` and `sqs_queue_parameters` attributes to the `source_parameters` configuration block. NOTE: Because we cannot easily test all this functionality, it is best effort and we ask for community help in testing ([#31607](https://github.com/hashicorp/terraform-provider-aws/issues/31607))
+* resource/aws_pipes_pipe: Add `batch_job_parameters`, `cloudwatch_logs_parameters`, `ecs_task_parameters`, `eventbridge_event_bus_parameters`, `http_parameters`, `kinesis_stream_parameters`, `lambda_function_parameters`, `redshift_data_parameters`, `sagemaker_pipeline_parameters`, `sqs_queue_parameters` and `step_function_state_machine_parameters` attributes to the `target_parameters` configuration block. NOTE: Because we cannot easily test all this functionality, it is best effort and we ask for community help in testing ([#31607](https://github.com/hashicorp/terraform-provider-aws/issues/31607))
+* resource/aws_pipes_pipe: Add `enrichment_parameters` argument ([#31607](https://github.com/hashicorp/terraform-provider-aws/issues/31607))
+* resource/aws_resourcegroups_group: `resource_query` no longer conflicts with `configuration` ([#30242](https://github.com/hashicorp/terraform-provider-aws/issues/30242))
+* resource/aws_s3_bucket_logging: Retry on empty read of logging config ([#30916](https://github.com/hashicorp/terraform-provider-aws/issues/30916))
+* resource/aws_sfn_state_machine: Add `description`, `publish`, `revision_id`, `state_machine_version_arn` and `version_description` attributes ([#32176](https://github.com/hashicorp/terraform-provider-aws/issues/32176))
+
+BUG FIXES:
+
+* resource/aws_db_instance: Fix resource Create returning instances not in the `available` state when `identifier_prefix` is specified ([#32287](https://github.com/hashicorp/terraform-provider-aws/issues/32287))
+* resource/aws_resourcegroups_resource: Fix crash when resource Create fails ([#30242](https://github.com/hashicorp/terraform-provider-aws/issues/30242))
+* resource/aws_route: Fix `reading Route in Route Table (rtb-1234abcd) with destination (1.2.3.4/5): couldn't find resource` errors when reading new resource ([#32196](https://github.com/hashicorp/terraform-provider-aws/issues/32196))
+* resource/aws_vpc_security_group_egress_rule: `security_group_id` is Required ([#32148](https://github.com/hashicorp/terraform-provider-aws/issues/32148))
+* resource/aws_vpc_security_group_ingress_rule: `security_group_id` is Required ([#32148](https://github.com/hashicorp/terraform-provider-aws/issues/32148))
+
+## 5.5.0 (June 23, 2023)
+
+NOTES:
+
+* provider: Updates to Go 1.20, the last release that will run on any release of Windows 7, 8, Server 2008 and Server 2012. A future release will update to Go 1.21, and these platforms will no longer be supported. ([#32108](https://github.com/hashicorp/terraform-provider-aws/issues/32108))
+* provider: Updates to Go 1.20, the last release that will run on macOS 10.13 High Sierra or 10.14 Mojave. A future release will update to Go 1.21, and these platforms will no longer be supported. ([#32108](https://github.com/hashicorp/terraform-provider-aws/issues/32108))
+* provider: Updates to Go 1.20. The provider will now notice the `trust-ad` option in `/etc/resolv.conf` and, if set, will set the "authentic data" option in outgoing DNS requests in order to better match the behavior of the GNU libc resolver. ([#32108](https://github.com/hashicorp/terraform-provider-aws/issues/32108))
 
 FEATURES:
 
+* **New Data Source:** `aws_sesv2_email_identity` ([#32026](https://github.com/hashicorp/terraform-provider-aws/issues/32026))
+* **New Data Source:** `aws_sesv2_email_identity_mail_from_attributes` ([#32026](https://github.com/hashicorp/terraform-provider-aws/issues/32026))
 * **New Resource:** `aws_chimesdkvoice_sip_rule` ([#32070](https://github.com/hashicorp/terraform-provider-aws/issues/32070))
 * **New Resource:** `aws_organizations_resource_policy` ([#32056](https://github.com/hashicorp/terraform-provider-aws/issues/32056))
 
 ENHANCEMENTS:
 
 * data-source/aws_organizations_organization: Return the full set of attributes when running as a [delegated administrator for AWS Organizations](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_delegate_policies.html) ([#32056](https://github.com/hashicorp/terraform-provider-aws/issues/32056))
+* provider: Mask all sensitive values that appear when `TF_LOG` level is `TRACE` ([#32174](https://github.com/hashicorp/terraform-provider-aws/issues/32174))
+* resource/aws_config_configuration_recorder: Add `exclusion_by_resource_types` and `recording_strategy` attributes to the `recording_group` configuration block ([#32007](https://github.com/hashicorp/terraform-provider-aws/issues/32007))
 * resource/aws_datasync_task: Add `object_tags` attribute to `options` configuration block ([#27811](https://github.com/hashicorp/terraform-provider-aws/issues/27811))
 * resource/aws_networkmanager_attachment_accepter: Added support for Transit Gateway route table attachments ([#32023](https://github.com/hashicorp/terraform-provider-aws/issues/32023))
 * resource/aws_ses_active_receipt_rule_set: Support import ([#27604](https://github.com/hashicorp/terraform-provider-aws/issues/27604))
 
 BUG FIXES:
 
+* resource/aws_api_gateway_rest_api: Fix crash when `binary_media_types` is `null` ([#32169](https://github.com/hashicorp/terraform-provider-aws/issues/32169))
 * resource/aws_datasync_location_object_storage: Don't ignore `server_certificate` argument ([#27811](https://github.com/hashicorp/terraform-provider-aws/issues/27811))
 * resource/aws_eip: Fix `reading EC2 EIP (eipalloc-abcd1234): couldn't find resource` errors when reading new resource ([#32016](https://github.com/hashicorp/terraform-provider-aws/issues/32016))
 * resource/aws_quicksight_analysis: Fix schema mapping for string set elements ([#31903](https://github.com/hashicorp/terraform-provider-aws/issues/31903))
 * resource/aws_redshiftserverless_workgroup: Fix `waiting for completion: unexpected state 'AVAILABLE'` errors when deleting resource ([#32067](https://github.com/hashicorp/terraform-provider-aws/issues/32067))
 * resource/aws_route_table: Fix `reading Route Table (rtb-abcd1234): couldn't find resource` errors when reading new resource ([#30999](https://github.com/hashicorp/terraform-provider-aws/issues/30999))
+* resource/aws_storagegateway_smb_file_share: Fix update error when `kms_encrypted` is `true` but `kms_key_arn` is not sent in the request ([#32171](https://github.com/hashicorp/terraform-provider-aws/issues/32171))
 
 ## 5.4.0 (June 15, 2023)
 
@@ -146,7 +941,7 @@ FEATURES:
 ENHANCEMENTS:
 
 * data-source/aws_autoscaling_group: Add `traffic_source` attribute ([#31527](https://github.com/hashicorp/terraform-provider-aws/issues/31527))
-* data-source/aws_opensearch_domain: Add `off_peak_window_options` attribute ([#35970](https://github.com/hashicorp/terraform-provider-aws/issues/35970))
+* data-source/aws_opensearch_domain: Add `off_peak_window_options` attribute ([#30965](https://github.com/hashicorp/terraform-provider-aws/issues/30965))
 * provider: Increases size of HTTP request bodies in logs to 1 KB ([#31718](https://github.com/hashicorp/terraform-provider-aws/issues/31718))
 * resource/aws_appsync_graphql_api: Add `visibility` argument ([#31369](https://github.com/hashicorp/terraform-provider-aws/issues/31369))
 * resource/aws_appsync_graphql_api: Add plan time validation for `log_config.cloudwatch_logs_role_arn` ([#31369](https://github.com/hashicorp/terraform-provider-aws/issues/31369))
@@ -161,7 +956,7 @@ ENHANCEMENTS:
 * resource/aws_lambda_invocation: Add lifecycle_scope CRUD to invoke on each resource state transition ([#29367](https://github.com/hashicorp/terraform-provider-aws/issues/29367))
 * resource/aws_lambda_layer_version_permission: Add `skip_destroy` attribute ([#29571](https://github.com/hashicorp/terraform-provider-aws/issues/29571))
 * resource/aws_lambda_provisioned_concurrency_configuration: Add `skip_destroy` argument ([#31646](https://github.com/hashicorp/terraform-provider-aws/issues/31646))
-* resource/aws_opensearch_domain: Add `off_peak_window_options` configuration block ([#35970](https://github.com/hashicorp/terraform-provider-aws/issues/35970))
+* resource/aws_opensearch_domain: Add `off_peak_window_options` configuration block ([#30965](https://github.com/hashicorp/terraform-provider-aws/issues/30965))
 * resource/aws_sagemaker_endpoint_configuration: Add  and `shadow_production_variants.serverless_config.provisioned_concurrency` arguments ([#31398](https://github.com/hashicorp/terraform-provider-aws/issues/31398))
 * resource/aws_transfer_server: Add support for `TransferSecurityPolicy-2023-05` `security_policy_name` value ([#31536](https://github.com/hashicorp/terraform-provider-aws/issues/31536))
 
diff --git a/GNUmakefile b/GNUmakefile
index 4a8433a5a14..e964745cf0f 100644
--- a/GNUmakefile
+++ b/GNUmakefile
@@ -1,14 +1,14 @@
-SWEEP               ?= us-west-2,us-east-1,us-east-2
+SWEEP               ?= us-west-2,us-east-1,us-east-2,us-west-1
 TEST                ?= ./...
 SWEEP_DIR           ?= ./internal/sweep
 PKG_NAME            ?= internal
 SVC_DIR             ?= ./internal/service
 TEST_COUNT          ?= 1
-ACCTEST_TIMEOUT     ?= 180m
+ACCTEST_TIMEOUT     ?= 360m
 ACCTEST_PARALLELISM ?= 20
 P                   ?= 20
 GO_VER              ?= go
-SWEEP_TIMEOUT       ?= 60m
+SWEEP_TIMEOUT       ?= 360m
 
 ifneq ($(origin PKG), undefined)
 	PKG_NAME = internal/service/$(PKG)
@@ -75,10 +75,10 @@ default: build
 
 # Please keep targets in alphabetical order
 
-build: fmtcheck
+build: fmtcheck ## Build provider
 	$(GO_VER) install
 
-cleango:
+cleango: ## Clean up Go cache
 	@echo "==> Cleaning Go..."
 	@echo "WARNING: This will kill gopls and clean Go caches"
 	@vscode=`ps -ef | grep Visual\ Studio\ Code | wc -l | xargs` ; \
@@ -92,15 +92,18 @@ cleango:
 	done ; \
 	go clean -modcache -testcache -cache ; \
 
-clean: cleango build tools
+clean: cleango build tools ## Clean up Go cache and re-install tools
 
-depscheck:
+copyright: ## Run copywrite (generate source code headers)
+	@copywrite headers
+
+depscheck: ## Verify dependencies are tidy
 	@echo "==> Checking source code with go mod tidy..."
 	@$(GO_VER) mod tidy
 	@git diff --exit-code -- go.mod go.sum || \
 		(echo; echo "Unexpected difference in go.mod/go.sum files. Run 'go mod tidy' command or revert any go.mod/go.sum changes and commit."; exit 1)
 
-docs-lint:
+docs-lint: ## Lint documentation
 	@echo "==> Checking docs against linters..."
 	@misspell -error -source=text docs/ || (echo; \
 		echo "Unexpected misspelling found in docs files."; \
@@ -111,12 +114,12 @@ docs-lint:
 		echo "To apply any automatic fixes, run 'make docs-lint-fix' and commit the changes."; \
 		exit 1)
 
-docs-lint-fix:
+docs-lint-fix: ## Fix documentation linter findings
 	@echo "==> Applying automatic docs linter fixes..."
 	@misspell -w -source=text docs/
 	@docker run --rm -v $(PWD):/markdown 06kellyjac/markdownlint-cli --fix docs/
 
-docscheck:
+docscheck: ## Check provider documentation
 	@tfproviderdocs check \
 		-allowed-resource-subcategories-file website/allowed-subcategories.txt \
 		-enable-contents-check \
@@ -126,26 +129,25 @@ docscheck:
 		-require-resource-subcategory
 	@misspell -error -source text CHANGELOG.md .changelog
 
-fmt:
+fmt: ## Fix Go source formatting
 	@echo "==> Fixing source code with gofmt..."
 	gofmt -s -w ./$(PKG_NAME) ./names $(filter-out ./.ci/providerlint/go% ./.ci/providerlint/README.md ./.ci/providerlint/vendor, $(wildcard ./.ci/providerlint/*))
 
 # Currently required by tf-deploy compile
-fmtcheck:
+fmtcheck: ## Verify Go source is formatted
 	@sh -c "'$(CURDIR)/.ci/scripts/gofmtcheck.sh'"
 
-fumpt:
+fumpt: ## Run gofumpt
 	@echo "==> Fixing source code with gofumpt..."
 	gofumpt -w ./$(PKG_NAME) ./names $(filter-out ./.ci/providerlint/go% ./.ci/providerlint/README.md ./.ci/providerlint/vendor, $(wildcard ./.ci/providerlint/*))
 
-gen:
+gen: ## Run all Go generators
 	rm -f .github/labeler-issue-triage.yml
 	rm -f .github/labeler-pr-triage.yml
 	rm -f infrastructure/repository/labels-service.tf
 	rm -f internal/conns/*_gen.go
 	rm -f internal/provider/*_gen.go
 	rm -f internal/service/**/*_gen.go
-	rm -f internal/sweep/sweep_test.go
 	rm -f names/caps.md
 	rm -f names/*_gen.go
 	rm -f website/docs/guides/custom-service-endpoints.html.md
@@ -153,38 +155,44 @@ gen:
 	rm -f .ci/.semgrep-configs.yml
 	rm -f .ci/.semgrep-service-name*.yml
 	$(GO_VER) generate ./...
-	# Generate service package list last as it may depend on output of earlier generators.
+	# Generate service package lists last as they may depend on output of earlier generators.
 	rm -f internal/provider/service_packages_gen.go
 	$(GO_VER) generate ./internal/provider
+	$(GO_VER) generate ./internal/sweep
 
-gencheck:
+gencheck: ## Verify generated code is tidy
 	@echo "==> Checking generated source code..."
 	@$(MAKE) gen
 	@git diff --compact-summary --exit-code || \
 		(echo; echo "Unexpected difference in directories after code generation. Run 'make gen' command and commit."; exit 1)
 
-generate-changelog:
+generate-changelog: ## Generate changelog
 	@echo "==> Generating changelog..."
 	@sh -c "'$(CURDIR)/.ci/scripts/generate-changelog.sh'"
 
-gh-workflows-lint:
+gh-workflows-lint: ## Lint github workflows (via actionlint)
 	@echo "==> Checking github workflows with actionlint..."
 	@actionlint
 
-golangci-lint:
+golangci-lint: ## Lint Go source (via golangci-lint)
 	@echo "==> Checking source code with golangci-lint..."
 	@golangci-lint run \
 		--config .ci/.golangci.yml \
 		--config .ci/.golangci2.yml \
 		./$(PKG_NAME)/...
 
-importlint:
+help:
+	@grep -E '^[a-zA-Z0-9_-]+:.*?## .*$$' $(MAKEFILE_LIST) | sort | awk 'BEGIN {FS = ":.*?## "}; {printf "\033[36m%-23s\033[0m %s\n", $$1, $$2}'
+
+importlint: ## Lint imports (via impi)
 	@echo "==> Checking source code with importlint..."
 	@impi --local . --scheme stdThirdPartyLocal ./internal/...
 
-lint: golangci-lint providerlint importlint
+lint: golangci-lint providerlint importlint ## Run all linters
+
+lint-fix: testacc-lint-fix website-lint-fix docs-lint-fix ## Fix all linter findings
 
-providerlint:
+providerlint: ## Lint provider (via providerlint)
 	@echo "==> Checking source code with providerlint..."
 	@providerlint \
 		-c 1 \
@@ -211,7 +219,7 @@ providerlint:
 		-XS002=false \
 		./internal/service/... ./internal/provider/...
 
-sane:
+sane: ## Run sanity checks
 	@echo "==> Sane Check (48 tests of Top 30 resources)"
 	@echo "==> Like 'sanity' except full output and stops soon after 1st error"
 	@echo "==> NOTE: NOT an exhaustive set of tests! Finds big problems only."
@@ -234,7 +242,7 @@ sane:
 		./internal/service/sts/... \
 		-v -count $(TEST_COUNT) -parallel $(ACCTEST_PARALLELISM) -run='TestAccSTSCallerIdentityDataSource_basic|TestAccMetaRegionDataSource_basic|TestAccMetaRegionDataSource_endpoint|TestAccMetaPartitionDataSource_basic|TestAccS3Bucket_Basic_basic|TestAccS3Bucket_Security_corsUpdate|TestAccS3BucketPublicAccessBlock_basic|TestAccS3BucketPolicy_basic|TestAccS3BucketACL_updateACL|TestAccRoute53Record_basic|TestAccRoute53Record_Latency_basic|TestAccRoute53ZoneDataSource_name|TestAccLambdaFunction_basic|TestAccLambdaPermission_basic|TestAccSecretsManagerSecret_basic' -timeout $(ACCTEST_TIMEOUT)
 
-sanity:
+sanity: ## Run sanity checks with failures allowed
 	@echo "==> Sanity Check (48 tests of Top 30 resources)"
 	@echo "==> Like 'sane' but less output and runs all tests despite most errors"
 	@echo "==> NOTE: NOT an exhaustive set of tests! Finds big problems only."
@@ -272,7 +280,7 @@ sanity:
 		exit 1; \
 	fi
 
-semall: semgrep-validate
+semall: semgrep-validate ## Run semgrep on all files
 	@echo "==> Running Semgrep checks locally (must have semgrep installed)..."
 	@semgrep --error --metrics=off \
 		$(if $(filter-out $(origin PKG), undefined),--include $(PKG_NAME),) \
@@ -291,7 +299,7 @@ semall: semgrep-validate
 		--config 'r/dgryski.semgrep-go.oddifsequence' \
 		--config 'r/dgryski.semgrep-go.oserrors'
 
-semgrep-validate:
+semgrep-validate: ## Validate semgrep configuration files
 	@semgrep --error --validate \
 		--config .ci/.semgrep.yml \
 		--config .ci/.semgrep-caps-aws-ec2.yml \
@@ -302,26 +310,30 @@ semgrep-validate:
 		--config .ci/.semgrep-service-name3.yml \
 		--config .ci/semgrep/
 
-semgrep: semgrep-validate
+semgrep: semgrep-validate ## Run semgrep
 	@echo "==> Running Semgrep static analysis..."
 	@docker run --rm --volume "${PWD}:/src" returntocorp/semgrep semgrep --config .ci/.semgrep.yml
 
-skaff:
+skaff: ## Install skaff
 	cd skaff && $(GO_VER) install github.com/hashicorp/terraform-provider-aws/skaff
 
-sweep:
+sweep: ## Run sweepers
 	# make sweep SWEEPARGS=-sweep-run=aws_example_thing
 	# set SWEEPARGS=-sweep-allow-failures to continue after first failure
 	@echo "WARNING: This will destroy infrastructure. Use only in development accounts."
-	$(GO_VER) test $(SWEEP_DIR) -v -tags=sweep -sweep=$(SWEEP) $(SWEEPARGS) -timeout $(SWEEP_TIMEOUT)
+	$(GO_VER) test $(SWEEP_DIR) -v -sweep=$(SWEEP) $(SWEEPARGS) -timeout $(SWEEP_TIMEOUT)
+
+sweeper: ## Run sweepers with failures allowed
+	@echo "WARNING: This will destroy infrastructure. Use only in development accounts."
+	$(GO_VER) test $(SWEEP_DIR) -v -tags=sweep -sweep=$(SWEEP) -sweep-allow-failures -timeout $(SWEEP_TIMEOUT)
 
 t: fmtcheck
 	TF_ACC=1 $(GO_VER) test ./$(PKG_NAME)/... -v -count $(TEST_COUNT) -parallel $(ACCTEST_PARALLELISM) $(RUNARGS) $(TESTARGS) -timeout $(ACCTEST_TIMEOUT)
 
-test: fmtcheck
+test: fmtcheck ## Run unit tests
 	$(GO_VER) test $(TEST) $(TESTARGS) -timeout=5m
 
-test-compile:
+test-compile: ## Test package compilation
 	@if [ "$(TEST)" = "./..." ]; then \
 		echo "ERROR: Set TEST to a specific package. For example,"; \
 		echo "  make test-compile TEST=./$(PKG_NAME)"; \
@@ -329,7 +341,7 @@ test-compile:
 	fi
 	$(GO_VER) test -c $(TEST) $(TESTARGS)
 
-testacc: fmtcheck
+testacc: fmtcheck ## Run acceptance tests
 	@if [ "$(TESTARGS)" = "-run=TestAccXXX" ]; then \
 		echo ""; \
 		echo "Error: Skipping example acceptance testing pattern. Update PKG and TESTS for the relevant *_test.go file."; \
@@ -342,46 +354,47 @@ testacc: fmtcheck
 	fi
 	TF_ACC=1 $(GO_VER) test ./$(PKG_NAME)/... -v -count $(TEST_COUNT) -parallel $(ACCTEST_PARALLELISM) $(RUNARGS) $(TESTARGS) -timeout $(ACCTEST_TIMEOUT)
 
-testacc-lint:
+testacc-lint: ## Lint acceptance tests (via terrafmt)
 	@echo "Checking acceptance tests with terrafmt"
 	find $(SVC_DIR) -type f -name '*_test.go' \
     | sort -u \
     | xargs -I {} terrafmt diff --check --fmtcompat {}
 
-testacc-lint-fix:
+testacc-lint-fix: ## Fix acceptance test linter findings
 	@echo "Fixing acceptance tests with terrafmt"
 	find $(SVC_DIR) -type f -name '*_test.go' \
 	| sort -u \
 	| xargs -I {} terrafmt fmt  --fmtcompat {}
 
-testacc-short: fmtcheck
+testacc-short: fmtcheck ## Run acceptace tests with the -short flag
 	@echo "Running acceptance tests with -short flag"
 	TF_ACC=1 $(GO_VER) test ./$(PKG_NAME)/... -v -short -count $(TEST_COUNT) -parallel $(ACCTEST_PARALLELISM) $(RUNARGS) $(TESTARGS) -timeout $(ACCTEST_TIMEOUT)
 
-tfsdk2fw:
+tfsdk2fw: ## Install tfsdk2fw
 	cd tools/tfsdk2fw && $(GO_VER) install github.com/hashicorp/terraform-provider-aws/tools/tfsdk2fw
 
-tools:
+tools: ## Install tools
 	cd .ci/providerlint && $(GO_VER) install .
-	cd .ci/tools && $(GO_VER) install github.com/bflad/tfproviderdocs
+	cd .ci/tools && $(GO_VER) install github.com/YakDriver/tfproviderdocs
 	cd .ci/tools && $(GO_VER) install github.com/client9/misspell/cmd/misspell
 	cd .ci/tools && $(GO_VER) install github.com/golangci/golangci-lint/cmd/golangci-lint
 	cd .ci/tools && $(GO_VER) install github.com/katbyte/terrafmt
 	cd .ci/tools && $(GO_VER) install github.com/terraform-linters/tflint
 	cd .ci/tools && $(GO_VER) install github.com/pavius/impi/cmd/impi
 	cd .ci/tools && $(GO_VER) install github.com/hashicorp/go-changelog/cmd/changelog-build
+	cd .ci/tools && $(GO_VER) install github.com/hashicorp/copywrite
 	cd .ci/tools && $(GO_VER) install github.com/rhysd/actionlint/cmd/actionlint
 	cd .ci/tools && $(GO_VER) install mvdan.cc/gofumpt
 
-ts: testacc-short
+ts: testacc-short ## Alias to testacc-short
 
-website-link-check:
+website-link-check: ## Check website links
 	@.ci/scripts/markdown-link-check.sh
 
-website-link-check-ghrc:
+website-link-check-ghrc: ## Check website links with ghrc
 	@LINK_CHECK_CONTAINER="ghcr.io/tcort/markdown-link-check:stable" .ci/scripts/markdown-link-check.sh
 
-website-lint:
+website-lint: ## Lint website files
 	@echo "==> Checking website against linters..."
 	@misspell -error -source=text website/ || (echo; \
 		echo "Unexpected mispelling found in website files."; \
@@ -397,13 +410,13 @@ website-lint:
 		echo "To automatically fix the formatting, run 'make website-lint-fix' and commit the changes."; \
 		exit 1)
 
-website-lint-fix:
+website-lint-fix: ## Fix website linter findings
 	@echo "==> Applying automatic website linter fixes..."
 	@misspell -w -source=text website/
 	@docker run --rm -v $(PWD):/markdown 06kellyjac/markdownlint-cli --fix website/docs/
 	@terrafmt fmt ./website --pattern '*.markdown'
 
-yamllint:
+yamllint: ## Lint YAML files (via yamllint)
 	@yamllint .
 
 # Please keep targets in alphabetical order
@@ -416,6 +429,7 @@ yamllint:
 	fmt \
 	fmtcheck \
 	fumpt \
+	help \
 	gen \
 	gencheck \
 	generate-changelog \
@@ -423,6 +437,7 @@ yamllint:
 	golangci-lint \
 	importlint \
 	lint \
+	lint-fix \
 	providerlint \
 	sane \
 	sanity \
diff --git a/docs/README.md b/docs/README.md
index 5b88d4333bb..0d265fef628 100644
--- a/docs/README.md
+++ b/docs/README.md
@@ -1,4 +1,21 @@
 # Documentation
 
-- [Using the AWS Provider](https://registry.terraform.io/providers/hashicorp/aws/latest/docs)
-- [AWS Provider contributing guide](https://hashicorp.github.io/terraform-provider-aws/)
+This directory contains documentation for the [Terraform AWS Provider Contributor Guide](https://hashicorp.github.io/terraform-provider-aws/). Resource and data source documentation is located in the [`website`](../website/) directory and available in the [Terraform Registry](https://registry.terraform.io/providers/hashicorp/aws/latest/docs).
+
+## Local Development
+
+To serve the contributing guide locally, [`mkdocs`](https://www.mkdocs.org/user-guide/installation/) and the [`mkdocs-material`](https://github.com/squidfunk/mkdocs-material#quick-start) extension must be installed. Both require Python and `pip`.
+
+```console
+% pip3 install mkdocs
+```
+
+```console
+% pip3 install mkdocs-material
+```
+
+Once installed, the documentation can be served from the root directory:
+
+```console
+% mkdocs serve
+```
diff --git a/docs/acc-test-environment-variables.md b/docs/acc-test-environment-variables.md
index 29303c32df2..cd49c1d5572 100644
--- a/docs/acc-test-environment-variables.md
+++ b/docs/acc-test-environment-variables.md
@@ -67,6 +67,7 @@ Environment variables (beyond standard AWS Go SDK ones) used by acceptance testi
 | `EC2_SECURITY_GROUP_RULES_PER_GROUP_LIMIT` | EC2 Quota for Rules per Security Group. Defaults to 50. **DEPRECATED:** Can be augmented or replaced with Service Quotas lookup. |
 | `EVENT_BRIDGE_PARTNER_EVENT_BUS_NAME` | Amazon EventBridge partner event bus name. |
 | `EVENT_BRIDGE_PARTNER_EVENT_SOURCE_NAME` | Amazon EventBridge partner event source name. |
+| `FINSPACE_MANAGED_KX_LICENSE_ENABLED` | Enables tests requiring a license to provision managed KX resources. |
 | `GCM_API_KEY` | API Key for Google Cloud Messaging in Pinpoint and SNS Platform Application testing. |
 | `GITHUB_TOKEN` | GitHub token for CodePipeline testing. |
 | `GLOBALACCERATOR_BYOIP_IPV4_ADDRESS` | IPv4 address from a BYOIP CIDR of AWS Account used for testing Global Accelerator's BYOIP accelerator. |
diff --git a/docs/add-a-new-datasource.md b/docs/add-a-new-datasource.md
index e8ac91fedc7..85921e9aafb 100644
--- a/docs/add-a-new-datasource.md
+++ b/docs/add-a-new-datasource.md
@@ -1,3 +1,4 @@
+<!-- markdownlint-configure-file { "code-block-style": false } -->
 # Adding a New Data Source
 
 New data sources are required when AWS adds a new service, or adds new features within an existing service which would require a new data source to allow practitioners to query existing resources of that type for use in their configurations. Anything with a Describe or Get endpoint could make a data source, but some are more useful than others.
@@ -36,18 +37,44 @@ These will map the AWS API response to the data source schema. You will also nee
 
 Data Sources use a self registration process that adds them to the provider using the `@SDKDataSource()` annotation in the datasource's comments. Run `make gen` to register the datasource. This will add an entry to the `service_package_gen.go` file located in the service package folder.
 
-```
-package something
+=== "Terraform Plugin Framework (Preferred)"
 
-import "github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+    ```go
+    package something
 
-// @SDKDataSource("aws_something_example", name="Example")
-func DataSourceExample() *schema.Resource {
-	return &schema.Resource{
-	    // some configuration
-	}
-}
-```
+    import (
+        "github.com/hashicorp/terraform-plugin-framework/datasource"
+        "github.com/hashicorp/terraform-provider-aws/internal/framework"
+    )
+
+    // @FrameworkDataSource(name="Example")
+    func newResourceExample(_ context.Context) (datasource.ResourceWithConfigure, error) {
+    	return &dataSourceExample{}, nil
+    }
+
+    type dataSourceExample struct {
+	    framework.DataSourceWithConfigure
+    }
+
+    func (r *dataSourceExample) Metadata(_ context.Context, request datasource.MetadataRequest, response *datasource.MetadataResponse) {
+    	response.TypeName = "aws_something_example"
+    }
+    ```
+
+=== "Terraform Plugin SDK V2"
+
+    ```go
+    package something
+
+    import "github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+
+    // @SDKDataSource("aws_something_example", name="Example")
+    func DataSourceExample() *schema.Resource {
+    	return &schema.Resource{
+    	    // some configuration
+    	}
+    }
+    ```
 
 ### Write Passing Acceptance Tests
 
diff --git a/docs/add-a-new-region.md b/docs/add-a-new-region.md
index 4388df9e816..298a7cba8d7 100644
--- a/docs/add-a-new-region.md
+++ b/docs/add-a-new-region.md
@@ -53,9 +53,7 @@ See the [Changelog Process](changelog-process.md) document for example changelog
 Some data sources include static values specific to regions that are not available via a standard AWS API call. These will need to be manually updated. AWS employees can code search previous region values to find new region values in internal packages like RIPStaticConfig if they are not documented yet.
 
 - Check [Elastic Load Balancing endpoints and quotas](https://docs.aws.amazon.com/general/latest/gr/elb.html#elb_region) and add Route53 Hosted Zone ID if available to [`internal/service/elb/hosted_zone_id_data_source.go`](https://github.com/hashicorp/terraform-provider-aws/tree/main/internal/service/elb/hosted_zone_id_data_source.go) and [`internal/service/elbv2/hosted_zone_id_data_source.go`](https://github.com/hashicorp/terraform-provider-aws/tree/main/internal/service/elbv2/hosted_zone_id_data_source.go)
-- Check [Amazon Simple Storage Service endpoints and quotas](https://docs.aws.amazon.com/general/latest/gr/s3.html#s3_region) and add Route53 Hosted Zone ID if available to [`internal/service/s3/hosted_zones.go`](https://github.com/hashicorp/terraform-provider-aws/tree/main/internal/service/s3/hosted_zones.go)
+- Check [Amazon Simple Storage Service endpoints and quotas](https://docs.aws.amazon.com/general/latest/gr/s3.html#s3_website_region_endpoints) and add Route53 Hosted Zone ID if available to [`internal/service/s3/hosted_zones.go`](https://github.com/hashicorp/terraform-provider-aws/tree/main/internal/service/s3/hosted_zones.go)
 - Check [CloudTrail Supported Regions docs](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-supported-regions.html#cloudtrail-supported-regions) and add AWS Account ID if available to [`internal/service/cloudtrail/service_account_data_source.go`](https://github.com/hashicorp/terraform-provider-aws/tree/main/internal/service/cloudtrail/service_account_data_source.go)
-- ~~Check [Elastic Load Balancing Access Logs docs](https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/enable-access-logs.html#attach-bucket-policy) and add Elastic Load Balancing Account ID if available to [`internal/service/elb/service_account_data_source.go`](https://github.com/hashicorp/terraform-provider-aws/tree/main/internal/service/elb/service_account_data_source.go)~~
-- ~~Check [Redshift Database Audit Logging docs](https://docs.aws.amazon.com/redshift/latest/mgmt/db-auditing.html#db-auditing-bucket-permissions) and add AWS Account ID if available to [`internal/service/redshift/service_account_data_source.go`](https://github.com/hashicorp/terraform-provider-aws/tree/main/internal/service/redshift/service_account_data_source.go)~~
 - Check [AWS Elastic Beanstalk endpoints and quotas](https://docs.aws.amazon.com/general/latest/gr/elasticbeanstalk.html) and add Route53 Hosted Zone ID if available to [`internal/service/elasticbeanstalk/hosted_zone_data_source.go`](https://github.com/hashicorp/terraform-provider-aws/tree/main/internal/service/elasticbeanstalk/hosted_zone_data_source.go)
 - Check [SageMaker docs](https://docs.aws.amazon.com/sagemaker/latest/dg/sagemaker-algo-docker-registry-paths.html) and add AWS Account IDs if available to [`internal/service/sagemaker/prebuilt_ecr_image_data_source.go`](https://github.com/hashicorp/terraform-provider-aws/tree/main/internal/service/sagemaker/prebuilt_ecr_image_data_source.go)
diff --git a/docs/add-a-new-resource.md b/docs/add-a-new-resource.md
index b43fda72e22..f436d25d345 100644
--- a/docs/add-a-new-resource.md
+++ b/docs/add-a-new-resource.md
@@ -1,3 +1,4 @@
+<!-- markdownlint-configure-file { "code-block-style": false } -->
 # Adding a New Resource
 
 New resources are required when AWS adds a new service, or adds new features within an existing service which would require a new resource to manage in Terraform. Typically anything with a new set of CRUD API endpoints is a great candidate for a new resource.
@@ -36,20 +37,46 @@ These will map planned Terraform state to the AWS API call, or an AWS API respon
 
 ### Register Resource to the provider
 
-Resources use a self registration process that adds them to the provider using the `@SDKResource()` annotation in the resource's comments. Run `make gen` to register the resource. This will add an entry to the `service_package_gen.go` file located in the service package folder.
+Resources use a self registration process that adds them to the provider using the `@FrameworkResource()` or `@SDKResource()` annotation in the resource's comments. Run `make gen` to register the resource. This will add an entry to the `service_package_gen.go` file located in the service package folder.
 
-```
-package something
+=== "Terraform Plugin Framework (Preferred)"
 
-import "github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+    ```go
+    package something
 
-// @SDKResource("aws_something_example", name="Example)
-func ResourceExample() *schema.Resource {
-	return &schema.Resource{
-	    // some configuration
-	}
-}
-```
+    import (
+        "github.com/hashicorp/terraform-plugin-framework/resource"
+        "github.com/hashicorp/terraform-provider-aws/internal/framework"
+    )
+
+    // @FrameworkResource(name="Example")
+    func newResourceExample(_ context.Context) (resource.ResourceWithConfigure, error) {
+    	return &resourceExample{}, nil
+    }
+
+    type resourceExample struct {
+    	framework.ResourceWithConfigure
+    }
+
+    func (r *resourceExample) Metadata(_ context.Context, request resource.MetadataRequest, response *resource.MetadataResponse) {
+    	response.TypeName = "aws_something_example"
+    }
+    ```
+
+=== "Terraform Plugin SDK V2"
+
+    ```go
+    package something
+
+    import "github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+
+    // @SDKResource("aws_something_example", name="Example)
+    func ResourceExample() *schema.Resource {
+    	return &schema.Resource{
+    	    // some configuration
+    	}
+    }
+    ```
 
 ### Write passing Acceptance Tests
 
diff --git a/docs/add-a-new-service.md b/docs/add-a-new-service.md
index cd7bf1688e3..c21a135f3dd 100644
--- a/docs/add-a-new-service.md
+++ b/docs/add-a-new-service.md
@@ -1,3 +1,4 @@
+<!-- markdownlint-configure-file { "code-block-style": false } -->
 # Adding a New AWS Service
 
 AWS frequently launches new services, and Terraform support is frequently desired by the community shortly after launch. Depending on the API surface area of the new service, this could be a major undertaking. The following steps should be followed to prepare for adding the resources that allow for Terraform management of that service.
@@ -19,22 +20,33 @@ Before new resources are submitted, please raise a separate pull request contain
 To add an AWS SDK for Go service client:
 
 1. Check the file `names/names_data.csv` for the service.
-  If it is already there, you are ready to implement the first [resource](./add-a-new-resource.md) or [data source](./add-a-new-datasource.md).
+
+1. If the service is there and there is no value in the `NotImplmented` column, you are ready to implement the first [resource](./add-a-new-resource.md) or [data source](./add-a-new-datasource.md).
+
+1. If the service is there and there is a value in the `NotImplemented` column, remove it and submit the client pull request as described below.
 
 1. Otherwise, determine the service identifier using the rule described in [the Naming Guide](naming.md#service-identifier).
 
 1. In `names/names_data.csv`, add a new line with all the requested information for the service following the guidance in the [`names` README](https://github.com/hashicorp/terraform-provider-aws/blob/main/names/README.md).
-  **_Be very careful when adding or changing data in `names_data.csv`!
-  The Provider and generators depend on the file being correct.
-  We strongly recommend using an editor with CSV support._**
 
-1. Run the following then submit the pull request:
+    !!! tip
+        Be very careful when adding or changing data in `names_data.csv`!
+        The Provider and generators depend on the file being correct.
+        We strongly recommend using an editor with CSV support.
+
+To generate the client, run the following then submit the pull request:
+
+```console
+make gen
+```
+
+```console
+make test
+```
 
-  ```sh
-  make gen
-  make test
-  go mod tidy
-  ```
+```console
+go mod tidy
+```
 
 Once the service client has been added, implement the first [resource](./add-a-new-resource.md) or [data source](./add-a-new-datasource.md) in a separate PR.
 
@@ -48,31 +60,61 @@ If an AWS service must be created in a non-standard way, for example the service
 
 1. Add a file `internal/<service>/service_package.go` that contains an API client factory function, for example:
 
-```go
-package globalaccelerator
-
-import (
-	"context"
-
-	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
-	endpoints_sdkv1 "github.com/aws/aws-sdk-go/aws/endpoints"
-	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
-	globalaccelerator_sdkv1 "github.com/aws/aws-sdk-go/service/globalaccelerator"
-)
-
-// NewConn returns a new AWS SDK for Go v1 client for this service package's AWS API.
-func (p *servicePackage) NewConn(ctx context.Context) (*globalaccelerator_sdkv1.GlobalAccelerator, error) {
-	sess := p.config["session"].(*session_sdkv1.Session)
-	config := &aws_sdkv1.Config{Endpoint: aws_sdkv1.String(p.config["endpoint"].(string))}
-
-	// Force "global" services to correct Regions.
-	if p.config["partition"].(string) == endpoints_sdkv1.AwsPartitionID {
-		config.Region = aws_sdkv1.String(endpoints_sdkv1.UsWest2RegionID)
-	}
-
-	return globalaccelerator_sdkv1.New(sess.Copy(config)), nil
-}
-```
+=== "AWS Go SDK V2 (Preferred)"
+
+    ```go
+    package route53domains
+    
+    import (
+    	"context"
+    
+    	aws_sdkv2 "github.com/aws/aws-sdk-go-v2/aws"
+    	route53domains_sdkv2 "github.com/aws/aws-sdk-go-v2/service/route53domains"
+    	endpoints_sdkv1 "github.com/aws/aws-sdk-go/aws/endpoints"
+    )
+    
+    // NewClient returns a new AWS SDK for Go v2 client for this service package's AWS API.
+    func (p *servicePackage) NewClient(ctx context.Context, config map[string]any) (*route53domains_sdkv2.Client, error) {
+    	cfg := *(config["aws_sdkv2_config"].(*aws_sdkv2.Config))
+    
+    	return route53domains_sdkv2.NewFromConfig(cfg, func(o *route53domains_sdkv2.Options) {
+    		if endpoint := config["endpoint"].(string); endpoint != "" {
+    			o.BaseEndpoint = aws_sdkv2.String(endpoint)
+    		} else if config["partition"].(string) == endpoints_sdkv1.AwsPartitionID {
+    			// Route 53 Domains is only available in AWS Commercial us-east-1 Region.
+    			o.Region = endpoints_sdkv1.UsEast1RegionID
+    		}
+    	}), nil
+    }
+    ```
+
+=== "AWS Go SDK V1"
+
+    ```go
+    package globalaccelerator
+    
+    import (
+        "context"
+    
+        aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
+        endpoints_sdkv1 "github.com/aws/aws-sdk-go/aws/endpoints"
+        session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
+        globalaccelerator_sdkv1 "github.com/aws/aws-sdk-go/service/globalaccelerator"
+    )
+    
+    // NewConn returns a new AWS SDK for Go v1 client for this service package's AWS API.
+    func (p *servicePackage) NewConn(ctx context.Context) (*globalaccelerator_sdkv1.GlobalAccelerator, error) {
+        sess := p.config["session"].(*session_sdkv1.Session)
+        config := &aws_sdkv1.Config{Endpoint: aws_sdkv1.String(p.config["endpoint"].(string))}
+    
+        // Force "global" services to correct Regions.
+        if p.config["partition"].(string) == endpoints_sdkv1.AwsPartitionID {
+            config.Region = aws_sdkv1.String(endpoints_sdkv1.UsWest2RegionID)
+        }
+    
+        return globalaccelerator_sdkv1.New(sess.Copy(config)), nil
+    }
+    ```
 
 ## Customizing a new Service Client
 
@@ -80,30 +122,32 @@ If an AWS service must be customized after creation, for example retry handling
 
 1. Add a file `internal/<service>/service_package.go` that contains an API client customization function, for example:
 
-```go
-package chime
-
-import (
-	"context"
-
-	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
-	request_sdkv1 "github.com/aws/aws-sdk-go/aws/request"
-	chime_sdkv1 "github.com/aws/aws-sdk-go/service/chime"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
-)
-
-// CustomizeConn customizes a new AWS SDK for Go v1 client for this service package's AWS API.
-func (p *servicePackage) CustomizeConn(ctx context.Context, conn *chime_sdkv1.Chime) (*chime_sdkv1.Chime, error) {
-	conn.Handlers.Retry.PushBack(func(r *request_sdkv1.Request) {
-		// When calling CreateVoiceConnector across multiple resources,
-		// the API can randomly return a BadRequestException without explanation
-		if r.Operation.Name == "CreateVoiceConnector" {
-			if tfawserr.ErrMessageContains(r.Error, chime_sdkv1.ErrCodeBadRequestException, "Service received a bad request") {
-				r.Retryable = aws_sdkv1.Bool(true)
-			}
-		}
-	})
-
-	return conn, nil
-}
-```
+=== "AWS Go SDK V1"
+
+    ```go
+    package chime
+    
+    import (
+    	"context"
+    
+    	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
+    	request_sdkv1 "github.com/aws/aws-sdk-go/aws/request"
+    	chime_sdkv1 "github.com/aws/aws-sdk-go/service/chime"
+    	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+    )
+    
+    // CustomizeConn customizes a new AWS SDK for Go v1 client for this service package's AWS API.
+    func (p *servicePackage) CustomizeConn(ctx context.Context, conn *chime_sdkv1.Chime) (*chime_sdkv1.Chime, error) {
+    	conn.Handlers.Retry.PushBack(func(r *request_sdkv1.Request) {
+    		// When calling CreateVoiceConnector across multiple resources,
+    		// the API can randomly return a BadRequestException without explanation
+    		if r.Operation.Name == "CreateVoiceConnector" {
+    			if tfawserr.ErrMessageContains(r.Error, chime_sdkv1.ErrCodeBadRequestException, "Service received a bad request") {
+    				r.Retryable = aws_sdkv1.Bool(true)
+    			}
+    		}
+    	})
+    
+    	return conn, nil
+    }
+    ```
diff --git a/docs/add-import-support.md b/docs/add-import-support.md
index ccbcf94a9dc..cfe37065cdb 100644
--- a/docs/add-import-support.md
+++ b/docs/add-import-support.md
@@ -1,9 +1,9 @@
 # Adding Resource Import Support
 
-Adding import support for Terraform resources will allow existing infrastructure to be managed within Terraform. This type of enhancement generally requires a small to moderate amount of code changes.
+Adding import support for Terraform resources will allow existing infrastructure to be managed within Terraform. This type of enhancement generally requires a small to moderate amount of code changes. Comprehensive code examples and information about resource import support can be found in the [Terraform Plugin Framework documentation](https://developer.hashicorp.com/terraform/plugin/framework/resources/import).
 
-Comprehensive code examples and information about resource import support can be found in the [Terraform Plugin SDK v2 documentation](https://www.terraform.io/plugin/sdkv2/resources/import).
-
-- _Resource Code Implementation_: In the resource code (e.g., `internal/service/{service}/{thing}.go`), implementation of `Importer` `State` function. When possible, prefer using [`schema.ImportStatePassthroughContext`](https://www.terraform.io/plugin/sdkv2/resources/import#importer-state-function) as the `Importer` `State` function
-- _Resource Acceptance Testing Implementation_: In the resource acceptance testing (e.g., `internal/service/{service}/{thing}_test.go`), implementation of `TestStep`s with `ImportState: true`
-- _Resource Documentation Implementation_: In the resource documentation (e.g., `website/docs/r/service_thing.html.markdown`), addition of `Import` documentation section at the bottom of the page
+- _Resource Code_: In the resource code (e.g., `internal/service/{service}/{thing}.go`),
+    - **Plugin Framework (Preferred)** Implement the `ImportState` method on the resource struct. When possible, prefer using the [`resource.ImportStatePassthroughID` function](https://pkg.go.dev/github.com/hashicorp/terraform-plugin-framework/resource#ImportStatePassthroughID).
+    - **Plugin SDK V2**: Implement an `Importer` `State` function. When possible, prefer using [`schema.ImportStatePassthroughContext`](https://www.terraform.io/plugin/sdkv2/resources/import#importer-state-function).
+- _Resource Acceptance Tests_: In the resource acceptance tests (e.g., `internal/service/{service}/{thing}_test.go`), implement one or more tests containing a `TestStep` with `ImportState: true`.
+- _Resource Documentation_: In the resource documentation (e.g., `website/docs/r/service_thing.html.markdown`), add an `Import` section at the bottom of the page.
diff --git a/docs/adding-a-tag-resource.md b/docs/adding-a-tag-resource.md
index 47140682b99..4f890f344d4 100644
--- a/docs/adding-a-tag-resource.md
+++ b/docs/adding-a-tag-resource.md
@@ -157,21 +157,21 @@ resource "aws_{service}_tag" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `resource_arn` - (Required) ARN of the {SERVICE} resource to tag.
 * `key` - (Required) Tag name.
 * `value` - (Required) Tag value.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - {SERVICE} resource identifier and key, separated by a comma (`,`)
 
 ## Import
 
-`aws_{service}_tag` can be imported by using the {SERVICE} resource identifier and key, separated by a comma (`,`), e.g.
+Import `aws_{service}_tag` using the {SERVICE} resource identifier and key, separated by a comma (`,`). For example:
 
 ```console
 $ terraform import aws_{service}_tag.example arn:aws:{service}:us-east-1:123456789012:{thing}/example,Name
diff --git a/docs/aws-go-sdk-versions.md b/docs/aws-go-sdk-versions.md
index a2e3e2e4efc..6a43c8abbcf 100644
--- a/docs/aws-go-sdk-versions.md
+++ b/docs/aws-go-sdk-versions.md
@@ -6,21 +6,19 @@ There are two versions of this API, both of which are considered Generally Avail
 - [AWS SDKs and Tools maintenance policy](https://docs.aws.amazon.com/sdkref/latest/guide/maint-policy.html)
 - [AWS SDKs and Tools version support matrix](https://docs.aws.amazon.com/sdkref/latest/guide/version-support-matrix.html)
 
-While the vast majority of the provider is based on the [AWS SDK for Go v1](https://github.com/aws/aws-sdk-go),
-the provider also allows the use of the [AWS SDK for Go v2](https://github.com/aws/aws-sdk-go-v2).
+Each Terraform provider implementation for an AWS service relies on a service client, which in turn is constructed based on a specific SDK version.
+While the vast majority of the provider is based on the [AWS SDK for Go v1](https://github.com/aws/aws-sdk-go), the provider also allows the use of the [AWS SDK for Go v2](https://github.com/aws/aws-sdk-go-v2).
 
 ## Which SDK Version should I use?
 
-Each Terraform provider implementation for an AWS service relies on a service client which in turn is constructed based on a specific SDK version.
-At present, we are slowly increasing our footprint on SDK v2, but are not actively migrating existing code to use v2.
-The choice of SDK will be as follows:
+At this time **all net-new services are required to use AWS Go SDK v2**.
+Enhancements or bug fixes to existing AWS Go SDK v1 based services do not require migration.
+You can determine the SDK version a given service uses by looking at the `import` section in the service's Go files.
+Where applicable, the contributor guide has been updated to include examples with both AWS Go SDK v1 and v2.
 
-For new services, you should use [AWS SDK for Go v2](https://github.com/aws/aws-sdk-go-v2).
+We are beginning to migrate core services written with v1 onto v2, and adoption will continue to increase over time.
 AWS has a [migration guide](https://aws.github.io/aws-sdk-go-v2/docs/migrating/) that details the differences between the versions of the SDK.
 
-For existing services, use the version of the SDK that service currently uses.
-You can determine this by looking at the `import` section in the service's Go files.
-
 ## What does the SDK handle?
 
 The AWS SDKs handle calling the various web service interfaces for AWS services.
diff --git a/docs/changelog-process.md b/docs/changelog-process.md
index a761ab7c56d..daec083acf3 100644
--- a/docs/changelog-process.md
+++ b/docs/changelog-process.md
@@ -1,14 +1,16 @@
 # Changelog Process
 
-HashiCorp’s open-source projects have always maintained user-friendly, readable CHANGELOG.md that allow users to tell at a glance whether a release should have any effect on them, and to gauge the risk of an upgrade.
+HashiCorp’s open-source projects have always maintained user-friendly, readable `CHANGELOG.md` that allow users to tell at a glance whether a release should have any effect on them, and to gauge the risk of an upgrade.
 
-We use the [go-changelog](https://github.com/hashicorp/go-changelog) to generate and update the changelog from files created in the `.changelog/` directory. It is important that when you raise your Pull Request, there is a changelog entry which describes the changes your contribution makes. Not all changes require an entry in the changelog, guidance follows on what changes do.
+We use [go-changelog](https://github.com/hashicorp/go-changelog) to generate the changelog from files created in the `.changelog/` directory.
+It is important that when you raise your pull request, there is a changelog entry which describes the changes your contribution makes.
+Not all changes require an entry in the changelog, guidance follows on what changes do.
 
 ## Changelog format
 
 The changelog format requires an entry in the following format, where HEADER corresponds to the changelog category, and the entry is the changelog entry itself. The entry should be included in a file in the `.changelog` directory with the naming convention `{PR-NUMBER}.txt`. For example, to create a changelog entry for pull request 1234, there should be a file named `.changelog/1234.txt`.
 
-``````markdown
+``````
 ```release-note:{HEADER}
 {ENTRY}
 ```
@@ -16,7 +18,7 @@ The changelog format requires an entry in the following format, where HEADER cor
 
 If a pull request should contain multiple changelog entries, then multiple blocks can be added to the same changelog file. For example:
 
-``````markdown
+``````
 ```release-note:note
 resource/aws_example_thing: The `broken` attribute has been deprecated. All configurations using `broken` should be updated to use the new `not_broken` attribute instead.
 ```
@@ -36,7 +38,7 @@ The CHANGELOG is intended to show operator-impacting changes to the codebase for
 
 A new resource entry should only contain the name of the resource, and use the `release-note:new-resource` header.
 
-``````markdown
+``````
 ```release-note:new-resource
 aws_secretsmanager_secret_policy
 ```
@@ -46,7 +48,7 @@ aws_secretsmanager_secret_policy
 
 A new data source entry should only contain the name of the data source, and use the `release-note:new-data-source` header.
 
-``````markdown
+``````
 ```release-note:new-data-source
 aws_workspaces_workspace
 ```
@@ -56,7 +58,7 @@ aws_workspaces_workspace
 
 A new full length documentation entry gives the title of the documentation added, using the `release-note:new-guide` header.
 
-``````markdown
+``````
 ```release-note:new-guide
 Custom Service Endpoint Configuration
 ```
@@ -66,7 +68,7 @@ Custom Service Endpoint Configuration
 
 A new bug entry should use the `release-note:bug` header and have a prefix indicating the resource or data source it corresponds to, a colon, then followed by a brief summary. Use a `provider` prefix for provider level fixes.
 
-``````markdown
+``````
 ```release-note:bug
 resource/aws_glue_classifier: Fix quote_symbol being optional
 ```
@@ -76,7 +78,7 @@ resource/aws_glue_classifier: Fix quote_symbol being optional
 
 A new enhancement entry should use the `release-note:enhancement` header and have a prefix indicating the resource or data source it corresponds to, a colon, then followed by a brief summary. Use a `provider` prefix for provider level enhancements.
 
-``````markdown
+``````
 ```release-note:enhancement
 resource/aws_eip: Add network_border_group argument
 ```
@@ -86,7 +88,7 @@ resource/aws_eip: Add network_border_group argument
 
 A deprecation entry should use the `release-note:note` header and have a prefix indicating the resource or data source it corresponds to, a colon, then followed by a brief summary. Use a `provider` prefix for provider level changes.
 
-``````markdown
+``````
 ```release-note:note
 resource/aws_dx_gateway_association: The vpn_gateway_id attribute is being deprecated in favor of the new associated_gateway_id attribute to support transit gateway associations
 ```
@@ -96,7 +98,7 @@ resource/aws_dx_gateway_association: The vpn_gateway_id attribute is being depre
 
 A breaking-change entry should use the `release-note:breaking-change` header and have a prefix indicating the resource or data source it corresponds to, a colon, then followed by a brief summary. Use a `provider` prefix for provider level changes.
 
-``````markdown
+``````
 ```release-note:breaking-change
 resource/aws_lambda_alias: Resource import no longer converts Lambda Function name to ARN
 ```
@@ -104,13 +106,13 @@ resource/aws_lambda_alias: Resource import no longer converts Lambda Function na
 
 #### Region validation support
 
-``````markdown
+``````
 ```release-note:note
 provider: Region validation now automatically supports the new `XX-XXXXX-#` (Location) region. For AWS operations to work in the new region, the region must be explicitly enabled as outlined in the [AWS Documentation](https://docs.aws.amazon.com/general/latest/gr/rande-manage.html#rande-manage-enable). When the region is not enabled, the Terraform AWS Provider will return errors during credential validation (e.g., `error validating provider credentials: error calling sts:GetCallerIdentity: InvalidClientTokenId: The security token included in the request is invalid`) or AWS operations will throw their own errors (e.g., `data.aws_availability_zones.available: Error fetching Availability Zones: AuthFailure: AWS was not able to validate the provided access credentials`). [GH-####]
 ```
 
 ```release-note:enhancement
-* provider: Support automatic region validation for `XX-XXXXX-#` [GH-####]
+provider: Support automatic region validation for `XX-XXXXX-#` [GH-####]
 ```
 ``````
 
@@ -120,7 +122,7 @@ Dependency updates: If the update contains relevant bug fixes or enhancements th
 Any changes which do not fit into the above categories but warrant highlighting.
 Use resource/data source/provider prefixes where appropriate.
 
-``````markdown
+``````
 ```release-note:note
 resource/aws_lambda_alias: Resource import no longer converts Lambda Function name to ARN
 ```
diff --git a/docs/data-handling-and-conversion.md b/docs/data-handling-and-conversion.md
index 08e571111f1..996bae66723 100644
--- a/docs/data-handling-and-conversion.md
+++ b/docs/data-handling-and-conversion.md
@@ -1,3 +1,4 @@
+<!-- markdownlint-configure-file { "code-block-style": false } -->
 # Data Handling and Conversion
 
 The Terraform AWS Provider codebase bridges the implementation of a [Terraform Plugin](https://www.terraform.io/plugin/how-terraform-works) and an AWS API client to support AWS operations and data types as Terraform Resources. Data handling and conversion is a large portion of resource implementation given the domain specific implementations of each side of the provider. The first where Terraform is a generic infrastructure as code tool with a generic data model and the other where the details are driven by AWS API data modeling concepts. This guide is intended to explain and show preferred Terraform AWS Provider code implementations required to successfully translate data between these two systems.
@@ -15,75 +16,116 @@ As a generic walkthrough, the following data handling occurs when creating a Ter
 - An operator creates a Terraform configuration with a new resource defined and runs `terraform apply`
 - Terraform CLI merges an empty prior state for the resource, along with the given configuration state, to create a planned new state for the resource
 - Terraform CLI sends a Terraform Plugin Protocol request to create the new resource with its planned new state data
-- If the Terraform Plugin is using a higher level library, such as the Terraform Plugin SDK, that library receives the request and translates the Terraform Plugin Protocol data types into the expected library types
+- If the Terraform Plugin is using a higher level library, such as the Terraform Plugin Framework, that library receives the request and translates the Terraform Plugin Protocol data types into the expected library types
 - Terraform Plugin invokes the resource creation function with the planned new state data
     - **The planned new state data is converted into an remote system request (e.g., API creation request) that is invoked**
     - **The remote system response is received and the data is converted into an applied new state**
-- If the Terraform Plugin is using a higher level library, such as the Terraform Plugin SDK, that library translates the library types back into Terraform Plugin Protocol data types
+- If the Terraform Plugin is using a higher level library, such as the Terraform Plugin Framework, that library translates the library types back into Terraform Plugin Protocol data types
 - Terraform Plugin responds to Terraform Plugin Protocol request with the new state data
 - Terraform CLI verifies and stores the new state
 
-The highlighted lines are the focus of this documentation today. In the future however, the Terraform AWS Provider may replace certain functionality in the items mentioning the Terraform Plugin SDK above to workaround certain limitations of that particular library.
+The lines in bold above are the focus of this page.
 
 ### Implicit State Passthrough
 
 An important behavior to note with Terraform State handling is if the value of a particular root attribute or block is not refreshed during plan or apply operations, then the prior Terraform State is implicitly deep copied to the new Terraform State for that attribute or block.
 
-Given a resource with a writeable root attribute named `not_set_attr` that never calls `d.Set("not_set_attr", /* ... nil or value */)`, the following happens:
+Given a resource with a writeable root attribute named `not_set_attr` that never explicitly writes a value, the following happens:
 
 - If the Terraform configuration contains `not_set_attr = "anything"` on resource creation, the Terraform State contains `not_set_attr` equal to `"anything"` after apply.
 - If the Terraform configuration is updated to `not_set_attr = "updated"`, the Terraform State contains `not_set_attr` equal to `"updated"` after apply.
 - If the attribute was meant to be associated with a remote system value, it will never update the Terraform State on plan or apply with the remote value. Effectively, it cannot perform drift detection with the remote value.
 
-This however does _not_ apply for nested attributes and blocks if the parent block is refreshed. Given a resource with a root block named `parent`, nested child attributes named `set_attr` and `not_set_attr`, and that calls `d.Set("parent", /* ... only refreshes nested set_attr ... */)`, the Terraform State for the nested `not_set_attr` will not be copied.
+This however does _not_ apply for nested attributes and blocks if the parent block is refreshed.
+Given a resource with a root block named `parent`, with nested child attributes `set_attr` and `not_set_attr`, a read operation which updates the value of `parent` (and the nested `set_attr` attribute) will not copy the Terraform State for the nested `not_set_attr` attribute.
 
-There are valid use cases for passthrough attribute values such as these (see the [Virtual Attributes section](#virtual-attributes)), however the behavior can be confusing or incorrect for operators if the drift detection is expected. Typically these types of drift detection issues can be discovered by implementing resource import testing with state verification.
+There are valid use cases for passthrough attribute values such as these (see the [Virtual Attributes section](#virtual-attributes)), however the behavior can be confusing or incorrect for operators if the drift detection is expected.
+Typically these types of drift detection issues can be discovered by implementing resource import testing with state verification.
+
+## Terraform Plugin Framework versus Plugin SDK V2
+
+Perhaps the most distinct difference between [Terraform Plugin Framework](https://developer.hashicorp.com/terraform/plugin/framework) and [Terraform Plugin SDKv2](https://developer.hashicorp.com/terraform/plugin/sdkv2) is data handling.
+With Terraform Plugin Framework state data is strongly typed, while Plugin SDK V2 based resources represent state data generically (each attribute is an `interface{}`) and types must be asserted at runtime.
+Strongly typed data eliminates an entire class of runtime bugs and crashes, but does require compile type type declarations and a slightly different approach to reading and writing data.
+The sections below contain examples for both plugin libraries, but Terraform Plugin Framework should be preferred whenever possible.
 
 ## Data Conversions in the Terraform AWS Provider
 
 To expand on the data handling that occurs specifically within the Terraform AWS Provider resource implementations, the above resource creation items become the below in practice given our current usage of the Terraform Plugin SDK:
 
-- The `Create`/`CreateWithoutTimeout` function of a `schema.Resource` is invoked with `*schema.ResourceData` containing the planned new state data (conventionally named `d`) and an AWS API client (conventionally named `meta`).
-    - Note: Before reaching this point, the `ResourceData` was already translated from the Terraform Plugin Protocol data types by the Terraform Plugin SDK so values can be read by invoking `d.Get()` and `d.GetOk()` receiver methods with Attribute and Block names from the `Schema` of the `schema.Resource`.
-- An AWS Go SDK operation input type (e.g., `*ec2.CreateVpcInput`) is initialized
-- For each necessary field to configure in the operation input type, the data is read from the `ResourceData` (e.g., `d.Get()`, `d.GetOk()`) and converted into the AWS Go SDK type for the field (e.g., `*string`)
-- The AWS Go SDK operation is invoked and the output type (e.g., `*ec2.CreateVpcOutput`) is initialized
-- For each necessary Attribute, Block, or resource identifier to be saved in the state, the data is read from the AWS Go SDK type for the field (`*string`), if necessary converted into a `ResourceData` compatible type, and saved into a mutated `ResourceData` (e.g., `d.Set()`, `d.SetId()`)
-- Function is returned
+=== "Terraform Plugin Framework (Preferred)"
+    - The `Create` method of a resource is invoked with `resource.CreateRequest` containing the planned new state data (`req.Plan`) and an AWS API client (stored in the `Meta()` method of the resource struct).
+        - Before reaching this point, the `Plan` data was already translated from the Terraform Plugin Protocol data types by the Terraform Plugin Framework so values can be read by invoking `req.Plan.Get(ctx, &plan)`, where `plan` is an instance of the struct representing the resources data.
+    - An AWS Go SDK operation input type (e.g., `*ec2.CreateVpcInput`) is initialized
+    - For each necessary field to configure in the operation input type, the data is read from the `plan` struct and converted into the AWS Go SDK type for the field (e.g., `*string`)
+    - The AWS Go SDK operation is invoked and the output type (e.g., `*ec2.CreateVpcOutput`) is initialized
+    - For each necessary Attribute, Block, or resource identifier to be saved in the state, the data is read from the AWS Go SDK type for the field (`*string`), if necessary converted into the equivalent Plugin Framework compatible type, and saved into a mutated data struct
+    - Function is returned
+
+=== "Terraform Plugin SDK V2"
+    - The `CreateWithoutTimeout` function of a `schema.Resource` is invoked with `*schema.ResourceData` containing the planned new state data (conventionally named `d`) and an AWS API client (conventionally named `meta`).
+        - Before reaching this point, the `ResourceData` was already translated from the Terraform Plugin Protocol data types by the Terraform Plugin SDK so values can be read by invoking `d.Get()` and `d.GetOk()` receiver methods with Attribute and Block names from the `Schema` of the `schema.Resource`.
+    - An AWS Go SDK operation input type (e.g., `*ec2.CreateVpcInput`) is initialized
+    - For each necessary field to configure in the operation input type, the data is read from the `ResourceData` (e.g., `d.Get()`, `d.GetOk()`) and converted into the AWS Go SDK type for the field (e.g., `*string`)
+    - The AWS Go SDK operation is invoked and the output type (e.g., `*ec2.CreateVpcOutput`) is initialized
+    - For each necessary Attribute, Block, or resource identifier to be saved in the state, the data is read from the AWS Go SDK type for the field (`*string`), if necessary converted into a `ResourceData` compatible type, and saved into a mutated `ResourceData` (e.g., `d.Set()`, `d.SetId()`)
+    - Function is returned
 
 ### Type Mapping
 
 To further understand the necessary data conversions used throughout the Terraform AWS Provider codebase between AWS Go SDK types and the Terraform Plugin SDK, the following table can be referenced for most scenarios:
 
-<!-- markdownlint-disable no-inline-html --->
+=== "Terraform Plugin Framework (Preferred)"
+    <!-- markdownlint-disable no-inline-html --->
+
+    | AWS API Model | AWS Go SDK V2 | Terraform Plugin Framework | Terraform Language/State |
+    |---------------|---------------|----------------------------|--------------------------|
+    | `boolean` | `bool` | `types.Bool` | `bool` |
+    | `float` | `*float64` | `types.Float64` | `number` |
+    | `integer` | `*int64` | `types.Int64` | `number` |
+    | `list` | `[]*T` | `types.List` <br/>`types.Set` | `list(any)`<br/>`set(any)` |
+    | `map` | `map[T1]*T2` | `types.Map` | `map(any)` |
+    | `string` | `*string` | `types.String` | `string` |
+    | `structure` | `struct` | `types.List` with `MaxItems: 1` | `list(object(any))` |
+    | `timestamp` | `*time.Time` | `types.String` (typically RFC3339 formatted) | `string` |
 
-| AWS API Model | AWS Go SDK | Terraform Plugin SDK | Terraform Language/State |
-|---------------|------------|----------------------|--------------------------|
-| `boolean` | `*bool` | `TypeBool` (`bool`) | `bool` |
-| `float` | `*float64` | `TypeFloat` (`float64`) | `number` |
-| `integer` | `*int64` | `TypeInt` (`int`) | `number` |
-| `list` | `[]*T` | `TypeList` (`[]interface{}` of `T`)<br/>`TypeSet` (`*schema.Set` of `T`) | `list(any)`<br/>`set(any)` |
-| `map` | `map[T1]*T2` | `TypeMap` (`map[string]interface{}`) | `map(any)` |
-| `string` | `*string` | `TypeString` (`string`) | `string` |
-| `structure` | `struct` | `TypeList` (`[]interface{}` of `map[string]interface{}`) with `MaxItems: 1` | `list(object(any))` |
-| `timestamp` | `*time.Time` | `TypeString` (typically RFC3339 formatted) | `string` |
+    <!-- markdownlint-enable no-inline-html --->
 
-<!-- markdownlint-enable no-inline-html --->
+    [Types](https://developer.hashicorp.com/terraform/plugin/framework/handling-data/types) are built into the Terraform Plugin Framework library and handle null and unknown values in accordance with the [Terraform type system](https://developer.hashicorp.com/terraform/plugin/framework/handling-data/terraform-concepts#type-system).
+    This eliminates the need for any special handling of zero values and provides better change detection on unset values.
 
-You may notice there are type encoding differences the AWS Go SDK and Terraform Plugin SDK:
+=== "Terraform Plugin SDK V2"
+    <!-- markdownlint-disable no-inline-html --->
 
-- AWS Go SDK types are all Go pointer types, while Terraform Plugin SDK types are not.
-- AWS Go SDK structures are the Go `struct` type, while there is no semantically equivalent Terraform Plugin SDK type. Instead they are represented as a slice of interfaces with an underlying map of interfaces.
-- AWS Go SDK types are all Go concrete types, while the Terraform Plugin SDK types for collections and maps are interfaces.
-- AWS Go SDK whole numeric type is always 64-bit, while the Terraform Plugin SDK type is implementation-specific.
+    | AWS API Model | AWS Go SDK | Terraform Plugin SDK | Terraform Language/State |
+    |---------------|------------|----------------------|--------------------------|
+    | `boolean` | `*bool` | `TypeBool` (`bool`) | `bool` |
+    | `float` | `*float64` | `TypeFloat` (`float64`) | `number` |
+    | `integer` | `*int64` | `TypeInt` (`int`) | `number` |
+    | `list` | `[]*T` | `TypeList` (`[]interface{}` of `T`)<br/>`TypeSet` (`*schema.Set` of `T`) | `list(any)`<br/>`set(any)` |
+    | `map` | `map[T1]*T2` | `TypeMap` (`map[string]interface{}`) | `map(any)` |
+    | `string` | `*string` | `TypeString` (`string`) | `string` |
+    | `structure` | `struct` | `TypeList` (`[]interface{}` of `map[string]interface{}`) with `MaxItems: 1` | `list(object(any))` |
+    | `timestamp` | `*time.Time` | `TypeString` (typically RFC3339 formatted) | `string` |
 
-Conceptually, the first and second items above the most problematic in the Terraform AWS Provider codebase. The first item because non-pointer types in Go cannot implement the concept of no value (`nil`). The [Zero Value Mapping section](#zero-value-mapping) will go into more details about the implications of this limitation. The second item because it can be confusing to always handle a structure ("object") type as a list.
+    <!-- markdownlint-enable no-inline-html --->
 
-_There are efforts to replace the Terraform Plugin type system with one similar the underlying Terraform CLI type system. As these efforts materialize, this documentation will be updated._
+    You may notice there are type encoding differences the AWS Go SDK and Terraform Plugin SDK:
+
+    - AWS Go SDK types are all Go pointer types, while Terraform Plugin SDK types are not.
+    - AWS Go SDK structures are the Go `struct` type, while there is no semantically equivalent Terraform Plugin SDK type. Instead they are represented as a slice of interfaces with an underlying map of interfaces.
+    - AWS Go SDK types are all Go concrete types, while the Terraform Plugin SDK types for collections and maps are interfaces.
+    - AWS Go SDK whole numeric type is always 64-bit, while the Terraform Plugin SDK type is implementation-specific.
+
+    Conceptually, the first and second items above the most problematic in the Terraform AWS Provider codebase. The first item because non-pointer types in Go cannot implement the concept of no value (`nil`). The [Zero Value Mapping section](#zero-value-mapping) will go into more details about the implications of this limitation. The second item because it can be confusing to always handle a structure ("object") type as a list.
 
 ### Zero Value Mapping
 
-As mentioned in the [Type Mapping section](#type-mapping), there is a discrepancy with how the Terraform Plugin SDK represents values and the reality that a Terraform State may not configure an Attribute. These values will default to the matching underlying Go type "zero value" if not set:
+!!! note
+    This section only applies to Plugin SDK V2 based resources. Terraform Plugin Framework based resources will handle null and unknown values distinctly from zero values.
+
+As mentioned in the [Type Mapping section](#type-mapping) for Terraform Plugin SDK V2, there is a discrepancy with how the Terraform Plugin SDK represents values and the reality that a Terraform State may not configure an Attribute.
+These values will default to the matching underlying Go type "zero value" if not set:
 
 | Terraform Plugin SDK | Go Type | Zero Value |
 |----------------------|---------|------------|
@@ -92,7 +134,8 @@ As mentioned in the [Type Mapping section](#type-mapping), there is a discrepanc
 | `TypeInt` | `int` | `0` |
 | `TypeString` | `string` | `""` |
 
-For Terraform resource logic this means that these special values must always be accounted for in implementation. The semantics of the API and its meaning of the zero value will determine whether:
+For Terraform resource logic this means that these special values must always be accounted for in implementation.
+The semantics of the API and its meaning of the zero value will determine whether:
 
 - If it is not used/needed, then generally the zero value can safely be used to store an "unset" value and should be ignored when sending to the API.
 - If it is used/needed, whether:
@@ -104,17 +147,33 @@ The maintainers can provide guidance on appropriate solutions for cases not ment
 
 ### Root Attributes Versus Block Attributes
 
-All Attributes and Blocks at the top level of `schema.Resource` `Schema` are considered "root" attributes. These will always be handled with receiver methods on `ResourceData`, such as reading with `d.Get()`, `d.GetOk()`, etc. and writing with `d.Set()`. Any nested Attributes and Blocks inside those root Blocks will then be handled with standard Go types according to the table in the [Type Mapping section](#type-mapping).
+=== "Terraform Plugin Framework (Preferred)"
+    All Attributes and Blocks at the top level of a resource structs `Schema` method are considered "root" attributes.
+    These will always be handled with the `Plan` and `State` fields from the request and response pointers passed in as arguments the the CRUD methods on the resource struct.
+    Values are read from and written to the underlying data structure during CRUD operations, and finally written to state in the response object with a call like `resp.Diagnostics.Append(resp.State.Set(ctx, &plan)...)`.
 
-By convention in the codebase, each level of Block handling beyond root attributes should be separated into "expand" functions that convert Terraform Plugin SDK data into the equivalent AWS Go SDK type (typically named `expand{Service}{Type}`) and "flatten" functions that convert an AWS Go SDK type into the equivalent Terraform Plugin SDK data (typically named `flatten{Service}{Type}`). The [Recommended Implementations section](#recommended-implementations) will go into those details.
+    By convention in the codebase, each level of Block handling beyond root attributes should be separated into "expand" functions that convert Terraform Plugin SDK data into the equivalent AWS Go SDK type (typically named `expand{Service}{Type}`) and "flatten" functions that convert an AWS Go SDK type into the equivalent Terraform Plugin SDK data (typically named `flatten{Service}{Type}`).
+    The [Recommended Implementations section](#recommended-implementations) will go into those details.
 
-_NOTE: While it is possible in certain type scenarios to deeply read and write ResourceData information for a Block Attribute, this practice is discouraged in preference of only handling root Attributes and Blocks._
+=== "Terraform Plugin SDK V2"
+    All Attributes and Blocks at the top level of `schema.Resource` `Schema` are considered "root" attributes.
+    These will always be handled with receiver methods on `ResourceData`, such as reading with `d.Get()`, `d.GetOk()`, etc. and writing with `d.Set()`.
+    Any nested Attributes and Blocks inside those root Blocks will then be handled with standard Go types according to the table in the [Type Mapping section](#type-mapping).
+
+    By convention in the codebase, each level of Block handling beyond root attributes should be separated into "expand" functions that convert Terraform Plugin SDK data into the equivalent AWS Go SDK type (typically named `expand{Service}{Type}`) and "flatten" functions that convert an AWS Go SDK type into the equivalent Terraform Plugin SDK data (typically named `flatten{Service}{Type}`).
+    The [Recommended Implementations section](#recommended-implementations) will go into those details.
+    
+    !!! warning
+        While it is possible in certain type scenarios to deeply read and write ResourceData information for a Block Attribute, this practice is discouraged in preference of only handling root Attributes and Blocks.
 
 ## Recommended Implementations
 
-Given the various complexities around the Terraform Plugin SDK type system, this section contains recommended implementations for Terraform AWS Provider resource code based on the [Type Mapping section](#type-mapping) and the features of the Terraform Plugin SDK and AWS Go SDK. The eventual goal and styling for many of these recommendations is to ease static analysis of the codebase and future potential code generation efforts.
+Given the complexities around conversions between AWS and Terraform Plugin type systems, this section contains recommended implementations for Terraform AWS Provider resources.
 
-_Some of these coding patterns may not be well represented in the codebase, as refactoring the many older styles over years of community development is a large task. However this is meant to represent the preferred implementations today. These will continue to evolve as this codebase and the Terraform Plugin ecosystem changes._
+!!! tip
+    Some of these coding patterns may not be well represented in the codebase, as refactoring the many older styles over years of community development is a large task.
+    However this is meant to represent the preferred implementations today.
+    These will continue to evolve as this codebase and the Terraform Plugin ecosystem changes.
 
 ### Where to Define Flex Functions
 
@@ -130,663 +189,1339 @@ Define FLatten and EXpand (i.e., flex) functions at the _most local level_ possi
 
 ### Expand Functions for Blocks
 
-```go
-func expandStructure(tfMap map[string]interface{}) *service.Structure {
-    if tfMap == nil {
-        return nil
-    }
-
-    apiObject := &service.Structure{}
-
-    // ... nested attribute handling ...
+=== "Terraform Plugin Framework (Preferred)"
+    ```go
+    func expandStructure(tfList []structureData) *service.Structure {
+        if len(tfList) == 0 {
+            return nil
+        }
 
-    return apiObject
-}
+        tfObj := tfList[0]
+        apiObject := &service.Structure{}
 
-func expandStructures(tfList []interface{}) []*service.Structure {
-    if len(tfList) == 0 {
-        return nil
+        // ... nested attribute handling ...
+        
+        return apiObject
     }
 
-    var apiObjects []*service.Structure
-
-    for _, tfMapRaw := range tfList {
-        tfMap, ok := tfMapRaw.(map[string]interface{})
-
-        if !ok {
-            continue
-        }
-
-        apiObject := expandStructure(tfMap)
-
-        if apiObject == nil {
-            continue
+    func expandStructures(tfList []structureData) []*service.Structure {
+        if len(tfList) == 0 {
+            return nil
         }
 
-        apiObjects = append(apiObjects, apiObject)
-    }
+        var apiObjects []*service.Structure
+        for _, tfObj := range tfList {
+            apiObject := &service.Structure{}
 
-    return apiObjects
-}
-```
+            // ... nested attribute handling ...
 
-### Flatten Functions for Blocks
+            apiObjects = append(apiObjects, apiObject)
+        }
 
-```go
-func flattenStructure(apiObject *service.Structure) map[string]interface{} {
-    if apiObject == nil {
-        return nil
+        return apiObjects
     }
+    ```
 
-    tfMap := map[string]interface{}{}
+=== "Terraform Plugin SDK V2"
+    ```go
+    func expandStructure(tfMap map[string]interface{}) *service.Structure {
+        if tfMap == nil {
+            return nil
+        }
 
-    // ... nested attribute handling ...
+        apiObject := &service.Structure{}
 
-    return tfMap
-}
+        // ... nested attribute handling ...
 
-func flattenStructures(apiObjects []*service.Structure) []interface{} {
-    if len(apiObjects) == 0 {
-        return nil
+        return apiObject
     }
 
-    var tfList []interface{}
-
-    for _, apiObject := range apiObjects {
-        if apiObject == nil {
-            continue
+    func expandStructures(tfList []interface{}) []*service.Structure {
+        if len(tfList) == 0 {
+            return nil
         }
 
-        tfList = append(tfList, flattenStructure(apiObject))
-    }
-
-    return tfList
-}
-```
-
-### Root TypeBool and AWS Boolean
+        var apiObjects []*service.Structure
 
-To read, if always sending the attribute value is correct:
+        for _, tfMapRaw := range tfList {
+            tfMap, ok := tfMapRaw.(map[string]interface{})
 
-```go
-input := service.ExampleOperationInput{
-    AttributeName: aws.String(d.Get("attribute_name").(bool))
-}
-```
+            if !ok {
+                continue
+            }
 
-Otherwise to read, if only sending the attribute value when `true` is preferred (`!ok` for opposite):
+            apiObject := expandStructure(tfMap)
 
-```go
-input := service.ExampleOperationInput{}
+            if apiObject == nil {
+                continue
+            }
 
-if v, ok := d.GetOk("attribute_name"); ok {
-    input.AttributeName = aws.Bool(v.(bool))
-}
-```
-
-To write:
+            apiObjects = append(apiObjects, apiObject)
+        }
 
-```go
-d.Set("attribute_name", output.Thing.AttributeName)
-```
+        return apiObjects
+    }
+    ```
 
-### Root TypeFloat and AWS Float
+### Flatten Functions for Blocks
 
-To read:
+=== "Terraform Plugin Framework (Preferred)"
+    ```go
+    func flattenStructure(ctx context.Context, apiObject *service.Structure) (types.List, diag.Diagnostics) {
+        var diags diag.Diagnostics
+        elemType := types.ObjectType{AttrTypes: structureAttrTypes}
 
-```go
-input := service.ExampleOperationInput{}
+        if apiObject == nil {
+            return types.ListNull(elemType), diags
+        }
+        
+        obj := map[string]attr.Value{
+            // ... nested attribute handling ...
+        }
+        objVal, d := types.ObjectValue(structureAttrTypes, obj)
+        diags.Append(d...)
+        
+        listVal, d := types.ListValue(elemType, []attr.Value{objVal})
+        diags.Append(d...)
+        
+        return listVal, diags
+    }
+    
+    func flattenStructures(ctx context.Context, apiObjects []*service.Structure) (types.List, diag.Diagnostics) {
+        var diags diag.Diagnostics
+        elemType := types.ObjectType{AttrTypes: structureAttrTypes}
+        
+        if len(apiObject) == 0 {
+            return types.ListNull(elemType), diags
+        }
+        
+        elems := []attr.Value{}
+        for _, apiObject := range apiObjects {
+            if apiObject == nil {
+                continue
+            }
+
+            obj := map[string]attr.Value{
+                // ... nested attribute handling ...
+            }
+            objVal, d := types.ObjectValue(structureAttrTypes, obj)
+            diags.Append(d...)
+
+            elems = append(elems, objVal)
+        }
+        
+        listVal, d := types.ListValue(elemType, []attr.Value{objVal})
+        diags.Append(d...)
+        
+        return listVal, diags
+    }
+    ```
 
-if v, ok := d.GetOk("attribute_name"); ok {
-    input.AttributeName = aws.Float64(v.(float64))
-}
-```
+=== "Terraform Plugin SDK V2"
+    ```go
+    func flattenStructure(apiObject *service.Structure) map[string]interface{} {
+        if apiObject == nil {
+            return nil
+        }
 
-To write:
+        tfMap := map[string]interface{}{}
+    
+        // ... nested attribute handling ...
+    
+        return tfMap
+    }
+    
+    func flattenStructures(apiObjects []*service.Structure) []interface{} {
+        if len(apiObjects) == 0 {
+            return nil
+        }
+    
+        var tfList []interface{}
+    
+        for _, apiObject := range apiObjects {
+            if apiObject == nil {
+                continue
+            }
+    
+            tfList = append(tfList, flattenStructure(apiObject))
+        }
+    
+        return tfList
+    }
+    ```
 
-```go
-d.Set("attribute_name", output.Thing.AttributeName)
-```
+### Root Bool and AWS Boolean
 
-### Root TypeInt and AWS Integer
+=== "Terraform Plugin Framework (Preferred)"
+    To read, if always sending the attribute value is correct:
 
-To read:
+    ```go
+    input := service.ExampleOperationInput{
+        AttributeName: aws.String(plan.AttributeName.ValueBool())
+    }
+    ```
+    
+    Alternatively, if only sending the attribute value when `true`:
+    
+    ```go
+    input := service.ExampleOperationInput{}
+    
+    if v := plan.AttributeName.ValueBool(); v {
+        input.AttributeName = aws.Bool(v)
+    }
+    ```
+
+    Or, if only sending the attribute value when it is known and not null:
+    
+    ```go
+    input := service.ExampleOperationInput{}
+    
+    if !plan.AttributeName.IsUnknown() && !plan.AttributeName.IsNull() {
+        input.AttributeName = aws.Bool(plan.AttributeName.ValueBool())
+    }
+    ```
+    
+    To write:
+    
+    ```go
+    plan.AttributeName = flex.BoolToFramework(output.Thing.AttributeName)
+    ```
+
+=== "Terraform Plugin SDK V2"
+    To read, if always sending the attribute value is correct:
+
+    ```go
+    input := service.ExampleOperationInput{
+        AttributeName: aws.String(d.Get("attribute_name").(bool))
+    }
+    ```
+    
+    Otherwise to read, if only sending the attribute value when `true` is preferred (`!ok` for opposite):
+    
+    ```go
+    input := service.ExampleOperationInput{}
+    
+    if v, ok := d.GetOk("attribute_name"); ok {
+        input.AttributeName = aws.Bool(v.(bool))
+    }
+    ```
+    
+    To write:
+    
+    ```go
+    d.Set("attribute_name", output.Thing.AttributeName)
+    ```
+
+### Root Float and AWS Float
+
+=== "Terraform Plugin Framework (Preferred)"
+    To read:
+
+    ```go
+    input := service.ExampleOperationInput{}
+    
+    if !plan.AttributeName.IsNull() {
+        input.AttributeName = aws.Float64(plan.AttributeName.ValueFloat64())
+    }
+    ```
+    
+    To write:
+    
+    ```go
+    plan.AttributeName = flex.Float64ToFramework(output.Thing.AttributeName)
+    ```
+
+=== "Terraform Plugin SDK V2"
+    To read:
+
+    ```go
+    input := service.ExampleOperationInput{}
+    
+    if v, ok := d.GetOk("attribute_name"); ok {
+        input.AttributeName = aws.Float64(v.(float64))
+    }
+    ```
+    
+    To write:
+    
+    ```go
+    d.Set("attribute_name", output.Thing.AttributeName)
+    ```
+
+### Root Int and AWS Integer
+
+=== "Terraform Plugin Framework (Preferred)"
+    To read:
+
+    ```go
+    input := service.ExampleOperationInput{}
+    
+    if !plan.AttributeName.IsNull() {
+        input.AttributeName = aws.Int64(plan.AttributeName.ValueInt64())
+    }
+    ```
+    
+    To write:
+    
+    ```go
+    plan.AttributeName = flex.Int64ToFramework(output.Thing.AttributeName)
+    ```
+
+=== "Terraform Plugin SDK V2"
+    To read:
+
+    ```go
+    input := service.ExampleOperationInput{}
+    
+    if v, ok := d.GetOk("attribute_name"); ok {
+        input.AttributeName = aws.Int64(int64(v.(int)))
+    }
+    ```
+    
+    To write:
+    
+    ```go
+    d.Set("attribute_name", output.Thing.AttributeName)
+    ```
+
+### Root List of Resource and AWS List of Structure
+
+=== "Terraform Plugin Framework (Preferred)"
+    To read:
+
+    ```go
+    input := service.ExampleOperationInput{}
+    
+    if !plan.AttributeName.IsNull() {
+        var tfList []attributeNameData
+        resp.Diagnostics.Append(plan.AttributeName.ElementsAs(ctx, &tfList, false)...)
+        if resp.Diagnostics.HasError() {
+            return
+        }
 
-```go
-input := service.ExampleOperationInput{}
+        input.AttributeName = expandStructures(tfList)
+    }
+    ```
+    
+    To write:
+    
+    ```go
+    attributeName, d := flattenStructures(ctx, output.Thing.AttributeName))
+    resp.Diagnostics.Append(d...)
+    state.AttributeName = attributeName
+    ```
+
+=== "Terraform Plugin SDK V2"
+    To read:
+
+    ```go
+    input := service.ExampleOperationInput{}
+    
+    if v, ok := d.GetOk("attribute_name"); ok && len(v.([]interface{})) > 0 {
+        input.AttributeName = expandStructures(v.([]interface{}))
+    }
+    ```
+    
+    To write:
+    
+    ```go
+    if err := d.Set("attribute_name", flattenStructures(output.Thing.AttributeName)); err != nil {
+        return diag.Errorf("setting attribute_name: %s", err)
+    }
+    ```
 
-if v, ok := d.GetOk("attribute_name"); ok {
-    input.AttributeName = aws.Int64(int64(v.(int)))
-}
-```
+### Root List of Resource and AWS Structure
 
-To write:
+=== "Terraform Plugin Framework (Preferred)"
+    To read:
 
-```go
-d.Set("attribute_name", output.Thing.AttributeName)
-```
+    ```go
+    input := service.ExampleOperationInput{}
+    
+    if !plan.AttributeName.IsNull() {
+        var tfList []attributeNameData
+        resp.Diagnostics.Append(plan.AttributeName.ElementsAs(ctx, &tfList, false)...)
+        if resp.Diagnostics.HasError() {
+            return
+        }
 
-### Root TypeList of Resource and AWS List of Structure
+        // expander handles translating list with 1 item to a single AWS object
+        input.AttributeName = expandStructure(tfList)
+    }
+    ```
+    
+    To write:
+    
+    ```go
+    // flattener handles nil output, returning the equivalent null Terraform type
+    attributeName, d := flattenStructures(ctx, output.Thing.AttributeName))
+    resp.Diagnostics.Append(d...)
+    state.AttributeName = attributeName
+    ```
+
+=== "Terraform Plugin SDK V2"
+    To read:
+
+    ```go
+    input := service.ExampleOperationInput{}
+    
+    if v, ok := d.GetOk("attribute_name"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
+        input.AttributeName = expandStructure(v.([]interface{})[0].(map[string]interface{}))
+    }
+    ```
+    
+    To write (_likely to have helper function introduced soon_):
+    
+    ```go
+    if output.Thing.AttributeName != nil {
+        if err := d.Set("attribute_name", []interface{}{flattenStructure(output.Thing.AttributeName)}); err != nil {
+            return diag.Errorf("setting attribute_name: %s", err)
+        }
+    } else {
+        d.Set("attribute_name", nil)
+    }
+    ```
 
-To read:
+### Root List of String and AWS List of String
 
-```go
-input := service.ExampleOperationInput{}
+=== "Terraform Plugin Framework (Preferred)"
+    To read:
 
-if v, ok := d.GetOk("attribute_name"); ok && len(v.([]interface{})) > 0 {
-    input.AttributeName = expandStructures(v.([]interface{}))
-}
-```
+    ```go
+    input := service.ExampleOperationInput{}
+    
+    if !plan.AttributeName.IsNull() {
+        input.AttributeName = flex.ExpandFrameworkStringValueList(ctx, plan.AttributeName)
+    }
+    ```
+    
+    To write:
+    
+    ```go
+    plan.AttributeName = flex.FlattenFrameworkStringValueList(output.Thing.AttributeName)
+    ```
+
+=== "Terraform Plugin SDK V2"
+    To read:
+
+    ```go
+    input := service.ExampleOperationInput{}
+    
+    if v, ok := d.GetOk("attribute_name"); ok && len(v.([]interface{})) > 0 {
+        input.AttributeName = flex.ExpandStringList(v.([]interface{}))
+    }
+    ```
+    
+    To write:
+    
+    ```go
+    d.Set("attribute_name", aws.StringValueSlice(output.Thing.AttributeName))
+    ```
+
+### Root Map of String and AWS Map of String
+
+=== "Terraform Plugin Framework (Preferred)"
+    To read:
+
+    ```go
+    input := service.ExampleOperationInput{}
+    
+    if !plan.AttributeName.IsNull() {
+        input.AttributeName = flex.ExpandFrameworkStringValueMap(ctx, plan.AttributeName)
+    }
+    ```
+    
+    To write:
+    
+    ```go
+    plan.AttributeName = flex.FlattenFrameworkStringValueMap(output.Thing.AttributeName)
+    ```
+
+=== "Terraform Plugin SDK V2"
+    To read:
+
+    ```go
+    input := service.ExampleOperationInput{}
+    
+    if v, ok := d.GetOk("attribute_name"); ok && len(v.(map[string]interface{})) > 0 {
+        input.AttributeName = flex.ExpandStringMap(v.(map[string]interface{}))
+    }
+    ```
 
-To write:
+    To write:
 
-```go
-if err := d.Set("attribute_name", flattenStructures(output.Thing.AttributeName)); err != nil {
-    return diag.Errorf("setting attribute_name: %s", err)
-}
-```
+    ```go
+    d.Set("attribute_name", aws.StringValueMap(output.Thing.AttributeName))
+    ```
 
-### Root TypeList of Resource and AWS Structure
+### Root Set of Resource and AWS List of Structure
 
-To read:
+=== "Terraform Plugin Framework (Preferred)"
+    To read:
 
-```go
-input := service.ExampleOperationInput{}
+    ```go
+    input := service.ExampleOperationInput{}
+    
+    if !plan.AttributeName.IsNull() {
+        var tfList []attributeNameData
+        resp.Diagnostics.Append(plan.AttributeName.ElementsAs(ctx, &tfList, false)...)
+        if resp.Diagnostics.HasError() {
+            return
+        }
 
-if v, ok := d.GetOk("attribute_name"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
-    input.AttributeName = expandStructure(v.([]interface{})[0].(map[string]interface{}))
-}
-```
+        input.AttributeName = expandStructure(tfList)
+    }
+    ```
+    
+    To write:
+    
+    ```go
+    // flattener handles nil output, returning the equivalent null Terraform type
+    attributeName, d := flattenStructures(ctx, output.Thing.AttributeName))
+    resp.Diagnostics.Append(d...)
+    state.AttributeName = attributeName
+    ```
+
+=== "Terraform Plugin SDK V2"
+    To read:
+
+    ```go
+    input := service.ExampleOperationInput{}
+    
+    if v, ok := d.GetOk("attribute_name"); ok && v.(*schema.Set).Len() > 0 {
+        input.AttributeName = expandStructures(v.(*schema.Set).List())
+    }
+    ```
 
-To write (_likely to have helper function introduced soon_):
+    To write:
 
-```go
-if output.Thing.AttributeName != nil {
-    if err := d.Set("attribute_name", []interface{}{flattenStructure(output.Thing.AttributeName)}); err != nil {
+    ```go
+    if err := d.Set("attribute_name", flattenStructures(output.Thing.AttributeNames)); err != nil {
         return diag.Errorf("setting attribute_name: %s", err)
     }
-} else {
-    d.Set("attribute_name", nil)
-}
-```
-
-### Root TypeList of TypeString and AWS List of String
-
-To read:
+    ```
 
-```go
-input := service.ExampleOperationInput{}
+### Root Set of String and AWS List of String
 
-if v, ok := d.GetOk("attribute_name"); ok && len(v.([]interface{})) > 0 {
-    input.AttributeName = flex.ExpandStringList(v.([]interface{}))
-}
-```
+=== "Terraform Plugin Framework (Preferred)"
+    To read:
 
-To write:
-
-```go
-d.Set("attribute_name", aws.StringValueSlice(output.Thing.AttributeName))
-```
-
-### Root TypeMap of TypeString and AWS Map of String
-
-To read:
-
-```go
-input := service.ExampleOperationInput{}
-
-if v, ok := d.GetOk("attribute_name"); ok && len(v.(map[string]interface{})) > 0 {
-    input.AttributeName = flex.ExpandStringMap(v.(map[string]interface{}))
-}
-```
+    ```go
+    input := service.ExampleOperationInput{}
+    
+    if !plan.AttributeName.IsNull() {
+        input.AttributeName = flex.ExpandFrameworkStringValueSet(ctx, plan.AttributeName)
+    }
+    ```
+    
+    To write:
+    
+    ```go
+    plan.AttributeName = flex.FlattenFrameworkStringValueSet(output.Thing.AttributeName)
+    ```
+
+=== "Terraform Plugin SDK V2"
+    To read:
+
+    ```go
+    input := service.ExampleOperationInput{}
+    
+    if v, ok := d.GetOk("attribute_name"); ok && v.(*schema.Set).Len() > 0 {
+        input.AttributeName = flex.ExpandStringSet(v.(*schema.Set))
+    }
+    ```
 
-To write:
+    To write:
 
-```go
-d.Set("attribute_name", aws.StringValueMap(output.Thing.AttributeName))
-```
+    ```go
+    d.Set("attribute_name", aws.StringValueSlice(output.Thing.AttributeName))
+    ```
 
-### Root TypeSet of Resource and AWS List of Structure
+### Root String and AWS String
 
-To read:
+=== "Terraform Plugin Framework (Preferred)"
+    To read:
 
-```go
-input := service.ExampleOperationInput{}
+    ```go
+    input := service.ExampleOperationInput{}
+    
+    if !plan.AttributeName.IsNull() {
+        input.AttributeName = aws.String(plan.AttributeName.ValueString())
+    }
+    ```
+    
+    To write:
+    
+    ```go
+    plan.AttributeName = flex.StringToFramework(output.Thing.AttributeName)
+    ```
+
+=== "Terraform Plugin SDK V2"
+    To read:
+
+    ```go
+    input := service.ExampleOperationInput{}
+    
+    if v, ok := d.GetOk("attribute_name"); ok {
+        input.AttributeName = aws.String(v.(string))
+    }
+    ```
 
-if v, ok := d.GetOk("attribute_name"); ok && v.(*schema.Set).Len() > 0 {
-    input.AttributeName = expandStructures(v.(*schema.Set).List())
-}
-```
+    To write:
 
-To write:
+    ```go
+    d.Set("attribute_name", output.Thing.AttributeName)
+    ```
 
-```go
-if err := d.Set("attribute_name", flattenStructures(output.Thing.AttributeNames)); err != nil {
-    return diag.Errorf("setting attribute_name: %s", err)
-}
-```
+### Root String and AWS Timestamp
 
-### Root TypeSet of TypeString and AWS List of String
+=== "Terraform Plugin Framework (Preferred)"
+    To ensure that parsing the read string value does not fail, use the [RFC3339 timetype](https://pkg.go.dev/github.com/hashicorp/terraform-plugin-framework-timetypes@v0.3.0/timetypes#RFC3339).
 
-To read:
+    To read:
 
-```go
-input := service.ExampleOperationInput{}
+    ```go
+    input := service.ExampleOperationInput{}
+    
+    if !plan.AttributeName.IsNull() {
+        attributeName, d := plan.AttributeName.ValueRFC3339Time()
+        resp.Diagnostics.Append(d...)
+        input.AttributeName = aws.Time(attributeName)
+    }
+    ```
+    
+    To write:
+    
+    ```go
+    plan.AttributeName = timetypes.NewRFC3339ValueMust(aws.ToTime(output.Thing.AttributeName).Format(time.RFC3339))
+    ```
+
+=== "Terraform Plugin SDK V2"
+    To ensure that parsing the read string value does not fail, define `attribute_name`'s `schema.Schema` with an appropriate [`ValidateFunc`](https://www.terraform.io/plugin/sdkv2/schemas/schema-behaviors#validatefunc):
+
+    ```go
+    "attribute_name": {
+        Type:         schema.TypeString,
+        // ...
+        ValidateFunc: validation.IsRFC3339Time,
+    },
+    ```
+
+    To read:
+
+    ```go
+    input := service.ExampleOperationInput{}
+    
+    if v, ok := d.GetOk("attribute_name"); ok {
+        v, _ := time.Parse(time.RFC3339, v.(string))
+    
+        input.AttributeName = aws.Time(v)
+    }
+    ```
 
-if v, ok := d.GetOk("attribute_name"); ok && v.(*schema.Set).Len() > 0 {
-    input.AttributeName = flex.ExpandStringSet(v.(*schema.Set))
-}
-```
+    To write:
 
-To write:
+    ```go
+    if output.Thing.AttributeName != nil {
+        d.Set("attribute_name", aws.TimeValue(output.Thing.AttributeName).Format(time.RFC3339))
+    } else {
+        d.Set("attribute_name", nil)
+    }
+    ```
 
-```go
-d.Set("attribute_name", aws.StringValueSlice(output.Thing.AttributeName))
-```
+### Nested Bool and AWS Boolean
 
-### Root TypeString and AWS String
+=== "Terraform Plugin Framework (Preferred)"
+    To read, if always sending the attribute value is correct:
 
-To read:
+    ```go
+    func expandStructure(tfList []structureData) *service.Structure {
+        // ...
 
-```go
-input := service.ExampleOperationInput{}
+        apiObject.NestedAttributeName = aws.Bool(tfObj.NestedAttributeName.ValueBool())
 
-if v, ok := d.GetOk("attribute_name"); ok {
-    input.AttributeName = aws.String(v.(string))
-}
-```
+        // ...
+    }
+    ```
 
-To write:
+    To read, if only sending the attribute value when known and not nil:
 
-```go
-d.Set("attribute_name", output.Thing.AttributeName)
-```
+    ```go
+    func expandStructure(tfList []structureData) *service.Structure {
+        // ...
 
-### Root TypeString and AWS Timestamp
+        if !tfObj.NestedAttributeName.IsUnknown() && !tfObj.NestedAttributeName.IsNull() {
+            apiObject.NestedAttributeName = aws.Bool(tfObj.NestedAttributeName.ValueBool())
+        }
 
-To ensure that parsing the read string value does not fail, define `attribute_name`'s `schema.Schema` with an appropriate [`ValidateFunc`](https://www.terraform.io/plugin/sdkv2/schemas/schema-behaviors#validatefunc):
+        // ...
+    }
+    ```
+
+    To write:
+
+    ```go
+    func flattenStructure(ctx context.Context, apiObject *service.Structure) (types.List, diag.Diagnostics) {
+        // ...
+    
+        // flex will handle setting null when appropriate
+        obj["nested_attribute_name"] = flex.BoolToFramework(ctx, apiObject.NestedAttributeName)
+    
+        // ...
+    }
+    ```
 
-```go
-"attribute_name": {
-    Type:         schema.TypeString,
-    // ...
-    ValidateFunc: validation.IsRFC3339Time,
-},
-```
+=== "Terraform Plugin SDK V2"
+    To read, if always sending the attribute value is correct:
 
-To read:
+    ```go
+    func expandStructure(tfMap map[string]interface{}) *service.Structure {
+        // ...
+    
+        if v, ok := tfMap["nested_attribute_name"].(bool); ok {
+            apiObject.NestedAttributeName = aws.Bool(v)
+        }
+    
+        // ...
+    }
+    ```
 
-```go
-input := service.ExampleOperationInput{}
+    To read, if only sending the attribute value when `true` is preferred (`!v` for opposite):
 
-if v, ok := d.GetOk("attribute_name"); ok {
-    v, _ := time.Parse(time.RFC3339, v.(string))
+    ```go
+    func expandStructure(tfMap map[string]interface{}) *service.Structure {
+        // ...
+    
+        if v, ok := tfMap["nested_attribute_name"].(bool); ok && v {
+            apiObject.NestedAttributeName = aws.Bool(v)
+        }
+    
+        // ...
+    }
+    ```
 
-    input.AttributeName = aws.Time(v)
-}
-```
+    To write:
 
-To write:
+    ```go
+    func flattenStructure(apiObject *service.Structure) map[string]interface{} {
+        // ...
+    
+        if v := apiObject.NestedAttributeName; v != nil {
+            tfMap["nested_attribute_name"] = aws.BoolValue(v)
+        }
+    
+        // ...
+    }
+    ```
 
-```go
-if output.Thing.AttributeName != nil {
-    d.Set("attribute_name", aws.TimeValue(output.Thing.AttributeName).Format(time.RFC3339))
-} else {
-    d.Set("attribute_name", nil)
-}
-```
+### Nested Float and AWS Float
 
-### Nested TypeBool and AWS Boolean
+=== "Terraform Plugin Framework (Preferred)"
+    To read:
 
-To read, if always sending the attribute value is correct:
+    ```go
+    func expandStructure(tfList []structureData) *service.Structure {
+        // ...
 
-```go
-func expandStructure(tfMap map[string]interface{}) *service.Structure {
-    // ...
+        if !tfObj.NestedAttributeName.IsUnknown() && !tfObj.NestedAttributeName.IsNull() {
+            apiObject.NestedAttributeName = aws.Float64(tfObj.NestedAttributeName.ValueFloat64())
+        }
 
-    if v, ok := tfMap["nested_attribute_name"].(bool); ok {
-        apiObject.NestedAttributeName = aws.Bool(v)
+        // ...
     }
-
-    // ...
-}
-```
-
-To read, if only sending the attribute value when `true` is preferred (`!v` for opposite):
-
-```go
-func expandStructure(tfMap map[string]interface{}) *service.Structure {
-    // ...
-
-    if v, ok := tfMap["nested_attribute_name"].(bool); ok && v {
-        apiObject.NestedAttributeName = aws.Bool(v)
+    ```
+
+    To write:
+
+    ```go
+    func flattenStructure(ctx context.Context, apiObject *service.Structure) (types.List, diag.Diagnostics) {
+        // ...
+    
+        // flex will handle setting null when appropriate
+        obj["nested_attribute_name"] = flex.Float64ToFramework(ctx, apiObject.NestedAttributeName)
+    
+        // ...
     }
+    ```
 
-    // ...
-}
-```
+=== "Terraform Plugin SDK V2"
+    To read:
 
-To write:
+    ```go
+    func expandStructure(tfMap map[string]interface{}) *service.Structure {
+        // ...
+    
+        if v, ok := tfMap["nested_attribute_name"].(float64); ok && v != 0.0 {
+            apiObject.NestedAttributeName = aws.Float64(v)
+        }
+    
+        // ...
+    }
+    ```
 
-```go
-func flattenStructure(apiObject *service.Structure) map[string]interface{} {
-    // ...
+    To write:
 
-    if v := apiObject.NestedAttributeName; v != nil {
-        tfMap["nested_attribute_name"] = aws.BoolValue(v)
+    ```go
+    func flattenStructure(apiObject *service.Structure) map[string]interface{} {
+        // ...
+    
+        if v := apiObject.NestedAttributeName; v != nil {
+            tfMap["nested_attribute_name"] = aws.Float64Value(v)
+        }
+    
+        // ...
     }
+    ```
 
-    // ...
-}
-```
+### Nested Int and AWS Integer
 
-### Nested TypeFloat and AWS Float
+=== "Terraform Plugin Framework (Preferred)"
+    To read:
 
-To read:
+    ```go
+    func expandStructure(tfList []structureData) *service.Structure {
+        // ...
 
-```go
-func expandStructure(tfMap map[string]interface{}) *service.Structure {
-    // ...
+        if !tfObj.NestedAttributeName.IsUnknown() && !tfObj.NestedAttributeName.IsNull() {
+            apiObject.NestedAttributeName = aws.Int64(tfObj.NestedAttributeName.ValueInt64())
+        }
 
-    if v, ok := tfMap["nested_attribute_name"].(float64); ok && v != 0.0 {
-        apiObject.NestedAttributeName = aws.Float64(v)
+        // ...
+    }
+    ```
+
+    To write:
+
+    ```go
+    func flattenStructure(ctx context.Context, apiObject *service.Structure) (types.List, diag.Diagnostics) {
+        // ...
+    
+        // flex will handle setting null when appropriate
+        obj["nested_attribute_name"] = flex.Int64ToFramework(ctx, apiObject.NestedAttributeName)
+    
+        // ...
     }
+    ```
 
-    // ...
-}
-```
+=== "Terraform Plugin SDK V2"
+    To read:
 
-To write:
+    ```go
+    func expandStructure(tfMap map[string]interface{}) *service.Structure {
+        // ...
+    
+        if v, ok := tfMap["nested_attribute_name"].(int); ok && v != 0 {
+            apiObject.NestedAttributeName = aws.Int64(int64(v))
+        }
+    
+        // ...
+    }
+    ```
 
-```go
-func flattenStructure(apiObject *service.Structure) map[string]interface{} {
-    // ...
+    To write:
 
-    if v := apiObject.NestedAttributeName; v != nil {
-        tfMap["nested_attribute_name"] = aws.Float64Value(v)
+    ```go
+    func flattenStructure(apiObject *service.Structure) map[string]interface{} {
+        // ...
+    
+        if v := apiObject.NestedAttributeName; v != nil {
+            tfMap["nested_attribute_name"] = aws.Int64Value(v)
+        }
+    
+        // ...
     }
+    ```
 
-    // ...
-}
-```
+### Nested List of Resource and AWS List of Structure
 
-### Nested TypeInt and AWS Integer
+=== "Terraform Plugin Framework (Preferred)"
+    To read:
 
-To read:
+    ```go
+    func expandStructure(ctx context.Context, tfList []structureData) (*service.Structure, diag.Diagnostics) {
+        // ...
 
-```go
-func expandStructure(tfMap map[string]interface{}) *service.Structure {
-    // ...
+        var nested []nestedAttributeNameData
+        diags.Append(tfObj.NestedAttributeName.ElementsAs(ctx, &nested, false)...)
 
-    if v, ok := tfMap["nested_attribute_name"].(int); ok && v != 0 {
-        apiObject.NestedAttributeName = aws.Int64(int64(v))
+        // expand will handle null when appropriate
+        apiObject.NestedAttributeName = expandNestedAttributeName(nested)
+
+        // ...
+    }
+    ```
+
+    To write:
+
+    ```go
+    func flattenStructure(ctx context.Context, apiObject *service.Structure) (types.List, diag.Diagnostics) {
+        // ...
+    
+        // flatten will handle setting null when appropriate
+        obj["nested_attribute_name"] = flattenNestedAttributeName(ctx, v)
+    
+        // ...
     }
+    ```
 
-    // ...
-}
-```
+=== "Terraform Plugin SDK V2"
+    To read:
 
-To write:
+    ```go
+    func expandStructure(tfMap map[string]interface{}) *service.Structure {
+        // ...
+    
+        if v, ok := tfMap["nested_attribute_name"].([]interface{}); ok && len(v) > 0 {
+            apiObject.NestedAttributeName = expandStructures(v)
+        }
+    
+        // ...
+    }
+    ```
 
-```go
-func flattenStructure(apiObject *service.Structure) map[string]interface{} {
-    // ...
+    To write:
 
-    if v := apiObject.NestedAttributeName; v != nil {
-        tfMap["nested_attribute_name"] = aws.Int64Value(v)
+    ```go
+    func flattenStructure(apiObject *service.Structure) map[string]interface{} {
+        // ...
+    
+        if v := apiObject.NestedAttributeName; v != nil {
+            tfMap["nested_attribute_name"] = flattenNestedStructures(v)
+        }
+    
+        // ...
     }
+    ```
 
-    // ...
-}
-```
+### Nested List of Resource and AWS Structure
 
-### Nested TypeList of Resource and AWS List of Structure
+=== "Terraform Plugin Framework (Preferred)"
+    To read:
 
-To read:
+    ```go
+    func expandStructure(ctx context.Context, tfList []structureData) (*service.Structure, diag.Diagnostics) {
+        // ...
 
-```go
-func expandStructure(tfMap map[string]interface{}) *service.Structure {
-    // ...
+        var nested []nestedAttributeNameData
+        diags.Append(tfObj.NestedAttributeName.ElementsAs(ctx, &nested, false)...)
 
-    if v, ok := tfMap["nested_attribute_name"].([]interface{}); ok && len(v) > 0 {
-        apiObject.NestedAttributeName = expandStructures(v)
+        // expand will handle null when appropriate
+        apiObject.NestedAttributeName = expandNestedAttributeName(nested)
+
+        // ...
+    }
+    ```
+
+    To write:
+
+    ```go
+    func flattenStructure(ctx context.Context, apiObject *service.Structure) (types.List, diag.Diagnostics) {
+        // ...
+    
+        // flatten will handle setting null when appropriate
+        obj["nested_attribute_name"] = flattenNestedAttributeName(ctx, v)
+    
+        // ...
     }
+    ```
 
-    // ...
-}
-```
+=== "Terraform Plugin SDK V2"
+    To read:
 
-To write:
+    ```go
+    func expandStructure(tfMap map[string]interface{}) *service.Structure {
+        // ...
+    
+        if v, ok := tfMap["nested_attribute_name"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
+            apiObject.NestedAttributeName = expandStructure(v[0].(map[string]interface{}))
+        }
+    
+        // ...
+    }
+    ```
 
-```go
-func flattenStructure(apiObject *service.Structure) map[string]interface{} {
-    // ...
+    To write:
 
-    if v := apiObject.NestedAttributeName; v != nil {
-        tfMap["nested_attribute_name"] = flattenNestedStructures(v)
+    ```go
+    func flattenStructure(apiObject *service.Structure) map[string]interface{} {
+        // ...
+    
+        if v := apiObject.NestedAttributeName; v != nil {
+            tfMap["nested_attribute_name"] = []interface{}{flattenNestedStructure(v)}
+        }
+    
+        // ...
     }
+    ```
 
-    // ...
-}
-```
+### Nested List of TypeString and AWS List of String
 
-### Nested TypeList of Resource and AWS Structure
+=== "Terraform Plugin Framework (Preferred)"
+    To read:
 
-To read:
+    ```go
+    func expandStructure(ctx context.Context, tfList []structureData) (*service.Structure, diag.Diagnostics) {
+        // ...
 
-```go
-func expandStructure(tfMap map[string]interface{}) *service.Structure {
-    // ...
+        if !tfObj.NestedAttributeName.IsUnknown() && !tfObj.NestedAttributeName.IsNull() {
+            apiObject.NestedAttributeName = flex.ExpandFrameworkStringList(ctx, tfObj.NestedAttributeName)
+        }
 
-    if v, ok := tfMap["nested_attribute_name"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
-        apiObject.NestedAttributeName = expandStructure(v[0].(map[string]interface{}))
+        // ...
+    }
+    ```
+
+    To write:
+
+    ```go
+    func flattenStructure(ctx context.Context, apiObject *service.Structure) (types.List, diag.Diagnostics) {
+        // ...
+    
+        // flex will handle setting null when appropriate
+        obj["nested_attribute_name"] = flex.FlattenFrameworkStringList(ctx, v)
+    
+        // ...
     }
+    ```
 
-    // ...
-}
-```
+=== "Terraform Plugin SDK V2"
+    To read:
 
-To write:
+    ```go
+    func expandStructure(tfMap map[string]interface{}) *service.Structure {
+        // ...
+    
+        if v, ok := tfMap["nested_attribute_name"].([]interface{}); ok && len(v) > 0 {
+            apiObject.NestedAttributeName = flex.ExpandStringList(v)
+        }
+    
+        // ...
+    }
+    ```
 
-```go
-func flattenStructure(apiObject *service.Structure) map[string]interface{} {
-    // ...
+    To write:
 
-    if v := apiObject.NestedAttributeName; v != nil {
-        tfMap["nested_attribute_name"] = []interface{}{flattenNestedStructure(v)}
+    ```go
+    func flattenStructure(apiObject *service.Structure) map[string]interface{} {
+        // ...
+    
+        if v := apiObject.NestedAttributeName; v != nil {
+            tfMap["nested_attribute_name"] = aws.StringValueSlice(v)
+        }
+    
+        // ...
     }
+    ```
 
-    // ...
-}
-```
+### Nested Map of String and AWS Map of String
 
-### Nested TypeList of TypeString and AWS List of String
+=== "Terraform Plugin Framework (Preferred)"
+    To read:
 
-To read:
+    ```go
+    func expandStructure(ctx context.Context, tfList []structureData) (*service.Structure, diag.Diagnostics) {
+        // ...
 
-```go
-func expandStructure(tfMap map[string]interface{}) *service.Structure {
-    // ...
+        if !tfObj.NestedAttributeName.IsUnknown() && !tfObj.NestedAttributeName.IsNull() {
+            apiObject.NestedAttributeName = flex.ExpandFrameworkStringMap(ctx, tfObj.NestedAttributeName)
+        }
 
-    if v, ok := tfMap["nested_attribute_name"].([]interface{}); ok && len(v) > 0 {
-        apiObject.NestedAttributeName = flex.ExpandStringList(v)
+        // ...
     }
+    ```
+
+    To write:
+
+    ```go
+    func flattenStructure(ctx context.Context, apiObject *service.Structure) (types.List, diag.Diagnostics) {
+        // ...
+    
+        // flex will handle setting null when appropriate
+        obj["nested_attribute_name"] = flex.FlattenFrameworkStringMap(ctx, v)
+    
+        // ...
+    }
+    ```
 
-    // ...
-}
-```
-
-To write:
-
-```go
-func flattenStructure(apiObject *service.Structure) map[string]interface{} {
-    // ...
+=== "Terraform Plugin SDK V2"
+    To read:
 
-    if v := apiObject.NestedAttributeName; v != nil {
-        tfMap["nested_attribute_name"] = aws.StringValueSlice(v)
+    ```go
+    input := service.ExampleOperationInput{}
+    
+    if v, ok := tfMap["nested_attribute_name"].(map[string]interface{}); ok && len(v) > 0 {
+        apiObject.NestedAttributeName = flex.ExpandStringMap(v)
     }
+    ```
 
-    // ...
-}
-```
+    To write:
 
-### Nested TypeMap of TypeString and AWS Map of String
+    ```go
+    func flattenStructure(apiObject *service.Structure) map[string]interface{} {
+        // ...
+    
+        if v := apiObject.NestedAttributeName; v != nil {
+            tfMap["nested_attribute_name"] = aws.StringValueMap(v)
+        }
+    
+        // ...
+    }
+    ```
 
-To read:
+### Nested Set of Resource and AWS List of Structure
 
-```go
-input := service.ExampleOperationInput{}
+=== "Terraform Plugin Framework (Preferred)"
+    To read:
 
-if v, ok := tfMap["nested_attribute_name"].(map[string]interface{}); ok && len(v) > 0 {
-    apiObject.NestedAttributeName = flex.ExpandStringMap(v)
-}
-```
+    ```go
+    func expandStructure(ctx context.Context, tfList []structureData) (*service.Structure, diag.Diagnostics) {
+        // ...
 
-To write:
+        var nested []nestedAttributeNameData
+        diags.Append(tfObj.NestedAttributeName.ElementsAs(ctx, &nested, false)...)
 
-```go
-func flattenStructure(apiObject *service.Structure) map[string]interface{} {
-    // ...
+        // expand will handle null when appropriate
+        apiObject.NestedAttributeName = expandNestedAttributeName(nested)
 
-    if v := apiObject.NestedAttributeName; v != nil {
-        tfMap["nested_attribute_name"] = aws.StringValueMap(v)
+        // ...
     }
-
-    // ...
-}
-```
-
-### Nested TypeSet of Resource and AWS List of Structure
-
-To read:
-
-```go
-func expandStructure(tfMap map[string]interface{}) *service.Structure {
-    // ...
-
-    if v, ok := tfMap["nested_attribute_name"].(*schema.Set); ok && v.Len() > 0 {
-        apiObject.NestedAttributeName = expandStructures(v.List())
+    ```
+
+    To write:
+
+    ```go
+    func flattenStructure(ctx context.Context, apiObject *service.Structure) (types.List, diag.Diagnostics) {
+        // ...
+    
+        // flatten will handle setting null when appropriate
+        obj["nested_attribute_name"] = flattenNestedAttributeName(ctx, v)
+    
+        // ...
     }
+    ```
 
-    // ...
-}
-```
+=== "Terraform Plugin SDK V2"
+    To read:
 
-To write:
+    ```go
+    func expandStructure(tfMap map[string]interface{}) *service.Structure {
+        // ...
+    
+        if v, ok := tfMap["nested_attribute_name"].(*schema.Set); ok && v.Len() > 0 {
+            apiObject.NestedAttributeName = expandStructures(v.List())
+        }
+    
+        // ...
+    }
+    ```
 
-```go
-func flattenStructure(apiObject *service.Structure) map[string]interface{} {
-    // ...
+    To write:
 
-    if v := apiObject.NestedAttributeName; v != nil {
-        tfMap["nested_attribute_name"] = flattenNestedStructures(v)
+    ```go
+    func flattenStructure(apiObject *service.Structure) map[string]interface{} {
+        // ...
+    
+        if v := apiObject.NestedAttributeName; v != nil {
+            tfMap["nested_attribute_name"] = flattenNestedStructures(v)
+        }
+    
+        // ...
     }
+    ```
 
-    // ...
-}
-```
+### Nested Set of TypeString and AWS List of String
 
-### Nested TypeSet of TypeString and AWS List of String
+=== "Terraform Plugin Framework (Preferred)"
+    To read:
 
-To read:
+    ```go
+    func expandStructure(ctx context.Context, tfList []structureData) (*service.Structure, diag.Diagnostics) {
+        // ...
 
-```go
-func expandStructure(tfMap map[string]interface{}) *service.Structure {
-    // ...
+        if !tfObj.NestedAttributeName.IsUnknown() && !tfObj.NestedAttributeName.IsNull() {
+            apiObject.NestedAttributeName = flex.ExpandFrameworkStringSet(ctx, tfObj.NestedAttributeName)
+        }
 
-    if v, ok := tfMap["nested_attribute_name"].(*schema.Set); ok && v.Len() > 0 {
-        apiObject.NestedAttributeName = flex.ExpandStringSet(v)
+        // ...
     }
+    ```
+
+    To write:
+
+    ```go
+    func flattenStructure(ctx context.Context, apiObject *service.Structure) (types.List, diag.Diagnostics) {
+        // ...
+    
+        // flex will handle setting null when appropriate
+        obj["nested_attribute_name"] = flex.FlattenFrameworkStringSet(ctx, v)
+    
+        // ...
+    }
+    ```
 
-    // ...
-}
-```
+=== "Terraform Plugin SDK V2"
+    To read:
 
-To write:
+    ```go
+    func expandStructure(tfMap map[string]interface{}) *service.Structure {
+        // ...
+    
+        if v, ok := tfMap["nested_attribute_name"].(*schema.Set); ok && v.Len() > 0 {
+            apiObject.NestedAttributeName = flex.ExpandStringSet(v)
+        }
+    
+        // ...
+    }
+    ```
 
-```go
-func flattenStructure(apiObject *service.Structure) map[string]interface{} {
-    // ...
+    To write:
 
-    if v := apiObject.NestedAttributeName; v != nil {
-        tfMap["nested_attribute_name"] = aws.StringValueSlice(v)
+    ```go
+    func flattenStructure(apiObject *service.Structure) map[string]interface{} {
+        // ...
+    
+        if v := apiObject.NestedAttributeName; v != nil {
+            tfMap["nested_attribute_name"] = aws.StringValueSlice(v)
+        }
+    
+        // ...
     }
-
-    // ...
-}
-```
+    ```
 
 ### Nested TypeString and AWS String
 
-To read:
+=== "Terraform Plugin Framework (Preferred)"
+    To read:
 
-```go
-func expandStructure(tfMap map[string]interface{}) *service.Structure {
-    // ...
+    ```go
+    func expandStructure(tfList []structureData) *service.Structure {
+        // ...
 
-    if v, ok := tfMap["nested_attribute_name"].(string); ok && v != "" {
-        apiObject.NestedAttributeName = aws.String(v)
+        if !tfObj.NestedAttributeName.IsUnknown() && !tfObj.NestedAttributeName.IsNull() {
+            apiObject.NestedAttributeName = aws.String(tfObj.NestedAttributeName.ValueString())
+        }
+
+        // ...
+    }
+    ```
+
+    To write:
+
+    ```go
+    func flattenStructure(ctx context.Context, apiObject *service.Structure) (types.List, diag.Diagnostics) {
+        // ...
+    
+        // flex will handle setting null when appropriate
+        obj["nested_attribute_name"] = flex.StringToFramework(ctx, apiObject.NestedAttributeName)
+    
+        // ...
     }
+    ```
 
-    // ...
-}
-```
+=== "Terraform Plugin SDK V2"
+    To read:
 
-To write:
+    ```go
+    func expandStructure(tfMap map[string]interface{}) *service.Structure {
+        // ...
+    
+        if v, ok := tfMap["nested_attribute_name"].(string); ok && v != "" {
+            apiObject.NestedAttributeName = aws.String(v)
+        }
+    
+        // ...
+    }
+    ```
 
-```go
-func flattenStructure(apiObject *service.Structure) map[string]interface{} {
-    // ...
+    To write:
 
-    if v := apiObject.NestedAttributeName; v != nil {
-        tfMap["nested_attribute_name"] = aws.StringValue(v)
+    ```go
+    func flattenStructure(apiObject *service.Structure) map[string]interface{} {
+        // ...
+    
+        if v := apiObject.NestedAttributeName; v != nil {
+            tfMap["nested_attribute_name"] = aws.StringValue(v)
+        }
+    
+        // ...
     }
+    ```
 
-    // ...
-}
-```
-
-### Nested TypeString and AWS Timestamp
+### Nested String and AWS Timestamp
 
-To ensure that parsing the read string value does not fail, define `nested_attribute_name`'s `schema.Schema` with an appropriate [`ValidateFunc`](https://www.terraform.io/plugin/sdkv2/schemas/schema-behaviors#validatefunc):
+=== "Terraform Plugin Framework (Preferred)"
+    To ensure that parsing the read string value does not fail, use the [RFC3339 timetype](https://pkg.go.dev/github.com/hashicorp/terraform-plugin-framework-timetypes@v0.3.0/timetypes#RFC3339).
 
-```go
-"nested_attribute_name": {
-    Type:         schema.TypeString,
-    // ...
-    ValidateFunc: validation.IsRFC3339Time,
-},
-```
+    To read:
 
-To read:
+    ```go
+    func expandStructure(tfList []structureData) (*service.Structure, diag.Diagnostics) {
+        // ...
 
-```go
-func expandStructure(tfMap map[string]interface{}) *service.Structure {
-    // ...
+        if !tfObj.NestedAttributeName.IsUnknown() && !tfObj.NestedAttributeName.IsNull() {
+            nested := tfObj.NestedAttributeName.ValueRFC3339Time()
+            diags.Append(tfObj.NestedAttributeName.ElementsAs(ctx, &nested, false)...)
 
-    if v, ok := tfMap["nested_attribute_name"].(string); ok && v != "" {
-        v, _ := time.Parse(time.RFC3339, v)
+            apiObject.NestedAttributeName = aws.Time(nested)
+        }
 
-        apiObject.NestedAttributeName = aws.Time(v)
+        // ...
     }
+    ```
 
-    // ...
-}
-```
+    To write:
 
-To write:
+    ```go
+    func flattenStructure(ctx context.Context, apiObject *service.Structure) (types.List, diag.Diagnostics) {
+        // ...
+    
+        obj["nested_attribute_name"] = timetypes.NewRFC3339ValueMust(aws.ToTime(apiObject.NestedAttributeName).Format(time.RFC3339))
 
-```go
-func flattenStructure(apiObject *service.Structure) map[string]interface{} {
-    // ...
-
-    if v := apiObject.NestedAttributeName; v != nil {
-        tfMap["nested_attribute_name"] = aws.TimeValue(v).Format(time.RFC3339)
+    
+        // ...
+    }
+    ```
+
+=== "Terraform Plugin SDK V2"
+    To ensure that parsing the read string value does not fail, define `nested_attribute_name`'s `schema.Schema` with an appropriate [`ValidateFunc`](https://www.terraform.io/plugin/sdkv2/schemas/schema-behaviors#validatefunc):
+
+    ```go
+    "nested_attribute_name": {
+        Type:         schema.TypeString,
+        // ...
+        ValidateFunc: validation.IsRFC3339Time,
+    },
+    ```
+
+    To read:
+
+    ```go
+    func expandStructure(tfMap map[string]interface{}) *service.Structure {
+        // ...
+    
+        if v, ok := tfMap["nested_attribute_name"].(string); ok && v != "" {
+            v, _ := time.Parse(time.RFC3339, v)
+    
+            apiObject.NestedAttributeName = aws.Time(v)
+        }
+    
+        // ...
     }
+    ```
 
-    // ...
-}
-```
+    To write:
+
+    ```go
+    func flattenStructure(apiObject *service.Structure) map[string]interface{} {
+        // ...
+    
+        if v := apiObject.NestedAttributeName; v != nil {
+            tfMap["nested_attribute_name"] = aws.TimeValue(v).Format(time.RFC3339)
+        }
+    
+        // ...
+    }
+    ```
 
 ## Further Guidelines
 
@@ -814,19 +1549,19 @@ Any value hashing implementation will not be accepted. An exception to this guid
 
 ### Sensitive Values
 
-Marking an Attribute in the Terraform Plugin SDK Schema with `Sensitive` has the following real world implications:
+Marking an Attribute in the Terraform Plugin Framework Schema with `Sensitive` has the following real world implications:
 
 - All occurrences of the Attribute will have the value hidden in plan difference output. In the context of an Attribute within a Block, all Blocks will hide all values of the Attribute.
 - In Terraform CLI 0.14 (with the `provider_sensitive_attrs` experiment enabled) and later, any downstream references to the value in other configuration will hide the value in plan difference output.
 
-The value is either always hidden or not as the Terraform Plugin SDK does not currently implement conditional support for this functionality. Since Terraform Configurations have no control over the behavior, hiding values from the plan difference can incur a potentially undesirable user experience cost for operators.
+The value is either always hidden or not as the Terraform Plugin Framework does not currently implement conditional support for this functionality. Since Terraform Configurations have no control over the behavior, hiding values from the plan difference can incur a potentially undesirable user experience cost for operators.
 
 Given that and especially with the improvements in Terraform CLI 0.14, the Terraform AWS Provider maintainers guiding principles for determining whether an Attribute should be marked as `Sensitive` is if an Attribute value:
 
 - Objectively will always contain a credential, password, or other secret material. Operators can have differing opinions on what constitutes secret material and the maintainers will make best effort determinations, if necessary consulting with the HashiCorp Security team.
 - If the Attribute is within a Block, that all occurrences of the Attribute value will objectively contain secret material. Some APIs (and therefore the Terraform AWS Provider resources) implement generic "setting" and "value" structures which likely will contain a mixture of secret and non-secret material. These will generally not be accepted for marking as `Sensitive`.
 
-If you are unsatisfied with sensitive value handling, the maintainers can recommend ensuring there is a covering issue in the Terraform CLI and/or Terraform Plugin SDK projects explaining the use case. Ultimately, Terraform Plugins including the Terraform AWS Provider cannot implement their own sensitive value abilities if the upstream projects do not implement the appropriate functionality.
+If you are unsatisfied with sensitive value handling, the maintainers can recommend ensuring there is a covering issue in the Terraform CLI and/or Terraform Plugin Framework projects explaining the use case. Ultimately, Terraform Plugins including the Terraform AWS Provider cannot implement their own sensitive value abilities if the upstream projects do not implement the appropriate functionality.
 
 ### Virtual Attributes
 
@@ -834,26 +1569,39 @@ Attributes which only exist within Terraform and not the remote system are typic
 
 If a virtual attribute has a default value that does not match the [Zero Value Mapping](#zero-value-mapping) for the type, it is recommended to explicitly call `d.Set()` with the default value in the `schema.Resource` `Importer` `State` function, for example:
 
-```go
-&schema.Resource{
-	// ... other fields ...
-	Importer: &schema.ResourceImporter{
-		State: func(d *schema.ResourceData, meta interface{}) ([]*schema.ResourceData, error) {
-			d.Set("skip_waiting", true)
+=== "Teraform Plugin Framework (Preferred)"
+    <!-- markdownlint-disable no-space-in-emphasis -->
+    ```go
+    (r *ThingResource) ImportState(ctx context.Context, req resource.ImportStateRequest, resp *resource.ImportStateResponse) {
+        // ... Other import activity
 
-			return []*schema.ResourceData{d}, nil
-		},
-	},
-}
-```
+        resp.Diagnostics.Append(resp.State.SetAttribute(ctx, path.Root("skip_waiting"), true)...)
+    }
+    ```
+    <!-- markdownlint-enable no-space-in-emphasis -->
+
+=== "Teraform Plugin SDK V2"
+    ```go
+    &schema.Resource{
+        // ... other fields ...
+        Importer: &schema.ResourceImporter{
+            State: func(d *schema.ResourceData, meta interface{}) ([]*schema.ResourceData, error) {
+                d.Set("skip_waiting", true)
+
+    			return []*schema.ResourceData{d}, nil
+    		},
+    	},
+    }
+    ```
 
 This helps prevent an immediate plan difference after resource import unless the configuration has a non-default value.
 
 ## Glossary
 
-Below is a listing of relevant terms and descriptions for data handling and conversion in the Terraform AWS Provider to establish common conventions throughout this documentation. This list is not exhaustive of all concepts of Terraform Plugins, the Terraform AWS Provider, or the data handling that occurs during Terraform runs, but these should generally provide enough context about the topics discussed here.
+Below is a listing of relevant terms and descriptions for data handling and conversion in the Terraform AWS Provider to establish common conventions throughout this documentation.
+This list is not exhaustive of all concepts of Terraform Plugins, the Terraform AWS Provider, or the data handling that occurs during Terraform runs, but these should generally provide enough context about the topics discussed here.
 
-- **AWS Go SDK**: Library that converts Go code into AWS Service API compatible operations and data types. Currently refers to version 1 (v1) available since 2015, however version 2 (v2) will reach general availability status soon. [Project](https://github.com/aws/aws-sdk-go).
+- **AWS Go SDK**: Library that converts Go code into AWS Service API compatible operations and data types. See [AWS SDK For Go Versions](aws-go-sdk-versions.md) for information on which version to use.
 - **AWS Go SDK Model**: AWS Go SDK compatible format of AWS Service API Model.
 - **AWS Go SDK Service**: AWS Service API Go code generated from the AWS Go SDK Model. Generated by the AWS Go SDK code.
 - **AWS Service API**: Logical boundary of an AWS service by API endpoint. Some large AWS services may be marketed with many different product names under the same service API (e.g., VPC functionality is part of the EC2 API) and vice-versa where some services may be marketed with one product name but are split into multiple service APIs (e.g., Single Sign-On functionality is split into the Identity Store and SSO Admin APIs).
@@ -861,8 +1609,9 @@ Below is a listing of relevant terms and descriptions for data handling and conv
 - **Terraform Language** ("Configuration"): Configuration syntax interpreted by the Terraform CLI. An implementation of [HCL](https://github.com/hashicorp/hcl). [Full Documentation](https://www.terraform.io/language).
 - **Terraform Plugin Protocol**: Description of Terraform Plugin operations and data types. Currently based on the Remote Procedure Call (RPC) library [`gRPC`](https://grpc.io/).
 - **Terraform Plugin Go**: Low-level library that converts Go code into Terraform Plugin Protocol compatible operations and data types. Not currently implemented in the Terraform AWS Provider. [Project](https://github.com/hashicorp/terraform-plugin-go).
-- **Terraform Plugin SDK**: High-level library that converts Go code into Terraform Plugin Protocol compatible operations and data types. [Project](https://github.com/hashicorp/terraform-plugin-sdk).
-- **Terraform Plugin SDK Schema**: Declarative description of types and domain specific behaviors for a Terraform provider, including resources and attributes. [Full Documentation](https://www.terraform.io/plugin/sdkv2/schemas).
+- **Terraform Plugin Framework**: High-level library that converts Go code into Terraform Plugin Protocol compatible operations and data types. This library replaces Plugin SDK V2. See [Terraform Plugin Development Packages](terraform-plugin-development-packages.md) for more information. [Project](https://github.com/hashicorp/terraform-plugin-framework).
+- **Terraform Plugin SDK V2**: High-level library that converts Go code into Terraform Plugin Protocol compatible operations and data types. This library is replaced by Plugin Framework. See [Terraform Plugin Development Packages](terraform-plugin-development-packages.md) for more information. [Project](https://github.com/hashicorp/terraform-plugin-sdk).
+- **Terraform Plugin Schema**: Declarative description of types and domain specific behaviors for a Terraform provider, including resources and attributes. [Framework Documentation](https://developer.hashicorp.com/terraform/plugin/framework/handling-data/schemas). [SDK V2 Documentation](https://www.terraform.io/plugin/sdkv2/schemas).
 - **Terraform State**: Bindings between objects in a remote system (e.g., an EC2 VPC) and a Terraform configuration (e.g., an `aws_vpc` resource configuration). [Full Documentation](https://www.terraform.io/language/state).
 
 AWS Service API Models use specific terminology to describe data and types:
@@ -893,6 +1642,19 @@ The Terraform Language uses the following terminology to describe data and types
     - **set**: Unordered collection of values.
     - **string**: Sequence of characters.
 
+Terraform Plugin Framework Schemas use the following terminology to describe data and types:
+
+- **Resource Schema**: Grouping of Schema that represents a Terraform Resource.
+- **Schema**: Represents an Attribute or Block. Has a Type and Behavior(s).
+- **Types**: [Full Documentation](https://developer.hashicorp.com/terraform/plugin/framework/handling-data/types).
+    - **Bool**: Boolean value.
+    - **Float64**: Fractional numeric value.
+    - **Int64**: Whole numeric value.
+    - **List**: Ordered collection of values or Blocks.
+    - **Map**: Grouping of key Type to value Type.
+    - **Set**: Unordered collection of values or Blocks.
+    - **String**: Sequence of characters value.
+
 Terraform Plugin SDK Schemas use the following terminology to describe data and types:
 
 - **Behaviors**: [Full Documentation](https://www.terraform.io/plugin/sdkv2/schemas/schema-behaviors).
@@ -916,9 +1678,9 @@ Some other terms that may be used:
 - **Block Attribute** ("Child Attribute", "Nested Attribute"): Block level Attribute.
 - **Expand Function**: Function that converts Terraform Plugin SDK data into the equivalent AWS Go SDK type.
 - **Flatten Function**: Function that converts an AWS Go SDK type into the equivalent Terraform Plugin SDK data.
-- **NullableTypeBool**: Workaround "schema type" created to accept a boolean value that is not configured in addition to true and false. Not implemented in the Terraform Plugin SDK, but uses `TypeString` (where `""` represents not configured) and additional validation.
-- **NullableTypeFloat**: Workaround "schema type" created to accept a fractional numeric value that is not configured in addition to `0.0`. Not implemented in the Terraform Plugin SDK, but uses `TypeString` (where `""` represents not configured) and additional validation.
-- **NullableTypeInt**: Workaround "schema type" created to accept a whole numeric value that is not configured in addition to `0`. Not implemented in the Terraform Plugin SDK, but uses `TypeString` (where `""` represents not configured) and additional validation.
+- **NullableTypeBool**: (SDK V2 Only) Workaround "schema type" created to accept a boolean value that is not configured in addition to true and false. Not implemented in the Terraform Plugin SDK, but uses `TypeString` (where `""` represents not configured) and additional validation.
+- **NullableTypeFloat**: (SDK V2 Only) Workaround "schema type" created to accept a fractional numeric value that is not configured in addition to `0.0`. Not implemented in the Terraform Plugin SDK, but uses `TypeString` (where `""` represents not configured) and additional validation.
+- **NullableTypeInt**: (SDK V2 Only) Workaround "schema type" created to accept a whole numeric value that is not configured in addition to `0`. Not implemented in the Terraform Plugin SDK, but uses `TypeString` (where `""` represents not configured) and additional validation.
 - **Root Attribute**: Resource top level Attribute or Block.
 
 For additional reference, the Terraform documentation also includes a [full glossary of terminology](https://www.terraform.io/docs/glossary.html).
diff --git a/docs/debugging.md b/docs/debugging.md
index 181be0ccb5e..5d9bec17f94 100644
--- a/docs/debugging.md
+++ b/docs/debugging.md
@@ -88,7 +88,10 @@ resource "aws_flow_log" "test" {
 If we were to [run the test](running-and-writing-acceptance-tests.md#running-an-acceptance-test) on the command line, this is how the erroring output might look:
 
 ```console
-% make testacc TESTS=TestAccVPCFlowLog_destinationError PKG=vpc
+make testacc TESTS=TestAccVPCFlowLog_destinationError PKG=vpc
+```
+
+```
 ==> Checking that code complies with gofmt requirements...
 TF_ACC=1 go test ./internal/service/ec2/... -v -count 1 -parallel 20 -run='TestAccVPCFlowLog_destinationError'  -timeout 180m
 === RUN   TestAccVPCFlowLog_destinationError
@@ -150,7 +153,10 @@ resource "aws_flow_log" "test" {
 If we were to [run the test](running-and-writing-acceptance-tests.md#running-an-acceptance-test) on the command line, this is how the erroring output might look:
 
 ```console
-% make testacc TESTS=TestAccVPCFlowLog_LogDestinationType_s3 PKG=vpc
+make testacc TESTS=TestAccVPCFlowLog_LogDestinationType_s3 PKG=vpc
+```
+
+```
 ==> Checking that code complies with gofmt requirements...
 TF_ACC=1 go test ./internal/service/ec2/... -v -count 1 -parallel 20 -run='TestAccVPCFlowLog_LogDestinationType_s3'  -timeout 180m
 === RUN   TestAccVPCFlowLog_LogDestinationType_s3
@@ -199,7 +205,7 @@ func TestAccVPCFlowLog_destinationError(t *testing.T) {
 				Config:      testAccVPCFlowLogConfig_destinationError(rName),
                 // This error should not happen!
                 // See https://github.com/hashicorp/terraform-provider-aws/issues/45912
-				ExpectError: regexp.MustCompile(`invalid destination`),
+				ExpectError: regexache.MustCompile(`invalid destination`),
 			},
 		},
 	})
@@ -293,7 +299,10 @@ func resourceLogFlowCreate(ctx context.Context, d *schema.ResourceData, meta int
 [Running the test](running-and-writing-acceptance-tests.md#running-an-acceptance-test) from the command line, we might see the following output:
 
 ```console
-% make testacc TESTS=TestAccVPCFlowLog_LogDestinationType_s3 PKG=vpc
+make testacc TESTS=TestAccVPCFlowLog_LogDestinationType_s3 PKG=vpc
+```
+
+```
 ==> Checking that code complies with gofmt requirements...
 TF_ACC=1 go test ./internal/service/ec2/... -v -count 1 -parallel 20 -run='TestAccVPCFlowLog_LogDestinationType_s3'  -timeout 180m
 === RUN   TestAccVPCFlowLog_LogDestinationType_s3
diff --git a/docs/dependency-updates.md b/docs/dependency-updates.md
index 1939f659b96..ce22a9e81d0 100644
--- a/docs/dependency-updates.md
+++ b/docs/dependency-updates.md
@@ -22,7 +22,7 @@ See [#9992](https://github.com/hashicorp/terraform-provider-aws/issues/9992) / [
 
 ## AWS Go SDK Updates
 
-Almost exclusively, `github.com/aws/aws-sdk-go` updates are additive in nature. It is generally safe to only scan through them before approving and merging. If you have any concerns about any of the service client updates such as suspicious code removals in the update, or deprecations introduced, run the acceptance testing for potentially affected resources before merging.
+Almost exclusively, `github.com/aws/aws-sdk-go` and `github.com/aws/aws-sdk-go-v2` updates are additive in nature. It is generally safe to only scan through them before approving and merging. If you have any concerns about any of the service client updates such as suspicious code removals in the update, or deprecations introduced, run the acceptance testing for potentially affected resources before merging.
 
 ### Authentication changes
 
@@ -38,7 +38,7 @@ CloudFront service client updates have previously caused an issue when a new fie
 
 Merge if CI passes.
 
-## Terraform Plugin SDK Updates
+## Terraform Plugin Development Package Updates (SDK V2 or Framework)
 
 Except for trivial changes, run the full acceptance testing suite against the pull request and verify there are no new or unexpected failures.
 
diff --git a/docs/design-decision-log.md b/docs/design-decision-log.md
new file mode 100644
index 00000000000..b83b4dbefd7
--- /dev/null
+++ b/docs/design-decision-log.md
@@ -0,0 +1,10 @@
+# Design Decision Log
+
+This serves as an index over the various decisions we make as a maintainer team over what is considered best practice, and
+what we should encourage/require as a design standard. These are not necessarily fixed, and are likely to evolve and be
+replaced as new decisions are made. This is an evolution of an internal process and will pivot to take place in public
+as much as possible to allow for external feedback from the community and core contributors.
+
+| Decision | Description | Issue Link |
+|----------|-------------|------------|
+| [Relationship Resource Design Standards](./design-decisions/relationship-resource-design-standards.md) | Align on design standards for relationship management resources in the Terraform AWS Provider. | [#9901](https://github.com/hashicorp/terraform-provider-aws/issues/9901) |
diff --git a/docs/design-decisions/relationship-resource-design-standards.md b/docs/design-decisions/relationship-resource-design-standards.md
new file mode 100644
index 00000000000..437257f1457
--- /dev/null
+++ b/docs/design-decisions/relationship-resource-design-standards.md
@@ -0,0 +1,124 @@
+# Relationship Resource Design Standards
+
+**Summary:** Align on design standards for relationship management resources in the Terraform AWS Provider.  
+**Created**: 2022-07-11  
+
+---
+
+The goal of this document is to assess the design of existing "relationship" resources in the Terraform AWS Provider and determine if a consistent set of rules can be defined for implementing them. For the purpose of this document, a "relationship" resource is defined as a resource which manages either a direct relationship between two standalone resources ("one-to-one", ie. [`aws_ssoadmin_permission_boundary_attachment`](https://registry.terraform.io/providers/-/aws/latest/docs/resources/ssoadmin_permissions_boundary_attachment)), or a variable number of child relationships to a parent resource ("one-to-many", ie. [`aws_iam_role_policy_attachment`](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment)). Resources and AWS API’s with this function will often contain suffixes like "attachment", "assignment", "registration", or "rule".
+
+A documented standard for implementing relationship-styled resources will inform how new resources are written, and provide guidelines to refer back to when the community requests features which may not align with internal best practices.
+
+## Background
+
+The first form of relationship resources ("one-to-one") typically have a straightforward, singular API design and provider implementation given only a single relationship exists. The second form of resources ("one-to-many") often have to balance two provider design principles:
+
+* [Resources should represent a single API object](https://developer.hashicorp.com/terraform/plugin/best-practices/hashicorp-provider-design-principles#resources-should-represent-a-single-api-object)
+* [Resource and attribute schema should closely match the underlying API](https://developer.hashicorp.com/terraform/plugin/best-practices/hashicorp-provider-design-principles#resource-and-attribute-schema-should-closely-match-the-underlying-api)
+
+In these cases, the smallest possible piece of infrastructure may be a single parent-child relationship, while the AWS APIs may accept and return lists of parent-child relationships. The first principle would favor a resource representing a single relationship, while the second principle suggests a resource should manage a variable number of relationships. Additionally, practitioners coming from the AWS CLI or SDK might also have expectations about how resource schemas should be shaped compared to CLI flags or SDK inputs.
+
+An analysis of existing resources can inform which of these principles maintainers have given precedence to up to this point. The table below documents existing relationship resources in the AWS provider. This table should not be considered exhaustive[^1], but covers a large majority of the resources implementing the patterns discussed above.
+
+| **Resource Name** | **Form** | **AWS API** | **Terraform** |
+| --- | --- | --- | --- |
+| [aws_alb_target_group_attachment](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lb_target_group_attachment) | One-to-many | [Plural](https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_RegisterTargets.html) | [Singular](https://github.com/hashicorp/terraform-provider-aws/blob/v5.7.0/internal/service/elbv2/target_group_attachment.go#L76-L79) |
+| [aws_autoscaling_attachment](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/autoscaling_attachment) (ELB) | One-to-many | [Plural](https://docs.aws.amazon.com/autoscaling/ec2/APIReference/API_AttachLoadBalancers.html) | [Singular](https://github.com/hashicorp/terraform-provider-aws/blob/v5.7.0/internal/service/autoscaling/attachment.go#L58-L61) |
+| [aws_autoscaling_attachment](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/autoscaling_attachment) (Target Group ARN) | One-to-many | [Plural](https://docs.aws.amazon.com/autoscaling/ec2/APIReference/API_AttachLoadBalancerTargetGroups.html)| [Singular](https://github.com/hashicorp/terraform-provider-aws/blob/v5.7.0/internal/service/autoscaling/attachment.go#L74-L77) |
+| [aws_autoscaling_traffic_source_attachment](https://registry.terraform.io/providers/-/aws/latest/docs/resources/autoscaling_traffic_source_attachment) | One-to-many | [Plural](https://docs.aws.amazon.com/autoscaling/ec2/APIReference/API_AttachTrafficSources.html)| [Singular](https://github.com/hashicorp/terraform-provider-aws/blob/v5.7.0/internal/service/autoscaling/traffic_source_attachment.go#L78-L81) |
+| [aws_cognito_identity_pool_roles_attachment](https://registry.terraform.io/providers/-/aws/latest/docs/resources/cognito_identity_pool_roles_attachment)[^2] | One-to-many | [Plural](https://docs.aws.amazon.com/cognitoidentity/latest/APIReference/API_SetIdentityPoolRoles.html) | [Plural](https://github.com/hashicorp/terraform-provider-aws/blob/v5.7.0/internal/service/cognitoidentity/pool_roles_attachment.go#L123-L126) |
+| [aws_ec2_transit_gateway_peering_attachment](https://registry.terraform.io/providers/-/aws/latest/docs/resources/ec2_transit_gateway_peering_attachment) | One-to-one | [Singular](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateTransitGatewayPeeringAttachment.html) | [Singular](https://github.com/hashicorp/terraform-provider-aws/blob/v5.7.0/internal/service/ec2/transitgateway_peering_attachment.go#L75-L81) |
+| [aws_ec2_transit_gateway_vpc_attachment](https://registry.terraform.io/providers/-/aws/latest/docs/resources/ec2_transit_gateway_vpc_attachment) | One-to-one | [Singular](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateTransitGatewayVpcAttachment.html) | [Singular](https://github.com/hashicorp/terraform-provider-aws/blob/v5.7.0/internal/service/ec2/transitgateway_vpc_attachment.go#L102-L112) |
+| [aws_elb_attachment](https://registry.terraform.io/providers/-/aws/latest/docs/resources/elb_attachment) | One-to-many | [Plural](https://docs.aws.amazon.com/elasticloadbalancing/2012-06-01/APIReference/API_RegisterInstancesWithLoadBalancer.html) | [Singular](https://github.com/hashicorp/terraform-provider-aws/blob/v5.7.0/internal/service/elb/attachment.go#L54-L57) |
+| [aws_iam_group_policy_attachment](https://registry.terraform.io/providers/-/aws/latest/docs/resources/iam_group_policy_attachment) | One-to-many | [Singular](https://docs.aws.amazon.com/IAM/latest/APIReference/API_AttachGroupPolicy.html)| [Singular](https://github.com/hashicorp/terraform-provider-aws/blob/v5.7.0/internal/service/iam/group_policy_attachment.go#L153-L156) |
+| [aws_iam_policy_attachment](https://registry.terraform.io/providers/-/aws/latest/docs/resources/iam_policy_attachment)[^3] | One-to-many | [Singular](https://docs.aws.amazon.com/IAM/latest/APIReference/API_AttachRolePolicy.html) | [Plural](https://github.com/hashicorp/terraform-provider-aws/blob/v5.7.0/internal/service/iam/policy_attachment.go#L219-L230) |
+| [aws_iam_role_policy_attachment](https://registry.terraform.io/providers/-/aws/latest/docs/resources/iam_role_policy_attachment) | One-to-many | [Singular](https://docs.aws.amazon.com/IAM/latest/APIReference/API_AttachRolePolicy.html) | [Singular](https://github.com/hashicorp/terraform-provider-aws/blob/v5.7.0/internal/service/iam/role_policy_attachment.go#L160-L163) |
+| [aws_iam_user_policy_attachment](https://registry.terraform.io/providers/-/aws/latest/docs/resources/iam_user_policy_attachment) | One-to-many | [Singular](https://docs.aws.amazon.com/IAM/latest/APIReference/API_AttachUserPolicy.html) | [Singular](https://github.com/hashicorp/terraform-provider-aws/blob/v5.7.0/internal/service/iam/user_policy_attachment.go#L156-L159) |
+| [aws_internet_gateway_attachment](https://registry.terraform.io/providers/-/aws/latest/docs/resources/internet_gateway_attachment) | One-to-one| [Singular](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AttachInternetGateway.html) | [Singular](https://github.com/hashicorp/terraform-provider-aws/blob/v5.7.0/internal/service/ec2/vpc_internet_gateway.go#L190-L193) |
+| [aws_iot_policy_attachment](https://registry.terraform.io/providers/-/aws/latest/docs/resources/iot_policy_attachment) | One-to-many | [Singular](https://docs.aws.amazon.com/iot/latest/apireference/API_AttachPolicy.html) | [Singular](https://github.com/hashicorp/terraform-provider-aws/blob/v5.7.0/internal/service/iot/policy_attachment.go#L48-L51) |
+| [aws_iot_thing_principal_attachment](https://registry.terraform.io/providers/-/aws/latest/docs/resources/iot_thing_principal_attachment) | One-to-many | [Singular](https://docs.aws.amazon.com/iot/latest/apireference/API_AttachThingPrincipal.html) | [Singular](https://github.com/hashicorp/terraform-provider-aws/blob/v5.7.0/internal/service/iot/thing_principal_attachment.go#L49-L52) |
+| [aws_lb_target_group_attachment](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lb_target_group_attachment) | One-to-many | [Plural](https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_RegisterTargets.html) | [Singular](https://github.com/hashicorp/terraform-provider-aws/blob/v5.7.0/internal/service/elbv2/target_group_attachment.go#L76-L79) |
+| [aws_lightsail_disk_attachment](https://registry.terraform.io/providers/-/aws/latest/docs/resources/lightsail_disk_attachment) | One-to-many | [Singular](https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_AttachDisk.html)| [Singular](https://github.com/hashicorp/terraform-provider-aws/blob/v5.7.0/internal/service/lightsail/disk_attachment.go#L57-L61) |
+| [aws_lightsail_lb_attachment](https://registry.terraform.io/providers/-/aws/latest/docs/resources/lightsail_lb_attachment) | One-to-many | [Plural](https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_AttachInstancesToLoadBalancer.html) | [Singular](https://github.com/hashicorp/terraform-provider-aws/blob/v5.7.0/internal/service/lightsail/lb_attachment.go#L59-L62) |
+| [aws_lightsail_lb_certificate_attachment](https://registry.terraform.io/providers/-/aws/latest/docs/resources/lightsail_lb_certificate_attachment) | One-to-one| [Singular](https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_AttachLoadBalancerTlsCertificate.html)| [Singular](https://github.com/hashicorp/terraform-provider-aws/blob/v5.7.0/internal/service/lightsail/lb_certificate_attachment.go#L60-L63) |
+| [aws_lightsail_static_ip_attachment](https://registry.terraform.io/providers/-/aws/latest/docs/resources/lightsail_static_ip_attachment) | One-to-one| [Singular](https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_AttachStaticIp.html)| [Singular](https://github.com/hashicorp/terraform-provider-aws/blob/v5.7.0/internal/service/lightsail/static_ip_attachment.go#L50-L53) |
+| [aws_network_interface_attachment](https://registry.terraform.io/providers/-/aws/latest/docs/resources/network_interface_attachment) | One-to-many | [Singular](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AttachNetworkInterface.html)| [Singular](https://github.com/hashicorp/terraform-provider-aws/blob/v5.7.0/internal/service/ec2/vpc_network_interface.go#L1058-L1062) |
+| [aws_network_interface_sg_attachment](https://registry.terraform.io/providers/-/aws/latest/docs/resources/network_interface_sg_attachment) | One-to-many | [Plural](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyNetworkInterfaceAttribute.html) | [Singular](https://github.com/hashicorp/terraform-provider-aws/blob/v5.7.0/internal/service/ec2/vpc_network_interface_sg_attachment.go#L63-L82) |
+| [aws_networkmanager_connect_attachment](https://registry.terraform.io/providers/-/aws/latest/docs/resources/networkmanager_connect_attachment) | One-to-one| [Singular](https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_CreateConnectAttachment.html) | [Singular](https://github.com/hashicorp/terraform-provider-aws/blob/v5.7.0/internal/service/networkmanager/connect_attachment.go#L143-L149) |
+| [aws_networkmanager_core_network_policy_attachment](https://registry.terraform.io/providers/-/aws/latest/docs/resources/networkmanager_core_network_policy_attachment) | One-to-one| [Singular](https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_PutCoreNetworkPolicy.html)| [Singular](https://github.com/hashicorp/terraform-provider-aws/blob/v5.7.0/internal/service/networkmanager/core_network.go#L513-L545) |
+| [aws_networkmanager_site_to_site_vpn_attachment](https://registry.terraform.io/providers/-/aws/latest/docs/resources/networkmanager_site_to_site_vpn_attachment) | One-to-one| [Singular](https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_CreateSiteToSiteVpnAttachment.html) | [Singular](https://github.com/hashicorp/terraform-provider-aws/blob/v5.7.0/internal/service/networkmanager/site_to_site_vpn_attachment.go#L108-L112) |
+| [aws_networkmanager_transit_gateway_registration](https://registry.terraform.io/providers/-/aws/latest/docs/resources/networkmanager_transit_gateway_registration) | One-to-one| [Singular](https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_RegisterTransitGateway.html)| [Singular](https://github.com/hashicorp/terraform-provider-aws/blob/v5.7.0/internal/service/networkmanager/transit_gateway_registration.go#L63-L66) |
+| [aws_networkmanager_transit_gateway_route_table_attachment](https://registry.terraform.io/providers/-/aws/latest/docs/resources/networkmanager_transit_gateway_route_table_attachment) | One-to-one| [Singular](https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_CreateTransitGatewayRouteTableAttachment.html)| [Singular](https://github.com/hashicorp/terraform-provider-aws/blob/v5.7.0/internal/service/networkmanager/transit_gateway_route_table_attachment.go#L109-L113) |
+| [aws_networkmanager_vpc_attachment](https://registry.terraform.io/providers/-/aws/latest/docs/resources/networkmanager_vpc_attachment) | One-to-one| [Singular](https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_CreateVpcAttachment.html) | [Singular](https://github.com/hashicorp/terraform-provider-aws/blob/v5.7.0/internal/service/networkmanager/vpc_attachment.go#L133-L138) |
+| [aws_organizations_policy_attachment](https://registry.terraform.io/providers/-/aws/latest/docs/resources/organizations_policy_attachment) | One-to-many | [Singular](https://docs.aws.amazon.com/organizations/latest/APIReference/API_AttachPolicy.html) | [Singular](https://github.com/hashicorp/terraform-provider-aws/blob/v5.7.0/internal/service/organizations/policy_attachment.go#L61-L64) |
+| [aws_quicksight_iam_policy_assignment](https://registry.terraform.io/providers/-/aws/latest/docs/resources/quicksight_iam_policy_assignment) | One-to-many | [Plural](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_CreateIAMPolicyAssignment.html) | [Plural](https://github.com/hashicorp/terraform-provider-aws/blob/v5.7.0/internal/service/quicksight/iam_policy_assignment.go#L131-L145) |
+| [aws_security_group](https://registry.terraform.io/providers/-/aws/latest/docs/resources/security_group) (Egress)[^4] | One-to-many | [Plural](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AuthorizeSecurityGroupEgress.html)| [Plural](https://github.com/hashicorp/terraform-provider-aws/blob/v5.7.0/internal/service/ec2/vpc_security_group.go#L781-L784) |
+| [aws_security_group](https://registry.terraform.io/providers/-/aws/latest/docs/resources/security_group) (Ingress)[^4] | One-to-many | [Plural](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AuthorizeSecurityGroupIngress.html) | [Plural](https://github.com/hashicorp/terraform-provider-aws/blob/v5.7.0/internal/service/ec2/vpc_security_group.go#L788-L791k) |
+| [aws_security_group_rule](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule) (Egress)| One-to-many | [Plural](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AuthorizeSecurityGroupEgress.html)| [Singular](https://github.com/hashicorp/terraform-provider-aws/blob/v5.7.0/internal/service/ec2/vpc_security_group_rule.go#L189-L205) |
+| [aws_security_group_rule](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule) (Ingress) | One-to-many | [Plural](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AuthorizeSecurityGroupIngress.html) | [Singular](https://github.com/hashicorp/terraform-provider-aws/blob/v5.7.0/internal/service/ec2/vpc_security_group_rule.go#L172-L187) |
+| [aws_sesv2_dedicated_ip_assignment](https://registry.terraform.io/providers/-/aws/latest/docs/resources/sesv2_dedicated_ip_assignment) | One-to-one| [Singular](https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_PutDedicatedIpInPool.html)| [Singular](https://github.com/hashicorp/terraform-provider-aws/blob/v5.7.0/internal/service/sesv2/dedicated_ip_assignment.go#L66-L69) |
+| [aws_ssoadmin_account_assignment](https://registry.terraform.io/providers/-/aws/latest/docs/resources/ssoadmin_account_assignment) | One-to-one| [Singular](https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_CreateAccountAssignment.html) | [Singular](https://github.com/hashicorp/terraform-provider-aws/blob/v5.7.0/internal/service/ssoadmin/account_assignment.go#L106-L113) |
+| [aws_ssoadmin_customer_managed_policy_attachment](https://registry.terraform.io/providers/-/aws/latest/docs/resources/ssoadmin_customer_managed_policy_attachment) | One-to-many | [Singular](https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_AttachCustomerManagedPolicyReferenceToPermissionSet.html) | [Singular](https://github.com/hashicorp/terraform-provider-aws/blob/v5.7.0/internal/service/ssoadmin/customer_managed_policy_attachment.go#L90-L94) |
+| [aws_ssoadmin_managed_policy_attachment](https://registry.terraform.io/providers/-/aws/latest/docs/resources/ssoadmin_managed_policy_attachment) | One-to-many | [Singular](https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_AttachManagedPolicyToPermissionSet.html)| [Singular](https://github.com/hashicorp/terraform-provider-aws/blob/v5.7.0/internal/service/ssoadmin/managed_policy_attachment.go#L69-L73) |
+| [aws_ssoadmin_permissions_boundary_attachment](https://registry.terraform.io/providers/-/aws/latest/docs/resources/ssoadmin_permissions_boundary_attachment) | One-to-one| [Singular](https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_PutPermissionsBoundaryToPermissionSet.html) | [Singular](https://github.com/hashicorp/terraform-provider-aws/blob/v5.7.0/internal/service/ssoadmin/permissions_boundary_attachment.go#L105-L109) |
+| [aws_volume_attachment](https://registry.terraform.io/providers/-/aws/latest/docs/resources/volume_attachment) | One-to-many | [Singular](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AttachVolume.html)| [Singular](https://github.com/hashicorp/terraform-provider-aws/blob/v5.7.0/internal/service/ec2/ebs_volume_attachment.go#L106-L110) |
+| [aws_vpc_security_group_egress_rule](https://registry.terraform.io/providers/-/aws/latest/docs/resources/vpc_security_group_egress_rule) | One-to-many | [Plural](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AuthorizeSecurityGroupEgress.html)| [Singular](https://github.com/hashicorp/terraform-provider-aws/blob/v5.7.0/internal/service/ec2/vpc_security_group_egress_rule.go#L37-L40) |
+| [aws_vpc_security_group_ingress_rule](https://registry.terraform.io/providers/-/aws/latest/docs/resources/vpc_security_group_ingress_rule) | One-to-many | [Plural](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AuthorizeSecurityGroupIngress.html) | [Singular](https://github.com/hashicorp/terraform-provider-aws/blob/v5.7.0/internal/service/ec2/vpc_security_group_ingress_rule.go#L55-L58) |
+| [aws_vpclattice_target_group_attachment](https://registry.terraform.io/providers/-/aws/latest/docs/resources/vpclattice_target_group_attachment) | One-to-many | [Plural](https://docs.aws.amazon.com/vpc-lattice/latest/APIReference/API_RegisterTargets.html)| [Singular](https://github.com/hashicorp/terraform-provider-aws/blob/v5.7.0/internal/service/vpclattice/target_group_attachment.go#L81-L84) |
+| [aws_vpn_gateway_attachment](https://registry.terraform.io/providers/-/aws/latest/docs/resources/vpn_gateway_attachment) | One-to-one| [Singular](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AttachVpnGateway.html)| [Singular](https://github.com/hashicorp/terraform-provider-aws/blob/v5.7.0/internal/service/ec2/vpnsite_gateway_attachment.go#L48-L51) |
+
+[^1]: Due to the volume of resources with "rule" in the name (~70), only the prominent security group rule resources were included in the analysis above. While "rule" resources often follow the same relationship-style design, the ~40 examples above provided enough initial data to inform design standards.
+[^2]: Structure of this API precludes it from being implemented in a singular fashion.
+[^3]: Creates exclusive attachments.
+[^4]: Creates exclusive rules.
+
+Of the 44 resources documented above, 29 are of the "one-to-many" form and 17 have "plural" AWS APIs (ie. accepts a list of child resources to be attached to a single parent). Of these 17, 13 resources (76%) use a "singular" Terraform implementation, where a list with one item is sent to the Create/Read/Update API, rather than allowing a single resource to manage multiple relationships. Of the remaining 4 with "plural" Terraform implementations, 2 do so in order to exclusively manage child relationships (`aws_security_group` Ingress/Egress variants), and one requires a "plural" implementation simply because of API limitations.
+
+These metrics indicate a strong historical preference for representing a single API object over aligning the schema to the underlying AWS API. The primary exceptions to this are when exclusive management of all child resources is desired, such as [security group ingress/egress rules](https://registry.terraform.io/providers/-/aws/latest/docs/resources/security_group), or [IAM policy attachments](https://registry.terraform.io/providers/-/aws/latest/docs/resources/iam_policy_attachment).
+
+## Proposal
+
+The best practice for net-new "one-to-many" relationship resources should be to implement singular versions. Feature requests related to changing the singular nature of an existing relationship resource should be avoided unless necessary for the underlying API to function properly.
+
+Variation from this pattern should only be done when:
+
+1. There is a valid use case for a single resource to retain exclusive management of all parent/child relationships.
+2. Manipulating the underlying AWS APIs to work with singular relationships is not possible or introduces unnecessary complexity.
+
+### "One-to-many" Design Example
+
+Given a fictional "plural" API `AttachChildren` with a request body like:
+
+```
+{
+  "ParentId": "string",
+  "Children": [
+    {
+      "ChildId: "string"
+    }
+  ]
+}
+```
+
+The corresponding Terraform resource would only represent a single parent/child relationship with a configuration like:
+
+```terraform
+resource "aws_parent" "example" {
+  name = "foo"
+}
+
+resource "aws_child" "example" {
+  name = "bar"
+}
+
+resource "aws_child_attachment" "example" {
+  parent_id = aws_parent.example.id
+  child_id  = aws_child.example.id
+}
+```
+
+## References
+
+* The following feature request and PR initiated the discussion for this analysis:
+    * [https://github.com/hashicorp/terraform-provider-aws/issues/9901](https://github.com/hashicorp/terraform-provider-aws/issues/9901)
+    * [https://github.com/hashicorp/terraform-provider-aws/pull/32380](https://github.com/hashicorp/terraform-provider-aws/pull/32380)
diff --git a/docs/development-environment.md b/docs/development-environment.md
index ff127d3f8ec..ec275d08137 100644
--- a/docs/development-environment.md
+++ b/docs/development-environment.md
@@ -3,56 +3,66 @@
 ## Requirements
 
 - [Terraform](https://www.terraform.io/downloads.html) 0.12.26+ (to run acceptance tests)
-- [Go](https://golang.org/doc/install) 1.19.3+ (to build the provider plugin)
+- [Go](https://golang.org/doc/install) 1.20+ (to build the provider plugin)
 
 ## Quick Start
 
 If you wish to work on the provider, you'll first need [Go](http://www.golang.org) installed on your machine (please check the [requirements](#requirements) before proceeding).
 
-*Note:* This project uses [Go Modules](https://blog.golang.org/using-go-modules) making it safe to work with it outside of your existing [GOPATH](http://golang.org/doc/code.html#GOPATH). The instructions that follow assume a directory in your home directory outside of the standard GOPATH (i.e `$HOME/development/hashicorp/`).
+!!! note
+    This project uses [Go Modules](https://blog.golang.org/using-go-modules) making it safe to work with it outside of your existing [GOPATH](http://golang.org/doc/code.html#GOPATH). The instructions that follow assume a directory in your home directory outside of the standard GOPATH (i.e `$HOME/development/hashicorp/`).
 
-Clone repository to: `$HOME/development/hashicorp/`
+Begin by creating a new development directory and cloning the repository.
 
 ```console
-$ mkdir -p $HOME/development/hashicorp/; cd $HOME/development/hashicorp/
-$ git clone git@github.com:hashicorp/terraform-provider-aws
-...
+mkdir -p $HOME/development/hashicorp/; cd $HOME/development/hashicorp/
 ```
 
-Enter the provider directory and run `make tools`. This will install the needed tools for the provider.
+```console
+ git clone git@github.com:hashicorp/terraform-provider-aws
+```
+
+Enter the provider directory and run `make tools`. This will install the tools for provider development.
+
+```console
+make tools
+```
+
+### Building the Provider
+
+To compile the provider, run `make build`.
 
 ```console
-$ make tools
+make build
 ```
 
-To compile the provider, run `make build`. This will build the provider and put the provider binary in the `$GOPATH/bin` directory.
+This will build the provider and put the provider binary in the `$GOPATH/bin` directory.
 
 ```console
-$ make build
-...
-$ $GOPATH/bin/terraform-provider-aws
-...
+ls -la ./$GOPATH/bin/terraform-provider-aws
 ```
 
-## Testing the Provider
+### Testing the Provider
 
 In order to test the provider, you can run `make test`.
 
-*Note:* Make sure no `AWS_ACCESS_KEY_ID` or `AWS_SECRET_ACCESS_KEY` variables are set, and there's no `[default]` section in the AWS credentials file `~/.aws/credentials`.
+!!! tip
+    Make sure no `AWS_ACCESS_KEY_ID` or `AWS_SECRET_ACCESS_KEY` variables are set, and there's no `[default]` section in the AWS credentials file `~/.aws/credentials`.
 
 ```console
-$ make test
+make test
 ```
 
-In order to run the full suite of Acceptance tests, run `make testacc`.
+In order to run the full suite of acceptance tests, run `make testacc`.
 
-*Note:* Acceptance tests create real resources, and often cost money to run. Please read [Running and Writing Acceptance Tests](running-and-writing-acceptance-tests.md) in the contribution guidelines for more information on usage.
+!!! warning
+    Acceptance tests create real resources, and often cost money to run. Please read [Running and Writing Acceptance Tests](running-and-writing-acceptance-tests.md) before running these tests.
 
 ```console
-$ make testacc
+make testacc
 ```
 
-## Using the Provider
+### Using the Provider
 
 With Terraform v0.14 and later, [development overrides for provider developers](https://www.terraform.io/cli/config/config-file#development-overrides-for-provider-developers) can be leveraged in order to use the provider built from source.
 
diff --git a/docs/error-handling.md b/docs/error-handling.md
index 58f2b99e96d..63ee97a0887 100644
--- a/docs/error-handling.md
+++ b/docs/error-handling.md
@@ -1,8 +1,13 @@
+<!-- markdownlint-configure-file { "code-block-style": false } -->
 # Error Handling
 
-The Terraform AWS Provider codebase bridges the implementation of a [Terraform Plugin](https://www.terraform.io/plugin/how-terraform-works) and an AWS API client to support AWS operations and data types as Terraform Resources. An important aspect of performing resource and remote actions is properly handling those operations, but those operations are not guaranteed to succeed every time. Some common examples include where network connections are unreliable, necessary permissions are not properly setup, incorrect Terraform configurations, or the remote system responds unexpectedly. All these situations lead to an unexpected workflow action that must be surfaced to the Terraform user interface for operators to troubleshoot. This guide is intended to explain and show various Terraform AWS Provider code implementations that are considered best practice for surfacing these issues properly to operators and code maintainers.
+The Terraform AWS Provider codebase bridges the implementation of a [Terraform Plugin](https://www.terraform.io/plugin/how-terraform-works) and an AWS API client to support AWS operations as Terraform Resources.
+An important aspect of performing remote actions is properly handling operations which are not guaranteed to succeed.
+Some common examples include unstable network connections, missing permissions, incorrect Terraform configurations, or unexpected responses from the remote system.
+All of these situations lead to an unexpected workflow action that must be surfaced to Terraform for operators to troubleshoot.
+This guide is intended to document best practices for surfacing these issues properly.
 
-For further details about how the AWS SDK for Go v1 and the Terraform AWS Provider resource logic handle retryable errors, see the [Retries and Waiters documentation](retries-and-waiters.md).
+For further details about how the AWS SDK for Go and the Terraform AWS Provider handle retryable errors, see the [Retries and Waiters documentation](retries-and-waiters.md).
 
 ## General Guidelines and Helpers
 
@@ -32,7 +37,8 @@ This is in preference of some other styles of error checking, such as `switch` c
 
 ### Wrap Errors
 
-Go implements error wrapping, which means that a deeply nested function call can return a particular error type, while each function up the stack can provide additional error message context without losing the ability to determine the original error. Additional information about this concept can be found on the [Go blog entry titled Working with Errors in Go 1.13](https://blog.golang.org/go1.13-errors).
+Go implements error wrapping, which means that a deeply nested function call can return a particular error type, while each function up the stack can provide additional error message context without losing the ability to determine the original error.
+Additional information about this concept can be found on the [Go blog entry titled Working with Errors in Go 1.13](https://blog.golang.org/go1.13-errors).
 
 For most use cases in this codebase, this means if code is receiving an error and needs to return it, it should implement [`fmt.Errorf()`](https://pkg.go.dev/fmt#Errorf) and the `%w` verb, e.g.
 
@@ -40,47 +46,77 @@ For most use cases in this codebase, this means if code is receiving an error an
 return fmt.Errorf("adding some additional message: %w", err)
 ```
 
-This type of error wrapping should be applied to all Terraform resource logic. It should also be applied to any nested functions that contains two or more error conditions (e.g., a function that calls an update API and waits for the update to finish) so practitioners and code maintainers have a clear idea which generated the error. When returning errors in those situations, it is important to only include necessary additional context. Resource logic will typically include the information such as the type of operation and resource identifier (e.g., `updating Service Thing (%s): %w`), so these messages can be more terse such as `waiting for completion: %w`.
+This type of error wrapping should be applied to all Terraform resource logic where errors (not diagnostics) are returned.
 
-### AWS SDK for Go v1 Errors
+### AWS SDK for Go Errors
 
-The [AWS SDK for Go v1 documentation](https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/welcome.html) includes a [section on handling errors](https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/handling-errors.html), which is recommended reading.
+V1 and V2 of the AWS SDK for Go approach errors differently.
+Most notably, V2 makes use of more modern techniques like error wrapping that v1 does not.
+The [Errors Types](https://aws.github.io/aws-sdk-go-v2/docs/migrating/#errors-types) section in the migration guide provides additional context on these differences.
 
-For the purposes of this documentation, the most important concepts with handling these errors are:
+The sections below contain documentation for both SDKs. See [AWS Go SDK Versions](aws-go-sdk-versions.md) for direction on which to use.
 
-- Each response error (which eventually implements `awserr.Error`) has a `string` error code (`Code`) and `string` error message (`Message`). When printed as a string, they format as: `Code: Message`, e.g., `InvalidParameterValueException: IAM Role arn:aws:iam::123456789012:role/XXX cannot be assumed by AWS Backup`.
-- Error handling is almost exclusively done via those `string` fields and not other response information, such as HTTP Status Codes.
-- When the error code is non-specific, the error message should also be checked. Unfortunately, AWS APIs generally do not provide documentation or API modeling with the contents of these messages and often the Terraform AWS Provider code must rely on substring matching.
-- Not all errors are returned in the response error from an AWS API operation. This is service- and sometimes API-call-specific. For example, the [EC2 `DeleteVpcEndpoints` API call](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteVpcEndpoints.html) can return a "successful" response (in terms of no response error) but include information in an `Unsuccessful` field in the response body.
+=== "AWS Go SDK V2 (Preferred)"
+    The [AWS SDK for Go v2 documentation](https://aws.github.io/aws-sdk-go-v2/docs/) includes a [section on handling errors](https://aws.github.io/aws-sdk-go-v2/docs/handling-errors/), which is recommended reading.
 
-When working with AWS SDK for Go v1 errors, it is preferred to use the helpers outlined below and use the `%w` format verb. Code should generally avoid type assertions with the underlying `awserr.Error` type or calling its `Code()`, `Error()`, `Message()`, or `String()` receiver methods. Using the `%v`, `%#v`, or `%+v` format verbs generally provides extraneous information that is not helpful to operators or code maintainers.
+    For the purposes of this documentation, the most important concepts with handling these errors are:
+
+    - The SDK wraps all errors returned by service clients with the [`smithy.OperationError`](https://pkg.go.dev/github.com/aws/smithy-go/#OperationError) type.
+    - [`errors.As`](https://golang.org/pkg/errors#As) should be used to unwrap errors when inspecting for a specific error type (e.g, a `BucketAlreadyExists` error from the S3 API).
+
+=== "AWS Go SDK V1"
+    The [AWS SDK for Go v1 documentation](https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/welcome.html) includes a [section on handling errors](https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/handling-errors.html), which is recommended reading.
+
+    For the purposes of this documentation, the most important concepts with handling these errors are:
+
+    - Each response error (which eventually implements `awserr.Error`) has a `string` error code (`Code`) and `string` error message (`Message`). When printed as a string, they format as: `Code: Message`, e.g., `InvalidParameterValueException: IAM Role arn:aws:iam::123456789012:role/XXX cannot be assumed by AWS Backup`.
+    - Error handling is almost exclusively done via those `string` fields and not other response information, such as HTTP Status Codes.
+    - When the error code is non-specific, the error message should also be checked. Unfortunately, AWS APIs generally do not provide documentation or API modeling with the contents of these messages and often the Terraform AWS Provider code must rely on substring matching.
+    - Not all errors are returned in the response error from an AWS API operation. This is service- and sometimes API-call-specific. For example, the [EC2 `DeleteVpcEndpoints` API call](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteVpcEndpoints.html) can return a "successful" response (in terms of no response error) but include information in an `Unsuccessful` field in the response body.
+
+    When working with AWS SDK for Go v1 errors, it is preferred to use the helpers outlined below and use the `%w` format verb. Code should generally avoid type assertions with the underlying `awserr.Error` type or calling its `Code()`, `Error()`, `Message()`, or `String()` receiver methods. Using the `%v`, `%#v`, or `%+v` format verbs generally provides extraneous information that is not helpful to operators or code maintainers.
 
 #### AWS SDK for Go Error Helpers
 
-To simplify operations with AWS SDK for Go error types, the following helpers are available via the `github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr` Go package:
+=== "AWS Go SDK V2 (Preferred)"
+    To simplify operations with AWS SDK for Go error types, the following helpers are available via the `github.com/hashicorp/aws-sdk-go-base/v2/tfawserr` Go package:
+
+    - `tfawserr.ErrCodeEquals` - Preferred when the error code is specific enough for the check condition. For example, a `ResourceNotFoundError` code provides enough information that the requested resource does not exist.
+    - `tfawserr.ErrMessageContains`: Preferred when an error code can cover multiple failure modes, and additional parsing of the error message is required to determine if it matches a specific condition.
 
-- `tfawserr.ErrCodeEquals(err, "Code")`: Preferred when the error code is specific enough for the check condition. For example, a `ResourceNotFoundError` code provides enough information that the requested API resource identifier/Amazon Resource Name does not exist.
-- `tfawserr.ErrMessageContains(err, "Code", "MessageContains")`: Does simple substring matching for the error message.
+=== "AWS Go SDK V1"
+    To simplify operations with AWS SDK for Go error types, the following helpers are available via the `github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr` Go package:
 
-The recommendation for error message checking is to be just specific enough to capture the anticipated issue, but not include _too_ much matching as the AWS API can change over time without notice. The maintainers have observed changes in wording and capitalization cause unexpected issues in the past.
+    - `tfawserr.ErrCodeEquals(err, "Code")`: Preferred when the error code is specific enough for the check condition. For example, a `ResourceNotFoundError` code provides enough information that the requested resource does not exist.
+    - `tfawserr.ErrMessageContains(err, "Code", "MessageContains")`: Does simple substring matching for the error message.
+
+The recommendation for error message checking is to be just specific enough to capture the anticipated issue, but not include _too_ much matching as the AWS API can change over time without notice.
+The maintainers have observed changes in wording and capitalization cause unexpected issues in the past.
 
 For example, given this error code and message:
 
-```sh
+```
 InvalidParameterValueException: IAM Role arn:aws:iam::123456789012:role/XXX cannot be assumed by AWS Backup
 ```
 
 An error check for this might be:
 
 ```go
-if tfawserr.ErrMessageContains(err, backup.ErrCodeInvalidParameterValueException, "cannot be assumed") { /* ... */ }
+if tfawserr.ErrMessageContains(err, backup.ErrCodeInvalidParameterValueException, "cannot be assumed") {
+    // Special handling here
+}
 ```
 
-The Amazon Resource Name in the error message will be different for every environment and does not add value to the check. The AWS Backup suffix is also extraneous and could change should the service ever rename.
+The Amazon Resource Name in the error message will be different for every environment and does not add value to the check.
+The AWS Backup suffix is also extraneous and could change should the service ever rename.
+
+#### AWS SDK for Go Error Constants
 
-#### Use AWS SDK for Go v1 Error Code Constants
+=== "AWS Go SDK V2 (Preferred)"
+    Each AWS SDK for Go v2 service API typically implements common error codes, which get exported as public structs in the SDK. In the [AWS SDK for Go v2 API Reference](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2), these can be found in each of the service packages `types` subpackage (typically named `{ErrorType}Exception`).
 
-Each AWS SDK for Go v1 service API typically implements common error codes, which get exported as public constants in the SDK. In the [AWS SDK for Go v1 API Reference](https://docs.aws.amazon.com/sdk-for-go/api/), these can be found in each of the service packages under the `Constants` section (typically named `ErrCode{ExceptionName}`).
+=== "AWS Go SDK V1"
+    Each AWS SDK for Go v1 service API typically implements common error codes, which get exported as public constants in the SDK. In the [AWS SDK for Go v1 API Reference](https://docs.aws.amazon.com/sdk-for-go/api/), these can be found in each of the service packages under the `Constants` section (typically named `ErrCode{ExceptionName}`).
 
 If an AWS SDK for Go service API is missing an error code constant, an AWS Support case should be submitted and a new constant can be added to `internal/service/{SERVICE}/errors.go` file (created if not present), e.g.
 
@@ -100,40 +136,107 @@ tf{SERVICE} "github.com/hashicorp/terraform-provider-aws/internal/service/{SERVI
 tfawserr.ErrCodeEquals(err, tf{SERVICE}.ErrCodeInvalidParameterException)
 ```
 
-e.g.
-
-```go
-// imports
-tfec2 "github.com/hashicorp/terraform-provider-aws/internal/service/ec2"
-
-// logic
-tfawserr.ErrCodeEquals(err, tfec2.ErrCodeInvalidParameterException)
-```
-
-### Terraform Plugin SDK Types and Helpers
+### Terraform Plugin Types and Helpers
 
 The Terraform Plugin SDK includes some error types which are used in certain operations and typically preferred over implementing new types:
 
 * [`retry.NotFoundError`](https://pkg.go.dev/github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry#NotFoundError)
-* [`retry.TimeoutError`](https://pkg.go.dev/github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry#TimeoutError):
-  Returned from [`retry.RetryContext()`](https://pkg.go.dev/github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry#RetryContext) and
-  [`(retry.StateChangeConf).WaitForStateContext()`](https://pkg.go.dev/github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry#StateChangeConf.WaitForStateContext)
+* [`retry.TimeoutError`](https://pkg.go.dev/github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry#TimeoutError)
+    * Returned from [`retry.RetryContext()`](https://pkg.go.dev/github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry#RetryContext) and
+    [`(retry.StateChangeConf).WaitForStateContext()`](https://pkg.go.dev/github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry#StateChangeConf.WaitForStateContext)
 
-The Terraform AWS Provider codebase implements some additional helpers for working with these in the `github.com/hashicorp/terraform-provider-aws/internal/tfresource` package:
+!!! note
+    While these helpers currently reside in the Terraform Plugin SDK V2 package, they can be used with Plugin Framework based resources. In the future these functions will likely be migrated into the provider itself, or a standalone library as there is no direct dependency on Plugin SDK functionality.
+
+The Terraform AWS Provider codebase implements some additional helpers for working with these in the `internal/tfresource` package:
 
 - `tfresource.NotFound(err)`: Returns true if the error is a `retry.NotFoundError`.
 - `tfresource.TimedOut(err)`: Returns true if the error is a `retry.TimeoutError` and contains no `LastError`. This typically signifies that the retry logic was never signaled for a retry, which can happen when AWS API operations are automatically retrying before returning.
 
 ## Resource Lifecycle Guidelines
 
-Terraform CLI and the Terraform Plugin SDK have certain expectations and automatic behaviors depending on the lifecycle operation of a resource. This section highlights some common issues that can occur and their expected resolution.
+Terraform CLI and the Terraform Plugin libraries have certain expectations and automatic behaviors depending on the lifecycle operation of a resource.
+This section highlights some common issues that can occur and their expected resolution.
 
 ### Resource Creation
 
-Invoked in the resource via the `schema.Resource` type `Create`/`CreateWithoutTimeout` function.
+For Terraform Plugin Framework based resources, creation is implemented on the `Create` method of the resource struct.
+For Terraform Plugin SDK V2 based resources, creation is implemented on the `CreateWithoutTimeout` function of the resource schema definition.
+
+#### Creation Error Message Context
+
+=== "Terraform Plugin Framework (Preferred)"
+    Errors enountered during creation should include additional messaging about the location or cause of the error for operators and code maintainers.
+    Plugin Framework based resources will append error [diagnostics](https://developer.hashicorp.com/terraform/plugin/framework/diagnostics) to the `resource.CreateResponse` `Diagnostics` field.
+    The `create.ProblemStandardMessage` helper function can be used for constructing the appropriate context to accompany the error.
+
+    ```go
+    if err != nil {
+        resp.Diagnostics.AddError(
+            create.ProblemStandardMessage(names.{{ .Service }}, create.ErrActionCreating, ResName{{ .Resource }}, plan.Name.String(), err),
+            err.Error(),
+        )
+        return
+    }
+    ```
+
+    e.g.
+
+    ```go
+    if err != nil {
+        resp.Diagnostics.AddError(
+            create.ProblemStandardMessage(names.QuickSight, create.ErrActionCreating, ResNameVPCConnection, plan.Name.String(), err),
+            err.Error(),
+        )
+        return
+    }
+    ```
+
+    Resources that use other operations that return errors (e.g. waiters) should follow a similar pattern, including the resource identifier since it has typically been set before this execution:
+
+    ```go
+    createTimeout := r.CreateTimeout(ctx, plan.Timeouts)
+    waitOut, err := waitVPCConnectionCreated(ctx, conn, plan.ID.ValueString(), createTimeout)
+    if err != nil {
+        resp.Diagnostics.AddError(
+            create.ProblemStandardMessage(names.QuickSight, create.ErrActionWaitingForCreation, ResNameVPCConnection, plan.ID.String(), err),
+            err.Error(),
+        )
+        return
+    }
+    ```
+
+=== "Terraform Plugin SDK V2"
+    Errors enountered during creation should include additional messaging about the location or cause of the error for operators and code maintainers.
+    The `create.DiagError` helper function can be used to convert a native error into a [diagnostic](https://developer.hashicorp.com/terraform/plugin/framework/diagnostics), which is the method for surfacing warnings and errors in Terraform providers.
+
+    ```go
+    if err != nil {
+        return append(diags, create.DiagError(names.{{ .Service }}, create.ErrActionCreating, ResName{{ .Resource }}, d.Get("name").(string), err)...)
+    }
+    ```
+
+    e.g.
+
+    ```go
+    if err != nil {
+        return append(diags, create.DiagError(names.IVS, create.ErrActionCreating, ResNameRecordingConfiguration, d.Id(), err)...)
+    }
+    ```
+
+    Resources that use other operations that return errors (e.g. waiters) should follow a similar pattern, including the resource identifier since it has typically been set before this execution:
+
+    ```go
+    if _, err := waitRecordingConfigurationCreated(ctx, conn, d.Id(), d.Timeout(schema.TimeoutCreate)); err != nil {
+        return append(diags, create.DiagError(names.IVS, create.ErrActionWaitingForCreation, ResNameRecordingConfiguration, d.Id(), err)...)
+    }
+    ```
 
 #### d.IsNewResource() Checks
 
+!!! note
+    This type of check only applies to Plugin SDK V2 based resources. Plugin Framework based resources rely solely on [retries and waiters](retries-and-waiters.md) to handle eventually consistent resources.
+
 During resource creation, Terraform CLI expects either a properly applied state for the new resource or an error. To signal proper resource existence, the Terraform Plugin SDK uses an underlying resource identifier (set via `d.SetId(/* some value */)`). If for some reason the resource creation is returned without an error, but also without the resource identifier being set, Terraform CLI will return an error such as:
 
 ```sh
@@ -147,7 +250,7 @@ This is a bug in the provider, which should be reported in the provider's own
 issue tracker.
 ```
 
-A typical pattern in resource implementations in the `Create`/`CreateWithoutTimeout` function is to `return` the `Read`/`ReadWithoutTimeout` function at the end to fill in the Terraform State for all attributes. Another typical pattern in resource implementations in the `Read`/`ReadWithoutTimeout` function is to remove the resource from the Terraform State if the remote system returns an error or status that indicates the remote resource no longer exists by explicitly calling `d.SetId("")` and returning no error. If the remote system is not strongly read-after-write consistent (eventually consistent), this means the resource creation can return no error and also return no resource state.
+A typical pattern in resource implementations in the `CreateWithoutTimeout` function is to `return` the `ReadWithoutTimeout` function at the end to fill in the Terraform State for all attributes. Another typical pattern in resource implementations in the `ReadWithoutTimeout` function is to remove the resource from the Terraform State if the remote system returns an error or status that indicates the remote resource no longer exists by explicitly calling `d.SetId("")` and returning no error. If the remote system is not strongly read-after-write consistent (eventually consistent), this means the resource creation can return no error and also return no resource state.
 
 To prevent this type of Terraform CLI error, the resource implementation should also check against `d.IsNewResource()` before removing from the Terraform State and returning no error. If that check is `true`, then remote operation error (or one synthesized from the non-existent status) should be returned instead. While adding this check will not fix the resource implementation to handle the eventually consistent nature of the remote system, the error being returned will be less opaque for operators and code maintainers to troubleshoot.
 
@@ -172,176 +275,294 @@ func resourceServiceThingRead(d *schema.ResourceData, meta interface{}) error {
     }
 
     if err != nil {
-        return fmt.Errorf("reading {Service} {Thing} (%s): %w", d.Id(), err)
+        return append(diags, create.DiagError(names.{{ .Service }}, create.ErrActionReading, ResName{{ .Resource }}, d.Id(), err)...)
     }
 
     /* ... */
 }
 ```
 
-If the remote system is not strongly read-after-write consistent, see the [Retries and Waiters documentation on Resource Lifecycle Retries](retries-and-waiters.md#resource-lifecycle-retries) for how to prevent consistency-type errors.
+If the remote system is eventually consistent, see the [Retries and Waiters documentation on Resource Lifecycle Retries](retries-and-waiters.md#resource-lifecycle-retries) for how to prevent consistency-type errors.
 
-#### Creation Error Message Context
+### Resource Read
 
-Returning errors during creation should include additional messaging about the location or cause of the error for operators and code maintainers by wrapping with [`fmt.Errorf()`](https://pkg.go.dev/fmt#Errorf):
+For Terraform Plugin Framework based resources, read is implemented on the `Read` method of the resource struct.
+For Terraform Plugin SDK V2 based resources, read is implemented on the `ReadWithoutTimeout` function of the resource schema definition.
 
-```go
-if err != nil {
-    return fmt.Errorf("creating {SERVICE} {THING}: %w", err)
-}
-```
+#### Read Error Message Context
+
+=== "Terraform Plugin Framework (Preferred)"
+    Errors enountered during read should include the resource identifier (for managed resources) and additional messaging about the location or cause of the error for operators and code maintainers.
+    Plugin Framework based resources will append error [diagnostics](https://developer.hashicorp.com/terraform/plugin/framework/diagnostics) to the `resource.ReadResponse` `Diagnostics` field.
+    The `create.ProblemStandardMessage` helper function can be used for constructing the appropriate context to accompany the error.
+
+    ```go
+    if err != nil {
+        resp.Diagnostics.AddError(
+            create.ProblemStandardMessage(names.{{ .Service }}, create.ErrActionReading, ResName{{ .Resource }}, state.ID.String(), err),
+            err.Error(),
+        )
+        return
+    }
+    ```
+
+    e.g.
+
+    ```go
+    if err != nil {
+        resp.Diagnostics.AddError(
+            create.ProblemStandardMessage(names.QuickSight, create.ErrActionReading, ResNameVPCConnection, state.ID.String(), err),
+            err.Error(),
+        )
+        return
+    }
+    ```
+
+=== "Terraform Plugin SDK V2"
+    Errors enountered during read should include the resource identifier (for managed resources) and additional messaging about the location or cause of the error for operators and code maintainers.
+    The `create.DiagError` helper function can be used to convert a native error into a [diagnostic](https://developer.hashicorp.com/terraform/plugin/framework/diagnostics), which is the method for surfacing warnings and errors in Terraform providers.
+
+    ```go
+    if err != nil {
+        return append(diags, create.DiagError(names.{{ .Service }}, create.ErrActionReading, ResName{{ .Resource }}, d.Id(), err)...)
+    }
+    ```
+
+    e.g.
+
+    ```go
+    if err != nil {
+        return append(diags, create.DiagError(names.IVS, create.ErrActionReading, ResNameRecordingConfiguration, d.Id(), err)...)
+    }
+    ```
+
+#### Singular Data Source Errors
 
-e.g.
+A data source which is expected to return Terraform State about a single remote resource is commonly referred to as a "singular" data source.
+Implementation-wise, it may use any available describe or list functionality from the remote system to retrieve the information.
+In addition to remote operation and data handling errors, errors should also be returned if:
+
+- Zero results are found.
+- Multiple results are found.
+
+For remote operations that are designed to return an error when the remote resource is not found, this error is typically just passed through similar to other remote operation errors.
+For remote operations that are designed to return a successful result whether there is zero, one, or multiple multiple results the error must be generated.
+
+For example in pseudo-code:
 
 ```go
+output, err := conn.ListServiceThings(input)
+
 if err != nil {
-    return fmt.Errorf("creating EC2 VPC: %w", err)
+    // Return error diagnostic wrapping remote error
 }
-```
 
-Code that also uses waiters or other operations that return errors should follow a similar pattern, including the resource identifier since it has typically been set before this execution:
+if output == nil || len(output.Results) == 0 {
+    // Return custom error diagnostic indicating empty results
+}
 
-```go
-if _, err := VpcAvailable(conn, d.Id()); err != nil {
-    return fmt.Errorf("waiting for EC2 VPC (%s) availability: %w", d.Id(), err)
+if len(output.Results) > 1 {
+    // Return custom error diagnostic indicating multiple results
 }
 ```
 
-### Resource Deletion
+#### Plural Data Source Errors
 
-Invoked in the resource via the `schema.Resource` type `Delete`/`DeleteWithoutTimeout` function.
+An emergent concept is a data source that returns multiple results, acting similar to listing functionality from the remote system.
+These types of data sources should return _not_ return errors if:
 
-#### Resource Already Deleted
+- Zero results are found.
+- Multiple results are found.
 
-A typical pattern for resource deletion is to immediately perform the remote system deletion operation without checking existence. This is generally acceptable as operators are encouraged to always refresh their Terraform State prior to performing changes. However in certain scenarios, such as external systems modifying the remote system prior to the Terraform execution, it is certainly still possible that the remote system will return an error signifying that remote resource does not exist. In these cases, resources should implement logic that catches the error and returns no error.
+Remote operation and other data handling errors should still be returned.
 
-_NOTE: The Terraform Plugin SDK automatically handles the equivalent of d.SetId("") on deletion, so it is not necessary to include it._
+### Resource Update
 
-For example in the Terraform AWS Provider:
+For Terraform Plugin Framework based resources, update is implemented on the `Update` method of the resource struct.
+For Terraform Plugin SDK V2 based resources, update is implemented on the `UpdateWithoutTimeout` function of the resource schema definition.
 
-```go
-func resourceServiceThingDelete(d *schema.ResourceData, meta interface{}) error {
-    /* ... */
-
-    output, err := conn.DeleteServiceThing(input)
+#### Update Error Message Context
 
-    if tfawserr.ErrCodeEquals(err, "ResourceNotFoundException") {
-        return nil
-    }
+=== "Terraform Plugin Framework (Preferred)"
+    Errors enountered during update should include the resource identifier and additional messaging about the location or cause of the error for operators and code maintainers.
+    Plugin Framework based resources will append error [diagnostics](https://developer.hashicorp.com/terraform/plugin/framework/diagnostics) to the `resource.UpdateResponse` `Diagnostics` field.
+    The `create.ProblemStandardMessage` helper function can be used for constructing the appropriate context to accompany the error.
 
+    ```go
     if err != nil {
-        return fmt.Errorf("deleting {Service} {Thing} (%s): %w", d.Id(), err)
+        resp.Diagnostics.AddError(
+            create.ProblemStandardMessage(names.{{ .Service }}, create.ErrActionUpdating, ResName{{ .Resource }}, plan.ID.String(), err),
+            err.Error(),
+        )
+        return
     }
+    ```
 
-    /* ... */
-}
-```
+    e.g.
 
-#### Deletion Error Message Context
+    ```go
+    if err != nil {
+        resp.Diagnostics.AddError(
+            create.ProblemStandardMessage(names.QuickSight, create.ErrActionUpdating, ResNameVPCConnection, plan.ID.String(), err),
+            err.Error(),
+        )
+        return
+    }
+    ```
 
-Returning errors during deletion should include the resource identifier and additional messaging about the location or cause of the error for operators and code maintainers by wrapping with [`fmt.Errorf()`](https://pkg.go.dev/fmt#Errorf):
+    Resources that use other operations that return errors (e.g. waiters) should follow a similar pattern:
 
-```go
-if err != nil {
-    return fmt.Errorf("deleting {SERVICE} {THING} (%s): %w", d.Id(), err)
-}
-```
+    ```go
+    updateTimeout := r.UpdateTimeout(ctx, plan.Timeouts)
+    waitOut, err := waitVPCConnectionUpdated(ctx, conn, plan.ID.ValueString(), updateTimeout)
+    if err != nil {
+        resp.Diagnostics.AddError(
+            create.ProblemStandardMessage(names.QuickSight, create.ErrActionWaitingForUpdate, ResNameVPCConnection, plan.ID.String(), err),
+            err.Error(),
+        )
+        return
+    }
+    ```
 
-e.g.
+=== "Terraform Plugin SDK V2"
+    Errors enountered during update should include the resource identifier and additional messaging about the location or cause of the error for operators and code maintainers.
+    The `create.DiagError` helper function can be used to convert a native error into a [diagnostic](https://developer.hashicorp.com/terraform/plugin/framework/diagnostics), which is the method for surfacing warnings and errors in Terraform providers.
 
-```go
-if err != nil {
-    return fmt.Errorf("deleting EC2 VPC (%s): %w", d.Id(), err)
-}
-```
+    ```go
+    if err != nil {
+        return append(diags, create.DiagError(names.{{ .Service }}, create.ErrActionUpdating, ResName{{ .Resource }}, d.Id(), err)...)
+    }
+    ```
 
-Code that also uses [waiters](retries-and-waiters.md) or other operations that return errors should follow a similar pattern:
+    e.g.
 
-```go
-if _, err := VpcDeleted(conn, d.Id()); err != nil {
-    return fmt.Errorf("waiting for EC2 VPC (%s) deletion: %w", d.Id(), err)
-}
-```
+    ```go
+    if err != nil {
+         return append(diags, create.DiagError(names.IVS, create.ErrActionUpdating, ResNameRecordingConfiguration, d.Id(), err)...)
+    }
+    ```
 
-### Resource Read
+    Resources that use other operations that return errors (e.g. waiters) should follow a similar pattern:
 
-Invoked in the resource via the `schema.Resource` type `Read`/`ReadWithoutTimeout` function.
+    ```go
+    if _, err := waitRecordingConfigurationUpdated(ctx, conn, d.Id(), d.Timeout(schema.TimeoutUpdate)); err != nil {
+         return append(diags, create.DiagError(names.IVS, create.ErrActionWaitingForUpdate, ResNameRecordingConfiguration, d.Id(), err)...)
+    }
+    ```
 
-#### Singular Data Source Errors
+### Resource Deletion
 
-A data source which is expected to return Terraform State about a single remote resource is commonly referred to as a "singular" data source. Implementation-wise, it may use any available describe or listing functionality from the remote system to retrieve the information. In addition to any remote operation and other data handling errors that should be returned, these two additional cases should be covered:
+For Terraform Plugin Framework based resources, deletion is implemented on the `Delete` method of the resource struct.
+For Terraform Plugin SDK V2 based resources, deletion is implemented on the `DeleteWithoutTimeout` function of the resource schema definition.
 
-- Returning an error when zero results are found.
-- Returning an error when multiple results are found.
+#### Deletion Error Message Context
 
-For remote operations that are designed to return an error when the remote resource is not found, this error is typically just passed through similar to other remote operation errors. For remote operations that are designed to return a successful result whether there is zero, one, or multiple multiple results the error must be generated.
+=== "Terraform Plugin Framework (Preferred)"
+    Errors enountered during deletion should include the resource identifier and additional messaging about the location or cause of the error for operators and code maintainers.
+    Plugin Framework based resources will append error [diagnostics](https://developer.hashicorp.com/terraform/plugin/framework/diagnostics) to the `resource.DeleteResponse` `Diagnostics` field.
+    The `create.ProblemStandardMessage` helper function can be used for constructing the appropriate context to accompany the error.
 
-For example in pseudo-code:
+    ```go
+    if err != nil {
+        resp.Diagnostics.AddError(
+            create.ProblemStandardMessage(names.{{ .Service }}, create.ErrActionDeleting, ResName{{ .Resource }}, state.ID.String(), err),
+            err.Error(),
+        )
+        return
+    }
+    ```
 
-```go
-output, err := conn.ListServiceThings(input)
+    e.g.
 
-if err != nil {
-    return fmt.Errorf("listing {Service} {Thing}s: %w", err)
-}
+    ```go
+    if err != nil {
+        resp.Diagnostics.AddError(
+            create.ProblemStandardMessage(names.QuickSight, create.ErrActionDeleting, ResNameVPCConnection, state.ID.String(), err),
+            err.Error(),
+        )
+        return
+    }
+    ```
 
-if output == nil || len(output.Results) == 0 {
-    return fmt.Errorf("no {Service} {Thing} found matching criteria; try different search")
-}
+    Resources that use other operations that return errors (e.g. waiters) should follow a similar pattern:
 
-if len(output.Results) > 1 {
-    return fmt.Errorf("multiple {Service} {Thing} found matching criteria; try different search")
-}
-```
+    ```go
+    deleteTimeout := r.DeleteTimeout(ctx, plan.Timeouts)
+    waitOut, err := waitVPCConnectionDeleted(ctx, conn, state.ID.ValueString(), deleteTimeout)
+    if err != nil {
+        resp.Diagnostics.AddError(
+            create.ProblemStandardMessage(names.QuickSight, create.ErrActionWaitingForDeletion, ResNameVPCConnection, state.ID.String(), err),
+            err.Error(),
+        )
+        return
+    }
+    ```
 
-#### Plural Data Source Errors
+=== "Terraform Plugin SDK V2"
+    Errors enountered during deletion should include the resource identifier and additional messaging about the location or cause of the error for operators and code maintainers.
+    The `create.DiagError` helper function can be used to convert a native error into a [diagnostic](https://developer.hashicorp.com/terraform/plugin/framework/diagnostics), which is the method for surfacing warnings and errors in Terraform providers.
 
-An emergent concept is a data source that returns multiple results, acting similar to any available listing functionality available from the remote system. These types of data sources should return _no_ error if zero results are returned and _no_ error if multiple results are found. Remote operation and other data handling errors should still be returned.
+    ```go
+    if err != nil {
+        return append(diags, create.DiagError(names.{{ .Service }}, create.ErrActionDeleting, ResName{{ .Resource }}, d.Id(), err)...)
+    }
+    ```
 
-#### Read Error Message Context
+    e.g.
 
-Returning errors during read should include the resource identifier (for managed resources) and additional messaging about the location or cause of the error for operators and code maintainers by wrapping with [`fmt.Errorf()`](https://pkg.go.dev/fmt#Errorf):
+    ```go
+    if err != nil {
+        return append(diags, create.DiagError(names.IVS, create.ErrActionDeleting, ResNameRecordingConfiguration, d.Id(), err)...)
+    }
+    ```
 
-```go
-if err != nil {
-    return fmt.Errorf("reading {SERVICE} {THING} (%s): %w", d.Id(), err)
-}
-```
+    Resources that use other operations that return errors (e.g. waiters) should follow a similar pattern:
 
-e.g.
+    ```go
+    if _, err := waitRecordingConfigurationDeleted(ctx, conn, d.Id(), d.Timeout(schema.TimeoutDelete)); err != nil {
+        return append(diags, create.DiagError(names.IVS, create.ErrActionWaitingForDeletion, ResNameRecordingConfiguration, d.Id(), err)...)
+    }
+    ```
 
-```go
-if err != nil {
-    return fmt.Errorf("reading EC2 VPC (%s): %w", d.Id(), err)
-}
-```
+#### Resource Already Deleted
 
-### Resource Update
+A typical pattern for resource deletion is to immediately perform the remote system deletion operation without checking existence.
+This is generally acceptable as operators are encouraged to always refresh their Terraform State prior to performing changes.
+However, in certain scenarios, such as external systems modifying the remote system prior to the Terraform execution, it is still possible that the remote system will return an error signifying that the resource does not exist.
+In these cases, resources should implement logic that skips returning the error.
 
-Invoked in the resource via the `schema.Resource` type `Update`/`UpdateWithoutTimeout` function.
+=== "Terraform Plugin Framework (Preferred)"
+    !!! note
+        The Terraform Plugin Framework automatically handles the equivalent of `resp.State.RemoveResource()` on deletion, so it is not necessary to include it.
 
-#### Update Error Message Context
+    ```go
+    output, err := conn.DeleteServiceThing(input)
 
-Returning errors during update should include the resource identifier and additional messaging about the location or cause of the error for operators and code maintainers by wrapping with [`fmt.Errorf()`](https://pkg.go.dev/fmt#Errorf):
+    if tfawserr.ErrCodeEquals(err, "ResourceNotFoundException") {
+        return
+    }
 
-```go
-if err != nil {
-    return fmt.Errorf("updating {SERVICE} {THING} (%s): %w", d.Id(), err)
-}
-```
+    if err != nil {
+        resp.Diagnostics.AddError(
+            create.ProblemStandardMessage(names.{{ .Service }}, create.ErrActionDeleting, ResName{{ .Resource }}, state.ID.String(), err),
+            err.Error(),
+        )
+        return
+    }
+    ```
 
-e.g.
+=== "Terraform Plugin SDK V2"
+    !!! note
+        The Terraform Plugin SDK V2 automatically handles the equivalent of `d.SetId("")` on deletion, so it is not necessary to include it.
 
-```go
-if err != nil {
-    return fmt.Errorf("updating EC2 VPC (%s): %w", d.Id(), err)
-}
-```
+    ```go
+    output, err := conn.DeleteServiceThing(input)
 
-Code that also uses waiters or other operations that return errors should follow a similar pattern:
+    if tfawserr.ErrCodeEquals(err, "ResourceNotFoundException") {
+        return nil
+    }
 
-```go
-if _, err := VpcAvailable(conn, d.Id()); err != nil {
-    return fmt.Errorf("waiting for EC2 VPC (%s) update: %w", d.Id(), err)
-}
-```
+    if err != nil {
+        return append(diags, create.DiagError(names.{{ .Service }}, create.ErrActionDeleting, ResName{{ .Resource }}, d.Id(), err)...)
+    }
+    ```
diff --git a/docs/index.md b/docs/index.md
index 1650d880c2c..e3e19a43735 100644
--- a/docs/index.md
+++ b/docs/index.md
@@ -2,7 +2,8 @@
 
 The Terraform AWS Provider is the work of thousands of contributors, and is maintained by a small team within HashiCorp. This site contains extensive instructions about how to contribute and how the AWS provider works.
 
-_Please Note: This documentation is intended for Terraform AWS Provider code developers. Typical operators writing and applying Terraform configurations do not need to read or understand this material._
+!!! tip
+    This documentation is intended for Terraform AWS Provider code developers. Typical operators writing and applying Terraform configurations do not need to read or understand this material.
 
 ## Contribute
 
diff --git a/docs/issue-reporting-and-lifecycle.md b/docs/issue-reporting-and-lifecycle.md
index 049476db12c..7d0e8586067 100644
--- a/docs/issue-reporting-and-lifecycle.md
+++ b/docs/issue-reporting-and-lifecycle.md
@@ -49,7 +49,8 @@ We encourage opening new issues rather than commenting on closed issues if a pro
 
 ## Issue Lifecycle
 
-**Note:** For detailed information on how issues are prioritized, see the [prioritization guide](prioritization.md).
+!!! tip
+    For detailed information on how issues are prioritized, see the [prioritization guide](prioritization.md).
 
 1. The issue is reported.
 
diff --git a/docs/naming.md b/docs/naming.md
index e05c80b152c..fb33a6f793a 100644
--- a/docs/naming.md
+++ b/docs/naming.md
@@ -120,7 +120,8 @@ In general, follow Go best practices for good variable and constant naming.
 4. To improve readability, consider including the resource name in variable and constant names that pertain only to that resource. For example, for a string constant for a "Role" resource and a "not found" status, use `roleStatusNotFound` or `RoleStatusNotFound`, if used outside the service's package.
 5. Do not include "AWS" or "Aws" in the name.
 
-**NOTE:** Give priority to using constants from the AWS SDK for Go rather than defining new constants for the same values.
+!!! note
+    Give priority to constants from the AWS SDK for Go rather than defining new constants for the same values.
 
 ## Acceptance and Unit Tests
 
@@ -174,7 +175,8 @@ This rule is for functions defined in the _test_ context (i.e., in a file ending
 
 This rule is for functions defined in the _test_ context (i.e., in a file ending with `_test.go`) that return a string with Terraform configuration. For test support functions, see [Test Support Functions](#test-support-functions) above. Or, for non-test functions, see [Functions](#functions) above.
 
-**NOTE:** This rule is not widely used currently. However, new functions and functions you change should follow it.
+!!! note
+    This rule is not widely used currently. However, new functions and functions you change should follow it.
 
 ### Rule
 
diff --git a/docs/prioritization.md b/docs/prioritization.md
index c436b6a7ece..44653a7ad92 100644
--- a/docs/prioritization.md
+++ b/docs/prioritization.md
@@ -8,7 +8,7 @@ This document describes how we handle prioritization of work from a variety of i
 
 ### What this document is not
 
-Due to the variety of input sources, the scale of the provider, and resource constraints, it is impossible to give a hard number on how each of the factors outlined in this document are weighted. Instead, the goal of the document is to give a transparent, but generalized assessment of each of the sources of input so that the community has a better idea of why things are prioritized the way they are. Additional information may be found in the [FAQ](https://github.com/hashicorp/terraform-provider-aws/blob/main/docs/contributing/faq.md#how-do-you-decide-what-gets-merged-for-each-release).
+Due to the variety of input sources, the scale of the provider, and resource constraints, it is impossible to give a hard number on how each of the factors outlined in this document are weighted. Instead, the goal of the document is to give a transparent, but generalized assessment of each of the sources of input so that the community has a better idea of why things are prioritized the way they are. Additional information may be found in the [FAQ](faq.md#how-do-you-decide-what-gets-merged-for-each-release).
 
 ## Prioritization
 
diff --git a/docs/raising-a-pull-request.md b/docs/raising-a-pull-request.md
index ae09f23a9ff..ea62da2a5bb 100644
--- a/docs/raising-a-pull-request.md
+++ b/docs/raising-a-pull-request.md
@@ -15,13 +15,13 @@
 
 1. Make the changes you would like to include in the provider, add new tests as required, and make sure that all relevant existing tests are passing.
 
-1. Create a changelog entry following the process outlined [here](changelog-process.md)
-
 1. [Create a pull request](https://help.github.com/en/articles/creating-a-pull-request-from-a-fork). Please ensure (if possible)   the 'Allow edits from maintainers' checkbox is checked. This will allow the maintainers to make changes and merge the PR without requiring action from the contributor.
    You are welcome to submit your pull request for commentary or review before
    it is fully completed by creating a [draft pull request](https://help.github.com/en/articles/about-pull-requests#draft-pull-requests).
    Please include specific questions or items you'd like feedback on.
 
+1. Create a changelog entry following the process outlined [here](changelog-process.md)
+
 1. Once you believe your pull request is ready to be reviewed, ensure the
    pull request is not a draft pull request by [marking it ready for review](https://help.github.com/en/articles/changing-the-stage-of-a-pull-request)
    or removing `[WIP]` from the pull request title if necessary, and a
@@ -45,33 +45,32 @@
 All Go code is automatically checked for compliance with various linters, such as `gofmt`. These tools can be installed using the `GNUMakefile` in this repository.
 
 ```console
-$ cd terraform-provider-aws
-$ make tools
+make tools
 ```
 
 Check your code with the linters:
 
 ```console
-$ make lint
+make lint
 ```
 
 We use [Semgrep](https://semgrep.dev/docs/) to check for other code standards.
 This can be run directly on the command line, i.e.,
 
 ```console
-$ semgrep
+semgrep
 ```
 
 or it can be run using Docker via the Makefile, i.e.,
 
 ```console
-$ make semgrep
+make semgrep
 ```
 
 `gofmt` will also fix many simple formatting issues for you. The Makefile includes a target for this:
 
 ```console
-$ make fmt
+make fmt
 ```
 
 The import statement in a Go file follows these rules (see [#15903](https://github.com/hashicorp/terraform-provider-aws/issues/15903)):
@@ -86,7 +85,7 @@ The import statement in a Go file follows these rules (see [#15903](https://gith
 Check your imports:
 
 ```console
-$ make importlint
+make importlint
 ```
 
 For greater detail, the following Go language resources provide common coding preferences that may be referenced during review, if not automatically handled by the project's linting tools.
@@ -104,7 +103,7 @@ This Contribution Guide also includes separate sections on topics such as [Error
 - __Avoids API Calls Across Account, Region, and Service Boundaries__: Resources should not implement cross-account, cross-region, or cross-service API calls.
 - __Does Not Set Optional or Required for Non-Configurable Attributes__: Resource schema definitions for read-only attributes must not include `Optional: true` or `Required: true`.
 - __Avoids retry.RetryContext() without retry.RetryableError()__: Resource logic should only implement [`retry.Retry()`](https://godoc.org/github.com/hashicorp/terraform/helper/retry#Retry) if there is a retryable condition (e.g., `return retry.RetryableError(err)`).
-- __Avoids Reusing Resource Read Function in Data Source Read Function__: Data sources should fully implement their own resource `Read` functionality including duplicating `d.Set()` calls.
+- __Avoids Reusing Resource Read Function in Data Source Read Function__: Data sources should fully implement their own resource `Read` functionality.
 - __Avoids Reading Schema Structure in Resource Code__: The resource `Schema` should not be read in resource `Create`/`Read`/`Update`/`Delete` functions to perform looping or otherwise complex attribute logic. Use [`d.Get()`](https://godoc.org/github.com/hashicorp/terraform/helper/schema#ResourceData.Get) and [`d.Set()`](https://godoc.org/github.com/hashicorp/terraform/helper/schema#ResourceData.Set) directly with individual attributes instead.
 - __Avoids ResourceData.GetOkExists()__: Resource logic should avoid using [`ResourceData.GetOkExists()`](https://godoc.org/github.com/hashicorp/terraform/helper/schema#ResourceData.GetOkExists) as its expected functionality is not guaranteed in all scenarios.
 - __Calls Read After Create and Update__: Except where API eventual consistency prohibits immediate reading of resources or updated attributes,  resource `Create` and `Update` functions should return the resource `Read` function.
diff --git a/docs/regular-expressions.md b/docs/regular-expressions.md
new file mode 100644
index 00000000000..24b51d822a9
--- /dev/null
+++ b/docs/regular-expressions.md
@@ -0,0 +1,43 @@
+# Using Regular Expressions
+
+Regular expressions are a powerful tool. However, they are also very expensive in terms of memory. Ensuring correct and useful functionality is the priority but we have a few tips to minimize impact without affecting capabilities.
+
+* **Consider non-regular expressions options.** [`strings.Contains()`](https://pkg.go.dev/strings#Contains), [`strings.Replace()`](https://pkg.go.dev/strings#Replace), and [`strings.ReplaceAll()`](https://pkg.go.dev/strings#ReplaceAll) are dramatically faster and less memory intensive than regular expressions. If one of these will work equally well, use the non-regular expression option.
+* **Order character classes consistently.** We use regular expression caching to reduce our memory footprint. This is more effective if character classes are consistently ordered. Since a character class is a set, order does not affect functionality. We have many equivalent regular expressions that only differ by character class order. Below is the order we recommend for consistency:
+    1. Numeric range, _i.e._, digits (_e.g._, `0-9`)
+    1. Uppercase alphabetic range (_e.g._, `A-Z`, `A-F`)
+    1. Lowercase alphabetic range (_e.g._, `a-z`, `a-f`)
+    1. Underscore (`_`)
+    1. Everything else (except dash, `-`) in ASCII order: `\t\n\r !"#$%&()*+,./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^abcdefghijklmnopqrstuvwxyz{|}~`
+    1. _Last_, dash (`-`)
+
+        For example, consider the following expressions which are equivalent but vary character class ordering:
+
+        ```go
+        `[_a-zA-Z0-9-,.]` // wrong ordering
+        `[0-9A-Za-z_,.-]` // correct
+        ```
+
+        ```go
+        `[;a-z0-9]` // wrong ordering
+        `[0-9a-z;]` // correct
+        ```
+
+* **Inside character classes, avoid unnecessary character escaping.** Go does not complain about extra character escaping but avoid it to improve cache performance. Inside a character class, _most_ characters do not need to be escaped, as Go assumes you mean the literal character.
+    * These characters which normally have special meaning in regular expressions, _inside character classes_ do **not** need to be escaped: `$`, `(`, `)`, `*`, `+`, `.`, `?`, `^`, `{`, `|`, `}`.
+    * Dash (`-`), when it is last in the character class or otherwise unambiguously not part of a range, does not need to be escaped. If in doubt, place the dash _last_ in the character class (_e.g._, `[a-c-]`) or escape the dash (_e.g._, `\-`).
+    * Angle brackets (`[`, `]`) always need to be escaped in a character class.
+
+        For example, consider the following expressions which are equivalent but include unnecessary character escapes:
+
+        ```go
+        `[\$\(\.\?\|]` // unnecessary escapes
+        `[$(.?|]`      // correct
+        ```
+
+        ```go
+        `[a-z\-0-9_A-Z\.]` // unnecessary escapes, wrong order
+        `[0-9A-Za-z_.-]`   // correct
+        ```
+
+<!-- Add links to standard validators to use instead of custom -->
diff --git a/docs/resource-filtering.md b/docs/resource-filtering.md
index e6e2c5925af..0ba07923b7b 100644
--- a/docs/resource-filtering.md
+++ b/docs/resource-filtering.md
@@ -1,3 +1,4 @@
+<!-- markdownlint-configure-file { "code-block-style": false } -->
 # Adding Resource Filtering Support
 
 AWS provides server-side filtering across many services and resources, which can be used when listing resources of that type, for example in the implementation of a data source.
@@ -30,20 +31,21 @@ Add the AWS Go SDK service name (e.g., `rds`) to `sliceServiceNames` in `interna
 - In the resource schema, add `"filter": namevaluesfilters.Schema(),`
 - Implement the logic to build the list of filters:
 
-```go
-input := &ec2.DescribeInternetGatewaysInput{}
-
-// Filters based on attributes.
-filters := namevaluesfilters.New(map[string]string{
-	"internet-gateway-id": d.Get("internet_gateway_id").(string),
-})
-// Add filters based on keyvalue tags (N.B. Not applicable to all AWS services that support filtering)
-filters.Add(namevaluesfilters.EC2Tags(keyvaluetags.New(d.Get("tags").(map[string]interface{})).IgnoreAWS().IgnoreConfig(ignoreTagsConfig).Map()))
-// Add filters based on the custom filtering "filter" attribute.
-filters.Add(d.Get("filter").(*schema.Set))
-
-input.Filters = filters.EC2Filters()
-```
+=== "Terraform Plugin SDK V2"
+    ```go
+    input := &ec2.DescribeInternetGatewaysInput{}
+
+    // Filters based on attributes.
+    filters := namevaluesfilters.New(map[string]string{
+    	"internet-gateway-id": d.Get("internet_gateway_id").(string),
+    })
+    // Add filters based on keyvalue tags (N.B. Not applicable to all AWS services that support filtering)
+    filters.Add(namevaluesfilters.EC2Tags(keyvaluetags.New(d.Get("tags").(map[string]interface{})).IgnoreAWS().IgnoreConfig(ignoreTagsConfig).Map()))
+    // Add filters based on the custom filtering "filter" attribute.
+    filters.Add(d.Get("filter").(*schema.Set))
+
+    input.Filters = filters.EC2Filters()
+    ```
 
 ## Resource Filtering Documentation Implementation
 
diff --git a/docs/resource-name-generation.md b/docs/resource-name-generation.md
index 8dc10dd8b45..7cc0a262c13 100644
--- a/docs/resource-name-generation.md
+++ b/docs/resource-name-generation.md
@@ -1,54 +1,97 @@
+<!-- markdownlint-configure-file { "code-block-style": false } -->
 # Adding Resource Name Generation Support
 
 Terraform AWS Provider resources can use shared logic to support and test name generation, where the operator can choose between an expected naming value, a generated naming value with a prefix, or a fully generated name.
 
-Implementing name generation support for Terraform AWS Provider resources requires the following, each with its own section below:
+Implementing name generation requires modifying the following:
+
+- _Resource Code_: In the resource code, add a `name_prefix` attribute, along with handling in the `Create` function.
+- _Resource Acceptance Tests_: In the resource acceptance tests, add new acceptance test functions and configurations to exercise the naming logic.
+- _Resource Documentation_: In the resource documentation, add the `name_prefix` argument and update the `name` argument description.
+
+## Resource Code
+
+- In the resource file (e.g., `internal/service/{service}/{thing}.go`), add the following import: `"github.com/hashicorp/terraform-provider-aws/internal/create"`.
+- Inside the resource schema, add the new `name_prefix` attribute and adjust the `name` attribute to be `Optional`, `Computed`, and conflict with the `name_prefix` attribute. Be sure to keep any existing validation functions already present on `name`.
+
+=== "Terraform Plugin Framework (Preferred)"
+    ```go
+    "name": schema.StringAttribute{
+        Optional: true
+        Computed: true,
+        PlanModifiers: []planmodifier.String{
+            stringplanmodifier.UseStateForUnknown(),
+            stringplanmodifier.RequiresReplace(),
+        },
+        Validators: append(
+            stringvalidator.ExactlyOneOf(
+                path.MatchRelative().AtParent().AtName("name"),
+                path.MatchRelative().AtParent().AtName("name_prefix"),
+            ),
+        ),
+    },
+    "name_prefix": schema.StringAttribute{
+        Optional:   true,
+        Computed:   true,
+        PlanModifiers: []planmodifier.String{
+            stringplanmodifier.UseStateForUnknown(),
+            stringplanmodifier.RequiresReplace(),
+        },
+    },
+    ```
+
+=== "Terraform Plugin SDK V2"
+    ```go
+    "name": {
+      Type:          schema.TypeString,
+      Optional:      true,
+      Computed:      true,
+      ForceNew:      true,
+      ConflictsWith: []string{"name_prefix"},
+    },
+    "name_prefix": {
+      Type:          schema.TypeString,
+      Optional:      true,
+      Computed:      true,
+      ForceNew:      true,
+      ConflictsWith: []string{"name"},
+    },
+    ```
 
-- _Resource Name Generation Code Implementation_: In the resource code (e.g., `internal/service/{service}/{thing}.go`), implementation of `name_prefix` attribute, along with handling in `Create` function.
-- _Resource Name Generation Testing Implementation_: In the resource acceptance testing (e.g., `internal/service/{service}/{thing}_test.go`), implementation of new acceptance test functions and configurations to exercise new naming logic.
-- _Resource Name Generation Documentation Implementation_: In the resource documentation (e.g., `website/docs/r/service_thing.html.markdown`), addition of `name_prefix` argument and update of `name` argument description.
+- In the resource `Create` function, make use of the `create.Name()` function.
 
-## Resource name generation code implementation
+=== "Terraform Plugin Framework (Preferred)"
+    ```go
+    name := create.Name(plan.Name.ValueString(), plan.NamePrefix.ValueString())
 
-- In the resource Go file (e.g., `internal/service/{service}/{thing}.go`), add the following Go import: `"github.com/hashicorp/terraform-provider-aws/internal/create"`
-- In the resource schema, add the new `name_prefix` attribute and adjust the `name` attribute to be `Optional`, `Computed`, and `ConflictsWith` the `name_prefix` attribute. Ensure to keep any existing schema fields on `name` such as `ValidateFunc`. E.g.
+    // ... in AWS Go SDK V2 Input types, etc. use aws.ToString(name)
+    ```
 
-```go
-"name": {
-  Type:          schema.TypeString,
-  Optional:      true,
-  Computed:      true,
-  ForceNew:      true,
-  ConflictsWith: []string{"name_prefix"},
-},
-"name_prefix": {
-  Type:          schema.TypeString,
-  Optional:      true,
-  Computed:      true,
-  ForceNew:      true,
-  ConflictsWith: []string{"name"},
-},
-```
+=== "Terraform Plugin SDK V2"
+    ```go
+    name := create.Name(d.Get("name").(string), d.Get("name_prefix").(string))
 
-- In the resource `Create` function, switch any calls from `d.Get("name").(string)` to instead use the `create.Name()` function, e.g.
+    // ... in AWS Go SDK V2 Input types, etc. use aws.ToString(name)
+    ```
 
-```go
-name := create.Name(d.Get("name").(string), d.Get("name_prefix").(string))
+- If the resource supports import, set both `name` and `name_prefix` in the resource `Read` function.
 
-// ... in AWS Go SDK Input types, etc. use aws.String(name)
-```
+=== "Terraform Plugin Framework (Preferred)"
+    ```go
+    state.Name = flex.StringToFramework(ctx, resp.Name)
+    state.NamePrefix = create.NamePrefixFromName(flex.StringToFramework(ctx, resp.Name))
+    ```
 
-- If the resource supports import, in the resource `Read` function add a call to `d.Set("name_prefix", ...)`, e.g.
-
-```go
-d.Set("name", resp.Name)
-d.Set("name_prefix", create.NamePrefixFromName(aws.StringValue(resp.Name)))
-```
+=== "Terraform Plugin SDK V2"
+    ```go
+    d.Set("name", resp.Name)
+    d.Set("name_prefix", create.NamePrefixFromName(aws.StringValue(resp.Name)))
+    ```
 
-## Resource name generation testing implementation
+## Resource Acceptance Tests
 
-- In the resource testing (e.g., `internal/service/{service}/{thing}_test.go`), add the following Go import: `"github.com/hashicorp/terraform-provider-aws/internal/create"`
-- In the resource testing, implement two new tests named `_Name_Generated` and `_NamePrefix` with associated configurations, that verifies creating the resource without `name` and `name_prefix` arguments (for the former) and with only the `name_prefix` argument (for the latter). E.g.
+- In the resource test file (e.g., `internal/service/{service}/{thing}_test.go`), add the following import: `"github.com/hashicorp/terraform-provider-aws/internal/create"`.
+- Implement two new tests named `_nameGenerated` and `_namePrefix` which verify creation of the resource without `name` and `name_prefix` arguments, and with only the `name_prefix` argument, respectively.
 
 ```go
 func TestAccServiceThing_nameGenerated(t *testing.T) {
@@ -128,34 +171,16 @@ resource "aws_service_thing" "test" {
 }
 ```
 
-## Resource name generation documentation implementation
+## Resource Documentation
 
-- In the resource documentation (e.g., `website/docs/r/service_thing.html.markdown`), add the following to the arguments reference:
+- In the resource documentation (e.g., `website/docs/r/{service}_{thing}.html.markdown`), add the following to the arguments reference.
 
 ```markdown
 * `name_prefix` - (Optional) Creates a unique name beginning with the specified prefix. Conflicts with `name`.
 ```
 
-- Adjust the existing `name` argument reference to ensure its denoted as `Optional`, includes a mention that it can be generated, and that it conflicts with `name_prefix`:
+- Adjust the existing `name` argument description to ensure its denoted as `Optional`, mention that it can be generated, and that it conflicts with `name_prefix`.
 
 ```markdown
 * `name` - (Optional) Name of the thing. If omitted, Terraform will assign a random, unique name. Conflicts with `name_prefix`.
 ```
-
-## Resource name generation with suffix
-
-Some generated resource names require a fixed suffix (for example Amazon SNS FIFO topic names must end in `.fifo`).
-In these cases use `create.NameWithSuffix()` in the resource `Create` function and `create.NamePrefixFromNameWithSuffix()` in the resource `Read` function, e.g.
-
-```go
-name := create.NameWithSuffix(d.Get("name").(string), d.Get("name_prefix").(string), ".fifo")
-```
-
-and
-
-```go
-d.Set("name", resp.Name)
-d.Set("name_prefix", create.NamePrefixFromNameWithSuffix(aws.StringValue(resp.Name), ".fifo"))
-```
-
-There are also functions `acctest.CheckResourceAttrNameWithSuffixGenerated` and `acctest.CheckResourceAttrNameWithSuffixFromPrefix` for use in tests.
diff --git a/docs/resource-tagging.md b/docs/resource-tagging.md
index 4fc91c147a4..0959b57228b 100644
--- a/docs/resource-tagging.md
+++ b/docs/resource-tagging.md
@@ -1,3 +1,4 @@
+<!-- markdownlint-configure-file { "code-block-style": false } -->
 # Adding Resource Tagging Support
 
 AWS provides key-value metadata across many services and resources, which can be used for a variety of use cases including billing, ownership, and more. See the [AWS Tagging Strategy page](https://aws.amazon.com/answers/account-management/aws-tagging-strategies/) for more information about tagging at a high level.
@@ -9,13 +10,10 @@ Implementing tagging support for Terraform AWS Provider resources requires the f
   Through these directives and their flags, you can customize code generation for the service.
   You can find the code that the tagging generator generates in a `tags_gen.go` file in a service, such as `internal/service/ec2/tags_gen.go`.
   You should generally _not_ need to edit the generator code itself (i.e., in `internal/generate/tags`).
-- _Resource Tagging Code Implementation_: In the resource code (e.g., `internal/service/{service}/{thing}.go`),
-  implementation of `tags` and `tags_all` schema attributes,
-  along with implementation of `CustomizeDiff` in the resource definition and handling in `Create`, `Read`, and `Update` functions.
-- _Resource Tagging Acceptance Testing Implementation_: In the resource acceptance testing (e.g., `internal/service/{service}/{thing}_test.go`),
-  implementation of new acceptance test function and configurations to exercise new tagging logic.
-- _Resource Tagging Documentation Implementation_: In the resource documentation (e.g., `website/docs/r/service_thing.html.markdown`),
-  addition of `tags` argument and `tags_all` attributes.
+- _Resource Code_: In the resource code, add the `tags` and `tags_all` schema attributes,
+  along with a plan modification in the resource definition, and handling in `Create`, `Read`, and `Update` functions.
+- _Resource Acceptance Tests_: In the resource acceptance tests, add new acceptance test functions and configurations to exercise the new tagging logic.
+- _Resource Documentation_: In the resource documentation, add the `tags` argument and `tags_all` attribute.
 
 ## Generating Tag Code for a Service
 
@@ -116,8 +114,8 @@ If the API does not support tagging on creation, pass the `-CreateTags` flag to
 
 ### Specifying the AWS SDK for Go version
 
-The vast majority of the Terraform AWS Provider is implemented using [version 1 of the AWS SDK for Go](https://github.com/aws/aws-sdk-go).
-For new services, however, we have started to use [version 2 of the SDK](https://github.com/aws/aws-sdk-go-v2).
+The majority of the Terraform AWS Provider is implemented using [version 1 of the AWS SDK for Go](https://github.com/aws/aws-sdk-go).
+For new services, however, [version 2 of the SDK](https://github.com/aws/aws-sdk-go-v2) is required.
 
 By default, the generated code uses the AWS SDK for Go v1.
 To generate code using the AWS SDK for Go v2, pass the flag `-AwsSdkVersion=2`.
@@ -129,7 +127,7 @@ For more information, see the [documentation on AWS SDK versions](./aws-go-sdk-v
 Run the command `make gen` to run the code generators for the project.
 To ensure that the code compiles, run `make test`.
 
-## Resource Tagging Code Implementation
+## Resource Code
 
 ### Resource Schema
 
@@ -137,10 +135,10 @@ Add the following imports to the resource's Go source file:
 
 ```go
 imports (
-  /* ... other imports ... */
-  tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
-	"github.com/hashicorp/terraform-provider-aws/internal/verify"
-	"github.com/hashicorp/terraform-provider-aws/names"
+    /* ... other imports ... */
+    tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
+    "github.com/hashicorp/terraform-provider-aws/internal/verify"
+    "github.com/hashicorp/terraform-provider-aws/names"
 )
 ```
 
@@ -148,60 +146,78 @@ Add the `tags` parameter and `tags_all` attribute to the schema, using constants
 The `tags` parameter contains the tags set directly on the resource.
 The `tags_all` attribute contains union of the tags set directly on the resource and default tags configured on the provider.
 
-```go
-func ResourceCluster() *schema.Resource {
-  return &schema.Resource{
-    /* ... other configuration ... */
-		Schema: map[string]*schema.Schema{
-      /* ... other configuration ... */
-			names.AttrTags:    tftags.TagsSchema(),
-			names.AttrTagsAll: tftags.TagsSchemaComputed(),
-    },
-  }
-}
-```
-
-The function `verify.SetTagsDiff` handles the combination of tags set on the resource and default tags,
-and must be added to the resource's `CustomizeDiff` function.
-
-If the resource has no other `CustomizeDiff` handler functions, set it directly:
-
-```go
-func ResourceCluster() *schema.Resource {
-  return &schema.Resource{
-    /* ... other configuration ... */
-    CustomizeDiff: verify.SetTagsDiff,
-  }
-}
-```
-
-Otherwise, if the resource already contains a `CustomizeDiff` function, append the `SetTagsDiff` via the `customdiff.All` method:
-
-```go
-func ResourceExample() *schema.Resource {
-  return &schema.Resource{
-    /* ... other configuration ... */
-    CustomizeDiff: customdiff.All(
-      resourceExampleCustomizeDiff,
-      verify.SetTagsDiff,
-    ),
-  }
-}
-```
+=== "Terraform Plugin Framework (Preferred)"
+    ```go
+    func (r *resourceExample) Schema(ctx context.Context, req resource.SchemaRequest, resp *resource.SchemaResponse) {
+        resp.Schema = schema.Schema{
+            Attributes: map[string]schema.Attribute{
+                /* ... other configuration ... */
+                names.AttrTags:    tftags.TagsAttribute(),
+                names.AttrTagsAll: tftags.TagsAttributeComputedOnly(),
+            },
+        }
+    }
+    ```
+
+=== "Terraform Plugin SDK V2"
+    ```go
+    func ResourceExample() *schema.Resource {
+        return &schema.Resource{
+            /* ... other configuration ... */
+            Schema: map[string]*schema.Schema{
+                /* ... other configuration ... */
+                names.AttrTags:    tftags.TagsSchema(),
+                names.AttrTagsAll: tftags.TagsSchemaComputed(),
+            },
+        }
+    }
+    ```
+
+Add a plan modifier (Terraform Plugin Framework) or a `CustomizeDiff` function (Terraform Plugin SDK V2) to ensure tagging diffs are handled appropriately.
+These functions handle the combination of tags set on the resource and default tags, and must be set for tagging to function properly.
+
+=== "Terraform Plugin Framework (Preferred)"
+    ```go
+    func (r *resourceExample) ModifyPlan(ctx context.Context, req resource.ModifyPlanRequest, resp *resource.ModifyPlanResponse) {
+        r.SetTagsAll(ctx, req, resp)
+    }
+    ```
+
+=== "Terraform Plugin SDK V2"
+    ```go
+    func ResourceExample() *schema.Resource {
+      return &schema.Resource{
+        /* ... other configuration ... */
+        CustomizeDiff: verify.SetTagsDiff,
+      }
+    }
+    ```
+
+If the resource already implements `ModifyPlan`, simply include the `SetTagsAll` function at the end of the method body.
 
 ### Transparent Tagging
 
 Most services can use a facility we call _transparent_ (or _implicit_) _tagging_, where the majority of resource tagging functionality is implemented using code located in the provider's runtime packages (see `internal/provider/intercept.go` and `internal/provider/fwprovider/intercept.go` for details) and not in the resource's CRUD handler functions. Resource implementers opt-in to transparent tagging by adding an _annotation_ (a specially formatted Go comment) to the resource's factory function (similar to the [resource self-registration mechanism](add-a-new-resource.md)).
 
-```go
-// @SDKResource("aws_accessanalyzer_analyzer", name="Analyzer")
-// @Tags(identifierAttribute="arn")
-func ResourceAnalyzer() *schema.Resource {
-  return &schema.Resource{
-    ...
-  }
-}
-```
+=== "Terraform Plugin Framework (Preferred)"
+    ```go
+    // @FrameworkResource(name="Example")
+    // @Tags(identifierAttribute="arn")
+    func newResourceExample(_ context.Context) (resource.ResourceWithConfigure, error) {
+        return &resourceExample{}, nil
+    }
+    ```
+
+=== "Terraform Plugin SDK V2"
+    ```go
+    // @SDKResource("aws_service_example", name="Example")
+    // @Tags(identifierAttribute="arn")
+    func ResourceExample() *schema.Resource {
+      return &schema.Resource{
+        ...
+      }
+    }
+    ```
 
 The `identifierAttribute` argument to the `@Tags` annotation identifies the attribute in the resource's schema whose value is used in tag listing and updating API calls. Common values are `"arn"` and "`id`".
 Once the annotation has been added to the resource's code, run `make gen` to register the resource for transparent tagging. This will add an entry to the `service_package_gen.go` file located in the service package folder.
@@ -212,32 +228,57 @@ When creating a resource, some AWS APIs support passing tags in the Create call
 while others require setting the tags after the initial creation.
 
 If the API supports tagging on creation (e.g., the `Input` struct accepts a `Tags` field),
-use the `getTagsIn` function to get any configured tags, e.g., with EKS Clusters:
-
-```go
-input := &eks.CreateClusterInput{
-  /* ... other configuration ... */
-  Tags: getTagsIn(ctx),
-}
-```
+use the `getTagsIn` function to get any configured tags.
 
-Otherwise, if the API does not support tagging on creation, call `createTags` after the resource has been created, e.g., with Device Farm device pools:
+=== "Terraform Plugin Framework (Preferred)"
+    ```go
+    input := &service.CreateExampleInput{
+      /* ... other configuration ... */
+      Tags: getTagsIn(ctx),
+    }
+    ```
 
-```go
-if err := createTags(ctx, conn, d.Id(), getTagsIn(ctx)); err != nil {
-  return sdkdiag.AppendErrorf(diags, "setting DeviceFarm Device Pool (%s) tags: %s", d.Id(), err)
-}
-```
+=== "Terraform Plugin SDK V2"
+    ```go
+    input := &service.CreateExampleInput{
+      /* ... other configuration ... */
+      Tags: getTagsIn(ctx),
+    }
+    ```
+
+Otherwise, if the API does not support tagging on creation, call `createTags` after the resource has been created.
+
+=== "Terraform Plugin Framework (Preferred)"
+    ```go
+    if err := createTags(ctx, conn, plan.ID.ValueString(), getTagsIn(ctx)); err != nil {
+        resp.Diagnostics.AddError(
+            create.ProblemStandardMessage(names.Service, create.ErrActionCreating, ResNameExample, plan.ID.String(), nil),
+            err.Error(),
+        )
+        return
+    }
+    ```
+
+=== "Terraform Plugin SDK V2"
+    ```go
+    if err := createTags(ctx, conn, d.Id(), getTagsIn(ctx)); err != nil {
+      return sdkdiag.AppendErrorf(diags, "setting Service Example (%s) tags: %s", d.Id(), err)
+    }
+    ```
 
 #### Resource Read Operation
 
-In the resource `Read` operation, use the `setTagsOut` function to signal to the transparent tagging mechanism that the resource has tags that should be saved into Terraform state, e.g., with EKS Clusters:
+In the resource `Read` operation, use the `setTagsOut` function to signal to the transparent tagging mechanism that the resource has tags that should be saved into Terraform state.
 
-```go
-/* ... other d.Set(...) logic ... */
+=== "Terraform Plugin Framework (Preferred)"
+    ```go
+    setTagsOut(ctx, out.Tags)
+    ```
 
-setTagsOut(ctx, cluster.Tags)
-```
+=== "Terraform Plugin SDK V2"
+    ```go
+    setTagsOut(ctx, out.Tags)
+    ```
 
 If the service API does not return the tags directly from reading the resource and requires use of the generated `listTags` function, do nothing and the transparent tagging mechanism will make the `listTags` call and save any tags into Terraform state.
 
@@ -245,27 +286,44 @@ If the service API does not return the tags directly from reading the resource a
 
 In the resource `Update` operation, only non-`tags` updates need be done as the transparent tagging mechanism makes the `updateTags` call.
 
-```go
-if d.HasChangesExcept("tags", "tags_all") {
-  ...
-}
-```
-
-Ensure that the `Update` operation always calls the resource `Read` operation before returning so that the transparent tagging mechanism correctly saves any tags into Terraform state, e.g., with Access Analyzer analyzers:
-
-```go
-func resourceAnalyzerUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-  var diags diag.Diagnostics
-  // Tags only.
-  return append(diags, resourceAnalyzerRead(ctx, d, meta)...)
-}
-```
+=== "Terraform Plugin Framework (Preferred)"
+    ```go
+    if !plan.Name.Equal(state.Name) ||
+        !plan.Description.Equal(state.Description) ||
+        // etc.
+        // Do NOT check for tags changes here.
+        !plan.OtherField.Equal(state.OtherField) {
+        ...
+    }
+    ```
+
+=== "Terraform Plugin SDK V2"
+    ```go
+    if d.HasChangesExcept("tags", "tags_all") {
+      ...
+    }
+    ```
+
+For Terraform Plugin SDK V2 based resources, ensure that the `Update` operation always calls the resource `Read` operation before returning so that the transparent tagging mechanism correctly saves any tags into Terraform state.
+
+=== "Terraform Plugin SDK V2"
+    ```go
+    func resourceAnalyzerUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+      var diags diag.Diagnostics
+      // Tags only.
+      return append(diags, resourceAnalyzerRead(ctx, d, meta)...)
+    }
+    ```
 
 ### Explicit Tagging
 
 If the resource cannot opt-in to transparent tagging, more boilerplate code must be explicitly added to the resource CRUD handler functions.
 This section describes how to do this.
 
+!!! note
+
+    There are currently no Terraform Plugin Framework based resources which use explicit tagging. As such, the remaining examples in this section will reference legacy Terraform Plugin SDK V2 patterns.
+
 #### Resource Create Operation
 
 When creating a resource, some AWS APIs support passing tags in the Create call
@@ -274,149 +332,157 @@ while others require setting the tags after the initial creation.
 If the API supports tagging on creation (e.g., the `Input` struct accepts a `Tags` field),
 implement the logic to convert the configuration tags into the service tags, e.g., with EKS Clusters:
 
-```go
-// Typically declared near conn := /* ... */
-defaultTagsConfig := meta.(*AWSClient).DefaultTagsConfig
-tags := defaultTagsConfig.MergeTags(tftags.New(ctx, d.Get("tags").(map[string]interface{})))
+=== "Terraform Plugin SDK V2"
+    ```go
+    // Typically declared near conn := /*...*/
+    defaultTagsConfig := meta.(*AWSClient).DefaultTagsConfig
+    tags := defaultTagsConfig.MergeTags(tftags.New(ctx, d.Get("tags").(map[string]interface{})))
 
-input := &eks.CreateClusterInput{
-  /* ... other configuration ... */
-  Tags: Tags(tags.IgnoreAWS()),
-}
-```
+    input := &eks.CreateClusterInput{
+      /* ... other configuration ... */
+      Tags: Tags(tags.IgnoreAWS()),
+    }
+    ```
 
 If the service API does not allow passing an empty list, the logic can be adjusted similar to:
 
-```go
-// Typically declared near conn := /* ... */
-defaultTagsConfig := meta.(*AWSClient).DefaultTagsConfig
-tags := defaultTagsConfig.MergeTags(tftags.New(ctx, d.Get("tags").(map[string]interface{})))
+=== "Terraform Plugin SDK V2"
+    ```go
+    // Typically declared near conn := /*...*/
+    defaultTagsConfig := meta.(*AWSClient).DefaultTagsConfig
+    tags := defaultTagsConfig.MergeTags(tftags.New(ctx, d.Get("tags").(map[string]interface{})))
 
-input := &eks.CreateClusterInput{
-  /* ... other configuration ... */
-}
+    input := &eks.CreateClusterInput{
+      /* ...other configuration... */
+    }
 
-if len(tags) > 0 {
-  input.Tags = Tags(tags.IgnoreAWS())
-}
-```
+    if len(tags) > 0 {
+      input.Tags = Tags(tags.IgnoreAWS())
+    }
+    ```
 
 Otherwise, if the API does not support tagging on creation,
 implement the logic to convert the configuration tags into the service API call to tag a resource, e.g., with Device Farm device pools:
 
-```go
-// Typically declared near conn := /* ... */
-defaultTagsConfig := meta.(*AWSClient).DefaultTagsConfig
-tags := defaultTagsConfig.MergeTags(tftags.New(ctx, d.Get("tags").(map[string]interface{})))
+=== "Terraform Plugin SDK V2"
+    ```go
+    // Typically declared near conn := /*...*/
+    defaultTagsConfig := meta.(*AWSClient).DefaultTagsConfig
+    tags := defaultTagsConfig.MergeTags(tftags.New(ctx, d.Get("tags").(map[string]interface{})))
 
-/* ... creation steps ... */
+    /* ... creation steps ... */
 
-if len(tags) > 0 {
-  if err := updateTags(ctx, conn, d.Id(), nil, tags); err != nil {
-    return fmt.Errorf("adding DeviceFarm Device Pool (%s) tags: %w", d.Id(), err)
-  }
-}
-```
+    if len(tags) > 0 {
+      if err := updateTags(ctx, conn, d.Id(), nil, tags); err != nil {
+        return fmt.Errorf("adding DeviceFarm Device Pool (%s) tags: %w", d.Id(), err)
+      }
+    }
+    ```
 
 Some EC2 resources (e.g., [`aws_ec2_fleet`](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ec2_fleet)) have a `TagSpecifications` field in the `InputStruct` instead of a `Tags` field.
 In these cases the `tagSpecificationsFromKeyValueTags()` helper function should be used.
 This example shows using `TagSpecifications`:
 
-  ```go
-  // Typically declared near conn := /* ... */
-  defaultTagsConfig := meta.(*AWSClient).DefaultTagsConfig
-  tags := defaultTagsConfig.MergeTags(tftags.New(ctx, d.Get("tags").(map[string]interface{})))
-  
-  input := &ec2.CreateFleetInput{
-    /* ... other configuration ... */
-    TagSpecifications: tagSpecificationsFromKeyValueTags(tags, ec2.ResourceTypeFleet),
-  }
-  ```
+=== "Terraform Plugin SDK V2"
+    ```go
+    // Typically declared near conn := /*...*/
+    defaultTagsConfig := meta.(*AWSClient).DefaultTagsConfig
+    tags := defaultTagsConfig.MergeTags(tftags.New(ctx, d.Get("tags").(map[string]interface{})))
+
+    input := &ec2.CreateFleetInput{
+        /* ... other configuration ... */
+        TagSpecifications: tagSpecificationsFromKeyValueTags(tags, ec2.ResourceTypeFleet),
+    }
+    ```
 
 #### Resource Read Operation
 
 In the resource `Read` operation, implement the logic to convert the service tags to save them into the Terraform state for drift detection, e.g., with EKS Clusters:
 
-```go
-// Typically declared near conn := /* ... */
-defaultTagsConfig := meta.(*AWSClient).DefaultTagsConfig
-ignoreTagsConfig := meta.(*AWSClient).IgnoreTagsConfig
+=== "Terraform Plugin SDK V2"
+    ```go
+    // Typically declared near conn := /*...*/
+    defaultTagsConfig := meta.(*AWSClient).DefaultTagsConfig
+    ignoreTagsConfig := meta.(*AWSClient).IgnoreTagsConfig
 
-/* ... other d.Set(...) logic ... */
+    /* ... other d.Set(...) logic ... */
 
-tags := KeyValueTags(ctx, cluster.Tags).IgnoreAWS().IgnoreConfig(ignoreTagsConfig)
+    tags := KeyValueTags(ctx, cluster.Tags).IgnoreAWS().IgnoreConfig(ignoreTagsConfig)
 
-if err := d.Set("tags", tags.RemoveDefaultConfig(defaultTagsConfig).Map()); err != nil {
-  return fmt.Errorf("setting tags: %w", err)
-}
+    if err := d.Set("tags", tags.RemoveDefaultConfig(defaultTagsConfig).Map()); err != nil {
+      return fmt.Errorf("setting tags: %w", err)
+    }
 
-if err := d.Set("tags_all", tags.Map()); err != nil {
-  return fmt.Errorf("setting tags_all: %w", err)
-}
-```
+    if err := d.Set("tags_all", tags.Map()); err != nil {
+      return fmt.Errorf("setting tags_all: %w", err)
+    }
+    ```
 
 If the service API does not return the tags directly from reading the resource and requires a separate API call,
 use the generated `listTags` function, e.g., with Athena Workgroups:
 
-```go
-// Typically declared near conn := /* ... */
-defaultTagsConfig := meta.(*AWSClient).DefaultTagsConfig
-ignoreTagsConfig := meta.(*AWSClient).IgnoreTagsConfig
+=== "Terraform Plugin SDK V2"
+    ```go
+    // Typically declared near conn := /*...*/
+    defaultTagsConfig := meta.(*AWSClient).DefaultTagsConfig
+    ignoreTagsConfig := meta.(*AWSClient).IgnoreTagsConfig
 
-/* ... other d.Set(...) logic ... */
+    /* ... other d.Set(...) logic ... */
 
-tags, err := listTags(ctx, conn, arn.String())
+    tags, err := listTags(ctx, conn, arn.String())
 
-if err != nil {
-  return fmt.Errorf("listing tags for resource (%s): %w", arn, err)
-}
+    if err != nil {
+      return fmt.Errorf("listing tags for resource (%s): %w", arn, err)
+    }
 
-tags = tags.IgnoreAWS().IgnoreConfig(ignoreTagsConfig)
+    tags = tags.IgnoreAWS().IgnoreConfig(ignoreTagsConfig)
 
-if err := d.Set("tags", tags.RemoveDefaultConfig(defaultTagsConfig).Map()); err != nil {
-  return fmt.Errorf("setting tags: %w", err)
-}
+    if err := d.Set("tags", tags.RemoveDefaultConfig(defaultTagsConfig).Map()); err != nil {
+      return fmt.Errorf("setting tags: %w", err)
+    }
 
-if err := d.Set("tags_all", tags.Map()); err != nil {
-  return fmt.Errorf("setting tags_all: %w", err)
-}
-```
+    if err := d.Set("tags_all", tags.Map()); err != nil {
+      return fmt.Errorf("setting tags_all: %w", err)
+    }
+    ```
 
 #### Resource Update Operation
 
 In the resource `Update` operation, implement the logic to handle tagging updates, e.g., with EKS Clusters:
 
-```go
-if d.HasChange("tags_all") {
-  o, n := d.GetChange("tags_all")
-  if err := updateTags(ctx, conn, d.Get("arn").(string), o, n); err != nil {
-    return fmt.Errorf("updating tags: %w", err)
-  }
-}
-```
+=== "Terraform Plugin SDK V2"
+    ```go
+    if d.HasChange("tags_all") {
+      o, n := d.GetChange("tags_all")
+      if err := updateTags(ctx, conn, d.Get("arn").(string), o, n); err != nil {
+        return fmt.Errorf("updating tags: %w", err)
+      }
+    }
+    ```
 
 If the resource `Update` function applies specific updates to attributes regardless of changes to tags, implement the following e.g., with IAM Policy:
 
-```go
-if d.HasChangesExcept("tags", "tags_all") {
-  /* ... other logic ...*/
-  request := &iam.CreatePolicyVersionInput{
-    PolicyArn:      aws.String(d.Id()),
-    PolicyDocument: aws.String(d.Get("policy").(string)),
-    SetAsDefault:   aws.Bool(true),
-  }
+=== "Terraform Plugin SDK V2"
+    ```go
+    if d.HasChangesExcept("tags", "tags_all") {
+      /* ... other logic ...*/
+      request := &iam.CreatePolicyVersionInput{
+        PolicyArn:      aws.String(d.Id()),
+        PolicyDocument: aws.String(d.Get("policy").(string)),
+        SetAsDefault:   aws.Bool(true),
+      }
 
-  if _, err := conn.CreatePolicyVersionWithContext(ctx, request); err != nil {
-      return fmt.Errorf("updating IAM policy (%s): %w", d.Id(), err)
-  }
-}
-```
+      if _, err := conn.CreatePolicyVersionWithContext(ctx, request); err != nil {
+          return fmt.Errorf("updating IAM policy (%s): %w", d.Id(), err)
+      }
+    }
+    ```
 
-## Resource Tagging Acceptance Testing Implementation
+## Resource Acceptance Tests
 
-In the resource testing (e.g., `internal/service/eks/cluster_test.go`), verify that existing resources without tagging are unaffected and do not have tags saved into their Terraform state. This should be done in the `_basic` acceptance test by adding one line similar to `resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),` and one similar to `resource.TestCheckResourceAttr(resourceName, "tags_all.%", "0"),`
+In the resource acceptance tests (e.g., `internal/service/eks/cluster_test.go`), verify that existing resources without tagging are unaffected and do not have tags saved into their Terraform state. This should be done in the `_basic` acceptance test by adding one line similar to `resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),` and one similar to `resource.TestCheckResourceAttr(resourceName, "tags_all.%", "0"),`
 
-In the resource testing, implement a new test named `_tags` with associated configurations, that verifies creating the resource with tags and updating tags. E.g., EKS Clusters:
+Add a new test named `_tags` with associated configurations, that verifies creating the resource with tags and updating tags. E.g., EKS Clusters:
 
 ```go
 func TestAccEKSCluster_tags(t *testing.T) {
@@ -507,15 +573,15 @@ resource "aws_eks_cluster" "test" {
 
 Verify all acceptance testing passes for the resource (e.g., `make testacc TESTS=TestAccEKSCluster_ PKG=eks`)
 
-## Resource Tagging Documentation Implementation
+## Resource Documentation
 
-In the resource documentation (e.g., `website/docs/r/eks_cluster.html.markdown`), add the following to the arguments reference:
+In the resource documentation (e.g., `website/docs/r/service_example.html.markdown`), add the following to the arguments reference:
 
 ```markdown
 * `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 ```
 
-In the resource documentation (e.g., `website/docs/r/eks_cluster.html.markdown`), add the following to the attributes reference:
+In the resource documentation (e.g., `website/docs/r/service_example.html.markdown`), add the following to the attribute reference:
 
 ```markdown
 * `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block).
diff --git a/docs/retries-and-waiters.md b/docs/retries-and-waiters.md
index 3bec4a5b78c..460aba4be49 100644
--- a/docs/retries-and-waiters.md
+++ b/docs/retries-and-waiters.md
@@ -1,3 +1,4 @@
+<!-- markdownlint-configure-file { "code-block-style": false } -->
 # Retries and Waiters
 
 Terraform plugins may run into situations where calling the remote system after an operation may be necessary. These typically fall under three classes where:
@@ -8,6 +9,10 @@ Terraform plugins may run into situations where calling the remote system after
 
 This guide describes the behavior of the Terraform AWS Provider and provides code implementations that help ensure success in each of these situations.
 
+!!! note
+    The helper functions detailed below **are** compatible with Terraform Plugin Framework based resources (the required library for net-new resources).
+    While these functions currently reside the in the legacy Terraform Plugin SDK repository, they are not directly tied to functionality exclusive to this library, and likely will be moved to a standalone library or into the AWS provider itself in the future.
+
 ## Terraform Plugin SDK Functionality
 
 The [Terraform Plugin SDK](https://github.com/hashicorp/terraform-plugin-sdk/), which the AWS Provider uses, provides vital tools for handling consistency: the `retry.StateChangeConf{}` struct, and the retry function `retry.RetryContext()`.
@@ -48,9 +53,7 @@ The Terraform AWS Provider's requests to AWS service APIs happen on top of Hyper
     - Triggering automatic request retries based on default and custom logic.
 - The Terraform resource receives the response, including any output and errors, from the AWS Go SDK.
 
-The Terraform AWS Provider specific configuration for AWS Go SDK operation handling can be found in `aws/conns/conns.go` in this codebase and the [`hashicorp/aws-sdk-go-base` codebase](https://github.com/hashicorp/aws-sdk-go-base).
-
-_NOTE: The section descibes the current handling with version 1 of the AWS Go SDK. In the future, this codebase will be migrated to version 2 of the AWS Go SDK. The newer version implements a very similar request flow but uses a simpler credential and request handling configuration. As such, the `aws-sdk-go-base` dependency will likely not receive further updates and will be removed after that migration._
+In cases where custom operation handling is configured for a specific service client, the changes can typically be found in `internal/service/{service-name}/service_package.go`.
 
 ### Default AWS Go SDK Retries
 
@@ -62,33 +65,66 @@ In some situations, while handling a response, the AWS Go SDK automatically retr
 
 By default, the Terraform AWS Provider sets the maximum number of AWS Go SDK retries based on the [`max_retries` provider configuration](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#max_retries). The provider configuration defaults to 25 and the exponential backoff roughly equates to one hour of retries. This very high default value was present before the Terraform AWS Provider codebase was split from Terraform CLI in version 0.10.
 
-_NOTE: The section describes the current handling with version 1 of the AWS Go SDK. In the future, this codebase will be migrated to version 2 of the AWS Go SDK. The newer version implements additional retry conditions by default, such as consistently retrying all common network errors._
-
-_NOTE: The section describes the current handling with Terraform Plugin SDK resource signatures without `context.Context`. In the future, this codebase will be migrated to the context-aware resource signatures which currently enforce a 20-minute default timeout that conflicts with the timeout with the default `max_retries` value. The Terraform Plugin SDK may be updated to support removing this default 20-minute timeout or the default retry mechanism described here will be updated to prevent context cancellation errors where possible._
-
 ### Lower Network Error Retries
 
 Given the very high default number of AWS Go SDK retries configured in the Terraform AWS Provider and the excessive wait that practitioners would face, the [`hashicorp/aws-sdk-go-base` codebase](https://github.com/hashicorp/aws-sdk-go-base/blob/57529b4c2d2f8f3b5299d66a829b01259fa800d7/session.go#L108-L130) lowers retries to 10 for certain network errors that typically cannot be remediated via retries. This roughly equates to 30 seconds of retries.
 
 ### Terraform AWS Provider Service Retries
 
-The AWS Go SDK provides hooks for injecting custom logic into the service client handlers. We prefer this handling in situations where contributors would need to apply the retry behavior to many resources. For example, in cases where the AWS service API does not mark an error code as automatically retriable. The AWS Provider includes other retry-changing behaviors using this method. You can find them in the `aws/config.go` file. For example:
-
-```go
-client.kafkaconn.Handlers.Retry.PushBack(func(r *request.Request) {
-	if tfawserr.ErrMessageContains(r.Error, kafka.ErrCodeTooManyRequestsException, "Too Many Requests") {
-		r.Retryable = aws.Bool(true)
-	}
-})
-```
+The AWS Go SDK provides hooks for injecting custom logic into service client handlers.
+We prefer this handling in situations where contributors would need to apply the retry behavior to many resources.
+For example, in cases where the AWS service API does not mark an error code as automatically retriable.
+The AWS Provider includes other retry-changing behaviors using this method.
+When custom service client configurations are applied, these will be defined in `internal/service/{service-name}/service_package.go`.
+
+=== "AWS Go SDK V2 (Preferred)"
+    With V2 of the AWS Go SDK, the retrier is extended directly in client construction.
+
+    ```go
+    // NewClient returns a new AWS SDK for Go v2 client for this service package's AWS API.
+    func (p *servicePackage) NewClient(ctx context.Context, config map[string]any) (*s3_sdkv2.Client, error) {
+    	cfg := *(config["aws_sdkv2_config"].(*aws_sdkv2.Config))
+    
+    	return s3_sdkv2.NewFromConfig(cfg, func(o *s3_sdkv2.Options) {
+            // ..other configuration..
+    
+    		o.Retryer = conns.AddIsErrorRetryables(cfg.Retryer().(aws_sdkv2.RetryerV2), retry_sdkv2.IsErrorRetryableFunc(func(err error) aws_sdkv2.Ternary {
+    			if tfawserr_sdkv2.ErrMessageContains(err, errCodeOperationAborted, "A conflicting conditional operation is currently in progress against this resource. Please try again.") {
+    				return aws_sdkv2.TrueTernary
+    			}
+    			return aws_sdkv2.UnknownTernary // Delegate to configured Retryer.
+    		}))
+    	}), nil
+    }
+    ```
+
+=== "AWS Go SDK V1"
+    With V1 of the AWS Go SDK, a `CustomizeConn` helper is used to augment retry logic on an existing client after construction.
+
+    ```go
+    // CustomizeConn customizes a new AWS SDK for Go v1 client for this service package's AWS API.
+    func (p *servicePackage) CustomizeConn(ctx context.Context, conn *kafka_sdkv1.Kafka) (*kafka_sdkv1.Kafka, error) {
+    	conn.Handlers.Retry.PushBack(func(r *request_sdkv1.Request) {
+    		if tfawserr.ErrMessageContains(r.Error, kafka_sdkv1.ErrCodeTooManyRequestsException, "Too Many Requests") {
+    			r.Retryable = aws_sdkv1.Bool(true)
+    		}
+    	})
+    
+    	return conn, nil
+    }
+    ```
 
 ## Eventual Consistency
 
-Eventual consistency is a temporary condition where the remote system can return outdated information or errors due to not being strongly read-after-write consistent. This is a pattern found in remote systems that must be highly scaled for broad usage.
+Eventual consistency is a temporary condition where the remote system can return outdated information or errors due to not being strongly read-after-write consistent.
+This is a pattern found in remote systems that must be highly scaled for broad usage.
 
-Terraform expects any planned resource lifecycle change (create, update, destroy of the resource itself) and planned resource attribute value change to match after being applied. Conversely, operators typically expect that Terraform resources also implement the concept of drift detection for resources and their attributes, which requires reading information back from the remote system after an operation. A common implementation is refreshing the Terraform State information (`d.Set()`) during the `Read` function of a resource after `Create` and `Update`.
+Terraform expects any planned resource lifecycle change (create, update, destroy of the resource itself) and planned resource attribute value change to match after being applied.
+Conversely, operators typically expect that Terraform resources also implement the concept of drift detection for resources and their attributes, which requires reading information back from the remote system after an operation.
+A common implementation is calling the underlying `Get`/`Describe` AWS API after `Create` and `Update`.
 
-These two concepts conflict with each other and require additional handling in Terraform resource logic as shown in the following sections. These issues are _not_ reliably reproducible, especially in the case of writing acceptance testing, so they can be elusive with false positives to verify fixes.
+These two concepts conflict with each other and require additional handling in Terraform resource logic as shown in the following sections.
+These issues are _not_ reliably reproducible, especially in the case of writing acceptance testing, so they can be elusive with false positives to verify fixes.
 
 ### Operation Specific Error Retries
 
@@ -103,48 +139,79 @@ Do not use this type of logic to overcome improperly ordered Terraform configura
 The approach may not work in larger environments.
 
 ```go
-// internal/service/example/wait.go (created if does not exist)
-
 const (
 	// Maximum amount of time to wait for Thing operation eventual consistency
 	ThingOperationTimeout = 2 * time.Minute
 )
 ```
 
-```go
-// internal/service/{service}/{thing}.go
-
-// ... Create, Read, Update, or Delete function ...
-	err := retry.RetryContext(ctx, ThingOperationTimeout, func() *retry.RetryError {
-		_, err := conn./* ... AWS Go SDK operation with eventual consistency errors ... */
-
-		// Retryable conditions which can be checked.
-		// These must be updated to match the AWS service API error code and message.
-		if tfawserr.ErrMessageContains(err, /* error code */, /* error message */) {
-			return retry.RetryableError(err)
-		}
-
-		if err != nil {
-			return retry.NonRetryableError(err)
-		}
-
-		return nil
-	})
-
-	// This check is important - it handles when the AWS Go SDK operation retries without returning.
-	// e.g., any automatic retries due to network or throttling errors.
-	if tfresource.TimedOut(err) {
-		// The use of equals assignment (over colon equals) is also important here.
-		// This overwrites the error variable to simplify logic.
-		_, err = conn./* ... AWS Go SDK operation with IAM eventual consistency errors ... */
-	}
-
-	if err != nil {
-		return fmt.Errorf("... error message context ... : %w", err)
-	}
-```
-
-_NOTE: The section descibes the current handling with version 1 of the AWS Go SDK. In the future, this codebase will be migrated to version 2 of the AWS Go SDK. The newer version natively supports operation-specific retries in a more friendly manner, which may replace this type of implementation._
+=== "AWS Go SDK V2 (Preferred)"
+    ```go
+    // internal/service/{service}/{thing}.go
+
+    // ... Create, Read, Update, or Delete function ...
+    	err := retry.RetryContext(ctx, ThingOperationTimeout, func() *retry.RetryError {
+    		_, err := conn./* ... AWS Go SDK operation with eventual consistency errors ... */
+
+    		// Retryable conditions which can be checked.
+    		// These must be updated to match the AWS service API error code and message.
+            if errs.IsAErrorMessageContains[/* error type */](err, /* error message */) {
+    			return retry.RetryableError(err)
+    		}
+    
+    		if err != nil {
+    			return retry.NonRetryableError(err)
+    		}
+
+    		return nil
+    	})
+    
+    	// This check is important - it handles when the AWS Go SDK operation retries without returning.
+    	// e.g., any automatic retries due to network or throttling errors.
+    	if tfresource.TimedOut(err) {
+    		// The use of equals assignment (over colon equals) is also important here.
+    		// This overwrites the error variable to simplify logic.
+    		_, err = conn./* ... AWS Go SDK operation with IAM eventual consistency errors ... */
+    	}
+
+    	if err != nil {
+    		return fmt.Errorf("... error message context ... : %w", err)
+    	}
+    ```
+
+=== "AWS Go SDK V1"
+    ```go
+    // internal/service/{service}/{thing}.go
+
+    // ... Create, Read, Update, or Delete function ...
+    	err := retry.RetryContext(ctx, ThingOperationTimeout, func() *retry.RetryError {
+    		_, err := conn./* ... AWS Go SDK operation with eventual consistency errors ... */
+
+    		// Retryable conditions which can be checked.
+    		// These must be updated to match the AWS service API error code and message.
+    		if tfawserr.ErrMessageContains(err, /* error code */, /* error message */) {
+    			return retry.RetryableError(err)
+    		}
+
+    		if err != nil {
+    			return retry.NonRetryableError(err)
+    		}
+
+    		return nil
+    	})
+
+    	// This check is important - it handles when the AWS Go SDK operation retries without returning.
+    	// e.g., any automatic retries due to network or throttling errors.
+    	if tfresource.TimedOut(err) {
+    		// The use of equals assignment (over colon equals) is also important here.
+    		// This overwrites the error variable to simplify logic.
+    		_, err = conn./* ... AWS Go SDK operation with IAM eventual consistency errors ... */
+    	}
+
+    	if err != nil {
+    		return fmt.Errorf("... error message context ... : %w", err)
+    	}
+    ```
 
 #### IAM Error Retries
 
@@ -162,39 +229,75 @@ The last operation can receive varied API errors ranging from:
 
 Each AWS service API (and sometimes even operations within the same API) varies in the implementation of these errors. To handle them, it is recommended to use the [Operation Specific Error Retries](#operation-specific-error-retries) pattern. The Terraform AWS Provider implements a standard timeout constant of two minutes in the `internal/service/iam` package which should be used for all retry timeouts associated with IAM errors. This timeout was derived from years of Terraform operational experience with all AWS APIs.
 
-```go
-// internal/service/{service}/{thing}.go
+=== "AWS Go SDK V2 (Preferred)"
+    ```go
+    // internal/service/{service}/{thing}.go
 
-import (
-	// ... other imports ...
-	tfiam "github.com/hashicorp/terraform-provider-aws/internal/service/iam"
-)
+    import (
+    	// ... other imports ...
+    	tfiam "github.com/hashicorp/terraform-provider-aws/internal/service/iam"
+    )
 
-// ... Create and typically Update function ...
-	err := retry.RetryContext(ctx, iamwaiter.PropagationTimeout, func() *retry.RetryError {
-		_, err := conn./* ... AWS Go SDK operation with IAM eventual consistency errors ... */
+    // ... Create and typically Update function ...
+    	err := retry.RetryContext(ctx, iamwaiter.PropagationTimeout, func() *retry.RetryError {
+    		_, err := conn./* ... AWS Go SDK operation with IAM eventual consistency errors ... */
 
-		// Example retryable condition
-		// This must be updated to match the AWS service API error code and message.
-		if tfawserr.ErrMessageContains(err, /* error code */, /* error message */) {
-			return retry.RetryableError(err)
-		}
+    		// Example retryable condition
+    		// This must be updated to match the AWS service API error code and message.
+    		if errs.IsAErrorMessageContains[/* error type */](err, /* error message */) {
+    			return retry.RetryableError(err)
+    		}
 
-		if err != nil {
-			return retry.NonRetryableError(err)
-		}
+    		if err != nil {
+    			return retry.NonRetryableError(err)
+    		}
 
-		return nil
-	})
+    		return nil
+    	})
 
-	if tfresource.TimedOut(err) {
-		_, err = conn./* ... AWS Go SDK operation with IAM eventual consistency errors ... */
-	}
+    	if tfresource.TimedOut(err) {
+    		_, err = conn./* ... AWS Go SDK operation with IAM eventual consistency errors ... */
+    	}
 
-	if err != nil {
-		return fmt.Errorf("... error message context ... : %w", err)
-	}
-```
+    	if err != nil {
+    		return fmt.Errorf("... error message context ... : %w", err)
+    	}
+    ```
+
+=== "AWS Go SDK V1"
+    ```go
+    // internal/service/{service}/{thing}.go
+
+    import (
+    	// ... other imports ...
+    	tfiam "github.com/hashicorp/terraform-provider-aws/internal/service/iam"
+    )
+
+    // ... Create and typically Update function ...
+    	err := retry.RetryContext(ctx, iamwaiter.PropagationTimeout, func() *retry.RetryError {
+    		_, err := conn./* ... AWS Go SDK operation with IAM eventual consistency errors ... */
+
+    		// Example retryable condition
+    		// This must be updated to match the AWS service API error code and message.
+    		if tfawserr.ErrMessageContains(err, /* error code */, /* error message */) {
+    			return retry.RetryableError(err)
+    		}
+
+    		if err != nil {
+    			return retry.NonRetryableError(err)
+    		}
+
+    		return nil
+    	})
+
+    	if tfresource.TimedOut(err) {
+    		_, err = conn./* ... AWS Go SDK operation with IAM eventual consistency errors ... */
+    	}
+
+    	if err != nil {
+    		return fmt.Errorf("... error message context ... : %w", err)
+    	}
+    ```
 
 #### Asynchronous Operation Error Retries
 
@@ -259,160 +362,270 @@ import (
 
 ### Resource Lifecycle Retries
 
-Resource lifecycle eventual consistency is a type of consistency issue that relates to the existence or state of an AWS infrastructure component. For example, if you create a resource and immediately try to get information about it, some AWS services and operations will return a "not found" error. Depending on the service and general AWS load, these errors can be frequent or rare.
-
-In order to avoid this issue, identify operations that make changes. Then, when calling any other operations that rely on the changes, account for the possibility that the AWS service has not yet fully realized them.
+Resource lifecycle eventual consistency is a type of consistency issue that relates to the existence or state of an AWS infrastructure component.
+For example, if you create a resource and immediately try to get information about it, some AWS services and operations will return a "not found" error.
+Depending on the service and general AWS load, these errors can be frequent or rare.
 
-A typical example is creating an AWS component. After creation, when attempting to read the component's information, provide logic to retry the read if the AWS service returns a "not found" error.
+In order to avoid this issue, identify operations that make changes.
+Then, when calling any other operations that rely on the changes, account for the possibility that the AWS service has not yet fully realized them.
 
-The pattern that most resources should follow is to have the `Create` function return calling the `Read` function. This fills in computed attributes and ensures that the AWS service applied the configuration correctly. Add retry logic to the `Read` function to overcome the temporary condition on resource creation.
+Handling eventual consistency looks slightly different for Terraform Plugin Framework based resources versus Plugin SDK V2. For Terraform Framework based resources, a `Get`/`Describe` API call should be made after the create request completes, all within the `Create` method. For Terraform Plugin SDK V2 resources, the `Create` function should return by calling the `Read` function. Both approaches fill in computed attributes and ensures that the AWS service applied the configuration correctly. Add retry logic to the `Get`/`Describe` API call (Plugin Framework) or `Read` function (Plugin SDK V2) to overcome the temporary condition on resource creation.
 
-Note that for eventually consistent resources, "not found" errors can still occur in the `Read` function even after implementing [Resource Lifecycle Waiters](#resource-lifecycle-waiters) for the Create function.
+!!! note
+    For eventually consistent resources, "not found" errors can still occur in the `Read` function even after implementing [Resource Lifecycle Waiters](#resource-lifecycle-waiters).
 
 ```go
-// internal/service/example/wait.go (created if does not exist)
-
 const (
 	// Maximum amount of time to wait for Thing eventual consistency on creation
 	ThingCreationTimeout = 2 * time.Minute
 )
 ```
 
-```go
-// internal/service/{service}/{thing}.go
-
-function ExampleThingCreate(d *schema.ResourceData, meta interface{}) error {
-	// ...
-	return ExampleThingRead(d, meta)
-}
-
-function ExampleThingRead(d *schema.ResourceData, meta interface{}) error {
-	conn := meta.(*AWSClient).ExampleConn()
-
-	input := &example.OperationInput{/* ... */}
-
-	var output *example.OperationOutput
-	err := retry.RetryContext(ctx, ThingCreationTimeout, func() *retry.RetryError {
-		var err error
-		output, err = conn.Operation(input)
-
-		// Retry on any API "not found" errors, but only on new resources.
-		if d.IsNewResource() && tfawserr.ErrorCodeEquals(err, example.ErrCodeResourceNotFoundException) {
-			return retry.RetryableError(err)
-		}
-
-		if err != nil {
-			return retry.NonRetryableError(err)
-		}
-
-		return nil
-	})
-
-	// Retry AWS Go SDK operation if no response from automatic retries.
-	if tfresource.TimedOut(err) {
-		output, err = exampleconn.Operation(input)
-	}
-
-	// Prevent confusing Terraform error messaging to operators by
-	// Only ignoring API "not found" errors if not a new resource.
-	if !d.IsNewResource() && tfawserr.ErrorCodeEquals(err, example.ErrCodeNoSuchEntityException) {
-		log.Printf("[WARN] Example Thing (%s) not found, removing from state", d.Id())
-		d.SetId("")
-		return nil
-	}
-
-	if err != nil {
-		return fmt.Errorf("reading Example Thing (%s): %w", d.Id(), err)
-	}
-
-	// Prevent panics.
-	if output == nil {
-		return fmt.Errorf("reading Example Thing (%s): empty response", d.Id())
-	}
-
-	// ... refresh Terraform state as normal ...
-	d.Set("arn", output.Arn)
-}
-```
-
-Some other general guidelines are:
-
-- If the `Create` function uses `retry.StateChangeConf`, the underlying `resource.RefreshStateFunc` should `return nil, "", nil` instead of the API "not found" error. This way the `StateChangeConf` logic will automatically retry.
-- If the `Create` function uses `retry.RetryContext()`, the API "not found" error should be caught and `return retry.RetryableError(err)` to automatically retry.
-
-In rare cases, it may be easier to duplicate all `Read` function logic in the `Create` function to handle all retries in one place.
+=== "Terraform Plugin Framework (Preferred)"
+    ```go
+    // internal/service/{service}/{thing}.go
+
+    func (r *resourceThing) Create(ctx context.Context, req resource.CreateRequest, resp *resource.CreateResponse) {
+    	conn := meta.(*AWSClient).ExampleClient()
+
+    	// ...Creation steps...
+
+    	input := &example.OperationInput{/* ... */}
+
+    	var output *example.OperationOutput
+        createTimeout := r.CreateTimeout(ctx, plan.Timeouts)
+    	err := retry.RetryContext(ctx, createTimeout, func() *retry.RetryError {
+    		var err error
+    		output, err = conn.Operation(input)
+
+    		if errs.IsA[*types.ResourceNotFoundException(err) {
+    			return retry.RetryableError(err)
+    		}
+
+    		if err != nil {
+    			return retry.NonRetryableError(err)
+    		}
+
+    		return nil
+    	})
+
+    	// Retry AWS Go SDK operation if no response from automatic retries.
+    	if tfresource.TimedOut(err) {
+    		output, err = exampleconn.Operation(input)
+    	}
+
+    	if err != nil {
+            resp.Diagnostics.AddError(
+                create.ProblemStandardMessage(names.Example, create.ErrActionWaitingForCreation, ResNameThing, plan.ID.String(), err),
+                err.Error(),
+            )
+            return
+    	}
+
+    	// Prevent panics.
+    	if output == nil {
+            resp.Diagnostics.AddError(
+                create.ProblemStandardMessage(names.Example, create.ErrActionWaitingForCreation, ResNameThing, plan.ID.String(), errors.New("empty output")),
+                err.Error(),
+            )
+            return
+    	}
+
+    	// ... refresh Terraform state as normal ...
+    }
+    ```
+
+=== "Terraform Plugin SDK V2"
+    ```go
+    // internal/service/{service}/{thing}.go
+
+    function ExampleThingCreate(d *schema.ResourceData, meta interface{}) error {
+    	// ...
+    	return ExampleThingRead(d, meta)
+    }
+
+    function ExampleThingRead(d *schema.ResourceData, meta interface{}) error {
+    	conn := meta.(*AWSClient).ExampleConn()
+
+    	input := &example.OperationInput{/* ... */}
+
+    	var output *example.OperationOutput
+    	err := retry.RetryContext(ctx, ThingCreationTimeout, func() *retry.RetryError {
+    		var err error
+    		output, err = conn.Operation(input)
+
+    		// Retry on any API "not found" errors, but only on new resources.
+    		if d.IsNewResource() && tfawserr.ErrorCodeEquals(err, example.ErrCodeResourceNotFoundException) {
+    			return retry.RetryableError(err)
+    		}
+
+    		if err != nil {
+    			return retry.NonRetryableError(err)
+    		}
+
+    		return nil
+    	})
+
+    	// Retry AWS Go SDK operation if no response from automatic retries.
+    	if tfresource.TimedOut(err) {
+    		output, err = exampleconn.Operation(input)
+    	}
+
+    	// Prevent confusing Terraform error messaging to operators by
+    	// Only ignoring API "not found" errors if not a new resource.
+    	if !d.IsNewResource() && tfawserr.ErrorCodeEquals(err, example.ErrCodeNoSuchEntityException) {
+    		log.Printf("[WARN] Example Thing (%s) not found, removing from state", d.Id())
+    		d.SetId("")
+    		return nil
+    	}
+
+    	if err != nil {
+    		return fmt.Errorf("reading Example Thing (%s): %w", d.Id(), err)
+    	}
+
+    	// Prevent panics.
+    	if output == nil {
+    		return fmt.Errorf("reading Example Thing (%s): empty response", d.Id())
+    	}
+
+    	// ... refresh Terraform state as normal ...
+    	d.Set("arn", output.Arn)
+    }
+    ```
+
+    Some other general guidelines are:
+    
+    - If the `Create` function uses `retry.StateChangeConf`, the underlying `resource.RefreshStateFunc` should `return nil, "", nil` instead of the API "not found" error. This way the `StateChangeConf` logic will automatically retry.
+    - If the `Create` function uses `retry.RetryContext()`, the API "not found" error should be caught and `return retry.RetryableError(err)` to automatically retry.
+    
+    In rare cases, it may be easier to duplicate all `Read` function logic in the `Create` function to handle all retries in one place.
 
 ### Resource Attribute Value Waiters
 
-An emergent solution for handling eventual consistency with attribute values on updates is to introduce a custom `retry.StateChangeConf` and `resource.RefreshStateFunc` handlers. For example:
-
-```go
-// internal/service/example/status.go (created if does not exist)
-
-// ThingAttribute fetches the Thing and its Attribute
-func ThingAttribute(conn *example.Example, id string) retry.StateRefreshFunc {
-	return func() (interface{}, string, error) {
-		output, err := /* ... AWS Go SDK operation to fetch resource/value ... */
-
-		if tfawserr.ErrCodeEquals(err, example.ErrCodeResourceNotFoundException) {
-			return nil, "", nil
-		}
-
-		if err != nil {
-			return nil, "", err
-		}
-
-		if output == nil {
-			return nil, "", nil
-		}
-
-		return output, aws.StringValue(output.Attribute), nil
-	}
-}
-```
-
-```go
-// internal/service/example/wait.go (created if does not exist)
-
-const (
-	ThingAttributePropagationTimeout = 2 * time.Minute
-)
-
-// ThingAttributeUpdated is an attribute waiter for ThingAttribute
-func ThingAttributeUpdated(conn *example.Example, id string, expectedValue string) (*example.Thing, error) {
-	stateConf := &retry.StateChangeConf{
-		Target:  []string{expectedValue},
-		Refresh: ThingAttribute(conn, id),
-		Timeout: ThingAttributePropagationTimeout,
-	}
-
-	outputRaw, err := stateConf.WaitForState()
-
-	if output, ok := outputRaw.(*example.Thing); ok {
-		return output, err
-	}
-
-	return nil, err
-}
-```
-
-```go
-// internal/service/{service}/{thing}.go
-
-function ExampleThingUpdate(d *schema.ResourceData, meta interface{}) error {
-	// ...
-
-	d.HasChange("attribute") {
-		// ... AWS Go SDK logic to update attribute ...
-
-		if _, err := ThingAttributeUpdated(conn, d.Id(), d.Get("attribute").(string)); err != nil {
-			return fmt.Errorf("waiting for Example Thing (%s) attribute update: %w", d.Id(), err)
-		}
-	}
-
-	// ...
-}
-```
+An emergent solution for handling eventual consistency with attribute values on updates is to introduce a custom `retry.StateChangeConf` and `resource.RefreshStateFunc` handlers. For example, the waiting logic can be implemeted as:
+
+=== "AWS SDK Go V2 (Preferred)"
+    ```go
+    // ThingAttribute fetches the Thing and its Attribute
+    func ThingAttribute(ctx context.Context, conn *example.Client, id string) retry.StateRefreshFunc {
+        return func() (interface{}, string, error) {
+            output, err := /* ... AWS Go SDK operation to fetch resource/value ... */
+
+    		if errs.IsA[*types.ResourceNotFoundException](err) {
+    			return nil, "", nil
+    		}
+    
+    		if err != nil {
+    			return nil, "", err
+    		}
+    
+    		if output == nil {
+    			return nil, "", nil
+    		}
+    
+    		return output, aws.ToString(output.Attribute), nil
+    	}
+    }
+    
+    // waitThingAttributeUpdated is an attribute waiter for Thing.Attribute
+    func waitThingAttributeUpdated(ctx context.Context, conn *example.Example, id string, expectedValue string, timeout time.Duration) (*example.Thing, error) {
+    	stateConf := &retry.StateChangeConf{
+    		Target:  []string{expectedValue},
+    		Refresh: ThingAttribute(ctx, conn, id),
+    		Timeout: timeout,
+    	}
+    
+    	outputRaw, err := stateConf.WaitForState()
+    
+    	if output, ok := outputRaw.(*example.Thing); ok {
+    		return output, err
+    	}
+    
+    	return nil, err
+    }
+    ```
+
+=== "AWS SDK Go V1"
+    ```go
+    // ThingAttribute fetches the Thing and its Attribute
+    func ThingAttribute(ctx context.Context, conn *example.Example, id string) retry.StateRefreshFunc {
+        return func() (interface{}, string, error) {
+            output, err := /* ... AWS Go SDK operation to fetch resource/value ... */
+
+    		if tfawserr.ErrCodeEquals(err, example.ErrCodeResourceNotFoundException) {
+    			return nil, "", nil
+    		}
+
+    		if err != nil {
+    			return nil, "", err
+    		}
+
+    		if output == nil {
+    			return nil, "", nil
+    		}
+
+    		return output, aws.StringValue(output.Attribute), nil
+    	}
+    }
+    
+    // waitThingAttributeUpdated is an attribute waiter for Thing.Attribute
+    func waitThingAttributeUpdated(ctx context.Context, conn *example.Example, id string, expectedValue string, timeout time.Duration) (*example.Thing, error) {
+    	stateConf := &retry.StateChangeConf{
+    		Target:  []string{expectedValue},
+    		Refresh: ThingAttribute(ctx, conn, id),
+    		Timeout: timeout,
+    	}
+
+    	outputRaw, err := stateConf.WaitForState()
+
+    	if output, ok := outputRaw.(*example.Thing); ok {
+    		return output, err
+    	}
+
+    	return nil, err
+    }
+    ```
+
+And consumed within the resource update workflow as follows:
+
+=== "Terraform Plugin Framework (Preferred)"
+    ```go
+    func (r *resourceThing) Update(ctx context.Context, req resource.UpdateRequest, resp resource.UpdateResponse) {
+        // ...
+
+    	!plan.Attribute.Equal(state.Attribute) {
+    		// ... AWS Go SDK logic to update attribute ...
+
+            updateTimeout := r.UpdateTimeout(ctx, plan.Timeouts)
+    		if _, err := waitThingAttributeUpdated(ctx, conn, plan.ID.StringValue(), plan.Attribute.StringValue(), updateTimeout); err != nil {
+                resp.Diagnostics.AddError(
+                    create.ProblemStandardMessage(names.Example, create.ErrActionWaitingForUpdate, ResNameThing, plan.ID.String(), err),
+                    err.Error(),
+                )
+            return
+    		}
+    	}
+
+    	// ...
+    }
+    ```
+
+=== "Terraform Plugin SDK V2"
+    ```go
+    function resourceThingUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diags.Diagnostics {
+        // ...
+
+    	d.HasChange("attribute") {
+    		// ... AWS Go SDK logic to update attribute ...
+
+    		if _, err := waitThingAttributeUpdated(ctx, conn, d.Id(), d.Get("attribute").(string), d.Timeout(schema.TimeoutUpdate)); err != nil {
+                return append(diags, create.DiagError(names.Example, create.ErrActionWaitingForUpdate, ResNameThing, d.Id(), err)...)
+    		}
+    	}
+
+    	// ...
+    }
+    ```
 
 ## Asynchronous Operations
 
@@ -434,48 +647,65 @@ If it is necessary to customize the timeouts and polling, we generally prefer us
 
 ### Resource Lifecycle Waiters
 
-Most of the codebase uses `retry.StateChangeConf` and `retry.StateRefreshFunc` handlers for tracking either component level status fields or explicit tracking identifiers. These should be placed in the `internal/service/{SERVICE}` package and split into separate functions. For example:
-
-```go
-// internal/service/example/status.go (created if does not exist)
-
-// ThingStatus fetches the Thing and its Status
-func ThingStatus(conn *example.Example, id string) retry.StateRefreshFunc {
-	return func() (interface{}, string, error) {
-		output, err := /* ... AWS Go SDK operation to fetch resource/status ... */
-
-		if tfawserr.ErrCodeEquals(err, example.ErrCodeResourceNotFoundException) {
-			return nil, "", nil
-		}
-
-		if err != nil {
-			return nil, "", err
-		}
-
-		if output == nil {
-			return nil, "", nil
-		}
-
-		return output, aws.StringValue(output.Status), nil
-	}
-}
-```
+Most of the codebase uses `retry.StateChangeConf` and `retry.StateRefreshFunc` handlers for tracking either component level status fields or explicit tracking identifiers.
+These should be placed in the `internal/service/{SERVICE}` package and split into separate functions. For example:
+
+=== "AWS SDK Go V2 (Preferred)"
+    ```go
+    // ThingStatus fetches the Thing and its Status
+    func ThingStatus(ctx context.Context, conn *example.Client, id string) retry.StateRefreshFunc {
+        return func() (interface{}, string, error) {
+            output, err := /* ... AWS Go SDK operation to fetch resource/status ... */
+
+            if errs.IsA[*types.ResourceNotFoundException](err) {
+    			return nil, "", nil
+    		}
+
+    		if err != nil {
+    			return nil, "", err
+    		}
+
+    		if output == nil {
+    			return nil, "", nil
+    		}
+
+    		return output, aws.ToString(output.Status), nil
+    	}
+    }
+    ```
+
+=== "AWS SDK Go V1"
+    ```go
+    // ThingStatus fetches the Thing and its Status
+    func ThingStatus(ctx context.Context, conn *example.Example, id string) retry.StateRefreshFunc {
+        return func() (interface{}, string, error) {
+            output, err := /* ... AWS Go SDK operation to fetch resource/status ... */
+
+    		if tfawserr.ErrCodeEquals(err, example.ErrCodeResourceNotFoundException) {
+    			return nil, "", nil
+    		}
+
+    		if err != nil {
+    			return nil, "", err
+    		}
+
+    		if output == nil {
+    			return nil, "", nil
+    		}
+
+    		return output, aws.StringValue(output.Status), nil
+    	}
+    }
+    ```
 
 ```go
-// internal/service/example/wait.go (created if does not exist)
-
-const (
-	ThingCreationTimeout = 2 * time.Minute
-	ThingDeletionTimeout = 5 * time.Minute
-)
-
-// ThingCreated is a resource waiter for Thing creation
-func ThingCreated(conn *example.Example, id string) (*example.Thing, error) {
+// waitThingCreated is a resource waiter for Thing creation
+func waitThingCreated(ctx context.Context, conn *example.Example, id string, timeout time.Duration) (*example.Thing, error) {
 	stateConf := &retry.StateChangeConf{
 		Pending: []string{example.StatusCreating},
 		Target:  []string{example.StatusCreated},
-		Refresh: ThingStatus(conn, id),
-		Timeout: ThingCreationTimeout,
+		Refresh: ThingStatus(ctx, conn, id),
+		Timeout: timeout,
 	}
 
 	outputRaw, err := stateConf.WaitForState()
@@ -487,13 +717,13 @@ func ThingCreated(conn *example.Example, id string) (*example.Thing, error) {
 	return nil, err
 }
 
-// ThingDeleted is a resource waiter for Thing deletion
-func ThingDeleted(conn *example.Example, id string) (*example.Thing, error) {
+// waitThingDeleted is a resource waiter for Thing deletion
+func waitThingDeleted(ctx context.Context, conn *example.Example, id string, timeout time.Duration) (*example.Thing, error) {
 	stateConf := &retry.StateChangeConf{
 		Pending: []string{example.StatusDeleting},
 		Target:  []string{}, // Use empty list if the resource disappears and does not have "deleted" status
 		Refresh: ThingStatus(conn, id),
-		Timeout: ThingDeletionTimeout,
+		Timeout: timeout,
 	}
 
 	outputRaw, err := stateConf.WaitForState()
@@ -506,28 +736,58 @@ func ThingDeleted(conn *example.Example, id string) (*example.Thing, error) {
 }
 ```
 
-```go
-// internal/service/{service}/{thing}.go
-
-function ExampleThingCreate(d *schema.ResourceData, meta interface{}) error {
-	// ... AWS Go SDK logic to create resource ...
-
-	if _, err := ThingCreated(conn, d.Id()); err != nil {
-		return fmt.Errorf("waiting for Example Thing (%s) creation: %w", d.Id(), err)
-	}
-
-	return ExampleThingRead(d, meta)
-}
-
-function ExampleThingDelete(d *schema.ResourceData, meta interface{}) error {
-	// ... AWS Go SDK logic to delete resource ...
-
-	if _, err := ThingDeleted(conn, d.Id()); err != nil {
-		return fmt.Errorf("waiting for Example Thing (%s) deletion: %w", d.Id(), err)
-	}
-
-	return ExampleThingRead(d, meta)
-}
-```
+=== "Terraform Plugin Framework (Preferred)"
+    ```go
+    func (r *resourceThing) Create(ctx context.Context, req resource.CreateRequest, resp resource.CreateResponse) {
+        // ... AWS Go SDK logic to create resource ...
+
+        createTimeout := r.CreateTimeout(ctx, plan.Timeouts)
+        if _, err = waitThingCreated(ctx, conn, plan.ID.ValueString(), createTimeout); err != nil {
+            resp.Diagnostics.AddError(
+                create.ProblemStandardMessage(names.Example, create.ErrActionWaitingForCreation, ResNameThing, plan.ID.String(), err),
+                err.Error(),
+            )
+            return
+        }
+
+    	resp.Diagnostics.Append(resp.State.Set(ctx, plan)...)
+    }
+
+    func (r *resourceThing) Delete(ctx context.Context, req resource.DeleteRequest, resp *resource.DeleteResponse) {
+        // ... AWS Go SDK logic to delete resource ...
+
+        deleteTimeout := r.DeleteTimeout(ctx, plan.Timeouts)
+        if _, err = waitThingDeleted(ctx, conn, plan.ID.ValueString(), deleteTimeout); err != nil {
+            resp.Diagnostics.AddError(
+                create.ProblemStandardMessage(names.Example, create.ErrActionWaitingForDeletion, ResNameThing, plan.ID.String(), err),
+                err.Error(),
+            )
+            return
+        }
+    }
+    ```
+
+=== "Terraform Plugin SDK V2"
+    ```go
+    func resourceThingCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+        // ... AWS Go SDK logic to create resource ...
+
+    	if _, err := waitThingCreated(ctx, conn, d.Id(), d.Timeout(schema.TimeoutCreate)) {
+            return append(diags, create.DiagError(names.Example, create.ErrActionWaitingForCreation, ResNameThing, d.Id(), err)...)
+    	}
+
+    	return ExampleThingRead(d, meta)
+    }
+
+    func resourceThingDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+        // ... AWS Go SDK logic to delete resource ...
+
+    	if _, err := waitThingDeleted(conn, d.Id(), d.Timeout(schema.TimeoutDelete)); err != nil {
+            return append(diags, create.DiagError(names.Example, create.ErrActionWaitingForDeletion, ResNameThing, d.Id(), err)...)
+    	}
+
+    	return diags
+    }
+    ```
 
 Typically, the AWS Go SDK should include constants for various status field values (e.g., `StatusCreating` for `CREATING`). If not, create them in a file named `internal/service/{SERVICE}/consts.go`.
diff --git a/docs/running-and-writing-acceptance-tests.md b/docs/running-and-writing-acceptance-tests.md
index a3c9efe2c91..7211783cd98 100644
--- a/docs/running-and-writing-acceptance-tests.md
+++ b/docs/running-and-writing-acceptance-tests.md
@@ -61,8 +61,11 @@ export AWS_DEFAULT_REGION=us-gov-west-1
 Tests can then be run by specifying a regular expression defining the tests to
 run and the package in which the tests are defined:
 
-```sh
-$ make testacc TESTS=TestAccCloudWatchDashboard_updateName PKG=cloudwatch
+```console
+make testacc TESTS=TestAccCloudWatchDashboard_updateName PKG=cloudwatch
+```
+
+```
 ==> Checking that code complies with gofmt requirements...
 TF_ACC=1 go test ./internal/service/cloudwatch/... -v -count 1 -parallel 20 -run=TestAccCloudWatchDashboard_updateName -timeout 180m
 === RUN   TestAccCloudWatchDashboard_updateName
@@ -75,11 +78,14 @@ ok  	github.com/hashicorp/terraform-provider-aws/internal/service/cloudwatch	25.
 
 Entire resource test suites can be targeted by using the naming convention to
 write the regular expression. For example, to run all tests of the
-`aws_cloudwatch_dashboard` resource rather than just the updateName test, you
+`aws_cloudwatch_dashboard` resource rather than just the `updateName` test, you
 can start testing like this:
 
-```sh
-$ make testacc TESTS=TestAccCloudWatchDashboard PKG=cloudwatch
+```console
+make testacc TESTS=TestAccCloudWatchDashboard PKG=cloudwatch
+```
+
+```
 ==> Checking that code complies with gofmt requirements...
 TF_ACC=1 go test ./internal/service/cloudwatch/... -v -count 1 -parallel 20 -run=TestAccCloudWatchDashboard -timeout 180m
 === RUN   TestAccCloudWatchDashboard_basic
@@ -109,7 +115,10 @@ Please Note: On macOS 10.14 and later (and some Linux distributions), the defaul
 Certain testing requires multiple AWS accounts. This additional setup is not typically required and the testing will return an error (shown below) if your current setup does not have the secondary AWS configuration:
 
 ```console
-$ make testacc TESTS=TestAccRDSInstance_DBSubnetGroupName_ramShared PKG=rds
+make testacc TESTS=TestAccRDSInstance_DBSubnetGroupName_ramShared PKG=rds
+```
+
+```
 TF_ACC=1 go test ./internal/service/rds/... -v -count 1 -parallel 20 -run=TestAccRDSInstance_DBSubnetGroupName_ramShared -timeout 180m
 === RUN   TestAccRDSInstance_DBSubnetGroupName_ramShared
 === PAUSE TestAccRDSInstance_DBSubnetGroupName_ramShared
@@ -152,13 +161,13 @@ If you want to run only short-running tests, you can use either one of these equ
 For example:
 
 ```console
-$ make testacc TESTS='TestAccECSTaskDefinition_' PKG=ecs TESTARGS=-short
+make testacc TESTS='TestAccECSTaskDefinition_' PKG=ecs TESTARGS=-short
 ```
 
 Or:
 
 ```console
-$ TF_ACC=1 go test ./internal/service/ecs/... -v -count 1 -parallel 20 -run='TestAccECSTaskDefinition_' -short -timeout 180m
+TF_ACC=1 go test ./internal/service/ecs/... -v -count 1 -parallel 20 -run='TestAccECSTaskDefinition_' -short -timeout 180m
 ```
 
 ## Writing an Acceptance Test
@@ -274,9 +283,9 @@ When executing the test, the following steps are taken for each `TestStep`:
    expected value if possible. The testing framework provides helper functions
    for several common types of check - for example:
 
-    ```go
-    resource.TestCheckResourceAttr("aws_cloudwatch_dashboard.foobar", "dashboard_name", testAccDashboardName(rInt)),
-    ```
+   ```go
+   resource.TestCheckResourceAttr("aws_cloudwatch_dashboard.foobar", "dashboard_name", testAccDashboardName(rInt)),
+   ```
 
 1. The resources created by the test are destroyed. This step happens
    automatically, and is the equivalent of calling `terraform destroy`.
@@ -1001,7 +1010,8 @@ func TestAccExampleThing_serial(t *testing.T) {
 }
 ```
 
-_NOTE: Future iterations of these acceptance testing concurrency instructions will include the ability to handle more than one component at a time including service quota lookup, if supported by the service API._
+!!! note
+    Future iterations of these acceptance testing concurrency instructions will include the ability to handle more than one component at a time including service quota lookup, if supported by the service API.
 
 ### Data Source Acceptance Testing
 
@@ -1066,18 +1076,19 @@ When running the acceptance tests, especially when developing or troubleshooting
 
 ### Running Test Sweepers
 
-**WARNING: Test Sweepers will destroy AWS infrastructure and backups in the target AWS account and region! These are designed to override any API deletion protection. Never run these outside a development AWS account that should be completely empty of resources.**
+!!! warning
+    Test Sweepers will destroy AWS infrastructure and backups in the target AWS account and region! These are designed to override any API deletion protection. Never run these outside a development AWS account that should be completely empty of resources. <!-- markdownlint-disable-line code-block-style -->
 
 To run the sweepers for all resources in `us-west-2` and `us-east-1` (default testing regions):
 
 ```console
-$ make sweep
+make sweep
 ```
 
 To run a specific resource sweeper:
 
 ```console
-$ SWEEPARGS=-sweep-run=aws_example_thing make sweep
+SWEEPARGS=-sweep-run=aws_example_thing make sweep
 ```
 
 To run sweepers with an assumed role, use the following additional environment variables:
@@ -1097,16 +1108,13 @@ To run sweepers with an assumed role, use the following additional environment v
 Sweeper logic should be written to a file called `sweep.go` in the appropriate service subdirectory (`internal/service/{serviceName}`). This file should include the following build tags above the package declaration:
 
 ```go
-//go:build sweep
-// +build sweep
-
 package example
 ```
 
-Next, initialize the resource into the test sweeper framework:
+Next, register the resource into the test sweeper framework:
 
 ```go
-func init() {
+func RegisterSweepers() {
   resource.AddTestSweepers("aws_example_thing", &resource.Sweeper{
     Name: "aws_example_thing",
     F:    sweepThings,
@@ -1123,7 +1131,7 @@ Then add the actual implementation. Preferably, if a paginated SDK call is avail
 ```go
 func sweepThings(region string) error {
   ctx := sweep.Context(region)
-  client, err := sweep.SharedRegionalSweepClient(region)
+  client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
   if err != nil {
     return fmt.Errorf("getting client: %w", err)
@@ -1157,7 +1165,6 @@ func sweepThings(region string) error {
       // Otherwise, do not include it.
       if err != nil {
         err := fmt.Errorf("reading Example Thing (%s): %w", id, err)
-        log.Printf("[ERROR] %s", err)
         errs = multierror.Append(errs, err)
         continue
       }
@@ -1168,29 +1175,30 @@ func sweepThings(region string) error {
     return !lastPage
   })
 
+  if awsv1.SkipSweepError(err) {
+    log.Printf("[WARN] Skipping Example Thing sweep for %s: %s", region, errs)
+    return nil
+  }
   if err != nil {
-    errs = multierror.Append(errs, fmt.Errorf("listing Example Thing for %s: %w", region, err))
+    errs = multierror.Append(errs, fmt.Errorf("listing Example Things for %s: %w", region, err))
   }
 
   if err := sweep.SweepOrchestrator(sweepResources); err != nil {
-    errs = multierror.Append(errs, fmt.Errorf("sweeping Example Thing for %s: %w", region, err))
-  }
-
-  if sweep.SkipSweepError(err) {
-    log.Printf("[WARN] Skipping Example Thing sweep for %s: %s", region, errs)
-    return nil
+    errs = multierror.Append(errs, fmt.Errorf("sweeping Example Things for %s: %w", region, err))
   }
 
   return errs.ErrorOrNil()
 }
 ```
 
-Otherwise, if no paginated SDK call is available:
+If no paginated SDK call is available,
+consider generating one using the [`listpages` generator](https://github.com/hashicorp/terraform-provider-aws/blob/main/internal/generate/listpages/README.md),
+or implement the sweeper as follows:
 
 ```go
 func sweepThings(region string) error {
   ctx := sweep.Context(region)
-  client, err := sweep.SharedRegionalSweepClient(region)
+  client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
   if err != nil {
     return fmt.Errorf("getting client: %w", err)
@@ -1204,6 +1212,14 @@ func sweepThings(region string) error {
 
   for {
     output, err := conn.ListThings(input)
+    if awsv1.SkipSweepError(err) {
+      log.Printf("[WARN] Skipping Example Thing sweep for %s: %s", region, errs)
+      return nil
+    }
+    if err != nil {
+      errs = multierror.Append(errs, fmt.Errorf("listing Example Things for %s: %w", region, err))
+      return errs.ErrorOrNil()
+    }
 
     for _, thing := range output.Things {
       r := ResourceThing()
@@ -1222,7 +1238,6 @@ func sweepThings(region string) error {
       // Otherwise, do not include it.
       if err != nil {
         err := fmt.Errorf("reading Example Thing (%s): %w", id, err)
-        log.Printf("[ERROR] %s", err)
         errs = multierror.Append(errs, err)
         continue
       }
@@ -1241,11 +1256,6 @@ func sweepThings(region string) error {
     errs = multierror.Append(errs, fmt.Errorf("sweeping Example Thing for %s: %w", region, err))
   }
 
-  if sweep.SkipSweepError(err) {
-    log.Printf("[WARN] Skipping Example Thing sweep for %s: %s", region, errs)
-    return nil
-  }
-
   return errs.ErrorOrNil()
 }
 ```
diff --git a/docs/skaff.md b/docs/skaff.md
index c0f56e1c20b..6580768fc3f 100644
--- a/docs/skaff.md
+++ b/docs/skaff.md
@@ -5,31 +5,40 @@
 ## Overview workflow steps
 
 1. Figure out what you're trying to do:
-    * Create a resource or a data source?
-    * [AWS Go SDK v1 or v2](aws-go-sdk-versions.md) code?
-    * [Terraform Plugin Framework or Plugin SDKv2](terraform-plugin-versions.md) based?
-    * [Name](naming.md) of the new resource or data source?
-2. Use `skaff` to generate provider code
-3. Go through the generated code completing code and customizing for the AWS Go SDK API
-4. Run, test, refine
-5. Remove "TIP" comments
-6. Submit code in pull request
+    * Resource or data source?
+    * [Name it](naming.md)
+    !!! tip
+        Net-new resources should be implemented with AWS SDK Go V2 and the Terraform Plugin Framework (e.g. the default `skaff` settings).
+        See [AWS Go SDK Versions](aws-go-sdk-versions.md), [Terraform Plugin Development Packages](terraform-plugin-development-packages.md), and [this issue](https://github.com/hashicorp/terraform-provider-aws/issues/32917) for additional information.
+1. Use `skaff` to generate provider code
+1. Go through the generated code completing code and customizing for the AWS Go SDK API
+1. Run, test, refine
+1. Remove "TIP" comments
+1. Submit code in pull request
 
 ## Running `skaff`
 
-1. Use Git to clone the GitHub [https://github.com/hashicorp/terraform-provider-aws](https://github.com/hashicorp/terraform-provider-aws) repository.
-2. `cd skaff`
-3. `go install .`
-4. Change directories to the service where your new resource will reside. _E.g._, `cd ../internal/service/mq`.
-5. To get help, enter `skaff` without arguments.
-6. Generate a resource. _E.g._, `skaff resource --name BrokerReboot` (or equivalently `skaff resource -n BrokerReboot`).
+1. Clone the [Terraform AWS Provider](https://github.com/hashicorp/terraform-provider-aws) repository.
+1. Install skaff
+
+    ```sh
+    make skaff
+    ```
+
+1. Change directories to the service where your new resource will reside. _E.g._, `cd internal/service/mq`.
+1. Generate a resource. _E.g._, `skaff resource --name BrokerReboot` (or equivalently `skaff resource -n BrokerReboot`).
+
+To get help, enter `skaff` without arguments.
 
 ## Usage
 
 ### Help
 
 ```console
-$ skaff --help
+skaff --help
+```
+
+```
 Usage:
   skaff [command]
 
@@ -48,7 +57,10 @@ Flags:
 Generate the autocompletion script for skaff for the specified shell
 
 ```console
-$ skaff completion --help
+skaff completion --help
+```
+
+```
 Usage:
   skaff completion [command]
 
@@ -69,7 +81,12 @@ Use "skaff completion [command] --help" for more information about a command
 Create scaffolding for a data source
 
 ```console
-$ skaff datasource --help
+skaff datasource --help
+```
+
+```
+Create scaffolding for a data source
+
 Usage:
   skaff datasource [flags]
 
@@ -77,8 +94,9 @@ Flags:
   -c, --clear-comments     do not include instructional comments in source
   -f, --force              force creation, overwriting existing files
   -h, --help               help for datasource
+  -t, --include-tags       Indicate that this resource has tags and the code for tagging should be generated
   -n, --name string        name of the entity
-  -p, --plugin-framework   generate for Terraform Plugin-Framework
+  -p, --plugin-sdkv2       generate for Terraform Plugin SDK V2
   -s, --snakename string   if skaff doesn't get it right, explicitly give name in snake case (e.g., db_vpc_instance)
   -o, --v1                 generate for AWS Go SDK v1 (some existing services)
 ```
@@ -88,7 +106,12 @@ Flags:
 Create scaffolding for a resource
 
 ```console
-$ skaff resource --help
+skaff resource --help
+```
+
+```
+Create scaffolding for a resource
+
 Usage:
   skaff resource [flags]
 
@@ -96,8 +119,9 @@ Flags:
   -c, --clear-comments     do not include instructional comments in source
   -f, --force              force creation, overwriting existing files
   -h, --help               help for resource
+  -t, --include-tags       Indicate that this resource has tags and the code for tagging should be generated
   -n, --name string        name of the entity
-  -p, --plugin-framework   generate for Terraform Plugin-Framework
+  -p, --plugin-sdkv2       generate for Terraform Plugin SDK V2
   -s, --snakename string   if skaff doesn't get it right, explicitly give name in snake case (e.g., db_vpc_instance)
   -o, --v1                 generate for AWS Go SDK v1 (some existing services)
 ```
diff --git a/docs/stylesheets/extra.css b/docs/stylesheets/extra.css
index 5499fe3f073..1f666ea4d75 100644
--- a/docs/stylesheets/extra.css
+++ b/docs/stylesheets/extra.css
@@ -1,3 +1,8 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
 .md-footer__inner:not([hidden]) {
     display: none
 }
\ No newline at end of file
diff --git a/docs/terraform-plugin-development-packages.md b/docs/terraform-plugin-development-packages.md
new file mode 100644
index 00000000000..9a31a863e49
--- /dev/null
+++ b/docs/terraform-plugin-development-packages.md
@@ -0,0 +1,14 @@
+# Terraform Plugin Development Packages
+
+The Terraform AWS Provider is constructed with HashiCorp-maintained packages for building plugins.
+Most existing resources are implemented with [Terraform Plugin SDK V2](https://developer.hashicorp.com/terraform/plugin/sdkv2), while newer resources use [Terraform Plugin Framework](https://developer.hashicorp.com/terraform/plugin/framework).
+A thorough comparison of the packages can be found [here](https://developer.hashicorp.com/terraform/plugin/framework-benefits).
+
+## Which Plugin Version Should I Use?
+
+At this time net-new contributions are **required to use Terraform Plugin Framework**.
+Enhancements or bug fixes to existing Plugin SDKv2 based resources do not require migration.
+The AWS Provider is [muxed](https://developer.hashicorp.com/terraform/plugin/framework/migrating/mux) to allow existing Terraform Plugin SDK V2 resources and data sources to remain alongside newer Plugin Framework based resources.
+
+[`skaff`](skaff.md) will generate Plugin Framework based resources by default, though for exceptional cases the optional `-p`/`--plugin-sdkv2` flag can be used.
+Where applicable, the contributor guide has been updated to include examples with both Terraform Plugin Framework and Terraform Plugin SDK V2.
diff --git a/docs/terraform-plugin-versions.md b/docs/terraform-plugin-versions.md
deleted file mode 100644
index c3e7f679024..00000000000
--- a/docs/terraform-plugin-versions.md
+++ /dev/null
@@ -1,9 +0,0 @@
-# Terraform Plugin Versions
-
-The Terraform AWS Provider is constructed with HashiCorp-maintained packages for building plugins. Most existing resources are implemented with [Terraform Plugin SDKv2](https://developer.hashicorp.com/terraform/plugin/sdkv2), while newer resources may use [Terraform Plugin Framework](https://developer.hashicorp.com/terraform/plugin/framework). A thorough comparison of the packages can be found [here](https://developer.hashicorp.com/terraform/plugin/framework-benefits).
-
-At this time community contributions in either package will be accepted. The AWS Provider is [muxed](https://developer.hashicorp.com/terraform/plugin/framework/migrating/mux) to allow resources and data sources implemented in both packages. As AWS Provider tooling around Plugin Framework (and the library itself) matures, we will being requiring all net-new resources be implemented with it. [`skaff`](skaff.md) currently supports generating Plugin Framework based resources using the optional `-p`/`--plugin-framework` flag. Factors to consider when choosing between packages are:
-
-1. What other resources in a given service use
-2. Level of comfort with the new idioms introduced in Plugin Framework
-3. [Advantages](https://developer.hashicorp.com/terraform/plugin/framework-benefits#plugin-framework-benefits) Plugin Framework may afford over Plugin SDKv2 (improved null handling, plan modifications, etc.)
diff --git a/examples/README.md b/examples/README.md
index dce48475c3b..bacd13ee677 100644
--- a/examples/README.md
+++ b/examples/README.md
@@ -9,9 +9,9 @@ the example's own directory.
 
 For example:
 
-```
-$ git clone https://github.com/hashicorp/terraform-provider-aws
-$ cd terraform-provider-aws/examples/two-tier
-$ terraform apply
+```console
+% git clone https://github.com/hashicorp/terraform-provider-aws
+% cd terraform-provider-aws/examples/two-tier
+% terraform apply
 ...
 ```
diff --git a/examples/alexa/main.tf b/examples/alexa/main.tf
index 71ce061b0b5..5c86d4d079c 100644
--- a/examples/alexa/main.tf
+++ b/examples/alexa/main.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 terraform {
   required_version = ">= 0.12"
 }
diff --git a/examples/alexa/outputs.tf b/examples/alexa/outputs.tf
index 6df79e495fa..4fee8c59ccf 100644
--- a/examples/alexa/outputs.tf
+++ b/examples/alexa/outputs.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 output "aws_lambda_function_arn" {
   value = aws_lambda_function.default.arn
 }
diff --git a/examples/alexa/variables.tf b/examples/alexa/variables.tf
index 78938923066..cc7ed572e0e 100644
--- a/examples/alexa/variables.tf
+++ b/examples/alexa/variables.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 variable "aws_region" {
   description = "The AWS region to create things in."
   default     = "us-east-1"
diff --git a/examples/api-gateway-rest-api-openapi/domain.tf b/examples/api-gateway-rest-api-openapi/domain.tf
index ef56e11d8f6..6c00b2d9b78 100644
--- a/examples/api-gateway-rest-api-openapi/domain.tf
+++ b/examples/api-gateway-rest-api-openapi/domain.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 #
 # Domain Setup
 #
diff --git a/examples/api-gateway-rest-api-openapi/main.tf b/examples/api-gateway-rest-api-openapi/main.tf
index 1b8857c5dc8..5ce07f02740 100644
--- a/examples/api-gateway-rest-api-openapi/main.tf
+++ b/examples/api-gateway-rest-api-openapi/main.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 terraform {
   required_version = ">= 0.12"
 }
diff --git a/examples/api-gateway-rest-api-openapi/outputs.tf b/examples/api-gateway-rest-api-openapi/outputs.tf
index a144a5b4c11..eb4751cd5a7 100644
--- a/examples/api-gateway-rest-api-openapi/outputs.tf
+++ b/examples/api-gateway-rest-api-openapi/outputs.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 #
 # Outputs
 #
diff --git a/examples/api-gateway-rest-api-openapi/rest-api.tf b/examples/api-gateway-rest-api-openapi/rest-api.tf
index 9d73af6e35a..94130fa078a 100644
--- a/examples/api-gateway-rest-api-openapi/rest-api.tf
+++ b/examples/api-gateway-rest-api-openapi/rest-api.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 resource "aws_api_gateway_rest_api" "example" {
   body = jsonencode({
     openapi = "3.0.1"
diff --git a/examples/api-gateway-rest-api-openapi/stage.tf b/examples/api-gateway-rest-api-openapi/stage.tf
index aa5e5a83f57..637ca3b7290 100644
--- a/examples/api-gateway-rest-api-openapi/stage.tf
+++ b/examples/api-gateway-rest-api-openapi/stage.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 #
 # Stage and Stage Settings
 #
diff --git a/examples/api-gateway-rest-api-openapi/terraform.template.tfvars b/examples/api-gateway-rest-api-openapi/terraform.template.tfvars
index 897df7521d4..6eb16abd87a 100644
--- a/examples/api-gateway-rest-api-openapi/terraform.template.tfvars
+++ b/examples/api-gateway-rest-api-openapi/terraform.template.tfvars
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 aws_region           = "us-west-2"
 rest_api_domain_name = "example.com"
 rest_api_name        = "api-gateway-rest-api-openapi-example"
diff --git a/examples/api-gateway-rest-api-openapi/tls.tf b/examples/api-gateway-rest-api-openapi/tls.tf
index b1e3ee73459..c5dcfbef1e7 100644
--- a/examples/api-gateway-rest-api-openapi/tls.tf
+++ b/examples/api-gateway-rest-api-openapi/tls.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 #
 # Self-Signed TLS Certificate for Testing
 #
diff --git a/examples/api-gateway-rest-api-openapi/variables.tf b/examples/api-gateway-rest-api-openapi/variables.tf
index 1a47ff7f712..608e49fee75 100644
--- a/examples/api-gateway-rest-api-openapi/variables.tf
+++ b/examples/api-gateway-rest-api-openapi/variables.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 variable "aws_region" {
   default     = "us-west-2"
   description = "AWS Region to deploy example API Gateway REST API"
diff --git a/examples/api-gateway-websocket-chat-app/main.tf b/examples/api-gateway-websocket-chat-app/main.tf
index d8bd0904263..bb11bb3d1b4 100644
--- a/examples/api-gateway-websocket-chat-app/main.tf
+++ b/examples/api-gateway-websocket-chat-app/main.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 #
 # Terraform configuration for simple-websockets-chat-app that has the DynamoDB table and
 # Lambda functions needed to demonstrate the Websocket protocol on API Gateway.
diff --git a/examples/api-gateway-websocket-chat-app/terraform.template.tfvars b/examples/api-gateway-websocket-chat-app/terraform.template.tfvars
index bb891daf459..a80912583cf 100644
--- a/examples/api-gateway-websocket-chat-app/terraform.template.tfvars
+++ b/examples/api-gateway-websocket-chat-app/terraform.template.tfvars
@@ -1 +1,4 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 aws_region = "us-east-1"
diff --git a/examples/api-gateway-websocket-chat-app/variables.tf b/examples/api-gateway-websocket-chat-app/variables.tf
index e4f8705a6ac..d5d8f13b4f1 100644
--- a/examples/api-gateway-websocket-chat-app/variables.tf
+++ b/examples/api-gateway-websocket-chat-app/variables.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 variable "aws_region" {
   description = "AWS region"
   default     = "us-west-2"
diff --git a/examples/asg/main.tf b/examples/asg/main.tf
index 58db7486c4c..6fa6e49e072 100644
--- a/examples/asg/main.tf
+++ b/examples/asg/main.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 terraform {
   required_version = ">= 0.12"
 }
diff --git a/examples/asg/outputs.tf b/examples/asg/outputs.tf
index 0f5acfd9d53..2456734d556 100644
--- a/examples/asg/outputs.tf
+++ b/examples/asg/outputs.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 output "security_group" {
   value = aws_security_group.default.id
 }
diff --git a/examples/asg/terraform.template.tfvars b/examples/asg/terraform.template.tfvars
index ac1a6a47e57..a251042dc11 100644
--- a/examples/asg/terraform.template.tfvars
+++ b/examples/asg/terraform.template.tfvars
@@ -1 +1,4 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 key_name = "terraform-aws-provider-example"
diff --git a/examples/asg/userdata.sh b/examples/asg/userdata.sh
index 77e340b3abf..586a583cbe6 100644
--- a/examples/asg/userdata.sh
+++ b/examples/asg/userdata.sh
@@ -1,3 +1,6 @@
 #!/bin/bash -v
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 apt-get update -y
 apt-get install -y nginx > /tmp/nginx.log
diff --git a/examples/asg/variables.tf b/examples/asg/variables.tf
index d45c10d2524..af40e9392bc 100644
--- a/examples/asg/variables.tf
+++ b/examples/asg/variables.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 variable "aws_region" {
   description = "The AWS region to create things in."
   default     = "us-east-1"
diff --git a/examples/cleanrooms/main.tf b/examples/cleanrooms/main.tf
new file mode 100644
index 00000000000..c1fea30869f
--- /dev/null
+++ b/examples/cleanrooms/main.tf
@@ -0,0 +1,55 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
+terraform {
+  required_version = ">= 0.12"
+}
+
+provider "aws" {
+  region = "us-east-1"
+}
+
+resource "aws_cleanrooms_collaboration" "test_collab" {
+  name                     = "terraform-example-collaboration"
+  creator_member_abilities = ["CAN_QUERY", "CAN_RECEIVE_RESULTS"]
+  creator_display_name     = "Creator "
+  description              = "I made this collaboration with terraform!"
+  query_log_status         = "DISABLED"
+
+  data_encryption_metadata {
+    allow_clear_text                            = true
+    allow_duplicates                            = true
+    allow_joins_on_columns_with_different_names = true
+    preserve_nulls                              = false
+  }
+
+  member {
+    account_id       = 123456789012
+    display_name     = "Other member"
+    member_abilities = []
+  }
+
+  tags = {
+    Project = "Terraform"
+  }
+}
+
+resource "aws_cleanrooms_configured_table" "test_configured_table" {
+  name            = "terraform-example-table"
+  description     = "I made this table with terraform!"
+  analysis_method = "DIRECT_QUERY"
+  allowed_columns = [
+    "column1",
+    "column2",
+    "column3",
+  ]
+
+  table_reference {
+    database_name = "example_database"
+    table_name    = "example_table"
+  }
+
+  tags = {
+    Project = "Terraform"
+  }
+}
diff --git a/examples/cloudhsm/main.tf b/examples/cloudhsm/main.tf
index 9887b008441..09971d11b23 100644
--- a/examples/cloudhsm/main.tf
+++ b/examples/cloudhsm/main.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 terraform {
   required_version = ">= 0.12"
 }
diff --git a/examples/cloudhsm/outputs.tf b/examples/cloudhsm/outputs.tf
index a3490dc600d..dd07a1b57e5 100644
--- a/examples/cloudhsm/outputs.tf
+++ b/examples/cloudhsm/outputs.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 output "hsm_ip_address" {
   value = aws_cloudhsm_v2_hsm.cloudhsm_v2_hsm.ip_address
 }
diff --git a/examples/cloudhsm/variables.tf b/examples/cloudhsm/variables.tf
index 74e618c20cf..28180c92919 100644
--- a/examples/cloudhsm/variables.tf
+++ b/examples/cloudhsm/variables.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 variable "aws_region" {
   description = "AWS region to launch cloudHSM cluster."
   default     = "eu-west-1"
diff --git a/examples/cognito-user-pool/main.tf b/examples/cognito-user-pool/main.tf
index c03439368cf..c3d6b2bff66 100644
--- a/examples/cognito-user-pool/main.tf
+++ b/examples/cognito-user-pool/main.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 terraform {
   required_version = ">= 0.12"
 }
diff --git a/examples/cognito-user-pool/variables.tf b/examples/cognito-user-pool/variables.tf
index 8478c23b1a0..58de427606d 100644
--- a/examples/cognito-user-pool/variables.tf
+++ b/examples/cognito-user-pool/variables.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 variable "aws_region" {
   default = "us-west-2"
 }
diff --git a/examples/count/main.tf b/examples/count/main.tf
index 7b24636313c..3c6fbcd72c1 100644
--- a/examples/count/main.tf
+++ b/examples/count/main.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 terraform {
   required_version = ">= 0.12"
 }
diff --git a/examples/count/outputs.tf b/examples/count/outputs.tf
index 8e1fa6cf08b..0561b14057f 100644
--- a/examples/count/outputs.tf
+++ b/examples/count/outputs.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 output "address" {
   value = "Instances: ${element(aws_instance.web[*].id, 0)}"
 }
diff --git a/examples/count/variables.tf b/examples/count/variables.tf
index 3cb51b2e1b3..c0503d62e1c 100644
--- a/examples/count/variables.tf
+++ b/examples/count/variables.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 variable "aws_region" {
   description = "The AWS region to create things in."
   default     = "us-west-2"
diff --git a/examples/dx-gateway-cross-account-vgw-association/main.tf b/examples/dx-gateway-cross-account-vgw-association/main.tf
index b5b6a84adde..ec1759fa020 100644
--- a/examples/dx-gateway-cross-account-vgw-association/main.tf
+++ b/examples/dx-gateway-cross-account-vgw-association/main.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 terraform {
   required_version = ">= 0.12"
 }
diff --git a/examples/dx-gateway-cross-account-vgw-association/terraform.template.tfvars b/examples/dx-gateway-cross-account-vgw-association/terraform.template.tfvars
index 7c099c2e978..ce85942a8da 100644
--- a/examples/dx-gateway-cross-account-vgw-association/terraform.template.tfvars
+++ b/examples/dx-gateway-cross-account-vgw-association/terraform.template.tfvars
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 # First account
 aws_first_access_key = "AAAAAAAAAAAAAAAAAAA"
 aws_first_secret_key = "SuperSecretKeyForAccount1"
diff --git a/examples/dx-gateway-cross-account-vgw-association/variables.tf b/examples/dx-gateway-cross-account-vgw-association/variables.tf
index 5f1601468ae..a3fb1c2ab27 100644
--- a/examples/dx-gateway-cross-account-vgw-association/variables.tf
+++ b/examples/dx-gateway-cross-account-vgw-association/variables.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 variable "aws_first_access_key" {}
 
 variable "aws_first_secret_key" {}
diff --git a/examples/ecs-alb/cloud-config.yml b/examples/ecs-alb/cloud-config.yml
index 002295a4f6c..db7411c8cbd 100644
--- a/examples/ecs-alb/cloud-config.yml
+++ b/examples/ecs-alb/cloud-config.yml
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 # cloud-config
 coreos:
   units:
diff --git a/examples/ecs-alb/main.tf b/examples/ecs-alb/main.tf
index 18d03b8c7d9..749e655ec6d 100644
--- a/examples/ecs-alb/main.tf
+++ b/examples/ecs-alb/main.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 terraform {
   required_version = ">= 0.12"
 }
diff --git a/examples/ecs-alb/outputs.tf b/examples/ecs-alb/outputs.tf
index 980e04a4101..5c66510465f 100644
--- a/examples/ecs-alb/outputs.tf
+++ b/examples/ecs-alb/outputs.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 output "instance_security_group" {
   value = aws_security_group.instance_sg.id
 }
diff --git a/examples/ecs-alb/terraform.template.tfvars b/examples/ecs-alb/terraform.template.tfvars
index 78c37be0e45..652d82221da 100644
--- a/examples/ecs-alb/terraform.template.tfvars
+++ b/examples/ecs-alb/terraform.template.tfvars
@@ -1,2 +1,5 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 admin_cidr_ingress = "1.2.3.4/32"
 key_name           = "terraform-aws-provider-example"
diff --git a/examples/ecs-alb/variables.tf b/examples/ecs-alb/variables.tf
index 92aef28f207..db4d9929e27 100644
--- a/examples/ecs-alb/variables.tf
+++ b/examples/ecs-alb/variables.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 variable "aws_region" {
   description = "The AWS region to create things in."
   default     = "us-west-2"
diff --git a/examples/eip/main.tf b/examples/eip/main.tf
index 95a5e79ad2d..b494c52d72c 100644
--- a/examples/eip/main.tf
+++ b/examples/eip/main.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 terraform {
   required_version = ">= 0.12"
 }
diff --git a/examples/eip/outputs.tf b/examples/eip/outputs.tf
index d80cbbadd44..dd00e1181de 100644
--- a/examples/eip/outputs.tf
+++ b/examples/eip/outputs.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 output "address" {
   value = aws_instance.web.private_ip
 }
diff --git a/examples/eip/terraform.template.tfvars b/examples/eip/terraform.template.tfvars
index ac1a6a47e57..a251042dc11 100644
--- a/examples/eip/terraform.template.tfvars
+++ b/examples/eip/terraform.template.tfvars
@@ -1 +1,4 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 key_name = "terraform-aws-provider-example"
diff --git a/examples/eip/userdata.sh b/examples/eip/userdata.sh
index 8a058c78617..670a272dbeb 100644
--- a/examples/eip/userdata.sh
+++ b/examples/eip/userdata.sh
@@ -1,4 +1,7 @@
 #!/bin/bash -v
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 apt-get update -y
 apt-get install -y nginx > /tmp/nginx.log
 
diff --git a/examples/eip/variables.tf b/examples/eip/variables.tf
index 400301d5fc8..2d3131bfa1b 100644
--- a/examples/eip/variables.tf
+++ b/examples/eip/variables.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 variable "aws_region" {
   description = "The AWS region to create things in."
   default     = "us-east-1"
diff --git a/examples/eks-getting-started/eks-cluster.tf b/examples/eks-getting-started/eks-cluster.tf
index 36ba135b07c..0cb83e6afc1 100644
--- a/examples/eks-getting-started/eks-cluster.tf
+++ b/examples/eks-getting-started/eks-cluster.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 #
 # EKS Cluster Resources
 #  * IAM Role to allow EKS service to manage other AWS services
diff --git a/examples/eks-getting-started/eks-worker-nodes.tf b/examples/eks-getting-started/eks-worker-nodes.tf
index 7121d198338..c437d0ca652 100644
--- a/examples/eks-getting-started/eks-worker-nodes.tf
+++ b/examples/eks-getting-started/eks-worker-nodes.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 #
 # EKS Worker Nodes Resources
 #  * IAM role allowing Kubernetes actions to access other AWS services
diff --git a/examples/eks-getting-started/outputs.tf b/examples/eks-getting-started/outputs.tf
index f3889268554..ab762dccb3e 100644
--- a/examples/eks-getting-started/outputs.tf
+++ b/examples/eks-getting-started/outputs.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 #
 # Outputs
 #
diff --git a/examples/eks-getting-started/providers.tf b/examples/eks-getting-started/providers.tf
index 5620f4f2eab..24be793dd5d 100644
--- a/examples/eks-getting-started/providers.tf
+++ b/examples/eks-getting-started/providers.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 terraform {
   required_version = ">= 0.12"
 }
diff --git a/examples/eks-getting-started/variables.tf b/examples/eks-getting-started/variables.tf
index 265111500a5..c1a9225265a 100644
--- a/examples/eks-getting-started/variables.tf
+++ b/examples/eks-getting-started/variables.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 variable "aws_region" {
   default = "us-west-2"
 }
diff --git a/examples/eks-getting-started/vpc.tf b/examples/eks-getting-started/vpc.tf
index 99e26b7fa47..84a6d094cf2 100644
--- a/examples/eks-getting-started/vpc.tf
+++ b/examples/eks-getting-started/vpc.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 #
 # VPC Resources
 #  * VPC
diff --git a/examples/eks-getting-started/workstation-external-ip.tf b/examples/eks-getting-started/workstation-external-ip.tf
index 9cf0644ad0a..608e6dfbcd7 100644
--- a/examples/eks-getting-started/workstation-external-ip.tf
+++ b/examples/eks-getting-started/workstation-external-ip.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 #
 # Workstation External IP
 #
diff --git a/examples/elasticsearch-domain/main.tf b/examples/elasticsearch-domain/main.tf
index b7149638350..d300c74430a 100644
--- a/examples/elasticsearch-domain/main.tf
+++ b/examples/elasticsearch-domain/main.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 terraform {
   required_version = ">= 0.12"
 }
diff --git a/examples/elasticsearch-domain/variables.tf b/examples/elasticsearch-domain/variables.tf
index c7ec1f2bfab..9c7027c31fa 100644
--- a/examples/elasticsearch-domain/variables.tf
+++ b/examples/elasticsearch-domain/variables.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 variable "aws_region" {
   default = "us-west-2"
 }
diff --git a/examples/elb/main.tf b/examples/elb/main.tf
index 37da5121af2..5c4f8e4cd65 100644
--- a/examples/elb/main.tf
+++ b/examples/elb/main.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 terraform {
   required_version = ">= 0.12"
 }
diff --git a/examples/elb/outputs.tf b/examples/elb/outputs.tf
index 2c535bb7283..b57b1a52a60 100644
--- a/examples/elb/outputs.tf
+++ b/examples/elb/outputs.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 output "address" {
   value = aws_elb.web.dns_name
 }
diff --git a/examples/elb/terraform.template.tfvars b/examples/elb/terraform.template.tfvars
index ac1a6a47e57..a251042dc11 100644
--- a/examples/elb/terraform.template.tfvars
+++ b/examples/elb/terraform.template.tfvars
@@ -1 +1,4 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 key_name = "terraform-aws-provider-example"
diff --git a/examples/elb/userdata.sh b/examples/elb/userdata.sh
index 8a058c78617..670a272dbeb 100644
--- a/examples/elb/userdata.sh
+++ b/examples/elb/userdata.sh
@@ -1,4 +1,7 @@
 #!/bin/bash -v
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 apt-get update -y
 apt-get install -y nginx > /tmp/nginx.log
 
diff --git a/examples/elb/variables.tf b/examples/elb/variables.tf
index 2f9175fc845..6ea74b1599d 100644
--- a/examples/elb/variables.tf
+++ b/examples/elb/variables.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 variable "key_name" {
   description = "Name of the SSH keypair to use in AWS."
 }
diff --git a/examples/events/kinesis/main.tf b/examples/events/kinesis/main.tf
index 93b171e5b86..0886745d24e 100644
--- a/examples/events/kinesis/main.tf
+++ b/examples/events/kinesis/main.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 terraform {
   required_version = ">= 0.12"
 }
diff --git a/examples/events/kinesis/outputs.tf b/examples/events/kinesis/outputs.tf
index 81bcbf4fec3..280a35a919d 100644
--- a/examples/events/kinesis/outputs.tf
+++ b/examples/events/kinesis/outputs.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 output "rule_arn" {
   value = aws_cloudwatch_event_rule.foo.arn
 }
diff --git a/examples/events/kinesis/variables.tf b/examples/events/kinesis/variables.tf
index 8ec330ad0aa..58efda3c542 100644
--- a/examples/events/kinesis/variables.tf
+++ b/examples/events/kinesis/variables.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 variable "aws_region" {
   description = "The AWS region to create resources in."
   default     = "us-east-1"
diff --git a/examples/events/sns/main.tf b/examples/events/sns/main.tf
index 2d93090b651..a9c8f1003de 100644
--- a/examples/events/sns/main.tf
+++ b/examples/events/sns/main.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 terraform {
   required_version = ">= 0.12"
 }
diff --git a/examples/events/sns/outputs.tf b/examples/events/sns/outputs.tf
index 7b92f327847..abfa0b78f52 100644
--- a/examples/events/sns/outputs.tf
+++ b/examples/events/sns/outputs.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 output "rule_arn" {
   value = aws_cloudwatch_event_rule.foo.arn
 }
diff --git a/examples/events/sns/variables.tf b/examples/events/sns/variables.tf
index 55708304946..5db0ec59bc0 100644
--- a/examples/events/sns/variables.tf
+++ b/examples/events/sns/variables.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 variable "aws_region" {
   description = "The AWS region to create resources in."
   default     = "us-east-1"
diff --git a/examples/ivs/main.tf b/examples/ivs/main.tf
index e345afe8832..99bfae6508a 100644
--- a/examples/ivs/main.tf
+++ b/examples/ivs/main.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 terraform {
   required_version = ">= 0.12"
 }
diff --git a/examples/ivs/outputs.tf b/examples/ivs/outputs.tf
index 77c08baa0df..41d0f80390f 100644
--- a/examples/ivs/outputs.tf
+++ b/examples/ivs/outputs.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 output "ingest_endpoint" {
   value = aws_ivs_channel.example.ingest_endpoint
 }
diff --git a/examples/ivs/variables.tf b/examples/ivs/variables.tf
index 3cb51b2e1b3..c0503d62e1c 100644
--- a/examples/ivs/variables.tf
+++ b/examples/ivs/variables.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 variable "aws_region" {
   description = "The AWS region to create things in."
   default     = "us-west-2"
diff --git a/examples/ivschat/index.js b/examples/ivschat/index.js
index 424368493cf..199095006ed 100644
--- a/examples/ivschat/index.js
+++ b/examples/ivschat/index.js
@@ -1,3 +1,8 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
 /** IVS Chat message review handler */
 exports.handler = async function ({ Content }) {
     return {
diff --git a/examples/ivschat/main.tf b/examples/ivschat/main.tf
index 2fb971f39ca..4c84a94b705 100644
--- a/examples/ivschat/main.tf
+++ b/examples/ivschat/main.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 terraform {
   required_version = ">= 0.12"
 }
diff --git a/examples/ivschat/outputs.tf b/examples/ivschat/outputs.tf
index 46fe6da522f..6e667a8b02b 100644
--- a/examples/ivschat/outputs.tf
+++ b/examples/ivschat/outputs.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 output "room" {
   value = aws_ivschat_room.example.arn
 }
diff --git a/examples/ivschat/variables.tf b/examples/ivschat/variables.tf
index 3cb51b2e1b3..c0503d62e1c 100644
--- a/examples/ivschat/variables.tf
+++ b/examples/ivschat/variables.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 variable "aws_region" {
   description = "The AWS region to create things in."
   default     = "us-west-2"
diff --git a/examples/lambda-file-systems/hello_lambda.py b/examples/lambda-file-systems/hello_lambda.py
index 5c28c83973f..4cbc976a94e 100644
--- a/examples/lambda-file-systems/hello_lambda.py
+++ b/examples/lambda-file-systems/hello_lambda.py
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 from datetime import datetime
 
 
diff --git a/examples/lambda-file-systems/main.tf b/examples/lambda-file-systems/main.tf
index cc1f7ee7be1..2bb19f69952 100644
--- a/examples/lambda-file-systems/main.tf
+++ b/examples/lambda-file-systems/main.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 terraform {
   required_version = ">= 0.12"
 }
diff --git a/examples/lambda-file-systems/outputs.tf b/examples/lambda-file-systems/outputs.tf
index 09bd3465c66..d1f4009e592 100644
--- a/examples/lambda-file-systems/outputs.tf
+++ b/examples/lambda-file-systems/outputs.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 output "lambda" {
   value = aws_lambda_function.example_lambda.qualified_arn
 }
diff --git a/examples/lambda-file-systems/variables.tf b/examples/lambda-file-systems/variables.tf
index 78938923066..cc7ed572e0e 100644
--- a/examples/lambda-file-systems/variables.tf
+++ b/examples/lambda-file-systems/variables.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 variable "aws_region" {
   description = "The AWS region to create things in."
   default     = "us-east-1"
diff --git a/examples/lambda/hello_lambda.py b/examples/lambda/hello_lambda.py
index 3c3b6bf9a23..14c25cb1dc3 100644
--- a/examples/lambda/hello_lambda.py
+++ b/examples/lambda/hello_lambda.py
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 import os
 
 def lambda_handler(event, context):
diff --git a/examples/lambda/main.tf b/examples/lambda/main.tf
index fd42442715d..7f71cbba226 100644
--- a/examples/lambda/main.tf
+++ b/examples/lambda/main.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 terraform {
   required_version = ">= 0.12"
 }
diff --git a/examples/lambda/outputs.tf b/examples/lambda/outputs.tf
index c743dc353c8..be68094c8ae 100644
--- a/examples/lambda/outputs.tf
+++ b/examples/lambda/outputs.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 output "lambda" {
   value = aws_lambda_function.lambda.qualified_arn
 }
diff --git a/examples/lambda/variables.tf b/examples/lambda/variables.tf
index 78938923066..cc7ed572e0e 100644
--- a/examples/lambda/variables.tf
+++ b/examples/lambda/variables.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 variable "aws_region" {
   description = "The AWS region to create things in."
   default     = "us-east-1"
diff --git a/examples/networking/region/outputs.tf b/examples/networking/region/outputs.tf
index 22afed18e26..d84d3f7dd02 100644
--- a/examples/networking/region/outputs.tf
+++ b/examples/networking/region/outputs.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 output "vpc_id" {
   value = aws_vpc.main.id
 }
diff --git a/examples/networking/region/security_group.tf b/examples/networking/region/security_group.tf
index 5221798506d..c66092f01cf 100644
--- a/examples/networking/region/security_group.tf
+++ b/examples/networking/region/security_group.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 resource "aws_security_group" "region" {
   name        = "region"
   description = "Open access within this region"
diff --git a/examples/networking/region/subnets.tf b/examples/networking/region/subnets.tf
index 78a3064d413..e6583c87ac6 100644
--- a/examples/networking/region/subnets.tf
+++ b/examples/networking/region/subnets.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 data "aws_availability_zones" "all" {}
 
 module "primary_subnet" {
diff --git a/examples/networking/region/terraform.template.tfvars b/examples/networking/region/terraform.template.tfvars
index 9304a92ab0b..07a1f0f6019 100644
--- a/examples/networking/region/terraform.template.tfvars
+++ b/examples/networking/region/terraform.template.tfvars
@@ -1,2 +1,5 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 base_cidr_block = "10.0.0.0/16"
 region          = "us-west-2"
diff --git a/examples/networking/region/variables.tf b/examples/networking/region/variables.tf
index a115c628277..8f7bf6b4609 100644
--- a/examples/networking/region/variables.tf
+++ b/examples/networking/region/variables.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 variable "region" {
   description = "The name of the AWS region to set up a network within"
 }
diff --git a/examples/networking/region/versions.tf b/examples/networking/region/versions.tf
index ac97c6ac8e7..83878d7b561 100644
--- a/examples/networking/region/versions.tf
+++ b/examples/networking/region/versions.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 
 terraform {
   required_version = ">= 0.12"
diff --git a/examples/networking/region/vpc.tf b/examples/networking/region/vpc.tf
index 387263d0b2d..4e5df1a7951 100644
--- a/examples/networking/region/vpc.tf
+++ b/examples/networking/region/vpc.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 resource "aws_vpc" "main" {
   cidr_block = cidrsubnet(var.base_cidr_block, 4, var.region_numbers[var.region])
 }
diff --git a/examples/networking/regions.tf b/examples/networking/regions.tf
index ebfbc5a8b18..e2edcf07a86 100644
--- a/examples/networking/regions.tf
+++ b/examples/networking/regions.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 module "us-east-1" {
   source          = "./region"
   region          = "us-east-1"
diff --git a/examples/networking/subnet/outputs.tf b/examples/networking/subnet/outputs.tf
index 087110ab168..8e11e0b688f 100644
--- a/examples/networking/subnet/outputs.tf
+++ b/examples/networking/subnet/outputs.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 output "subnet_id" {
   value = aws_subnet.main.id
 }
diff --git a/examples/networking/subnet/security_group.tf b/examples/networking/subnet/security_group.tf
index c6036f57481..2d895881ae5 100644
--- a/examples/networking/subnet/security_group.tf
+++ b/examples/networking/subnet/security_group.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 resource "aws_security_group" "az" {
   name        = "az-${data.aws_availability_zone.target.name}"
   description = "Open access within the AZ ${data.aws_availability_zone.target.name}"
diff --git a/examples/networking/subnet/subnet.tf b/examples/networking/subnet/subnet.tf
index 9554c99f954..909711f511c 100644
--- a/examples/networking/subnet/subnet.tf
+++ b/examples/networking/subnet/subnet.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 resource "aws_subnet" "main" {
   cidr_block        = cidrsubnet(data.aws_vpc.target.cidr_block, 2, var.az_numbers[data.aws_availability_zone.target.name_suffix])
   vpc_id            = var.vpc_id
diff --git a/examples/networking/subnet/terraform.template.tfvars b/examples/networking/subnet/terraform.template.tfvars
index 435e6fc8f1c..feaa64238aa 100644
--- a/examples/networking/subnet/terraform.template.tfvars
+++ b/examples/networking/subnet/terraform.template.tfvars
@@ -1,2 +1,5 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 availability_zone = "us-west-2a"
 vpc_id            = "vpc-12345678"
diff --git a/examples/networking/subnet/variables.tf b/examples/networking/subnet/variables.tf
index 406a4310b5c..b92ee99a9ff 100644
--- a/examples/networking/subnet/variables.tf
+++ b/examples/networking/subnet/variables.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 variable "vpc_id" {
 }
 
diff --git a/examples/networking/subnet/versions.tf b/examples/networking/subnet/versions.tf
index ac97c6ac8e7..83878d7b561 100644
--- a/examples/networking/subnet/versions.tf
+++ b/examples/networking/subnet/versions.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 
 terraform {
   required_version = ">= 0.12"
diff --git a/examples/networking/variables.tf b/examples/networking/variables.tf
index 7482b1f4c5a..3bbbc9ebbe8 100644
--- a/examples/networking/variables.tf
+++ b/examples/networking/variables.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 variable "base_cidr_block" {
   default = "10.0.0.0/22"
 }
diff --git a/examples/networking/versions.tf b/examples/networking/versions.tf
index ac97c6ac8e7..83878d7b561 100644
--- a/examples/networking/versions.tf
+++ b/examples/networking/versions.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 
 terraform {
   required_version = ">= 0.12"
diff --git a/examples/opensearchserverless/README.md b/examples/opensearchserverless/README.md
new file mode 100644
index 00000000000..3ad8586a404
--- /dev/null
+++ b/examples/opensearchserverless/README.md
@@ -0,0 +1,31 @@
+# Amazon OpenSearch Serverless Example
+
+This example creates an OpenSearch Serverless collection with an encryption, network, and data access policy along with an OpenSearch Serverless-managed VPC endpoint and its required VPC resources.
+
+## Setup
+
+Configure your AWS provider as described in https://www.terraform.io/docs/providers/aws/index.html
+
+From inside of this directory:
+
+```bash
+export AWS_ACCESS_KEY_ID=<this is a secret>
+export AWS_SECRET_ACCESS_KEY=<this is a secret>
+terraform init
+```
+
+## Run the example
+
+From inside of this directory:
+
+```bash
+terraform apply
+```
+
+## Clean up
+
+From inside of this directory:
+
+```bash
+terraform destroy
+```
diff --git a/examples/opensearchserverless/main.tf b/examples/opensearchserverless/main.tf
new file mode 100644
index 00000000000..d9d03312b67
--- /dev/null
+++ b/examples/opensearchserverless/main.tf
@@ -0,0 +1,118 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
+# Require Terraform 0.12 or greater
+terraform {
+  required_version = ">= 0.12"
+}
+
+# Set AWS provider region
+provider "aws" {
+  region = var.aws_region
+}
+
+# Creates an encryption security policy
+resource "aws_opensearchserverless_security_policy" "encryption_policy" {
+  name        = "example-encryption-policy"
+  type        = "encryption"
+  description = "encryption policy for ${var.collection_name}"
+  policy = jsonencode({
+    Rules = [
+      {
+        Resource = [
+          "collection/${var.collection_name}"
+        ],
+        ResourceType = "collection"
+      }
+    ],
+    AWSOwnedKey = true
+  })
+}
+
+# Creates a collection
+resource "aws_opensearchserverless_collection" "collection" {
+  name = var.collection_name
+
+  depends_on = [aws_opensearchserverless_security_policy.encryption_policy]
+}
+
+# Creates a network security policy
+resource "aws_opensearchserverless_security_policy" "network_policy" {
+  name        = "example-network-policy"
+  type        = "network"
+  description = "public access for dashboard, VPC access for collection endpoint"
+  policy = jsonencode([
+    {
+      Description = "VPC access for collection endpoint",
+      Rules = [
+        {
+          ResourceType = "collection",
+          Resource = [
+            "collection/${var.collection_name}"
+          ]
+        }
+      ],
+      AllowFromPublic = false,
+      SourceVPCEs = [
+        aws_opensearchserverless_vpc_endpoint.vpc_endpoint.id
+      ]
+    },
+    {
+      Description = "Public access for dashboards",
+      Rules = [
+        {
+          ResourceType = "dashboard"
+          Resource = [
+            "collection/${var.collection_name}"
+          ]
+        }
+      ],
+      AllowFromPublic = true
+    }
+  ])
+}
+
+# Creates a VPC endpoint
+resource "aws_opensearchserverless_vpc_endpoint" "vpc_endpoint" {
+  name               = "example-vpc-endpoint"
+  vpc_id             = aws_vpc.vpc.id
+  subnet_ids         = [aws_subnet.subnet.id]
+  security_group_ids = [aws_security_group.security_group.id]
+}
+
+# Gets access to the effective Account ID in which Terraform is authorized
+data "aws_caller_identity" "current" {}
+
+# Creates a data access policy
+resource "aws_opensearchserverless_access_policy" "data_access_policy" {
+  name        = "example-data-access-policy"
+  type        = "data"
+  description = "allow index and collection access"
+  policy = jsonencode([
+    {
+      Rules = [
+        {
+          ResourceType = "index",
+          Resource = [
+            "index/${var.collection_name}/*"
+          ],
+          Permission = [
+            "aoss:*"
+          ]
+        },
+        {
+          ResourceType = "collection",
+          Resource = [
+            "collection/${var.collection_name}"
+          ],
+          Permission = [
+            "aoss:*"
+          ]
+        }
+      ],
+      Principal = [
+        data.aws_caller_identity.current.arn
+      ]
+    }
+  ])
+}
diff --git a/examples/opensearchserverless/outputs.tf b/examples/opensearchserverless/outputs.tf
new file mode 100644
index 00000000000..c64c61af065
--- /dev/null
+++ b/examples/opensearchserverless/outputs.tf
@@ -0,0 +1,10 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
+output "collection_enpdoint" {
+  value = aws_opensearchserverless_collection.collection.collection_endpoint
+}
+
+output "dashboard_endpoint" {
+  value = aws_opensearchserverless_collection.collection.dashboard_endpoint
+}
diff --git a/examples/opensearchserverless/variables.tf b/examples/opensearchserverless/variables.tf
new file mode 100644
index 00000000000..068ed08640e
--- /dev/null
+++ b/examples/opensearchserverless/variables.tf
@@ -0,0 +1,12 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
+variable "aws_region" {
+  description = "The AWS region to create things in."
+  default     = "us-east-1"
+}
+
+variable "collection_name" {
+  description = "Name of the OpenSearch Serverless collection."
+  default     = "example-collection"
+}
diff --git a/examples/opensearchserverless/vpc.tf b/examples/opensearchserverless/vpc.tf
new file mode 100644
index 00000000000..c5f2943ab20
--- /dev/null
+++ b/examples/opensearchserverless/vpc.tf
@@ -0,0 +1,71 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
+# Creates a VPC
+resource "aws_vpc" "vpc" {
+  cidr_block           = "10.0.0.0/16"
+  enable_dns_hostnames = true
+
+  tags = {
+    Name = "example-vpc"
+  }
+}
+
+# Creates a subnet
+resource "aws_subnet" "subnet" {
+  vpc_id     = aws_vpc.vpc.id
+  cidr_block = "10.0.0.0/16"
+
+  tags = {
+    Name = "example-subnet"
+  }
+}
+
+# Creates an Internet Gateway
+resource "aws_internet_gateway" "igw" {
+  vpc_id = aws_vpc.vpc.id
+
+  tags = {
+    Name = "example-igw"
+  }
+}
+
+# Creates a route table
+resource "aws_route_table" "route_table" {
+  vpc_id = aws_vpc.vpc.id
+
+  route {
+    cidr_block = "0.0.0.0/0"
+    gateway_id = aws_internet_gateway.igw.id
+  }
+}
+
+# Creates a route table association
+resource "aws_route_table_association" "route_table_association" {
+  subnet_id      = aws_subnet.subnet.id
+  route_table_id = aws_route_table.route_table.id
+}
+
+# Creates a security group
+resource "aws_security_group" "security_group" {
+  vpc_id = aws_vpc.vpc.id
+  tags = {
+    Name = "example-security-group"
+  }
+}
+
+# Allows all outbound traffic
+resource "aws_vpc_security_group_egress_rule" "sg_egress" {
+  security_group_id = aws_security_group.security_group.id
+
+  cidr_ipv4   = "0.0.0.0/0"
+  ip_protocol = "-1"
+}
+
+# Allows inbound traffic from within security group
+resource "aws_vpc_security_group_ingress_rule" "sg_ingress" {
+  security_group_id = aws_security_group.security_group.id
+
+  referenced_security_group_id = aws_security_group.security_group.id
+  ip_protocol                  = "-1"
+}
diff --git a/examples/rds/main.tf b/examples/rds/main.tf
index 09a5590732f..4fa4415dc2b 100644
--- a/examples/rds/main.tf
+++ b/examples/rds/main.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 terraform {
   required_version = ">= 0.12"
 }
diff --git a/examples/rds/outputs.tf b/examples/rds/outputs.tf
index e8f41d4bdc8..6b245ee4b36 100644
--- a/examples/rds/outputs.tf
+++ b/examples/rds/outputs.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 output "subnet_group" {
   value = aws_db_subnet_group.default.name
 }
diff --git a/examples/rds/sg-variables.tf b/examples/rds/sg-variables.tf
index c6db98abb64..5100c585493 100644
--- a/examples/rds/sg-variables.tf
+++ b/examples/rds/sg-variables.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 variable "cidr_blocks" {
   default     = "0.0.0.0/0"
   description = "CIDR for sg"
diff --git a/examples/rds/sg.tf b/examples/rds/sg.tf
index 1ddf27500e2..1bfaad8d5eb 100644
--- a/examples/rds/sg.tf
+++ b/examples/rds/sg.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 resource "aws_security_group" "default" {
   name        = "main_rds_sg"
   description = "Allow all inbound traffic"
diff --git a/examples/rds/subnet-variables.tf b/examples/rds/subnet-variables.tf
index cf9d9b731cf..8001766adb6 100644
--- a/examples/rds/subnet-variables.tf
+++ b/examples/rds/subnet-variables.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 variable "subnet_1_cidr" {
   default     = "10.0.1.0/24"
   description = "Your AZ"
diff --git a/examples/rds/subnets.tf b/examples/rds/subnets.tf
index 27e9e5a6c97..6547be8405f 100644
--- a/examples/rds/subnets.tf
+++ b/examples/rds/subnets.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 resource "aws_subnet" "subnet_1" {
   vpc_id            = var.vpc_id
   cidr_block        = var.subnet_1_cidr
diff --git a/examples/rds/terraform.template.tfvars b/examples/rds/terraform.template.tfvars
index bbc90ba75b8..3e2820d50b1 100644
--- a/examples/rds/terraform.template.tfvars
+++ b/examples/rds/terraform.template.tfvars
@@ -1,2 +1,5 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 password = "neverstorepasswordsinplaintext"
 vpc_id   = "vpc-12345678"
diff --git a/examples/rds/variables.tf b/examples/rds/variables.tf
index 8bd47d36a7e..4328e303b70 100644
--- a/examples/rds/variables.tf
+++ b/examples/rds/variables.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 variable "aws_region" {
   default = "us-west-2"
 }
diff --git a/examples/s3-api-gateway-integration/main.tf b/examples/s3-api-gateway-integration/main.tf
index 557e0f7b938..d65869496e9 100644
--- a/examples/s3-api-gateway-integration/main.tf
+++ b/examples/s3-api-gateway-integration/main.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 terraform {
   required_version = ">= 0.12"
 }
diff --git a/examples/s3-api-gateway-integration/terraform.template.tfvars b/examples/s3-api-gateway-integration/terraform.template.tfvars
index d078194646d..d67285cd3fe 100644
--- a/examples/s3-api-gateway-integration/terraform.template.tfvars
+++ b/examples/s3-api-gateway-integration/terraform.template.tfvars
@@ -1 +1,4 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 aws_region = "us-west-2"
diff --git a/examples/s3-api-gateway-integration/variables.tf b/examples/s3-api-gateway-integration/variables.tf
index 452d6553d45..67883483574 100644
--- a/examples/s3-api-gateway-integration/variables.tf
+++ b/examples/s3-api-gateway-integration/variables.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 variable "aws_region" {
   default = "us-west-2"
 }
diff --git a/examples/s3-cross-account-access/main.tf b/examples/s3-cross-account-access/main.tf
index 79182b8ecda..6193914239c 100644
--- a/examples/s3-cross-account-access/main.tf
+++ b/examples/s3-cross-account-access/main.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 terraform {
   required_version = ">= 0.12"
 }
diff --git a/examples/s3-cross-account-access/terraform.template.tfvars b/examples/s3-cross-account-access/terraform.template.tfvars
index a4fb4c59b82..30832ef5f23 100644
--- a/examples/s3-cross-account-access/terraform.template.tfvars
+++ b/examples/s3-cross-account-access/terraform.template.tfvars
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 # prod account
 prod_access_key = "AAAAAAAAAAAAAAAAAAA"
 prod_secret_key = "SuperSecretKeyForAccountA"
diff --git a/examples/s3-cross-account-access/variables.tf b/examples/s3-cross-account-access/variables.tf
index 58c2a1e7cf0..28dccede991 100644
--- a/examples/s3-cross-account-access/variables.tf
+++ b/examples/s3-cross-account-access/variables.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 variable "prod_access_key" {}
 
 variable "prod_secret_key" {}
diff --git a/examples/sagemaker/main.tf b/examples/sagemaker/main.tf
index d78e28245bb..3b839569f87 100644
--- a/examples/sagemaker/main.tf
+++ b/examples/sagemaker/main.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 terraform {
   required_version = ">= 0.12"
 }
diff --git a/examples/transit-gateway-cross-account-peering-attachment/main.tf b/examples/transit-gateway-cross-account-peering-attachment/main.tf
index 0799f85ac0f..6cb3c24a367 100644
--- a/examples/transit-gateway-cross-account-peering-attachment/main.tf
+++ b/examples/transit-gateway-cross-account-peering-attachment/main.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 terraform {
   required_version = ">= 0.12"
 }
diff --git a/examples/transit-gateway-cross-account-peering-attachment/terraform.template.tfvars b/examples/transit-gateway-cross-account-peering-attachment/terraform.template.tfvars
index 122bfe58357..d06e23228a9 100644
--- a/examples/transit-gateway-cross-account-peering-attachment/terraform.template.tfvars
+++ b/examples/transit-gateway-cross-account-peering-attachment/terraform.template.tfvars
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 # First account
 aws_first_access_key = "AAAAAAAAAAAAAAAAAAA"
 aws_first_secret_key = "SuperSecretKeyForAccount1"
diff --git a/examples/transit-gateway-cross-account-peering-attachment/variables.tf b/examples/transit-gateway-cross-account-peering-attachment/variables.tf
index 88b369a456e..e7001647aff 100644
--- a/examples/transit-gateway-cross-account-peering-attachment/variables.tf
+++ b/examples/transit-gateway-cross-account-peering-attachment/variables.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 variable "aws_first_access_key" {}
 
 variable "aws_first_secret_key" {}
diff --git a/examples/transit-gateway-cross-account-vpc-attachment/main.tf b/examples/transit-gateway-cross-account-vpc-attachment/main.tf
index 31a9c41210b..ea5c5bd5f57 100644
--- a/examples/transit-gateway-cross-account-vpc-attachment/main.tf
+++ b/examples/transit-gateway-cross-account-vpc-attachment/main.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 terraform {
   required_version = ">= 0.12"
 }
diff --git a/examples/transit-gateway-cross-account-vpc-attachment/terraform.template.tfvars b/examples/transit-gateway-cross-account-vpc-attachment/terraform.template.tfvars
index 813b24302fe..1b2e74891f5 100644
--- a/examples/transit-gateway-cross-account-vpc-attachment/terraform.template.tfvars
+++ b/examples/transit-gateway-cross-account-vpc-attachment/terraform.template.tfvars
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 # First account
 aws_first_access_key = "AAAAAAAAAAAAAAAAAAA"
 aws_first_secret_key = "SuperSecretKeyForAccount1"
diff --git a/examples/transit-gateway-cross-account-vpc-attachment/variables.tf b/examples/transit-gateway-cross-account-vpc-attachment/variables.tf
index ed1a71f53b1..a1b8e9c6a72 100644
--- a/examples/transit-gateway-cross-account-vpc-attachment/variables.tf
+++ b/examples/transit-gateway-cross-account-vpc-attachment/variables.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 variable "aws_first_access_key" {}
 
 variable "aws_first_secret_key" {}
diff --git a/examples/transit-gateway-intra-region-peering/main.tf b/examples/transit-gateway-intra-region-peering/main.tf
index 4a1ad370b44..d78f3acb3a8 100644
--- a/examples/transit-gateway-intra-region-peering/main.tf
+++ b/examples/transit-gateway-intra-region-peering/main.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 terraform {
   required_version = ">= 0.12"
 }
diff --git a/examples/transit-gateway-intra-region-peering/terraform.template.tfvars b/examples/transit-gateway-intra-region-peering/terraform.template.tfvars
index 290c2a8fa3f..160ec813bf8 100644
--- a/examples/transit-gateway-intra-region-peering/terraform.template.tfvars
+++ b/examples/transit-gateway-intra-region-peering/terraform.template.tfvars
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 # AWS Profile (type `aws configure`)
 aws_profile = "default"
 
diff --git a/examples/transit-gateway-intra-region-peering/variables.tf b/examples/transit-gateway-intra-region-peering/variables.tf
index 018322bac48..568c2059459 100644
--- a/examples/transit-gateway-intra-region-peering/variables.tf
+++ b/examples/transit-gateway-intra-region-peering/variables.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 variable "aws_profile" {}
 
 variable "aws_region" {}
diff --git a/examples/two-tier/main.tf b/examples/two-tier/main.tf
index d1b8b41701d..da907e9cad3 100644
--- a/examples/two-tier/main.tf
+++ b/examples/two-tier/main.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 terraform {
   required_version = ">= 0.12"
 }
diff --git a/examples/two-tier/outputs.tf b/examples/two-tier/outputs.tf
index 2c535bb7283..b57b1a52a60 100644
--- a/examples/two-tier/outputs.tf
+++ b/examples/two-tier/outputs.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 output "address" {
   value = aws_elb.web.dns_name
 }
diff --git a/examples/two-tier/terraform.template.tfvars b/examples/two-tier/terraform.template.tfvars
index b19a09391c5..223da16b3eb 100644
--- a/examples/two-tier/terraform.template.tfvars
+++ b/examples/two-tier/terraform.template.tfvars
@@ -1,2 +1,5 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 key_name        = "terraform-provider-aws-example"
 public_key_path = "~/.ssh/terraform-provider-aws-example.pub"
diff --git a/examples/two-tier/variables.tf b/examples/two-tier/variables.tf
index d590361880b..ccb4fb1bbb2 100644
--- a/examples/two-tier/variables.tf
+++ b/examples/two-tier/variables.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 variable "public_key_path" {
   description = <<DESCRIPTION
 Path to the SSH public key to be used for authentication.
diff --git a/examples/workspaces/iam.tf b/examples/workspaces/iam.tf
index de04b6a94a7..94061128cdf 100644
--- a/examples/workspaces/iam.tf
+++ b/examples/workspaces/iam.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 # Uncomment the resources in this file to create the IAM resources required by the AWS WorkSpaces service.
 # Also uncomment the `depends_on` meta-arguments on `aws_workspaces_directory.example` and `aws_workspaces_workspace.example`.
 #
diff --git a/examples/workspaces/main.tf b/examples/workspaces/main.tf
index af5b90ea40f..19afe6895dd 100644
--- a/examples/workspaces/main.tf
+++ b/examples/workspaces/main.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 terraform {
   required_version = ">= 0.12"
 }
diff --git a/examples/workspaces/variables.tf b/examples/workspaces/variables.tf
index 3c91c693825..3c4f6e99e62 100644
--- a/examples/workspaces/variables.tf
+++ b/examples/workspaces/variables.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 variable "aws_region" {
   description = "The AWS region to use"
   default     = "us-west-2"
diff --git a/go.mod b/go.mod
index 6798feb958d..5d81037aefe 100644
--- a/go.mod
+++ b/go.mod
@@ -1,78 +1,103 @@
 module github.com/hashicorp/terraform-provider-aws
 
-go 1.19
+go 1.20
 
 require (
-	github.com/ProtonMail/go-crypto v0.0.0-20230217124315-7d5c6f04bbb8
-	github.com/aws/aws-sdk-go v1.44.285
-	github.com/aws/aws-sdk-go-v2 v1.18.1
-	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.13.4
-	github.com/aws/aws-sdk-go-v2/service/accessanalyzer v1.19.14
-	github.com/aws/aws-sdk-go-v2/service/account v1.10.8
-	github.com/aws/aws-sdk-go-v2/service/acm v1.17.13
-	github.com/aws/aws-sdk-go-v2/service/appconfig v1.17.11
-	github.com/aws/aws-sdk-go-v2/service/auditmanager v1.25.0
-	github.com/aws/aws-sdk-go-v2/service/cleanrooms v1.1.6
-	github.com/aws/aws-sdk-go-v2/service/cloudcontrol v1.11.14
-	github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.21.2
-	github.com/aws/aws-sdk-go-v2/service/comprehend v1.24.4
-	github.com/aws/aws-sdk-go-v2/service/computeoptimizer v1.24.2
-	github.com/aws/aws-sdk-go-v2/service/directoryservice v1.17.3
-	github.com/aws/aws-sdk-go-v2/service/docdbelastic v1.1.12
-	github.com/aws/aws-sdk-go-v2/service/ec2 v1.101.0
-	github.com/aws/aws-sdk-go-v2/service/finspace v1.10.2
-	github.com/aws/aws-sdk-go-v2/service/fis v1.14.12
-	github.com/aws/aws-sdk-go-v2/service/glacier v1.14.13
-	github.com/aws/aws-sdk-go-v2/service/healthlake v1.16.2
-	github.com/aws/aws-sdk-go-v2/service/identitystore v1.16.13
-	github.com/aws/aws-sdk-go-v2/service/inspector2 v1.14.2
-	github.com/aws/aws-sdk-go-v2/service/ivschat v1.4.7
-	github.com/aws/aws-sdk-go-v2/service/kendra v1.40.4
-	github.com/aws/aws-sdk-go-v2/service/lambda v1.35.2
-	github.com/aws/aws-sdk-go-v2/service/lightsail v1.27.1
-	github.com/aws/aws-sdk-go-v2/service/medialive v1.31.6
-	github.com/aws/aws-sdk-go-v2/service/oam v1.1.13
-	github.com/aws/aws-sdk-go-v2/service/opensearchserverless v1.2.6
-	github.com/aws/aws-sdk-go-v2/service/pipes v1.2.8
-	github.com/aws/aws-sdk-go-v2/service/rbin v1.8.14
-	github.com/aws/aws-sdk-go-v2/service/rds v1.45.2
-	github.com/aws/aws-sdk-go-v2/service/resourceexplorer2 v1.2.15
-	github.com/aws/aws-sdk-go-v2/service/rolesanywhere v1.2.2
-	github.com/aws/aws-sdk-go-v2/service/route53domains v1.15.0
-	github.com/aws/aws-sdk-go-v2/service/s3control v1.31.7
-	github.com/aws/aws-sdk-go-v2/service/scheduler v1.1.13
-	github.com/aws/aws-sdk-go-v2/service/securitylake v1.4.3
-	github.com/aws/aws-sdk-go-v2/service/sesv2 v1.18.2
-	github.com/aws/aws-sdk-go-v2/service/ssm v1.36.6
-	github.com/aws/aws-sdk-go-v2/service/ssmcontacts v1.15.6
-	github.com/aws/aws-sdk-go-v2/service/ssmincidents v1.21.6
-	github.com/aws/aws-sdk-go-v2/service/swf v1.15.2
-	github.com/aws/aws-sdk-go-v2/service/transcribe v1.26.8
-	github.com/aws/aws-sdk-go-v2/service/vpclattice v1.0.7
-	github.com/aws/aws-sdk-go-v2/service/xray v1.16.13
-	github.com/aws/smithy-go v1.13.5
+	github.com/ProtonMail/go-crypto v0.0.0-20230923063757-afb1ddc0824c
+	github.com/YakDriver/regexache v0.23.0
+	github.com/aws/aws-sdk-go v1.46.6
+	github.com/aws/aws-sdk-go-v2 v1.21.2
+	github.com/aws/aws-sdk-go-v2/config v1.19.1
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.13.13
+	github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.11.92
+	github.com/aws/aws-sdk-go-v2/service/accessanalyzer v1.21.2
+	github.com/aws/aws-sdk-go-v2/service/account v1.11.7
+	github.com/aws/aws-sdk-go-v2/service/acm v1.19.2
+	github.com/aws/aws-sdk-go-v2/service/appconfig v1.23.0
+	github.com/aws/aws-sdk-go-v2/service/auditmanager v1.27.0
+	github.com/aws/aws-sdk-go-v2/service/cleanrooms v1.4.2
+	github.com/aws/aws-sdk-go-v2/service/cloudcontrol v1.12.7
+	github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.24.2
+	github.com/aws/aws-sdk-go-v2/service/codecatalyst v1.5.7
+	github.com/aws/aws-sdk-go-v2/service/codestarconnections v1.15.8
+	github.com/aws/aws-sdk-go-v2/service/codestarnotifications v1.17.0
+	github.com/aws/aws-sdk-go-v2/service/comprehend v1.25.7
+	github.com/aws/aws-sdk-go-v2/service/computeoptimizer v1.27.2
+	github.com/aws/aws-sdk-go-v2/service/directoryservice v1.19.0
+	github.com/aws/aws-sdk-go-v2/service/docdbelastic v1.3.2
+	github.com/aws/aws-sdk-go-v2/service/ec2 v1.128.0
+	github.com/aws/aws-sdk-go-v2/service/emrserverless v1.11.2
+	github.com/aws/aws-sdk-go-v2/service/finspace v1.13.0
+	github.com/aws/aws-sdk-go-v2/service/fis v1.17.0
+	github.com/aws/aws-sdk-go-v2/service/glacier v1.16.2
+	github.com/aws/aws-sdk-go-v2/service/healthlake v1.17.7
+	github.com/aws/aws-sdk-go-v2/service/identitystore v1.18.4
+	github.com/aws/aws-sdk-go-v2/service/inspector2 v1.17.0
+	github.com/aws/aws-sdk-go-v2/service/internetmonitor v1.6.2
+	github.com/aws/aws-sdk-go-v2/service/ivschat v1.6.2
+	github.com/aws/aws-sdk-go-v2/service/kafka v1.24.0
+	github.com/aws/aws-sdk-go-v2/service/kendra v1.44.0
+	github.com/aws/aws-sdk-go-v2/service/keyspaces v1.4.7
+	github.com/aws/aws-sdk-go-v2/service/lambda v1.41.0
+	github.com/aws/aws-sdk-go-v2/service/lexmodelsv2 v1.33.0
+	github.com/aws/aws-sdk-go-v2/service/lightsail v1.29.0
+	github.com/aws/aws-sdk-go-v2/service/mediaconnect v1.21.0
+	github.com/aws/aws-sdk-go-v2/service/medialive v1.38.0
+	github.com/aws/aws-sdk-go-v2/service/mediapackage v1.24.1
+	github.com/aws/aws-sdk-go-v2/service/oam v1.4.2
+	github.com/aws/aws-sdk-go-v2/service/opensearchserverless v1.6.0
+	github.com/aws/aws-sdk-go-v2/service/pipes v1.4.3
+	github.com/aws/aws-sdk-go-v2/service/pricing v1.21.9
+	github.com/aws/aws-sdk-go-v2/service/qldb v1.16.7
+	github.com/aws/aws-sdk-go-v2/service/rbin v1.10.2
+	github.com/aws/aws-sdk-go-v2/service/rds v1.58.0
+	github.com/aws/aws-sdk-go-v2/service/redshiftdata v1.20.7
+	github.com/aws/aws-sdk-go-v2/service/resourceexplorer2 v1.4.3
+	github.com/aws/aws-sdk-go-v2/service/resourcegroups v1.16.2
+	github.com/aws/aws-sdk-go-v2/service/resourcegroupstaggingapi v1.16.2
+	github.com/aws/aws-sdk-go-v2/service/rolesanywhere v1.3.8
+	github.com/aws/aws-sdk-go-v2/service/route53domains v1.17.5
+	github.com/aws/aws-sdk-go-v2/service/s3 v1.40.2
+	github.com/aws/aws-sdk-go-v2/service/s3control v1.34.0
+	github.com/aws/aws-sdk-go-v2/service/scheduler v1.3.2
+	github.com/aws/aws-sdk-go-v2/service/securitylake v1.7.3
+	github.com/aws/aws-sdk-go-v2/service/servicequotas v1.16.2
+	github.com/aws/aws-sdk-go-v2/service/sesv2 v1.21.0
+	github.com/aws/aws-sdk-go-v2/service/signer v1.16.7
+	github.com/aws/aws-sdk-go-v2/service/ssm v1.40.0
+	github.com/aws/aws-sdk-go-v2/service/ssmcontacts v1.17.2
+	github.com/aws/aws-sdk-go-v2/service/ssmincidents v1.23.2
+	github.com/aws/aws-sdk-go-v2/service/swf v1.17.5
+	github.com/aws/aws-sdk-go-v2/service/timestreamwrite v1.20.0
+	github.com/aws/aws-sdk-go-v2/service/transcribe v1.29.0
+	github.com/aws/aws-sdk-go-v2/service/verifiedpermissions v1.3.0
+	github.com/aws/aws-sdk-go-v2/service/vpclattice v1.2.2
+	github.com/aws/aws-sdk-go-v2/service/workspaces v1.31.3
+	github.com/aws/aws-sdk-go-v2/service/xray v1.20.0
 	github.com/beevik/etree v1.2.0
-	github.com/google/go-cmp v0.5.9
-	github.com/hashicorp/aws-cloudformation-resource-schema-sdk-go v0.20.0
-	github.com/hashicorp/aws-sdk-go-base/v2 v2.0.0-beta.29
-	github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2 v2.0.0-beta.30
+	github.com/gertd/go-pluralize v0.2.1
+	github.com/google/go-cmp v0.6.0
+	github.com/hashicorp/aws-cloudformation-resource-schema-sdk-go v0.21.0
+	github.com/hashicorp/aws-sdk-go-base/v2 v2.0.0-beta.37
+	github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2 v2.0.0-beta.38
 	github.com/hashicorp/awspolicyequivalence v1.6.0
 	github.com/hashicorp/go-cleanhttp v0.5.2
-	github.com/hashicorp/go-cty v1.4.1-0.20200414143053-d3edf31b6320
+	github.com/hashicorp/go-cty v1.4.1-0.20200723130312-85980079f637
+	github.com/hashicorp/go-hclog v1.5.0
 	github.com/hashicorp/go-multierror v1.1.1
 	github.com/hashicorp/go-uuid v1.0.3
 	github.com/hashicorp/go-version v1.6.0
-	github.com/hashicorp/hcl/v2 v2.17.0
-	github.com/hashicorp/terraform-plugin-framework v1.3.1
-	github.com/hashicorp/terraform-plugin-framework-timeouts v0.3.1
-	github.com/hashicorp/terraform-plugin-framework-validators v0.10.0
-	github.com/hashicorp/terraform-plugin-go v0.15.0
+	github.com/hashicorp/hcl/v2 v2.18.0
+	github.com/hashicorp/terraform-plugin-framework v1.4.2
+	github.com/hashicorp/terraform-plugin-framework-timeouts v0.4.1
+	github.com/hashicorp/terraform-plugin-framework-validators v0.12.0
+	github.com/hashicorp/terraform-plugin-go v0.19.0
 	github.com/hashicorp/terraform-plugin-log v0.9.0
-	github.com/hashicorp/terraform-plugin-mux v0.10.0
-	github.com/hashicorp/terraform-plugin-sdk/v2 v2.26.1
-	github.com/hashicorp/terraform-plugin-testing v1.3.0
+	github.com/hashicorp/terraform-plugin-mux v0.12.0
+	github.com/hashicorp/terraform-plugin-sdk/v2 v2.29.0
+	github.com/hashicorp/terraform-plugin-testing v1.5.1
 	github.com/jmespath/go-jmespath v0.4.0
-	github.com/mattbaird/jsonpatch v0.0.0-20200820163806-098863c1fc24
+	github.com/mattbaird/jsonpatch v0.0.0-20230413205102-771768614e91
 	github.com/mitchellh/cli v1.1.5
 	github.com/mitchellh/copystructure v1.2.0
 	github.com/mitchellh/go-homedir v1.1.0
@@ -80,9 +105,9 @@ require (
 	github.com/mitchellh/mapstructure v1.5.0
 	github.com/pquerna/otp v1.4.0
 	github.com/shopspring/decimal v1.3.1
-	golang.org/x/crypto v0.10.0
-	golang.org/x/exp v0.0.0-20230206171751-46f607a40771
-	golang.org/x/tools v0.6.0
+	golang.org/x/crypto v0.14.0
+	golang.org/x/exp v0.0.0-20231006140011-7918f672742d
+	golang.org/x/tools v0.14.0
 	gopkg.in/dnaeon/go-vcr.v3 v3.1.2
 	gopkg.in/yaml.v2 v2.4.0
 	syreclabs.com/go/faker v1.2.3
@@ -90,68 +115,83 @@ require (
 
 require (
 	github.com/Masterminds/goutils v1.1.1 // indirect
-	github.com/Masterminds/semver/v3 v3.1.1 // indirect
-	github.com/Masterminds/sprig/v3 v3.2.1 // indirect
+	github.com/Masterminds/semver/v3 v3.2.1 // indirect
+	github.com/Masterminds/sprig/v3 v3.2.3 // indirect
 	github.com/agext/levenshtein v1.2.3 // indirect
-	github.com/apparentlymart/go-textseg/v13 v13.0.0 // indirect
-	github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310 // indirect
-	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.4.10 // indirect
-	github.com/aws/aws-sdk-go-v2/config v1.18.25 // indirect
-	github.com/aws/aws-sdk-go-v2/credentials v1.13.24 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.34 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.28 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/ini v1.3.34 // indirect
-	github.com/aws/aws-sdk-go-v2/service/iam v1.20.2 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.28 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.14.3 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sso v1.12.12 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.14.12 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sts v1.19.2 // indirect
+	github.com/apparentlymart/go-textseg/v15 v15.0.0 // indirect
+	github.com/armon/go-radix v1.0.0 // indirect
+	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.4.14 // indirect
+	github.com/aws/aws-sdk-go-v2/credentials v1.13.43 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.43 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.37 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/ini v1.3.45 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/v4a v1.1.6 // indirect
+	github.com/aws/aws-sdk-go-v2/service/dynamodb v1.22.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/iam v1.22.6 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.9.15 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.1.38 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/endpoint-discovery v1.7.37 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.37 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.15.6 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sqs v1.24.6 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.15.2 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.17.3 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.23.2 // indirect
+	github.com/aws/smithy-go v1.15.0 // indirect
 	github.com/bgentry/speakeasy v0.1.0 // indirect
-	github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc // indirect
+	github.com/boombuler/barcode v1.0.1 // indirect
+	github.com/bufbuild/protocompile v0.6.0 // indirect
 	github.com/cloudflare/circl v1.3.3 // indirect
 	github.com/evanphx/json-patch v0.5.2 // indirect
-	github.com/fatih/color v1.14.1 // indirect
-	github.com/golang/protobuf v1.5.2 // indirect
-	github.com/google/uuid v1.3.0 // indirect
+	github.com/fatih/color v1.15.0 // indirect
+	github.com/frankban/quicktest v1.14.6 // indirect
+	github.com/go-logr/logr v1.2.4 // indirect
+	github.com/go-logr/stdr v1.2.2 // indirect
+	github.com/go-test/deep v1.1.0 // indirect
+	github.com/golang/protobuf v1.5.3 // indirect
+	github.com/google/uuid v1.3.1 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-checkpoint v0.5.0 // indirect
-	github.com/hashicorp/go-hclog v1.5.0 // indirect
-	github.com/hashicorp/go-plugin v1.4.9 // indirect
-	github.com/hashicorp/hc-install v0.5.2 // indirect
+	github.com/hashicorp/go-plugin v1.5.2 // indirect
+	github.com/hashicorp/hc-install v0.6.0 // indirect
 	github.com/hashicorp/logutils v1.0.0 // indirect
-	github.com/hashicorp/terraform-exec v0.18.1 // indirect
-	github.com/hashicorp/terraform-json v0.17.0 // indirect
-	github.com/hashicorp/terraform-registry-address v0.2.0 // indirect
-	github.com/hashicorp/terraform-svchost v0.1.0 // indirect
+	github.com/hashicorp/terraform-exec v0.19.0 // indirect
+	github.com/hashicorp/terraform-json v0.17.1 // indirect
+	github.com/hashicorp/terraform-registry-address v0.2.2 // indirect
+	github.com/hashicorp/terraform-svchost v0.1.1 // indirect
 	github.com/hashicorp/yamux v0.1.1 // indirect
-	github.com/huandu/xstrings v1.3.2 // indirect
-	github.com/imdario/mergo v0.3.13 // indirect
-	github.com/kr/pretty v0.3.0 // indirect
+	github.com/huandu/xstrings v1.4.0 // indirect
+	github.com/imdario/mergo v0.3.16 // indirect
 	github.com/mattn/go-colorable v0.1.13 // indirect
-	github.com/mattn/go-isatty v0.0.17 // indirect
+	github.com/mattn/go-isatty v0.0.19 // indirect
 	github.com/mitchellh/go-wordwrap v1.0.1 // indirect
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
 	github.com/oklog/run v1.1.0 // indirect
-	github.com/posener/complete v1.1.1 // indirect
-	github.com/rogpeppe/go-internal v1.9.0 // indirect
-	github.com/spf13/cast v1.3.1 // indirect
+	github.com/posener/complete v1.2.3 // indirect
+	github.com/rogpeppe/go-internal v1.11.0 // indirect
+	github.com/sergi/go-diff v1.3.1 // indirect
+	github.com/spf13/cast v1.5.1 // indirect
 	github.com/vmihailenco/msgpack v4.0.4+incompatible // indirect
 	github.com/vmihailenco/msgpack/v5 v5.3.5 // indirect
 	github.com/vmihailenco/tagparser/v2 v2.0.0 // indirect
 	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
 	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
 	github.com/xeipuuv/gojsonschema v1.2.0 // indirect
-	github.com/zclconf/go-cty v1.13.2 // indirect
-	go.opentelemetry.io/otel v1.15.1 // indirect
-	go.opentelemetry.io/otel/trace v1.15.1 // indirect
-	golang.org/x/mod v0.10.0 // indirect
-	golang.org/x/net v0.10.0 // indirect
-	golang.org/x/sys v0.9.0 // indirect
-	golang.org/x/text v0.10.0 // indirect
-	google.golang.org/appengine v1.6.7 // indirect
-	google.golang.org/genproto v0.0.0-20230202175211-008b39050e57 // indirect
-	google.golang.org/grpc v1.54.0 // indirect
-	google.golang.org/protobuf v1.30.0 // indirect
+	github.com/zclconf/go-cty v1.14.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/github.com/aws/aws-sdk-go-v2/otelaws v0.45.0 // indirect
+	go.opentelemetry.io/otel v1.19.0 // indirect
+	go.opentelemetry.io/otel/metric v1.19.0 // indirect
+	go.opentelemetry.io/otel/trace v1.19.0 // indirect
+	golang.org/x/mod v0.13.0 // indirect
+	golang.org/x/net v0.17.0 // indirect
+	golang.org/x/sys v0.13.0 // indirect
+	golang.org/x/text v0.13.0 // indirect
+	google.golang.org/appengine v1.6.8 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20230920204549-e6e6cdab5c13 // indirect
+	google.golang.org/grpc v1.58.2 // indirect
+	google.golang.org/protobuf v1.31.0 // indirect
+	gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
+
+replace github.com/hashicorp/terraform-plugin-log => github.com/gdavison/terraform-plugin-log v0.0.0-20230928191232-6c653d8ef8fb
diff --git a/go.sum b/go.sum
index a3f9e98a84b..a3f5496e005 100644
--- a/go.sum
+++ b/go.sum
@@ -1,154 +1,215 @@
+dario.cat/mergo v1.0.0 h1:AGCNq9Evsj31mOgNPcLyXc+4PNABt905YmuqPYYpBWk=
 github.com/Masterminds/goutils v1.1.1 h1:5nUrii3FMTL5diU80unEVvNevw1nH4+ZV4DSLVJLSYI=
 github.com/Masterminds/goutils v1.1.1/go.mod h1:8cTjp+g8YejhMuvIA5y2vz3BpJxksy863GQaJW2MFNU=
-github.com/Masterminds/semver/v3 v3.1.1 h1:hLg3sBzpNErnxhQtUy/mmLR2I9foDujNK030IGemrRc=
 github.com/Masterminds/semver/v3 v3.1.1/go.mod h1:VPu/7SZ7ePZ3QOrcuXROw5FAcLl4a0cBrbBpGY/8hQs=
-github.com/Masterminds/sprig/v3 v3.2.1 h1:n6EPaDyLSvCEa3frruQvAiHuNp2dhBlMSmkEr+HuzGc=
+github.com/Masterminds/semver/v3 v3.2.0/go.mod h1:qvl/7zhW3nngYb5+80sSMF+FG2BjYrf8m9wsX0PNOMQ=
+github.com/Masterminds/semver/v3 v3.2.1 h1:RN9w6+7QoMeJVGyfmbcgs28Br8cvmnucEXnY0rYXWg0=
+github.com/Masterminds/semver/v3 v3.2.1/go.mod h1:qvl/7zhW3nngYb5+80sSMF+FG2BjYrf8m9wsX0PNOMQ=
 github.com/Masterminds/sprig/v3 v3.2.1/go.mod h1:UoaO7Yp8KlPnJIYWTFkMaqPUYKTfGFPhxNuwnnxkKlk=
-github.com/Microsoft/go-winio v0.5.2 h1:a9IhgEQBCUEk6QCdml9CiJGhAws+YwffDHEMp1VMrpA=
-github.com/ProtonMail/go-crypto v0.0.0-20230217124315-7d5c6f04bbb8 h1:wPbRQzjjwFc0ih8puEVAOFGELsn1zoIIYdxvML7mDxA=
-github.com/ProtonMail/go-crypto v0.0.0-20230217124315-7d5c6f04bbb8/go.mod h1:I0gYDMZ6Z5GRU7l58bNFSkPTFN6Yl12dsUlAZ8xy98g=
+github.com/Masterminds/sprig/v3 v3.2.3 h1:eL2fZNezLomi0uOLqjQoN6BfsDD+fyLtgbJMAj9n6YA=
+github.com/Masterminds/sprig/v3 v3.2.3/go.mod h1:rXcFaZ2zZbLRJv/xSysmlgIM1u11eBaRMhvYXJNkGuM=
+github.com/Microsoft/go-winio v0.6.1 h1:9/kr64B9VUZrLm5YYwbGtUJnMgqWVOdUAXu6Migciow=
+github.com/ProtonMail/go-crypto v0.0.0-20230923063757-afb1ddc0824c h1:kMFnB0vCcX7IL/m9Y5LO+KQYv+t1CQOiFe6+SV2J7bE=
+github.com/ProtonMail/go-crypto v0.0.0-20230923063757-afb1ddc0824c/go.mod h1:EjAoLdwvbIOoOQr3ihjnSoLZRtE8azugULFRteWMNc0=
+github.com/YakDriver/regexache v0.23.0 h1:kv3j4XKhbx/vqUilSBgizXDUXHvvH1KdYekdmGwz4C4=
+github.com/YakDriver/regexache v0.23.0/go.mod h1:K4BZ3MYKAqSFbYWqmbsG+OzYUDyJjnMEr27DJEsVG3U=
 github.com/acomagu/bufpipe v1.0.4 h1:e3H4WUzM3npvo5uv95QuJM3cQspFNtFBzvJ2oNjKIDQ=
 github.com/agext/levenshtein v1.2.3 h1:YB2fHEn0UJagG8T1rrWknE3ZQzWM06O8AMAatNn7lmo=
 github.com/agext/levenshtein v1.2.3/go.mod h1:JEDfjyjHDjOF/1e4FlBE/PkbqA9OfWu2ki2W0IB5558=
 github.com/apparentlymart/go-textseg/v12 v12.0.0/go.mod h1:S/4uRK2UtaQttw1GenVJEynmyUenKwP++x/+DdGV/Ec=
-github.com/apparentlymart/go-textseg/v13 v13.0.0 h1:Y+KvPE1NYz0xl601PVImeQfFyEy6iT90AvPUL1NNfNw=
-github.com/apparentlymart/go-textseg/v13 v13.0.0/go.mod h1:ZK2fH7c4NqDTLtiYLvIkEghdlcqw7yxLeM89kiTRPUo=
-github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310 h1:BUAU3CGlLvorLI26FmByPp2eC2qla6E1Tw+scpcg/to=
+github.com/apparentlymart/go-textseg/v15 v15.0.0 h1:uYvfpb3DyLSCGWnctWKGj857c6ew1u1fNQOlOtuGxQY=
+github.com/apparentlymart/go-textseg/v15 v15.0.0/go.mod h1:K8XmNZdhEBkdlyDdvbmmsvpAG721bKi0joRfFdHIWJ4=
 github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
-github.com/aws/aws-sdk-go v1.44.285 h1:rgoWYl+NdmKzRgoi/fZLEtGXOjCkcWIa5jPH02Uahdo=
-github.com/aws/aws-sdk-go v1.44.285/go.mod h1:aVsgQcEevwlmQ7qHE9I3h+dtQgpqhFB+i8Phjh7fkwI=
-github.com/aws/aws-sdk-go-v2 v1.18.0/go.mod h1:uzbQtefpm44goOPmdKyAlXSNcwlRgF3ePWVW6EtJvvw=
-github.com/aws/aws-sdk-go-v2 v1.18.1 h1:+tefE750oAb7ZQGzla6bLkOwfcQCEtC5y2RqoqCeqKo=
-github.com/aws/aws-sdk-go-v2 v1.18.1/go.mod h1:uzbQtefpm44goOPmdKyAlXSNcwlRgF3ePWVW6EtJvvw=
-github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.4.10 h1:dK82zF6kkPeCo8J1e+tGx4JdvDIQzj7ygIoLg8WMuGs=
-github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.4.10/go.mod h1:VeTZetY5KRJLuD/7fkQXMU6Mw7H5m/KP2J5Iy9osMno=
-github.com/aws/aws-sdk-go-v2/config v1.18.25 h1:JuYyZcnMPBiFqn87L2cRppo+rNwgah6YwD3VuyvaW6Q=
-github.com/aws/aws-sdk-go-v2/config v1.18.25/go.mod h1:dZnYpD5wTW/dQF0rRNLVypB396zWCcPiBIvdvSWHEg4=
-github.com/aws/aws-sdk-go-v2/credentials v1.13.24 h1:PjiYyls3QdCrzqUN35jMWtUK1vqVZ+zLfdOa/UPFDp0=
-github.com/aws/aws-sdk-go-v2/credentials v1.13.24/go.mod h1:jYPYi99wUOPIFi0rhiOvXeSEReVOzBqFNOX5bXYoG2o=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.13.3/go.mod h1:4Q0UFP0YJf0NrsEuEYHpM9fTSEVnD16Z3uyEF7J9JGM=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.13.4 h1:LxK/bitrAr4lnh9LnIS6i7zWbCOdMsfzKFBI6LUCS0I=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.13.4/go.mod h1:E1hLXN/BL2e6YizK1zFlYd8vsfi2GTjbjBazinMmeaM=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.33/go.mod h1:7i0PF1ME/2eUPFcjkVIwq+DOygHEoK92t5cDqNgYbIw=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.34 h1:A5UqQEmPaCFpedKouS4v+dHCTUo2sKqhoKO9U5kxyWo=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.34/go.mod h1:wZpTEecJe0Btj3IYnDx/VlUzor9wm3fJHyvLpQF0VwY=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.27/go.mod h1:UrHnn3QV/d0pBZ6QBAEQcqFLf8FAzLmoUfPVIueOvoM=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.28 h1:srIVS45eQuewqz6fKKu6ZGXaq6FuFg5NzgQBAM6g8Y4=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.28/go.mod h1:7VRpKQQedkfIEXb4k52I7swUnZP0wohVajJMRn3vsUw=
-github.com/aws/aws-sdk-go-v2/internal/ini v1.3.34 h1:gGLG7yKaXG02/jBlg210R7VgQIotiQntNhsCFejawx8=
-github.com/aws/aws-sdk-go-v2/internal/ini v1.3.34/go.mod h1:Etz2dj6UHYuw+Xw830KfzCfWGMzqvUTCjUj5b76GVDc=
-github.com/aws/aws-sdk-go-v2/service/accessanalyzer v1.19.14 h1:zNXf4WC1KZZKKMjlhkSfjKA90p6fQJHjmnBSj7JKHlk=
-github.com/aws/aws-sdk-go-v2/service/accessanalyzer v1.19.14/go.mod h1:3SKaBO7H4AJHi3Tv8WPxSlAKF3N6eVTxvqPTo1BvG/o=
-github.com/aws/aws-sdk-go-v2/service/account v1.10.8 h1:nvUpdu6IHqY9reKI8InrYpOa1cGadxiAgGITOa+vVyo=
-github.com/aws/aws-sdk-go-v2/service/account v1.10.8/go.mod h1:hC6WhRtoLcuUTRxx99fwVoSt5IzgELQBNdnzEZYzlPA=
-github.com/aws/aws-sdk-go-v2/service/acm v1.17.13 h1:v858/efJsg0ydr33NEbX6CidcOVGx0T0iIHgUrOh+xg=
-github.com/aws/aws-sdk-go-v2/service/acm v1.17.13/go.mod h1:3cAmFXTtyBKv5+JYgHK5EZ6ufCAlgHXCzDDWYG5AUaY=
-github.com/aws/aws-sdk-go-v2/service/appconfig v1.17.11 h1:z/fg62eLb5Hynz7c5R+/B9S9wxDZd20ofvt+rBmlzjU=
-github.com/aws/aws-sdk-go-v2/service/appconfig v1.17.11/go.mod h1:tpRhHndw04n6hgzicRXhsrLTCLagWJ8jtt7e3Wet7RU=
-github.com/aws/aws-sdk-go-v2/service/auditmanager v1.25.0 h1:+pED0OdEasz/zHWgy4s+hDzNXL1rfK+GBi74k54QkVE=
-github.com/aws/aws-sdk-go-v2/service/auditmanager v1.25.0/go.mod h1:ia6+sGa4z5LM8ho3hfV06VktSCpmFJo530vSsBDkbT4=
-github.com/aws/aws-sdk-go-v2/service/cleanrooms v1.1.6 h1:QhDbnfEp2TLbLpx6fWhcqfCvSo+7MFIjYhn2B+7dhSU=
-github.com/aws/aws-sdk-go-v2/service/cleanrooms v1.1.6/go.mod h1:kEOOfzYBRPmMvAhxer+ztu/WC0KC8l4nTytGUemU/Og=
-github.com/aws/aws-sdk-go-v2/service/cloudcontrol v1.11.14 h1:4r+ZNZuPN9qlYsSONoEK12IaEwzTCHBguZ7QVMq3FKQ=
-github.com/aws/aws-sdk-go-v2/service/cloudcontrol v1.11.14/go.mod h1:WDIYAtWm2b8ET3y8hSuUHLwSsOB5ZwBZkK7ioTTo7S4=
-github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.21.2 h1:zMnh9plMceN5DVuG55IjzEwAS3kbeG0GTNzmbnqI/C8=
-github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.21.2/go.mod h1:zuZWQM3kYD+ibkP3GBrAMbsfUvHK7p7yOwWh9MKsnYQ=
-github.com/aws/aws-sdk-go-v2/service/comprehend v1.24.4 h1:jGIp04h4FvujUjsGLUgwfe1cg/TPViomE5EBtxaCxv4=
-github.com/aws/aws-sdk-go-v2/service/comprehend v1.24.4/go.mod h1:t1X+vZJVxh7GXE8xoXpr8SG1RT31bXSF9BN6Rw9pt1Y=
-github.com/aws/aws-sdk-go-v2/service/computeoptimizer v1.24.2 h1:pw1ZCQIa25gKXEp7In+VHqS25xJRzpHX96Ha/U9qiVM=
-github.com/aws/aws-sdk-go-v2/service/computeoptimizer v1.24.2/go.mod h1:sBj1DJdinQBuuaeAD/KJAfWEKd/3CtbW8vhgqE0phyw=
-github.com/aws/aws-sdk-go-v2/service/directoryservice v1.17.3 h1:Ij9KqZAu7JM6H+1pcysufBUi56aaWDSNAVXcNqDHLXg=
-github.com/aws/aws-sdk-go-v2/service/directoryservice v1.17.3/go.mod h1:cFv2leRY0jEdFFXPC9iT4HSdYuC3LO3dhDEfMPkObtg=
-github.com/aws/aws-sdk-go-v2/service/docdbelastic v1.1.12 h1:p4VxoGiHg+nJHPAXIpTSuXF+1SoHmNPfplzkR3Fmi0k=
-github.com/aws/aws-sdk-go-v2/service/docdbelastic v1.1.12/go.mod h1:2UtZqzdVwPZMvQfbMXaiTFmqHzH0djspNEJWAmP6U9c=
-github.com/aws/aws-sdk-go-v2/service/ec2 v1.101.0 h1:mELn7pIvmCW/FESssXir+rNG201nkgcQtGN2iTEGu/g=
-github.com/aws/aws-sdk-go-v2/service/ec2 v1.101.0/go.mod h1:tIctCeX9IbzsUTKHt53SVEcgyfxV2ElxJeEB+QUbc4M=
-github.com/aws/aws-sdk-go-v2/service/finspace v1.10.2 h1:SszO0FFI23oCM30QIJCJ1IKfl+FhCxoLuEwWSw5CkSg=
-github.com/aws/aws-sdk-go-v2/service/finspace v1.10.2/go.mod h1:go0pcProAlBpDBh9g1l9h8XvOL8zfeBqA2tc2DvH9AM=
-github.com/aws/aws-sdk-go-v2/service/fis v1.14.12 h1:ePwiKxedbAePZLNza3Yb0C52dguII3gLEsxBg7D/3AI=
-github.com/aws/aws-sdk-go-v2/service/fis v1.14.12/go.mod h1:tygYAthjrOZANZe156t+zECxhYHw/kYVNkCU6rvI5cI=
-github.com/aws/aws-sdk-go-v2/service/glacier v1.14.13 h1:2kfsHVFJTIAcc6dOkxv9syph4211EJe0pIcwrRJ1U6M=
-github.com/aws/aws-sdk-go-v2/service/glacier v1.14.13/go.mod h1:ojK9fioQX8Cz8xdoXRp304sF9s5YHvLvhIrr4GswCzs=
-github.com/aws/aws-sdk-go-v2/service/healthlake v1.16.2 h1:DE9750UM0zcleUk5meiZL/bHPZzDOQHIDhGdcPIp+7w=
-github.com/aws/aws-sdk-go-v2/service/healthlake v1.16.2/go.mod h1:7dapfq6ZyDrAl4hv6hgxYuLYbUUQd5E+ngSdXvun6ys=
-github.com/aws/aws-sdk-go-v2/service/iam v1.20.2 h1:ZR0W8HrZ2QnBuwJzPTtR1cMVrNxoIr0vHE9SI8tu5Cw=
-github.com/aws/aws-sdk-go-v2/service/iam v1.20.2/go.mod h1:aQZ8BI+reeaY7RI/QQp7TKCSUHOesTdrzzylp3CW85c=
-github.com/aws/aws-sdk-go-v2/service/identitystore v1.16.13 h1:xYUE2IwzSq1rNK9uf8BsxVVxFSeJzKgZ2VFc1zDT+iU=
-github.com/aws/aws-sdk-go-v2/service/identitystore v1.16.13/go.mod h1:siVgFYduB/ThkiyUhVIBQ5AG3wBpbFho4KIQOHQLR2s=
-github.com/aws/aws-sdk-go-v2/service/inspector2 v1.14.2 h1:CvtMCEed02XOIoA8ZmIYP9Q/AxkAqTXnA2yeRUnMCfo=
-github.com/aws/aws-sdk-go-v2/service/inspector2 v1.14.2/go.mod h1:a2EqXrt+5o49Cnp4iMc2Tpt38ZUiX8aJsNy9ZzH+y/s=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.27/go.mod h1:EOwBD4J4S5qYszS5/3DpkejfuK+Z5/1uzICfPaZLtqw=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.28 h1:bkRyG4a929RCnpVSTvLM2j/T4ls015ZhhYApbmYs15s=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.28/go.mod h1:jj7znCIg05jXlaGBlFMGP8+7UN3VtCkRBG2spnmRQkU=
-github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.14.3 h1:dBL3StFxHtpBzJJ/mNEsjXVgfO+7jR0dAIEwLqMapEA=
-github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.14.3/go.mod h1:f1QyiAsvIv4B49DmCqrhlXqyaR+0IxMmyX+1P+AnzOM=
-github.com/aws/aws-sdk-go-v2/service/ivschat v1.4.7 h1:pI950CQHVEFW2/+UklRO4TWzHdO83bedFO9s6vH1R3k=
-github.com/aws/aws-sdk-go-v2/service/ivschat v1.4.7/go.mod h1:oOLFrfP14cyQdTsc3I8VohdYb8g86I7xduoMALyKLj0=
-github.com/aws/aws-sdk-go-v2/service/kendra v1.40.4 h1:a5zhzI2i0NDtT6MEO7OnIOX5SD+ix3hp2HTdm2Rsf/M=
-github.com/aws/aws-sdk-go-v2/service/kendra v1.40.4/go.mod h1:huU0BQC+O9qcc3vrANhwkC9KP0hGg1quffiyfbJ1Ktg=
-github.com/aws/aws-sdk-go-v2/service/lambda v1.35.2 h1:MeukRLx5lbfObw2gH2FePNJPCsYrsC7vuXPNf+Oa5oo=
-github.com/aws/aws-sdk-go-v2/service/lambda v1.35.2/go.mod h1:Q8zQi5nZpjUF/H55dKEpKfEvFWJkgZzjjqvDb2AR5b4=
-github.com/aws/aws-sdk-go-v2/service/lightsail v1.27.1 h1:q9YZIsBPkeafzYPAJUquHZW5WkdmsLLu4jWlWzNEyjI=
-github.com/aws/aws-sdk-go-v2/service/lightsail v1.27.1/go.mod h1:il65k5YeNrQVAw6GXT/7/ZGmiQ0nKXKLsc3T9+/GXbI=
-github.com/aws/aws-sdk-go-v2/service/medialive v1.31.6 h1:WFOpGQ+WHDIDimce3dAf/GiFOlme5TJI6SmvQe1WV6Q=
-github.com/aws/aws-sdk-go-v2/service/medialive v1.31.6/go.mod h1:HY+J2fuuc8zncrXB5MRAjsQDGIl9tmCpf+7X7ySZ8V8=
-github.com/aws/aws-sdk-go-v2/service/oam v1.1.13 h1:JaXK3OSWCUs+gKG84P1ojFhI8PC9o/c2JRrdSjYd11k=
-github.com/aws/aws-sdk-go-v2/service/oam v1.1.13/go.mod h1:w6pNi/5sYUHurOQW0hpUr4mxGYvUzEtbAQ2xg3qNHR0=
-github.com/aws/aws-sdk-go-v2/service/opensearchserverless v1.2.6 h1:tADh6fIpsh0XTvqY45kZbkk44dJ2VYt0jOF7SGXB0+4=
-github.com/aws/aws-sdk-go-v2/service/opensearchserverless v1.2.6/go.mod h1:Ju/rPQaOhCUQAFIZlf+drYB+YJQSuwbCYlAzfCGQVQc=
-github.com/aws/aws-sdk-go-v2/service/pipes v1.2.8 h1:TPr7uAucpAvgE0ac9zMs/LTx9O0dmLWHWr2mkZjL4iY=
-github.com/aws/aws-sdk-go-v2/service/pipes v1.2.8/go.mod h1:T8pM2eiirH5Ld58Ek+t7tK3SqQNUwp9zkqkslW1v8sM=
-github.com/aws/aws-sdk-go-v2/service/rbin v1.8.14 h1:oEeNqSze4JYbhsDg7udtz+AtLwrIXlvjItAd09Z2zTw=
-github.com/aws/aws-sdk-go-v2/service/rbin v1.8.14/go.mod h1:JehbzDgwXYQi1wqKKFLstaNqsRPgPu9Kd6DiwhtFxoA=
-github.com/aws/aws-sdk-go-v2/service/rds v1.45.2 h1:tKZ+n9/BTnNYXZo80nIoFes7QEbOd/lnbp0EkPbHfUU=
-github.com/aws/aws-sdk-go-v2/service/rds v1.45.2/go.mod h1:goBDR4OPrsnKpYyU0GHGcEnlTmL8O+eKGsWeyOAFJ5M=
-github.com/aws/aws-sdk-go-v2/service/resourceexplorer2 v1.2.15 h1:V9D5mkuxoHp0emavQh6YDRZgh++sI+Yhl0jWcXmGyzU=
-github.com/aws/aws-sdk-go-v2/service/resourceexplorer2 v1.2.15/go.mod h1:JkXv1RqDLs6Bpgj2EtFpVW4J83lEewuTiQJwzj8dzvs=
-github.com/aws/aws-sdk-go-v2/service/rolesanywhere v1.2.2 h1:Dc3UON/Ry+dcDbXNLsyi2JPlfhNbaBRXqYg7ItYvJF8=
-github.com/aws/aws-sdk-go-v2/service/rolesanywhere v1.2.2/go.mod h1:PKn6HQ0RaVbZn+nPAl7UpxbVvDJv0JxWj7m+XTMzZZI=
-github.com/aws/aws-sdk-go-v2/service/route53domains v1.15.0 h1:H7c53dt/1Wsp3fWbu5v5+XVNsThWzmxzYdyYLltWtec=
-github.com/aws/aws-sdk-go-v2/service/route53domains v1.15.0/go.mod h1:k75fR3BhOo/0umex9ICEJ+CKTA55qxvFWAlyVHTS6Qg=
-github.com/aws/aws-sdk-go-v2/service/s3control v1.31.7 h1:dTPOxNtrOt1NU/3DstjpNOAT7qjnMcZ08ah4A3zuu2w=
-github.com/aws/aws-sdk-go-v2/service/s3control v1.31.7/go.mod h1:mRBY8itC2zX/tZL7IzZBORR7fqCpFy6GCNWYVx9jE7o=
-github.com/aws/aws-sdk-go-v2/service/scheduler v1.1.13 h1:g3mR/LmI0SQILlRqWqENskXVaU1E6kbRzoWVkOJOAes=
-github.com/aws/aws-sdk-go-v2/service/scheduler v1.1.13/go.mod h1:B0FqPtgWXfV5NSlEPtR+V7zBlaAScNWL6uOsXu4owfI=
-github.com/aws/aws-sdk-go-v2/service/securitylake v1.4.3 h1:lkme0ZphoOBLozbJ7d+oiWdhn4XgUjqL7IkCBWHZxH4=
-github.com/aws/aws-sdk-go-v2/service/securitylake v1.4.3/go.mod h1:2+ps4raDazjHdffquUq0KO6G4MsCLUMAEfITwPZkPzw=
-github.com/aws/aws-sdk-go-v2/service/sesv2 v1.18.2 h1:+Q13MHUoGJ02puTt1fTtePY8FvpGhAvkpbCgHJq/0m4=
-github.com/aws/aws-sdk-go-v2/service/sesv2 v1.18.2/go.mod h1:CirPyae+ZPYmzWUJfRvxhRs00yAyK9mh/r61+oKk3SM=
-github.com/aws/aws-sdk-go-v2/service/ssm v1.36.6 h1:/DEPQUCqR6UoJjW4a21gW9AqjFlRSTwyOmciNef19qI=
-github.com/aws/aws-sdk-go-v2/service/ssm v1.36.6/go.mod h1:NdyMyZH/FzmCaybTrVMBD0nTCGrs1G4cOPKHFywx9Ns=
-github.com/aws/aws-sdk-go-v2/service/ssmcontacts v1.15.6 h1:VB4peY1f3jQeyVQ8j06RH+ExeBD1w9QLGNyA+riIDew=
-github.com/aws/aws-sdk-go-v2/service/ssmcontacts v1.15.6/go.mod h1:acZsEd16A53TrcSdmUZ4emKmmSp2dCJLf7cJbou7ArI=
-github.com/aws/aws-sdk-go-v2/service/ssmincidents v1.21.6 h1:7tFvTeZ8EsVVkBByv9Q66WqenXLk7T62HC7cFwxAaIs=
-github.com/aws/aws-sdk-go-v2/service/ssmincidents v1.21.6/go.mod h1:8wiHOckjElK6ywHQlWjbDrmEZOg7JGcicM2zkEeojUI=
-github.com/aws/aws-sdk-go-v2/service/sso v1.12.10/go.mod h1:ouy2P4z6sJN70fR3ka3wD3Ro3KezSxU6eKGQI2+2fjI=
-github.com/aws/aws-sdk-go-v2/service/sso v1.12.12 h1:nneMBM2p79PGWBQovYO/6Xnc2ryRMw3InnDJq1FHkSY=
-github.com/aws/aws-sdk-go-v2/service/sso v1.12.12/go.mod h1:HuCOxYsF21eKrerARYO6HapNeh9GBNq7fius2AcwodY=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.14.10/go.mod h1:AFvkxc8xfBe8XA+5St5XIHHrQQtkxqrRincx4hmMHOk=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.14.12 h1:2qTR7IFk7/0IN/adSFhYu9Xthr0zVFTgBrmPldILn80=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.14.12/go.mod h1:E4VrHCPzmVB/KFXtqBGKb3c8zpbNBgKe3fisDNLAW5w=
-github.com/aws/aws-sdk-go-v2/service/sts v1.19.0/go.mod h1:BgQOMsg8av8jset59jelyPW7NoZcZXLVpDsXunGDrk8=
-github.com/aws/aws-sdk-go-v2/service/sts v1.19.2 h1:XFJ2Z6sNUUcAz9poj+245DMkrHE4h2j5I9/xD50RHfE=
-github.com/aws/aws-sdk-go-v2/service/sts v1.19.2/go.mod h1:dp0yLPsLBOi++WTxzCjA/oZqi6NPIhoR+uF7GeMU9eg=
-github.com/aws/aws-sdk-go-v2/service/swf v1.15.2 h1:2ozdtzVA8NpZZZrE1BwYbWVbtA0uJ9rph2+LIgVF22k=
-github.com/aws/aws-sdk-go-v2/service/swf v1.15.2/go.mod h1:Jj8X0ex+9XIXgNI/zD/g0jvv2wd5LHEZq29FlJj1RUc=
-github.com/aws/aws-sdk-go-v2/service/transcribe v1.26.8 h1:KfCL992IXYjCPT62KGBMCOxf4cvu5OwwqcJZRBORL+U=
-github.com/aws/aws-sdk-go-v2/service/transcribe v1.26.8/go.mod h1:F8gPtIYU0JYmVyPeQI0zf8geCpbupPJfo3wPoIV6wy0=
-github.com/aws/aws-sdk-go-v2/service/vpclattice v1.0.7 h1:SovLGhSpSnv9AQyW2ANCxzc1X4ri1ptsLM5nIR0rTFs=
-github.com/aws/aws-sdk-go-v2/service/vpclattice v1.0.7/go.mod h1:ZYUcLmMNXSVsWPC8r2d6DXhAlu5uqdU6u2lxLDOvf/8=
-github.com/aws/aws-sdk-go-v2/service/xray v1.16.13 h1:I1j641YyiML0WBbTYkitzVkO7rwhTtUdhACrwEirCBg=
-github.com/aws/aws-sdk-go-v2/service/xray v1.16.13/go.mod h1:8jQIOnrQNc+m4x1CxrGulz7Xa27YtGRbpDb4NZp4uyc=
-github.com/aws/smithy-go v1.13.5 h1:hgz0X/DX0dGqTYpGALqXJoRKRj5oQ7150i5FdTePzO8=
-github.com/aws/smithy-go v1.13.5/go.mod h1:Tg+OJXh4MB2R/uN61Ko2f6hTZwB/ZYGOtib8J3gBHzA=
+github.com/armon/go-radix v1.0.0 h1:F4z6KzEeeQIMeLFa97iZU6vupzoecKdU5TX24SNppXI=
+github.com/armon/go-radix v1.0.0/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
+github.com/aws/aws-sdk-go v1.46.6 h1:6wFnNC9hETIZLMf6SOTN7IcclrOGwp/n9SLp8Pjt6E8=
+github.com/aws/aws-sdk-go v1.46.6/go.mod h1:aVsgQcEevwlmQ7qHE9I3h+dtQgpqhFB+i8Phjh7fkwI=
+github.com/aws/aws-sdk-go-v2 v1.21.1/go.mod h1:ErQhvNuEMhJjweavOYhxVkn2RUx7kQXVATHrjKtxIpM=
+github.com/aws/aws-sdk-go-v2 v1.21.2 h1:+LXZ0sgo8quN9UOKXXzAWRT3FWd4NxeXWOZom9pE7GA=
+github.com/aws/aws-sdk-go-v2 v1.21.2/go.mod h1:ErQhvNuEMhJjweavOYhxVkn2RUx7kQXVATHrjKtxIpM=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.4.14 h1:Sc82v7tDQ/vdU1WtuSyzZ1I7y/68j//HJ6uozND1IDs=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.4.14/go.mod h1:9NCTOURS8OpxvoAVHq79LK81/zC78hfRWFn+aL0SPcY=
+github.com/aws/aws-sdk-go-v2/config v1.19.1 h1:oe3vqcGftyk40icfLymhhhNysAwk0NfiwkDi2GTPMXs=
+github.com/aws/aws-sdk-go-v2/config v1.19.1/go.mod h1:ZwDUgFnQgsazQTnWfeLWk5GjeqTQTL8lMkoE1UXzxdE=
+github.com/aws/aws-sdk-go-v2/credentials v1.13.43 h1:LU8vo40zBlo3R7bAvBVy/ku4nxGEyZe9N8MqAeFTzF8=
+github.com/aws/aws-sdk-go-v2/credentials v1.13.43/go.mod h1:zWJBz1Yf1ZtX5NGax9ZdNjhhI4rgjfgsyk6vTY1yfVg=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.13.13 h1:PIktER+hwIG286DqXyvVENjgLTAwGgoeriLDD5C+YlQ=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.13.13/go.mod h1:f/Ib/qYjhV2/qdsf79H3QP/eRE4AkVyEf6sk7XfZ1tg=
+github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.11.92 h1:nLA7dGFC6v4P6b+hzqt5GqIGmIuN+jTJzojfdOLXWFE=
+github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.11.92/go.mod h1:h+ei9z19AhoN+Dac92DwkzfbJ4mFUea92xgl5pKSG0Q=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.42/go.mod h1:oDfgXoBBmj+kXnqxDDnIDnC56QBosglKp8ftRCTxR+0=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.43 h1:nFBQlGtkbPzp/NjZLuFxRqmT91rLJkgvsEQs68h962Y=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.43/go.mod h1:auo+PiyLl0n1l8A0e8RIeR8tOzYPfZZH/JNlrJ8igTQ=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.36/go.mod h1:rwr4WnmFi3RJO0M4dxbJtgi9BPLMpVBMX1nUte5ha9U=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.37 h1:JRVhO25+r3ar2mKGP7E0LDl8K9/G36gjlqca5iQbaqc=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.37/go.mod h1:Qe+2KtKml+FEsQF/DHmDV+xjtche/hwoF75EG4UlHW8=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.3.45 h1:hze8YsjSh8Wl1rYa1CJpRmXP21BvOBuc76YhW0HsuQ4=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.3.45/go.mod h1:lD5M20o09/LCuQ2mE62Mb/iSdSlCNuj6H5ci7tW7OsE=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.1.6 h1:wmGLw2i8ZTlHLw7a9ULGfQbuccw8uIiNr6sol5bFzc8=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.1.6/go.mod h1:Q0Hq2X/NuL7z8b1Dww8rmOFl+jzusKEcyvkKspwdpyc=
+github.com/aws/aws-sdk-go-v2/service/accessanalyzer v1.21.2 h1:5R7Sl/DwDC4nPrlGErsMf5XFCcnJ/l8UY6xLHb3siVI=
+github.com/aws/aws-sdk-go-v2/service/accessanalyzer v1.21.2/go.mod h1:VJG7AGbDMjEYpFSgwbBcAUT5W64siPAgnrNZViNKz8k=
+github.com/aws/aws-sdk-go-v2/service/account v1.11.7 h1:77Y0z87uZbG7R3djQJhxLetw6dES7F2W3vmcXIMa0mc=
+github.com/aws/aws-sdk-go-v2/service/account v1.11.7/go.mod h1:hIGpFtNvJLOEDfp9hqnRVYfah6i9JDKqpyh/EGxDw1U=
+github.com/aws/aws-sdk-go-v2/service/acm v1.19.2 h1:M+BY1Sk+AcWg596Nz3MMX630a3vposBFDaTan+UD/Kk=
+github.com/aws/aws-sdk-go-v2/service/acm v1.19.2/go.mod h1:Zx0vrYeKZEZIPnggUx09FdoXze1+2i6Od+lHsG/L3vU=
+github.com/aws/aws-sdk-go-v2/service/appconfig v1.23.0 h1:lN+EsDRxYDYeRHYXZ+3uTSYeEhmXYULg5qBABSqVIrk=
+github.com/aws/aws-sdk-go-v2/service/appconfig v1.23.0/go.mod h1:7bTOwXFz4+VxkDVB26d7TAhFKloGA3EtwtLAydyv1ek=
+github.com/aws/aws-sdk-go-v2/service/auditmanager v1.27.0 h1:pz81qsD+FxrrHOaNrfGSWbQ4cU6Dxj2I5tvlrLmgCUE=
+github.com/aws/aws-sdk-go-v2/service/auditmanager v1.27.0/go.mod h1:zEDWBhc3yodpWk3ZLDNPlTOZGNx0bGx90XQma07xR1Q=
+github.com/aws/aws-sdk-go-v2/service/cleanrooms v1.4.2 h1:qt0XqbZAU+ZnaqQqvuafocTm/KPKIxf0GPRObbMvhGc=
+github.com/aws/aws-sdk-go-v2/service/cleanrooms v1.4.2/go.mod h1:bbDwGddkt+EcDTY6PuJVKyXesjbQ61r7erTlBm+tIy4=
+github.com/aws/aws-sdk-go-v2/service/cloudcontrol v1.12.7 h1:XbzkTIZi+VwbpQHnWdSCPlnhKQo8upmObVHLBcJVx5s=
+github.com/aws/aws-sdk-go-v2/service/cloudcontrol v1.12.7/go.mod h1:UES6/e6TFF6cpex9s9ks+Zuup3Vf9HcL8kpcDXEV0QI=
+github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.24.2 h1:g2t+hNCOYWICWs0cQLXk86DnXQMXgx1omrAGEpF/d68=
+github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.24.2/go.mod h1:5ngOUsc/7/voqXQ5Mn5T5l9/rWopTMgu7hk+4Fl2AS4=
+github.com/aws/aws-sdk-go-v2/service/codecatalyst v1.5.7 h1:d2tImK3KffYtFb0xVY4CQM0dqgGxxqB8HhlImdTVp7g=
+github.com/aws/aws-sdk-go-v2/service/codecatalyst v1.5.7/go.mod h1:mbPhpQ0SRnwxVDYqHOLny+X3QozY1DBPbhBvtYtTlCw=
+github.com/aws/aws-sdk-go-v2/service/codestarconnections v1.15.8 h1:ZNCHBGGFpOH1G0tJhpLjsWITXOuDZEOAwq5HN351aDc=
+github.com/aws/aws-sdk-go-v2/service/codestarconnections v1.15.8/go.mod h1:RhrN9J+LVtEMjEQPZQyhnO4A0LiOKT732AHDy7sYsIc=
+github.com/aws/aws-sdk-go-v2/service/codestarnotifications v1.17.0 h1:STOjCDhbX5IPRG3lUVpc9mQv0o7ECZFDEMHUzCVwOjg=
+github.com/aws/aws-sdk-go-v2/service/codestarnotifications v1.17.0/go.mod h1:B10oKKFd10DeYPN8qYeXFtNCEGjSnZ60EG3FeGli8FA=
+github.com/aws/aws-sdk-go-v2/service/comprehend v1.25.7 h1:x03mvMDVDdvH/Xk+U7kLaQJ3eA7kSYr0t5lbZgi0bnk=
+github.com/aws/aws-sdk-go-v2/service/comprehend v1.25.7/go.mod h1:zvkBeCgksf5F/XOlNY6g34QOlo1dOUne9okw6gznZAI=
+github.com/aws/aws-sdk-go-v2/service/computeoptimizer v1.27.2 h1:X9F5HmF5GELOsSwdu0cJFviemuVHqteYIIfpZZ7yvEI=
+github.com/aws/aws-sdk-go-v2/service/computeoptimizer v1.27.2/go.mod h1:if6fmhug8f0CUqd7xHbxY8VsgLPRRXAs26/sbVJT9wc=
+github.com/aws/aws-sdk-go-v2/service/directoryservice v1.19.0 h1:erGB6hvk3Gala8lkpaGg5I6exnShvTLl7/Gmlt/NoaM=
+github.com/aws/aws-sdk-go-v2/service/directoryservice v1.19.0/go.mod h1:2m0QmkUL+PSwJ74GY+5xR3rgDUmjg9W629PMxsLvG68=
+github.com/aws/aws-sdk-go-v2/service/docdbelastic v1.3.2 h1:PhSKGmHpNQ4zRWPd36fquIbrxRlp0ia8S7O3gR4ah74=
+github.com/aws/aws-sdk-go-v2/service/docdbelastic v1.3.2/go.mod h1:JE7FKd3vLDLXxZK48NYQQNnMkqalW0TYYDYMtXO7AK4=
+github.com/aws/aws-sdk-go-v2/service/dynamodb v1.22.1 h1:TYq4EU2vEEluoaBG0RCPnbibSndTQSzlpbZdmT/YRcs=
+github.com/aws/aws-sdk-go-v2/service/dynamodb v1.22.1/go.mod h1:1EJb9/tJwI7iqiStZBcmHijQxcgp7dlPuD2YgoZIrJQ=
+github.com/aws/aws-sdk-go-v2/service/ec2 v1.128.0 h1:JCUTmTs7W1yvUCOdONMX7Hjgn7N9pj57y4/ibU4KFp4=
+github.com/aws/aws-sdk-go-v2/service/ec2 v1.128.0/go.mod h1:raUdIDoNuDPn9dMG3cCmIm8RoWOmZUqQPzuw8xpmB8Y=
+github.com/aws/aws-sdk-go-v2/service/emrserverless v1.11.2 h1:diyMrawOZ56CavFS//UFFjk2LY1ooXeTqAecXsjtXwI=
+github.com/aws/aws-sdk-go-v2/service/emrserverless v1.11.2/go.mod h1:ZrmnnT6zI3+0XsQIGCu/vXhIFk4Vwu4WKqeMDSzm4z4=
+github.com/aws/aws-sdk-go-v2/service/finspace v1.13.0 h1:gsitjGgLSd0hdfReRk+Lc6Rrcg7UMUIqe3eO1m61H5o=
+github.com/aws/aws-sdk-go-v2/service/finspace v1.13.0/go.mod h1:TKYYw/RwUTrm8/6qRvxtNZpAfzPJ0zrUJAWOrrreCpQ=
+github.com/aws/aws-sdk-go-v2/service/fis v1.17.0 h1:zAsleap91sZkiLMQm0oB1ypNdGdSpAtCgRrBY35Fiwg=
+github.com/aws/aws-sdk-go-v2/service/fis v1.17.0/go.mod h1:zLKsp8cB3L0gqEW4d8NG1cZwQeczg4HqqLm5/b9d8rs=
+github.com/aws/aws-sdk-go-v2/service/glacier v1.16.2 h1:3e1Y17V637Qx/9rZJZFpC1FR/lL3Js9IFwZCWCkxiIo=
+github.com/aws/aws-sdk-go-v2/service/glacier v1.16.2/go.mod h1:W5b9hqb4sCTIBOacfItRmL72QzvB2Qasq5tmJfn9BlQ=
+github.com/aws/aws-sdk-go-v2/service/healthlake v1.17.7 h1:785/FmKD/qDYKW2adVxc4y3PIybe+U/qRI3zHe3quLw=
+github.com/aws/aws-sdk-go-v2/service/healthlake v1.17.7/go.mod h1:HJh0/bNoBvtnowJ2m8TimynLgAfhuxSVw+tz7eorxQw=
+github.com/aws/aws-sdk-go-v2/service/iam v1.22.6 h1:AL1fgN3/LHI7WJMKx63Osvsmk3f+EyHIJme0DQFasog=
+github.com/aws/aws-sdk-go-v2/service/iam v1.22.6/go.mod h1:GM5AHRAQGBgA3U6n7HwpWZGCPyxKLCgM7JSSAuoUWU8=
+github.com/aws/aws-sdk-go-v2/service/identitystore v1.18.4 h1:ubNPVqOVw+TJ6jLfXxbchjRmWiQ5WLXi/c35/1XHqeQ=
+github.com/aws/aws-sdk-go-v2/service/identitystore v1.18.4/go.mod h1:iCXR+ssQIxKT/EqO2G2UD2ZY9XiZxC3LO3o5W6VeKQA=
+github.com/aws/aws-sdk-go-v2/service/inspector2 v1.17.0 h1:QyhIBKR2ybHeRXAiKlvRo4uLZoT0pcGS7Cc6KmLpW68=
+github.com/aws/aws-sdk-go-v2/service/inspector2 v1.17.0/go.mod h1:wpOdgJi4x/PBXWpoSM4QRcqJomrSRf8Ynke8g5D3Tco=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.9.15 h1:7R8uRYyXzdD71KWVCL78lJZltah6VVznXBazvKjfH58=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.9.15/go.mod h1:26SQUPcTNgV1Tapwdt4a1rOsYRsnBsJHLMPoxK2b0d8=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.1.38 h1:skaFGzv+3kA+v2BPKhuekeb1Hbb105+44r8ASC+q5SE=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.1.38/go.mod h1:epIZoRSSbRIwLPJU5F+OldHhwZPBdpDeQkRdCeY3+00=
+github.com/aws/aws-sdk-go-v2/service/internal/endpoint-discovery v1.7.36/go.mod h1:zAE5h/4VanzBpqyWoCZX/nJImdsqjjsGt2r3MtbKSFA=
+github.com/aws/aws-sdk-go-v2/service/internal/endpoint-discovery v1.7.37 h1:4LoizcvPT9A0tiAFhepxn0bGZXkzvN0pG0epydY3Pno=
+github.com/aws/aws-sdk-go-v2/service/internal/endpoint-discovery v1.7.37/go.mod h1:7xBUZyP6LeLc+5Ym9PG7atqw4sR28sBtYcHETik+bPE=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.37 h1:WWZA/I2K4ptBS1kg0kV1JbBtG/umed0vwHRrmcr9z7k=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.37/go.mod h1:vBmDnwWXWxNPFRMmG2m/3MKOe+xEcMDo1tanpaWCcck=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.15.6 h1:9ulSU5ClouoPIYhDQdg9tpl83d5Yb91PXTKK+17q+ow=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.15.6/go.mod h1:lnc2taBsR9nTlz9meD+lhFZZ9EWY712QHrRflWpTcOA=
+github.com/aws/aws-sdk-go-v2/service/internetmonitor v1.6.2 h1:JD5IUr3CejC0kGxvnU8dxkl2k383n94QdUcxb2Vt+Nw=
+github.com/aws/aws-sdk-go-v2/service/internetmonitor v1.6.2/go.mod h1:Dj1bgHF1Ikb61w1D9bXLypZfPD9vwojs7DUe+wurCL0=
+github.com/aws/aws-sdk-go-v2/service/ivschat v1.6.2 h1:fs5s2FluB+7MxT9ciRYrYQjfPxfFAakFfHS+KpscQx4=
+github.com/aws/aws-sdk-go-v2/service/ivschat v1.6.2/go.mod h1:ZMkzeFf1mD4t/D0astNbbdGBXrY6Xn0CqcQfq7znfao=
+github.com/aws/aws-sdk-go-v2/service/kafka v1.24.0 h1:25GTIbwI/L/zdNHTxzJDg4JiiLOnZBL2WZSj8UyK16M=
+github.com/aws/aws-sdk-go-v2/service/kafka v1.24.0/go.mod h1:n5GUmBbNhSLO2NMpODVwrfqqZWaP2cro4QXxamzU1RE=
+github.com/aws/aws-sdk-go-v2/service/kendra v1.44.0 h1:lr+JNpmf4zPFobZC192iiy+8KIesdEQXjmTGy4hJrEo=
+github.com/aws/aws-sdk-go-v2/service/kendra v1.44.0/go.mod h1:/OvU9HvHY03NYNI01IXJO8LLK/7AQOsK87byCDE+pQc=
+github.com/aws/aws-sdk-go-v2/service/keyspaces v1.4.7 h1:2CSLIVJSGMa5S6Og4M/Nx9AZLOs0xJVX/qmcj4YRL4E=
+github.com/aws/aws-sdk-go-v2/service/keyspaces v1.4.7/go.mod h1:s42chwUVdTwyeMFLFJ3RZVx/cQ8X2791JqHeKs39OcE=
+github.com/aws/aws-sdk-go-v2/service/lambda v1.41.0 h1:AQK0v7JA0stOOi1cNOq4n9N3X1a3N3A2Ezt3UEyHL9o=
+github.com/aws/aws-sdk-go-v2/service/lambda v1.41.0/go.mod h1:kFs07FNyTowZkz+dGBR33xJbzGs2mkC5Kfm6/lyR5CA=
+github.com/aws/aws-sdk-go-v2/service/lexmodelsv2 v1.33.0 h1:z5zCrHSiY/oFWR2tKYzHlKUEmSoiZ6nEc+v2hcRtdA0=
+github.com/aws/aws-sdk-go-v2/service/lexmodelsv2 v1.33.0/go.mod h1:dbmSa5HVnGr1MZwEi4okJLfx4Z7J8ur/cSwiBIgTkZg=
+github.com/aws/aws-sdk-go-v2/service/lightsail v1.29.0 h1:Io+ezo97hWDmcg3tSMJbMoL1zd5zJ8BxK8Y8yB2Chfs=
+github.com/aws/aws-sdk-go-v2/service/lightsail v1.29.0/go.mod h1:u2yl3D9ygNXthorLQOj2wmMPSxWBGZ+XTlkVbsK2Bh8=
+github.com/aws/aws-sdk-go-v2/service/mediaconnect v1.21.0 h1:0nqFG7I3G+4JodX+pxIi++qi96EGSXAZxwPQYFDZI9c=
+github.com/aws/aws-sdk-go-v2/service/mediaconnect v1.21.0/go.mod h1:xpU8ugTBGYX8Q2Oo0JeRsXUz22emMuKiNJs8N3GkByQ=
+github.com/aws/aws-sdk-go-v2/service/medialive v1.38.0 h1:0/fzOrxQrnMYs/apbFW0Pg155NWquYVQnNW2EC90lbg=
+github.com/aws/aws-sdk-go-v2/service/medialive v1.38.0/go.mod h1:lINBgPiWIs+HmltgiBaphp9vb6ARUbxqkf2iV5RG71s=
+github.com/aws/aws-sdk-go-v2/service/mediapackage v1.24.1 h1:9eprT2FXGm7+jzdxqsT2XgW6+cQ28N2EKuNyhu/B0EQ=
+github.com/aws/aws-sdk-go-v2/service/mediapackage v1.24.1/go.mod h1:DX1RiU0NNEEKHsi6Qx17XICo4R63yV6ED8HRQXqZzRM=
+github.com/aws/aws-sdk-go-v2/service/oam v1.4.2 h1:7yyahY9W1PT1f/YzJANF0Rcjt1iYv/Gfo1VVb5xMNlE=
+github.com/aws/aws-sdk-go-v2/service/oam v1.4.2/go.mod h1:Xy10stQLwlkUqnDebKBrHJkiPgj4ifwo35kYwrSfhvI=
+github.com/aws/aws-sdk-go-v2/service/opensearchserverless v1.6.0 h1:i3dePKIcfgtcHWWWtt6861lsIPcVt8grtYMnD/d7pt0=
+github.com/aws/aws-sdk-go-v2/service/opensearchserverless v1.6.0/go.mod h1:FYUH57MkKKdCtmW/e7AVL4IDHdMA/u3N6yCkvcXlehM=
+github.com/aws/aws-sdk-go-v2/service/pipes v1.4.3 h1:OgaiJYVLvgbPP46LUzZW1u0huJaSN8dc7XlEwPfTDg0=
+github.com/aws/aws-sdk-go-v2/service/pipes v1.4.3/go.mod h1:Q2dPlvCZoor/OzUVvQ3wLBOiSYGbEmXqSYYi6YaV5O0=
+github.com/aws/aws-sdk-go-v2/service/pricing v1.21.9 h1:SlhalyLhNxYXFXORYs/mfuSlmDzSgt2e950VhYzieB4=
+github.com/aws/aws-sdk-go-v2/service/pricing v1.21.9/go.mod h1:zynD2dnMorTN6tvTehY2L5mhOlxQkdI11djI1ljWQO4=
+github.com/aws/aws-sdk-go-v2/service/qldb v1.16.7 h1:lLP/LlzaI67MXKfyTVLox6HBKgB4XN8Ml6C9jYbhLWQ=
+github.com/aws/aws-sdk-go-v2/service/qldb v1.16.7/go.mod h1:po39i8aELtAKkN5FtMRzOhuOjEi6v/pwAS6FqRT4ags=
+github.com/aws/aws-sdk-go-v2/service/rbin v1.10.2 h1:69qtIi4V7ehV07agrcPnZY6Pq6ZkW+LAInuvyql2rIw=
+github.com/aws/aws-sdk-go-v2/service/rbin v1.10.2/go.mod h1:brD/m0i8L/zx56h8JRC1K+37C6fbom3boeSNPgY6t8M=
+github.com/aws/aws-sdk-go-v2/service/rds v1.58.0 h1:ErFOugr4ORe+d6OGNk3Csr5ItF9DRcHJMFZnuh4isUM=
+github.com/aws/aws-sdk-go-v2/service/rds v1.58.0/go.mod h1:NNx09yR8B7z4I5xTt2rUq+5h2lmA9T9bbm7NME/74Ac=
+github.com/aws/aws-sdk-go-v2/service/redshiftdata v1.20.7 h1:jmA2Y9wChfXRi20BZhswSl8BMOBzIP4nj6umS7Dz1UU=
+github.com/aws/aws-sdk-go-v2/service/redshiftdata v1.20.7/go.mod h1:CKZw7PAz+RoNy/k2ZOb+td+3gC6+WCQw6Xn1yROp1Mo=
+github.com/aws/aws-sdk-go-v2/service/resourceexplorer2 v1.4.3 h1:HSCkOqof4ks93+7tTl/dRysP4uFhNv7SOgLwN9J32MU=
+github.com/aws/aws-sdk-go-v2/service/resourceexplorer2 v1.4.3/go.mod h1:GsN589Hv8aU2bq3U4MCa4/O1McJC0SbBE+kLxAZ1xhI=
+github.com/aws/aws-sdk-go-v2/service/resourcegroups v1.16.2 h1:ctIc24j6wZDc5VjKB/9CCuYXSSrU720/NtUNSYaWLvw=
+github.com/aws/aws-sdk-go-v2/service/resourcegroups v1.16.2/go.mod h1:eKOu4v1YLHBywiUKFsAnz0xN5xH5DlCmEy6D/0c9fOg=
+github.com/aws/aws-sdk-go-v2/service/resourcegroupstaggingapi v1.16.2 h1:03EH0RIXqyhwLZFjyJBG4hMTBw4rHMUtIESEwizxkg8=
+github.com/aws/aws-sdk-go-v2/service/resourcegroupstaggingapi v1.16.2/go.mod h1:qqGaDe21Tbh/b9vRv61ykdn/JM/xQr78SL4nYfRzh4E=
+github.com/aws/aws-sdk-go-v2/service/rolesanywhere v1.3.8 h1:8UL7FZR1oUhQaSostFjWm4j4Wj3n46cER03dV5eGFWM=
+github.com/aws/aws-sdk-go-v2/service/rolesanywhere v1.3.8/go.mod h1:kBa2hmvLufUsdBMtAKmN9X464w1X+wlhJazsvFO+2wQ=
+github.com/aws/aws-sdk-go-v2/service/route53domains v1.17.5 h1:18p6+HD6xj5oOtDNi1XvW0PkZw/xticjOvSbIWFyw6I=
+github.com/aws/aws-sdk-go-v2/service/route53domains v1.17.5/go.mod h1:BhMj1pZPuQfzuS96s4ScniYr9qhPwDMA19N4eWPM1Lg=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.40.2 h1:Ll5/YVCOzRB+gxPqs2uD0R7/MyATC0w85626glSKmp4=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.40.2/go.mod h1:Zjfqt7KhQK+PO1bbOsFNzKgaq7TcxzmEoDWN8lM0qzQ=
+github.com/aws/aws-sdk-go-v2/service/s3control v1.34.0 h1:C04Uf6qSXocZG79rsY3E4H95iMcEhldIqZEXnHpMmmQ=
+github.com/aws/aws-sdk-go-v2/service/s3control v1.34.0/go.mod h1:RCYpYoSEUpDfeQeZYHMFgY15cUNc/IbG06sF7IDSSO0=
+github.com/aws/aws-sdk-go-v2/service/scheduler v1.3.2 h1:VYWFZZ2jYWRu0bZ5+nSJiToRrUd1MyQt5ox3MlA+VsU=
+github.com/aws/aws-sdk-go-v2/service/scheduler v1.3.2/go.mod h1:vPsUqtS4023/mjhV5zyXUaGmCgBMomsPTPvJFhaPhZY=
+github.com/aws/aws-sdk-go-v2/service/securitylake v1.7.3 h1:s+lF7mmqMRBQae3Jx+R+RJpqIVyzdqoxo4v7WsJXwyk=
+github.com/aws/aws-sdk-go-v2/service/securitylake v1.7.3/go.mod h1:bT7d8k/k7DbfzbDdOv4IiiBpvPiet4aDpocpxeB0AtQ=
+github.com/aws/aws-sdk-go-v2/service/servicequotas v1.16.2 h1:7dfERjekFyE/OAd4ZyA+EpW/8CW/aL2ou3yOgNyigqk=
+github.com/aws/aws-sdk-go-v2/service/servicequotas v1.16.2/go.mod h1:N5a9dNF+SH34X/nWhpUePVebcnNRa0A2W4IByMpB3gg=
+github.com/aws/aws-sdk-go-v2/service/sesv2 v1.21.0 h1:4iHtFr1ZsqFJK03vJqaZFUcg2fJeiCTdnwuBH6U64os=
+github.com/aws/aws-sdk-go-v2/service/sesv2 v1.21.0/go.mod h1:xrSmtekhLtdb13dQGTnGkCtuvk4tkS12m8UVtZn2NZE=
+github.com/aws/aws-sdk-go-v2/service/signer v1.16.7 h1:dqT9OiL6KP8byHMxz3+VfVBrhYqe37lfD4hG6E2MtVU=
+github.com/aws/aws-sdk-go-v2/service/signer v1.16.7/go.mod h1:vUcaaoXjmmxEXOyhhq4NyLB87H1hDjYoq9rhAEv7Ez4=
+github.com/aws/aws-sdk-go-v2/service/sqs v1.24.6 h1:gOp27f7sRnebYZmBTEU9SshxNmUSZpLxwhEbR4B7IG0=
+github.com/aws/aws-sdk-go-v2/service/sqs v1.24.6/go.mod h1:hG0BRoUOVHMQDcMWnZx4rC0NBbxxvYa4zMPdh7kxI/w=
+github.com/aws/aws-sdk-go-v2/service/ssm v1.40.0 h1:DHZFzwbFXlfw15I0ERlTVB/YH9iHNr2C1axjRpB7/Gg=
+github.com/aws/aws-sdk-go-v2/service/ssm v1.40.0/go.mod h1:qpnJ98BgJ3YUEvHMgJ1OADwaOgqhgv0nxnqAjTKupeY=
+github.com/aws/aws-sdk-go-v2/service/ssmcontacts v1.17.2 h1:2lPwcd4q0u9QYrt3DgitFx1OO0q/rrLMngTDUCJ59os=
+github.com/aws/aws-sdk-go-v2/service/ssmcontacts v1.17.2/go.mod h1:AXw7Qt+vLe1WHqoyBmEnNBGXdKqP7h1aXM+y8Guipc4=
+github.com/aws/aws-sdk-go-v2/service/ssmincidents v1.23.2 h1:UtLWhmsg8CQUcUH+XFDXu7btMcmkHvLujkr2YjPaJCY=
+github.com/aws/aws-sdk-go-v2/service/ssmincidents v1.23.2/go.mod h1:MEWDMHSX38CfNrfa8j64GxgenjpySPOGDxyNIFEqwr4=
+github.com/aws/aws-sdk-go-v2/service/sso v1.15.2 h1:JuPGc7IkOP4AaqcZSIcyqLpFSqBWK32rM9+a1g6u73k=
+github.com/aws/aws-sdk-go-v2/service/sso v1.15.2/go.mod h1:gsL4keucRCgW+xA85ALBpRFfdSLH4kHOVSnLMSuBECo=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.17.3 h1:HFiiRkf1SdaAmV3/BHOFZ9DjFynPHj8G/UIO1lQS+fk=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.17.3/go.mod h1:a7bHA82fyUXOm+ZSWKU6PIoBxrjSprdLoM8xPYvzYVg=
+github.com/aws/aws-sdk-go-v2/service/sts v1.23.2 h1:0BkLfgeDjfZnZ+MhB3ONb01u9pwFYTCZVhlsSSBvlbU=
+github.com/aws/aws-sdk-go-v2/service/sts v1.23.2/go.mod h1:Eows6e1uQEsc4ZaHANmsPRzAKcVDrcmjjWiih2+HUUQ=
+github.com/aws/aws-sdk-go-v2/service/swf v1.17.5 h1:MR6A/XkUKAkaRuUiuLHcZPgjCB+o9iRxBBSym7pVDek=
+github.com/aws/aws-sdk-go-v2/service/swf v1.17.5/go.mod h1:yQR+w4YfnXyKeDIIFX3tDZ1wndz+VESqcEJN5cFIjSI=
+github.com/aws/aws-sdk-go-v2/service/timestreamwrite v1.20.0 h1:Z1kRc8lKJdhLxtx4HT65O1GTtH+ohKmBWqObQOwJ3F0=
+github.com/aws/aws-sdk-go-v2/service/timestreamwrite v1.20.0/go.mod h1:7bY9UbR+qbrj3nSV1IxGol1OLA1fM5dZQ4y97FF1zvA=
+github.com/aws/aws-sdk-go-v2/service/transcribe v1.29.0 h1:kTRJ0ZloHKzGchHa5REs7pGVeaxqR00r5R5TOKQE6rU=
+github.com/aws/aws-sdk-go-v2/service/transcribe v1.29.0/go.mod h1:JfI0OCCqM779RRoXNL8829r6i9ItxodDcm8VjA9uifY=
+github.com/aws/aws-sdk-go-v2/service/verifiedpermissions v1.3.0 h1:nDGWTtrIRyvGtfmd4DBddauFZnoyhl9dalOfPa0OPCs=
+github.com/aws/aws-sdk-go-v2/service/verifiedpermissions v1.3.0/go.mod h1:mbAnBP22I0U/b2iK7aQKvv7FlWgF+YScoLoOw7njjt0=
+github.com/aws/aws-sdk-go-v2/service/vpclattice v1.2.2 h1:EBqXw8PnMWXoWgSuoM1KgzCHZw7RCmOFJOrFZNv8wdM=
+github.com/aws/aws-sdk-go-v2/service/vpclattice v1.2.2/go.mod h1:RQBqiF63AQ7bu3qVkreCMIQtnodEafCbCsMM3GK6FSQ=
+github.com/aws/aws-sdk-go-v2/service/workspaces v1.31.3 h1:2eetvB/mGjlHV4jmz5bCtOK8/TaVbNgqJF0mmDZS5Ko=
+github.com/aws/aws-sdk-go-v2/service/workspaces v1.31.3/go.mod h1:/RuGfv7gjDalR0ep9ZwiPTkLVrlGX65VDubzeTssrE4=
+github.com/aws/aws-sdk-go-v2/service/xray v1.20.0 h1:PRn/UykuiRp7FptdntY89wLbcBHwNToarq2NoPd/qXs=
+github.com/aws/aws-sdk-go-v2/service/xray v1.20.0/go.mod h1:FVEAranUTitntkgI5wg0kQofo6y2O5clJixXTJA2zqU=
+github.com/aws/smithy-go v1.15.0 h1:PS/durmlzvAFpQHDs4wi4sNNP9ExsqZh6IlfdHXgKK8=
+github.com/aws/smithy-go v1.15.0/go.mod h1:Tg+OJXh4MB2R/uN61Ko2f6hTZwB/ZYGOtib8J3gBHzA=
 github.com/beevik/etree v1.2.0 h1:l7WETslUG/T+xOPs47dtd6jov2Ii/8/OjCldk5fYfQw=
 github.com/beevik/etree v1.2.0/go.mod h1:aiPf89g/1k3AShMVAzriilpcE4R/Vuor90y83zVZWFc=
 github.com/bgentry/speakeasy v0.1.0 h1:ByYyxL9InA1OWqxJqqp2A5pYHUrCiAL6K3J+LKSsQkY=
 github.com/bgentry/speakeasy v0.1.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs=
-github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc h1:biVzkmvwrH8WK8raXaxBx6fRVTlJILwEwQGL1I/ByEI=
 github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
-github.com/bwesterb/go-ristretto v1.2.0/go.mod h1:fUIoIZaG73pV5biE2Blr2xEzDoMj7NFEuV9ekS419A0=
-github.com/cloudflare/circl v1.1.0/go.mod h1:prBCrKB9DV4poKZY1l9zBXg2QJY7mvgRvtMxxK7fi4I=
+github.com/boombuler/barcode v1.0.1 h1:NDBbPmhS+EqABEs5Kg3n/5ZNjy73Pz7SIV+KCeqyXcs=
+github.com/boombuler/barcode v1.0.1/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
+github.com/bufbuild/protocompile v0.6.0 h1:Uu7WiSQ6Yj9DbkdnOe7U4mNKp58y9WDMKDn28/ZlunY=
+github.com/bufbuild/protocompile v0.6.0/go.mod h1:YNP35qEYoYGme7QMtz5SBCoN4kL4g12jTtjuzRNdjpE=
+github.com/bwesterb/go-ristretto v1.2.3/go.mod h1:fUIoIZaG73pV5biE2Blr2xEzDoMj7NFEuV9ekS419A0=
 github.com/cloudflare/circl v1.3.3 h1:fE/Qz0QdIGqeWfnwq0RE0R7MI51s0M2E4Ga9kq5AEMs=
 github.com/cloudflare/circl v1.3.3/go.mod h1:5XYMA4rFBvNIrhs50XuiBJ15vF2pZn4nnUKZrLbUZFA=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
@@ -160,32 +221,46 @@ github.com/evanphx/json-patch v0.5.2 h1:xVCHIVMUu1wtM/VkR9jVZ45N3FhZfYMMYGorLCR8
 github.com/evanphx/json-patch v0.5.2/go.mod h1:ZWS5hhDbVDyob71nXKNL0+PWn6ToqBHMikGIFbs31qQ=
 github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
 github.com/fatih/color v1.13.0/go.mod h1:kLAiJbzzSOZDVNGyDpeOxJ47H46qBXwg5ILebYFFOfk=
-github.com/fatih/color v1.14.1 h1:qfhVLaG5s+nCROl1zJsZRxFeYrHLqWroPOQ8BWiNb4w=
-github.com/fatih/color v1.14.1/go.mod h1:2oHN61fhTpgcxD3TSWCgKDiH1+x4OiDVVGH8WlgGZGg=
-github.com/go-git/gcfg v1.5.0 h1:Q5ViNfGF8zFgyJWPqYwA7qGFoMTEiBmdlkcfRmpIMa4=
+github.com/fatih/color v1.15.0 h1:kOqh6YHBtK8aywxGerMG2Eq3H6Qgoqeo13Bk2Mv/nBs=
+github.com/fatih/color v1.15.0/go.mod h1:0h5ZqXfHYED7Bhv2ZJamyIOUej9KtShiJESRwBDUSsw=
+github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
+github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
+github.com/gdavison/terraform-plugin-log v0.0.0-20230928191232-6c653d8ef8fb h1:HM67IMNxlkqGxAM5ymxMg2ANCcbL4oEr5cy+tGZ6fNo=
+github.com/gdavison/terraform-plugin-log v0.0.0-20230928191232-6c653d8ef8fb/go.mod h1:rKL8egZQ/eXSyDqzLUuwUYLVdlYeamldAHSxjUFADow=
+github.com/gertd/go-pluralize v0.2.1 h1:M3uASbVjMnTsPb0PNqg+E/24Vwigyo/tvyMTtAlLgiA=
+github.com/gertd/go-pluralize v0.2.1/go.mod h1:rbYaKDbsXxmRfr8uygAEKhOWsjyrrqrkHVpZvoOp8zk=
+github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 h1:+zs/tPmkDkHx3U66DAb0lQFJrpS6731Oaa12ikc+DiI=
 github.com/go-git/go-billy/v5 v5.4.1 h1:Uwp5tDRkPr+l/TnbHOQzp+tmJfLceOlbVucgpTz8ix4=
-github.com/go-git/go-git/v5 v5.6.1 h1:q4ZRqQl4pR/ZJHc1L5CFjGA1a10u76aV1iC+nh+bHsk=
-github.com/go-test/deep v1.0.3 h1:ZrJSEWsXzPOxaZnFteGEfooLba+ju3FYIbOrS+rQd68=
+github.com/go-git/go-git/v5 v5.8.1 h1:Zo79E4p7TRk0xoRgMq0RShiTHGKcKI4+DI6BfJc/Q+A=
+github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
+github.com/go-logr/logr v1.2.4 h1:g01GSCwiDw2xSZfjJ2/T9M+S6pFdcNtFYsp+Y43HYDQ=
+github.com/go-logr/logr v1.2.4/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
+github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
+github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
+github.com/go-test/deep v1.1.0 h1:WOcxcdHcvdgThNXjw0t76K42FXTU7HpNQWHpA2HHNlg=
+github.com/go-test/deep v1.1.0/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE=
+github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da h1:oI5xCqsCo564l8iNU+DwB5epxmsaqB+rhGL0m5jtYqE=
 github.com/golang/protobuf v1.1.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
-github.com/golang/protobuf v1.5.2 h1:ROPKBNFfQgOUMifHyP+KYbvpjbdoFNs+aK7DXlji0Tw=
 github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
+github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg=
+github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
 github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.8/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
-github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
 github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
+github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/google/uuid v1.3.0 h1:t6JiXgmwXMjEs8VusXIJk2BXHsn+wx8BZdTaoZ5fu7I=
-github.com/google/uuid v1.3.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/hashicorp/aws-cloudformation-resource-schema-sdk-go v0.20.0 h1:xc1OYpWvNo6dhnzemfjwtbNxeu3Ag4Wr6yT8BOo0/q0=
-github.com/hashicorp/aws-cloudformation-resource-schema-sdk-go v0.20.0/go.mod h1:cdTE6F2pCKQobug+RqRaQp7Kz9hIEqiSvpPmb6E5G1w=
-github.com/hashicorp/aws-sdk-go-base/v2 v2.0.0-beta.29 h1:O1xB5BlSr57lDLgc6v+G+BBRr4HlkQKpapjmkJLCS4c=
-github.com/hashicorp/aws-sdk-go-base/v2 v2.0.0-beta.29/go.mod h1:eBFMtEbjCseWKRv5/M6SONGS0mSbMjxAeVMjCuDLGYE=
-github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2 v2.0.0-beta.30 h1:if38Z0xWEOR7MzmahrM3gCZDRSlc03Lc2x+hPEdpdnk=
-github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2 v2.0.0-beta.30/go.mod h1:RcKwhAC0Xu+i2/A7MYVKwhzvGt4KUvonf0IKHyfXYtw=
+github.com/google/uuid v1.3.1 h1:KjJaJ9iWZ3jOFZIf1Lqf4laDRCasjl0BCmnEGxkdLb4=
+github.com/google/uuid v1.3.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/hashicorp/aws-cloudformation-resource-schema-sdk-go v0.21.0 h1:IUypt/TbXiJBkBbE3926CgnjD8IltAitdn7Yive61DY=
+github.com/hashicorp/aws-cloudformation-resource-schema-sdk-go v0.21.0/go.mod h1:cdTE6F2pCKQobug+RqRaQp7Kz9hIEqiSvpPmb6E5G1w=
+github.com/hashicorp/aws-sdk-go-base/v2 v2.0.0-beta.37 h1:cpyObAk6869M/kROO/b9F14d8zyLbO3H7Fxqxn8J7DI=
+github.com/hashicorp/aws-sdk-go-base/v2 v2.0.0-beta.37/go.mod h1:9OxAOakW2pTtcX5bQMIEXwKjSJbpTNhumMCppJ4EaGw=
+github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2 v2.0.0-beta.38 h1:eTdtMVp6z9iqxsh9yvWFM4I+a/cy2c4BQgqnx0JSL08=
+github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2 v2.0.0-beta.38/go.mod h1:AOrVL7s+my9fpdDiFmkRZw5FPeY6GNiqApco3d53e7Y=
 github.com/hashicorp/awspolicyequivalence v1.6.0 h1:7aadmkalbc5ewStC6g3rljx1iNvP4QyAhg2KsHx8bU8=
 github.com/hashicorp/awspolicyequivalence v1.6.0/go.mod h1:9IOaIHx+a7C0NfUNk1A93M7kHd5rJ19aoUx37LZGC14=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
@@ -196,76 +271,77 @@ github.com/hashicorp/go-checkpoint v0.5.0/go.mod h1:7nfLNL10NsxqO4iWuW6tWW0HjZuD
 github.com/hashicorp/go-cleanhttp v0.5.0/go.mod h1:JpRdi6/HCYpAwUzNwuwqhbovhLtngrth3wmdIIUrZ80=
 github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ=
 github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48=
-github.com/hashicorp/go-cty v1.4.1-0.20200414143053-d3edf31b6320 h1:1/D3zfFHttUKaCaGKZ/dR2roBXv0vKbSCnssIldfQdI=
-github.com/hashicorp/go-cty v1.4.1-0.20200414143053-d3edf31b6320/go.mod h1:EiZBMaudVLy8fmjf9Npq1dq9RalhveqZG5w/yz3mHWs=
+github.com/hashicorp/go-cty v1.4.1-0.20200723130312-85980079f637 h1:Ud/6/AdmJ1R7ibdS0Wo5MWPj0T1R0fkpaD087bBaW8I=
+github.com/hashicorp/go-cty v1.4.1-0.20200723130312-85980079f637/go.mod h1:EiZBMaudVLy8fmjf9Npq1dq9RalhveqZG5w/yz3mHWs=
 github.com/hashicorp/go-hclog v1.5.0 h1:bI2ocEMgcVlz55Oj1xZNBsVi900c7II+fWDyV9o+13c=
 github.com/hashicorp/go-hclog v1.5.0/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M=
 github.com/hashicorp/go-multierror v1.0.0/go.mod h1:dHtQlpGsu+cZNNAkkCN/P3hoUDHhCYQXV3UM06sGGrk=
 github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
-github.com/hashicorp/go-plugin v1.4.9 h1:ESiK220/qE0aGxWdzKIvRH69iLiuN/PjoLTm69RoWtU=
-github.com/hashicorp/go-plugin v1.4.9/go.mod h1:viDMjcLJuDui6pXb8U4HVfb8AamCWhHGUjr2IrTF67s=
+github.com/hashicorp/go-plugin v1.5.2 h1:aWv8eimFqWlsEiMrYZdPYl+FdHaBJSN4AWwGWfT1G2Y=
+github.com/hashicorp/go-plugin v1.5.2/go.mod h1:w1sAEES3g3PuV/RzUrgow20W2uErMly84hhD3um1WL4=
 github.com/hashicorp/go-uuid v1.0.0/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
 github.com/hashicorp/go-uuid v1.0.3 h1:2gKiV6YVmrJ1i2CKKa9obLvRieoRGviZFL26PcT/Co8=
 github.com/hashicorp/go-uuid v1.0.3/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
 github.com/hashicorp/go-version v1.6.0 h1:feTTfFNnjP967rlCxM/I9g701jU+RN74YKx2mOkIeek=
 github.com/hashicorp/go-version v1.6.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
-github.com/hashicorp/hc-install v0.5.2 h1:SfwMFnEXVVirpwkDuSF5kymUOhrUxrTq3udEseZdOD0=
-github.com/hashicorp/hc-install v0.5.2/go.mod h1:9QISwe6newMWIfEiXpzuu1k9HAGtQYgnSH8H9T8wmoI=
-github.com/hashicorp/hcl/v2 v2.17.0 h1:z1XvSUyXd1HP10U4lrLg5e0JMVz6CPaJvAgxM0KNZVY=
-github.com/hashicorp/hcl/v2 v2.17.0/go.mod h1:gJyW2PTShkJqQBKpAmPO3yxMxIuoXkOF2TpqXzrQyx4=
+github.com/hashicorp/hc-install v0.6.0 h1:fDHnU7JNFNSQebVKYhHZ0va1bC6SrPQ8fpebsvNr2w4=
+github.com/hashicorp/hc-install v0.6.0/go.mod h1:10I912u3nntx9Umo1VAeYPUUuehk0aRQJYpMwbX5wQA=
+github.com/hashicorp/hcl/v2 v2.18.0 h1:wYnG7Lt31t2zYkcquwgKo6MWXzRUDIeIVU5naZwHLl8=
+github.com/hashicorp/hcl/v2 v2.18.0/go.mod h1:ThLC89FV4p9MPW804KVbe/cEXoQ8NZEh+JtMeeGErHE=
 github.com/hashicorp/logutils v1.0.0 h1:dLEQVugN8vlakKOUE3ihGLTZJRB4j+M2cdTm/ORI65Y=
 github.com/hashicorp/logutils v1.0.0/go.mod h1:QIAnNjmIWmVIIkWDTG1z5v++HQmx9WQRO+LraFDTW64=
-github.com/hashicorp/terraform-exec v0.18.1 h1:LAbfDvNQU1l0NOQlTuudjczVhHj061fNX5H8XZxHlH4=
-github.com/hashicorp/terraform-exec v0.18.1/go.mod h1:58wg4IeuAJ6LVsLUeD2DWZZoc/bYi6dzhLHzxM41980=
-github.com/hashicorp/terraform-json v0.17.0 h1:EiA1Wp07nknYQAiv+jIt4dX4Cq5crgP+TsTE45MjMmM=
-github.com/hashicorp/terraform-json v0.17.0/go.mod h1:Huy6zt6euxaY9knPAFKjUITn8QxUFIe9VuSzb4zn/0o=
-github.com/hashicorp/terraform-plugin-framework v1.3.1 h1:uhd+SuyuDq3oh5VB2Toq5IPyaC5XFAUf9vUFKBmNNOk=
-github.com/hashicorp/terraform-plugin-framework v1.3.1/go.mod h1:A1WD3Ry7FhrThViUTbkx4ZDsMq9oaAv4U9oTI8bBzCU=
-github.com/hashicorp/terraform-plugin-framework-timeouts v0.3.1 h1:5GhozvHUsrqxqku+yd0UIRTkmDLp2QPX5paL1Kq5uUA=
-github.com/hashicorp/terraform-plugin-framework-timeouts v0.3.1/go.mod h1:ThtYDU8p6sJ9+SI+TYxXrw28vXxgBwYOpoPv1EojSJI=
-github.com/hashicorp/terraform-plugin-framework-validators v0.10.0 h1:4L0tmy/8esP6OcvocVymw52lY0HyQ5OxB7VNl7k4bS0=
-github.com/hashicorp/terraform-plugin-framework-validators v0.10.0/go.mod h1:qdQJCdimB9JeX2YwOpItEu+IrfoJjWQ5PhLpAOMDQAE=
-github.com/hashicorp/terraform-plugin-go v0.15.0 h1:1BJNSUFs09DS8h/XNyJNJaeusQuWc/T9V99ylU9Zwp0=
-github.com/hashicorp/terraform-plugin-go v0.15.0/go.mod h1:tk9E3/Zx4RlF/9FdGAhwxHExqIHHldqiQGt20G6g+nQ=
-github.com/hashicorp/terraform-plugin-log v0.9.0 h1:i7hOA+vdAItN1/7UrfBqBwvYPQ9TFvymaRGZED3FCV0=
-github.com/hashicorp/terraform-plugin-log v0.9.0/go.mod h1:rKL8egZQ/eXSyDqzLUuwUYLVdlYeamldAHSxjUFADow=
-github.com/hashicorp/terraform-plugin-mux v0.10.0 h1:VejY1BffxGy2iYOaa8DDHavY4k9jbvAE8F3lhruspKY=
-github.com/hashicorp/terraform-plugin-mux v0.10.0/go.mod h1:9sdnpmY20xIsl4ItsfODZYE+MgpSy/osXpSf+RwaZCY=
-github.com/hashicorp/terraform-plugin-sdk/v2 v2.26.1 h1:G9WAfb8LHeCxu7Ae8nc1agZlQOSCUWsb610iAogBhCs=
-github.com/hashicorp/terraform-plugin-sdk/v2 v2.26.1/go.mod h1:xcOSYlRVdPLmDUoqPhO9fiO/YCN/l6MGYeTzGt5jgkQ=
-github.com/hashicorp/terraform-plugin-testing v1.3.0 h1:4Pn8fSspPCRUc5zRGPNZYc00VhQmQPEH6y6Pv4e/42M=
-github.com/hashicorp/terraform-plugin-testing v1.3.0/go.mod h1:mGOfGFTVIhP9buGPZyDQhmZFIO/Ig8E0Fo694UACr64=
-github.com/hashicorp/terraform-registry-address v0.2.0 h1:92LUg03NhfgZv44zpNTLBGIbiyTokQCDcdH5BhVHT3s=
-github.com/hashicorp/terraform-registry-address v0.2.0/go.mod h1:478wuzJPzdmqT6OGbB/iH82EDcI8VFM4yujknh/1nIs=
-github.com/hashicorp/terraform-svchost v0.1.0 h1:0+RcgZdZYNd81Vw7tu62g9JiLLvbOigp7QtyNh6CjXk=
-github.com/hashicorp/terraform-svchost v0.1.0/go.mod h1:ut8JaH0vumgdCfJaihdcZULqkAwHdQNwNH7taIDdsZM=
+github.com/hashicorp/terraform-exec v0.19.0 h1:FpqZ6n50Tk95mItTSS9BjeOVUb4eg81SpgVtZNNtFSM=
+github.com/hashicorp/terraform-exec v0.19.0/go.mod h1:tbxUpe3JKruE9Cuf65mycSIT8KiNPZ0FkuTE3H4urQg=
+github.com/hashicorp/terraform-json v0.17.1 h1:eMfvh/uWggKmY7Pmb3T85u86E2EQg6EQHgyRwf3RkyA=
+github.com/hashicorp/terraform-json v0.17.1/go.mod h1:Huy6zt6euxaY9knPAFKjUITn8QxUFIe9VuSzb4zn/0o=
+github.com/hashicorp/terraform-plugin-framework v1.4.2 h1:P7a7VP1GZbjc4rv921Xy5OckzhoiO3ig6SGxwelD2sI=
+github.com/hashicorp/terraform-plugin-framework v1.4.2/go.mod h1:GWl3InPFZi2wVQmdVnINPKys09s9mLmTZr95/ngLnbY=
+github.com/hashicorp/terraform-plugin-framework-timeouts v0.4.1 h1:gm5b1kHgFFhaKFhm4h2TgvMUlNzFAtUqlcOWnWPm+9E=
+github.com/hashicorp/terraform-plugin-framework-timeouts v0.4.1/go.mod h1:MsjL1sQ9L7wGwzJ5RjcI6FzEMdyoBnw+XK8ZnOvQOLY=
+github.com/hashicorp/terraform-plugin-framework-validators v0.12.0 h1:HOjBuMbOEzl7snOdOoUfE2Jgeto6JOjLVQ39Ls2nksc=
+github.com/hashicorp/terraform-plugin-framework-validators v0.12.0/go.mod h1:jfHGE/gzjxYz6XoUwi/aYiiKrJDeutQNUtGQXkaHklg=
+github.com/hashicorp/terraform-plugin-go v0.19.0 h1:BuZx/6Cp+lkmiG0cOBk6Zps0Cb2tmqQpDM3iAtnhDQU=
+github.com/hashicorp/terraform-plugin-go v0.19.0/go.mod h1:EhRSkEPNoylLQntYsk5KrDHTZJh9HQoumZXbOGOXmec=
+github.com/hashicorp/terraform-plugin-mux v0.12.0 h1:TJlmeslQ11WlQtIFAfth0vXx+gSNgvMEng2Rn9z3WZY=
+github.com/hashicorp/terraform-plugin-mux v0.12.0/go.mod h1:8MR0AgmV+Q03DIjyrAKxXyYlq2EUnYBQP8gxAAA0zeM=
+github.com/hashicorp/terraform-plugin-sdk/v2 v2.29.0 h1:wcOKYwPI9IorAJEBLzgclh3xVolO7ZorYd6U1vnok14=
+github.com/hashicorp/terraform-plugin-sdk/v2 v2.29.0/go.mod h1:qH/34G25Ugdj5FcM95cSoXzUgIbgfhVLXCcEcYaMwq8=
+github.com/hashicorp/terraform-plugin-testing v1.5.1 h1:T4aQh9JAhmWo4+t1A7x+rnxAJHCDIYW9kXyo4sVO92c=
+github.com/hashicorp/terraform-plugin-testing v1.5.1/go.mod h1:dg8clO6K59rZ8w9EshBmDp1CxTIPu3yA4iaDpX1h5u0=
+github.com/hashicorp/terraform-registry-address v0.2.2 h1:lPQBg403El8PPicg/qONZJDC6YlgCVbWDtNmmZKtBno=
+github.com/hashicorp/terraform-registry-address v0.2.2/go.mod h1:LtwNbCihUoUZ3RYriyS2wF/lGPB6gF9ICLRtuDk7hSo=
+github.com/hashicorp/terraform-svchost v0.1.1 h1:EZZimZ1GxdqFRinZ1tpJwVxxt49xc/S52uzrw4x0jKQ=
+github.com/hashicorp/terraform-svchost v0.1.1/go.mod h1:mNsjQfZyf/Jhz35v6/0LWcv26+X7JPS+buii2c9/ctc=
 github.com/hashicorp/yamux v0.1.1 h1:yrQxtgseBDrq9Y652vSRDvsKCJKOUD+GzTS4Y0Y8pvE=
 github.com/hashicorp/yamux v0.1.1/go.mod h1:CtWFDAQgb7dxtzFs4tWbplKIe2jSi3+5vKbgIO0SLnQ=
 github.com/huandu/xstrings v1.3.1/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE=
-github.com/huandu/xstrings v1.3.2 h1:L18LIDzqlW6xN2rEkpdV8+oL/IXWJ1APd+vsdYy4Wdw=
 github.com/huandu/xstrings v1.3.2/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE=
+github.com/huandu/xstrings v1.3.3/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE=
+github.com/huandu/xstrings v1.4.0 h1:D17IlohoQq4UcpqD7fDk80P7l+lwAmlFaBHgOipl2FU=
+github.com/huandu/xstrings v1.4.0/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE=
 github.com/imdario/mergo v0.3.11/go.mod h1:jmQim1M+e3UYxmgPu/WyfjB3N3VflVyUjjjwH0dnCYA=
-github.com/imdario/mergo v0.3.13 h1:lFzP57bqS/wsqKssCGmtLAb8A0wKjLGrve2q3PPVcBk=
-github.com/imdario/mergo v0.3.13/go.mod h1:4lJ1jqUDcsbIECGy0RUJAXNIhg+6ocWgb1ALK2O4oXg=
+github.com/imdario/mergo v0.3.16 h1:wwQJbIsHYGMUyLSPrEq1CT16AhnhNJQ51+4fdHUnCl4=
+github.com/imdario/mergo v0.3.16/go.mod h1:WBLT9ZmE3lPoWsEzCh9LPo3TiwVN+ZKEjmz+hD27ysY=
 github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 h1:BQSFePA1RWJOlocH6Fxy8MmwDt+yVQYULKfN0RoTN8A=
 github.com/jessevdk/go-flags v1.4.0/go.mod h1:4FA24M0QyGHXBuZZK/XkWh8h0e1EYbRYJSGM75WSRxI=
-github.com/jhump/protoreflect v1.6.0 h1:h5jfMVslIg6l29nsMs0D8Wj17RDVdNYti0vDN/PZZoE=
+github.com/jhump/protoreflect v1.15.1 h1:HUMERORf3I3ZdX05WaQ6MIpd/NJ434hTp5YiKgfCL6c=
 github.com/jmespath/go-jmespath v0.4.0 h1:BEgLn5cpjn8UN1mAw4NjwDrS35OdebyEtFe+9YPoQUg=
 github.com/jmespath/go-jmespath v0.4.0/go.mod h1:T8mJZnbsbmF+m6zOOFylbeCJqk5+pHWvzYPziyZiYoo=
 github.com/jmespath/go-jmespath/internal/testify v1.5.1 h1:shLQSRRSCCPj3f2gpwzGwWFoC7ycTf1rcQZHOlsJ6N8=
 github.com/jmespath/go-jmespath/internal/testify v1.5.1/go.mod h1:L3OGu8Wl2/fWfCI6z80xFu9LTZmf1ZRjMHUOPmWr69U=
 github.com/kevinburke/ssh_config v1.2.0 h1:x584FjTGwHzMwvHx18PXxbBVzfnxogHaAReU4gf13a4=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
-github.com/kr/pretty v0.3.0 h1:WgNl7dwNpEZ6jJ9k1snq4pZsg7DOEN8hP9Xw0Tsjwk0=
-github.com/kr/pretty v0.3.0/go.mod h1:640gp4NfQd8pI5XOwp5fnNeVWj67G7CFk/SaSQn7NBk=
+github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
+github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
+github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
-github.com/mattbaird/jsonpatch v0.0.0-20200820163806-098863c1fc24 h1:uYuGXJBAi1umT+ZS4oQJUgKtfXCAYTR+n9zw1ViT0vA=
-github.com/mattbaird/jsonpatch v0.0.0-20200820163806-098863c1fc24/go.mod h1:M1qoD/MqPgTZIk0EWKB38wE28ACRfVcn+cU08jyArI0=
+github.com/mattbaird/jsonpatch v0.0.0-20230413205102-771768614e91 h1:JnZSkFP1/GLwKCEuuWVhsacvbDQIVa5BRwAwd+9k2Vw=
+github.com/mattbaird/jsonpatch v0.0.0-20230413205102-771768614e91/go.mod h1:M1qoD/MqPgTZIk0EWKB38wE28ACRfVcn+cU08jyArI0=
 github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU=
 github.com/mattn/go-colorable v0.1.9/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
 github.com/mattn/go-colorable v0.1.12/go.mod h1:u5H1YNBxpqRaxsYJYSkiCWKzEfiAb1Gb520KVy5xxl4=
@@ -275,8 +351,8 @@ github.com/mattn/go-isatty v0.0.3/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNx
 github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU=
 github.com/mattn/go-isatty v0.0.14/go.mod h1:7GGIvUiUoEMVVmxf/4nioHXj79iQHKdU27kJ6hsGG94=
 github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
-github.com/mattn/go-isatty v0.0.17 h1:BTarxUcIeDqL27Mc+vyvdWYSL28zpIhv3RoTdsLMPng=
-github.com/mattn/go-isatty v0.0.17/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
+github.com/mattn/go-isatty v0.0.19 h1:JITubQf0MOLdlGRuRq+jtsDlekdYPia9ZFsB8h/APPA=
+github.com/mattn/go-isatty v0.0.19/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
 github.com/mitchellh/cli v1.1.5 h1:OxRIeJXpAMztws/XHlN2vu6imG5Dpq+j61AzAX5fLng=
 github.com/mitchellh/cli v1.1.5/go.mod h1:v8+iFts2sPIKUV1ltktPXMCC8fumSKFItNcD2cLtRR4=
 github.com/mitchellh/copystructure v1.0.0/go.mod h1:SNtv71yrdKgLRyLFxmLdkAbkKEFWgYaq1OVrnRcwhnw=
@@ -296,31 +372,36 @@ github.com/mitchellh/reflectwalk v1.0.2/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx
 github.com/oklog/run v1.1.0 h1:GEenZ1cK0+q0+wsJew9qUg/DyD8k3JzYsZAi5gYi2mA=
 github.com/oklog/run v1.1.0/go.mod h1:sVPdnTZT1zYwAJeCMu2Th4T21pA3FPOQRfWjQlk7DVU=
 github.com/pjbgf/sha1cd v0.3.0 h1:4D5XXmUUBUl/xQ6IjCkEAbqXskkq/4O7LmGn0AqMDs4=
+github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/posener/complete v1.1.1 h1:ccV59UEOTzVDnDUEFdT95ZzHVZ+5+158q8+SJb2QV5w=
 github.com/posener/complete v1.1.1/go.mod h1:em0nMJCgc9GFtwrmVmEMR/ZL6WyhyjMBndrE9hABlRI=
+github.com/posener/complete v1.2.3 h1:NP0eAhjcjImqslEwo/1hq7gpajME0fTLTezBKDqfXqo=
+github.com/posener/complete v1.2.3/go.mod h1:WZIdtGGp+qx0sLrYKtIRAruyNpv6hFCicSgv7Sy7s/s=
 github.com/pquerna/otp v1.4.0 h1:wZvl1TIVxKRThZIBiwOOHOGP/1+nZyWBil9Y2XNEDzg=
 github.com/pquerna/otp v1.4.0/go.mod h1:dkJfzwRKNiegxyNb54X/3fLwhCynbMspSyWKnvi1AEg=
-github.com/rogpeppe/go-internal v1.6.1/go.mod h1:xXDCJY+GAPziupqXw64V24skbSoqbTEfhy4qGm1nDQc=
-github.com/rogpeppe/go-internal v1.9.0 h1:73kH8U+JUqXU8lRuOHeVHaa/SZPifC7BkcraZVejAe8=
 github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
-github.com/sergi/go-diff v1.2.0 h1:XU+rvMAioB0UC3q1MFrIQy4Vo5/4VsRDQQXHsEya6xQ=
+github.com/rogpeppe/go-internal v1.11.0 h1:cWPaGQEPrBb5/AsnsZesgZZ9yb1OQ+GOISoDNXVBh4M=
+github.com/rogpeppe/go-internal v1.11.0/go.mod h1:ddIwULY96R17DhadqLgMfk9H9tvdUzkipdSkR5nkCZA=
+github.com/sergi/go-diff v1.3.1 h1:xkr+Oxo4BOQKmkn/B9eMK0g5Kg/983T9DqqPHwYqD+8=
+github.com/sergi/go-diff v1.3.1/go.mod h1:aMJSSKb2lpPvRNec0+w3fl7LP9IOFzdc9Pa4NFbPK1I=
 github.com/shopspring/decimal v1.2.0/go.mod h1:DKyhrW/HYNuLGql+MJL6WCR6knT2jwCFRcu2hWCYk4o=
 github.com/shopspring/decimal v1.3.1 h1:2Usl1nmF/WZucqkFZhnfFYxxxu8LG21F6nPQBE5gKV8=
 github.com/shopspring/decimal v1.3.1/go.mod h1:DKyhrW/HYNuLGql+MJL6WCR6knT2jwCFRcu2hWCYk4o=
-github.com/skeema/knownhosts v1.1.0 h1:Wvr9V0MxhjRbl3f9nMnKnFfiWTJmtECJ9Njkea3ysW0=
-github.com/spf13/cast v1.3.1 h1:nFm6S0SMdyzrzcmThSipiEubIDy8WEXKNZ0UOgiRpng=
+github.com/skeema/knownhosts v1.2.0 h1:h9r9cf0+u7wSE+M183ZtMGgOJKiL96brpaz5ekfJCpM=
 github.com/spf13/cast v1.3.1/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE=
+github.com/spf13/cast v1.5.1 h1:R+kOtfhWQE6TVQzY+4D7wJLBgkdVasCEFxSUBYBYIlA=
+github.com/spf13/cast v1.5.1/go.mod h1:b9PdjNptOpzXr7Rq1q9gJML/2cdGQAo69NKzQ10KN48=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
+github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
 github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
 github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.2/go.mod h1:R6va5+xMeoiuVRoj+gSkQ7d3FALtqAAGI1FQKckRals=
-github.com/stretchr/testify v1.8.2 h1:+h33VjcLVPDHtOdpUCuF+7gSuG3yGIftsP1YvFihtJ8=
+github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
 github.com/vmihailenco/msgpack v3.3.3+incompatible/go.mod h1:fy3FlTQTDXWkZ7Bh6AcGMlsjHatGryHQYUTf1ShIgkk=
 github.com/vmihailenco/msgpack v4.0.4+incompatible h1:dSLoQfGFAo3F6OoNhwUmLwVgaUXK79GlxNBwueZn0xI=
 github.com/vmihailenco/msgpack v4.0.4+incompatible/go.mod h1:fy3FlTQTDXWkZ7Bh6AcGMlsjHatGryHQYUTf1ShIgkk=
@@ -337,35 +418,46 @@ github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415/go.mod h1:
 github.com/xeipuuv/gojsonschema v1.2.0 h1:LhYJRs+L4fBtjZUfuSZIKGeVu0QRy8e5Xi7D17UxZ74=
 github.com/xeipuuv/gojsonschema v1.2.0/go.mod h1:anYRn/JVcOK2ZgGU+IjEV4nwlhoK5sQluxsYJ78Id3Y=
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
-github.com/zclconf/go-cty v1.13.2 h1:4GvrUxe/QUDYuJKAav4EYqdM47/kZa672LwmXFmEKT0=
-github.com/zclconf/go-cty v1.13.2/go.mod h1:YKQzy/7pZ7iq2jNFzy5go57xdxdWoLLpaEp4u238AE0=
-go.opentelemetry.io/otel v1.15.1 h1:3Iwq3lfRByPaws0f6bU3naAqOR1n5IeDWd9390kWHa8=
-go.opentelemetry.io/otel v1.15.1/go.mod h1:mHHGEHVDLal6YrKMmk9LqC4a3sF5g+fHfrttQIB1NTc=
-go.opentelemetry.io/otel/trace v1.15.1 h1:uXLo6iHJEzDfrNC0L0mNjItIp06SyaBQxu5t3xMlngY=
-go.opentelemetry.io/otel/trace v1.15.1/go.mod h1:IWdQG/5N1x7f6YUlmdLeJvH9yxtuJAfc4VW5Agv9r/8=
+github.com/zclconf/go-cty v1.14.0 h1:/Xrd39K7DXbHzlisFP9c4pHao4yyf+/Ug9LEz+Y/yhc=
+github.com/zclconf/go-cty v1.14.0/go.mod h1:VvMs5i0vgZdhYawQNq5kePSpLAoz8u1xvZgrPIxfnZE=
+go.opentelemetry.io/contrib/instrumentation/github.com/aws/aws-sdk-go-v2/otelaws v0.45.0 h1:IheWOjAlqLJB0oRsfy640dvUy4T5ARTohgUKR23705U=
+go.opentelemetry.io/contrib/instrumentation/github.com/aws/aws-sdk-go-v2/otelaws v0.45.0/go.mod h1:uJGvUG+4OT1N41mbAgng0iNdOTvv9chnfavACM2z2DA=
+go.opentelemetry.io/otel v1.19.0 h1:MuS/TNf4/j4IXsZuJegVzI1cwut7Qc00344rgH7p8bs=
+go.opentelemetry.io/otel v1.19.0/go.mod h1:i0QyjOq3UPoTzff0PJB2N66fb4S0+rSbSB15/oyH9fY=
+go.opentelemetry.io/otel/metric v1.19.0 h1:aTzpGtV0ar9wlV4Sna9sdJyII5jTVJEvKETPiOKwvpE=
+go.opentelemetry.io/otel/metric v1.19.0/go.mod h1:L5rUsV9kM1IxCj1MmSdS+JQAcVm319EUrDVLrt7jqt8=
+go.opentelemetry.io/otel/trace v1.19.0 h1:DFVQmlVbfVeOuBRrwdtaehRrWiL1JoVs9CPIQ1Dzxpg=
+go.opentelemetry.io/otel/trace v1.19.0/go.mod h1:mfaSyvGyEJEI0nyV2I4qhNQnbBOUUmYZpYojqMnX2vo=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20200414173820-0848c9571904/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20200820211705-5c72a883971a/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/crypto v0.10.0 h1:LKqV2xt9+kDzSTfOhx4FrkEBcMrAgHSYgzywV9zcGmM=
-golang.org/x/crypto v0.10.0/go.mod h1:o4eNf7Ede1fv+hwOwZsTHl9EsPFO6q6ZvYR8vYfY45I=
-golang.org/x/exp v0.0.0-20230206171751-46f607a40771 h1:xP7rWLUr1e1n2xkK5YB4LI0hPEy3LJC6Wk+D4pGlOJg=
-golang.org/x/exp v0.0.0-20230206171751-46f607a40771/go.mod h1:CxIveKay+FTh1D0yPZemJVgC/95VzuuOLq5Qi4xnoYc=
+golang.org/x/crypto v0.3.0/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
+golang.org/x/crypto v0.3.1-0.20221117191849-2c476679df9a/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
+golang.org/x/crypto v0.7.0/go.mod h1:pYwdfH91IfpZVANVyUOhSIPZaFoJGxTFbZhFTx+dXZU=
+golang.org/x/crypto v0.14.0 h1:wBqGXzWJW6m1XrIKlAH0Hs1JJ7+9KBwnIO8v66Q9cHc=
+golang.org/x/crypto v0.14.0/go.mod h1:MVFd36DqK4CsrnJYDkBA3VC4m2GkXAM0PvzMCn4JQf4=
+golang.org/x/exp v0.0.0-20231006140011-7918f672742d h1:jtJma62tbqLibJ5sFQz8bKtEM8rJBtfilJ2qTU199MI=
+golang.org/x/exp v0.0.0-20231006140011-7918f672742d/go.mod h1:ldy0pHrwJyGW56pPQzzkH36rKxoZW1tw7ZJpeKx+hdo=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
-golang.org/x/mod v0.10.0 h1:lFO9qtOdlre5W1jxS3r/4szv2/6iXxScdzjoBMXNhYk=
-golang.org/x/mod v0.10.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/mod v0.13.0 h1:I/DsJXRlw/8l/0c24sM9yb0T4z9liZTduXvdAWYiysY=
+golang.org/x/mod v0.13.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.1.0/go.mod h1:Cx3nUiGt4eDBEyega/BKRp+/AlGL8hYe7U9odMt2Cco=
-golang.org/x/net v0.10.0 h1:X2//UzNDwYmtCLn7To6G58Wr6f5ahEAQgKNzv9Y951M=
-golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
+golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY=
+golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
+golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc=
+golang.org/x/net v0.17.0 h1:pVaXccu2ozPjCXewfr1S7xza/zcXTity9cCdXQYSjIM=
+golang.org/x/net v0.17.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.1.0 h1:wsuoTGHzEhffawBOhz5CYhcrV4IdKZbEyZjBMuTp12o=
+golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.4.0 h1:zxkM55ReGkDlKSM+Fu41A+zmbZuaPVbGMzvvdUPznYQ=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200116001909-b77594299b42/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -374,49 +466,60 @@ golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210927094055-39ccf1dd6fa6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20211007075335-d3039528d8ac/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220503163025-988cb79eb6c6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.9.0 h1:KS/R3tvhPqvJvwcKfnBHJwwthS11LRhmM5D59eEXa0s=
-golang.org/x/sys v0.9.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.3.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.13.0 h1:Af8nKPmuFypiUBjVoU9V20FiaFXOcuZI21p0ycVYYGE=
+golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.1.0/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.9.0 h1:GRRCnKYhdQrD8kfRAdQ6Zcw1P0OcELxGLKJvtjVMZ28=
+golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
+golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
+golang.org/x/term v0.6.0/go.mod h1:m6U89DPEgQRMq3DNkDClhWw02AUbt2daBVO4cn4Hv9U=
+golang.org/x/term v0.13.0 h1:bb+I9cTfFazGW51MZqBVmZy7+JEJMouUHTUSKVQLBek=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
+golang.org/x/text v0.3.8/go.mod h1:E6s5w1FMmriuDzIBO73fBruAKo1PCIq6d2Q6DHfQ8WQ=
 golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.10.0 h1:UpjohKhiEgNc0CSauXmwYftY1+LlaC75SJwh0SgCX58=
-golang.org/x/text v0.10.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
+golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
+golang.org/x/text v0.8.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
+golang.org/x/text v0.13.0 h1:ablQoSUd0tRdKxZewP80B+BaqeKJuVhuRxj/dkrun3k=
+golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
-golang.org/x/tools v0.6.0 h1:BOw41kyTf3PuCW1pVQf8+Cyg8pMlkYB1oo9iJ6D/lKM=
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
+golang.org/x/tools v0.14.0 h1:jvNa2pY0M4r62jkRQ6RwEZZyPcymeL9XZMLBbV7U2nc=
+golang.org/x/tools v0.14.0/go.mod h1:uYBEerGOWcJyEORxN+Ek8+TT266gXkNlHdJBwexUsBg=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
-google.golang.org/appengine v1.6.7 h1:FZR1q0exgwxzPzp/aF+VccGrSfxfPpkBqjIIEq3ru6c=
-google.golang.org/appengine v1.6.7/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
-google.golang.org/genproto v0.0.0-20230202175211-008b39050e57 h1:vArvWooPH749rNHpBGgVl+U9B9dATjiEhJzcWGlovNs=
-google.golang.org/genproto v0.0.0-20230202175211-008b39050e57/go.mod h1:RGgjbofJ8xD9Sq1VVhDM1Vok1vRONV+rg+CjzG4SZKM=
-google.golang.org/grpc v1.54.0 h1:EhTqbhiYeixwWQtAEZAxmV9MGqcjEU2mFx52xCzNyag=
-google.golang.org/grpc v1.54.0/go.mod h1:PUSEXI6iWghWaB6lXM4knEgpJNu2qUcKfDtNci3EC2g=
+google.golang.org/appengine v1.6.8 h1:IhEN5q69dyKagZPYMSdIjS2HqprW324FRQZJcGqPAsM=
+google.golang.org/appengine v1.6.8/go.mod h1:1jJ3jBArFh5pcgW8gCtRJnepW8FzD1V44FJffLiz/Ds=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20230920204549-e6e6cdab5c13 h1:N3bU/SQDCDyD6R528GJ/PwW9KjYcJA3dgyH+MovAkIM=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20230920204549-e6e6cdab5c13/go.mod h1:KSqppvjFjtoCI+KGd4PELB0qLNxdJHRGqRI09mB6pQA=
+google.golang.org/grpc v1.58.2 h1:SXUpjxeVF3FKrTYQI4f4KvbGD5u2xccdYdurwowix5I=
+google.golang.org/grpc v1.58.2/go.mod h1:tgX3ZQDlNJGU96V6yHh1T/JeoBQ2TXdr43YbYSsCJk0=
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.30.0 h1:kPPoIgf3TsEvrm0PFe15JQ+570QVxYzEvvHqChK+cng=
-google.golang.org/protobuf v1.30.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
+google.golang.org/protobuf v1.31.0 h1:g0LDEJHgrBl9N9r17Ru3sqWhkIx2NB67okBHPwC7hs8=
+google.golang.org/protobuf v1.31.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127 h1:qIbj1fsPNlZgppZ+VLlY7N33q108Sa+fhmuc+sWQYwY=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
 gopkg.in/dnaeon/go-vcr.v3 v3.1.2 h1:F1smfXBqQqwpVifDfUBQG6zzaGjzT+EnVZakrOdr5wA=
 gopkg.in/dnaeon/go-vcr.v3 v3.1.2/go.mod h1:2IMOnnlx9I6u9x+YBsM3tAMx6AlOxnJ0pWxQAzZ79Ag=
-gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
 gopkg.in/warnings.v0 v0.1.2 h1:wFXVbFY8DY5/xOe1ECiWdKCzZlxgshcYVNkBHstARME=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
@@ -424,7 +527,6 @@ gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
 gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-gopkg.in/yaml.v3 v3.0.0/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 syreclabs.com/go/faker v1.2.3 h1:HPrWtnHazIf0/bVuPZJLFrtHlBHk10hS0SB+mV8v6R4=
diff --git a/infrastructure/repository/community.tf b/infrastructure/repository/community.tf
index 85a732ae6f0..7fbebfaa424 100644
--- a/infrastructure/repository/community.tf
+++ b/infrastructure/repository/community.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 variable "community_list_repo" {
   type        = string
   description = "The name of the repository containing the lists of users. Value set in TFC."
@@ -23,7 +26,7 @@ data "github_team" "aws" {
 resource "github_actions_secret" "maintainers" {
   repository      = "terraform-provider-aws"
   secret_name     = "MAINTAINERS"
-  plaintext_value = base64encode(jsonencode(concat(data.github_team.aws.members,["dependabot[bot]"])))
+  plaintext_value = base64encode(jsonencode(concat(data.github_team.aws.members, ["dependabot[bot]"])))
 }
 
 // Partners
diff --git a/infrastructure/repository/labels-partition.tf b/infrastructure/repository/labels-partition.tf
index 9972c2dd757..86cadab1f4c 100644
--- a/infrastructure/repository/labels-partition.tf
+++ b/infrastructure/repository/labels-partition.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 variable "partition_labels" {
   default = [
     "aws-cn",
diff --git a/infrastructure/repository/labels-service.tf b/infrastructure/repository/labels-service.tf
index 0cfd60be36e..dee317b701e 100644
--- a/infrastructure/repository/labels-service.tf
+++ b/infrastructure/repository/labels-service.tf
@@ -31,6 +31,7 @@ variable "service_labels" {
     "backup",
     "backupgateway",
     "batch",
+    "bedrock",
     "billingconductor",
     "braket",
     "budgets",
@@ -54,6 +55,7 @@ variable "service_labels" {
     "cloudwatch",
     "codeartifact",
     "codebuild",
+    "codecatalyst",
     "codecommit",
     "codeguruprofiler",
     "codegurureviewer",
@@ -175,9 +177,9 @@ variable "service_labels" {
     "lakeformation",
     "lambda",
     "lexmodels",
-    "lexmodelsv2",
     "lexruntime",
     "lexruntimev2",
+    "lexv2models",
     "licensemanager",
     "lightsail",
     "location",
@@ -309,6 +311,7 @@ variable "service_labels" {
     "transitgateway",
     "translate",
     "verifiedaccess",
+    "verifiedpermissions",
     "voiceid",
     "vpc",
     "vpclattice",
diff --git a/infrastructure/repository/labels-workflow.tf b/infrastructure/repository/labels-workflow.tf
index e66bd9ee349..0eac7e14e4c 100644
--- a/infrastructure/repository/labels-workflow.tf
+++ b/infrastructure/repository/labels-workflow.tf
@@ -1,6 +1,9 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 variable "workflow_labels" {
   default = {
-    # Stop the search. Keep these alphabetibelized.
+    # Stop the search. Keep these alphabetized.
 
     "authentication" = {
       color       = "844fba", # color:terraform (main)
@@ -38,6 +41,10 @@ variable "workflow_labels" {
       color       = "844fba", # color:terraform (main)
       description = "Requests to existing resources that expand the functionality or scope."
     },
+    "engineering-initiative" = {
+      color       = "844fba", # color:terraform (main)
+      description = "Maintainer driven proposals to improve operation, or development experience of the provider."
+    },
     "eventual-consistency" = {
       color       = "844fba", # color:terraform (main)
       description = "Pertains to eventual consistency issues."
@@ -46,6 +53,10 @@ variable "workflow_labels" {
       color       = "63d0ff", # color:packer
       description = "Introduces or discusses updates to examples."
     },
+    "external-maintainer" = {
+      color       = "63d0ff", # color:packer
+      description = "Contribution from a trusted external contributor."
+    },
     "flex" = {
       color       = "844fba", # color:terraform (main)
       description = "Pertains to FLatteners and EXpanders."
@@ -94,6 +105,10 @@ variable "workflow_labels" {
       color       = "60dea9", # color:nomad
       description = "Pertains to testing Terraform releases prior to release."
     },
+    "prioritized" = {
+      color       = "d1ebff", # color:terraform accent
+      description = "Part of the maintainer teams immediate focus. To be addressed within the current quarter.",
+    },
     "proposal" = {
       color       = "d1ebff", # color:terraform accent
       description = "Proposes new design or functionality."
@@ -114,10 +129,6 @@ variable "workflow_labels" {
       color       = "828a90", # color:stale grey
       description = "Repository modifications; GitHub Actions, developer docs, issue templates, codeowners, changelog."
     },
-    "roadmap" = {
-      color       = "d1ebff", # color:terraform accent
-      description = "Issue mentioned on the public roadmap. To be resolved in the current quarter.",
-    },
     "service/meta" = {
       color       = "7b42bc", # color:terraform (logomark)
       description = "Issues and PRs that correspond to meta data sources."
diff --git a/infrastructure/repository/main.tf b/infrastructure/repository/main.tf
index e3fd75ac466..6f0316fa29d 100644
--- a/infrastructure/repository/main.tf
+++ b/infrastructure/repository/main.tf
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 terraform {
   backend "remote" {
     organization = "hashicorp-v2"
@@ -10,7 +13,7 @@ terraform {
   required_providers {
     github = {
       source  = "integrations/github"
-      version = "5.28.0"
+      version = "5.41.0"
     }
   }
 
diff --git a/infrastructure/repository/projects.tf b/infrastructure/repository/projects.tf
new file mode 100644
index 00000000000..37fcb808005
--- /dev/null
+++ b/infrastructure/repository/projects.tf
@@ -0,0 +1,48 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
+// This configuration file sets up Actions variables for use when automating GitHub Projects.
+// Currently, this consists only of the main team project proof of concept, but more may be added at a later date.
+
+
+// Project's "Status" field's options IDs (vars.team_project_status_${option_name_snake_case}
+// This set of variables will take the names of each possible value for the "Status" column, convert them to snake case
+// and prefix them with "team_project_status_". E.g. "To Do" becomes "team_project_status_to_do".
+variable "team_project_field_status_values" {
+  type        = map(string)
+  description = "A mapping of the statuses in the main team project to their IDs"
+  default = {
+    "To Do"         = "f75ad846",
+    "In Progress"   = "47fc9ee4",
+    "Waiting"       = "e85f2e5d",
+    "Maintainer PR" = "28a034bc",
+    "Pending Merge" = "043bc06e",
+    "Done"          = "98236657"
+  }
+}
+
+variable "team_project_field_view_values" {
+  type        = map(string)
+  description = "A mapping of the options in the view field in the main team project to their IDs"
+  default = {
+    "Working Board"          = "8d366764",
+    "Partner Contribution"   = "b0492564",
+    "External Maintainer"    = "f17c472c",
+    "S3 Backend"             = "5c656f1e",
+    "Engineering Initiative" = "a62d09b9"
+  }
+}
+
+resource "github_actions_variable" "team_project_field_status_option_ids" {
+  for_each      = var.team_project_field_status_values
+  repository    = "terraform-provider-aws"
+  variable_name = "team_project_status_${replace(lower(each.key), " ", "_")}"
+  value         = each.value
+}
+
+resource "github_actions_variable" "team_project_field_view_option_ids" {
+  for_each      = var.team_project_field_view_values
+  repository    = "terraform-provider-aws"
+  variable_name = "team_project_view_${replace(lower(each.key), " ", "_")}"
+  value         = each.value
+}
diff --git a/internal/acctest/acctest.go b/internal/acctest/acctest.go
index 76943f7bdca..b4674aaa9d0 100644
--- a/internal/acctest/acctest.go
+++ b/internal/acctest/acctest.go
@@ -1,8 +1,12 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package acctest
 
 import (
 	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"log"
 	"os"
@@ -13,6 +17,10 @@ import (
 	"testing"
 	"time"
 
+	"github.com/YakDriver/regexache"
+	ec2types "github.com/aws/aws-sdk-go-v2/service/ec2/types"
+	"github.com/aws/aws-sdk-go-v2/service/inspector2"
+	inspector2types "github.com/aws/aws-sdk-go-v2/service/inspector2/types"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/aws/aws-sdk-go/aws/endpoints"
@@ -22,6 +30,7 @@ import (
 	"github.com/aws/aws-sdk-go/service/iam"
 	"github.com/aws/aws-sdk-go/service/outposts"
 	"github.com/aws/aws-sdk-go/service/ssoadmin"
+	"github.com/aws/aws-sdk-go/service/wafv2"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-go/tfprotov5"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
@@ -34,10 +43,12 @@ import (
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/envvar"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
 	"github.com/hashicorp/terraform-provider-aws/internal/provider"
 	tfacmpca "github.com/hashicorp/terraform-provider-aws/internal/service/acmpca"
 	tfec2 "github.com/hashicorp/terraform-provider-aws/internal/service/ec2"
+	tfiam "github.com/hashicorp/terraform-provider-aws/internal/service/iam"
 	tforganizations "github.com/hashicorp/terraform-provider-aws/internal/service/organizations"
 	tfsts "github.com/hashicorp/terraform-provider-aws/internal/service/sts"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
@@ -356,7 +367,7 @@ func CheckResourceAttrNameFromPrefix(resourceName string, attributeName string,
 
 // Regexp for "<start-of-string>terraform-<26 lowercase hex digits><additional suffix><end-of-string>".
 func resourceUniqueIDPrefixPlusAdditionalSuffixRegexp(prefix, suffix string) *regexp.Regexp {
-	return regexp.MustCompile(fmt.Sprintf("^%s[[:xdigit:]]{%d}%s$", prefix, id.UniqueIDSuffixLength, suffix))
+	return regexache.MustCompile(fmt.Sprintf("^%s[[:xdigit:]]{%d}%s$", prefix, id.UniqueIDSuffixLength, suffix))
 }
 
 // CheckResourceAttrNameWithSuffixFromPrefix verifies that the state attribute value matches name with suffix generated from given prefix
@@ -372,6 +383,13 @@ func CheckResourceAttrNameGenerated(resourceName string, attributeName string) r
 	return CheckResourceAttrNameWithSuffixGenerated(resourceName, attributeName, "")
 }
 
+// CheckResourceAttrNameGeneratedWithPrefix verifies that the state attribute value matches name automatically generated with prefix
+func CheckResourceAttrNameGeneratedWithPrefix(resourceName string, attributeName string, prefix string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		return resource.TestMatchResourceAttr(resourceName, attributeName, resourceUniqueIDPrefixPlusAdditionalSuffixRegexp(prefix, ""))(s)
+	}
+}
+
 // CheckResourceAttrNameWithSuffixGenerated verifies that the state attribute value matches name with suffix automatically generated without prefix
 func CheckResourceAttrNameWithSuffixGenerated(resourceName string, attributeName string, suffix string) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
@@ -382,7 +400,7 @@ func CheckResourceAttrNameWithSuffixGenerated(resourceName string, attributeName
 // MatchResourceAttrAccountID ensures the Terraform state regexp matches an account ID
 func MatchResourceAttrAccountID(resourceName, attributeName string) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		return resource.TestMatchResourceAttr(resourceName, attributeName, regexp.MustCompile(`^\d{12}$`))(s)
+		return resource.TestMatchResourceAttr(resourceName, attributeName, regexache.MustCompile(`^\d{12}$`))(s)
 	}
 }
 
@@ -407,6 +425,27 @@ func MatchResourceAttrRegionalARN(resourceName, attributeName, arnService string
 	}
 }
 
+// MatchResourceAttrRegionalARNRegion ensures the Terraform state regexp matches a formatted ARN with the specified region
+func MatchResourceAttrRegionalARNRegion(resourceName, attributeName, arnService, region string, arnResourceRegexp *regexp.Regexp) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		arnRegexp := arn.ARN{
+			AccountID: AccountID(),
+			Partition: Partition(),
+			Region:    region,
+			Resource:  arnResourceRegexp.String(),
+			Service:   arnService,
+		}.String()
+
+		attributeMatch, err := regexp.Compile(arnRegexp)
+
+		if err != nil {
+			return fmt.Errorf("unable to compile ARN regexp (%s): %w", arnRegexp, err)
+		}
+
+		return resource.TestMatchResourceAttr(resourceName, attributeName, attributeMatch)(s)
+	}
+}
+
 // MatchResourceAttrRegionalARNNoAccount ensures the Terraform state regexp matches a formatted ARN with region but without account ID
 func MatchResourceAttrRegionalARNNoAccount(resourceName, attributeName, arnService string, arnResourceRegexp *regexp.Regexp) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
@@ -579,7 +618,7 @@ func MatchResourceAttrGlobalARNNoAccount(resourceName, attributeName, arnService
 // CheckResourceAttrRFC3339 ensures the Terraform state matches a RFC3339 value
 // This TestCheckFunc will likely be moved to the Terraform Plugin SDK in the future.
 func CheckResourceAttrRFC3339(resourceName, attributeName string) resource.TestCheckFunc {
-	return resource.TestMatchResourceAttr(resourceName, attributeName, regexp.MustCompile(RFC3339RegexPattern))
+	return resource.TestMatchResourceAttr(resourceName, attributeName, regexache.MustCompile(RFC3339RegexPattern))
 }
 
 // CheckResourceAttrEquivalentJSON is a TestCheckFunc that compares a JSON value with an expected value. Both JSON
@@ -883,6 +922,20 @@ func PreCheckPartitionNot(t *testing.T, partitions ...string) {
 	}
 }
 
+func PreCheckInspector2(ctx context.Context, t *testing.T) {
+	conn := Provider.Meta().(*conns.AWSClient).Inspector2Client(ctx)
+
+	_, err := conn.ListDelegatedAdminAccounts(ctx, &inspector2.ListDelegatedAdminAccountsInput{})
+
+	if errs.IsA[*inspector2types.AccessDeniedException](err) {
+		t.Skipf("Amazon Inspector not available: %s", err)
+	}
+
+	if err != nil {
+		t.Fatalf("listing Inspector2 delegated administrators: %s", err)
+	}
+}
+
 func PreCheckOrganizationsAccount(ctx context.Context, t *testing.T) {
 	_, err := tforganizations.FindOrganization(ctx, Provider.Meta().(*conns.AWSClient).OrganizationsConn(ctx))
 
@@ -974,15 +1027,10 @@ func PreCheckSSOAdminInstances(ctx context.Context, t *testing.T) {
 }
 
 func PreCheckHasIAMRole(ctx context.Context, t *testing.T, roleName string) {
-	conn := Provider.Meta().(*conns.AWSClient).IAMConn(ctx)
-	input := &iam.GetRoleInput{
-		RoleName: aws.String(roleName),
-	}
-
-	_, err := conn.GetRoleWithContext(ctx, input)
+	_, err := tfiam.FindRoleByName(ctx, Provider.Meta().(*conns.AWSClient).IAMConn(ctx), roleName)
 
-	if tfawserr.ErrCodeEquals(err, iam.ErrCodeNoSuchEntityException) {
-		t.Skipf("skipping acceptance test: required IAM role \"%s\" is not present", roleName)
+	if tfresource.NotFound(err) {
+		t.Skipf("skipping acceptance test: required IAM role %q not found", roleName)
 	}
 
 	if PreCheckSkipError(err) {
@@ -1080,6 +1128,30 @@ func PreCheckOutpostsOutposts(ctx context.Context, t *testing.T) {
 	}
 }
 
+func PreCheckWAFV2CloudFrontScope(ctx context.Context, t *testing.T) {
+	switch Partition() {
+	case endpoints.AwsPartitionID:
+		PreCheckRegion(t, endpoints.UsEast1RegionID)
+	case endpoints.AwsCnPartitionID:
+		PreCheckRegion(t, endpoints.CnNorthwest1RegionID)
+	}
+
+	conn := Provider.Meta().(*conns.AWSClient).WAFV2Conn(ctx)
+	input := &wafv2.ListWebACLsInput{
+		Scope: aws.String(wafv2.ScopeCloudfront),
+	}
+
+	_, err := conn.ListWebACLsWithContext(ctx, input)
+
+	if PreCheckSkipError(err) {
+		t.Skipf("skipping acceptance testing: %s", err)
+	}
+
+	if err != nil {
+		t.Fatalf("unexpected PreCheck error: %s", err)
+	}
+}
+
 func ConfigAlternateAccountProvider() string {
 	//lintignore:AT004
 	return ConfigNamedAccountProvider(
@@ -1170,11 +1242,11 @@ func ConfigDefaultAndIgnoreTagsKeyPrefixes1(key1, value1, keyPrefix1 string) str
 provider "aws" {
   default_tags {
     tags = {
-      %q = %q
+      %[1]q = %[2]q
     }
   }
   ignore_tags {
-    key_prefixes = [%q]
+    key_prefixes = [%[3]q]
   }
 }
 `, key1, value1, keyPrefix1)
@@ -1186,7 +1258,7 @@ func ConfigDefaultAndIgnoreTagsKeys1(key1, value1 string) string {
 provider "aws" {
   default_tags {
     tags = {
-      %[1]q = %q
+      %[1]q = %[2]q
     }
   }
   ignore_tags {
@@ -1380,16 +1452,34 @@ func CheckWithNamedProviders(f TestCheckWithProviderFunc, providers map[string]*
 	}
 }
 
-// ErrorCheckSkipMessagesContaining skips tests based on error messages that indicate unsupported features
-func ErrorCheckSkipMessagesContaining(t *testing.T, messages ...string) resource.ErrorCheckFunc {
+// ErrorCheckSkipMessagesContaining skips tests based on error messages that contain one of the specified needles.
+func ErrorCheckSkipMessagesContaining(t *testing.T, needles ...string) resource.ErrorCheckFunc {
+	return func(err error) error {
+		if err == nil {
+			return nil
+		}
+
+		for _, needle := range needles {
+			errorMessage := err.Error()
+			if strings.Contains(errorMessage, needle) {
+				t.Skipf("skipping test for %s/%s: %s", Partition(), Region(), errorMessage)
+			}
+		}
+
+		return err
+	}
+}
+
+// ErrorCheckSkipMessagesMatches skips tests based on error messages that match one of the specified regular expressions.
+func ErrorCheckSkipMessagesMatches(t *testing.T, rs ...*regexp.Regexp) resource.ErrorCheckFunc {
 	return func(err error) error {
 		if err == nil {
 			return nil
 		}
 
-		for _, message := range messages {
+		for _, r := range rs {
 			errorMessage := err.Error()
-			if strings.Contains(errorMessage, message) {
+			if r.MatchString(errorMessage) {
 				t.Skipf("skipping test for %s/%s: %s", Partition(), Region(), errorMessage)
 			}
 		}
@@ -1500,6 +1590,10 @@ func PreCheckSkipError(err error) bool {
 	if tfawserr.ErrMessageContains(err, "InvalidAction", "Unavailable Operation") {
 		return true
 	}
+	// ignore when not authorized to call API from account
+	if tfawserr.ErrCodeEquals(err, "ForbiddenException") {
+		return true
+	}
 	return false
 }
 
@@ -1524,7 +1618,7 @@ func ConfigDefaultTags_Tags1(tag1, value1 string) string {
 provider "aws" {
   default_tags {
     tags = {
-      %q = %q
+      %[1]q = %[2]q
     }
   }
 
@@ -1543,8 +1637,8 @@ func ConfigDefaultTags_Tags2(tag1, value1, tag2, value2 string) string {
 provider "aws" {
   default_tags {
     tags = {
-      %q = %q
-      %q = %q
+      %[1]q = %[2]q
+      %[3]q = %[4]q
     }
   }
 
@@ -1564,8 +1658,8 @@ func ConfigAssumeRolePolicy(policy string) string {
 	return fmt.Sprintf(`
 provider "aws" {
   assume_role {
-    role_arn = %q
-    policy   = %q
+    role_arn = %[1]q
+    policy   = %[2]q
   }
 }
 `, os.Getenv(envvar.AccAssumeRoleARN), policy)
@@ -2030,7 +2124,7 @@ func ConfigLambdaBase(policyName, roleName, sgName string) string {
 data "aws_partition" "current" {}
 
 resource "aws_iam_role_policy" "iam_policy_for_lambda" {
-  name = "%s"
+  name = %[1]q
   role = aws_iam_role.iam_for_lambda.id
 
   policy = <<EOF
@@ -2051,7 +2145,9 @@ resource "aws_iam_role_policy" "iam_policy_for_lambda" {
       "Action": [
         "ec2:CreateNetworkInterface",
         "ec2:DescribeNetworkInterfaces",
-        "ec2:DeleteNetworkInterface"
+        "ec2:DeleteNetworkInterface",
+        "ec2:AssignPrivateIpAddresses",
+        "ec2:UnassignPrivateIpAddresses"
       ],
       "Resource": [
         "*"
@@ -2081,7 +2177,7 @@ EOF
 }
 
 resource "aws_iam_role" "iam_for_lambda" {
-  name = "%s"
+  name = %[2]q
 
   assume_role_policy = <<EOF
 {
@@ -2101,7 +2197,8 @@ EOF
 }
 
 resource "aws_vpc" "vpc_for_lambda" {
-  cidr_block = "10.0.0.0/16"
+  cidr_block                       = "10.0.0.0/16"
+  assign_generated_ipv6_cidr_block = true
 
   tags = {
     Name = "terraform-testacc-lambda-function"
@@ -2109,9 +2206,11 @@ resource "aws_vpc" "vpc_for_lambda" {
 }
 
 resource "aws_subnet" "subnet_for_lambda" {
-  vpc_id            = aws_vpc.vpc_for_lambda.id
-  cidr_block        = "10.0.1.0/24"
-  availability_zone = data.aws_availability_zones.available.names[0]
+  vpc_id                          = aws_vpc.vpc_for_lambda.id
+  cidr_block                      = cidrsubnet(aws_vpc.vpc_for_lambda.cidr_block, 8, 1)
+  availability_zone               = data.aws_availability_zones.available.names[1]
+  ipv6_cidr_block                 = cidrsubnet(aws_vpc.vpc_for_lambda.ipv6_cidr_block, 8, 1)
+  assign_ipv6_address_on_creation = true
 
   tags = {
     Name = "tf-acc-lambda-function-1"
@@ -2121,9 +2220,11 @@ resource "aws_subnet" "subnet_for_lambda" {
 # This is defined here, rather than only in test cases where it's needed is to
 # prevent a timeout issue when fully removing Lambda Filesystems
 resource "aws_subnet" "subnet_for_lambda_az2" {
-  vpc_id            = aws_vpc.vpc_for_lambda.id
-  cidr_block        = "10.0.2.0/24"
-  availability_zone = data.aws_availability_zones.available.names[1]
+  vpc_id                          = aws_vpc.vpc_for_lambda.id
+  cidr_block                      = cidrsubnet(aws_vpc.vpc_for_lambda.cidr_block, 8, 2)
+  availability_zone               = data.aws_availability_zones.available.names[1]
+  ipv6_cidr_block                 = cidrsubnet(aws_vpc.vpc_for_lambda.ipv6_cidr_block, 8, 2)
+  assign_ipv6_address_on_creation = true
 
   tags = {
     Name = "tf-acc-lambda-function-2"
@@ -2131,7 +2232,7 @@ resource "aws_subnet" "subnet_for_lambda_az2" {
 }
 
 resource "aws_security_group" "sg_for_lambda" {
-  name        = "%s"
+  name        = %[3]q
   description = "Allow all inbound traffic for lambda test"
   vpc_id      = aws_vpc.vpc_for_lambda.id
 
@@ -2148,6 +2249,10 @@ resource "aws_security_group" "sg_for_lambda" {
     protocol    = "-1"
     cidr_blocks = ["0.0.0.0/0"]
   }
+
+  tags = {
+    Name = %[3]q
+  }
 }
 `, policyName, roleName, sgName))
 }
@@ -2236,6 +2341,31 @@ func CheckVPCExists(ctx context.Context, n string, v *ec2.Vpc) resource.TestChec
 	}
 }
 
+func CheckVPCExistsV2(ctx context.Context, n string, v *ec2types.Vpc) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("not found: %s", n)
+		}
+
+		if rs.Primary.ID == "" {
+			return fmt.Errorf("no VPC ID is set")
+		}
+
+		conn := Provider.Meta().(*conns.AWSClient).EC2Client(ctx)
+
+		output, err := tfec2.FindVPCByIDV2(ctx, conn, rs.Primary.ID)
+
+		if err != nil {
+			return err
+		}
+
+		*v = *output
+
+		return nil
+	}
+}
+
 func CheckCallerIdentityAccountID(n string) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		rs, ok := s.RootModule().Resources[n]
@@ -2296,6 +2426,32 @@ func CheckResourceAttrGreaterThanOrEqualValue(n, key string, val int) resource.T
 	})
 }
 
+func CheckResourceAttrIsJSONString(n, key string) resource.TestCheckFunc {
+	return resource.TestCheckResourceAttrWith(n, key, func(value string) error {
+		var m map[string]*json.RawMessage
+
+		if err := json.Unmarshal([]byte(value), &m); err != nil {
+			return err
+		}
+
+		if len(m) == 0 {
+			return errors.New(`empty JSON string`)
+		}
+
+		return nil
+	})
+}
+
+// SkipIfEnvVarNotSet skips the current test if the specified environment variable is not set.
+// The variable's value is returned.
+func SkipIfEnvVarNotSet(t *testing.T, key string) string {
+	v := os.Getenv(key)
+	if v == "" {
+		t.Skipf("Environment variable %s is not set, skipping test", key)
+	}
+	return v
+}
+
 // RunSerialTests1Level runs test cases in parallel, optionally sleeping between each.
 func RunSerialTests1Level(t *testing.T, testCases map[string]func(t *testing.T), d time.Duration) {
 	t.Helper()
@@ -2352,11 +2508,11 @@ func testNoMatchResourceAttr(is *terraform.InstanceState, name string, key strin
 }
 
 // checkIfIndexesIntoTypeSet is copied from
-// github.com/hashicorp/terraform-plugin-testing/helper/resource
+// https://github.com/hashicorp/terraform-plugin-testing/blob/dee4bfbbfd4911cf69a6c9917a37ecd8faa41ae9/helper/resource/testing.go#L1689
 func checkIfIndexesIntoTypeSet(key string, f resource.TestCheckFunc) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		err := f(s)
-		if err != nil && s.IsBinaryDrivenTest && indexesIntoTypeSet(key) {
+		if err != nil && indexesIntoTypeSet(key) {
 			return fmt.Errorf("Error in test check: %s\nTest check address %q likely indexes into TypeSet\nThis is currently not possible in the SDK", err, key)
 		}
 		return err
@@ -2364,7 +2520,7 @@ func checkIfIndexesIntoTypeSet(key string, f resource.TestCheckFunc) resource.Te
 }
 
 // indexesIntoTypeSet is copied from
-// github.com/hashicorp/terraform-plugin-testing/helper/resource
+// https://github.com/hashicorp/terraform-plugin-testing/blob/dee4bfbbfd4911cf69a6c9917a37ecd8faa41ae9/helper/resource/testing.go#L1680
 func indexesIntoTypeSet(key string) bool {
 	for _, part := range strings.Split(key, ".") {
 		if i, err := strconv.Atoi(part); err == nil && i > 100 {
@@ -2375,14 +2531,14 @@ func indexesIntoTypeSet(key string) bool {
 }
 
 // primaryInstanceState is copied from
-// github.com/hashicorp/terraform-plugin-testing/helper/resource
+// https://github.com/hashicorp/terraform-plugin-testing/blob/dee4bfbbfd4911cf69a6c9917a37ecd8faa41ae9/helper/resource/testing.go#L1672
 func primaryInstanceState(s *terraform.State, name string) (*terraform.InstanceState, error) {
 	ms := s.RootModule()
 	return modulePrimaryInstanceState(ms, name)
 }
 
 // modulePrimaryInstanceState is copied from
-// github.com/hashicorp/terraform-plugin-testing/helper/resource
+// https://github.com/hashicorp/terraform-plugin-testing/blob/dee4bfbbfd4911cf69a6c9917a37ecd8faa41ae9/helper/resource/testing.go#L1645
 func modulePrimaryInstanceState(ms *terraform.ModuleState, name string) (*terraform.InstanceState, error) {
 	rs, ok := ms.Resources[name]
 	if !ok {
@@ -2398,9 +2554,9 @@ func modulePrimaryInstanceState(ms *terraform.ModuleState, name string) (*terraf
 }
 
 func ExpectErrorAttrAtLeastOneOf(attrs ...string) *regexp.Regexp {
-	return regexp.MustCompile(fmt.Sprintf("one of\\s+`%s`\\s+must be specified", strings.Join(attrs, ",")))
+	return regexache.MustCompile(fmt.Sprintf("one of\\s+`%s`\\s+must be specified", strings.Join(attrs, ",")))
 }
 
 func ExpectErrorAttrMinItems(attr string, expected, actual int) *regexp.Regexp {
-	return regexp.MustCompile(fmt.Sprintf(`Attribute %s requires %d\s+item minimum, but config has only %d declared`, attr, expected, actual))
+	return regexache.MustCompile(fmt.Sprintf(`Attribute %s requires %d\s+item minimum, but config has only %d declared`, attr, expected, actual))
 }
diff --git a/internal/acctest/context.go b/internal/acctest/context.go
index 2fa367a705b..cd602bcb603 100644
--- a/internal/acctest/context.go
+++ b/internal/acctest/context.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package acctest
 
 import (
diff --git a/internal/acctest/crypto.go b/internal/acctest/crypto.go
index 00c4d8f6d91..7df76c18970 100644
--- a/internal/acctest/crypto.go
+++ b/internal/acctest/crypto.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package acctest
 
 import (
diff --git a/internal/acctest/crypto_test.go b/internal/acctest/crypto_test.go
index 7e78f56d9ea..c97ba1acc96 100644
--- a/internal/acctest/crypto_test.go
+++ b/internal/acctest/crypto_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package acctest_test
 
 import (
diff --git a/internal/acctest/exports_test.go b/internal/acctest/exports_test.go
index 53e1a1cff14..5e30a95ec23 100644
--- a/internal/acctest/exports_test.go
+++ b/internal/acctest/exports_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package acctest
 
 // Exports for use in tests only.
diff --git a/internal/acctest/framework.go b/internal/acctest/framework.go
index 92360a9ca21..74ed7e7719c 100644
--- a/internal/acctest/framework.go
+++ b/internal/acctest/framework.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package acctest
 
 import (
diff --git a/internal/acctest/vcr.go b/internal/acctest/vcr.go
index f9ffe559151..952462e6b5b 100644
--- a/internal/acctest/vcr.go
+++ b/internal/acctest/vcr.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package acctest
 
 import (
@@ -28,6 +31,7 @@ import (
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
 	"github.com/hashicorp/terraform-provider-aws/internal/provider"
 	"gopkg.in/dnaeon/go-vcr.v3/cassette"
 	"gopkg.in/dnaeon/go-vcr.v3/recorder"
@@ -130,6 +134,8 @@ func vcrEnabledProtoV5ProviderFactories(t *testing.T, input map[string]func() (t
 // VCR requires a single HTTP client to handle all interactions.
 func vcrProviderConfigureContextFunc(provider *schema.Provider, configureContextFunc schema.ConfigureContextFunc, testName string) schema.ConfigureContextFunc {
 	return func(ctx context.Context, d *schema.ResourceData) (interface{}, diag.Diagnostics) {
+		var diags diag.Diagnostics
+
 		providerMetas.Lock()
 		meta, ok := providerMetas[testName]
 		defer providerMetas.Unlock()
@@ -141,7 +147,7 @@ func vcrProviderConfigureContextFunc(provider *schema.Provider, configureContext
 		vcrMode, err := vcrMode()
 
 		if err != nil {
-			return nil, diag.FromErr(err)
+			return nil, sdkdiag.AppendFromErr(diags, err)
 		}
 
 		// Cribbed from aws-sdk-go-base.
@@ -165,7 +171,7 @@ func vcrProviderConfigureContextFunc(provider *schema.Provider, configureContext
 		})
 
 		if err != nil {
-			return nil, diag.FromErr(err)
+			return nil, sdkdiag.AppendFromErr(diags, err)
 		}
 
 		// Remove sensitive HTTP headers.
@@ -260,8 +266,8 @@ func vcrProviderConfigureContextFunc(provider *schema.Provider, configureContext
 		meta.SetHTTPClient(httpClient)
 		provider.SetMeta(meta)
 
-		if v, diags := configureContextFunc(ctx, d); diags.HasError() {
-			return nil, diags
+		if v, ds := configureContextFunc(ctx, d); ds.HasError() {
+			return nil, append(diags, ds...)
 		} else {
 			meta = v.(*conns.AWSClient)
 		}
@@ -279,7 +285,7 @@ func vcrProviderConfigureContextFunc(provider *schema.Provider, configureContext
 
 		providerMetas[testName] = meta
 
-		return meta, nil
+		return meta, diags
 	}
 }
 
diff --git a/internal/acctest/vcr_test.go b/internal/acctest/vcr_test.go
index 5d5bc2824b6..c1589e5f495 100644
--- a/internal/acctest/vcr_test.go
+++ b/internal/acctest/vcr_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package acctest_test
 
 import (
diff --git a/internal/attrmap/attrmap.go b/internal/attrmap/attrmap.go
index fb33dbd42f0..db4c59a2186 100644
--- a/internal/attrmap/attrmap.go
+++ b/internal/attrmap/attrmap.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package attrmap
 
 import (
diff --git a/internal/conns/apiretry.go b/internal/conns/apiretry.go
new file mode 100644
index 00000000000..4134fe88af9
--- /dev/null
+++ b/internal/conns/apiretry.go
@@ -0,0 +1,29 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package conns
+
+import (
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/aws/retry"
+)
+
+// AddIsErrorRetryables returns a Retryer which runs the specified retryables on any error.
+func AddIsErrorRetryables(r aws.RetryerV2, retryables ...retry.IsErrorRetryable) aws.RetryerV2 {
+	return &withIsErrorRetryables{
+		RetryerV2:  r,
+		retryables: retryables,
+	}
+}
+
+type withIsErrorRetryables struct {
+	aws.RetryerV2
+	retryables retry.IsErrorRetryables
+}
+
+func (r *withIsErrorRetryables) IsErrorRetryable(err error) bool {
+	if v := r.retryables.IsErrorRetryable(err); v != aws.UnknownTernary {
+		return v.Bool()
+	}
+	return r.RetryerV2.IsErrorRetryable(err)
+}
diff --git a/internal/conns/apiretry_test.go b/internal/conns/apiretry_test.go
new file mode 100644
index 00000000000..fec1d6b10f9
--- /dev/null
+++ b/internal/conns/apiretry_test.go
@@ -0,0 +1,54 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package conns
+
+import (
+	"errors"
+	"testing"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/aws/retry"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs"
+)
+
+func TestAddIsErrorRetryables(t *testing.T) {
+	t.Parallel()
+
+	f := func(err error) aws.Ternary {
+		if errs.Contains(err, "testing") {
+			return aws.TrueTernary
+		}
+		return aws.UnknownTernary
+	}
+	testCases := []struct {
+		name     string
+		err      error
+		expected bool
+	}{
+		{
+			name: "no error",
+		},
+		{
+			name: "non-retryable",
+			err:  errors.New(`this is not retryable`),
+		},
+		{
+			name:     "retryable",
+			err:      errors.New(`this is testing`),
+			expected: true,
+		},
+	}
+
+	for _, testCase := range testCases {
+		testCase := testCase
+		t.Run(testCase.name, func(t *testing.T) {
+			t.Parallel()
+
+			got := AddIsErrorRetryables(retry.NewStandard(), retry.IsErrorRetryableFunc(f)).IsErrorRetryable(testCase.err)
+			if got, want := got, testCase.expected; got != want {
+				t.Errorf("IsErrorRetryable(%q) = %v, want %v", testCase.err, got, want)
+			}
+		})
+	}
+}
diff --git a/internal/conns/awsclient.go b/internal/conns/awsclient.go
index 300f798408c..b1f8680be8b 100644
--- a/internal/conns/awsclient.go
+++ b/internal/conns/awsclient.go
@@ -1,18 +1,21 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package conns
 
 import (
 	"context"
 	"fmt"
 	"net/http"
+	"os"
 	"sync"
 
 	aws_sdkv2 "github.com/aws/aws-sdk-go-v2/aws"
-	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	endpoints_sdkv1 "github.com/aws/aws-sdk-go/aws/endpoints"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	apigatewayv2_sdkv1 "github.com/aws/aws-sdk-go/service/apigatewayv2"
 	mediaconvert_sdkv1 "github.com/aws/aws-sdk-go/service/mediaconvert"
-	s3_sdkv1 "github.com/aws/aws-sdk-go/service/s3"
+	baselogging "github.com/hashicorp/aws-sdk-go-base/v2/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -30,14 +33,24 @@ type AWSClient struct {
 	Session                 *session_sdkv1.Session
 	TerraformVersion        string
 
-	awsConfig      *aws_sdkv2.Config
-	clients        map[string]any
-	conns          map[string]any
-	endpoints      map[string]string // From provider configuration.
-	httpClient     *http.Client
-	lock           sync.Mutex
-	s3UsePathStyle bool   // From provider configuration.
-	stsRegion      string // From provider configuration.
+	awsConfig                 *aws_sdkv2.Config
+	clients                   map[string]any
+	conns                     map[string]any
+	endpoints                 map[string]string // From provider configuration.
+	httpClient                *http.Client
+	lock                      sync.Mutex
+	logger                    baselogging.Logger
+	s3UsePathStyle            bool                                      // From provider configuration.
+	s3UsEast1RegionalEndpoint endpoints_sdkv1.S3UsEast1RegionalEndpoint // From provider configuration.
+	stsRegion                 string                                    // From provider configuration.
+}
+
+// CredentialsProvider returns the AWS SDK for Go v2 credentials provider.
+func (client *AWSClient) CredentialsProvider() aws_sdkv2.CredentialsProvider {
+	if client.awsConfig == nil {
+		return nil
+	}
+	return client.awsConfig.Credentials
 }
 
 // PartitionHostname returns a hostname with the provider domain suffix for the partition
@@ -54,11 +67,9 @@ func (client *AWSClient) RegionalHostname(prefix string) string {
 	return fmt.Sprintf("%s.%s.%s", prefix, client.Region, client.DNSSuffix)
 }
 
-func (client *AWSClient) S3ConnURICleaningDisabled(ctx context.Context) *s3_sdkv1.S3 {
-	config := client.S3Conn(ctx).Config
-	config.DisableRestProtocolURICleaning = aws_sdkv1.Bool(true)
-
-	return s3_sdkv1.New(client.Session.Copy(&config))
+// S3UsePathStyle returns the s3_force_path_style provider configuration value.
+func (client *AWSClient) S3UsePathStyle() bool {
+	return client.s3UsePathStyle
 }
 
 // SetHTTPClient sets the http.Client used for AWS API calls.
@@ -74,6 +85,11 @@ func (client *AWSClient) HTTPClient() *http.Client {
 	return client.httpClient
 }
 
+// RegisterLogger places the configured logger into Context so it can be used via `tflog`.
+func (client *AWSClient) RegisterLogger(ctx context.Context) context.Context {
+	return baselogging.RegisterLogger(ctx, client.logger)
+}
+
 // APIGatewayInvokeURL returns the Amazon API Gateway (REST APIs) invoke URL for the configured AWS Region.
 // See https://docs.aws.amazon.com/apigateway/latest/developerguide/how-to-call-api.html.
 func (client *AWSClient) APIGatewayInvokeURL(restAPIID, stageName string) string {
@@ -142,6 +158,14 @@ func (client *AWSClient) apiClientConfig(servicePackageName string) map[string]a
 	switch servicePackageName {
 	case names.S3:
 		m["s3_use_path_style"] = client.s3UsePathStyle
+		// AWS SDK for Go v2 does not use the AWS_S3_US_EAST_1_REGIONAL_ENDPOINT environment variable during configuration.
+		// For compatibility, read it now.
+		if client.s3UsEast1RegionalEndpoint == endpoints_sdkv1.UnsetS3UsEast1Endpoint {
+			if v, err := endpoints_sdkv1.GetS3UsEast1RegionalEndpoint(os.Getenv("AWS_S3_US_EAST_1_REGIONAL_ENDPOINT")); err == nil {
+				client.s3UsEast1RegionalEndpoint = v
+			}
+		}
+		m["s3_us_east_1_regional_endpoint"] = client.s3UsEast1RegionalEndpoint
 	case names.STS:
 		m["sts_region"] = client.stsRegion
 	}
diff --git a/internal/conns/awsclient_gen.go b/internal/conns/awsclient_gen.go
index 0ae3143f307..0a73c487c30 100644
--- a/internal/conns/awsclient_gen.go
+++ b/internal/conns/awsclient_gen.go
@@ -12,85 +12,90 @@ import (
 	cleanrooms_sdkv2 "github.com/aws/aws-sdk-go-v2/service/cleanrooms"
 	cloudcontrol_sdkv2 "github.com/aws/aws-sdk-go-v2/service/cloudcontrol"
 	cloudwatchlogs_sdkv2 "github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs"
+	codecatalyst_sdkv2 "github.com/aws/aws-sdk-go-v2/service/codecatalyst"
+	codestarconnections_sdkv2 "github.com/aws/aws-sdk-go-v2/service/codestarconnections"
+	codestarnotifications_sdkv2 "github.com/aws/aws-sdk-go-v2/service/codestarnotifications"
 	comprehend_sdkv2 "github.com/aws/aws-sdk-go-v2/service/comprehend"
 	computeoptimizer_sdkv2 "github.com/aws/aws-sdk-go-v2/service/computeoptimizer"
 	directoryservice_sdkv2 "github.com/aws/aws-sdk-go-v2/service/directoryservice"
 	docdbelastic_sdkv2 "github.com/aws/aws-sdk-go-v2/service/docdbelastic"
 	ec2_sdkv2 "github.com/aws/aws-sdk-go-v2/service/ec2"
+	emrserverless_sdkv2 "github.com/aws/aws-sdk-go-v2/service/emrserverless"
 	finspace_sdkv2 "github.com/aws/aws-sdk-go-v2/service/finspace"
 	fis_sdkv2 "github.com/aws/aws-sdk-go-v2/service/fis"
 	glacier_sdkv2 "github.com/aws/aws-sdk-go-v2/service/glacier"
 	healthlake_sdkv2 "github.com/aws/aws-sdk-go-v2/service/healthlake"
 	identitystore_sdkv2 "github.com/aws/aws-sdk-go-v2/service/identitystore"
 	inspector2_sdkv2 "github.com/aws/aws-sdk-go-v2/service/inspector2"
+	internetmonitor_sdkv2 "github.com/aws/aws-sdk-go-v2/service/internetmonitor"
 	ivschat_sdkv2 "github.com/aws/aws-sdk-go-v2/service/ivschat"
+	kafka_sdkv2 "github.com/aws/aws-sdk-go-v2/service/kafka"
 	kendra_sdkv2 "github.com/aws/aws-sdk-go-v2/service/kendra"
+	keyspaces_sdkv2 "github.com/aws/aws-sdk-go-v2/service/keyspaces"
 	lambda_sdkv2 "github.com/aws/aws-sdk-go-v2/service/lambda"
+	lexmodelsv2_sdkv2 "github.com/aws/aws-sdk-go-v2/service/lexmodelsv2"
 	lightsail_sdkv2 "github.com/aws/aws-sdk-go-v2/service/lightsail"
+	mediaconnect_sdkv2 "github.com/aws/aws-sdk-go-v2/service/mediaconnect"
 	medialive_sdkv2 "github.com/aws/aws-sdk-go-v2/service/medialive"
+	mediapackage_sdkv2 "github.com/aws/aws-sdk-go-v2/service/mediapackage"
 	oam_sdkv2 "github.com/aws/aws-sdk-go-v2/service/oam"
 	opensearchserverless_sdkv2 "github.com/aws/aws-sdk-go-v2/service/opensearchserverless"
 	pipes_sdkv2 "github.com/aws/aws-sdk-go-v2/service/pipes"
+	pricing_sdkv2 "github.com/aws/aws-sdk-go-v2/service/pricing"
+	qldb_sdkv2 "github.com/aws/aws-sdk-go-v2/service/qldb"
 	rbin_sdkv2 "github.com/aws/aws-sdk-go-v2/service/rbin"
 	rds_sdkv2 "github.com/aws/aws-sdk-go-v2/service/rds"
+	redshiftdata_sdkv2 "github.com/aws/aws-sdk-go-v2/service/redshiftdata"
 	resourceexplorer2_sdkv2 "github.com/aws/aws-sdk-go-v2/service/resourceexplorer2"
+	resourcegroups_sdkv2 "github.com/aws/aws-sdk-go-v2/service/resourcegroups"
+	resourcegroupstaggingapi_sdkv2 "github.com/aws/aws-sdk-go-v2/service/resourcegroupstaggingapi"
 	rolesanywhere_sdkv2 "github.com/aws/aws-sdk-go-v2/service/rolesanywhere"
 	route53domains_sdkv2 "github.com/aws/aws-sdk-go-v2/service/route53domains"
+	s3_sdkv2 "github.com/aws/aws-sdk-go-v2/service/s3"
 	s3control_sdkv2 "github.com/aws/aws-sdk-go-v2/service/s3control"
 	scheduler_sdkv2 "github.com/aws/aws-sdk-go-v2/service/scheduler"
 	securitylake_sdkv2 "github.com/aws/aws-sdk-go-v2/service/securitylake"
+	servicequotas_sdkv2 "github.com/aws/aws-sdk-go-v2/service/servicequotas"
 	sesv2_sdkv2 "github.com/aws/aws-sdk-go-v2/service/sesv2"
+	signer_sdkv2 "github.com/aws/aws-sdk-go-v2/service/signer"
 	ssm_sdkv2 "github.com/aws/aws-sdk-go-v2/service/ssm"
 	ssmcontacts_sdkv2 "github.com/aws/aws-sdk-go-v2/service/ssmcontacts"
 	ssmincidents_sdkv2 "github.com/aws/aws-sdk-go-v2/service/ssmincidents"
 	swf_sdkv2 "github.com/aws/aws-sdk-go-v2/service/swf"
+	timestreamwrite_sdkv2 "github.com/aws/aws-sdk-go-v2/service/timestreamwrite"
 	transcribe_sdkv2 "github.com/aws/aws-sdk-go-v2/service/transcribe"
+	verifiedpermissions_sdkv2 "github.com/aws/aws-sdk-go-v2/service/verifiedpermissions"
 	vpclattice_sdkv2 "github.com/aws/aws-sdk-go-v2/service/vpclattice"
+	workspaces_sdkv2 "github.com/aws/aws-sdk-go-v2/service/workspaces"
 	xray_sdkv2 "github.com/aws/aws-sdk-go-v2/service/xray"
 	acmpca_sdkv1 "github.com/aws/aws-sdk-go/service/acmpca"
-	alexaforbusiness_sdkv1 "github.com/aws/aws-sdk-go/service/alexaforbusiness"
 	amplify_sdkv1 "github.com/aws/aws-sdk-go/service/amplify"
-	amplifybackend_sdkv1 "github.com/aws/aws-sdk-go/service/amplifybackend"
-	amplifyuibuilder_sdkv1 "github.com/aws/aws-sdk-go/service/amplifyuibuilder"
 	apigateway_sdkv1 "github.com/aws/aws-sdk-go/service/apigateway"
-	apigatewaymanagementapi_sdkv1 "github.com/aws/aws-sdk-go/service/apigatewaymanagementapi"
 	apigatewayv2_sdkv1 "github.com/aws/aws-sdk-go/service/apigatewayv2"
 	appconfig_sdkv1 "github.com/aws/aws-sdk-go/service/appconfig"
-	appconfigdata_sdkv1 "github.com/aws/aws-sdk-go/service/appconfigdata"
 	appflow_sdkv1 "github.com/aws/aws-sdk-go/service/appflow"
 	appintegrationsservice_sdkv1 "github.com/aws/aws-sdk-go/service/appintegrationsservice"
 	applicationautoscaling_sdkv1 "github.com/aws/aws-sdk-go/service/applicationautoscaling"
-	applicationcostprofiler_sdkv1 "github.com/aws/aws-sdk-go/service/applicationcostprofiler"
-	applicationdiscoveryservice_sdkv1 "github.com/aws/aws-sdk-go/service/applicationdiscoveryservice"
 	applicationinsights_sdkv1 "github.com/aws/aws-sdk-go/service/applicationinsights"
 	appmesh_sdkv1 "github.com/aws/aws-sdk-go/service/appmesh"
-	appregistry_sdkv1 "github.com/aws/aws-sdk-go/service/appregistry"
 	apprunner_sdkv1 "github.com/aws/aws-sdk-go/service/apprunner"
 	appstream_sdkv1 "github.com/aws/aws-sdk-go/service/appstream"
 	appsync_sdkv1 "github.com/aws/aws-sdk-go/service/appsync"
 	athena_sdkv1 "github.com/aws/aws-sdk-go/service/athena"
-	augmentedairuntime_sdkv1 "github.com/aws/aws-sdk-go/service/augmentedairuntime"
 	autoscaling_sdkv1 "github.com/aws/aws-sdk-go/service/autoscaling"
 	autoscalingplans_sdkv1 "github.com/aws/aws-sdk-go/service/autoscalingplans"
 	backup_sdkv1 "github.com/aws/aws-sdk-go/service/backup"
-	backupgateway_sdkv1 "github.com/aws/aws-sdk-go/service/backupgateway"
 	batch_sdkv1 "github.com/aws/aws-sdk-go/service/batch"
-	billingconductor_sdkv1 "github.com/aws/aws-sdk-go/service/billingconductor"
-	braket_sdkv1 "github.com/aws/aws-sdk-go/service/braket"
+	bedrock_sdkv1 "github.com/aws/aws-sdk-go/service/bedrock"
 	budgets_sdkv1 "github.com/aws/aws-sdk-go/service/budgets"
 	chime_sdkv1 "github.com/aws/aws-sdk-go/service/chime"
-	chimesdkidentity_sdkv1 "github.com/aws/aws-sdk-go/service/chimesdkidentity"
 	chimesdkmediapipelines_sdkv1 "github.com/aws/aws-sdk-go/service/chimesdkmediapipelines"
-	chimesdkmeetings_sdkv1 "github.com/aws/aws-sdk-go/service/chimesdkmeetings"
-	chimesdkmessaging_sdkv1 "github.com/aws/aws-sdk-go/service/chimesdkmessaging"
 	chimesdkvoice_sdkv1 "github.com/aws/aws-sdk-go/service/chimesdkvoice"
 	cloud9_sdkv1 "github.com/aws/aws-sdk-go/service/cloud9"
-	clouddirectory_sdkv1 "github.com/aws/aws-sdk-go/service/clouddirectory"
 	cloudformation_sdkv1 "github.com/aws/aws-sdk-go/service/cloudformation"
 	cloudfront_sdkv1 "github.com/aws/aws-sdk-go/service/cloudfront"
 	cloudhsmv2_sdkv1 "github.com/aws/aws-sdk-go/service/cloudhsmv2"
 	cloudsearch_sdkv1 "github.com/aws/aws-sdk-go/service/cloudsearch"
-	cloudsearchdomain_sdkv1 "github.com/aws/aws-sdk-go/service/cloudsearchdomain"
 	cloudtrail_sdkv1 "github.com/aws/aws-sdk-go/service/cloudtrail"
 	cloudwatch_sdkv1 "github.com/aws/aws-sdk-go/service/cloudwatch"
 	cloudwatchevidently_sdkv1 "github.com/aws/aws-sdk-go/service/cloudwatchevidently"
@@ -100,25 +105,15 @@ import (
 	codebuild_sdkv1 "github.com/aws/aws-sdk-go/service/codebuild"
 	codecommit_sdkv1 "github.com/aws/aws-sdk-go/service/codecommit"
 	codedeploy_sdkv1 "github.com/aws/aws-sdk-go/service/codedeploy"
-	codeguruprofiler_sdkv1 "github.com/aws/aws-sdk-go/service/codeguruprofiler"
 	codegurureviewer_sdkv1 "github.com/aws/aws-sdk-go/service/codegurureviewer"
 	codepipeline_sdkv1 "github.com/aws/aws-sdk-go/service/codepipeline"
-	codestar_sdkv1 "github.com/aws/aws-sdk-go/service/codestar"
-	codestarconnections_sdkv1 "github.com/aws/aws-sdk-go/service/codestarconnections"
-	codestarnotifications_sdkv1 "github.com/aws/aws-sdk-go/service/codestarnotifications"
 	cognitoidentity_sdkv1 "github.com/aws/aws-sdk-go/service/cognitoidentity"
 	cognitoidentityprovider_sdkv1 "github.com/aws/aws-sdk-go/service/cognitoidentityprovider"
-	cognitosync_sdkv1 "github.com/aws/aws-sdk-go/service/cognitosync"
-	comprehendmedical_sdkv1 "github.com/aws/aws-sdk-go/service/comprehendmedical"
 	configservice_sdkv1 "github.com/aws/aws-sdk-go/service/configservice"
 	connect_sdkv1 "github.com/aws/aws-sdk-go/service/connect"
-	connectcontactlens_sdkv1 "github.com/aws/aws-sdk-go/service/connectcontactlens"
-	connectparticipant_sdkv1 "github.com/aws/aws-sdk-go/service/connectparticipant"
-	connectwisdomservice_sdkv1 "github.com/aws/aws-sdk-go/service/connectwisdomservice"
 	controltower_sdkv1 "github.com/aws/aws-sdk-go/service/controltower"
 	costandusagereportservice_sdkv1 "github.com/aws/aws-sdk-go/service/costandusagereportservice"
 	costexplorer_sdkv1 "github.com/aws/aws-sdk-go/service/costexplorer"
-	customerprofiles_sdkv1 "github.com/aws/aws-sdk-go/service/customerprofiles"
 	databasemigrationservice_sdkv1 "github.com/aws/aws-sdk-go/service/databasemigrationservice"
 	dataexchange_sdkv1 "github.com/aws/aws-sdk-go/service/dataexchange"
 	datapipeline_sdkv1 "github.com/aws/aws-sdk-go/service/datapipeline"
@@ -126,17 +121,12 @@ import (
 	dax_sdkv1 "github.com/aws/aws-sdk-go/service/dax"
 	detective_sdkv1 "github.com/aws/aws-sdk-go/service/detective"
 	devicefarm_sdkv1 "github.com/aws/aws-sdk-go/service/devicefarm"
-	devopsguru_sdkv1 "github.com/aws/aws-sdk-go/service/devopsguru"
 	directconnect_sdkv1 "github.com/aws/aws-sdk-go/service/directconnect"
 	directoryservice_sdkv1 "github.com/aws/aws-sdk-go/service/directoryservice"
 	dlm_sdkv1 "github.com/aws/aws-sdk-go/service/dlm"
 	docdb_sdkv1 "github.com/aws/aws-sdk-go/service/docdb"
-	drs_sdkv1 "github.com/aws/aws-sdk-go/service/drs"
 	dynamodb_sdkv1 "github.com/aws/aws-sdk-go/service/dynamodb"
-	dynamodbstreams_sdkv1 "github.com/aws/aws-sdk-go/service/dynamodbstreams"
-	ebs_sdkv1 "github.com/aws/aws-sdk-go/service/ebs"
 	ec2_sdkv1 "github.com/aws/aws-sdk-go/service/ec2"
-	ec2instanceconnect_sdkv1 "github.com/aws/aws-sdk-go/service/ec2instanceconnect"
 	ecr_sdkv1 "github.com/aws/aws-sdk-go/service/ecr"
 	ecrpublic_sdkv1 "github.com/aws/aws-sdk-go/service/ecrpublic"
 	ecs_sdkv1 "github.com/aws/aws-sdk-go/service/ecs"
@@ -144,137 +134,62 @@ import (
 	eks_sdkv1 "github.com/aws/aws-sdk-go/service/eks"
 	elasticache_sdkv1 "github.com/aws/aws-sdk-go/service/elasticache"
 	elasticbeanstalk_sdkv1 "github.com/aws/aws-sdk-go/service/elasticbeanstalk"
-	elasticinference_sdkv1 "github.com/aws/aws-sdk-go/service/elasticinference"
 	elasticsearchservice_sdkv1 "github.com/aws/aws-sdk-go/service/elasticsearchservice"
 	elastictranscoder_sdkv1 "github.com/aws/aws-sdk-go/service/elastictranscoder"
 	elb_sdkv1 "github.com/aws/aws-sdk-go/service/elb"
 	elbv2_sdkv1 "github.com/aws/aws-sdk-go/service/elbv2"
 	emr_sdkv1 "github.com/aws/aws-sdk-go/service/emr"
 	emrcontainers_sdkv1 "github.com/aws/aws-sdk-go/service/emrcontainers"
-	emrserverless_sdkv1 "github.com/aws/aws-sdk-go/service/emrserverless"
 	eventbridge_sdkv1 "github.com/aws/aws-sdk-go/service/eventbridge"
-	finspacedata_sdkv1 "github.com/aws/aws-sdk-go/service/finspacedata"
 	firehose_sdkv1 "github.com/aws/aws-sdk-go/service/firehose"
 	fms_sdkv1 "github.com/aws/aws-sdk-go/service/fms"
-	forecastqueryservice_sdkv1 "github.com/aws/aws-sdk-go/service/forecastqueryservice"
-	forecastservice_sdkv1 "github.com/aws/aws-sdk-go/service/forecastservice"
-	frauddetector_sdkv1 "github.com/aws/aws-sdk-go/service/frauddetector"
 	fsx_sdkv1 "github.com/aws/aws-sdk-go/service/fsx"
 	gamelift_sdkv1 "github.com/aws/aws-sdk-go/service/gamelift"
 	globalaccelerator_sdkv1 "github.com/aws/aws-sdk-go/service/globalaccelerator"
 	glue_sdkv1 "github.com/aws/aws-sdk-go/service/glue"
-	gluedatabrew_sdkv1 "github.com/aws/aws-sdk-go/service/gluedatabrew"
 	greengrass_sdkv1 "github.com/aws/aws-sdk-go/service/greengrass"
-	greengrassv2_sdkv1 "github.com/aws/aws-sdk-go/service/greengrassv2"
-	groundstation_sdkv1 "github.com/aws/aws-sdk-go/service/groundstation"
 	guardduty_sdkv1 "github.com/aws/aws-sdk-go/service/guardduty"
-	health_sdkv1 "github.com/aws/aws-sdk-go/service/health"
-	honeycode_sdkv1 "github.com/aws/aws-sdk-go/service/honeycode"
 	iam_sdkv1 "github.com/aws/aws-sdk-go/service/iam"
 	imagebuilder_sdkv1 "github.com/aws/aws-sdk-go/service/imagebuilder"
 	inspector_sdkv1 "github.com/aws/aws-sdk-go/service/inspector"
-	internetmonitor_sdkv1 "github.com/aws/aws-sdk-go/service/internetmonitor"
 	iot_sdkv1 "github.com/aws/aws-sdk-go/service/iot"
-	iot1clickdevicesservice_sdkv1 "github.com/aws/aws-sdk-go/service/iot1clickdevicesservice"
-	iot1clickprojects_sdkv1 "github.com/aws/aws-sdk-go/service/iot1clickprojects"
 	iotanalytics_sdkv1 "github.com/aws/aws-sdk-go/service/iotanalytics"
-	iotdataplane_sdkv1 "github.com/aws/aws-sdk-go/service/iotdataplane"
-	iotdeviceadvisor_sdkv1 "github.com/aws/aws-sdk-go/service/iotdeviceadvisor"
 	iotevents_sdkv1 "github.com/aws/aws-sdk-go/service/iotevents"
-	ioteventsdata_sdkv1 "github.com/aws/aws-sdk-go/service/ioteventsdata"
-	iotfleethub_sdkv1 "github.com/aws/aws-sdk-go/service/iotfleethub"
-	iotjobsdataplane_sdkv1 "github.com/aws/aws-sdk-go/service/iotjobsdataplane"
-	iotsecuretunneling_sdkv1 "github.com/aws/aws-sdk-go/service/iotsecuretunneling"
-	iotsitewise_sdkv1 "github.com/aws/aws-sdk-go/service/iotsitewise"
-	iotthingsgraph_sdkv1 "github.com/aws/aws-sdk-go/service/iotthingsgraph"
-	iottwinmaker_sdkv1 "github.com/aws/aws-sdk-go/service/iottwinmaker"
-	iotwireless_sdkv1 "github.com/aws/aws-sdk-go/service/iotwireless"
 	ivs_sdkv1 "github.com/aws/aws-sdk-go/service/ivs"
 	kafka_sdkv1 "github.com/aws/aws-sdk-go/service/kafka"
 	kafkaconnect_sdkv1 "github.com/aws/aws-sdk-go/service/kafkaconnect"
-	keyspaces_sdkv1 "github.com/aws/aws-sdk-go/service/keyspaces"
 	kinesis_sdkv1 "github.com/aws/aws-sdk-go/service/kinesis"
 	kinesisanalytics_sdkv1 "github.com/aws/aws-sdk-go/service/kinesisanalytics"
 	kinesisanalyticsv2_sdkv1 "github.com/aws/aws-sdk-go/service/kinesisanalyticsv2"
 	kinesisvideo_sdkv1 "github.com/aws/aws-sdk-go/service/kinesisvideo"
-	kinesisvideoarchivedmedia_sdkv1 "github.com/aws/aws-sdk-go/service/kinesisvideoarchivedmedia"
-	kinesisvideomedia_sdkv1 "github.com/aws/aws-sdk-go/service/kinesisvideomedia"
-	kinesisvideosignalingchannels_sdkv1 "github.com/aws/aws-sdk-go/service/kinesisvideosignalingchannels"
 	kms_sdkv1 "github.com/aws/aws-sdk-go/service/kms"
 	lakeformation_sdkv1 "github.com/aws/aws-sdk-go/service/lakeformation"
 	lambda_sdkv1 "github.com/aws/aws-sdk-go/service/lambda"
 	lexmodelbuildingservice_sdkv1 "github.com/aws/aws-sdk-go/service/lexmodelbuildingservice"
-	lexmodelsv2_sdkv1 "github.com/aws/aws-sdk-go/service/lexmodelsv2"
-	lexruntimeservice_sdkv1 "github.com/aws/aws-sdk-go/service/lexruntimeservice"
-	lexruntimev2_sdkv1 "github.com/aws/aws-sdk-go/service/lexruntimev2"
 	licensemanager_sdkv1 "github.com/aws/aws-sdk-go/service/licensemanager"
 	locationservice_sdkv1 "github.com/aws/aws-sdk-go/service/locationservice"
-	lookoutequipment_sdkv1 "github.com/aws/aws-sdk-go/service/lookoutequipment"
-	lookoutforvision_sdkv1 "github.com/aws/aws-sdk-go/service/lookoutforvision"
-	lookoutmetrics_sdkv1 "github.com/aws/aws-sdk-go/service/lookoutmetrics"
-	machinelearning_sdkv1 "github.com/aws/aws-sdk-go/service/machinelearning"
-	macie_sdkv1 "github.com/aws/aws-sdk-go/service/macie"
 	macie2_sdkv1 "github.com/aws/aws-sdk-go/service/macie2"
-	managedblockchain_sdkv1 "github.com/aws/aws-sdk-go/service/managedblockchain"
 	managedgrafana_sdkv1 "github.com/aws/aws-sdk-go/service/managedgrafana"
-	marketplacecatalog_sdkv1 "github.com/aws/aws-sdk-go/service/marketplacecatalog"
-	marketplacecommerceanalytics_sdkv1 "github.com/aws/aws-sdk-go/service/marketplacecommerceanalytics"
-	marketplaceentitlementservice_sdkv1 "github.com/aws/aws-sdk-go/service/marketplaceentitlementservice"
-	marketplacemetering_sdkv1 "github.com/aws/aws-sdk-go/service/marketplacemetering"
-	mediaconnect_sdkv1 "github.com/aws/aws-sdk-go/service/mediaconnect"
 	mediaconvert_sdkv1 "github.com/aws/aws-sdk-go/service/mediaconvert"
-	mediapackage_sdkv1 "github.com/aws/aws-sdk-go/service/mediapackage"
-	mediapackagevod_sdkv1 "github.com/aws/aws-sdk-go/service/mediapackagevod"
 	mediastore_sdkv1 "github.com/aws/aws-sdk-go/service/mediastore"
-	mediastoredata_sdkv1 "github.com/aws/aws-sdk-go/service/mediastoredata"
-	mediatailor_sdkv1 "github.com/aws/aws-sdk-go/service/mediatailor"
 	memorydb_sdkv1 "github.com/aws/aws-sdk-go/service/memorydb"
-	mgn_sdkv1 "github.com/aws/aws-sdk-go/service/mgn"
-	migrationhub_sdkv1 "github.com/aws/aws-sdk-go/service/migrationhub"
-	migrationhubconfig_sdkv1 "github.com/aws/aws-sdk-go/service/migrationhubconfig"
-	migrationhubrefactorspaces_sdkv1 "github.com/aws/aws-sdk-go/service/migrationhubrefactorspaces"
-	migrationhubstrategyrecommendations_sdkv1 "github.com/aws/aws-sdk-go/service/migrationhubstrategyrecommendations"
-	mobile_sdkv1 "github.com/aws/aws-sdk-go/service/mobile"
 	mq_sdkv1 "github.com/aws/aws-sdk-go/service/mq"
-	mturk_sdkv1 "github.com/aws/aws-sdk-go/service/mturk"
 	mwaa_sdkv1 "github.com/aws/aws-sdk-go/service/mwaa"
 	neptune_sdkv1 "github.com/aws/aws-sdk-go/service/neptune"
 	networkfirewall_sdkv1 "github.com/aws/aws-sdk-go/service/networkfirewall"
 	networkmanager_sdkv1 "github.com/aws/aws-sdk-go/service/networkmanager"
-	nimblestudio_sdkv1 "github.com/aws/aws-sdk-go/service/nimblestudio"
 	opensearchservice_sdkv1 "github.com/aws/aws-sdk-go/service/opensearchservice"
 	opsworks_sdkv1 "github.com/aws/aws-sdk-go/service/opsworks"
-	opsworkscm_sdkv1 "github.com/aws/aws-sdk-go/service/opsworkscm"
 	organizations_sdkv1 "github.com/aws/aws-sdk-go/service/organizations"
 	outposts_sdkv1 "github.com/aws/aws-sdk-go/service/outposts"
-	panorama_sdkv1 "github.com/aws/aws-sdk-go/service/panorama"
-	personalize_sdkv1 "github.com/aws/aws-sdk-go/service/personalize"
-	personalizeevents_sdkv1 "github.com/aws/aws-sdk-go/service/personalizeevents"
-	personalizeruntime_sdkv1 "github.com/aws/aws-sdk-go/service/personalizeruntime"
-	pi_sdkv1 "github.com/aws/aws-sdk-go/service/pi"
 	pinpoint_sdkv1 "github.com/aws/aws-sdk-go/service/pinpoint"
-	pinpointemail_sdkv1 "github.com/aws/aws-sdk-go/service/pinpointemail"
-	pinpointsmsvoice_sdkv1 "github.com/aws/aws-sdk-go/service/pinpointsmsvoice"
-	polly_sdkv1 "github.com/aws/aws-sdk-go/service/polly"
-	pricing_sdkv1 "github.com/aws/aws-sdk-go/service/pricing"
 	prometheusservice_sdkv1 "github.com/aws/aws-sdk-go/service/prometheusservice"
-	proton_sdkv1 "github.com/aws/aws-sdk-go/service/proton"
-	qldb_sdkv1 "github.com/aws/aws-sdk-go/service/qldb"
-	qldbsession_sdkv1 "github.com/aws/aws-sdk-go/service/qldbsession"
 	quicksight_sdkv1 "github.com/aws/aws-sdk-go/service/quicksight"
 	ram_sdkv1 "github.com/aws/aws-sdk-go/service/ram"
 	rds_sdkv1 "github.com/aws/aws-sdk-go/service/rds"
-	rdsdataservice_sdkv1 "github.com/aws/aws-sdk-go/service/rdsdataservice"
 	redshift_sdkv1 "github.com/aws/aws-sdk-go/service/redshift"
-	redshiftdataapiservice_sdkv1 "github.com/aws/aws-sdk-go/service/redshiftdataapiservice"
 	redshiftserverless_sdkv1 "github.com/aws/aws-sdk-go/service/redshiftserverless"
-	rekognition_sdkv1 "github.com/aws/aws-sdk-go/service/rekognition"
-	resiliencehub_sdkv1 "github.com/aws/aws-sdk-go/service/resiliencehub"
-	resourcegroups_sdkv1 "github.com/aws/aws-sdk-go/service/resourcegroups"
-	resourcegroupstaggingapi_sdkv1 "github.com/aws/aws-sdk-go/service/resourcegroupstaggingapi"
-	robomaker_sdkv1 "github.com/aws/aws-sdk-go/service/robomaker"
 	route53_sdkv1 "github.com/aws/aws-sdk-go/service/route53"
-	route53recoverycluster_sdkv1 "github.com/aws/aws-sdk-go/service/route53recoverycluster"
 	route53recoverycontrolconfig_sdkv1 "github.com/aws/aws-sdk-go/service/route53recoverycontrolconfig"
 	route53recoveryreadiness_sdkv1 "github.com/aws/aws-sdk-go/service/route53recoveryreadiness"
 	route53resolver_sdkv1 "github.com/aws/aws-sdk-go/service/route53resolver"
@@ -282,52 +197,28 @@ import (
 	s3control_sdkv1 "github.com/aws/aws-sdk-go/service/s3control"
 	s3outposts_sdkv1 "github.com/aws/aws-sdk-go/service/s3outposts"
 	sagemaker_sdkv1 "github.com/aws/aws-sdk-go/service/sagemaker"
-	sagemakeredgemanager_sdkv1 "github.com/aws/aws-sdk-go/service/sagemakeredgemanager"
-	sagemakerfeaturestoreruntime_sdkv1 "github.com/aws/aws-sdk-go/service/sagemakerfeaturestoreruntime"
-	sagemakerruntime_sdkv1 "github.com/aws/aws-sdk-go/service/sagemakerruntime"
-	savingsplans_sdkv1 "github.com/aws/aws-sdk-go/service/savingsplans"
 	schemas_sdkv1 "github.com/aws/aws-sdk-go/service/schemas"
 	secretsmanager_sdkv1 "github.com/aws/aws-sdk-go/service/secretsmanager"
 	securityhub_sdkv1 "github.com/aws/aws-sdk-go/service/securityhub"
 	serverlessapplicationrepository_sdkv1 "github.com/aws/aws-sdk-go/service/serverlessapplicationrepository"
 	servicecatalog_sdkv1 "github.com/aws/aws-sdk-go/service/servicecatalog"
 	servicediscovery_sdkv1 "github.com/aws/aws-sdk-go/service/servicediscovery"
-	servicequotas_sdkv1 "github.com/aws/aws-sdk-go/service/servicequotas"
 	ses_sdkv1 "github.com/aws/aws-sdk-go/service/ses"
 	sfn_sdkv1 "github.com/aws/aws-sdk-go/service/sfn"
 	shield_sdkv1 "github.com/aws/aws-sdk-go/service/shield"
-	signer_sdkv1 "github.com/aws/aws-sdk-go/service/signer"
 	simpledb_sdkv1 "github.com/aws/aws-sdk-go/service/simpledb"
-	sms_sdkv1 "github.com/aws/aws-sdk-go/service/sms"
-	snowball_sdkv1 "github.com/aws/aws-sdk-go/service/snowball"
-	snowdevicemanagement_sdkv1 "github.com/aws/aws-sdk-go/service/snowdevicemanagement"
 	sns_sdkv1 "github.com/aws/aws-sdk-go/service/sns"
 	sqs_sdkv1 "github.com/aws/aws-sdk-go/service/sqs"
 	ssm_sdkv1 "github.com/aws/aws-sdk-go/service/ssm"
-	sso_sdkv1 "github.com/aws/aws-sdk-go/service/sso"
 	ssoadmin_sdkv1 "github.com/aws/aws-sdk-go/service/ssoadmin"
-	ssooidc_sdkv1 "github.com/aws/aws-sdk-go/service/ssooidc"
 	storagegateway_sdkv1 "github.com/aws/aws-sdk-go/service/storagegateway"
 	sts_sdkv1 "github.com/aws/aws-sdk-go/service/sts"
-	support_sdkv1 "github.com/aws/aws-sdk-go/service/support"
 	synthetics_sdkv1 "github.com/aws/aws-sdk-go/service/synthetics"
-	textract_sdkv1 "github.com/aws/aws-sdk-go/service/textract"
-	timestreamquery_sdkv1 "github.com/aws/aws-sdk-go/service/timestreamquery"
-	timestreamwrite_sdkv1 "github.com/aws/aws-sdk-go/service/timestreamwrite"
-	transcribestreamingservice_sdkv1 "github.com/aws/aws-sdk-go/service/transcribestreamingservice"
 	transfer_sdkv1 "github.com/aws/aws-sdk-go/service/transfer"
-	translate_sdkv1 "github.com/aws/aws-sdk-go/service/translate"
-	voiceid_sdkv1 "github.com/aws/aws-sdk-go/service/voiceid"
 	waf_sdkv1 "github.com/aws/aws-sdk-go/service/waf"
 	wafregional_sdkv1 "github.com/aws/aws-sdk-go/service/wafregional"
 	wafv2_sdkv1 "github.com/aws/aws-sdk-go/service/wafv2"
-	wellarchitected_sdkv1 "github.com/aws/aws-sdk-go/service/wellarchitected"
-	workdocs_sdkv1 "github.com/aws/aws-sdk-go/service/workdocs"
 	worklink_sdkv1 "github.com/aws/aws-sdk-go/service/worklink"
-	workmail_sdkv1 "github.com/aws/aws-sdk-go/service/workmail"
-	workmailmessageflow_sdkv1 "github.com/aws/aws-sdk-go/service/workmailmessageflow"
-	workspaces_sdkv1 "github.com/aws/aws-sdk-go/service/workspaces"
-	workspacesweb_sdkv1 "github.com/aws/aws-sdk-go/service/workspacesweb"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -348,10 +239,6 @@ func (c *AWSClient) APIGatewayConn(ctx context.Context) *apigateway_sdkv1.APIGat
 	return errs.Must(conn[*apigateway_sdkv1.APIGateway](ctx, c, names.APIGateway))
 }
 
-func (c *AWSClient) APIGatewayManagementAPIConn(ctx context.Context) *apigatewaymanagementapi_sdkv1.ApiGatewayManagementApi {
-	return errs.Must(conn[*apigatewaymanagementapi_sdkv1.ApiGatewayManagementApi](ctx, c, names.APIGatewayManagementAPI))
-}
-
 func (c *AWSClient) APIGatewayV2Conn(ctx context.Context) *apigatewayv2_sdkv1.ApiGatewayV2 {
 	return errs.Must(conn[*apigatewayv2_sdkv1.ApiGatewayV2](ctx, c, names.APIGatewayV2))
 }
@@ -364,22 +251,10 @@ func (c *AWSClient) AccountClient(ctx context.Context) *account_sdkv2.Client {
 	return errs.Must(client[*account_sdkv2.Client](ctx, c, names.Account))
 }
 
-func (c *AWSClient) AlexaForBusinessConn(ctx context.Context) *alexaforbusiness_sdkv1.AlexaForBusiness {
-	return errs.Must(conn[*alexaforbusiness_sdkv1.AlexaForBusiness](ctx, c, names.AlexaForBusiness))
-}
-
 func (c *AWSClient) AmplifyConn(ctx context.Context) *amplify_sdkv1.Amplify {
 	return errs.Must(conn[*amplify_sdkv1.Amplify](ctx, c, names.Amplify))
 }
 
-func (c *AWSClient) AmplifyBackendConn(ctx context.Context) *amplifybackend_sdkv1.AmplifyBackend {
-	return errs.Must(conn[*amplifybackend_sdkv1.AmplifyBackend](ctx, c, names.AmplifyBackend))
-}
-
-func (c *AWSClient) AmplifyUIBuilderConn(ctx context.Context) *amplifyuibuilder_sdkv1.AmplifyUIBuilder {
-	return errs.Must(conn[*amplifyuibuilder_sdkv1.AmplifyUIBuilder](ctx, c, names.AmplifyUIBuilder))
-}
-
 func (c *AWSClient) AppAutoScalingConn(ctx context.Context) *applicationautoscaling_sdkv1.ApplicationAutoScaling {
 	return errs.Must(conn[*applicationautoscaling_sdkv1.ApplicationAutoScaling](ctx, c, names.AppAutoScaling))
 }
@@ -392,10 +267,6 @@ func (c *AWSClient) AppConfigClient(ctx context.Context) *appconfig_sdkv2.Client
 	return errs.Must(client[*appconfig_sdkv2.Client](ctx, c, names.AppConfig))
 }
 
-func (c *AWSClient) AppConfigDataConn(ctx context.Context) *appconfigdata_sdkv1.AppConfigData {
-	return errs.Must(conn[*appconfigdata_sdkv1.AppConfigData](ctx, c, names.AppConfigData))
-}
-
 func (c *AWSClient) AppFlowConn(ctx context.Context) *appflow_sdkv1.Appflow {
 	return errs.Must(conn[*appflow_sdkv1.Appflow](ctx, c, names.AppFlow))
 }
@@ -420,10 +291,6 @@ func (c *AWSClient) AppSyncConn(ctx context.Context) *appsync_sdkv1.AppSync {
 	return errs.Must(conn[*appsync_sdkv1.AppSync](ctx, c, names.AppSync))
 }
 
-func (c *AWSClient) ApplicationCostProfilerConn(ctx context.Context) *applicationcostprofiler_sdkv1.ApplicationCostProfiler {
-	return errs.Must(conn[*applicationcostprofiler_sdkv1.ApplicationCostProfiler](ctx, c, names.ApplicationCostProfiler))
-}
-
 func (c *AWSClient) ApplicationInsightsConn(ctx context.Context) *applicationinsights_sdkv1.ApplicationInsights {
 	return errs.Must(conn[*applicationinsights_sdkv1.ApplicationInsights](ctx, c, names.ApplicationInsights))
 }
@@ -448,20 +315,12 @@ func (c *AWSClient) BackupConn(ctx context.Context) *backup_sdkv1.Backup {
 	return errs.Must(conn[*backup_sdkv1.Backup](ctx, c, names.Backup))
 }
 
-func (c *AWSClient) BackupGatewayConn(ctx context.Context) *backupgateway_sdkv1.BackupGateway {
-	return errs.Must(conn[*backupgateway_sdkv1.BackupGateway](ctx, c, names.BackupGateway))
-}
-
 func (c *AWSClient) BatchConn(ctx context.Context) *batch_sdkv1.Batch {
 	return errs.Must(conn[*batch_sdkv1.Batch](ctx, c, names.Batch))
 }
 
-func (c *AWSClient) BillingConductorConn(ctx context.Context) *billingconductor_sdkv1.BillingConductor {
-	return errs.Must(conn[*billingconductor_sdkv1.BillingConductor](ctx, c, names.BillingConductor))
-}
-
-func (c *AWSClient) BraketConn(ctx context.Context) *braket_sdkv1.Braket {
-	return errs.Must(conn[*braket_sdkv1.Braket](ctx, c, names.Braket))
+func (c *AWSClient) BedrockConn(ctx context.Context) *bedrock_sdkv1.Bedrock {
+	return errs.Must(conn[*bedrock_sdkv1.Bedrock](ctx, c, names.Bedrock))
 }
 
 func (c *AWSClient) BudgetsConn(ctx context.Context) *budgets_sdkv1.Budgets {
@@ -480,22 +339,10 @@ func (c *AWSClient) ChimeConn(ctx context.Context) *chime_sdkv1.Chime {
 	return errs.Must(conn[*chime_sdkv1.Chime](ctx, c, names.Chime))
 }
 
-func (c *AWSClient) ChimeSDKIdentityConn(ctx context.Context) *chimesdkidentity_sdkv1.ChimeSDKIdentity {
-	return errs.Must(conn[*chimesdkidentity_sdkv1.ChimeSDKIdentity](ctx, c, names.ChimeSDKIdentity))
-}
-
 func (c *AWSClient) ChimeSDKMediaPipelinesConn(ctx context.Context) *chimesdkmediapipelines_sdkv1.ChimeSDKMediaPipelines {
 	return errs.Must(conn[*chimesdkmediapipelines_sdkv1.ChimeSDKMediaPipelines](ctx, c, names.ChimeSDKMediaPipelines))
 }
 
-func (c *AWSClient) ChimeSDKMeetingsConn(ctx context.Context) *chimesdkmeetings_sdkv1.ChimeSDKMeetings {
-	return errs.Must(conn[*chimesdkmeetings_sdkv1.ChimeSDKMeetings](ctx, c, names.ChimeSDKMeetings))
-}
-
-func (c *AWSClient) ChimeSDKMessagingConn(ctx context.Context) *chimesdkmessaging_sdkv1.ChimeSDKMessaging {
-	return errs.Must(conn[*chimesdkmessaging_sdkv1.ChimeSDKMessaging](ctx, c, names.ChimeSDKMessaging))
-}
-
 func (c *AWSClient) ChimeSDKVoiceConn(ctx context.Context) *chimesdkvoice_sdkv1.ChimeSDKVoice {
 	return errs.Must(conn[*chimesdkvoice_sdkv1.ChimeSDKVoice](ctx, c, names.ChimeSDKVoice))
 }
@@ -512,10 +359,6 @@ func (c *AWSClient) CloudControlClient(ctx context.Context) *cloudcontrol_sdkv2.
 	return errs.Must(client[*cloudcontrol_sdkv2.Client](ctx, c, names.CloudControl))
 }
 
-func (c *AWSClient) CloudDirectoryConn(ctx context.Context) *clouddirectory_sdkv1.CloudDirectory {
-	return errs.Must(conn[*clouddirectory_sdkv1.CloudDirectory](ctx, c, names.CloudDirectory))
-}
-
 func (c *AWSClient) CloudFormationConn(ctx context.Context) *cloudformation_sdkv1.CloudFormation {
 	return errs.Must(conn[*cloudformation_sdkv1.CloudFormation](ctx, c, names.CloudFormation))
 }
@@ -532,10 +375,6 @@ func (c *AWSClient) CloudSearchConn(ctx context.Context) *cloudsearch_sdkv1.Clou
 	return errs.Must(conn[*cloudsearch_sdkv1.CloudSearch](ctx, c, names.CloudSearch))
 }
 
-func (c *AWSClient) CloudSearchDomainConn(ctx context.Context) *cloudsearchdomain_sdkv1.CloudSearchDomain {
-	return errs.Must(conn[*cloudsearchdomain_sdkv1.CloudSearchDomain](ctx, c, names.CloudSearchDomain))
-}
-
 func (c *AWSClient) CloudTrailConn(ctx context.Context) *cloudtrail_sdkv1.CloudTrail {
 	return errs.Must(conn[*cloudtrail_sdkv1.CloudTrail](ctx, c, names.CloudTrail))
 }
@@ -552,12 +391,12 @@ func (c *AWSClient) CodeBuildConn(ctx context.Context) *codebuild_sdkv1.CodeBuil
 	return errs.Must(conn[*codebuild_sdkv1.CodeBuild](ctx, c, names.CodeBuild))
 }
 
-func (c *AWSClient) CodeCommitConn(ctx context.Context) *codecommit_sdkv1.CodeCommit {
-	return errs.Must(conn[*codecommit_sdkv1.CodeCommit](ctx, c, names.CodeCommit))
+func (c *AWSClient) CodeCatalystClient(ctx context.Context) *codecatalyst_sdkv2.Client {
+	return errs.Must(client[*codecatalyst_sdkv2.Client](ctx, c, names.CodeCatalyst))
 }
 
-func (c *AWSClient) CodeGuruProfilerConn(ctx context.Context) *codeguruprofiler_sdkv1.CodeGuruProfiler {
-	return errs.Must(conn[*codeguruprofiler_sdkv1.CodeGuruProfiler](ctx, c, names.CodeGuruProfiler))
+func (c *AWSClient) CodeCommitConn(ctx context.Context) *codecommit_sdkv1.CodeCommit {
+	return errs.Must(conn[*codecommit_sdkv1.CodeCommit](ctx, c, names.CodeCommit))
 }
 
 func (c *AWSClient) CodeGuruReviewerConn(ctx context.Context) *codegurureviewer_sdkv1.CodeGuruReviewer {
@@ -568,16 +407,12 @@ func (c *AWSClient) CodePipelineConn(ctx context.Context) *codepipeline_sdkv1.Co
 	return errs.Must(conn[*codepipeline_sdkv1.CodePipeline](ctx, c, names.CodePipeline))
 }
 
-func (c *AWSClient) CodeStarConn(ctx context.Context) *codestar_sdkv1.CodeStar {
-	return errs.Must(conn[*codestar_sdkv1.CodeStar](ctx, c, names.CodeStar))
-}
-
-func (c *AWSClient) CodeStarConnectionsConn(ctx context.Context) *codestarconnections_sdkv1.CodeStarConnections {
-	return errs.Must(conn[*codestarconnections_sdkv1.CodeStarConnections](ctx, c, names.CodeStarConnections))
+func (c *AWSClient) CodeStarConnectionsClient(ctx context.Context) *codestarconnections_sdkv2.Client {
+	return errs.Must(client[*codestarconnections_sdkv2.Client](ctx, c, names.CodeStarConnections))
 }
 
-func (c *AWSClient) CodeStarNotificationsConn(ctx context.Context) *codestarnotifications_sdkv1.CodeStarNotifications {
-	return errs.Must(conn[*codestarnotifications_sdkv1.CodeStarNotifications](ctx, c, names.CodeStarNotifications))
+func (c *AWSClient) CodeStarNotificationsClient(ctx context.Context) *codestarnotifications_sdkv2.Client {
+	return errs.Must(client[*codestarnotifications_sdkv2.Client](ctx, c, names.CodeStarNotifications))
 }
 
 func (c *AWSClient) CognitoIDPConn(ctx context.Context) *cognitoidentityprovider_sdkv1.CognitoIdentityProvider {
@@ -588,18 +423,10 @@ func (c *AWSClient) CognitoIdentityConn(ctx context.Context) *cognitoidentity_sd
 	return errs.Must(conn[*cognitoidentity_sdkv1.CognitoIdentity](ctx, c, names.CognitoIdentity))
 }
 
-func (c *AWSClient) CognitoSyncConn(ctx context.Context) *cognitosync_sdkv1.CognitoSync {
-	return errs.Must(conn[*cognitosync_sdkv1.CognitoSync](ctx, c, names.CognitoSync))
-}
-
 func (c *AWSClient) ComprehendClient(ctx context.Context) *comprehend_sdkv2.Client {
 	return errs.Must(client[*comprehend_sdkv2.Client](ctx, c, names.Comprehend))
 }
 
-func (c *AWSClient) ComprehendMedicalConn(ctx context.Context) *comprehendmedical_sdkv1.ComprehendMedical {
-	return errs.Must(conn[*comprehendmedical_sdkv1.ComprehendMedical](ctx, c, names.ComprehendMedical))
-}
-
 func (c *AWSClient) ComputeOptimizerClient(ctx context.Context) *computeoptimizer_sdkv2.Client {
 	return errs.Must(client[*computeoptimizer_sdkv2.Client](ctx, c, names.ComputeOptimizer))
 }
@@ -612,22 +439,10 @@ func (c *AWSClient) ConnectConn(ctx context.Context) *connect_sdkv1.Connect {
 	return errs.Must(conn[*connect_sdkv1.Connect](ctx, c, names.Connect))
 }
 
-func (c *AWSClient) ConnectContactLensConn(ctx context.Context) *connectcontactlens_sdkv1.ConnectContactLens {
-	return errs.Must(conn[*connectcontactlens_sdkv1.ConnectContactLens](ctx, c, names.ConnectContactLens))
-}
-
-func (c *AWSClient) ConnectParticipantConn(ctx context.Context) *connectparticipant_sdkv1.ConnectParticipant {
-	return errs.Must(conn[*connectparticipant_sdkv1.ConnectParticipant](ctx, c, names.ConnectParticipant))
-}
-
 func (c *AWSClient) ControlTowerConn(ctx context.Context) *controltower_sdkv1.ControlTower {
 	return errs.Must(conn[*controltower_sdkv1.ControlTower](ctx, c, names.ControlTower))
 }
 
-func (c *AWSClient) CustomerProfilesConn(ctx context.Context) *customerprofiles_sdkv1.CustomerProfiles {
-	return errs.Must(conn[*customerprofiles_sdkv1.CustomerProfiles](ctx, c, names.CustomerProfiles))
-}
-
 func (c *AWSClient) DAXConn(ctx context.Context) *dax_sdkv1.DAX {
 	return errs.Must(conn[*dax_sdkv1.DAX](ctx, c, names.DAX))
 }
@@ -640,10 +455,6 @@ func (c *AWSClient) DMSConn(ctx context.Context) *databasemigrationservice_sdkv1
 	return errs.Must(conn[*databasemigrationservice_sdkv1.DatabaseMigrationService](ctx, c, names.DMS))
 }
 
-func (c *AWSClient) DRSConn(ctx context.Context) *drs_sdkv1.Drs {
-	return errs.Must(conn[*drs_sdkv1.Drs](ctx, c, names.DRS))
-}
-
 func (c *AWSClient) DSConn(ctx context.Context) *directoryservice_sdkv1.DirectoryService {
 	return errs.Must(conn[*directoryservice_sdkv1.DirectoryService](ctx, c, names.DS))
 }
@@ -652,10 +463,6 @@ func (c *AWSClient) DSClient(ctx context.Context) *directoryservice_sdkv2.Client
 	return errs.Must(client[*directoryservice_sdkv2.Client](ctx, c, names.DS))
 }
 
-func (c *AWSClient) DataBrewConn(ctx context.Context) *gluedatabrew_sdkv1.GlueDataBrew {
-	return errs.Must(conn[*gluedatabrew_sdkv1.GlueDataBrew](ctx, c, names.DataBrew))
-}
-
 func (c *AWSClient) DataExchangeConn(ctx context.Context) *dataexchange_sdkv1.DataExchange {
 	return errs.Must(conn[*dataexchange_sdkv1.DataExchange](ctx, c, names.DataExchange))
 }
@@ -676,10 +483,6 @@ func (c *AWSClient) DetectiveConn(ctx context.Context) *detective_sdkv1.Detectiv
 	return errs.Must(conn[*detective_sdkv1.Detective](ctx, c, names.Detective))
 }
 
-func (c *AWSClient) DevOpsGuruConn(ctx context.Context) *devopsguru_sdkv1.DevOpsGuru {
-	return errs.Must(conn[*devopsguru_sdkv1.DevOpsGuru](ctx, c, names.DevOpsGuru))
-}
-
 func (c *AWSClient) DeviceFarmConn(ctx context.Context) *devicefarm_sdkv1.DeviceFarm {
 	return errs.Must(conn[*devicefarm_sdkv1.DeviceFarm](ctx, c, names.DeviceFarm))
 }
@@ -688,10 +491,6 @@ func (c *AWSClient) DirectConnectConn(ctx context.Context) *directconnect_sdkv1.
 	return errs.Must(conn[*directconnect_sdkv1.DirectConnect](ctx, c, names.DirectConnect))
 }
 
-func (c *AWSClient) DiscoveryConn(ctx context.Context) *applicationdiscoveryservice_sdkv1.ApplicationDiscoveryService {
-	return errs.Must(conn[*applicationdiscoveryservice_sdkv1.ApplicationDiscoveryService](ctx, c, names.Discovery))
-}
-
 func (c *AWSClient) DocDBConn(ctx context.Context) *docdb_sdkv1.DocDB {
 	return errs.Must(conn[*docdb_sdkv1.DocDB](ctx, c, names.DocDB))
 }
@@ -704,14 +503,6 @@ func (c *AWSClient) DynamoDBConn(ctx context.Context) *dynamodb_sdkv1.DynamoDB {
 	return errs.Must(conn[*dynamodb_sdkv1.DynamoDB](ctx, c, names.DynamoDB))
 }
 
-func (c *AWSClient) DynamoDBStreamsConn(ctx context.Context) *dynamodbstreams_sdkv1.DynamoDBStreams {
-	return errs.Must(conn[*dynamodbstreams_sdkv1.DynamoDBStreams](ctx, c, names.DynamoDBStreams))
-}
-
-func (c *AWSClient) EBSConn(ctx context.Context) *ebs_sdkv1.EBS {
-	return errs.Must(conn[*ebs_sdkv1.EBS](ctx, c, names.EBS))
-}
-
 func (c *AWSClient) EC2Conn(ctx context.Context) *ec2_sdkv1.EC2 {
 	return errs.Must(conn[*ec2_sdkv1.EC2](ctx, c, names.EC2))
 }
@@ -720,10 +511,6 @@ func (c *AWSClient) EC2Client(ctx context.Context) *ec2_sdkv2.Client {
 	return errs.Must(client[*ec2_sdkv2.Client](ctx, c, names.EC2))
 }
 
-func (c *AWSClient) EC2InstanceConnectConn(ctx context.Context) *ec2instanceconnect_sdkv1.EC2InstanceConnect {
-	return errs.Must(conn[*ec2instanceconnect_sdkv1.EC2InstanceConnect](ctx, c, names.EC2InstanceConnect))
-}
-
 func (c *AWSClient) ECRConn(ctx context.Context) *ecr_sdkv1.ECR {
 	return errs.Must(conn[*ecr_sdkv1.ECR](ctx, c, names.ECR))
 }
@@ -760,8 +547,8 @@ func (c *AWSClient) EMRContainersConn(ctx context.Context) *emrcontainers_sdkv1.
 	return errs.Must(conn[*emrcontainers_sdkv1.EMRContainers](ctx, c, names.EMRContainers))
 }
 
-func (c *AWSClient) EMRServerlessConn(ctx context.Context) *emrserverless_sdkv1.EMRServerless {
-	return errs.Must(conn[*emrserverless_sdkv1.EMRServerless](ctx, c, names.EMRServerless))
+func (c *AWSClient) EMRServerlessClient(ctx context.Context) *emrserverless_sdkv2.Client {
+	return errs.Must(client[*emrserverless_sdkv2.Client](ctx, c, names.EMRServerless))
 }
 
 func (c *AWSClient) ElastiCacheConn(ctx context.Context) *elasticache_sdkv1.ElastiCache {
@@ -772,10 +559,6 @@ func (c *AWSClient) ElasticBeanstalkConn(ctx context.Context) *elasticbeanstalk_
 	return errs.Must(conn[*elasticbeanstalk_sdkv1.ElasticBeanstalk](ctx, c, names.ElasticBeanstalk))
 }
 
-func (c *AWSClient) ElasticInferenceConn(ctx context.Context) *elasticinference_sdkv1.ElasticInference {
-	return errs.Must(conn[*elasticinference_sdkv1.ElasticInference](ctx, c, names.ElasticInference))
-}
-
 func (c *AWSClient) ElasticTranscoderConn(ctx context.Context) *elastictranscoder_sdkv1.ElasticTranscoder {
 	return errs.Must(conn[*elastictranscoder_sdkv1.ElasticTranscoder](ctx, c, names.ElasticTranscoder))
 }
@@ -808,26 +591,10 @@ func (c *AWSClient) FinSpaceClient(ctx context.Context) *finspace_sdkv2.Client {
 	return errs.Must(client[*finspace_sdkv2.Client](ctx, c, names.FinSpace))
 }
 
-func (c *AWSClient) FinSpaceDataConn(ctx context.Context) *finspacedata_sdkv1.FinSpaceData {
-	return errs.Must(conn[*finspacedata_sdkv1.FinSpaceData](ctx, c, names.FinSpaceData))
-}
-
 func (c *AWSClient) FirehoseConn(ctx context.Context) *firehose_sdkv1.Firehose {
 	return errs.Must(conn[*firehose_sdkv1.Firehose](ctx, c, names.Firehose))
 }
 
-func (c *AWSClient) ForecastConn(ctx context.Context) *forecastservice_sdkv1.ForecastService {
-	return errs.Must(conn[*forecastservice_sdkv1.ForecastService](ctx, c, names.Forecast))
-}
-
-func (c *AWSClient) ForecastQueryConn(ctx context.Context) *forecastqueryservice_sdkv1.ForecastQueryService {
-	return errs.Must(conn[*forecastqueryservice_sdkv1.ForecastQueryService](ctx, c, names.ForecastQuery))
-}
-
-func (c *AWSClient) FraudDetectorConn(ctx context.Context) *frauddetector_sdkv1.FraudDetector {
-	return errs.Must(conn[*frauddetector_sdkv1.FraudDetector](ctx, c, names.FraudDetector))
-}
-
 func (c *AWSClient) GameLiftConn(ctx context.Context) *gamelift_sdkv1.GameLift {
 	return errs.Must(conn[*gamelift_sdkv1.GameLift](ctx, c, names.GameLift))
 }
@@ -852,30 +619,14 @@ func (c *AWSClient) GreengrassConn(ctx context.Context) *greengrass_sdkv1.Greeng
 	return errs.Must(conn[*greengrass_sdkv1.Greengrass](ctx, c, names.Greengrass))
 }
 
-func (c *AWSClient) GreengrassV2Conn(ctx context.Context) *greengrassv2_sdkv1.GreengrassV2 {
-	return errs.Must(conn[*greengrassv2_sdkv1.GreengrassV2](ctx, c, names.GreengrassV2))
-}
-
-func (c *AWSClient) GroundStationConn(ctx context.Context) *groundstation_sdkv1.GroundStation {
-	return errs.Must(conn[*groundstation_sdkv1.GroundStation](ctx, c, names.GroundStation))
-}
-
 func (c *AWSClient) GuardDutyConn(ctx context.Context) *guardduty_sdkv1.GuardDuty {
 	return errs.Must(conn[*guardduty_sdkv1.GuardDuty](ctx, c, names.GuardDuty))
 }
 
-func (c *AWSClient) HealthConn(ctx context.Context) *health_sdkv1.Health {
-	return errs.Must(conn[*health_sdkv1.Health](ctx, c, names.Health))
-}
-
 func (c *AWSClient) HealthLakeClient(ctx context.Context) *healthlake_sdkv2.Client {
 	return errs.Must(client[*healthlake_sdkv2.Client](ctx, c, names.HealthLake))
 }
 
-func (c *AWSClient) HoneycodeConn(ctx context.Context) *honeycode_sdkv1.Honeycode {
-	return errs.Must(conn[*honeycode_sdkv1.Honeycode](ctx, c, names.Honeycode))
-}
-
 func (c *AWSClient) IAMConn(ctx context.Context) *iam_sdkv1.IAM {
 	return errs.Must(conn[*iam_sdkv1.IAM](ctx, c, names.IAM))
 }
@@ -904,70 +655,22 @@ func (c *AWSClient) Inspector2Client(ctx context.Context) *inspector2_sdkv2.Clie
 	return errs.Must(client[*inspector2_sdkv2.Client](ctx, c, names.Inspector2))
 }
 
-func (c *AWSClient) InternetMonitorConn(ctx context.Context) *internetmonitor_sdkv1.InternetMonitor {
-	return errs.Must(conn[*internetmonitor_sdkv1.InternetMonitor](ctx, c, names.InternetMonitor))
+func (c *AWSClient) InternetMonitorClient(ctx context.Context) *internetmonitor_sdkv2.Client {
+	return errs.Must(client[*internetmonitor_sdkv2.Client](ctx, c, names.InternetMonitor))
 }
 
 func (c *AWSClient) IoTConn(ctx context.Context) *iot_sdkv1.IoT {
 	return errs.Must(conn[*iot_sdkv1.IoT](ctx, c, names.IoT))
 }
 
-func (c *AWSClient) IoT1ClickDevicesConn(ctx context.Context) *iot1clickdevicesservice_sdkv1.IoT1ClickDevicesService {
-	return errs.Must(conn[*iot1clickdevicesservice_sdkv1.IoT1ClickDevicesService](ctx, c, names.IoT1ClickDevices))
-}
-
-func (c *AWSClient) IoT1ClickProjectsConn(ctx context.Context) *iot1clickprojects_sdkv1.IoT1ClickProjects {
-	return errs.Must(conn[*iot1clickprojects_sdkv1.IoT1ClickProjects](ctx, c, names.IoT1ClickProjects))
-}
-
 func (c *AWSClient) IoTAnalyticsConn(ctx context.Context) *iotanalytics_sdkv1.IoTAnalytics {
 	return errs.Must(conn[*iotanalytics_sdkv1.IoTAnalytics](ctx, c, names.IoTAnalytics))
 }
 
-func (c *AWSClient) IoTDataConn(ctx context.Context) *iotdataplane_sdkv1.IoTDataPlane {
-	return errs.Must(conn[*iotdataplane_sdkv1.IoTDataPlane](ctx, c, names.IoTData))
-}
-
-func (c *AWSClient) IoTDeviceAdvisorConn(ctx context.Context) *iotdeviceadvisor_sdkv1.IoTDeviceAdvisor {
-	return errs.Must(conn[*iotdeviceadvisor_sdkv1.IoTDeviceAdvisor](ctx, c, names.IoTDeviceAdvisor))
-}
-
 func (c *AWSClient) IoTEventsConn(ctx context.Context) *iotevents_sdkv1.IoTEvents {
 	return errs.Must(conn[*iotevents_sdkv1.IoTEvents](ctx, c, names.IoTEvents))
 }
 
-func (c *AWSClient) IoTEventsDataConn(ctx context.Context) *ioteventsdata_sdkv1.IoTEventsData {
-	return errs.Must(conn[*ioteventsdata_sdkv1.IoTEventsData](ctx, c, names.IoTEventsData))
-}
-
-func (c *AWSClient) IoTFleetHubConn(ctx context.Context) *iotfleethub_sdkv1.IoTFleetHub {
-	return errs.Must(conn[*iotfleethub_sdkv1.IoTFleetHub](ctx, c, names.IoTFleetHub))
-}
-
-func (c *AWSClient) IoTJobsDataConn(ctx context.Context) *iotjobsdataplane_sdkv1.IoTJobsDataPlane {
-	return errs.Must(conn[*iotjobsdataplane_sdkv1.IoTJobsDataPlane](ctx, c, names.IoTJobsData))
-}
-
-func (c *AWSClient) IoTSecureTunnelingConn(ctx context.Context) *iotsecuretunneling_sdkv1.IoTSecureTunneling {
-	return errs.Must(conn[*iotsecuretunneling_sdkv1.IoTSecureTunneling](ctx, c, names.IoTSecureTunneling))
-}
-
-func (c *AWSClient) IoTSiteWiseConn(ctx context.Context) *iotsitewise_sdkv1.IoTSiteWise {
-	return errs.Must(conn[*iotsitewise_sdkv1.IoTSiteWise](ctx, c, names.IoTSiteWise))
-}
-
-func (c *AWSClient) IoTThingsGraphConn(ctx context.Context) *iotthingsgraph_sdkv1.IoTThingsGraph {
-	return errs.Must(conn[*iotthingsgraph_sdkv1.IoTThingsGraph](ctx, c, names.IoTThingsGraph))
-}
-
-func (c *AWSClient) IoTTwinMakerConn(ctx context.Context) *iottwinmaker_sdkv1.IoTTwinMaker {
-	return errs.Must(conn[*iottwinmaker_sdkv1.IoTTwinMaker](ctx, c, names.IoTTwinMaker))
-}
-
-func (c *AWSClient) IoTWirelessConn(ctx context.Context) *iotwireless_sdkv1.IoTWireless {
-	return errs.Must(conn[*iotwireless_sdkv1.IoTWireless](ctx, c, names.IoTWireless))
-}
-
 func (c *AWSClient) KMSConn(ctx context.Context) *kms_sdkv1.KMS {
 	return errs.Must(conn[*kms_sdkv1.KMS](ctx, c, names.KMS))
 }
@@ -976,6 +679,10 @@ func (c *AWSClient) KafkaConn(ctx context.Context) *kafka_sdkv1.Kafka {
 	return errs.Must(conn[*kafka_sdkv1.Kafka](ctx, c, names.Kafka))
 }
 
+func (c *AWSClient) KafkaClient(ctx context.Context) *kafka_sdkv2.Client {
+	return errs.Must(client[*kafka_sdkv2.Client](ctx, c, names.Kafka))
+}
+
 func (c *AWSClient) KafkaConnectConn(ctx context.Context) *kafkaconnect_sdkv1.KafkaConnect {
 	return errs.Must(conn[*kafkaconnect_sdkv1.KafkaConnect](ctx, c, names.KafkaConnect))
 }
@@ -984,8 +691,8 @@ func (c *AWSClient) KendraClient(ctx context.Context) *kendra_sdkv2.Client {
 	return errs.Must(client[*kendra_sdkv2.Client](ctx, c, names.Kendra))
 }
 
-func (c *AWSClient) KeyspacesConn(ctx context.Context) *keyspaces_sdkv1.Keyspaces {
-	return errs.Must(conn[*keyspaces_sdkv1.Keyspaces](ctx, c, names.Keyspaces))
+func (c *AWSClient) KeyspacesClient(ctx context.Context) *keyspaces_sdkv2.Client {
+	return errs.Must(client[*keyspaces_sdkv2.Client](ctx, c, names.Keyspaces))
 }
 
 func (c *AWSClient) KinesisConn(ctx context.Context) *kinesis_sdkv1.Kinesis {
@@ -1004,18 +711,6 @@ func (c *AWSClient) KinesisVideoConn(ctx context.Context) *kinesisvideo_sdkv1.Ki
 	return errs.Must(conn[*kinesisvideo_sdkv1.KinesisVideo](ctx, c, names.KinesisVideo))
 }
 
-func (c *AWSClient) KinesisVideoArchivedMediaConn(ctx context.Context) *kinesisvideoarchivedmedia_sdkv1.KinesisVideoArchivedMedia {
-	return errs.Must(conn[*kinesisvideoarchivedmedia_sdkv1.KinesisVideoArchivedMedia](ctx, c, names.KinesisVideoArchivedMedia))
-}
-
-func (c *AWSClient) KinesisVideoMediaConn(ctx context.Context) *kinesisvideomedia_sdkv1.KinesisVideoMedia {
-	return errs.Must(conn[*kinesisvideomedia_sdkv1.KinesisVideoMedia](ctx, c, names.KinesisVideoMedia))
-}
-
-func (c *AWSClient) KinesisVideoSignalingConn(ctx context.Context) *kinesisvideosignalingchannels_sdkv1.KinesisVideoSignalingChannels {
-	return errs.Must(conn[*kinesisvideosignalingchannels_sdkv1.KinesisVideoSignalingChannels](ctx, c, names.KinesisVideoSignaling))
-}
-
 func (c *AWSClient) LakeFormationConn(ctx context.Context) *lakeformation_sdkv1.LakeFormation {
 	return errs.Must(conn[*lakeformation_sdkv1.LakeFormation](ctx, c, names.LakeFormation))
 }
@@ -1032,16 +727,8 @@ func (c *AWSClient) LexModelsConn(ctx context.Context) *lexmodelbuildingservice_
 	return errs.Must(conn[*lexmodelbuildingservice_sdkv1.LexModelBuildingService](ctx, c, names.LexModels))
 }
 
-func (c *AWSClient) LexModelsV2Conn(ctx context.Context) *lexmodelsv2_sdkv1.LexModelsV2 {
-	return errs.Must(conn[*lexmodelsv2_sdkv1.LexModelsV2](ctx, c, names.LexModelsV2))
-}
-
-func (c *AWSClient) LexRuntimeConn(ctx context.Context) *lexruntimeservice_sdkv1.LexRuntimeService {
-	return errs.Must(conn[*lexruntimeservice_sdkv1.LexRuntimeService](ctx, c, names.LexRuntime))
-}
-
-func (c *AWSClient) LexRuntimeV2Conn(ctx context.Context) *lexruntimev2_sdkv1.LexRuntimeV2 {
-	return errs.Must(conn[*lexruntimev2_sdkv1.LexRuntimeV2](ctx, c, names.LexRuntimeV2))
+func (c *AWSClient) LexV2ModelsClient(ctx context.Context) *lexmodelsv2_sdkv2.Client {
+	return errs.Must(client[*lexmodelsv2_sdkv2.Client](ctx, c, names.LexV2Models))
 }
 
 func (c *AWSClient) LicenseManagerConn(ctx context.Context) *licensemanager_sdkv1.LicenseManager {
@@ -1064,64 +751,20 @@ func (c *AWSClient) LogsClient(ctx context.Context) *cloudwatchlogs_sdkv2.Client
 	return errs.Must(client[*cloudwatchlogs_sdkv2.Client](ctx, c, names.Logs))
 }
 
-func (c *AWSClient) LookoutEquipmentConn(ctx context.Context) *lookoutequipment_sdkv1.LookoutEquipment {
-	return errs.Must(conn[*lookoutequipment_sdkv1.LookoutEquipment](ctx, c, names.LookoutEquipment))
-}
-
-func (c *AWSClient) LookoutMetricsConn(ctx context.Context) *lookoutmetrics_sdkv1.LookoutMetrics {
-	return errs.Must(conn[*lookoutmetrics_sdkv1.LookoutMetrics](ctx, c, names.LookoutMetrics))
-}
-
-func (c *AWSClient) LookoutVisionConn(ctx context.Context) *lookoutforvision_sdkv1.LookoutForVision {
-	return errs.Must(conn[*lookoutforvision_sdkv1.LookoutForVision](ctx, c, names.LookoutVision))
-}
-
 func (c *AWSClient) MQConn(ctx context.Context) *mq_sdkv1.MQ {
 	return errs.Must(conn[*mq_sdkv1.MQ](ctx, c, names.MQ))
 }
 
-func (c *AWSClient) MTurkConn(ctx context.Context) *mturk_sdkv1.MTurk {
-	return errs.Must(conn[*mturk_sdkv1.MTurk](ctx, c, names.MTurk))
-}
-
 func (c *AWSClient) MWAAConn(ctx context.Context) *mwaa_sdkv1.MWAA {
 	return errs.Must(conn[*mwaa_sdkv1.MWAA](ctx, c, names.MWAA))
 }
 
-func (c *AWSClient) MachineLearningConn(ctx context.Context) *machinelearning_sdkv1.MachineLearning {
-	return errs.Must(conn[*machinelearning_sdkv1.MachineLearning](ctx, c, names.MachineLearning))
-}
-
-func (c *AWSClient) MacieConn(ctx context.Context) *macie_sdkv1.Macie {
-	return errs.Must(conn[*macie_sdkv1.Macie](ctx, c, names.Macie))
-}
-
 func (c *AWSClient) Macie2Conn(ctx context.Context) *macie2_sdkv1.Macie2 {
 	return errs.Must(conn[*macie2_sdkv1.Macie2](ctx, c, names.Macie2))
 }
 
-func (c *AWSClient) ManagedBlockchainConn(ctx context.Context) *managedblockchain_sdkv1.ManagedBlockchain {
-	return errs.Must(conn[*managedblockchain_sdkv1.ManagedBlockchain](ctx, c, names.ManagedBlockchain))
-}
-
-func (c *AWSClient) MarketplaceCatalogConn(ctx context.Context) *marketplacecatalog_sdkv1.MarketplaceCatalog {
-	return errs.Must(conn[*marketplacecatalog_sdkv1.MarketplaceCatalog](ctx, c, names.MarketplaceCatalog))
-}
-
-func (c *AWSClient) MarketplaceCommerceAnalyticsConn(ctx context.Context) *marketplacecommerceanalytics_sdkv1.MarketplaceCommerceAnalytics {
-	return errs.Must(conn[*marketplacecommerceanalytics_sdkv1.MarketplaceCommerceAnalytics](ctx, c, names.MarketplaceCommerceAnalytics))
-}
-
-func (c *AWSClient) MarketplaceEntitlementConn(ctx context.Context) *marketplaceentitlementservice_sdkv1.MarketplaceEntitlementService {
-	return errs.Must(conn[*marketplaceentitlementservice_sdkv1.MarketplaceEntitlementService](ctx, c, names.MarketplaceEntitlement))
-}
-
-func (c *AWSClient) MarketplaceMeteringConn(ctx context.Context) *marketplacemetering_sdkv1.MarketplaceMetering {
-	return errs.Must(conn[*marketplacemetering_sdkv1.MarketplaceMetering](ctx, c, names.MarketplaceMetering))
-}
-
-func (c *AWSClient) MediaConnectConn(ctx context.Context) *mediaconnect_sdkv1.MediaConnect {
-	return errs.Must(conn[*mediaconnect_sdkv1.MediaConnect](ctx, c, names.MediaConnect))
+func (c *AWSClient) MediaConnectClient(ctx context.Context) *mediaconnect_sdkv2.Client {
+	return errs.Must(client[*mediaconnect_sdkv2.Client](ctx, c, names.MediaConnect))
 }
 
 func (c *AWSClient) MediaConvertConn(ctx context.Context) *mediaconvert_sdkv1.MediaConvert {
@@ -1132,54 +775,18 @@ func (c *AWSClient) MediaLiveClient(ctx context.Context) *medialive_sdkv2.Client
 	return errs.Must(client[*medialive_sdkv2.Client](ctx, c, names.MediaLive))
 }
 
-func (c *AWSClient) MediaPackageConn(ctx context.Context) *mediapackage_sdkv1.MediaPackage {
-	return errs.Must(conn[*mediapackage_sdkv1.MediaPackage](ctx, c, names.MediaPackage))
-}
-
-func (c *AWSClient) MediaPackageVODConn(ctx context.Context) *mediapackagevod_sdkv1.MediaPackageVod {
-	return errs.Must(conn[*mediapackagevod_sdkv1.MediaPackageVod](ctx, c, names.MediaPackageVOD))
+func (c *AWSClient) MediaPackageClient(ctx context.Context) *mediapackage_sdkv2.Client {
+	return errs.Must(client[*mediapackage_sdkv2.Client](ctx, c, names.MediaPackage))
 }
 
 func (c *AWSClient) MediaStoreConn(ctx context.Context) *mediastore_sdkv1.MediaStore {
 	return errs.Must(conn[*mediastore_sdkv1.MediaStore](ctx, c, names.MediaStore))
 }
 
-func (c *AWSClient) MediaStoreDataConn(ctx context.Context) *mediastoredata_sdkv1.MediaStoreData {
-	return errs.Must(conn[*mediastoredata_sdkv1.MediaStoreData](ctx, c, names.MediaStoreData))
-}
-
-func (c *AWSClient) MediaTailorConn(ctx context.Context) *mediatailor_sdkv1.MediaTailor {
-	return errs.Must(conn[*mediatailor_sdkv1.MediaTailor](ctx, c, names.MediaTailor))
-}
-
 func (c *AWSClient) MemoryDBConn(ctx context.Context) *memorydb_sdkv1.MemoryDB {
 	return errs.Must(conn[*memorydb_sdkv1.MemoryDB](ctx, c, names.MemoryDB))
 }
 
-func (c *AWSClient) MgHConn(ctx context.Context) *migrationhub_sdkv1.MigrationHub {
-	return errs.Must(conn[*migrationhub_sdkv1.MigrationHub](ctx, c, names.MgH))
-}
-
-func (c *AWSClient) MgnConn(ctx context.Context) *mgn_sdkv1.Mgn {
-	return errs.Must(conn[*mgn_sdkv1.Mgn](ctx, c, names.Mgn))
-}
-
-func (c *AWSClient) MigrationHubConfigConn(ctx context.Context) *migrationhubconfig_sdkv1.MigrationHubConfig {
-	return errs.Must(conn[*migrationhubconfig_sdkv1.MigrationHubConfig](ctx, c, names.MigrationHubConfig))
-}
-
-func (c *AWSClient) MigrationHubRefactorSpacesConn(ctx context.Context) *migrationhubrefactorspaces_sdkv1.MigrationHubRefactorSpaces {
-	return errs.Must(conn[*migrationhubrefactorspaces_sdkv1.MigrationHubRefactorSpaces](ctx, c, names.MigrationHubRefactorSpaces))
-}
-
-func (c *AWSClient) MigrationHubStrategyConn(ctx context.Context) *migrationhubstrategyrecommendations_sdkv1.MigrationHubStrategyRecommendations {
-	return errs.Must(conn[*migrationhubstrategyrecommendations_sdkv1.MigrationHubStrategyRecommendations](ctx, c, names.MigrationHubStrategy))
-}
-
-func (c *AWSClient) MobileConn(ctx context.Context) *mobile_sdkv1.Mobile {
-	return errs.Must(conn[*mobile_sdkv1.Mobile](ctx, c, names.Mobile))
-}
-
 func (c *AWSClient) NeptuneConn(ctx context.Context) *neptune_sdkv1.Neptune {
 	return errs.Must(conn[*neptune_sdkv1.Neptune](ctx, c, names.Neptune))
 }
@@ -1192,10 +799,6 @@ func (c *AWSClient) NetworkManagerConn(ctx context.Context) *networkmanager_sdkv
 	return errs.Must(conn[*networkmanager_sdkv1.NetworkManager](ctx, c, names.NetworkManager))
 }
 
-func (c *AWSClient) NimbleConn(ctx context.Context) *nimblestudio_sdkv1.NimbleStudio {
-	return errs.Must(conn[*nimblestudio_sdkv1.NimbleStudio](ctx, c, names.Nimble))
-}
-
 func (c *AWSClient) ObservabilityAccessManagerClient(ctx context.Context) *oam_sdkv2.Client {
 	return errs.Must(client[*oam_sdkv2.Client](ctx, c, names.ObservabilityAccessManager))
 }
@@ -1212,10 +815,6 @@ func (c *AWSClient) OpsWorksConn(ctx context.Context) *opsworks_sdkv1.OpsWorks {
 	return errs.Must(conn[*opsworks_sdkv1.OpsWorks](ctx, c, names.OpsWorks))
 }
 
-func (c *AWSClient) OpsWorksCMConn(ctx context.Context) *opsworkscm_sdkv1.OpsWorksCM {
-	return errs.Must(conn[*opsworkscm_sdkv1.OpsWorksCM](ctx, c, names.OpsWorksCM))
-}
-
 func (c *AWSClient) OrganizationsConn(ctx context.Context) *organizations_sdkv1.Organizations {
 	return errs.Must(conn[*organizations_sdkv1.Organizations](ctx, c, names.Organizations))
 }
@@ -1224,60 +823,20 @@ func (c *AWSClient) OutpostsConn(ctx context.Context) *outposts_sdkv1.Outposts {
 	return errs.Must(conn[*outposts_sdkv1.Outposts](ctx, c, names.Outposts))
 }
 
-func (c *AWSClient) PIConn(ctx context.Context) *pi_sdkv1.PI {
-	return errs.Must(conn[*pi_sdkv1.PI](ctx, c, names.PI))
-}
-
-func (c *AWSClient) PanoramaConn(ctx context.Context) *panorama_sdkv1.Panorama {
-	return errs.Must(conn[*panorama_sdkv1.Panorama](ctx, c, names.Panorama))
-}
-
-func (c *AWSClient) PersonalizeConn(ctx context.Context) *personalize_sdkv1.Personalize {
-	return errs.Must(conn[*personalize_sdkv1.Personalize](ctx, c, names.Personalize))
-}
-
-func (c *AWSClient) PersonalizeEventsConn(ctx context.Context) *personalizeevents_sdkv1.PersonalizeEvents {
-	return errs.Must(conn[*personalizeevents_sdkv1.PersonalizeEvents](ctx, c, names.PersonalizeEvents))
-}
-
-func (c *AWSClient) PersonalizeRuntimeConn(ctx context.Context) *personalizeruntime_sdkv1.PersonalizeRuntime {
-	return errs.Must(conn[*personalizeruntime_sdkv1.PersonalizeRuntime](ctx, c, names.PersonalizeRuntime))
-}
-
 func (c *AWSClient) PinpointConn(ctx context.Context) *pinpoint_sdkv1.Pinpoint {
 	return errs.Must(conn[*pinpoint_sdkv1.Pinpoint](ctx, c, names.Pinpoint))
 }
 
-func (c *AWSClient) PinpointEmailConn(ctx context.Context) *pinpointemail_sdkv1.PinpointEmail {
-	return errs.Must(conn[*pinpointemail_sdkv1.PinpointEmail](ctx, c, names.PinpointEmail))
-}
-
-func (c *AWSClient) PinpointSMSVoiceConn(ctx context.Context) *pinpointsmsvoice_sdkv1.PinpointSMSVoice {
-	return errs.Must(conn[*pinpointsmsvoice_sdkv1.PinpointSMSVoice](ctx, c, names.PinpointSMSVoice))
-}
-
 func (c *AWSClient) PipesClient(ctx context.Context) *pipes_sdkv2.Client {
 	return errs.Must(client[*pipes_sdkv2.Client](ctx, c, names.Pipes))
 }
 
-func (c *AWSClient) PollyConn(ctx context.Context) *polly_sdkv1.Polly {
-	return errs.Must(conn[*polly_sdkv1.Polly](ctx, c, names.Polly))
-}
-
-func (c *AWSClient) PricingConn(ctx context.Context) *pricing_sdkv1.Pricing {
-	return errs.Must(conn[*pricing_sdkv1.Pricing](ctx, c, names.Pricing))
+func (c *AWSClient) PricingClient(ctx context.Context) *pricing_sdkv2.Client {
+	return errs.Must(client[*pricing_sdkv2.Client](ctx, c, names.Pricing))
 }
 
-func (c *AWSClient) ProtonConn(ctx context.Context) *proton_sdkv1.Proton {
-	return errs.Must(conn[*proton_sdkv1.Proton](ctx, c, names.Proton))
-}
-
-func (c *AWSClient) QLDBConn(ctx context.Context) *qldb_sdkv1.QLDB {
-	return errs.Must(conn[*qldb_sdkv1.QLDB](ctx, c, names.QLDB))
-}
-
-func (c *AWSClient) QLDBSessionConn(ctx context.Context) *qldbsession_sdkv1.QLDBSession {
-	return errs.Must(conn[*qldbsession_sdkv1.QLDBSession](ctx, c, names.QLDBSession))
+func (c *AWSClient) QLDBClient(ctx context.Context) *qldb_sdkv2.Client {
+	return errs.Must(client[*qldb_sdkv2.Client](ctx, c, names.QLDB))
 }
 
 func (c *AWSClient) QuickSightConn(ctx context.Context) *quicksight_sdkv1.QuickSight {
@@ -1300,10 +859,6 @@ func (c *AWSClient) RDSClient(ctx context.Context) *rds_sdkv2.Client {
 	return errs.Must(client[*rds_sdkv2.Client](ctx, c, names.RDS))
 }
 
-func (c *AWSClient) RDSDataConn(ctx context.Context) *rdsdataservice_sdkv1.RDSDataService {
-	return errs.Must(conn[*rdsdataservice_sdkv1.RDSDataService](ctx, c, names.RDSData))
-}
-
 func (c *AWSClient) RUMConn(ctx context.Context) *cloudwatchrum_sdkv1.CloudWatchRUM {
 	return errs.Must(conn[*cloudwatchrum_sdkv1.CloudWatchRUM](ctx, c, names.RUM))
 }
@@ -1312,36 +867,24 @@ func (c *AWSClient) RedshiftConn(ctx context.Context) *redshift_sdkv1.Redshift {
 	return errs.Must(conn[*redshift_sdkv1.Redshift](ctx, c, names.Redshift))
 }
 
-func (c *AWSClient) RedshiftDataConn(ctx context.Context) *redshiftdataapiservice_sdkv1.RedshiftDataAPIService {
-	return errs.Must(conn[*redshiftdataapiservice_sdkv1.RedshiftDataAPIService](ctx, c, names.RedshiftData))
+func (c *AWSClient) RedshiftDataClient(ctx context.Context) *redshiftdata_sdkv2.Client {
+	return errs.Must(client[*redshiftdata_sdkv2.Client](ctx, c, names.RedshiftData))
 }
 
 func (c *AWSClient) RedshiftServerlessConn(ctx context.Context) *redshiftserverless_sdkv1.RedshiftServerless {
 	return errs.Must(conn[*redshiftserverless_sdkv1.RedshiftServerless](ctx, c, names.RedshiftServerless))
 }
 
-func (c *AWSClient) RekognitionConn(ctx context.Context) *rekognition_sdkv1.Rekognition {
-	return errs.Must(conn[*rekognition_sdkv1.Rekognition](ctx, c, names.Rekognition))
-}
-
-func (c *AWSClient) ResilienceHubConn(ctx context.Context) *resiliencehub_sdkv1.ResilienceHub {
-	return errs.Must(conn[*resiliencehub_sdkv1.ResilienceHub](ctx, c, names.ResilienceHub))
-}
-
 func (c *AWSClient) ResourceExplorer2Client(ctx context.Context) *resourceexplorer2_sdkv2.Client {
 	return errs.Must(client[*resourceexplorer2_sdkv2.Client](ctx, c, names.ResourceExplorer2))
 }
 
-func (c *AWSClient) ResourceGroupsConn(ctx context.Context) *resourcegroups_sdkv1.ResourceGroups {
-	return errs.Must(conn[*resourcegroups_sdkv1.ResourceGroups](ctx, c, names.ResourceGroups))
+func (c *AWSClient) ResourceGroupsClient(ctx context.Context) *resourcegroups_sdkv2.Client {
+	return errs.Must(client[*resourcegroups_sdkv2.Client](ctx, c, names.ResourceGroups))
 }
 
-func (c *AWSClient) ResourceGroupsTaggingAPIConn(ctx context.Context) *resourcegroupstaggingapi_sdkv1.ResourceGroupsTaggingAPI {
-	return errs.Must(conn[*resourcegroupstaggingapi_sdkv1.ResourceGroupsTaggingAPI](ctx, c, names.ResourceGroupsTaggingAPI))
-}
-
-func (c *AWSClient) RoboMakerConn(ctx context.Context) *robomaker_sdkv1.RoboMaker {
-	return errs.Must(conn[*robomaker_sdkv1.RoboMaker](ctx, c, names.RoboMaker))
+func (c *AWSClient) ResourceGroupsTaggingAPIClient(ctx context.Context) *resourcegroupstaggingapi_sdkv2.Client {
+	return errs.Must(client[*resourcegroupstaggingapi_sdkv2.Client](ctx, c, names.ResourceGroupsTaggingAPI))
 }
 
 func (c *AWSClient) RolesAnywhereClient(ctx context.Context) *rolesanywhere_sdkv2.Client {
@@ -1356,10 +899,6 @@ func (c *AWSClient) Route53DomainsClient(ctx context.Context) *route53domains_sd
 	return errs.Must(client[*route53domains_sdkv2.Client](ctx, c, names.Route53Domains))
 }
 
-func (c *AWSClient) Route53RecoveryClusterConn(ctx context.Context) *route53recoverycluster_sdkv1.Route53RecoveryCluster {
-	return errs.Must(conn[*route53recoverycluster_sdkv1.Route53RecoveryCluster](ctx, c, names.Route53RecoveryCluster))
-}
-
 func (c *AWSClient) Route53RecoveryControlConfigConn(ctx context.Context) *route53recoverycontrolconfig_sdkv1.Route53RecoveryControlConfig {
 	return errs.Must(conn[*route53recoverycontrolconfig_sdkv1.Route53RecoveryControlConfig](ctx, c, names.Route53RecoveryControlConfig))
 }
@@ -1376,6 +915,10 @@ func (c *AWSClient) S3Conn(ctx context.Context) *s3_sdkv1.S3 {
 	return errs.Must(conn[*s3_sdkv1.S3](ctx, c, names.S3))
 }
 
+func (c *AWSClient) S3Client(ctx context.Context) *s3_sdkv2.Client {
+	return errs.Must(client[*s3_sdkv2.Client](ctx, c, names.S3))
+}
+
 func (c *AWSClient) S3ControlConn(ctx context.Context) *s3control_sdkv1.S3Control {
 	return errs.Must(conn[*s3control_sdkv1.S3Control](ctx, c, names.S3Control))
 }
@@ -1400,10 +943,6 @@ func (c *AWSClient) SFNConn(ctx context.Context) *sfn_sdkv1.SFN {
 	return errs.Must(conn[*sfn_sdkv1.SFN](ctx, c, names.SFN))
 }
 
-func (c *AWSClient) SMSConn(ctx context.Context) *sms_sdkv1.SMS {
-	return errs.Must(conn[*sms_sdkv1.SMS](ctx, c, names.SMS))
-}
-
 func (c *AWSClient) SNSConn(ctx context.Context) *sns_sdkv1.SNS {
 	return errs.Must(conn[*sns_sdkv1.SNS](ctx, c, names.SNS))
 }
@@ -1428,18 +967,10 @@ func (c *AWSClient) SSMIncidentsClient(ctx context.Context) *ssmincidents_sdkv2.
 	return errs.Must(client[*ssmincidents_sdkv2.Client](ctx, c, names.SSMIncidents))
 }
 
-func (c *AWSClient) SSOConn(ctx context.Context) *sso_sdkv1.SSO {
-	return errs.Must(conn[*sso_sdkv1.SSO](ctx, c, names.SSO))
-}
-
 func (c *AWSClient) SSOAdminConn(ctx context.Context) *ssoadmin_sdkv1.SSOAdmin {
 	return errs.Must(conn[*ssoadmin_sdkv1.SSOAdmin](ctx, c, names.SSOAdmin))
 }
 
-func (c *AWSClient) SSOOIDCConn(ctx context.Context) *ssooidc_sdkv1.SSOOIDC {
-	return errs.Must(conn[*ssooidc_sdkv1.SSOOIDC](ctx, c, names.SSOOIDC))
-}
-
 func (c *AWSClient) STSConn(ctx context.Context) *sts_sdkv1.STS {
 	return errs.Must(conn[*sts_sdkv1.STS](ctx, c, names.STS))
 }
@@ -1452,26 +983,6 @@ func (c *AWSClient) SageMakerConn(ctx context.Context) *sagemaker_sdkv1.SageMake
 	return errs.Must(conn[*sagemaker_sdkv1.SageMaker](ctx, c, names.SageMaker))
 }
 
-func (c *AWSClient) SageMakerA2IRuntimeConn(ctx context.Context) *augmentedairuntime_sdkv1.AugmentedAIRuntime {
-	return errs.Must(conn[*augmentedairuntime_sdkv1.AugmentedAIRuntime](ctx, c, names.SageMakerA2IRuntime))
-}
-
-func (c *AWSClient) SageMakerEdgeConn(ctx context.Context) *sagemakeredgemanager_sdkv1.SagemakerEdgeManager {
-	return errs.Must(conn[*sagemakeredgemanager_sdkv1.SagemakerEdgeManager](ctx, c, names.SageMakerEdge))
-}
-
-func (c *AWSClient) SageMakerFeatureStoreRuntimeConn(ctx context.Context) *sagemakerfeaturestoreruntime_sdkv1.SageMakerFeatureStoreRuntime {
-	return errs.Must(conn[*sagemakerfeaturestoreruntime_sdkv1.SageMakerFeatureStoreRuntime](ctx, c, names.SageMakerFeatureStoreRuntime))
-}
-
-func (c *AWSClient) SageMakerRuntimeConn(ctx context.Context) *sagemakerruntime_sdkv1.SageMakerRuntime {
-	return errs.Must(conn[*sagemakerruntime_sdkv1.SageMakerRuntime](ctx, c, names.SageMakerRuntime))
-}
-
-func (c *AWSClient) SavingsPlansConn(ctx context.Context) *savingsplans_sdkv1.SavingsPlans {
-	return errs.Must(conn[*savingsplans_sdkv1.SavingsPlans](ctx, c, names.SavingsPlans))
-}
-
 func (c *AWSClient) SchedulerClient(ctx context.Context) *scheduler_sdkv2.Client {
 	return errs.Must(client[*scheduler_sdkv2.Client](ctx, c, names.Scheduler))
 }
@@ -1500,84 +1011,52 @@ func (c *AWSClient) ServiceCatalogConn(ctx context.Context) *servicecatalog_sdkv
 	return errs.Must(conn[*servicecatalog_sdkv1.ServiceCatalog](ctx, c, names.ServiceCatalog))
 }
 
-func (c *AWSClient) ServiceCatalogAppRegistryConn(ctx context.Context) *appregistry_sdkv1.AppRegistry {
-	return errs.Must(conn[*appregistry_sdkv1.AppRegistry](ctx, c, names.ServiceCatalogAppRegistry))
-}
-
 func (c *AWSClient) ServiceDiscoveryConn(ctx context.Context) *servicediscovery_sdkv1.ServiceDiscovery {
 	return errs.Must(conn[*servicediscovery_sdkv1.ServiceDiscovery](ctx, c, names.ServiceDiscovery))
 }
 
-func (c *AWSClient) ServiceQuotasConn(ctx context.Context) *servicequotas_sdkv1.ServiceQuotas {
-	return errs.Must(conn[*servicequotas_sdkv1.ServiceQuotas](ctx, c, names.ServiceQuotas))
+func (c *AWSClient) ServiceQuotasClient(ctx context.Context) *servicequotas_sdkv2.Client {
+	return errs.Must(client[*servicequotas_sdkv2.Client](ctx, c, names.ServiceQuotas))
 }
 
 func (c *AWSClient) ShieldConn(ctx context.Context) *shield_sdkv1.Shield {
 	return errs.Must(conn[*shield_sdkv1.Shield](ctx, c, names.Shield))
 }
 
-func (c *AWSClient) SignerConn(ctx context.Context) *signer_sdkv1.Signer {
-	return errs.Must(conn[*signer_sdkv1.Signer](ctx, c, names.Signer))
+func (c *AWSClient) SignerClient(ctx context.Context) *signer_sdkv2.Client {
+	return errs.Must(client[*signer_sdkv2.Client](ctx, c, names.Signer))
 }
 
 func (c *AWSClient) SimpleDBConn(ctx context.Context) *simpledb_sdkv1.SimpleDB {
 	return errs.Must(conn[*simpledb_sdkv1.SimpleDB](ctx, c, names.SimpleDB))
 }
 
-func (c *AWSClient) SnowDeviceManagementConn(ctx context.Context) *snowdevicemanagement_sdkv1.SnowDeviceManagement {
-	return errs.Must(conn[*snowdevicemanagement_sdkv1.SnowDeviceManagement](ctx, c, names.SnowDeviceManagement))
-}
-
-func (c *AWSClient) SnowballConn(ctx context.Context) *snowball_sdkv1.Snowball {
-	return errs.Must(conn[*snowball_sdkv1.Snowball](ctx, c, names.Snowball))
-}
-
 func (c *AWSClient) StorageGatewayConn(ctx context.Context) *storagegateway_sdkv1.StorageGateway {
 	return errs.Must(conn[*storagegateway_sdkv1.StorageGateway](ctx, c, names.StorageGateway))
 }
 
-func (c *AWSClient) SupportConn(ctx context.Context) *support_sdkv1.Support {
-	return errs.Must(conn[*support_sdkv1.Support](ctx, c, names.Support))
-}
-
 func (c *AWSClient) SyntheticsConn(ctx context.Context) *synthetics_sdkv1.Synthetics {
 	return errs.Must(conn[*synthetics_sdkv1.Synthetics](ctx, c, names.Synthetics))
 }
 
-func (c *AWSClient) TextractConn(ctx context.Context) *textract_sdkv1.Textract {
-	return errs.Must(conn[*textract_sdkv1.Textract](ctx, c, names.Textract))
-}
-
-func (c *AWSClient) TimestreamQueryConn(ctx context.Context) *timestreamquery_sdkv1.TimestreamQuery {
-	return errs.Must(conn[*timestreamquery_sdkv1.TimestreamQuery](ctx, c, names.TimestreamQuery))
-}
-
-func (c *AWSClient) TimestreamWriteConn(ctx context.Context) *timestreamwrite_sdkv1.TimestreamWrite {
-	return errs.Must(conn[*timestreamwrite_sdkv1.TimestreamWrite](ctx, c, names.TimestreamWrite))
+func (c *AWSClient) TimestreamWriteClient(ctx context.Context) *timestreamwrite_sdkv2.Client {
+	return errs.Must(client[*timestreamwrite_sdkv2.Client](ctx, c, names.TimestreamWrite))
 }
 
 func (c *AWSClient) TranscribeClient(ctx context.Context) *transcribe_sdkv2.Client {
 	return errs.Must(client[*transcribe_sdkv2.Client](ctx, c, names.Transcribe))
 }
 
-func (c *AWSClient) TranscribeStreamingConn(ctx context.Context) *transcribestreamingservice_sdkv1.TranscribeStreamingService {
-	return errs.Must(conn[*transcribestreamingservice_sdkv1.TranscribeStreamingService](ctx, c, names.TranscribeStreaming))
-}
-
 func (c *AWSClient) TransferConn(ctx context.Context) *transfer_sdkv1.Transfer {
 	return errs.Must(conn[*transfer_sdkv1.Transfer](ctx, c, names.Transfer))
 }
 
-func (c *AWSClient) TranslateConn(ctx context.Context) *translate_sdkv1.Translate {
-	return errs.Must(conn[*translate_sdkv1.Translate](ctx, c, names.Translate))
-}
-
 func (c *AWSClient) VPCLatticeClient(ctx context.Context) *vpclattice_sdkv2.Client {
 	return errs.Must(client[*vpclattice_sdkv2.Client](ctx, c, names.VPCLattice))
 }
 
-func (c *AWSClient) VoiceIDConn(ctx context.Context) *voiceid_sdkv1.VoiceID {
-	return errs.Must(conn[*voiceid_sdkv1.VoiceID](ctx, c, names.VoiceID))
+func (c *AWSClient) VerifiedPermissionsClient(ctx context.Context) *verifiedpermissions_sdkv2.Client {
+	return errs.Must(client[*verifiedpermissions_sdkv2.Client](ctx, c, names.VerifiedPermissions))
 }
 
 func (c *AWSClient) WAFConn(ctx context.Context) *waf_sdkv1.WAF {
@@ -1592,36 +1071,12 @@ func (c *AWSClient) WAFV2Conn(ctx context.Context) *wafv2_sdkv1.WAFV2 {
 	return errs.Must(conn[*wafv2_sdkv1.WAFV2](ctx, c, names.WAFV2))
 }
 
-func (c *AWSClient) WellArchitectedConn(ctx context.Context) *wellarchitected_sdkv1.WellArchitected {
-	return errs.Must(conn[*wellarchitected_sdkv1.WellArchitected](ctx, c, names.WellArchitected))
-}
-
-func (c *AWSClient) WisdomConn(ctx context.Context) *connectwisdomservice_sdkv1.ConnectWisdomService {
-	return errs.Must(conn[*connectwisdomservice_sdkv1.ConnectWisdomService](ctx, c, names.Wisdom))
-}
-
-func (c *AWSClient) WorkDocsConn(ctx context.Context) *workdocs_sdkv1.WorkDocs {
-	return errs.Must(conn[*workdocs_sdkv1.WorkDocs](ctx, c, names.WorkDocs))
-}
-
 func (c *AWSClient) WorkLinkConn(ctx context.Context) *worklink_sdkv1.WorkLink {
 	return errs.Must(conn[*worklink_sdkv1.WorkLink](ctx, c, names.WorkLink))
 }
 
-func (c *AWSClient) WorkMailConn(ctx context.Context) *workmail_sdkv1.WorkMail {
-	return errs.Must(conn[*workmail_sdkv1.WorkMail](ctx, c, names.WorkMail))
-}
-
-func (c *AWSClient) WorkMailMessageFlowConn(ctx context.Context) *workmailmessageflow_sdkv1.WorkMailMessageFlow {
-	return errs.Must(conn[*workmailmessageflow_sdkv1.WorkMailMessageFlow](ctx, c, names.WorkMailMessageFlow))
-}
-
-func (c *AWSClient) WorkSpacesConn(ctx context.Context) *workspaces_sdkv1.WorkSpaces {
-	return errs.Must(conn[*workspaces_sdkv1.WorkSpaces](ctx, c, names.WorkSpaces))
-}
-
-func (c *AWSClient) WorkSpacesWebConn(ctx context.Context) *workspacesweb_sdkv1.WorkSpacesWeb {
-	return errs.Must(conn[*workspacesweb_sdkv1.WorkSpacesWeb](ctx, c, names.WorkSpacesWeb))
+func (c *AWSClient) WorkSpacesClient(ctx context.Context) *workspaces_sdkv2.Client {
+	return errs.Must(client[*workspaces_sdkv2.Client](ctx, c, names.WorkSpaces))
 }
 
 func (c *AWSClient) XRayClient(ctx context.Context) *xray_sdkv2.Client {
diff --git a/internal/conns/awsclient_test.go b/internal/conns/awsclient_test.go
index ea549342d50..176166ba2b3 100644
--- a/internal/conns/awsclient_test.go
+++ b/internal/conns/awsclient_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package conns
 
 import (
diff --git a/internal/conns/config.go b/internal/conns/config.go
index 66ea3f695e3..b376ffacaec 100644
--- a/internal/conns/config.go
+++ b/internal/conns/config.go
@@ -1,16 +1,24 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package conns
 
 import (
 	"context"
-	"log"
+	"fmt"
 
 	aws_sdkv2 "github.com/aws/aws-sdk-go-v2/aws"
 	imds_sdkv2 "github.com/aws/aws-sdk-go-v2/feature/ec2/imds"
 	endpoints_sdkv1 "github.com/aws/aws-sdk-go/aws/endpoints"
 	awsbase "github.com/hashicorp/aws-sdk-go-base/v2"
 	awsbasev1 "github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2"
+	basediag "github.com/hashicorp/aws-sdk-go-base/v2/diag"
+	"github.com/hashicorp/aws-sdk-go-base/v2/logging"
+	basevalidation "github.com/hashicorp/aws-sdk-go-base/v2/validation"
 	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -35,6 +43,7 @@ type Config struct {
 	Region                         string
 	RetryMode                      aws_sdkv2.RetryMode
 	S3UsePathStyle                 bool
+	S3UsEast1RegionalEndpoint      endpoints_sdkv1.S3UsEast1RegionalEndpoint
 	SecretKey                      string
 	SharedConfigFiles              []string
 	SharedCredentialsFiles         []string
@@ -51,17 +60,24 @@ type Config struct {
 
 // ConfigureProvider configures the provided provider Meta (instance data).
 func (c *Config) ConfigureProvider(ctx context.Context, client *AWSClient) (*AWSClient, diag.Diagnostics) {
+	var diags diag.Diagnostics
+
+	ctx, logger := logging.NewTfLogger(ctx)
+
 	awsbaseConfig := awsbase.Config{
 		AccessKey:                     c.AccessKey,
+		AllowedAccountIds:             c.AllowedAccountIds,
 		APNInfo:                       StdUserAgentProducts(c.TerraformVersion),
 		AssumeRoleWithWebIdentity:     c.AssumeRoleWithWebIdentity,
 		CallerDocumentationURL:        "https://registry.terraform.io/providers/hashicorp/aws",
 		CallerName:                    "Terraform AWS Provider",
 		EC2MetadataServiceEnableState: c.EC2MetadataServiceEnableState,
+		ForbiddenAccountIds:           c.ForbiddenAccountIds,
 		IamEndpoint:                   c.Endpoints[names.IAM],
 		Insecure:                      c.Insecure,
 		HTTPClient:                    client.HTTPClient(),
 		HTTPProxy:                     c.HTTPProxy,
+		Logger:                        logger,
 		MaxRetries:                    c.MaxRetries,
 		Profile:                       c.Profile,
 		Region:                        c.Region,
@@ -101,54 +117,69 @@ func (c *Config) ConfigureProvider(ctx context.Context, client *AWSClient) (*AWS
 		awsbaseConfig.StsRegion = c.STSRegion
 	}
 
+	// Avoid duplicate calls to STS by enabling SkipCredsValidation for the call to GetAwsConfig
+	// and then restoring the configured value for the call to GetAwsAccountIDAndPartition.
+	skipCredsValidation := awsbaseConfig.SkipCredsValidation
+	awsbaseConfig.SkipCredsValidation = true
+
 	tflog.Debug(ctx, "Configuring Terraform AWS Provider")
-	ctx, cfg, err := awsbase.GetAwsConfig(ctx, &awsbaseConfig)
-	if err != nil {
-		return nil, diag.Errorf("configuring Terraform AWS Provider: %s", err)
+	ctx, cfg, awsDiags := awsbase.GetAwsConfig(ctx, &awsbaseConfig)
+
+	for _, d := range awsDiags {
+		diags = append(diags, diag.Diagnostic{
+			Severity: baseSeverityToSdkSeverity(d.Severity()),
+			Summary:  d.Summary(),
+			Detail:   d.Detail(),
+		})
+	}
+
+	if diags.HasError() {
+		return nil, diags
 	}
 
 	if !c.SkipRegionValidation {
-		if err := awsbase.ValidateRegion(cfg.Region); err != nil {
-			return nil, diag.FromErr(err)
+		if err := basevalidation.SupportedRegion(cfg.Region); err != nil {
+			return nil, sdkdiag.AppendFromErr(diags, err)
 		}
 	}
 	c.Region = cfg.Region
 
+	awsbaseConfig.SkipCredsValidation = skipCredsValidation
+
 	tflog.Debug(ctx, "Creating AWS SDK v1 session")
-	sess, err := awsbasev1.GetSession(ctx, &cfg, &awsbaseConfig)
-	if err != nil {
-		return nil, diag.Errorf("creating AWS SDK v1 session: %s", err)
+	sess, awsDiags := awsbasev1.GetSession(ctx, &cfg, &awsbaseConfig)
+
+	for _, d := range awsDiags {
+		diags = append(diags, diag.Diagnostic{
+			Severity: baseSeverityToSdkSeverity(d.Severity()),
+			Summary:  fmt.Sprintf("creating AWS SDK v1 session: %s", d.Summary()),
+			Detail:   d.Detail(),
+		})
+	}
+
+	if diags.HasError() {
+		return nil, diags
 	}
 
 	tflog.Debug(ctx, "Retrieving AWS account details")
-	accountID, partition, err := awsbase.GetAwsAccountIDAndPartition(ctx, cfg, &awsbaseConfig)
-	if err != nil {
-		return nil, diag.Errorf("retrieving AWS account details: %s", err)
+	accountID, partition, awsDiags := awsbase.GetAwsAccountIDAndPartition(ctx, cfg, &awsbaseConfig)
+	for _, d := range awsDiags {
+		diags = append(diags, diag.Diagnostic{
+			Severity: baseSeverityToSdkSeverity(d.Severity()),
+			Summary:  fmt.Sprintf("retrieving AWS account details: %s", d.Summary()),
+			Detail:   d.Detail(),
+		})
 	}
 
 	if accountID == "" {
-		// TODO: Make this a Warning Diagnostic
-		log.Println("[WARN] AWS account ID not found for provider. See https://www.terraform.io/docs/providers/aws/index.html#skip_requesting_account_id for implications.")
+		diags = append(diags, errs.NewWarningDiagnostic(
+			"AWS account ID not found for provider",
+			"See https://www.terraform.io/docs/providers/aws/index.html#skip_requesting_account_id for implications."))
 	}
 
-	if len(c.ForbiddenAccountIds) > 0 {
-		for _, forbiddenAccountID := range c.AllowedAccountIds {
-			if accountID == forbiddenAccountID {
-				return nil, diag.Errorf("AWS account ID not allowed: %s", accountID)
-			}
-		}
-	}
-	if len(c.AllowedAccountIds) > 0 {
-		found := false
-		for _, allowedAccountID := range c.AllowedAccountIds {
-			if accountID == allowedAccountID {
-				found = true
-				break
-			}
-		}
-		if !found {
-			return nil, diag.Errorf("AWS account ID not allowed: %s", accountID)
-		}
+	err := awsbaseConfig.VerifyAccountIDAllowed(accountID)
+	if err != nil {
+		return nil, sdkdiag.AppendErrorf(diags, err.Error())
 	}
 
 	DNSSuffix := "amazonaws.com"
@@ -172,8 +203,21 @@ func (c *Config) ConfigureProvider(ctx context.Context, client *AWSClient) (*AWS
 	client.clients = make(map[string]any, 0)
 	client.conns = make(map[string]any, 0)
 	client.endpoints = c.Endpoints
+	client.logger = logger
 	client.s3UsePathStyle = c.S3UsePathStyle
+	client.s3UsEast1RegionalEndpoint = c.S3UsEast1RegionalEndpoint
 	client.stsRegion = c.STSRegion
 
-	return client, nil
+	return client, diags
+}
+
+func baseSeverityToSdkSeverity(s basediag.Severity) diag.Severity {
+	switch s {
+	case basediag.SeverityWarning:
+		return diag.Warning
+	case basediag.SeverityError:
+		return diag.Error
+	default:
+		return -1
+	}
 }
diff --git a/internal/conns/conns.go b/internal/conns/conns.go
index 73c5ca024b5..954266ba7a2 100644
--- a/internal/conns/conns.go
+++ b/internal/conns/conns.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package conns
 
 import (
diff --git a/internal/conns/conns_test.go b/internal/conns/conns_test.go
index 737bdbd1449..17c962cc58f 100644
--- a/internal/conns/conns_test.go
+++ b/internal/conns/conns_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package conns
 
 import (
diff --git a/internal/conns/generate.go b/internal/conns/generate.go
index 2b72f0c765a..201771e6fcc 100644
--- a/internal/conns/generate.go
+++ b/internal/conns/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../generate/awsclient/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
 
diff --git a/internal/conns/mutexkv.go b/internal/conns/mutexkv.go
index c44e909d6b9..2c34d01ba72 100644
--- a/internal/conns/mutexkv.go
+++ b/internal/conns/mutexkv.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package conns
 
 import (
diff --git a/internal/conns/mutexkv_test.go b/internal/conns/mutexkv_test.go
index 986f476224a..6ce02b4b762 100644
--- a/internal/conns/mutexkv_test.go
+++ b/internal/conns/mutexkv_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package conns
 
 import (
diff --git a/internal/create/errors.go b/internal/create/errors.go
index 001a907638a..805dbd5cd0e 100644
--- a/internal/create/errors.go
+++ b/internal/create/errors.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package create
 
 import (
@@ -49,14 +52,24 @@ func Error(service, action, resource, id string, gotError error) error {
 	return errors.New(ProblemStandardMessage(service, action, resource, id, gotError))
 }
 
+// AddError returns diag.Diagnostics with an additional diag.Diagnostic containing
+// an error using a standardized problem message
+func AddError(diags diag.Diagnostics, service, action, resource, id string, gotError error) diag.Diagnostics {
+	return append(diags, newError(service, action, resource, id, gotError))
+}
+
 // DiagError returns a 1-length diag.Diagnostics with a diag.Error-level diag.Diagnostic
 // with a standardized error message
 func DiagError(service, action, resource, id string, gotError error) diag.Diagnostics {
 	return diag.Diagnostics{
-		diag.Diagnostic{
-			Severity: diag.Error,
-			Summary:  ProblemStandardMessage(service, action, resource, id, gotError),
-		},
+		newError(service, action, resource, id, gotError),
+	}
+}
+
+func newError(service, action, resource, id string, gotError error) diag.Diagnostic {
+	return diag.Diagnostic{
+		Severity: diag.Error,
+		Summary:  ProblemStandardMessage(service, action, resource, id, gotError),
 	}
 }
 
@@ -99,6 +112,15 @@ func AddWarning(diags diag.Diagnostics, service, action, resource, id string, go
 	)
 }
 
+func AddWarningMessage(diags diag.Diagnostics, service, action, resource, id, message string) diag.Diagnostics {
+	return append(diags,
+		diag.Diagnostic{
+			Severity: diag.Warning,
+			Summary:  ProblemStandardMessage(service, action, resource, id, fmt.Errorf(message)),
+		},
+	)
+}
+
 // AddWarningNotFoundRemoveState returns diag.Diagnostics with an additional diag.Diagnostic containing
 // a warning using a standardized problem message
 func AddWarningNotFoundRemoveState(service, action, resource, id string) diag.Diagnostics {
diff --git a/internal/create/hashcode.go b/internal/create/hashcode.go
index d4f77ac136c..d2d7a4f00c9 100644
--- a/internal/create/hashcode.go
+++ b/internal/create/hashcode.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package create
 
 import (
diff --git a/internal/create/hashcode_test.go b/internal/create/hashcode_test.go
index eee0bbd9ca9..f73bc61bace 100644
--- a/internal/create/hashcode_test.go
+++ b/internal/create/hashcode_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package create
 
 import (
diff --git a/internal/create/naming.go b/internal/create/naming.go
index 007c4ac6e13..e36dfd9d392 100644
--- a/internal/create/naming.go
+++ b/internal/create/naming.go
@@ -1,34 +1,23 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package create
 
 import (
 	"fmt"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 )
 
 // Name returns in order the name if non-empty, a prefix generated name if non-empty, or fully generated name prefixed with terraform-
 func Name(name string, namePrefix string) string {
-	return NameWithSuffix(name, namePrefix, "")
-}
-
-// NameWithSuffix returns in order the name if non-empty, a prefix generated name if non-empty, or fully generated name prefixed with "terraform-".
-// In the latter two cases, any suffix is appended to the generated name
-func NameWithSuffix(name string, namePrefix string, nameSuffix string) string {
-	if name != "" {
-		return name
-	}
-
-	if namePrefix != "" {
-		return id.PrefixedUniqueId(namePrefix) + nameSuffix
-	}
-
-	return id.UniqueId() + nameSuffix
+	return NewNameGenerator(WithConfiguredName(name), WithConfiguredPrefix(namePrefix)).Generate()
 }
 
 // hasResourceUniqueIDPlusAdditionalSuffix returns true if the string has the built-in unique ID suffix plus an additional suffix
 func hasResourceUniqueIDPlusAdditionalSuffix(s string, additionalSuffix string) bool {
-	re := regexp.MustCompile(fmt.Sprintf("[[:xdigit:]]{%d}%s$", id.UniqueIDSuffixLength, additionalSuffix))
+	re := regexache.MustCompile(fmt.Sprintf("[[:xdigit:]]{%d}%s$", id.UniqueIDSuffixLength, additionalSuffix))
 	return re.MatchString(s)
 }
 
@@ -59,3 +48,71 @@ func NamePrefixFromNameWithSuffix(name, nameSuffix string) *string {
 
 	return &namePrefix
 }
+
+type nameGenerator struct {
+	configuredName   string
+	configuredPrefix string
+	defaultPrefix    string
+	suffix           string
+}
+
+// nameGeneratorOptionsFunc is a type alias for a name generator functional option.
+type NameGeneratorOptionsFunc func(*nameGenerator)
+
+// WithConfiguredName is a helper function to construct functional options
+// that set a name generator's configured name value.
+// An empty ("") configured name inidicates that no name was configured.
+func WithConfiguredName(name string) NameGeneratorOptionsFunc {
+	return func(g *nameGenerator) {
+		g.configuredName = name
+	}
+}
+
+// WithConfiguredPrefix is a helper function to construct functional options
+// that set a name generator's configured prefix value.
+// An empty ("") configured prefix inidicates that no prefix was configured.
+func WithConfiguredPrefix(prefix string) NameGeneratorOptionsFunc {
+	return func(g *nameGenerator) {
+		g.configuredPrefix = prefix
+	}
+}
+
+// WithDefaultPrefix is a helper function to construct functional options
+// that set a name generator's default prefix value.
+func WithDefaultPrefix(prefix string) NameGeneratorOptionsFunc {
+	return func(g *nameGenerator) {
+		g.defaultPrefix = prefix
+	}
+}
+
+// WithSuffix is a helper function to construct functional options
+// that set a name generator's suffix value.
+func WithSuffix(suffix string) NameGeneratorOptionsFunc {
+	return func(g *nameGenerator) {
+		g.suffix = suffix
+	}
+}
+
+// NewNameGenerator returns a new name generator from the specified varidaic list of functional options.
+func NewNameGenerator(optFns ...NameGeneratorOptionsFunc) *nameGenerator {
+	g := &nameGenerator{defaultPrefix: id.UniqueIdPrefix}
+
+	for _, optFn := range optFns {
+		optFn(g)
+	}
+
+	return g
+}
+
+// Generate generates a new name.
+func (g *nameGenerator) Generate() string {
+	if g.configuredName != "" {
+		return g.configuredName
+	}
+
+	prefix := g.defaultPrefix
+	if g.configuredPrefix != "" {
+		prefix = g.configuredPrefix
+	}
+	return id.PrefixedUniqueId(prefix) + g.suffix
+}
diff --git a/internal/create/naming_test.go b/internal/create/naming_test.go
index 95c0c8eef8e..d671b5020cf 100644
--- a/internal/create/naming_test.go
+++ b/internal/create/naming_test.go
@@ -1,13 +1,185 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package create
 
 import (
+	"fmt"
+	"regexp"
 	"testing"
+
+	"github.com/YakDriver/regexache"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 )
 
 func strPtr(str string) *string {
 	return &str
 }
 
+func nameWithSuffix(name string, namePrefix string, nameSuffix string) string {
+	return NewNameGenerator(WithConfiguredName(name), WithConfiguredPrefix(namePrefix), WithSuffix(nameSuffix)).Generate()
+}
+
+func TestName(t *testing.T) {
+	t.Parallel()
+
+	testCases := []struct {
+		testName         string
+		configuredName   string
+		configuredPrefix string
+		expectedRegexp   *regexp.Regexp
+	}{
+		{
+			testName:       "no configured name or prefix",
+			expectedRegexp: regexache.MustCompile(fmt.Sprintf("^terraform-[[:xdigit:]]{%d}$", id.UniqueIDSuffixLength)),
+		},
+		{
+			testName:       "configured name only",
+			configuredName: "testing",
+			expectedRegexp: regexache.MustCompile(`^testing$`),
+		},
+		{
+			testName:         "configured prefix only",
+			configuredPrefix: "pfx-",
+			expectedRegexp:   regexache.MustCompile(fmt.Sprintf("^pfx-[[:xdigit:]]{%d}$", id.UniqueIDSuffixLength)),
+		},
+		{
+			testName:         "configured name and prefix",
+			configuredName:   "testing",
+			configuredPrefix: "pfx-",
+			expectedRegexp:   regexache.MustCompile(`^testing$`),
+		},
+	}
+
+	for _, testCase := range testCases {
+		testCase := testCase
+		t.Run(testCase.testName, func(t *testing.T) {
+			t.Parallel()
+
+			got := Name(testCase.configuredName, testCase.configuredPrefix)
+
+			if !testCase.expectedRegexp.MatchString(got) {
+				t.Errorf("Name(%q, %q) = %v, does not match %s", testCase.configuredName, testCase.configuredPrefix, got, testCase.expectedRegexp)
+			}
+		})
+	}
+}
+
+func TestNameWithSuffix(t *testing.T) {
+	t.Parallel()
+
+	testCases := []struct {
+		testName         string
+		configuredName   string
+		configuredPrefix string
+		suffix           string
+		expectedRegexp   *regexp.Regexp
+	}{
+		{
+			testName:       "no configured name or prefix, no suffix",
+			expectedRegexp: regexache.MustCompile(fmt.Sprintf("^terraform-[[:xdigit:]]{%d}$", id.UniqueIDSuffixLength)),
+		},
+		{
+			testName:       "configured name only, no suffix",
+			configuredName: "testing",
+			expectedRegexp: regexache.MustCompile(`^testing$`),
+		},
+		{
+			testName:         "configured prefix only, no suffix",
+			configuredPrefix: "pfx-",
+			expectedRegexp:   regexache.MustCompile(fmt.Sprintf("^pfx-[[:xdigit:]]{%d}$", id.UniqueIDSuffixLength)),
+		},
+		{
+			testName:         "configured name and prefix, no suffix",
+			configuredName:   "testing",
+			configuredPrefix: "pfx-",
+			expectedRegexp:   regexache.MustCompile(`^testing$`),
+		},
+		{
+			testName:       "no configured name or prefix, with suffix",
+			expectedRegexp: regexache.MustCompile(fmt.Sprintf("^terraform-[[:xdigit:]]{%d}-sfx$", id.UniqueIDSuffixLength)),
+			suffix:         "-sfx",
+		},
+		{
+			testName:       "configured name only, with suffix",
+			configuredName: "testing",
+			expectedRegexp: regexache.MustCompile(`^testing$`),
+			suffix:         "-sfx",
+		},
+		{
+			testName:         "configured prefix only, with suffix",
+			configuredPrefix: "pfx-",
+			expectedRegexp:   regexache.MustCompile(fmt.Sprintf("^pfx-[[:xdigit:]]{%d}-sfx$", id.UniqueIDSuffixLength)),
+			suffix:           "-sfx",
+		},
+		{
+			testName:         "configured name and prefix, with suffix",
+			configuredName:   "testing",
+			configuredPrefix: "pfx-",
+			expectedRegexp:   regexache.MustCompile(`^testing$`),
+			suffix:           "-sfx",
+		},
+	}
+
+	for _, testCase := range testCases {
+		testCase := testCase
+		t.Run(testCase.testName, func(t *testing.T) {
+			t.Parallel()
+
+			got := nameWithSuffix(testCase.configuredName, testCase.configuredPrefix, testCase.suffix)
+
+			if !testCase.expectedRegexp.MatchString(got) {
+				t.Errorf("NameWithSuffix(%q, %q, %q) = %v, does not match %s", testCase.configuredName, testCase.configuredPrefix, testCase.suffix, got, testCase.expectedRegexp)
+			}
+		})
+	}
+}
+
+func TestNameWithDefaultPrefix(t *testing.T) {
+	t.Parallel()
+
+	testCases := []struct {
+		testName         string
+		configuredName   string
+		configuredPrefix string
+		expectedRegexp   *regexp.Regexp
+	}{
+		{
+			testName:       "no configured name or prefix",
+			expectedRegexp: regexache.MustCompile(fmt.Sprintf("^def-[[:xdigit:]]{%d}$", id.UniqueIDSuffixLength)),
+		},
+		{
+			testName:       "configured name only",
+			configuredName: "testing",
+			expectedRegexp: regexache.MustCompile(`^testing$`),
+		},
+		{
+			testName:         "configured prefix only",
+			configuredPrefix: "pfx-",
+			expectedRegexp:   regexache.MustCompile(fmt.Sprintf("^pfx-[[:xdigit:]]{%d}$", id.UniqueIDSuffixLength)),
+		},
+		{
+			testName:         "configured name and prefix",
+			configuredName:   "testing",
+			configuredPrefix: "pfx-",
+			expectedRegexp:   regexache.MustCompile(`^testing$`),
+		},
+	}
+
+	for _, testCase := range testCases {
+		testCase := testCase
+		t.Run(testCase.testName, func(t *testing.T) {
+			t.Parallel()
+
+			got := NewNameGenerator(WithConfiguredName(testCase.configuredName), WithConfiguredPrefix(testCase.configuredPrefix), WithDefaultPrefix("def-")).Generate()
+
+			if !testCase.expectedRegexp.MatchString(got) {
+				t.Errorf("NameWithDefaultPrefix(%q, %q) = %v, does not match %s", testCase.configuredName, testCase.configuredPrefix, got, testCase.expectedRegexp)
+			}
+		})
+	}
+}
+
 func TestHasResourceUniqueIDPlusAdditionalSuffix(t *testing.T) {
 	t.Parallel()
 
@@ -237,7 +409,7 @@ func TestNamePrefixFromNameWithSuffix(t *testing.T) {
 
 		for i := 0; i < 10; i++ {
 			prefix := "test-"
-			input := NameWithSuffix("", prefix, "suffix")
+			input := nameWithSuffix("", prefix, "suffix")
 			got := NamePrefixFromNameWithSuffix(input, "suffix")
 
 			if got == nil {
diff --git a/internal/enum/validate.go b/internal/enum/validate.go
index 4becca3521e..3005198c9fb 100644
--- a/internal/enum/validate.go
+++ b/internal/enum/validate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package enum
 
 import (
diff --git a/internal/enum/values.go b/internal/enum/values.go
index af8047be1d5..8d056b3d7ed 100644
--- a/internal/enum/values.go
+++ b/internal/enum/values.go
@@ -1,5 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package enum
 
+import (
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema/defaults"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema/stringdefault"
+)
+
 type valueser[T ~string] interface {
 	~string
 	Values() []T
@@ -19,3 +27,7 @@ func Slice[T valueser[T]](l ...T) []string {
 
 	return result
 }
+
+func FrameworkDefault[T ~string](t T) defaults.String {
+	return stringdefault.StaticString(string(t))
+}
diff --git a/internal/envvar/envvar.go b/internal/envvar/envvar.go
index 52bdff09016..3eec0181d5a 100644
--- a/internal/envvar/envvar.go
+++ b/internal/envvar/envvar.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package envvar
 
 import (
diff --git a/internal/envvar/envvar_test.go b/internal/envvar/envvar_test.go
index 1f7387625eb..2b31d8469c6 100644
--- a/internal/envvar/envvar_test.go
+++ b/internal/envvar/envvar_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package envvar
 
 import (
diff --git a/internal/errs/diag.go b/internal/errs/diag.go
index 98b7c85766e..7faf6b596c5 100644
--- a/internal/errs/diag.go
+++ b/internal/errs/diag.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package errs
 
 import (
diff --git a/internal/errs/errs.go b/internal/errs/errs.go
index 439817e634d..ffdc39a798e 100644
--- a/internal/errs/errs.go
+++ b/internal/errs/errs.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package errs
 
 import (
diff --git a/internal/errs/errs_test.go b/internal/errs/errs_test.go
index cef5969f82a..6b7d35ef3ed 100644
--- a/internal/errs/errs_test.go
+++ b/internal/errs/errs_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package errs_test
 
 import (
diff --git a/internal/errs/fwdiag/diags.go b/internal/errs/fwdiag/diags.go
index 9c6ed9f4f9b..31355f934f8 100644
--- a/internal/errs/fwdiag/diags.go
+++ b/internal/errs/fwdiag/diags.go
@@ -1,24 +1,24 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package fwdiag
 
 import (
 	"errors"
 	"fmt"
 
-	multierror "github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform-plugin-framework/diag"
 )
 
 // DiagnosticsError returns an error containing all Diagnostic with SeverityError
-func DiagnosticsError(diags diag.Diagnostics) (errs error) {
-	if !diags.HasError() {
-		return
-	}
+func DiagnosticsError(diags diag.Diagnostics) error {
+	var errs []error
 
 	for _, d := range diags.Errors() {
-		errs = multierror.Append(errs, errors.New(DiagnosticString(d)))
+		errs = append(errs, errors.New(DiagnosticString(d)))
 	}
 
-	return
+	return errors.Join(errs...)
 }
 
 // DiagnosticString formats a Diagnostic
diff --git a/internal/errs/fwdiag/diags_test.go b/internal/errs/fwdiag/diags_test.go
new file mode 100644
index 00000000000..cf823b704df
--- /dev/null
+++ b/internal/errs/fwdiag/diags_test.go
@@ -0,0 +1,71 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package fwdiag_test
+
+import (
+	"testing"
+
+	"github.com/hashicorp/terraform-plugin-framework/diag"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs/fwdiag"
+)
+
+func TestDiagnosticsError(t *testing.T) {
+	t.Parallel()
+
+	testCases := []struct {
+		testName string
+		diags    diag.Diagnostics
+		wantErr  bool
+	}{
+		{
+			testName: "nil Diagnostics",
+		},
+		{
+			testName: "single warning Diagnostics",
+			diags:    diag.Diagnostics{diag.NewWarningDiagnostic("summary", "detail")},
+		},
+		{
+			testName: "single error Diagnostics",
+			diags:    diag.Diagnostics{diag.NewErrorDiagnostic("summary", "detail")},
+			wantErr:  true,
+		},
+		{
+			testName: "mixed warning and error Diagnostics",
+			diags: diag.Diagnostics{
+				diag.NewWarningDiagnostic("summary1", "detail1"),
+				diag.NewErrorDiagnostic("summary2", "detail2"),
+			},
+			wantErr: true,
+		},
+		{
+			testName: "multiple error Diagnostics",
+			diags: diag.Diagnostics{
+				diag.NewErrorDiagnostic("summary1", "detail1"),
+				diag.NewErrorDiagnostic("summary2", "detail2"),
+			},
+			wantErr: true,
+		},
+		{
+			testName: "multiple warning Diagnostics",
+			diags: diag.Diagnostics{
+				diag.NewWarningDiagnostic("summary1", "detail1"),
+				diag.NewWarningDiagnostic("summary2", "detail2"),
+			},
+		},
+	}
+
+	for _, testCase := range testCases {
+		testCase := testCase
+		t.Run(testCase.testName, func(t *testing.T) {
+			t.Parallel()
+
+			err := fwdiag.DiagnosticsError(testCase.diags)
+			gotErr := err != nil
+
+			if gotErr != testCase.wantErr {
+				t.Errorf("gotErr = %v, wantErr = %v", gotErr, testCase.wantErr)
+			}
+		})
+	}
+}
diff --git a/internal/errs/fwdiag/must.go b/internal/errs/fwdiag/must.go
index e819337e035..65d5b743692 100644
--- a/internal/errs/fwdiag/must.go
+++ b/internal/errs/fwdiag/must.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package fwdiag
 
 import (
diff --git a/internal/errs/must.go b/internal/errs/must.go
index 0d3d4dea120..d5b92d4e9ad 100644
--- a/internal/errs/must.go
+++ b/internal/errs/must.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package errs
 
 // Must is a generic implementation of the Go Must idiom [1, 2]. It panics if
diff --git a/internal/errs/sdkdiag/append.go b/internal/errs/sdkdiag/append.go
index c2f77996a9b..56aabc3095b 100644
--- a/internal/errs/sdkdiag/append.go
+++ b/internal/errs/sdkdiag/append.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sdkdiag
 
 import (
@@ -15,14 +18,14 @@ func AppendWarningf(diags diag.Diagnostics, format string, a ...any) diag.Diagno
 }
 
 func AppendErrorf(diags diag.Diagnostics, format string, a ...any) diag.Diagnostics {
-	return append(diags, diag.Errorf(format, a...)...)
+	return append(diags, diag.Errorf(format, a...)...) // nosemgrep:ci.semgrep.pluginsdk.avoid-diag_Errorf
 }
 
 func AppendFromErr(diags diag.Diagnostics, err error) diag.Diagnostics {
 	if err == nil {
 		return diags
 	}
-	return append(diags, diag.FromErr(err)...)
+	return append(diags, diag.FromErr(err)...) // nosemgrep:ci.semgrep.pluginsdk.avoid-diag_FromErr
 }
 
 func WrapDiagsf(orig diag.Diagnostics, format string, a ...any) diag.Diagnostics {
diff --git a/internal/errs/sdkdiag/diags.go b/internal/errs/sdkdiag/diags.go
index ebb673c331f..960786686d2 100644
--- a/internal/errs/sdkdiag/diags.go
+++ b/internal/errs/sdkdiag/diags.go
@@ -1,10 +1,12 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sdkdiag
 
 import (
 	"errors"
 	"fmt"
 
-	multierror "github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	tfslices "github.com/hashicorp/terraform-provider-aws/internal/slices"
 )
@@ -21,23 +23,21 @@ func Warnings(diags diag.Diagnostics) diag.Diagnostics {
 	return tfslices.Filter(diags, severityFilter(diag.Warning))
 }
 
-func severityFilter(s diag.Severity) tfslices.FilterFunc[diag.Diagnostic] {
+func severityFilter(s diag.Severity) tfslices.Predicate[diag.Diagnostic] {
 	return func(d diag.Diagnostic) bool {
 		return d.Severity == s
 	}
 }
 
 // DiagnosticsError returns an error containing all Diagnostic with SeverityError
-func DiagnosticsError(diags diag.Diagnostics) (errs error) {
-	if !diags.HasError() {
-		return
-	}
+func DiagnosticsError(diags diag.Diagnostics) error {
+	var errs []error
 
 	for _, d := range Errors(diags) {
-		errs = multierror.Append(errs, errors.New(DiagnosticString(d)))
+		errs = append(errs, errors.New(DiagnosticString(d)))
 	}
 
-	return
+	return errors.Join(errs...)
 }
 
 // DiagnosticString formats a Diagnostic
diff --git a/internal/errs/sdkdiag/diags_test.go b/internal/errs/sdkdiag/diags_test.go
new file mode 100644
index 00000000000..6c60474ca13
--- /dev/null
+++ b/internal/errs/sdkdiag/diags_test.go
@@ -0,0 +1,189 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package sdkdiag_test
+
+import (
+	"testing"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
+)
+
+func TestErrors(t *testing.T) {
+	t.Parallel()
+
+	testCases := []struct {
+		testName string
+		diags    diag.Diagnostics
+		want     int
+	}{
+		{
+			testName: "nil Diagnostics",
+		},
+		{
+			testName: "single warning Diagnostics",
+			diags:    diag.Diagnostics{diag.Diagnostic{Severity: diag.Warning, Summary: "summary", Detail: "detail"}},
+		},
+		{
+			testName: "single error Diagnostics",
+			diags:    diag.Diagnostics{diag.Diagnostic{Severity: diag.Error, Summary: "summary", Detail: "detail"}},
+			want:     1,
+		},
+		{
+			testName: "mixed warning and error Diagnostics",
+			diags: diag.Diagnostics{
+				diag.Diagnostic{Severity: diag.Warning, Summary: "summary1", Detail: "detail1"},
+				diag.Diagnostic{Severity: diag.Error, Summary: "summary2", Detail: "detail2"},
+			},
+			want: 1,
+		},
+		{
+			testName: "multiple error Diagnostics",
+			diags: diag.Diagnostics{
+				diag.Diagnostic{Severity: diag.Error, Summary: "summary1", Detail: "detail1"},
+				diag.Diagnostic{Severity: diag.Error, Summary: "summary2", Detail: "detail2"},
+			},
+			want: 2,
+		},
+		{
+			testName: "multiple warning Diagnostics",
+			diags: diag.Diagnostics{
+				diag.Diagnostic{Severity: diag.Warning, Summary: "summary1", Detail: "detail1"},
+				diag.Diagnostic{Severity: diag.Warning, Summary: "summary2", Detail: "detail2"},
+			},
+		},
+	}
+
+	for _, testCase := range testCases {
+		testCase := testCase
+		t.Run(testCase.testName, func(t *testing.T) {
+			t.Parallel()
+
+			output := sdkdiag.Errors(testCase.diags)
+
+			if got, want := len(output), testCase.want; got != want {
+				t.Errorf("Errors = %v, want %v", got, want)
+			}
+		})
+	}
+}
+
+func TestWarnings(t *testing.T) {
+	t.Parallel()
+
+	testCases := []struct {
+		testName string
+		diags    diag.Diagnostics
+		want     int
+	}{
+		{
+			testName: "nil Diagnostics",
+		},
+		{
+			testName: "single warning Diagnostics",
+			diags:    diag.Diagnostics{diag.Diagnostic{Severity: diag.Warning, Summary: "summary", Detail: "detail"}},
+			want:     1,
+		},
+		{
+			testName: "single error Diagnostics",
+			diags:    diag.Diagnostics{diag.Diagnostic{Severity: diag.Error, Summary: "summary", Detail: "detail"}},
+		},
+		{
+			testName: "mixed warning and error Diagnostics",
+			diags: diag.Diagnostics{
+				diag.Diagnostic{Severity: diag.Warning, Summary: "summary1", Detail: "detail1"},
+				diag.Diagnostic{Severity: diag.Error, Summary: "summary2", Detail: "detail2"},
+			},
+			want: 1,
+		},
+		{
+			testName: "multiple error Diagnostics",
+			diags: diag.Diagnostics{
+				diag.Diagnostic{Severity: diag.Error, Summary: "summary1", Detail: "detail1"},
+				diag.Diagnostic{Severity: diag.Error, Summary: "summary2", Detail: "detail2"},
+			},
+		},
+		{
+			testName: "multiple warning Diagnostics",
+			diags: diag.Diagnostics{
+				diag.Diagnostic{Severity: diag.Warning, Summary: "summary1", Detail: "detail1"},
+				diag.Diagnostic{Severity: diag.Warning, Summary: "summary2", Detail: "detail2"},
+			},
+			want: 2,
+		},
+	}
+
+	for _, testCase := range testCases {
+		testCase := testCase
+		t.Run(testCase.testName, func(t *testing.T) {
+			t.Parallel()
+
+			output := sdkdiag.Warnings(testCase.diags)
+
+			if got, want := len(output), testCase.want; got != want {
+				t.Errorf("Warnings = %v, want %v", got, want)
+			}
+		})
+	}
+}
+
+func TestDiagnosticsError(t *testing.T) {
+	t.Parallel()
+
+	testCases := []struct {
+		testName string
+		diags    diag.Diagnostics
+		wantErr  bool
+	}{
+		{
+			testName: "nil Diagnostics",
+		},
+		{
+			testName: "single warning Diagnostics",
+			diags:    diag.Diagnostics{diag.Diagnostic{Severity: diag.Warning, Summary: "summary", Detail: "detail"}},
+		},
+		{
+			testName: "single error Diagnostics",
+			diags:    diag.Diagnostics{diag.Diagnostic{Severity: diag.Error, Summary: "summary", Detail: "detail"}},
+			wantErr:  true,
+		},
+		{
+			testName: "mixed warning and error Diagnostics",
+			diags: diag.Diagnostics{
+				diag.Diagnostic{Severity: diag.Warning, Summary: "summary1", Detail: "detail1"},
+				diag.Diagnostic{Severity: diag.Error, Summary: "summary2", Detail: "detail2"},
+			},
+			wantErr: true,
+		},
+		{
+			testName: "multiple error Diagnostics",
+			diags: diag.Diagnostics{
+				diag.Diagnostic{Severity: diag.Error, Summary: "summary1", Detail: "detail1"},
+				diag.Diagnostic{Severity: diag.Error, Summary: "summary2", Detail: "detail2"},
+			},
+			wantErr: true,
+		},
+		{
+			testName: "multiple warning Diagnostics",
+			diags: diag.Diagnostics{
+				diag.Diagnostic{Severity: diag.Warning, Summary: "summary1", Detail: "detail1"},
+				diag.Diagnostic{Severity: diag.Warning, Summary: "summary2", Detail: "detail2"},
+			},
+		},
+	}
+
+	for _, testCase := range testCases {
+		testCase := testCase
+		t.Run(testCase.testName, func(t *testing.T) {
+			t.Parallel()
+
+			err := sdkdiag.DiagnosticsError(testCase.diags)
+			gotErr := err != nil
+
+			if gotErr != testCase.wantErr {
+				t.Errorf("gotErr = %v, wantErr = %v", gotErr, testCase.wantErr)
+			}
+		})
+	}
+}
diff --git a/internal/errs/sdkdiag/must.go b/internal/errs/sdkdiag/must.go
index b94c5ef7f9f..6f780d2f410 100644
--- a/internal/errs/sdkdiag/must.go
+++ b/internal/errs/sdkdiag/must.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sdkdiag
 
 import (
diff --git a/internal/errs/unsupported.go b/internal/errs/unsupported.go
index d5eab1b4066..f8f8823211d 100644
--- a/internal/errs/unsupported.go
+++ b/internal/errs/unsupported.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package errs
 
 import (
diff --git a/internal/experimental/depgraph/dependency_graph.go b/internal/experimental/depgraph/dependency_graph.go
index 8f52bb56f1d..b4a5bfd291b 100644
--- a/internal/experimental/depgraph/dependency_graph.go
+++ b/internal/experimental/depgraph/dependency_graph.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package depgraph
 
 import (
diff --git a/internal/experimental/depgraph/dependency_graph_test.go b/internal/experimental/depgraph/dependency_graph_test.go
index 148c483eb37..51543f8a9df 100644
--- a/internal/experimental/depgraph/dependency_graph_test.go
+++ b/internal/experimental/depgraph/dependency_graph_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package depgraph
 
 import (
diff --git a/internal/experimental/depgraph/stack.go b/internal/experimental/depgraph/stack.go
index 1f414b08f0b..05095542460 100644
--- a/internal/experimental/depgraph/stack.go
+++ b/internal/experimental/depgraph/stack.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package depgraph
 
 type stack struct {
diff --git a/internal/experimental/depgraph/stack_test.go b/internal/experimental/depgraph/stack_test.go
index 655e217bc96..7bf653e9db4 100644
--- a/internal/experimental/depgraph/stack_test.go
+++ b/internal/experimental/depgraph/stack_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package depgraph
 
 import (
diff --git a/internal/experimental/nullable/bool.go b/internal/experimental/nullable/bool.go
deleted file mode 100644
index 6726f336be6..00000000000
--- a/internal/experimental/nullable/bool.go
+++ /dev/null
@@ -1,85 +0,0 @@
-package nullable
-
-import (
-	"fmt"
-	"strconv"
-
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
-)
-
-const (
-	TypeNullableBool = schema.TypeString
-)
-
-type Bool string
-
-func (b Bool) IsNull() bool {
-	return b == ""
-}
-
-func (b Bool) Value() (bool, bool, error) {
-	if b.IsNull() {
-		return false, true, nil
-	}
-
-	value, err := strconv.ParseBool(string(b))
-	if err != nil {
-		return false, false, err
-	}
-	return value, false, nil
-}
-
-func NewBool(v bool) Bool {
-	return Bool(strconv.FormatBool(v))
-}
-
-// ValidateTypeStringNullableBool provides custom error messaging for TypeString booleans
-// Some arguments require a boolean value or unspecified, empty field.
-func ValidateTypeStringNullableBool(v interface{}, k string) (ws []string, es []error) {
-	value, ok := v.(string)
-	if !ok {
-		es = append(es, fmt.Errorf("expected type of %s to be string", k))
-		return
-	}
-
-	if value == "" {
-		return
-	}
-
-	if _, err := strconv.ParseBool(value); err != nil {
-		es = append(es, fmt.Errorf("%s: cannot parse '%s' as boolean: %w", k, value, err))
-		return
-	}
-
-	if value != "true" && value != "false" {
-		ws = append(ws, fmt.Sprintf(`%s: the use of values other than "true" and "false" is deprecated and will be removed in a future version of the provider`, k))
-	}
-
-	return
-}
-
-func DiffSuppressNullableBool(k, o, n string, d *schema.ResourceData) bool {
-	ov, onull, _ := Bool(o).Value()
-	nv, nnull, _ := Bool(n).Value()
-	if onull && nnull {
-		return true
-	}
-	if !onull && !nnull {
-		return ov == nv
-	}
-	return false
-}
-
-// DiffSuppressNullableBoolFalseAsNull allows false to be treated equivalently to null.
-// This can be used to allow a practitioner to set false when the API requires a null value,
-// as a convenience.
-// This is typically not what you want: it is indended for cases where a parameter is optional
-// in some cases and must be set in others.
-func DiffSuppressNullableBoolFalseAsNull(k, o, n string, d *schema.ResourceData) bool {
-	ov, onull, _ := Bool(o).Value()
-	nv, nnull, _ := Bool(n).Value()
-	if !ov && nnull || onull && !nv {
-		return true
-	}
-	return false
-}
diff --git a/internal/experimental/nullable/bool_test.go b/internal/experimental/nullable/bool_test.go
deleted file mode 100644
index 8fa330a7c52..00000000000
--- a/internal/experimental/nullable/bool_test.go
+++ /dev/null
@@ -1,389 +0,0 @@
-package nullable
-
-import (
-	"errors"
-	"regexp"
-	"strconv"
-	"testing"
-)
-
-func TestNullableBool(t *testing.T) {
-	t.Parallel()
-
-	cases := []struct {
-		val           string
-		expectNull    bool
-		expectedValue bool
-		expectedErr   error
-	}{
-		{
-			val:           "true",
-			expectNull:    false,
-			expectedValue: true,
-		},
-		{
-			val:           "false",
-			expectNull:    false,
-			expectedValue: false,
-		},
-		{
-			val:           "1",
-			expectNull:    false,
-			expectedValue: true,
-		},
-		{
-			val:           "0",
-			expectNull:    false,
-			expectedValue: false,
-		},
-		{
-			val:           "",
-			expectNull:    true,
-			expectedValue: false,
-		},
-		{
-			val:           "A",
-			expectNull:    false,
-			expectedValue: false,
-			expectedErr:   strconv.ErrSyntax,
-		},
-	}
-
-	for i, tc := range cases {
-		v := Bool(tc.val)
-
-		if null := v.IsNull(); null != tc.expectNull {
-			t.Fatalf("expected test case %d IsNull to return %t, got %t", i, null, tc.expectNull)
-		}
-
-		value, null, err := v.Value()
-		if value != tc.expectedValue {
-			t.Fatalf("expected test case %d Value to be %t, got %t", i, tc.expectedValue, value)
-		}
-		if null != tc.expectNull {
-			t.Fatalf("expected test case %d Value null flag to be %t, got %t", i, tc.expectNull, null)
-		}
-		if tc.expectedErr == nil && err != nil {
-			t.Fatalf("expected test case %d to succeed, got error %s", i, err)
-		}
-		if tc.expectedErr != nil {
-			if !errors.Is(err, tc.expectedErr) {
-				t.Fatalf("expected test case %d to have error matching \"%s\", got %s", i, tc.expectedErr, err)
-			}
-		}
-	}
-}
-
-func TestValidationBool(t *testing.T) {
-	t.Parallel()
-
-	runValidationTestCases(t, []testCase{
-		{
-			val: "true",
-			f:   ValidateTypeStringNullableBool,
-		},
-		{
-			val:             "1",
-			f:               ValidateTypeStringNullableBool,
-			expectedWarning: regexp.MustCompile(`^\w+: the use of values other than "true" and "false" is deprecated and will be removed in a future version of the provider$`),
-		},
-		{
-			val:         "A",
-			f:           ValidateTypeStringNullableBool,
-			expectedErr: regexp.MustCompile(`^\w+: cannot parse 'A' as boolean: .+$`),
-		},
-		{
-			val:         1,
-			f:           ValidateTypeStringNullableBool,
-			expectedErr: regexp.MustCompile(`^expected type of \w+ to be string$`),
-		},
-	})
-}
-
-func TestDiffSuppressBool(t *testing.T) {
-	t.Parallel()
-
-	cases := []struct {
-		old, new   string
-		equivalent bool
-	}{
-		// Truthy values
-		{
-			old:        "true",
-			new:        "1",
-			equivalent: true,
-		},
-		{
-			old:        "1",
-			new:        "true",
-			equivalent: true,
-		},
-
-		// Falsey values
-		{
-			old:        "false",
-			new:        "0",
-			equivalent: true,
-		},
-		{
-			old:        "0",
-			new:        "false",
-			equivalent: true,
-		},
-
-		// Truthy -> Falsey
-		{
-			old:        "true",
-			new:        "false",
-			equivalent: false,
-		},
-		{
-			old:        "true",
-			new:        "0",
-			equivalent: false,
-		},
-		{
-			old:        "1",
-			new:        "false",
-			equivalent: false,
-		},
-		{
-			old:        "1",
-			new:        "0",
-			equivalent: false,
-		},
-
-		// Falsey -> Truthy
-		{
-			old:        "false",
-			new:        "true",
-			equivalent: false,
-		},
-		{
-			old:        "false",
-			new:        "1",
-			equivalent: false,
-		},
-		{
-			old:        "0",
-			new:        "true",
-			equivalent: false,
-		},
-		{
-			old:        "0",
-			new:        "1",
-			equivalent: false,
-		},
-
-		// Null -> Truthy
-		{
-			old:        "",
-			new:        "true",
-			equivalent: false,
-		},
-		{
-			old:        "",
-			new:        "1",
-			equivalent: false,
-		},
-
-		// Null -> Falsey
-		{
-			old:        "",
-			new:        "false",
-			equivalent: false,
-		},
-		{
-			old:        "",
-			new:        "0",
-			equivalent: false,
-		},
-
-		// Truthy -> Null
-		{
-			old:        "true",
-			new:        "",
-			equivalent: false,
-		},
-		{
-			old:        "1",
-			new:        "",
-			equivalent: false,
-		},
-
-		// Falsey -> Null
-		{
-			old:        "false",
-			new:        "",
-			equivalent: false,
-		},
-		{
-			old:        "0",
-			new:        "",
-			equivalent: false,
-		},
-
-		// Null => Null
-		{
-			old:        "",
-			new:        "",
-			equivalent: true,
-		},
-	}
-
-	for i, tc := range cases {
-		v := DiffSuppressNullableBool("test_property", tc.old, tc.new, nil)
-
-		if tc.equivalent && !v {
-			t.Fatalf("expected test case %d to be equivalent", i)
-		}
-
-		if !tc.equivalent && v {
-			t.Fatalf("expected test case %d to not be equivalent", i)
-		}
-	}
-}
-
-func TestDiffSuppressBoolFalseAsNull(t *testing.T) {
-	t.Parallel()
-
-	cases := []struct {
-		old, new   string
-		equivalent bool
-	}{
-		// Falsey -> Null
-		{
-			old:        "false",
-			new:        "",
-			equivalent: true,
-		},
-		{
-			old:        "0",
-			new:        "",
-			equivalent: true,
-		},
-
-		// Null -> Falsey
-		{
-			old:        "",
-			new:        "false",
-			equivalent: true,
-		},
-		{
-			old:        "",
-			new:        "0",
-			equivalent: true,
-		},
-
-		// Null => Null
-		{
-			old:        "",
-			new:        "",
-			equivalent: true,
-		},
-
-		// Truthy values
-		{
-			old:        "true",
-			new:        "1",
-			equivalent: false,
-		},
-		{
-			old:        "1",
-			new:        "true",
-			equivalent: false,
-		},
-
-		// Falsey values
-		{
-			old:        "false",
-			new:        "0",
-			equivalent: false,
-		},
-		{
-			old:        "0",
-			new:        "false",
-			equivalent: false,
-		},
-
-		// Truthy -> Falsey
-		{
-			old:        "true",
-			new:        "false",
-			equivalent: false,
-		},
-		{
-			old:        "true",
-			new:        "0",
-			equivalent: false,
-		},
-		{
-			old:        "1",
-			new:        "false",
-			equivalent: false,
-		},
-		{
-			old:        "1",
-			new:        "0",
-			equivalent: false,
-		},
-
-		// Falsey -> Truthy
-		{
-			old:        "false",
-			new:        "true",
-			equivalent: false,
-		},
-		{
-			old:        "false",
-			new:        "1",
-			equivalent: false,
-		},
-		{
-			old:        "0",
-			new:        "true",
-			equivalent: false,
-		},
-		{
-			old:        "0",
-			new:        "1",
-			equivalent: false,
-		},
-
-		// Null -> Truthy
-		{
-			old:        "",
-			new:        "true",
-			equivalent: false,
-		},
-		{
-			old:        "",
-			new:        "1",
-			equivalent: false,
-		},
-
-		// Truthy -> Null
-		{
-			old:        "true",
-			new:        "",
-			equivalent: false,
-		},
-		{
-			old:        "1",
-			new:        "",
-			equivalent: false,
-		},
-	}
-
-	for i, tc := range cases {
-		v := DiffSuppressNullableBoolFalseAsNull("test_property", tc.old, tc.new, nil)
-
-		if tc.equivalent && !v {
-			t.Fatalf("expected test case %d to be equivalent", i)
-		}
-
-		if !tc.equivalent && v {
-			t.Fatalf("expected test case %d to not be equivalent", i)
-		}
-	}
-}
diff --git a/internal/experimental/nullable/float.go b/internal/experimental/nullable/float.go
deleted file mode 100644
index 80cf71e345b..00000000000
--- a/internal/experimental/nullable/float.go
+++ /dev/null
@@ -1,50 +0,0 @@
-package nullable
-
-import (
-	"fmt"
-	"strconv"
-
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
-)
-
-const (
-	TypeNullableFloat = schema.TypeString
-)
-
-type Float string
-
-func (i Float) IsNull() bool {
-	return i == ""
-}
-
-func (i Float) Value() (float64, bool, error) {
-	if i.IsNull() {
-		return 0, true, nil
-	}
-
-	value, err := strconv.ParseFloat(string(i), 64)
-	if err != nil {
-		return 0, false, err
-	}
-	return value, false, nil
-}
-
-// ValidateTypeStringNullableFloat provides custom error messaging for TypeString floats
-// Some arguments require an float value or unspecified, empty field.
-func ValidateTypeStringNullableFloat(v interface{}, k string) (ws []string, es []error) {
-	value, ok := v.(string)
-	if !ok {
-		es = append(es, fmt.Errorf("expected type of %s to be string", k))
-		return
-	}
-
-	if value == "" {
-		return
-	}
-
-	if _, err := strconv.ParseFloat(value, 64); err != nil {
-		es = append(es, fmt.Errorf("%s: cannot parse '%s' as float: %w", k, value, err))
-	}
-
-	return
-}
diff --git a/internal/experimental/nullable/float_test.go b/internal/experimental/nullable/float_test.go
deleted file mode 100644
index 07e40300ba1..00000000000
--- a/internal/experimental/nullable/float_test.go
+++ /dev/null
@@ -1,99 +0,0 @@
-package nullable
-
-import (
-	"errors"
-	"regexp"
-	"strconv"
-	"testing"
-)
-
-func TestNullableFloat(t *testing.T) {
-	t.Parallel()
-
-	cases := []struct {
-		val           string
-		expectNull    bool
-		expectedValue float64
-		expectedErr   error
-	}{
-		{
-			val:           "1",
-			expectNull:    false,
-			expectedValue: 1,
-		},
-		{
-			val:           "1.1",
-			expectNull:    false,
-			expectedValue: 1.1,
-		},
-		{
-			val:           "0",
-			expectNull:    false,
-			expectedValue: 0,
-		},
-		{
-			val:           "",
-			expectNull:    true,
-			expectedValue: 0,
-		},
-		{
-			val:           "A",
-			expectNull:    false,
-			expectedValue: 0,
-			expectedErr:   strconv.ErrSyntax,
-		},
-	}
-
-	for i, tc := range cases {
-		v := Float(tc.val)
-
-		if null := v.IsNull(); null != tc.expectNull {
-			t.Fatalf("expected test case %d IsNull to return %t, got %t", i, null, tc.expectNull)
-		}
-
-		value, null, err := v.Value()
-		if value != tc.expectedValue {
-			t.Fatalf("expected test case %d Value to be %f, got %f", i, tc.expectedValue, value)
-		}
-		if null != tc.expectNull {
-			t.Fatalf("expected test case %d Value null flag to be %t, got %t", i, tc.expectNull, null)
-		}
-		if tc.expectedErr == nil && err != nil {
-			t.Fatalf("expected test case %d to succeed, got error %s", i, err)
-		}
-		if tc.expectedErr != nil {
-			if !errors.Is(err, tc.expectedErr) {
-				t.Fatalf("expected test case %d to have error matching \"%s\", got %s", i, tc.expectedErr, err)
-			}
-		}
-	}
-}
-
-func TestValidationFloat(t *testing.T) {
-	t.Parallel()
-
-	runValidationTestCases(t, []testCase{
-		{
-			val: "1",
-			f:   ValidateTypeStringNullableFloat,
-		},
-		{
-			val: "1.1",
-			f:   ValidateTypeStringNullableFloat,
-		},
-		{
-			val: "0",
-			f:   ValidateTypeStringNullableFloat,
-		},
-		{
-			val:         "A",
-			f:           ValidateTypeStringNullableFloat,
-			expectedErr: regexp.MustCompile(`^\w+: cannot parse 'A' as float: .+$`),
-		},
-		{
-			val:         1,
-			f:           ValidateTypeStringNullableFloat,
-			expectedErr: regexp.MustCompile(`^expected type of \w+ to be string$`),
-		},
-	})
-}
diff --git a/internal/experimental/nullable/int.go b/internal/experimental/nullable/int.go
deleted file mode 100644
index 25feb8112bb..00000000000
--- a/internal/experimental/nullable/int.go
+++ /dev/null
@@ -1,106 +0,0 @@
-package nullable
-
-import (
-	"fmt"
-	"strconv"
-
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
-)
-
-const (
-	TypeNullableInt = schema.TypeString
-)
-
-type Int string
-
-func (i Int) IsNull() bool {
-	return i == ""
-}
-
-func (i Int) Value() (int64, bool, error) {
-	if i.IsNull() {
-		return 0, true, nil
-	}
-
-	value, err := strconv.ParseInt(string(i), 10, 64)
-	if err != nil {
-		return 0, false, err
-	}
-	return value, false, nil
-}
-
-// ValidateTypeStringNullableInt provides custom error messaging for TypeString ints
-// Some arguments require an int value or unspecified, empty field.
-func ValidateTypeStringNullableInt(v interface{}, k string) (ws []string, es []error) {
-	value, ok := v.(string)
-	if !ok {
-		es = append(es, fmt.Errorf("expected type of %s to be string", k))
-		return
-	}
-
-	if value == "" {
-		return
-	}
-
-	if _, err := strconv.ParseInt(value, 10, 64); err != nil {
-		es = append(es, fmt.Errorf("%s: cannot parse '%s' as int: %w", k, value, err))
-	}
-
-	return
-}
-
-// ValidateTypeStringNullableIntAtLeast provides custom error messaging for TypeString ints
-// Some arguments require an int value or unspecified, empty field.
-func ValidateTypeStringNullableIntAtLeast(min int) schema.SchemaValidateFunc {
-	return func(i interface{}, k string) (ws []string, es []error) {
-		value, ok := i.(string)
-		if !ok {
-			es = append(es, fmt.Errorf("expected type of %s to be string", k))
-			return
-		}
-
-		if value == "" {
-			return
-		}
-
-		v, err := strconv.ParseInt(value, 10, 64)
-		if err != nil {
-			es = append(es, fmt.Errorf("%s: cannot parse '%s' as int: %w", k, value, err))
-			return
-		}
-
-		if v < int64(min) {
-			es = append(es, fmt.Errorf("expected %s to be at least (%d), got %d", k, min, v))
-		}
-
-		return
-	}
-}
-
-// ValidateTypeStringNullableIntBetween provides custom error messaging for TypeString ints
-// Some arguments require an int value or unspecified, empty field.
-func ValidateTypeStringNullableIntBetween(min int, max int) schema.SchemaValidateFunc {
-	return func(i interface{}, k string) (ws []string, es []error) {
-		value, ok := i.(string)
-		if !ok {
-			es = append(es, fmt.Errorf("expected type of %s to be string", k))
-			return
-		}
-
-		if value == "" {
-			return
-		}
-
-		v, err := strconv.ParseInt(value, 10, 64)
-		if err != nil {
-			es = append(es, fmt.Errorf("%s: cannot parse '%s' as int: %w", k, value, err))
-			return
-		}
-
-		if v < int64(min) || v > int64(max) {
-			es = append(es, fmt.Errorf("expected %s to be at between (%d) and (%d), got %d", k, min, max, v))
-		}
-
-		return
-	}
-}
diff --git a/internal/experimental/nullable/int_test.go b/internal/experimental/nullable/int_test.go
deleted file mode 100644
index 434cc5f2cb0..00000000000
--- a/internal/experimental/nullable/int_test.go
+++ /dev/null
@@ -1,106 +0,0 @@
-package nullable
-
-import (
-	"errors"
-	"regexp"
-	"strconv"
-	"testing"
-)
-
-func TestNullableInt(t *testing.T) {
-	t.Parallel()
-
-	cases := []struct {
-		val           string
-		expectNull    bool
-		expectedValue int64
-		expectedErr   error
-	}{
-		{
-			val:           "1",
-			expectNull:    false,
-			expectedValue: 1,
-		},
-		{
-			val:           "",
-			expectNull:    true,
-			expectedValue: 0,
-		},
-		{
-			val:           "A",
-			expectNull:    false,
-			expectedValue: 0,
-			expectedErr:   strconv.ErrSyntax,
-		},
-	}
-
-	for i, tc := range cases {
-		v := Int(tc.val)
-
-		if null := v.IsNull(); null != tc.expectNull {
-			t.Fatalf("expected test case %d IsNull to return %t, got %t", i, null, tc.expectNull)
-		}
-
-		value, null, err := v.Value()
-		if value != tc.expectedValue {
-			t.Fatalf("expected test case %d Value to be %d, got %d", i, tc.expectedValue, value)
-		}
-		if null != tc.expectNull {
-			t.Fatalf("expected test case %d Value null flag to be %t, got %t", i, tc.expectNull, null)
-		}
-		if tc.expectedErr == nil && err != nil {
-			t.Fatalf("expected test case %d to succeed, got error %s", i, err)
-		}
-		if tc.expectedErr != nil {
-			if !errors.Is(err, tc.expectedErr) {
-				t.Fatalf("expected test case %d to have error matching \"%s\", got %s", i, tc.expectedErr, err)
-			}
-		}
-	}
-}
-
-func TestValidationInt(t *testing.T) {
-	t.Parallel()
-
-	runValidationTestCases(t, []testCase{
-		{
-			val: "1",
-			f:   ValidateTypeStringNullableInt,
-		},
-		{
-			val:         "A",
-			f:           ValidateTypeStringNullableInt,
-			expectedErr: regexp.MustCompile(`^\w+: cannot parse 'A' as int: .*`),
-		},
-		{
-			val:         1,
-			f:           ValidateTypeStringNullableInt,
-			expectedErr: regexp.MustCompile(`^expected type of \w+ to be string`),
-		},
-	})
-}
-
-func TestValidationIntAtLeast(t *testing.T) {
-	t.Parallel()
-
-	runValidationTestCases(t, []testCase{
-		{
-			val: "1",
-			f:   ValidateTypeStringNullableIntAtLeast(1),
-		},
-		{
-			val: "1",
-			f:   ValidateTypeStringNullableIntAtLeast(0),
-		},
-		{
-			val:         "1",
-			f:           ValidateTypeStringNullableIntAtLeast(2),
-			expectedErr: regexp.MustCompile(`expected \w+ to be at least \(2\), got 1`),
-		},
-		{
-			val:         1,
-			f:           ValidateTypeStringNullableIntAtLeast(2),
-			expectedErr: regexp.MustCompile(`expected type of \w+ to be string`),
-		},
-	})
-}
diff --git a/internal/experimental/sync/sync.go b/internal/experimental/sync/sync.go
index a50df8d9ece..6f4eb1e79d5 100644
--- a/internal/experimental/sync/sync.go
+++ b/internal/experimental/sync/sync.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sync
 
 import (
diff --git a/internal/flex/flex.go b/internal/flex/flex.go
index 8fb5da702d0..4ade8c6dd04 100644
--- a/internal/flex/flex.go
+++ b/internal/flex/flex.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package flex
 
 import (
@@ -15,14 +18,27 @@ const (
 	ResourceIdSeparator = ","
 )
 
-// Takes the result of flatmap.Expand for an array of strings
-// and returns a []*string
+// ExpandStringList the result of flatmap.Expand for an array of strings
+// and returns a []*string. Empty strings are skipped.
 func ExpandStringList(configured []interface{}) []*string {
 	vs := make([]*string, 0, len(configured))
 	for _, v := range configured {
-		val, ok := v.(string)
-		if ok && val != "" {
-			vs = append(vs, aws.String(v.(string)))
+		if v, ok := v.(string); ok && v != "" { // v != "" may not do anything since in []interface{}, empty string will be nil so !ok
+			vs = append(vs, aws.String(v))
+		}
+	}
+	return vs
+}
+
+// ExpandStringListEmpty the result of flatmap. Expand for an array of strings
+// and returns a []*string. Adds an empty element for every nil or uncastable.
+func ExpandStringListEmpty(configured []interface{}) []*string {
+	vs := make([]*string, 0, len(configured))
+	for _, v := range configured {
+		if v, ok := v.(string); ok { // empty string in config turns into nil in []interface{} so !ok
+			vs = append(vs, aws.String(v))
+		} else {
+			vs = append(vs, aws.String(""))
 		}
 	}
 	return vs
@@ -286,3 +302,21 @@ func ResourceIdPartCount(id string) int {
 	idParts := strings.Split(id, ResourceIdSeparator)
 	return len(idParts)
 }
+
+type Set[T comparable] []T
+
+// Difference find the elements in two sets that are not similar.
+func (s Set[T]) Difference(ns Set[T]) Set[T] {
+	m := make(map[T]struct{})
+	for _, v := range ns {
+		m[v] = struct{}{}
+	}
+
+	var result []T
+	for _, v := range s {
+		if _, ok := m[v]; !ok {
+			result = append(result, v)
+		}
+	}
+	return result
+}
diff --git a/internal/flex/flex_test.go b/internal/flex/flex_test.go
index 0ff5bf65826..94ec3aa21b8 100644
--- a/internal/flex/flex_test.go
+++ b/internal/flex/flex_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package flex
 
 import (
@@ -12,31 +15,58 @@ import (
 func TestExpandStringList(t *testing.T) {
 	t.Parallel()
 
-	configured := []interface{}{"abc", "xyz123"}
-	got := ExpandStringList(configured)
-	want := []*string{
-		aws.String("abc"),
-		aws.String("xyz123"),
+	testCases := []struct {
+		configured []interface{}
+		want       []*string
+	}{
+		{
+			configured: []interface{}{"abc", "xyz123"},
+			want:       []*string{aws.String("abc"), aws.String("xyz123")},
+		},
+		{
+			configured: []interface{}{"abc", 123, "xyz123"},
+			want:       []*string{aws.String("abc"), aws.String("xyz123")},
+		},
+		{
+			configured: []interface{}{"foo", "bar", "", "baz"},
+			want:       []*string{aws.String("foo"), aws.String("bar"), aws.String("baz")},
+		},
 	}
-
-	if !cmp.Equal(got, want) {
-		t.Errorf("expanded = %v, want = %v", got, want)
+	for _, testCase := range testCases {
+		if got, want := ExpandStringList(testCase.configured), testCase.want; !cmp.Equal(got, want) {
+			t.Errorf("ExpandStringList(%v) = %v, want %v", testCase.configured, got, want)
+		}
 	}
 }
 
-func TestExpandStringListEmptyItems(t *testing.T) {
+func TestExpandStringListEmpty(t *testing.T) {
 	t.Parallel()
 
-	configured := []interface{}{"foo", "bar", "", "baz"}
-	got := ExpandStringList(configured)
-	want := []*string{
-		aws.String("foo"),
-		aws.String("bar"),
-		aws.String("baz"),
+	testCases := []struct {
+		configured []interface{}
+		want       []*string
+	}{
+		{
+			configured: []interface{}{"abc", "xyz123"},
+			want:       []*string{aws.String("abc"), aws.String("xyz123")},
+		},
+		{
+			configured: []interface{}{"abc", 123, "xyz123"},
+			want:       []*string{aws.String("abc"), aws.String(""), aws.String("xyz123")},
+		},
+		{
+			configured: []interface{}{"foo", "bar", "", "baz"},
+			want:       []*string{aws.String("foo"), aws.String("bar"), aws.String(""), aws.String("baz")},
+		},
+		{
+			configured: []interface{}{"foo", "bar", nil, "baz"},
+			want:       []*string{aws.String("foo"), aws.String("bar"), aws.String(""), aws.String("baz")},
+		},
 	}
-
-	if !cmp.Equal(got, want) {
-		t.Errorf("expanded = %v, want = %v", got, want)
+	for _, testCase := range testCases {
+		if got, want := ExpandStringListEmpty(testCase.configured), testCase.want; !cmp.Equal(got, want) {
+			t.Errorf("ExpandStringListEmpty(%v) = %v, want %v", testCase.configured, got, want)
+		}
 	}
 }
 
diff --git a/internal/flex/framework.go b/internal/flex/framework.go
deleted file mode 100644
index 192d17e71d6..00000000000
--- a/internal/flex/framework.go
+++ /dev/null
@@ -1,362 +0,0 @@
-package flex
-
-import (
-	"context"
-
-	"github.com/aws/aws-sdk-go-v2/aws"
-	"github.com/hashicorp/terraform-plugin-framework/attr"
-	"github.com/hashicorp/terraform-plugin-framework/types"
-)
-
-// Terraform Plugin Framework variants of standard flatteners and expanders.
-
-func ExpandFrameworkStringList(ctx context.Context, list types.List) []*string {
-	if list.IsNull() || list.IsUnknown() {
-		return nil
-	}
-
-	var vl []*string
-
-	if list.ElementsAs(ctx, &vl, false).HasError() {
-		return nil
-	}
-
-	return vl
-}
-
-func ExpandFrameworkStringValueList(ctx context.Context, list types.List) []string {
-	if list.IsNull() || list.IsUnknown() {
-		return nil
-	}
-
-	var vl []string
-
-	if list.ElementsAs(ctx, &vl, false).HasError() {
-		return nil
-	}
-
-	return vl
-}
-
-func ExpandFrameworkStringSet(ctx context.Context, set types.Set) []*string {
-	if set.IsNull() || set.IsUnknown() {
-		return nil
-	}
-
-	var vs []*string
-
-	if set.ElementsAs(ctx, &vs, false).HasError() {
-		return nil
-	}
-
-	return vs
-}
-
-func ExpandFrameworkStringValueSet(ctx context.Context, set types.Set) Set[string] {
-	if set.IsNull() || set.IsUnknown() {
-		return nil
-	}
-
-	var vs []string
-
-	if set.ElementsAs(ctx, &vs, false).HasError() {
-		return nil
-	}
-
-	return vs
-}
-
-func ExpandFrameworkStringValueMap(ctx context.Context, set types.Map) map[string]string {
-	if set.IsNull() || set.IsUnknown() {
-		return nil
-	}
-
-	var m map[string]string
-
-	if set.ElementsAs(ctx, &m, false).HasError() {
-		return nil
-	}
-
-	return m
-}
-
-// FlattenFrameworkStringList converts a slice of string pointers to a framework List value.
-//
-// A nil slice is converted to a null List.
-// An empty slice is converted to a null List.
-func FlattenFrameworkStringList(_ context.Context, vs []*string) types.List {
-	if len(vs) == 0 {
-		return types.ListNull(types.StringType)
-	}
-
-	elems := make([]attr.Value, len(vs))
-
-	for i, v := range vs {
-		elems[i] = types.StringValue(aws.ToString(v))
-	}
-
-	return types.ListValueMust(types.StringType, elems)
-}
-
-// FlattenFrameworkStringListLegacy is the Plugin Framework variant of FlattenStringList.
-// A nil slice is converted to an empty (non-null) List.
-func FlattenFrameworkStringListLegacy(_ context.Context, vs []*string) types.List {
-	elems := make([]attr.Value, len(vs))
-
-	for i, v := range vs {
-		elems[i] = types.StringValue(aws.ToString(v))
-	}
-
-	return types.ListValueMust(types.StringType, elems)
-}
-
-// FlattenFrameworkStringValueList converts a slice of string values to a framework List value.
-//
-// A nil slice is converted to a null List.
-// An empty slice is converted to a null List.
-func FlattenFrameworkStringValueList(_ context.Context, vs []string) types.List {
-	if len(vs) == 0 {
-		return types.ListNull(types.StringType)
-	}
-
-	elems := make([]attr.Value, len(vs))
-
-	for i, v := range vs {
-		elems[i] = types.StringValue(v)
-	}
-
-	return types.ListValueMust(types.StringType, elems)
-}
-
-// FlattenFrameworkStringValueListLegacy is the Plugin Framework variant of FlattenStringValueList.
-// A nil slice is converted to an empty (non-null) List.
-func FlattenFrameworkStringValueListLegacy(_ context.Context, vs []string) types.List {
-	elems := make([]attr.Value, len(vs))
-
-	for i, v := range vs {
-		elems[i] = types.StringValue(v)
-	}
-
-	return types.ListValueMust(types.StringType, elems)
-}
-
-// FlattenFrameworkStringSet converts a slice of string pointers to a framework Set value.
-//
-// A nil slice is converted to a null Set.
-// An empty slice is converted to a null Set.
-func FlattenFrameworkStringSet(_ context.Context, vs []*string) types.Set {
-	if len(vs) == 0 {
-		return types.SetNull(types.StringType)
-	}
-
-	elems := make([]attr.Value, len(vs))
-
-	for i, v := range vs {
-		elems[i] = types.StringValue(aws.ToString(v))
-	}
-
-	return types.SetValueMust(types.StringType, elems)
-}
-
-// FlattenFrameworkStringSetLegacy converts a slice of string pointers to a framework Set value.
-//
-// A nil slice is converted to an empty (non-null) Set.
-func FlattenFrameworkStringSetLegacy(_ context.Context, vs []*string) types.Set {
-	elems := make([]attr.Value, len(vs))
-
-	for i, v := range vs {
-		elems[i] = types.StringValue(aws.ToString(v))
-	}
-
-	return types.SetValueMust(types.StringType, elems)
-}
-
-// FlattenFrameworkStringValueSet converts a slice of string values to a framework Set value.
-//
-// A nil slice is converted to a null Set.
-// An empty slice is converted to a null Set.
-func FlattenFrameworkStringValueSet(_ context.Context, vs []string) types.Set {
-	if len(vs) == 0 {
-		return types.SetNull(types.StringType)
-	}
-
-	elems := make([]attr.Value, len(vs))
-
-	for i, v := range vs {
-		elems[i] = types.StringValue(v)
-	}
-
-	return types.SetValueMust(types.StringType, elems)
-}
-
-// FlattenFrameworkStringValueSetLegacy is the Plugin Framework variant of FlattenStringValueSet.
-// A nil slice is converted to an empty (non-null) Set.
-func FlattenFrameworkStringValueSetLegacy(_ context.Context, vs []string) types.Set {
-	elems := make([]attr.Value, len(vs))
-
-	for i, v := range vs {
-		elems[i] = types.StringValue(v)
-	}
-
-	return types.SetValueMust(types.StringType, elems)
-}
-
-// FlattenFrameworkStringValueMapLegacy has no Plugin SDK equivalent as schema.ResourceData.Set can be passed string value maps directly.
-// A nil map is converted to an empty (non-null) Map.
-func FlattenFrameworkStringValueMapLegacy(_ context.Context, m map[string]string) types.Map {
-	elems := make(map[string]attr.Value, len(m))
-
-	for k, v := range m {
-		elems[k] = types.StringValue(v)
-	}
-
-	return types.MapValueMust(types.StringType, elems)
-}
-
-// BoolFromFramework converts a Framework Bool value to a bool pointer.
-// A null Bool is converted to a nil bool pointer.
-func BoolFromFramework(_ context.Context, v types.Bool) *bool {
-	if v.IsNull() || v.IsUnknown() {
-		return nil
-	}
-
-	return aws.Bool(v.ValueBool())
-}
-
-// Int64FromFramework converts a Framework Int64 value to an int64 pointer.
-// A null Int64 is converted to a nil int64 pointer.
-func Int64FromFramework(_ context.Context, v types.Int64) *int64 {
-	if v.IsNull() || v.IsUnknown() {
-		return nil
-	}
-
-	return aws.Int64(v.ValueInt64())
-}
-
-// StringFromFramework converts a Framework String value to a string pointer.
-// A null String is converted to a nil string pointer.
-func StringFromFramework(_ context.Context, v types.String) *string {
-	if v.IsNull() || v.IsUnknown() {
-		return nil
-	}
-
-	return aws.String(v.ValueString())
-}
-
-// StringFromFramework converts a single Framework String value to a string pointer slice.
-// A null String is converted to a nil slice.
-func StringSliceFromFramework(_ context.Context, v types.String) []*string {
-	if v.IsNull() || v.IsUnknown() {
-		return nil
-	}
-
-	return aws.StringSlice([]string{v.ValueString()})
-}
-
-// BoolToFramework converts a bool pointer to a Framework Bool value.
-// A nil bool pointer is converted to a null Bool.
-func BoolToFramework(_ context.Context, v *bool) types.Bool {
-	if v == nil {
-		return types.BoolNull()
-	}
-
-	return types.BoolValue(aws.ToBool(v))
-}
-
-// BoolToFrameworkLegacy converts a bool pointer to a Framework Bool value.
-// A nil bool pointer is converted to a false Bool.
-func BoolToFrameworkLegacy(_ context.Context, v *bool) types.Bool {
-	return types.BoolValue(aws.ToBool(v))
-}
-
-// StringValueToFramework converts a string value to a Framework String value.
-// An empty string is converted to a null String.
-func StringValueToFramework[T ~string](_ context.Context, v T) types.String {
-	if v == "" {
-		return types.StringNull()
-	}
-	return types.StringValue(string(v))
-}
-
-// StringValueToFrameworkLegacy converts a string value to a Framework String value.
-// An empty string is left as an empty String.
-func StringValueToFrameworkLegacy[T ~string](_ context.Context, v T) types.String {
-	return types.StringValue(string(v))
-}
-
-// Int64ToFramework converts an int64 pointer to a Framework Int64 value.
-// A nil int64 pointer is converted to a null Int64.
-func Int64ToFramework(_ context.Context, v *int64) types.Int64 {
-	if v == nil {
-		return types.Int64Null()
-	}
-
-	return types.Int64Value(aws.ToInt64(v))
-}
-
-// Int64ToFrameworkLegacy converts an int64 pointer to a Framework Int64 value.
-// A nil int64 pointer is converted to a zero Int64.
-func Int64ToFrameworkLegacy(_ context.Context, v *int64) types.Int64 {
-	return types.Int64Value(aws.ToInt64(v))
-}
-
-// StringToFramework converts a string pointer to a Framework String value.
-// A nil string pointer is converted to a null String.
-func StringToFramework(_ context.Context, v *string) types.String {
-	if v == nil {
-		return types.StringNull()
-	}
-
-	return types.StringValue(aws.ToString(v))
-}
-
-// StringToFrameworkLegacy converts a string pointer to a Framework String value.
-// A nil string pointer is converted to an empty String.
-func StringToFrameworkLegacy(_ context.Context, v *string) types.String {
-	return types.StringValue(aws.ToString(v))
-}
-
-// StringToFrameworkWithTransform converts a string pointer to a Framework String value.
-// A nil string pointer is converted to a null String.
-// A non-nil string pointer has its value transformed by `f`.
-func StringToFrameworkWithTransform(_ context.Context, v *string, f func(string) string) types.String {
-	if v == nil {
-		return types.StringNull()
-	}
-
-	return types.StringValue(f(aws.ToString(v)))
-}
-
-// Float64ToFramework converts a float64 pointer to a Framework Float64 value.
-// A nil float64 pointer is converted to a null Float64.
-func Float64ToFramework(_ context.Context, v *float64) types.Float64 {
-	if v == nil {
-		return types.Float64Null()
-	}
-
-	return types.Float64Value(aws.ToFloat64(v))
-}
-
-// Float64ToFrameworkLegacy converts a float64 pointer to a Framework Float64 value.
-// A nil float64 pointer is converted to a zero float64.
-func Float64ToFrameworkLegacy(_ context.Context, v *float64) types.Float64 {
-	return types.Float64Value(aws.ToFloat64(v))
-}
-
-type Set[T comparable] []T
-
-// Difference find the elements in two sets that are not similar.
-func (s Set[T]) Difference(ns Set[T]) Set[T] {
-	m := make(map[T]struct{})
-	for _, v := range ns {
-		m[v] = struct{}{}
-	}
-
-	var result []T
-	for _, v := range s {
-		if _, ok := m[v]; !ok {
-			result = append(result, v)
-		}
-	}
-	return result
-}
diff --git a/internal/flex/framework_test.go b/internal/flex/framework_test.go
deleted file mode 100644
index 2ee82184b54..00000000000
--- a/internal/flex/framework_test.go
+++ /dev/null
@@ -1,1087 +0,0 @@
-package flex
-
-import (
-	"context"
-	"strings"
-	"testing"
-
-	"github.com/aws/aws-sdk-go-v2/aws"
-	"github.com/google/go-cmp/cmp"
-	"github.com/hashicorp/terraform-plugin-framework/attr"
-	"github.com/hashicorp/terraform-plugin-framework/types"
-)
-
-func TestExpandFrameworkStringList(t *testing.T) {
-	t.Parallel()
-
-	type testCase struct {
-		input    types.List
-		expected []*string
-	}
-	tests := map[string]testCase{
-		"null": {
-			input:    types.ListNull(types.StringType),
-			expected: nil,
-		},
-		"unknown": {
-			input:    types.ListUnknown(types.StringType),
-			expected: nil,
-		},
-		"two elements": {
-			input: types.ListValueMust(types.StringType, []attr.Value{
-				types.StringValue("GET"),
-				types.StringValue("HEAD"),
-			}),
-			expected: []*string{aws.String("GET"), aws.String("HEAD")},
-		},
-		"zero elements": {
-			input:    types.ListValueMust(types.StringType, []attr.Value{}),
-			expected: []*string{},
-		},
-		"invalid element type": {
-			input: types.ListValueMust(types.Int64Type, []attr.Value{
-				types.Int64Value(42),
-			}),
-			expected: nil,
-		},
-	}
-
-	for name, test := range tests {
-		name, test := name, test
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-
-			got := ExpandFrameworkStringList(context.Background(), test.input)
-
-			if diff := cmp.Diff(got, test.expected); diff != "" {
-				t.Errorf("unexpected diff (+wanted, -got): %s", diff)
-			}
-		})
-	}
-}
-
-func TestExpandFrameworkStringValueList(t *testing.T) {
-	t.Parallel()
-
-	type testCase struct {
-		input    types.List
-		expected []string
-	}
-	tests := map[string]testCase{
-		"null": {
-			input:    types.ListNull(types.StringType),
-			expected: nil,
-		},
-		"unknown": {
-			input:    types.ListUnknown(types.StringType),
-			expected: nil,
-		},
-		"two elements": {
-			input: types.ListValueMust(types.StringType, []attr.Value{
-				types.StringValue("GET"),
-				types.StringValue("HEAD"),
-			}),
-			expected: []string{"GET", "HEAD"},
-		},
-		"zero elements": {
-			input:    types.ListValueMust(types.StringType, []attr.Value{}),
-			expected: []string{},
-		},
-		"invalid element type": {
-			input: types.ListValueMust(types.Int64Type, []attr.Value{
-				types.Int64Value(42),
-			}),
-			expected: nil,
-		},
-	}
-
-	for name, test := range tests {
-		name, test := name, test
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-
-			got := ExpandFrameworkStringValueList(context.Background(), test.input)
-
-			if diff := cmp.Diff(got, test.expected); diff != "" {
-				t.Errorf("unexpected diff (+wanted, -got): %s", diff)
-			}
-		})
-	}
-}
-
-func TestExpandFrameworkStringSet(t *testing.T) {
-	t.Parallel()
-
-	type testCase struct {
-		input    types.Set
-		expected []*string
-	}
-	tests := map[string]testCase{
-		"null": {
-			input:    types.SetNull(types.StringType),
-			expected: nil,
-		},
-		"unknown": {
-			input:    types.SetUnknown(types.StringType),
-			expected: nil,
-		},
-		"two elements": {
-			input: types.SetValueMust(types.StringType, []attr.Value{
-				types.StringValue("GET"),
-				types.StringValue("HEAD"),
-			}),
-			expected: []*string{aws.String("GET"), aws.String("HEAD")},
-		},
-		"zero elements": {
-			input:    types.SetValueMust(types.StringType, []attr.Value{}),
-			expected: []*string{},
-		},
-		"invalid element type": {
-			input: types.SetValueMust(types.Int64Type, []attr.Value{
-				types.Int64Value(42),
-			}),
-			expected: nil,
-		},
-	}
-
-	for name, test := range tests {
-		name, test := name, test
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-
-			got := ExpandFrameworkStringSet(context.Background(), test.input)
-
-			if diff := cmp.Diff(got, test.expected); diff != "" {
-				t.Errorf("unexpected diff (+wanted, -got): %s", diff)
-			}
-		})
-	}
-}
-
-func TestExpandFrameworkStringValueSet(t *testing.T) {
-	t.Parallel()
-
-	type testCase struct {
-		input    types.Set
-		expected Set[string]
-	}
-	tests := map[string]testCase{
-		"null": {
-			input:    types.SetNull(types.StringType),
-			expected: nil,
-		},
-		"unknown": {
-			input:    types.SetUnknown(types.StringType),
-			expected: nil,
-		},
-		"two elements": {
-			input: types.SetValueMust(types.StringType, []attr.Value{
-				types.StringValue("GET"),
-				types.StringValue("HEAD"),
-			}),
-			expected: []string{"GET", "HEAD"},
-		},
-		"zero elements": {
-			input:    types.SetValueMust(types.StringType, []attr.Value{}),
-			expected: []string{},
-		},
-		"invalid element type": {
-			input: types.SetValueMust(types.Int64Type, []attr.Value{
-				types.Int64Value(42),
-			}),
-			expected: nil,
-		},
-	}
-
-	for name, test := range tests {
-		name, test := name, test
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-
-			got := ExpandFrameworkStringValueSet(context.Background(), test.input)
-
-			if diff := cmp.Diff(got, test.expected); diff != "" {
-				t.Errorf("unexpected diff (+wanted, -got): %s", diff)
-			}
-		})
-	}
-}
-
-func TestExpandFrameworkStringValueMap(t *testing.T) {
-	t.Parallel()
-
-	type testCase struct {
-		input    types.Map
-		expected map[string]string
-	}
-	tests := map[string]testCase{
-		"null": {
-			input:    types.MapNull(types.StringType),
-			expected: nil,
-		},
-		"unknown": {
-			input:    types.MapUnknown(types.StringType),
-			expected: nil,
-		},
-		"two elements": {
-			input: types.MapValueMust(types.StringType, map[string]attr.Value{
-				"one": types.StringValue("GET"),
-				"two": types.StringValue("HEAD"),
-			}),
-			expected: map[string]string{
-				"one": "GET",
-				"two": "HEAD",
-			},
-		},
-		"zero elements": {
-			input:    types.MapValueMust(types.StringType, map[string]attr.Value{}),
-			expected: map[string]string{},
-		},
-		"invalid element type": {
-			input: types.MapValueMust(types.BoolType, map[string]attr.Value{
-				"one": types.BoolValue(true),
-			}),
-			expected: nil,
-		},
-	}
-
-	for name, test := range tests {
-		name, test := name, test
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-
-			got := ExpandFrameworkStringValueMap(context.Background(), test.input)
-
-			if diff := cmp.Diff(got, test.expected); diff != "" {
-				t.Errorf("unexpected diff (+wanted, -got): %s", diff)
-			}
-		})
-	}
-}
-
-func TestFlattenFrameworkStringList(t *testing.T) {
-	t.Parallel()
-
-	type testCase struct {
-		input    []*string
-		expected types.List
-	}
-	tests := map[string]testCase{
-		"two elements": {
-			input: []*string{aws.String("GET"), aws.String("HEAD")},
-			expected: types.ListValueMust(types.StringType, []attr.Value{
-				types.StringValue("GET"),
-				types.StringValue("HEAD"),
-			}),
-		},
-		"zero elements": {
-			input:    []*string{},
-			expected: types.ListNull(types.StringType),
-		},
-		"nil array": {
-			input:    nil,
-			expected: types.ListNull(types.StringType),
-		},
-	}
-
-	for name, test := range tests {
-		name, test := name, test
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-
-			got := FlattenFrameworkStringList(context.Background(), test.input)
-
-			if diff := cmp.Diff(got, test.expected); diff != "" {
-				t.Errorf("unexpected diff (+wanted, -got): %s", diff)
-			}
-		})
-	}
-}
-
-func TestFlattenFrameworkStringListLegacy(t *testing.T) {
-	t.Parallel()
-
-	type testCase struct {
-		input    []*string
-		expected types.List
-	}
-	tests := map[string]testCase{
-		"two elements": {
-			input: []*string{aws.String("GET"), aws.String("HEAD")},
-			expected: types.ListValueMust(types.StringType, []attr.Value{
-				types.StringValue("GET"),
-				types.StringValue("HEAD"),
-			}),
-		},
-		"zero elements": {
-			input:    []*string{},
-			expected: types.ListValueMust(types.StringType, []attr.Value{}),
-		},
-		"nil array": {
-			input:    nil,
-			expected: types.ListValueMust(types.StringType, []attr.Value{}),
-		},
-	}
-
-	for name, test := range tests {
-		name, test := name, test
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-
-			got := FlattenFrameworkStringListLegacy(context.Background(), test.input)
-
-			if diff := cmp.Diff(got, test.expected); diff != "" {
-				t.Errorf("unexpected diff (+wanted, -got): %s", diff)
-			}
-		})
-	}
-}
-
-func TestFlattenFrameworkStringValueList(t *testing.T) {
-	t.Parallel()
-
-	type testCase struct {
-		input    []string
-		expected types.List
-	}
-	tests := map[string]testCase{
-		"two elements": {
-			input: []string{"GET", "HEAD"},
-			expected: types.ListValueMust(types.StringType, []attr.Value{
-				types.StringValue("GET"),
-				types.StringValue("HEAD"),
-			}),
-		},
-		"zero elements": {
-			input:    []string{},
-			expected: types.ListNull(types.StringType),
-		},
-		"nil array": {
-			input:    nil,
-			expected: types.ListNull(types.StringType),
-		},
-	}
-
-	for name, test := range tests {
-		name, test := name, test
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-
-			got := FlattenFrameworkStringValueList(context.Background(), test.input)
-
-			if diff := cmp.Diff(got, test.expected); diff != "" {
-				t.Errorf("unexpected diff (+wanted, -got): %s", diff)
-			}
-		})
-	}
-}
-
-func TestFlattenFrameworkStringValueListLegacy(t *testing.T) {
-	t.Parallel()
-
-	type testCase struct {
-		input    []string
-		expected types.List
-	}
-	tests := map[string]testCase{
-		"two elements": {
-			input: []string{"GET", "HEAD"},
-			expected: types.ListValueMust(types.StringType, []attr.Value{
-				types.StringValue("GET"),
-				types.StringValue("HEAD"),
-			}),
-		},
-		"zero elements": {
-			input:    []string{},
-			expected: types.ListValueMust(types.StringType, []attr.Value{}),
-		},
-		"nil array": {
-			input:    nil,
-			expected: types.ListValueMust(types.StringType, []attr.Value{}),
-		},
-	}
-
-	for name, test := range tests {
-		name, test := name, test
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-
-			got := FlattenFrameworkStringValueListLegacy(context.Background(), test.input)
-
-			if diff := cmp.Diff(got, test.expected); diff != "" {
-				t.Errorf("unexpected diff (+wanted, -got): %s", diff)
-			}
-		})
-	}
-}
-
-func TestFlattenFrameworkStringValueSet(t *testing.T) {
-	t.Parallel()
-
-	type testCase struct {
-		input    []string
-		expected types.Set
-	}
-	tests := map[string]testCase{
-		"two elements": {
-			input: []string{"GET", "HEAD"},
-			expected: types.SetValueMust(types.StringType, []attr.Value{
-				types.StringValue("GET"),
-				types.StringValue("HEAD"),
-			}),
-		},
-		"zero elements": {
-			input:    []string{},
-			expected: types.SetNull(types.StringType),
-		},
-		"nil array": {
-			input:    nil,
-			expected: types.SetNull(types.StringType),
-		},
-	}
-
-	for name, test := range tests {
-		name, test := name, test
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-
-			got := FlattenFrameworkStringValueSet(context.Background(), test.input)
-
-			if diff := cmp.Diff(got, test.expected); diff != "" {
-				t.Errorf("unexpected diff (+wanted, -got): %s", diff)
-			}
-		})
-	}
-}
-
-func TestFlattenFrameworkStringValueSetLegacy(t *testing.T) {
-	t.Parallel()
-
-	type testCase struct {
-		input    []string
-		expected types.Set
-	}
-	tests := map[string]testCase{
-		"two elements": {
-			input: []string{"GET", "HEAD"},
-			expected: types.SetValueMust(types.StringType, []attr.Value{
-				types.StringValue("GET"),
-				types.StringValue("HEAD"),
-			}),
-		},
-		"zero elements": {
-			input:    []string{},
-			expected: types.SetValueMust(types.StringType, []attr.Value{}),
-		},
-		"nil array": {
-			input:    nil,
-			expected: types.SetValueMust(types.StringType, []attr.Value{}),
-		},
-	}
-
-	for name, test := range tests {
-		name, test := name, test
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-
-			got := FlattenFrameworkStringValueSetLegacy(context.Background(), test.input)
-
-			if diff := cmp.Diff(got, test.expected); diff != "" {
-				t.Errorf("unexpected diff (+wanted, -got): %s", diff)
-			}
-		})
-	}
-}
-
-func TestFlattenFrameworkStringValueMapLegacy(t *testing.T) {
-	t.Parallel()
-
-	type testCase struct {
-		input    map[string]string
-		expected types.Map
-	}
-	tests := map[string]testCase{
-		"two elements": {
-			input: map[string]string{
-				"one": "GET",
-				"two": "HEAD",
-			},
-			expected: types.MapValueMust(types.StringType, map[string]attr.Value{
-				"one": types.StringValue("GET"),
-				"two": types.StringValue("HEAD"),
-			}),
-		},
-		"zero elements": {
-			input:    map[string]string{},
-			expected: types.MapValueMust(types.StringType, map[string]attr.Value{}),
-		},
-		"nil map": {
-			input:    nil,
-			expected: types.MapValueMust(types.StringType, map[string]attr.Value{}),
-		},
-	}
-
-	for name, test := range tests {
-		name, test := name, test
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-
-			got := FlattenFrameworkStringValueMapLegacy(context.Background(), test.input)
-
-			if diff := cmp.Diff(got, test.expected); diff != "" {
-				t.Errorf("unexpected diff (+wanted, -got): %s", diff)
-			}
-		})
-	}
-}
-
-func TestBoolFromFramework(t *testing.T) {
-	t.Parallel()
-
-	type testCase struct {
-		input    types.Bool
-		expected *bool
-	}
-	tests := map[string]testCase{
-		"valid bool": {
-			input:    types.BoolValue(true),
-			expected: aws.Bool(true),
-		},
-		"null bool": {
-			input:    types.BoolNull(),
-			expected: nil,
-		},
-		"unknown bool": {
-			input:    types.BoolUnknown(),
-			expected: nil,
-		},
-	}
-
-	for name, test := range tests {
-		name, test := name, test
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-
-			got := BoolFromFramework(context.Background(), test.input)
-
-			if diff := cmp.Diff(got, test.expected); diff != "" {
-				t.Errorf("unexpected diff (+wanted, -got): %s", diff)
-			}
-		})
-	}
-}
-
-func TestInt64FromFramework(t *testing.T) {
-	t.Parallel()
-
-	type testCase struct {
-		input    types.Int64
-		expected *int64
-	}
-	tests := map[string]testCase{
-		"valid int64": {
-			input:    types.Int64Value(42),
-			expected: aws.Int64(42),
-		},
-		"zero int64": {
-			input:    types.Int64Value(0),
-			expected: aws.Int64(0),
-		},
-		"null int64": {
-			input:    types.Int64Null(),
-			expected: nil,
-		},
-		"unknown int64": {
-			input:    types.Int64Unknown(),
-			expected: nil,
-		},
-	}
-
-	for name, test := range tests {
-		name, test := name, test
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-
-			got := Int64FromFramework(context.Background(), test.input)
-
-			if diff := cmp.Diff(got, test.expected); diff != "" {
-				t.Errorf("unexpected diff (+wanted, -got): %s", diff)
-			}
-		})
-	}
-}
-
-func TestStringFromFramework(t *testing.T) {
-	t.Parallel()
-
-	type testCase struct {
-		input    types.String
-		expected *string
-	}
-	tests := map[string]testCase{
-		"valid string": {
-			input:    types.StringValue("TEST"),
-			expected: aws.String("TEST"),
-		},
-		"empty string": {
-			input:    types.StringValue(""),
-			expected: aws.String(""),
-		},
-		"null string": {
-			input:    types.StringNull(),
-			expected: nil,
-		},
-		"unknown string": {
-			input:    types.StringUnknown(),
-			expected: nil,
-		},
-	}
-
-	for name, test := range tests {
-		name, test := name, test
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-
-			got := StringFromFramework(context.Background(), test.input)
-
-			if diff := cmp.Diff(got, test.expected); diff != "" {
-				t.Errorf("unexpected diff (+wanted, -got): %s", diff)
-			}
-		})
-	}
-}
-
-func TestBoolToFramework(t *testing.T) {
-	t.Parallel()
-
-	type testCase struct {
-		input    *bool
-		expected types.Bool
-	}
-	tests := map[string]testCase{
-		"valid bool": {
-			input:    aws.Bool(true),
-			expected: types.BoolValue(true),
-		},
-		"nil bool": {
-			input:    nil,
-			expected: types.BoolNull(),
-		},
-	}
-
-	for name, test := range tests {
-		name, test := name, test
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-
-			got := BoolToFramework(context.Background(), test.input)
-
-			if diff := cmp.Diff(got, test.expected); diff != "" {
-				t.Errorf("unexpected diff (+wanted, -got): %s", diff)
-			}
-		})
-	}
-}
-
-func TestBoolToFrameworkLegacy(t *testing.T) {
-	t.Parallel()
-
-	type testCase struct {
-		input    *bool
-		expected types.Bool
-	}
-	tests := map[string]testCase{
-		"valid bool": {
-			input:    aws.Bool(true),
-			expected: types.BoolValue(true),
-		},
-		"nil bool": {
-			input:    nil,
-			expected: types.BoolValue(false),
-		},
-	}
-
-	for name, test := range tests {
-		name, test := name, test
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-
-			got := BoolToFrameworkLegacy(context.Background(), test.input)
-
-			if diff := cmp.Diff(got, test.expected); diff != "" {
-				t.Errorf("unexpected diff (+wanted, -got): %s", diff)
-			}
-		})
-	}
-}
-
-func TestInt64ToFramework(t *testing.T) {
-	t.Parallel()
-
-	type testCase struct {
-		input    *int64
-		expected types.Int64
-	}
-	tests := map[string]testCase{
-		"valid int64": {
-			input:    aws.Int64(42),
-			expected: types.Int64Value(42),
-		},
-		"zero int64": {
-			input:    aws.Int64(0),
-			expected: types.Int64Value(0),
-		},
-		"nil int64": {
-			input:    nil,
-			expected: types.Int64Null(),
-		},
-	}
-
-	for name, test := range tests {
-		name, test := name, test
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-
-			got := Int64ToFramework(context.Background(), test.input)
-
-			if diff := cmp.Diff(got, test.expected); diff != "" {
-				t.Errorf("unexpected diff (+wanted, -got): %s", diff)
-			}
-		})
-	}
-}
-
-func TestInt64ToFrameworkLegacy(t *testing.T) {
-	t.Parallel()
-
-	type testCase struct {
-		input    *int64
-		expected types.Int64
-	}
-	tests := map[string]testCase{
-		"valid int64": {
-			input:    aws.Int64(42),
-			expected: types.Int64Value(42),
-		},
-		"zero int64": {
-			input:    aws.Int64(0),
-			expected: types.Int64Value(0),
-		},
-		"nil int64": {
-			input:    nil,
-			expected: types.Int64Value(0),
-		},
-	}
-
-	for name, test := range tests {
-		name, test := name, test
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-
-			got := Int64ToFrameworkLegacy(context.Background(), test.input)
-
-			if diff := cmp.Diff(got, test.expected); diff != "" {
-				t.Errorf("unexpected diff (+wanted, -got): %s", diff)
-			}
-		})
-	}
-}
-
-func TestStringToFramework(t *testing.T) {
-	t.Parallel()
-
-	type testCase struct {
-		input    *string
-		expected types.String
-	}
-	tests := map[string]testCase{
-		"valid string": {
-			input:    aws.String("TEST"),
-			expected: types.StringValue("TEST"),
-		},
-		"empty string": {
-			input:    aws.String(""),
-			expected: types.StringValue(""),
-		},
-		"nil string": {
-			input:    nil,
-			expected: types.StringNull(),
-		},
-	}
-
-	for name, test := range tests {
-		name, test := name, test
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-
-			got := StringToFramework(context.Background(), test.input)
-
-			if diff := cmp.Diff(got, test.expected); diff != "" {
-				t.Errorf("unexpected diff (+wanted, -got): %s", diff)
-			}
-		})
-	}
-}
-
-func TestStringToFrameworkLegacy(t *testing.T) {
-	t.Parallel()
-
-	type testCase struct {
-		input    *string
-		expected types.String
-	}
-	tests := map[string]testCase{
-		"valid string": {
-			input:    aws.String("TEST"),
-			expected: types.StringValue("TEST"),
-		},
-		"empty string": {
-			input:    aws.String(""),
-			expected: types.StringValue(""),
-		},
-		"nil string": {
-			input:    nil,
-			expected: types.StringValue(""),
-		},
-	}
-
-	for name, test := range tests {
-		name, test := name, test
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-
-			got := StringToFrameworkLegacy(context.Background(), test.input)
-
-			if diff := cmp.Diff(got, test.expected); diff != "" {
-				t.Errorf("unexpected diff (+wanted, -got): %s", diff)
-			}
-		})
-	}
-}
-
-func TestStringToFrameworkWithTransform(t *testing.T) {
-	t.Parallel()
-
-	type testCase struct {
-		input    *string
-		expected types.String
-	}
-	tests := map[string]testCase{
-		"valid string": {
-			input:    aws.String("TEST"),
-			expected: types.StringValue("test"),
-		},
-		"empty string": {
-			input:    aws.String(""),
-			expected: types.StringValue(""),
-		},
-		"nil string": {
-			input:    nil,
-			expected: types.StringNull(),
-		},
-	}
-
-	for name, test := range tests {
-		name, test := name, test
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-
-			got := StringToFrameworkWithTransform(context.Background(), test.input, strings.ToLower)
-
-			if diff := cmp.Diff(got, test.expected); diff != "" {
-				t.Errorf("unexpected diff (+wanted, -got): %s", diff)
-			}
-		})
-	}
-}
-
-func TestStringValueToFramework(t *testing.T) {
-	t.Parallel()
-
-	// AWS enums use custom types with an underlying string type
-	type custom string
-
-	type testCase struct {
-		input    custom
-		expected types.String
-	}
-	tests := map[string]testCase{
-		"valid": {
-			input:    "TEST",
-			expected: types.StringValue("TEST"),
-		},
-		"empty": {
-			input:    "",
-			expected: types.StringNull(),
-		},
-	}
-
-	for name, test := range tests {
-		name, test := name, test
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-
-			got := StringValueToFramework(context.Background(), test.input)
-
-			if diff := cmp.Diff(got, test.expected); diff != "" {
-				t.Errorf("unexpected diff (+wanted, -got): %s", diff)
-			}
-		})
-	}
-}
-
-func TestStringValueToFrameworkLegacy(t *testing.T) {
-	t.Parallel()
-
-	// AWS enums use custom types with an underlying string type
-	type custom string
-
-	type testCase struct {
-		input    custom
-		expected types.String
-	}
-	tests := map[string]testCase{
-		"valid": {
-			input:    "TEST",
-			expected: types.StringValue("TEST"),
-		},
-		"empty": {
-			input:    "",
-			expected: types.StringValue(""),
-		},
-	}
-
-	for name, test := range tests {
-		name, test := name, test
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-
-			got := StringValueToFrameworkLegacy(context.Background(), test.input)
-
-			if diff := cmp.Diff(got, test.expected); diff != "" {
-				t.Errorf("unexpected diff (+wanted, -got): %s", diff)
-			}
-		})
-	}
-}
-
-func TestFloat64ToFramework(t *testing.T) {
-	t.Parallel()
-
-	type testCase struct {
-		input    *float64
-		expected types.Float64
-	}
-	tests := map[string]testCase{
-		"valid float64": {
-			input:    aws.Float64(42.1),
-			expected: types.Float64Value(42.1),
-		},
-		"zero float64": {
-			input:    aws.Float64(0),
-			expected: types.Float64Value(0),
-		},
-		"nil float64": {
-			input:    nil,
-			expected: types.Float64Null(),
-		},
-	}
-
-	for name, test := range tests {
-		name, test := name, test
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-
-			got := Float64ToFramework(context.Background(), test.input)
-
-			if diff := cmp.Diff(got, test.expected); diff != "" {
-				t.Errorf("unexpected diff (+wanted, -got): %s", diff)
-			}
-		})
-	}
-}
-
-func TestFloat64ToFrameworkLegacy(t *testing.T) {
-	t.Parallel()
-
-	type testCase struct {
-		input    *float64
-		expected types.Float64
-	}
-	tests := map[string]testCase{
-		"valid int64": {
-			input:    aws.Float64(42.1),
-			expected: types.Float64Value(42.1),
-		},
-		"zero int64": {
-			input:    aws.Float64(0),
-			expected: types.Float64Value(0),
-		},
-		"nil int64": {
-			input:    nil,
-			expected: types.Float64Value(0),
-		},
-	}
-
-	for name, test := range tests {
-		name, test := name, test
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-
-			got := Float64ToFrameworkLegacy(context.Background(), test.input)
-
-			if diff := cmp.Diff(got, test.expected); diff != "" {
-				t.Errorf("unexpected diff (+wanted, -got): %s", diff)
-			}
-		})
-	}
-}
-
-func TestSet_Difference_strings(t *testing.T) {
-	t.Parallel()
-
-	type testCase struct {
-		original Set[string]
-		new      Set[string]
-		expected Set[string]
-	}
-	tests := map[string]testCase{
-		"nil": {
-			original: nil,
-			new:      nil,
-			expected: nil,
-		},
-		"equal": {
-			original: Set[string]{"one"},
-			new:      Set[string]{"one"},
-			expected: nil,
-		},
-		"difference": {
-			original: Set[string]{"one", "two", "four"},
-			new:      Set[string]{"one", "two", "three"},
-			expected: Set[string]{"four"},
-		},
-		"difference_remove": {
-			original: Set[string]{"one", "two"},
-			new:      Set[string]{"one"},
-			expected: Set[string]{"two"},
-		},
-		"difference_add": {
-			original: Set[string]{"one"},
-			new:      Set[string]{"one", "two"},
-			expected: nil,
-		},
-	}
-
-	for name, test := range tests {
-		name, test := name, test
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-
-			got := test.original.Difference(test.new)
-			if diff := cmp.Diff(got, test.expected); diff != "" {
-				t.Errorf("unexpected diff (+wanted, -got): %s", diff)
-			}
-		})
-	}
-}
diff --git a/internal/framework/attrtypes.go b/internal/framework/attrtypes.go
deleted file mode 100644
index 6c93eedb479..00000000000
--- a/internal/framework/attrtypes.go
+++ /dev/null
@@ -1,50 +0,0 @@
-package framework
-
-import (
-	"context"
-	"fmt"
-	"reflect"
-
-	"github.com/hashicorp/terraform-plugin-framework/attr"
-)
-
-// AttributeTypes returns a map of attribute types for the specified type T.
-// T must be a struct and reflection is used to find exported fields of T with the `tfsdk` tag.
-func AttributeTypes[T any](ctx context.Context) (map[string]attr.Type, error) {
-	var t T
-	val := reflect.ValueOf(t)
-	typ := val.Type()
-
-	if typ.Kind() != reflect.Struct {
-		return nil, fmt.Errorf("%T has unsupported type: %s", t, typ)
-	}
-
-	attributeTypes := make(map[string]attr.Type)
-	for i := 0; i < typ.NumField(); i++ {
-		field := typ.Field(i)
-		if field.PkgPath != "" {
-			continue // Skip unexported fields.
-		}
-		tag := field.Tag.Get(`tfsdk`)
-		if tag == "-" {
-			continue // Skip explicitly excluded fields.
-		}
-		if tag == "" {
-			return nil, fmt.Errorf(`%T needs a struct tag for "tfsdk" on %s`, t, field.Name)
-		}
-
-		if v, ok := val.Field(i).Interface().(attr.Value); ok {
-			attributeTypes[tag] = v.Type(ctx)
-		}
-	}
-
-	return attributeTypes, nil
-}
-
-func AttributeTypesMust[T any](ctx context.Context) map[string]attr.Type {
-	types, err := AttributeTypes[T](ctx)
-	if err != nil {
-		panic(fmt.Sprintf("AttributeTypesMust[%T] received error: %s", *new(T), err))
-	}
-	return types
-}
diff --git a/internal/framework/attrtypes_test.go b/internal/framework/attrtypes_test.go
deleted file mode 100644
index 6244bf769fd..00000000000
--- a/internal/framework/attrtypes_test.go
+++ /dev/null
@@ -1,57 +0,0 @@
-package framework_test
-
-import (
-	"context"
-	"testing"
-
-	"github.com/google/go-cmp/cmp"
-	"github.com/hashicorp/terraform-plugin-framework/attr"
-	"github.com/hashicorp/terraform-plugin-framework/types"
-	"github.com/hashicorp/terraform-provider-aws/internal/framework"
-)
-
-func TestAttributeTypes(t *testing.T) {
-	t.Parallel()
-
-	type struct1 struct{}
-	type struct2 struct {
-		ARN             types.String `tfsdk:"arn"`
-		ID              types.Int64  `tfsdk:"id"`
-		IncludeProperty types.Bool   `tfsdk:"include_property"`
-	}
-
-	ctx := context.Background()
-	got, err := framework.AttributeTypes[struct1](ctx)
-
-	if err != nil {
-		t.Fatalf("unexpected error")
-	}
-
-	wanted := map[string]attr.Type{}
-
-	if diff := cmp.Diff(got, wanted); diff != "" {
-		t.Errorf("unexpected diff (+wanted, -got): %s", diff)
-	}
-
-	_, err = framework.AttributeTypes[int](ctx)
-
-	if err == nil {
-		t.Fatalf("expected error")
-	}
-
-	got, err = framework.AttributeTypes[struct2](ctx)
-
-	if err != nil {
-		t.Fatalf("unexpected error")
-	}
-
-	wanted = map[string]attr.Type{
-		"arn":              types.StringType,
-		"id":               types.Int64Type,
-		"include_property": types.BoolType,
-	}
-
-	if diff := cmp.Diff(got, wanted); diff != "" {
-		t.Errorf("unexpected diff (+wanted, -got): %s", diff)
-	}
-}
diff --git a/internal/framework/base.go b/internal/framework/base.go
index 908e6bfcd74..34065d92852 100644
--- a/internal/framework/base.go
+++ b/internal/framework/base.go
@@ -1,9 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package framework
 
 import (
 	"context"
 	"time"
 
+	"github.com/aws/aws-sdk-go-v2/aws/arn"
 	"github.com/hashicorp/terraform-plugin-framework-timeouts/resource/timeouts"
 	"github.com/hashicorp/terraform-plugin-framework/datasource"
 	"github.com/hashicorp/terraform-plugin-framework/path"
@@ -11,8 +15,9 @@ import (
 	"github.com/hashicorp/terraform-plugin-framework/types"
 	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
-	"github.com/hashicorp/terraform-provider-aws/internal/flex"
+	"github.com/hashicorp/terraform-provider-aws/internal/framework/flex"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
+	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
 type withMeta struct {
@@ -23,6 +28,17 @@ func (w *withMeta) Meta() *conns.AWSClient {
 	return w.meta
 }
 
+// RegionalARN returns a regional ARN for the specified service namespace and resource.
+func (w *withMeta) RegionalARN(service, resource string) string {
+	return arn.ARN{
+		Partition: w.meta.Partition,
+		Service:   service,
+		Region:    w.meta.Region,
+		AccountID: w.meta.AccountID,
+		Resource:  resource,
+	}.String()
+}
+
 type withMigratedFromPluginSDK struct {
 	migrated bool
 }
@@ -51,26 +67,6 @@ func (r *ResourceWithConfigure) Configure(_ context.Context, request resource.Co
 	}
 }
 
-// ExpandTags returns the API tags for the specified "tags" value.
-func (r *ResourceWithConfigure) ExpandTags(ctx context.Context, tags types.Map) tftags.KeyValueTags {
-	return r.Meta().DefaultTagsConfig.MergeTags(tftags.New(ctx, tags))
-}
-
-// FlattenTags returns the "tags" value from the specified API tags.
-func (r *ResourceWithConfigure) FlattenTags(ctx context.Context, apiTags tftags.KeyValueTags) types.Map {
-	// AWS APIs often return empty lists of tags when none have been configured.
-	if v := apiTags.IgnoreAWS().IgnoreConfig(r.Meta().IgnoreTagsConfig).RemoveDefaultConfig(r.Meta().DefaultTagsConfig).Map(); len(v) == 0 {
-		return tftags.Null
-	} else {
-		return flex.FlattenFrameworkStringValueMapLegacy(ctx, v)
-	}
-}
-
-// FlattenTagsAll returns the "tags_all" value from the specified API tags.
-func (r *ResourceWithConfigure) FlattenTagsAll(ctx context.Context, apiTags tftags.KeyValueTags) types.Map {
-	return flex.FlattenFrameworkStringValueMapLegacy(ctx, apiTags.IgnoreAWS().IgnoreConfig(r.Meta().IgnoreTagsConfig).Map())
-}
-
 // SetTagsAll calculates the new value for the `tags_all` attribute.
 func (r *ResourceWithConfigure) SetTagsAll(ctx context.Context, request resource.ModifyPlanRequest, response *resource.ModifyPlanResponse) {
 	// If the entire plan is null, the resource is planned for destruction.
@@ -83,7 +79,7 @@ func (r *ResourceWithConfigure) SetTagsAll(ctx context.Context, request resource
 
 	var planTags types.Map
 
-	response.Diagnostics.Append(request.Plan.GetAttribute(ctx, path.Root("tags"), &planTags)...)
+	response.Diagnostics.Append(request.Plan.GetAttribute(ctx, path.Root(names.AttrTags), &planTags)...)
 
 	if response.Diagnostics.HasError() {
 		return
@@ -92,18 +88,25 @@ func (r *ResourceWithConfigure) SetTagsAll(ctx context.Context, request resource
 	if !planTags.IsUnknown() {
 		if !mapHasUnknownElements(planTags) {
 			resourceTags := tftags.New(ctx, planTags)
-
 			allTags := defaultTagsConfig.MergeTags(resourceTags).IgnoreConfig(ignoreTagsConfig)
 
-			response.Diagnostics.Append(response.Plan.SetAttribute(ctx, path.Root("tags_all"), flex.FlattenFrameworkStringValueMapLegacy(ctx, allTags.Map()))...)
+			response.Diagnostics.Append(response.Plan.SetAttribute(ctx, path.Root(names.AttrTagsAll), flex.FlattenFrameworkStringValueMapLegacy(ctx, allTags.Map()))...)
 		} else {
-			response.Diagnostics.Append(response.Plan.SetAttribute(ctx, path.Root("tags_all"), tftags.Unknown)...)
+			response.Diagnostics.Append(response.Plan.SetAttribute(ctx, path.Root(names.AttrTagsAll), tftags.Unknown)...)
 		}
 	} else {
-		response.Diagnostics.Append(response.Plan.SetAttribute(ctx, path.Root("tags_all"), tftags.Unknown)...)
+		response.Diagnostics.Append(response.Plan.SetAttribute(ctx, path.Root(names.AttrTagsAll), tftags.Unknown)...)
 	}
 }
 
+// WithImportByID is intended to be embedded in resources which import state via the "id" attribute.
+// See https://developer.hashicorp.com/terraform/plugin/framework/resources/import.
+type WithImportByID struct{}
+
+func (w *WithImportByID) ImportState(ctx context.Context, request resource.ImportStateRequest, response *resource.ImportStateResponse) {
+	resource.ImportStatePassthroughID(ctx, path.Root(names.AttrID), request, response)
+}
+
 // DataSourceWithConfigure is a structure to be embedded within a DataSource that implements the DataSourceWithConfigure interface.
 type DataSourceWithConfigure struct {
 	withMeta
@@ -119,7 +122,7 @@ func (d *DataSourceWithConfigure) Configure(_ context.Context, request datasourc
 	}
 }
 
-// WithTimeouts is intended to be embedded in resource which use the special "timeouts" nested block.
+// WithTimeouts is intended to be embedded in resources which use the special "timeouts" nested block.
 // See https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts.
 type WithTimeouts struct {
 	defaultCreateTimeout, defaultReadTimeout, defaultUpdateTimeout, defaultDeleteTimeout time.Duration
diff --git a/internal/framework/boolplanmodifier/default_value.go b/internal/framework/boolplanmodifier/default_value.go
deleted file mode 100644
index 3f98c62e60d..00000000000
--- a/internal/framework/boolplanmodifier/default_value.go
+++ /dev/null
@@ -1,42 +0,0 @@
-package boolplanmodifier
-
-import (
-	"context"
-	"fmt"
-
-	"github.com/hashicorp/terraform-plugin-framework/resource/schema/planmodifier"
-	"github.com/hashicorp/terraform-plugin-framework/types"
-)
-
-type defaultValue struct {
-	val bool
-}
-
-// DefaultValue return a bool plan modifier that sets the specified value if the planned value is Null.
-func DefaultValue(b bool) planmodifier.Bool {
-	return defaultValue{
-		val: b,
-	}
-}
-
-func (m defaultValue) Description(context.Context) string {
-	return fmt.Sprintf("If value is not configured, defaults to %t", m.val)
-}
-
-func (m defaultValue) MarkdownDescription(ctx context.Context) string {
-	return m.Description(ctx)
-}
-
-func (m defaultValue) PlanModifyBool(ctx context.Context, req planmodifier.BoolRequest, resp *planmodifier.BoolResponse) {
-	if !req.ConfigValue.IsNull() {
-		return
-	}
-
-	// If the attribute plan is "known" and "not null", then a previous plan modifier in the sequence
-	// has already been applied, and we don't want to interfere.
-	if !req.PlanValue.IsUnknown() && !req.PlanValue.IsNull() {
-		return
-	}
-
-	resp.PlanValue = types.BoolValue(m.val)
-}
diff --git a/internal/framework/boolplanmodifier/default_value_test.go b/internal/framework/boolplanmodifier/default_value_test.go
deleted file mode 100644
index 06554f68e0f..00000000000
--- a/internal/framework/boolplanmodifier/default_value_test.go
+++ /dev/null
@@ -1,67 +0,0 @@
-package boolplanmodifier
-
-import (
-	"context"
-	"testing"
-
-	"github.com/google/go-cmp/cmp"
-	"github.com/hashicorp/terraform-plugin-framework/path"
-	"github.com/hashicorp/terraform-plugin-framework/resource/schema/planmodifier"
-	"github.com/hashicorp/terraform-plugin-framework/types"
-)
-
-func TestDefaultValue(t *testing.T) {
-	t.Parallel()
-
-	type testCase struct {
-		plannedValue  types.Bool
-		currentValue  types.Bool
-		defaultValue  bool
-		expectedValue types.Bool
-		expectError   bool
-	}
-	tests := map[string]testCase{
-		"default bool": {
-			plannedValue:  types.BoolNull(),
-			currentValue:  types.BoolValue(true),
-			defaultValue:  true,
-			expectedValue: types.BoolValue(true),
-		},
-		"default bool on create": {
-			plannedValue:  types.BoolNull(),
-			currentValue:  types.BoolNull(),
-			defaultValue:  true,
-			expectedValue: types.BoolValue(true),
-		},
-	}
-
-	for name, test := range tests {
-		name, test := name, test
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-
-			ctx := context.Background()
-			request := planmodifier.BoolRequest{
-				Path:       path.Root("test"),
-				PlanValue:  test.plannedValue,
-				StateValue: test.currentValue,
-			}
-			response := planmodifier.BoolResponse{
-				PlanValue: request.PlanValue,
-			}
-			DefaultValue(test.defaultValue).PlanModifyBool(ctx, request, &response)
-
-			if !response.Diagnostics.HasError() && test.expectError {
-				t.Fatal("expected error, got no error")
-			}
-
-			if response.Diagnostics.HasError() && !test.expectError {
-				t.Fatalf("got unexpected error: %s", response.Diagnostics)
-			}
-
-			if diff := cmp.Diff(response.PlanValue, test.expectedValue); diff != "" {
-				t.Errorf("unexpected diff (+wanted, -got): %s", diff)
-			}
-		})
-	}
-}
diff --git a/internal/framework/flex/attrtypes.go b/internal/framework/flex/attrtypes.go
new file mode 100644
index 00000000000..f028db4929f
--- /dev/null
+++ b/internal/framework/flex/attrtypes.go
@@ -0,0 +1,50 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package flex
+
+import (
+	"context"
+	"fmt"
+	"reflect"
+
+	"github.com/hashicorp/terraform-plugin-framework/attr"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs"
+)
+
+// AttributeTypes returns a map of attribute types for the specified type T.
+// T must be a struct and reflection is used to find exported fields of T with the `tfsdk` tag.
+func AttributeTypes[T any](ctx context.Context) (map[string]attr.Type, error) {
+	var t T
+	val := reflect.ValueOf(t)
+	typ := val.Type()
+
+	if typ.Kind() != reflect.Struct {
+		return nil, fmt.Errorf("%T has unsupported type: %s", t, typ)
+	}
+
+	attributeTypes := make(map[string]attr.Type)
+	for i := 0; i < typ.NumField(); i++ {
+		field := typ.Field(i)
+		if field.PkgPath != "" {
+			continue // Skip unexported fields.
+		}
+		tag := field.Tag.Get(`tfsdk`)
+		if tag == "-" {
+			continue // Skip explicitly excluded fields.
+		}
+		if tag == "" {
+			return nil, fmt.Errorf(`%T needs a struct tag for "tfsdk" on %s`, t, field.Name)
+		}
+
+		if v, ok := val.Field(i).Interface().(attr.Value); ok {
+			attributeTypes[tag] = v.Type(ctx)
+		}
+	}
+
+	return attributeTypes, nil
+}
+
+func AttributeTypesMust[T any](ctx context.Context) map[string]attr.Type {
+	return errs.Must(AttributeTypes[T](ctx))
+}
diff --git a/internal/framework/flex/attrtypes_test.go b/internal/framework/flex/attrtypes_test.go
new file mode 100644
index 00000000000..763d10b72cb
--- /dev/null
+++ b/internal/framework/flex/attrtypes_test.go
@@ -0,0 +1,55 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package flex_test
+
+import (
+	"context"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/hashicorp/terraform-plugin-framework/attr"
+	"github.com/hashicorp/terraform-plugin-framework/types"
+	"github.com/hashicorp/terraform-provider-aws/internal/framework/flex"
+)
+
+func TestAttributeTypes(t *testing.T) {
+	t.Parallel()
+
+	type struct1 struct{}
+	type struct2 struct {
+		ARN             types.String `tfsdk:"arn"`
+		ID              types.Int64  `tfsdk:"id"`
+		IncludeProperty types.Bool   `tfsdk:"include_property"`
+	}
+
+	ctx := context.Background()
+	got := flex.AttributeTypesMust[struct1](ctx)
+	wanted := map[string]attr.Type{}
+
+	if diff := cmp.Diff(got, wanted); diff != "" {
+		t.Errorf("unexpected diff (+wanted, -got): %s", diff)
+	}
+
+	_, err := flex.AttributeTypes[int](ctx)
+
+	if err == nil {
+		t.Fatalf("expected error")
+	}
+
+	got, err = flex.AttributeTypes[struct2](ctx)
+
+	if err != nil {
+		t.Fatalf("unexpected error")
+	}
+
+	wanted = map[string]attr.Type{
+		"arn":              types.StringType,
+		"id":               types.Int64Type,
+		"include_property": types.BoolType,
+	}
+
+	if diff := cmp.Diff(got, wanted); diff != "" {
+		t.Errorf("unexpected diff (+wanted, -got): %s", diff)
+	}
+}
diff --git a/internal/framework/flex/autoflex.go b/internal/framework/flex/autoflex.go
new file mode 100644
index 00000000000..dfc51aa6da5
--- /dev/null
+++ b/internal/framework/flex/autoflex.go
@@ -0,0 +1,1289 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package flex
+
+import (
+	"context"
+	"fmt"
+	"reflect"
+	"strings"
+
+	pluralize "github.com/gertd/go-pluralize"
+	"github.com/hashicorp/terraform-plugin-framework/attr"
+	"github.com/hashicorp/terraform-plugin-framework/diag"
+	"github.com/hashicorp/terraform-plugin-framework/types"
+	"github.com/hashicorp/terraform-plugin-framework/types/basetypes"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
+	fwtypes "github.com/hashicorp/terraform-provider-aws/internal/framework/types"
+)
+
+// Expand "expands" a resource's "business logic" data structure,
+// implemented using Terraform Plugin Framework data types, into
+// an AWS SDK for Go v2 API data structure.
+// The resource's data structure is walked and exported fields that
+// have a corresponding field in the API data structure (and a suitable
+// target data type) are copied.
+func Expand(ctx context.Context, tfObject, apiObject any, optFns ...AutoFlexOptionsFunc) diag.Diagnostics {
+	var diags diag.Diagnostics
+	expander := &autoExpander{}
+
+	for _, optFn := range optFns {
+		optFn(expander)
+	}
+
+	diags.Append(autoFlexConvert(ctx, tfObject, apiObject, expander)...)
+	if diags.HasError() {
+		diags.AddError("AutoFlEx", fmt.Sprintf("Expand[%T, %T]", tfObject, apiObject))
+		return diags
+	}
+
+	return diags
+}
+
+// Flatten "flattens" an AWS SDK for Go v2 API data structure into
+// a resource's "business logic" data structure, implemented using
+// Terraform Plugin Framework data types.
+// The API data structure's fields are walked and exported fields that
+// have a corresponding field in the resource's data structure (and a
+// suitable target data type) are copied.
+func Flatten(ctx context.Context, apiObject, tfObject any, optFns ...AutoFlexOptionsFunc) diag.Diagnostics {
+	var diags diag.Diagnostics
+	flattener := &autoFlattener{}
+
+	for _, optFn := range optFns {
+		optFn(flattener)
+	}
+
+	diags.Append(autoFlexConvert(ctx, apiObject, tfObject, flattener)...)
+	if diags.HasError() {
+		diags.AddError("AutoFlEx", fmt.Sprintf("Flatten[%T, %T]", apiObject, tfObject))
+		return diags
+	}
+
+	return diags
+}
+
+// autoFlexer is the interface implemented by an auto-flattener or expander.
+type autoFlexer interface {
+	convert(context.Context, reflect.Value, reflect.Value) diag.Diagnostics
+}
+
+// AutoFlexOptionsFunc is a type alias for an autoFlexer functional option.
+type AutoFlexOptionsFunc func(autoFlexer)
+
+type autoExpander struct{}
+
+type autoFlattener struct{}
+
+// autoFlexConvert converts `from` to `to` using the specified auto-flexer.
+func autoFlexConvert(ctx context.Context, from, to any, flexer autoFlexer) diag.Diagnostics {
+	var diags diag.Diagnostics
+
+	valFrom, valTo, d := autoFlexValues(ctx, from, to)
+	diags.Append(d...)
+	if diags.HasError() {
+		return diags
+	}
+
+	// Top-level struct to struct conversion.
+	if valFrom.IsValid() && valTo.IsValid() {
+		if typFrom, typTo := valFrom.Type(), valTo.Type(); typFrom.Kind() == reflect.Struct && typTo.Kind() == reflect.Struct {
+			diags.Append(autoFlexConvertStruct(ctx, from, to, flexer)...)
+			return diags
+		}
+	}
+
+	// Anything else.
+	diags.Append(flexer.convert(ctx, valFrom, valTo)...)
+	return diags
+}
+
+// autoFlexValues returns the underlying `reflect.Value`s of `from` and `to`.
+func autoFlexValues(_ context.Context, from, to any) (reflect.Value, reflect.Value, diag.Diagnostics) {
+	var diags diag.Diagnostics
+
+	valFrom, valTo := reflect.ValueOf(from), reflect.ValueOf(to)
+	if kind := valFrom.Kind(); kind == reflect.Ptr {
+		valFrom = valFrom.Elem()
+	}
+	if kind := valTo.Kind(); kind != reflect.Ptr {
+		diags.AddError("AutoFlEx", fmt.Sprintf("target (%T): %s, want pointer", to, kind))
+		return reflect.Value{}, reflect.Value{}, diags
+	}
+	valTo = valTo.Elem()
+
+	return valFrom, valTo, diags
+}
+
+var (
+	plural = pluralize.NewClient()
+)
+
+// autoFlexConvertStruct traverses struct `from` calling `flexer` for each exported field.
+func autoFlexConvertStruct(ctx context.Context, from any, to any, flexer autoFlexer) diag.Diagnostics {
+	var diags diag.Diagnostics
+
+	valFrom, valTo, d := autoFlexValues(ctx, from, to)
+	diags.Append(d...)
+	if diags.HasError() {
+		return diags
+	}
+
+	for i, typFrom := 0, valFrom.Type(); i < typFrom.NumField(); i++ {
+		field := typFrom.Field(i)
+		if field.PkgPath != "" {
+			continue // Skip unexported fields.
+		}
+		fieldName := field.Name
+		if fieldName == "Tags" {
+			continue // Resource tags are handled separately.
+		}
+		toFieldVal := findFieldFuzzy(fieldName, valTo)
+		if !toFieldVal.IsValid() {
+			continue // Corresponding field not found in to.
+		}
+		if !toFieldVal.CanSet() {
+			continue // Corresponding field value can't be changed.
+		}
+		diags.Append(flexer.convert(ctx, valFrom.Field(i), toFieldVal)...)
+		if diags.HasError() {
+			diags.AddError("AutoFlEx", fmt.Sprintf("convert (%s)", fieldName))
+			return diags
+		}
+	}
+
+	return diags
+}
+
+func findFieldFuzzy(fieldNameFrom string, valTo reflect.Value) reflect.Value {
+	// first precedence is exact match (case sensitive)
+	if v := valTo.FieldByName(fieldNameFrom); v.IsValid() {
+		return v
+	}
+
+	// second precedence is exact match (case insensitive)
+	for i, typTo := 0, valTo.Type(); i < typTo.NumField(); i++ {
+		field := typTo.Field(i)
+		if field.PkgPath != "" {
+			continue // Skip unexported fields.
+		}
+		fieldNameTo := field.Name
+		if fieldNameTo == "Tags" {
+			continue // Resource tags are handled separately.
+		}
+		if v := valTo.FieldByName(fieldNameTo); v.IsValid() && strings.EqualFold(fieldNameFrom, fieldNameTo) {
+			// probably could assume validity here since reflect gave the field name
+			return v
+		}
+	}
+
+	// third precedence is singular/plural
+	if plural.IsSingular(fieldNameFrom) {
+		if v := valTo.FieldByName(plural.Plural(fieldNameFrom)); v.IsValid() {
+			return v
+		}
+	}
+
+	if plural.IsPlural(fieldNameFrom) {
+		if v := valTo.FieldByName(plural.Singular(fieldNameFrom)); v.IsValid() {
+			return v
+		}
+	}
+
+	// no finds, fuzzy or otherwise - return invalid
+	return valTo.FieldByName(fieldNameFrom)
+}
+
+// convert converts a single Plugin Framework value to its AWS API equivalent.
+func (expander autoExpander) convert(ctx context.Context, valFrom, vTo reflect.Value) diag.Diagnostics {
+	var diags diag.Diagnostics
+
+	vFrom, ok := valFrom.Interface().(attr.Value)
+	if !ok {
+		diags.AddError("AutoFlEx", fmt.Sprintf("does not implement attr.Value: %s", valFrom.Kind()))
+		return diags
+	}
+
+	// No need to set the target value if there's no source value.
+	if vFrom.IsNull() || vFrom.IsUnknown() {
+		return diags
+	}
+
+	switch vFrom := vFrom.(type) {
+	// Primitive types.
+	case basetypes.BoolValuable:
+		diags.Append(expander.bool(ctx, vFrom, vTo)...)
+		return diags
+
+	case basetypes.Float64Valuable:
+		diags.Append(expander.float64(ctx, vFrom, vTo)...)
+		return diags
+
+	case basetypes.Int64Valuable:
+		diags.Append(expander.int64(ctx, vFrom, vTo)...)
+		return diags
+
+	case basetypes.StringValuable:
+		diags.Append(expander.string(ctx, vFrom, vTo)...)
+		return diags
+
+	// Aggregate types.
+	case basetypes.ListValuable:
+		diags.Append(expander.list(ctx, vFrom, vTo)...)
+		return diags
+
+	case basetypes.MapValuable:
+		diags.Append(expander.map_(ctx, vFrom, vTo)...)
+		return diags
+
+	case basetypes.SetValuable:
+		diags.Append(expander.set(ctx, vFrom, vTo)...)
+		return diags
+	}
+
+	tflog.Info(ctx, "AutoFlex Expand; incompatible types", map[string]interface{}{
+		"from": vFrom.Type(ctx),
+		"to":   vTo.Kind(),
+	})
+
+	return diags
+}
+
+// bool copies a Plugin Framework Bool(ish) value to a compatible AWS API value.
+func (expander autoExpander) bool(ctx context.Context, vFrom basetypes.BoolValuable, vTo reflect.Value) diag.Diagnostics {
+	var diags diag.Diagnostics
+
+	v, d := vFrom.ToBoolValue(ctx)
+	diags.Append(d...)
+	if diags.HasError() {
+		return diags
+	}
+
+	switch vTo.Kind() {
+	case reflect.Bool:
+		//
+		// types.Bool -> bool.
+		//
+		vTo.SetBool(v.ValueBool())
+		return diags
+
+	case reflect.Ptr:
+		switch vTo.Type().Elem().Kind() {
+		case reflect.Bool:
+			//
+			// types.Bool -> *bool.
+			//
+			vTo.Set(reflect.ValueOf(v.ValueBoolPointer()))
+			return diags
+		}
+	}
+
+	tflog.Info(ctx, "AutoFlex Expand; incompatible types", map[string]interface{}{
+		"from": vFrom.Type(ctx),
+		"to":   vTo.Kind(),
+	})
+
+	return diags
+}
+
+// float64 copies a Plugin Framework Float64(ish) value to a compatible AWS API value.
+func (expander autoExpander) float64(ctx context.Context, vFrom basetypes.Float64Valuable, vTo reflect.Value) diag.Diagnostics {
+	var diags diag.Diagnostics
+
+	v, d := vFrom.ToFloat64Value(ctx)
+	diags.Append(d...)
+	if diags.HasError() {
+		return diags
+	}
+
+	switch vTo.Kind() {
+	case reflect.Float32, reflect.Float64:
+		//
+		// types.Float32/types.Float64 -> float32/float64.
+		//
+		vTo.SetFloat(v.ValueFloat64())
+		return diags
+
+	case reflect.Ptr:
+		switch vTo.Type().Elem().Kind() {
+		case reflect.Float32:
+			//
+			// types.Float32/types.Float64 -> *float32.
+			//
+			to := float32(v.ValueFloat64())
+			vTo.Set(reflect.ValueOf(&to))
+			return diags
+
+		case reflect.Float64:
+			//
+			// types.Float32/types.Float64 -> *float64.
+			//
+			vTo.Set(reflect.ValueOf(v.ValueFloat64Pointer()))
+			return diags
+		}
+	}
+
+	tflog.Info(ctx, "AutoFlex Expand; incompatible types", map[string]interface{}{
+		"from": vFrom.Type(ctx),
+		"to":   vTo.Kind(),
+	})
+
+	return diags
+}
+
+// int64 copies a Plugin Framework Int64(ish) value to a compatible AWS API value.
+func (expander autoExpander) int64(ctx context.Context, vFrom basetypes.Int64Valuable, vTo reflect.Value) diag.Diagnostics {
+	var diags diag.Diagnostics
+
+	v, d := vFrom.ToInt64Value(ctx)
+	diags.Append(d...)
+	if diags.HasError() {
+		return diags
+	}
+
+	switch vTo.Kind() {
+	case reflect.Int32, reflect.Int64:
+		//
+		// types.Int32/types.Int64 -> int32/int64.
+		//
+		vTo.SetInt(v.ValueInt64())
+		return diags
+
+	case reflect.Ptr:
+		switch vTo.Type().Elem().Kind() {
+		case reflect.Int32:
+			//
+			// types.Int32/types.Int64 -> *int32.
+			//
+			to := int32(v.ValueInt64())
+			vTo.Set(reflect.ValueOf(&to))
+			return diags
+
+		case reflect.Int64:
+			//
+			// types.Int32/types.Int64 -> *int64.
+			//
+			vTo.Set(reflect.ValueOf(v.ValueInt64Pointer()))
+			return diags
+		}
+	}
+
+	tflog.Info(ctx, "AutoFlex Expand; incompatible types", map[string]interface{}{
+		"from": vFrom.Type(ctx),
+		"to":   vTo.Kind(),
+	})
+
+	return diags
+}
+
+// string copies a Plugin Framework String(ish) value to a compatible AWS API value.
+func (expander autoExpander) string(ctx context.Context, vFrom basetypes.StringValuable, vTo reflect.Value) diag.Diagnostics {
+	var diags diag.Diagnostics
+
+	v, d := vFrom.ToStringValue(ctx)
+	diags.Append(d...)
+	if diags.HasError() {
+		return diags
+	}
+
+	switch vTo.Kind() {
+	case reflect.String:
+		//
+		// types.String -> string.
+		//
+		vTo.SetString(v.ValueString())
+		return diags
+
+	case reflect.Ptr:
+		switch vTo.Type().Elem().Kind() {
+		case reflect.String:
+			//
+			// types.String -> *string.
+			//
+			vTo.Set(reflect.ValueOf(v.ValueStringPointer()))
+			return diags
+		}
+	}
+
+	tflog.Info(ctx, "AutoFlex Expand; incompatible types", map[string]interface{}{
+		"from": vFrom.Type(ctx),
+		"to":   vTo.Kind(),
+	})
+
+	return diags
+}
+
+// list copies a Plugin Framework List(ish) value to a compatible AWS API value.
+func (expander autoExpander) list(ctx context.Context, vFrom basetypes.ListValuable, vTo reflect.Value) diag.Diagnostics {
+	var diags diag.Diagnostics
+
+	v, d := vFrom.ToListValue(ctx)
+	diags.Append(d...)
+	if diags.HasError() {
+		return diags
+	}
+
+	switch v.ElementType(ctx).(type) {
+	case basetypes.StringTypable:
+		diags.Append(expander.listOfString(ctx, v, vTo)...)
+		return diags
+
+	case basetypes.ObjectTypable:
+		if vFrom, ok := vFrom.(fwtypes.NestedObjectValue); ok {
+			diags.Append(expander.nestedObject(ctx, vFrom, vTo)...)
+			return diags
+		}
+	}
+
+	tflog.Info(ctx, "AutoFlex Expand; incompatible types", map[string]interface{}{
+		"from list[%s]": v.ElementType(ctx),
+		"to":            vTo.Kind(),
+	})
+
+	return diags
+}
+
+// listOfString copies a Plugin Framework ListOfString(ish) value to a compatible AWS API value.
+func (expander autoExpander) listOfString(ctx context.Context, vFrom basetypes.ListValue, vTo reflect.Value) diag.Diagnostics {
+	var diags diag.Diagnostics
+
+	switch vTo.Kind() {
+	case reflect.Slice:
+		switch tSliceElem := vTo.Type().Elem(); tSliceElem.Kind() {
+		case reflect.String:
+			//
+			// types.List(OfString) -> []string.
+			//
+			var to []string
+			diags.Append(vFrom.ElementsAs(ctx, &to, false)...)
+			if diags.HasError() {
+				return diags
+			}
+
+			vTo.Set(reflect.ValueOf(to))
+			return diags
+
+		case reflect.Ptr:
+			switch tSliceElem.Elem().Kind() {
+			case reflect.String:
+				//
+				// types.List(OfString) -> []*string.
+				//
+				var to []*string
+				diags.Append(vFrom.ElementsAs(ctx, &to, false)...)
+				if diags.HasError() {
+					return diags
+				}
+
+				vTo.Set(reflect.ValueOf(to))
+				return diags
+			}
+		}
+	}
+
+	tflog.Info(ctx, "AutoFlex Expand; incompatible types", map[string]interface{}{
+		"from list[%s]": vFrom.ElementType(ctx),
+		"to":            vTo.Kind(),
+	})
+
+	return diags
+}
+
+// map_ copies a Plugin Framework Map(ish) value to a compatible AWS API value.
+func (expander autoExpander) map_(ctx context.Context, vFrom basetypes.MapValuable, vTo reflect.Value) diag.Diagnostics {
+	var diags diag.Diagnostics
+
+	v, d := vFrom.ToMapValue(ctx)
+	diags.Append(d...)
+	if diags.HasError() {
+		return diags
+	}
+
+	switch v.ElementType(ctx).(type) {
+	case basetypes.StringTypable:
+		diags.Append(expander.mapOfString(ctx, v, vTo)...)
+		return diags
+	}
+
+	tflog.Info(ctx, "AutoFlex Expand; incompatible types", map[string]interface{}{
+		"from map[string, %s]": v.ElementType(ctx),
+		"to":                   vTo.Kind(),
+	})
+
+	return diags
+}
+
+// mapOfString copies a Plugin Framework MapOfString(ish) value to a compatible AWS API value.
+func (expander autoExpander) mapOfString(ctx context.Context, vFrom basetypes.MapValue, vTo reflect.Value) diag.Diagnostics {
+	var diags diag.Diagnostics
+
+	switch vTo.Kind() {
+	case reflect.Map:
+		switch tMapKey := vTo.Type().Key(); tMapKey.Kind() {
+		case reflect.String:
+			switch tMapElem := vTo.Type().Elem(); tMapElem.Kind() {
+			case reflect.String:
+				//
+				// types.Map(OfString) -> map[string]string.
+				//
+				var to map[string]string
+				diags.Append(vFrom.ElementsAs(ctx, &to, false)...)
+				if diags.HasError() {
+					return diags
+				}
+
+				vTo.Set(reflect.ValueOf(to))
+				return diags
+
+			case reflect.Ptr:
+				switch tMapElem.Elem().Kind() {
+				case reflect.String:
+					//
+					// types.Map(OfString) -> map[string]*string.
+					//
+					var to map[string]*string
+					diags.Append(vFrom.ElementsAs(ctx, &to, false)...)
+					if diags.HasError() {
+						return diags
+					}
+
+					vTo.Set(reflect.ValueOf(to))
+					return diags
+				}
+			}
+		}
+	}
+
+	tflog.Info(ctx, "AutoFlex Expand; incompatible types", map[string]interface{}{
+		"from map[string, %s]": vFrom.ElementType(ctx),
+		"to":                   vTo.Kind(),
+	})
+
+	return diags
+}
+
+// set copies a Plugin Framework Set(ish) value to a compatible AWS API value.
+func (expander autoExpander) set(ctx context.Context, vFrom basetypes.SetValuable, vTo reflect.Value) diag.Diagnostics {
+	var diags diag.Diagnostics
+
+	v, d := vFrom.ToSetValue(ctx)
+	diags.Append(d...)
+	if diags.HasError() {
+		return diags
+	}
+
+	switch v.ElementType(ctx).(type) {
+	case basetypes.StringTypable:
+		diags.Append(expander.setOfString(ctx, v, vTo)...)
+		return diags
+
+	case basetypes.ObjectTypable:
+		if vFrom, ok := vFrom.(fwtypes.NestedObjectValue); ok {
+			diags.Append(expander.nestedObject(ctx, vFrom, vTo)...)
+			return diags
+		}
+	}
+
+	tflog.Info(ctx, "AutoFlex Expand; incompatible types", map[string]interface{}{
+		"from set[%s]": v.ElementType(ctx),
+		"to":           vTo.Kind(),
+	})
+
+	return diags
+}
+
+// setOfString copies a Plugin Framework SetOfString(ish) value to a compatible AWS API value.
+func (expander autoExpander) setOfString(ctx context.Context, vFrom basetypes.SetValue, vTo reflect.Value) diag.Diagnostics {
+	var diags diag.Diagnostics
+
+	switch vTo.Kind() {
+	case reflect.Slice:
+		switch tSliceElem := vTo.Type().Elem(); tSliceElem.Kind() {
+		case reflect.String:
+			//
+			// types.Set(OfString) -> []string.
+			//
+			var to []string
+			diags.Append(vFrom.ElementsAs(ctx, &to, false)...)
+			if diags.HasError() {
+				return diags
+			}
+
+			vTo.Set(reflect.ValueOf(to))
+			return diags
+
+		case reflect.Ptr:
+			switch tSliceElem.Elem().Kind() {
+			case reflect.String:
+				//
+				// types.Set(OfString) -> []*string.
+				//
+				var to []*string
+				diags.Append(vFrom.ElementsAs(ctx, &to, false)...)
+				if diags.HasError() {
+					return diags
+				}
+
+				vTo.Set(reflect.ValueOf(to))
+				return diags
+			}
+		}
+	}
+
+	tflog.Info(ctx, "AutoFlex Expand; incompatible types", map[string]interface{}{
+		"from set[%s]": vFrom.ElementType(ctx),
+		"to":           vTo.Kind(),
+	})
+
+	return diags
+}
+
+// nestedObject copies a Plugin Framework NestedObjectValue value to a compatible AWS API value.
+func (expander autoExpander) nestedObject(ctx context.Context, vFrom fwtypes.NestedObjectValue, vTo reflect.Value) diag.Diagnostics {
+	var diags diag.Diagnostics
+
+	switch tTo := vTo.Type(); vTo.Kind() {
+	case reflect.Ptr:
+		switch tElem := tTo.Elem(); tElem.Kind() {
+		case reflect.Struct:
+			//
+			// types.List(OfObject) -> *struct.
+			//
+			diags.Append(expander.nestedObjectToStruct(ctx, vFrom, tElem, vTo)...)
+			return diags
+		}
+
+	case reflect.Slice:
+		switch tElem := tTo.Elem(); tElem.Kind() {
+		case reflect.Struct:
+			//
+			// types.List(OfObject) -> []struct.
+			//
+			diags.Append(expander.nestedObjectToSlice(ctx, vFrom, tTo, tElem, vTo)...)
+			return diags
+
+		case reflect.Ptr:
+			switch tElem := tElem.Elem(); tElem.Kind() {
+			case reflect.Struct:
+				//
+				// types.List(OfObject) -> []*struct.
+				//
+				diags.Append(expander.nestedObjectToSlice(ctx, vFrom, tTo, tElem, vTo)...)
+				return diags
+			}
+		}
+	}
+
+	diags.AddError("Incompatible types", fmt.Sprintf("nestedObject[%s] cannot be expanded to %s", vFrom.Type(ctx).(attr.TypeWithElementType).ElementType(), vTo.Kind()))
+	return diags
+}
+
+// nestedObjectToStruct copies a Plugin Framework NestedObjectValue to a compatible AWS API (*)struct value.
+func (expander autoExpander) nestedObjectToStruct(ctx context.Context, vFrom fwtypes.NestedObjectValue, tStruct reflect.Type, vTo reflect.Value) diag.Diagnostics {
+	var diags diag.Diagnostics
+
+	// Get the nested Object as a pointer.
+	from, d := vFrom.ToObjectPtr(ctx)
+	diags.Append(d...)
+	if diags.HasError() {
+		return diags
+	}
+
+	// Create a new target structure and walk its fields.
+	to := reflect.New(tStruct)
+	diags.Append(autoFlexConvertStruct(ctx, from, to.Interface(), expander)...)
+	if diags.HasError() {
+		return diags
+	}
+
+	// Set value (or pointer).
+	if vTo.Type().Kind() == reflect.Struct {
+		vTo.Set(to.Elem())
+	} else {
+		vTo.Set(to)
+	}
+
+	return diags
+}
+
+// nestedObjectToSlice copies a Plugin Framework NestedObjectValue to a compatible AWS API [](*)struct value.
+func (expander autoExpander) nestedObjectToSlice(ctx context.Context, vFrom fwtypes.NestedObjectValue, tSlice, tElem reflect.Type, vTo reflect.Value) diag.Diagnostics {
+	var diags diag.Diagnostics
+
+	// Get the nested Objects as a slice.
+	from, d := vFrom.ToObjectSlice(ctx)
+	diags.Append(d...)
+	if diags.HasError() {
+		return diags
+	}
+
+	// Create a new target slice and expand each element.
+	f := reflect.ValueOf(from)
+	n := f.Len()
+	t := reflect.MakeSlice(tSlice, n, n)
+	for i := 0; i < n; i++ {
+		// Create a new target structure and walk its fields.
+		target := reflect.New(tElem)
+		diags.Append(autoFlexConvertStruct(ctx, f.Index(i).Interface(), target.Interface(), expander)...)
+		if diags.HasError() {
+			return diags
+		}
+
+		// Set value (or pointer) in the target slice.
+		if vTo.Type().Elem().Kind() == reflect.Struct {
+			t.Index(i).Set(target.Elem())
+		} else {
+			t.Index(i).Set(target)
+		}
+	}
+
+	vTo.Set(t)
+
+	return diags
+}
+
+// convert converts a single AWS API value to its Plugin Framework equivalent.
+func (flattener autoFlattener) convert(ctx context.Context, vFrom, vTo reflect.Value) diag.Diagnostics {
+	var diags diag.Diagnostics
+
+	valTo, ok := vTo.Interface().(attr.Value)
+	if !ok {
+		diags.AddError("AutoFlEx", fmt.Sprintf("does not implement attr.Value: %s", vTo.Kind()))
+		return diags
+	}
+
+	tTo := valTo.Type(ctx)
+	switch vFrom.Kind() {
+	case reflect.Bool:
+		diags.Append(flattener.bool(ctx, vFrom, tTo, vTo)...)
+		return diags
+
+	case reflect.Float32, reflect.Float64:
+		diags.Append(flattener.float(ctx, vFrom, tTo, vTo)...)
+		return diags
+
+	case reflect.Int32, reflect.Int64:
+		diags.Append(flattener.int(ctx, vFrom, tTo, vTo)...)
+		return diags
+
+	case reflect.String:
+		diags.Append(flattener.string(ctx, vFrom, tTo, vTo)...)
+		return diags
+
+	case reflect.Ptr:
+		diags.Append(flattener.ptr(ctx, vFrom, tTo, vTo)...)
+		return diags
+
+	case reflect.Slice:
+		diags.Append(flattener.slice(ctx, vFrom, tTo, vTo)...)
+		return diags
+
+	case reflect.Map:
+		diags.Append(flattener.map_(ctx, vFrom, tTo, vTo)...)
+		return diags
+	}
+
+	tflog.Info(ctx, "AutoFlex Flatten; incompatible types", map[string]interface{}{
+		"from": vFrom.Kind(),
+		"to":   tTo,
+	})
+
+	return diags
+}
+
+// bool copies an AWS API bool value to a compatible Plugin Framework value.
+func (flattener autoFlattener) bool(ctx context.Context, vFrom reflect.Value, tTo attr.Type, vTo reflect.Value) diag.Diagnostics {
+	var diags diag.Diagnostics
+
+	switch tTo := tTo.(type) {
+	case basetypes.BoolTypable:
+		v, d := tTo.ValueFromBool(ctx, types.BoolValue(vFrom.Bool()))
+		diags.Append(d...)
+		if diags.HasError() {
+			return diags
+		}
+
+		//
+		// bool -> types.Bool.
+		//
+		vTo.Set(reflect.ValueOf(v))
+		return diags
+	}
+
+	tflog.Info(ctx, "AutoFlex Flatten; incompatible types", map[string]interface{}{
+		"from": vFrom.Kind(),
+		"to":   tTo,
+	})
+
+	return diags
+}
+
+// float copies an AWS API float value to a compatible Plugin Framework value.
+func (flattener autoFlattener) float(ctx context.Context, vFrom reflect.Value, tTo attr.Type, vTo reflect.Value) diag.Diagnostics {
+	var diags diag.Diagnostics
+
+	switch tTo := tTo.(type) {
+	case basetypes.Float64Typable:
+		v, d := tTo.ValueFromFloat64(ctx, types.Float64Value(vFrom.Float()))
+		diags.Append(d...)
+		if diags.HasError() {
+			return diags
+		}
+
+		//
+		// float32/float64 -> types.Float64.
+		//
+		vTo.Set(reflect.ValueOf(v))
+		return diags
+	}
+
+	tflog.Info(ctx, "AutoFlex Flatten; incompatible types", map[string]interface{}{
+		"from": vFrom.Kind(),
+		"to":   tTo,
+	})
+
+	return diags
+}
+
+// int copies an AWS API int value to a compatible Plugin Framework value.
+func (flattener autoFlattener) int(ctx context.Context, vFrom reflect.Value, tTo attr.Type, vTo reflect.Value) diag.Diagnostics {
+	var diags diag.Diagnostics
+
+	switch tTo := tTo.(type) {
+	case basetypes.Int64Typable:
+		v, d := tTo.ValueFromInt64(ctx, types.Int64Value(vFrom.Int()))
+		diags.Append(d...)
+		if diags.HasError() {
+			return diags
+		}
+
+		//
+		// int32/int64 -> types.Int64.
+		//
+		vTo.Set(reflect.ValueOf(v))
+		return diags
+	}
+
+	tflog.Info(ctx, "AutoFlex Flatten; incompatible types", map[string]interface{}{
+		"from": vFrom.Kind(),
+		"to":   tTo,
+	})
+
+	return diags
+}
+
+// string copies an AWS API string value to a compatible Plugin Framework value.
+func (flattener autoFlattener) string(ctx context.Context, vFrom reflect.Value, tTo attr.Type, vTo reflect.Value) diag.Diagnostics {
+	var diags diag.Diagnostics
+
+	switch tTo := tTo.(type) {
+	case basetypes.StringTypable:
+		v, d := tTo.ValueFromString(ctx, types.StringValue(vFrom.String()))
+		diags.Append(d...)
+		if diags.HasError() {
+			return diags
+		}
+
+		//
+		// string -> types.String.
+		//
+		vTo.Set(reflect.ValueOf(v))
+		return diags
+	}
+
+	tflog.Info(ctx, "AutoFlex Flatten; incompatible types", map[string]interface{}{
+		"from": vFrom.Kind(),
+		"to":   tTo,
+	})
+
+	return diags
+}
+
+// ptr copies an AWS API pointer value to a compatible Plugin Framework value.
+func (flattener autoFlattener) ptr(ctx context.Context, vFrom reflect.Value, tTo attr.Type, vTo reflect.Value) diag.Diagnostics {
+	var diags diag.Diagnostics
+
+	switch vElem := vFrom.Elem(); vFrom.Type().Elem().Kind() {
+	case reflect.Bool:
+		if vFrom.IsNil() {
+			vTo.Set(reflect.ValueOf(types.BoolNull()))
+			return diags
+		}
+
+		diags.Append(flattener.bool(ctx, vElem, tTo, vTo)...)
+		return diags
+
+	case reflect.Float32, reflect.Float64:
+		if vFrom.IsNil() {
+			vTo.Set(reflect.ValueOf(types.Float64Null()))
+			return diags
+		}
+
+		diags.Append(flattener.float(ctx, vElem, tTo, vTo)...)
+		return diags
+
+	case reflect.Int32, reflect.Int64:
+		if vFrom.IsNil() {
+			vTo.Set(reflect.ValueOf(types.Int64Null()))
+			return diags
+		}
+
+		diags.Append(flattener.int(ctx, vElem, tTo, vTo)...)
+		return diags
+
+	case reflect.String:
+		if vFrom.IsNil() {
+			vTo.Set(reflect.ValueOf(types.StringNull()))
+			return diags
+		}
+
+		diags.Append(flattener.string(ctx, vElem, tTo, vTo)...)
+		return diags
+
+	case reflect.Struct:
+		if tTo, ok := tTo.(fwtypes.NestedObjectType); ok {
+			//
+			// *struct -> types.List(OfObject).
+			//
+			diags.Append(flattener.ptrToStructNestedObject(ctx, vFrom, tTo, vTo)...)
+			return diags
+		}
+	}
+
+	tflog.Info(ctx, "AutoFlex Flatten; incompatible types", map[string]interface{}{
+		"from": vFrom.Kind(),
+		"to":   tTo,
+	})
+
+	return diags
+}
+
+// slice copies an AWS API slice value to a compatible Plugin Framework value.
+func (flattener autoFlattener) slice(ctx context.Context, vFrom reflect.Value, tTo attr.Type, vTo reflect.Value) diag.Diagnostics {
+	var diags diag.Diagnostics
+
+	switch tSliceElem := vFrom.Type().Elem(); tSliceElem.Kind() {
+	case reflect.String:
+		switch tTo := tTo.(type) {
+		case basetypes.ListTypable:
+			//
+			// []string -> types.List(OfString).
+			//
+			if vFrom.IsNil() {
+				vTo.Set(reflect.ValueOf(types.ListNull(types.StringType)))
+				return diags
+			}
+
+			from := vFrom.Interface().([]string)
+			elements := make([]attr.Value, len(from))
+			for i, v := range from {
+				elements[i] = types.StringValue(v)
+			}
+			list, d := types.ListValue(types.StringType, elements)
+			diags.Append(d...)
+			if diags.HasError() {
+				return diags
+			}
+
+			to, d := tTo.ValueFromList(ctx, list)
+			diags.Append(d...)
+			if diags.HasError() {
+				return diags
+			}
+
+			vTo.Set(reflect.ValueOf(to))
+			return diags
+
+		case basetypes.SetTypable:
+			//
+			// []string -> types.Set(OfString).
+			//
+			if vFrom.IsNil() {
+				vTo.Set(reflect.ValueOf(types.SetNull(types.StringType)))
+				return diags
+			}
+
+			from := vFrom.Interface().([]string)
+			elements := make([]attr.Value, len(from))
+			for i, v := range from {
+				elements[i] = types.StringValue(v)
+			}
+			set, d := types.SetValue(types.StringType, elements)
+			diags.Append(d...)
+			if diags.HasError() {
+				return diags
+			}
+
+			to, d := tTo.ValueFromSet(ctx, set)
+			diags.Append(d...)
+			if diags.HasError() {
+				return diags
+			}
+
+			vTo.Set(reflect.ValueOf(to))
+			return diags
+		}
+
+	case reflect.Ptr:
+		switch tSliceElem.Elem().Kind() {
+		case reflect.String:
+			switch tTo := tTo.(type) {
+			case basetypes.ListTypable:
+				//
+				// []*string -> types.List(OfString).
+				//
+				if vFrom.IsNil() {
+					vTo.Set(reflect.ValueOf(types.ListNull(types.StringType)))
+					return diags
+				}
+
+				from := vFrom.Interface().([]*string)
+				elements := make([]attr.Value, len(from))
+				for i, v := range from {
+					elements[i] = types.StringPointerValue(v)
+				}
+				list, d := types.ListValue(types.StringType, elements)
+				diags.Append(d...)
+				if diags.HasError() {
+					return diags
+				}
+
+				to, d := tTo.ValueFromList(ctx, list)
+				diags.Append(d...)
+				if diags.HasError() {
+					return diags
+				}
+
+				vTo.Set(reflect.ValueOf(to))
+				return diags
+
+			case basetypes.SetTypable:
+				//
+				// []string -> types.Set(OfString).
+				//
+				if vFrom.IsNil() {
+					vTo.Set(reflect.ValueOf(types.SetNull(types.StringType)))
+					return diags
+				}
+
+				from := vFrom.Interface().([]*string)
+				elements := make([]attr.Value, len(from))
+				for i, v := range from {
+					elements[i] = types.StringPointerValue(v)
+				}
+				set, d := types.SetValue(types.StringType, elements)
+				diags.Append(d...)
+				if diags.HasError() {
+					return diags
+				}
+
+				to, d := tTo.ValueFromSet(ctx, set)
+				diags.Append(d...)
+				if diags.HasError() {
+					return diags
+				}
+
+				vTo.Set(reflect.ValueOf(to))
+				return diags
+			}
+
+		case reflect.Struct:
+			if tTo, ok := tTo.(fwtypes.NestedObjectType); ok {
+				//
+				// []*struct -> types.List(OfObject).
+				//
+				diags.Append(flattener.sliceOfStructNestedObject(ctx, vFrom, tTo, vTo)...)
+				return diags
+			}
+		}
+
+	case reflect.Struct:
+		if tTo, ok := tTo.(fwtypes.NestedObjectType); ok {
+			//
+			// []struct -> types.List(OfObject).
+			//
+			diags.Append(flattener.sliceOfStructNestedObject(ctx, vFrom, tTo, vTo)...)
+			return diags
+		}
+	}
+
+	tflog.Info(ctx, "AutoFlex Flatten; incompatible types", map[string]interface{}{
+		"from": vFrom.Kind(),
+		"to":   tTo,
+	})
+
+	return diags
+}
+
+// map_ copies an AWS API map value to a compatible Plugin Framework value.
+func (flattener autoFlattener) map_(ctx context.Context, vFrom reflect.Value, tTo attr.Type, vTo reflect.Value) diag.Diagnostics {
+	var diags diag.Diagnostics
+
+	switch tMapKey := vFrom.Type().Key(); tMapKey.Kind() {
+	case reflect.String:
+		switch tMapElem := vFrom.Type().Elem(); tMapElem.Kind() {
+		case reflect.String:
+			switch tTo := tTo.(type) {
+			case basetypes.MapTypable:
+				//
+				// map[string]string -> types.Map(OfString).
+				//
+				if vFrom.IsNil() {
+					vTo.Set(reflect.ValueOf(types.MapNull(types.StringType)))
+					return diags
+				}
+
+				from := vFrom.Interface().(map[string]string)
+				elements := make(map[string]attr.Value, len(from))
+				for k, v := range from {
+					elements[k] = types.StringValue(v)
+				}
+				map_, d := types.MapValue(types.StringType, elements)
+				diags.Append(d...)
+				if diags.HasError() {
+					return diags
+				}
+
+				to, d := tTo.ValueFromMap(ctx, map_)
+				diags.Append(d...)
+				if diags.HasError() {
+					return diags
+				}
+
+				vTo.Set(reflect.ValueOf(to))
+				return diags
+			}
+
+		case reflect.Ptr:
+			switch tMapElem.Elem().Kind() {
+			case reflect.String:
+				switch tTo := tTo.(type) {
+				case basetypes.MapTypable:
+					//
+					// map[string]*string -> types.Map(OfString).
+					//
+					if vFrom.IsNil() {
+						vTo.Set(reflect.ValueOf(types.MapNull(types.StringType)))
+						return diags
+					}
+
+					from := vFrom.Interface().(map[string]*string)
+					elements := make(map[string]attr.Value, len(from))
+					for k, v := range from {
+						elements[k] = types.StringPointerValue(v)
+					}
+					map_, d := types.MapValue(types.StringType, elements)
+					diags.Append(d...)
+					if diags.HasError() {
+						return diags
+					}
+
+					to, d := tTo.ValueFromMap(ctx, map_)
+					diags.Append(d...)
+					if diags.HasError() {
+						return diags
+					}
+
+					vTo.Set(reflect.ValueOf(to))
+					return diags
+				}
+			}
+		}
+	}
+
+	tflog.Info(ctx, "AutoFlex Flatten; incompatible types", map[string]interface{}{
+		"from": vFrom.Kind(),
+		"to":   tTo,
+	})
+
+	return diags
+}
+
+// ptrToStructNestedObject copies an AWS API *struct value to a compatible Plugin Framework NestedObjectValue value.
+func (flattener autoFlattener) ptrToStructNestedObject(ctx context.Context, vFrom reflect.Value, tTo fwtypes.NestedObjectType, vTo reflect.Value) diag.Diagnostics {
+	var diags diag.Diagnostics
+
+	if vFrom.IsNil() {
+		val, d := tTo.NullValue(ctx)
+		diags.Append(d...)
+		if diags.HasError() {
+			return diags
+		}
+
+		vTo.Set(reflect.ValueOf(val))
+		return diags
+	}
+
+	// Create a new target structure and walk its fields.
+	to, d := tTo.NewObjectPtr(ctx)
+	diags.Append(d...)
+	if diags.HasError() {
+		return diags
+	}
+
+	diags.Append(autoFlexConvertStruct(ctx, vFrom.Elem().Interface(), to, flattener)...)
+	if diags.HasError() {
+		return diags
+	}
+
+	// Set the target structure as a nested Object.
+	val, d := tTo.ValueFromObjectPtr(ctx, to)
+	diags.Append(d...)
+	if diags.HasError() {
+		return diags
+	}
+
+	vTo.Set(reflect.ValueOf(val))
+	return diags
+}
+
+// sliceOfStructNestedObject copies an AWS API []struct value to a compatible Plugin Framework NestedObjectValue value.
+func (flattener autoFlattener) sliceOfStructNestedObject(ctx context.Context, vFrom reflect.Value, tTo fwtypes.NestedObjectType, vTo reflect.Value) diag.Diagnostics {
+	var diags diag.Diagnostics
+
+	if vFrom.IsNil() {
+		val, d := tTo.NullValue(ctx)
+		diags.Append(d...)
+		if diags.HasError() {
+			return diags
+		}
+
+		vTo.Set(reflect.ValueOf(val))
+		return diags
+	}
+
+	// Create a new target slice and flatten each element.
+	n := vFrom.Len()
+	to, d := tTo.NewObjectSlice(ctx, n, n)
+	diags.Append(d...)
+	if diags.HasError() {
+		return diags
+	}
+
+	t := reflect.ValueOf(to)
+	for i := 0; i < n; i++ {
+		target, d := tTo.NewObjectPtr(ctx)
+		diags.Append(d...)
+		if diags.HasError() {
+			return diags
+		}
+
+		diags.Append(autoFlexConvertStruct(ctx, vFrom.Index(i).Interface(), target, flattener)...)
+		if diags.HasError() {
+			return diags
+		}
+
+		t.Index(i).Set(reflect.ValueOf(target))
+	}
+
+	// Set the target structure as a nested Object.
+	val, d := tTo.ValueFromObjectSlice(ctx, to)
+	diags.Append(d...)
+	if diags.HasError() {
+		return diags
+	}
+
+	vTo.Set(reflect.ValueOf(val))
+	return diags
+}
diff --git a/internal/framework/flex/autoflex_test.go b/internal/framework/flex/autoflex_test.go
new file mode 100644
index 00000000000..e2044a1b865
--- /dev/null
+++ b/internal/framework/flex/autoflex_test.go
@@ -0,0 +1,989 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package flex
+
+import (
+	"context"
+	"testing"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/google/go-cmp/cmp"
+	"github.com/hashicorp/terraform-plugin-framework/attr"
+	"github.com/hashicorp/terraform-plugin-framework/types"
+	fwtypes "github.com/hashicorp/terraform-provider-aws/internal/framework/types"
+)
+
+type TestFlex00 struct{}
+
+type TestFlexTF01 struct {
+	Field1 types.String `tfsdk:"field1"`
+}
+
+type TestFlexTF02 struct {
+	Field1 types.Int64 `tfsdk:"field1"`
+}
+
+// All primitive types.
+type TestFlexTF03 struct {
+	Field1  types.String  `tfsdk:"field1"`
+	Field2  types.String  `tfsdk:"field2"`
+	Field3  types.Int64   `tfsdk:"field3"`
+	Field4  types.Int64   `tfsdk:"field4"`
+	Field5  types.Int64   `tfsdk:"field5"`
+	Field6  types.Int64   `tfsdk:"field6"`
+	Field7  types.Float64 `tfsdk:"field7"`
+	Field8  types.Float64 `tfsdk:"field8"`
+	Field9  types.Float64 `tfsdk:"field9"`
+	Field10 types.Float64 `tfsdk:"field10"`
+	Field11 types.Bool    `tfsdk:"field11"`
+	Field12 types.Bool    `tfsdk:"field12"`
+}
+
+// List/Set/Map of primitive types.
+type TestFlexTF04 struct {
+	Field1 types.List `tfsdk:"field1"`
+	Field2 types.List `tfsdk:"field2"`
+	Field3 types.Set  `tfsdk:"field3"`
+	Field4 types.Set  `tfsdk:"field4"`
+	Field5 types.Map  `tfsdk:"field5"`
+	Field6 types.Map  `tfsdk:"field6"`
+}
+
+type TestFlexTF05 struct {
+	Field1 fwtypes.ListNestedObjectValueOf[TestFlexTF01] `tfsdk:"field1"`
+}
+
+type TestFlexTF06 struct {
+	Field1 fwtypes.SetNestedObjectValueOf[TestFlexTF01] `tfsdk:"field1"`
+}
+
+type TestFlexTF07 struct {
+	Field1 types.String                                  `tfsdk:"field1"`
+	Field2 fwtypes.ListNestedObjectValueOf[TestFlexTF05] `tfsdk:"field2"`
+	Field3 types.Map                                     `tfsdk:"field3"`
+	Field4 fwtypes.SetNestedObjectValueOf[TestFlexTF02]  `tfsdk:"field4"`
+}
+
+// TestFlexTF08 testing for idiomatic singular on TF side but plural on AWS side
+type TestFlexTF08 struct {
+	Field fwtypes.ListNestedObjectValueOf[TestFlexTF01] `tfsdk:"field"`
+}
+
+type TestFlexTF09 struct {
+	City      types.List `tfsdk:"city"`
+	Coach     types.List `tfsdk:"coach"`
+	Tomato    types.List `tfsdk:"tomato"`
+	Vertex    types.List `tfsdk:"vertex"`
+	Criterion types.List `tfsdk:"criterion"`
+	Datum     types.List `tfsdk:"datum"`
+	Hive      types.List `tfsdk:"hive"`
+}
+
+// TestFlexTF10 testing for fields that only differ by capitalization
+type TestFlexTF10 struct {
+	FieldURL types.String `tfsdk:"field_url"`
+}
+
+type TestFlexAWS01 struct {
+	Field1 string
+}
+
+type TestFlexAWS02 struct {
+	Field1 *string
+}
+
+type TestFlexAWS03 struct {
+	Field1 int64
+}
+
+type TestFlexAWS04 struct {
+	Field1  string
+	Field2  *string
+	Field3  int32
+	Field4  *int32
+	Field5  int64
+	Field6  *int64
+	Field7  float32
+	Field8  *float32
+	Field9  float64
+	Field10 *float64
+	Field11 bool
+	Field12 *bool
+}
+
+type TestFlexAWS05 struct {
+	Field1 []string
+	Field2 []*string
+	Field3 []string
+	Field4 []*string
+	Field5 map[string]string
+	Field6 map[string]*string
+}
+
+type TestFlexAWS06 struct {
+	Field1 *TestFlexAWS01
+}
+
+type TestFlexAWS07 struct {
+	Field1 []*TestFlexAWS01
+}
+
+type TestFlexAWS08 struct {
+	Field1 []TestFlexAWS01
+}
+
+type TestFlexAWS09 struct {
+	Field1 string
+	Field2 *TestFlexAWS06
+	Field3 map[string]*string
+	Field4 []TestFlexAWS03
+}
+
+type TestFlexAWS10 struct {
+	Fields []TestFlexAWS01
+}
+
+type TestFlexAWS11 struct {
+	Cities   []*string
+	Coaches  []*string
+	Tomatoes []*string
+	Vertices []*string
+	Criteria []*string
+	Data     []*string
+	Hives    []*string
+}
+
+type TestFlexAWS12 struct {
+	FieldUrl *string
+}
+
+func TestGenericExpand(t *testing.T) {
+	t.Parallel()
+
+	ctx := context.Background()
+	testString := "test"
+	testStringResult := "a"
+	testCases := []struct {
+		TestName   string
+		Source     any
+		Target     any
+		WantErr    bool
+		WantTarget any
+	}{
+		{
+			TestName: "nil Source and Target",
+			WantErr:  true,
+		},
+		{
+			TestName: "non-pointer Target",
+			Source:   TestFlex00{},
+			Target:   0,
+			WantErr:  true,
+		},
+		{
+			TestName: "non-struct Source",
+			Source:   testString,
+			Target:   &TestFlex00{},
+			WantErr:  true,
+		},
+		{
+			TestName: "non-struct Target",
+			Source:   TestFlex00{},
+			Target:   &testString,
+			WantErr:  true,
+		},
+		{
+			TestName:   "types.String to string",
+			Source:     types.StringValue("a"),
+			Target:     &testString,
+			WantTarget: &testStringResult,
+		},
+		{
+			TestName:   "empty struct Source and Target",
+			Source:     TestFlex00{},
+			Target:     &TestFlex00{},
+			WantTarget: &TestFlex00{},
+		},
+		{
+			TestName:   "empty struct pointer Source and Target",
+			Source:     &TestFlex00{},
+			Target:     &TestFlex00{},
+			WantTarget: &TestFlex00{},
+		},
+		{
+			TestName:   "single string struct pointer Source and empty Target",
+			Source:     &TestFlexTF01{Field1: types.StringValue("a")},
+			Target:     &TestFlex00{},
+			WantTarget: &TestFlex00{},
+		},
+		{
+			TestName: "does not implement attr.Value Source",
+			Source:   &TestFlexAWS01{Field1: "a"},
+			Target:   &TestFlexAWS01{},
+			WantErr:  true,
+		},
+		{
+			TestName:   "single string Source and single string Target",
+			Source:     &TestFlexTF01{Field1: types.StringValue("a")},
+			Target:     &TestFlexAWS01{},
+			WantTarget: &TestFlexAWS01{Field1: "a"},
+		},
+		{
+			TestName:   "single string Source and single *string Target",
+			Source:     &TestFlexTF01{Field1: types.StringValue("a")},
+			Target:     &TestFlexAWS02{},
+			WantTarget: &TestFlexAWS02{Field1: aws.String("a")},
+		},
+		{
+			TestName:   "single string Source and single int64 Target",
+			Source:     &TestFlexTF01{Field1: types.StringValue("a")},
+			Target:     &TestFlexAWS03{},
+			WantTarget: &TestFlexAWS03{},
+		},
+		{
+			TestName: "primtive types Source and primtive types Target",
+			Source: &TestFlexTF03{
+				Field1:  types.StringValue("field1"),
+				Field2:  types.StringValue("field2"),
+				Field3:  types.Int64Value(3),
+				Field4:  types.Int64Value(-4),
+				Field5:  types.Int64Value(5),
+				Field6:  types.Int64Value(-6),
+				Field7:  types.Float64Value(7.7),
+				Field8:  types.Float64Value(-8.8),
+				Field9:  types.Float64Value(9.99),
+				Field10: types.Float64Value(-10.101),
+				Field11: types.BoolValue(true),
+				Field12: types.BoolValue(false),
+			},
+			Target: &TestFlexAWS04{},
+			WantTarget: &TestFlexAWS04{
+				Field1:  "field1",
+				Field2:  aws.String("field2"),
+				Field3:  3,
+				Field4:  aws.Int32(-4),
+				Field5:  5,
+				Field6:  aws.Int64(-6),
+				Field7:  7.7,
+				Field8:  aws.Float32(-8.8),
+				Field9:  9.99,
+				Field10: aws.Float64(-10.101),
+				Field11: true,
+				Field12: aws.Bool(false),
+			},
+		},
+		{
+			TestName: "List/Set/Map of primitive types Source and slice/map of primtive types Target",
+			Source: &TestFlexTF04{
+				Field1: types.ListValueMust(types.StringType, []attr.Value{
+					types.StringValue("a"),
+					types.StringValue("b"),
+				}),
+				Field2: types.ListValueMust(types.StringType, []attr.Value{
+					types.StringValue("a"),
+					types.StringValue("b"),
+				}),
+				Field3: types.SetValueMust(types.StringType, []attr.Value{
+					types.StringValue("a"),
+					types.StringValue("b"),
+				}),
+				Field4: types.SetValueMust(types.StringType, []attr.Value{
+					types.StringValue("a"),
+					types.StringValue("b"),
+				}),
+				Field5: types.MapValueMust(types.StringType, map[string]attr.Value{
+					"A": types.StringValue("a"),
+					"B": types.StringValue("b"),
+				}),
+				Field6: types.MapValueMust(types.StringType, map[string]attr.Value{
+					"A": types.StringValue("a"),
+					"B": types.StringValue("b"),
+				}),
+			},
+			Target: &TestFlexAWS05{},
+			WantTarget: &TestFlexAWS05{
+				Field1: []string{"a", "b"},
+				Field2: aws.StringSlice([]string{"a", "b"}),
+				Field3: []string{"a", "b"},
+				Field4: aws.StringSlice([]string{"a", "b"}),
+				Field5: map[string]string{"A": "a", "B": "b"},
+				Field6: aws.StringMap(map[string]string{"A": "a", "B": "b"}),
+			},
+		},
+		{
+			TestName:   "single list Source and *struct Target",
+			Source:     &TestFlexTF05{Field1: fwtypes.NewListNestedObjectValueOfPtr(ctx, &TestFlexTF01{Field1: types.StringValue("a")})},
+			Target:     &TestFlexAWS06{},
+			WantTarget: &TestFlexAWS06{Field1: &TestFlexAWS01{Field1: "a"}},
+		},
+		{
+			TestName:   "single set Source and *struct Target",
+			Source:     &TestFlexTF06{Field1: fwtypes.NewSetNestedObjectValueOfPtr(ctx, &TestFlexTF01{Field1: types.StringValue("a")})},
+			Target:     &TestFlexAWS06{},
+			WantTarget: &TestFlexAWS06{Field1: &TestFlexAWS01{Field1: "a"}},
+		},
+		{
+			TestName:   "empty list Source and empty []struct Target",
+			Source:     &TestFlexTF05{Field1: fwtypes.NewListNestedObjectValueOfValueSlice(ctx, []TestFlexTF01{})},
+			Target:     &TestFlexAWS08{},
+			WantTarget: &TestFlexAWS08{Field1: []TestFlexAWS01{}},
+		},
+		{
+			TestName: "non-empty list Source and non-empty []struct Target",
+			Source: &TestFlexTF05{Field1: fwtypes.NewListNestedObjectValueOfValueSlice(ctx, []TestFlexTF01{
+				{Field1: types.StringValue("a")},
+				{Field1: types.StringValue("b")},
+			})},
+			Target: &TestFlexAWS08{},
+			WantTarget: &TestFlexAWS08{Field1: []TestFlexAWS01{
+				{Field1: "a"},
+				{Field1: "b"},
+			}},
+		},
+		{
+			TestName:   "empty list Source and empty []*struct Target",
+			Source:     &TestFlexTF05{Field1: fwtypes.NewListNestedObjectValueOfSlice(ctx, []*TestFlexTF01{})},
+			Target:     &TestFlexAWS07{},
+			WantTarget: &TestFlexAWS07{Field1: []*TestFlexAWS01{}},
+		},
+		{
+			TestName: "non-empty list Source and non-empty []*struct Target",
+			Source: &TestFlexTF05{Field1: fwtypes.NewListNestedObjectValueOfSlice(ctx, []*TestFlexTF01{
+				{Field1: types.StringValue("a")},
+				{Field1: types.StringValue("b")},
+			})},
+			Target: &TestFlexAWS07{},
+			WantTarget: &TestFlexAWS07{Field1: []*TestFlexAWS01{
+				{Field1: "a"},
+				{Field1: "b"},
+			}},
+		},
+		{
+			TestName:   "empty list Source and empty []struct Target",
+			Source:     &TestFlexTF05{Field1: fwtypes.NewListNestedObjectValueOfValueSlice(ctx, []TestFlexTF01{})},
+			Target:     &TestFlexAWS08{},
+			WantTarget: &TestFlexAWS08{Field1: []TestFlexAWS01{}},
+		},
+		{
+			TestName: "non-empty list Source and non-empty []struct Target",
+			Source: &TestFlexTF05{Field1: fwtypes.NewListNestedObjectValueOfValueSlice(ctx, []TestFlexTF01{
+				{Field1: types.StringValue("a")},
+				{Field1: types.StringValue("b")},
+			})},
+			Target: &TestFlexAWS08{},
+			WantTarget: &TestFlexAWS08{Field1: []TestFlexAWS01{
+				{Field1: "a"},
+				{Field1: "b"},
+			}},
+		},
+		{
+			TestName:   "empty set Source and empty []*struct Target",
+			Source:     &TestFlexTF06{Field1: fwtypes.NewSetNestedObjectValueOfSlice(ctx, []*TestFlexTF01{})},
+			Target:     &TestFlexAWS07{},
+			WantTarget: &TestFlexAWS07{Field1: []*TestFlexAWS01{}},
+		},
+		{
+			TestName: "non-empty set Source and non-empty []*struct Target",
+			Source: &TestFlexTF06{Field1: fwtypes.NewSetNestedObjectValueOfSlice(ctx, []*TestFlexTF01{
+				{Field1: types.StringValue("a")},
+				{Field1: types.StringValue("b")},
+			})},
+			Target: &TestFlexAWS07{},
+			WantTarget: &TestFlexAWS07{Field1: []*TestFlexAWS01{
+				{Field1: "a"},
+				{Field1: "b"},
+			}},
+		},
+		{
+			TestName: "non-empty set Source and non-empty []struct Target",
+			Source: &TestFlexTF06{Field1: fwtypes.NewSetNestedObjectValueOfValueSlice(ctx, []TestFlexTF01{
+				{Field1: types.StringValue("a")},
+				{Field1: types.StringValue("b")},
+			})},
+			Target: &TestFlexAWS08{},
+			WantTarget: &TestFlexAWS08{Field1: []TestFlexAWS01{
+				{Field1: "a"},
+				{Field1: "b"},
+			}},
+		},
+		{
+			TestName: "complex Source and complex Target",
+			Source: &TestFlexTF07{
+				Field1: types.StringValue("m"),
+				Field2: fwtypes.NewListNestedObjectValueOfPtr(ctx, &TestFlexTF05{
+					Field1: fwtypes.NewListNestedObjectValueOfPtr(ctx, &TestFlexTF01{
+						Field1: types.StringValue("n"),
+					}),
+				}),
+				Field3: types.MapValueMust(types.StringType, map[string]attr.Value{
+					"X": types.StringValue("x"),
+					"Y": types.StringValue("y"),
+				}),
+				Field4: fwtypes.NewSetNestedObjectValueOfValueSlice(ctx, []TestFlexTF02{
+					{Field1: types.Int64Value(100)},
+					{Field1: types.Int64Value(2000)},
+					{Field1: types.Int64Value(30000)},
+				}),
+			},
+			Target: &TestFlexAWS09{},
+			WantTarget: &TestFlexAWS09{
+				Field1: "m",
+				Field2: &TestFlexAWS06{Field1: &TestFlexAWS01{Field1: "n"}},
+				Field3: aws.StringMap(map[string]string{"X": "x", "Y": "y"}),
+				Field4: []TestFlexAWS03{{Field1: 100}, {Field1: 2000}, {Field1: 30000}},
+			},
+		},
+		{
+			TestName: "plural ordinary field names",
+			Source: &TestFlexTF08{
+				Field: fwtypes.NewListNestedObjectValueOfPtr(ctx, &TestFlexTF01{
+					Field1: types.StringValue("a"),
+				}),
+			},
+			Target: &TestFlexAWS10{},
+			WantTarget: &TestFlexAWS10{
+				Fields: []TestFlexAWS01{{Field1: "a"}},
+			},
+		},
+		{
+			TestName: "plural field names",
+			Source: &TestFlexTF09{
+				City: types.ListValueMust(types.StringType, []attr.Value{
+					types.StringValue("paris"),
+					types.StringValue("london"),
+				}),
+				Coach: types.ListValueMust(types.StringType, []attr.Value{
+					types.StringValue("guardiola"),
+					types.StringValue("mourinho"),
+				}),
+				Tomato: types.ListValueMust(types.StringType, []attr.Value{
+					types.StringValue("brandywine"),
+					types.StringValue("roma"),
+				}),
+				Vertex: types.ListValueMust(types.StringType, []attr.Value{
+					types.StringValue("ab"),
+					types.StringValue("bc"),
+				}),
+				Criterion: types.ListValueMust(types.StringType, []attr.Value{
+					types.StringValue("votes"),
+					types.StringValue("editors"),
+				}),
+				Datum: types.ListValueMust(types.StringType, []attr.Value{
+					types.StringValue("d1282f78-fa99-5d9d-bd51-e6f0173eb74a"),
+					types.StringValue("0f10cb10-2076-5254-bd21-d3f62fe66303"),
+				}),
+				Hive: types.ListValueMust(types.StringType, []attr.Value{
+					types.StringValue("Cegieme"),
+					types.StringValue("Fahumvid"),
+				}),
+			},
+			Target: &TestFlexAWS11{},
+			WantTarget: &TestFlexAWS11{
+				Cities: []*string{
+					aws.String("paris"),
+					aws.String("london"),
+				},
+				Coaches: []*string{
+					aws.String("guardiola"),
+					aws.String("mourinho"),
+				},
+				Tomatoes: []*string{
+					aws.String("brandywine"),
+					aws.String("roma"),
+				},
+				Vertices: []*string{
+					aws.String("ab"),
+					aws.String("bc"),
+				},
+				Criteria: []*string{
+					aws.String("votes"),
+					aws.String("editors"),
+				},
+				Data: []*string{
+					aws.String("d1282f78-fa99-5d9d-bd51-e6f0173eb74a"),
+					aws.String("0f10cb10-2076-5254-bd21-d3f62fe66303"),
+				},
+				Hives: []*string{
+					aws.String("Cegieme"),
+					aws.String("Fahumvid"),
+				},
+			},
+		},
+		{
+			TestName: "capitalization field names",
+			Source: &TestFlexTF10{
+				FieldURL: types.StringValue("h"),
+			},
+			Target: &TestFlexAWS12{},
+			WantTarget: &TestFlexAWS12{
+				FieldUrl: aws.String("h"),
+			},
+		},
+	}
+
+	for _, testCase := range testCases {
+		testCase := testCase
+		t.Run(testCase.TestName, func(t *testing.T) {
+			t.Parallel()
+
+			err := Expand(ctx, testCase.Source, testCase.Target)
+			gotErr := err != nil
+
+			if gotErr != testCase.WantErr {
+				t.Errorf("gotErr = %v, wantErr = %v", gotErr, testCase.WantErr)
+			}
+
+			if gotErr {
+				if !testCase.WantErr {
+					t.Errorf("err = %q", err)
+				}
+			} else if diff := cmp.Diff(testCase.Target, testCase.WantTarget); diff != "" {
+				t.Errorf("unexpected diff (+wanted, -got): %s", diff)
+			}
+		})
+	}
+}
+
+func TestGenericFlatten(t *testing.T) {
+	t.Parallel()
+
+	ctx := context.Background()
+	testString := "test"
+	testCases := []struct {
+		TestName   string
+		Source     any
+		Target     any
+		WantErr    bool
+		WantTarget any
+	}{
+		{
+			TestName: "nil Source and Target",
+			WantErr:  true,
+		},
+		{
+			TestName: "non-pointer Target",
+			Source:   TestFlex00{},
+			Target:   0,
+			WantErr:  true,
+		},
+		{
+			TestName: "non-struct Source",
+			Source:   testString,
+			Target:   &TestFlex00{},
+			WantErr:  true,
+		},
+		{
+			TestName: "non-struct Target",
+			Source:   TestFlex00{},
+			Target:   &testString,
+			WantErr:  true,
+		},
+		{
+			TestName:   "empty struct Source and Target",
+			Source:     TestFlex00{},
+			Target:     &TestFlex00{},
+			WantTarget: &TestFlex00{},
+		},
+		{
+			TestName:   "empty struct pointer Source and Target",
+			Source:     &TestFlex00{},
+			Target:     &TestFlex00{},
+			WantTarget: &TestFlex00{},
+		},
+		{
+			TestName:   "single string struct pointer Source and empty Target",
+			Source:     &TestFlexAWS01{Field1: "a"},
+			Target:     &TestFlex00{},
+			WantTarget: &TestFlex00{},
+		},
+		{
+			TestName: "does not implement attr.Value Target",
+			Source:   &TestFlexAWS01{Field1: "a"},
+			Target:   &TestFlexAWS01{},
+			WantErr:  true,
+		},
+		{
+			TestName:   "single empty string Source and single string Target",
+			Source:     &TestFlexAWS01{},
+			Target:     &TestFlexTF01{},
+			WantTarget: &TestFlexTF01{Field1: types.StringValue("")},
+		},
+		{
+			TestName:   "single string Source and single string Target",
+			Source:     &TestFlexAWS01{Field1: "a"},
+			Target:     &TestFlexTF01{},
+			WantTarget: &TestFlexTF01{Field1: types.StringValue("a")},
+		},
+		{
+			TestName:   "single nil *string Source and single string Target",
+			Source:     &TestFlexAWS02{},
+			Target:     &TestFlexTF01{},
+			WantTarget: &TestFlexTF01{Field1: types.StringNull()},
+		},
+		{
+			TestName:   "single *string Source and single string Target",
+			Source:     &TestFlexAWS02{Field1: aws.String("a")},
+			Target:     &TestFlexTF01{},
+			WantTarget: &TestFlexTF01{Field1: types.StringValue("a")},
+		},
+		{
+			TestName:   "single string Source and single int64 Target",
+			Source:     &TestFlexAWS01{Field1: "a"},
+			Target:     &TestFlexTF02{},
+			WantTarget: &TestFlexTF02{},
+		},
+		{
+			TestName: "zero value primtive types Source and primtive types Target",
+			Source:   &TestFlexAWS04{},
+			Target:   &TestFlexTF03{},
+			WantTarget: &TestFlexTF03{
+				Field1:  types.StringValue(""),
+				Field2:  types.StringNull(),
+				Field3:  types.Int64Value(0),
+				Field4:  types.Int64Null(),
+				Field5:  types.Int64Value(0),
+				Field6:  types.Int64Null(),
+				Field7:  types.Float64Value(0),
+				Field8:  types.Float64Null(),
+				Field9:  types.Float64Value(0),
+				Field10: types.Float64Null(),
+				Field11: types.BoolValue(false),
+				Field12: types.BoolNull(),
+			},
+		},
+		{
+			TestName: "primtive types Source and primtive types Target",
+			Source: &TestFlexAWS04{
+				Field1:  "field1",
+				Field2:  aws.String("field2"),
+				Field3:  3,
+				Field4:  aws.Int32(-4),
+				Field5:  5,
+				Field6:  aws.Int64(-6),
+				Field7:  7.7,
+				Field8:  aws.Float32(-8.8),
+				Field9:  9.99,
+				Field10: aws.Float64(-10.101),
+				Field11: true,
+				Field12: aws.Bool(false),
+			},
+			Target: &TestFlexTF03{},
+			WantTarget: &TestFlexTF03{
+				Field1: types.StringValue("field1"),
+				Field2: types.StringValue("field2"),
+				Field3: types.Int64Value(3),
+				Field4: types.Int64Value(-4),
+				Field5: types.Int64Value(5),
+				Field6: types.Int64Value(-6),
+				// float32 -> float64 precision problems.
+				Field7:  types.Float64Value(float64(float32(7.7))),
+				Field8:  types.Float64Value(float64(float32(-8.8))),
+				Field9:  types.Float64Value(9.99),
+				Field10: types.Float64Value(-10.101),
+				Field11: types.BoolValue(true),
+				Field12: types.BoolValue(false),
+			},
+		},
+		{
+			TestName: "zero value slice/map of primtive primtive types Source and List/Set/Map of primtive types Target",
+			Source:   &TestFlexAWS05{},
+			Target:   &TestFlexTF04{},
+			WantTarget: &TestFlexTF04{
+				Field1: types.ListNull(types.StringType),
+				Field2: types.ListNull(types.StringType),
+				Field3: types.SetNull(types.StringType),
+				Field4: types.SetNull(types.StringType),
+				Field5: types.MapNull(types.StringType),
+				Field6: types.MapNull(types.StringType),
+			},
+		},
+		{
+			TestName: "slice/map of primtive primtive types Source and List/Set/Map of primtive types Target",
+			Source: &TestFlexAWS05{
+				Field1: []string{"a", "b"},
+				Field2: aws.StringSlice([]string{"a", "b"}),
+				Field3: []string{"a", "b"},
+				Field4: aws.StringSlice([]string{"a", "b"}),
+				Field5: map[string]string{"A": "a", "B": "b"},
+				Field6: aws.StringMap(map[string]string{"A": "a", "B": "b"}),
+			},
+			Target: &TestFlexTF04{},
+			WantTarget: &TestFlexTF04{
+				Field1: types.ListValueMust(types.StringType, []attr.Value{
+					types.StringValue("a"),
+					types.StringValue("b"),
+				}),
+				Field2: types.ListValueMust(types.StringType, []attr.Value{
+					types.StringValue("a"),
+					types.StringValue("b"),
+				}),
+				Field3: types.SetValueMust(types.StringType, []attr.Value{
+					types.StringValue("a"),
+					types.StringValue("b"),
+				}),
+				Field4: types.SetValueMust(types.StringType, []attr.Value{
+					types.StringValue("a"),
+					types.StringValue("b"),
+				}),
+				Field5: types.MapValueMust(types.StringType, map[string]attr.Value{
+					"A": types.StringValue("a"),
+					"B": types.StringValue("b"),
+				}),
+				Field6: types.MapValueMust(types.StringType, map[string]attr.Value{
+					"A": types.StringValue("a"),
+					"B": types.StringValue("b"),
+				}),
+			},
+		},
+		{
+			TestName:   "nil *struct Source and single list Target",
+			Source:     &TestFlexAWS06{},
+			Target:     &TestFlexTF05{},
+			WantTarget: &TestFlexTF05{Field1: fwtypes.NewListNestedObjectValueOfNull[TestFlexTF01](ctx)},
+		},
+		{
+			TestName:   "*struct Source and single list Target",
+			Source:     &TestFlexAWS06{Field1: &TestFlexAWS01{Field1: "a"}},
+			Target:     &TestFlexTF05{},
+			WantTarget: &TestFlexTF05{Field1: fwtypes.NewListNestedObjectValueOfPtr(ctx, &TestFlexTF01{Field1: types.StringValue("a")})},
+		},
+		{
+			TestName:   "*struct Source and single set Target",
+			Source:     &TestFlexAWS06{Field1: &TestFlexAWS01{Field1: "a"}},
+			Target:     &TestFlexTF06{},
+			WantTarget: &TestFlexTF06{Field1: fwtypes.NewSetNestedObjectValueOfPtr(ctx, &TestFlexTF01{Field1: types.StringValue("a")})},
+		},
+		{
+			TestName:   "nil []struct and null list Target",
+			Source:     &TestFlexAWS08{},
+			Target:     &TestFlexTF05{},
+			WantTarget: &TestFlexTF05{Field1: fwtypes.NewListNestedObjectValueOfNull[TestFlexTF01](ctx)},
+		},
+		{
+			TestName:   "nil []struct and null set Target",
+			Source:     &TestFlexAWS08{},
+			Target:     &TestFlexTF06{},
+			WantTarget: &TestFlexTF06{Field1: fwtypes.NewSetNestedObjectValueOfNull[TestFlexTF01](ctx)},
+		},
+		{
+			TestName:   "empty []struct and empty list Target",
+			Source:     &TestFlexAWS08{Field1: []TestFlexAWS01{}},
+			Target:     &TestFlexTF05{},
+			WantTarget: &TestFlexTF05{Field1: fwtypes.NewListNestedObjectValueOfValueSlice(ctx, []TestFlexTF01{})},
+		},
+		{
+			TestName:   "empty []struct and empty struct Target",
+			Source:     &TestFlexAWS08{Field1: []TestFlexAWS01{}},
+			Target:     &TestFlexTF06{},
+			WantTarget: &TestFlexTF06{Field1: fwtypes.NewSetNestedObjectValueOfValueSlice(ctx, []TestFlexTF01{})},
+		},
+		{
+			TestName: "non-empty []struct and non-empty list Target",
+			Source: &TestFlexAWS08{Field1: []TestFlexAWS01{
+				{Field1: "a"},
+				{Field1: "b"},
+			}},
+			Target: &TestFlexTF05{},
+			WantTarget: &TestFlexTF05{Field1: fwtypes.NewListNestedObjectValueOfValueSlice(ctx, []TestFlexTF01{
+				{Field1: types.StringValue("a")},
+				{Field1: types.StringValue("b")},
+			})},
+		},
+		{
+			TestName: "non-empty []struct and non-empty set Target",
+			Source: &TestFlexAWS08{Field1: []TestFlexAWS01{
+				{Field1: "a"},
+				{Field1: "b"},
+			}},
+			Target: &TestFlexTF06{},
+			WantTarget: &TestFlexTF06{Field1: fwtypes.NewSetNestedObjectValueOfValueSlice(ctx, []TestFlexTF01{
+				{Field1: types.StringValue("a")},
+				{Field1: types.StringValue("b")},
+			})},
+		},
+		{
+			TestName:   "nil []*struct and null list Target",
+			Source:     &TestFlexAWS07{},
+			Target:     &TestFlexTF05{},
+			WantTarget: &TestFlexTF05{Field1: fwtypes.NewListNestedObjectValueOfNull[TestFlexTF01](ctx)},
+		},
+		{
+			TestName:   "nil []*struct and null set Target",
+			Source:     &TestFlexAWS07{},
+			Target:     &TestFlexTF06{},
+			WantTarget: &TestFlexTF06{Field1: fwtypes.NewSetNestedObjectValueOfNull[TestFlexTF01](ctx)},
+		},
+		{
+			TestName:   "empty []*struct and empty list Target",
+			Source:     &TestFlexAWS07{Field1: []*TestFlexAWS01{}},
+			Target:     &TestFlexTF05{},
+			WantTarget: &TestFlexTF05{Field1: fwtypes.NewListNestedObjectValueOfSlice(ctx, []*TestFlexTF01{})},
+		},
+		{
+			TestName:   "empty []*struct and empty set Target",
+			Source:     &TestFlexAWS07{Field1: []*TestFlexAWS01{}},
+			Target:     &TestFlexTF06{},
+			WantTarget: &TestFlexTF06{Field1: fwtypes.NewSetNestedObjectValueOfSlice(ctx, []*TestFlexTF01{})},
+		},
+		{
+			TestName: "non-empty []*struct and non-empty list Target",
+			Source: &TestFlexAWS07{Field1: []*TestFlexAWS01{
+				{Field1: "a"},
+				{Field1: "b"},
+			}},
+			Target: &TestFlexTF05{},
+			WantTarget: &TestFlexTF05{Field1: fwtypes.NewListNestedObjectValueOfSlice(ctx, []*TestFlexTF01{
+				{Field1: types.StringValue("a")},
+				{Field1: types.StringValue("b")},
+			})},
+		},
+		{
+			TestName: "non-empty []*struct and non-empty set Target",
+			Source: &TestFlexAWS07{Field1: []*TestFlexAWS01{
+				{Field1: "a"},
+				{Field1: "b"},
+			}},
+			Target: &TestFlexTF06{},
+			WantTarget: &TestFlexTF06{Field1: fwtypes.NewSetNestedObjectValueOfSlice(ctx, []*TestFlexTF01{
+				{Field1: types.StringValue("a")},
+				{Field1: types.StringValue("b")},
+			})},
+		},
+		{
+			TestName: "complex Source and complex Target",
+			Source: &TestFlexAWS09{
+				Field1: "m",
+				Field2: &TestFlexAWS06{Field1: &TestFlexAWS01{Field1: "n"}},
+				Field3: aws.StringMap(map[string]string{"X": "x", "Y": "y"}),
+				Field4: []TestFlexAWS03{{Field1: 100}, {Field1: 2000}, {Field1: 30000}},
+			},
+			Target: &TestFlexTF07{},
+			WantTarget: &TestFlexTF07{
+				Field1: types.StringValue("m"),
+				Field2: fwtypes.NewListNestedObjectValueOfPtr(ctx, &TestFlexTF05{
+					Field1: fwtypes.NewListNestedObjectValueOfPtr(ctx, &TestFlexTF01{
+						Field1: types.StringValue("n"),
+					}),
+				}),
+				Field3: types.MapValueMust(types.StringType, map[string]attr.Value{
+					"X": types.StringValue("x"),
+					"Y": types.StringValue("y"),
+				}),
+				Field4: fwtypes.NewSetNestedObjectValueOfValueSlice(ctx, []TestFlexTF02{
+					{Field1: types.Int64Value(100)},
+					{Field1: types.Int64Value(2000)},
+					{Field1: types.Int64Value(30000)},
+				}),
+			},
+		},
+		{
+			TestName: "plural ordinary field names",
+			Source: &TestFlexAWS10{
+				Fields: []TestFlexAWS01{{Field1: "a"}},
+			},
+			Target: &TestFlexTF08{},
+			WantTarget: &TestFlexTF08{
+				Field: fwtypes.NewListNestedObjectValueOfPtr(ctx, &TestFlexTF01{
+					Field1: types.StringValue("a"),
+				}),
+			},
+		},
+		{
+			TestName: "plural field names",
+			Source: &TestFlexAWS11{
+				Cities: []*string{
+					aws.String("paris"),
+					aws.String("london"),
+				},
+				Coaches: []*string{
+					aws.String("guardiola"),
+					aws.String("mourinho"),
+				},
+				Tomatoes: []*string{
+					aws.String("brandywine"),
+					aws.String("roma"),
+				},
+				Vertices: []*string{
+					aws.String("ab"),
+					aws.String("bc"),
+				},
+				Criteria: []*string{
+					aws.String("votes"),
+					aws.String("editors"),
+				},
+				Data: []*string{
+					aws.String("d1282f78-fa99-5d9d-bd51-e6f0173eb74a"),
+					aws.String("0f10cb10-2076-5254-bd21-d3f62fe66303"),
+				},
+				Hives: []*string{
+					aws.String("Cegieme"),
+					aws.String("Fahumvid"),
+				},
+			},
+			Target: &TestFlexTF09{},
+			WantTarget: &TestFlexTF09{
+				City: types.ListValueMust(types.StringType, []attr.Value{
+					types.StringValue("paris"),
+					types.StringValue("london"),
+				}),
+				Coach: types.ListValueMust(types.StringType, []attr.Value{
+					types.StringValue("guardiola"),
+					types.StringValue("mourinho"),
+				}),
+				Tomato: types.ListValueMust(types.StringType, []attr.Value{
+					types.StringValue("brandywine"),
+					types.StringValue("roma"),
+				}),
+				Vertex: types.ListValueMust(types.StringType, []attr.Value{
+					types.StringValue("ab"),
+					types.StringValue("bc"),
+				}),
+				Criterion: types.ListValueMust(types.StringType, []attr.Value{
+					types.StringValue("votes"),
+					types.StringValue("editors"),
+				}),
+				Datum: types.ListValueMust(types.StringType, []attr.Value{
+					types.StringValue("d1282f78-fa99-5d9d-bd51-e6f0173eb74a"),
+					types.StringValue("0f10cb10-2076-5254-bd21-d3f62fe66303"),
+				}),
+				Hive: types.ListValueMust(types.StringType, []attr.Value{
+					types.StringValue("Cegieme"),
+					types.StringValue("Fahumvid"),
+				}),
+			},
+		},
+		{
+			TestName: "capitalization field names",
+			Source: &TestFlexAWS12{
+				FieldUrl: aws.String("h"),
+			},
+			Target: &TestFlexTF10{},
+			WantTarget: &TestFlexTF10{
+				FieldURL: types.StringValue("h"),
+			},
+		},
+	}
+
+	for _, testCase := range testCases {
+		testCase := testCase
+		t.Run(testCase.TestName, func(t *testing.T) {
+			t.Parallel()
+
+			err := Flatten(ctx, testCase.Source, testCase.Target)
+			gotErr := err != nil
+
+			if gotErr != testCase.WantErr {
+				t.Errorf("gotErr = %v, wantErr = %v", gotErr, testCase.WantErr)
+			}
+
+			if gotErr {
+				if !testCase.WantErr {
+					t.Errorf("err = %q", err)
+				}
+			} else if diff := cmp.Diff(testCase.Target, testCase.WantTarget); diff != "" {
+				t.Errorf("unexpected diff (+wanted, -got): %s", diff)
+			}
+		})
+	}
+}
diff --git a/internal/framework/flex/bool.go b/internal/framework/flex/bool.go
new file mode 100644
index 00000000000..470d9483480
--- /dev/null
+++ b/internal/framework/flex/bool.go
@@ -0,0 +1,46 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package flex
+
+import (
+	"context"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/hashicorp/terraform-plugin-framework/diag"
+	"github.com/hashicorp/terraform-plugin-framework/types"
+	"github.com/hashicorp/terraform-plugin-framework/types/basetypes"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs/fwdiag"
+)
+
+// BoolFromFramework converts a Framework Bool value to a bool pointer.
+// A null Bool is converted to a nil bool pointer.
+func BoolFromFramework(ctx context.Context, v basetypes.BoolValuable) *bool {
+	var output *bool
+
+	panicOnError(Expand(ctx, v, &output))
+
+	return output
+}
+
+// BoolToFramework converts a bool pointer to a Framework Bool value.
+// A nil bool pointer is converted to a null Bool.
+func BoolToFramework(ctx context.Context, v *bool) types.Bool {
+	var output types.Bool
+
+	panicOnError(Flatten(ctx, v, &output))
+
+	return output
+}
+
+// BoolToFrameworkLegacy converts a bool pointer to a Framework Bool value.
+// A nil bool pointer is converted to a false Bool.
+func BoolToFrameworkLegacy(_ context.Context, v *bool) types.Bool {
+	return types.BoolValue(aws.ToBool(v))
+}
+
+func panicOnError(diags diag.Diagnostics) {
+	if err := fwdiag.DiagnosticsError(diags); err != nil {
+		panic(err)
+	}
+}
diff --git a/internal/framework/flex/bool_test.go b/internal/framework/flex/bool_test.go
new file mode 100644
index 00000000000..a0ca89faf7f
--- /dev/null
+++ b/internal/framework/flex/bool_test.go
@@ -0,0 +1,114 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package flex_test
+
+import (
+	"context"
+	"testing"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/google/go-cmp/cmp"
+	"github.com/hashicorp/terraform-plugin-framework/types"
+	"github.com/hashicorp/terraform-provider-aws/internal/framework/flex"
+)
+
+func TestBoolFromFramework(t *testing.T) {
+	t.Parallel()
+
+	type testCase struct {
+		input    types.Bool
+		expected *bool
+	}
+	tests := map[string]testCase{
+		"valid bool": {
+			input:    types.BoolValue(true),
+			expected: aws.Bool(true),
+		},
+		"null bool": {
+			input:    types.BoolNull(),
+			expected: nil,
+		},
+		"unknown bool": {
+			input:    types.BoolUnknown(),
+			expected: nil,
+		},
+	}
+
+	for name, test := range tests {
+		name, test := name, test
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			got := flex.BoolFromFramework(context.Background(), test.input)
+
+			if diff := cmp.Diff(got, test.expected); diff != "" {
+				t.Errorf("unexpected diff (+wanted, -got): %s", diff)
+			}
+		})
+	}
+}
+
+func TestBoolToFramework(t *testing.T) {
+	t.Parallel()
+
+	type testCase struct {
+		input    *bool
+		expected types.Bool
+	}
+	tests := map[string]testCase{
+		"valid bool": {
+			input:    aws.Bool(true),
+			expected: types.BoolValue(true),
+		},
+		"nil bool": {
+			input:    nil,
+			expected: types.BoolNull(),
+		},
+	}
+
+	for name, test := range tests {
+		name, test := name, test
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			got := flex.BoolToFramework(context.Background(), test.input)
+
+			if diff := cmp.Diff(got, test.expected); diff != "" {
+				t.Errorf("unexpected diff (+wanted, -got): %s", diff)
+			}
+		})
+	}
+}
+
+func TestBoolToFrameworkLegacy(t *testing.T) {
+	t.Parallel()
+
+	type testCase struct {
+		input    *bool
+		expected types.Bool
+	}
+	tests := map[string]testCase{
+		"valid bool": {
+			input:    aws.Bool(true),
+			expected: types.BoolValue(true),
+		},
+		"nil bool": {
+			input:    nil,
+			expected: types.BoolValue(false),
+		},
+	}
+
+	for name, test := range tests {
+		name, test := name, test
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			got := flex.BoolToFrameworkLegacy(context.Background(), test.input)
+
+			if diff := cmp.Diff(got, test.expected); diff != "" {
+				t.Errorf("unexpected diff (+wanted, -got): %s", diff)
+			}
+		})
+	}
+}
diff --git a/internal/framework/flex/flex.go b/internal/framework/flex/flex.go
index 8b79c265388..c15a5e76b93 100644
--- a/internal/framework/flex/flex.go
+++ b/internal/framework/flex/flex.go
@@ -1,80 +1,22 @@
-package flex
-
-import (
-	"context"
-	"fmt"
-
-	"github.com/aws/aws-sdk-go-v2/aws"
-	"github.com/aws/aws-sdk-go-v2/aws/arn"
-	"github.com/hashicorp/terraform-plugin-framework/diag"
-	"github.com/hashicorp/terraform-plugin-framework/types"
-	"github.com/hashicorp/terraform-provider-aws/internal/flex"
-	fwtypes "github.com/hashicorp/terraform-provider-aws/internal/framework/types"
-)
-
-// Breaking the cycles without changing all files
-var (
-	BoolFromFramework        = flex.BoolFromFramework
-	ExpandFrameworkStringSet = flex.ExpandFrameworkStringSet
-	Int64FromFramework       = flex.Int64FromFramework
-	StringFromFramework      = flex.StringFromFramework
-)
-
-var (
-	BoolToFramework                 = flex.BoolToFramework
-	FlattenFrameworkStringSetLegacy = flex.FlattenFrameworkStringSetLegacy
-	Int64ToFramework                = flex.Int64ToFramework
-	Int64ToFrameworkLegacy          = flex.Int64ToFrameworkLegacy
-	StringToFramework               = flex.StringToFramework
-	StringToFrameworkLegacy         = flex.StringToFrameworkLegacy
-)
-
-func ARNStringFromFramework(_ context.Context, v fwtypes.ARN) *string {
-	if v.IsNull() || v.IsUnknown() {
-		return nil
-	}
-
-	return aws.String(v.ValueARN().String())
-}
-
-func StringToFrameworkARN(ctx context.Context, v *string, diags *diag.Diagnostics) fwtypes.ARN {
-	if v == nil {
-		return fwtypes.ARNNull()
-	}
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
-	a, err := arn.Parse(aws.ToString(v))
-	if err != nil {
-		diags.AddError(
-			"Parsing Error",
-			fmt.Sprintf("String %s cannot be parsed as an ARN.", aws.ToString(v)),
-		)
-	}
-
-	return fwtypes.ARNValue(a)
-}
-
-func Int64FromFrameworkLegacy(_ context.Context, v types.Int64) *int64 {
-	if v.IsNull() || v.IsUnknown() {
-		return nil
-	}
+package flex
 
-	i := v.ValueInt64()
-	if i == 0 {
-		return nil
-	}
+type Set[T comparable] []T
 
-	return aws.Int64(i)
-}
-
-func StringFromFrameworkLegacy(_ context.Context, v types.String) *string {
-	if v.IsNull() || v.IsUnknown() {
-		return nil
+// Difference find the elements in two sets that are not similar.
+func (s Set[T]) Difference(ns Set[T]) Set[T] {
+	m := make(map[T]struct{})
+	for _, v := range ns {
+		m[v] = struct{}{}
 	}
 
-	s := v.ValueString()
-	if s == "" {
-		return nil
+	var result []T
+	for _, v := range s {
+		if _, ok := m[v]; !ok {
+			result = append(result, v)
+		}
 	}
-
-	return aws.String(s)
+	return result
 }
diff --git a/internal/framework/flex/flex_test.go b/internal/framework/flex/flex_test.go
new file mode 100644
index 00000000000..c2143bf8efc
--- /dev/null
+++ b/internal/framework/flex/flex_test.go
@@ -0,0 +1,59 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package flex
+
+import (
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+)
+
+func TestSet_Difference_strings(t *testing.T) {
+	t.Parallel()
+
+	type testCase struct {
+		original Set[string]
+		new      Set[string]
+		expected Set[string]
+	}
+	tests := map[string]testCase{
+		"nil": {
+			original: nil,
+			new:      nil,
+			expected: nil,
+		},
+		"equal": {
+			original: Set[string]{"one"},
+			new:      Set[string]{"one"},
+			expected: nil,
+		},
+		"difference": {
+			original: Set[string]{"one", "two", "four"},
+			new:      Set[string]{"one", "two", "three"},
+			expected: Set[string]{"four"},
+		},
+		"difference_remove": {
+			original: Set[string]{"one", "two"},
+			new:      Set[string]{"one"},
+			expected: Set[string]{"two"},
+		},
+		"difference_add": {
+			original: Set[string]{"one"},
+			new:      Set[string]{"one", "two"},
+			expected: nil,
+		},
+	}
+
+	for name, test := range tests {
+		name, test := name, test
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			got := test.original.Difference(test.new)
+			if diff := cmp.Diff(got, test.expected); diff != "" {
+				t.Errorf("unexpected diff (+wanted, -got): %s", diff)
+			}
+		})
+	}
+}
diff --git a/internal/framework/flex/float.go b/internal/framework/flex/float.go
new file mode 100644
index 00000000000..031f18091b3
--- /dev/null
+++ b/internal/framework/flex/float.go
@@ -0,0 +1,27 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package flex
+
+import (
+	"context"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/hashicorp/terraform-plugin-framework/types"
+)
+
+// Float64ToFramework converts a float64 pointer to a Framework Float64 value.
+// A nil float64 pointer is converted to a null Float64.
+func Float64ToFramework(ctx context.Context, v *float64) types.Float64 {
+	var output types.Float64
+
+	panicOnError(Flatten(ctx, v, &output))
+
+	return output
+}
+
+// Float64ToFrameworkLegacy converts a float64 pointer to a Framework Float64 value.
+// A nil float64 pointer is converted to a zero float64.
+func Float64ToFrameworkLegacy(_ context.Context, v *float64) types.Float64 {
+	return types.Float64Value(aws.ToFloat64(v))
+}
diff --git a/internal/framework/flex/float_test.go b/internal/framework/flex/float_test.go
new file mode 100644
index 00000000000..e053b046b6d
--- /dev/null
+++ b/internal/framework/flex/float_test.go
@@ -0,0 +1,86 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package flex_test
+
+import (
+	"context"
+	"testing"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/google/go-cmp/cmp"
+	"github.com/hashicorp/terraform-plugin-framework/types"
+	"github.com/hashicorp/terraform-provider-aws/internal/framework/flex"
+)
+
+func TestFloat64ToFramework(t *testing.T) {
+	t.Parallel()
+
+	type testCase struct {
+		input    *float64
+		expected types.Float64
+	}
+	tests := map[string]testCase{
+		"valid float64": {
+			input:    aws.Float64(42.1),
+			expected: types.Float64Value(42.1),
+		},
+		"zero float64": {
+			input:    aws.Float64(0),
+			expected: types.Float64Value(0),
+		},
+		"nil float64": {
+			input:    nil,
+			expected: types.Float64Null(),
+		},
+	}
+
+	for name, test := range tests {
+		name, test := name, test
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			got := flex.Float64ToFramework(context.Background(), test.input)
+
+			if diff := cmp.Diff(got, test.expected); diff != "" {
+				t.Errorf("unexpected diff (+wanted, -got): %s", diff)
+			}
+		})
+	}
+}
+
+func TestFloat64ToFrameworkLegacy(t *testing.T) {
+	t.Parallel()
+
+	type testCase struct {
+		input    *float64
+		expected types.Float64
+	}
+	tests := map[string]testCase{
+		"valid int64": {
+			input:    aws.Float64(42.1),
+			expected: types.Float64Value(42.1),
+		},
+		"zero int64": {
+			input:    aws.Float64(0),
+			expected: types.Float64Value(0),
+		},
+		"nil int64": {
+			input:    nil,
+			expected: types.Float64Value(0),
+		},
+	}
+
+	for name, test := range tests {
+		name, test := name, test
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			got := flex.Float64ToFrameworkLegacy(context.Background(), test.input)
+
+			if diff := cmp.Diff(got, test.expected); diff != "" {
+				t.Errorf("unexpected diff (+wanted, -got): %s", diff)
+			}
+		})
+	}
+}
diff --git a/internal/framework/flex/int.go b/internal/framework/flex/int.go
new file mode 100644
index 00000000000..ed8bca2be9e
--- /dev/null
+++ b/internal/framework/flex/int.go
@@ -0,0 +1,69 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package flex
+
+import (
+	"context"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/hashicorp/terraform-plugin-framework/types"
+	"github.com/hashicorp/terraform-plugin-framework/types/basetypes"
+)
+
+// Int64FromFramework converts a Framework Int64 value to an int64 pointer.
+// A null Int64 is converted to a nil int64 pointer.
+func Int64FromFramework(ctx context.Context, v basetypes.Int64Valuable) *int64 {
+	var output *int64
+
+	panicOnError(Expand(ctx, v, &output))
+
+	return output
+}
+
+// Int64ToFramework converts an int64 pointer to a Framework Int64 value.
+// A nil int64 pointer is converted to a null Int64.
+func Int64ToFramework(ctx context.Context, v *int64) types.Int64 {
+	var output types.Int64
+
+	panicOnError(Flatten(ctx, v, &output))
+
+	return output
+}
+
+// Int64ToFrameworkLegacy converts an int64 pointer to a Framework Int64 value.
+// A nil int64 pointer is converted to a zero Int64.
+func Int64ToFrameworkLegacy(_ context.Context, v *int64) types.Int64 {
+	return types.Int64Value(aws.ToInt64(v))
+}
+
+func Int64FromFrameworkLegacy(_ context.Context, v types.Int64) *int64 {
+	if v.IsNull() || v.IsUnknown() {
+		return nil
+	}
+
+	i := v.ValueInt64()
+	if i == 0 {
+		return nil
+	}
+
+	return aws.Int64(i)
+}
+
+func Int32ToFramework(ctx context.Context, v *int32) types.Int64 {
+	var output types.Int64
+
+	panicOnError(Flatten(ctx, v, &output))
+
+	return output
+}
+
+// Int32FromFramework coverts a Framework Int64 value to an int32 pointer.
+// A null Int64 is converted to a nil int32 pointer.
+func Int32FromFramework(ctx context.Context, v types.Int64) *int32 {
+	var output *int32
+
+	panicOnError(Expand(ctx, v, &output))
+
+	return output
+}
diff --git a/internal/framework/flex/int_test.go b/internal/framework/flex/int_test.go
new file mode 100644
index 00000000000..d91ab87541c
--- /dev/null
+++ b/internal/framework/flex/int_test.go
@@ -0,0 +1,202 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package flex_test
+
+import (
+	"context"
+	"testing"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/google/go-cmp/cmp"
+	"github.com/hashicorp/terraform-plugin-framework/types"
+	"github.com/hashicorp/terraform-provider-aws/internal/framework/flex"
+)
+
+func TestInt64FromFramework(t *testing.T) {
+	t.Parallel()
+
+	type testCase struct {
+		input    types.Int64
+		expected *int64
+	}
+	tests := map[string]testCase{
+		"valid int64": {
+			input:    types.Int64Value(42),
+			expected: aws.Int64(42),
+		},
+		"zero int64": {
+			input:    types.Int64Value(0),
+			expected: aws.Int64(0),
+		},
+		"null int64": {
+			input:    types.Int64Null(),
+			expected: nil,
+		},
+		"unknown int64": {
+			input:    types.Int64Unknown(),
+			expected: nil,
+		},
+	}
+
+	for name, test := range tests {
+		name, test := name, test
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			got := flex.Int64FromFramework(context.Background(), test.input)
+
+			if diff := cmp.Diff(got, test.expected); diff != "" {
+				t.Errorf("unexpected diff (+wanted, -got): %s", diff)
+			}
+		})
+	}
+}
+
+func TestInt64ToFramework(t *testing.T) {
+	t.Parallel()
+
+	type testCase struct {
+		input    *int64
+		expected types.Int64
+	}
+	tests := map[string]testCase{
+		"valid int64": {
+			input:    aws.Int64(42),
+			expected: types.Int64Value(42),
+		},
+		"zero int64": {
+			input:    aws.Int64(0),
+			expected: types.Int64Value(0),
+		},
+		"nil int64": {
+			input:    nil,
+			expected: types.Int64Null(),
+		},
+	}
+
+	for name, test := range tests {
+		name, test := name, test
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			got := flex.Int64ToFramework(context.Background(), test.input)
+
+			if diff := cmp.Diff(got, test.expected); diff != "" {
+				t.Errorf("unexpected diff (+wanted, -got): %s", diff)
+			}
+		})
+	}
+}
+
+func TestInt64ToFrameworkLegacy(t *testing.T) {
+	t.Parallel()
+
+	type testCase struct {
+		input    *int64
+		expected types.Int64
+	}
+	tests := map[string]testCase{
+		"valid int64": {
+			input:    aws.Int64(42),
+			expected: types.Int64Value(42),
+		},
+		"zero int64": {
+			input:    aws.Int64(0),
+			expected: types.Int64Value(0),
+		},
+		"nil int64": {
+			input:    nil,
+			expected: types.Int64Value(0),
+		},
+	}
+
+	for name, test := range tests {
+		name, test := name, test
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			got := flex.Int64ToFrameworkLegacy(context.Background(), test.input)
+
+			if diff := cmp.Diff(got, test.expected); diff != "" {
+				t.Errorf("unexpected diff (+wanted, -got): %s", diff)
+			}
+		})
+	}
+}
+
+func TestInt32ToFramework(t *testing.T) {
+	t.Parallel()
+
+	type testCase struct {
+		input    *int32
+		expected types.Int64
+	}
+	tests := map[string]testCase{
+		"valid int64": {
+			input:    aws.Int32(42),
+			expected: types.Int64Value(42),
+		},
+		"zero int64": {
+			input:    aws.Int32(0),
+			expected: types.Int64Value(0),
+		},
+		"nil int64": {
+			input:    nil,
+			expected: types.Int64Null(),
+		},
+	}
+
+	for name, test := range tests {
+		name, test := name, test
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			got := flex.Int32ToFramework(context.Background(), test.input)
+
+			if diff := cmp.Diff(got, test.expected); diff != "" {
+				t.Errorf("unexpected diff (+wanted, -got): %s", diff)
+			}
+		})
+	}
+}
+
+func TestInt32FromFramework(t *testing.T) {
+	t.Parallel()
+
+	type testCase struct {
+		input    types.Int64
+		expected *int32
+	}
+	tests := map[string]testCase{
+		"valid int64": {
+			input:    types.Int64Value(42),
+			expected: aws.Int32(42),
+		},
+		"zero int64": {
+			input:    types.Int64Value(0),
+			expected: aws.Int32(0),
+		},
+		"null int64": {
+			input:    types.Int64Null(),
+			expected: nil,
+		},
+		"unknown int64": {
+			input:    types.Int64Unknown(),
+			expected: nil,
+		},
+	}
+
+	for name, test := range tests {
+		name, test := name, test
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			got := flex.Int32FromFramework(context.Background(), test.input)
+
+			if diff := cmp.Diff(got, test.expected); diff != "" {
+				t.Errorf("unexpected diff (+wanted, -got): %s", diff)
+			}
+		})
+	}
+}
diff --git a/internal/framework/flex/list.go b/internal/framework/flex/list.go
new file mode 100644
index 00000000000..69a0b3df5d0
--- /dev/null
+++ b/internal/framework/flex/list.go
@@ -0,0 +1,136 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package flex
+
+import (
+	"context"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/hashicorp/terraform-plugin-framework/attr"
+	"github.com/hashicorp/terraform-plugin-framework/types"
+	"github.com/hashicorp/terraform-plugin-framework/types/basetypes"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs/fwdiag"
+	"github.com/hashicorp/terraform-provider-aws/internal/slices"
+)
+
+func ExpandFrameworkStringList(ctx context.Context, v basetypes.ListValuable) []*string {
+	var output []*string
+
+	panicOnError(Expand(ctx, v, &output))
+
+	return output
+}
+
+func ExpandFrameworkStringValueList(ctx context.Context, v basetypes.ListValuable) []string {
+	var output []string
+
+	panicOnError(Expand(ctx, v, &output))
+
+	return output
+}
+
+// FlattenFrameworkStringList converts a slice of string pointers to a framework List value.
+//
+// A nil slice is converted to a null List.
+// An empty slice is converted to a null List.
+func FlattenFrameworkStringList(ctx context.Context, v []*string) types.List {
+	if len(v) == 0 {
+		return types.ListNull(types.StringType)
+	}
+
+	var output types.List
+
+	panicOnError(Flatten(ctx, v, &output))
+
+	return output
+}
+
+// FlattenFrameworkStringListLegacy is the Plugin Framework variant of FlattenStringList.
+// A nil slice is converted to an empty (non-null) List.
+func FlattenFrameworkStringListLegacy(_ context.Context, vs []*string) types.List {
+	elems := make([]attr.Value, len(vs))
+
+	for i, v := range vs {
+		elems[i] = types.StringValue(aws.ToString(v))
+	}
+
+	return types.ListValueMust(types.StringType, elems)
+}
+
+// FlattenFrameworkStringValueList converts a slice of string values to a framework List value.
+//
+// A nil slice is converted to a null List.
+// An empty slice is converted to a null List.
+func FlattenFrameworkStringValueList(ctx context.Context, v []string) types.List {
+	if len(v) == 0 {
+		return types.ListNull(types.StringType)
+	}
+
+	var output types.List
+
+	panicOnError(Flatten(ctx, v, &output))
+
+	return output
+}
+
+// FlattenFrameworkStringValueListLegacy is the Plugin Framework variant of FlattenStringValueList.
+// A nil slice is converted to an empty (non-null) List.
+func FlattenFrameworkStringValueListLegacy(_ context.Context, vs []string) types.List {
+	elems := make([]attr.Value, len(vs))
+
+	for i, v := range vs {
+		elems[i] = types.StringValue(v)
+	}
+
+	return types.ListValueMust(types.StringType, elems)
+}
+
+type FrameworkElementExpanderFunc[T any, U any] func(context.Context, T) U
+
+func ExpandFrameworkListNestedBlock[T any, U any](ctx context.Context, tfList types.List, f FrameworkElementExpanderFunc[T, U]) []U {
+	if tfList.IsNull() || tfList.IsUnknown() {
+		return nil
+	}
+
+	var data []T
+
+	_ = fwdiag.Must(0, tfList.ElementsAs(ctx, &data, false))
+
+	return slices.ApplyToAll(data, func(t T) U {
+		return f(ctx, t)
+	})
+}
+
+func ExpandFrameworkListNestedBlockPtr[T any, U any](ctx context.Context, tfList types.List, f FrameworkElementExpanderFunc[T, *U]) *U {
+	if tfList.IsNull() || tfList.IsUnknown() {
+		return nil
+	}
+
+	var data []T
+
+	_ = fwdiag.Must(0, tfList.ElementsAs(ctx, &data, false))
+
+	if len(data) == 0 {
+		return nil
+	}
+
+	return f(ctx, data[0])
+}
+
+type FrameworkElementFlattenerFunc[T any, U any] func(context.Context, U) T
+
+func FlattenFrameworkListNestedBlock[T any, U any](ctx context.Context, apiObjects []U, f FrameworkElementFlattenerFunc[T, U]) types.List {
+	attributeTypes := AttributeTypesMust[T](ctx)
+	elementType := types.ObjectType{AttrTypes: attributeTypes}
+
+	if len(apiObjects) == 0 {
+		return types.ListNull(elementType)
+	}
+
+	data := slices.ApplyToAll(apiObjects, func(apiObject U) T {
+		return f(ctx, apiObject)
+	})
+
+	return fwdiag.Must(types.ListValueFrom(ctx, elementType, data))
+}
diff --git a/internal/framework/flex/list_test.go b/internal/framework/flex/list_test.go
new file mode 100644
index 00000000000..22e5550eb5b
--- /dev/null
+++ b/internal/framework/flex/list_test.go
@@ -0,0 +1,269 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package flex_test
+
+import (
+	"context"
+	"testing"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/google/go-cmp/cmp"
+	"github.com/hashicorp/terraform-plugin-framework/attr"
+	"github.com/hashicorp/terraform-plugin-framework/types"
+	"github.com/hashicorp/terraform-provider-aws/internal/framework/flex"
+)
+
+func TestExpandFrameworkStringList(t *testing.T) {
+	t.Parallel()
+
+	type testCase struct {
+		input    types.List
+		expected []*string
+	}
+	tests := map[string]testCase{
+		"null": {
+			input:    types.ListNull(types.StringType),
+			expected: nil,
+		},
+		"unknown": {
+			input:    types.ListUnknown(types.StringType),
+			expected: nil,
+		},
+		"two elements": {
+			input: types.ListValueMust(types.StringType, []attr.Value{
+				types.StringValue("GET"),
+				types.StringValue("HEAD"),
+			}),
+			expected: []*string{aws.String("GET"), aws.String("HEAD")},
+		},
+		"zero elements": {
+			input:    types.ListValueMust(types.StringType, []attr.Value{}),
+			expected: []*string{},
+		},
+		"invalid element type": {
+			input: types.ListValueMust(types.Int64Type, []attr.Value{
+				types.Int64Value(42),
+			}),
+			expected: nil,
+		},
+	}
+
+	for name, test := range tests {
+		name, test := name, test
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			got := flex.ExpandFrameworkStringList(context.Background(), test.input)
+
+			if diff := cmp.Diff(got, test.expected); diff != "" {
+				t.Errorf("unexpected diff (+wanted, -got): %s", diff)
+			}
+		})
+	}
+}
+
+func TestExpandFrameworkStringValueList(t *testing.T) {
+	t.Parallel()
+
+	type testCase struct {
+		input    types.List
+		expected []string
+	}
+	tests := map[string]testCase{
+		"null": {
+			input:    types.ListNull(types.StringType),
+			expected: nil,
+		},
+		"unknown": {
+			input:    types.ListUnknown(types.StringType),
+			expected: nil,
+		},
+		"two elements": {
+			input: types.ListValueMust(types.StringType, []attr.Value{
+				types.StringValue("GET"),
+				types.StringValue("HEAD"),
+			}),
+			expected: []string{"GET", "HEAD"},
+		},
+		"zero elements": {
+			input:    types.ListValueMust(types.StringType, []attr.Value{}),
+			expected: []string{},
+		},
+		"invalid element type": {
+			input: types.ListValueMust(types.Int64Type, []attr.Value{
+				types.Int64Value(42),
+			}),
+			expected: nil,
+		},
+	}
+
+	for name, test := range tests {
+		name, test := name, test
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			got := flex.ExpandFrameworkStringValueList(context.Background(), test.input)
+
+			if diff := cmp.Diff(got, test.expected); diff != "" {
+				t.Errorf("unexpected diff (+wanted, -got): %s", diff)
+			}
+		})
+	}
+}
+
+func TestFlattenFrameworkStringList(t *testing.T) {
+	t.Parallel()
+
+	type testCase struct {
+		input    []*string
+		expected types.List
+	}
+	tests := map[string]testCase{
+		"two elements": {
+			input: []*string{aws.String("GET"), aws.String("HEAD")},
+			expected: types.ListValueMust(types.StringType, []attr.Value{
+				types.StringValue("GET"),
+				types.StringValue("HEAD"),
+			}),
+		},
+		"zero elements": {
+			input:    []*string{},
+			expected: types.ListNull(types.StringType),
+		},
+		"nil array": {
+			input:    nil,
+			expected: types.ListNull(types.StringType),
+		},
+	}
+
+	for name, test := range tests {
+		name, test := name, test
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			got := flex.FlattenFrameworkStringList(context.Background(), test.input)
+
+			if diff := cmp.Diff(got, test.expected); diff != "" {
+				t.Errorf("unexpected diff (+wanted, -got): %s", diff)
+			}
+		})
+	}
+}
+
+func TestFlattenFrameworkStringListLegacy(t *testing.T) {
+	t.Parallel()
+
+	type testCase struct {
+		input    []*string
+		expected types.List
+	}
+	tests := map[string]testCase{
+		"two elements": {
+			input: []*string{aws.String("GET"), aws.String("HEAD")},
+			expected: types.ListValueMust(types.StringType, []attr.Value{
+				types.StringValue("GET"),
+				types.StringValue("HEAD"),
+			}),
+		},
+		"zero elements": {
+			input:    []*string{},
+			expected: types.ListValueMust(types.StringType, []attr.Value{}),
+		},
+		"nil array": {
+			input:    nil,
+			expected: types.ListValueMust(types.StringType, []attr.Value{}),
+		},
+	}
+
+	for name, test := range tests {
+		name, test := name, test
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			got := flex.FlattenFrameworkStringListLegacy(context.Background(), test.input)
+
+			if diff := cmp.Diff(got, test.expected); diff != "" {
+				t.Errorf("unexpected diff (+wanted, -got): %s", diff)
+			}
+		})
+	}
+}
+
+func TestFlattenFrameworkStringValueList(t *testing.T) {
+	t.Parallel()
+
+	type testCase struct {
+		input    []string
+		expected types.List
+	}
+	tests := map[string]testCase{
+		"two elements": {
+			input: []string{"GET", "HEAD"},
+			expected: types.ListValueMust(types.StringType, []attr.Value{
+				types.StringValue("GET"),
+				types.StringValue("HEAD"),
+			}),
+		},
+		"zero elements": {
+			input:    []string{},
+			expected: types.ListNull(types.StringType),
+		},
+		"nil array": {
+			input:    nil,
+			expected: types.ListNull(types.StringType),
+		},
+	}
+
+	for name, test := range tests {
+		name, test := name, test
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			got := flex.FlattenFrameworkStringValueList(context.Background(), test.input)
+
+			if diff := cmp.Diff(got, test.expected); diff != "" {
+				t.Errorf("unexpected diff (+wanted, -got): %s", diff)
+			}
+		})
+	}
+}
+
+func TestFlattenFrameworkStringValueListLegacy(t *testing.T) {
+	t.Parallel()
+
+	type testCase struct {
+		input    []string
+		expected types.List
+	}
+	tests := map[string]testCase{
+		"two elements": {
+			input: []string{"GET", "HEAD"},
+			expected: types.ListValueMust(types.StringType, []attr.Value{
+				types.StringValue("GET"),
+				types.StringValue("HEAD"),
+			}),
+		},
+		"zero elements": {
+			input:    []string{},
+			expected: types.ListValueMust(types.StringType, []attr.Value{}),
+		},
+		"nil array": {
+			input:    nil,
+			expected: types.ListValueMust(types.StringType, []attr.Value{}),
+		},
+	}
+
+	for name, test := range tests {
+		name, test := name, test
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			got := flex.FlattenFrameworkStringValueListLegacy(context.Background(), test.input)
+
+			if diff := cmp.Diff(got, test.expected); diff != "" {
+				t.Errorf("unexpected diff (+wanted, -got): %s", diff)
+			}
+		})
+	}
+}
diff --git a/internal/framework/flex/map.go b/internal/framework/flex/map.go
new file mode 100644
index 00000000000..5d307e960f5
--- /dev/null
+++ b/internal/framework/flex/map.go
@@ -0,0 +1,72 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package flex
+
+import (
+	"context"
+
+	"github.com/hashicorp/terraform-plugin-framework/attr"
+	"github.com/hashicorp/terraform-plugin-framework/types"
+	"github.com/hashicorp/terraform-plugin-framework/types/basetypes"
+)
+
+func ExpandFrameworkStringMap(ctx context.Context, v basetypes.MapValuable) map[string]*string {
+	var output map[string]*string
+
+	panicOnError(Expand(ctx, v, &output))
+
+	return output
+}
+
+func ExpandFrameworkStringValueMap(ctx context.Context, v basetypes.MapValuable) map[string]string {
+	var output map[string]string
+
+	panicOnError(Expand(ctx, v, &output))
+
+	return output
+}
+
+// FlattenFrameworkStringMap converts a map of string pointers to a framework Map value.
+//
+// A nil map is converted to a null Map.
+// An empty map is converted to a null Map.
+func FlattenFrameworkStringMap(ctx context.Context, v map[string]*string) types.Map {
+	if len(v) == 0 {
+		return types.MapNull(types.StringType)
+	}
+
+	var output types.Map
+
+	panicOnError(Flatten(ctx, v, &output))
+
+	return output
+}
+
+// FlattenFrameworkStringValueMap converts a map of strings to a framework Map value.
+//
+// A nil map is converted to a null Map.
+// An empty map is converted to a null Map.
+func FlattenFrameworkStringValueMap(ctx context.Context, v map[string]string) types.Map {
+	if len(v) == 0 {
+		return types.MapNull(types.StringType)
+	}
+
+	var output types.Map
+
+	panicOnError(Flatten(ctx, v, &output))
+
+	return output
+}
+
+// FlattenFrameworkStringValueMapLegacy has no Plugin SDK equivalent as schema.ResourceData.Set can be passed string value maps directly.
+// A nil map is converted to an empty (non-null) Map.
+func FlattenFrameworkStringValueMapLegacy(_ context.Context, m map[string]string) types.Map {
+	elems := make(map[string]attr.Value, len(m))
+
+	for k, v := range m {
+		elems[k] = types.StringValue(v)
+	}
+
+	return types.MapValueMust(types.StringType, elems)
+}
diff --git a/internal/framework/flex/map_test.go b/internal/framework/flex/map_test.go
new file mode 100644
index 00000000000..5fcd775e0b5
--- /dev/null
+++ b/internal/framework/flex/map_test.go
@@ -0,0 +1,245 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package flex_test
+
+import (
+	"context"
+	"testing"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/google/go-cmp/cmp"
+	"github.com/hashicorp/terraform-plugin-framework/attr"
+	"github.com/hashicorp/terraform-plugin-framework/types"
+	"github.com/hashicorp/terraform-provider-aws/internal/framework/flex"
+)
+
+func TestExpandFrameworkStringMap(t *testing.T) {
+	t.Parallel()
+
+	type testCase struct {
+		input    types.Map
+		expected map[string]*string
+	}
+	tests := map[string]testCase{
+		"null": {
+			input:    types.MapNull(types.StringType),
+			expected: nil,
+		},
+		"unknown": {
+			input:    types.MapUnknown(types.StringType),
+			expected: nil,
+		},
+		"two elements": {
+			input: types.MapValueMust(types.StringType, map[string]attr.Value{
+				"one": types.StringValue("GET"),
+				"two": types.StringValue("HEAD"),
+			}),
+			expected: aws.StringMap(map[string]string{
+				"one": "GET",
+				"two": "HEAD",
+			}),
+		},
+		"zero elements": {
+			input:    types.MapValueMust(types.StringType, map[string]attr.Value{}),
+			expected: aws.StringMap(map[string]string{}),
+		},
+		"invalid element type": {
+			input: types.MapValueMust(types.BoolType, map[string]attr.Value{
+				"one": types.BoolValue(true),
+			}),
+			expected: nil,
+		},
+	}
+
+	for name, test := range tests {
+		name, test := name, test
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			got := flex.ExpandFrameworkStringMap(context.Background(), test.input)
+
+			if diff := cmp.Diff(got, test.expected); diff != "" {
+				t.Errorf("unexpected diff (+wanted, -got): %s", diff)
+			}
+		})
+	}
+}
+
+func TestExpandFrameworkStringValueMap(t *testing.T) {
+	t.Parallel()
+
+	type testCase struct {
+		input    types.Map
+		expected map[string]string
+	}
+	tests := map[string]testCase{
+		"null": {
+			input:    types.MapNull(types.StringType),
+			expected: nil,
+		},
+		"unknown": {
+			input:    types.MapUnknown(types.StringType),
+			expected: nil,
+		},
+		"two elements": {
+			input: types.MapValueMust(types.StringType, map[string]attr.Value{
+				"one": types.StringValue("GET"),
+				"two": types.StringValue("HEAD"),
+			}),
+			expected: map[string]string{
+				"one": "GET",
+				"two": "HEAD",
+			},
+		},
+		"zero elements": {
+			input:    types.MapValueMust(types.StringType, map[string]attr.Value{}),
+			expected: map[string]string{},
+		},
+		"invalid element type": {
+			input: types.MapValueMust(types.BoolType, map[string]attr.Value{
+				"one": types.BoolValue(true),
+			}),
+			expected: nil,
+		},
+	}
+
+	for name, test := range tests {
+		name, test := name, test
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			got := flex.ExpandFrameworkStringValueMap(context.Background(), test.input)
+
+			if diff := cmp.Diff(got, test.expected); diff != "" {
+				t.Errorf("unexpected diff (+wanted, -got): %s", diff)
+			}
+		})
+	}
+}
+
+func TestFlattenFrameworkStringMap(t *testing.T) {
+	t.Parallel()
+
+	type testCase struct {
+		input    map[string]*string
+		expected types.Map
+	}
+	tests := map[string]testCase{
+		"two elements": {
+			input: aws.StringMap(map[string]string{
+				"one": "GET",
+				"two": "HEAD",
+			}),
+			expected: types.MapValueMust(types.StringType, map[string]attr.Value{
+				"one": types.StringValue("GET"),
+				"two": types.StringValue("HEAD"),
+			}),
+		},
+		"zero elements": {
+			input:    aws.StringMap(map[string]string{}),
+			expected: types.MapNull(types.StringType),
+		},
+		"nil map": {
+			input:    nil,
+			expected: types.MapNull(types.StringType),
+		},
+	}
+
+	for name, test := range tests {
+		name, test := name, test
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			got := flex.FlattenFrameworkStringMap(context.Background(), test.input)
+
+			if diff := cmp.Diff(got, test.expected); diff != "" {
+				t.Errorf("unexpected diff (+wanted, -got): %s", diff)
+			}
+		})
+	}
+}
+
+func TestFlattenFrameworkStringValueMap(t *testing.T) {
+	t.Parallel()
+
+	type testCase struct {
+		input    map[string]string
+		expected types.Map
+	}
+	tests := map[string]testCase{
+		"two elements": {
+			input: map[string]string{
+				"one": "GET",
+				"two": "HEAD",
+			},
+			expected: types.MapValueMust(types.StringType, map[string]attr.Value{
+				"one": types.StringValue("GET"),
+				"two": types.StringValue("HEAD"),
+			}),
+		},
+		"zero elements": {
+			input:    map[string]string{},
+			expected: types.MapNull(types.StringType),
+		},
+		"nil map": {
+			input:    nil,
+			expected: types.MapNull(types.StringType),
+		},
+	}
+
+	for name, test := range tests {
+		name, test := name, test
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			got := flex.FlattenFrameworkStringValueMap(context.Background(), test.input)
+
+			if diff := cmp.Diff(got, test.expected); diff != "" {
+				t.Errorf("unexpected diff (+wanted, -got): %s", diff)
+			}
+		})
+	}
+}
+
+func TestFlattenFrameworkStringValueMapLegacy(t *testing.T) {
+	t.Parallel()
+
+	type testCase struct {
+		input    map[string]string
+		expected types.Map
+	}
+	tests := map[string]testCase{
+		"two elements": {
+			input: map[string]string{
+				"one": "GET",
+				"two": "HEAD",
+			},
+			expected: types.MapValueMust(types.StringType, map[string]attr.Value{
+				"one": types.StringValue("GET"),
+				"two": types.StringValue("HEAD"),
+			}),
+		},
+		"zero elements": {
+			input:    map[string]string{},
+			expected: types.MapValueMust(types.StringType, map[string]attr.Value{}),
+		},
+		"nil map": {
+			input:    nil,
+			expected: types.MapValueMust(types.StringType, map[string]attr.Value{}),
+		},
+	}
+
+	for name, test := range tests {
+		name, test := name, test
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			got := flex.FlattenFrameworkStringValueMapLegacy(context.Background(), test.input)
+
+			if diff := cmp.Diff(got, test.expected); diff != "" {
+				t.Errorf("unexpected diff (+wanted, -got): %s", diff)
+			}
+		})
+	}
+}
diff --git a/internal/framework/flex/set.go b/internal/framework/flex/set.go
new file mode 100644
index 00000000000..a9ce0a31730
--- /dev/null
+++ b/internal/framework/flex/set.go
@@ -0,0 +1,86 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package flex
+
+import (
+	"context"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/hashicorp/terraform-plugin-framework/attr"
+	"github.com/hashicorp/terraform-plugin-framework/types"
+	"github.com/hashicorp/terraform-plugin-framework/types/basetypes"
+)
+
+func ExpandFrameworkStringSet(ctx context.Context, v basetypes.SetValuable) []*string {
+	var output []*string
+
+	panicOnError(Expand(ctx, v, &output))
+
+	return output
+}
+
+func ExpandFrameworkStringValueSet(ctx context.Context, v basetypes.SetValuable) Set[string] {
+	var output []string
+
+	panicOnError(Expand(ctx, v, &output))
+
+	return output
+}
+
+// FlattenFrameworkStringSet converts a slice of string pointers to a framework Set value.
+//
+// A nil slice is converted to a null Set.
+// An empty slice is converted to a null Set.
+func FlattenFrameworkStringSet(ctx context.Context, v []*string) types.Set {
+	if len(v) == 0 {
+		return types.SetNull(types.StringType)
+	}
+
+	var output types.Set
+
+	panicOnError(Flatten(ctx, v, &output))
+
+	return output
+}
+
+// FlattenFrameworkStringSetLegacy converts a slice of string pointers to a framework Set value.
+//
+// A nil slice is converted to an empty (non-null) Set.
+func FlattenFrameworkStringSetLegacy(_ context.Context, vs []*string) types.Set {
+	elems := make([]attr.Value, len(vs))
+
+	for i, v := range vs {
+		elems[i] = types.StringValue(aws.ToString(v))
+	}
+
+	return types.SetValueMust(types.StringType, elems)
+}
+
+// FlattenFrameworkStringValueSet converts a slice of string values to a framework Set value.
+//
+// A nil slice is converted to a null Set.
+// An empty slice is converted to a null Set.
+func FlattenFrameworkStringValueSet(ctx context.Context, v []string) types.Set {
+	if len(v) == 0 {
+		return types.SetNull(types.StringType)
+	}
+
+	var output types.Set
+
+	panicOnError(Flatten(ctx, v, &output))
+
+	return output
+}
+
+// FlattenFrameworkStringValueSetLegacy is the Plugin Framework variant of FlattenStringValueSet.
+// A nil slice is converted to an empty (non-null) Set.
+func FlattenFrameworkStringValueSetLegacy(_ context.Context, vs []string) types.Set {
+	elems := make([]attr.Value, len(vs))
+
+	for i, v := range vs {
+		elems[i] = types.StringValue(v)
+	}
+
+	return types.SetValueMust(types.StringType, elems)
+}
diff --git a/internal/framework/flex/set_test.go b/internal/framework/flex/set_test.go
new file mode 100644
index 00000000000..6f6effd332e
--- /dev/null
+++ b/internal/framework/flex/set_test.go
@@ -0,0 +1,191 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package flex_test
+
+import (
+	"context"
+	"testing"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/google/go-cmp/cmp"
+	"github.com/hashicorp/terraform-plugin-framework/attr"
+	"github.com/hashicorp/terraform-plugin-framework/types"
+	"github.com/hashicorp/terraform-provider-aws/internal/framework/flex"
+)
+
+func TestExpandFrameworkStringSet(t *testing.T) {
+	t.Parallel()
+
+	type testCase struct {
+		input    types.Set
+		expected []*string
+	}
+	tests := map[string]testCase{
+		"null": {
+			input:    types.SetNull(types.StringType),
+			expected: nil,
+		},
+		"unknown": {
+			input:    types.SetUnknown(types.StringType),
+			expected: nil,
+		},
+		"two elements": {
+			input: types.SetValueMust(types.StringType, []attr.Value{
+				types.StringValue("GET"),
+				types.StringValue("HEAD"),
+			}),
+			expected: []*string{aws.String("GET"), aws.String("HEAD")},
+		},
+		"zero elements": {
+			input:    types.SetValueMust(types.StringType, []attr.Value{}),
+			expected: []*string{},
+		},
+		"invalid element type": {
+			input: types.SetValueMust(types.Int64Type, []attr.Value{
+				types.Int64Value(42),
+			}),
+			expected: nil,
+		},
+	}
+
+	for name, test := range tests {
+		name, test := name, test
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			got := flex.ExpandFrameworkStringSet(context.Background(), test.input)
+
+			if diff := cmp.Diff(got, test.expected); diff != "" {
+				t.Errorf("unexpected diff (+wanted, -got): %s", diff)
+			}
+		})
+	}
+}
+
+func TestExpandFrameworkStringValueSet(t *testing.T) {
+	t.Parallel()
+
+	type testCase struct {
+		input    types.Set
+		expected flex.Set[string]
+	}
+	tests := map[string]testCase{
+		"null": {
+			input:    types.SetNull(types.StringType),
+			expected: nil,
+		},
+		"unknown": {
+			input:    types.SetUnknown(types.StringType),
+			expected: nil,
+		},
+		"two elements": {
+			input: types.SetValueMust(types.StringType, []attr.Value{
+				types.StringValue("GET"),
+				types.StringValue("HEAD"),
+			}),
+			expected: []string{"GET", "HEAD"},
+		},
+		"zero elements": {
+			input:    types.SetValueMust(types.StringType, []attr.Value{}),
+			expected: []string{},
+		},
+		"invalid element type": {
+			input: types.SetValueMust(types.Int64Type, []attr.Value{
+				types.Int64Value(42),
+			}),
+			expected: nil,
+		},
+	}
+
+	for name, test := range tests {
+		name, test := name, test
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			got := flex.ExpandFrameworkStringValueSet(context.Background(), test.input)
+
+			if diff := cmp.Diff(got, test.expected); diff != "" {
+				t.Errorf("unexpected diff (+wanted, -got): %s", diff)
+			}
+		})
+	}
+}
+
+func TestFlattenFrameworkStringValueSet(t *testing.T) {
+	t.Parallel()
+
+	type testCase struct {
+		input    []string
+		expected types.Set
+	}
+	tests := map[string]testCase{
+		"two elements": {
+			input: []string{"GET", "HEAD"},
+			expected: types.SetValueMust(types.StringType, []attr.Value{
+				types.StringValue("GET"),
+				types.StringValue("HEAD"),
+			}),
+		},
+		"zero elements": {
+			input:    []string{},
+			expected: types.SetNull(types.StringType),
+		},
+		"nil array": {
+			input:    nil,
+			expected: types.SetNull(types.StringType),
+		},
+	}
+
+	for name, test := range tests {
+		name, test := name, test
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			got := flex.FlattenFrameworkStringValueSet(context.Background(), test.input)
+
+			if diff := cmp.Diff(got, test.expected); diff != "" {
+				t.Errorf("unexpected diff (+wanted, -got): %s", diff)
+			}
+		})
+	}
+}
+
+func TestFlattenFrameworkStringValueSetLegacy(t *testing.T) {
+	t.Parallel()
+
+	type testCase struct {
+		input    []string
+		expected types.Set
+	}
+	tests := map[string]testCase{
+		"two elements": {
+			input: []string{"GET", "HEAD"},
+			expected: types.SetValueMust(types.StringType, []attr.Value{
+				types.StringValue("GET"),
+				types.StringValue("HEAD"),
+			}),
+		},
+		"zero elements": {
+			input:    []string{},
+			expected: types.SetValueMust(types.StringType, []attr.Value{}),
+		},
+		"nil array": {
+			input:    nil,
+			expected: types.SetValueMust(types.StringType, []attr.Value{}),
+		},
+	}
+
+	for name, test := range tests {
+		name, test := name, test
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			got := flex.FlattenFrameworkStringValueSetLegacy(context.Background(), test.input)
+
+			if diff := cmp.Diff(got, test.expected); diff != "" {
+				t.Errorf("unexpected diff (+wanted, -got): %s", diff)
+			}
+		})
+	}
+}
diff --git a/internal/framework/flex/string.go b/internal/framework/flex/string.go
new file mode 100644
index 00000000000..e32fcd2ab68
--- /dev/null
+++ b/internal/framework/flex/string.go
@@ -0,0 +1,98 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package flex
+
+import (
+	"context"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/hashicorp/terraform-plugin-framework/diag"
+	"github.com/hashicorp/terraform-plugin-framework/types"
+	"github.com/hashicorp/terraform-plugin-framework/types/basetypes"
+	fwtypes "github.com/hashicorp/terraform-provider-aws/internal/framework/types"
+)
+
+// StringFromFramework converts a Framework String value to a string pointer.
+// A null String is converted to a nil string pointer.
+func StringFromFramework(ctx context.Context, v basetypes.StringValuable) *string {
+	var output *string
+
+	panicOnError(Expand(ctx, v, &output))
+
+	return output
+}
+
+// StringFromFramework converts a single Framework String value to a string pointer slice.
+// A null String is converted to a nil slice.
+func StringSliceFromFramework(ctx context.Context, v basetypes.StringValuable) []*string {
+	if v.IsNull() || v.IsUnknown() {
+		return nil
+	}
+
+	return []*string{StringFromFramework(ctx, v)}
+}
+
+// StringValueToFramework converts a string value to a Framework String value.
+// An empty string is converted to a null String.
+func StringValueToFramework[T ~string](ctx context.Context, v T) types.String {
+	if v == "" {
+		return types.StringNull()
+	}
+
+	var output types.String
+
+	panicOnError(Flatten(ctx, v, &output))
+
+	return output
+}
+
+// StringValueToFrameworkLegacy converts a string value to a Framework String value.
+// An empty string is left as an empty String.
+func StringValueToFrameworkLegacy[T ~string](_ context.Context, v T) types.String {
+	return types.StringValue(string(v))
+}
+
+// StringToFramework converts a string pointer to a Framework String value.
+// A nil string pointer is converted to a null String.
+func StringToFramework(ctx context.Context, v *string) types.String {
+	var output types.String
+
+	panicOnError(Flatten(ctx, v, &output))
+
+	return output
+}
+
+// StringToFrameworkLegacy converts a string pointer to a Framework String value.
+// A nil string pointer is converted to an empty String.
+func StringToFrameworkLegacy(_ context.Context, v *string) types.String {
+	return types.StringValue(aws.ToString(v))
+}
+
+// StringToFrameworkARN converts a string pointer to a Framework custom ARN value.
+// A nil string pointer is converted to a null ARN.
+// If diags is nil, any errors cause a panic.
+func StringToFrameworkARN(ctx context.Context, v *string, diags *diag.Diagnostics) fwtypes.ARN {
+	var output fwtypes.ARN
+
+	if diags == nil {
+		panicOnError(Flatten(ctx, v, &output))
+	} else {
+		diags.Append(Flatten(ctx, v, &output)...)
+	}
+
+	return output
+}
+
+func StringFromFrameworkLegacy(_ context.Context, v types.String) *string {
+	if v.IsNull() || v.IsUnknown() {
+		return nil
+	}
+
+	s := v.ValueString()
+	if s == "" {
+		return nil
+	}
+
+	return aws.String(s)
+}
diff --git a/internal/framework/flex/string_test.go b/internal/framework/flex/string_test.go
new file mode 100644
index 00000000000..87ec11f04e1
--- /dev/null
+++ b/internal/framework/flex/string_test.go
@@ -0,0 +1,272 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package flex_test
+
+import (
+	"context"
+	"testing"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/aws/arn"
+	"github.com/google/go-cmp/cmp"
+	"github.com/hashicorp/terraform-plugin-framework/diag"
+	"github.com/hashicorp/terraform-plugin-framework/types"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs/fwdiag"
+	"github.com/hashicorp/terraform-provider-aws/internal/framework/flex"
+	fwtypes "github.com/hashicorp/terraform-provider-aws/internal/framework/types"
+)
+
+func TestStringFromFramework(t *testing.T) {
+	t.Parallel()
+
+	type testCase struct {
+		input    types.String
+		expected *string
+	}
+	tests := map[string]testCase{
+		"valid string": {
+			input:    types.StringValue("TEST"),
+			expected: aws.String("TEST"),
+		},
+		"empty string": {
+			input:    types.StringValue(""),
+			expected: aws.String(""),
+		},
+		"null string": {
+			input:    types.StringNull(),
+			expected: nil,
+		},
+		"unknown string": {
+			input:    types.StringUnknown(),
+			expected: nil,
+		},
+	}
+
+	for name, test := range tests {
+		name, test := name, test
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			got := flex.StringFromFramework(context.Background(), test.input)
+
+			if diff := cmp.Diff(got, test.expected); diff != "" {
+				t.Errorf("unexpected diff (+wanted, -got): %s", diff)
+			}
+		})
+	}
+}
+
+func TestStringToFramework(t *testing.T) {
+	t.Parallel()
+
+	type testCase struct {
+		input    *string
+		expected types.String
+	}
+	tests := map[string]testCase{
+		"valid string": {
+			input:    aws.String("TEST"),
+			expected: types.StringValue("TEST"),
+		},
+		"empty string": {
+			input:    aws.String(""),
+			expected: types.StringValue(""),
+		},
+		"nil string": {
+			input:    nil,
+			expected: types.StringNull(),
+		},
+	}
+
+	for name, test := range tests {
+		name, test := name, test
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			got := flex.StringToFramework(context.Background(), test.input)
+
+			if diff := cmp.Diff(got, test.expected); diff != "" {
+				t.Errorf("unexpected diff (+wanted, -got): %s", diff)
+			}
+		})
+	}
+}
+
+func TestStringToFrameworkLegacy(t *testing.T) {
+	t.Parallel()
+
+	type testCase struct {
+		input    *string
+		expected types.String
+	}
+	tests := map[string]testCase{
+		"valid string": {
+			input:    aws.String("TEST"),
+			expected: types.StringValue("TEST"),
+		},
+		"empty string": {
+			input:    aws.String(""),
+			expected: types.StringValue(""),
+		},
+		"nil string": {
+			input:    nil,
+			expected: types.StringValue(""),
+		},
+	}
+
+	for name, test := range tests {
+		name, test := name, test
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			got := flex.StringToFrameworkLegacy(context.Background(), test.input)
+
+			if diff := cmp.Diff(got, test.expected); diff != "" {
+				t.Errorf("unexpected diff (+wanted, -got): %s", diff)
+			}
+		})
+	}
+}
+
+func TestStringValueToFramework(t *testing.T) {
+	t.Parallel()
+
+	// AWS enums use custom types with an underlying string type
+	type custom string
+
+	type testCase struct {
+		input    custom
+		expected types.String
+	}
+	tests := map[string]testCase{
+		"valid": {
+			input:    "TEST",
+			expected: types.StringValue("TEST"),
+		},
+		"empty": {
+			input:    "",
+			expected: types.StringNull(),
+		},
+	}
+
+	for name, test := range tests {
+		name, test := name, test
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			got := flex.StringValueToFramework(context.Background(), test.input)
+
+			if diff := cmp.Diff(got, test.expected); diff != "" {
+				t.Errorf("unexpected diff (+wanted, -got): %s", diff)
+			}
+		})
+	}
+}
+
+func TestStringValueToFrameworkLegacy(t *testing.T) {
+	t.Parallel()
+
+	// AWS enums use custom types with an underlying string type
+	type custom string
+
+	type testCase struct {
+		input    custom
+		expected types.String
+	}
+	tests := map[string]testCase{
+		"valid": {
+			input:    "TEST",
+			expected: types.StringValue("TEST"),
+		},
+		"empty": {
+			input:    "",
+			expected: types.StringValue(""),
+		},
+	}
+
+	for name, test := range tests {
+		name, test := name, test
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			got := flex.StringValueToFrameworkLegacy(context.Background(), test.input)
+
+			if diff := cmp.Diff(got, test.expected); diff != "" {
+				t.Errorf("unexpected diff (+wanted, -got): %s", diff)
+			}
+		})
+	}
+}
+
+func TestARNStringFromFramework(t *testing.T) {
+	t.Parallel()
+
+	type testCase struct {
+		input    fwtypes.ARN
+		expected *string
+	}
+	tests := map[string]testCase{
+		"valid ARN": {
+			input:    fwtypes.ARNValue(errs.Must(arn.Parse("arn:aws:iam::123456789012:user/David"))),
+			expected: aws.String("arn:aws:iam::123456789012:user/David"),
+		},
+		"null ARN": {
+			input:    fwtypes.ARNNull(),
+			expected: nil,
+		},
+		"unknown ARN": {
+			input:    fwtypes.ARNUnknown(),
+			expected: nil,
+		},
+	}
+
+	for name, test := range tests {
+		name, test := name, test
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			got := flex.StringFromFramework(context.Background(), test.input)
+
+			if diff := cmp.Diff(got, test.expected); diff != "" {
+				t.Errorf("unexpected diff (+wanted, -got): %s", diff)
+			}
+		})
+	}
+}
+
+func TestStringToFrameworkARN(t *testing.T) {
+	t.Parallel()
+
+	type testCase struct {
+		input    *string
+		expected fwtypes.ARN
+	}
+	tests := map[string]testCase{
+		"valid ARN": {
+			input:    aws.String("arn:aws:iam::123456789012:user/David"),
+			expected: fwtypes.ARNValue(errs.Must(arn.Parse("arn:aws:iam::123456789012:user/David"))),
+		},
+		"null ARN": {
+			input:    nil,
+			expected: fwtypes.ARNNull(),
+		},
+	}
+
+	for name, test := range tests {
+		name, test := name, test
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			var diags diag.Diagnostics
+			got := flex.StringToFrameworkARN(context.Background(), test.input, &diags)
+
+			if err := fwdiag.DiagnosticsError(diags); err != nil {
+				t.Errorf("err %q", err)
+			} else if diff := cmp.Diff(got, test.expected); diff != "" {
+				t.Errorf("unexpected diff (+wanted, -got): %s", diff)
+			}
+		})
+	}
+}
diff --git a/internal/framework/int64planmodifier/default_value.go b/internal/framework/int64planmodifier/default_value.go
deleted file mode 100644
index 7ff39b433b8..00000000000
--- a/internal/framework/int64planmodifier/default_value.go
+++ /dev/null
@@ -1,42 +0,0 @@
-package int64planmodifier
-
-import (
-	"context"
-	"fmt"
-
-	"github.com/hashicorp/terraform-plugin-framework/resource/schema/planmodifier"
-	"github.com/hashicorp/terraform-plugin-framework/types"
-)
-
-type defaultValue struct {
-	val int64
-}
-
-// DefaultValue return a bool plan modifier that sets the specified value if the planned value is Null.
-func DefaultValue(i int64) planmodifier.Int64 {
-	return defaultValue{
-		val: i,
-	}
-}
-
-func (m defaultValue) Description(context.Context) string {
-	return fmt.Sprintf("If value is not configured, defaults to %d", m.val)
-}
-
-func (m defaultValue) MarkdownDescription(ctx context.Context) string {
-	return m.Description(ctx)
-}
-
-func (m defaultValue) PlanModifyInt64(ctx context.Context, req planmodifier.Int64Request, resp *planmodifier.Int64Response) {
-	if !req.ConfigValue.IsNull() {
-		return
-	}
-
-	// If the attribute plan is "known" and "not null", then a previous plan modifier in the sequence
-	// has already been applied, and we don't want to interfere.
-	if !req.PlanValue.IsUnknown() && !req.PlanValue.IsNull() {
-		return
-	}
-
-	resp.PlanValue = types.Int64Value(m.val)
-}
diff --git a/internal/framework/int64planmodifier/default_value_test.go b/internal/framework/int64planmodifier/default_value_test.go
deleted file mode 100644
index 011f878ced7..00000000000
--- a/internal/framework/int64planmodifier/default_value_test.go
+++ /dev/null
@@ -1,67 +0,0 @@
-package int64planmodifier
-
-import (
-	"context"
-	"testing"
-
-	"github.com/google/go-cmp/cmp"
-	"github.com/hashicorp/terraform-plugin-framework/path"
-	"github.com/hashicorp/terraform-plugin-framework/resource/schema/planmodifier"
-	"github.com/hashicorp/terraform-plugin-framework/types"
-)
-
-func TestDefaultValue(t *testing.T) {
-	t.Parallel()
-
-	type testCase struct {
-		plannedValue  types.Int64
-		currentValue  types.Int64
-		defaultValue  int64
-		expectedValue types.Int64
-		expectError   bool
-	}
-	tests := map[string]testCase{
-		"default int64": {
-			plannedValue:  types.Int64Null(),
-			currentValue:  types.Int64Value(1),
-			defaultValue:  1,
-			expectedValue: types.Int64Value(1),
-		},
-		"default int64 on create": {
-			plannedValue:  types.Int64Null(),
-			currentValue:  types.Int64Null(),
-			defaultValue:  1,
-			expectedValue: types.Int64Value(1),
-		},
-	}
-
-	for name, test := range tests {
-		name, test := name, test
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-
-			ctx := context.Background()
-			request := planmodifier.Int64Request{
-				Path:       path.Root("test"),
-				PlanValue:  test.plannedValue,
-				StateValue: test.currentValue,
-			}
-			response := planmodifier.Int64Response{
-				PlanValue: request.PlanValue,
-			}
-			DefaultValue(test.defaultValue).PlanModifyInt64(ctx, request, &response)
-
-			if !response.Diagnostics.HasError() && test.expectError {
-				t.Fatal("expected error, got no error")
-			}
-
-			if response.Diagnostics.HasError() && !test.expectError {
-				t.Fatalf("got unexpected error: %s", response.Diagnostics)
-			}
-
-			if diff := cmp.Diff(response.PlanValue, test.expectedValue); diff != "" {
-				t.Errorf("unexpected diff (+wanted, -got): %s", diff)
-			}
-		})
-	}
-}
diff --git a/internal/framework/stdattributes.go b/internal/framework/stdattributes.go
index f975e5a0541..4ec86062a8f 100644
--- a/internal/framework/stdattributes.go
+++ b/internal/framework/stdattributes.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package framework
 
 import (
diff --git a/internal/framework/stringplanmodifier/README.md b/internal/framework/stringplanmodifier/README.md
deleted file mode 100644
index 7f6bf3c0209..00000000000
--- a/internal/framework/stringplanmodifier/README.md
+++ /dev/null
@@ -1,3 +0,0 @@
-# Terraform Plugin Framework String Plan Modifiers
-
-This package contains Terraform Plugin Framework [string plan modifiers](https://developer.hashicorp.com/terraform/plugin/framework/resources/plan-modification).
diff --git a/internal/framework/stringplanmodifier/default_value.go b/internal/framework/stringplanmodifier/default_value.go
deleted file mode 100644
index 33771e45082..00000000000
--- a/internal/framework/stringplanmodifier/default_value.go
+++ /dev/null
@@ -1,43 +0,0 @@
-package stringplanmodifier
-
-import (
-	"context"
-	"fmt"
-
-	"github.com/hashicorp/terraform-plugin-framework/resource/schema/planmodifier"
-	"github.com/hashicorp/terraform-plugin-framework/types"
-)
-
-type defaultValue struct {
-	val string
-}
-
-// DefaultValue return a string plan modifier that sets the specified value if the planned value is Null.
-func DefaultValue(s string) planmodifier.String {
-	return defaultValue{
-		val: s,
-	}
-}
-
-func (m defaultValue) Description(context.Context) string {
-	return fmt.Sprintf("If value is not configured, defaults to %s", m.val)
-}
-
-func (m defaultValue) MarkdownDescription(ctx context.Context) string {
-	return m.Description(ctx)
-}
-
-func (m defaultValue) PlanModifyString(ctx context.Context, req planmodifier.StringRequest, resp *planmodifier.StringResponse) {
-	// If the attribute configuration is not null, we are done here
-	if !req.ConfigValue.IsNull() {
-		return
-	}
-
-	// If the attribute plan is "known" and "not null", then a previous plan modifier in the sequence
-	// has already been applied, and we don't want to interfere.
-	if !req.PlanValue.IsUnknown() && !req.PlanValue.IsNull() {
-		return
-	}
-
-	resp.PlanValue = types.StringValue(m.val)
-}
diff --git a/internal/framework/stringplanmodifier/default_value_test.go b/internal/framework/stringplanmodifier/default_value_test.go
deleted file mode 100644
index 03f9a675df5..00000000000
--- a/internal/framework/stringplanmodifier/default_value_test.go
+++ /dev/null
@@ -1,85 +0,0 @@
-package stringplanmodifier
-
-import (
-	"context"
-	"testing"
-
-	"github.com/google/go-cmp/cmp"
-	"github.com/hashicorp/terraform-plugin-framework/path"
-	"github.com/hashicorp/terraform-plugin-framework/resource/schema/planmodifier"
-	"github.com/hashicorp/terraform-plugin-framework/types"
-)
-
-func TestDefaultValue(t *testing.T) {
-	t.Parallel()
-
-	type testCase struct {
-		plannedValue  types.String
-		currentValue  types.String
-		defaultValue  string
-		expectedValue types.String
-		expectError   bool
-	}
-	tests := map[string]testCase{
-		"non-default non-Null string": {
-			plannedValue:  types.StringValue("gamma"),
-			currentValue:  types.StringValue("beta"),
-			defaultValue:  "alpha",
-			expectedValue: types.StringValue("gamma"),
-		},
-		"non-default non-Null string, current Null": {
-			plannedValue:  types.StringValue("gamma"),
-			currentValue:  types.StringNull(),
-			defaultValue:  "alpha",
-			expectedValue: types.StringValue("gamma"),
-		},
-		"non-default Null string, current Null": {
-			plannedValue:  types.StringNull(),
-			currentValue:  types.StringValue("beta"),
-			defaultValue:  "alpha",
-			expectedValue: types.StringValue("alpha"),
-		},
-		"default string": {
-			plannedValue:  types.StringNull(),
-			currentValue:  types.StringValue("alpha"),
-			defaultValue:  "alpha",
-			expectedValue: types.StringValue("alpha"),
-		},
-		"default string on create": {
-			plannedValue:  types.StringNull(),
-			currentValue:  types.StringNull(),
-			defaultValue:  "alpha",
-			expectedValue: types.StringValue("alpha"),
-		},
-	}
-
-	for name, test := range tests {
-		name, test := name, test
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-
-			ctx := context.Background()
-			request := planmodifier.StringRequest{
-				Path:       path.Root("test"),
-				PlanValue:  test.plannedValue,
-				StateValue: test.currentValue,
-			}
-			response := planmodifier.StringResponse{
-				PlanValue: request.PlanValue,
-			}
-			DefaultValue(test.defaultValue).PlanModifyString(ctx, request, &response)
-
-			if !response.Diagnostics.HasError() && test.expectError {
-				t.Fatal("expected error, got no error")
-			}
-
-			if response.Diagnostics.HasError() && !test.expectError {
-				t.Fatalf("got unexpected error: %s", response.Diagnostics)
-			}
-
-			if diff := cmp.Diff(response.PlanValue, test.expectedValue); diff != "" {
-				t.Errorf("unexpected diff (+wanted, -got): %s", diff)
-			}
-		})
-	}
-}
diff --git a/internal/framework/types/arn.go b/internal/framework/types/arn.go
index bae74fc7c1b..c753f300284 100644
--- a/internal/framework/types/arn.go
+++ b/internal/framework/types/arn.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package types
 
 import (
@@ -14,6 +17,10 @@ import (
 	"github.com/hashicorp/terraform-plugin-go/tftypes"
 )
 
+// ProviderErrorDetailPrefix contains instructions for reporting provider errors to provider developers
+const ProviderErrorDetailPrefix = "An unexpected error was encountered trying to validate an attribute value. " +
+	"This is always an error in the provider. Please report the following to the provider developer:\n\n"
+
 type arnType uint8
 
 const (
@@ -21,7 +28,8 @@ const (
 )
 
 var (
-	_ xattr.TypeWithValidate = ARNType
+	_ xattr.TypeWithValidate   = ARNType
+	_ basetypes.StringValuable = ARN{}
 )
 
 func (t arnType) TerraformType(_ context.Context) tftypes.Type {
@@ -103,8 +111,7 @@ func (t arnType) Validate(ctx context.Context, in tftypes.Value, path path.Path)
 		diags.AddAttributeError(
 			path,
 			"ARN Type Validation Error",
-			"An unexpected error was encountered trying to validate an attribute value. This is always an error in the provider. Please report the following to the provider developer:\n\n"+
-				fmt.Sprintf("Expected String value, received %T with value: %v", in, in),
+			fmt.Sprintf("%sExpected String value, received %T with value: %v", ProviderErrorDetailPrefix, in, in),
 		)
 		return diags
 	}
@@ -119,8 +126,7 @@ func (t arnType) Validate(ctx context.Context, in tftypes.Value, path path.Path)
 		diags.AddAttributeError(
 			path,
 			"ARN Type Validation Error",
-			"An unexpected error was encountered trying to validate an attribute value. This is always an error in the provider. Please report the following to the provider developer:\n\n"+
-				fmt.Sprintf("Cannot convert value to arn.ARN: %s", err),
+			fmt.Sprintf("%sCannot convert value to arn.ARN: %s", ProviderErrorDetailPrefix, err),
 		)
 		return diags
 	}
diff --git a/internal/framework/types/arn_test.go b/internal/framework/types/arn_test.go
index f21492a1359..7fb4774a801 100644
--- a/internal/framework/types/arn_test.go
+++ b/internal/framework/types/arn_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package types_test
 
 import (
diff --git a/internal/framework/types/attrtypes.go b/internal/framework/types/attrtypes.go
new file mode 100644
index 00000000000..dc06ca79ee3
--- /dev/null
+++ b/internal/framework/types/attrtypes.go
@@ -0,0 +1,54 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package types
+
+import (
+	"context"
+	"fmt"
+	"reflect"
+
+	"github.com/hashicorp/terraform-plugin-framework/attr"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs"
+)
+
+//
+// TODO dedup internal/framework/flex/attrtypes.go.
+//
+
+// AttributeTypes returns a map of attribute types for the specified type T.
+// T must be a struct and reflection is used to find exported fields of T with the `tfsdk` tag.
+func AttributeTypes[T any](ctx context.Context) (map[string]attr.Type, error) {
+	var t T
+	val := reflect.ValueOf(t)
+	typ := val.Type()
+
+	if typ.Kind() != reflect.Struct {
+		return nil, fmt.Errorf("%T has unsupported type: %s", t, typ)
+	}
+
+	attributeTypes := make(map[string]attr.Type)
+	for i := 0; i < typ.NumField(); i++ {
+		field := typ.Field(i)
+		if field.PkgPath != "" {
+			continue // Skip unexported fields.
+		}
+		tag := field.Tag.Get(`tfsdk`)
+		if tag == "-" {
+			continue // Skip explicitly excluded fields.
+		}
+		if tag == "" {
+			return nil, fmt.Errorf(`%T needs a struct tag for "tfsdk" on %s`, t, field.Name)
+		}
+
+		if v, ok := val.Field(i).Interface().(attr.Value); ok {
+			attributeTypes[tag] = v.Type(ctx)
+		}
+	}
+
+	return attributeTypes, nil
+}
+
+func AttributeTypesMust[T any](ctx context.Context) map[string]attr.Type {
+	return errs.Must(AttributeTypes[T](ctx))
+}
diff --git a/internal/framework/types/attrtypes_test.go b/internal/framework/types/attrtypes_test.go
new file mode 100644
index 00000000000..525fcba73b2
--- /dev/null
+++ b/internal/framework/types/attrtypes_test.go
@@ -0,0 +1,59 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package types_test
+
+import (
+	"context"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/hashicorp/terraform-plugin-framework/attr"
+	"github.com/hashicorp/terraform-plugin-framework/types"
+	fwtypes "github.com/hashicorp/terraform-provider-aws/internal/framework/types"
+)
+
+//
+// TODO dedup internal/framework/flex/attrtypes_test.go.
+//
+
+func TestAttributeTypes(t *testing.T) {
+	t.Parallel()
+
+	type struct1 struct{}
+	type struct2 struct {
+		ARN             types.String `tfsdk:"arn"`
+		ID              types.Int64  `tfsdk:"id"`
+		IncludeProperty types.Bool   `tfsdk:"include_property"`
+	}
+
+	ctx := context.Background()
+	got := fwtypes.AttributeTypesMust[struct1](ctx)
+	wanted := map[string]attr.Type{}
+
+	if diff := cmp.Diff(got, wanted); diff != "" {
+		t.Errorf("unexpected diff (+wanted, -got): %s", diff)
+	}
+
+	_, err := fwtypes.AttributeTypes[int](ctx)
+
+	if err == nil {
+		t.Fatalf("expected error")
+	}
+
+	got, err = fwtypes.AttributeTypes[struct2](ctx)
+
+	if err != nil {
+		t.Fatalf("unexpected error")
+	}
+
+	wanted = map[string]attr.Type{
+		"arn":              types.StringType,
+		"id":               types.Int64Type,
+		"include_property": types.BoolType,
+	}
+
+	if diff := cmp.Diff(got, wanted); diff != "" {
+		t.Errorf("unexpected diff (+wanted, -got): %s", diff)
+	}
+}
diff --git a/internal/framework/types/cidr_block.go b/internal/framework/types/cidr_block.go
index 4678b8f65b8..60e6e442076 100644
--- a/internal/framework/types/cidr_block.go
+++ b/internal/framework/types/cidr_block.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package types
 
 import (
@@ -11,7 +14,7 @@ import (
 	"github.com/hashicorp/terraform-plugin-framework/types"
 	"github.com/hashicorp/terraform-plugin-framework/types/basetypes"
 	"github.com/hashicorp/terraform-plugin-go/tftypes"
-	"github.com/hashicorp/terraform-provider-aws/internal/verify"
+	itypes "github.com/hashicorp/terraform-provider-aws/internal/types"
 )
 
 type cidrBlockType uint8
@@ -21,7 +24,8 @@ const (
 )
 
 var (
-	_ xattr.TypeWithValidate = CIDRBlockType
+	_ xattr.TypeWithValidate   = CIDRBlockType
+	_ basetypes.StringValuable = CIDRBlock{}
 )
 
 func (t cidrBlockType) TerraformType(_ context.Context) tftypes.Type {
@@ -54,7 +58,7 @@ func (t cidrBlockType) ValueFromTerraform(_ context.Context, in tftypes.Value) (
 		return nil, err
 	}
 
-	if err := verify.ValidateCIDRBlock(s); err != nil {
+	if err := itypes.ValidateCIDRBlock(s); err != nil {
 		return CIDRBlockUnknown(), nil //nolint: nilerr // Must not return validation errors
 	}
 
@@ -85,8 +89,7 @@ func (t cidrBlockType) Validate(ctx context.Context, in tftypes.Value, path path
 		diags.AddAttributeError(
 			path,
 			"CIDRBlock Type Validation Error",
-			"An unexpected error was encountered trying to validate an attribute value. This is always an error in the provider. Please report the following to the provider developer:\n\n"+
-				fmt.Sprintf("Expected String value, received %T with value: %v", in, in),
+			fmt.Sprintf("%sExpected String value, received %T with value: %v", ProviderErrorDetailPrefix, in, in),
 		)
 		return diags
 	}
@@ -101,13 +104,12 @@ func (t cidrBlockType) Validate(ctx context.Context, in tftypes.Value, path path
 		diags.AddAttributeError(
 			path,
 			"CIDRBlock Type Validation Error",
-			"An unexpected error was encountered trying to validate an attribute value. This is always an error in the provider. Please report the following to the provider developer:\n\n"+
-				fmt.Sprintf("Cannot convert value to string: %s", err),
+			fmt.Sprintf("%sCannot convert value to string: %s", ProviderErrorDetailPrefix, err),
 		)
 		return diags
 	}
 
-	if err := verify.ValidateCIDRBlock(value); err != nil {
+	if err := itypes.ValidateCIDRBlock(value); err != nil {
 		diags.AddAttributeError(
 			path,
 			"CIDRBlock Type Validation Error",
diff --git a/internal/framework/types/cidr_block_test.go b/internal/framework/types/cidr_block_test.go
index bb15fa6f873..a14af011959 100644
--- a/internal/framework/types/cidr_block_test.go
+++ b/internal/framework/types/cidr_block_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package types_test
 
 import (
diff --git a/internal/framework/types/duration.go b/internal/framework/types/duration.go
index 3c8b41d981a..d0623f34898 100644
--- a/internal/framework/types/duration.go
+++ b/internal/framework/types/duration.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package types
 
 import (
@@ -21,7 +24,8 @@ const (
 )
 
 var (
-	_ xattr.TypeWithValidate = DurationType
+	_ xattr.TypeWithValidate   = DurationType
+	_ basetypes.StringValuable = Duration{}
 )
 
 func (d durationType) TerraformType(_ context.Context) tftypes.Type {
@@ -104,8 +108,7 @@ func (d durationType) Validate(ctx context.Context, in tftypes.Value, path path.
 		diags.AddAttributeError(
 			path,
 			"Duration Type Validation Error",
-			"An unexpected error was encountered trying to validate an attribute value. This is always an error in the provider. Please report the following to the provider developer:\n\n"+
-				fmt.Sprintf("Expected String value, received %T with value: %v", in, in),
+			fmt.Sprintf("%sExpected String value, received %T with value: %v", ProviderErrorDetailPrefix, in, in),
 		)
 		return diags
 	}
@@ -120,8 +123,7 @@ func (d durationType) Validate(ctx context.Context, in tftypes.Value, path path.
 		diags.AddAttributeError(
 			path,
 			"Duration Type Validation Error",
-			"An unexpected error was encountered trying to validate an attribute value. This is always an error in the provider. Please report the following to the provider developer:\n\n"+
-				fmt.Sprintf("Cannot convert value to time.Duration: %s", err),
+			fmt.Sprintf("%sCannot convert value to time.Duration: %s", ProviderErrorDetailPrefix, err),
 		)
 		return diags
 	}
diff --git a/internal/framework/types/duration_test.go b/internal/framework/types/duration_test.go
index 0381e6d29a8..c345bf8ed46 100644
--- a/internal/framework/types/duration_test.go
+++ b/internal/framework/types/duration_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package types_test
 
 import (
diff --git a/internal/framework/types/list_nested_objectof.go b/internal/framework/types/list_nested_objectof.go
new file mode 100644
index 00000000000..30838b92bfa
--- /dev/null
+++ b/internal/framework/types/list_nested_objectof.go
@@ -0,0 +1,258 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package types
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/hashicorp/terraform-plugin-framework/attr"
+	"github.com/hashicorp/terraform-plugin-framework/diag"
+	"github.com/hashicorp/terraform-plugin-framework/types/basetypes"
+	"github.com/hashicorp/terraform-plugin-go/tftypes"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs/fwdiag"
+)
+
+// ListNestedObjectTypeOf is the attribute type of a ListNestedObjectValueOf.
+type ListNestedObjectTypeOf[T any] struct {
+	basetypes.ListType
+}
+
+var (
+	_ basetypes.ListTypable = ListNestedObjectTypeOf[struct{}]{}
+	_ NestedObjectType      = ListNestedObjectTypeOf[struct{}]{}
+)
+
+func NewListNestedObjectTypeOf[T any](ctx context.Context) ListNestedObjectTypeOf[T] {
+	return ListNestedObjectTypeOf[T]{basetypes.ListType{ElemType: NewObjectTypeOf[T](ctx)}}
+}
+
+func (t ListNestedObjectTypeOf[T]) Equal(o attr.Type) bool {
+	other, ok := o.(ListNestedObjectTypeOf[T])
+
+	if !ok {
+		return false
+	}
+
+	return t.ListType.Equal(other.ListType)
+}
+
+func (t ListNestedObjectTypeOf[T]) String() string {
+	var zero T
+	return fmt.Sprintf("ListNestedObjectTypeOf[%T]", zero)
+}
+
+func (t ListNestedObjectTypeOf[T]) ValueFromList(ctx context.Context, in basetypes.ListValue) (basetypes.ListValuable, diag.Diagnostics) {
+	var diags diag.Diagnostics
+
+	if in.IsNull() {
+		return NewListNestedObjectValueOfNull[T](ctx), diags
+	}
+	if in.IsUnknown() {
+		return NewListNestedObjectValueOfUnknown[T](ctx), diags
+	}
+
+	listValue, d := basetypes.NewListValue(NewObjectTypeOf[T](ctx), in.Elements())
+	diags.Append(d...)
+	if diags.HasError() {
+		return NewListNestedObjectValueOfUnknown[T](ctx), diags
+	}
+
+	value := ListNestedObjectValueOf[T]{
+		ListValue: listValue,
+	}
+
+	return value, diags
+}
+
+func (t ListNestedObjectTypeOf[T]) ValueFromTerraform(ctx context.Context, in tftypes.Value) (attr.Value, error) {
+	attrValue, err := t.ListType.ValueFromTerraform(ctx, in)
+
+	if err != nil {
+		return nil, err
+	}
+
+	listValue, ok := attrValue.(basetypes.ListValue)
+
+	if !ok {
+		return nil, fmt.Errorf("unexpected value type of %T", attrValue)
+	}
+
+	listValuable, diags := t.ValueFromList(ctx, listValue)
+
+	if diags.HasError() {
+		return nil, fmt.Errorf("unexpected error converting ListValue to ListValuable: %v", diags)
+	}
+
+	return listValuable, nil
+}
+
+func (t ListNestedObjectTypeOf[T]) ValueType(ctx context.Context) attr.Value {
+	return ListNestedObjectValueOf[T]{}
+}
+
+func (t ListNestedObjectTypeOf[T]) NewObjectPtr(ctx context.Context) (any, diag.Diagnostics) {
+	return nestedObjectTypeNewObjectPtr[T](ctx)
+}
+
+func (t ListNestedObjectTypeOf[T]) NewObjectSlice(ctx context.Context, len, cap int) (any, diag.Diagnostics) {
+	return nestedObjectTypeNewObjectSlice[T](ctx, len, cap)
+}
+
+func (t ListNestedObjectTypeOf[T]) NullValue(ctx context.Context) (attr.Value, diag.Diagnostics) {
+	var diags diag.Diagnostics
+
+	return NewListNestedObjectValueOfNull[T](ctx), diags
+}
+
+func (t ListNestedObjectTypeOf[T]) ValueFromObjectPtr(ctx context.Context, ptr any) (attr.Value, diag.Diagnostics) {
+	var diags diag.Diagnostics
+
+	if v, ok := ptr.(*T); ok {
+		return NewListNestedObjectValueOfPtr(ctx, v), diags
+	}
+
+	diags.Append(diag.NewErrorDiagnostic("Invalid pointer value", fmt.Sprintf("incorrect type: want %T, got %T", (*T)(nil), ptr)))
+	return nil, diags
+}
+
+func (t ListNestedObjectTypeOf[T]) ValueFromObjectSlice(ctx context.Context, slice any) (attr.Value, diag.Diagnostics) {
+	var diags diag.Diagnostics
+
+	if v, ok := slice.([]*T); ok {
+		return NewListNestedObjectValueOfSlice(ctx, v), diags
+	}
+
+	diags.Append(diag.NewErrorDiagnostic("Invalid slice value", fmt.Sprintf("incorrect type: want %T, got %T", (*[]T)(nil), slice)))
+	return nil, diags
+}
+
+func nestedObjectTypeNewObjectPtr[T any](_ context.Context) (*T, diag.Diagnostics) {
+	var diags diag.Diagnostics
+
+	return new(T), diags
+}
+
+func nestedObjectTypeNewObjectSlice[T any](_ context.Context, len, cap int) ([]*T, diag.Diagnostics) { //nolint:unparam
+	var diags diag.Diagnostics
+
+	return make([]*T, len, cap), diags
+}
+
+// ListNestedObjectValueOf represents a Terraform Plugin Framework List value whose elements are of type ObjectTypeOf.
+type ListNestedObjectValueOf[T any] struct {
+	basetypes.ListValue
+}
+
+var (
+	_ basetypes.ListValuable = ListNestedObjectValueOf[struct{}]{}
+	_ NestedObjectValue      = ListNestedObjectValueOf[struct{}]{}
+)
+
+func (v ListNestedObjectValueOf[T]) Equal(o attr.Value) bool {
+	other, ok := o.(ListNestedObjectValueOf[T])
+
+	if !ok {
+		return false
+	}
+
+	return v.ListValue.Equal(other.ListValue)
+}
+
+func (v ListNestedObjectValueOf[T]) Type(ctx context.Context) attr.Type {
+	return NewListNestedObjectTypeOf[T](ctx)
+}
+
+func (v ListNestedObjectValueOf[T]) ToObjectPtr(ctx context.Context) (any, diag.Diagnostics) {
+	return v.ToPtr(ctx)
+}
+
+func (v ListNestedObjectValueOf[T]) ToObjectSlice(ctx context.Context) (any, diag.Diagnostics) {
+	return v.ToSlice(ctx)
+}
+
+// ToPtr returns a pointer to the single element of a ListNestedObject.
+func (v ListNestedObjectValueOf[T]) ToPtr(ctx context.Context) (*T, diag.Diagnostics) {
+	return nestedObjectValueObjectPtr[T](ctx, v.ListValue)
+}
+
+// ToSlice returns a slice of pointers to the elements of a ListNestedObject.
+func (v ListNestedObjectValueOf[T]) ToSlice(ctx context.Context) ([]*T, diag.Diagnostics) {
+	return nestedObjectValueObjectSlice[T](ctx, v.ListValue)
+}
+
+func nestedObjectValueObjectPtr[T any](ctx context.Context, val valueWithElements) (*T, diag.Diagnostics) {
+	var diags diag.Diagnostics
+
+	elements := val.Elements()
+	switch n := len(elements); n {
+	case 0:
+		return nil, diags
+	case 1:
+		ptr, d := nestedObjectValueObjectPtrFromElement[T](ctx, elements[0])
+		diags.Append(d...)
+		if diags.HasError() {
+			return nil, diags
+		}
+		return ptr, diags
+	default:
+		diags.Append(diag.NewErrorDiagnostic("Invalid list/set", fmt.Sprintf("too many elements: want 1, got %d", n)))
+		return nil, diags
+	}
+}
+
+func nestedObjectValueObjectSlice[T any](ctx context.Context, val valueWithElements) ([]*T, diag.Diagnostics) {
+	var diags diag.Diagnostics
+
+	elements := val.Elements()
+	n := len(elements)
+	slice := make([]*T, n)
+	for i := 0; i < n; i++ {
+		ptr, d := nestedObjectValueObjectPtrFromElement[T](ctx, elements[i])
+		diags.Append(d...)
+		if diags.HasError() {
+			return nil, diags
+		}
+
+		slice[i] = ptr
+	}
+
+	return slice, diags
+}
+
+func nestedObjectValueObjectPtrFromElement[T any](ctx context.Context, val attr.Value) (*T, diag.Diagnostics) {
+	var diags diag.Diagnostics
+
+	ptr := new(T)
+	diags.Append(val.(ObjectValueOf[T]).ObjectValue.As(ctx, ptr, basetypes.ObjectAsOptions{})...)
+	if diags.HasError() {
+		return nil, diags
+	}
+
+	return ptr, diags
+}
+
+func NewListNestedObjectValueOfNull[T any](ctx context.Context) ListNestedObjectValueOf[T] {
+	return ListNestedObjectValueOf[T]{ListValue: basetypes.NewListNull(NewObjectTypeOf[T](ctx))}
+}
+
+func NewListNestedObjectValueOfUnknown[T any](ctx context.Context) ListNestedObjectValueOf[T] {
+	return ListNestedObjectValueOf[T]{ListValue: basetypes.NewListUnknown(NewObjectTypeOf[T](ctx))}
+}
+
+func NewListNestedObjectValueOfPtr[T any](ctx context.Context, t *T) ListNestedObjectValueOf[T] {
+	return NewListNestedObjectValueOfSlice(ctx, []*T{t})
+}
+
+func NewListNestedObjectValueOfSlice[T any](ctx context.Context, ts []*T) ListNestedObjectValueOf[T] {
+	return newListNestedObjectValueOf[T](ctx, ts)
+}
+
+func NewListNestedObjectValueOfValueSlice[T any](ctx context.Context, ts []T) ListNestedObjectValueOf[T] {
+	return newListNestedObjectValueOf[T](ctx, ts)
+}
+
+func newListNestedObjectValueOf[T any](ctx context.Context, elements any) ListNestedObjectValueOf[T] {
+	return ListNestedObjectValueOf[T]{ListValue: fwdiag.Must(basetypes.NewListValueFrom(ctx, NewObjectTypeOf[T](ctx), elements))}
+}
diff --git a/internal/framework/types/list_nested_objectof_test.go b/internal/framework/types/list_nested_objectof_test.go
new file mode 100644
index 00000000000..6b76b9ab5a1
--- /dev/null
+++ b/internal/framework/types/list_nested_objectof_test.go
@@ -0,0 +1,176 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package types_test
+
+import (
+	"context"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/hashicorp/terraform-plugin-framework/attr"
+	"github.com/hashicorp/terraform-plugin-framework/types"
+	"github.com/hashicorp/terraform-plugin-go/tftypes"
+	fwtypes "github.com/hashicorp/terraform-provider-aws/internal/framework/types"
+)
+
+func TestListNestedObjectTypeOfEqual(t *testing.T) {
+	t.Parallel()
+
+	ctx := context.Background()
+	testCases := map[string]struct {
+		other attr.Type
+		want  bool
+	}{
+		"string type": {
+			other: types.StringType,
+		},
+		"equal type": {
+			other: fwtypes.NewListNestedObjectTypeOf[ObjectA](ctx),
+			want:  true,
+		},
+		"other struct type": {
+			other: fwtypes.NewListNestedObjectTypeOf[ObjectB](ctx),
+		},
+	}
+
+	for name, testCase := range testCases {
+		name, testCase := name, testCase
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			got := fwtypes.NewListNestedObjectTypeOf[ObjectA](ctx).Equal(testCase.other)
+
+			if got != testCase.want {
+				t.Errorf("got = %v, want = %v", got, testCase.want)
+			}
+		})
+	}
+}
+
+func TestListNestedObjectTypeOfValueFromTerraform(t *testing.T) {
+	t.Parallel()
+
+	objectA := ObjectA{
+		Name: types.StringValue("test"),
+	}
+	objectAType := tftypes.Object{
+		AttributeTypes: map[string]tftypes.Type{
+			"name": tftypes.String,
+		},
+	}
+	objectAListType := tftypes.List{ElementType: objectAType}
+	objectAValue := tftypes.NewValue(objectAType, map[string]tftypes.Value{
+		"name": tftypes.NewValue(tftypes.String, "test"),
+	})
+	objectAListValue := tftypes.NewValue(tftypes.List{ElementType: objectAType}, []tftypes.Value{objectAValue})
+	objectBType := tftypes.Object{
+		AttributeTypes: map[string]tftypes.Type{
+			"length": tftypes.Number,
+		},
+	}
+	objectBValue := tftypes.NewValue(objectBType, map[string]tftypes.Value{
+		"length": tftypes.NewValue(tftypes.Number, 42),
+	})
+	objectBListValue := tftypes.NewValue(tftypes.List{ElementType: objectBType}, []tftypes.Value{objectBValue})
+
+	ctx := context.Background()
+	testCases := map[string]struct {
+		tfVal   tftypes.Value
+		wantVal attr.Value
+		wantErr bool
+	}{
+		"null value": {
+			tfVal:   tftypes.NewValue(objectAListType, nil),
+			wantVal: fwtypes.NewListNestedObjectValueOfNull[ObjectA](ctx),
+		},
+		"unknown value": {
+			tfVal:   tftypes.NewValue(objectAListType, tftypes.UnknownValue),
+			wantVal: fwtypes.NewListNestedObjectValueOfUnknown[ObjectA](ctx),
+		},
+		"valid value": {
+			tfVal:   objectAListValue,
+			wantVal: fwtypes.NewListNestedObjectValueOfPtr[ObjectA](ctx, &objectA),
+		},
+		"invalid Terraform value": {
+			tfVal:   objectBListValue,
+			wantVal: fwtypes.NewListNestedObjectValueOfPtr[ObjectA](ctx, &objectA),
+			wantErr: true,
+		},
+	}
+
+	for name, testCase := range testCases {
+		name, testCase := name, testCase
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			gotVal, err := fwtypes.NewListNestedObjectTypeOf[ObjectA](ctx).ValueFromTerraform(ctx, testCase.tfVal)
+			gotErr := err != nil
+
+			if gotErr != testCase.wantErr {
+				t.Errorf("gotErr = %v, wantErr = %v", gotErr, testCase.wantErr)
+			}
+
+			if gotErr {
+				if !testCase.wantErr {
+					t.Errorf("err = %q", err)
+				}
+			} else if diff := cmp.Diff(gotVal, testCase.wantVal); diff != "" {
+				t.Errorf("unexpected diff (+wanted, -got): %s", diff)
+			}
+		})
+	}
+}
+
+func TestListNestedObjectValueOfEqual(t *testing.T) {
+	t.Parallel()
+
+	objectA := ObjectA{
+		Name: types.StringValue("test"),
+	}
+	objectB := ObjectB{
+		Length: types.Int64Value(42),
+	}
+	objectA2 := ObjectA{
+		Name: types.StringValue("test2"),
+	}
+
+	ctx := context.Background()
+	testCases := map[string]struct {
+		other attr.Value
+		want  bool
+	}{
+		"string value": {
+			other: types.StringValue("test"),
+		},
+		"equal value": {
+			other: fwtypes.NewListNestedObjectValueOfPtr(ctx, &objectA),
+			want:  true,
+		},
+		"struct not equal value": {
+			other: fwtypes.NewListNestedObjectValueOfPtr(ctx, &objectA2),
+		},
+		"other struct value": {
+			other: fwtypes.NewListNestedObjectValueOfPtr(ctx, &objectB),
+		},
+		"null value": {
+			other: fwtypes.NewListNestedObjectValueOfNull[ObjectA](ctx),
+		},
+		"unknown value": {
+			other: fwtypes.NewListNestedObjectValueOfUnknown[ObjectA](ctx),
+		},
+	}
+
+	for name, testCase := range testCases {
+		name, testCase := name, testCase
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			got := fwtypes.NewListNestedObjectValueOfPtr(ctx, &objectA).Equal(testCase.other)
+
+			if got != testCase.want {
+				t.Errorf("got = %v, want = %v", got, testCase.want)
+			}
+		})
+	}
+}
diff --git a/internal/framework/types/nested_object.go b/internal/framework/types/nested_object.go
new file mode 100644
index 00000000000..fac17b79b7c
--- /dev/null
+++ b/internal/framework/types/nested_object.go
@@ -0,0 +1,49 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package types
+
+import (
+	"context"
+
+	"github.com/hashicorp/terraform-plugin-framework/attr"
+	"github.com/hashicorp/terraform-plugin-framework/diag"
+)
+
+// NestedObjectType extends the Type interface for types that represent nested Objects.
+type NestedObjectType interface {
+	attr.Type
+
+	// NewObjectPtr returns a new, empty value as an object pointer (Go *struct).
+	NewObjectPtr(context.Context) (any, diag.Diagnostics)
+
+	// NewObjectSlice returns a new value as an object slice (Go []*struct).
+	NewObjectSlice(context.Context, int, int) (any, diag.Diagnostics)
+
+	// NullValue returns a Null Value.
+	NullValue(context.Context) (attr.Value, diag.Diagnostics)
+
+	// ValueFromObjectPtr returns a Value given an object pointer (Go *struct).
+	ValueFromObjectPtr(context.Context, any) (attr.Value, diag.Diagnostics)
+
+	// ValueFromObjectSlice returns a Value given an object pointer (Go []*struct).
+	ValueFromObjectSlice(context.Context, any) (attr.Value, diag.Diagnostics)
+}
+
+// NestedObjectValue extends the Value interface for values that represent nested Objects.
+type NestedObjectValue interface {
+	attr.Value
+
+	// ToObjectPtr returns the value as an object pointer (Go *struct).
+	ToObjectPtr(context.Context) (any, diag.Diagnostics)
+
+	// ToObjectSlice returns the value as an object slice (Go []*struct).
+	ToObjectSlice(context.Context) (any, diag.Diagnostics)
+}
+
+// valueWithElements extends the Value interface for values that have an Elements method.
+type valueWithElements interface {
+	attr.Value
+
+	Elements() []attr.Value
+}
diff --git a/internal/framework/types/objectof.go b/internal/framework/types/objectof.go
new file mode 100644
index 00000000000..5a8d2aa04c5
--- /dev/null
+++ b/internal/framework/types/objectof.go
@@ -0,0 +1,123 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package types
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/hashicorp/terraform-plugin-framework/attr"
+	"github.com/hashicorp/terraform-plugin-framework/diag"
+	"github.com/hashicorp/terraform-plugin-framework/types/basetypes"
+	"github.com/hashicorp/terraform-plugin-go/tftypes"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs/fwdiag"
+)
+
+// ObjectTypeOf is the attribute type of an ObjectValueOf.
+type ObjectTypeOf[T any] struct {
+	basetypes.ObjectType
+}
+
+var _ basetypes.ObjectTypable = ObjectTypeOf[struct{}]{}
+
+func NewObjectTypeOf[T any](ctx context.Context) ObjectTypeOf[T] {
+	return ObjectTypeOf[T]{basetypes.ObjectType{AttrTypes: AttributeTypesMust[T](ctx)}}
+}
+
+func (t ObjectTypeOf[T]) Equal(o attr.Type) bool {
+	other, ok := o.(ObjectTypeOf[T])
+
+	if !ok {
+		return false
+	}
+
+	return t.ObjectType.Equal(other.ObjectType)
+}
+
+func (t ObjectTypeOf[T]) String() string {
+	var zero T
+	return fmt.Sprintf("ObjectTypeOf[%T]", zero)
+}
+
+func (t ObjectTypeOf[T]) ValueFromObject(ctx context.Context, in basetypes.ObjectValue) (basetypes.ObjectValuable, diag.Diagnostics) {
+	var diags diag.Diagnostics
+
+	if in.IsNull() {
+		return NewObjectValueOfNull[T](ctx), diags
+	}
+	if in.IsUnknown() {
+		return NewObjectValueOfUnknown[T](ctx), diags
+	}
+
+	objectValue, d := basetypes.NewObjectValue(AttributeTypesMust[T](ctx), in.Attributes())
+	diags.Append(d...)
+	if diags.HasError() {
+		return NewObjectValueOfUnknown[T](ctx), diags
+	}
+
+	value := ObjectValueOf[T]{
+		ObjectValue: objectValue,
+	}
+
+	return value, diags
+}
+
+func (t ObjectTypeOf[T]) ValueFromTerraform(ctx context.Context, in tftypes.Value) (attr.Value, error) {
+	attrValue, err := t.ObjectType.ValueFromTerraform(ctx, in)
+
+	if err != nil {
+		return nil, err
+	}
+
+	objectValue, ok := attrValue.(basetypes.ObjectValue)
+
+	if !ok {
+		return nil, fmt.Errorf("unexpected value type of %T", attrValue)
+	}
+
+	objectValuable, diags := t.ValueFromObject(ctx, objectValue)
+
+	if diags.HasError() {
+		return nil, fmt.Errorf("unexpected error converting ObjectValue to ObjectValuable: %v", diags)
+	}
+
+	return objectValuable, nil
+}
+
+func (t ObjectTypeOf[T]) ValueType(ctx context.Context) attr.Value {
+	return ObjectValueOf[T]{}
+}
+
+// ObjectValueOf represents a Terraform Plugin Framework Object value whose corresponding Go type is the structure T.
+type ObjectValueOf[T any] struct {
+	basetypes.ObjectValue
+}
+
+var _ basetypes.ObjectValuable = ObjectValueOf[struct{}]{}
+
+func (v ObjectValueOf[T]) Equal(o attr.Value) bool {
+	other, ok := o.(ObjectValueOf[T])
+
+	if !ok {
+		return false
+	}
+
+	return v.ObjectValue.Equal(other.ObjectValue)
+}
+
+func (v ObjectValueOf[T]) Type(ctx context.Context) attr.Type {
+	return NewObjectTypeOf[T](ctx)
+}
+
+func NewObjectValueOfNull[T any](ctx context.Context) ObjectValueOf[T] {
+	return ObjectValueOf[T]{ObjectValue: basetypes.NewObjectNull(AttributeTypesMust[T](ctx))}
+}
+
+func NewObjectValueOfUnknown[T any](ctx context.Context) ObjectValueOf[T] {
+	return ObjectValueOf[T]{ObjectValue: basetypes.NewObjectUnknown(AttributeTypesMust[T](ctx))}
+}
+
+func NewObjectValueOf[T any](ctx context.Context, t *T) ObjectValueOf[T] {
+	return ObjectValueOf[T]{ObjectValue: fwdiag.Must(basetypes.NewObjectValueFrom(ctx, AttributeTypesMust[T](ctx), t))}
+}
diff --git a/internal/framework/types/objectof_test.go b/internal/framework/types/objectof_test.go
new file mode 100644
index 00000000000..1b05d3f51e6
--- /dev/null
+++ b/internal/framework/types/objectof_test.go
@@ -0,0 +1,181 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package types_test
+
+import (
+	"context"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/hashicorp/terraform-plugin-framework/attr"
+	"github.com/hashicorp/terraform-plugin-framework/types"
+	"github.com/hashicorp/terraform-plugin-go/tftypes"
+	fwtypes "github.com/hashicorp/terraform-provider-aws/internal/framework/types"
+)
+
+type ObjectA struct {
+	Name types.String `tfsdk:"name"`
+}
+
+type ObjectB struct {
+	Length types.Int64 `tfsdk:"length"`
+}
+
+func TestObjectTypeOfEqual(t *testing.T) {
+	t.Parallel()
+
+	ctx := context.Background()
+	testCases := map[string]struct {
+		other attr.Type
+		want  bool
+	}{
+		"string type": {
+			other: types.StringType,
+		},
+		"equal type": {
+			other: fwtypes.NewObjectTypeOf[ObjectA](ctx),
+			want:  true,
+		},
+		"other struct type": {
+			other: fwtypes.NewObjectTypeOf[ObjectB](ctx),
+		},
+	}
+
+	for name, testCase := range testCases {
+		name, testCase := name, testCase
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			got := fwtypes.NewObjectTypeOf[ObjectA](ctx).Equal(testCase.other)
+
+			if got != testCase.want {
+				t.Errorf("got = %v, want = %v", got, testCase.want)
+			}
+		})
+	}
+}
+
+func TestObjectTypeOfValueFromTerraform(t *testing.T) {
+	t.Parallel()
+
+	objectA := ObjectA{
+		Name: types.StringValue("test"),
+	}
+	objectAType := tftypes.Object{
+		AttributeTypes: map[string]tftypes.Type{
+			"name": tftypes.String,
+		},
+	}
+	objectAValue := tftypes.NewValue(objectAType, map[string]tftypes.Value{
+		"name": tftypes.NewValue(tftypes.String, "test"),
+	})
+	objectBType := tftypes.Object{
+		AttributeTypes: map[string]tftypes.Type{
+			"length": tftypes.Number,
+		},
+	}
+	objectBValue := tftypes.NewValue(objectBType, map[string]tftypes.Value{
+		"length": tftypes.NewValue(tftypes.Number, 42),
+	})
+
+	ctx := context.Background()
+	testCases := map[string]struct {
+		tfVal   tftypes.Value
+		wantVal attr.Value
+		wantErr bool
+	}{
+		"null value": {
+			tfVal:   tftypes.NewValue(objectAType, nil),
+			wantVal: fwtypes.NewObjectValueOfNull[ObjectA](ctx),
+		},
+		"unknown value": {
+			tfVal:   tftypes.NewValue(objectAType, tftypes.UnknownValue),
+			wantVal: fwtypes.NewObjectValueOfUnknown[ObjectA](ctx),
+		},
+		"valid value": {
+			tfVal:   objectAValue,
+			wantVal: fwtypes.NewObjectValueOf[ObjectA](ctx, &objectA),
+		},
+		"invalid Terraform value": {
+			tfVal:   objectBValue,
+			wantVal: fwtypes.NewObjectValueOf[ObjectA](ctx, &objectA),
+			wantErr: true,
+		},
+	}
+
+	for name, testCase := range testCases {
+		name, testCase := name, testCase
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			gotVal, err := fwtypes.NewObjectTypeOf[ObjectA](ctx).ValueFromTerraform(ctx, testCase.tfVal)
+			gotErr := err != nil
+
+			if gotErr != testCase.wantErr {
+				t.Errorf("gotErr = %v, wantErr = %v", gotErr, testCase.wantErr)
+			}
+
+			if gotErr {
+				if !testCase.wantErr {
+					t.Errorf("err = %q", err)
+				}
+			} else if diff := cmp.Diff(gotVal, testCase.wantVal); diff != "" {
+				t.Errorf("unexpected diff (+wanted, -got): %s", diff)
+			}
+		})
+	}
+}
+
+func TestObjectValueOfEqual(t *testing.T) {
+	t.Parallel()
+
+	objectA := ObjectA{
+		Name: types.StringValue("test"),
+	}
+	objectB := ObjectB{
+		Length: types.Int64Value(42),
+	}
+	objectA2 := ObjectA{
+		Name: types.StringValue("test2"),
+	}
+
+	ctx := context.Background()
+	testCases := map[string]struct {
+		other attr.Value
+		want  bool
+	}{
+		"string value": {
+			other: types.StringValue("test"),
+		},
+		"equal value": {
+			other: fwtypes.NewObjectValueOf(ctx, &objectA),
+			want:  true,
+		},
+		"struct not equal value": {
+			other: fwtypes.NewObjectValueOf(ctx, &objectA2),
+		},
+		"other struct value": {
+			other: fwtypes.NewObjectValueOf(ctx, &objectB),
+		},
+		"null value": {
+			other: fwtypes.NewObjectValueOfNull[ObjectA](ctx),
+		},
+		"unknown value": {
+			other: fwtypes.NewObjectValueOfUnknown[ObjectA](ctx),
+		},
+	}
+
+	for name, testCase := range testCases {
+		name, testCase := name, testCase
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			got := fwtypes.NewObjectValueOf(ctx, &objectA).Equal(testCase.other)
+
+			if got != testCase.want {
+				t.Errorf("got = %v, want = %v", got, testCase.want)
+			}
+		})
+	}
+}
diff --git a/internal/framework/types/regexp.go b/internal/framework/types/regexp.go
index 96464f1418a..00b67e09273 100644
--- a/internal/framework/types/regexp.go
+++ b/internal/framework/types/regexp.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package types
 
 import (
@@ -21,7 +24,8 @@ var (
 )
 
 var (
-	_ xattr.TypeWithValidate = RegexpType
+	_ xattr.TypeWithValidate   = RegexpType
+	_ basetypes.StringValuable = Regexp{}
 )
 
 func (t regexpType) TerraformType(_ context.Context) tftypes.Type {
@@ -103,8 +107,7 @@ func (t regexpType) Validate(ctx context.Context, in tftypes.Value, path path.Pa
 		diags.AddAttributeError(
 			path,
 			"Regexp Type Validation Error",
-			"An unexpected error was encountered trying to validate an attribute value. This is always an error in the provider. Please report the following to the provider developer:\n\n"+
-				fmt.Sprintf("Expected String value, received %T with value: %v", in, in),
+			fmt.Sprintf("%sExpected String value, received %T with value: %v", ProviderErrorDetailPrefix, in, in),
 		)
 		return diags
 	}
@@ -119,8 +122,7 @@ func (t regexpType) Validate(ctx context.Context, in tftypes.Value, path path.Pa
 		diags.AddAttributeError(
 			path,
 			"Regexp Type Validation Error",
-			"An unexpected error was encountered trying to validate an attribute value. This is always an error in the provider. Please report the following to the provider developer:\n\n"+
-				fmt.Sprintf("Cannot convert value to string: %s", err),
+			fmt.Sprintf("%sCannot convert value to string: %s", ProviderErrorDetailPrefix, err),
 		)
 		return diags
 	}
diff --git a/internal/framework/types/regexp_test.go b/internal/framework/types/regexp_test.go
index bf8677115fd..06985ca2391 100644
--- a/internal/framework/types/regexp_test.go
+++ b/internal/framework/types/regexp_test.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package types_test
 
 import (
 	"context"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/hashicorp/terraform-plugin-framework/path"
 	"github.com/hashicorp/terraform-plugin-framework/types"
 	"github.com/hashicorp/terraform-plugin-go/tftypes"
@@ -28,7 +31,7 @@ func TestRegexpTypeValueFromTerraform(t *testing.T) {
 		},
 		"valid Regexp": {
 			val:      tftypes.NewValue(tftypes.String, `\w+`),
-			expected: fwtypes.RegexpValue(regexp.MustCompile(`\w+`)),
+			expected: fwtypes.RegexpValue(regexache.MustCompile(`\w+`)),
 		},
 		"invalid Regexp": {
 			val:      tftypes.NewValue(tftypes.String, `(`),
@@ -110,7 +113,7 @@ func TestRegexpToStringValue(t *testing.T) {
 		expected types.String
 	}{
 		"value": {
-			regexp:   fwtypes.RegexpValue(regexp.MustCompile(`\w+`)),
+			regexp:   fwtypes.RegexpValue(regexache.MustCompile(`\w+`)),
 			expected: types.StringValue(`\w+`),
 		},
 		"null": {
diff --git a/internal/framework/types/set_nested_objectof.go b/internal/framework/types/set_nested_objectof.go
new file mode 100644
index 00000000000..e465126acb3
--- /dev/null
+++ b/internal/framework/types/set_nested_objectof.go
@@ -0,0 +1,195 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package types
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/hashicorp/terraform-plugin-framework/attr"
+	"github.com/hashicorp/terraform-plugin-framework/diag"
+	"github.com/hashicorp/terraform-plugin-framework/types/basetypes"
+	"github.com/hashicorp/terraform-plugin-go/tftypes"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs/fwdiag"
+)
+
+// SetNestedObjectTypeOf is the attribute type of a SetNestedObjectValueOf.
+type SetNestedObjectTypeOf[T any] struct {
+	basetypes.SetType
+}
+
+var (
+	_ basetypes.SetTypable = SetNestedObjectTypeOf[struct{}]{}
+	_ NestedObjectType     = SetNestedObjectTypeOf[struct{}]{}
+)
+
+func NewSetNestedObjectTypeOf[T any](ctx context.Context) SetNestedObjectTypeOf[T] {
+	return SetNestedObjectTypeOf[T]{basetypes.SetType{ElemType: NewObjectTypeOf[T](ctx)}}
+}
+
+func (t SetNestedObjectTypeOf[T]) Equal(o attr.Type) bool {
+	other, ok := o.(SetNestedObjectTypeOf[T])
+
+	if !ok {
+		return false
+	}
+
+	return t.SetType.Equal(other.SetType)
+}
+
+func (t SetNestedObjectTypeOf[T]) String() string {
+	var zero T
+	return fmt.Sprintf("SetNestedObjectTypeOf[%T]", zero)
+}
+
+func (t SetNestedObjectTypeOf[T]) ValueFromSet(ctx context.Context, in basetypes.SetValue) (basetypes.SetValuable, diag.Diagnostics) {
+	var diags diag.Diagnostics
+
+	if in.IsNull() {
+		return NewSetNestedObjectValueOfNull[T](ctx), diags
+	}
+	if in.IsUnknown() {
+		return NewSetNestedObjectValueOfUnknown[T](ctx), diags
+	}
+
+	setValue, d := basetypes.NewSetValue(NewObjectTypeOf[T](ctx), in.Elements())
+	diags.Append(d...)
+	if diags.HasError() {
+		return NewSetNestedObjectValueOfUnknown[T](ctx), diags
+	}
+
+	value := SetNestedObjectValueOf[T]{
+		SetValue: setValue,
+	}
+
+	return value, diags
+}
+
+func (t SetNestedObjectTypeOf[T]) ValueFromTerraform(ctx context.Context, in tftypes.Value) (attr.Value, error) {
+	attrValue, err := t.SetType.ValueFromTerraform(ctx, in)
+
+	if err != nil {
+		return nil, err
+	}
+
+	setValue, ok := attrValue.(basetypes.SetValue)
+
+	if !ok {
+		return nil, fmt.Errorf("unexpected value type of %T", attrValue)
+	}
+
+	setValuable, diags := t.ValueFromSet(ctx, setValue)
+
+	if diags.HasError() {
+		return nil, fmt.Errorf("unexpected error converting SetValue to SetValuable: %v", diags)
+	}
+
+	return setValuable, nil
+}
+
+func (t SetNestedObjectTypeOf[T]) ValueType(ctx context.Context) attr.Value {
+	return SetNestedObjectValueOf[T]{}
+}
+
+func (t SetNestedObjectTypeOf[T]) NewObjectPtr(ctx context.Context) (any, diag.Diagnostics) {
+	return nestedObjectTypeNewObjectPtr[T](ctx)
+}
+
+func (t SetNestedObjectTypeOf[T]) NewObjectSlice(ctx context.Context, len, cap int) (any, diag.Diagnostics) {
+	return nestedObjectTypeNewObjectSlice[T](ctx, len, cap)
+}
+
+func (t SetNestedObjectTypeOf[T]) NullValue(ctx context.Context) (attr.Value, diag.Diagnostics) {
+	var diags diag.Diagnostics
+
+	return NewSetNestedObjectValueOfNull[T](ctx), diags
+}
+
+func (t SetNestedObjectTypeOf[T]) ValueFromObjectPtr(ctx context.Context, ptr any) (attr.Value, diag.Diagnostics) {
+	var diags diag.Diagnostics
+
+	if v, ok := ptr.(*T); ok {
+		return NewSetNestedObjectValueOfPtr(ctx, v), diags
+	}
+
+	diags.Append(diag.NewErrorDiagnostic("Invalid pointer value", fmt.Sprintf("incorrect type: want %T, got %T", (*T)(nil), ptr)))
+	return nil, diags
+}
+
+func (t SetNestedObjectTypeOf[T]) ValueFromObjectSlice(ctx context.Context, slice any) (attr.Value, diag.Diagnostics) {
+	var diags diag.Diagnostics
+
+	if v, ok := slice.([]*T); ok {
+		return NewSetNestedObjectValueOfSlice(ctx, v), diags
+	}
+
+	diags.Append(diag.NewErrorDiagnostic("Invalid slice value", fmt.Sprintf("incorrect type: want %T, got %T", (*[]T)(nil), slice)))
+	return nil, diags
+}
+
+// SetNestedObjectValueOf represents a Terraform Plugin Framework Set value whose elements are of type ObjectTypeOf.
+type SetNestedObjectValueOf[T any] struct {
+	basetypes.SetValue
+}
+
+var (
+	_ basetypes.SetValuable = SetNestedObjectValueOf[struct{}]{}
+	_ NestedObjectValue     = SetNestedObjectValueOf[struct{}]{}
+)
+
+func (v SetNestedObjectValueOf[T]) Equal(o attr.Value) bool {
+	other, ok := o.(SetNestedObjectValueOf[T])
+
+	if !ok {
+		return false
+	}
+
+	return v.SetValue.Equal(other.SetValue)
+}
+
+func (v SetNestedObjectValueOf[T]) Type(ctx context.Context) attr.Type {
+	return NewSetNestedObjectTypeOf[T](ctx)
+}
+
+func (v SetNestedObjectValueOf[T]) ToObjectPtr(ctx context.Context) (any, diag.Diagnostics) {
+	return v.ToPtr(ctx)
+}
+
+func (v SetNestedObjectValueOf[T]) ToObjectSlice(ctx context.Context) (any, diag.Diagnostics) {
+	return v.ToSlice(ctx)
+}
+
+// ToPtr returns a pointer to the single element of a SetNestedObject.
+func (v SetNestedObjectValueOf[T]) ToPtr(ctx context.Context) (*T, diag.Diagnostics) {
+	return nestedObjectValueObjectPtr[T](ctx, v.SetValue)
+}
+
+// ToSlice returns a slice of pointers to the elements of a SetNestedObject.
+func (v SetNestedObjectValueOf[T]) ToSlice(ctx context.Context) ([]*T, diag.Diagnostics) {
+	return nestedObjectValueObjectSlice[T](ctx, v.SetValue)
+}
+
+func NewSetNestedObjectValueOfNull[T any](ctx context.Context) SetNestedObjectValueOf[T] {
+	return SetNestedObjectValueOf[T]{SetValue: basetypes.NewSetNull(NewObjectTypeOf[T](ctx))}
+}
+
+func NewSetNestedObjectValueOfUnknown[T any](ctx context.Context) SetNestedObjectValueOf[T] {
+	return SetNestedObjectValueOf[T]{SetValue: basetypes.NewSetUnknown(NewObjectTypeOf[T](ctx))}
+}
+
+func NewSetNestedObjectValueOfPtr[T any](ctx context.Context, t *T) SetNestedObjectValueOf[T] {
+	return NewSetNestedObjectValueOfSlice(ctx, []*T{t})
+}
+
+func NewSetNestedObjectValueOfSlice[T any](ctx context.Context, ts []*T) SetNestedObjectValueOf[T] {
+	return newSetNestedObjectValueOf[T](ctx, ts)
+}
+
+func NewSetNestedObjectValueOfValueSlice[T any](ctx context.Context, ts []T) SetNestedObjectValueOf[T] {
+	return newSetNestedObjectValueOf[T](ctx, ts)
+}
+
+func newSetNestedObjectValueOf[T any](ctx context.Context, elements any) SetNestedObjectValueOf[T] {
+	return SetNestedObjectValueOf[T]{SetValue: fwdiag.Must(basetypes.NewSetValueFrom(ctx, NewObjectTypeOf[T](ctx), elements))}
+}
diff --git a/internal/framework/types/set_nested_objectof_test.go b/internal/framework/types/set_nested_objectof_test.go
new file mode 100644
index 00000000000..12c6b9ea8f7
--- /dev/null
+++ b/internal/framework/types/set_nested_objectof_test.go
@@ -0,0 +1,176 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package types_test
+
+import (
+	"context"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/hashicorp/terraform-plugin-framework/attr"
+	"github.com/hashicorp/terraform-plugin-framework/types"
+	"github.com/hashicorp/terraform-plugin-go/tftypes"
+	fwtypes "github.com/hashicorp/terraform-provider-aws/internal/framework/types"
+)
+
+func TestSetNestedObjectTypeOfEqual(t *testing.T) {
+	t.Parallel()
+
+	ctx := context.Background()
+	testCases := map[string]struct {
+		other attr.Type
+		want  bool
+	}{
+		"string type": {
+			other: types.StringType,
+		},
+		"equal type": {
+			other: fwtypes.NewSetNestedObjectTypeOf[ObjectA](ctx),
+			want:  true,
+		},
+		"other struct type": {
+			other: fwtypes.NewSetNestedObjectTypeOf[ObjectB](ctx),
+		},
+	}
+
+	for name, testCase := range testCases {
+		name, testCase := name, testCase
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			got := fwtypes.NewSetNestedObjectTypeOf[ObjectA](ctx).Equal(testCase.other)
+
+			if got != testCase.want {
+				t.Errorf("got = %v, want = %v", got, testCase.want)
+			}
+		})
+	}
+}
+
+func TestSetNestedObjectTypeOfValueFromTerraform(t *testing.T) {
+	t.Parallel()
+
+	objectA := ObjectA{
+		Name: types.StringValue("test"),
+	}
+	objectAType := tftypes.Object{
+		AttributeTypes: map[string]tftypes.Type{
+			"name": tftypes.String,
+		},
+	}
+	objectASetType := tftypes.Set{ElementType: objectAType}
+	objectAValue := tftypes.NewValue(objectAType, map[string]tftypes.Value{
+		"name": tftypes.NewValue(tftypes.String, "test"),
+	})
+	objectASetValue := tftypes.NewValue(tftypes.Set{ElementType: objectAType}, []tftypes.Value{objectAValue})
+	objectBType := tftypes.Object{
+		AttributeTypes: map[string]tftypes.Type{
+			"length": tftypes.Number,
+		},
+	}
+	objectBValue := tftypes.NewValue(objectBType, map[string]tftypes.Value{
+		"length": tftypes.NewValue(tftypes.Number, 42),
+	})
+	objectBSetValue := tftypes.NewValue(tftypes.Set{ElementType: objectBType}, []tftypes.Value{objectBValue})
+
+	ctx := context.Background()
+	testCases := map[string]struct {
+		tfVal   tftypes.Value
+		wantVal attr.Value
+		wantErr bool
+	}{
+		"null value": {
+			tfVal:   tftypes.NewValue(objectASetType, nil),
+			wantVal: fwtypes.NewSetNestedObjectValueOfNull[ObjectA](ctx),
+		},
+		"unknown value": {
+			tfVal:   tftypes.NewValue(objectASetType, tftypes.UnknownValue),
+			wantVal: fwtypes.NewSetNestedObjectValueOfUnknown[ObjectA](ctx),
+		},
+		"valid value": {
+			tfVal:   objectASetValue,
+			wantVal: fwtypes.NewSetNestedObjectValueOfPtr[ObjectA](ctx, &objectA),
+		},
+		"invalid Terraform value": {
+			tfVal:   objectBSetValue,
+			wantVal: fwtypes.NewSetNestedObjectValueOfPtr[ObjectA](ctx, &objectA),
+			wantErr: true,
+		},
+	}
+
+	for name, testCase := range testCases {
+		name, testCase := name, testCase
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			gotVal, err := fwtypes.NewSetNestedObjectTypeOf[ObjectA](ctx).ValueFromTerraform(ctx, testCase.tfVal)
+			gotErr := err != nil
+
+			if gotErr != testCase.wantErr {
+				t.Errorf("gotErr = %v, wantErr = %v", gotErr, testCase.wantErr)
+			}
+
+			if gotErr {
+				if !testCase.wantErr {
+					t.Errorf("err = %q", err)
+				}
+			} else if diff := cmp.Diff(gotVal, testCase.wantVal); diff != "" {
+				t.Errorf("unexpected diff (+wanted, -got): %s", diff)
+			}
+		})
+	}
+}
+
+func TestSetNestedObjectValueOfEqual(t *testing.T) {
+	t.Parallel()
+
+	objectA := ObjectA{
+		Name: types.StringValue("test"),
+	}
+	objectB := ObjectB{
+		Length: types.Int64Value(42),
+	}
+	objectA2 := ObjectA{
+		Name: types.StringValue("test2"),
+	}
+
+	ctx := context.Background()
+	testCases := map[string]struct {
+		other attr.Value
+		want  bool
+	}{
+		"string value": {
+			other: types.StringValue("test"),
+		},
+		"equal value": {
+			other: fwtypes.NewSetNestedObjectValueOfPtr(ctx, &objectA),
+			want:  true,
+		},
+		"struct not equal value": {
+			other: fwtypes.NewSetNestedObjectValueOfPtr(ctx, &objectA2),
+		},
+		"other struct value": {
+			other: fwtypes.NewSetNestedObjectValueOfPtr(ctx, &objectB),
+		},
+		"null value": {
+			other: fwtypes.NewSetNestedObjectValueOfNull[ObjectA](ctx),
+		},
+		"unknown value": {
+			other: fwtypes.NewSetNestedObjectValueOfUnknown[ObjectA](ctx),
+		},
+	}
+
+	for name, testCase := range testCases {
+		name, testCase := name, testCase
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			got := fwtypes.NewSetNestedObjectValueOfPtr(ctx, &objectA).Equal(testCase.other)
+
+			if got != testCase.want {
+				t.Errorf("got = %v, want = %v", got, testCase.want)
+			}
+		})
+	}
+}
diff --git a/internal/framework/types/timestamp_type.go b/internal/framework/types/timestamp_type.go
new file mode 100644
index 00000000000..a607eef6934
--- /dev/null
+++ b/internal/framework/types/timestamp_type.go
@@ -0,0 +1,128 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package types
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"github.com/hashicorp/terraform-plugin-framework/attr"
+	"github.com/hashicorp/terraform-plugin-framework/attr/xattr"
+	"github.com/hashicorp/terraform-plugin-framework/diag"
+	"github.com/hashicorp/terraform-plugin-framework/path"
+	"github.com/hashicorp/terraform-plugin-framework/types/basetypes"
+	"github.com/hashicorp/terraform-plugin-go/tftypes"
+)
+
+type TimestampType struct {
+	basetypes.StringType
+}
+
+var (
+	_ basetypes.StringTypable = TimestampType{}
+	_ xattr.TypeWithValidate  = TimestampType{}
+)
+
+func (typ TimestampType) ValueFromString(_ context.Context, in basetypes.StringValue) (basetypes.StringValuable, diag.Diagnostics) {
+	if in.IsUnknown() {
+		return NewTimestampUnknown(), nil
+	}
+
+	if in.IsNull() {
+		return NewTimestampNull(), nil
+	}
+
+	s := in.ValueString()
+
+	var diags diag.Diagnostics
+	t, err := time.Parse(time.RFC3339, s)
+	if err != nil {
+		diags.AddError(
+			"Timestamp Type Validation Error",
+			fmt.Sprintf("Value %q cannot be parsed as a Timestamp.", s),
+		)
+		return nil, diags
+	}
+
+	return newTimestampValue(s, t), nil
+}
+
+func (typ TimestampType) ValueFromTerraform(_ context.Context, in tftypes.Value) (attr.Value, error) {
+	if !in.IsKnown() {
+		return NewTimestampUnknown(), nil
+	}
+
+	if in.IsNull() {
+		return NewTimestampNull(), nil
+	}
+
+	var s string
+	err := in.As(&s)
+	if err != nil {
+		return nil, err
+	}
+
+	t, err := time.Parse(time.RFC3339, s)
+	if err != nil {
+		return NewTimestampUnknown(), nil //nolint: nilerr // Must not return validation errors
+	}
+
+	return newTimestampValue(s, t), nil
+}
+
+func (typ TimestampType) ValueType(context.Context) attr.Value {
+	return TimestampValue{}
+}
+
+func (typ TimestampType) Equal(o attr.Type) bool {
+	other, ok := o.(TimestampType)
+	if !ok {
+		return false
+	}
+
+	return typ.StringType.Equal(other.StringType)
+}
+
+// String returns a human-friendly description of the TimestampType.
+func (typ TimestampType) String() string {
+	return "types.TimestampType"
+}
+
+func (typ TimestampType) Validate(ctx context.Context, in tftypes.Value, path path.Path) diag.Diagnostics {
+	var diags diag.Diagnostics
+
+	if !in.IsKnown() || in.IsNull() {
+		return diags
+	}
+
+	var s string
+	err := in.As(&s)
+	if err != nil {
+		diags.AddAttributeError(
+			path,
+			"Invalid Terraform Value",
+			"An unexpected error occurred while attempting to convert a Terraform value to a string. "+
+				"This is generally an issue with the provider schema implementation. "+
+				"Please report the following to the provider developer:\n\n"+
+				"Path: "+path.String()+"\n"+
+				"Error: "+err.Error(),
+		)
+		return diags
+	}
+
+	_, err = time.Parse(time.RFC3339, s)
+	if err != nil {
+		diags.AddAttributeError(
+			path,
+			"Invalid Timestamp Value",
+			fmt.Sprintf("Value %q cannot be parsed as an RFC 3339 Timestamp.\n\n"+
+				"Path: %s\n"+
+				"Error: %s", s, path, err),
+		)
+		return diags
+	}
+
+	return diags
+}
diff --git a/internal/framework/types/timestamp_type_test.go b/internal/framework/types/timestamp_type_test.go
new file mode 100644
index 00000000000..57aaaa9f819
--- /dev/null
+++ b/internal/framework/types/timestamp_type_test.go
@@ -0,0 +1,138 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package types_test
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/hashicorp/terraform-plugin-framework/attr"
+	"github.com/hashicorp/terraform-plugin-framework/path"
+	"github.com/hashicorp/terraform-plugin-go/tftypes"
+	fwtypes "github.com/hashicorp/terraform-provider-aws/internal/framework/types"
+)
+
+func TestTimestampTypeValueFromTerraform(t *testing.T) {
+	t.Parallel()
+
+	tests := map[string]struct {
+		val      tftypes.Value
+		expected attr.Value
+	}{
+		"null value": {
+			val:      tftypes.NewValue(tftypes.String, nil),
+			expected: fwtypes.NewTimestampNull(),
+		},
+		"unknown value": {
+			val:      tftypes.NewValue(tftypes.String, tftypes.UnknownValue),
+			expected: fwtypes.NewTimestampUnknown(),
+		},
+		"valid timestamp UTC": {
+			val:      tftypes.NewValue(tftypes.String, "2023-06-07T15:11:34Z"),
+			expected: fwtypes.NewTimestampValue(time.Date(2023, time.June, 7, 15, 11, 34, 0, time.UTC)),
+		},
+		"valid timestamp zone": {
+			val:      tftypes.NewValue(tftypes.String, "2023-06-07T15:11:34-06:00"),
+			expected: fwtypes.NewTimestampValue(time.Date(2023, time.June, 7, 15, 11, 34, 0, locationFromString(t, "America/Regina"))), // No DST
+		},
+		"invalid value": {
+			val:      tftypes.NewValue(tftypes.String, "not ok"),
+			expected: fwtypes.NewTimestampUnknown(),
+		},
+		"invalid no zone": {
+			val:      tftypes.NewValue(tftypes.String, "2023-06-07T15:11:34"),
+			expected: fwtypes.NewTimestampUnknown(),
+		},
+		"invalid date only": {
+			val:      tftypes.NewValue(tftypes.String, "2023-06-07Z"),
+			expected: fwtypes.NewTimestampUnknown(),
+		},
+	}
+
+	for name, test := range tests {
+		name, test := name, test
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			ctx := context.Background()
+			val, err := fwtypes.TimestampType{}.ValueFromTerraform(ctx, test.val)
+
+			if err != nil {
+				t.Fatalf("got unexpected error: %s", err)
+			}
+
+			if !test.expected.Equal(val) {
+				t.Errorf("unexpected diff\nwanted: %s\ngot:    %s", test.expected, val)
+			}
+		})
+	}
+}
+
+func TestTimestampTypeValidate(t *testing.T) {
+	t.Parallel()
+
+	type testCase struct {
+		val         tftypes.Value
+		expectError bool
+	}
+	tests := map[string]testCase{
+		"not a string": {
+			val:         tftypes.NewValue(tftypes.Bool, true),
+			expectError: true,
+		},
+		"unknown string": {
+			val: tftypes.NewValue(tftypes.String, tftypes.UnknownValue),
+		},
+		"null string": {
+			val: tftypes.NewValue(tftypes.String, nil),
+		},
+		"valid timestamp UTC": {
+			val: tftypes.NewValue(tftypes.String, "2023-06-07T15:11:34Z"),
+		},
+		"valid timestamp zone": {
+			val: tftypes.NewValue(tftypes.String, "2023-06-07T15:11:34-06:00"),
+		},
+		"invalid string": {
+			val:         tftypes.NewValue(tftypes.String, "not ok"),
+			expectError: true,
+		},
+		"invalid no zone": {
+			val:         tftypes.NewValue(tftypes.String, "2023-06-07T15:11:34"),
+			expectError: true,
+		},
+		"invalid date only": {
+			val:         tftypes.NewValue(tftypes.String, "2023-06-07Z"),
+			expectError: true,
+		},
+	}
+
+	for name, test := range tests {
+		name, test := name, test
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			ctx := context.Background()
+
+			diags := fwtypes.TimestampType{}.Validate(ctx, test.val, path.Root("test"))
+
+			if !diags.HasError() && test.expectError {
+				t.Fatal("expected error, got no error")
+			}
+
+			if diags.HasError() && !test.expectError {
+				t.Fatalf("got unexpected error: %#v", diags)
+			}
+		})
+	}
+}
+
+func locationFromString(t *testing.T, s string) *time.Location {
+	location, err := time.LoadLocation(s)
+	if err != nil {
+		t.Fatalf("loading time.Location %q: %s", s, err)
+	}
+
+	return location
+}
diff --git a/internal/framework/types/timestamp_value.go b/internal/framework/types/timestamp_value.go
new file mode 100644
index 00000000000..73260f6261e
--- /dev/null
+++ b/internal/framework/types/timestamp_value.go
@@ -0,0 +1,83 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package types
+
+import (
+	"context"
+	"time"
+
+	"github.com/hashicorp/terraform-plugin-framework/attr"
+	"github.com/hashicorp/terraform-plugin-framework/types"
+	"github.com/hashicorp/terraform-plugin-framework/types/basetypes"
+)
+
+func NewTimestampNull() TimestampValue {
+	return TimestampValue{
+		StringValue: types.StringNull(),
+	}
+}
+
+func NewTimestampUnknown() TimestampValue {
+	return TimestampValue{
+		StringValue: types.StringUnknown(),
+	}
+}
+
+func NewTimestampValue(t time.Time) TimestampValue {
+	return newTimestampValue(t.Format(time.RFC3339), t)
+}
+
+func NewTimestampValueString(s string) (TimestampValue, error) {
+	t, err := time.Parse(time.RFC3339, s)
+	if err != nil {
+		return TimestampValue{}, err
+	}
+	return newTimestampValue(s, t), nil
+}
+
+func newTimestampValue(s string, t time.Time) TimestampValue {
+	return TimestampValue{
+		StringValue: types.StringValue(s),
+		value:       t,
+	}
+}
+
+var (
+	_ basetypes.StringValuable = TimestampValue{}
+)
+
+type TimestampValue struct {
+	basetypes.StringValue
+
+	// value contains the parsed value, if not Null or Unknown.
+	value time.Time
+}
+
+func (val TimestampValue) Type(_ context.Context) attr.Type {
+	return TimestampType{}
+}
+
+func (val TimestampValue) Equal(other attr.Value) bool {
+	o, ok := other.(TimestampValue)
+
+	if !ok {
+		return false
+	}
+
+	if val.StringValue.IsUnknown() {
+		return o.StringValue.IsUnknown()
+	}
+
+	if val.StringValue.IsNull() {
+		return o.StringValue.IsNull()
+	}
+
+	return val.value.Equal(o.value)
+}
+
+// ValueTimestamp returns the known time.Time value. If Timestamp is null or unknown, returns 0.
+// To get the value as a string, use ValueString.
+func (val TimestampValue) ValueTimestamp() time.Time {
+	return val.value
+}
diff --git a/internal/framework/types/timestamp_value_test.go b/internal/framework/types/timestamp_value_test.go
new file mode 100644
index 00000000000..8d512da5680
--- /dev/null
+++ b/internal/framework/types/timestamp_value_test.go
@@ -0,0 +1,348 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package types_test
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/hashicorp/terraform-plugin-framework/attr"
+	"github.com/hashicorp/terraform-plugin-framework/types"
+	"github.com/hashicorp/terraform-plugin-go/tftypes"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs"
+	fwtypes "github.com/hashicorp/terraform-provider-aws/internal/framework/types"
+)
+
+func TestTimestampValueToTerraformValue(t *testing.T) {
+	t.Parallel()
+
+	tests := map[string]struct {
+		timestamp fwtypes.TimestampValue
+		expected  tftypes.Value
+	}{
+		"value": {
+			timestamp: errs.Must(fwtypes.NewTimestampValueString("2023-06-07T15:11:34Z")),
+			expected:  tftypes.NewValue(tftypes.String, "2023-06-07T15:11:34Z"),
+		},
+		"null": {
+			timestamp: fwtypes.NewTimestampNull(),
+			expected:  tftypes.NewValue(tftypes.String, nil),
+		},
+		"unknown": {
+			timestamp: fwtypes.NewTimestampUnknown(),
+			expected:  tftypes.NewValue(tftypes.String, tftypes.UnknownValue),
+		},
+	}
+
+	for name, test := range tests {
+		name, test := name, test
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			ctx := context.Background()
+
+			got, err := test.timestamp.ToTerraformValue(ctx)
+			if err != nil {
+				t.Fatalf("Unexpected error: %s", err)
+			}
+
+			if !test.expected.Equal(got) {
+				t.Fatalf("expected %#v to equal %#v", got, test.expected)
+			}
+		})
+	}
+}
+
+func TestTimestampValueToStringValue(t *testing.T) {
+	t.Parallel()
+
+	tests := map[string]struct {
+		timestamp fwtypes.TimestampValue
+		expected  types.String
+	}{
+		"value": {
+			timestamp: errs.Must(fwtypes.NewTimestampValueString("2023-06-07T15:11:34Z")),
+			expected:  types.StringValue("2023-06-07T15:11:34Z"),
+		},
+		"null": {
+			timestamp: fwtypes.NewTimestampNull(),
+			expected:  types.StringNull(),
+		},
+		"unknown": {
+			timestamp: fwtypes.NewTimestampUnknown(),
+			expected:  types.StringUnknown(),
+		},
+	}
+
+	for name, test := range tests {
+		name, test := name, test
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			ctx := context.Background()
+
+			s, _ := test.timestamp.ToStringValue(ctx)
+
+			if !test.expected.Equal(s) {
+				t.Fatalf("expected %#v to equal %#v", s, test.expected)
+			}
+		})
+	}
+}
+
+func TestTimestampValueEqual(t *testing.T) {
+	t.Parallel()
+
+	tests := map[string]struct {
+		input     fwtypes.TimestampValue
+		candidate attr.Value
+		expected  bool
+	}{
+		"known-known-same": {
+			input:     errs.Must(fwtypes.NewTimestampValueString("2023-06-07T15:11:34Z")),
+			candidate: errs.Must(fwtypes.NewTimestampValueString("2023-06-07T15:11:34Z")),
+			expected:  true,
+		},
+		"known-known-diff": {
+			input:     errs.Must(fwtypes.NewTimestampValueString("2023-06-07T15:11:34Z")),
+			candidate: errs.Must(fwtypes.NewTimestampValueString("1999-06-07T15:11:34Z")),
+			expected:  false,
+		},
+		"known-unknown": {
+			input:     errs.Must(fwtypes.NewTimestampValueString("2023-06-07T15:11:34Z")),
+			candidate: fwtypes.NewTimestampUnknown(),
+			expected:  false,
+		},
+		"known-null": {
+			input:     errs.Must(fwtypes.NewTimestampValueString("2023-06-07T15:11:34Z")),
+			candidate: fwtypes.NewTimestampNull(),
+			expected:  false,
+		},
+		"unknown-known": {
+			input:     fwtypes.NewTimestampUnknown(),
+			candidate: errs.Must(fwtypes.NewTimestampValueString("2023-06-07T15:11:34Z")),
+			expected:  false,
+		},
+		"unknown-unknown": {
+			input:     fwtypes.NewTimestampUnknown(),
+			candidate: fwtypes.NewTimestampUnknown(),
+			expected:  true,
+		},
+		"unknown-null": {
+			input:     fwtypes.NewTimestampUnknown(),
+			candidate: fwtypes.NewTimestampNull(),
+			expected:  false,
+		},
+		"null-known": {
+			input:     fwtypes.NewTimestampNull(),
+			candidate: errs.Must(fwtypes.NewTimestampValueString("2023-06-07T15:11:34Z")),
+			expected:  false,
+		},
+		"null-unknown": {
+			input:     fwtypes.NewTimestampNull(),
+			candidate: fwtypes.NewTimestampUnknown(),
+			expected:  false,
+		},
+		"null-null": {
+			input:     fwtypes.NewTimestampNull(),
+			candidate: fwtypes.NewTimestampNull(),
+			expected:  true,
+		},
+	}
+	for name, test := range tests {
+		name, test := name, test
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			got := test.input.Equal(test.candidate)
+			if got != test.expected {
+				t.Errorf("expected %t, got %t", test.expected, got)
+			}
+		})
+	}
+}
+
+func TestTimestampValueIsNull(t *testing.T) {
+	t.Parallel()
+
+	testCases := map[string]struct {
+		input    fwtypes.TimestampValue
+		expected bool
+	}{
+		"known": {
+			input:    errs.Must(fwtypes.NewTimestampValueString("2023-06-07T15:11:34Z")),
+			expected: false,
+		},
+		"null": {
+			input:    fwtypes.NewTimestampNull(),
+			expected: true,
+		},
+		"unknown": {
+			input:    fwtypes.NewTimestampUnknown(),
+			expected: false,
+		},
+	}
+
+	for name, testCase := range testCases {
+		name, testCase := name, testCase
+
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			got := testCase.input.IsNull()
+
+			if got != testCase.expected {
+				t.Error("expected Null")
+			}
+		})
+	}
+}
+
+func TestTimestampValueIsUnknown(t *testing.T) {
+	t.Parallel()
+
+	testCases := map[string]struct {
+		input    fwtypes.TimestampValue
+		expected bool
+	}{
+		"known": {
+			input:    errs.Must(fwtypes.NewTimestampValueString("2023-06-07T15:11:34Z")),
+			expected: false,
+		},
+		"null": {
+			input:    fwtypes.NewTimestampNull(),
+			expected: false,
+		},
+		"unknown": {
+			input:    fwtypes.NewTimestampUnknown(),
+			expected: true,
+		},
+	}
+
+	for name, testCase := range testCases {
+		name, testCase := name, testCase
+
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			got := testCase.input.IsUnknown()
+
+			if got != testCase.expected {
+				t.Error("expected Unknown")
+			}
+		})
+	}
+}
+
+func TestTimestampValueString(t *testing.T) {
+	t.Parallel()
+
+	type testCase struct {
+		input    fwtypes.TimestampValue
+		expected string
+	}
+	tests := map[string]testCase{
+		"known-non-empty": {
+			input:    errs.Must(fwtypes.NewTimestampValueString("2023-06-07T15:11:34Z")),
+			expected: `"2023-06-07T15:11:34Z"`,
+		},
+		"unknown": {
+			input:    fwtypes.NewTimestampUnknown(),
+			expected: "<unknown>",
+		},
+		"null": {
+			input:    fwtypes.NewTimestampNull(),
+			expected: "<null>",
+		},
+		"zero-value": {
+			input:    fwtypes.TimestampValue{},
+			expected: `<null>`,
+		},
+	}
+
+	for name, test := range tests {
+		name, test := name, test
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			got := test.input.String()
+			if got != test.expected {
+				t.Errorf("Expected %q, got %q", test.expected, got)
+			}
+		})
+	}
+}
+
+func TestTimestampValueValueString(t *testing.T) {
+	t.Parallel()
+
+	testCases := map[string]struct {
+		input    fwtypes.TimestampValue
+		expected string
+	}{
+		"known": {
+			input:    errs.Must(fwtypes.NewTimestampValueString("2023-06-07T15:11:34Z")),
+			expected: "2023-06-07T15:11:34Z",
+		},
+		"null": {
+			input:    fwtypes.NewTimestampNull(),
+			expected: "",
+		},
+		"unknown": {
+			input:    fwtypes.NewTimestampUnknown(),
+			expected: "",
+		},
+	}
+
+	for name, testCase := range testCases {
+		name, testCase := name, testCase
+
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			got := testCase.input.ValueString()
+
+			if got != testCase.expected {
+				t.Errorf("Expected %q, got %q", testCase.expected, got)
+			}
+		})
+	}
+}
+
+func TestTimestampValueValueTimestamp(t *testing.T) {
+	t.Parallel()
+
+	testCases := map[string]struct {
+		input    fwtypes.TimestampValue
+		expected time.Time
+	}{
+		"known": {
+			input:    errs.Must(fwtypes.NewTimestampValueString("2023-06-07T15:11:34Z")),
+			expected: errs.Must(time.Parse(time.RFC3339, "2023-06-07T15:11:34Z")),
+		},
+		"null": {
+			input:    fwtypes.NewTimestampNull(),
+			expected: time.Time{},
+		},
+		"unknown": {
+			input:    fwtypes.NewTimestampUnknown(),
+			expected: time.Time{},
+		},
+	}
+
+	for name, testCase := range testCases {
+		name, testCase := name, testCase
+
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			got := testCase.input.ValueTimestamp()
+
+			if !testCase.expected.Equal(got) {
+				t.Errorf("Expected %q, got %q", testCase.expected, got)
+			}
+		})
+	}
+}
diff --git a/internal/framework/validators/arn.go b/internal/framework/validators/arn.go
deleted file mode 100644
index 49c5bdeeb8a..00000000000
--- a/internal/framework/validators/arn.go
+++ /dev/null
@@ -1,38 +0,0 @@
-package validators
-
-import (
-	"context"
-
-	"github.com/aws/aws-sdk-go-v2/aws/arn"
-	"github.com/hashicorp/terraform-plugin-framework-validators/helpers/validatordiag"
-	"github.com/hashicorp/terraform-plugin-framework/schema/validator"
-)
-
-type arnValidator struct{}
-
-func (validator arnValidator) Description(_ context.Context) string {
-	return "value must be a valid Amazon Resource Name"
-}
-
-func (validator arnValidator) MarkdownDescription(ctx context.Context) string {
-	return validator.Description(ctx)
-}
-
-func (validator arnValidator) ValidateString(ctx context.Context, request validator.StringRequest, response *validator.StringResponse) {
-	if request.ConfigValue.IsNull() || request.ConfigValue.IsUnknown() {
-		return
-	}
-
-	if !arn.IsARN(request.ConfigValue.ValueString()) {
-		response.Diagnostics.Append(validatordiag.InvalidAttributeValueDiagnostic(
-			request.Path,
-			validator.Description(ctx),
-			request.ConfigValue.ValueString(),
-		))
-		return
-	}
-}
-
-func ARN() validator.String {
-	return arnValidator{}
-}
diff --git a/internal/framework/validators/arn_test.go b/internal/framework/validators/arn_test.go
deleted file mode 100644
index d0ca67c82f2..00000000000
--- a/internal/framework/validators/arn_test.go
+++ /dev/null
@@ -1,63 +0,0 @@
-package validators_test
-
-import (
-	"context"
-	"testing"
-
-	"github.com/google/go-cmp/cmp"
-	"github.com/hashicorp/terraform-plugin-framework/diag"
-	"github.com/hashicorp/terraform-plugin-framework/path"
-	"github.com/hashicorp/terraform-plugin-framework/schema/validator"
-	"github.com/hashicorp/terraform-plugin-framework/types"
-	fwvalidators "github.com/hashicorp/terraform-provider-aws/internal/framework/validators"
-)
-
-func TestARNValidator(t *testing.T) {
-	t.Parallel()
-
-	type testCase struct {
-		val                 types.String
-		expectedDiagnostics diag.Diagnostics
-	}
-
-	tests := map[string]testCase{
-		"unknown String": {
-			val: types.StringUnknown(),
-		},
-		"null String": {
-			val: types.StringNull(),
-		},
-		"valid arn": {
-			val: types.StringValue("arn:aws:iam::aws:policy/CloudWatchReadOnlyAccess"),
-		},
-		"invalid_arn": {
-			val: types.StringValue("arn"),
-			expectedDiagnostics: diag.Diagnostics{
-				diag.NewAttributeErrorDiagnostic(
-					path.Root("test"),
-					"Invalid Attribute Value",
-					`Attribute test value must be a valid Amazon Resource Name, got: arn`,
-				),
-			},
-		},
-	}
-
-	for name, test := range tests {
-		name, test := name, test
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-
-			request := validator.StringRequest{
-				Path:           path.Root("test"),
-				PathExpression: path.MatchRoot("test"),
-				ConfigValue:    test.val,
-			}
-			response := validator.StringResponse{}
-			fwvalidators.ARN().ValidateString(context.Background(), request, &response)
-
-			if diff := cmp.Diff(response.Diagnostics, test.expectedDiagnostics); diff != "" {
-				t.Errorf("unexpected diagnostics difference: %s", diff)
-			}
-		})
-	}
-}
diff --git a/internal/framework/validators/aws_account_id.go b/internal/framework/validators/aws_account_id.go
new file mode 100644
index 00000000000..d748d3ec254
--- /dev/null
+++ b/internal/framework/validators/aws_account_id.go
@@ -0,0 +1,52 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package validators
+
+import (
+	"context"
+
+	"github.com/YakDriver/regexache"
+	"github.com/hashicorp/terraform-plugin-framework-validators/helpers/validatordiag"
+	"github.com/hashicorp/terraform-plugin-framework/schema/validator"
+)
+
+// awsAccountIDValidator validates that a string Attribute's value is a valid AWS account ID.
+type awsAccountIDValidator struct{}
+
+// Description describes the validation in plain text formatting.
+func (validator awsAccountIDValidator) Description(_ context.Context) string {
+	return "value must be a valid AWS account ID"
+}
+
+// MarkdownDescription describes the validation in Markdown formatting.
+func (validator awsAccountIDValidator) MarkdownDescription(ctx context.Context) string {
+	return validator.Description(ctx)
+}
+
+// ValidateString performs the validation.
+func (validator awsAccountIDValidator) ValidateString(ctx context.Context, request validator.StringRequest, response *validator.StringResponse) {
+	if request.ConfigValue.IsNull() || request.ConfigValue.IsUnknown() {
+		return
+	}
+
+	// https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-identifiers.html.
+	if !regexache.MustCompile(`^\d{12}$`).MatchString(request.ConfigValue.ValueString()) {
+		response.Diagnostics.Append(validatordiag.InvalidAttributeValueDiagnostic(
+			request.Path,
+			validator.Description(ctx),
+			request.ConfigValue.ValueString(),
+		))
+		return
+	}
+}
+
+// AWSAccountID returns a string validator which ensures that any configured
+// attribute value:
+//
+//   - Is a string, which represents a valid AWS account ID.
+//
+// Null (unconfigured) and unknown (known after apply) values are skipped.
+func AWSAccountID() validator.String { // nosemgrep:ci.aws-in-func-name
+	return awsAccountIDValidator{}
+}
diff --git a/internal/framework/validators/aws_account_id_test.go b/internal/framework/validators/aws_account_id_test.go
new file mode 100644
index 00000000000..d4f344ef1b6
--- /dev/null
+++ b/internal/framework/validators/aws_account_id_test.go
@@ -0,0 +1,87 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package validators_test
+
+import (
+	"context"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/hashicorp/terraform-plugin-framework/diag"
+	"github.com/hashicorp/terraform-plugin-framework/path"
+	"github.com/hashicorp/terraform-plugin-framework/schema/validator"
+	"github.com/hashicorp/terraform-plugin-framework/types"
+	fwvalidators "github.com/hashicorp/terraform-provider-aws/internal/framework/validators"
+)
+
+func TestAWSAccountIDValidator(t *testing.T) { // nosemgrep:ci.aws-in-func-name
+	t.Parallel()
+
+	type testCase struct {
+		val                 types.String
+		expectedDiagnostics diag.Diagnostics
+	}
+	tests := map[string]testCase{
+		"unknown String": {
+			val: types.StringUnknown(),
+		},
+		"null String": {
+			val: types.StringNull(),
+		},
+		"invalid String": {
+			val: types.StringValue("test-value"),
+			expectedDiagnostics: diag.Diagnostics{
+				diag.NewAttributeErrorDiagnostic(
+					path.Root("test"),
+					"Invalid Attribute Value",
+					`Attribute test value must be a valid AWS account ID, got: test-value`,
+				),
+			},
+		},
+		"valid AWS account ID": {
+			val: types.StringValue("123456789012"),
+		},
+		"too long AWS account ID": {
+			val: types.StringValue("1234567890123"),
+			expectedDiagnostics: diag.Diagnostics{
+				diag.NewAttributeErrorDiagnostic(
+					path.Root("test"),
+					"Invalid Attribute Value",
+					`Attribute test value must be a valid AWS account ID, got: 1234567890123`,
+				),
+			},
+		},
+		"too short AWS account ID": {
+			val: types.StringValue("12345678901"),
+			expectedDiagnostics: diag.Diagnostics{
+				diag.NewAttributeErrorDiagnostic(
+					path.Root("test"),
+					"Invalid Attribute Value",
+					`Attribute test value must be a valid AWS account ID, got: 12345678901`,
+				),
+			},
+		},
+	}
+
+	for name, test := range tests {
+		name, test := name, test
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			ctx := context.Background()
+
+			request := validator.StringRequest{
+				Path:           path.Root("test"),
+				PathExpression: path.MatchRoot("test"),
+				ConfigValue:    test.val,
+			}
+			response := validator.StringResponse{}
+			fwvalidators.AWSAccountID().ValidateString(ctx, request, &response)
+
+			if diff := cmp.Diff(response.Diagnostics, test.expectedDiagnostics); diff != "" {
+				t.Errorf("unexpected diagnostics difference: %s", diff)
+			}
+		})
+	}
+}
diff --git a/internal/framework/validators/cidr.go b/internal/framework/validators/cidr.go
index 5b4b188aa3c..1ba2493a18b 100644
--- a/internal/framework/validators/cidr.go
+++ b/internal/framework/validators/cidr.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package validators
 
 import (
diff --git a/internal/framework/validators/cidr_test.go b/internal/framework/validators/cidr_test.go
index 023cc0c2cad..c04c5c34f5d 100644
--- a/internal/framework/validators/cidr_test.go
+++ b/internal/framework/validators/cidr_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package validators_test
 
 import (
diff --git a/internal/framework/validators/cluster.go b/internal/framework/validators/cluster.go
deleted file mode 100644
index 00a0cf8a1e1..00000000000
--- a/internal/framework/validators/cluster.go
+++ /dev/null
@@ -1,187 +0,0 @@
-package validators
-
-import (
-	"context"
-	"errors"
-	"regexp"
-
-	"github.com/hashicorp/terraform-plugin-framework-validators/helpers/validatordiag"
-	"github.com/hashicorp/terraform-plugin-framework/schema/validator"
-)
-
-type clusterIdentifierValidator struct{}
-
-func (validator clusterIdentifierValidator) Description(_ context.Context) string {
-	return "value must be a valid Cluster Identifier"
-}
-
-func (validator clusterIdentifierValidator) MarkdownDescription(ctx context.Context) string {
-	return validator.Description(ctx)
-}
-
-func (validator clusterIdentifierValidator) ValidateString(ctx context.Context, request validator.StringRequest, response *validator.StringResponse) {
-	if request.ConfigValue.IsNull() || request.ConfigValue.IsUnknown() {
-		return
-	}
-
-	if err := validateClusterIdentifier(request.ConfigValue.ValueString()); err != nil {
-		response.Diagnostics.Append(validatordiag.InvalidAttributeValueDiagnostic(
-			request.Path,
-			validator.Description(ctx)+": "+err.Error(),
-			request.ConfigValue.ValueString(),
-		))
-		return
-	}
-}
-
-func ClusterIdentifier() validator.String {
-	return clusterIdentifierValidator{}
-}
-
-type clusterIdentifierPrefixValidator struct{}
-
-func (validator clusterIdentifierPrefixValidator) Description(_ context.Context) string {
-	return "value must be a valid Cluster Identifier Prefix"
-}
-
-func (validator clusterIdentifierPrefixValidator) MarkdownDescription(ctx context.Context) string {
-	return validator.Description(ctx)
-}
-
-func (validator clusterIdentifierPrefixValidator) ValidateString(ctx context.Context, request validator.StringRequest, response *validator.StringResponse) {
-	if request.ConfigValue.IsNull() || request.ConfigValue.IsUnknown() {
-		return
-	}
-
-	if err := validateClusterIdentifierPrefix(request.ConfigValue.ValueString()); err != nil {
-		response.Diagnostics.Append(validatordiag.InvalidAttributeValueDiagnostic(
-			request.Path,
-			validator.Description(ctx)+": "+err.Error(),
-			request.ConfigValue.ValueString(),
-		))
-		return
-	}
-}
-
-func ClusterIdentifierPrefix() validator.String {
-	return clusterIdentifierPrefixValidator{}
-}
-
-type clusterFinalSnapshotIdentifierValidator struct{}
-
-func (validator clusterFinalSnapshotIdentifierValidator) Description(_ context.Context) string {
-	return "value must be a valid Final Snapshot Identifier"
-}
-
-func (validator clusterFinalSnapshotIdentifierValidator) MarkdownDescription(ctx context.Context) string {
-	return validator.Description(ctx)
-}
-
-func (validator clusterFinalSnapshotIdentifierValidator) ValidateString(ctx context.Context, request validator.StringRequest, response *validator.StringResponse) {
-	if request.ConfigValue.IsNull() || request.ConfigValue.IsUnknown() {
-		return
-	}
-
-	if err := validateFinalSnapshotIdentifier(request.ConfigValue.ValueString()); err != nil {
-		response.Diagnostics.Append(validatordiag.InvalidAttributeValueDiagnostic(
-			request.Path,
-			validator.Description(ctx)+": "+err.Error(),
-			request.ConfigValue.ValueString(),
-		))
-		return
-	}
-}
-
-func ClusterFinalSnapshotIdentifier() validator.String {
-	return clusterFinalSnapshotIdentifierValidator{}
-}
-
-type evaluate struct {
-	regex   func(string) bool
-	message string
-	isMatch bool
-}
-
-func (e evaluate) match(value string) error {
-	if e.regex(value) == e.isMatch {
-		return errors.New(e.message)
-	}
-
-	return nil
-}
-
-var (
-	firstCharacterIsLetter = evaluate{
-		regex:   regexp.MustCompile(`^[a-zA-Z]`).MatchString,
-		message: "first character must be a letter",
-		isMatch: false,
-	}
-	onlyAlphanumeric = evaluate{
-		regex:   regexp.MustCompile(`^[0-9A-Za-z-]+$`).MatchString,
-		message: "must contain only alphanumeric characters and hyphens",
-		isMatch: false,
-	}
-	onlyLowercaseAlphanumeric = evaluate{
-		regex:   regexp.MustCompile(`^[0-9a-z-]+$`).MatchString,
-		message: "must contain only lowercase alphanumeric characters and hyphens",
-		isMatch: false,
-	}
-	noConsecutiveHyphens = evaluate{
-		regex:   regexp.MustCompile(`--`).MatchString,
-		message: "cannot contain two consecutive hyphens",
-		isMatch: true,
-	}
-	cannotEndWithHyphen = evaluate{
-		regex:   regexp.MustCompile(`-$`).MatchString,
-		message: "cannot end with a hyphen",
-		isMatch: true,
-	}
-)
-
-func validateClusterIdentifier(value string) error {
-	err := onlyLowercaseAlphanumeric.match(value)
-	if err != nil {
-		return err
-	}
-	err = noConsecutiveHyphens.match(value)
-	if err != nil {
-		return err
-	}
-	err = cannotEndWithHyphen.match(value)
-	if err != nil {
-		return err
-	}
-
-	return firstCharacterIsLetter.match(value)
-}
-
-func validateClusterIdentifierPrefix(value string) error {
-	err := onlyLowercaseAlphanumeric.match(value)
-	if err != nil {
-		return err
-	}
-	err = noConsecutiveHyphens.match(value)
-	if err != nil {
-		return err
-	}
-
-	return firstCharacterIsLetter.match(value)
-}
-
-func validateFinalSnapshotIdentifier(value string) error {
-	err := onlyAlphanumeric.match(value)
-	if err != nil {
-		return err
-	}
-	err = cannotEndWithHyphen.match(value)
-	if err != nil {
-		return err
-	}
-
-	err = noConsecutiveHyphens.match(value)
-	if err != nil {
-		return err
-	}
-
-	return firstCharacterIsLetter.match(value)
-}
diff --git a/internal/framework/validators/cluster_test.go b/internal/framework/validators/cluster_test.go
deleted file mode 100644
index 13a031cb425..00000000000
--- a/internal/framework/validators/cluster_test.go
+++ /dev/null
@@ -1,271 +0,0 @@
-package validators_test
-
-import (
-	"context"
-	"testing"
-
-	"github.com/google/go-cmp/cmp"
-	"github.com/hashicorp/terraform-plugin-framework/diag"
-	"github.com/hashicorp/terraform-plugin-framework/path"
-	"github.com/hashicorp/terraform-plugin-framework/schema/validator"
-	"github.com/hashicorp/terraform-plugin-framework/types"
-	fwvalidators "github.com/hashicorp/terraform-provider-aws/internal/framework/validators"
-)
-
-func TestClusterIdentifierValidator(t *testing.T) {
-	t.Parallel()
-
-	type testCase struct {
-		val                 types.String
-		expectedDiagnostics diag.Diagnostics
-	}
-
-	tests := map[string]testCase{
-		"unknown String": {
-			val: types.StringUnknown(),
-		},
-		"null String": {
-			val: types.StringNull(),
-		},
-		"valid identifier": {
-			val: types.StringValue("valid-cluster-identifier"),
-		},
-		"begins with number": {
-			val: types.StringValue("11-not-valid"),
-			expectedDiagnostics: diag.Diagnostics{
-				diag.NewAttributeErrorDiagnostic(
-					path.Root("test"),
-					"Invalid Attribute Value",
-					`Attribute test value must be a valid Cluster Identifier: first character must be a letter, got: 11-not-valid`,
-				),
-			},
-		},
-		"contains special character": {
-			val: types.StringValue("not-valid!-identifier"),
-			expectedDiagnostics: diag.Diagnostics{
-				diag.NewAttributeErrorDiagnostic(
-					path.Root("test"),
-					"Invalid Attribute Value",
-					`Attribute test value must be a valid Cluster Identifier: must contain only lowercase alphanumeric characters and hyphens, got: not-valid!-identifier`,
-				),
-			},
-		},
-		"contains uppercase": {
-			val: types.StringValue("Invalid-identifier"),
-			expectedDiagnostics: diag.Diagnostics{
-				diag.NewAttributeErrorDiagnostic(
-					path.Root("test"),
-					"Invalid Attribute Value",
-					`Attribute test value must be a valid Cluster Identifier: must contain only lowercase alphanumeric characters and hyphens, got: Invalid-identifier`,
-				),
-			},
-		},
-		"contains consecutive hyphens": {
-			val: types.StringValue("invalid--identifier"),
-			expectedDiagnostics: diag.Diagnostics{
-				diag.NewAttributeErrorDiagnostic(
-					path.Root("test"),
-					"Invalid Attribute Value",
-					`Attribute test value must be a valid Cluster Identifier: cannot contain two consecutive hyphens, got: invalid--identifier`,
-				),
-			},
-		},
-		"ends with hyphen": {
-			val: types.StringValue("invalid-identifier-"),
-			expectedDiagnostics: diag.Diagnostics{
-				diag.NewAttributeErrorDiagnostic(
-					path.Root("test"),
-					"Invalid Attribute Value",
-					`Attribute test value must be a valid Cluster Identifier: cannot end with a hyphen, got: invalid-identifier-`,
-				),
-			},
-		},
-	}
-
-	for name, test := range tests {
-		name, test := name, test
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-
-			ctx := context.Background()
-
-			request := validator.StringRequest{
-				Path:           path.Root("test"),
-				PathExpression: path.MatchRoot("test"),
-				ConfigValue:    test.val,
-			}
-			response := validator.StringResponse{}
-			fwvalidators.ClusterIdentifier().ValidateString(ctx, request, &response)
-
-			if diff := cmp.Diff(response.Diagnostics, test.expectedDiagnostics); diff != "" {
-				t.Errorf("unexpected diagnostics difference: %s", diff)
-			}
-		})
-	}
-}
-
-func TestClusterIdentifierPrefixValidator(t *testing.T) {
-	t.Parallel()
-
-	type testCase struct {
-		val                 types.String
-		expectedDiagnostics diag.Diagnostics
-	}
-
-	tests := map[string]testCase{
-		"unknown String": {
-			val: types.StringUnknown(),
-		},
-		"null String": {
-			val: types.StringNull(),
-		},
-		"valid identifier": {
-			val: types.StringValue("valid-cluster-identifier"),
-		},
-		"begins with number": {
-			val: types.StringValue("11-not-valid"),
-			expectedDiagnostics: diag.Diagnostics{
-				diag.NewAttributeErrorDiagnostic(
-					path.Root("test"),
-					"Invalid Attribute Value",
-					`Attribute test value must be a valid Cluster Identifier Prefix: first character must be a letter, got: 11-not-valid`,
-				),
-			},
-		},
-		"contains special character": {
-			val: types.StringValue("not-valid!-identifier"),
-			expectedDiagnostics: diag.Diagnostics{
-				diag.NewAttributeErrorDiagnostic(
-					path.Root("test"),
-					"Invalid Attribute Value",
-					`Attribute test value must be a valid Cluster Identifier Prefix: must contain only lowercase alphanumeric characters and hyphens, got: not-valid!-identifier`,
-				),
-			},
-		},
-		"contains uppercase": {
-			val: types.StringValue("InValid-identifier"),
-			expectedDiagnostics: diag.Diagnostics{
-				diag.NewAttributeErrorDiagnostic(
-					path.Root("test"),
-					"Invalid Attribute Value",
-					`Attribute test value must be a valid Cluster Identifier Prefix: must contain only lowercase alphanumeric characters and hyphens, got: InValid-identifier`,
-				),
-			},
-		},
-		"contains consecutive hyphens": {
-			val: types.StringValue("invalid--identifier"),
-			expectedDiagnostics: diag.Diagnostics{
-				diag.NewAttributeErrorDiagnostic(
-					path.Root("test"),
-					"Invalid Attribute Value",
-					`Attribute test value must be a valid Cluster Identifier Prefix: cannot contain two consecutive hyphens, got: invalid--identifier`,
-				),
-			},
-		},
-		"ends with hyphen": {
-			val: types.StringValue("valid-identifier-"),
-		},
-	}
-
-	for name, test := range tests {
-		name, test := name, test
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-
-			request := validator.StringRequest{
-				Path:           path.Root("test"),
-				PathExpression: path.MatchRoot("test"),
-				ConfigValue:    test.val,
-			}
-			response := validator.StringResponse{}
-			fwvalidators.ClusterIdentifierPrefix().ValidateString(context.Background(), request, &response)
-
-			if diff := cmp.Diff(response.Diagnostics, test.expectedDiagnostics); diff != "" {
-				t.Errorf("unexpected diagnostics difference: %s", diff)
-			}
-		})
-	}
-}
-
-func TestClusterFinalSnapshotIdentifierValidator(t *testing.T) {
-	t.Parallel()
-
-	type testCase struct {
-		val                 types.String
-		expectedDiagnostics diag.Diagnostics
-	}
-
-	tests := map[string]testCase{
-		"unknown String": {
-			val: types.StringUnknown(),
-		},
-		"null String": {
-			val: types.StringNull(),
-		},
-		"valid identifier": {
-			val: types.StringValue("valid-cluster-identifier"),
-		},
-		"begins with number": {
-			val: types.StringValue("11-not-valid"),
-			expectedDiagnostics: diag.Diagnostics{
-				diag.NewAttributeErrorDiagnostic(
-					path.Root("test"),
-					"Invalid Attribute Value",
-					`Attribute test value must be a valid Final Snapshot Identifier: first character must be a letter, got: 11-not-valid`,
-				),
-			},
-		},
-		"contains special character": {
-			val: types.StringValue("not-valid!-identifier"),
-			expectedDiagnostics: diag.Diagnostics{
-				diag.NewAttributeErrorDiagnostic(
-					path.Root("test"),
-					"Invalid Attribute Value",
-					`Attribute test value must be a valid Final Snapshot Identifier: must contain only alphanumeric characters and hyphens, got: not-valid!-identifier`,
-				),
-			},
-		},
-		"contains uppercase": {
-			val: types.StringValue("Valid-identifier"),
-		},
-		"contains consecutive hyphens": {
-			val: types.StringValue("invalid--identifier"),
-			expectedDiagnostics: diag.Diagnostics{
-				diag.NewAttributeErrorDiagnostic(
-					path.Root("test"),
-					"Invalid Attribute Value",
-					`Attribute test value must be a valid Final Snapshot Identifier: cannot contain two consecutive hyphens, got: invalid--identifier`,
-				),
-			},
-		},
-		"ends with hyphens": {
-			val: types.StringValue("invalid-identifier-"),
-			expectedDiagnostics: diag.Diagnostics{
-				diag.NewAttributeErrorDiagnostic(
-					path.Root("test"),
-					"Invalid Attribute Value",
-					`Attribute test value must be a valid Final Snapshot Identifier: cannot end with a hyphen, got: invalid-identifier-`,
-				),
-			},
-		},
-	}
-
-	for name, test := range tests {
-		name, test := name, test
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-
-			request := validator.StringRequest{
-				Path:           path.Root("test"),
-				PathExpression: path.MatchRoot("test"),
-				ConfigValue:    test.val,
-			}
-			response := validator.StringResponse{}
-			fwvalidators.ClusterFinalSnapshotIdentifier().ValidateString(context.Background(), request, &response)
-
-			if diff := cmp.Diff(response.Diagnostics, test.expectedDiagnostics); diff != "" {
-				t.Errorf("unexpected diagnostics difference: %s", diff)
-			}
-		})
-	}
-}
diff --git a/internal/framework/validators/ip.go b/internal/framework/validators/ip.go
index 138bc2b2b27..7cebf5ad562 100644
--- a/internal/framework/validators/ip.go
+++ b/internal/framework/validators/ip.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package validators
 
 import (
diff --git a/internal/framework/validators/ip_test.go b/internal/framework/validators/ip_test.go
index 573b388c252..a724ef7be23 100644
--- a/internal/framework/validators/ip_test.go
+++ b/internal/framework/validators/ip_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package validators_test
 
 import (
diff --git a/internal/framework/validators/timestamp.go b/internal/framework/validators/timestamp.go
deleted file mode 100644
index 7b3be4ddeac..00000000000
--- a/internal/framework/validators/timestamp.go
+++ /dev/null
@@ -1,99 +0,0 @@
-package validators
-
-import (
-	"context"
-
-	"github.com/hashicorp/terraform-plugin-framework-validators/helpers/validatordiag"
-	"github.com/hashicorp/terraform-plugin-framework/schema/validator"
-	"github.com/hashicorp/terraform-provider-aws/internal/types/timestamp"
-)
-
-type utcTimestampValidator struct{}
-
-func (validator utcTimestampValidator) Description(_ context.Context) string {
-	return "value must be a valid UTC Timestamp"
-}
-
-func (validator utcTimestampValidator) MarkdownDescription(ctx context.Context) string {
-	return validator.Description(ctx)
-}
-
-func (validator utcTimestampValidator) ValidateString(ctx context.Context, request validator.StringRequest, response *validator.StringResponse) {
-	if request.ConfigValue.IsNull() || request.ConfigValue.IsUnknown() {
-		return
-	}
-
-	t := timestamp.New(request.ConfigValue.ValueString())
-	if err := t.ValidateUTCFormat(); err != nil {
-		response.Diagnostics.Append(validatordiag.InvalidAttributeValueDiagnostic(
-			request.Path,
-			validator.Description(ctx),
-			request.ConfigValue.ValueString(),
-		))
-		return
-	}
-}
-
-func UTCTimestamp() validator.String {
-	return utcTimestampValidator{}
-}
-
-type onceADayWindowFormatValidator struct{}
-
-func (validator onceADayWindowFormatValidator) Description(_ context.Context) string {
-	return `value must satisfy the format of "hh24:mi-hh24:mi"`
-}
-
-func (validator onceADayWindowFormatValidator) MarkdownDescription(ctx context.Context) string {
-	return validator.Description(ctx)
-}
-
-func (validator onceADayWindowFormatValidator) ValidateString(ctx context.Context, request validator.StringRequest, response *validator.StringResponse) {
-	if request.ConfigValue.IsNull() || request.ConfigValue.IsUnknown() {
-		return
-	}
-
-	t := timestamp.New(request.ConfigValue.ValueString())
-	if err := t.ValidateOnceADayWindowFormat(); err != nil {
-		response.Diagnostics.Append(validatordiag.InvalidAttributeValueDiagnostic(
-			request.Path,
-			validator.Description(ctx),
-			request.ConfigValue.ValueString(),
-		))
-		return
-	}
-}
-
-func OnceADayWindowFormat() validator.String {
-	return onceADayWindowFormatValidator{}
-}
-
-type onceAWeekWindowFormatValidator struct{}
-
-func (validator onceAWeekWindowFormatValidator) Description(_ context.Context) string {
-	return `value must satisfy the format of "ddd:hh24:mi-ddd:hh24:mi"`
-}
-
-func (validator onceAWeekWindowFormatValidator) MarkdownDescription(ctx context.Context) string {
-	return validator.Description(ctx)
-}
-
-func (validator onceAWeekWindowFormatValidator) ValidateString(ctx context.Context, request validator.StringRequest, response *validator.StringResponse) {
-	if request.ConfigValue.IsNull() || request.ConfigValue.IsUnknown() {
-		return
-	}
-
-	t := timestamp.New(request.ConfigValue.ValueString())
-	if err := t.ValidateOnceAWeekWindowFormat(); err != nil {
-		response.Diagnostics.Append(validatordiag.InvalidAttributeValueDiagnostic(
-			request.Path,
-			validator.Description(ctx),
-			request.ConfigValue.ValueString(),
-		))
-		return
-	}
-}
-
-func OnceAWeekWindowFormat() validator.String {
-	return onceAWeekWindowFormatValidator{}
-}
diff --git a/internal/framework/validators/timestamp_test.go b/internal/framework/validators/timestamp_test.go
deleted file mode 100644
index ac92c05032b..00000000000
--- a/internal/framework/validators/timestamp_test.go
+++ /dev/null
@@ -1,165 +0,0 @@
-package validators_test
-
-import (
-	"context"
-	"testing"
-
-	"github.com/google/go-cmp/cmp"
-	"github.com/hashicorp/terraform-plugin-framework/diag"
-	"github.com/hashicorp/terraform-plugin-framework/path"
-	"github.com/hashicorp/terraform-plugin-framework/schema/validator"
-	"github.com/hashicorp/terraform-plugin-framework/types"
-	fwvalidators "github.com/hashicorp/terraform-provider-aws/internal/framework/validators"
-)
-
-func TestUTCTimestampValidator(t *testing.T) {
-	t.Parallel()
-
-	type testCase struct {
-		val                 types.String
-		expectedDiagnostics diag.Diagnostics
-	}
-
-	tests := map[string]testCase{
-		"unknown String": {
-			val: types.StringUnknown(),
-		},
-		"null String": {
-			val: types.StringNull(),
-		},
-		"valid timestamp": {
-			val: types.StringValue("2023-02-28T14:04:05Z"),
-		},
-		"invalid timestamp": {
-			val: types.StringValue("02 Jan 06 15:04 -0700"),
-			expectedDiagnostics: diag.Diagnostics{
-				diag.NewAttributeErrorDiagnostic(
-					path.Root("test"),
-					"Invalid Attribute Value",
-					`Attribute test value must be a valid UTC Timestamp, got: 02 Jan 06 15:04 -0700`,
-				),
-			},
-		},
-	}
-
-	for name, test := range tests {
-		name, test := name, test
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-
-			ctx := context.Background()
-
-			request := validator.StringRequest{
-				Path:           path.Root("test"),
-				PathExpression: path.MatchRoot("test"),
-				ConfigValue:    test.val,
-			}
-			response := validator.StringResponse{}
-			fwvalidators.UTCTimestamp().ValidateString(ctx, request, &response)
-
-			if diff := cmp.Diff(response.Diagnostics, test.expectedDiagnostics); diff != "" {
-				t.Errorf("unexpected diagnostics difference: %s", diff)
-			}
-		})
-	}
-}
-
-func TestOnceADayWindowFormatValidator(t *testing.T) {
-	t.Parallel()
-
-	type testCase struct {
-		val                 types.String
-		expectedDiagnostics diag.Diagnostics
-	}
-
-	tests := map[string]testCase{
-		"unknown String": {
-			val: types.StringUnknown(),
-		},
-		"null String": {
-			val: types.StringNull(),
-		},
-		"valid format": {
-			val: types.StringValue("04:00-05:00"),
-		},
-		"invalid format": {
-			val: types.StringValue("24:00-25:00"),
-			expectedDiagnostics: diag.Diagnostics{
-				diag.NewAttributeErrorDiagnostic(
-					path.Root("test"),
-					"Invalid Attribute Value",
-					`Attribute test value must satisfy the format of "hh24:mi-hh24:mi", got: 24:00-25:00`,
-				),
-			},
-		},
-	}
-
-	for name, test := range tests {
-		name, test := name, test
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-
-			request := validator.StringRequest{
-				Path:           path.Root("test"),
-				PathExpression: path.MatchRoot("test"),
-				ConfigValue:    test.val,
-			}
-			response := validator.StringResponse{}
-			fwvalidators.OnceADayWindowFormat().ValidateString(context.Background(), request, &response)
-
-			if diff := cmp.Diff(response.Diagnostics, test.expectedDiagnostics); diff != "" {
-				t.Errorf("unexpected diagnostics difference: %s", diff)
-			}
-		})
-	}
-}
-
-func TestOnceAWeekWindowFormatValidator(t *testing.T) {
-	t.Parallel()
-
-	type testCase struct {
-		val                 types.String
-		expectedDiagnostics diag.Diagnostics
-	}
-
-	tests := map[string]testCase{
-		"unknown String": {
-			val: types.StringUnknown(),
-		},
-		"null String": {
-			val: types.StringNull(),
-		},
-		"valid format": {
-			val: types.StringValue("sun:04:00-sun:05:00"),
-		},
-		"invalid format": {
-			val: types.StringValue("sun:04:00-sun:04:60"),
-			expectedDiagnostics: diag.Diagnostics{
-				diag.NewAttributeErrorDiagnostic(
-					path.Root("test"),
-					"Invalid Attribute Value",
-					`Attribute test value must satisfy the format of "ddd:hh24:mi-ddd:hh24:mi", got: sun:04:00-sun:04:60`,
-				),
-			},
-		},
-	}
-
-	for name, test := range tests {
-		name, test := name, test
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-
-			request := validator.StringRequest{
-				Path:           path.Root("test"),
-				PathExpression: path.MatchRoot("test"),
-				ConfigValue:    test.val,
-			}
-			response := validator.StringResponse{}
-			fwvalidators.OnceAWeekWindowFormat().ValidateString(context.Background(), request, &response)
-
-			if diff := cmp.Diff(response.Diagnostics, test.expectedDiagnostics); diff != "" {
-				t.Errorf("unexpected diagnostics difference: %s", diff)
-			}
-		})
-	}
-}
diff --git a/internal/generate/allowsubcats/generate.go b/internal/generate/allowsubcats/generate.go
index 8685829d7a6..c366a262d88 100644
--- a/internal/generate/allowsubcats/generate.go
+++ b/internal/generate/allowsubcats/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
 
diff --git a/internal/generate/allowsubcats/main.go b/internal/generate/allowsubcats/main.go
index cdae5bb1d81..07ed72688e4 100644
--- a/internal/generate/allowsubcats/main.go
+++ b/internal/generate/allowsubcats/main.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:build generate
 // +build generate
 
@@ -46,6 +49,10 @@ func main() {
 			continue
 		}
 
+		if l[names.ColNotImplemented] != "" {
+			continue
+		}
+
 		sd := ServiceDatum{
 			HumanFriendly: l[names.ColHumanFriendly],
 		}
diff --git a/internal/generate/awsclient/main.go b/internal/generate/awsclient/main.go
index 7b214285431..7090bc43c6c 100644
--- a/internal/generate/awsclient/main.go
+++ b/internal/generate/awsclient/main.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:build generate
 // +build generate
 
@@ -49,6 +52,10 @@ func main() {
 			continue
 		}
 
+		if l[names.ColNotImplemented] != "" {
+			continue
+		}
+
 		if l[names.ColProviderPackageActual] == "" && l[names.ColProviderPackageCorrect] == "" {
 			continue
 		}
diff --git a/internal/generate/checknames/generate.go b/internal/generate/checknames/generate.go
index cd1bb152773..d43e761010e 100644
--- a/internal/generate/checknames/generate.go
+++ b/internal/generate/checknames/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
 
diff --git a/internal/generate/checknames/main.go b/internal/generate/checknames/main.go
index d9ea6f472bb..a069eeff741 100644
--- a/internal/generate/checknames/main.go
+++ b/internal/generate/checknames/main.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:build generate
 // +build generate
 
diff --git a/internal/generate/common/args.go b/internal/generate/common/args.go
index dfc2f502b2e..72ea5434af2 100644
--- a/internal/generate/common/args.go
+++ b/internal/generate/common/args.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package common
 
 import (
diff --git a/internal/generate/common/args_test.go b/internal/generate/common/args_test.go
index 0f089575d9f..f0fa5bc4360 100644
--- a/internal/generate/common/args_test.go
+++ b/internal/generate/common/args_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package common
 
 import (
diff --git a/internal/generate/common/csvdata.go b/internal/generate/common/csvdata.go
index a71208c9ba5..2eef1b6b7e8 100644
--- a/internal/generate/common/csvdata.go
+++ b/internal/generate/common/csvdata.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package common
 
 import (
diff --git a/internal/generate/common/generator.go b/internal/generate/common/generator.go
index c054de367ea..2704cef7fac 100644
--- a/internal/generate/common/generator.go
+++ b/internal/generate/common/generator.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package common
 
 import (
diff --git a/internal/generate/customends/generate.go b/internal/generate/customends/generate.go
index fd7cfbaacdf..7ffaa3ecf92 100644
--- a/internal/generate/customends/generate.go
+++ b/internal/generate/customends/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
 
diff --git a/internal/generate/customends/main.go b/internal/generate/customends/main.go
index b24edb03ba5..651760ac95c 100644
--- a/internal/generate/customends/main.go
+++ b/internal/generate/customends/main.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:build generate
 // +build generate
 
@@ -29,7 +32,7 @@ type TemplateData struct {
 
 func main() {
 	const (
-		filename      = `../../../website/docs/guides/custom-service-endpoints.html.md`
+		filename      = `../../../website/docs/guides/custom-service-endpoints.html.markdown`
 		namesDataFile = "../../../names/names_data.csv"
 	)
 	g := common.NewGenerator()
@@ -53,6 +56,10 @@ func main() {
 			continue
 		}
 
+		if l[names.ColNotImplemented] != "" {
+			continue
+		}
+
 		if l[names.ColProviderPackageActual] == "" && l[names.ColProviderPackageCorrect] == "" {
 			continue
 		}
diff --git a/internal/generate/issuelabels/generate.go b/internal/generate/issuelabels/generate.go
index 45dfaa1466c..a280a1825d4 100644
--- a/internal/generate/issuelabels/generate.go
+++ b/internal/generate/issuelabels/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
 
diff --git a/internal/generate/issuelabels/main.go b/internal/generate/issuelabels/main.go
index 33e1950ac56..50b1f7ef258 100644
--- a/internal/generate/issuelabels/main.go
+++ b/internal/generate/issuelabels/main.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:build generate
 // +build generate
 
diff --git a/internal/generate/listpages/main.go b/internal/generate/listpages/main.go
index bd4c9d314ce..e7f5d49ce35 100644
--- a/internal/generate/listpages/main.go
+++ b/internal/generate/listpages/main.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:build generate
 // +build generate
 
diff --git a/internal/generate/namescapslist/generate.go b/internal/generate/namescapslist/generate.go
index ab2d50fb3cd..9159f740495 100644
--- a/internal/generate/namescapslist/generate.go
+++ b/internal/generate/namescapslist/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
 
diff --git a/internal/generate/namescapslist/main.go b/internal/generate/namescapslist/main.go
index dc740b2a2b8..780eba34e97 100644
--- a/internal/generate/namescapslist/main.go
+++ b/internal/generate/namescapslist/main.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:build generate
 // +build generate
 
diff --git a/internal/generate/namesconsts/main.go b/internal/generate/namesconsts/main.go
index f04075dd844..7021cf6861c 100644
--- a/internal/generate/namesconsts/main.go
+++ b/internal/generate/namesconsts/main.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:build generate
 // +build generate
 
@@ -46,6 +49,10 @@ func main() {
 			continue
 		}
 
+		if l[names.ColNotImplemented] != "" {
+			continue
+		}
+
 		if l[names.ColProviderPackageActual] == "" && l[names.ColProviderPackageCorrect] == "" {
 			continue
 		}
diff --git a/internal/generate/namevaluesfilters/ec2_filters.go b/internal/generate/namevaluesfilters/ec2_filters.go
index 290e2cbdbd1..5cbccf1bee0 100644
--- a/internal/generate/namevaluesfilters/ec2_filters.go
+++ b/internal/generate/namevaluesfilters/ec2_filters.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:build !generate
 // +build !generate
 
diff --git a/internal/generate/namevaluesfilters/ec2_filters_test.go b/internal/generate/namevaluesfilters/ec2_filters_test.go
index b8e8743ec5b..c272358b0c6 100644
--- a/internal/generate/namevaluesfilters/ec2_filters_test.go
+++ b/internal/generate/namevaluesfilters/ec2_filters_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package namevaluesfilters_test
 
 import (
diff --git a/internal/generate/namevaluesfilters/name_values_filters.go b/internal/generate/namevaluesfilters/name_values_filters.go
index d28b38dc0e2..76abcb4715e 100644
--- a/internal/generate/namevaluesfilters/name_values_filters.go
+++ b/internal/generate/namevaluesfilters/name_values_filters.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package namevaluesfilters
 
 import (
diff --git a/internal/generate/namevaluesfilters/name_values_filters_test.go b/internal/generate/namevaluesfilters/name_values_filters_test.go
index d5b300578bc..07a377e852b 100644
--- a/internal/generate/namevaluesfilters/name_values_filters_test.go
+++ b/internal/generate/namevaluesfilters/name_values_filters_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package namevaluesfilters_test
 
 import (
diff --git a/internal/generate/namevaluesfilters/service_generation_customizations.go b/internal/generate/namevaluesfilters/service_generation_customizations.go
index afab63d9847..0f57d9385e2 100644
--- a/internal/generate/namevaluesfilters/service_generation_customizations.go
+++ b/internal/generate/namevaluesfilters/service_generation_customizations.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 // This file contains code generation customizations for each AWS Go SDK service.
 
 package namevaluesfilters
diff --git a/internal/generate/prlabels/file.tmpl b/internal/generate/prlabels/file.tmpl
index b35c7a3f15a..dc6f554197b 100644
--- a/internal/generate/prlabels/file.tmpl
+++ b/internal/generate/prlabels/file.tmpl
@@ -26,7 +26,7 @@ linter:
   - '.github/workflows/acctest-terraform-lint.yml'
   - '.github/workflows/providerlint.yml'
   - '.github/workflows/semgrep-ci.yml'
-  - '.github/workflows/terraform_provider.yml'
+  - '.github/workflows/provider.yml'
   - '.github/workflows/website.yml'
   - '.github/workflows/workflow-lint.yml'
 pre-service-packages:
diff --git a/internal/generate/prlabels/generate.go b/internal/generate/prlabels/generate.go
index a31bb6ee17e..56cd7823b0a 100644
--- a/internal/generate/prlabels/generate.go
+++ b/internal/generate/prlabels/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
 
diff --git a/internal/generate/prlabels/main.go b/internal/generate/prlabels/main.go
index b3a9a505049..6f3fd55f3a7 100644
--- a/internal/generate/prlabels/main.go
+++ b/internal/generate/prlabels/main.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:build generate
 // +build generate
 
diff --git a/internal/generate/servicelabels/generate.go b/internal/generate/servicelabels/generate.go
index cd212f3dd91..09e6ab833d4 100644
--- a/internal/generate/servicelabels/generate.go
+++ b/internal/generate/servicelabels/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
 
diff --git a/internal/generate/servicelabels/main.go b/internal/generate/servicelabels/main.go
index 78b909caf66..981f75d475f 100644
--- a/internal/generate/servicelabels/main.go
+++ b/internal/generate/servicelabels/main.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:build generate
 // +build generate
 
diff --git a/internal/generate/servicepackage/file.tmpl b/internal/generate/servicepackage/file.tmpl
index 38a0d1c83f4..d02b90afeb6 100644
--- a/internal/generate/servicepackage/file.tmpl
+++ b/internal/generate/servicepackage/file.tmpl
@@ -16,6 +16,7 @@ import (
 	{{ .GoV2Package }}_sdkv2 "github.com/aws/aws-sdk-go-v2/service/{{ .GoV2Package }}"
 	{{- end }}
 {{- end }}
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 {{- if ne .ProviderPackage "meta" }}
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -143,11 +144,13 @@ func (p *servicePackage) NewClient(ctx context.Context, config map[string]any) (
 
 	return {{ .GoV2Package }}_sdkv2.NewFromConfig(cfg, func(o *{{ .GoV2Package }}_sdkv2.Options) {
 		if endpoint := config["endpoint"].(string); endpoint != "" {
-			o.EndpointResolver = {{ .GoV2Package }}_sdkv2.EndpointResolverFromURL(endpoint)
+			o.BaseEndpoint = aws_sdkv2.String(endpoint)
 		}
 	}), nil
 }
 	{{- end }}
 {{- end }}
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/generate/servicepackage/main.go b/internal/generate/servicepackage/main.go
index 98263d2ecef..df02714630e 100644
--- a/internal/generate/servicepackage/main.go
+++ b/internal/generate/servicepackage/main.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:build generate
 // +build generate
 
@@ -10,10 +13,10 @@ import (
 	"go/parser"
 	"go/token"
 	"os"
-	"regexp"
 	"sort"
 	"strings"
 
+	"github.com/YakDriver/regexache"
 	multierror "github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform-provider-aws/internal/generate/common"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -146,7 +149,7 @@ var tmpl string
 
 // Annotation processing.
 var (
-	annotation = regexp.MustCompile(`^//\s*@([a-zA-Z0-9]+)(\(([^)]*)\))?\s*$`)
+	annotation = regexache.MustCompile(`^//\s*@([0-9A-Za-z]+)(\(([^)]*)\))?\s*$`)
 )
 
 type visitor struct {
diff --git a/internal/generate/servicepackage/service_package_gen.go b/internal/generate/servicepackage/service_package_gen.go
new file mode 100644
index 00000000000..463e7ea61df
--- /dev/null
+++ b/internal/generate/servicepackage/service_package_gen.go
@@ -0,0 +1,47 @@
+// Code generated by internal/generate/servicepackages/main.go; DO NOT EDIT.
+
+package cognitoidentity
+
+import (
+	"context"
+
+	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
+	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
+	cognitoidentity_sdkv1 "github.com/aws/aws-sdk-go/service/cognitoidentity"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/types"
+	"github.com/hashicorp/terraform-provider-aws/names"
+)
+
+type servicePackage struct{}
+
+func (p *servicePackage) FrameworkDataSources(ctx context.Context) []*types.ServicePackageFrameworkDataSource {
+	return []*types.ServicePackageFrameworkDataSource{}
+}
+
+func (p *servicePackage) FrameworkResources(ctx context.Context) []*types.ServicePackageFrameworkResource {
+	return []*types.ServicePackageFrameworkResource{}
+}
+
+func (p *servicePackage) SDKDataSources(ctx context.Context) []*types.ServicePackageSDKDataSource {
+	return []*types.ServicePackageSDKDataSource{}
+}
+
+func (p *servicePackage) SDKResources(ctx context.Context) []*types.ServicePackageSDKResource {
+	return []*types.ServicePackageSDKResource{}
+}
+
+func (p *servicePackage) ServicePackageName() string {
+	return names.CognitoIdentity
+}
+
+// NewConn returns a new AWS SDK for Go v1 client for this service package's AWS API.
+func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*cognitoidentity_sdkv1.CognitoIdentity, error) {
+	sess := config["session"].(*session_sdkv1.Session)
+
+	return cognitoidentity_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
+}
+
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/generate/servicepackages/file.tmpl b/internal/generate/servicepackages/file.tmpl
index 4832fd02f3d..cc7f14aee80 100644
--- a/internal/generate/servicepackages/file.tmpl
+++ b/internal/generate/servicepackages/file.tmpl
@@ -12,10 +12,10 @@ import (
 	"golang.org/x/exp/slices"
 )
 
-func servicePackages(context.Context) []conns.ServicePackage {
+func servicePackages(ctx context.Context) []conns.ServicePackage {
 	v := []conns.ServicePackage{
 {{- range .Services }}
-		{{ .ProviderPackage }}.ServicePackage,
+		{{ .ProviderPackage }}.ServicePackage(ctx),
 {{- end }}
 }
 
diff --git a/internal/generate/servicepackages/main.go b/internal/generate/servicepackages/main.go
index df66f83287a..e5a61f98d6c 100644
--- a/internal/generate/servicepackages/main.go
+++ b/internal/generate/servicepackages/main.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:build generate
 // +build generate
 
@@ -5,6 +8,7 @@ package main
 
 import (
 	_ "embed"
+	"flag"
 	"fmt"
 	"os"
 	"sort"
@@ -15,9 +19,16 @@ import (
 
 func main() {
 	const (
-		filename      = `service_packages_gen.go`
 		namesDataFile = `../../names/names_data.csv`
 	)
+	filename := `service_packages_gen.go`
+
+	flag.Parse()
+	args := flag.Args()
+	if len(args) > 0 {
+		filename = args[0]
+	}
+
 	g := common.NewGenerator()
 
 	packageName := os.Getenv("GOPACKAGE")
diff --git a/internal/generate/servicesemgrep/configs.tmpl b/internal/generate/servicesemgrep/configs.tmpl
index 6aa39013090..821176b03bc 100644
--- a/internal/generate/servicesemgrep/configs.tmpl
+++ b/internal/generate/servicesemgrep/configs.tmpl
@@ -17,7 +17,7 @@ rules:
       - metavariable-pattern:
           metavariable: "$VALUE"
           patterns:
-            - pattern-not-regex: "testAcc[a-zA-Z0-9]+Config(_[a-zA-Z0-9_]+_|_)[a-z0-9].*"
+            - pattern-not-regex: "testAcc[0-9A-Za-z]+Config(_[0-9A-Za-z_]+_|_)[0-9a-z].*"
             - pattern-not: acctest.ConfigCompose(...)
             - pattern-not: "..."
     severity: WARNING
@@ -39,7 +39,7 @@ rules:
       - metavariable-pattern:
           metavariable: "$VALUE"
           patterns:
-            - pattern-not-regex: "testAcc[a-zA-Z0-9]+Config(_[a-zA-Z0-9_]+_|_)[a-z0-9].*"
+            - pattern-not-regex: "testAcc[0-9A-Za-z]+Config(_[0-9A-Za-z_]+_|_)[0-9a-z].*"
             - pattern-not-regex: "acctest\\..*"
     severity: WARNING
 
diff --git a/internal/generate/servicesemgrep/generate.go b/internal/generate/servicesemgrep/generate.go
index 069d8f7309f..4280fb002ed 100644
--- a/internal/generate/servicesemgrep/generate.go
+++ b/internal/generate/servicesemgrep/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
 
diff --git a/internal/generate/servicesemgrep/main.go b/internal/generate/servicesemgrep/main.go
index 724c733b76c..aee81ffcce6 100644
--- a/internal/generate/servicesemgrep/main.go
+++ b/internal/generate/servicesemgrep/main.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:build generate
 // +build generate
 
@@ -12,10 +15,10 @@ import (
 	"io"
 	"io/fs"
 	"os"
-	"regexp"
 	"sort"
 	"strings"
 
+	"github.com/YakDriver/regexache"
 	"github.com/hashicorp/terraform-provider-aws/internal/generate/common"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -276,7 +279,7 @@ func breakUpBigFile(g *common.Generator, filename, header string) error {
 	var cfile string
 	passedChunk := false
 
-	re := regexp.MustCompile(`^  - id: `)
+	re := regexache.MustCompile(`^  - id: `)
 
 	for scanner.Scan() {
 		if l%(lines/semgrepConfigChunks) == 0 {
diff --git a/internal/generate/sweeperregistration/file.tmpl b/internal/generate/sweeperregistration/file.tmpl
new file mode 100644
index 00000000000..26f2f0ffd86
--- /dev/null
+++ b/internal/generate/sweeperregistration/file.tmpl
@@ -0,0 +1,15 @@
+// Code generated by internal/generate/sweeperregistration/main.go; DO NOT EDIT.
+
+package {{ .PackageName }}
+
+import (
+{{ range .Services }}
+	"github.com/hashicorp/terraform-provider-aws/internal/service/{{ .ProviderPackage }}"
+{{- end }}
+)
+
+func registerSweepers() {
+{{- range .Services }}
+	{{ .ProviderPackage }}.RegisterSweepers()
+{{- end }}
+}
diff --git a/internal/generate/sweeperregistration/main.go b/internal/generate/sweeperregistration/main.go
new file mode 100644
index 00000000000..55c4710ca46
--- /dev/null
+++ b/internal/generate/sweeperregistration/main.go
@@ -0,0 +1,102 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+//go:build generate
+// +build generate
+
+package main
+
+import (
+	_ "embed"
+	"errors"
+	"fmt"
+	"io/fs"
+	"os"
+	"sort"
+
+	"github.com/hashicorp/terraform-provider-aws/internal/generate/common"
+	"github.com/hashicorp/terraform-provider-aws/names"
+)
+
+type ServiceDatum struct {
+	ProviderPackage string
+}
+
+type TemplateData struct {
+	PackageName string
+	Services    []ServiceDatum
+}
+
+func main() {
+	const (
+		filename      = `register_gen_test.go`
+		namesDataFile = "../../names/names_data.csv"
+	)
+	g := common.NewGenerator()
+
+	packageName := os.Getenv("GOPACKAGE")
+
+	g.Infof("Generating %s/%s", packageName, filename)
+
+	data, err := common.ReadAllCSVData(namesDataFile)
+
+	if err != nil {
+		g.Fatalf("error reading %s: %s", namesDataFile, err)
+	}
+
+	td := TemplateData{
+		PackageName: packageName,
+	}
+
+	for i, l := range data {
+		if i < 1 { // no header
+			continue
+		}
+
+		if l[names.ColExclude] != "" {
+			continue
+		}
+
+		if l[names.ColProviderPackageActual] == "" && l[names.ColProviderPackageCorrect] == "" {
+			continue
+		}
+
+		p := l[names.ColProviderPackageCorrect]
+
+		if l[names.ColProviderPackageActual] != "" {
+			p = l[names.ColProviderPackageActual]
+		}
+
+		if _, err := os.Stat(fmt.Sprintf("../service/%s", p)); err != nil || errors.Is(err, fs.ErrNotExist) {
+			continue
+		}
+
+		if _, err := os.Stat(fmt.Sprintf("../service/%s/sweep.go", p)); err != nil || errors.Is(err, fs.ErrNotExist) {
+			g.Infof("No sweepers for %q", p)
+			continue
+		}
+
+		s := ServiceDatum{
+			ProviderPackage: p,
+		}
+
+		td.Services = append(td.Services, s)
+	}
+
+	sort.SliceStable(td.Services, func(i, j int) bool {
+		return td.Services[i].ProviderPackage < td.Services[j].ProviderPackage
+	})
+
+	d := g.NewGoFileDestination(filename)
+
+	if err := d.WriteTemplate("sweeperregistration", tmpl, td); err != nil {
+		g.Fatalf("generating file (%s): %s", filename, err)
+	}
+
+	if err := d.Write(); err != nil {
+		g.Fatalf("generating file (%s): %s", filename, err)
+	}
+}
+
+//go:embed file.tmpl
+var tmpl string
diff --git a/internal/generate/sweepimp/file.tmpl b/internal/generate/sweepimp/file.tmpl
deleted file mode 100644
index be19e127abd..00000000000
--- a/internal/generate/sweepimp/file.tmpl
+++ /dev/null
@@ -1,16 +0,0 @@
-// Code generated by internal/generate/sweepimp/main.go; DO NOT EDIT.
-
-package sweep_test
-
-import (
-	"testing"
-
-	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
-{{- range .Services }}
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/{{ .ProviderPackage }}"
-{{- end }}
-)
-
-func TestMain(m *testing.M) {
-	resource.TestMain(m)
-}
\ No newline at end of file
diff --git a/internal/generate/sweepimp/generate.go b/internal/generate/sweepimp/generate.go
deleted file mode 100644
index c5711059425..00000000000
--- a/internal/generate/sweepimp/generate.go
+++ /dev/null
@@ -1,4 +0,0 @@
-//go:generate go run main.go
-// ONLY generate directives and package declaration! Do not add anything else to this file.
-
-package sweepimp
diff --git a/internal/generate/sweepimp/main.go b/internal/generate/sweepimp/main.go
deleted file mode 100644
index 9738afa341b..00000000000
--- a/internal/generate/sweepimp/main.go
+++ /dev/null
@@ -1,94 +0,0 @@
-//go:build generate
-// +build generate
-
-package main
-
-import (
-	_ "embed"
-	"errors"
-	"fmt"
-	"io/fs"
-	"os"
-	"sort"
-	"strings"
-
-	"github.com/hashicorp/terraform-provider-aws/internal/generate/common"
-	"github.com/hashicorp/terraform-provider-aws/names"
-)
-
-type ServiceDatum struct {
-	ProviderPackage string
-}
-
-type TemplateData struct {
-	Services []ServiceDatum
-}
-
-func main() {
-	const (
-		filename      = `../../sweep/sweep_test.go`
-		namesDataFile = "../../../names/names_data.csv"
-	)
-	g := common.NewGenerator()
-
-	g.Infof("Generating %s", strings.TrimPrefix(filename, "../../"))
-
-	data, err := common.ReadAllCSVData(namesDataFile)
-
-	if err != nil {
-		g.Fatalf("error reading %s: %s", namesDataFile, err)
-	}
-
-	td := TemplateData{}
-
-	for i, l := range data {
-		if i < 1 { // no header
-			continue
-		}
-
-		if l[names.ColExclude] != "" {
-			continue
-		}
-
-		if l[names.ColProviderPackageActual] == "" && l[names.ColProviderPackageCorrect] == "" {
-			continue
-		}
-
-		p := l[names.ColProviderPackageCorrect]
-
-		if l[names.ColProviderPackageActual] != "" {
-			p = l[names.ColProviderPackageActual]
-		}
-
-		if _, err := os.Stat(fmt.Sprintf("../../service/%s", p)); err != nil || errors.Is(err, fs.ErrNotExist) {
-			continue
-		}
-
-		if _, err := os.Stat(fmt.Sprintf("../../service/%s/sweep.go", p)); err != nil || errors.Is(err, fs.ErrNotExist) {
-			continue
-		}
-
-		s := ServiceDatum{
-			ProviderPackage: p,
-		}
-
-		td.Services = append(td.Services, s)
-	}
-
-	sort.SliceStable(td.Services, func(i, j int) bool {
-		return td.Services[i].ProviderPackage < td.Services[j].ProviderPackage
-	})
-
-	d := g.NewGoFileDestination(filename)
-
-	if err := d.WriteTemplate("sweepimport", tmpl, td); err != nil {
-		g.Fatalf("generating file (%s): %s", filename, err)
-	}
-
-	if err := d.Write(); err != nil {
-		g.Fatalf("generating file (%s): %s", filename, err)
-	}
-}
-
-//go:embed file.tmpl
-var tmpl string
diff --git a/internal/generate/tagresource/main.go b/internal/generate/tagresource/main.go
index d3834f6c579..2868ef43814 100644
--- a/internal/generate/tagresource/main.go
+++ b/internal/generate/tagresource/main.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:build generate
 // +build generate
 
diff --git a/internal/generate/tags/README.md b/internal/generate/tags/README.md
index 2f70b22a549..e8c8e84093d 100644
--- a/internal/generate/tags/README.md
+++ b/internal/generate/tags/README.md
@@ -36,6 +36,7 @@ Some flags control generation a certain section of code, such as whether the gen
 | `TagInCustomVal` |  | Tag input custom value | `-TagInCustomVal=aws.StringMap(updatedTags.IgnoreAWS().Map())` |
 | `TagInIDElem` | `ResourceArn` | Tag input identifier element | `-TagInIDElem=ResourceARN` |
 | `TagInIDNeedSlice` |  | Tag input identifier needs a slice | `-TagInIDNeedSlice=yes` |
+| `TagInIDNeedValueSlice` |  | Tag input identifier needs a slice of values, rather than a slice of pointers | `-TagInIDNeedValueSlice=yes` |
 | `TagInTagsElem` | Tags | Tag input tags element | `-TagInTagsElem=TagsList` |
 | `TagKeyType` |  | Tag key type | `-TagKeyType=TagKeyOnly` |
 | `TagOp` | `TagResource` | Tag operation | `-TagOp=AddTags` |
diff --git a/internal/generate/tags/main.go b/internal/generate/tags/main.go
index 8503ca8bcf2..108c1bbeb15 100644
--- a/internal/generate/tags/main.go
+++ b/internal/generate/tags/main.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:build generate
 // +build generate
 
@@ -7,9 +10,10 @@ import (
 	"flag"
 	"fmt"
 	"os"
-	"regexp"
 	"strings"
+	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/hashicorp/terraform-provider-aws/internal/generate/common"
 	v1 "github.com/hashicorp/terraform-provider-aws/internal/generate/tags/templates/v1"
 	v2 "github.com/hashicorp/terraform-provider-aws/internal/generate/tags/templates/v2"
@@ -22,8 +26,9 @@ const (
 )
 
 const (
-	defaultListTagsFunc   = "listTags"
-	defaultUpdateTagsFunc = "updateTags"
+	defaultListTagsFunc           = "listTags"
+	defaultUpdateTagsFunc         = "updateTags"
+	defaultWaitTagsPropagatedFunc = "waitTagsPropagated"
 )
 
 var (
@@ -35,42 +40,57 @@ var (
 	untagInNeedTagType       = flag.Bool("UntagInNeedTagType", false, "whether Untag input needs tag type")
 	updateTags               = flag.Bool("UpdateTags", false, "whether to generate UpdateTags")
 	updateTagsNoIgnoreSystem = flag.Bool("UpdateTagsNoIgnoreSystem", false, "whether to not ignore system tags in UpdateTags")
-
-	createTagsFunc        = flag.String("CreateTagsFunc", "createTags", "createTagsFunc")
-	getTagFunc            = flag.String("GetTagFunc", "GetTag", "getTagFunc")
-	listTagsFunc          = flag.String("ListTagsFunc", defaultListTagsFunc, "listTagsFunc")
-	listTagsInFiltIDName  = flag.String("ListTagsInFiltIDName", "", "listTagsInFiltIDName")
-	listTagsInIDElem      = flag.String("ListTagsInIDElem", "ResourceArn", "listTagsInIDElem")
-	listTagsInIDNeedSlice = flag.String("ListTagsInIDNeedSlice", "", "listTagsInIDNeedSlice")
-	listTagsOp            = flag.String("ListTagsOp", "ListTagsForResource", "listTagsOp")
-	listTagsOutTagsElem   = flag.String("ListTagsOutTagsElem", "Tags", "listTagsOutTagsElem")
-	tagInCustomVal        = flag.String("TagInCustomVal", "", "tagInCustomVal")
-	tagInIDElem           = flag.String("TagInIDElem", "ResourceArn", "tagInIDElem")
-	tagInIDNeedSlice      = flag.String("TagInIDNeedSlice", "", "tagInIDNeedSlice")
-	tagInTagsElem         = flag.String("TagInTagsElem", "Tags", "tagInTagsElem")
-	tagKeyType            = flag.String("TagKeyType", "", "tagKeyType")
-	tagOp                 = flag.String("TagOp", "TagResource", "tagOp")
-	tagOpBatchSize        = flag.String("TagOpBatchSize", "", "tagOpBatchSize")
-	tagResTypeElem        = flag.String("TagResTypeElem", "", "tagResTypeElem")
-	tagType               = flag.String("TagType", "Tag", "tagType")
-	tagType2              = flag.String("TagType2", "", "tagType")
-	tagTypeAddBoolElem    = flag.String("TagTypeAddBoolElem", "", "TagTypeAddBoolElem")
-	tagTypeIDElem         = flag.String("TagTypeIDElem", "", "tagTypeIDElem")
-	tagTypeKeyElem        = flag.String("TagTypeKeyElem", "Key", "tagTypeKeyElem")
-	tagTypeValElem        = flag.String("TagTypeValElem", "Value", "tagTypeValElem")
-	untagInCustomVal      = flag.String("UntagInCustomVal", "", "untagInCustomVal")
-	untagInNeedTagKeyType = flag.String("UntagInNeedTagKeyType", "", "untagInNeedTagKeyType")
-	untagInTagsElem       = flag.String("UntagInTagsElem", "TagKeys", "untagInTagsElem")
-	untagOp               = flag.String("UntagOp", "UntagResource", "untagOp")
-	updateTagsFunc        = flag.String("UpdateTagsFunc", defaultUpdateTagsFunc, "updateTagsFunc")
+	waitForPropagation       = flag.Bool("Wait", false, "whether to generate WaitTagsPropagated")
+
+	createTagsFunc          = flag.String("CreateTagsFunc", "createTags", "createTagsFunc")
+	getTagFunc              = flag.String("GetTagFunc", "GetTag", "getTagFunc")
+	getTagsInFunc           = flag.String("GetTagsInFunc", "getTagsIn", "getTagsInFunc")
+	keyValueTagsFunc        = flag.String("KeyValueTagsFunc", "KeyValueTags", "keyValueTagsFunc")
+	listTagsFunc            = flag.String("ListTagsFunc", defaultListTagsFunc, "listTagsFunc")
+	listTagsInFiltIDName    = flag.String("ListTagsInFiltIDName", "", "listTagsInFiltIDName")
+	listTagsInIDElem        = flag.String("ListTagsInIDElem", "ResourceArn", "listTagsInIDElem")
+	listTagsInIDNeedSlice   = flag.String("ListTagsInIDNeedSlice", "", "listTagsInIDNeedSlice")
+	listTagsOp              = flag.String("ListTagsOp", "ListTagsForResource", "listTagsOp")
+	listTagsOpPaginated     = flag.Bool("ListTagsOpPaginated", false, "whether ListTagsOp is paginated")
+	listTagsOutTagsElem     = flag.String("ListTagsOutTagsElem", "Tags", "listTagsOutTagsElem")
+	setTagsOutFunc          = flag.String("SetTagsOutFunc", "setTagsOut", "setTagsOutFunc")
+	tagInCustomVal          = flag.String("TagInCustomVal", "", "tagInCustomVal")
+	tagInIDElem             = flag.String("TagInIDElem", "ResourceArn", "tagInIDElem")
+	tagInIDNeedSlice        = flag.String("TagInIDNeedSlice", "", "tagInIDNeedSlice")
+	tagInIDNeedValueSlice   = flag.String("TagInIDNeedValueSlice", "", "tagInIDNeedValueSlice")
+	tagInTagsElem           = flag.String("TagInTagsElem", "Tags", "tagInTagsElem")
+	tagKeyType              = flag.String("TagKeyType", "", "tagKeyType")
+	tagOp                   = flag.String("TagOp", "TagResource", "tagOp")
+	tagOpBatchSize          = flag.String("TagOpBatchSize", "", "tagOpBatchSize")
+	tagResTypeElem          = flag.String("TagResTypeElem", "", "tagResTypeElem")
+	tagType                 = flag.String("TagType", "Tag", "tagType")
+	tagType2                = flag.String("TagType2", "", "tagType")
+	tagTypeAddBoolElem      = flag.String("TagTypeAddBoolElem", "", "TagTypeAddBoolElem")
+	tagTypeIDElem           = flag.String("TagTypeIDElem", "", "tagTypeIDElem")
+	tagTypeKeyElem          = flag.String("TagTypeKeyElem", "Key", "tagTypeKeyElem")
+	tagTypeValElem          = flag.String("TagTypeValElem", "Value", "tagTypeValElem")
+	tagsFunc                = flag.String("TagsFunc", "Tags", "tagsFunc")
+	untagInCustomVal        = flag.String("UntagInCustomVal", "", "untagInCustomVal")
+	untagInNeedTagKeyType   = flag.String("UntagInNeedTagKeyType", "", "untagInNeedTagKeyType")
+	untagInTagsElem         = flag.String("UntagInTagsElem", "TagKeys", "untagInTagsElem")
+	untagOp                 = flag.String("UntagOp", "UntagResource", "untagOp")
+	updateTagsFunc          = flag.String("UpdateTagsFunc", defaultUpdateTagsFunc, "updateTagsFunc")
+	waitTagsPropagatedFunc  = flag.String("WaitFunc", defaultWaitTagsPropagatedFunc, "waitFunc")
+	waitContinuousOccurence = flag.Int("WaitContinuousOccurence", 0, "ContinuousTargetOccurence for Wait function")
+	waitDelay               = flag.Duration("WaitDelay", 0, "Delay for Wait function")
+	waitMinTimeout          = flag.Duration("WaitMinTimeout", 0, `"MinTimeout" (minimum poll interval) for Wait function`)
+	waitPollInterval        = flag.Duration("WaitPollInterval", 0, "PollInterval for Wait function")
+	waitTimeout             = flag.Duration("WaitTimeout", 0, "Timeout for Wait function")
 
 	parentNotFoundErrCode = flag.String("ParentNotFoundErrCode", "", "Parent 'NotFound' Error Code")
 	parentNotFoundErrMsg  = flag.String("ParentNotFoundErrMsg", "", "Parent 'NotFound' Error Message")
 
 	sdkServicePackage = flag.String("AWSSDKServicePackage", "", "AWS Go SDK package to use. Defaults to the provider service package name.")
-	sdkVersion        = flag.Int("AWSSDKVersion", sdkV1, "Version of the AWS SDK Go to use i.e. 1 or 2")
+	sdkVersion        = flag.Int("AWSSDKVersion", sdkV1, "Version of the AWS Go SDK to use i.e. 1 or 2")
 	kvtValues         = flag.Bool("KVTValues", false, "Whether KVT string map is of string pointers")
+	skipAWSImp        = flag.Bool("SkipAWSImp", false, "Whether to skip importing the AWS Go SDK aws package") // nosemgrep:ci.aws-in-var-name
 	skipNamesImp      = flag.Bool("SkipNamesImp", false, "Whether to skip importing names")
+	skipServiceImp    = flag.Bool("SkipAWSServiceImp", false, "Whether to skip importing the AWS service package")
 	skipTypesImp      = flag.Bool("SkipTypesImp", false, "Whether to skip importing types")
 )
 
@@ -82,12 +102,13 @@ func usage() {
 }
 
 type TemplateBody struct {
-	getTag           string
-	header           string
-	listTags         string
-	serviceTagsMap   string
-	serviceTagsSlice string
-	updateTags       string
+	getTag             string
+	header             string
+	listTags           string
+	serviceTagsMap     string
+	serviceTagsSlice   string
+	updateTags         string
+	waitTagsPropagated string
 }
 
 func newTemplateBody(version int, kvtValues bool) *TemplateBody {
@@ -100,6 +121,7 @@ func newTemplateBody(version int, kvtValues bool) *TemplateBody {
 			"\n" + v1.ServiceTagsMapBody,
 			"\n" + v1.ServiceTagsSliceBody,
 			"\n" + v1.UpdateTagsBody,
+			"\n" + v1.WaitTagsPropagatedBody,
 		}
 	case sdkV2:
 		if kvtValues {
@@ -110,6 +132,7 @@ func newTemplateBody(version int, kvtValues bool) *TemplateBody {
 				"\n" + v2.ServiceTagsValueMapBody,
 				"\n" + v2.ServiceTagsSliceBody,
 				"\n" + v2.UpdateTagsBody,
+				"\n" + v2.WaitTagsPropagatedBody,
 			}
 		}
 		return &TemplateBody{
@@ -119,6 +142,7 @@ func newTemplateBody(version int, kvtValues bool) *TemplateBody {
 			"\n" + v2.ServiceTagsMapBody,
 			"\n" + v2.ServiceTagsSliceBody,
 			"\n" + v2.UpdateTagsBody,
+			"\n" + v2.WaitTagsPropagatedBody,
 		}
 	default:
 		return nil
@@ -134,18 +158,23 @@ type TemplateData struct {
 
 	CreateTagsFunc          string
 	GetTagFunc              string
+	GetTagsInFunc           string
+	KeyValueTagsFunc        string
 	ListTagsFunc            string
 	ListTagsInFiltIDName    string
 	ListTagsInIDElem        string
 	ListTagsInIDNeedSlice   string
 	ListTagsOp              string
+	ListTagsOpPaginated     bool
 	ListTagsOutTagsElem     string
 	ParentNotFoundErrCode   string
 	ParentNotFoundErrMsg    string
 	RetryCreateOnNotFound   string
+	SetTagsOutFunc          string
 	TagInCustomVal          string
 	TagInIDElem             string
 	TagInIDNeedSlice        string
+	TagInIDNeedValueSlice   string
 	TagInTagsElem           string
 	TagKeyType              string
 	TagOp                   string
@@ -159,6 +188,7 @@ type TemplateData struct {
 	TagTypeIDElem           string
 	TagTypeKeyElem          string
 	TagTypeValElem          string
+	TagsFunc                string
 	UntagInCustomVal        string
 	UntagInNeedTagKeyType   string
 	UntagInNeedTagType      bool
@@ -166,6 +196,13 @@ type TemplateData struct {
 	UntagOp                 string
 	UpdateTagsFunc          string
 	UpdateTagsIgnoreSystem  bool
+	WaitForPropagation      bool
+	WaitTagsPropagatedFunc  string
+	WaitContinuousOccurence int
+	WaitDelay               string
+	WaitMinTimeout          string
+	WaitPollInterval        string
+	WaitTimeout             string
 
 	// The following are specific to writing import paths in the `headerBody`;
 	// to include the package, set the corresponding field's value to true
@@ -173,9 +210,14 @@ type TemplateData struct {
 	FmtPkg           bool
 	HelperSchemaPkg  bool
 	InternalTypesPkg bool
+	LoggingPkg       bool
 	NamesPkg         bool
+	SkipAWSImp       bool
+	SkipServiceImp   bool
 	SkipTypesImp     bool
+	TfLogPkg         bool
 	TfResourcePkg    bool
+	TimePkg          bool
 
 	IsDefaultListTags   bool
 	IsDefaultUpdateTags bool
@@ -260,23 +302,33 @@ func main() {
 		FmtPkg:           *updateTags,
 		HelperSchemaPkg:  awsPkg == "autoscaling",
 		InternalTypesPkg: (*listTags && *listTagsFunc == defaultListTagsFunc) || *serviceTagsMap || *serviceTagsSlice,
+		LoggingPkg:       *updateTags,
 		NamesPkg:         *updateTags && !*skipNamesImp,
+		SkipAWSImp:       *skipAWSImp,
+		SkipServiceImp:   *skipServiceImp,
 		SkipTypesImp:     *skipTypesImp,
-		TfResourcePkg:    *getTag,
+		TfLogPkg:         *updateTags,
+		TfResourcePkg:    (*getTag || *waitForPropagation),
+		TimePkg:          *waitForPropagation,
 
 		CreateTagsFunc:          createTagsFunc,
 		GetTagFunc:              *getTagFunc,
+		GetTagsInFunc:           *getTagsInFunc,
+		KeyValueTagsFunc:        *keyValueTagsFunc,
 		ListTagsFunc:            *listTagsFunc,
 		ListTagsInFiltIDName:    *listTagsInFiltIDName,
 		ListTagsInIDElem:        *listTagsInIDElem,
 		ListTagsInIDNeedSlice:   *listTagsInIDNeedSlice,
 		ListTagsOp:              *listTagsOp,
+		ListTagsOpPaginated:     *listTagsOpPaginated,
 		ListTagsOutTagsElem:     *listTagsOutTagsElem,
 		ParentNotFoundErrCode:   *parentNotFoundErrCode,
 		ParentNotFoundErrMsg:    *parentNotFoundErrMsg,
+		SetTagsOutFunc:          *setTagsOutFunc,
 		TagInCustomVal:          *tagInCustomVal,
 		TagInIDElem:             *tagInIDElem,
 		TagInIDNeedSlice:        *tagInIDNeedSlice,
+		TagInIDNeedValueSlice:   *tagInIDNeedValueSlice,
 		TagInTagsElem:           *tagInTagsElem,
 		TagKeyType:              *tagKeyType,
 		TagOp:                   *tagOp,
@@ -290,6 +342,7 @@ func main() {
 		TagTypeIDElem:           *tagTypeIDElem,
 		TagTypeKeyElem:          *tagTypeKeyElem,
 		TagTypeValElem:          *tagTypeValElem,
+		TagsFunc:                *tagsFunc,
 		UntagInCustomVal:        *untagInCustomVal,
 		UntagInNeedTagKeyType:   *untagInNeedTagKeyType,
 		UntagInNeedTagType:      *untagInNeedTagType,
@@ -297,6 +350,13 @@ func main() {
 		UntagOp:                 *untagOp,
 		UpdateTagsFunc:          *updateTagsFunc,
 		UpdateTagsIgnoreSystem:  !*updateTagsNoIgnoreSystem,
+		WaitForPropagation:      *waitForPropagation,
+		WaitTagsPropagatedFunc:  *waitTagsPropagatedFunc,
+		WaitContinuousOccurence: *waitContinuousOccurence,
+		WaitDelay:               formatDuration(*waitDelay),
+		WaitMinTimeout:          formatDuration(*waitMinTimeout),
+		WaitPollInterval:        formatDuration(*waitPollInterval),
+		WaitTimeout:             formatDuration(*waitTimeout),
 
 		IsDefaultListTags:   *listTagsFunc == defaultListTagsFunc,
 		IsDefaultUpdateTags: *updateTagsFunc == defaultUpdateTagsFunc,
@@ -348,13 +408,45 @@ func main() {
 		}
 	}
 
+	if *waitForPropagation {
+		if err := d.WriteTemplate("waittagspropagated", templateBody.waitTagsPropagated, templateData); err != nil {
+			g.Fatalf("generating file (%s): %s", filename, err)
+		}
+	}
+
 	if err := d.Write(); err != nil {
 		g.Fatalf("generating file (%s): %s", filename, err)
 	}
 }
 
 func toSnakeCase(str string) string {
-	result := regexp.MustCompile("(.)([A-Z][a-z]+)").ReplaceAllString(str, "${1}_${2}")
-	result = regexp.MustCompile("([a-z0-9])([A-Z])").ReplaceAllString(result, "${1}_${2}")
+	result := regexache.MustCompile("(.)([A-Z][a-z]+)").ReplaceAllString(str, "${1}_${2}")
+	result = regexache.MustCompile("([0-9a-z])([A-Z])").ReplaceAllString(result, "${1}_${2}")
 	return strings.ToLower(result)
 }
+
+func formatDuration(d time.Duration) string {
+	if d == 0 {
+		return ""
+	}
+
+	var buf []string
+	if h := d.Hours(); h >= 1 {
+		buf = append(buf, fmt.Sprintf("%d * time.Hour", int64(h)))
+		d = d - time.Duration(int64(h)*int64(time.Hour))
+	}
+	if m := d.Minutes(); m >= 1 {
+		buf = append(buf, fmt.Sprintf("%d * time.Minute", int64(m)))
+		d = d - time.Duration(int64(m)*int64(time.Minute))
+	}
+	if s := d.Seconds(); s >= 1 {
+		buf = append(buf, fmt.Sprintf("%d * time.Second", int64(s)))
+		d = d - time.Duration(int64(s)*int64(time.Second))
+	}
+	if ms := d.Milliseconds(); ms >= 1 {
+		buf = append(buf, fmt.Sprintf("%d * time.Millisecond", int64(ms)))
+	}
+	// Ignoring anything below milliseconds
+
+	return strings.Join(buf, " + ")
+}
diff --git a/internal/generate/tags/templates/v1/get_tag_body.tmpl b/internal/generate/tags/templates/v1/get_tag_body.tmpl
index 1d23c9f4249..f7dc90fe26a 100644
--- a/internal/generate/tags/templates/v1/get_tag_body.tmpl
+++ b/internal/generate/tags/templates/v1/get_tag_body.tmpl
@@ -29,7 +29,7 @@ func {{ .GetTagFunc }}(ctx context.Context, conn {{ .ClientType }}, identifier{{
 		return nil, err
 	}
 
-	listTags := KeyValueTags(ctx, output.{{ .ListTagsOutTagsElem }}{{ if .TagTypeIDElem }}, identifier{{ if .TagResTypeElem }}, resourceType{{ end }}{{ end }})
+	listTags := {{ .KeyValueTagsFunc }}(ctx, output.{{ .ListTagsOutTagsElem }}{{ if .TagTypeIDElem }}, identifier{{ if .TagResTypeElem }}, resourceType{{ end }}{{ end }})
 	{{- else }}
 	listTags, err := {{ .ListTagsFunc }}(ctx, conn, identifier{{ if .TagResTypeElem }}, resourceType{{ end }})
 
diff --git a/internal/generate/tags/templates/v1/header_body.tmpl b/internal/generate/tags/templates/v1/header_body.tmpl
index 96235cae303..6043ab408ce 100644
--- a/internal/generate/tags/templates/v1/header_body.tmpl
+++ b/internal/generate/tags/templates/v1/header_body.tmpl
@@ -6,11 +6,18 @@ import (
 	{{- if .FmtPkg }}
 	"fmt"
 	{{- end }}
+	{{- if .TimePkg }}
+	"time"
+	{{- end }}
 
+	{{ if not .SkipAWSImp }}
 	"github.com/aws/aws-sdk-go/aws"
+	{{- end }}
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	{{- if .AWSService }}
+		{{- if not .SkipServiceImp }}
 	"github.com/aws/aws-sdk-go/service/{{ .AWSService }}"
+		{{- end }}
 	{{- end }}
 	{{- if .AWSServiceIfacePackage }}
 	"github.com/aws/aws-sdk-go/service/{{ .AWSServiceIfacePackage }}"
@@ -24,10 +31,16 @@ import (
 	{{- if .ParentNotFoundErrCode }}
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
+	{{- end }}
+	{{- if .TfLogPkg }}
+    "github.com/hashicorp/terraform-plugin-log/tflog"
 	{{- end }}
 	{{- if .ConnsPkg }}
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	{{- end }}
+	{{- if .LoggingPkg }}
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
+	{{- end }}
 	{{- if .TfResourcePkg }}
     "github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	{{- end }}
diff --git a/internal/generate/tags/templates/v1/list_tags_body.tmpl b/internal/generate/tags/templates/v1/list_tags_body.tmpl
index 036e087465d..33aa392f4e8 100644
--- a/internal/generate/tags/templates/v1/list_tags_body.tmpl
+++ b/internal/generate/tags/templates/v1/list_tags_body.tmpl
@@ -21,8 +21,26 @@ func {{ .ListTagsFunc }}(ctx context.Context, conn {{ .ClientType }}, identifier
 		{{- end }}
 		{{- end }}
 	}
+{{- if .ListTagsOpPaginated }}
+	var output []*{{ .TagPackage }}.{{ .TagType }}
+
+	err := conn.{{ .ListTagsOp }}PagesWithContext(ctx, input, func(page *{{ .TagPackage  }}.{{ .ListTagsOp }}Output, lastPage bool) bool {
+		if page == nil {
+			return !lastPage
+		}
+
+		for _, v := range page.{{ .ListTagsOutTagsElem }} {
+			if v != nil {
+				output = append(output, v)
+			}
+		}
+
+		return !lastPage
+	})
+{{ else }}
 
 	output, err := conn.{{ .ListTagsOp }}WithContext(ctx, input)
+{{- end }}
 
 	{{ if and ( .ParentNotFoundErrCode ) ( .ParentNotFoundErrMsg ) }}
 			if tfawserr.ErrMessageContains(err, "{{ .ParentNotFoundErrCode }}", "{{ .ParentNotFoundErrMsg }}") {
@@ -44,7 +62,11 @@ func {{ .ListTagsFunc }}(ctx context.Context, conn {{ .ClientType }}, identifier
 		return tftags.New(ctx, nil), err
 	}
 
-	return KeyValueTags(ctx, output.{{ .ListTagsOutTagsElem }}{{ if .TagTypeIDElem }}, identifier{{ if .TagResTypeElem }}, resourceType{{ end }}{{ end }}), nil
+{{ if .ListTagsOpPaginated }}
+	return {{ .KeyValueTagsFunc }}(ctx, output{{ if .TagTypeIDElem }}, identifier{{ if .TagResTypeElem }}, resourceType{{ end }}{{ end }}), nil
+{{- else }}
+	return {{ .KeyValueTagsFunc }}(ctx, output.{{ .ListTagsOutTagsElem }}{{ if .TagTypeIDElem }}, identifier{{ if .TagResTypeElem }}, resourceType{{ end }}{{ end }}), nil
+{{- end }}
 }
 
 {{- if .IsDefaultListTags }}
diff --git a/internal/generate/tags/templates/v1/service_tags_map_body.tmpl b/internal/generate/tags/templates/v1/service_tags_map_body.tmpl
index a1fd1f0d988..8f72a4d3f09 100644
--- a/internal/generate/tags/templates/v1/service_tags_map_body.tmpl
+++ b/internal/generate/tags/templates/v1/service_tags_map_body.tmpl
@@ -1,20 +1,20 @@
 // map[string]*string handling
 
-// Tags returns {{ .ServicePackage }} service tags.
-func Tags(tags tftags.KeyValueTags) map[string]*string {
+// {{ .TagsFunc }} returns {{ .ServicePackage }} service tags.
+func {{ .TagsFunc }}(tags tftags.KeyValueTags) map[string]*string {
 	return aws.StringMap(tags.Map())
 }
 
-// KeyValueTags creates KeyValueTags from {{ .ServicePackage }} service tags.
-func KeyValueTags(ctx context.Context, tags map[string]*string) tftags.KeyValueTags {
+// {{ .KeyValueTagsFunc }} creates tftags.KeyValueTags from {{ .ServicePackage }} service tags.
+func {{ .KeyValueTagsFunc }}(ctx context.Context, tags map[string]*string) tftags.KeyValueTags {
 	return tftags.New(ctx, tags)
 }
 
-// getTagsIn returns {{ .ServicePackage }} service tags from Context.
+// {{ .GetTagsInFunc }} returns {{ .ServicePackage }} service tags from Context.
 // nil is returned if there are no input tags.
-func getTagsIn(ctx context.Context) map[string]*string {
+func {{ .GetTagsInFunc }}(ctx context.Context) map[string]*string {
 	if inContext, ok := tftags.FromContext(ctx); ok {
-		if tags := Tags(inContext.TagsIn.UnwrapOrDefault()); len(tags) > 0 {
+		if tags := {{ .TagsFunc }}(inContext.TagsIn.UnwrapOrDefault()); len(tags) > 0 {
 			return tags
 		}
 	}
@@ -22,10 +22,10 @@ func getTagsIn(ctx context.Context) map[string]*string {
 	return nil
 }
 
-// setTagsOut sets {{ .ServicePackage }} service tags in Context.
-func setTagsOut(ctx context.Context, tags map[string]*string) {
+// {{ .SetTagsOutFunc }} sets {{ .ServicePackage }} service tags in Context.
+func {{ .SetTagsOutFunc }}(ctx context.Context, tags map[string]*string) {
 	if inContext, ok := tftags.FromContext(ctx); ok {
-		inContext.TagsOut = types.Some(KeyValueTags(ctx, tags))
+		inContext.TagsOut = types.Some({{ .KeyValueTagsFunc }}(ctx, tags))
 	}
 }
 
diff --git a/internal/generate/tags/templates/v1/service_tags_slice_body.tmpl b/internal/generate/tags/templates/v1/service_tags_slice_body.tmpl
index 7964157d03c..4f46528a0f3 100644
--- a/internal/generate/tags/templates/v1/service_tags_slice_body.tmpl
+++ b/internal/generate/tags/templates/v1/service_tags_slice_body.tmpl
@@ -44,8 +44,8 @@ func TagKeys(tags tftags.KeyValueTags) []*{{ .TagPackage }}.{{ .TagKeyType }} {
 }
 {{- end }}
 
-// Tags returns {{ .ServicePackage }} service tags.
-func Tags(tags tftags.KeyValueTags) []*{{ .TagPackage }}.{{ .TagType }} {
+// {{ .TagsFunc }} returns {{ .ServicePackage }} service tags.
+func {{ .TagsFunc }}(tags tftags.KeyValueTags) []*{{ .TagPackage }}.{{ .TagType }} {
 	{{- if or ( .TagTypeIDElem ) ( .TagTypeAddBoolElem) }}
 	var result []*{{ .TagPackage }}.{{ .TagType }}
 
@@ -82,7 +82,7 @@ func Tags(tags tftags.KeyValueTags) []*{{ .TagPackage }}.{{ .TagType }} {
 	return result
 }
 
-// KeyValueTags creates tftags.KeyValueTags from {{ .AWSService }} service tags.
+// {{ .KeyValueTagsFunc }} creates tftags.KeyValueTags from {{ .AWSService }} service tags.
 {{- if or ( .TagType2 ) ( .TagTypeAddBoolElem ) }}
 //
 // Accepts the following types:
@@ -94,7 +94,7 @@ func Tags(tags tftags.KeyValueTags) []*{{ .TagPackage }}.{{ .TagType }} {
 //   - []any (Terraform TypeList configuration block compatible)
 //   - *schema.Set (Terraform TypeSet configuration block compatible)
 {{- end }}
-func KeyValueTags(ctx context.Context, tags any{{ if .TagTypeIDElem }}, identifier{{ if .TagResTypeElem }}, resourceType{{ end }} string{{ end }}) tftags.KeyValueTags {
+func {{ .KeyValueTagsFunc }}(ctx context.Context, tags any{{ if .TagTypeIDElem }}, identifier{{ if .TagResTypeElem }}, resourceType{{ end }} string{{ end }}) tftags.KeyValueTags {
 	switch tags := tags.(type) {
 	case []*{{ .TagPackage }}.{{ .TagType }}:
 		{{- if or ( .TagTypeIDElem ) ( .TagTypeAddBoolElem) }}
@@ -164,7 +164,7 @@ func KeyValueTags(ctx context.Context, tags any{{ if .TagTypeIDElem }}, identifi
 		return tftags.New(ctx, m)
 	{{- if .TagTypeAddBoolElem }}
 	case *schema.Set:
-		return KeyValueTags(ctx, tags.List(){{ if .TagTypeIDElem }}, identifier{{ if .TagResTypeElem }}, resourceType{{ end }}{{ end }})
+		return {{ .KeyValueTagsFunc }}(ctx, tags.List(){{ if .TagTypeIDElem }}, identifier{{ if .TagResTypeElem }}, resourceType{{ end }}{{ end }})
 	case []any:
 		result := make(map[string]*tftags.TagData)
 
@@ -214,7 +214,7 @@ func KeyValueTags(ctx context.Context, tags any{{ if .TagTypeIDElem }}, identifi
 	}
 }
 {{- else }}
-func KeyValueTags(ctx context.Context, tags []*{{ .TagPackage }}.{{ .TagType }}) tftags.KeyValueTags {
+func {{ .KeyValueTagsFunc }}(ctx context.Context, tags []*{{ .TagPackage }}.{{ .TagType }}) tftags.KeyValueTags {
 	m := make(map[string]*string, len(tags))
 
 	for _, tag := range tags {
@@ -225,11 +225,11 @@ func KeyValueTags(ctx context.Context, tags []*{{ .TagPackage }}.{{ .TagType }})
 }
 {{- end }}
 
-// getTagsIn returns {{ .ServicePackage }} service tags from Context.
+// {{ .GetTagsInFunc }} returns {{ .ServicePackage }} service tags from Context.
 // nil is returned if there are no input tags.
-func getTagsIn(ctx context.Context) []*{{ .TagPackage }}.{{ .TagType }} {
+func {{ .GetTagsInFunc }}(ctx context.Context) []*{{ .TagPackage }}.{{ .TagType }} {
 	if inContext, ok := tftags.FromContext(ctx); ok {
-		if tags := Tags(inContext.TagsIn.UnwrapOrDefault()); len(tags) > 0 {
+		if tags := {{ .TagsFunc }}(inContext.TagsIn.UnwrapOrDefault()); len(tags) > 0 {
 			return tags
 		}
 	}
@@ -237,17 +237,17 @@ func getTagsIn(ctx context.Context) []*{{ .TagPackage }}.{{ .TagType }} {
 	return nil
 }
 
-// setTagsOut sets {{ .ServicePackage }} service tags in Context.
+// {{ .SetTagsOutFunc }} sets {{ .ServicePackage }} service tags in Context.
 {{- if or ( .TagType2 ) ( .TagTypeAddBoolElem ) }}
-func setTagsOut(ctx context.Context, tags any{{ if .TagTypeIDElem }}, identifier{{ if .TagResTypeElem }}, resourceType{{ end }} string{{ end }}) {
+func {{ .SetTagsOutFunc }}(ctx context.Context, tags any{{ if .TagTypeIDElem }}, identifier{{ if .TagResTypeElem }}, resourceType{{ end }} string{{ end }}) {
 	if inContext, ok := tftags.FromContext(ctx); ok {
-		inContext.TagsOut = types.Some(KeyValueTags(ctx, tags{{ if .TagTypeIDElem }}, identifier{{ if .TagResTypeElem }}, resourceType{{ end }}{{ end }}))
+		inContext.TagsOut = types.Some({{ .KeyValueTagsFunc }}(ctx, tags{{ if .TagTypeIDElem }}, identifier{{ if .TagResTypeElem }}, resourceType{{ end }}{{ end }}))
 	}
 }
 {{- else }}
-func setTagsOut(ctx context.Context, tags []*{{ .TagPackage }}.{{ .TagType }}) {
+func {{ .SetTagsOutFunc }}(ctx context.Context, tags []*{{ .TagPackage }}.{{ .TagType }}) {
 	if inContext, ok := tftags.FromContext(ctx); ok {
-		inContext.TagsOut = types.Some(KeyValueTags(ctx, tags))
+		inContext.TagsOut = types.Some({{ .KeyValueTagsFunc }}(ctx, tags))
 	}
 }
 {{- end }}
@@ -259,6 +259,6 @@ func {{ .CreateTagsFunc }}(ctx context.Context, conn {{ .ClientType }}, identifi
 		return nil
 	}
 
-	return  {{ .UpdateTagsFunc }}(ctx, conn, identifier{{ if .TagResTypeElem }}, resourceType{{ end }}, nil, KeyValueTags(ctx, tags))
+	return  {{ .UpdateTagsFunc }}(ctx, conn, identifier{{ if .TagResTypeElem }}, resourceType{{ end }}, nil, {{ .KeyValueTagsFunc }}(ctx, tags))
 }
 {{- end }}
diff --git a/internal/generate/tags/templates/v1/update_tags_body.tmpl b/internal/generate/tags/templates/v1/update_tags_body.tmpl
index 9092243ed4c..e94863b6b63 100644
--- a/internal/generate/tags/templates/v1/update_tags_body.tmpl
+++ b/internal/generate/tags/templates/v1/update_tags_body.tmpl
@@ -3,14 +3,18 @@
 // it may also be a different identifier depending on the service.
 {{if  .TagTypeAddBoolElem -}}
 func {{ .UpdateTagsFunc }}(ctx context.Context, conn {{ .ClientType }}, identifier{{ if .TagResTypeElem }}, resourceType{{ end }} string, oldTagsSet, newTagsSet any) error {
-	oldTags := KeyValueTags(ctx, oldTagsSet, identifier{{ if .TagResTypeElem }}, resourceType{{ end }})
-	newTags := KeyValueTags(ctx, newTagsSet, identifier{{ if .TagResTypeElem }}, resourceType{{ end }})
+	oldTags := {{ .KeyValueTagsFunc }}(ctx, oldTagsSet, identifier{{ if .TagResTypeElem }}, resourceType{{ end }})
+	newTags := {{ .KeyValueTagsFunc }}(ctx, newTagsSet, identifier{{ if .TagResTypeElem }}, resourceType{{ end }})
 {{- else -}}
 func {{ .UpdateTagsFunc }}(ctx context.Context, conn {{ .ClientType }}, identifier{{ if .TagResTypeElem }}, resourceType{{ end }} string, oldTagsMap, newTagsMap any) error {
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 {{- end }}
+
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	{{- if eq (.TagOp) (.UntagOp) }}
+
 	removedTags := oldTags.Removed(newTags)
 	{{- if .UpdateTagsIgnoreSystem }}
 	removedTags = removedTags.IgnoreSystem(names.{{ .ProviderNameUpper }})
@@ -29,6 +33,8 @@ func {{ .UpdateTagsFunc }}(ctx context.Context, conn {{ .ClientType }}, identifi
 		{{- if not ( .TagTypeIDElem ) }}
 		{{- if .TagInIDNeedSlice }}
 		{{ .TagInIDElem }}:   aws.StringSlice([]string{identifier}),
+		{{- else if .TagInIDNeedValueSlice }}
+		{{ .TagInIDElem }}:   []string{identifier},
 		{{- else }}
 		{{ .TagInIDElem }}:   aws.String(identifier),
 		{{- end }}
@@ -39,12 +45,12 @@ func {{ .UpdateTagsFunc }}(ctx context.Context, conn {{ .ClientType }}, identifi
 	}
 
 	if len(updatedTags) > 0 {
-		input.{{ .TagInTagsElem }} = Tags(updatedTags)
+		input.{{ .TagInTagsElem }} = {{ .TagsFunc }}(updatedTags)
 	}
 
 	if len(removedTags) > 0 {
 		{{- if .UntagInNeedTagType }}
-		input.{{ .UntagInTagsElem }} = Tags(removedTags)
+		input.{{ .UntagInTagsElem }} = {{ .TagsFunc }}(removedTags)
 		{{- else if .UntagInNeedTagKeyType }}
 		input.{{ .UntagInTagsElem }} = TagKeys(removedTags)
 		{{- else if .UntagInCustomVal }}
@@ -74,6 +80,8 @@ func {{ .UpdateTagsFunc }}(ctx context.Context, conn {{ .ClientType }}, identifi
 			{{- if not ( .TagTypeIDElem ) }}
 			{{- if .TagInIDNeedSlice }}
 			{{ .TagInIDElem }}:   aws.StringSlice([]string{identifier}),
+			{{- else if .TagInIDNeedValueSlice }}
+			{{ .TagInIDElem }}:   []string{identifier},
 			{{- else }}
 			{{ .TagInIDElem }}:   aws.String(identifier),
 			{{- end }}
@@ -82,7 +90,7 @@ func {{ .UpdateTagsFunc }}(ctx context.Context, conn {{ .ClientType }}, identifi
 			{{- end }}
 			{{- end }}
 			{{- if .UntagInNeedTagType }}
-			{{ .UntagInTagsElem }}:       Tags(removedTags),
+			{{ .UntagInTagsElem }}:       {{ .TagsFunc }}(removedTags),
 			{{- else if .UntagInNeedTagKeyType }}
 			{{ .UntagInTagsElem }}:       TagKeys(removedTags),
 			{{- else if .UntagInCustomVal }}
@@ -114,6 +122,8 @@ func {{ .UpdateTagsFunc }}(ctx context.Context, conn {{ .ClientType }}, identifi
 			{{- if not ( .TagTypeIDElem ) }}
 			{{- if .TagInIDNeedSlice }}
 			{{ .TagInIDElem }}: aws.StringSlice([]string{identifier}),
+			{{- else if .TagInIDNeedValueSlice }}
+			{{ .TagInIDElem }}: []string{identifier},
 			{{- else }}
 			{{ .TagInIDElem }}: aws.String(identifier),
 			{{- end }}
@@ -124,7 +134,7 @@ func {{ .UpdateTagsFunc }}(ctx context.Context, conn {{ .ClientType }}, identifi
 			{{- if .TagInCustomVal }}
 			{{ .TagInTagsElem }}:       {{ .TagInCustomVal }},
 			{{- else }}
-			{{ .TagInTagsElem }}:       Tags(updatedTags),
+			{{ .TagInTagsElem }}:       {{ .TagsFunc }}(updatedTags),
 			{{- end }}
 		}
 
@@ -140,6 +150,14 @@ func {{ .UpdateTagsFunc }}(ctx context.Context, conn {{ .ClientType }}, identifi
 
 	{{- end }}
 
+	{{ if .WaitForPropagation }}
+	if len(removedTags) > 0 || len(updatedTags) > 0 {
+		if err := {{ .WaitTagsPropagatedFunc }}(ctx, conn, identifier, newTags); err != nil {
+			return fmt.Errorf("waiting for resource (%s) tag propagation: %w", identifier, err)
+		}
+	}
+	{{- end }}
+
 	return nil
 }
 
diff --git a/internal/generate/tags/templates/v1/v1.go b/internal/generate/tags/templates/v1/v1.go
index 4b308bfccb6..7e933e491ed 100644
--- a/internal/generate/tags/templates/v1/v1.go
+++ b/internal/generate/tags/templates/v1/v1.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package v1
 
 import (
@@ -21,3 +24,6 @@ var ServiceTagsSliceBody string
 
 //go:embed update_tags_body.tmpl
 var UpdateTagsBody string
+
+//go:embed wait_tags_propagated_body.tmpl
+var WaitTagsPropagatedBody string
diff --git a/internal/generate/tags/templates/v1/wait_tags_propagated_body.tmpl b/internal/generate/tags/templates/v1/wait_tags_propagated_body.tmpl
new file mode 100644
index 00000000000..6ba73a3a941
--- /dev/null
+++ b/internal/generate/tags/templates/v1/wait_tags_propagated_body.tmpl
@@ -0,0 +1,42 @@
+// {{ .WaitTagsPropagatedFunc }} waits for {{ .ServicePackage }} service tags to be propagated.
+// The identifier is typically the Amazon Resource Name (ARN), although
+// it may also be a different identifier depending on the service.
+func {{ .WaitTagsPropagatedFunc }}(ctx context.Context, conn {{ .ClientType }}, id string, tags tftags.KeyValueTags) error {
+	tflog.Debug(ctx, "Waiting for tag propagation", map[string]any{
+		"tags": tags,
+	})
+
+	checkFunc := func() (bool, error) {
+		output, err := {{ .ListTagsFunc }}(ctx, conn, id)
+
+		if tfresource.NotFound(err) {
+			return false, nil
+		}
+
+		if err != nil {
+			return false, err
+		}
+
+		if inContext, ok := tftags.FromContext(ctx); ok {
+			output = output.IgnoreConfig(inContext.IgnoreConfig)
+		}
+
+		return output.Equal(tags), nil
+	}
+	opts := tfresource.WaitOpts{
+		{{- if ne .WaitContinuousOccurence 0 }}
+		ContinuousTargetOccurence: {{ .WaitContinuousOccurence }},
+		{{- end }}
+		{{- if ne .WaitDelay "" }}
+		Delay: {{ .WaitDelay }},
+		{{- end }}
+		{{- if ne .WaitMinTimeout "" }}
+		MinTimeout: {{ .WaitMinTimeout }},
+		{{- end }}
+		{{- if ne .WaitPollInterval "" }}
+		PollInterval: {{ .WaitPollInterval }},
+		{{- end }}
+	}
+
+	return tfresource.WaitUntil(ctx, {{ .WaitTimeout }}, checkFunc, opts)
+}
diff --git a/internal/generate/tags/templates/v2/get_tag_body.tmpl b/internal/generate/tags/templates/v2/get_tag_body.tmpl
index d2f9042c98f..914bd410381 100644
--- a/internal/generate/tags/templates/v2/get_tag_body.tmpl
+++ b/internal/generate/tags/templates/v2/get_tag_body.tmpl
@@ -28,7 +28,7 @@ func {{ .GetTagFunc }}(ctx context.Context, conn {{ .ClientType }}, identifier{{
 		return nil, err
 	}
 
-	listTags := KeyValueTags(ctx, output.{{ .ListTagsOutTagsElem }}{{ if .TagTypeIDElem }}, identifier{{ if .TagResTypeElem }}, resourceType{{ end }}{{ end }})
+	listTags := {{ .KeyValueTagsFunc }}(ctx, output.{{ .ListTagsOutTagsElem }}{{ if .TagTypeIDElem }}, identifier{{ if .TagResTypeElem }}, resourceType{{ end }}{{ end }})
 	{{- else }}
 	listTags, err := {{ .ListTagsFunc }}(ctx, conn, identifier{{ if .TagResTypeElem }}, resourceType{{ end }})
 
diff --git a/internal/generate/tags/templates/v2/header_body.tmpl b/internal/generate/tags/templates/v2/header_body.tmpl
index 59dabbd4089..da201d8a767 100644
--- a/internal/generate/tags/templates/v2/header_body.tmpl
+++ b/internal/generate/tags/templates/v2/header_body.tmpl
@@ -6,14 +6,21 @@ import (
 	{{- if .FmtPkg }}
 	"fmt"
 	{{- end }}
+	{{- if .TimePkg }}
+	"time"
+	{{- end }}
 
+	{{ if not .SkipAWSImp }}
 	"github.com/aws/aws-sdk-go-v2/aws"
+	{{- end }}
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	{{- if .AWSService }}
+		{{- if not .SkipServiceImp }}
 	"github.com/aws/aws-sdk-go-v2/service/{{ .AWSService }}"
-	{{- if not .SkipTypesImp }}
+		{{- end }}
+		{{- if not .SkipTypesImp }}
 	awstypes "github.com/aws/aws-sdk-go-v2/service/{{ .AWSService }}/types"
-	{{- end }}
+		{{- end }}
 	{{- end }}
 	{{- if .HelperSchemaPkg }}
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
@@ -21,10 +28,16 @@ import (
 	{{- if .ParentNotFoundErrCode }}
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	{{- end }}
+	{{- if .TfLogPkg }}
+    "github.com/hashicorp/terraform-plugin-log/tflog"
 	{{- end }}
 	{{- if .ConnsPkg }}
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	{{- end }}
+	{{- if .LoggingPkg }}
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
+	{{- end }}
 	{{- if .TfResourcePkg }}
     "github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	{{- end }}
diff --git a/internal/generate/tags/templates/v2/list_tags_body.tmpl b/internal/generate/tags/templates/v2/list_tags_body.tmpl
index c4013e8bf03..a64ecc2db02 100644
--- a/internal/generate/tags/templates/v2/list_tags_body.tmpl
+++ b/internal/generate/tags/templates/v2/list_tags_body.tmpl
@@ -44,7 +44,7 @@ func {{ .ListTagsFunc }}(ctx context.Context, conn {{ .ClientType }}, identifier
 		return tftags.New(ctx, nil), err
 	}
 
-	return KeyValueTags(ctx, output.{{ .ListTagsOutTagsElem }}{{ if .TagTypeIDElem }}, identifier{{ if .TagResTypeElem }}, resourceType{{ end }}{{ end }}), nil
+	return {{ .KeyValueTagsFunc }}(ctx, output.{{ .ListTagsOutTagsElem }}{{ if .TagTypeIDElem }}, identifier{{ if .TagResTypeElem }}, resourceType{{ end }}{{ end }}), nil
 }
 
 {{- if .IsDefaultListTags }}
diff --git a/internal/generate/tags/templates/v2/service_tags_map_body.tmpl b/internal/generate/tags/templates/v2/service_tags_map_body.tmpl
index a1fd1f0d988..8f72a4d3f09 100644
--- a/internal/generate/tags/templates/v2/service_tags_map_body.tmpl
+++ b/internal/generate/tags/templates/v2/service_tags_map_body.tmpl
@@ -1,20 +1,20 @@
 // map[string]*string handling
 
-// Tags returns {{ .ServicePackage }} service tags.
-func Tags(tags tftags.KeyValueTags) map[string]*string {
+// {{ .TagsFunc }} returns {{ .ServicePackage }} service tags.
+func {{ .TagsFunc }}(tags tftags.KeyValueTags) map[string]*string {
 	return aws.StringMap(tags.Map())
 }
 
-// KeyValueTags creates KeyValueTags from {{ .ServicePackage }} service tags.
-func KeyValueTags(ctx context.Context, tags map[string]*string) tftags.KeyValueTags {
+// {{ .KeyValueTagsFunc }} creates tftags.KeyValueTags from {{ .ServicePackage }} service tags.
+func {{ .KeyValueTagsFunc }}(ctx context.Context, tags map[string]*string) tftags.KeyValueTags {
 	return tftags.New(ctx, tags)
 }
 
-// getTagsIn returns {{ .ServicePackage }} service tags from Context.
+// {{ .GetTagsInFunc }} returns {{ .ServicePackage }} service tags from Context.
 // nil is returned if there are no input tags.
-func getTagsIn(ctx context.Context) map[string]*string {
+func {{ .GetTagsInFunc }}(ctx context.Context) map[string]*string {
 	if inContext, ok := tftags.FromContext(ctx); ok {
-		if tags := Tags(inContext.TagsIn.UnwrapOrDefault()); len(tags) > 0 {
+		if tags := {{ .TagsFunc }}(inContext.TagsIn.UnwrapOrDefault()); len(tags) > 0 {
 			return tags
 		}
 	}
@@ -22,10 +22,10 @@ func getTagsIn(ctx context.Context) map[string]*string {
 	return nil
 }
 
-// setTagsOut sets {{ .ServicePackage }} service tags in Context.
-func setTagsOut(ctx context.Context, tags map[string]*string) {
+// {{ .SetTagsOutFunc }} sets {{ .ServicePackage }} service tags in Context.
+func {{ .SetTagsOutFunc }}(ctx context.Context, tags map[string]*string) {
 	if inContext, ok := tftags.FromContext(ctx); ok {
-		inContext.TagsOut = types.Some(KeyValueTags(ctx, tags))
+		inContext.TagsOut = types.Some({{ .KeyValueTagsFunc }}(ctx, tags))
 	}
 }
 
diff --git a/internal/generate/tags/templates/v2/service_tags_slice_body.tmpl b/internal/generate/tags/templates/v2/service_tags_slice_body.tmpl
index c79a97f9589..c5aa8ebd415 100644
--- a/internal/generate/tags/templates/v2/service_tags_slice_body.tmpl
+++ b/internal/generate/tags/templates/v2/service_tags_slice_body.tmpl
@@ -44,8 +44,8 @@ func TagKeys(tags tftags.KeyValueTags) []*{{ .AWSService }}.{{ .TagKeyType }} {
 }
 {{- end }}
 
-// Tags returns {{ .ServicePackage }} service tags.
-func Tags(tags tftags.KeyValueTags) []awstypes.{{ .TagType }} {
+// {{ .TagsFunc }} returns {{ .ServicePackage }} service tags.
+func {{ .TagsFunc }}(tags tftags.KeyValueTags) []awstypes.{{ .TagType }} {
 	{{- if or ( .TagTypeIDElem ) ( .TagTypeAddBoolElem) }}
 	var result []awstypes.{{ .TagType }}
 
@@ -82,7 +82,7 @@ func Tags(tags tftags.KeyValueTags) []awstypes.{{ .TagType }} {
 	return result
 }
 
-// KeyValueTags creates tftags.KeyValueTags from {{ .AWSService }} service tags.
+// {{ .KeyValueTagsFunc }} creates tftags.KeyValueTags from {{ .AWSService }} service tags.
 {{- if or ( .TagType2 ) ( .TagTypeAddBoolElem ) }}
 //
 // Accepts the following types:
@@ -94,7 +94,7 @@ func Tags(tags tftags.KeyValueTags) []awstypes.{{ .TagType }} {
 //   - []any (Terraform TypeList configuration block compatible)
 //   - *schema.Set (Terraform TypeSet configuration block compatible)
 {{- end }}
-func KeyValueTags(ctx context.Context, tags any{{ if .TagTypeIDElem }}, identifier{{ if .TagResTypeElem }}, resourceType{{ end }} string{{ end }}) tftags.KeyValueTags {
+func {{ .KeyValueTagsFunc }}(ctx context.Context, tags any{{ if .TagTypeIDElem }}, identifier{{ if .TagResTypeElem }}, resourceType{{ end }} string{{ end }}) tftags.KeyValueTags {
 	switch tags := tags.(type) {
 	case []awstypes.{{ .TagType }}:
 		{{- if or ( .TagTypeIDElem ) ( .TagTypeAddBoolElem) }}
@@ -164,7 +164,7 @@ func KeyValueTags(ctx context.Context, tags any{{ if .TagTypeIDElem }}, identifi
 		return tftags.New(ctx, m)
 	{{- if .TagTypeAddBoolElem }}
 	case *schema.Set:
-		return KeyValueTags(tags.List(){{ if .TagTypeIDElem }}, identifier{{ if .TagResTypeElem }}, resourceType{{ end }}{{ end }})
+		return {{ .KeyValueTagsFunc }}(tags.List(){{ if .TagTypeIDElem }}, identifier{{ if .TagResTypeElem }}, resourceType{{ end }}{{ end }})
 	case []any:
 		result := make(map[string]*tftags.TagData)
 
@@ -214,7 +214,7 @@ func KeyValueTags(ctx context.Context, tags any{{ if .TagTypeIDElem }}, identifi
 	}
 }
 {{- else }}
-func KeyValueTags(ctx context.Context, tags []awstypes.{{ .TagType }}) tftags.KeyValueTags {
+func {{ .KeyValueTagsFunc }}(ctx context.Context, tags []awstypes.{{ .TagType }}) tftags.KeyValueTags {
 	m := make(map[string]*string, len(tags))
 
 	for _, tag := range tags {
@@ -225,11 +225,11 @@ func KeyValueTags(ctx context.Context, tags []awstypes.{{ .TagType }}) tftags.Ke
 }
 {{- end }}
 
-// getTagsIn returns {{ .ServicePackage }} service tags from Context.
+// {{ .GetTagsInFunc }} returns {{ .ServicePackage }} service tags from Context.
 // nil is returned if there are no input tags.
-func getTagsIn(ctx context.Context) []awstypes.{{ .TagType }} {
+func {{ .GetTagsInFunc }}(ctx context.Context) []awstypes.{{ .TagType }} {
 	if inContext, ok := tftags.FromContext(ctx); ok {
-		if tags := Tags(inContext.TagsIn.UnwrapOrDefault()); len(tags) > 0 {
+		if tags := {{ .TagsFunc }}(inContext.TagsIn.UnwrapOrDefault()); len(tags) > 0 {
 			return tags
 		}
 	}
@@ -237,28 +237,28 @@ func getTagsIn(ctx context.Context) []awstypes.{{ .TagType }} {
 	return nil
 }
 
-// setTagsOut sets {{ .ServicePackage }} service tags in Context.
+// {{ .SetTagsOutFunc }} sets {{ .ServicePackage }} service tags in Context.
 {{- if or ( .TagType2 ) ( .TagTypeAddBoolElem ) }}
-func setTagsOut(ctx context.Context, tags any{{ if .TagTypeIDElem }}, identifier{{ if .TagResTypeElem }}, resourceType{{ end }} string{{ end }}) {
+func {{ .SetTagsOutFunc }}(ctx context.Context, tags any{{ if .TagTypeIDElem }}, identifier{{ if .TagResTypeElem }}, resourceType{{ end }} string{{ end }}) {
 	if inContext, ok := tftags.FromContext(ctx); ok {
-		inContext.TagsOut = types.Some(KeyValueTags(ctx, tags{{ if .TagTypeIDElem }}, identifier{{ if .TagResTypeElem }}, resourceType{{ end }}{{ end }}))
+		inContext.TagsOut = types.Some({{ .KeyValueTagsFunc }}(ctx, tags{{ if .TagTypeIDElem }}, identifier{{ if .TagResTypeElem }}, resourceType{{ end }}{{ end }}))
 	}
 }
 {{- else }}
-func setTagsOut(ctx context.Context, tags []awstypes.{{ .TagType }}) {
+func {{ .SetTagsOutFunc }}(ctx context.Context, tags []awstypes.{{ .TagType }}) {
 	if inContext, ok := tftags.FromContext(ctx); ok {
-		inContext.TagsOut = types.Some(KeyValueTags(ctx, tags))
+		inContext.TagsOut = types.Some({{ .KeyValueTagsFunc }}(ctx, tags))
 	}
 }
 {{- end }}
 
 {{- if ne .CreateTagsFunc "" }}
 // {{ .CreateTagsFunc }} creates {{ .ServicePackage }} service tags for new resources.
-func {{ .CreateTagsFunc }}(ctx context.Context, conn {{ .ClientType }}, identifier{{ if .TagResTypeElem }}, resourceType{{ end }} string, tags []*{{ .TagPackage }}.{{ .TagType }}) error {
+func {{ .CreateTagsFunc }}(ctx context.Context, conn {{ .ClientType }}, identifier{{ if .TagResTypeElem }}, resourceType{{ end }} string, tags []awstypes.{{ .TagType }}) error {
 	if len(tags) == 0 {
 		return nil
 	}
 
-	return  {{ .UpdateTagsFunc }}(ctx, conn, identifier{{ if .TagResTypeElem }}, resourceType{{ end }}, nil, KeyValueTags(ctx, tags))
+	return  {{ .UpdateTagsFunc }}(ctx, conn, identifier{{ if .TagResTypeElem }}, resourceType{{ end }}, nil, {{ .KeyValueTagsFunc }}(ctx, tags))
 }
 {{- end }}
diff --git a/internal/generate/tags/templates/v2/service_tags_value_map_body.tmpl b/internal/generate/tags/templates/v2/service_tags_value_map_body.tmpl
index bb6d0ad9397..b3918861970 100644
--- a/internal/generate/tags/templates/v2/service_tags_value_map_body.tmpl
+++ b/internal/generate/tags/templates/v2/service_tags_value_map_body.tmpl
@@ -1,20 +1,20 @@
 // map[string]string handling
 
-// Tags returns {{ .ServicePackage }} service tags.
-func Tags(tags tftags.KeyValueTags) map[string]string {
+// {{ .TagsFunc }} returns {{ .ServicePackage }} service tags.
+func {{ .TagsFunc }}(tags tftags.KeyValueTags) map[string]string {
 	return tags.Map()
 }
 
-// KeyValueTags creates KeyValueTags from {{ .ServicePackage }} service tags.
-func KeyValueTags(ctx context.Context, tags map[string]string) tftags.KeyValueTags {
+// {{ .KeyValueTagsFunc }} creates tftags.KeyValueTags from {{ .ServicePackage }} service tags.
+func {{ .KeyValueTagsFunc }}(ctx context.Context, tags map[string]string) tftags.KeyValueTags {
 	return tftags.New(ctx, tags)
 }
 
-// getTagsIn returns {{ .ServicePackage }} service tags from Context.
+// {{ .GetTagsInFunc }} returns {{ .ServicePackage }} service tags from Context.
 // nil is returned if there are no input tags.
-func getTagsIn(ctx context.Context) map[string]string {
+func {{ .GetTagsInFunc }}(ctx context.Context) map[string]string {
 	if inContext, ok := tftags.FromContext(ctx); ok {
-		if tags := Tags(inContext.TagsIn.UnwrapOrDefault()); len(tags) > 0 {
+		if tags := {{ .TagsFunc }}(inContext.TagsIn.UnwrapOrDefault()); len(tags) > 0 {
 			return tags
 		}
 	}
@@ -22,10 +22,10 @@ func getTagsIn(ctx context.Context) map[string]string {
 	return nil
 }
 
-// setTagsOut sets {{ .ServicePackage }} service tags in Context.
-func setTagsOut(ctx context.Context, tags map[string]string) {
+// {{ .SetTagsOutFunc }} sets {{ .ServicePackage }} service tags in Context.
+func {{ .SetTagsOutFunc }}(ctx context.Context, tags map[string]string) {
 	if inContext, ok := tftags.FromContext(ctx); ok {
-		inContext.TagsOut = types.Some(KeyValueTags(ctx, tags))
+		inContext.TagsOut = types.Some({{ .KeyValueTagsFunc }}(ctx, tags))
 	}
 }
 
diff --git a/internal/generate/tags/templates/v2/update_tags_body.tmpl b/internal/generate/tags/templates/v2/update_tags_body.tmpl
index d27557c39ff..1a79b455b77 100644
--- a/internal/generate/tags/templates/v2/update_tags_body.tmpl
+++ b/internal/generate/tags/templates/v2/update_tags_body.tmpl
@@ -3,14 +3,18 @@
 // it may also be a different identifier depending on the service.
 {{if  .TagTypeAddBoolElem -}}
 func {{ .UpdateTagsFunc }}(ctx context.Context, conn {{ .ClientType }}, identifier{{ if .TagResTypeElem }}, resourceType{{ end }} string, oldTagsSet, newTagsSet any) error {
-	oldTags := KeyValueTags(ctx, oldTagsSet, identifier{{ if .TagResTypeElem }}, resourceType{{ end }})
-	newTags := KeyValueTags(ctx, newTagsSet, identifier{{ if .TagResTypeElem }}, resourceType{{ end }})
+	oldTags := {{ .KeyValueTagsFunc }}(ctx, oldTagsSet, identifier{{ if .TagResTypeElem }}, resourceType{{ end }})
+	newTags := {{ .KeyValueTagsFunc }}(ctx, newTagsSet, identifier{{ if .TagResTypeElem }}, resourceType{{ end }})
 {{- else -}}
 func {{ .UpdateTagsFunc }}(ctx context.Context, conn {{ .ClientType }}, identifier{{ if .TagResTypeElem }}, resourceType{{ end }} string, oldTagsMap, newTagsMap any) error {
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 {{- end }}
+
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	{{- if eq (.TagOp) (.UntagOp) }}
+
 	removedTags := oldTags.Removed(newTags)
 	{{- if .UpdateTagsIgnoreSystem }}
 	removedTags = removedTags.IgnoreSystem(names.{{ .ProviderNameUpper }})
@@ -29,6 +33,8 @@ func {{ .UpdateTagsFunc }}(ctx context.Context, conn {{ .ClientType }}, identifi
 		{{- if not ( .TagTypeIDElem ) }}
 		{{- if .TagInIDNeedSlice }}
 		{{ .TagInIDElem }}:   aws.StringSlice([]string{identifier}),
+		{{- else if .TagInIDNeedValueSlice }}
+		{{ .TagInIDElem }}: []string{identifier},
 		{{- else }}
 		{{ .TagInIDElem }}:   aws.String(identifier),
 		{{- end }}
@@ -39,12 +45,12 @@ func {{ .UpdateTagsFunc }}(ctx context.Context, conn {{ .ClientType }}, identifi
 	}
 
 	if len(updatedTags) > 0 {
-		input.{{ .TagInTagsElem }} = Tags(updatedTags)
+		input.{{ .TagInTagsElem }} = {{ .TagsFunc }}(updatedTags)
 	}
 
 	if len(removedTags) > 0 {
 		{{- if .UntagInNeedTagType }}
-		input.{{ .UntagInTagsElem }} = Tags(removedTags)
+		input.{{ .UntagInTagsElem }} = {{ .TagsFunc }}(removedTags)
 		{{- else if .UntagInNeedTagKeyType }}
 		input.{{ .UntagInTagsElem }} = TagKeys(removedTags)
 		{{- else if .UntagInCustomVal }}
@@ -74,6 +80,8 @@ func {{ .UpdateTagsFunc }}(ctx context.Context, conn {{ .ClientType }}, identifi
 			{{- if not ( .TagTypeIDElem ) }}
 			{{- if .TagInIDNeedSlice }}
 			{{ .TagInIDElem }}:   aws.StringSlice([]string{identifier}),
+			{{- else if .TagInIDNeedValueSlice }}
+			{{ .TagInIDElem }}: []string{identifier},
 			{{- else }}
 			{{ .TagInIDElem }}:   aws.String(identifier),
 			{{- end }}
@@ -82,7 +90,7 @@ func {{ .UpdateTagsFunc }}(ctx context.Context, conn {{ .ClientType }}, identifi
 			{{- end }}
 			{{- end }}
 			{{- if .UntagInNeedTagType }}
-			{{ .UntagInTagsElem }}:       Tags(removedTags),
+			{{ .UntagInTagsElem }}:       {{ .TagsFunc }}(removedTags),
 			{{- else if .UntagInNeedTagKeyType }}
 			{{ .UntagInTagsElem }}:       TagKeys(removedTags),
 			{{- else if .UntagInCustomVal }}
@@ -114,6 +122,8 @@ func {{ .UpdateTagsFunc }}(ctx context.Context, conn {{ .ClientType }}, identifi
 			{{- if not ( .TagTypeIDElem ) }}
 			{{- if .TagInIDNeedSlice }}
 			{{ .TagInIDElem }}: aws.StringSlice([]string{identifier}),
+			{{- else if .TagInIDNeedValueSlice }}
+			{{ .TagInIDElem }}: []string{identifier},
 			{{- else }}
 			{{ .TagInIDElem }}: aws.String(identifier),
 			{{- end }}
@@ -124,7 +134,7 @@ func {{ .UpdateTagsFunc }}(ctx context.Context, conn {{ .ClientType }}, identifi
 			{{- if .TagInCustomVal }}
 			{{ .TagInTagsElem }}:       {{ .TagInCustomVal }},
 			{{- else }}
-			{{ .TagInTagsElem }}:       Tags(updatedTags),
+			{{ .TagInTagsElem }}:       {{ .TagsFunc }}(updatedTags),
 			{{- end }}
 		}
 
@@ -140,6 +150,14 @@ func {{ .UpdateTagsFunc }}(ctx context.Context, conn {{ .ClientType }}, identifi
 
 	{{- end }}
 
+	{{ if .WaitForPropagation }}
+	if len(removedTags) > 0 || len(updatedTags) > 0 {
+		if err := {{ .WaitTagsPropagatedFunc }}(ctx, conn, identifier, newTags); err != nil {
+			return fmt.Errorf("waiting for resource (%s) tag propagation: %w", identifier, err)
+		}
+	}
+	{{- end }}
+
 	return nil
 }
 
diff --git a/internal/generate/tags/templates/v2/v2.go b/internal/generate/tags/templates/v2/v2.go
index c70913785cd..c148caaaf66 100644
--- a/internal/generate/tags/templates/v2/v2.go
+++ b/internal/generate/tags/templates/v2/v2.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package v2
 
 import (
@@ -27,3 +30,6 @@ var ServiceTagsSliceBody string
 
 //go:embed update_tags_body.tmpl
 var UpdateTagsBody string
+
+//go:embed wait_tags_propagated_body.tmpl
+var WaitTagsPropagatedBody string
diff --git a/internal/generate/tags/templates/v2/wait_tags_propagated_body.tmpl b/internal/generate/tags/templates/v2/wait_tags_propagated_body.tmpl
new file mode 100644
index 00000000000..6ba73a3a941
--- /dev/null
+++ b/internal/generate/tags/templates/v2/wait_tags_propagated_body.tmpl
@@ -0,0 +1,42 @@
+// {{ .WaitTagsPropagatedFunc }} waits for {{ .ServicePackage }} service tags to be propagated.
+// The identifier is typically the Amazon Resource Name (ARN), although
+// it may also be a different identifier depending on the service.
+func {{ .WaitTagsPropagatedFunc }}(ctx context.Context, conn {{ .ClientType }}, id string, tags tftags.KeyValueTags) error {
+	tflog.Debug(ctx, "Waiting for tag propagation", map[string]any{
+		"tags": tags,
+	})
+
+	checkFunc := func() (bool, error) {
+		output, err := {{ .ListTagsFunc }}(ctx, conn, id)
+
+		if tfresource.NotFound(err) {
+			return false, nil
+		}
+
+		if err != nil {
+			return false, err
+		}
+
+		if inContext, ok := tftags.FromContext(ctx); ok {
+			output = output.IgnoreConfig(inContext.IgnoreConfig)
+		}
+
+		return output.Equal(tags), nil
+	}
+	opts := tfresource.WaitOpts{
+		{{- if ne .WaitContinuousOccurence 0 }}
+		ContinuousTargetOccurence: {{ .WaitContinuousOccurence }},
+		{{- end }}
+		{{- if ne .WaitDelay "" }}
+		Delay: {{ .WaitDelay }},
+		{{- end }}
+		{{- if ne .WaitMinTimeout "" }}
+		MinTimeout: {{ .WaitMinTimeout }},
+		{{- end }}
+		{{- if ne .WaitPollInterval "" }}
+		PollInterval: {{ .WaitPollInterval }},
+		{{- end }}
+	}
+
+	return tfresource.WaitUntil(ctx, {{ .WaitTimeout }}, checkFunc, opts)
+}
diff --git a/internal/generate/teamcity/acctest_services.hcl b/internal/generate/teamcity/acctest_services.hcl
index ef2462fb3f5..142bf0d5121 100644
--- a/internal/generate/teamcity/acctest_services.hcl
+++ b/internal/generate/teamcity/acctest_services.hcl
@@ -1,7 +1,18 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 service "appautoscaling" {
   vpc_lock = true
 }
 
+service "apigateway" {
+  vpc_lock = true
+}
+
+service "apigatewayv2" {
+  vpc_lock = true
+}
+
 service "appstream" {
   vpc_lock    = true
   parallelism = 10
@@ -35,6 +46,10 @@ service "datasync" {
   vpc_lock = true
 }
 
+service "deploy" {
+  vpc_lock = true
+}
+
 service "directconnect" {
   vpc_lock = true
 }
@@ -59,6 +74,10 @@ service "ecrpublic" {
   region = "us-east-1"
 }
 
+service "ecs" {
+  vpc_lock = true
+}
+
 service "efs" {
   vpc_lock = true
 }
@@ -99,6 +118,10 @@ service "fsx" {
   vpc_lock = true
 }
 
+service "imagebuilder" {
+  vpc_lock = true
+}
+
 service "kafka" {
   vpc_lock = true
 }
@@ -135,6 +158,14 @@ service "networkfirewall" {
   vpc_lock = true
 }
 
+service "networkmanager" {
+  vpc_lock = true
+}
+
+service "opensearch" {
+  vpc_lock = true
+}
+
 service "opsworks" {
   vpc_lock = true
 }
diff --git a/internal/generate/teamcity/generate.go b/internal/generate/teamcity/generate.go
index 23f36495932..3b2ffe1b263 100644
--- a/internal/generate/teamcity/generate.go
+++ b/internal/generate/teamcity/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run services.go
 //go:generate go run provider_tests.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/generate/teamcity/provider_tests.go b/internal/generate/teamcity/provider_tests.go
index 8b64370ba2b..0535b8846eb 100644
--- a/internal/generate/teamcity/provider_tests.go
+++ b/internal/generate/teamcity/provider_tests.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:build generate
 // +build generate
 
diff --git a/internal/generate/teamcity/services.go b/internal/generate/teamcity/services.go
index 01ba3c75641..01f786900ee 100644
--- a/internal/generate/teamcity/services.go
+++ b/internal/generate/teamcity/services.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:build generate
 // +build generate
 
diff --git a/internal/logging/keys.go b/internal/logging/keys.go
new file mode 100644
index 00000000000..f935394dd8d
--- /dev/null
+++ b/internal/logging/keys.go
@@ -0,0 +1,8 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package logging
+
+const (
+	KeyResourceId = "id"
+)
diff --git a/internal/maps/maps.go b/internal/maps/maps.go
index caa1cc63353..81cc2c6a959 100644
--- a/internal/maps/maps.go
+++ b/internal/maps/maps.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package maps
 
 // ApplyToAll returns a new map containing the results of applying the function `f` to each element of the original map `m`.
diff --git a/internal/maps/maps_test.go b/internal/maps/maps_test.go
index 39463729aa3..bb599f860b1 100644
--- a/internal/maps/maps_test.go
+++ b/internal/maps/maps_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package maps
 
 import (
diff --git a/internal/provider/factory.go b/internal/provider/factory.go
index d9e592c0396..07482f9b46f 100644
--- a/internal/provider/factory.go
+++ b/internal/provider/factory.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package provider
 
 import (
diff --git a/internal/provider/factory_test.go b/internal/provider/factory_test.go
index 4d4e22e9d0b..20b6b70d720 100644
--- a/internal/provider/factory_test.go
+++ b/internal/provider/factory_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package provider_test
 
 import (
diff --git a/internal/provider/fwprovider/intercept.go b/internal/provider/fwprovider/intercept.go
index df936bfc97e..ef97b51c230 100644
--- a/internal/provider/fwprovider/intercept.go
+++ b/internal/provider/fwprovider/intercept.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package fwprovider
 
 import (
@@ -11,13 +14,24 @@ import (
 	fwtypes "github.com/hashicorp/terraform-plugin-framework/types"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs"
-	"github.com/hashicorp/terraform-provider-aws/internal/flex"
+	"github.com/hashicorp/terraform-provider-aws/internal/framework/flex"
 	"github.com/hashicorp/terraform-provider-aws/internal/slices"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
+// A data source interceptor is functionality invoked during the data source's CRUD request lifecycle.
+// If a Before interceptor returns Diagnostics indicating an error occurred then
+// no further interceptors in the chain are run and neither is the schema's method.
+// In other cases all interceptors in the chain are run.
+type dataSourceInterceptor interface {
+	// read is invoke for a Read call.
+	read(context.Context, datasource.ReadRequest, *datasource.ReadResponse, *conns.AWSClient, when, diag.Diagnostics) (context.Context, diag.Diagnostics)
+}
+
+type dataSourceInterceptors []dataSourceInterceptor
+
 type resourceCRUDRequest interface {
 	resource.CreateRequest | resource.ReadRequest | resource.UpdateRequest | resource.DeleteRequest
 }
@@ -130,13 +144,15 @@ type wrappedDataSource struct {
 	// bootstrapContext is run on all wrapped methods before any interceptors.
 	bootstrapContext contextFunc
 	inner            datasource.DataSourceWithConfigure
+	interceptors     dataSourceInterceptors
 	meta             *conns.AWSClient
 }
 
-func newWrappedDataSource(bootstrapContext contextFunc, inner datasource.DataSourceWithConfigure) datasource.DataSourceWithConfigure {
+func newWrappedDataSource(bootstrapContext contextFunc, inner datasource.DataSourceWithConfigure, interceptors dataSourceInterceptors) datasource.DataSourceWithConfigure {
 	return &wrappedDataSource{
 		bootstrapContext: bootstrapContext,
 		inner:            inner,
+		interceptors:     interceptors,
 	}
 }
 
@@ -152,14 +168,28 @@ func (w *wrappedDataSource) Schema(ctx context.Context, request datasource.Schem
 
 func (w *wrappedDataSource) Read(ctx context.Context, request datasource.ReadRequest, response *datasource.ReadResponse) {
 	ctx = w.bootstrapContext(ctx, w.meta)
+	// TODO Run interceptors.
 	w.inner.Read(ctx, request, response)
 }
 
 func (w *wrappedDataSource) Configure(ctx context.Context, request datasource.ConfigureRequest, response *datasource.ConfigureResponse) {
+	if v, ok := request.ProviderData.(*conns.AWSClient); ok {
+		w.meta = v
+	}
 	ctx = w.bootstrapContext(ctx, w.meta)
 	w.inner.Configure(ctx, request, response)
 }
 
+// tagsDataSourceInterceptor implements transparent tagging for data sources.
+type tagsDataSourceInterceptor struct {
+	tags *types.ServicePackageResourceTags
+}
+
+func (r tagsDataSourceInterceptor) read(ctx context.Context, request datasource.ReadRequest, response *datasource.ReadResponse, meta *conns.AWSClient, when when, diags diag.Diagnostics) (context.Context, diag.Diagnostics) {
+	// TODO
+	return ctx, diags
+}
+
 // wrappedResource represents an interceptor dispatcher for a Plugin Framework resource.
 type wrappedResource struct {
 	// bootstrapContext is run on all wrapped methods before any interceptors.
@@ -284,12 +314,12 @@ func (w *wrappedResource) UpgradeState(ctx context.Context) map[int64]resource.S
 	return nil
 }
 
-// tagsInterceptor implements transparent tagging.
-type tagsInterceptor struct {
+// tagsResourceInterceptor implements transparent tagging for resources.
+type tagsResourceInterceptor struct {
 	tags *types.ServicePackageResourceTags
 }
 
-func (r tagsInterceptor) create(ctx context.Context, request resource.CreateRequest, response *resource.CreateResponse, meta *conns.AWSClient, when when, diags diag.Diagnostics) (context.Context, diag.Diagnostics) {
+func (r tagsResourceInterceptor) create(ctx context.Context, request resource.CreateRequest, response *resource.CreateResponse, meta *conns.AWSClient, when when, diags diag.Diagnostics) (context.Context, diag.Diagnostics) {
 	if r.tags == nil {
 		return ctx, diags
 	}
@@ -334,7 +364,7 @@ func (r tagsInterceptor) create(ctx context.Context, request resource.CreateRequ
 	return ctx, diags
 }
 
-func (r tagsInterceptor) read(ctx context.Context, request resource.ReadRequest, response *resource.ReadResponse, meta *conns.AWSClient, when when, diags diag.Diagnostics) (context.Context, diag.Diagnostics) {
+func (r tagsResourceInterceptor) read(ctx context.Context, request resource.ReadRequest, response *resource.ReadResponse, meta *conns.AWSClient, when when, diags diag.Diagnostics) (context.Context, diag.Diagnostics) {
 	if r.tags == nil {
 		return ctx, diags
 	}
@@ -439,7 +469,7 @@ func (r tagsInterceptor) read(ctx context.Context, request resource.ReadRequest,
 	return ctx, diags
 }
 
-func (r tagsInterceptor) update(ctx context.Context, request resource.UpdateRequest, response *resource.UpdateResponse, meta *conns.AWSClient, when when, diags diag.Diagnostics) (context.Context, diag.Diagnostics) {
+func (r tagsResourceInterceptor) update(ctx context.Context, request resource.UpdateRequest, response *resource.UpdateResponse, meta *conns.AWSClient, when when, diags diag.Diagnostics) (context.Context, diag.Diagnostics) {
 	if r.tags == nil {
 		return ctx, diags
 	}
@@ -544,6 +574,6 @@ func (r tagsInterceptor) update(ctx context.Context, request resource.UpdateRequ
 	return ctx, diags
 }
 
-func (r tagsInterceptor) delete(ctx context.Context, request resource.DeleteRequest, response *resource.DeleteResponse, meta *conns.AWSClient, when when, diags diag.Diagnostics) (context.Context, diag.Diagnostics) {
+func (r tagsResourceInterceptor) delete(ctx context.Context, request resource.DeleteRequest, response *resource.DeleteResponse, meta *conns.AWSClient, when when, diags diag.Diagnostics) (context.Context, diag.Diagnostics) {
 	return ctx, diags
 }
diff --git a/internal/provider/fwprovider/provider.go b/internal/provider/fwprovider/provider.go
index 1abdbbfeeb9..85a814022bd 100644
--- a/internal/provider/fwprovider/provider.go
+++ b/internal/provider/fwprovider/provider.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package fwprovider
 
 import (
 	"context"
+	"errors"
 	"fmt"
 
-	multierror "github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform-plugin-framework-validators/listvalidator"
 	"github.com/hashicorp/terraform-plugin-framework/datasource"
 	"github.com/hashicorp/terraform-plugin-framework/provider"
@@ -92,6 +95,12 @@ func (p *fwprovider) Schema(ctx context.Context, req provider.SchemaRequest, res
 				Optional:    true,
 				Description: "Set this to true to enable the request to use path-style addressing,\ni.e., https://s3.amazonaws.com/BUCKET/KEY. By default, the S3 client will\nuse virtual hosted bucket addressing when possible\n(https://BUCKET.s3.amazonaws.com/KEY). Specific to the Amazon S3 service.",
 			},
+			"s3_us_east_1_regional_endpoint": schema.StringAttribute{
+				Optional: true,
+				Description: "Specifies whether S3 API calls in the `us-east-1` region use the legacy global endpoint or a regional endpoint. " + //lintignore:AWSAT003
+					"Valid values are `legacy` or `regional`. " +
+					"Can also be configured using the `AWS_S3_US_EAST_1_REGIONAL_ENDPOINT` environment variable or the `s3_us_east_1_regional_endpoint` shared config file parameter",
+			},
 			"secret_key": schema.StringAttribute{
 				Optional:    true,
 				Description: "The secret key for API operations. You can retrieve this\nfrom the 'Security & Credentials' section of the AWS console.",
@@ -282,6 +291,7 @@ func (p *fwprovider) Configure(ctx context.Context, request provider.ConfigureRe
 // The data source type name is determined by the DataSource implementing
 // the Metadata method. All data sources must have unique names.
 func (p *fwprovider) DataSources(ctx context.Context) []func() datasource.DataSource {
+	var errs []error
 	var dataSources []func() datasource.DataSource
 
 	for n, sp := range p.Primary.Meta().(*conns.AWSClient).ServicePackages {
@@ -300,22 +310,53 @@ func (p *fwprovider) DataSources(ctx context.Context) []func() datasource.DataSo
 				continue
 			}
 
+			metadataResponse := datasource.MetadataResponse{}
+			inner.Metadata(ctx, datasource.MetadataRequest{}, &metadataResponse)
+			typeName := metadataResponse.TypeName
+
 			// bootstrapContext is run on all wrapped methods before any interceptors.
 			bootstrapContext := func(ctx context.Context, meta *conns.AWSClient) context.Context {
 				ctx = conns.NewDataSourceContext(ctx, servicePackageName, v.Name)
 				if meta != nil {
 					ctx = tftags.NewContext(ctx, meta.DefaultTagsConfig, meta.IgnoreTagsConfig)
+					ctx = meta.RegisterLogger(ctx)
 				}
 
 				return ctx
 			}
+			interceptors := dataSourceInterceptors{}
+
+			if v.Tags != nil {
+				// The data source has opted in to transparent tagging.
+				// Ensure that the schema look OK.
+				schemaResponse := datasource.SchemaResponse{}
+				inner.Schema(ctx, datasource.SchemaRequest{}, &schemaResponse)
+
+				if v, ok := schemaResponse.Schema.Attributes[names.AttrTags]; ok {
+					if !v.IsComputed() {
+						errs = append(errs, fmt.Errorf("`%s` attribute must be Computed: %s", names.AttrTags, typeName))
+						continue
+					}
+				} else {
+					errs = append(errs, fmt.Errorf("no `%s` attribute defined in schema: %s", names.AttrTags, typeName))
+					continue
+				}
+
+				interceptors = append(interceptors, tagsDataSourceInterceptor{tags: v.Tags})
+			}
 
 			dataSources = append(dataSources, func() datasource.DataSource {
-				return newWrappedDataSource(bootstrapContext, inner)
+				return newWrappedDataSource(bootstrapContext, inner, interceptors)
 			})
 		}
 	}
 
+	if err := errors.Join(errs...); err != nil {
+		tflog.Warn(ctx, "registering data sources", map[string]interface{}{
+			"error": err.Error(),
+		})
+	}
+
 	return dataSources
 }
 
@@ -325,7 +366,7 @@ func (p *fwprovider) DataSources(ctx context.Context) []func() datasource.DataSo
 // The resource type name is determined by the Resource implementing
 // the Metadata method. All resources must have unique names.
 func (p *fwprovider) Resources(ctx context.Context) []func() resource.Resource {
-	var errs *multierror.Error
+	var errs []error
 	var resources []func() resource.Resource
 
 	for _, sp := range p.Primary.Meta().(*conns.AWSClient).ServicePackages {
@@ -336,7 +377,7 @@ func (p *fwprovider) Resources(ctx context.Context) []func() resource.Resource {
 			inner, err := v.Factory(ctx)
 
 			if err != nil {
-				errs = multierror.Append(errs, fmt.Errorf("creating resource: %w", err))
+				errs = append(errs, fmt.Errorf("creating resource: %w", err))
 				continue
 			}
 
@@ -349,6 +390,7 @@ func (p *fwprovider) Resources(ctx context.Context) []func() resource.Resource {
 				ctx = conns.NewResourceContext(ctx, servicePackageName, v.Name)
 				if meta != nil {
 					ctx = tftags.NewContext(ctx, meta.DefaultTagsConfig, meta.IgnoreTagsConfig)
+					ctx = meta.RegisterLogger(ctx)
 				}
 
 				return ctx
@@ -363,24 +405,24 @@ func (p *fwprovider) Resources(ctx context.Context) []func() resource.Resource {
 
 				if v, ok := schemaResponse.Schema.Attributes[names.AttrTags]; ok {
 					if v.IsComputed() {
-						errs = multierror.Append(errs, fmt.Errorf("`%s` attribute cannot be Computed: %s", names.AttrTags, typeName))
+						errs = append(errs, fmt.Errorf("`%s` attribute cannot be Computed: %s", names.AttrTags, typeName))
 						continue
 					}
 				} else {
-					errs = multierror.Append(errs, fmt.Errorf("no `%s` attribute defined in schema: %s", names.AttrTags, typeName))
+					errs = append(errs, fmt.Errorf("no `%s` attribute defined in schema: %s", names.AttrTags, typeName))
 					continue
 				}
 				if v, ok := schemaResponse.Schema.Attributes[names.AttrTagsAll]; ok {
 					if !v.IsComputed() {
-						errs = multierror.Append(errs, fmt.Errorf("`%s` attribute must be Computed: %s", names.AttrTagsAll, typeName))
+						errs = append(errs, fmt.Errorf("`%s` attribute must be Computed: %s", names.AttrTagsAll, typeName))
 						continue
 					}
 				} else {
-					errs = multierror.Append(errs, fmt.Errorf("no `%s` attribute defined in schema: %s", names.AttrTagsAll, typeName))
+					errs = append(errs, fmt.Errorf("no `%s` attribute defined in schema: %s", names.AttrTagsAll, typeName))
 					continue
 				}
 
-				interceptors = append(interceptors, tagsInterceptor{tags: v.Tags})
+				interceptors = append(interceptors, tagsResourceInterceptor{tags: v.Tags})
 			}
 
 			resources = append(resources, func() resource.Resource {
@@ -389,7 +431,7 @@ func (p *fwprovider) Resources(ctx context.Context) []func() resource.Resource {
 		}
 	}
 
-	if err := errs.ErrorOrNil(); err != nil {
+	if err := errors.Join(errs...); err != nil {
 		tflog.Warn(ctx, "registering resources", map[string]interface{}{
 			"error": err.Error(),
 		})
diff --git a/internal/provider/generate.go b/internal/provider/generate.go
index aa576a54a2a..2590226a3ce 100644
--- a/internal/provider/generate.go
+++ b/internal/provider/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../generate/servicepackages/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
 
diff --git a/internal/provider/intercept.go b/internal/provider/intercept.go
index 7208ba4a9cd..f73190ce169 100644
--- a/internal/provider/intercept.go
+++ b/internal/provider/intercept.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package provider
 
 import (
@@ -192,14 +195,14 @@ func (r *wrappedResource) StateUpgrade(f schema.StateUpgradeFunc) schema.StateUp
 
 type tagsCRUDFunc func(context.Context, schemaResourceData, conns.ServicePackage, *types.ServicePackageResourceTags, string, string, any, diag.Diagnostics) (context.Context, diag.Diagnostics)
 
-// tagsInterceptor implements transparent tagging.
-type tagsInterceptor struct {
+// tagsResourceInterceptor implements transparent tagging for resources.
+type tagsResourceInterceptor struct {
 	tags       *types.ServicePackageResourceTags
 	updateFunc tagsCRUDFunc
 	readFunc   tagsCRUDFunc
 }
 
-func (r tagsInterceptor) run(ctx context.Context, d schemaResourceData, meta any, when when, why why, diags diag.Diagnostics) (context.Context, diag.Diagnostics) {
+func (r tagsResourceInterceptor) run(ctx context.Context, d schemaResourceData, meta any, when when, why why, diags diag.Diagnostics) (context.Context, diag.Diagnostics) {
 	if r.tags == nil {
 		return ctx, diags
 	}
@@ -368,3 +371,74 @@ func (r tagsInterceptor) run(ctx context.Context, d schemaResourceData, meta any
 
 	return ctx, diags
 }
+
+// tagsResourceInterceptor implements transparent tagging for data sources.
+type tagsDataSourceInterceptor struct {
+	tags *types.ServicePackageResourceTags
+}
+
+func (r tagsDataSourceInterceptor) run(ctx context.Context, d schemaResourceData, meta any, when when, why why, diags diag.Diagnostics) (context.Context, diag.Diagnostics) {
+	if r.tags == nil {
+		return ctx, diags
+	}
+
+	inContext, ok := conns.FromContext(ctx)
+	if !ok {
+		return ctx, diags
+	}
+
+	// sp, ok := meta.(*conns.AWSClient).ServicePackages[inContext.ServicePackageName]
+	// if !ok {
+	// 	return ctx, diags
+	// }
+
+	// serviceName, err := names.HumanFriendly(inContext.ServicePackageName)
+	// if err != nil {
+	// 	serviceName = "<service>"
+	// }
+
+	// resourceName := inContext.ResourceName
+	// if resourceName == "" {
+	// 	resourceName = "<thing>"
+	// }
+
+	tagsInContext, ok := tftags.FromContext(ctx)
+	if !ok {
+		return ctx, diags
+	}
+
+	switch when {
+	case Before:
+		switch why {
+		case Read:
+			// Get the data source's configured tags.
+			tags := tftags.New(ctx, d.Get(names.AttrTags).(map[string]interface{}))
+			tagsInContext.TagsIn = types.Some(tags)
+		}
+	case After:
+		// Set tags and tags_all in state after CRU.
+		// C & U handlers are assumed to tail call the R handler.
+		switch why {
+		case Read:
+			// Will occur on a refresh when the resource does not exist in AWS and needs to be recreated, e.g. "_disappears" tests.
+			if d.Id() == "" {
+				return ctx, diags
+			}
+
+			fallthrough
+		case Create, Update:
+			// If the R handler didn't set tags, try and read them from the service API.
+			// TODO.
+			// if tagsInContext.TagsOut.IsNone() {
+			// }
+
+			// Remove any provider configured ignore_tags and system tags from those returned from the service API.
+			tags := tagsInContext.TagsOut.UnwrapOrDefault().IgnoreSystem(inContext.ServicePackageName).IgnoreConfig(tagsInContext.IgnoreConfig)
+			if err := d.Set(names.AttrTags, tags.Map()); err != nil {
+				return ctx, sdkdiag.AppendErrorf(diags, "setting %s: %s", names.AttrTags, err)
+			}
+		}
+	}
+
+	return ctx, diags
+}
diff --git a/internal/provider/intercept_test.go b/internal/provider/intercept_test.go
index 64748c5107b..c9df335b6b4 100644
--- a/internal/provider/intercept_test.go
+++ b/internal/provider/intercept_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package provider
 
 import (
diff --git a/internal/provider/provider.go b/internal/provider/provider.go
index daf8c128803..0bcb6d6a98e 100644
--- a/internal/provider/provider.go
+++ b/internal/provider/provider.go
@@ -1,25 +1,30 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package provider
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"log"
 	"os"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/feature/ec2/imds"
+	"github.com/aws/aws-sdk-go/aws/endpoints"
 	awsbase "github.com/hashicorp/aws-sdk-go-base/v2"
-	multierror "github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
-	"github.com/hashicorp/terraform-provider-aws/internal/experimental/nullable"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
 	"github.com/hashicorp/terraform-provider-aws/internal/flex"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
+	"github.com/hashicorp/terraform-provider-aws/internal/types/nullable"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -42,7 +47,6 @@ func New(ctx context.Context) (*schema.Provider, error) {
 				Elem:          &schema.Schema{Type: schema.TypeString},
 				Optional:      true,
 				ConflictsWith: []string{"forbidden_account_ids"},
-				Set:           schema.HashString,
 			},
 			"assume_role":                   assumeRoleSchema(),
 			"assume_role_with_web_identity": assumeRoleWithWebIdentitySchema(),
@@ -87,7 +91,6 @@ func New(ctx context.Context) (*schema.Provider, error) {
 				Elem:          &schema.Schema{Type: schema.TypeString},
 				Optional:      true,
 				ConflictsWith: []string{"allowed_account_ids"},
-				Set:           schema.HashString,
 			},
 			"http_proxy": {
 				Type:     schema.TypeString,
@@ -106,14 +109,12 @@ func New(ctx context.Context) (*schema.Provider, error) {
 							Type:        schema.TypeSet,
 							Optional:    true,
 							Elem:        &schema.Schema{Type: schema.TypeString},
-							Set:         schema.HashString,
 							Description: "Resource tag keys to ignore across all resources.",
 						},
 						"key_prefixes": {
 							Type:        schema.TypeSet,
 							Optional:    true,
 							Elem:        &schema.Schema{Type: schema.TypeString},
-							Set:         schema.HashString,
 							Description: "Resource tag key prefixes to ignore across all resources.",
 						},
 					},
@@ -158,6 +159,13 @@ func New(ctx context.Context) (*schema.Provider, error) {
 					"use virtual hosted bucket addressing when possible\n" +
 					"(https://BUCKET.s3.amazonaws.com/KEY). Specific to the Amazon S3 service.",
 			},
+			"s3_us_east_1_regional_endpoint": {
+				Type:     schema.TypeString,
+				Optional: true,
+				Description: "Specifies whether S3 API calls in the `us-east-1` region use the legacy global endpoint or a regional endpoint. " + //lintignore:AWSAT003
+					"Valid values are `legacy` or `regional`. " +
+					"Can also be configured using the `AWS_S3_US_EAST_1_REGIONAL_ENDPOINT` environment variable or the `s3_us_east_1_regional_endpoint` shared config file parameter",
+			},
 			"secret_key": {
 				Type:     schema.TypeString,
 				Optional: true,
@@ -236,7 +244,7 @@ func New(ctx context.Context) (*schema.Provider, error) {
 		return configure(ctx, provider, d)
 	}
 
-	var errs *multierror.Error
+	var errs []error
 	servicePackageMap := make(map[string]conns.ServicePackage)
 
 	for _, sp := range servicePackages(ctx) {
@@ -248,7 +256,7 @@ func New(ctx context.Context) (*schema.Provider, error) {
 			typeName := v.TypeName
 
 			if _, ok := provider.DataSourcesMap[typeName]; ok {
-				errs = multierror.Append(errs, fmt.Errorf("duplicate data source: %s", typeName))
+				errs = append(errs, fmt.Errorf("duplicate data source: %s", typeName))
 				continue
 			}
 
@@ -256,7 +264,7 @@ func New(ctx context.Context) (*schema.Provider, error) {
 
 			// Ensure that the correct CRUD handler variants are used.
 			if r.Read != nil || r.ReadContext != nil {
-				errs = multierror.Append(errs, fmt.Errorf("incorrect Read handler variant: %s", typeName))
+				errs = append(errs, fmt.Errorf("incorrect Read handler variant: %s", typeName))
 				continue
 			}
 
@@ -265,11 +273,37 @@ func New(ctx context.Context) (*schema.Provider, error) {
 				ctx = conns.NewDataSourceContext(ctx, servicePackageName, v.Name)
 				if v, ok := meta.(*conns.AWSClient); ok {
 					ctx = tftags.NewContext(ctx, v.DefaultTagsConfig, v.IgnoreTagsConfig)
+					ctx = v.RegisterLogger(ctx)
 				}
 
 				return ctx
 			}
 			interceptors := interceptorItems{}
+
+			if v.Tags != nil {
+				schema := r.SchemaMap()
+
+				// The data source has opted in to transparent tagging.
+				// Ensure that the schema look OK.
+				if v, ok := schema[names.AttrTags]; ok {
+					if !v.Computed {
+						errs = append(errs, fmt.Errorf("`%s` attribute must be Computed: %s", names.AttrTags, typeName))
+						continue
+					}
+				} else {
+					errs = append(errs, fmt.Errorf("no `%s` attribute defined in schema: %s", names.AttrTags, typeName))
+					continue
+				}
+
+				interceptors = append(interceptors, interceptorItem{
+					when: Before | After,
+					why:  Read,
+					interceptor: tagsDataSourceInterceptor{
+						tags: v.Tags,
+					},
+				})
+			}
+
 			ds := &wrappedDataSource{
 				bootstrapContext: bootstrapContext,
 				interceptors:     interceptors,
@@ -287,7 +321,7 @@ func New(ctx context.Context) (*schema.Provider, error) {
 			typeName := v.TypeName
 
 			if _, ok := provider.ResourcesMap[typeName]; ok {
-				errs = multierror.Append(errs, fmt.Errorf("duplicate resource: %s", typeName))
+				errs = append(errs, fmt.Errorf("duplicate resource: %s", typeName))
 				continue
 			}
 
@@ -295,19 +329,19 @@ func New(ctx context.Context) (*schema.Provider, error) {
 
 			// Ensure that the correct CRUD handler variants are used.
 			if r.Create != nil || r.CreateContext != nil {
-				errs = multierror.Append(errs, fmt.Errorf("incorrect Create handler variant: %s", typeName))
+				errs = append(errs, fmt.Errorf("incorrect Create handler variant: %s", typeName))
 				continue
 			}
 			if r.Read != nil || r.ReadContext != nil {
-				errs = multierror.Append(errs, fmt.Errorf("incorrect Read handler variant: %s", typeName))
+				errs = append(errs, fmt.Errorf("incorrect Read handler variant: %s", typeName))
 				continue
 			}
 			if r.Update != nil || r.UpdateContext != nil {
-				errs = multierror.Append(errs, fmt.Errorf("incorrect Update handler variant: %s", typeName))
+				errs = append(errs, fmt.Errorf("incorrect Update handler variant: %s", typeName))
 				continue
 			}
 			if r.Delete != nil || r.DeleteContext != nil {
-				errs = multierror.Append(errs, fmt.Errorf("incorrect Delete handler variant: %s", typeName))
+				errs = append(errs, fmt.Errorf("incorrect Delete handler variant: %s", typeName))
 				continue
 			}
 
@@ -316,6 +350,7 @@ func New(ctx context.Context) (*schema.Provider, error) {
 				ctx = conns.NewResourceContext(ctx, servicePackageName, v.Name)
 				if v, ok := meta.(*conns.AWSClient); ok {
 					ctx = tftags.NewContext(ctx, v.DefaultTagsConfig, v.IgnoreTagsConfig)
+					ctx = v.RegisterLogger(ctx)
 				}
 
 				return ctx
@@ -323,31 +358,33 @@ func New(ctx context.Context) (*schema.Provider, error) {
 			interceptors := interceptorItems{}
 
 			if v.Tags != nil {
+				schema := r.SchemaMap()
+
 				// The resource has opted in to transparent tagging.
 				// Ensure that the schema look OK.
-				if v, ok := r.Schema[names.AttrTags]; ok {
+				if v, ok := schema[names.AttrTags]; ok {
 					if v.Computed {
-						errs = multierror.Append(errs, fmt.Errorf("`%s` attribute cannot be Computed: %s", names.AttrTags, typeName))
+						errs = append(errs, fmt.Errorf("`%s` attribute cannot be Computed: %s", names.AttrTags, typeName))
 						continue
 					}
 				} else {
-					errs = multierror.Append(errs, fmt.Errorf("no `%s` attribute defined in schema: %s", names.AttrTags, typeName))
+					errs = append(errs, fmt.Errorf("no `%s` attribute defined in schema: %s", names.AttrTags, typeName))
 					continue
 				}
-				if v, ok := r.Schema[names.AttrTagsAll]; ok {
+				if v, ok := schema[names.AttrTagsAll]; ok {
 					if !v.Computed {
-						errs = multierror.Append(errs, fmt.Errorf("`%s` attribute must be Computed: %s", names.AttrTags, typeName))
+						errs = append(errs, fmt.Errorf("`%s` attribute must be Computed: %s", names.AttrTags, typeName))
 						continue
 					}
 				} else {
-					errs = multierror.Append(errs, fmt.Errorf("no `%s` attribute defined in schema: %s", names.AttrTagsAll, typeName))
+					errs = append(errs, fmt.Errorf("no `%s` attribute defined in schema: %s", names.AttrTagsAll, typeName))
 					continue
 				}
 
 				interceptors = append(interceptors, interceptorItem{
 					when: Before | After | Finally,
 					why:  Create | Read | Update,
-					interceptor: tagsInterceptor{
+					interceptor: tagsResourceInterceptor{
 						tags:       v.Tags,
 						updateFunc: tagsUpdateFunc,
 						readFunc:   tagsReadFunc,
@@ -390,7 +427,7 @@ func New(ctx context.Context) (*schema.Provider, error) {
 		}
 	}
 
-	if err := errs.ErrorOrNil(); err != nil {
+	if err := errors.Join(errs...); err != nil {
 		return nil, err
 	}
 
@@ -411,6 +448,8 @@ func New(ctx context.Context) (*schema.Provider, error) {
 
 // configure ensures that the provider is fully configured.
 func configure(ctx context.Context, provider *schema.Provider, d *schema.ResourceData) (*conns.AWSClient, diag.Diagnostics) {
+	var diags diag.Diagnostics
+
 	terraformVersion := provider.TerraformVersion
 	if terraformVersion == "" {
 		// Terraform 0.12 introduced this field to the protocol
@@ -444,11 +483,19 @@ func configure(ctx context.Context, provider *schema.Provider, d *schema.Resourc
 	if v, ok := d.Get("retry_mode").(string); ok && v != "" {
 		mode, err := aws.ParseRetryMode(v)
 		if err != nil {
-			return nil, diag.FromErr(err)
+			return nil, sdkdiag.AppendFromErr(diags, err)
 		}
 		config.RetryMode = mode
 	}
 
+	if v, ok := d.Get("s3_us_east_1_regional_endpoint").(string); ok && v != "" {
+		endpoint, err := endpoints.GetS3UsEast1RegionalEndpoint(v)
+		if err != nil {
+			return nil, sdkdiag.AppendFromErr(diags, err)
+		}
+		config.S3UsEast1RegionalEndpoint = endpoint
+	}
+
 	if v, ok := d.GetOk("allowed_account_ids"); ok && v.(*schema.Set).Len() > 0 {
 		config.AllowedAccountIds = flex.ExpandStringValueSet(v.(*schema.Set))
 	}
@@ -479,7 +526,7 @@ func configure(ctx context.Context, provider *schema.Provider, d *schema.Resourc
 		endpoints, err := expandEndpoints(ctx, v.(*schema.Set).List())
 
 		if err != nil {
-			return nil, diag.FromErr(err)
+			return nil, sdkdiag.AppendFromErr(diags, err)
 		}
 
 		config.Endpoints = endpoints
@@ -519,7 +566,8 @@ func configure(ctx context.Context, provider *schema.Provider, d *schema.Resourc
 	} else {
 		meta = new(conns.AWSClient)
 	}
-	meta, diags := config.ConfigureProvider(ctx, meta)
+	meta, ds := config.ConfigureProvider(ctx, meta)
+	diags = append(diags, ds...)
 
 	if diags.HasError() {
 		return nil, diags
@@ -547,7 +595,7 @@ func assumeRoleSchema() *schema.Schema {
 					Description: "A unique identifier that might be required when you assume a role in another account.",
 					ValidateFunc: validation.All(
 						validation.StringLenBetween(2, 1224),
-						validation.StringMatch(regexp.MustCompile(`[\w+=,.@:\/\-]*`), ""),
+						validation.StringMatch(regexache.MustCompile(`[\w+=,.@:\/\-]*`), ""),
 					),
 				},
 				"policy": {
diff --git a/internal/provider/provider_acc_test.go b/internal/provider/provider_acc_test.go
index 3c8bdd49389..8c7ec0fecbc 100644
--- a/internal/provider/provider_acc_test.go
+++ b/internal/provider/provider_acc_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package provider_test
 
 import (
@@ -772,12 +775,22 @@ func testAccCheckEndpoints(_ context.Context, p **schema.Provider) resource.Test
 
 		providerClient := (*p).Meta().(*conns.AWSClient)
 
-		for _, serviceKey := range names.ProviderPackages() {
-			method := reflect.ValueOf(providerClient).MethodByName(serviceConn(serviceKey))
+		for _, serviceKey := range names.Aliases() {
+			methodName := serviceConn(serviceKey)
+			method := reflect.ValueOf(providerClient).MethodByName(methodName)
 			if !method.IsValid() {
 				continue
 			}
-			result := method.Call([]reflect.Value{})
+			if method.Kind() != reflect.Func {
+				return fmt.Errorf("value %q is not a function", methodName)
+			}
+			if !funcHasConnFuncSignature(method) {
+				return fmt.Errorf("function %q does not match expected signature", methodName)
+			}
+
+			result := method.Call([]reflect.Value{
+				reflect.ValueOf(context.Background()),
+			})
 			if l := len(result); l != 1 {
 				return fmt.Errorf("expected 1 result, got %d", l)
 			}
@@ -811,7 +824,18 @@ func testAccCheckUnusualEndpoints(_ context.Context, p **schema.Provider, unusua
 
 		providerClient := (*p).Meta().(*conns.AWSClient)
 
-		result := reflect.ValueOf(providerClient).MethodByName(serviceConn(unusual.thing)).Call([]reflect.Value{})
+		methodName := serviceConn(unusual.thing)
+		method := reflect.ValueOf(providerClient).MethodByName(methodName)
+		if method.Kind() != reflect.Func {
+			return fmt.Errorf("value %q is not a function", methodName)
+		}
+		if !funcHasConnFuncSignature(method) {
+			return fmt.Errorf("function %q does not match expected signature", methodName)
+		}
+
+		result := method.Call([]reflect.Value{
+			reflect.ValueOf(context.Background()),
+		})
 		if l := len(result); l != 1 {
 			return fmt.Errorf("expected 1 result, got %d", l)
 		}
@@ -832,6 +856,18 @@ func testAccCheckUnusualEndpoints(_ context.Context, p **schema.Provider, unusua
 	}
 }
 
+func funcHasConnFuncSignature(method reflect.Value) bool {
+	typ := method.Type()
+	if typ.NumIn() != 1 {
+		return false
+	}
+
+	fn := func(ctx context.Context) {}
+	ftyp := reflect.TypeOf(fn)
+
+	return typ.In(0) == ftyp.In(0)
+}
+
 func serviceConn(key string) string {
 	serviceUpper := ""
 	var err error
diff --git a/internal/provider/provider_test.go b/internal/provider/provider_test.go
index 638780b0121..d1e02e09bba 100644
--- a/internal/provider/provider_test.go
+++ b/internal/provider/provider_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package provider
 
 import (
diff --git a/internal/provider/service_packages_gen.go b/internal/provider/service_packages_gen.go
index 5927e1aa609..93f1982554d 100644
--- a/internal/provider/service_packages_gen.go
+++ b/internal/provider/service_packages_gen.go
@@ -29,6 +29,7 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/service/autoscalingplans"
 	"github.com/hashicorp/terraform-provider-aws/internal/service/backup"
 	"github.com/hashicorp/terraform-provider-aws/internal/service/batch"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/bedrock"
 	"github.com/hashicorp/terraform-provider-aws/internal/service/budgets"
 	"github.com/hashicorp/terraform-provider-aws/internal/service/ce"
 	"github.com/hashicorp/terraform-provider-aws/internal/service/chime"
@@ -45,6 +46,7 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/service/cloudwatch"
 	"github.com/hashicorp/terraform-provider-aws/internal/service/codeartifact"
 	"github.com/hashicorp/terraform-provider-aws/internal/service/codebuild"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/codecatalyst"
 	"github.com/hashicorp/terraform-provider-aws/internal/service/codecommit"
 	"github.com/hashicorp/terraform-provider-aws/internal/service/codegurureviewer"
 	"github.com/hashicorp/terraform-provider-aws/internal/service/codepipeline"
@@ -125,6 +127,7 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/service/lakeformation"
 	"github.com/hashicorp/terraform-provider-aws/internal/service/lambda"
 	"github.com/hashicorp/terraform-provider-aws/internal/service/lexmodels"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/lexv2models"
 	"github.com/hashicorp/terraform-provider-aws/internal/service/licensemanager"
 	"github.com/hashicorp/terraform-provider-aws/internal/service/lightsail"
 	"github.com/hashicorp/terraform-provider-aws/internal/service/location"
@@ -201,6 +204,7 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/service/timestreamwrite"
 	"github.com/hashicorp/terraform-provider-aws/internal/service/transcribe"
 	"github.com/hashicorp/terraform-provider-aws/internal/service/transfer"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/verifiedpermissions"
 	"github.com/hashicorp/terraform-provider-aws/internal/service/vpclattice"
 	"github.com/hashicorp/terraform-provider-aws/internal/service/waf"
 	"github.com/hashicorp/terraform-provider-aws/internal/service/wafregional"
@@ -211,210 +215,214 @@ import (
 	"golang.org/x/exp/slices"
 )
 
-func servicePackages(context.Context) []conns.ServicePackage {
+func servicePackages(ctx context.Context) []conns.ServicePackage {
 	v := []conns.ServicePackage{
-		accessanalyzer.ServicePackage,
-		account.ServicePackage,
-		acm.ServicePackage,
-		acmpca.ServicePackage,
-		amp.ServicePackage,
-		amplify.ServicePackage,
-		apigateway.ServicePackage,
-		apigatewayv2.ServicePackage,
-		appautoscaling.ServicePackage,
-		appconfig.ServicePackage,
-		appflow.ServicePackage,
-		appintegrations.ServicePackage,
-		applicationinsights.ServicePackage,
-		appmesh.ServicePackage,
-		apprunner.ServicePackage,
-		appstream.ServicePackage,
-		appsync.ServicePackage,
-		athena.ServicePackage,
-		auditmanager.ServicePackage,
-		autoscaling.ServicePackage,
-		autoscalingplans.ServicePackage,
-		backup.ServicePackage,
-		batch.ServicePackage,
-		budgets.ServicePackage,
-		ce.ServicePackage,
-		chime.ServicePackage,
-		chimesdkmediapipelines.ServicePackage,
-		chimesdkvoice.ServicePackage,
-		cleanrooms.ServicePackage,
-		cloud9.ServicePackage,
-		cloudcontrol.ServicePackage,
-		cloudformation.ServicePackage,
-		cloudfront.ServicePackage,
-		cloudhsmv2.ServicePackage,
-		cloudsearch.ServicePackage,
-		cloudtrail.ServicePackage,
-		cloudwatch.ServicePackage,
-		codeartifact.ServicePackage,
-		codebuild.ServicePackage,
-		codecommit.ServicePackage,
-		codegurureviewer.ServicePackage,
-		codepipeline.ServicePackage,
-		codestarconnections.ServicePackage,
-		codestarnotifications.ServicePackage,
-		cognitoidentity.ServicePackage,
-		cognitoidp.ServicePackage,
-		comprehend.ServicePackage,
-		computeoptimizer.ServicePackage,
-		configservice.ServicePackage,
-		connect.ServicePackage,
-		controltower.ServicePackage,
-		cur.ServicePackage,
-		dataexchange.ServicePackage,
-		datapipeline.ServicePackage,
-		datasync.ServicePackage,
-		dax.ServicePackage,
-		deploy.ServicePackage,
-		detective.ServicePackage,
-		devicefarm.ServicePackage,
-		directconnect.ServicePackage,
-		dlm.ServicePackage,
-		dms.ServicePackage,
-		docdb.ServicePackage,
-		docdbelastic.ServicePackage,
-		ds.ServicePackage,
-		dynamodb.ServicePackage,
-		ec2.ServicePackage,
-		ecr.ServicePackage,
-		ecrpublic.ServicePackage,
-		ecs.ServicePackage,
-		efs.ServicePackage,
-		eks.ServicePackage,
-		elasticache.ServicePackage,
-		elasticbeanstalk.ServicePackage,
-		elasticsearch.ServicePackage,
-		elastictranscoder.ServicePackage,
-		elb.ServicePackage,
-		elbv2.ServicePackage,
-		emr.ServicePackage,
-		emrcontainers.ServicePackage,
-		emrserverless.ServicePackage,
-		events.ServicePackage,
-		evidently.ServicePackage,
-		finspace.ServicePackage,
-		firehose.ServicePackage,
-		fis.ServicePackage,
-		fms.ServicePackage,
-		fsx.ServicePackage,
-		gamelift.ServicePackage,
-		glacier.ServicePackage,
-		globalaccelerator.ServicePackage,
-		glue.ServicePackage,
-		grafana.ServicePackage,
-		greengrass.ServicePackage,
-		guardduty.ServicePackage,
-		healthlake.ServicePackage,
-		iam.ServicePackage,
-		identitystore.ServicePackage,
-		imagebuilder.ServicePackage,
-		inspector.ServicePackage,
-		inspector2.ServicePackage,
-		internetmonitor.ServicePackage,
-		iot.ServicePackage,
-		iotanalytics.ServicePackage,
-		iotevents.ServicePackage,
-		ivs.ServicePackage,
-		ivschat.ServicePackage,
-		kafka.ServicePackage,
-		kafkaconnect.ServicePackage,
-		kendra.ServicePackage,
-		keyspaces.ServicePackage,
-		kinesis.ServicePackage,
-		kinesisanalytics.ServicePackage,
-		kinesisanalyticsv2.ServicePackage,
-		kinesisvideo.ServicePackage,
-		kms.ServicePackage,
-		lakeformation.ServicePackage,
-		lambda.ServicePackage,
-		lexmodels.ServicePackage,
-		licensemanager.ServicePackage,
-		lightsail.ServicePackage,
-		location.ServicePackage,
-		logs.ServicePackage,
-		macie2.ServicePackage,
-		mediaconnect.ServicePackage,
-		mediaconvert.ServicePackage,
-		medialive.ServicePackage,
-		mediapackage.ServicePackage,
-		mediastore.ServicePackage,
-		memorydb.ServicePackage,
-		meta.ServicePackage,
-		mq.ServicePackage,
-		mwaa.ServicePackage,
-		neptune.ServicePackage,
-		networkfirewall.ServicePackage,
-		networkmanager.ServicePackage,
-		oam.ServicePackage,
-		opensearch.ServicePackage,
-		opensearchserverless.ServicePackage,
-		opsworks.ServicePackage,
-		organizations.ServicePackage,
-		outposts.ServicePackage,
-		pinpoint.ServicePackage,
-		pipes.ServicePackage,
-		pricing.ServicePackage,
-		qldb.ServicePackage,
-		quicksight.ServicePackage,
-		ram.ServicePackage,
-		rbin.ServicePackage,
-		rds.ServicePackage,
-		redshift.ServicePackage,
-		redshiftdata.ServicePackage,
-		redshiftserverless.ServicePackage,
-		resourceexplorer2.ServicePackage,
-		resourcegroups.ServicePackage,
-		resourcegroupstaggingapi.ServicePackage,
-		rolesanywhere.ServicePackage,
-		route53.ServicePackage,
-		route53domains.ServicePackage,
-		route53recoverycontrolconfig.ServicePackage,
-		route53recoveryreadiness.ServicePackage,
-		route53resolver.ServicePackage,
-		rum.ServicePackage,
-		s3.ServicePackage,
-		s3control.ServicePackage,
-		s3outposts.ServicePackage,
-		sagemaker.ServicePackage,
-		scheduler.ServicePackage,
-		schemas.ServicePackage,
-		secretsmanager.ServicePackage,
-		securityhub.ServicePackage,
-		securitylake.ServicePackage,
-		serverlessrepo.ServicePackage,
-		servicecatalog.ServicePackage,
-		servicediscovery.ServicePackage,
-		servicequotas.ServicePackage,
-		ses.ServicePackage,
-		sesv2.ServicePackage,
-		sfn.ServicePackage,
-		shield.ServicePackage,
-		signer.ServicePackage,
-		simpledb.ServicePackage,
-		sns.ServicePackage,
-		sqs.ServicePackage,
-		ssm.ServicePackage,
-		ssmcontacts.ServicePackage,
-		ssmincidents.ServicePackage,
-		ssoadmin.ServicePackage,
-		storagegateway.ServicePackage,
-		sts.ServicePackage,
-		swf.ServicePackage,
-		synthetics.ServicePackage,
-		timestreamwrite.ServicePackage,
-		transcribe.ServicePackage,
-		transfer.ServicePackage,
-		vpclattice.ServicePackage,
-		waf.ServicePackage,
-		wafregional.ServicePackage,
-		wafv2.ServicePackage,
-		worklink.ServicePackage,
-		workspaces.ServicePackage,
-		xray.ServicePackage,
+		accessanalyzer.ServicePackage(ctx),
+		account.ServicePackage(ctx),
+		acm.ServicePackage(ctx),
+		acmpca.ServicePackage(ctx),
+		amp.ServicePackage(ctx),
+		amplify.ServicePackage(ctx),
+		apigateway.ServicePackage(ctx),
+		apigatewayv2.ServicePackage(ctx),
+		appautoscaling.ServicePackage(ctx),
+		appconfig.ServicePackage(ctx),
+		appflow.ServicePackage(ctx),
+		appintegrations.ServicePackage(ctx),
+		applicationinsights.ServicePackage(ctx),
+		appmesh.ServicePackage(ctx),
+		apprunner.ServicePackage(ctx),
+		appstream.ServicePackage(ctx),
+		appsync.ServicePackage(ctx),
+		athena.ServicePackage(ctx),
+		auditmanager.ServicePackage(ctx),
+		autoscaling.ServicePackage(ctx),
+		autoscalingplans.ServicePackage(ctx),
+		backup.ServicePackage(ctx),
+		batch.ServicePackage(ctx),
+		bedrock.ServicePackage(ctx),
+		budgets.ServicePackage(ctx),
+		ce.ServicePackage(ctx),
+		chime.ServicePackage(ctx),
+		chimesdkmediapipelines.ServicePackage(ctx),
+		chimesdkvoice.ServicePackage(ctx),
+		cleanrooms.ServicePackage(ctx),
+		cloud9.ServicePackage(ctx),
+		cloudcontrol.ServicePackage(ctx),
+		cloudformation.ServicePackage(ctx),
+		cloudfront.ServicePackage(ctx),
+		cloudhsmv2.ServicePackage(ctx),
+		cloudsearch.ServicePackage(ctx),
+		cloudtrail.ServicePackage(ctx),
+		cloudwatch.ServicePackage(ctx),
+		codeartifact.ServicePackage(ctx),
+		codebuild.ServicePackage(ctx),
+		codecatalyst.ServicePackage(ctx),
+		codecommit.ServicePackage(ctx),
+		codegurureviewer.ServicePackage(ctx),
+		codepipeline.ServicePackage(ctx),
+		codestarconnections.ServicePackage(ctx),
+		codestarnotifications.ServicePackage(ctx),
+		cognitoidentity.ServicePackage(ctx),
+		cognitoidp.ServicePackage(ctx),
+		comprehend.ServicePackage(ctx),
+		computeoptimizer.ServicePackage(ctx),
+		configservice.ServicePackage(ctx),
+		connect.ServicePackage(ctx),
+		controltower.ServicePackage(ctx),
+		cur.ServicePackage(ctx),
+		dataexchange.ServicePackage(ctx),
+		datapipeline.ServicePackage(ctx),
+		datasync.ServicePackage(ctx),
+		dax.ServicePackage(ctx),
+		deploy.ServicePackage(ctx),
+		detective.ServicePackage(ctx),
+		devicefarm.ServicePackage(ctx),
+		directconnect.ServicePackage(ctx),
+		dlm.ServicePackage(ctx),
+		dms.ServicePackage(ctx),
+		docdb.ServicePackage(ctx),
+		docdbelastic.ServicePackage(ctx),
+		ds.ServicePackage(ctx),
+		dynamodb.ServicePackage(ctx),
+		ec2.ServicePackage(ctx),
+		ecr.ServicePackage(ctx),
+		ecrpublic.ServicePackage(ctx),
+		ecs.ServicePackage(ctx),
+		efs.ServicePackage(ctx),
+		eks.ServicePackage(ctx),
+		elasticache.ServicePackage(ctx),
+		elasticbeanstalk.ServicePackage(ctx),
+		elasticsearch.ServicePackage(ctx),
+		elastictranscoder.ServicePackage(ctx),
+		elb.ServicePackage(ctx),
+		elbv2.ServicePackage(ctx),
+		emr.ServicePackage(ctx),
+		emrcontainers.ServicePackage(ctx),
+		emrserverless.ServicePackage(ctx),
+		events.ServicePackage(ctx),
+		evidently.ServicePackage(ctx),
+		finspace.ServicePackage(ctx),
+		firehose.ServicePackage(ctx),
+		fis.ServicePackage(ctx),
+		fms.ServicePackage(ctx),
+		fsx.ServicePackage(ctx),
+		gamelift.ServicePackage(ctx),
+		glacier.ServicePackage(ctx),
+		globalaccelerator.ServicePackage(ctx),
+		glue.ServicePackage(ctx),
+		grafana.ServicePackage(ctx),
+		greengrass.ServicePackage(ctx),
+		guardduty.ServicePackage(ctx),
+		healthlake.ServicePackage(ctx),
+		iam.ServicePackage(ctx),
+		identitystore.ServicePackage(ctx),
+		imagebuilder.ServicePackage(ctx),
+		inspector.ServicePackage(ctx),
+		inspector2.ServicePackage(ctx),
+		internetmonitor.ServicePackage(ctx),
+		iot.ServicePackage(ctx),
+		iotanalytics.ServicePackage(ctx),
+		iotevents.ServicePackage(ctx),
+		ivs.ServicePackage(ctx),
+		ivschat.ServicePackage(ctx),
+		kafka.ServicePackage(ctx),
+		kafkaconnect.ServicePackage(ctx),
+		kendra.ServicePackage(ctx),
+		keyspaces.ServicePackage(ctx),
+		kinesis.ServicePackage(ctx),
+		kinesisanalytics.ServicePackage(ctx),
+		kinesisanalyticsv2.ServicePackage(ctx),
+		kinesisvideo.ServicePackage(ctx),
+		kms.ServicePackage(ctx),
+		lakeformation.ServicePackage(ctx),
+		lambda.ServicePackage(ctx),
+		lexmodels.ServicePackage(ctx),
+		lexv2models.ServicePackage(ctx),
+		licensemanager.ServicePackage(ctx),
+		lightsail.ServicePackage(ctx),
+		location.ServicePackage(ctx),
+		logs.ServicePackage(ctx),
+		macie2.ServicePackage(ctx),
+		mediaconnect.ServicePackage(ctx),
+		mediaconvert.ServicePackage(ctx),
+		medialive.ServicePackage(ctx),
+		mediapackage.ServicePackage(ctx),
+		mediastore.ServicePackage(ctx),
+		memorydb.ServicePackage(ctx),
+		meta.ServicePackage(ctx),
+		mq.ServicePackage(ctx),
+		mwaa.ServicePackage(ctx),
+		neptune.ServicePackage(ctx),
+		networkfirewall.ServicePackage(ctx),
+		networkmanager.ServicePackage(ctx),
+		oam.ServicePackage(ctx),
+		opensearch.ServicePackage(ctx),
+		opensearchserverless.ServicePackage(ctx),
+		opsworks.ServicePackage(ctx),
+		organizations.ServicePackage(ctx),
+		outposts.ServicePackage(ctx),
+		pinpoint.ServicePackage(ctx),
+		pipes.ServicePackage(ctx),
+		pricing.ServicePackage(ctx),
+		qldb.ServicePackage(ctx),
+		quicksight.ServicePackage(ctx),
+		ram.ServicePackage(ctx),
+		rbin.ServicePackage(ctx),
+		rds.ServicePackage(ctx),
+		redshift.ServicePackage(ctx),
+		redshiftdata.ServicePackage(ctx),
+		redshiftserverless.ServicePackage(ctx),
+		resourceexplorer2.ServicePackage(ctx),
+		resourcegroups.ServicePackage(ctx),
+		resourcegroupstaggingapi.ServicePackage(ctx),
+		rolesanywhere.ServicePackage(ctx),
+		route53.ServicePackage(ctx),
+		route53domains.ServicePackage(ctx),
+		route53recoverycontrolconfig.ServicePackage(ctx),
+		route53recoveryreadiness.ServicePackage(ctx),
+		route53resolver.ServicePackage(ctx),
+		rum.ServicePackage(ctx),
+		s3.ServicePackage(ctx),
+		s3control.ServicePackage(ctx),
+		s3outposts.ServicePackage(ctx),
+		sagemaker.ServicePackage(ctx),
+		scheduler.ServicePackage(ctx),
+		schemas.ServicePackage(ctx),
+		secretsmanager.ServicePackage(ctx),
+		securityhub.ServicePackage(ctx),
+		securitylake.ServicePackage(ctx),
+		serverlessrepo.ServicePackage(ctx),
+		servicecatalog.ServicePackage(ctx),
+		servicediscovery.ServicePackage(ctx),
+		servicequotas.ServicePackage(ctx),
+		ses.ServicePackage(ctx),
+		sesv2.ServicePackage(ctx),
+		sfn.ServicePackage(ctx),
+		shield.ServicePackage(ctx),
+		signer.ServicePackage(ctx),
+		simpledb.ServicePackage(ctx),
+		sns.ServicePackage(ctx),
+		sqs.ServicePackage(ctx),
+		ssm.ServicePackage(ctx),
+		ssmcontacts.ServicePackage(ctx),
+		ssmincidents.ServicePackage(ctx),
+		ssoadmin.ServicePackage(ctx),
+		storagegateway.ServicePackage(ctx),
+		sts.ServicePackage(ctx),
+		swf.ServicePackage(ctx),
+		synthetics.ServicePackage(ctx),
+		timestreamwrite.ServicePackage(ctx),
+		transcribe.ServicePackage(ctx),
+		transfer.ServicePackage(ctx),
+		verifiedpermissions.ServicePackage(ctx),
+		vpclattice.ServicePackage(ctx),
+		waf.ServicePackage(ctx),
+		wafregional.ServicePackage(ctx),
+		wafv2.ServicePackage(ctx),
+		worklink.ServicePackage(ctx),
+		workspaces.ServicePackage(ctx),
+		xray.ServicePackage(ctx),
 	}
 
 	return slices.Clone(v)
diff --git a/internal/provider/tags_interceptor.go b/internal/provider/tags_interceptor.go
index 23ce0a8b7b0..5654f34f331 100644
--- a/internal/provider/tags_interceptor.go
+++ b/internal/provider/tags_interceptor.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package provider
 
 import (
@@ -53,20 +56,21 @@ func tagsUpdateFunc(ctx context.Context, d schemaResourceData, sp conns.ServiceP
 	stateTags := make(map[string]string)
 	if state := d.GetRawState(); !state.IsNull() && state.IsKnown() {
 		s := state.GetAttr(names.AttrTagsAll)
-		for k, v := range s.AsValueMap() {
-			stateTags[k] = v.AsString()
+		if !s.IsNull() {
+			for k, v := range s.AsValueMap() {
+				if !v.IsNull() {
+					stateTags[k] = v.AsString()
+				}
+			}
 		}
 	}
 
-	tagsAll := tftags.New(ctx, stateTags)
+	oldTags := tftags.New(ctx, stateTags)
 	// if tags_all was computed because not wholly known
 	// Merge the resource's configured tags with any provider configured default_tags.
-	configAll := tagsInContext.DefaultConfig.MergeTags(tftags.New(ctx, configTags))
+	newTags := tagsInContext.DefaultConfig.MergeTags(tftags.New(ctx, configTags))
 	// Remove system tags.
-	configAll = configAll.IgnoreSystem(inContext.ServicePackageName)
-
-	toAdd := configAll.Difference(tagsAll)
-	toRemove := tagsAll.Difference(configAll)
+	newTags = newTags.IgnoreSystem(inContext.ServicePackageName)
 
 	// If the service package has a generic resource update tags methods, call it.
 	var err error
@@ -74,11 +78,11 @@ func tagsUpdateFunc(ctx context.Context, d schemaResourceData, sp conns.ServiceP
 	if v, ok := sp.(interface {
 		UpdateTags(context.Context, any, string, any, any) error
 	}); ok {
-		err = v.UpdateTags(ctx, meta, identifier, toRemove, toAdd)
+		err = v.UpdateTags(ctx, meta, identifier, oldTags, newTags)
 	} else if v, ok := sp.(interface {
 		UpdateTags(context.Context, any, string, string, any, any) error
 	}); ok && spt.ResourceType != "" {
-		err = v.UpdateTags(ctx, meta, identifier, spt.ResourceType, toRemove, toAdd)
+		err = v.UpdateTags(ctx, meta, identifier, spt.ResourceType, oldTags, newTags)
 	}
 
 	// ISO partitions may not support tagging, giving error.
diff --git a/internal/provider/tags_interceptor_test.go b/internal/provider/tags_interceptor_test.go
index 8eb3449db4d..feb3bccb56b 100644
--- a/internal/provider/tags_interceptor_test.go
+++ b/internal/provider/tags_interceptor_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package provider
 
 import (
@@ -49,7 +52,7 @@ func (t *mockService) UpdateTags(context.Context, any, string, string, any) erro
 	return nil
 }
 
-func TestTagsInterceptor(t *testing.T) {
+func TestTagsResourceInterceptor(t *testing.T) {
 	t.Parallel()
 
 	var interceptors interceptorItems
@@ -58,7 +61,7 @@ func TestTagsInterceptor(t *testing.T) {
 		IdentifierAttribute: "id",
 	}
 
-	tags := tagsInterceptor{
+	tags := tagsResourceInterceptor{
 		tags:       sp,
 		updateFunc: tagsUpdateFunc,
 		readFunc:   tagsReadFunc,
diff --git a/internal/provider/validate.go b/internal/provider/validate.go
index 46d221f85a5..57f9ea8b3b3 100644
--- a/internal/provider/validate.go
+++ b/internal/provider/validate.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package provider
 
 import (
 	"fmt"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 )
 
@@ -27,10 +30,10 @@ func validAssumeRoleDuration(v interface{}, k string) (ws []string, errors []err
 
 var validAssumeRoleSessionName = validation.All(
 	validation.StringLenBetween(2, 64),
-	validation.StringMatch(regexp.MustCompile(`[\w+=,.@\-]*`), ""),
+	validation.StringMatch(regexache.MustCompile(`[\w+=,.@\-]*`), ""),
 )
 
 var validAssumeRoleSourceIdentity = validation.All(
 	validation.StringLenBetween(2, 64),
-	validation.StringMatch(regexp.MustCompile(`[\w+=,.@\-]*`), ""),
+	validation.StringMatch(regexache.MustCompile(`[\w+=,.@\-]*`), ""),
 )
diff --git a/internal/provider/validate_test.go b/internal/provider/validate_test.go
index 9b068e00e52..ef022e3a5d2 100644
--- a/internal/provider/validate_test.go
+++ b/internal/provider/validate_test.go
@@ -1,8 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package provider
 
 import (
 	"regexp"
 	"testing"
+
+	"github.com/YakDriver/regexache"
 )
 
 func TestValidAssumeRoleDuration(t *testing.T) {
@@ -14,19 +19,19 @@ func TestValidAssumeRoleDuration(t *testing.T) {
 	}{
 		{
 			val:         "",
-			expectedErr: regexp.MustCompile(`cannot be parsed as a duration`),
+			expectedErr: regexache.MustCompile(`cannot be parsed as a duration`),
 		},
 		{
 			val:         "1",
-			expectedErr: regexp.MustCompile(`cannot be parsed as a duration`),
+			expectedErr: regexache.MustCompile(`cannot be parsed as a duration`),
 		},
 		{
 			val:         "10m",
-			expectedErr: regexp.MustCompile(`must be between 15 minutes \(15m\) and 12 hours \(12h\)`),
+			expectedErr: regexache.MustCompile(`must be between 15 minutes \(15m\) and 12 hours \(12h\)`),
 		},
 		{
 			val:         "12h30m",
-			expectedErr: regexp.MustCompile(`must be between 15 minutes \(15m\) and 12 hours \(12h\)`),
+			expectedErr: regexache.MustCompile(`must be between 15 minutes \(15m\) and 12 hours \(12h\)`),
 		},
 		{
 
diff --git a/internal/sdktypes/duration.go b/internal/sdktypes/duration.go
index 38b135a7ab4..01db216661a 100644
--- a/internal/sdktypes/duration.go
+++ b/internal/sdktypes/duration.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sdktypes
 
 import (
diff --git a/internal/sdktypes/duration_test.go b/internal/sdktypes/duration_test.go
index 538787c3a21..0ad25003a50 100644
--- a/internal/sdktypes/duration_test.go
+++ b/internal/sdktypes/duration_test.go
@@ -1,9 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sdktypes
 
 import (
-	"regexp"
 	"testing"
 	"time"
+
+	"github.com/YakDriver/regexache"
 )
 
 func TestDuration(t *testing.T) {
@@ -67,14 +71,14 @@ func TestValidationDuration(t *testing.T) {
 		"invalid": {
 			val:             "A",
 			f:               ValidateDuration,
-			expectedSummary: regexp.MustCompile(`^Invalid value$`),
-			expectedDetail:  regexp.MustCompile(`time: invalid duration "A"`),
+			expectedSummary: regexache.MustCompile(`^Invalid value$`),
+			expectedDetail:  regexache.MustCompile(`time: invalid duration "A"`),
 		},
 		"wrong type": {
 			val:             1,
 			f:               ValidateDuration,
-			expectedSummary: regexp.MustCompile(`^Invalid value type$`),
-			expectedDetail:  regexp.MustCompile(`Expected type to be string`),
+			expectedSummary: regexache.MustCompile(`^Invalid value type$`),
+			expectedDetail:  regexache.MustCompile(`Expected type to be string`),
 		},
 	})
 }
@@ -90,26 +94,26 @@ func TestValidationDurationBetween(t *testing.T) {
 		"duration too big": {
 			val:             "10h",
 			f:               ValidateDurationBetween(10*time.Second, 2*time.Hour),
-			expectedSummary: regexp.MustCompile(`^Invalid value$`),
-			expectedDetail:  regexp.MustCompile(`Expected to be in the range \(10000000000 - 7200000000000\)`),
+			expectedSummary: regexache.MustCompile(`^Invalid value$`),
+			expectedDetail:  regexache.MustCompile(`Expected to be in the range \(10000000000 - 7200000000000\)`),
 		},
 		"duration too small": {
 			val:             "2s",
 			f:               ValidateDurationBetween(10*time.Second, 2*time.Hour),
-			expectedSummary: regexp.MustCompile(`^Invalid value$`),
-			expectedDetail:  regexp.MustCompile(`Expected to be in the range \(10000000000 - 7200000000000\)`),
+			expectedSummary: regexache.MustCompile(`^Invalid value$`),
+			expectedDetail:  regexache.MustCompile(`Expected to be in the range \(10000000000 - 7200000000000\)`),
 		},
 		"invalid duration format": {
 			val:             "A",
 			f:               ValidateDurationBetween(10*time.Second, 2*time.Hour),
-			expectedSummary: regexp.MustCompile(`^Invalid value$`),
-			expectedDetail:  regexp.MustCompile(`time: invalid duration "A"`),
+			expectedSummary: regexache.MustCompile(`^Invalid value$`),
+			expectedDetail:  regexache.MustCompile(`time: invalid duration "A"`),
 		},
 		"wrong type": {
 			val:             1,
 			f:               ValidateDurationBetween(10*time.Second, 2*time.Hour),
-			expectedSummary: regexp.MustCompile(`^Invalid value type$`),
-			expectedDetail:  regexp.MustCompile(`Expected type to be string`),
+			expectedSummary: regexache.MustCompile(`^Invalid value type$`),
+			expectedDetail:  regexache.MustCompile(`Expected type to be string`),
 		},
 	})
 }
diff --git a/internal/sdktypes/rfc3339_duration.go b/internal/sdktypes/rfc3339_duration.go
index d270b682fca..a0d397a4026 100644
--- a/internal/sdktypes/rfc3339_duration.go
+++ b/internal/sdktypes/rfc3339_duration.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sdktypes
 
 import (
diff --git a/internal/sdktypes/testing_test.go b/internal/sdktypes/testing_test.go
index df642b4b3a8..c01810f20bc 100644
--- a/internal/sdktypes/testing_test.go
+++ b/internal/sdktypes/testing_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sdktypes
 
 import (
diff --git a/internal/service/accessanalyzer/accessanalyzer_test.go b/internal/service/accessanalyzer/accessanalyzer_test.go
index ad433cccc37..113263f09cb 100644
--- a/internal/service/accessanalyzer/accessanalyzer_test.go
+++ b/internal/service/accessanalyzer/accessanalyzer_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package accessanalyzer_test
 
 import (
diff --git a/internal/service/accessanalyzer/analyzer.go b/internal/service/accessanalyzer/analyzer.go
index 3352f292ef4..a84994c3a86 100644
--- a/internal/service/accessanalyzer/analyzer.go
+++ b/internal/service/accessanalyzer/analyzer.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package accessanalyzer
 
 import (
 	"context"
 	"log"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/accessanalyzer"
 	"github.com/aws/aws-sdk-go-v2/service/accessanalyzer/types"
@@ -52,7 +55,7 @@ func resourceAnalyzer() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 255),
-					validation.StringMatch(regexp.MustCompile(`^[A-Za-z][A-Za-z0-9_.-]*$`), "must begin with a letter and contain only alphanumeric, underscore, period, or hyphen characters"),
+					validation.StringMatch(regexache.MustCompile(`^[A-Za-z][0-9A-Za-z_.-]*$`), "must begin with a letter and contain only alphanumeric, underscore, period, or hyphen characters"),
 				),
 			},
 			"arn": {
diff --git a/internal/service/accessanalyzer/analyzer_test.go b/internal/service/accessanalyzer/analyzer_test.go
index 81605f5d8d9..450ae360ec5 100644
--- a/internal/service/accessanalyzer/analyzer_test.go
+++ b/internal/service/accessanalyzer/analyzer_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package accessanalyzer_test
 
 import (
diff --git a/internal/service/accessanalyzer/archive_rule.go b/internal/service/accessanalyzer/archive_rule.go
index bb8f77df114..f86f1903060 100644
--- a/internal/service/accessanalyzer/archive_rule.go
+++ b/internal/service/accessanalyzer/archive_rule.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package accessanalyzer
 
 import (
@@ -16,9 +19,9 @@ import (
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs"
-	"github.com/hashicorp/terraform-provider-aws/internal/experimental/nullable"
 	"github.com/hashicorp/terraform-provider-aws/internal/flex"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/internal/types/nullable"
 )
 
 // @SDKResource("aws_accessanalyzer_archive_rule")
diff --git a/internal/service/accessanalyzer/archive_rule_test.go b/internal/service/accessanalyzer/archive_rule_test.go
index 308e36b1aa4..82b20b889ff 100644
--- a/internal/service/accessanalyzer/archive_rule_test.go
+++ b/internal/service/accessanalyzer/archive_rule_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package accessanalyzer_test
 
 import (
diff --git a/internal/service/accessanalyzer/exports_test.go b/internal/service/accessanalyzer/exports_test.go
index 84ae619ccd0..4d87a2c580b 100644
--- a/internal/service/accessanalyzer/exports_test.go
+++ b/internal/service/accessanalyzer/exports_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package accessanalyzer
 
 // Exports for use in tests only.
diff --git a/internal/service/accessanalyzer/generate.go b/internal/service/accessanalyzer/generate.go
index eafe9c56978..947fe563087 100644
--- a/internal/service/accessanalyzer/generate.go
+++ b/internal/service/accessanalyzer/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -AWSSDKVersion=2 -ListTags -ServiceTagsMap -UpdateTags -KVTValues -SkipTypesImp
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/accessanalyzer/service_package_gen.go b/internal/service/accessanalyzer/service_package_gen.go
index fc872199638..a15c412b00a 100644
--- a/internal/service/accessanalyzer/service_package_gen.go
+++ b/internal/service/accessanalyzer/service_package_gen.go
@@ -7,6 +7,7 @@ import (
 
 	aws_sdkv2 "github.com/aws/aws-sdk-go-v2/aws"
 	accessanalyzer_sdkv2 "github.com/aws/aws-sdk-go-v2/service/accessanalyzer"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -52,9 +53,11 @@ func (p *servicePackage) NewClient(ctx context.Context, config map[string]any) (
 
 	return accessanalyzer_sdkv2.NewFromConfig(cfg, func(o *accessanalyzer_sdkv2.Options) {
 		if endpoint := config["endpoint"].(string); endpoint != "" {
-			o.EndpointResolver = accessanalyzer_sdkv2.EndpointResolverFromURL(endpoint)
+			o.BaseEndpoint = aws_sdkv2.String(endpoint)
 		}
 	}), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/accessanalyzer/sweep.go b/internal/service/accessanalyzer/sweep.go
index 36bd7865ed2..abdd4c642d5 100644
--- a/internal/service/accessanalyzer/sweep.go
+++ b/internal/service/accessanalyzer/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package accessanalyzer
 
@@ -11,9 +11,10 @@ import (
 	"github.com/aws/aws-sdk-go-v2/service/accessanalyzer"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv2"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_accessanalyzer_analyzer", &resource.Sweeper{
 		Name: "aws_accessanalyzer_analyzer",
 		F:    sweepAnalyzers,
@@ -22,7 +23,7 @@ func init() {
 
 func sweepAnalyzers(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("getting client: %s", err)
 	}
@@ -34,7 +35,7 @@ func sweepAnalyzers(region string) error {
 	for pages.HasMorePages() {
 		page, err := pages.NextPage(ctx)
 
-		if sweep.SkipSweepError(err) {
+		if awsv2.SkipSweepError(err) {
 			log.Printf("[WARN] Skipping IAM Access Analyzer Analyzer sweep for %s: %s", region, err)
 			return nil
 		}
@@ -52,7 +53,7 @@ func sweepAnalyzers(region string) error {
 		}
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("sweeping IAM Access Analyzer Analyzers (%s): %w", region, err)
diff --git a/internal/service/accessanalyzer/tags_gen.go b/internal/service/accessanalyzer/tags_gen.go
index f8cfe375464..2376f6ad668 100644
--- a/internal/service/accessanalyzer/tags_gen.go
+++ b/internal/service/accessanalyzer/tags_gen.go
@@ -7,7 +7,9 @@ import (
 
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/accessanalyzer"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -53,7 +55,7 @@ func Tags(tags tftags.KeyValueTags) map[string]string {
 	return tags.Map()
 }
 
-// KeyValueTags creates KeyValueTags from accessanalyzer service tags.
+// KeyValueTags creates tftags.KeyValueTags from accessanalyzer service tags.
 func KeyValueTags(ctx context.Context, tags map[string]string) tftags.KeyValueTags {
 	return tftags.New(ctx, tags)
 }
@@ -84,6 +86,8 @@ func updateTags(ctx context.Context, conn *accessanalyzer.Client, identifier str
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.AccessAnalyzer)
 	if len(removedTags) > 0 {
diff --git a/internal/service/account/account_test.go b/internal/service/account/account_test.go
index d4664cd9fb5..0f6b6166303 100644
--- a/internal/service/account/account_test.go
+++ b/internal/service/account/account_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package account_test
 
 import (
diff --git a/internal/service/account/alternate_contact.go b/internal/service/account/alternate_contact.go
index 80b3e912e1a..ebea2b6f29a 100644
--- a/internal/service/account/alternate_contact.go
+++ b/internal/service/account/alternate_contact.go
@@ -1,13 +1,16 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package account
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"strings"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/account"
 	"github.com/aws/aws-sdk-go-v2/service/account/types"
@@ -57,7 +60,7 @@ func resourceAlternateContact() *schema.Resource {
 			"email_address": {
 				Type:         schema.TypeString,
 				Required:     true,
-				ValidateFunc: validation.StringMatch(regexp.MustCompile(`[\w+=,.-]+@[\w.-]+\.[\w]+`), "must be a valid email address"),
+				ValidateFunc: validation.StringMatch(regexache.MustCompile(`[\w+=,.-]+@[\w.-]+\.[\w]+`), "must be a valid email address"),
 			},
 			"name": {
 				Type:         schema.TypeString,
@@ -67,7 +70,7 @@ func resourceAlternateContact() *schema.Resource {
 			"phone_number": {
 				Type:         schema.TypeString,
 				Required:     true,
-				ValidateFunc: validation.StringMatch(regexp.MustCompile(`^[\s0-9()+-]+$`), "must be a valid phone number"),
+				ValidateFunc: validation.StringMatch(regexache.MustCompile(`^[0-9\s()+-]+$`), "must be a valid phone number"),
 			},
 			"title": {
 				Type:         schema.TypeString,
diff --git a/internal/service/account/alternate_contact_test.go b/internal/service/account/alternate_contact_test.go
index 1bf10751c05..d490eafaebd 100644
--- a/internal/service/account/alternate_contact_test.go
+++ b/internal/service/account/alternate_contact_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package account_test
 
 import (
diff --git a/internal/service/account/exports_test.go b/internal/service/account/exports_test.go
index ea47fd58d54..1ce71eced7a 100644
--- a/internal/service/account/exports_test.go
+++ b/internal/service/account/exports_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package account
 
 // Exports for use in tests only.
diff --git a/internal/service/account/generate.go b/internal/service/account/generate.go
index 9c94f2c23c2..c2b1d858819 100644
--- a/internal/service/account/generate.go
+++ b/internal/service/account/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
 
diff --git a/internal/service/account/primary_contact.go b/internal/service/account/primary_contact.go
index 30598d5eb10..80324c7f8d2 100644
--- a/internal/service/account/primary_contact.go
+++ b/internal/service/account/primary_contact.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package account
 
 import (
 	"context"
 	"log"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/account"
 	"github.com/aws/aws-sdk-go-v2/service/account/types"
@@ -73,7 +76,7 @@ func resourcePrimaryContact() *schema.Resource {
 			"phone_number": {
 				Type:         schema.TypeString,
 				Required:     true,
-				ValidateFunc: validation.StringMatch(regexp.MustCompile(`^[\s0-9()+-]+$`), "must be a valid phone number"),
+				ValidateFunc: validation.StringMatch(regexache.MustCompile(`^[+][0-9\s()-]+$`), "must be a valid phone number"),
 			},
 			"postal_code": {
 				Type:     schema.TypeString,
diff --git a/internal/service/account/primary_contact_test.go b/internal/service/account/primary_contact_test.go
index 8a2d07a7569..58457032d85 100644
--- a/internal/service/account/primary_contact_test.go
+++ b/internal/service/account/primary_contact_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package account_test
 
 import (
diff --git a/internal/service/account/retry/retry.go b/internal/service/account/retry/retry.go
index 6e5f94ac18c..85684bf3f24 100644
--- a/internal/service/account/retry/retry.go
+++ b/internal/service/account/retry/retry.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package retry
 
 import (
diff --git a/internal/service/account/retry/retry_test.go b/internal/service/account/retry/retry_test.go
index 241f45c3e29..e4904031830 100644
--- a/internal/service/account/retry/retry_test.go
+++ b/internal/service/account/retry/retry_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package retry
 
 import (
diff --git a/internal/service/account/retry/wrappers.go b/internal/service/account/retry/wrappers.go
index 710f618276d..421f824d668 100644
--- a/internal/service/account/retry/wrappers.go
+++ b/internal/service/account/retry/wrappers.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package retry
 
 import (
diff --git a/internal/service/account/service_package_gen.go b/internal/service/account/service_package_gen.go
index c0a1788de24..98cf66e2aca 100644
--- a/internal/service/account/service_package_gen.go
+++ b/internal/service/account/service_package_gen.go
@@ -7,6 +7,7 @@ import (
 
 	aws_sdkv2 "github.com/aws/aws-sdk-go-v2/aws"
 	account_sdkv2 "github.com/aws/aws-sdk-go-v2/service/account"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -48,9 +49,11 @@ func (p *servicePackage) NewClient(ctx context.Context, config map[string]any) (
 
 	return account_sdkv2.NewFromConfig(cfg, func(o *account_sdkv2.Options) {
 		if endpoint := config["endpoint"].(string); endpoint != "" {
-			o.EndpointResolver = account_sdkv2.EndpointResolverFromURL(endpoint)
+			o.BaseEndpoint = aws_sdkv2.String(endpoint)
 		}
 	}), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/acm/certificate.go b/internal/service/acm/certificate.go
index f27b705babb..0b33b969083 100644
--- a/internal/service/acm/certificate.go
+++ b/internal/service/acm/certificate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package acm
 
 import (
@@ -7,11 +10,11 @@ import (
 	"errors"
 	"fmt"
 	"log"
-	"regexp"
 	"strconv"
 	"strings"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/acm"
 	"github.com/aws/aws-sdk-go-v2/service/acm/types"
@@ -90,7 +93,7 @@ func resourceCertificate() *schema.Resource {
 				Optional:      true,
 				Computed:      true,
 				ForceNew:      true,
-				ValidateFunc:  validation.StringDoesNotMatch(regexp.MustCompile(`\.$`), "cannot end with a period"),
+				ValidateFunc:  validation.StringDoesNotMatch(regexache.MustCompile(`\.$`), "cannot end with a period"),
 				ExactlyOneOf:  []string{"domain_name", "private_key"},
 				ConflictsWith: []string{"certificate_body", "certificate_chain", "private_key"},
 			},
@@ -205,7 +208,7 @@ func resourceCertificate() *schema.Resource {
 					Type: schema.TypeString,
 					ValidateFunc: validation.All(
 						validation.StringLenBetween(1, 253),
-						validation.StringDoesNotMatch(regexp.MustCompile(`\.$`), "cannot end with a period"),
+						validation.StringDoesNotMatch(regexache.MustCompile(`\.$`), "cannot end with a period"),
 					),
 				},
 				ConflictsWith: []string{"certificate_body", "certificate_chain", "private_key"},
@@ -910,7 +913,7 @@ func waitCertificateRenewed(ctx context.Context, conn *acm.Client, arn string, t
 	return nil, err
 }
 
-var validateHybridDuration = verify.ValidAnyDiag(
+var validateHybridDuration = validation.AnyDiag(
 	sdktypes.ValidateDuration,
 	sdktypes.ValidateRFC3339Duration,
 )
diff --git a/internal/service/acm/certificate_data_source.go b/internal/service/acm/certificate_data_source.go
index 6c3e574374a..a3599f63848 100644
--- a/internal/service/acm/certificate_data_source.go
+++ b/internal/service/acm/certificate_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package acm
 
 import (
diff --git a/internal/service/acm/certificate_data_source_test.go b/internal/service/acm/certificate_data_source_test.go
index 725d889fbce..9487433c83a 100644
--- a/internal/service/acm/certificate_data_source_test.go
+++ b/internal/service/acm/certificate_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package acm_test
 
 import (
@@ -6,6 +9,7 @@ import (
 	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/acm"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -24,9 +28,9 @@ func TestAccACMCertificateDataSource_singleIssued(t *testing.T) {
 	var domain string
 
 	if os.Getenv("ACM_CERTIFICATE_SINGLE_ISSUED_MOST_RECENT_ARN") != "" {
-		arnRe = regexp.MustCompile(fmt.Sprintf("^%s$", os.Getenv("ACM_CERTIFICATE_SINGLE_ISSUED_MOST_RECENT_ARN")))
+		arnRe = regexache.MustCompile(fmt.Sprintf("^%s$", os.Getenv("ACM_CERTIFICATE_SINGLE_ISSUED_MOST_RECENT_ARN")))
 	} else {
-		arnRe = regexp.MustCompile(certificateRE)
+		arnRe = regexache.MustCompile(certificateRE)
 	}
 
 	if os.Getenv("ACM_CERTIFICATE_SINGLE_ISSUED_DOMAIN") != "" {
@@ -112,9 +116,9 @@ func TestAccACMCertificateDataSource_multipleIssued(t *testing.T) {
 	var domain string
 
 	if os.Getenv("ACM_CERTIFICATE_MULTIPLE_ISSUED_MOST_RECENT_ARN") != "" {
-		arnRe = regexp.MustCompile(fmt.Sprintf("^%s$", os.Getenv("ACM_CERTIFICATE_MULTIPLE_ISSUED_MOST_RECENT_ARN")))
+		arnRe = regexache.MustCompile(fmt.Sprintf("^%s$", os.Getenv("ACM_CERTIFICATE_MULTIPLE_ISSUED_MOST_RECENT_ARN")))
 	} else {
-		arnRe = regexp.MustCompile(certificateRE)
+		arnRe = regexache.MustCompile(certificateRE)
 	}
 
 	if os.Getenv("ACM_CERTIFICATE_MULTIPLE_ISSUED_DOMAIN") != "" {
@@ -132,15 +136,15 @@ func TestAccACMCertificateDataSource_multipleIssued(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccCertificateDataSourceConfig_basic(domain),
-				ExpectError: regexp.MustCompile(`multiple ACM Certificates matching domain`),
+				ExpectError: regexache.MustCompile(`multiple ACM Certificates matching domain`),
 			},
 			{
 				Config:      testAccCertificateDataSourceConfig_status(domain, acm.CertificateStatusIssued),
-				ExpectError: regexp.MustCompile(`multiple ACM Certificates matching domain`),
+				ExpectError: regexache.MustCompile(`multiple ACM Certificates matching domain`),
 			},
 			{
 				Config:      testAccCertificateDataSourceConfig_types(domain, acm.CertificateTypeAmazonIssued),
-				ExpectError: regexp.MustCompile(`multiple ACM Certificates matching domain`),
+				ExpectError: regexache.MustCompile(`multiple ACM Certificates matching domain`),
 			},
 			{
 				Config: testAccCertificateDataSourceConfig_mostRecent(domain, true),
@@ -182,27 +186,27 @@ func TestAccACMCertificateDataSource_noMatchReturnsError(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccCertificateDataSourceConfig_basic(domain),
-				ExpectError: regexp.MustCompile(`no ACM Certificate matching domain`),
+				ExpectError: regexache.MustCompile(`no ACM Certificate matching domain`),
 			},
 			{
 				Config:      testAccCertificateDataSourceConfig_status(domain, acm.CertificateStatusIssued),
-				ExpectError: regexp.MustCompile(`no ACM Certificate matching domain`),
+				ExpectError: regexache.MustCompile(`no ACM Certificate matching domain`),
 			},
 			{
 				Config:      testAccCertificateDataSourceConfig_types(domain, acm.CertificateTypeAmazonIssued),
-				ExpectError: regexp.MustCompile(`no ACM Certificate matching domain`),
+				ExpectError: regexache.MustCompile(`no ACM Certificate matching domain`),
 			},
 			{
 				Config:      testAccCertificateDataSourceConfig_mostRecent(domain, true),
-				ExpectError: regexp.MustCompile(`no ACM Certificate matching domain`),
+				ExpectError: regexache.MustCompile(`no ACM Certificate matching domain`),
 			},
 			{
 				Config:      testAccCertificateDataSourceConfig_mostRecentAndStatus(domain, acm.CertificateStatusIssued, true),
-				ExpectError: regexp.MustCompile(`no ACM Certificate matching domain`),
+				ExpectError: regexache.MustCompile(`no ACM Certificate matching domain`),
 			},
 			{
 				Config:      testAccCertificateDataSourceConfig_mostRecentAndTypes(domain, acm.CertificateTypeAmazonIssued, true),
-				ExpectError: regexp.MustCompile(`no ACM Certificate matching domain`),
+				ExpectError: regexache.MustCompile(`no ACM Certificate matching domain`),
 			},
 		},
 	})
diff --git a/internal/service/acm/certificate_test.go b/internal/service/acm/certificate_test.go
index 29a53a56d76..a02bbf90060 100644
--- a/internal/service/acm/certificate_test.go
+++ b/internal/service/acm/certificate_test.go
@@ -1,14 +1,17 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package acm_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"strconv"
 	"strings"
 	"testing"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/acm"
 	"github.com/aws/aws-sdk-go-v2/service/acm/types"
@@ -38,7 +41,7 @@ func TestAccACMCertificate_emailValidation(t *testing.T) {
 				Config: testAccCertificateConfig_basic(domain, types.ValidationMethodEmail),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckCertificateExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "acm", regexp.MustCompile("certificate/.+$")),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "acm", regexache.MustCompile("certificate/.+$")),
 					resource.TestCheckResourceAttr(resourceName, "domain_name", domain),
 					resource.TestCheckResourceAttr(resourceName, "domain_validation_options.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "early_renewal_duration", ""),
@@ -52,7 +55,7 @@ func TestAccACMCertificate_emailValidation(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "renewal_eligibility", string(types.RenewalEligibilityIneligible)),
 					resource.TestCheckResourceAttr(resourceName, "renewal_summary.#", "0"),
 					acctest.CheckResourceAttrGreaterThanValue(resourceName, "validation_emails.#", 0),
-					resource.TestMatchResourceAttr(resourceName, "validation_emails.0", regexp.MustCompile(`^[^@]+@.+$`)),
+					resource.TestMatchResourceAttr(resourceName, "validation_emails.0", regexache.MustCompile(`^[^@]+@.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "validation_method", string(types.ValidationMethodEmail)),
 					resource.TestCheckResourceAttr(resourceName, "validation_option.#", "0"),
 				),
@@ -83,7 +86,7 @@ func TestAccACMCertificate_dnsValidation(t *testing.T) {
 				Config: testAccCertificateConfig_basic(domain, types.ValidationMethodDns),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckCertificateExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "acm", regexp.MustCompile("certificate/.+$")),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "acm", regexache.MustCompile("certificate/.+$")),
 					resource.TestCheckResourceAttr(resourceName, "domain_name", domain),
 					resource.TestCheckResourceAttr(resourceName, "domain_validation_options.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "domain_validation_options.*", map[string]string{
@@ -130,7 +133,7 @@ func TestAccACMCertificate_root(t *testing.T) {
 				Config: testAccCertificateConfig_basic(rootDomain, types.ValidationMethodDns),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckCertificateExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "acm", regexp.MustCompile("certificate/.+$")),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "acm", regexache.MustCompile("certificate/.+$")),
 					resource.TestCheckResourceAttr(resourceName, "domain_name", rootDomain),
 					resource.TestCheckResourceAttr(resourceName, "domain_validation_options.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "domain_validation_options.*", map[string]string{
@@ -171,14 +174,14 @@ func TestAccACMCertificate_validationOptions(t *testing.T) {
 				Config: testAccCertificateConfig_validationOptions(rootDomain, domain),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckCertificateExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "acm", regexp.MustCompile("certificate/.+$")),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "acm", regexache.MustCompile("certificate/.+$")),
 					resource.TestCheckResourceAttr(resourceName, "domain_name", domain),
 					resource.TestCheckResourceAttr(resourceName, "domain_validation_options.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "status", string(types.CertificateStatusPendingValidation)),
 					resource.TestCheckResourceAttr(resourceName, "subject_alternative_names.#", "1"),
 					resource.TestCheckTypeSetElemAttr(resourceName, "subject_alternative_names.*", domain),
 					acctest.CheckResourceAttrGreaterThanValue(resourceName, "validation_emails.#", 0),
-					resource.TestMatchResourceAttr(resourceName, "validation_emails.0", regexp.MustCompile(`^[^@]+@.+$`)),
+					resource.TestMatchResourceAttr(resourceName, "validation_emails.0", regexache.MustCompile(`^[^@]+@.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "validation_method", string(types.ValidationMethodEmail)),
 					resource.TestCheckResourceAttr(resourceName, "validation_option.#", "1"),
 				),
@@ -211,7 +214,7 @@ func TestAccACMCertificate_privateCertificate_renewable(t *testing.T) {
 				Config: testAccCertificateConfig_privateCertificate_renewable(commonName.String(), certificateDomainName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckCertificateExists(ctx, resourceName, &v1),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "acm", regexp.MustCompile("certificate/.+$")),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "acm", regexache.MustCompile("certificate/.+$")),
 					resource.TestCheckResourceAttrPair(resourceName, "certificate_authority_arn", certificateAuthorityResourceName, "arn"),
 					resource.TestCheckResourceAttr(resourceName, "domain_name", certificateDomainName),
 					resource.TestCheckResourceAttr(resourceName, "domain_validation_options.#", "0"),
@@ -337,7 +340,7 @@ func TestAccACMCertificate_privateCertificate_noRenewalPermission(t *testing.T)
 				Config: testAccCertificateConfig_privateCertificate_noRenewalPermission(commonName.String(), certificateDomainName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckCertificateExists(ctx, resourceName, &v1),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "acm", regexp.MustCompile("certificate/.+$")),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "acm", regexache.MustCompile("certificate/.+$")),
 					resource.TestCheckResourceAttrPair(resourceName, "certificate_authority_arn", certificateAuthorityResourceName, "arn"),
 					resource.TestCheckResourceAttr(resourceName, "domain_name", certificateDomainName),
 					resource.TestCheckResourceAttr(resourceName, "domain_validation_options.#", "0"),
@@ -455,7 +458,7 @@ func TestAccACMCertificate_privateCertificate_pendingRenewalGoDuration(t *testin
 				Config: testAccCertificateConfig_privateCertificate_pendingRenewal(commonName.String(), certificateDomainName, duration),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckCertificateExists(ctx, resourceName, &v1),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "acm", regexp.MustCompile("certificate/.+$")),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "acm", regexache.MustCompile("certificate/.+$")),
 					resource.TestCheckResourceAttr(resourceName, "early_renewal_duration", duration),
 					resource.TestCheckResourceAttr(resourceName, "pending_renewal", "false"),
 					resource.TestCheckResourceAttr(resourceName, "renewal_eligibility", string(types.RenewalEligibilityIneligible)),
@@ -529,7 +532,7 @@ func TestAccACMCertificate_privateCertificate_pendingRenewalRFC3339Duration(t *t
 				Config: testAccCertificateConfig_privateCertificate_pendingRenewal(commonName.String(), certificateDomainName, duration),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckCertificateExists(ctx, resourceName, &v1),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "acm", regexp.MustCompile("certificate/.+$")),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "acm", regexache.MustCompile("certificate/.+$")),
 					resource.TestCheckResourceAttr(resourceName, "early_renewal_duration", duration),
 					resource.TestCheckResourceAttr(resourceName, "pending_renewal", "false"),
 					resource.TestCheckResourceAttr(resourceName, "renewal_eligibility", string(types.RenewalEligibilityIneligible)),
@@ -603,7 +606,7 @@ func TestAccACMCertificate_privateCertificate_addEarlyRenewalPast(t *testing.T)
 				Config: testAccCertificateConfig_privateCertificate_renewable(commonName.String(), certificateDomainName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckCertificateExists(ctx, resourceName, &v1),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "acm", regexp.MustCompile("certificate/.+$")),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "acm", regexache.MustCompile("certificate/.+$")),
 					resource.TestCheckResourceAttr(resourceName, "early_renewal_duration", ""),
 					resource.TestCheckResourceAttr(resourceName, "pending_renewal", "false"),
 					resource.TestCheckResourceAttr(resourceName, "renewal_eligibility", string(types.RenewalEligibilityIneligible)),
@@ -691,7 +694,7 @@ func TestAccACMCertificate_privateCertificate_addEarlyRenewalPastIneligible(t *t
 				Config: testAccCertificateConfig_privateCertificate_renewable(commonName.String(), certificateDomainName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckCertificateExists(ctx, resourceName, &v1),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "acm", regexp.MustCompile("certificate/.+$")),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "acm", regexache.MustCompile("certificate/.+$")),
 					resource.TestCheckResourceAttr(resourceName, "early_renewal_duration", ""),
 					resource.TestCheckResourceAttr(resourceName, "pending_renewal", "false"),
 					resource.TestCheckResourceAttr(resourceName, "renewal_eligibility", string(types.RenewalEligibilityIneligible)),
@@ -744,7 +747,7 @@ func TestAccACMCertificate_privateCertificate_addEarlyRenewalFuture(t *testing.T
 				Config: testAccCertificateConfig_privateCertificate_renewable(commonName.String(), certificateDomainName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckCertificateExists(ctx, resourceName, &v1),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "acm", regexp.MustCompile("certificate/.+$")),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "acm", regexache.MustCompile("certificate/.+$")),
 					resource.TestCheckResourceAttr(resourceName, "early_renewal_duration", ""),
 					resource.TestCheckResourceAttr(resourceName, "pending_renewal", "false"),
 					resource.TestCheckResourceAttr(resourceName, "renewal_eligibility", string(types.RenewalEligibilityIneligible)),
@@ -830,7 +833,7 @@ func TestAccACMCertificate_privateCertificate_updateEarlyRenewalFuture(t *testin
 				Config: testAccCertificateConfig_privateCertificate_pendingRenewal(commonName.String(), certificateDomainName, duration),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckCertificateExists(ctx, resourceName, &v1),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "acm", regexp.MustCompile("certificate/.+$")),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "acm", regexache.MustCompile("certificate/.+$")),
 					resource.TestCheckResourceAttr(resourceName, "early_renewal_duration", duration),
 					resource.TestCheckResourceAttr(resourceName, "pending_renewal", "false"),
 					resource.TestCheckResourceAttr(resourceName, "renewal_eligibility", string(types.RenewalEligibilityIneligible)),
@@ -900,7 +903,7 @@ func TestAccACMCertificate_privateCertificate_removeEarlyRenewal(t *testing.T) {
 				Config: testAccCertificateConfig_privateCertificate_pendingRenewal(commonName.String(), certificateDomainName, duration),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckCertificateExists(ctx, resourceName, &v1),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "acm", regexp.MustCompile("certificate/.+$")),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "acm", regexache.MustCompile("certificate/.+$")),
 					resource.TestCheckResourceAttr(resourceName, "early_renewal_duration", duration),
 					resource.TestCheckResourceAttr(resourceName, "pending_renewal", "false"),
 					resource.TestCheckResourceAttr(resourceName, "renewal_eligibility", string(types.RenewalEligibilityIneligible)),
@@ -967,7 +970,7 @@ func TestAccACMCertificate_Root_trailingPeriod(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccCertificateConfig_basic(domain, types.ValidationMethodDns),
-				ExpectError: regexp.MustCompile(`invalid value for domain_name \(cannot end with a period\)`),
+				ExpectError: regexache.MustCompile(`invalid value for domain_name \(cannot end with a period\)`),
 			},
 		},
 	})
@@ -990,7 +993,7 @@ func TestAccACMCertificate_rootAndWildcardSan(t *testing.T) {
 				Config: testAccCertificateConfig_subjectAlternativeNames(rootDomain, strconv.Quote(wildcardDomain), types.ValidationMethodDns),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckCertificateExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "acm", regexp.MustCompile("certificate/.+$")),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "acm", regexache.MustCompile("certificate/.+$")),
 					resource.TestCheckResourceAttr(resourceName, "domain_name", rootDomain),
 					resource.TestCheckResourceAttr(resourceName, "domain_validation_options.#", "2"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "domain_validation_options.*", map[string]string{
@@ -1031,7 +1034,7 @@ func TestAccACMCertificate_SubjectAlternativeNames_emptyString(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccCertificateConfig_subjectAlternativeNames(domain, strconv.Quote(""), types.ValidationMethodDns),
-				ExpectError: regexp.MustCompile(`expected length`),
+				ExpectError: regexache.MustCompile(`expected length`),
 			},
 		},
 	})
@@ -1055,7 +1058,7 @@ func TestAccACMCertificate_San_single(t *testing.T) {
 				Config: testAccCertificateConfig_subjectAlternativeNames(domain, strconv.Quote(sanDomain), types.ValidationMethodDns),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckCertificateExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "acm", regexp.MustCompile("certificate/.+$")),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "acm", regexache.MustCompile("certificate/.+$")),
 					resource.TestCheckResourceAttr(resourceName, "domain_name", domain),
 					resource.TestCheckResourceAttr(resourceName, "domain_validation_options.#", "2"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "domain_validation_options.*", map[string]string{
@@ -1102,7 +1105,7 @@ func TestAccACMCertificate_San_multiple(t *testing.T) {
 				Config: testAccCertificateConfig_subjectAlternativeNames(domain, fmt.Sprintf("%q, %q", sanDomain1, sanDomain2), types.ValidationMethodDns),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckCertificateExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "acm", regexp.MustCompile("certificate/.+$")),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "acm", regexache.MustCompile("certificate/.+$")),
 					resource.TestCheckResourceAttr(resourceName, "domain_name", domain),
 					resource.TestCheckResourceAttr(resourceName, "domain_validation_options.#", "3"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "domain_validation_options.*", map[string]string{
@@ -1153,7 +1156,7 @@ func TestAccACMCertificate_San_trailingPeriod(t *testing.T) {
 				Config: testAccCertificateConfig_subjectAlternativeNames(domain, strconv.Quote(sanDomain), types.ValidationMethodDns),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckCertificateExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "acm", regexp.MustCompile(`certificate/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "acm", regexache.MustCompile(`certificate/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "domain_name", domain),
 					resource.TestCheckResourceAttr(resourceName, "domain_validation_options.#", "2"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "domain_validation_options.*", map[string]string{
@@ -1199,7 +1202,7 @@ func TestAccACMCertificate_San_matches_domain(t *testing.T) {
 				Config: testAccCertificateConfig_subjectAlternativeNames(domain, strconv.Quote(sanDomain), types.ValidationMethodDns),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckCertificateExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "acm", regexp.MustCompile(`certificate/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "acm", regexache.MustCompile(`certificate/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "domain_name", domain),
 					resource.TestCheckResourceAttr(resourceName, "domain_validation_options.#", "2"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "domain_validation_options.*", map[string]string{
@@ -1244,7 +1247,7 @@ func TestAccACMCertificate_wildcard(t *testing.T) {
 				Config: testAccCertificateConfig_basic(wildcardDomain, types.ValidationMethodDns),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckCertificateExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "acm", regexp.MustCompile("certificate/.+$")),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "acm", regexache.MustCompile("certificate/.+$")),
 					resource.TestCheckResourceAttr(resourceName, "domain_name", wildcardDomain),
 					resource.TestCheckResourceAttr(resourceName, "domain_validation_options.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "domain_validation_options.*", map[string]string{
@@ -1284,7 +1287,7 @@ func TestAccACMCertificate_wildcardAndRootSan(t *testing.T) {
 				Config: testAccCertificateConfig_subjectAlternativeNames(wildcardDomain, strconv.Quote(rootDomain), types.ValidationMethodDns),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckCertificateExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "acm", regexp.MustCompile("certificate/.+$")),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "acm", regexache.MustCompile("certificate/.+$")),
 					resource.TestCheckResourceAttr(resourceName, "domain_name", wildcardDomain),
 					resource.TestCheckResourceAttr(resourceName, "domain_validation_options.#", "2"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "domain_validation_options.*", map[string]string{
@@ -1328,7 +1331,7 @@ func TestAccACMCertificate_keyAlgorithm(t *testing.T) {
 				Config: testAccCertificateConfig_keyAlgorithm(rootDomain, types.ValidationMethodDns, types.KeyAlgorithmEcPrime256v1),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckCertificateExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "acm", regexp.MustCompile("certificate/.+$")),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "acm", regexache.MustCompile("certificate/.+$")),
 					resource.TestCheckResourceAttr(resourceName, "domain_name", rootDomain),
 					resource.TestCheckResourceAttr(resourceName, "domain_validation_options.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "domain_validation_options.*", map[string]string{
@@ -1368,7 +1371,7 @@ func TestAccACMCertificate_disableCTLogging(t *testing.T) {
 				Config: testAccCertificateConfig_disableCTLogging(rootDomain, types.ValidationMethodDns),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckCertificateExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "acm", regexp.MustCompile("certificate/.+$")),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "acm", regexache.MustCompile("certificate/.+$")),
 					resource.TestCheckResourceAttr(resourceName, "domain_name", rootDomain),
 					resource.TestCheckResourceAttr(resourceName, "domain_validation_options.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "domain_validation_options.*", map[string]string{
@@ -1414,7 +1417,7 @@ func TestAccACMCertificate_disableReenableCTLogging(t *testing.T) {
 				Config: testAccCertificateConfig_optionsWithValidation(rootDomain, types.ValidationMethodDns, "ENABLED"),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckCertificateExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "acm", regexp.MustCompile("certificate/.+$")),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "acm", regexache.MustCompile("certificate/.+$")),
 					resource.TestCheckResourceAttr(resourceName, "domain_name", rootDomain),
 					resource.TestCheckResourceAttr(resourceName, "domain_validation_options.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "domain_validation_options.*", map[string]string{
@@ -1439,7 +1442,7 @@ func TestAccACMCertificate_disableReenableCTLogging(t *testing.T) {
 				Config: testAccCertificateConfig_optionsWithValidation(rootDomain, types.ValidationMethodDns, "DISABLED"),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckCertificateExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "acm", regexp.MustCompile("certificate/.+$")),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "acm", regexache.MustCompile("certificate/.+$")),
 					resource.TestCheckResourceAttr(resourceName, "domain_name", rootDomain),
 					resource.TestCheckResourceAttr(resourceName, "domain_validation_options.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "domain_validation_options.*", map[string]string{
@@ -1464,7 +1467,7 @@ func TestAccACMCertificate_disableReenableCTLogging(t *testing.T) {
 				Config: testAccCertificateConfig_optionsWithValidation(rootDomain, types.ValidationMethodDns, "ENABLED"),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckCertificateExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "acm", regexp.MustCompile("certificate/.+$")),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "acm", regexache.MustCompile("certificate/.+$")),
 					resource.TestCheckResourceAttr(resourceName, "domain_name", rootDomain),
 					resource.TestCheckResourceAttr(resourceName, "domain_validation_options.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "domain_validation_options.*", map[string]string{
diff --git a/internal/service/acm/certificate_validation.go b/internal/service/acm/certificate_validation.go
index e488d0b362c..9998c500fcc 100644
--- a/internal/service/acm/certificate_validation.go
+++ b/internal/service/acm/certificate_validation.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package acm
 
 import (
diff --git a/internal/service/acm/certificate_validation_test.go b/internal/service/acm/certificate_validation_test.go
index 940ef706fd1..bf9b8bf8ad2 100644
--- a/internal/service/acm/certificate_validation_test.go
+++ b/internal/service/acm/certificate_validation_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package acm_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"strconv"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
@@ -53,7 +56,7 @@ func TestAccACMCertificateValidation_timeout(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccCertificateValidationConfig_timeout(domain),
-				ExpectError: regexp.MustCompile(`timeout while waiting for state to become 'ISSUED' \(last state: 'PENDING_VALIDATION'`),
+				ExpectError: regexache.MustCompile(`timeout while waiting for state to become 'ISSUED' \(last state: 'PENDING_VALIDATION'`),
 			},
 		},
 	})
@@ -75,7 +78,7 @@ func TestAccACMCertificateValidation_validationRecordFQDNS(t *testing.T) {
 			// Test that validation fails if given validation_fqdns don't match
 			{
 				Config:      testAccCertificateValidationConfig_recordFQDNsWrongFQDN(domain),
-				ExpectError: regexp.MustCompile("missing .+ DNS validation record: .+"),
+				ExpectError: regexache.MustCompile("missing .+ DNS validation record: .+"),
 			},
 			// Test that validation succeeds with validation
 			{
@@ -102,7 +105,7 @@ func TestAccACMCertificateValidation_validationRecordFQDNSEmail(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccCertificateValidationConfig_recordFQDNsEmail(domain),
-				ExpectError: regexp.MustCompile("validation_record_fqdns is not valid for EMAIL validation"),
+				ExpectError: regexache.MustCompile("validation_record_fqdns is not valid for EMAIL validation"),
 			},
 		},
 	})
diff --git a/internal/service/acm/exports_test.go b/internal/service/acm/exports_test.go
index 9d04bbc662c..12ad519f0e8 100644
--- a/internal/service/acm/exports_test.go
+++ b/internal/service/acm/exports_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package acm
 
 // Exports for use in tests only.
diff --git a/internal/service/acm/generate.go b/internal/service/acm/generate.go
index 8814df98037..0615a7197b1 100644
--- a/internal/service/acm/generate.go
+++ b/internal/service/acm/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -AWSSDKVersion=2 -ListTags -ListTagsOp=ListTagsForCertificate -ListTagsInIDElem=CertificateArn -ServiceTagsSlice -TagOp=AddTagsToCertificate -TagInIDElem=CertificateArn -UntagOp=RemoveTagsFromCertificate -UntagInNeedTagType -UntagInTagsElem=Tags -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/acm/service_package_gen.go b/internal/service/acm/service_package_gen.go
index b89eead0baf..dbd2989c628 100644
--- a/internal/service/acm/service_package_gen.go
+++ b/internal/service/acm/service_package_gen.go
@@ -7,6 +7,7 @@ import (
 
 	aws_sdkv2 "github.com/aws/aws-sdk-go-v2/aws"
 	acm_sdkv2 "github.com/aws/aws-sdk-go-v2/service/acm"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -57,9 +58,11 @@ func (p *servicePackage) NewClient(ctx context.Context, config map[string]any) (
 
 	return acm_sdkv2.NewFromConfig(cfg, func(o *acm_sdkv2.Options) {
 		if endpoint := config["endpoint"].(string); endpoint != "" {
-			o.EndpointResolver = acm_sdkv2.EndpointResolverFromURL(endpoint)
+			o.BaseEndpoint = aws_sdkv2.String(endpoint)
 		}
 	}), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/acm/sweep.go b/internal/service/acm/sweep.go
index fe1156ca02d..a33e72f960d 100644
--- a/internal/service/acm/sweep.go
+++ b/internal/service/acm/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package acm
 
@@ -11,9 +11,10 @@ import (
 	"github.com/aws/aws-sdk-go-v2/service/acm"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv2"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_acm_certificate", &resource.Sweeper{
 		Name: "aws_acm_certificate",
 		F:    sweepCertificates,
@@ -31,6 +32,7 @@ func init() {
 			"aws_elb",
 			"aws_iam_server_certificate",
 			"aws_iam_signing_certificate",
+			"aws_iot_domain_configuration",
 			"aws_lb",
 			"aws_lb_listener",
 		},
@@ -39,7 +41,7 @@ func init() {
 
 func sweepCertificates(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -51,7 +53,7 @@ func sweepCertificates(region string) error {
 	for pages.HasMorePages() {
 		page, err := pages.NextPage(ctx)
 
-		if sweep.SkipSweepError(err) {
+		if awsv2.SkipSweepError(err) {
 			log.Printf("[WARN] Skipping ACM Certificate sweep for %s: %s", region, err)
 			return nil
 		}
@@ -96,7 +98,7 @@ func sweepCertificates(region string) error {
 		}
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping ACM Certificates (%s): %w", region, err)
diff --git a/internal/service/acm/tags_gen.go b/internal/service/acm/tags_gen.go
index 264c8687642..e5df0371177 100644
--- a/internal/service/acm/tags_gen.go
+++ b/internal/service/acm/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/acm"
 	awstypes "github.com/aws/aws-sdk-go-v2/service/acm/types"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -102,6 +104,8 @@ func updateTags(ctx context.Context, conn *acm.Client, identifier string, oldTag
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.ACM)
 	if len(removedTags) > 0 {
diff --git a/internal/service/acmpca/certificate.go b/internal/service/acmpca/certificate.go
index 34be7f57886..7cac716b03c 100644
--- a/internal/service/acmpca/certificate.go
+++ b/internal/service/acmpca/certificate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package acmpca
 
 import (
@@ -8,11 +11,11 @@ import (
 	"fmt"
 	"log"
 	"math/big"
-	"regexp"
 	"strconv"
 	"strings"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/aws/aws-sdk-go/service/acmpca"
@@ -42,7 +45,7 @@ func ResourceCertificate() *schema.Resource {
 		// arn:aws:acm-pca:eu-west-1:555885746124:certificate-authority/08322ede-92f9-4200-8f21-c7d12b2b6edb/certificate/a4e9c2aa2ccfab625b1b9136464cd3a6
 		Importer: &schema.ResourceImporter{
 			StateContext: func(ctx context.Context, d *schema.ResourceData, meta interface{}) ([]*schema.ResourceData, error) {
-				re := regexp.MustCompile(`arn:.+:certificate-authority/[^/]+`)
+				re := regexache.MustCompile(`arn:.+:certificate-authority/[^/]+`)
 				authorityARN := re.FindString(d.Id())
 				if authorityARN == "" {
 					return nil, fmt.Errorf("Unexpected format for ID (%q), expected ACM PCA Certificate ARN", d.Id())
diff --git a/internal/service/acmpca/certificate_authority.go b/internal/service/acmpca/certificate_authority.go
index 429146fe9dc..f0d3ee76a77 100644
--- a/internal/service/acmpca/certificate_authority.go
+++ b/internal/service/acmpca/certificate_authority.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package acmpca
 
 import (
diff --git a/internal/service/acmpca/certificate_authority_certificate.go b/internal/service/acmpca/certificate_authority_certificate.go
index 3d7770ac4d3..f72a06b04cd 100644
--- a/internal/service/acmpca/certificate_authority_certificate.go
+++ b/internal/service/acmpca/certificate_authority_certificate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package acmpca
 
 import (
diff --git a/internal/service/acmpca/certificate_authority_certificate_test.go b/internal/service/acmpca/certificate_authority_certificate_test.go
index 892e80ba6f2..a5c885bec66 100644
--- a/internal/service/acmpca/certificate_authority_certificate_test.go
+++ b/internal/service/acmpca/certificate_authority_certificate_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package acmpca_test
 
 import (
diff --git a/internal/service/acmpca/certificate_authority_data_source.go b/internal/service/acmpca/certificate_authority_data_source.go
index 7b3ed014487..243e939d4c5 100644
--- a/internal/service/acmpca/certificate_authority_data_source.go
+++ b/internal/service/acmpca/certificate_authority_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package acmpca
 
 import (
diff --git a/internal/service/acmpca/certificate_authority_data_source_test.go b/internal/service/acmpca/certificate_authority_data_source_test.go
index 724d9b13066..b5b5ddcacb7 100644
--- a/internal/service/acmpca/certificate_authority_data_source_test.go
+++ b/internal/service/acmpca/certificate_authority_data_source_test.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package acmpca_test
 
 import (
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/acmpca"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
@@ -24,7 +27,7 @@ func TestAccACMPCACertificateAuthorityDataSource_basic(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccCertificateAuthorityDataSourceConfig_nonExistent,
-				ExpectError: regexp.MustCompile(`(AccessDeniedException|ResourceNotFoundException)`),
+				ExpectError: regexache.MustCompile(`(AccessDeniedException|ResourceNotFoundException)`),
 			},
 			{
 				Config: testAccCertificateAuthorityDataSourceConfig_arn(commonName),
@@ -63,7 +66,7 @@ func TestAccACMPCACertificateAuthorityDataSource_s3ObjectACL(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccCertificateAuthorityDataSourceConfig_nonExistent,
-				ExpectError: regexp.MustCompile(`(AccessDeniedException|ResourceNotFoundException)`),
+				ExpectError: regexache.MustCompile(`(AccessDeniedException|ResourceNotFoundException)`),
 			},
 			{
 				Config: testAccCertificateAuthorityDataSourceConfig_s3ObjectACLARN(commonName),
diff --git a/internal/service/acmpca/certificate_authority_migrate.go b/internal/service/acmpca/certificate_authority_migrate.go
index 9add1528216..1b57a46db84 100644
--- a/internal/service/acmpca/certificate_authority_migrate.go
+++ b/internal/service/acmpca/certificate_authority_migrate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package acmpca
 
 import (
diff --git a/internal/service/acmpca/certificate_authority_migrate_test.go b/internal/service/acmpca/certificate_authority_migrate_test.go
index df3c311895b..35588222e5e 100644
--- a/internal/service/acmpca/certificate_authority_migrate_test.go
+++ b/internal/service/acmpca/certificate_authority_migrate_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package acmpca_test
 
 import (
diff --git a/internal/service/acmpca/certificate_authority_test.go b/internal/service/acmpca/certificate_authority_test.go
index 9c3f44df0ee..a15f2dd8019 100644
--- a/internal/service/acmpca/certificate_authority_test.go
+++ b/internal/service/acmpca/certificate_authority_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package acmpca_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws/endpoints"
 	"github.com/aws/aws-sdk-go/service/acmpca"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -33,7 +36,7 @@ func TestAccACMPCACertificateAuthority_basic(t *testing.T) {
 				Config: testAccCertificateAuthorityConfig_required(commonName),
 				Check: resource.ComposeTestCheckFunc(
 					acctest.CheckACMPCACertificateAuthorityExists(ctx, resourceName, &certificateAuthority),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "acm-pca", regexp.MustCompile(`certificate-authority/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "acm-pca", regexache.MustCompile(`certificate-authority/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "certificate_authority_configuration.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "certificate_authority_configuration.0.key_algorithm", "RSA_4096"),
 					resource.TestCheckResourceAttr(resourceName, "certificate_authority_configuration.0.signing_algorithm", "SHA512WITHRSA"),
@@ -243,7 +246,7 @@ func TestAccACMPCACertificateAuthority_RevocationConfiguration_empty(t *testing.
 				Config: testAccCertificateAuthorityConfig_revocationConfigurationEmpty(commonName),
 				Check: resource.ComposeTestCheckFunc(
 					acctest.CheckACMPCACertificateAuthorityExists(ctx, resourceName, &certificateAuthority),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "acm-pca", regexp.MustCompile(`certificate-authority/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "acm-pca", regexache.MustCompile(`certificate-authority/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "certificate_authority_configuration.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "certificate_authority_configuration.0.key_algorithm", "RSA_4096"),
 					resource.TestCheckResourceAttr(resourceName, "certificate_authority_configuration.0.signing_algorithm", "SHA512WITHRSA"),
diff --git a/internal/service/acmpca/certificate_data_source.go b/internal/service/acmpca/certificate_data_source.go
index c14a08ce69d..578f06a27a0 100644
--- a/internal/service/acmpca/certificate_data_source.go
+++ b/internal/service/acmpca/certificate_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package acmpca
 
 import (
diff --git a/internal/service/acmpca/certificate_data_source_test.go b/internal/service/acmpca/certificate_data_source_test.go
index 73d379424d3..720c9f2882e 100644
--- a/internal/service/acmpca/certificate_data_source_test.go
+++ b/internal/service/acmpca/certificate_data_source_test.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package acmpca_test
 
 import (
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/acmpca"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
@@ -24,7 +27,7 @@ func TestAccACMPCACertificateDataSource_basic(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccCertificateDataSourceConfig_nonExistent,
-				ExpectError: regexp.MustCompile(`ResourceNotFoundException`),
+				ExpectError: regexache.MustCompile(`ResourceNotFoundException`),
 			},
 			{
 				Config: testAccCertificateDataSourceConfig_arn(domain),
diff --git a/internal/service/acmpca/certificate_test.go b/internal/service/acmpca/certificate_test.go
index 08953c86f8c..f9c1ca5d6af 100644
--- a/internal/service/acmpca/certificate_test.go
+++ b/internal/service/acmpca/certificate_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package acmpca_test
 
 import (
@@ -5,11 +8,11 @@ import (
 	"crypto/x509"
 	"encoding/pem"
 	"fmt"
-	"regexp"
 	"strconv"
 	"testing"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/acmpca"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -37,7 +40,7 @@ func TestAccACMPCACertificate_rootCertificate(t *testing.T) {
 				Config: testAccCertificateConfig_root(domain),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckCertificateExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "acm-pca", regexp.MustCompile(`certificate-authority/.+/certificate/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "acm-pca", regexache.MustCompile(`certificate-authority/.+/certificate/.+$`)),
 					resource.TestCheckResourceAttrSet(resourceName, "certificate"),
 					resource.TestCheckResourceAttr(resourceName, "certificate_chain", ""),
 					resource.TestCheckResourceAttrPair(resourceName, "certificate_authority_arn", certificateAuthorityResourceName, "arn"),
@@ -83,7 +86,7 @@ func TestAccACMPCACertificate_rootCertificateWithAPIPassthrough(t *testing.T) {
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckCertificateExists(ctx, resourceName),
 					testAccCheckCertificateExtension(resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "acm-pca", regexp.MustCompile(`certificate-authority/.+/certificate/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "acm-pca", regexache.MustCompile(`certificate-authority/.+/certificate/.+$`)),
 					resource.TestCheckResourceAttrSet(resourceName, "certificate"),
 					resource.TestCheckResourceAttr(resourceName, "certificate_chain", ""),
 					resource.TestCheckResourceAttrPair(resourceName, "certificate_authority_arn", certificateAuthorityResourceName, "arn"),
@@ -128,7 +131,7 @@ func TestAccACMPCACertificate_subordinateCertificate(t *testing.T) {
 				Config: testAccCertificateConfig_subordinate(domain),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckCertificateExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "acm-pca", regexp.MustCompile(`certificate-authority/.+/certificate/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "acm-pca", regexache.MustCompile(`certificate-authority/.+/certificate/.+$`)),
 					resource.TestCheckResourceAttrSet(resourceName, "certificate"),
 					resource.TestCheckResourceAttrSet(resourceName, "certificate_chain"),
 					resource.TestCheckResourceAttrPair(resourceName, "certificate_authority_arn", rootCertificateAuthorityResourceName, "arn"),
@@ -173,7 +176,7 @@ func TestAccACMPCACertificate_endEntityCertificate(t *testing.T) {
 				Config: testAccCertificateConfig_endEntity(domain, acctest.TLSPEMEscapeNewlines(csr)),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckCertificateExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "acm-pca", regexp.MustCompile(`certificate-authority/.+/certificate/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "acm-pca", regexache.MustCompile(`certificate-authority/.+/certificate/.+$`)),
 					resource.TestCheckResourceAttrSet(resourceName, "certificate"),
 					resource.TestCheckResourceAttrSet(resourceName, "certificate_chain"),
 					resource.TestCheckResourceAttr(resourceName, "certificate_signing_request", csr),
@@ -218,7 +221,7 @@ func TestAccACMPCACertificate_Validity_endDate(t *testing.T) {
 				Config: testAccCertificateConfig_validityEndDate(domain, acctest.TLSPEMEscapeNewlines(csr), later),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckCertificateExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "acm-pca", regexp.MustCompile(`certificate-authority/.+/certificate/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "acm-pca", regexache.MustCompile(`certificate-authority/.+/certificate/.+$`)),
 					resource.TestCheckResourceAttrSet(resourceName, "certificate"),
 					resource.TestCheckResourceAttrSet(resourceName, "certificate_chain"),
 					resource.TestCheckResourceAttr(resourceName, "certificate_signing_request", csr),
@@ -263,7 +266,7 @@ func TestAccACMPCACertificate_Validity_absolute(t *testing.T) {
 				Config: testAccCertificateConfig_validityAbsolute(domain, acctest.TLSPEMEscapeNewlines(csr), later),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckCertificateExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "acm-pca", regexp.MustCompile(`certificate-authority/.+/certificate/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "acm-pca", regexache.MustCompile(`certificate-authority/.+/certificate/.+$`)),
 					resource.TestCheckResourceAttrSet(resourceName, "certificate"),
 					resource.TestCheckResourceAttrSet(resourceName, "certificate_chain"),
 					resource.TestCheckResourceAttr(resourceName, "certificate_signing_request", csr),
diff --git a/internal/service/acmpca/find.go b/internal/service/acmpca/find.go
index 637142abdb0..125eec74adb 100644
--- a/internal/service/acmpca/find.go
+++ b/internal/service/acmpca/find.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package acmpca
 
 import (
diff --git a/internal/service/acmpca/generate.go b/internal/service/acmpca/generate.go
index 7f1e2c027e0..40c66b6f7b9 100644
--- a/internal/service/acmpca/generate.go
+++ b/internal/service/acmpca/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTags -ListTagsOp=ListTags -ListTagsInIDElem=CertificateAuthorityArn -ServiceTagsSlice -TagOp=TagCertificateAuthority -TagInIDElem=CertificateAuthorityArn -UntagOp=UntagCertificateAuthority -UntagInNeedTagType -UntagInTagsElem=Tags -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/acmpca/permission.go b/internal/service/acmpca/permission.go
index a14b1ba6801..b1dbb20f4fe 100644
--- a/internal/service/acmpca/permission.go
+++ b/internal/service/acmpca/permission.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package acmpca
 
 import (
diff --git a/internal/service/acmpca/permission_test.go b/internal/service/acmpca/permission_test.go
index f45aeb23686..aaa3fd9761b 100644
--- a/internal/service/acmpca/permission_test.go
+++ b/internal/service/acmpca/permission_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package acmpca_test
 
 import (
diff --git a/internal/service/acmpca/policy.go b/internal/service/acmpca/policy.go
index 66cc27553f5..2633fc3ae09 100644
--- a/internal/service/acmpca/policy.go
+++ b/internal/service/acmpca/policy.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package acmpca
 
 import (
diff --git a/internal/service/acmpca/policy_test.go b/internal/service/acmpca/policy_test.go
index 1ecb2ad5cda..a36069ffeb0 100644
--- a/internal/service/acmpca/policy_test.go
+++ b/internal/service/acmpca/policy_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package acmpca_test
 
 import (
diff --git a/internal/service/acmpca/service_package_gen.go b/internal/service/acmpca/service_package_gen.go
index b164d82b565..04a2de126a2 100644
--- a/internal/service/acmpca/service_package_gen.go
+++ b/internal/service/acmpca/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	acmpca_sdkv1 "github.com/aws/aws-sdk-go/service/acmpca"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -75,4 +76,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*a
 	return acmpca_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/acmpca/sweep.go b/internal/service/acmpca/sweep.go
index b46b848b421..636df0953b0 100644
--- a/internal/service/acmpca/sweep.go
+++ b/internal/service/acmpca/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package acmpca
 
@@ -12,9 +12,10 @@ import (
 	"github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_acmpca_certificate_authority", &resource.Sweeper{
 		Name: "aws_acmpca_certificate_authority",
 		F:    sweepCertificateAuthorities,
@@ -23,7 +24,7 @@ func init() {
 
 func sweepCertificateAuthorities(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
@@ -53,7 +54,7 @@ func sweepCertificateAuthorities(region string) error {
 			r := ResourceCertificateAuthority()
 			d := r.Data(nil)
 			d.SetId(arn)
-			d.Set("permanent_deletion_time_in_days", 7)
+			d.Set("permanent_deletion_time_in_days", 7) //nolint:gomnd
 
 			sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
 		}
@@ -65,11 +66,11 @@ func sweepCertificateAuthorities(region string) error {
 		errs = multierror.Append(errs, fmt.Errorf("listing ACM PCA Certificate Authorities: %w", err))
 	}
 
-	if err = sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err = sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("sweeping ACM PCA Certificate Authorities for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
+	if awsv1.SkipSweepError(errs.ErrorOrNil()) {
 		log.Printf("[WARN] Skipping ACM PCA Certificate Authorities sweep for %s: %s", region, errs)
 		return nil
 	}
diff --git a/internal/service/acmpca/tags_gen.go b/internal/service/acmpca/tags_gen.go
index 9a6ed910bff..e20ae03a3b7 100644
--- a/internal/service/acmpca/tags_gen.go
+++ b/internal/service/acmpca/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/acmpca"
 	"github.com/aws/aws-sdk-go/service/acmpca/acmpcaiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -102,6 +104,8 @@ func updateTags(ctx context.Context, conn acmpcaiface.ACMPCAAPI, identifier stri
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.ACMPCA)
 	if len(removedTags) > 0 {
diff --git a/internal/service/amp/alert_manager_definition.go b/internal/service/amp/alert_manager_definition.go
index dbf8187e876..a853030fcc5 100644
--- a/internal/service/amp/alert_manager_definition.go
+++ b/internal/service/amp/alert_manager_definition.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package amp
 
 import (
diff --git a/internal/service/amp/alert_manager_definition_test.go b/internal/service/amp/alert_manager_definition_test.go
index ba2b1f9e1bc..c454a80b27f 100644
--- a/internal/service/amp/alert_manager_definition_test.go
+++ b/internal/service/amp/alert_manager_definition_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package amp_test
 
 import (
diff --git a/internal/service/amp/find.go b/internal/service/amp/find.go
index 0b4333388c8..7cab24a8ed5 100644
--- a/internal/service/amp/find.go
+++ b/internal/service/amp/find.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package amp
 
 import (
diff --git a/internal/service/amp/generate.go b/internal/service/amp/generate.go
index b233a0eb618..0bd610285cb 100644
--- a/internal/service/amp/generate.go
+++ b/internal/service/amp/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTags -ListTagsInIDElem=ResourceArn -ServiceTagsMap -TagInIDElem=ResourceArn -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/amp/rule_group_namespace.go b/internal/service/amp/rule_group_namespace.go
index 695aca852a3..1892af73414 100644
--- a/internal/service/amp/rule_group_namespace.go
+++ b/internal/service/amp/rule_group_namespace.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package amp
 
 import (
diff --git a/internal/service/amp/rule_group_namespace_test.go b/internal/service/amp/rule_group_namespace_test.go
index b8a569cdf9f..41d2c6bb65d 100644
--- a/internal/service/amp/rule_group_namespace_test.go
+++ b/internal/service/amp/rule_group_namespace_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package amp_test
 
 import (
diff --git a/internal/service/amp/service_package_gen.go b/internal/service/amp/service_package_gen.go
index 840c4c60f18..cdd2b57d67b 100644
--- a/internal/service/amp/service_package_gen.go
+++ b/internal/service/amp/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	prometheusservice_sdkv1 "github.com/aws/aws-sdk-go/service/prometheusservice"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -67,4 +68,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*p
 	return prometheusservice_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/amp/status.go b/internal/service/amp/status.go
index 07c4473d1fc..383b1331bb9 100644
--- a/internal/service/amp/status.go
+++ b/internal/service/amp/status.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package amp
 
 import (
diff --git a/internal/service/amp/tags_gen.go b/internal/service/amp/tags_gen.go
index 22da3490c36..39e1f3ed8bc 100644
--- a/internal/service/amp/tags_gen.go
+++ b/internal/service/amp/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/prometheusservice"
 	"github.com/aws/aws-sdk-go/service/prometheusservice/prometheusserviceiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -54,7 +56,7 @@ func Tags(tags tftags.KeyValueTags) map[string]*string {
 	return aws.StringMap(tags.Map())
 }
 
-// KeyValueTags creates KeyValueTags from amp service tags.
+// KeyValueTags creates tftags.KeyValueTags from amp service tags.
 func KeyValueTags(ctx context.Context, tags map[string]*string) tftags.KeyValueTags {
 	return tftags.New(ctx, tags)
 }
@@ -85,6 +87,8 @@ func updateTags(ctx context.Context, conn prometheusserviceiface.PrometheusServi
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.AMP)
 	if len(removedTags) > 0 {
diff --git a/internal/service/amp/wait.go b/internal/service/amp/wait.go
index 5747607a800..5a467da543f 100644
--- a/internal/service/amp/wait.go
+++ b/internal/service/amp/wait.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package amp
 
 import (
diff --git a/internal/service/amp/workspace.go b/internal/service/amp/workspace.go
index b248fac92d1..665ccd6260b 100644
--- a/internal/service/amp/workspace.go
+++ b/internal/service/amp/workspace.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package amp
 
 import (
diff --git a/internal/service/amp/workspace_data_source.go b/internal/service/amp/workspace_data_source.go
index 57b36dbb869..2fc26485208 100644
--- a/internal/service/amp/workspace_data_source.go
+++ b/internal/service/amp/workspace_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package amp
 
 import (
diff --git a/internal/service/amp/workspace_data_source_test.go b/internal/service/amp/workspace_data_source_test.go
index d7770800bce..1f9312b6b3f 100644
--- a/internal/service/amp/workspace_data_source_test.go
+++ b/internal/service/amp/workspace_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package amp_test
 
 import (
diff --git a/internal/service/amp/workspace_test.go b/internal/service/amp/workspace_test.go
index 86085621285..d7f32539f00 100644
--- a/internal/service/amp/workspace_test.go
+++ b/internal/service/amp/workspace_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package amp_test
 
 import (
diff --git a/internal/service/amp/workspaces_data_source.go b/internal/service/amp/workspaces_data_source.go
index 2a217e86c0d..c7d079c2ca6 100644
--- a/internal/service/amp/workspaces_data_source.go
+++ b/internal/service/amp/workspaces_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package amp
 
 import (
diff --git a/internal/service/amp/workspaces_data_source_test.go b/internal/service/amp/workspaces_data_source_test.go
index 5dea5a1f070..33394fc4ee9 100644
--- a/internal/service/amp/workspaces_data_source_test.go
+++ b/internal/service/amp/workspaces_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package amp_test
 
 import (
diff --git a/internal/service/amplify/amplify_test.go b/internal/service/amplify/amplify_test.go
index 4b6a3dc2fb8..d988d84398f 100644
--- a/internal/service/amplify/amplify_test.go
+++ b/internal/service/amplify/amplify_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package amplify_test
 
 import (
diff --git a/internal/service/amplify/app.go b/internal/service/amplify/app.go
index 624030b080d..9fb96cdc324 100644
--- a/internal/service/amplify/app.go
+++ b/internal/service/amplify/app.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package amplify
 
 import (
diff --git a/internal/service/amplify/app_test.go b/internal/service/amplify/app_test.go
index 8f5d74b11ca..f8365ceb680 100644
--- a/internal/service/amplify/app_test.go
+++ b/internal/service/amplify/app_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package amplify_test
 
 import (
@@ -5,9 +8,9 @@ import (
 	"encoding/base64"
 	"fmt"
 	"os"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/endpoints"
 	"github.com/aws/aws-sdk-go/service/amplify"
@@ -37,13 +40,13 @@ func testAccApp_basic(t *testing.T) {
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckAppExists(ctx, resourceName, &app),
 					resource.TestCheckNoResourceAttr(resourceName, "access_token"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "amplify", regexp.MustCompile(`apps/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "amplify", regexache.MustCompile(`apps/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "auto_branch_creation_config.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "auto_branch_creation_patterns.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "basic_auth_credentials", ""),
 					resource.TestCheckResourceAttr(resourceName, "build_spec", ""),
 					resource.TestCheckResourceAttr(resourceName, "custom_rule.#", "0"),
-					resource.TestMatchResourceAttr(resourceName, "default_domain", regexp.MustCompile(`\.amplifyapp\.com$`)),
+					resource.TestMatchResourceAttr(resourceName, "default_domain", regexache.MustCompile(`\.amplifyapp\.com$`)),
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
 					resource.TestCheckResourceAttr(resourceName, "enable_auto_branch_creation", "false"),
 					resource.TestCheckResourceAttr(resourceName, "enable_basic_auth", "false"),
diff --git a/internal/service/amplify/backend_environment.go b/internal/service/amplify/backend_environment.go
index eafdea1e828..587d9078f57 100644
--- a/internal/service/amplify/backend_environment.go
+++ b/internal/service/amplify/backend_environment.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package amplify
 
 import (
 	"context"
 	"log"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/amplify"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -43,14 +46,14 @@ func ResourceBackendEnvironment() *schema.Resource {
 				Optional:     true,
 				Computed:     true,
 				ForceNew:     true,
-				ValidateFunc: validation.StringMatch(regexp.MustCompile(`^[0-9A-Za-z-]{1,100}$`), "should be not be more than 100 alphanumeric or hyphen characters"),
+				ValidateFunc: validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z-]{1,100}$`), "should be not be more than 100 alphanumeric or hyphen characters"),
 			},
 
 			"environment_name": {
 				Type:         schema.TypeString,
 				Required:     true,
 				ForceNew:     true,
-				ValidateFunc: validation.StringMatch(regexp.MustCompile(`^[a-z]{2,10}$`), "should be between 2 and 10 characters (only lowercase alphabetic)"),
+				ValidateFunc: validation.StringMatch(regexache.MustCompile(`^[a-z]{2,10}$`), "should be between 2 and 10 characters (only lowercase alphabetic)"),
 			},
 
 			"stack_name": {
@@ -58,7 +61,7 @@ func ResourceBackendEnvironment() *schema.Resource {
 				Optional:     true,
 				Computed:     true,
 				ForceNew:     true,
-				ValidateFunc: validation.StringMatch(regexp.MustCompile(`^[0-9A-Za-z-]{1,100}$`), "should be not be more than 100 alphanumeric or hyphen characters"),
+				ValidateFunc: validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z-]{1,100}$`), "should be not be more than 100 alphanumeric or hyphen characters"),
 			},
 		},
 	}
diff --git a/internal/service/amplify/backend_environment_test.go b/internal/service/amplify/backend_environment_test.go
index a0f04c3c703..6a915c2e42e 100644
--- a/internal/service/amplify/backend_environment_test.go
+++ b/internal/service/amplify/backend_environment_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package amplify_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/amplify"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -34,7 +37,7 @@ func testAccBackendEnvironment_basic(t *testing.T) {
 				Config: testAccBackendEnvironmentConfig_basic(rName, environmentName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBackendEnvironmentExists(ctx, resourceName, &env),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "amplify", regexp.MustCompile(`apps/[^/]+/backendenvironments/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "amplify", regexache.MustCompile(`apps/[^/]+/backendenvironments/.+`)),
 					resource.TestCheckResourceAttrSet(resourceName, "deployment_artifacts"),
 					resource.TestCheckResourceAttr(resourceName, "environment_name", environmentName),
 					resource.TestCheckResourceAttrSet(resourceName, "stack_name"),
@@ -93,7 +96,7 @@ func testAccBackendEnvironment_DeploymentArtifacts_StackName(t *testing.T) {
 				Config: testAccBackendEnvironmentConfig_deploymentArtifactsAndStackName(rName, environmentName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBackendEnvironmentExists(ctx, resourceName, &env),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "amplify", regexp.MustCompile(`apps/[^/]+/backendenvironments/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "amplify", regexache.MustCompile(`apps/[^/]+/backendenvironments/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "deployment_artifacts", rName),
 					resource.TestCheckResourceAttr(resourceName, "environment_name", environmentName),
 					resource.TestCheckResourceAttr(resourceName, "stack_name", rName),
diff --git a/internal/service/amplify/branch.go b/internal/service/amplify/branch.go
index 939038e4e4e..a59abdd5d28 100644
--- a/internal/service/amplify/branch.go
+++ b/internal/service/amplify/branch.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package amplify
 
 import (
 	"context"
 	"log"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/amplify"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -77,7 +80,7 @@ func ResourceBranch() *schema.Resource {
 				Type:         schema.TypeString,
 				Required:     true,
 				ForceNew:     true,
-				ValidateFunc: validation.StringMatch(regexp.MustCompile(`^[0-9A-Za-z/_.-]{1,255}$`), "should be not be more than 255 letters, numbers, and the symbols /_.-"),
+				ValidateFunc: validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z/_.-]{1,255}$`), "should be not be more than 255 letters, numbers, and the symbols /_.-"),
 			},
 
 			"custom_domains": {
@@ -101,7 +104,7 @@ func ResourceBranch() *schema.Resource {
 				Type:         schema.TypeString,
 				Optional:     true,
 				Computed:     true,
-				ValidateFunc: validation.StringMatch(regexp.MustCompile(`^[0-9a-z-]{1,255}$`), "should be not be more than 255 lowercase alphanumeric or hyphen characters"),
+				ValidateFunc: validation.StringMatch(regexache.MustCompile(`^[0-9a-z-]{1,255}$`), "should be not be more than 255 lowercase alphanumeric or hyphen characters"),
 			},
 
 			"enable_auto_build": {
diff --git a/internal/service/amplify/branch_test.go b/internal/service/amplify/branch_test.go
index d9bcd2a8dae..b950dc3959c 100644
--- a/internal/service/amplify/branch_test.go
+++ b/internal/service/amplify/branch_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package amplify_test
 
 import (
 	"context"
 	"encoding/base64"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/amplify"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -33,7 +36,7 @@ func testAccBranch_basic(t *testing.T) {
 				Config: testAccBranchConfig_name(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckBranchExists(ctx, resourceName, &branch),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "amplify", regexp.MustCompile(`apps/.+/branches/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "amplify", regexache.MustCompile(`apps/.+/branches/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "associated_resources.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "backend_environment_arn", ""),
 					resource.TestCheckResourceAttr(resourceName, "basic_auth_credentials", ""),
diff --git a/internal/service/amplify/consts.go b/internal/service/amplify/consts.go
index 3049f2bcfc2..95f4ee52d63 100644
--- a/internal/service/amplify/consts.go
+++ b/internal/service/amplify/consts.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package amplify
 
 const (
diff --git a/internal/service/amplify/domain_association.go b/internal/service/amplify/domain_association.go
index c89c5dfc5b4..433d858b542 100644
--- a/internal/service/amplify/domain_association.go
+++ b/internal/service/amplify/domain_association.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package amplify
 
 import (
diff --git a/internal/service/amplify/domain_association_test.go b/internal/service/amplify/domain_association_test.go
index 9d1c4ab0059..35a626efa82 100644
--- a/internal/service/amplify/domain_association_test.go
+++ b/internal/service/amplify/domain_association_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package amplify_test
 
 import (
 	"context"
 	"fmt"
 	"os"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/amplify"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -39,7 +42,7 @@ func testAccDomainAssociation_basic(t *testing.T) {
 				Config: testAccDomainAssociationConfig_basic(rName, domainName, false, false),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDomainAssociationExists(ctx, resourceName, &domain),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "amplify", regexp.MustCompile(`apps/.+/domains/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "amplify", regexache.MustCompile(`apps/.+/domains/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "domain_name", domainName),
 					resource.TestCheckResourceAttr(resourceName, "enable_auto_sub_domain", "false"),
 					resource.TestCheckResourceAttr(resourceName, "sub_domain.#", "1"),
@@ -112,7 +115,7 @@ func testAccDomainAssociation_update(t *testing.T) {
 				Config: testAccDomainAssociationConfig_basic(rName, domainName, false, true),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDomainAssociationExists(ctx, resourceName, &domain),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "amplify", regexp.MustCompile(`apps/.+/domains/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "amplify", regexache.MustCompile(`apps/.+/domains/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "domain_name", domainName),
 					resource.TestCheckResourceAttr(resourceName, "enable_auto_sub_domain", "false"),
 					resource.TestCheckResourceAttr(resourceName, "sub_domain.#", "1"),
@@ -133,7 +136,7 @@ func testAccDomainAssociation_update(t *testing.T) {
 				Config: testAccDomainAssociationConfig_updated(rName, domainName, true, true),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDomainAssociationExists(ctx, resourceName, &domain),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "amplify", regexp.MustCompile(`apps/.+/domains/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "amplify", regexache.MustCompile(`apps/.+/domains/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "domain_name", domainName),
 					resource.TestCheckResourceAttr(resourceName, "enable_auto_sub_domain", "true"),
 					resource.TestCheckResourceAttr(resourceName, "sub_domain.#", "2"),
diff --git a/internal/service/amplify/find.go b/internal/service/amplify/find.go
index 202455139f2..d3794d3970a 100644
--- a/internal/service/amplify/find.go
+++ b/internal/service/amplify/find.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package amplify
 
 import (
diff --git a/internal/service/amplify/generate.go b/internal/service/amplify/generate.go
index 445d5a5fb8f..040ef2e3a1b 100644
--- a/internal/service/amplify/generate.go
+++ b/internal/service/amplify/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/listpages/main.go -ListOps=ListApps
 //go:generate go run ../../generate/tags/main.go -ListTags -ServiceTagsMap -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
diff --git a/internal/service/amplify/id.go b/internal/service/amplify/id.go
index aeda71e1b48..23d5af0020f 100644
--- a/internal/service/amplify/id.go
+++ b/internal/service/amplify/id.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package amplify
 
 import (
diff --git a/internal/service/amplify/id_test.go b/internal/service/amplify/id_test.go
index e9dcfdddce0..9a712c1fcff 100644
--- a/internal/service/amplify/id_test.go
+++ b/internal/service/amplify/id_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package amplify_test
 
 import (
diff --git a/internal/service/amplify/service_package_gen.go b/internal/service/amplify/service_package_gen.go
index 97d49ca90f6..aba2fab07a2 100644
--- a/internal/service/amplify/service_package_gen.go
+++ b/internal/service/amplify/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	amplify_sdkv1 "github.com/aws/aws-sdk-go/service/amplify"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -70,4 +71,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*a
 	return amplify_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/amplify/status.go b/internal/service/amplify/status.go
index 44b1acef251..d507dc5a387 100644
--- a/internal/service/amplify/status.go
+++ b/internal/service/amplify/status.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package amplify
 
 import (
diff --git a/internal/service/amplify/sweep.go b/internal/service/amplify/sweep.go
index 1b37cd45376..124179eeb55 100644
--- a/internal/service/amplify/sweep.go
+++ b/internal/service/amplify/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package amplify
 
@@ -11,9 +11,10 @@ import (
 	"github.com/aws/aws-sdk-go/service/amplify"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_amplify_app", &resource.Sweeper{
 		Name: "aws_amplify_app",
 		F:    sweepApps,
@@ -22,7 +23,7 @@ func init() {
 
 func sweepApps(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -46,7 +47,7 @@ func sweepApps(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Amplify App sweep for %s: %s", region, err)
 		return nil
 	}
@@ -54,7 +55,7 @@ func sweepApps(region string) error {
 		return fmt.Errorf("error listing Amplify Apps: %w", err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping Amplify Apps (%s): %w", region, err)
diff --git a/internal/service/amplify/tags_gen.go b/internal/service/amplify/tags_gen.go
index a6bc52a0961..fb424290ccf 100644
--- a/internal/service/amplify/tags_gen.go
+++ b/internal/service/amplify/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/amplify"
 	"github.com/aws/aws-sdk-go/service/amplify/amplifyiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -54,7 +56,7 @@ func Tags(tags tftags.KeyValueTags) map[string]*string {
 	return aws.StringMap(tags.Map())
 }
 
-// KeyValueTags creates KeyValueTags from amplify service tags.
+// KeyValueTags creates tftags.KeyValueTags from amplify service tags.
 func KeyValueTags(ctx context.Context, tags map[string]*string) tftags.KeyValueTags {
 	return tftags.New(ctx, tags)
 }
@@ -85,6 +87,8 @@ func updateTags(ctx context.Context, conn amplifyiface.AmplifyAPI, identifier st
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.Amplify)
 	if len(removedTags) > 0 {
diff --git a/internal/service/amplify/wait.go b/internal/service/amplify/wait.go
index a18dd3f0a63..b37d3229898 100644
--- a/internal/service/amplify/wait.go
+++ b/internal/service/amplify/wait.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package amplify
 
 import (
diff --git a/internal/service/amplify/webhook.go b/internal/service/amplify/webhook.go
index 30fb2cec69d..db0fa31e191 100644
--- a/internal/service/amplify/webhook.go
+++ b/internal/service/amplify/webhook.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package amplify
 
 import (
 	"context"
 	"log"
-	"regexp"
 	"strings"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/aws/aws-sdk-go/service/amplify"
@@ -44,7 +47,7 @@ func ResourceWebhook() *schema.Resource {
 			"branch_name": {
 				Type:         schema.TypeString,
 				Required:     true,
-				ValidateFunc: validation.StringMatch(regexp.MustCompile(`^[0-9A-Za-z/_.-]{1,255}$`), "should be not be more than 255 letters, numbers, and the symbols /_.-"),
+				ValidateFunc: validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z/_.-]{1,255}$`), "should be not be more than 255 letters, numbers, and the symbols /_.-"),
 			},
 
 			"description": {
diff --git a/internal/service/amplify/webhook_test.go b/internal/service/amplify/webhook_test.go
index afbb7d10d12..b69c443ee74 100644
--- a/internal/service/amplify/webhook_test.go
+++ b/internal/service/amplify/webhook_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package amplify_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/amplify"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -32,10 +35,10 @@ func testAccWebhook_basic(t *testing.T) {
 				Config: testAccWebhookConfig_basic(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckWebhookExists(ctx, resourceName, &webhook),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "amplify", regexp.MustCompile(`apps/.+/webhooks/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "amplify", regexache.MustCompile(`apps/.+/webhooks/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "branch_name", rName),
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
-					resource.TestMatchResourceAttr(resourceName, "url", regexp.MustCompile(fmt.Sprintf(`^https://webhooks.amplify.%s.%s/.+$`, acctest.Region(), acctest.PartitionDNSSuffix()))),
+					resource.TestMatchResourceAttr(resourceName, "url", regexache.MustCompile(fmt.Sprintf(`^https://webhooks.amplify.%s.%s/.+$`, acctest.Region(), acctest.PartitionDNSSuffix()))),
 				),
 			},
 			{
diff --git a/internal/service/apigateway/account.go b/internal/service/apigateway/account.go
index f85da436149..d2cddddb3ec 100644
--- a/internal/service/apigateway/account.go
+++ b/internal/service/apigateway/account.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigateway
 
 import (
@@ -10,7 +13,9 @@ import (
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
+	"github.com/hashicorp/terraform-provider-aws/internal/flex"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/internal/verify"
 )
 
 // @SDKResource("aws_api_gateway_account")
@@ -26,9 +31,19 @@ func ResourceAccount() *schema.Resource {
 		},
 
 		Schema: map[string]*schema.Schema{
-			"cloudwatch_role_arn": {
+			"api_key_version": {
 				Type:     schema.TypeString,
-				Optional: true,
+				Computed: true,
+			},
+			"cloudwatch_role_arn": {
+				Type:         schema.TypeString,
+				Optional:     true,
+				ValidateFunc: verify.ValidARN,
+			},
+			"features": {
+				Type:     schema.TypeSet,
+				Elem:     &schema.Schema{Type: schema.TypeString},
+				Computed: true,
 			},
 			"throttle_settings": {
 				Type:     schema.TypeList,
@@ -56,9 +71,6 @@ func resourceAccountUpdate(ctx context.Context, d *schema.ResourceData, meta int
 
 	input := &apigateway.UpdateAccountInput{}
 
-	// Unfortunately AWS API doesn't allow empty ARNs,
-	// even though that's default settings for new AWS accounts
-	// BadRequestException: The role ARN is not well formed
 	if v, ok := d.GetOk("cloudwatch_role_arn"); ok {
 		input.PatchOperations = []*apigateway.PatchOperation{{
 			Op:    aws.String(apigateway.OpReplace),
@@ -66,7 +78,11 @@ func resourceAccountUpdate(ctx context.Context, d *schema.ResourceData, meta int
 			Value: aws.String(v.(string)),
 		}}
 	} else {
-		input.PatchOperations = []*apigateway.PatchOperation{}
+		input.PatchOperations = []*apigateway.PatchOperation{{
+			Op:    aws.String(apigateway.OpReplace),
+			Path:  aws.String("/cloudwatchRoleArn"),
+			Value: aws.String(""),
+		}}
 	}
 
 	_, err := tfresource.RetryWhen(ctx, propagationTimeout,
@@ -107,13 +123,9 @@ func resourceAccountRead(ctx context.Context, d *schema.ResourceData, meta inter
 		return sdkdiag.AppendErrorf(diags, "reading API Gateway Account: %s", err)
 	}
 
-	if _, ok := d.GetOk("cloudwatch_role_arn"); ok {
-		// Backwards compatibility:
-		// CloudwatchRoleArn cannot be empty nor made empty via API
-		// This resource can however be useful w/out defining cloudwatch_role_arn
-		// (e.g. for referencing throttle_settings)
-		d.Set("cloudwatch_role_arn", account.CloudwatchRoleArn)
-	}
+	d.Set("api_key_version", account.ApiKeyVersion)
+	d.Set("cloudwatch_role_arn", account.CloudwatchRoleArn)
+	d.Set("features", flex.FlattenStringSet(account.Features))
 	if err := d.Set("throttle_settings", flattenThrottleSettings(account.ThrottleSettings)); err != nil {
 		return sdkdiag.AppendErrorf(diags, "setting throttle_settings: %s", err)
 	}
diff --git a/internal/service/apigateway/account_test.go b/internal/service/apigateway/account_test.go
index 15838671002..8993ca50a9e 100644
--- a/internal/service/apigateway/account_test.go
+++ b/internal/service/apigateway/account_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigateway_test
 
 import (
@@ -26,13 +29,14 @@ func TestAccAPIGatewayAccount_basic(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttrPair(resourceName, "cloudwatch_role_arn", "aws_iam_role.test.0", "arn"),
 					resource.TestCheckResourceAttr(resourceName, "throttle_settings.#", "1"),
+					resource.TestCheckResourceAttrSet(resourceName, "api_key_version"),
+					resource.TestCheckResourceAttrSet(resourceName, "features.#"),
 				),
 			},
 			{
-				ResourceName:            resourceName,
-				ImportState:             true,
-				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"cloudwatch_role_arn"},
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
 			},
 			{
 				Config: testAccAccountConfig_role1(rName),
@@ -58,50 +62,25 @@ resource "aws_api_gateway_account" "test" {}
 
 func testAccAccountConfig_base(rName string) string {
 	return fmt.Sprintf(`
+data "aws_partition" "current" {}
+
 resource "aws_iam_role" "test" {
   count = 2
 
   name = "%[1]s-${count.index}"
 
-  assume_role_policy = <<EOF
-{
-  "Version": "2012-10-17",
-  "Statement": [{
-    "Sid": "",
-    "Effect": "Allow",
-    "Principal": {
-      "Service": "apigateway.amazonaws.com"
-    },
-    "Action": "sts:AssumeRole"
-  }]
-}
-EOF
-}
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [{
+      Action = "sts:AssumeRole"
+      Effect = "Allow"
+      Principal = {
+        Service = "apigateway.amazonaws.com"
+      }
+    }]
+  })
 
-resource "aws_iam_role_policy" "test" {
-  count = 2
-
-  name = "%[1]s-${count.index}"
-  role = aws_iam_role.test[count.index].id
-
-  policy = <<EOF
-{
-  "Version": "2012-10-17",
-  "Statement": [{
-    "Effect": "Allow",
-    "Action": [
-      "logs:CreateLogGroup",
-      "logs:CreateLogStream",
-      "logs:DescribeLogGroups",
-      "logs:DescribeLogStreams",
-      "logs:PutLogEvents",
-      "logs:GetLogEvents",
-      "logs:FilterLogEvents"
-    ],
-    "Resource": "*"
-  }]
-}
-EOF
+  managed_policy_arns = ["arn:${data.aws_partition.current.partition}:iam::aws:policy/service-role/AmazonAPIGatewayPushToCloudWatchLogs"]
 }
 `, rName)
 }
diff --git a/internal/service/apigateway/api_key.go b/internal/service/apigateway/api_key.go
index b6c82d47df8..a9bc1cc418c 100644
--- a/internal/service/apigateway/api_key.go
+++ b/internal/service/apigateway/api_key.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigateway
 
 import (
@@ -35,34 +38,38 @@ func ResourceAPIKey() *schema.Resource {
 		},
 
 		Schema: map[string]*schema.Schema{
-			"name": {
+			"arn": {
 				Type:     schema.TypeString,
-				Required: true,
-				ForceNew: true,
+				Computed: true,
+			},
+			"created_date": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"customer_id": {
+				Type:     schema.TypeString,
+				Optional: true,
 			},
-
 			"description": {
 				Type:     schema.TypeString,
 				Optional: true,
 				Default:  "Managed by Terraform",
 			},
-
 			"enabled": {
 				Type:     schema.TypeBool,
 				Optional: true,
 				Default:  true,
 			},
-
-			"created_date": {
+			"last_updated_date": {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
-
-			"last_updated_date": {
+			"name": {
 				Type:     schema.TypeString,
-				Computed: true,
+				Required: true,
 			},
-
+			names.AttrTags:    tftags.TagsSchema(),
+			names.AttrTagsAll: tftags.TagsSchemaComputed(),
 			"value": {
 				Type:         schema.TypeString,
 				Optional:     true,
@@ -71,12 +78,6 @@ func ResourceAPIKey() *schema.Resource {
 				Sensitive:    true,
 				ValidateFunc: validation.StringLenBetween(20, 128),
 			},
-			"arn": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
-			names.AttrTags:    tftags.TagsSchema(),
-			names.AttrTagsAll: tftags.TagsSchemaComputed(),
 		},
 
 		CustomizeDiff: verify.SetTagsDiff,
@@ -96,6 +97,10 @@ func resourceAPIKeyCreate(ctx context.Context, d *schema.ResourceData, meta inte
 		Value:       aws.String(d.Get("value").(string)),
 	}
 
+	if v, ok := d.GetOk("customer_id"); ok {
+		input.CustomerId = aws.String(v.(string))
+	}
+
 	apiKey, err := conn.CreateApiKeyWithContext(ctx, input)
 
 	if err != nil {
@@ -132,25 +137,20 @@ func resourceAPIKeyRead(ctx context.Context, d *schema.ResourceData, meta interf
 		Resource:  fmt.Sprintf("/apikeys/%s", d.Id()),
 	}.String()
 	d.Set("arn", arn)
-
-	d.Set("name", apiKey.Name)
+	d.Set("created_date", apiKey.CreatedDate.Format(time.RFC3339))
+	d.Set("customer_id", apiKey.CustomerId)
 	d.Set("description", apiKey.Description)
 	d.Set("enabled", apiKey.Enabled)
+	d.Set("last_updated_date", apiKey.LastUpdatedDate.Format(time.RFC3339))
+	d.Set("name", apiKey.Name)
 	d.Set("value", apiKey.Value)
 
-	if err := d.Set("created_date", apiKey.CreatedDate.Format(time.RFC3339)); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting created_date: %s", err)
-	}
-
-	if err := d.Set("last_updated_date", apiKey.LastUpdatedDate.Format(time.RFC3339)); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting last_updated_date: %s", err)
-	}
-
 	return diags
 }
 
 func resourceAPIKeyUpdateOperations(d *schema.ResourceData) []*apigateway.PatchOperation {
 	operations := make([]*apigateway.PatchOperation, 0)
+
 	if d.HasChange("enabled") {
 		isEnabled := "false"
 		if d.Get("enabled").(bool) {
@@ -171,6 +171,22 @@ func resourceAPIKeyUpdateOperations(d *schema.ResourceData) []*apigateway.PatchO
 		})
 	}
 
+	if d.HasChange("name") {
+		operations = append(operations, &apigateway.PatchOperation{
+			Op:    aws.String(apigateway.OpReplace),
+			Path:  aws.String("/name"),
+			Value: aws.String(d.Get("name").(string)),
+		})
+	}
+
+	if d.HasChange("customer_id") {
+		operations = append(operations, &apigateway.PatchOperation{
+			Op:    aws.String(apigateway.OpReplace),
+			Path:  aws.String("/customerId"),
+			Value: aws.String(d.Get("customer_id").(string)),
+		})
+	}
+
 	return operations
 }
 
diff --git a/internal/service/apigateway/api_key_data_source.go b/internal/service/apigateway/api_key_data_source.go
index 9049cdc040a..289919d6ea8 100644
--- a/internal/service/apigateway/api_key_data_source.go
+++ b/internal/service/apigateway/api_key_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigateway
 
 import (
@@ -16,12 +19,13 @@ import (
 func DataSourceAPIKey() *schema.Resource {
 	return &schema.Resource{
 		ReadWithoutTimeout: dataSourceAPIKeyRead,
+
 		Schema: map[string]*schema.Schema{
-			"id": {
+			"created_date": {
 				Type:     schema.TypeString,
-				Required: true,
+				Computed: true,
 			},
-			"name": {
+			"customer_id": {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
@@ -29,24 +33,28 @@ func DataSourceAPIKey() *schema.Resource {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
-			"created_date": {
-				Type:     schema.TypeString,
+			"enabled": {
+				Type:     schema.TypeBool,
 				Computed: true,
 			},
+			"id": {
+				Type:     schema.TypeString,
+				Required: true,
+			},
 			"last_updated_date": {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
-			"enabled": {
-				Type:     schema.TypeBool,
+			"name": {
+				Type:     schema.TypeString,
 				Computed: true,
 			},
+			"tags": tftags.TagsSchemaComputed(),
 			"value": {
 				Type:      schema.TypeString,
 				Computed:  true,
 				Sensitive: true,
 			},
-			"tags": tftags.TagsSchemaComputed(),
 		},
 	}
 }
@@ -64,12 +72,13 @@ func dataSourceAPIKeyRead(ctx context.Context, d *schema.ResourceData, meta inte
 	}
 
 	d.SetId(aws.StringValue(apiKey.Id))
-	d.Set("name", apiKey.Name)
-	d.Set("value", apiKey.Value)
 	d.Set("created_date", aws.TimeValue(apiKey.CreatedDate).Format(time.RFC3339))
+	d.Set("customer_id", apiKey.CustomerId)
 	d.Set("description", apiKey.Description)
 	d.Set("enabled", apiKey.Enabled)
 	d.Set("last_updated_date", aws.TimeValue(apiKey.LastUpdatedDate).Format(time.RFC3339))
+	d.Set("name", apiKey.Name)
+	d.Set("value", apiKey.Value)
 
 	if err := d.Set("tags", KeyValueTags(ctx, apiKey.Tags).IgnoreAWS().IgnoreConfig(ignoreTagsConfig).Map()); err != nil {
 		return sdkdiag.AppendErrorf(diags, "setting tags: %s", err)
diff --git a/internal/service/apigateway/api_key_data_source_test.go b/internal/service/apigateway/api_key_data_source_test.go
index be815070588..8b5df61874f 100644
--- a/internal/service/apigateway/api_key_data_source_test.go
+++ b/internal/service/apigateway/api_key_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigateway_test
 
 import (
@@ -24,21 +27,22 @@ func TestAccAPIGatewayAPIKeyDataSource_basic(t *testing.T) {
 			{
 				Config: testAccAPIKeyDataSourceConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttrPair(resourceName, "created_date", dataSourceName, "created_date"),
+					resource.TestCheckResourceAttrPair(resourceName, "customer_id", dataSourceName, "customer_id"),
+					resource.TestCheckResourceAttrPair(resourceName, "description", dataSourceName, "description"),
+					resource.TestCheckResourceAttrPair(resourceName, "enabled", dataSourceName, "enabled"),
 					resource.TestCheckResourceAttrPair(resourceName, "id", dataSourceName, "id"),
+					resource.TestCheckResourceAttrPair(resourceName, "last_updated_date", dataSourceName, "last_updated_date"),
 					resource.TestCheckResourceAttrPair(resourceName, "name", dataSourceName, "name"),
+					resource.TestCheckResourceAttrPair(resourceName, "tags.%", dataSourceName, "tags.%"),
 					resource.TestCheckResourceAttrPair(resourceName, "value", dataSourceName, "value"),
-					resource.TestCheckResourceAttrPair(resourceName, "enabled", dataSourceName, "enabled"),
-					resource.TestCheckResourceAttrPair(resourceName, "description", dataSourceName, "description"),
-					resource.TestCheckResourceAttrSet(dataSourceName, "last_updated_date"),
-					resource.TestCheckResourceAttrSet(dataSourceName, "created_date"),
-					resource.TestCheckResourceAttr(dataSourceName, "tags.%", "0"),
 				),
 			},
 		},
 	})
 }
 
-func testAccAPIKeyDataSourceConfig_basic(r string) string {
+func testAccAPIKeyDataSourceConfig_basic(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_api_gateway_api_key" "test" {
   name = %[1]q
@@ -47,5 +51,5 @@ resource "aws_api_gateway_api_key" "test" {
 data "aws_api_gateway_api_key" "test" {
   id = aws_api_gateway_api_key.test.id
 }
-`, r)
+`, rName)
 }
diff --git a/internal/service/apigateway/api_key_test.go b/internal/service/apigateway/api_key_test.go
index c806787eaa7..6dc761d192b 100644
--- a/internal/service/apigateway/api_key_test.go
+++ b/internal/service/apigateway/api_key_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigateway_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/apigateway"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -19,9 +22,10 @@ import (
 
 func TestAccAPIGatewayAPIKey_basic(t *testing.T) {
 	ctx := acctest.Context(t)
-	var apiKey1 apigateway.ApiKey
+	var apiKey1, apiKey2 apigateway.ApiKey
 	resourceName := "aws_api_gateway_api_key.test"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	rNameUpdated := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
@@ -33,8 +37,9 @@ func TestAccAPIGatewayAPIKey_basic(t *testing.T) {
 				Config: testAccAPIKeyConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckAPIKeyExists(ctx, resourceName, &apiKey1),
-					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexp.MustCompile(`/apikeys/+.`)),
+					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexache.MustCompile(`/apikeys/+.`)),
 					resource.TestCheckResourceAttrSet(resourceName, "created_date"),
+					resource.TestCheckResourceAttr(resourceName, "customer_id", ""),
 					resource.TestCheckResourceAttr(resourceName, "description", "Managed by Terraform"),
 					resource.TestCheckResourceAttr(resourceName, "enabled", "true"),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
@@ -47,6 +52,20 @@ func TestAccAPIGatewayAPIKey_basic(t *testing.T) {
 				ImportState:       true,
 				ImportStateVerify: true,
 			},
+			{
+				Config: testAccAPIKeyConfig_basic(rNameUpdated),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAPIKeyExists(ctx, resourceName, &apiKey2),
+					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexache.MustCompile(`/apikeys/+.`)),
+					resource.TestCheckResourceAttrSet(resourceName, "created_date"),
+					resource.TestCheckResourceAttr(resourceName, "customer_id", ""),
+					resource.TestCheckResourceAttr(resourceName, "description", "Managed by Terraform"),
+					resource.TestCheckResourceAttr(resourceName, "enabled", "true"),
+					resource.TestCheckResourceAttr(resourceName, "name", rNameUpdated),
+					resource.TestCheckResourceAttrSet(resourceName, "last_updated_date"),
+					resource.TestCheckResourceAttrSet(resourceName, "value"),
+				),
+			},
 		},
 	})
 }
@@ -97,6 +116,42 @@ func TestAccAPIGatewayAPIKey_tags(t *testing.T) {
 	})
 }
 
+func TestAccAPIGatewayAPIKey_customerID(t *testing.T) {
+	ctx := acctest.Context(t)
+	var apiKey1, apiKey2 apigateway.ApiKey
+	resourceName := "aws_api_gateway_api_key.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, apigateway.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckAPIKeyDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccAPIKeyConfig_customerID(rName, "cid1"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAPIKeyExists(ctx, resourceName, &apiKey1),
+					resource.TestCheckResourceAttr(resourceName, "customer_id", "cid1"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				Config: testAccAPIKeyConfig_customerID(rName, "cid2"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAPIKeyExists(ctx, resourceName, &apiKey2),
+					testAccCheckAPIKeyNotRecreated(&apiKey1, &apiKey2),
+					resource.TestCheckResourceAttr(resourceName, "customer_id", "cid2"),
+				),
+			},
+		},
+	})
+}
+
 func TestAccAPIGatewayAPIKey_description(t *testing.T) {
 	ctx := acctest.Context(t)
 	var apiKey1, apiKey2 apigateway.ApiKey
@@ -315,6 +370,15 @@ resource "aws_api_gateway_api_key" "test" {
 `, rName, tagKey1, tagValue1, tagKey2, tagValue2)
 }
 
+func testAccAPIKeyConfig_customerID(rName, customerID string) string {
+	return fmt.Sprintf(`
+resource "aws_api_gateway_api_key" "test" {
+  customer_id = %[2]q
+  name        = %[1]q
+}
+`, rName, customerID)
+}
+
 func testAccAPIKeyConfig_description(rName, description string) string {
 	return fmt.Sprintf(`
 resource "aws_api_gateway_api_key" "test" {
diff --git a/internal/service/apigateway/authorizer.go b/internal/service/apigateway/authorizer.go
index 504268dcc5b..497a97f1ee7 100644
--- a/internal/service/apigateway/authorizer.go
+++ b/internal/service/apigateway/authorizer.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigateway
 
 import (
diff --git a/internal/service/apigateway/authorizer_data_source.go b/internal/service/apigateway/authorizer_data_source.go
index 92779d3f562..70e6780fb58 100644
--- a/internal/service/apigateway/authorizer_data_source.go
+++ b/internal/service/apigateway/authorizer_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigateway
 
 import (
diff --git a/internal/service/apigateway/authorizer_data_source_test.go b/internal/service/apigateway/authorizer_data_source_test.go
index 48b0e122989..a8b295538f5 100644
--- a/internal/service/apigateway/authorizer_data_source_test.go
+++ b/internal/service/apigateway/authorizer_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigateway_test
 
 import (
diff --git a/internal/service/apigateway/authorizer_test.go b/internal/service/apigateway/authorizer_test.go
index bab42123472..39d36b68e8a 100644
--- a/internal/service/apigateway/authorizer_test.go
+++ b/internal/service/apigateway/authorizer_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigateway_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"strconv"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/apigateway"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -35,7 +38,7 @@ func TestAccAPIGatewayAuthorizer_basic(t *testing.T) {
 				Config: testAccAuthorizerConfig_lambda(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckAuthorizerExists(ctx, resourceName, &conf),
-					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexp.MustCompile(`/restapis/.+/authorizers/.+`)),
+					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexache.MustCompile(`/restapis/.+/authorizers/.+`)),
 					resource.TestCheckResourceAttrPair(resourceName, "authorizer_uri", lambdaResourceName, "invoke_arn"),
 					resource.TestCheckResourceAttr(resourceName, "identity_source", "method.request.header.Authorization"),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
@@ -248,15 +251,15 @@ func TestAccAPIGatewayAuthorizer_authTypeValidation(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccAuthorizerConfig_authTypeValidationDefaultToken(rName),
-				ExpectError: regexp.MustCompile(`authorizer_uri must be set non-empty when authorizer type is TOKEN`),
+				ExpectError: regexache.MustCompile(`authorizer_uri must be set non-empty when authorizer type is TOKEN`),
 			},
 			{
 				Config:      testAccAuthorizerConfig_authTypeValidationRequest(rName),
-				ExpectError: regexp.MustCompile(`authorizer_uri must be set non-empty when authorizer type is REQUEST`),
+				ExpectError: regexache.MustCompile(`authorizer_uri must be set non-empty when authorizer type is REQUEST`),
 			},
 			{
 				Config:      testAccAuthorizerConfig_authTypeValidationCognito(rName),
-				ExpectError: regexp.MustCompile(`provider_arns must be set non-empty when authorizer type is COGNITO_USER_POOLS`),
+				ExpectError: regexache.MustCompile(`provider_arns must be set non-empty when authorizer type is COGNITO_USER_POOLS`),
 			},
 		},
 	})
diff --git a/internal/service/apigateway/authorizers_data_source.go b/internal/service/apigateway/authorizers_data_source.go
index 026c30935f3..5e9afe580bd 100644
--- a/internal/service/apigateway/authorizers_data_source.go
+++ b/internal/service/apigateway/authorizers_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigateway
 
 import (
diff --git a/internal/service/apigateway/authorizers_data_source_test.go b/internal/service/apigateway/authorizers_data_source_test.go
index a0bfa62f45e..3ae286e089b 100644
--- a/internal/service/apigateway/authorizers_data_source_test.go
+++ b/internal/service/apigateway/authorizers_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigateway_test
 
 import (
diff --git a/internal/service/apigateway/base_path_mapping.go b/internal/service/apigateway/base_path_mapping.go
index 0f96453c8db..7f8f69544ce 100644
--- a/internal/service/apigateway/base_path_mapping.go
+++ b/internal/service/apigateway/base_path_mapping.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigateway
 
 import (
diff --git a/internal/service/apigateway/base_path_mapping_test.go b/internal/service/apigateway/base_path_mapping_test.go
index 0ab527e5c2e..63df946f5f1 100644
--- a/internal/service/apigateway/base_path_mapping_test.go
+++ b/internal/service/apigateway/base_path_mapping_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigateway_test
 
 import (
diff --git a/internal/service/apigateway/client_certificate.go b/internal/service/apigateway/client_certificate.go
index c98fa88699c..51ef7d6d841 100644
--- a/internal/service/apigateway/client_certificate.go
+++ b/internal/service/apigateway/client_certificate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigateway
 
 import (
diff --git a/internal/service/apigateway/client_certificate_test.go b/internal/service/apigateway/client_certificate_test.go
index 3551fdeddd4..584324aa030 100644
--- a/internal/service/apigateway/client_certificate_test.go
+++ b/internal/service/apigateway/client_certificate_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigateway_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/apigateway"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
@@ -30,7 +33,7 @@ func TestAccAPIGatewayClientCertificate_basic(t *testing.T) {
 				Config: testAccClientCertificateConfig_basic,
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckClientCertificateExists(ctx, resourceName, &conf),
-					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexp.MustCompile(`/clientcertificates/+.`)),
+					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexache.MustCompile(`/clientcertificates/+.`)),
 					resource.TestCheckResourceAttr(resourceName, "description", "Hello from TF acceptance test"),
 				),
 			},
@@ -43,7 +46,7 @@ func TestAccAPIGatewayClientCertificate_basic(t *testing.T) {
 				Config: testAccClientCertificateConfig_basicUpdated,
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckClientCertificateExists(ctx, resourceName, &conf),
-					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexp.MustCompile(`/clientcertificates/+.`)),
+					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexache.MustCompile(`/clientcertificates/+.`)),
 					resource.TestCheckResourceAttr(resourceName, "description", "Hello from TF acceptance test - updated"),
 				),
 			},
diff --git a/internal/service/apigateway/consts.go b/internal/service/apigateway/consts.go
index a9bfc7564c3..8e04daf1efc 100644
--- a/internal/service/apigateway/consts.go
+++ b/internal/service/apigateway/consts.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigateway
 
 import (
diff --git a/internal/service/apigateway/deployment.go b/internal/service/apigateway/deployment.go
index 32d74bb58d7..38c51689214 100644
--- a/internal/service/apigateway/deployment.go
+++ b/internal/service/apigateway/deployment.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigateway
 
 import (
diff --git a/internal/service/apigateway/deployment_test.go b/internal/service/apigateway/deployment_test.go
index 6e8bc55a7a4..8acb5a77212 100644
--- a/internal/service/apigateway/deployment_test.go
+++ b/internal/service/apigateway/deployment_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigateway_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/apigateway"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -36,8 +39,8 @@ func TestAccAPIGatewayDeployment_basic(t *testing.T) {
 					testAccCheckDeploymentExists(ctx, resourceName, &deployment),
 					resource.TestCheckResourceAttrSet(resourceName, "created_date"),
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "execution_arn", "execute-api", regexp.MustCompile(".+/")),
-					resource.TestMatchResourceAttr(resourceName, "invoke_url", regexp.MustCompile(fmt.Sprintf("https://.+\\.execute-api\\.%s.amazonaws\\.com/", acctest.Region()))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "execution_arn", "execute-api", regexache.MustCompile(".+/")),
+					resource.TestMatchResourceAttr(resourceName, "invoke_url", regexache.MustCompile(fmt.Sprintf("https://.+\\.execute-api\\.%s.amazonaws\\.com/", acctest.Region()))),
 					resource.TestCheckResourceAttrPair(resourceName, "rest_api_id", restApiResourceName, "id"),
 					resource.TestCheckNoResourceAttr(resourceName, "stage_description"),
 					resource.TestCheckNoResourceAttr(resourceName, "stage_name"),
@@ -216,16 +219,16 @@ func TestAccAPIGatewayDeployment_stageName(t *testing.T) {
 					testAccCheckDeploymentExists(ctx, resourceName, &deployment),
 					testAccCheckStageExists(ctx, resourceName, &stage),
 					resource.TestCheckResourceAttr(resourceName, "stage_name", stageName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "execution_arn", "execute-api", regexp.MustCompile(fmt.Sprintf(".+/%s", stageName))),
-					resource.TestMatchResourceAttr(resourceName, "invoke_url", regexp.MustCompile(fmt.Sprintf("https://.+\\.execute-api\\.%s.amazonaws\\.com/%s", acctest.Region(), stageName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "execution_arn", "execute-api", regexache.MustCompile(fmt.Sprintf(".+/%s", stageName))),
+					resource.TestMatchResourceAttr(resourceName, "invoke_url", regexache.MustCompile(fmt.Sprintf("https://.+\\.execute-api\\.%s.amazonaws\\.com/%s", acctest.Region(), stageName))),
 				),
 			},
 			{
 				Config: testAccDeploymentConfig_required(rName),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckNoResourceAttr(resourceName, "stage_name"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "execution_arn", "execute-api", regexp.MustCompile(".+/")),
-					resource.TestMatchResourceAttr(resourceName, "invoke_url", regexp.MustCompile(fmt.Sprintf("https://.+\\.execute-api\\.%s.amazonaws\\.com/", acctest.Region()))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "execution_arn", "execute-api", regexache.MustCompile(".+/")),
+					resource.TestMatchResourceAttr(resourceName, "invoke_url", regexache.MustCompile(fmt.Sprintf("https://.+\\.execute-api\\.%s.amazonaws\\.com/", acctest.Region()))),
 				),
 			},
 		},
diff --git a/internal/service/apigateway/documentation_part.go b/internal/service/apigateway/documentation_part.go
index 035215552d7..7a9fb5eb16a 100644
--- a/internal/service/apigateway/documentation_part.go
+++ b/internal/service/apigateway/documentation_part.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigateway
 
 import (
diff --git a/internal/service/apigateway/documentation_part_test.go b/internal/service/apigateway/documentation_part_test.go
index bf08d33325e..8cc0e51e3bd 100644
--- a/internal/service/apigateway/documentation_part_test.go
+++ b/internal/service/apigateway/documentation_part_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigateway_test
 
 import (
diff --git a/internal/service/apigateway/documentation_version.go b/internal/service/apigateway/documentation_version.go
index 41604b0f2eb..25dc7c06892 100644
--- a/internal/service/apigateway/documentation_version.go
+++ b/internal/service/apigateway/documentation_version.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigateway
 
 import (
diff --git a/internal/service/apigateway/documentation_version_test.go b/internal/service/apigateway/documentation_version_test.go
index 2e5e41999aa..e244ce0aeeb 100644
--- a/internal/service/apigateway/documentation_version_test.go
+++ b/internal/service/apigateway/documentation_version_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigateway_test
 
 import (
diff --git a/internal/service/apigateway/domain_name.go b/internal/service/apigateway/domain_name.go
index 7d2d76dc901..7b4eb0bab5a 100644
--- a/internal/service/apigateway/domain_name.go
+++ b/internal/service/apigateway/domain_name.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigateway
 
 import (
diff --git a/internal/service/apigateway/domain_name_data_source.go b/internal/service/apigateway/domain_name_data_source.go
index 5faf4d0e125..864c73368be 100644
--- a/internal/service/apigateway/domain_name_data_source.go
+++ b/internal/service/apigateway/domain_name_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigateway
 
 import (
diff --git a/internal/service/apigateway/domain_name_data_source_test.go b/internal/service/apigateway/domain_name_data_source_test.go
index a41eb79f17e..ff4035aebaf 100644
--- a/internal/service/apigateway/domain_name_data_source_test.go
+++ b/internal/service/apigateway/domain_name_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigateway_test
 
 import (
diff --git a/internal/service/apigateway/domain_name_test.go b/internal/service/apigateway/domain_name_test.go
index 99e5d1c2d82..293cee8850c 100644
--- a/internal/service/apigateway/domain_name_test.go
+++ b/internal/service/apigateway/domain_name_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigateway_test
 
 import (
 	"context"
 	"fmt"
 	"os"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/aws/aws-sdk-go/aws/endpoints"
 	"github.com/aws/aws-sdk-go/service/apigateway"
@@ -39,7 +42,7 @@ func TestAccAPIGatewayDomainName_certificateARN(t *testing.T) {
 					testAccCheckDomainNameExists(ctx, resourceName, &domainName),
 					testAccCheckResourceAttrRegionalARNEdgeDomainName(resourceName, "arn", "apigateway", domain),
 					resource.TestCheckResourceAttrPair(resourceName, "certificate_arn", acmCertificateResourceName, "arn"),
-					resource.TestMatchResourceAttr(resourceName, "cloudfront_domain_name", regexp.MustCompile(`[a-z0-9]+.cloudfront.net`)),
+					resource.TestMatchResourceAttr(resourceName, "cloudfront_domain_name", regexache.MustCompile(`[0-9a-z]+.cloudfront.net`)),
 					resource.TestCheckResourceAttr(resourceName, "cloudfront_zone_id", "Z2FDTNDATAQYW2"),
 					resource.TestCheckResourceAttrPair(resourceName, "domain_name", acmCertificateResourceName, "domain_name"),
 				),
@@ -99,7 +102,7 @@ func TestAccAPIGatewayDomainName_certificateName(t *testing.T) {
 				Config: testAccDomainNameConfig_certificate(domainName, certificatePrivateKey, certificateBody, certificateChain),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDomainNameExists(ctx, resourceName, &conf),
-					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexp.MustCompile(`/domainnames/+.`)),
+					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexache.MustCompile(`/domainnames/+.`)),
 					resource.TestCheckResourceAttr(resourceName, "certificate_name", "tf-acc-apigateway-domain-name"),
 					resource.TestCheckResourceAttrSet(resourceName, "cloudfront_domain_name"),
 					resource.TestCheckResourceAttr(resourceName, "cloudfront_zone_id", "Z2FDTNDATAQYW2"),
@@ -137,8 +140,8 @@ func TestAccAPIGatewayDomainName_regionalCertificateARN(t *testing.T) {
 					testAccCheckDomainNameExists(ctx, resourceName, &domainName),
 					testAccCheckResourceAttrRegionalARNRegionalDomainName(resourceName, "arn", "apigateway", rName),
 					resource.TestCheckResourceAttr(resourceName, "domain_name", rName),
-					acctest.MatchResourceAttrRegionalHostname(resourceName, "regional_domain_name", "execute-api", regexp.MustCompile(`d-[a-z0-9]+`)),
-					resource.TestMatchResourceAttr(resourceName, "regional_zone_id", regexp.MustCompile(`^Z`)),
+					acctest.MatchResourceAttrRegionalHostname(resourceName, "regional_domain_name", "execute-api", regexache.MustCompile(`d-[0-9a-z]+`)),
+					resource.TestMatchResourceAttr(resourceName, "regional_zone_id", regexache.MustCompile(`^Z`)),
 				),
 			},
 		},
@@ -186,8 +189,8 @@ func TestAccAPIGatewayDomainName_regionalCertificateName(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "certificate_private_key", key),
 					resource.TestCheckResourceAttrSet(resourceName, "certificate_upload_date"),
 					resource.TestCheckResourceAttr(resourceName, "domain_name", rName),
-					acctest.MatchResourceAttrRegionalHostname(resourceName, "regional_domain_name", "execute-api", regexp.MustCompile(`d-[a-z0-9]+`)),
-					resource.TestMatchResourceAttr(resourceName, "regional_zone_id", regexp.MustCompile(`^Z`)),
+					acctest.MatchResourceAttrRegionalHostname(resourceName, "regional_domain_name", "execute-api", regexache.MustCompile(`d-[0-9a-z]+`)),
+					resource.TestMatchResourceAttr(resourceName, "regional_zone_id", regexache.MustCompile(`^Z`)),
 				),
 			},
 		},
@@ -318,7 +321,7 @@ func TestAccAPIGatewayDomainName_MutualTLSAuthentication_basic(t *testing.T) {
 				Config: testAccDomainNameConfig_mutualTLSAuthentication(rName, rootDomain, domain),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDomainNameExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexp.MustCompile(`/domainnames/+.`)),
+					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexache.MustCompile(`/domainnames/+.`)),
 					resource.TestCheckResourceAttrPair(resourceName, "domain_name", acmCertificateResourceName, "domain_name"),
 					resource.TestCheckResourceAttr(resourceName, "mutual_tls_authentication.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "mutual_tls_authentication.0.truststore_uri", fmt.Sprintf("s3://%s/%s", rName, rName)),
@@ -343,7 +346,7 @@ func TestAccAPIGatewayDomainName_MutualTLSAuthentication_basic(t *testing.T) {
 				Config: testAccDomainNameConfig_mutualTLSAuthentication(rName, rootDomain, domain),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDomainNameExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexp.MustCompile(`/domainnames/+.`)),
+					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexache.MustCompile(`/domainnames/+.`)),
 					resource.TestCheckResourceAttrPair(resourceName, "domain_name", acmCertificateResourceName, "domain_name"),
 					resource.TestCheckResourceAttr(resourceName, "mutual_tls_authentication.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "mutual_tls_authentication.0.truststore_uri", fmt.Sprintf("s3://%s/%s", rName, rName)),
@@ -376,7 +379,7 @@ func TestAccAPIGatewayDomainName_MutualTLSAuthentication_ownership(t *testing.T)
 				Config: testAccDomainNameConfig_mutualTLSOwnership(rName, rootDomain, domain, certificate, key),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDomainNameExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexp.MustCompile(`/domainnames/+.`)),
+					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexache.MustCompile(`/domainnames/+.`)),
 					resource.TestCheckResourceAttrPair(resourceName, "domain_name", publicAcmCertificateResourceName, "domain_name"),
 					resource.TestCheckResourceAttrPair(resourceName, "ownership_verification_certificate_arn", publicAcmCertificateResourceName, "arn"),
 					resource.TestCheckResourceAttr(resourceName, "mutual_tls_authentication.#", "1"),
diff --git a/internal/service/apigateway/errorcheck_test.go b/internal/service/apigateway/errorcheck_test.go
index b03b31e3b91..dc83e0a3fa4 100644
--- a/internal/service/apigateway/errorcheck_test.go
+++ b/internal/service/apigateway/errorcheck_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigateway_test
 
 import (
diff --git a/internal/service/apigateway/export_data_source.go b/internal/service/apigateway/export_data_source.go
index a344cb8fae7..87208885206 100644
--- a/internal/service/apigateway/export_data_source.go
+++ b/internal/service/apigateway/export_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigateway
 
 import (
diff --git a/internal/service/apigateway/export_data_source_test.go b/internal/service/apigateway/export_data_source_test.go
index 3594cf9f56b..75a6f31e530 100644
--- a/internal/service/apigateway/export_data_source_test.go
+++ b/internal/service/apigateway/export_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigateway_test
 
 import (
diff --git a/internal/service/apigateway/flex.go b/internal/service/apigateway/flex.go
index 7c142de3efc..24824931833 100644
--- a/internal/service/apigateway/flex.go
+++ b/internal/service/apigateway/flex.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigateway
 
 import (
diff --git a/internal/service/apigateway/forge.go b/internal/service/apigateway/forge.go
index 9804e60543b..92328ed584c 100644
--- a/internal/service/apigateway/forge.go
+++ b/internal/service/apigateway/forge.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigateway
 
 import (
diff --git a/internal/service/apigateway/gateway_response.go b/internal/service/apigateway/gateway_response.go
index 9b12236cfb7..9d52355476c 100644
--- a/internal/service/apigateway/gateway_response.go
+++ b/internal/service/apigateway/gateway_response.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigateway
 
 import (
diff --git a/internal/service/apigateway/gateway_response_test.go b/internal/service/apigateway/gateway_response_test.go
index 60a69c90b9a..3eb03dbf147 100644
--- a/internal/service/apigateway/gateway_response_test.go
+++ b/internal/service/apigateway/gateway_response_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigateway_test
 
 import (
diff --git a/internal/service/apigateway/generate.go b/internal/service/apigateway/generate.go
index a32afc9c9a5..9762c336307 100644
--- a/internal/service/apigateway/generate.go
+++ b/internal/service/apigateway/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/listpages/main.go -ListOps=GetAuthorizers -Paginator=Position
 //go:generate go run ../../generate/tags/main.go -ServiceTagsMap -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
diff --git a/internal/service/apigateway/integration.go b/internal/service/apigateway/integration.go
index 167f0bedca5..3a6a5f07686 100644
--- a/internal/service/apigateway/integration.go
+++ b/internal/service/apigateway/integration.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigateway
 
 import (
diff --git a/internal/service/apigateway/integration_response.go b/internal/service/apigateway/integration_response.go
index 67c2be97f68..ed91d8fd1cd 100644
--- a/internal/service/apigateway/integration_response.go
+++ b/internal/service/apigateway/integration_response.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigateway
 
 import (
diff --git a/internal/service/apigateway/integration_response_test.go b/internal/service/apigateway/integration_response_test.go
index 869da6da037..02cb020e58a 100644
--- a/internal/service/apigateway/integration_response_test.go
+++ b/internal/service/apigateway/integration_response_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigateway_test
 
 import (
diff --git a/internal/service/apigateway/integration_test.go b/internal/service/apigateway/integration_test.go
index fab3fca0923..de0595cc4a3 100644
--- a/internal/service/apigateway/integration_test.go
+++ b/internal/service/apigateway/integration_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigateway_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/apigateway"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -342,7 +345,7 @@ func TestAccAPIGatewayIntegration_integrationType(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckIntegrationExists(ctx, resourceName, &conf),
 					resource.TestCheckResourceAttr(resourceName, "connection_type", "VPC_LINK"),
-					resource.TestMatchResourceAttr(resourceName, "connection_id", regexp.MustCompile("^[0-9a-z]+$")),
+					resource.TestMatchResourceAttr(resourceName, "connection_id", regexache.MustCompile("^[0-9a-z]+$")),
 				),
 			},
 			{
diff --git a/internal/service/apigateway/method.go b/internal/service/apigateway/method.go
index 94c9093daaa..eb2199eb909 100644
--- a/internal/service/apigateway/method.go
+++ b/internal/service/apigateway/method.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigateway
 
 import (
diff --git a/internal/service/apigateway/method_response.go b/internal/service/apigateway/method_response.go
index 5d55d3c665e..1b0668d474d 100644
--- a/internal/service/apigateway/method_response.go
+++ b/internal/service/apigateway/method_response.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigateway
 
 import (
diff --git a/internal/service/apigateway/method_response_test.go b/internal/service/apigateway/method_response_test.go
index b1a426135a9..611cb3b4364 100644
--- a/internal/service/apigateway/method_response_test.go
+++ b/internal/service/apigateway/method_response_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigateway_test
 
 import (
diff --git a/internal/service/apigateway/method_settings.go b/internal/service/apigateway/method_settings.go
index b85e3a92c2a..311e39d9a64 100644
--- a/internal/service/apigateway/method_settings.go
+++ b/internal/service/apigateway/method_settings.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigateway
 
 import (
diff --git a/internal/service/apigateway/method_settings_test.go b/internal/service/apigateway/method_settings_test.go
index 5d6be4d9b09..0119ce0c5ad 100644
--- a/internal/service/apigateway/method_settings_test.go
+++ b/internal/service/apigateway/method_settings_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigateway_test
 
 import (
diff --git a/internal/service/apigateway/method_test.go b/internal/service/apigateway/method_test.go
index 27a6396873f..8e33a66fcb3 100644
--- a/internal/service/apigateway/method_test.go
+++ b/internal/service/apigateway/method_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigateway_test
 
 import (
diff --git a/internal/service/apigateway/model.go b/internal/service/apigateway/model.go
index 53511c164b1..fb1979578b6 100644
--- a/internal/service/apigateway/model.go
+++ b/internal/service/apigateway/model.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigateway
 
 import (
diff --git a/internal/service/apigateway/model_test.go b/internal/service/apigateway/model_test.go
index 0dab6322442..d09ab158eed 100644
--- a/internal/service/apigateway/model_test.go
+++ b/internal/service/apigateway/model_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigateway_test
 
 import (
diff --git a/internal/service/apigateway/request_validator.go b/internal/service/apigateway/request_validator.go
index 5952792c47e..6d61379d050 100644
--- a/internal/service/apigateway/request_validator.go
+++ b/internal/service/apigateway/request_validator.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigateway
 
 import (
diff --git a/internal/service/apigateway/request_validator_test.go b/internal/service/apigateway/request_validator_test.go
index 360b5b8158d..6ada6d9c823 100644
--- a/internal/service/apigateway/request_validator_test.go
+++ b/internal/service/apigateway/request_validator_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigateway_test
 
 import (
diff --git a/internal/service/apigateway/resource.go b/internal/service/apigateway/resource.go
index 5f84e10f6df..a7b07582a5c 100644
--- a/internal/service/apigateway/resource.go
+++ b/internal/service/apigateway/resource.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigateway
 
 import (
diff --git a/internal/service/apigateway/resource_data_source.go b/internal/service/apigateway/resource_data_source.go
index 06aba676b5e..bf36dc30605 100644
--- a/internal/service/apigateway/resource_data_source.go
+++ b/internal/service/apigateway/resource_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigateway
 
 import (
diff --git a/internal/service/apigateway/resource_data_source_test.go b/internal/service/apigateway/resource_data_source_test.go
index 48f20dfbf53..e03e0760e98 100644
--- a/internal/service/apigateway/resource_data_source_test.go
+++ b/internal/service/apigateway/resource_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigateway_test
 
 import (
diff --git a/internal/service/apigateway/resource_test.go b/internal/service/apigateway/resource_test.go
index ba855b31bc8..9bfa6d1890e 100644
--- a/internal/service/apigateway/resource_test.go
+++ b/internal/service/apigateway/resource_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigateway_test
 
 import (
diff --git a/internal/service/apigateway/rest_api.go b/internal/service/apigateway/rest_api.go
index d64f9b68981..9c53b7f3441 100644
--- a/internal/service/apigateway/rest_api.go
+++ b/internal/service/apigateway/rest_api.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigateway
 
 import (
@@ -19,10 +22,10 @@ import (
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
-	"github.com/hashicorp/terraform-provider-aws/internal/experimental/nullable"
 	"github.com/hashicorp/terraform-provider-aws/internal/flex"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/internal/types/nullable"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -395,19 +398,23 @@ func resourceRestAPIUpdate(ctx context.Context, d *schema.ResourceData, meta int
 			// Remove every binary media types. Simpler to remove and add new ones,
 			// since there are no replacings.
 			for _, v := range old {
-				operations = append(operations, &apigateway.PatchOperation{
-					Op:   aws.String(apigateway.OpRemove),
-					Path: aws.String(fmt.Sprintf("/%s/%s", prefix, escapeJSONPointer(v.(string)))),
-				})
+				if e, ok := v.(string); ok {
+					operations = append(operations, &apigateway.PatchOperation{
+						Op:   aws.String(apigateway.OpRemove),
+						Path: aws.String(fmt.Sprintf("/%s/%s", prefix, escapeJSONPointer(e))),
+					})
+				}
 			}
 
 			// Handle additions
 			if len(new) > 0 {
 				for _, v := range new {
-					operations = append(operations, &apigateway.PatchOperation{
-						Op:   aws.String(apigateway.OpAdd),
-						Path: aws.String(fmt.Sprintf("/%s/%s", prefix, escapeJSONPointer(v.(string)))),
-					})
+					if e, ok := v.(string); ok {
+						operations = append(operations, &apigateway.PatchOperation{
+							Op:   aws.String(apigateway.OpAdd),
+							Path: aws.String(fmt.Sprintf("/%s/%s", prefix, escapeJSONPointer(e))),
+						})
+					}
 				}
 			}
 		}
@@ -626,18 +633,22 @@ func resourceRestAPIWithBodyUpdateOperations(d *schema.ResourceData, output *api
 	}
 
 	if v, ok := d.GetOk("binary_media_types"); ok && len(v.([]interface{})) > 0 {
-		for _, elem := range aws.StringValueSlice(output.BinaryMediaTypes) {
-			operations = append(operations, &apigateway.PatchOperation{
-				Op:   aws.String(apigateway.OpRemove),
-				Path: aws.String("/binaryMediaTypes/" + escapeJSONPointer(elem)),
-			})
+		if len(output.BinaryMediaTypes) > 0 {
+			for _, elem := range aws.StringValueSlice(output.BinaryMediaTypes) {
+				operations = append(operations, &apigateway.PatchOperation{
+					Op:   aws.String(apigateway.OpRemove),
+					Path: aws.String("/binaryMediaTypes/" + escapeJSONPointer(elem)),
+				})
+			}
 		}
 
 		for _, elem := range v.([]interface{}) {
-			operations = append(operations, &apigateway.PatchOperation{
-				Op:   aws.String(apigateway.OpAdd),
-				Path: aws.String("/binaryMediaTypes/" + escapeJSONPointer(elem.(string))),
-			})
+			if el, ok := elem.(string); ok {
+				operations = append(operations, &apigateway.PatchOperation{
+					Op:   aws.String(apigateway.OpAdd),
+					Path: aws.String("/binaryMediaTypes/" + escapeJSONPointer(el)),
+				})
+			}
 		}
 	}
 
diff --git a/internal/service/apigateway/rest_api_data_source.go b/internal/service/apigateway/rest_api_data_source.go
index 0329ad7d28e..37f0a500e20 100644
--- a/internal/service/apigateway/rest_api_data_source.go
+++ b/internal/service/apigateway/rest_api_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigateway
 
 import (
@@ -13,8 +16,8 @@ import (
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
-	"github.com/hashicorp/terraform-provider-aws/internal/experimental/nullable"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
+	"github.com/hashicorp/terraform-provider-aws/internal/types/nullable"
 )
 
 // @SDKDataSource("aws_api_gateway_rest_api")
diff --git a/internal/service/apigateway/rest_api_data_source_test.go b/internal/service/apigateway/rest_api_data_source_test.go
index 41bc6322377..b519da7b239 100644
--- a/internal/service/apigateway/rest_api_data_source_test.go
+++ b/internal/service/apigateway/rest_api_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigateway_test
 
 import (
diff --git a/internal/service/apigateway/rest_api_policy.go b/internal/service/apigateway/rest_api_policy.go
index a2fea094fd3..756d289157f 100644
--- a/internal/service/apigateway/rest_api_policy.go
+++ b/internal/service/apigateway/rest_api_policy.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigateway
 
 import (
diff --git a/internal/service/apigateway/rest_api_policy_test.go b/internal/service/apigateway/rest_api_policy_test.go
index 2591201983f..00399391f6b 100644
--- a/internal/service/apigateway/rest_api_policy_test.go
+++ b/internal/service/apigateway/rest_api_policy_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigateway_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"strconv"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/apigateway"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/structure"
@@ -34,7 +37,7 @@ func TestAccAPIGatewayRestAPIPolicy_basic(t *testing.T) {
 				Config: testAccRestAPIPolicyConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRestAPIPolicyExists(ctx, resourceName, &v),
-					resource.TestMatchResourceAttr(resourceName, "policy", regexp.MustCompile(`"Action":"execute-api:Invoke".+`)),
+					resource.TestMatchResourceAttr(resourceName, "policy", regexache.MustCompile(`"Action":"execute-api:Invoke".+`)),
 				),
 			},
 			{
@@ -47,7 +50,7 @@ func TestAccAPIGatewayRestAPIPolicy_basic(t *testing.T) {
 				Config: testAccRestAPIPolicyConfig_updated(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRestAPIPolicyExists(ctx, resourceName, &v),
-					resource.TestMatchResourceAttr(resourceName, "policy", regexp.MustCompile(`"aws:SourceIp":"123.123.123.123/32".+`))),
+					resource.TestMatchResourceAttr(resourceName, "policy", regexache.MustCompile(`"aws:SourceIp":"123.123.123.123/32".+`))),
 			},
 		},
 	})
diff --git a/internal/service/apigateway/rest_api_test.go b/internal/service/apigateway/rest_api_test.go
index 2f7e1fee0d4..fa86fc8a08b 100644
--- a/internal/service/apigateway/rest_api_test.go
+++ b/internal/service/apigateway/rest_api_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigateway_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/apigateway"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -35,17 +38,17 @@ func TestAccAPIGatewayRestAPI_basic(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRestAPIExists(ctx, resourceName, &conf),
 					resource.TestCheckResourceAttr(resourceName, "api_key_source", "HEADER"),
-					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexp.MustCompile(`/restapis/+.`)),
+					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexache.MustCompile(`/restapis/+.`)),
 					resource.TestCheckResourceAttr(resourceName, "binary_media_types.#", "0"),
 					resource.TestCheckNoResourceAttr(resourceName, "body"),
 					acctest.CheckResourceAttrRFC3339(resourceName, "created_date"),
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
 					resource.TestCheckResourceAttr(resourceName, "disable_execute_api_endpoint", "false"),
 					resource.TestCheckResourceAttr(resourceName, "endpoint_configuration.#", "1"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "execution_arn", "execute-api", regexp.MustCompile(`[a-z0-9]+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "execution_arn", "execute-api", regexache.MustCompile(`[0-9a-z]+`)),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "parameters.%", "0"),
-					resource.TestMatchResourceAttr(resourceName, "root_resource_id", regexp.MustCompile(`[a-z0-9]+`)),
+					resource.TestMatchResourceAttr(resourceName, "root_resource_id", regexache.MustCompile(`[0-9a-z]+`)),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 				),
 			},
@@ -75,7 +78,7 @@ func TestAccAPIGatewayRestAPI_tags(t *testing.T) {
 				Config: testAccRestAPIConfig_tags1(rName, "key1", "value1"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRestAPIExists(ctx, resourceName, &conf),
-					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexp.MustCompile(`/restapis/+.`)),
+					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexache.MustCompile(`/restapis/+.`)),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
 				),
@@ -91,7 +94,7 @@ func TestAccAPIGatewayRestAPI_tags(t *testing.T) {
 				Config: testAccRestAPIConfig_tags2(rName, "key1", "value1updated", "key2", "value2"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRestAPIExists(ctx, resourceName, &conf),
-					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexp.MustCompile(`/restapis/+.`)),
+					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexache.MustCompile(`/restapis/+.`)),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1updated"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
@@ -102,7 +105,7 @@ func TestAccAPIGatewayRestAPI_tags(t *testing.T) {
 				Config: testAccRestAPIConfig_tags1(rName, "key2", "value2"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRestAPIExists(ctx, resourceName, &conf),
-					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexp.MustCompile(`/restapis/+.`)),
+					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexache.MustCompile(`/restapis/+.`)),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
 				),
@@ -1200,7 +1203,7 @@ func TestAccAPIGatewayRestAPI_FailOnWarnings(t *testing.T) {
 			// Verify invalid body fails creation, when fail_on_warnings is true
 			{
 				Config:      testAccRestAPIConfig_failOnWarnings(rName, "original", "fail_on_warnings = true"),
-				ExpectError: regexp.MustCompile(`BadRequestException: Warnings found during import`),
+				ExpectError: regexache.MustCompile(`BadRequestException: Warnings found during import`),
 			},
 			// Verify invalid body succeeds creation, when fail_on_warnings is not set
 			{
@@ -1208,7 +1211,7 @@ func TestAccAPIGatewayRestAPI_FailOnWarnings(t *testing.T) {
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckRestAPIExists(ctx, resourceName, &conf),
 					testAccCheckRestAPIRoutes(ctx, &conf, []string{"/", "/users"}),
-					resource.TestMatchResourceAttr(resourceName, "description", regexp.MustCompile(`original`)),
+					resource.TestMatchResourceAttr(resourceName, "description", regexache.MustCompile(`original`)),
 				),
 			},
 			{
@@ -1220,12 +1223,12 @@ func TestAccAPIGatewayRestAPI_FailOnWarnings(t *testing.T) {
 			// Verify invalid body fails update, when fail_on_warnings is true
 			{
 				Config:      testAccRestAPIConfig_failOnWarnings(rName, "update", "fail_on_warnings = true"),
-				ExpectError: regexp.MustCompile(`BadRequestException: Warnings found during import`),
+				ExpectError: regexache.MustCompile(`BadRequestException: Warnings found during import`),
 			},
 			// Verify invalid body succeeds update, when fail_on_warnings is not set
 			{
 				Config: testAccRestAPIConfig_failOnWarnings(rName, "update", ""),
-				Check:  resource.TestMatchResourceAttr(resourceName, "description", regexp.MustCompile(`update`)),
+				Check:  resource.TestMatchResourceAttr(resourceName, "description", regexache.MustCompile(`update`)),
 			},
 		},
 	})
@@ -1345,7 +1348,7 @@ func TestAccAPIGatewayRestAPI_Policy_overrideBody(t *testing.T) {
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckRestAPIExists(ctx, resourceName, &conf),
 					testAccCheckRestAPIRoutes(ctx, &conf, []string{"/", "/test"}),
-					resource.TestMatchResourceAttr(resourceName, "policy", regexp.MustCompile(`"Allow"`)),
+					resource.TestMatchResourceAttr(resourceName, "policy", regexache.MustCompile(`"Allow"`)),
 				),
 			},
 			{
@@ -1360,7 +1363,7 @@ func TestAccAPIGatewayRestAPI_Policy_overrideBody(t *testing.T) {
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckRestAPIExists(ctx, resourceName, &conf),
 					testAccCheckRestAPIRoutes(ctx, &conf, []string{"/", "/test2"}),
-					resource.TestMatchResourceAttr(resourceName, "policy", regexp.MustCompile(`"Allow"`)),
+					resource.TestMatchResourceAttr(resourceName, "policy", regexache.MustCompile(`"Allow"`)),
 				),
 			},
 			// Verify updated policy still overrides body
@@ -1369,7 +1372,7 @@ func TestAccAPIGatewayRestAPI_Policy_overrideBody(t *testing.T) {
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckRestAPIExists(ctx, resourceName, &conf),
 					testAccCheckRestAPIRoutes(ctx, &conf, []string{"/", "/test2"}),
-					resource.TestMatchResourceAttr(resourceName, "policy", regexp.MustCompile(`"Deny"`)),
+					resource.TestMatchResourceAttr(resourceName, "policy", regexache.MustCompile(`"Deny"`)),
 				),
 			},
 		},
@@ -1392,7 +1395,7 @@ func TestAccAPIGatewayRestAPI_Policy_setByBody(t *testing.T) {
 				Config: testAccRestAPIConfig_policySetByBody(rName, "Allow"),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckRestAPIExists(ctx, resourceName, &conf),
-					resource.TestMatchResourceAttr(resourceName, "policy", regexp.MustCompile(`"Allow"`)),
+					resource.TestMatchResourceAttr(resourceName, "policy", regexache.MustCompile(`"Allow"`)),
 				),
 			},
 			{
diff --git a/internal/service/apigateway/sdk_data_source.go b/internal/service/apigateway/sdk_data_source.go
index debf49b21bf..d36b88635de 100644
--- a/internal/service/apigateway/sdk_data_source.go
+++ b/internal/service/apigateway/sdk_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigateway
 
 import (
diff --git a/internal/service/apigateway/sdk_data_source_test.go b/internal/service/apigateway/sdk_data_source_test.go
index 985230fb677..9ffe7899f66 100644
--- a/internal/service/apigateway/sdk_data_source_test.go
+++ b/internal/service/apigateway/sdk_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigateway_test
 
 import (
diff --git a/internal/service/apigateway/service_package.go b/internal/service/apigateway/service_package.go
index 1771b682bd5..4e53f749961 100644
--- a/internal/service/apigateway/service_package.go
+++ b/internal/service/apigateway/service_package.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigateway
 
 import (
diff --git a/internal/service/apigateway/service_package_gen.go b/internal/service/apigateway/service_package_gen.go
index 8ff68616341..d72af166fc4 100644
--- a/internal/service/apigateway/service_package_gen.go
+++ b/internal/service/apigateway/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	apigateway_sdkv1 "github.com/aws/aws-sdk-go/service/apigateway"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -203,4 +204,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*a
 	return apigateway_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/apigateway/stage.go b/internal/service/apigateway/stage.go
index 08a1c6a406e..6b3c611e28d 100644
--- a/internal/service/apigateway/stage.go
+++ b/internal/service/apigateway/stage.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigateway
 
 import (
diff --git a/internal/service/apigateway/stage_test.go b/internal/service/apigateway/stage_test.go
index 09a9dd93fc9..b0af4a7dfd7 100644
--- a/internal/service/apigateway/stage_test.go
+++ b/internal/service/apigateway/stage_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigateway_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/apigateway"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -32,7 +35,7 @@ func TestAccAPIGatewayStage_basic(t *testing.T) {
 				Config: testAccStageConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckStageExists(ctx, resourceName, &conf),
-					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexp.MustCompile(`/restapis/.+/stages/prod`)),
+					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexache.MustCompile(`/restapis/.+/stages/prod`)),
 					resource.TestCheckResourceAttr(resourceName, "stage_name", "prod"),
 					resource.TestCheckResourceAttrSet(resourceName, "execution_arn"),
 					resource.TestCheckResourceAttrSet(resourceName, "invoke_url"),
@@ -53,7 +56,7 @@ func TestAccAPIGatewayStage_basic(t *testing.T) {
 				Config: testAccStageConfig_updated(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckStageExists(ctx, resourceName, &conf),
-					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexp.MustCompile(`/restapis/.+/stages/prod`)),
+					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexache.MustCompile(`/restapis/.+/stages/prod`)),
 					resource.TestCheckResourceAttr(resourceName, "stage_name", "prod"),
 					resource.TestCheckResourceAttrSet(resourceName, "execution_arn"),
 					resource.TestCheckResourceAttrSet(resourceName, "invoke_url"),
@@ -69,7 +72,7 @@ func TestAccAPIGatewayStage_basic(t *testing.T) {
 				Config: testAccStageConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckStageExists(ctx, resourceName, &conf),
-					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexp.MustCompile(`/restapis/.+/stages/prod`)),
+					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexache.MustCompile(`/restapis/.+/stages/prod`)),
 					resource.TestCheckResourceAttr(resourceName, "stage_name", "prod"),
 					resource.TestCheckResourceAttrSet(resourceName, "execution_arn"),
 					resource.TestCheckResourceAttrSet(resourceName, "invoke_url"),
@@ -309,7 +312,7 @@ func TestAccAPIGatewayStage_accessLogSettings(t *testing.T) {
 				Config: testAccStageConfig_accessLogSettings(rName, clf),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckStageExists(ctx, resourceName, &conf),
-					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexp.MustCompile(`/restapis/.+/stages/prod`)),
+					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexache.MustCompile(`/restapis/.+/stages/prod`)),
 					resource.TestCheckResourceAttr(resourceName, "access_log_settings.#", "1"),
 					resource.TestCheckResourceAttrPair(resourceName, "access_log_settings.0.destination_arn", cloudwatchLogGroupResourceName, "arn"),
 					resource.TestCheckResourceAttr(resourceName, "access_log_settings.0.format", clf),
@@ -320,7 +323,7 @@ func TestAccAPIGatewayStage_accessLogSettings(t *testing.T) {
 				Config: testAccStageConfig_accessLogSettings(rName, json),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckStageExists(ctx, resourceName, &conf),
-					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexp.MustCompile(`/restapis/.+/stages/prod`)),
+					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexache.MustCompile(`/restapis/.+/stages/prod`)),
 					resource.TestCheckResourceAttr(resourceName, "access_log_settings.#", "1"),
 					resource.TestCheckResourceAttrPair(resourceName, "access_log_settings.0.destination_arn", cloudwatchLogGroupResourceName, "arn"),
 					resource.TestCheckResourceAttr(resourceName, "access_log_settings.0.format", json),
@@ -330,7 +333,7 @@ func TestAccAPIGatewayStage_accessLogSettings(t *testing.T) {
 				Config: testAccStageConfig_accessLogSettings(rName, xml),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckStageExists(ctx, resourceName, &conf),
-					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexp.MustCompile(`/restapis/.+/stages/prod`)),
+					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexache.MustCompile(`/restapis/.+/stages/prod`)),
 					resource.TestCheckResourceAttr(resourceName, "access_log_settings.#", "1"),
 					resource.TestCheckResourceAttrPair(resourceName, "access_log_settings.0.destination_arn", cloudwatchLogGroupResourceName, "arn"),
 					resource.TestCheckResourceAttr(resourceName, "access_log_settings.0.format", xml),
@@ -340,7 +343,7 @@ func TestAccAPIGatewayStage_accessLogSettings(t *testing.T) {
 				Config: testAccStageConfig_accessLogSettings(rName, csv),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckStageExists(ctx, resourceName, &conf),
-					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexp.MustCompile(`/restapis/.+/stages/prod`)),
+					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexache.MustCompile(`/restapis/.+/stages/prod`)),
 					resource.TestCheckResourceAttr(resourceName, "access_log_settings.#", "1"),
 					resource.TestCheckResourceAttrPair(resourceName, "access_log_settings.0.destination_arn", cloudwatchLogGroupResourceName, "arn"),
 					resource.TestCheckResourceAttr(resourceName, "access_log_settings.0.format", csv),
@@ -350,7 +353,7 @@ func TestAccAPIGatewayStage_accessLogSettings(t *testing.T) {
 				Config: testAccStageConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckStageExists(ctx, resourceName, &conf),
-					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexp.MustCompile(`/restapis/.+/stages/prod`)),
+					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexache.MustCompile(`/restapis/.+/stages/prod`)),
 					resource.TestCheckResourceAttr(resourceName, "access_log_settings.#", "0"),
 				),
 			},
@@ -389,7 +392,7 @@ func TestAccAPIGatewayStage_AccessLogSettings_kinesis(t *testing.T) {
 				Config: testAccStageConfig_accessLogSettingsKinesis(rName, json),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckStageExists(ctx, resourceName, &conf),
-					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexp.MustCompile(`/restapis/.+/stages/prod`)),
+					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexache.MustCompile(`/restapis/.+/stages/prod`)),
 					resource.TestCheckResourceAttr(resourceName, "access_log_settings.#", "1"),
 					resource.TestCheckResourceAttrPair(resourceName, "access_log_settings.0.destination_arn", kinesesResourceName, "arn"),
 					resource.TestCheckResourceAttr(resourceName, "access_log_settings.0.format", json),
@@ -399,7 +402,7 @@ func TestAccAPIGatewayStage_AccessLogSettings_kinesis(t *testing.T) {
 				Config: testAccStageConfig_accessLogSettingsKinesis(rName, xml),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckStageExists(ctx, resourceName, &conf),
-					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexp.MustCompile(`/restapis/.+/stages/prod`)),
+					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexache.MustCompile(`/restapis/.+/stages/prod`)),
 					resource.TestCheckResourceAttr(resourceName, "access_log_settings.#", "1"),
 					resource.TestCheckResourceAttrPair(resourceName, "access_log_settings.0.destination_arn", kinesesResourceName, "arn"),
 					resource.TestCheckResourceAttr(resourceName, "access_log_settings.0.format", xml),
@@ -409,7 +412,7 @@ func TestAccAPIGatewayStage_AccessLogSettings_kinesis(t *testing.T) {
 				Config: testAccStageConfig_accessLogSettingsKinesis(rName, csv),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckStageExists(ctx, resourceName, &conf),
-					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexp.MustCompile(`/restapis/.+/stages/prod`)),
+					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexache.MustCompile(`/restapis/.+/stages/prod`)),
 					resource.TestCheckResourceAttr(resourceName, "access_log_settings.#", "1"),
 					resource.TestCheckResourceAttrPair(resourceName, "access_log_settings.0.destination_arn", kinesesResourceName, "arn"),
 					resource.TestCheckResourceAttr(resourceName, "access_log_settings.0.format", csv),
@@ -419,7 +422,7 @@ func TestAccAPIGatewayStage_AccessLogSettings_kinesis(t *testing.T) {
 				Config: testAccStageConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckStageExists(ctx, resourceName, &conf),
-					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexp.MustCompile(`/restapis/.+/stages/prod`)),
+					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexache.MustCompile(`/restapis/.+/stages/prod`)),
 					resource.TestCheckResourceAttr(resourceName, "access_log_settings.#", "0"),
 				),
 			},
diff --git a/internal/service/apigateway/status.go b/internal/service/apigateway/status.go
index b3a05e35bc8..878c36d0163 100644
--- a/internal/service/apigateway/status.go
+++ b/internal/service/apigateway/status.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigateway
 
 import (
diff --git a/internal/service/apigateway/sweep.go b/internal/service/apigateway/sweep.go
index c12b9636bbf..04e2565101e 100644
--- a/internal/service/apigateway/sweep.go
+++ b/internal/service/apigateway/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package apigateway
 
@@ -15,9 +15,10 @@ import (
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_api_gateway_rest_api", &resource.Sweeper{
 		Name: "aws_api_gateway_rest_api",
 		F:    sweepRestAPIs,
@@ -54,7 +55,7 @@ func init() {
 
 func sweepRestAPIs(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("getting client: %s", err)
 	}
@@ -85,7 +86,7 @@ func sweepRestAPIs(region string) error {
 		return !lastPage
 	})
 	if err != nil {
-		if sweep.SkipSweepError(err) {
+		if awsv1.SkipSweepError(err) {
 			log.Printf("[WARN] Skipping API Gateway REST API sweep for %s: %s", region, err)
 			return nil
 		}
@@ -97,7 +98,7 @@ func sweepRestAPIs(region string) error {
 
 func sweepVPCLinks(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("getting client: %w", err)
 	}
@@ -118,7 +119,7 @@ func sweepVPCLinks(region string) error {
 		}
 		return !lastPage
 	})
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping API Gateway VPC Link sweep for %s: %s", region, err)
 		return nil
 	}
@@ -126,7 +127,7 @@ func sweepVPCLinks(region string) error {
 		return fmt.Errorf("retrieving API Gateway VPC Links: %w", err)
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("sweeping API Gateway VPC Links: %w", err))
 	}
 
@@ -135,7 +136,7 @@ func sweepVPCLinks(region string) error {
 
 func sweepClientCertificates(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("getting client: %s", err)
 	}
@@ -164,11 +165,11 @@ func sweepClientCertificates(region string) error {
 		errs = multierror.Append(errs, fmt.Errorf("describing API Gateway Client Certificates for %s: %w", region, err))
 	}
 
-	if err = sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err = sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("sweeping API Gateway Client Certificates for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
+	if awsv1.SkipSweepError(errs.ErrorOrNil()) {
 		log.Printf("[WARN] Skipping API Gateway Client Certificate sweep for %s: %s", region, errs)
 		return nil
 	}
@@ -178,7 +179,7 @@ func sweepClientCertificates(region string) error {
 
 func sweepUsagePlans(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("getting client: %s", err)
 	}
@@ -212,11 +213,11 @@ func sweepUsagePlans(region string) error {
 		errs = multierror.Append(errs, fmt.Errorf("describing API Gateway Usage Plans for %s: %w", region, err))
 	}
 
-	if err = sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err = sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("sweeping API Gateway Usage Plans for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
+	if awsv1.SkipSweepError(errs.ErrorOrNil()) {
 		log.Printf("[WARN] Skipping API Gateway Usage Plan sweep for %s: %s", region, errs)
 		return nil
 	}
@@ -226,7 +227,7 @@ func sweepUsagePlans(region string) error {
 
 func sweepAPIKeys(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("getting client: %s", err)
 	}
@@ -259,11 +260,11 @@ func sweepAPIKeys(region string) error {
 		errs = multierror.Append(errs, fmt.Errorf("describing API Gateway API Keys for %s: %w", region, err))
 	}
 
-	if err = sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err = sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("sweeping API Gateway API Keys for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
+	if awsv1.SkipSweepError(errs.ErrorOrNil()) {
 		log.Printf("[WARN] Skipping API Gateway API Key sweep for %s: %s", region, errs)
 		return nil
 	}
@@ -273,7 +274,7 @@ func sweepAPIKeys(region string) error {
 
 func sweepDomainNames(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("getting client: %s", err)
 	}
@@ -306,11 +307,11 @@ func sweepDomainNames(region string) error {
 		errs = multierror.Append(errs, fmt.Errorf("describing API Gateway Domain Names for %s: %w", region, err))
 	}
 
-	if err = sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err = sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("sweeping API Gateway Domain Names for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
+	if awsv1.SkipSweepError(errs.ErrorOrNil()) {
 		log.Printf("[WARN] Skipping API Gateway Domain Name sweep for %s: %s", region, errs)
 		return nil
 	}
diff --git a/internal/service/apigateway/tags_gen.go b/internal/service/apigateway/tags_gen.go
index e388a1a7499..8daa9115caf 100644
--- a/internal/service/apigateway/tags_gen.go
+++ b/internal/service/apigateway/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/apigateway"
 	"github.com/aws/aws-sdk-go/service/apigateway/apigatewayiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -21,7 +23,7 @@ func Tags(tags tftags.KeyValueTags) map[string]*string {
 	return aws.StringMap(tags.Map())
 }
 
-// KeyValueTags creates KeyValueTags from apigateway service tags.
+// KeyValueTags creates tftags.KeyValueTags from apigateway service tags.
 func KeyValueTags(ctx context.Context, tags map[string]*string) tftags.KeyValueTags {
 	return tftags.New(ctx, tags)
 }
@@ -52,6 +54,8 @@ func updateTags(ctx context.Context, conn apigatewayiface.APIGatewayAPI, identif
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.APIGateway)
 	if len(removedTags) > 0 {
diff --git a/internal/service/apigateway/usage_plan.go b/internal/service/apigateway/usage_plan.go
index 25a79300140..fb0c7ee0583 100644
--- a/internal/service/apigateway/usage_plan.go
+++ b/internal/service/apigateway/usage_plan.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigateway
 
 import (
diff --git a/internal/service/apigateway/usage_plan_key.go b/internal/service/apigateway/usage_plan_key.go
index ad1bec5c7a5..9e543b6e755 100644
--- a/internal/service/apigateway/usage_plan_key.go
+++ b/internal/service/apigateway/usage_plan_key.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigateway
 
 import (
diff --git a/internal/service/apigateway/usage_plan_key_test.go b/internal/service/apigateway/usage_plan_key_test.go
index 91ecb097df3..12d008a602d 100644
--- a/internal/service/apigateway/usage_plan_key_test.go
+++ b/internal/service/apigateway/usage_plan_key_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigateway_test
 
 import (
diff --git a/internal/service/apigateway/usage_plan_test.go b/internal/service/apigateway/usage_plan_test.go
index 2683d155f97..f10fa661c24 100644
--- a/internal/service/apigateway/usage_plan_test.go
+++ b/internal/service/apigateway/usage_plan_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigateway_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/apigateway"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -34,7 +37,7 @@ func TestAccAPIGatewayUsagePlan_basic(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckUsagePlanExists(ctx, resourceName, &conf),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
-					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexp.MustCompile(`/usageplans/+.`)),
+					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexache.MustCompile(`/usageplans/+.`)),
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 					resource.TestCheckResourceAttr(resourceName, "api_stages.%", "0"),
diff --git a/internal/service/apigateway/validate.go b/internal/service/apigateway/validate.go
index 8b61c3f9c98..aacd02b7ac5 100644
--- a/internal/service/apigateway/validate.go
+++ b/internal/service/apigateway/validate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigateway
 
 import (
diff --git a/internal/service/apigateway/validate_test.go b/internal/service/apigateway/validate_test.go
index 5a06420a01a..9d91d2a2820 100644
--- a/internal/service/apigateway/validate_test.go
+++ b/internal/service/apigateway/validate_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigateway
 
 import (
diff --git a/internal/service/apigateway/vpc_link.go b/internal/service/apigateway/vpc_link.go
index bc37685f513..c870a1ed301 100644
--- a/internal/service/apigateway/vpc_link.go
+++ b/internal/service/apigateway/vpc_link.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigateway
 
 import (
diff --git a/internal/service/apigateway/vpc_link_data_source.go b/internal/service/apigateway/vpc_link_data_source.go
index 007edf5cbf7..0acf4550251 100644
--- a/internal/service/apigateway/vpc_link_data_source.go
+++ b/internal/service/apigateway/vpc_link_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigateway
 
 import (
diff --git a/internal/service/apigateway/vpc_link_data_source_test.go b/internal/service/apigateway/vpc_link_data_source_test.go
index ec0d676ed74..0f7ee3e49cc 100644
--- a/internal/service/apigateway/vpc_link_data_source_test.go
+++ b/internal/service/apigateway/vpc_link_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigateway_test
 
 import (
diff --git a/internal/service/apigateway/vpc_link_test.go b/internal/service/apigateway/vpc_link_test.go
index 3da12b7822b..8dcb0e0d88d 100644
--- a/internal/service/apigateway/vpc_link_test.go
+++ b/internal/service/apigateway/vpc_link_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigateway_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/apigateway"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -34,7 +37,7 @@ func TestAccAPIGatewayVPCLink_basic(t *testing.T) {
 				Config: testAccVPCLinkConfig_basic(rName, "test"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckVPCLinkExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexp.MustCompile(`/vpclinks/.+`)),
+					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexache.MustCompile(`/vpclinks/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "name", vpcLinkName),
 					resource.TestCheckResourceAttr(resourceName, "description", "test"),
 					resource.TestCheckResourceAttr(resourceName, "target_arns.#", "1"),
@@ -49,7 +52,7 @@ func TestAccAPIGatewayVPCLink_basic(t *testing.T) {
 				Config: testAccVPCLinkConfig_update(rName, "test update"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckVPCLinkExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexp.MustCompile(`/vpclinks/.+`)),
+					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexache.MustCompile(`/vpclinks/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "name", vpcLinkNameUpdated),
 					resource.TestCheckResourceAttr(resourceName, "description", "test update"),
 					resource.TestCheckResourceAttr(resourceName, "target_arns.#", "1"),
diff --git a/internal/service/apigateway/wait.go b/internal/service/apigateway/wait.go
index 8a7937795cb..01f06c848fa 100644
--- a/internal/service/apigateway/wait.go
+++ b/internal/service/apigateway/wait.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigateway
 
 import (
diff --git a/internal/service/apigatewayv2/api.go b/internal/service/apigatewayv2/api.go
index 046e9fe38fe..74e69669511 100644
--- a/internal/service/apigatewayv2/api.go
+++ b/internal/service/apigatewayv2/api.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigatewayv2
 
 import (
diff --git a/internal/service/apigatewayv2/api_data_source.go b/internal/service/apigatewayv2/api_data_source.go
index f5eac6f8046..b14fe59819d 100644
--- a/internal/service/apigatewayv2/api_data_source.go
+++ b/internal/service/apigatewayv2/api_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigatewayv2
 
 import (
diff --git a/internal/service/apigatewayv2/api_data_source_test.go b/internal/service/apigatewayv2/api_data_source_test.go
index afc81678da3..643cadfa3e3 100644
--- a/internal/service/apigatewayv2/api_data_source_test.go
+++ b/internal/service/apigatewayv2/api_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigatewayv2_test
 
 import (
diff --git a/internal/service/apigatewayv2/api_mapping.go b/internal/service/apigatewayv2/api_mapping.go
index eaf7128f14d..f8072f177aa 100644
--- a/internal/service/apigatewayv2/api_mapping.go
+++ b/internal/service/apigatewayv2/api_mapping.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigatewayv2
 
 import (
diff --git a/internal/service/apigatewayv2/api_mapping_test.go b/internal/service/apigatewayv2/api_mapping_test.go
index c38251b337c..e545f089ce2 100644
--- a/internal/service/apigatewayv2/api_mapping_test.go
+++ b/internal/service/apigatewayv2/api_mapping_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigatewayv2_test
 
 import (
diff --git a/internal/service/apigatewayv2/api_test.go b/internal/service/apigatewayv2/api_test.go
index bce302717a9..31ca2789059 100644
--- a/internal/service/apigatewayv2/api_test.go
+++ b/internal/service/apigatewayv2/api_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigatewayv2_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/apigatewayv2"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -35,11 +38,11 @@ func TestAccAPIGatewayV2API_basicWebSocket(t *testing.T) {
 					testAccCheckAPIExists(ctx, resourceName, &v),
 					resource.TestCheckResourceAttrSet(resourceName, "api_endpoint"),
 					resource.TestCheckResourceAttr(resourceName, "api_key_selection_expression", "$request.header.x-api-key"),
-					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexp.MustCompile(`/apis/.+`)),
+					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexache.MustCompile(`/apis/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "cors_configuration.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
 					resource.TestCheckResourceAttr(resourceName, "disable_execute_api_endpoint", "false"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "execution_arn", "execute-api", regexp.MustCompile(`.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "execution_arn", "execute-api", regexache.MustCompile(`.+`)),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "protocol_type", apigatewayv2.ProtocolTypeWebsocket),
 					resource.TestCheckResourceAttr(resourceName, "route_selection_expression", "$request.body.action"),
@@ -74,11 +77,11 @@ func TestAccAPIGatewayV2API_basicHTTP(t *testing.T) {
 					testAccCheckAPIExists(ctx, resourceName, &v),
 					resource.TestCheckResourceAttrSet(resourceName, "api_endpoint"),
 					resource.TestCheckResourceAttr(resourceName, "api_key_selection_expression", "$request.header.x-api-key"),
-					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexp.MustCompile(`/apis/.+`)),
+					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexache.MustCompile(`/apis/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "cors_configuration.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
 					resource.TestCheckResourceAttr(resourceName, "disable_execute_api_endpoint", "false"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "execution_arn", "execute-api", regexp.MustCompile(`.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "execution_arn", "execute-api", regexache.MustCompile(`.+`)),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "protocol_type", apigatewayv2.ProtocolTypeHttp),
 					resource.TestCheckResourceAttr(resourceName, "route_selection_expression", "$request.method $request.path"),
@@ -138,11 +141,11 @@ func TestAccAPIGatewayV2API_allAttributesWebSocket(t *testing.T) {
 					testAccCheckAPIExists(ctx, resourceName, &v),
 					resource.TestCheckResourceAttrSet(resourceName, "api_endpoint"),
 					resource.TestCheckResourceAttr(resourceName, "api_key_selection_expression", "$context.authorizer.usageIdentifierKey"),
-					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexp.MustCompile(`/apis/.+`)),
+					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexache.MustCompile(`/apis/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "cors_configuration.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "description", "test description"),
 					resource.TestCheckResourceAttr(resourceName, "disable_execute_api_endpoint", "true"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "execution_arn", "execute-api", regexp.MustCompile(`.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "execution_arn", "execute-api", regexache.MustCompile(`.+`)),
 					resource.TestCheckResourceAttr(resourceName, "name", rName1),
 					resource.TestCheckResourceAttr(resourceName, "protocol_type", apigatewayv2.ProtocolTypeWebsocket),
 					resource.TestCheckResourceAttr(resourceName, "route_selection_expression", "$request.body.service"),
@@ -221,11 +224,11 @@ func TestAccAPIGatewayV2API_allAttributesHTTP(t *testing.T) {
 					testAccCheckAPIExists(ctx, resourceName, &v),
 					resource.TestCheckResourceAttrSet(resourceName, "api_endpoint"),
 					resource.TestCheckResourceAttr(resourceName, "api_key_selection_expression", "$request.header.x-api-key"),
-					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexp.MustCompile(`/apis/.+`)),
+					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexache.MustCompile(`/apis/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "cors_configuration.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "description", "test description"),
 					resource.TestCheckResourceAttr(resourceName, "disable_execute_api_endpoint", "true"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "execution_arn", "execute-api", regexp.MustCompile(`.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "execution_arn", "execute-api", regexache.MustCompile(`.+`)),
 					resource.TestCheckResourceAttr(resourceName, "name", rName1),
 					resource.TestCheckResourceAttr(resourceName, "protocol_type", apigatewayv2.ProtocolTypeHttp),
 					resource.TestCheckResourceAttr(resourceName, "route_selection_expression", "$request.method $request.path"),
@@ -306,7 +309,7 @@ func TestAccAPIGatewayV2API_openAPI(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "disable_execute_api_endpoint", "false"),
 					resource.TestCheckResourceAttr(resourceName, "name", rName+"_DIFFERENT"),
 					resource.TestCheckResourceAttr(resourceName, "version", "1.0"),
-					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexp.MustCompile(`/apis/.+`)),
+					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexache.MustCompile(`/apis/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "protocol_type", apigatewayv2.ProtocolTypeHttp),
 					testAccCheckAPIRoutes(ctx, &v, []string{"GET /test"}),
 				),
@@ -393,7 +396,7 @@ func TestAccAPIGatewayV2API_OpenAPI_withCors(t *testing.T) {
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckAPIExists(ctx, resourceName, &v),
 					resource.TestCheckResourceAttrSet(resourceName, "api_endpoint"),
-					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexp.MustCompile(`/apis/.+`)),
+					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexache.MustCompile(`/apis/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "protocol_type", apigatewayv2.ProtocolTypeHttp),
 					resource.TestCheckResourceAttr(resourceName, "cors_configuration.0.allow_methods.#", "1"),
 					resource.TestCheckTypeSetElemAttr(resourceName, "cors_configuration.0.allow_methods.*", "delete"),
@@ -458,7 +461,7 @@ func TestAccAPIGatewayV2API_OpenAPI_withMoreFields(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "name", rName+"_DIFFERENT"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 					resource.TestCheckResourceAttr(resourceName, "version", "1.0"),
-					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexp.MustCompile(`/apis/.+`)),
+					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexache.MustCompile(`/apis/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "protocol_type", apigatewayv2.ProtocolTypeHttp),
 					testAccCheckAPIRoutes(ctx, &v, []string{"GET /test"}),
 				),
@@ -509,7 +512,7 @@ func TestAccAPIGatewayV2API_OpenAPI_failOnWarnings(t *testing.T) {
 			// Invalid body should not be accepted when fail_on_warnings is enabled
 			{
 				Config:      testAccAPIConfig_failOnWarnings(rName, "fail_on_warnings = true"),
-				ExpectError: regexp.MustCompile(`BadRequestException: Warnings found during import`),
+				ExpectError: regexache.MustCompile(`BadRequestException: Warnings found during import`),
 			},
 			// Warnings do not break the deployment when fail_on_warnings is disabled
 			{
@@ -598,10 +601,10 @@ func TestAccAPIGatewayV2API_tags(t *testing.T) {
 					testAccCheckAPIExists(ctx, resourceName, &v),
 					resource.TestCheckResourceAttrSet(resourceName, "api_endpoint"),
 					resource.TestCheckResourceAttr(resourceName, "api_key_selection_expression", "$request.header.x-api-key"),
-					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexp.MustCompile(`/apis/.+`)),
+					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexache.MustCompile(`/apis/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "cors_configuration.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "execution_arn", "execute-api", regexp.MustCompile(`.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "execution_arn", "execute-api", regexache.MustCompile(`.+`)),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "protocol_type", apigatewayv2.ProtocolTypeWebsocket),
 					resource.TestCheckResourceAttr(resourceName, "route_selection_expression", "$request.body.action"),
@@ -652,7 +655,7 @@ func TestAccAPIGatewayV2API_cors(t *testing.T) {
 					testAccCheckAPIExists(ctx, resourceName, &v),
 					resource.TestCheckResourceAttrSet(resourceName, "api_endpoint"),
 					resource.TestCheckResourceAttr(resourceName, "api_key_selection_expression", "$request.header.x-api-key"),
-					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexp.MustCompile(`/apis/.+`)),
+					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexache.MustCompile(`/apis/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "cors_configuration.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "cors_configuration.0.allow_credentials", "false"),
 					resource.TestCheckResourceAttr(resourceName, "cors_configuration.0.allow_headers.#", "1"),
@@ -665,7 +668,7 @@ func TestAccAPIGatewayV2API_cors(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "cors_configuration.0.expose_headers.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "cors_configuration.0.max_age", "0"),
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "execution_arn", "execute-api", regexp.MustCompile(`.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "execution_arn", "execute-api", regexache.MustCompile(`.+`)),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "protocol_type", apigatewayv2.ProtocolTypeHttp),
 					resource.TestCheckResourceAttr(resourceName, "route_selection_expression", "$request.method $request.path"),
@@ -684,7 +687,7 @@ func TestAccAPIGatewayV2API_cors(t *testing.T) {
 					testAccCheckAPIExists(ctx, resourceName, &v),
 					resource.TestCheckResourceAttrSet(resourceName, "api_endpoint"),
 					resource.TestCheckResourceAttr(resourceName, "api_key_selection_expression", "$request.header.x-api-key"),
-					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexp.MustCompile(`/apis/.+`)),
+					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexache.MustCompile(`/apis/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "cors_configuration.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "cors_configuration.0.allow_credentials", "true"),
 					resource.TestCheckResourceAttr(resourceName, "cors_configuration.0.allow_headers.#", "0"),
@@ -697,7 +700,7 @@ func TestAccAPIGatewayV2API_cors(t *testing.T) {
 					resource.TestCheckTypeSetElemAttr(resourceName, "cors_configuration.0.expose_headers.*", "X-Api-Id"),
 					resource.TestCheckResourceAttr(resourceName, "cors_configuration.0.max_age", "500"),
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "execution_arn", "execute-api", regexp.MustCompile(`.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "execution_arn", "execute-api", regexache.MustCompile(`.+`)),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "protocol_type", apigatewayv2.ProtocolTypeHttp),
 					resource.TestCheckResourceAttr(resourceName, "route_selection_expression", "$request.method $request.path"),
@@ -711,10 +714,10 @@ func TestAccAPIGatewayV2API_cors(t *testing.T) {
 					testAccCheckAPIExists(ctx, resourceName, &v),
 					resource.TestCheckResourceAttrSet(resourceName, "api_endpoint"),
 					resource.TestCheckResourceAttr(resourceName, "api_key_selection_expression", "$request.header.x-api-key"),
-					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexp.MustCompile(`/apis/.+`)),
+					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexache.MustCompile(`/apis/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "cors_configuration.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "execution_arn", "execute-api", regexp.MustCompile(`.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "execution_arn", "execute-api", regexache.MustCompile(`.+`)),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "protocol_type", apigatewayv2.ProtocolTypeHttp),
 					resource.TestCheckResourceAttr(resourceName, "route_selection_expression", "$request.method $request.path"),
@@ -747,10 +750,10 @@ func TestAccAPIGatewayV2API_quickCreate(t *testing.T) {
 					testAccCheckAPIQuickCreateStage(ctx, resourceName, "$default"),
 					resource.TestCheckResourceAttrSet(resourceName, "api_endpoint"),
 					resource.TestCheckResourceAttr(resourceName, "api_key_selection_expression", "$request.header.x-api-key"),
-					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexp.MustCompile(`/apis/.+`)),
+					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexache.MustCompile(`/apis/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "cors_configuration.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "execution_arn", "execute-api", regexp.MustCompile(`.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "execution_arn", "execute-api", regexache.MustCompile(`.+`)),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "protocol_type", apigatewayv2.ProtocolTypeHttp),
 					resource.TestCheckResourceAttr(resourceName, "route_key", "GET /pets"),
diff --git a/internal/service/apigatewayv2/apis_data_source.go b/internal/service/apigatewayv2/apis_data_source.go
index a644fc4ab45..a0daa655fcf 100644
--- a/internal/service/apigatewayv2/apis_data_source.go
+++ b/internal/service/apigatewayv2/apis_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigatewayv2
 
 import (
diff --git a/internal/service/apigatewayv2/apis_data_source_test.go b/internal/service/apigatewayv2/apis_data_source_test.go
index 7b760fec648..89da50998bd 100644
--- a/internal/service/apigatewayv2/apis_data_source_test.go
+++ b/internal/service/apigatewayv2/apis_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigatewayv2_test
 
 import (
diff --git a/internal/service/apigatewayv2/authorizer.go b/internal/service/apigatewayv2/authorizer.go
index d1be2824e6f..68efb08dbb3 100644
--- a/internal/service/apigatewayv2/authorizer.go
+++ b/internal/service/apigatewayv2/authorizer.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigatewayv2
 
 import (
@@ -127,9 +130,10 @@ func resourceAuthorizerCreate(ctx context.Context, d *schema.ResourceData, meta
 	}
 	if v, ok := d.GetOkExists("authorizer_result_ttl_in_seconds"); ok {
 		req.AuthorizerResultTtlInSeconds = aws.Int64(int64(v.(int)))
-	} else if protocolType == apigatewayv2.ProtocolTypeHttp && authorizerType == apigatewayv2.AuthorizerTypeRequest {
+	} else if protocolType == apigatewayv2.ProtocolTypeHttp && authorizerType == apigatewayv2.AuthorizerTypeRequest && len(req.IdentitySource) > 0 {
 		// Default in the AWS Console is 300 seconds.
 		// Explicitly set on creation so that we can correctly detect changes to the 0 value.
+		// This value should only be set when IdentitySources have been defined
 		req.AuthorizerResultTtlInSeconds = aws.Int64(300)
 	}
 	if v, ok := d.GetOk("authorizer_uri"); ok {
diff --git a/internal/service/apigatewayv2/authorizer_test.go b/internal/service/apigatewayv2/authorizer_test.go
index a5f546d576f..59ce2dd11bd 100644
--- a/internal/service/apigatewayv2/authorizer_test.go
+++ b/internal/service/apigatewayv2/authorizer_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigatewayv2_test
 
 import (
@@ -45,6 +48,16 @@ func TestAccAPIGatewayV2Authorizer_basic(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 				),
 			},
+			{
+				Config: testAccAuthorizerConfig_httpNoAuthenticationSources(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAuthorizerExists(ctx, resourceName, &apiId, &v),
+					resource.TestCheckResourceAttr(resourceName, "authorizer_type", "REQUEST"),
+					resource.TestCheckResourceAttr(resourceName, "identity_sources.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "authorizer_result_ttl_in_seconds", "0"),
+					resource.TestCheckResourceAttr(resourceName, "name", rName),
+				),
+			},
 			{
 				ResourceName:      resourceName,
 				ImportStateIdFunc: testAccAuthorizerImportStateIdFunc(resourceName),
@@ -570,6 +583,22 @@ resource "aws_apigatewayv2_authorizer" "test" {
 `, rName))
 }
 
+func testAccAuthorizerConfig_httpNoAuthenticationSources(rName string) string {
+	return acctest.ConfigCompose(
+		testAccAuthorizerConfig_apiHTTP(rName),
+		testAccAuthorizerConfig_baseLambda(rName),
+		fmt.Sprintf(`
+resource "aws_apigatewayv2_authorizer" "test" {
+  api_id                            = aws_apigatewayv2_api.test.id
+  authorizer_payload_format_version = "2.0"
+  authorizer_type                   = "REQUEST"
+  authorizer_uri                    = aws_lambda_function.test.invoke_arn
+  enable_simple_responses           = true
+  name                              = %[1]q
+}
+`, rName))
+}
+
 func testAccAuthorizerConfig_httpAPILambdaRequestUpdated(rName string, authorizerResultTtl int) string {
 	return acctest.ConfigCompose(
 		testAccAuthorizerConfig_apiHTTP(rName),
diff --git a/internal/service/apigatewayv2/deployment.go b/internal/service/apigatewayv2/deployment.go
index 80f221dbb06..dbc782bf9fa 100644
--- a/internal/service/apigatewayv2/deployment.go
+++ b/internal/service/apigatewayv2/deployment.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigatewayv2
 
 import (
diff --git a/internal/service/apigatewayv2/deployment_test.go b/internal/service/apigatewayv2/deployment_test.go
index eeab659df0b..376231c6580 100644
--- a/internal/service/apigatewayv2/deployment_test.go
+++ b/internal/service/apigatewayv2/deployment_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigatewayv2_test
 
 import (
diff --git a/internal/service/apigatewayv2/domain_name.go b/internal/service/apigatewayv2/domain_name.go
index 3dca258bc02..e9a9f5cfb71 100644
--- a/internal/service/apigatewayv2/domain_name.go
+++ b/internal/service/apigatewayv2/domain_name.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigatewayv2
 
 import (
diff --git a/internal/service/apigatewayv2/domain_name_test.go b/internal/service/apigatewayv2/domain_name_test.go
index da91f8b85f2..16f9862eef6 100644
--- a/internal/service/apigatewayv2/domain_name_test.go
+++ b/internal/service/apigatewayv2/domain_name_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigatewayv2_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/apigatewayv2"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -36,7 +39,7 @@ func TestAccAPIGatewayV2DomainName_basic(t *testing.T) {
 				Config: testAccDomainNameConfig_basic(rName, certificate, key, 1, 0),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDomainNameExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexp.MustCompile(`/domainnames/.+`)),
+					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexache.MustCompile(`/domainnames/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "domain_name", domainName),
 					resource.TestCheckResourceAttr(resourceName, "domain_name_configuration.#", "1"),
 					resource.TestCheckResourceAttrPair(resourceName, "domain_name_configuration.0.certificate_arn", certResourceName, "arn"),
@@ -104,7 +107,7 @@ func TestAccAPIGatewayV2DomainName_tags(t *testing.T) {
 				Config: testAccDomainNameConfig_tags(rName, certificate, key, 1, 0),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDomainNameExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexp.MustCompile(`/domainnames/.+`)),
+					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexache.MustCompile(`/domainnames/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "domain_name", domainName),
 					resource.TestCheckResourceAttr(resourceName, "domain_name_configuration.#", "1"),
 					resource.TestCheckResourceAttrPair(resourceName, "domain_name_configuration.0.certificate_arn", certResourceName, "arn"),
@@ -127,7 +130,7 @@ func TestAccAPIGatewayV2DomainName_tags(t *testing.T) {
 				Config: testAccDomainNameConfig_basic(rName, certificate, key, 1, 0),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDomainNameExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexp.MustCompile(`/domainnames/.+`)),
+					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexache.MustCompile(`/domainnames/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "domain_name", domainName),
 					resource.TestCheckResourceAttr(resourceName, "domain_name_configuration.#", "1"),
 					resource.TestCheckResourceAttrPair(resourceName, "domain_name_configuration.0.certificate_arn", certResourceName, "arn"),
@@ -164,7 +167,7 @@ func TestAccAPIGatewayV2DomainName_updateCertificate(t *testing.T) {
 				Config: testAccDomainNameConfig_basic(rName, certificate, key, 2, 0),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDomainNameExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexp.MustCompile(`/domainnames/.+`)),
+					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexache.MustCompile(`/domainnames/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "domain_name", domainName),
 					resource.TestCheckResourceAttr(resourceName, "domain_name_configuration.#", "1"),
 					resource.TestCheckResourceAttrPair(resourceName, "domain_name_configuration.0.certificate_arn", certResourceName0, "arn"),
@@ -180,7 +183,7 @@ func TestAccAPIGatewayV2DomainName_updateCertificate(t *testing.T) {
 				Config: testAccDomainNameConfig_basic(rName, certificate, key, 2, 1),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDomainNameExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexp.MustCompile(`/domainnames/.+`)),
+					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexache.MustCompile(`/domainnames/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "domain_name", domainName),
 					resource.TestCheckResourceAttr(resourceName, "domain_name_configuration.#", "1"),
 					resource.TestCheckResourceAttrPair(resourceName, "domain_name_configuration.0.certificate_arn", certResourceName1, "arn"),
@@ -196,7 +199,7 @@ func TestAccAPIGatewayV2DomainName_updateCertificate(t *testing.T) {
 				Config: testAccDomainNameConfig_tags(rName, certificate, key, 2, 0),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDomainNameExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexp.MustCompile(`/domainnames/.+`)),
+					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexache.MustCompile(`/domainnames/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "domain_name", domainName),
 					resource.TestCheckResourceAttr(resourceName, "domain_name_configuration.#", "1"),
 					resource.TestCheckResourceAttrPair(resourceName, "domain_name_configuration.0.certificate_arn", certResourceName0, "arn"),
@@ -239,7 +242,7 @@ func TestAccAPIGatewayV2DomainName_MutualTLSAuthentication_basic(t *testing.T) {
 				Config: testAccDomainNameConfig_mutualTLSAuthenticationObjectVersion(rName, rootDomain, domain),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDomainNameExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexp.MustCompile(`/domainnames/.+`)),
+					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexache.MustCompile(`/domainnames/.+`)),
 					resource.TestCheckResourceAttrPair(resourceName, "domain_name", acmCertificateResourceName, "domain_name"),
 					resource.TestCheckResourceAttr(resourceName, "domain_name_configuration.#", "1"),
 					resource.TestCheckResourceAttrPair(resourceName, "domain_name_configuration.0.certificate_arn", acmCertificateResourceName, "arn"),
@@ -257,7 +260,7 @@ func TestAccAPIGatewayV2DomainName_MutualTLSAuthentication_basic(t *testing.T) {
 				Config: testAccDomainNameConfig_mutualTLSAuthenticationObjectVersion(rName, rootDomain, domain),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDomainNameExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexp.MustCompile(`/domainnames/.+`)),
+					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexache.MustCompile(`/domainnames/.+`)),
 					resource.TestCheckResourceAttrPair(resourceName, "domain_name", acmCertificateResourceName, "domain_name"),
 					resource.TestCheckResourceAttr(resourceName, "domain_name_configuration.#", "1"),
 					resource.TestCheckResourceAttrPair(resourceName, "domain_name_configuration.0.certificate_arn", acmCertificateResourceName, "arn"),
@@ -281,7 +284,7 @@ func TestAccAPIGatewayV2DomainName_MutualTLSAuthentication_basic(t *testing.T) {
 				Config: testAccDomainNameConfig_mutualTLSAuthenticationMissing(rootDomain, domain),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDomainNameExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexp.MustCompile(`/domainnames/.+`)),
+					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexache.MustCompile(`/domainnames/.+`)),
 					resource.TestCheckResourceAttrPair(resourceName, "domain_name", acmCertificateResourceName, "domain_name"),
 					resource.TestCheckResourceAttr(resourceName, "domain_name_configuration.#", "1"),
 					resource.TestCheckResourceAttrPair(resourceName, "domain_name_configuration.0.certificate_arn", acmCertificateResourceName, "arn"),
@@ -297,7 +300,7 @@ func TestAccAPIGatewayV2DomainName_MutualTLSAuthentication_basic(t *testing.T) {
 				Config: testAccDomainNameConfig_mutualTLSAuthenticationObjectVersion(rName, rootDomain, domain),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDomainNameExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexp.MustCompile(`/domainnames/.+`)),
+					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexache.MustCompile(`/domainnames/.+`)),
 					resource.TestCheckResourceAttrPair(resourceName, "domain_name", acmCertificateResourceName, "domain_name"),
 					resource.TestCheckResourceAttr(resourceName, "domain_name_configuration.#", "1"),
 					resource.TestCheckResourceAttrPair(resourceName, "domain_name_configuration.0.certificate_arn", acmCertificateResourceName, "arn"),
@@ -334,7 +337,7 @@ func TestAccAPIGatewayV2DomainName_MutualTLSAuthentication_noVersion(t *testing.
 				Config: testAccDomainNameConfig_mutualTLSAuthenticationNoObjectVersion(rName, rootDomain, domain),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDomainNameExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexp.MustCompile(`/domainnames/.+`)),
+					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexache.MustCompile(`/domainnames/.+`)),
 					resource.TestCheckResourceAttrPair(resourceName, "domain_name", acmCertificateResourceName, "domain_name"),
 					resource.TestCheckResourceAttr(resourceName, "domain_name_configuration.#", "1"),
 					resource.TestCheckResourceAttrPair(resourceName, "domain_name_configuration.0.certificate_arn", acmCertificateResourceName, "arn"),
@@ -375,7 +378,7 @@ func TestAccAPIGatewayV2DomainName_MutualTLSAuthentication_ownership(t *testing.
 				Config: testAccDomainNameConfig_mutualTLSAuthenticationOwnershipVerificationCert(rName, rootDomain, domain, certificate, key),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDomainNameExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexp.MustCompile(`/domainnames/+.`)),
+					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexache.MustCompile(`/domainnames/+.`)),
 					resource.TestCheckResourceAttrPair(resourceName, "domain_name", publicAcmCertificateResourceName, "domain_name"),
 					resource.TestCheckResourceAttr(resourceName, "domain_name_configuration.#", "1"),
 					resource.TestCheckResourceAttrPair(resourceName, "domain_name_configuration.0.certificate_arn", importedAcmCertificateResourceName, "arn"),
diff --git a/internal/service/apigatewayv2/errorcheck_test.go b/internal/service/apigatewayv2/errorcheck_test.go
index a161bc8fe6a..28633b81b17 100644
--- a/internal/service/apigatewayv2/errorcheck_test.go
+++ b/internal/service/apigatewayv2/errorcheck_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigatewayv2_test
 
 import (
diff --git a/internal/service/apigatewayv2/export_data_source.go b/internal/service/apigatewayv2/export_data_source.go
index 18c6e830fa8..c9139ab99a3 100644
--- a/internal/service/apigatewayv2/export_data_source.go
+++ b/internal/service/apigatewayv2/export_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigatewayv2
 
 import (
diff --git a/internal/service/apigatewayv2/export_data_source_test.go b/internal/service/apigatewayv2/export_data_source_test.go
index c888376d1e1..0ea180d2515 100644
--- a/internal/service/apigatewayv2/export_data_source_test.go
+++ b/internal/service/apigatewayv2/export_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigatewayv2_test
 
 import (
diff --git a/internal/service/apigatewayv2/flex.go b/internal/service/apigatewayv2/flex.go
index c0c0a9fb537..3ce515047e8 100644
--- a/internal/service/apigatewayv2/flex.go
+++ b/internal/service/apigatewayv2/flex.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigatewayv2
 
 import (
diff --git a/internal/service/apigatewayv2/forge.go b/internal/service/apigatewayv2/forge.go
index 7c0d5273402..5be4c1a6a35 100644
--- a/internal/service/apigatewayv2/forge.go
+++ b/internal/service/apigatewayv2/forge.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigatewayv2
 
 import (
diff --git a/internal/service/apigatewayv2/generate.go b/internal/service/apigatewayv2/generate.go
index 95b27b6f8e3..bd1186bc0ec 100644
--- a/internal/service/apigatewayv2/generate.go
+++ b/internal/service/apigatewayv2/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/listpages/main.go -ListOps=GetApis,GetApiMappings,GetDomainNames,GetVpcLinks
 //go:generate go run ../../generate/tags/main.go -ListTags -ListTagsOp=GetTags -ServiceTagsMap -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
diff --git a/internal/service/apigatewayv2/integration.go b/internal/service/apigatewayv2/integration.go
index ab22e08a661..67a91d5b2d9 100644
--- a/internal/service/apigatewayv2/integration.go
+++ b/internal/service/apigatewayv2/integration.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigatewayv2
 
 import (
diff --git a/internal/service/apigatewayv2/integration_response.go b/internal/service/apigatewayv2/integration_response.go
index abfef3f6227..b31c0f42eca 100644
--- a/internal/service/apigatewayv2/integration_response.go
+++ b/internal/service/apigatewayv2/integration_response.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigatewayv2
 
 import (
diff --git a/internal/service/apigatewayv2/integration_response_test.go b/internal/service/apigatewayv2/integration_response_test.go
index c8a06c75175..b7770562192 100644
--- a/internal/service/apigatewayv2/integration_response_test.go
+++ b/internal/service/apigatewayv2/integration_response_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigatewayv2_test
 
 import (
diff --git a/internal/service/apigatewayv2/integration_test.go b/internal/service/apigatewayv2/integration_test.go
index 953c9fc0fa5..b3ea3526d8e 100644
--- a/internal/service/apigatewayv2/integration_test.go
+++ b/internal/service/apigatewayv2/integration_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigatewayv2_test
 
 import (
diff --git a/internal/service/apigatewayv2/model.go b/internal/service/apigatewayv2/model.go
index d084d49ab8a..fbf855473f5 100644
--- a/internal/service/apigatewayv2/model.go
+++ b/internal/service/apigatewayv2/model.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigatewayv2
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"strings"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/apigatewayv2"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -51,7 +54,7 @@ func ResourceModel() *schema.Resource {
 				Required: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 128),
-					validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9]+$`), "must be alphanumeric"),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z]+$`), "must be alphanumeric"),
 				),
 			},
 			"schema": {
diff --git a/internal/service/apigatewayv2/model_test.go b/internal/service/apigatewayv2/model_test.go
index 35d96d77e3a..02f8747a7ba 100644
--- a/internal/service/apigatewayv2/model_test.go
+++ b/internal/service/apigatewayv2/model_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigatewayv2_test
 
 import (
diff --git a/internal/service/apigatewayv2/route.go b/internal/service/apigatewayv2/route.go
index 36ced708ff9..a0c0ed3c5d4 100644
--- a/internal/service/apigatewayv2/route.go
+++ b/internal/service/apigatewayv2/route.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigatewayv2
 
 import (
diff --git a/internal/service/apigatewayv2/route_response.go b/internal/service/apigatewayv2/route_response.go
index 56d8e919cf4..5873231be7d 100644
--- a/internal/service/apigatewayv2/route_response.go
+++ b/internal/service/apigatewayv2/route_response.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigatewayv2
 
 import (
diff --git a/internal/service/apigatewayv2/route_response_test.go b/internal/service/apigatewayv2/route_response_test.go
index 85543dbd352..ad50257d018 100644
--- a/internal/service/apigatewayv2/route_response_test.go
+++ b/internal/service/apigatewayv2/route_response_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigatewayv2_test
 
 import (
diff --git a/internal/service/apigatewayv2/route_test.go b/internal/service/apigatewayv2/route_test.go
index 9fa9f87a87e..35939fbe211 100644
--- a/internal/service/apigatewayv2/route_test.go
+++ b/internal/service/apigatewayv2/route_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigatewayv2_test
 
 import (
diff --git a/internal/service/apigatewayv2/service_package.go b/internal/service/apigatewayv2/service_package.go
index 0759e0971ac..42d7b0377a0 100644
--- a/internal/service/apigatewayv2/service_package.go
+++ b/internal/service/apigatewayv2/service_package.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigatewayv2
 
 import (
diff --git a/internal/service/apigatewayv2/service_package_gen.go b/internal/service/apigatewayv2/service_package_gen.go
index 8783423c513..b5b05c23a73 100644
--- a/internal/service/apigatewayv2/service_package_gen.go
+++ b/internal/service/apigatewayv2/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	apigatewayv2_sdkv1 "github.com/aws/aws-sdk-go/service/apigatewayv2"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -119,4 +120,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*a
 	return apigatewayv2_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/apigatewayv2/stage.go b/internal/service/apigatewayv2/stage.go
index 92adde09217..cde6ab467d6 100644
--- a/internal/service/apigatewayv2/stage.go
+++ b/internal/service/apigatewayv2/stage.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigatewayv2
 
 import (
diff --git a/internal/service/apigatewayv2/stage_test.go b/internal/service/apigatewayv2/stage_test.go
index d2d9b0215fe..9f318f5d5e1 100644
--- a/internal/service/apigatewayv2/stage_test.go
+++ b/internal/service/apigatewayv2/stage_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigatewayv2_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/apigateway"
 	"github.com/aws/aws-sdk-go/service/apigatewayv2"
@@ -48,7 +51,7 @@ func TestAccAPIGatewayV2Stage_basicWebSocket(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "deployment_id", ""),
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
 					testAccCheckStageExecutionARN(resourceName, "execution_arn", &apiId, &v),
-					resource.TestMatchResourceAttr(resourceName, "invoke_url", regexp.MustCompile(fmt.Sprintf("wss://.+\\.execute-api\\.%s.amazonaws\\.com/%s", acctest.Region(), rName))),
+					resource.TestMatchResourceAttr(resourceName, "invoke_url", regexache.MustCompile(fmt.Sprintf("wss://.+\\.execute-api\\.%s.amazonaws\\.com/%s", acctest.Region(), rName))),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "route_settings.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "stage_variables.%", "0"),
@@ -95,7 +98,7 @@ func TestAccAPIGatewayV2Stage_basicHTTP(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "deployment_id", ""),
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
 					testAccCheckStageExecutionARN(resourceName, "execution_arn", &apiId, &v),
-					resource.TestMatchResourceAttr(resourceName, "invoke_url", regexp.MustCompile(fmt.Sprintf("https://.+\\.execute-api\\.%s.amazonaws\\.com/%s", acctest.Region(), rName))),
+					resource.TestMatchResourceAttr(resourceName, "invoke_url", regexache.MustCompile(fmt.Sprintf("https://.+\\.execute-api\\.%s.amazonaws\\.com/%s", acctest.Region(), rName))),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "route_settings.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "stage_variables.%", "0"),
@@ -142,7 +145,7 @@ func TestAccAPIGatewayV2Stage_defaultHTTPStage(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "deployment_id", ""),
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
 					testAccCheckStageExecutionARN(resourceName, "execution_arn", &apiId, &v),
-					resource.TestMatchResourceAttr(resourceName, "invoke_url", regexp.MustCompile(fmt.Sprintf("https://.+\\.execute-api\\.%s.amazonaws\\.com/", acctest.Region()))),
+					resource.TestMatchResourceAttr(resourceName, "invoke_url", regexache.MustCompile(fmt.Sprintf("https://.+\\.execute-api\\.%s.amazonaws\\.com/", acctest.Region()))),
 					resource.TestCheckResourceAttr(resourceName, "name", "$default"),
 					resource.TestCheckResourceAttr(resourceName, "route_settings.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "stage_variables.%", "0"),
@@ -189,7 +192,7 @@ func TestAccAPIGatewayV2Stage_autoDeployHTTP(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "deployment_id", ""),
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
 					testAccCheckStageExecutionARN(resourceName, "execution_arn", &apiId, &v),
-					resource.TestMatchResourceAttr(resourceName, "invoke_url", regexp.MustCompile(fmt.Sprintf("https://.+\\.execute-api\\.%s.amazonaws\\.com/%s", acctest.Region(), rName))),
+					resource.TestMatchResourceAttr(resourceName, "invoke_url", regexache.MustCompile(fmt.Sprintf("https://.+\\.execute-api\\.%s.amazonaws\\.com/%s", acctest.Region(), rName))),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "route_settings.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "stage_variables.%", "0"),
@@ -214,7 +217,7 @@ func TestAccAPIGatewayV2Stage_autoDeployHTTP(t *testing.T) {
 					// resource.TestCheckResourceAttrSet(resourceName, "deployment_id"),
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
 					testAccCheckStageExecutionARN(resourceName, "execution_arn", &apiId, &v),
-					resource.TestMatchResourceAttr(resourceName, "invoke_url", regexp.MustCompile(fmt.Sprintf("https://.+\\.execute-api\\.%s.amazonaws\\.com/%s", acctest.Region(), rName))),
+					resource.TestMatchResourceAttr(resourceName, "invoke_url", regexache.MustCompile(fmt.Sprintf("https://.+\\.execute-api\\.%s.amazonaws\\.com/%s", acctest.Region(), rName))),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "route_settings.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "stage_variables.%", "0"),
@@ -290,7 +293,7 @@ func TestAccAPIGatewayV2Stage_accessLogSettings(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "deployment_id", ""),
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
 					testAccCheckStageExecutionARN(resourceName, "execution_arn", &apiId, &v),
-					resource.TestMatchResourceAttr(resourceName, "invoke_url", regexp.MustCompile(fmt.Sprintf("wss://.+\\.execute-api\\.%s.amazonaws\\.com/%s", acctest.Region(), rName))),
+					resource.TestMatchResourceAttr(resourceName, "invoke_url", regexache.MustCompile(fmt.Sprintf("wss://.+\\.execute-api\\.%s.amazonaws\\.com/%s", acctest.Region(), rName))),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "route_settings.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "stage_variables.%", "0"),
@@ -361,7 +364,7 @@ func TestAccAPIGatewayV2Stage_clientCertificateIdAndDescription(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "deployment_id", ""),
 					resource.TestCheckResourceAttr(resourceName, "description", "Test stage"),
 					testAccCheckStageExecutionARN(resourceName, "execution_arn", &apiId, &v),
-					resource.TestMatchResourceAttr(resourceName, "invoke_url", regexp.MustCompile(fmt.Sprintf("wss://.+\\.execute-api\\.%s.amazonaws\\.com/%s", acctest.Region(), rName))),
+					resource.TestMatchResourceAttr(resourceName, "invoke_url", regexache.MustCompile(fmt.Sprintf("wss://.+\\.execute-api\\.%s.amazonaws\\.com/%s", acctest.Region(), rName))),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "route_settings.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "stage_variables.%", "0"),
@@ -391,7 +394,7 @@ func TestAccAPIGatewayV2Stage_clientCertificateIdAndDescription(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "deployment_id", ""),
 					resource.TestCheckResourceAttr(resourceName, "description", "Test stage updated"),
 					testAccCheckStageExecutionARN(resourceName, "execution_arn", &apiId, &v),
-					resource.TestMatchResourceAttr(resourceName, "invoke_url", regexp.MustCompile(fmt.Sprintf("wss://.+\\.execute-api\\.%s.amazonaws\\.com/%s", acctest.Region(), rName))),
+					resource.TestMatchResourceAttr(resourceName, "invoke_url", regexache.MustCompile(fmt.Sprintf("wss://.+\\.execute-api\\.%s.amazonaws\\.com/%s", acctest.Region(), rName))),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "route_settings.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "stage_variables.%", "0"),
@@ -432,7 +435,7 @@ func TestAccAPIGatewayV2Stage_defaultRouteSettingsWebSocket(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "deployment_id", ""),
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
 					testAccCheckStageExecutionARN(resourceName, "execution_arn", &apiId, &v),
-					resource.TestMatchResourceAttr(resourceName, "invoke_url", regexp.MustCompile(fmt.Sprintf("wss://.+\\.execute-api\\.%s.amazonaws\\.com/%s", acctest.Region(), rName))),
+					resource.TestMatchResourceAttr(resourceName, "invoke_url", regexache.MustCompile(fmt.Sprintf("wss://.+\\.execute-api\\.%s.amazonaws\\.com/%s", acctest.Region(), rName))),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "route_settings.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "stage_variables.%", "0"),
@@ -456,7 +459,7 @@ func TestAccAPIGatewayV2Stage_defaultRouteSettingsWebSocket(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "deployment_id", ""),
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
 					testAccCheckStageExecutionARN(resourceName, "execution_arn", &apiId, &v),
-					resource.TestMatchResourceAttr(resourceName, "invoke_url", regexp.MustCompile(fmt.Sprintf("wss://.+\\.execute-api\\.%s.amazonaws\\.com/%s", acctest.Region(), rName))),
+					resource.TestMatchResourceAttr(resourceName, "invoke_url", regexache.MustCompile(fmt.Sprintf("wss://.+\\.execute-api\\.%s.amazonaws\\.com/%s", acctest.Region(), rName))),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "route_settings.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "stage_variables.%", "0"),
@@ -524,7 +527,7 @@ func TestAccAPIGatewayV2Stage_defaultRouteSettingsHTTP(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "deployment_id", ""),
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
 					testAccCheckStageExecutionARN(resourceName, "execution_arn", &apiId, &v),
-					resource.TestMatchResourceAttr(resourceName, "invoke_url", regexp.MustCompile(fmt.Sprintf("https://.+\\.execute-api\\.%s.amazonaws\\.com/%s", acctest.Region(), rName))),
+					resource.TestMatchResourceAttr(resourceName, "invoke_url", regexache.MustCompile(fmt.Sprintf("https://.+\\.execute-api\\.%s.amazonaws\\.com/%s", acctest.Region(), rName))),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "route_settings.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "stage_variables.%", "0"),
@@ -548,7 +551,7 @@ func TestAccAPIGatewayV2Stage_defaultRouteSettingsHTTP(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "deployment_id", ""),
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
 					testAccCheckStageExecutionARN(resourceName, "execution_arn", &apiId, &v),
-					resource.TestMatchResourceAttr(resourceName, "invoke_url", regexp.MustCompile(fmt.Sprintf("https://.+\\.execute-api\\.%s.amazonaws\\.com/%s", acctest.Region(), rName))),
+					resource.TestMatchResourceAttr(resourceName, "invoke_url", regexache.MustCompile(fmt.Sprintf("https://.+\\.execute-api\\.%s.amazonaws\\.com/%s", acctest.Region(), rName))),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "route_settings.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "stage_variables.%", "0"),
@@ -617,7 +620,7 @@ func TestAccAPIGatewayV2Stage_deployment(t *testing.T) {
 					resource.TestCheckResourceAttrPair(resourceName, "deployment_id", deploymentResourceName, "id"),
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
 					testAccCheckStageExecutionARN(resourceName, "execution_arn", &apiId, &v),
-					resource.TestMatchResourceAttr(resourceName, "invoke_url", regexp.MustCompile(fmt.Sprintf("wss://.+\\.execute-api\\.%s.amazonaws\\.com/%s", acctest.Region(), rName))),
+					resource.TestMatchResourceAttr(resourceName, "invoke_url", regexache.MustCompile(fmt.Sprintf("wss://.+\\.execute-api\\.%s.amazonaws\\.com/%s", acctest.Region(), rName))),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "route_settings.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "stage_variables.%", "0"),
@@ -664,7 +667,7 @@ func TestAccAPIGatewayV2Stage_routeSettingsWebSocket(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "deployment_id", ""),
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
 					testAccCheckStageExecutionARN(resourceName, "execution_arn", &apiId, &v),
-					resource.TestMatchResourceAttr(resourceName, "invoke_url", regexp.MustCompile(fmt.Sprintf("wss://.+\\.execute-api\\.%s.amazonaws\\.com/%s", acctest.Region(), rName))),
+					resource.TestMatchResourceAttr(resourceName, "invoke_url", regexache.MustCompile(fmt.Sprintf("wss://.+\\.execute-api\\.%s.amazonaws\\.com/%s", acctest.Region(), rName))),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "route_settings.#", "2"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "route_settings.*", map[string]string{
@@ -703,7 +706,7 @@ func TestAccAPIGatewayV2Stage_routeSettingsWebSocket(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "deployment_id", ""),
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
 					testAccCheckStageExecutionARN(resourceName, "execution_arn", &apiId, &v),
-					resource.TestMatchResourceAttr(resourceName, "invoke_url", regexp.MustCompile(fmt.Sprintf("wss://.+\\.execute-api\\.%s.amazonaws\\.com/%s", acctest.Region(), rName))),
+					resource.TestMatchResourceAttr(resourceName, "invoke_url", regexache.MustCompile(fmt.Sprintf("wss://.+\\.execute-api\\.%s.amazonaws\\.com/%s", acctest.Region(), rName))),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "route_settings.#", "3"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "route_settings.*", map[string]string{
@@ -793,7 +796,7 @@ func TestAccAPIGatewayV2Stage_routeSettingsHTTP(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "deployment_id", ""),
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
 					testAccCheckStageExecutionARN(resourceName, "execution_arn", &apiId, &v),
-					resource.TestMatchResourceAttr(resourceName, "invoke_url", regexp.MustCompile(fmt.Sprintf("https://.+\\.execute-api\\.%s.amazonaws\\.com/%s", acctest.Region(), rName))),
+					resource.TestMatchResourceAttr(resourceName, "invoke_url", regexache.MustCompile(fmt.Sprintf("https://.+\\.execute-api\\.%s.amazonaws\\.com/%s", acctest.Region(), rName))),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "route_settings.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "route_settings.*", map[string]string{
@@ -824,7 +827,7 @@ func TestAccAPIGatewayV2Stage_routeSettingsHTTP(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "deployment_id", ""),
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
 					testAccCheckStageExecutionARN(resourceName, "execution_arn", &apiId, &v),
-					resource.TestMatchResourceAttr(resourceName, "invoke_url", regexp.MustCompile(fmt.Sprintf("https://.+\\.execute-api\\.%s.amazonaws\\.com/%s", acctest.Region(), rName))),
+					resource.TestMatchResourceAttr(resourceName, "invoke_url", regexache.MustCompile(fmt.Sprintf("https://.+\\.execute-api\\.%s.amazonaws\\.com/%s", acctest.Region(), rName))),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "route_settings.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "route_settings.*", map[string]string{
@@ -899,7 +902,7 @@ func TestAccAPIGatewayV2Stage_RouteSettingsHTTP_withRoute(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "deployment_id", ""),
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
 					testAccCheckStageExecutionARN(resourceName, "execution_arn", &apiId, &v),
-					resource.TestMatchResourceAttr(resourceName, "invoke_url", regexp.MustCompile(fmt.Sprintf("https://.+\\.execute-api\\.%s.amazonaws\\.com/%s", acctest.Region(), rName))),
+					resource.TestMatchResourceAttr(resourceName, "invoke_url", regexache.MustCompile(fmt.Sprintf("https://.+\\.execute-api\\.%s.amazonaws\\.com/%s", acctest.Region(), rName))),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "route_settings.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "route_settings.*", map[string]string{
@@ -930,7 +933,7 @@ func TestAccAPIGatewayV2Stage_RouteSettingsHTTP_withRoute(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "deployment_id", ""),
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
 					testAccCheckStageExecutionARN(resourceName, "execution_arn", &apiId, &v),
-					resource.TestMatchResourceAttr(resourceName, "invoke_url", regexp.MustCompile(fmt.Sprintf("https://.+\\.execute-api\\.%s.amazonaws\\.com/%s", acctest.Region(), rName))),
+					resource.TestMatchResourceAttr(resourceName, "invoke_url", regexache.MustCompile(fmt.Sprintf("https://.+\\.execute-api\\.%s.amazonaws\\.com/%s", acctest.Region(), rName))),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "route_settings.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "route_settings.*", map[string]string{
@@ -984,7 +987,7 @@ func TestAccAPIGatewayV2Stage_stageVariables(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "default_route_settings.0.throttling_rate_limit", "0"),
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
 					testAccCheckStageExecutionARN(resourceName, "execution_arn", &apiId, &v),
-					resource.TestMatchResourceAttr(resourceName, "invoke_url", regexp.MustCompile(fmt.Sprintf("wss://.+\\.execute-api\\.%s.amazonaws\\.com/%s", acctest.Region(), rName))),
+					resource.TestMatchResourceAttr(resourceName, "invoke_url", regexache.MustCompile(fmt.Sprintf("wss://.+\\.execute-api\\.%s.amazonaws\\.com/%s", acctest.Region(), rName))),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "route_settings.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "stage_variables.%", "2"),
@@ -1054,7 +1057,7 @@ func TestAccAPIGatewayV2Stage_tags(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "default_route_settings.0.throttling_rate_limit", "0"),
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
 					testAccCheckStageExecutionARN(resourceName, "execution_arn", &apiId, &v),
-					resource.TestMatchResourceAttr(resourceName, "invoke_url", regexp.MustCompile(fmt.Sprintf("wss://.+\\.execute-api\\.%s.amazonaws\\.com/%s", acctest.Region(), rName))),
+					resource.TestMatchResourceAttr(resourceName, "invoke_url", regexache.MustCompile(fmt.Sprintf("wss://.+\\.execute-api\\.%s.amazonaws\\.com/%s", acctest.Region(), rName))),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "route_settings.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "stage_variables.%", "0"),
diff --git a/internal/service/apigatewayv2/status.go b/internal/service/apigatewayv2/status.go
index 624f48c1e5b..77b00eb809c 100644
--- a/internal/service/apigatewayv2/status.go
+++ b/internal/service/apigatewayv2/status.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigatewayv2
 
 import (
diff --git a/internal/service/apigatewayv2/sweep.go b/internal/service/apigatewayv2/sweep.go
index 777ee31e3ce..c599b9c71d8 100644
--- a/internal/service/apigatewayv2/sweep.go
+++ b/internal/service/apigatewayv2/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package apigatewayv2
 
@@ -12,9 +12,10 @@ import (
 	multierror "github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_apigatewayv2_api", &resource.Sweeper{
 		Name: "aws_apigatewayv2_api",
 		F:    sweepAPIs,
@@ -44,7 +45,7 @@ func init() {
 
 func sweepAPIs(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -68,7 +69,7 @@ func sweepAPIs(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping API Gateway v2 API sweep for %s: %s", region, err)
 		return nil
 	}
@@ -77,7 +78,7 @@ func sweepAPIs(region string) error {
 		return fmt.Errorf("error listing API Gateway v2 APIs (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping API Gateway v2 APIs (%s): %w", region, err)
@@ -88,7 +89,7 @@ func sweepAPIs(region string) error {
 
 func sweepAPIMappings(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
@@ -125,7 +126,7 @@ func sweepAPIMappings(region string) error {
 				return !lastPage
 			})
 
-			if sweep.SkipSweepError(err) {
+			if awsv1.SkipSweepError(err) {
 				continue
 			}
 
@@ -137,7 +138,7 @@ func sweepAPIMappings(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping API Gateway v2 API Mapping sweep for %s: %s", region, err)
 		return nil
 	}
@@ -146,7 +147,7 @@ func sweepAPIMappings(region string) error {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error listing API Gateway v2 Domain Names (%s): %w", region, err))
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error sweeping API Gateway v2 API Mappings (%s): %w", region, err))
@@ -157,7 +158,7 @@ func sweepAPIMappings(region string) error {
 
 func sweepDomainNames(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
@@ -181,7 +182,7 @@ func sweepDomainNames(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping API Gateway v2 Domain Name sweep for %s: %s", region, err)
 		return nil
 	}
@@ -190,7 +191,7 @@ func sweepDomainNames(region string) error {
 		return fmt.Errorf("error listing API Gateway v2 Domain Names (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping API Gateway v2 Domain Names (%s): %w", region, err)
@@ -201,7 +202,7 @@ func sweepDomainNames(region string) error {
 
 func sweepVPCLinks(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -225,7 +226,7 @@ func sweepVPCLinks(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping API Gateway v2 VPC Link sweep for %s: %s", region, err)
 		return nil
 	}
@@ -234,7 +235,7 @@ func sweepVPCLinks(region string) error {
 		return fmt.Errorf("error listing API Gateway v2 VPC Links (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping API Gateway v2 VPC Links (%s): %w", region, err)
diff --git a/internal/service/apigatewayv2/tags_gen.go b/internal/service/apigatewayv2/tags_gen.go
index 39d7e1dc402..cd194405c9f 100644
--- a/internal/service/apigatewayv2/tags_gen.go
+++ b/internal/service/apigatewayv2/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/apigatewayv2"
 	"github.com/aws/aws-sdk-go/service/apigatewayv2/apigatewayv2iface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -54,7 +56,7 @@ func Tags(tags tftags.KeyValueTags) map[string]*string {
 	return aws.StringMap(tags.Map())
 }
 
-// KeyValueTags creates KeyValueTags from apigatewayv2 service tags.
+// KeyValueTags creates tftags.KeyValueTags from apigatewayv2 service tags.
 func KeyValueTags(ctx context.Context, tags map[string]*string) tftags.KeyValueTags {
 	return tftags.New(ctx, tags)
 }
@@ -85,6 +87,8 @@ func updateTags(ctx context.Context, conn apigatewayv2iface.ApiGatewayV2API, ide
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.APIGatewayV2)
 	if len(removedTags) > 0 {
diff --git a/internal/service/apigatewayv2/validate.go b/internal/service/apigatewayv2/validate.go
index 8de2253e750..3fb07674a5d 100644
--- a/internal/service/apigatewayv2/validate.go
+++ b/internal/service/apigatewayv2/validate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigatewayv2
 
 import (
diff --git a/internal/service/apigatewayv2/vpc_link.go b/internal/service/apigatewayv2/vpc_link.go
index ff283ec05a8..7da56df9f70 100644
--- a/internal/service/apigatewayv2/vpc_link.go
+++ b/internal/service/apigatewayv2/vpc_link.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigatewayv2
 
 import (
diff --git a/internal/service/apigatewayv2/vpc_link_test.go b/internal/service/apigatewayv2/vpc_link_test.go
index 21398172e6c..99f370de5d1 100644
--- a/internal/service/apigatewayv2/vpc_link_test.go
+++ b/internal/service/apigatewayv2/vpc_link_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigatewayv2_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/apigatewayv2"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -34,7 +37,7 @@ func TestAccAPIGatewayV2VPCLink_basic(t *testing.T) {
 				Config: testAccVPCLinkConfig_basic(rName1),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckVPCLinkExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexp.MustCompile(`/vpclinks/.+`)),
+					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexache.MustCompile(`/vpclinks/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "name", rName1),
 					resource.TestCheckResourceAttr(resourceName, "security_group_ids.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "subnet_ids.#", "2"),
@@ -45,7 +48,7 @@ func TestAccAPIGatewayV2VPCLink_basic(t *testing.T) {
 				Config: testAccVPCLinkConfig_basic(rName2),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckVPCLinkExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexp.MustCompile(`/vpclinks/.+`)),
+					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexache.MustCompile(`/vpclinks/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "name", rName2),
 					resource.TestCheckResourceAttr(resourceName, "security_group_ids.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "subnet_ids.#", "2"),
@@ -101,7 +104,7 @@ func TestAccAPIGatewayV2VPCLink_tags(t *testing.T) {
 				Config: testAccVPCLinkConfig_tags(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckVPCLinkExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexp.MustCompile(`/vpclinks/.+`)),
+					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "apigateway", regexache.MustCompile(`/vpclinks/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "security_group_ids.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "subnet_ids.#", "2"),
diff --git a/internal/service/apigatewayv2/wait.go b/internal/service/apigatewayv2/wait.go
index 6ec23efe847..b1f54062897 100644
--- a/internal/service/apigatewayv2/wait.go
+++ b/internal/service/apigatewayv2/wait.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apigatewayv2
 
 import (
diff --git a/internal/service/appautoscaling/consts.go b/internal/service/appautoscaling/consts.go
index 8d0acf2b8a4..e4ddfad0fa8 100644
--- a/internal/service/appautoscaling/consts.go
+++ b/internal/service/appautoscaling/consts.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appautoscaling
 
 import (
diff --git a/internal/service/appautoscaling/diff.go b/internal/service/appautoscaling/diff.go
index 5a23ca40695..b0060d5bf52 100644
--- a/internal/service/appautoscaling/diff.go
+++ b/internal/service/appautoscaling/diff.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appautoscaling
 
 import (
diff --git a/internal/service/appautoscaling/find.go b/internal/service/appautoscaling/find.go
index cf78be347c7..bbc317915c6 100644
--- a/internal/service/appautoscaling/find.go
+++ b/internal/service/appautoscaling/find.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appautoscaling
 
 import (
diff --git a/internal/service/appautoscaling/generate.go b/internal/service/appautoscaling/generate.go
index d1bf227d5bb..e74ba40f1ab 100644
--- a/internal/service/appautoscaling/generate.go
+++ b/internal/service/appautoscaling/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTags -ListTagsInIDElem=ResourceARN -ServiceTagsMap -TagInIDElem=ResourceARN -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/appautoscaling/policy.go b/internal/service/appautoscaling/policy.go
index 98629532da0..66650215ea1 100644
--- a/internal/service/appautoscaling/policy.go
+++ b/internal/service/appautoscaling/policy.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appautoscaling
 
 import (
diff --git a/internal/service/appautoscaling/policy_test.go b/internal/service/appautoscaling/policy_test.go
index f4c02d161f1..06563cf43d1 100644
--- a/internal/service/appautoscaling/policy_test.go
+++ b/internal/service/appautoscaling/policy_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appautoscaling_test
 
 import (
diff --git a/internal/service/appautoscaling/scheduled_action.go b/internal/service/appautoscaling/scheduled_action.go
index 365c66756ff..73bfed9f874 100644
--- a/internal/service/appautoscaling/scheduled_action.go
+++ b/internal/service/appautoscaling/scheduled_action.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appautoscaling
 
 import (
@@ -15,8 +18,8 @@ import (
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
-	"github.com/hashicorp/terraform-provider-aws/internal/experimental/nullable"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/internal/types/nullable"
 )
 
 // @SDKResource("aws_appautoscaling_scheduled_action")
diff --git a/internal/service/appautoscaling/scheduled_action_test.go b/internal/service/appautoscaling/scheduled_action_test.go
index 16c10e2054d..ee6afdec26f 100644
--- a/internal/service/appautoscaling/scheduled_action_test.go
+++ b/internal/service/appautoscaling/scheduled_action_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appautoscaling_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/applicationautoscaling"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -46,7 +49,7 @@ func TestAccAppAutoScalingScheduledAction_dynamoDB(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "scalable_target_action.0.min_capacity", "1"),
 					resource.TestCheckResourceAttr(resourceName, "scalable_target_action.0.max_capacity", "10"),
 					resource.TestCheckResourceAttr(resourceName, "timezone", "UTC"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "autoscaling", regexp.MustCompile(fmt.Sprintf("scheduledAction:.+:scheduledActionName/%s$", rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "autoscaling", regexache.MustCompile(fmt.Sprintf("scheduledAction:.+:scheduledActionName/%s$", rName))),
 					resource.TestCheckNoResourceAttr(resourceName, "start_time"),
 					resource.TestCheckNoResourceAttr(resourceName, "end_time"),
 				),
@@ -65,7 +68,7 @@ func TestAccAppAutoScalingScheduledAction_dynamoDB(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "scalable_target_action.0.min_capacity", "2"),
 					resource.TestCheckResourceAttr(resourceName, "scalable_target_action.0.max_capacity", "9"),
 					resource.TestCheckResourceAttr(resourceName, "timezone", updatedTimezone),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "autoscaling", regexp.MustCompile(fmt.Sprintf("scheduledAction:.+:scheduledActionName/%s$", rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "autoscaling", regexache.MustCompile(fmt.Sprintf("scheduledAction:.+:scheduledActionName/%s$", rName))),
 					resource.TestCheckNoResourceAttr(resourceName, "start_time"),
 					resource.TestCheckNoResourceAttr(resourceName, "end_time"),
 				),
@@ -101,7 +104,7 @@ func TestAccAppAutoScalingScheduledAction_ecs(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "scalable_target_action.0.min_capacity", "1"),
 					resource.TestCheckResourceAttr(resourceName, "scalable_target_action.0.max_capacity", "5"),
 					resource.TestCheckResourceAttr(resourceName, "timezone", "UTC"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "autoscaling", regexp.MustCompile(fmt.Sprintf("scheduledAction:.+:scheduledActionName/%s$", rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "autoscaling", regexache.MustCompile(fmt.Sprintf("scheduledAction:.+:scheduledActionName/%s$", rName))),
 				),
 			},
 		},
@@ -135,7 +138,7 @@ func TestAccAppAutoScalingScheduledAction_emr(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "scalable_target_action.0.min_capacity", "1"),
 					resource.TestCheckResourceAttr(resourceName, "scalable_target_action.0.max_capacity", "5"),
 					resource.TestCheckResourceAttr(resourceName, "timezone", "UTC"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "autoscaling", regexp.MustCompile(fmt.Sprintf("scheduledAction:.+:scheduledActionName/%s$", rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "autoscaling", regexache.MustCompile(fmt.Sprintf("scheduledAction:.+:scheduledActionName/%s$", rName))),
 				),
 			},
 		},
@@ -194,7 +197,7 @@ func TestAccAppAutoScalingScheduledAction_spotFleet(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "scalable_target_action.0.min_capacity", "1"),
 					resource.TestCheckResourceAttr(resourceName, "scalable_target_action.0.max_capacity", "3"),
 					resource.TestCheckResourceAttr(resourceName, "timezone", "UTC"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "autoscaling", regexp.MustCompile(fmt.Sprintf("scheduledAction:.+:scheduledActionName/%s$", rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "autoscaling", regexache.MustCompile(fmt.Sprintf("scheduledAction:.+:scheduledActionName/%s$", rName))),
 				),
 			},
 		},
@@ -232,7 +235,7 @@ func TestAccAppAutoScalingScheduledAction_ScheduleAtExpression_timezone(t *testi
 					resource.TestCheckResourceAttr(resourceName, "scalable_target_action.0.min_capacity", "1"),
 					resource.TestCheckResourceAttr(resourceName, "scalable_target_action.0.max_capacity", "10"),
 					resource.TestCheckResourceAttr(resourceName, "timezone", timezone),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "autoscaling", regexp.MustCompile(fmt.Sprintf("scheduledAction:.+:scheduledActionName/%s$", rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "autoscaling", regexache.MustCompile(fmt.Sprintf("scheduledAction:.+:scheduledActionName/%s$", rName))),
 					resource.TestCheckResourceAttr(resourceName, "start_time", startTime),
 					resource.TestCheckResourceAttr(resourceName, "end_time", endTime),
 				),
@@ -268,7 +271,7 @@ func TestAccAppAutoScalingScheduledAction_ScheduleCronExpression_basic(t *testin
 					resource.TestCheckResourceAttr(resourceName, "scalable_target_action.0.min_capacity", "1"),
 					resource.TestCheckResourceAttr(resourceName, "scalable_target_action.0.max_capacity", "10"),
 					resource.TestCheckResourceAttr(resourceName, "timezone", "UTC"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "autoscaling", regexp.MustCompile(fmt.Sprintf("scheduledAction:.+:scheduledActionName/%s$", rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "autoscaling", regexache.MustCompile(fmt.Sprintf("scheduledAction:.+:scheduledActionName/%s$", rName))),
 					resource.TestCheckNoResourceAttr(resourceName, "start_time"),
 					resource.TestCheckNoResourceAttr(resourceName, "end_time"),
 				),
@@ -307,7 +310,7 @@ func TestAccAppAutoScalingScheduledAction_ScheduleCronExpression_timezone(t *tes
 					resource.TestCheckResourceAttr(resourceName, "scalable_target_action.0.min_capacity", "1"),
 					resource.TestCheckResourceAttr(resourceName, "scalable_target_action.0.max_capacity", "10"),
 					resource.TestCheckResourceAttr(resourceName, "timezone", timezone),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "autoscaling", regexp.MustCompile(fmt.Sprintf("scheduledAction:.+:scheduledActionName/%s$", rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "autoscaling", regexache.MustCompile(fmt.Sprintf("scheduledAction:.+:scheduledActionName/%s$", rName))),
 					resource.TestCheckResourceAttr(resourceName, "start_time", startTime),
 					resource.TestCheckResourceAttr(resourceName, "end_time", endTime),
 				),
@@ -350,7 +353,7 @@ func TestAccAppAutoScalingScheduledAction_ScheduleCronExpression_startEndTimeTim
 					resource.TestCheckResourceAttr(resourceName, "scalable_target_action.0.min_capacity", "1"),
 					resource.TestCheckResourceAttr(resourceName, "scalable_target_action.0.max_capacity", "10"),
 					resource.TestCheckResourceAttr(resourceName, "timezone", scheduleTimezone),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "autoscaling", regexp.MustCompile(fmt.Sprintf("scheduledAction:.+:scheduledActionName/%s$", rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "autoscaling", regexache.MustCompile(fmt.Sprintf("scheduledAction:.+:scheduledActionName/%s$", rName))),
 					resource.TestCheckResourceAttr(resourceName, "start_time", startTimeUtc.Format(time.RFC3339)),
 					resource.TestCheckResourceAttr(resourceName, "end_time", endTimeUtc.Format(time.RFC3339)),
 				),
@@ -368,7 +371,7 @@ func TestAccAppAutoScalingScheduledAction_ScheduleCronExpression_startEndTimeTim
 					resource.TestCheckResourceAttr(resourceName, "scalable_target_action.0.min_capacity", "1"),
 					resource.TestCheckResourceAttr(resourceName, "scalable_target_action.0.max_capacity", "10"),
 					resource.TestCheckResourceAttr(resourceName, "timezone", "UTC"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "autoscaling", regexp.MustCompile(fmt.Sprintf("scheduledAction:.+:scheduledActionName/%s$", rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "autoscaling", regexache.MustCompile(fmt.Sprintf("scheduledAction:.+:scheduledActionName/%s$", rName))),
 					resource.TestCheckResourceAttr(resourceName, "start_time", ""),
 					resource.TestCheckResourceAttr(resourceName, "end_time", ""),
 				),
@@ -404,7 +407,7 @@ func TestAccAppAutoScalingScheduledAction_ScheduleRateExpression_basic(t *testin
 					resource.TestCheckResourceAttr(resourceName, "scalable_target_action.0.min_capacity", "1"),
 					resource.TestCheckResourceAttr(resourceName, "scalable_target_action.0.max_capacity", "10"),
 					resource.TestCheckResourceAttr(resourceName, "timezone", "UTC"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "autoscaling", regexp.MustCompile(fmt.Sprintf("scheduledAction:.+:scheduledActionName/%s$", rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "autoscaling", regexache.MustCompile(fmt.Sprintf("scheduledAction:.+:scheduledActionName/%s$", rName))),
 					resource.TestCheckNoResourceAttr(resourceName, "start_time"),
 					resource.TestCheckNoResourceAttr(resourceName, "end_time"),
 				),
@@ -443,7 +446,7 @@ func TestAccAppAutoScalingScheduledAction_ScheduleRateExpression_timezone(t *tes
 					resource.TestCheckResourceAttr(resourceName, "scalable_target_action.0.min_capacity", "1"),
 					resource.TestCheckResourceAttr(resourceName, "scalable_target_action.0.max_capacity", "10"),
 					resource.TestCheckResourceAttr(resourceName, "timezone", timezone),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "autoscaling", regexp.MustCompile(fmt.Sprintf("scheduledAction:.+:scheduledActionName/%s$", rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "autoscaling", regexache.MustCompile(fmt.Sprintf("scheduledAction:.+:scheduledActionName/%s$", rName))),
 					resource.TestCheckResourceAttr(resourceName, "start_time", startTime),
 					resource.TestCheckResourceAttr(resourceName, "end_time", endTime),
 				),
@@ -479,7 +482,7 @@ func TestAccAppAutoScalingScheduledAction_minCapacity(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "scalable_target_action.0.min_capacity", "1"),
 					resource.TestCheckResourceAttr(resourceName, "scalable_target_action.0.max_capacity", ""),
 					resource.TestCheckResourceAttr(resourceName, "timezone", "UTC"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "autoscaling", regexp.MustCompile(fmt.Sprintf("scheduledAction:.+:scheduledActionName/%s$", rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "autoscaling", regexache.MustCompile(fmt.Sprintf("scheduledAction:.+:scheduledActionName/%s$", rName))),
 					resource.TestCheckNoResourceAttr(resourceName, "start_time"),
 					resource.TestCheckNoResourceAttr(resourceName, "end_time"),
 				),
@@ -535,7 +538,7 @@ func TestAccAppAutoScalingScheduledAction_maxCapacity(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "scalable_target_action.0.min_capacity", ""),
 					resource.TestCheckResourceAttr(resourceName, "scalable_target_action.0.max_capacity", "10"),
 					resource.TestCheckResourceAttr(resourceName, "timezone", "UTC"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "autoscaling", regexp.MustCompile(fmt.Sprintf("scheduledAction:.+:scheduledActionName/%s$", rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "autoscaling", regexache.MustCompile(fmt.Sprintf("scheduledAction:.+:scheduledActionName/%s$", rName))),
 					resource.TestCheckNoResourceAttr(resourceName, "start_time"),
 					resource.TestCheckNoResourceAttr(resourceName, "end_time"),
 				),
diff --git a/internal/service/appautoscaling/service_package.go b/internal/service/appautoscaling/service_package.go
index 9bf8a975b48..c03d1a61306 100644
--- a/internal/service/appautoscaling/service_package.go
+++ b/internal/service/appautoscaling/service_package.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appautoscaling
 
 import (
diff --git a/internal/service/appautoscaling/service_package_gen.go b/internal/service/appautoscaling/service_package_gen.go
index 56f13dcdc28..b3afc60b206 100644
--- a/internal/service/appautoscaling/service_package_gen.go
+++ b/internal/service/appautoscaling/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	applicationautoscaling_sdkv1 "github.com/aws/aws-sdk-go/service/applicationautoscaling"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -58,4 +59,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*a
 	return applicationautoscaling_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/appautoscaling/tags_gen.go b/internal/service/appautoscaling/tags_gen.go
index 7c6e25e2f01..513af866fac 100644
--- a/internal/service/appautoscaling/tags_gen.go
+++ b/internal/service/appautoscaling/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/applicationautoscaling"
 	"github.com/aws/aws-sdk-go/service/applicationautoscaling/applicationautoscalingiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -54,7 +56,7 @@ func Tags(tags tftags.KeyValueTags) map[string]*string {
 	return aws.StringMap(tags.Map())
 }
 
-// KeyValueTags creates KeyValueTags from appautoscaling service tags.
+// KeyValueTags creates tftags.KeyValueTags from appautoscaling service tags.
 func KeyValueTags(ctx context.Context, tags map[string]*string) tftags.KeyValueTags {
 	return tftags.New(ctx, tags)
 }
@@ -85,6 +87,8 @@ func updateTags(ctx context.Context, conn applicationautoscalingiface.Applicatio
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.AppAutoScaling)
 	if len(removedTags) > 0 {
diff --git a/internal/service/appautoscaling/target.go b/internal/service/appautoscaling/target.go
index 22220117ccb..5fa630c3e3b 100644
--- a/internal/service/appautoscaling/target.go
+++ b/internal/service/appautoscaling/target.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appautoscaling
 
 import (
diff --git a/internal/service/appautoscaling/target_test.go b/internal/service/appautoscaling/target_test.go
index 2f71f97f2b7..2a60a2f153d 100644
--- a/internal/service/appautoscaling/target_test.go
+++ b/internal/service/appautoscaling/target_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appautoscaling_test
 
 import (
diff --git a/internal/service/appconfig/application.go b/internal/service/appconfig/application.go
index 3c1c5c4f9b6..f63b50fffc3 100644
--- a/internal/service/appconfig/application.go
+++ b/internal/service/appconfig/application.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appconfig
 
 import (
diff --git a/internal/service/appconfig/application_test.go b/internal/service/appconfig/application_test.go
index 845c4f5176f..a30d0df062f 100644
--- a/internal/service/appconfig/application_test.go
+++ b/internal/service/appconfig/application_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appconfig_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/appconfig"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -32,7 +35,7 @@ func TestAccAppConfigApplication_basic(t *testing.T) {
 				Config: testAccApplicationConfig_name(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckApplicationExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "appconfig", regexp.MustCompile(`application/[a-z0-9]{4,7}`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "appconfig", regexache.MustCompile(`application/[0-9a-z]{4,7}`)),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 				),
diff --git a/internal/service/appconfig/configuration_profile.go b/internal/service/appconfig/configuration_profile.go
index 61c7110bf6f..88375c4753e 100644
--- a/internal/service/appconfig/configuration_profile.go
+++ b/internal/service/appconfig/configuration_profile.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appconfig
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"strings"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/aws/aws-sdk-go/service/appconfig"
@@ -38,7 +41,7 @@ func ResourceConfigurationProfile() *schema.Resource {
 				Type:         schema.TypeString,
 				Required:     true,
 				ForceNew:     true,
-				ValidateFunc: validation.StringMatch(regexp.MustCompile(`[a-z0-9]{4,7}`), ""),
+				ValidateFunc: validation.StringMatch(regexache.MustCompile(`[0-9a-z]{4,7}`), ""),
 			},
 			"arn": {
 				Type:     schema.TypeString,
diff --git a/internal/service/appconfig/configuration_profile_data_source.go b/internal/service/appconfig/configuration_profile_data_source.go
index e15a9631352..6f5e2ed32f2 100644
--- a/internal/service/appconfig/configuration_profile_data_source.go
+++ b/internal/service/appconfig/configuration_profile_data_source.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appconfig
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/aws/aws-sdk-go/service/appconfig"
@@ -25,7 +28,7 @@ func DataSourceConfigurationProfile() *schema.Resource {
 			"application_id": {
 				Type:         schema.TypeString,
 				Required:     true,
-				ValidateFunc: validation.StringMatch(regexp.MustCompile(`[a-z\d]{4,7}`), ""),
+				ValidateFunc: validation.StringMatch(regexache.MustCompile(`[a-z\d]{4,7}`), ""),
 			},
 			"arn": {
 				Type:     schema.TypeString,
@@ -34,7 +37,7 @@ func DataSourceConfigurationProfile() *schema.Resource {
 			"configuration_profile_id": {
 				Type:         schema.TypeString,
 				Required:     true,
-				ValidateFunc: validation.StringMatch(regexp.MustCompile(`[a-z\d]{4,7}`), ""),
+				ValidateFunc: validation.StringMatch(regexache.MustCompile(`[a-z\d]{4,7}`), ""),
 			},
 			"description": {
 				Type:     schema.TypeString,
diff --git a/internal/service/appconfig/configuration_profile_data_source_test.go b/internal/service/appconfig/configuration_profile_data_source_test.go
index dc9ffd8f85b..ab0b1792ec0 100644
--- a/internal/service/appconfig/configuration_profile_data_source_test.go
+++ b/internal/service/appconfig/configuration_profile_data_source_test.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appconfig_test
 
 import (
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/appconfig"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -31,8 +34,8 @@ func TestAccAppConfigConfigurationProfileDataSource_basic(t *testing.T) {
 				Config: testAccConfigurationProfileDataSourceConfig_basic(appName, rName),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttrPair(dataSourceName, "application_id", appResourceName, "id"),
-					acctest.MatchResourceAttrRegionalARN(dataSourceName, "arn", "appconfig", regexp.MustCompile(`application/([a-z\d]{4,7})/configurationprofile/+.`)),
-					resource.TestMatchResourceAttr(dataSourceName, "configuration_profile_id", regexp.MustCompile(`[a-z\d]{4,7}`)),
+					acctest.MatchResourceAttrRegionalARN(dataSourceName, "arn", "appconfig", regexache.MustCompile(`application/([a-z\d]{4,7})/configurationprofile/+.`)),
+					resource.TestMatchResourceAttr(dataSourceName, "configuration_profile_id", regexache.MustCompile(`[a-z\d]{4,7}`)),
 					resource.TestCheckResourceAttr(dataSourceName, "location_uri", "hosted"),
 					resource.TestCheckResourceAttr(dataSourceName, "name", rName),
 					resource.TestCheckResourceAttr(dataSourceName, "retrieval_role_arn", ""),
diff --git a/internal/service/appconfig/configuration_profile_test.go b/internal/service/appconfig/configuration_profile_test.go
index 826f1921fdc..cf81871a59f 100644
--- a/internal/service/appconfig/configuration_profile_test.go
+++ b/internal/service/appconfig/configuration_profile_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appconfig_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/appconfig"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -34,8 +37,8 @@ func TestAccAppConfigConfigurationProfile_basic(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckConfigurationProfileExists(ctx, resourceName),
 					resource.TestCheckResourceAttrPair(resourceName, "application_id", appResourceName, "id"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "appconfig", regexp.MustCompile(`application/[a-z0-9]{4,7}/configurationprofile/[a-z0-9]{4,7}`)),
-					resource.TestMatchResourceAttr(resourceName, "configuration_profile_id", regexp.MustCompile(`[a-z0-9]{4,7}`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "appconfig", regexache.MustCompile(`application/[0-9a-z]{4,7}/configurationprofile/[0-9a-z]{4,7}`)),
+					resource.TestMatchResourceAttr(resourceName, "configuration_profile_id", regexache.MustCompile(`[0-9a-z]{4,7}`)),
 					resource.TestCheckResourceAttr(resourceName, "location_uri", "hosted"),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
diff --git a/internal/service/appconfig/configuration_profiles_data_source.go b/internal/service/appconfig/configuration_profiles_data_source.go
index dd36032f11e..cc9712030e9 100644
--- a/internal/service/appconfig/configuration_profiles_data_source.go
+++ b/internal/service/appconfig/configuration_profiles_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appconfig
 
 import (
diff --git a/internal/service/appconfig/configuration_profiles_data_source_test.go b/internal/service/appconfig/configuration_profiles_data_source_test.go
index 8eac714b577..5cca863720e 100644
--- a/internal/service/appconfig/configuration_profiles_data_source_test.go
+++ b/internal/service/appconfig/configuration_profiles_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appconfig_test
 
 import (
diff --git a/internal/service/appconfig/deployment.go b/internal/service/appconfig/deployment.go
index a3fd825386c..942d58f3f69 100644
--- a/internal/service/appconfig/deployment.go
+++ b/internal/service/appconfig/deployment.go
@@ -1,13 +1,16 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appconfig
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"strconv"
 	"strings"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/aws/aws-sdk-go/service/appconfig"
@@ -39,7 +42,7 @@ func ResourceDeployment() *schema.Resource {
 				Type:         schema.TypeString,
 				Required:     true,
 				ForceNew:     true,
-				ValidateFunc: validation.StringMatch(regexp.MustCompile(`[a-z0-9]{4,7}`), ""),
+				ValidateFunc: validation.StringMatch(regexache.MustCompile(`[0-9a-z]{4,7}`), ""),
 			},
 			"arn": {
 				Type:     schema.TypeString,
@@ -49,7 +52,7 @@ func ResourceDeployment() *schema.Resource {
 				Type:         schema.TypeString,
 				Required:     true,
 				ForceNew:     true,
-				ValidateFunc: validation.StringMatch(regexp.MustCompile(`[a-z0-9]{4,7}`), ""),
+				ValidateFunc: validation.StringMatch(regexache.MustCompile(`[0-9a-z]{4,7}`), ""),
 			},
 			"configuration_version": {
 				Type:         schema.TypeString,
@@ -65,7 +68,7 @@ func ResourceDeployment() *schema.Resource {
 				Type:         schema.TypeString,
 				Required:     true,
 				ForceNew:     true,
-				ValidateFunc: validation.StringMatch(regexp.MustCompile(`(^[a-z0-9]{4,7}$|^AppConfig\.[A-Za-z0-9]{9,40}$)`), ""),
+				ValidateFunc: validation.StringMatch(regexache.MustCompile(`(^[0-9a-z]{4,7}$|^AppConfig\.[0-9A-Za-z]{9,40}$)`), ""),
 			},
 			"description": {
 				Type:         schema.TypeString,
@@ -77,7 +80,7 @@ func ResourceDeployment() *schema.Resource {
 				Type:         schema.TypeString,
 				Required:     true,
 				ForceNew:     true,
-				ValidateFunc: validation.StringMatch(regexp.MustCompile(`[a-z0-9]{4,7}`), ""),
+				ValidateFunc: validation.StringMatch(regexache.MustCompile(`[0-9a-z]{4,7}`), ""),
 			},
 			"state": {
 				Type:     schema.TypeString,
diff --git a/internal/service/appconfig/deployment_strategy.go b/internal/service/appconfig/deployment_strategy.go
index 8a1403b8b98..b481d78c3c9 100644
--- a/internal/service/appconfig/deployment_strategy.go
+++ b/internal/service/appconfig/deployment_strategy.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appconfig
 
 import (
diff --git a/internal/service/appconfig/deployment_strategy_test.go b/internal/service/appconfig/deployment_strategy_test.go
index 89a873b1f47..323b335a240 100644
--- a/internal/service/appconfig/deployment_strategy_test.go
+++ b/internal/service/appconfig/deployment_strategy_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appconfig_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/appconfig"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -32,7 +35,7 @@ func TestAccAppConfigDeploymentStrategy_basic(t *testing.T) {
 				Config: testAccDeploymentStrategyConfig_name(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDeploymentStrategyExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "appconfig", regexp.MustCompile(`deploymentstrategy/[a-z0-9]{4,7}`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "appconfig", regexache.MustCompile(`deploymentstrategy/[0-9a-z]{4,7}`)),
 					resource.TestCheckResourceAttr(resourceName, "deployment_duration_in_minutes", "3"),
 					resource.TestCheckResourceAttr(resourceName, "growth_factor", "10"),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
diff --git a/internal/service/appconfig/deployment_test.go b/internal/service/appconfig/deployment_test.go
index 67effb52e82..45b513a7e35 100644
--- a/internal/service/appconfig/deployment_test.go
+++ b/internal/service/appconfig/deployment_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appconfig_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/appconfig"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -38,7 +41,7 @@ func TestAccAppConfigDeployment_basic(t *testing.T) {
 				Config: testAccDeploymentConfig_name(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDeploymentExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "appconfig", regexp.MustCompile(`application/[a-z0-9]{4,7}/environment/[a-z0-9]{4,7}/deployment/1`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "appconfig", regexache.MustCompile(`application/[0-9a-z]{4,7}/environment/[0-9a-z]{4,7}/deployment/1`)),
 					resource.TestCheckResourceAttrPair(resourceName, "application_id", appResourceName, "id"),
 					resource.TestCheckResourceAttrPair(resourceName, "configuration_profile_id", confProfResourceName, "configuration_profile_id"),
 					resource.TestCheckResourceAttrPair(resourceName, "configuration_version", confVersionResourceName, "version_number"),
diff --git a/internal/service/appconfig/enum.go b/internal/service/appconfig/enum.go
index 7206bdac7a6..2f6f243a3ab 100644
--- a/internal/service/appconfig/enum.go
+++ b/internal/service/appconfig/enum.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appconfig
 
 const (
diff --git a/internal/service/appconfig/environment.go b/internal/service/appconfig/environment.go
index c9abac172ee..258bb7c9072 100644
--- a/internal/service/appconfig/environment.go
+++ b/internal/service/appconfig/environment.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appconfig
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"strings"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/aws/arn"
 	"github.com/aws/aws-sdk-go-v2/service/appconfig"
@@ -26,7 +29,6 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/fwdiag"
-	flex_ "github.com/hashicorp/terraform-provider-aws/internal/flex"
 	"github.com/hashicorp/terraform-provider-aws/internal/framework"
 	"github.com/hashicorp/terraform-provider-aws/internal/framework/flex"
 	fwtypes "github.com/hashicorp/terraform-provider-aws/internal/framework/types"
@@ -61,7 +63,7 @@ func (r *resourceEnvironment) Schema(ctx context.Context, request resource.Schem
 				},
 				Validators: []validator.String{
 					stringvalidator.RegexMatches(
-						regexp.MustCompile(`^[a-z0-9]{4,7}$`),
+						regexache.MustCompile(`^[0-9a-z]{4,7}$`),
 						"value must contain 4-7 lowercase letters or numbers",
 					),
 				},
@@ -342,7 +344,7 @@ func (d *resourceEnvironmentData) refreshFromCreateOutput(ctx context.Context, m
 	d.ID = types.StringValue(fmt.Sprintf("%s:%s", envID, appID))
 	d.Monitors = flattenMonitors(ctx, out.Monitors, &diags)
 	d.Name = flex.StringToFramework(ctx, out.Name)
-	d.State = flex_.StringValueToFramework(ctx, out.State)
+	d.State = flex.StringValueToFramework(ctx, out.State)
 
 	return diags
 }
@@ -364,7 +366,7 @@ func (d *resourceEnvironmentData) refreshFromGetOutput(ctx context.Context, meta
 	d.ID = types.StringValue(fmt.Sprintf("%s:%s", envID, appID))
 	d.Monitors = flattenMonitors(ctx, out.Monitors, &diags)
 	d.Name = flex.StringToFramework(ctx, out.Name)
-	d.State = flex_.StringValueToFramework(ctx, out.State)
+	d.State = flex.StringValueToFramework(ctx, out.State)
 
 	return diags
 }
@@ -386,7 +388,7 @@ func (d *resourceEnvironmentData) refreshFromUpdateOutput(ctx context.Context, m
 	d.ID = types.StringValue(fmt.Sprintf("%s:%s", envID, appID))
 	d.Monitors = flattenMonitors(ctx, out.Monitors, &diags)
 	d.Name = flex.StringToFramework(ctx, out.Name)
-	d.State = flex_.StringValueToFramework(ctx, out.State)
+	d.State = flex.StringValueToFramework(ctx, out.State)
 
 	return diags
 }
@@ -431,7 +433,7 @@ func expandMonitors(l []monitorData) []awstypes.Monitor {
 }
 
 func flattenMonitors(ctx context.Context, apiObjects []awstypes.Monitor, diags *diag.Diagnostics) types.Set {
-	monitorDataTypes := framework.AttributeTypesMust[monitorData](ctx)
+	monitorDataTypes := flex.AttributeTypesMust[monitorData](ctx)
 	elemType := types.ObjectType{AttrTypes: monitorDataTypes}
 
 	if len(apiObjects) == 0 {
@@ -474,7 +476,7 @@ func flattenMonitorData(ctx context.Context, apiObject awstypes.Monitor, diags *
 }
 
 func (m monitorData) value(ctx context.Context, diags *diag.Diagnostics) types.Object {
-	monitorDataTypes := framework.AttributeTypesMust[monitorData](ctx)
+	monitorDataTypes := flex.AttributeTypesMust[monitorData](ctx)
 
 	obj, d := types.ObjectValueFrom(ctx, monitorDataTypes, m)
 	diags.Append(d...)
diff --git a/internal/service/appconfig/environment_data_source.go b/internal/service/appconfig/environment_data_source.go
index a89940e79f8..bc5079eb2fd 100644
--- a/internal/service/appconfig/environment_data_source.go
+++ b/internal/service/appconfig/environment_data_source.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appconfig
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/appconfig"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
@@ -24,12 +27,12 @@ func DataSourceEnvironment() *schema.Resource {
 			"application_id": {
 				Type:         schema.TypeString,
 				Required:     true,
-				ValidateFunc: validation.StringMatch(regexp.MustCompile(`[a-z\d]{4,7}`), ""),
+				ValidateFunc: validation.StringMatch(regexache.MustCompile(`[a-z\d]{4,7}`), ""),
 			},
 			"environment_id": {
 				Type:         schema.TypeString,
 				Required:     true,
-				ValidateFunc: validation.StringMatch(regexp.MustCompile(`[a-z\d]{4,7}`), ""),
+				ValidateFunc: validation.StringMatch(regexache.MustCompile(`[a-z\d]{4,7}`), ""),
 			},
 			"arn": {
 				Type:     schema.TypeString,
diff --git a/internal/service/appconfig/environment_data_source_test.go b/internal/service/appconfig/environment_data_source_test.go
index 6fdbee7d121..0aeaf10b6dd 100644
--- a/internal/service/appconfig/environment_data_source_test.go
+++ b/internal/service/appconfig/environment_data_source_test.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appconfig_test
 
 import (
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/appconfig"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -30,10 +33,10 @@ func TestAccAppConfigEnvironmentDataSource_basic(t *testing.T) {
 			{
 				Config: testAccEnvironmentDataSourceConfig_basic(appName, rName),
 				Check: resource.ComposeTestCheckFunc(
-					acctest.MatchResourceAttrRegionalARN(dataSourceName, "arn", "appconfig", regexp.MustCompile(`application/([a-z\d]{4,7})/environment/+.`)),
+					acctest.MatchResourceAttrRegionalARN(dataSourceName, "arn", "appconfig", regexache.MustCompile(`application/([a-z\d]{4,7})/environment/+.`)),
 					resource.TestCheckResourceAttrPair(dataSourceName, "application_id", appResourceName, "id"),
 					resource.TestCheckResourceAttr(dataSourceName, "description", "Example AppConfig Environment"),
-					resource.TestMatchResourceAttr(dataSourceName, "environment_id", regexp.MustCompile(`[a-z\d]{4,7}`)),
+					resource.TestMatchResourceAttr(dataSourceName, "environment_id", regexache.MustCompile(`[a-z\d]{4,7}`)),
 					resource.TestCheckResourceAttr(dataSourceName, "monitor.#", "1"),
 					resource.TestCheckTypeSetElemAttrPair(dataSourceName, "monitor.*.alarm_arn", "aws_cloudwatch_metric_alarm.test", "arn"),
 					resource.TestCheckTypeSetElemAttrPair(dataSourceName, "monitor.*.alarm_role_arn", "aws_iam_role.test", "arn"),
diff --git a/internal/service/appconfig/environment_test.go b/internal/service/appconfig/environment_test.go
index 338cb42d19b..a5fb55f9347 100644
--- a/internal/service/appconfig/environment_test.go
+++ b/internal/service/appconfig/environment_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appconfig_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/appconfig"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -33,7 +36,7 @@ func TestAccAppConfigEnvironment_basic(t *testing.T) {
 				Config: testAccEnvironmentConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckEnvironmentExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "appconfig", regexp.MustCompile(`application/[a-z0-9]{4,7}/environment/[a-z0-9]{4,7}`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "appconfig", regexache.MustCompile(`application/[0-9a-z]{4,7}/environment/[0-9a-z]{4,7}`)),
 					resource.TestCheckResourceAttrPair(resourceName, "application_id", appResourceName, "id"),
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
 					resource.TestCheckResourceAttr(resourceName, "monitor.#", "0"),
diff --git a/internal/service/appconfig/environments_data_source.go b/internal/service/appconfig/environments_data_source.go
index baa75d79461..39f716ba508 100644
--- a/internal/service/appconfig/environments_data_source.go
+++ b/internal/service/appconfig/environments_data_source.go
@@ -1,9 +1,12 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appconfig
 
 import (
 	"context"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/appconfig"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
@@ -22,7 +25,7 @@ func DataSourceEnvironments() *schema.Resource {
 			"application_id": {
 				Type:         schema.TypeString,
 				Required:     true,
-				ValidateFunc: validation.StringMatch(regexp.MustCompile(`[a-z\d]{4,7}`), ""),
+				ValidateFunc: validation.StringMatch(regexache.MustCompile(`[a-z\d]{4,7}`), ""),
 			},
 			"environment_ids": {
 				Type:     schema.TypeSet,
diff --git a/internal/service/appconfig/environments_data_source_test.go b/internal/service/appconfig/environments_data_source_test.go
index a5c53d288e5..e9c896a0d84 100644
--- a/internal/service/appconfig/environments_data_source_test.go
+++ b/internal/service/appconfig/environments_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appconfig_test
 
 import (
diff --git a/internal/service/appconfig/exports_test.go b/internal/service/appconfig/exports_test.go
index a69436f8b4a..ebddbafc599 100644
--- a/internal/service/appconfig/exports_test.go
+++ b/internal/service/appconfig/exports_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appconfig
 
 // Exports for use in tests only.
diff --git a/internal/service/appconfig/extension.go b/internal/service/appconfig/extension.go
index 80cfd1d6fda..7393c5c1d0e 100644
--- a/internal/service/appconfig/extension.go
+++ b/internal/service/appconfig/extension.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appconfig
 
 import (
diff --git a/internal/service/appconfig/extension_association.go b/internal/service/appconfig/extension_association.go
index be0e56b616f..b2359c6da0b 100644
--- a/internal/service/appconfig/extension_association.go
+++ b/internal/service/appconfig/extension_association.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appconfig
 
 import (
diff --git a/internal/service/appconfig/extension_test.go b/internal/service/appconfig/extension_test.go
index 92317efbbc0..0e88e025882 100644
--- a/internal/service/appconfig/extension_test.go
+++ b/internal/service/appconfig/extension_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appconfig_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/appconfig"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -32,7 +35,7 @@ func TestAccAppConfigExtension_basic(t *testing.T) {
 				Config: testAccExtensionConfig_name(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckExtensionExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "appconfig", regexp.MustCompile(`extension/*`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "appconfig", regexache.MustCompile(`extension/*`)),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "action_point.0.point", "ON_DEPLOYMENT_COMPLETE"),
 					resource.TestCheckResourceAttr(resourceName, "action_point.0.action.0.name", "test"),
diff --git a/internal/service/appconfig/extenstion_association_test.go b/internal/service/appconfig/extenstion_association_test.go
index 73dacce89df..9298a0930e4 100644
--- a/internal/service/appconfig/extenstion_association_test.go
+++ b/internal/service/appconfig/extenstion_association_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appconfig_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/appconfig"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -32,8 +35,8 @@ func TestAccAppConfigExtensionAssociation_basic(t *testing.T) {
 				Config: testAccExtensionAssociationConfig_name(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckExtensionAssociationExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "extension_arn", "appconfig", regexp.MustCompile(`extension/*`)),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "resource_arn", "appconfig", regexp.MustCompile(`application/*`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "extension_arn", "appconfig", regexache.MustCompile(`extension/*`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "resource_arn", "appconfig", regexache.MustCompile(`application/*`)),
 				),
 			},
 			{
diff --git a/internal/service/appconfig/find.go b/internal/service/appconfig/find.go
index e62965b29ea..baf17375f81 100644
--- a/internal/service/appconfig/find.go
+++ b/internal/service/appconfig/find.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appconfig
 
 import (
diff --git a/internal/service/appconfig/generate.go b/internal/service/appconfig/generate.go
index 7d75a7c0065..ced958f80c8 100644
--- a/internal/service/appconfig/generate.go
+++ b/internal/service/appconfig/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTags -ServiceTagsMap -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/appconfig/hosted_configuration_version.go b/internal/service/appconfig/hosted_configuration_version.go
index 9ebff1210e4..a7848c030d2 100644
--- a/internal/service/appconfig/hosted_configuration_version.go
+++ b/internal/service/appconfig/hosted_configuration_version.go
@@ -1,13 +1,16 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appconfig
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"strconv"
 	"strings"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/aws/aws-sdk-go/service/appconfig"
@@ -34,7 +37,7 @@ func ResourceHostedConfigurationVersion() *schema.Resource {
 				Type:         schema.TypeString,
 				Required:     true,
 				ForceNew:     true,
-				ValidateFunc: validation.StringMatch(regexp.MustCompile(`[a-z0-9]{4,7}`), ""),
+				ValidateFunc: validation.StringMatch(regexache.MustCompile(`[0-9a-z]{4,7}`), ""),
 			},
 			"arn": {
 				Type:     schema.TypeString,
@@ -44,7 +47,7 @@ func ResourceHostedConfigurationVersion() *schema.Resource {
 				Type:         schema.TypeString,
 				Required:     true,
 				ForceNew:     true,
-				ValidateFunc: validation.StringMatch(regexp.MustCompile(`[a-z0-9]{4,7}`), ""),
+				ValidateFunc: validation.StringMatch(regexache.MustCompile(`[0-9a-z]{4,7}`), ""),
 			},
 			"content": {
 				Type:      schema.TypeString,
diff --git a/internal/service/appconfig/hosted_configuration_version_test.go b/internal/service/appconfig/hosted_configuration_version_test.go
index 15abe573266..7d50e54b5e8 100644
--- a/internal/service/appconfig/hosted_configuration_version_test.go
+++ b/internal/service/appconfig/hosted_configuration_version_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appconfig_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/appconfig"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -32,7 +35,7 @@ func TestAccAppConfigHostedConfigurationVersion_basic(t *testing.T) {
 				Config: testAccHostedConfigurationVersionConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckHostedConfigurationVersionExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "appconfig", regexp.MustCompile(`application/[a-z0-9]{4,7}/configurationprofile/[a-z0-9]{4,7}/hostedconfigurationversion/[0-9]+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "appconfig", regexache.MustCompile(`application/[0-9a-z]{4,7}/configurationprofile/[0-9a-z]{4,7}/hostedconfigurationversion/[0-9]+`)),
 					resource.TestCheckResourceAttrPair(resourceName, "application_id", "aws_appconfig_application.test", "id"),
 					resource.TestCheckResourceAttrPair(resourceName, "configuration_profile_id", "aws_appconfig_configuration_profile.test", "configuration_profile_id"),
 					resource.TestCheckResourceAttr(resourceName, "content", "{\"foo\":\"bar\"}"),
diff --git a/internal/service/appconfig/service_package.go b/internal/service/appconfig/service_package.go
index bff9a4c8891..528eec7bd42 100644
--- a/internal/service/appconfig/service_package.go
+++ b/internal/service/appconfig/service_package.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appconfig
 
 import (
diff --git a/internal/service/appconfig/service_package_gen.go b/internal/service/appconfig/service_package_gen.go
index c436e4d1fcf..a0a1217a35c 100644
--- a/internal/service/appconfig/service_package_gen.go
+++ b/internal/service/appconfig/service_package_gen.go
@@ -10,6 +10,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	appconfig_sdkv1 "github.com/aws/aws-sdk-go/service/appconfig"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -122,9 +123,11 @@ func (p *servicePackage) NewClient(ctx context.Context, config map[string]any) (
 
 	return appconfig_sdkv2.NewFromConfig(cfg, func(o *appconfig_sdkv2.Options) {
 		if endpoint := config["endpoint"].(string); endpoint != "" {
-			o.EndpointResolver = appconfig_sdkv2.EndpointResolverFromURL(endpoint)
+			o.BaseEndpoint = aws_sdkv2.String(endpoint)
 		}
 	}), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/appconfig/sweep.go b/internal/service/appconfig/sweep.go
index 153527e3a11..b048354047a 100644
--- a/internal/service/appconfig/sweep.go
+++ b/internal/service/appconfig/sweep.go
@@ -1,22 +1,23 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package appconfig
 
 import (
 	"fmt"
 	"log"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/appconfig"
 	"github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep/framework"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_appconfig_application", &resource.Sweeper{
 		Name: "aws_appconfig_application",
 		F:    sweepApplications,
@@ -52,7 +53,7 @@ func init() {
 
 func sweepApplications(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
@@ -91,11 +92,11 @@ func sweepApplications(region string) error {
 		errs = multierror.Append(errs, fmt.Errorf("error listing AppConfig Applications: %w", err))
 	}
 
-	if err = sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err = sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("error sweeping AppConfig Applications for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
+	if awsv1.SkipSweepError(errs.ErrorOrNil()) {
 		log.Printf("[WARN] Skipping AppConfig Applications sweep for %s: %s", region, errs)
 		return nil
 	}
@@ -105,7 +106,7 @@ func sweepApplications(region string) error {
 
 func sweepConfigurationProfiles(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
@@ -168,11 +169,11 @@ func sweepConfigurationProfiles(region string) error {
 		errs = multierror.Append(errs, fmt.Errorf("error listing AppConfig Applications: %w", err))
 	}
 
-	if err = sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err = sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("error sweeping AppConfig Configuration Profiles for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
+	if awsv1.SkipSweepError(errs.ErrorOrNil()) {
 		log.Printf("[WARN] Skipping AppConfig Configuration Profiles sweep for %s: %s", region, errs)
 		return nil
 	}
@@ -182,7 +183,7 @@ func sweepConfigurationProfiles(region string) error {
 
 func sweepDeploymentStrategies(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
@@ -207,7 +208,7 @@ func sweepDeploymentStrategies(region string) error {
 			id := aws.StringValue(item.Id)
 
 			// Deleting AppConfig Predefined Strategies is not supported; returns BadRequestException
-			if regexp.MustCompile(`^AppConfig\.[A-Za-z0-9]{9,40}$`).MatchString(id) {
+			if regexache.MustCompile(`^AppConfig\.[0-9A-Za-z]{9,40}$`).MatchString(id) {
 				log.Printf("[DEBUG] Skipping AppConfig Deployment Strategy (%s): predefined strategy cannot be deleted", id)
 				continue
 			}
@@ -227,11 +228,11 @@ func sweepDeploymentStrategies(region string) error {
 		errs = multierror.Append(errs, fmt.Errorf("error listing AppConfig Deployment Strategies: %w", err))
 	}
 
-	if err = sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err = sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("error sweeping AppConfig Deployment Strategies for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
+	if awsv1.SkipSweepError(errs.ErrorOrNil()) {
 		log.Printf("[WARN] Skipping AppConfig Deployment Strategies sweep for %s: %s", region, errs)
 		return nil
 	}
@@ -241,7 +242,7 @@ func sweepDeploymentStrategies(region string) error {
 
 func sweepEnvironments(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
@@ -300,11 +301,11 @@ func sweepEnvironments(region string) error {
 		errs = multierror.Append(errs, fmt.Errorf("error listing AppConfig Applications: %w", err))
 	}
 
-	if err = sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err = sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("error sweeping AppConfig Environments for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
+	if awsv1.SkipSweepError(errs.ErrorOrNil()) {
 		log.Printf("[WARN] Skipping AppConfig Environments sweep for %s: %s", region, errs)
 		return nil
 	}
@@ -314,7 +315,7 @@ func sweepEnvironments(region string) error {
 
 func sweepHostedConfigurationVersions(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
@@ -402,11 +403,11 @@ func sweepHostedConfigurationVersions(region string) error {
 		errs = multierror.Append(errs, fmt.Errorf("error listing AppConfig Applications: %w", err))
 	}
 
-	if err = sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err = sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("error sweeping AppConfig Hosted Configuration Versions for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
+	if awsv1.SkipSweepError(errs.ErrorOrNil()) {
 		log.Printf("[WARN] Skipping AppConfig Hosted Configuration Versions sweep for %s: %s", region, errs)
 		return nil
 	}
diff --git a/internal/service/appconfig/tags_gen.go b/internal/service/appconfig/tags_gen.go
index 0392792ac79..a8c9cbea4e5 100644
--- a/internal/service/appconfig/tags_gen.go
+++ b/internal/service/appconfig/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/appconfig"
 	"github.com/aws/aws-sdk-go/service/appconfig/appconfigiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -54,7 +56,7 @@ func Tags(tags tftags.KeyValueTags) map[string]*string {
 	return aws.StringMap(tags.Map())
 }
 
-// KeyValueTags creates KeyValueTags from appconfig service tags.
+// KeyValueTags creates tftags.KeyValueTags from appconfig service tags.
 func KeyValueTags(ctx context.Context, tags map[string]*string) tftags.KeyValueTags {
 	return tftags.New(ctx, tags)
 }
@@ -85,6 +87,8 @@ func updateTags(ctx context.Context, conn appconfigiface.AppConfigAPI, identifie
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.AppConfig)
 	if len(removedTags) > 0 {
diff --git a/internal/service/appflow/connector_profile.go b/internal/service/appflow/connector_profile.go
index 80f09487436..ad497a7237b 100644
--- a/internal/service/appflow/connector_profile.go
+++ b/internal/service/appflow/connector_profile.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appflow
 
 import (
 	"context"
 	"log"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/appflow"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
@@ -23,9 +26,11 @@ func ResourceConnectorProfile() *schema.Resource {
 		ReadWithoutTimeout:   resourceConnectorProfileRead,
 		UpdateWithoutTimeout: resourceConnectorProfileUpdate,
 		DeleteWithoutTimeout: resourceConnectorProfileDelete,
+
 		Importer: &schema.ResourceImporter{
 			StateContext: schema.ImportStatePassthroughContext,
 		},
+
 		Schema: map[string]*schema.Schema{
 			"arn": {
 				Type:     schema.TypeString,
@@ -37,7 +42,7 @@ func ResourceConnectorProfile() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 256),
-					validation.StringMatch(regexp.MustCompile(`[\w/!@#+=.-]+`), "must match [\\w/!@#+=.-]+"),
+					validation.StringMatch(regexache.MustCompile(`[\w/!@#+=.-]+`), "must match [\\w/!@#+=.-]+"),
 				),
 			},
 			"connection_mode": {
@@ -50,7 +55,7 @@ func ResourceConnectorProfile() *schema.Resource {
 				Optional: true,
 				ForceNew: true,
 				ValidateFunc: validation.All(
-					validation.StringMatch(regexp.MustCompile(`[a-zA-Z0-9][\w!@#.-]+`), "must contain only alphanumeric, exclamation point (!), at sign (@), number sign (#), period (.), and hyphen (-) characters"),
+					validation.StringMatch(regexache.MustCompile(`[0-9A-Za-z][\w!@#.-]+`), "must contain only alphanumeric, exclamation point (!), at sign (@), number sign (#), period (.), and hyphen (-) characters"),
 					validation.StringLenBetween(1, 256),
 				),
 			},
@@ -77,7 +82,7 @@ func ResourceConnectorProfile() *schema.Resource {
 													Required: true,
 													ValidateFunc: validation.All(
 														validation.StringLenBetween(1, 256),
-														validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"),
+														validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"),
 													),
 												},
 												"secret_key": {
@@ -86,7 +91,7 @@ func ResourceConnectorProfile() *schema.Resource {
 													Sensitive: true,
 													ValidateFunc: validation.All(
 														validation.StringLenBetween(1, 256),
-														validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"),
+														validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"),
 													),
 												},
 											},
@@ -109,7 +114,7 @@ func ResourceConnectorProfile() *schema.Resource {
 																Required: true,
 																ValidateFunc: validation.All(
 																	validation.StringLenBetween(1, 256),
-																	validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"),
+																	validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"),
 																),
 															},
 															"api_secret_key": {
@@ -117,7 +122,7 @@ func ResourceConnectorProfile() *schema.Resource {
 																Optional: true,
 																ValidateFunc: validation.All(
 																	validation.StringLenBetween(1, 256),
-																	validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"),
+																	validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"),
 																),
 															},
 														},
@@ -158,22 +163,22 @@ func ResourceConnectorProfile() *schema.Resource {
 																Type:      schema.TypeMap,
 																Optional:  true,
 																Sensitive: true,
-																ValidateDiagFunc: verify.ValidAllDiag(
+																ValidateDiagFunc: validation.AllDiag(
 																	validation.MapKeyLenBetween(1, 128),
-																	validation.MapKeyMatch(regexp.MustCompile(`[\w]+`), "must contain only alphanumeric and underscore (_) characters"),
+																	validation.MapKeyMatch(regexache.MustCompile(`[\w]+`), "must contain only alphanumeric and underscore (_) characters"),
 																),
 																Elem: &schema.Schema{
 																	Type: schema.TypeString,
 																	ValidateFunc: validation.All(
 																		validation.StringLenBetween(0, 2048),
-																		validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"),
+																		validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"),
 																	),
 																},
 															},
 															"custom_authentication_type": {
 																Type:         schema.TypeString,
 																Required:     true,
-																ValidateFunc: validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"),
+																ValidateFunc: validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"),
 															},
 														},
 													},
@@ -189,8 +194,8 @@ func ResourceConnectorProfile() *schema.Resource {
 																Optional:  true,
 																Sensitive: true,
 																ValidateFunc: validation.All(
-																	validation.StringLenBetween(1, 2048),
-																	validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"),
+																	validation.StringLenBetween(1, 4096),
+																	validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"),
 																),
 															},
 															"client_id": {
@@ -198,7 +203,7 @@ func ResourceConnectorProfile() *schema.Resource {
 																Optional: true,
 																ValidateFunc: validation.All(
 																	validation.StringLenBetween(1, 512),
-																	validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"),
+																	validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"),
 																),
 															},
 															"client_secret": {
@@ -207,7 +212,7 @@ func ResourceConnectorProfile() *schema.Resource {
 																Sensitive: true,
 																ValidateFunc: validation.All(
 																	validation.StringLenBetween(1, 512),
-																	validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"),
+																	validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"),
 																),
 															},
 															"oauth_request": {
@@ -220,8 +225,8 @@ func ResourceConnectorProfile() *schema.Resource {
 																			Type:     schema.TypeString,
 																			Optional: true,
 																			ValidateFunc: validation.All(
-																				validation.StringLenBetween(1, 2048),
-																				validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"),
+																				validation.StringLenBetween(1, 4096),
+																				validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"),
 																			),
 																		},
 																		"redirect_uri": {
@@ -229,7 +234,7 @@ func ResourceConnectorProfile() *schema.Resource {
 																			Optional: true,
 																			ValidateFunc: validation.All(
 																				validation.StringLenBetween(1, 512),
-																				validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"),
+																				validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"),
 																			),
 																		},
 																	},
@@ -239,8 +244,8 @@ func ResourceConnectorProfile() *schema.Resource {
 																Type:     schema.TypeString,
 																Optional: true,
 																ValidateFunc: validation.All(
-																	validation.StringLenBetween(1, 1024),
-																	validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"),
+																	validation.StringLenBetween(1, 4096),
+																	validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"),
 																),
 															},
 														},
@@ -260,7 +265,7 @@ func ResourceConnectorProfile() *schema.Resource {
 													Required: true,
 													ValidateFunc: validation.All(
 														validation.StringLenBetween(1, 256),
-														validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"),
+														validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"),
 													),
 												},
 												"application_key": {
@@ -268,7 +273,7 @@ func ResourceConnectorProfile() *schema.Resource {
 													Required: true,
 													ValidateFunc: validation.All(
 														validation.StringLenBetween(1, 512),
-														validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"),
+														validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"),
 													),
 												},
 											},
@@ -285,7 +290,7 @@ func ResourceConnectorProfile() *schema.Resource {
 													Required: true,
 													ValidateFunc: validation.All(
 														validation.StringLenBetween(1, 256),
-														validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"),
+														validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"),
 													),
 												},
 											},
@@ -303,7 +308,7 @@ func ResourceConnectorProfile() *schema.Resource {
 													Sensitive: true,
 													ValidateFunc: validation.All(
 														validation.StringLenBetween(1, 2048),
-														validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"),
+														validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"),
 													),
 												},
 												"client_id": {
@@ -311,7 +316,7 @@ func ResourceConnectorProfile() *schema.Resource {
 													Required: true,
 													ValidateFunc: validation.All(
 														validation.StringLenBetween(1, 512),
-														validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"),
+														validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"),
 													),
 												},
 												"client_secret": {
@@ -320,7 +325,7 @@ func ResourceConnectorProfile() *schema.Resource {
 													Sensitive: true,
 													ValidateFunc: validation.All(
 														validation.StringLenBetween(1, 512),
-														validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"),
+														validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"),
 													),
 												},
 												"oauth_request": {
@@ -334,7 +339,7 @@ func ResourceConnectorProfile() *schema.Resource {
 																Optional: true,
 																ValidateFunc: validation.All(
 																	validation.StringLenBetween(1, 2048),
-																	validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"),
+																	validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"),
 																),
 															},
 															"redirect_uri": {
@@ -342,7 +347,7 @@ func ResourceConnectorProfile() *schema.Resource {
 																Optional: true,
 																ValidateFunc: validation.All(
 																	validation.StringLenBetween(1, 512),
-																	validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"),
+																	validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"),
 																),
 															},
 														},
@@ -353,7 +358,7 @@ func ResourceConnectorProfile() *schema.Resource {
 													Optional: true,
 													ValidateFunc: validation.All(
 														validation.StringLenBetween(1, 1024),
-														validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"),
+														validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"),
 													),
 												},
 											},
@@ -371,7 +376,7 @@ func ResourceConnectorProfile() *schema.Resource {
 													Sensitive: true,
 													ValidateFunc: validation.All(
 														validation.StringLenBetween(1, 2048),
-														validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"),
+														validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"),
 													),
 												},
 												"oauth_request": {
@@ -385,7 +390,7 @@ func ResourceConnectorProfile() *schema.Resource {
 																Optional: true,
 																ValidateFunc: validation.All(
 																	validation.StringLenBetween(1, 2048),
-																	validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"),
+																	validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"),
 																),
 															},
 															"redirect_uri": {
@@ -393,7 +398,7 @@ func ResourceConnectorProfile() *schema.Resource {
 																Optional: true,
 																ValidateFunc: validation.All(
 																	validation.StringLenBetween(1, 512),
-																	validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"),
+																	validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"),
 																),
 															},
 														},
@@ -404,7 +409,7 @@ func ResourceConnectorProfile() *schema.Resource {
 													Optional: true,
 													ValidateFunc: validation.All(
 														validation.StringLenBetween(1, 1024),
-														validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"),
+														validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"),
 													),
 												},
 											},
@@ -421,7 +426,7 @@ func ResourceConnectorProfile() *schema.Resource {
 													Required: true,
 													ValidateFunc: validation.All(
 														validation.StringLenBetween(1, 256),
-														validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"),
+														validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"),
 													),
 												},
 												"datakey": {
@@ -429,7 +434,7 @@ func ResourceConnectorProfile() *schema.Resource {
 													Required: true,
 													ValidateFunc: validation.All(
 														validation.StringLenBetween(1, 512),
-														validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"),
+														validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"),
 													),
 												},
 												"secret_access_key": {
@@ -438,7 +443,7 @@ func ResourceConnectorProfile() *schema.Resource {
 													Sensitive: true,
 													ValidateFunc: validation.All(
 														validation.StringLenBetween(1, 512),
-														validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"),
+														validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"),
 													),
 												},
 												"user_id": {
@@ -446,7 +451,7 @@ func ResourceConnectorProfile() *schema.Resource {
 													Required: true,
 													ValidateFunc: validation.All(
 														validation.StringLenBetween(1, 512),
-														validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"),
+														validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"),
 													),
 												},
 											},
@@ -464,7 +469,7 @@ func ResourceConnectorProfile() *schema.Resource {
 													Sensitive: true,
 													ValidateFunc: validation.All(
 														validation.StringLenBetween(1, 2048),
-														validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"),
+														validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"),
 													),
 												},
 												"client_id": {
@@ -472,7 +477,7 @@ func ResourceConnectorProfile() *schema.Resource {
 													Required: true,
 													ValidateFunc: validation.All(
 														validation.StringLenBetween(1, 512),
-														validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"),
+														validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"),
 													),
 												},
 												"client_secret": {
@@ -481,7 +486,7 @@ func ResourceConnectorProfile() *schema.Resource {
 													Sensitive: true,
 													ValidateFunc: validation.All(
 														validation.StringLenBetween(1, 512),
-														validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"),
+														validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"),
 													),
 												},
 												"oauth_request": {
@@ -495,7 +500,7 @@ func ResourceConnectorProfile() *schema.Resource {
 																Optional: true,
 																ValidateFunc: validation.All(
 																	validation.StringLenBetween(1, 512),
-																	validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"),
+																	validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"),
 																),
 															},
 															"redirect_uri": {
@@ -503,7 +508,7 @@ func ResourceConnectorProfile() *schema.Resource {
 																Optional: true,
 																ValidateFunc: validation.All(
 																	validation.StringLenBetween(1, 512),
-																	validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"),
+																	validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"),
 																),
 															},
 														},
@@ -529,7 +534,7 @@ func ResourceConnectorProfile() *schema.Resource {
 													Required: true,
 													ValidateFunc: validation.All(
 														validation.StringLenBetween(1, 512),
-														validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"),
+														validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"),
 													),
 												},
 											},
@@ -547,7 +552,7 @@ func ResourceConnectorProfile() *schema.Resource {
 													Sensitive: true,
 													ValidateFunc: validation.All(
 														validation.StringLenBetween(1, 2048),
-														validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"),
+														validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"),
 													),
 												},
 												"client_credentials_arn": {
@@ -566,7 +571,7 @@ func ResourceConnectorProfile() *schema.Resource {
 																Optional: true,
 																ValidateFunc: validation.All(
 																	validation.StringLenBetween(1, 2048),
-																	validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"),
+																	validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"),
 																),
 															},
 															"redirect_uri": {
@@ -574,7 +579,7 @@ func ResourceConnectorProfile() *schema.Resource {
 																Optional: true,
 																ValidateFunc: validation.All(
 																	validation.StringLenBetween(1, 512),
-																	validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"),
+																	validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"),
 																),
 															},
 														},
@@ -585,7 +590,7 @@ func ResourceConnectorProfile() *schema.Resource {
 													Optional: true,
 													ValidateFunc: validation.All(
 														validation.StringLenBetween(1, 1024),
-														validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"),
+														validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"),
 													),
 												},
 											},
@@ -614,7 +619,7 @@ func ResourceConnectorProfile() *schema.Resource {
 																Required: true,
 																ValidateFunc: validation.All(
 																	validation.StringLenBetween(1, 512),
-																	validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"),
+																	validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"),
 																),
 															},
 														},
@@ -632,7 +637,7 @@ func ResourceConnectorProfile() *schema.Resource {
 																Sensitive: true,
 																ValidateFunc: validation.All(
 																	validation.StringLenBetween(1, 2048),
-																	validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"),
+																	validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"),
 																),
 															},
 															"client_id": {
@@ -640,7 +645,7 @@ func ResourceConnectorProfile() *schema.Resource {
 																Required: true,
 																ValidateFunc: validation.All(
 																	validation.StringLenBetween(1, 512),
-																	validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"),
+																	validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"),
 																),
 															},
 															"client_secret": {
@@ -648,7 +653,7 @@ func ResourceConnectorProfile() *schema.Resource {
 																Required: true,
 																ValidateFunc: validation.All(
 																	validation.StringLenBetween(1, 512),
-																	validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"),
+																	validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"),
 																),
 															},
 															"oauth_request": {
@@ -662,7 +667,7 @@ func ResourceConnectorProfile() *schema.Resource {
 																			Optional: true,
 																			ValidateFunc: validation.All(
 																				validation.StringLenBetween(1, 2048),
-																				validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"),
+																				validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"),
 																			),
 																		},
 																		"redirect_uri": {
@@ -670,7 +675,7 @@ func ResourceConnectorProfile() *schema.Resource {
 																			Optional: true,
 																			ValidateFunc: validation.All(
 																				validation.StringLenBetween(1, 512),
-																				validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"),
+																				validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"),
 																			),
 																		},
 																	},
@@ -681,7 +686,7 @@ func ResourceConnectorProfile() *schema.Resource {
 																Optional: true,
 																ValidateFunc: validation.All(
 																	validation.StringLenBetween(1, 1024),
-																	validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"),
+																	validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"),
 																),
 															},
 														},
@@ -707,7 +712,7 @@ func ResourceConnectorProfile() *schema.Resource {
 													Required: true,
 													ValidateFunc: validation.All(
 														validation.StringLenBetween(1, 512),
-														validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"),
+														validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"),
 													),
 												},
 											},
@@ -724,7 +729,7 @@ func ResourceConnectorProfile() *schema.Resource {
 													Required: true,
 													ValidateFunc: validation.All(
 														validation.StringLenBetween(1, 256),
-														validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"),
+														validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"),
 													),
 												},
 											},
@@ -742,7 +747,7 @@ func ResourceConnectorProfile() *schema.Resource {
 													Sensitive: true,
 													ValidateFunc: validation.All(
 														validation.StringLenBetween(1, 2048),
-														validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"),
+														validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"),
 													),
 												},
 												"client_id": {
@@ -750,7 +755,7 @@ func ResourceConnectorProfile() *schema.Resource {
 													Required: true,
 													ValidateFunc: validation.All(
 														validation.StringLenBetween(1, 512),
-														validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"),
+														validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"),
 													),
 												},
 												"client_secret": {
@@ -759,7 +764,7 @@ func ResourceConnectorProfile() *schema.Resource {
 													Sensitive: true,
 													ValidateFunc: validation.All(
 														validation.StringLenBetween(1, 512),
-														validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"),
+														validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"),
 													),
 												},
 												"oauth_request": {
@@ -773,7 +778,7 @@ func ResourceConnectorProfile() *schema.Resource {
 																Optional: true,
 																ValidateFunc: validation.All(
 																	validation.StringLenBetween(1, 2048),
-																	validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"),
+																	validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"),
 																),
 															},
 															"redirect_uri": {
@@ -781,7 +786,7 @@ func ResourceConnectorProfile() *schema.Resource {
 																Optional: true,
 																ValidateFunc: validation.All(
 																	validation.StringLenBetween(1, 512),
-																	validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"),
+																	validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"),
 																),
 															},
 														},
@@ -807,7 +812,7 @@ func ResourceConnectorProfile() *schema.Resource {
 													Required: true,
 													ValidateFunc: validation.All(
 														validation.StringLenBetween(1, 512),
-														validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"),
+														validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"),
 													),
 												},
 											},
@@ -825,7 +830,7 @@ func ResourceConnectorProfile() *schema.Resource {
 													Sensitive: true,
 													ValidateFunc: validation.All(
 														validation.StringLenBetween(1, 256),
-														validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"),
+														validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"),
 													),
 												},
 											},
@@ -848,7 +853,7 @@ func ResourceConnectorProfile() *schema.Resource {
 													Required: true,
 													ValidateFunc: validation.All(
 														validation.StringLenBetween(1, 512),
-														validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"),
+														validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"),
 													),
 												},
 											},
@@ -866,7 +871,7 @@ func ResourceConnectorProfile() *schema.Resource {
 													Sensitive: true,
 													ValidateFunc: validation.All(
 														validation.StringLenBetween(1, 2048),
-														validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"),
+														validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"),
 													),
 												},
 												"client_id": {
@@ -874,7 +879,7 @@ func ResourceConnectorProfile() *schema.Resource {
 													Required: true,
 													ValidateFunc: validation.All(
 														validation.StringLenBetween(1, 512),
-														validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"),
+														validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"),
 													),
 												},
 												"client_secret": {
@@ -883,7 +888,7 @@ func ResourceConnectorProfile() *schema.Resource {
 													Sensitive: true,
 													ValidateFunc: validation.All(
 														validation.StringLenBetween(1, 512),
-														validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"),
+														validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"),
 													),
 												},
 												"oauth_request": {
@@ -897,7 +902,7 @@ func ResourceConnectorProfile() *schema.Resource {
 																Optional: true,
 																ValidateFunc: validation.All(
 																	validation.StringLenBetween(1, 2048),
-																	validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"),
+																	validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"),
 																),
 															},
 															"redirect_uri": {
@@ -905,7 +910,7 @@ func ResourceConnectorProfile() *schema.Resource {
 																Optional: true,
 																ValidateFunc: validation.All(
 																	validation.StringLenBetween(1, 512),
-																	validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"),
+																	validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"),
 																),
 															},
 														},
@@ -953,21 +958,21 @@ func ResourceConnectorProfile() *schema.Resource {
 																Required: true,
 																ValidateFunc: validation.All(
 																	validation.StringLenBetween(1, 256),
-																	validation.StringMatch(regexp.MustCompile(`^(https?)://[-a-zA-Z0-9+&@#/%?=~_|!:,.;]*[-a-zA-Z0-9+&@#/%=~_|]`), "must provide a valid HTTPS url"),
+																	validation.StringMatch(regexache.MustCompile(`^(https?)://[0-9A-Za-z-+&@#/%?=~_|!:,.;]*[0-9A-Za-z-+&@#/%=~_|]`), "must provide a valid HTTPS url"),
 																),
 															},
 															"token_url_custom_properties": {
 																Type:     schema.TypeMap,
 																Optional: true,
-																ValidateDiagFunc: verify.ValidAllDiag(
+																ValidateDiagFunc: validation.AllDiag(
 																	validation.MapKeyLenBetween(1, 128),
-																	validation.MapKeyMatch(regexp.MustCompile(`[\w]+`), "must contain only alphanumeric and underscore (_) characters"),
+																	validation.MapKeyMatch(regexache.MustCompile(`[\w]+`), "must contain only alphanumeric and underscore (_) characters"),
 																),
 																Elem: &schema.Schema{
 																	Type: schema.TypeString,
 																	ValidateFunc: validation.All(
 																		validation.StringLenBetween(0, 2048),
-																		validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"),
+																		validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"),
 																	),
 																},
 															},
@@ -977,15 +982,15 @@ func ResourceConnectorProfile() *schema.Resource {
 												"profile_properties": {
 													Type:     schema.TypeMap,
 													Optional: true,
-													ValidateDiagFunc: verify.ValidAllDiag(
+													ValidateDiagFunc: validation.AllDiag(
 														validation.MapKeyLenBetween(1, 128),
-														validation.MapKeyMatch(regexp.MustCompile(`[\w]+`), "must contain only alphanumeric and underscore (_) characters"),
+														validation.MapKeyMatch(regexache.MustCompile(`[\w]+`), "must contain only alphanumeric and underscore (_) characters"),
 													),
 													Elem: &schema.Schema{
 														Type: schema.TypeString,
 														ValidateFunc: validation.All(
 															validation.StringLenBetween(0, 2048),
-															validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"),
+															validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"),
 														),
 													},
 												},
@@ -1003,7 +1008,7 @@ func ResourceConnectorProfile() *schema.Resource {
 													Required: true,
 													ValidateFunc: validation.All(
 														validation.StringLenBetween(1, 256),
-														validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"),
+														validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"),
 													),
 												},
 											},
@@ -1020,7 +1025,7 @@ func ResourceConnectorProfile() *schema.Resource {
 													Required: true,
 													ValidateFunc: validation.All(
 														validation.StringLenBetween(1, 256),
-														validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"),
+														validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"),
 													),
 												},
 											},
@@ -1053,7 +1058,7 @@ func ResourceConnectorProfile() *schema.Resource {
 													Required: true,
 													ValidateFunc: validation.All(
 														validation.StringLenBetween(1, 256),
-														validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"),
+														validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"),
 													),
 												},
 											},
@@ -1070,7 +1075,7 @@ func ResourceConnectorProfile() *schema.Resource {
 													Required: true,
 													ValidateFunc: validation.All(
 														validation.StringLenBetween(1, 256),
-														validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"),
+														validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"),
 													),
 												},
 											},
@@ -1087,7 +1092,7 @@ func ResourceConnectorProfile() *schema.Resource {
 													Required: true,
 													ValidateFunc: validation.All(
 														validation.StringLenBetween(3, 63),
-														validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"),
+														validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"),
 													),
 												},
 												"bucket_prefix": {
@@ -1132,7 +1137,7 @@ func ResourceConnectorProfile() *schema.Resource {
 													Optional: true,
 													ValidateFunc: validation.All(
 														validation.StringLenBetween(1, 256),
-														validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"),
+														validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"),
 													),
 												},
 												"is_sandbox_environment": {
@@ -1153,7 +1158,7 @@ func ResourceConnectorProfile() *schema.Resource {
 													Required: true,
 													ValidateFunc: validation.All(
 														validation.StringLenBetween(1, 256),
-														validation.StringMatch(regexp.MustCompile(`^(https?)://[-a-zA-Z0-9+&@#/%?=~_|!:,.;]*[-a-zA-Z0-9+&@#/%=~_|]`), "must provide a valid HTTPS url"),
+														validation.StringMatch(regexache.MustCompile(`^(https?)://[0-9A-Za-z-+&@#/%?=~_|!:,.;]*[0-9A-Za-z-+&@#/%=~_|]`), "must provide a valid HTTPS url"),
 													),
 												},
 												"application_service_path": {
@@ -1161,7 +1166,7 @@ func ResourceConnectorProfile() *schema.Resource {
 													Required: true,
 													ValidateFunc: validation.All(
 														validation.StringLenBetween(1, 512),
-														validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"),
+														validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"),
 													),
 												},
 												"client_number": {
@@ -1169,7 +1174,7 @@ func ResourceConnectorProfile() *schema.Resource {
 													Required: true,
 													ValidateFunc: validation.All(
 														validation.StringLenBetween(3, 3),
-														validation.StringMatch(regexp.MustCompile(`^\d{3}$`), "must consist of exactly three digits"),
+														validation.StringMatch(regexache.MustCompile(`^\d{3}$`), "must consist of exactly three digits"),
 													),
 												},
 												"logon_language": {
@@ -1177,7 +1182,7 @@ func ResourceConnectorProfile() *schema.Resource {
 													Optional: true,
 													ValidateFunc: validation.All(
 														validation.StringLenBetween(0, 2),
-														validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9_]*$`), "must contain only alphanumeric characters and the underscore (_) character"),
+														validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_]*$`), "must contain only alphanumeric characters and the underscore (_) character"),
 													),
 												},
 												"oauth_properties": {
@@ -1191,7 +1196,7 @@ func ResourceConnectorProfile() *schema.Resource {
 																Required: true,
 																ValidateFunc: validation.All(
 																	validation.StringLenBetween(1, 256),
-																	validation.StringMatch(regexp.MustCompile(`^(https?)://[-a-zA-Z0-9+&@#/%?=~_|!:,.;]*[-a-zA-Z0-9+&@#/%=~_|]`), "must provide a valid HTTPS url"),
+																	validation.StringMatch(regexache.MustCompile(`^(https?)://[0-9A-Za-z-+&@#/%?=~_|!:,.;]*[0-9A-Za-z-+&@#/%=~_|]`), "must provide a valid HTTPS url"),
 																),
 															},
 															"oauth_scopes": {
@@ -1201,7 +1206,7 @@ func ResourceConnectorProfile() *schema.Resource {
 																	Type: schema.TypeString,
 																	ValidateFunc: validation.All(
 																		validation.StringLenBetween(1, 128),
-																		validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"),
+																		validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"),
 																	),
 																},
 															},
@@ -1210,7 +1215,7 @@ func ResourceConnectorProfile() *schema.Resource {
 																Required: true,
 																ValidateFunc: validation.All(
 																	validation.StringLenBetween(1, 256),
-																	validation.StringMatch(regexp.MustCompile(`^(https?)://[-a-zA-Z0-9+&@#/%?=~_|!:,.;]*[-a-zA-Z0-9+&@#/%=~_|]`), "must provide a valid HTTPS url"),
+																	validation.StringMatch(regexache.MustCompile(`^(https?)://[0-9A-Za-z-+&@#/%?=~_|!:,.;]*[0-9A-Za-z-+&@#/%=~_|]`), "must provide a valid HTTPS url"),
 																),
 															},
 														},
@@ -1226,7 +1231,7 @@ func ResourceConnectorProfile() *schema.Resource {
 													Optional: true,
 													ValidateFunc: validation.All(
 														validation.StringLenBetween(1, 512),
-														validation.StringMatch(regexp.MustCompile(`^$|com.amazonaws.vpce.[\w/!:@#.\-]+`), "must be a valid AWS VPC endpoint address"),
+														validation.StringMatch(regexache.MustCompile(`^$|com.amazonaws.vpce.[\w/!:@#.\-]+`), "must be a valid AWS VPC endpoint address"),
 													),
 												},
 											},
@@ -1243,7 +1248,7 @@ func ResourceConnectorProfile() *schema.Resource {
 													Required: true,
 													ValidateFunc: validation.All(
 														validation.StringLenBetween(1, 256),
-														validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"),
+														validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"),
 													),
 												},
 											},
@@ -1268,7 +1273,7 @@ func ResourceConnectorProfile() *schema.Resource {
 													Required: true,
 													ValidateFunc: validation.All(
 														validation.StringLenBetween(1, 256),
-														validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"),
+														validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"),
 													),
 												},
 											},
@@ -1285,7 +1290,7 @@ func ResourceConnectorProfile() *schema.Resource {
 													Optional: true,
 													ValidateFunc: validation.All(
 														validation.StringLenBetween(1, 512),
-														validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"),
+														validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"),
 													),
 												},
 												"bucket_name": {
@@ -1293,7 +1298,7 @@ func ResourceConnectorProfile() *schema.Resource {
 													Required: true,
 													ValidateFunc: validation.All(
 														validation.StringLenBetween(3, 63),
-														validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"),
+														validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"),
 													),
 												},
 												"bucket_prefix": {
@@ -1306,7 +1311,7 @@ func ResourceConnectorProfile() *schema.Resource {
 													Optional: true,
 													ValidateFunc: validation.All(
 														validation.StringLenBetween(1, 512),
-														validation.StringMatch(regexp.MustCompile(`^$|com.amazonaws.vpce.[\w/!:@#.\-]+`), "must be a valid AWS VPC endpoint address"),
+														validation.StringMatch(regexache.MustCompile(`^$|com.amazonaws.vpce.[\w/!:@#.\-]+`), "must be a valid AWS VPC endpoint address"),
 													),
 												},
 												"region": {
@@ -1314,7 +1319,7 @@ func ResourceConnectorProfile() *schema.Resource {
 													Optional: true,
 													ValidateFunc: validation.All(
 														validation.StringLenBetween(1, 64),
-														validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"),
+														validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"),
 													),
 												},
 												"stage": {
@@ -1325,7 +1330,7 @@ func ResourceConnectorProfile() *schema.Resource {
 													},
 													ValidateFunc: validation.All(
 														validation.StringLenBetween(1, 512),
-														validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"),
+														validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"),
 													),
 												},
 												"warehouse": {
@@ -1333,7 +1338,7 @@ func ResourceConnectorProfile() *schema.Resource {
 													Required: true,
 													ValidateFunc: validation.All(
 														validation.StringLenBetween(0, 512),
-														validation.StringMatch(regexp.MustCompile(`[\s\w/!@#+=.-]*`), "must match [\\s\\w/!@#+=.-]*"),
+														validation.StringMatch(regexache.MustCompile(`[\s\w/!@#+=.-]*`), "must match [\\s\\w/!@#+=.-]*"),
 													),
 												},
 											},
@@ -1358,7 +1363,7 @@ func ResourceConnectorProfile() *schema.Resource {
 													Required: true,
 													ValidateFunc: validation.All(
 														validation.StringLenBetween(1, 256),
-														validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"),
+														validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"),
 													),
 												},
 											},
@@ -1375,7 +1380,7 @@ func ResourceConnectorProfile() *schema.Resource {
 													Required: true,
 													ValidateFunc: validation.All(
 														validation.StringLenBetween(1, 256),
-														validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"),
+														validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"),
 													),
 												},
 											},
@@ -1410,34 +1415,33 @@ func ResourceConnectorProfile() *schema.Resource {
 
 func resourceConnectorProfileCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	conn := meta.(*conns.AWSClient).AppFlowConn(ctx)
-	name := d.Get("name").(string)
 
-	createConnectorProfileInput := appflow.CreateConnectorProfileInput{
-		ConnectionMode:         aws.String(d.Get("connection_mode").(string)),
-		ConnectorProfileConfig: expandConnectorProfileConfig(d.Get("connector_profile_config").([]interface{})[0].(map[string]interface{})),
-		ConnectorProfileName:   aws.String(name),
-		ConnectorType:          aws.String(d.Get("connector_type").(string)),
+	name := d.Get("name").(string)
+	input := &appflow.CreateConnectorProfileInput{
+		ConnectionMode:       aws.String(d.Get("connection_mode").(string)),
+		ConnectorProfileName: aws.String(name),
+		ConnectorType:        aws.String(d.Get("connector_type").(string)),
 	}
 
 	if v, ok := d.Get("connector_label").(string); ok && len(v) > 0 {
-		createConnectorProfileInput.ConnectorLabel = aws.String(v)
+		input.ConnectorLabel = aws.String(v)
+	}
+
+	if v, ok := d.GetOk("connector_profile_config"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
+		input.ConnectorProfileConfig = expandConnectorProfileConfig(v.([]interface{})[0].(map[string]interface{}))
 	}
 
 	if v, ok := d.Get("kms_arn").(string); ok && len(v) > 0 {
-		createConnectorProfileInput.KmsArn = aws.String(v)
+		input.KmsArn = aws.String(v)
 	}
 
-	out, err := conn.CreateConnectorProfileWithContext(ctx, &createConnectorProfileInput)
+	output, err := conn.CreateConnectorProfileWithContext(ctx, input)
 
 	if err != nil {
-		return diag.Errorf("creating AppFlow Connector Profile: %s", err)
-	}
-
-	if out == nil || out.ConnectorProfileArn == nil {
-		return diag.Errorf("creating Appflow Connector Profile (%s): empty output", d.Get("name").(string))
+		return diag.Errorf("creating AppFlow Connector Profile (%s): %s", name, err)
 	}
 
-	d.SetId(aws.StringValue(out.ConnectorProfileArn))
+	d.SetId(aws.StringValue(output.ConnectorProfileArn))
 
 	return resourceConnectorProfileRead(ctx, d, meta)
 }
@@ -1480,13 +1484,16 @@ func resourceConnectorProfileUpdate(ctx context.Context, d *schema.ResourceData,
 	conn := meta.(*conns.AWSClient).AppFlowConn(ctx)
 	name := d.Get("name").(string)
 
-	updateConnectorProfileInput := appflow.UpdateConnectorProfileInput{
-		ConnectionMode:         aws.String(d.Get("connection_mode").(string)),
-		ConnectorProfileConfig: expandConnectorProfileConfig(d.Get("connector_profile_config").([]interface{})[0].(map[string]interface{})),
-		ConnectorProfileName:   aws.String(name),
+	input := &appflow.UpdateConnectorProfileInput{
+		ConnectionMode:       aws.String(d.Get("connection_mode").(string)),
+		ConnectorProfileName: aws.String(name),
 	}
 
-	_, err := conn.UpdateConnectorProfileWithContext(ctx, &updateConnectorProfileInput)
+	if v, ok := d.GetOk("connector_profile_config"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
+		input.ConnectorProfileConfig = expandConnectorProfileConfig(v.([]interface{})[0].(map[string]interface{}))
+	}
+
+	_, err := conn.UpdateConnectorProfileWithContext(ctx, input)
 
 	if err != nil {
 		return diag.Errorf("updating AppFlow Connector Profile (%s): %s", d.Id(), err)
@@ -1500,8 +1507,7 @@ func resourceConnectorProfileDelete(ctx context.Context, d *schema.ResourceData,
 
 	out, _ := FindConnectorProfileByARN(ctx, conn, d.Id())
 
-	log.Printf("[INFO] Deleting AppFlow Flow %s", d.Id())
-
+	log.Printf("[INFO] Deleting AppFlow Connector Profile: %s", d.Id())
 	_, err := conn.DeleteConnectorProfileWithContext(ctx, &appflow.DeleteConnectorProfileInput{
 		ConnectorProfileName: out.ConnectorProfileName,
 	})
@@ -1514,9 +1520,13 @@ func resourceConnectorProfileDelete(ctx context.Context, d *schema.ResourceData,
 }
 
 func expandConnectorProfileConfig(m map[string]interface{}) *appflow.ConnectorProfileConfig {
-	cpc := appflow.ConnectorProfileConfig{
-		ConnectorProfileCredentials: expandConnectorProfileCredentials(m["connector_profile_credentials"].([]interface{})[0].(map[string]interface{})),
-		ConnectorProfileProperties:  expandConnectorProfileProperties(m["connector_profile_properties"].([]interface{})[0].(map[string]interface{})),
+	cpc := appflow.ConnectorProfileConfig{}
+
+	if v, ok := m["connector_profile_credentials"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
+		cpc.ConnectorProfileCredentials = expandConnectorProfileCredentials(v[0].(map[string]interface{}))
+	}
+	if v, ok := m["connector_profile_properties"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
+		cpc.ConnectorProfileProperties = expandConnectorProfileProperties(v[0].(map[string]interface{}))
 	}
 
 	return &cpc
@@ -1597,19 +1607,16 @@ func expandCustomConnectorProfileCredentials(m map[string]interface{}) *appflow.
 		AuthenticationType: aws.String(m["authentication_type"].(string)),
 	}
 
-	if v, ok := m["api_key"].([]interface{}); ok && len(v) > 0 {
+	if v, ok := m["api_key"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
 		credentials.ApiKey = expandAPIKeyCredentials(v[0].(map[string]interface{}))
 	}
-
-	if v, ok := m["basic"].([]interface{}); ok && len(v) > 0 {
+	if v, ok := m["basic"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
 		credentials.Basic = expandBasicAuthCredentials(v[0].(map[string]interface{}))
 	}
-
-	if v, ok := m["custom"].([]interface{}); ok && len(v) > 0 {
+	if v, ok := m["custom"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
 		credentials.Custom = expandCustomAuthCredentials(v[0].(map[string]interface{}))
 	}
-
-	if v, ok := m["oauth2"].([]interface{}); ok && len(v) > 0 {
+	if v, ok := m["oauth2"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
 		credentials.Oauth2 = expandOAuth2Credentials(v[0].(map[string]interface{}))
 	}
 
@@ -1642,11 +1649,9 @@ func expandGoogleAnalyticsConnectorProfileCredentials(m map[string]interface{})
 	if v, ok := m["access_token"].(string); ok && v != "" {
 		credentials.AccessToken = aws.String(v)
 	}
-
-	if v, ok := m["oauth_request"].([]interface{}); ok && len(v) > 0 {
+	if v, ok := m["oauth_request"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
 		credentials.OAuthRequest = expandOAuthRequest(v[0].(map[string]interface{}))
 	}
-
 	if v, ok := m["refresh_token"].(string); ok && v != "" {
 		credentials.RefreshToken = aws.String(v)
 	}
@@ -1660,11 +1665,9 @@ func expandHoneycodeConnectorProfileCredentials(m map[string]interface{}) *appfl
 	if v, ok := m["access_token"].(string); ok && v != "" {
 		credentials.AccessToken = aws.String(v)
 	}
-
-	if v, ok := m["oauth_request"].([]interface{}); ok && len(v) > 0 {
+	if v, ok := m["oauth_request"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
 		credentials.OAuthRequest = expandOAuthRequest(v[0].(map[string]interface{}))
 	}
-
 	if v, ok := m["refresh_token"].(string); ok && v != "" {
 		credentials.RefreshToken = aws.String(v)
 	}
@@ -1692,8 +1695,7 @@ func expandMarketoConnectorProfileCredentials(m map[string]interface{}) *appflow
 	if v, ok := m["access_token"].(string); ok && v != "" {
 		credentials.AccessToken = aws.String(v)
 	}
-
-	if v, ok := m["oauth_request"].([]interface{}); ok && len(v) > 0 {
+	if v, ok := m["oauth_request"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
 		credentials.OAuthRequest = expandOAuthRequest(v[0].(map[string]interface{}))
 	}
 
@@ -1715,15 +1717,12 @@ func expandSalesforceConnectorProfileCredentials(m map[string]interface{}) *appf
 	if v, ok := m["access_token"].(string); ok && v != "" {
 		credentials.AccessToken = aws.String(v)
 	}
-
 	if v, ok := m["client_credentials_arn"].(string); ok && v != "" {
 		credentials.ClientCredentialsArn = aws.String(v)
 	}
-
-	if v, ok := m["oauth_request"].([]interface{}); ok && len(v) > 0 {
+	if v, ok := m["oauth_request"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
 		credentials.OAuthRequest = expandOAuthRequest(v[0].(map[string]interface{}))
 	}
-
 	if v, ok := m["refresh_token"].(string); ok && v != "" {
 		credentials.RefreshToken = aws.String(v)
 	}
@@ -1734,11 +1733,10 @@ func expandSalesforceConnectorProfileCredentials(m map[string]interface{}) *appf
 func expandSAPODataConnectorProfileCredentials(m map[string]interface{}) *appflow.SAPODataConnectorProfileCredentials {
 	credentials := appflow.SAPODataConnectorProfileCredentials{}
 
-	if v, ok := m["basic_auth_credentials"].([]interface{}); ok && len(v) > 0 {
+	if v, ok := m["basic_auth_credentials"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
 		credentials.BasicAuthCredentials = expandBasicAuthCredentials(v[0].(map[string]interface{}))
 	}
-
-	if v, ok := m["oauth_credentials"].([]interface{}); ok && len(v) > 0 {
+	if v, ok := m["oauth_credentials"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
 		credentials.OAuthCredentials = expandOAuthCredentials(v[0].(map[string]interface{}))
 	}
 
@@ -1769,7 +1767,7 @@ func expandSlackConnectorProfileCredentials(m map[string]interface{}) *appflow.S
 		ClientSecret: aws.String(m["client_secret"].(string)),
 	}
 
-	if v, ok := m["oauth_request"].([]interface{}); ok && len(v) > 0 {
+	if v, ok := m["oauth_request"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
 		credentials.OAuthRequest = expandOAuthRequest(v[0].(map[string]interface{}))
 	}
 
@@ -1809,7 +1807,7 @@ func expandZendeskConnectorProfileCredentials(m map[string]interface{}) *appflow
 		ClientSecret: aws.String(m["client_secret"].(string)),
 	}
 
-	if v, ok := m["oauth_request"].([]interface{}); ok && len(v) > 0 {
+	if v, ok := m["oauth_request"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
 		credentials.OAuthRequest = expandOAuthRequest(v[0].(map[string]interface{}))
 	}
 
@@ -1881,11 +1879,9 @@ func expandOAuthCredentials(m map[string]interface{}) *appflow.OAuthCredentials
 	if v, ok := m["access_token"].(string); ok && v != "" {
 		credentials.AccessToken = aws.String(v)
 	}
-
-	if v, ok := m["oauth_request"].([]interface{}); ok && len(v) > 0 {
+	if v, ok := m["oauth_request"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
 		credentials.OAuthRequest = expandOAuthRequest(v[0].(map[string]interface{}))
 	}
-
 	if v, ok := m["refresh_token"].(string); ok && v != "" {
 		credentials.RefreshToken = aws.String(v)
 	}
@@ -1899,19 +1895,15 @@ func expandOAuth2Credentials(m map[string]interface{}) *appflow.OAuth2Credential
 	if v, ok := m["access_token"].(string); ok && v != "" {
 		credentials.AccessToken = aws.String(v)
 	}
-
 	if v, ok := m["client_id"].(string); ok && v != "" {
 		credentials.ClientId = aws.String(v)
 	}
-
 	if v, ok := m["client_secret"].(string); ok && v != "" {
 		credentials.ClientSecret = aws.String(v)
 	}
-
-	if v, ok := m["oauth_request"].([]interface{}); ok && len(v) > 0 {
+	if v, ok := m["oauth_request"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
 		credentials.OAuthRequest = expandOAuthRequest(v[0].(map[string]interface{}))
 	}
-
 	if v, ok := m["refresh_token"].(string); ok && v != "" {
 		credentials.RefreshToken = aws.String(v)
 	}
@@ -1922,74 +1914,57 @@ func expandOAuth2Credentials(m map[string]interface{}) *appflow.OAuth2Credential
 func expandConnectorProfileProperties(m map[string]interface{}) *appflow.ConnectorProfileProperties {
 	cpc := appflow.ConnectorProfileProperties{}
 
-	if v, ok := m["amplitude"].([]interface{}); ok && len(v) > 0 {
+	if v, ok := m["amplitude"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
 		cpc.Amplitude = v[0].(*appflow.AmplitudeConnectorProfileProperties)
 	}
-
-	if v, ok := m["custom_connector"].([]interface{}); ok && len(v) > 0 {
+	if v, ok := m["custom_connector"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
 		cpc.CustomConnector = expandCustomConnectorProfileProperties(v[0].(map[string]interface{}))
 	}
-
 	if v, ok := m["datadog"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
 		cpc.Datadog = expandDatadogConnectorProfileProperties(v[0].(map[string]interface{}))
 	}
-
 	if v, ok := m["dynatrace"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
 		cpc.Dynatrace = expandDynatraceConnectorProfileProperties(v[0].(map[string]interface{}))
 	}
-
-	if v, ok := m["google_analytics"].([]interface{}); ok && len(v) > 0 {
+	if v, ok := m["google_analytics"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
 		cpc.GoogleAnalytics = v[0].(*appflow.GoogleAnalyticsConnectorProfileProperties)
 	}
-
-	if v, ok := m["honeycode"].([]interface{}); ok && len(v) > 0 {
+	if v, ok := m["honeycode"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
 		cpc.Honeycode = v[0].(*appflow.HoneycodeConnectorProfileProperties)
 	}
-
 	if v, ok := m["infor_nexus"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
 		cpc.InforNexus = expandInforNexusConnectorProfileProperties(v[0].(map[string]interface{}))
 	}
-
 	if v, ok := m["marketo"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
 		cpc.Marketo = expandMarketoConnectorProfileProperties(v[0].(map[string]interface{}))
 	}
-
 	if v, ok := m["redshift"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
 		cpc.Redshift = expandRedshiftConnectorProfileProperties(v[0].(map[string]interface{}))
 	}
-
 	if v, ok := m["salesforce"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
 		cpc.Salesforce = expandSalesforceConnectorProfileProperties(v[0].(map[string]interface{}))
 	}
-
 	if v, ok := m["sapo_data"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
 		cpc.SAPOData = expandSAPODataConnectorProfileProperties(v[0].(map[string]interface{}))
 	}
-
 	if v, ok := m["service_now"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
 		cpc.ServiceNow = expandServiceNowConnectorProfileProperties(v[0].(map[string]interface{}))
 	}
-
-	if v, ok := m["singular"].([]interface{}); ok && len(v) > 0 {
+	if v, ok := m["singular"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
 		cpc.Singular = v[0].(*appflow.SingularConnectorProfileProperties)
 	}
-
 	if v, ok := m["slack"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
 		cpc.Slack = expandSlackConnectorProfileProperties(v[0].(map[string]interface{}))
 	}
-
 	if v, ok := m["snowflake"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
 		cpc.Snowflake = expandSnowflakeConnectorProfileProperties(v[0].(map[string]interface{}))
 	}
-
-	if v, ok := m["trendmicro"].([]interface{}); ok && len(v) > 0 {
+	if v, ok := m["trendmicro"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
 		cpc.Trendmicro = v[0].(*appflow.TrendmicroConnectorProfileProperties)
 	}
-
-	if v, ok := m["veeva"].([]interface{}); ok && len(v) > 0 {
+	if v, ok := m["veeva"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
 		cpc.Veeva = expandVeevaConnectorProfileProperties(v[0].(map[string]interface{}))
 	}
-
 	if v, ok := m["zendesk"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
 		cpc.Zendesk = expandZendeskConnectorProfileProperties(v[0].(map[string]interface{}))
 	}
@@ -2074,10 +2049,9 @@ func expandSalesforceConnectorProfileProperties(m map[string]interface{}) *appfl
 func expandCustomConnectorProfileProperties(m map[string]interface{}) *appflow.CustomConnectorProfileProperties {
 	properties := appflow.CustomConnectorProfileProperties{}
 
-	if v, ok := m["oauth2_properties"].([]interface{}); ok && len(v) > 0 {
+	if v, ok := m["oauth2_properties"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
 		properties.OAuth2Properties = expandOAuth2Properties(v[0].(map[string]interface{}))
 	}
-
 	if v, ok := m["profile_properties"].(map[string]interface{}); ok && len(v) > 0 {
 		properties.ProfileProperties = flex.ExpandStringMap(v)
 	}
@@ -2096,11 +2070,9 @@ func expandSAPODataConnectorProfileProperties(m map[string]interface{}) *appflow
 	if v, ok := m["logon_language"].(string); ok && v != "" {
 		properties.LogonLanguage = aws.String(v)
 	}
-
-	if v, ok := m["oauth_properties"].([]interface{}); ok && len(v) > 0 {
+	if v, ok := m["oauth_properties"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
 		properties.OAuthProperties = expandOAuthProperties(v[0].(map[string]interface{}))
 	}
-
 	if v, ok := m["private_link_service_name"].(string); ok && v != "" {
 		properties.PrivateLinkServiceName = aws.String(v)
 	}
diff --git a/internal/service/appflow/connector_profile_test.go b/internal/service/appflow/connector_profile_test.go
index 42c663dba3c..68433e9e61d 100644
--- a/internal/service/appflow/connector_profile_test.go
+++ b/internal/service/appflow/connector_profile_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appflow_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/appflow"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -38,7 +41,7 @@ func TestAccAppFlowConnectorProfile_basic(t *testing.T) {
 				Config: testAccConnectorProfileConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckConnectorProfileExists(ctx, resourceName, &connectorProfiles),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "appflow", regexp.MustCompile(`connectorprofile/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "appflow", regexache.MustCompile(`connectorprofile/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttrSet(resourceName, "connection_mode"),
 					resource.TestCheckResourceAttrSet(resourceName, "connector_profile_config.#"),
diff --git a/internal/service/appflow/find.go b/internal/service/appflow/find.go
index ad86bb21248..bc54b6a2e8c 100644
--- a/internal/service/appflow/find.go
+++ b/internal/service/appflow/find.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appflow
 
 import (
diff --git a/internal/service/appflow/flow.go b/internal/service/appflow/flow.go
index fd80fbc89a7..f845bde375d 100644
--- a/internal/service/appflow/flow.go
+++ b/internal/service/appflow/flow.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appflow
 
 import (
 	"context"
 	"log"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/appflow"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -45,12 +48,12 @@ func ResourceFlow() *schema.Resource {
 				Type:         schema.TypeString,
 				Required:     true,
 				ForceNew:     true,
-				ValidateFunc: validation.All(validation.StringMatch(regexp.MustCompile(`[a-zA-Z0-9][\w!@#.-]+`), "must contain only alphanumeric, exclamation point (!), at sign (@), number sign (#), period (.), and hyphen (-) characters"), validation.StringLenBetween(1, 256)),
+				ValidateFunc: validation.All(validation.StringMatch(regexache.MustCompile(`[0-9A-Za-z][\w!@#.-]+`), "must contain only alphanumeric, exclamation point (!), at sign (@), number sign (#), period (.), and hyphen (-) characters"), validation.StringLenBetween(1, 256)),
 			},
 			names.AttrDescription: {
 				Type:         schema.TypeString,
 				Optional:     true,
-				ValidateFunc: validation.StringMatch(regexp.MustCompile(`[\w!@#\-.?,\s]*`), "must contain only alphanumeric, underscore (_), exclamation point (!), at sign (@), number sign (#), hyphen (-), period (.), question mark (?), comma (,), and whitespace characters"),
+				ValidateFunc: validation.StringMatch(regexache.MustCompile(`[\w!@#\-.?,\s]*`), "must contain only alphanumeric, underscore (_), exclamation point (!), at sign (@), number sign (#), hyphen (-), period (.), question mark (?), comma (,), and whitespace characters"),
 			},
 			"destination_flow_config": {
 				Type:     schema.TypeSet,
@@ -60,12 +63,12 @@ func ResourceFlow() *schema.Resource {
 						"api_version": {
 							Type:         schema.TypeString,
 							Optional:     true,
-							ValidateFunc: validation.All(validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(1, 256)),
+							ValidateFunc: validation.All(validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(1, 256)),
 						},
 						"connector_profile_name": {
 							Type:         schema.TypeString,
 							Optional:     true,
-							ValidateFunc: validation.All(validation.StringMatch(regexp.MustCompile(`[\w\/!@#+=.-]+`), "must contain only alphanumeric, underscore (_), forward slash (/), exclamation point (!), at sign (@), number sign (#), plus sign (+), equals sign (=), period (.), and hyphen (-) characters"), validation.StringLenBetween(1, 256)),
+							ValidateFunc: validation.All(validation.StringMatch(regexache.MustCompile(`[\w\/!@#+=.-]+`), "must contain only alphanumeric, underscore (_), forward slash (/), exclamation point (!), at sign (@), number sign (#), plus sign (+), equals sign (=), period (.), and hyphen (-) characters"), validation.StringLenBetween(1, 256)),
 						},
 						"connector_type": {
 							Type:         schema.TypeString,
@@ -87,19 +90,19 @@ func ResourceFlow() *schema.Resource {
 												"custom_properties": {
 													Type:     schema.TypeMap,
 													Optional: true,
-													ValidateDiagFunc: verify.ValidAllDiag(
+													ValidateDiagFunc: validation.AllDiag(
 														validation.MapKeyLenBetween(1, 128),
-														validation.MapKeyMatch(regexp.MustCompile(`[\w]+`), "must contain only alphanumeric and underscore (_) characters"),
+														validation.MapKeyMatch(regexache.MustCompile(`[\w]+`), "must contain only alphanumeric and underscore (_) characters"),
 													),
 													Elem: &schema.Schema{
 														Type:         schema.TypeString,
-														ValidateFunc: validation.All(validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(0, 2048)),
+														ValidateFunc: validation.All(validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(0, 2048)),
 													},
 												},
 												"entity_name": {
 													Type:         schema.TypeString,
 													Required:     true,
-													ValidateFunc: validation.All(validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(1, 1024)),
+													ValidateFunc: validation.All(validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(1, 1024)),
 												},
 												"error_handling_config": {
 													Type:     schema.TypeList,
@@ -110,7 +113,7 @@ func ResourceFlow() *schema.Resource {
 															"bucket_name": {
 																Type:         schema.TypeString,
 																Optional:     true,
-																ValidateFunc: validation.All(validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(3, 63)),
+																ValidateFunc: validation.All(validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(3, 63)),
 															},
 															"bucket_prefix": {
 																Type:         schema.TypeString,
@@ -129,7 +132,7 @@ func ResourceFlow() *schema.Resource {
 													Optional: true,
 													Elem: &schema.Schema{
 														Type:         schema.TypeString,
-														ValidateFunc: validation.All(validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(0, 128)),
+														ValidateFunc: validation.All(validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(0, 128)),
 													},
 												},
 												"write_operation_type": {
@@ -149,12 +152,12 @@ func ResourceFlow() *schema.Resource {
 												"domain_name": {
 													Type:         schema.TypeString,
 													Required:     true,
-													ValidateFunc: validation.All(validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(1, 64)),
+													ValidateFunc: validation.All(validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(1, 64)),
 												},
 												"object_type_name": {
 													Type:         schema.TypeString,
 													Optional:     true,
-													ValidateFunc: validation.All(validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(0, 255)),
+													ValidateFunc: validation.All(validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(0, 255)),
 												},
 											},
 										},
@@ -174,7 +177,7 @@ func ResourceFlow() *schema.Resource {
 															"bucket_name": {
 																Type:         schema.TypeString,
 																Optional:     true,
-																ValidateFunc: validation.All(validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(3, 63)),
+																ValidateFunc: validation.All(validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(3, 63)),
 															},
 															"bucket_prefix": {
 																Type:         schema.TypeString,
@@ -191,7 +194,7 @@ func ResourceFlow() *schema.Resource {
 												"object": {
 													Type:         schema.TypeString,
 													Required:     true,
-													ValidateFunc: validation.All(validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(1, 512)),
+													ValidateFunc: validation.All(validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(1, 512)),
 												},
 											},
 										},
@@ -211,7 +214,7 @@ func ResourceFlow() *schema.Resource {
 															"bucket_name": {
 																Type:         schema.TypeString,
 																Optional:     true,
-																ValidateFunc: validation.All(validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(3, 63)),
+																ValidateFunc: validation.All(validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(3, 63)),
 															},
 															"bucket_prefix": {
 																Type:         schema.TypeString,
@@ -228,7 +231,7 @@ func ResourceFlow() *schema.Resource {
 												"object": {
 													Type:         schema.TypeString,
 													Required:     true,
-													ValidateFunc: validation.All(validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(1, 512)),
+													ValidateFunc: validation.All(validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(1, 512)),
 												},
 											},
 										},
@@ -256,7 +259,7 @@ func ResourceFlow() *schema.Resource {
 															"bucket_name": {
 																Type:         schema.TypeString,
 																Optional:     true,
-																ValidateFunc: validation.All(validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(3, 63)),
+																ValidateFunc: validation.All(validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(3, 63)),
 															},
 															"bucket_prefix": {
 																Type:         schema.TypeString,
@@ -273,7 +276,7 @@ func ResourceFlow() *schema.Resource {
 												"object": {
 													Type:         schema.TypeString,
 													Required:     true,
-													ValidateFunc: validation.All(validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(1, 512)),
+													ValidateFunc: validation.All(validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(1, 512)),
 												},
 											},
 										},
@@ -298,7 +301,7 @@ func ResourceFlow() *schema.Resource {
 															"bucket_name": {
 																Type:         schema.TypeString,
 																Optional:     true,
-																ValidateFunc: validation.All(validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(3, 63)),
+																ValidateFunc: validation.All(validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(3, 63)),
 															},
 															"bucket_prefix": {
 																Type:         schema.TypeString,
@@ -315,12 +318,12 @@ func ResourceFlow() *schema.Resource {
 												"intermediate_bucket_name": {
 													Type:         schema.TypeString,
 													Required:     true,
-													ValidateFunc: validation.All(validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(3, 63)),
+													ValidateFunc: validation.All(validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(3, 63)),
 												},
 												"object": {
 													Type:         schema.TypeString,
 													Required:     true,
-													ValidateFunc: validation.All(validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(1, 512)),
+													ValidateFunc: validation.All(validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(1, 512)),
 												},
 											},
 										},
@@ -334,7 +337,7 @@ func ResourceFlow() *schema.Resource {
 												"bucket_name": {
 													Type:         schema.TypeString,
 													Required:     true,
-													ValidateFunc: validation.All(validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(3, 63)),
+													ValidateFunc: validation.All(validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(3, 63)),
 												},
 												"bucket_prefix": {
 													Type:         schema.TypeString,
@@ -410,7 +413,7 @@ func ResourceFlow() *schema.Resource {
 															"bucket_name": {
 																Type:         schema.TypeString,
 																Optional:     true,
-																ValidateFunc: validation.All(validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(3, 63)),
+																ValidateFunc: validation.All(validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(3, 63)),
 															},
 															"bucket_prefix": {
 																Type:         schema.TypeString,
@@ -429,13 +432,13 @@ func ResourceFlow() *schema.Resource {
 													Optional: true,
 													Elem: &schema.Schema{
 														Type:         schema.TypeString,
-														ValidateFunc: validation.All(validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(0, 128)),
+														ValidateFunc: validation.All(validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(0, 128)),
 													},
 												},
 												"object": {
 													Type:         schema.TypeString,
 													Required:     true,
-													ValidateFunc: validation.All(validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(1, 512)),
+													ValidateFunc: validation.All(validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(1, 512)),
 												},
 												"write_operation_type": {
 													Type:         schema.TypeString,
@@ -460,7 +463,7 @@ func ResourceFlow() *schema.Resource {
 															"bucket_name": {
 																Type:         schema.TypeString,
 																Optional:     true,
-																ValidateFunc: validation.All(validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(3, 63)),
+																ValidateFunc: validation.All(validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(3, 63)),
 															},
 															"bucket_prefix": {
 																Type:         schema.TypeString,
@@ -479,13 +482,13 @@ func ResourceFlow() *schema.Resource {
 													Optional: true,
 													Elem: &schema.Schema{
 														Type:         schema.TypeString,
-														ValidateFunc: validation.All(validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(0, 128)),
+														ValidateFunc: validation.All(validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(0, 128)),
 													},
 												},
 												AttrObjectPath: {
 													Type:         schema.TypeString,
 													Required:     true,
-													ValidateFunc: validation.All(validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(1, 512)),
+													ValidateFunc: validation.All(validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(1, 512)),
 												},
 												"success_response_handling_config": {
 													Type:     schema.TypeList,
@@ -496,7 +499,7 @@ func ResourceFlow() *schema.Resource {
 															"bucket_name": {
 																Type:         schema.TypeString,
 																Optional:     true,
-																ValidateFunc: validation.All(validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(3, 63)),
+																ValidateFunc: validation.All(validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(3, 63)),
 															},
 															"bucket_prefix": {
 																Type:         schema.TypeString,
@@ -534,7 +537,7 @@ func ResourceFlow() *schema.Resource {
 															"bucket_name": {
 																Type:         schema.TypeString,
 																Optional:     true,
-																ValidateFunc: validation.All(validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(3, 63)),
+																ValidateFunc: validation.All(validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(3, 63)),
 															},
 															"bucket_prefix": {
 																Type:         schema.TypeString,
@@ -551,12 +554,12 @@ func ResourceFlow() *schema.Resource {
 												"intermediate_bucket_name": {
 													Type:         schema.TypeString,
 													Required:     true,
-													ValidateFunc: validation.All(validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(3, 63)),
+													ValidateFunc: validation.All(validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(3, 63)),
 												},
 												"object": {
 													Type:         schema.TypeString,
 													Required:     true,
-													ValidateFunc: validation.All(validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(1, 512)),
+													ValidateFunc: validation.All(validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(1, 512)),
 												},
 											},
 										},
@@ -570,7 +573,7 @@ func ResourceFlow() *schema.Resource {
 												"bucket_name": {
 													Type:         schema.TypeString,
 													Required:     true,
-													ValidateFunc: validation.All(validation.StringMatch(regexp.MustCompile(`^(upsolver-appflow)\S*`), "must start with 'upsolver-appflow' and can not contain any whitespace characters"), validation.StringLenBetween(3, 63)),
+													ValidateFunc: validation.All(validation.StringMatch(regexache.MustCompile(`^(upsolver-appflow)\S*`), "must start with 'upsolver-appflow' and can not contain any whitespace characters"), validation.StringLenBetween(3, 63)),
 												},
 												"bucket_prefix": {
 													Type:         schema.TypeString,
@@ -642,7 +645,7 @@ func ResourceFlow() *schema.Resource {
 															"bucket_name": {
 																Type:         schema.TypeString,
 																Optional:     true,
-																ValidateFunc: validation.All(validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(3, 63)),
+																ValidateFunc: validation.All(validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(3, 63)),
 															},
 															"bucket_prefix": {
 																Type:         schema.TypeString,
@@ -661,13 +664,13 @@ func ResourceFlow() *schema.Resource {
 													Optional: true,
 													Elem: &schema.Schema{
 														Type:         schema.TypeString,
-														ValidateFunc: validation.All(validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(0, 128)),
+														ValidateFunc: validation.All(validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(0, 128)),
 													},
 												},
 												"object": {
 													Type:         schema.TypeString,
 													Required:     true,
-													ValidateFunc: validation.All(validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(1, 512)),
+													ValidateFunc: validation.All(validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(1, 512)),
 												},
 												"write_operation_type": {
 													Type:         schema.TypeString,
@@ -688,7 +691,7 @@ func ResourceFlow() *schema.Resource {
 				Optional:     true,
 				Computed:     true,
 				ForceNew:     true,
-				ValidateFunc: validation.StringMatch(regexp.MustCompile(`arn:.*:kms:.*:[0-9]+:.*`), "must be a valid ARN of a Key Management Services (KMS) key"),
+				ValidateFunc: validation.StringMatch(regexache.MustCompile(`arn:.*:kms:.*:[0-9]+:.*`), "must be a valid ARN of a Key Management Services (KMS) key"),
 			},
 			"source_flow_config": {
 				Type:     schema.TypeList,
@@ -699,12 +702,12 @@ func ResourceFlow() *schema.Resource {
 						"api_version": {
 							Type:         schema.TypeString,
 							Optional:     true,
-							ValidateFunc: validation.All(validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(1, 256)),
+							ValidateFunc: validation.All(validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(1, 256)),
 						},
 						"connector_profile_name": {
 							Type:         schema.TypeString,
 							Optional:     true,
-							ValidateFunc: validation.All(validation.StringMatch(regexp.MustCompile(`[\w\/!@#+=.-]+`), "must contain only alphanumeric, underscore (_), forward slash (/), exclamation point (!), at sign (@), number sign (#), plus sign (+), equals sign (=), period (.), and hyphen (-) characters"), validation.StringLenBetween(1, 256)),
+							ValidateFunc: validation.All(validation.StringMatch(regexache.MustCompile(`[\w\/!@#+=.-]+`), "must contain only alphanumeric, underscore (_), forward slash (/), exclamation point (!), at sign (@), number sign (#), plus sign (+), equals sign (=), period (.), and hyphen (-) characters"), validation.StringLenBetween(1, 256)),
 						},
 						"connector_type": {
 							Type:         schema.TypeString,
@@ -740,7 +743,7 @@ func ResourceFlow() *schema.Resource {
 												"object": {
 													Type:         schema.TypeString,
 													Required:     true,
-													ValidateFunc: validation.All(validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(1, 512)),
+													ValidateFunc: validation.All(validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(1, 512)),
 												},
 											},
 										},
@@ -754,19 +757,19 @@ func ResourceFlow() *schema.Resource {
 												"custom_properties": {
 													Type:     schema.TypeMap,
 													Optional: true,
-													ValidateDiagFunc: verify.ValidAllDiag(
+													ValidateDiagFunc: validation.AllDiag(
 														validation.MapKeyLenBetween(1, 128),
-														validation.MapKeyMatch(regexp.MustCompile(`[\w]+`), "must contain only alphanumeric and underscore (_) characters"),
+														validation.MapKeyMatch(regexache.MustCompile(`[\w]+`), "must contain only alphanumeric and underscore (_) characters"),
 													),
 													Elem: &schema.Schema{
 														Type:         schema.TypeString,
-														ValidateFunc: validation.All(validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(0, 2048)),
+														ValidateFunc: validation.All(validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(0, 2048)),
 													},
 												},
 												"entity_name": {
 													Type:         schema.TypeString,
 													Required:     true,
-													ValidateFunc: validation.All(validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(1, 1024)),
+													ValidateFunc: validation.All(validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(1, 1024)),
 												},
 											},
 										},
@@ -780,7 +783,7 @@ func ResourceFlow() *schema.Resource {
 												"object": {
 													Type:         schema.TypeString,
 													Required:     true,
-													ValidateFunc: validation.All(validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(1, 512)),
+													ValidateFunc: validation.All(validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(1, 512)),
 												},
 											},
 										},
@@ -794,7 +797,7 @@ func ResourceFlow() *schema.Resource {
 												"object": {
 													Type:         schema.TypeString,
 													Required:     true,
-													ValidateFunc: validation.All(validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(1, 512)),
+													ValidateFunc: validation.All(validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(1, 512)),
 												},
 											},
 										},
@@ -808,7 +811,7 @@ func ResourceFlow() *schema.Resource {
 												"object": {
 													Type:         schema.TypeString,
 													Required:     true,
-													ValidateFunc: validation.All(validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(1, 512)),
+													ValidateFunc: validation.All(validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(1, 512)),
 												},
 											},
 										},
@@ -822,7 +825,7 @@ func ResourceFlow() *schema.Resource {
 												"object": {
 													Type:         schema.TypeString,
 													Required:     true,
-													ValidateFunc: validation.All(validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(1, 512)),
+													ValidateFunc: validation.All(validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(1, 512)),
 												},
 											},
 										},
@@ -836,7 +839,7 @@ func ResourceFlow() *schema.Resource {
 												"object": {
 													Type:         schema.TypeString,
 													Required:     true,
-													ValidateFunc: validation.All(validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(1, 512)),
+													ValidateFunc: validation.All(validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(1, 512)),
 												},
 											},
 										},
@@ -850,7 +853,7 @@ func ResourceFlow() *schema.Resource {
 												"bucket_name": {
 													Type:         schema.TypeString,
 													Required:     true,
-													ValidateFunc: validation.All(validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(3, 63)),
+													ValidateFunc: validation.All(validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(3, 63)),
 												},
 												"bucket_prefix": {
 													Type:         schema.TypeString,
@@ -891,7 +894,7 @@ func ResourceFlow() *schema.Resource {
 												"object": {
 													Type:         schema.TypeString,
 													Required:     true,
-													ValidateFunc: validation.All(validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(1, 512)),
+													ValidateFunc: validation.All(validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(1, 512)),
 												},
 											},
 										},
@@ -905,7 +908,7 @@ func ResourceFlow() *schema.Resource {
 												AttrObjectPath: {
 													Type:         schema.TypeString,
 													Required:     true,
-													ValidateFunc: validation.All(validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(1, 512)),
+													ValidateFunc: validation.All(validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(1, 512)),
 												},
 											},
 										},
@@ -919,7 +922,7 @@ func ResourceFlow() *schema.Resource {
 												"object": {
 													Type:         schema.TypeString,
 													Required:     true,
-													ValidateFunc: validation.All(validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(1, 512)),
+													ValidateFunc: validation.All(validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(1, 512)),
 												},
 											},
 										},
@@ -933,7 +936,7 @@ func ResourceFlow() *schema.Resource {
 												"object": {
 													Type:         schema.TypeString,
 													Required:     true,
-													ValidateFunc: validation.All(validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(1, 512)),
+													ValidateFunc: validation.All(validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(1, 512)),
 												},
 											},
 										},
@@ -947,7 +950,7 @@ func ResourceFlow() *schema.Resource {
 												"object": {
 													Type:         schema.TypeString,
 													Required:     true,
-													ValidateFunc: validation.All(validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(1, 512)),
+													ValidateFunc: validation.All(validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(1, 512)),
 												},
 											},
 										},
@@ -961,7 +964,7 @@ func ResourceFlow() *schema.Resource {
 												"object": {
 													Type:         schema.TypeString,
 													Required:     true,
-													ValidateFunc: validation.All(validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(1, 512)),
+													ValidateFunc: validation.All(validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(1, 512)),
 												},
 											},
 										},
@@ -975,7 +978,7 @@ func ResourceFlow() *schema.Resource {
 												"document_type": {
 													Type:         schema.TypeString,
 													Optional:     true,
-													ValidateFunc: validation.All(validation.StringMatch(regexp.MustCompile(`[\s\w_-]+`), "must contain only alphanumeric, underscore (_), and hyphen (-) characters"), validation.StringLenBetween(1, 512)),
+													ValidateFunc: validation.All(validation.StringMatch(regexache.MustCompile(`[\s\w_-]+`), "must contain only alphanumeric, underscore (_), and hyphen (-) characters"), validation.StringLenBetween(1, 512)),
 												},
 												"include_all_versions": {
 													Type:     schema.TypeBool,
@@ -992,7 +995,7 @@ func ResourceFlow() *schema.Resource {
 												"object": {
 													Type:         schema.TypeString,
 													Required:     true,
-													ValidateFunc: validation.All(validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(1, 512)),
+													ValidateFunc: validation.All(validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(1, 512)),
 												},
 											},
 										},
@@ -1006,7 +1009,7 @@ func ResourceFlow() *schema.Resource {
 												"object": {
 													Type:         schema.TypeString,
 													Required:     true,
-													ValidateFunc: validation.All(validation.StringMatch(regexp.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(1, 512)),
+													ValidateFunc: validation.All(validation.StringMatch(regexache.MustCompile(`\S+`), "must not contain any whitespace characters"), validation.StringLenBetween(1, 512)),
 												},
 											},
 										},
@@ -3396,7 +3399,7 @@ func flattenTasks(tasks []*appflow.Task) []interface{} {
 }
 
 func flattenTask(task *appflow.Task) map[string]interface{} {
-	if task == nil {
+	if task == nil || (task == (&appflow.Task{})) {
 		return nil
 	}
 
diff --git a/internal/service/appflow/flow_test.go b/internal/service/appflow/flow_test.go
index f23512c8eba..a80d92ffa00 100644
--- a/internal/service/appflow/flow_test.go
+++ b/internal/service/appflow/flow_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appflow_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/appflow"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -37,7 +40,7 @@ func TestAccAppFlowFlow_basic(t *testing.T) {
 				Config: testAccFlowConfig_basic(rSourceName, rDestinationName, rFlowName, scheduleStartTime),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckFlowExists(ctx, resourceName, &flowOutput),
-					acctest.MatchResourceAttrRegionalARN(resourceName, names.AttrARN, "appflow", regexp.MustCompile(`flow/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, names.AttrARN, "appflow", regexache.MustCompile(`flow/.+`)),
 					resource.TestCheckResourceAttr(resourceName, names.AttrName, rFlowName),
 					resource.TestCheckResourceAttrSet(resourceName, "destination_flow_config.#"),
 					resource.TestCheckResourceAttrSet(resourceName, "destination_flow_config.0.connector_type"),
diff --git a/internal/service/appflow/generate.go b/internal/service/appflow/generate.go
index c95bc900352..487625d8e06 100644
--- a/internal/service/appflow/generate.go
+++ b/internal/service/appflow/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ServiceTagsMap -ListTags -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/appflow/service_package_gen.go b/internal/service/appflow/service_package_gen.go
index fc77242a1f2..ee3fd7b58fa 100644
--- a/internal/service/appflow/service_package_gen.go
+++ b/internal/service/appflow/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	appflow_sdkv1 "github.com/aws/aws-sdk-go/service/appflow"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -54,4 +55,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*a
 	return appflow_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/appflow/status.go b/internal/service/appflow/status.go
index 1151f015dcf..0b12ee5a32f 100644
--- a/internal/service/appflow/status.go
+++ b/internal/service/appflow/status.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appflow
 
 import (
diff --git a/internal/service/appflow/tags_gen.go b/internal/service/appflow/tags_gen.go
index 9c280ab0968..29c5e24464a 100644
--- a/internal/service/appflow/tags_gen.go
+++ b/internal/service/appflow/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/appflow"
 	"github.com/aws/aws-sdk-go/service/appflow/appflowiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -54,7 +56,7 @@ func Tags(tags tftags.KeyValueTags) map[string]*string {
 	return aws.StringMap(tags.Map())
 }
 
-// KeyValueTags creates KeyValueTags from appflow service tags.
+// KeyValueTags creates tftags.KeyValueTags from appflow service tags.
 func KeyValueTags(ctx context.Context, tags map[string]*string) tftags.KeyValueTags {
 	return tftags.New(ctx, tags)
 }
@@ -85,6 +87,8 @@ func updateTags(ctx context.Context, conn appflowiface.AppflowAPI, identifier st
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.AppFlow)
 	if len(removedTags) > 0 {
diff --git a/internal/service/appflow/wait.go b/internal/service/appflow/wait.go
index 677369d7280..ba7fbd8eef0 100644
--- a/internal/service/appflow/wait.go
+++ b/internal/service/appflow/wait.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appflow
 
 import (
diff --git a/internal/service/appintegrations/data_integration.go b/internal/service/appintegrations/data_integration.go
index 6b0044eec44..007c173137a 100644
--- a/internal/service/appintegrations/data_integration.go
+++ b/internal/service/appintegrations/data_integration.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appintegrations
 
 import (
 	"context"
 	"log"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/appintegrationsservice"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -52,7 +55,7 @@ func ResourceDataIntegration() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 255),
-					validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9\/\._\-]+$`), "should be not be more than 255 alphanumeric, forward slashes, dots, underscores, or hyphen characters"),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z\/\._\-]+$`), "should be not be more than 255 alphanumeric, forward slashes, dots, underscores, or hyphen characters"),
 				),
 			},
 			"schedule_config": {
@@ -74,7 +77,7 @@ func ResourceDataIntegration() *schema.Resource {
 							ForceNew: true,
 							ValidateFunc: validation.All(
 								validation.StringLenBetween(1, 255),
-								validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9\/\._\-]+$`), "should be not be more than 255 alphanumeric, forward slashes, dots, underscores, or hyphen characters"),
+								validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z\/\._\-]+$`), "should be not be more than 255 alphanumeric, forward slashes, dots, underscores, or hyphen characters"),
 							),
 						},
 						"schedule_expression": {
@@ -92,7 +95,7 @@ func ResourceDataIntegration() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 1000),
-					validation.StringMatch(regexp.MustCompile(`^\w+\:\/\/\w+\/[\w/!@#+=.-]+$`), "should be a valid source uri"),
+					validation.StringMatch(regexache.MustCompile(`^\w+\:\/\/\w+\/[\w/!@#+=.-]+$`), "should be a valid source uri"),
 				),
 			},
 			names.AttrTags:    tftags.TagsSchema(),
diff --git a/internal/service/appintegrations/data_integration_test.go b/internal/service/appintegrations/data_integration_test.go
index 8626e419406..880c7a76dca 100644
--- a/internal/service/appintegrations/data_integration_test.go
+++ b/internal/service/appintegrations/data_integration_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appintegrations_test
 
 import (
diff --git a/internal/service/appintegrations/event_integration.go b/internal/service/appintegrations/event_integration.go
index 2ea59754df8..8d9c8fa9dcf 100644
--- a/internal/service/appintegrations/event_integration.go
+++ b/internal/service/appintegrations/event_integration.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appintegrations
 
 import (
 	"context"
 	"log"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/appintegrationsservice"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -43,7 +46,7 @@ func ResourceEventIntegration() *schema.Resource {
 				Type:         schema.TypeString,
 				Required:     true,
 				ForceNew:     true,
-				ValidateFunc: validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9\/\._\-]{1,255}$`), "should be not be more than 255 alphanumeric, forward slashes, dots, underscores, or hyphen characters"),
+				ValidateFunc: validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z\/\._\-]{1,255}$`), "should be not be more than 255 alphanumeric, forward slashes, dots, underscores, or hyphen characters"),
 			},
 			"event_filter": {
 				Type:     schema.TypeList,
@@ -56,7 +59,7 @@ func ResourceEventIntegration() *schema.Resource {
 							Type:         schema.TypeString,
 							Required:     true,
 							ForceNew:     true,
-							ValidateFunc: validation.StringMatch(regexp.MustCompile(`^aws\.partner\/.*$`), "should be not be more than 255 alphanumeric, forward slashes, dots, underscores, or hyphen characters"),
+							ValidateFunc: validation.StringMatch(regexache.MustCompile(`^aws\.partner\/.*$`), "should be not be more than 255 alphanumeric, forward slashes, dots, underscores, or hyphen characters"),
 						},
 					},
 				},
@@ -65,7 +68,7 @@ func ResourceEventIntegration() *schema.Resource {
 				Type:         schema.TypeString,
 				Required:     true,
 				ForceNew:     true,
-				ValidateFunc: validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9\/\._\-]{1,255}$`), "should be not be more than 255 alphanumeric, forward slashes, dots, underscores, or hyphen characters"),
+				ValidateFunc: validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z\/\._\-]{1,255}$`), "should be not be more than 255 alphanumeric, forward slashes, dots, underscores, or hyphen characters"),
 			},
 			names.AttrTags:    tftags.TagsSchema(),
 			names.AttrTagsAll: tftags.TagsSchemaComputed(),
diff --git a/internal/service/appintegrations/event_integration_data_source.go b/internal/service/appintegrations/event_integration_data_source.go
index b780e920f8b..0343bb3ad15 100644
--- a/internal/service/appintegrations/event_integration_data_source.go
+++ b/internal/service/appintegrations/event_integration_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appintegrations
 
 import (
diff --git a/internal/service/appintegrations/event_integration_data_source_test.go b/internal/service/appintegrations/event_integration_data_source_test.go
index d1d653c64cb..0581e21d713 100644
--- a/internal/service/appintegrations/event_integration_data_source_test.go
+++ b/internal/service/appintegrations/event_integration_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appintegrations_test
 
 import (
diff --git a/internal/service/appintegrations/event_integration_test.go b/internal/service/appintegrations/event_integration_test.go
index d4a210e235a..4031900fe58 100644
--- a/internal/service/appintegrations/event_integration_test.go
+++ b/internal/service/appintegrations/event_integration_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appintegrations_test
 
 import (
diff --git a/internal/service/appintegrations/generate.go b/internal/service/appintegrations/generate.go
index af95353d97d..6fd29e6c380 100644
--- a/internal/service/appintegrations/generate.go
+++ b/internal/service/appintegrations/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ServiceTagsMap -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/appintegrations/service_package_gen.go b/internal/service/appintegrations/service_package_gen.go
index db99e1aa938..0ad4dcc869a 100644
--- a/internal/service/appintegrations/service_package_gen.go
+++ b/internal/service/appintegrations/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	appintegrationsservice_sdkv1 "github.com/aws/aws-sdk-go/service/appintegrationsservice"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -64,4 +65,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*a
 	return appintegrationsservice_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/appintegrations/tags_gen.go b/internal/service/appintegrations/tags_gen.go
index 5297ee8287c..52ca9a09c95 100644
--- a/internal/service/appintegrations/tags_gen.go
+++ b/internal/service/appintegrations/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/appintegrationsservice"
 	"github.com/aws/aws-sdk-go/service/appintegrationsservice/appintegrationsserviceiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -21,7 +23,7 @@ func Tags(tags tftags.KeyValueTags) map[string]*string {
 	return aws.StringMap(tags.Map())
 }
 
-// KeyValueTags creates KeyValueTags from appintegrations service tags.
+// KeyValueTags creates tftags.KeyValueTags from appintegrations service tags.
 func KeyValueTags(ctx context.Context, tags map[string]*string) tftags.KeyValueTags {
 	return tftags.New(ctx, tags)
 }
@@ -52,6 +54,8 @@ func updateTags(ctx context.Context, conn appintegrationsserviceiface.AppIntegra
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.AppIntegrations)
 	if len(removedTags) > 0 {
diff --git a/internal/service/applicationinsights/application.go b/internal/service/applicationinsights/application.go
index 88a9818c408..8cfb90485da 100644
--- a/internal/service/applicationinsights/application.go
+++ b/internal/service/applicationinsights/application.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package applicationinsights
 
 import (
diff --git a/internal/service/applicationinsights/application_test.go b/internal/service/applicationinsights/application_test.go
index 78407ec87af..e98b019611d 100644
--- a/internal/service/applicationinsights/application_test.go
+++ b/internal/service/applicationinsights/application_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package applicationinsights_test
 
 import (
diff --git a/internal/service/applicationinsights/find.go b/internal/service/applicationinsights/find.go
index 5e3f8e751fc..e84bb449386 100644
--- a/internal/service/applicationinsights/find.go
+++ b/internal/service/applicationinsights/find.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package applicationinsights
 
 import (
diff --git a/internal/service/applicationinsights/generate.go b/internal/service/applicationinsights/generate.go
index 618674b5320..d6606cc11b0 100644
--- a/internal/service/applicationinsights/generate.go
+++ b/internal/service/applicationinsights/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTags -ListTagsInIDElem=ResourceARN -ServiceTagsSlice -TagInIDElem=ResourceARN -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/applicationinsights/service_package_gen.go b/internal/service/applicationinsights/service_package_gen.go
index fae777a1d23..d00b8577f36 100644
--- a/internal/service/applicationinsights/service_package_gen.go
+++ b/internal/service/applicationinsights/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	applicationinsights_sdkv1 "github.com/aws/aws-sdk-go/service/applicationinsights"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -50,4 +51,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*a
 	return applicationinsights_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/applicationinsights/status.go b/internal/service/applicationinsights/status.go
index ffd3c9e270a..71de4604040 100644
--- a/internal/service/applicationinsights/status.go
+++ b/internal/service/applicationinsights/status.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package applicationinsights
 
 import (
diff --git a/internal/service/applicationinsights/sweep.go b/internal/service/applicationinsights/sweep.go
index 9a593b25ae3..0899e94cd0c 100644
--- a/internal/service/applicationinsights/sweep.go
+++ b/internal/service/applicationinsights/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package applicationinsights
 
@@ -12,9 +12,10 @@ import (
 	"github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_applicationinsights_application", &resource.Sweeper{
 		Name: "aws_applicationinsights_application",
 		F:    sweepApplications,
@@ -23,7 +24,7 @@ func init() {
 
 func sweepApplications(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
@@ -55,11 +56,11 @@ func sweepApplications(region string) error {
 		// in case work can be done, don't jump out yet
 	}
 
-	if err = sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err = sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("error sweeping ApplicationInsights Applications for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
+	if awsv1.SkipSweepError(errs.ErrorOrNil()) {
 		log.Printf("[WARN] Skipping ApplicationInsights Application sweep for %s: %s", region, err)
 		return nil
 	}
diff --git a/internal/service/applicationinsights/tags_gen.go b/internal/service/applicationinsights/tags_gen.go
index facf77f754d..93e283c0d1a 100644
--- a/internal/service/applicationinsights/tags_gen.go
+++ b/internal/service/applicationinsights/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/applicationinsights"
 	"github.com/aws/aws-sdk-go/service/applicationinsights/applicationinsightsiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -102,6 +104,8 @@ func updateTags(ctx context.Context, conn applicationinsightsiface.ApplicationIn
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.ApplicationInsights)
 	if len(removedTags) > 0 {
diff --git a/internal/service/applicationinsights/wait.go b/internal/service/applicationinsights/wait.go
index bfe4bda875a..0a82c082373 100644
--- a/internal/service/applicationinsights/wait.go
+++ b/internal/service/applicationinsights/wait.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package applicationinsights
 
 import (
@@ -32,7 +35,7 @@ func waitApplicationCreated(ctx context.Context, conn *applicationinsights.Appli
 
 func waitApplicationTerminated(ctx context.Context, conn *applicationinsights.ApplicationInsights, name string) (*applicationinsights.ApplicationInfo, error) {
 	stateConf := &retry.StateChangeConf{
-		Pending: []string{"NOT_CONFIGURED", "DELETING"},
+		Pending: []string{"ACTIVE", "NOT_CONFIGURED", "DELETING"},
 		Target:  []string{},
 		Refresh: statusApplication(ctx, conn, name),
 		Timeout: ApplicationDeletedTimeout,
diff --git a/internal/service/appmesh/appmesh_test.go b/internal/service/appmesh/appmesh_test.go
index d5a461b50c5..4f6bf3d3407 100644
--- a/internal/service/appmesh/appmesh_test.go
+++ b/internal/service/appmesh/appmesh_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appmesh_test
 
 import (
diff --git a/internal/service/appmesh/flex.go b/internal/service/appmesh/flex.go
index 6c6c4560082..1745247d538 100644
--- a/internal/service/appmesh/flex.go
+++ b/internal/service/appmesh/flex.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appmesh
 
 import (
diff --git a/internal/service/appmesh/gateway_route.go b/internal/service/appmesh/gateway_route.go
index a6acaa47959..dd7b8722d4a 100644
--- a/internal/service/appmesh/gateway_route.go
+++ b/internal/service/appmesh/gateway_route.go
@@ -1,13 +1,16 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appmesh
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"strings"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/appmesh"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -104,60 +107,51 @@ func resourceGatewayRouteSpecSchema() *schema.Schema {
 						MaxItems: 1,
 						Elem: &schema.Resource{
 							Schema: map[string]*schema.Schema{
-								"target": {
+								"rewrite": {
 									Type:     schema.TypeList,
-									Required: true,
+									Optional: true,
 									MinItems: 1,
 									MaxItems: 1,
 									Elem: &schema.Resource{
 										Schema: map[string]*schema.Schema{
-											"port": {
-												Type:         schema.TypeInt,
-												Optional:     true,
-												ValidateFunc: validation.IsPortNumber,
-											},
-											"virtual_service": {
+											"hostname": {
 												Type:     schema.TypeList,
-												Required: true,
+												Optional: true,
 												MinItems: 1,
 												MaxItems: 1,
 												Elem: &schema.Resource{
 													Schema: map[string]*schema.Schema{
-														"virtual_service_name": {
+														"default_target_hostname": {
 															Type:         schema.TypeString,
 															Required:     true,
-															ValidateFunc: validation.StringLenBetween(1, 255),
+															ValidateFunc: validation.StringInSlice([]string{"ENABLED", "DISABLED"}, false),
 														},
 													},
 												},
+												AtLeastOneOf: []string{
+													fmt.Sprintf("spec.0.%s.0.action.0.rewrite.0.hostname", attrName),
+													fmt.Sprintf("spec.0.%s.0.action.0.rewrite.0.path", attrName),
+													fmt.Sprintf("spec.0.%s.0.action.0.rewrite.0.prefix", attrName),
+												},
 											},
-										},
-									},
-								},
-								"rewrite": {
-									Type:     schema.TypeList,
-									Optional: true,
-									MinItems: 1,
-									MaxItems: 1,
-									Elem: &schema.Resource{
-										Schema: map[string]*schema.Schema{
-											"hostname": {
+											"path": {
 												Type:     schema.TypeList,
 												Optional: true,
 												MinItems: 1,
 												MaxItems: 1,
 												Elem: &schema.Resource{
 													Schema: map[string]*schema.Schema{
-														"default_target_hostname": {
+														"exact": {
 															Type:         schema.TypeString,
 															Required:     true,
-															ValidateFunc: validation.StringInSlice([]string{"ENABLED", "DISABLED"}, false),
+															ValidateFunc: validation.StringLenBetween(1, 255),
 														},
 													},
 												},
 												AtLeastOneOf: []string{
-													fmt.Sprintf("spec.0.%s.0.action.0.rewrite.0.prefix", attrName),
 													fmt.Sprintf("spec.0.%s.0.action.0.rewrite.0.hostname", attrName),
+													fmt.Sprintf("spec.0.%s.0.action.0.rewrite.0.path", attrName),
+													fmt.Sprintf("spec.0.%s.0.action.0.rewrite.0.prefix", attrName),
 												},
 											},
 											"prefix": {
@@ -179,7 +173,7 @@ func resourceGatewayRouteSpecSchema() *schema.Schema {
 														"value": {
 															Type:         schema.TypeString,
 															Optional:     true,
-															ValidateFunc: validation.StringMatch(regexp.MustCompile(`^/`), "must start with /"),
+															ValidateFunc: validation.StringMatch(regexache.MustCompile(`^/`), "must start with /"),
 															ExactlyOneOf: []string{
 																fmt.Sprintf("spec.0.%s.0.action.0.rewrite.0.prefix.0.default_prefix", attrName),
 																fmt.Sprintf("spec.0.%s.0.action.0.rewrite.0.prefix.0.value", attrName),
@@ -188,8 +182,39 @@ func resourceGatewayRouteSpecSchema() *schema.Schema {
 													},
 												},
 												AtLeastOneOf: []string{
-													fmt.Sprintf("spec.0.%s.0.action.0.rewrite.0.prefix", attrName),
 													fmt.Sprintf("spec.0.%s.0.action.0.rewrite.0.hostname", attrName),
+													fmt.Sprintf("spec.0.%s.0.action.0.rewrite.0.path", attrName),
+													fmt.Sprintf("spec.0.%s.0.action.0.rewrite.0.prefix", attrName),
+												},
+											},
+										},
+									},
+								},
+								"target": {
+									Type:     schema.TypeList,
+									Required: true,
+									MinItems: 1,
+									MaxItems: 1,
+									Elem: &schema.Resource{
+										Schema: map[string]*schema.Schema{
+											"port": {
+												Type:         schema.TypeInt,
+												Optional:     true,
+												ValidateFunc: validation.IsPortNumber,
+											},
+											"virtual_service": {
+												Type:     schema.TypeList,
+												Required: true,
+												MinItems: 1,
+												MaxItems: 1,
+												Elem: &schema.Resource{
+													Schema: map[string]*schema.Schema{
+														"virtual_service_name": {
+															Type:         schema.TypeString,
+															Required:     true,
+															ValidateFunc: validation.StringLenBetween(1, 255),
+														},
+													},
 												},
 											},
 										},
@@ -324,8 +349,8 @@ func resourceGatewayRouteSpecSchema() *schema.Schema {
 										},
 									},
 									AtLeastOneOf: []string{
-										fmt.Sprintf("spec.0.%s.0.match.0.path", attrName),
 										fmt.Sprintf("spec.0.%s.0.match.0.hostname", attrName),
+										fmt.Sprintf("spec.0.%s.0.match.0.path", attrName),
 										fmt.Sprintf("spec.0.%s.0.match.0.prefix", attrName),
 									},
 								},
@@ -337,11 +362,11 @@ func resourceGatewayRouteSpecSchema() *schema.Schema {
 								"prefix": {
 									Type:         schema.TypeString,
 									Optional:     true,
-									ValidateFunc: validation.StringMatch(regexp.MustCompile(`^/`), "must start with /"),
+									ValidateFunc: validation.StringMatch(regexache.MustCompile(`^/`), "must start with /"),
 									AtLeastOneOf: []string{
-										fmt.Sprintf("spec.0.%s.0.match.0.prefix", attrName),
 										fmt.Sprintf("spec.0.%s.0.match.0.hostname", attrName),
 										fmt.Sprintf("spec.0.%s.0.match.0.path", attrName),
+										fmt.Sprintf("spec.0.%s.0.match.0.prefix", attrName),
 									},
 								},
 								"query_parameter": {
@@ -780,6 +805,15 @@ func expandHTTPGatewayRouteRewrite(vHttpRouteRewrite []interface{}) *appmesh.Htt
 		routeRewrite.Hostname = routeHostnameRewrite
 	}
 
+	if vRoutePathRewrite, ok := mRouteRewrite["path"].([]interface{}); ok && len(vRoutePathRewrite) > 0 && vRoutePathRewrite[0] != nil {
+		mRoutePathRewrite := vRoutePathRewrite[0].(map[string]interface{})
+		routePathRewrite := &appmesh.HttpGatewayRoutePathRewrite{}
+		if vExact, ok := mRoutePathRewrite["exact"].(string); ok && vExact != "" {
+			routePathRewrite.Exact = aws.String(vExact)
+		}
+		routeRewrite.Path = routePathRewrite
+	}
+
 	if vRoutePrefixRewrite, ok := mRouteRewrite["prefix"].([]interface{}); ok && len(vRoutePrefixRewrite) > 0 && vRoutePrefixRewrite[0] != nil {
 		mRoutePrefixRewrite := vRoutePrefixRewrite[0].(map[string]interface{})
 		routePrefixRewrite := &appmesh.HttpGatewayRoutePrefixRewrite{}
@@ -1133,6 +1167,13 @@ func flattenHTTPGatewayRouteRewrite(routeRewrite *appmesh.HttpGatewayRouteRewrit
 		mRouteRewrite["hostname"] = []interface{}{mRewriteHostname}
 	}
 
+	if rewritePath := routeRewrite.Path; rewritePath != nil {
+		mRewritePath := map[string]interface{}{
+			"exact": aws.StringValue(rewritePath.Exact),
+		}
+		mRouteRewrite["path"] = []interface{}{mRewritePath}
+	}
+
 	if rewritePrefix := routeRewrite.Prefix; rewritePrefix != nil {
 		mRewritePrefix := map[string]interface{}{
 			"default_prefix": aws.StringValue(rewritePrefix.DefaultPrefix),
diff --git a/internal/service/appmesh/gateway_route_data_source.go b/internal/service/appmesh/gateway_route_data_source.go
index 1cae83fd334..77b66b00fc0 100644
--- a/internal/service/appmesh/gateway_route_data_source.go
+++ b/internal/service/appmesh/gateway_route_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appmesh
 
 import (
diff --git a/internal/service/appmesh/gateway_route_data_source_test.go b/internal/service/appmesh/gateway_route_data_source_test.go
index 4b2da858f38..08a07516793 100644
--- a/internal/service/appmesh/gateway_route_data_source_test.go
+++ b/internal/service/appmesh/gateway_route_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appmesh_test
 
 import (
diff --git a/internal/service/appmesh/gateway_route_test.go b/internal/service/appmesh/gateway_route_test.go
index 50162fe886e..406e3f10c7f 100644
--- a/internal/service/appmesh/gateway_route_test.go
+++ b/internal/service/appmesh/gateway_route_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appmesh_test
 
 import (
@@ -462,6 +465,37 @@ func testAccGatewayRoute_httpRoute(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 				),
 			},
+			{
+				Config: testAccGatewayRouteConfig_httpRouteRewriteWithPath(meshName, vgName, grName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckGatewayRouteExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "mesh_name", meshName),
+					acctest.CheckResourceAttrAccountID(resourceName, "mesh_owner"),
+					resource.TestCheckResourceAttr(resourceName, "name", grName),
+					resource.TestCheckResourceAttr(resourceName, "spec.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "spec.0.grpc_route.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "spec.0.http2_route.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "spec.0.http_route.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "spec.0.http_route.0.action.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "spec.0.http_route.0.action.0.target.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "spec.0.http_route.0.action.0.target.0.virtual_service.#", "1"),
+					resource.TestCheckResourceAttrPair(resourceName, "spec.0.http_route.0.action.0.target.0.virtual_service.0.virtual_service_name", vs1ResourceName, "name"),
+					resource.TestCheckResourceAttr(resourceName, "spec.0.http_route.0.action.0.rewrite.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "spec.0.http_route.0.action.0.rewrite.0.hostname.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "spec.0.http_route.0.action.0.rewrite.0.prefix.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "spec.0.http_route.0.action.0.rewrite.0.path.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "spec.0.http_route.0.action.0.rewrite.0.path.0.exact", "/rewrite_path"),
+					resource.TestCheckResourceAttr(resourceName, "spec.0.http_route.0.match.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "spec.0.http_route.0.match.0.path.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "spec.0.http_route.0.match.0.path.0.exact", "/match_path"),
+					resource.TestCheckResourceAttr(resourceName, "virtual_gateway_name", vgName),
+					resource.TestCheckResourceAttrSet(resourceName, "created_date"),
+					resource.TestCheckResourceAttrSet(resourceName, "last_updated_date"),
+					acctest.CheckResourceAttrAccountID(resourceName, "resource_owner"),
+					acctest.CheckResourceAttrRegionalARN(resourceName, "arn", "appmesh", fmt.Sprintf("mesh/%s/virtualGateway/%s/gatewayRoute/%s", meshName, vgName, grName)),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
+				),
+			},
 			{
 				ResourceName:      resourceName,
 				ImportStateIdFunc: testAccGatewayRouteImportStateIdFunc(resourceName),
@@ -730,6 +764,37 @@ func testAccGatewayRoute_httpRouteWithPort(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 				),
 			},
+			{
+				Config: testAccGatewayRouteConfig_httpRouteRewriteWithPath(meshName, vgName, grName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckGatewayRouteExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "mesh_name", meshName),
+					acctest.CheckResourceAttrAccountID(resourceName, "mesh_owner"),
+					resource.TestCheckResourceAttr(resourceName, "name", grName),
+					resource.TestCheckResourceAttr(resourceName, "spec.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "spec.0.grpc_route.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "spec.0.http2_route.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "spec.0.http_route.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "spec.0.http_route.0.action.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "spec.0.http_route.0.action.0.target.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "spec.0.http_route.0.action.0.target.0.virtual_service.#", "1"),
+					resource.TestCheckResourceAttrPair(resourceName, "spec.0.http_route.0.action.0.target.0.virtual_service.0.virtual_service_name", vs1ResourceName, "name"),
+					resource.TestCheckResourceAttr(resourceName, "spec.0.http_route.0.action.0.rewrite.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "spec.0.http_route.0.action.0.rewrite.0.hostname.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "spec.0.http_route.0.action.0.rewrite.0.prefix.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "spec.0.http_route.0.action.0.rewrite.0.path.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "spec.0.http_route.0.action.0.rewrite.0.path.0.exact", "/rewrite_path"),
+					resource.TestCheckResourceAttr(resourceName, "spec.0.http_route.0.match.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "spec.0.http_route.0.match.0.path.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "spec.0.http_route.0.match.0.path.0.exact", "/match_path"),
+					resource.TestCheckResourceAttr(resourceName, "virtual_gateway_name", vgName),
+					resource.TestCheckResourceAttrSet(resourceName, "created_date"),
+					resource.TestCheckResourceAttrSet(resourceName, "last_updated_date"),
+					acctest.CheckResourceAttrAccountID(resourceName, "resource_owner"),
+					acctest.CheckResourceAttrRegionalARN(resourceName, "arn", "appmesh", fmt.Sprintf("mesh/%s/virtualGateway/%s/gatewayRoute/%s", meshName, vgName, grName)),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
+				),
+			},
 			{
 				ResourceName:      resourceName,
 				ImportStateIdFunc: testAccGatewayRouteImportStateIdFunc(resourceName),
@@ -890,6 +955,37 @@ func testAccGatewayRoute_http2Route(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 				),
 			},
+			{
+				Config: testAccGatewayRouteConfig_http2RouteRewriteWithPath(meshName, vgName, grName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckGatewayRouteExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "mesh_name", meshName),
+					acctest.CheckResourceAttrAccountID(resourceName, "mesh_owner"),
+					resource.TestCheckResourceAttr(resourceName, "name", grName),
+					resource.TestCheckResourceAttr(resourceName, "spec.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "spec.0.grpc_route.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "spec.0.http2_route.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "spec.0.http2_route.0.action.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "spec.0.http2_route.0.action.0.target.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "spec.0.http2_route.0.action.0.target.0.virtual_service.#", "1"),
+					resource.TestCheckResourceAttrPair(resourceName, "spec.0.http2_route.0.action.0.target.0.virtual_service.0.virtual_service_name", vs1ResourceName, "name"),
+					resource.TestCheckResourceAttr(resourceName, "spec.0.http2_route.0.action.0.rewrite.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "spec.0.http2_route.0.action.0.rewrite.0.hostname.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "spec.0.http2_route.0.action.0.rewrite.0.prefix.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "spec.0.http2_route.0.action.0.rewrite.0.path.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "spec.0.http2_route.0.action.0.rewrite.0.path.0.exact", "/rewrite_path"),
+					resource.TestCheckResourceAttr(resourceName, "spec.0.http2_route.0.match.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "spec.0.http2_route.0.match.0.path.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "spec.0.http2_route.0.match.0.path.0.exact", "/match_path"),
+					resource.TestCheckResourceAttr(resourceName, "spec.0.http_route.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "virtual_gateway_name", vgName),
+					resource.TestCheckResourceAttrSet(resourceName, "created_date"),
+					resource.TestCheckResourceAttrSet(resourceName, "last_updated_date"),
+					acctest.CheckResourceAttrAccountID(resourceName, "resource_owner"),
+					acctest.CheckResourceAttrRegionalARN(resourceName, "arn", "appmesh", fmt.Sprintf("mesh/%s/virtualGateway/%s/gatewayRoute/%s", meshName, vgName, grName)),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
+				),
+			},
 			{
 				ResourceName:      resourceName,
 				ImportStateIdFunc: testAccGatewayRouteImportStateIdFunc(resourceName),
@@ -1101,6 +1197,37 @@ func testAccGatewayRoute_http2RouteWithPort(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 				),
 			},
+			{
+				Config: testAccGatewayRouteConfig_http2RouteRewriteWithPath(meshName, vgName, grName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckGatewayRouteExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "mesh_name", meshName),
+					acctest.CheckResourceAttrAccountID(resourceName, "mesh_owner"),
+					resource.TestCheckResourceAttr(resourceName, "name", grName),
+					resource.TestCheckResourceAttr(resourceName, "spec.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "spec.0.grpc_route.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "spec.0.http2_route.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "spec.0.http2_route.0.action.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "spec.0.http2_route.0.action.0.target.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "spec.0.http2_route.0.action.0.target.0.virtual_service.#", "1"),
+					resource.TestCheckResourceAttrPair(resourceName, "spec.0.http2_route.0.action.0.target.0.virtual_service.0.virtual_service_name", vs1ResourceName, "name"),
+					resource.TestCheckResourceAttr(resourceName, "spec.0.http2_route.0.action.0.rewrite.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "spec.0.http2_route.0.action.0.rewrite.0.hostname.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "spec.0.http2_route.0.action.0.rewrite.0.prefix.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "spec.0.http2_route.0.action.0.rewrite.0.path.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "spec.0.http2_route.0.action.0.rewrite.0.path.0.exact", "/rewrite_path"),
+					resource.TestCheckResourceAttr(resourceName, "spec.0.http2_route.0.match.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "spec.0.http2_route.0.match.0.path.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "spec.0.http2_route.0.match.0.path.0.exact", "/match_path"),
+					resource.TestCheckResourceAttr(resourceName, "spec.0.http_route.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "virtual_gateway_name", vgName),
+					resource.TestCheckResourceAttrSet(resourceName, "created_date"),
+					resource.TestCheckResourceAttrSet(resourceName, "last_updated_date"),
+					acctest.CheckResourceAttrAccountID(resourceName, "resource_owner"),
+					acctest.CheckResourceAttrRegionalARN(resourceName, "arn", "appmesh", fmt.Sprintf("mesh/%s/virtualGateway/%s/gatewayRoute/%s", meshName, vgName, grName)),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
+				),
+			},
 			{
 				ResourceName:      resourceName,
 				ImportStateIdFunc: testAccGatewayRouteImportStateIdFunc(resourceName),
@@ -1783,6 +1910,39 @@ resource "aws_appmesh_gateway_route" "test" {
 `, grName))
 }
 
+func testAccGatewayRouteConfig_httpRouteRewriteWithPath(meshName, vgName, grName string) string {
+	return acctest.ConfigCompose(testAccGatewayRouteConfig_base(meshName, vgName, "http"), fmt.Sprintf(`
+resource "aws_appmesh_gateway_route" "test" {
+  name                 = %[1]q
+  mesh_name            = aws_appmesh_mesh.test.name
+  virtual_gateway_name = aws_appmesh_virtual_gateway.test.name
+
+  spec {
+    http_route {
+      action {
+        target {
+          virtual_service {
+            virtual_service_name = aws_appmesh_virtual_service.test[0].name
+          }
+        }
+        rewrite {
+          path {
+            exact = "/rewrite_path"
+          }
+        }
+      }
+
+      match {
+        path {
+          exact = "/match_path"
+        }
+      }
+    }
+  }
+}
+`, grName))
+}
+
 func testAccGatewayRouteConfig_http2Route(meshName, vgName, grName string) string {
 	return acctest.ConfigCompose(testAccGatewayRouteConfig_base(meshName, vgName, "http2"), fmt.Sprintf(`
 resource "aws_appmesh_gateway_route" "test" {
@@ -2066,6 +2226,39 @@ resource "aws_appmesh_gateway_route" "test" {
 `, grName))
 }
 
+func testAccGatewayRouteConfig_http2RouteRewriteWithPath(meshName, vgName, grName string) string {
+	return acctest.ConfigCompose(testAccGatewayRouteConfig_base(meshName, vgName, "http2"), fmt.Sprintf(`
+resource "aws_appmesh_gateway_route" "test" {
+  name                 = %[1]q
+  mesh_name            = aws_appmesh_mesh.test.name
+  virtual_gateway_name = aws_appmesh_virtual_gateway.test.name
+
+  spec {
+    http2_route {
+      action {
+        target {
+          virtual_service {
+            virtual_service_name = aws_appmesh_virtual_service.test[0].name
+          }
+        }
+        rewrite {
+          path {
+            exact = "/rewrite_path"
+          }
+        }
+      }
+
+      match {
+        path {
+          exact = "/match_path"
+        }
+      }
+    }
+  }
+}
+`, grName))
+}
+
 func testAccGatewayRouteConfig_tags1(meshName, vgName, grName, tagKey1, tagValue1 string) string {
 	return acctest.ConfigCompose(testAccGatewayRouteConfig_base(meshName, vgName, "http"), fmt.Sprintf(`
 resource "aws_appmesh_gateway_route" "test" {
diff --git a/internal/service/appmesh/generate.go b/internal/service/appmesh/generate.go
index f4785c610fc..4793092a6aa 100644
--- a/internal/service/appmesh/generate.go
+++ b/internal/service/appmesh/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTags -ServiceTagsSlice -TagType=TagRef -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/appmesh/mesh.go b/internal/service/appmesh/mesh.go
index 705837fb1ba..043d4cfedb2 100644
--- a/internal/service/appmesh/mesh.go
+++ b/internal/service/appmesh/mesh.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appmesh
 
 import (
diff --git a/internal/service/appmesh/mesh_data_source.go b/internal/service/appmesh/mesh_data_source.go
index 8c39720a5fe..ccd8bb95f23 100644
--- a/internal/service/appmesh/mesh_data_source.go
+++ b/internal/service/appmesh/mesh_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appmesh
 
 import (
diff --git a/internal/service/appmesh/mesh_data_source_test.go b/internal/service/appmesh/mesh_data_source_test.go
index 954315add1c..8ab21f423f1 100644
--- a/internal/service/appmesh/mesh_data_source_test.go
+++ b/internal/service/appmesh/mesh_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appmesh_test
 
 import (
diff --git a/internal/service/appmesh/mesh_test.go b/internal/service/appmesh/mesh_test.go
index a6c2d76c11e..836ae154f43 100644
--- a/internal/service/appmesh/mesh_test.go
+++ b/internal/service/appmesh/mesh_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appmesh_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/appmesh"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -32,7 +35,7 @@ func testAccMesh_basic(t *testing.T) {
 				Config: testAccMeshConfig_basic(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckMeshExists(ctx, resourceName, &mesh),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "appmesh", regexp.MustCompile(`mesh/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "appmesh", regexache.MustCompile(`mesh/.+`)),
 					resource.TestCheckResourceAttrSet(resourceName, "created_date"),
 					resource.TestCheckResourceAttrSet(resourceName, "last_updated_date"),
 					acctest.CheckResourceAttrAccountID(resourceName, "mesh_owner"),
diff --git a/internal/service/appmesh/route.go b/internal/service/appmesh/route.go
index 62cf4bee5f8..06e11f8f63a 100644
--- a/internal/service/appmesh/route.go
+++ b/internal/service/appmesh/route.go
@@ -1,13 +1,16 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appmesh
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"strings"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/appmesh"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -240,7 +243,7 @@ func resourceRouteSpecSchema() *schema.Schema {
 								"prefix": {
 									Type:         schema.TypeString,
 									Optional:     true,
-									ValidateFunc: validation.StringMatch(regexp.MustCompile(`^/`), "must start with /"),
+									ValidateFunc: validation.StringMatch(regexache.MustCompile(`^/`), "must start with /"),
 								},
 								"query_parameter": {
 									Type:     schema.TypeSet,
diff --git a/internal/service/appmesh/route_data_source.go b/internal/service/appmesh/route_data_source.go
index 3c086196dca..f8eee5ef00a 100644
--- a/internal/service/appmesh/route_data_source.go
+++ b/internal/service/appmesh/route_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appmesh
 
 import (
diff --git a/internal/service/appmesh/route_data_source_test.go b/internal/service/appmesh/route_data_source_test.go
index c7fe4d7f7e9..c4d8201bdb6 100644
--- a/internal/service/appmesh/route_data_source_test.go
+++ b/internal/service/appmesh/route_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appmesh_test
 
 import (
diff --git a/internal/service/appmesh/route_test.go b/internal/service/appmesh/route_test.go
index e29b6a8f397..e4e8f2aa069 100644
--- a/internal/service/appmesh/route_test.go
+++ b/internal/service/appmesh/route_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appmesh_test
 
 import (
diff --git a/internal/service/appmesh/service_package_gen.go b/internal/service/appmesh/service_package_gen.go
index eccfd2dd027..a09059d9d56 100644
--- a/internal/service/appmesh/service_package_gen.go
+++ b/internal/service/appmesh/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	appmesh_sdkv1 "github.com/aws/aws-sdk-go/service/appmesh"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -127,4 +128,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*a
 	return appmesh_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/appmesh/sweep.go b/internal/service/appmesh/sweep.go
index 99f12b69221..bccaf0a689a 100644
--- a/internal/service/appmesh/sweep.go
+++ b/internal/service/appmesh/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package appmesh
 
@@ -12,9 +12,10 @@ import (
 	multierror "github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_appmesh_gateway_route", &resource.Sweeper{
 		Name: "aws_appmesh_gateway_route",
 		F:    sweepGatewayRoutes,
@@ -65,7 +66,7 @@ func init() {
 
 func sweepMeshes(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -89,7 +90,7 @@ func sweepMeshes(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping App Mesh Service Mesh sweep for %s: %s", region, err)
 		return nil
 	}
@@ -98,7 +99,7 @@ func sweepMeshes(region string) error {
 		return fmt.Errorf("error listing App Mesh Service Meshes (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping App Mesh Service Meshes (%s): %w", region, err)
@@ -109,7 +110,7 @@ func sweepMeshes(region string) error {
 
 func sweepVirtualGateways(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
@@ -148,7 +149,7 @@ func sweepVirtualGateways(region string) error {
 				return !lastPage
 			})
 
-			if sweep.SkipSweepError(err) {
+			if awsv1.SkipSweepError(err) {
 				continue
 			}
 
@@ -160,7 +161,7 @@ func sweepVirtualGateways(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping App Mesh Virtual Gateway sweep for %s: %s", region, err)
 		return sweeperErrs.ErrorOrNil() // In case we have completed some pages, but had errors
 	}
@@ -169,7 +170,7 @@ func sweepVirtualGateways(region string) error {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error listing App Mesh Service Meshes (%s): %w", region, err))
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error sweeping App Mesh Virtual Gateways (%s): %w", region, err))
@@ -180,7 +181,7 @@ func sweepVirtualGateways(region string) error {
 
 func sweepVirtualNodes(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
@@ -219,7 +220,7 @@ func sweepVirtualNodes(region string) error {
 				return !lastPage
 			})
 
-			if sweep.SkipSweepError(err) {
+			if awsv1.SkipSweepError(err) {
 				continue
 			}
 
@@ -231,7 +232,7 @@ func sweepVirtualNodes(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping App Mesh Virtual Node sweep for %s: %s", region, err)
 		return sweeperErrs.ErrorOrNil() // In case we have completed some pages, but had errors
 	}
@@ -240,7 +241,7 @@ func sweepVirtualNodes(region string) error {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error listing App Mesh Service Meshes (%s): %w", region, err))
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error sweeping App Mesh Virtual Nodes (%s): %w", region, err))
@@ -251,7 +252,7 @@ func sweepVirtualNodes(region string) error {
 
 func sweepVirtualRouters(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -290,7 +291,7 @@ func sweepVirtualRouters(region string) error {
 				return !lastPage
 			})
 
-			if sweep.SkipSweepError(err) {
+			if awsv1.SkipSweepError(err) {
 				continue
 			}
 
@@ -302,7 +303,7 @@ func sweepVirtualRouters(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping App Mesh Virtual Router sweep for %s: %s", region, err)
 		return sweeperErrs.ErrorOrNil() // In case we have completed some pages, but had errors
 	}
@@ -311,7 +312,7 @@ func sweepVirtualRouters(region string) error {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error listing App Mesh Service Meshes (%s): %w", region, err))
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error sweeping App Mesh Virtual Routers (%s): %w", region, err))
@@ -322,7 +323,7 @@ func sweepVirtualRouters(region string) error {
 
 func sweepVirtualServices(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -361,7 +362,7 @@ func sweepVirtualServices(region string) error {
 				return !lastPage
 			})
 
-			if sweep.SkipSweepError(err) {
+			if awsv1.SkipSweepError(err) {
 				continue
 			}
 
@@ -373,7 +374,7 @@ func sweepVirtualServices(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping App Mesh Virtual Service sweep for %s: %s", region, err)
 		return sweeperErrs.ErrorOrNil() // In case we have completed some pages, but had errors
 	}
@@ -382,7 +383,7 @@ func sweepVirtualServices(region string) error {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error listing App Mesh Service Meshes (%s): %w", region, err))
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error sweeping App Mesh Virtual Services (%s): %w", region, err))
@@ -393,7 +394,7 @@ func sweepVirtualServices(region string) error {
 
 func sweepGatewayRoutes(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
@@ -445,7 +446,7 @@ func sweepGatewayRoutes(region string) error {
 						return !lastPage
 					})
 
-					if sweep.SkipSweepError(err) {
+					if awsv1.SkipSweepError(err) {
 						continue
 					}
 
@@ -457,7 +458,7 @@ func sweepGatewayRoutes(region string) error {
 				return !lastPage
 			})
 
-			if sweep.SkipSweepError(err) {
+			if awsv1.SkipSweepError(err) {
 				continue
 			}
 
@@ -469,7 +470,7 @@ func sweepGatewayRoutes(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping App Mesh Gateway Route sweep for %s: %s", region, err)
 		return sweeperErrs.ErrorOrNil() // In case we have completed some pages, but had errors
 	}
@@ -478,7 +479,7 @@ func sweepGatewayRoutes(region string) error {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error listing App Mesh Service Meshes (%s): %w", region, err))
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error sweeping App Mesh Gateway Routes (%s): %w", region, err))
@@ -489,7 +490,7 @@ func sweepGatewayRoutes(region string) error {
 
 func sweepRoutes(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -541,7 +542,7 @@ func sweepRoutes(region string) error {
 						return !lastPage
 					})
 
-					if sweep.SkipSweepError(err) {
+					if awsv1.SkipSweepError(err) {
 						continue
 					}
 
@@ -553,7 +554,7 @@ func sweepRoutes(region string) error {
 				return !lastPage
 			})
 
-			if sweep.SkipSweepError(err) {
+			if awsv1.SkipSweepError(err) {
 				continue
 			}
 
@@ -565,7 +566,7 @@ func sweepRoutes(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping App Mesh Route sweep for %s: %s", region, err)
 		return sweeperErrs.ErrorOrNil() // In case we have completed some pages, but had errors
 	}
@@ -574,7 +575,7 @@ func sweepRoutes(region string) error {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error listing App Mesh Service Meshes (%s): %w", region, err))
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error sweeping App Mesh Routes (%s): %w", region, err))
diff --git a/internal/service/appmesh/tags_gen.go b/internal/service/appmesh/tags_gen.go
index dd4fc3d9dd3..4f5d9cf6017 100644
--- a/internal/service/appmesh/tags_gen.go
+++ b/internal/service/appmesh/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/appmesh"
 	"github.com/aws/aws-sdk-go/service/appmesh/appmeshiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -102,6 +104,8 @@ func updateTags(ctx context.Context, conn appmeshiface.AppMeshAPI, identifier st
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.AppMesh)
 	if len(removedTags) > 0 {
diff --git a/internal/service/appmesh/virtual_gateway.go b/internal/service/appmesh/virtual_gateway.go
index ed49792ce25..ac37f5de06d 100644
--- a/internal/service/appmesh/virtual_gateway.go
+++ b/internal/service/appmesh/virtual_gateway.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appmesh
 
 import (
diff --git a/internal/service/appmesh/virtual_gateway_data_source.go b/internal/service/appmesh/virtual_gateway_data_source.go
index f3089b2a893..4480731d5f4 100644
--- a/internal/service/appmesh/virtual_gateway_data_source.go
+++ b/internal/service/appmesh/virtual_gateway_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appmesh
 
 import (
diff --git a/internal/service/appmesh/virtual_gateway_data_source_test.go b/internal/service/appmesh/virtual_gateway_data_source_test.go
index ffe066155e5..3a04e1c1b48 100644
--- a/internal/service/appmesh/virtual_gateway_data_source_test.go
+++ b/internal/service/appmesh/virtual_gateway_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appmesh_test
 
 import (
diff --git a/internal/service/appmesh/virtual_gateway_test.go b/internal/service/appmesh/virtual_gateway_test.go
index 1da4bb944bb..2c567f3f9b1 100644
--- a/internal/service/appmesh/virtual_gateway_test.go
+++ b/internal/service/appmesh/virtual_gateway_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appmesh_test
 
 import (
diff --git a/internal/service/appmesh/virtual_node.go b/internal/service/appmesh/virtual_node.go
index 7d79354a2eb..dfaeaa7ff70 100644
--- a/internal/service/appmesh/virtual_node.go
+++ b/internal/service/appmesh/virtual_node.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appmesh
 
 import (
diff --git a/internal/service/appmesh/virtual_node_data_source.go b/internal/service/appmesh/virtual_node_data_source.go
index cd24b472451..e9b439e79bc 100644
--- a/internal/service/appmesh/virtual_node_data_source.go
+++ b/internal/service/appmesh/virtual_node_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appmesh
 
 import (
diff --git a/internal/service/appmesh/virtual_node_data_source_test.go b/internal/service/appmesh/virtual_node_data_source_test.go
index d48e082a06d..c23487fcab9 100644
--- a/internal/service/appmesh/virtual_node_data_source_test.go
+++ b/internal/service/appmesh/virtual_node_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appmesh_test
 
 import (
diff --git a/internal/service/appmesh/virtual_node_migrate.go b/internal/service/appmesh/virtual_node_migrate.go
index b553ea311c1..0bbede1c97c 100644
--- a/internal/service/appmesh/virtual_node_migrate.go
+++ b/internal/service/appmesh/virtual_node_migrate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appmesh
 
 import (
diff --git a/internal/service/appmesh/virtual_node_migrate_test.go b/internal/service/appmesh/virtual_node_migrate_test.go
index c89fa0567c9..b0ec1bd380f 100644
--- a/internal/service/appmesh/virtual_node_migrate_test.go
+++ b/internal/service/appmesh/virtual_node_migrate_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appmesh_test
 
 import (
diff --git a/internal/service/appmesh/virtual_node_test.go b/internal/service/appmesh/virtual_node_test.go
index 3c9f56f48fa..6e3a7bd5d0f 100644
--- a/internal/service/appmesh/virtual_node_test.go
+++ b/internal/service/appmesh/virtual_node_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appmesh_test
 
 import (
diff --git a/internal/service/appmesh/virtual_router.go b/internal/service/appmesh/virtual_router.go
index 2c76b7e8cf9..186281f0c62 100644
--- a/internal/service/appmesh/virtual_router.go
+++ b/internal/service/appmesh/virtual_router.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appmesh
 
 import (
diff --git a/internal/service/appmesh/virtual_router_data_source.go b/internal/service/appmesh/virtual_router_data_source.go
index b0fd7e66104..9bc091b45b3 100644
--- a/internal/service/appmesh/virtual_router_data_source.go
+++ b/internal/service/appmesh/virtual_router_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appmesh
 
 import (
diff --git a/internal/service/appmesh/virtual_router_data_source_test.go b/internal/service/appmesh/virtual_router_data_source_test.go
index 9d220c64ef4..6329c8d2f80 100644
--- a/internal/service/appmesh/virtual_router_data_source_test.go
+++ b/internal/service/appmesh/virtual_router_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appmesh_test
 
 import (
diff --git a/internal/service/appmesh/virtual_router_migrate.go b/internal/service/appmesh/virtual_router_migrate.go
index a6b8a7675bd..f92e7c3b867 100644
--- a/internal/service/appmesh/virtual_router_migrate.go
+++ b/internal/service/appmesh/virtual_router_migrate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appmesh
 
 import (
diff --git a/internal/service/appmesh/virtual_router_migrate_test.go b/internal/service/appmesh/virtual_router_migrate_test.go
index 42a92d3f926..6c1d94eaa99 100644
--- a/internal/service/appmesh/virtual_router_migrate_test.go
+++ b/internal/service/appmesh/virtual_router_migrate_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appmesh_test
 
 import (
diff --git a/internal/service/appmesh/virtual_router_test.go b/internal/service/appmesh/virtual_router_test.go
index cc9e302f908..a84a503b814 100644
--- a/internal/service/appmesh/virtual_router_test.go
+++ b/internal/service/appmesh/virtual_router_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appmesh_test
 
 import (
diff --git a/internal/service/appmesh/virtual_service.go b/internal/service/appmesh/virtual_service.go
index c12722e805b..894f8c36f5d 100644
--- a/internal/service/appmesh/virtual_service.go
+++ b/internal/service/appmesh/virtual_service.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appmesh
 
 import (
diff --git a/internal/service/appmesh/virtual_service_data_source.go b/internal/service/appmesh/virtual_service_data_source.go
index 600a6473666..54916c0ac05 100644
--- a/internal/service/appmesh/virtual_service_data_source.go
+++ b/internal/service/appmesh/virtual_service_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appmesh
 
 import (
diff --git a/internal/service/appmesh/virtual_service_data_source_test.go b/internal/service/appmesh/virtual_service_data_source_test.go
index 3c50e8f8348..8a46869002a 100644
--- a/internal/service/appmesh/virtual_service_data_source_test.go
+++ b/internal/service/appmesh/virtual_service_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appmesh_test
 
 import (
diff --git a/internal/service/appmesh/virtual_service_test.go b/internal/service/appmesh/virtual_service_test.go
index 4761c82b597..6c68fc7a3ae 100644
--- a/internal/service/appmesh/virtual_service_test.go
+++ b/internal/service/appmesh/virtual_service_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appmesh_test
 
 import (
diff --git a/internal/service/appmesh/wait.go b/internal/service/appmesh/wait.go
index 9be690a2d0c..0dbb7547ee3 100644
--- a/internal/service/appmesh/wait.go
+++ b/internal/service/appmesh/wait.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appmesh
 
 import (
diff --git a/internal/service/apprunner/auto_scaling_configuration_version.go b/internal/service/apprunner/auto_scaling_configuration_version.go
index a97ec6af34a..bebb07b0d42 100644
--- a/internal/service/apprunner/auto_scaling_configuration_version.go
+++ b/internal/service/apprunner/auto_scaling_configuration_version.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apprunner
 
 import (
diff --git a/internal/service/apprunner/auto_scaling_configuration_version_test.go b/internal/service/apprunner/auto_scaling_configuration_version_test.go
index 9355db4ea57..13c34d93f07 100644
--- a/internal/service/apprunner/auto_scaling_configuration_version_test.go
+++ b/internal/service/apprunner/auto_scaling_configuration_version_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apprunner_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/apprunner"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -32,7 +35,7 @@ func TestAccAppRunnerAutoScalingConfigurationVersion_basic(t *testing.T) {
 				Config: testAccAutoScalingConfigurationVersionConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckAutoScalingConfigurationVersionExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "apprunner", regexp.MustCompile(fmt.Sprintf(`autoscalingconfiguration/%s/1/.+`, rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "apprunner", regexache.MustCompile(fmt.Sprintf(`autoscalingconfiguration/%s/1/.+`, rName))),
 					resource.TestCheckResourceAttr(resourceName, "auto_scaling_configuration_name", rName),
 					resource.TestCheckResourceAttr(resourceName, "auto_scaling_configuration_revision", "1"),
 					resource.TestCheckResourceAttr(resourceName, "latest", "true"),
@@ -66,7 +69,7 @@ func TestAccAppRunnerAutoScalingConfigurationVersion_complex(t *testing.T) {
 				Config: testAccAutoScalingConfigurationVersionConfig_nonDefaults(rName, 50, 10, 2),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckAutoScalingConfigurationVersionExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "apprunner", regexp.MustCompile(fmt.Sprintf(`autoscalingconfiguration/%s/1/.+`, rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "apprunner", regexache.MustCompile(fmt.Sprintf(`autoscalingconfiguration/%s/1/.+`, rName))),
 					resource.TestCheckResourceAttr(resourceName, "auto_scaling_configuration_name", rName),
 					resource.TestCheckResourceAttr(resourceName, "auto_scaling_configuration_revision", "1"),
 					resource.TestCheckResourceAttr(resourceName, "latest", "true"),
@@ -86,7 +89,7 @@ func TestAccAppRunnerAutoScalingConfigurationVersion_complex(t *testing.T) {
 				Config: testAccAutoScalingConfigurationVersionConfig_nonDefaults(rName, 150, 20, 5),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckAutoScalingConfigurationVersionExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "apprunner", regexp.MustCompile(fmt.Sprintf(`autoscalingconfiguration/%s/1/.+`, rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "apprunner", regexache.MustCompile(fmt.Sprintf(`autoscalingconfiguration/%s/1/.+`, rName))),
 					resource.TestCheckResourceAttr(resourceName, "auto_scaling_configuration_name", rName),
 					resource.TestCheckResourceAttr(resourceName, "auto_scaling_configuration_revision", "1"),
 					resource.TestCheckResourceAttr(resourceName, "latest", "true"),
@@ -106,7 +109,7 @@ func TestAccAppRunnerAutoScalingConfigurationVersion_complex(t *testing.T) {
 				Config: testAccAutoScalingConfigurationVersionConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckAutoScalingConfigurationVersionExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "apprunner", regexp.MustCompile(fmt.Sprintf(`autoscalingconfiguration/%s/1/.+`, rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "apprunner", regexache.MustCompile(fmt.Sprintf(`autoscalingconfiguration/%s/1/.+`, rName))),
 					resource.TestCheckResourceAttr(resourceName, "auto_scaling_configuration_name", rName),
 					resource.TestCheckResourceAttr(resourceName, "auto_scaling_configuration_revision", "1"),
 					resource.TestCheckResourceAttr(resourceName, "latest", "true"),
@@ -137,7 +140,7 @@ func TestAccAppRunnerAutoScalingConfigurationVersion_multipleVersions(t *testing
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckAutoScalingConfigurationVersionExists(ctx, resourceName),
 					testAccCheckAutoScalingConfigurationVersionExists(ctx, otherResourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "apprunner", regexp.MustCompile(fmt.Sprintf(`autoscalingconfiguration/%s/1/.+`, rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "apprunner", regexache.MustCompile(fmt.Sprintf(`autoscalingconfiguration/%s/1/.+`, rName))),
 					resource.TestCheckResourceAttr(resourceName, "auto_scaling_configuration_name", rName),
 					resource.TestCheckResourceAttr(resourceName, "auto_scaling_configuration_revision", "1"),
 					resource.TestCheckResourceAttr(resourceName, "latest", "true"),
@@ -145,7 +148,7 @@ func TestAccAppRunnerAutoScalingConfigurationVersion_multipleVersions(t *testing
 					resource.TestCheckResourceAttr(resourceName, "max_size", "25"),
 					resource.TestCheckResourceAttr(resourceName, "min_size", "1"),
 					resource.TestCheckResourceAttr(resourceName, "status", tfapprunner.AutoScalingConfigurationStatusActive),
-					acctest.MatchResourceAttrRegionalARN(otherResourceName, "arn", "apprunner", regexp.MustCompile(fmt.Sprintf(`autoscalingconfiguration/%s/2/.+`, rName))),
+					acctest.MatchResourceAttrRegionalARN(otherResourceName, "arn", "apprunner", regexache.MustCompile(fmt.Sprintf(`autoscalingconfiguration/%s/2/.+`, rName))),
 					resource.TestCheckResourceAttr(otherResourceName, "auto_scaling_configuration_name", rName),
 					resource.TestCheckResourceAttr(otherResourceName, "auto_scaling_configuration_revision", "2"),
 					resource.TestCheckResourceAttr(otherResourceName, "latest", "true"),
@@ -203,7 +206,7 @@ func TestAccAppRunnerAutoScalingConfigurationVersion_updateMultipleVersions(t *t
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckAutoScalingConfigurationVersionExists(ctx, resourceName),
 					testAccCheckAutoScalingConfigurationVersionExists(ctx, otherResourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "apprunner", regexp.MustCompile(fmt.Sprintf(`autoscalingconfiguration/%s/1/.+`, rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "apprunner", regexache.MustCompile(fmt.Sprintf(`autoscalingconfiguration/%s/1/.+`, rName))),
 					resource.TestCheckResourceAttr(resourceName, "auto_scaling_configuration_name", rName),
 					resource.TestCheckResourceAttr(resourceName, "auto_scaling_configuration_revision", "1"),
 					resource.TestCheckResourceAttr(resourceName, "latest", "false"),
@@ -211,7 +214,7 @@ func TestAccAppRunnerAutoScalingConfigurationVersion_updateMultipleVersions(t *t
 					resource.TestCheckResourceAttr(resourceName, "max_size", "25"),
 					resource.TestCheckResourceAttr(resourceName, "min_size", "1"),
 					resource.TestCheckResourceAttr(resourceName, "status", tfapprunner.AutoScalingConfigurationStatusActive),
-					acctest.MatchResourceAttrRegionalARN(otherResourceName, "arn", "apprunner", regexp.MustCompile(fmt.Sprintf(`autoscalingconfiguration/%s/2/.+`, rName))),
+					acctest.MatchResourceAttrRegionalARN(otherResourceName, "arn", "apprunner", regexache.MustCompile(fmt.Sprintf(`autoscalingconfiguration/%s/2/.+`, rName))),
 					resource.TestCheckResourceAttr(otherResourceName, "auto_scaling_configuration_name", rName),
 					resource.TestCheckResourceAttr(otherResourceName, "auto_scaling_configuration_revision", "2"),
 					resource.TestCheckResourceAttr(otherResourceName, "latest", "true"),
diff --git a/internal/service/apprunner/connection.go b/internal/service/apprunner/connection.go
index b4495e9aafe..6dcee52f5dc 100644
--- a/internal/service/apprunner/connection.go
+++ b/internal/service/apprunner/connection.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apprunner
 
 import (
diff --git a/internal/service/apprunner/connection_test.go b/internal/service/apprunner/connection_test.go
index 5c14ea27a20..de8db9186e2 100644
--- a/internal/service/apprunner/connection_test.go
+++ b/internal/service/apprunner/connection_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apprunner_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/apprunner"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -31,7 +34,7 @@ func TestAccAppRunnerConnection_basic(t *testing.T) {
 				Config: testAccConnectionConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckConnectionExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "apprunner", regexp.MustCompile(fmt.Sprintf(`connection/%s/.+`, rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "apprunner", regexache.MustCompile(fmt.Sprintf(`connection/%s/.+`, rName))),
 					resource.TestCheckResourceAttr(resourceName, "connection_name", rName),
 					resource.TestCheckResourceAttr(resourceName, "provider_type", apprunner.ProviderTypeGithub),
 					resource.TestCheckResourceAttr(resourceName, "status", apprunner.ConnectionStatusPendingHandshake),
diff --git a/internal/service/apprunner/consts.go b/internal/service/apprunner/consts.go
index 59eb6f17648..bcb5ff0621f 100644
--- a/internal/service/apprunner/consts.go
+++ b/internal/service/apprunner/consts.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apprunner
 
 import (
diff --git a/internal/service/apprunner/custom_domain_association.go b/internal/service/apprunner/custom_domain_association.go
index 0f94272b9f8..80b20b3c5f4 100644
--- a/internal/service/apprunner/custom_domain_association.go
+++ b/internal/service/apprunner/custom_domain_association.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apprunner
 
 import (
diff --git a/internal/service/apprunner/custom_domain_association_test.go b/internal/service/apprunner/custom_domain_association_test.go
index 7e87e1f2cf2..242630c8b3f 100644
--- a/internal/service/apprunner/custom_domain_association_test.go
+++ b/internal/service/apprunner/custom_domain_association_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apprunner_test
 
 import (
diff --git a/internal/service/apprunner/find.go b/internal/service/apprunner/find.go
index e58743f8133..6c9d59a8094 100644
--- a/internal/service/apprunner/find.go
+++ b/internal/service/apprunner/find.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apprunner
 
 import (
diff --git a/internal/service/apprunner/generate.go b/internal/service/apprunner/generate.go
index 6d8dd701567..60033f1570c 100644
--- a/internal/service/apprunner/generate.go
+++ b/internal/service/apprunner/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTags -ServiceTagsSlice -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/apprunner/id.go b/internal/service/apprunner/id.go
index 1674c942501..dfe437e27de 100644
--- a/internal/service/apprunner/id.go
+++ b/internal/service/apprunner/id.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apprunner
 
 import (
diff --git a/internal/service/apprunner/id_test.go b/internal/service/apprunner/id_test.go
index 9f2b1702ae6..9782b792f1f 100644
--- a/internal/service/apprunner/id_test.go
+++ b/internal/service/apprunner/id_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apprunner_test
 
 import (
diff --git a/internal/service/apprunner/observability_configuration.go b/internal/service/apprunner/observability_configuration.go
index 0cdcd9aa647..33b0d2599cc 100644
--- a/internal/service/apprunner/observability_configuration.go
+++ b/internal/service/apprunner/observability_configuration.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apprunner
 
 import (
diff --git a/internal/service/apprunner/observability_configuration_version_test.go b/internal/service/apprunner/observability_configuration_version_test.go
index 688c2354b25..69e5bf018ff 100644
--- a/internal/service/apprunner/observability_configuration_version_test.go
+++ b/internal/service/apprunner/observability_configuration_version_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apprunner_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/apprunner"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -32,7 +35,7 @@ func TestAccAppRunnerObservabilityConfiguration_basic(t *testing.T) {
 				Config: testAccObservabilityConfigurationConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckObservabilityConfigurationExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "apprunner", regexp.MustCompile(fmt.Sprintf(`observabilityconfiguration/%s/1/.+`, rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "apprunner", regexache.MustCompile(fmt.Sprintf(`observabilityconfiguration/%s/1/.+`, rName))),
 					resource.TestCheckResourceAttr(resourceName, "observability_configuration_name", rName),
 					resource.TestCheckResourceAttr(resourceName, "observability_configuration_revision", "1"),
 					resource.TestCheckResourceAttr(resourceName, "status", tfapprunner.ObservabilityConfigurationStatusActive),
@@ -62,7 +65,7 @@ func TestAccAppRunnerObservabilityConfiguration_traceConfiguration(t *testing.T)
 				Config: testAccObservabilityConfigurationConfig_traceConfiguration(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckObservabilityConfigurationExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "apprunner", regexp.MustCompile(fmt.Sprintf(`observabilityconfiguration/%s/1/.+`, rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "apprunner", regexache.MustCompile(fmt.Sprintf(`observabilityconfiguration/%s/1/.+`, rName))),
 					resource.TestCheckResourceAttr(resourceName, "observability_configuration_name", rName),
 					resource.TestCheckResourceAttr(resourceName, "observability_configuration_revision", "1"),
 					resource.TestCheckResourceAttr(resourceName, "status", tfapprunner.ObservabilityConfigurationStatusActive),
diff --git a/internal/service/apprunner/service.go b/internal/service/apprunner/service.go
index 36ab3f419cd..8c390ec088e 100644
--- a/internal/service/apprunner/service.go
+++ b/internal/service/apprunner/service.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apprunner
 
 import (
 	"context"
 	"log"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/apprunner"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -128,7 +131,7 @@ func ResourceService() *schema.Resource {
 							Type:         schema.TypeString,
 							Optional:     true,
 							Default:      "1024",
-							ValidateFunc: validation.StringMatch(regexp.MustCompile(`256|512|1024|2048|4096|(0.25|0.5|1|2|4) vCPU`), ""),
+							ValidateFunc: validation.StringMatch(regexache.MustCompile(`256|512|1024|2048|4096|(0.25|0.5|1|2|4) vCPU`), ""),
 							DiffSuppressFunc: func(k, old, new string, d *schema.ResourceData) bool {
 								// App Runner API always returns the amount in multiples of 1024 units
 								return (old == "256" && new == "0.25 vCPU") || (old == "512" && new == "0.5 vCPU") || (old == "1024" && new == "1 vCPU") || (old == "2048" && new == "2 vCPU") || (old == "4096" && new == "4 vCPU")
@@ -143,7 +146,7 @@ func ResourceService() *schema.Resource {
 							Type:         schema.TypeString,
 							Optional:     true,
 							Default:      "2048",
-							ValidateFunc: validation.StringMatch(regexp.MustCompile(`512|1024|2048|3072|4096|6144|8192|10240|12288|(0.5|1|2|3|4|6|8|10|12) GB`), ""),
+							ValidateFunc: validation.StringMatch(regexache.MustCompile(`512|1024|2048|3072|4096|6144|8192|10240|12288|(0.5|1|2|3|4|6|8|10|12) GB`), ""),
 							DiffSuppressFunc: func(k, old, new string, d *schema.ResourceData) bool {
 								// App Runner API always returns the amount in MB
 								return (old == "512" && new == "0.5 GB") || (old == "1024" && new == "1 GB") || (old == "2048" && new == "2 GB") || (old == "3072" && new == "3 GB") || (old == "4096" && new == "4 GB") || (old == "6144" && new == "6 GB") || (old == "8192" && new == "8 GB") || (old == "10240" && new == "10 GB") || (old == "12288" && new == "12 GB")
@@ -403,7 +406,7 @@ func ResourceService() *schema.Resource {
 									"image_identifier": {
 										Type:         schema.TypeString,
 										Required:     true,
-										ValidateFunc: validation.StringMatch(regexp.MustCompile(`([0-9]{12}\.dkr\.ecr\.[a-z\-]+-[0-9]{1}\.amazonaws\.com\/.*)|(^public\.ecr\.aws\/.+\/.+)`), ""),
+										ValidateFunc: validation.StringMatch(regexache.MustCompile(`([0-9]{12}\.dkr\.ecr\.[a-z\-]+-[0-9]{1}\.amazonaws\.com\/.*)|(^public\.ecr\.aws\/.+\/.+)`), ""),
 									},
 									"image_repository_type": {
 										Type:         schema.TypeString,
diff --git a/internal/service/apprunner/service_package_gen.go b/internal/service/apprunner/service_package_gen.go
index 62a5757e086..01609e9fab0 100644
--- a/internal/service/apprunner/service_package_gen.go
+++ b/internal/service/apprunner/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	apprunner_sdkv1 "github.com/aws/aws-sdk-go/service/apprunner"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -94,4 +95,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*a
 	return apprunner_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/apprunner/service_test.go b/internal/service/apprunner/service_test.go
index 686a441ae63..a772d865b32 100644
--- a/internal/service/apprunner/service_test.go
+++ b/internal/service/apprunner/service_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apprunner_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/apprunner"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -33,8 +36,8 @@ func TestAccAppRunnerService_ImageRepository_basic(t *testing.T) {
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckServiceExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "service_name", rName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "apprunner", regexp.MustCompile(fmt.Sprintf(`service/%s/.+`, rName))),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "auto_scaling_configuration_arn", "apprunner", regexp.MustCompile(`autoscalingconfiguration/DefaultConfiguration/1/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "apprunner", regexache.MustCompile(fmt.Sprintf(`service/%s/.+`, rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "auto_scaling_configuration_arn", "apprunner", regexache.MustCompile(`autoscalingconfiguration/DefaultConfiguration/1/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "encryption_configuration.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "health_check_configuration.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "health_check_configuration.0.protocol", apprunner.HealthCheckProtocolTcp),
diff --git a/internal/service/apprunner/status.go b/internal/service/apprunner/status.go
index f857460969c..3278a77e468 100644
--- a/internal/service/apprunner/status.go
+++ b/internal/service/apprunner/status.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apprunner
 
 import (
diff --git a/internal/service/apprunner/sweep.go b/internal/service/apprunner/sweep.go
index a9f40eabcbf..2f08050a582 100644
--- a/internal/service/apprunner/sweep.go
+++ b/internal/service/apprunner/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package apprunner
 
@@ -12,9 +12,10 @@ import (
 	"github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_apprunner_auto_scaling_configuration_version", &resource.Sweeper{
 		Name:         "aws_apprunner_auto_scaling_configuration_version",
 		F:            sweepAutoScalingConfigurationVersions,
@@ -35,7 +36,7 @@ func init() {
 
 func sweepAutoScalingConfigurationVersions(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
@@ -78,7 +79,7 @@ func sweepAutoScalingConfigurationVersions(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping App Runner AutoScaling Configuration Versions sweep for %s: %s", region, err)
 		return nil
 	}
@@ -87,11 +88,11 @@ func sweepAutoScalingConfigurationVersions(region string) error {
 		errs = multierror.Append(errs, fmt.Errorf("error listing App Runner AutoScaling Configuration Versions: %w", err))
 	}
 
-	if err = sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err = sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("error sweeping App Runner AutoScaling Configuration Version for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
+	if awsv1.SkipSweepError(errs.ErrorOrNil()) {
 		log.Printf("[WARN] Skipping App Runner AutoScaling Configuration Versions sweep for %s: %s", region, errs)
 		return nil
 	}
@@ -101,7 +102,7 @@ func sweepAutoScalingConfigurationVersions(region string) error {
 
 func sweepConnections(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
@@ -139,7 +140,7 @@ func sweepConnections(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping App Runner Connections sweep for %s: %s", region, err)
 		return nil
 	}
@@ -148,11 +149,11 @@ func sweepConnections(region string) error {
 		errs = multierror.Append(errs, fmt.Errorf("error listing App Runner Connections: %w", err))
 	}
 
-	if err = sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err = sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("error sweeping App Runner Connections for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping App Runner Connections sweep for %s: %s", region, err)
 		return nil // In case we have completed some pages, but had errors
 	}
@@ -162,7 +163,7 @@ func sweepConnections(region string) error {
 
 func sweepServices(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
@@ -199,7 +200,7 @@ func sweepServices(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping App Runner Services sweep for %s: %s", region, err)
 		return nil
 	}
@@ -208,11 +209,11 @@ func sweepServices(region string) error {
 		errs = multierror.Append(errs, fmt.Errorf("error listing App Runner Services: %w", err))
 	}
 
-	if err = sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err = sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("error sweeping App Runner Services for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping App Runner Services sweep for %s: %s", region, err)
 		return nil // In case we have completed some pages, but had errors
 	}
diff --git a/internal/service/apprunner/tags_gen.go b/internal/service/apprunner/tags_gen.go
index 1417de0b460..19ef266e608 100644
--- a/internal/service/apprunner/tags_gen.go
+++ b/internal/service/apprunner/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/apprunner"
 	"github.com/aws/aws-sdk-go/service/apprunner/apprunneriface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -102,6 +104,8 @@ func updateTags(ctx context.Context, conn apprunneriface.AppRunnerAPI, identifie
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.AppRunner)
 	if len(removedTags) > 0 {
diff --git a/internal/service/apprunner/vpc_connector.go b/internal/service/apprunner/vpc_connector.go
index b24e6638f49..93144b3598b 100644
--- a/internal/service/apprunner/vpc_connector.go
+++ b/internal/service/apprunner/vpc_connector.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apprunner
 
 import (
diff --git a/internal/service/apprunner/vpc_connector_test.go b/internal/service/apprunner/vpc_connector_test.go
index 15012c570a8..b05cc58cb39 100644
--- a/internal/service/apprunner/vpc_connector_test.go
+++ b/internal/service/apprunner/vpc_connector_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apprunner_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/apprunner"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -31,7 +34,7 @@ func TestAccAppRunnerVPCConnector_basic(t *testing.T) {
 				Config: testAccVPCConnectorConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckVPCConnectorExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "apprunner", regexp.MustCompile(fmt.Sprintf(`vpcconnector/%s/1/.+`, rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "apprunner", regexache.MustCompile(fmt.Sprintf(`vpcconnector/%s/1/.+`, rName))),
 					resource.TestCheckResourceAttr(resourceName, "vpc_connector_name", rName),
 					resource.TestCheckResourceAttr(resourceName, "subnets.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "security_groups.#", "1"),
diff --git a/internal/service/apprunner/vpc_ingress_connection.go b/internal/service/apprunner/vpc_ingress_connection.go
index e0fc1e97bc5..f2592d0f9f2 100644
--- a/internal/service/apprunner/vpc_ingress_connection.go
+++ b/internal/service/apprunner/vpc_ingress_connection.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apprunner
 
 import (
diff --git a/internal/service/apprunner/vpc_ingress_connection_test.go b/internal/service/apprunner/vpc_ingress_connection_test.go
index c746de68142..89b74ebb402 100644
--- a/internal/service/apprunner/vpc_ingress_connection_test.go
+++ b/internal/service/apprunner/vpc_ingress_connection_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apprunner_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/apprunner"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -35,7 +38,7 @@ func TestAccAppRunnerVPCIngressConnection_basic(t *testing.T) {
 				Config: testAccVPCIngressConnectionConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckVPCIngressConnectionExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "apprunner", regexp.MustCompile(fmt.Sprintf(`vpcingressconnection/%s/.+`, rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "apprunner", regexache.MustCompile(fmt.Sprintf(`vpcingressconnection/%s/.+`, rName))),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "status", tfapprunner.VPCIngressConnectionStatusActive),
 					resource.TestCheckResourceAttrSet(resourceName, "domain_name"),
diff --git a/internal/service/apprunner/wait.go b/internal/service/apprunner/wait.go
index 47e5b10c5af..6387d374bf4 100644
--- a/internal/service/apprunner/wait.go
+++ b/internal/service/apprunner/wait.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package apprunner
 
 import (
diff --git a/internal/service/appstream/directory_config.go b/internal/service/appstream/directory_config.go
index b1bd0443b49..168a7588d22 100644
--- a/internal/service/appstream/directory_config.go
+++ b/internal/service/appstream/directory_config.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appstream
 
 import (
diff --git a/internal/service/appstream/directory_config_test.go b/internal/service/appstream/directory_config_test.go
index 9125222bbbf..d82fba8388a 100644
--- a/internal/service/appstream/directory_config_test.go
+++ b/internal/service/appstream/directory_config_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appstream_test
 
 import (
diff --git a/internal/service/appstream/find.go b/internal/service/appstream/find.go
index 67aaedecb70..8fe26a96c63 100644
--- a/internal/service/appstream/find.go
+++ b/internal/service/appstream/find.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appstream
 
 import (
diff --git a/internal/service/appstream/fleet.go b/internal/service/appstream/fleet.go
index 8663347c14e..6ce7a752c61 100644
--- a/internal/service/appstream/fleet.go
+++ b/internal/service/appstream/fleet.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appstream
 
 import (
@@ -155,7 +158,7 @@ func ResourceFleet() *schema.Resource {
 				Type:         schema.TypeInt,
 				Optional:     true,
 				Computed:     true,
-				ValidateFunc: validation.IntBetween(600, 360000),
+				ValidateFunc: validation.IntBetween(600, 432000),
 			},
 			"name": {
 				Type:     schema.TypeString,
@@ -270,6 +273,10 @@ func resourceFleetCreate(ctx context.Context, d *schema.ResourceData, meta inter
 				return retry.RetryableError(err)
 			}
 
+			if tfawserr.ErrCodeEquals(err, appstream.ErrCodeConcurrentModificationException) {
+				return retry.RetryableError(err)
+			}
+
 			// Retry for IAM eventual consistency on error:
 			if tfawserr.ErrMessageContains(err, appstream.ErrCodeInvalidRoleException, "encountered an error because your IAM role") {
 				return retry.RetryableError(err)
@@ -285,7 +292,7 @@ func resourceFleetCreate(ctx context.Context, d *schema.ResourceData, meta inter
 		output, err = conn.CreateFleetWithContext(ctx, input)
 	}
 	if err != nil {
-		return diag.Errorf("creating Appstream Fleet (%s): %s", d.Id(), err)
+		return diag.Errorf("creating Appstream Fleet (%s): %s", d.Get("name").(string), err)
 	}
 
 	d.SetId(aws.StringValue(output.Fleet.Name))
diff --git a/internal/service/appstream/fleet_stack_association.go b/internal/service/appstream/fleet_stack_association.go
index e06df82db38..8e91b8dac6b 100644
--- a/internal/service/appstream/fleet_stack_association.go
+++ b/internal/service/appstream/fleet_stack_association.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appstream
 
 import (
diff --git a/internal/service/appstream/fleet_stack_association_test.go b/internal/service/appstream/fleet_stack_association_test.go
index 956117afb17..42ee144bff5 100644
--- a/internal/service/appstream/fleet_stack_association_test.go
+++ b/internal/service/appstream/fleet_stack_association_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appstream_test
 
 import (
@@ -128,11 +131,11 @@ func testAccCheckFleetStackAssociationDestroy(ctx context.Context) resource.Test
 }
 
 func testAccFleetStackAssociationConfig_basic(name string) string {
-	// "Amazon-AppStream2-Sample-Image-02-04-2019" is not available in GovCloud
+	// "Amazon-AppStream2-Sample-Image-03-11-2023" is not available in GovCloud
 	return fmt.Sprintf(`
 resource "aws_appstream_fleet" "test" {
   name          = %[1]q
-  image_name    = "Amazon-AppStream2-Sample-Image-02-04-2019"
+  image_name    = "Amazon-AppStream2-Sample-Image-03-11-2023"
   instance_type = "stream.standard.small"
 
   compute_capacity {
diff --git a/internal/service/appstream/fleet_test.go b/internal/service/appstream/fleet_test.go
index 209df2207ec..fa09193b2ae 100644
--- a/internal/service/appstream/fleet_test.go
+++ b/internal/service/appstream/fleet_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appstream_test
 
 import (
@@ -358,11 +361,11 @@ func testAccCheckFleetDestroy(ctx context.Context) resource.TestCheckFunc {
 }
 
 func testAccFleetConfig_basic(name, instanceType string) string {
-	// "Amazon-AppStream2-Sample-Image-02-04-2019" is not available in GovCloud
+	// "Amazon-AppStream2-Sample-Image-03-11-2023" is not available in GovCloud
 	return fmt.Sprintf(`
 resource "aws_appstream_fleet" "test" {
   name          = %[1]q
-  image_name    = "Amazon-AppStream2-Sample-Image-02-04-2019"
+  image_name    = "Amazon-AppStream2-Sample-Image-03-11-2023"
   instance_type = %[2]q
 
   compute_capacity {
@@ -392,7 +395,7 @@ resource "aws_subnet" "test" {
 
 resource "aws_appstream_fleet" "test" {
   name      = %[1]q
-  image_arn = "arn:${data.aws_partition.current.partition}:appstream:${data.aws_region.current.name}::image/Amazon-AppStream2-Sample-Image-02-04-2019"
+  image_arn = "arn:${data.aws_partition.current.partition}:appstream:${data.aws_region.current.name}::image/Amazon-AppStream2-Sample-Image-03-11-2023"
 
   compute_capacity {
     desired_instances = 1
@@ -430,7 +433,7 @@ resource "aws_subnet" "test" {
 
 resource "aws_appstream_fleet" "test" {
   name       = %[1]q
-  image_name = "Amazon-AppStream2-Sample-Image-02-04-2019"
+  image_name = "Amazon-AppStream2-Sample-Image-03-11-2023"
 
   compute_capacity {
     desired_instances = 1
@@ -468,7 +471,7 @@ resource "aws_subnet" "test" {
 
 resource "aws_appstream_fleet" "test" {
   name       = %[1]q
-  image_name = "Amazon-AppStream2-Sample-Image-02-04-2019"
+  image_name = "Amazon-AppStream2-Sample-Image-03-11-2023"
 
   compute_capacity {
     desired_instances = 1
@@ -494,11 +497,11 @@ resource "aws_appstream_fleet" "test" {
 }
 
 func testAccFleetConfig_emptyDomainJoin(name, instanceType, empty string) string {
-	// "Amazon-AppStream2-Sample-Image-02-04-2019" is not available in GovCloud
+	// "Amazon-AppStream2-Sample-Image-03-11-2023" is not available in GovCloud
 	return fmt.Sprintf(`
 resource "aws_appstream_fleet" "test" {
   name          = %[1]q
-  image_name    = "Amazon-AppStream2-Sample-Image-02-04-2019"
+  image_name    = "Amazon-AppStream2-Sample-Image-03-11-2023"
   instance_type = %[2]q
 
   compute_capacity {
diff --git a/internal/service/appstream/generate.go b/internal/service/appstream/generate.go
index e866c0a1824..18f30d88779 100644
--- a/internal/service/appstream/generate.go
+++ b/internal/service/appstream/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/listpages/main.go -ListOps=DescribeDirectoryConfigs,DescribeFleets,DescribeImageBuilders,DescribeStacks,DescribeUsers,ListAssociatedStacks
 //go:generate go run ../../generate/tags/main.go -ListTags -ServiceTagsMap -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
diff --git a/internal/service/appstream/image_builder.go b/internal/service/appstream/image_builder.go
index 5f0747e9dc5..7b3abd67c49 100644
--- a/internal/service/appstream/image_builder.go
+++ b/internal/service/appstream/image_builder.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appstream
 
 import (
diff --git a/internal/service/appstream/image_builder_test.go b/internal/service/appstream/image_builder_test.go
index 616e5acd21a..f85f22ef76f 100644
--- a/internal/service/appstream/image_builder_test.go
+++ b/internal/service/appstream/image_builder_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appstream_test
 
 import (
@@ -50,7 +53,7 @@ func TestAccAppStreamImageBuilder_withIAMRole(t *testing.T) {
 	ctx := acctest.Context(t)
 	resourceName := "aws_appstream_image_builder.test"
 	instanceType := "stream.standard.medium"
-	imageName := "AppStream-WinServer2019-07-12-2022"
+	imageName := "AppStream-WinServer2019-06-12-2023"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
@@ -199,7 +202,7 @@ func TestAccAppStreamImageBuilder_imageARN(t *testing.T) {
 	resourceName := "aws_appstream_image_builder.test"
 	// imageName selected from the available AWS Managed AppStream 2.0 Base Images
 	// Reference: https://docs.aws.amazon.com/appstream2/latest/developerguide/base-image-version-history.html
-	imageName := "AppStream-WinServer2019-07-12-2022"
+	imageName := "AppStream-WinServer2019-06-12-2023"
 	instanceType := "stream.standard.small"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
@@ -273,7 +276,7 @@ func testAccCheckImageBuilderDestroy(ctx context.Context) resource.TestCheckFunc
 func testAccImageBuilderConfig_basic(instanceType, rName string) string {
 	return fmt.Sprintf(`
 resource "aws_appstream_image_builder" "test" {
-  image_name    = "AppStream-WinServer2019-07-12-2022"
+  image_name    = "AppStream-WinServer2019-06-12-2023"
   instance_type = %[1]q
   name          = %[2]q
 }
@@ -283,7 +286,7 @@ resource "aws_appstream_image_builder" "test" {
 func testAccImageBuilderConfig_complete(rName, description, instanceType string) string {
 	return acctest.ConfigCompose(acctest.ConfigVPCWithSubnets(rName, 1), fmt.Sprintf(`
 resource "aws_appstream_image_builder" "test" {
-  image_name                     = "AppStream-WinServer2019-07-12-2022"
+  image_name                     = "AppStream-WinServer2019-06-12-2023"
   name                           = %[1]q
   description                    = %[2]q
   enable_default_internet_access = false
@@ -298,7 +301,7 @@ resource "aws_appstream_image_builder" "test" {
 func testAccImageBuilderConfig_tags1(instanceType, rName, key, value string) string {
 	return fmt.Sprintf(`
 resource "aws_appstream_image_builder" "test" {
-  image_name    = "AppStream-WinServer2019-07-12-2022"
+  image_name    = "AppStream-WinServer2019-06-12-2023"
   instance_type = %[1]q
   name          = %[2]q
 
@@ -312,7 +315,7 @@ resource "aws_appstream_image_builder" "test" {
 func testAccImageBuilderConfig_tags2(instanceType, rName, key1, value1, key2, value2 string) string {
 	return fmt.Sprintf(`
 resource "aws_appstream_image_builder" "test" {
-  image_name    = "AppStream-WinServer2019-07-12-2022"
+  image_name    = "AppStream-WinServer2019-06-12-2023"
   instance_type = %[1]q
   name          = %[2]q
 
diff --git a/internal/service/appstream/service_package_gen.go b/internal/service/appstream/service_package_gen.go
index 4c860223bb8..e3855c290f3 100644
--- a/internal/service/appstream/service_package_gen.go
+++ b/internal/service/appstream/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	appstream_sdkv1 "github.com/aws/aws-sdk-go/service/appstream"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -82,4 +83,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*a
 	return appstream_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/appstream/stack.go b/internal/service/appstream/stack.go
index 32b740826c3..0929727c929 100644
--- a/internal/service/appstream/stack.go
+++ b/internal/service/appstream/stack.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appstream
 
 import (
diff --git a/internal/service/appstream/stack_test.go b/internal/service/appstream/stack_test.go
index 965bf27240a..dc0f3d9f906 100644
--- a/internal/service/appstream/stack_test.go
+++ b/internal/service/appstream/stack_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appstream_test
 
 import (
diff --git a/internal/service/appstream/status.go b/internal/service/appstream/status.go
index 8a8eedfe366..7fdec319781 100644
--- a/internal/service/appstream/status.go
+++ b/internal/service/appstream/status.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appstream
 
 import (
diff --git a/internal/service/appstream/sweep.go b/internal/service/appstream/sweep.go
index c1a2f8d6f5f..d1422e4f237 100644
--- a/internal/service/appstream/sweep.go
+++ b/internal/service/appstream/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package appstream
 
@@ -11,9 +11,11 @@ import (
 	"github.com/aws/aws-sdk-go/service/appstream"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
+	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_appstream_directory_config", &resource.Sweeper{
 		Name: "aws_appstream_directory_config",
 		F:    sweepDirectoryConfigs,
@@ -37,7 +39,11 @@ func init() {
 
 func sweepDirectoryConfigs(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	if region == names.USWest1RegionID {
+		log.Printf("[WARN] Skipping AppStream Directory Config sweep for region: %s", region)
+		return nil
+	}
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
@@ -61,7 +67,7 @@ func sweepDirectoryConfigs(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping AppStream Directory Config sweep for %s: %s", region, err)
 		return nil
 	}
@@ -70,7 +76,7 @@ func sweepDirectoryConfigs(region string) error {
 		return fmt.Errorf("error listing AppStream Directory Configs (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping AppStream Directory Configs (%s): %w", region, err)
@@ -81,7 +87,11 @@ func sweepDirectoryConfigs(region string) error {
 
 func sweepFleets(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	if region == names.USWest1RegionID {
+		log.Printf("[WARN] Skipping AppStream Fleet sweep for region: %s", region)
+		return nil
+	}
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
@@ -105,7 +115,7 @@ func sweepFleets(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping AppStream Fleet sweep for %s: %s", region, err)
 		return nil
 	}
@@ -114,7 +124,7 @@ func sweepFleets(region string) error {
 		return fmt.Errorf("error listing AppStream Fleets (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping AppStream Fleets (%s): %w", region, err)
@@ -125,7 +135,11 @@ func sweepFleets(region string) error {
 
 func sweepImageBuilders(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	if region == names.USWest1RegionID {
+		log.Printf("[WARN] Skipping AppStream Image Builder sweep for region: %s", region)
+		return nil
+	}
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
@@ -149,7 +163,7 @@ func sweepImageBuilders(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping AppStream Image Builder sweep for %s: %s", region, err)
 		return nil
 	}
@@ -158,7 +172,7 @@ func sweepImageBuilders(region string) error {
 		return fmt.Errorf("error listing AppStream Image Builders (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping AppStream Image Builders (%s): %w", region, err)
@@ -169,7 +183,11 @@ func sweepImageBuilders(region string) error {
 
 func sweepStacks(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	if region == names.USWest1RegionID {
+		log.Printf("[WARN] Skipping AppStream Stack sweep for region: %s", region)
+		return nil
+	}
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
@@ -193,7 +211,7 @@ func sweepStacks(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping AppStream Stack sweep for %s: %s", region, err)
 		return nil
 	}
@@ -202,7 +220,7 @@ func sweepStacks(region string) error {
 		return fmt.Errorf("error listing AppStream Stacks (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping AppStream Stacks (%s): %w", region, err)
diff --git a/internal/service/appstream/tags_gen.go b/internal/service/appstream/tags_gen.go
index c847cc314dd..5d63387e8b0 100644
--- a/internal/service/appstream/tags_gen.go
+++ b/internal/service/appstream/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/appstream"
 	"github.com/aws/aws-sdk-go/service/appstream/appstreamiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -54,7 +56,7 @@ func Tags(tags tftags.KeyValueTags) map[string]*string {
 	return aws.StringMap(tags.Map())
 }
 
-// KeyValueTags creates KeyValueTags from appstream service tags.
+// KeyValueTags creates tftags.KeyValueTags from appstream service tags.
 func KeyValueTags(ctx context.Context, tags map[string]*string) tftags.KeyValueTags {
 	return tftags.New(ctx, tags)
 }
@@ -85,6 +87,8 @@ func updateTags(ctx context.Context, conn appstreamiface.AppStreamAPI, identifie
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.AppStream)
 	if len(removedTags) > 0 {
diff --git a/internal/service/appstream/user.go b/internal/service/appstream/user.go
index 30ee0d277d9..44102302a81 100644
--- a/internal/service/appstream/user.go
+++ b/internal/service/appstream/user.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appstream
 
 import (
diff --git a/internal/service/appstream/user_stack_association.go b/internal/service/appstream/user_stack_association.go
index 1b103453833..22902195d15 100644
--- a/internal/service/appstream/user_stack_association.go
+++ b/internal/service/appstream/user_stack_association.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appstream
 
 import (
diff --git a/internal/service/appstream/user_stack_association_test.go b/internal/service/appstream/user_stack_association_test.go
index 3490fed7146..4e599931614 100644
--- a/internal/service/appstream/user_stack_association_test.go
+++ b/internal/service/appstream/user_stack_association_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appstream_test
 
 import (
diff --git a/internal/service/appstream/user_test.go b/internal/service/appstream/user_test.go
index f2330b9ee0a..fc97fb97a32 100644
--- a/internal/service/appstream/user_test.go
+++ b/internal/service/appstream/user_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appstream_test
 
 import (
diff --git a/internal/service/appstream/wait.go b/internal/service/appstream/wait.go
index a5b1d780aef..bd806d4dc06 100644
--- a/internal/service/appstream/wait.go
+++ b/internal/service/appstream/wait.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appstream
 
 import (
diff --git a/internal/service/appsync/api_cache.go b/internal/service/appsync/api_cache.go
index 4712f9094f0..f7b4c5d6db4 100644
--- a/internal/service/appsync/api_cache.go
+++ b/internal/service/appsync/api_cache.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appsync
 
 import (
diff --git a/internal/service/appsync/api_cache_test.go b/internal/service/appsync/api_cache_test.go
index 27f9c3a50d7..7aaff9bb7dd 100644
--- a/internal/service/appsync/api_cache_test.go
+++ b/internal/service/appsync/api_cache_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appsync_test
 
 import (
diff --git a/internal/service/appsync/api_key.go b/internal/service/appsync/api_key.go
index 2211661f014..154306cde7f 100644
--- a/internal/service/appsync/api_key.go
+++ b/internal/service/appsync/api_key.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appsync
 
 import (
diff --git a/internal/service/appsync/api_key_test.go b/internal/service/appsync/api_key_test.go
index 9ef55a20c41..dd20ac2a29f 100644
--- a/internal/service/appsync/api_key_test.go
+++ b/internal/service/appsync/api_key_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appsync_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/appsync"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -37,7 +40,7 @@ func testAccAPIKey_basic(t *testing.T) {
 					testAccCheckAPIKeyExists(ctx, resourceName, &apiKey),
 					resource.TestCheckResourceAttr(resourceName, "description", "Managed by Terraform"),
 					testAccCheckAPIKeyExpiresDate(&apiKey, dateAfterSevenDays),
-					resource.TestMatchResourceAttr(resourceName, "key", regexp.MustCompile(`.+`)),
+					resource.TestMatchResourceAttr(resourceName, "key", regexache.MustCompile(`.+`)),
 				),
 			},
 			{
diff --git a/internal/service/appsync/appsync_test.go b/internal/service/appsync/appsync_test.go
index dbc8352cc9e..b81b5ba04a3 100644
--- a/internal/service/appsync/appsync_test.go
+++ b/internal/service/appsync/appsync_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appsync_test
 
 import (
diff --git a/internal/service/appsync/datasource.go b/internal/service/appsync/datasource.go
index 6d8107d4419..f12dc6f28d5 100644
--- a/internal/service/appsync/datasource.go
+++ b/internal/service/appsync/datasource.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appsync
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"strings"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/appsync"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -210,7 +213,7 @@ func ResourceDataSource() *schema.Resource {
 			"name": {
 				Type:         schema.TypeString,
 				Required:     true,
-				ValidateFunc: validation.StringMatch(regexp.MustCompile(`[_A-Za-z][_0-9A-Za-z]*`), "must match [_A-Za-z][_0-9A-Za-z]*"),
+				ValidateFunc: validation.StringMatch(regexache.MustCompile(`[A-Za-z_][0-9A-Za-z_]*`), "must match [A-Za-z_][0-9A-Za-z_]*"),
 			},
 			"relational_database_config": {
 				Type:     schema.TypeList,
diff --git a/internal/service/appsync/datasource_test.go b/internal/service/appsync/datasource_test.go
index bad64b7aab9..89454d90522 100644
--- a/internal/service/appsync/datasource_test.go
+++ b/internal/service/appsync/datasource_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appsync_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/appsync"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -31,7 +34,7 @@ func testAccDataSource_basic(t *testing.T) {
 				Config: testAccDataSourceConfig_typeNone(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckExistsDataSource(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "appsync", regexp.MustCompile(fmt.Sprintf("apis/.+/datasources/%s", rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "appsync", regexache.MustCompile(fmt.Sprintf("apis/.+/datasources/%s", rName))),
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
 					resource.TestCheckResourceAttr(resourceName, "dynamodb_config.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "elasticsearch_config.#", "0"),
diff --git a/internal/service/appsync/domain_name.go b/internal/service/appsync/domain_name.go
index 5f3b8a68310..89c6e67b1f4 100644
--- a/internal/service/appsync/domain_name.go
+++ b/internal/service/appsync/domain_name.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appsync
 
 import (
diff --git a/internal/service/appsync/domain_name_api_association.go b/internal/service/appsync/domain_name_api_association.go
index 1cdf4a852c5..1bff3ff4717 100644
--- a/internal/service/appsync/domain_name_api_association.go
+++ b/internal/service/appsync/domain_name_api_association.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appsync
 
 import (
diff --git a/internal/service/appsync/domain_name_api_association_test.go b/internal/service/appsync/domain_name_api_association_test.go
index 0ceaacef626..97e6b1f7d15 100644
--- a/internal/service/appsync/domain_name_api_association_test.go
+++ b/internal/service/appsync/domain_name_api_association_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appsync_test
 
 import (
diff --git a/internal/service/appsync/domain_name_test.go b/internal/service/appsync/domain_name_test.go
index 344af073863..3fdd909bef4 100644
--- a/internal/service/appsync/domain_name_test.go
+++ b/internal/service/appsync/domain_name_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appsync_test
 
 import (
diff --git a/internal/service/appsync/find.go b/internal/service/appsync/find.go
index 9bc120ae746..05906df4040 100644
--- a/internal/service/appsync/find.go
+++ b/internal/service/appsync/find.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appsync
 
 import (
diff --git a/internal/service/appsync/function.go b/internal/service/appsync/function.go
index ec09884d386..f1135e3ce7b 100644
--- a/internal/service/appsync/function.go
+++ b/internal/service/appsync/function.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appsync
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"strings"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/appsync"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -74,7 +77,7 @@ func ResourceFunction() *schema.Resource {
 			"name": {
 				Type:         schema.TypeString,
 				Required:     true,
-				ValidateFunc: validation.StringMatch(regexp.MustCompile(`[_A-Za-z][_0-9A-Za-z]*`), "must match [_A-Za-z][_0-9A-Za-z]*"),
+				ValidateFunc: validation.StringMatch(regexache.MustCompile(`[A-Za-z_][0-9A-Za-z_]*`), "must match [A-Za-z_][0-9A-Za-z_]*"),
 			},
 			"request_mapping_template": {
 				Type:     schema.TypeString,
diff --git a/internal/service/appsync/function_test.go b/internal/service/appsync/function_test.go
index 64d7af40540..b79c8c3a866 100644
--- a/internal/service/appsync/function_test.go
+++ b/internal/service/appsync/function_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appsync_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/appsync"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -35,7 +38,7 @@ func testAccFunction_basic(t *testing.T) {
 				Config: testAccFunctionConfig_basic(rName1, rName2, acctest.Region()),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckFunctionExists(ctx, resourceName, &config),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "appsync", regexp.MustCompile("apis/.+/functions/.+")),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "appsync", regexache.MustCompile("apis/.+/functions/.+")),
 					resource.TestCheckResourceAttr(resourceName, "name", rName2),
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
 					resource.TestCheckResourceAttr(resourceName, "max_batch_size", "0"),
diff --git a/internal/service/appsync/generate.go b/internal/service/appsync/generate.go
index bc0cb77f91f..3efb706569b 100644
--- a/internal/service/appsync/generate.go
+++ b/internal/service/appsync/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTags -ServiceTagsMap -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/appsync/graphql_api.go b/internal/service/appsync/graphql_api.go
index 33f2f8b1972..e59d2ab0c20 100644
--- a/internal/service/appsync/graphql_api.go
+++ b/internal/service/appsync/graphql_api.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appsync
 
 import (
@@ -5,9 +8,9 @@ import (
 	"errors"
 	"fmt"
 	"log"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/appsync"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -185,8 +188,8 @@ func ResourceGraphQLAPI() *schema.Resource {
 				Required: true,
 				ValidateFunc: func(v interface{}, k string) (ws []string, errors []error) {
 					value := v.(string)
-					if !regexp.MustCompile(`[_A-Za-z][_0-9A-Za-z]*`).MatchString(value) {
-						errors = append(errors, fmt.Errorf("%q must match [_A-Za-z][_0-9A-Za-z]*", k))
+					if !regexache.MustCompile(`[A-Za-z_][0-9A-Za-z_]*`).MatchString(value) {
+						errors = append(errors, fmt.Errorf("%q must match [A-Za-z_][0-9A-Za-z_]*", k))
 					}
 					return
 				},
diff --git a/internal/service/appsync/graphql_api_test.go b/internal/service/appsync/graphql_api_test.go
index 4da3f59ad17..68cc1d6e9d1 100644
--- a/internal/service/appsync/graphql_api_test.go
+++ b/internal/service/appsync/graphql_api_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appsync_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"strconv"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/appsync"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -33,7 +36,7 @@ func testAccGraphQLAPI_basic(t *testing.T) {
 				Config: testAccGraphQLAPIConfig_authenticationType(rName, "API_KEY"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckGraphQLAPIExists(ctx, resourceName, &api1),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "appsync", regexp.MustCompile(`apis/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "appsync", regexache.MustCompile(`apis/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "authentication_type", "API_KEY"),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "log_config.#", "0"),
@@ -97,7 +100,7 @@ func testAccGraphQLAPI_schema(t *testing.T) {
 				Config: testAccGraphQLAPIConfig_schema(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckGraphQLAPIExists(ctx, resourceName, &api1),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "appsync", regexp.MustCompile(`apis/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "appsync", regexache.MustCompile(`apis/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "authentication_type", "API_KEY"),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "log_config.#", "0"),
@@ -179,7 +182,7 @@ func testAccGraphQLAPI_AuthenticationType_apiKey(t *testing.T) {
 				Config: testAccGraphQLAPIConfig_authenticationType(rName, "API_KEY"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckGraphQLAPIExists(ctx, resourceName, &api1),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "appsync", regexp.MustCompile(`apis/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "appsync", regexache.MustCompile(`apis/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "authentication_type", "API_KEY"),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 				),
@@ -209,7 +212,7 @@ func testAccGraphQLAPI_AuthenticationType_iam(t *testing.T) {
 				Config: testAccGraphQLAPIConfig_authenticationType(rName, "AWS_IAM"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckGraphQLAPIExists(ctx, resourceName, &api1),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "appsync", regexp.MustCompile(`apis/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "appsync", regexache.MustCompile(`apis/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "authentication_type", "AWS_IAM"),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 				),
@@ -928,7 +931,7 @@ func testAccGraphQLAPI_AdditionalAuthentication_apiKey(t *testing.T) {
 				Config: testAccGraphQLAPIConfig_additionalAuthAuthType(rName, "AWS_IAM", "API_KEY"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckGraphQLAPIExists(ctx, resourceName, &api1),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "appsync", regexp.MustCompile(`apis/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "appsync", regexache.MustCompile(`apis/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "authentication_type", "AWS_IAM"),
 					resource.TestCheckResourceAttr(resourceName, "additional_authentication_provider.#", "1"),
@@ -963,7 +966,7 @@ func testAccGraphQLAPI_AdditionalAuthentication_iam(t *testing.T) {
 				Config: testAccGraphQLAPIConfig_additionalAuthAuthType(rName, "API_KEY", "AWS_IAM"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckGraphQLAPIExists(ctx, resourceName, &api1),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "appsync", regexp.MustCompile(`apis/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "appsync", regexache.MustCompile(`apis/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "authentication_type", "API_KEY"),
 					resource.TestCheckResourceAttr(resourceName, "additional_authentication_provider.#", "1"),
@@ -999,7 +1002,7 @@ func testAccGraphQLAPI_AdditionalAuthentication_cognitoUserPools(t *testing.T) {
 				Config: testAccGraphQLAPIConfig_additionalAuthUserPool(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckGraphQLAPIExists(ctx, resourceName, &api1),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "appsync", regexp.MustCompile(`apis/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "appsync", regexache.MustCompile(`apis/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "authentication_type", "API_KEY"),
 					resource.TestCheckResourceAttr(resourceName, "additional_authentication_provider.#", "1"),
@@ -1035,7 +1038,7 @@ func testAccGraphQLAPI_AdditionalAuthentication_openIDConnect(t *testing.T) {
 				Config: testAccGraphQLAPIConfig_additionalAuthOpenIdConnect(rName, "https://example.com"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckGraphQLAPIExists(ctx, resourceName, &api1),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "appsync", regexp.MustCompile(`apis/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "appsync", regexache.MustCompile(`apis/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "authentication_type", "API_KEY"),
 					resource.TestCheckResourceAttr(resourceName, "additional_authentication_provider.#", "1"),
@@ -1072,7 +1075,7 @@ func testAccGraphQLAPI_AdditionalAuthentication_lambda(t *testing.T) {
 				Config: testAccGraphQLAPIConfig_additionalAuthLambda(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckGraphQLAPIExists(ctx, resourceName, &api1),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "appsync", regexp.MustCompile(`apis/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "appsync", regexache.MustCompile(`apis/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "authentication_type", "API_KEY"),
 					resource.TestCheckResourceAttr(resourceName, "additional_authentication_provider.#", "1"),
@@ -1112,7 +1115,7 @@ func testAccGraphQLAPI_AdditionalAuthentication_multiple(t *testing.T) {
 				Config: testAccGraphQLAPIConfig_additionalAuthMultiple(rName, "https://example.com"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckGraphQLAPIExists(ctx, resourceName, &api1),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "appsync", regexp.MustCompile(`apis/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "appsync", regexache.MustCompile(`apis/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "authentication_type", "API_KEY"),
 					resource.TestCheckResourceAttr(resourceName, "additional_authentication_provider.#", "4"),
diff --git a/internal/service/appsync/resolver.go b/internal/service/appsync/resolver.go
index 8f70038df37..84667f782cd 100644
--- a/internal/service/appsync/resolver.go
+++ b/internal/service/appsync/resolver.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appsync
 
 import (
diff --git a/internal/service/appsync/resolver_test.go b/internal/service/appsync/resolver_test.go
index 728254023a3..5965334a80f 100644
--- a/internal/service/appsync/resolver_test.go
+++ b/internal/service/appsync/resolver_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appsync_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/appsync"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -33,7 +36,7 @@ func testAccResolver_basic(t *testing.T) {
 				Config: testAccResolverConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckResolverExists(ctx, resourceName, &resolver1),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "appsync", regexp.MustCompile("apis/.+/types/.+/resolvers/.+")),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "appsync", regexache.MustCompile("apis/.+/types/.+/resolvers/.+")),
 					resource.TestCheckResourceAttr(resourceName, "data_source", rName),
 					resource.TestCheckResourceAttrSet(resourceName, "request_template"),
 					resource.TestCheckResourceAttr(resourceName, "max_batch_size", "0"),
@@ -216,7 +219,7 @@ func testAccResolver_requestTemplate(t *testing.T) {
 				Config: testAccResolverConfig_requestTemplate(rName, "/"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckResolverExists(ctx, resourceName, &resolver1),
-					resource.TestMatchResourceAttr(resourceName, "request_template", regexp.MustCompile("resourcePath\": \"/\"")),
+					resource.TestMatchResourceAttr(resourceName, "request_template", regexache.MustCompile("resourcePath\": \"/\"")),
 				),
 			},
 			{
@@ -228,7 +231,7 @@ func testAccResolver_requestTemplate(t *testing.T) {
 				Config: testAccResolverConfig_requestTemplate(rName, "/test"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckResolverExists(ctx, resourceName, &resolver2),
-					resource.TestMatchResourceAttr(resourceName, "request_template", regexp.MustCompile("resourcePath\": \"/test\"")),
+					resource.TestMatchResourceAttr(resourceName, "request_template", regexache.MustCompile("resourcePath\": \"/test\"")),
 				),
 			},
 		},
@@ -251,7 +254,7 @@ func testAccResolver_responseTemplate(t *testing.T) {
 				Config: testAccResolverConfig_responseTemplate(rName, 200),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckResolverExists(ctx, resourceName, &resolver1),
-					resource.TestMatchResourceAttr(resourceName, "response_template", regexp.MustCompile(`ctx\.result\.statusCode == 200`)),
+					resource.TestMatchResourceAttr(resourceName, "response_template", regexache.MustCompile(`ctx\.result\.statusCode == 200`)),
 				),
 			},
 			{
@@ -263,7 +266,7 @@ func testAccResolver_responseTemplate(t *testing.T) {
 				Config: testAccResolverConfig_responseTemplate(rName, 201),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckResolverExists(ctx, resourceName, &resolver2),
-					resource.TestMatchResourceAttr(resourceName, "response_template", regexp.MustCompile(`ctx\.result\.statusCode == 201`)),
+					resource.TestMatchResourceAttr(resourceName, "response_template", regexache.MustCompile(`ctx\.result\.statusCode == 201`)),
 				),
 			},
 		},
diff --git a/internal/service/appsync/service_package.go b/internal/service/appsync/service_package.go
index 08419c033f0..53db884512f 100644
--- a/internal/service/appsync/service_package.go
+++ b/internal/service/appsync/service_package.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appsync
 
 import (
diff --git a/internal/service/appsync/service_package_gen.go b/internal/service/appsync/service_package_gen.go
index bb4ba69f37a..b60257c11df 100644
--- a/internal/service/appsync/service_package_gen.go
+++ b/internal/service/appsync/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	appsync_sdkv1 "github.com/aws/aws-sdk-go/service/appsync"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -82,4 +83,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*a
 	return appsync_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/appsync/status.go b/internal/service/appsync/status.go
index 3be2220db37..7b3ecbbd352 100644
--- a/internal/service/appsync/status.go
+++ b/internal/service/appsync/status.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appsync
 
 import (
diff --git a/internal/service/appsync/sweep.go b/internal/service/appsync/sweep.go
index c35bd6e72a2..459b5265365 100644
--- a/internal/service/appsync/sweep.go
+++ b/internal/service/appsync/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package appsync
 
@@ -12,9 +12,10 @@ import (
 	"github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_appsync_graphql_api", &resource.Sweeper{
 		Name: "aws_appsync_graphql_api",
 		F:    sweepGraphQLAPIs,
@@ -36,7 +37,7 @@ func init() {
 
 func sweepGraphQLAPIs(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("Error getting client: %s", err)
 	}
@@ -48,7 +49,7 @@ func sweepGraphQLAPIs(region string) error {
 
 	for {
 		output, err := conn.ListGraphqlApisWithContext(ctx, input)
-		if sweep.SkipSweepError(err) {
+		if awsv1.SkipSweepError(err) {
 			log.Printf("[WARN] Skipping AppSync GraphQL API sweep for %s: %s", region, err)
 			return nil
 		}
@@ -61,7 +62,6 @@ func sweepGraphQLAPIs(region string) error {
 		}
 
 		for _, graphAPI := range output.GraphqlApis {
-
 			r := ResourceGraphQLAPI()
 			d := r.Data(nil)
 
@@ -78,11 +78,11 @@ func sweepGraphQLAPIs(region string) error {
 		input.NextToken = output.NextToken
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("error sweeping AppSync GraphQL API %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping AppSync GraphQL API sweep for %s: %s", region, errs)
 		return nil
 	}
@@ -92,7 +92,7 @@ func sweepGraphQLAPIs(region string) error {
 
 func sweepDomainNames(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("Error getting client: %s", err)
 	}
@@ -104,7 +104,7 @@ func sweepDomainNames(region string) error {
 
 	for {
 		output, err := conn.ListDomainNamesWithContext(ctx, input)
-		if sweep.SkipSweepError(err) {
+		if awsv1.SkipSweepError(err) {
 			log.Printf("[WARN] Skipping AppSync Domain Name sweep for %s: %s", region, err)
 			return nil
 		}
@@ -117,7 +117,6 @@ func sweepDomainNames(region string) error {
 		}
 
 		for _, dm := range output.DomainNameConfigs {
-
 			r := ResourceDomainName()
 			d := r.Data(nil)
 
@@ -134,11 +133,11 @@ func sweepDomainNames(region string) error {
 		input.NextToken = output.NextToken
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("error sweeping AppSync Domain Name %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping AppSync Domain Name sweep for %s: %s", region, errs)
 		return nil
 	}
@@ -148,7 +147,7 @@ func sweepDomainNames(region string) error {
 
 func sweepDomainNameAssociations(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("Error getting client: %s", err)
 	}
@@ -160,7 +159,7 @@ func sweepDomainNameAssociations(region string) error {
 
 	for {
 		output, err := conn.ListDomainNamesWithContext(ctx, input)
-		if sweep.SkipSweepError(err) {
+		if awsv1.SkipSweepError(err) {
 			log.Printf("[WARN] Skipping AppSync Domain Name Association sweep for %s: %s", region, err)
 			return nil
 		}
@@ -173,7 +172,6 @@ func sweepDomainNameAssociations(region string) error {
 		}
 
 		for _, dm := range output.DomainNameConfigs {
-
 			r := ResourceDomainNameAPIAssociation()
 			d := r.Data(nil)
 
@@ -190,11 +188,11 @@ func sweepDomainNameAssociations(region string) error {
 		input.NextToken = output.NextToken
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("error sweeping AppSync Domain Name Association %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping AppSync Domain Name Association sweep for %s: %s", region, errs)
 		return nil
 	}
diff --git a/internal/service/appsync/tags_gen.go b/internal/service/appsync/tags_gen.go
index 355fa6f3440..1074f18a837 100644
--- a/internal/service/appsync/tags_gen.go
+++ b/internal/service/appsync/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/appsync"
 	"github.com/aws/aws-sdk-go/service/appsync/appsynciface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -54,7 +56,7 @@ func Tags(tags tftags.KeyValueTags) map[string]*string {
 	return aws.StringMap(tags.Map())
 }
 
-// KeyValueTags creates KeyValueTags from appsync service tags.
+// KeyValueTags creates tftags.KeyValueTags from appsync service tags.
 func KeyValueTags(ctx context.Context, tags map[string]*string) tftags.KeyValueTags {
 	return tftags.New(ctx, tags)
 }
@@ -85,6 +87,8 @@ func updateTags(ctx context.Context, conn appsynciface.AppSyncAPI, identifier st
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.AppSync)
 	if len(removedTags) > 0 {
diff --git a/internal/service/appsync/test-fixtures/test-code-updated.js b/internal/service/appsync/test-fixtures/test-code-updated.js
index cccf930150f..ed9ec31eff2 100644
--- a/internal/service/appsync/test-fixtures/test-code-updated.js
+++ b/internal/service/appsync/test-fixtures/test-code-updated.js
@@ -1,3 +1,8 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
 import { util } from '@aws-appsync/utils';
 
 /**
diff --git a/internal/service/appsync/test-fixtures/test-code.js b/internal/service/appsync/test-fixtures/test-code.js
index b9da7287553..5b4a1936f5b 100644
--- a/internal/service/appsync/test-fixtures/test-code.js
+++ b/internal/service/appsync/test-fixtures/test-code.js
@@ -1,3 +1,8 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
 import { util } from '@aws-appsync/utils';
 
 /**
diff --git a/internal/service/appsync/type.go b/internal/service/appsync/type.go
index a0b37a30161..84b817a3b1b 100644
--- a/internal/service/appsync/type.go
+++ b/internal/service/appsync/type.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appsync
 
 import (
diff --git a/internal/service/appsync/type_test.go b/internal/service/appsync/type_test.go
index d45f0d27cdf..b57a5df888d 100644
--- a/internal/service/appsync/type_test.go
+++ b/internal/service/appsync/type_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appsync_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/appsync"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -32,7 +35,7 @@ func testAccType_basic(t *testing.T) {
 				Config: testAccTypeConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckTypeExists(ctx, resourceName, &typ),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "appsync", regexp.MustCompile("apis/.+/types/.+")),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "appsync", regexache.MustCompile("apis/.+/types/.+")),
 					resource.TestCheckResourceAttrPair(resourceName, "api_id", "aws_appsync_graphql_api.test", "id"),
 					resource.TestCheckResourceAttr(resourceName, "format", "SDL"),
 					resource.TestCheckResourceAttr(resourceName, "name", "Mutation"),
diff --git a/internal/service/appsync/wait.go b/internal/service/appsync/wait.go
index 76aa4a7a147..59bd7cb9c48 100644
--- a/internal/service/appsync/wait.go
+++ b/internal/service/appsync/wait.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package appsync
 
 import (
diff --git a/internal/service/athena/data_catalog.go b/internal/service/athena/data_catalog.go
index 22e2a30f52a..a09c74fdfb7 100644
--- a/internal/service/athena/data_catalog.go
+++ b/internal/service/athena/data_catalog.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package athena
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/aws/aws-sdk-go/service/athena"
@@ -51,7 +54,7 @@ func ResourceDataCatalog() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 129),
-					validation.StringMatch(regexp.MustCompile(`[\w@-]*`), ""),
+					validation.StringMatch(regexache.MustCompile(`[\w@-]*`), ""),
 				),
 			},
 			"parameters": {
diff --git a/internal/service/athena/data_catalog_test.go b/internal/service/athena/data_catalog_test.go
index ca29e80ada5..6ba63bbe50b 100644
--- a/internal/service/athena/data_catalog_test.go
+++ b/internal/service/athena/data_catalog_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package athena_test
 
 import (
diff --git a/internal/service/athena/database.go b/internal/service/athena/database.go
index 4b4ea19daa1..b6690f4f681 100644
--- a/internal/service/athena/database.go
+++ b/internal/service/athena/database.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package athena
 
 import (
@@ -5,10 +8,10 @@ import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"strings"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/athena"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -92,7 +95,7 @@ func ResourceDatabase() *schema.Resource {
 				Type:         schema.TypeString,
 				Required:     true,
 				ForceNew:     true,
-				ValidateFunc: validation.StringMatch(regexp.MustCompile("^[_a-z0-9]+$"), "must be lowercase letters, numbers, or underscore ('_')"),
+				ValidateFunc: validation.StringMatch(regexache.MustCompile("^[0-9a-z_]+$"), "must be lowercase letters, numbers, or underscore ('_')"),
 			},
 			"properties": {
 				Type:     schema.TypeMap,
diff --git a/internal/service/athena/database_test.go b/internal/service/athena/database_test.go
index aa6fcbf1ba6..4702c09c0c3 100644
--- a/internal/service/athena/database_test.go
+++ b/internal/service/athena/database_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package athena_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/athena"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -184,7 +187,7 @@ func TestAccAthenaDatabase_nameCantHaveUppercase(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccDatabaseConfig_basic(rName, dbName, false),
-				ExpectError: regexp.MustCompile(`must be lowercase letters, numbers, or underscore \('_'\)`),
+				ExpectError: regexache.MustCompile(`must be lowercase letters, numbers, or underscore \('_'\)`),
 			},
 		},
 	})
diff --git a/internal/service/athena/generate.go b/internal/service/athena/generate.go
index 2f38d4265ef..d0f2ed305c1 100644
--- a/internal/service/athena/generate.go
+++ b/internal/service/athena/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTags -ListTagsInIDElem=ResourceARN -ServiceTagsSlice -TagInIDElem=ResourceARN -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/athena/named_query.go b/internal/service/athena/named_query.go
index 2507fc9200a..8512ae51d28 100644
--- a/internal/service/athena/named_query.go
+++ b/internal/service/athena/named_query.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package athena
 
 import (
diff --git a/internal/service/athena/named_query_test.go b/internal/service/athena/named_query_test.go
index d4ffb7e90b4..a42d34d8c80 100644
--- a/internal/service/athena/named_query_test.go
+++ b/internal/service/athena/named_query_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package athena_test
 
 import (
diff --git a/internal/service/athena/service_package_gen.go b/internal/service/athena/service_package_gen.go
index 3bf02ee904d..27c10fdde17 100644
--- a/internal/service/athena/service_package_gen.go
+++ b/internal/service/athena/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	athena_sdkv1 "github.com/aws/aws-sdk-go/service/athena"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -66,4 +67,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*a
 	return athena_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/athena/sweep.go b/internal/service/athena/sweep.go
index a9af87aa9ab..1752f9fac12 100644
--- a/internal/service/athena/sweep.go
+++ b/internal/service/athena/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package athena
 
@@ -9,12 +9,12 @@ import (
 
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/athena"
-	"github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_athena_database", &resource.Sweeper{
 		Name: "aws_athena_database",
 		F:    sweepDatabases,
@@ -23,7 +23,7 @@ func init() {
 
 func sweepDatabases(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -31,13 +31,14 @@ func sweepDatabases(region string) error {
 	input := &athena.ListDatabasesInput{
 		CatalogName: aws.String("AwsDataCatalog"),
 	}
-	var errs *multierror.Error
-
 	sweepResources := make([]sweep.Sweepable, 0)
-	for {
-		output, err := conn.ListDatabasesWithContext(ctx, input)
 
-		for _, v := range output.DatabaseList {
+	err = conn.ListDatabasesPagesWithContext(ctx, input, func(page *athena.ListDatabasesOutput, lastPage bool) bool {
+		if page == nil {
+			return !lastPage
+		}
+
+		for _, v := range page.DatabaseList {
 			name := aws.StringValue(v.Name)
 			if name == "default" {
 				continue
@@ -45,34 +46,28 @@ func sweepDatabases(region string) error {
 			r := ResourceDatabase()
 			d := r.Data(nil)
 			d.SetId(name)
-
-			if err != nil {
-				err := fmt.Errorf("error listing Athena Databases (%s): %w", name, err)
-				log.Printf("[ERROR] %s", err)
-				errs = multierror.Append(errs, err)
-				continue
-			}
+			d.Set("force_destroy", true)
 
 			sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
 		}
 
-		if aws.StringValue(output.NextToken) == "" {
-			break
-		}
-
-		input.NextToken = output.NextToken
-	}
+		return !lastPage
+	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Athena Database sweep for %s: %s", region, err)
 		return nil
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	if err != nil {
+		return fmt.Errorf("error listing Athena Databases (%s): %w", region, err)
+	}
+
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
-		errs = multierror.Append(errs, fmt.Errorf("error sweeping Athena Databases (%s): %w", region, err))
+		return fmt.Errorf("error sweeping Athena Databases (%s): %w", region, err)
 	}
 
-	return errs.ErrorOrNil()
+	return nil
 }
diff --git a/internal/service/athena/tags_gen.go b/internal/service/athena/tags_gen.go
index dd0d7781686..985d3f53add 100644
--- a/internal/service/athena/tags_gen.go
+++ b/internal/service/athena/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/athena"
 	"github.com/aws/aws-sdk-go/service/athena/athenaiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -102,6 +104,8 @@ func updateTags(ctx context.Context, conn athenaiface.AthenaAPI, identifier stri
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.Athena)
 	if len(removedTags) > 0 {
diff --git a/internal/service/athena/workgroup.go b/internal/service/athena/workgroup.go
index a7737460f16..9195313edd9 100644
--- a/internal/service/athena/workgroup.go
+++ b/internal/service/athena/workgroup.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package athena
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/aws/aws-sdk-go/service/athena"
@@ -154,7 +157,7 @@ func ResourceWorkGroup() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 128),
-					validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9._-]+$`), "must contain only alphanumeric characters, periods, underscores, and hyphens"),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_.-]+$`), "must contain only alphanumeric characters, periods, underscores, and hyphens"),
 				),
 			},
 			"state": {
diff --git a/internal/service/athena/workgroup_test.go b/internal/service/athena/workgroup_test.go
index 424c38d3c85..a051d66811e 100644
--- a/internal/service/athena/workgroup_test.go
+++ b/internal/service/athena/workgroup_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package athena_test
 
 import (
diff --git a/internal/service/auditmanager/account_registration.go b/internal/service/auditmanager/account_registration.go
index 99dd32be4f8..2f655b86b53 100644
--- a/internal/service/auditmanager/account_registration.go
+++ b/internal/service/auditmanager/account_registration.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package auditmanager
 
 import (
@@ -11,8 +14,8 @@ import (
 	"github.com/hashicorp/terraform-plugin-framework/resource/schema"
 	"github.com/hashicorp/terraform-plugin-framework/types"
 	"github.com/hashicorp/terraform-provider-aws/internal/create"
-	"github.com/hashicorp/terraform-provider-aws/internal/flex"
 	"github.com/hashicorp/terraform-provider-aws/internal/framework"
+	"github.com/hashicorp/terraform-provider-aws/internal/framework/flex"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
diff --git a/internal/service/auditmanager/account_registration_test.go b/internal/service/auditmanager/account_registration_test.go
index acd38ed68c2..7fc7e464237 100644
--- a/internal/service/auditmanager/account_registration_test.go
+++ b/internal/service/auditmanager/account_registration_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package auditmanager_test
 
 import (
diff --git a/internal/service/auditmanager/assessment.go b/internal/service/auditmanager/assessment.go
index 8c03287e26b..0a27df1500d 100644
--- a/internal/service/auditmanager/assessment.go
+++ b/internal/service/auditmanager/assessment.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package auditmanager
 
 import (
@@ -24,8 +27,8 @@ import (
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-provider-aws/internal/create"
 	"github.com/hashicorp/terraform-provider-aws/internal/enum"
-	"github.com/hashicorp/terraform-provider-aws/internal/flex"
 	"github.com/hashicorp/terraform-provider-aws/internal/framework"
+	"github.com/hashicorp/terraform-provider-aws/internal/framework/flex"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/names"
diff --git a/internal/service/auditmanager/assessment_delegation.go b/internal/service/auditmanager/assessment_delegation.go
index 9d631df3199..0d73659b304 100644
--- a/internal/service/auditmanager/assessment_delegation.go
+++ b/internal/service/auditmanager/assessment_delegation.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package auditmanager
 
 import (
@@ -18,8 +21,8 @@ import (
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-provider-aws/internal/create"
 	"github.com/hashicorp/terraform-provider-aws/internal/enum"
-	"github.com/hashicorp/terraform-provider-aws/internal/flex"
 	"github.com/hashicorp/terraform-provider-aws/internal/framework"
+	"github.com/hashicorp/terraform-provider-aws/internal/framework/flex"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
diff --git a/internal/service/auditmanager/assessment_delegation_test.go b/internal/service/auditmanager/assessment_delegation_test.go
index 8759e559e18..e905b0af9ea 100644
--- a/internal/service/auditmanager/assessment_delegation_test.go
+++ b/internal/service/auditmanager/assessment_delegation_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package auditmanager_test
 
 import (
@@ -242,11 +245,6 @@ resource "aws_s3_bucket" "test" {
   force_destroy = true
 }
 
-resource "aws_s3_bucket_acl" "test" {
-  bucket = aws_s3_bucket.test.id
-  acl    = "private"
-}
-
 data "aws_iam_policy_document" "test" {
   statement {
     actions = ["sts:AssumeRole"]
diff --git a/internal/service/auditmanager/assessment_report.go b/internal/service/auditmanager/assessment_report.go
index 8a74ac049ca..8b5ad533448 100644
--- a/internal/service/auditmanager/assessment_report.go
+++ b/internal/service/auditmanager/assessment_report.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package auditmanager
 
 import (
@@ -17,8 +20,8 @@ import (
 	"github.com/hashicorp/terraform-plugin-framework/types"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-provider-aws/internal/create"
-	"github.com/hashicorp/terraform-provider-aws/internal/flex"
 	"github.com/hashicorp/terraform-provider-aws/internal/framework"
+	"github.com/hashicorp/terraform-provider-aws/internal/framework/flex"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
diff --git a/internal/service/auditmanager/assessment_report_test.go b/internal/service/auditmanager/assessment_report_test.go
index b99da56242d..93bb52e45d0 100644
--- a/internal/service/auditmanager/assessment_report_test.go
+++ b/internal/service/auditmanager/assessment_report_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package auditmanager_test
 
 import (
@@ -186,11 +189,6 @@ resource "aws_s3_bucket" "test" {
   force_destroy = true
 }
 
-resource "aws_s3_bucket_acl" "test" {
-  bucket = aws_s3_bucket.test.id
-  acl    = "private"
-}
-
 resource "aws_iam_role" "test" {
   name = %[1]q
 
diff --git a/internal/service/auditmanager/assessment_test.go b/internal/service/auditmanager/assessment_test.go
index e72435ae9fe..f4db1a3c5b8 100644
--- a/internal/service/auditmanager/assessment_test.go
+++ b/internal/service/auditmanager/assessment_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package auditmanager_test
 
 import (
 	"context"
 	"errors"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/service/auditmanager/types"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -44,7 +47,7 @@ func TestAccAuditManagerAssessment_basic(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "scope.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "scope.0.aws_accounts.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "scope.0.aws_services.#", "1"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "auditmanager", regexp.MustCompile(`assessment/+.`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "auditmanager", regexache.MustCompile(`assessment/+.`)),
 				),
 			},
 			{
diff --git a/internal/service/auditmanager/control.go b/internal/service/auditmanager/control.go
index 0095de787d0..01631e3e969 100644
--- a/internal/service/auditmanager/control.go
+++ b/internal/service/auditmanager/control.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package auditmanager
 
 import (
@@ -21,8 +24,8 @@ import (
 	"github.com/hashicorp/terraform-plugin-framework/types"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-provider-aws/internal/create"
-	"github.com/hashicorp/terraform-provider-aws/internal/flex"
 	"github.com/hashicorp/terraform-provider-aws/internal/framework"
+	"github.com/hashicorp/terraform-provider-aws/internal/framework/flex"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/names"
diff --git a/internal/service/auditmanager/control_data_source.go b/internal/service/auditmanager/control_data_source.go
index 239ded9950f..8fde891e458 100644
--- a/internal/service/auditmanager/control_data_source.go
+++ b/internal/service/auditmanager/control_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package auditmanager
 
 import (
@@ -16,8 +19,8 @@ import (
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/enum"
-	"github.com/hashicorp/terraform-provider-aws/internal/flex"
 	"github.com/hashicorp/terraform-provider-aws/internal/framework"
+	"github.com/hashicorp/terraform-provider-aws/internal/framework/flex"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 )
 
diff --git a/internal/service/auditmanager/control_data_source_test.go b/internal/service/auditmanager/control_data_source_test.go
index 847669ee50b..27058940715 100644
--- a/internal/service/auditmanager/control_data_source_test.go
+++ b/internal/service/auditmanager/control_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package auditmanager_test
 
 import (
diff --git a/internal/service/auditmanager/control_test.go b/internal/service/auditmanager/control_test.go
index 00b5e6e99ae..0be2c5e1984 100644
--- a/internal/service/auditmanager/control_test.go
+++ b/internal/service/auditmanager/control_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package auditmanager_test
 
 import (
 	"context"
 	"errors"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/service/auditmanager/types"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -42,7 +45,7 @@ func TestAccAuditManagerControl_basic(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "control_mapping_sources.0.source_name", rName),
 					resource.TestCheckResourceAttr(resourceName, "control_mapping_sources.0.source_set_up_option", string(types.SourceSetUpOptionProceduralControlsMapping)),
 					resource.TestCheckResourceAttr(resourceName, "control_mapping_sources.0.source_type", string(types.SourceTypeManual)),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "auditmanager", regexp.MustCompile(`control/+.`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "auditmanager", regexache.MustCompile(`control/+.`)),
 				),
 			},
 			{
diff --git a/internal/service/auditmanager/exports_test.go b/internal/service/auditmanager/exports_test.go
index 2ae72094478..86d78aba5dd 100644
--- a/internal/service/auditmanager/exports_test.go
+++ b/internal/service/auditmanager/exports_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package auditmanager
 
 // Exports for use in tests only.
diff --git a/internal/service/auditmanager/framework.go b/internal/service/auditmanager/framework.go
index 28e92902384..942630acaec 100644
--- a/internal/service/auditmanager/framework.go
+++ b/internal/service/auditmanager/framework.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package auditmanager
 
 import (
@@ -20,8 +23,8 @@ import (
 	"github.com/hashicorp/terraform-plugin-framework/types"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-provider-aws/internal/create"
-	"github.com/hashicorp/terraform-provider-aws/internal/flex"
 	"github.com/hashicorp/terraform-provider-aws/internal/framework"
+	"github.com/hashicorp/terraform-provider-aws/internal/framework/flex"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/names"
diff --git a/internal/service/auditmanager/framework_data_source.go b/internal/service/auditmanager/framework_data_source.go
index e73e2093592..6abd6a48e8f 100644
--- a/internal/service/auditmanager/framework_data_source.go
+++ b/internal/service/auditmanager/framework_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package auditmanager
 
 import (
@@ -14,8 +17,8 @@ import (
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/enum"
-	"github.com/hashicorp/terraform-provider-aws/internal/flex"
 	"github.com/hashicorp/terraform-provider-aws/internal/framework"
+	"github.com/hashicorp/terraform-provider-aws/internal/framework/flex"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 )
 
diff --git a/internal/service/auditmanager/framework_data_source_test.go b/internal/service/auditmanager/framework_data_source_test.go
index 808c97ff1c4..b8d5cd31cd0 100644
--- a/internal/service/auditmanager/framework_data_source_test.go
+++ b/internal/service/auditmanager/framework_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package auditmanager_test
 
 import (
diff --git a/internal/service/auditmanager/framework_share.go b/internal/service/auditmanager/framework_share.go
index 9a7e936bfae..fee1c941476 100644
--- a/internal/service/auditmanager/framework_share.go
+++ b/internal/service/auditmanager/framework_share.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package auditmanager
 
 import (
@@ -16,8 +19,8 @@ import (
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-provider-aws/internal/create"
 	"github.com/hashicorp/terraform-provider-aws/internal/enum"
-	"github.com/hashicorp/terraform-provider-aws/internal/flex"
 	"github.com/hashicorp/terraform-provider-aws/internal/framework"
+	"github.com/hashicorp/terraform-provider-aws/internal/framework/flex"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
diff --git a/internal/service/auditmanager/framework_share_test.go b/internal/service/auditmanager/framework_share_test.go
index 730d3028d99..841cf03bcd8 100644
--- a/internal/service/auditmanager/framework_share_test.go
+++ b/internal/service/auditmanager/framework_share_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package auditmanager_test
 
 import (
diff --git a/internal/service/auditmanager/framework_test.go b/internal/service/auditmanager/framework_test.go
index 9d07e360d4e..a1b5b535883 100644
--- a/internal/service/auditmanager/framework_test.go
+++ b/internal/service/auditmanager/framework_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package auditmanager_test
 
 import (
 	"context"
 	"errors"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/service/auditmanager/types"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -41,7 +44,7 @@ func TestAccAuditManagerFramework_basic(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "control_sets.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "control_sets.0.name", rName),
 					resource.TestCheckResourceAttr(resourceName, "control_sets.0.controls.#", "1"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "auditmanager", regexp.MustCompile(`assessmentFramework/+.`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "auditmanager", regexache.MustCompile(`assessmentFramework/+.`)),
 				),
 			},
 			{
diff --git a/internal/service/auditmanager/generate.go b/internal/service/auditmanager/generate.go
index 1ec18827095..48cabfcce65 100644
--- a/internal/service/auditmanager/generate.go
+++ b/internal/service/auditmanager/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -AWSSDKVersion=2 -ServiceTagsMap -KVTValues -SkipTypesImp -ListTags -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/auditmanager/organization_admin_account_registration.go b/internal/service/auditmanager/organization_admin_account_registration.go
index 0aaf4a5fc4e..b91385676a0 100644
--- a/internal/service/auditmanager/organization_admin_account_registration.go
+++ b/internal/service/auditmanager/organization_admin_account_registration.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package auditmanager
 
 import (
@@ -12,8 +15,8 @@ import (
 	"github.com/hashicorp/terraform-plugin-framework/resource/schema/stringplanmodifier"
 	"github.com/hashicorp/terraform-plugin-framework/types"
 	"github.com/hashicorp/terraform-provider-aws/internal/create"
-	"github.com/hashicorp/terraform-provider-aws/internal/flex"
 	"github.com/hashicorp/terraform-provider-aws/internal/framework"
+	"github.com/hashicorp/terraform-provider-aws/internal/framework/flex"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
diff --git a/internal/service/auditmanager/organization_admin_account_registration_test.go b/internal/service/auditmanager/organization_admin_account_registration_test.go
index e001e06ce8f..18ae53c0dcf 100644
--- a/internal/service/auditmanager/organization_admin_account_registration_test.go
+++ b/internal/service/auditmanager/organization_admin_account_registration_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package auditmanager_test
 
 import (
diff --git a/internal/service/auditmanager/service_package_gen.go b/internal/service/auditmanager/service_package_gen.go
index b5c2f31ceb6..242268fbff0 100644
--- a/internal/service/auditmanager/service_package_gen.go
+++ b/internal/service/auditmanager/service_package_gen.go
@@ -7,6 +7,7 @@ import (
 
 	aws_sdkv2 "github.com/aws/aws-sdk-go-v2/aws"
 	auditmanager_sdkv2 "github.com/aws/aws-sdk-go-v2/service/auditmanager"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -83,9 +84,11 @@ func (p *servicePackage) NewClient(ctx context.Context, config map[string]any) (
 
 	return auditmanager_sdkv2.NewFromConfig(cfg, func(o *auditmanager_sdkv2.Options) {
 		if endpoint := config["endpoint"].(string); endpoint != "" {
-			o.EndpointResolver = auditmanager_sdkv2.EndpointResolverFromURL(endpoint)
+			o.BaseEndpoint = aws_sdkv2.String(endpoint)
 		}
 	}), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/auditmanager/sweep.go b/internal/service/auditmanager/sweep.go
index 8af4a982a9a..6afef0984e4 100644
--- a/internal/service/auditmanager/sweep.go
+++ b/internal/service/auditmanager/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package auditmanager
 
@@ -11,13 +11,13 @@ import (
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/auditmanager"
 	"github.com/aws/aws-sdk-go-v2/service/auditmanager/types"
-	"github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv2"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep/framework"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_auditmanager_assessment", &resource.Sweeper{
 		Name: "aws_auditmanager_assessment",
 		F:    sweepAssessments,
@@ -57,29 +57,25 @@ func init() {
 // AccessDeniedException: Please complete AWS Audit Manager setup from home page to enable this action in this account.
 func isCompleteSetupError(err error) bool {
 	var ade *types.AccessDeniedException
-	if errors.As(err, &ade) {
-		return true
-	}
-	return false
+	return errors.As(err, &ade)
 }
 
 func sweepAssessments(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
-		fmt.Errorf("error getting client: %s", err)
+		return fmt.Errorf("error getting client: %s", err)
 	}
 
 	conn := client.AuditManagerClient(ctx)
 	sweepResources := make([]sweep.Sweepable, 0)
 	in := &auditmanager.ListAssessmentsInput{}
-	var errs *multierror.Error
 
 	pages := auditmanager.NewListAssessmentsPaginator(conn, in)
 
 	for pages.HasMorePages() {
 		page, err := pages.NextPage(ctx)
-		if sweep.SkipSweepError(err) || isCompleteSetupError(err) {
+		if awsv2.SkipSweepError(err) || isCompleteSetupError(err) {
 			log.Printf("[WARN] Skipping AuditManager Assessments sweep for %s: %s", region, err)
 			return nil
 		}
@@ -97,34 +93,29 @@ func sweepAssessments(region string) error {
 		}
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
-		errs = multierror.Append(errs, fmt.Errorf("error sweeping AuditManager Assessments for %s: %w", region, err))
-	}
-	if sweep.SkipSweepError(err) {
-		log.Printf("[WARN] Skipping AuditManager Assessments sweep for %s: %s", region, errs)
-		return nil
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
+		return fmt.Errorf("error sweeping AuditManager Assessments for %s: %w", region, err)
 	}
 
-	return errs.ErrorOrNil()
+	return nil
 }
 
 func sweepAssessmentDelegations(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
-		fmt.Errorf("error getting client: %s", err)
+		return fmt.Errorf("error getting client: %s", err)
 	}
 
 	conn := client.AuditManagerClient(ctx)
 	sweepResources := make([]sweep.Sweepable, 0)
 	in := &auditmanager.GetDelegationsInput{}
-	var errs *multierror.Error
 
 	pages := auditmanager.NewGetDelegationsPaginator(conn, in)
 
 	for pages.HasMorePages() {
 		page, err := pages.NextPage(ctx)
-		if sweep.SkipSweepError(err) || isCompleteSetupError(err) {
+		if awsv2.SkipSweepError(err) || isCompleteSetupError(err) {
 			log.Printf("[WARN] Skipping AuditManager Assesment Delegations sweep for %s: %s", region, err)
 			return nil
 		}
@@ -141,34 +132,29 @@ func sweepAssessmentDelegations(region string) error {
 		}
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
-		errs = multierror.Append(errs, fmt.Errorf("error sweeping AuditManager Assessment Delegations for %s: %w", region, err))
-	}
-	if sweep.SkipSweepError(err) {
-		log.Printf("[WARN] Skipping AuditManager Assessment Delegations sweep for %s: %s", region, errs)
-		return nil
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
+		return fmt.Errorf("error sweeping AuditManager Assessment Delegations for %s: %w", region, err)
 	}
 
-	return errs.ErrorOrNil()
+	return nil
 }
 
 func sweepAssessmentReports(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
-		fmt.Errorf("error getting client: %s", err)
+		return fmt.Errorf("error getting client: %s", err)
 	}
 
 	conn := client.AuditManagerClient(ctx)
 	sweepResources := make([]sweep.Sweepable, 0)
 	in := &auditmanager.ListAssessmentReportsInput{}
-	var errs *multierror.Error
 
 	pages := auditmanager.NewListAssessmentReportsPaginator(conn, in)
 
 	for pages.HasMorePages() {
 		page, err := pages.NextPage(ctx)
-		if sweep.SkipSweepError(err) || isCompleteSetupError(err) {
+		if awsv2.SkipSweepError(err) || isCompleteSetupError(err) {
 			log.Printf("[WARN] Skipping AuditManager Assesment Reports sweep for %s: %s", region, err)
 			return nil
 		}
@@ -187,34 +173,29 @@ func sweepAssessmentReports(region string) error {
 		}
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
-		errs = multierror.Append(errs, fmt.Errorf("error sweeping AuditManager Assessment Reports for %s: %w", region, err))
-	}
-	if sweep.SkipSweepError(err) {
-		log.Printf("[WARN] Skipping AuditManager Assessment Reports sweep for %s: %s", region, errs)
-		return nil
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
+		return fmt.Errorf("error sweeping AuditManager Assessment Reports for %s: %w", region, err)
 	}
 
-	return errs.ErrorOrNil()
+	return nil
 }
 
 func sweepControls(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
-		fmt.Errorf("error getting client: %s", err)
+		return fmt.Errorf("error getting client: %s", err)
 	}
 
 	conn := client.AuditManagerClient(ctx)
 	sweepResources := make([]sweep.Sweepable, 0)
 	in := &auditmanager.ListControlsInput{ControlType: types.ControlTypeCustom}
-	var errs *multierror.Error
 
 	pages := auditmanager.NewListControlsPaginator(conn, in)
 
 	for pages.HasMorePages() {
 		page, err := pages.NextPage(ctx)
-		if sweep.SkipSweepError(err) || isCompleteSetupError(err) {
+		if awsv2.SkipSweepError(err) || isCompleteSetupError(err) {
 			log.Printf("[WARN] Skipping AuditManager Controls sweep for %s: %s", region, err)
 			return nil
 		}
@@ -232,34 +213,29 @@ func sweepControls(region string) error {
 		}
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
-		errs = multierror.Append(errs, fmt.Errorf("error sweeping AuditManager Controls for %s: %w", region, err))
-	}
-	if sweep.SkipSweepError(err) {
-		log.Printf("[WARN] Skipping AuditManager Controls sweep for %s: %s", region, errs)
-		return nil
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
+		return fmt.Errorf("error sweeping AuditManager Controls for %s: %w", region, err)
 	}
 
-	return errs.ErrorOrNil()
+	return nil
 }
 
 func sweepFrameworks(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
-		fmt.Errorf("error getting client: %s", err)
+		return fmt.Errorf("error getting client: %s", err)
 	}
 
 	conn := client.AuditManagerClient(ctx)
 	sweepResources := make([]sweep.Sweepable, 0)
 	in := &auditmanager.ListAssessmentFrameworksInput{FrameworkType: types.FrameworkTypeCustom}
-	var errs *multierror.Error
 
 	pages := auditmanager.NewListAssessmentFrameworksPaginator(conn, in)
 
 	for pages.HasMorePages() {
 		page, err := pages.NextPage(ctx)
-		if sweep.SkipSweepError(err) || isCompleteSetupError(err) {
+		if awsv2.SkipSweepError(err) || isCompleteSetupError(err) {
 			log.Printf("[WARN] Skipping AuditManager Frameworks sweep for %s: %s", region, err)
 			return nil
 		}
@@ -277,34 +253,29 @@ func sweepFrameworks(region string) error {
 		}
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
-		errs = multierror.Append(errs, fmt.Errorf("error sweeping AuditManager Frameworks for %s: %w", region, err))
-	}
-	if sweep.SkipSweepError(err) {
-		log.Printf("[WARN] Skipping AuditManager Frameworks sweep for %s: %s", region, errs)
-		return nil
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
+		return fmt.Errorf("error sweeping AuditManager Frameworks for %s: %w", region, err)
 	}
 
-	return errs.ErrorOrNil()
+	return nil
 }
 
 func sweepFrameworkShares(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
-		fmt.Errorf("error getting client: %s", err)
+		return fmt.Errorf("error getting client: %s", err)
 	}
 
 	conn := client.AuditManagerClient(ctx)
 	sweepResources := make([]sweep.Sweepable, 0)
 	in := &auditmanager.ListAssessmentFrameworkShareRequestsInput{RequestType: types.ShareRequestTypeSent}
-	var errs *multierror.Error
 
 	pages := auditmanager.NewListAssessmentFrameworkShareRequestsPaginator(conn, in)
 
 	for pages.HasMorePages() {
 		page, err := pages.NextPage(ctx)
-		if sweep.SkipSweepError(err) || isCompleteSetupError(err) {
+		if awsv2.SkipSweepError(err) || isCompleteSetupError(err) {
 			log.Printf("[WARN] Skipping AuditManager Framework Shares sweep for %s: %s", region, err)
 			return nil
 		}
@@ -322,13 +293,9 @@ func sweepFrameworkShares(region string) error {
 		}
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
-		errs = multierror.Append(errs, fmt.Errorf("error sweeping AuditManager Framework Shares for %s: %w", region, err))
-	}
-	if sweep.SkipSweepError(err) {
-		log.Printf("[WARN] Skipping AuditManager Framework Shares sweep for %s: %s", region, errs)
-		return nil
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
+		return fmt.Errorf("error sweeping AuditManager Framework Shares for %s: %w", region, err)
 	}
 
-	return errs.ErrorOrNil()
+	return nil
 }
diff --git a/internal/service/auditmanager/tags_gen.go b/internal/service/auditmanager/tags_gen.go
index 9bc8511709d..8bae514eb2f 100644
--- a/internal/service/auditmanager/tags_gen.go
+++ b/internal/service/auditmanager/tags_gen.go
@@ -7,7 +7,9 @@ import (
 
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/auditmanager"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -53,7 +55,7 @@ func Tags(tags tftags.KeyValueTags) map[string]string {
 	return tags.Map()
 }
 
-// KeyValueTags creates KeyValueTags from auditmanager service tags.
+// KeyValueTags creates tftags.KeyValueTags from auditmanager service tags.
 func KeyValueTags(ctx context.Context, tags map[string]string) tftags.KeyValueTags {
 	return tftags.New(ctx, tags)
 }
@@ -84,6 +86,8 @@ func updateTags(ctx context.Context, conn *auditmanager.Client, identifier strin
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.AuditManager)
 	if len(removedTags) > 0 {
diff --git a/internal/service/autoscaling/attachment.go b/internal/service/autoscaling/attachment.go
index fbde618f120..3fbd96a1ff8 100644
--- a/internal/service/autoscaling/attachment.go
+++ b/internal/service/autoscaling/attachment.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package autoscaling
 
 import (
diff --git a/internal/service/autoscaling/attachment_test.go b/internal/service/autoscaling/attachment_test.go
index 7e94a99710d..b646ae3ec69 100644
--- a/internal/service/autoscaling/attachment_test.go
+++ b/internal/service/autoscaling/attachment_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package autoscaling_test
 
 import (
diff --git a/internal/service/autoscaling/consts.go b/internal/service/autoscaling/consts.go
index 1c2a3506005..2c3ccd07169 100644
--- a/internal/service/autoscaling/consts.go
+++ b/internal/service/autoscaling/consts.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package autoscaling
 
 import (
@@ -82,3 +85,7 @@ const (
 	TrafficSourceStateRemoving  = "Removing"
 	TrafficSourceStateRemoved   = "Removed"
 )
+
+const (
+	launchTemplateIDUnknown = "unknown"
+)
diff --git a/internal/service/autoscaling/errors.go b/internal/service/autoscaling/errors.go
index c1b17bdd180..6f1ca00713f 100644
--- a/internal/service/autoscaling/errors.go
+++ b/internal/service/autoscaling/errors.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package autoscaling
 
 const (
diff --git a/internal/service/autoscaling/flex.go b/internal/service/autoscaling/flex.go
index 4cf62ffdd54..28c41aab07f 100644
--- a/internal/service/autoscaling/flex.go
+++ b/internal/service/autoscaling/flex.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package autoscaling
 
 import (
diff --git a/internal/service/autoscaling/flex_test.go b/internal/service/autoscaling/flex_test.go
index fd5f244a041..598de484cc1 100644
--- a/internal/service/autoscaling/flex_test.go
+++ b/internal/service/autoscaling/flex_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package autoscaling
 
 import (
diff --git a/internal/service/autoscaling/generate.go b/internal/service/autoscaling/generate.go
index 5900a6f51aa..c29c3890830 100644
--- a/internal/service/autoscaling/generate.go
+++ b/internal/service/autoscaling/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -GetTag -ListTags -ListTagsOp=DescribeTags -ListTagsInFiltIDName=auto-scaling-group -ServiceTagsSlice -TagOp=CreateOrUpdateTags -TagResTypeElem=ResourceType -TagType2=TagDescription -TagTypeAddBoolElem=PropagateAtLaunch -TagTypeIDElem=ResourceId -UntagOp=DeleteTags -UntagInNeedTagType -UntagInTagsElem=Tags -UpdateTags
 //go:generate go run ../../generate/listpages/main.go -ListOps=DescribeInstanceRefreshes,DescribeLoadBalancers,DescribeLoadBalancerTargetGroups,DescribeWarmPool
 //go:generate go run ../../generate/servicepackage/main.go
diff --git a/internal/service/autoscaling/group.go b/internal/service/autoscaling/group.go
index 68660193a01..ccd6598eca9 100644
--- a/internal/service/autoscaling/group.go
+++ b/internal/service/autoscaling/group.go
@@ -1,21 +1,24 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package autoscaling
 
 import ( // nosemgrep:ci.semgrep.aws.multiple-service-imports
 	"context"
+	"errors"
 	"fmt"
 	"log"
-	"regexp"
 	"strconv"
 	"strings"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/autoscaling"
 	"github.com/aws/aws-sdk-go/service/elb"
 	"github.com/aws/aws-sdk-go/service/elbv2"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	"github.com/hashicorp/go-cty/cty"
-	multierror "github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/customdiff"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
@@ -25,11 +28,11 @@ import ( // nosemgrep:ci.semgrep.aws.multiple-service-imports
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/create"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
-	"github.com/hashicorp/terraform-provider-aws/internal/experimental/nullable"
 	"github.com/hashicorp/terraform-provider-aws/internal/flex"
 	tfelb "github.com/hashicorp/terraform-provider-aws/internal/service/elb"
 	"github.com/hashicorp/terraform-provider-aws/internal/slices"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/internal/types/nullable"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
 )
 
@@ -50,6 +53,15 @@ func ResourceGroup() *schema.Resource {
 			Delete: schema.DefaultTimeout(10 * time.Minute),
 		},
 
+		SchemaVersion: 1,
+		StateUpgraders: []schema.StateUpgrader{
+			{
+				Type:    resourceGroupV0().CoreConfigSchema().ImpliedType(),
+				Upgrade: GroupStateUpgradeV0,
+				Version: 0,
+			},
+		},
+
 		Schema: map[string]*schema.Schema{
 			"arn": {
 				Type:     schema.TypeString,
@@ -114,6 +126,11 @@ func ResourceGroup() *schema.Resource {
 				Optional: true,
 				Computed: true,
 			},
+			"ignore_failed_scaling_activities": {
+				Type:     schema.TypeBool,
+				Optional: true,
+				Default:  false,
+			},
 			"initial_lifecycle_hook": {
 				Type:     schema.TypeSet,
 				Optional: true,
@@ -191,11 +208,23 @@ func ResourceGroup() *schema.Resource {
 										Default:      90,
 										ValidateFunc: validation.IntBetween(0, 100),
 									},
+									"scale_in_protected_instances": {
+										Type:         schema.TypeString,
+										Optional:     true,
+										Default:      autoscaling.ScaleInProtectedInstancesIgnore,
+										ValidateFunc: validation.StringInSlice(autoscaling.ScaleInProtectedInstances_Values(), false),
+									},
 									"skip_matching": {
 										Type:     schema.TypeBool,
 										Optional: true,
 										Default:  false,
 									},
+									"standby_instances": {
+										Type:         schema.TypeString,
+										Optional:     true,
+										Default:      autoscaling.StandbyInstancesIgnore,
+										ValidateFunc: validation.StringInSlice(autoscaling.StandbyInstances_Values(), false),
+									},
 								},
 							},
 						},
@@ -224,6 +253,7 @@ func ResourceGroup() *schema.Resource {
 				Type:     schema.TypeList,
 				MaxItems: 1,
 				Optional: true,
+				Computed: true,
 				Elem: &schema.Resource{
 					Schema: map[string]*schema.Schema{
 						"id": {
@@ -280,6 +310,7 @@ func ResourceGroup() *schema.Resource {
 			"mixed_instances_policy": {
 				Type:     schema.TypeList,
 				Optional: true,
+				Computed: true,
 				MaxItems: 1,
 				Elem: &schema.Resource{
 					Schema: map[string]*schema.Schema{
@@ -367,6 +398,7 @@ func ResourceGroup() *schema.Resource {
 									"override": {
 										Type:     schema.TypeList,
 										Optional: true,
+										Computed: true,
 										Elem: &schema.Resource{
 											Schema: map[string]*schema.Schema{
 												"instance_requirements": {
@@ -670,7 +702,7 @@ func ResourceGroup() *schema.Resource {
 												"weighted_capacity": {
 													Type:         schema.TypeString,
 													Optional:     true,
-													ValidateFunc: validation.StringMatch(regexp.MustCompile(`^[1-9][0-9]{0,2}$`), "see https://docs.aws.amazon.com/autoscaling/ec2/APIReference/API_LaunchTemplateOverrides.html"),
+													ValidateFunc: validation.StringMatch(regexache.MustCompile(`^[1-9][0-9]{0,2}$`), "see https://docs.aws.amazon.com/autoscaling/ec2/APIReference/API_LaunchTemplateOverrides.html"),
 												},
 											},
 										},
@@ -836,16 +868,63 @@ func ResourceGroup() *schema.Resource {
 		},
 
 		CustomizeDiff: customdiff.Sequence(
-			customdiff.ComputedIf("launch_template.0.id", func(_ context.Context, diff *schema.ResourceDiff, meta interface{}) bool {
-				return diff.HasChange("launch_template.0.name")
-			}),
-			customdiff.ComputedIf("launch_template.0.name", func(_ context.Context, diff *schema.ResourceDiff, meta interface{}) bool {
-				return diff.HasChange("launch_template.0.id")
-			}),
+			launchTemplateCustomDiff("launch_template", "launch_template.0.name"),
+			launchTemplateCustomDiff("mixed_instances_policy", "mixed_instances_policy.0.launch_template.0.launch_template_specification.0.launch_template_name"),
+			launchTemplateCustomDiff("mixed_instances_policy", "mixed_instances_policy.0.launch_template.0.override"),
 		),
 	}
 }
 
+func launchTemplateCustomDiff(baseAttribute, subAttribute string) schema.CustomizeDiffFunc {
+	return func(_ context.Context, diff *schema.ResourceDiff, _ interface{}) error {
+		if diff.HasChange(subAttribute) {
+			n := diff.Get(baseAttribute)
+			ba, ok := n.([]interface{})
+			if !ok {
+				return nil
+			}
+
+			if baseAttribute == "launch_template" {
+				launchTemplate := ba[0].(map[string]interface{})
+				launchTemplate["id"] = launchTemplateIDUnknown
+
+				if err := diff.SetNew(baseAttribute, ba); err != nil {
+					return err
+				}
+			}
+
+			if baseAttribute == "mixed_instances_policy" && !strings.Contains(subAttribute, "override") {
+				launchTemplate := ba[0].(map[string]interface{})["launch_template"].([]interface{})[0].(map[string]interface{})["launch_template_specification"].([]interface{})[0]
+				launchTemplateSpecification := launchTemplate.(map[string]interface{})
+				launchTemplateSpecification["launch_template_id"] = launchTemplateIDUnknown
+
+				if err := diff.SetNew(baseAttribute, ba); err != nil {
+					return err
+				}
+			}
+
+			if baseAttribute == "mixed_instances_policy" && strings.Contains(subAttribute, "override") {
+				launchTemplate := ba[0].(map[string]interface{})["launch_template"].([]interface{})[0].(map[string]interface{})["override"].([]interface{})
+
+				for i := range launchTemplate {
+					key := fmt.Sprintf("mixed_instances_policy.0.launch_template.0.override.%d.launch_template_specification.0.launch_template_name", i)
+
+					if diff.HasChange(key) {
+						launchTemplateSpecification := launchTemplate[i].(map[string]interface{})["launch_template_specification"].([]interface{})[0].(map[string]interface{})
+						launchTemplateSpecification["launch_template_id"] = launchTemplateIDUnknown
+					}
+				}
+
+				if err := diff.SetNew(baseAttribute, ba); err != nil {
+					return err
+				}
+			}
+		}
+
+		return nil
+	}
+}
+
 func resourceGroupCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).AutoScalingConn(ctx)
@@ -1029,7 +1108,7 @@ func resourceGroupCreate(ctx context.Context, d *schema.ResourceData, meta inter
 				return nil
 			}
 
-			if err := waitGroupCapacitySatisfied(ctx, conn, meta.(*conns.AWSClient).ELBConn(ctx), meta.(*conns.AWSClient).ELBV2Conn(ctx), d.Id(), f, startTime, timeout); err != nil {
+			if err := waitGroupCapacitySatisfied(ctx, conn, meta.(*conns.AWSClient).ELBConn(ctx), meta.(*conns.AWSClient).ELBV2Conn(ctx), d.Id(), f, startTime, d.Get("ignore_failed_scaling_activities").(bool), timeout); err != nil {
 				return sdkdiag.AppendErrorf(diags, "waiting for Auto Scaling Group (%s) capacity satisfied: %s", d.Id(), err)
 			}
 		}
@@ -1521,7 +1600,7 @@ func resourceGroupUpdate(ctx context.Context, d *schema.ResourceData, meta inter
 					return nil
 				}
 
-				if err := waitGroupCapacitySatisfied(ctx, conn, meta.(*conns.AWSClient).ELBConn(ctx), meta.(*conns.AWSClient).ELBV2Conn(ctx), d.Id(), f, startTime, timeout); err != nil {
+				if err := waitGroupCapacitySatisfied(ctx, conn, meta.(*conns.AWSClient).ELBConn(ctx), meta.(*conns.AWSClient).ELBV2Conn(ctx), d.Id(), f, startTime, d.Get("ignore_failed_scaling_activities").(bool), timeout); err != nil {
 					return sdkdiag.AppendErrorf(diags, "waiting for Auto Scaling Group (%s) capacity satisfied: %s", d.Id(), err)
 				}
 			}
@@ -2159,31 +2238,33 @@ func findWarmPool(ctx context.Context, conn *autoscaling.AutoScaling, name strin
 	return output, nil
 }
 
-func statusGroupCapacity(ctx context.Context, conn *autoscaling.AutoScaling, elbconn *elb.ELB, elbv2conn *elbv2.ELBV2, name string, startTime time.Time, cb func(int, int) error) retry.StateRefreshFunc {
+func statusGroupCapacity(ctx context.Context, conn *autoscaling.AutoScaling, elbconn *elb.ELB, elbv2conn *elbv2.ELBV2, name string, cb func(int, int) error, startTime time.Time, ignoreFailedScalingActivities bool) retry.StateRefreshFunc {
 	return func() (interface{}, string, error) {
-		// Check for fatal error in activity logs.
-		scalingActivities, err := findScalingActivitiesByName(ctx, conn, name, startTime)
+		if !ignoreFailedScalingActivities {
+			// Check for fatal error in activity logs.
+			scalingActivities, err := findScalingActivitiesByName(ctx, conn, name, startTime)
 
-		if err != nil {
-			return nil, "", fmt.Errorf("reading scaling activities: %w", err)
-		}
+			if err != nil {
+				return nil, "", fmt.Errorf("reading scaling activities: %w", err)
+			}
 
-		var errors *multierror.Error
+			var errs []error
 
-		for _, v := range scalingActivities {
-			if statusCode := aws.StringValue(v.StatusCode); statusCode == autoscaling.ScalingActivityStatusCodeFailed && aws.Int64Value(v.Progress) == 100 {
-				if strings.Contains(aws.StringValue(v.StatusMessage), "Invalid IAM Instance Profile") {
-					// the activity will likely be retried
-					continue
+			for _, v := range scalingActivities {
+				if statusCode := aws.StringValue(v.StatusCode); statusCode == autoscaling.ScalingActivityStatusCodeFailed && aws.Int64Value(v.Progress) == 100 {
+					if strings.Contains(aws.StringValue(v.StatusMessage), "Invalid IAM Instance Profile") {
+						// the activity will likely be retried
+						continue
+					}
+					errs = append(errs, fmt.Errorf("scaling activity (%s): %s: %s", aws.StringValue(v.ActivityId), statusCode, aws.StringValue(v.StatusMessage)))
 				}
-				errors = multierror.Append(errors, fmt.Errorf("Scaling activity (%s): %s: %s", aws.StringValue(v.ActivityId), statusCode, aws.StringValue(v.StatusMessage)))
 			}
-		}
 
-		err = errors.ErrorOrNil()
+			err = errors.Join(errs...)
 
-		if err != nil {
-			return nil, "", err
+			if err != nil {
+				return nil, "", err
+			}
 		}
 
 		g, err := FindGroupByName(ctx, conn, name)
@@ -2412,10 +2493,10 @@ func statusWarmPoolInstanceCount(ctx context.Context, conn *autoscaling.AutoScal
 	}
 }
 
-func waitGroupCapacitySatisfied(ctx context.Context, conn *autoscaling.AutoScaling, elbconn *elb.ELB, elbv2conn *elbv2.ELBV2, name string, cb func(int, int) error, startTime time.Time, timeout time.Duration) error {
+func waitGroupCapacitySatisfied(ctx context.Context, conn *autoscaling.AutoScaling, elbconn *elb.ELB, elbv2conn *elbv2.ELBV2, name string, cb func(int, int) error, startTime time.Time, ignoreFailedScalingActivities bool, timeout time.Duration) error {
 	stateConf := &retry.StateChangeConf{
 		Target:  []string{"ok"},
-		Refresh: statusGroupCapacity(ctx, conn, elbconn, elbv2conn, name, startTime, cb),
+		Refresh: statusGroupCapacity(ctx, conn, elbconn, elbv2conn, name, cb, startTime, ignoreFailedScalingActivities),
 		Timeout: timeout,
 	}
 
@@ -3004,7 +3085,7 @@ func expandLaunchTemplateSpecificationForMixedInstancesPolicy(tfMap map[string]i
 	// API returns both ID and name, which Terraform saves to state. Next update returns:
 	// ValidationError: Valid requests must contain either launchTemplateId or LaunchTemplateName
 	// Prefer the ID if we have both.
-	if v, ok := tfMap["launch_template_id"]; ok && v != "" {
+	if v, ok := tfMap["launch_template_id"]; ok && v != "" && v != launchTemplateIDUnknown {
 		apiObject.LaunchTemplateId = aws.String(v.(string))
 	} else if v, ok := tfMap["launch_template_name"]; ok && v != "" {
 		apiObject.LaunchTemplateName = aws.String(v.(string))
@@ -3026,7 +3107,7 @@ func expandLaunchTemplateSpecification(tfMap map[string]interface{}) *autoscalin
 
 	// DescribeAutoScalingGroups returns both name and id but LaunchTemplateSpecification
 	// allows only one of them to be set.
-	if v, ok := tfMap["id"]; ok && v != "" {
+	if v, ok := tfMap["id"]; ok && v != "" && v != launchTemplateIDUnknown {
 		apiObject.LaunchTemplateId = aws.String(v.(string))
 	} else if v, ok := tfMap["name"]; ok && v != "" {
 		apiObject.LaunchTemplateName = aws.String(v.(string))
@@ -3224,10 +3305,18 @@ func expandRefreshPreferences(tfMap map[string]interface{}) *autoscaling.Refresh
 		apiObject.MinHealthyPercentage = aws.Int64(int64(v))
 	}
 
+	if v, ok := tfMap["scale_in_protected_instances"].(string); ok {
+		apiObject.ScaleInProtectedInstances = aws.String(v)
+	}
+
 	if v, ok := tfMap["skip_matching"].(bool); ok {
 		apiObject.SkipMatching = aws.Bool(v)
 	}
 
+	if v, ok := tfMap["standby_instances"].(string); ok {
+		apiObject.StandbyInstances = aws.String(v)
+	}
+
 	return apiObject
 }
 
@@ -3882,7 +3971,7 @@ func validateGroupInstanceRefreshTriggerFields(i interface{}, path cty.Path) dia
 		}
 	}
 
-	schema := ResourceGroup().Schema
+	schema := ResourceGroup().SchemaMap()
 	for attr, attrSchema := range schema {
 		if v == attr {
 			if attrSchema.Computed && !attrSchema.Optional {
diff --git a/internal/service/autoscaling/group_data_source.go b/internal/service/autoscaling/group_data_source.go
index de22c3b7673..968df4b694a 100644
--- a/internal/service/autoscaling/group_data_source.go
+++ b/internal/service/autoscaling/group_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package autoscaling
 
 import (
diff --git a/internal/service/autoscaling/group_data_source_test.go b/internal/service/autoscaling/group_data_source_test.go
index 90459bb261f..6454972bf8a 100644
--- a/internal/service/autoscaling/group_data_source_test.go
+++ b/internal/service/autoscaling/group_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package autoscaling_test
 
 import (
diff --git a/internal/service/autoscaling/group_migrate.go b/internal/service/autoscaling/group_migrate.go
new file mode 100644
index 00000000000..8bb7d144b1e
--- /dev/null
+++ b/internal/service/autoscaling/group_migrate.go
@@ -0,0 +1,754 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package autoscaling
+
+import (
+	"context"
+
+	"github.com/aws/aws-sdk-go/service/autoscaling"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-provider-aws/internal/types/nullable"
+)
+
+// aws_autoscaling_group resource's Schema @v5.11.0 minus validators.
+func resourceGroupV0() *schema.Resource {
+	return &schema.Resource{
+		Schema: map[string]*schema.Schema{
+			"arn": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"availability_zones": {
+				Type:     schema.TypeSet,
+				Optional: true,
+				Computed: true,
+				Elem:     &schema.Schema{Type: schema.TypeString},
+			},
+			"capacity_rebalance": {
+				Type:     schema.TypeBool,
+				Optional: true,
+			},
+			"context": {
+				Type:     schema.TypeString,
+				Optional: true,
+			},
+			"default_cooldown": {
+				Type:     schema.TypeInt,
+				Optional: true,
+				Computed: true,
+			},
+			"default_instance_warmup": {
+				Type:     schema.TypeInt,
+				Optional: true,
+			},
+			"desired_capacity": {
+				Type:     schema.TypeInt,
+				Optional: true,
+				Computed: true,
+			},
+			"desired_capacity_type": {
+				Type:     schema.TypeString,
+				Optional: true,
+			},
+			"enabled_metrics": {
+				Type:     schema.TypeSet,
+				Optional: true,
+				Elem:     &schema.Schema{Type: schema.TypeString},
+			},
+			"force_delete": {
+				Type:     schema.TypeBool,
+				Optional: true,
+				Default:  false,
+			},
+			"force_delete_warm_pool": {
+				Type:     schema.TypeBool,
+				Optional: true,
+				Default:  false,
+			},
+			"health_check_grace_period": {
+				Type:     schema.TypeInt,
+				Optional: true,
+				Default:  300,
+			},
+			"health_check_type": {
+				Type:     schema.TypeString,
+				Optional: true,
+				Computed: true,
+			},
+			"initial_lifecycle_hook": {
+				Type:     schema.TypeSet,
+				Optional: true,
+				ForceNew: true,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"default_result": {
+							Type:     schema.TypeString,
+							Optional: true,
+							Computed: true,
+						},
+						"heartbeat_timeout": {
+							Type:     schema.TypeInt,
+							Optional: true,
+						},
+						"lifecycle_transition": {
+							Type:     schema.TypeString,
+							Required: true,
+						},
+						"name": {
+							Type:     schema.TypeString,
+							Required: true,
+						},
+						"notification_metadata": {
+							Type:     schema.TypeString,
+							Optional: true,
+						},
+						"notification_target_arn": {
+							Type:     schema.TypeString,
+							Optional: true,
+						},
+						"role_arn": {
+							Type:     schema.TypeString,
+							Optional: true,
+						},
+					},
+				},
+			},
+			"instance_refresh": {
+				Type:     schema.TypeList,
+				MaxItems: 1,
+				Optional: true,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"preferences": {
+							Type:     schema.TypeList,
+							MaxItems: 1,
+							Optional: true,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"auto_rollback": {
+										Type:     schema.TypeBool,
+										Optional: true,
+									},
+									"checkpoint_delay": {
+										Type:     nullable.TypeNullableInt,
+										Optional: true,
+									},
+									"checkpoint_percentages": {
+										Type:     schema.TypeList,
+										Optional: true,
+										Elem: &schema.Schema{
+											Type: schema.TypeInt,
+										},
+									},
+									"instance_warmup": {
+										Type:     nullable.TypeNullableInt,
+										Optional: true,
+									},
+									"min_healthy_percentage": {
+										Type:     schema.TypeInt,
+										Optional: true,
+										Default:  90,
+									},
+									"skip_matching": {
+										Type:     schema.TypeBool,
+										Optional: true,
+										Default:  false,
+									},
+								},
+							},
+						},
+						"strategy": {
+							Type:     schema.TypeString,
+							Required: true,
+						},
+						"triggers": {
+							Type:     schema.TypeSet,
+							Optional: true,
+							Elem: &schema.Schema{
+								Type: schema.TypeString,
+							},
+						},
+					},
+				},
+			},
+			"launch_configuration": {
+				Type:     schema.TypeString,
+				Optional: true,
+			},
+			"launch_template": {
+				Type:     schema.TypeList,
+				MaxItems: 1,
+				Optional: true,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"id": {
+							Type:     schema.TypeString,
+							Optional: true,
+							Computed: true,
+						},
+						"name": {
+							Type:     schema.TypeString,
+							Optional: true,
+							Computed: true,
+						},
+						"version": {
+							Type:     schema.TypeString,
+							Optional: true,
+						},
+					},
+				},
+			},
+			"load_balancers": {
+				Type:     schema.TypeSet,
+				Optional: true,
+				Computed: true,
+				Elem:     &schema.Schema{Type: schema.TypeString},
+			},
+			"max_instance_lifetime": {
+				Type:     schema.TypeInt,
+				Optional: true,
+			},
+			"max_size": {
+				Type:     schema.TypeInt,
+				Required: true,
+			},
+			"metrics_granularity": {
+				Type:     schema.TypeString,
+				Optional: true,
+				Default:  DefaultEnabledMetricsGranularity,
+			},
+			"min_elb_capacity": {
+				Type:     schema.TypeInt,
+				Optional: true,
+			},
+			"min_size": {
+				Type:     schema.TypeInt,
+				Required: true,
+			},
+			"mixed_instances_policy": {
+				Type:     schema.TypeList,
+				Optional: true,
+				MaxItems: 1,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"instances_distribution": {
+							Type:     schema.TypeList,
+							Optional: true,
+							MaxItems: 1,
+							Computed: true,
+							// Ideally we'd want to detect drift detection,
+							// but a DiffSuppressFunc here does not behave nicely
+							// for detecting missing configuration blocks
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									// These fields are returned from calls to the API
+									// even if not provided at input time and can be omitted in requests;
+									// thus, to prevent non-empty plans, we set these
+									// to Computed and remove Defaults
+									"on_demand_allocation_strategy": {
+										Type:     schema.TypeString,
+										Optional: true,
+										Computed: true,
+									},
+									"on_demand_base_capacity": {
+										Type:     schema.TypeInt,
+										Optional: true,
+										Computed: true,
+									},
+									"on_demand_percentage_above_base_capacity": {
+										Type:     schema.TypeInt,
+										Optional: true,
+										Computed: true,
+									},
+									"spot_allocation_strategy": {
+										Type:     schema.TypeString,
+										Optional: true,
+										Computed: true,
+									},
+									"spot_instance_pools": {
+										Type:     schema.TypeInt,
+										Optional: true,
+										Computed: true,
+									},
+									"spot_max_price": {
+										Type:     schema.TypeString,
+										Optional: true,
+									},
+								},
+							},
+						},
+						"launch_template": {
+							Type:     schema.TypeList,
+							Required: true,
+							MinItems: 1,
+							MaxItems: 1,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"launch_template_specification": {
+										Type:     schema.TypeList,
+										Required: true,
+										MinItems: 1,
+										MaxItems: 1,
+										Elem: &schema.Resource{
+											Schema: map[string]*schema.Schema{
+												"launch_template_id": {
+													Type:     schema.TypeString,
+													Optional: true,
+													Computed: true,
+												},
+												"launch_template_name": {
+													Type:     schema.TypeString,
+													Optional: true,
+													Computed: true,
+												},
+												"version": {
+													Type:     schema.TypeString,
+													Optional: true,
+													Default:  "$Default",
+												},
+											},
+										},
+									},
+									"override": {
+										Type:     schema.TypeList,
+										Optional: true,
+										Elem: &schema.Resource{
+											Schema: map[string]*schema.Schema{
+												"instance_requirements": {
+													Type:     schema.TypeList,
+													Optional: true,
+													MaxItems: 1,
+													Elem: &schema.Resource{
+														Schema: map[string]*schema.Schema{
+															"accelerator_count": {
+																Type:     schema.TypeList,
+																Optional: true,
+																MaxItems: 1,
+																Elem: &schema.Resource{
+																	Schema: map[string]*schema.Schema{
+																		"max": {
+																			Type:     schema.TypeInt,
+																			Optional: true,
+																		},
+																		"min": {
+																			Type:     schema.TypeInt,
+																			Optional: true,
+																		},
+																	},
+																},
+															},
+															"accelerator_manufacturers": {
+																Type:     schema.TypeSet,
+																Optional: true,
+																Elem: &schema.Schema{
+																	Type: schema.TypeString,
+																},
+															},
+															"accelerator_names": {
+																Type:     schema.TypeSet,
+																Optional: true,
+																Elem: &schema.Schema{
+																	Type: schema.TypeString,
+																},
+															},
+															"accelerator_total_memory_mib": {
+																Type:     schema.TypeList,
+																Optional: true,
+																MaxItems: 1,
+																Elem: &schema.Resource{
+																	Schema: map[string]*schema.Schema{
+																		"max": {
+																			Type:     schema.TypeInt,
+																			Optional: true,
+																		},
+																		"min": {
+																			Type:     schema.TypeInt,
+																			Optional: true,
+																		},
+																	},
+																},
+															},
+															"accelerator_types": {
+																Type:     schema.TypeSet,
+																Optional: true,
+																Elem: &schema.Schema{
+																	Type: schema.TypeString,
+																},
+															},
+															"allowed_instance_types": {
+																Type:     schema.TypeSet,
+																Optional: true,
+																MaxItems: 400,
+																Elem:     &schema.Schema{Type: schema.TypeString},
+															},
+															"bare_metal": {
+																Type:     schema.TypeString,
+																Optional: true,
+															},
+															"baseline_ebs_bandwidth_mbps": {
+																Type:     schema.TypeList,
+																Optional: true,
+																MaxItems: 1,
+																Elem: &schema.Resource{
+																	Schema: map[string]*schema.Schema{
+																		"max": {
+																			Type:     schema.TypeInt,
+																			Optional: true,
+																		},
+																		"min": {
+																			Type:     schema.TypeInt,
+																			Optional: true,
+																		},
+																	},
+																},
+															},
+															"burstable_performance": {
+																Type:     schema.TypeString,
+																Optional: true,
+															},
+															"cpu_manufacturers": {
+																Type:     schema.TypeSet,
+																Optional: true,
+																Elem: &schema.Schema{
+																	Type: schema.TypeString,
+																},
+															},
+															"excluded_instance_types": {
+																Type:     schema.TypeSet,
+																Optional: true,
+																MaxItems: 400,
+																Elem:     &schema.Schema{Type: schema.TypeString},
+															},
+															"instance_generations": {
+																Type:     schema.TypeSet,
+																Optional: true,
+																Elem: &schema.Schema{
+																	Type: schema.TypeString,
+																},
+															},
+															"local_storage": {
+																Type:     schema.TypeString,
+																Optional: true,
+															},
+															"local_storage_types": {
+																Type:     schema.TypeSet,
+																Optional: true,
+																Elem: &schema.Schema{
+																	Type: schema.TypeString,
+																},
+															},
+															"memory_gib_per_vcpu": {
+																Type:     schema.TypeList,
+																Optional: true,
+																MaxItems: 1,
+																Elem: &schema.Resource{
+																	Schema: map[string]*schema.Schema{
+																		"max": {
+																			Type:     schema.TypeFloat,
+																			Optional: true,
+																		},
+																		"min": {
+																			Type:     schema.TypeFloat,
+																			Optional: true,
+																		},
+																	},
+																},
+															},
+															"memory_mib": {
+																Type:     schema.TypeList,
+																Optional: true,
+																MaxItems: 1,
+																Elem: &schema.Resource{
+																	Schema: map[string]*schema.Schema{
+																		"max": {
+																			Type:     schema.TypeInt,
+																			Optional: true,
+																		},
+																		"min": {
+																			Type:     schema.TypeInt,
+																			Optional: true,
+																		},
+																	},
+																},
+															},
+															"network_bandwidth_gbps": {
+																Type:     schema.TypeList,
+																Optional: true,
+																MaxItems: 1,
+																Elem: &schema.Resource{
+																	Schema: map[string]*schema.Schema{
+																		"max": {
+																			Type:     schema.TypeFloat,
+																			Optional: true,
+																		},
+																		"min": {
+																			Type:     schema.TypeFloat,
+																			Optional: true,
+																		},
+																	},
+																},
+															},
+															"network_interface_count": {
+																Type:     schema.TypeList,
+																Optional: true,
+																MaxItems: 1,
+																Elem: &schema.Resource{
+																	Schema: map[string]*schema.Schema{
+																		"max": {
+																			Type:     schema.TypeInt,
+																			Optional: true,
+																		},
+																		"min": {
+																			Type:     schema.TypeInt,
+																			Optional: true,
+																		},
+																	},
+																},
+															},
+															"on_demand_max_price_percentage_over_lowest_price": {
+																Type:     schema.TypeInt,
+																Optional: true,
+															},
+															"require_hibernate_support": {
+																Type:     schema.TypeBool,
+																Optional: true,
+															},
+															"spot_max_price_percentage_over_lowest_price": {
+																Type:     schema.TypeInt,
+																Optional: true,
+															},
+															"total_local_storage_gb": {
+																Type:     schema.TypeList,
+																Optional: true,
+																MaxItems: 1,
+																Elem: &schema.Resource{
+																	Schema: map[string]*schema.Schema{
+																		"max": {
+																			Type:     schema.TypeFloat,
+																			Optional: true,
+																		},
+																		"min": {
+																			Type:     schema.TypeFloat,
+																			Optional: true,
+																		},
+																	},
+																},
+															},
+															"vcpu_count": {
+																Type:     schema.TypeList,
+																Optional: true,
+																MaxItems: 1,
+																Elem: &schema.Resource{
+																	Schema: map[string]*schema.Schema{
+																		"max": {
+																			Type:     schema.TypeInt,
+																			Optional: true,
+																		},
+																		"min": {
+																			Type:     schema.TypeInt,
+																			Optional: true,
+																		},
+																	},
+																},
+															},
+														},
+													},
+												},
+												"instance_type": {
+													Type:     schema.TypeString,
+													Optional: true,
+												},
+												"launch_template_specification": {
+													Type:     schema.TypeList,
+													Optional: true,
+													MinItems: 0,
+													MaxItems: 1,
+													Elem: &schema.Resource{
+														Schema: map[string]*schema.Schema{
+															"launch_template_id": {
+																Type:     schema.TypeString,
+																Optional: true,
+																Computed: true,
+															},
+															"launch_template_name": {
+																Type:     schema.TypeString,
+																Optional: true,
+																Computed: true,
+															},
+															"version": {
+																Type:     schema.TypeString,
+																Optional: true,
+																Default:  "$Default",
+															},
+														},
+													},
+												},
+												"weighted_capacity": {
+													Type:     schema.TypeString,
+													Optional: true,
+												},
+											},
+										},
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+			"name": {
+				Type:     schema.TypeString,
+				Optional: true,
+				Computed: true,
+				ForceNew: true,
+			},
+			"name_prefix": {
+				Type:     schema.TypeString,
+				Optional: true,
+				Computed: true,
+				ForceNew: true,
+			},
+			"placement_group": {
+				Type:     schema.TypeString,
+				Optional: true,
+			},
+			"predicted_capacity": {
+				Type:     schema.TypeInt,
+				Computed: true,
+			},
+			"protect_from_scale_in": {
+				Type:     schema.TypeBool,
+				Optional: true,
+				Default:  false,
+			},
+			"service_linked_role_arn": {
+				Type:     schema.TypeString,
+				Optional: true,
+				Computed: true,
+			},
+			"suspended_processes": {
+				Type:     schema.TypeSet,
+				Optional: true,
+				Elem:     &schema.Schema{Type: schema.TypeString},
+			},
+			"tag": {
+				Type:     schema.TypeSet,
+				Optional: true,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"key": {
+							Type:     schema.TypeString,
+							Required: true,
+						},
+						"propagate_at_launch": {
+							Type:     schema.TypeBool,
+							Required: true,
+						},
+						"value": {
+							Type:     schema.TypeString,
+							Required: true,
+						},
+					},
+				},
+			},
+			"target_group_arns": {
+				Type:     schema.TypeSet,
+				Optional: true,
+				Computed: true,
+				Elem:     &schema.Schema{Type: schema.TypeString},
+			},
+			"termination_policies": {
+				Type:     schema.TypeList,
+				Optional: true,
+				Elem:     &schema.Schema{Type: schema.TypeString},
+			},
+			"traffic_source": {
+				Type:     schema.TypeSet,
+				Optional: true,
+				Computed: true,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"identifier": {
+							Type:     schema.TypeString,
+							Required: true,
+						},
+						"type": {
+							Type:     schema.TypeString,
+							Optional: true,
+						},
+					},
+				},
+			},
+			"vpc_zone_identifier": {
+				Type:     schema.TypeSet,
+				Optional: true,
+				Computed: true,
+				Elem:     &schema.Schema{Type: schema.TypeString},
+			},
+			"wait_for_capacity_timeout": {
+				Type:     schema.TypeString,
+				Optional: true,
+				Default:  "10m",
+			},
+			"wait_for_elb_capacity": {
+				Type:     schema.TypeInt,
+				Optional: true,
+			},
+			"warm_pool": {
+				Type:     schema.TypeList,
+				Optional: true,
+				MaxItems: 1,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"instance_reuse_policy": {
+							Type:     schema.TypeList,
+							Optional: true,
+							MaxItems: 1,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"reuse_on_scale_in": {
+										Type:     schema.TypeBool,
+										Optional: true,
+										Default:  false,
+									},
+								},
+							},
+						},
+						"max_group_prepared_capacity": {
+							Type:     schema.TypeInt,
+							Optional: true,
+							Default:  DefaultWarmPoolMaxGroupPreparedCapacity,
+						},
+						"min_size": {
+							Type:     schema.TypeInt,
+							Optional: true,
+							Default:  0,
+						},
+						"pool_state": {
+							Type:     schema.TypeString,
+							Optional: true,
+							Default:  autoscaling.WarmPoolStateStopped,
+						},
+					},
+				},
+			},
+			"warm_pool_size": {
+				Type:     schema.TypeInt,
+				Computed: true,
+			},
+		},
+	}
+}
+
+func GroupStateUpgradeV0(_ context.Context, rawState map[string]interface{}, meta interface{}) (map[string]interface{}, error) {
+	if rawState == nil {
+		rawState = map[string]interface{}{}
+	}
+
+	if _, ok := rawState["ignore_failed_scaling_activities"]; !ok {
+		rawState["ignore_failed_scaling_activities"] = "false"
+	}
+
+	return rawState, nil
+}
diff --git a/internal/service/autoscaling/group_migrate_test.go b/internal/service/autoscaling/group_migrate_test.go
new file mode 100644
index 00000000000..8a91b9af8af
--- /dev/null
+++ b/internal/service/autoscaling/group_migrate_test.go
@@ -0,0 +1,75 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package autoscaling_test
+
+import (
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
+	tfautoscaling "github.com/hashicorp/terraform-provider-aws/internal/service/autoscaling"
+)
+
+func TestGroupStateUpgradeV0(t *testing.T) {
+	ctx := acctest.Context(t)
+	t.Parallel()
+
+	testCases := []struct {
+		testName string
+		rawState map[string]interface{}
+		want     map[string]interface{}
+	}{
+		{
+			testName: "empty state",
+			rawState: map[string]interface{}{},
+			want: map[string]interface{}{
+				"ignore_failed_scaling_activities": "false",
+			},
+		},
+		{
+			testName: "non-empty state",
+			rawState: map[string]interface{}{
+				"capacity_rebalance":        "true",
+				"health_check_grace_period": "600",
+				"max_instance_lifetime":     "3600",
+			},
+			want: map[string]interface{}{
+				"capacity_rebalance":               "true",
+				"health_check_grace_period":        "600",
+				"ignore_failed_scaling_activities": "false",
+				"max_instance_lifetime":            "3600",
+			},
+		},
+		{
+			testName: "ignore_failed_scaling_activities set",
+			rawState: map[string]interface{}{
+				"capacity_rebalance":               "false",
+				"health_check_grace_period":        "400",
+				"ignore_failed_scaling_activities": "true",
+				"max_instance_lifetime":            "36000",
+			},
+			want: map[string]interface{}{
+				"capacity_rebalance":               "false",
+				"health_check_grace_period":        "400",
+				"ignore_failed_scaling_activities": "true",
+				"max_instance_lifetime":            "36000",
+			},
+		},
+	}
+
+	for _, testCase := range testCases {
+		testCase := testCase
+		t.Run(testCase.testName, func(t *testing.T) {
+			t.Parallel()
+
+			got, err := tfautoscaling.GroupStateUpgradeV0(ctx, testCase.rawState, nil)
+
+			if err != nil {
+				t.Errorf("err = %q", err)
+			} else if diff := cmp.Diff(got, testCase.want); diff != "" {
+				t.Errorf("unexpected diff (+wanted, -got): %s", diff)
+			}
+		})
+	}
+}
diff --git a/internal/service/autoscaling/group_tag.go b/internal/service/autoscaling/group_tag.go
index a5fa12b81c4..e2967504f6c 100644
--- a/internal/service/autoscaling/group_tag.go
+++ b/internal/service/autoscaling/group_tag.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package autoscaling
 
 import (
diff --git a/internal/service/autoscaling/group_tag_test.go b/internal/service/autoscaling/group_tag_test.go
index 96c94939b84..010f4521818 100644
--- a/internal/service/autoscaling/group_tag_test.go
+++ b/internal/service/autoscaling/group_tag_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package autoscaling_test
 
 import (
diff --git a/internal/service/autoscaling/group_test.go b/internal/service/autoscaling/group_test.go
index ca384ac254e..af591cc2c91 100644
--- a/internal/service/autoscaling/group_test.go
+++ b/internal/service/autoscaling/group_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package autoscaling_test
 
 import (
 	"context"
 	"errors"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/autoscaling"
 	"github.com/aws/aws-sdk-go/service/elbv2"
@@ -37,6 +40,7 @@ func testAccGroupImportStep(n string) resource.TestStep {
 		ImportStateVerify: true,
 		ImportStateVerifyIgnore: []string{
 			"force_delete",
+			"ignore_failed_scaling_activities",
 			"initial_lifecycle_hook",
 			"tag",
 			"tags",
@@ -62,7 +66,7 @@ func TestAccAutoScalingGroup_basic(t *testing.T) {
 				Config: testAccGroupConfig_basic(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckGroupExists(ctx, resourceName, &group),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "autoscaling", regexp.MustCompile(fmt.Sprintf(`autoScalingGroup:.+:autoScalingGroupName/%s`, rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "autoscaling", regexache.MustCompile(fmt.Sprintf(`autoScalingGroup:.+:autoScalingGroupName/%s`, rName))),
 					resource.TestCheckResourceAttr(resourceName, "availability_zones.#", "1"),
 					resource.TestCheckTypeSetElemAttrPair(resourceName, "availability_zones.*", "data.aws_availability_zones.available", "names.0"),
 					resource.TestCheckResourceAttr(resourceName, "capacity_rebalance", "false"),
@@ -289,7 +293,7 @@ func TestAccAutoScalingGroup_simple(t *testing.T) {
 				Config: testAccGroupConfig_simple(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckGroupExists(ctx, resourceName, &group),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "autoscaling", regexp.MustCompile(fmt.Sprintf(`autoScalingGroup:.+:autoScalingGroupName/%s`, rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "autoscaling", regexache.MustCompile(fmt.Sprintf(`autoScalingGroup:.+:autoScalingGroupName/%s`, rName))),
 					resource.TestCheckResourceAttr(resourceName, "availability_zones.#", "1"),
 					resource.TestCheckTypeSetElemAttrPair(resourceName, "availability_zones.*", "data.aws_availability_zones.available", "names.0"),
 					resource.TestCheckResourceAttr(resourceName, "capacity_rebalance", "false"),
@@ -340,7 +344,7 @@ func TestAccAutoScalingGroup_simple(t *testing.T) {
 				Config: testAccGroupConfig_simpleUpdated(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckGroupExists(ctx, resourceName, &group),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "autoscaling", regexp.MustCompile(fmt.Sprintf(`autoScalingGroup:.+:autoScalingGroupName/%s`, rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "autoscaling", regexache.MustCompile(fmt.Sprintf(`autoScalingGroup:.+:autoScalingGroupName/%s`, rName))),
 					resource.TestCheckResourceAttr(resourceName, "availability_zones.#", "1"),
 					resource.TestCheckTypeSetElemAttrPair(resourceName, "availability_zones.*", "data.aws_availability_zones.available", "names.0"),
 					resource.TestCheckResourceAttr(resourceName, "capacity_rebalance", "false"),
@@ -777,7 +781,7 @@ func TestAccAutoScalingGroup_withScalingActivityErrorPlacementGroupNotSupportedO
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccGroupConfig_withScalingActivityErrorPlacementGroupNotSupportedOnInstanceType(rName),
-				ExpectError: regexp.MustCompile(`Cluster placement groups are not supported by the .* instance type. Specify a supported instance type or change the placement group strategy`),
+				ExpectError: regexache.MustCompile(`Cluster placement groups are not supported by the .* instance type. Specify a supported instance type or change the placement group strategy`),
 			},
 		},
 	})
@@ -794,8 +798,26 @@ func TestAccAutoScalingGroup_withScalingActivityErrorIncorrectInstanceArchitectu
 		CheckDestroy:             testAccCheckGroupDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config:      testAccGroupConfig_withPotentialScalingActivityError(rName, "t4g.micro", 1),
-				ExpectError: regexp.MustCompile(`The architecture 'arm64' of the specified instance type does not match the architecture 'x86_64' of the specified AMI`),
+				Config:      testAccGroupConfig_withPotentialScalingActivityError(rName, "t4g.micro", 1, "null"),
+				ExpectError: regexache.MustCompile(`The architecture 'arm64' of the specified instance type does not match the architecture 'x86_64' of the specified AMI`),
+			},
+		},
+	})
+}
+
+func TestAccAutoScalingGroup_withScalingActivityErrorIncorrectInstanceArchitecture_IgnoreFailedScalingActivities(t *testing.T) {
+	ctx := acctest.Context(t)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, autoscaling.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckGroupDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config:      testAccGroupConfig_withPotentialScalingActivityError(rName, "t4g.micro", 1, "true"),
+				ExpectError: regexache.MustCompile(`timeout while waiting for state to become 'ok'`),
 			},
 		},
 	})
@@ -814,17 +836,17 @@ func TestAccAutoScalingGroup_withScalingActivityErrorIncorrectInstanceArchitectu
 		CheckDestroy:             testAccCheckGroupDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccGroupConfig_withPotentialScalingActivityError(rName, "t2.micro", 1),
+				Config: testAccGroupConfig_withPotentialScalingActivityError(rName, "t2.micro", 1, "null"),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckGroupExists(ctx, resourceName, &group),
 				),
 			},
 			{
-				Config:      testAccGroupConfig_withPotentialScalingActivityError(rName, "t4g.micro", 2),
-				ExpectError: regexp.MustCompile(`The architecture 'arm64' of the specified instance type does not match the architecture 'x86_64' of the specified AMI`),
+				Config:      testAccGroupConfig_withPotentialScalingActivityError(rName, "t4g.micro", 2, "null"),
+				ExpectError: regexache.MustCompile(`The architecture 'arm64' of the specified instance type does not match the architecture 'x86_64' of the specified AMI`),
 			},
 			{
-				Config: testAccGroupConfig_withPotentialScalingActivityError(rName, "t2.micro", 3),
+				Config: testAccGroupConfig_withPotentialScalingActivityError(rName, "t2.micro", 3, "null"),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckGroupExists(ctx, resourceName, &group),
 				),
@@ -1076,6 +1098,7 @@ func TestAccAutoScalingGroup_LaunchTemplate_update(t *testing.T) {
 	ctx := acctest.Context(t)
 	var group autoscaling.Group
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	launchTemplateNameUpdated := fmt.Sprintf("%s_updated", rName)
 	resourceName := "aws_autoscaling_group.test"
 
 	resource.ParallelTest(t, resource.TestCase{
@@ -1105,7 +1128,7 @@ func TestAccAutoScalingGroup_LaunchTemplate_update(t *testing.T) {
 				),
 			},
 			{
-				Config: testAccGroupConfig_launchTemplateName(rName),
+				Config: testAccGroupConfig_launchTemplateName(rName, rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckGroupExists(ctx, resourceName, &group),
 					resource.TestCheckResourceAttr(resourceName, "launch_configuration", ""),
@@ -1137,6 +1160,17 @@ func TestAccAutoScalingGroup_LaunchTemplate_update(t *testing.T) {
 					resource.TestCheckResourceAttrPair(resourceName, "launch_template.0.version", "aws_launch_template.test", "default_version"),
 				),
 			},
+			{
+				Config: testAccGroupConfig_launchTemplateName(rName, launchTemplateNameUpdated),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckGroupExists(ctx, resourceName, &group),
+					resource.TestCheckResourceAttr(resourceName, "launch_configuration", ""),
+					resource.TestCheckResourceAttr(resourceName, "launch_template.#", "1"),
+					resource.TestCheckResourceAttrPair(resourceName, "launch_template.0.id", "aws_launch_template.test", "id"),
+					resource.TestCheckResourceAttrPair(resourceName, "launch_template.0.name", "aws_launch_template.test", "name"),
+					resource.TestCheckResourceAttr(resourceName, "launch_template.0.version", ""),
+				),
+			},
 		},
 	})
 }
@@ -1200,7 +1234,9 @@ func TestAccAutoScalingGroup_InstanceRefresh_basic(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "instance_refresh.0.preferences.0.checkpoint_percentages.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "instance_refresh.0.preferences.0.instance_warmup", ""),
 					resource.TestCheckResourceAttr(resourceName, "instance_refresh.0.preferences.0.min_healthy_percentage", "0"),
+					resource.TestCheckResourceAttr(resourceName, "instance_refresh.0.preferences.0.scale_in_protected_instances", "Ignore"),
 					resource.TestCheckResourceAttr(resourceName, "instance_refresh.0.preferences.0.skip_matching", "false"),
+					resource.TestCheckResourceAttr(resourceName, "instance_refresh.0.preferences.0.standby_instances", "Ignore"),
 					resource.TestCheckResourceAttr(resourceName, "instance_refresh.0.strategy", "Rolling"),
 					resource.TestCheckResourceAttr(resourceName, "instance_refresh.0.triggers.#", "0"),
 				),
@@ -1216,7 +1252,45 @@ func TestAccAutoScalingGroup_InstanceRefresh_basic(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "instance_refresh.0.preferences.0.checkpoint_percentages.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "instance_refresh.0.preferences.0.instance_warmup", ""),
 					resource.TestCheckResourceAttr(resourceName, "instance_refresh.0.preferences.0.min_healthy_percentage", "0"),
+					resource.TestCheckResourceAttr(resourceName, "instance_refresh.0.preferences.0.scale_in_protected_instances", "Ignore"),
 					resource.TestCheckResourceAttr(resourceName, "instance_refresh.0.preferences.0.skip_matching", "true"),
+					resource.TestCheckResourceAttr(resourceName, "instance_refresh.0.preferences.0.standby_instances", "Ignore"),
+					resource.TestCheckResourceAttr(resourceName, "instance_refresh.0.strategy", "Rolling"),
+					resource.TestCheckResourceAttr(resourceName, "instance_refresh.0.triggers.#", "0"),
+				),
+			},
+			{
+				Config: testAccGroupConfig_instanceRefreshScaleInProtectedInstances(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckGroupExists(ctx, resourceName, &group),
+					resource.TestCheckResourceAttr(resourceName, "instance_refresh.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "instance_refresh.0.preferences.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "instance_refresh.0.preferences.0.auto_rollback", "false"),
+					resource.TestCheckResourceAttr(resourceName, "instance_refresh.0.preferences.0.checkpoint_delay", ""),
+					resource.TestCheckResourceAttr(resourceName, "instance_refresh.0.preferences.0.checkpoint_percentages.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "instance_refresh.0.preferences.0.instance_warmup", ""),
+					resource.TestCheckResourceAttr(resourceName, "instance_refresh.0.preferences.0.min_healthy_percentage", "0"),
+					resource.TestCheckResourceAttr(resourceName, "instance_refresh.0.preferences.0.scale_in_protected_instances", "Wait"),
+					resource.TestCheckResourceAttr(resourceName, "instance_refresh.0.preferences.0.skip_matching", "false"),
+					resource.TestCheckResourceAttr(resourceName, "instance_refresh.0.preferences.0.standby_instances", "Ignore"),
+					resource.TestCheckResourceAttr(resourceName, "instance_refresh.0.strategy", "Rolling"),
+					resource.TestCheckResourceAttr(resourceName, "instance_refresh.0.triggers.#", "0"),
+				),
+			},
+			{
+				Config: testAccGroupConfig_instanceRefreshStandbyInstances(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckGroupExists(ctx, resourceName, &group),
+					resource.TestCheckResourceAttr(resourceName, "instance_refresh.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "instance_refresh.0.preferences.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "instance_refresh.0.preferences.0.auto_rollback", "false"),
+					resource.TestCheckResourceAttr(resourceName, "instance_refresh.0.preferences.0.checkpoint_delay", ""),
+					resource.TestCheckResourceAttr(resourceName, "instance_refresh.0.preferences.0.checkpoint_percentages.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "instance_refresh.0.preferences.0.instance_warmup", ""),
+					resource.TestCheckResourceAttr(resourceName, "instance_refresh.0.preferences.0.min_healthy_percentage", "0"),
+					resource.TestCheckResourceAttr(resourceName, "instance_refresh.0.preferences.0.scale_in_protected_instances", "Ignore"),
+					resource.TestCheckResourceAttr(resourceName, "instance_refresh.0.preferences.0.skip_matching", "false"),
+					resource.TestCheckResourceAttr(resourceName, "instance_refresh.0.preferences.0.standby_instances", "Wait"),
 					resource.TestCheckResourceAttr(resourceName, "instance_refresh.0.strategy", "Rolling"),
 					resource.TestCheckResourceAttr(resourceName, "instance_refresh.0.triggers.#", "0"),
 				),
@@ -1237,7 +1311,9 @@ func TestAccAutoScalingGroup_InstanceRefresh_basic(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "instance_refresh.0.preferences.0.checkpoint_percentages.4", "100"),
 					resource.TestCheckResourceAttr(resourceName, "instance_refresh.0.preferences.0.instance_warmup", "10"),
 					resource.TestCheckResourceAttr(resourceName, "instance_refresh.0.preferences.0.min_healthy_percentage", "50"),
+					resource.TestCheckResourceAttr(resourceName, "instance_refresh.0.preferences.0.scale_in_protected_instances", "Refresh"),
 					resource.TestCheckResourceAttr(resourceName, "instance_refresh.0.preferences.0.skip_matching", "false"),
+					resource.TestCheckResourceAttr(resourceName, "instance_refresh.0.preferences.0.standby_instances", "Terminate"),
 					resource.TestCheckResourceAttr(resourceName, "instance_refresh.0.strategy", "Rolling"),
 					resource.TestCheckResourceAttr(resourceName, "instance_refresh.0.triggers.#", "0"),
 				),
@@ -1360,7 +1436,9 @@ func TestAccAutoScalingGroup_InstanceRefresh_autoRollback(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "instance_refresh.0.preferences.0.checkpoint_percentages.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "instance_refresh.0.preferences.0.instance_warmup", ""),
 					resource.TestCheckResourceAttr(resourceName, "instance_refresh.0.preferences.0.min_healthy_percentage", "0"),
+					resource.TestCheckResourceAttr(resourceName, "instance_refresh.0.preferences.0.scale_in_protected_instances", "Ignore"),
 					resource.TestCheckResourceAttr(resourceName, "instance_refresh.0.preferences.0.skip_matching", "false"),
+					resource.TestCheckResourceAttr(resourceName, "instance_refresh.0.preferences.0.standby_instances", "Ignore"),
 					resource.TestCheckResourceAttr(resourceName, "instance_refresh.0.strategy", "Rolling"),
 					resource.TestCheckResourceAttr(resourceName, "instance_refresh.0.triggers.#", "0"),
 				),
@@ -1376,7 +1454,9 @@ func TestAccAutoScalingGroup_InstanceRefresh_autoRollback(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "instance_refresh.0.preferences.0.checkpoint_percentages.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "instance_refresh.0.preferences.0.instance_warmup", ""),
 					resource.TestCheckResourceAttr(resourceName, "instance_refresh.0.preferences.0.min_healthy_percentage", "0"),
+					resource.TestCheckResourceAttr(resourceName, "instance_refresh.0.preferences.0.scale_in_protected_instances", "Ignore"),
 					resource.TestCheckResourceAttr(resourceName, "instance_refresh.0.preferences.0.skip_matching", "false"),
+					resource.TestCheckResourceAttr(resourceName, "instance_refresh.0.preferences.0.standby_instances", "Ignore"),
 					resource.TestCheckResourceAttr(resourceName, "instance_refresh.0.strategy", "Rolling"),
 					resource.TestCheckResourceAttr(resourceName, "instance_refresh.0.triggers.#", "0"),
 				),
@@ -1906,7 +1986,7 @@ func TestAccAutoScalingGroup_MixedInstancesPolicyLaunchTemplateLaunchTemplateSpe
 	var group autoscaling.Group
 	resourceName := "aws_autoscaling_group.test"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
-
+	launchTemplateNameUpdated := fmt.Sprintf("%s_updated", rName)
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
 		ErrorCheck:               acctest.ErrorCheck(t, autoscaling.EndpointsID),
@@ -1914,7 +1994,7 @@ func TestAccAutoScalingGroup_MixedInstancesPolicyLaunchTemplateLaunchTemplateSpe
 		CheckDestroy:             testAccCheckGroupDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccGroupConfig_mixedInstancesPolicyLaunchTemplateLaunchTemplateSpecificationLaunchTemplateName(rName),
+				Config: testAccGroupConfig_mixedInstancesPolicyLaunchTemplateLaunchTemplateSpecificationLaunchTemplateName(rName, rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckGroupExists(ctx, resourceName, &group),
 					resource.TestCheckResourceAttr(resourceName, "mixed_instances_policy.#", "1"),
@@ -1924,6 +2004,16 @@ func TestAccAutoScalingGroup_MixedInstancesPolicyLaunchTemplateLaunchTemplateSpe
 				),
 			},
 			testAccGroupImportStep(resourceName),
+			{
+				Config: testAccGroupConfig_mixedInstancesPolicyLaunchTemplateLaunchTemplateSpecificationLaunchTemplateName(rName, launchTemplateNameUpdated),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckGroupExists(ctx, resourceName, &group),
+					resource.TestCheckResourceAttr(resourceName, "mixed_instances_policy.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "mixed_instances_policy.0.launch_template.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "mixed_instances_policy.0.launch_template.0.launch_template_specification.#", "1"),
+					resource.TestCheckResourceAttrSet(resourceName, "mixed_instances_policy.0.launch_template.0.launch_template_specification.0.launch_template_name"),
+				),
+			},
 		},
 	})
 }
@@ -4626,7 +4716,7 @@ resource "aws_autoscaling_group" "test" {
 `, rName))
 }
 
-func testAccGroupConfig_withPotentialScalingActivityError(rName, instanceType string, instanceCount int) string {
+func testAccGroupConfig_withPotentialScalingActivityError(rName, instanceType string, instanceCount int, ignoreFailedScalingActivities string) string {
 	return acctest.ConfigCompose(testAccGroupConfig_launchConfigurationBase(rName, instanceType), fmt.Sprintf(`
 resource "aws_autoscaling_group" "test" {
   availability_zones        = [data.aws_availability_zones.available.names[0]]
@@ -4641,6 +4731,8 @@ resource "aws_autoscaling_group" "test" {
   wait_for_capacity_timeout = "2m"
   launch_configuration      = aws_launch_configuration.test.name
 
+  ignore_failed_scaling_activities = %[3]s
+
   instance_refresh {
     strategy = "Rolling"
   }
@@ -4651,7 +4743,7 @@ resource "aws_autoscaling_group" "test" {
     propagate_at_launch = true
   }
 }
-`, rName, instanceCount))
+`, rName, instanceCount, ignoreFailedScalingActivities))
 }
 
 func testAccGroupConfig_serviceLinkedRoleARN(rName string) string {
@@ -4731,8 +4823,8 @@ resource "aws_autoscaling_group" "test" {
 `, rName))
 }
 
-func testAccGroupConfig_launchTemplateName(rName string) string {
-	return acctest.ConfigCompose(testAccGroupConfig_launchTemplateBase(rName, "t2.micro"), fmt.Sprintf(`
+func testAccGroupConfig_launchTemplateName(rName, launchTemplateName string) string {
+	return acctest.ConfigCompose(testAccGroupConfig_launchTemplateBase(launchTemplateName, "t2.micro"), fmt.Sprintf(`
 resource "aws_autoscaling_group" "test" {
   availability_zones = [data.aws_availability_zones.available.names[0]]
   max_size           = 0
@@ -4859,6 +4951,62 @@ resource "aws_autoscaling_group" "test" {
 `, rName))
 }
 
+func testAccGroupConfig_instanceRefreshScaleInProtectedInstances(rName string) string {
+	return acctest.ConfigCompose(testAccGroupConfig_launchConfigurationBase(rName, "t3.nano"), fmt.Sprintf(`
+resource "aws_autoscaling_group" "test" {
+  availability_zones   = [data.aws_availability_zones.available.names[0]]
+  name                 = %[1]q
+  max_size             = 2
+  min_size             = 1
+  desired_capacity     = 1
+  launch_configuration = aws_launch_configuration.test.name
+
+  instance_refresh {
+    strategy = "Rolling"
+
+    preferences {
+      min_healthy_percentage       = 0
+      scale_in_protected_instances = "Wait"
+    }
+  }
+
+  tag {
+    key                 = "Name"
+    value               = %[1]q
+    propagate_at_launch = true
+  }
+}
+`, rName))
+}
+
+func testAccGroupConfig_instanceRefreshStandbyInstances(rName string) string {
+	return acctest.ConfigCompose(testAccGroupConfig_launchConfigurationBase(rName, "t3.nano"), fmt.Sprintf(`
+resource "aws_autoscaling_group" "test" {
+  availability_zones   = [data.aws_availability_zones.available.names[0]]
+  name                 = %[1]q
+  max_size             = 2
+  min_size             = 1
+  desired_capacity     = 1
+  launch_configuration = aws_launch_configuration.test.name
+
+  instance_refresh {
+    strategy = "Rolling"
+
+    preferences {
+      min_healthy_percentage = 0
+      standby_instances      = "Wait"
+    }
+  }
+
+  tag {
+    key                 = "Name"
+    value               = %[1]q
+    propagate_at_launch = true
+  }
+}
+`, rName))
+}
+
 func testAccGroupConfig_instanceRefreshAutoRollback(rName, instanceType string) string {
 	return acctest.ConfigCompose(testAccGroupConfig_launchTemplateBase(rName, instanceType), fmt.Sprintf(`
 resource "aws_autoscaling_group" "test" {
@@ -4909,6 +5057,9 @@ resource "aws_autoscaling_group" "test" {
       min_healthy_percentage = 50
       checkpoint_delay       = 25
       checkpoint_percentages = [1, 20, 25, 50, 100]
+
+      scale_in_protected_instances = "Refresh"
+      standby_instances            = "Terminate"
     }
   }
 
@@ -5589,8 +5740,8 @@ resource "aws_autoscaling_group" "test" {
 `, rName, spotMaxPrice))
 }
 
-func testAccGroupConfig_mixedInstancesPolicyLaunchTemplateLaunchTemplateSpecificationLaunchTemplateName(rName string) string {
-	return acctest.ConfigCompose(testAccGroupConfig_launchTemplateBase(rName, "t3.micro"), fmt.Sprintf(`
+func testAccGroupConfig_mixedInstancesPolicyLaunchTemplateLaunchTemplateSpecificationLaunchTemplateName(rName, launchTemplateName string) string {
+	return acctest.ConfigCompose(testAccGroupConfig_launchTemplateBase(launchTemplateName, "t3.micro"), fmt.Sprintf(`
 resource "aws_autoscaling_group" "test" {
   availability_zones = [data.aws_availability_zones.available.names[0]]
   desired_capacity   = 0
diff --git a/internal/service/autoscaling/groups_data_source.go b/internal/service/autoscaling/groups_data_source.go
index bf576b939a6..e0d7cd1545b 100644
--- a/internal/service/autoscaling/groups_data_source.go
+++ b/internal/service/autoscaling/groups_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package autoscaling
 
 import (
diff --git a/internal/service/autoscaling/groups_data_source_test.go b/internal/service/autoscaling/groups_data_source_test.go
index 82d7220e1cb..c338c35df6e 100644
--- a/internal/service/autoscaling/groups_data_source_test.go
+++ b/internal/service/autoscaling/groups_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package autoscaling_test
 
 import (
diff --git a/internal/service/autoscaling/launch_configuration.go b/internal/service/autoscaling/launch_configuration.go
index 7b646fff3e2..0cd504e232d 100644
--- a/internal/service/autoscaling/launch_configuration.go
+++ b/internal/service/autoscaling/launch_configuration.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package autoscaling
 
 import ( // nosemgrep:ci.semgrep.aws.multiple-service-imports
diff --git a/internal/service/autoscaling/launch_configuration_data_source.go b/internal/service/autoscaling/launch_configuration_data_source.go
index 1aaae8722ec..14e3def9785 100644
--- a/internal/service/autoscaling/launch_configuration_data_source.go
+++ b/internal/service/autoscaling/launch_configuration_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package autoscaling
 
 import (
diff --git a/internal/service/autoscaling/launch_configuration_data_source_test.go b/internal/service/autoscaling/launch_configuration_data_source_test.go
index c4dbe62ef4c..6a711d57ad6 100644
--- a/internal/service/autoscaling/launch_configuration_data_source_test.go
+++ b/internal/service/autoscaling/launch_configuration_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package autoscaling_test
 
 import (
diff --git a/internal/service/autoscaling/launch_configuration_test.go b/internal/service/autoscaling/launch_configuration_test.go
index 8f2ff65832f..be69bf26034 100644
--- a/internal/service/autoscaling/launch_configuration_test.go
+++ b/internal/service/autoscaling/launch_configuration_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package autoscaling_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/autoscaling"
 	"github.com/aws/aws-sdk-go/service/ec2"
@@ -35,7 +38,7 @@ func TestAccAutoScalingLaunchConfiguration_basic(t *testing.T) {
 				Config: testAccLaunchConfigurationConfig_basic(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckLaunchConfigurationExists(ctx, resourceName, &conf),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "autoscaling", regexp.MustCompile(`launchConfiguration:.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "autoscaling", regexache.MustCompile(`launchConfiguration:.+`)),
 					resource.TestCheckResourceAttr(resourceName, "associate_public_ip_address", "false"),
 					resource.TestCheckResourceAttr(resourceName, "ebs_block_device.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "ebs_optimized", "false"),
diff --git a/internal/service/autoscaling/lifecycle_hook.go b/internal/service/autoscaling/lifecycle_hook.go
index 53c8de79cce..b6a80a68bad 100644
--- a/internal/service/autoscaling/lifecycle_hook.go
+++ b/internal/service/autoscaling/lifecycle_hook.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package autoscaling
 
 import (
diff --git a/internal/service/autoscaling/lifecycle_hook_test.go b/internal/service/autoscaling/lifecycle_hook_test.go
index eb189b63695..5189c3f2fd7 100644
--- a/internal/service/autoscaling/lifecycle_hook_test.go
+++ b/internal/service/autoscaling/lifecycle_hook_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package autoscaling_test
 
 import (
diff --git a/internal/service/autoscaling/notification.go b/internal/service/autoscaling/notification.go
index fe8acd0aa2f..618629834f0 100644
--- a/internal/service/autoscaling/notification.go
+++ b/internal/service/autoscaling/notification.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package autoscaling
 
 import (
diff --git a/internal/service/autoscaling/notification_test.go b/internal/service/autoscaling/notification_test.go
index ccb79885bf1..df37c9c889b 100644
--- a/internal/service/autoscaling/notification_test.go
+++ b/internal/service/autoscaling/notification_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package autoscaling_test
 
 import (
diff --git a/internal/service/autoscaling/policy.go b/internal/service/autoscaling/policy.go
index edf925d07cb..c8ad504dd69 100644
--- a/internal/service/autoscaling/policy.go
+++ b/internal/service/autoscaling/policy.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package autoscaling
 
 import (
@@ -18,8 +21,8 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/create"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
-	"github.com/hashicorp/terraform-provider-aws/internal/experimental/nullable"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/internal/types/nullable"
 )
 
 // @SDKResource("aws_autoscaling_policy")
diff --git a/internal/service/autoscaling/policy_test.go b/internal/service/autoscaling/policy_test.go
index da78d982595..dd5bee5dfe4 100644
--- a/internal/service/autoscaling/policy_test.go
+++ b/internal/service/autoscaling/policy_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package autoscaling_test
 
 import (
diff --git a/internal/service/autoscaling/schedule.go b/internal/service/autoscaling/schedule.go
index a9178bd959e..041ebfa2139 100644
--- a/internal/service/autoscaling/schedule.go
+++ b/internal/service/autoscaling/schedule.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package autoscaling
 
 import (
diff --git a/internal/service/autoscaling/schedule_test.go b/internal/service/autoscaling/schedule_test.go
index da02c400f1e..be15466c5da 100644
--- a/internal/service/autoscaling/schedule_test.go
+++ b/internal/service/autoscaling/schedule_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package autoscaling_test
 
 import (
diff --git a/internal/service/autoscaling/service_package_gen.go b/internal/service/autoscaling/service_package_gen.go
index 80fd2e081b4..8abf7846587 100644
--- a/internal/service/autoscaling/service_package_gen.go
+++ b/internal/service/autoscaling/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	autoscaling_sdkv1 "github.com/aws/aws-sdk-go/service/autoscaling"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -91,4 +92,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*a
 	return autoscaling_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/autoscaling/sweep.go b/internal/service/autoscaling/sweep.go
index c44cc892c2f..dca31163c9b 100644
--- a/internal/service/autoscaling/sweep.go
+++ b/internal/service/autoscaling/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package autoscaling
 
@@ -11,9 +11,10 @@ import (
 	"github.com/aws/aws-sdk-go/service/autoscaling"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_autoscaling_group", &resource.Sweeper{
 		Name: "aws_autoscaling_group",
 		F:    sweepGroups,
@@ -28,7 +29,7 @@ func init() {
 
 func sweepGroups(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -53,7 +54,7 @@ func sweepGroups(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Auto Scaling Group sweep for %s: %s", region, err)
 		return nil
 	}
@@ -62,7 +63,7 @@ func sweepGroups(region string) error {
 		return fmt.Errorf("error listing Auto Scaling Groups (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping Auto Scaling Groups (%s): %w", region, err)
@@ -73,7 +74,7 @@ func sweepGroups(region string) error {
 
 func sweepLaunchConfigurations(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -97,7 +98,7 @@ func sweepLaunchConfigurations(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Auto Scaling Launch Configuration sweep for %s: %s", region, err)
 		return nil
 	}
@@ -106,7 +107,7 @@ func sweepLaunchConfigurations(region string) error {
 		return fmt.Errorf("error listing Auto Scaling Launch Configurations (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping Auto Scaling Launch Configurations (%s): %w", region, err)
diff --git a/internal/service/autoscaling/tags_gen.go b/internal/service/autoscaling/tags_gen.go
index d351488670d..c9c57ba280f 100644
--- a/internal/service/autoscaling/tags_gen.go
+++ b/internal/service/autoscaling/tags_gen.go
@@ -8,8 +8,10 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/autoscaling"
 	"github.com/aws/aws-sdk-go/service/autoscaling/autoscalingiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
@@ -245,6 +247,8 @@ func updateTags(ctx context.Context, conn autoscalingiface.AutoScalingAPI, ident
 	oldTags := KeyValueTags(ctx, oldTagsSet, identifier, resourceType)
 	newTags := KeyValueTags(ctx, newTagsSet, identifier, resourceType)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.AutoScaling)
 	if len(removedTags) > 0 {
diff --git a/internal/service/autoscaling/traffic_source_attachment.go b/internal/service/autoscaling/traffic_source_attachment.go
index 44a20a27dc4..ffb2ffd1bb8 100644
--- a/internal/service/autoscaling/traffic_source_attachment.go
+++ b/internal/service/autoscaling/traffic_source_attachment.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package autoscaling
 
 import (
diff --git a/internal/service/autoscaling/traffic_source_attachment_test.go b/internal/service/autoscaling/traffic_source_attachment_test.go
index 88639a9c3ee..c6c4974fc0e 100644
--- a/internal/service/autoscaling/traffic_source_attachment_test.go
+++ b/internal/service/autoscaling/traffic_source_attachment_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package autoscaling_test
 
 import (
diff --git a/internal/service/autoscalingplans/find.go b/internal/service/autoscalingplans/find.go
index a90d23e7435..348a761376b 100644
--- a/internal/service/autoscalingplans/find.go
+++ b/internal/service/autoscalingplans/find.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package autoscalingplans
 
 import (
diff --git a/internal/service/autoscalingplans/generate.go b/internal/service/autoscalingplans/generate.go
index 38d8fa90e14..2391e0a87d5 100644
--- a/internal/service/autoscalingplans/generate.go
+++ b/internal/service/autoscalingplans/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/listpages/main.go -ListOps=DescribeScalingPlans
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/autoscalingplans/id.go b/internal/service/autoscalingplans/id.go
index e5ec990c364..fbf9eb9b308 100644
--- a/internal/service/autoscalingplans/id.go
+++ b/internal/service/autoscalingplans/id.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package autoscalingplans
 
 import (
diff --git a/internal/service/autoscalingplans/scaling_plan.go b/internal/service/autoscalingplans/scaling_plan.go
index 39c237eda33..90641f1bdb9 100644
--- a/internal/service/autoscalingplans/scaling_plan.go
+++ b/internal/service/autoscalingplans/scaling_plan.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package autoscalingplans
 
 import (
 	"context"
 	"log"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/autoscalingplans"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -77,7 +80,7 @@ func ResourceScalingPlan() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 128),
-					validation.StringMatch(regexp.MustCompile(`^[[:print:]]+$`), "must be printable"),
+					validation.StringMatch(regexache.MustCompile(`^[[:print:]]+$`), "must be printable"),
 					validation.StringDoesNotContainAny("|:/"),
 				),
 			},
diff --git a/internal/service/autoscalingplans/scaling_plan_test.go b/internal/service/autoscalingplans/scaling_plan_test.go
index a448996f9f6..2aff877a193 100644
--- a/internal/service/autoscalingplans/scaling_plan_test.go
+++ b/internal/service/autoscalingplans/scaling_plan_test.go
@@ -1,15 +1,18 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package autoscalingplans_test
 
 import (
 	"context"
 	"fmt"
-	"reflect"
 	"sort"
 	"strconv"
 	"testing"
 
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/autoscalingplans"
+	"github.com/google/go-cmp/cmp"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
@@ -434,7 +437,7 @@ func testAccCheckApplicationSourceTags(scalingPlan *autoscalingplans.ScalingPlan
 
 			sort.Strings(values)
 			sort.Strings(expectedValues)
-			if !reflect.DeepEqual(values, expectedValues) {
+			if !cmp.Equal(values, expectedValues) {
 				return fmt.Errorf("Scaling plan application source tag filter values %q, expected %q", values, expectedValues)
 			}
 		}
@@ -443,13 +446,14 @@ func testAccCheckApplicationSourceTags(scalingPlan *autoscalingplans.ScalingPlan
 	}
 }
 
-func testAccScalingPlanConfigBase(rName, tagName string) string {
+func testAccScalingPlanConfig_base(rName, tagName string) string {
 	return acctest.ConfigCompose(
 		acctest.ConfigLatestAmazonLinuxHVMEBSAMI(),
 		acctest.ConfigAvailableAZsNoOptInDefaultExclude(),
 		acctest.AvailableEC2InstanceTypeForRegion("t3.micro", "t2.micro"),
 		fmt.Sprintf(`
 resource "aws_launch_configuration" "test" {
+  name          = %[1]q
   image_id      = data.aws_ami.amzn-ami-minimal-hvm-ebs.id
   instance_type = data.aws_ec2_instance_type_offering.available.instance_type
 }
@@ -464,21 +468,17 @@ resource "aws_autoscaling_group" "test" {
   max_size         = 3
   desired_capacity = 0
 
-  tags = [
-    {
-      key                 = %[2]q
-      value               = %[2]q
-      propagate_at_launch = true
-    },
-  ]
+  tag {
+    key                 = %[2]q
+    value               = %[2]q
+    propagate_at_launch = true
+  }
 }
 `, rName, tagName))
 }
 
 func testAccScalingPlanConfig_basicDynamicScaling(rName, tagName string) string {
-	return acctest.ConfigCompose(
-		testAccScalingPlanConfigBase(rName, tagName),
-		fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccScalingPlanConfig_base(rName, tagName), fmt.Sprintf(`
 resource "aws_autoscalingplans_scaling_plan" "test" {
   name = %[1]q
 
@@ -509,9 +509,7 @@ resource "aws_autoscalingplans_scaling_plan" "test" {
 }
 
 func testAccScalingPlanConfig_basicPredictiveScaling(rName, tagName string) string {
-	return acctest.ConfigCompose(
-		testAccScalingPlanConfigBase(rName, tagName),
-		fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccScalingPlanConfig_base(rName, tagName), fmt.Sprintf(`
 resource "aws_autoscalingplans_scaling_plan" "test" {
   name = %[1]q
 
@@ -551,9 +549,7 @@ resource "aws_autoscalingplans_scaling_plan" "test" {
 }
 
 func testAccScalingPlanConfig_dynamicScalingCustomizedScalingMetricSpecification(rName, tagName string, targetValue int) string {
-	return acctest.ConfigCompose(
-		testAccScalingPlanConfigBase(rName, tagName),
-		fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccScalingPlanConfig_base(rName, tagName), fmt.Sprintf(`
 resource "aws_autoscalingplans_scaling_plan" "test" {
   name = %[1]q
 
diff --git a/internal/service/autoscalingplans/service_package_gen.go b/internal/service/autoscalingplans/service_package_gen.go
index 7484abfc9a0..c428380f24a 100644
--- a/internal/service/autoscalingplans/service_package_gen.go
+++ b/internal/service/autoscalingplans/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	autoscalingplans_sdkv1 "github.com/aws/aws-sdk-go/service/autoscalingplans"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -46,4 +47,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*a
 	return autoscalingplans_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/autoscalingplans/status.go b/internal/service/autoscalingplans/status.go
index 30dd408affc..709dd744327 100644
--- a/internal/service/autoscalingplans/status.go
+++ b/internal/service/autoscalingplans/status.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package autoscalingplans
 
 import (
diff --git a/internal/service/autoscalingplans/sweep.go b/internal/service/autoscalingplans/sweep.go
index 0a492f2e49e..a71697b74d6 100644
--- a/internal/service/autoscalingplans/sweep.go
+++ b/internal/service/autoscalingplans/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package autoscalingplans
 
@@ -11,9 +11,10 @@ import (
 	"github.com/aws/aws-sdk-go/service/autoscalingplans"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_autoscalingplans_scaling_plan", &resource.Sweeper{
 		Name: "aws_autoscalingplans_scaling_plan",
 		F:    sweepScalingPlans,
@@ -22,7 +23,7 @@ func init() {
 
 func sweepScalingPlans(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -51,7 +52,7 @@ func sweepScalingPlans(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Auto Scaling Scaling Plan sweep for %s: %s", region, err)
 		return nil
 	}
@@ -60,7 +61,7 @@ func sweepScalingPlans(region string) error {
 		return fmt.Errorf("error listing Auto Scaling Scaling Plans (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping Auto Scaling Scaling Plans (%s): %w", region, err)
diff --git a/internal/service/autoscalingplans/wait.go b/internal/service/autoscalingplans/wait.go
index 1331ec643e7..8f10d0ff810 100644
--- a/internal/service/autoscalingplans/wait.go
+++ b/internal/service/autoscalingplans/wait.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package autoscalingplans
 
 import (
diff --git a/internal/service/backup/consts.go b/internal/service/backup/consts.go
index dc43465190f..ea4860cd65f 100644
--- a/internal/service/backup/consts.go
+++ b/internal/service/backup/consts.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package backup
 
 const (
diff --git a/internal/service/backup/errors.go b/internal/service/backup/errors.go
index 43f019afb26..b8dff1cad97 100644
--- a/internal/service/backup/errors.go
+++ b/internal/service/backup/errors.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package backup
 
 const (
diff --git a/internal/service/backup/find.go b/internal/service/backup/find.go
index 16639c7b933..81a2aa0304a 100644
--- a/internal/service/backup/find.go
+++ b/internal/service/backup/find.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package backup
 
 import (
diff --git a/internal/service/backup/framework.go b/internal/service/backup/framework.go
index 648f74d3861..dd7c4456a44 100644
--- a/internal/service/backup/framework.go
+++ b/internal/service/backup/framework.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package backup
 
 import (
diff --git a/internal/service/backup/framework_data_source.go b/internal/service/backup/framework_data_source.go
index 9e88d3434e0..846e580add7 100644
--- a/internal/service/backup/framework_data_source.go
+++ b/internal/service/backup/framework_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package backup
 
 import (
diff --git a/internal/service/backup/framework_data_source_test.go b/internal/service/backup/framework_data_source_test.go
index e73dc692060..fd9e9d495de 100644
--- a/internal/service/backup/framework_data_source_test.go
+++ b/internal/service/backup/framework_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package backup_test
 
 import (
diff --git a/internal/service/backup/framework_test.go b/internal/service/backup/framework_test.go
index c6a24193a7e..e13e82334e0 100644
--- a/internal/service/backup/framework_test.go
+++ b/internal/service/backup/framework_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package backup_test
 
 import (
diff --git a/internal/service/backup/generate.go b/internal/service/backup/generate.go
index 6dc214abfca..27f6f21aefd 100644
--- a/internal/service/backup/generate.go
+++ b/internal/service/backup/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTags -ListTagsOp=ListTags -ServiceTagsMap -UntagInTagsElem=TagKeyList -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/backup/global_settings.go b/internal/service/backup/global_settings.go
index e6cbc71edd2..4b62e526d86 100644
--- a/internal/service/backup/global_settings.go
+++ b/internal/service/backup/global_settings.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package backup
 
 import (
diff --git a/internal/service/backup/global_settings_test.go b/internal/service/backup/global_settings_test.go
index e6053cf44a8..0ed512498c3 100644
--- a/internal/service/backup/global_settings_test.go
+++ b/internal/service/backup/global_settings_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package backup_test
 
 import (
diff --git a/internal/service/backup/plan.go b/internal/service/backup/plan.go
index 2933f60b28a..9093e0f7a4b 100644
--- a/internal/service/backup/plan.go
+++ b/internal/service/backup/plan.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package backup
 
 import (
@@ -5,9 +8,9 @@ import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/backup"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -53,7 +56,7 @@ func ResourcePlan() *schema.Resource {
 							Required: true,
 							ValidateFunc: validation.All(
 								validation.StringLenBetween(1, 50),
-								validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9\-\_\.]+$`), "must contain only alphanumeric characters, hyphens, underscores, and periods"),
+								validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_.-]+$`), "must contain only alphanumeric characters, hyphens, underscores, and periods"),
 							),
 						},
 						"target_vault_name": {
@@ -61,7 +64,7 @@ func ResourcePlan() *schema.Resource {
 							Required: true,
 							ValidateFunc: validation.All(
 								validation.StringLenBetween(2, 50),
-								validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9\-\_]+$`), "must contain only alphanumeric characters, hyphens, and underscores"),
+								validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_-]+$`), "must contain only alphanumeric characters, hyphens, and underscores"),
 							),
 						},
 						"schedule": {
diff --git a/internal/service/backup/plan_data_source.go b/internal/service/backup/plan_data_source.go
index 1e235aca702..27a73b45d1f 100644
--- a/internal/service/backup/plan_data_source.go
+++ b/internal/service/backup/plan_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package backup
 
 import (
diff --git a/internal/service/backup/plan_data_source_test.go b/internal/service/backup/plan_data_source_test.go
index 8fb4ba79a86..f68ae0f05d8 100644
--- a/internal/service/backup/plan_data_source_test.go
+++ b/internal/service/backup/plan_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package backup_test
 
 import (
diff --git a/internal/service/backup/plan_test.go b/internal/service/backup/plan_test.go
index bed6f116600..410815a0135 100644
--- a/internal/service/backup/plan_test.go
+++ b/internal/service/backup/plan_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package backup_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/backup"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -32,7 +35,7 @@ func TestAccBackupPlan_basic(t *testing.T) {
 				Config: testAccPlanConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckPlanExists(ctx, resourceName, &plan),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "backup", regexp.MustCompile(`backup-plan:.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "backup", regexache.MustCompile(`backup-plan:.+`)),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
@@ -608,7 +611,7 @@ func TestAccBackupPlan_enableContinuousBackup(t *testing.T) {
 				Config: testAccPlanConfig_enableContinuous(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckPlanExists(ctx, resourceName, &plan),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "backup", regexp.MustCompile(`backup-plan:.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "backup", regexache.MustCompile(`backup-plan:.+`)),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
diff --git a/internal/service/backup/region_settings.go b/internal/service/backup/region_settings.go
index 28c38f35538..2fd8549896c 100644
--- a/internal/service/backup/region_settings.go
+++ b/internal/service/backup/region_settings.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package backup
 
 import (
diff --git a/internal/service/backup/region_settings_test.go b/internal/service/backup/region_settings_test.go
index a8ccfc6fefd..fec2eb3b5cf 100644
--- a/internal/service/backup/region_settings_test.go
+++ b/internal/service/backup/region_settings_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package backup_test
 
 import (
diff --git a/internal/service/backup/report_plan.go b/internal/service/backup/report_plan.go
index ac890169875..7d38d7298f1 100644
--- a/internal/service/backup/report_plan.go
+++ b/internal/service/backup/report_plan.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package backup
 
 import (
diff --git a/internal/service/backup/report_plan_data_source.go b/internal/service/backup/report_plan_data_source.go
index b353939edce..82c084dd179 100644
--- a/internal/service/backup/report_plan_data_source.go
+++ b/internal/service/backup/report_plan_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package backup
 
 import (
diff --git a/internal/service/backup/report_plan_data_source_test.go b/internal/service/backup/report_plan_data_source_test.go
index bb6d6165881..04230f8f9cf 100644
--- a/internal/service/backup/report_plan_data_source_test.go
+++ b/internal/service/backup/report_plan_data_source_test.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package backup_test
 
 import (
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/backup"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -25,7 +28,7 @@ func TestAccBackupReportPlanDataSource_basic(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccReportPlanDataSourceConfig_nonExistent,
-				ExpectError: regexp.MustCompile(`reading Backup Report Plan`),
+				ExpectError: regexache.MustCompile(`reading Backup Report Plan`),
 			},
 			{
 				Config: testAccReportPlanDataSourceConfig_basic(rName, rName2),
diff --git a/internal/service/backup/report_plan_test.go b/internal/service/backup/report_plan_test.go
index 4de5bf9a662..9df823f4033 100644
--- a/internal/service/backup/report_plan_test.go
+++ b/internal/service/backup/report_plan_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package backup_test
 
 import (
diff --git a/internal/service/backup/selection.go b/internal/service/backup/selection.go
index f9299cc0bac..76c9bf217b8 100644
--- a/internal/service/backup/selection.go
+++ b/internal/service/backup/selection.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package backup
 
 import (
@@ -5,9 +8,9 @@ import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"strings"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/backup"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -40,7 +43,7 @@ func ResourceSelection() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 50),
-					validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9\-\_\.]+$`), "must contain only alphanumeric, hyphen, underscore, and period characters"),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_.-]+$`), "must contain only alphanumeric, hyphen, underscore, and period characters"),
 				),
 			},
 			"plan_id": {
diff --git a/internal/service/backup/selection_data_source.go b/internal/service/backup/selection_data_source.go
index a8f3ca28b80..2e9511251b6 100644
--- a/internal/service/backup/selection_data_source.go
+++ b/internal/service/backup/selection_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package backup
 
 import (
diff --git a/internal/service/backup/selection_data_source_test.go b/internal/service/backup/selection_data_source_test.go
index 85571133ad6..67fadec48e6 100644
--- a/internal/service/backup/selection_data_source_test.go
+++ b/internal/service/backup/selection_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package backup_test
 
 import (
diff --git a/internal/service/backup/selection_test.go b/internal/service/backup/selection_test.go
index 54722925907..ff09aab6106 100644
--- a/internal/service/backup/selection_test.go
+++ b/internal/service/backup/selection_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package backup_test
 
 import (
diff --git a/internal/service/backup/service_package_gen.go b/internal/service/backup/service_package_gen.go
index 8f4e3d725f2..0e8ed95b223 100644
--- a/internal/service/backup/service_package_gen.go
+++ b/internal/service/backup/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	backup_sdkv1 "github.com/aws/aws-sdk-go/service/backup"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -119,4 +120,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*b
 	return backup_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/backup/status.go b/internal/service/backup/status.go
index d6fa3a2dcb5..8fb4acdec96 100644
--- a/internal/service/backup/status.go
+++ b/internal/service/backup/status.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package backup
 
 import (
diff --git a/internal/service/backup/sweep.go b/internal/service/backup/sweep.go
index 980b437620c..ef1a7c69a44 100644
--- a/internal/service/backup/sweep.go
+++ b/internal/service/backup/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package backup
 
@@ -12,9 +12,10 @@ import (
 	"github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_backup_framework", &resource.Sweeper{
 		Name: "aws_backup_framework",
 		F:    sweepFramework,
@@ -53,7 +54,7 @@ func init() {
 
 func sweepFramework(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("Error getting client: %w", err)
 	}
@@ -78,7 +79,7 @@ func sweepFramework(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Backup Framework sweep for %s: %s", region, err)
 		return sweeperErrs.ErrorOrNil()
 	}
@@ -87,7 +88,7 @@ func sweepFramework(region string) error {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error listing Backup Frameworks for %s: %w", region, err))
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error sweeping Backup Frameworks for %s: %w", region, err))
 	}
 
@@ -96,7 +97,7 @@ func sweepFramework(region string) error {
 
 func sweepReportPlan(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("Error getting client: %w", err)
 	}
@@ -121,7 +122,7 @@ func sweepReportPlan(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Backup Report Plans sweep for %s: %s", region, err)
 		return sweeperErrs.ErrorOrNil()
 	}
@@ -130,7 +131,7 @@ func sweepReportPlan(region string) error {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error listing Backup Report Plans for %s: %w", region, err))
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error sweeping Backup Report Plans for %s: %w", region, err))
 	}
 
@@ -139,7 +140,7 @@ func sweepReportPlan(region string) error {
 
 func sweepVaultLockConfiguration(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("Error getting client: %w", err)
@@ -175,11 +176,11 @@ func sweepVaultLockConfiguration(region string) error {
 		errs = multierror.Append(errs, fmt.Errorf("error listing Backup Vaults for %s: %w", region, err))
 	}
 
-	if err = sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err = sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("error sweeping Backup Vault Lock Configuration for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
+	if awsv1.SkipSweepError(errs.ErrorOrNil()) {
 		log.Printf("[WARN] Skipping Backup Vault Lock Configuration sweep for %s: %s", region, errs)
 		return nil
 	}
@@ -189,7 +190,7 @@ func sweepVaultLockConfiguration(region string) error {
 
 func sweepVaultNotifications(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("Error getting client: %w", err)
@@ -225,11 +226,11 @@ func sweepVaultNotifications(region string) error {
 		errs = multierror.Append(errs, fmt.Errorf("error listing Backup Vaults for %s: %w", region, err))
 	}
 
-	if err = sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err = sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("error sweeping Backup Vault Notifications for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
+	if awsv1.SkipSweepError(errs.ErrorOrNil()) {
 		log.Printf("[WARN] Skipping Backup Vault Notifications sweep for %s: %s", region, errs)
 		return nil
 	}
@@ -239,7 +240,7 @@ func sweepVaultNotifications(region string) error {
 
 func sweepVaultPolicies(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("Error getting client: %w", err)
 	}
@@ -264,7 +265,7 @@ func sweepVaultPolicies(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Backup Vault Policies sweep for %s: %s", region, err)
 		return sweeperErrs.ErrorOrNil()
 	}
@@ -273,7 +274,7 @@ func sweepVaultPolicies(region string) error {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error listing Backup Vaults for %s: %w", region, err))
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error sweeping Backup Vault Policies for %s: %w", region, err))
 	}
 
@@ -282,7 +283,7 @@ func sweepVaultPolicies(region string) error {
 
 func sweepVaults(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("Error getting client: %w", err)
@@ -317,7 +318,7 @@ func sweepVaults(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Backup Vaults sweep for %s: %s", region, err)
 		return sweeperErrs.ErrorOrNil()
 	}
@@ -326,7 +327,7 @@ func sweepVaults(region string) error {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error listing Backup Vaults for %s: %w", region, err))
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error sweeping Backup Vaults for %s: %w", region, err))
 	}
 
diff --git a/internal/service/backup/tags_gen.go b/internal/service/backup/tags_gen.go
index c40e1aa254f..3e37fe6cea3 100644
--- a/internal/service/backup/tags_gen.go
+++ b/internal/service/backup/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/backup"
 	"github.com/aws/aws-sdk-go/service/backup/backupiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -54,7 +56,7 @@ func Tags(tags tftags.KeyValueTags) map[string]*string {
 	return aws.StringMap(tags.Map())
 }
 
-// KeyValueTags creates KeyValueTags from backup service tags.
+// KeyValueTags creates tftags.KeyValueTags from backup service tags.
 func KeyValueTags(ctx context.Context, tags map[string]*string) tftags.KeyValueTags {
 	return tftags.New(ctx, tags)
 }
@@ -85,6 +87,8 @@ func updateTags(ctx context.Context, conn backupiface.BackupAPI, identifier stri
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.Backup)
 	if len(removedTags) > 0 {
diff --git a/internal/service/backup/validate.go b/internal/service/backup/validate.go
index 86497de70b4..7c04deccb59 100644
--- a/internal/service/backup/validate.go
+++ b/internal/service/backup/validate.go
@@ -1,13 +1,17 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package backup
 
 import (
 	"fmt"
-	"regexp"
+
+	"github.com/YakDriver/regexache"
 )
 
 func validReportPlanName(v interface{}, k string) (ws []string, errors []error) {
 	value := v.(string)
-	if !regexp.MustCompile(`^[a-zA-Z]{1}[_a-zA-Z0-9]{0,255}$`).MatchString(value) {
+	if !regexache.MustCompile(`^[A-Za-z]{1}[0-9A-Za-z_]{0,255}$`).MatchString(value) {
 		errors = append(errors, fmt.Errorf("%q (%q) must be must be between 1 and 256 characters, starting with a letter, and consisting of letters, numbers, and underscores.", k, v))
 	}
 	return
@@ -16,7 +20,7 @@ func validReportPlanName(v interface{}, k string) (ws []string, errors []error)
 // The pattern for framework and report plan name is the same but separate functions are used in the event that there are future differences
 func validFrameworkName(v interface{}, k string) (ws []string, errors []error) {
 	value := v.(string)
-	if !regexp.MustCompile(`^[a-zA-Z]{1}[_a-zA-Z0-9]{0,255}$`).MatchString(value) {
+	if !regexache.MustCompile(`^[A-Za-z]{1}[0-9A-Za-z_]{0,255}$`).MatchString(value) {
 		errors = append(errors, fmt.Errorf("%q (%q) must be must be between 1 and 256 characters, starting with a letter, and consisting of letters, numbers, and underscores.", k, v))
 	}
 	return
diff --git a/internal/service/backup/validate_test.go b/internal/service/backup/validate_test.go
index 6ad37453e5b..9631e583d1e 100644
--- a/internal/service/backup/validate_test.go
+++ b/internal/service/backup/validate_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package backup
 
 import (
diff --git a/internal/service/backup/vault.go b/internal/service/backup/vault.go
index 2cddb7be5ce..e731ab9e26d 100644
--- a/internal/service/backup/vault.go
+++ b/internal/service/backup/vault.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package backup
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/backup"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -62,7 +65,7 @@ func ResourceVault() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(2, 50),
-					validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9\-\_]*$`), "must consist of letters, numbers, and hyphens."),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_-]*$`), "must consist of letters, numbers, and hyphens."),
 				),
 			},
 			"recovery_points": {
diff --git a/internal/service/backup/vault_data_source.go b/internal/service/backup/vault_data_source.go
index 1c2649a2e9f..0817d1108d3 100644
--- a/internal/service/backup/vault_data_source.go
+++ b/internal/service/backup/vault_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package backup
 
 import (
diff --git a/internal/service/backup/vault_data_source_test.go b/internal/service/backup/vault_data_source_test.go
index 0bbc8294759..11663e4f1fe 100644
--- a/internal/service/backup/vault_data_source_test.go
+++ b/internal/service/backup/vault_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package backup_test
 
 import (
diff --git a/internal/service/backup/vault_lock_configuration.go b/internal/service/backup/vault_lock_configuration.go
index 194f08c9e8e..3db045432b0 100644
--- a/internal/service/backup/vault_lock_configuration.go
+++ b/internal/service/backup/vault_lock_configuration.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package backup
 
 import (
 	"context"
 	"log"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/backup"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -31,7 +34,7 @@ func ResourceVaultLockConfiguration() *schema.Resource {
 				Type:         schema.TypeString,
 				Required:     true,
 				ForceNew:     true,
-				ValidateFunc: validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9\-\_\.]{1,50}$`), "must consist of lowercase letters, numbers, and hyphens."),
+				ValidateFunc: validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_.-]{1,50}$`), "must consist of lowercase letters, numbers, and hyphens."),
 			},
 			"backup_vault_arn": {
 				Type:     schema.TypeString,
diff --git a/internal/service/backup/vault_lock_configuration_test.go b/internal/service/backup/vault_lock_configuration_test.go
index ff539b81eb3..2f59204988b 100644
--- a/internal/service/backup/vault_lock_configuration_test.go
+++ b/internal/service/backup/vault_lock_configuration_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package backup_test
 
 import (
diff --git a/internal/service/backup/vault_notifications.go b/internal/service/backup/vault_notifications.go
index cb794f29946..1d2d10bd31c 100644
--- a/internal/service/backup/vault_notifications.go
+++ b/internal/service/backup/vault_notifications.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package backup
 
 import (
 	"context"
 	"log"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/backup"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -32,7 +35,7 @@ func ResourceVaultNotifications() *schema.Resource {
 				Type:         schema.TypeString,
 				Required:     true,
 				ForceNew:     true,
-				ValidateFunc: validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9\-\_\.]{1,50}$`), "must consist of lowercase letters, numbers, and hyphens."),
+				ValidateFunc: validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_.-]{1,50}$`), "must consist of lowercase letters, numbers, and hyphens."),
 			},
 			"sns_topic_arn": {
 				Type:         schema.TypeString,
diff --git a/internal/service/backup/vault_notifications_test.go b/internal/service/backup/vault_notifications_test.go
index b8f7242ad32..1aa60920e6b 100644
--- a/internal/service/backup/vault_notifications_test.go
+++ b/internal/service/backup/vault_notifications_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package backup_test
 
 import (
diff --git a/internal/service/backup/vault_policy.go b/internal/service/backup/vault_policy.go
index 49db3ea1008..7a3240a7e04 100644
--- a/internal/service/backup/vault_policy.go
+++ b/internal/service/backup/vault_policy.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package backup
 
 import (
diff --git a/internal/service/backup/vault_policy_test.go b/internal/service/backup/vault_policy_test.go
index 5067865cad5..e66e263e23b 100644
--- a/internal/service/backup/vault_policy_test.go
+++ b/internal/service/backup/vault_policy_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package backup_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/backup"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -32,7 +35,7 @@ func TestAccBackupVaultPolicy_basic(t *testing.T) {
 				Config: testAccVaultPolicyConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckVaultPolicyExists(ctx, resourceName, &vault),
-					resource.TestMatchResourceAttr(resourceName, "policy", regexp.MustCompile("^{\"Id\":\"default\".+"))),
+					resource.TestMatchResourceAttr(resourceName, "policy", regexache.MustCompile("^{\"Id\":\"default\".+"))),
 			},
 			{
 				ResourceName:      resourceName,
@@ -43,8 +46,8 @@ func TestAccBackupVaultPolicy_basic(t *testing.T) {
 				Config: testAccVaultPolicyConfig_updated(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckVaultPolicyExists(ctx, resourceName, &vault),
-					resource.TestMatchResourceAttr(resourceName, "policy", regexp.MustCompile("^{\"Id\":\"default\".+")),
-					resource.TestMatchResourceAttr(resourceName, "policy", regexp.MustCompile("backup:ListRecoveryPointsByBackupVault")),
+					resource.TestMatchResourceAttr(resourceName, "policy", regexache.MustCompile("^{\"Id\":\"default\".+")),
+					resource.TestMatchResourceAttr(resourceName, "policy", regexache.MustCompile("backup:ListRecoveryPointsByBackupVault")),
 				),
 			},
 		},
@@ -116,7 +119,7 @@ func TestAccBackupVaultPolicy_ignoreEquivalent(t *testing.T) {
 				Config: testAccVaultPolicyConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckVaultPolicyExists(ctx, resourceName, &vault),
-					resource.TestMatchResourceAttr(resourceName, "policy", regexp.MustCompile("\"Version\":\"2012-10-17\""))),
+					resource.TestMatchResourceAttr(resourceName, "policy", regexache.MustCompile("\"Version\":\"2012-10-17\""))),
 			},
 			{
 				Config:   testAccVaultPolicyConfig_newOrder(rName),
diff --git a/internal/service/backup/vault_test.go b/internal/service/backup/vault_test.go
index 52600b4ef4c..e6d1804e5ca 100644
--- a/internal/service/backup/vault_test.go
+++ b/internal/service/backup/vault_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package backup_test
 
 import (
diff --git a/internal/service/backup/wait.go b/internal/service/backup/wait.go
index a66330a77e7..4a98129440d 100644
--- a/internal/service/backup/wait.go
+++ b/internal/service/backup/wait.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package backup
 
 import (
diff --git a/internal/service/batch/compute_environment.go b/internal/service/batch/compute_environment.go
index 9a5fcaf5f75..0618b550c37 100644
--- a/internal/service/batch/compute_environment.go
+++ b/internal/service/batch/compute_environment.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package batch
 
 import (
@@ -8,6 +11,7 @@ import (
 	"strings"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/batch"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
@@ -75,7 +79,6 @@ func ResourceComputeEnvironment() *schema.Resource {
 						"allocation_strategy": {
 							Type:     schema.TypeString,
 							Optional: true,
-							ForceNew: true,
 							StateFunc: func(val interface{}) string {
 								return strings.ToUpper(val.(string))
 							},
@@ -84,7 +87,6 @@ func ResourceComputeEnvironment() *schema.Resource {
 						"bid_percentage": {
 							Type:     schema.TypeInt,
 							Optional: true,
-							ForceNew: true,
 						},
 						"desired_vcpus": {
 							Type:     schema.TypeInt,
@@ -103,13 +105,11 @@ func ResourceComputeEnvironment() *schema.Resource {
 										Type:         schema.TypeString,
 										Optional:     true,
 										Computed:     true,
-										ForceNew:     true,
 										ValidateFunc: validation.StringLenBetween(1, 256),
 									},
 									"image_type": {
 										Type:         schema.TypeString,
 										Optional:     true,
-										ForceNew:     true,
 										ValidateFunc: validation.StringLenBetween(1, 256),
 									},
 								},
@@ -118,23 +118,19 @@ func ResourceComputeEnvironment() *schema.Resource {
 						"ec2_key_pair": {
 							Type:     schema.TypeString,
 							Optional: true,
-							ForceNew: true,
 						},
 						"image_id": {
 							Type:     schema.TypeString,
 							Optional: true,
-							ForceNew: true,
 						},
 						"instance_role": {
 							Type:         schema.TypeString,
 							Optional:     true,
-							ForceNew:     true,
 							ValidateFunc: verify.ValidARN,
 						},
 						"instance_type": {
 							Type:     schema.TypeSet,
 							Optional: true,
-							ForceNew: true,
 							Elem:     &schema.Schema{Type: schema.TypeString},
 						},
 						"launch_template": {
@@ -147,19 +143,17 @@ func ResourceComputeEnvironment() *schema.Resource {
 									"launch_template_id": {
 										Type:          schema.TypeString,
 										Optional:      true,
-										ForceNew:      true,
 										ConflictsWith: []string{"compute_resources.0.launch_template.0.launch_template_name"},
 									},
 									"launch_template_name": {
 										Type:          schema.TypeString,
 										Optional:      true,
-										ForceNew:      true,
 										ConflictsWith: []string{"compute_resources.0.launch_template.0.launch_template_id"},
 									},
 									"version": {
 										Type:     schema.TypeString,
 										Optional: true,
-										ForceNew: true,
+										Computed: true,
 									},
 								},
 							},
@@ -172,6 +166,11 @@ func ResourceComputeEnvironment() *schema.Resource {
 							Type:     schema.TypeInt,
 							Optional: true,
 						},
+						"placement_group": {
+							Type:     schema.TypeString,
+							Optional: true,
+							ForceNew: true,
+						},
 						"security_group_ids": {
 							Type:     schema.TypeSet,
 							Optional: true,
@@ -188,11 +187,10 @@ func ResourceComputeEnvironment() *schema.Resource {
 							Required: true,
 							Elem:     &schema.Schema{Type: schema.TypeString},
 						},
-						"tags": tftags.TagsSchemaForceNew(),
+						"tags": tftags.TagsSchema(),
 						"type": {
 							Type:     schema.TypeString,
 							Required: true,
-							ForceNew: true,
 							StateFunc: func(val interface{}) string {
 								return strings.ToUpper(val.(string))
 							},
@@ -309,7 +307,7 @@ func resourceComputeEnvironmentRead(ctx context.Context, d *schema.ResourceData,
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).BatchConn(ctx)
 
-	computeEnvironment, err := FindComputeEnvironmentDetailByName(ctx, conn, d.Id())
+	computeEnvironment, err := findComputeEnvironmentDetailByName(ctx, conn, d.Id())
 
 	if !d.IsNewResource() && tfresource.NotFound(err) {
 		log.Printf("[WARN] Batch Compute Environment (%s) not found, removing from state", d.Id())
@@ -326,13 +324,6 @@ func resourceComputeEnvironmentRead(ctx context.Context, d *schema.ResourceData,
 	d.Set("arn", computeEnvironment.ComputeEnvironmentArn)
 	d.Set("compute_environment_name", computeEnvironment.ComputeEnvironmentName)
 	d.Set("compute_environment_name_prefix", create.NamePrefixFromName(aws.StringValue(computeEnvironment.ComputeEnvironmentName)))
-	d.Set("ecs_cluster_arn", computeEnvironment.EcsClusterArn)
-	d.Set("service_role", computeEnvironment.ServiceRole)
-	d.Set("state", computeEnvironment.State)
-	d.Set("status", computeEnvironment.Status)
-	d.Set("status_reason", computeEnvironment.StatusReason)
-	d.Set("type", computeEnvironmentType)
-
 	if computeEnvironment.ComputeResources != nil {
 		if err := d.Set("compute_resources", []interface{}{flattenComputeResource(ctx, computeEnvironment.ComputeResources)}); err != nil {
 			return sdkdiag.AppendErrorf(diags, "setting compute_resources: %s", err)
@@ -340,7 +331,7 @@ func resourceComputeEnvironmentRead(ctx context.Context, d *schema.ResourceData,
 	} else {
 		d.Set("compute_resources", nil)
 	}
-
+	d.Set("ecs_cluster_arn", computeEnvironment.EcsClusterArn)
 	if computeEnvironment.EksConfiguration != nil {
 		if err := d.Set("eks_configuration", []interface{}{flattenEKSConfiguration(computeEnvironment.EksConfiguration)}); err != nil {
 			return sdkdiag.AppendErrorf(diags, "setting eks_configuration: %s", err)
@@ -348,6 +339,11 @@ func resourceComputeEnvironmentRead(ctx context.Context, d *schema.ResourceData,
 	} else {
 		d.Set("eks_configuration", nil)
 	}
+	d.Set("service_role", computeEnvironment.ServiceRole)
+	d.Set("state", computeEnvironment.State)
+	d.Set("status", computeEnvironment.Status)
+	d.Set("status_reason", computeEnvironment.StatusReason)
+	d.Set("type", computeEnvironmentType)
 
 	setTagsOut(ctx, computeEnvironment.Tags)
 
@@ -377,14 +373,6 @@ func resourceComputeEnvironmentUpdate(ctx context.Context, d *schema.ResourceDat
 				MaxvCpus: aws.Int64(int64(d.Get("compute_resources.0.max_vcpus").(int))),
 			}
 
-			if d.HasChange("compute_resources.0.desired_vcpus") {
-				computeResourceUpdate.DesiredvCpus = aws.Int64(int64(d.Get("compute_resources.0.desired_vcpus").(int)))
-			}
-
-			if d.HasChange("compute_resources.0.min_vcpus") {
-				computeResourceUpdate.MinvCpus = aws.Int64(int64(d.Get("compute_resources.0.min_vcpus").(int)))
-			}
-
 			if d.HasChange("compute_resources.0.security_group_ids") {
 				computeResourceUpdate.SecurityGroupIds = flex.ExpandStringSet(d.Get("compute_resources.0.security_group_ids").(*schema.Set))
 			}
@@ -393,6 +381,96 @@ func resourceComputeEnvironmentUpdate(ctx context.Context, d *schema.ResourceDat
 				computeResourceUpdate.Subnets = flex.ExpandStringSet(d.Get("compute_resources.0.subnets").(*schema.Set))
 			}
 
+			if d.HasChange("compute_resources.0.allocation_strategy") {
+				if allocationStrategy, ok := d.GetOk("compute_resources.0.allocation_strategy"); ok {
+					computeResourceUpdate.AllocationStrategy = aws.String(allocationStrategy.(string))
+				} else {
+					computeResourceUpdate.AllocationStrategy = aws.String("")
+				}
+			}
+
+			computeResourceEnvironmentType := d.Get("compute_resources.0.type").(string)
+
+			if d.HasChange("compute_resources.0.type") {
+				computeResourceUpdate.Type = aws.String(computeResourceEnvironmentType)
+			}
+
+			if !isFargateType(computeResourceEnvironmentType) {
+				if d.HasChange("compute_resources.0.desired_vcpus") {
+					if desiredvCpus, ok := d.GetOk("compute_resources.0.desired_vcpus"); ok {
+						computeResourceUpdate.DesiredvCpus = aws.Int64(int64(desiredvCpus.(int)))
+					} else {
+						computeResourceUpdate.DesiredvCpus = aws.Int64(0)
+					}
+				}
+
+				if d.HasChange("compute_resources.0.min_vcpus") {
+					if minVcpus, ok := d.GetOk("compute_resources.0.min_vcpus"); ok {
+						computeResourceUpdate.MinvCpus = aws.Int64(int64(minVcpus.(int)))
+					} else {
+						computeResourceUpdate.MinvCpus = aws.Int64(0)
+					}
+				}
+
+				if d.HasChange("compute_resources.0.bid_percentage") {
+					if bidPercentage, ok := d.GetOk("compute_resources.0.bid_percentage"); ok {
+						computeResourceUpdate.BidPercentage = aws.Int64(int64(bidPercentage.(int)))
+					} else {
+						computeResourceUpdate.BidPercentage = aws.Int64(0)
+					}
+				}
+
+				if d.HasChange("compute_resources.0.ec2_configuration") {
+					defaultImageType := "ECS_AL2"
+					if _, ok := d.GetOk("eks_configuration.#"); ok {
+						defaultImageType = "EKS_AL2"
+					}
+					ec2Configuration := d.Get("compute_resources.0.ec2_configuration").([]interface{})
+					computeResourceUpdate.Ec2Configuration = expandEC2ConfigurationsUpdate(ec2Configuration, defaultImageType)
+				}
+
+				if d.HasChange("compute_resources.0.ec2_key_pair") {
+					if keyPair, ok := d.GetOk("compute_resources.0.ec2_key_pair"); ok {
+						computeResourceUpdate.Ec2KeyPair = aws.String(keyPair.(string))
+					} else {
+						computeResourceUpdate.Ec2KeyPair = aws.String("")
+					}
+				}
+
+				if d.HasChange("compute_resources.0.image_id") {
+					if imageId, ok := d.GetOk("compute_resources.0.image_id"); ok {
+						computeResourceUpdate.ImageId = aws.String(imageId.(string))
+					} else {
+						computeResourceUpdate.ImageId = aws.String("")
+					}
+				}
+
+				if d.HasChange("compute_resources.0.instance_role") {
+					if instanceRole, ok := d.GetOk("compute_resources.0.instance_role"); ok {
+						computeResourceUpdate.InstanceRole = aws.String(instanceRole.(string))
+					} else {
+						computeResourceUpdate.InstanceRole = aws.String("")
+					}
+				}
+
+				if d.HasChange("compute_resources.0.instance_type") {
+					computeResourceUpdate.InstanceTypes = flex.ExpandStringSet(d.Get("compute_resources.0.instance_type").(*schema.Set))
+				}
+
+				if d.HasChange("compute_resources.0.launch_template") {
+					launchTemplate := d.Get("compute_resources.0.launch_template").([]interface{})
+					computeResourceUpdate.LaunchTemplate = expandLaunchTemplateSpecificationUpdate(launchTemplate)
+				}
+
+				if d.HasChange("compute_resources.0.tags") {
+					if tags, ok := d.GetOk("compute_resources.0.tags"); ok {
+						computeResourceUpdate.Tags = Tags(tftags.New(ctx, tags.(map[string]interface{})).IgnoreAWS())
+					} else {
+						computeResourceUpdate.Tags = aws.StringMap(map[string]string{})
+					}
+				}
+			}
+
 			input.ComputeResources = computeResourceUpdate
 		}
 
@@ -458,21 +536,103 @@ func resourceComputeEnvironmentCustomizeDiff(_ context.Context, diff *schema.Res
 	if diff.Id() != "" {
 		// Update.
 
-		computeResourceType := strings.ToUpper(diff.Get("compute_resources.0.type").(string))
-		fargateComputeResources := false
-		if computeResourceType == batch.CRTypeFargate || computeResourceType == batch.CRTypeFargateSpot {
-			fargateComputeResources = true
-		}
+		fargateComputeResources := isFargateType(diff.Get("compute_resources.0.type").(string))
 
-		if diff.HasChange("compute_resources.0.security_group_ids") && !fargateComputeResources {
-			if err := diff.ForceNew("compute_resources.0.security_group_ids"); err != nil {
-				return err
+		if !isUpdatableComputeEnvironment(diff) {
+			if diff.HasChange("compute_resources.0.security_group_ids") && !fargateComputeResources {
+				if err := diff.ForceNew("compute_resources.0.security_group_ids"); err != nil {
+					return err
+				}
+			}
+
+			if diff.HasChange("compute_resources.0.subnets") && !fargateComputeResources {
+				if err := diff.ForceNew("compute_resources.0.subnets"); err != nil {
+					return err
+				}
+			}
+
+			if diff.HasChange("compute_resources.0.allocation_strategy") {
+				if err := diff.ForceNew("compute_resources.0.allocation_strategy"); err != nil {
+					return err
+				}
+			}
+
+			if diff.HasChange("compute_resources.0.bid_percentage") {
+				if err := diff.ForceNew("compute_resources.0.bid_percentage"); err != nil {
+					return err
+				}
+			}
+
+			if diff.HasChange("compute_resources.0.ec2_configuration.#") {
+				if err := diff.ForceNew("compute_resources.0.ec2_configuration.#"); err != nil {
+					return err
+				}
+			}
+
+			if diff.HasChange("compute_resources.0.ec2_configuration.0.image_id_override") {
+				if err := diff.ForceNew("compute_resources.0.ec2_configuration.0.image_id_override"); err != nil {
+					return err
+				}
+			}
+
+			if diff.HasChange("compute_resources.0.ec2_configuration.0.image_type") {
+				if err := diff.ForceNew("compute_resources.0.ec2_configuration.0.image_type"); err != nil {
+					return err
+				}
+			}
+
+			if diff.HasChange("compute_resources.0.ec2_key_pair") {
+				if err := diff.ForceNew("compute_resources.0.ec2_key_pair"); err != nil {
+					return err
+				}
+			}
+
+			if diff.HasChange("compute_resources.0.image_id") {
+				if err := diff.ForceNew("compute_resources.0.image_id"); err != nil {
+					return err
+				}
+			}
+
+			if diff.HasChange("compute_resources.0.instance_role") {
+				if err := diff.ForceNew("compute_resources.0.instance_role"); err != nil {
+					return err
+				}
+			}
+
+			if diff.HasChange("compute_resources.0.instance_type") {
+				if err := diff.ForceNew("compute_resources.0.instance_type"); err != nil {
+					return err
+				}
+			}
+
+			if diff.HasChange("compute_resources.0.launch_template.#") {
+				if err := diff.ForceNew("compute_resources.0.launch_template.#"); err != nil {
+					return err
+				}
 			}
-		}
 
-		if diff.HasChange("compute_resources.0.subnets") && !fargateComputeResources {
-			if err := diff.ForceNew("compute_resources.0.subnets"); err != nil {
-				return err
+			if diff.HasChange("compute_resources.0.launch_template.0.launch_template_id") {
+				if err := diff.ForceNew("compute_resources.0.launch_template.0.launch_template_id"); err != nil {
+					return err
+				}
+			}
+
+			if diff.HasChange("compute_resources.0.launch_template.0.launch_template_name") {
+				if err := diff.ForceNew("compute_resources.0.launch_template.0.launch_template_name"); err != nil {
+					return err
+				}
+			}
+
+			if diff.HasChange("compute_resources.0.launch_template.0.version") {
+				if err := diff.ForceNew("compute_resources.0.launch_template.0.version"); err != nil {
+					return err
+				}
+			}
+
+			if diff.HasChange("compute_resources.0.tags") {
+				if err := diff.ForceNew("compute_resources.0.tags"); err != nil {
+					return err
+				}
 			}
 		}
 	}
@@ -480,7 +640,7 @@ func resourceComputeEnvironmentCustomizeDiff(_ context.Context, diff *schema.Res
 	return nil
 }
 
-func FindComputeEnvironmentDetailByName(ctx context.Context, conn *batch.Batch, name string) (*batch.ComputeEnvironmentDetail, error) {
+func findComputeEnvironmentDetailByName(ctx context.Context, conn *batch.Batch, name string) (*batch.ComputeEnvironmentDetail, error) {
 	input := &batch.DescribeComputeEnvironmentsInput{
 		ComputeEnvironments: aws.StringSlice([]string{name}),
 	}
@@ -508,20 +668,16 @@ func findComputeEnvironmentDetail(ctx context.Context, conn *batch.Batch, input
 		return nil, err
 	}
 
-	if output == nil || len(output.ComputeEnvironments) == 0 || output.ComputeEnvironments[0] == nil {
+	if output == nil {
 		return nil, tfresource.NewEmptyResultError(input)
 	}
 
-	if count := len(output.ComputeEnvironments); count > 1 {
-		return nil, tfresource.NewTooManyResultsError(count, input)
-	}
-
-	return output.ComputeEnvironments[0], nil
+	return tfresource.AssertSinglePtrResult(output.ComputeEnvironments)
 }
 
 func statusComputeEnvironment(ctx context.Context, conn *batch.Batch, name string) retry.StateRefreshFunc {
 	return func() (interface{}, string, error) {
-		computeEnvironmentDetail, err := FindComputeEnvironmentDetailByName(ctx, conn, name)
+		computeEnvironmentDetail, err := findComputeEnvironmentDetailByName(ctx, conn, name)
 
 		if tfresource.NotFound(err) {
 			return nil, "", nil
@@ -615,6 +771,67 @@ func waitComputeEnvironmentUpdated(ctx context.Context, conn *batch.Batch, name
 	return nil, err
 }
 
+func isFargateType(computeResourceType string) bool {
+	if computeResourceType == batch.CRTypeFargate || computeResourceType == batch.CRTypeFargateSpot {
+		return true
+	}
+	return false
+}
+
+func isUpdatableComputeEnvironment(diff *schema.ResourceDiff) bool {
+	if !isServiceLinkedRoleDiff(diff) {
+		return false
+	}
+	if !isUpdatableAllocationStrategyDiff(diff) {
+		return false
+	}
+	return true
+}
+
+func isServiceLinkedRoleDiff(diff *schema.ResourceDiff) bool {
+	var before, after string
+	if diff.HasChange("service_role") {
+		beforeRaw, afterRaw := diff.GetChange("service_role")
+		before, _ = beforeRaw.(string)
+		after, _ := afterRaw.(string)
+		return isServiceLinkedRole(before) && isServiceLinkedRole(after)
+	}
+	afterRaw, _ := diff.GetOk("service_role")
+	after, _ = afterRaw.(string)
+	return isServiceLinkedRole(after)
+}
+
+func isServiceLinkedRole(roleArn string) bool {
+	if roleArn == "" {
+		// Empty role ARN defaults to AWS service-linked role
+		return true
+	}
+	re := regexache.MustCompile(`arn:[^:]+:iam::\d{12}:role/aws-service-role/batch\.amazonaws\.com/*`)
+	return re.MatchString(roleArn)
+}
+
+func isUpdatableAllocationStrategyDiff(diff *schema.ResourceDiff) bool {
+	var before, after string
+	if computeResourcesCount, ok := diff.Get("compute_resources.#").(int); ok {
+		if computeResourcesCount > 0 {
+			if diff.HasChange("compute_resources.0.allocation_strategy") {
+				beforeRaw, afterRaw := diff.GetChange("compute_resources.0.allocation_strategy")
+				before, _ = beforeRaw.(string)
+				after, _ = afterRaw.(string)
+				return isUpdatableAllocationStrategy(before) && isUpdatableAllocationStrategy(after)
+			}
+			afterRaw, _ := diff.GetOk("compute_resources.0.allocation_strategy")
+			after, _ := afterRaw.(string)
+			return isUpdatableAllocationStrategy(after)
+		}
+	}
+	return false
+}
+
+func isUpdatableAllocationStrategy(allocationStrategy string) bool {
+	return allocationStrategy == batch.CRAllocationStrategyBestFitProgressive || allocationStrategy == batch.CRAllocationStrategySpotCapacityOptimized
+}
+
 func expandComputeResource(ctx context.Context, tfMap map[string]interface{}) *batch.ComputeResource {
 	if tfMap == nil {
 		return nil
@@ -674,6 +891,10 @@ func expandComputeResource(ctx context.Context, tfMap map[string]interface{}) *b
 		apiObject.MinvCpus = aws.Int64(0)
 	}
 
+	if v, ok := tfMap["placement_group"].(string); ok && v != "" {
+		apiObject.PlacementGroup = aws.String(v)
+	}
+
 	if v, ok := tfMap["security_group_ids"].(*schema.Set); ok && v.Len() > 0 {
 		apiObject.SecurityGroupIds = flex.ExpandStringSet(v)
 	}
@@ -781,6 +1002,64 @@ func expandLaunchTemplateSpecification(tfMap map[string]interface{}) *batch.Laun
 	return apiObject
 }
 
+func expandEC2ConfigurationsUpdate(tfList []interface{}, defaultImageType string) []*batch.Ec2Configuration {
+	if len(tfList) == 0 {
+		return []*batch.Ec2Configuration{
+			{
+				ImageType: aws.String(defaultImageType),
+			},
+		}
+	}
+
+	var apiObjects []*batch.Ec2Configuration
+
+	for _, tfMapRaw := range tfList {
+		tfMap, ok := tfMapRaw.(map[string]interface{})
+
+		if !ok {
+			continue
+		}
+
+		apiObject := expandEC2Configuration(tfMap)
+
+		if apiObject == nil {
+			continue
+		}
+
+		apiObjects = append(apiObjects, apiObject)
+	}
+
+	return apiObjects
+}
+
+func expandLaunchTemplateSpecificationUpdate(tfList []interface{}) *batch.LaunchTemplateSpecification {
+	if len(tfList) == 0 || tfList[0] == nil {
+		// delete any existing launch template configuration
+		return &batch.LaunchTemplateSpecification{
+			LaunchTemplateId: aws.String(""),
+		}
+	}
+
+	tfMap := tfList[0].(map[string]interface{})
+	apiObject := &batch.LaunchTemplateSpecification{}
+
+	if v, ok := tfMap["launch_template_id"].(string); ok && v != "" {
+		apiObject.LaunchTemplateId = aws.String(v)
+	}
+
+	if v, ok := tfMap["launch_template_name"].(string); ok && v != "" {
+		apiObject.LaunchTemplateName = aws.String(v)
+	}
+
+	if v, ok := tfMap["version"].(string); ok {
+		apiObject.Version = aws.String(v)
+	} else {
+		apiObject.Version = aws.String("")
+	}
+
+	return apiObject
+}
+
 func flattenComputeResource(ctx context.Context, apiObject *batch.ComputeResource) map[string]interface{} {
 	if apiObject == nil {
 		return nil
@@ -832,6 +1111,10 @@ func flattenComputeResource(ctx context.Context, apiObject *batch.ComputeResourc
 		tfMap["min_vcpus"] = aws.Int64Value(v)
 	}
 
+	if v := apiObject.PlacementGroup; v != nil {
+		tfMap["placement_group"] = aws.StringValue(v)
+	}
+
 	if v := apiObject.SecurityGroupIds; v != nil {
 		tfMap["security_group_ids"] = aws.StringValueSlice(v)
 	}
diff --git a/internal/service/batch/compute_environment_data_source.go b/internal/service/batch/compute_environment_data_source.go
index c456f979a7d..7163667f07c 100644
--- a/internal/service/batch/compute_environment_data_source.go
+++ b/internal/service/batch/compute_environment_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package batch
 
 import (
diff --git a/internal/service/batch/compute_environment_data_source_test.go b/internal/service/batch/compute_environment_data_source_test.go
index 26b6c42f0f2..6f35d54e2d5 100644
--- a/internal/service/batch/compute_environment_data_source_test.go
+++ b/internal/service/batch/compute_environment_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package batch_test
 
 import (
diff --git a/internal/service/batch/compute_environment_test.go b/internal/service/batch/compute_environment_test.go
index 65cd172ccf1..8b520e66486 100644
--- a/internal/service/batch/compute_environment_test.go
+++ b/internal/service/batch/compute_environment_test.go
@@ -1,12 +1,17 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package batch_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
+	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/batch"
+	"github.com/google/go-cmp/cmp"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
@@ -16,6 +21,139 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
+func TestExpandEC2ConfigurationsUpdate(t *testing.T) {
+	t.Parallel()
+
+	//lintignore:AWSAT002
+	testCases := []struct {
+		flattened []interface{}
+		expected  []*batch.Ec2Configuration
+	}{
+		{
+			flattened: []interface{}{},
+			expected: []*batch.Ec2Configuration{
+				{
+					ImageType: aws.String("default"),
+				},
+			},
+		},
+		{
+			flattened: []interface{}{
+				map[string]interface{}{
+					"image_type": "ECS_AL1",
+				},
+			},
+			expected: []*batch.Ec2Configuration{
+				{
+					ImageType: aws.String("ECS_AL1"),
+				},
+			},
+		},
+		{
+			flattened: []interface{}{
+				map[string]interface{}{
+					"image_id_override": "ami-deadbeef",
+				},
+			},
+			expected: []*batch.Ec2Configuration{
+				{
+					ImageIdOverride: aws.String("ami-deadbeef"),
+				},
+			},
+		},
+		{
+			flattened: []interface{}{
+				map[string]interface{}{
+					"image_id_override": "ami-deadbeef",
+					"image_type":        "ECS_AL1",
+				},
+			},
+			expected: []*batch.Ec2Configuration{
+				{
+					ImageIdOverride: aws.String("ami-deadbeef"),
+					ImageType:       aws.String("ECS_AL1"),
+				},
+			},
+		},
+	}
+
+	for _, testCase := range testCases {
+		expanded := tfbatch.ExpandEC2ConfigurationsUpdate(testCase.flattened, "default")
+		if diff := cmp.Diff(expanded, testCase.expected); diff != "" {
+			t.Errorf("unexpected diff (+wanted, -got): %s", diff)
+		}
+	}
+}
+
+func TestExpandLaunchTemplateSpecificationUpdate(t *testing.T) {
+	t.Parallel()
+
+	testCases := []struct {
+		flattened []interface{}
+		expected  *batch.LaunchTemplateSpecification
+	}{
+		{
+			flattened: []interface{}{},
+			expected: &batch.LaunchTemplateSpecification{
+				LaunchTemplateId: aws.String(""),
+			},
+		},
+		{
+			flattened: []interface{}{
+				map[string]interface{}{
+					"launch_template_id": "lt-123456",
+				},
+			},
+			expected: &batch.LaunchTemplateSpecification{
+				LaunchTemplateId: aws.String("lt-123456"),
+				Version:          aws.String(""),
+			},
+		},
+		{
+			flattened: []interface{}{
+				map[string]interface{}{
+					"launch_template_name": "my-launch-template",
+				},
+			},
+			expected: &batch.LaunchTemplateSpecification{
+				LaunchTemplateName: aws.String("my-launch-template"),
+				Version:            aws.String(""),
+			},
+		},
+		{
+			flattened: []interface{}{
+				map[string]interface{}{
+					"launch_template_id": "lt-123456",
+					"version":            "$LATEST",
+				},
+			},
+			expected: &batch.LaunchTemplateSpecification{
+				LaunchTemplateId: aws.String("lt-123456"),
+				Version:          aws.String("$LATEST"),
+			},
+		},
+		{
+			flattened: []interface{}{
+				map[string]interface{}{
+					"launch_template_name": "my-launch-template",
+					"version":              "$LATEST",
+				},
+			},
+			expected: &batch.LaunchTemplateSpecification{
+				LaunchTemplateName: aws.String("my-launch-template"),
+				Version:            aws.String("$LATEST"),
+			},
+		},
+	}
+
+	for _, testCase := range testCases {
+		expanded := tfbatch.ExpandLaunchTemplateSpecificationUpdate(testCase.flattened)
+		if diff := cmp.Diff(expanded, testCase.expected); diff != "" {
+			t.Errorf("unexpected diff (+wanted, -got): %s", diff)
+		}
+	}
+}
+
 func TestAccBatchComputeEnvironment_basic(t *testing.T) {
 	ctx := acctest.Context(t)
 	var ce batch.ComputeEnvironmentDetail
@@ -202,6 +340,7 @@ func TestAccBatchComputeEnvironment_createEC2(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "compute_resources.0.launch_template.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "compute_resources.0.max_vcpus", "16"),
 					resource.TestCheckResourceAttr(resourceName, "compute_resources.0.min_vcpus", "0"),
+					resource.TestCheckResourceAttr(resourceName, "compute_resources.0.placement_group", ""),
 					resource.TestCheckResourceAttr(resourceName, "compute_resources.0.security_group_ids.#", "1"),
 					resource.TestCheckTypeSetElemAttrPair(resourceName, "compute_resources.0.security_group_ids.*", securityGroupResourceName, "id"),
 					resource.TestCheckResourceAttr(resourceName, "compute_resources.0.spot_iam_fleet_role", ""),
@@ -726,7 +865,7 @@ func TestAccBatchComputeEnvironment_defaultServiceRole(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "compute_resources.0.tags.%", "0"),
 					resource.TestCheckResourceAttr(resourceName, "compute_resources.0.type", "FARGATE"),
 					resource.TestCheckResourceAttrSet(resourceName, "ecs_cluster_arn"),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "service_role", "iam", regexp.MustCompile(`role/aws-service-role/batch`)),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "service_role", "iam", regexache.MustCompile(`role/aws-service-role/batch`)),
 					resource.TestCheckResourceAttr(resourceName, "state", "ENABLED"),
 					resource.TestCheckResourceAttrSet(resourceName, "status"),
 					resource.TestCheckResourceAttrSet(resourceName, "status_reason"),
@@ -1068,6 +1207,72 @@ func TestAccBatchComputeEnvironment_ec2Configuration(t *testing.T) {
 	})
 }
 
+func TestAccBatchComputeEnvironment_ec2ConfigurationPlacementGroup(t *testing.T) {
+	ctx := acctest.Context(t)
+	var ce batch.ComputeEnvironmentDetail
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_batch_compute_environment.test"
+	instanceProfileResourceName := "aws_iam_instance_profile.ecs_instance"
+	securityGroupResourceName := "aws_security_group.test"
+	serviceRoleResourceName := "aws_iam_role.batch_service"
+	spotFleetRoleResourceName := "aws_iam_role.ec2_spot_fleet"
+	subnetResourceName := "aws_subnet.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, batch.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckComputeEnvironmentDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccComputeEnvironmentConfig_ec2ConfigurationPlacementGroup(rName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckComputeEnvironmentExists(ctx, resourceName, &ce),
+					acctest.CheckResourceAttrRegionalARN(resourceName, "arn", "batch", fmt.Sprintf("compute-environment/%s", rName)),
+					resource.TestCheckResourceAttr(resourceName, "compute_environment_name", rName),
+					resource.TestCheckResourceAttr(resourceName, "compute_environment_name_prefix", ""),
+					resource.TestCheckResourceAttr(resourceName, "compute_resources.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "compute_resources.0.allocation_strategy", ""),
+					resource.TestCheckResourceAttr(resourceName, "compute_resources.0.bid_percentage", "0"),
+					resource.TestCheckResourceAttr(resourceName, "compute_resources.0.desired_vcpus", "0"),
+					resource.TestCheckResourceAttr(resourceName, "compute_resources.0.ec2_key_pair", ""),
+					resource.TestCheckResourceAttr(resourceName, "compute_resources.0.image_id", ""),
+					resource.TestCheckResourceAttrPair(resourceName, "compute_resources.0.instance_role", instanceProfileResourceName, "arn"),
+					resource.TestCheckResourceAttr(resourceName, "compute_resources.0.instance_type.#", "1"),
+					resource.TestCheckTypeSetElemAttr(resourceName, "compute_resources.0.instance_type.*", "optimal"),
+					resource.TestCheckResourceAttr(resourceName, "compute_resources.0.ec2_configuration.#", "2"),
+					resource.TestCheckResourceAttrSet(resourceName, "compute_resources.0.ec2_configuration.0.image_id_override"),
+					resource.TestCheckResourceAttr(resourceName, "compute_resources.0.ec2_configuration.0.image_type", "ECS_AL2"),
+					resource.TestCheckResourceAttrSet(resourceName, "compute_resources.0.ec2_configuration.1.image_id_override"),
+					resource.TestCheckResourceAttr(resourceName, "compute_resources.0.ec2_configuration.1.image_type", "ECS_AL2_NVIDIA"),
+					resource.TestCheckResourceAttr(resourceName, "compute_resources.0.max_vcpus", "16"),
+					resource.TestCheckResourceAttr(resourceName, "compute_resources.0.min_vcpus", "0"),
+					resource.TestCheckResourceAttr(resourceName, "compute_resources.0.placement_group", rName),
+					resource.TestCheckResourceAttr(resourceName, "compute_resources.0.security_group_ids.#", "1"),
+					resource.TestCheckTypeSetElemAttrPair(resourceName, "compute_resources.0.security_group_ids.*", securityGroupResourceName, "id"),
+					resource.TestCheckResourceAttrPair(resourceName, "compute_resources.0.spot_iam_fleet_role", spotFleetRoleResourceName, "arn"),
+					resource.TestCheckResourceAttr(resourceName, "compute_resources.0.subnets.#", "1"),
+					resource.TestCheckTypeSetElemAttrPair(resourceName, "compute_resources.0.subnets.*", subnetResourceName, "id"),
+					resource.TestCheckResourceAttr(resourceName, "compute_resources.0.tags.%", "0"),
+					resource.TestCheckResourceAttr(resourceName, "compute_resources.0.type", "SPOT"),
+					resource.TestCheckResourceAttrSet(resourceName, "ecs_cluster_arn"),
+					resource.TestCheckResourceAttrPair(resourceName, "service_role", serviceRoleResourceName, "arn"),
+					resource.TestCheckResourceAttr(resourceName, "state", "ENABLED"),
+					resource.TestCheckResourceAttrSet(resourceName, "status"),
+					resource.TestCheckResourceAttrSet(resourceName, "status_reason"),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
+					resource.TestCheckResourceAttr(resourceName, "type", "MANAGED"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
 func TestAccBatchComputeEnvironment_launchTemplate(t *testing.T) {
 	ctx := acctest.Context(t)
 	var ce batch.ComputeEnvironmentDetail
@@ -1388,17 +1593,30 @@ func TestAccBatchComputeEnvironment_createUnmanagedWithComputeResources(t *testi
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccComputeEnvironmentConfig_unmanagedResources(rName),
-				ExpectError: regexp.MustCompile("no `compute_resources` can be specified when `type` is \"UNMANAGED\""),
+				ExpectError: regexache.MustCompile("no `compute_resources` can be specified when `type` is \"UNMANAGED\""),
 			},
 		},
 	})
 }
 
-// Test plan time errors...
-
-func TestAccBatchComputeEnvironment_createEC2WithoutComputeResources(t *testing.T) {
+func TestAccBatchComputeEnvironment_updateEC2(t *testing.T) {
 	ctx := acctest.Context(t)
+	var ce batch.ComputeEnvironmentDetail
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_batch_compute_environment.test"
+	instanceProfileResourceName := "aws_iam_instance_profile.ecs_instance"
+	updatedInstanceProfileResourceName := "aws_iam_instance_profile.ecs_instance_2"
+	securityGroupResourceName := "aws_security_group.test"
+	updatedSecurityGroupResourceName := "aws_security_group.test_2"
+	subnetResourceName := "aws_subnet.test"
+	updatedSubnetResourceName := "aws_subnet.test_2"
+	ec2KeyPairResourceName := "aws_key_pair.test"
+	launchTemplateResourceName := "aws_launch_template.test"
+	spotFleetRoleResourceName := "aws_iam_role.ec2_spot_fleet"
+	publicKey, _, err := sdkacctest.RandSSHKeyPair(acctest.DefaultEmailAddress)
+	if err != nil {
+		t.Fatalf("error generating random SSH key: %s", err)
+	}
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheck(ctx, t) },
@@ -1407,14 +1625,129 @@ func TestAccBatchComputeEnvironment_createEC2WithoutComputeResources(t *testing.
 		CheckDestroy:             testAccCheckComputeEnvironmentDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config:      testAccComputeEnvironmentConfig_ec2NoResources(rName),
-				ExpectError: regexp.MustCompile(`computeResources must be provided for a MANAGED compute environment`),
+				Config: testAccComputeenvironmentConfig_ec2PreUpdate(rName, publicKey),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckComputeEnvironmentExists(ctx, resourceName, &ce),
+					acctest.CheckResourceAttrRegionalARN(resourceName, "arn", "batch", fmt.Sprintf("compute-environment/%s", rName)),
+					resource.TestCheckResourceAttr(resourceName, "compute_environment_name", rName),
+					resource.TestCheckResourceAttr(resourceName, "compute_environment_name_prefix", ""),
+					resource.TestCheckResourceAttr(resourceName, "compute_resources.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "compute_resources.0.allocation_strategy", "BEST_FIT_PROGRESSIVE"),
+					resource.TestCheckResourceAttr(resourceName, "compute_resources.0.bid_percentage", "0"),
+					resource.TestCheckResourceAttr(resourceName, "compute_resources.0.desired_vcpus", "0"),
+					resource.TestCheckResourceAttr(resourceName, "compute_resources.0.ec2_configuration.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "compute_resources.0.ec2_configuration.0.image_type", "ECS_AL2"),
+					resource.TestCheckResourceAttr(resourceName, "compute_resources.0.ec2_key_pair", ""),
+					resource.TestCheckResourceAttr(resourceName, "compute_resources.0.image_id", ""),
+					resource.TestCheckResourceAttrPair(resourceName, "compute_resources.0.instance_role", instanceProfileResourceName, "arn"),
+					resource.TestCheckResourceAttr(resourceName, "compute_resources.0.instance_type.#", "1"),
+					resource.TestCheckTypeSetElemAttr(resourceName, "compute_resources.0.instance_type.*", "optimal"),
+					resource.TestCheckResourceAttr(resourceName, "compute_resources.0.launch_template.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "compute_resources.0.max_vcpus", "16"),
+					resource.TestCheckResourceAttr(resourceName, "compute_resources.0.min_vcpus", "0"),
+					resource.TestCheckResourceAttr(resourceName, "compute_resources.0.security_group_ids.#", "1"),
+					resource.TestCheckTypeSetElemAttrPair(resourceName, "compute_resources.0.security_group_ids.*", securityGroupResourceName, "id"),
+					resource.TestCheckResourceAttrPair(resourceName, "compute_resources.0.spot_iam_fleet_role", spotFleetRoleResourceName, "arn"),
+					resource.TestCheckResourceAttr(resourceName, "compute_resources.0.subnets.#", "1"),
+					resource.TestCheckTypeSetElemAttrPair(resourceName, "compute_resources.0.subnets.*", subnetResourceName, "id"),
+					resource.TestCheckResourceAttr(resourceName, "compute_resources.0.tags.%", "0"),
+					resource.TestCheckResourceAttr(resourceName, "compute_resources.0.type", "EC2"),
+					resource.TestCheckResourceAttrSet(resourceName, "ecs_cluster_arn"),
+					resource.TestCheckResourceAttr(resourceName, "state", "ENABLED"),
+					resource.TestCheckResourceAttrSet(resourceName, "status"),
+					resource.TestCheckResourceAttrSet(resourceName, "status_reason"),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
+					resource.TestCheckResourceAttr(resourceName, "type", "MANAGED"),
+				),
+			},
+			{
+				Config: testAccComputeenvironmentConfig_ec2Update(rName, publicKey),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckComputeEnvironmentExists(ctx, resourceName, &ce),
+					acctest.CheckResourceAttrRegionalARN(resourceName, "arn", "batch", fmt.Sprintf("compute-environment/%s", rName)),
+					resource.TestCheckResourceAttr(resourceName, "compute_environment_name", rName),
+					resource.TestCheckResourceAttr(resourceName, "compute_environment_name_prefix", ""),
+					resource.TestCheckResourceAttr(resourceName, "compute_resources.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "compute_resources.0.allocation_strategy", "SPOT_CAPACITY_OPTIMIZED"),
+					resource.TestCheckResourceAttr(resourceName, "compute_resources.0.bid_percentage", "100"),
+					resource.TestCheckResourceAttr(resourceName, "compute_resources.0.desired_vcpus", "0"),
+					resource.TestCheckResourceAttr(resourceName, "compute_resources.0.ec2_configuration.#", "1"),
+					resource.TestCheckResourceAttrSet(resourceName, "compute_resources.0.ec2_configuration.0.image_id_override"),
+					resource.TestCheckResourceAttr(resourceName, "compute_resources.0.ec2_configuration.0.image_type", "ECS_AL2"),
+					resource.TestCheckResourceAttrPair(resourceName, "compute_resources.0.ec2_key_pair", ec2KeyPairResourceName, "id"),
+					resource.TestCheckResourceAttr(resourceName, "compute_resources.0.image_id", ""),
+					resource.TestCheckResourceAttrPair(resourceName, "compute_resources.0.instance_role", updatedInstanceProfileResourceName, "arn"),
+					resource.TestCheckResourceAttr(resourceName, "compute_resources.0.instance_type.#", "1"),
+					resource.TestCheckTypeSetElemAttr(resourceName, "compute_resources.0.instance_type.*", "c4.large"),
+					resource.TestCheckResourceAttr(resourceName, "compute_resources.0.launch_template.#", "1"),
+					resource.TestCheckResourceAttrPair(resourceName, "compute_resources.0.launch_template.0.launch_template_id", launchTemplateResourceName, "id"),
+					resource.TestCheckResourceAttr(resourceName, "compute_resources.0.launch_template.0.version", "$Latest"),
+					resource.TestCheckResourceAttr(resourceName, "compute_resources.0.max_vcpus", "16"),
+					resource.TestCheckResourceAttr(resourceName, "compute_resources.0.min_vcpus", "0"),
+					resource.TestCheckResourceAttr(resourceName, "compute_resources.0.security_group_ids.#", "1"),
+					resource.TestCheckTypeSetElemAttrPair(resourceName, "compute_resources.0.security_group_ids.*", updatedSecurityGroupResourceName, "id"),
+					resource.TestCheckResourceAttrPair(resourceName, "compute_resources.0.spot_iam_fleet_role", spotFleetRoleResourceName, "arn"),
+					resource.TestCheckResourceAttr(resourceName, "compute_resources.0.subnets.#", "1"),
+					resource.TestCheckTypeSetElemAttrPair(resourceName, "compute_resources.0.subnets.*", updatedSubnetResourceName, "id"),
+					resource.TestCheckResourceAttr(resourceName, "compute_resources.0.tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "compute_resources.0.tags.updated", "yes"),
+					resource.TestCheckResourceAttr(resourceName, "compute_resources.0.type", "SPOT"),
+					resource.TestCheckResourceAttrSet(resourceName, "ecs_cluster_arn"),
+					resource.TestCheckResourceAttr(resourceName, "state", "ENABLED"),
+					resource.TestCheckResourceAttrSet(resourceName, "status"),
+					resource.TestCheckResourceAttrSet(resourceName, "status_reason"),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
+					resource.TestCheckResourceAttr(resourceName, "type", "MANAGED"),
+				),
+			},
+			{
+				Config: testAccComputeenvironmentConfig_ec2PreUpdate(rName, publicKey),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckComputeEnvironmentExists(ctx, resourceName, &ce),
+					acctest.CheckResourceAttrRegionalARN(resourceName, "arn", "batch", fmt.Sprintf("compute-environment/%s", rName)),
+					resource.TestCheckResourceAttr(resourceName, "compute_environment_name", rName),
+					resource.TestCheckResourceAttr(resourceName, "compute_environment_name_prefix", ""),
+					resource.TestCheckResourceAttr(resourceName, "compute_resources.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "compute_resources.0.allocation_strategy", "BEST_FIT_PROGRESSIVE"),
+					resource.TestCheckResourceAttr(resourceName, "compute_resources.0.bid_percentage", "0"),
+					resource.TestCheckResourceAttr(resourceName, "compute_resources.0.desired_vcpus", "0"),
+					resource.TestCheckResourceAttr(resourceName, "compute_resources.0.ec2_configuration.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "compute_resources.0.ec2_configuration.0.image_type", "ECS_AL2"),
+					resource.TestCheckResourceAttr(resourceName, "compute_resources.0.ec2_key_pair", ""),
+					resource.TestCheckResourceAttr(resourceName, "compute_resources.0.image_id", ""),
+					resource.TestCheckResourceAttrPair(resourceName, "compute_resources.0.instance_role", instanceProfileResourceName, "arn"),
+					resource.TestCheckResourceAttr(resourceName, "compute_resources.0.instance_type.#", "1"),
+					resource.TestCheckTypeSetElemAttr(resourceName, "compute_resources.0.instance_type.*", "optimal"),
+					resource.TestCheckResourceAttr(resourceName, "compute_resources.0.launch_template.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "compute_resources.0.max_vcpus", "16"),
+					resource.TestCheckResourceAttr(resourceName, "compute_resources.0.min_vcpus", "0"),
+					resource.TestCheckResourceAttr(resourceName, "compute_resources.0.security_group_ids.#", "1"),
+					resource.TestCheckTypeSetElemAttrPair(resourceName, "compute_resources.0.security_group_ids.*", securityGroupResourceName, "id"),
+					resource.TestCheckResourceAttrPair(resourceName, "compute_resources.0.spot_iam_fleet_role", spotFleetRoleResourceName, "arn"),
+					resource.TestCheckResourceAttr(resourceName, "compute_resources.0.subnets.#", "1"),
+					resource.TestCheckTypeSetElemAttrPair(resourceName, "compute_resources.0.subnets.*", subnetResourceName, "id"),
+					resource.TestCheckResourceAttr(resourceName, "compute_resources.0.tags.%", "0"),
+					resource.TestCheckResourceAttr(resourceName, "compute_resources.0.type", "EC2"),
+					resource.TestCheckResourceAttrSet(resourceName, "ecs_cluster_arn"),
+					resource.TestCheckResourceAttr(resourceName, "state", "ENABLED"),
+					resource.TestCheckResourceAttrSet(resourceName, "status"),
+					resource.TestCheckResourceAttrSet(resourceName, "status_reason"),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
+					resource.TestCheckResourceAttr(resourceName, "type", "MANAGED"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
 			},
 		},
 	})
 }
 
-func TestAccBatchComputeEnvironment_createSpotWithoutIAMFleetRole(t *testing.T) {
+// Test plan time errors...
+
+func TestAccBatchComputeEnvironment_createEC2WithoutComputeResources(t *testing.T) {
 	ctx := acctest.Context(t)
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
@@ -1425,8 +1758,8 @@ func TestAccBatchComputeEnvironment_createSpotWithoutIAMFleetRole(t *testing.T)
 		CheckDestroy:             testAccCheckComputeEnvironmentDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config:      testAccComputeEnvironmentConfig_spotNoIAMFleetRole(rName),
-				ExpectError: regexp.MustCompile(`ComputeResources.spotIamFleetRole cannot not be null or empty`),
+				Config:      testAccComputeEnvironmentConfig_ec2NoResources(rName),
+				ExpectError: regexache.MustCompile(`computeResources must be provided for a MANAGED compute environment`),
 			},
 		},
 	})
@@ -1470,13 +1803,13 @@ func testAccCheckComputeEnvironmentExists(ctx context.Context, n string, v *batc
 
 		conn := acctest.Provider.Meta().(*conns.AWSClient).BatchConn(ctx)
 
-		computeEnvironment, err := tfbatch.FindComputeEnvironmentDetailByName(ctx, conn, rs.Primary.ID)
+		output, err := tfbatch.FindComputeEnvironmentDetailByName(ctx, conn, rs.Primary.ID)
 
 		if err != nil {
 			return err
 		}
 
-		*v = *computeEnvironment
+		*v = *output
 
 		return nil
 	}
@@ -2316,34 +2649,6 @@ resource "aws_batch_compute_environment" "test" {
 `, rName))
 }
 
-func testAccComputeEnvironmentConfig_spotNoIAMFleetRole(rName string) string {
-	return acctest.ConfigCompose(testAccComputeEnvironmentConfig_base(rName), fmt.Sprintf(`
-resource "aws_batch_compute_environment" "test" {
-  compute_environment_name = %[1]q
-
-  compute_resources {
-    instance_role = aws_iam_instance_profile.ecs_instance.arn
-    instance_type = [
-      "c4.large",
-    ]
-    max_vcpus = 16
-    min_vcpus = 0
-    security_group_ids = [
-      aws_security_group.test.id
-    ]
-    subnets = [
-      aws_subnet.test.id
-    ]
-    type = "SPOT"
-  }
-
-  service_role = aws_iam_role.batch_service.arn
-  type         = "MANAGED"
-  depends_on   = [aws_iam_role_policy_attachment.batch_service]
-}
-`, rName))
-}
-
 func testAccComputeEnvironmentConfig_launchTemplate(rName string) string {
 	return acctest.ConfigCompose(testAccComputeEnvironmentConfig_base(rName), fmt.Sprintf(`
 resource "aws_launch_template" "test" {
@@ -2493,3 +2798,181 @@ resource "aws_batch_compute_environment" "test" {
 }
 `, rName))
 }
+
+func testAccComputeEnvironmentConfig_ec2ConfigurationPlacementGroup(rName string) string {
+	return acctest.ConfigCompose(testAccComputeEnvironmentConfig_base(rName), acctest.ConfigLatestAmazonLinuxHVMEBSAMI(), fmt.Sprintf(`
+resource "aws_placement_group" "test" {
+  name     = %[1]q
+  strategy = "cluster"
+}
+
+resource "aws_batch_compute_environment" "test" {
+  compute_environment_name = %[1]q
+
+  compute_resources {
+    instance_role = aws_iam_instance_profile.ecs_instance.arn
+    instance_type = ["optimal"]
+
+    ec2_configuration {
+      image_id_override = data.aws_ami.amzn-ami-minimal-hvm-ebs.id
+      image_type        = "ECS_AL2"
+    }
+
+    ec2_configuration {
+      image_id_override = data.aws_ami.amzn-ami-minimal-hvm-ebs.id
+      image_type        = "ECS_AL2_NVIDIA"
+    }
+
+    max_vcpus = 16
+    min_vcpus = 0
+
+    placement_group = aws_placement_group.test.name
+
+    security_group_ids = [
+      aws_security_group.test.id
+    ]
+    spot_iam_fleet_role = aws_iam_role.ec2_spot_fleet.arn
+    subnets = [
+      aws_subnet.test.id
+    ]
+    type = "SPOT"
+  }
+
+  service_role = aws_iam_role.batch_service.arn
+  type         = "MANAGED"
+  depends_on   = [aws_iam_role_policy_attachment.batch_service]
+}
+`, rName))
+}
+
+func testAccComputeEnvironmentConfig_baseForUpdates(rName string, publicKey string) string {
+	return fmt.Sprintf(`
+resource "aws_iam_role" "ecs_instance_2" {
+  name = "%[1]s_ecs_instance_2"
+
+  assume_role_policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [{
+    "Action": "sts:AssumeRole",
+    "Effect": "Allow",
+    "Principal": {
+      "Service": "ec2.${data.aws_partition.current.dns_suffix}"
+    }
+  }]
+}
+EOF
+}
+
+resource "aws_iam_role_policy_attachment" "ecs_instance_2" {
+  role       = aws_iam_role.ecs_instance_2.name
+  policy_arn = "arn:${data.aws_partition.current.partition}:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role"
+}
+
+resource "aws_iam_instance_profile" "ecs_instance_2" {
+  name = "%[1]s_2"
+  role = aws_iam_role_policy_attachment.ecs_instance_2.role
+}
+
+resource "aws_security_group" "test_2" {
+  name   = "%[1]s_2"
+  vpc_id = aws_vpc.test.id
+
+  tags = {
+    Name = "%[1]s_2"
+  }
+}
+
+resource "aws_subnet" "test_2" {
+  vpc_id     = aws_vpc.test.id
+  cidr_block = "10.1.2.0/24"
+
+  tags = {
+    Name = "%[1]s_2"
+  }
+}
+
+resource "aws_key_pair" "test" {
+  key_name   = %[1]q
+  public_key = %[2]q
+}
+
+resource "aws_launch_template" "test" {
+  name = %[1]q
+}
+`, rName, publicKey)
+}
+
+func testAccComputeenvironmentConfig_ec2PreUpdate(rName string, publicKey string) string {
+	return acctest.ConfigCompose(
+		testAccComputeEnvironmentConfig_base(rName),
+		testAccComputeEnvironmentConfig_baseForUpdates(rName, publicKey),
+		fmt.Sprintf(`
+resource "aws_batch_compute_environment" "test" {
+  compute_environment_name = %[1]q
+
+  compute_resources {
+    allocation_strategy = "BEST_FIT_PROGRESSIVE"
+    instance_role       = aws_iam_instance_profile.ecs_instance.arn
+    instance_type = [
+      "optimal",
+    ]
+    max_vcpus = 16
+    security_group_ids = [
+      aws_security_group.test.id
+    ]
+    spot_iam_fleet_role = aws_iam_role.ec2_spot_fleet.arn
+    subnets = [
+      aws_subnet.test.id
+    ]
+    type = "EC2"
+  }
+
+  type = "MANAGED"
+}
+`, rName))
+}
+
+func testAccComputeenvironmentConfig_ec2Update(rName string, publicKey string) string {
+	return acctest.ConfigCompose(
+		testAccComputeEnvironmentConfig_base(rName),
+		testAccComputeEnvironmentConfig_baseForUpdates(rName, publicKey),
+		acctest.ConfigLatestAmazonLinuxHVMEBSAMI(),
+		fmt.Sprintf(`
+resource "aws_batch_compute_environment" "test" {
+  compute_environment_name = %[1]q
+
+  compute_resources {
+    allocation_strategy = "SPOT_CAPACITY_OPTIMIZED"
+    bid_percentage      = 100
+    ec2_key_pair        = aws_key_pair.test.id
+    instance_role       = aws_iam_instance_profile.ecs_instance_2.arn
+    ec2_configuration {
+      image_id_override = data.aws_ami.amzn-ami-minimal-hvm-ebs.id
+      image_type        = "ECS_AL2"
+    }
+    launch_template {
+      launch_template_id = aws_launch_template.test.id
+      version            = "$Latest"
+    }
+    instance_type = [
+      "c4.large",
+    ]
+    max_vcpus = 16
+    security_group_ids = [
+      aws_security_group.test_2.id
+    ]
+    spot_iam_fleet_role = aws_iam_role.ec2_spot_fleet.arn
+    subnets = [
+      aws_subnet.test_2.id
+    ]
+    type = "SPOT"
+    tags = {
+      updated = "yes"
+    }
+  }
+
+  type = "MANAGED"
+}
+`, rName))
+}
diff --git a/internal/service/batch/container_properties.go b/internal/service/batch/container_properties.go
index 98e0eb83b29..49c355a8aba 100644
--- a/internal/service/batch/container_properties.go
+++ b/internal/service/batch/container_properties.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package batch
 
 import (
diff --git a/internal/service/batch/container_properties_test.go b/internal/service/batch/container_properties_test.go
index 556f5d4209d..4038a34e081 100644
--- a/internal/service/batch/container_properties_test.go
+++ b/internal/service/batch/container_properties_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package batch_test
 
 import (
diff --git a/internal/service/batch/exports_test.go b/internal/service/batch/exports_test.go
new file mode 100644
index 00000000000..07d427f1246
--- /dev/null
+++ b/internal/service/batch/exports_test.go
@@ -0,0 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package batch
+
+// Exports for use in tests only.
+var (
+	ResourceJobQueue = newResourceJobQueue
+
+	ExpandEC2ConfigurationsUpdate           = expandEC2ConfigurationsUpdate
+	ExpandLaunchTemplateSpecificationUpdate = expandLaunchTemplateSpecificationUpdate
+	FindComputeEnvironmentDetailByName      = findComputeEnvironmentDetailByName
+	FindJobQueueByName                      = findJobQueueByName
+)
diff --git a/internal/service/batch/generate.go b/internal/service/batch/generate.go
index e7bd484c3ec..0d04a2ef789 100644
--- a/internal/service/batch/generate.go
+++ b/internal/service/batch/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTags -ServiceTagsMap -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/batch/job_definition.go b/internal/service/batch/job_definition.go
index 55ef3e2545b..fbd4075f28b 100644
--- a/internal/service/batch/job_definition.go
+++ b/internal/service/batch/job_definition.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package batch
 
 import (
@@ -5,9 +8,9 @@ import (
 	"encoding/json"
 	"fmt"
 	"log"
-	"regexp"
 	"strings"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/private/protocol/json/jsonutil"
 	"github.com/aws/aws-sdk-go/service/batch"
@@ -122,7 +125,7 @@ func ResourceJobDefinition() *schema.Resource {
 										ForceNew: true,
 										ValidateFunc: validation.All(
 											validation.StringLenBetween(1, 512),
-											validation.StringMatch(regexp.MustCompile(`^[0-9]*\*?$`), "must contain only numbers, and can optionally end with an asterisk"),
+											validation.StringMatch(regexache.MustCompile(`^[0-9]*\*?$`), "must contain only numbers, and can optionally end with an asterisk"),
 										),
 									},
 									"on_reason": {
@@ -131,7 +134,7 @@ func ResourceJobDefinition() *schema.Resource {
 										ForceNew: true,
 										ValidateFunc: validation.All(
 											validation.StringLenBetween(1, 512),
-											validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9\.:\s]*\*?$`), "must contain letters, numbers, periods, colons, and white space, and can optionally end with an asterisk"),
+											validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z.:\s]*\*?$`), "must contain letters, numbers, periods, colons, and white space, and can optionally end with an asterisk"),
 										),
 									},
 									"on_status_reason": {
@@ -140,7 +143,7 @@ func ResourceJobDefinition() *schema.Resource {
 										ForceNew: true,
 										ValidateFunc: validation.All(
 											validation.StringLenBetween(1, 512),
-											validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9\.:\s]*\*?$`), "must contain letters, numbers, periods, colons, and white space, and can optionally end with an asterisk"),
+											validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z.:\s]*\*?$`), "must contain letters, numbers, periods, colons, and white space, and can optionally end with an asterisk"),
 										),
 									},
 								},
diff --git a/internal/service/batch/job_definition_test.go b/internal/service/batch/job_definition_test.go
index 6c7571d3b38..d3736b62674 100644
--- a/internal/service/batch/job_definition_test.go
+++ b/internal/service/batch/job_definition_test.go
@@ -1,13 +1,16 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package batch_test
 
 import (
 	"context"
 	"fmt"
 	"reflect"
-	"regexp"
 	"strings"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/batch"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -35,7 +38,7 @@ func TestAccBatchJobDefinition_basic(t *testing.T) {
 				Config: testAccJobDefinitionConfig_name(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckJobDefinitionExists(ctx, resourceName, &jd),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "batch", regexp.MustCompile(fmt.Sprintf(`job-definition/%s:\d+`, rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "batch", regexache.MustCompile(fmt.Sprintf(`job-definition/%s:\d+`, rName))),
 					acctest.CheckResourceAttrEquivalentJSON(resourceName, "container_properties", `{
 						"command": ["echo", "test"],
 						"image": "busybox",
@@ -109,7 +112,7 @@ func TestAccBatchJobDefinition_PlatformCapabilities_ec2(t *testing.T) {
 				Config: testAccJobDefinitionConfig_capabilitiesEC2(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckJobDefinitionExists(ctx, resourceName, &jd),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "batch", regexp.MustCompile(fmt.Sprintf(`job-definition/%s:\d+`, rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "batch", regexache.MustCompile(fmt.Sprintf(`job-definition/%s:\d+`, rName))),
 					acctest.CheckResourceAttrEquivalentJSON(resourceName, "container_properties", `{
 						"command": ["echo", "test"],
 						"image": "busybox",
@@ -159,7 +162,7 @@ func TestAccBatchJobDefinition_PlatformCapabilitiesFargate_containerPropertiesDe
 				Config: testAccJobDefinitionConfig_capabilitiesFargateContainerPropertiesDefaults(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckJobDefinitionExists(ctx, resourceName, &jd),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "batch", regexp.MustCompile(fmt.Sprintf(`job-definition/%s:\d+`, rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "batch", regexache.MustCompile(fmt.Sprintf(`job-definition/%s:\d+`, rName))),
 					acctest.CheckResourceAttrJMES(resourceName, "container_properties", "length(command)", "0"),
 					acctest.CheckResourceAttrJMESPair(resourceName, "container_properties", "executionRoleArn", "aws_iam_role.ecs_task_execution_role", "arn"),
 					acctest.CheckResourceAttrJMES(resourceName, "container_properties", "fargatePlatformConfiguration.platformVersion", "LATEST"),
@@ -203,7 +206,7 @@ func TestAccBatchJobDefinition_PlatformCapabilities_fargate(t *testing.T) {
 				Config: testAccJobDefinitionConfig_capabilitiesFargate(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckJobDefinitionExists(ctx, resourceName, &jd),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "batch", regexp.MustCompile(fmt.Sprintf(`job-definition/%s:\d+`, rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "batch", regexache.MustCompile(fmt.Sprintf(`job-definition/%s:\d+`, rName))),
 					acctest.CheckResourceAttrJMESPair(resourceName, "container_properties", "executionRoleArn", "aws_iam_role.ecs_task_execution_role", "arn"),
 					acctest.CheckResourceAttrJMES(resourceName, "container_properties", "fargatePlatformConfiguration.platformVersion", "LATEST"),
 					acctest.CheckResourceAttrJMES(resourceName, "container_properties", "networkConfiguration.assignPublicIp", "DISABLED"),
@@ -395,7 +398,7 @@ func TestAccBatchJobDefinition_propagateTags(t *testing.T) {
 				Config: testAccJobDefinitionConfig_propagateTags(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckJobDefinitionExists(ctx, resourceName, &jd),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "batch", regexp.MustCompile(fmt.Sprintf(`job-definition/%s:\d+`, rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "batch", regexache.MustCompile(fmt.Sprintf(`job-definition/%s:\d+`, rName))),
 					acctest.CheckResourceAttrEquivalentJSON(resourceName, "container_properties", `{
 						"command": ["echo", "test"],
 						"image": "busybox",
diff --git a/internal/service/batch/job_queue.go b/internal/service/batch/job_queue.go
index fc99b148261..7346ce68774 100644
--- a/internal/service/batch/job_queue.go
+++ b/internal/service/batch/job_queue.go
@@ -1,266 +1,418 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package batch
 
 import (
 	"context"
+	"errors"
 	"fmt"
-	"log"
 	"sort"
 	"time"
 
-	"github.com/aws/aws-sdk-go/aws"
+	"github.com/YakDriver/regexache"
+	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go/service/batch"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-framework-timeouts/resource/timeouts"
+	"github.com/hashicorp/terraform-plugin-framework-validators/stringvalidator"
+	"github.com/hashicorp/terraform-plugin-framework/diag"
+	"github.com/hashicorp/terraform-plugin-framework/path"
+	"github.com/hashicorp/terraform-plugin-framework/resource"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema/planmodifier"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema/stringplanmodifier"
+	"github.com/hashicorp/terraform-plugin-framework/schema/validator"
+	"github.com/hashicorp/terraform-plugin-framework/types"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
-	"github.com/hashicorp/terraform-provider-aws/internal/conns"
-	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
+	"github.com/hashicorp/terraform-provider-aws/internal/create"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs/fwdiag"
+	"github.com/hashicorp/terraform-provider-aws/internal/framework"
+	"github.com/hashicorp/terraform-provider-aws/internal/framework/flex"
+	fwtypes "github.com/hashicorp/terraform-provider-aws/internal/framework/types"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
-	"github.com/hashicorp/terraform-provider-aws/internal/verify"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
-// @SDKResource("aws_batch_job_queue", name="Job Queue")
+// @FrameworkResource(name="Job Queue")
 // @Tags(identifierAttribute="arn")
-func ResourceJobQueue() *schema.Resource {
-	return &schema.Resource{
-		CreateWithoutTimeout: resourceJobQueueCreate,
-		ReadWithoutTimeout:   resourceJobQueueRead,
-		UpdateWithoutTimeout: resourceJobQueueUpdate,
-		DeleteWithoutTimeout: resourceJobQueueDelete,
-
-		Importer: &schema.ResourceImporter{
-			StateContext: func(ctx context.Context, d *schema.ResourceData, meta interface{}) ([]*schema.ResourceData, error) {
-				d.Set("arn", d.Id())
-				return []*schema.ResourceData{d}, nil
-			},
-		},
+func newResourceJobQueue(_ context.Context) (resource.ResourceWithConfigure, error) {
+	r := resourceJobQueue{}
+	r.SetMigratedFromPluginSDK(true)
 
-		Schema: map[string]*schema.Schema{
-			"compute_environments": {
-				Type:     schema.TypeList,
-				Required: true,
-				Elem:     &schema.Schema{Type: schema.TypeString},
-			},
-			"name": {
-				Type:         schema.TypeString,
-				Required:     true,
-				ForceNew:     true,
-				ValidateFunc: validName,
+	r.SetDefaultCreateTimeout(10 * time.Minute)
+	r.SetDefaultUpdateTimeout(10 * time.Minute)
+	r.SetDefaultDeleteTimeout(10 * time.Minute)
+
+	return &r, nil
+}
+
+const (
+	ResNameJobQueue = "Job Queue"
+)
+
+type resourceJobQueue struct {
+	framework.ResourceWithConfigure
+	framework.WithTimeouts
+}
+
+func (r *resourceJobQueue) Metadata(_ context.Context, request resource.MetadataRequest, response *resource.MetadataResponse) {
+	response.TypeName = "aws_batch_job_queue"
+}
+
+func (r *resourceJobQueue) Schema(ctx context.Context, request resource.SchemaRequest, response *resource.SchemaResponse) {
+	s := schema.Schema{
+		Version: 1,
+		Attributes: map[string]schema.Attribute{
+			"arn": framework.ARNAttributeComputedOnly(),
+			"compute_environments": schema.ListAttribute{
+				ElementType: fwtypes.ARNType,
+				Required:    true,
 			},
-			"priority": {
-				Type:     schema.TypeInt,
+			"id": framework.IDAttribute(),
+			"name": schema.StringAttribute{
 				Required: true,
+				PlanModifiers: []planmodifier.String{
+					stringplanmodifier.RequiresReplace(),
+				},
+				Validators: []validator.String{
+					stringvalidator.RegexMatches(regexache.MustCompile(`^[0-9A-Za-z]{1}[0-9A-Za-z_-]{0,127}$`),
+						"must be up to 128 letters (uppercase and lowercase), numbers, underscores and dashes, and must start with an alphanumeric"),
+				},
 			},
-			"scheduling_policy_arn": {
-				Type:         schema.TypeString,
-				Optional:     true,
-				ValidateFunc: verify.ValidARN,
+			"priority": schema.Int64Attribute{
+				Required: true,
 			},
-			"state": {
-				Type:         schema.TypeString,
-				Required:     true,
-				ValidateFunc: validation.StringInSlice([]string{batch.JQStateDisabled, batch.JQStateEnabled}, true),
+			"scheduling_policy_arn": schema.StringAttribute{
+				CustomType: fwtypes.ARNType,
+				Optional:   true,
+				PlanModifiers: []planmodifier.String{
+					stringplanmodifier.UseStateForUnknown(),
+				},
 			},
-			names.AttrTags:    tftags.TagsSchema(),
-			names.AttrTagsAll: tftags.TagsSchemaComputed(),
-			"arn": {
-				Type:     schema.TypeString,
-				Computed: true,
+			"state": schema.StringAttribute{
+				Required: true,
+				Validators: []validator.String{
+					stringvalidator.OneOfCaseInsensitive(batch.JQState_Values()...),
+				},
 			},
+			names.AttrTags:    tftags.TagsAttribute(),
+			names.AttrTagsAll: tftags.TagsAttributeComputedOnly(),
 		},
+	}
 
-		CustomizeDiff: verify.SetTagsDiff,
+	s.Blocks = map[string]schema.Block{
+		"timeouts": timeouts.Block(ctx, timeouts.Opts{
+			Create: true,
+			Update: true,
+			Delete: true,
+		}),
 	}
+
+	response.Schema = s
 }
 
-func resourceJobQueueCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).BatchConn(ctx)
+func (r *resourceJobQueue) Create(ctx context.Context, request resource.CreateRequest, response *resource.CreateResponse) {
+	conn := r.Meta().BatchConn(ctx)
+	var data resourceJobQueueData
+
+	response.Diagnostics.Append(request.Plan.Get(ctx, &data)...)
+
+	if response.Diagnostics.HasError() {
+		return
+	}
+
+	ceo := flex.ExpandFrameworkStringValueList(ctx, data.ComputeEnvironments)
 
 	input := batch.CreateJobQueueInput{
-		ComputeEnvironmentOrder: createComputeEnvironmentOrder(d.Get("compute_environments").([]interface{})),
-		JobQueueName:            aws.String(d.Get("name").(string)),
-		Priority:                aws.Int64(int64(d.Get("priority").(int))),
-		State:                   aws.String(d.Get("state").(string)),
+		ComputeEnvironmentOrder: expandComputeEnvironmentOrder(ceo),
+		JobQueueName:            flex.StringFromFramework(ctx, data.Name),
+		Priority:                flex.Int64FromFramework(ctx, data.Priority),
+		State:                   flex.StringFromFramework(ctx, data.State),
 		Tags:                    getTagsIn(ctx),
 	}
 
-	if v, ok := d.GetOk("scheduling_policy_arn"); ok {
-		input.SchedulingPolicyArn = aws.String(v.(string))
+	if !data.SchedulingPolicyARN.IsNull() {
+		input.SchedulingPolicyArn = flex.StringFromFramework(ctx, data.SchedulingPolicyARN)
 	}
 
-	name := d.Get("name").(string)
-	out, err := conn.CreateJobQueueWithContext(ctx, &input)
+	output, err := conn.CreateJobQueueWithContext(ctx, &input)
+
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "%s %q", err, name)
+		response.Diagnostics.AddError(
+			create.ProblemStandardMessage(names.Batch, create.ErrActionCreating, ResNameJobQueue, data.Name.ValueString(), nil),
+			err.Error(),
+		)
+		return
 	}
 
-	stateConf := &retry.StateChangeConf{
-		Pending:    []string{batch.JQStatusCreating, batch.JQStatusUpdating},
-		Target:     []string{batch.JQStatusValid},
-		Refresh:    jobQueueRefreshStatusFunc(ctx, conn, name),
-		Timeout:    10 * time.Minute,
-		Delay:      10 * time.Second,
-		MinTimeout: 3 * time.Second,
-	}
+	state := data
+	state.ID = flex.StringToFramework(ctx, output.JobQueueArn)
+
+	createTimeout := r.CreateTimeout(ctx, data.Timeouts)
+	out, err := waitJobQueueCreated(ctx, conn, data.Name.ValueString(), createTimeout)
 
-	_, err = stateConf.WaitForStateContext(ctx)
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "waiting for JobQueue state to be \"VALID\": %s", err)
+		response.Diagnostics.AddError(
+			create.ProblemStandardMessage(names.Batch, create.ErrActionWaitingForCreation, ResNameJobQueue, data.Name.ValueString(), nil),
+			err.Error(),
+		)
+		return
 	}
 
-	arn := aws.StringValue(out.JobQueueArn)
-	log.Printf("[DEBUG] JobQueue created: %s", arn)
-	d.SetId(arn)
-
-	return append(diags, resourceJobQueueRead(ctx, d, meta)...)
+	response.Diagnostics.Append(state.refreshFromOutput(ctx, out)...)
+	response.Diagnostics.Append(response.State.Set(ctx, &state)...)
 }
 
-func resourceJobQueueRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).BatchConn(ctx)
+func (r *resourceJobQueue) Read(ctx context.Context, request resource.ReadRequest, response *resource.ReadResponse) {
+	conn := r.Meta().BatchConn(ctx)
+	var data resourceJobQueueData
+
+	response.Diagnostics.Append(request.State.Get(ctx, &data)...)
+
+	if response.Diagnostics.HasError() {
+		return
+	}
+
+	out, err := findJobQueueByName(ctx, conn, data.ID.ValueString())
 
-	jq, err := GetJobQueue(ctx, conn, d.Id())
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "reading Batch Job Queue (%s): %s", d.Get("name").(string), err)
+		response.Diagnostics.AddError(
+			create.ProblemStandardMessage(names.Batch, create.ErrActionUpdating, ResNameJobQueue, data.Name.ValueString(), err),
+			err.Error(),
+		)
+		return
 	}
-	if jq == nil {
-		log.Printf("[WARN] Batch Job Queue (%s) not found, removing from state", d.Id())
-		d.SetId("")
-		return diags
+
+	if out == nil {
+		response.Diagnostics.Append(fwdiag.NewResourceNotFoundWarningDiagnostic(errors.New("not found")))
+		response.State.RemoveResource(ctx)
+		return
 	}
 
-	d.Set("arn", jq.JobQueueArn)
+	response.Diagnostics.Append(data.refreshFromOutput(ctx, out)...)
+	response.Diagnostics.Append(response.State.Set(ctx, &data)...)
+}
 
-	computeEnvironments := make([]string, 0, len(jq.ComputeEnvironmentOrder))
+func (r *resourceJobQueue) Update(ctx context.Context, request resource.UpdateRequest, response *resource.UpdateResponse) {
+	conn := r.Meta().BatchConn(ctx)
+	var plan, state resourceJobQueueData
 
-	sort.Slice(jq.ComputeEnvironmentOrder, func(i, j int) bool {
-		return aws.Int64Value(jq.ComputeEnvironmentOrder[i].Order) < aws.Int64Value(jq.ComputeEnvironmentOrder[j].Order)
-	})
+	response.Diagnostics.Append(request.State.Get(ctx, &state)...)
+	response.Diagnostics.Append(request.Plan.Get(ctx, &plan)...)
 
-	for _, computeEnvironmentOrder := range jq.ComputeEnvironmentOrder {
-		computeEnvironments = append(computeEnvironments, aws.StringValue(computeEnvironmentOrder.ComputeEnvironment))
+	if response.Diagnostics.HasError() {
+		return
 	}
 
-	if err := d.Set("compute_environments", computeEnvironments); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting compute_environments: %s", err)
+	var update bool
+	input := &batch.UpdateJobQueueInput{
+		JobQueue: flex.StringFromFramework(ctx, plan.Name),
 	}
 
-	d.Set("name", jq.JobQueueName)
-	d.Set("priority", jq.Priority)
-	d.Set("scheduling_policy_arn", jq.SchedulingPolicyArn)
-	d.Set("state", jq.State)
+	if !plan.ComputeEnvironments.Equal(state.ComputeEnvironments) {
+		ceo := flex.ExpandFrameworkStringValueList(ctx, plan.ComputeEnvironments)
+		input.ComputeEnvironmentOrder = expandComputeEnvironmentOrder(ceo)
 
-	setTagsOut(ctx, jq.Tags)
+		update = true
+	}
 
-	return diags
-}
+	if !plan.Priority.Equal(state.Priority) {
+		input.Priority = flex.Int64FromFramework(ctx, plan.Priority)
 
-func resourceJobQueueUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).BatchConn(ctx)
-
-	if d.HasChanges("compute_environments", "priority", "scheduling_policy_arn", "state") {
-		name := d.Get("name").(string)
-		updateInput := &batch.UpdateJobQueueInput{
-			ComputeEnvironmentOrder: createComputeEnvironmentOrder(d.Get("compute_environments").([]interface{})),
-			JobQueue:                aws.String(name),
-			Priority:                aws.Int64(int64(d.Get("priority").(int))),
-			State:                   aws.String(d.Get("state").(string)),
-		}
-		// After a job queue is created, you can replace but can't remove the fair share scheduling policy
-		// https://docs.aws.amazon.com/sdk-for-go/api/service/batch/#CreateJobQueueInput
-		if d.HasChange("scheduling_policy_arn") {
-			if v, ok := d.GetOk("scheduling_policy_arn"); ok {
-				updateInput.SchedulingPolicyArn = aws.String(v.(string))
-			} else {
-				return sdkdiag.AppendErrorf(diags, "Cannot remove the fair share scheduling policy")
-			}
+		update = true
+	}
+
+	if !plan.State.Equal(state.State) {
+		input.State = flex.StringFromFramework(ctx, plan.State)
+
+		update = true
+	}
+
+	if !state.SchedulingPolicyARN.IsNull() {
+		input.SchedulingPolicyArn = flex.StringFromFramework(ctx, state.SchedulingPolicyARN)
+		update = true
+	}
+
+	if !plan.SchedulingPolicyARN.Equal(state.SchedulingPolicyARN) {
+		if !plan.SchedulingPolicyARN.IsNull() || !plan.SchedulingPolicyARN.IsUnknown() {
+			input.SchedulingPolicyArn = flex.StringFromFramework(ctx, plan.SchedulingPolicyARN)
+
+			update = true
 		} else {
-			// if a queue is a FIFO queue, SchedulingPolicyArn should not be set. Error is "Only fairshare queue can have scheduling policy"
-			// hence, check for scheduling_policy_arn and set it in the inputs only if it exists already
-			if v, ok := d.GetOk("scheduling_policy_arn"); ok {
-				updateInput.SchedulingPolicyArn = aws.String(v.(string))
-			}
+			response.Diagnostics.AddError(
+				"cannot remove the fair share scheduling policy",
+				"cannot remove scheduling policy",
+			)
+			return
 		}
+	}
+
+	if update {
+		_, err := conn.UpdateJobQueueWithContext(ctx, input)
 
-		_, err := conn.UpdateJobQueueWithContext(ctx, updateInput)
 		if err != nil {
-			return sdkdiag.AppendErrorf(diags, "updating Batch Job Queue (%s): %s", d.Get("name").(string), err)
-		}
-		stateConf := &retry.StateChangeConf{
-			Pending:    []string{batch.JQStatusUpdating},
-			Target:     []string{batch.JQStatusValid},
-			Refresh:    jobQueueRefreshStatusFunc(ctx, conn, name),
-			Timeout:    10 * time.Minute,
-			Delay:      10 * time.Second,
-			MinTimeout: 3 * time.Second,
+			response.Diagnostics.AddError(
+				create.ProblemStandardMessage(names.Batch, create.ErrActionUpdating, ResNameJobQueue, plan.Name.ValueString(), nil),
+				err.Error(),
+			)
+			return
 		}
 
-		_, err = stateConf.WaitForStateContext(ctx)
+		updateTimeout := r.UpdateTimeout(ctx, plan.Timeouts)
+		out, err := waitJobQueueUpdated(ctx, conn, plan.ID.ValueString(), updateTimeout)
+
 		if err != nil {
-			return sdkdiag.AppendErrorf(diags, "updating Batch Job Queue (%s): waiting for completion: %s", d.Get("name").(string), err)
+			response.Diagnostics.AddError(
+				create.ProblemStandardMessage(names.Batch, create.ErrActionWaitingForCreation, ResNameJobQueue, plan.Name.ValueString(), nil),
+				err.Error(),
+			)
+			return
 		}
+
+		response.Diagnostics.Append(plan.refreshFromOutput(ctx, out)...)
 	}
 
-	return append(diags, resourceJobQueueRead(ctx, d, meta)...)
+	response.Diagnostics.Append(response.State.Set(ctx, &plan)...)
 }
 
-func resourceJobQueueDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).BatchConn(ctx)
-	name := d.Get("name").(string)
+func (r *resourceJobQueue) Delete(ctx context.Context, request resource.DeleteRequest, response *resource.DeleteResponse) {
+	conn := r.Meta().BatchConn(ctx)
+	var data resourceJobQueueData
+
+	response.Diagnostics.Append(request.State.Get(ctx, &data)...)
+
+	if response.Diagnostics.HasError() {
+		return
+	}
+
+	deleteTimeout := r.DeleteTimeout(ctx, data.Timeouts)
+	err := disableJobQueue(ctx, conn, data.ID.ValueString(), deleteTimeout)
 
-	log.Printf("[DEBUG] Disabling Batch Job Queue: %s", name)
-	err := DisableJobQueue(ctx, name, conn)
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "disabling Batch Job Queue (%s): %s", name, err)
+		response.Diagnostics.AddError(
+			create.ProblemStandardMessage(names.Batch, create.ErrActionDeleting, ResNameJobQueue, data.Name.ValueString(), nil),
+			err.Error(),
+		)
+		return
 	}
 
-	log.Printf("[DEBUG] Deleting Batch Job Queue: %s", name)
-	err = DeleteJobQueue(ctx, name, conn)
+	_, err = conn.DeleteJobQueueWithContext(ctx, &batch.DeleteJobQueueInput{
+		JobQueue: flex.StringFromFramework(ctx, data.ID),
+	})
+
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "deleting Batch Job Queue (%s): %s", name, err)
+		response.Diagnostics.AddError(
+			create.ProblemStandardMessage(names.Batch, create.ErrActionDeleting, ResNameJobQueue, data.Name.ValueString(), nil),
+			err.Error(),
+		)
+		return
 	}
 
+	_, err = waitJobQueueDeleted(ctx, conn, data.ID.ValueString(), deleteTimeout)
+
+	if err != nil {
+		response.Diagnostics.AddError(
+			create.ProblemStandardMessage(names.Batch, create.ErrActionWaitingForDeletion, ResNameJobQueue, data.Name.ValueString(), nil),
+			err.Error(),
+		)
+		return
+	}
+}
+
+func (r *resourceJobQueue) ImportState(ctx context.Context, request resource.ImportStateRequest, response *resource.ImportStateResponse) {
+	resource.ImportStatePassthroughID(ctx, path.Root("id"), request, response)
+}
+
+func (r *resourceJobQueue) ModifyPlan(ctx context.Context, request resource.ModifyPlanRequest, response *resource.ModifyPlanResponse) {
+	r.SetTagsAll(ctx, request, response)
+}
+
+func (r *resourceJobQueue) UpgradeState(ctx context.Context) map[int64]resource.StateUpgrader {
+	schemaV0 := jobQueueSchema0(ctx)
+
+	return map[int64]resource.StateUpgrader{
+		0: {
+			PriorSchema:   &schemaV0,
+			StateUpgrader: upgradeJobQueueResourceStateV0toV1,
+		},
+	}
+}
+
+type resourceJobQueueData struct {
+	ARN                 types.String   `tfsdk:"arn"`
+	ComputeEnvironments types.List     `tfsdk:"compute_environments"`
+	ID                  types.String   `tfsdk:"id"`
+	Name                types.String   `tfsdk:"name"`
+	Priority            types.Int64    `tfsdk:"priority"`
+	SchedulingPolicyARN fwtypes.ARN    `tfsdk:"scheduling_policy_arn"`
+	State               types.String   `tfsdk:"state"`
+	Tags                types.Map      `tfsdk:"tags"`
+	TagsAll             types.Map      `tfsdk:"tags_all"`
+	Timeouts            timeouts.Value `tfsdk:"timeouts"`
+}
+
+func (r *resourceJobQueueData) refreshFromOutput(ctx context.Context, out *batch.JobQueueDetail) diag.Diagnostics {
+	var diags diag.Diagnostics
+
+	r.ARN = flex.StringToFrameworkLegacy(ctx, out.JobQueueArn)
+	r.Name = flex.StringToFramework(ctx, out.JobQueueName)
+	r.ComputeEnvironments = flex.FlattenFrameworkStringValueListLegacy(ctx, flattenComputeEnvironmentOrder(out.ComputeEnvironmentOrder))
+	r.Priority = flex.Int64ToFrameworkLegacy(ctx, out.Priority)
+	r.SchedulingPolicyARN = flex.StringToFrameworkARN(ctx, out.SchedulingPolicyArn, &diags)
+	r.State = flex.StringToFrameworkLegacy(ctx, out.State)
+
+	setTagsOut(ctx, out.Tags)
+
 	return diags
 }
 
-func createComputeEnvironmentOrder(order []interface{}) (envs []*batch.ComputeEnvironmentOrder) {
+func expandComputeEnvironmentOrder(order []string) (envs []*batch.ComputeEnvironmentOrder) {
 	for i, env := range order {
 		envs = append(envs, &batch.ComputeEnvironmentOrder{
 			Order:              aws.Int64(int64(i)),
-			ComputeEnvironment: aws.String(env.(string)),
+			ComputeEnvironment: aws.String(env),
 		})
 	}
 	return
 }
 
-func DeleteJobQueue(ctx context.Context, jobQueue string, conn *batch.Batch) error {
-	_, err := conn.DeleteJobQueueWithContext(ctx, &batch.DeleteJobQueueInput{
-		JobQueue: aws.String(jobQueue),
+func flattenComputeEnvironmentOrder(apiObject []*batch.ComputeEnvironmentOrder) []string {
+	sort.Slice(apiObject, func(i, j int) bool {
+		return aws.ToInt64(apiObject[i].Order) < aws.ToInt64(apiObject[j].Order)
 	})
-	if err != nil {
-		return err
+
+	computeEnvironments := make([]string, 0, len(apiObject))
+	for _, v := range apiObject {
+		computeEnvironments = append(computeEnvironments, aws.ToString(v.ComputeEnvironment))
 	}
 
-	stateChangeConf := &retry.StateChangeConf{
-		Pending:    []string{batch.JQStateDisabled, batch.JQStatusDeleting},
-		Target:     []string{batch.JQStatusDeleted},
-		Refresh:    jobQueueRefreshStatusFunc(ctx, conn, jobQueue),
-		Timeout:    10 * time.Minute,
-		Delay:      10 * time.Second,
-		MinTimeout: 3 * time.Second,
+	return computeEnvironments
+}
+
+func findJobQueueByName(ctx context.Context, conn *batch.Batch, sn string) (*batch.JobQueueDetail, error) {
+	describeOpts := &batch.DescribeJobQueuesInput{
+		JobQueues: []*string{aws.String(sn)},
+	}
+	resp, err := conn.DescribeJobQueuesWithContext(ctx, describeOpts)
+	if err != nil {
+		return nil, err
 	}
 
-	_, err = stateChangeConf.WaitForStateContext(ctx)
-	return err
+	numJobQueues := len(resp.JobQueues)
+	switch {
+	case numJobQueues == 0:
+		return nil, nil
+	case numJobQueues == 1:
+		return resp.JobQueues[0], nil
+	case numJobQueues > 1:
+		return nil, fmt.Errorf("Multiple Job Queues with name %s", sn)
+	}
+	return nil, nil
 }
 
-func DisableJobQueue(ctx context.Context, jobQueue string, conn *batch.Batch) error {
+func disableJobQueue(ctx context.Context, conn *batch.Batch, id string, timeout time.Duration) error {
 	_, err := conn.UpdateJobQueueWithContext(ctx, &batch.UpdateJobQueueInput{
-		JobQueue: aws.String(jobQueue),
+		JobQueue: aws.String(id),
 		State:    aws.String(batch.JQStateDisabled),
 	})
 	if err != nil {
@@ -270,8 +422,8 @@ func DisableJobQueue(ctx context.Context, jobQueue string, conn *batch.Batch) er
 	stateChangeConf := &retry.StateChangeConf{
 		Pending:    []string{batch.JQStatusUpdating},
 		Target:     []string{batch.JQStatusValid},
-		Refresh:    jobQueueRefreshStatusFunc(ctx, conn, jobQueue),
-		Timeout:    10 * time.Minute,
+		Refresh:    jobQueueRefreshStatusFunc(ctx, conn, id),
+		Timeout:    timeout,
 		Delay:      10 * time.Second,
 		MinTimeout: 3 * time.Second,
 	}
@@ -279,36 +431,74 @@ func DisableJobQueue(ctx context.Context, jobQueue string, conn *batch.Batch) er
 	return err
 }
 
-func GetJobQueue(ctx context.Context, conn *batch.Batch, sn string) (*batch.JobQueueDetail, error) {
-	describeOpts := &batch.DescribeJobQueuesInput{
-		JobQueues: []*string{aws.String(sn)},
+func waitJobQueueCreated(ctx context.Context, conn *batch.Batch, id string, timeout time.Duration) (*batch.JobQueueDetail, error) {
+	stateConf := &retry.StateChangeConf{
+		Pending:    []string{batch.JQStatusCreating, batch.JQStatusUpdating},
+		Target:     []string{batch.JQStatusValid},
+		Refresh:    jobQueueRefreshStatusFunc(ctx, conn, id),
+		Timeout:    timeout,
+		MinTimeout: 10 * time.Second,
+		Delay:      30 * time.Second,
 	}
-	resp, err := conn.DescribeJobQueuesWithContext(ctx, describeOpts)
-	if err != nil {
-		return nil, err
+
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+
+	if output, ok := outputRaw.(*batch.JobQueueDetail); ok {
+		return output, err
 	}
 
-	numJobQueues := len(resp.JobQueues)
-	switch {
-	case numJobQueues == 0:
-		return nil, nil
-	case numJobQueues == 1:
-		return resp.JobQueues[0], nil
-	case numJobQueues > 1:
-		return nil, fmt.Errorf("Multiple Job Queues with name %s", sn)
+	return nil, err
+}
+
+func waitJobQueueUpdated(ctx context.Context, conn *batch.Batch, id string, timeout time.Duration) (*batch.JobQueueDetail, error) {
+	stateConf := &retry.StateChangeConf{
+		Pending:    []string{batch.JQStatusUpdating},
+		Target:     []string{batch.JQStatusValid},
+		Refresh:    jobQueueRefreshStatusFunc(ctx, conn, id),
+		Timeout:    timeout,
+		MinTimeout: 10 * time.Second,
+		Delay:      30 * time.Second,
 	}
-	return nil, nil
+
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+
+	if output, ok := outputRaw.(*batch.JobQueueDetail); ok {
+		return output, err
+	}
+
+	return nil, err
+}
+
+func waitJobQueueDeleted(ctx context.Context, conn *batch.Batch, id string, timeout time.Duration) (*batch.JobQueueDetail, error) {
+	stateConf := &retry.StateChangeConf{
+		Pending:    []string{batch.JQStateDisabled, batch.JQStatusDeleting},
+		Target:     []string{batch.JQStatusDeleted},
+		Refresh:    jobQueueRefreshStatusFunc(ctx, conn, id),
+		Timeout:    timeout,
+		MinTimeout: 10 * time.Second,
+		Delay:      30 * time.Second,
+	}
+
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+
+	if output, ok := outputRaw.(*batch.JobQueueDetail); ok {
+		return output, err
+	}
+
+	return nil, err
 }
 
 func jobQueueRefreshStatusFunc(ctx context.Context, conn *batch.Batch, sn string) retry.StateRefreshFunc {
 	return func() (interface{}, string, error) {
-		ce, err := GetJobQueue(ctx, conn, sn)
+		ce, err := findJobQueueByName(ctx, conn, sn)
 		if err != nil {
-			return nil, "failed", err
+			return nil, "", err
 		}
+
 		if ce == nil {
 			return 42, batch.JQStatusDeleted, nil
 		}
+
 		return ce, *ce.Status, nil
 	}
 }
diff --git a/internal/service/batch/job_queue_data_source.go b/internal/service/batch/job_queue_data_source.go
index 8ed774866fd..3d2f1d3dfc6 100644
--- a/internal/service/batch/job_queue_data_source.go
+++ b/internal/service/batch/job_queue_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package batch
 
 import (
diff --git a/internal/service/batch/job_queue_data_source_test.go b/internal/service/batch/job_queue_data_source_test.go
index d8ed204dfed..f8089c048ef 100644
--- a/internal/service/batch/job_queue_data_source_test.go
+++ b/internal/service/batch/job_queue_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package batch_test
 
 import (
diff --git a/internal/service/batch/job_queue_schema.go b/internal/service/batch/job_queue_schema.go
new file mode 100644
index 00000000000..bd19814922c
--- /dev/null
+++ b/internal/service/batch/job_queue_schema.go
@@ -0,0 +1,111 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package batch
+
+import (
+	"context"
+
+	"github.com/YakDriver/regexache"
+	"github.com/aws/aws-sdk-go/service/batch"
+	"github.com/hashicorp/terraform-plugin-framework-timeouts/resource/timeouts"
+	"github.com/hashicorp/terraform-plugin-framework-validators/stringvalidator"
+	"github.com/hashicorp/terraform-plugin-framework/resource"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema/planmodifier"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema/stringplanmodifier"
+	"github.com/hashicorp/terraform-plugin-framework/schema/validator"
+	"github.com/hashicorp/terraform-plugin-framework/types"
+	"github.com/hashicorp/terraform-provider-aws/internal/framework"
+	fwtypes "github.com/hashicorp/terraform-provider-aws/internal/framework/types"
+	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
+	"github.com/hashicorp/terraform-provider-aws/names"
+)
+
+func jobQueueSchema0(ctx context.Context) schema.Schema {
+	return schema.Schema{
+		Version: 0,
+		Attributes: map[string]schema.Attribute{
+			"arn": framework.ARNAttributeComputedOnly(),
+			"compute_environments": schema.ListAttribute{
+				ElementType: types.StringType,
+				Required:    true,
+			},
+			"id": framework.IDAttribute(),
+			"name": schema.StringAttribute{
+				Required: true,
+				PlanModifiers: []planmodifier.String{
+					stringplanmodifier.RequiresReplace(),
+				},
+				Validators: []validator.String{
+					stringvalidator.RegexMatches(regexache.MustCompile(`^[0-9A-Za-z]{1}[0-9A-Za-z_-]{0,127}$`),
+						"must be up to 128 letters (uppercase and lowercase), numbers, underscores and dashes, and must start with an alphanumeric"),
+				},
+			},
+			"priority": schema.Int64Attribute{
+				Required: true,
+			},
+			"scheduling_policy_arn": schema.StringAttribute{
+				Optional: true,
+				PlanModifiers: []planmodifier.String{
+					stringplanmodifier.UseStateForUnknown(),
+				},
+			},
+			"state": schema.StringAttribute{
+				Required: true,
+				Validators: []validator.String{
+					stringvalidator.OneOfCaseInsensitive(batch.JQState_Values()...),
+				},
+			},
+			names.AttrTags:    tftags.TagsAttribute(),
+			names.AttrTagsAll: tftags.TagsAttributeComputedOnly(),
+		},
+		Blocks: map[string]schema.Block{
+			"timeouts": timeouts.Block(ctx, timeouts.Opts{
+				Create: true,
+				Update: true,
+				Delete: true,
+			}),
+		},
+	}
+}
+
+func upgradeJobQueueResourceStateV0toV1(ctx context.Context, req resource.UpgradeStateRequest, resp *resource.UpgradeStateResponse) {
+	type resourceJobQueueDataV0 struct {
+		ARN                 types.String   `tfsdk:"arn"`
+		ComputeEnvironments types.List     `tfsdk:"compute_environments"`
+		ID                  types.String   `tfsdk:"id"`
+		Name                types.String   `tfsdk:"name"`
+		Priority            types.Int64    `tfsdk:"priority"`
+		SchedulingPolicyARN types.String   `tfsdk:"scheduling_policy_arn"`
+		State               types.String   `tfsdk:"state"`
+		Tags                types.Map      `tfsdk:"tags"`
+		TagsAll             types.Map      `tfsdk:"tags_all"`
+		Timeouts            timeouts.Value `tfsdk:"timeouts"`
+	}
+
+	var jobQueueDataV0 resourceJobQueueDataV0
+
+	resp.Diagnostics.Append(req.State.Get(ctx, &jobQueueDataV0)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	jobQueueDataV2 := resourceJobQueueData{
+		ComputeEnvironments: jobQueueDataV0.ComputeEnvironments,
+		ID:                  jobQueueDataV0.ID,
+		Name:                jobQueueDataV0.Name,
+		Priority:            jobQueueDataV0.Priority,
+		State:               jobQueueDataV0.State,
+		Tags:                jobQueueDataV0.Tags,
+		TagsAll:             jobQueueDataV0.TagsAll,
+		Timeouts:            jobQueueDataV0.Timeouts,
+	}
+
+	if jobQueueDataV0.SchedulingPolicyARN.ValueString() == "" {
+		jobQueueDataV2.SchedulingPolicyARN = fwtypes.ARNNull()
+	}
+
+	diags := resp.State.Set(ctx, jobQueueDataV2)
+	resp.Diagnostics.Append(diags...)
+}
diff --git a/internal/service/batch/job_queue_test.go b/internal/service/batch/job_queue_test.go
index 093cdffce89..53c98bd1918 100644
--- a/internal/service/batch/job_queue_test.go
+++ b/internal/service/batch/job_queue_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package batch_test
 
 import (
@@ -36,6 +39,7 @@ func TestAccBatchJobQueue_basic(t *testing.T) {
 					testAccCheckJobQueueExists(ctx, resourceName, &jobQueue1),
 					acctest.CheckResourceAttrRegionalARN(resourceName, "arn", "batch", fmt.Sprintf("job-queue/%s", rName)),
 					resource.TestCheckResourceAttr(resourceName, "compute_environments.#", "1"),
+					resource.TestCheckResourceAttrPair(resourceName, "compute_environments.0", "aws_batch_compute_environment.test", "arn"),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "priority", "1"),
 					resource.TestCheckResourceAttr(resourceName, "state", batch.JQStateEnabled),
@@ -67,7 +71,7 @@ func TestAccBatchJobQueue_disappears(t *testing.T) {
 				Config: testAccJobQueueConfig_state(rName, batch.JQStateEnabled),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckJobQueueExists(ctx, resourceName, &jobQueue1),
-					testAccCheckJobQueueDisappears(ctx, &jobQueue1),
+					acctest.CheckFrameworkResourceDisappears(ctx, acctest.Provider, tfbatch.ResourceJobQueue, resourceName),
 				),
 				ExpectNonEmptyPlan: true,
 			},
@@ -75,6 +79,85 @@ func TestAccBatchJobQueue_disappears(t *testing.T) {
 	})
 }
 
+func TestAccBatchJobQueue_MigrateFromPluginSDK(t *testing.T) {
+	ctx := acctest.Context(t)
+	var jobQueue1 batch.JobQueueDetail
+	resourceName := "aws_batch_job_queue.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:     func() { acctest.PreCheck(ctx, t); testAccPreCheck(ctx, t) },
+		ErrorCheck:   acctest.ErrorCheck(t, batch.EndpointsID),
+		CheckDestroy: testAccCheckJobQueueDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				ExternalProviders: map[string]resource.ExternalProvider{
+					"aws": {
+						Source:            "hashicorp/aws",
+						VersionConstraint: "5.13.1",
+					},
+				},
+				Config: testAccJobQueueConfig_state(rName, batch.JQStateEnabled),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckJobQueueExists(ctx, resourceName, &jobQueue1),
+					acctest.CheckResourceAttrRegionalARN(resourceName, "arn", "batch", fmt.Sprintf("job-queue/%s", rName)),
+				),
+			},
+			{
+				ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+				Config:                   testAccJobQueueConfig_state(rName, batch.JQStateEnabled),
+				PlanOnly:                 true,
+			},
+		},
+	})
+}
+
+func TestAccBatchJobQueue_ComputeEnvironments_multiple(t *testing.T) {
+	ctx := acctest.Context(t)
+	var jobQueue1 batch.JobQueueDetail
+	resourceName := "aws_batch_job_queue.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, batch.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckJobQueueDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccJobQueueConfig_ComputeEnvironments_multiple(rName, batch.JQStateEnabled),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckJobQueueExists(ctx, resourceName, &jobQueue1),
+					resource.TestCheckResourceAttr(resourceName, "compute_environments.#", "3"),
+					resource.TestCheckResourceAttrPair(resourceName, "compute_environments.0", "aws_batch_compute_environment.test", "arn"),
+					resource.TestCheckResourceAttrPair(resourceName, "compute_environments.1", "aws_batch_compute_environment.more.0", "arn"),
+					resource.TestCheckResourceAttrPair(resourceName, "compute_environments.2", "aws_batch_compute_environment.more.1", "arn"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				Config: testAccJobQueueConfig_ComputeEnvironments_multipleReorder(rName, batch.JQStateEnabled),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckJobQueueExists(ctx, resourceName, &jobQueue1),
+					resource.TestCheckResourceAttr(resourceName, "compute_environments.#", "3"),
+					resource.TestCheckResourceAttrPair(resourceName, "compute_environments.0", "aws_batch_compute_environment.more.0", "arn"),
+					resource.TestCheckResourceAttrPair(resourceName, "compute_environments.1", "aws_batch_compute_environment.test", "arn"),
+					resource.TestCheckResourceAttrPair(resourceName, "compute_environments.2", "aws_batch_compute_environment.more.1", "arn"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
 // Reference: https://github.com/hashicorp/terraform-provider-aws/issues/8083
 func TestAccBatchJobQueue_ComputeEnvironments_externalOrderUpdate(t *testing.T) {
 	ctx := acctest.Context(t)
@@ -273,7 +356,7 @@ func testAccCheckJobQueueExists(ctx context.Context, n string, jq *batch.JobQueu
 
 		conn := acctest.Provider.Meta().(*conns.AWSClient).BatchConn(ctx)
 		name := rs.Primary.Attributes["name"]
-		queue, err := tfbatch.GetJobQueue(ctx, conn, name)
+		queue, err := tfbatch.FindJobQueueByName(ctx, conn, name)
 		if err != nil {
 			return err
 		}
@@ -293,7 +376,7 @@ func testAccCheckJobQueueDestroy(ctx context.Context) resource.TestCheckFunc {
 				continue
 			}
 			conn := acctest.Provider.Meta().(*conns.AWSClient).BatchConn(ctx)
-			jq, err := tfbatch.GetJobQueue(ctx, conn, rs.Primary.Attributes["name"])
+			jq, err := tfbatch.FindJobQueueByName(ctx, conn, rs.Primary.Attributes["name"])
 			if err == nil {
 				if jq != nil {
 					return fmt.Errorf("Error: Job Queue still exists")
@@ -305,20 +388,6 @@ func testAccCheckJobQueueDestroy(ctx context.Context) resource.TestCheckFunc {
 	}
 }
 
-func testAccCheckJobQueueDisappears(ctx context.Context, jobQueue *batch.JobQueueDetail) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		conn := acctest.Provider.Meta().(*conns.AWSClient).BatchConn(ctx)
-		name := aws.StringValue(jobQueue.JobQueueName)
-
-		err := tfbatch.DisableJobQueue(ctx, name, conn)
-		if err != nil {
-			return fmt.Errorf("error disabling Batch Job Queue (%s): %s", name, err)
-		}
-
-		return tfbatch.DeleteJobQueue(ctx, name, conn)
-	}
-}
-
 // testAccCheckJobQueueComputeEnvironmentOrderUpdate simulates the change of a Compute Environment Order
 // An external update to the Batch Job Queue (e.g. console) may trigger changes to the value of the Order
 // parameter that do not affect the operation of the queue itself, but the resource logic needs to handle.
@@ -528,6 +597,79 @@ resource "aws_batch_job_queue" "test" {
 `, rName, state))
 }
 
+func testAccJobQueueConfig_ComputeEnvironments_multiple(rName string, state string) string {
+	return acctest.ConfigCompose(
+		testAccJobQueueConfigBase(rName),
+		fmt.Sprintf(`
+resource "aws_batch_job_queue" "test" {
+  compute_environments = concat(
+    [aws_batch_compute_environment.test.arn],
+    aws_batch_compute_environment.more[*].arn,
+  )
+  name     = %[1]q
+  priority = 1
+  state    = %[2]q
+}
+
+resource "aws_batch_compute_environment" "more" {
+  count = 2
+
+  compute_environment_name = "%[1]s-${count.index + 1}"
+  service_role             = aws_iam_role.test.arn
+  type                     = "MANAGED"
+
+  compute_resources {
+    instance_role      = aws_iam_instance_profile.ecs_instance_role.arn
+    instance_type      = ["c5", "m5", "r5"]
+    max_vcpus          = 1
+    min_vcpus          = 0
+    security_group_ids = [aws_security_group.test.id]
+    subnets            = [aws_subnet.test.id]
+    type               = "EC2"
+  }
+
+  depends_on = [aws_iam_role_policy_attachment.test]
+}
+`, rName, state))
+}
+
+func testAccJobQueueConfig_ComputeEnvironments_multipleReorder(rName string, state string) string {
+	return acctest.ConfigCompose(
+		testAccJobQueueConfigBase(rName),
+		fmt.Sprintf(`
+resource "aws_batch_job_queue" "test" {
+  compute_environments = [
+    aws_batch_compute_environment.more[0].arn,
+    aws_batch_compute_environment.test.arn,
+    aws_batch_compute_environment.more[1].arn,
+  ]
+  name     = %[1]q
+  priority = 1
+  state    = %[2]q
+}
+
+resource "aws_batch_compute_environment" "more" {
+  count = 2
+
+  compute_environment_name = "%[1]s-${count.index + 1}"
+  service_role             = aws_iam_role.test.arn
+  type                     = "MANAGED"
+
+  compute_resources {
+    instance_role      = aws_iam_instance_profile.ecs_instance_role.arn
+    instance_type      = ["c5", "m5", "r5"]
+    max_vcpus          = 1
+    min_vcpus          = 0
+    security_group_ids = [aws_security_group.test.id]
+    subnets            = [aws_subnet.test.id]
+    type               = "EC2"
+  }
+
+  depends_on = [aws_iam_role_policy_attachment.test]
+}
+`, rName, state))
+}
+
 func testAccJobQueueConfig_tags1(rName, tagKey1, tagValue1 string) string {
 	return acctest.ConfigCompose(
 		testAccJobQueueConfigBase(rName),
diff --git a/internal/service/batch/scheduling_policy.go b/internal/service/batch/scheduling_policy.go
index 63bb8ed86a5..53bb4dd27a8 100644
--- a/internal/service/batch/scheduling_policy.go
+++ b/internal/service/batch/scheduling_policy.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package batch
 
 import (
diff --git a/internal/service/batch/scheduling_policy_data_source.go b/internal/service/batch/scheduling_policy_data_source.go
index 85a50996656..1059e7cdea3 100644
--- a/internal/service/batch/scheduling_policy_data_source.go
+++ b/internal/service/batch/scheduling_policy_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package batch
 
 import (
diff --git a/internal/service/batch/scheduling_policy_data_source_test.go b/internal/service/batch/scheduling_policy_data_source_test.go
index 1e23eb0dd71..37832894991 100644
--- a/internal/service/batch/scheduling_policy_data_source_test.go
+++ b/internal/service/batch/scheduling_policy_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package batch_test
 
 import (
diff --git a/internal/service/batch/scheduling_policy_test.go b/internal/service/batch/scheduling_policy_test.go
index 1fa3c1ffab4..27d266e5221 100644
--- a/internal/service/batch/scheduling_policy_test.go
+++ b/internal/service/batch/scheduling_policy_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package batch_test
 
 import (
diff --git a/internal/service/batch/service_package_gen.go b/internal/service/batch/service_package_gen.go
index 6957a812278..f1eae349c43 100644
--- a/internal/service/batch/service_package_gen.go
+++ b/internal/service/batch/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	batch_sdkv1 "github.com/aws/aws-sdk-go/service/batch"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -19,7 +20,15 @@ func (p *servicePackage) FrameworkDataSources(ctx context.Context) []*types.Serv
 }
 
 func (p *servicePackage) FrameworkResources(ctx context.Context) []*types.ServicePackageFrameworkResource {
-	return []*types.ServicePackageFrameworkResource{}
+	return []*types.ServicePackageFrameworkResource{
+		{
+			Factory: newResourceJobQueue,
+			Name:    "Job Queue",
+			Tags: &types.ServicePackageResourceTags{
+				IdentifierAttribute: "arn",
+			},
+		},
+	}
 }
 
 func (p *servicePackage) SDKDataSources(ctx context.Context) []*types.ServicePackageSDKDataSource {
@@ -57,14 +66,6 @@ func (p *servicePackage) SDKResources(ctx context.Context) []*types.ServicePacka
 				IdentifierAttribute: "arn",
 			},
 		},
-		{
-			Factory:  ResourceJobQueue,
-			TypeName: "aws_batch_job_queue",
-			Name:     "Job Queue",
-			Tags: &types.ServicePackageResourceTags{
-				IdentifierAttribute: "arn",
-			},
-		},
 		{
 			Factory:  ResourceSchedulingPolicy,
 			TypeName: "aws_batch_scheduling_policy",
@@ -87,4 +88,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*b
 	return batch_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/batch/sweep.go b/internal/service/batch/sweep.go
index 1ab21c05df9..e0425198d8d 100644
--- a/internal/service/batch/sweep.go
+++ b/internal/service/batch/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package batch
 
@@ -15,9 +15,12 @@ import (
 	multierror "github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/framework"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/sdk"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_batch_compute_environment", &resource.Sweeper{
 		Name: "aws_batch_compute_environment",
 		Dependencies: []string{
@@ -50,7 +53,7 @@ func init() {
 
 func sweepComputeEnvironments(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
@@ -138,37 +141,33 @@ func sweepComputeEnvironments(region string) error {
 			d := r.Data(nil)
 			d.SetId(name)
 
-			sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
+			sweepResources = append(sweepResources, sdk.NewSweepResource(r, d, client))
 		}
 
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Batch Compute Environment sweep for %s: %s", region, err)
-		return sweeperErrs.ErrorOrNil() // In case we have completed some pages, but had errors
+		return nil
 	}
 
 	if err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error listing Batch Compute Environments (%s): %w", region, err))
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error sweeping Batch Compute Environments (%s): %w", region, err))
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
-		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error sweeping Batch Compute Environments: %w", err))
-	}
-
 	return sweeperErrs.ErrorOrNil()
 }
 
 func sweepJobDefinitions(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
@@ -184,17 +183,17 @@ func sweepJobDefinitions(region string) error {
 		}
 
 		for _, v := range page.JobDefinitions {
-			r := ResourceSchedulingPolicy()
+			r := ResourceJobDefinition()
 			d := r.Data(nil)
 			d.SetId(aws.StringValue(v.JobDefinitionArn))
 
-			sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
+			sweepResources = append(sweepResources, sdk.NewSweepResource(r, d, client))
 		}
 
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Batch Job Definition sweep for %s: %s", region, err)
 		return nil
 	}
@@ -203,7 +202,7 @@ func sweepJobDefinitions(region string) error {
 		return fmt.Errorf("error listing Batch Job Definitions (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping Batch Job Definitions (%s): %w", region, err)
@@ -214,7 +213,7 @@ func sweepJobDefinitions(region string) error {
 
 func sweepJobQueues(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -228,18 +227,17 @@ func sweepJobQueues(region string) error {
 		}
 
 		for _, v := range page.JobQueues {
-			r := ResourceJobQueue()
-			d := r.Data(nil)
-			d.SetId(aws.StringValue(v.JobQueueArn))
-			d.Set("name", v.JobQueueName)
+			id := aws.StringValue(v.JobQueueArn)
 
-			sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
+			sweepResources = append(sweepResources, framework.NewSweepResource(newResourceJobQueue, client,
+				framework.NewAttribute("id", id),
+			))
 		}
 
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Batch Job Queue sweep for %s: %s", region, err)
 		return nil
 	}
@@ -248,7 +246,7 @@ func sweepJobQueues(region string) error {
 		return fmt.Errorf("error listing Batch Job Queues (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping Batch Job Queues (%s): %w", region, err)
@@ -259,7 +257,7 @@ func sweepJobQueues(region string) error {
 
 func sweepSchedulingPolicies(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -277,13 +275,13 @@ func sweepSchedulingPolicies(region string) error {
 			d := r.Data(nil)
 			d.SetId(aws.StringValue(v.Arn))
 
-			sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
+			sweepResources = append(sweepResources, sdk.NewSweepResource(r, d, client))
 		}
 
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Batch Scheduling Policy sweep for %s: %s", region, err)
 		return nil
 	}
@@ -292,7 +290,7 @@ func sweepSchedulingPolicies(region string) error {
 		return fmt.Errorf("error listing Batch Scheduling Policies (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping Batch Scheduling Policies (%s): %w", region, err)
diff --git a/internal/service/batch/tags_gen.go b/internal/service/batch/tags_gen.go
index d8ff94adca7..e4f9233d685 100644
--- a/internal/service/batch/tags_gen.go
+++ b/internal/service/batch/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/batch"
 	"github.com/aws/aws-sdk-go/service/batch/batchiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -54,7 +56,7 @@ func Tags(tags tftags.KeyValueTags) map[string]*string {
 	return aws.StringMap(tags.Map())
 }
 
-// KeyValueTags creates KeyValueTags from batch service tags.
+// KeyValueTags creates tftags.KeyValueTags from batch service tags.
 func KeyValueTags(ctx context.Context, tags map[string]*string) tftags.KeyValueTags {
 	return tftags.New(ctx, tags)
 }
@@ -85,6 +87,8 @@ func updateTags(ctx context.Context, conn batchiface.BatchAPI, identifier string
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.Batch)
 	if len(removedTags) > 0 {
diff --git a/internal/service/batch/validate.go b/internal/service/batch/validate.go
index 4d9920448fa..b45171b5b44 100644
--- a/internal/service/batch/validate.go
+++ b/internal/service/batch/validate.go
@@ -1,13 +1,17 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package batch
 
 import (
 	"fmt"
-	"regexp"
+
+	"github.com/YakDriver/regexache"
 )
 
 func validName(v interface{}, k string) (ws []string, errors []error) {
 	value := v.(string)
-	if !regexp.MustCompile(`^[0-9a-zA-Z]{1}[0-9a-zA-Z_\-]{0,127}$`).MatchString(value) {
+	if !regexache.MustCompile(`^[0-9A-Za-z]{1}[0-9A-Za-z_-]{0,127}$`).MatchString(value) {
 		errors = append(errors, fmt.Errorf("%q (%q) must be up to 128 letters (uppercase and lowercase), numbers, underscores and dashes, and must start with an alphanumeric.", k, v))
 	}
 	return
@@ -15,7 +19,7 @@ func validName(v interface{}, k string) (ws []string, errors []error) {
 
 func validPrefix(v interface{}, k string) (ws []string, errors []error) {
 	value := v.(string)
-	if !regexp.MustCompile(`^[0-9a-zA-Z]{1}[0-9a-zA-Z_\-]{0,101}$`).MatchString(value) {
+	if !regexache.MustCompile(`^[0-9A-Za-z]{1}[0-9A-Za-z_-]{0,101}$`).MatchString(value) {
 		errors = append(errors, fmt.Errorf("%q (%q) must be up to 102 letters (uppercase and lowercase), numbers, underscores and dashes, and must start with an alphanumeric.", k, v))
 	}
 	return
@@ -23,7 +27,7 @@ func validPrefix(v interface{}, k string) (ws []string, errors []error) {
 
 func validShareIdentifier(v interface{}, k string) (ws []string, errors []error) {
 	value := v.(string)
-	if !regexp.MustCompile(`^[a-zA-Z0-9]{0,254}[a-zA-Z0-9*]?$`).MatchString(value) {
+	if !regexache.MustCompile(`^[0-9A-Za-z]{0,254}[0-9A-Za-z*]?$`).MatchString(value) {
 		errors = append(errors, fmt.Errorf("%q (%q) must be limited to 255 alphanumeric characters, where the last character can be an asterisk (*).", k, v))
 	}
 	return
diff --git a/internal/service/batch/validate_test.go b/internal/service/batch/validate_test.go
index 4b0d839608c..2054340deb4 100644
--- a/internal/service/batch/validate_test.go
+++ b/internal/service/batch/validate_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package batch
 
 import (
diff --git a/internal/service/bedrock/README.md b/internal/service/bedrock/README.md
new file mode 100644
index 00000000000..9c5794a8b0e
--- /dev/null
+++ b/internal/service/bedrock/README.md
@@ -0,0 +1,5 @@
+# Terraform AWS Provider Amazon Bedrock Package
+
+* AWS Provider: [Contribution Guide](https://hashicorp.github.io/terraform-provider-aws/#contribute)
+* Service User Guide: [What is Amazon Bedrock?](https://docs.aws.amazon.com/bedrock/latest/userguide/what-is-service.html)
+* Service API Guide: [Bedrock API Reference](https://docs.aws.amazon.com/bedrock/latest/APIReference/welcome.html)
diff --git a/internal/service/bedrock/generate.go b/internal/service/bedrock/generate.go
new file mode 100644
index 00000000000..d12e8848301
--- /dev/null
+++ b/internal/service/bedrock/generate.go
@@ -0,0 +1,7 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+//go:generate go run ../../generate/servicepackage/main.go
+// ONLY generate directives and package declaration! Do not add anything else to this file.
+
+package bedrock
diff --git a/internal/service/bedrock/service_package_gen.go b/internal/service/bedrock/service_package_gen.go
new file mode 100644
index 00000000000..dbf67558ffb
--- /dev/null
+++ b/internal/service/bedrock/service_package_gen.go
@@ -0,0 +1,47 @@
+// Code generated by internal/generate/servicepackages/main.go; DO NOT EDIT.
+
+package bedrock
+
+import (
+	"context"
+
+	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
+	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
+	bedrock_sdkv1 "github.com/aws/aws-sdk-go/service/bedrock"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/types"
+	"github.com/hashicorp/terraform-provider-aws/names"
+)
+
+type servicePackage struct{}
+
+func (p *servicePackage) FrameworkDataSources(ctx context.Context) []*types.ServicePackageFrameworkDataSource {
+	return []*types.ServicePackageFrameworkDataSource{}
+}
+
+func (p *servicePackage) FrameworkResources(ctx context.Context) []*types.ServicePackageFrameworkResource {
+	return []*types.ServicePackageFrameworkResource{}
+}
+
+func (p *servicePackage) SDKDataSources(ctx context.Context) []*types.ServicePackageSDKDataSource {
+	return []*types.ServicePackageSDKDataSource{}
+}
+
+func (p *servicePackage) SDKResources(ctx context.Context) []*types.ServicePackageSDKResource {
+	return []*types.ServicePackageSDKResource{}
+}
+
+func (p *servicePackage) ServicePackageName() string {
+	return names.Bedrock
+}
+
+// NewConn returns a new AWS SDK for Go v1 client for this service package's AWS API.
+func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*bedrock_sdkv1.Bedrock, error) {
+	sess := config["session"].(*session_sdkv1.Session)
+
+	return bedrock_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
+}
+
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/budgets/budget.go b/internal/service/budgets/budget.go
index 157d1d5d5ed..9cef689f3f3 100644
--- a/internal/service/budgets/budget.go
+++ b/internal/service/budgets/budget.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package budgets
 
 import (
diff --git a/internal/service/budgets/budget_action.go b/internal/service/budgets/budget_action.go
index db670f86906..3f94019cd18 100644
--- a/internal/service/budgets/budget_action.go
+++ b/internal/service/budgets/budget_action.go
@@ -1,13 +1,16 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package budgets
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"strings"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/aws/aws-sdk-go/service/budgets"
@@ -17,6 +20,7 @@ import (
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
 	"github.com/hashicorp/terraform-provider-aws/internal/flex"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
@@ -35,8 +39,9 @@ func ResourceBudgetAction() *schema.Resource {
 		},
 
 		Timeouts: &schema.ResourceTimeout{
-			Create: schema.DefaultTimeout(5 * time.Minute),
-			Update: schema.DefaultTimeout(5 * time.Minute),
+			Create: schema.DefaultTimeout(5 * time.Minute), // unneeded, but a breaking change to remove
+			Update: schema.DefaultTimeout(5 * time.Minute), // unneeded, but a breaking change to remove
+			Delete: schema.DefaultTimeout(5 * time.Minute),
 		},
 
 		Schema: map[string]*schema.Schema{
@@ -91,7 +96,7 @@ func ResourceBudgetAction() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 100),
-					validation.StringMatch(regexp.MustCompile(`[^:\\]+`), "The ':' and '\\' characters aren't allowed."),
+					validation.StringMatch(regexache.MustCompile(`[^:\\]+`), "The ':' and '\\' characters aren't allowed."),
 				),
 			},
 			"definition": {
@@ -203,7 +208,7 @@ func ResourceBudgetAction() *schema.Resource {
 							Required: true,
 							ValidateFunc: validation.All(
 								validation.StringLenBetween(1, 2147483647),
-								validation.StringMatch(regexp.MustCompile(`(.*[\n\r\t\f\ ]?)*`), "Can't contain line breaks."),
+								validation.StringMatch(regexache.MustCompile(`(.*[\n\r\t\f\ ]?)*`), "Can't contain line breaks."),
 							)},
 						"subscription_type": {
 							Type:         schema.TypeString,
@@ -218,6 +223,7 @@ func ResourceBudgetAction() *schema.Resource {
 }
 
 func resourceBudgetActionCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).BudgetsConn(ctx)
 
 	accountID := d.Get("account_id").(string)
@@ -241,7 +247,7 @@ func resourceBudgetActionCreate(ctx context.Context, d *schema.ResourceData, met
 	}, budgets.ErrCodeAccessDeniedException)
 
 	if err != nil {
-		return diag.Errorf("creating Budget Action: %s", err)
+		return sdkdiag.AppendErrorf(diags, "creating Budget Action: %s", err)
 	}
 
 	output := outputRaw.(*budgets.CreateBudgetActionOutput)
@@ -250,20 +256,17 @@ func resourceBudgetActionCreate(ctx context.Context, d *schema.ResourceData, met
 
 	d.SetId(BudgetActionCreateResourceID(accountID, actionID, budgetName))
 
-	if _, err := waitActionAvailable(ctx, conn, accountID, actionID, budgetName, d.Timeout(schema.TimeoutCreate)); err != nil {
-		return diag.Errorf("waiting for Budget Action (%s) create: %s", d.Id(), err)
-	}
-
-	return resourceBudgetActionRead(ctx, d, meta)
+	return append(diags, resourceBudgetActionRead(ctx, d, meta)...)
 }
 
 func resourceBudgetActionRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).BudgetsConn(ctx)
 
 	accountID, actionID, budgetName, err := BudgetActionParseResourceID(d.Id())
 
 	if err != nil {
-		return diag.FromErr(err)
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
 	output, err := FindActionByThreePartKey(ctx, conn, accountID, actionID, budgetName)
@@ -275,13 +278,13 @@ func resourceBudgetActionRead(ctx context.Context, d *schema.ResourceData, meta
 	}
 
 	if err != nil {
-		return diag.Errorf("reading Budget Action (%s): %s", d.Id(), err)
+		return sdkdiag.AppendErrorf(diags, "reading Budget Action (%s): %s", d.Id(), err)
 	}
 
 	d.Set("account_id", accountID)
 	d.Set("action_id", actionID)
 	if err := d.Set("action_threshold", flattenBudgetActionActionThreshold(output.ActionThreshold)); err != nil {
-		return diag.Errorf("setting action_threshold: %s", err)
+		return sdkdiag.AppendErrorf(diags, "setting action_threshold: %s", err)
 	}
 	d.Set("action_type", output.ActionType)
 	d.Set("approval_model", output.ApprovalModel)
@@ -294,25 +297,26 @@ func resourceBudgetActionRead(ctx context.Context, d *schema.ResourceData, meta
 	d.Set("arn", arn.String())
 	d.Set("budget_name", budgetName)
 	if err := d.Set("definition", flattenBudgetActionDefinition(output.Definition)); err != nil {
-		return diag.Errorf("setting definition: %s", err)
+		return sdkdiag.AppendErrorf(diags, "setting definition: %s", err)
 	}
 	d.Set("execution_role_arn", output.ExecutionRoleArn)
 	d.Set("notification_type", output.NotificationType)
 	d.Set("status", output.Status)
 	if err := d.Set("subscriber", flattenBudgetActionSubscriber(output.Subscribers)); err != nil {
-		return diag.Errorf("setting subscriber: %s", err)
+		return sdkdiag.AppendErrorf(diags, "setting subscriber: %s", err)
 	}
 
-	return nil
+	return diags
 }
 
 func resourceBudgetActionUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).BudgetsConn(ctx)
 
 	accountID, actionID, budgetName, err := BudgetActionParseResourceID(d.Id())
 
 	if err != nil {
-		return diag.FromErr(err)
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
 	input := &budgets.UpdateBudgetActionInput{
@@ -348,41 +352,40 @@ func resourceBudgetActionUpdate(ctx context.Context, d *schema.ResourceData, met
 	_, err = conn.UpdateBudgetActionWithContext(ctx, input)
 
 	if err != nil {
-		return diag.Errorf("updating Budget Action (%s): %s", d.Id(), err)
+		return sdkdiag.AppendErrorf(diags, "updating Budget Action (%s): %s", d.Id(), err)
 	}
 
-	if _, err := waitActionAvailable(ctx, conn, accountID, actionID, budgetName, d.Timeout(schema.TimeoutUpdate)); err != nil {
-		return diag.Errorf("waiting for Budget Action (%s) update: %s", d.Id(), err)
-	}
-
-	return resourceBudgetActionRead(ctx, d, meta)
+	return append(diags, resourceBudgetActionRead(ctx, d, meta)...)
 }
 
 func resourceBudgetActionDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).BudgetsConn(ctx)
 
 	accountID, actionID, budgetName, err := BudgetActionParseResourceID(d.Id())
 
 	if err != nil {
-		return diag.FromErr(err)
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
 	log.Printf("[DEBUG] Deleting Budget Action: %s", d.Id())
-	_, err = conn.DeleteBudgetActionWithContext(ctx, &budgets.DeleteBudgetActionInput{
-		AccountId:  aws.String(accountID),
-		ActionId:   aws.String(actionID),
-		BudgetName: aws.String(budgetName),
-	})
+	_, err = tfresource.RetryWhenAWSErrCodeEquals(ctx, d.Timeout(schema.TimeoutDelete), func() (any, error) {
+		return conn.DeleteBudgetActionWithContext(ctx, &budgets.DeleteBudgetActionInput{
+			AccountId:  aws.String(accountID),
+			ActionId:   aws.String(actionID),
+			BudgetName: aws.String(budgetName),
+		})
+	}, budgets.ErrCodeResourceLockedException)
 
 	if tfawserr.ErrCodeEquals(err, budgets.ErrCodeNotFoundException) {
 		return nil
 	}
 
 	if err != nil {
-		return diag.Errorf("deleting Budget Action (%s): %s", d.Id(), err)
+		return sdkdiag.AppendErrorf(diags, "deleting Budget Action (%s): %s", d.Id(), err)
 	}
 
-	return nil
+	return diags
 }
 
 const budgetActionResourceIDSeparator = ":"
@@ -435,46 +438,6 @@ func FindActionByThreePartKey(ctx context.Context, conn *budgets.Budgets, accoun
 	return output.Action, nil
 }
 
-func statusAction(ctx context.Context, conn *budgets.Budgets, accountID, actionID, budgetName string) retry.StateRefreshFunc {
-	return func() (interface{}, string, error) {
-		output, err := FindActionByThreePartKey(ctx, conn, accountID, actionID, budgetName)
-
-		if tfresource.NotFound(err) {
-			return nil, "", nil
-		}
-
-		if err != nil {
-			return nil, "", err
-		}
-
-		return output, aws.StringValue(output.Status), nil
-	}
-}
-
-func waitActionAvailable(ctx context.Context, conn *budgets.Budgets, accountID, actionID, budgetName string, timeout time.Duration) (*budgets.Action, error) { //nolint:unparam
-	stateConf := &retry.StateChangeConf{
-		Pending: []string{
-			budgets.ActionStatusExecutionInProgress,
-			budgets.ActionStatusStandby,
-		},
-		Target: []string{
-			budgets.ActionStatusExecutionSuccess,
-			budgets.ActionStatusExecutionFailure,
-			budgets.ActionStatusPending,
-		},
-		Refresh: statusAction(ctx, conn, accountID, actionID, budgetName),
-		Timeout: timeout,
-	}
-
-	outputRaw, err := stateConf.WaitForStateContext(ctx)
-
-	if v, ok := outputRaw.(*budgets.Action); ok {
-		return v, err
-	}
-
-	return nil, err
-}
-
 func expandBudgetActionActionThreshold(l []interface{}) *budgets.ActionThreshold {
 	if len(l) == 0 || l[0] == nil {
 		return nil
diff --git a/internal/service/budgets/budget_action_test.go b/internal/service/budgets/budget_action_test.go
index cb87b7806e5..a15a8091219 100644
--- a/internal/service/budgets/budget_action_test.go
+++ b/internal/service/budgets/budget_action_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package budgets_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/budgets"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -22,6 +25,96 @@ func TestAccBudgetsBudgetAction_basic(t *testing.T) {
 	resourceName := "aws_budgets_budget_action.test"
 	var conf budgets.Action
 
+	const thresholdValue = "1000000000"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, budgets.EndpointsID) },
+		ErrorCheck:               acctest.ErrorCheck(t, budgets.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckBudgetActionDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccBudgetActionConfig_basic(rName, budgets.ApprovalModelAutomatic, thresholdValue),
+				Check: resource.ComposeTestCheckFunc(
+					testAccBudgetActionExists(ctx, resourceName, &conf),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "budgets", regexache.MustCompile(fmt.Sprintf(`budget/%s/action/.+`, rName))),
+					resource.TestCheckResourceAttrPair(resourceName, "budget_name", "aws_budgets_budget.test", "name"),
+					resource.TestCheckResourceAttrPair(resourceName, "execution_role_arn", "aws_iam_role.test", "arn"),
+					resource.TestCheckResourceAttr(resourceName, "action_type", "APPLY_IAM_POLICY"),
+					resource.TestCheckResourceAttr(resourceName, "approval_model", budgets.ApprovalModelAutomatic),
+					resource.TestCheckResourceAttr(resourceName, "notification_type", "ACTUAL"),
+					resource.TestCheckResourceAttr(resourceName, "action_threshold.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "action_threshold.0.action_threshold_type", "ABSOLUTE_VALUE"),
+					resource.TestCheckResourceAttr(resourceName, "action_threshold.0.action_threshold_value", thresholdValue),
+					resource.TestCheckResourceAttr(resourceName, "definition.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "definition.0.iam_action_definition.#", "1"),
+					resource.TestCheckResourceAttrPair(resourceName, "definition.0.iam_action_definition.0.policy_arn", "aws_iam_policy.test", "arn"),
+					resource.TestCheckResourceAttr(resourceName, "definition.0.iam_action_definition.0.roles.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "subscriber.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "status", budgets.ActionStatusStandby),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
+func TestAccBudgetsBudgetAction_triggeredAutomatic(t *testing.T) {
+	ctx := acctest.Context(t)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_budgets_budget_action.test"
+	var conf budgets.Action
+
+	const thresholdValue = "100"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, budgets.EndpointsID) },
+		ErrorCheck:               acctest.ErrorCheck(t, budgets.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckBudgetActionDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccBudgetActionConfig_basic(rName, budgets.ApprovalModelAutomatic, thresholdValue),
+				Check: resource.ComposeTestCheckFunc(
+					testAccBudgetActionExists(ctx, resourceName, &conf),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "budgets", regexache.MustCompile(fmt.Sprintf(`budget/%s/action/.+`, rName))),
+					resource.TestCheckResourceAttrPair(resourceName, "budget_name", "aws_budgets_budget.test", "name"),
+					resource.TestCheckResourceAttrPair(resourceName, "execution_role_arn", "aws_iam_role.test", "arn"),
+					resource.TestCheckResourceAttr(resourceName, "action_type", "APPLY_IAM_POLICY"),
+					resource.TestCheckResourceAttr(resourceName, "approval_model", budgets.ApprovalModelAutomatic),
+					resource.TestCheckResourceAttr(resourceName, "notification_type", "ACTUAL"),
+					resource.TestCheckResourceAttr(resourceName, "action_threshold.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "action_threshold.0.action_threshold_type", "ABSOLUTE_VALUE"),
+					resource.TestCheckResourceAttr(resourceName, "action_threshold.0.action_threshold_value", thresholdValue),
+					resource.TestCheckResourceAttr(resourceName, "definition.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "definition.0.iam_action_definition.#", "1"),
+					resource.TestCheckResourceAttrPair(resourceName, "definition.0.iam_action_definition.0.policy_arn", "aws_iam_policy.test", "arn"),
+					resource.TestCheckResourceAttr(resourceName, "definition.0.iam_action_definition.0.roles.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "subscriber.#", "1"),
+					resource.TestCheckResourceAttrSet(resourceName, "status"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
+func TestAccBudgetsBudgetAction_triggeredManual(t *testing.T) {
+	ctx := acctest.Context(t)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_budgets_budget_action.test"
+	var conf budgets.Action
+
+	const thresholdValue = "100"
+
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, budgets.EndpointsID) },
 		ErrorCheck:               acctest.ErrorCheck(t, budgets.EndpointsID),
@@ -29,23 +122,24 @@ func TestAccBudgetsBudgetAction_basic(t *testing.T) {
 		CheckDestroy:             testAccCheckBudgetActionDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccBudgetActionConfig_basic(rName),
+				Config: testAccBudgetActionConfig_basic(rName, budgets.ApprovalModelManual, thresholdValue),
 				Check: resource.ComposeTestCheckFunc(
 					testAccBudgetActionExists(ctx, resourceName, &conf),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "budgets", regexp.MustCompile(fmt.Sprintf(`budget/%s/action/.+`, rName))),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "budgets", regexache.MustCompile(fmt.Sprintf(`budget/%s/action/.+`, rName))),
 					resource.TestCheckResourceAttrPair(resourceName, "budget_name", "aws_budgets_budget.test", "name"),
 					resource.TestCheckResourceAttrPair(resourceName, "execution_role_arn", "aws_iam_role.test", "arn"),
 					resource.TestCheckResourceAttr(resourceName, "action_type", "APPLY_IAM_POLICY"),
-					resource.TestCheckResourceAttr(resourceName, "approval_model", "AUTOMATIC"),
+					resource.TestCheckResourceAttr(resourceName, "approval_model", budgets.ApprovalModelManual),
 					resource.TestCheckResourceAttr(resourceName, "notification_type", "ACTUAL"),
 					resource.TestCheckResourceAttr(resourceName, "action_threshold.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "action_threshold.0.action_threshold_type", "ABSOLUTE_VALUE"),
-					resource.TestCheckResourceAttr(resourceName, "action_threshold.0.action_threshold_value", "100"),
+					resource.TestCheckResourceAttr(resourceName, "action_threshold.0.action_threshold_value", thresholdValue),
 					resource.TestCheckResourceAttr(resourceName, "definition.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "definition.0.iam_action_definition.#", "1"),
 					resource.TestCheckResourceAttrPair(resourceName, "definition.0.iam_action_definition.0.policy_arn", "aws_iam_policy.test", "arn"),
 					resource.TestCheckResourceAttr(resourceName, "definition.0.iam_action_definition.0.roles.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "subscriber.#", "1"),
+					resource.TestCheckResourceAttrSet(resourceName, "status"), // Race condition between "STANDBY" and "PENDING"
 				),
 			},
 			{
@@ -70,7 +164,7 @@ func TestAccBudgetsBudgetAction_disappears(t *testing.T) {
 		CheckDestroy:             testAccCheckBudgetActionDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccBudgetActionConfig_basic(rName),
+				Config: testAccBudgetActionConfig_basic(rName, budgets.ApprovalModelAutomatic, "100"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccBudgetActionExists(ctx, resourceName, &conf),
 					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfbudgets.ResourceBudgetAction(), resourceName),
@@ -144,8 +238,42 @@ func testAccCheckBudgetActionDestroy(ctx context.Context) resource.TestCheckFunc
 	}
 }
 
-func testAccBudgetActionConfig_basic(rName string) string {
+func testAccBudgetActionConfig_basic(rName, approvalModel, thresholdValue string) string {
 	return fmt.Sprintf(`
+resource "aws_budgets_budget_action" "test" {
+  budget_name        = aws_budgets_budget.test.name
+  action_type        = "APPLY_IAM_POLICY"
+  approval_model     = %[2]q
+  notification_type  = "ACTUAL"
+  execution_role_arn = aws_iam_role.test.arn
+
+  action_threshold {
+    action_threshold_type  = "ABSOLUTE_VALUE"
+    action_threshold_value = %[3]s
+  }
+
+  definition {
+    iam_action_definition {
+      policy_arn = aws_iam_policy.test.arn
+      roles      = [aws_iam_role.test.name]
+    }
+  }
+
+  subscriber {
+    address           = %[4]q
+    subscription_type = "EMAIL"
+  }
+}
+
+resource "aws_budgets_budget" "test" {
+  name              = %[1]q
+  budget_type       = "USAGE"
+  limit_amount      = "1.0"
+  limit_unit        = "dollars"
+  time_period_start = "2006-01-02_15:04"
+  time_unit         = "MONTHLY"
+}
+
 resource "aws_iam_policy" "test" {
   name        = %[1]q
   description = "My test policy"
@@ -190,39 +318,5 @@ resource "aws_iam_role" "test" {
 }
 EOF
 }
-
-resource "aws_budgets_budget" "test" {
-  name              = %[1]q
-  budget_type       = "USAGE"
-  limit_amount      = "10.0"
-  limit_unit        = "dollars"
-  time_period_start = "2006-01-02_15:04"
-  time_unit         = "MONTHLY"
-}
-
-resource "aws_budgets_budget_action" "test" {
-  budget_name        = aws_budgets_budget.test.name
-  action_type        = "APPLY_IAM_POLICY"
-  approval_model     = "AUTOMATIC"
-  notification_type  = "ACTUAL"
-  execution_role_arn = aws_iam_role.test.arn
-
-  action_threshold {
-    action_threshold_type  = "ABSOLUTE_VALUE"
-    action_threshold_value = 100
-  }
-
-  definition {
-    iam_action_definition {
-      policy_arn = aws_iam_policy.test.arn
-      roles      = [aws_iam_role.test.name]
-    }
-  }
-
-  subscriber {
-    address           = "test@test.test"
-    subscription_type = "EMAIL"
-  }
-}
-`, rName)
+`, rName, approvalModel, thresholdValue, acctest.DefaultEmailAddress)
 }
diff --git a/internal/service/budgets/budget_data_source.go b/internal/service/budgets/budget_data_source.go
index dc2c4d4aa5f..e268c71b5e4 100644
--- a/internal/service/budgets/budget_data_source.go
+++ b/internal/service/budgets/budget_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package budgets
 
 import (
diff --git a/internal/service/budgets/budget_data_source_test.go b/internal/service/budgets/budget_data_source_test.go
index 0f33ac188c9..5fe6c1c1c5c 100644
--- a/internal/service/budgets/budget_data_source_test.go
+++ b/internal/service/budgets/budget_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package budgets_test
 
 import (
diff --git a/internal/service/budgets/budget_test.go b/internal/service/budgets/budget_test.go
index e037402a628..2f6e524452e 100644
--- a/internal/service/budgets/budget_test.go
+++ b/internal/service/budgets/budget_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package budgets_test
 
 import (
@@ -206,14 +209,12 @@ func TestAccBudgetsBudget_autoAdjustDataForecast(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config: testAccBudgetConfig_autoAdjustDataForecast(rName),
-				Check: resource.ComposeTestCheckFunc(
+				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccBudgetExists(ctx, resourceName, &budget),
 					resource.TestCheckResourceAttr(resourceName, "budget_type", "COST"),
 					resource.TestCheckResourceAttr(resourceName, "auto_adjust_data.0.auto_adjust_type", "FORECAST"),
 					resource.TestCheckResourceAttr(resourceName, "cost_filter.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
-					acctest.CheckResourceAttrGreaterThanValue(resourceName, "limit_amount", 0),
-					resource.TestCheckResourceAttr(resourceName, "limit_unit", "USD"),
 				),
 			},
 			{
@@ -249,8 +250,6 @@ func TestAccBudgetsBudget_autoAdjustDataHistorical(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "cost_filter.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "time_unit", "MONTHLY"),
-					acctest.CheckResourceAttrGreaterThanValue(resourceName, "limit_amount", 0),
-					resource.TestCheckResourceAttr(resourceName, "limit_unit", "USD"),
 				),
 			},
 			{
@@ -270,8 +269,6 @@ func TestAccBudgetsBudget_autoAdjustDataHistorical(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "cost_filter.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "time_unit", "MONTHLY"),
-					acctest.CheckResourceAttrGreaterThanValue(resourceName, "limit_amount", 0),
-					resource.TestCheckResourceAttr(resourceName, "limit_unit", "USD"),
 				),
 			},
 		},
diff --git a/internal/service/budgets/generate.go b/internal/service/budgets/generate.go
index e15b7059909..923b283c6e4 100644
--- a/internal/service/budgets/generate.go
+++ b/internal/service/budgets/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
 
diff --git a/internal/service/budgets/service_package_gen.go b/internal/service/budgets/service_package_gen.go
index 37daeaafd49..a8aaaebfde5 100644
--- a/internal/service/budgets/service_package_gen.go
+++ b/internal/service/budgets/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	budgets_sdkv1 "github.com/aws/aws-sdk-go/service/budgets"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -55,4 +56,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*b
 	return budgets_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/budgets/sweep.go b/internal/service/budgets/sweep.go
index 2b7b3969e6f..9b2f3b1d4a9 100644
--- a/internal/service/budgets/sweep.go
+++ b/internal/service/budgets/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package budgets
 
@@ -12,9 +12,10 @@ import (
 	"github.com/aws/aws-sdk-go/service/budgets"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_budgets_budget_action", &resource.Sweeper{
 		Name: "aws_budgets_budget_action",
 		F:    sweepBudgetActions,
@@ -31,7 +32,7 @@ func init() {
 
 func sweepBudgetActions(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
@@ -58,7 +59,7 @@ func sweepBudgetActions(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Budget Action sweep for %s: %s", region, err)
 		return nil
 	}
@@ -67,7 +68,7 @@ func sweepBudgetActions(region string) error {
 		return fmt.Errorf("error listing Budget Actions (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping Budget Actions (%s): %w", region, err)
@@ -78,7 +79,7 @@ func sweepBudgetActions(region string) error {
 
 func sweepBudgets(region string) error { // nosemgrep:ci.budgets-in-func-name
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
@@ -111,7 +112,7 @@ func sweepBudgets(region string) error { // nosemgrep:ci.budgets-in-func-name
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Budget sweep for %s: %s", region, err)
 		return nil
 	}
@@ -120,7 +121,7 @@ func sweepBudgets(region string) error { // nosemgrep:ci.budgets-in-func-name
 		return fmt.Errorf("error listing Budgets (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping Budgets (%s): %w", region, err)
diff --git a/internal/service/ce/anomaly_monitor.go b/internal/service/ce/anomaly_monitor.go
index a2295631428..be516145772 100644
--- a/internal/service/ce/anomaly_monitor.go
+++ b/internal/service/ce/anomaly_monitor.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ce
 
 import (
 	"context"
 	"encoding/json"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/costexplorer"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -47,7 +50,7 @@ func ResourceAnomalyMonitor() *schema.Resource {
 				Required: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 1024),
-					validation.StringMatch(regexp.MustCompile(`[\\S\\s]*`), "Must be a valid Anomaly Monitor Name matching expression: [\\S\\s]*")),
+					validation.StringMatch(regexache.MustCompile(`[\\S\\s]*`), "Must be a valid Anomaly Monitor Name matching expression: [\\S\\s]*")),
 			},
 			"monitor_specification": {
 				Type:             schema.TypeString,
diff --git a/internal/service/ce/anomaly_monitor_test.go b/internal/service/ce/anomaly_monitor_test.go
index 1fd5c8e8ff0..63113abc8b4 100644
--- a/internal/service/ce/anomaly_monitor_test.go
+++ b/internal/service/ce/anomaly_monitor_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ce_test
 
 import (
 	"context"
 	"errors"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/costexplorer"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -36,7 +39,7 @@ func TestAccCEAnomalyMonitor_basic(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckAnomalyMonitorExists(ctx, resourceName, &monitor),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "ce", regexp.MustCompile(`anomalymonitor/.+`)),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "ce", regexache.MustCompile(`anomalymonitor/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "monitor_type", "CUSTOM"),
 					resource.TestCheckResourceAttrSet(resourceName, "monitor_specification"),
 				),
diff --git a/internal/service/ce/anomaly_subscription.go b/internal/service/ce/anomaly_subscription.go
index 12c1fa477ae..8e2f41a0659 100644
--- a/internal/service/ce/anomaly_subscription.go
+++ b/internal/service/ce/anomaly_subscription.go
@@ -1,9 +1,12 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ce
 
 import (
 	"context"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/costexplorer"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -59,7 +62,7 @@ func ResourceAnomalySubscription() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 1024),
-					validation.StringMatch(regexp.MustCompile(`[\\S\\s]*`), "Must be a valid Anomaly Subscription Name matching expression: [\\S\\s]*")),
+					validation.StringMatch(regexache.MustCompile(`[\\S\\s]*`), "Must be a valid Anomaly Subscription Name matching expression: [\\S\\s]*")),
 			},
 			"subscriber": {
 				Type:     schema.TypeSet,
diff --git a/internal/service/ce/anomaly_subscription_test.go b/internal/service/ce/anomaly_subscription_test.go
index 40a9552b41e..3874999646a 100644
--- a/internal/service/ce/anomaly_subscription_test.go
+++ b/internal/service/ce/anomaly_subscription_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ce_test
 
 import (
 	"context"
 	"errors"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/costexplorer"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -38,7 +41,7 @@ func TestAccCEAnomalySubscription_basic(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckAnomalySubscriptionExists(ctx, resourceName, &subscription),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "ce", regexp.MustCompile(`anomalysubscription/.+`)),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "ce", regexache.MustCompile(`anomalysubscription/.+`)),
 					acctest.CheckResourceAttrAccountID(resourceName, "account_id"),
 					resource.TestCheckResourceAttr(resourceName, "frequency", "DAILY"),
 					resource.TestCheckResourceAttrSet(resourceName, "monitor_arn_list.#"),
diff --git a/internal/service/ce/consts.go b/internal/service/ce/consts.go
index a2b079fa3a1..bd3dee92d93 100644
--- a/internal/service/ce/consts.go
+++ b/internal/service/ce/consts.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ce
 
 const (
diff --git a/internal/service/ce/cost_allocation_tag.go b/internal/service/ce/cost_allocation_tag.go
index db172148967..a0fbe183349 100644
--- a/internal/service/ce/cost_allocation_tag.go
+++ b/internal/service/ce/cost_allocation_tag.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ce
 
 import (
diff --git a/internal/service/ce/cost_allocation_tag_test.go b/internal/service/ce/cost_allocation_tag_test.go
index 56b5059a76e..aef3ecbd781 100644
--- a/internal/service/ce/cost_allocation_tag_test.go
+++ b/internal/service/ce/cost_allocation_tag_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ce_test
 
 import (
diff --git a/internal/service/ce/cost_category.go b/internal/service/ce/cost_category.go
index 74e773ed8e4..b7358e49c22 100644
--- a/internal/service/ce/cost_category.go
+++ b/internal/service/ce/cost_category.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ce
 
 import (
diff --git a/internal/service/ce/cost_category_data_source.go b/internal/service/ce/cost_category_data_source.go
index cb203a222b2..4a047448026 100644
--- a/internal/service/ce/cost_category_data_source.go
+++ b/internal/service/ce/cost_category_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ce
 
 import (
diff --git a/internal/service/ce/cost_category_data_source_test.go b/internal/service/ce/cost_category_data_source_test.go
index 0736d5a2ded..47925dd8b40 100644
--- a/internal/service/ce/cost_category_data_source_test.go
+++ b/internal/service/ce/cost_category_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ce_test
 
 import (
diff --git a/internal/service/ce/cost_category_test.go b/internal/service/ce/cost_category_test.go
index 0e56827b148..954d4578a3b 100644
--- a/internal/service/ce/cost_category_test.go
+++ b/internal/service/ce/cost_category_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ce_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/costexplorer"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -34,7 +37,7 @@ func TestAccCECostCategory_basic(t *testing.T) {
 					testAccCheckCostCategoryExists(ctx, resourceName, &output),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttrSet(resourceName, "effective_start"),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "ce", regexp.MustCompile(`costcategory/.+$`)),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "ce", regexache.MustCompile(`costcategory/.+$`)),
 				),
 			},
 			{
diff --git a/internal/service/ce/find.go b/internal/service/ce/find.go
index 9b2af70e19f..d6553ae01e6 100644
--- a/internal/service/ce/find.go
+++ b/internal/service/ce/find.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ce
 
 import (
diff --git a/internal/service/ce/generate.go b/internal/service/ce/generate.go
index 895cccb612d..4336a942c2c 100644
--- a/internal/service/ce/generate.go
+++ b/internal/service/ce/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTags -ListTagsOutTagsElem=ResourceTags -ServiceTagsSlice -TagInTagsElem=ResourceTags -UpdateTags -UntagInTagsElem=ResourceTagKeys -UntagInTagsElem=ResourceTagKeys -TagType=ResourceTag
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/ce/service_package_gen.go b/internal/service/ce/service_package_gen.go
index f1e80a509e5..2dde43272d5 100644
--- a/internal/service/ce/service_package_gen.go
+++ b/internal/service/ce/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	costexplorer_sdkv1 "github.com/aws/aws-sdk-go/service/costexplorer"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -79,4 +80,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*c
 	return costexplorer_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/ce/tags_data_source.go b/internal/service/ce/tags_data_source.go
index 051efa982e7..b749d445783 100644
--- a/internal/service/ce/tags_data_source.go
+++ b/internal/service/ce/tags_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ce
 
 import (
diff --git a/internal/service/ce/tags_data_source_test.go b/internal/service/ce/tags_data_source_test.go
index dbbccbcaefc..37db90e30de 100644
--- a/internal/service/ce/tags_data_source_test.go
+++ b/internal/service/ce/tags_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ce_test
 
 import (
diff --git a/internal/service/ce/tags_gen.go b/internal/service/ce/tags_gen.go
index a5fb62d6663..cc23c7b111a 100644
--- a/internal/service/ce/tags_gen.go
+++ b/internal/service/ce/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/costexplorer"
 	"github.com/aws/aws-sdk-go/service/costexplorer/costexploreriface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -102,6 +104,8 @@ func updateTags(ctx context.Context, conn costexploreriface.CostExplorerAPI, ide
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.CE)
 	if len(removedTags) > 0 {
diff --git a/internal/service/chime/chime_test.go b/internal/service/chime/chime_test.go
new file mode 100644
index 00000000000..8d762e6d7ae
--- /dev/null
+++ b/internal/service/chime/chime_test.go
@@ -0,0 +1,50 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package chime_test
+
+import (
+	"testing"
+
+	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
+)
+
+func TestAccChime_serial(t *testing.T) {
+	t.Parallel()
+
+	testCases := map[string]map[string]func(t *testing.T){
+		"VoiceConnector": {
+			"basic":      testAccVoiceConnector_basic,
+			"disappears": testAccVoiceConnector_disappears,
+			"update":     testAccVoiceConnector_update,
+			"tags":       testAccVoiceConnector_tags,
+		},
+		"VoiceConnectorGroup": {
+			"basic":      testAccVoiceConnectorGroup_basic,
+			"disappears": testAccVoiceConnectorGroup_disappears,
+			"update":     testAccVoiceConnectorGroup_update,
+		},
+		"VoiceConnectorLogging": {
+			"basic":      testAccVoiceConnectorLogging_basic,
+			"disappears": testAccVoiceConnectorLogging_disappears,
+			"update":     testAccVoiceConnectorLogging_update,
+		},
+		"VoiceConnectorOrigination": {
+			"basic":      testAccVoiceConnectorOrigination_basic,
+			"disappears": testAccVoiceConnectorOrigination_disappears,
+			"update":     testAccVoiceConnectorOrigination_update,
+		},
+		"VoiceConnectorTermination": {
+			"basic":      testAccVoiceConnectorTermination_basic,
+			"disappears": testAccVoiceConnectorTermination_disappears,
+			"update":     testAccVoiceConnectorTermination_update,
+		},
+		"VoiceConnectorTerminationCredentials": {
+			"basic":      testAccVoiceConnectorTerminationCredentials_basic,
+			"disappears": testAccVoiceConnectorTerminationCredentials_disappears,
+			"update":     testAccVoiceConnectorTerminationCredentials_update,
+		},
+	}
+
+	acctest.RunSerialTests2Levels(t, testCases, 0)
+}
diff --git a/internal/service/chime/generate.go b/internal/service/chime/generate.go
index c63ac5554cb..7bbc5209df2 100644
--- a/internal/service/chime/generate.go
+++ b/internal/service/chime/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTags -ListTagsInIDElem=ResourceARN -ServiceTagsSlice -TagInIDElem=ResourceARN -CreateTags -UpdateTags -AWSSDKServicePackage=chimesdkvoice
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/chime/service_package.go b/internal/service/chime/service_package.go
index c90fb8ebdef..2ddfe0505ea 100644
--- a/internal/service/chime/service_package.go
+++ b/internal/service/chime/service_package.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package chime
 
 import (
diff --git a/internal/service/chime/service_package_gen.go b/internal/service/chime/service_package_gen.go
index edb1877db1e..e875959ddac 100644
--- a/internal/service/chime/service_package_gen.go
+++ b/internal/service/chime/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	chime_sdkv1 "github.com/aws/aws-sdk-go/service/chime"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -74,4 +75,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*c
 	return chime_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/chime/tags_gen.go b/internal/service/chime/tags_gen.go
index 81d20a7bbee..6e3ad528667 100644
--- a/internal/service/chime/tags_gen.go
+++ b/internal/service/chime/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/chimesdkvoice"
 	"github.com/aws/aws-sdk-go/service/chimesdkvoice/chimesdkvoiceiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -111,6 +113,8 @@ func updateTags(ctx context.Context, conn chimesdkvoiceiface.ChimeSDKVoiceAPI, i
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.ChimeSDKVoice)
 	if len(removedTags) > 0 {
diff --git a/internal/service/chime/voice_connector.go b/internal/service/chime/voice_connector.go
index a4f78cae674..c70245eeeb1 100644
--- a/internal/service/chime/voice_connector.go
+++ b/internal/service/chime/voice_connector.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package chime
 
 import (
@@ -5,7 +8,7 @@ import (
 	"log"
 
 	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/chime"
+	"github.com/aws/aws-sdk-go/service/chimesdkvoice"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
@@ -39,8 +42,8 @@ func ResourceVoiceConnector() *schema.Resource {
 				Type:         schema.TypeString,
 				ForceNew:     true,
 				Optional:     true,
-				Default:      chime.VoiceConnectorAwsRegionUsEast1,
-				ValidateFunc: validation.StringInSlice([]string{chime.VoiceConnectorAwsRegionUsEast1, chime.VoiceConnectorAwsRegionUsWest2}, false),
+				Default:      chimesdkvoice.VoiceConnectorAwsRegionUsEast1,
+				ValidateFunc: validation.StringInSlice([]string{chimesdkvoice.VoiceConnectorAwsRegionUsEast1, chimesdkvoice.VoiceConnectorAwsRegionUsWest2}, false),
 			},
 			"name": {
 				Type:         schema.TypeString,
@@ -65,9 +68,9 @@ func ResourceVoiceConnector() *schema.Resource {
 
 func resourceVoiceConnectorCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).ChimeConn(ctx)
+	conn := meta.(*conns.AWSClient).ChimeSDKVoiceConn(ctx)
 
-	createInput := &chime.CreateVoiceConnectorInput{
+	createInput := &chimesdkvoice.CreateVoiceConnectorInput{
 		Name:              aws.String(d.Get("name").(string)),
 		RequireEncryption: aws.Bool(d.Get("require_encryption").(bool)),
 	}
@@ -93,14 +96,14 @@ func resourceVoiceConnectorCreate(ctx context.Context, d *schema.ResourceData, m
 
 func resourceVoiceConnectorRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).ChimeConn(ctx)
+	conn := meta.(*conns.AWSClient).ChimeSDKVoiceConn(ctx)
 
-	getInput := &chime.GetVoiceConnectorInput{
+	getInput := &chimesdkvoice.GetVoiceConnectorInput{
 		VoiceConnectorId: aws.String(d.Id()),
 	}
 
 	resp, err := conn.GetVoiceConnectorWithContext(ctx, getInput)
-	if !d.IsNewResource() && tfawserr.ErrCodeEquals(err, chime.ErrCodeNotFoundException) {
+	if !d.IsNewResource() && tfawserr.ErrCodeEquals(err, chimesdkvoice.ErrCodeNotFoundException) {
 		log.Printf("[WARN] Chime Voice connector %s not found", d.Id())
 		d.SetId("")
 		return diags
@@ -121,10 +124,10 @@ func resourceVoiceConnectorRead(ctx context.Context, d *schema.ResourceData, met
 
 func resourceVoiceConnectorUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).ChimeConn(ctx)
+	conn := meta.(*conns.AWSClient).ChimeSDKVoiceConn(ctx)
 
 	if d.HasChanges("name", "require_encryption") {
-		updateInput := &chime.UpdateVoiceConnectorInput{
+		updateInput := &chimesdkvoice.UpdateVoiceConnectorInput{
 			VoiceConnectorId:  aws.String(d.Id()),
 			Name:              aws.String(d.Get("name").(string)),
 			RequireEncryption: aws.Bool(d.Get("require_encryption").(bool)),
@@ -140,14 +143,14 @@ func resourceVoiceConnectorUpdate(ctx context.Context, d *schema.ResourceData, m
 
 func resourceVoiceConnectorDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).ChimeConn(ctx)
+	conn := meta.(*conns.AWSClient).ChimeSDKVoiceConn(ctx)
 
-	input := &chime.DeleteVoiceConnectorInput{
+	input := &chimesdkvoice.DeleteVoiceConnectorInput{
 		VoiceConnectorId: aws.String(d.Id()),
 	}
 
 	if _, err := conn.DeleteVoiceConnectorWithContext(ctx, input); err != nil {
-		if tfawserr.ErrCodeEquals(err, chime.ErrCodeNotFoundException) {
+		if tfawserr.ErrCodeEquals(err, chimesdkvoice.ErrCodeNotFoundException) {
 			log.Printf("[WARN] Chime Voice connector %s not found", d.Id())
 			return diags
 		}
diff --git a/internal/service/chime/voice_connector_group.go b/internal/service/chime/voice_connector_group.go
index 02a9d6e9bd7..18ef1c6a2fa 100644
--- a/internal/service/chime/voice_connector_group.go
+++ b/internal/service/chime/voice_connector_group.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package chime
 
 import (
@@ -5,7 +8,7 @@ import (
 	"log"
 
 	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/chime"
+	"github.com/aws/aws-sdk-go/service/chimesdkvoice"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
@@ -55,9 +58,9 @@ func ResourceVoiceConnectorGroup() *schema.Resource {
 }
 
 func resourceVoiceConnectorGroupCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).ChimeConn(ctx)
+	conn := meta.(*conns.AWSClient).ChimeSDKVoiceConn(ctx)
 
-	input := &chime.CreateVoiceConnectorGroupInput{
+	input := &chimesdkvoice.CreateVoiceConnectorGroupInput{
 		Name: aws.String(d.Get("name").(string)),
 	}
 
@@ -76,14 +79,14 @@ func resourceVoiceConnectorGroupCreate(ctx context.Context, d *schema.ResourceDa
 }
 
 func resourceVoiceConnectorGroupRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).ChimeConn(ctx)
+	conn := meta.(*conns.AWSClient).ChimeSDKVoiceConn(ctx)
 
-	getInput := &chime.GetVoiceConnectorGroupInput{
+	getInput := &chimesdkvoice.GetVoiceConnectorGroupInput{
 		VoiceConnectorGroupId: aws.String(d.Id()),
 	}
 
 	resp, err := conn.GetVoiceConnectorGroupWithContext(ctx, getInput)
-	if !d.IsNewResource() && tfawserr.ErrCodeEquals(err, chime.ErrCodeNotFoundException) {
+	if !d.IsNewResource() && tfawserr.ErrCodeEquals(err, chimesdkvoice.ErrCodeNotFoundException) {
 		log.Printf("[WARN] Chime Voice conector group %s not found", d.Id())
 		d.SetId("")
 		return nil
@@ -101,9 +104,9 @@ func resourceVoiceConnectorGroupRead(ctx context.Context, d *schema.ResourceData
 }
 
 func resourceVoiceConnectorGroupUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).ChimeConn(ctx)
+	conn := meta.(*conns.AWSClient).ChimeSDKVoiceConn(ctx)
 
-	input := &chime.UpdateVoiceConnectorGroupInput{
+	input := &chimesdkvoice.UpdateVoiceConnectorGroupInput{
 		Name:                  aws.String(d.Get("name").(string)),
 		VoiceConnectorGroupId: aws.String(d.Id()),
 	}
@@ -113,7 +116,7 @@ func resourceVoiceConnectorGroupUpdate(ctx context.Context, d *schema.ResourceDa
 			input.VoiceConnectorItems = expandVoiceConnectorItems(v.(*schema.Set).List())
 		}
 	} else if !d.IsNewResource() {
-		input.VoiceConnectorItems = make([]*chime.VoiceConnectorItem, 0)
+		input.VoiceConnectorItems = make([]*chimesdkvoice.VoiceConnectorItem, 0)
 	}
 
 	if _, err := conn.UpdateVoiceConnectorGroupWithContext(ctx, input); err != nil {
@@ -124,7 +127,7 @@ func resourceVoiceConnectorGroupUpdate(ctx context.Context, d *schema.ResourceDa
 }
 
 func resourceVoiceConnectorGroupDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).ChimeConn(ctx)
+	conn := meta.(*conns.AWSClient).ChimeSDKVoiceConn(ctx)
 
 	if v, ok := d.GetOk("connector"); ok && v.(*schema.Set).Len() > 0 {
 		if err := resourceVoiceConnectorGroupUpdate(ctx, d, meta); err != nil {
@@ -132,12 +135,12 @@ func resourceVoiceConnectorGroupDelete(ctx context.Context, d *schema.ResourceDa
 		}
 	}
 
-	input := &chime.DeleteVoiceConnectorGroupInput{
+	input := &chimesdkvoice.DeleteVoiceConnectorGroupInput{
 		VoiceConnectorGroupId: aws.String(d.Id()),
 	}
 
 	if _, err := conn.DeleteVoiceConnectorGroupWithContext(ctx, input); err != nil {
-		if tfawserr.ErrCodeEquals(err, chime.ErrCodeNotFoundException) {
+		if tfawserr.ErrCodeEquals(err, chimesdkvoice.ErrCodeNotFoundException) {
 			log.Printf("[WARN] Chime Voice conector group %s not found", d.Id())
 			return nil
 		}
@@ -147,12 +150,12 @@ func resourceVoiceConnectorGroupDelete(ctx context.Context, d *schema.ResourceDa
 	return nil
 }
 
-func expandVoiceConnectorItems(data []interface{}) []*chime.VoiceConnectorItem {
-	var connectorsItems []*chime.VoiceConnectorItem
+func expandVoiceConnectorItems(data []interface{}) []*chimesdkvoice.VoiceConnectorItem {
+	var connectorsItems []*chimesdkvoice.VoiceConnectorItem
 
 	for _, rItem := range data {
 		item := rItem.(map[string]interface{})
-		connectorsItems = append(connectorsItems, &chime.VoiceConnectorItem{
+		connectorsItems = append(connectorsItems, &chimesdkvoice.VoiceConnectorItem{
 			VoiceConnectorId: aws.String(item["voice_connector_id"].(string)),
 			Priority:         aws.Int64(int64(item["priority"].(int))),
 		})
@@ -161,7 +164,7 @@ func expandVoiceConnectorItems(data []interface{}) []*chime.VoiceConnectorItem {
 	return connectorsItems
 }
 
-func flattenVoiceConnectorItems(connectors []*chime.VoiceConnectorItem) []interface{} {
+func flattenVoiceConnectorItems(connectors []*chimesdkvoice.VoiceConnectorItem) []interface{} {
 	var rawConnectors []interface{}
 
 	for _, c := range connectors {
diff --git a/internal/service/chime/voice_connector_group_test.go b/internal/service/chime/voice_connector_group_test.go
index 9bac5b78a92..efea54d40c2 100644
--- a/internal/service/chime/voice_connector_group_test.go
+++ b/internal/service/chime/voice_connector_group_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package chime_test
 
 import (
@@ -6,7 +9,8 @@ import (
 	"testing"
 
 	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/chime"
+	"github.com/aws/aws-sdk-go/aws/endpoints"
+	"github.com/aws/aws-sdk-go/service/chimesdkvoice"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
@@ -15,16 +19,20 @@ import (
 	tfchime "github.com/hashicorp/terraform-provider-aws/internal/service/chime"
 )
 
-func TestAccChimeVoiceConnectorGroup_basic(t *testing.T) {
+func testAccVoiceConnectorGroup_basic(t *testing.T) {
 	ctx := acctest.Context(t)
-	var voiceConnectorGroup *chime.VoiceConnectorGroup
+	var voiceConnectorGroup *chimesdkvoice.VoiceConnectorGroup
 
 	vcgName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_chime_voice_connector_group.test"
 
-	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, chime.EndpointsID),
+	resource.Test(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckRegion(t, endpoints.UsEast1RegionID)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, chimesdkvoice.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckVoiceConnectorGroupDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -46,16 +54,20 @@ func TestAccChimeVoiceConnectorGroup_basic(t *testing.T) {
 	})
 }
 
-func TestAccChimeVoiceConnectorGroup_disappears(t *testing.T) {
+func testAccVoiceConnectorGroup_disappears(t *testing.T) {
 	ctx := acctest.Context(t)
-	var voiceConnectorGroup *chime.VoiceConnectorGroup
+	var voiceConnectorGroup *chimesdkvoice.VoiceConnectorGroup
 
 	vcgName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_chime_voice_connector_group.test"
 
-	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, chime.EndpointsID),
+	resource.Test(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckRegion(t, endpoints.UsEast1RegionID)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, chimesdkvoice.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckVoiceConnectorGroupDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -71,16 +83,20 @@ func TestAccChimeVoiceConnectorGroup_disappears(t *testing.T) {
 	})
 }
 
-func TestAccChimeVoiceConnectorGroup_update(t *testing.T) {
+func testAccVoiceConnectorGroup_update(t *testing.T) {
 	ctx := acctest.Context(t)
-	var voiceConnectorGroup *chime.VoiceConnectorGroup
+	var voiceConnectorGroup *chimesdkvoice.VoiceConnectorGroup
 
 	vcgName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_chime_voice_connector_group.test"
 
-	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, chime.EndpointsID),
+	resource.Test(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckRegion(t, endpoints.UsEast1RegionID)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, chimesdkvoice.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckVoiceConnectorGroupDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -96,7 +112,7 @@ func TestAccChimeVoiceConnectorGroup_update(t *testing.T) {
 				Config: testAccVoiceConnectorGroupConfig_updated(vcgName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					resource.TestCheckResourceAttr(resourceName, "name", fmt.Sprintf("vcg-updated-%s", vcgName)),
-					resource.TestCheckResourceAttr(resourceName, "connector.0.priority", "10"),
+					resource.TestCheckResourceAttr(resourceName, "connector.0.priority", "3"),
 				),
 			},
 			{
@@ -138,13 +154,13 @@ resource "aws_chime_voice_connector_group" "test" {
 
   connector {
     voice_connector_id = aws_chime_voice_connector.chime.id
-    priority           = 10
+    priority           = 3
   }
 }
 `, name)
 }
 
-func testAccCheckVoiceConnectorGroupExists(ctx context.Context, name string, vc *chime.VoiceConnectorGroup) resource.TestCheckFunc {
+func testAccCheckVoiceConnectorGroupExists(ctx context.Context, name string, vc *chimesdkvoice.VoiceConnectorGroup) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		rs, ok := s.RootModule().Resources[name]
 		if !ok {
@@ -155,8 +171,8 @@ func testAccCheckVoiceConnectorGroupExists(ctx context.Context, name string, vc
 			return fmt.Errorf("no Chime voice connector group ID is set")
 		}
 
-		conn := acctest.Provider.Meta().(*conns.AWSClient).ChimeConn(ctx)
-		input := &chime.GetVoiceConnectorGroupInput{
+		conn := acctest.Provider.Meta().(*conns.AWSClient).ChimeSDKVoiceConn(ctx)
+		input := &chimesdkvoice.GetVoiceConnectorGroupInput{
 			VoiceConnectorGroupId: aws.String(rs.Primary.ID),
 		}
 
@@ -176,8 +192,8 @@ func testAccCheckVoiceConnectorGroupDestroy(ctx context.Context) resource.TestCh
 			if rs.Type != "aws_chime_voice_connector" {
 				continue
 			}
-			conn := acctest.Provider.Meta().(*conns.AWSClient).ChimeConn(ctx)
-			input := &chime.GetVoiceConnectorGroupInput{
+			conn := acctest.Provider.Meta().(*conns.AWSClient).ChimeSDKVoiceConn(ctx)
+			input := &chimesdkvoice.GetVoiceConnectorGroupInput{
 				VoiceConnectorGroupId: aws.String(rs.Primary.ID),
 			}
 			resp, err := conn.GetVoiceConnectorGroupWithContext(ctx, input)
diff --git a/internal/service/chime/voice_connector_logging.go b/internal/service/chime/voice_connector_logging.go
index 7343dfd0676..b19cbc78123 100644
--- a/internal/service/chime/voice_connector_logging.go
+++ b/internal/service/chime/voice_connector_logging.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package chime
 
 import (
@@ -5,7 +8,7 @@ import (
 	"log"
 
 	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/chime"
+	"github.com/aws/aws-sdk-go/service/chimesdkvoice"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
@@ -45,12 +48,12 @@ func ResourceVoiceConnectorLogging() *schema.Resource {
 }
 
 func resourceVoiceConnectorLoggingCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).ChimeConn(ctx)
+	conn := meta.(*conns.AWSClient).ChimeSDKVoiceConn(ctx)
 
 	vcId := d.Get("voice_connector_id").(string)
-	input := &chime.PutVoiceConnectorLoggingConfigurationInput{
+	input := &chimesdkvoice.PutVoiceConnectorLoggingConfigurationInput{
 		VoiceConnectorId: aws.String(vcId),
-		LoggingConfiguration: &chime.LoggingConfiguration{
+		LoggingConfiguration: &chimesdkvoice.LoggingConfiguration{
 			EnableMediaMetricLogs: aws.Bool(d.Get("enable_media_metric_logs").(bool)),
 			EnableSIPLogs:         aws.Bool(d.Get("enable_sip_logs").(bool)),
 		},
@@ -65,14 +68,14 @@ func resourceVoiceConnectorLoggingCreate(ctx context.Context, d *schema.Resource
 }
 
 func resourceVoiceConnectorLoggingRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).ChimeConn(ctx)
+	conn := meta.(*conns.AWSClient).ChimeSDKVoiceConn(ctx)
 
-	input := &chime.GetVoiceConnectorLoggingConfigurationInput{
+	input := &chimesdkvoice.GetVoiceConnectorLoggingConfigurationInput{
 		VoiceConnectorId: aws.String(d.Id()),
 	}
 
 	resp, err := conn.GetVoiceConnectorLoggingConfigurationWithContext(ctx, input)
-	if !d.IsNewResource() && tfawserr.ErrCodeEquals(err, chime.ErrCodeNotFoundException) {
+	if !d.IsNewResource() && tfawserr.ErrCodeEquals(err, chimesdkvoice.ErrCodeNotFoundException) {
 		log.Printf("[WARN] Chime Voice Connector logging configuration %s not found", d.Id())
 		d.SetId("")
 		return nil
@@ -89,12 +92,12 @@ func resourceVoiceConnectorLoggingRead(ctx context.Context, d *schema.ResourceDa
 }
 
 func resourceVoiceConnectorLoggingUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).ChimeConn(ctx)
+	conn := meta.(*conns.AWSClient).ChimeSDKVoiceConn(ctx)
 
 	if d.HasChanges("enable_sip_logs", "enable_media_metric_logs") {
-		input := &chime.PutVoiceConnectorLoggingConfigurationInput{
+		input := &chimesdkvoice.PutVoiceConnectorLoggingConfigurationInput{
 			VoiceConnectorId: aws.String(d.Id()),
-			LoggingConfiguration: &chime.LoggingConfiguration{
+			LoggingConfiguration: &chimesdkvoice.LoggingConfiguration{
 				EnableMediaMetricLogs: aws.Bool(d.Get("enable_media_metric_logs").(bool)),
 				EnableSIPLogs:         aws.Bool(d.Get("enable_sip_logs").(bool)),
 			},
@@ -109,11 +112,11 @@ func resourceVoiceConnectorLoggingUpdate(ctx context.Context, d *schema.Resource
 }
 
 func resourceVoiceConnectorLoggingDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).ChimeConn(ctx)
+	conn := meta.(*conns.AWSClient).ChimeSDKVoiceConn(ctx)
 
-	input := &chime.PutVoiceConnectorLoggingConfigurationInput{
+	input := &chimesdkvoice.PutVoiceConnectorLoggingConfigurationInput{
 		VoiceConnectorId: aws.String(d.Id()),
-		LoggingConfiguration: &chime.LoggingConfiguration{
+		LoggingConfiguration: &chimesdkvoice.LoggingConfiguration{
 			EnableSIPLogs:         aws.Bool(false),
 			EnableMediaMetricLogs: aws.Bool(false),
 		},
@@ -121,7 +124,7 @@ func resourceVoiceConnectorLoggingDelete(ctx context.Context, d *schema.Resource
 
 	_, err := conn.PutVoiceConnectorLoggingConfigurationWithContext(ctx, input)
 
-	if tfawserr.ErrCodeEquals(err, chime.ErrCodeNotFoundException) {
+	if tfawserr.ErrCodeEquals(err, chimesdkvoice.ErrCodeNotFoundException) {
 		return nil
 	}
 
diff --git a/internal/service/chime/voice_connector_logging_test.go b/internal/service/chime/voice_connector_logging_test.go
index 30dffc9f472..e4c1054a91a 100644
--- a/internal/service/chime/voice_connector_logging_test.go
+++ b/internal/service/chime/voice_connector_logging_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package chime_test
 
 import (
@@ -6,7 +9,8 @@ import (
 	"testing"
 
 	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/chime"
+	"github.com/aws/aws-sdk-go/aws/endpoints"
+	"github.com/aws/aws-sdk-go/service/chimesdkvoice"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
@@ -15,14 +19,18 @@ import (
 	tfchime "github.com/hashicorp/terraform-provider-aws/internal/service/chime"
 )
 
-func TestAccChimeVoiceConnectorLogging_basic(t *testing.T) {
+func testAccVoiceConnectorLogging_basic(t *testing.T) {
 	ctx := acctest.Context(t)
 	name := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_chime_voice_connector_logging.test"
 
-	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, chime.EndpointsID),
+	resource.Test(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckRegion(t, endpoints.UsEast1RegionID)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, chimesdkvoice.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckVoiceConnectorDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -43,14 +51,18 @@ func TestAccChimeVoiceConnectorLogging_basic(t *testing.T) {
 	})
 }
 
-func TestAccChimeVoiceConnectorLogging_disappears(t *testing.T) {
+func testAccVoiceConnectorLogging_disappears(t *testing.T) {
 	ctx := acctest.Context(t)
 	name := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_chime_voice_connector_logging.test"
 
-	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, chime.EndpointsID),
+	resource.Test(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckRegion(t, endpoints.UsEast1RegionID)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, chimesdkvoice.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckVoiceConnectorDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -66,14 +78,18 @@ func TestAccChimeVoiceConnectorLogging_disappears(t *testing.T) {
 	})
 }
 
-func TestAccChimeVoiceConnectorLogging_update(t *testing.T) {
+func testAccVoiceConnectorLogging_update(t *testing.T) {
 	ctx := acctest.Context(t)
 	name := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_chime_voice_connector_logging.test"
 
-	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, chime.EndpointsID),
+	resource.Test(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckRegion(t, endpoints.UsEast1RegionID)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, chimesdkvoice.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckVoiceConnectorDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -141,8 +157,8 @@ func testAccCheckVoiceConnectorLoggingExists(ctx context.Context, name string) r
 			return fmt.Errorf("no Chime Voice Connector logging ID is set")
 		}
 
-		conn := acctest.Provider.Meta().(*conns.AWSClient).ChimeConn(ctx)
-		input := &chime.GetVoiceConnectorLoggingConfigurationInput{
+		conn := acctest.Provider.Meta().(*conns.AWSClient).ChimeSDKVoiceConn(ctx)
+		input := &chimesdkvoice.GetVoiceConnectorLoggingConfigurationInput{
 			VoiceConnectorId: aws.String(rs.Primary.ID),
 		}
 
diff --git a/internal/service/chime/voice_connector_origination.go b/internal/service/chime/voice_connector_origination.go
index a0532f43953..01cb78dbccf 100644
--- a/internal/service/chime/voice_connector_origination.go
+++ b/internal/service/chime/voice_connector_origination.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package chime
 
 import (
@@ -5,7 +8,7 @@ import (
 	"log"
 
 	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/chime"
+	"github.com/aws/aws-sdk-go/service/chimesdkvoice"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
@@ -56,7 +59,7 @@ func ResourceVoiceConnectorOrigination() *schema.Resource {
 						"protocol": {
 							Type:         schema.TypeString,
 							Required:     true,
-							ValidateFunc: validation.StringInSlice(chime.OriginationRouteProtocol_Values(), false),
+							ValidateFunc: validation.StringInSlice(chimesdkvoice.OriginationRouteProtocol_Values(), false),
 						},
 						"weight": {
 							Type:         schema.TypeInt,
@@ -76,13 +79,13 @@ func ResourceVoiceConnectorOrigination() *schema.Resource {
 }
 
 func resourceVoiceConnectorOriginationCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).ChimeConn(ctx)
+	conn := meta.(*conns.AWSClient).ChimeSDKVoiceConn(ctx)
 
 	vcId := d.Get("voice_connector_id").(string)
 
-	input := &chime.PutVoiceConnectorOriginationInput{
+	input := &chimesdkvoice.PutVoiceConnectorOriginationInput{
 		VoiceConnectorId: aws.String(vcId),
-		Origination: &chime.Origination{
+		Origination: &chimesdkvoice.Origination{
 			Routes: expandOriginationRoutes(d.Get("route").(*schema.Set).List()),
 		},
 	}
@@ -101,15 +104,15 @@ func resourceVoiceConnectorOriginationCreate(ctx context.Context, d *schema.Reso
 }
 
 func resourceVoiceConnectorOriginationRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).ChimeConn(ctx)
+	conn := meta.(*conns.AWSClient).ChimeSDKVoiceConn(ctx)
 
-	input := &chime.GetVoiceConnectorOriginationInput{
+	input := &chimesdkvoice.GetVoiceConnectorOriginationInput{
 		VoiceConnectorId: aws.String(d.Id()),
 	}
 
 	resp, err := conn.GetVoiceConnectorOriginationWithContext(ctx, input)
 
-	if !d.IsNewResource() && tfawserr.ErrCodeEquals(err, chime.ErrCodeNotFoundException) {
+	if !d.IsNewResource() && tfawserr.ErrCodeEquals(err, chimesdkvoice.ErrCodeNotFoundException) {
 		log.Printf("[WARN] Chime Voice Connector (%s) origination not found, removing from state", d.Id())
 		d.SetId("")
 		return nil
@@ -134,12 +137,12 @@ func resourceVoiceConnectorOriginationRead(ctx context.Context, d *schema.Resour
 }
 
 func resourceVoiceConnectorOriginationUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).ChimeConn(ctx)
+	conn := meta.(*conns.AWSClient).ChimeSDKVoiceConn(ctx)
 
 	if d.HasChanges("route", "disabled") {
-		input := &chime.PutVoiceConnectorOriginationInput{
+		input := &chimesdkvoice.PutVoiceConnectorOriginationInput{
 			VoiceConnectorId: aws.String(d.Id()),
-			Origination: &chime.Origination{
+			Origination: &chimesdkvoice.Origination{
 				Routes: expandOriginationRoutes(d.Get("route").(*schema.Set).List()),
 			},
 		}
@@ -159,15 +162,15 @@ func resourceVoiceConnectorOriginationUpdate(ctx context.Context, d *schema.Reso
 }
 
 func resourceVoiceConnectorOriginationDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).ChimeConn(ctx)
+	conn := meta.(*conns.AWSClient).ChimeSDKVoiceConn(ctx)
 
-	input := &chime.DeleteVoiceConnectorOriginationInput{
+	input := &chimesdkvoice.DeleteVoiceConnectorOriginationInput{
 		VoiceConnectorId: aws.String(d.Id()),
 	}
 
 	_, err := conn.DeleteVoiceConnectorOriginationWithContext(ctx, input)
 
-	if tfawserr.ErrCodeEquals(err, chime.ErrCodeNotFoundException) {
+	if tfawserr.ErrCodeEquals(err, chimesdkvoice.ErrCodeNotFoundException) {
 		return nil
 	}
 
@@ -178,12 +181,12 @@ func resourceVoiceConnectorOriginationDelete(ctx context.Context, d *schema.Reso
 	return nil
 }
 
-func expandOriginationRoutes(data []interface{}) []*chime.OriginationRoute {
-	var originationRoutes []*chime.OriginationRoute
+func expandOriginationRoutes(data []interface{}) []*chimesdkvoice.OriginationRoute {
+	var originationRoutes []*chimesdkvoice.OriginationRoute
 
 	for _, rItem := range data {
 		item := rItem.(map[string]interface{})
-		originationRoutes = append(originationRoutes, &chime.OriginationRoute{
+		originationRoutes = append(originationRoutes, &chimesdkvoice.OriginationRoute{
 			Host:     aws.String(item["host"].(string)),
 			Port:     aws.Int64(int64(item["port"].(int))),
 			Priority: aws.Int64(int64(item["priority"].(int))),
@@ -195,7 +198,7 @@ func expandOriginationRoutes(data []interface{}) []*chime.OriginationRoute {
 	return originationRoutes
 }
 
-func flattenOriginationRoutes(routes []*chime.OriginationRoute) []interface{} {
+func flattenOriginationRoutes(routes []*chimesdkvoice.OriginationRoute) []interface{} {
 	var rawRoutes []interface{}
 
 	for _, route := range routes {
diff --git a/internal/service/chime/voice_connector_origination_test.go b/internal/service/chime/voice_connector_origination_test.go
index bd22ac06fda..b908debd255 100644
--- a/internal/service/chime/voice_connector_origination_test.go
+++ b/internal/service/chime/voice_connector_origination_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package chime_test
 
 import (
@@ -6,7 +9,8 @@ import (
 	"testing"
 
 	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/chime"
+	"github.com/aws/aws-sdk-go/aws/endpoints"
+	"github.com/aws/aws-sdk-go/service/chimesdkvoice"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -16,14 +20,18 @@ import (
 	tfchime "github.com/hashicorp/terraform-provider-aws/internal/service/chime"
 )
 
-func TestAccChimeVoiceConnectorOrigination_basic(t *testing.T) {
+func testAccVoiceConnectorOrigination_basic(t *testing.T) {
 	ctx := acctest.Context(t)
 	name := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_chime_voice_connector_origination.test"
 
-	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, chime.EndpointsID),
+	resource.Test(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckRegion(t, endpoints.UsEast1RegionID)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, chimesdkvoice.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckVoiceConnectorOriginationDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -47,14 +55,18 @@ func TestAccChimeVoiceConnectorOrigination_basic(t *testing.T) {
 	})
 }
 
-func TestAccChimeVoiceConnectorOrigination_disappears(t *testing.T) {
+func testAccVoiceConnectorOrigination_disappears(t *testing.T) {
 	ctx := acctest.Context(t)
 	name := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_chime_voice_connector_origination.test"
 
-	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, chime.EndpointsID),
+	resource.Test(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckRegion(t, endpoints.UsEast1RegionID)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, chimesdkvoice.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckVoiceConnectorOriginationDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -70,14 +82,18 @@ func TestAccChimeVoiceConnectorOrigination_disappears(t *testing.T) {
 	})
 }
 
-func TestAccChimeVoiceConnectorOrigination_update(t *testing.T) {
+func testAccVoiceConnectorOrigination_update(t *testing.T) {
 	ctx := acctest.Context(t)
 	name := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_chime_voice_connector_origination.test"
 
-	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, chime.EndpointsID),
+	resource.Test(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckRegion(t, endpoints.UsEast1RegionID)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, chimesdkvoice.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckVoiceConnectorOriginationDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -124,8 +140,8 @@ func testAccCheckVoiceConnectorOriginationExists(ctx context.Context, name strin
 			return fmt.Errorf("no Chime voice connector origination ID is set")
 		}
 
-		conn := acctest.Provider.Meta().(*conns.AWSClient).ChimeConn(ctx)
-		input := &chime.GetVoiceConnectorOriginationInput{
+		conn := acctest.Provider.Meta().(*conns.AWSClient).ChimeSDKVoiceConn(ctx)
+		input := &chimesdkvoice.GetVoiceConnectorOriginationInput{
 			VoiceConnectorId: aws.String(rs.Primary.ID),
 		}
 
@@ -148,14 +164,14 @@ func testAccCheckVoiceConnectorOriginationDestroy(ctx context.Context) resource.
 			if rs.Type != "aws_chime_voice_connector_origination" {
 				continue
 			}
-			conn := acctest.Provider.Meta().(*conns.AWSClient).ChimeConn(ctx)
-			input := &chime.GetVoiceConnectorOriginationInput{
+			conn := acctest.Provider.Meta().(*conns.AWSClient).ChimeSDKVoiceConn(ctx)
+			input := &chimesdkvoice.GetVoiceConnectorOriginationInput{
 				VoiceConnectorId: aws.String(rs.Primary.ID),
 			}
 
 			resp, err := conn.GetVoiceConnectorOriginationWithContext(ctx, input)
 
-			if tfawserr.ErrCodeEquals(err, chime.ErrCodeNotFoundException) {
+			if tfawserr.ErrCodeEquals(err, chimesdkvoice.ErrCodeNotFoundException) {
 				continue
 			}
 
diff --git a/internal/service/chime/voice_connector_streaming.go b/internal/service/chime/voice_connector_streaming.go
index cd2702c5ca5..f71196256df 100644
--- a/internal/service/chime/voice_connector_streaming.go
+++ b/internal/service/chime/voice_connector_streaming.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package chime
 
 import (
diff --git a/internal/service/chime/voice_connector_streaming_test.go b/internal/service/chime/voice_connector_streaming_test.go
index 56c5b97f71f..4c08316ada3 100644
--- a/internal/service/chime/voice_connector_streaming_test.go
+++ b/internal/service/chime/voice_connector_streaming_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package chime_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/chime"
 	"github.com/aws/aws-sdk-go/service/chimesdkvoice"
@@ -24,7 +27,10 @@ func TestAccChimeVoiceConnectorStreaming_basic(t *testing.T) {
 	resourceName := "aws_chime_voice_connector_streaming.test"
 
 	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			testAccPreCheck(ctx, t)
+		},
 		ErrorCheck:               acctest.ErrorCheck(t, chime.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckVoiceConnectorStreamingDestroy(ctx),
@@ -53,7 +59,10 @@ func TestAccChimeVoiceConnectorStreaming_disappears(t *testing.T) {
 	resourceName := "aws_chime_voice_connector_streaming.test"
 
 	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			testAccPreCheck(ctx, t)
+		},
 		ErrorCheck:               acctest.ErrorCheck(t, chime.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckVoiceConnectorStreamingDestroy(ctx),
@@ -76,7 +85,10 @@ func TestAccChimeVoiceConnectorStreaming_update(t *testing.T) {
 	resourceName := "aws_chime_voice_connector_streaming.test"
 
 	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			testAccPreCheck(ctx, t)
+		},
 		ErrorCheck:               acctest.ErrorCheck(t, chime.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckVoiceConnectorStreamingDestroy(ctx),
@@ -98,7 +110,7 @@ func TestAccChimeVoiceConnectorStreaming_update(t *testing.T) {
 					acctest.MatchResourceAttrRegionalARN(resourceName,
 						"media_insights_configuration.0.configuration_arn",
 						"chime",
-						regexp.MustCompile(fmt.Sprintf(`media-insights-pipeline-configuration/test-config-%s`, name)),
+						regexache.MustCompile(fmt.Sprintf(`media-insights-pipeline-configuration/test-config-%s`, name)),
 					),
 				),
 			},
diff --git a/internal/service/chime/voice_connector_termination.go b/internal/service/chime/voice_connector_termination.go
index 502c39fdd84..ccc46db20cd 100644
--- a/internal/service/chime/voice_connector_termination.go
+++ b/internal/service/chime/voice_connector_termination.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package chime
 
 import (
 	"context"
 	"log"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/chime"
+	"github.com/aws/aws-sdk-go/service/chimesdkvoice"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
@@ -55,7 +58,7 @@ func ResourceVoiceConnectorTermination() *schema.Resource {
 			"default_phone_number": {
 				Type:         schema.TypeString,
 				Optional:     true,
-				ValidateFunc: validation.StringMatch(regexp.MustCompile(`^\+?[1-9]\d{1,14}$`), "must match ^\\+?[1-9]\\d{1,14}$"),
+				ValidateFunc: validation.StringMatch(regexache.MustCompile(`^\+?[1-9]\d{1,14}$`), "must match ^\\+?[1-9]\\d{1,14}$"),
 			},
 			"disabled": {
 				Type:     schema.TypeBool,
@@ -71,15 +74,15 @@ func ResourceVoiceConnectorTermination() *schema.Resource {
 }
 
 func resourceVoiceConnectorTerminationCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).ChimeConn(ctx)
+	conn := meta.(*conns.AWSClient).ChimeSDKVoiceConn(ctx)
 
 	vcId := d.Get("voice_connector_id").(string)
 
-	input := &chime.PutVoiceConnectorTerminationInput{
+	input := &chimesdkvoice.PutVoiceConnectorTerminationInput{
 		VoiceConnectorId: aws.String(vcId),
 	}
 
-	termination := &chime.Termination{
+	termination := &chimesdkvoice.Termination{
 		CidrAllowedList: flex.ExpandStringSet(d.Get("cidr_allow_list").(*schema.Set)),
 		CallingRegions:  flex.ExpandStringSet(d.Get("calling_regions").(*schema.Set)),
 	}
@@ -108,15 +111,15 @@ func resourceVoiceConnectorTerminationCreate(ctx context.Context, d *schema.Reso
 }
 
 func resourceVoiceConnectorTerminationRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).ChimeConn(ctx)
+	conn := meta.(*conns.AWSClient).ChimeSDKVoiceConn(ctx)
 
-	input := &chime.GetVoiceConnectorTerminationInput{
+	input := &chimesdkvoice.GetVoiceConnectorTerminationInput{
 		VoiceConnectorId: aws.String(d.Id()),
 	}
 
 	resp, err := conn.GetVoiceConnectorTerminationWithContext(ctx, input)
 
-	if !d.IsNewResource() && tfawserr.ErrCodeEquals(err, chime.ErrCodeNotFoundException) {
+	if !d.IsNewResource() && tfawserr.ErrCodeEquals(err, chimesdkvoice.ErrCodeNotFoundException) {
 		log.Printf("[WARN] Chime Voice Connector (%s) termination not found, removing from state", d.Id())
 		d.SetId("")
 		return nil
@@ -147,10 +150,10 @@ func resourceVoiceConnectorTerminationRead(ctx context.Context, d *schema.Resour
 }
 
 func resourceVoiceConnectorTerminationUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).ChimeConn(ctx)
+	conn := meta.(*conns.AWSClient).ChimeSDKVoiceConn(ctx)
 
 	if d.HasChanges("calling_regions", "cidr_allow_list", "disabled", "cps_limit", "default_phone_number") {
-		termination := &chime.Termination{
+		termination := &chimesdkvoice.Termination{
 			CallingRegions:  flex.ExpandStringSet(d.Get("calling_regions").(*schema.Set)),
 			CidrAllowedList: flex.ExpandStringSet(d.Get("cidr_allow_list").(*schema.Set)),
 			CpsLimit:        aws.Int64(int64(d.Get("cps_limit").(int))),
@@ -164,7 +167,7 @@ func resourceVoiceConnectorTerminationUpdate(ctx context.Context, d *schema.Reso
 			termination.Disabled = aws.Bool(v.(bool))
 		}
 
-		input := &chime.PutVoiceConnectorTerminationInput{
+		input := &chimesdkvoice.PutVoiceConnectorTerminationInput{
 			VoiceConnectorId: aws.String(d.Id()),
 			Termination:      termination,
 		}
@@ -180,15 +183,15 @@ func resourceVoiceConnectorTerminationUpdate(ctx context.Context, d *schema.Reso
 }
 
 func resourceVoiceConnectorTerminationDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).ChimeConn(ctx)
+	conn := meta.(*conns.AWSClient).ChimeSDKVoiceConn(ctx)
 
-	input := &chime.DeleteVoiceConnectorTerminationInput{
+	input := &chimesdkvoice.DeleteVoiceConnectorTerminationInput{
 		VoiceConnectorId: aws.String(d.Id()),
 	}
 
 	_, err := conn.DeleteVoiceConnectorTerminationWithContext(ctx, input)
 
-	if tfawserr.ErrCodeEquals(err, chime.ErrCodeNotFoundException) {
+	if tfawserr.ErrCodeEquals(err, chimesdkvoice.ErrCodeNotFoundException) {
 		return nil
 	}
 
diff --git a/internal/service/chime/voice_connector_termination_credentials.go b/internal/service/chime/voice_connector_termination_credentials.go
index e05668c56d5..81b98786ddc 100644
--- a/internal/service/chime/voice_connector_termination_credentials.go
+++ b/internal/service/chime/voice_connector_termination_credentials.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package chime
 
 import (
@@ -5,7 +8,7 @@ import (
 	"log"
 
 	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/chime"
+	"github.com/aws/aws-sdk-go/service/chimesdkvoice"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
@@ -57,11 +60,11 @@ func ResourceVoiceConnectorTerminationCredentials() *schema.Resource {
 }
 
 func resourceVoiceConnectorTerminationCredentialsCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).ChimeConn(ctx)
+	conn := meta.(*conns.AWSClient).ChimeSDKVoiceConn(ctx)
 
 	vcId := d.Get("voice_connector_id").(string)
 
-	input := &chime.PutVoiceConnectorTerminationCredentialsInput{
+	input := &chimesdkvoice.PutVoiceConnectorTerminationCredentialsInput{
 		VoiceConnectorId: aws.String(vcId),
 		Credentials:      expandCredentials(d.Get("credentials").(*schema.Set).List()),
 	}
@@ -76,14 +79,14 @@ func resourceVoiceConnectorTerminationCredentialsCreate(ctx context.Context, d *
 }
 
 func resourceVoiceConnectorTerminationCredentialsRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).ChimeConn(ctx)
+	conn := meta.(*conns.AWSClient).ChimeSDKVoiceConn(ctx)
 
-	input := &chime.ListVoiceConnectorTerminationCredentialsInput{
+	input := &chimesdkvoice.ListVoiceConnectorTerminationCredentialsInput{
 		VoiceConnectorId: aws.String(d.Id()),
 	}
 
 	_, err := conn.ListVoiceConnectorTerminationCredentialsWithContext(ctx, input)
-	if !d.IsNewResource() && tfawserr.ErrCodeEquals(err, chime.ErrCodeNotFoundException) {
+	if !d.IsNewResource() && tfawserr.ErrCodeEquals(err, chimesdkvoice.ErrCodeNotFoundException) {
 		log.Printf("[WARN] Chime Voice Connector (%s) termination credentials not found, removing from state", d.Id())
 		d.SetId("")
 		return nil
@@ -99,10 +102,10 @@ func resourceVoiceConnectorTerminationCredentialsRead(ctx context.Context, d *sc
 }
 
 func resourceVoiceConnectorTerminationCredentialsUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).ChimeConn(ctx)
+	conn := meta.(*conns.AWSClient).ChimeSDKVoiceConn(ctx)
 
 	if d.HasChanges("credentials") {
-		input := &chime.PutVoiceConnectorTerminationCredentialsInput{
+		input := &chimesdkvoice.PutVoiceConnectorTerminationCredentialsInput{
 			VoiceConnectorId: aws.String(d.Id()),
 			Credentials:      expandCredentials(d.Get("credentials").(*schema.Set).List()),
 		}
@@ -118,16 +121,16 @@ func resourceVoiceConnectorTerminationCredentialsUpdate(ctx context.Context, d *
 }
 
 func resourceVoiceConnectorTerminationCredentialsDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).ChimeConn(ctx)
+	conn := meta.(*conns.AWSClient).ChimeSDKVoiceConn(ctx)
 
-	input := &chime.DeleteVoiceConnectorTerminationCredentialsInput{
+	input := &chimesdkvoice.DeleteVoiceConnectorTerminationCredentialsInput{
 		VoiceConnectorId: aws.String(d.Id()),
 		Usernames:        expandCredentialsUsernames(d.Get("credentials").(*schema.Set).List()),
 	}
 
 	_, err := conn.DeleteVoiceConnectorTerminationCredentialsWithContext(ctx, input)
 
-	if tfawserr.ErrCodeEquals(err, chime.ErrCodeNotFoundException) {
+	if tfawserr.ErrCodeEquals(err, chimesdkvoice.ErrCodeNotFoundException) {
 		return nil
 	}
 
@@ -149,12 +152,12 @@ func expandCredentialsUsernames(data []interface{}) []*string {
 	return rawNames
 }
 
-func expandCredentials(data []interface{}) []*chime.Credential {
-	var credentials []*chime.Credential
+func expandCredentials(data []interface{}) []*chimesdkvoice.Credential {
+	var credentials []*chimesdkvoice.Credential
 
 	for _, rItem := range data {
 		item := rItem.(map[string]interface{})
-		credentials = append(credentials, &chime.Credential{
+		credentials = append(credentials, &chimesdkvoice.Credential{
 			Username: aws.String(item["username"].(string)),
 			Password: aws.String(item["password"].(string)),
 		})
diff --git a/internal/service/chime/voice_connector_termination_credentials_test.go b/internal/service/chime/voice_connector_termination_credentials_test.go
index e7c60dd0690..db12d4895c8 100644
--- a/internal/service/chime/voice_connector_termination_credentials_test.go
+++ b/internal/service/chime/voice_connector_termination_credentials_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package chime_test
 
 import (
@@ -6,7 +9,8 @@ import (
 	"testing"
 
 	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/chime"
+	"github.com/aws/aws-sdk-go/aws/endpoints"
+	"github.com/aws/aws-sdk-go/service/chimesdkvoice"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -16,14 +20,18 @@ import (
 	tfchime "github.com/hashicorp/terraform-provider-aws/internal/service/chime"
 )
 
-func TestAccChimeVoiceConnectorTerminationCredentials_basic(t *testing.T) {
+func testAccVoiceConnectorTerminationCredentials_basic(t *testing.T) {
 	ctx := acctest.Context(t)
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_chime_voice_connector_termination_credentials.test"
 
-	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, chime.EndpointsID),
+	resource.Test(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckRegion(t, endpoints.UsEast1RegionID)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, chimesdkvoice.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckVoiceConnectorTerminationCredentialsDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -44,14 +52,18 @@ func TestAccChimeVoiceConnectorTerminationCredentials_basic(t *testing.T) {
 	})
 }
 
-func TestAccChimeVoiceConnectorTerminationCredentials_disappears(t *testing.T) {
+func testAccVoiceConnectorTerminationCredentials_disappears(t *testing.T) {
 	ctx := acctest.Context(t)
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_chime_voice_connector_termination_credentials.test"
 
-	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, chime.EndpointsID),
+	resource.Test(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckRegion(t, endpoints.UsEast1RegionID)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, chimesdkvoice.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckVoiceConnectorTerminationCredentialsDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -67,14 +79,18 @@ func TestAccChimeVoiceConnectorTerminationCredentials_disappears(t *testing.T) {
 	})
 }
 
-func TestAccChimeVoiceConnectorTerminationCredentials_update(t *testing.T) {
+func testAccVoiceConnectorTerminationCredentials_update(t *testing.T) {
 	ctx := acctest.Context(t)
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_chime_voice_connector_termination_credentials.test"
 
-	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, chime.EndpointsID),
+	resource.Test(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckRegion(t, endpoints.UsEast1RegionID)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, chimesdkvoice.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckVoiceConnectorTerminationCredentialsDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -107,8 +123,8 @@ func testAccCheckVoiceConnectorTerminationCredentialsExists(ctx context.Context,
 			return fmt.Errorf("no Chime Voice Connector termination credentials ID is set")
 		}
 
-		conn := acctest.Provider.Meta().(*conns.AWSClient).ChimeConn(ctx)
-		input := &chime.ListVoiceConnectorTerminationCredentialsInput{
+		conn := acctest.Provider.Meta().(*conns.AWSClient).ChimeSDKVoiceConn(ctx)
+		input := &chimesdkvoice.ListVoiceConnectorTerminationCredentialsInput{
 			VoiceConnectorId: aws.String(rs.Primary.ID),
 		}
 
@@ -131,13 +147,13 @@ func testAccCheckVoiceConnectorTerminationCredentialsDestroy(ctx context.Context
 			if rs.Type != "aws_chime_voice_connector_termination_credentials" {
 				continue
 			}
-			conn := acctest.Provider.Meta().(*conns.AWSClient).ChimeConn(ctx)
-			input := &chime.ListVoiceConnectorTerminationCredentialsInput{
+			conn := acctest.Provider.Meta().(*conns.AWSClient).ChimeSDKVoiceConn(ctx)
+			input := &chimesdkvoice.ListVoiceConnectorTerminationCredentialsInput{
 				VoiceConnectorId: aws.String(rs.Primary.ID),
 			}
 			resp, err := conn.ListVoiceConnectorTerminationCredentialsWithContext(ctx, input)
 
-			if tfawserr.ErrCodeEquals(err, chime.ErrCodeNotFoundException) {
+			if tfawserr.ErrCodeEquals(err, chimesdkvoice.ErrCodeNotFoundException) {
 				continue
 			}
 
diff --git a/internal/service/chime/voice_connector_termination_test.go b/internal/service/chime/voice_connector_termination_test.go
index 24c5faabd40..e9c9c333fe4 100644
--- a/internal/service/chime/voice_connector_termination_test.go
+++ b/internal/service/chime/voice_connector_termination_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package chime_test
 
 import (
@@ -6,7 +9,8 @@ import (
 	"testing"
 
 	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/chime"
+	"github.com/aws/aws-sdk-go/aws/endpoints"
+	"github.com/aws/aws-sdk-go/service/chimesdkvoice"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -16,14 +20,18 @@ import (
 	tfchime "github.com/hashicorp/terraform-provider-aws/internal/service/chime"
 )
 
-func TestAccChimeVoiceConnectorTermination_basic(t *testing.T) {
+func testAccVoiceConnectorTermination_basic(t *testing.T) {
 	ctx := acctest.Context(t)
 	name := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_chime_voice_connector_termination.test"
 
-	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, chime.EndpointsID),
+	resource.Test(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckRegion(t, endpoints.UsEast1RegionID)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, chimesdkvoice.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckVoiceConnectorTerminationDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -46,14 +54,18 @@ func TestAccChimeVoiceConnectorTermination_basic(t *testing.T) {
 	})
 }
 
-func TestAccChimeVoiceConnectorTermination_disappears(t *testing.T) {
+func testAccVoiceConnectorTermination_disappears(t *testing.T) {
 	ctx := acctest.Context(t)
 	name := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_chime_voice_connector_termination.test"
 
-	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, chime.EndpointsID),
+	resource.Test(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckRegion(t, endpoints.UsEast1RegionID)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, chimesdkvoice.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckVoiceConnectorTerminationDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -69,14 +81,18 @@ func TestAccChimeVoiceConnectorTermination_disappears(t *testing.T) {
 	})
 }
 
-func TestAccChimeVoiceConnectorTermination_update(t *testing.T) {
+func testAccVoiceConnectorTermination_update(t *testing.T) {
 	ctx := acctest.Context(t)
 	name := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_chime_voice_connector_termination.test"
 
-	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, chime.EndpointsID),
+	resource.Test(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckRegion(t, endpoints.UsEast1RegionID)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, chimesdkvoice.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckVoiceConnectorTerminationDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -149,8 +165,8 @@ func testAccCheckVoiceConnectorTerminationExists(ctx context.Context, name strin
 			return fmt.Errorf("no Chime Voice Connector termination ID is set")
 		}
 
-		conn := acctest.Provider.Meta().(*conns.AWSClient).ChimeConn(ctx)
-		input := &chime.GetVoiceConnectorTerminationInput{
+		conn := acctest.Provider.Meta().(*conns.AWSClient).ChimeSDKVoiceConn(ctx)
+		input := &chimesdkvoice.GetVoiceConnectorTerminationInput{
 			VoiceConnectorId: aws.String(rs.Primary.ID),
 		}
 
@@ -173,13 +189,13 @@ func testAccCheckVoiceConnectorTerminationDestroy(ctx context.Context) resource.
 			if rs.Type != "aws_chime_voice_connector_termination" {
 				continue
 			}
-			conn := acctest.Provider.Meta().(*conns.AWSClient).ChimeConn(ctx)
-			input := &chime.GetVoiceConnectorTerminationInput{
+			conn := acctest.Provider.Meta().(*conns.AWSClient).ChimeSDKVoiceConn(ctx)
+			input := &chimesdkvoice.GetVoiceConnectorTerminationInput{
 				VoiceConnectorId: aws.String(rs.Primary.ID),
 			}
 			resp, err := conn.GetVoiceConnectorTerminationWithContext(ctx, input)
 
-			if tfawserr.ErrCodeEquals(err, chime.ErrCodeNotFoundException) {
+			if tfawserr.ErrCodeEquals(err, chimesdkvoice.ErrCodeNotFoundException) {
 				continue
 			}
 
diff --git a/internal/service/chime/voice_connector_test.go b/internal/service/chime/voice_connector_test.go
index e12f9d354ca..15aa116a003 100644
--- a/internal/service/chime/voice_connector_test.go
+++ b/internal/service/chime/voice_connector_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package chime_test
 
 import (
@@ -7,7 +10,7 @@ import (
 
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/endpoints"
-	"github.com/aws/aws-sdk-go/service/chime"
+	"github.com/aws/aws-sdk-go/service/chimesdkvoice"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
@@ -16,19 +19,20 @@ import (
 	tfchime "github.com/hashicorp/terraform-provider-aws/internal/service/chime"
 )
 
-func TestAccChimeVoiceConnector_basic(t *testing.T) {
+func testAccVoiceConnector_basic(t *testing.T) {
 	ctx := acctest.Context(t)
-	var voiceConnector *chime.VoiceConnector
+	var voiceConnector *chimesdkvoice.VoiceConnector
 
 	vcName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_chime_voice_connector.test"
 
-	resource.ParallelTest(t, resource.TestCase{
+	resource.Test(t, resource.TestCase{
 		PreCheck: func() {
 			acctest.PreCheck(ctx, t)
 			acctest.PreCheckRegion(t, endpoints.UsEast1RegionID)
+			testAccPreCheck(ctx, t)
 		},
-		ErrorCheck:               acctest.ErrorCheck(t, chime.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, chimesdkvoice.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckVoiceConnectorDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -37,7 +41,7 @@ func TestAccChimeVoiceConnector_basic(t *testing.T) {
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckVoiceConnectorExists(ctx, resourceName, voiceConnector),
 					resource.TestCheckResourceAttr(resourceName, "name", fmt.Sprintf("vc-%s", vcName)),
-					resource.TestCheckResourceAttr(resourceName, "aws_region", chime.VoiceConnectorAwsRegionUsEast1),
+					resource.TestCheckResourceAttr(resourceName, "aws_region", chimesdkvoice.VoiceConnectorAwsRegionUsEast1),
 					resource.TestCheckResourceAttr(resourceName, "require_encryption", "true"),
 				),
 			},
@@ -50,19 +54,20 @@ func TestAccChimeVoiceConnector_basic(t *testing.T) {
 	})
 }
 
-func TestAccChimeVoiceConnector_disappears(t *testing.T) {
+func testAccVoiceConnector_disappears(t *testing.T) {
 	ctx := acctest.Context(t)
-	var voiceConnector *chime.VoiceConnector
+	var voiceConnector *chimesdkvoice.VoiceConnector
 
 	vcName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_chime_voice_connector.test"
 
-	resource.ParallelTest(t, resource.TestCase{
+	resource.Test(t, resource.TestCase{
 		PreCheck: func() {
 			acctest.PreCheck(ctx, t)
 			acctest.PreCheckRegion(t, endpoints.UsEast1RegionID)
+			testAccPreCheck(ctx, t)
 		},
-		ErrorCheck:               acctest.ErrorCheck(t, chime.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, chimesdkvoice.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckVoiceConnectorDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -78,19 +83,20 @@ func TestAccChimeVoiceConnector_disappears(t *testing.T) {
 	})
 }
 
-func TestAccChimeVoiceConnector_update(t *testing.T) {
+func testAccVoiceConnector_update(t *testing.T) {
 	ctx := acctest.Context(t)
-	var voiceConnector *chime.VoiceConnector
+	var voiceConnector *chimesdkvoice.VoiceConnector
 
 	vcName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_chime_voice_connector.test"
 
-	resource.ParallelTest(t, resource.TestCase{
+	resource.Test(t, resource.TestCase{
 		PreCheck: func() {
 			acctest.PreCheck(ctx, t)
 			acctest.PreCheckRegion(t, endpoints.UsEast1RegionID)
+			testAccPreCheck(ctx, t)
 		},
-		ErrorCheck:               acctest.ErrorCheck(t, chime.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, chimesdkvoice.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckVoiceConnectorDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -99,7 +105,7 @@ func TestAccChimeVoiceConnector_update(t *testing.T) {
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckVoiceConnectorExists(ctx, resourceName, voiceConnector),
 					resource.TestCheckResourceAttr(resourceName, "name", fmt.Sprintf("vc-%s", vcName)),
-					resource.TestCheckResourceAttr(resourceName, "aws_region", chime.VoiceConnectorAwsRegionUsEast1),
+					resource.TestCheckResourceAttr(resourceName, "aws_region", chimesdkvoice.VoiceConnectorAwsRegionUsEast1),
 					resource.TestCheckResourceAttr(resourceName, "require_encryption", "true"),
 				),
 			},
@@ -118,21 +124,22 @@ func TestAccChimeVoiceConnector_update(t *testing.T) {
 	})
 }
 
-func TestAccChimeVoiceConnector_tags(t *testing.T) {
+func testAccVoiceConnector_tags(t *testing.T) {
 	ctx := acctest.Context(t)
-	var voiceConnector *chime.VoiceConnector
+	var voiceConnector *chimesdkvoice.VoiceConnector
 
 	vcName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_chime_voice_connector.test"
 
-	resource.ParallelTest(t, resource.TestCase{
+	resource.Test(t, resource.TestCase{
 		PreCheck: func() {
 			acctest.PreCheck(ctx, t)
 			// Legacy chime resources are always created in us-east-1, and the ListTags operation
 			// can behave unexpectedly when configured with a different region.
 			acctest.PreCheckRegion(t, endpoints.UsEast1RegionID)
+			testAccPreCheck(ctx, t)
 		},
-		ErrorCheck:               acctest.ErrorCheck(t, chime.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, chimesdkvoice.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckVoiceConnectorDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -218,7 +225,7 @@ resource "aws_chime_voice_connector" "test" {
 `, name, tagKey1, tagValue1, tagKey2, tagValue2)
 }
 
-func testAccCheckVoiceConnectorExists(ctx context.Context, name string, vc *chime.VoiceConnector) resource.TestCheckFunc {
+func testAccCheckVoiceConnectorExists(ctx context.Context, name string, vc *chimesdkvoice.VoiceConnector) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		rs, ok := s.RootModule().Resources[name]
 		if !ok {
@@ -229,8 +236,8 @@ func testAccCheckVoiceConnectorExists(ctx context.Context, name string, vc *chim
 			return fmt.Errorf("no Chime voice connector ID is set")
 		}
 
-		conn := acctest.Provider.Meta().(*conns.AWSClient).ChimeConn(ctx)
-		input := &chime.GetVoiceConnectorInput{
+		conn := acctest.Provider.Meta().(*conns.AWSClient).ChimeSDKVoiceConn(ctx)
+		input := &chimesdkvoice.GetVoiceConnectorInput{
 			VoiceConnectorId: aws.String(rs.Primary.ID),
 		}
 		resp, err := conn.GetVoiceConnectorWithContext(ctx, input)
@@ -250,8 +257,8 @@ func testAccCheckVoiceConnectorDestroy(ctx context.Context) resource.TestCheckFu
 			if rs.Type != "aws_chime_voice_connector" {
 				continue
 			}
-			conn := acctest.Provider.Meta().(*conns.AWSClient).ChimeConn(ctx)
-			input := &chime.GetVoiceConnectorInput{
+			conn := acctest.Provider.Meta().(*conns.AWSClient).ChimeSDKVoiceConn(ctx)
+			input := &chimesdkvoice.GetVoiceConnectorInput{
 				VoiceConnectorId: aws.String(rs.Primary.ID),
 			}
 			resp, err := conn.GetVoiceConnectorWithContext(ctx, input)
@@ -265,3 +272,19 @@ func testAccCheckVoiceConnectorDestroy(ctx context.Context) resource.TestCheckFu
 		return nil
 	}
 }
+
+func testAccPreCheck(ctx context.Context, t *testing.T) {
+	conn := acctest.Provider.Meta().(*conns.AWSClient).ChimeSDKVoiceConn(ctx)
+
+	input := &chimesdkvoice.ListVoiceConnectorsInput{}
+
+	_, err := conn.ListVoiceConnectorsWithContext(ctx, input)
+
+	if acctest.PreCheckSkipError(err) {
+		t.Skipf("skipping acceptance testing: %s", err)
+	}
+
+	if err != nil {
+		t.Fatalf("unexpected PreCheck error: %s", err)
+	}
+}
diff --git a/internal/service/chimesdkmediapipelines/generate.go b/internal/service/chimesdkmediapipelines/generate.go
index 39cfebe64fc..7ad21965177 100644
--- a/internal/service/chimesdkmediapipelines/generate.go
+++ b/internal/service/chimesdkmediapipelines/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTags -ListTagsInIDElem=ResourceARN -ServiceTagsSlice -TagInIDElem=ResourceARN -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/chimesdkmediapipelines/media_insights_pipeline_configuration.go b/internal/service/chimesdkmediapipelines/media_insights_pipeline_configuration.go
index 3a6aef9d2e7..9a4680c06e8 100644
--- a/internal/service/chimesdkmediapipelines/media_insights_pipeline_configuration.go
+++ b/internal/service/chimesdkmediapipelines/media_insights_pipeline_configuration.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package chimesdkmediapipelines
 
 import (
 	"context"
 	"errors"
 	"log"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/chimesdkmediapipelines"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -120,7 +123,7 @@ func AmazonTranscribeCallAnalyticsProcessorConfigurationSchema() *schema.Schema
 						Type: schema.TypeString,
 						ValidateFunc: validation.All(
 							validation.StringLenBetween(1, 200),
-							validation.StringMatch(regexp.MustCompile(`^[0-9a-zA-Z._-]+`), "Must be a valid Category Name matching expression: ^[0-9a-zA-Z._-]+"),
+							validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_.-]+`), "Must be a valid Category Name matching expression: ^[0-9A-Za-z_.-]+"),
 						),
 					},
 				},
@@ -152,7 +155,7 @@ func AmazonTranscribeCallAnalyticsProcessorConfigurationSchema() *schema.Schema
 					Optional: true,
 					ValidateFunc: validation.All(
 						validation.StringLenBetween(0, 200),
-						validation.StringMatch(regexp.MustCompile(`^[0-9a-zA-Z._-]+`), "Must be a valid language model name matching expression: ^[0-9a-zA-Z._-]+"),
+						validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_.-]+`), "Must be a valid language model name matching expression: ^[0-9A-Za-z_.-]+"),
 					),
 				},
 				"partial_results_stability": {
@@ -165,7 +168,7 @@ func AmazonTranscribeCallAnalyticsProcessorConfigurationSchema() *schema.Schema
 					Optional: true,
 					ValidateFunc: validation.All(
 						validation.StringLenBetween(0, 300),
-						validation.StringMatch(regexp.MustCompile(`^[A-Z_, ]+`),
+						validation.StringMatch(regexache.MustCompile(`^[A-Z_, ]+`),
 							"Must be a valid comma-separated list of entity types. For valid types see https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_media-pipelines-chime_AmazonTranscribeCallAnalyticsProcessorConfiguration.html#chimesdk-Type-media-pipelines-chime_AmazonTranscribeCallAnalyticsProcessorConfiguration-CallAnalyticsStreamCategories"),
 					),
 				},
@@ -180,7 +183,7 @@ func AmazonTranscribeCallAnalyticsProcessorConfigurationSchema() *schema.Schema
 					Optional: true,
 					ValidateFunc: validation.All(
 						validation.StringLenBetween(0, 200),
-						validation.StringMatch(regexp.MustCompile(`^[0-9a-zA-Z._-]+`), "Must be a valid vocabulary filter name matching expression: ^[0-9a-zA-Z._-]+"),
+						validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_.-]+`), "Must be a valid vocabulary filter name matching expression: ^[0-9A-Za-z_.-]+"),
 					),
 				},
 				"vocabulary_name": {
@@ -188,7 +191,7 @@ func AmazonTranscribeCallAnalyticsProcessorConfigurationSchema() *schema.Schema
 					Optional: true,
 					ValidateFunc: validation.All(
 						validation.StringLenBetween(0, 200),
-						validation.StringMatch(regexp.MustCompile(`^[0-9a-zA-Z._-]+`), "Must be a valid vocabulary name matching expression: ^[0-9a-zA-Z._-]+"),
+						validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_.-]+`), "Must be a valid vocabulary name matching expression: ^[0-9A-Za-z_.-]+"),
 					),
 				},
 			},
@@ -221,7 +224,7 @@ func PostCallAnalyticsSettingsSchema() *schema.Schema {
 				"output_location": {
 					Type:         schema.TypeString,
 					Required:     true,
-					ValidateFunc: validation.StringMatch(regexp.MustCompile(`s3://+`), "Must begin with the prefix 's3://'"),
+					ValidateFunc: validation.StringMatch(regexache.MustCompile(`s3://+`), "Must begin with the prefix 's3://'"),
 				},
 			},
 		},
@@ -263,7 +266,7 @@ func AmazonTranscribeProcessorConfigurationSchema() *schema.Schema {
 					Optional: true,
 					ValidateFunc: validation.All(
 						validation.StringLenBetween(0, 200),
-						validation.StringMatch(regexp.MustCompile(`^[0-9a-zA-Z._-]+`), "Must be a valid language model name matching expression: ^[0-9a-zA-Z._-]+"),
+						validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_.-]+`), "Must be a valid language model name matching expression: ^[0-9A-Za-z_.-]+"),
 					),
 				},
 				"partial_results_stability": {
@@ -276,7 +279,7 @@ func AmazonTranscribeProcessorConfigurationSchema() *schema.Schema {
 					Optional: true,
 					ValidateFunc: validation.All(
 						validation.StringLenBetween(0, 300),
-						validation.StringMatch(regexp.MustCompile(`^[A-Z_, ]+`),
+						validation.StringMatch(regexache.MustCompile(`^[A-Z_, ]+`),
 							"Must be a valid comma-separated list of entity types. For valid types see https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_media-pipelines-chime_AmazonTranscribeCallAnalyticsProcessorConfiguration.html#chimesdk-Type-media-pipelines-chime_AmazonTranscribeCallAnalyticsProcessorConfiguration-CallAnalyticsStreamCategories"),
 					),
 				},
@@ -294,7 +297,7 @@ func AmazonTranscribeProcessorConfigurationSchema() *schema.Schema {
 					Optional: true,
 					ValidateFunc: validation.All(
 						validation.StringLenBetween(0, 200),
-						validation.StringMatch(regexp.MustCompile(`^[0-9a-zA-Z._-]+`), "Must be a valid vocabulary filter name matching expression: ^[0-9a-zA-Z._-]+"),
+						validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_.-]+`), "Must be a valid vocabulary filter name matching expression: ^[0-9A-Za-z_.-]+"),
 					),
 				},
 				"vocabulary_name": {
@@ -302,7 +305,7 @@ func AmazonTranscribeProcessorConfigurationSchema() *schema.Schema {
 					Optional: true,
 					ValidateFunc: validation.All(
 						validation.StringLenBetween(0, 200),
-						validation.StringMatch(regexp.MustCompile(`^[0-9a-zA-Z._-]+`), "Must be a valid vocabulary name matching expression: ^[0-9a-zA-Z._-]+"),
+						validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_.-]+`), "Must be a valid vocabulary name matching expression: ^[0-9A-Za-z_.-]+"),
 					),
 				},
 			},
@@ -394,7 +397,7 @@ func RealTimeAlertConfigurationSchema() *schema.Schema {
 										"rule_name": {
 											Type:         schema.TypeString,
 											Required:     true,
-											ValidateFunc: validation.StringMatch(regexp.MustCompile(`^[0-9a-zA-Z._-]+`), "Must match the expression: ^[0-9a-zA-Z._-]+"),
+											ValidateFunc: validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_.-]+`), "Must match the expression: ^[0-9A-Za-z_.-]+"),
 										},
 									},
 								},
@@ -412,7 +415,7 @@ func RealTimeAlertConfigurationSchema() *schema.Schema {
 											MaxItems: 100,
 											Elem: &schema.Schema{
 												Type:         schema.TypeString,
-												ValidateFunc: validation.StringMatch(regexp.MustCompile(`^[\s0-9a-zA-Z'-]+`), "Must match the expression: ^[\\s0-9a-zA-Z'-]+"),
+												ValidateFunc: validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z\s'-]+`), "Must match the expression: ^[0-9A-Za-z\\s'-]+"),
 											},
 										},
 										"negate": {
@@ -423,7 +426,7 @@ func RealTimeAlertConfigurationSchema() *schema.Schema {
 										"rule_name": {
 											Type:         schema.TypeString,
 											Required:     true,
-											ValidateFunc: validation.StringMatch(regexp.MustCompile(`^[0-9a-zA-Z._-]+`), "Must match the expression: ^[0-9a-zA-Z._-]+"),
+											ValidateFunc: validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_.-]+`), "Must match the expression: ^[0-9A-Za-z_.-]+"),
 										},
 									},
 								},
@@ -437,7 +440,7 @@ func RealTimeAlertConfigurationSchema() *schema.Schema {
 										"rule_name": {
 											Type:         schema.TypeString,
 											Required:     true,
-											ValidateFunc: validation.StringMatch(regexp.MustCompile(`^[0-9a-zA-Z._-]+`), "Must match the expression: ^[0-9a-zA-Z._-]+"),
+											ValidateFunc: validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_.-]+`), "Must match the expression: ^[0-9A-Za-z_.-]+"),
 										},
 										"sentiment_type": {
 											Type:         schema.TypeString,
diff --git a/internal/service/chimesdkmediapipelines/media_insights_pipeline_configuration_test.go b/internal/service/chimesdkmediapipelines/media_insights_pipeline_configuration_test.go
index 370488d6d13..5effdbc20d8 100644
--- a/internal/service/chimesdkmediapipelines/media_insights_pipeline_configuration_test.go
+++ b/internal/service/chimesdkmediapipelines/media_insights_pipeline_configuration_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package chimesdkmediapipelines_test
 
 import (
 	"context"
 	"errors"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/chimesdkmediapipelines"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -48,7 +51,7 @@ func TestAccChimeSDKMediaPipelinesMediaInsightsPipelineConfiguration_basic(t *te
 					resource.TestCheckResourceAttr(resourceName, "elements.#", "2"),
 					resource.TestCheckResourceAttr(resourceName, "elements.0.type", "AmazonTranscribeCallAnalyticsProcessor"),
 					resource.TestCheckResourceAttr(resourceName, "elements.1.type", "KinesisDataStreamSink"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "chime", regexp.MustCompile(`media-insights-pipeline-configuration/+.`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "chime", regexache.MustCompile(`media-insights-pipeline-configuration/+.`)),
 				),
 			},
 			{
@@ -125,7 +128,7 @@ func TestAccChimeSDKMediaPipelinesMediaInsightsPipelineConfiguration_updateAllPr
 					resource.TestCheckResourceAttr(resourceName, "elements.#", "2"),
 					resource.TestCheckResourceAttr(resourceName, "elements.0.type", "AmazonTranscribeCallAnalyticsProcessor"),
 					resource.TestCheckResourceAttr(resourceName, "elements.1.type", "KinesisDataStreamSink"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "elements.1.kinesis_data_stream_sink_configuration.0.insights_target", "kinesis", regexp.MustCompile(fmt.Sprintf(`stream/%s`, streamName1))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "elements.1.kinesis_data_stream_sink_configuration.0.insights_target", "kinesis", regexache.MustCompile(fmt.Sprintf(`stream/%s`, streamName1))),
 					resource.TestCheckResourceAttrSet(resourceName, "real_time_alert_configuration.0.%"),
 					resource.TestCheckResourceAttr(resourceName, "real_time_alert_configuration.0.disabled", "false"),
 					resource.TestCheckResourceAttr(resourceName, "real_time_alert_configuration.0.rules.#", "3"),
@@ -135,7 +138,7 @@ func TestAccChimeSDKMediaPipelinesMediaInsightsPipelineConfiguration_updateAllPr
 					resource.TestCheckResourceAttrSet(resourceName, "real_time_alert_configuration.0.rules.1.keyword_match_configuration.0.%"),
 					resource.TestCheckResourceAttr(resourceName, "real_time_alert_configuration.0.rules.2.type", "Sentiment"),
 					resource.TestCheckResourceAttrSet(resourceName, "real_time_alert_configuration.0.rules.2.sentiment_configuration.0.%"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "chime", regexp.MustCompile(`media-insights-pipeline-configuration/+.`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "chime", regexache.MustCompile(`media-insights-pipeline-configuration/+.`)),
 				),
 			},
 			{
@@ -146,11 +149,11 @@ func TestAccChimeSDKMediaPipelinesMediaInsightsPipelineConfiguration_updateAllPr
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttrSet(resourceName, "id"),
 					acctest.CheckResourceAttrGlobalARN(resourceName, "resource_access_role_arn", "iam", fmt.Sprintf(`role/%s`, roleName1)),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "chime", regexp.MustCompile(`media-insights-pipeline-configuration/+.`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "chime", regexache.MustCompile(`media-insights-pipeline-configuration/+.`)),
 					resource.TestCheckResourceAttr(resourceName, "elements.#", "2"),
 					resource.TestCheckResourceAttr(resourceName, "elements.0.type", "AmazonTranscribeProcessor"),
 					resource.TestCheckResourceAttr(resourceName, "elements.1.type", "KinesisDataStreamSink"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "elements.1.kinesis_data_stream_sink_configuration.0.insights_target", "kinesis", regexp.MustCompile(fmt.Sprintf(`stream/%s`, streamName2))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "elements.1.kinesis_data_stream_sink_configuration.0.insights_target", "kinesis", regexache.MustCompile(fmt.Sprintf(`stream/%s`, streamName2))),
 					resource.TestCheckNoResourceAttr(resourceName, "real_time_alert_configuration.0.%"),
 				),
 			},
@@ -162,7 +165,7 @@ func TestAccChimeSDKMediaPipelinesMediaInsightsPipelineConfiguration_updateAllPr
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttrSet(resourceName, "id"),
 					acctest.CheckResourceAttrGlobalARN(resourceName, "resource_access_role_arn", "iam", fmt.Sprintf(`role/%s`, roleName2)),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "chime", regexp.MustCompile(`media-insights-pipeline-configuration/+.`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "chime", regexache.MustCompile(`media-insights-pipeline-configuration/+.`)),
 					resource.TestCheckResourceAttr(resourceName, "elements.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "elements.0.type", "S3RecordingSink"),
 				),
@@ -175,14 +178,14 @@ func TestAccChimeSDKMediaPipelinesMediaInsightsPipelineConfiguration_updateAllPr
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttrSet(resourceName, "id"),
 					acctest.CheckResourceAttrGlobalARN(resourceName, "resource_access_role_arn", "iam", fmt.Sprintf(`role/%s`, roleName2)),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "chime", regexp.MustCompile(`media-insights-pipeline-configuration/+.`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "chime", regexache.MustCompile(`media-insights-pipeline-configuration/+.`)),
 					resource.TestCheckResourceAttr(resourceName, "elements.#", "5"),
 					resource.TestCheckResourceAttr(resourceName, "elements.0.type", "VoiceAnalyticsProcessor"),
 					resource.TestCheckResourceAttr(resourceName, "elements.1.type", "LambdaFunctionSink"),
 					resource.TestCheckResourceAttr(resourceName, "elements.2.type", "SnsTopicSink"),
 					resource.TestCheckResourceAttr(resourceName, "elements.3.type", "SqsQueueSink"),
 					resource.TestCheckResourceAttr(resourceName, "elements.4.type", "KinesisDataStreamSink"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "elements.4.kinesis_data_stream_sink_configuration.0.insights_target", "kinesis", regexp.MustCompile(fmt.Sprintf(`stream/%s`, streamName2))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "elements.4.kinesis_data_stream_sink_configuration.0.insights_target", "kinesis", regexache.MustCompile(fmt.Sprintf(`stream/%s`, streamName2))),
 				),
 			},
 			{
diff --git a/internal/service/chimesdkmediapipelines/service_package_gen.go b/internal/service/chimesdkmediapipelines/service_package_gen.go
index 4b082f105d2..cd672f57a57 100644
--- a/internal/service/chimesdkmediapipelines/service_package_gen.go
+++ b/internal/service/chimesdkmediapipelines/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	chimesdkmediapipelines_sdkv1 "github.com/aws/aws-sdk-go/service/chimesdkmediapipelines"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -50,4 +51,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*c
 	return chimesdkmediapipelines_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/chimesdkmediapipelines/tags_gen.go b/internal/service/chimesdkmediapipelines/tags_gen.go
index 87f7211aae5..310756bca56 100644
--- a/internal/service/chimesdkmediapipelines/tags_gen.go
+++ b/internal/service/chimesdkmediapipelines/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/chimesdkmediapipelines"
 	"github.com/aws/aws-sdk-go/service/chimesdkmediapipelines/chimesdkmediapipelinesiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -102,6 +104,8 @@ func updateTags(ctx context.Context, conn chimesdkmediapipelinesiface.ChimeSDKMe
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.ChimeSDKMediaPipelines)
 	if len(removedTags) > 0 {
diff --git a/internal/service/chimesdkvoice/generate.go b/internal/service/chimesdkvoice/generate.go
index 9a7ffb883f8..2be2e798c78 100644
--- a/internal/service/chimesdkvoice/generate.go
+++ b/internal/service/chimesdkvoice/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTags -ListTagsInIDElem=ResourceARN -ServiceTagsSlice -TagInIDElem=ResourceARN -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/chimesdkvoice/global_settings.go b/internal/service/chimesdkvoice/global_settings.go
index 72ccc4eece3..f3fa5dcd90c 100644
--- a/internal/service/chimesdkvoice/global_settings.go
+++ b/internal/service/chimesdkvoice/global_settings.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package chimesdkvoice
 
 import (
@@ -19,7 +22,7 @@ import (
 
 const (
 	ResNameGlobalSettings            = "Global Settings"
-	globalSettingsPropagationTimeout = time.Second * 10
+	globalSettingsPropagationTimeout = 20 * time.Second
 )
 
 // @SDKResource("aws_chimesdkvoice_global_settings")
@@ -62,10 +65,12 @@ func resourceGlobalSettingsRead(ctx context.Context, d *schema.ResourceData, met
 	err := tfresource.Retry(ctx, globalSettingsPropagationTimeout, func() *retry.RetryError {
 		var getErr error
 		out, getErr = conn.GetGlobalSettingsWithContext(ctx, &chimesdkvoice.GetGlobalSettingsInput{})
+
 		if getErr != nil {
 			return retry.NonRetryableError(getErr)
 		}
-		if out.VoiceConnector == nil {
+
+		if out.VoiceConnector == nil || out.VoiceConnector.CdrBucket == nil {
 			return retry.RetryableError(tfresource.NewEmptyResultError(&chimesdkvoice.GetGlobalSettingsInput{}))
 		}
 
diff --git a/internal/service/chimesdkvoice/global_settings_test.go b/internal/service/chimesdkvoice/global_settings_test.go
index a442f43ae32..619a72ee15f 100644
--- a/internal/service/chimesdkvoice/global_settings_test.go
+++ b/internal/service/chimesdkvoice/global_settings_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package chimesdkvoice_test
 
 import (
@@ -7,6 +10,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/aws/aws-sdk-go/aws/endpoints"
 	"github.com/aws/aws-sdk-go/service/chimesdkvoice"
 	sdkacctest "github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
@@ -87,7 +91,10 @@ func testAccGlobalSettings_update(t *testing.T) {
 	bucketResourceName := "aws_s3_bucket.test"
 
 	resource.Test(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckRegion(t, endpoints.UsEast1RegionID) // run test in us-east-1 only since eventual consistency causes intermittent failures in other regions.
+		},
 		ErrorCheck:               acctest.ErrorCheck(t, chimesdkvoice.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckGlobalSettingsDestroy(ctx),
diff --git a/internal/service/chimesdkvoice/service_package_gen.go b/internal/service/chimesdkvoice/service_package_gen.go
index 1f3659a1bb3..3fd5a5cfe6a 100644
--- a/internal/service/chimesdkvoice/service_package_gen.go
+++ b/internal/service/chimesdkvoice/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	chimesdkvoice_sdkv1 "github.com/aws/aws-sdk-go/service/chimesdkvoice"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -67,4 +68,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*c
 	return chimesdkvoice_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/chimesdkvoice/sip_media_application.go b/internal/service/chimesdkvoice/sip_media_application.go
index 5c801798826..08a4b461afc 100644
--- a/internal/service/chimesdkvoice/sip_media_application.go
+++ b/internal/service/chimesdkvoice/sip_media_application.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package chimesdkvoice
 
 import (
diff --git a/internal/service/chimesdkvoice/sip_media_application_test.go b/internal/service/chimesdkvoice/sip_media_application_test.go
index 424db5b785b..36948ac10bd 100644
--- a/internal/service/chimesdkvoice/sip_media_application_test.go
+++ b/internal/service/chimesdkvoice/sip_media_application_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package chimesdkvoice_test
 
 import (
diff --git a/internal/service/chimesdkvoice/sip_rule.go b/internal/service/chimesdkvoice/sip_rule.go
index 3091ac6be8b..4b45105b91c 100644
--- a/internal/service/chimesdkvoice/sip_rule.go
+++ b/internal/service/chimesdkvoice/sip_rule.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package chimesdkvoice
 
 import (
diff --git a/internal/service/chimesdkvoice/sip_rule_test.go b/internal/service/chimesdkvoice/sip_rule_test.go
index 2d798744096..a7bf5eb5055 100644
--- a/internal/service/chimesdkvoice/sip_rule_test.go
+++ b/internal/service/chimesdkvoice/sip_rule_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package chimesdkvoice_test
 
 import (
diff --git a/internal/service/chimesdkvoice/tags_gen.go b/internal/service/chimesdkvoice/tags_gen.go
index 6f043c32fa3..52a0cc786f0 100644
--- a/internal/service/chimesdkvoice/tags_gen.go
+++ b/internal/service/chimesdkvoice/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/chimesdkvoice"
 	"github.com/aws/aws-sdk-go/service/chimesdkvoice/chimesdkvoiceiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -102,6 +104,8 @@ func updateTags(ctx context.Context, conn chimesdkvoiceiface.ChimeSDKVoiceAPI, i
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.ChimeSDKVoice)
 	if len(removedTags) > 0 {
diff --git a/internal/service/chimesdkvoice/voice_profile_domain.go b/internal/service/chimesdkvoice/voice_profile_domain.go
index feab2a1fb86..f6801dad62b 100644
--- a/internal/service/chimesdkvoice/voice_profile_domain.go
+++ b/internal/service/chimesdkvoice/voice_profile_domain.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package chimesdkvoice
 
 import (
 	"context"
 	"errors"
 	"log"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/chimesdkvoice"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -64,7 +67,7 @@ func ResourceVoiceProfileDomain() *schema.Resource {
 				Required: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 200),
-					validation.StringMatch(regexp.MustCompile(`[a-zA-Z0-9 _.-]+`), "Name must match expression: ^[0-9a-zA-Z._-]+"),
+					validation.StringMatch(regexache.MustCompile(`[0-9A-Za-z_ .-]+`), "Name must match expression: ^[0-9A-Za-z_ .-]+"),
 				),
 			},
 			"server_side_encryption_configuration": {
diff --git a/internal/service/chimesdkvoice/voice_profile_domain_test.go b/internal/service/chimesdkvoice/voice_profile_domain_test.go
index 3a329da8f01..6c413c56326 100644
--- a/internal/service/chimesdkvoice/voice_profile_domain_test.go
+++ b/internal/service/chimesdkvoice/voice_profile_domain_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package chimesdkvoice_test
 
 import (
 	"context"
 	"errors"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/chimesdkvoice"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -57,7 +60,7 @@ func testAccVoiceProfileDomain_basic(t *testing.T) {
 					testAccCheckVoiceProfileDomainExists(ctx, resourceName, &voiceprofiledomain),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttrSet(resourceName, "server_side_encryption_configuration.0.kms_key_arn"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "chime", regexp.MustCompile(`voice-profile-domain/+.`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "chime", regexache.MustCompile(`voice-profile-domain/+.`)),
 				),
 			},
 			{
@@ -122,7 +125,7 @@ func testAccVoiceProfileDomain_update(t *testing.T) {
 					testAccCheckVoiceProfileDomainExists(ctx, resourceName, &v1),
 					resource.TestCheckResourceAttr(resourceName, "name", rName1),
 					resource.TestCheckResourceAttrSet(resourceName, "server_side_encryption_configuration.0.kms_key_arn"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "chime", regexp.MustCompile(`voice-profile-domain/+.`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "chime", regexache.MustCompile(`voice-profile-domain/+.`)),
 				),
 			},
 			{
@@ -133,7 +136,7 @@ func testAccVoiceProfileDomain_update(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "name", rName2),
 					resource.TestCheckResourceAttrSet(resourceName, "server_side_encryption_configuration.0.kms_key_arn"),
 					resource.TestCheckResourceAttr(resourceName, "description", description),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "chime", regexp.MustCompile(`voice-profile-domain/+.`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "chime", regexache.MustCompile(`voice-profile-domain/+.`)),
 				),
 			},
 		},
diff --git a/internal/service/cleanrooms/collaboration.go b/internal/service/cleanrooms/collaboration.go
new file mode 100644
index 00000000000..1e457a94be0
--- /dev/null
+++ b/internal/service/cleanrooms/collaboration.go
@@ -0,0 +1,427 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package cleanrooms
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"log"
+	"time"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/cleanrooms"
+	"github.com/aws/aws-sdk-go-v2/service/cleanrooms/types"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/create"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs"
+	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/internal/verify"
+	"github.com/hashicorp/terraform-provider-aws/names"
+)
+
+// @SDKResource("aws_cleanrooms_collaboration")
+// @Tags(identifierAttribute="arn")
+func ResourceCollaboration() *schema.Resource {
+	return &schema.Resource{
+		CreateWithoutTimeout: resourceCollaborationCreate,
+		ReadWithoutTimeout:   resourceCollaborationRead,
+		UpdateWithoutTimeout: resourceCollaborationUpdate,
+		DeleteWithoutTimeout: resourceCollaborationDelete,
+
+		Importer: &schema.ResourceImporter{
+			StateContext: schema.ImportStatePassthroughContext,
+		},
+
+		Timeouts: &schema.ResourceTimeout{
+			Create: schema.DefaultTimeout(1 * time.Minute),
+			Update: schema.DefaultTimeout(1 * time.Minute),
+			Delete: schema.DefaultTimeout(1 * time.Minute),
+		},
+
+		Schema: map[string]*schema.Schema{
+			names.AttrARN: {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"create_time": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"creator_display_name": {
+				Type:     schema.TypeString,
+				ForceNew: true,
+				Required: true,
+			},
+			"creator_member_abilities": {
+				Type:     schema.TypeList,
+				Required: true,
+				ForceNew: true,
+				Elem:     &schema.Schema{Type: schema.TypeString},
+			},
+			names.AttrDescription: {
+				Type:     schema.TypeString,
+				Required: true,
+			},
+			"data_encryption_metadata": {
+				Type:     schema.TypeList,
+				Optional: true,
+				ForceNew: true,
+				MaxItems: 1,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"allow_clear_text": {
+							Type:     schema.TypeBool,
+							Required: true,
+							ForceNew: true,
+						},
+						"allow_duplicates": {
+							Type:     schema.TypeBool,
+							Required: true,
+							ForceNew: true,
+						},
+						"allow_joins_on_columns_with_different_names": {
+							Type:     schema.TypeBool,
+							Required: true,
+							ForceNew: true,
+						},
+						"preserve_nulls": {
+							Type:     schema.TypeBool,
+							Required: true,
+							ForceNew: true,
+						},
+					},
+				},
+			},
+			names.AttrID: {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"member": {
+				Type:     schema.TypeSet,
+				Optional: true,
+				ForceNew: true,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"account_id": {
+							Type:     schema.TypeString,
+							Required: true,
+							ForceNew: true,
+						},
+						"display_name": {
+							Type:     schema.TypeString,
+							Required: true,
+							ForceNew: true,
+						},
+						"status": {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+						"member_abilities": {
+							Type:     schema.TypeList,
+							Required: true,
+							ForceNew: true,
+							Elem:     &schema.Schema{Type: schema.TypeString},
+						},
+					},
+				},
+			},
+			names.AttrName: {
+				Type:     schema.TypeString,
+				Required: true,
+			},
+			"query_log_status": {
+				Type:     schema.TypeString,
+				ForceNew: true,
+				Required: true,
+			},
+			names.AttrTags:    tftags.TagsSchema(),
+			names.AttrTagsAll: tftags.TagsSchemaComputed(),
+			"update_time": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+		},
+		CustomizeDiff: verify.SetTagsDiff,
+	}
+}
+
+const (
+	ResNameCollaboration = "Collaboration"
+)
+
+func resourceCollaborationCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	conn := meta.(*conns.AWSClient).CleanRoomsClient(ctx)
+
+	creatorAbilities := d.Get("creator_member_abilities").([]interface{})
+
+	input := &cleanrooms.CreateCollaborationInput{
+		Name:                   aws.String(d.Get(names.AttrName).(string)),
+		CreatorDisplayName:     aws.String(d.Get("creator_display_name").(string)),
+		CreatorMemberAbilities: expandMemberAbilities(creatorAbilities),
+		Members:                *expandMembers(d.Get("member").(*schema.Set).List()),
+		Tags:                   getTagsIn(ctx),
+	}
+
+	queryLogStatus, err := expandQueryLogStatus(d.Get("query_log_status").(string))
+	if err != nil {
+		return create.DiagError(names.CleanRooms, create.ErrActionCreating, ResNameCollaboration, d.Get("name").(string), err)
+	}
+	input.QueryLogStatus = queryLogStatus
+
+	if v, ok := d.GetOk("data_encryption_metadata"); ok {
+		input.DataEncryptionMetadata = expandDataEncryptionMetadata(v.([]interface{}))
+	}
+
+	if v, ok := d.GetOk(names.AttrDescription); ok {
+		input.Description = aws.String(v.(string))
+	}
+
+	out, err := conn.CreateCollaboration(ctx, input)
+	if err != nil {
+		return create.DiagError(names.CleanRooms, create.ErrActionCreating, ResNameCollaboration, d.Get("name").(string), err)
+	}
+
+	if out == nil || out.Collaboration == nil {
+		return create.DiagError(names.CleanRooms, create.ErrActionCreating, ResNameCollaboration, d.Get("name").(string), errors.New("empty output"))
+	}
+	d.SetId(aws.ToString(out.Collaboration.Id))
+
+	return resourceCollaborationRead(ctx, d, meta)
+}
+
+func resourceCollaborationRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	conn := meta.(*conns.AWSClient).CleanRoomsClient(ctx)
+
+	out, err := findCollaborationByID(ctx, conn, d.Id())
+
+	if !d.IsNewResource() && tfresource.NotFound(err) {
+		log.Printf("[WARN] CleanRooms Collaboration (%s) not found, removing from state", d.Id())
+		d.SetId("")
+		return nil
+	}
+
+	if err != nil {
+		return create.DiagError(names.CleanRooms, create.ErrActionReading, ResNameCollaboration, d.Id(), err)
+	}
+
+	collaboration := out.Collaboration
+	d.Set(names.AttrARN, collaboration.Arn)
+	d.Set(names.AttrName, collaboration.Name)
+	d.Set(names.AttrDescription, collaboration.Description)
+	d.Set("creator_display_name", collaboration.CreatorDisplayName)
+	d.Set("create_time", collaboration.CreateTime.String())
+	d.Set("update_time", collaboration.UpdateTime.String())
+	d.Set("query_log_status", collaboration.QueryLogStatus)
+	if err := d.Set("data_encryption_metadata", flattenDataEncryptionMetadata(collaboration.DataEncryptionMetadata)); err != nil {
+		return diag.Errorf("setting data_encryption_metadata: %s", err)
+	}
+
+	membersOut, err := findMembersByCollaborationId(ctx, conn, d.Id())
+	if err != nil {
+		return create.DiagError(names.CleanRooms, create.ErrActionSetting, ResNameCollaboration, d.Id(), err)
+	}
+
+	if err := d.Set("member", flattenMembers(membersOut.MemberSummaries, collaboration.CreatorAccountId)); err != nil {
+		return diag.Errorf("setting member: %s", err)
+	}
+	if err := d.Set("creator_member_abilities", flattenCreatorAbilities(membersOut.MemberSummaries, collaboration.CreatorAccountId)); err != nil {
+		return diag.Errorf("setting creator_member_abilities: %s", err)
+	}
+
+	return nil
+}
+
+func resourceCollaborationUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).CleanRoomsClient(ctx)
+
+	if d.HasChangesExcept("tags", "tags_all") {
+		input := &cleanrooms.UpdateCollaborationInput{
+			CollaborationIdentifier: aws.String(d.Id()),
+		}
+
+		if d.HasChanges(names.AttrDescription) {
+			input.Description = aws.String(d.Get(names.AttrDescription).(string))
+		}
+
+		if d.HasChanges(names.AttrName) {
+			input.Name = aws.String(d.Get(names.AttrName).(string))
+		}
+
+		_, err := conn.UpdateCollaboration(ctx, input)
+		if err != nil {
+			return create.DiagError(names.CleanRooms, create.ErrActionUpdating, ResNameCollaboration, d.Id(), err)
+		}
+	}
+
+	return append(diags, resourceCollaborationRead(ctx, d, meta)...)
+}
+
+func resourceCollaborationDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	conn := meta.(*conns.AWSClient).CleanRoomsClient(ctx)
+
+	log.Printf("[INFO] Deleting CleanRooms Collaboration %s", d.Id())
+	_, err := conn.DeleteCollaboration(ctx, &cleanrooms.DeleteCollaborationInput{
+		CollaborationIdentifier: aws.String(d.Id()),
+	})
+
+	if errs.IsA[*types.AccessDeniedException](err) {
+		return nil
+	}
+
+	if err != nil {
+		return create.DiagError(names.CleanRooms, create.ErrActionDeleting, ResNameCollaboration, d.Id(), err)
+	}
+
+	return nil
+}
+
+func findCollaborationByID(ctx context.Context, conn *cleanrooms.Client, id string) (*cleanrooms.GetCollaborationOutput, error) {
+	in := &cleanrooms.GetCollaborationInput{
+		CollaborationIdentifier: aws.String(id),
+	}
+	out, err := conn.GetCollaboration(ctx, in)
+
+	if errs.IsA[*types.AccessDeniedException](err) {
+		//We throw Access Denied for NFE in Cleanrooms for collaborations since they are cross account
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: in,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	if out == nil || out.Collaboration == nil {
+		return nil, tfresource.NewEmptyResultError(in)
+	}
+
+	return out, nil
+}
+
+func findMembersByCollaborationId(ctx context.Context, conn *cleanrooms.Client, id string) (*cleanrooms.ListMembersOutput, error) {
+	in := &cleanrooms.ListMembersInput{
+		CollaborationIdentifier: aws.String(id),
+	}
+	out, err := conn.ListMembers(ctx, in)
+
+	if errs.IsA[*types.ResourceNotFoundException](err) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: in,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	if out == nil || out.MemberSummaries == nil {
+		return nil, tfresource.NewEmptyResultError(in)
+	}
+
+	return out, nil
+}
+
+func expandMemberAbilities(data []interface{}) []types.MemberAbility {
+	mappedAbilities := []types.MemberAbility{}
+	for _, v := range data {
+		switch v.(string) {
+		case "CAN_QUERY":
+			mappedAbilities = append(mappedAbilities, types.MemberAbilityCanQuery)
+		case "CAN_RECEIVE_RESULTS":
+			mappedAbilities = append(mappedAbilities, types.MemberAbilityCanReceiveResults)
+		}
+	}
+	return mappedAbilities
+}
+
+func expandQueryLogStatus(status string) (types.CollaborationQueryLogStatus, error) {
+	switch status {
+	case "ENABLED":
+		return types.CollaborationQueryLogStatusEnabled, nil
+	case "DISABLED":
+		return types.CollaborationQueryLogStatusDisabled, nil
+	default:
+		return types.CollaborationQueryLogStatusDisabled, fmt.Errorf("Invalid query log status type: %s", status)
+	}
+}
+
+func expandDataEncryptionMetadata(data []interface{}) *types.DataEncryptionMetadata {
+	dataEncryptionMetadata := &types.DataEncryptionMetadata{}
+	if len(data) > 0 {
+		metadata := data[0].(map[string]interface{})
+		dataEncryptionMetadata.PreserveNulls = aws.Bool(metadata["preserve_nulls"].(bool))
+		dataEncryptionMetadata.AllowCleartext = aws.Bool(metadata["allow_clear_text"].(bool))
+		dataEncryptionMetadata.AllowJoinsOnColumnsWithDifferentNames = aws.Bool(metadata["allow_joins_on_columns_with_different_names"].(bool))
+		dataEncryptionMetadata.AllowDuplicates = aws.Bool(metadata["allow_duplicates"].(bool))
+	}
+	return dataEncryptionMetadata
+}
+
+func expandMembers(data []interface{}) *[]types.MemberSpecification {
+	members := []types.MemberSpecification{}
+	for _, member := range data {
+		memberMap := member.(map[string]interface{})
+		member := &types.MemberSpecification{
+			AccountId:       aws.String(memberMap["account_id"].(string)),
+			MemberAbilities: expandMemberAbilities(memberMap["member_abilities"].([]interface{})),
+			DisplayName:     aws.String(memberMap["display_name"].(string)),
+		}
+		members = append(members, *member)
+	}
+	return &members
+}
+
+func flattenDataEncryptionMetadata(dataEncryptionMetadata *types.DataEncryptionMetadata) []interface{} {
+	if dataEncryptionMetadata == nil {
+		return nil
+	}
+	m := map[string]interface{}{}
+	m["preserve_nulls"] = aws.Bool(*dataEncryptionMetadata.PreserveNulls)
+	m["allow_clear_text"] = aws.Bool(*dataEncryptionMetadata.AllowCleartext)
+	m["allow_joins_on_columns_with_different_names"] = aws.Bool(*dataEncryptionMetadata.AllowJoinsOnColumnsWithDifferentNames)
+	m["allow_duplicates"] = aws.Bool(*dataEncryptionMetadata.AllowDuplicates)
+	return []interface{}{m}
+}
+
+func flattenMembers(members []types.MemberSummary, ownerAccount *string) []interface{} {
+	flattenedMembers := []interface{}{}
+	for _, member := range members {
+		if aws.ToString(member.AccountId) != aws.ToString(ownerAccount) {
+			memberMap := map[string]interface{}{}
+			memberMap["status"] = member.Status
+			memberMap["account_id"] = member.AccountId
+			memberMap["display_name"] = member.DisplayName
+			memberMap["member_abilities"] = flattenMemberAbilities(member.Abilities)
+			flattenedMembers = append(flattenedMembers, memberMap)
+		}
+	}
+	return flattenedMembers
+}
+
+func flattenCreatorAbilities(members []types.MemberSummary, ownerAccount *string) []string {
+	flattenedAbilities := []string{}
+	for _, member := range members {
+		if aws.ToString(member.AccountId) == aws.ToString(ownerAccount) {
+			return flattenMemberAbilities(member.Abilities)
+		}
+	}
+	return flattenedAbilities
+}
+
+func flattenMemberAbilities(abilities []types.MemberAbility) []string {
+	flattenedAbilities := []string{}
+	for _, ability := range abilities {
+		flattenedAbilities = append(flattenedAbilities, string(ability))
+	}
+	return flattenedAbilities
+}
diff --git a/internal/service/cleanrooms/collaboration_test.go b/internal/service/cleanrooms/collaboration_test.go
new file mode 100644
index 00000000000..d7c0619af13
--- /dev/null
+++ b/internal/service/cleanrooms/collaboration_test.go
@@ -0,0 +1,539 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package cleanrooms_test
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"reflect"
+	"testing"
+
+	"github.com/YakDriver/regexache"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/cleanrooms"
+	"github.com/aws/aws-sdk-go-v2/service/cleanrooms/types"
+	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
+	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/create"
+	tfcleanrooms "github.com/hashicorp/terraform-provider-aws/internal/service/cleanrooms"
+	"github.com/hashicorp/terraform-provider-aws/names"
+)
+
+func TestAccCleanRoomsCollaboration_basic(t *testing.T) {
+	ctx := acctest.Context(t)
+
+	var collaboration cleanrooms.GetCollaborationOutput
+	resourceName := "aws_cleanrooms_collaboration.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, names.CleanRoomsEndpointID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckCollaborationDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccCollaborationConfig_basic(TEST_NAME, TEST_DESCRIPTION, TEST_TAG),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckCollaborationExists(ctx, resourceName, &collaboration),
+					resource.TestCheckResourceAttr(resourceName, "name", TEST_NAME),
+					resource.TestCheckResourceAttr(resourceName, "description", TEST_DESCRIPTION),
+					resource.TestCheckResourceAttr(resourceName, "query_log_status", TEST_QUERY_LOG_STATUS),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "data_encryption_metadata.*", map[string]string{
+						"allow_clear_text": "true",
+						"allow_duplicates": "true",
+						"allow_joins_on_columns_with_different_names": "true",
+						"preserve_nulls": "false",
+					}),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "cleanrooms", regexache.MustCompile(`collaboration:*`)),
+					testCheckCreatorMember(ctx, resourceName),
+					testAccCollaborationTags(ctx, resourceName, map[string]string{
+						"Project": TEST_TAG,
+					}),
+				),
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"apply_immediately", "user"},
+			},
+		},
+	})
+}
+
+func TestAccCleanRoomsCollaboration_disappears(t *testing.T) {
+	ctx := acctest.Context(t)
+
+	var collaboration cleanrooms.GetCollaborationOutput
+	resourceName := "aws_cleanrooms_collaboration.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, names.CleanRoomsEndpointID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckCollaborationDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccCollaborationConfig_basic(TEST_NAME, TEST_DESCRIPTION, TEST_TAG),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckCollaborationExists(ctx, resourceName, &collaboration),
+					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfcleanrooms.ResourceCollaboration(), resourceName),
+				),
+				ExpectNonEmptyPlan: true,
+			},
+		},
+	})
+}
+
+func TestAccCleanRoomsCollaboration_mutableProperties(t *testing.T) {
+	ctx := acctest.Context(t)
+
+	var collaboration cleanrooms.GetCollaborationOutput
+	updatedName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_cleanrooms_collaboration.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, names.CleanRoomsEndpointID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckCollaborationDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccCollaborationConfig_basic(TEST_NAME, TEST_DESCRIPTION, TEST_TAG),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckCollaborationExists(ctx, resourceName, &collaboration),
+				),
+			},
+			{
+				Config: testAccCollaborationConfig_basic(updatedName, "updated Description", "Not Terraform"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckCollaborationIsTheSame(resourceName, &collaboration),
+					resource.TestCheckResourceAttr(resourceName, "name", updatedName),
+					resource.TestCheckResourceAttr(resourceName, "description", "updated Description"),
+					testAccCollaborationTags(ctx, resourceName, map[string]string{
+						"Project": "Not Terraform",
+					}),
+				),
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"apply_immediately", "user"},
+			},
+		},
+	})
+}
+
+func TestAccCleanRoomsCollaboration_updateCreatorDisplayName(t *testing.T) {
+	ctx := acctest.Context(t)
+
+	var collaboration cleanrooms.GetCollaborationOutput
+	resourceName := "aws_cleanrooms_collaboration.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, names.CleanRoomsEndpointID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckCollaborationDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccCollaborationConfig_basic(TEST_NAME, TEST_DESCRIPTION, TEST_TAG),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckCollaborationExists(ctx, resourceName, &collaboration),
+				),
+			},
+			{
+				Config: testAccCollaborationConfig_creatorDisplayName(TEST_NAME, TEST_DESCRIPTION, TEST_TAG, "updatedName"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckCollaborationRecreated(resourceName, &collaboration),
+					resource.TestCheckResourceAttr(resourceName, "creator_display_name", "updatedName"),
+				),
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"apply_immediately", "user"},
+			},
+		},
+	})
+}
+func TestAccCleanRoomsCollaboration_updateQueryLogStatus(t *testing.T) {
+	ctx := acctest.Context(t)
+
+	var collaboration cleanrooms.GetCollaborationOutput
+	resourceName := "aws_cleanrooms_collaboration.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, names.CleanRoomsEndpointID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckCollaborationDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccCollaborationConfig_basic(TEST_NAME, TEST_DESCRIPTION, TEST_TAG),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckCollaborationExists(ctx, resourceName, &collaboration),
+				),
+			},
+			{
+				Config: testAccCollaborationConfig_queryLogStatus(TEST_NAME, TEST_DESCRIPTION, TEST_TAG, "ENABLED"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckCollaborationRecreated(resourceName, &collaboration),
+					resource.TestCheckResourceAttr(resourceName, "query_log_status", "ENABLED"),
+				),
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"apply_immediately", "user"},
+			},
+		},
+	})
+}
+func TestAccCleanRoomsCollaboration_dataEncryptionSettings(t *testing.T) {
+	ctx := acctest.Context(t)
+
+	var collaboration cleanrooms.GetCollaborationOutput
+	resourceName := "aws_cleanrooms_collaboration.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, names.CleanRoomsEndpointID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckCollaborationDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccCollaborationConfig_basic(TEST_NAME, TEST_DESCRIPTION, TEST_TAG),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckCollaborationExists(ctx, resourceName, &collaboration),
+				),
+			},
+			{
+				Config: testAccCollaborationConfig_updatedDataEncryptionSettings(TEST_NAME, TEST_DESCRIPTION, TEST_TAG),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckCollaborationRecreated(resourceName, &collaboration),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "data_encryption_metadata.*", map[string]string{
+						"allow_clear_text": "true",
+						"allow_duplicates": "true",
+						"allow_joins_on_columns_with_different_names": "true",
+						"preserve_nulls": "true",
+					}),
+				),
+			},
+			{
+				Config: testAccCollaborationConfig_noDataEncryptionSettings(TEST_NAME, TEST_DESCRIPTION, TEST_TAG),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckCollaborationRecreated(resourceName, &collaboration),
+					resource.TestCheckResourceAttr(resourceName, "data_encryption_metadata.#", "0"),
+				),
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"apply_immediately", "user"},
+			},
+		},
+	})
+}
+
+func TestAccCleanRoomsCollaboration_updateMemberAbilities(t *testing.T) {
+	ctx := acctest.Context(t)
+
+	var collaboration cleanrooms.GetCollaborationOutput
+	resourceName := "aws_cleanrooms_collaboration.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, names.CleanRoomsEndpointID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckCollaborationDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccCollaborationConfig_additionalMember(TEST_NAME, TEST_DESCRIPTION, TEST_TAG),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckCollaborationExists(ctx, resourceName, &collaboration),
+					resource.TestCheckResourceAttr(resourceName, "member.0.account_id", "123456789012"),
+					resource.TestCheckResourceAttr(resourceName, "member.0.display_name", "OtherMember"),
+					resource.TestCheckResourceAttr(resourceName, "member.0.status", "INVITED"),
+					resource.TestCheckResourceAttr(resourceName, "member.0.member_abilities.#", "0"),
+				),
+			},
+			{
+				Config: testAccCollaborationConfig_swapMemberAbilities(TEST_NAME, TEST_DESCRIPTION, TEST_TAG),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckCollaborationRecreated(resourceName, &collaboration),
+					resource.TestCheckResourceAttr(resourceName, "creator_member_abilities.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "member.0.member_abilities.#", "2"),
+				),
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"apply_immediately", "user"},
+			},
+		},
+	})
+}
+
+func testAccCheckCollaborationDestroy(ctx context.Context) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		conn := acctest.Provider.Meta().(*conns.AWSClient).CleanRoomsClient(ctx)
+
+		for _, rs := range s.RootModule().Resources {
+			if rs.Type != "aws_cleanrooms_collaboration" {
+				continue
+			}
+
+			_, err := conn.GetCollaboration(ctx, &cleanrooms.GetCollaborationInput{
+				CollaborationIdentifier: aws.String(rs.Primary.ID),
+			})
+			if err != nil {
+				// We throw access denied exceptions for Not Found Collaboration since they are cross account resources
+				var nfe *types.AccessDeniedException
+				if errors.As(err, &nfe) {
+					return nil
+				}
+				return err
+			}
+
+			return create.Error(names.CleanRooms, create.ErrActionCheckingDestroyed, tfcleanrooms.ResNameCollaboration, rs.Primary.ID, errors.New("not destroyed"))
+		}
+
+		return nil
+	}
+}
+
+func testAccCheckCollaborationExists(ctx context.Context, name string, collaboration *cleanrooms.GetCollaborationOutput) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[name]
+		if !ok {
+			return create.Error(names.CleanRooms, create.ErrActionCheckingExistence, tfcleanrooms.ResNameCollaboration, name, errors.New("not found"))
+		}
+
+		if rs.Primary.ID == "" {
+			return create.Error(names.CleanRooms, create.ErrActionCheckingExistence, tfcleanrooms.ResNameCollaboration, name, errors.New("not set"))
+		}
+
+		conn := acctest.Provider.Meta().(*conns.AWSClient).CleanRoomsClient(ctx)
+		resp, err := conn.GetCollaboration(ctx, &cleanrooms.GetCollaborationInput{
+			CollaborationIdentifier: aws.String(rs.Primary.ID),
+		})
+
+		if err != nil {
+			return create.Error(names.CleanRooms, create.ErrActionCheckingExistence, tfcleanrooms.ResNameCollaboration, rs.Primary.ID, err)
+		}
+
+		*collaboration = *resp
+
+		return nil
+	}
+}
+
+func testAccCheckCollaborationIsTheSame(name string, collaboration *cleanrooms.GetCollaborationOutput) resource.TestCheckFunc {
+	return func(state *terraform.State) error {
+		return checkCollaborationIsSame(name, collaboration, state)
+	}
+}
+
+func testAccCheckCollaborationRecreated(name string, collaboration *cleanrooms.GetCollaborationOutput) resource.TestCheckFunc {
+	return func(state *terraform.State) error {
+		err := checkCollaborationIsSame(name, collaboration, state)
+		if err == nil {
+			return fmt.Errorf("Collaboration was expected to be recreated but was updated")
+		}
+		return nil
+	}
+}
+
+func checkCollaborationIsSame(name string, collaboration *cleanrooms.GetCollaborationOutput, s *terraform.State) error {
+	rs, ok := s.RootModule().Resources[name]
+	if !ok {
+		return create.Error(names.CleanRooms, create.ErrActionCheckingExistence, tfcleanrooms.ResNameCollaboration, name, errors.New("not found"))
+	}
+
+	if rs.Primary.ID == "" {
+		return create.Error(names.CleanRooms, create.ErrActionCheckingExistence, tfcleanrooms.ResNameCollaboration, name, errors.New("not set"))
+	}
+	if rs.Primary.ID != *collaboration.Collaboration.Id {
+		return fmt.Errorf("New collaboration: %s created instead of updating: %s", rs.Primary.ID, *collaboration.Collaboration.Id)
+	}
+	return nil
+}
+
+func testAccPreCheck(ctx context.Context, t *testing.T) {
+	conn := acctest.Provider.Meta().(*conns.AWSClient).CleanRoomsClient(ctx)
+
+	input := &cleanrooms.ListCollaborationsInput{}
+	_, err := conn.ListCollaborations(ctx, input)
+
+	if acctest.PreCheckSkipError(err) {
+		t.Skipf("skipping acceptance testing: %s", err)
+	}
+
+	if err != nil {
+		t.Fatalf("unexpected PreCheck error: %s", err)
+	}
+}
+
+func testCheckCreatorMember(ctx context.Context, name string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		conn := acctest.Provider.Meta().(*conns.AWSClient).CleanRoomsClient(ctx)
+		collaboration, ok := s.RootModule().Resources[name]
+		if !ok {
+			return fmt.Errorf("Collaboration: %s not found in resources", name)
+		}
+		membersOut, err := conn.ListMembers(ctx, &cleanrooms.ListMembersInput{
+			CollaborationIdentifier: &collaboration.Primary.ID,
+		})
+		if err != nil {
+			return err
+		}
+		if len(membersOut.MemberSummaries) != 1 {
+			return fmt.Errorf("Expected 1 member but found %d", len(membersOut.MemberSummaries))
+		}
+		member := membersOut.MemberSummaries[0]
+		if *member.AccountId != acctest.AccountID() {
+			return fmt.Errorf("Member account id %s does not match expected value", acctest.AccountID())
+		}
+		if member.Status != types.MemberStatusInvited {
+			return fmt.Errorf("Member status: %s does not match expected value", member.Status)
+		}
+		if *member.DisplayName != "creator" {
+			return fmt.Errorf("member ")
+		}
+		expectedAbilities := []types.MemberAbility{types.MemberAbilityCanQuery, types.MemberAbilityCanReceiveResults}
+		if !reflect.DeepEqual(member.Abilities, expectedAbilities) {
+			return fmt.Errorf("Member abilities: %s do not match expected values: %s", member.Abilities, expectedAbilities)
+		}
+
+		return nil
+	}
+}
+
+func testAccCollaborationTags(ctx context.Context, name string, expectedTags map[string]string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		conn := acctest.Provider.Meta().(*conns.AWSClient).CleanRoomsClient(ctx)
+		collaboration, ok := s.RootModule().Resources[name]
+		if !ok {
+			return fmt.Errorf("Collaboration: %s not found in resources", name)
+		}
+		tagsOut, err := conn.ListTagsForResource(ctx, &cleanrooms.ListTagsForResourceInput{
+			ResourceArn: aws.String(collaboration.Primary.Attributes["arn"]),
+		})
+		if err != nil {
+			return err
+		}
+		if !reflect.DeepEqual(expectedTags, tagsOut.Tags) {
+			return fmt.Errorf("Actual tags do not match expected")
+		}
+		return nil
+	}
+}
+
+const TEST_NAME = "name"
+const TEST_DESCRIPTION = "description"
+const TEST_TAG = "Terraform"
+const TEST_MEMBER_ABILITIES = "[\"CAN_QUERY\", \"CAN_RECEIVE_RESULTS\"]"
+const TEST_CREATOR_DISPLAY_NAME = "creator"
+const TEST_QUERY_LOG_STATUS = "DISABLED"
+const TEST_DATA_ENCRYPTION_SETTINGS = `
+  data_encryption_metadata {
+    allow_clear_text = true
+    allow_duplicates = true
+    allow_joins_on_columns_with_different_names = true
+    preserve_nulls = false
+  }
+`
+const TEST_ADDITIONAL_MEMBER = `
+member {
+    account_id = 123456789012
+    display_name = "OtherMember"
+    member_abilities = [] 
+  }
+`
+
+func testAccCollaborationConfig_basic(rName string, description string, tagValue string) string {
+	return testAccCollaboration_configurable(rName, description, tagValue, TEST_MEMBER_ABILITIES,
+		TEST_CREATOR_DISPLAY_NAME, TEST_QUERY_LOG_STATUS, TEST_DATA_ENCRYPTION_SETTINGS, "")
+}
+
+func testAccCollaborationConfig_additionalMember(rName string, description string, tagValue string) string {
+	return testAccCollaboration_configurable(rName, description, tagValue, TEST_MEMBER_ABILITIES,
+		TEST_CREATOR_DISPLAY_NAME, TEST_QUERY_LOG_STATUS, TEST_DATA_ENCRYPTION_SETTINGS, TEST_ADDITIONAL_MEMBER)
+}
+
+func testAccCollaborationConfig_swapMemberAbilities(rName string, description string, tagValue string) string {
+	additionalMember := `
+		member {
+			account_id = 123456789012
+			display_name = "OtherMember"
+			member_abilities = ["CAN_QUERY", "CAN_RECEIVE_RESULTS"] 
+		}
+	`
+
+	return testAccCollaboration_configurable(rName, description, tagValue, "[]",
+		TEST_CREATOR_DISPLAY_NAME, TEST_QUERY_LOG_STATUS, TEST_DATA_ENCRYPTION_SETTINGS, additionalMember)
+}
+
+func testAccCollaborationConfig_creatorDisplayName(name string, description string, tagValue string, creatorDisplayName string) string {
+	return testAccCollaboration_configurable(name, description, tagValue, TEST_MEMBER_ABILITIES,
+		creatorDisplayName, TEST_QUERY_LOG_STATUS, TEST_DATA_ENCRYPTION_SETTINGS, "")
+}
+
+func testAccCollaborationConfig_queryLogStatus(rName string, description string, tagValue string, queryLogStatus string) string {
+	return testAccCollaboration_configurable(rName, description, tagValue, TEST_MEMBER_ABILITIES,
+		TEST_CREATOR_DISPLAY_NAME, queryLogStatus, TEST_DATA_ENCRYPTION_SETTINGS, "")
+}
+
+func testAccCollaborationConfig_updatedDataEncryptionSettings(name string, description string, tagValue string) string {
+	encryptionSettings := `
+	data_encryption_metadata {
+		allow_clear_text = true
+		allow_duplicates = true
+		allow_joins_on_columns_with_different_names = true
+		preserve_nulls = true
+	}
+	`
+	return testAccCollaboration_configurable(name, description, tagValue, TEST_MEMBER_ABILITIES,
+		TEST_CREATOR_DISPLAY_NAME, TEST_QUERY_LOG_STATUS, encryptionSettings, "")
+}
+
+func testAccCollaborationConfig_noDataEncryptionSettings(name string, description string, tagValue string) string {
+	return testAccCollaboration_configurable(name, description, tagValue, TEST_MEMBER_ABILITIES,
+		TEST_CREATOR_DISPLAY_NAME, TEST_QUERY_LOG_STATUS, "", "")
+}
+
+func testAccCollaboration_configurable(name string, description string, tagValue string,
+	creatorMemberAbilities string, creatorDisplayName string, queryLogStatus string,
+	dataEncryptionMetadata string, additionalMember string) string {
+	return fmt.Sprintf(`
+resource "aws_cleanrooms_collaboration" "test" {
+  name                     = %[1]q
+  creator_member_abilities = %[4]s
+  creator_display_name     = %[5]q
+  description              = %[2]q
+  query_log_status         = %[6]q
+
+		%[7]s
+
+		%[8]s
+
+  tags = {
+    Project = %[3]q
+  }
+}
+
+
+	`, name, description, tagValue, creatorMemberAbilities, creatorDisplayName, queryLogStatus,
+		dataEncryptionMetadata, additionalMember)
+}
diff --git a/internal/service/cleanrooms/configured_table.go b/internal/service/cleanrooms/configured_table.go
new file mode 100644
index 00000000000..59e7d79a52e
--- /dev/null
+++ b/internal/service/cleanrooms/configured_table.go
@@ -0,0 +1,272 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package cleanrooms
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"log"
+	"time"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/cleanrooms"
+	"github.com/aws/aws-sdk-go-v2/service/cleanrooms/types"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/create"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs"
+	"github.com/hashicorp/terraform-provider-aws/internal/flex"
+	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/internal/verify"
+	"github.com/hashicorp/terraform-provider-aws/names"
+)
+
+// @SDKResource("aws_cleanrooms_configured_table")
+// @Tags(identifierAttribute="arn")
+func ResourceConfiguredTable() *schema.Resource {
+	return &schema.Resource{
+		CreateWithoutTimeout: resourceConfiguredTableCreate,
+		ReadWithoutTimeout:   resourceConfiguredTableRead,
+		UpdateWithoutTimeout: resourceConfiguredTableUpdate,
+		DeleteWithoutTimeout: resourceConfiguredTableDelete,
+
+		Importer: &schema.ResourceImporter{
+			StateContext: schema.ImportStatePassthroughContext,
+		},
+
+		Timeouts: &schema.ResourceTimeout{
+			Create: schema.DefaultTimeout(1 * time.Minute),
+			Update: schema.DefaultTimeout(1 * time.Minute),
+			Delete: schema.DefaultTimeout(1 * time.Minute),
+		},
+
+		Schema: map[string]*schema.Schema{
+			"allowed_columns": {
+				Type:     schema.TypeSet,
+				Required: true,
+				ForceNew: true,
+				Elem:     &schema.Schema{Type: schema.TypeString},
+				MinItems: 1,
+				MaxItems: 225,
+			},
+			"analysis_method": {
+				Type:     schema.TypeString,
+				Required: true,
+			},
+			names.AttrARN: {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"create_time": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			names.AttrDescription: {
+				Type:     schema.TypeString,
+				Optional: true,
+			},
+			names.AttrName: {
+				Type:     schema.TypeString,
+				Required: true,
+			},
+			"table_reference": {
+				Type:     schema.TypeList,
+				Required: true,
+				ForceNew: true,
+				MaxItems: 1,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"database_name": {
+							Type:     schema.TypeString,
+							Required: true,
+							ForceNew: true,
+						},
+						"table_name": {
+							Type:     schema.TypeString,
+							Required: true,
+							ForceNew: true,
+						},
+					},
+				},
+			},
+			names.AttrTags:    tftags.TagsSchema(),
+			names.AttrTagsAll: tftags.TagsSchemaComputed(),
+			"update_time": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+		},
+		CustomizeDiff: verify.SetTagsDiff,
+	}
+}
+
+const (
+	ResNameConfiguredTable = "Configured Table"
+)
+
+func resourceConfiguredTableCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	conn := meta.(*conns.AWSClient).CleanRoomsClient(ctx)
+
+	input := &cleanrooms.CreateConfiguredTableInput{
+		Name:           aws.String(d.Get(names.AttrName).(string)),
+		AllowedColumns: flex.ExpandStringValueSet(d.Get("allowed_columns").(*schema.Set)),
+		TableReference: expandTableReference(d.Get("table_reference").([]interface{})),
+		Tags:           getTagsIn(ctx),
+	}
+
+	analysisMethod, err := expandAnalysisMethod(d.Get("analysis_method").(string))
+	if err != nil {
+		return create.DiagError(names.CleanRooms, create.ErrActionCreating, ResNameConfiguredTable, d.Get("name").(string), err)
+	}
+	input.AnalysisMethod = analysisMethod
+
+	if v, ok := d.GetOk(names.AttrDescription); ok {
+		input.Description = aws.String(v.(string))
+	}
+
+	out, err := conn.CreateConfiguredTable(ctx, input)
+	if err != nil {
+		return create.DiagError(names.CleanRooms, create.ErrActionCreating, ResNameConfiguredTable, d.Get("name").(string), err)
+	}
+
+	if out == nil || out.ConfiguredTable == nil {
+		return create.DiagError(names.CleanRooms, create.ErrActionCreating, ResNameCollaboration, d.Get("name").(string), errors.New("empty output"))
+	}
+	d.SetId(aws.ToString(out.ConfiguredTable.Id))
+
+	return resourceConfiguredTableRead(ctx, d, meta)
+}
+
+func resourceConfiguredTableRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	conn := meta.(*conns.AWSClient).CleanRoomsClient(ctx)
+
+	out, err := findConfiguredTableByID(ctx, conn, d.Id())
+
+	if !d.IsNewResource() && tfresource.NotFound(err) {
+		log.Printf("[WARN] Clean Rooms Configured Table (%s) not found, removing from state", d.Id())
+		d.SetId("")
+		return nil
+	}
+
+	if err != nil {
+		return create.DiagError(names.CleanRooms, create.ErrActionReading, ResNameConfiguredTable, d.Id(), err)
+	}
+
+	configuredTable := out.ConfiguredTable
+	d.Set(names.AttrARN, configuredTable.Arn)
+	d.Set(names.AttrName, configuredTable.Name)
+	d.Set(names.AttrDescription, configuredTable.Description)
+	d.Set("allowed_columns", configuredTable.AllowedColumns)
+	d.Set("analysis_method", configuredTable.AnalysisMethod)
+	d.Set("create_time", configuredTable.CreateTime.String())
+	d.Set("update_time", configuredTable.UpdateTime.String())
+
+	if err := d.Set("table_reference", flattenTableReference(configuredTable.TableReference)); err != nil {
+		return diag.Errorf("setting table_reference: %s", err)
+	}
+
+	return nil
+}
+
+func resourceConfiguredTableUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).CleanRoomsClient(ctx)
+
+	if d.HasChangesExcept("tags", "tags_all") {
+		input := &cleanrooms.UpdateConfiguredTableInput{
+			ConfiguredTableIdentifier: aws.String(d.Id()),
+		}
+
+		if d.HasChanges(names.AttrDescription) {
+			input.Description = aws.String(d.Get(names.AttrDescription).(string))
+		}
+
+		if d.HasChanges(names.AttrName) {
+			input.Name = aws.String(d.Get(names.AttrName).(string))
+		}
+
+		_, err := conn.UpdateConfiguredTable(ctx, input)
+		if err != nil {
+			return create.DiagError(names.CleanRooms, create.ErrActionUpdating, ResNameConfiguredTable, d.Id(), err)
+		}
+	}
+
+	return append(diags, resourceConfiguredTableRead(ctx, d, meta)...)
+}
+
+func resourceConfiguredTableDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	conn := meta.(*conns.AWSClient).CleanRoomsClient(ctx)
+
+	log.Printf("[INFO] Deleting Clean Rooms Configured Table %s", d.Id())
+	in := &cleanrooms.DeleteConfiguredTableInput{
+		ConfiguredTableIdentifier: aws.String(d.Id()),
+	}
+
+	if _, err := conn.DeleteConfiguredTable(ctx, in); err != nil {
+		return create.DiagError(names.CleanRooms, create.ErrActionDeleting, ResNameConfiguredTable, d.Id(), err)
+	}
+
+	return nil
+}
+
+func findConfiguredTableByID(ctx context.Context, conn *cleanrooms.Client, id string) (*cleanrooms.GetConfiguredTableOutput, error) {
+	in := &cleanrooms.GetConfiguredTableInput{
+		ConfiguredTableIdentifier: aws.String(id),
+	}
+
+	out, err := conn.GetConfiguredTable(ctx, in)
+
+	if errs.IsA[*types.ResourceNotFoundException](err) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: in,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	if out == nil || out.ConfiguredTable == nil {
+		return nil, tfresource.NewEmptyResultError(in)
+	}
+
+	return out, nil
+}
+
+func expandAnalysisMethod(analysisMethod string) (types.AnalysisMethod, error) {
+	switch analysisMethod {
+	case "DIRECT_QUERY":
+		return types.AnalysisMethodDirectQuery, nil
+	default:
+		return "", fmt.Errorf("Invalid analysis method type: %s. Currently the only valid value is `DIRECT_QUERY`", analysisMethod)
+	}
+}
+
+func expandTableReference(data []interface{}) types.TableReference {
+	tableReference := data[0].(map[string]interface{})
+	return &types.TableReferenceMemberGlue{
+		Value: types.GlueTableReference{
+			DatabaseName: aws.String(tableReference["database_name"].(string)),
+			TableName:    aws.String(tableReference["table_name"].(string)),
+		},
+	}
+}
+
+func flattenTableReference(tableReference types.TableReference) []interface{} {
+	switch v := tableReference.(type) {
+	case *types.TableReferenceMemberGlue:
+		m := map[string]interface{}{
+			"database_name": v.Value.DatabaseName,
+			"table_name":    v.Value.TableName,
+		}
+		return []interface{}{m}
+	default:
+		return nil
+	}
+}
diff --git a/internal/service/cleanrooms/configured_table_test.go b/internal/service/cleanrooms/configured_table_test.go
new file mode 100644
index 00000000000..491aa9fd999
--- /dev/null
+++ b/internal/service/cleanrooms/configured_table_test.go
@@ -0,0 +1,487 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package cleanrooms_test
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"testing"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/cleanrooms"
+	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
+	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/create"
+	tfcleanrooms "github.com/hashicorp/terraform-provider-aws/internal/service/cleanrooms"
+	"github.com/hashicorp/terraform-provider-aws/names"
+)
+
+func TestAccCleanRoomsConfiguredTable_basic(t *testing.T) {
+	ctx := acctest.Context(t)
+
+	var configuredTable cleanrooms.GetConfiguredTableOutput
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_cleanrooms_configured_table.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheckConfiguredTable(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, names.CleanRoomsEndpointID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckConfiguredTableDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccConfiguredTableConfig_basic(TEST_NAME, TEST_DESCRIPTION, TEST_TAG, rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckConfiguredTableExists(ctx, resourceName, &configuredTable),
+					resource.TestCheckResourceAttr(resourceName, "name", TEST_NAME),
+					resource.TestCheckResourceAttr(resourceName, "description", TEST_DESCRIPTION),
+					resource.TestCheckResourceAttr(resourceName, "analysis_method", TEST_ANALYSIS_METHOD),
+					resource.TestCheckResourceAttr(resourceName, "allowed_columns.#", "2"),
+					resource.TestCheckResourceAttr(resourceName, "allowed_columns.0", "my_column_1"),
+					resource.TestCheckResourceAttr(resourceName, "allowed_columns.1", "my_column_2"),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "table_reference.*", map[string]string{
+						"database_name": rName,
+						"table_name":    rName,
+					}),
+					resource.TestCheckResourceAttr(resourceName, "tags.Project", TEST_TAG),
+				),
+			},
+		},
+	})
+}
+
+func TestAccCleanRoomsConfiguredTable_disappears(t *testing.T) {
+	ctx := acctest.Context(t)
+
+	var configuredTable cleanrooms.GetConfiguredTableOutput
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_cleanrooms_configured_table.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, names.CleanRoomsEndpointID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckConfiguredTableDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccConfiguredTableConfig_basic(TEST_NAME, TEST_DESCRIPTION, TEST_TAG, rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckConfiguredTableExists(ctx, resourceName, &configuredTable),
+					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfcleanrooms.ResourceConfiguredTable(), resourceName),
+				),
+				ExpectNonEmptyPlan: true,
+			},
+		},
+	})
+}
+
+func TestAccCleanRoomsConfiguredTable_mutableProperties(t *testing.T) {
+	ctx := acctest.Context(t)
+
+	var configuredTable cleanrooms.GetConfiguredTableOutput
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_cleanrooms_configured_table.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, names.CleanRoomsEndpointID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckConfiguredTableDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccConfiguredTableConfig_basic(TEST_NAME, TEST_DESCRIPTION, TEST_TAG, rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckConfiguredTableExists(ctx, resourceName, &configuredTable),
+				),
+			},
+			{
+				Config: testAccConfiguredTableConfig_basic(rName, "updated description", "updated tag", rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckConfiguredTableIsTheSame(resourceName, &configuredTable),
+					resource.TestCheckResourceAttr(resourceName, "name", rName),
+					resource.TestCheckResourceAttr(resourceName, "description", "updated description"),
+					resource.TestCheckResourceAttr(resourceName, "tags.Project", "updated tag"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccCleanRoomsConfiguredTable_updateAllowedColumns(t *testing.T) {
+	ctx := acctest.Context(t)
+
+	var configuredTable cleanrooms.GetConfiguredTableOutput
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_cleanrooms_configured_table.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, names.CleanRoomsEndpointID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckConfiguredTableDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccConfiguredTableConfig_allowedColumns(TEST_ALLOWED_COLUMNS, rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckConfiguredTableExists(ctx, resourceName, &configuredTable),
+					resource.TestCheckResourceAttr(resourceName, "allowed_columns.#", "2"),
+					resource.TestCheckResourceAttr(resourceName, "allowed_columns.0", "my_column_1"),
+					resource.TestCheckResourceAttr(resourceName, "allowed_columns.1", "my_column_2"),
+				),
+			},
+			{
+				Config: testAccConfiguredTableConfig_allowedColumns("[\"my_column_1\"]", rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckConfiguredTableRecreated(resourceName, &configuredTable),
+					resource.TestCheckResourceAttr(resourceName, "allowed_columns.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "allowed_columns.0", "my_column_1"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccCleanRoomsConfiguredTable_updateTableReference(t *testing.T) {
+	ctx := acctest.Context(t)
+
+	var configuredTable cleanrooms.GetConfiguredTableOutput
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	firstDatabaseName := rName
+	secondDatabaseName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_cleanrooms_configured_table.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, names.CleanRoomsEndpointID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckConfiguredTableDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccConfiguredTableConfig_additionalTables(rName, firstDatabaseName, secondDatabaseName, firstDatabaseName, TEST_FIRST_ADDITIONAL_TABLE_NAME),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckConfiguredTableExists(ctx, resourceName, &configuredTable),
+				),
+			},
+			{
+				Config: testAccConfiguredTableConfig_additionalTables(rName, firstDatabaseName, secondDatabaseName, secondDatabaseName, TEST_SECOND_ADDITIONAL_TABLE_NAME),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckConfiguredTableRecreated(resourceName, &configuredTable),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "table_reference.*", map[string]string{
+						"database_name": secondDatabaseName,
+						"table_name":    TEST_SECOND_ADDITIONAL_TABLE_NAME,
+					}),
+				),
+			},
+		},
+	})
+}
+
+func TestAccCleanRoomsConfiguredTable_updateTableReference_onlyDatabase(t *testing.T) {
+	ctx := acctest.Context(t)
+
+	var configuredTable cleanrooms.GetConfiguredTableOutput
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	firstDatabaseName := rName
+	secondDatabaseName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_cleanrooms_configured_table.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, names.CleanRoomsEndpointID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckConfiguredTableDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccConfiguredTableConfig_additionalTables(rName, firstDatabaseName, secondDatabaseName, firstDatabaseName, TEST_FIRST_ADDITIONAL_TABLE_NAME),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckConfiguredTableExists(ctx, resourceName, &configuredTable),
+				),
+			},
+			{
+				Config: testAccConfiguredTableConfig_additionalTables(rName, firstDatabaseName, secondDatabaseName, secondDatabaseName, TEST_FIRST_ADDITIONAL_TABLE_NAME),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckConfiguredTableRecreated(resourceName, &configuredTable),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "table_reference.*", map[string]string{
+						"database_name": secondDatabaseName,
+						"table_name":    TEST_FIRST_ADDITIONAL_TABLE_NAME,
+					}),
+				),
+			},
+		},
+	})
+}
+
+func TestAccCleanRoomsConfiguredTable_updateTableReference_onlyTable(t *testing.T) {
+	ctx := acctest.Context(t)
+
+	var configuredTable cleanrooms.GetConfiguredTableOutput
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	firstDatabaseName := rName
+	secondDatabaseName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_cleanrooms_configured_table.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, names.CleanRoomsEndpointID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckConfiguredTableDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccConfiguredTableConfig_additionalTables(rName, firstDatabaseName, secondDatabaseName, firstDatabaseName, TEST_FIRST_ADDITIONAL_TABLE_NAME),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckConfiguredTableExists(ctx, resourceName, &configuredTable),
+				),
+			},
+			{
+				Config: testAccConfiguredTableConfig_additionalTables(rName, firstDatabaseName, secondDatabaseName, firstDatabaseName, TEST_SECOND_ADDITIONAL_TABLE_NAME),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckConfiguredTableRecreated(resourceName, &configuredTable),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "table_reference.*", map[string]string{
+						"database_name": firstDatabaseName,
+						"table_name":    TEST_SECOND_ADDITIONAL_TABLE_NAME,
+					}),
+				),
+			},
+		},
+	})
+}
+
+func testAccPreCheckConfiguredTable(ctx context.Context, t *testing.T) {
+	conn := acctest.Provider.Meta().(*conns.AWSClient).CleanRoomsClient(ctx)
+
+	input := &cleanrooms.ListConfiguredTablesInput{}
+	_, err := conn.ListConfiguredTables(ctx, input)
+
+	if acctest.PreCheckSkipError(err) {
+		t.Skipf("skipping acceptance testing: %s", err)
+	}
+
+	if err != nil {
+		t.Fatalf("unexpected PreCheck error: %s", err)
+	}
+}
+
+func testAccCheckConfiguredTableDestroy(ctx context.Context) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		conn := acctest.Provider.Meta().(*conns.AWSClient).CleanRoomsClient(ctx)
+
+		for _, rs := range s.RootModule().Resources {
+			if rs.Type != tfcleanrooms.ResNameConfiguredTable {
+				continue
+			}
+
+			_, err := conn.GetConfiguredTable(ctx, &cleanrooms.GetConfiguredTableInput{
+				ConfiguredTableIdentifier: aws.String(rs.Primary.ID),
+			})
+
+			if err == nil {
+				return create.Error(names.CleanRooms, create.ErrActionCheckingExistence, tfcleanrooms.ResNameConfiguredTable, rs.Primary.ID, errors.New("not destroyed"))
+			}
+		}
+
+		return nil
+	}
+}
+
+func testAccCheckConfiguredTableExists(ctx context.Context, name string, configuredTable *cleanrooms.GetConfiguredTableOutput) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[name]
+		if !ok {
+			return create.Error(names.CleanRooms, create.ErrActionCheckingExistence, tfcleanrooms.ResNameConfiguredTable, name, errors.New("not found"))
+		}
+
+		if rs.Primary.ID == "" {
+			return create.Error(names.CleanRooms, create.ErrActionCheckingExistence, tfcleanrooms.ResNameConfiguredTable, name, errors.New("not set"))
+		}
+
+		client := acctest.Provider.Meta().(*conns.AWSClient).CleanRoomsClient(ctx)
+		resp, err := client.GetConfiguredTable(ctx, &cleanrooms.GetConfiguredTableInput{
+			ConfiguredTableIdentifier: aws.String(rs.Primary.ID),
+		})
+
+		if err != nil {
+			return create.Error(names.CleanRooms, create.ErrActionCheckingExistence, tfcleanrooms.ResNameConfiguredTable, rs.Primary.ID, err)
+		}
+
+		*configuredTable = *resp
+
+		return nil
+	}
+}
+
+func testAccCheckConfiguredTableIsTheSame(name string, configuredTable *cleanrooms.GetConfiguredTableOutput) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		return checkConfiguredTableIsTheSame(name, configuredTable, s)
+	}
+}
+
+func testAccCheckConfiguredTableRecreated(name string, configuredTable *cleanrooms.GetConfiguredTableOutput) resource.TestCheckFunc {
+	return func(state *terraform.State) error {
+		err := checkConfiguredTableIsTheSame(name, configuredTable, state)
+		if err == nil {
+			return fmt.Errorf("Configured Table was expected to be recreated but was updated")
+		}
+		return nil
+	}
+}
+
+func checkConfiguredTableIsTheSame(name string, configuredTable *cleanrooms.GetConfiguredTableOutput, s *terraform.State) error {
+	rs, ok := s.RootModule().Resources[name]
+	if !ok {
+		return create.Error(names.CleanRooms, create.ErrActionCheckingExistence, tfcleanrooms.ResNameConfiguredTable, name, errors.New("not found"))
+	}
+
+	if rs.Primary.ID == "" {
+		return create.Error(names.CleanRooms, create.ErrActionCheckingExistence, tfcleanrooms.ResNameConfiguredTable, name, errors.New("not set"))
+	}
+
+	if rs.Primary.ID != *configuredTable.ConfiguredTable.Id {
+		return fmt.Errorf("New configured table: %s created instead of updating: %s", rs.Primary.ID, *configuredTable.ConfiguredTable.Id)
+	}
+
+	return nil
+}
+
+const TEST_ALLOWED_COLUMNS = "[\"my_column_1\",\"my_column_2\"]"
+const TEST_ANALYSIS_METHOD = "DIRECT_QUERY"
+const TEST_DATABASE_NAME = "database"
+const TEST_TABLE_NAME = "table"
+
+func testAccConfiguredTableConfig_basic(name string, description string, tagValue string, rName string) string {
+	return testAccConfiguredTableConfig(rName, name, description, tagValue, TEST_ALLOWED_COLUMNS,
+		TEST_ANALYSIS_METHOD, rName, rName)
+}
+
+func testAccConfiguredTableConfig_allowedColumns(allowedColumns string, rName string) string {
+	return testAccConfiguredTableConfig(rName, TEST_NAME, TEST_DESCRIPTION, TEST_TAG, allowedColumns,
+		TEST_ANALYSIS_METHOD, rName, rName)
+}
+
+const TEST_FIRST_ADDITIONAL_TABLE_NAME = "table_1"
+const TEST_SECOND_ADDITIONAL_TABLE_NAME = "table_2"
+
+func testAccConfiguredTableConfig_additionalTables(rName string, firstDatabaseName string, secondDatabaseName string, databaseName string, tableName string) string {
+	storageDescriptor := `
+storage_descriptor {
+  location = "s3://${aws_s3_bucket.test.bucket}"
+
+  columns {
+    name = "my_column_1"
+    type = "string"
+  }
+}`
+	return fmt.Sprintf(`
+resource "aws_s3_bucket" "test" {
+  bucket = %[1]q
+}
+
+resource "aws_glue_catalog_database" "test_1" {
+  name = %[2]q
+}
+
+resource "aws_glue_catalog_database" "test_2" {
+  name = %[3]q
+}
+
+resource "aws_glue_catalog_table" "test_1" {
+  name          = %[7]q
+  database_name = aws_glue_catalog_database.test_1.name
+
+  %[6]s
+}
+
+resource "aws_glue_catalog_table" "test_2" {
+  name          = %[8]q
+  database_name = aws_glue_catalog_database.test_1.name
+
+  %[6]s
+}
+
+resource "aws_glue_catalog_table" "test_3" {
+  name          = %[7]q
+  database_name = aws_glue_catalog_database.test_2.name
+
+  %[6]s
+}
+
+resource "aws_glue_catalog_table" "test_4" {
+  name          = %[8]q
+  database_name = aws_glue_catalog_database.test_2.name
+
+  %[6]s
+}
+
+resource "aws_cleanrooms_configured_table" "test" {
+  name            = "test name"
+  description     = "test description"
+  analysis_method = "DIRECT_QUERY"
+  allowed_columns = ["my_column_1"]
+
+  table_reference {
+    database_name = %[4]q
+    table_name    = %[5]q
+  }
+
+  tags = {
+    Project = "Terraform"
+  }
+
+  depends_on = [aws_glue_catalog_table.test_1, aws_glue_catalog_table.test_2, aws_glue_catalog_table.test_3, aws_glue_catalog_table.test_4]
+}
+	`, rName, firstDatabaseName, secondDatabaseName, databaseName, tableName, storageDescriptor, TEST_FIRST_ADDITIONAL_TABLE_NAME, TEST_SECOND_ADDITIONAL_TABLE_NAME)
+}
+
+func testAccConfiguredTableConfig(rName string, name string, description string, tagValue string, allowedColumns string,
+	analysisMethod string, databaseName string, tableName string) string {
+	return fmt.Sprintf(`
+resource "aws_s3_bucket" "test" {
+  bucket = %[1]q
+}
+
+resource "aws_glue_catalog_database" "test" {
+  name = %[1]q
+}
+
+resource "aws_glue_catalog_table" "test" {
+  name          = %[1]q
+  database_name = %[1]q
+
+  storage_descriptor {
+    location = "s3://${aws_s3_bucket.test.bucket}"
+
+    columns {
+      name = "my_column_1"
+      type = "string"
+    }
+
+    columns {
+      name = "my_column_2"
+      type = "string"
+    }
+  }
+}
+
+resource "aws_cleanrooms_configured_table" "test" {
+  name            = %[2]q
+  description     = %[3]q
+  analysis_method = %[6]q
+  allowed_columns = %[5]s
+
+  table_reference {
+    database_name = %[7]q
+    table_name    = %[8]q
+  }
+
+  tags = {
+    Project = %[4]q
+  }
+
+  depends_on = [aws_glue_catalog_table.test]
+}
+	`, rName, name, description, tagValue, allowedColumns, analysisMethod, databaseName, tableName)
+}
diff --git a/internal/service/cleanrooms/generate.go b/internal/service/cleanrooms/generate.go
index d48abdfd118..a71b8f0cd26 100644
--- a/internal/service/cleanrooms/generate.go
+++ b/internal/service/cleanrooms/generate.go
@@ -1,4 +1,8 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/servicepackage/main.go
+//go:generate go run ../../generate/tags/main.go -AWSSDKVersion=2 -ListTags  -ServiceTagsMap -UpdateTags -TagTypeKeyElem=key -TagTypeValElem=value -KVTValues -SkipTypesImp
 // ONLY generate directives and package declaration! Do not add anything else to this file.
 
 package cleanrooms
diff --git a/internal/service/cleanrooms/service_package_gen.go b/internal/service/cleanrooms/service_package_gen.go
index 015dab1440d..0684efb284a 100644
--- a/internal/service/cleanrooms/service_package_gen.go
+++ b/internal/service/cleanrooms/service_package_gen.go
@@ -7,6 +7,7 @@ import (
 
 	aws_sdkv2 "github.com/aws/aws-sdk-go-v2/aws"
 	cleanrooms_sdkv2 "github.com/aws/aws-sdk-go-v2/service/cleanrooms"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -26,7 +27,22 @@ func (p *servicePackage) SDKDataSources(ctx context.Context) []*types.ServicePac
 }
 
 func (p *servicePackage) SDKResources(ctx context.Context) []*types.ServicePackageSDKResource {
-	return []*types.ServicePackageSDKResource{}
+	return []*types.ServicePackageSDKResource{
+		{
+			Factory:  ResourceCollaboration,
+			TypeName: "aws_cleanrooms_collaboration",
+			Tags: &types.ServicePackageResourceTags{
+				IdentifierAttribute: "arn",
+			},
+		},
+		{
+			Factory:  ResourceConfiguredTable,
+			TypeName: "aws_cleanrooms_configured_table",
+			Tags: &types.ServicePackageResourceTags{
+				IdentifierAttribute: "arn",
+			},
+		},
+	}
 }
 
 func (p *servicePackage) ServicePackageName() string {
@@ -39,9 +55,11 @@ func (p *servicePackage) NewClient(ctx context.Context, config map[string]any) (
 
 	return cleanrooms_sdkv2.NewFromConfig(cfg, func(o *cleanrooms_sdkv2.Options) {
 		if endpoint := config["endpoint"].(string); endpoint != "" {
-			o.EndpointResolver = cleanrooms_sdkv2.EndpointResolverFromURL(endpoint)
+			o.BaseEndpoint = aws_sdkv2.String(endpoint)
 		}
 	}), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/cleanrooms/tags_gen.go b/internal/service/cleanrooms/tags_gen.go
new file mode 100644
index 00000000000..3ec4b24cc38
--- /dev/null
+++ b/internal/service/cleanrooms/tags_gen.go
@@ -0,0 +1,128 @@
+// Code generated by internal/generate/tags/main.go; DO NOT EDIT.
+package cleanrooms
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/cleanrooms"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
+	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
+	"github.com/hashicorp/terraform-provider-aws/internal/types"
+	"github.com/hashicorp/terraform-provider-aws/names"
+)
+
+// listTags lists cleanrooms service tags.
+// The identifier is typically the Amazon Resource Name (ARN), although
+// it may also be a different identifier depending on the service.
+func listTags(ctx context.Context, conn *cleanrooms.Client, identifier string) (tftags.KeyValueTags, error) {
+	input := &cleanrooms.ListTagsForResourceInput{
+		ResourceArn: aws.String(identifier),
+	}
+
+	output, err := conn.ListTagsForResource(ctx, input)
+
+	if err != nil {
+		return tftags.New(ctx, nil), err
+	}
+
+	return KeyValueTags(ctx, output.Tags), nil
+}
+
+// ListTags lists cleanrooms service tags and set them in Context.
+// It is called from outside this package.
+func (p *servicePackage) ListTags(ctx context.Context, meta any, identifier string) error {
+	tags, err := listTags(ctx, meta.(*conns.AWSClient).CleanRoomsClient(ctx), identifier)
+
+	if err != nil {
+		return err
+	}
+
+	if inContext, ok := tftags.FromContext(ctx); ok {
+		inContext.TagsOut = types.Some(tags)
+	}
+
+	return nil
+}
+
+// map[string]string handling
+
+// Tags returns cleanrooms service tags.
+func Tags(tags tftags.KeyValueTags) map[string]string {
+	return tags.Map()
+}
+
+// KeyValueTags creates tftags.KeyValueTags from cleanrooms service tags.
+func KeyValueTags(ctx context.Context, tags map[string]string) tftags.KeyValueTags {
+	return tftags.New(ctx, tags)
+}
+
+// getTagsIn returns cleanrooms service tags from Context.
+// nil is returned if there are no input tags.
+func getTagsIn(ctx context.Context) map[string]string {
+	if inContext, ok := tftags.FromContext(ctx); ok {
+		if tags := Tags(inContext.TagsIn.UnwrapOrDefault()); len(tags) > 0 {
+			return tags
+		}
+	}
+
+	return nil
+}
+
+// setTagsOut sets cleanrooms service tags in Context.
+func setTagsOut(ctx context.Context, tags map[string]string) {
+	if inContext, ok := tftags.FromContext(ctx); ok {
+		inContext.TagsOut = types.Some(KeyValueTags(ctx, tags))
+	}
+}
+
+// updateTags updates cleanrooms service tags.
+// The identifier is typically the Amazon Resource Name (ARN), although
+// it may also be a different identifier depending on the service.
+func updateTags(ctx context.Context, conn *cleanrooms.Client, identifier string, oldTagsMap, newTagsMap any) error {
+	oldTags := tftags.New(ctx, oldTagsMap)
+	newTags := tftags.New(ctx, newTagsMap)
+
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
+	removedTags := oldTags.Removed(newTags)
+	removedTags = removedTags.IgnoreSystem(names.CleanRooms)
+	if len(removedTags) > 0 {
+		input := &cleanrooms.UntagResourceInput{
+			ResourceArn: aws.String(identifier),
+			TagKeys:     removedTags.Keys(),
+		}
+
+		_, err := conn.UntagResource(ctx, input)
+
+		if err != nil {
+			return fmt.Errorf("untagging resource (%s): %w", identifier, err)
+		}
+	}
+
+	updatedTags := oldTags.Updated(newTags)
+	updatedTags = updatedTags.IgnoreSystem(names.CleanRooms)
+	if len(updatedTags) > 0 {
+		input := &cleanrooms.TagResourceInput{
+			ResourceArn: aws.String(identifier),
+			Tags:        Tags(updatedTags),
+		}
+
+		_, err := conn.TagResource(ctx, input)
+
+		if err != nil {
+			return fmt.Errorf("tagging resource (%s): %w", identifier, err)
+		}
+	}
+
+	return nil
+}
+
+// UpdateTags updates cleanrooms service tags.
+// It is called from outside this package.
+func (p *servicePackage) UpdateTags(ctx context.Context, meta any, identifier string, oldTags, newTags any) error {
+	return updateTags(ctx, meta.(*conns.AWSClient).CleanRoomsClient(ctx), identifier, oldTags, newTags)
+}
diff --git a/internal/service/cloud9/consts.go b/internal/service/cloud9/consts.go
index b697a543a48..e69b8ed2222 100644
--- a/internal/service/cloud9/consts.go
+++ b/internal/service/cloud9/consts.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloud9
 
 import (
diff --git a/internal/service/cloud9/environment_ec2.go b/internal/service/cloud9/environment_ec2.go
index 4922ea9de3c..086dad1a758 100644
--- a/internal/service/cloud9/environment_ec2.go
+++ b/internal/service/cloud9/environment_ec2.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloud9
 
 import (
@@ -64,9 +67,11 @@ func ResourceEnvironmentEC2() *schema.Resource {
 					"amazonlinux-1-x86_64",
 					"amazonlinux-2-x86_64",
 					"ubuntu-18.04-x86_64",
+					"ubuntu-22.04-x86_64",
 					"resolve:ssm:/aws/service/cloud9/amis/amazonlinux-1-x86_64",
 					"resolve:ssm:/aws/service/cloud9/amis/amazonlinux-2-x86_64",
 					"resolve:ssm:/aws/service/cloud9/amis/ubuntu-18.04-x86_64",
+					"resolve:ssm:/aws/service/cloud9/amis/ubuntu-22.04-x86_64",
 				}, false),
 			},
 			"instance_type": {
diff --git a/internal/service/cloud9/environment_ec2_test.go b/internal/service/cloud9/environment_ec2_test.go
index a6cd6782c84..a67847b36f7 100644
--- a/internal/service/cloud9/environment_ec2_test.go
+++ b/internal/service/cloud9/environment_ec2_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloud9_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/cloud9"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -33,7 +36,7 @@ func TestAccCloud9EnvironmentEC2_basic(t *testing.T) {
 				Config: testAccEnvironmentEC2Config_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckEnvironmentEC2Exists(ctx, resourceName, &conf),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "cloud9", regexp.MustCompile(`environment:.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "cloud9", regexache.MustCompile(`environment:.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "connection_type", "CONNECT_SSH"),
 					resource.TestCheckResourceAttr(resourceName, "instance_type", "t2.micro"),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
@@ -60,6 +63,7 @@ func TestAccCloud9EnvironmentEC2_allFields(t *testing.T) {
 	name2 := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	description1 := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	description2 := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	imageID := "ubuntu-22.04-x86_64"
 	resourceName := "aws_cloud9_environment_ec2.test"
 
 	resource.ParallelTest(t, resource.TestCase{
@@ -69,17 +73,17 @@ func TestAccCloud9EnvironmentEC2_allFields(t *testing.T) {
 		CheckDestroy:             testAccCheckEnvironmentEC2Destroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccEnvironmentEC2Config_allFields(rName, name1, description1),
+				Config: testAccEnvironmentEC2Config_allFields(rName, name1, description1, imageID),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckEnvironmentEC2Exists(ctx, resourceName, &conf),
 					resource.TestCheckResourceAttr(resourceName, "automatic_stop_time_minutes", "60"),
 					resource.TestCheckResourceAttr(resourceName, "connection_type", "CONNECT_SSH"),
 					resource.TestCheckResourceAttr(resourceName, "description", description1),
-					resource.TestCheckResourceAttr(resourceName, "image_id", "amazonlinux-2-x86_64"),
+					resource.TestCheckResourceAttr(resourceName, "image_id", imageID),
 					resource.TestCheckResourceAttr(resourceName, "instance_type", "t2.micro"),
 					resource.TestCheckResourceAttr(resourceName, "name", name1),
 					resource.TestCheckResourceAttrPair(resourceName, "owner_arn", "aws_iam_user.test", "arn"),
-					resource.TestCheckResourceAttrPair(resourceName, "subnet_id", "aws_subnet.test", "id"),
+					resource.TestCheckResourceAttrPair(resourceName, "subnet_id", "aws_subnet.test.0", "id"),
 					resource.TestCheckResourceAttr(resourceName, "type", "ec2"),
 				),
 			},
@@ -90,7 +94,7 @@ func TestAccCloud9EnvironmentEC2_allFields(t *testing.T) {
 				ImportStateVerifyIgnore: []string{"automatic_stop_time_minutes", "image_id", "instance_type", "subnet_id"},
 			},
 			{
-				Config: testAccEnvironmentEC2Config_allFields(rName, name2, description2),
+				Config: testAccEnvironmentEC2Config_allFields(rName, name2, description2, imageID),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckEnvironmentEC2Exists(ctx, resourceName, &conf),
 					resource.TestCheckResourceAttr(resourceName, "description", description2),
@@ -225,26 +229,8 @@ func testAccCheckEnvironmentEC2Destroy(ctx context.Context) resource.TestCheckFu
 	}
 }
 
-func testAccEnvironmentEC2BaseConfig(rName string) string {
-	return acctest.ConfigCompose(acctest.ConfigAvailableAZsNoOptInDefaultExclude(), fmt.Sprintf(`
-resource "aws_vpc" "test" {
-  cidr_block = "10.0.0.0/16"
-
-  tags = {
-    Name = %[1]q
-  }
-}
-
-resource "aws_subnet" "test" {
-  availability_zone = data.aws_availability_zones.available.names[0]
-  cidr_block        = "10.0.0.0/24"
-  vpc_id            = aws_vpc.test.id
-
-  tags = {
-    Name = %[1]q
-  }
-}
-
+func testAccEnvironmentEC2Config_base(rName string) string {
+	return acctest.ConfigCompose(acctest.ConfigVPCWithSubnets(rName, 1), fmt.Sprintf(`
 resource "aws_internet_gateway" "test" {
   vpc_id = aws_vpc.test.id
 
@@ -262,40 +248,40 @@ resource "aws_route" "test" {
 }
 
 func testAccEnvironmentEC2Config_basic(rName string) string {
-	return acctest.ConfigCompose(testAccEnvironmentEC2BaseConfig(rName), fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccEnvironmentEC2Config_base(rName), fmt.Sprintf(`
 resource "aws_cloud9_environment_ec2" "test" {
   instance_type = "t2.micro"
   name          = %[1]q
-  subnet_id     = aws_subnet.test.id
+  subnet_id     = aws_subnet.test[0].id
 }
 `, rName))
 }
 
-func testAccEnvironmentEC2Config_allFields(rName, name, description string) string {
-	return acctest.ConfigCompose(testAccEnvironmentEC2BaseConfig(rName), fmt.Sprintf(`
+func testAccEnvironmentEC2Config_allFields(rName, name, description, imageID string) string {
+	return acctest.ConfigCompose(testAccEnvironmentEC2Config_base(rName), fmt.Sprintf(`
 resource "aws_cloud9_environment_ec2" "test" {
   automatic_stop_time_minutes = 60
   description                 = %[2]q
   instance_type               = "t2.micro"
   name                        = %[1]q
   owner_arn                   = aws_iam_user.test.arn
-  subnet_id                   = aws_subnet.test.id
+  subnet_id                   = aws_subnet.test[0].id
   connection_type             = "CONNECT_SSH"
-  image_id                    = "amazonlinux-2-x86_64"
+  image_id                    = %[4]q
 }
 
 resource "aws_iam_user" "test" {
   name = %[3]q
 }
-`, name, description, rName))
+`, name, description, rName, imageID))
 }
 
 func testAccEnvironmentEC2Config_tags1(rName, tagKey1, tagValue1 string) string {
-	return acctest.ConfigCompose(testAccEnvironmentEC2BaseConfig(rName), fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccEnvironmentEC2Config_base(rName), fmt.Sprintf(`
 resource "aws_cloud9_environment_ec2" "test" {
   instance_type = "t2.micro"
   name          = %[1]q
-  subnet_id     = aws_subnet.test.id
+  subnet_id     = aws_subnet.test[0].id
 
   tags = {
     %[2]q = %[3]q
@@ -305,11 +291,11 @@ resource "aws_cloud9_environment_ec2" "test" {
 }
 
 func testAccEnvironmentEC2Config_tags2(rName, tagKey1, tagValue1, tagKey2, tagValue2 string) string {
-	return acctest.ConfigCompose(testAccEnvironmentEC2BaseConfig(rName), fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccEnvironmentEC2Config_base(rName), fmt.Sprintf(`
 resource "aws_cloud9_environment_ec2" "test" {
   instance_type = "t2.micro"
   name          = %[1]q
-  subnet_id     = aws_subnet.test.id
+  subnet_id     = aws_subnet.test[0].id
 
   tags = {
     %[2]q = %[3]q
diff --git a/internal/service/cloud9/environment_membership.go b/internal/service/cloud9/environment_membership.go
index 17537cb2161..db373ee8a2b 100644
--- a/internal/service/cloud9/environment_membership.go
+++ b/internal/service/cloud9/environment_membership.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloud9
 
 import (
diff --git a/internal/service/cloud9/environment_membership_test.go b/internal/service/cloud9/environment_membership_test.go
index c534f7c0a60..da54ab2fde3 100644
--- a/internal/service/cloud9/environment_membership_test.go
+++ b/internal/service/cloud9/environment_membership_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloud9_test
 
 import (
diff --git a/internal/service/cloud9/find.go b/internal/service/cloud9/find.go
index d8c65262208..5a13c3f95d2 100644
--- a/internal/service/cloud9/find.go
+++ b/internal/service/cloud9/find.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloud9
 
 import (
diff --git a/internal/service/cloud9/generate.go b/internal/service/cloud9/generate.go
index bf5153465e8..6c2e0a708f7 100644
--- a/internal/service/cloud9/generate.go
+++ b/internal/service/cloud9/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTags -ListTagsInIDElem=ResourceARN -ServiceTagsSlice -TagInIDElem=ResourceARN -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/cloud9/service_package_gen.go b/internal/service/cloud9/service_package_gen.go
index 200e2aff385..a399df9b48a 100644
--- a/internal/service/cloud9/service_package_gen.go
+++ b/internal/service/cloud9/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	cloud9_sdkv1 "github.com/aws/aws-sdk-go/service/cloud9"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -54,4 +55,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*c
 	return cloud9_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/cloud9/status.go b/internal/service/cloud9/status.go
index 0187562b8c0..ceef6094ce8 100644
--- a/internal/service/cloud9/status.go
+++ b/internal/service/cloud9/status.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloud9
 
 import (
diff --git a/internal/service/cloud9/sweep.go b/internal/service/cloud9/sweep.go
index c983b7f07e7..68aee88c111 100644
--- a/internal/service/cloud9/sweep.go
+++ b/internal/service/cloud9/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package cloud9
 
@@ -11,9 +11,10 @@ import (
 	"github.com/aws/aws-sdk-go/service/cloud9"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_cloud9_environment_ec2", &resource.Sweeper{
 		Name: "aws_cloud9_environment_ec2",
 		F:    sweepEnvironmentEC2s,
@@ -22,7 +23,7 @@ func init() {
 
 func sweepEnvironmentEC2s(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -46,7 +47,7 @@ func sweepEnvironmentEC2s(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Cloud9 EC2 Environment sweep for %s: %s", region, err)
 		return nil
 	}
@@ -55,7 +56,7 @@ func sweepEnvironmentEC2s(region string) error {
 		return fmt.Errorf("error listing Cloud9 EC2 Environments (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping Cloud9 EC2 Environments (%s): %w", region, err)
diff --git a/internal/service/cloud9/tags_gen.go b/internal/service/cloud9/tags_gen.go
index 795a361cb24..e421d534c47 100644
--- a/internal/service/cloud9/tags_gen.go
+++ b/internal/service/cloud9/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/cloud9"
 	"github.com/aws/aws-sdk-go/service/cloud9/cloud9iface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -102,6 +104,8 @@ func updateTags(ctx context.Context, conn cloud9iface.Cloud9API, identifier stri
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.Cloud9)
 	if len(removedTags) > 0 {
diff --git a/internal/service/cloud9/wait.go b/internal/service/cloud9/wait.go
index 94008508411..634191871c0 100644
--- a/internal/service/cloud9/wait.go
+++ b/internal/service/cloud9/wait.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloud9
 
 import (
diff --git a/internal/service/cloudcontrol/generate.go b/internal/service/cloudcontrol/generate.go
index 5311990637d..8cf40119c93 100644
--- a/internal/service/cloudcontrol/generate.go
+++ b/internal/service/cloudcontrol/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
 
diff --git a/internal/service/cloudcontrol/resource.go b/internal/service/cloudcontrol/resource.go
index 37667fb2b02..4138f66a856 100644
--- a/internal/service/cloudcontrol/resource.go
+++ b/internal/service/cloudcontrol/resource.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudcontrol
 
 import (
@@ -5,9 +8,9 @@ import (
 	"encoding/json"
 	"fmt"
 	"log"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/cloudcontrol"
 	"github.com/aws/aws-sdk-go-v2/service/cloudcontrol/types"
@@ -63,7 +66,7 @@ func ResourceResource() *schema.Resource {
 				Type:         schema.TypeString,
 				Required:     true,
 				ForceNew:     true,
-				ValidateFunc: validation.StringMatch(regexp.MustCompile(`[A-Za-z0-9]{2,64}::[A-Za-z0-9]{2,64}::[A-Za-z0-9]{2,64}`), "must be three alphanumeric sections separated by double colons (::)"),
+				ValidateFunc: validation.StringMatch(regexache.MustCompile(`[0-9A-Za-z]{2,64}::[0-9A-Za-z]{2,64}::[0-9A-Za-z]{2,64}`), "must be three alphanumeric sections separated by double colons (::)"),
 			},
 			"type_version_id": {
 				Type:     schema.TypeString,
diff --git a/internal/service/cloudcontrol/resource_data_source.go b/internal/service/cloudcontrol/resource_data_source.go
index 6312b81a641..165eb80c1a5 100644
--- a/internal/service/cloudcontrol/resource_data_source.go
+++ b/internal/service/cloudcontrol/resource_data_source.go
@@ -1,9 +1,12 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudcontrol
 
 import (
 	"context"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
@@ -32,7 +35,7 @@ func DataSourceResource() *schema.Resource {
 			"type_name": {
 				Type:         schema.TypeString,
 				Required:     true,
-				ValidateFunc: validation.StringMatch(regexp.MustCompile(`[A-Za-z0-9]{2,64}::[A-Za-z0-9]{2,64}::[A-Za-z0-9]{2,64}`), "must be three alphanumeric sections separated by double colons (::)"),
+				ValidateFunc: validation.StringMatch(regexache.MustCompile(`[0-9A-Za-z]{2,64}::[0-9A-Za-z]{2,64}::[0-9A-Za-z]{2,64}`), "must be three alphanumeric sections separated by double colons (::)"),
 			},
 			"type_version_id": {
 				Type:     schema.TypeString,
diff --git a/internal/service/cloudcontrol/resource_data_source_test.go b/internal/service/cloudcontrol/resource_data_source_test.go
index 1828b2af7d8..f83839c9b57 100644
--- a/internal/service/cloudcontrol/resource_data_source_test.go
+++ b/internal/service/cloudcontrol/resource_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudcontrol_test
 
 import (
diff --git a/internal/service/cloudcontrol/resource_test.go b/internal/service/cloudcontrol/resource_test.go
index a7935f7da04..825a1c6503c 100644
--- a/internal/service/cloudcontrol/resource_test.go
+++ b/internal/service/cloudcontrol/resource_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudcontrol_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/cloudcontrolapi"
 	"github.com/aws/aws-sdk-go/service/cloudformation"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -42,8 +45,8 @@ func TestAccCloudControlResource_basic(t *testing.T) {
 			{
 				Config: testAccResourceConfig_basic(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
-					resource.TestMatchResourceAttr(resourceName, "properties", regexp.MustCompile(`^\{.*\}$`)),
-					resource.TestMatchResourceAttr(resourceName, "schema", regexp.MustCompile(`^\{.*`)),
+					resource.TestMatchResourceAttr(resourceName, "properties", regexache.MustCompile(`^\{.*\}$`)),
+					resource.TestMatchResourceAttr(resourceName, "schema", regexache.MustCompile(`^\{.*`)),
 				),
 			},
 		},
@@ -86,13 +89,13 @@ func TestAccCloudControlResource_DesiredState_booleanValueAdded(t *testing.T) {
 			{
 				Config: testAccResourceConfig_desiredStateBooleanValueRemoved(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
-					resource.TestMatchResourceAttr(resourceName, "properties", regexp.MustCompile(`"Enabled":false`)),
+					resource.TestMatchResourceAttr(resourceName, "properties", regexache.MustCompile(`"Enabled":false`)),
 				),
 			},
 			{
 				Config: testAccResourceConfig_desiredStateBooleanValue(rName, true),
 				Check: resource.ComposeAggregateTestCheckFunc(
-					resource.TestMatchResourceAttr(resourceName, "properties", regexp.MustCompile(`"Enabled":true`)),
+					resource.TestMatchResourceAttr(resourceName, "properties", regexache.MustCompile(`"Enabled":true`)),
 				),
 			},
 		},
@@ -113,13 +116,13 @@ func TestAccCloudControlResource_DesiredState_booleanValueRemoved(t *testing.T)
 			{
 				Config: testAccResourceConfig_desiredStateBooleanValue(rName, true),
 				Check: resource.ComposeAggregateTestCheckFunc(
-					resource.TestMatchResourceAttr(resourceName, "properties", regexp.MustCompile(`"Enabled":true`)),
+					resource.TestMatchResourceAttr(resourceName, "properties", regexache.MustCompile(`"Enabled":true`)),
 				),
 			},
 			{
 				Config: testAccResourceConfig_desiredStateBooleanValueRemoved(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
-					resource.TestMatchResourceAttr(resourceName, "properties", regexp.MustCompile(`"Enabled":false`)),
+					resource.TestMatchResourceAttr(resourceName, "properties", regexache.MustCompile(`"Enabled":false`)),
 				),
 			},
 		},
@@ -140,13 +143,13 @@ func TestAccCloudControlResource_DesiredState_booleanValueUpdate(t *testing.T) {
 			{
 				Config: testAccResourceConfig_desiredStateBooleanValue(rName, true),
 				Check: resource.ComposeAggregateTestCheckFunc(
-					resource.TestMatchResourceAttr(resourceName, "properties", regexp.MustCompile(`"Enabled":true`)),
+					resource.TestMatchResourceAttr(resourceName, "properties", regexache.MustCompile(`"Enabled":true`)),
 				),
 			},
 			{
 				Config: testAccResourceConfig_desiredStateBooleanValue(rName, false),
 				Check: resource.ComposeAggregateTestCheckFunc(
-					resource.TestMatchResourceAttr(resourceName, "properties", regexp.MustCompile(`"Enabled":false`)),
+					resource.TestMatchResourceAttr(resourceName, "properties", regexache.MustCompile(`"Enabled":false`)),
 				),
 			},
 		},
@@ -168,13 +171,13 @@ func TestAccCloudControlResource_DesiredState_createOnly(t *testing.T) {
 			{
 				Config: testAccResourceConfig_desiredStateCreateOnly(rName1),
 				Check: resource.ComposeAggregateTestCheckFunc(
-					resource.TestMatchResourceAttr(resourceName, "properties", regexp.MustCompile(`"LogGroupName":"`+rName1+`"`)),
+					resource.TestMatchResourceAttr(resourceName, "properties", regexache.MustCompile(`"LogGroupName":"`+rName1+`"`)),
 				),
 			},
 			{
 				Config: testAccResourceConfig_desiredStateCreateOnly(rName2),
 				Check: resource.ComposeAggregateTestCheckFunc(
-					resource.TestMatchResourceAttr(resourceName, "properties", regexp.MustCompile(`"LogGroupName":"`+rName2+`"`)),
+					resource.TestMatchResourceAttr(resourceName, "properties", regexache.MustCompile(`"LogGroupName":"`+rName2+`"`)),
 				),
 			},
 		},
@@ -195,13 +198,13 @@ func TestAccCloudControlResource_DesiredState_integerValueAdded(t *testing.T) {
 			{
 				Config: testAccResourceConfig_desiredStateIntegerValueRemoved(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
-					resource.TestMatchResourceAttr(resourceName, "properties", regexp.MustCompile(`"LogGroupName":`)),
+					resource.TestMatchResourceAttr(resourceName, "properties", regexache.MustCompile(`"LogGroupName":`)),
 				),
 			},
 			{
 				Config: testAccResourceConfig_desiredStateIntegerValue(rName, 14),
 				Check: resource.ComposeAggregateTestCheckFunc(
-					resource.TestMatchResourceAttr(resourceName, "properties", regexp.MustCompile(`"RetentionInDays":14`)),
+					resource.TestMatchResourceAttr(resourceName, "properties", regexache.MustCompile(`"RetentionInDays":14`)),
 				),
 			},
 		},
@@ -222,13 +225,13 @@ func TestAccCloudControlResource_DesiredState_integerValueRemoved(t *testing.T)
 			{
 				Config: testAccResourceConfig_desiredStateIntegerValue(rName, 14),
 				Check: resource.ComposeAggregateTestCheckFunc(
-					resource.TestMatchResourceAttr(resourceName, "properties", regexp.MustCompile(`"RetentionInDays":14`)),
+					resource.TestMatchResourceAttr(resourceName, "properties", regexache.MustCompile(`"RetentionInDays":14`)),
 				),
 			},
 			{
 				Config: testAccResourceConfig_desiredStateIntegerValueRemoved(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
-					resource.TestMatchResourceAttr(resourceName, "properties", regexp.MustCompile(`"LogGroupName":`)),
+					resource.TestMatchResourceAttr(resourceName, "properties", regexache.MustCompile(`"LogGroupName":`)),
 				),
 			},
 		},
@@ -249,13 +252,13 @@ func TestAccCloudControlResource_DesiredState_integerValueUpdate(t *testing.T) {
 			{
 				Config: testAccResourceConfig_desiredStateIntegerValue(rName, 7),
 				Check: resource.ComposeAggregateTestCheckFunc(
-					resource.TestMatchResourceAttr(resourceName, "properties", regexp.MustCompile(`"RetentionInDays":7`)),
+					resource.TestMatchResourceAttr(resourceName, "properties", regexache.MustCompile(`"RetentionInDays":7`)),
 				),
 			},
 			{
 				Config: testAccResourceConfig_desiredStateIntegerValue(rName, 14),
 				Check: resource.ComposeAggregateTestCheckFunc(
-					resource.TestMatchResourceAttr(resourceName, "properties", regexp.MustCompile(`"RetentionInDays":14`)),
+					resource.TestMatchResourceAttr(resourceName, "properties", regexache.MustCompile(`"RetentionInDays":14`)),
 				),
 			},
 		},
@@ -274,7 +277,7 @@ func TestAccCloudControlResource_DesiredState_invalidPropertyName(t *testing.T)
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccResourceConfig_desiredStateInvalidPropertyName(rName),
-				ExpectError: regexp.MustCompile(`\(root\): Additional property InvalidName is not allowed`),
+				ExpectError: regexache.MustCompile(`\(root\): Additional property InvalidName is not allowed`),
 			},
 		},
 	})
@@ -292,7 +295,7 @@ func TestAccCloudControlResource_DesiredState_invalidPropertyValue(t *testing.T)
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccResourceConfig_desiredStateInvalidPropertyValue(rName),
-				ExpectError: regexp.MustCompile(`Model validation failed`),
+				ExpectError: regexache.MustCompile(`Model validation failed`),
 			},
 		},
 	})
@@ -312,13 +315,13 @@ func TestAccCloudControlResource_DesiredState_objectValueAdded(t *testing.T) {
 			{
 				Config: testAccResourceConfig_desiredStateObjectValueRemoved(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
-					resource.TestMatchResourceAttr(resourceName, "properties", regexp.MustCompile(`"Name":`)),
+					resource.TestMatchResourceAttr(resourceName, "properties", regexache.MustCompile(`"Name":`)),
 				),
 			},
 			{
 				Config: testAccResourceConfig_desiredStateObjectValue1(rName, "key1", "value1"),
 				Check: resource.ComposeAggregateTestCheckFunc(
-					resource.TestMatchResourceAttr(resourceName, "properties", regexp.MustCompile(`"Value":"value1"`)),
+					resource.TestMatchResourceAttr(resourceName, "properties", regexache.MustCompile(`"Value":"value1"`)),
 				),
 			},
 		},
@@ -339,13 +342,13 @@ func TestAccCloudControlResource_DesiredState_objectValueRemoved(t *testing.T) {
 			{
 				Config: testAccResourceConfig_desiredStateObjectValue1(rName, "key1", "value1"),
 				Check: resource.ComposeAggregateTestCheckFunc(
-					resource.TestMatchResourceAttr(resourceName, "properties", regexp.MustCompile(`"Value":"value1"`)),
+					resource.TestMatchResourceAttr(resourceName, "properties", regexache.MustCompile(`"Value":"value1"`)),
 				),
 			},
 			{
 				Config: testAccResourceConfig_desiredStateObjectValueRemoved(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
-					resource.TestMatchResourceAttr(resourceName, "properties", regexp.MustCompile(`"Name":`)),
+					resource.TestMatchResourceAttr(resourceName, "properties", regexache.MustCompile(`"Name":`)),
 				),
 			},
 		},
@@ -366,19 +369,19 @@ func TestAccCloudControlResource_DesiredState_objectValueUpdate(t *testing.T) {
 			{
 				Config: testAccResourceConfig_desiredStateObjectValue1(rName, "key1", "value1"),
 				Check: resource.ComposeAggregateTestCheckFunc(
-					resource.TestMatchResourceAttr(resourceName, "properties", regexp.MustCompile(`"Value":"value1"`)),
+					resource.TestMatchResourceAttr(resourceName, "properties", regexache.MustCompile(`"Value":"value1"`)),
 				),
 			},
 			{
 				Config: testAccResourceConfig_desiredStateObjectValue1(rName, "key1", "value1updated"),
 				Check: resource.ComposeAggregateTestCheckFunc(
-					resource.TestMatchResourceAttr(resourceName, "properties", regexp.MustCompile(`"Value":"value1updated"`)),
+					resource.TestMatchResourceAttr(resourceName, "properties", regexache.MustCompile(`"Value":"value1updated"`)),
 				),
 			},
 			{
 				Config: testAccResourceConfig_desiredStateObjectValue1(rName, "key2", "value2"),
 				Check: resource.ComposeAggregateTestCheckFunc(
-					resource.TestMatchResourceAttr(resourceName, "properties", regexp.MustCompile(`"Value":"value2"`)),
+					resource.TestMatchResourceAttr(resourceName, "properties", regexache.MustCompile(`"Value":"value2"`)),
 				),
 			},
 		},
@@ -399,13 +402,13 @@ func TestAccCloudControlResource_DesiredState_stringValueAdded(t *testing.T) {
 			{
 				Config: testAccResourceConfig_desiredStateStringValueRemoved(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
-					resource.TestMatchResourceAttr(resourceName, "properties", regexp.MustCompile(`"Name":`)),
+					resource.TestMatchResourceAttr(resourceName, "properties", regexache.MustCompile(`"Name":`)),
 				),
 			},
 			{
 				Config: testAccResourceConfig_desiredStateStringValue(rName, "description1"),
 				Check: resource.ComposeAggregateTestCheckFunc(
-					resource.TestMatchResourceAttr(resourceName, "properties", regexp.MustCompile(`"Description":"description1"`)),
+					resource.TestMatchResourceAttr(resourceName, "properties", regexache.MustCompile(`"Description":"description1"`)),
 				),
 			},
 		},
@@ -426,13 +429,13 @@ func TestAccCloudControlResource_DesiredState_stringValueRemoved(t *testing.T) {
 			{
 				Config: testAccResourceConfig_desiredStateStringValue(rName, "description1"),
 				Check: resource.ComposeAggregateTestCheckFunc(
-					resource.TestMatchResourceAttr(resourceName, "properties", regexp.MustCompile(`"Description":"description1"`)),
+					resource.TestMatchResourceAttr(resourceName, "properties", regexache.MustCompile(`"Description":"description1"`)),
 				),
 			},
 			{
 				Config: testAccResourceConfig_desiredStateStringValueRemoved(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
-					resource.TestMatchResourceAttr(resourceName, "properties", regexp.MustCompile(`"Name":`)),
+					resource.TestMatchResourceAttr(resourceName, "properties", regexache.MustCompile(`"Name":`)),
 				),
 			},
 		},
@@ -453,13 +456,13 @@ func TestAccCloudControlResource_DesiredState_stringValueUpdate(t *testing.T) {
 			{
 				Config: testAccResourceConfig_desiredStateStringValue(rName, "description1"),
 				Check: resource.ComposeAggregateTestCheckFunc(
-					resource.TestMatchResourceAttr(resourceName, "properties", regexp.MustCompile(`"Description":"description1"`)),
+					resource.TestMatchResourceAttr(resourceName, "properties", regexache.MustCompile(`"Description":"description1"`)),
 				),
 			},
 			{
 				Config: testAccResourceConfig_desiredStateStringValue(rName, "description2"),
 				Check: resource.ComposeAggregateTestCheckFunc(
-					resource.TestMatchResourceAttr(resourceName, "properties", regexp.MustCompile(`"Description":"description2"`)),
+					resource.TestMatchResourceAttr(resourceName, "properties", regexache.MustCompile(`"Description":"description2"`)),
 				),
 			},
 		},
@@ -509,8 +512,8 @@ func TestAccCloudControlResource_lambdaFunction(t *testing.T) {
 			{
 				Config: testAccResourceConfig_lambdaFunction(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
-					resource.TestMatchResourceAttr(resourceName, "properties", regexp.MustCompile(`^\{.*\}$`)),
-					resource.TestMatchResourceAttr(resourceName, "schema", regexp.MustCompile(`^\{.*`)),
+					resource.TestMatchResourceAttr(resourceName, "properties", regexache.MustCompile(`^\{.*\}$`)),
+					resource.TestMatchResourceAttr(resourceName, "schema", regexache.MustCompile(`^\{.*`)),
 				),
 			},
 		},
diff --git a/internal/service/cloudcontrol/service_package_gen.go b/internal/service/cloudcontrol/service_package_gen.go
index 6eae1cc05b6..1d1b326b463 100644
--- a/internal/service/cloudcontrol/service_package_gen.go
+++ b/internal/service/cloudcontrol/service_package_gen.go
@@ -7,6 +7,7 @@ import (
 
 	aws_sdkv2 "github.com/aws/aws-sdk-go-v2/aws"
 	cloudcontrol_sdkv2 "github.com/aws/aws-sdk-go-v2/service/cloudcontrol"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -49,9 +50,11 @@ func (p *servicePackage) NewClient(ctx context.Context, config map[string]any) (
 
 	return cloudcontrol_sdkv2.NewFromConfig(cfg, func(o *cloudcontrol_sdkv2.Options) {
 		if endpoint := config["endpoint"].(string); endpoint != "" {
-			o.EndpointResolver = cloudcontrol_sdkv2.EndpointResolverFromURL(endpoint)
+			o.BaseEndpoint = aws_sdkv2.String(endpoint)
 		}
 	}), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/cloudformation/arn.go b/internal/service/cloudformation/arn.go
index 5f6a45774d4..b44847dd1ed 100644
--- a/internal/service/cloudformation/arn.go
+++ b/internal/service/cloudformation/arn.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudformation
 
 import (
diff --git a/internal/service/cloudformation/arn_test.go b/internal/service/cloudformation/arn_test.go
index dcbbe9bc85b..baa3b143515 100644
--- a/internal/service/cloudformation/arn_test.go
+++ b/internal/service/cloudformation/arn_test.go
@@ -1,9 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudformation_test
 
 import (
 	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	tfcloudformation "github.com/hashicorp/terraform-provider-aws/internal/service/cloudformation"
 )
 
@@ -20,27 +24,27 @@ func TestTypeVersionARNToTypeARNAndVersionID(t *testing.T) {
 		{
 			TestName:      "empty ARN",
 			InputARN:      "",
-			ExpectedError: regexp.MustCompile(`parsing ARN`),
+			ExpectedError: regexache.MustCompile(`parsing ARN`),
 		},
 		{
 			TestName:      "unparsable ARN",
 			InputARN:      "test",
-			ExpectedError: regexp.MustCompile(`parsing ARN`),
+			ExpectedError: regexache.MustCompile(`parsing ARN`),
 		},
 		{
 			TestName:      "invalid ARN service",
 			InputARN:      "arn:aws:ec2:us-west-2:123456789012:instance/i-12345678", //lintignore:AWSAT003,AWSAT005
-			ExpectedError: regexp.MustCompile(`expected service cloudformation`),
+			ExpectedError: regexache.MustCompile(`expected service cloudformation`),
 		},
 		{
 			TestName:      "invalid ARN resource parts",
 			InputARN:      "arn:aws:cloudformation:us-west-2:123456789012:type/resource/HashiCorp-TerraformAwsProvider-TfAccTestzwv6r2i7", //lintignore:AWSAT003,AWSAT005
-			ExpectedError: regexp.MustCompile(`expected 4 resource parts`),
+			ExpectedError: regexache.MustCompile(`expected 4 resource parts`),
 		},
 		{
 			TestName:      "invalid ARN resource prefix",
 			InputARN:      "arn:aws:cloudformation:us-west-2:123456789012:stack/name/1/2", //lintignore:AWSAT003,AWSAT005
-			ExpectedError: regexp.MustCompile(`expected resource prefix type`),
+			ExpectedError: regexache.MustCompile(`expected resource prefix type`),
 		},
 		{
 			TestName:          "valid ARN",
diff --git a/internal/service/cloudformation/consts.go b/internal/service/cloudformation/consts.go
index 75a88edf52d..790572cb173 100644
--- a/internal/service/cloudformation/consts.go
+++ b/internal/service/cloudformation/consts.go
@@ -1,13 +1,12 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudformation
 
 import (
 	"time"
 )
 
-const (
-	ResNameStack = "Stack"
-)
-
 const (
 	propagationTimeout = 2 * time.Minute
 )
diff --git a/internal/service/cloudformation/errors.go b/internal/service/cloudformation/errors.go
index 28e5473ed14..110ccacd913 100644
--- a/internal/service/cloudformation/errors.go
+++ b/internal/service/cloudformation/errors.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudformation
 
 import (
@@ -9,7 +12,7 @@ import (
 )
 
 const (
-	ErrCodeValidationError = "ValidationError"
+	errCodeValidationError = "ValidationError"
 )
 
 func StackSetOperationError(apiObjects []*cloudformation.StackSetOperationResultSummary) error {
diff --git a/internal/service/cloudformation/export_data_source.go b/internal/service/cloudformation/export_data_source.go
index b8040ebb9e8..80703ca1e38 100644
--- a/internal/service/cloudformation/export_data_source.go
+++ b/internal/service/cloudformation/export_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudformation
 
 import (
diff --git a/internal/service/cloudformation/export_data_source_test.go b/internal/service/cloudformation/export_data_source_test.go
index 00431019b30..6f2e870eff0 100644
--- a/internal/service/cloudformation/export_data_source_test.go
+++ b/internal/service/cloudformation/export_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudformation_test
 
 import (
diff --git a/internal/service/cloudformation/find.go b/internal/service/cloudformation/find.go
index 56fbc7ca251..a5958b2080c 100644
--- a/internal/service/cloudformation/find.go
+++ b/internal/service/cloudformation/find.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudformation
 
 import (
@@ -36,45 +39,7 @@ func FindChangeSetByStackIDAndChangeSetName(ctx context.Context, conn *cloudform
 	return output, nil
 }
 
-func FindStackByID(ctx context.Context, conn *cloudformation.CloudFormation, id string) (*cloudformation.Stack, error) {
-	input := &cloudformation.DescribeStacksInput{
-		StackName: aws.String(id),
-	}
-
-	output, err := conn.DescribeStacksWithContext(ctx, input)
-
-	if tfawserr.ErrMessageContains(err, ErrCodeValidationError, "does not exist") {
-		return nil, &retry.NotFoundError{
-			LastError:   err,
-			LastRequest: input,
-		}
-	}
-
-	if err != nil {
-		return nil, err
-	}
-
-	if output == nil || len(output.Stacks) == 0 || output.Stacks[0] == nil {
-		return nil, tfresource.NewEmptyResultError(input)
-	}
-
-	if count := len(output.Stacks); count > 1 {
-		return nil, tfresource.NewTooManyResultsError(count, input)
-	}
-
-	stack := output.Stacks[0]
-
-	if status := aws.StringValue(stack.StackStatus); status == cloudformation.StackStatusDeleteComplete {
-		return nil, &retry.NotFoundError{
-			LastRequest: input,
-			Message:     status,
-		}
-	}
-
-	return stack, nil
-}
-
-func FindStackInstanceAccountIdByOrgIDs(ctx context.Context, conn *cloudformation.CloudFormation, stackSetName, region, callAs string, orgIDs []string) (string, error) {
+func FindStackInstanceSummariesByOrgIDs(ctx context.Context, conn *cloudformation.CloudFormation, stackSetName, region, callAs string, orgIDs []string) ([]*cloudformation.StackInstanceSummary, error) {
 	input := &cloudformation.ListStackInstancesInput{
 		StackInstanceRegion: aws.String(region),
 		StackSetName:        aws.String(stackSetName),
@@ -84,7 +49,7 @@ func FindStackInstanceAccountIdByOrgIDs(ctx context.Context, conn *cloudformatio
 		input.CallAs = aws.String(callAs)
 	}
 
-	var result string
+	var result []*cloudformation.StackInstanceSummary
 
 	err := conn.ListStackInstancesPagesWithContext(ctx, input, func(page *cloudformation.ListStackInstancesOutput, lastPage bool) bool {
 		if page == nil {
@@ -98,8 +63,7 @@ func FindStackInstanceAccountIdByOrgIDs(ctx context.Context, conn *cloudformatio
 
 			for _, orgID := range orgIDs {
 				if aws.StringValue(s.OrganizationalUnitId) == orgID {
-					result = aws.StringValue(s.Account)
-					return false
+					result = append(result, s)
 				}
 			}
 		}
@@ -108,14 +72,14 @@ func FindStackInstanceAccountIdByOrgIDs(ctx context.Context, conn *cloudformatio
 	})
 
 	if tfawserr.ErrCodeEquals(err, cloudformation.ErrCodeStackSetNotFoundException) {
-		return "", &retry.NotFoundError{
+		return nil, &retry.NotFoundError{
 			LastError:   err,
 			LastRequest: input,
 		}
 	}
 
 	if err != nil {
-		return "", err
+		return nil, err
 	}
 
 	return result, nil
diff --git a/internal/service/cloudformation/flex.go b/internal/service/cloudformation/flex.go
index a45239b03d1..eb20d5718d4 100644
--- a/internal/service/cloudformation/flex.go
+++ b/internal/service/cloudformation/flex.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudformation
 
 import (
diff --git a/internal/service/cloudformation/generate.go b/internal/service/cloudformation/generate.go
index 7bf8cf27588..86b5e981d71 100644
--- a/internal/service/cloudformation/generate.go
+++ b/internal/service/cloudformation/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ServiceTagsSlice
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/cloudformation/id.go b/internal/service/cloudformation/id.go
deleted file mode 100644
index 74f254beda9..00000000000
--- a/internal/service/cloudformation/id.go
+++ /dev/null
@@ -1,25 +0,0 @@
-package cloudformation
-
-import (
-	"fmt"
-	"strings"
-)
-
-const stackSetInstanceResourceIDSeparator = ","
-
-func StackSetInstanceCreateResourceID(stackSetName, accountID, region string) string {
-	parts := []string{stackSetName, accountID, region}
-	id := strings.Join(parts, stackSetInstanceResourceIDSeparator)
-
-	return id
-}
-
-func StackSetInstanceParseResourceID(id string) (string, string, string, error) {
-	parts := strings.Split(id, stackSetInstanceResourceIDSeparator)
-
-	if len(parts) == 3 && parts[0] != "" && parts[1] != "" && parts[2] != "" {
-		return parts[0], parts[1], parts[2], nil
-	}
-
-	return "", "", "", fmt.Errorf("unexpected format for ID (%[1]s), expected STACKSETNAME%[2]sACCOUNTID%[2]sREGION", id, stackSetInstanceResourceIDSeparator)
-}
diff --git a/internal/service/cloudformation/list.go b/internal/service/cloudformation/list.go
deleted file mode 100644
index 1c1f685ebcd..00000000000
--- a/internal/service/cloudformation/list.go
+++ /dev/null
@@ -1,33 +0,0 @@
-package cloudformation
-
-import (
-	"context"
-
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/cloudformation"
-)
-
-func listStackEventsForOperation(ctx context.Context, conn *cloudformation.CloudFormation, stackID, requestToken string, fn func(*cloudformation.StackEvent)) error {
-	tokenSeen := false
-	err := conn.DescribeStackEventsPagesWithContext(ctx, &cloudformation.DescribeStackEventsInput{
-		StackName: aws.String(stackID),
-	}, func(page *cloudformation.DescribeStackEventsOutput, lastPage bool) bool {
-		for _, e := range page.StackEvents {
-			currentToken := aws.StringValue(e.ClientRequestToken)
-			if !tokenSeen {
-				if currentToken != requestToken {
-					continue
-				}
-				tokenSeen = true
-			} else {
-				if currentToken != requestToken {
-					return false
-				}
-			}
-
-			fn(e)
-		}
-		return !lastPage
-	})
-	return err
-}
diff --git a/internal/service/cloudformation/service_package.go b/internal/service/cloudformation/service_package.go
index 8f4bfe77d26..3dd9f3640bd 100644
--- a/internal/service/cloudformation/service_package.go
+++ b/internal/service/cloudformation/service_package.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudformation
 
 import (
diff --git a/internal/service/cloudformation/service_package_gen.go b/internal/service/cloudformation/service_package_gen.go
index ae85d870402..e046d9e5475 100644
--- a/internal/service/cloudformation/service_package_gen.go
+++ b/internal/service/cloudformation/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	cloudformation_sdkv1 "github.com/aws/aws-sdk-go/service/cloudformation"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -75,4 +76,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*c
 	return cloudformation_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/cloudformation/stack.go b/internal/service/cloudformation/stack.go
index 3b6ee652ddc..e7ba19db9c4 100644
--- a/internal/service/cloudformation/stack.go
+++ b/internal/service/cloudformation/stack.go
@@ -1,22 +1,29 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudformation
 
 import (
 	"context"
-	"errors"
+	"fmt"
 	"log"
+	"strings"
+	"time"
 
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/cloudformation"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/customdiff"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/structure"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
-	"github.com/hashicorp/terraform-provider-aws/internal/create"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
 	"github.com/hashicorp/terraform-provider-aws/internal/flex"
+	"github.com/hashicorp/terraform-provider-aws/internal/slices"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
@@ -37,9 +44,9 @@ func ResourceStack() *schema.Resource {
 		},
 
 		Timeouts: &schema.ResourceTimeout{
-			Create: schema.DefaultTimeout(StackCreatedDefaultTimeout),
-			Update: schema.DefaultTimeout(StackUpdatedDefaultTimeout),
-			Delete: schema.DefaultTimeout(StackDeletedDefaultTimeout),
+			Create: schema.DefaultTimeout(30 * time.Minute),
+			Update: schema.DefaultTimeout(30 * time.Minute),
+			Delete: schema.DefaultTimeout(30 * time.Minute),
 		},
 
 		Schema: map[string]*schema.Schema{
@@ -126,7 +133,10 @@ func ResourceStack() *schema.Resource {
 			},
 		},
 
-		CustomizeDiff: verify.SetTagsDiff,
+		CustomizeDiff: customdiff.All(
+			verify.SetTagsDiff,
+			customdiff.ComputedIf("outputs", stackHasActualChanges),
+		),
 	}
 }
 
@@ -142,22 +152,15 @@ func resourceStackCreate(ctx context.Context, d *schema.ResourceData, meta inter
 		Tags:               getTagsIn(ctx),
 	}
 
-	if v, ok := d.GetOk("template_body"); ok {
-		template, err := verify.NormalizeJSONOrYAMLString(v)
-		if err != nil {
-			return sdkdiag.AppendErrorf(diags, "template body contains an invalid JSON or YAML: %s", err)
-		}
-		input.TemplateBody = aws.String(template)
-	}
-	if v, ok := d.GetOk("template_url"); ok {
-		input.TemplateURL = aws.String(v.(string))
-	}
 	if v, ok := d.GetOk("capabilities"); ok {
 		input.Capabilities = flex.ExpandStringSet(v.(*schema.Set))
 	}
 	if v, ok := d.GetOk("disable_rollback"); ok {
 		input.DisableRollback = aws.Bool(v.(bool))
 	}
+	if v, ok := d.GetOk("iam_role_arn"); ok {
+		input.RoleARN = aws.String(v.(string))
+	}
 	if v, ok := d.GetOk("notification_arns"); ok {
 		input.NotificationARNs = flex.ExpandStringSet(v.(*schema.Set))
 	}
@@ -177,27 +180,23 @@ func resourceStackCreate(ctx context.Context, d *schema.ResourceData, meta inter
 	if v, ok := d.GetOk("policy_url"); ok {
 		input.StackPolicyURL = aws.String(v.(string))
 	}
-	if v, ok := d.GetOk("timeout_in_minutes"); ok {
-		m := int64(v.(int))
-		input.TimeoutInMinutes = aws.Int64(m)
+	if v, ok := d.GetOk("template_body"); ok {
+		template, err := verify.NormalizeJSONOrYAMLString(v)
+		if err != nil {
+			return sdkdiag.AppendErrorf(diags, "template body contains an invalid JSON or YAML: %s", err)
+		}
+		input.TemplateBody = aws.String(template)
 	}
-	if v, ok := d.GetOk("iam_role_arn"); ok {
-		input.RoleARN = aws.String(v.(string))
+	if v, ok := d.GetOk("template_url"); ok {
+		input.TemplateURL = aws.String(v.(string))
+	}
+	if v, ok := d.GetOk("timeout_in_minutes"); ok {
+		input.TimeoutInMinutes = aws.Int64(int64(v.(int)))
 	}
 
-	log.Printf("[DEBUG] Creating CloudFormation Stack: %s", input)
-	outputRaw, err := tfresource.RetryWhen(ctx, propagationTimeout,
-		func() (interface{}, error) {
-			return conn.CreateStackWithContext(ctx, input)
-		},
-		func(err error) (bool, error) {
-			if tfawserr.ErrMessageContains(err, "ValidationError", "is invalid or cannot be assumed") {
-				return true, err
-			}
-
-			return false, err
-		},
-	)
+	outputRaw, err := tfresource.RetryWhenAWSErrMessageContains(ctx, propagationTimeout, func() (interface{}, error) {
+		return conn.CreateStackWithContext(ctx, input)
+	}, errCodeValidationError, "is invalid or cannot be assumed")
 
 	if err != nil {
 		return sdkdiag.AppendErrorf(diags, "creating CloudFormation Stack (%s): %s", name, err)
@@ -216,63 +215,38 @@ func resourceStackRead(ctx context.Context, d *schema.ResourceData, meta interfa
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).CloudFormationConn(ctx)
 
-	input := &cloudformation.DescribeStacksInput{
-		StackName: aws.String(d.Id()),
-	}
-	resp, err := conn.DescribeStacksWithContext(ctx, input)
-	if !d.IsNewResource() && tfawserr.ErrCodeEquals(err, "ValidationError") {
-		create.LogNotFoundRemoveState(names.CloudFormation, create.ErrActionReading, ResNameStack, d.Id())
-		d.SetId("")
-		return diags
-	}
+	stack, err := FindStackByName(ctx, conn, d.Id())
 
-	if err != nil {
-		return create.DiagError(names.CloudFormation, create.ErrActionReading, ResNameStack, d.Id(), err)
-	}
-
-	stacks := resp.Stacks
-	if !d.IsNewResource() && len(stacks) < 1 {
-		create.LogNotFoundRemoveState(names.CloudFormation, create.ErrActionReading, ResNameStack, d.Id())
+	if !d.IsNewResource() && tfresource.NotFound(err) {
+		log.Printf("[WARN] CloudFormation Stack %s not found, removing from state", d.Id())
 		d.SetId("")
 		return diags
 	}
 
-	if d.IsNewResource() && len(stacks) < 1 {
-		return create.DiagError(names.CloudFormation, create.ErrActionReading, ResNameStack, d.Id(), errors.New("not found after creation"))
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "reading CloudFormation Stack (%s): %s", d.Id(), err)
 	}
 
-	stack := stacks[0]
-	if !d.IsNewResource() && aws.StringValue(stack.StackStatus) == cloudformation.StackStatusDeleteComplete {
-		log.Printf("[WARN] CloudFormation stack (%s) not found, removing from state", d.Id())
-		d.SetId("")
-		return diags
+	input := &cloudformation.GetTemplateInput{
+		StackName:     aws.String(d.Id()),
+		TemplateStage: aws.String(cloudformation.TemplateStageOriginal),
 	}
 
-	if d.IsNewResource() && aws.StringValue(stack.StackStatus) == cloudformation.StackStatusDeleteComplete {
-		return create.DiagError(names.CloudFormation, create.ErrActionReading, ResNameStack, d.Id(), errors.New("status delete complete after creation"))
-	}
+	output, err := conn.GetTemplateWithContext(ctx, input)
 
-	tInput := cloudformation.GetTemplateInput{
-		StackName:     aws.String(d.Id()),
-		TemplateStage: aws.String("Original"),
-	}
-	out, err := conn.GetTemplateWithContext(ctx, &tInput)
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "reading CloudFormation Stack (%s): reading template: %s", d.Id(), err)
+		return sdkdiag.AppendErrorf(diags, "reading CloudFormation Stack (%s) template: %s", d.Id(), err)
 	}
 
-	template, err := verify.NormalizeJSONOrYAMLString(*out.TemplateBody)
+	template, err := verify.NormalizeJSONOrYAMLString(aws.StringValue(output.TemplateBody))
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "template body contains an invalid JSON or YAML: %s", err)
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 	d.Set("template_body", template)
 
-	log.Printf("[DEBUG] Received CloudFormation stack: %s", stack)
-
-	d.Set("name", stack.StackName)
-	d.Set("iam_role_arn", stack.RoleARN)
-	d.Set("timeout_in_minutes", stack.TimeoutInMinutes)
-
+	if len(stack.Capabilities) > 0 {
+		d.Set("capabilities", aws.StringValueSlice(stack.Capabilities))
+	}
 	if stack.DisableRollback != nil {
 		d.Set("disable_rollback", stack.DisableRollback)
 
@@ -282,32 +256,20 @@ func resourceStackRead(ctx context.Context, d *schema.ResourceData, meta interfa
 			d.Set("disable_rollback", false)
 		}
 	}
+	d.Set("iam_role_arn", stack.RoleARN)
+	d.Set("name", stack.StackName)
 	if len(stack.NotificationARNs) > 0 {
-		err = d.Set("notification_arns", flex.FlattenStringSet(stack.NotificationARNs))
-		if err != nil {
-			return sdkdiag.AppendErrorf(diags, "reading CloudFormation Stack (%s): %s", d.Id(), err)
-		}
+		d.Set("notification_arns", aws.StringValueSlice(stack.NotificationARNs))
 	}
-
-	originalParams := d.Get("parameters").(map[string]interface{})
-	err = d.Set("parameters", flattenParameters(stack.Parameters, originalParams))
-	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "reading CloudFormation Stack (%s): %s", d.Id(), err)
+	if err := d.Set("outputs", flattenOutputs(stack.Outputs)); err != nil {
+		return sdkdiag.AppendErrorf(diags, "setting outputs: %s", err)
 	}
-
-	setTagsOut(ctx, stack.Tags)
-
-	err = d.Set("outputs", flattenOutputs(stack.Outputs))
-	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "reading CloudFormation Stack (%s): %s", d.Id(), err)
+	if err := d.Set("parameters", flattenParameters(stack.Parameters, d.Get("parameters").(map[string]interface{}))); err != nil {
+		return sdkdiag.AppendErrorf(diags, "setting parameters: %s", err)
 	}
+	d.Set("timeout_in_minutes", stack.TimeoutInMinutes)
 
-	if len(stack.Capabilities) > 0 {
-		err = d.Set("capabilities", flex.FlattenStringSet(stack.Capabilities))
-		if err != nil {
-			return sdkdiag.AppendErrorf(diags, "reading CloudFormation Stack (%s): %s", d.Id(), err)
-		}
-	}
+	setTagsOut(ctx, stack.Tags)
 
 	return diags
 }
@@ -323,36 +285,21 @@ func resourceStackUpdate(ctx context.Context, d *schema.ResourceData, meta inter
 		Tags:               []*cloudformation.Tag{},
 	}
 
-	// Either TemplateBody, TemplateURL or UsePreviousTemplate are required
-	if v, ok := d.GetOk("template_url"); ok {
-		input.TemplateURL = aws.String(v.(string))
-	}
-	if v, ok := d.GetOk("template_body"); ok && input.TemplateURL == nil {
-		template, err := verify.NormalizeJSONOrYAMLString(v)
-		if err != nil {
-			return sdkdiag.AppendErrorf(diags, "template body contains an invalid JSON or YAML: %s", err)
-		}
-		input.TemplateBody = aws.String(template)
-	}
-
 	// Capabilities must be present whether they are changed or not
 	if v, ok := d.GetOk("capabilities"); ok {
 		input.Capabilities = flex.ExpandStringSet(v.(*schema.Set))
 	}
-
+	if d.HasChange("iam_role_arn") {
+		input.RoleARN = aws.String(d.Get("iam_role_arn").(string))
+	}
 	if d.HasChange("notification_arns") {
 		input.NotificationARNs = flex.ExpandStringSet(d.Get("notification_arns").(*schema.Set))
 	}
-
 	// Parameters must be present whether they are changed or not
 	if v, ok := d.GetOk("parameters"); ok {
 		input.Parameters = expandParameters(v.(map[string]interface{}))
 	}
 
-	if tags := getTagsIn(ctx); len(tags) > 0 {
-		input.Tags = tags
-	}
-
 	if d.HasChange("policy_body") {
 		policy, err := structure.NormalizeJsonString(d.Get("policy_body"))
 		if err != nil {
@@ -364,31 +311,35 @@ func resourceStackUpdate(ctx context.Context, d *schema.ResourceData, meta inter
 		input.StackPolicyURL = aws.String(d.Get("policy_url").(string))
 	}
 
-	if d.HasChange("iam_role_arn") {
-		input.RoleARN = aws.String(d.Get("iam_role_arn").(string))
+	// Either TemplateBody, TemplateURL or UsePreviousTemplate are required
+	if v, ok := d.GetOk("template_url"); ok {
+		input.TemplateURL = aws.String(v.(string))
+	}
+	if v, ok := d.GetOk("template_body"); ok && input.TemplateURL == nil {
+		template, err := verify.NormalizeJSONOrYAMLString(v)
+		if err != nil {
+			return sdkdiag.AppendErrorf(diags, "template body contains an invalid JSON or YAML: %s", err)
+		}
+		input.TemplateBody = aws.String(template)
 	}
 
-	log.Printf("[DEBUG] Updating CloudFormation Stack: %s", input)
-	_, err := tfresource.RetryWhen(ctx, propagationTimeout,
-		func() (interface{}, error) {
-			return conn.UpdateStackWithContext(ctx, input)
-		},
-		func(err error) (bool, error) {
-			if tfawserr.ErrMessageContains(err, "ValidationError", "is invalid or cannot be assumed") {
-				return true, err
-			}
+	if tags := getTagsIn(ctx); len(tags) > 0 {
+		input.Tags = tags
+	}
 
-			return false, err
-		},
-	)
+	_, err := tfresource.RetryWhenAWSErrMessageContains(ctx, propagationTimeout, func() (interface{}, error) {
+		return conn.UpdateStackWithContext(ctx, input)
+	}, errCodeValidationError, "is invalid or cannot be assumed")
 
-	if err != nil && !tfawserr.ErrMessageContains(err, "ValidationError", "No updates are to be performed") {
-		return sdkdiag.AppendErrorf(diags, "updating CloudFormation Stack (%s): %s", d.Id(), err)
+	if tfawserr.ErrMessageContains(err, errCodeValidationError, "No updates are to be performed") {
+		return append(diags, resourceStackRead(ctx, d, meta)...)
 	}
 
-	_, err = WaitStackUpdated(ctx, conn, d.Id(), requestToken, d.Timeout(schema.TimeoutUpdate))
-
 	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "updating CloudFormation Stack (%s): %s", d.Id(), err)
+	}
+
+	if _, err := WaitStackUpdated(ctx, conn, d.Id(), requestToken, d.Timeout(schema.TimeoutUpdate)); err != nil {
 		return sdkdiag.AppendErrorf(diags, "waiting for CloudFormation Stack (%s) update: %s", d.Id(), err)
 	}
 
@@ -399,23 +350,375 @@ func resourceStackDelete(ctx context.Context, d *schema.ResourceData, meta inter
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).CloudFormationConn(ctx)
 
+	log.Printf("[INFO] Deleting CloudFormation Stack: %s", d.Id())
 	requestToken := id.UniqueId()
-	input := &cloudformation.DeleteStackInput{
-		StackName:          aws.String(d.Id()),
+	_, err := conn.DeleteStackWithContext(ctx, &cloudformation.DeleteStackInput{
 		ClientRequestToken: aws.String(requestToken),
-	}
-	_, err := conn.DeleteStackWithContext(ctx, input)
-	if tfawserr.ErrCodeEquals(err, "ValidationError") {
+		StackName:          aws.String(d.Id()),
+	})
+
+	if tfawserr.ErrCodeEquals(err, errCodeValidationError) {
 		return diags
 	}
+
 	if err != nil {
 		return sdkdiag.AppendErrorf(diags, "deleting CloudFormation Stack (%s): %s", d.Id(), err)
 	}
 
-	_, err = WaitStackDeleted(ctx, conn, d.Id(), requestToken, d.Timeout(schema.TimeoutDelete))
-	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "deleting CloudFormation Stack (%s): waiting for completion: %s", d.Id(), err)
+	if _, err := WaitStackDeleted(ctx, conn, d.Id(), requestToken, d.Timeout(schema.TimeoutDelete)); err != nil {
+		return sdkdiag.AppendErrorf(diags, "waiting for CloudFormation Stack (%s) delete: %s", d.Id(), err)
 	}
 
 	return diags
 }
+
+func FindStackByName(ctx context.Context, conn *cloudformation.CloudFormation, name string) (*cloudformation.Stack, error) {
+	input := &cloudformation.DescribeStacksInput{
+		StackName: aws.String(name),
+	}
+
+	output, err := findStack(ctx, conn, input)
+
+	if err != nil {
+		return nil, err
+	}
+
+	if status := aws.StringValue(output.StackStatus); status == cloudformation.StackStatusDeleteComplete {
+		return nil, &retry.NotFoundError{
+			LastRequest: input,
+			Message:     status,
+		}
+	}
+
+	return output, nil
+}
+
+func findStack(ctx context.Context, conn *cloudformation.CloudFormation, input *cloudformation.DescribeStacksInput) (*cloudformation.Stack, error) {
+	output, err := findStacks(ctx, conn, input)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return tfresource.AssertSinglePtrResult(output)
+}
+
+func findStacks(ctx context.Context, conn *cloudformation.CloudFormation, input *cloudformation.DescribeStacksInput) ([]*cloudformation.Stack, error) {
+	var output []*cloudformation.Stack
+
+	err := conn.DescribeStacksPagesWithContext(ctx, input, func(page *cloudformation.DescribeStacksOutput, lastPage bool) bool {
+		if page == nil {
+			return !lastPage
+		}
+
+		for _, v := range page.Stacks {
+			if v != nil {
+				output = append(output, v)
+			}
+		}
+
+		return !lastPage
+	})
+
+	if tfawserr.ErrMessageContains(err, errCodeValidationError, "does not exist") {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	return output, nil
+}
+
+func statusStack(ctx context.Context, conn *cloudformation.CloudFormation, name string) retry.StateRefreshFunc {
+	return func() (interface{}, string, error) {
+		// Don't call FindStackByName as it maps useful status codes to NotFoundError.
+		output, err := findStack(ctx, conn, &cloudformation.DescribeStacksInput{
+			StackName: aws.String(name),
+		})
+
+		if tfresource.NotFound(err) {
+			return nil, "", nil
+		}
+
+		if err != nil {
+			return nil, "", err
+		}
+
+		return output, aws.StringValue(output.StackStatus), nil
+	}
+}
+
+func WaitStackCreated(ctx context.Context, conn *cloudformation.CloudFormation, name, requestToken string, timeout time.Duration) (*cloudformation.Stack, error) {
+	const (
+		minTimeout = 1 * time.Second
+	)
+	stateConf := retry.StateChangeConf{
+		Pending: []string{
+			cloudformation.StackStatusCreateInProgress,
+			cloudformation.StackStatusDeleteInProgress,
+			cloudformation.StackStatusRollbackInProgress,
+		},
+		Target: []string{
+			cloudformation.StackStatusCreateComplete,
+			cloudformation.StackStatusCreateFailed,
+			cloudformation.StackStatusDeleteComplete,
+			cloudformation.StackStatusDeleteFailed,
+			cloudformation.StackStatusRollbackComplete,
+			cloudformation.StackStatusRollbackFailed,
+		},
+		Timeout:    timeout,
+		MinTimeout: minTimeout,
+		Delay:      10 * time.Second,
+		Refresh:    statusStack(ctx, conn, name),
+	}
+
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	output, ok := outputRaw.(*cloudformation.Stack)
+	if !ok {
+		return nil, err
+	}
+
+	switch lastStatus := aws.StringValue(output.StackStatus); lastStatus {
+	// This will be the case if either disable_rollback is false or on_failure is ROLLBACK
+	case cloudformation.StackStatusRollbackComplete, cloudformation.StackStatusRollbackFailed:
+		if reasons := getRollbackReasons(ctx, conn, name, requestToken); len(reasons) > 0 {
+			return output, fmt.Errorf("failed to create CloudFormation stack, rollback requested (%s): %q", lastStatus, reasons)
+		} else {
+			return output, fmt.Errorf("failed to create CloudFormation stack (%s): %s", lastStatus, aws.StringValue(output.StackStatusReason))
+		}
+
+	// This will be the case if on_failure is DELETE
+	case cloudformation.StackStatusDeleteComplete, cloudformation.StackStatusDeleteFailed:
+		if reasons := getDeletionReasons(ctx, conn, name, requestToken); len(reasons) > 0 {
+			return output, fmt.Errorf("failed to create CloudFormation stack, delete requested (%s): %q", lastStatus, reasons)
+		} else {
+			return output, fmt.Errorf("failed to create CloudFormation stack (%s): %s", lastStatus, aws.StringValue(output.StackStatusReason))
+		}
+
+	// This will be the case if either disable_rollback is true or on_failure is DO_NOTHING
+	case cloudformation.StackStatusCreateFailed:
+		if reasons := getFailureReasons(ctx, conn, name, requestToken); len(reasons) > 0 {
+			return output, fmt.Errorf("failed to create CloudFormation stack (%s): %q", lastStatus, reasons)
+		} else {
+			return output, fmt.Errorf("failed to create CloudFormation stack (%s): %s", lastStatus, aws.StringValue(output.StackStatusReason))
+		}
+	}
+
+	return output, err
+}
+
+func WaitStackUpdated(ctx context.Context, conn *cloudformation.CloudFormation, name, requestToken string, timeout time.Duration) (*cloudformation.Stack, error) {
+	const (
+		minTimeout = 5 * time.Second
+	)
+	stateConf := retry.StateChangeConf{
+		Pending: []string{
+			cloudformation.StackStatusUpdateCompleteCleanupInProgress,
+			cloudformation.StackStatusUpdateInProgress,
+			cloudformation.StackStatusUpdateRollbackInProgress,
+			cloudformation.StackStatusUpdateRollbackCompleteCleanupInProgress,
+		},
+		Target: []string{
+			cloudformation.StackStatusCreateComplete,
+			cloudformation.StackStatusUpdateComplete,
+			cloudformation.StackStatusUpdateRollbackComplete,
+			cloudformation.StackStatusUpdateRollbackFailed,
+		},
+		Timeout:    timeout,
+		MinTimeout: minTimeout,
+		Delay:      10 * time.Second,
+		Refresh:    statusStack(ctx, conn, name),
+	}
+
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	output, ok := outputRaw.(*cloudformation.Stack)
+	if !ok {
+		return nil, err
+	}
+
+	switch lastStatus := aws.StringValue(output.StackStatus); lastStatus {
+	case cloudformation.StackStatusUpdateRollbackComplete, cloudformation.StackStatusUpdateRollbackFailed:
+		if reasons := getRollbackReasons(ctx, conn, name, requestToken); len(reasons) > 0 {
+			return output, fmt.Errorf("failed to update CloudFormation stack (%s): %q", lastStatus, reasons)
+		} else {
+			return output, fmt.Errorf("failed to update CloudFormation stack (%s): %s", lastStatus, aws.StringValue(output.StackStatusReason))
+		}
+	}
+
+	return output, err
+}
+
+func WaitStackDeleted(ctx context.Context, conn *cloudformation.CloudFormation, name, requestToken string, timeout time.Duration) (*cloudformation.Stack, error) {
+	const (
+		minTimeout = 5 * time.Second
+	)
+	stateConf := retry.StateChangeConf{
+		Pending: []string{
+			cloudformation.StackStatusDeleteInProgress,
+			cloudformation.StackStatusRollbackInProgress,
+		},
+		Target: []string{
+			cloudformation.StackStatusDeleteComplete,
+			cloudformation.StackStatusDeleteFailed,
+		},
+		Timeout:    timeout,
+		MinTimeout: minTimeout,
+		Delay:      10 * time.Second,
+		Refresh:    statusStack(ctx, conn, name),
+	}
+
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	output, ok := outputRaw.(*cloudformation.Stack)
+	if !ok {
+		return nil, err
+	}
+
+	switch lastStatus := aws.StringValue(output.StackStatus); lastStatus {
+	case cloudformation.StackStatusDeleteFailed:
+		if reasons := getFailureReasons(ctx, conn, name, requestToken); len(reasons) > 0 {
+			return output, fmt.Errorf("failed to delete CloudFormation stack (%s): %q", lastStatus, reasons)
+		} else {
+			return output, fmt.Errorf("failed to delete CloudFormation stack (%s): %s", lastStatus, aws.StringValue(output.StackStatusReason))
+		}
+	}
+
+	return output, err
+}
+
+func findStackEventsForOperation(ctx context.Context, conn *cloudformation.CloudFormation, name, requestToken string, filter slices.Predicate[*cloudformation.StackEvent]) ([]*cloudformation.StackEvent, error) {
+	input := &cloudformation.DescribeStackEventsInput{
+		StackName: aws.String(name),
+	}
+	var output []*cloudformation.StackEvent
+	tokenSeen := false
+
+	err := conn.DescribeStackEventsPagesWithContext(ctx, input, func(page *cloudformation.DescribeStackEventsOutput, lastPage bool) bool {
+		if page == nil {
+			return !lastPage
+		}
+
+		for _, v := range page.StackEvents {
+			if v == nil {
+				continue
+			}
+
+			if currentToken := aws.StringValue(v.ClientRequestToken); !tokenSeen {
+				if currentToken != requestToken {
+					continue
+				}
+				tokenSeen = true
+			} else {
+				if currentToken != requestToken {
+					return false
+				}
+			}
+
+			if filter(v) {
+				output = append(output, v)
+			}
+		}
+
+		return !lastPage
+	})
+
+	return output, err
+}
+
+func getDeletionReasons(ctx context.Context, conn *cloudformation.CloudFormation, name, requestToken string) []string {
+	events, err := findStackEventsForOperation(ctx, conn, name, requestToken, func(event *cloudformation.StackEvent) bool {
+		return isFailedEvent(event) || isStackDeletionEvent(event)
+	})
+
+	if err != nil {
+		return nil
+	}
+
+	return slices.ApplyToAll(events, reasonFromEvent)
+}
+
+func getRollbackReasons(ctx context.Context, conn *cloudformation.CloudFormation, name, requestToken string) []string {
+	events, err := findStackEventsForOperation(ctx, conn, name, requestToken, func(event *cloudformation.StackEvent) bool {
+		return isFailedEvent(event) || isRollbackEvent(event)
+	})
+
+	if err != nil {
+		return nil
+	}
+
+	return slices.ApplyToAll(events, reasonFromEvent)
+}
+
+func getFailureReasons(ctx context.Context, conn *cloudformation.CloudFormation, name, requestToken string) []string {
+	events, err := findStackEventsForOperation(ctx, conn, name, requestToken, func(event *cloudformation.StackEvent) bool {
+		return isFailedEvent(event)
+	})
+
+	if err != nil {
+		return nil
+	}
+
+	return slices.ApplyToAll(events, reasonFromEvent)
+}
+
+func isFailedEvent(event *cloudformation.StackEvent) bool {
+	return strings.HasSuffix(aws.StringValue(event.ResourceStatus), "_FAILED") && event.ResourceStatusReason != nil
+}
+
+func isRollbackEvent(event *cloudformation.StackEvent) bool {
+	return strings.HasPrefix(aws.StringValue(event.ResourceStatus), "ROLLBACK_") && event.ResourceStatusReason != nil
+}
+
+func isStackDeletionEvent(event *cloudformation.StackEvent) bool {
+	return aws.StringValue(event.ResourceStatus) == cloudformation.ResourceStatusDeleteInProgress &&
+		aws.StringValue(event.ResourceType) == "AWS::CloudFormation::Stack" &&
+		event.ResourceStatusReason != nil
+}
+
+func reasonFromEvent(event *cloudformation.StackEvent) string {
+	return aws.StringValue(event.ResourceStatusReason)
+}
+
+func stackHasActualChanges(ctx context.Context, d *schema.ResourceDiff, meta any) bool {
+	if d.Id() == "" {
+		return false
+	}
+
+	for k, attr := range ResourceStack().Schema {
+		if attr.ForceNew {
+			continue
+		}
+		if attr.Computed && !attr.Optional {
+			continue
+		}
+
+		if d.HasChange(k) {
+			if attr.StateFunc == nil {
+				return true
+			}
+			o, n := d.GetChange(k)
+			on := attr.StateFunc(o)
+			nn := attr.StateFunc(n)
+			if on != nn {
+				return true
+			}
+		}
+	}
+	return false
+}
diff --git a/internal/service/cloudformation/stack_data_source.go b/internal/service/cloudformation/stack_data_source.go
index 40012e09479..ae0f92892f9 100644
--- a/internal/service/cloudformation/stack_data_source.go
+++ b/internal/service/cloudformation/stack_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudformation
 
 import (
diff --git a/internal/service/cloudformation/stack_data_source_test.go b/internal/service/cloudformation/stack_data_source_test.go
index 159170a70c7..4380f88d09d 100644
--- a/internal/service/cloudformation/stack_data_source_test.go
+++ b/internal/service/cloudformation/stack_data_source_test.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudformation_test
 
 import (
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/cloudformation"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -25,7 +28,7 @@ func TestAccCloudFormationStackDataSource_DataSource_basic(t *testing.T) {
 				Config: testAccStackDataSourceConfig_basic(stackName),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr(resourceName, "outputs.%", "1"),
-					resource.TestMatchResourceAttr(resourceName, "outputs.VPCId", regexp.MustCompile("^vpc-[a-z0-9]+")),
+					resource.TestMatchResourceAttr(resourceName, "outputs.VPCId", regexache.MustCompile("^vpc-[0-9a-z]+")),
 					resource.TestCheckResourceAttr(resourceName, "capabilities.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "disable_rollback", "false"),
 					resource.TestCheckResourceAttr(resourceName, "notification_arns.#", "0"),
@@ -112,7 +115,7 @@ func TestAccCloudFormationStackDataSource_DataSource_yaml(t *testing.T) {
 				Config: testAccStackDataSourceConfig_yaml(stackName),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr(resourceName, "outputs.%", "1"),
-					resource.TestMatchResourceAttr(resourceName, "outputs.VPCId", regexp.MustCompile("^vpc-[a-z0-9]+")),
+					resource.TestMatchResourceAttr(resourceName, "outputs.VPCId", regexache.MustCompile("^vpc-[0-9a-z]+")),
 					resource.TestCheckResourceAttr(resourceName, "capabilities.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "disable_rollback", "false"),
 					resource.TestCheckResourceAttr(resourceName, "notification_arns.#", "0"),
diff --git a/internal/service/cloudformation/stack_set.go b/internal/service/cloudformation/stack_set.go
index 69644ce544c..38b68396d32 100644
--- a/internal/service/cloudformation/stack_set.go
+++ b/internal/service/cloudformation/stack_set.go
@@ -1,11 +1,16 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudformation
 
 import (
 	"context"
+	"fmt"
 	"log"
-	"regexp"
+	"strings"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/cloudformation"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -32,7 +37,7 @@ func ResourceStackSet() *schema.Resource {
 		DeleteWithoutTimeout: resourceStackSetDelete,
 
 		Importer: &schema.ResourceImporter{
-			StateContext: schema.ImportStatePassthroughContext,
+			StateContext: resourceStackSetImport,
 		},
 
 		Timeouts: &schema.ResourceTimeout{
@@ -119,8 +124,8 @@ func ResourceStackSet() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 128),
-					validation.StringMatch(regexp.MustCompile(`^[a-zA-Z]`), "must begin with alphabetic character"),
-					validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9-]+$`), "must contain only alphanumeric and hyphen characters"),
+					validation.StringMatch(regexache.MustCompile(`^[A-Za-z]`), "must begin with alphabetic character"),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z-]+$`), "must contain only alphanumeric and hyphen characters"),
 				),
 			},
 			"operation_preferences": {
@@ -164,7 +169,7 @@ func ResourceStackSet() *schema.Resource {
 							MinItems: 1,
 							Elem: &schema.Schema{
 								Type:         schema.TypeString,
-								ValidateFunc: validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9-]{1,128}$`), ""),
+								ValidateFunc: validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z-]{1,128}$`), ""),
 							},
 						},
 					},
@@ -225,6 +230,10 @@ func resourceStackSetCreate(ctx context.Context, d *schema.ResourceData, meta in
 		input.AutoDeployment = expandAutoDeployment(v.([]interface{}))
 	}
 
+	if v, ok := d.GetOk("call_as"); ok {
+		input.CallAs = aws.String(v.(string))
+	}
+
 	if v, ok := d.GetOk("capabilities"); ok {
 		input.Capabilities = flex.ExpandStringSet(v.(*schema.Set))
 	}
@@ -249,10 +258,6 @@ func resourceStackSetCreate(ctx context.Context, d *schema.ResourceData, meta in
 		input.PermissionModel = aws.String(v.(string))
 	}
 
-	if v, ok := d.GetOk("call_as"); ok {
-		input.CallAs = aws.String(v.(string))
-	}
-
 	if v, ok := d.GetOk("template_body"); ok {
 		input.TemplateBody = aws.String(v.(string))
 	}
@@ -261,7 +266,6 @@ func resourceStackSetCreate(ctx context.Context, d *schema.ResourceData, meta in
 		input.TemplateURL = aws.String(v.(string))
 	}
 
-	log.Printf("[DEBUG] Creating CloudFormation StackSet: %s", input)
 	_, err := conn.CreateStackSetWithContext(ctx, input)
 
 	if err != nil {
@@ -292,35 +296,25 @@ func resourceStackSetRead(ctx context.Context, d *schema.ResourceData, meta inte
 
 	d.Set("administration_role_arn", stackSet.AdministrationRoleARN)
 	d.Set("arn", stackSet.StackSetARN)
-
 	if err := d.Set("auto_deployment", flattenStackSetAutoDeploymentResponse(stackSet.AutoDeployment)); err != nil {
 		return sdkdiag.AppendErrorf(diags, "setting auto_deployment: %s", err)
 	}
-
-	if err := d.Set("capabilities", aws.StringValueSlice(stackSet.Capabilities)); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting capabilities: %s", err)
-	}
-
+	d.Set("capabilities", aws.StringValueSlice(stackSet.Capabilities))
 	d.Set("description", stackSet.Description)
 	d.Set("execution_role_name", stackSet.ExecutionRoleName)
-
 	if err := d.Set("managed_execution", flattenStackSetManagedExecution(stackSet.ManagedExecution)); err != nil {
 		return sdkdiag.AppendErrorf(diags, "setting managed_execution: %s", err)
 	}
-
 	d.Set("name", stackSet.StackSetName)
 	d.Set("permission_model", stackSet.PermissionModel)
-
 	if err := d.Set("parameters", flattenAllParameters(stackSet.Parameters)); err != nil {
 		return sdkdiag.AppendErrorf(diags, "setting parameters: %s", err)
 	}
-
 	d.Set("stack_set_id", stackSet.StackSetId)
+	d.Set("template_body", stackSet.TemplateBody)
 
 	setTagsOut(ctx, stackSet.Tags)
 
-	d.Set("template_body", stackSet.TemplateBody)
-
 	return diags
 }
 
@@ -339,6 +333,11 @@ func resourceStackSetUpdate(ctx context.Context, d *schema.ResourceData, meta in
 		input.AdministrationRoleARN = aws.String(v.(string))
 	}
 
+	callAs := d.Get("call_as").(string)
+	if v, ok := d.GetOk("call_as"); ok {
+		input.CallAs = aws.String(v.(string))
+	}
+
 	if v, ok := d.GetOk("capabilities"); ok {
 		input.Capabilities = flex.ExpandStringSet(v.(*schema.Set))
 	}
@@ -367,11 +366,6 @@ func resourceStackSetUpdate(ctx context.Context, d *schema.ResourceData, meta in
 		input.PermissionModel = aws.String(v.(string))
 	}
 
-	callAs := d.Get("call_as").(string)
-	if v, ok := d.GetOk("call_as"); ok {
-		input.CallAs = aws.String(v.(string))
-	}
-
 	if tags := getTagsIn(ctx); len(tags) > 0 {
 		input.Tags = tags
 	}
@@ -392,7 +386,6 @@ func resourceStackSetUpdate(ctx context.Context, d *schema.ResourceData, meta in
 		input.AutoDeployment = expandAutoDeployment(v.([]interface{}))
 	}
 
-	log.Printf("[DEBUG] Updating CloudFormation StackSet: %s", input)
 	output, err := conn.UpdateStackSetWithContext(ctx, input)
 
 	if err != nil {
@@ -432,6 +425,21 @@ func resourceStackSetDelete(ctx context.Context, d *schema.ResourceData, meta in
 	return diags
 }
 
+func resourceStackSetImport(ctx context.Context, d *schema.ResourceData, meta interface{}) ([]*schema.ResourceData, error) {
+	const stackSetImportIDSeparator = ","
+
+	switch parts := strings.Split(d.Id(), stackSetImportIDSeparator); len(parts) {
+	case 1:
+	case 2:
+		d.SetId(parts[0])
+		d.Set("call_as", parts[1])
+	default:
+		return []*schema.ResourceData{}, fmt.Errorf("unexpected format for import ID (%[1]s), use: STACKSETNAME or STACKSETNAME%[2]sCALLAS", d.Id(), stackSetImportIDSeparator)
+	}
+
+	return []*schema.ResourceData{d}, nil
+}
+
 func expandAutoDeployment(l []interface{}) *cloudformation.AutoDeployment {
 	if len(l) == 0 {
 		return nil
@@ -439,9 +447,13 @@ func expandAutoDeployment(l []interface{}) *cloudformation.AutoDeployment {
 
 	m := l[0].(map[string]interface{})
 
+	enabled := m["enabled"].(bool)
 	autoDeployment := &cloudformation.AutoDeployment{
-		Enabled:                      aws.Bool(m["enabled"].(bool)),
-		RetainStacksOnAccountRemoval: aws.Bool(m["retain_stacks_on_account_removal"].(bool)),
+		Enabled: aws.Bool(enabled),
+	}
+
+	if enabled {
+		autoDeployment.RetainStacksOnAccountRemoval = aws.Bool(m["retain_stacks_on_account_removal"].(bool))
 	}
 
 	return autoDeployment
diff --git a/internal/service/cloudformation/stack_set_instance.go b/internal/service/cloudformation/stack_set_instance.go
index 727e812c0d7..8cbdba89c23 100644
--- a/internal/service/cloudformation/stack_set_instance.go
+++ b/internal/service/cloudformation/stack_set_instance.go
@@ -1,12 +1,16 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudformation
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"strings"
+	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/cloudformation"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -30,13 +34,13 @@ func ResourceStackSetInstance() *schema.Resource {
 		DeleteWithoutTimeout: resourceStackSetInstanceDelete,
 
 		Importer: &schema.ResourceImporter{
-			StateContext: schema.ImportStatePassthroughContext,
+			StateContext: resourceStackSetInstanceImport,
 		},
 
 		Timeouts: &schema.ResourceTimeout{
-			Create: schema.DefaultTimeout(StackSetInstanceCreatedDefaultTimeout),
-			Update: schema.DefaultTimeout(StackSetInstanceUpdatedDefaultTimeout),
-			Delete: schema.DefaultTimeout(StackSetInstanceDeletedDefaultTimeout),
+			Create: schema.DefaultTimeout(30 * time.Minute),
+			Update: schema.DefaultTimeout(30 * time.Minute),
+			Delete: schema.DefaultTimeout(30 * time.Minute),
 		},
 
 		Schema: map[string]*schema.Schema{
@@ -57,6 +61,7 @@ func ResourceStackSetInstance() *schema.Resource {
 			"deployment_targets": {
 				Type:     schema.TypeList,
 				Optional: true,
+				ForceNew: true,
 				MaxItems: 1,
 				Elem: &schema.Resource{
 					Schema: map[string]*schema.Schema{
@@ -66,7 +71,7 @@ func ResourceStackSetInstance() *schema.Resource {
 							MinItems: 1,
 							Elem: &schema.Schema{
 								Type:         schema.TypeString,
-								ValidateFunc: validation.StringMatch(regexp.MustCompile(`^(ou-[a-z0-9]{4,32}-[a-z0-9]{8,32}|r-[a-z0-9]{4,32})$`), ""),
+								ValidateFunc: validation.StringMatch(regexache.MustCompile(`^(ou-[0-9a-z]{4,32}-[0-9a-z]{8,32}|r-[0-9a-z]{4,32})$`), ""),
 							},
 						},
 					},
@@ -114,7 +119,7 @@ func ResourceStackSetInstance() *schema.Resource {
 							MinItems: 1,
 							Elem: &schema.Schema{
 								Type:         schema.TypeString,
-								ValidateFunc: validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9-]{1,128}$`), ""),
+								ValidateFunc: validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z-]{1,128}$`), ""),
 							},
 						},
 					},
@@ -129,21 +134,43 @@ func ResourceStackSetInstance() *schema.Resource {
 				Optional: true,
 				Elem:     &schema.Schema{Type: schema.TypeString},
 			},
-			"retain_stack": {
-				Type:     schema.TypeBool,
-				Optional: true,
-				Default:  false,
-			},
 			"region": {
 				Type:     schema.TypeString,
 				Optional: true,
 				Computed: true,
 				ForceNew: true,
 			},
+			"retain_stack": {
+				Type:     schema.TypeBool,
+				Optional: true,
+				Default:  false,
+			},
 			"stack_id": {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
+			"stack_instance_summaries": {
+				Type:     schema.TypeList,
+				Computed: true,
+				Description: "List of stack instances created from an organizational unit deployment target. " +
+					"This will only be populated when `deployment_targets` is set.",
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"account_id": {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+						"organizational_unit_id": {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+						"stack_id": {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+					},
+				},
+			},
 			"stack_set_name": {
 				Type:         schema.TypeString,
 				Required:     true,
@@ -154,6 +181,10 @@ func ResourceStackSetInstance() *schema.Resource {
 	}
 }
 
+var (
+	accountIDRegexp = regexache.MustCompile(`^\d{12}$`)
+)
+
 func resourceStackSetInstanceCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).CloudFormationConn(ctx)
@@ -173,22 +204,25 @@ func resourceStackSetInstanceCreate(ctx context.Context, d *schema.ResourceData,
 	if v, ok := d.GetOk("account_id"); ok {
 		accountID = v.(string)
 	}
-
-	callAs := d.Get("call_as").(string)
-	if v, ok := d.GetOk("call_as"); ok {
-		input.CallAs = aws.String(v.(string))
-	}
+	// accountOrOrgID will either be account_id or a slash-delimited list of
+	// organizational_unit_id's from the deployment_targets argument. This
+	// is composed with stack_set_name and region to form the resources ID.
+	accountOrOrgID := accountID
 
 	if v, ok := d.GetOk("deployment_targets"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
 		dt := expandDeploymentTargets(v.([]interface{}))
-		// temporarily set the accountId to the DeploymentTarget IDs
-		// to later inform the Read CRUD operation if the true accountID needs to be determined
-		accountID = strings.Join(aws.StringValueSlice(dt.OrganizationalUnitIds), "/")
+		accountOrOrgID = strings.Join(aws.StringValueSlice(dt.OrganizationalUnitIds), "/")
 		input.DeploymentTargets = dt
 	} else {
+		d.Set("account_id", accountID)
 		input.Accounts = aws.StringSlice([]string{accountID})
 	}
 
+	callAs := d.Get("call_as").(string)
+	if v, ok := d.GetOk("call_as"); ok {
+		input.CallAs = aws.String(v.(string))
+	}
+
 	if v, ok := d.GetOk("parameter_overrides"); ok {
 		input.ParameterOverrides = expandParameters(v.(map[string]interface{}))
 	}
@@ -197,7 +231,6 @@ func resourceStackSetInstanceCreate(ctx context.Context, d *schema.ResourceData,
 		input.OperationPreferences = expandOperationPreferences(v.([]interface{})[0].(map[string]interface{}))
 	}
 
-	log.Printf("[DEBUG] Creating CloudFormation StackSet Instance: %s", input)
 	_, err := tfresource.RetryWhen(ctx, propagationTimeout,
 		func() (interface{}, error) {
 			input.OperationId = aws.String(id.UniqueId())
@@ -208,7 +241,7 @@ func resourceStackSetInstanceCreate(ctx context.Context, d *schema.ResourceData,
 				return nil, err
 			}
 
-			d.SetId(StackSetInstanceCreateResourceID(stackSetName, accountID, region))
+			d.SetId(StackSetInstanceCreateResourceID(stackSetName, accountOrOrgID, region))
 
 			operation, err := WaitStackSetOperationSucceeded(ctx, conn, stackSetName, aws.StringValue(output.OperationId), callAs, d.Timeout(schema.TimeoutCreate))
 			if err != nil {
@@ -251,7 +284,7 @@ func resourceStackSetInstanceCreate(ctx context.Context, d *schema.ResourceData,
 				return true, err
 			}
 
-			return false, fmt.Errorf("waiting for CloudFormation StackSet Instance (%s) creation: %w", d.Id(), err)
+			return false, err
 		},
 	)
 
@@ -266,49 +299,57 @@ func resourceStackSetInstanceRead(ctx context.Context, d *schema.ResourceData, m
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).CloudFormationConn(ctx)
 
-	stackSetName, accountID, region, err := StackSetInstanceParseResourceID(d.Id())
+	stackSetName, accountOrOrgID, region, err := StackSetInstanceParseResourceID(d.Id())
+	if err != nil {
+		return sdkdiag.AppendFromErr(diags, err)
+	}
+
+	d.Set("region", region)
+	d.Set("stack_set_name", stackSetName)
 
 	callAs := d.Get("call_as").(string)
 
-	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "reading CloudFormation StackSet Instance (%s): %s", d.Id(), err)
-	}
+	if accountIDRegexp.MatchString(accountOrOrgID) {
+		// Stack instances deployed by account ID
+		stackInstance, err := FindStackInstanceByName(ctx, conn, stackSetName, accountOrOrgID, region, callAs)
 
-	// Determine correct account ID for the Instance if created with deployment targets;
-	// we only expect the accountID to be the organization root ID or organizational unit (OU) IDs
-	// separated by a slash after creation.
-	if regexp.MustCompile(`(ou-[a-z0-9]{4,32}-[a-z0-9]{8,32}|r-[a-z0-9]{4,32})`).MatchString(accountID) {
-		orgIDs := strings.Split(accountID, "/")
-		accountID, err = FindStackInstanceAccountIdByOrgIDs(ctx, conn, stackSetName, region, callAs, orgIDs)
+		if !d.IsNewResource() && tfresource.NotFound(err) {
+			log.Printf("[WARN] CloudFormation StackSet Instance (%s) not found, removing from state", d.Id())
+			d.SetId("")
+			return diags
+		}
 
 		if err != nil {
-			return sdkdiag.AppendErrorf(diags, "finding CloudFormation StackSet Instance (%s) Account: %s", d.Id(), err)
+			return sdkdiag.AppendErrorf(diags, "reading CloudFormation StackSet Instance (%s): %s", d.Id(), err)
 		}
 
-		d.SetId(StackSetInstanceCreateResourceID(stackSetName, accountID, region))
-	}
+		d.Set("account_id", stackInstance.Account)
+		d.Set("organizational_unit_id", stackInstance.OrganizationalUnitId)
+		if err := d.Set("parameter_overrides", flattenAllParameters(stackInstance.ParameterOverrides)); err != nil {
+			return sdkdiag.AppendErrorf(diags, "setting parameters: %s", err)
+		}
 
-	stackInstance, err := FindStackInstanceByName(ctx, conn, stackSetName, accountID, region, callAs)
+		d.Set("stack_id", stackInstance.StackId)
+		d.Set("stack_instance_summaries", nil)
+	} else {
+		// Stack instances deployed by organizational unit ID
+		orgIDs := strings.Split(accountOrOrgID, "/")
 
-	if !d.IsNewResource() && tfresource.NotFound(err) {
-		log.Printf("[WARN] CloudFormation StackSet Instance (%s) not found, removing from state", d.Id())
-		d.SetId("")
-		return diags
-	}
+		summaries, err := FindStackInstanceSummariesByOrgIDs(ctx, conn, stackSetName, region, callAs, orgIDs)
 
-	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "reading CloudFormation StackSet Instance (%s): %s", d.Id(), err)
-	}
+		if !d.IsNewResource() && tfresource.NotFound(err) {
+			log.Printf("[WARN] CloudFormation StackSet Instance (%s) not found, removing from state", d.Id())
+			d.SetId("")
+			return diags
+		}
 
-	d.Set("account_id", stackInstance.Account)
-	d.Set("organizational_unit_id", stackInstance.OrganizationalUnitId)
-	if err := d.Set("parameter_overrides", flattenAllParameters(stackInstance.ParameterOverrides)); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting parameters: %s", err)
-	}
+		if err != nil {
+			return sdkdiag.AppendErrorf(diags, "finding CloudFormation StackSet Instance (%s): %s", d.Id(), err)
+		}
 
-	d.Set("region", stackInstance.Region)
-	d.Set("stack_id", stackInstance.StackId)
-	d.Set("stack_set_name", stackSetName)
+		d.Set("deployment_targets", flattenDeploymentTargetsFromSlice(orgIDs))
+		d.Set("stack_instance_summaries", flattenStackInstanceSummaries(summaries))
+	}
 
 	return diags
 }
@@ -318,14 +359,13 @@ func resourceStackSetInstanceUpdate(ctx context.Context, d *schema.ResourceData,
 	conn := meta.(*conns.AWSClient).CloudFormationConn(ctx)
 
 	if d.HasChanges("deployment_targets", "parameter_overrides", "operation_preferences") {
-		stackSetName, accountID, region, err := StackSetInstanceParseResourceID(d.Id())
-
+		stackSetName, accountOrOrgID, region, err := StackSetInstanceParseResourceID(d.Id())
 		if err != nil {
-			return sdkdiag.AppendErrorf(diags, "updating CloudFormation StackSet Instance (%s): %s", d.Id(), err)
+			return sdkdiag.AppendFromErr(diags, err)
 		}
 
 		input := &cloudformation.UpdateStackInstancesInput{
-			Accounts:           aws.StringSlice([]string{accountID}),
+			Accounts:           aws.StringSlice([]string{accountOrOrgID}),
 			OperationId:        aws.String(id.UniqueId()),
 			ParameterOverrides: []*cloudformation.Parameter{},
 			Regions:            aws.StringSlice([]string{region}),
@@ -338,9 +378,10 @@ func resourceStackSetInstanceUpdate(ctx context.Context, d *schema.ResourceData,
 		}
 
 		if v, ok := d.GetOk("deployment_targets"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
+			dt := expandDeploymentTargets(v.([]interface{}))
 			// reset input Accounts as the API accepts only 1 of Accounts and DeploymentTargets
 			input.Accounts = nil
-			input.DeploymentTargets = expandDeploymentTargets(v.([]interface{}))
+			input.DeploymentTargets = dt
 		}
 
 		if v, ok := d.GetOk("parameter_overrides"); ok {
@@ -351,7 +392,6 @@ func resourceStackSetInstanceUpdate(ctx context.Context, d *schema.ResourceData,
 			input.OperationPreferences = expandOperationPreferences(v.([]interface{})[0].(map[string]interface{}))
 		}
 
-		log.Printf("[DEBUG] Updating CloudFormation StackSet Instance: %s", input)
 		output, err := conn.UpdateStackInstancesWithContext(ctx, input)
 
 		if err != nil {
@@ -359,7 +399,7 @@ func resourceStackSetInstanceUpdate(ctx context.Context, d *schema.ResourceData,
 		}
 
 		if _, err := WaitStackSetOperationSucceeded(ctx, conn, stackSetName, aws.StringValue(output.OperationId), callAs, d.Timeout(schema.TimeoutUpdate)); err != nil {
-			return sdkdiag.AppendErrorf(diags, "updating CloudFormation StackSet Instance (%s): waiting for completion: %s", d.Id(), err)
+			return sdkdiag.AppendErrorf(diags, "waiting for CloudFormation StackSet Instance (%s) update: %s", d.Id(), err)
 		}
 	}
 
@@ -370,14 +410,13 @@ func resourceStackSetInstanceDelete(ctx context.Context, d *schema.ResourceData,
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).CloudFormationConn(ctx)
 
-	stackSetName, accountID, region, err := StackSetInstanceParseResourceID(d.Id())
-
+	stackSetName, accountOrOrgID, region, err := StackSetInstanceParseResourceID(d.Id())
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "deleting CloudFormation StackSet Instance (%s): %s", d.Id(), err)
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
 	input := &cloudformation.DeleteStackInstancesInput{
-		Accounts:     aws.StringSlice([]string{accountID}),
+		Accounts:     aws.StringSlice([]string{accountOrOrgID}),
 		OperationId:  aws.String(id.UniqueId()),
 		Regions:      aws.StringSlice([]string{region}),
 		RetainStacks: aws.Bool(d.Get("retain_stack").(bool)),
@@ -389,19 +428,20 @@ func resourceStackSetInstanceDelete(ctx context.Context, d *schema.ResourceData,
 		input.CallAs = aws.String(v.(string))
 	}
 
-	if v, ok := d.GetOk("organizational_unit_id"); ok {
+	if v, ok := d.GetOk("deployment_targets"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
+		dt := expandDeploymentTargets(v.([]interface{}))
 		// For instances associated with stack sets that use a self-managed permission model,
 		// the organizational unit must be provided;
 		input.Accounts = nil
-		input.DeploymentTargets = &cloudformation.DeploymentTargets{
-			OrganizationalUnitIds: aws.StringSlice([]string{v.(string)}),
-		}
+		input.DeploymentTargets = dt
 	}
 
 	log.Printf("[DEBUG] Deleting CloudFormation StackSet Instance: %s", d.Id())
-	output, err := conn.DeleteStackInstancesWithContext(ctx, input)
+	outputRaw, err := tfresource.RetryWhenAWSErrCodeEquals(ctx, d.Timeout(schema.TimeoutDelete), func() (interface{}, error) {
+		return conn.DeleteStackInstancesWithContext(ctx, input)
+	}, cloudformation.ErrCodeOperationInProgressException)
 
-	if tfawserr.ErrCodeEquals(err, cloudformation.ErrCodeStackInstanceNotFoundException) || tfawserr.ErrCodeEquals(err, cloudformation.ErrCodeStackSetNotFoundException) {
+	if tfawserr.ErrCodeEquals(err, cloudformation.ErrCodeStackInstanceNotFoundException, cloudformation.ErrCodeStackSetNotFoundException) {
 		return diags
 	}
 
@@ -409,29 +449,93 @@ func resourceStackSetInstanceDelete(ctx context.Context, d *schema.ResourceData,
 		return sdkdiag.AppendErrorf(diags, "deleting CloudFormation StackSet Instance (%s): %s", d.Id(), err)
 	}
 
-	if _, err := WaitStackSetOperationSucceeded(ctx, conn, stackSetName, aws.StringValue(output.OperationId), callAs, d.Timeout(schema.TimeoutDelete)); err != nil {
-		return sdkdiag.AppendErrorf(diags, "deleting CloudFormation StackSet Instance (%s): waiting for completion: %s", d.Id(), err)
+	if _, err := WaitStackSetOperationSucceeded(ctx, conn, stackSetName, aws.StringValue(outputRaw.(*cloudformation.DeleteStackInstancesOutput).OperationId), callAs, d.Timeout(schema.TimeoutDelete)); err != nil {
+		return sdkdiag.AppendErrorf(diags, "waiting for CloudFormation StackSet Instance (%s) delete: %s", d.Id(), err)
 	}
 
 	return diags
 }
 
-func expandDeploymentTargets(l []interface{}) *cloudformation.DeploymentTargets {
-	if len(l) == 0 || l[0] == nil {
-		return nil
+func resourceStackSetInstanceImport(ctx context.Context, d *schema.ResourceData, meta interface{}) ([]*schema.ResourceData, error) {
+	switch parts := strings.Split(d.Id(), stackSetInstanceResourceIDSeparator); len(parts) {
+	case 3:
+	case 4:
+		d.SetId(strings.Join([]string{parts[0], parts[1], parts[2]}, stackSetInstanceResourceIDSeparator))
+		d.Set("call_as", parts[3])
+	default:
+		return []*schema.ResourceData{}, fmt.Errorf("unexpected format for import ID (%[1]s), use: STACKSETNAME%[2]sACCOUNTID%[2]sREGION or STACKSETNAME%[2]sACCOUNTID%[2]sREGION%[2]sCALLAS", d.Id(), stackSetInstanceResourceIDSeparator)
 	}
 
-	tfMap, ok := l[0].(map[string]interface{})
+	return []*schema.ResourceData{d}, nil
+}
+
+const stackSetInstanceResourceIDSeparator = ","
+
+func StackSetInstanceCreateResourceID(stackSetName, accountID, region string) string {
+	parts := []string{stackSetName, accountID, region}
+	id := strings.Join(parts, stackSetInstanceResourceIDSeparator)
+
+	return id
+}
+
+func StackSetInstanceParseResourceID(id string) (string, string, string, error) {
+	parts := strings.Split(id, stackSetInstanceResourceIDSeparator)
 
+	if len(parts) == 3 && parts[0] != "" && parts[1] != "" && parts[2] != "" {
+		return parts[0], parts[1], parts[2], nil
+	}
+
+	return "", "", "", fmt.Errorf("unexpected format for ID (%[1]s), expected STACKSETNAME%[2]sACCOUNTID%[2]sREGION", id, stackSetInstanceResourceIDSeparator)
+}
+
+func expandDeploymentTargets(tfList []interface{}) *cloudformation.DeploymentTargets {
+	if len(tfList) == 0 || tfList[0] == nil {
+		return nil
+	}
+
+	tfMap, ok := tfList[0].(map[string]interface{})
 	if !ok {
 		return nil
 	}
 
 	dt := &cloudformation.DeploymentTargets{}
-
 	if v, ok := tfMap["organizational_unit_ids"].(*schema.Set); ok && v.Len() > 0 {
 		dt.OrganizationalUnitIds = flex.ExpandStringSet(v)
 	}
 
 	return dt
 }
+
+// flattenDeployment targets converts a list of organizational units (typically
+// parsed from the resource ID) into the Terraform representation of the
+// deployment_targets attribute.
+func flattenDeploymentTargetsFromSlice(orgIDs []string) []interface{} {
+	tfList := []interface{}{}
+	for _, ou := range orgIDs {
+		tfList = append(tfList, ou)
+	}
+
+	m := map[string]interface{}{
+		"organizational_unit_ids": tfList,
+	}
+
+	return []interface{}{m}
+}
+
+func flattenStackInstanceSummaries(apiObject []*cloudformation.StackInstanceSummary) []interface{} {
+	if len(apiObject) == 0 {
+		return nil
+	}
+
+	tfList := []interface{}{}
+	for _, obj := range apiObject {
+		m := map[string]interface{}{
+			"account_id":             obj.Account,
+			"organizational_unit_id": obj.OrganizationalUnitId,
+			"stack_id":               obj.StackId,
+		}
+		tfList = append(tfList, m)
+	}
+
+	return tfList
+}
diff --git a/internal/service/cloudformation/stack_set_instance_test.go b/internal/service/cloudformation/stack_set_instance_test.go
index 165f87b141d..80ffac0876c 100644
--- a/internal/service/cloudformation/stack_set_instance_test.go
+++ b/internal/service/cloudformation/stack_set_instance_test.go
@@ -1,8 +1,12 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudformation_test
 
 import (
 	"context"
 	"fmt"
+	"strings"
 	"testing"
 
 	"github.com/aws/aws-sdk-go/aws"
@@ -34,12 +38,15 @@ func TestAccCloudFormationStackSetInstance_basic(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckStackSetInstanceExists(ctx, resourceName, &stackInstance1),
 					acctest.CheckResourceAttrAccountID(resourceName, "account_id"),
+					resource.TestCheckResourceAttr(resourceName, "call_as", "SELF"),
 					resource.TestCheckResourceAttr(resourceName, "deployment_targets.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "operation_preferences.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "organizational_unit_id", ""),
 					resource.TestCheckResourceAttr(resourceName, "parameter_overrides.%", "0"),
 					resource.TestCheckResourceAttr(resourceName, "region", acctest.Region()),
 					resource.TestCheckResourceAttr(resourceName, "retain_stack", "false"),
 					resource.TestCheckResourceAttrSet(resourceName, "stack_id"),
+					resource.TestCheckResourceAttr(resourceName, "stack_instance_summaries.#", "0"),
 					resource.TestCheckResourceAttrPair(resourceName, "stack_set_name", cloudformationStackSetResourceName, "name"),
 				),
 			},
@@ -52,6 +59,23 @@ func TestAccCloudFormationStackSetInstance_basic(t *testing.T) {
 					"call_as",
 				},
 			},
+			// Test import with call_as.
+			{
+				ResourceName: resourceName,
+				ImportStateIdFunc: func(s *terraform.State) (string, error) {
+					rs, ok := s.RootModule().Resources[resourceName]
+					if !ok {
+						return "", fmt.Errorf("Not found: %s", resourceName)
+					}
+
+					return fmt.Sprintf("%s,SELF", rs.Primary.ID), nil
+				},
+				ImportState:       true,
+				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{
+					"retain_stack",
+				},
+			},
 		},
 	})
 }
@@ -232,7 +256,7 @@ func TestAccCloudFormationStackSetInstance_retainStack(t *testing.T) {
 
 func TestAccCloudFormationStackSetInstance_deploymentTargets(t *testing.T) {
 	ctx := acctest.Context(t)
-	var stackInstance cloudformation.StackInstance
+	var stackInstanceSummaries []*cloudformation.StackInstanceSummary
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_cloudformation_stack_set_instance.test"
 
@@ -246,12 +270,12 @@ func TestAccCloudFormationStackSetInstance_deploymentTargets(t *testing.T) {
 		},
 		ErrorCheck:               acctest.ErrorCheck(t, cloudformation.EndpointsID, "organizations"),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckStackSetInstanceDestroy(ctx),
+		CheckDestroy:             testAccCheckStackSetInstanceForOrganizationalUnitDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccStackSetInstanceConfig_deploymentTargets(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckStackSetInstanceExists(ctx, resourceName, &stackInstance),
+					testAccCheckStackSetInstanceForOrganizationalUnitExists(ctx, resourceName, stackInstanceSummaries),
 					resource.TestCheckResourceAttr(resourceName, "deployment_targets.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "deployment_targets.0.organizational_unit_ids.#", "1"),
 				),
@@ -262,14 +286,58 @@ func TestAccCloudFormationStackSetInstance_deploymentTargets(t *testing.T) {
 				ImportStateVerify: true,
 				ImportStateVerifyIgnore: []string{
 					"retain_stack",
-					"deployment_targets",
 					"call_as",
 				},
 			},
 			{
-				Config: testAccStackSetInstanceConfig_serviceManaged(rName),
+				Config: testAccStackSetInstanceConfig_deploymentTargets(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckStackSetInstanceExists(ctx, resourceName, &stackInstance),
+					testAccCheckStackSetInstanceForOrganizationalUnitExists(ctx, resourceName, stackInstanceSummaries),
+				),
+			},
+		},
+	})
+}
+
+func TestAccCloudFormationStackSetInstance_DeploymentTargets_emptyOU(t *testing.T) {
+	ctx := acctest.Context(t)
+	var stackInstanceSummaries []*cloudformation.StackInstanceSummary
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_cloudformation_stack_set_instance.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			testAccPreCheckStackSet(ctx, t)
+			acctest.PreCheckOrganizationsEnabled(ctx, t)
+			acctest.PreCheckOrganizationManagementAccount(ctx, t)
+			acctest.PreCheckIAMServiceLinkedRole(ctx, t, "/aws-service-role/stacksets.cloudformation.amazonaws.com")
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, cloudformation.EndpointsID, "organizations"),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckStackSetInstanceForOrganizationalUnitDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccStackSetInstanceConfig_DeploymentTargets_emptyOU(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckStackSetInstanceForOrganizationalUnitExists(ctx, resourceName, stackInstanceSummaries),
+					resource.TestCheckResourceAttr(resourceName, "deployment_targets.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "deployment_targets.0.organizational_unit_ids.#", "1"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{
+					"retain_stack",
+					"call_as",
+				},
+			},
+			{
+				Config: testAccStackSetInstanceConfig_DeploymentTargets_emptyOU(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckStackSetInstanceForOrganizationalUnitExists(ctx, resourceName, stackInstanceSummaries),
 				),
 			},
 		},
@@ -278,7 +346,7 @@ func TestAccCloudFormationStackSetInstance_deploymentTargets(t *testing.T) {
 
 func TestAccCloudFormationStackSetInstance_operationPreferences(t *testing.T) {
 	ctx := acctest.Context(t)
-	var stackInstance cloudformation.StackInstance
+	var stackInstanceSummaries []*cloudformation.StackInstanceSummary
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_cloudformation_stack_set_instance.test"
 
@@ -292,12 +360,12 @@ func TestAccCloudFormationStackSetInstance_operationPreferences(t *testing.T) {
 		},
 		ErrorCheck:               acctest.ErrorCheck(t, cloudformation.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckStackSetInstanceDestroy(ctx),
+		CheckDestroy:             testAccCheckStackSetInstanceForOrganizationalUnitDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccStackSetInstanceConfig_operationPreferences(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckStackSetInstanceExists(ctx, resourceName, &stackInstance),
+					testAccCheckStackSetInstanceForOrganizationalUnitExists(ctx, resourceName, stackInstanceSummaries),
 					resource.TestCheckResourceAttr(resourceName, "operation_preferences.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "operation_preferences.0.failure_tolerance_count", "1"),
 					resource.TestCheckResourceAttr(resourceName, "operation_preferences.0.failure_tolerance_percentage", "0"),
@@ -306,12 +374,6 @@ func TestAccCloudFormationStackSetInstance_operationPreferences(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "operation_preferences.0.region_concurrency_type", ""),
 				),
 			},
-			{
-				Config: testAccStackSetInstanceConfig_serviceManaged(rName),
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckStackSetInstanceExists(ctx, resourceName, &stackInstance),
-				),
-			},
 		},
 	})
 }
@@ -345,11 +407,83 @@ func testAccCheckStackSetInstanceExists(ctx context.Context, resourceName string
 	}
 }
 
+// testAccCheckStackSetInstanceForOrganizationalUnitExists is a variant of the
+// standard CheckExistsFunc which expects the resource ID to contain organizational
+// unit IDs rather than an account ID
+func testAccCheckStackSetInstanceForOrganizationalUnitExists(ctx context.Context, resourceName string, v []*cloudformation.StackInstanceSummary) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[resourceName]
+		if !ok {
+			return fmt.Errorf("Not found: %s", resourceName)
+		}
+
+		callAs := rs.Primary.Attributes["call_as"]
+
+		conn := acctest.Provider.Meta().(*conns.AWSClient).CloudFormationConn(ctx)
+
+		stackSetName, accountOrOrgID, region, err := tfcloudformation.StackSetInstanceParseResourceID(rs.Primary.ID)
+		if err != nil {
+			return err
+		}
+		orgIDs := strings.Split(accountOrOrgID, "/")
+
+		output, err := tfcloudformation.FindStackInstanceSummariesByOrgIDs(ctx, conn, stackSetName, region, callAs, orgIDs)
+
+		if err != nil {
+			return err
+		}
+
+		v = output
+
+		return nil
+	}
+}
+
+// testAccCheckStackSetInstanceForOrganizationalUnitDestroy is a variant of the
+// standard CheckDestroyFunc which expects the resource ID to contain organizational
+// unit IDs rather than an account ID
+func testAccCheckStackSetInstanceForOrganizationalUnitDestroy(ctx context.Context) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		conn := acctest.Provider.Meta().(*conns.AWSClient).CloudFormationConn(ctx)
+
+		for _, rs := range s.RootModule().Resources {
+			if rs.Type != "aws_cloudformation_stack_set_instance" {
+				continue
+			}
+
+			callAs := rs.Primary.Attributes["call_as"]
+
+			stackSetName, accountOrOrgID, region, err := tfcloudformation.StackSetInstanceParseResourceID(rs.Primary.ID)
+			if err != nil {
+				return err
+			}
+			orgIDs := strings.Split(accountOrOrgID, "/")
+
+			output, err := tfcloudformation.FindStackInstanceSummariesByOrgIDs(ctx, conn, stackSetName, region, callAs, orgIDs)
+
+			if tfresource.NotFound(err) {
+				continue
+			}
+			if len(output) == 0 {
+				continue
+			}
+
+			if err != nil {
+				return err
+			}
+
+			return fmt.Errorf("CloudFormation StackSet Instance %s still exists", rs.Primary.ID)
+		}
+
+		return nil
+	}
+}
+
 func testAccCheckStackSetInstanceStackExists(ctx context.Context, stackInstance *cloudformation.StackInstance, v *cloudformation.Stack) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		conn := acctest.Provider.Meta().(*conns.AWSClient).CloudFormationConn(ctx)
 
-		output, err := tfcloudformation.FindStackByID(ctx, conn, aws.StringValue(stackInstance.StackId))
+		output, err := tfcloudformation.FindStackByName(ctx, conn, aws.StringValue(stackInstance.StackId))
 
 		if err != nil {
 			return err
@@ -715,14 +849,23 @@ resource "aws_cloudformation_stack_set_instance" "test" {
 `)
 }
 
-func testAccStackSetInstanceConfig_serviceManaged(rName string) string {
-	return acctest.ConfigCompose(testAccStackSetInstanceBaseConfig_ServiceManagedStackSet(rName), `
+func testAccStackSetInstanceConfig_DeploymentTargets_emptyOU(rName string) string {
+	return acctest.ConfigCompose(testAccStackSetInstanceBaseConfig_ServiceManagedStackSet(rName), fmt.Sprintf(`
+resource "aws_organizations_organizational_unit" "test" {
+  name      = %[1]q
+  parent_id = data.aws_organizations_organization.test.roots[0].id
+}
+
 resource "aws_cloudformation_stack_set_instance" "test" {
   depends_on = [aws_iam_role_policy.Administration, aws_iam_role_policy.Execution]
 
+  deployment_targets {
+    organizational_unit_ids = [aws_organizations_organizational_unit.test.id]
+  }
+
   stack_set_name = aws_cloudformation_stack_set.test.name
 }
-`)
+`, rName))
 }
 
 func testAccStackSetInstanceConfig_operationPreferences(rName string) string {
diff --git a/internal/service/cloudformation/stack_set_test.go b/internal/service/cloudformation/stack_set_test.go
index 62f4b1fc627..c1f57a6ea09 100644
--- a/internal/service/cloudformation/stack_set_test.go
+++ b/internal/service/cloudformation/stack_set_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudformation_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/cloudformation"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -36,7 +39,7 @@ func TestAccCloudFormationStackSet_basic(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckStackSetExists(ctx, resourceName, &stackSet1),
 					resource.TestCheckResourceAttrPair(resourceName, "administration_role_arn", iamRoleResourceName, "arn"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "cloudformation", regexp.MustCompile(`stackset/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "cloudformation", regexache.MustCompile(`stackset/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "capabilities.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "call_as", "SELF"),
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
@@ -47,7 +50,7 @@ func TestAccCloudFormationStackSet_basic(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "operation_preferences.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "parameters.%", "0"),
 					resource.TestCheckResourceAttr(resourceName, "permission_model", "SELF_MANAGED"),
-					resource.TestMatchResourceAttr(resourceName, "stack_set_id", regexp.MustCompile(fmt.Sprintf("%s:.+", rName))),
+					resource.TestMatchResourceAttr(resourceName, "stack_set_id", regexache.MustCompile(fmt.Sprintf("%s:.+", rName))),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 					resource.TestCheckResourceAttr(resourceName, "template_body", testAccStackSetTemplateBodyVPC(rName)+"\n"),
 					resource.TestCheckNoResourceAttr(resourceName, "template_url"),
@@ -62,6 +65,16 @@ func TestAccCloudFormationStackSet_basic(t *testing.T) {
 					"template_url",
 				},
 			},
+			// Test import with call_as.
+			{
+				ResourceName:      resourceName,
+				ImportStateId:     fmt.Sprintf("%s,SELF", rName),
+				ImportState:       true,
+				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{
+					"template_url",
+				},
+			},
 		},
 	})
 }
@@ -260,19 +273,19 @@ func TestAccCloudFormationStackSet_name(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccStackSetConfig_name(""),
-				ExpectError: regexp.MustCompile(`expected length`),
+				ExpectError: regexache.MustCompile(`expected length`),
 			},
 			{
 				Config:      testAccStackSetConfig_name(sdkacctest.RandStringFromCharSet(129, sdkacctest.CharSetAlpha)),
-				ExpectError: regexp.MustCompile(`(cannot be longer|expected length)`),
+				ExpectError: regexache.MustCompile(`(cannot be longer|expected length)`),
 			},
 			{
 				Config:      testAccStackSetConfig_name("1"),
-				ExpectError: regexp.MustCompile(`must begin with alphabetic character`),
+				ExpectError: regexache.MustCompile(`must begin with alphabetic character`),
 			},
 			{
 				Config:      testAccStackSetConfig_name("a_b"),
-				ExpectError: regexp.MustCompile(`must contain only alphanumeric and hyphen characters`),
+				ExpectError: regexache.MustCompile(`must contain only alphanumeric and hyphen characters`),
 			},
 			{
 				Config: testAccStackSetConfig_name(rName1),
@@ -580,12 +593,12 @@ func TestAccCloudFormationStackSet_PermissionModel_serviceManaged(t *testing.T)
 				Config: testAccStackSetConfig_permissionModel(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckStackSetExists(ctx, resourceName, &stackSet1),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "cloudformation", regexp.MustCompile(`stackset/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "cloudformation", regexache.MustCompile(`stackset/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "permission_model", "SERVICE_MANAGED"),
 					resource.TestCheckResourceAttr(resourceName, "auto_deployment.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "auto_deployment.0.enabled", "true"),
 					resource.TestCheckResourceAttr(resourceName, "auto_deployment.0.retain_stacks_on_account_removal", "false"),
-					resource.TestMatchResourceAttr(resourceName, "stack_set_id", regexp.MustCompile(fmt.Sprintf("%s:.+", rName))),
+					resource.TestMatchResourceAttr(resourceName, "stack_set_id", regexache.MustCompile(fmt.Sprintf("%s:.+", rName))),
 				),
 			},
 			{
@@ -734,6 +747,84 @@ func TestAccCloudFormationStackSet_templateURL(t *testing.T) {
 	})
 }
 
+// https://github.com/hashicorp/terraform-provider-aws/issues/19015.
+func TestAccCloudFormationStackSet_autoDeploymentEnabled(t *testing.T) {
+	ctx := acctest.Context(t)
+	var stackSet cloudformation.StackSet
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_cloudformation_stack_set.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			testAccPreCheckStackSet(ctx, t)
+			acctest.PreCheckOrganizationManagementAccount(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, cloudformation.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckStackSetDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccStackSetConfig_autoDeployment(rName, true, false),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckStackSetExists(ctx, resourceName, &stackSet),
+					resource.TestCheckResourceAttr(resourceName, "auto_deployment.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "auto_deployment.0.enabled", "true"),
+					resource.TestCheckResourceAttr(resourceName, "auto_deployment.0.retain_stacks_on_account_removal", "false"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{
+					"call_as",
+					"template_url",
+				},
+			},
+		},
+	})
+}
+
+// https://github.com/hashicorp/terraform-provider-aws/issues/19015.
+func TestAccCloudFormationStackSet_autoDeploymentDisabled(t *testing.T) {
+	ctx := acctest.Context(t)
+	var stackSet cloudformation.StackSet
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_cloudformation_stack_set.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			testAccPreCheckStackSet(ctx, t)
+			acctest.PreCheckOrganizationManagementAccount(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, cloudformation.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckStackSetDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccStackSetConfig_autoDeployment(rName, false, false),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckStackSetExists(ctx, resourceName, &stackSet),
+					resource.TestCheckResourceAttr(resourceName, "auto_deployment.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "auto_deployment.0.enabled", "false"),
+					resource.TestCheckResourceAttr(resourceName, "auto_deployment.0.retain_stacks_on_account_removal", "false"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{
+					"call_as",
+					"template_url",
+				},
+			},
+		},
+	})
+}
+
 func testAccCheckStackSetExists(ctx context.Context, resourceName string, v *cloudformation.StackSet) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		rs, ok := s.RootModule().Resources[resourceName]
@@ -741,11 +832,9 @@ func testAccCheckStackSetExists(ctx context.Context, resourceName string, v *clo
 			return fmt.Errorf("Not found: %s", resourceName)
 		}
 
-		callAs := rs.Primary.Attributes["call_as"]
-
 		conn := acctest.Provider.Meta().(*conns.AWSClient).CloudFormationConn(ctx)
 
-		output, err := tfcloudformation.FindStackSetByName(ctx, conn, rs.Primary.ID, callAs)
+		output, err := tfcloudformation.FindStackSetByName(ctx, conn, rs.Primary.ID, rs.Primary.Attributes["call_as"])
 
 		if err != nil {
 			return err
@@ -766,9 +855,7 @@ func testAccCheckStackSetDestroy(ctx context.Context) resource.TestCheckFunc {
 				continue
 			}
 
-			callAs := rs.Primary.Attributes["call_as"]
-
-			_, err := tfcloudformation.FindStackSetByName(ctx, conn, rs.Primary.ID, callAs)
+			_, err := tfcloudformation.FindStackSetByName(ctx, conn, rs.Primary.ID, rs.Primary.Attributes["call_as"])
 
 			if tfresource.NotFound(err) {
 				continue
@@ -1313,3 +1400,21 @@ TEMPLATE
 }
 `, rName, failureTolerancePercentage, maxConcurrentPercentage, testAccStackSetTemplateBodyVPC(rName)))
 }
+
+func testAccStackSetConfig_autoDeployment(rName string, enabled, retainStacksOnAccountRemoval bool) string {
+	return fmt.Sprintf(`
+resource "aws_cloudformation_stack_set" "test" {
+  name             = %[1]q
+  permission_model = "SERVICE_MANAGED"
+
+  auto_deployment {
+    enabled                          = %[3]t
+    retain_stacks_on_account_removal = %[4]t
+  }
+
+  template_body = <<TEMPLATE
+%[2]s
+TEMPLATE
+}
+`, rName, testAccStackSetTemplateBodyVPC(rName), enabled, retainStacksOnAccountRemoval)
+}
diff --git a/internal/service/cloudformation/stack_test.go b/internal/service/cloudformation/stack_test.go
index 1b20ee53c2a..17e88b368cf 100644
--- a/internal/service/cloudformation/stack_test.go
+++ b/internal/service/cloudformation/stack_test.go
@@ -1,19 +1,24 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudformation_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/aws"
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/cloudformation"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/plancheck"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/tfjsonpath"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	tfcloudformation "github.com/hashicorp/terraform-provider-aws/internal/service/cloudformation"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
 func TestAccCloudFormationStack_basic(t *testing.T) {
@@ -30,10 +35,15 @@ func TestAccCloudFormationStack_basic(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config: testAccStackConfig_basic(rName),
-				Check: resource.ComposeTestCheckFunc(
+				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckStackExists(ctx, resourceName, &stack),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckNoResourceAttr(resourceName, "on_failure"),
+					resource.TestCheckResourceAttr(resourceName, "outputs.%", "2"),
+					resource.TestCheckResourceAttrSet(resourceName, "outputs.DefaultSgId"),
+					resource.TestCheckResourceAttrSet(resourceName, "outputs.VpcID"),
+					resource.TestCheckResourceAttr(resourceName, "parameters.%", "0"),
+					resource.TestCheckNoResourceAttr(resourceName, "template_url"),
 				),
 			},
 			{
@@ -41,6 +51,10 @@ func TestAccCloudFormationStack_basic(t *testing.T) {
 				ImportState:       true,
 				ImportStateVerify: true,
 			},
+			{
+				Config:   testAccStackConfig_basic(rName),
+				PlanOnly: true,
+			},
 		},
 	})
 }
@@ -57,7 +71,7 @@ func TestAccCloudFormationStack_CreationFailure_doNothing(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccStackConfig_creationFailure(rName, cloudformation.OnFailureDoNothing),
-				ExpectError: regexp.MustCompile(`failed to create CloudFormation stack \(CREATE_FAILED\).*The following resource\(s\) failed to create.*This is not a valid CIDR block`),
+				ExpectError: regexache.MustCompile(`failed to create CloudFormation stack \(CREATE_FAILED\).*The following resource\(s\) failed to create.*This is not a valid CIDR block`),
 			},
 		},
 	})
@@ -75,7 +89,7 @@ func TestAccCloudFormationStack_CreationFailure_delete(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccStackConfig_creationFailure(rName, cloudformation.OnFailureDelete),
-				ExpectError: regexp.MustCompile(`failed to create CloudFormation stack, delete requested \(DELETE_COMPLETE\).*The following resource\(s\) failed to create.*This is not a valid CIDR block`),
+				ExpectError: regexache.MustCompile(`failed to create CloudFormation stack, delete requested \(DELETE_COMPLETE\).*The following resource\(s\) failed to create.*This is not a valid CIDR block`),
 			},
 		},
 	})
@@ -93,7 +107,7 @@ func TestAccCloudFormationStack_CreationFailure_rollback(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccStackConfig_creationFailure(rName, cloudformation.OnFailureRollback),
-				ExpectError: regexp.MustCompile(`failed to create CloudFormation stack, rollback requested \(ROLLBACK_COMPLETE\).*The following resource\(s\) failed to create.*This is not a valid CIDR block`),
+				ExpectError: regexache.MustCompile(`failed to create CloudFormation stack, rollback requested \(ROLLBACK_COMPLETE\).*The following resource\(s\) failed to create.*This is not a valid CIDR block`),
 			},
 		},
 	})
@@ -116,13 +130,13 @@ func TestAccCloudFormationStack_updateFailure(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config: testAccStackConfig_params(rName, vpcCidrInitial),
-				Check: resource.ComposeTestCheckFunc(
+				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckStackExists(ctx, resourceName, &stack),
 				),
 			},
 			{
 				Config:      testAccStackConfig_params(rName, vpcCidrInvalid),
-				ExpectError: regexp.MustCompile(`failed to update CloudFormation stack \(UPDATE_ROLLBACK_COMPLETE\).*This is not a valid CIDR block`),
+				ExpectError: regexache.MustCompile(`failed to update CloudFormation stack \(UPDATE_ROLLBACK_COMPLETE\).*This is not a valid CIDR block`),
 			},
 		},
 	})
@@ -142,7 +156,7 @@ func TestAccCloudFormationStack_disappears(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config: testAccStackConfig_basic(rName),
-				Check: resource.ComposeTestCheckFunc(
+				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckStackExists(ctx, resourceName, &stack),
 					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfcloudformation.ResourceStack(), resourceName),
 				),
@@ -166,7 +180,7 @@ func TestAccCloudFormationStack_yaml(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config: testAccStackConfig_yaml(rName),
-				Check: resource.ComposeTestCheckFunc(
+				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckStackExists(ctx, resourceName, &stack),
 				),
 			},
@@ -193,7 +207,7 @@ func TestAccCloudFormationStack_defaultParams(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config: testAccStackConfig_defaultParams(rName),
-				Check: resource.ComposeTestCheckFunc(
+				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckStackExists(ctx, resourceName, &stack),
 				),
 			},
@@ -222,7 +236,7 @@ func TestAccCloudFormationStack_allAttributes(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config: testAccStackConfig_allAttributesBodies(rName),
-				Check: resource.ComposeTestCheckFunc(
+				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckStackExists(ctx, resourceName, &stack),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "capabilities.#", "1"),
@@ -246,7 +260,7 @@ func TestAccCloudFormationStack_allAttributes(t *testing.T) {
 			},
 			{
 				Config: testAccStackConfig_allAttributesBodiesModified(rName),
-				Check: resource.ComposeTestCheckFunc(
+				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckStackExists(ctx, resourceName, &stack),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "capabilities.#", "1"),
@@ -284,10 +298,11 @@ func TestAccCloudFormationStack_withParams(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config: testAccStackConfig_params(rName, vpcCidrInitial),
-				Check: resource.ComposeTestCheckFunc(
+				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckStackExists(ctx, resourceName, &stack),
 					resource.TestCheckResourceAttr(resourceName, "parameters.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "parameters.VpcCIDR", vpcCidrInitial),
+					resource.TestCheckResourceAttr(resourceName, "outputs.%", "0"),
 				),
 			},
 			{
@@ -298,10 +313,11 @@ func TestAccCloudFormationStack_withParams(t *testing.T) {
 			},
 			{
 				Config: testAccStackConfig_params(rName, vpcCidrUpdated),
-				Check: resource.ComposeTestCheckFunc(
+				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckStackExists(ctx, resourceName, &stack),
 					resource.TestCheckResourceAttr(resourceName, "parameters.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "parameters.VpcCIDR", vpcCidrUpdated),
+					resource.TestCheckResourceAttr(resourceName, "outputs.%", "0"),
 				),
 			},
 		},
@@ -323,7 +339,7 @@ func TestAccCloudFormationStack_WithURL_withParams(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config: testAccStackConfig_templateURLParams(rName, "tf-cf-stack.json", "11.0.0.0/16"),
-				Check: resource.ComposeTestCheckFunc(
+				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckStackExists(ctx, resourceName, &stack),
 				),
 			},
@@ -335,7 +351,7 @@ func TestAccCloudFormationStack_WithURL_withParams(t *testing.T) {
 			},
 			{
 				Config: testAccStackConfig_templateURLParams(rName, "tf-cf-stack.json", "13.0.0.0/16"),
-				Check: resource.ComposeTestCheckFunc(
+				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckStackExists(ctx, resourceName, &stack),
 				),
 			},
@@ -357,7 +373,7 @@ func TestAccCloudFormationStack_WithURLWithParams_withYAML(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config: testAccStackConfig_templateURLParamsYAML(rName, "tf-cf-stack.test", "13.0.0.0/16"),
-				Check: resource.ComposeTestCheckFunc(
+				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckStackExists(ctx, resourceName, &stack),
 				),
 			},
@@ -386,7 +402,7 @@ func TestAccCloudFormationStack_WithURLWithParams_noUpdate(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config: testAccStackConfig_templateURLParams(rName, "tf-cf-stack-1.json", "11.0.0.0/16"),
-				Check: resource.ComposeTestCheckFunc(
+				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckStackExists(ctx, resourceName, &stack),
 				),
 			},
@@ -398,7 +414,7 @@ func TestAccCloudFormationStack_WithURLWithParams_noUpdate(t *testing.T) {
 			},
 			{
 				Config: testAccStackConfig_templateURLParams(rName, "tf-cf-stack-2.json", "11.0.0.0/16"),
-				Check: resource.ComposeTestCheckFunc(
+				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckStackExists(ctx, resourceName, &stack),
 				),
 			},
@@ -420,14 +436,14 @@ func TestAccCloudFormationStack_withTransform(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config: testAccStackConfig_transform(rName),
-				Check: resource.ComposeTestCheckFunc(
+				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckStackExists(ctx, resourceName, &stack),
 				),
 			},
 			{
 				PlanOnly: true,
 				Config:   testAccStackConfig_transform(rName),
-				Check: resource.ComposeTestCheckFunc(
+				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckStackExists(ctx, resourceName, &stack),
 				),
 			},
@@ -450,7 +466,7 @@ func TestAccCloudFormationStack_onFailure(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config: testAccStackConfig_onFailure(rName),
-				Check: resource.ComposeTestCheckFunc(
+				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckStackExists(ctx, resourceName, &stack),
 					resource.TestCheckResourceAttr(resourceName, "disable_rollback", "false"),
 					resource.TestCheckResourceAttr(resourceName, "on_failure", cloudformation.OnFailureDoNothing),
@@ -460,7 +476,102 @@ func TestAccCloudFormationStack_onFailure(t *testing.T) {
 	})
 }
 
-func testAccCheckStackExists(ctx context.Context, n string, stack *cloudformation.Stack) resource.TestCheckFunc {
+func TestAccCloudFormationStack_outputsUpdated(t *testing.T) {
+	ctx := acctest.Context(t)
+	var stack cloudformation.Stack
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_cloudformation_stack.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, cloudformation.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckStackDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccStackConfig_parametersAndOutputs(rName, "in1"),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckStackExists(ctx, resourceName, &stack),
+					resource.TestCheckResourceAttr(resourceName, "parameters.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "parameters.DataIn", "in1"),
+					resource.TestCheckResourceAttr(resourceName, "outputs.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "outputs.DataOut", "pre-in1-post"),
+					resource.TestCheckOutput("stack_DataOut", "pre-in1-post"),
+				),
+			},
+			{
+				Config: testAccStackConfig_parametersAndOutputs(rName, "in2"),
+				ConfigPlanChecks: resource.ConfigPlanChecks{
+					PreApply: []plancheck.PlanCheck{
+						plancheck.ExpectResourceAction(resourceName, plancheck.ResourceActionUpdate),
+						plancheck.ExpectUnknownValue(resourceName, tfjsonpath.New("outputs")),
+					},
+				},
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckStackExists(ctx, resourceName, &stack),
+					resource.TestCheckResourceAttr(resourceName, "parameters.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "parameters.DataIn", "in2"),
+					resource.TestCheckResourceAttr(resourceName, "outputs.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "outputs.DataOut", "pre-in2-post"),
+					resource.TestCheckOutput("stack_DataOut", "pre-in2-post"),
+				),
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"parameters"},
+			},
+		},
+	})
+}
+
+func TestAccCloudFormationStack_templateUpdate(t *testing.T) {
+	ctx := acctest.Context(t)
+	var stack cloudformation.Stack
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_cloudformation_stack.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, cloudformation.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckStackDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccStackConfig_templateUpdate(rName, "out1", "value1"),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckStackExists(ctx, resourceName, &stack),
+					resource.TestCheckResourceAttr(resourceName, "outputs.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "outputs.out1", "value1"),
+					resource.TestCheckOutput("stack_output", "out1:value1"),
+				),
+			},
+			{
+				Config: testAccStackConfig_templateUpdate(rName, "out2", "value2"),
+				ConfigPlanChecks: resource.ConfigPlanChecks{
+					PreApply: []plancheck.PlanCheck{
+						plancheck.ExpectResourceAction(resourceName, plancheck.ResourceActionUpdate),
+						plancheck.ExpectUnknownValue(resourceName, tfjsonpath.New("outputs")),
+					},
+				},
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckStackExists(ctx, resourceName, &stack),
+					resource.TestCheckResourceAttr(resourceName, "outputs.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "outputs.out2", "value2"),
+					resource.TestCheckOutput("stack_output", "out2:value2"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
+func testAccCheckStackExists(ctx context.Context, n string, v *cloudformation.Stack) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		rs, ok := s.RootModule().Resources[n]
 		if !ok {
@@ -468,18 +579,14 @@ func testAccCheckStackExists(ctx context.Context, n string, stack *cloudformatio
 		}
 
 		conn := acctest.Provider.Meta().(*conns.AWSClient).CloudFormationConn(ctx)
-		params := &cloudformation.DescribeStacksInput{
-			StackName: aws.String(rs.Primary.ID),
-		}
-		resp, err := conn.DescribeStacksWithContext(ctx, params)
+
+		output, err := tfcloudformation.FindStackByName(ctx, conn, rs.Primary.ID)
+
 		if err != nil {
 			return err
 		}
-		if len(resp.Stacks) == 0 || resp.Stacks[0] == nil {
-			return fmt.Errorf("CloudFormation stack not found")
-		}
 
-		*stack = *resp.Stacks[0]
+		*v = *output
 
 		return nil
 	}
@@ -494,21 +601,17 @@ func testAccCheckStackDestroy(ctx context.Context) resource.TestCheckFunc {
 				continue
 			}
 
-			params := cloudformation.DescribeStacksInput{
-				StackName: aws.String(rs.Primary.ID),
-			}
+			_, err := tfcloudformation.FindStackByName(ctx, conn, rs.Primary.ID)
 
-			resp, err := conn.DescribeStacksWithContext(ctx, &params)
+			if tfresource.NotFound(err) {
+				continue
+			}
 
 			if err != nil {
 				return err
 			}
 
-			for _, s := range resp.Stacks {
-				if aws.StringValue(s.StackId) == rs.Primary.ID && aws.StringValue(s.StackStatus) != cloudformation.StackStatusDeleteComplete {
-					return fmt.Errorf("CloudFormation stack still exists: %q", rs.Primary.ID)
-				}
-			}
+			return fmt.Errorf("CloudFormation Stack %s still exists", rs.Primary.ID)
 		}
 
 		return nil
@@ -843,7 +946,7 @@ STACK
 `, rName, cidr)
 }
 
-func testAccStackConfig_templateURLParams(rName, bucketKey, vpcCidr string) string {
+func testAccStackConfig_baseTemplateURL(rName string) string {
 	return fmt.Sprintf(`
 data "aws_partition" "current" {}
 
@@ -853,12 +956,33 @@ resource "aws_s3_bucket" "b" {
   bucket = %[1]q
 }
 
-resource "aws_s3_bucket_acl" "b" {
+resource "aws_s3_bucket_public_access_block" "b" {
+  bucket = aws_s3_bucket.b.id
+
+  block_public_acls       = false
+  block_public_policy     = false
+  ignore_public_acls      = false
+  restrict_public_buckets = false
+}
+
+resource "aws_s3_bucket_ownership_controls" "b" {
   bucket = aws_s3_bucket.b.id
+  rule {
+    object_ownership = "BucketOwnerPreferred"
+  }
+}
+
+resource "aws_s3_bucket_acl" "b" {
+  bucket = aws_s3_bucket_policy.b.bucket
   acl    = "public-read"
 }
 
-resource "aws_s3_bucket_policy" "test" {
+resource "aws_s3_bucket_policy" "b" {
+  depends_on = [
+    aws_s3_bucket_public_access_block.b,
+    aws_s3_bucket_ownership_controls.b,
+  ]
+
   bucket = aws_s3_bucket.b.id
   policy = <<POLICY
 {
@@ -878,8 +1002,8 @@ resource "aws_s3_bucket_policy" "test" {
 POLICY
 }
 
-resource "aws_s3_bucket_website_configuration" "test" {
-  bucket = aws_s3_bucket.b.id
+resource "aws_s3_bucket_website_configuration" "b" {
+  bucket = aws_s3_bucket_acl.b.bucket
   index_document {
     suffix = "index.html"
   }
@@ -887,9 +1011,13 @@ resource "aws_s3_bucket_website_configuration" "test" {
     key = "error.html"
   }
 }
+`, rName)
+}
 
+func testAccStackConfig_templateURLParams(rName, bucketKey, vpcCidr string) string {
+	return acctest.ConfigCompose(testAccStackConfig_baseTemplateURL(rName), fmt.Sprintf(`
 resource "aws_s3_object" "object" {
-  bucket = aws_s3_bucket.b.id
+  bucket = aws_s3_bucket_acl.b.bucket
   key    = %[2]q
   source = "test-fixtures/cloudformation-template.json"
 }
@@ -905,56 +1033,13 @@ resource "aws_cloudformation_stack" "test" {
   on_failure         = "DELETE"
   timeout_in_minutes = 1
 }
-`, rName, bucketKey, vpcCidr)
+`, rName, bucketKey, vpcCidr))
 }
 
 func testAccStackConfig_templateURLParamsYAML(rName, bucketKey, vpcCidr string) string {
-	return fmt.Sprintf(`
-data "aws_partition" "current" {}
-
-data "aws_region" "current" {}
-
-resource "aws_s3_bucket" "b" {
-  bucket = %[1]q
-}
-
-resource "aws_s3_bucket_acl" "b" {
-  bucket = aws_s3_bucket.b.id
-  acl    = "public-read"
-}
-
-resource "aws_s3_bucket_policy" "test" {
-  bucket = aws_s3_bucket.b.id
-  policy = <<POLICY
-{
-  "Version":"2008-10-17",
-  "Statement": [
-    {
-      "Sid":"AllowPublicRead",
-      "Effect":"Allow",
-      "Principal": {
-        "AWS": "*"
-      },
-      "Action": "s3:GetObject",
-      "Resource": "arn:${data.aws_partition.current.partition}:s3:::%[1]s/*"
-    }
-  ]
-}
-POLICY
-}
-
-resource "aws_s3_bucket_website_configuration" "test" {
-  bucket = aws_s3_bucket.b.id
-  index_document {
-    suffix = "index.html"
-  }
-  error_document {
-    key = "error.html"
-  }
-}
-
+	return acctest.ConfigCompose(testAccStackConfig_baseTemplateURL(rName), fmt.Sprintf(`
 resource "aws_s3_object" "object" {
-  bucket = aws_s3_bucket.b.id
+  bucket = aws_s3_bucket_acl.b.bucket
   key    = %[2]q
   source = "test-fixtures/cloudformation-template.yaml"
 }
@@ -970,7 +1055,7 @@ resource "aws_cloudformation_stack" "test" {
   on_failure         = "DELETE"
   timeout_in_minutes = 1
 }
-`, rName, bucketKey, vpcCidr)
+`, rName, bucketKey, vpcCidr))
 }
 
 func testAccStackConfig_transform(rName string) string {
@@ -1051,3 +1136,99 @@ resource "aws_cloudformation_stack" "test" {
 }
 `, rName)
 }
+
+func testAccStackConfig_parametersAndOutputs(rName, dataIn string) string {
+	return fmt.Sprintf(`
+resource "aws_cloudformation_stack" "test" {
+  name = %[1]q
+
+  template_body = <<STACK
+  {
+    "AWSTemplateFormatVersion": "2010-09-09",
+    "Description": "AWS CloudFormation template that a transformed copy of its input parameter",
+    "Parameters": {
+      "DataIn": {
+        "Type": "String",
+        "Description": "Input data"
+      }
+    },
+    "Resources": {
+      "NullResource": {
+        "Type": "AWS::CloudFormation::WaitConditionHandle"
+      }
+    },
+    "Outputs": {
+      "DataOut": {
+        "Description": "Output data",
+        "Value": {
+          "Fn::Join": [
+            "",
+            [
+              "pre-",
+              {
+                "Ref": "DataIn"
+              },
+              "-post"
+            ]
+          ]
+        }
+      }
+    }
+}
+STACK
+
+  parameters = {
+    DataIn = %[2]q
+  }
+}
+
+output "stack_DataOut" {
+  value = aws_cloudformation_stack.test.outputs["DataOut"]
+}
+`, rName, dataIn)
+}
+
+func testAccStackConfig_templateUpdate(rName, name, value string) string {
+	return fmt.Sprintf(`
+resource "aws_cloudformation_stack" "test" {
+  name = %[1]q
+
+  template_body = jsonencode(
+    merge(
+      jsondecode(local.template),
+      { "Outputs" = local.outputs },
+    )
+  )
+}
+
+locals {
+  template = <<STACK
+{
+  "AWSTemplateFormatVersion": "2010-09-09",
+  "Description": "AWS CloudFormation template that returns a constant value",
+  "Conditions": {
+	  "NeverTrue": {"Fn::Equals": ["true","false"]}
+  },
+  "Resources": {
+	  "nullRes": {
+		  "Type": "Custom::NullResource",
+		  "Condition": "NeverTrue",
+		  "Properties": {
+			  "ServiceToken": ""
+		  }
+	  }
+  }
+}
+STACK
+  outputs = {
+    %[2]s = {
+      Value = %[3]q
+    }
+  }
+}
+
+output "stack_output" {
+  value = format("%%s:%%s", %[2]q, aws_cloudformation_stack.test.outputs[%[2]q])
+}
+`, rName, name, value)
+}
diff --git a/internal/service/cloudformation/status.go b/internal/service/cloudformation/status.go
index ac23a617f5d..0a3c457c486 100644
--- a/internal/service/cloudformation/status.go
+++ b/internal/service/cloudformation/status.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudformation
 
 import (
@@ -41,28 +44,6 @@ func StatusStackSetOperation(ctx context.Context, conn *cloudformation.CloudForm
 	}
 }
 
-const (
-	stackStatusError    = "Error"
-	stackStatusNotFound = "NotFound"
-)
-
-func StatusStack(ctx context.Context, conn *cloudformation.CloudFormation, stackName string) retry.StateRefreshFunc {
-	return func() (interface{}, string, error) {
-		resp, err := conn.DescribeStacksWithContext(ctx, &cloudformation.DescribeStacksInput{
-			StackName: aws.String(stackName),
-		})
-		if err != nil {
-			return nil, stackStatusError, err
-		}
-
-		if resp.Stacks == nil || len(resp.Stacks) == 0 {
-			return nil, stackStatusNotFound, nil
-		}
-
-		return resp.Stacks[0], aws.StringValue(resp.Stacks[0].StackStatus), err
-	}
-}
-
 func StatusTypeRegistrationProgress(ctx context.Context, conn *cloudformation.CloudFormation, registrationToken string) retry.StateRefreshFunc {
 	return func() (interface{}, string, error) {
 		output, err := FindTypeRegistrationByToken(ctx, conn, registrationToken)
diff --git a/internal/service/cloudformation/sweep.go b/internal/service/cloudformation/sweep.go
index e622c2c28a8..6bf777d64ba 100644
--- a/internal/service/cloudformation/sweep.go
+++ b/internal/service/cloudformation/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package cloudformation
 
@@ -10,11 +10,13 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/cloudformation"
 	"github.com/hashicorp/go-multierror"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_cloudformation_stack_set_instance", &resource.Sweeper{
 		Name: "aws_cloudformation_stack_set_instance",
 		F:    sweepStackSetInstances,
@@ -39,7 +41,7 @@ func init() {
 
 func sweepStackSetInstances(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -55,25 +57,35 @@ func sweepStackSetInstances(region string) error {
 			return !lastPage
 		}
 
-		for _, summary := range page.Summaries {
+		for _, v := range page.Summaries {
 			input := &cloudformation.ListStackInstancesInput{
-				StackSetName: summary.StackSetName,
+				StackSetName: v.StackSetName,
 			}
 
-			err = conn.ListStackInstancesPagesWithContext(ctx, input, func(page *cloudformation.ListStackInstancesOutput, lastPage bool) bool {
+			err := conn.ListStackInstancesPagesWithContext(ctx, input, func(page *cloudformation.ListStackInstancesOutput, lastPage bool) bool {
 				if page == nil {
 					return !lastPage
 				}
 
-				for _, summary := range page.Summaries {
+				for _, v := range page.Summaries {
+					ouID := aws.StringValue(v.OrganizationalUnitId)
+					accountOrOrgID := aws.StringValue(v.Account)
+					if ouID != "" {
+						accountOrOrgID = ouID
+					}
+
 					r := ResourceStackSetInstance()
 					d := r.Data(nil)
 					id := StackSetInstanceCreateResourceID(
-						aws.StringValue(summary.StackSetId),
-						aws.StringValue(summary.Account),
-						aws.StringValue(summary.Region),
+						aws.StringValue(v.StackSetId),
+						accountOrOrgID,
+						aws.StringValue(v.Region),
 					)
 					d.SetId(id)
+					d.Set("call_as", cloudformation.CallAsSelf)
+					if ouID != "" {
+						d.Set("deployment_targets", []interface{}{map[string]interface{}{"organizational_unit_ids": schema.NewSet(schema.HashString, []interface{}{ouID})}})
+					}
 
 					sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
 				}
@@ -81,7 +93,7 @@ func sweepStackSetInstances(region string) error {
 				return !lastPage
 			})
 
-			if sweep.SkipSweepError(err) {
+			if awsv1.SkipSweepError(err) {
 				continue
 			}
 
@@ -93,7 +105,7 @@ func sweepStackSetInstances(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping CloudFormation StackSet Instance sweep for %s: %s", region, err)
 		return nil
 	}
@@ -102,7 +114,7 @@ func sweepStackSetInstances(region string) error {
 		return fmt.Errorf("error listing CloudFormation StackSets (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error sweeping CloudFormation StackSet Instances (%s): %w", region, err))
@@ -113,7 +125,7 @@ func sweepStackSetInstances(region string) error {
 
 func sweepStackSets(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -128,10 +140,11 @@ func sweepStackSets(region string) error {
 			return !lastPage
 		}
 
-		for _, summary := range page.Summaries {
+		for _, v := range page.Summaries {
 			r := ResourceStackSet()
 			d := r.Data(nil)
-			d.SetId(aws.StringValue(summary.StackSetName))
+			d.SetId(aws.StringValue(v.StackSetName))
+			d.Set("call_as", cloudformation.CallAsSelf)
 
 			sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
 		}
@@ -139,7 +152,7 @@ func sweepStackSets(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping CloudFormation StackSet sweep for %s: %s", region, err)
 		return nil
 	}
@@ -148,7 +161,7 @@ func sweepStackSets(region string) error {
 		return fmt.Errorf("error listing CloudFormation StackSets (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping CloudFormation StackSets (%s): %w", region, err)
@@ -159,7 +172,7 @@ func sweepStackSets(region string) error {
 
 func sweepStacks(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
@@ -213,7 +226,7 @@ func sweepStacks(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping CloudFormation Stack sweep for %s: %s", region, err)
 		return nil
 	}
diff --git a/internal/service/cloudformation/test-fixtures/cloudformation-template.yaml b/internal/service/cloudformation/test-fixtures/cloudformation-template.yaml
index c84e3fcdd6b..717e8ce48c9 100644
--- a/internal/service/cloudformation/test-fixtures/cloudformation-template.yaml
+++ b/internal/service/cloudformation/test-fixtures/cloudformation-template.yaml
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 Parameters:
   VpcCIDR:
     Description: CIDR to be used for the VPC
diff --git a/internal/service/cloudformation/testdata/examplecompany-exampleservice-exampleresource/cmd/resource/resource.go b/internal/service/cloudformation/testdata/examplecompany-exampleservice-exampleresource/cmd/resource/resource.go
index 8a98effbe07..f0e512cae04 100644
--- a/internal/service/cloudformation/testdata/examplecompany-exampleservice-exampleresource/cmd/resource/resource.go
+++ b/internal/service/cloudformation/testdata/examplecompany-exampleservice-exampleresource/cmd/resource/resource.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package resource
 
 import (
diff --git a/internal/service/cloudformation/testdata/examplecompany-exampleservice-exampleresource/resource-role.yaml b/internal/service/cloudformation/testdata/examplecompany-exampleservice-exampleresource/resource-role.yaml
index f4726f6b780..0d8fb7da4d2 100644
--- a/internal/service/cloudformation/testdata/examplecompany-exampleservice-exampleresource/resource-role.yaml
+++ b/internal/service/cloudformation/testdata/examplecompany-exampleservice-exampleresource/resource-role.yaml
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 AWSTemplateFormatVersion: "2010-09-09"
 Description: >
   This CloudFormation template creates a role assumed by CloudFormation
diff --git a/internal/service/cloudformation/testdata/examplecompany-exampleservice-exampleresource/template.yml b/internal/service/cloudformation/testdata/examplecompany-exampleservice-exampleresource/template.yml
index 27db91b33c3..1b42556fa57 100644
--- a/internal/service/cloudformation/testdata/examplecompany-exampleservice-exampleresource/template.yml
+++ b/internal/service/cloudformation/testdata/examplecompany-exampleservice-exampleresource/template.yml
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 AWSTemplateFormatVersion: "2010-09-09"
 Transform: AWS::Serverless-2016-10-31
 Description: AWS SAM template for the ExampleCompany::ExampleService::ExampleResource resource type
diff --git a/internal/service/cloudformation/type.go b/internal/service/cloudformation/type.go
index 118166212a8..66f114b11ad 100644
--- a/internal/service/cloudformation/type.go
+++ b/internal/service/cloudformation/type.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudformation
 
 import (
 	"context"
 	"log"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/cloudformation"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -69,7 +72,7 @@ func ResourceType() *schema.Resource {
 							ForceNew: true,
 							ValidateFunc: validation.All(
 								validation.StringLenBetween(1, 512),
-								validation.StringMatch(regexp.MustCompile(`[\.\-_/#A-Za-z0-9]+`), "must contain only alphanumeric, period, hyphen, forward slash, and octothorp characters"),
+								validation.StringMatch(regexache.MustCompile(`[0-9A-Za-z_./#-]+`), "must contain only alphanumeric, period, hyphen, forward slash, and octothorp characters"),
 							),
 						},
 						"log_role_arn": {
@@ -97,7 +100,7 @@ func ResourceType() *schema.Resource {
 				Type:         schema.TypeString,
 				Required:     true,
 				ForceNew:     true,
-				ValidateFunc: validation.StringMatch(regexp.MustCompile(`^(https|s3)\:\/\/.+`), "must begin with s3:// or https://"),
+				ValidateFunc: validation.StringMatch(regexache.MustCompile(`^(https|s3)\:\/\/.+`), "must begin with s3:// or https://"),
 			},
 			"type": {
 				Type:         schema.TypeString,
@@ -116,7 +119,7 @@ func ResourceType() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(10, 204),
-					validation.StringMatch(regexp.MustCompile(`[A-Za-z0-9]{2,64}::[A-Za-z0-9]{2,64}::[A-Za-z0-9]{2,64}(::MODULE){0,1}`), "three alphanumeric character sections separated by double colons (::)"),
+					validation.StringMatch(regexache.MustCompile(`[0-9A-Za-z]{2,64}::[0-9A-Za-z]{2,64}::[0-9A-Za-z]{2,64}(::MODULE){0,1}`), "three alphanumeric character sections separated by double colons (::)"),
 				),
 			},
 			"version_id": {
diff --git a/internal/service/cloudformation/type_data_source.go b/internal/service/cloudformation/type_data_source.go
index db44f7ffcd3..76cb71ef4a2 100644
--- a/internal/service/cloudformation/type_data_source.go
+++ b/internal/service/cloudformation/type_data_source.go
@@ -1,9 +1,12 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudformation
 
 import (
 	"context"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/cloudformation"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
@@ -91,7 +94,7 @@ func DataSourceType() *schema.Resource {
 				Computed: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(10, 204),
-					validation.StringMatch(regexp.MustCompile(`[A-Za-z0-9]{2,64}::[A-Za-z0-9]{2,64}::[A-Za-z0-9]{2,64}(::MODULE){0,1}`), "three alphanumeric character sections separated by double colons (::)"),
+					validation.StringMatch(regexache.MustCompile(`[0-9A-Za-z]{2,64}::[0-9A-Za-z]{2,64}::[0-9A-Za-z]{2,64}(::MODULE){0,1}`), "three alphanumeric character sections separated by double colons (::)"),
 				),
 			},
 			"version_id": {
diff --git a/internal/service/cloudformation/type_data_source_test.go b/internal/service/cloudformation/type_data_source_test.go
index dba6de99e97..58a8ce4ac53 100644
--- a/internal/service/cloudformation/type_data_source_test.go
+++ b/internal/service/cloudformation/type_data_source_test.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudformation_test
 
 import (
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/cloudformation"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -62,13 +65,13 @@ func TestAccCloudFormationTypeDataSource_ARN_public(t *testing.T) {
 				Check: resource.ComposeAggregateTestCheckFunc(
 					acctest.CheckResourceAttrRegionalARNNoAccount(dataSourceName, "arn", "cloudformation", "type/resource/AWS-Athena-WorkGroup"),
 					resource.TestCheckResourceAttr(dataSourceName, "deprecated_status", cloudformation.DeprecatedStatusLive),
-					resource.TestMatchResourceAttr(dataSourceName, "description", regexp.MustCompile(`.*`)),
+					resource.TestMatchResourceAttr(dataSourceName, "description", regexache.MustCompile(`.*`)),
 					resource.TestCheckResourceAttr(dataSourceName, "documentation_url", ""),
 					resource.TestCheckResourceAttr(dataSourceName, "is_default_version", "true"),
 					resource.TestCheckResourceAttr(dataSourceName, "logging_config.#", "0"),
 					resource.TestCheckResourceAttr(dataSourceName, "provisioning_type", cloudformation.ProvisioningTypeFullyMutable),
-					resource.TestMatchResourceAttr(dataSourceName, "schema", regexp.MustCompile(`^\{.*`)),
-					resource.TestMatchResourceAttr(dataSourceName, "source_url", regexp.MustCompile(`^https://.+`)),
+					resource.TestMatchResourceAttr(dataSourceName, "schema", regexache.MustCompile(`^\{.*`)),
+					resource.TestMatchResourceAttr(dataSourceName, "source_url", regexache.MustCompile(`^https://.+`)),
 					resource.TestCheckResourceAttr(dataSourceName, "type", cloudformation.RegistryTypeResource),
 					resource.TestCheckResourceAttr(dataSourceName, "type_name", "AWS::Athena::WorkGroup"),
 					resource.TestCheckResourceAttr(dataSourceName, "visibility", cloudformation.VisibilityPublic),
@@ -129,13 +132,13 @@ func TestAccCloudFormationTypeDataSource_TypeName_public(t *testing.T) {
 				Check: resource.ComposeAggregateTestCheckFunc(
 					acctest.CheckResourceAttrRegionalARNNoAccount(dataSourceName, "arn", "cloudformation", "type/resource/AWS-Athena-WorkGroup"),
 					resource.TestCheckResourceAttr(dataSourceName, "deprecated_status", cloudformation.DeprecatedStatusLive),
-					resource.TestMatchResourceAttr(dataSourceName, "description", regexp.MustCompile(`.*`)),
+					resource.TestMatchResourceAttr(dataSourceName, "description", regexache.MustCompile(`.*`)),
 					resource.TestCheckResourceAttr(dataSourceName, "documentation_url", ""),
 					resource.TestCheckResourceAttr(dataSourceName, "is_default_version", "true"),
 					resource.TestCheckResourceAttr(dataSourceName, "logging_config.#", "0"),
 					resource.TestCheckResourceAttr(dataSourceName, "provisioning_type", cloudformation.ProvisioningTypeFullyMutable),
-					resource.TestMatchResourceAttr(dataSourceName, "schema", regexp.MustCompile(`^\{.*`)),
-					resource.TestMatchResourceAttr(dataSourceName, "source_url", regexp.MustCompile(`^https://.+`)),
+					resource.TestMatchResourceAttr(dataSourceName, "schema", regexache.MustCompile(`^\{.*`)),
+					resource.TestMatchResourceAttr(dataSourceName, "source_url", regexache.MustCompile(`^https://.+`)),
 					resource.TestCheckResourceAttr(dataSourceName, "type", cloudformation.RegistryTypeResource),
 					resource.TestCheckResourceAttr(dataSourceName, "type_name", "AWS::Athena::WorkGroup"),
 					resource.TestCheckResourceAttr(dataSourceName, "visibility", cloudformation.VisibilityPublic),
diff --git a/internal/service/cloudformation/type_test.go b/internal/service/cloudformation/type_test.go
index 73141d205cc..ac11a9c7d1b 100644
--- a/internal/service/cloudformation/type_test.go
+++ b/internal/service/cloudformation/type_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudformation_test
 
 import (
@@ -8,11 +11,11 @@ import (
 	"io"
 	"os"
 	"path/filepath"
-	"regexp"
 	"runtime"
 	"strings"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/cloudformation"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -40,7 +43,7 @@ func TestAccCloudFormationType_basic(t *testing.T) {
 				Config: testAccTypeConfig_name(rName, zipPath, typeName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckTypeExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "cloudformation", regexp.MustCompile(fmt.Sprintf("type/resource/%s/.+", strings.ReplaceAll(typeName, "::", "-")))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "cloudformation", regexache.MustCompile(fmt.Sprintf("type/resource/%s/.+", strings.ReplaceAll(typeName, "::", "-")))),
 					resource.TestCheckResourceAttr(resourceName, "default_version_id", ""),
 					resource.TestCheckResourceAttr(resourceName, "deprecated_status", cloudformation.DeprecatedStatusLive),
 					resource.TestCheckResourceAttr(resourceName, "description", "An example resource schema demonstrating some basic constructs and validation rules."),
@@ -49,13 +52,13 @@ func TestAccCloudFormationType_basic(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "logging_config.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "provisioning_type", cloudformation.ProvisioningTypeFullyMutable),
 					resource.TestCheckResourceAttr(resourceName, "schema_handler_package", fmt.Sprintf("s3://%s/test", rName)),
-					resource.TestMatchResourceAttr(resourceName, "schema", regexp.MustCompile(`^\{.*`)),
+					resource.TestMatchResourceAttr(resourceName, "schema", regexache.MustCompile(`^\{.*`)),
 					resource.TestCheckResourceAttr(resourceName, "source_url", "https://github.com/aws-cloudformation/aws-cloudformation-rpdk.git"),
 					resource.TestCheckResourceAttr(resourceName, "type", cloudformation.RegistryTypeResource),
 					acctest.CheckResourceAttrRegionalARN(resourceName, "type_arn", "cloudformation", fmt.Sprintf("type/resource/%s", strings.ReplaceAll(typeName, "::", "-"))),
 					resource.TestCheckResourceAttr(resourceName, "type_name", typeName),
 					resource.TestCheckResourceAttr(resourceName, "visibility", cloudformation.VisibilityPrivate),
-					resource.TestMatchResourceAttr(resourceName, "version_id", regexp.MustCompile(`.+`)),
+					resource.TestMatchResourceAttr(resourceName, "version_id", regexache.MustCompile(`.+`)),
 				),
 			},
 		},
diff --git a/internal/service/cloudformation/wait.go b/internal/service/cloudformation/wait.go
index 597e73190a8..8bbe7d22971 100644
--- a/internal/service/cloudformation/wait.go
+++ b/internal/service/cloudformation/wait.go
@@ -1,10 +1,12 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudformation
 
 import (
 	"context"
 	"errors"
 	"fmt"
-	"strings"
 	"time"
 
 	"github.com/aws/aws-sdk-go/aws"
@@ -39,15 +41,6 @@ func WaitChangeSetCreated(ctx context.Context, conn *cloudformation.CloudFormati
 }
 
 const (
-	// Default maximum amount of time to wait for a StackSetInstance to be Created
-	StackSetInstanceCreatedDefaultTimeout = 30 * time.Minute
-
-	// Default maximum amount of time to wait for a StackSetInstance to be Updated
-	StackSetInstanceUpdatedDefaultTimeout = 30 * time.Minute
-
-	// Default maximum amount of time to wait for a StackSetInstance to be Deleted
-	StackSetInstanceDeletedDefaultTimeout = 30 * time.Minute
-
 	stackSetOperationDelay = 5 * time.Second
 )
 
@@ -94,167 +87,6 @@ func WaitStackSetOperationSucceeded(ctx context.Context, conn *cloudformation.Cl
 	return nil, waitErr
 }
 
-const (
-	// Default maximum amount of time to wait for a Stack to be Created
-	StackCreatedDefaultTimeout = 30 * time.Minute
-
-	stackCreatedMinTimeout = 1 * time.Second
-
-	// Default maximum amount of time to wait for a Stack to be Updated
-	StackUpdatedDefaultTimeout = 30 * time.Minute
-
-	stackUpdatedMinTimeout = 5 * time.Second
-
-	// Default maximum amount of time to wait for a Stack to be Deleted
-	StackDeletedDefaultTimeout = 30 * time.Minute
-
-	stackDeletedMinTimeout = 5 * time.Second
-)
-
-func WaitStackCreated(ctx context.Context, conn *cloudformation.CloudFormation, stackID, requestToken string, timeout time.Duration) (*cloudformation.Stack, error) {
-	stateConf := retry.StateChangeConf{
-		Pending: []string{
-			cloudformation.StackStatusCreateInProgress,
-			cloudformation.StackStatusDeleteInProgress,
-			cloudformation.StackStatusRollbackInProgress,
-		},
-		Target: []string{
-			cloudformation.StackStatusCreateComplete,
-			cloudformation.StackStatusCreateFailed,
-			cloudformation.StackStatusDeleteComplete,
-			cloudformation.StackStatusDeleteFailed,
-			cloudformation.StackStatusRollbackComplete,
-			cloudformation.StackStatusRollbackFailed,
-		},
-		Timeout:    timeout,
-		MinTimeout: stackCreatedMinTimeout,
-		Delay:      10 * time.Second,
-		Refresh:    StatusStack(ctx, conn, stackID),
-	}
-
-	outputRaw, err := stateConf.WaitForStateContext(ctx)
-	if err != nil {
-		return nil, err
-	}
-
-	stack, ok := outputRaw.(*cloudformation.Stack)
-	if !ok {
-		return nil, err
-	}
-
-	lastStatus := aws.StringValue(stack.StackStatus)
-	switch lastStatus {
-	// This will be the case if either disable_rollback is false or on_failure is ROLLBACK
-	case cloudformation.StackStatusRollbackComplete, cloudformation.StackStatusRollbackFailed:
-		reasons, err := getRollbackReasons(ctx, conn, stackID, requestToken)
-		if err != nil {
-			return stack, fmt.Errorf("failed to create CloudFormation stack, rollback requested (%s). Got an error reading failure information: %w", lastStatus, err)
-		}
-		return stack, fmt.Errorf("failed to create CloudFormation stack, rollback requested (%s): %q", lastStatus, reasons)
-
-	// This will be the case if on_failure is DELETE
-	case cloudformation.StackStatusDeleteComplete, cloudformation.StackStatusDeleteFailed:
-		reasons, err := getDeletionReasons(ctx, conn, stackID, requestToken)
-		if err != nil {
-			return stack, fmt.Errorf("failed to create CloudFormation stack, delete requested (%s). Got an error reading failure information: %w", lastStatus, err)
-		}
-
-		return stack, fmt.Errorf("failed to create CloudFormation stack, delete requested (%s): %q", lastStatus, reasons)
-
-	// This will be the case if either disable_rollback is true or on_failure is DO_NOTHING
-	case cloudformation.StackStatusCreateFailed:
-		reasons, err := getFailures(ctx, conn, stackID, requestToken)
-		if err != nil {
-			return stack, fmt.Errorf("failed to create CloudFormation stack (%s). Got an error reading failure information: %w", lastStatus, err)
-		}
-		return stack, fmt.Errorf("failed to create CloudFormation stack (%s): %q", lastStatus, reasons)
-	}
-
-	return stack, nil
-}
-
-func WaitStackUpdated(ctx context.Context, conn *cloudformation.CloudFormation, stackID, requestToken string, timeout time.Duration) (*cloudformation.Stack, error) {
-	stateConf := retry.StateChangeConf{
-		Pending: []string{
-			cloudformation.StackStatusUpdateCompleteCleanupInProgress,
-			cloudformation.StackStatusUpdateInProgress,
-			cloudformation.StackStatusUpdateRollbackInProgress,
-			cloudformation.StackStatusUpdateRollbackCompleteCleanupInProgress,
-		},
-		Target: []string{
-			cloudformation.StackStatusCreateComplete,
-			cloudformation.StackStatusUpdateComplete,
-			cloudformation.StackStatusUpdateRollbackComplete,
-			cloudformation.StackStatusUpdateRollbackFailed,
-		},
-		Timeout:    timeout,
-		MinTimeout: stackUpdatedMinTimeout,
-		Delay:      10 * time.Second,
-		Refresh:    StatusStack(ctx, conn, stackID),
-	}
-
-	outputRaw, err := stateConf.WaitForStateContext(ctx)
-	if err != nil {
-		return nil, err
-	}
-
-	stack, ok := outputRaw.(*cloudformation.Stack)
-	if !ok {
-		return nil, err
-	}
-
-	lastStatus := aws.StringValue(stack.StackStatus)
-	if lastStatus == cloudformation.StackStatusUpdateRollbackComplete || lastStatus == cloudformation.StackStatusUpdateRollbackFailed {
-		reasons, err := getRollbackReasons(ctx, conn, stackID, requestToken)
-		if err != nil {
-			return stack, fmt.Errorf("failed to update CloudFormation stack (%s). Got an error reading failure information: %w", lastStatus, err)
-		}
-
-		return stack, fmt.Errorf("failed to update CloudFormation stack (%s): %q", lastStatus, reasons)
-	}
-
-	return stack, nil
-}
-
-func WaitStackDeleted(ctx context.Context, conn *cloudformation.CloudFormation, stackID, requestToken string, timeout time.Duration) (*cloudformation.Stack, error) {
-	stateConf := retry.StateChangeConf{
-		Pending: []string{
-			cloudformation.StackStatusDeleteInProgress,
-			cloudformation.StackStatusRollbackInProgress,
-		},
-		Target: []string{
-			cloudformation.StackStatusDeleteComplete,
-			cloudformation.StackStatusDeleteFailed,
-		},
-		Timeout:    timeout,
-		MinTimeout: stackDeletedMinTimeout,
-		Delay:      10 * time.Second,
-		Refresh:    StatusStack(ctx, conn, stackID),
-	}
-
-	outputRaw, err := stateConf.WaitForStateContext(ctx)
-	if err != nil {
-		return nil, err
-	}
-
-	stack, ok := outputRaw.(*cloudformation.Stack)
-	if !ok {
-		return nil, err
-	}
-
-	lastStatus := aws.StringValue(stack.StackStatus)
-	if lastStatus == cloudformation.StackStatusDeleteFailed {
-		reasons, err := getFailures(ctx, conn, stackID, requestToken)
-		if err != nil {
-			return stack, fmt.Errorf("failed to delete CloudFormation stack (%s). Got an error reading failure information: %w", lastStatus, err)
-		}
-
-		return stack, fmt.Errorf("failed to delete CloudFormation stack (%s): %q", lastStatus, reasons)
-	}
-
-	return stack, nil
-}
-
 const (
 	TypeRegistrationTimeout = 5 * time.Minute
 )
@@ -275,49 +107,3 @@ func WaitTypeRegistrationProgressStatusComplete(ctx context.Context, conn *cloud
 
 	return nil, err
 }
-
-func getDeletionReasons(ctx context.Context, conn *cloudformation.CloudFormation, stackID, requestToken string) ([]string, error) {
-	var failures []string
-
-	err := listStackEventsForOperation(ctx, conn, stackID, requestToken, func(e *cloudformation.StackEvent) {
-		if isFailedEvent(e) || isStackDeletionEvent(e) {
-			failures = append(failures, aws.StringValue(e.ResourceStatusReason))
-		}
-	})
-	return failures, err
-}
-
-func getRollbackReasons(ctx context.Context, conn *cloudformation.CloudFormation, stackID, requestToken string) ([]string, error) {
-	var failures []string
-	err := listStackEventsForOperation(ctx, conn, stackID, requestToken, func(e *cloudformation.StackEvent) {
-		if isFailedEvent(e) || isRollbackEvent(e) {
-			failures = append(failures, aws.StringValue(e.ResourceStatusReason))
-		}
-	})
-	return failures, err
-}
-
-func getFailures(ctx context.Context, conn *cloudformation.CloudFormation, stackID, requestToken string) ([]string, error) {
-	var failures []string
-
-	err := listStackEventsForOperation(ctx, conn, stackID, requestToken, func(e *cloudformation.StackEvent) {
-		if isFailedEvent(e) {
-			failures = append(failures, aws.StringValue(e.ResourceStatusReason))
-		}
-	})
-	return failures, err
-}
-
-func isFailedEvent(event *cloudformation.StackEvent) bool {
-	return strings.HasSuffix(aws.StringValue(event.ResourceStatus), "_FAILED") && event.ResourceStatusReason != nil
-}
-
-func isRollbackEvent(event *cloudformation.StackEvent) bool {
-	return strings.HasPrefix(aws.StringValue(event.ResourceStatus), "ROLLBACK_") && event.ResourceStatusReason != nil
-}
-
-func isStackDeletionEvent(event *cloudformation.StackEvent) bool {
-	return aws.StringValue(event.ResourceStatus) == cloudformation.ResourceStatusDeleteInProgress &&
-		aws.StringValue(event.ResourceType) == "AWS::CloudFormation::Stack" &&
-		event.ResourceStatusReason != nil
-}
diff --git a/internal/service/cloudfront/cache_policy.go b/internal/service/cloudfront/cache_policy.go
index 8ce4c7adaa4..e6d9c9d2995 100644
--- a/internal/service/cloudfront/cache_policy.go
+++ b/internal/service/cloudfront/cache_policy.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudfront
 
 import (
diff --git a/internal/service/cloudfront/cache_policy_data_source.go b/internal/service/cloudfront/cache_policy_data_source.go
index 64a09018690..100b9913e7a 100644
--- a/internal/service/cloudfront/cache_policy_data_source.go
+++ b/internal/service/cloudfront/cache_policy_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudfront
 
 import (
diff --git a/internal/service/cloudfront/cache_policy_data_source_test.go b/internal/service/cloudfront/cache_policy_data_source_test.go
index ef5ee39f7b8..cc43e5b118f 100644
--- a/internal/service/cloudfront/cache_policy_data_source_test.go
+++ b/internal/service/cloudfront/cache_policy_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudfront_test
 
 import (
diff --git a/internal/service/cloudfront/cache_policy_test.go b/internal/service/cloudfront/cache_policy_test.go
index aa0538b4bf0..2da5c089f80 100644
--- a/internal/service/cloudfront/cache_policy_test.go
+++ b/internal/service/cloudfront/cache_policy_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudfront_test
 
 import (
diff --git a/internal/service/cloudfront/cloudfront_test.go b/internal/service/cloudfront/cloudfront_test.go
index 45c31c33d98..447a5b25aef 100644
--- a/internal/service/cloudfront/cloudfront_test.go
+++ b/internal/service/cloudfront/cloudfront_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudfront_test
 
 import (
diff --git a/internal/service/cloudfront/consts.go b/internal/service/cloudfront/consts.go
index a7e17b5dff1..679a26f9aa1 100644
--- a/internal/service/cloudfront/consts.go
+++ b/internal/service/cloudfront/consts.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudfront
 
 const (
diff --git a/internal/service/cloudfront/continuous_deployment_policy.go b/internal/service/cloudfront/continuous_deployment_policy.go
new file mode 100644
index 00000000000..d91bed3b4b0
--- /dev/null
+++ b/internal/service/cloudfront/continuous_deployment_policy.go
@@ -0,0 +1,694 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package cloudfront
+
+import (
+	"context"
+	"errors"
+	"time"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/cloudfront"
+	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/hashicorp/terraform-plugin-framework-validators/listvalidator"
+	"github.com/hashicorp/terraform-plugin-framework/attr"
+	"github.com/hashicorp/terraform-plugin-framework/diag"
+	"github.com/hashicorp/terraform-plugin-framework/path"
+	"github.com/hashicorp/terraform-plugin-framework/resource"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema"
+	"github.com/hashicorp/terraform-plugin-framework/schema/validator"
+	"github.com/hashicorp/terraform-plugin-framework/types"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
+	"github.com/hashicorp/terraform-provider-aws/internal/create"
+	"github.com/hashicorp/terraform-provider-aws/internal/framework"
+	"github.com/hashicorp/terraform-provider-aws/internal/framework/flex"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/names"
+)
+
+// @FrameworkResource(name="Continuous Deployment Policy")
+func newResourceContinuousDeploymentPolicy(_ context.Context) (resource.ResourceWithConfigure, error) {
+	return &resourceContinuousDeploymentPolicy{}, nil
+}
+
+const (
+	ResNameContinuousDeploymentPolicy = "Continuous Deployment Policy"
+)
+
+type resourceContinuousDeploymentPolicy struct {
+	framework.ResourceWithConfigure
+}
+
+func (r *resourceContinuousDeploymentPolicy) Metadata(_ context.Context, req resource.MetadataRequest, resp *resource.MetadataResponse) {
+	resp.TypeName = "aws_cloudfront_continuous_deployment_policy"
+}
+
+func (r *resourceContinuousDeploymentPolicy) Schema(ctx context.Context, req resource.SchemaRequest, resp *resource.SchemaResponse) {
+	resp.Schema = schema.Schema{
+		Attributes: map[string]schema.Attribute{
+			"enabled": schema.BoolAttribute{
+				Required: true,
+			},
+			"etag": schema.StringAttribute{
+				Computed: true,
+			},
+			"id": framework.IDAttribute(),
+			"last_modified_time": schema.StringAttribute{
+				Computed: true,
+			},
+		},
+		Blocks: map[string]schema.Block{
+			"staging_distribution_dns_names": schema.ListNestedBlock{
+				Validators: []validator.List{
+					listvalidator.SizeAtLeast(1),
+					listvalidator.SizeAtMost(1),
+				},
+				NestedObject: schema.NestedBlockObject{
+					Attributes: map[string]schema.Attribute{
+						"items": schema.SetAttribute{
+							ElementType: types.StringType,
+							Optional:    true,
+						},
+						"quantity": schema.Int64Attribute{
+							Required: true,
+						},
+					},
+				},
+			},
+			"traffic_config": schema.ListNestedBlock{
+				Validators: []validator.List{
+					listvalidator.SizeAtLeast(1),
+					listvalidator.SizeAtMost(1),
+				},
+				NestedObject: schema.NestedBlockObject{
+					Attributes: map[string]schema.Attribute{
+						"type": schema.StringAttribute{
+							Required: true,
+						},
+					},
+					Blocks: map[string]schema.Block{
+						"single_header_config": schema.ListNestedBlock{
+							Validators: []validator.List{
+								listvalidator.SizeAtMost(1),
+							},
+							NestedObject: schema.NestedBlockObject{
+								Attributes: map[string]schema.Attribute{
+									"header": schema.StringAttribute{
+										Required: true,
+									},
+									"value": schema.StringAttribute{
+										Required: true,
+									},
+								},
+							},
+						},
+						"single_weight_config": schema.ListNestedBlock{
+							Validators: []validator.List{
+								listvalidator.SizeAtMost(1),
+							},
+							NestedObject: schema.NestedBlockObject{
+								Attributes: map[string]schema.Attribute{
+									"weight": schema.Float64Attribute{
+										Required: true,
+									},
+								},
+								Blocks: map[string]schema.Block{
+									"session_stickiness_config": schema.ListNestedBlock{
+										Validators: []validator.List{
+											listvalidator.SizeAtMost(1),
+										},
+										NestedObject: schema.NestedBlockObject{
+											Attributes: map[string]schema.Attribute{
+												"idle_ttl": schema.Int64Attribute{
+													Required: true,
+												},
+												"maximum_ttl": schema.Int64Attribute{
+													Required: true,
+												},
+											},
+										},
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+}
+
+func (r *resourceContinuousDeploymentPolicy) Create(ctx context.Context, req resource.CreateRequest, resp *resource.CreateResponse) {
+	conn := r.Meta().CloudFrontConn(ctx)
+
+	var plan resourceContinuousDeploymentPolicyData
+	resp.Diagnostics.Append(req.Plan.Get(ctx, &plan)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	cfg, d := expandContinuousDeploymentPolicyConfig(ctx, plan)
+	resp.Diagnostics.Append(d...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	in := &cloudfront.CreateContinuousDeploymentPolicyInput{
+		ContinuousDeploymentPolicyConfig: cfg,
+	}
+
+	out, err := conn.CreateContinuousDeploymentPolicyWithContext(ctx, in)
+	if err != nil {
+		resp.Diagnostics.AddError(
+			create.ProblemStandardMessage(names.CloudFront, create.ErrActionCreating, ResNameContinuousDeploymentPolicy, "", err),
+			err.Error(),
+		)
+		return
+	}
+	if out == nil || out.ContinuousDeploymentPolicy == nil {
+		resp.Diagnostics.AddError(
+			create.ProblemStandardMessage(names.CloudFront, create.ErrActionCreating, ResNameContinuousDeploymentPolicy, "", nil),
+			errors.New("empty output").Error(),
+		)
+		return
+	}
+
+	plan.ETag = flex.StringToFramework(ctx, out.ETag)
+	plan.ID = flex.StringToFramework(ctx, out.ContinuousDeploymentPolicy.Id)
+	plan.LastModifiedTime = flex.StringValueToFramework(ctx, out.ContinuousDeploymentPolicy.LastModifiedTime.Format(time.RFC3339))
+
+	resp.Diagnostics.Append(resp.State.Set(ctx, plan)...)
+}
+
+func (r *resourceContinuousDeploymentPolicy) Read(ctx context.Context, req resource.ReadRequest, resp *resource.ReadResponse) {
+	conn := r.Meta().CloudFrontConn(ctx)
+
+	var state resourceContinuousDeploymentPolicyData
+	resp.Diagnostics.Append(req.State.Get(ctx, &state)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	out, err := FindContinuousDeploymentPolicyByID(ctx, conn, state.ID.ValueString())
+	if tfresource.NotFound(err) {
+		resp.State.RemoveResource(ctx)
+		return
+	}
+	if err != nil {
+		resp.Diagnostics.AddError(
+			create.ProblemStandardMessage(names.CloudFront, create.ErrActionSetting, ResNameContinuousDeploymentPolicy, state.ID.String(), err),
+			err.Error(),
+		)
+		return
+	}
+
+	state.ETag = flex.StringToFramework(ctx, out.ETag)
+	policy := out.ContinuousDeploymentPolicy
+	state.ID = flex.StringToFramework(ctx, policy.Id)
+	state.LastModifiedTime = flex.StringValueToFramework(ctx, policy.LastModifiedTime.Format(time.RFC3339))
+	resp.Diagnostics.Append(state.refresh(ctx, policy.ContinuousDeploymentPolicyConfig)...)
+
+	resp.Diagnostics.Append(resp.State.Set(ctx, &state)...)
+}
+
+func (r *resourceContinuousDeploymentPolicy) Update(ctx context.Context, req resource.UpdateRequest, resp *resource.UpdateResponse) {
+	conn := r.Meta().CloudFrontConn(ctx)
+
+	var plan, state resourceContinuousDeploymentPolicyData
+	resp.Diagnostics.Append(req.Plan.Get(ctx, &plan)...)
+	resp.Diagnostics.Append(req.State.Get(ctx, &state)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	if !plan.Enabled.Equal(state.Enabled) ||
+		!plan.StagingDistributionDNSNames.Equal(state.StagingDistributionDNSNames) ||
+		!plan.TrafficConfig.Equal(state.TrafficConfig) {
+		cfg, d := expandContinuousDeploymentPolicyConfig(ctx, plan)
+		resp.Diagnostics.Append(d...)
+		if resp.Diagnostics.HasError() {
+			return
+		}
+
+		in := &cloudfront.UpdateContinuousDeploymentPolicyInput{
+			Id: aws.String(plan.ID.ValueString()),
+			// Use state ETag value. The planned value will be unknown.
+			IfMatch:                          aws.String(state.ETag.ValueString()),
+			ContinuousDeploymentPolicyConfig: cfg,
+		}
+
+		out, err := conn.UpdateContinuousDeploymentPolicyWithContext(ctx, in)
+		if err != nil {
+			resp.Diagnostics.AddError(
+				create.ProblemStandardMessage(names.CloudFront, create.ErrActionUpdating, ResNameContinuousDeploymentPolicy, plan.ID.String(), err),
+				err.Error(),
+			)
+			return
+		}
+		if out == nil || out.ContinuousDeploymentPolicy == nil {
+			resp.Diagnostics.AddError(
+				create.ProblemStandardMessage(names.CloudFront, create.ErrActionUpdating, ResNameContinuousDeploymentPolicy, plan.ID.String(), nil),
+				errors.New("empty output").Error(),
+			)
+			return
+		}
+
+		plan.ETag = flex.StringToFramework(ctx, out.ETag)
+		plan.ID = flex.StringToFramework(ctx, out.ContinuousDeploymentPolicy.Id)
+		plan.LastModifiedTime = flex.StringValueToFramework(ctx, out.ContinuousDeploymentPolicy.LastModifiedTime.Format(time.RFC3339))
+	}
+
+	resp.Diagnostics.Append(resp.State.Set(ctx, &plan)...)
+}
+
+func (r *resourceContinuousDeploymentPolicy) Delete(ctx context.Context, req resource.DeleteRequest, resp *resource.DeleteResponse) {
+	conn := r.Meta().CloudFrontConn(ctx)
+
+	var state resourceContinuousDeploymentPolicyData
+	resp.Diagnostics.Append(req.State.Get(ctx, &state)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	err := DeleteCDP(ctx, conn, state.ID.ValueString())
+
+	if err != nil {
+		resp.Diagnostics.AddError(
+			create.ProblemStandardMessage(names.CloudFront, create.ErrActionDeleting, ResNameContinuousDeploymentPolicy, state.ID.String(), err),
+			err.Error(),
+		)
+		return
+	}
+}
+
+func DeleteCDP(ctx context.Context, conn *cloudfront.CloudFront, id string) error {
+	etag, err := cdpETag(ctx, conn, id)
+	if tfresource.NotFound(err) {
+		return nil
+	}
+
+	if err != nil {
+		return err
+	}
+
+	in := &cloudfront.DeleteContinuousDeploymentPolicyInput{
+		Id:      aws.String(id),
+		IfMatch: etag,
+	}
+
+	_, err = conn.DeleteContinuousDeploymentPolicyWithContext(ctx, in)
+	if tfawserr.ErrCodeEquals(err, cloudfront.ErrCodeNoSuchContinuousDeploymentPolicy) {
+		return nil
+	}
+
+	if tfawserr.ErrCodeEquals(err, cloudfront.ErrCodePreconditionFailed, cloudfront.ErrCodeInvalidIfMatchVersion) {
+		etag, err := cdpETag(ctx, conn, id)
+		if tfresource.NotFound(err) {
+			return nil
+		}
+
+		if err != nil {
+			return err
+		}
+
+		in.SetIfMatch(aws.StringValue(etag))
+
+		_, err = conn.DeleteContinuousDeploymentPolicyWithContext(ctx, in)
+		if tfawserr.ErrCodeEquals(err, cloudfront.ErrCodeNoSuchContinuousDeploymentPolicy) {
+			return nil
+		}
+	}
+
+	return err
+}
+
+func disableContinuousDeploymentPolicy(ctx context.Context, conn *cloudfront.CloudFront, id string) error {
+	out, err := FindContinuousDeploymentPolicyByID(ctx, conn, id)
+	if tfresource.NotFound(err) || out == nil || out.ContinuousDeploymentPolicy == nil || out.ContinuousDeploymentPolicy.ContinuousDeploymentPolicyConfig == nil {
+		return nil
+	}
+
+	if !aws.BoolValue(out.ContinuousDeploymentPolicy.ContinuousDeploymentPolicyConfig.Enabled) {
+		return nil
+	}
+
+	out.ContinuousDeploymentPolicy.ContinuousDeploymentPolicyConfig.SetEnabled(false)
+
+	in := &cloudfront.UpdateContinuousDeploymentPolicyInput{
+		Id:                               out.ContinuousDeploymentPolicy.Id,
+		IfMatch:                          out.ETag,
+		ContinuousDeploymentPolicyConfig: out.ContinuousDeploymentPolicy.ContinuousDeploymentPolicyConfig,
+	}
+
+	_, err = conn.UpdateContinuousDeploymentPolicyWithContext(ctx, in)
+	return err
+}
+
+func cdpETag(ctx context.Context, conn *cloudfront.CloudFront, id string) (*string, error) {
+	output, err := FindContinuousDeploymentPolicyByID(ctx, conn, id)
+	if err != nil {
+		return nil, err
+	}
+
+	return output.ETag, nil
+}
+
+func (r *resourceContinuousDeploymentPolicy) ImportState(ctx context.Context, req resource.ImportStateRequest, resp *resource.ImportStateResponse) {
+	resource.ImportStatePassthroughID(ctx, path.Root("id"), req, resp)
+}
+
+func FindContinuousDeploymentPolicyByID(ctx context.Context, conn *cloudfront.CloudFront, id string) (*cloudfront.GetContinuousDeploymentPolicyOutput, error) {
+	in := &cloudfront.GetContinuousDeploymentPolicyInput{
+		Id: aws.String(id),
+	}
+
+	out, err := conn.GetContinuousDeploymentPolicyWithContext(ctx, in)
+	if tfawserr.ErrCodeEquals(err, cloudfront.ErrCodeNoSuchContinuousDeploymentPolicy) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: in,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	if out == nil || out.ContinuousDeploymentPolicy == nil {
+		return nil, tfresource.NewEmptyResultError(in)
+	}
+
+	return out, nil
+}
+
+func flattenStagingDistributionDNSNames(ctx context.Context, apiObject *cloudfront.StagingDistributionDnsNames) (types.List, diag.Diagnostics) {
+	var diags diag.Diagnostics
+	elemType := types.ObjectType{AttrTypes: stagingDistributionDNSNamesAttrTypes}
+
+	if apiObject == nil {
+		return types.ListNull(elemType), diags
+	}
+
+	obj := map[string]attr.Value{
+		"items":    flex.FlattenFrameworkStringSet(ctx, apiObject.Items),
+		"quantity": flex.Int64ToFramework(ctx, apiObject.Quantity),
+	}
+	objVal, d := types.ObjectValue(stagingDistributionDNSNamesAttrTypes, obj)
+	diags.Append(d...)
+
+	listVal, d := types.ListValue(elemType, []attr.Value{objVal})
+	diags.Append(d...)
+
+	return listVal, diags
+}
+
+func flattenTrafficConfig(ctx context.Context, apiObject *cloudfront.TrafficConfig) (types.List, diag.Diagnostics) {
+	var diags diag.Diagnostics
+	elemType := types.ObjectType{AttrTypes: trafficConfigAttrTypes}
+
+	if apiObject == nil {
+		return types.ListNull(elemType), diags
+	}
+
+	singleHeaderConfig, d := flattenSingleHeaderConfig(ctx, apiObject.SingleHeaderConfig)
+	diags.Append(d...)
+
+	singleWeightConfig, d := flattenSingleWeightConfig(ctx, apiObject.SingleWeightConfig)
+	diags.Append(d...)
+
+	obj := map[string]attr.Value{
+		"type":                 flex.StringToFramework(ctx, apiObject.Type),
+		"single_header_config": singleHeaderConfig,
+		"single_weight_config": singleWeightConfig,
+	}
+	objVal, d := types.ObjectValue(trafficConfigAttrTypes, obj)
+	diags.Append(d...)
+
+	listVal, d := types.ListValue(elemType, []attr.Value{objVal})
+	diags.Append(d...)
+
+	return listVal, diags
+}
+
+func flattenSingleHeaderConfig(ctx context.Context, apiObject *cloudfront.ContinuousDeploymentSingleHeaderConfig) (types.List, diag.Diagnostics) {
+	var diags diag.Diagnostics
+	elemType := types.ObjectType{AttrTypes: singleHeaderConfigAttrTypes}
+
+	if apiObject == nil {
+		return types.ListNull(elemType), diags
+	}
+
+	obj := map[string]attr.Value{
+		"header": flex.StringToFramework(ctx, apiObject.Header),
+		"value":  flex.StringToFramework(ctx, apiObject.Value),
+	}
+	objVal, d := types.ObjectValue(singleHeaderConfigAttrTypes, obj)
+	diags.Append(d...)
+
+	listVal, d := types.ListValue(elemType, []attr.Value{objVal})
+	diags.Append(d...)
+
+	return listVal, diags
+}
+
+func flattenSingleWeightConfig(ctx context.Context, apiObject *cloudfront.ContinuousDeploymentSingleWeightConfig) (types.List, diag.Diagnostics) {
+	var diags diag.Diagnostics
+	elemType := types.ObjectType{AttrTypes: singleWeightConfigAttrTypes}
+
+	if apiObject == nil {
+		return types.ListNull(elemType), diags
+	}
+
+	sessionStickinessConfig, d := flattenSessionStickinessConfig(ctx, apiObject.SessionStickinessConfig)
+	diags.Append(d...)
+
+	obj := map[string]attr.Value{
+		"session_stickiness_config": sessionStickinessConfig,
+		"weight":                    flex.Float64ToFramework(ctx, apiObject.Weight),
+	}
+	objVal, d := types.ObjectValue(singleWeightConfigAttrTypes, obj)
+	diags.Append(d...)
+
+	listVal, d := types.ListValue(elemType, []attr.Value{objVal})
+	diags.Append(d...)
+
+	return listVal, diags
+}
+
+func flattenSessionStickinessConfig(ctx context.Context, apiObject *cloudfront.SessionStickinessConfig) (types.List, diag.Diagnostics) {
+	var diags diag.Diagnostics
+	elemType := types.ObjectType{AttrTypes: sessionStickinessConfigAttrTypes}
+
+	if apiObject == nil {
+		return types.ListNull(elemType), diags
+	}
+
+	obj := map[string]attr.Value{
+		"idle_ttl":    flex.Int64ToFramework(ctx, apiObject.IdleTTL),
+		"maximum_ttl": flex.Int64ToFramework(ctx, apiObject.MaximumTTL),
+	}
+	objVal, d := types.ObjectValue(sessionStickinessConfigAttrTypes, obj)
+	diags.Append(d...)
+
+	listVal, d := types.ListValue(elemType, []attr.Value{objVal})
+	diags.Append(d...)
+
+	return listVal, diags
+}
+
+// expandContinuousDeploymentPolicyConfig translates a resource plan into a
+// continuous deployment policy config
+func expandContinuousDeploymentPolicyConfig(ctx context.Context, data resourceContinuousDeploymentPolicyData) (*cloudfront.ContinuousDeploymentPolicyConfig, diag.Diagnostics) {
+	var diags diag.Diagnostics
+	var stagingDistributionDNSNames []stagingDistributionDNSNamesData
+	diags.Append(data.StagingDistributionDNSNames.ElementsAs(ctx, &stagingDistributionDNSNames, false)...)
+
+	apiObject := &cloudfront.ContinuousDeploymentPolicyConfig{
+		Enabled:                     aws.Bool(data.Enabled.ValueBool()),
+		StagingDistributionDnsNames: expandStagingDistributionDNSNames(ctx, stagingDistributionDNSNames),
+	}
+	if !data.TrafficConfig.IsNull() {
+		var tcData []trafficConfigData
+		diags.Append(data.TrafficConfig.ElementsAs(ctx, &tcData, false)...)
+
+		trafficConfig, d := expandTrafficConfig(ctx, tcData)
+		diags.Append(d...)
+
+		apiObject.TrafficConfig = trafficConfig
+	}
+
+	return apiObject, diags
+}
+
+func expandStagingDistributionDNSNames(ctx context.Context, tfList []stagingDistributionDNSNamesData) *cloudfront.StagingDistributionDnsNames {
+	if len(tfList) == 0 {
+		return nil
+	}
+
+	tfObj := tfList[0]
+	apiObject := &cloudfront.StagingDistributionDnsNames{
+		Quantity: aws.Int64(tfObj.Quantity.ValueInt64()),
+		Items:    flex.ExpandFrameworkStringSet(ctx, tfObj.Items),
+	}
+
+	return apiObject
+}
+
+func expandTrafficConfig(ctx context.Context, tfList []trafficConfigData) (*cloudfront.TrafficConfig, diag.Diagnostics) {
+	var diags diag.Diagnostics
+	if len(tfList) == 0 {
+		return nil, diags
+	}
+
+	tfObj := tfList[0]
+	apiObject := &cloudfront.TrafficConfig{
+		Type: aws.String(tfObj.Type.ValueString()),
+	}
+	if !tfObj.SingleHeaderConfig.IsNull() {
+		var data []singleHeaderConfigData
+		diags.Append(tfObj.SingleHeaderConfig.ElementsAs(ctx, &data, false)...)
+
+		apiObject.SingleHeaderConfig = expandSingleHeaderConfig(data)
+	}
+	if !tfObj.SingleWeightConfig.IsNull() {
+		var data []singleWeightConfigData
+		diags.Append(tfObj.SingleWeightConfig.ElementsAs(ctx, &data, false)...)
+
+		singleWeightConfig, d := expandSingleWeightConfig(ctx, data)
+		diags.Append(d...)
+
+		apiObject.SingleWeightConfig = singleWeightConfig
+	}
+
+	return apiObject, diags
+}
+
+func expandSingleHeaderConfig(tfList []singleHeaderConfigData) *cloudfront.ContinuousDeploymentSingleHeaderConfig {
+	if len(tfList) == 0 {
+		return nil
+	}
+
+	tfObj := tfList[0]
+	apiObject := &cloudfront.ContinuousDeploymentSingleHeaderConfig{
+		Header: aws.String(tfObj.Header.ValueString()),
+		Value:  aws.String(tfObj.Value.ValueString()),
+	}
+
+	return apiObject
+}
+
+func expandSingleWeightConfig(ctx context.Context, tfList []singleWeightConfigData) (*cloudfront.ContinuousDeploymentSingleWeightConfig, diag.Diagnostics) {
+	var diags diag.Diagnostics
+	if len(tfList) == 0 {
+		return nil, diags
+	}
+
+	tfObj := tfList[0]
+	apiObject := &cloudfront.ContinuousDeploymentSingleWeightConfig{
+		Weight: aws.Float64(tfObj.Weight.ValueFloat64()),
+	}
+	if !tfObj.SessionStickinessConfig.IsNull() {
+		var data []sessionStickinessConfigData
+		diags.Append(tfObj.SessionStickinessConfig.ElementsAs(ctx, &data, false)...)
+
+		apiObject.SessionStickinessConfig = expandSessionStickinessConfig(data)
+	}
+
+	return apiObject, diags
+}
+
+func expandSessionStickinessConfig(tfList []sessionStickinessConfigData) *cloudfront.SessionStickinessConfig {
+	if len(tfList) == 0 {
+		return nil
+	}
+
+	tfObj := tfList[0]
+	apiObject := &cloudfront.SessionStickinessConfig{
+		IdleTTL:    aws.Int64(tfObj.IdleTTL.ValueInt64()),
+		MaximumTTL: aws.Int64(tfObj.MaximumTTL.ValueInt64()),
+	}
+
+	return apiObject
+}
+
+type resourceContinuousDeploymentPolicyData struct {
+	Enabled                     types.Bool   `tfsdk:"enabled"`
+	ETag                        types.String `tfsdk:"etag"`
+	ID                          types.String `tfsdk:"id"`
+	LastModifiedTime            types.String `tfsdk:"last_modified_time"`
+	StagingDistributionDNSNames types.List   `tfsdk:"staging_distribution_dns_names"`
+	TrafficConfig               types.List   `tfsdk:"traffic_config"`
+}
+
+type stagingDistributionDNSNamesData struct {
+	Items    types.Set   `tfsdk:"items"`
+	Quantity types.Int64 `tfsdk:"quantity"`
+}
+
+type trafficConfigData struct {
+	SingleHeaderConfig types.List   `tfsdk:"single_header_config"`
+	SingleWeightConfig types.List   `tfsdk:"single_weight_config"`
+	Type               types.String `tfsdk:"type"`
+}
+
+type singleHeaderConfigData struct {
+	Header types.String `tfsdk:"header"`
+	Value  types.String `tfsdk:"value"`
+}
+
+type singleWeightConfigData struct {
+	SessionStickinessConfig types.List    `tfsdk:"session_stickiness_config"`
+	Weight                  types.Float64 `tfsdk:"weight"`
+}
+
+type sessionStickinessConfigData struct {
+	IdleTTL    types.Int64 `tfsdk:"idle_ttl"`
+	MaximumTTL types.Int64 `tfsdk:"maximum_ttl"`
+}
+
+var stagingDistributionDNSNamesAttrTypes = map[string]attr.Type{
+	"items":    types.SetType{ElemType: types.StringType},
+	"quantity": types.Int64Type,
+}
+
+var trafficConfigAttrTypes = map[string]attr.Type{
+	"single_header_config": types.ListType{ElemType: types.ObjectType{AttrTypes: singleHeaderConfigAttrTypes}},
+	"single_weight_config": types.ListType{ElemType: types.ObjectType{AttrTypes: singleWeightConfigAttrTypes}},
+	"type":                 types.StringType,
+}
+
+var singleHeaderConfigAttrTypes = map[string]attr.Type{
+	"header": types.StringType,
+	"value":  types.StringType,
+}
+
+var singleWeightConfigAttrTypes = map[string]attr.Type{
+	"session_stickiness_config": types.ListType{ElemType: types.ObjectType{AttrTypes: sessionStickinessConfigAttrTypes}},
+	"weight":                    types.Float64Type,
+}
+
+var sessionStickinessConfigAttrTypes = map[string]attr.Type{
+	"idle_ttl":    types.Int64Type,
+	"maximum_ttl": types.Int64Type,
+}
+
+// refresh updates state data from the returned API response
+func (rd *resourceContinuousDeploymentPolicyData) refresh(ctx context.Context, apiObject *cloudfront.ContinuousDeploymentPolicyConfig) diag.Diagnostics {
+	var diags diag.Diagnostics
+	if apiObject == nil {
+		return diags
+	}
+
+	rd.Enabled = flex.BoolToFramework(ctx, apiObject.Enabled)
+
+	stagingDistributionDNSNames, d := flattenStagingDistributionDNSNames(ctx, apiObject.StagingDistributionDnsNames)
+	diags.Append(d...)
+	rd.StagingDistributionDNSNames = stagingDistributionDNSNames
+
+	trafficConfig, d := flattenTrafficConfig(ctx, apiObject.TrafficConfig)
+	diags.Append(d...)
+	rd.TrafficConfig = trafficConfig
+
+	return diags
+}
diff --git a/internal/service/cloudfront/continuous_deployment_policy_test.go b/internal/service/cloudfront/continuous_deployment_policy_test.go
new file mode 100644
index 00000000000..49a296cd222
--- /dev/null
+++ b/internal/service/cloudfront/continuous_deployment_policy_test.go
@@ -0,0 +1,583 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package cloudfront_test
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"testing"
+
+	"github.com/aws/aws-sdk-go/service/cloudfront"
+	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
+	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/create"
+	tfcloudfront "github.com/hashicorp/terraform-provider-aws/internal/service/cloudfront"
+	"github.com/hashicorp/terraform-provider-aws/names"
+)
+
+const (
+	defaultDomain = "www.example.com"
+)
+
+func TestAccCloudFrontContinuousDeploymentPolicy_basic(t *testing.T) {
+	ctx := acctest.Context(t)
+	var policy cloudfront.GetContinuousDeploymentPolicyOutput
+	var stagingDistribution cloudfront.Distribution
+	var productionDistribution cloudfront.Distribution
+	resourceName := "aws_cloudfront_continuous_deployment_policy.test"
+	stagingDistributionResourceName := "aws_cloudfront_distribution.staging"
+	productionDistributionResourceName := "aws_cloudfront_distribution.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, cloudfront.EndpointsID)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, cloudfront.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckContinuousDeploymentPolicyDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccContinuousDeploymentPolicyConfig_init(defaultDomain),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckDistributionExists(ctx, stagingDistributionResourceName, &stagingDistribution),
+					testAccCheckDistributionExists(ctx, productionDistributionResourceName, &productionDistribution),
+					testAccCheckContinuousDeploymentPolicyExists(ctx, resourceName, &policy),
+				),
+			},
+			{
+				Config: testAccContinuousDeploymentPolicyConfig_basic(),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckContinuousDeploymentPolicyExists(ctx, resourceName, &policy),
+					resource.TestCheckResourceAttr(resourceName, "enabled", "false"),
+					resource.TestCheckResourceAttr(resourceName, "staging_distribution_dns_names.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "staging_distribution_dns_names.0.quantity", "1"),
+					resource.TestCheckResourceAttr(resourceName, "staging_distribution_dns_names.0.items.#", "1"),
+					resource.TestCheckResourceAttrPair(resourceName, "staging_distribution_dns_names.0.items.0", stagingDistributionResourceName, "domain_name"),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "traffic_config.*", map[string]string{
+						"type":                          "SingleWeight",
+						"single_weight_config.#":        "1",
+						"single_weight_config.0.weight": "0.01",
+					}),
+					resource.TestCheckResourceAttrSet(resourceName, "etag"),
+					resource.TestCheckResourceAttrSet(resourceName, "last_modified_time"),
+					resource.TestCheckResourceAttrPair(productionDistributionResourceName, "continuous_deployment_policy_id", resourceName, "id"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
+func TestAccCloudFrontContinuousDeploymentPolicy_disappears(t *testing.T) {
+	ctx := acctest.Context(t)
+	var policy cloudfront.GetContinuousDeploymentPolicyOutput
+	var stagingDistribution cloudfront.Distribution
+	var productionDistribution cloudfront.Distribution
+	resourceName := "aws_cloudfront_continuous_deployment_policy.test"
+	stagingDistributionResourceName := "aws_cloudfront_distribution.staging"
+	productionDistributionResourceName := "aws_cloudfront_distribution.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, cloudfront.EndpointsID)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, cloudfront.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckContinuousDeploymentPolicyDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccContinuousDeploymentPolicyConfig_init(defaultDomain),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckDistributionExists(ctx, stagingDistributionResourceName, &stagingDistribution),
+					testAccCheckDistributionExists(ctx, productionDistributionResourceName, &productionDistribution),
+					testAccCheckContinuousDeploymentPolicyExists(ctx, resourceName, &policy),
+					acctest.CheckFrameworkResourceDisappears(ctx, acctest.Provider, tfcloudfront.ResourceContinuousDeploymentPolicy, resourceName),
+				),
+				ExpectNonEmptyPlan: true,
+			},
+		},
+	})
+}
+
+func TestAccCloudFrontContinuousDeploymentPolicy_trafficConfig(t *testing.T) {
+	ctx := acctest.Context(t)
+	var policy cloudfront.GetContinuousDeploymentPolicyOutput
+	var stagingDistribution cloudfront.Distribution
+	var productionDistribution cloudfront.Distribution
+	resourceName := "aws_cloudfront_continuous_deployment_policy.test"
+	stagingDistributionResourceName := "aws_cloudfront_distribution.staging"
+	productionDistributionResourceName := "aws_cloudfront_distribution.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, cloudfront.EndpointsID)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, cloudfront.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckContinuousDeploymentPolicyDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccContinuousDeploymentPolicyConfig_init(defaultDomain),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckDistributionExists(ctx, stagingDistributionResourceName, &stagingDistribution),
+					testAccCheckDistributionExists(ctx, productionDistributionResourceName, &productionDistribution),
+					testAccCheckContinuousDeploymentPolicyExists(ctx, resourceName, &policy),
+				),
+			},
+			{
+				Config: testAccContinuousDeploymentPolicyConfig_TrafficConfig_singleWeight(false, "0.01", 300, 600, defaultDomain),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckContinuousDeploymentPolicyExists(ctx, resourceName, &policy),
+					resource.TestCheckResourceAttr(resourceName, "enabled", "false"),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "traffic_config.*", map[string]string{
+						"type":                          "SingleWeight",
+						"single_weight_config.#":        "1",
+						"single_weight_config.0.weight": "0.01",
+						"single_weight_config.0.session_stickiness_config.#":             "1",
+						"single_weight_config.0.session_stickiness_config.0.idle_ttl":    "300",
+						"single_weight_config.0.session_stickiness_config.0.maximum_ttl": "600",
+					}),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				Config: testAccContinuousDeploymentPolicyConfig_TrafficConfig_singleWeight(true, "0.02", 600, 1200, defaultDomain),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckContinuousDeploymentPolicyExists(ctx, resourceName, &policy),
+					resource.TestCheckResourceAttr(resourceName, "enabled", "true"),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "traffic_config.*", map[string]string{
+						"type":                          "SingleWeight",
+						"single_weight_config.#":        "1",
+						"single_weight_config.0.weight": "0.02",
+						"single_weight_config.0.session_stickiness_config.#":             "1",
+						"single_weight_config.0.session_stickiness_config.0.idle_ttl":    "600",
+						"single_weight_config.0.session_stickiness_config.0.maximum_ttl": "1200",
+					}),
+				),
+			},
+			{
+				Config: testAccContinuousDeploymentPolicyConfig_TrafficConfig_singleHeader(false, "aws-cf-cd-test", "test"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckContinuousDeploymentPolicyExists(ctx, resourceName, &policy),
+					resource.TestCheckResourceAttr(resourceName, "enabled", "false"),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "traffic_config.*", map[string]string{
+						"type":                          "SingleHeader",
+						"single_header_config.#":        "1",
+						"single_header_config.0.header": "aws-cf-cd-test",
+						"single_header_config.0.value":  "test",
+					}),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				Config: testAccContinuousDeploymentPolicyConfig_TrafficConfig_singleHeader(true, "aws-cf-cd-test2", "test2"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckContinuousDeploymentPolicyExists(ctx, resourceName, &policy),
+					resource.TestCheckResourceAttr(resourceName, "enabled", "true"),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "traffic_config.*", map[string]string{
+						"type":                          "SingleHeader",
+						"single_header_config.#":        "1",
+						"single_header_config.0.header": "aws-cf-cd-test2",
+						"single_header_config.0.value":  "test2",
+					}),
+				),
+			},
+		},
+	})
+}
+
+// https://github.com/hashicorp/terraform-provider-aws/issues/33338
+func TestAccCloudFrontContinuousDeploymentPolicy_domainChange(t *testing.T) {
+	ctx := acctest.Context(t)
+	var policy cloudfront.GetContinuousDeploymentPolicyOutput
+	var stagingDistribution cloudfront.Distribution
+	var productionDistribution cloudfront.Distribution
+	resourceName := "aws_cloudfront_continuous_deployment_policy.test"
+	stagingDistributionResourceName := "aws_cloudfront_distribution.staging"
+	productionDistributionResourceName := "aws_cloudfront_distribution.test"
+	domain1 := fmt.Sprintf("%s.example.com", sdkacctest.RandomWithPrefix(acctest.ResourcePrefix))
+	domain2 := fmt.Sprintf("%s.example.com", sdkacctest.RandomWithPrefix(acctest.ResourcePrefix))
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, cloudfront.EndpointsID)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, cloudfront.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckContinuousDeploymentPolicyDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccContinuousDeploymentPolicyConfig_init(domain1),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckDistributionExists(ctx, stagingDistributionResourceName, &stagingDistribution),
+					testAccCheckDistributionExists(ctx, productionDistributionResourceName, &productionDistribution),
+					testAccCheckContinuousDeploymentPolicyExists(ctx, resourceName, &policy),
+				),
+			},
+			{
+				Config: testAccContinuousDeploymentPolicyConfig_TrafficConfig_singleWeight(true, "0.01", 300, 600, domain1),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckContinuousDeploymentPolicyExists(ctx, resourceName, &policy),
+					resource.TestCheckResourceAttr(resourceName, "enabled", "true"),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "traffic_config.*", map[string]string{
+						"type":                          "SingleWeight",
+						"single_weight_config.#":        "1",
+						"single_weight_config.0.weight": "0.01",
+						"single_weight_config.0.session_stickiness_config.#":             "1",
+						"single_weight_config.0.session_stickiness_config.0.idle_ttl":    "300",
+						"single_weight_config.0.session_stickiness_config.0.maximum_ttl": "600",
+					}),
+					resource.TestCheckTypeSetElemNestedAttrs(stagingDistributionResourceName, "origin.*", map[string]string{
+						"domain_name": domain1,
+					}),
+					resource.TestCheckTypeSetElemNestedAttrs(productionDistributionResourceName, "origin.*", map[string]string{
+						"domain_name": domain1,
+					}),
+				),
+			},
+			{
+				Config: testAccContinuousDeploymentPolicyConfig_TrafficConfig_singleWeight(true, "0.01", 300, 600, domain2),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckContinuousDeploymentPolicyExists(ctx, resourceName, &policy),
+					resource.TestCheckResourceAttr(resourceName, "enabled", "true"),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "traffic_config.*", map[string]string{
+						"type":                          "SingleWeight",
+						"single_weight_config.#":        "1",
+						"single_weight_config.0.weight": "0.01",
+						"single_weight_config.0.session_stickiness_config.#":             "1",
+						"single_weight_config.0.session_stickiness_config.0.idle_ttl":    "300",
+						"single_weight_config.0.session_stickiness_config.0.maximum_ttl": "600",
+					}),
+					resource.TestCheckTypeSetElemNestedAttrs(stagingDistributionResourceName, "origin.*", map[string]string{
+						"domain_name": domain2,
+					}),
+					resource.TestCheckTypeSetElemNestedAttrs(productionDistributionResourceName, "origin.*", map[string]string{
+						"domain_name": domain2,
+					}),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckContinuousDeploymentPolicyDestroy(ctx context.Context) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		conn := acctest.Provider.Meta().(*conns.AWSClient).CloudFrontConn(ctx)
+
+		for _, rs := range s.RootModule().Resources {
+			if rs.Type != "aws_cloudfront_continuous_deployment_policy" {
+				continue
+			}
+
+			_, err := tfcloudfront.FindContinuousDeploymentPolicyByID(ctx, conn, rs.Primary.ID)
+			if tfawserr.ErrCodeEquals(err, cloudfront.ErrCodeNoSuchContinuousDeploymentPolicy) {
+				return nil
+			}
+			if err != nil {
+				return err
+			}
+
+			return create.Error(names.CloudFront, create.ErrActionCheckingDestroyed, tfcloudfront.ResNameContinuousDeploymentPolicy, rs.Primary.ID, errors.New("not destroyed"))
+		}
+
+		return nil
+	}
+}
+
+func testAccCheckContinuousDeploymentPolicyExists(ctx context.Context, name string, policy *cloudfront.GetContinuousDeploymentPolicyOutput) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[name]
+		if !ok {
+			return create.Error(names.CloudFront, create.ErrActionCheckingExistence, tfcloudfront.ResNameContinuousDeploymentPolicy, name, errors.New("not found"))
+		}
+
+		if rs.Primary.ID == "" {
+			return create.Error(names.CloudFront, create.ErrActionCheckingExistence, tfcloudfront.ResNameContinuousDeploymentPolicy, name, errors.New("not set"))
+		}
+
+		conn := acctest.Provider.Meta().(*conns.AWSClient).CloudFrontConn(ctx)
+		resp, err := tfcloudfront.FindContinuousDeploymentPolicyByID(ctx, conn, rs.Primary.ID)
+		if err != nil {
+			return create.Error(names.CloudFront, create.ErrActionCheckingExistence, tfcloudfront.ResNameContinuousDeploymentPolicy, rs.Primary.ID, err)
+		}
+
+		*policy = *resp
+
+		return nil
+	}
+}
+
+func testAccContinuousDeploymentPolicyConfigBase_staging(domain string) string {
+	return fmt.Sprintf(`
+resource "aws_cloudfront_distribution" "staging" {
+  enabled          = true
+  retain_on_delete = false
+  staging          = true
+
+  default_cache_behavior {
+    allowed_methods        = ["GET", "HEAD"]
+    cached_methods         = ["GET", "HEAD"]
+    target_origin_id       = "test"
+    viewer_protocol_policy = "allow-all"
+
+    forwarded_values {
+      query_string = false
+
+      cookies {
+        forward = "all"
+      }
+    }
+  }
+
+  origin {
+    domain_name = %[1]q
+    origin_id   = "test"
+
+    custom_origin_config {
+      http_port              = 80
+      https_port             = 443
+      origin_protocol_policy = "https-only"
+      origin_ssl_protocols   = ["TLSv1.2"]
+    }
+  }
+
+  restrictions {
+    geo_restriction {
+      restriction_type = "none"
+    }
+  }
+
+  viewer_certificate {
+    cloudfront_default_certificate = true
+  }
+}
+`, domain)
+}
+
+// The initial production distribution must be created _without_ the continuous
+// deployment policy attached. Example error:
+//
+// InvalidArgument: Continuous deployment policy is not supported during distribution creation.
+func testAccContinuousDeploymentPolicyConfigBase_productionInit(domain string) string {
+	return fmt.Sprintf(`
+resource "aws_cloudfront_distribution" "test" {
+  enabled          = true
+  retain_on_delete = false
+
+  default_cache_behavior {
+    allowed_methods        = ["GET", "HEAD"]
+    cached_methods         = ["GET", "HEAD"]
+    target_origin_id       = "test"
+    viewer_protocol_policy = "allow-all"
+
+    forwarded_values {
+      query_string = false
+
+      cookies {
+        forward = "all"
+      }
+    }
+  }
+
+  origin {
+    domain_name = %[1]q
+    origin_id   = "test"
+
+    custom_origin_config {
+      http_port              = 80
+      https_port             = 443
+      origin_protocol_policy = "https-only"
+      origin_ssl_protocols   = ["TLSv1.2"]
+    }
+  }
+
+  restrictions {
+    geo_restriction {
+      restriction_type = "none"
+    }
+  }
+
+  viewer_certificate {
+    cloudfront_default_certificate = true
+  }
+}
+`, domain)
+}
+
+func testAccContinuousDeploymentPolicyConfigBase_production(domain string) string {
+	return fmt.Sprintf(`
+resource "aws_cloudfront_distribution" "test" {
+  enabled          = true
+  retain_on_delete = false
+
+  continuous_deployment_policy_id = aws_cloudfront_continuous_deployment_policy.test.id
+
+  default_cache_behavior {
+    allowed_methods        = ["GET", "HEAD"]
+    cached_methods         = ["GET", "HEAD"]
+    target_origin_id       = "test"
+    viewer_protocol_policy = "allow-all"
+
+    forwarded_values {
+      query_string = false
+
+      cookies {
+        forward = "all"
+      }
+    }
+  }
+
+  origin {
+    domain_name = %[1]q
+    origin_id   = "test"
+
+    custom_origin_config {
+      http_port              = 80
+      https_port             = 443
+      origin_protocol_policy = "https-only"
+      origin_ssl_protocols   = ["TLSv1.2"]
+    }
+  }
+
+  restrictions {
+    geo_restriction {
+      restriction_type = "none"
+    }
+  }
+
+  viewer_certificate {
+    cloudfront_default_certificate = true
+  }
+}
+`, domain)
+}
+
+// testAccContinuousDeploymentPolicyConfig_init initializes the staging and production
+// distributions and creates the continuous deployment policy, but does not yet
+// associate it with the production distribution. Association with a production distribution
+// must be done in sunsequent steps, so this will always be the first configuration deployed.
+//
+// A fortunate side effect of the initial deployment without a production distribution
+// association is that it allows the the policy to be "disappeared" out of band safely,
+// avoiding errors like the following:
+//
+// ContinuousDeploymentPolicyInUse: The specified continuous deployment policy is
+// currently associated with a distribution.
+func testAccContinuousDeploymentPolicyConfig_init(domain string) string {
+	return acctest.ConfigCompose(
+		testAccContinuousDeploymentPolicyConfigBase_staging(domain),
+		testAccContinuousDeploymentPolicyConfigBase_productionInit(domain),
+		`
+resource "aws_cloudfront_continuous_deployment_policy" "test" {
+  enabled = false
+
+  staging_distribution_dns_names {
+    items    = [aws_cloudfront_distribution.staging.domain_name]
+    quantity = 1
+  }
+
+  traffic_config {
+    type = "SingleWeight"
+    single_weight_config {
+      weight = "0.01"
+    }
+  }
+}
+`)
+}
+
+func testAccContinuousDeploymentPolicyConfig_basic() string {
+	return acctest.ConfigCompose(
+		testAccContinuousDeploymentPolicyConfigBase_staging(defaultDomain),
+		testAccContinuousDeploymentPolicyConfigBase_production(defaultDomain),
+		`
+resource "aws_cloudfront_continuous_deployment_policy" "test" {
+  enabled = false
+
+  staging_distribution_dns_names {
+    items    = [aws_cloudfront_distribution.staging.domain_name]
+    quantity = 1
+  }
+
+  traffic_config {
+    type = "SingleWeight"
+    single_weight_config {
+      weight = "0.01"
+    }
+  }
+}
+`)
+}
+
+func testAccContinuousDeploymentPolicyConfig_TrafficConfig_singleWeight(enabled bool, weight string, idleTTL, maxTTL int, domain string) string {
+	return acctest.ConfigCompose(
+		testAccContinuousDeploymentPolicyConfigBase_staging(domain),
+		testAccContinuousDeploymentPolicyConfigBase_production(domain),
+		fmt.Sprintf(`
+resource "aws_cloudfront_continuous_deployment_policy" "test" {
+  enabled = %[1]t
+
+  staging_distribution_dns_names {
+    items    = [aws_cloudfront_distribution.staging.domain_name]
+    quantity = 1
+  }
+
+  traffic_config {
+    type = "SingleWeight"
+    single_weight_config {
+      weight = %[2]q
+      session_stickiness_config {
+        idle_ttl    = %[3]d
+        maximum_ttl = %[4]d
+      }
+    }
+  }
+}
+`, enabled, weight, idleTTL, maxTTL))
+}
+
+func testAccContinuousDeploymentPolicyConfig_TrafficConfig_singleHeader(enabled bool, header, value string) string {
+	return acctest.ConfigCompose(
+		testAccContinuousDeploymentPolicyConfigBase_staging(defaultDomain),
+		testAccContinuousDeploymentPolicyConfigBase_production(defaultDomain),
+		fmt.Sprintf(`
+resource "aws_cloudfront_continuous_deployment_policy" "test" {
+  enabled = %[1]t
+
+  staging_distribution_dns_names {
+    items    = [aws_cloudfront_distribution.staging.domain_name]
+    quantity = 1
+  }
+
+  traffic_config {
+    type = "SingleHeader"
+    single_header_config {
+      header = %[2]q
+      value  = %[3]q
+    }
+  }
+}
+`, enabled, header, value))
+}
diff --git a/internal/service/cloudfront/distribution.go b/internal/service/cloudfront/distribution.go
index 0e6cc921e13..7d66d22860d 100644
--- a/internal/service/cloudfront/distribution.go
+++ b/internal/service/cloudfront/distribution.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudfront
 
 import (
@@ -226,6 +229,11 @@ func ResourceDistribution() *schema.Resource {
 					},
 				},
 			},
+			"continuous_deployment_policy_id": {
+				Type:     schema.TypeString,
+				Optional: true,
+				Computed: true,
+			},
 			"comment": {
 				Type:         schema.TypeString,
 				Optional:     true,
@@ -618,7 +626,7 @@ func ResourceDistribution() *schema.Resource {
 									},
 									"origin_shield_region": {
 										Type:         schema.TypeString,
-										Required:     true,
+										Optional:     true,
 										ValidateFunc: validation.StringMatch(regionRegexp, "must be a valid AWS Region Code"),
 									},
 								},
@@ -819,6 +827,12 @@ func ResourceDistribution() *schema.Resource {
 				Optional: true,
 				Default:  false,
 			},
+			"staging": {
+				Type:     schema.TypeBool,
+				Optional: true,
+				Default:  false,
+				ForceNew: true,
+			},
 
 			names.AttrTags:    tftags.TagsSchema(),
 			names.AttrTagsAll: tftags.TagsSchemaComputed(),
@@ -843,39 +857,21 @@ func resourceDistributionCreate(ctx context.Context, d *schema.ResourceData, met
 		input.DistributionConfigWithTags.Tags.Items = tags
 	}
 
-	var resp *cloudfront.CreateDistributionWithTagsOutput
-	// Handle eventual consistency issues
-	err := retry.RetryContext(ctx, 1*time.Minute, func() *retry.RetryError {
-		var err error
-		resp, err = conn.CreateDistributionWithTagsWithContext(ctx, input)
-
-		// ACM and IAM certificate eventual consistency
-		// InvalidViewerCertificate: The specified SSL certificate doesn't exist, isn't in us-east-1 region, isn't valid, or doesn't include a valid certificate chain.
-		if tfawserr.ErrCodeEquals(err, cloudfront.ErrCodeInvalidViewerCertificate) {
-			return retry.RetryableError(err)
-		}
-
-		if err != nil {
-			return retry.NonRetryableError(err)
-		}
-
-		return nil
-	})
-
-	// Propagate AWS Go SDK retried error, if any
-	if tfresource.TimedOut(err) {
-		resp, err = conn.CreateDistributionWithTagsWithContext(ctx, input)
-	}
+	// ACM and IAM certificate eventual consistency.
+	// InvalidViewerCertificate: The specified SSL certificate doesn't exist, isn't in us-east-1 region, isn't valid, or doesn't include a valid certificate chain.
+	outputRaw, err := tfresource.RetryWhenAWSErrCodeEquals(ctx, 1*time.Minute, func() (interface{}, error) {
+		return conn.CreateDistributionWithTagsWithContext(ctx, input)
+	}, cloudfront.ErrCodeInvalidViewerCertificate)
 
 	if err != nil {
 		return sdkdiag.AppendErrorf(diags, "creating CloudFront Distribution: %s", err)
 	}
 
-	d.SetId(aws.StringValue(resp.Distribution.Id))
+	d.SetId(aws.StringValue(outputRaw.(*cloudfront.CreateDistributionWithTagsOutput).Distribution.Id))
 
 	if d.Get("wait_for_deployment").(bool) {
 		log.Printf("[DEBUG] Waiting until CloudFront Distribution (%s) is deployed", d.Id())
-		if err := DistributionWaitUntilDeployed(ctx, d.Id(), meta); err != nil {
+		if err := WaitDistributionDeployed(ctx, conn, d.Id()); err != nil {
 			return sdkdiag.AppendErrorf(diags, "waiting until CloudFront Distribution (%s) is deployed: %s", d.Id(), err)
 		}
 	}
@@ -926,65 +922,52 @@ func resourceDistributionRead(ctx context.Context, d *schema.ResourceData, meta
 func resourceDistributionUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).CloudFrontConn(ctx)
-	params := &cloudfront.UpdateDistributionInput{
-		Id:                 aws.String(d.Id()),
-		DistributionConfig: expandDistributionConfig(d),
-		IfMatch:            aws.String(d.Get("etag").(string)),
-	}
 
-	// Handle eventual consistency issues
-	err := retry.RetryContext(ctx, 1*time.Minute, func() *retry.RetryError {
-		_, err := conn.UpdateDistributionWithContext(ctx, params)
+	if d.HasChangesExcept("tags", "tags_all") {
+		input := &cloudfront.UpdateDistributionInput{
+			Id:                 aws.String(d.Id()),
+			DistributionConfig: expandDistributionConfig(d),
+			IfMatch:            aws.String(d.Get("etag").(string)),
+		}
 
-		// ACM and IAM certificate eventual consistency
+		// ACM and IAM certificate eventual consistency.
 		// InvalidViewerCertificate: The specified SSL certificate doesn't exist, isn't in us-east-1 region, isn't valid, or doesn't include a valid certificate chain.
-		if tfawserr.ErrCodeEquals(err, cloudfront.ErrCodeInvalidViewerCertificate) {
-			return retry.RetryableError(err)
-		}
+		_, err := tfresource.RetryWhenAWSErrCodeEquals(ctx, 1*time.Minute, func() (interface{}, error) {
+			return conn.UpdateDistributionWithContext(ctx, input)
+		}, cloudfront.ErrCodeInvalidViewerCertificate)
 
-		if err != nil {
-			return retry.NonRetryableError(err)
-		}
+		// Refresh our ETag if it is out of date and attempt update again.
+		if tfawserr.ErrCodeEquals(err, cloudfront.ErrCodePreconditionFailed) {
+			getDistributionInput := &cloudfront.GetDistributionInput{
+				Id: aws.String(d.Id()),
+			}
+			var getDistributionOutput *cloudfront.GetDistributionOutput
 
-		return nil
-	})
+			log.Printf("[DEBUG] Refreshing CloudFront Distribution (%s) ETag", d.Id())
+			getDistributionOutput, err = conn.GetDistributionWithContext(ctx, getDistributionInput)
 
-	// Refresh our ETag if it is out of date and attempt update again
-	if tfawserr.ErrCodeEquals(err, cloudfront.ErrCodePreconditionFailed) {
-		getDistributionInput := &cloudfront.GetDistributionInput{
-			Id: aws.String(d.Id()),
-		}
-		var getDistributionOutput *cloudfront.GetDistributionOutput
+			if err != nil {
+				return sdkdiag.AppendErrorf(diags, "refreshing CloudFront Distribution (%s) ETag: %s", d.Id(), err)
+			}
 
-		log.Printf("[DEBUG] Refreshing CloudFront Distribution (%s) ETag", d.Id())
-		getDistributionOutput, err = conn.GetDistributionWithContext(ctx, getDistributionInput)
+			if getDistributionOutput == nil {
+				return sdkdiag.AppendErrorf(diags, "refreshing CloudFront Distribution (%s) ETag: empty response", d.Id())
+			}
 
-		if err != nil {
-			return sdkdiag.AppendErrorf(diags, "refreshing CloudFront Distribution (%s) ETag: %s", d.Id(), err)
-		}
+			input.IfMatch = getDistributionOutput.ETag
 
-		if getDistributionOutput == nil {
-			return sdkdiag.AppendErrorf(diags, "refreshing CloudFront Distribution (%s) ETag: empty response", d.Id())
+			_, err = conn.UpdateDistributionWithContext(ctx, input)
 		}
 
-		params.IfMatch = getDistributionOutput.ETag
-
-		_, err = conn.UpdateDistributionWithContext(ctx, params)
-	}
-
-	// Propagate AWS Go SDK retried error, if any
-	if tfresource.TimedOut(err) {
-		_, err = conn.UpdateDistributionWithContext(ctx, params)
-	}
-
-	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "updating CloudFront Distribution (%s): %s", d.Id(), err)
-	}
+		if err != nil {
+			return sdkdiag.AppendErrorf(diags, "updating CloudFront Distribution (%s): %s", d.Id(), err)
+		}
 
-	if d.Get("wait_for_deployment").(bool) {
-		log.Printf("[DEBUG] Waiting until CloudFront Distribution (%s) is deployed", d.Id())
-		if err := DistributionWaitUntilDeployed(ctx, d.Id(), meta); err != nil {
-			return sdkdiag.AppendErrorf(diags, "waiting until CloudFront Distribution (%s) is deployed: %s", d.Id(), err)
+		if d.Get("wait_for_deployment").(bool) {
+			log.Printf("[DEBUG] Waiting until CloudFront Distribution (%s) is deployed", d.Id())
+			if err := WaitDistributionDeployed(ctx, conn, d.Id()); err != nil {
+				return sdkdiag.AppendErrorf(diags, "waiting until CloudFront Distribution (%s) is deployed: %s", d.Id(), err)
+			}
 		}
 	}
 
@@ -995,114 +978,141 @@ func resourceDistributionDelete(ctx context.Context, d *schema.ResourceData, met
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).CloudFrontConn(ctx)
 
-	if d.Get("retain_on_delete").(bool) {
-		// Check if we need to disable first.
-		output, err := FindDistributionByID(ctx, conn, d.Id())
-
-		if err != nil {
-			return sdkdiag.AppendErrorf(diags, "reading CloudFront Distribution (%s): %s", d.Id(), err)
-		}
+	if d.Get("arn").(string) == "" {
+		diags = append(diags, resourceDistributionRead(ctx, d, meta)...)
+	}
 
-		if !aws.BoolValue(output.Distribution.DistributionConfig.Enabled) {
-			log.Printf("[WARN] Removing CloudFront Distribution ID %q with `retain_on_delete` set. Please delete this distribution manually.", d.Id())
-			return diags
+	if v := d.Get("continuous_deployment_policy_id").(string); v != "" {
+		if err := disableContinuousDeploymentPolicy(ctx, conn, v); err != nil {
+			return create.DiagError(names.CloudFront, create.ErrActionDeleting, ResNameDistribution, d.Id(), err)
 		}
 
-		input := &cloudfront.UpdateDistributionInput{
-			DistributionConfig: output.Distribution.DistributionConfig,
-			Id:                 aws.String(d.Id()),
-			IfMatch:            output.ETag,
+		if err := WaitDistributionDeployed(ctx, conn, d.Id()); err != nil && !tfresource.NotFound(err) {
+			return diag.Errorf("waiting until CloudFront Distribution (%s) is deployed: %s", d.Id(), err)
 		}
-		input.DistributionConfig.Enabled = aws.Bool(false)
-
-		_, err = conn.UpdateDistributionWithContext(ctx, input)
+	}
 
-		if err != nil {
-			return sdkdiag.AppendErrorf(diags, "disabling CloudFront Distribution (%s): %s", d.Id(), err)
-		}
+	if err := disableDistribution(ctx, conn, d.Id()); err != nil {
+		return diag.Errorf("disabling CloudFront Distribution (%s): %s", d.Id(), err)
+	}
 
+	if d.Get("retain_on_delete").(bool) {
 		log.Printf("[WARN] Removing CloudFront Distribution ID %q with `retain_on_delete` set. Please delete this distribution manually.", d.Id())
 		return diags
 	}
 
-	deleteDistroInput := &cloudfront.DeleteDistributionInput{
-		Id:      aws.String(d.Id()),
-		IfMatch: aws.String(d.Get("etag").(string)),
+	err := deleteDistribution(ctx, conn, d.Id())
+	if err == nil || tfawserr.ErrCodeEquals(err, cloudfront.ErrCodeNoSuchDistribution) {
+		return diags
 	}
 
-	log.Printf("[DEBUG] Deleting CloudFront Distribution: %s", d.Id())
-	_, err := conn.DeleteDistributionWithContext(ctx, deleteDistroInput)
+	// Disable distribution if it is not yet disabled and attempt deletion again.
+	// Here we update via the deployed configuration to ensure we are not submitting an out of date
+	// configuration from the Terraform configuration, should other changes have occurred manually.
+	if tfawserr.ErrCodeEquals(err, cloudfront.ErrCodeDistributionNotDisabled) {
+		if err = disableDistribution(ctx, conn, d.Id()); err != nil {
+			return diag.Errorf("disabling CloudFront Distribution (%s): %s", d.Id(), err)
+		}
 
-	if err == nil || tfawserr.ErrCodeEquals(err, cloudfront.ErrCodeNoSuchDistribution) {
-		return diags
+		_, err = tfresource.RetryWhenAWSErrCodeEquals(ctx, 3*time.Minute, func() (interface{}, error) {
+			return nil, deleteDistribution(ctx, conn, d.Id())
+		}, cloudfront.ErrCodeDistributionNotDisabled)
+	}
+
+	if tfawserr.ErrCodeEquals(err, cloudfront.ErrCodePreconditionFailed, cloudfront.ErrCodeInvalidIfMatchVersion) {
+		_, err = tfresource.RetryWhenAWSErrCodeEquals(ctx, 1*time.Minute, func() (interface{}, error) {
+			return nil, deleteDistribution(ctx, conn, d.Id())
+		}, cloudfront.ErrCodePreconditionFailed, cloudfront.ErrCodeInvalidIfMatchVersion)
 	}
 
-	// Refresh our ETag if it is out of date and attempt deletion again.
-	if tfawserr.ErrCodeEquals(err, cloudfront.ErrCodeInvalidIfMatchVersion) {
-		var output *cloudfront.GetDistributionOutput
-		output, err = FindDistributionByID(ctx, conn, d.Id())
+	if tfawserr.ErrCodeEquals(err, cloudfront.ErrCodeNoSuchDistribution) {
+		return diags
+	}
 
-		if err != nil {
-			return sdkdiag.AppendErrorf(diags, "reading CloudFront Distribution (%s): %s", d.Id(), err)
+	if tfawserr.ErrCodeEquals(err, cloudfront.ErrCodeDistributionNotDisabled) {
+		if err = disableDistribution(ctx, conn, d.Id()); err != nil {
+			return diag.Errorf("disabling CloudFront Distribution (%s): %s", d.Id(), err)
 		}
 
-		deleteDistroInput.IfMatch = output.ETag
+		err = deleteDistribution(ctx, conn, d.Id())
+	}
 
-		_, err = conn.DeleteDistributionWithContext(ctx, deleteDistroInput)
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "deleting CloudFront Distribution (%s): %s", d.Id(), err)
 	}
 
-	// Disable distribution if it is not yet disabled and attempt deletion again.
-	// Here we update via the deployed configuration to ensure we are not submitting an out of date
-	// configuration from the Terraform configuration, should other changes have occurred manually.
-	if tfawserr.ErrCodeEquals(err, cloudfront.ErrCodeDistributionNotDisabled) {
-		var output *cloudfront.GetDistributionOutput
-		output, err = FindDistributionByID(ctx, conn, d.Id())
+	return diags
+}
 
-		if err != nil {
-			return sdkdiag.AppendErrorf(diags, "reading CloudFront Distribution (%s): %s", d.Id(), err)
-		}
+func deleteDistribution(ctx context.Context, conn *cloudfront.CloudFront, id string) error {
+	etag, err := distroETag(ctx, conn, id)
+	if err != nil {
+		return err
+	}
 
-		updateDistroInput := &cloudfront.UpdateDistributionInput{
-			DistributionConfig: output.Distribution.DistributionConfig,
-			Id:                 aws.String(d.Id()),
-			IfMatch:            output.ETag,
-		}
-		updateDistroInput.DistributionConfig.Enabled = aws.Bool(false)
-		var updateDistroOutput *cloudfront.UpdateDistributionOutput
+	in := &cloudfront.DeleteDistributionInput{
+		Id:      aws.String(id),
+		IfMatch: aws.String(etag),
+	}
 
-		updateDistroOutput, err = conn.UpdateDistributionWithContext(ctx, updateDistroInput)
+	if _, err := conn.DeleteDistributionWithContext(ctx, in); err != nil {
+		return err
+	}
 
-		if err != nil {
-			return sdkdiag.AppendErrorf(diags, "disabling CloudFront Distribution (%s): %s", d.Id(), err)
-		}
+	if err := WaitDistributionDeleted(ctx, conn, id); err != nil {
+		return err
+	}
 
-		if err := DistributionWaitUntilDeployed(ctx, d.Id(), meta); err != nil {
-			return sdkdiag.AppendErrorf(diags, "waiting until CloudFront Distribution (%s) is deployed: %s", d.Id(), err)
-		}
+	return nil
+}
+
+func distroETag(ctx context.Context, conn *cloudfront.CloudFront, id string) (string, error) {
+	output, err := FindDistributionByID(ctx, conn, id)
+	if err != nil {
+		return "", err
+	}
+
+	return aws.StringValue(output.ETag), nil
+}
 
-		deleteDistroInput.IfMatch = updateDistroOutput.ETag
+func disableDistribution(ctx context.Context, conn *cloudfront.CloudFront, id string) error {
+	out, err := FindDistributionByID(ctx, conn, id)
+	if err != nil {
+		return err
+	}
 
-		_, err = conn.DeleteDistributionWithContext(ctx, deleteDistroInput)
+	if aws.StringValue(out.Distribution.Status) == "InProgress" {
+		if err := WaitDistributionDeployed(ctx, conn, id); err != nil {
+			return err
+		}
 
-		// CloudFront has eventual consistency issues even for "deployed" state.
-		// Occasionally the DeleteDistribution call will return this error as well, in which retries will succeed:
-		//   * PreconditionFailed: The request failed because it didn't meet the preconditions in one or more request-header fields
-		if tfawserr.ErrCodeEquals(err, cloudfront.ErrCodeDistributionNotDisabled, cloudfront.ErrCodePreconditionFailed) {
-			_, err = tfresource.RetryWhenAWSErrCodeEquals(ctx, 2*time.Minute, func() (interface{}, error) {
-				return conn.DeleteDistributionWithContext(ctx, deleteDistroInput)
-			}, cloudfront.ErrCodeDistributionNotDisabled, cloudfront.ErrCodePreconditionFailed)
+		out, err = FindDistributionByID(ctx, conn, id)
+		if err != nil {
+			return err
 		}
 	}
 
-	if tfawserr.ErrCodeEquals(err, cloudfront.ErrCodeNoSuchDistribution) {
-		return diags
+	if !aws.BoolValue(out.Distribution.DistributionConfig.Enabled) {
+		return nil
+	}
+
+	in := &cloudfront.UpdateDistributionInput{
+		DistributionConfig: out.Distribution.DistributionConfig,
+		Id:                 aws.String(id),
+		IfMatch:            out.ETag,
 	}
+	in.DistributionConfig.Enabled = aws.Bool(false)
 
+	_, err = conn.UpdateDistributionWithContext(ctx, in)
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "deleting CloudFront Distribution (%s): %s", d.Id(), err)
+		return err
 	}
 
-	return diags
+	if err := WaitDistributionDeployed(ctx, conn, id); err != nil {
+		return err
+	}
+
+	return nil
 }
 
 func FindDistributionByID(ctx context.Context, conn *cloudfront.CloudFront, id string) (*cloudfront.GetDistributionOutput, error) {
@@ -1133,38 +1143,64 @@ func FindDistributionByID(ctx context.Context, conn *cloudfront.CloudFront, id s
 // resourceAwsCloudFrontWebDistributionWaitUntilDeployed blocks until the
 // distribution is deployed. It currently takes exactly 15 minutes to deploy
 // but that might change in the future.
-func DistributionWaitUntilDeployed(ctx context.Context, id string, meta interface{}) error {
+func WaitDistributionDeployed(ctx context.Context, conn *cloudfront.CloudFront, id string) error {
 	stateConf := &retry.StateChangeConf{
 		Pending:    []string{"InProgress"},
 		Target:     []string{"Deployed"},
-		Refresh:    resourceWebDistributionStateRefreshFunc(ctx, id, meta),
+		Refresh:    distributionDeployRefreshFunc(ctx, conn, id),
+		Timeout:    90 * time.Minute,
+		MinTimeout: 15 * time.Second,
+		Delay:      30 * time.Second,
+	}
+
+	_, err := stateConf.WaitForStateContext(ctx)
+	return err
+}
+
+func WaitDistributionDeleted(ctx context.Context, conn *cloudfront.CloudFront, id string) error {
+	stateConf := &retry.StateChangeConf{
+		Pending:    []string{"InProgress", "Deployed"},
+		Target:     []string{},
+		Refresh:    distributionDeleteRefreshFunc(ctx, conn, id),
 		Timeout:    90 * time.Minute,
 		MinTimeout: 15 * time.Second,
-		Delay:      1 * time.Minute,
+		Delay:      15 * time.Second,
 	}
 
 	_, err := stateConf.WaitForStateContext(ctx)
 	return err
 }
 
-// The refresh function for resourceAwsCloudFrontWebDistributionWaitUntilDeployed.
-func resourceWebDistributionStateRefreshFunc(ctx context.Context, id string, meta interface{}) retry.StateRefreshFunc {
+func distributionDeleteRefreshFunc(ctx context.Context, conn *cloudfront.CloudFront, id string) retry.StateRefreshFunc {
 	return func() (interface{}, string, error) {
-		conn := meta.(*conns.AWSClient).CloudFrontConn(ctx)
-		params := &cloudfront.GetDistributionInput{
-			Id: aws.String(id),
+		out, err := FindDistributionByID(ctx, conn, id)
+		if tfresource.NotFound(err) {
+			return nil, "", nil
 		}
 
-		resp, err := conn.GetDistributionWithContext(ctx, params)
 		if err != nil {
-			log.Printf("[WARN] Error retrieving CloudFront Distribution %q details: %s", id, err)
 			return nil, "", err
 		}
 
-		if resp == nil {
+		if out == nil {
+			return nil, "", nil
+		}
+
+		return out.Distribution, aws.StringValue(out.Distribution.Status), nil
+	}
+}
+
+func distributionDeployRefreshFunc(ctx context.Context, conn *cloudfront.CloudFront, id string) retry.StateRefreshFunc {
+	return func() (interface{}, string, error) {
+		out, err := FindDistributionByID(ctx, conn, id)
+		if err != nil {
+			return nil, "", err
+		}
+
+		if out == nil {
 			return nil, "", nil
 		}
 
-		return resp.Distribution, *resp.Distribution.Status, nil
+		return out.Distribution, aws.StringValue(out.Distribution.Status), nil
 	}
 }
diff --git a/internal/service/cloudfront/distribution_configuration_structure.go b/internal/service/cloudfront/distribution_configuration_structure.go
index 2658322e904..f7a2e0e7448 100644
--- a/internal/service/cloudfront/distribution_configuration_structure.go
+++ b/internal/service/cloudfront/distribution_configuration_structure.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 // CloudFront DistributionConfig structure helpers.
 //
 // These functions assist in pulling in data from Terraform resource
@@ -28,18 +31,20 @@ import (
 // Used by the aws_cloudfront_distribution Create and Update functions.
 func expandDistributionConfig(d *schema.ResourceData) *cloudfront.DistributionConfig {
 	distributionConfig := &cloudfront.DistributionConfig{
-		CacheBehaviors:       expandCacheBehaviors(d.Get("ordered_cache_behavior").([]interface{})),
-		CallerReference:      aws.String(id.UniqueId()),
-		Comment:              aws.String(d.Get("comment").(string)),
-		CustomErrorResponses: ExpandCustomErrorResponses(d.Get("custom_error_response").(*schema.Set)),
-		DefaultCacheBehavior: ExpandDefaultCacheBehavior(d.Get("default_cache_behavior").([]interface{})[0].(map[string]interface{})),
-		DefaultRootObject:    aws.String(d.Get("default_root_object").(string)),
-		Enabled:              aws.Bool(d.Get("enabled").(bool)),
-		IsIPV6Enabled:        aws.Bool(d.Get("is_ipv6_enabled").(bool)),
-		HttpVersion:          aws.String(d.Get("http_version").(string)),
-		Origins:              ExpandOrigins(d.Get("origin").(*schema.Set)),
-		PriceClass:           aws.String(d.Get("price_class").(string)),
-		WebACLId:             aws.String(d.Get("web_acl_id").(string)),
+		CacheBehaviors:               expandCacheBehaviors(d.Get("ordered_cache_behavior").([]interface{})),
+		CallerReference:              aws.String(id.UniqueId()),
+		Comment:                      aws.String(d.Get("comment").(string)),
+		ContinuousDeploymentPolicyId: aws.String(d.Get("continuous_deployment_policy_id").(string)),
+		CustomErrorResponses:         ExpandCustomErrorResponses(d.Get("custom_error_response").(*schema.Set)),
+		DefaultCacheBehavior:         ExpandDefaultCacheBehavior(d.Get("default_cache_behavior").([]interface{})[0].(map[string]interface{})),
+		DefaultRootObject:            aws.String(d.Get("default_root_object").(string)),
+		Enabled:                      aws.Bool(d.Get("enabled").(bool)),
+		IsIPV6Enabled:                aws.Bool(d.Get("is_ipv6_enabled").(bool)),
+		HttpVersion:                  aws.String(d.Get("http_version").(string)),
+		Origins:                      ExpandOrigins(d.Get("origin").(*schema.Set)),
+		PriceClass:                   aws.String(d.Get("price_class").(string)),
+		Staging:                      aws.Bool(d.Get("staging").(bool)),
+		WebACLId:                     aws.String(d.Get("web_acl_id").(string)),
 	}
 
 	// This sets CallerReference if it's still pending computation (ie: new resource)
@@ -99,8 +104,14 @@ func flattenDistributionConfig(d *schema.ResourceData, distributionConfig *cloud
 	}
 	d.Set("default_root_object", distributionConfig.DefaultRootObject)
 	d.Set("http_version", distributionConfig.HttpVersion)
+	d.Set("staging", distributionConfig.Staging)
 	d.Set("web_acl_id", distributionConfig.WebACLId)
 
+	// Not having this set for staging distributions causes IllegalUpdate errors when making updates of any kind.
+	// If this absolutely must not be optional/computed, the policy ID will need to be retrieved and set for each
+	// API call for staging distributions.
+	d.Set("continuous_deployment_policy_id", distributionConfig.ContinuousDeploymentPolicyId)
+
 	if distributionConfig.CustomErrorResponses != nil {
 		err = d.Set("custom_error_response", FlattenCustomErrorResponses(distributionConfig.CustomErrorResponses))
 		if err != nil {
diff --git a/internal/service/cloudfront/distribution_configuration_structure_test.go b/internal/service/cloudfront/distribution_configuration_structure_test.go
index 586100fc245..e00abe7e0f1 100644
--- a/internal/service/cloudfront/distribution_configuration_structure_test.go
+++ b/internal/service/cloudfront/distribution_configuration_structure_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudfront_test
 
 import (
diff --git a/internal/service/cloudfront/distribution_data_source.go b/internal/service/cloudfront/distribution_data_source.go
index 2f2ae6ad9e7..cf63eac7769 100644
--- a/internal/service/cloudfront/distribution_data_source.go
+++ b/internal/service/cloudfront/distribution_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudfront
 
 import (
@@ -58,7 +61,10 @@ func DataSourceDistribution() *schema.Resource {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
-
+			"web_acl_id": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
 			"tags": tftags.TagsSchema(),
 		},
 	}
@@ -86,6 +92,7 @@ func dataSourceDistributionRead(ctx context.Context, d *schema.ResourceData, met
 		d.Set("hosted_zone_id", meta.(*conns.AWSClient).CloudFrontDistributionHostedZoneID())
 		if distributionConfig := distribution.DistributionConfig; distributionConfig != nil {
 			d.Set("enabled", distributionConfig.Enabled)
+			d.Set("web_acl_id", distributionConfig.WebACLId)
 			if aliases := distributionConfig.Aliases; aliases != nil {
 				d.Set("aliases", aliases.Items)
 			}
diff --git a/internal/service/cloudfront/distribution_data_source_test.go b/internal/service/cloudfront/distribution_data_source_test.go
index e8ecf7b3d49..ad3431264ff 100644
--- a/internal/service/cloudfront/distribution_data_source_test.go
+++ b/internal/service/cloudfront/distribution_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudfront_test
 
 import (
@@ -28,6 +31,7 @@ func TestAccCloudFrontDistributionDataSource_basic(t *testing.T) {
 					resource.TestCheckResourceAttrPair(dataSourceName, "in_progress_validation_batches", resourceName, "in_progress_validation_batches"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "last_modified_time", resourceName, "last_modified_time"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "status", resourceName, "status"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "web_acl_id", resourceName, "web_acl_id"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "aliases.#", resourceName, "aliases.#"),
 				),
 			},
diff --git a/internal/service/cloudfront/distribution_migrate.go b/internal/service/cloudfront/distribution_migrate.go
index 9aff2a78974..5f95a74fb95 100644
--- a/internal/service/cloudfront/distribution_migrate.go
+++ b/internal/service/cloudfront/distribution_migrate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudfront
 
 import (
diff --git a/internal/service/cloudfront/distribution_migrate_test.go b/internal/service/cloudfront/distribution_migrate_test.go
index 21bc925e7d3..0d90b2fb455 100644
--- a/internal/service/cloudfront/distribution_migrate_test.go
+++ b/internal/service/cloudfront/distribution_migrate_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudfront_test
 
 import (
diff --git a/internal/service/cloudfront/distribution_test.go b/internal/service/cloudfront/distribution_test.go
index 6c69d4d8b37..5c61eaf8e4a 100644
--- a/internal/service/cloudfront/distribution_test.go
+++ b/internal/service/cloudfront/distribution_test.go
@@ -1,13 +1,16 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudfront_test
 
 import (
 	"context"
 	"fmt"
 	"os"
-	"regexp"
 	"testing"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/cloudfront"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -219,7 +222,7 @@ func TestAccCloudFrontDistribution_originPolicyDefault(t *testing.T) {
 			{
 				Config: testAccDistributionConfig_originRequestPolicyDefault(rName),
 				Check: resource.ComposeTestCheckFunc(
-					resource.TestMatchResourceAttr("aws_cloudfront_distribution.custom_distribution", "default_cache_behavior.0.origin_request_policy_id", regexp.MustCompile("[A-z0-9]+")),
+					resource.TestMatchResourceAttr("aws_cloudfront_distribution.custom_distribution", "default_cache_behavior.0.origin_request_policy_id", regexache.MustCompile("[0-9A-z]+")),
 				),
 			},
 			{
@@ -252,7 +255,7 @@ func TestAccCloudFrontDistribution_originPolicyOrdered(t *testing.T) {
 			{
 				Config: testAccDistributionConfig_originRequestPolicyOrdered(rName),
 				Check: resource.ComposeTestCheckFunc(
-					resource.TestMatchResourceAttr("aws_cloudfront_distribution.custom_distribution", "ordered_cache_behavior.0.origin_request_policy_id", regexp.MustCompile("[A-z0-9]+")),
+					resource.TestMatchResourceAttr("aws_cloudfront_distribution.custom_distribution", "ordered_cache_behavior.0.origin_request_policy_id", regexache.MustCompile("[0-9A-Za-z]+")),
 				),
 			},
 			{
@@ -377,7 +380,7 @@ func TestAccCloudFrontDistribution_orderedCacheBehaviorCachePolicy(t *testing.T)
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDistributionExists(ctx, resourceName, &distribution),
 					resource.TestCheckResourceAttr(resourceName, "ordered_cache_behavior.0.path_pattern", "images2/*.jpg"),
-					resource.TestMatchResourceAttr(resourceName, "ordered_cache_behavior.0.cache_policy_id", regexp.MustCompile(`^[a-z0-9]+`)),
+					resource.TestMatchResourceAttr(resourceName, "ordered_cache_behavior.0.cache_policy_id", regexache.MustCompile(`^[0-9a-z]+`)),
 				),
 			},
 			{
@@ -414,7 +417,7 @@ func TestAccCloudFrontDistribution_orderedCacheBehaviorResponseHeadersPolicy(t *
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDistributionExists(ctx, resourceName, &distribution),
 					resource.TestCheckResourceAttr(resourceName, "ordered_cache_behavior.0.path_pattern", "images2/*.jpg"),
-					resource.TestMatchResourceAttr(resourceName, "ordered_cache_behavior.0.response_headers_policy_id", regexp.MustCompile(`^[a-z0-9]+`)),
+					resource.TestMatchResourceAttr(resourceName, "ordered_cache_behavior.0.response_headers_policy_id", regexache.MustCompile(`^[0-9a-z]+`)),
 				),
 			},
 			{
@@ -472,7 +475,7 @@ func TestAccCloudFrontDistribution_Origin_emptyDomainName(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccDistributionConfig_originEmptyDomainName(),
-				ExpectError: regexp.MustCompile(`domain_name must not be empty`),
+				ExpectError: regexache.MustCompile(`domain_name must not be empty`),
 			},
 		},
 	})
@@ -488,7 +491,7 @@ func TestAccCloudFrontDistribution_Origin_emptyOriginID(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccDistributionConfig_originEmptyOriginID(),
-				ExpectError: regexp.MustCompile(`origin.0.origin_id must not be empty`),
+				ExpectError: regexache.MustCompile(`origin.0.origin_id must not be empty`),
 			},
 		},
 	})
@@ -512,11 +515,11 @@ func TestAccCloudFrontDistribution_Origin_connectionAttempts(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccDistributionConfig_originItem(rName, `connection_attempts = 0`),
-				ExpectError: regexp.MustCompile(`expected origin.0.connection_attempts to be in the range`),
+				ExpectError: regexache.MustCompile(`expected origin.0.connection_attempts to be in the range`),
 			},
 			{
 				Config:      testAccDistributionConfig_originItem(rName, `connection_attempts = 4`),
-				ExpectError: regexp.MustCompile(`expected origin.0.connection_attempts to be in the range`),
+				ExpectError: regexache.MustCompile(`expected origin.0.connection_attempts to be in the range`),
 			},
 			{
 				Config: testAccDistributionConfig_originItem(rName, `connection_attempts = 2`),
@@ -548,11 +551,11 @@ func TestAccCloudFrontDistribution_Origin_connectionTimeout(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccDistributionConfig_originItem(rName, `connection_timeout = 0`),
-				ExpectError: regexp.MustCompile(`expected origin.0.connection_timeout to be in the range`),
+				ExpectError: regexache.MustCompile(`expected origin.0.connection_timeout to be in the range`),
 			},
 			{
 				Config:      testAccDistributionConfig_originItem(rName, `connection_timeout = 11`),
-				ExpectError: regexp.MustCompile(`expected origin.0.connection_timeout to be in the range`),
+				ExpectError: regexache.MustCompile(`expected origin.0.connection_timeout to be in the range`),
 			},
 			{
 				Config: testAccDistributionConfig_originItem(rName, `connection_timeout = 6`),
@@ -584,23 +587,15 @@ func TestAccCloudFrontDistribution_Origin_originShield(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccDistributionConfig_originItem(rName, originShieldItem(`null`, `data.aws_region.current.name`)),
-				ExpectError: regexp.MustCompile(`Missing required argument`),
-			},
-			{
-				Config:      testAccDistributionConfig_originItem(rName, originShieldItem(`false`, `null`)),
-				ExpectError: regexp.MustCompile(`Missing required argument`),
-			},
-			{
-				Config:      testAccDistributionConfig_originItem(rName, originShieldItem(`true`, `null`)),
-				ExpectError: regexp.MustCompile(`Missing required argument`),
+				ExpectError: regexache.MustCompile(`Missing required argument`),
 			},
 			{
 				Config:      testAccDistributionConfig_originItem(rName, originShieldItem(`false`, `""`)),
-				ExpectError: regexp.MustCompile(`.*must be a valid AWS Region Code.*`),
+				ExpectError: regexache.MustCompile(`.*must be a valid AWS Region Code.*`),
 			},
 			{
 				Config:      testAccDistributionConfig_originItem(rName, originShieldItem(`true`, `"US East (Ohio)"`)),
-				ExpectError: regexp.MustCompile(`.*must be a valid AWS Region Code.*`),
+				ExpectError: regexache.MustCompile(`.*must be a valid AWS Region Code.*`),
 			},
 			{
 				Config: testAccDistributionConfig_originItem(rName, originShieldItem(`true`, `"us-east-1"`)), //lintignore:AWSAT003
@@ -682,7 +677,7 @@ func TestAccCloudFrontDistribution_noOptionalItems(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDistributionExists(ctx, resourceName, &distribution),
 					resource.TestCheckResourceAttr(resourceName, "aliases.#", "0"),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "cloudfront", regexp.MustCompile(`distribution/[A-Z0-9]+$`)),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "cloudfront", regexache.MustCompile(`distribution/[0-9A-Z]+$`)),
 					resource.TestCheckResourceAttr(resourceName, "custom_error_response.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "default_cache_behavior.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "default_cache_behavior.0.allowed_methods.#", "7"),
@@ -703,9 +698,9 @@ func TestAccCloudFrontDistribution_noOptionalItems(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "default_cache_behavior.0.trusted_key_groups.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "default_cache_behavior.0.trusted_signers.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "default_cache_behavior.0.viewer_protocol_policy", "allow-all"),
-					resource.TestMatchResourceAttr(resourceName, "domain_name", regexp.MustCompile(`^[a-z0-9]+\.cloudfront\.net$`)),
+					resource.TestMatchResourceAttr(resourceName, "domain_name", regexache.MustCompile(`^[0-9a-z]+\.cloudfront\.net$`)),
 					resource.TestCheckResourceAttr(resourceName, "enabled", "true"),
-					resource.TestMatchResourceAttr(resourceName, "etag", regexp.MustCompile(`^[A-Z0-9]+$`)),
+					resource.TestMatchResourceAttr(resourceName, "etag", regexache.MustCompile(`^[0-9A-Z]+$`)),
 					resource.TestCheckResourceAttr(resourceName, "hosted_zone_id", "Z2FDTNDATAQYW2"),
 					resource.TestCheckResourceAttrSet(resourceName, "http_version"),
 					resource.TestCheckResourceAttr(resourceName, "is_ipv6_enabled", "false"),
@@ -1637,7 +1632,7 @@ func testAccCheckDistributionDisappears(ctx context.Context, distribution *cloud
 
 func testAccCheckDistributionWaitForDeployment(ctx context.Context, distribution *cloudfront.Distribution) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		return tfcloudfront.DistributionWaitUntilDeployed(ctx, aws.StringValue(distribution.Id), acctest.Provider.Meta())
+		return tfcloudfront.WaitDistributionDeployed(ctx, acctest.Provider.Meta().(*conns.AWSClient).CloudFrontConn(ctx), aws.StringValue(distribution.Id))
 	}
 }
 
@@ -1698,7 +1693,28 @@ resource "aws_s3_bucket" "s3_bucket_origin" {
   bucket = "%[1]s.origin-bucket"
 }
 
+resource "aws_s3_bucket_public_access_block" "s3_bucket_origin" {
+  bucket = aws_s3_bucket.s3_bucket_origin.id
+
+  block_public_acls       = false
+  block_public_policy     = false
+  ignore_public_acls      = false
+  restrict_public_buckets = false
+}
+
+resource "aws_s3_bucket_ownership_controls" "s3_bucket_origin" {
+  bucket = aws_s3_bucket.s3_bucket_origin.id
+  rule {
+    object_ownership = "BucketOwnerPreferred"
+  }
+}
+
 resource "aws_s3_bucket_acl" "s3_bucket_origin_acl" {
+  depends_on = [
+    aws_s3_bucket_public_access_block.s3_bucket_origin,
+    aws_s3_bucket_ownership_controls.s3_bucket_origin,
+  ]
+
   bucket = aws_s3_bucket.s3_bucket_origin.id
   acl    = "public-read"
 }
@@ -1711,7 +1727,28 @@ resource "aws_s3_bucket" "s3_backup_bucket_origin" {
   bucket = "%[1]s.backup-bucket"
 }
 
+resource "aws_s3_bucket_public_access_block" "s3_backup_bucket_origin" {
+  bucket = aws_s3_bucket.s3_backup_bucket_origin.id
+
+  block_public_acls       = false
+  block_public_policy     = false
+  ignore_public_acls      = false
+  restrict_public_buckets = false
+}
+
+resource "aws_s3_bucket_ownership_controls" "s3_backup_bucket_origin" {
+  bucket = aws_s3_bucket.s3_backup_bucket_origin.id
+  rule {
+    object_ownership = "BucketOwnerPreferred"
+  }
+}
+
 resource "aws_s3_bucket_acl" "s3_backup_bucket_origin_acl" {
+  depends_on = [
+    aws_s3_bucket_public_access_block.s3_backup_bucket_origin,
+    aws_s3_bucket_ownership_controls.s3_backup_bucket_origin,
+  ]
+
   bucket = aws_s3_bucket.s3_backup_bucket_origin.id
   acl    = "public-read"
 }
@@ -1725,7 +1762,29 @@ resource "aws_s3_bucket" "s3_bucket_logs" {
   force_destroy = true
 }
 
+resource "aws_s3_bucket_public_access_block" "s3_bucket_logs" {
+  bucket = aws_s3_bucket.s3_bucket_logs.id
+
+  block_public_acls       = false
+  block_public_policy     = false
+  ignore_public_acls      = false
+  restrict_public_buckets = false
+}
+
+resource "aws_s3_bucket_ownership_controls" "s3_bucket_logs" {
+  bucket = aws_s3_bucket.s3_bucket_logs.id
+  rule {
+    object_ownership = "BucketOwnerPreferred"
+  }
+}
+
+
 resource "aws_s3_bucket_acl" "s3_bucket_logs_acl" {
+  depends_on = [
+    aws_s3_bucket_public_access_block.s3_bucket_logs,
+    aws_s3_bucket_ownership_controls.s3_bucket_logs,
+  ]
+
   bucket = aws_s3_bucket.s3_bucket_logs.id
   acl    = "public-read"
 }
@@ -1738,6 +1797,11 @@ func testAccDistributionConfig_s3(rName string) string {
 		logBucket(rName),
 		fmt.Sprintf(`
 resource "aws_cloudfront_distribution" "s3_distribution" {
+  depends_on = [
+    aws_s3_bucket_acl.s3_bucket_origin_acl,
+    aws_s3_bucket_acl.s3_bucket_logs_acl,
+  ]
+
   origin {
     domain_name = aws_s3_bucket.s3_bucket_origin.bucket_regional_domain_name
     origin_id   = "myS3Origin"
@@ -1895,6 +1959,8 @@ func testAccDistributionConfig_custom(rName string) string {
 		logBucket(rName),
 		fmt.Sprintf(`
 resource "aws_cloudfront_distribution" "custom_distribution" {
+  depends_on = [aws_s3_bucket_acl.s3_bucket_logs_acl]
+
   origin {
     domain_name = "www.example.com"
     origin_id   = "myCustomOrigin"
@@ -2036,6 +2102,8 @@ resource "aws_cloudfront_origin_request_policy" "test_policy" {
 }
 
 resource "aws_cloudfront_distribution" "custom_distribution" {
+  depends_on = [aws_s3_bucket_acl.s3_bucket_logs_acl]
+
   origin {
     domain_name = "www.example.com"
     origin_id   = "myCustomOrigin"
@@ -2170,6 +2238,8 @@ resource "aws_cloudfront_origin_request_policy" "test_policy" {
 }
 
 resource "aws_cloudfront_distribution" "custom_distribution" {
+  depends_on = [aws_s3_bucket_acl.s3_bucket_logs_acl]
+
   origin {
     domain_name = "www.example.com"
     origin_id   = "myCustomOrigin"
@@ -2245,6 +2315,11 @@ func testAccDistributionConfig_multiOrigin(rName string) string {
 		logBucket(rName),
 		fmt.Sprintf(`
 resource "aws_cloudfront_distribution" "multi_origin_distribution" {
+  depends_on = [
+    aws_s3_bucket_acl.s3_bucket_origin_acl,
+    aws_s3_bucket_acl.s3_bucket_logs_acl,
+  ]
+
   origin {
     domain_name = aws_s3_bucket.s3_bucket_origin.bucket_regional_domain_name
     origin_id   = "myS3Origin"
@@ -2966,6 +3041,11 @@ func testAccDistributionConfig_originGroups(rName string) string {
 		backupBucket(rName),
 		fmt.Sprintf(`
 resource "aws_cloudfront_distribution" "failover_distribution" {
+  depends_on = [
+    aws_s3_bucket_acl.s3_bucket_origin_acl,
+    aws_s3_bucket_acl.s3_backup_bucket_origin_acl,
+  ]
+
   origin {
     domain_name = aws_s3_bucket.s3_bucket_origin.bucket_regional_domain_name
     origin_id   = "primaryS3"
@@ -3990,6 +4070,8 @@ func testAccDistributionConfig_originItem(rName string, item string) string {
 data "aws_region" "current" {}
 
 resource "aws_cloudfront_distribution" "test" {
+  depends_on = [aws_s3_bucket_acl.s3_bucket_origin_acl]
+
   origin {
     domain_name = aws_s3_bucket.s3_bucket_origin.bucket_regional_domain_name
     origin_id   = "myOrigin"
@@ -4104,6 +4186,8 @@ resource "aws_cloudfront_origin_request_policy" "test_policy" {
 }
 
 resource "aws_cloudfront_distribution" "main" {
+  depends_on = [aws_s3_bucket_acl.s3_bucket_logs_acl]
+
   origin {
     domain_name = "www.example.com"
     origin_id   = "myCustomOrigin"
@@ -4238,6 +4322,8 @@ resource "aws_cloudfront_origin_request_policy" "test_policy" {
 }
 
 resource "aws_cloudfront_distribution" "main" {
+  depends_on = [aws_s3_bucket_acl.s3_bucket_logs_acl]
+
   origin {
     domain_name = "www.example.com"
     origin_id   = "myCustomOrigin"
@@ -4372,6 +4458,8 @@ resource "aws_cloudfront_origin_request_policy" "test_policy" {
 }
 
 resource "aws_cloudfront_distribution" "main" {
+  depends_on = [aws_s3_bucket_acl.s3_bucket_logs_acl]
+
   origin {
     domain_name = "www.example.com"
     origin_id   = "myCustomOrigin"
@@ -4446,6 +4534,11 @@ resource "aws_cloudfront_origin_access_control" "test" {
 }
 
 resource "aws_cloudfront_distribution" "test" {
+  depends_on = [
+    aws_s3_bucket_acl.s3_bucket_origin_acl,
+    aws_s3_bucket_acl.s3_bucket_logs_acl,
+  ]
+
   origin {
     domain_name = aws_s3_bucket.s3_bucket_origin.bucket_regional_domain_name
     origin_id   = "myS3Origin"
diff --git a/internal/service/cloudfront/exports_test.go b/internal/service/cloudfront/exports_test.go
new file mode 100644
index 00000000000..f9288ed2e5d
--- /dev/null
+++ b/internal/service/cloudfront/exports_test.go
@@ -0,0 +1,11 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package cloudfront
+
+// Exports for use in tests only.
+var (
+	ResourceContinuousDeploymentPolicy = newResourceContinuousDeploymentPolicy
+
+	FindPublicKeyByID = findPublicKeyByID
+)
diff --git a/internal/service/cloudfront/field_level_encryption_config.go b/internal/service/cloudfront/field_level_encryption_config.go
index d16673650e6..3ad35c46e38 100644
--- a/internal/service/cloudfront/field_level_encryption_config.go
+++ b/internal/service/cloudfront/field_level_encryption_config.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudfront
 
 import (
diff --git a/internal/service/cloudfront/field_level_encryption_config_test.go b/internal/service/cloudfront/field_level_encryption_config_test.go
index a3000f23192..8b99d4e3a37 100644
--- a/internal/service/cloudfront/field_level_encryption_config_test.go
+++ b/internal/service/cloudfront/field_level_encryption_config_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudfront_test
 
 import (
diff --git a/internal/service/cloudfront/field_level_encryption_profile.go b/internal/service/cloudfront/field_level_encryption_profile.go
index 8b8eb5e0604..0a42d3d5a44 100644
--- a/internal/service/cloudfront/field_level_encryption_profile.go
+++ b/internal/service/cloudfront/field_level_encryption_profile.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudfront
 
 import (
diff --git a/internal/service/cloudfront/field_level_encryption_profile_test.go b/internal/service/cloudfront/field_level_encryption_profile_test.go
index c32430cde1c..1d64a5cced6 100644
--- a/internal/service/cloudfront/field_level_encryption_profile_test.go
+++ b/internal/service/cloudfront/field_level_encryption_profile_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudfront_test
 
 import (
diff --git a/internal/service/cloudfront/find.go b/internal/service/cloudfront/find.go
index 4a1223733a7..984389bc31f 100644
--- a/internal/service/cloudfront/find.go
+++ b/internal/service/cloudfront/find.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudfront
 
 import (
@@ -118,7 +121,7 @@ func FindMonitoringSubscriptionByDistributionID(ctx context.Context, conn *cloud
 
 	output, err := conn.GetMonitoringSubscriptionWithContext(ctx, input)
 
-	if tfawserr.ErrCodeEquals(err, cloudfront.ErrCodeNoSuchDistribution) {
+	if tfawserr.ErrCodeEquals(err, cloudfront.ErrCodeNoSuchDistribution, cloudfront.ErrCodeNoSuchMonitoringSubscription) {
 		return nil, &retry.NotFoundError{
 			LastError:   err,
 			LastRequest: input,
diff --git a/internal/service/cloudfront/forge.go b/internal/service/cloudfront/forge.go
index 50229c0a269..4343b4143bb 100644
--- a/internal/service/cloudfront/forge.go
+++ b/internal/service/cloudfront/forge.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudfront
 
 import (
diff --git a/internal/service/cloudfront/function.go b/internal/service/cloudfront/function.go
index 409bd5ae68d..c9ec3475dfb 100644
--- a/internal/service/cloudfront/function.go
+++ b/internal/service/cloudfront/function.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudfront
 
 import (
diff --git a/internal/service/cloudfront/function_data_source.go b/internal/service/cloudfront/function_data_source.go
index 7cbe182d309..5cfa12a638f 100644
--- a/internal/service/cloudfront/function_data_source.go
+++ b/internal/service/cloudfront/function_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudfront
 
 import (
diff --git a/internal/service/cloudfront/function_data_source_test.go b/internal/service/cloudfront/function_data_source_test.go
index 262a2a2f702..62a2e2083fb 100644
--- a/internal/service/cloudfront/function_data_source_test.go
+++ b/internal/service/cloudfront/function_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudfront_test
 
 import (
diff --git a/internal/service/cloudfront/function_test.go b/internal/service/cloudfront/function_test.go
index d658a6f12f7..1bf85fc8bd4 100644
--- a/internal/service/cloudfront/function_test.go
+++ b/internal/service/cloudfront/function_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudfront_test
 
 import (
diff --git a/internal/service/cloudfront/generate.go b/internal/service/cloudfront/generate.go
index a7a849f8835..f3ba5081dd0 100644
--- a/internal/service/cloudfront/generate.go
+++ b/internal/service/cloudfront/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTags -ListTagsInIDElem=Resource -ListTagsOutTagsElem=Tags.Items -ServiceTagsSlice "-TagInCustomVal=&cloudfront.Tags{Items: Tags(updatedTags)}" -TagInIDElem=Resource "-UntagInCustomVal=&cloudfront.TagKeys{Items: aws.StringSlice(removedTags.Keys())}" -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/cloudfront/key_group.go b/internal/service/cloudfront/key_group.go
index c3ce61825d9..cd049cd9c53 100644
--- a/internal/service/cloudfront/key_group.go
+++ b/internal/service/cloudfront/key_group.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudfront
 
 import (
diff --git a/internal/service/cloudfront/key_group_test.go b/internal/service/cloudfront/key_group_test.go
index a029489a03b..a3a5e08603c 100644
--- a/internal/service/cloudfront/key_group_test.go
+++ b/internal/service/cloudfront/key_group_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudfront_test
 
 import (
diff --git a/internal/service/cloudfront/list.go b/internal/service/cloudfront/list.go
index 763bfadc51f..c77c15b4a6e 100644
--- a/internal/service/cloudfront/list.go
+++ b/internal/service/cloudfront/list.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudfront
 
 import (
diff --git a/internal/service/cloudfront/log_delivery_canonical_user_id_data_source.go b/internal/service/cloudfront/log_delivery_canonical_user_id_data_source.go
index 09a0b23cad4..0c58ff94790 100644
--- a/internal/service/cloudfront/log_delivery_canonical_user_id_data_source.go
+++ b/internal/service/cloudfront/log_delivery_canonical_user_id_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudfront
 
 import (
diff --git a/internal/service/cloudfront/log_delivery_canonical_user_id_data_source_test.go b/internal/service/cloudfront/log_delivery_canonical_user_id_data_source_test.go
index 1a729e6c3f4..3f8c26f6e58 100644
--- a/internal/service/cloudfront/log_delivery_canonical_user_id_data_source_test.go
+++ b/internal/service/cloudfront/log_delivery_canonical_user_id_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudfront_test
 
 import (
diff --git a/internal/service/cloudfront/monitoring_subscription.go b/internal/service/cloudfront/monitoring_subscription.go
index 1fd67f2f914..f41647df718 100644
--- a/internal/service/cloudfront/monitoring_subscription.go
+++ b/internal/service/cloudfront/monitoring_subscription.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudfront
 
 import (
diff --git a/internal/service/cloudfront/monitoring_subscription_test.go b/internal/service/cloudfront/monitoring_subscription_test.go
index 70905d2c666..eeaf20e39e2 100644
--- a/internal/service/cloudfront/monitoring_subscription_test.go
+++ b/internal/service/cloudfront/monitoring_subscription_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudfront_test
 
 import (
diff --git a/internal/service/cloudfront/origin_access_control.go b/internal/service/cloudfront/origin_access_control.go
index 2a22bba93ad..68125930870 100644
--- a/internal/service/cloudfront/origin_access_control.go
+++ b/internal/service/cloudfront/origin_access_control.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudfront
 
 import (
diff --git a/internal/service/cloudfront/origin_access_control_test.go b/internal/service/cloudfront/origin_access_control_test.go
index a3d99f4f1e7..0ecacd37eea 100644
--- a/internal/service/cloudfront/origin_access_control_test.go
+++ b/internal/service/cloudfront/origin_access_control_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudfront_test
 
 import (
diff --git a/internal/service/cloudfront/origin_access_identities_data_source.go b/internal/service/cloudfront/origin_access_identities_data_source.go
index 54b1afe7791..024f0cf0c29 100644
--- a/internal/service/cloudfront/origin_access_identities_data_source.go
+++ b/internal/service/cloudfront/origin_access_identities_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudfront
 
 import (
diff --git a/internal/service/cloudfront/origin_access_identities_data_source_test.go b/internal/service/cloudfront/origin_access_identities_data_source_test.go
index d563e4b0071..0c06fe8934c 100644
--- a/internal/service/cloudfront/origin_access_identities_data_source_test.go
+++ b/internal/service/cloudfront/origin_access_identities_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudfront_test
 
 import (
diff --git a/internal/service/cloudfront/origin_access_identity.go b/internal/service/cloudfront/origin_access_identity.go
index f1abac646d0..2ba2812ee78 100644
--- a/internal/service/cloudfront/origin_access_identity.go
+++ b/internal/service/cloudfront/origin_access_identity.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudfront
 
 import (
diff --git a/internal/service/cloudfront/origin_access_identity_data_source.go b/internal/service/cloudfront/origin_access_identity_data_source.go
index 6b4e790d5a0..10e3bedc0e1 100644
--- a/internal/service/cloudfront/origin_access_identity_data_source.go
+++ b/internal/service/cloudfront/origin_access_identity_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudfront
 
 import (
diff --git a/internal/service/cloudfront/origin_access_identity_data_source_test.go b/internal/service/cloudfront/origin_access_identity_data_source_test.go
index da6d138fe23..685694e7006 100644
--- a/internal/service/cloudfront/origin_access_identity_data_source_test.go
+++ b/internal/service/cloudfront/origin_access_identity_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudfront_test
 
 import (
diff --git a/internal/service/cloudfront/origin_access_identity_test.go b/internal/service/cloudfront/origin_access_identity_test.go
index 0c80a4c4165..9c23a994a6d 100644
--- a/internal/service/cloudfront/origin_access_identity_test.go
+++ b/internal/service/cloudfront/origin_access_identity_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudfront_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/cloudfront"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
@@ -32,11 +35,11 @@ func TestAccCloudFrontOriginAccessIdentity_basic(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckOriginAccessIdentityExistence(ctx, resourceName, &origin),
 					resource.TestCheckResourceAttr(resourceName, "comment", "some comment"),
-					resource.TestMatchResourceAttr(resourceName, "caller_reference", regexp.MustCompile(fmt.Sprintf("^%s", id.UniqueIdPrefix))),
-					resource.TestMatchResourceAttr(resourceName, "s3_canonical_user_id", regexp.MustCompile("^[a-z0-9]+")),
-					resource.TestMatchResourceAttr(resourceName, "cloudfront_access_identity_path", regexp.MustCompile("^origin-access-identity/cloudfront/[A-Z0-9]+")),
+					resource.TestMatchResourceAttr(resourceName, "caller_reference", regexache.MustCompile(fmt.Sprintf("^%s", id.UniqueIdPrefix))),
+					resource.TestMatchResourceAttr(resourceName, "s3_canonical_user_id", regexache.MustCompile("^[0-9a-z]+")),
+					resource.TestMatchResourceAttr(resourceName, "cloudfront_access_identity_path", regexache.MustCompile("^origin-access-identity/cloudfront/[0-9A-Z]+")),
 					//lintignore:AWSAT001
-					resource.TestMatchResourceAttr(resourceName, "iam_arn", regexp.MustCompile(fmt.Sprintf("^arn:%s:iam::cloudfront:user/CloudFront Origin Access Identity [A-Z0-9]+", acctest.Partition()))),
+					resource.TestMatchResourceAttr(resourceName, "iam_arn", regexache.MustCompile(fmt.Sprintf("^arn:%s:iam::cloudfront:user/CloudFront Origin Access Identity [0-9A-Z]+", acctest.Partition()))),
 				),
 			},
 			{
@@ -63,11 +66,11 @@ func TestAccCloudFrontOriginAccessIdentity_noComment(t *testing.T) {
 				Config: testAccOriginAccessIdentityConfig_noComment,
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckOriginAccessIdentityExistence(ctx, resourceName, &origin),
-					resource.TestMatchResourceAttr(resourceName, "caller_reference", regexp.MustCompile(fmt.Sprintf("^%s", id.UniqueIdPrefix))),
-					resource.TestMatchResourceAttr(resourceName, "s3_canonical_user_id", regexp.MustCompile("^[a-z0-9]+")),
-					resource.TestMatchResourceAttr(resourceName, "cloudfront_access_identity_path", regexp.MustCompile("^origin-access-identity/cloudfront/[A-Z0-9]+")),
+					resource.TestMatchResourceAttr(resourceName, "caller_reference", regexache.MustCompile(fmt.Sprintf("^%s", id.UniqueIdPrefix))),
+					resource.TestMatchResourceAttr(resourceName, "s3_canonical_user_id", regexache.MustCompile("^[0-9a-z]+")),
+					resource.TestMatchResourceAttr(resourceName, "cloudfront_access_identity_path", regexache.MustCompile("^origin-access-identity/cloudfront/[0-9A-Z]+")),
 					//lintignore:AWSAT001
-					resource.TestMatchResourceAttr(resourceName, "iam_arn", regexp.MustCompile(fmt.Sprintf("^arn:%s:iam::cloudfront:user/CloudFront Origin Access Identity [A-Z0-9]+", acctest.Partition()))),
+					resource.TestMatchResourceAttr(resourceName, "iam_arn", regexache.MustCompile(fmt.Sprintf("^arn:%s:iam::cloudfront:user/CloudFront Origin Access Identity [0-9A-Z]+", acctest.Partition()))),
 				),
 			},
 			{
diff --git a/internal/service/cloudfront/origin_request_policy.go b/internal/service/cloudfront/origin_request_policy.go
index 9ba319c827a..8df610c51a5 100644
--- a/internal/service/cloudfront/origin_request_policy.go
+++ b/internal/service/cloudfront/origin_request_policy.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudfront
 
 import (
diff --git a/internal/service/cloudfront/origin_request_policy_data_source.go b/internal/service/cloudfront/origin_request_policy_data_source.go
index cbb15128088..d78ba84c7af 100644
--- a/internal/service/cloudfront/origin_request_policy_data_source.go
+++ b/internal/service/cloudfront/origin_request_policy_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudfront
 
 import (
diff --git a/internal/service/cloudfront/origin_request_policy_data_source_test.go b/internal/service/cloudfront/origin_request_policy_data_source_test.go
index b8746b4fe08..d259bde33da 100644
--- a/internal/service/cloudfront/origin_request_policy_data_source_test.go
+++ b/internal/service/cloudfront/origin_request_policy_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudfront_test
 
 import (
diff --git a/internal/service/cloudfront/origin_request_policy_test.go b/internal/service/cloudfront/origin_request_policy_test.go
index 3b433e3754d..e3fe8103a45 100644
--- a/internal/service/cloudfront/origin_request_policy_test.go
+++ b/internal/service/cloudfront/origin_request_policy_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudfront_test
 
 import (
diff --git a/internal/service/cloudfront/public_key.go b/internal/service/cloudfront/public_key.go
index 024bcc4ce30..7512407c602 100644
--- a/internal/service/cloudfront/public_key.go
+++ b/internal/service/cloudfront/public_key.go
@@ -1,8 +1,10 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudfront
 
 import (
 	"context"
-	"errors"
 	"log"
 
 	"github.com/aws/aws-sdk-go/aws"
@@ -10,11 +12,12 @@ import (
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/create"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
-	"github.com/hashicorp/terraform-provider-aws/names"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
 // @SDKResource("aws_cloudfront_public_key")
@@ -70,63 +73,62 @@ func resourcePublicKeyCreate(ctx context.Context, d *schema.ResourceData, meta i
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).CloudFrontConn(ctx)
 
-	if v, ok := d.GetOk("name"); ok {
-		d.Set("name", v.(string))
-	} else if v, ok := d.GetOk("name_prefix"); ok {
-		d.Set("name", id.PrefixedUniqueId(v.(string)))
+	name := create.NewNameGenerator(
+		create.WithConfiguredName(d.Get("name").(string)),
+		create.WithConfiguredPrefix(d.Get("name_prefix").(string)),
+		create.WithDefaultPrefix("tf-"),
+	).Generate()
+	input := &cloudfront.CreatePublicKeyInput{
+		PublicKeyConfig: &cloudfront.PublicKeyConfig{
+			EncodedKey: aws.String(d.Get("encoded_key").(string)),
+			Name:       aws.String(name),
+		},
+	}
+
+	if v, ok := d.GetOk("caller_reference"); ok {
+		input.PublicKeyConfig.CallerReference = aws.String(v.(string))
 	} else {
-		d.Set("name", id.PrefixedUniqueId("tf-"))
+		input.PublicKeyConfig.CallerReference = aws.String(id.UniqueId())
 	}
 
-	request := &cloudfront.CreatePublicKeyInput{
-		PublicKeyConfig: expandPublicKeyConfig(d),
+	if v, ok := d.GetOk("comment"); ok {
+		input.PublicKeyConfig.Comment = aws.String(v.(string))
 	}
 
-	log.Println("[DEBUG] Create CloudFront PublicKey:", request)
+	output, err := conn.CreatePublicKeyWithContext(ctx, input)
 
-	output, err := conn.CreatePublicKeyWithContext(ctx, request)
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "creating CloudFront PublicKey: %s", err)
+		return sdkdiag.AppendErrorf(diags, "creating CloudFront Public Key (%s): %s", name, err)
 	}
 
 	d.SetId(aws.StringValue(output.PublicKey.Id))
+
 	return append(diags, resourcePublicKeyRead(ctx, d, meta)...)
 }
 
 func resourcePublicKeyRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).CloudFrontConn(ctx)
-	request := &cloudfront.GetPublicKeyInput{
-		Id: aws.String(d.Id()),
-	}
-
-	output, err := conn.GetPublicKeyWithContext(ctx, request)
-	if !d.IsNewResource() && tfawserr.ErrCodeEquals(err, cloudfront.ErrCodeNoSuchPublicKey) {
-		create.LogNotFoundRemoveState(names.CloudFront, create.ErrActionReading, ResNamePublicKey, d.Id())
-		d.SetId("")
-		return diags
-	}
 
-	if err != nil {
-		return create.DiagError(names.CloudFront, create.ErrActionReading, ResNamePublicKey, d.Id(), err)
-	}
+	output, err := findPublicKeyByID(ctx, conn, d.Id())
 
-	if !d.IsNewResource() && (output == nil || output.PublicKey == nil || output.PublicKey.PublicKeyConfig == nil) {
-		create.LogNotFoundRemoveState(names.CloudFront, create.ErrActionReading, ResNamePublicKey, d.Id())
+	if !d.IsNewResource() && tfresource.NotFound(err) {
+		log.Printf("[WARN] CloudFront Public Key (%s) not found, removing from state", d.Id())
 		d.SetId("")
 		return diags
 	}
 
-	if d.IsNewResource() && (output == nil || output.PublicKey == nil || output.PublicKey.PublicKeyConfig == nil) {
-		return create.DiagError(names.CloudFront, create.ErrActionReading, ResNamePublicKey, d.Id(), errors.New("empty response after creation"))
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "reading CloudFront Public Key (%s): %s", d.Id(), err)
 	}
 
 	publicKeyConfig := output.PublicKey.PublicKeyConfig
-	d.Set("encoded_key", publicKeyConfig.EncodedKey)
-	d.Set("name", publicKeyConfig.Name)
-	d.Set("comment", publicKeyConfig.Comment)
 	d.Set("caller_reference", publicKeyConfig.CallerReference)
+	d.Set("comment", publicKeyConfig.Comment)
+	d.Set("encoded_key", publicKeyConfig.EncodedKey)
 	d.Set("etag", output.ETag)
+	d.Set("name", publicKeyConfig.Name)
+	d.Set("name_prefix", create.NamePrefixFromName(aws.StringValue(publicKeyConfig.Name)))
 
 	return diags
 }
@@ -135,15 +137,29 @@ func resourcePublicKeyUpdate(ctx context.Context, d *schema.ResourceData, meta i
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).CloudFrontConn(ctx)
 
-	request := &cloudfront.UpdatePublicKeyInput{
-		Id:              aws.String(d.Id()),
-		PublicKeyConfig: expandPublicKeyConfig(d),
-		IfMatch:         aws.String(d.Get("etag").(string)),
+	input := &cloudfront.UpdatePublicKeyInput{
+		Id:      aws.String(d.Id()),
+		IfMatch: aws.String(d.Get("etag").(string)),
+		PublicKeyConfig: &cloudfront.PublicKeyConfig{
+			EncodedKey: aws.String(d.Get("encoded_key").(string)),
+			Name:       aws.String(d.Get("name").(string)),
+		},
+	}
+
+	if v, ok := d.GetOk("caller_reference"); ok {
+		input.PublicKeyConfig.CallerReference = aws.String(v.(string))
+	} else {
+		input.PublicKeyConfig.CallerReference = aws.String(id.UniqueId())
 	}
 
-	_, err := conn.UpdatePublicKeyWithContext(ctx, request)
+	if v, ok := d.GetOk("comment"); ok {
+		input.PublicKeyConfig.Comment = aws.String(v.(string))
+	}
+
+	_, err := conn.UpdatePublicKeyWithContext(ctx, input)
+
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "updating CloudFront PublicKey (%s): %s", d.Id(), err)
+		return sdkdiag.AppendErrorf(diags, "updating CloudFront Public Key (%s): %s", d.Id(), err)
 	}
 
 	return append(diags, resourcePublicKeyRead(ctx, d, meta)...)
@@ -153,37 +169,44 @@ func resourcePublicKeyDelete(ctx context.Context, d *schema.ResourceData, meta i
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).CloudFrontConn(ctx)
 
-	request := &cloudfront.DeletePublicKeyInput{
+	log.Printf("[DEBUG] Deleting CloudFront Public Key: %s", d.Id())
+	_, err := conn.DeletePublicKeyWithContext(ctx, &cloudfront.DeletePublicKeyInput{
 		Id:      aws.String(d.Id()),
 		IfMatch: aws.String(d.Get("etag").(string)),
+	})
+
+	if tfawserr.ErrCodeEquals(err, cloudfront.ErrCodeNoSuchPublicKey) {
+		return diags
 	}
 
-	_, err := conn.DeletePublicKeyWithContext(ctx, request)
 	if err != nil {
-		if tfawserr.ErrCodeEquals(err, cloudfront.ErrCodeNoSuchPublicKey) {
-			return diags
-		}
-		return sdkdiag.AppendErrorf(diags, "deleting CloudFront PublicKey (%s): %s", d.Id(), err)
+		return sdkdiag.AppendErrorf(diags, "deleting CloudFront Public Key (%s): %s", d.Id(), err)
 	}
 
 	return diags
 }
 
-func expandPublicKeyConfig(d *schema.ResourceData) *cloudfront.PublicKeyConfig {
-	publicKeyConfig := &cloudfront.PublicKeyConfig{
-		EncodedKey: aws.String(d.Get("encoded_key").(string)),
-		Name:       aws.String(d.Get("name").(string)),
+func findPublicKeyByID(ctx context.Context, conn *cloudfront.CloudFront, id string) (*cloudfront.GetPublicKeyOutput, error) {
+	input := &cloudfront.GetPublicKeyInput{
+		Id: aws.String(id),
 	}
 
-	if v, ok := d.GetOk("comment"); ok {
-		publicKeyConfig.Comment = aws.String(v.(string))
+	output, err := conn.GetPublicKeyWithContext(ctx, input)
+
+	if tfawserr.ErrCodeEquals(err, cloudfront.ErrCodeNoSuchPublicKey) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
 	}
 
-	if v, ok := d.GetOk("caller_reference"); ok {
-		publicKeyConfig.CallerReference = aws.String(v.(string))
-	} else {
-		publicKeyConfig.CallerReference = aws.String(id.UniqueId())
+	if err != nil {
+		return nil, err
+	}
+
+	if output == nil || output.PublicKey == nil || output.PublicKey.PublicKeyConfig == nil {
+		return nil, tfresource.NewEmptyResultError(input)
 	}
 
-	return publicKeyConfig
+	return output, nil
 }
diff --git a/internal/service/cloudfront/public_key_test.go b/internal/service/cloudfront/public_key_test.go
index 3460b4ae4a5..ff2e31eb67f 100644
--- a/internal/service/cloudfront/public_key_test.go
+++ b/internal/service/cloudfront/public_key_test.go
@@ -1,27 +1,27 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudfront_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/cloudfront"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	tfcloudfront "github.com/hashicorp/terraform-provider-aws/internal/service/cloudfront"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
 func TestAccCloudFrontPublicKey_basic(t *testing.T) {
 	ctx := acctest.Context(t)
-	rInt := sdkacctest.RandInt()
-	resourceName := "aws_cloudfront_public_key.example"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_cloudfront_public_key.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, cloudfront.EndpointsID) },
@@ -30,12 +30,15 @@ func TestAccCloudFrontPublicKey_basic(t *testing.T) {
 		CheckDestroy:             testAccCheckPublicKeyDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccPublicKeyConfig_basic(rInt),
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckPublicKeyExistence(ctx, resourceName),
-					resource.TestCheckResourceAttr("aws_cloudfront_public_key.example", "comment", "test key"),
-					resource.TestMatchResourceAttr("aws_cloudfront_public_key.example", "caller_reference", regexp.MustCompile(fmt.Sprintf("^%s", id.UniqueIdPrefix))),
-					resource.TestCheckResourceAttr("aws_cloudfront_public_key.example", "name", fmt.Sprintf("tf-acc-test-%d", rInt)),
+				Config: testAccPublicKeyConfig_basic(rName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckPublicKeyExists(ctx, resourceName),
+					resource.TestCheckResourceAttrSet(resourceName, "caller_reference"),
+					resource.TestCheckResourceAttr(resourceName, "comment", ""),
+					resource.TestCheckResourceAttrSet(resourceName, "encoded_key"),
+					resource.TestCheckResourceAttrSet(resourceName, "etag"),
+					resource.TestCheckResourceAttr(resourceName, "name", rName),
+					resource.TestCheckResourceAttr(resourceName, "name_prefix", ""),
 				),
 			},
 			{
@@ -49,8 +52,8 @@ func TestAccCloudFrontPublicKey_basic(t *testing.T) {
 
 func TestAccCloudFrontPublicKey_disappears(t *testing.T) {
 	ctx := acctest.Context(t)
-	rInt := sdkacctest.RandInt()
-	resourceName := "aws_cloudfront_public_key.example"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_cloudfront_public_key.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, cloudfront.EndpointsID) },
@@ -59,9 +62,9 @@ func TestAccCloudFrontPublicKey_disappears(t *testing.T) {
 		CheckDestroy:             testAccCheckPublicKeyDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccPublicKeyConfig_basic(rInt),
+				Config: testAccPublicKeyConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckPublicKeyExistence(ctx, resourceName),
+					testAccCheckPublicKeyExists(ctx, resourceName),
 					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfcloudfront.ResourcePublicKey(), resourceName),
 				),
 				ExpectNonEmptyPlan: true,
@@ -70,10 +73,36 @@ func TestAccCloudFrontPublicKey_disappears(t *testing.T) {
 	})
 }
 
+func TestAccCloudFrontPublicKey_nameGenerated(t *testing.T) {
+	ctx := acctest.Context(t)
+	resourceName := "aws_cloudfront_public_key.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, cloudfront.EndpointsID) },
+		ErrorCheck:               acctest.ErrorCheck(t, cloudfront.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckPublicKeyDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccPublicKeyConfig_nameGenerated(),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckPublicKeyExists(ctx, resourceName),
+					acctest.CheckResourceAttrNameGeneratedWithPrefix(resourceName, "name", "tf-"),
+					resource.TestCheckResourceAttr(resourceName, "name_prefix", "tf-"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
 func TestAccCloudFrontPublicKey_namePrefix(t *testing.T) {
 	ctx := acctest.Context(t)
-	startsWithPrefix := regexp.MustCompile("^tf-acc-test-")
-	resourceName := "aws_cloudfront_public_key.example"
+	resourceName := "aws_cloudfront_public_key.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, cloudfront.EndpointsID) },
@@ -82,19 +111,17 @@ func TestAccCloudFrontPublicKey_namePrefix(t *testing.T) {
 		CheckDestroy:             testAccCheckPublicKeyDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccPublicKeyConfig_namePrefix(),
+				Config: testAccPublicKeyConfig_namePrefix("tf-acc-test-prefix-"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckPublicKeyExistence(ctx, resourceName),
-					resource.TestMatchResourceAttr("aws_cloudfront_public_key.example", "name", startsWithPrefix),
+					testAccCheckPublicKeyExists(ctx, resourceName),
+					acctest.CheckResourceAttrNameFromPrefix(resourceName, "name", "tf-acc-test-prefix-"),
+					resource.TestCheckResourceAttr(resourceName, "name_prefix", "tf-acc-test-prefix-"),
 				),
 			},
 			{
 				ResourceName:      resourceName,
 				ImportState:       true,
 				ImportStateVerify: true,
-				ImportStateVerifyIgnore: []string{
-					"name_prefix",
-				},
 			},
 		},
 	})
@@ -102,8 +129,8 @@ func TestAccCloudFrontPublicKey_namePrefix(t *testing.T) {
 
 func TestAccCloudFrontPublicKey_update(t *testing.T) {
 	ctx := acctest.Context(t)
-	rInt := sdkacctest.RandInt()
-	resourceName := "aws_cloudfront_public_key.example"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_cloudfront_public_key.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, cloudfront.EndpointsID) },
@@ -112,10 +139,10 @@ func TestAccCloudFrontPublicKey_update(t *testing.T) {
 		CheckDestroy:             testAccCheckPublicKeyDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccPublicKeyConfig_basic(rInt),
+				Config: testAccPublicKeyConfig_comment(rName, "comment 1"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckPublicKeyExistence(ctx, resourceName),
-					resource.TestCheckResourceAttr("aws_cloudfront_public_key.example", "comment", "test key"),
+					testAccCheckPublicKeyExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "comment", "comment 1"),
 				),
 			},
 			{
@@ -124,37 +151,28 @@ func TestAccCloudFrontPublicKey_update(t *testing.T) {
 				ImportStateVerify: true,
 			},
 			{
-				Config: testAccPublicKeyConfig_update(rInt),
+				Config: testAccPublicKeyConfig_comment(rName, "comment 2"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckPublicKeyExistence(ctx, resourceName),
-					resource.TestCheckResourceAttr("aws_cloudfront_public_key.example", "comment", "test key1"),
+					testAccCheckPublicKeyExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "comment", "comment 2"),
 				),
 			},
 		},
 	})
 }
 
-func testAccCheckPublicKeyExistence(ctx context.Context, r string) resource.TestCheckFunc {
+func testAccCheckPublicKeyExists(ctx context.Context, n string) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		rs, ok := s.RootModule().Resources[r]
+		rs, ok := s.RootModule().Resources[n]
 		if !ok {
-			return fmt.Errorf("Not found: %s", r)
-		}
-		if rs.Primary.ID == "" {
-			return fmt.Errorf("No Id is set")
+			return fmt.Errorf("Not found: %s", n)
 		}
 
 		conn := acctest.Provider.Meta().(*conns.AWSClient).CloudFrontConn(ctx)
 
-		params := &cloudfront.GetPublicKeyInput{
-			Id: aws.String(rs.Primary.ID),
-		}
+		_, err := tfcloudfront.FindPublicKeyByID(ctx, conn, rs.Primary.ID)
 
-		_, err := conn.GetPublicKeyWithContext(ctx, params)
-		if err != nil {
-			return fmt.Errorf("Error retrieving CloudFront PublicKey: %s", err)
-		}
-		return nil
+		return err
 	}
 }
 
@@ -167,50 +185,55 @@ func testAccCheckPublicKeyDestroy(ctx context.Context) resource.TestCheckFunc {
 				continue
 			}
 
-			params := &cloudfront.GetPublicKeyInput{
-				Id: aws.String(rs.Primary.ID),
-			}
+			_, err := tfcloudfront.FindPublicKeyByID(ctx, conn, rs.Primary.ID)
 
-			_, err := conn.GetPublicKeyWithContext(ctx, params)
-			if tfawserr.ErrCodeEquals(err, cloudfront.ErrCodeNoSuchPublicKey) {
+			if tfresource.NotFound(err) {
 				continue
 			}
+
 			if err != nil {
 				return err
 			}
-			return fmt.Errorf("CloudFront PublicKey (%s) was not deleted", rs.Primary.ID)
+
+			return fmt.Errorf("CloudFront Public Key %s still exists", rs.Primary.ID)
 		}
 
 		return nil
 	}
 }
 
-func testAccPublicKeyConfig_basic(rInt int) string {
+func testAccPublicKeyConfig_basic(rName string) string {
 	return fmt.Sprintf(`
-resource "aws_cloudfront_public_key" "example" {
-  comment     = "test key"
+resource "aws_cloudfront_public_key" "test" {
   encoded_key = file("test-fixtures/cloudfront-public-key.pem")
-  name        = "tf-acc-test-%d"
+  name        = %[1]q
 }
-`, rInt)
+`, rName)
 }
 
-func testAccPublicKeyConfig_namePrefix() string {
+func testAccPublicKeyConfig_nameGenerated() string {
 	return `
-resource "aws_cloudfront_public_key" "example" {
-  comment     = "test key"
+resource "aws_cloudfront_public_key" "test" {
   encoded_key = file("test-fixtures/cloudfront-public-key.pem")
-  name_prefix = "tf-acc-test-"
 }
 `
 }
 
-func testAccPublicKeyConfig_update(rInt int) string {
+func testAccPublicKeyConfig_namePrefix(namePrefix string) string {
+	return fmt.Sprintf(`
+resource "aws_cloudfront_public_key" "test" {
+  encoded_key = file("test-fixtures/cloudfront-public-key.pem")
+  name_prefix = %[1]q
+}
+`, namePrefix)
+}
+
+func testAccPublicKeyConfig_comment(rName, comment string) string {
 	return fmt.Sprintf(`
-resource "aws_cloudfront_public_key" "example" {
-  comment     = "test key1"
+resource "aws_cloudfront_public_key" "test" {
+  comment     = %[2]q
   encoded_key = file("test-fixtures/cloudfront-public-key.pem")
-  name        = "tf-acc-test-%d"
+  name        = %[1]q
 }
-`, rInt)
+`, rName, comment)
 }
diff --git a/internal/service/cloudfront/realtime_log_config.go b/internal/service/cloudfront/realtime_log_config.go
index 57716af464a..1544e1de06b 100644
--- a/internal/service/cloudfront/realtime_log_config.go
+++ b/internal/service/cloudfront/realtime_log_config.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudfront
 
 import (
diff --git a/internal/service/cloudfront/realtime_log_config_data_source.go b/internal/service/cloudfront/realtime_log_config_data_source.go
index f84d03bc1f2..b7aa0fc1128 100644
--- a/internal/service/cloudfront/realtime_log_config_data_source.go
+++ b/internal/service/cloudfront/realtime_log_config_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudfront
 
 import (
diff --git a/internal/service/cloudfront/realtime_log_config_data_source_test.go b/internal/service/cloudfront/realtime_log_config_data_source_test.go
index badb9e07c4e..cc578b57fb9 100644
--- a/internal/service/cloudfront/realtime_log_config_data_source_test.go
+++ b/internal/service/cloudfront/realtime_log_config_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudfront_test
 
 import (
diff --git a/internal/service/cloudfront/realtime_log_config_test.go b/internal/service/cloudfront/realtime_log_config_test.go
index 9433017e254..acb00047cd7 100644
--- a/internal/service/cloudfront/realtime_log_config_test.go
+++ b/internal/service/cloudfront/realtime_log_config_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudfront_test
 
 import (
diff --git a/internal/service/cloudfront/response_headers_policy.go b/internal/service/cloudfront/response_headers_policy.go
index 5ca86e58a5d..90a330f2680 100644
--- a/internal/service/cloudfront/response_headers_policy.go
+++ b/internal/service/cloudfront/response_headers_policy.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudfront
 
 import (
diff --git a/internal/service/cloudfront/response_headers_policy_data_source.go b/internal/service/cloudfront/response_headers_policy_data_source.go
index 170973dfddc..2013edde403 100644
--- a/internal/service/cloudfront/response_headers_policy_data_source.go
+++ b/internal/service/cloudfront/response_headers_policy_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudfront
 
 import (
diff --git a/internal/service/cloudfront/response_headers_policy_data_source_test.go b/internal/service/cloudfront/response_headers_policy_data_source_test.go
index 2cacecabff2..ab02ba31482 100644
--- a/internal/service/cloudfront/response_headers_policy_data_source_test.go
+++ b/internal/service/cloudfront/response_headers_policy_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudfront_test
 
 import (
diff --git a/internal/service/cloudfront/response_headers_policy_test.go b/internal/service/cloudfront/response_headers_policy_test.go
index 7286bb157ed..4758708c971 100644
--- a/internal/service/cloudfront/response_headers_policy_test.go
+++ b/internal/service/cloudfront/response_headers_policy_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudfront_test
 
 import (
diff --git a/internal/service/cloudfront/service_package_gen.go b/internal/service/cloudfront/service_package_gen.go
index 75da6e06989..1581087c214 100644
--- a/internal/service/cloudfront/service_package_gen.go
+++ b/internal/service/cloudfront/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	cloudfront_sdkv1 "github.com/aws/aws-sdk-go/service/cloudfront"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -19,7 +20,12 @@ func (p *servicePackage) FrameworkDataSources(ctx context.Context) []*types.Serv
 }
 
 func (p *servicePackage) FrameworkResources(ctx context.Context) []*types.ServicePackageFrameworkResource {
-	return []*types.ServicePackageFrameworkResource{}
+	return []*types.ServicePackageFrameworkResource{
+		{
+			Factory: newResourceContinuousDeploymentPolicy,
+			Name:    "Continuous Deployment Policy",
+		},
+	}
 }
 
 func (p *servicePackage) SDKDataSources(ctx context.Context) []*types.ServicePackageSDKDataSource {
@@ -135,4 +141,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*c
 	return cloudfront_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/cloudfront/sweep.go b/internal/service/cloudfront/sweep.go
index d0ed0b40ddf..113a18ac893 100644
--- a/internal/service/cloudfront/sweep.go
+++ b/internal/service/cloudfront/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package cloudfront
 
@@ -12,10 +12,11 @@ import (
 	"github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_cloudfront_cache_policy", &resource.Sweeper{
 		Name: "aws_cloudfront_cache_policy",
 		F:    sweepCachePolicies,
@@ -24,6 +25,12 @@ func init() {
 		},
 	})
 
+	// DO NOT add a continuous deployment policy sweeper as these are swept as part of the distribution sweeper
+	// resource.AddTestSweepers("aws_cloudfront_continuous_deployment_policy", &resource.Sweeper{
+	//	Name: "aws_cloudfront_continuous_deployment_policy",
+	//	F:    sweepContinuousDeploymentPolicies,
+	//})
+
 	resource.AddTestSweepers("aws_cloudfront_distribution", &resource.Sweeper{
 		Name: "aws_cloudfront_distribution",
 		F:    sweepDistributions,
@@ -55,6 +62,9 @@ func init() {
 	resource.AddTestSweepers("aws_cloudfront_monitoring_subscription", &resource.Sweeper{
 		Name: "aws_cloudfront_monitoring_subscription",
 		F:    sweepMonitoringSubscriptions,
+		Dependencies: []string{
+			"aws_cloudfront_distribution",
+		},
 	})
 
 	resource.AddTestSweepers("aws_cloudfront_origin_access_control", &resource.Sweeper{
@@ -89,7 +99,7 @@ func init() {
 
 func sweepCachePolicies(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -129,7 +139,7 @@ func sweepCachePolicies(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping CloudFront Cache Policy sweep for %s: %s", region, err)
 		return nil
 	}
@@ -138,7 +148,7 @@ func sweepCachePolicies(region string) error {
 		return fmt.Errorf("error listing CloudFront Cache Policies (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping CloudFront Cache Policies (%s): %w", region, err)
@@ -148,8 +158,29 @@ func sweepCachePolicies(region string) error {
 }
 
 func sweepDistributions(region string) error {
+	var result *multierror.Error
+
+	// 1. Production Distributions
+	if err := sweepDistributionsByProductionStaging(region, false); err != nil {
+		result = multierror.Append(result, err)
+	}
+
+	// 2. Continuous Deployment Policies
+	if err := sweepContinuousDeploymentPolicies(region); err != nil {
+		result = multierror.Append(result, err)
+	}
+
+	// 3. Staging Distributions
+	if err := sweepDistributionsByProductionStaging(region, true); err != nil {
+		result = multierror.Append(result, err)
+	}
+
+	return result.ErrorOrNil()
+}
+
+func sweepDistributionsByProductionStaging(region string, staging bool) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -157,6 +188,12 @@ func sweepDistributions(region string) error {
 	input := &cloudfront.ListDistributionsInput{}
 	sweepResources := make([]sweep.Sweepable, 0)
 
+	if staging {
+		log.Print("[INFO] Sweeping staging distributions")
+	} else {
+		log.Print("[INFO] Sweeping production distributions")
+	}
+
 	err = conn.ListDistributionsPagesWithContext(ctx, input, func(page *cloudfront.ListDistributionsOutput, lastPage bool) bool {
 		if page == nil {
 			return !lastPage
@@ -176,6 +213,10 @@ func sweepDistributions(region string) error {
 				continue
 			}
 
+			if staging != aws.BoolValue(output.Distribution.DistributionConfig.Staging) {
+				continue
+			}
+
 			r := ResourceDistribution()
 			d := r.Data(nil)
 			d.SetId(id)
@@ -187,7 +228,7 @@ func sweepDistributions(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping CloudFront Distribution sweep for %s: %s", region, err)
 		return nil
 	}
@@ -196,8 +237,7 @@ func sweepDistributions(region string) error {
 		return fmt.Errorf("error listing CloudFront Distributions (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
-
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 	if err != nil {
 		return fmt.Errorf("error sweeping CloudFront Distributions (%s): %w", region, err)
 	}
@@ -205,9 +245,54 @@ func sweepDistributions(region string) error {
 	return nil
 }
 
+func sweepContinuousDeploymentPolicies(region string) error {
+	ctx := sweep.Context(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
+	if err != nil {
+		return fmt.Errorf("error getting client: %s", err)
+	}
+	conn := client.CloudFrontConn(ctx)
+	input := &cloudfront.ListContinuousDeploymentPoliciesInput{}
+
+	log.Printf("[INFO] Sweeping continuous deployment policies")
+	var result *multierror.Error
+
+	// ListContinuousDeploymentPolicies does not have a paginator
+	for {
+		output, err := conn.ListContinuousDeploymentPoliciesWithContext(ctx, input)
+		if awsv1.SkipSweepError(err) {
+			log.Printf("[WARN] Skipping CloudFront Continuous Deployment Policy sweep for %s: %s", region, err)
+			return result.ErrorOrNil()
+		}
+		if err != nil {
+			result = multierror.Append(result, fmt.Errorf("listing CloudFront Continuous Deployment Policies: %w", err))
+			break
+		}
+
+		if output == nil || output.ContinuousDeploymentPolicyList == nil {
+			log.Printf("[WARN] CloudFront Continuous Deployment Policies: empty response")
+			break
+		}
+
+		for _, cdp := range output.ContinuousDeploymentPolicyList.Items {
+			if err := DeleteCDP(ctx, conn, aws.StringValue(cdp.ContinuousDeploymentPolicy.Id)); err != nil {
+				result = multierror.Append(result, err)
+			}
+		}
+
+		if output.ContinuousDeploymentPolicyList.NextMarker == nil {
+			break
+		}
+
+		input.Marker = output.ContinuousDeploymentPolicyList.NextMarker
+	}
+
+	return result.ErrorOrNil()
+}
+
 func sweepFunctions(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
@@ -248,7 +333,7 @@ func sweepFunctions(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping CloudFront Function sweep for %s: %s", region, err)
 		return sweeperErrs.ErrorOrNil() // In case we have completed some pages, but had errors
 	}
@@ -256,7 +341,7 @@ func sweepFunctions(region string) error {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error listing CloudFront Functions: %w", err))
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error sweeping CloudFront Functions: %w", err))
 	}
 
@@ -265,7 +350,7 @@ func sweepFunctions(region string) error {
 
 func sweepKeyGroup(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("Error getting client: %w", err)
 	}
@@ -277,7 +362,7 @@ func sweepKeyGroup(region string) error {
 	for {
 		output, err := conn.ListKeyGroupsWithContext(ctx, input)
 		if err != nil {
-			if sweep.SkipSweepError(err) {
+			if awsv1.SkipSweepError(err) {
 				log.Printf("[WARN] Skipping CloudFront key group sweep for %s: %s", region, err)
 				return nil
 			}
@@ -325,7 +410,7 @@ func sweepKeyGroup(region string) error {
 
 func sweepMonitoringSubscriptions(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -340,7 +425,7 @@ func sweepMonitoringSubscriptions(region string) error {
 		return !lastPage
 	})
 	if err != nil {
-		if sweep.SkipSweepError(err) {
+		if awsv1.SkipSweepError(err) {
 			log.Printf("[WARN] Skipping CloudFront Monitoring Subscriptions sweep for %s: %s", region, err)
 			return nil
 		}
@@ -353,7 +438,6 @@ func sweepMonitoringSubscriptions(region string) error {
 	}
 
 	for _, distributionSummary := range distributionSummaries {
-
 		_, err := conn.GetMonitoringSubscriptionWithContext(ctx, &cloudfront.GetMonitoringSubscriptionInput{
 			DistributionId: distributionSummary.Id,
 		})
@@ -374,7 +458,7 @@ func sweepMonitoringSubscriptions(region string) error {
 
 func sweepRealtimeLogsConfig(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -386,7 +470,7 @@ func sweepRealtimeLogsConfig(region string) error {
 	for {
 		output, err := conn.ListRealtimeLogConfigsWithContext(ctx, input)
 
-		if sweep.SkipSweepError(err) {
+		if awsv1.SkipSweepError(err) {
 			log.Printf("[WARN] Skipping CloudFront Real-time Log Configs sweep for %s: %s", region, err)
 			return sweeperErrs.ErrorOrNil() // In case we have completed some pages, but had errors
 		}
@@ -413,7 +497,7 @@ func sweepRealtimeLogsConfig(region string) error {
 		input.Marker = output.RealtimeLogConfigs.NextMarker
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error sweeping CloudFront Real-time Log Configs: %w", err))
 	}
 
@@ -422,7 +506,7 @@ func sweepRealtimeLogsConfig(region string) error {
 
 func sweepFieldLevelEncryptionConfigs(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -460,7 +544,7 @@ func sweepFieldLevelEncryptionConfigs(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping CloudFront Field-level Encryption Config sweep for %s: %s", region, err)
 		return nil
 	}
@@ -469,7 +553,7 @@ func sweepFieldLevelEncryptionConfigs(region string) error {
 		return fmt.Errorf("error listing CloudFront Field-level Encryption Configs (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping CloudFront Field-level Encryption Configs (%s): %w", region, err)
@@ -480,7 +564,7 @@ func sweepFieldLevelEncryptionConfigs(region string) error {
 
 func sweepFieldLevelEncryptionProfiles(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -518,7 +602,7 @@ func sweepFieldLevelEncryptionProfiles(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping CloudFront Field-level Encryption Profile sweep for %s: %s", region, err)
 		return nil
 	}
@@ -527,7 +611,7 @@ func sweepFieldLevelEncryptionProfiles(region string) error {
 		return fmt.Errorf("error listing CloudFront Field-level Encryption Profiles (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping CloudFront Field-level Encryption Profiles (%s): %w", region, err)
@@ -538,7 +622,7 @@ func sweepFieldLevelEncryptionProfiles(region string) error {
 
 func sweepOriginRequestPolicies(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -578,7 +662,7 @@ func sweepOriginRequestPolicies(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping CloudFront Origin Request Policy sweep for %s: %s", region, err)
 		return nil
 	}
@@ -587,7 +671,7 @@ func sweepOriginRequestPolicies(region string) error {
 		return fmt.Errorf("error listing CloudFront Origin Request Policies (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping CloudFront Origin Request Policies (%s): %w", region, err)
@@ -598,7 +682,7 @@ func sweepOriginRequestPolicies(region string) error {
 
 func sweepResponseHeadersPolicies(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -638,7 +722,7 @@ func sweepResponseHeadersPolicies(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping CloudFront Response Headers Policy sweep for %s: %s", region, err)
 		return nil
 	}
@@ -647,7 +731,7 @@ func sweepResponseHeadersPolicies(region string) error {
 		return fmt.Errorf("error listing CloudFront Response Headers Policies (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping CloudFront Response Headers Policies (%s): %w", region, err)
@@ -658,7 +742,7 @@ func sweepResponseHeadersPolicies(region string) error {
 
 func sweepOriginAccessControls(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -696,7 +780,7 @@ func sweepOriginAccessControls(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping CloudFront Origin Access Control sweep for %s: %s", region, err)
 		return nil
 	}
@@ -705,7 +789,7 @@ func sweepOriginAccessControls(region string) error {
 		return fmt.Errorf("error listing CloudFront Origin Access Controls (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping CloudFront Origin Access Controls (%s): %w", region, err)
diff --git a/internal/service/cloudfront/tags_gen.go b/internal/service/cloudfront/tags_gen.go
index 186e47f0991..555cc86a719 100644
--- a/internal/service/cloudfront/tags_gen.go
+++ b/internal/service/cloudfront/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/cloudfront"
 	"github.com/aws/aws-sdk-go/service/cloudfront/cloudfrontiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -102,6 +104,8 @@ func updateTags(ctx context.Context, conn cloudfrontiface.CloudFrontAPI, identif
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.CloudFront)
 	if len(removedTags) > 0 {
diff --git a/internal/service/cloudfront/validate.go b/internal/service/cloudfront/validate.go
index fa4acc36a0e..eafb87998ca 100644
--- a/internal/service/cloudfront/validate.go
+++ b/internal/service/cloudfront/validate.go
@@ -1,17 +1,20 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudfront
 
 import (
 	"fmt"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 )
 
-var regionRegexp = regexp.MustCompile(`^[a-z]{2}(-[a-z]+)+-\d$`)
+var regionRegexp = regexache.MustCompile(`^[a-z]{2}(-[a-z]+)+-\d$`)
 
 func validPublicKeyName(v interface{}, k string) (ws []string, errors []error) {
 	value := v.(string)
-	if !regexp.MustCompile(`^[0-9A-Za-z_-]+$`).MatchString(value) {
+	if !regexache.MustCompile(`^[0-9A-Za-z_-]+$`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"only alphanumeric characters, underscores and hyphens allowed in %q", k))
 	}
@@ -24,7 +27,7 @@ func validPublicKeyName(v interface{}, k string) (ws []string, errors []error) {
 
 func validPublicKeyNamePrefix(v interface{}, k string) (ws []string, errors []error) {
 	value := v.(string)
-	if !regexp.MustCompile(`^[0-9A-Za-z_-]+$`).MatchString(value) {
+	if !regexache.MustCompile(`^[0-9A-Za-z_-]+$`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"only alphanumeric characters, underscores and hyphens allowed in %q", k))
 	}
diff --git a/internal/service/cloudfront/validate_test.go b/internal/service/cloudfront/validate_test.go
index 6493517af08..115edc2aa9d 100644
--- a/internal/service/cloudfront/validate_test.go
+++ b/internal/service/cloudfront/validate_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudfront
 
 import (
diff --git a/internal/service/cloudhsmv2/cloudhsmv2_test.go b/internal/service/cloudhsmv2/cloudhsmv2_test.go
index 9bbe9bcc518..6f801d57252 100644
--- a/internal/service/cloudhsmv2/cloudhsmv2_test.go
+++ b/internal/service/cloudhsmv2/cloudhsmv2_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudhsmv2_test
 
 import (
diff --git a/internal/service/cloudhsmv2/cluster.go b/internal/service/cloudhsmv2/cluster.go
index 65d884e62f8..f7e068a2e78 100644
--- a/internal/service/cloudhsmv2/cluster.go
+++ b/internal/service/cloudhsmv2/cluster.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudhsmv2
 
 import (
diff --git a/internal/service/cloudhsmv2/cluster_data_source.go b/internal/service/cloudhsmv2/cluster_data_source.go
index ee9d02a4a19..7d9e6844d97 100644
--- a/internal/service/cloudhsmv2/cluster_data_source.go
+++ b/internal/service/cloudhsmv2/cluster_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudhsmv2
 
 import (
diff --git a/internal/service/cloudhsmv2/cluster_data_source_test.go b/internal/service/cloudhsmv2/cluster_data_source_test.go
index 5bdf3ba4b82..806a28a0bf2 100644
--- a/internal/service/cloudhsmv2/cluster_data_source_test.go
+++ b/internal/service/cloudhsmv2/cluster_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudhsmv2_test
 
 import (
diff --git a/internal/service/cloudhsmv2/cluster_test.go b/internal/service/cloudhsmv2/cluster_test.go
index 038b5d8e305..f24622c25cd 100644
--- a/internal/service/cloudhsmv2/cluster_test.go
+++ b/internal/service/cloudhsmv2/cluster_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudhsmv2_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/cloudhsmv2"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -31,10 +34,10 @@ func testAccCluster_basic(t *testing.T) {
 				Config: testAccClusterConfig_basic(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckClusterExists(ctx, resourceName),
-					resource.TestMatchResourceAttr(resourceName, "cluster_id", regexp.MustCompile(`^cluster-.+`)),
+					resource.TestMatchResourceAttr(resourceName, "cluster_id", regexache.MustCompile(`^cluster-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "cluster_state", cloudhsmv2.ClusterStateUninitialized),
 					resource.TestCheckResourceAttr(resourceName, "hsm_type", "hsm1.medium"),
-					resource.TestMatchResourceAttr(resourceName, "security_group_id", regexp.MustCompile(`^sg-.+`)),
+					resource.TestMatchResourceAttr(resourceName, "security_group_id", regexache.MustCompile(`^sg-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "source_backup_identifier", ""),
 					resource.TestCheckResourceAttr(resourceName, "subnet_ids.#", "2"),
 					resource.TestCheckTypeSetElemAttrPair(resourceName, "subnet_ids.*", "aws_subnet.test.0", "id"),
diff --git a/internal/service/cloudhsmv2/find.go b/internal/service/cloudhsmv2/find.go
index 1df551977c2..551b4d684b9 100644
--- a/internal/service/cloudhsmv2/find.go
+++ b/internal/service/cloudhsmv2/find.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudhsmv2
 
 import (
diff --git a/internal/service/cloudhsmv2/generate.go b/internal/service/cloudhsmv2/generate.go
index f59d08c028e..ee5756a0659 100644
--- a/internal/service/cloudhsmv2/generate.go
+++ b/internal/service/cloudhsmv2/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTags -ListTagsOp=ListTags -ListTagsInIDElem=ResourceId -ListTagsOutTagsElem=TagList -ServiceTagsSlice -TagInIDElem=ResourceId -TagInTagsElem=TagList -UntagInTagsElem=TagKeyList -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/cloudhsmv2/hsm.go b/internal/service/cloudhsmv2/hsm.go
index 604636a3923..a6962c8d269 100644
--- a/internal/service/cloudhsmv2/hsm.go
+++ b/internal/service/cloudhsmv2/hsm.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudhsmv2
 
 import (
diff --git a/internal/service/cloudhsmv2/hsm_test.go b/internal/service/cloudhsmv2/hsm_test.go
index e0cb0dd3e89..85277c92a1e 100644
--- a/internal/service/cloudhsmv2/hsm_test.go
+++ b/internal/service/cloudhsmv2/hsm_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudhsmv2_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/cloudhsmv2"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -33,8 +36,8 @@ func testAccHSM_basic(t *testing.T) {
 					testAccCheckHSMExists(ctx, resourceName),
 					resource.TestCheckResourceAttrPair(resourceName, "availability_zone", "aws_subnet.test.0", "availability_zone"),
 					resource.TestCheckResourceAttrPair(resourceName, "cluster_id", "aws_cloudhsm_v2_cluster.test", "id"),
-					resource.TestMatchResourceAttr(resourceName, "hsm_eni_id", regexp.MustCompile(`^eni-.+`)),
-					resource.TestMatchResourceAttr(resourceName, "hsm_id", regexp.MustCompile(`^hsm-.+`)),
+					resource.TestMatchResourceAttr(resourceName, "hsm_eni_id", regexache.MustCompile(`^eni-.+`)),
+					resource.TestMatchResourceAttr(resourceName, "hsm_id", regexache.MustCompile(`^hsm-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "hsm_state", cloudhsmv2.HsmStateActive),
 					resource.TestCheckResourceAttrSet(resourceName, "ip_address"),
 					resource.TestCheckResourceAttrPair(resourceName, "subnet_id", "aws_subnet.test.0", "id"),
diff --git a/internal/service/cloudhsmv2/service_package.go b/internal/service/cloudhsmv2/service_package.go
index 1d9582985f2..d7e5f62dd52 100644
--- a/internal/service/cloudhsmv2/service_package.go
+++ b/internal/service/cloudhsmv2/service_package.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudhsmv2
 
 import (
diff --git a/internal/service/cloudhsmv2/service_package_gen.go b/internal/service/cloudhsmv2/service_package_gen.go
index 1e49a0fb360..06f30cc5c0e 100644
--- a/internal/service/cloudhsmv2/service_package_gen.go
+++ b/internal/service/cloudhsmv2/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	cloudhsmv2_sdkv1 "github.com/aws/aws-sdk-go/service/cloudhsmv2"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -59,4 +60,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*c
 	return cloudhsmv2_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/cloudhsmv2/status.go b/internal/service/cloudhsmv2/status.go
index cbbdb045000..85196f1a072 100644
--- a/internal/service/cloudhsmv2/status.go
+++ b/internal/service/cloudhsmv2/status.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudhsmv2
 
 import (
diff --git a/internal/service/cloudhsmv2/sweep.go b/internal/service/cloudhsmv2/sweep.go
index babfacfaa8a..ab5a2e5b8ae 100644
--- a/internal/service/cloudhsmv2/sweep.go
+++ b/internal/service/cloudhsmv2/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package cloudhsmv2
 
@@ -11,9 +11,10 @@ import (
 	"github.com/aws/aws-sdk-go/service/cloudhsmv2"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_cloudhsm_v2_cluster", &resource.Sweeper{
 		Name:         "aws_cloudhsm_v2_cluster",
 		F:            sweepClusters,
@@ -28,7 +29,7 @@ func init() {
 
 func sweepClusters(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -55,7 +56,7 @@ func sweepClusters(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping CloudHSMv2 Cluster sweep for %s: %s", region, err)
 		return nil
 	}
@@ -64,7 +65,7 @@ func sweepClusters(region string) error {
 		return fmt.Errorf("error listing CloudHSMv2 Clusters (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping CloudHSMv2 Clusters (%s): %w", region, err)
@@ -75,7 +76,7 @@ func sweepClusters(region string) error {
 
 func sweepHSMs(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -105,7 +106,7 @@ func sweepHSMs(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping CloudHSMv2 HSM sweep for %s: %s", region, err)
 		return nil
 	}
@@ -114,7 +115,7 @@ func sweepHSMs(region string) error {
 		return fmt.Errorf("error listing CloudHSMv2 HSMs (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping CloudHSMv2 HSMs (%s): %w", region, err)
diff --git a/internal/service/cloudhsmv2/tags_gen.go b/internal/service/cloudhsmv2/tags_gen.go
index 456af59b999..f61f9fff5c8 100644
--- a/internal/service/cloudhsmv2/tags_gen.go
+++ b/internal/service/cloudhsmv2/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/cloudhsmv2"
 	"github.com/aws/aws-sdk-go/service/cloudhsmv2/cloudhsmv2iface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -102,6 +104,8 @@ func updateTags(ctx context.Context, conn cloudhsmv2iface.CloudHSMV2API, identif
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.CloudHSMV2)
 	if len(removedTags) > 0 {
diff --git a/internal/service/cloudhsmv2/wait.go b/internal/service/cloudhsmv2/wait.go
index 622e1aa4aee..4bd900b6a1c 100644
--- a/internal/service/cloudhsmv2/wait.go
+++ b/internal/service/cloudhsmv2/wait.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudhsmv2
 
 import (
diff --git a/internal/service/cloudsearch/domain.go b/internal/service/cloudsearch/domain.go
index 7fdc1bb93f4..9901fbe2873 100644
--- a/internal/service/cloudsearch/domain.go
+++ b/internal/service/cloudsearch/domain.go
@@ -1,13 +1,16 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudsearch
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"strconv"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/cloudsearch"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -118,7 +121,7 @@ func ResourceDomain() *schema.Resource {
 						"source_fields": {
 							Type:         schema.TypeString,
 							Optional:     true,
-							ValidateFunc: validation.StringDoesNotMatch(regexp.MustCompile(`score`), "Cannot be set to reserved field score"),
+							ValidateFunc: validation.StringDoesNotMatch(regexache.MustCompile(`score`), "Cannot be set to reserved field score"),
 						},
 						"type": {
 							Type:         schema.TypeString,
@@ -137,7 +140,7 @@ func ResourceDomain() *schema.Resource {
 				Type:         schema.TypeString,
 				Required:     true,
 				ForceNew:     true,
-				ValidateFunc: validation.StringMatch(regexp.MustCompile(`^[a-z]([a-z0-9-]){2,27}$`), "Search domain names must start with a lowercase letter (a-z) and be at least 3 and no more than 28 lower-case letters, digits or hyphens"),
+				ValidateFunc: validation.StringMatch(regexache.MustCompile(`^[a-z]([0-9a-z-]){2,27}$`), "Search domain names must start with a lowercase letter (a-z) and be at least 3 and no more than 28 lower-case letters, digits or hyphens"),
 			},
 			"scaling_parameters": {
 				Type:     schema.TypeList,
@@ -493,7 +496,7 @@ func resourceDomainDelete(ctx context.Context, d *schema.ResourceData, meta inte
 func validateIndexName(v interface{}, k string) (ws []string, es []error) {
 	value := v.(string)
 
-	if !regexp.MustCompile(`^(\*?[a-z][a-z0-9_]{2,63}|[a-z][a-z0-9_]{2,63}\*?)$`).MatchString(value) {
+	if !regexache.MustCompile(`^(\*?[a-z][0-9a-z_]{2,63}|[a-z][0-9a-z_]{2,63}\*?)$`).MatchString(value) {
 		es = append(es, fmt.Errorf(
 			"%q must begin with a letter and be at least 3 and no more than 64 characters long", k))
 	}
diff --git a/internal/service/cloudsearch/domain_service_access_policy.go b/internal/service/cloudsearch/domain_service_access_policy.go
index f0572e69128..aa94b0c0979 100644
--- a/internal/service/cloudsearch/domain_service_access_policy.go
+++ b/internal/service/cloudsearch/domain_service_access_policy.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudsearch
 
 import (
diff --git a/internal/service/cloudsearch/domain_service_access_policy_test.go b/internal/service/cloudsearch/domain_service_access_policy_test.go
index 655cd5ea785..562dc3b1a8f 100644
--- a/internal/service/cloudsearch/domain_service_access_policy_test.go
+++ b/internal/service/cloudsearch/domain_service_access_policy_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudsearch_test
 
 import (
diff --git a/internal/service/cloudsearch/domain_test.go b/internal/service/cloudsearch/domain_test.go
index 3f8f1ac6cae..469650fa9be 100644
--- a/internal/service/cloudsearch/domain_test.go
+++ b/internal/service/cloudsearch/domain_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudsearch_test
 
 import (
diff --git a/internal/service/cloudsearch/generate.go b/internal/service/cloudsearch/generate.go
index 85a62954801..eae13231dfb 100644
--- a/internal/service/cloudsearch/generate.go
+++ b/internal/service/cloudsearch/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
 
diff --git a/internal/service/cloudsearch/service_package_gen.go b/internal/service/cloudsearch/service_package_gen.go
index 4d9a0d49a63..0d18b71f5a8 100644
--- a/internal/service/cloudsearch/service_package_gen.go
+++ b/internal/service/cloudsearch/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	cloudsearch_sdkv1 "github.com/aws/aws-sdk-go/service/cloudsearch"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -50,4 +51,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*c
 	return cloudsearch_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/cloudsearch/sweep.go b/internal/service/cloudsearch/sweep.go
index 37d63cab213..ccfdd0a29b2 100644
--- a/internal/service/cloudsearch/sweep.go
+++ b/internal/service/cloudsearch/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package cloudsearch
 
@@ -11,9 +11,10 @@ import (
 	"github.com/aws/aws-sdk-go/service/cloudsearch"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_cloudsearch_domain", &resource.Sweeper{
 		Name: "aws_cloudsearch_domain",
 		F:    sweepDomains,
@@ -22,7 +23,7 @@ func init() {
 
 func sweepDomains(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -44,7 +45,7 @@ func sweepDomains(region string) error {
 		sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
 	}
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping CloudSearch Domain sweep for %s: %s", region, err)
 		return nil
 	}
@@ -53,7 +54,7 @@ func sweepDomains(region string) error {
 		return fmt.Errorf("error listing CloudSearch Domains (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping CloudSearch Domains (%s): %w", region, err)
diff --git a/internal/service/cloudtrail/cloudtrail.go b/internal/service/cloudtrail/cloudtrail.go
index e9f9d69ec70..ca25e1c8c3c 100644
--- a/internal/service/cloudtrail/cloudtrail.go
+++ b/internal/service/cloudtrail/cloudtrail.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudtrail
 
 import (
diff --git a/internal/service/cloudtrail/cloudtrail_test.go b/internal/service/cloudtrail/cloudtrail_test.go
index 41d53599e75..0335f635726 100644
--- a/internal/service/cloudtrail/cloudtrail_test.go
+++ b/internal/service/cloudtrail/cloudtrail_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudtrail_test
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/cloudtrail"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -535,7 +538,7 @@ func testAcc_eventSelectorDynamoDB(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "event_selector.0.data_resource.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "event_selector.0.data_resource.0.type", "AWS::DynamoDB::Table"),
 					resource.TestCheckResourceAttr(resourceName, "event_selector.0.data_resource.0.values.#", "1"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "event_selector.0.data_resource.0.values.0", "dynamodb", regexp.MustCompile(`table/tf-acc-test-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "event_selector.0.data_resource.0.values.0", "dynamodb", regexache.MustCompile(`table/tf-acc-test-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "event_selector.0.include_management_events", "true"),
 					resource.TestCheckResourceAttr(resourceName, "event_selector.0.read_write_type", "All"),
 				),
diff --git a/internal/service/cloudtrail/consts.go b/internal/service/cloudtrail/consts.go
index 96f9bdc3a4a..035c9202bea 100644
--- a/internal/service/cloudtrail/consts.go
+++ b/internal/service/cloudtrail/consts.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudtrail
 
 import (
diff --git a/internal/service/cloudtrail/event_data_store.go b/internal/service/cloudtrail/event_data_store.go
index e66d55aeee6..a21c57c2891 100644
--- a/internal/service/cloudtrail/event_data_store.go
+++ b/internal/service/cloudtrail/event_data_store.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudtrail
 
 import (
diff --git a/internal/service/cloudtrail/event_data_store_test.go b/internal/service/cloudtrail/event_data_store_test.go
index 6eaf263714d..f9f01c92db6 100644
--- a/internal/service/cloudtrail/event_data_store_test.go
+++ b/internal/service/cloudtrail/event_data_store_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudtrail_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/cloudtrail"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -39,7 +42,7 @@ func TestAccCloudTrailEventDataStore_basic(t *testing.T) {
 						"field":    "eventCategory",
 					}),
 					resource.TestCheckResourceAttr(resourceName, "advanced_event_selector.0.name", "Default management events"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "cloudtrail", regexp.MustCompile(`eventdatastore/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "cloudtrail", regexache.MustCompile(`eventdatastore/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "multi_region_enabled", "true"),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "organization_enabled", "false"),
@@ -73,7 +76,7 @@ func TestAccCloudTrailEventDataStore_kmsKeyId(t *testing.T) {
 				Config: testAccEventDataStoreConfig_kmsKeyId(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckEventDataStoreExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "cloudtrail", regexp.MustCompile(`eventdatastore/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "cloudtrail", regexache.MustCompile(`eventdatastore/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "multi_region_enabled", "true"),
 					resource.TestCheckResourceAttr(resourceName, "organization_enabled", "false"),
diff --git a/internal/service/cloudtrail/generate.go b/internal/service/cloudtrail/generate.go
index dc8d7c8e405..49c7b5278ce 100644
--- a/internal/service/cloudtrail/generate.go
+++ b/internal/service/cloudtrail/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTags -ListTagsOp=ListTags -ListTagsInIDElem=ResourceIdList -ListTagsInIDNeedSlice=yes -ListTagsOutTagsElem=ResourceTagList[0].TagsList -ServiceTagsSlice -TagOp=AddTags -TagInIDElem=ResourceId -TagInTagsElem=TagsList -UntagOp=RemoveTags -UntagInNeedTagType -UntagInTagsElem=TagsList -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/cloudtrail/service_account_data_source.go b/internal/service/cloudtrail/service_account_data_source.go
index ede3a31cc17..698e76c2f67 100644
--- a/internal/service/cloudtrail/service_account_data_source.go
+++ b/internal/service/cloudtrail/service_account_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudtrail
 
 import (
@@ -38,6 +41,7 @@ var ServiceAccountPerRegionMap = map[string]string{
 	endpoints.EuWest1RegionID:      "859597730677",
 	endpoints.EuWest2RegionID:      "282025262664",
 	endpoints.EuWest3RegionID:      "262312530599",
+	endpoints.IlCentral1RegionID:   "683224464357",
 	endpoints.MeCentral1RegionID:   "585772288577",
 	endpoints.MeSouth1RegionID:     "034638983726",
 	endpoints.SaEast1RegionID:      "814480443879",
diff --git a/internal/service/cloudtrail/service_account_data_source_test.go b/internal/service/cloudtrail/service_account_data_source_test.go
index 891c20e1cd0..9eedd15b3cd 100644
--- a/internal/service/cloudtrail/service_account_data_source_test.go
+++ b/internal/service/cloudtrail/service_account_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudtrail_test
 
 import (
diff --git a/internal/service/cloudtrail/service_package_gen.go b/internal/service/cloudtrail/service_package_gen.go
index 88d8c959101..8d39defce07 100644
--- a/internal/service/cloudtrail/service_package_gen.go
+++ b/internal/service/cloudtrail/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	cloudtrail_sdkv1 "github.com/aws/aws-sdk-go/service/cloudtrail"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -63,4 +64,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*c
 	return cloudtrail_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/cloudtrail/sweep.go b/internal/service/cloudtrail/sweep.go
index 03a435fc0b7..9ed0b3a751d 100644
--- a/internal/service/cloudtrail/sweep.go
+++ b/internal/service/cloudtrail/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package cloudtrail
 
@@ -13,9 +13,10 @@ import (
 	"github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_cloudtrail", &resource.Sweeper{
 		Name: "aws_cloudtrail",
 		F:    sweeps,
@@ -24,7 +25,7 @@ func init() {
 
 func sweeps(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
@@ -81,7 +82,7 @@ func sweeps(region string) error {
 
 		return !lastPage
 	})
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping CloudTrail sweep for %s: %s", region, err)
 		return sweeperErrs.ErrorOrNil() // In case we have completed some pages, but had errors
 	}
diff --git a/internal/service/cloudtrail/tags_gen.go b/internal/service/cloudtrail/tags_gen.go
index 2f679666f17..3ff41754a98 100644
--- a/internal/service/cloudtrail/tags_gen.go
+++ b/internal/service/cloudtrail/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/cloudtrail"
 	"github.com/aws/aws-sdk-go/service/cloudtrail/cloudtrailiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -102,6 +104,8 @@ func updateTags(ctx context.Context, conn cloudtrailiface.CloudTrailAPI, identif
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.CloudTrail)
 	if len(removedTags) > 0 {
diff --git a/internal/service/cloudwatch/composite_alarm.go b/internal/service/cloudwatch/composite_alarm.go
index 75ecbb55ea1..ec1441a1a10 100644
--- a/internal/service/cloudwatch/composite_alarm.go
+++ b/internal/service/cloudwatch/composite_alarm.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudwatch
 
 import (
@@ -40,6 +43,27 @@ func ResourceCompositeAlarm() *schema.Resource {
 				Default:  true,
 				ForceNew: true,
 			},
+			"actions_suppressor": {
+				Type:     schema.TypeList,
+				Optional: true,
+				MaxItems: 1,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"alarm": {
+							Type:     schema.TypeString,
+							Required: true,
+						},
+						"extension_period": {
+							Type:     schema.TypeInt,
+							Required: true,
+						},
+						"wait_period": {
+							Type:     schema.TypeInt,
+							Required: true,
+						},
+					},
+				},
+			},
 			"alarm_actions": {
 				Type:     schema.TypeSet,
 				Optional: true,
@@ -158,6 +182,13 @@ func resourceCompositeAlarmRead(ctx context.Context, d *schema.ResourceData, met
 	}
 
 	d.Set("actions_enabled", alarm.ActionsEnabled)
+	if alarm.ActionsSuppressor != nil {
+		if err := d.Set("actions_suppressor", []interface{}{flattenActionsSuppressor(alarm)}); err != nil {
+			return diag.Errorf("setting actions_suppressor: %s", err)
+		}
+	} else {
+		d.Set("actions_suppressor", nil)
+	}
 	d.Set("alarm_actions", aws.StringValueSlice(alarm.AlarmActions))
 	d.Set("alarm_description", alarm.AlarmDescription)
 	d.Set("alarm_name", alarm.AlarmName)
@@ -223,15 +254,11 @@ func FindCompositeAlarmByName(ctx context.Context, conn *cloudwatch.CloudWatch,
 		return nil, err
 	}
 
-	if output == nil || len(output.CompositeAlarms) == 0 || output.CompositeAlarms[0] == nil {
+	if output == nil {
 		return nil, tfresource.NewEmptyResultError(input)
 	}
 
-	if count := len(output.CompositeAlarms); count > 1 {
-		return nil, tfresource.NewTooManyResultsError(count, input)
-	}
-
-	return output.CompositeAlarms[0], nil
+	return tfresource.AssertSinglePtrResult(output.CompositeAlarms)
 }
 
 func expandPutCompositeAlarmInput(ctx context.Context, d *schema.ResourceData) *cloudwatch.PutCompositeAlarmInput {
@@ -244,6 +271,13 @@ func expandPutCompositeAlarmInput(ctx context.Context, d *schema.ResourceData) *
 		apiObject.AlarmActions = flex.ExpandStringSet(v.(*schema.Set))
 	}
 
+	if v, ok := d.GetOk("actions_suppressor"); ok && v != nil && len(v.([]interface{})) > 0 {
+		alarm := expandActionsSuppressor(v.([]interface{}))
+		apiObject.ActionsSuppressor = alarm.ActionsSuppressor
+		apiObject.ActionsSuppressorExtensionPeriod = alarm.ActionsSuppressorExtensionPeriod
+		apiObject.ActionsSuppressorWaitPeriod = alarm.ActionsSuppressorWaitPeriod
+	}
+
 	if v, ok := d.GetOk("alarm_description"); ok {
 		apiObject.AlarmDescription = aws.String(v.(string))
 	}
@@ -266,3 +300,33 @@ func expandPutCompositeAlarmInput(ctx context.Context, d *schema.ResourceData) *
 
 	return apiObject
 }
+
+func flattenActionsSuppressor(alarm *cloudwatch.CompositeAlarm) map[string]interface{} {
+	actionsSuppressor := map[string]interface{}{
+		"alarm":            aws.StringValue(alarm.ActionsSuppressor),
+		"extension_period": aws.Int64Value(alarm.ActionsSuppressorExtensionPeriod),
+		"wait_period":      aws.Int64Value(alarm.ActionsSuppressorWaitPeriod),
+	}
+	return actionsSuppressor
+}
+
+func expandActionsSuppressor(v []interface{}) *cloudwatch.CompositeAlarm {
+	if v[0] == nil {
+		return nil
+	}
+
+	alarmResource := v[0].(map[string]interface{})
+	alarm := cloudwatch.CompositeAlarm{}
+
+	if v, ok := alarmResource["alarm"]; ok && v.(string) != "" {
+		alarm.ActionsSuppressor = aws.String(v.(string))
+	}
+	if v, ok := alarmResource["extension_period"]; ok {
+		alarm.ActionsSuppressorExtensionPeriod = aws.Int64(int64(v.(int)))
+	}
+	if v, ok := alarmResource["wait_period"]; ok {
+		alarm.ActionsSuppressorWaitPeriod = aws.Int64(int64(v.(int)))
+	}
+
+	return &alarm
+}
diff --git a/internal/service/cloudwatch/composite_alarm_test.go b/internal/service/cloudwatch/composite_alarm_test.go
index 5c4e9ee2af0..39638c29f1c 100644
--- a/internal/service/cloudwatch/composite_alarm_test.go
+++ b/internal/service/cloudwatch/composite_alarm_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudwatch_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/cloudwatch"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -32,11 +35,12 @@ func TestAccCloudWatchCompositeAlarm_basic(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckCompositeAlarmExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "actions_enabled", "true"),
+					resource.TestCheckResourceAttr(resourceName, "actions_suppressor.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "alarm_actions.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "alarm_description", ""),
 					resource.TestCheckResourceAttr(resourceName, "alarm_name", rName),
 					resource.TestCheckResourceAttr(resourceName, "alarm_rule", fmt.Sprintf("ALARM(%[1]s-0) OR ALARM(%[1]s-1)", rName)),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "cloudwatch", regexp.MustCompile(`alarm:.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "cloudwatch", regexache.MustCompile(`alarm:.+`)),
 					resource.TestCheckResourceAttr(resourceName, "insufficient_data_actions.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "ok_actions.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
@@ -386,6 +390,36 @@ func TestAccCloudWatchCompositeAlarm_allActions(t *testing.T) {
 	})
 }
 
+func TestAccCloudWatchCompositeAlarm_actionsSuppressor(t *testing.T) {
+	ctx := acctest.Context(t)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_cloudwatch_composite_alarm.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, cloudwatch.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckCompositeAlarmDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccCompositeAlarmConfig_actionSuppressor(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckCompositeAlarmExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "actions_suppressor.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "actions_suppressor.0.alarm", fmt.Sprintf("%[1]s-0", rName)),
+					resource.TestCheckResourceAttr(resourceName, "actions_suppressor.0.extension_period", "10"),
+					resource.TestCheckResourceAttr(resourceName, "actions_suppressor.0.wait_period", "20"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
 func testAccCheckCompositeAlarmDestroy(ctx context.Context) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		conn := acctest.Provider.Meta().(*conns.AWSClient).CloudWatchConn(ctx)
@@ -623,3 +657,26 @@ resource "aws_cloudwatch_composite_alarm" "test" {
 }
 `, rName))
 }
+
+func testAccCompositeAlarmConfig_actionSuppressor(rName string) string {
+	return acctest.ConfigCompose(testAccCompositeAlarmConfig_base(rName), fmt.Sprintf(`
+resource "aws_sns_topic" "test" {
+  count = 3
+  name  = "%[1]s-${count.index}"
+}
+
+resource "aws_cloudwatch_composite_alarm" "test" {
+  alarm_actions             = [aws_sns_topic.test[0].arn]
+  alarm_name                = %[1]q
+  alarm_rule                = "ALARM(${aws_cloudwatch_metric_alarm.test[0].alarm_name})"
+  insufficient_data_actions = [aws_sns_topic.test[1].arn]
+  ok_actions                = [aws_sns_topic.test[2].arn]
+
+  actions_suppressor {
+    alarm            = aws_cloudwatch_metric_alarm.test[0].alarm_name
+    extension_period = 10
+    wait_period      = 20
+  }
+}
+`, rName))
+}
diff --git a/internal/service/cloudwatch/consts.go b/internal/service/cloudwatch/consts.go
index 70ac0cdd239..a2ffad3a878 100644
--- a/internal/service/cloudwatch/consts.go
+++ b/internal/service/cloudwatch/consts.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudwatch
 
 const (
diff --git a/internal/service/cloudwatch/dashboard.go b/internal/service/cloudwatch/dashboard.go
index 359daac1cbd..688ea38eb12 100644
--- a/internal/service/cloudwatch/dashboard.go
+++ b/internal/service/cloudwatch/dashboard.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudwatch
 
 import (
diff --git a/internal/service/cloudwatch/dashboard_test.go b/internal/service/cloudwatch/dashboard_test.go
index bdb64e315b1..f450a278362 100644
--- a/internal/service/cloudwatch/dashboard_test.go
+++ b/internal/service/cloudwatch/dashboard_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudwatch_test
 
 import (
diff --git a/internal/service/cloudwatch/generate.go b/internal/service/cloudwatch/generate.go
index 54216554510..5e45b181003 100644
--- a/internal/service/cloudwatch/generate.go
+++ b/internal/service/cloudwatch/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTags -ListTagsInIDElem=ResourceARN -ServiceTagsSlice -TagInIDElem=ResourceARN -UpdateTags -CreateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/cloudwatch/metric_alarm.go b/internal/service/cloudwatch/metric_alarm.go
index 66f820503cb..6883e749684 100644
--- a/internal/service/cloudwatch/metric_alarm.go
+++ b/internal/service/cloudwatch/metric_alarm.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudwatch
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/cloudwatch"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -105,7 +108,7 @@ func ResourceMetricAlarm() *schema.Resource {
 				ConflictsWith: []string{"statistic", "metric_query"},
 				ValidateFunc: validation.StringMatch(
 					// doesn't catch: PR with %-values provided, TM/WM/PR/TC/TS with no values provided
-					regexp.MustCompile(`^((p|(tm)|(wm)|(tc)|(ts))((\d{1,2}(\.\d{1,2})?)|(100))|(IQM)|(((TM)|(WM)|(PR)|(TC)|(TS)))\((\d+(\.\d+)?%?)?:(\d+(\.\d+)?%?)?\))$`),
+					regexache.MustCompile(`^((p|(tm)|(wm)|(tc)|(ts))((\d{1,2}(\.\d{1,2})?)|(100))|(IQM)|(((TM)|(WM)|(PR)|(TC)|(TS)))\((\d+(\.\d+)?%?)?:(\d+(\.\d+)?%?)?\))$`),
 					"invalid statistic, see: https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Statistics-definitions.html",
 				),
 			},
@@ -169,7 +172,7 @@ func ResourceMetricAlarm() *schema.Resource {
 										Optional: true,
 										ValidateFunc: validation.All(
 											validation.StringLenBetween(1, 255),
-											validation.StringMatch(regexp.MustCompile(`[^:].*`), "must not contain colon characters"),
+											validation.StringMatch(regexache.MustCompile(`[^:].*`), "must not contain colon characters"),
 										),
 									},
 									"period": {
@@ -187,7 +190,7 @@ func ResourceMetricAlarm() *schema.Resource {
 											validation.StringInSlice(cloudwatch.Statistic_Values(), false),
 											validation.StringMatch(
 												// doesn't catch: PR with %-values provided, TM/WM/PR/TC/TS with no values provided
-												regexp.MustCompile(`^((p|(tm)|(wm)|(tc)|(ts))((\d{1,2}(\.\d{1,2})?)|(100))|(IQM)|(((TM)|(WM)|(PR)|(TC)|(TS)))\((\d+(\.\d+)?%?)?:(\d+(\.\d+)?%?)?\))$`),
+												regexache.MustCompile(`^((p|(tm)|(wm)|(tc)|(ts))((\d{1,2}(\.\d{1,2})?)|(100))|(IQM)|(((TM)|(WM)|(PR)|(TC)|(TS)))\((\d+(\.\d+)?%?)?:(\d+(\.\d+)?%?)?\))$`),
 												"invalid statistic, see: https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Statistics-definitions.html",
 											),
 										),
@@ -226,7 +229,7 @@ func ResourceMetricAlarm() *schema.Resource {
 				ConflictsWith: []string{"metric_query"},
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 255),
-					validation.StringMatch(regexp.MustCompile(`[^:].*`), "must not contain colon characters"),
+					validation.StringMatch(regexache.MustCompile(`[^:].*`), "must not contain colon characters"),
 				),
 			},
 			"ok_actions": {
diff --git a/internal/service/cloudwatch/metric_alarm_migrate.go b/internal/service/cloudwatch/metric_alarm_migrate.go
index 0c8f0415028..48098a12349 100644
--- a/internal/service/cloudwatch/metric_alarm_migrate.go
+++ b/internal/service/cloudwatch/metric_alarm_migrate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudwatch
 
 import (
diff --git a/internal/service/cloudwatch/metric_alarm_migrate_test.go b/internal/service/cloudwatch/metric_alarm_migrate_test.go
index 20d6c8fa645..8dd2268625d 100644
--- a/internal/service/cloudwatch/metric_alarm_migrate_test.go
+++ b/internal/service/cloudwatch/metric_alarm_migrate_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudwatch_test
 
 import (
diff --git a/internal/service/cloudwatch/metric_alarm_test.go b/internal/service/cloudwatch/metric_alarm_test.go
index f04078afbf6..f9e9694c696 100755
--- a/internal/service/cloudwatch/metric_alarm_test.go
+++ b/internal/service/cloudwatch/metric_alarm_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudwatch_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/cloudwatch"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -34,7 +37,7 @@ func TestAccCloudWatchMetricAlarm_basic(t *testing.T) {
 					testAccCheckMetricAlarmExists(ctx, resourceName, &alarm),
 					resource.TestCheckResourceAttr(resourceName, "metric_name", "CPUUtilization"),
 					resource.TestCheckResourceAttr(resourceName, "statistic", "Average"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "cloudwatch", regexp.MustCompile(`alarm:.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "cloudwatch", regexache.MustCompile(`alarm:.+`)),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 					resource.TestCheckResourceAttr(resourceName, "alarm_description", "This metric monitors ec2 cpu utilization"),
 					resource.TestCheckResourceAttr(resourceName, "threshold", "80"),
@@ -272,35 +275,35 @@ func TestAccCloudWatchMetricAlarm_extendedStatistic(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccMetricAlarmConfig_extendedStatistic(rName, "IQM(1:2)"), // IQM accepts no args
-				ExpectError: regexp.MustCompile(`invalid statistic, see: https:\/\/docs\.aws\.amazon\.com\/.*`),
+				ExpectError: regexache.MustCompile(`invalid statistic, see: https:\/\/docs\.aws\.amazon\.com\/.*`),
 			},
 			{
 				Config:      testAccMetricAlarmConfig_extendedStatistic(rName, "iqm10"), // IQM accepts no args
-				ExpectError: regexp.MustCompile(`invalid statistic, see: https:\/\/docs\.aws\.amazon\.com\/.*`),
+				ExpectError: regexache.MustCompile(`invalid statistic, see: https:\/\/docs\.aws\.amazon\.com\/.*`),
 			},
 			// {  TODO: more complex regex to reject this
 			// 	Config: testAccMetricAlarmConfig_extendedStatistic(rName, "PR(5%:10%)"),  // PR args must be absolute
-			// 	ExpectError: regexp.MustCompile(`invalid statistic, see: https:\/\/docs\.aws\.amazon\.com\/.*`),
+			// 	ExpectError: regexache.MustCompile(`invalid statistic, see: https:\/\/docs\.aws\.amazon\.com\/.*`),
 			// },
 			// {  TODO: more complex regex to reject this
 			// 	Config: testAccMetricAlarmConfig_extendedStatistic(rName, "TC(:)"),  // at least one arg must be provided
-			// 	ExpectError: regexp.MustCompile(`invalid statistic, see: https:\/\/docs\.aws\.amazon\.com\/.*`),
+			// 	ExpectError: regexache.MustCompile(`invalid statistic, see: https:\/\/docs\.aws\.amazon\.com\/.*`),
 			// },
 			{
 				Config:      testAccMetricAlarmConfig_extendedStatistic(rName, "WM"), // missing syntax
-				ExpectError: regexp.MustCompile(`invalid statistic, see: https:\/\/docs\.aws\.amazon\.com\/.*`),
+				ExpectError: regexache.MustCompile(`invalid statistic, see: https:\/\/docs\.aws\.amazon\.com\/.*`),
 			},
 			{
 				Config:      testAccMetricAlarmConfig_extendedStatistic(rName, "p"), // missing arg
-				ExpectError: regexp.MustCompile(`invalid statistic, see: https:\/\/docs\.aws\.amazon\.com\/.*`),
+				ExpectError: regexache.MustCompile(`invalid statistic, see: https:\/\/docs\.aws\.amazon\.com\/.*`),
 			},
 			{
 				Config:      testAccMetricAlarmConfig_extendedStatistic(rName, "AB(1:2)"), // unknown stat 'AB'
-				ExpectError: regexp.MustCompile(`invalid statistic, see: https:\/\/docs\.aws\.amazon\.com\/.*`),
+				ExpectError: regexache.MustCompile(`invalid statistic, see: https:\/\/docs\.aws\.amazon\.com\/.*`),
 			},
 			{
 				Config:      testAccMetricAlarmConfig_extendedStatistic(rName, "cd42"), // unknown stat 'cd'
-				ExpectError: regexp.MustCompile(`invalid statistic, see: https:\/\/docs\.aws\.amazon\.com\/.*`),
+				ExpectError: regexache.MustCompile(`invalid statistic, see: https:\/\/docs\.aws\.amazon\.com\/.*`),
 			},
 			{
 				Config: testAccMetricAlarmConfig_extendedStatistic(rName, "p88.0"),
@@ -425,7 +428,7 @@ func TestAccCloudWatchMetricAlarm_metricQuery(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccMetricAlarmConfig_badMetricQuery(rName),
-				ExpectError: regexp.MustCompile("No metric_query may have both `expression` and a `metric` specified"),
+				ExpectError: regexache.MustCompile("No metric_query may have both `expression` and a `metric` specified"),
 			},
 			{
 				Config: testAccMetricAlarmConfig_metricQueryExpressionQuery(rName),
@@ -564,7 +567,7 @@ func TestAccCloudWatchMetricAlarm_missingStatistic(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccMetricAlarmConfig_missingStatistic(rName),
-				ExpectError: regexp.MustCompile("One of `statistic` or `extended_statistic` must be set for a cloudwatch metric alarm"),
+				ExpectError: regexache.MustCompile("One of `statistic` or `extended_statistic` must be set for a cloudwatch metric alarm"),
 			},
 		},
 	})
diff --git a/internal/service/cloudwatch/metric_stream.go b/internal/service/cloudwatch/metric_stream.go
index f0397863645..d9e12053e9d 100644
--- a/internal/service/cloudwatch/metric_stream.go
+++ b/internal/service/cloudwatch/metric_stream.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudwatch
 
 import (
 	"context"
 	"log"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/cloudwatch"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -153,16 +156,16 @@ func ResourceMetricStream() *schema.Resource {
 								ValidateFunc: validation.All(
 									validation.Any(
 										validation.StringMatch(
-											regexp.MustCompile(`(^IQM$)|(^(p|tc|tm|ts|wm)(100|\d{1,2})(\.\d{0,10})?$)|(^[ou]\d+(\.\d*)?$)`),
+											regexache.MustCompile(`(^IQM$)|(^(p|tc|tm|ts|wm)(100|\d{1,2})(\.\d{0,10})?$)|(^[ou]\d+(\.\d*)?$)`),
 											"invalid statistic, see: https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Statistics-definitions.html",
 										),
 										validation.StringMatch(
-											regexp.MustCompile(`^(TM|TC|TS|WM)\(((((\d{1,2})(\.\d{0,10})?|100(\.0{0,10})?)%)?:((\d{1,2})(\.\d{0,10})?|100(\.0{0,10})?)%|((\d{1,2})(\.\d{0,10})?|100(\.0{0,10})?)%:(((\d{1,2})(\.\d{0,10})?|100(\.0{0,10})?)%)?)\)|(TM|TC|TS|WM|PR)\(((\d+(\.\d{0,10})?|(\d+(\.\d{0,10})?[Ee][+-]?\d+)):((\d+(\.\d{0,10})?|(\d+(\.\d{0,10})?[Ee][+-]?\d+)))?|((\d+(\.\d{0,10})?|(\d+(\.\d{0,10})?[Ee][+-]?\d+)))?:(\d+(\.\d{0,10})?|(\d+(\.\d{0,10})?[Ee][+-]?\d+)))\)$`),
+											regexache.MustCompile(`^(TM|TC|TS|WM)\(((((\d{1,2})(\.\d{0,10})?|100(\.0{0,10})?)%)?:((\d{1,2})(\.\d{0,10})?|100(\.0{0,10})?)%|((\d{1,2})(\.\d{0,10})?|100(\.0{0,10})?)%:(((\d{1,2})(\.\d{0,10})?|100(\.0{0,10})?)%)?)\)|(TM|TC|TS|WM|PR)\(((\d+(\.\d{0,10})?|(\d+(\.\d{0,10})?[Ee][+-]?\d+)):((\d+(\.\d{0,10})?|(\d+(\.\d{0,10})?[Ee][+-]?\d+)))?|((\d+(\.\d{0,10})?|(\d+(\.\d{0,10})?[Ee][+-]?\d+)))?:(\d+(\.\d{0,10})?|(\d+(\.\d{0,10})?[Ee][+-]?\d+)))\)$`),
 											"invalid statistic, see: https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Statistics-definitions.html",
 										),
 									),
 									validation.StringDoesNotMatch(
-										regexp.MustCompile(`^p0(\.0{0,10})?|p100(\.\d{0,10})?$`),
+										regexache.MustCompile(`^p0(\.0{0,10})?|p100(\.\d{0,10})?$`),
 										"invalid statistic, see: https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Statistics-definitions.html",
 									),
 								),
@@ -443,7 +446,7 @@ func waitMetricStreamRunning(ctx context.Context, conn *cloudwatch.CloudWatch, n
 func validateMetricStreamName(v interface{}, k string) (ws []string, errors []error) {
 	return validation.All(
 		validation.StringLenBetween(1, 255),
-		validation.StringMatch(regexp.MustCompile(`^[\-_A-Za-z0-9]*$`), "must match [\\-_A-Za-z0-9]"),
+		validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_-]*$`), "must match [0-9A-Za-z_-]"),
 	)(v, k)
 }
 
diff --git a/internal/service/cloudwatch/metric_stream_test.go b/internal/service/cloudwatch/metric_stream_test.go
index 2c04f5a7c86..b3138420c72 100644
--- a/internal/service/cloudwatch/metric_stream_test.go
+++ b/internal/service/cloudwatch/metric_stream_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudwatch_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/cloudwatch"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -283,8 +286,8 @@ func TestAccCloudWatchMetricStream_update(t *testing.T) {
 				Config: testAccMetricStreamConfig_arns(rName, "S1"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckMetricStreamExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "firehose_arn", "firehose", regexp.MustCompile(`deliverystream/S1$`)),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "role_arn", "iam", regexp.MustCompile(`role/S1$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "firehose_arn", "firehose", regexache.MustCompile(`deliverystream/S1$`)),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "role_arn", "iam", regexache.MustCompile(`role/S1$`)),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 				),
 			},
@@ -297,8 +300,8 @@ func TestAccCloudWatchMetricStream_update(t *testing.T) {
 				Config: testAccMetricStreamConfig_arns(rName, "S2"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckMetricStreamExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "firehose_arn", "firehose", regexp.MustCompile(`deliverystream/S2$`)),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "role_arn", "iam", regexp.MustCompile(`role/S2$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "firehose_arn", "firehose", regexache.MustCompile(`deliverystream/S2$`)),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "role_arn", "iam", regexache.MustCompile(`role/S2$`)),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 				),
 			},
@@ -306,8 +309,8 @@ func TestAccCloudWatchMetricStream_update(t *testing.T) {
 				Config: testAccMetricStreamConfig_arnsWithTag(rName, "S3", "key1", "value1"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckMetricStreamExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "firehose_arn", "firehose", regexp.MustCompile(`deliverystream/S3$`)),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "role_arn", "iam", regexp.MustCompile(`role/S3$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "firehose_arn", "firehose", regexache.MustCompile(`deliverystream/S3$`)),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "role_arn", "iam", regexache.MustCompile(`role/S3$`)),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
 				),
@@ -316,8 +319,8 @@ func TestAccCloudWatchMetricStream_update(t *testing.T) {
 				Config: testAccMetricStreamConfig_arnsWithTag(rName, "S4", "key1", "value1"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckMetricStreamExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "firehose_arn", "firehose", regexp.MustCompile(`deliverystream/S4$`)),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "role_arn", "iam", regexp.MustCompile(`role/S4$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "firehose_arn", "firehose", regexache.MustCompile(`deliverystream/S4$`)),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "role_arn", "iam", regexache.MustCompile(`role/S4$`)),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
 				),
@@ -326,8 +329,8 @@ func TestAccCloudWatchMetricStream_update(t *testing.T) {
 				Config: testAccMetricStreamConfig_arnsWithTag(rName, "S4", "key1", "value1updated"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckMetricStreamExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "firehose_arn", "firehose", regexp.MustCompile(`deliverystream/S4$`)),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "role_arn", "iam", regexp.MustCompile(`role/S4$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "firehose_arn", "firehose", regexache.MustCompile(`deliverystream/S4$`)),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "role_arn", "iam", regexache.MustCompile(`role/S4$`)),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1updated"),
 				),
@@ -394,27 +397,27 @@ func TestAccCloudWatchMetricStream_additional_statistics(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccMetricStreamConfig_additionalStatistics(rName, "p0"),
-				ExpectError: regexp.MustCompile(`invalid statistic, see: https:\/\/docs\.aws\.amazon\.com\/.*`),
+				ExpectError: regexache.MustCompile(`invalid statistic, see: https:\/\/docs\.aws\.amazon\.com\/.*`),
 			},
 			{
 				Config:      testAccMetricStreamConfig_additionalStatistics(rName, "p100"),
-				ExpectError: regexp.MustCompile(`invalid statistic, see: https:\/\/docs\.aws\.amazon\.com\/.*`),
+				ExpectError: regexache.MustCompile(`invalid statistic, see: https:\/\/docs\.aws\.amazon\.com\/.*`),
 			},
 			{
 				Config:      testAccMetricStreamConfig_additionalStatistics(rName, "p"),
-				ExpectError: regexp.MustCompile(`invalid statistic, see: https:\/\/docs\.aws\.amazon\.com\/.*`),
+				ExpectError: regexache.MustCompile(`invalid statistic, see: https:\/\/docs\.aws\.amazon\.com\/.*`),
 			},
 			{
 				Config:      testAccMetricStreamConfig_additionalStatistics(rName, "tm"),
-				ExpectError: regexp.MustCompile(`invalid statistic, see: https:\/\/docs\.aws\.amazon\.com\/.*`),
+				ExpectError: regexache.MustCompile(`invalid statistic, see: https:\/\/docs\.aws\.amazon\.com\/.*`),
 			},
 			{
 				Config:      testAccMetricStreamConfig_additionalStatistics(rName, "tc()"),
-				ExpectError: regexp.MustCompile(`invalid statistic, see: https:\/\/docs\.aws\.amazon\.com\/.*`),
+				ExpectError: regexache.MustCompile(`invalid statistic, see: https:\/\/docs\.aws\.amazon\.com\/.*`),
 			},
 			{
 				Config:      testAccMetricStreamConfig_additionalStatistics(rName, "p99.12345678901"),
-				ExpectError: regexp.MustCompile(`invalid statistic, see: https:\/\/docs\.aws\.amazon\.com\/.*`),
+				ExpectError: regexache.MustCompile(`invalid statistic, see: https:\/\/docs\.aws\.amazon\.com\/.*`),
 			},
 			{
 				Config: testAccMetricStreamConfig_additionalStatistics(rName, "IQM"),
@@ -572,7 +575,8 @@ EOF
 }
 
 resource "aws_s3_bucket" "bucket" {
-  bucket = %[1]q
+  bucket        = %[1]q
+  force_destroy = true
 }
 
 resource "aws_iam_role" "firehose_to_s3" {
diff --git a/internal/service/cloudwatch/service_package_gen.go b/internal/service/cloudwatch/service_package_gen.go
index 613a13adb82..608f2fb673a 100644
--- a/internal/service/cloudwatch/service_package_gen.go
+++ b/internal/service/cloudwatch/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	cloudwatch_sdkv1 "github.com/aws/aws-sdk-go/service/cloudwatch"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -70,4 +71,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*c
 	return cloudwatch_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/cloudwatch/sweep.go b/internal/service/cloudwatch/sweep.go
index d5aa3b3d723..c04a006e80f 100644
--- a/internal/service/cloudwatch/sweep.go
+++ b/internal/service/cloudwatch/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package cloudwatch
 
@@ -11,9 +11,10 @@ import (
 	"github.com/aws/aws-sdk-go/service/cloudwatch"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_cloudwatch_composite_alarm", &resource.Sweeper{
 		Name: "aws_cloudwatch_composite_alarm",
 		F:    sweepCompositeAlarms,
@@ -22,7 +23,7 @@ func init() {
 
 func sweepCompositeAlarms(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
@@ -48,7 +49,7 @@ func sweepCompositeAlarms(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] SkippingCloudWatch Composite Alarm sweep for %s: %s", region, err)
 		return nil
 	}
@@ -57,7 +58,7 @@ func sweepCompositeAlarms(region string) error {
 		return fmt.Errorf("error listing CloudWatch Composite Alarms (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping CloudWatch Composite Alarms (%s): %w", region, err)
diff --git a/internal/service/cloudwatch/tags_gen.go b/internal/service/cloudwatch/tags_gen.go
index c919ebbb8db..e54959abddf 100644
--- a/internal/service/cloudwatch/tags_gen.go
+++ b/internal/service/cloudwatch/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/cloudwatch"
 	"github.com/aws/aws-sdk-go/service/cloudwatch/cloudwatchiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -111,6 +113,8 @@ func updateTags(ctx context.Context, conn cloudwatchiface.CloudWatchAPI, identif
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.CloudWatch)
 	if len(removedTags) > 0 {
diff --git a/internal/service/cloudwatch/validate.go b/internal/service/cloudwatch/validate.go
index d489392c5c2..00052d3a37b 100644
--- a/internal/service/cloudwatch/validate.go
+++ b/internal/service/cloudwatch/validate.go
@@ -1,8 +1,12 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudwatch
 
 import (
 	"fmt"
-	"regexp"
+
+	"github.com/YakDriver/regexache"
 )
 
 func validDashboardName(v interface{}, k string) (ws []string, errors []error) {
@@ -13,8 +17,8 @@ func validDashboardName(v interface{}, k string) (ws []string, errors []error) {
 	}
 
 	// http://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_PutDashboard.html
-	pattern := `^[\-_A-Za-z0-9]+$`
-	if !regexp.MustCompile(pattern).MatchString(value) {
+	pattern := `^[0-9A-Za-z_-]+$`
+	if !regexache.MustCompile(pattern).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"%q doesn't comply with restrictions (%q): %q",
 			k, pattern, value))
@@ -28,7 +32,7 @@ func validEC2AutomateARN(v interface{}, k string) (ws []string, errors []error)
 
 	// https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_PutMetricAlarm.html
 	pattern := `^arn:[\w-]+:automate:[\w-]+:ec2:(reboot|recover|stop|terminate)$`
-	if !regexp.MustCompile(pattern).MatchString(value) {
+	if !regexache.MustCompile(pattern).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"%q does not match EC2 automation ARN (%q): %q",
 			k, pattern, value))
diff --git a/internal/service/cloudwatch/validate_test.go b/internal/service/cloudwatch/validate_test.go
index 9759440cd5e..33a356b78a9 100644
--- a/internal/service/cloudwatch/validate_test.go
+++ b/internal/service/cloudwatch/validate_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cloudwatch
 
 import (
diff --git a/internal/service/codeartifact/authorization_token_data_source.go b/internal/service/codeartifact/authorization_token_data_source.go
index 96811a48ea0..879d641464f 100644
--- a/internal/service/codeartifact/authorization_token_data_source.go
+++ b/internal/service/codeartifact/authorization_token_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package codeartifact
 
 import (
diff --git a/internal/service/codeartifact/authorization_token_data_source_test.go b/internal/service/codeartifact/authorization_token_data_source_test.go
index d1924de8a8e..af72537207b 100644
--- a/internal/service/codeartifact/authorization_token_data_source_test.go
+++ b/internal/service/codeartifact/authorization_token_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package codeartifact_test
 
 import (
diff --git a/internal/service/codeartifact/codeartifact_test.go b/internal/service/codeartifact/codeartifact_test.go
index a301ff29f30..07e150ecf19 100644
--- a/internal/service/codeartifact/codeartifact_test.go
+++ b/internal/service/codeartifact/codeartifact_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package codeartifact_test
 
 import (
@@ -16,10 +19,11 @@ func TestAccCodeArtifact_serial(t *testing.T) {
 			"owner":    testAccAuthorizationTokenDataSource_owner,
 		},
 		"Domain": {
-			"basic":                testAccDomain_basic,
-			"defaultEncryptionKey": testAccDomain_defaultEncryptionKey,
-			"disappears":           testAccDomain_disappears,
-			"tags":                 testAccDomain_tags,
+			"basic":                         testAccDomain_basic,
+			"defaultEncryptionKey":          testAccDomain_defaultEncryptionKey,
+			"disappears":                    testAccDomain_disappears,
+			"migrateAssetSizeBytesToString": testAccDomain_MigrateAssetSizeBytesToString,
+			"tags":                          testAccDomain_tags,
 		},
 		"DomainPermissionsPolicy": {
 			"basic":            testAccDomainPermissionsPolicy_basic,
diff --git a/internal/service/codeartifact/consts.go b/internal/service/codeartifact/consts.go
index 0fb508f82d4..dc97c23cbeb 100644
--- a/internal/service/codeartifact/consts.go
+++ b/internal/service/codeartifact/consts.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package codeartifact
 
 const (
diff --git a/internal/service/codeartifact/domain.go b/internal/service/codeartifact/domain.go
index 4d0fed631e8..099302a4779 100644
--- a/internal/service/codeartifact/domain.go
+++ b/internal/service/codeartifact/domain.go
@@ -1,8 +1,12 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package codeartifact
 
 import (
 	"context"
 	"log"
+	"strconv"
 	"strings"
 	"time"
 
@@ -59,7 +63,7 @@ func ResourceDomain() *schema.Resource {
 				Computed: true,
 			},
 			"asset_size_bytes": {
-				Type:     schema.TypeInt,
+				Type:     schema.TypeString,
 				Computed: true,
 			},
 			"repository_count": {
@@ -128,7 +132,7 @@ func resourceDomainRead(ctx context.Context, d *schema.ResourceData, meta interf
 	d.Set("arn", arn)
 	d.Set("encryption_key", sm.Domain.EncryptionKey)
 	d.Set("owner", sm.Domain.Owner)
-	d.Set("asset_size_bytes", sm.Domain.AssetSizeBytes)
+	d.Set("asset_size_bytes", strconv.FormatInt(aws.Int64Value(sm.Domain.AssetSizeBytes), 10))
 	d.Set("repository_count", sm.Domain.RepositoryCount)
 	d.Set("created_time", sm.Domain.CreatedTime.Format(time.RFC3339))
 
diff --git a/internal/service/codeartifact/domain_permissions_policy.go b/internal/service/codeartifact/domain_permissions_policy.go
index 9b2eeef6af6..51be09fdba4 100644
--- a/internal/service/codeartifact/domain_permissions_policy.go
+++ b/internal/service/codeartifact/domain_permissions_policy.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package codeartifact
 
 import (
diff --git a/internal/service/codeartifact/domain_permissions_policy_test.go b/internal/service/codeartifact/domain_permissions_policy_test.go
index 39a1a260edd..e01274e5d78 100644
--- a/internal/service/codeartifact/domain_permissions_policy_test.go
+++ b/internal/service/codeartifact/domain_permissions_policy_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package codeartifact_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/codeartifact"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -34,7 +37,7 @@ func testAccDomainPermissionsPolicy_basic(t *testing.T) {
 					testAccCheckDomainPermissionsExists(ctx, resourceName),
 					resource.TestCheckResourceAttrPair(resourceName, "resource_arn", "aws_codeartifact_domain.test", "arn"),
 					resource.TestCheckResourceAttr(resourceName, "domain", rName),
-					resource.TestMatchResourceAttr(resourceName, "policy_document", regexp.MustCompile("codeartifact:CreateRepository")),
+					resource.TestMatchResourceAttr(resourceName, "policy_document", regexache.MustCompile("codeartifact:CreateRepository")),
 					resource.TestCheckResourceAttrPair(resourceName, "domain_owner", "aws_codeartifact_domain.test", "owner"),
 				),
 			},
@@ -49,8 +52,8 @@ func testAccDomainPermissionsPolicy_basic(t *testing.T) {
 					testAccCheckDomainPermissionsExists(ctx, resourceName),
 					resource.TestCheckResourceAttrPair(resourceName, "resource_arn", "aws_codeartifact_domain.test", "arn"),
 					resource.TestCheckResourceAttr(resourceName, "domain", rName),
-					resource.TestMatchResourceAttr(resourceName, "policy_document", regexp.MustCompile("codeartifact:CreateRepository")),
-					resource.TestMatchResourceAttr(resourceName, "policy_document", regexp.MustCompile("codeartifact:ListRepositoriesInDomain")),
+					resource.TestMatchResourceAttr(resourceName, "policy_document", regexache.MustCompile("codeartifact:CreateRepository")),
+					resource.TestMatchResourceAttr(resourceName, "policy_document", regexache.MustCompile("codeartifact:ListRepositoriesInDomain")),
 					resource.TestCheckResourceAttrPair(resourceName, "domain_owner", "aws_codeartifact_domain.test", "owner"),
 				),
 			},
@@ -75,8 +78,8 @@ func testAccDomainPermissionsPolicy_ignoreEquivalent(t *testing.T) {
 					testAccCheckDomainPermissionsExists(ctx, resourceName),
 					resource.TestCheckResourceAttrPair(resourceName, "resource_arn", "aws_codeartifact_domain.test", "arn"),
 					resource.TestCheckResourceAttr(resourceName, "domain", rName),
-					resource.TestMatchResourceAttr(resourceName, "policy_document", regexp.MustCompile("codeartifact:CreateRepository")),
-					resource.TestMatchResourceAttr(resourceName, "policy_document", regexp.MustCompile("codeartifact:ListRepositoriesInDomain")),
+					resource.TestMatchResourceAttr(resourceName, "policy_document", regexache.MustCompile("codeartifact:CreateRepository")),
+					resource.TestMatchResourceAttr(resourceName, "policy_document", regexache.MustCompile("codeartifact:ListRepositoriesInDomain")),
 					resource.TestCheckResourceAttrPair(resourceName, "domain_owner", "aws_codeartifact_domain.test", "owner"),
 				),
 			},
@@ -105,7 +108,7 @@ func testAccDomainPermissionsPolicy_owner(t *testing.T) {
 					testAccCheckDomainPermissionsExists(ctx, resourceName),
 					resource.TestCheckResourceAttrPair(resourceName, "resource_arn", "aws_codeartifact_domain.test", "arn"),
 					resource.TestCheckResourceAttr(resourceName, "domain", rName),
-					resource.TestMatchResourceAttr(resourceName, "policy_document", regexp.MustCompile("codeartifact:CreateRepository")),
+					resource.TestMatchResourceAttr(resourceName, "policy_document", regexache.MustCompile("codeartifact:CreateRepository")),
 					resource.TestCheckResourceAttrPair(resourceName, "domain_owner", "aws_codeartifact_domain.test", "owner"),
 				),
 			},
diff --git a/internal/service/codeartifact/domain_test.go b/internal/service/codeartifact/domain_test.go
index 9f3d935cf29..96dc613ce56 100644
--- a/internal/service/codeartifact/domain_test.go
+++ b/internal/service/codeartifact/domain_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package codeartifact_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/codeartifact"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -67,7 +70,7 @@ func testAccDomain_defaultEncryptionKey(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDomainExists(ctx, resourceName),
 					acctest.CheckResourceAttrRegionalARN(resourceName, "arn", "codeartifact", fmt.Sprintf("domain/%s", rName)),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "encryption_key", "kms", regexp.MustCompile(`key/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "encryption_key", "kms", regexache.MustCompile(`key/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "domain", rName),
 					resource.TestCheckResourceAttr(resourceName, "asset_size_bytes", "0"),
 					resource.TestCheckResourceAttr(resourceName, "repository_count", "0"),
@@ -151,6 +154,39 @@ func testAccDomain_disappears(t *testing.T) {
 	})
 }
 
+func testAccDomain_MigrateAssetSizeBytesToString(t *testing.T) {
+	ctx := acctest.Context(t)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_codeartifact_domain.test"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, codeartifact.EndpointsID) },
+		ErrorCheck:   acctest.ErrorCheck(t, codeartifact.EndpointsID),
+		CheckDestroy: testAccCheckDomainDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				ExternalProviders: map[string]resource.ExternalProvider{
+					"aws": {
+						Source:            "hashicorp/aws",
+						VersionConstraint: "5.14.0",
+					},
+				},
+				Config: testAccDomainConfig_basic(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckDomainExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "domain", rName),
+					resource.TestCheckResourceAttr(resourceName, "asset_size_bytes", "0"),
+				),
+			},
+			{
+				ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+				Config:                   testAccDomainConfig_basic(rName),
+				PlanOnly:                 true,
+			},
+		},
+	})
+}
+
 func testAccCheckDomainExists(ctx context.Context, n string) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		rs, ok := s.RootModule().Resources[n]
diff --git a/internal/service/codeartifact/generate.go b/internal/service/codeartifact/generate.go
index b7143d78af0..3d3b4379763 100644
--- a/internal/service/codeartifact/generate.go
+++ b/internal/service/codeartifact/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTags -ServiceTagsSlice -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/codeartifact/repository.go b/internal/service/codeartifact/repository.go
index 41f7d59ddd1..d438821f13b 100644
--- a/internal/service/codeartifact/repository.go
+++ b/internal/service/codeartifact/repository.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package codeartifact
 
 import (
diff --git a/internal/service/codeartifact/repository_endpoint_data_source.go b/internal/service/codeartifact/repository_endpoint_data_source.go
index d5808ac1d5e..107bd6a6a36 100644
--- a/internal/service/codeartifact/repository_endpoint_data_source.go
+++ b/internal/service/codeartifact/repository_endpoint_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package codeartifact
 
 import (
diff --git a/internal/service/codeartifact/repository_endpoint_data_source_test.go b/internal/service/codeartifact/repository_endpoint_data_source_test.go
index 375cc03ad3b..b86058b56d2 100644
--- a/internal/service/codeartifact/repository_endpoint_data_source_test.go
+++ b/internal/service/codeartifact/repository_endpoint_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package codeartifact_test
 
 import (
diff --git a/internal/service/codeartifact/repository_permissions_policy.go b/internal/service/codeartifact/repository_permissions_policy.go
index 9355ce34112..aba3e91b510 100644
--- a/internal/service/codeartifact/repository_permissions_policy.go
+++ b/internal/service/codeartifact/repository_permissions_policy.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package codeartifact
 
 import (
diff --git a/internal/service/codeartifact/repository_permissions_policy_test.go b/internal/service/codeartifact/repository_permissions_policy_test.go
index d249d7b1f1c..cd45e881eb0 100644
--- a/internal/service/codeartifact/repository_permissions_policy_test.go
+++ b/internal/service/codeartifact/repository_permissions_policy_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package codeartifact_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/codeartifact"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -34,7 +37,7 @@ func testAccRepositoryPermissionsPolicy_basic(t *testing.T) {
 					testAccCheckRepositoryPermissionsExists(ctx, resourceName),
 					resource.TestCheckResourceAttrPair(resourceName, "resource_arn", "aws_codeartifact_repository.test", "arn"),
 					resource.TestCheckResourceAttr(resourceName, "domain", rName),
-					resource.TestMatchResourceAttr(resourceName, "policy_document", regexp.MustCompile("codeartifact:CreateRepository")),
+					resource.TestMatchResourceAttr(resourceName, "policy_document", regexache.MustCompile("codeartifact:CreateRepository")),
 					resource.TestCheckResourceAttrPair(resourceName, "domain_owner", "aws_codeartifact_domain.test", "owner"),
 				),
 			},
@@ -49,8 +52,8 @@ func testAccRepositoryPermissionsPolicy_basic(t *testing.T) {
 					testAccCheckRepositoryPermissionsExists(ctx, resourceName),
 					resource.TestCheckResourceAttrPair(resourceName, "resource_arn", "aws_codeartifact_repository.test", "arn"),
 					resource.TestCheckResourceAttr(resourceName, "domain", rName),
-					resource.TestMatchResourceAttr(resourceName, "policy_document", regexp.MustCompile("codeartifact:CreateRepository")),
-					resource.TestMatchResourceAttr(resourceName, "policy_document", regexp.MustCompile("codeartifact:ListRepositoriesInDomain")),
+					resource.TestMatchResourceAttr(resourceName, "policy_document", regexache.MustCompile("codeartifact:CreateRepository")),
+					resource.TestMatchResourceAttr(resourceName, "policy_document", regexache.MustCompile("codeartifact:ListRepositoriesInDomain")),
 					resource.TestCheckResourceAttrPair(resourceName, "domain_owner", "aws_codeartifact_domain.test", "owner"),
 				),
 			},
@@ -75,7 +78,7 @@ func testAccRepositoryPermissionsPolicy_ignoreEquivalent(t *testing.T) {
 					testAccCheckRepositoryPermissionsExists(ctx, resourceName),
 					resource.TestCheckResourceAttrPair(resourceName, "resource_arn", "aws_codeartifact_repository.test", "arn"),
 					resource.TestCheckResourceAttr(resourceName, "domain", rName),
-					resource.TestMatchResourceAttr(resourceName, "policy_document", regexp.MustCompile("codeartifact:CreateRepository")),
+					resource.TestMatchResourceAttr(resourceName, "policy_document", regexache.MustCompile("codeartifact:CreateRepository")),
 					resource.TestCheckResourceAttrPair(resourceName, "domain_owner", "aws_codeartifact_domain.test", "owner"),
 				),
 			},
@@ -104,7 +107,7 @@ func testAccRepositoryPermissionsPolicy_owner(t *testing.T) {
 					testAccCheckRepositoryPermissionsExists(ctx, resourceName),
 					resource.TestCheckResourceAttrPair(resourceName, "resource_arn", "aws_codeartifact_repository.test", "arn"),
 					resource.TestCheckResourceAttr(resourceName, "domain", rName),
-					resource.TestMatchResourceAttr(resourceName, "policy_document", regexp.MustCompile("codeartifact:CreateRepository")),
+					resource.TestMatchResourceAttr(resourceName, "policy_document", regexache.MustCompile("codeartifact:CreateRepository")),
 					resource.TestCheckResourceAttrPair(resourceName, "domain_owner", "aws_codeartifact_domain.test", "owner"),
 				),
 			},
diff --git a/internal/service/codeartifact/repository_test.go b/internal/service/codeartifact/repository_test.go
index d084919f0f5..265202cb612 100644
--- a/internal/service/codeartifact/repository_test.go
+++ b/internal/service/codeartifact/repository_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package codeartifact_test
 
 import (
diff --git a/internal/service/codeartifact/service_package_gen.go b/internal/service/codeartifact/service_package_gen.go
index f4429259f13..2a18ec34189 100644
--- a/internal/service/codeartifact/service_package_gen.go
+++ b/internal/service/codeartifact/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	codeartifact_sdkv1 "github.com/aws/aws-sdk-go/service/codeartifact"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -75,4 +76,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*c
 	return codeartifact_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/codeartifact/sweep.go b/internal/service/codeartifact/sweep.go
index 5fd0de1a324..972a5fe46ca 100644
--- a/internal/service/codeartifact/sweep.go
+++ b/internal/service/codeartifact/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package codeartifact
 
@@ -12,9 +12,10 @@ import (
 	"github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_codeartifact_domain", &resource.Sweeper{
 		Name: "aws_codeartifact_domain",
 		F:    sweepDomains,
@@ -28,7 +29,7 @@ func init() {
 
 func sweepDomains(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -61,7 +62,7 @@ func sweepDomains(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping CodeArtifact Domain sweep for %s: %s", region, err)
 		return nil
 	}
@@ -75,7 +76,7 @@ func sweepDomains(region string) error {
 
 func sweepRepositories(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
@@ -110,7 +111,7 @@ func sweepRepositories(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping CodeArtifact Repository sweep for %s: %s", region, err)
 		return nil
 	}
diff --git a/internal/service/codeartifact/tags_gen.go b/internal/service/codeartifact/tags_gen.go
index f631876458a..5d8fde828d2 100644
--- a/internal/service/codeartifact/tags_gen.go
+++ b/internal/service/codeartifact/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/codeartifact"
 	"github.com/aws/aws-sdk-go/service/codeartifact/codeartifactiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -102,6 +104,8 @@ func updateTags(ctx context.Context, conn codeartifactiface.CodeArtifactAPI, ide
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.CodeArtifact)
 	if len(removedTags) > 0 {
diff --git a/internal/service/codebuild/consts.go b/internal/service/codebuild/consts.go
index c6ec7f3ed09..00a7ff7167f 100644
--- a/internal/service/codebuild/consts.go
+++ b/internal/service/codebuild/consts.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package codebuild
 
 import (
diff --git a/internal/service/codebuild/find.go b/internal/service/codebuild/find.go
index 1b6b4c03cf1..0dae36d7569 100644
--- a/internal/service/codebuild/find.go
+++ b/internal/service/codebuild/find.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package codebuild
 
 import (
diff --git a/internal/service/codebuild/generate.go b/internal/service/codebuild/generate.go
index 9d361d6b3a0..38b80319dc1 100644
--- a/internal/service/codebuild/generate.go
+++ b/internal/service/codebuild/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ServiceTagsSlice
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/codebuild/project.go b/internal/service/codebuild/project.go
index 272fc1bae47..4d055badb82 100644
--- a/internal/service/codebuild/project.go
+++ b/internal/service/codebuild/project.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package codebuild
 
 import (
@@ -5,9 +8,9 @@ import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/codebuild"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -264,7 +267,7 @@ func ResourceProject() *schema.Resource {
 						"certificate": {
 							Type:         schema.TypeString,
 							Optional:     true,
-							ValidateFunc: validation.StringMatch(regexp.MustCompile(`\.(pem|zip)$`), "must end in .pem or .zip"),
+							ValidateFunc: validation.StringMatch(regexache.MustCompile(`\.(pem|zip)$`), "must end in .pem or .zip"),
 						},
 						"registry_credential": {
 							Type:     schema.TypeList,
@@ -1945,12 +1948,12 @@ func environmentVariablesToMap(environmentVariables []*codebuild.EnvironmentVari
 
 func ValidProjectName(v interface{}, k string) (ws []string, errors []error) {
 	value := v.(string)
-	if !regexp.MustCompile(`^[A-Za-z0-9]`).MatchString(value) {
+	if !regexache.MustCompile(`^[0-9A-Za-z]`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"first character of %q must be a letter or number", value))
 	}
 
-	if !regexp.MustCompile(`^[A-Za-z0-9\-_]+$`).MatchString(value) {
+	if !regexache.MustCompile(`^[0-9A-Za-z_-]+$`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"only alphanumeric characters, hyphens and underscores allowed in %q", value))
 	}
@@ -1971,8 +1974,8 @@ func validProjectS3LogsLocation(v interface{}, k string) (ws []string, errors []
 		return
 	}
 
-	simplePattern := `^[a-z0-9][^/]*\/(.+)$`
-	if !regexp.MustCompile(simplePattern).MatchString(value) {
+	simplePattern := `^[0-9a-z][^/]*\/(.+)$`
+	if !regexache.MustCompile(simplePattern).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"%q does not match pattern (%q): %q",
 			k, simplePattern, value))
diff --git a/internal/service/codebuild/project_test.go b/internal/service/codebuild/project_test.go
index 4cffd1527e0..25147227952 100644
--- a/internal/service/codebuild/project_test.go
+++ b/internal/service/codebuild/project_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package codebuild_test
 
 import (
 	"context"
 	"fmt"
 	"os"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/codebuild"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -176,7 +179,7 @@ func TestAccCodeBuildProject_badgeEnabled(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckProjectExists(ctx, resourceName, &project),
 					resource.TestCheckResourceAttr(resourceName, "badge_enabled", "true"),
-					resource.TestMatchResourceAttr(resourceName, "badge_url", regexp.MustCompile(`\b(https?).*\b`)),
+					resource.TestMatchResourceAttr(resourceName, "badge_url", regexache.MustCompile(`\b(https?).*\b`)),
 				),
 			},
 			{
@@ -274,7 +277,7 @@ func TestAccCodeBuildProject_cache(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccProjectConfig_cache(rName, "", "S3"),
-				ExpectError: regexp.MustCompile(`cache location is required when cache type is "S3"`),
+				ExpectError: regexache.MustCompile(`cache location is required when cache type is "S3"`),
 			},
 			{
 				Config: testAccProjectConfig_cache(rName, "", codebuild.CacheTypeNoCache),
@@ -403,7 +406,7 @@ func TestAccCodeBuildProject_fileSystemLocations(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "environment.0.type", codebuild.EnvironmentTypeLinuxContainer),
 					resource.TestCheckResourceAttr(resourceName, "file_system_locations.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "file_system_locations.0.identifier", "test"),
-					resource.TestMatchResourceAttr(resourceName, "file_system_locations.0.location", regexp.MustCompile(`/directory-path$`)),
+					resource.TestMatchResourceAttr(resourceName, "file_system_locations.0.location", regexache.MustCompile(`/directory-path$`)),
 					resource.TestCheckResourceAttr(resourceName, "file_system_locations.0.mount_options", "nfsvers=4.1,rsize=1048576,wsize=1048576,hard,timeo=450,retrans=3"),
 					resource.TestCheckResourceAttr(resourceName, "file_system_locations.0.mount_point", "/mount1"),
 					resource.TestCheckResourceAttr(resourceName, "file_system_locations.0.type", codebuild.FileSystemTypeEfs),
@@ -420,7 +423,7 @@ func TestAccCodeBuildProject_fileSystemLocations(t *testing.T) {
 					testAccCheckProjectExists(ctx, resourceName, &project),
 					resource.TestCheckResourceAttr(resourceName, "file_system_locations.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "file_system_locations.0.identifier", "test"),
-					resource.TestMatchResourceAttr(resourceName, "file_system_locations.0.location", regexp.MustCompile(`/directory-path$`)),
+					resource.TestMatchResourceAttr(resourceName, "file_system_locations.0.location", regexache.MustCompile(`/directory-path$`)),
 					resource.TestCheckResourceAttr(resourceName, "file_system_locations.0.mount_options", "nfsvers=4.1,rsize=1048576,wsize=1048576,hard,timeo=450,retrans=3"),
 					resource.TestCheckResourceAttr(resourceName, "file_system_locations.0.mount_point", "/mount2"),
 					resource.TestCheckResourceAttr(resourceName, "file_system_locations.0.type", codebuild.FileSystemTypeEfs),
@@ -1523,11 +1526,11 @@ phases:
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccProjectConfig_sourceTypeNoSource(rName, "", ""),
-				ExpectError: regexp.MustCompile("`buildspec` must be set when source's `type` is `NO_SOURCE`"),
+				ExpectError: regexache.MustCompile("`buildspec` must be set when source's `type` is `NO_SOURCE`"),
 			},
 			{
 				Config:      testAccProjectConfig_sourceTypeNoSource(rName, "location", rBuildspec),
-				ExpectError: regexp.MustCompile("`location` must be empty when source's `type` is `NO_SOURCE`"),
+				ExpectError: regexache.MustCompile("`location` must be empty when source's `type` is `NO_SOURCE`"),
 			},
 		},
 	})
@@ -1591,7 +1594,7 @@ func TestAccCodeBuildProject_vpc(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "vpc_config.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "vpc_config.0.security_group_ids.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "vpc_config.0.subnets.#", "2"),
-					resource.TestMatchResourceAttr(resourceName, "vpc_config.0.vpc_id", regexp.MustCompile(`^vpc-`)),
+					resource.TestMatchResourceAttr(resourceName, "vpc_config.0.vpc_id", regexache.MustCompile(`^vpc-`)),
 				),
 			},
 			{
@@ -1606,7 +1609,7 @@ func TestAccCodeBuildProject_vpc(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "vpc_config.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "vpc_config.0.security_group_ids.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "vpc_config.0.subnets.#", "1"),
-					resource.TestMatchResourceAttr(resourceName, "vpc_config.0.vpc_id", regexp.MustCompile(`^vpc-`)),
+					resource.TestMatchResourceAttr(resourceName, "vpc_config.0.vpc_id", regexache.MustCompile(`^vpc-`)),
 				),
 			},
 			{
diff --git a/internal/service/codebuild/report_group.go b/internal/service/codebuild/report_group.go
index 68a1398309e..821f838d51c 100644
--- a/internal/service/codebuild/report_group.go
+++ b/internal/service/codebuild/report_group.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package codebuild
 
 import (
diff --git a/internal/service/codebuild/report_group_test.go b/internal/service/codebuild/report_group_test.go
index 6f7586e375c..49b50bb7cf0 100644
--- a/internal/service/codebuild/report_group_test.go
+++ b/internal/service/codebuild/report_group_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package codebuild_test
 
 import (
diff --git a/internal/service/codebuild/resource_policy.go b/internal/service/codebuild/resource_policy.go
index 59275f7008b..8844f2a5a61 100644
--- a/internal/service/codebuild/resource_policy.go
+++ b/internal/service/codebuild/resource_policy.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package codebuild
 
 import (
diff --git a/internal/service/codebuild/resource_policy_test.go b/internal/service/codebuild/resource_policy_test.go
index 4575cdd1c9a..32077ec9396 100644
--- a/internal/service/codebuild/resource_policy_test.go
+++ b/internal/service/codebuild/resource_policy_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package codebuild_test
 
 import (
diff --git a/internal/service/codebuild/service_package_gen.go b/internal/service/codebuild/service_package_gen.go
index cbccb4851c9..7f2fef33260 100644
--- a/internal/service/codebuild/service_package_gen.go
+++ b/internal/service/codebuild/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	codebuild_sdkv1 "github.com/aws/aws-sdk-go/service/codebuild"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -66,4 +67,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*c
 	return codebuild_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/codebuild/source_credential.go b/internal/service/codebuild/source_credential.go
index 00e63a70546..7d29ab77638 100644
--- a/internal/service/codebuild/source_credential.go
+++ b/internal/service/codebuild/source_credential.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package codebuild
 
 import (
diff --git a/internal/service/codebuild/source_credential_test.go b/internal/service/codebuild/source_credential_test.go
index ec6fe4d9756..51a617fb54b 100644
--- a/internal/service/codebuild/source_credential_test.go
+++ b/internal/service/codebuild/source_credential_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package codebuild_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/codebuild"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -32,7 +35,7 @@ func TestAccCodeBuildSourceCredential_basic(t *testing.T) {
 				Config: testAccSourceCredentialConfig_basic("PERSONAL_ACCESS_TOKEN", "GITHUB", token),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckSourceCredentialExists(ctx, resourceName, &sourceCredentialsInfo),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "codebuild", regexp.MustCompile(`token/github`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "codebuild", regexache.MustCompile(`token/github`)),
 					resource.TestCheckResourceAttr(resourceName, "server_type", "GITHUB"),
 					resource.TestCheckResourceAttr(resourceName, "auth_type", "PERSONAL_ACCESS_TOKEN"),
 				),
@@ -41,7 +44,7 @@ func TestAccCodeBuildSourceCredential_basic(t *testing.T) {
 				Config: testAccSourceCredentialConfig_basic("PERSONAL_ACCESS_TOKEN", "GITHUB_ENTERPRISE", token),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckSourceCredentialExists(ctx, resourceName, &sourceCredentialsInfo),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "codebuild", regexp.MustCompile(`token/github_enterprise`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "codebuild", regexache.MustCompile(`token/github_enterprise`)),
 					resource.TestCheckResourceAttr(resourceName, "server_type", "GITHUB_ENTERPRISE"),
 					resource.TestCheckResourceAttr(resourceName, "auth_type", "PERSONAL_ACCESS_TOKEN"),
 				),
@@ -72,7 +75,7 @@ func TestAccCodeBuildSourceCredential_basicAuth(t *testing.T) {
 				Config: testAccSourceCredentialConfig_basicAuth(token, "user1"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckSourceCredentialExists(ctx, resourceName, &sourceCredentialsInfo),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "codebuild", regexp.MustCompile(`token/bitbucket`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "codebuild", regexache.MustCompile(`token/bitbucket`)),
 					resource.TestCheckResourceAttr(resourceName, "user_name", "user1"),
 					resource.TestCheckResourceAttr(resourceName, "server_type", "BITBUCKET"),
 					resource.TestCheckResourceAttr(resourceName, "auth_type", "BASIC_AUTH"),
diff --git a/internal/service/codebuild/status.go b/internal/service/codebuild/status.go
index f0554c726fe..19c237d16f3 100644
--- a/internal/service/codebuild/status.go
+++ b/internal/service/codebuild/status.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package codebuild
 
 import (
diff --git a/internal/service/codebuild/sweep.go b/internal/service/codebuild/sweep.go
index d6163f25957..c64078194a6 100644
--- a/internal/service/codebuild/sweep.go
+++ b/internal/service/codebuild/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package codebuild
 
@@ -12,9 +12,10 @@ import (
 	"github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_codebuild_report_group", &resource.Sweeper{
 		Name: "aws_codebuild_report_group",
 		F:    sweepReportGroups,
@@ -33,7 +34,7 @@ func init() {
 
 func sweepReportGroups(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
@@ -60,7 +61,7 @@ func sweepReportGroups(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping CodeBuild Report Group sweep for %s: %s", region, err)
 		return nil
 	}
@@ -69,7 +70,7 @@ func sweepReportGroups(region string) error {
 		return fmt.Errorf("error retrieving CodeBuild ReportGroups: %w", err)
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		return fmt.Errorf("error sweeping CodeBuild ReportGroups: %w", err)
 	}
 
@@ -78,7 +79,7 @@ func sweepReportGroups(region string) error {
 
 func sweepProjects(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
@@ -104,7 +105,7 @@ func sweepProjects(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping CodeBuild Project sweep for %s: %s", region, err)
 		return nil
 	}
@@ -112,7 +113,7 @@ func sweepProjects(region string) error {
 		return fmt.Errorf("error retrieving CodeBuild Projects: %w", err)
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		return fmt.Errorf("error sweeping CodeBuild Projects: %w", err)
 	}
 
@@ -121,7 +122,7 @@ func sweepProjects(region string) error {
 
 func sweepSourceCredentials(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
@@ -142,7 +143,7 @@ func sweepSourceCredentials(region string) error {
 		sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
 	}
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping CodeBuild Source Credential sweep for %s: %s", region, err)
 		return sweeperErrs.ErrorOrNil()
 	}
@@ -150,7 +151,7 @@ func sweepSourceCredentials(region string) error {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error retrieving CodeBuild Source Credentials: %w", err))
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error sweeping CodeBuild Source Credentials: %w", err))
 	}
 
diff --git a/internal/service/codebuild/wait.go b/internal/service/codebuild/wait.go
index 594017293c3..207e940faa4 100644
--- a/internal/service/codebuild/wait.go
+++ b/internal/service/codebuild/wait.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package codebuild
 
 import (
diff --git a/internal/service/codebuild/webhook.go b/internal/service/codebuild/webhook.go
index 1ea481e8a11..0bc4bf27a73 100644
--- a/internal/service/codebuild/webhook.go
+++ b/internal/service/codebuild/webhook.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package codebuild
 
 import (
diff --git a/internal/service/codebuild/webhook_test.go b/internal/service/codebuild/webhook_test.go
index 0b8726cd227..6d3046d03ea 100644
--- a/internal/service/codebuild/webhook_test.go
+++ b/internal/service/codebuild/webhook_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package codebuild_test
 
 import (
 	"context"
 	"fmt"
 	"reflect"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/codebuild"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -36,9 +39,9 @@ func TestAccCodeBuildWebhook_bitbucket(t *testing.T) {
 					testAccCheckWebhookExists(ctx, resourceName, &webhook),
 					resource.TestCheckResourceAttr(resourceName, "branch_filter", ""),
 					resource.TestCheckResourceAttr(resourceName, "project_name", rName),
-					resource.TestMatchResourceAttr(resourceName, "payload_url", regexp.MustCompile(`^https://`)),
+					resource.TestMatchResourceAttr(resourceName, "payload_url", regexache.MustCompile(`^https://`)),
 					resource.TestCheckResourceAttr(resourceName, "secret", ""),
-					resource.TestMatchResourceAttr(resourceName, "url", regexp.MustCompile(`^https://`)),
+					resource.TestMatchResourceAttr(resourceName, "url", regexache.MustCompile(`^https://`)),
 				),
 			},
 			{
@@ -69,9 +72,9 @@ func TestAccCodeBuildWebhook_gitHub(t *testing.T) {
 					testAccCheckWebhookExists(ctx, resourceName, &webhook),
 					resource.TestCheckResourceAttr(resourceName, "branch_filter", ""),
 					resource.TestCheckResourceAttr(resourceName, "project_name", rName),
-					resource.TestMatchResourceAttr(resourceName, "payload_url", regexp.MustCompile(`^https://`)),
+					resource.TestMatchResourceAttr(resourceName, "payload_url", regexache.MustCompile(`^https://`)),
 					resource.TestCheckResourceAttr(resourceName, "secret", ""),
-					resource.TestMatchResourceAttr(resourceName, "url", regexp.MustCompile(`^https://`)),
+					resource.TestMatchResourceAttr(resourceName, "url", regexache.MustCompile(`^https://`)),
 				),
 			},
 			{
@@ -102,8 +105,8 @@ func TestAccCodeBuildWebhook_gitHubEnterprise(t *testing.T) {
 					testAccCheckWebhookExists(ctx, resourceName, &webhook),
 					resource.TestCheckResourceAttr(resourceName, "branch_filter", "dev"),
 					resource.TestCheckResourceAttr(resourceName, "project_name", rName),
-					resource.TestMatchResourceAttr(resourceName, "payload_url", regexp.MustCompile(`^https://`)),
-					resource.TestMatchResourceAttr(resourceName, "secret", regexp.MustCompile(`.+`)),
+					resource.TestMatchResourceAttr(resourceName, "payload_url", regexache.MustCompile(`^https://`)),
+					resource.TestMatchResourceAttr(resourceName, "secret", regexache.MustCompile(`.+`)),
 					resource.TestCheckResourceAttr(resourceName, "url", ""),
 				),
 			},
@@ -119,8 +122,8 @@ func TestAccCodeBuildWebhook_gitHubEnterprise(t *testing.T) {
 					testAccCheckWebhookExists(ctx, resourceName, &webhook),
 					resource.TestCheckResourceAttr(resourceName, "branch_filter", "master"),
 					resource.TestCheckResourceAttr(resourceName, "project_name", rName),
-					resource.TestMatchResourceAttr(resourceName, "payload_url", regexp.MustCompile(`^https://`)),
-					resource.TestMatchResourceAttr(resourceName, "secret", regexp.MustCompile(`.+`)),
+					resource.TestMatchResourceAttr(resourceName, "payload_url", regexache.MustCompile(`^https://`)),
+					resource.TestMatchResourceAttr(resourceName, "secret", regexache.MustCompile(`.+`)),
 					resource.TestCheckResourceAttr(resourceName, "url", ""),
 				),
 			},
diff --git a/internal/service/codecatalyst/dev_environment.go b/internal/service/codecatalyst/dev_environment.go
new file mode 100644
index 00000000000..6b74e4c5e55
--- /dev/null
+++ b/internal/service/codecatalyst/dev_environment.go
@@ -0,0 +1,499 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package codecatalyst
+
+import (
+	"context"
+	"errors"
+	"log"
+	"time"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/codecatalyst"
+	"github.com/aws/aws-sdk-go-v2/service/codecatalyst/types"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/create"
+	"github.com/hashicorp/terraform-provider-aws/internal/enum"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/names"
+)
+
+// Function annotations are used for resource registration to the Provider. DO NOT EDIT.
+// @SDKResource("aws_codecatalyst_dev_environment", name="DevEnvironment")
+func ResourceDevEnvironment() *schema.Resource {
+	return &schema.Resource{
+		CreateWithoutTimeout: resourceDevEnvironmentCreate,
+		ReadWithoutTimeout:   resourceDevEnvironmentRead,
+		UpdateWithoutTimeout: resourceDevEnvironmentUpdate,
+		DeleteWithoutTimeout: resourceDevEnvironmentDelete,
+
+		Importer: &schema.ResourceImporter{
+			StateContext: schema.ImportStatePassthroughContext,
+		},
+
+		Timeouts: &schema.ResourceTimeout{
+			Create: schema.DefaultTimeout(30 * time.Minute),
+			Update: schema.DefaultTimeout(30 * time.Minute),
+			Delete: schema.DefaultTimeout(30 * time.Minute),
+		},
+
+		Schema: map[string]*schema.Schema{
+			"alias": {
+				Type:     schema.TypeString,
+				Optional: true,
+			},
+			"ides": {
+				Type:     schema.TypeList,
+				Required: true,
+				MaxItems: 1,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"name": {
+							Type:     schema.TypeString,
+							Optional: true,
+						},
+						"runtime": {
+							Type:     schema.TypeString,
+							Optional: true,
+						},
+					},
+				},
+			},
+			"inactivity_timeout_minutes": {
+				Type:     schema.TypeInt,
+				Default:  15,
+				Optional: true,
+			},
+			"instance_type": {
+				Type:             schema.TypeString,
+				Required:         true,
+				ValidateDiagFunc: enum.Validate[types.InstanceType](),
+			},
+			"project_name": {
+				Type:     schema.TypeString,
+				Required: true,
+			},
+			"persistent_storage": {
+				Type:     schema.TypeList,
+				Required: true,
+				MaxItems: 1,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"size": {
+							Type:     schema.TypeInt,
+							Required: true,
+						},
+					},
+				},
+			},
+			"repositories": {
+				Type:     schema.TypeList,
+				Optional: true,
+				MaxItems: 100,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"branch_name": {
+							Type:     schema.TypeString,
+							Optional: true,
+						},
+						"repository_name": {
+							Type:     schema.TypeString,
+							Required: true,
+						},
+					},
+				},
+			},
+			"space_name": {
+				Type:     schema.TypeString,
+				Required: true,
+			},
+		},
+	}
+}
+
+const (
+	ResNameDevEnvironment = "DevEnvironment"
+)
+
+func resourceDevEnvironmentCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+
+	conn := meta.(*conns.AWSClient).CodeCatalystClient(ctx)
+	storage := expandPersistentStorageConfiguration(d.Get("persistent_storage").([]interface{})[0].(map[string]interface{}))
+	instanceType := types.InstanceType(d.Get("instance_type").(string))
+	in := &codecatalyst.CreateDevEnvironmentInput{
+		ProjectName:       aws.String(d.Get("project_name").(string)),
+		SpaceName:         aws.String(d.Get("space_name").(string)),
+		PersistentStorage: storage,
+		InstanceType:      instanceType,
+	}
+
+	if v, ok := d.GetOk("inactivity_timeout_minutes"); ok {
+		in.InactivityTimeoutMinutes = int32(v.(int))
+	}
+
+	if v, ok := d.GetOk("alias"); ok {
+		in.Alias = aws.String(v.(string))
+	}
+
+	if v, ok := d.GetOk("ides"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
+		in.Ides = expandIdesConfiguration(v.([]interface{}))
+	}
+
+	if v, ok := d.GetOk("repositories"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
+		in.Repositories = expandRepositorysInput(v.([]interface{}))
+	}
+
+	out, err := conn.CreateDevEnvironment(ctx, in)
+
+	if err != nil {
+		return append(diags, create.DiagError(names.CodeCatalyst, create.ErrActionCreating, ResNameDevEnvironment, d.Id(), err)...)
+	}
+
+	if out == nil {
+		return append(diags, create.DiagError(names.CodeCatalyst, create.ErrActionCreating, ResNameDevEnvironment, d.Id(), errors.New("empty output"))...)
+	}
+
+	d.SetId(aws.ToString(out.Id))
+
+	if _, err := waitDevEnvironmentCreated(ctx, conn, d.Id(), out.SpaceName, out.ProjectName, d.Timeout(schema.TimeoutCreate)); err != nil {
+		return append(diags, create.DiagError(names.CodeCatalyst, create.ErrActionWaitingForCreation, ResNameDevEnvironment, d.Id(), err)...)
+	}
+
+	return append(diags, resourceDevEnvironmentRead(ctx, d, meta)...)
+}
+
+func resourceDevEnvironmentRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+
+	conn := meta.(*conns.AWSClient).CodeCatalystClient(ctx)
+
+	spaceName := aws.String(d.Get("space_name").(string))
+	projectName := aws.String(d.Get("project_name").(string))
+
+	out, err := findDevEnvironmentByID(ctx, conn, d.Id(), spaceName, projectName)
+
+	if !d.IsNewResource() && tfresource.NotFound(err) {
+		log.Printf("[WARN] Codecatalyst DevEnvironment (%s) not found, removing from state", d.Id())
+		d.SetId("")
+		return diags
+	}
+
+	if err != nil {
+		return append(diags, create.DiagError(names.CodeCatalyst, create.ErrActionReading, ResNameDevEnvironment, d.Id(), err)...)
+	}
+
+	d.Set("alias", out.Alias)
+	d.Set("project_name", out.ProjectName)
+	d.Set("space_name", out.SpaceName)
+	d.Set("instance_type", out.InstanceType)
+	d.Set("inactivity_timeout_minutes", out.InactivityTimeoutMinutes)
+	d.Set("persistent_storage", flattenPersistentStorage(out.PersistentStorage))
+
+	if err := d.Set("ides", flattenIdes(out.Ides)); err != nil {
+		return append(diags, create.DiagError(names.CodeCatalyst, create.ErrActionSetting, ResNameDevEnvironment, d.Id(), err)...)
+	}
+
+	if err := d.Set("repositories", flattenRepositories(out.Repositories)); err != nil {
+		return append(diags, create.DiagError(names.CodeCatalyst, create.ErrActionSetting, ResNameDevEnvironment, d.Id(), err)...)
+	}
+
+	return diags
+}
+
+func resourceDevEnvironmentUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+
+	conn := meta.(*conns.AWSClient).CodeCatalystClient(ctx)
+
+	update := false
+
+	in := &codecatalyst.UpdateDevEnvironmentInput{
+		Id: aws.String(d.Id()),
+	}
+
+	if d.HasChanges("alias") {
+		in.Alias = aws.String(d.Get("alias").(string))
+		update = true
+	}
+
+	if d.HasChanges("instance_type") {
+		in.InstanceType = types.InstanceType(d.Get("instance_type").(string))
+		update = true
+	}
+	if !update {
+		return diags
+	}
+
+	log.Printf("[DEBUG] Updating Codecatalyst DevEnvironment (%s): %#v", d.Id(), in)
+	out, err := conn.UpdateDevEnvironment(ctx, in)
+	if err != nil {
+		return append(diags, create.DiagError(names.CodeCatalyst, create.ErrActionUpdating, ResNameDevEnvironment, d.Id(), err)...)
+	}
+
+	if _, err := waitDevEnvironmentUpdated(ctx, conn, aws.ToString(out.Id), out.SpaceName, out.ProjectName, d.Timeout(schema.TimeoutUpdate)); err != nil {
+		return append(diags, create.DiagError(names.CodeCatalyst, create.ErrActionWaitingForUpdate, ResNameDevEnvironment, d.Id(), err)...)
+	}
+
+	return append(diags, resourceDevEnvironmentRead(ctx, d, meta)...)
+}
+
+func resourceDevEnvironmentDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+
+	conn := meta.(*conns.AWSClient).CodeCatalystClient(ctx)
+
+	log.Printf("[INFO] Deleting Codecatalyst DevEnvironment %s", d.Id())
+
+	_, err := conn.DeleteDevEnvironment(ctx, &codecatalyst.DeleteDevEnvironmentInput{
+		Id:          aws.String(d.Id()),
+		SpaceName:   aws.String(d.Get("space_name").(string)),
+		ProjectName: aws.String(d.Get("project_name").(string)),
+	})
+
+	if errs.IsA[*types.ResourceNotFoundException](err) {
+		return diags
+	}
+	if err != nil {
+		return append(diags, create.DiagError(names.CodeCatalyst, create.ErrActionDeleting, ResNameDevEnvironment, d.Id(), err)...)
+	}
+
+	return diags
+}
+
+func waitDevEnvironmentCreated(ctx context.Context, conn *codecatalyst.Client, id string, spaceName *string, projectName *string, timeout time.Duration) (*codecatalyst.GetDevEnvironmentOutput, error) {
+	stateConf := &retry.StateChangeConf{
+		Pending:                   enum.Slice(types.DevEnvironmentStatusPending, types.DevEnvironmentStatusStarting),
+		Target:                    enum.Slice(types.DevEnvironmentStatusRunning, types.DevEnvironmentStatusStopped, types.DevEnvironmentStatusStopping),
+		Refresh:                   statusDevEnvironment(ctx, conn, id, spaceName, projectName),
+		Timeout:                   timeout,
+		NotFoundChecks:            20,
+		ContinuousTargetOccurence: 2,
+	}
+
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+	if out, ok := outputRaw.(*codecatalyst.GetDevEnvironmentOutput); ok {
+		return out, err
+	}
+
+	return nil, err
+}
+
+func waitDevEnvironmentUpdated(ctx context.Context, conn *codecatalyst.Client, id string, spaceName *string, projectName *string, timeout time.Duration) (*codecatalyst.GetDevEnvironmentOutput, error) {
+	stateConf := &retry.StateChangeConf{
+		Pending:                   enum.Slice(types.DevEnvironmentStatusStopping, types.DevEnvironmentStatusPending, types.DevEnvironmentStatusStopped),
+		Target:                    enum.Slice(types.DevEnvironmentStatusRunning),
+		Refresh:                   statusDevEnvironment(ctx, conn, id, spaceName, projectName),
+		Timeout:                   timeout,
+		NotFoundChecks:            20,
+		ContinuousTargetOccurence: 2,
+	}
+
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+	if out, ok := outputRaw.(*codecatalyst.GetDevEnvironmentOutput); ok {
+		return out, err
+	}
+
+	return nil, err
+}
+
+func statusDevEnvironment(ctx context.Context, conn *codecatalyst.Client, id string, spaceName *string, projectName *string) retry.StateRefreshFunc {
+	return func() (interface{}, string, error) {
+		out, err := findDevEnvironmentByID(ctx, conn, id, spaceName, projectName)
+		if tfresource.NotFound(err) {
+			return nil, "", nil
+		}
+
+		if err != nil {
+			return nil, "", err
+		}
+
+		return out, string(out.Status), nil
+	}
+}
+
+func findDevEnvironmentByID(ctx context.Context, conn *codecatalyst.Client, id string, spaceName *string, projectName *string) (*codecatalyst.GetDevEnvironmentOutput, error) {
+	in := &codecatalyst.GetDevEnvironmentInput{
+		Id:          aws.String(id),
+		ProjectName: projectName,
+		SpaceName:   spaceName,
+	}
+
+	out, err := conn.GetDevEnvironment(ctx, in)
+	if errs.IsA[*types.AccessDeniedException](err) || errs.IsA[*types.ResourceNotFoundException](err) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: in,
+		}
+	}
+	if err != nil {
+		return nil, err
+	}
+
+	if out == nil || out.Id == nil {
+		return nil, tfresource.NewEmptyResultError(in)
+	}
+
+	return out, nil
+}
+
+func flattenRepositories(apiObjects []types.DevEnvironmentRepositorySummary) []interface{} {
+	if len(apiObjects) == 0 {
+		return nil
+	}
+
+	var tfList []interface{}
+
+	for _, apiObject := range apiObjects {
+		tfList = append(tfList, flattenRepository(&apiObject))
+	}
+
+	return tfList
+}
+
+func flattenRepository(apiObject *types.DevEnvironmentRepositorySummary) interface{} {
+	if apiObject == nil {
+		return nil
+	}
+
+	tfMap := map[string]interface{}{}
+
+	if v := apiObject.BranchName; v != nil {
+		tfMap["branch_name"] = aws.ToString(v)
+	}
+
+	if v := apiObject.RepositoryName; v != nil {
+		tfMap["repository_name"] = aws.ToString(v)
+	}
+
+	return tfMap
+}
+
+func flattenIdes(apiObjects []types.Ide) []interface{} {
+	if len(apiObjects) == 0 {
+		return nil
+	}
+
+	var tfList []interface{}
+
+	for _, apiObject := range apiObjects {
+		tfList = append(tfList, flattenIde(&apiObject))
+	}
+
+	return tfList
+}
+
+func flattenIde(apiObject *types.Ide) map[string]interface{} {
+	if apiObject == nil {
+		return nil
+	}
+
+	tfMap := map[string]interface{}{}
+
+	if v := apiObject.Name; v != nil {
+		tfMap["name"] = aws.ToString(v)
+	}
+
+	if v := apiObject.Runtime; v != nil {
+		tfMap["runtime"] = aws.ToString(v)
+	}
+
+	return tfMap
+}
+
+func flattenPersistentStorage(apiObject *types.PersistentStorage) []map[string]interface{} {
+	if apiObject == nil {
+		return nil
+	}
+
+	tfMap := map[string]interface{}{
+		"size": aws.ToInt32(apiObject.SizeInGiB),
+	}
+
+	return []map[string]interface{}{tfMap}
+}
+
+func expandRepositorysInput(tfList []interface{}) []types.RepositoryInput {
+	if len(tfList) == 0 {
+		return nil
+	}
+
+	var apiObjects []types.RepositoryInput
+
+	for _, tfMapRaw := range tfList {
+		tfMap, ok := tfMapRaw.(map[string]interface{})
+
+		if !ok {
+			continue
+		}
+
+		apiObject := expandRepositoryInput(tfMap)
+
+		apiObjects = append(apiObjects, apiObject)
+	}
+
+	return apiObjects
+}
+
+func expandRepositoryInput(tfMap map[string]interface{}) types.RepositoryInput {
+	apiObject := types.RepositoryInput{}
+
+	if v, ok := tfMap["branch_name"].(string); ok && v != "" {
+		apiObject.BranchName = aws.String(v)
+	}
+	if v, ok := tfMap["repository_name"].(string); ok && v != "" {
+		apiObject.RepositoryName = aws.String(v)
+	}
+
+	return apiObject
+}
+
+func expandIdesConfiguration(tfList []interface{}) []types.IdeConfiguration {
+	if len(tfList) == 0 {
+		return nil
+	}
+
+	var apiObjects []types.IdeConfiguration
+
+	for _, tfMapRaw := range tfList {
+		tfMap, ok := tfMapRaw.(map[string]interface{})
+
+		if !ok {
+			continue
+		}
+
+		apiObject := expandIdeConfiguration(tfMap)
+
+		apiObjects = append(apiObjects, apiObject)
+	}
+
+	return apiObjects
+}
+
+func expandIdeConfiguration(tfMap map[string]interface{}) types.IdeConfiguration {
+	apiObject := types.IdeConfiguration{}
+
+	if v, ok := tfMap["name"].(string); ok && v != "" {
+		apiObject.Name = aws.String(v)
+	}
+	if v, ok := tfMap["runtime"].(string); ok && v != "" {
+		apiObject.Runtime = aws.String(v)
+	}
+
+	return apiObject
+}
+
+func expandPersistentStorageConfiguration(tfMap map[string]interface{}) *types.PersistentStorageConfiguration {
+	apiObject := &types.PersistentStorageConfiguration{}
+
+	if v, ok := tfMap["size"].(int); ok && v != 0 {
+		apiObject.SizeInGiB = aws.Int32(int32(v))
+	}
+
+	return apiObject
+}
diff --git a/internal/service/codecatalyst/dev_environment_data_source.go b/internal/service/codecatalyst/dev_environment_data_source.go
new file mode 100644
index 00000000000..40e0c9ba380
--- /dev/null
+++ b/internal/service/codecatalyst/dev_environment_data_source.go
@@ -0,0 +1,156 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package codecatalyst
+
+import (
+	"context"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/create"
+	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
+	"github.com/hashicorp/terraform-provider-aws/names"
+)
+
+// Function annotations are used for datasource registration to the Provider. DO NOT EDIT.
+// @SDKDataSource("aws_codecatalyst_dev_environment", name="Dev Environment")
+func DataSourceDevEnvironment() *schema.Resource {
+	return &schema.Resource{
+
+		ReadWithoutTimeout: dataSourceDevEnvironmentRead,
+
+		Schema: map[string]*schema.Schema{
+			"alias": {
+				Type:     schema.TypeString,
+				Optional: true,
+			},
+			"creator_id": {
+				Type:     schema.TypeString,
+				Optional: true,
+			},
+			"env_id": {
+				Type:     schema.TypeString,
+				Required: true,
+			},
+			"ides": {
+				Type:     schema.TypeList,
+				Computed: true,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"name": {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+						"runtime": {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+					},
+				},
+			},
+			"inactivity_timeout_minutes": {
+				Type:     schema.TypeInt,
+				Computed: true,
+			},
+			"instance_type": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"last_updated_time": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"persistent_storage": {
+				Type:     schema.TypeList,
+				Computed: true,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"size": {
+							Type:     schema.TypeInt,
+							Computed: true,
+						},
+					},
+				},
+			},
+			"project_name": {
+				Type:     schema.TypeString,
+				Required: true,
+			},
+			"repositories": {
+				Type:     schema.TypeList,
+				Optional: true,
+				MaxItems: 100,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"branch_name": {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+						"repository_name": {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+					},
+				},
+			},
+			"space_name": {
+				Type:     schema.TypeString,
+				Required: true,
+			},
+			"status": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"status_reason": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"tags": tftags.TagsSchemaComputed(),
+		},
+	}
+}
+
+const (
+	DSNameDevEnvironment = "Dev Environment Data Source"
+)
+
+func dataSourceDevEnvironmentRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+
+	conn := meta.(*conns.AWSClient).CodeCatalystClient(ctx)
+
+	spaceName := aws.String(d.Get("space_name").(string))
+	projectName := aws.String(d.Get("project_name").(string))
+	env_id := d.Get("env_id").(string)
+
+	out, err := findDevEnvironmentByID(ctx, conn, env_id, spaceName, projectName)
+	if err != nil {
+		return append(diags, create.DiagError(names.CodeCatalyst, create.ErrActionReading, DSNameDevEnvironment, d.Id(), err)...)
+	}
+
+	d.SetId(aws.ToString(out.Id))
+
+	d.Set("alias", out.Alias)
+	d.Set("creator_id", out.CreatorId)
+	d.Set("project_name", out.ProjectName)
+	d.Set("space_name", out.SpaceName)
+	d.Set("instance_type", out.InstanceType)
+	d.Set("last_updated_time", out.LastUpdatedTime.String())
+	d.Set("inactivity_timeout_minutes", out.InactivityTimeoutMinutes)
+	d.Set("persistent_storage", flattenPersistentStorage(out.PersistentStorage))
+	d.Set("status", out.Status)
+	d.Set("status_reason", out.StatusReason)
+
+	if err := d.Set("ides", flattenIdes(out.Ides)); err != nil {
+		return append(diags, create.DiagError(names.CodeCatalyst, create.ErrActionSetting, ResNameDevEnvironment, d.Id(), err)...)
+	}
+
+	if err := d.Set("repositories", flattenRepositories(out.Repositories)); err != nil {
+		return append(diags, create.DiagError(names.CodeCatalyst, create.ErrActionSetting, ResNameDevEnvironment, d.Id(), err)...)
+	}
+
+	return diags
+}
diff --git a/internal/service/codecatalyst/dev_environment_data_source_test.go b/internal/service/codecatalyst/dev_environment_data_source_test.go
new file mode 100644
index 00000000000..35d4b3eee32
--- /dev/null
+++ b/internal/service/codecatalyst/dev_environment_data_source_test.go
@@ -0,0 +1,62 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package codecatalyst_test
+
+import (
+	"fmt"
+	"testing"
+
+	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
+	"github.com/hashicorp/terraform-provider-aws/names"
+)
+
+func TestAccCodeCatalystDevEnvironmentDataSource_basic(t *testing.T) {
+	ctx := acctest.Context(t)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	dataSourceName := "data.aws_codecatalyst_dev_environment.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, names.CodeCatalyst)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, names.CodeCatalyst),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccDevEnvironmentDataSourceConfig_basic(rName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					resource.TestCheckResourceAttr(dataSourceName, "space_name", "tf-cc-aws-provider"),
+					resource.TestCheckResourceAttr(dataSourceName, "project_name", "tf-cc"),
+				),
+			},
+		},
+	})
+}
+
+func testAccDevEnvironmentDataSourceConfig_basic(rName string) string {
+	return fmt.Sprintf(`
+resource "aws_codecatalyst_dev_environment" "test" {
+  alias         = %[1]q
+  space_name    = "tf-cc-aws-provider"
+  project_name  = "tf-cc"
+  instance_type = "dev.standard1.small"
+  persistent_storage {
+    size = 16
+  }
+  ides {
+    name = "VSCode"
+  }
+}
+
+data "aws_codecatalyst_dev_environment" "test" {
+  space_name   = "tf-cc-aws-provider"
+  project_name = "tf-cc"
+  env_id       = aws_codecatalyst_dev_environment.test.id
+}
+`, rName)
+}
diff --git a/internal/service/codecatalyst/dev_environment_test.go b/internal/service/codecatalyst/dev_environment_test.go
new file mode 100644
index 00000000000..8d951d70e14
--- /dev/null
+++ b/internal/service/codecatalyst/dev_environment_test.go
@@ -0,0 +1,263 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package codecatalyst_test
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"testing"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/codecatalyst"
+	"github.com/aws/aws-sdk-go-v2/service/codecatalyst/types"
+	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
+	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/create"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs"
+	tfcodecatalyst "github.com/hashicorp/terraform-provider-aws/internal/service/codecatalyst"
+	"github.com/hashicorp/terraform-provider-aws/names"
+)
+
+func TestAccCodeCatalystDevEnvironment_basic(t *testing.T) {
+	ctx := acctest.Context(t)
+	var DevEnvironment codecatalyst.GetDevEnvironmentOutput
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_codecatalyst_dev_environment.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, names.CodeCatalyst)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, names.CodeCatalyst),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckDevEnvironmentDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccDevEnvironmentConfig_basic(rName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckDevEnvironmentExists(ctx, resourceName, &DevEnvironment),
+					resource.TestCheckResourceAttr(resourceName, "alias", rName),
+					resource.TestCheckResourceAttr(resourceName, "space_name", "terraform"),
+					resource.TestCheckResourceAttr(resourceName, "project_name", "terraform"),
+					resource.TestCheckResourceAttr(resourceName, "instance_type", "dev.standard1.small"),
+					resource.TestCheckResourceAttr(resourceName, "persistent_storage.0.size", "16"),
+					resource.TestCheckResourceAttr(resourceName, "ides.0.name", "VSCode"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccCodeCatalystDevEnvironment_withRepositories(t *testing.T) {
+	ctx := acctest.Context(t)
+	var DevEnvironment codecatalyst.GetDevEnvironmentOutput
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_codecatalyst_dev_environment.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, names.CodeCatalyst)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, names.CodeCatalyst),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckDevEnvironmentDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccDevEnvironmentConfig_withRepositories(rName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckDevEnvironmentExists(ctx, resourceName, &DevEnvironment),
+					resource.TestCheckResourceAttr(resourceName, "alias", rName),
+					resource.TestCheckResourceAttr(resourceName, "space_name", "terraform"),
+					resource.TestCheckResourceAttr(resourceName, "project_name", "terraform"),
+					resource.TestCheckResourceAttr(resourceName, "instance_type", "dev.standard1.small"),
+					resource.TestCheckResourceAttr(resourceName, "persistent_storage.0.size", "16"),
+					resource.TestCheckResourceAttr(resourceName, "ides.0.name", "PyCharm"),
+					resource.TestCheckResourceAttr(resourceName, "ides.0.runtime", "public.ecr.aws/jetbrains/py"),
+					resource.TestCheckResourceAttr(resourceName, "inactivity_timeout_minutes", "40"),
+					resource.TestCheckResourceAttr(resourceName, "repositories.0.repository_name", "terraform-provider-aws"),
+					resource.TestCheckResourceAttr(resourceName, "repositories.0.branch_name", "main"),
+				),
+			},
+		},
+	})
+}
+func TestAccCodeCatalystDevEnvironment_disappears(t *testing.T) {
+	ctx := acctest.Context(t)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	var DevEnvironment codecatalyst.GetDevEnvironmentOutput
+	resourceName := "aws_codecatalyst_dev_environment.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, names.CodeCatalyst)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, names.CodeCatalyst),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckDevEnvironmentDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccDevEnvironmentConfig_basic(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckDevEnvironmentExists(ctx, resourceName, &DevEnvironment),
+					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfcodecatalyst.ResourceDevEnvironment(), resourceName),
+				),
+				ExpectNonEmptyPlan: true,
+			},
+		},
+	})
+}
+
+func testAccCheckDevEnvironmentDestroy(ctx context.Context) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		conn := acctest.Provider.Meta().(*conns.AWSClient).CodeCatalystClient(ctx)
+
+		for _, rs := range s.RootModule().Resources {
+			if rs.Type != "aws_codecatalyst_dev_environment" {
+				continue
+			}
+			spaceName := rs.Primary.Attributes["space_name"]
+			projectName := rs.Primary.Attributes["project_name"]
+
+			_, err := conn.GetDevEnvironment(ctx, &codecatalyst.GetDevEnvironmentInput{
+				Id:          aws.String(rs.Primary.ID),
+				SpaceName:   aws.String(spaceName),
+				ProjectName: aws.String(projectName),
+			})
+			if errs.IsA[*types.AccessDeniedException](err) {
+				continue
+			}
+			if err != nil {
+				return err
+			}
+
+			return create.Error(names.CodeCatalyst, create.ErrActionCheckingDestroyed, tfcodecatalyst.ResNameDevEnvironment, rs.Primary.ID, errors.New("not destroyed"))
+		}
+
+		return nil
+	}
+}
+
+func testAccCheckDevEnvironmentExists(ctx context.Context, name string, DevEnvironment *codecatalyst.GetDevEnvironmentOutput) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[name]
+		if !ok {
+			return create.Error(names.CodeCatalyst, create.ErrActionCheckingExistence, tfcodecatalyst.ResNameDevEnvironment, name, errors.New("not found"))
+		}
+
+		if rs.Primary.ID == "" {
+			return create.Error(names.CodeCatalyst, create.ErrActionCheckingExistence, tfcodecatalyst.ResNameDevEnvironment, name, errors.New("not set"))
+		}
+		spaceName := rs.Primary.Attributes["space_name"]
+		projectName := rs.Primary.Attributes["project_name"]
+
+		conn := acctest.Provider.Meta().(*conns.AWSClient).CodeCatalystClient(ctx)
+		resp, err := conn.GetDevEnvironment(ctx, &codecatalyst.GetDevEnvironmentInput{
+			Id:          aws.String(rs.Primary.ID),
+			SpaceName:   aws.String(spaceName),
+			ProjectName: aws.String(projectName),
+		})
+
+		if err != nil {
+			return create.Error(names.CodeCatalyst, create.ErrActionCheckingExistence, tfcodecatalyst.ResNameDevEnvironment, rs.Primary.ID, err)
+		}
+
+		*DevEnvironment = *resp
+
+		return nil
+	}
+}
+
+func testAccPreCheck(ctx context.Context, t *testing.T) {
+	conn := acctest.Provider.Meta().(*conns.AWSClient).CodeCatalystClient(ctx)
+
+	/*
+		If no Amazon CodeCatalyst token is available then the Go SDK crashes:
+
+		panic: runtime error: invalid memory address or nil pointer dereference [recovered]
+			panic: runtime error: invalid memory address or nil pointer dereference
+		[signal SIGSEGV: segmentation violation code=0x1 addr=0x18 pc=0x13b9c10]
+
+		goroutine 51 [running]:
+		testing.tRunner.func1.2({0xc732900, 0x15190320})
+			/Users/ewbankkit/sdk/go1.20.5/src/testing/testing.go:1526 +0x24e
+		testing.tRunner.func1()
+			/Users/ewbankkit/sdk/go1.20.5/src/testing/testing.go:1529 +0x39f
+		panic({0xc732900, 0x15190320})
+			/Users/ewbankkit/sdk/go1.20.5/src/runtime/panic.go:884 +0x213
+		github.com/aws/smithy-go/auth/bearer.(*AuthenticationMiddleware).HandleFinalize(0xc002690360, {0xf06b6e0, 0xc0023ab200}, {{0xdcae320?, 0xc0023aaa80?}}, {0xef7e740, 0xc000c4b170})
+			/Users/ewbankkit/go/pkg/mod/github.com/aws/smithy-go@v1.14.0/auth/bearer/middleware.go:59 +0x70
+	*/
+	defer func() {
+		if err := recover(); err != nil {
+			t.Skipf("skipping acceptance testing: %s", err)
+		}
+	}()
+
+	_, err := conn.VerifySession(ctx, &codecatalyst.VerifySessionInput{})
+
+	if acctest.PreCheckSkipError(err) {
+		t.Skipf("skipping acceptance testing: %s", err)
+	}
+
+	if err != nil {
+		t.Fatalf("unexpected PreCheck error: %s", err)
+	}
+}
+
+func testAccDevEnvironmentConfig_basic(rName string) string {
+	return fmt.Sprintf(`
+resource "aws_codecatalyst_dev_environment" "test" {
+  alias         = %[1]q
+  space_name    = "terraform"
+  project_name  = "terraform"
+  instance_type = "dev.standard1.small"
+  persistent_storage {
+    size = 16
+  }
+  ides {
+    name = "VSCode"
+  }
+
+
+}
+`, rName)
+}
+
+func testAccDevEnvironmentConfig_withRepositories(rName string) string {
+	return fmt.Sprintf(`
+resource "aws_codecatalyst_dev_environment" "test" {
+  alias         = %[1]q
+  space_name    = "terraform"
+  project_name  = "terraform"
+  instance_type = "dev.standard1.small"
+
+  persistent_storage {
+    size = 16
+  }
+
+  ides {
+    name    = "PyCharm"
+    runtime = "public.ecr.aws/jetbrains/py"
+  }
+
+  inactivity_timeout_minutes = 40
+
+  repositories {
+    repository_name = "terraform-provider-aws"
+    branch_name     = "main"
+  }
+
+}
+`, rName)
+}
diff --git a/internal/service/codecatalyst/generate.go b/internal/service/codecatalyst/generate.go
new file mode 100644
index 00000000000..b6be35756ff
--- /dev/null
+++ b/internal/service/codecatalyst/generate.go
@@ -0,0 +1,7 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+//go:generate go run ../../generate/servicepackage/main.go
+// ONLY generate directives and package declaration! Do not add anything else to this file.
+
+package codecatalyst
diff --git a/internal/service/codecatalyst/project.go b/internal/service/codecatalyst/project.go
new file mode 100644
index 00000000000..69bbf44a02c
--- /dev/null
+++ b/internal/service/codecatalyst/project.go
@@ -0,0 +1,192 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package codecatalyst
+
+import (
+	"context"
+	"errors"
+	"log"
+	"time"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/codecatalyst"
+	"github.com/aws/aws-sdk-go-v2/service/codecatalyst/types"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/create"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/names"
+)
+
+// Function annotations are used for resource registration to the Provider. DO NOT EDIT.
+// @SDKResource("aws_codecatalyst_project", name="Project")
+func ResourceProject() *schema.Resource {
+	return &schema.Resource{
+
+		CreateWithoutTimeout: resourceProjectCreate,
+		ReadWithoutTimeout:   resourceProjectRead,
+		UpdateWithoutTimeout: resourceProjectUpdate,
+		DeleteWithoutTimeout: resourceProjectDelete,
+
+		Importer: &schema.ResourceImporter{
+			StateContext: schema.ImportStatePassthroughContext,
+		},
+
+		Timeouts: &schema.ResourceTimeout{
+			Create: schema.DefaultTimeout(5 * time.Minute),
+			Update: schema.DefaultTimeout(5 * time.Minute),
+			Delete: schema.DefaultTimeout(5 * time.Minute),
+		},
+
+		Schema: map[string]*schema.Schema{
+			"space_name": {
+				Type:     schema.TypeString,
+				Required: true,
+			},
+			"description": {
+				Type:     schema.TypeString,
+				Optional: true,
+			},
+			"display_name": {
+				Type:     schema.TypeString,
+				Required: true,
+			},
+			"name": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+		},
+	}
+}
+
+const (
+	ResNameProject = "Project"
+)
+
+func resourceProjectCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	conn := meta.(*conns.AWSClient).CodeCatalystClient(ctx)
+
+	in := &codecatalyst.CreateProjectInput{
+		DisplayName: aws.String(d.Get("display_name").(string)),
+		SpaceName:   aws.String(d.Get("space_name").(string)),
+		Description: aws.String(d.Get("description").(string)),
+	}
+
+	out, err := conn.CreateProject(ctx, in)
+	if err != nil {
+		return create.DiagError(names.CodeCatalyst, create.ErrActionCreating, ResNameProject, d.Get("display_name").(string), err)
+	}
+
+	if out == nil || out.Name == nil {
+		return create.DiagError(names.CodeCatalyst, create.ErrActionCreating, ResNameProject, d.Get("display_name").(string), errors.New("empty output"))
+	}
+
+	d.SetId(aws.ToString(out.Name))
+	return resourceProjectRead(ctx, d, meta)
+}
+
+func resourceProjectRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+
+	conn := meta.(*conns.AWSClient).CodeCatalystClient(ctx)
+
+	spaceName := aws.String(d.Get("space_name").(string))
+
+	out, err := findProjectByName(ctx, conn, d.Id(), spaceName)
+
+	if !d.IsNewResource() && tfresource.NotFound(err) {
+		log.Printf("[WARN] CodeCatalyst Project (%s) not found, removing from state", d.Id())
+		d.SetId("")
+		return diags
+	}
+
+	if err != nil {
+		return append(diags, create.DiagError(names.CodeCatalyst, create.ErrActionReading, ResNameProject, d.Id(), err)...)
+	}
+
+	d.Set("name", out.Name)
+	d.Set("space_name", out.SpaceName)
+	d.Set("description", out.Description)
+
+	return diags
+}
+
+func resourceProjectUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+
+	conn := meta.(*conns.AWSClient).CodeCatalystClient(ctx)
+
+	update := false
+
+	in := &codecatalyst.UpdateProjectInput{
+		Name:        aws.String(d.Get("display_name").(string)),
+		SpaceName:   aws.String(d.Get("space_name").(string)),
+		Description: aws.String(d.Get("description").(string)),
+	}
+
+	if d.HasChanges("description") {
+		in.Description = aws.String(d.Get("description").(string))
+		update = true
+	}
+
+	if !update {
+		return diags
+	}
+
+	log.Printf("[DEBUG] Updating Codecatalyst Project (%s): %#v", d.Id(), in)
+
+	_, err := conn.UpdateProject(ctx, in)
+	if err != nil {
+		return append(diags, create.DiagError(names.CodeCatalyst, create.ErrActionUpdating, ResNameProject, d.Id(), err)...)
+	}
+
+	return append(diags, resourceDevEnvironmentRead(ctx, d, meta)...)
+}
+
+func resourceProjectDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	conn := meta.(*conns.AWSClient).CodeCatalystClient(ctx)
+
+	log.Printf("[INFO] Deleting CodeCatalyst Project %s", d.Id())
+
+	_, err := conn.DeleteProject(ctx, &codecatalyst.DeleteProjectInput{
+		Name:      aws.String(d.Id()),
+		SpaceName: aws.String(d.Get("space_name").(string)),
+	})
+	if err != nil {
+		var nfe *types.ResourceNotFoundException
+		if errors.As(err, &nfe) {
+			return nil
+		}
+
+		return create.DiagError(names.CodeCatalyst, create.ErrActionDeleting, ResNameProject, d.Id(), err)
+	}
+
+	return nil
+}
+
+func findProjectByName(ctx context.Context, conn *codecatalyst.Client, id string, spaceName *string) (*codecatalyst.GetProjectOutput, error) {
+	in := &codecatalyst.GetProjectInput{
+		Name:      aws.String(id),
+		SpaceName: spaceName,
+	}
+	out, err := conn.GetProject(ctx, in)
+	if errs.IsA[*types.AccessDeniedException](err) || errs.IsA[*types.ResourceNotFoundException](err) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: in,
+		}
+	}
+	if err != nil {
+		return nil, err
+	}
+
+	if out == nil || out.Name == nil {
+		return nil, tfresource.NewEmptyResultError(in)
+	}
+
+	return out, nil
+}
diff --git a/internal/service/codecatalyst/project_test.go b/internal/service/codecatalyst/project_test.go
new file mode 100644
index 00000000000..d59a39b6c28
--- /dev/null
+++ b/internal/service/codecatalyst/project_test.go
@@ -0,0 +1,148 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package codecatalyst_test
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"testing"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/codecatalyst"
+	"github.com/aws/aws-sdk-go-v2/service/codecatalyst/types"
+	sdkacctest "github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
+	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/create"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs"
+	tfcodecatalyst "github.com/hashicorp/terraform-provider-aws/internal/service/codecatalyst"
+	"github.com/hashicorp/terraform-provider-aws/names"
+)
+
+func TestAccCodeCatalystProject_basic(t *testing.T) {
+	ctx := acctest.Context(t)
+	var project codecatalyst.GetProjectOutput
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_codecatalyst_project.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, names.CodeCatalyst)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, names.CodeCatalyst),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckProjectDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccProjectConfig_basic(rName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckProjectExists(ctx, resourceName, &project),
+					resource.TestCheckResourceAttr(resourceName, "description", "Sample CC project created by TF"),
+					resource.TestCheckResourceAttr(resourceName, "space_name", "tf-cc-aws-provider"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccCodeCatalystProject_disappears(t *testing.T) {
+	ctx := acctest.Context(t)
+	var project codecatalyst.GetProjectOutput
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_codecatalyst_project.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, names.CodeCatalyst)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, names.CodeCatalyst),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckProjectDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccProjectConfig_basic(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckProjectExists(ctx, resourceName, &project),
+					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfcodecatalyst.ResourceProject(), resourceName),
+				),
+				ExpectNonEmptyPlan: true,
+			},
+		},
+	})
+}
+
+func testAccCheckProjectDestroy(ctx context.Context) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		conn := acctest.Provider.Meta().(*conns.AWSClient).CodeCatalystClient(ctx)
+
+		for _, rs := range s.RootModule().Resources {
+			if rs.Type != "aws_codecatalyst_project" {
+				continue
+			}
+
+			spaceName := rs.Primary.Attributes["space_name"]
+
+			_, err := conn.GetProject(ctx, &codecatalyst.GetProjectInput{
+				Name:      aws.String(rs.Primary.ID),
+				SpaceName: aws.String(spaceName),
+			})
+			if errs.IsA[*types.AccessDeniedException](err) {
+				continue
+			}
+			if err != nil {
+				return err
+			}
+
+			return create.Error(names.CodeCatalyst, create.ErrActionCheckingDestroyed, tfcodecatalyst.ResNameProject, rs.Primary.ID, errors.New("not destroyed"))
+		}
+
+		return nil
+	}
+}
+
+func testAccCheckProjectExists(ctx context.Context, name string, project *codecatalyst.GetProjectOutput) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[name]
+		if !ok {
+			return create.Error(names.CodeCatalyst, create.ErrActionCheckingExistence, tfcodecatalyst.ResNameProject, name, errors.New("not found"))
+		}
+
+		if rs.Primary.ID == "" {
+			return create.Error(names.CodeCatalyst, create.ErrActionCheckingExistence, tfcodecatalyst.ResNameProject, name, errors.New("not set"))
+		}
+
+		spaceName := rs.Primary.Attributes["space_name"]
+
+		conn := acctest.Provider.Meta().(*conns.AWSClient).CodeCatalystClient(ctx)
+		resp, err := conn.GetProject(ctx, &codecatalyst.GetProjectInput{
+			Name:      aws.String(rs.Primary.ID),
+			SpaceName: aws.String(spaceName),
+		})
+
+		if err != nil {
+			return create.Error(names.CodeCatalyst, create.ErrActionCheckingExistence, tfcodecatalyst.ResNameProject, rs.Primary.ID, err)
+		}
+
+		*project = *resp
+
+		return nil
+	}
+}
+
+func testAccProjectConfig_basic(rName string) string {
+	return fmt.Sprintf(`
+resource "aws_codecatalyst_project" "test" {
+  space_name   = "tf-cc-aws-provider"
+  display_name = %[1]q
+  description  = "Sample CC project created by TF"
+}
+`, rName)
+}
diff --git a/internal/service/codecatalyst/service_package_gen.go b/internal/service/codecatalyst/service_package_gen.go
new file mode 100644
index 00000000000..c9f04d85f24
--- /dev/null
+++ b/internal/service/codecatalyst/service_package_gen.go
@@ -0,0 +1,72 @@
+// Code generated by internal/generate/servicepackages/main.go; DO NOT EDIT.
+
+package codecatalyst
+
+import (
+	"context"
+
+	aws_sdkv2 "github.com/aws/aws-sdk-go-v2/aws"
+	codecatalyst_sdkv2 "github.com/aws/aws-sdk-go-v2/service/codecatalyst"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/types"
+	"github.com/hashicorp/terraform-provider-aws/names"
+)
+
+type servicePackage struct{}
+
+func (p *servicePackage) FrameworkDataSources(ctx context.Context) []*types.ServicePackageFrameworkDataSource {
+	return []*types.ServicePackageFrameworkDataSource{}
+}
+
+func (p *servicePackage) FrameworkResources(ctx context.Context) []*types.ServicePackageFrameworkResource {
+	return []*types.ServicePackageFrameworkResource{}
+}
+
+func (p *servicePackage) SDKDataSources(ctx context.Context) []*types.ServicePackageSDKDataSource {
+	return []*types.ServicePackageSDKDataSource{
+		{
+			Factory:  DataSourceDevEnvironment,
+			TypeName: "aws_codecatalyst_dev_environment",
+			Name:     "Dev Environment",
+		},
+	}
+}
+
+func (p *servicePackage) SDKResources(ctx context.Context) []*types.ServicePackageSDKResource {
+	return []*types.ServicePackageSDKResource{
+		{
+			Factory:  ResourceDevEnvironment,
+			TypeName: "aws_codecatalyst_dev_environment",
+			Name:     "DevEnvironment",
+		},
+		{
+			Factory:  ResourceProject,
+			TypeName: "aws_codecatalyst_project",
+			Name:     "Project",
+		},
+		{
+			Factory:  ResourceSourceRepository,
+			TypeName: "aws_codecatalyst_source_repository",
+			Name:     "Source Repository",
+		},
+	}
+}
+
+func (p *servicePackage) ServicePackageName() string {
+	return names.CodeCatalyst
+}
+
+// NewClient returns a new AWS SDK for Go v2 client for this service package's AWS API.
+func (p *servicePackage) NewClient(ctx context.Context, config map[string]any) (*codecatalyst_sdkv2.Client, error) {
+	cfg := *(config["aws_sdkv2_config"].(*aws_sdkv2.Config))
+
+	return codecatalyst_sdkv2.NewFromConfig(cfg, func(o *codecatalyst_sdkv2.Options) {
+		if endpoint := config["endpoint"].(string); endpoint != "" {
+			o.BaseEndpoint = aws_sdkv2.String(endpoint)
+		}
+	}), nil
+}
+
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/codecatalyst/source_repository.go b/internal/service/codecatalyst/source_repository.go
new file mode 100644
index 00000000000..fefba45590a
--- /dev/null
+++ b/internal/service/codecatalyst/source_repository.go
@@ -0,0 +1,166 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package codecatalyst
+
+import (
+	"context"
+	"errors"
+	"log"
+	"time"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/codecatalyst"
+	"github.com/aws/aws-sdk-go-v2/service/codecatalyst/types"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/create"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/names"
+)
+
+// Function annotations are used for resource registration to the Provider. DO NOT EDIT.
+// @SDKResource("aws_codecatalyst_source_repository", name="Source Repository")
+func ResourceSourceRepository() *schema.Resource {
+	return &schema.Resource{
+		CreateWithoutTimeout: resourceSourceRepositoryCreate,
+		ReadWithoutTimeout:   resourceSourceRepositoryRead,
+		UpdateWithoutTimeout: resourceSourceRepositoryCreate,
+		DeleteWithoutTimeout: resourceSourceRepositoryDelete,
+
+		Importer: &schema.ResourceImporter{
+			StateContext: schema.ImportStatePassthroughContext,
+		},
+
+		Timeouts: &schema.ResourceTimeout{
+			Create: schema.DefaultTimeout(30 * time.Minute),
+			Update: schema.DefaultTimeout(30 * time.Minute),
+			Delete: schema.DefaultTimeout(30 * time.Minute),
+		},
+
+		Schema: map[string]*schema.Schema{
+			"name": {
+				Type:     schema.TypeString,
+				Required: true,
+			},
+			"project_name": {
+				Type:     schema.TypeString,
+				Required: true,
+			},
+			"space_name": {
+				Type:     schema.TypeString,
+				Required: true,
+			},
+			"description": {
+				Type:     schema.TypeString,
+				Optional: true,
+			},
+		},
+	}
+}
+
+const (
+	ResNameSourceRepository = "Source Repository"
+)
+
+func resourceSourceRepositoryCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+
+	conn := meta.(*conns.AWSClient).CodeCatalystClient(ctx)
+
+	in := &codecatalyst.CreateSourceRepositoryInput{
+		Name:        aws.String(d.Get("name").(string)),
+		ProjectName: aws.String(d.Get("project_name").(string)),
+		SpaceName:   aws.String(d.Get("space_name").(string)),
+	}
+
+	out, err := conn.CreateSourceRepository(ctx, in)
+	if err != nil {
+		return append(diags, create.DiagError(names.CodeCatalyst, create.ErrActionCreating, ResNameSourceRepository, d.Get("name").(string), err)...)
+	}
+
+	if out == nil || out.Name == nil {
+		return append(diags, create.DiagError(names.CodeCatalyst, create.ErrActionCreating, ResNameSourceRepository, d.Get("name").(string), errors.New("empty output"))...)
+	}
+
+	d.SetId(aws.ToString(out.Name))
+
+	return resourceSourceRepositoryRead(ctx, d, meta)
+}
+
+func resourceSourceRepositoryRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).CodeCatalystClient(ctx)
+
+	projectName := aws.String(d.Get("project_name").(string))
+	spaceName := aws.String(d.Get("space_name").(string))
+
+	out, err := findSourceRepositoryByName(ctx, conn, d.Id(), projectName, spaceName)
+
+	if !d.IsNewResource() && tfresource.NotFound(err) {
+		log.Printf("[WARN] CodeCatalyst SourceRepository (%s) not found, removing from state", d.Id())
+		d.SetId("")
+		return diags
+	}
+
+	if err != nil {
+		return append(diags, create.DiagError(names.CodeCatalyst, create.ErrActionReading, ResNameSourceRepository, d.Id(), err)...)
+	}
+
+	d.Set("name", out.Name)
+	d.Set("project_name", out.ProjectName)
+	d.Set("space_name", out.SpaceName)
+	d.Set("description", out.Description)
+
+	return diags
+}
+
+func resourceSourceRepositoryDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+
+	conn := meta.(*conns.AWSClient).CodeCatalystClient(ctx)
+
+	log.Printf("[INFO] Deleting CodeCatalyst SourceRepository %s", d.Id())
+
+	_, err := conn.DeleteSourceRepository(ctx, &codecatalyst.DeleteSourceRepositoryInput{
+		Name:        aws.String(d.Id()),
+		ProjectName: aws.String(d.Get("project_name").(string)),
+		SpaceName:   aws.String(d.Get("space_name").(string)),
+	})
+
+	if errs.IsA[*types.ResourceNotFoundException](err) {
+		return diags
+	}
+	if err != nil {
+		return append(diags, create.DiagError(names.CodeCatalyst, create.ErrActionDeleting, ResNameSourceRepository, d.Id(), err)...)
+	}
+
+	return diags
+}
+
+func findSourceRepositoryByName(ctx context.Context, conn *codecatalyst.Client, name string, projectName, spaceName *string) (*codecatalyst.GetSourceRepositoryOutput, error) {
+	in := &codecatalyst.GetSourceRepositoryInput{
+		Name:        aws.String(name),
+		ProjectName: projectName,
+		SpaceName:   spaceName,
+	}
+	out, err := conn.GetSourceRepository(ctx, in)
+	if errs.IsA[*types.AccessDeniedException](err) || errs.IsA[*types.ResourceNotFoundException](err) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: in,
+		}
+	}
+	if err != nil {
+		return nil, err
+	}
+
+	if out == nil || out.Name == nil {
+		return nil, tfresource.NewEmptyResultError(in)
+	}
+
+	return out, nil
+}
diff --git a/internal/service/codecatalyst/source_repository_test.go b/internal/service/codecatalyst/source_repository_test.go
new file mode 100644
index 00000000000..2b54769f8ae
--- /dev/null
+++ b/internal/service/codecatalyst/source_repository_test.go
@@ -0,0 +1,153 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package codecatalyst_test
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"testing"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/codecatalyst"
+	"github.com/aws/aws-sdk-go-v2/service/codecatalyst/types"
+	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
+	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/create"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs"
+	tfcodecatalyst "github.com/hashicorp/terraform-provider-aws/internal/service/codecatalyst"
+	"github.com/hashicorp/terraform-provider-aws/names"
+)
+
+func TestAccCodeCatalystSourceRepository_basic(t *testing.T) {
+	ctx := acctest.Context(t)
+	var sourcerepository codecatalyst.GetSourceRepositoryOutput
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_codecatalyst_source_repository.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, names.CodeCatalyst)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, names.CodeCatalyst),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckSourceRepositoryDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccSourceRepositoryConfig_basic(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckSourceRepositoryExists(ctx, resourceName, &sourcerepository),
+					resource.TestCheckResourceAttr(resourceName, "name", rName),
+					resource.TestCheckResourceAttr(resourceName, "space_name", "tf-cc-aws-provider"),
+					resource.TestCheckResourceAttr(resourceName, "project_name", "tf-cc"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccCodeCatalystSourceRepository_disappears(t *testing.T) {
+	ctx := acctest.Context(t)
+	var sourcerepository codecatalyst.GetSourceRepositoryOutput
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_codecatalyst_source_repository.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, names.CodeCatalyst)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, names.CodeCatalyst),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckSourceRepositoryDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccSourceRepositoryConfig_basic(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckSourceRepositoryExists(ctx, resourceName, &sourcerepository),
+					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfcodecatalyst.ResourceSourceRepository(), resourceName),
+				),
+				ExpectNonEmptyPlan: true,
+			},
+		},
+	})
+}
+
+func testAccCheckSourceRepositoryDestroy(ctx context.Context) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		conn := acctest.Provider.Meta().(*conns.AWSClient).CodeCatalystClient(ctx)
+
+		for _, rs := range s.RootModule().Resources {
+			if rs.Type != "aws_codecatalyst_source_repository" {
+				continue
+			}
+			spaceName := rs.Primary.Attributes["space_name"]
+			projectName := rs.Primary.Attributes["project_name"]
+
+			input := &codecatalyst.GetSourceRepositoryInput{
+				Name:        aws.String(rs.Primary.ID),
+				SpaceName:   aws.String(spaceName),
+				ProjectName: aws.String(projectName),
+			}
+			_, err := conn.GetSourceRepository(ctx, input)
+
+			if errs.IsA[*types.AccessDeniedException](err) {
+				continue
+			}
+			if err != nil {
+				return err
+			}
+
+			return create.Error(names.CodeCatalyst, create.ErrActionCheckingDestroyed, tfcodecatalyst.ResNameSourceRepository, rs.Primary.ID, errors.New("not destroyed"))
+		}
+
+		return nil
+	}
+}
+
+func testAccCheckSourceRepositoryExists(ctx context.Context, name string, sourcerepository *codecatalyst.GetSourceRepositoryOutput) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[name]
+		if !ok {
+			return create.Error(names.CodeCatalyst, create.ErrActionCheckingExistence, tfcodecatalyst.ResNameSourceRepository, name, errors.New("not found"))
+		}
+
+		if rs.Primary.ID == "" {
+			return create.Error(names.CodeCatalyst, create.ErrActionCheckingExistence, tfcodecatalyst.ResNameSourceRepository, name, errors.New("not set"))
+		}
+		spaceName := rs.Primary.Attributes["space_name"]
+		projectName := rs.Primary.Attributes["project_name"]
+
+		conn := acctest.Provider.Meta().(*conns.AWSClient).CodeCatalystClient(ctx)
+		resp, err := conn.GetSourceRepository(ctx, &codecatalyst.GetSourceRepositoryInput{
+			Name:        aws.String(rs.Primary.ID),
+			SpaceName:   aws.String(spaceName),
+			ProjectName: aws.String(projectName),
+		})
+
+		if err != nil {
+			return create.Error(names.CodeCatalyst, create.ErrActionCheckingExistence, tfcodecatalyst.ResNameSourceRepository, rs.Primary.ID, err)
+		}
+
+		*sourcerepository = *resp
+
+		return nil
+	}
+}
+
+func testAccSourceRepositoryConfig_basic(rName string) string {
+	return fmt.Sprintf(`
+resource "aws_codecatalyst_source_repository" "test" {
+  name         = %[1]q
+  project_name = "tf-cc"
+  space_name   = "tf-cc-aws-provider"
+}
+`, rName)
+}
diff --git a/internal/service/codecommit/approval_rule_template.go b/internal/service/codecommit/approval_rule_template.go
index 50bc41697a5..85c90e6809a 100644
--- a/internal/service/codecommit/approval_rule_template.go
+++ b/internal/service/codecommit/approval_rule_template.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package codecommit
 
 import (
diff --git a/internal/service/codecommit/approval_rule_template_association.go b/internal/service/codecommit/approval_rule_template_association.go
index fa1bc56a978..92eed71df5c 100644
--- a/internal/service/codecommit/approval_rule_template_association.go
+++ b/internal/service/codecommit/approval_rule_template_association.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package codecommit
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"strings"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/codecommit"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -41,7 +44,7 @@ func ResourceApprovalRuleTemplateAssociation() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 100),
-					validation.StringMatch(regexp.MustCompile(`[\w\.-]+`), ""),
+					validation.StringMatch(regexache.MustCompile(`[\w\.-]+`), ""),
 				),
 			},
 		},
diff --git a/internal/service/codecommit/approval_rule_template_association_test.go b/internal/service/codecommit/approval_rule_template_association_test.go
index 31d79fdbb98..dad29db8600 100644
--- a/internal/service/codecommit/approval_rule_template_association_test.go
+++ b/internal/service/codecommit/approval_rule_template_association_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package codecommit_test
 
 import (
diff --git a/internal/service/codecommit/approval_rule_template_data_source.go b/internal/service/codecommit/approval_rule_template_data_source.go
index 041e269871e..ee4f1a419fe 100644
--- a/internal/service/codecommit/approval_rule_template_data_source.go
+++ b/internal/service/codecommit/approval_rule_template_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package codecommit
 
 import (
diff --git a/internal/service/codecommit/approval_rule_template_data_source_test.go b/internal/service/codecommit/approval_rule_template_data_source_test.go
index af906d26b6a..30d9d19aa63 100644
--- a/internal/service/codecommit/approval_rule_template_data_source_test.go
+++ b/internal/service/codecommit/approval_rule_template_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package codecommit_test
 
 import (
diff --git a/internal/service/codecommit/approval_rule_template_test.go b/internal/service/codecommit/approval_rule_template_test.go
index 375f4f99166..7e9b76682e8 100644
--- a/internal/service/codecommit/approval_rule_template_test.go
+++ b/internal/service/codecommit/approval_rule_template_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package codecommit_test
 
 import (
diff --git a/internal/service/codecommit/consts.go b/internal/service/codecommit/consts.go
index 3385290d4e2..04e56aa61a8 100644
--- a/internal/service/codecommit/consts.go
+++ b/internal/service/codecommit/consts.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package codecommit
 
 const (
diff --git a/internal/service/codecommit/find.go b/internal/service/codecommit/find.go
index 19bf93e5f31..3f5f68ab4a9 100644
--- a/internal/service/codecommit/find.go
+++ b/internal/service/codecommit/find.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package codecommit
 
 import (
diff --git a/internal/service/codecommit/generate.go b/internal/service/codecommit/generate.go
index fc381d90ae7..e9349829fa0 100644
--- a/internal/service/codecommit/generate.go
+++ b/internal/service/codecommit/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTags -ServiceTagsMap -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/codecommit/repository.go b/internal/service/codecommit/repository.go
index d6ea9d97f10..e417f6d172a 100644
--- a/internal/service/codecommit/repository.go
+++ b/internal/service/codecommit/repository.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package codecommit
 
 import (
@@ -35,7 +38,6 @@ func ResourceRepository() *schema.Resource {
 			"repository_name": {
 				Type:         schema.TypeString,
 				Required:     true,
-				ForceNew:     true,
 				ValidateFunc: validation.StringLenBetween(0, 100),
 			},
 
@@ -134,7 +136,11 @@ func resourceRepositoryRead(ctx context.Context, d *schema.ResourceData, meta in
 	d.Set("repository_name", out.RepositoryMetadata.RepositoryName)
 
 	if _, ok := d.GetOk("default_branch"); ok {
-		d.Set("default_branch", out.RepositoryMetadata.DefaultBranch)
+		// The default branch can only be set when there is code in the repository
+		// Preserve the configured value
+		if out.RepositoryMetadata.DefaultBranch != nil { // nosemgrep:ci.helper-schema-ResourceData-Set-extraneous-nil-check
+			d.Set("default_branch", out.RepositoryMetadata.DefaultBranch)
+		}
 	}
 
 	return diags
@@ -144,6 +150,12 @@ func resourceRepositoryUpdate(ctx context.Context, d *schema.ResourceData, meta
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).CodeCommitConn(ctx)
 
+	if d.HasChange("repository_name") {
+		if err := resourceUpdateRepositoryName(ctx, conn, d); err != nil {
+			return sdkdiag.AppendErrorf(diags, "updating CodeCommit Repository (%s) name: %s", d.Id(), err)
+		}
+	}
+
 	if d.HasChange("default_branch") {
 		if err := resourceUpdateDefaultBranch(ctx, conn, d); err != nil {
 			return sdkdiag.AppendErrorf(diags, "updating CodeCommit Repository (%s) default branch: %s", d.Id(), err)
@@ -174,6 +186,25 @@ func resourceRepositoryDelete(ctx context.Context, d *schema.ResourceData, meta
 	return diags
 }
 
+func resourceUpdateRepositoryName(ctx context.Context, conn *codecommit.CodeCommit, d *schema.ResourceData) error {
+	newName := d.Get("repository_name").(string)
+
+	branchInput := &codecommit.UpdateRepositoryNameInput{
+		OldName: aws.String(d.Id()),
+		NewName: aws.String(newName),
+	}
+
+	_, err := conn.UpdateRepositoryNameWithContext(ctx, branchInput)
+	if err != nil {
+		return fmt.Errorf("Updating Repository Name for CodeCommit Repository: %s", err.Error())
+	}
+
+	// The Id is the name
+	d.SetId(newName)
+
+	return nil
+}
+
 func resourceUpdateDescription(ctx context.Context, conn *codecommit.CodeCommit, d *schema.ResourceData) error {
 	branchInput := &codecommit.UpdateRepositoryDescriptionInput{
 		RepositoryName:        aws.String(d.Id()),
@@ -208,8 +239,7 @@ func resourceUpdateDefaultBranch(ctx context.Context, conn *codecommit.CodeCommi
 		DefaultBranchName: aws.String(d.Get("default_branch").(string)),
 	}
 
-	_, err = conn.UpdateDefaultBranchWithContext(ctx, branchInput)
-	if err != nil {
+	if _, err := conn.UpdateDefaultBranchWithContext(ctx, branchInput); err != nil {
 		return fmt.Errorf("Updating Default Branch for CodeCommit Repository: %s", err.Error())
 	}
 
diff --git a/internal/service/codecommit/repository_data_source.go b/internal/service/codecommit/repository_data_source.go
index ff07770a53d..d569bab4696 100644
--- a/internal/service/codecommit/repository_data_source.go
+++ b/internal/service/codecommit/repository_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package codecommit
 
 import (
diff --git a/internal/service/codecommit/repository_data_source_test.go b/internal/service/codecommit/repository_data_source_test.go
index 4f5e19386e8..6aebe2d562d 100644
--- a/internal/service/codecommit/repository_data_source_test.go
+++ b/internal/service/codecommit/repository_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package codecommit_test
 
 import (
diff --git a/internal/service/codecommit/repository_test.go b/internal/service/codecommit/repository_test.go
index 8540d8a7715..1623b01855a 100644
--- a/internal/service/codecommit/repository_test.go
+++ b/internal/service/codecommit/repository_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package codecommit_test
 
 import (
@@ -17,8 +20,9 @@ import (
 
 func TestAccCodeCommitRepository_basic(t *testing.T) {
 	ctx := acctest.Context(t)
-	rInt := sdkacctest.RandInt()
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_codecommit_repository.test"
+	var v codecommit.RepositoryMetadata
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
@@ -27,9 +31,17 @@ func TestAccCodeCommitRepository_basic(t *testing.T) {
 		CheckDestroy:             testAccCheckRepositoryDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccRepositoryConfig_basic(rInt),
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckRepositoryExists(ctx, "aws_codecommit_repository.test"),
+				Config: testAccRepositoryConfig_basic(rName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckRepositoryExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "repository_name", rName),
+					resource.TestCheckNoResourceAttr(resourceName, "default_branch"),
+					resource.TestCheckResourceAttr(resourceName, "description", "This is a test description"),
+					acctest.CheckResourceAttrRegionalARN(resourceName, "arn", "codecommit", rName),
+					resource.TestCheckResourceAttrSet(resourceName, "repository_id"),
+					resource.TestCheckResourceAttrSet(resourceName, "clone_url_http"),
+					resource.TestCheckResourceAttrSet(resourceName, "clone_url_ssh"),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 				),
 			},
 			{
@@ -43,8 +55,10 @@ func TestAccCodeCommitRepository_basic(t *testing.T) {
 
 func TestAccCodeCommitRepository_withChanges(t *testing.T) {
 	ctx := acctest.Context(t)
-	rInt := sdkacctest.RandInt()
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	rNameUpdated := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_codecommit_repository.test"
+	var v1, v2 codecommit.RepositoryMetadata
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
@@ -53,11 +67,19 @@ func TestAccCodeCommitRepository_withChanges(t *testing.T) {
 		CheckDestroy:             testAccCheckRepositoryDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccRepositoryConfig_basic(rInt),
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckRepositoryExists(ctx, "aws_codecommit_repository.test"),
-					resource.TestCheckResourceAttr(
-						"aws_codecommit_repository.test", "description", "This is a test description"),
+				Config: testAccRepositoryConfig_basic(rName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckRepositoryExists(ctx, resourceName, &v1),
+					resource.TestCheckResourceAttr(resourceName, "description", "This is a test description"),
+				),
+			},
+			{
+				Config: testAccRepositoryConfig_changes(rNameUpdated),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckRepositoryExists(ctx, resourceName, &v2),
+					testAccCheckRepositoryNotRecreated(&v1, &v2),
+					resource.TestCheckResourceAttr(resourceName, "description", "This is a test description - with changes"),
+					resource.TestCheckResourceAttr(resourceName, "repository_name", rNameUpdated),
 				),
 			},
 			{
@@ -65,22 +87,15 @@ func TestAccCodeCommitRepository_withChanges(t *testing.T) {
 				ImportState:       true,
 				ImportStateVerify: true,
 			},
-			{
-				Config: testAccRepositoryConfig_changes(rInt),
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckRepositoryExists(ctx, "aws_codecommit_repository.test"),
-					resource.TestCheckResourceAttr(
-						"aws_codecommit_repository.test", "description", "This is a test description - with changes"),
-				),
-			},
 		},
 	})
 }
 
 func TestAccCodeCommitRepository_CreateDefault_branch(t *testing.T) {
 	ctx := acctest.Context(t)
-	rInt := sdkacctest.RandInt()
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_codecommit_repository.test"
+	var v codecommit.RepositoryMetadata
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
@@ -89,11 +104,10 @@ func TestAccCodeCommitRepository_CreateDefault_branch(t *testing.T) {
 		CheckDestroy:             testAccCheckRepositoryDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccRepositoryConfig_defaultBranch(rInt),
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckRepositoryExists(ctx, "aws_codecommit_repository.test"),
-					resource.TestCheckResourceAttr(
-						"aws_codecommit_repository.test", "default_branch", "master"),
+				Config: testAccRepositoryConfig_defaultBranch(rName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckRepositoryExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "default_branch", "main"),
 				),
 			},
 			{
@@ -108,8 +122,9 @@ func TestAccCodeCommitRepository_CreateDefault_branch(t *testing.T) {
 
 func TestAccCodeCommitRepository_CreateAndUpdateDefault_branch(t *testing.T) {
 	ctx := acctest.Context(t)
-	rInt := sdkacctest.RandInt()
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_codecommit_repository.test"
+	var v1, v2 codecommit.RepositoryMetadata
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
@@ -118,25 +133,24 @@ func TestAccCodeCommitRepository_CreateAndUpdateDefault_branch(t *testing.T) {
 		CheckDestroy:             testAccCheckRepositoryDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccRepositoryConfig_basic(rInt),
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckRepositoryExists(ctx, "aws_codecommit_repository.test"),
-					resource.TestCheckNoResourceAttr(
-						"aws_codecommit_repository.test", "default_branch"),
+				Config: testAccRepositoryConfig_basic(rName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckRepositoryExists(ctx, resourceName, &v1),
+					resource.TestCheckNoResourceAttr(resourceName, "default_branch"),
 				),
 			},
 			{
-				ResourceName:      resourceName,
-				ImportState:       true,
-				ImportStateVerify: true,
+				Config: testAccRepositoryConfig_defaultBranch(rName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckRepositoryExists(ctx, resourceName, &v2),
+					resource.TestCheckResourceAttr(resourceName, "default_branch", "main"),
+				),
 			},
 			{
-				Config: testAccRepositoryConfig_defaultBranch(rInt),
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckRepositoryExists(ctx, "aws_codecommit_repository.test"),
-					resource.TestCheckResourceAttr(
-						"aws_codecommit_repository.test", "default_branch", "master"),
-				),
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"default_branch"},
 			},
 		},
 	})
@@ -146,6 +160,7 @@ func TestAccCodeCommitRepository_tags(t *testing.T) {
 	ctx := acctest.Context(t)
 	rName := sdkacctest.RandString(10)
 	resourceName := "aws_codecommit_repository.test"
+	var v1, v2, v3 codecommit.RepositoryMetadata
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
@@ -155,8 +170,8 @@ func TestAccCodeCommitRepository_tags(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config: testAccRepositoryConfig_tags1(rName, "key1", "value1"),
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckRepositoryExists(ctx, resourceName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckRepositoryExists(ctx, resourceName, &v1),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
 				),
@@ -168,26 +183,82 @@ func TestAccCodeCommitRepository_tags(t *testing.T) {
 			},
 			{
 				Config: testAccRepositoryConfig_tags2(rName, "key1", "value1updated", "key2", "value2"),
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckRepositoryExists(ctx, resourceName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckRepositoryExists(ctx, resourceName, &v2),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1updated"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
 				),
 			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
 			{
 				Config: testAccRepositoryConfig_tags1(rName, "key2", "value2"),
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckRepositoryExists(ctx, resourceName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckRepositoryExists(ctx, resourceName, &v3),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
+func TestAccCodeCommitRepository_UpdateNameAndTags(t *testing.T) {
+	ctx := acctest.Context(t)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	rNameUpdated := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_codecommit_repository.test"
+	var v1, v2 codecommit.RepositoryMetadata
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, codecommit.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckRepositoryDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccRepositoryConfig_tags1(rName, "key1", "value1"),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckRepositoryExists(ctx, resourceName, &v1),
+					resource.TestCheckResourceAttr(resourceName, "repository_name", rName),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				Config: testAccRepositoryConfig_tags2(rNameUpdated, "key1", "value1updated", "key2", "value2"),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckRepositoryExists(ctx, resourceName, &v2),
+					resource.TestCheckResourceAttr(resourceName, "repository_name", rNameUpdated),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1updated"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
 				),
 			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
 		},
 	})
 }
 
-func testAccCheckRepositoryExists(ctx context.Context, name string) resource.TestCheckFunc {
+func testAccCheckRepositoryExists(ctx context.Context, name string, v *codecommit.RepositoryMetadata) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		rs, ok := s.RootModule().Resources[name]
 		if !ok {
@@ -216,6 +287,8 @@ func testAccCheckRepositoryExists(ctx context.Context, name string) resource.Tes
 				*out.RepositoryMetadata.RepositoryName, rs.Primary.ID)
 		}
 
+		*v = *out.RepositoryMetadata
+
 		return nil
 	}
 }
@@ -247,55 +320,64 @@ func testAccCheckRepositoryDestroy(ctx context.Context) resource.TestCheckFunc {
 	}
 }
 
-func testAccRepositoryConfig_basic(rInt int) string {
+func testAccCheckRepositoryNotRecreated(v1, v2 *codecommit.RepositoryMetadata) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		if aws.StringValue(v1.RepositoryId) != aws.StringValue(v2.RepositoryId) {
+			return fmt.Errorf("CodeCommit Repository recreated")
+		}
+		return nil
+	}
+}
+
+func testAccRepositoryConfig_basic(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_codecommit_repository" "test" {
-  repository_name = "test_repository_%d"
+  repository_name = %[1]q
   description     = "This is a test description"
 }
-`, rInt)
+`, rName)
 }
 
-func testAccRepositoryConfig_changes(rInt int) string {
+func testAccRepositoryConfig_changes(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_codecommit_repository" "test" {
-  repository_name = "test_repository_%d"
+  repository_name = %[1]q
   description     = "This is a test description - with changes"
 }
-`, rInt)
+`, rName)
 }
 
-func testAccRepositoryConfig_defaultBranch(rInt int) string {
+func testAccRepositoryConfig_defaultBranch(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_codecommit_repository" "test" {
-  repository_name = "test_repository_%d"
+  repository_name = %[1]q
   description     = "This is a test description"
-  default_branch  = "master"
+  default_branch  = "main"
 }
-`, rInt)
+`, rName)
 }
 
-func testAccRepositoryConfig_tags1(r, tag1Key, tag1Value string) string {
+func testAccRepositoryConfig_tags1(rName, tag1Key, tag1Value string) string {
 	return fmt.Sprintf(`
 resource "aws_codecommit_repository" "test" {
-  repository_name = "terraform-test-%s"
+  repository_name = %[1]q
 
   tags = {
-    %q = %q
+    %[2]q = %[3]q
   }
 }
-`, r, tag1Key, tag1Value)
+`, rName, tag1Key, tag1Value)
 }
 
-func testAccRepositoryConfig_tags2(r, tag1Key, tag1Value, tag2Key, tag2Value string) string {
+func testAccRepositoryConfig_tags2(rName, tag1Key, tag1Value, tag2Key, tag2Value string) string {
 	return fmt.Sprintf(`
 resource "aws_codecommit_repository" "test" {
-  repository_name = "terraform-test-%s"
+  repository_name = %[1]q
 
   tags = {
-    %q = %q
-    %q = %q
+    %[2]q = %[3]q
+    %[4]q = %[5]q
   }
 }
-`, r, tag1Key, tag1Value, tag2Key, tag2Value)
+`, rName, tag1Key, tag1Value, tag2Key, tag2Value)
 }
diff --git a/internal/service/codecommit/service_package_gen.go b/internal/service/codecommit/service_package_gen.go
index 69a2b37c4df..e63566ac80e 100644
--- a/internal/service/codecommit/service_package_gen.go
+++ b/internal/service/codecommit/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	codecommit_sdkv1 "github.com/aws/aws-sdk-go/service/codecommit"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -71,4 +72,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*c
 	return codecommit_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/codecommit/tags_gen.go b/internal/service/codecommit/tags_gen.go
index 2edda33ceea..27c1ed988c1 100644
--- a/internal/service/codecommit/tags_gen.go
+++ b/internal/service/codecommit/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/codecommit"
 	"github.com/aws/aws-sdk-go/service/codecommit/codecommitiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -54,7 +56,7 @@ func Tags(tags tftags.KeyValueTags) map[string]*string {
 	return aws.StringMap(tags.Map())
 }
 
-// KeyValueTags creates KeyValueTags from codecommit service tags.
+// KeyValueTags creates tftags.KeyValueTags from codecommit service tags.
 func KeyValueTags(ctx context.Context, tags map[string]*string) tftags.KeyValueTags {
 	return tftags.New(ctx, tags)
 }
@@ -85,6 +87,8 @@ func updateTags(ctx context.Context, conn codecommitiface.CodeCommitAPI, identif
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.CodeCommit)
 	if len(removedTags) > 0 {
diff --git a/internal/service/codecommit/trigger.go b/internal/service/codecommit/trigger.go
index 88e55964826..a0af93e7123 100644
--- a/internal/service/codecommit/trigger.go
+++ b/internal/service/codecommit/trigger.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package codecommit
 
 import (
diff --git a/internal/service/codecommit/trigger_test.go b/internal/service/codecommit/trigger_test.go
index a317b1102cf..fbcdd7cb026 100644
--- a/internal/service/codecommit/trigger_test.go
+++ b/internal/service/codecommit/trigger_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package codecommit_test
 
 import (
diff --git a/internal/service/codegurureviewer/generate.go b/internal/service/codegurureviewer/generate.go
index 48e931f1954..de601265188 100644
--- a/internal/service/codegurureviewer/generate.go
+++ b/internal/service/codegurureviewer/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTags -ServiceTagsMap -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/codegurureviewer/repository_association.go b/internal/service/codegurureviewer/repository_association.go
index 1ad68faa39a..5571422c586 100644
--- a/internal/service/codegurureviewer/repository_association.go
+++ b/internal/service/codegurureviewer/repository_association.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package codegurureviewer
 
 import (
 	"context"
 	"errors"
 	"log"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/codegurureviewer"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -82,7 +85,7 @@ func ResourceRepositoryAssociation() *schema.Resource {
 							Optional: true,
 							ValidateFunc: validation.All(
 								validation.StringLenBetween(1, 2048),
-								validation.StringMatch(regexp.MustCompile(`[a-zA-Z0-9-]+`), ""),
+								validation.StringMatch(regexache.MustCompile(`[0-9A-Za-z-]+`), ""),
 							),
 						},
 					},
@@ -124,7 +127,7 @@ func ResourceRepositoryAssociation() *schema.Resource {
 										Required: true,
 										ValidateFunc: validation.All(
 											validation.StringLenBetween(1, 100),
-											validation.StringMatch(regexp.MustCompile(`^\S[\w.-]*$`), ""),
+											validation.StringMatch(regexache.MustCompile(`^\S[\w.-]*$`), ""),
 										),
 									},
 									"owner": {
@@ -132,7 +135,7 @@ func ResourceRepositoryAssociation() *schema.Resource {
 										Required: true,
 										ValidateFunc: validation.All(
 											validation.StringLenBetween(1, 100),
-											validation.StringMatch(regexp.MustCompile(`^\S(.*\S)?$`), ""),
+											validation.StringMatch(regexache.MustCompile(`^\S(.*\S)?$`), ""),
 										),
 									},
 								},
@@ -150,7 +153,7 @@ func ResourceRepositoryAssociation() *schema.Resource {
 										Required: true,
 										ValidateFunc: validation.All(
 											validation.StringLenBetween(1, 100),
-											validation.StringMatch(regexp.MustCompile(`^\S[\w.-]*$`), ""),
+											validation.StringMatch(regexache.MustCompile(`^\S[\w.-]*$`), ""),
 										),
 									},
 								},
@@ -173,7 +176,7 @@ func ResourceRepositoryAssociation() *schema.Resource {
 										Required: true,
 										ValidateFunc: validation.All(
 											validation.StringLenBetween(1, 100),
-											validation.StringMatch(regexp.MustCompile(`^\S[\w.-]*$`), ""),
+											validation.StringMatch(regexache.MustCompile(`^\S[\w.-]*$`), ""),
 										),
 									},
 									"owner": {
@@ -181,7 +184,7 @@ func ResourceRepositoryAssociation() *schema.Resource {
 										Required: true,
 										ValidateFunc: validation.All(
 											validation.StringLenBetween(1, 100),
-											validation.StringMatch(regexp.MustCompile(`^\S(.*\S)?$`), ""),
+											validation.StringMatch(regexache.MustCompile(`^\S(.*\S)?$`), ""),
 										),
 									},
 								},
@@ -199,7 +202,7 @@ func ResourceRepositoryAssociation() *schema.Resource {
 										Required: true,
 										ValidateFunc: validation.All(
 											validation.StringLenBetween(1, 63),
-											validation.StringMatch(regexp.MustCompile(`^\S(.*\S)?$`), ""),
+											validation.StringMatch(regexache.MustCompile(`^\S(.*\S)?$`), ""),
 										),
 									},
 									"name": {
@@ -207,7 +210,7 @@ func ResourceRepositoryAssociation() *schema.Resource {
 										Required: true,
 										ValidateFunc: validation.All(
 											validation.StringLenBetween(1, 100),
-											validation.StringMatch(regexp.MustCompile(`^\S[\w.-]*$`), ""),
+											validation.StringMatch(regexache.MustCompile(`^\S[\w.-]*$`), ""),
 										),
 									},
 								},
diff --git a/internal/service/codegurureviewer/repository_association_test.go b/internal/service/codegurureviewer/repository_association_test.go
index 7be9ca34b76..925160fe424 100644
--- a/internal/service/codegurureviewer/repository_association_test.go
+++ b/internal/service/codegurureviewer/repository_association_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package codegurureviewer_test
 
 import (
 	"context"
 	"errors"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/codegurureviewer"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -42,8 +45,8 @@ func TestAccCodeGuruReviewerRepositoryAssociation_basic(t *testing.T) {
 				Config: testAccRepositoryAssociationConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRepositoryAssociationExists(ctx, resourceName, &repositoryassociation),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "codeguru-reviewer", regexp.MustCompile(`association:+.`)),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "id", "codeguru-reviewer", regexp.MustCompile(`association:+.`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "codeguru-reviewer", regexache.MustCompile(`association:+.`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "id", "codeguru-reviewer", regexache.MustCompile(`association:+.`)),
 					resource.TestCheckResourceAttr(resourceName, "repository.0.bitbucket.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "repository.0.codecommit.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "repository.0.github_enterprise_server.#", "0"),
@@ -77,8 +80,8 @@ func TestAccCodeGuruReviewerRepositoryAssociation_KMSKey(t *testing.T) {
 				Config: testAccRepositoryAssociationConfig_kms_key(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRepositoryAssociationExists(ctx, resourceName, &repositoryassociation),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "codeguru-reviewer", regexp.MustCompile(`association:+.`)),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "id", "codeguru-reviewer", regexp.MustCompile(`association:+.`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "codeguru-reviewer", regexache.MustCompile(`association:+.`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "id", "codeguru-reviewer", regexache.MustCompile(`association:+.`)),
 					resource.TestCheckResourceAttr(resourceName, "repository.0.bitbucket.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "repository.0.codecommit.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "repository.0.github_enterprise_server.#", "0"),
@@ -112,8 +115,8 @@ func TestAccCodeGuruReviewerRepositoryAssociation_S3Repository(t *testing.T) {
 				Config: testAccRepositoryAssociationConfig_s3_repository(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRepositoryAssociationExists(ctx, resourceName, &repositoryassociation),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "codeguru-reviewer", regexp.MustCompile(`association:+.`)),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "id", "codeguru-reviewer", regexp.MustCompile(`association:+.`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "codeguru-reviewer", regexache.MustCompile(`association:+.`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "id", "codeguru-reviewer", regexache.MustCompile(`association:+.`)),
 					resource.TestCheckResourceAttr(resourceName, "repository.0.bitbucket.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "repository.0.codecommit.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "repository.0.github_enterprise_server.#", "0"),
diff --git a/internal/service/codegurureviewer/service_package_gen.go b/internal/service/codegurureviewer/service_package_gen.go
index 69188438dac..422603b711d 100644
--- a/internal/service/codegurureviewer/service_package_gen.go
+++ b/internal/service/codegurureviewer/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	codegurureviewer_sdkv1 "github.com/aws/aws-sdk-go/service/codegurureviewer"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -50,4 +51,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*c
 	return codegurureviewer_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/codegurureviewer/sweep.go b/internal/service/codegurureviewer/sweep.go
index ab241333c57..afa5e4a350b 100644
--- a/internal/service/codegurureviewer/sweep.go
+++ b/internal/service/codegurureviewer/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package codegurureviewer
 
@@ -11,9 +11,10 @@ import (
 	"github.com/aws/aws-sdk-go/service/codegurureviewer"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_codegurureviewer", &resource.Sweeper{
 		Name: "aws_codegurureviewer",
 		F:    sweepAssociations,
@@ -22,7 +23,7 @@ func init() {
 
 func sweepAssociations(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
@@ -48,7 +49,7 @@ func sweepAssociations(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping CodeGuruReviewer Association sweep for %s: %s", region, err)
 		return nil
 	}
@@ -57,7 +58,7 @@ func sweepAssociations(region string) error {
 		return fmt.Errorf("error listing CodeGuruReviewer Associations (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping CodeGuruReviewer Associations (%s): %w", region, err)
diff --git a/internal/service/codegurureviewer/tags_gen.go b/internal/service/codegurureviewer/tags_gen.go
index 7e7c509762e..40ae57a3592 100644
--- a/internal/service/codegurureviewer/tags_gen.go
+++ b/internal/service/codegurureviewer/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/codegurureviewer"
 	"github.com/aws/aws-sdk-go/service/codegurureviewer/codegururevieweriface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -54,7 +56,7 @@ func Tags(tags tftags.KeyValueTags) map[string]*string {
 	return aws.StringMap(tags.Map())
 }
 
-// KeyValueTags creates KeyValueTags from codegurureviewer service tags.
+// KeyValueTags creates tftags.KeyValueTags from codegurureviewer service tags.
 func KeyValueTags(ctx context.Context, tags map[string]*string) tftags.KeyValueTags {
 	return tftags.New(ctx, tags)
 }
@@ -85,6 +87,8 @@ func updateTags(ctx context.Context, conn codegururevieweriface.CodeGuruReviewer
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.CodeGuruReviewer)
 	if len(removedTags) > 0 {
diff --git a/internal/service/codepipeline/codepipeline.go b/internal/service/codepipeline/codepipeline.go
index ceb7a4a6060..8183c598c67 100644
--- a/internal/service/codepipeline/codepipeline.go
+++ b/internal/service/codepipeline/codepipeline.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package codepipeline
 
 import (
@@ -7,9 +10,9 @@ import (
 	"errors"
 	"fmt"
 	"log"
-	"regexp"
 	"strings"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/codepipeline"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -96,7 +99,7 @@ func ResourcePipeline() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 100),
-					validation.StringMatch(regexp.MustCompile(`[A-Za-z0-9.@\-_]+`), ""),
+					validation.StringMatch(regexache.MustCompile(`[0-9A-Za-z_.@-]+`), ""),
 				),
 			},
 			"role_arn": {
@@ -123,7 +126,7 @@ func ResourcePipeline() *schema.Resource {
 									"configuration": {
 										Type:     schema.TypeMap,
 										Optional: true,
-										ValidateDiagFunc: verify.ValidAllDiag(
+										ValidateDiagFunc: validation.AllDiag(
 											validation.MapKeyLenBetween(1, 50),
 											validation.MapKeyLenBetween(1, 1000),
 										),
@@ -140,7 +143,7 @@ func ResourcePipeline() *schema.Resource {
 										Required: true,
 										ValidateFunc: validation.All(
 											validation.StringLenBetween(1, 100),
-											validation.StringMatch(regexp.MustCompile(`[A-Za-z0-9.@\-_]+`), ""),
+											validation.StringMatch(regexache.MustCompile(`[0-9A-Za-z_.@-]+`), ""),
 										),
 									},
 									"namespace": {
@@ -148,7 +151,7 @@ func ResourcePipeline() *schema.Resource {
 										Optional: true,
 										ValidateFunc: validation.All(
 											validation.StringLenBetween(1, 100),
-											validation.StringMatch(regexp.MustCompile(`[A-Za-z0-9@\-_]+`), ""),
+											validation.StringMatch(regexache.MustCompile(`[0-9A-Za-z_@-]+`), ""),
 										),
 									},
 									"output_artifacts": {
@@ -187,7 +190,7 @@ func ResourcePipeline() *schema.Resource {
 										Required: true,
 										ValidateFunc: validation.All(
 											validation.StringLenBetween(1, 9),
-											validation.StringMatch(regexp.MustCompile(`[0-9A-Za-z_-]+`), ""),
+											validation.StringMatch(regexache.MustCompile(`[0-9A-Za-z_-]+`), ""),
 										),
 									},
 								},
@@ -198,7 +201,7 @@ func ResourcePipeline() *schema.Resource {
 							Required: true,
 							ValidateFunc: validation.All(
 								validation.StringLenBetween(1, 100),
-								validation.StringMatch(regexp.MustCompile(`[A-Za-z0-9.@\-_]+`), ""),
+								validation.StringMatch(regexache.MustCompile(`[0-9A-Za-z_.@-]+`), ""),
 							),
 						},
 					},
diff --git a/internal/service/codepipeline/codepipeline_test.go b/internal/service/codepipeline/codepipeline_test.go
index ea6718366db..134cc325822 100644
--- a/internal/service/codepipeline/codepipeline_test.go
+++ b/internal/service/codepipeline/codepipeline_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package codepipeline_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/codepipeline"
 	"github.com/aws/aws-sdk-go/service/codestarconnections"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -40,7 +43,7 @@ func TestAccCodePipeline_basic(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckPipelineExists(ctx, resourceName, &p1),
 					resource.TestCheckResourceAttrPair(resourceName, "role_arn", "aws_iam_role.codepipeline_role", "arn"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "codepipeline", regexp.MustCompile(fmt.Sprintf("test-pipeline-%s", name))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "codepipeline", regexache.MustCompile(fmt.Sprintf("test-pipeline-%s", name))),
 					resource.TestCheckResourceAttr(resourceName, "artifact_store.#", "1"),
 
 					resource.TestCheckResourceAttr(resourceName, "stage.#", "2"),
@@ -173,7 +176,7 @@ func TestAccCodePipeline_emptyStageArtifacts(t *testing.T) {
 				Config: testAccCodePipelineConfig_emptyStageArtifacts(name),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckPipelineExists(ctx, resourceName, &p),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "codepipeline", regexp.MustCompile(fmt.Sprintf("test-pipeline-%s$", name))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "codepipeline", regexache.MustCompile(fmt.Sprintf("test-pipeline-%s$", name))),
 					resource.TestCheckResourceAttr(resourceName, "artifact_store.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "stage.#", "2"),
 					resource.TestCheckResourceAttr(resourceName, "stage.1.name", "Build"),
@@ -471,7 +474,7 @@ func TestAccCodePipeline_withNamespace(t *testing.T) {
 				Config: testAccCodePipelineConfig_namespace(name),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckPipelineExists(ctx, resourceName, &p1),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "codepipeline", regexp.MustCompile(fmt.Sprintf("test-pipeline-%s", name))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "codepipeline", regexache.MustCompile(fmt.Sprintf("test-pipeline-%s", name))),
 					resource.TestCheckResourceAttr(resourceName, "stage.0.action.0.namespace", "SourceVariables"),
 				),
 			},
@@ -667,7 +670,7 @@ func testAccPreCheckSupported(ctx context.Context, t *testing.T, regions ...stri
 		conf := &conns.Config{
 			Region: region,
 		}
-		client, diags := conf.ConfigureProvider(ctx, &conns.AWSClient{})
+		client, diags := conf.ConfigureProvider(ctx, acctest.Provider.Meta().(*conns.AWSClient))
 
 		if diags.HasError() {
 			t.Fatalf("error getting AWS client for region %s", region)
@@ -1402,11 +1405,6 @@ func testAccS3Bucket(bucket, rName string) string {
 resource "aws_s3_bucket" "%[1]s" {
   bucket = "tf-test-pipeline-%[1]s-%[2]s"
 }
-
-resource "aws_s3_bucket_acl" "%[1]s" {
-  bucket = aws_s3_bucket.%[1]s.id
-  acl    = "private"
-}
 `, bucket, rName)
 }
 
@@ -1416,12 +1414,6 @@ resource "aws_s3_bucket" "%[1]s" {
   bucket   = "tf-test-pipeline-%[1]s-%[2]s"
   provider = %[3]s
 }
-
-resource "aws_s3_bucket_acl" "%[1]s" {
-  bucket   = aws_s3_bucket.%[1]s.id
-  acl      = "private"
-  provider = %[3]s
-}
 `, bucket, rName, provider)
 }
 
@@ -1490,11 +1482,6 @@ resource "aws_codestarconnections_connection" "test" {
 resource "aws_s3_bucket" "foo" {
   bucket = "tf-test-pipeline-%[1]s"
 }
-
-resource "aws_s3_bucket_acl" "foo_acl" {
-  bucket = aws_s3_bucket.foo.id
-  acl    = "private"
-}
 `, rName))
 }
 
diff --git a/internal/service/codepipeline/consts.go b/internal/service/codepipeline/consts.go
index 5174ba73333..b45da1f0464 100644
--- a/internal/service/codepipeline/consts.go
+++ b/internal/service/codepipeline/consts.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package codepipeline
 
 import (
diff --git a/internal/service/codepipeline/custom_action_type.go b/internal/service/codepipeline/custom_action_type.go
index 438203ae3c2..171629f0812 100644
--- a/internal/service/codepipeline/custom_action_type.go
+++ b/internal/service/codepipeline/custom_action_type.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package codepipeline
 
 import (
diff --git a/internal/service/codepipeline/custom_action_type_test.go b/internal/service/codepipeline/custom_action_type_test.go
index 6500f1d4070..d4b71374040 100644
--- a/internal/service/codepipeline/custom_action_type_test.go
+++ b/internal/service/codepipeline/custom_action_type_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package codepipeline_test
 
 import (
diff --git a/internal/service/codepipeline/generate.go b/internal/service/codepipeline/generate.go
index afab6a4f170..13364bd8346 100644
--- a/internal/service/codepipeline/generate.go
+++ b/internal/service/codepipeline/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTags -ServiceTagsSlice -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/codepipeline/service_package_gen.go b/internal/service/codepipeline/service_package_gen.go
index b029d782833..7906ed8b3e3 100644
--- a/internal/service/codepipeline/service_package_gen.go
+++ b/internal/service/codepipeline/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	codepipeline_sdkv1 "github.com/aws/aws-sdk-go/service/codepipeline"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -66,4 +67,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*c
 	return codepipeline_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/codepipeline/sweep.go b/internal/service/codepipeline/sweep.go
index 07fb7369941..b839d233a75 100644
--- a/internal/service/codepipeline/sweep.go
+++ b/internal/service/codepipeline/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package codepipeline
 
@@ -11,9 +11,10 @@ import (
 	"github.com/aws/aws-sdk-go/service/codepipeline"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_codepipeline", &resource.Sweeper{
 		Name: "aws_codepipeline",
 		F:    sweepPipelines,
@@ -22,7 +23,7 @@ func init() {
 
 func sweepPipelines(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
@@ -47,7 +48,7 @@ func sweepPipelines(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Codepipeline Pipeline sweep for %s: %s", region, err)
 		return nil
 	}
@@ -56,7 +57,7 @@ func sweepPipelines(region string) error {
 		return fmt.Errorf("error listing Codepipeline Pipelines (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping Codepipeline Pipelines (%s): %w", region, err)
diff --git a/internal/service/codepipeline/tags_gen.go b/internal/service/codepipeline/tags_gen.go
index 714ed1f99f3..2c632012c2f 100644
--- a/internal/service/codepipeline/tags_gen.go
+++ b/internal/service/codepipeline/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/codepipeline"
 	"github.com/aws/aws-sdk-go/service/codepipeline/codepipelineiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -102,6 +104,8 @@ func updateTags(ctx context.Context, conn codepipelineiface.CodePipelineAPI, ide
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.CodePipeline)
 	if len(removedTags) > 0 {
diff --git a/internal/service/codepipeline/webhook.go b/internal/service/codepipeline/webhook.go
index 34408234c93..820c1ae0c74 100644
--- a/internal/service/codepipeline/webhook.go
+++ b/internal/service/codepipeline/webhook.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package codepipeline
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/codepipeline"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
@@ -94,7 +97,7 @@ func ResourceWebhook() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 100),
-					validation.StringMatch(regexp.MustCompile(`[A-Za-z0-9.@\-_]+`), ""),
+					validation.StringMatch(regexache.MustCompile(`[0-9A-Za-z_.@-]+`), ""),
 				),
 			},
 			"url": {
diff --git a/internal/service/codepipeline/webhook_test.go b/internal/service/codepipeline/webhook_test.go
index 95737fc806a..fba3bf42ed5 100644
--- a/internal/service/codepipeline/webhook_test.go
+++ b/internal/service/codepipeline/webhook_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package codepipeline_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/codepipeline"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -40,7 +43,7 @@ func TestAccCodePipelineWebhook_basic(t *testing.T) {
 				Config: testAccWebhookConfig_basic(rName, githubToken),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckWebhookExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "codepipeline", regexp.MustCompile(fmt.Sprintf("webhook:%s", rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "codepipeline", regexache.MustCompile(fmt.Sprintf("webhook:%s", rName))),
 					resource.TestCheckResourceAttr(resourceName, "authentication", "GITHUB_HMAC"),
 					resource.TestCheckResourceAttr(resourceName, "target_action", "Source"),
 					resource.TestCheckResourceAttrPair(resourceName, "target_pipeline", "aws_codepipeline.test", "name"),
@@ -460,11 +463,6 @@ resource "aws_s3_bucket" "test" {
   bucket = %[1]q
 }
 
-resource "aws_s3_bucket_acl" "test" {
-  bucket = aws_s3_bucket.test.id
-  acl    = "private"
-}
-
 resource "aws_iam_role" "test" {
   name = %[1]q
 
diff --git a/internal/service/codestarconnections/connection.go b/internal/service/codestarconnections/connection.go
index 58b1f0adff3..3ee5815f124 100644
--- a/internal/service/codestarconnections/connection.go
+++ b/internal/service/codestarconnections/connection.go
@@ -1,17 +1,21 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package codestarconnections
 
 import (
 	"context"
 	"log"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/codestarconnections"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/codestarconnections"
+	"github.com/aws/aws-sdk-go-v2/service/codestarconnections/types"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
-	"github.com/hashicorp/terraform-provider-aws/internal/create"
+	"github.com/hashicorp/terraform-provider-aws/internal/enum"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
@@ -21,7 +25,7 @@ import (
 
 // @SDKResource("aws_codestarconnections_connection", name="Connection")
 // @Tags(identifierAttribute="arn")
-func ResourceConnection() *schema.Resource {
+func resourceConnection() *schema.Resource {
 	return &schema.Resource{
 		CreateWithoutTimeout: resourceConnectionCreate,
 		ReadWithoutTimeout:   resourceConnectionRead,
@@ -54,12 +58,12 @@ func ResourceConnection() *schema.Resource {
 				ForceNew: true,
 			},
 			"provider_type": {
-				Type:          schema.TypeString,
-				Optional:      true,
-				ForceNew:      true,
-				Computed:      true,
-				ValidateFunc:  validation.StringInSlice(codestarconnections.ProviderType_Values(), false),
-				ConflictsWith: []string{"host_arn"},
+				Type:             schema.TypeString,
+				Optional:         true,
+				ForceNew:         true,
+				Computed:         true,
+				ValidateDiagFunc: enum.Validate[types.ProviderType](),
+				ConflictsWith:    []string{"host_arn"},
 			},
 			names.AttrTags:    tftags.TagsSchema(),
 			names.AttrTagsAll: tftags.TagsSchemaComputed(),
@@ -71,7 +75,7 @@ func ResourceConnection() *schema.Resource {
 
 func resourceConnectionCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).CodeStarConnectionsConn(ctx)
+	conn := meta.(*conns.AWSClient).CodeStarConnectionsClient(ctx)
 
 	name := d.Get("name").(string)
 	input := &codestarconnections.CreateConnectionInput{
@@ -84,38 +88,37 @@ func resourceConnectionCreate(ctx context.Context, d *schema.ResourceData, meta
 	}
 
 	if v, ok := d.GetOk("provider_type"); ok {
-		input.ProviderType = aws.String(v.(string))
+		input.ProviderType = types.ProviderType(v.(string))
 	}
 
-	log.Printf("[DEBUG] Creating CodeStar Connections Connection: %s", input)
-	output, err := conn.CreateConnectionWithContext(ctx, input)
+	output, err := conn.CreateConnection(ctx, input)
 
 	if err != nil {
 		return sdkdiag.AppendErrorf(diags, "creating CodeStar Connections Connection (%s): %s", name, err)
 	}
 
-	d.SetId(aws.StringValue(output.ConnectionArn))
+	d.SetId(aws.ToString(output.ConnectionArn))
 
 	return append(diags, resourceConnectionRead(ctx, d, meta)...)
 }
 
 func resourceConnectionRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).CodeStarConnectionsConn(ctx)
+	conn := meta.(*conns.AWSClient).CodeStarConnectionsClient(ctx)
 
-	connection, err := FindConnectionByARN(ctx, conn, d.Id())
+	connection, err := findConnectionByARN(ctx, conn, d.Id())
 
 	if !d.IsNewResource() && tfresource.NotFound(err) {
-		create.LogNotFoundRemoveState(names.CodeStarConnections, create.ErrActionReading, ResNameConnection, d.Id())
+		log.Printf("[WARN] CodeStar Connections Connection (%s) not found, removing from state", d.Id())
 		d.SetId("")
 		return diags
 	}
 
 	if err != nil {
-		return create.DiagError(names.CodeStarConnections, create.ErrActionReading, ResNameConnection, d.Id(), err)
+		return sdkdiag.AppendErrorf(diags, "reading CodeStar Connections Connection (%s): %s", d.Id(), err)
 	}
 
-	arn := aws.StringValue(connection.ConnectionArn)
+	arn := aws.ToString(connection.ConnectionArn)
 	d.SetId(arn)
 	d.Set("arn", connection.ConnectionArn)
 	d.Set("connection_status", connection.ConnectionStatus)
@@ -136,14 +139,14 @@ func resourceConnectionUpdate(ctx context.Context, d *schema.ResourceData, meta
 
 func resourceConnectionDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).CodeStarConnectionsConn(ctx)
+	conn := meta.(*conns.AWSClient).CodeStarConnectionsClient(ctx)
 
 	log.Printf("[DEBUG] Deleting CodeStar Connections Connection: %s", d.Id())
-	_, err := conn.DeleteConnectionWithContext(ctx, &codestarconnections.DeleteConnectionInput{
+	_, err := conn.DeleteConnection(ctx, &codestarconnections.DeleteConnectionInput{
 		ConnectionArn: aws.String(d.Id()),
 	})
 
-	if tfawserr.ErrCodeEquals(err, codestarconnections.ErrCodeResourceNotFoundException) {
+	if errs.IsA[*types.ResourceNotFoundException](err) {
 		return diags
 	}
 
@@ -153,3 +156,28 @@ func resourceConnectionDelete(ctx context.Context, d *schema.ResourceData, meta
 
 	return diags
 }
+
+func findConnectionByARN(ctx context.Context, conn *codestarconnections.Client, arn string) (*types.Connection, error) {
+	input := &codestarconnections.GetConnectionInput{
+		ConnectionArn: aws.String(arn),
+	}
+
+	output, err := conn.GetConnection(ctx, input)
+
+	if errs.IsA[*types.ResourceNotFoundException](err) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	if output == nil || output.Connection == nil {
+		return nil, tfresource.NewEmptyResultError(input)
+	}
+
+	return output.Connection, nil
+}
diff --git a/internal/service/codestarconnections/connection_data_source.go b/internal/service/codestarconnections/connection_data_source.go
index 848d63dee58..4a7aa2a8174 100644
--- a/internal/service/codestarconnections/connection_data_source.go
+++ b/internal/service/codestarconnections/connection_data_source.go
@@ -1,10 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package codestarconnections
 
 import (
 	"context"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/codestarconnections"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/codestarconnections"
+	"github.com/aws/aws-sdk-go-v2/service/codestarconnections/types"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
@@ -14,7 +18,7 @@ import (
 )
 
 // @SDKDataSource("aws_codestarconnections_connection")
-func DataSourceConnection() *schema.Resource {
+func dataSourceConnection() *schema.Resource {
 	return &schema.Resource{
 		ReadWithoutTimeout: dataSourceConnectionRead,
 
@@ -51,15 +55,16 @@ func DataSourceConnection() *schema.Resource {
 
 func dataSourceConnectionRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).CodeStarConnectionsConn(ctx)
+	conn := meta.(*conns.AWSClient).CodeStarConnectionsClient(ctx)
 	ignoreTagsConfig := meta.(*conns.AWSClient).IgnoreTagsConfig
 
-	var connection *codestarconnections.Connection
-	var err error
+	var connection *types.Connection
 
 	if v, ok := d.GetOk("arn"); ok {
 		arn := v.(string)
-		connection, err = FindConnectionByARN(ctx, conn, arn)
+		var err error
+
+		connection, err = findConnectionByARN(ctx, conn, arn)
 
 		if err != nil {
 			return sdkdiag.AppendErrorf(diags, "reading CodeStar Connections Connection (%s): %s", arn, err)
@@ -67,24 +72,23 @@ func dataSourceConnectionRead(ctx context.Context, d *schema.ResourceData, meta
 	} else if v, ok := d.GetOk("name"); ok {
 		name := v.(string)
 
-		err = conn.ListConnectionsPagesWithContext(ctx, &codestarconnections.ListConnectionsInput{}, func(page *codestarconnections.ListConnectionsOutput, lastPage bool) bool {
-			if page == nil {
-				return !lastPage
+		input := &codestarconnections.ListConnectionsInput{}
+		pages := codestarconnections.NewListConnectionsPaginator(conn, input)
+		for pages.HasMorePages() && connection == nil {
+			page, err := pages.NextPage(ctx)
+
+			if err != nil {
+				return sdkdiag.AppendErrorf(diags, "listing CodeStar Connections Connections: %s", err)
 			}
 
 			for _, v := range page.Connections {
-				if aws.StringValue(v.ConnectionName) == name {
-					connection = v
+				v := v
 
-					return false
+				if aws.ToString(v.ConnectionName) == name {
+					connection = &v
+					break
 				}
 			}
-
-			return !lastPage
-		})
-
-		if err != nil {
-			return sdkdiag.AppendErrorf(diags, "listing CodeStar Connections Connections: %s", err)
 		}
 
 		if connection == nil {
@@ -92,7 +96,7 @@ func dataSourceConnectionRead(ctx context.Context, d *schema.ResourceData, meta
 		}
 	}
 
-	arn := aws.StringValue(connection.ConnectionArn)
+	arn := aws.ToString(connection.ConnectionArn)
 	d.SetId(arn)
 	d.Set("arn", arn)
 	d.Set("connection_status", connection.ConnectionStatus)
diff --git a/internal/service/codestarconnections/connection_data_source_test.go b/internal/service/codestarconnections/connection_data_source_test.go
index 37033b456ec..e3ee2644462 100644
--- a/internal/service/codestarconnections/connection_data_source_test.go
+++ b/internal/service/codestarconnections/connection_data_source_test.go
@@ -1,13 +1,16 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package codestarconnections_test
 
 import (
 	"fmt"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/service/codestarconnections"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
+	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
 func TestAccCodeStarConnectionsConnectionDataSource_basic(t *testing.T) {
@@ -20,9 +23,9 @@ func TestAccCodeStarConnectionsConnectionDataSource_basic(t *testing.T) {
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck: func() {
 			acctest.PreCheck(ctx, t)
-			acctest.PreCheckPartitionHasService(t, codestarconnections.EndpointsID)
+			acctest.PreCheckPartitionHasService(t, names.CodeStarConnectionsEndpointID)
 		},
-		ErrorCheck:               acctest.ErrorCheck(t, codestarconnections.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.CodeStarConnectionsEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		Steps: []resource.TestStep{
 			{
@@ -55,9 +58,9 @@ func TestAccCodeStarConnectionsConnectionDataSource_tags(t *testing.T) {
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck: func() {
 			acctest.PreCheck(ctx, t)
-			acctest.PreCheckPartitionHasService(t, codestarconnections.EndpointsID)
+			acctest.PreCheckPartitionHasService(t, names.CodeStarConnectionsEndpointID)
 		},
-		ErrorCheck:               acctest.ErrorCheck(t, codestarconnections.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.CodeStarConnectionsEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		Steps: []resource.TestStep{
 			{
diff --git a/internal/service/codestarconnections/connection_test.go b/internal/service/codestarconnections/connection_test.go
index ad21b90952f..b83aef1d222 100644
--- a/internal/service/codestarconnections/connection_test.go
+++ b/internal/service/codestarconnections/connection_test.go
@@ -1,13 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package codestarconnections_test
 
 import (
 	"context"
-	"errors"
 	"fmt"
-	"regexp"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/service/codestarconnections"
+	"github.com/YakDriver/regexache"
+	"github.com/aws/aws-sdk-go-v2/service/codestarconnections/types"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
@@ -15,20 +17,21 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	tfcodestarconnections "github.com/hashicorp/terraform-provider-aws/internal/service/codestarconnections"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
 func TestAccCodeStarConnectionsConnection_basic(t *testing.T) {
 	ctx := acctest.Context(t)
-	var v codestarconnections.Connection
+	var v types.Connection
 	resourceName := "aws_codestarconnections_connection.test"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck: func() {
 			acctest.PreCheck(ctx, t)
-			acctest.PreCheckPartitionHasService(t, codestarconnections.EndpointsID)
+			acctest.PreCheckPartitionHasService(t, names.CodeStarConnectionsEndpointID)
 		},
-		ErrorCheck:               acctest.ErrorCheck(t, codestarconnections.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.CodeStarConnectionsEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckConnectionDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -36,11 +39,11 @@ func TestAccCodeStarConnectionsConnection_basic(t *testing.T) {
 				Config: testAccConnectionConfig_basic(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckConnectionExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "id", "codestar-connections", regexp.MustCompile("connection/.+")),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "codestar-connections", regexp.MustCompile("connection/.+")),
-					resource.TestCheckResourceAttr(resourceName, "provider_type", codestarconnections.ProviderTypeBitbucket),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "id", "codestar-connections", regexache.MustCompile("connection/.+")),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "codestar-connections", regexache.MustCompile("connection/.+")),
+					resource.TestCheckResourceAttr(resourceName, "provider_type", string(types.ProviderTypeBitbucket)),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
-					resource.TestCheckResourceAttr(resourceName, "connection_status", codestarconnections.ConnectionStatusPending),
+					resource.TestCheckResourceAttr(resourceName, "connection_status", string(types.ConnectionStatusPending)),
 				),
 			},
 			{
@@ -54,16 +57,16 @@ func TestAccCodeStarConnectionsConnection_basic(t *testing.T) {
 
 func TestAccCodeStarConnectionsConnection_hostARN(t *testing.T) {
 	ctx := acctest.Context(t)
-	var v codestarconnections.Connection
+	var v types.Connection
 	resourceName := "aws_codestarconnections_connection.test"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck: func() {
 			acctest.PreCheck(ctx, t)
-			acctest.PreCheckPartitionHasService(t, codestarconnections.EndpointsID)
+			acctest.PreCheckPartitionHasService(t, names.CodeStarConnectionsEndpointID)
 		},
-		ErrorCheck:               acctest.ErrorCheck(t, codestarconnections.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.CodeStarConnectionsEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckConnectionDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -71,12 +74,12 @@ func TestAccCodeStarConnectionsConnection_hostARN(t *testing.T) {
 				Config: testAccConnectionConfig_hostARN(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckConnectionExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "id", "codestar-connections", regexp.MustCompile("connection/.+")),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "codestar-connections", regexp.MustCompile("connection/.+")),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "host_arn", "codestar-connections", regexp.MustCompile("host/.+")),
-					resource.TestCheckResourceAttr(resourceName, "provider_type", codestarconnections.ProviderTypeGitHubEnterpriseServer),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "id", "codestar-connections", regexache.MustCompile("connection/.+")),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "codestar-connections", regexache.MustCompile("connection/.+")),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "host_arn", "codestar-connections", regexache.MustCompile("host/.+")),
+					resource.TestCheckResourceAttr(resourceName, "provider_type", string(types.ProviderTypeGithubEnterpriseServer)),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
-					resource.TestCheckResourceAttr(resourceName, "connection_status", codestarconnections.ConnectionStatusPending),
+					resource.TestCheckResourceAttr(resourceName, "connection_status", string(types.ConnectionStatusPending)),
 				),
 			},
 			{
@@ -90,16 +93,16 @@ func TestAccCodeStarConnectionsConnection_hostARN(t *testing.T) {
 
 func TestAccCodeStarConnectionsConnection_disappears(t *testing.T) {
 	ctx := acctest.Context(t)
-	var v codestarconnections.Connection
+	var v types.Connection
 	resourceName := "aws_codestarconnections_connection.test"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck: func() {
 			acctest.PreCheck(ctx, t)
-			acctest.PreCheckPartitionHasService(t, codestarconnections.EndpointsID)
+			acctest.PreCheckPartitionHasService(t, names.CodeStarConnectionsEndpointID)
 		},
-		ErrorCheck:               acctest.ErrorCheck(t, codestarconnections.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.CodeStarConnectionsEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckConnectionDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -117,16 +120,16 @@ func TestAccCodeStarConnectionsConnection_disappears(t *testing.T) {
 
 func TestAccCodeStarConnectionsConnection_tags(t *testing.T) {
 	ctx := acctest.Context(t)
-	var v codestarconnections.Connection
+	var v types.Connection
 	resourceName := "aws_codestarconnections_connection.test"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck: func() {
 			acctest.PreCheck(ctx, t)
-			acctest.PreCheckPartitionHasService(t, codestarconnections.EndpointsID)
+			acctest.PreCheckPartitionHasService(t, names.CodeStarConnectionsEndpointID)
 		},
-		ErrorCheck:               acctest.ErrorCheck(t, codestarconnections.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.CodeStarConnectionsEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckConnectionDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -164,18 +167,14 @@ func TestAccCodeStarConnectionsConnection_tags(t *testing.T) {
 	})
 }
 
-func testAccCheckConnectionExists(ctx context.Context, n string, v *codestarconnections.Connection) resource.TestCheckFunc {
+func testAccCheckConnectionExists(ctx context.Context, n string, v *types.Connection) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		rs, ok := s.RootModule().Resources[n]
 		if !ok {
 			return fmt.Errorf("Not found: %s", n)
 		}
 
-		if rs.Primary.ID == "" {
-			return errors.New("No CodeStar Connections Connection ID is set")
-		}
-
-		conn := acctest.Provider.Meta().(*conns.AWSClient).CodeStarConnectionsConn(ctx)
+		conn := acctest.Provider.Meta().(*conns.AWSClient).CodeStarConnectionsClient(ctx)
 
 		output, err := tfcodestarconnections.FindConnectionByARN(ctx, conn, rs.Primary.ID)
 
@@ -191,7 +190,7 @@ func testAccCheckConnectionExists(ctx context.Context, n string, v *codestarconn
 
 func testAccCheckConnectionDestroy(ctx context.Context) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		conn := acctest.Provider.Meta().(*conns.AWSClient).CodeStarConnectionsConn(ctx)
+		conn := acctest.Provider.Meta().(*conns.AWSClient).CodeStarConnectionsClient(ctx)
 
 		for _, rs := range s.RootModule().Resources {
 			if rs.Type != "aws_codestarconnections_connection" {
diff --git a/internal/service/codestarconnections/consts.go b/internal/service/codestarconnections/consts.go
deleted file mode 100644
index 66715de861d..00000000000
--- a/internal/service/codestarconnections/consts.go
+++ /dev/null
@@ -1,5 +0,0 @@
-package codestarconnections
-
-const (
-	ResNameConnection = "Connection"
-)
diff --git a/internal/service/codestarconnections/exports_test.go b/internal/service/codestarconnections/exports_test.go
new file mode 100644
index 00000000000..a6124f7cfe8
--- /dev/null
+++ b/internal/service/codestarconnections/exports_test.go
@@ -0,0 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package codestarconnections
+
+// Exports for use in tests only.
+var (
+	FindConnectionByARN = findConnectionByARN
+	FindHostByARN       = findHostByARN
+
+	ResourceConnection = resourceConnection
+	ResourceHost       = resourceHost
+)
diff --git a/internal/service/codestarconnections/find.go b/internal/service/codestarconnections/find.go
deleted file mode 100644
index 230d442a95b..00000000000
--- a/internal/service/codestarconnections/find.go
+++ /dev/null
@@ -1,61 +0,0 @@
-package codestarconnections
-
-import (
-	"context"
-
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/codestarconnections"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
-	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
-)
-
-func FindConnectionByARN(ctx context.Context, conn *codestarconnections.CodeStarConnections, arn string) (*codestarconnections.Connection, error) {
-	input := &codestarconnections.GetConnectionInput{
-		ConnectionArn: aws.String(arn),
-	}
-
-	output, err := conn.GetConnectionWithContext(ctx, input)
-
-	if tfawserr.ErrCodeEquals(err, codestarconnections.ErrCodeResourceNotFoundException) {
-		return nil, &retry.NotFoundError{
-			LastError:   err,
-			LastRequest: input,
-		}
-	}
-
-	if err != nil {
-		return nil, err
-	}
-
-	if output == nil || output.Connection == nil {
-		return nil, tfresource.NewEmptyResultError(input)
-	}
-
-	return output.Connection, nil
-}
-
-func FindHostByARN(ctx context.Context, conn *codestarconnections.CodeStarConnections, arn string) (*codestarconnections.GetHostOutput, error) {
-	input := &codestarconnections.GetHostInput{
-		HostArn: aws.String(arn),
-	}
-
-	output, err := conn.GetHostWithContext(ctx, input)
-
-	if tfawserr.ErrCodeEquals(err, codestarconnections.ErrCodeResourceNotFoundException) {
-		return nil, &retry.NotFoundError{
-			LastError:   err,
-			LastRequest: input,
-		}
-	}
-
-	if err != nil {
-		return nil, err
-	}
-
-	if output == nil {
-		return nil, tfresource.NewEmptyResultError(input)
-	}
-
-	return output, nil
-}
diff --git a/internal/service/codestarconnections/generate.go b/internal/service/codestarconnections/generate.go
index 594cd8c3dc1..5fd1f8826e1 100644
--- a/internal/service/codestarconnections/generate.go
+++ b/internal/service/codestarconnections/generate.go
@@ -1,4 +1,7 @@
-//go:generate go run ../../generate/tags/main.go -ListTags -ServiceTagsSlice -UpdateTags
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+//go:generate go run ../../generate/tags/main.go -AWSSDKVersion=2 -ListTags -ServiceTagsSlice -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
 
diff --git a/internal/service/codestarconnections/host.go b/internal/service/codestarconnections/host.go
index a7efa351a24..42d80a33b14 100644
--- a/internal/service/codestarconnections/host.go
+++ b/internal/service/codestarconnections/host.go
@@ -1,26 +1,29 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package codestarconnections
 
 import (
 	"context"
-	"errors"
 	"log"
 	"time"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/codestarconnections"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/codestarconnections"
+	"github.com/aws/aws-sdk-go-v2/service/codestarconnections/types"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/enum"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
 	"github.com/hashicorp/terraform-provider-aws/internal/flex"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
-// @SDKResource("aws_codestarconnections_host")
-func ResourceHost() *schema.Resource {
+// @SDKResource("aws_codestarconnections_host", name="Host")
+func resourceHost() *schema.Resource {
 	return &schema.Resource{
 		CreateWithoutTimeout: resourceHostCreate,
 		ReadWithoutTimeout:   resourceHostRead,
@@ -52,10 +55,10 @@ func ResourceHost() *schema.Resource {
 				Required: true,
 			},
 			"provider_type": {
-				Type:         schema.TypeString,
-				Required:     true,
-				ForceNew:     true,
-				ValidateFunc: validation.StringInSlice(codestarconnections.ProviderType_Values(), false),
+				Type:             schema.TypeString,
+				Required:         true,
+				ForceNew:         true,
+				ValidateDiagFunc: enum.Validate[types.ProviderType](),
 			},
 			"status": {
 				Type:     schema.TypeString,
@@ -96,24 +99,23 @@ func ResourceHost() *schema.Resource {
 
 func resourceHostCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).CodeStarConnectionsConn(ctx)
+	conn := meta.(*conns.AWSClient).CodeStarConnectionsClient(ctx)
 
 	name := d.Get("name").(string)
 	input := &codestarconnections.CreateHostInput{
 		Name:             aws.String(name),
 		ProviderEndpoint: aws.String(d.Get("provider_endpoint").(string)),
-		ProviderType:     aws.String(d.Get("provider_type").(string)),
+		ProviderType:     types.ProviderType(d.Get("provider_type").(string)),
 		VpcConfiguration: expandHostVPCConfiguration(d.Get("vpc_configuration").([]interface{})),
 	}
 
-	log.Printf("[DEBUG] Creating CodeStar Connections Host: %s", input)
-	output, err := conn.CreateHostWithContext(ctx, input)
+	output, err := conn.CreateHost(ctx, input)
 
 	if err != nil {
 		return sdkdiag.AppendErrorf(diags, "creating CodeStar Connections Host (%s): %s", name, err)
 	}
 
-	d.SetId(aws.StringValue(output.HostArn))
+	d.SetId(aws.ToString(output.HostArn))
 
 	if _, err := waitHostPendingOrAvailable(ctx, conn, d.Id(), d.Timeout(schema.TimeoutCreate)); err != nil {
 		return sdkdiag.AppendErrorf(diags, "waiting for CodeStar Connections Host (%s) create: %s", d.Id(), err)
@@ -124,9 +126,9 @@ func resourceHostCreate(ctx context.Context, d *schema.ResourceData, meta interf
 
 func resourceHostRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).CodeStarConnectionsConn(ctx)
+	conn := meta.(*conns.AWSClient).CodeStarConnectionsClient(ctx)
 
-	output, err := FindHostByARN(ctx, conn, d.Id())
+	output, err := findHostByARN(ctx, conn, d.Id())
 
 	if !d.IsNewResource() && tfresource.NotFound(err) {
 		log.Printf("[WARN] CodeStar Connections Host (%s) not found, removing from state", d.Id())
@@ -143,14 +145,16 @@ func resourceHostRead(ctx context.Context, d *schema.ResourceData, meta interfac
 	d.Set("provider_endpoint", output.ProviderEndpoint)
 	d.Set("provider_type", output.ProviderType)
 	d.Set("status", output.Status)
-	d.Set("vpc_configuration", flattenHostVPCConfiguration(output.VpcConfiguration))
+	if err := d.Set("vpc_configuration", flattenHostVPCConfiguration(output.VpcConfiguration)); err != nil {
+		return sdkdiag.AppendErrorf(diags, "setting vpc_configuration: %s", err)
+	}
 
 	return diags
 }
 
 func resourceHostUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).CodeStarConnectionsConn(ctx)
+	conn := meta.(*conns.AWSClient).CodeStarConnectionsClient(ctx)
 
 	if d.HasChanges("provider_endpoint", "vpc_configuration") {
 		input := &codestarconnections.UpdateHostInput{
@@ -159,7 +163,7 @@ func resourceHostUpdate(ctx context.Context, d *schema.ResourceData, meta interf
 			VpcConfiguration: expandHostVPCConfiguration(d.Get("vpc_configuration").([]interface{})),
 		}
 
-		_, err := conn.UpdateHostWithContext(ctx, input)
+		_, err := conn.UpdateHost(ctx, input)
 
 		if err != nil {
 			return sdkdiag.AppendErrorf(diags, "updating CodeStar Connections Host (%s): %s", d.Id(), err)
@@ -175,14 +179,14 @@ func resourceHostUpdate(ctx context.Context, d *schema.ResourceData, meta interf
 
 func resourceHostDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).CodeStarConnectionsConn(ctx)
+	conn := meta.(*conns.AWSClient).CodeStarConnectionsClient(ctx)
 
 	log.Printf("[DEBUG] Deleting CodeStar Connections Host: %s", d.Id())
-	_, err := conn.DeleteHostWithContext(ctx, &codestarconnections.DeleteHostInput{
+	_, err := conn.DeleteHost(ctx, &codestarconnections.DeleteHostInput{
 		HostArn: aws.String(d.Id()),
 	})
 
-	if tfawserr.ErrCodeEquals(err, codestarconnections.ErrCodeResourceNotFoundException) {
+	if errs.IsA[*types.ResourceNotFoundException](err) {
 		return diags
 	}
 
@@ -193,16 +197,16 @@ func resourceHostDelete(ctx context.Context, d *schema.ResourceData, meta interf
 	return diags
 }
 
-func expandHostVPCConfiguration(l []interface{}) *codestarconnections.VpcConfiguration {
+func expandHostVPCConfiguration(l []interface{}) *types.VpcConfiguration {
 	if len(l) == 0 || l[0] == nil {
 		return nil
 	}
 
 	m := l[0].(map[string]interface{})
 
-	vc := &codestarconnections.VpcConfiguration{
-		SecurityGroupIds: flex.ExpandStringSet(m["security_group_ids"].(*schema.Set)),
-		SubnetIds:        flex.ExpandStringSet(m["subnet_ids"].(*schema.Set)),
+	vc := &types.VpcConfiguration{
+		SecurityGroupIds: flex.ExpandStringValueSet(m["security_group_ids"].(*schema.Set)),
+		SubnetIds:        flex.ExpandStringValueSet(m["subnet_ids"].(*schema.Set)),
 		VpcId:            aws.String(m["vpc_id"].(string)),
 	}
 
@@ -213,27 +217,52 @@ func expandHostVPCConfiguration(l []interface{}) *codestarconnections.VpcConfigu
 	return vc
 }
 
-func flattenHostVPCConfiguration(vpcConfig *codestarconnections.VpcConfiguration) []interface{} {
+func flattenHostVPCConfiguration(vpcConfig *types.VpcConfiguration) []interface{} {
 	if vpcConfig == nil {
 		return []interface{}{}
 	}
 
 	m := map[string]interface{}{
-		"security_group_ids": flex.FlattenStringSet(vpcConfig.SecurityGroupIds),
-		"subnet_ids":         flex.FlattenStringSet(vpcConfig.SubnetIds),
-		"vpc_id":             aws.StringValue(vpcConfig.VpcId),
+		"security_group_ids": vpcConfig.SecurityGroupIds,
+		"subnet_ids":         vpcConfig.SubnetIds,
+		"vpc_id":             aws.ToString(vpcConfig.VpcId),
 	}
 
 	if vpcConfig.TlsCertificate != nil {
-		m["tls_certificate"] = aws.StringValue(vpcConfig.TlsCertificate)
+		m["tls_certificate"] = aws.ToString(vpcConfig.TlsCertificate)
 	}
 
 	return []interface{}{m}
 }
 
-func statusHost(ctx context.Context, conn *codestarconnections.CodeStarConnections, arn string) retry.StateRefreshFunc {
+func findHostByARN(ctx context.Context, conn *codestarconnections.Client, arn string) (*codestarconnections.GetHostOutput, error) {
+	input := &codestarconnections.GetHostInput{
+		HostArn: aws.String(arn),
+	}
+
+	output, err := conn.GetHost(ctx, input)
+
+	if errs.IsA[*types.ResourceNotFoundException](err) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	if output == nil {
+		return nil, tfresource.NewEmptyResultError(input)
+	}
+
+	return output, nil
+}
+
+func statusHost(ctx context.Context, conn *codestarconnections.Client, arn string) retry.StateRefreshFunc {
 	return func() (interface{}, string, error) {
-		output, err := FindHostByARN(ctx, conn, arn)
+		output, err := findHostByARN(ctx, conn, arn)
 
 		if tfresource.NotFound(err) {
 			return nil, "", nil
@@ -243,7 +272,7 @@ func statusHost(ctx context.Context, conn *codestarconnections.CodeStarConnectio
 			return nil, "", err
 		}
 
-		return output, aws.StringValue(output.Status), nil
+		return output, aws.ToString(output.Status), nil
 	}
 }
 
@@ -255,7 +284,7 @@ const (
 	hostStatusVPCConfigInitializing = "VPC_CONFIG_INITIALIZING"
 )
 
-func waitHostPendingOrAvailable(ctx context.Context, conn *codestarconnections.CodeStarConnections, arn string, timeout time.Duration) (*codestarconnections.Host, error) { //nolint:unparam
+func waitHostPendingOrAvailable(ctx context.Context, conn *codestarconnections.Client, arn string, timeout time.Duration) (*codestarconnections.GetHostOutput, error) { //nolint:unparam
 	stateConf := &retry.StateChangeConf{
 		Pending: []string{hostStatusVPCConfigInitializing},
 		Target:  []string{hostStatusAvailable, hostStatusPending},
@@ -265,9 +294,7 @@ func waitHostPendingOrAvailable(ctx context.Context, conn *codestarconnections.C
 
 	outputRaw, err := stateConf.WaitForStateContext(ctx)
 
-	if output, ok := outputRaw.(*codestarconnections.Host); ok {
-		tfresource.SetLastError(err, errors.New(aws.StringValue(output.StatusMessage)))
-
+	if output, ok := outputRaw.(*codestarconnections.GetHostOutput); ok {
 		return output, err
 	}
 
diff --git a/internal/service/codestarconnections/host_test.go b/internal/service/codestarconnections/host_test.go
index 5011b1244b4..825bb14b08a 100644
--- a/internal/service/codestarconnections/host_test.go
+++ b/internal/service/codestarconnections/host_test.go
@@ -1,13 +1,16 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package codestarconnections_test
 
 import (
 	"context"
-	"errors"
 	"fmt"
-	"regexp"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/service/codestarconnections"
+	"github.com/YakDriver/regexache"
+	"github.com/aws/aws-sdk-go-v2/service/codestarconnections"
+	"github.com/aws/aws-sdk-go-v2/service/codestarconnections/types"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
@@ -15,6 +18,7 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	tfcodestarconnections "github.com/hashicorp/terraform-provider-aws/internal/service/codestarconnections"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
 func TestAccCodeStarConnectionsHost_basic(t *testing.T) {
@@ -26,9 +30,9 @@ func TestAccCodeStarConnectionsHost_basic(t *testing.T) {
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck: func() {
 			acctest.PreCheck(ctx, t)
-			acctest.PreCheckPartitionHasService(t, codestarconnections.EndpointsID)
+			acctest.PreCheckPartitionHasService(t, names.CodeStarConnectionsEndpointID)
 		},
-		ErrorCheck:               acctest.ErrorCheck(t, codestarconnections.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.CodeStarConnectionsEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckHostDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -36,11 +40,11 @@ func TestAccCodeStarConnectionsHost_basic(t *testing.T) {
 				Config: testAccHostConfig_basic(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckHostExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "id", "codestar-connections", regexp.MustCompile("host/.+")),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "codestar-connections", regexp.MustCompile("host/.+")),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "id", "codestar-connections", regexache.MustCompile("host/.+")),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "codestar-connections", regexache.MustCompile("host/.+")),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "provider_endpoint", "https://example.com"),
-					resource.TestCheckResourceAttr(resourceName, "provider_type", codestarconnections.ProviderTypeGitHubEnterpriseServer),
+					resource.TestCheckResourceAttr(resourceName, "provider_type", string(types.ProviderTypeGithubEnterpriseServer)),
 				),
 			},
 			{
@@ -61,9 +65,9 @@ func TestAccCodeStarConnectionsHost_disappears(t *testing.T) {
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck: func() {
 			acctest.PreCheck(ctx, t)
-			acctest.PreCheckPartitionHasService(t, codestarconnections.EndpointsID)
+			acctest.PreCheckPartitionHasService(t, names.CodeStarConnectionsEndpointID)
 		},
-		ErrorCheck:               acctest.ErrorCheck(t, codestarconnections.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.CodeStarConnectionsEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckHostDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -88,9 +92,9 @@ func TestAccCodeStarConnectionsHost_vpc(t *testing.T) {
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck: func() {
 			acctest.PreCheck(ctx, t)
-			acctest.PreCheckPartitionHasService(t, codestarconnections.EndpointsID)
+			acctest.PreCheckPartitionHasService(t, names.CodeStarConnectionsEndpointID)
 		},
-		ErrorCheck:               acctest.ErrorCheck(t, codestarconnections.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.CodeStarConnectionsEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckHostDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -98,11 +102,11 @@ func TestAccCodeStarConnectionsHost_vpc(t *testing.T) {
 				Config: testAccHostConfig_vpc(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckHostExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "id", "codestar-connections", regexp.MustCompile("host/.+")),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "codestar-connections", regexp.MustCompile("host/.+")),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "id", "codestar-connections", regexache.MustCompile("host/.+")),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "codestar-connections", regexache.MustCompile("host/.+")),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "provider_endpoint", "https://example.com"),
-					resource.TestCheckResourceAttr(resourceName, "provider_type", codestarconnections.ProviderTypeGitHubEnterpriseServer),
+					resource.TestCheckResourceAttr(resourceName, "provider_type", string(types.ProviderTypeGithubEnterpriseServer)),
 					resource.TestCheckResourceAttr(resourceName, "vpc_configuration.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "vpc_configuration.0.security_group_ids.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "vpc_configuration.0.subnet_ids.#", "2"),
@@ -126,11 +130,7 @@ func testAccCheckHostExists(ctx context.Context, n string, v *codestarconnection
 			return fmt.Errorf("Not found: %s", n)
 		}
 
-		if rs.Primary.ID == "" {
-			return errors.New("No CodeStar Connections Host ID is set")
-		}
-
-		conn := acctest.Provider.Meta().(*conns.AWSClient).CodeStarConnectionsConn(ctx)
+		conn := acctest.Provider.Meta().(*conns.AWSClient).CodeStarConnectionsClient(ctx)
 
 		output, err := tfcodestarconnections.FindHostByARN(ctx, conn, rs.Primary.ID)
 
@@ -146,7 +146,7 @@ func testAccCheckHostExists(ctx context.Context, n string, v *codestarconnection
 
 func testAccCheckHostDestroy(ctx context.Context) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		conn := acctest.Provider.Meta().(*conns.AWSClient).CodeStarConnectionsConn(ctx)
+		conn := acctest.Provider.Meta().(*conns.AWSClient).CodeStarConnectionsClient(ctx)
 
 		for _, rs := range s.RootModule().Resources {
 			if rs.Type != "aws_codestarconnections_host" {
@@ -171,19 +171,12 @@ func testAccCheckHostDestroy(ctx context.Context) resource.TestCheckFunc {
 }
 
 func testAccHostVPCBaseConfig(rName string) string {
-	return fmt.Sprintf(`
-data "aws_availability_zones" "available" {
-  state = "available"
-  filter {
-    name   = "opt-in-status"
-    values = ["opt-in-not-required"]
-  }
-}
-
+	return acctest.ConfigCompose(acctest.ConfigAvailableAZsNoOptIn(), fmt.Sprintf(`
 resource "aws_vpc" "test" {
   cidr_block           = "10.0.0.0/16"
   enable_dns_hostnames = true
   enable_dns_support   = true
+
   tags = {
     Name = %[1]q
   }
@@ -194,13 +187,16 @@ resource "aws_subnet" "test" {
   availability_zone = data.aws_availability_zones.available.names[count.index]
   cidr_block        = cidrsubnet(aws_vpc.test.cidr_block, 8, count.index + 2)
   vpc_id            = aws_vpc.test.id
+
   tags = {
-    Name = "%[1]s-${count.index}"
+    Name = %[1]q
   }
 }
 
 resource "aws_security_group" "test" {
+  name   = %[1]q
   vpc_id = aws_vpc.test.id
+
   egress {
     from_port   = 0
     to_port     = 0
@@ -213,11 +209,12 @@ resource "aws_security_group" "test" {
     protocol    = "-1"
     cidr_blocks = ["0.0.0.0/0"]
   }
+
   tags = {
     Name = %[1]q
   }
 }
-`, rName)
+`, rName))
 }
 
 func testAccHostConfig_basic(rName string) string {
@@ -231,9 +228,7 @@ resource "aws_codestarconnections_host" "test" {
 }
 
 func testAccHostConfig_vpc(rName string) string {
-	return acctest.ConfigCompose(
-		testAccHostVPCBaseConfig(rName),
-		fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccHostVPCBaseConfig(rName), fmt.Sprintf(`
 resource "aws_codestarconnections_host" "test" {
   name              = %[1]q
   provider_endpoint = "https://example.com"
diff --git a/internal/service/codestarconnections/service_package_gen.go b/internal/service/codestarconnections/service_package_gen.go
index 0fbba91819b..b68169e1fb8 100644
--- a/internal/service/codestarconnections/service_package_gen.go
+++ b/internal/service/codestarconnections/service_package_gen.go
@@ -5,9 +5,9 @@ package codestarconnections
 import (
 	"context"
 
-	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
-	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
-	codestarconnections_sdkv1 "github.com/aws/aws-sdk-go/service/codestarconnections"
+	aws_sdkv2 "github.com/aws/aws-sdk-go-v2/aws"
+	codestarconnections_sdkv2 "github.com/aws/aws-sdk-go-v2/service/codestarconnections"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -25,7 +25,7 @@ func (p *servicePackage) FrameworkResources(ctx context.Context) []*types.Servic
 func (p *servicePackage) SDKDataSources(ctx context.Context) []*types.ServicePackageSDKDataSource {
 	return []*types.ServicePackageSDKDataSource{
 		{
-			Factory:  DataSourceConnection,
+			Factory:  dataSourceConnection,
 			TypeName: "aws_codestarconnections_connection",
 		},
 	}
@@ -34,7 +34,7 @@ func (p *servicePackage) SDKDataSources(ctx context.Context) []*types.ServicePac
 func (p *servicePackage) SDKResources(ctx context.Context) []*types.ServicePackageSDKResource {
 	return []*types.ServicePackageSDKResource{
 		{
-			Factory:  ResourceConnection,
+			Factory:  resourceConnection,
 			TypeName: "aws_codestarconnections_connection",
 			Name:     "Connection",
 			Tags: &types.ServicePackageResourceTags{
@@ -42,8 +42,9 @@ func (p *servicePackage) SDKResources(ctx context.Context) []*types.ServicePacka
 			},
 		},
 		{
-			Factory:  ResourceHost,
+			Factory:  resourceHost,
 			TypeName: "aws_codestarconnections_host",
+			Name:     "Host",
 		},
 	}
 }
@@ -52,11 +53,17 @@ func (p *servicePackage) ServicePackageName() string {
 	return names.CodeStarConnections
 }
 
-// NewConn returns a new AWS SDK for Go v1 client for this service package's AWS API.
-func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*codestarconnections_sdkv1.CodeStarConnections, error) {
-	sess := config["session"].(*session_sdkv1.Session)
+// NewClient returns a new AWS SDK for Go v2 client for this service package's AWS API.
+func (p *servicePackage) NewClient(ctx context.Context, config map[string]any) (*codestarconnections_sdkv2.Client, error) {
+	cfg := *(config["aws_sdkv2_config"].(*aws_sdkv2.Config))
 
-	return codestarconnections_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
+	return codestarconnections_sdkv2.NewFromConfig(cfg, func(o *codestarconnections_sdkv2.Options) {
+		if endpoint := config["endpoint"].(string); endpoint != "" {
+			o.BaseEndpoint = aws_sdkv2.String(endpoint)
+		}
+	}), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/codestarconnections/sweep.go b/internal/service/codestarconnections/sweep.go
index 14c34883f28..8afd0db8a5c 100644
--- a/internal/service/codestarconnections/sweep.go
+++ b/internal/service/codestarconnections/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package codestarconnections
 
@@ -7,13 +7,15 @@ import (
 	"fmt"
 	"log"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/codestarconnections"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/codestarconnections"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv2"
+	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_codestarconnections_connection", &resource.Sweeper{
 		Name: "aws_codestarconnections_connection",
 		F:    sweepConnections,
@@ -30,40 +32,41 @@ func init() {
 
 func sweepConnections(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	if region == names.USGovEast1RegionID || region == names.USGovWest1RegionID {
+		log.Printf("[WARN] Skipping CodeStar Connections Connection sweep for region: %s", region)
+		return nil
+	}
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
-	conn := client.CodeStarConnectionsConn(ctx)
+	conn := client.CodeStarConnectionsClient(ctx)
 	input := &codestarconnections.ListConnectionsInput{}
 	sweepResources := make([]sweep.Sweepable, 0)
 
-	err = conn.ListConnectionsPagesWithContext(ctx, input, func(page *codestarconnections.ListConnectionsOutput, lastPage bool) bool {
-		if page == nil {
-			return !lastPage
+	pages := codestarconnections.NewListConnectionsPaginator(conn, input)
+	for pages.HasMorePages() {
+		page, err := pages.NextPage(ctx)
+
+		if awsv2.SkipSweepError(err) {
+			log.Printf("[WARN] Skipping CodeStar Connections Connection sweep for %s: %s", region, err)
+			return nil
+		}
+
+		if err != nil {
+			return fmt.Errorf("error listing CodeStar Connections Connections (%s): %w", region, err)
 		}
 
 		for _, v := range page.Connections {
-			r := ResourceConnection()
+			r := resourceConnection()
 			d := r.Data(nil)
-			d.SetId(aws.StringValue(v.ConnectionArn))
+			d.SetId(aws.ToString(v.ConnectionArn))
 
 			sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
 		}
-
-		return !lastPage
-	})
-
-	if sweep.SkipSweepError(err) {
-		log.Printf("[WARN] Skipping CodeStar Connections Connection sweep for %s: %s", region, err)
-		return nil
-	}
-
-	if err != nil {
-		return fmt.Errorf("error listing CodeStar Connections Connections (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping CodeStar Connections Connections (%s): %w", region, err)
@@ -74,40 +77,41 @@ func sweepConnections(region string) error {
 
 func sweepHosts(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	if region == names.USGovEast1RegionID || region == names.USGovWest1RegionID {
+		log.Printf("[WARN] Skipping CodeStar Connections Host sweep for region: %s", region)
+		return nil
+	}
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
-	conn := client.CodeStarConnectionsConn(ctx)
+	conn := client.CodeStarConnectionsClient(ctx)
 	input := &codestarconnections.ListHostsInput{}
 	sweepResources := make([]sweep.Sweepable, 0)
 
-	err = conn.ListHostsPagesWithContext(ctx, input, func(page *codestarconnections.ListHostsOutput, lastPage bool) bool {
-		if page == nil {
-			return !lastPage
+	pages := codestarconnections.NewListHostsPaginator(conn, input)
+	for pages.HasMorePages() {
+		page, err := pages.NextPage(ctx)
+
+		if awsv2.SkipSweepError(err) {
+			log.Printf("[WARN] Skipping CodeStar Connections Host sweep for %s: %s", region, err)
+			return nil
+		}
+
+		if err != nil {
+			return fmt.Errorf("error listing CodeStar Connections Hosts (%s): %w", region, err)
 		}
 
 		for _, v := range page.Hosts {
-			r := ResourceHost()
+			r := resourceHost()
 			d := r.Data(nil)
-			d.SetId(aws.StringValue(v.HostArn))
+			d.SetId(aws.ToString(v.HostArn))
 
 			sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
 		}
-
-		return !lastPage
-	})
-
-	if sweep.SkipSweepError(err) {
-		log.Printf("[WARN] Skipping CodeStar Connections Host sweep for %s: %s", region, err)
-		return nil
-	}
-
-	if err != nil {
-		return fmt.Errorf("error listing CodeStar Connections Hosts (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping CodeStar Connections Hosts (%s): %w", region, err)
diff --git a/internal/service/codestarconnections/tags_gen.go b/internal/service/codestarconnections/tags_gen.go
index bd31a0e5d23..fe6fd88e3dc 100644
--- a/internal/service/codestarconnections/tags_gen.go
+++ b/internal/service/codestarconnections/tags_gen.go
@@ -5,10 +5,12 @@ import (
 	"context"
 	"fmt"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/codestarconnections"
-	"github.com/aws/aws-sdk-go/service/codestarconnections/codestarconnectionsiface"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/codestarconnections"
+	awstypes "github.com/aws/aws-sdk-go-v2/service/codestarconnections/types"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -17,12 +19,12 @@ import (
 // listTags lists codestarconnections service tags.
 // The identifier is typically the Amazon Resource Name (ARN), although
 // it may also be a different identifier depending on the service.
-func listTags(ctx context.Context, conn codestarconnectionsiface.CodeStarConnectionsAPI, identifier string) (tftags.KeyValueTags, error) {
+func listTags(ctx context.Context, conn *codestarconnections.Client, identifier string) (tftags.KeyValueTags, error) {
 	input := &codestarconnections.ListTagsForResourceInput{
 		ResourceArn: aws.String(identifier),
 	}
 
-	output, err := conn.ListTagsForResourceWithContext(ctx, input)
+	output, err := conn.ListTagsForResource(ctx, input)
 
 	if err != nil {
 		return tftags.New(ctx, nil), err
@@ -34,7 +36,7 @@ func listTags(ctx context.Context, conn codestarconnectionsiface.CodeStarConnect
 // ListTags lists codestarconnections service tags and set them in Context.
 // It is called from outside this package.
 func (p *servicePackage) ListTags(ctx context.Context, meta any, identifier string) error {
-	tags, err := listTags(ctx, meta.(*conns.AWSClient).CodeStarConnectionsConn(ctx), identifier)
+	tags, err := listTags(ctx, meta.(*conns.AWSClient).CodeStarConnectionsClient(ctx), identifier)
 
 	if err != nil {
 		return err
@@ -50,11 +52,11 @@ func (p *servicePackage) ListTags(ctx context.Context, meta any, identifier stri
 // []*SERVICE.Tag handling
 
 // Tags returns codestarconnections service tags.
-func Tags(tags tftags.KeyValueTags) []*codestarconnections.Tag {
-	result := make([]*codestarconnections.Tag, 0, len(tags))
+func Tags(tags tftags.KeyValueTags) []awstypes.Tag {
+	result := make([]awstypes.Tag, 0, len(tags))
 
 	for k, v := range tags.Map() {
-		tag := &codestarconnections.Tag{
+		tag := awstypes.Tag{
 			Key:   aws.String(k),
 			Value: aws.String(v),
 		}
@@ -66,11 +68,11 @@ func Tags(tags tftags.KeyValueTags) []*codestarconnections.Tag {
 }
 
 // KeyValueTags creates tftags.KeyValueTags from codestarconnections service tags.
-func KeyValueTags(ctx context.Context, tags []*codestarconnections.Tag) tftags.KeyValueTags {
+func KeyValueTags(ctx context.Context, tags []awstypes.Tag) tftags.KeyValueTags {
 	m := make(map[string]*string, len(tags))
 
 	for _, tag := range tags {
-		m[aws.StringValue(tag.Key)] = tag.Value
+		m[aws.ToString(tag.Key)] = tag.Value
 	}
 
 	return tftags.New(ctx, m)
@@ -78,7 +80,7 @@ func KeyValueTags(ctx context.Context, tags []*codestarconnections.Tag) tftags.K
 
 // getTagsIn returns codestarconnections service tags from Context.
 // nil is returned if there are no input tags.
-func getTagsIn(ctx context.Context) []*codestarconnections.Tag {
+func getTagsIn(ctx context.Context) []awstypes.Tag {
 	if inContext, ok := tftags.FromContext(ctx); ok {
 		if tags := Tags(inContext.TagsIn.UnwrapOrDefault()); len(tags) > 0 {
 			return tags
@@ -89,7 +91,7 @@ func getTagsIn(ctx context.Context) []*codestarconnections.Tag {
 }
 
 // setTagsOut sets codestarconnections service tags in Context.
-func setTagsOut(ctx context.Context, tags []*codestarconnections.Tag) {
+func setTagsOut(ctx context.Context, tags []awstypes.Tag) {
 	if inContext, ok := tftags.FromContext(ctx); ok {
 		inContext.TagsOut = types.Some(KeyValueTags(ctx, tags))
 	}
@@ -98,19 +100,21 @@ func setTagsOut(ctx context.Context, tags []*codestarconnections.Tag) {
 // updateTags updates codestarconnections service tags.
 // The identifier is typically the Amazon Resource Name (ARN), although
 // it may also be a different identifier depending on the service.
-func updateTags(ctx context.Context, conn codestarconnectionsiface.CodeStarConnectionsAPI, identifier string, oldTagsMap, newTagsMap any) error {
+func updateTags(ctx context.Context, conn *codestarconnections.Client, identifier string, oldTagsMap, newTagsMap any) error {
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.CodeStarConnections)
 	if len(removedTags) > 0 {
 		input := &codestarconnections.UntagResourceInput{
 			ResourceArn: aws.String(identifier),
-			TagKeys:     aws.StringSlice(removedTags.Keys()),
+			TagKeys:     removedTags.Keys(),
 		}
 
-		_, err := conn.UntagResourceWithContext(ctx, input)
+		_, err := conn.UntagResource(ctx, input)
 
 		if err != nil {
 			return fmt.Errorf("untagging resource (%s): %w", identifier, err)
@@ -125,7 +129,7 @@ func updateTags(ctx context.Context, conn codestarconnectionsiface.CodeStarConne
 			Tags:        Tags(updatedTags),
 		}
 
-		_, err := conn.TagResourceWithContext(ctx, input)
+		_, err := conn.TagResource(ctx, input)
 
 		if err != nil {
 			return fmt.Errorf("tagging resource (%s): %w", identifier, err)
@@ -138,5 +142,5 @@ func updateTags(ctx context.Context, conn codestarconnectionsiface.CodeStarConne
 // UpdateTags updates codestarconnections service tags.
 // It is called from outside this package.
 func (p *servicePackage) UpdateTags(ctx context.Context, meta any, identifier string, oldTags, newTags any) error {
-	return updateTags(ctx, meta.(*conns.AWSClient).CodeStarConnectionsConn(ctx), identifier, oldTags, newTags)
+	return updateTags(ctx, meta.(*conns.AWSClient).CodeStarConnectionsClient(ctx), identifier, oldTags, newTags)
 }
diff --git a/internal/service/codestarnotifications/consts.go b/internal/service/codestarnotifications/consts.go
index 00a48ab6f3f..b5f158297d0 100644
--- a/internal/service/codestarnotifications/consts.go
+++ b/internal/service/codestarnotifications/consts.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package codestarnotifications
 
 const (
diff --git a/internal/service/codestarnotifications/exports_test.go b/internal/service/codestarnotifications/exports_test.go
new file mode 100644
index 00000000000..bf690edf787
--- /dev/null
+++ b/internal/service/codestarnotifications/exports_test.go
@@ -0,0 +1,11 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package codestarnotifications
+
+// Exports for use in tests only.
+var (
+	FindNotificationRuleByARN = findNotificationRuleByARN
+
+	ResourceNotificationRule = resourceNotificationRule
+)
diff --git a/internal/service/codestarnotifications/generate.go b/internal/service/codestarnotifications/generate.go
index 2141935cf7d..eaabbf749aa 100644
--- a/internal/service/codestarnotifications/generate.go
+++ b/internal/service/codestarnotifications/generate.go
@@ -1,4 +1,7 @@
-//go:generate go run ../../generate/tags/main.go -ListTags -ListTagsInIDElem=Arn -ServiceTagsMap -TagInIDElem=Arn -UpdateTags
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+//go:generate go run ../../generate/tags/main.go -AWSSDKVersion=2 -KVTValues -SkipTypesImp -ListTags -ListTagsInIDElem=Arn -ServiceTagsMap -TagInIDElem=Arn -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
 
diff --git a/internal/service/codestarnotifications/notification_rule.go b/internal/service/codestarnotifications/notification_rule.go
index 0a7a5c88ddc..c02d4c2d933 100644
--- a/internal/service/codestarnotifications/notification_rule.go
+++ b/internal/service/codestarnotifications/notification_rule.go
@@ -1,40 +1,43 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package codestarnotifications
 
 import (
 	"context"
-	"regexp"
+	"log"
 	"time"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/codestarnotifications"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/YakDriver/regexache"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/codestarnotifications"
+	"github.com/aws/aws-sdk-go-v2/service/codestarnotifications/types"
+	"github.com/hashicorp/aws-sdk-go-base/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
-	"github.com/hashicorp/terraform-provider-aws/internal/create"
+	"github.com/hashicorp/terraform-provider-aws/internal/enum"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
 	"github.com/hashicorp/terraform-provider-aws/internal/flex"
+	tfslices "github.com/hashicorp/terraform-provider-aws/internal/slices"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
-const (
-	// Maximum amount of time to wait for target subscriptions to propagate
-	targetSubscriptionTimeout = 30 * time.Second
-)
-
 // @SDKResource("aws_codestarnotifications_notification_rule", name="Notification Rule")
 // @Tags(identifierAttribute="id")
-func ResourceNotificationRule() *schema.Resource {
+func resourceNotificationRule() *schema.Resource {
 	return &schema.Resource{
 		CreateWithoutTimeout: resourceNotificationRuleCreate,
 		ReadWithoutTimeout:   resourceNotificationRuleRead,
 		UpdateWithoutTimeout: resourceNotificationRuleUpdate,
 		DeleteWithoutTimeout: resourceNotificationRuleDelete,
+
 		Importer: &schema.ResourceImporter{
 			StateContext: schema.ImportStatePassthroughContext,
 		},
@@ -44,53 +47,40 @@ func ResourceNotificationRule() *schema.Resource {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
-
 			"detail_type": {
-				Type:     schema.TypeString,
-				Required: true,
-				ValidateFunc: validation.StringInSlice([]string{
-					codestarnotifications.DetailTypeBasic,
-					codestarnotifications.DetailTypeFull,
-				}, false),
+				Type:             schema.TypeString,
+				Required:         true,
+				ValidateDiagFunc: enum.Validate[types.DetailType](),
 			},
-
 			"event_type_ids": {
 				Type:     schema.TypeSet,
 				Required: true,
-				Elem:     &schema.Schema{Type: schema.TypeString},
 				MinItems: 1,
 				MaxItems: 200,
+				Elem:     &schema.Schema{Type: schema.TypeString},
 			},
-
 			"name": {
 				Type:     schema.TypeString,
 				Required: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 64),
-					validation.StringMatch(regexp.MustCompile(`^[A-Za-z0-9\-_ ]+$`), "must be one or more alphanumeric, hyphen, underscore or space characters"),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_ -]+$`), "must be one or more alphanumeric, hyphen, underscore or space characters"),
 				),
 			},
-
 			"resource": {
 				Type:         schema.TypeString,
 				Required:     true,
 				ForceNew:     true,
 				ValidateFunc: verify.ValidARN,
 			},
-
 			"status": {
-				Type:     schema.TypeString,
-				Optional: true,
-				Default:  codestarnotifications.NotificationRuleStatusEnabled,
-				ValidateFunc: validation.StringInSlice([]string{
-					codestarnotifications.NotificationRuleStatusEnabled,
-					codestarnotifications.NotificationRuleStatusDisabled,
-				}, false),
+				Type:             schema.TypeString,
+				Optional:         true,
+				Default:          types.NotificationRuleStatusEnabled,
+				ValidateDiagFunc: enum.Validate[types.NotificationRuleStatus](),
 			},
-
 			names.AttrTags:    tftags.TagsSchema(),
 			names.AttrTagsAll: tftags.TagsSchemaComputed(),
-
 			"target": {
 				Type:     schema.TypeSet,
 				Optional: true,
@@ -102,15 +92,15 @@ func ResourceNotificationRule() *schema.Resource {
 							Required:     true,
 							ValidateFunc: verify.ValidARN,
 						},
+						"status": {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
 						"type": {
 							Type:     schema.TypeString,
 							Default:  "SNS",
 							Optional: true,
 						},
-						"status": {
-							Type:     schema.TypeString,
-							Computed: true,
-						},
 					},
 				},
 			},
@@ -120,165 +110,96 @@ func ResourceNotificationRule() *schema.Resource {
 	}
 }
 
-func expandNotificationRuleTargets(targetsData []interface{}) []*codestarnotifications.Target {
-	targets := make([]*codestarnotifications.Target, 0, len(targetsData))
-	for _, t := range targetsData {
-		target := t.(map[string]interface{})
-		targets = append(targets, &codestarnotifications.Target{
-			TargetAddress: aws.String(target["address"].(string)),
-			TargetType:    aws.String(target["type"].(string)),
-		})
-	}
-	return targets
-}
-
 func resourceNotificationRuleCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).CodeStarNotificationsConn(ctx)
+	conn := meta.(*conns.AWSClient).CodeStarNotificationsClient(ctx)
 
+	name := d.Get("name").(string)
 	input := &codestarnotifications.CreateNotificationRuleInput{
-		DetailType:   aws.String(d.Get("detail_type").(string)),
-		EventTypeIds: flex.ExpandStringSet(d.Get("event_type_ids").(*schema.Set)),
-		Name:         aws.String(d.Get("name").(string)),
+		DetailType:   types.DetailType(d.Get("detail_type").(string)),
+		EventTypeIds: flex.ExpandStringValueSet(d.Get("event_type_ids").(*schema.Set)),
+		Name:         aws.String(name),
 		Resource:     aws.String(d.Get("resource").(string)),
-		Status:       aws.String(d.Get("status").(string)),
+		Status:       types.NotificationRuleStatus(d.Get("status").(string)),
 		Tags:         getTagsIn(ctx),
 		Targets:      expandNotificationRuleTargets(d.Get("target").(*schema.Set).List()),
 	}
 
-	res, err := conn.CreateNotificationRuleWithContext(ctx, input)
+	output, err := conn.CreateNotificationRule(ctx, input)
+
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "creating CodeStar Notification Rule: %s", err)
+		return sdkdiag.AppendErrorf(diags, "creating CodeStar Notification Rule (%s): %s", name, err)
 	}
 
-	d.SetId(aws.StringValue(res.Arn))
+	d.SetId(aws.ToString(output.Arn))
 
 	return append(diags, resourceNotificationRuleRead(ctx, d, meta)...)
 }
 
 func resourceNotificationRuleRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).CodeStarNotificationsConn(ctx)
+	conn := meta.(*conns.AWSClient).CodeStarNotificationsClient(ctx)
 
-	rule, err := conn.DescribeNotificationRuleWithContext(ctx, &codestarnotifications.DescribeNotificationRuleInput{
-		Arn: aws.String(d.Id()),
-	})
+	rule, err := findNotificationRuleByARN(ctx, conn, d.Id())
 
-	if !d.IsNewResource() && tfawserr.ErrCodeEquals(err, codestarnotifications.ErrCodeResourceNotFoundException) {
-		create.LogNotFoundRemoveState(names.CodeStarNotifications, create.ErrActionReading, ResNotificationRule, d.Id())
+	if !d.IsNewResource() && tfresource.NotFound(err) {
+		log.Printf("[WARN] CodeStar Notification Rule (%s) not found, removing from state", d.Id())
 		d.SetId("")
 		return diags
 	}
 
 	if err != nil {
-		return create.DiagError(names.CodeStarNotifications, create.ErrActionReading, ResNotificationRule, d.Id(), err)
+		return sdkdiag.AppendErrorf(diags, "reading CodeStar Notification Rule (%s): %s", d.Id(), err)
 	}
 
 	d.Set("arn", rule.Arn)
 	d.Set("detail_type", rule.DetailType)
-	eventTypeIds := make([]string, 0, len(rule.EventTypes))
-	for _, et := range rule.EventTypes {
-		eventTypeIds = append(eventTypeIds, aws.StringValue(et.EventTypeId))
-	}
-	if err := d.Set("event_type_ids", eventTypeIds); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting event_type_ids: %s", err)
-	}
+	eventTypeIDs := tfslices.ApplyToAll(rule.EventTypes, func(v types.EventTypeSummary) string {
+		return aws.ToString(v.EventTypeId)
+	})
+	d.Set("event_type_ids", eventTypeIDs)
 	d.Set("name", rule.Name)
-	d.Set("status", rule.Status)
 	d.Set("resource", rule.Resource)
-
-	setTagsOut(ctx, rule.Tags)
+	d.Set("status", rule.Status)
 
 	targets := make([]map[string]interface{}, 0, len(rule.Targets))
 	for _, t := range rule.Targets {
 		targets = append(targets, map[string]interface{}{
-			"address": aws.StringValue(t.TargetAddress),
-			"type":    aws.StringValue(t.TargetType),
-			"status":  aws.StringValue(t.TargetStatus),
+			"address": aws.ToString(t.TargetAddress),
+			"type":    aws.ToString(t.TargetType),
+			"status":  t.TargetStatus,
 		})
 	}
-	if err = d.Set("target", targets); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting CodeStar notification target: %s", err)
-	}
-
-	return diags
-}
-
-const notificationRuleErrorSubscribed = "The target cannot be deleted because it is subscribed to one or more notification rules."
-
-// cleanupNotificationRuleTargets tries to remove unused notification targets. AWS API does not
-// provide expicit way for creating targets, they are created on first subscription. Here we are trying to remove all
-// unused targets which were unsubscribed from this notification rule.
-func cleanupNotificationRuleTargets(ctx context.Context, conn *codestarnotifications.CodeStarNotifications, oldVal *schema.Set, newVal *schema.Set) error {
-	removedTargets := oldVal
-	if newVal != nil {
-		removedTargets = oldVal.Difference(newVal)
+	if err := d.Set("target", targets); err != nil {
+		return sdkdiag.AppendErrorf(diags, "setting target: %s", err)
 	}
 
-	for _, targetRaw := range removedTargets.List() {
-		target, ok := targetRaw.(map[string]interface{})
-
-		if !ok {
-			continue
-		}
-
-		input := &codestarnotifications.DeleteTargetInput{
-			ForceUnsubscribeAll: aws.Bool(false),
-			TargetAddress:       aws.String(target["address"].(string)),
-		}
-
-		err := retry.RetryContext(ctx, targetSubscriptionTimeout, func() *retry.RetryError {
-			_, err := conn.DeleteTargetWithContext(ctx, input)
-
-			if tfawserr.ErrMessageContains(err, codestarnotifications.ErrCodeValidationException, notificationRuleErrorSubscribed) {
-				return retry.RetryableError(err)
-			}
-
-			if err != nil {
-				return retry.NonRetryableError(err)
-			}
-
-			return nil
-		})
-
-		if tfresource.TimedOut(err) {
-			_, err = conn.DeleteTargetWithContext(ctx, input)
-		}
-
-		// Treat target deletion as best effort
-		if tfawserr.ErrMessageContains(err, codestarnotifications.ErrCodeValidationException, notificationRuleErrorSubscribed) {
-			continue
-		}
-
-		if err != nil {
-			return err
-		}
-	}
+	setTagsOut(ctx, rule.Tags)
 
-	return nil
+	return diags
 }
 
 func resourceNotificationRuleUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).CodeStarNotificationsConn(ctx)
+	conn := meta.(*conns.AWSClient).CodeStarNotificationsClient(ctx)
 
 	input := &codestarnotifications.UpdateNotificationRuleInput{
 		Arn:          aws.String(d.Id()),
-		DetailType:   aws.String(d.Get("detail_type").(string)),
-		EventTypeIds: flex.ExpandStringSet(d.Get("event_type_ids").(*schema.Set)),
+		DetailType:   types.DetailType(d.Get("detail_type").(string)),
+		EventTypeIds: flex.ExpandStringValueSet(d.Get("event_type_ids").(*schema.Set)),
 		Name:         aws.String(d.Get("name").(string)),
-		Status:       aws.String(d.Get("status").(string)),
+		Status:       types.NotificationRuleStatus(d.Get("status").(string)),
 		Targets:      expandNotificationRuleTargets(d.Get("target").(*schema.Set).List()),
 	}
 
-	if _, err := conn.UpdateNotificationRuleWithContext(ctx, input); err != nil {
+	if _, err := conn.UpdateNotificationRule(ctx, input); err != nil {
 		return sdkdiag.AppendErrorf(diags, "updating CodeStar Notification Rule (%s): %s", d.Id(), err)
 	}
 
 	if d.HasChange("target") {
 		o, n := d.GetChange("target")
 		if err := cleanupNotificationRuleTargets(ctx, conn, o.(*schema.Set), n.(*schema.Set)); err != nil {
-			return sdkdiag.AppendErrorf(diags, "updating CodeStar Notification Rule (%s): cleaning targets: %s", d.Id(), err)
+			return sdkdiag.AppendErrorf(diags, "deleting CodeStar Notification Rule (%s) targets: %s", d.Id(), err)
 		}
 	}
 
@@ -287,19 +208,99 @@ func resourceNotificationRuleUpdate(ctx context.Context, d *schema.ResourceData,
 
 func resourceNotificationRuleDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).CodeStarNotificationsConn(ctx)
+	conn := meta.(*conns.AWSClient).CodeStarNotificationsClient(ctx)
 
-	_, err := conn.DeleteNotificationRuleWithContext(ctx, &codestarnotifications.DeleteNotificationRuleInput{
+	log.Printf("[DEBUG] Deleting CodeStar Notification Rule: %s", d.Id())
+	_, err := conn.DeleteNotificationRule(ctx, &codestarnotifications.DeleteNotificationRuleInput{
 		Arn: aws.String(d.Id()),
 	})
 
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "deleting CodeStar Notification Rule: %s", err)
+		return sdkdiag.AppendErrorf(diags, "deleting CodeStar Notification Rule (%s): %s", d.Id(), err)
 	}
 
 	if err = cleanupNotificationRuleTargets(ctx, conn, d.Get("target").(*schema.Set), nil); err != nil {
-		return sdkdiag.AppendErrorf(diags, "deleting CodeStar notification targets: %s", err)
+		return sdkdiag.AppendErrorf(diags, "deleting CodeStar Notification Rule (%s) targets: %s", d.Id(), err)
 	}
 
 	return diags
 }
+
+func findNotificationRuleByARN(ctx context.Context, conn *codestarnotifications.Client, arn string) (*codestarnotifications.DescribeNotificationRuleOutput, error) {
+	input := &codestarnotifications.DescribeNotificationRuleInput{
+		Arn: aws.String(arn),
+	}
+
+	output, err := conn.DescribeNotificationRule(ctx, input)
+
+	if errs.IsA[*types.ResourceNotFoundException](err) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	if output == nil {
+		return nil, tfresource.NewEmptyResultError(input)
+	}
+
+	return output, nil
+}
+
+// cleanupNotificationRuleTargets tries to remove unused notification targets. AWS API does not
+// provide expicit way for creating targets, they are created on first subscription. Here we are trying to remove all
+// unused targets which were unsubscribed from this notification rule.
+func cleanupNotificationRuleTargets(ctx context.Context, conn *codestarnotifications.Client, oldVal, newVal *schema.Set) error {
+	const (
+		notificationRuleErrorSubscribed = "The target cannot be deleted because it is subscribed to one or more notification rules."
+		targetSubscriptionTimeout       = 30 * time.Second
+	)
+	removedTargets := oldVal
+	if newVal != nil {
+		removedTargets = oldVal.Difference(newVal)
+	}
+
+	for _, targetRaw := range removedTargets.List() {
+		target, ok := targetRaw.(map[string]interface{})
+
+		if !ok {
+			continue
+		}
+
+		input := &codestarnotifications.DeleteTargetInput{
+			ForceUnsubscribeAll: false,
+			TargetAddress:       aws.String(target["address"].(string)),
+		}
+
+		_, err := tfresource.RetryWhenAWSErrMessageContains(ctx, targetSubscriptionTimeout, func() (interface{}, error) {
+			return conn.DeleteTarget(ctx, input)
+		}, "ValidationException", notificationRuleErrorSubscribed)
+
+		// Treat target deletion as best effort.
+		if tfawserr.ErrMessageContains(err, "ValidationException", notificationRuleErrorSubscribed) {
+			continue
+		}
+
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func expandNotificationRuleTargets(targetsData []interface{}) []types.Target {
+	targets := make([]types.Target, 0, len(targetsData))
+	for _, t := range targetsData {
+		target := t.(map[string]interface{})
+		targets = append(targets, types.Target{
+			TargetAddress: aws.String(target["address"].(string)),
+			TargetType:    aws.String(target["type"].(string)),
+		})
+	}
+	return targets
+}
diff --git a/internal/service/codestarnotifications/notification_rule_test.go b/internal/service/codestarnotifications/notification_rule_test.go
index 12bb53178d0..71c6e54e3b3 100644
--- a/internal/service/codestarnotifications/notification_rule_test.go
+++ b/internal/service/codestarnotifications/notification_rule_test.go
@@ -1,25 +1,27 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package codestarnotifications_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/codestarnotifications"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/YakDriver/regexache"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/codestarnotifications"
+	"github.com/aws/aws-sdk-go-v2/service/codestarnotifications/types"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	tfcodestarnotifications "github.com/hashicorp/terraform-provider-aws/internal/service/codestarnotifications"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
-// For PreCheck, using acctest.PreCheckPartitionHasService does not work for
-// codestarnotifications because it gives false positives always saying the
-// partition (aws or GovCloud) does not support the service
-
 func TestAccCodeStarNotificationsNotificationRule_basic(t *testing.T) {
 	ctx := acctest.Context(t)
 	resourceName := "aws_codestarnotifications_notification_rule.test"
@@ -27,19 +29,20 @@ func TestAccCodeStarNotificationsNotificationRule_basic(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, codestarnotifications.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.CodeStarNotificationsEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckNotificationRuleDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccNotificationRuleConfig_basic(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "codestar-notifications", regexp.MustCompile("notificationrule/.+")),
-					resource.TestCheckResourceAttr(resourceName, "detail_type", codestarnotifications.DetailTypeBasic),
+					testAccCheckNotificationRuleExists(ctx, resourceName),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "codestar-notifications", regexache.MustCompile("notificationrule/.+")),
+					resource.TestCheckResourceAttr(resourceName, "detail_type", string(types.DetailTypeBasic)),
 					resource.TestCheckResourceAttr(resourceName, "event_type_ids.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
-					resource.TestCheckResourceAttr(resourceName, "status", codestarnotifications.NotificationRuleStatusEnabled),
-					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "status", string(types.NotificationRuleStatusEnabled)),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 					resource.TestCheckResourceAttr(resourceName, "target.#", "1"),
 				),
 			},
@@ -52,6 +55,29 @@ func TestAccCodeStarNotificationsNotificationRule_basic(t *testing.T) {
 	})
 }
 
+func TestAccCodeStarNotificationsNotificationRule_disappears(t *testing.T) {
+	ctx := acctest.Context(t)
+	resourceName := "aws_codestarnotifications_notification_rule.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, names.CodeStarNotificationsEndpointID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckNotificationRuleDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccNotificationRuleConfig_basic(rName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckNotificationRuleExists(ctx, resourceName),
+					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfcodestarnotifications.ResourceNotificationRule(), resourceName),
+				),
+				ExpectNonEmptyPlan: true,
+			},
+		},
+	})
+}
+
 func TestAccCodeStarNotificationsNotificationRule_status(t *testing.T) {
 	ctx := acctest.Context(t)
 	resourceName := "aws_codestarnotifications_notification_rule.test"
@@ -59,14 +85,15 @@ func TestAccCodeStarNotificationsNotificationRule_status(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, codestarnotifications.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.CodeStarNotificationsEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckNotificationRuleDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccNotificationRuleConfig_status(rName, codestarnotifications.NotificationRuleStatusDisabled),
+				Config: testAccNotificationRuleConfig_status(rName, string(types.NotificationRuleStatusDisabled)),
 				Check: resource.ComposeAggregateTestCheckFunc(
-					resource.TestCheckResourceAttr(resourceName, "status", codestarnotifications.NotificationRuleStatusDisabled),
+					testAccCheckNotificationRuleExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "status", string(types.NotificationRuleStatusDisabled)),
 				),
 			},
 			{
@@ -75,15 +102,17 @@ func TestAccCodeStarNotificationsNotificationRule_status(t *testing.T) {
 				ImportStateVerify: true,
 			},
 			{
-				Config: testAccNotificationRuleConfig_status(rName, codestarnotifications.NotificationRuleStatusEnabled),
+				Config: testAccNotificationRuleConfig_status(rName, string(types.NotificationRuleStatusEnabled)),
 				Check: resource.ComposeAggregateTestCheckFunc(
-					resource.TestCheckResourceAttr(resourceName, "status", codestarnotifications.NotificationRuleStatusEnabled),
+					testAccCheckNotificationRuleExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "status", string(types.NotificationRuleStatusEnabled)),
 				),
 			},
 			{
-				Config: testAccNotificationRuleConfig_status(rName, codestarnotifications.NotificationRuleStatusDisabled),
+				Config: testAccNotificationRuleConfig_status(rName, string(types.NotificationRuleStatusDisabled)),
 				Check: resource.ComposeAggregateTestCheckFunc(
-					resource.TestCheckResourceAttr(resourceName, "status", codestarnotifications.NotificationRuleStatusDisabled),
+					testAccCheckNotificationRuleExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "status", string(types.NotificationRuleStatusDisabled)),
 				),
 			},
 		},
@@ -97,13 +126,14 @@ func TestAccCodeStarNotificationsNotificationRule_targets(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, codestarnotifications.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.CodeStarNotificationsEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckNotificationRuleDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccNotificationRuleConfig_targets1(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckNotificationRuleExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "target.#", "1"),
 				),
 			},
@@ -115,12 +145,14 @@ func TestAccCodeStarNotificationsNotificationRule_targets(t *testing.T) {
 			{
 				Config: testAccNotificationRuleConfig_targets2(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckNotificationRuleExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "target.#", "2"),
 				),
 			},
 			{
 				Config: testAccNotificationRuleConfig_targets1(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckNotificationRuleExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "target.#", "1"),
 				),
 			},
@@ -135,16 +167,16 @@ func TestAccCodeStarNotificationsNotificationRule_tags(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, codestarnotifications.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.CodeStarNotificationsEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckNotificationRuleDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccNotificationRuleConfig_tags1(rName),
+				Config: testAccNotificationRuleConfig_tags1(rName, "key1", "value1"),
 				Check: resource.ComposeAggregateTestCheckFunc(
-					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
-					resource.TestCheckResourceAttr(resourceName, "tags.TestTag1", "123456"),
-					resource.TestCheckResourceAttr(resourceName, "tags.TestTag2", "654321"),
+					testAccCheckNotificationRuleExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
 				),
 			},
 			{
@@ -153,19 +185,20 @@ func TestAccCodeStarNotificationsNotificationRule_tags(t *testing.T) {
 				ImportStateVerify: true,
 			},
 			{
-				Config: testAccNotificationRuleConfig_tags2(rName),
+				Config: testAccNotificationRuleConfig_tags2(rName, "key1", "value1updated", "key2", "value2"),
 				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckNotificationRuleExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
-					resource.TestCheckResourceAttr(resourceName, "tags.TestTag2", "654321"),
-					resource.TestCheckResourceAttr(resourceName, "tags.TestTag3", "asdfgh"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1updated"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
 				),
 			},
 			{
-				Config: testAccNotificationRuleConfig_tags1(rName),
+				Config: testAccNotificationRuleConfig_tags1(rName, "key1", "value1"),
 				Check: resource.ComposeAggregateTestCheckFunc(
-					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
-					resource.TestCheckResourceAttr(resourceName, "tags.TestTag1", "123456"),
-					resource.TestCheckResourceAttr(resourceName, "tags.TestTag2", "654321"),
+					testAccCheckNotificationRuleExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
 				),
 			},
 		},
@@ -179,13 +212,14 @@ func TestAccCodeStarNotificationsNotificationRule_eventTypeIDs(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, codestarnotifications.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.CodeStarNotificationsEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckNotificationRuleDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccNotificationRuleConfig_eventTypeIDs1(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckNotificationRuleExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "event_type_ids.#", "1"),
 				),
 			},
@@ -197,12 +231,14 @@ func TestAccCodeStarNotificationsNotificationRule_eventTypeIDs(t *testing.T) {
 			{
 				Config: testAccNotificationRuleConfig_eventTypeIDs2(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckNotificationRuleExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "event_type_ids.#", "2"),
 				),
 			},
 			{
 				Config: testAccNotificationRuleConfig_eventTypeIDs3(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckNotificationRuleExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "event_type_ids.#", "1"),
 				),
 			},
@@ -210,41 +246,41 @@ func TestAccCodeStarNotificationsNotificationRule_eventTypeIDs(t *testing.T) {
 	})
 }
 
+func testAccCheckNotificationRuleExists(ctx context.Context, n string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		conn := acctest.Provider.Meta().(*conns.AWSClient).CodeStarNotificationsClient(ctx)
+
+		_, err := tfcodestarnotifications.FindNotificationRuleByARN(ctx, conn, rs.Primary.ID)
+
+		return err
+	}
+}
+
 func testAccCheckNotificationRuleDestroy(ctx context.Context) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		conn := acctest.Provider.Meta().(*conns.AWSClient).CodeStarNotificationsConn(ctx)
+		conn := acctest.Provider.Meta().(*conns.AWSClient).CodeStarNotificationsClient(ctx)
 
 		for _, rs := range s.RootModule().Resources {
-			switch rs.Type {
-			case "aws_codestarnotifications_notification_rule":
-				_, err := conn.DescribeNotificationRuleWithContext(ctx, &codestarnotifications.DescribeNotificationRuleInput{
-					Arn: aws.String(rs.Primary.ID),
-				})
-
-				if err != nil && !tfawserr.ErrCodeEquals(err, codestarnotifications.ErrCodeResourceNotFoundException) {
-					return err
-				}
-			case "aws_sns_topic":
-				res, err := conn.ListTargetsWithContext(ctx, &codestarnotifications.ListTargetsInput{
-					Filters: []*codestarnotifications.ListTargetsFilter{
-						{
-							Name:  aws.String("TARGET_ADDRESS"),
-							Value: aws.String(rs.Primary.ID),
-						},
-						{
-							Name:  aws.String("TARGET_TYPE"),
-							Value: aws.String("SNS"),
-						},
-					},
-					MaxResults: aws.Int64(1),
-				})
-				if err != nil {
-					return err
-				}
-				if len(res.Targets) > 0 {
-					return fmt.Errorf("codestar notification target (%s) is not removed", rs.Primary.ID)
-				}
+			if rs.Type != "aws_codestarnotifications_notification_rule" {
+				continue
+			}
+
+			_, err := tfcodestarnotifications.FindNotificationRuleByARN(ctx, conn, rs.Primary.ID)
+
+			if tfresource.NotFound(err) {
+				continue
+			}
+
+			if err != nil {
+				return err
 			}
+
+			return fmt.Errorf("CodeStar Notification Rule %s still exists", rs.Primary.ID)
 		}
 
 		return nil
@@ -252,13 +288,13 @@ func testAccCheckNotificationRuleDestroy(ctx context.Context) resource.TestCheck
 }
 
 func testAccPreCheck(ctx context.Context, t *testing.T) {
-	conn := acctest.Provider.Meta().(*conns.AWSClient).CodeStarNotificationsConn(ctx)
+	conn := acctest.Provider.Meta().(*conns.AWSClient).CodeStarNotificationsClient(ctx)
 
 	input := &codestarnotifications.ListTargetsInput{
-		MaxResults: aws.Int64(1),
+		MaxResults: aws.Int32(1),
 	}
 
-	_, err := conn.ListTargetsWithContext(ctx, input)
+	_, err := conn.ListTargets(ctx, input)
 
 	if acctest.PreCheckSkipError(err) {
 		t.Skipf("skipping acceptance testing: %s", err)
@@ -269,7 +305,7 @@ func testAccPreCheck(ctx context.Context, t *testing.T) {
 	}
 }
 
-func testAccNotificationRuleBaseConfig(rName string) string {
+func testAccNotificationRuleConfig_base(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_codecommit_repository" "test" {
   repository_name = %[1]q
@@ -282,7 +318,7 @@ resource "aws_sns_topic" "test" {
 }
 
 func testAccNotificationRuleConfig_basic(rName string) string {
-	return testAccNotificationRuleBaseConfig(rName) + fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccNotificationRuleConfig_base(rName), fmt.Sprintf(`
 resource "aws_codestarnotifications_notification_rule" "test" {
   detail_type    = "BASIC"
   event_type_ids = ["codecommit-repository-comments-on-commits"]
@@ -290,19 +326,15 @@ resource "aws_codestarnotifications_notification_rule" "test" {
   resource       = aws_codecommit_repository.test.arn
   status         = "ENABLED"
 
-  tags = {
-    TestTag = "123456"
-  }
-
   target {
     address = aws_sns_topic.test.arn
   }
 }
-`, rName)
+`, rName))
 }
 
 func testAccNotificationRuleConfig_status(rName, status string) string {
-	return testAccNotificationRuleBaseConfig(rName) + fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccNotificationRuleConfig_base(rName), fmt.Sprintf(`
 resource "aws_codestarnotifications_notification_rule" "test" {
   detail_type    = "BASIC"
   event_type_ids = ["codecommit-repository-comments-on-commits"]
@@ -314,11 +346,11 @@ resource "aws_codestarnotifications_notification_rule" "test" {
     address = aws_sns_topic.test.arn
   }
 }
-`, rName, status)
+`, rName, status))
 }
 
 func testAccNotificationRuleConfig_targets1(rName string) string {
-	return testAccNotificationRuleBaseConfig(rName) + fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccNotificationRuleConfig_base(rName), fmt.Sprintf(`
 resource "aws_codestarnotifications_notification_rule" "test" {
   detail_type    = "BASIC"
   event_type_ids = ["codecommit-repository-comments-on-commits"]
@@ -329,13 +361,13 @@ resource "aws_codestarnotifications_notification_rule" "test" {
     address = aws_sns_topic.test.arn
   }
 }
-`, rName)
+`, rName))
 }
 
 func testAccNotificationRuleConfig_targets2(rName string) string {
-	return testAccNotificationRuleBaseConfig(rName) + fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccNotificationRuleConfig_base(rName), fmt.Sprintf(`
 resource "aws_sns_topic" "test2" {
-  name = "%[1]s2"
+  name = "%[1]s-2"
 }
 
 resource "aws_codestarnotifications_notification_rule" "test" {
@@ -352,11 +384,11 @@ resource "aws_codestarnotifications_notification_rule" "test" {
     address = aws_sns_topic.test2.arn
   }
 }
-`, rName)
+`, rName))
 }
 
-func testAccNotificationRuleConfig_tags1(rName string) string {
-	return testAccNotificationRuleBaseConfig(rName) + fmt.Sprintf(`
+func testAccNotificationRuleConfig_tags1(rName, tagKey1, tagValue1 string) string {
+	return acctest.ConfigCompose(testAccNotificationRuleConfig_base(rName), fmt.Sprintf(`
 resource "aws_codestarnotifications_notification_rule" "test" {
   detail_type    = "BASIC"
   event_type_ids = ["codecommit-repository-comments-on-commits"]
@@ -365,19 +397,18 @@ resource "aws_codestarnotifications_notification_rule" "test" {
   status         = "ENABLED"
 
   tags = {
-    TestTag1 = "123456"
-    TestTag2 = "654321"
+    %[2]q = %[3]q
   }
 
   target {
     address = aws_sns_topic.test.arn
   }
 }
-`, rName)
+`, rName, tagKey1, tagValue1))
 }
 
-func testAccNotificationRuleConfig_tags2(rName string) string {
-	return testAccNotificationRuleBaseConfig(rName) + fmt.Sprintf(`
+func testAccNotificationRuleConfig_tags2(rName, tagKey1, tagValue1, tagKey2, tagValue2 string) string {
+	return acctest.ConfigCompose(testAccNotificationRuleConfig_base(rName), fmt.Sprintf(`
 resource "aws_codestarnotifications_notification_rule" "test" {
   detail_type    = "BASIC"
   event_type_ids = ["codecommit-repository-comments-on-commits"]
@@ -386,19 +417,19 @@ resource "aws_codestarnotifications_notification_rule" "test" {
   status         = "ENABLED"
 
   tags = {
-    TestTag2 = "654321"
-    TestTag3 = "asdfgh"
+    %[2]q = %[3]q
+    %[4]q = %[5]q
   }
 
   target {
     address = aws_sns_topic.test.arn
   }
 }
-`, rName)
+`, rName, tagKey1, tagValue1, tagKey2, tagValue2))
 }
 
 func testAccNotificationRuleConfig_eventTypeIDs1(rName string) string {
-	return testAccNotificationRuleBaseConfig(rName) + fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccNotificationRuleConfig_base(rName), fmt.Sprintf(`
 resource "aws_codestarnotifications_notification_rule" "test" {
   detail_type = "BASIC"
   event_type_ids = [
@@ -412,11 +443,11 @@ resource "aws_codestarnotifications_notification_rule" "test" {
     address = aws_sns_topic.test.arn
   }
 }
-`, rName)
+`, rName))
 }
 
 func testAccNotificationRuleConfig_eventTypeIDs2(rName string) string {
-	return testAccNotificationRuleBaseConfig(rName) + fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccNotificationRuleConfig_base(rName), fmt.Sprintf(`
 resource "aws_codestarnotifications_notification_rule" "test" {
   detail_type = "BASIC"
   event_type_ids = [
@@ -431,11 +462,11 @@ resource "aws_codestarnotifications_notification_rule" "test" {
     address = aws_sns_topic.test.arn
   }
 }
-`, rName)
+`, rName))
 }
 
 func testAccNotificationRuleConfig_eventTypeIDs3(rName string) string {
-	return testAccNotificationRuleBaseConfig(rName) + fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccNotificationRuleConfig_base(rName), fmt.Sprintf(`
 resource "aws_codestarnotifications_notification_rule" "test" {
   detail_type = "BASIC"
   event_type_ids = [
@@ -449,5 +480,5 @@ resource "aws_codestarnotifications_notification_rule" "test" {
     address = aws_sns_topic.test.arn
   }
 }
-`, rName)
+`, rName))
 }
diff --git a/internal/service/codestarnotifications/service_package_gen.go b/internal/service/codestarnotifications/service_package_gen.go
index 41142931413..024cd8d75e2 100644
--- a/internal/service/codestarnotifications/service_package_gen.go
+++ b/internal/service/codestarnotifications/service_package_gen.go
@@ -5,9 +5,9 @@ package codestarnotifications
 import (
 	"context"
 
-	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
-	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
-	codestarnotifications_sdkv1 "github.com/aws/aws-sdk-go/service/codestarnotifications"
+	aws_sdkv2 "github.com/aws/aws-sdk-go-v2/aws"
+	codestarnotifications_sdkv2 "github.com/aws/aws-sdk-go-v2/service/codestarnotifications"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -29,7 +29,7 @@ func (p *servicePackage) SDKDataSources(ctx context.Context) []*types.ServicePac
 func (p *servicePackage) SDKResources(ctx context.Context) []*types.ServicePackageSDKResource {
 	return []*types.ServicePackageSDKResource{
 		{
-			Factory:  ResourceNotificationRule,
+			Factory:  resourceNotificationRule,
 			TypeName: "aws_codestarnotifications_notification_rule",
 			Name:     "Notification Rule",
 			Tags: &types.ServicePackageResourceTags{
@@ -43,11 +43,17 @@ func (p *servicePackage) ServicePackageName() string {
 	return names.CodeStarNotifications
 }
 
-// NewConn returns a new AWS SDK for Go v1 client for this service package's AWS API.
-func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*codestarnotifications_sdkv1.CodeStarNotifications, error) {
-	sess := config["session"].(*session_sdkv1.Session)
+// NewClient returns a new AWS SDK for Go v2 client for this service package's AWS API.
+func (p *servicePackage) NewClient(ctx context.Context, config map[string]any) (*codestarnotifications_sdkv2.Client, error) {
+	cfg := *(config["aws_sdkv2_config"].(*aws_sdkv2.Config))
 
-	return codestarnotifications_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
+	return codestarnotifications_sdkv2.NewFromConfig(cfg, func(o *codestarnotifications_sdkv2.Options) {
+		if endpoint := config["endpoint"].(string); endpoint != "" {
+			o.BaseEndpoint = aws_sdkv2.String(endpoint)
+		}
+	}), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/codestarnotifications/sweep.go b/internal/service/codestarnotifications/sweep.go
new file mode 100644
index 00000000000..1640843c9dd
--- /dev/null
+++ b/internal/service/codestarnotifications/sweep.go
@@ -0,0 +1,63 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package codestarnotifications
+
+import (
+	"fmt"
+	"log"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/codestarnotifications"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv2"
+)
+
+func RegisterSweepers() {
+	resource.AddTestSweepers("aws_codestarnotifications_notification_rule", &resource.Sweeper{
+		Name: "aws_codestarnotifications_notification_rule",
+		F:    sweepNotificationRules,
+	})
+}
+
+func sweepNotificationRules(region string) error {
+	ctx := sweep.Context(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
+	if err != nil {
+		return fmt.Errorf("error getting client: %s", err)
+	}
+	conn := client.CodeStarNotificationsClient(ctx)
+	input := &codestarnotifications.ListNotificationRulesInput{}
+	sweepResources := make([]sweep.Sweepable, 0)
+
+	pages := codestarnotifications.NewListNotificationRulesPaginator(conn, input)
+	for pages.HasMorePages() {
+		page, err := pages.NextPage(ctx)
+
+		if awsv2.SkipSweepError(err) {
+			log.Printf("[WARN] Skipping CodeStar Notification Rule sweep for %s: %s", region, err)
+			return nil
+		}
+
+		if err != nil {
+			return fmt.Errorf("error listingCodeStar Notification Rules (%s): %w", region, err)
+		}
+
+		for _, v := range page.NotificationRules {
+			r := resourceNotificationRule()
+			d := r.Data(nil)
+			d.SetId(aws.ToString(v.Arn))
+
+			sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
+		}
+	}
+
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
+
+	if err != nil {
+		return fmt.Errorf("error sweeping CodeStar Notification Rules (%s): %w", region, err)
+	}
+
+	return nil
+}
diff --git a/internal/service/codestarnotifications/tags_gen.go b/internal/service/codestarnotifications/tags_gen.go
index 562dad7b277..79af87a1f41 100644
--- a/internal/service/codestarnotifications/tags_gen.go
+++ b/internal/service/codestarnotifications/tags_gen.go
@@ -5,10 +5,11 @@ import (
 	"context"
 	"fmt"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/codestarnotifications"
-	"github.com/aws/aws-sdk-go/service/codestarnotifications/codestarnotificationsiface"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/codestarnotifications"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -17,12 +18,12 @@ import (
 // listTags lists codestarnotifications service tags.
 // The identifier is typically the Amazon Resource Name (ARN), although
 // it may also be a different identifier depending on the service.
-func listTags(ctx context.Context, conn codestarnotificationsiface.CodeStarNotificationsAPI, identifier string) (tftags.KeyValueTags, error) {
+func listTags(ctx context.Context, conn *codestarnotifications.Client, identifier string) (tftags.KeyValueTags, error) {
 	input := &codestarnotifications.ListTagsForResourceInput{
 		Arn: aws.String(identifier),
 	}
 
-	output, err := conn.ListTagsForResourceWithContext(ctx, input)
+	output, err := conn.ListTagsForResource(ctx, input)
 
 	if err != nil {
 		return tftags.New(ctx, nil), err
@@ -34,7 +35,7 @@ func listTags(ctx context.Context, conn codestarnotificationsiface.CodeStarNotif
 // ListTags lists codestarnotifications service tags and set them in Context.
 // It is called from outside this package.
 func (p *servicePackage) ListTags(ctx context.Context, meta any, identifier string) error {
-	tags, err := listTags(ctx, meta.(*conns.AWSClient).CodeStarNotificationsConn(ctx), identifier)
+	tags, err := listTags(ctx, meta.(*conns.AWSClient).CodeStarNotificationsClient(ctx), identifier)
 
 	if err != nil {
 		return err
@@ -47,21 +48,21 @@ func (p *servicePackage) ListTags(ctx context.Context, meta any, identifier stri
 	return nil
 }
 
-// map[string]*string handling
+// map[string]string handling
 
 // Tags returns codestarnotifications service tags.
-func Tags(tags tftags.KeyValueTags) map[string]*string {
-	return aws.StringMap(tags.Map())
+func Tags(tags tftags.KeyValueTags) map[string]string {
+	return tags.Map()
 }
 
-// KeyValueTags creates KeyValueTags from codestarnotifications service tags.
-func KeyValueTags(ctx context.Context, tags map[string]*string) tftags.KeyValueTags {
+// KeyValueTags creates tftags.KeyValueTags from codestarnotifications service tags.
+func KeyValueTags(ctx context.Context, tags map[string]string) tftags.KeyValueTags {
 	return tftags.New(ctx, tags)
 }
 
 // getTagsIn returns codestarnotifications service tags from Context.
 // nil is returned if there are no input tags.
-func getTagsIn(ctx context.Context) map[string]*string {
+func getTagsIn(ctx context.Context) map[string]string {
 	if inContext, ok := tftags.FromContext(ctx); ok {
 		if tags := Tags(inContext.TagsIn.UnwrapOrDefault()); len(tags) > 0 {
 			return tags
@@ -72,7 +73,7 @@ func getTagsIn(ctx context.Context) map[string]*string {
 }
 
 // setTagsOut sets codestarnotifications service tags in Context.
-func setTagsOut(ctx context.Context, tags map[string]*string) {
+func setTagsOut(ctx context.Context, tags map[string]string) {
 	if inContext, ok := tftags.FromContext(ctx); ok {
 		inContext.TagsOut = types.Some(KeyValueTags(ctx, tags))
 	}
@@ -81,19 +82,21 @@ func setTagsOut(ctx context.Context, tags map[string]*string) {
 // updateTags updates codestarnotifications service tags.
 // The identifier is typically the Amazon Resource Name (ARN), although
 // it may also be a different identifier depending on the service.
-func updateTags(ctx context.Context, conn codestarnotificationsiface.CodeStarNotificationsAPI, identifier string, oldTagsMap, newTagsMap any) error {
+func updateTags(ctx context.Context, conn *codestarnotifications.Client, identifier string, oldTagsMap, newTagsMap any) error {
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.CodeStarNotifications)
 	if len(removedTags) > 0 {
 		input := &codestarnotifications.UntagResourceInput{
 			Arn:     aws.String(identifier),
-			TagKeys: aws.StringSlice(removedTags.Keys()),
+			TagKeys: removedTags.Keys(),
 		}
 
-		_, err := conn.UntagResourceWithContext(ctx, input)
+		_, err := conn.UntagResource(ctx, input)
 
 		if err != nil {
 			return fmt.Errorf("untagging resource (%s): %w", identifier, err)
@@ -108,7 +111,7 @@ func updateTags(ctx context.Context, conn codestarnotificationsiface.CodeStarNot
 			Tags: Tags(updatedTags),
 		}
 
-		_, err := conn.TagResourceWithContext(ctx, input)
+		_, err := conn.TagResource(ctx, input)
 
 		if err != nil {
 			return fmt.Errorf("tagging resource (%s): %w", identifier, err)
@@ -121,5 +124,5 @@ func updateTags(ctx context.Context, conn codestarnotificationsiface.CodeStarNot
 // UpdateTags updates codestarnotifications service tags.
 // It is called from outside this package.
 func (p *servicePackage) UpdateTags(ctx context.Context, meta any, identifier string, oldTags, newTags any) error {
-	return updateTags(ctx, meta.(*conns.AWSClient).CodeStarNotificationsConn(ctx), identifier, oldTags, newTags)
+	return updateTags(ctx, meta.(*conns.AWSClient).CodeStarNotificationsClient(ctx), identifier, oldTags, newTags)
 }
diff --git a/internal/service/cognitoidentity/consts.go b/internal/service/cognitoidentity/consts.go
index 78c941d7fce..ec582580bd1 100644
--- a/internal/service/cognitoidentity/consts.go
+++ b/internal/service/cognitoidentity/consts.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cognitoidentity
 
 const (
diff --git a/internal/service/cognitoidentity/flex.go b/internal/service/cognitoidentity/flex.go
index 0226be8a6d6..54e16fffea8 100644
--- a/internal/service/cognitoidentity/flex.go
+++ b/internal/service/cognitoidentity/flex.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cognitoidentity
 
 import (
diff --git a/internal/service/cognitoidentity/generate.go b/internal/service/cognitoidentity/generate.go
index dfa0b21ff0a..044a634a357 100644
--- a/internal/service/cognitoidentity/generate.go
+++ b/internal/service/cognitoidentity/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTags -ServiceTagsMap -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/cognitoidentity/pool.go b/internal/service/cognitoidentity/pool.go
index 8f69ac15bb1..c17b5a2b63b 100644
--- a/internal/service/cognitoidentity/pool.go
+++ b/internal/service/cognitoidentity/pool.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cognitoidentity
 
 import (
diff --git a/internal/service/cognitoidentity/pool_data_source.go b/internal/service/cognitoidentity/pool_data_source.go
new file mode 100644
index 00000000000..151c798f060
--- /dev/null
+++ b/internal/service/cognitoidentity/pool_data_source.go
@@ -0,0 +1,189 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package cognitoidentity
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/arn"
+	"github.com/aws/aws-sdk-go/service/cognitoidentity"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/create"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
+	"github.com/hashicorp/terraform-provider-aws/internal/flex"
+	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
+	"github.com/hashicorp/terraform-provider-aws/names"
+)
+
+// @SDKDataSource("aws_cognito_identity_pool", name="Pool")
+// @Tags(identifierAttribute="arn")
+func DataSourcePool() *schema.Resource {
+	return &schema.Resource{
+		ReadWithoutTimeout: dataSourcePoolRead,
+
+		Schema: map[string]*schema.Schema{
+			"allow_classic_flow": {
+				Type:     schema.TypeBool,
+				Computed: true,
+			},
+			"allow_unauthenticated_identities": {
+				Type:     schema.TypeBool,
+				Computed: true,
+			},
+			"arn": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"cognito_identity_providers": {
+				Type:     schema.TypeSet,
+				Computed: true,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"client_id": {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+						"provider_name": {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+						"server_side_token_check": {
+							Type:     schema.TypeBool,
+							Computed: true,
+						},
+					},
+				},
+			},
+			"developer_provider_name": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"identity_pool_name": {
+				Type:         schema.TypeString,
+				Required:     true,
+				ValidateFunc: validIdentityPoolName,
+			},
+			"openid_connect_provider_arns": {
+				Type:     schema.TypeSet,
+				Computed: true,
+				Elem: &schema.Schema{
+					Type: schema.TypeString,
+				},
+			},
+			"saml_provider_arns": {
+				Type:     schema.TypeList,
+				Computed: true,
+				Elem: &schema.Schema{
+					Type: schema.TypeString,
+				},
+			},
+			"supported_login_providers": {
+				Type:     schema.TypeMap,
+				Computed: true,
+				Elem: &schema.Schema{
+					Type: schema.TypeString,
+				},
+			},
+			"tags": tftags.TagsSchemaComputed(),
+		},
+	}
+}
+
+const (
+	DSNamePool         = "Pool Data Source"
+	ListPoolMaxResults = 20
+)
+
+func dataSourcePoolRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).CognitoIdentityConn(ctx)
+
+	name := d.Get("identity_pool_name").(string)
+
+	ip, err := findPoolByName(ctx, conn, name)
+	if err != nil {
+		return append(diags, create.DiagError(names.CognitoIdentity, create.ErrActionReading, DSNamePool, name, err)...)
+	}
+
+	d.SetId(aws.StringValue(ip.IdentityPoolId))
+
+	arn := arn.ARN{
+		Partition: meta.(*conns.AWSClient).Partition,
+		Region:    meta.(*conns.AWSClient).Region,
+		Service:   "cognito-identity",
+		AccountID: meta.(*conns.AWSClient).AccountID,
+		Resource:  fmt.Sprintf("identitypool/%s", d.Id()),
+	}
+	d.Set("arn", arn.String())
+	d.Set("identity_pool_name", ip.IdentityPoolName)
+	d.Set("allow_unauthenticated_identities", ip.AllowUnauthenticatedIdentities)
+	d.Set("allow_classic_flow", ip.AllowClassicFlow)
+	d.Set("developer_provider_name", ip.DeveloperProviderName)
+
+	setTagsOut(ctx, ip.IdentityPoolTags)
+
+	if err := d.Set("cognito_identity_providers", flattenIdentityProviders(ip.CognitoIdentityProviders)); err != nil {
+		return sdkdiag.AppendErrorf(diags, "setting cognito_identity_providers error: %s", err)
+	}
+
+	if err := d.Set("openid_connect_provider_arns", flex.FlattenStringList(ip.OpenIdConnectProviderARNs)); err != nil {
+		return sdkdiag.AppendErrorf(diags, "setting openid_connect_provider_arns error: %s", err)
+	}
+
+	if err := d.Set("saml_provider_arns", flex.FlattenStringList(ip.SamlProviderARNs)); err != nil {
+		return sdkdiag.AppendErrorf(diags, "setting saml_provider_arns error: %s", err)
+	}
+
+	if err := d.Set("supported_login_providers", aws.StringValueMap(ip.SupportedLoginProviders)); err != nil {
+		return sdkdiag.AppendErrorf(diags, "setting supported_login_providers error: %s", err)
+	}
+
+	return diags
+}
+
+func findPoolByName(ctx context.Context, conn *cognitoidentity.CognitoIdentity, name string) (*cognitoidentity.IdentityPool, error) {
+	var poolID string
+	input := &cognitoidentity.ListIdentityPoolsInput{
+		MaxResults: aws.Int64(ListPoolMaxResults),
+	}
+
+	err := conn.ListIdentityPoolsPagesWithContext(ctx, input, func(page *cognitoidentity.ListIdentityPoolsOutput, lastPage bool) bool {
+		if page == nil {
+			return !lastPage
+		}
+
+		for _, p := range page.IdentityPools {
+			if p == nil {
+				continue
+			}
+			if aws.StringValue(p.IdentityPoolName) == name {
+				poolID = aws.StringValue(p.IdentityPoolId)
+				return false
+			}
+		}
+
+		return !lastPage
+	})
+
+	if err != nil {
+		return nil, err
+	}
+
+	pool, err := conn.DescribeIdentityPoolWithContext(ctx, &cognitoidentity.DescribeIdentityPoolInput{
+		IdentityPoolId: aws.String(poolID),
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	if poolID == "" {
+		return nil, fmt.Errorf("no identity pool found with name %q", name)
+	}
+
+	return pool, nil
+}
diff --git a/internal/service/cognitoidentity/pool_data_source_test.go b/internal/service/cognitoidentity/pool_data_source_test.go
new file mode 100644
index 00000000000..13d6d7f0b58
--- /dev/null
+++ b/internal/service/cognitoidentity/pool_data_source_test.go
@@ -0,0 +1,275 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package cognitoidentity_test
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/aws/aws-sdk-go/service/cognitoidentity"
+	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
+)
+
+func TestAccCognitoIdentityPoolDataSource_basic(t *testing.T) {
+	ctx := acctest.Context(t)
+
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
+	var ip cognitoidentity.IdentityPool
+	name := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	dataSourceName := "data.aws_cognito_identity_pool.test"
+	resourceName := "aws_cognito_identity_pool.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, cognitoidentity.EndpointsID)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, cognitoidentity.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckPoolDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccPoolDataSourceConfig_basic(name),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckPoolExists(ctx, resourceName, &ip),
+					resource.TestCheckResourceAttrPair(dataSourceName, "arn", resourceName, "arn"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "developer_provider_name", resourceName, "developer_provider_name"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "allow_unauthenticated_identities", resourceName, "allow_unauthenticated_identities"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "allow_classic_flow", resourceName, "allow_classic_flow"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccCognitoIdentityPoolDataSource_openidConnectProviderARNs(t *testing.T) {
+	ctx := acctest.Context(t)
+
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
+	var ip cognitoidentity.IdentityPool
+	name := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	dataSourceName := "data.aws_cognito_identity_pool.test"
+	resourceName := "aws_cognito_identity_pool.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, cognitoidentity.EndpointsID)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, cognitoidentity.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckPoolDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccPoolDataSourceConfig_openidConnectProviderARNs(name),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckPoolExists(ctx, resourceName, &ip),
+					resource.TestCheckResourceAttrPair(dataSourceName, "openid_connect_provider_arns", resourceName, "openid_connect_provider_arns"),
+					resource.TestCheckResourceAttr(dataSourceName, "openid_connect_provider_arns.#", "1"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccCognitoIdentityPoolDataSource_cognitoIdentityProviders(t *testing.T) {
+	ctx := acctest.Context(t)
+
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
+	name := sdkacctest.RandString(10)
+	var ip cognitoidentity.IdentityPool
+	dataSourceName := "data.aws_cognito_identity_pool.test"
+	resourceName := "aws_cognito_identity_pool.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, cognitoidentity.EndpointsID)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, cognitoidentity.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckPoolDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccPoolDataSourceConfig_identityProviders(name),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckPoolExists(ctx, resourceName, &ip),
+					resource.TestCheckResourceAttrPair(dataSourceName, "arn", resourceName, "arn"),
+					resource.TestCheckResourceAttr(dataSourceName, "cognito_identity_providers.#", "2"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccCognitoIdentityPoolDataSource_samlProviderARNs(t *testing.T) {
+	ctx := acctest.Context(t)
+
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
+	name := sdkacctest.RandString(10)
+	idpEntityId := fmt.Sprintf("https://%s", acctest.RandomDomainName())
+	var ip cognitoidentity.IdentityPool
+	dataSourceName := "data.aws_cognito_identity_pool.test"
+	resourceName := "aws_cognito_identity_pool.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, cognitoidentity.EndpointsID)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, cognitoidentity.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckPoolDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccPoolDataSourceConfig_samlProviderARNs(name, idpEntityId),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckPoolExists(ctx, resourceName, &ip),
+					resource.TestCheckResourceAttrPair(dataSourceName, "arn", resourceName, "arn"),
+					resource.TestCheckResourceAttr(dataSourceName, "saml_provider_arns.#", "1"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "saml_provider_arns.0", "aws_iam_saml_provider.default", "arn")),
+			},
+		},
+	})
+}
+
+func TestAccCognitoIdentityPoolDataSource_supportedLoginProviders(t *testing.T) {
+	ctx := acctest.Context(t)
+
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
+	name := sdkacctest.RandString(10)
+	var ip cognitoidentity.IdentityPool
+	dataSourceName := "data.aws_cognito_identity_pool.test"
+	resourceName := "aws_cognito_identity_pool.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, cognitoidentity.EndpointsID)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, cognitoidentity.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckPoolDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccPoolDataSourceConfig_supportedLoginProviders(name),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckPoolExists(ctx, resourceName, &ip),
+					resource.TestCheckResourceAttrPair(dataSourceName, "arn", resourceName, "arn"),
+					resource.TestCheckResourceAttr(dataSourceName, "supported_login_providers.%", "1"),
+					resource.TestCheckResourceAttr(dataSourceName, "supported_login_providers.graph.facebook.com", "7346241598935555")),
+			},
+		},
+	})
+}
+
+func TestAccCognitoIdentityPoolDataSource_tags(t *testing.T) {
+	ctx := acctest.Context(t)
+
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
+	var ip cognitoidentity.IdentityPool
+	name := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	dataSourceName := "data.aws_cognito_identity_pool.test"
+	resourceName := "aws_cognito_identity_pool.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, cognitoidentity.EndpointsID)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, cognitoidentity.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckPoolDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccPoolDataSourceConfig_tags(name, "key1", "value1"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckPoolExists(ctx, resourceName, &ip),
+					resource.TestCheckResourceAttrPair(dataSourceName, "arn", resourceName, "arn"),
+					resource.TestCheckResourceAttr(dataSourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(dataSourceName, "tags.key1", "value1"),
+				),
+			},
+		},
+	})
+}
+
+func testAccPoolDataSourceConfig_basic(rName string) string {
+	return fmt.Sprintf(`
+resource "aws_cognito_identity_pool" "test" {
+  identity_pool_name               = "%s"
+  allow_unauthenticated_identities = false
+}
+
+data "aws_cognito_identity_pool" "test" {
+  identity_pool_name = aws_cognito_identity_pool.test.identity_pool_name
+}
+	`, rName)
+}
+
+func testAccPoolDataSourceConfig_openidConnectProviderARNs(rName string) string {
+	return acctest.ConfigCompose(testAccPoolConfig_openidConnectProviderARNs(rName), `
+data "aws_cognito_identity_pool" "test" {
+  identity_pool_name = aws_cognito_identity_pool.test.identity_pool_name
+}
+`)
+}
+
+func testAccPoolDataSourceConfig_identityProviders(rName string) string {
+	return acctest.ConfigCompose(testAccPoolConfig_identityProviders(rName), `
+data "aws_cognito_identity_pool" "test" {
+  identity_pool_name = aws_cognito_identity_pool.test.identity_pool_name
+}
+`)
+}
+
+func testAccPoolDataSourceConfig_samlProviderARNs(name, idpEntityId string) string {
+	return acctest.ConfigCompose(testAccPoolConfig_samlProviderARNs(name, idpEntityId), `
+data "aws_cognito_identity_pool" "test" {
+  identity_pool_name = aws_cognito_identity_pool.test.identity_pool_name
+}
+`)
+}
+
+func testAccPoolDataSourceConfig_supportedLoginProviders(name string) string {
+	return acctest.ConfigCompose(testAccPoolConfig_supportedLoginProviders(name), `
+data "aws_cognito_identity_pool" "test" {
+  identity_pool_name = aws_cognito_identity_pool.test.identity_pool_name
+}
+`)
+}
+
+func testAccPoolDataSourceConfig_tags(name, tagKey1, tagValue1 string) string {
+	return acctest.ConfigCompose(testAccPoolConfig_tags1(name, tagKey1, tagValue1), `
+data "aws_cognito_identity_pool" "test" {
+  identity_pool_name = aws_cognito_identity_pool.test.identity_pool_name
+}
+`)
+}
diff --git a/internal/service/cognitoidentity/pool_provider_principal_tag.go b/internal/service/cognitoidentity/pool_provider_principal_tag.go
index 9fd3ddaaf9d..4b2189b08e4 100644
--- a/internal/service/cognitoidentity/pool_provider_principal_tag.go
+++ b/internal/service/cognitoidentity/pool_provider_principal_tag.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cognitoidentity
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/cognitoidentity"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -39,7 +42,7 @@ func ResourcePoolProviderPrincipalTag() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 55),
-					validation.StringMatch(regexp.MustCompile(`^[\w-]+:[0-9a-f-]+$`), "see https://docs.aws.amazon.com/cognitoidentity/latest/APIReference/API_SetPrincipalTagAttributeMap.html#API_SetPrincipalTagAttributeMap_ResponseSyntax"),
+					validation.StringMatch(regexache.MustCompile(`^[\w-]+:[0-9a-f-]+$`), "see https://docs.aws.amazon.com/cognitoidentity/latest/APIReference/API_SetPrincipalTagAttributeMap.html#API_SetPrincipalTagAttributeMap_ResponseSyntax"),
 				),
 			},
 			"identity_provider_name": {
@@ -185,7 +188,7 @@ func resourcePoolProviderPrincipalTagDelete(ctx context.Context, d *schema.Resou
 }
 
 func DecodePoolProviderPrincipalTagsID(id string) (string, string, error) {
-	r := regexp.MustCompile(`(?P<ProviderID>[\w-]+:[0-9a-f-]+):(?P<ProviderName>[[:graph:]]+)`)
+	r := regexache.MustCompile(`(?P<ProviderID>[\w-]+:[0-9a-f-]+):(?P<ProviderName>[[:graph:]]+)`)
 	idParts := r.FindStringSubmatch(id)
 	if len(idParts) <= 2 {
 		return "", "", fmt.Errorf("expected ID in format UserPoolID:ProviderName, received: %s", id)
diff --git a/internal/service/cognitoidentity/pool_provider_principal_tag_test.go b/internal/service/cognitoidentity/pool_provider_principal_tag_test.go
index 1a35444785a..83ba67f0319 100644
--- a/internal/service/cognitoidentity/pool_provider_principal_tag_test.go
+++ b/internal/service/cognitoidentity/pool_provider_principal_tag_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cognitoidentity_test
 
 import (
diff --git a/internal/service/cognitoidentity/pool_roles_attachment.go b/internal/service/cognitoidentity/pool_roles_attachment.go
index 0a2f8a530c7..b660333e674 100644
--- a/internal/service/cognitoidentity/pool_roles_attachment.go
+++ b/internal/service/cognitoidentity/pool_roles_attachment.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cognitoidentity
 
 import (
diff --git a/internal/service/cognitoidentity/pool_roles_attachment_test.go b/internal/service/cognitoidentity/pool_roles_attachment_test.go
index 10cde7936dc..19675489490 100644
--- a/internal/service/cognitoidentity/pool_roles_attachment_test.go
+++ b/internal/service/cognitoidentity/pool_roles_attachment_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cognitoidentity_test
 
 import (
 	"context"
 	"errors"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/cognitoidentity"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -146,7 +149,7 @@ func TestAccCognitoIdentityPoolRolesAttachment_roleMappingsWithAmbiguousRoleReso
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccPoolRolesAttachmentConfig_roleMappingsWithAmbiguousRoleResolutionError(name),
-				ExpectError: regexp.MustCompile(`validating ambiguous role resolution`),
+				ExpectError: regexache.MustCompile(`validating ambiguous role resolution`),
 			},
 		},
 	})
@@ -164,7 +167,7 @@ func TestAccCognitoIdentityPoolRolesAttachment_roleMappingsWithRulesTypeError(t
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccPoolRolesAttachmentConfig_roleMappingsWithRulesTypeError(name),
-				ExpectError: regexp.MustCompile(`mapping_rule is required for Rules`),
+				ExpectError: regexache.MustCompile(`mapping_rule is required for Rules`),
 			},
 		},
 	})
@@ -182,7 +185,7 @@ func TestAccCognitoIdentityPoolRolesAttachment_roleMappingsWithTokenTypeError(t
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccPoolRolesAttachmentConfig_roleMappingsWithTokenTypeError(name),
-				ExpectError: regexp.MustCompile(`mapping_rule must not be set for Token based role mapping`),
+				ExpectError: regexache.MustCompile(`mapping_rule must not be set for Token based role mapping`),
 			},
 		},
 	})
diff --git a/internal/service/cognitoidentity/pool_test.go b/internal/service/cognitoidentity/pool_test.go
index 2351a60fcf4..ca62e8636ad 100644
--- a/internal/service/cognitoidentity/pool_test.go
+++ b/internal/service/cognitoidentity/pool_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cognitoidentity_test
 
 import (
 	"context"
 	"errors"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/cognitoidentity"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -36,7 +39,7 @@ func TestAccCognitoIdentityPool_basic(t *testing.T) {
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckPoolExists(ctx, resourceName, &v1),
 					resource.TestCheckResourceAttr(resourceName, "identity_pool_name", fmt.Sprintf("identity pool %s", name)),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "cognito-identity", regexp.MustCompile(`identitypool/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "cognito-identity", regexache.MustCompile(`identitypool/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "allow_unauthenticated_identities", "false"),
 					resource.TestCheckResourceAttr(resourceName, "developer_provider_name", ""),
 				),
diff --git a/internal/service/cognitoidentity/service_package_gen.go b/internal/service/cognitoidentity/service_package_gen.go
index 35ed8d4c5ad..3539abfe7ff 100644
--- a/internal/service/cognitoidentity/service_package_gen.go
+++ b/internal/service/cognitoidentity/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	cognitoidentity_sdkv1 "github.com/aws/aws-sdk-go/service/cognitoidentity"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -23,7 +24,16 @@ func (p *servicePackage) FrameworkResources(ctx context.Context) []*types.Servic
 }
 
 func (p *servicePackage) SDKDataSources(ctx context.Context) []*types.ServicePackageSDKDataSource {
-	return []*types.ServicePackageSDKDataSource{}
+	return []*types.ServicePackageSDKDataSource{
+		{
+			Factory:  DataSourcePool,
+			TypeName: "aws_cognito_identity_pool",
+			Name:     "Pool",
+			Tags: &types.ServicePackageResourceTags{
+				IdentifierAttribute: "arn",
+			},
+		},
+	}
 }
 
 func (p *servicePackage) SDKResources(ctx context.Context) []*types.ServicePackageSDKResource {
@@ -58,4 +68,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*c
 	return cognitoidentity_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/cognitoidentity/tags_gen.go b/internal/service/cognitoidentity/tags_gen.go
index bbc236f5794..3a508555072 100644
--- a/internal/service/cognitoidentity/tags_gen.go
+++ b/internal/service/cognitoidentity/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/cognitoidentity"
 	"github.com/aws/aws-sdk-go/service/cognitoidentity/cognitoidentityiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -54,7 +56,7 @@ func Tags(tags tftags.KeyValueTags) map[string]*string {
 	return aws.StringMap(tags.Map())
 }
 
-// KeyValueTags creates KeyValueTags from cognitoidentity service tags.
+// KeyValueTags creates tftags.KeyValueTags from cognitoidentity service tags.
 func KeyValueTags(ctx context.Context, tags map[string]*string) tftags.KeyValueTags {
 	return tftags.New(ctx, tags)
 }
@@ -85,6 +87,8 @@ func updateTags(ctx context.Context, conn cognitoidentityiface.CognitoIdentityAP
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.CognitoIdentity)
 	if len(removedTags) > 0 {
diff --git a/internal/service/cognitoidentity/validate.go b/internal/service/cognitoidentity/validate.go
index 8180335ca1e..d9b4233e8d8 100644
--- a/internal/service/cognitoidentity/validate.go
+++ b/internal/service/cognitoidentity/validate.go
@@ -1,15 +1,18 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cognitoidentity
 
 import (
 	"fmt"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/cognitoidentity"
 )
 
 func validIdentityPoolName(v interface{}, k string) (ws []string, errors []error) {
 	val := v.(string)
-	if !regexp.MustCompile(`^[\w\s+=,.@-]+$`).MatchString(val) {
+	if !regexache.MustCompile(`^[\w\s+=,.@-]+$`).MatchString(val) {
 		errors = append(errors, fmt.Errorf("%q must contain only alphanumeric characters, dots, underscores and hyphens", k))
 	}
 
@@ -26,7 +29,7 @@ func validIdentityProvidersClientID(v interface{}, k string) (ws []string, error
 		errors = append(errors, fmt.Errorf("%q cannot be longer than 128 characters", k))
 	}
 
-	if !regexp.MustCompile(`^[\w_]+$`).MatchString(value) {
+	if !regexache.MustCompile(`^[\w_]+$`).MatchString(value) {
 		errors = append(errors, fmt.Errorf("%q must contain only alphanumeric characters and underscores", k))
 	}
 
@@ -43,7 +46,7 @@ func validIdentityProvidersProviderName(v interface{}, k string) (ws []string, e
 		errors = append(errors, fmt.Errorf("%q cannot be longer than 128 characters", k))
 	}
 
-	if !regexp.MustCompile(`^[\w._:/-]+$`).MatchString(value) {
+	if !regexache.MustCompile(`^[\w._:/-]+$`).MatchString(value) {
 		errors = append(errors, fmt.Errorf("%q must contain only alphanumeric characters, dots, underscores, colons, slashes and hyphens", k))
 	}
 
@@ -56,7 +59,7 @@ func validProviderDeveloperName(v interface{}, k string) (ws []string, errors []
 		errors = append(errors, fmt.Errorf("%q cannot be longer than 100 characters", k))
 	}
 
-	if !regexp.MustCompile(`^[\w._-]+$`).MatchString(value) {
+	if !regexache.MustCompile(`^[\w._-]+$`).MatchString(value) {
 		errors = append(errors, fmt.Errorf("%q must contain only alphanumeric characters, dots, underscores and hyphens", k))
 	}
 
@@ -77,7 +80,7 @@ func validRoleMappingsAmbiguousRoleResolutionAgainstType(v map[string]interface{
 func validRoleMappingsRulesClaim(v interface{}, k string) (ws []string, errors []error) {
 	value := v.(string)
 
-	if !regexp.MustCompile(`^[\p{L}\p{M}\p{S}\p{N}\p{P}]+$`).MatchString(value) {
+	if !regexache.MustCompile(`^[\p{L}\p{M}\p{S}\p{N}\p{P}]+$`).MatchString(value) {
 		errors = append(errors, fmt.Errorf("%q must contain only alphanumeric characters, dots, underscores, colons, slashes and hyphens", k))
 	}
 
@@ -125,7 +128,7 @@ func validSupportedLoginProviders(v interface{}, k string) (ws []string, errors
 		errors = append(errors, fmt.Errorf("%q cannot be longer than 128 characters", k))
 	}
 
-	if !regexp.MustCompile(`^[\w.;_/-]+$`).MatchString(value) {
+	if !regexache.MustCompile(`^[\w.;_/-]+$`).MatchString(value) {
 		errors = append(errors, fmt.Errorf("%q must contain only alphanumeric characters, dots, semicolons, underscores, slashes and hyphens", k))
 	}
 
diff --git a/internal/service/cognitoidentity/validate_test.go b/internal/service/cognitoidentity/validate_test.go
index d13b5e3e49c..00059c5b6bf 100644
--- a/internal/service/cognitoidentity/validate_test.go
+++ b/internal/service/cognitoidentity/validate_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cognitoidentity
 
 import (
diff --git a/internal/service/cognitoidp/consts.go b/internal/service/cognitoidp/consts.go
index 78797fcf3c2..355dd1d7418 100644
--- a/internal/service/cognitoidp/consts.go
+++ b/internal/service/cognitoidp/consts.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cognitoidp
 
 import (
diff --git a/internal/service/cognitoidp/exports_test.go b/internal/service/cognitoidp/exports_test.go
index 5e18c9ce128..7746cfae13c 100644
--- a/internal/service/cognitoidp/exports_test.go
+++ b/internal/service/cognitoidp/exports_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cognitoidp
 
 // Exports for use in tests only.
diff --git a/internal/service/cognitoidp/find.go b/internal/service/cognitoidp/find.go
index c4dc6a48dda..9c9c5e8e092 100644
--- a/internal/service/cognitoidp/find.go
+++ b/internal/service/cognitoidp/find.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cognitoidp
 
 import (
diff --git a/internal/service/cognitoidp/flex.go b/internal/service/cognitoidp/flex.go
index 5d671d9c447..184027b31cb 100644
--- a/internal/service/cognitoidp/flex.go
+++ b/internal/service/cognitoidp/flex.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cognitoidp
 
 import (
diff --git a/internal/service/cognitoidp/flex_test.go b/internal/service/cognitoidp/flex_test.go
index f900b9557fe..2d502cac4fa 100644
--- a/internal/service/cognitoidp/flex_test.go
+++ b/internal/service/cognitoidp/flex_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cognitoidp
 
 import (
@@ -11,10 +14,12 @@ func TestUserPoolSchemaAttributeMatchesStandardAttribute(t *testing.T) {
 	t.Parallel()
 
 	cases := []struct {
+		Name     string
 		Input    *cognitoidentityprovider.SchemaAttributeType
 		Expected bool
 	}{
 		{
+			Name: "birthday standard",
 			Input: &cognitoidentityprovider.SchemaAttributeType{
 				AttributeDataType:      aws.String(cognitoidentityprovider.AttributeDataTypeString),
 				DeveloperOnlyAttribute: aws.Bool(false),
@@ -29,6 +34,7 @@ func TestUserPoolSchemaAttributeMatchesStandardAttribute(t *testing.T) {
 			Expected: true,
 		},
 		{
+			Name: "birthday non-standard DeveloperOnlyAttribute",
 			Input: &cognitoidentityprovider.SchemaAttributeType{
 				AttributeDataType:      aws.String(cognitoidentityprovider.AttributeDataTypeString),
 				DeveloperOnlyAttribute: aws.Bool(true),
@@ -43,6 +49,7 @@ func TestUserPoolSchemaAttributeMatchesStandardAttribute(t *testing.T) {
 			Expected: false,
 		},
 		{
+			Name: "birthday non-standard Mutable",
 			Input: &cognitoidentityprovider.SchemaAttributeType{
 				AttributeDataType:      aws.String(cognitoidentityprovider.AttributeDataTypeString),
 				DeveloperOnlyAttribute: aws.Bool(false),
@@ -57,6 +64,7 @@ func TestUserPoolSchemaAttributeMatchesStandardAttribute(t *testing.T) {
 			Expected: false,
 		},
 		{
+			Name: "non-standard Name",
 			Input: &cognitoidentityprovider.SchemaAttributeType{
 				AttributeDataType:      aws.String(cognitoidentityprovider.AttributeDataTypeString),
 				DeveloperOnlyAttribute: aws.Bool(false),
@@ -71,6 +79,7 @@ func TestUserPoolSchemaAttributeMatchesStandardAttribute(t *testing.T) {
 			Expected: false,
 		},
 		{
+			Name: "birthday non-standard Required",
 			Input: &cognitoidentityprovider.SchemaAttributeType{
 				AttributeDataType:      aws.String(cognitoidentityprovider.AttributeDataTypeString),
 				DeveloperOnlyAttribute: aws.Bool(false),
@@ -85,6 +94,7 @@ func TestUserPoolSchemaAttributeMatchesStandardAttribute(t *testing.T) {
 			Expected: false,
 		},
 		{
+			Name: "birthday non-standard StringAttributeConstraints.Max",
 			Input: &cognitoidentityprovider.SchemaAttributeType{
 				AttributeDataType:      aws.String(cognitoidentityprovider.AttributeDataTypeString),
 				DeveloperOnlyAttribute: aws.Bool(false),
@@ -99,6 +109,7 @@ func TestUserPoolSchemaAttributeMatchesStandardAttribute(t *testing.T) {
 			Expected: false,
 		},
 		{
+			Name: "birthday non-standard StringAttributeConstraints.Min",
 			Input: &cognitoidentityprovider.SchemaAttributeType{
 				AttributeDataType:      aws.String(cognitoidentityprovider.AttributeDataTypeString),
 				DeveloperOnlyAttribute: aws.Bool(false),
@@ -113,6 +124,7 @@ func TestUserPoolSchemaAttributeMatchesStandardAttribute(t *testing.T) {
 			Expected: false,
 		},
 		{
+			Name: "email_verified standard",
 			Input: &cognitoidentityprovider.SchemaAttributeType{
 				AttributeDataType:      aws.String(cognitoidentityprovider.AttributeDataTypeBoolean),
 				DeveloperOnlyAttribute: aws.Bool(false),
@@ -123,6 +135,7 @@ func TestUserPoolSchemaAttributeMatchesStandardAttribute(t *testing.T) {
 			Expected: true,
 		},
 		{
+			Name: "updated_at standard",
 			Input: &cognitoidentityprovider.SchemaAttributeType{
 				AttributeDataType:      aws.String(cognitoidentityprovider.AttributeDataTypeNumber),
 				DeveloperOnlyAttribute: aws.Bool(false),
@@ -138,9 +151,116 @@ func TestUserPoolSchemaAttributeMatchesStandardAttribute(t *testing.T) {
 	}
 
 	for _, tc := range cases {
-		output := UserPoolSchemaAttributeMatchesStandardAttribute(tc.Input)
-		if output != tc.Expected {
-			t.Fatalf("Expected %t match with standard attribute on input: \n\n%#v\n\n", tc.Expected, tc.Input)
-		}
+		tc := tc
+		t.Run(tc.Name, func(t *testing.T) {
+			t.Parallel()
+			output := UserPoolSchemaAttributeMatchesStandardAttribute(tc.Input)
+			if output != tc.Expected {
+				t.Fatalf("Expected %t match with standard attribute on input: \n\n%#v\n\n", tc.Expected, tc.Input)
+			}
+		})
+	}
+}
+
+func TestSkipFlatteningStringAttributeContraints(t *testing.T) {
+	t.Parallel()
+
+	cases := []struct {
+		name       string
+		configured []*cognitoidentityprovider.SchemaAttributeType
+		input      *cognitoidentityprovider.SchemaAttributeType
+		want       bool
+	}{
+		{
+			name: "config omitted",
+			configured: []*cognitoidentityprovider.SchemaAttributeType{
+				{
+					AttributeDataType:      aws.String(cognitoidentityprovider.AttributeDataTypeString),
+					DeveloperOnlyAttribute: aws.Bool(false),
+					Mutable:                aws.Bool(false),
+					Name:                   aws.String("email"),
+					Required:               aws.Bool(true),
+				},
+			},
+			input: &cognitoidentityprovider.SchemaAttributeType{
+				AttributeDataType:      aws.String(cognitoidentityprovider.AttributeDataTypeString),
+				DeveloperOnlyAttribute: aws.Bool(false),
+				Mutable:                aws.Bool(false),
+				Name:                   aws.String("email"),
+				Required:               aws.Bool(true),
+				StringAttributeConstraints: &cognitoidentityprovider.StringAttributeConstraintsType{
+					MaxLength: aws.String("2048"),
+					MinLength: aws.String("0"),
+				},
+			},
+			want: true,
+		},
+		{
+			name: "config set",
+			configured: []*cognitoidentityprovider.SchemaAttributeType{
+				{
+					AttributeDataType:      aws.String(cognitoidentityprovider.AttributeDataTypeString),
+					DeveloperOnlyAttribute: aws.Bool(false),
+					Mutable:                aws.Bool(false),
+					Name:                   aws.String("email"),
+					Required:               aws.Bool(true),
+					StringAttributeConstraints: &cognitoidentityprovider.StringAttributeConstraintsType{
+						MaxLength: aws.String("2048"),
+						MinLength: aws.String("0"),
+					},
+				},
+			},
+			input: &cognitoidentityprovider.SchemaAttributeType{
+				AttributeDataType:      aws.String(cognitoidentityprovider.AttributeDataTypeString),
+				DeveloperOnlyAttribute: aws.Bool(false),
+				Mutable:                aws.Bool(false),
+				Name:                   aws.String("email"),
+				Required:               aws.Bool(true),
+				StringAttributeConstraints: &cognitoidentityprovider.StringAttributeConstraintsType{
+					MaxLength: aws.String("2048"),
+					MinLength: aws.String("0"),
+				},
+			},
+			want: false,
+		},
+		{
+			name: "config set with diff",
+			configured: []*cognitoidentityprovider.SchemaAttributeType{
+				{
+					AttributeDataType:      aws.String(cognitoidentityprovider.AttributeDataTypeString),
+					DeveloperOnlyAttribute: aws.Bool(false),
+					Mutable:                aws.Bool(false),
+					Name:                   aws.String("email"),
+					Required:               aws.Bool(true),
+					StringAttributeConstraints: &cognitoidentityprovider.StringAttributeConstraintsType{
+						MaxLength: aws.String("1024"),
+						MinLength: aws.String("5"),
+					},
+				},
+			},
+			input: &cognitoidentityprovider.SchemaAttributeType{
+				AttributeDataType:      aws.String(cognitoidentityprovider.AttributeDataTypeString),
+				DeveloperOnlyAttribute: aws.Bool(false),
+				Mutable:                aws.Bool(false),
+				Name:                   aws.String("email"),
+				Required:               aws.Bool(true),
+				StringAttributeConstraints: &cognitoidentityprovider.StringAttributeConstraintsType{
+					MaxLength: aws.String("2048"),
+					MinLength: aws.String("0"),
+				},
+			},
+			want: false,
+		},
+	}
+
+	for _, tc := range cases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			got := skipFlatteningStringAttributeContraints(tc.configured, tc.input)
+			if got != tc.want {
+				t.Fatalf("skipFlatteningStringAttributeContraints() got %t, want %t\n\n%#v\n\n", got, tc.want, tc.input)
+			}
+		})
 	}
 }
diff --git a/internal/service/cognitoidp/generate.go b/internal/service/cognitoidp/generate.go
index 88a121c1823..11c3168f128 100644
--- a/internal/service/cognitoidp/generate.go
+++ b/internal/service/cognitoidp/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTags -ServiceTagsMap -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/cognitoidp/identity_provider.go b/internal/service/cognitoidp/identity_provider.go
index d5fb3d60e80..657eff4ec32 100644
--- a/internal/service/cognitoidp/identity_provider.go
+++ b/internal/service/cognitoidp/identity_provider.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cognitoidp
 
 import (
@@ -5,9 +8,9 @@ import (
 	"errors"
 	"fmt"
 	"log"
-	"regexp"
 	"strings"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/cognitoidentityprovider"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -51,7 +54,7 @@ func ResourceIdentityProvider() *schema.Resource {
 					Type: schema.TypeString,
 					ValidateFunc: validation.All(
 						validation.StringLenBetween(1, 40),
-						validation.StringMatch(regexp.MustCompile(`^[\w\s+=.@-]+$`), "see https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_CreateIdentityProvider.html#API_CreateIdentityProvider_RequestSyntax"),
+						validation.StringMatch(regexache.MustCompile(`^[\w\s+=.@-]+$`), "see https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_CreateIdentityProvider.html#API_CreateIdentityProvider_RequestSyntax"),
 					),
 				},
 			},
@@ -68,7 +71,7 @@ func ResourceIdentityProvider() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 32),
-					validation.StringMatch(regexp.MustCompile(`^[^_][\p{L}\p{M}\p{S}\p{N}\p{P}][^_]+$`), "see https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_CreateIdentityProvider.html#API_CreateIdentityProvider_RequestSyntax"),
+					validation.StringMatch(regexache.MustCompile(`^[^_][\p{L}\p{M}\p{S}\p{N}\p{P}][^_]+$`), "see https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_CreateIdentityProvider.html#API_CreateIdentityProvider_RequestSyntax"),
 				),
 			},
 
diff --git a/internal/service/cognitoidp/identity_provider_test.go b/internal/service/cognitoidp/identity_provider_test.go
index 5433d0c8458..1de01c60915 100644
--- a/internal/service/cognitoidp/identity_provider_test.go
+++ b/internal/service/cognitoidp/identity_provider_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cognitoidp_test
 
 import (
diff --git a/internal/service/cognitoidp/managed_user_pool_client.go b/internal/service/cognitoidp/managed_user_pool_client.go
index 5e1b04aefe0..6e9c86fa748 100644
--- a/internal/service/cognitoidp/managed_user_pool_client.go
+++ b/internal/service/cognitoidp/managed_user_pool_client.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cognitoidp
 
 import (
@@ -21,13 +24,13 @@ import (
 	"github.com/hashicorp/terraform-plugin-framework/resource/schema/int64planmodifier"
 	"github.com/hashicorp/terraform-plugin-framework/resource/schema/planmodifier"
 	"github.com/hashicorp/terraform-plugin-framework/resource/schema/setplanmodifier"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema/stringdefault"
 	"github.com/hashicorp/terraform-plugin-framework/resource/schema/stringplanmodifier"
 	"github.com/hashicorp/terraform-plugin-framework/schema/validator"
 	"github.com/hashicorp/terraform-plugin-framework/types"
 	"github.com/hashicorp/terraform-provider-aws/internal/create"
 	"github.com/hashicorp/terraform-provider-aws/internal/framework"
 	"github.com/hashicorp/terraform-provider-aws/internal/framework/flex"
-	fwstringplanmodifier "github.com/hashicorp/terraform-provider-aws/internal/framework/stringplanmodifier"
 	fwtypes "github.com/hashicorp/terraform-provider-aws/internal/framework/types"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -305,9 +308,7 @@ func (r *resourceManagedUserPoolClient) Schema(ctx context.Context, request reso
 						"access_token": schema.StringAttribute{
 							Optional: true,
 							Computed: true,
-							PlanModifiers: []planmodifier.String{
-								fwstringplanmodifier.DefaultValue(cognitoidentityprovider.TimeUnitsTypeHours),
-							},
+							Default:  stringdefault.StaticString(cognitoidentityprovider.TimeUnitsTypeHours),
 							Validators: []validator.String{
 								stringvalidator.OneOf(cognitoidentityprovider.TimeUnitsType_Values()...),
 							},
@@ -315,9 +316,7 @@ func (r *resourceManagedUserPoolClient) Schema(ctx context.Context, request reso
 						"id_token": schema.StringAttribute{
 							Optional: true,
 							Computed: true,
-							PlanModifiers: []planmodifier.String{
-								fwstringplanmodifier.DefaultValue(cognitoidentityprovider.TimeUnitsTypeHours),
-							},
+							Default:  stringdefault.StaticString(cognitoidentityprovider.TimeUnitsTypeHours),
 							Validators: []validator.String{
 								stringvalidator.OneOf(cognitoidentityprovider.TimeUnitsType_Values()...),
 							},
@@ -325,9 +324,7 @@ func (r *resourceManagedUserPoolClient) Schema(ctx context.Context, request reso
 						"refresh_token": schema.StringAttribute{
 							Optional: true,
 							Computed: true,
-							PlanModifiers: []planmodifier.String{
-								fwstringplanmodifier.DefaultValue(cognitoidentityprovider.TimeUnitsTypeDays),
-							},
+							Default:  stringdefault.StaticString(cognitoidentityprovider.TimeUnitsTypeDays),
 							Validators: []validator.String{
 								stringvalidator.OneOf(cognitoidentityprovider.TimeUnitsType_Values()...),
 							},
@@ -578,7 +575,7 @@ func (r *resourceManagedUserPoolClient) Read(ctx context.Context, request resour
 	state.RefreshTokenValidity = flex.Int64ToFramework(ctx, poolClient.RefreshTokenValidity)
 	state.SupportedIdentityProviders = flex.FlattenFrameworkStringSetLegacy(ctx, poolClient.SupportedIdentityProviders)
 	if state.TokenValidityUnits.IsNull() && isDefaultTokenValidityUnits(poolClient.TokenValidityUnits) {
-		attributeTypes := framework.AttributeTypesMust[tokenValidityUnits](ctx)
+		attributeTypes := flex.AttributeTypesMust[tokenValidityUnits](ctx)
 		elemType := types.ObjectType{AttrTypes: attributeTypes}
 		state.TokenValidityUnits = types.ListNull(elemType)
 	} else {
@@ -660,7 +657,7 @@ func (r *resourceManagedUserPoolClient) Update(ctx context.Context, request reso
 	config.RefreshTokenValidity = flex.Int64ToFramework(ctx, poolClient.RefreshTokenValidity)
 	config.SupportedIdentityProviders = flex.FlattenFrameworkStringSetLegacy(ctx, poolClient.SupportedIdentityProviders)
 	if !state.TokenValidityUnits.IsNull() && plan.TokenValidityUnits.IsNull() && isDefaultTokenValidityUnits(poolClient.TokenValidityUnits) {
-		attributeTypes := framework.AttributeTypesMust[tokenValidityUnits](ctx)
+		attributeTypes := flex.AttributeTypesMust[tokenValidityUnits](ctx)
 		elemType := types.ObjectType{AttrTypes: attributeTypes}
 		config.TokenValidityUnits = types.ListNull(elemType)
 	} else {
diff --git a/internal/service/cognitoidp/managed_user_pool_client_test.go b/internal/service/cognitoidp/managed_user_pool_client_test.go
index 038b05dee08..7ef6bdafe2d 100644
--- a/internal/service/cognitoidp/managed_user_pool_client_test.go
+++ b/internal/service/cognitoidp/managed_user_pool_client_test.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cognitoidp_test
 
 import (
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/cognitoidentityprovider"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -41,7 +44,7 @@ func TestAccCognitoIDPManagedUserPoolClient_basic(t *testing.T) {
 				Config: testAccManagedUserPoolClientConfig_basic(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckUserPoolClientExists(ctx, resourceName, &client),
-					resource.TestMatchResourceAttr(resourceName, "name", regexp.MustCompile(fmt.Sprintf(`^AmazonOpenSearchService-%s`, rName))),
+					resource.TestMatchResourceAttr(resourceName, "name", regexache.MustCompile(fmt.Sprintf(`^AmazonOpenSearchService-%s`, rName))),
 					resource.TestCheckResourceAttr(resourceName, "access_token_validity", "0"),
 					resource.TestCheckResourceAttr(resourceName, "allowed_oauth_flows.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "allowed_oauth_flows.0", "code"),
@@ -54,15 +57,15 @@ func TestAccCognitoIDPManagedUserPoolClient_basic(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "analytics_configuration.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "auth_session_validity", "3"),
 					resource.TestCheckResourceAttr(resourceName, "callback_urls.#", "1"),
-					resource.TestMatchResourceAttr(resourceName, "callback_urls.0", regexp.MustCompile(fmt.Sprintf(`https://search-%s-\w+.%s.es.amazonaws.com/_dashboards/app/home`, rName, acctest.Region()))),
-					resource.TestMatchResourceAttr(resourceName, "client_secret", regexp.MustCompile(`\w+`)),
+					resource.TestMatchResourceAttr(resourceName, "callback_urls.0", regexache.MustCompile(fmt.Sprintf(`https://search-%s-\w+.%s.es.amazonaws.com/_dashboards/app/home`, rName, acctest.Region()))),
+					resource.TestMatchResourceAttr(resourceName, "client_secret", regexache.MustCompile(`\w+`)),
 					resource.TestCheckResourceAttr(resourceName, "default_redirect_uri", ""),
 					resource.TestCheckResourceAttr(resourceName, "enable_propagate_additional_user_context_data", "false"),
 					resource.TestCheckResourceAttr(resourceName, "enable_token_revocation", "true"),
 					resource.TestCheckResourceAttr(resourceName, "explicit_auth_flows.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "id_token_validity", "0"),
 					resource.TestCheckResourceAttr(resourceName, "logout_urls.#", "1"),
-					resource.TestMatchResourceAttr(resourceName, "logout_urls.0", regexp.MustCompile(fmt.Sprintf(`https://search-%s-\w+.%s.es.amazonaws.com/_dashboards/app/home`, rName, acctest.Region()))),
+					resource.TestMatchResourceAttr(resourceName, "logout_urls.0", regexache.MustCompile(fmt.Sprintf(`https://search-%s-\w+.%s.es.amazonaws.com/_dashboards/app/home`, rName, acctest.Region()))),
 					resource.TestCheckResourceAttr(resourceName, "prevent_user_existence_errors", ""),
 					resource.TestCheckResourceAttr(resourceName, "read_attributes.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "refresh_token_validity", "30"),
@@ -102,7 +105,7 @@ func TestAccCognitoIDPManagedUserPoolClient_namePattern(t *testing.T) {
 				Config: testAccManagedUserPoolClientConfig_namePattern(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckUserPoolClientExists(ctx, resourceName, &client),
-					resource.TestMatchResourceAttr(resourceName, "name", regexp.MustCompile(fmt.Sprintf(`^AmazonOpenSearchService-%s`, rName))),
+					resource.TestMatchResourceAttr(resourceName, "name", regexache.MustCompile(fmt.Sprintf(`^AmazonOpenSearchService-%s`, rName))),
 				),
 			},
 			{
@@ -227,15 +230,15 @@ func TestAccCognitoIDPManagedUserPoolClient_accessTokenValidity_error(t *testing
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccManagedUserPoolClientConfig_accessTokenValidity(rName, 25),
-				ExpectError: regexp.MustCompile(`Attribute access_token_validity must have a duration between 5m0s and\s+24h0m0s, got: 25h0m0s`),
+				ExpectError: regexache.MustCompile(`Attribute access_token_validity must have a duration between 5m0s and\s+24h0m0s, got: 25h0m0s`),
 			},
 			{
 				Config:      testAccManagedUserPoolClientConfig_accessTokenValidityUnit(rName, 2, cognitoidentityprovider.TimeUnitsTypeDays),
-				ExpectError: regexp.MustCompile(`Attribute access_token_validity must have a duration between 5m0s and\s+24h0m0s, got: 48h0m0s`),
+				ExpectError: regexache.MustCompile(`Attribute access_token_validity must have a duration between 5m0s and\s+24h0m0s, got: 48h0m0s`),
 			},
 			{
 				Config:      testAccManagedUserPoolClientConfig_accessTokenValidityUnit(rName, 4, cognitoidentityprovider.TimeUnitsTypeMinutes),
-				ExpectError: regexp.MustCompile(`Attribute access_token_validity must have a duration between 5m0s and\s+24h0m0s, got: 4m0s`),
+				ExpectError: regexache.MustCompile(`Attribute access_token_validity must have a duration between 5m0s and\s+24h0m0s, got: 4m0s`),
 			},
 		},
 	})
@@ -301,15 +304,15 @@ func TestAccCognitoIDPManagedUserPoolClient_idTokenValidity_error(t *testing.T)
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccManagedUserPoolClientConfig_idTokenValidity(rName, 25),
-				ExpectError: regexp.MustCompile(`Attribute id_token_validity must have a duration between 5m0s and\s+24h0m0s,\s+got: 25h0m0s`),
+				ExpectError: regexache.MustCompile(`Attribute id_token_validity must have a duration between 5m0s and\s+24h0m0s,\s+got: 25h0m0s`),
 			},
 			{
 				Config:      testAccManagedUserPoolClientConfig_idTokenValidityUnit(rName, 2, cognitoidentityprovider.TimeUnitsTypeDays),
-				ExpectError: regexp.MustCompile(`Attribute id_token_validity must have a duration between 5m0s and\s+24h0m0s,\s+got: 48h0m0s`),
+				ExpectError: regexache.MustCompile(`Attribute id_token_validity must have a duration between 5m0s and\s+24h0m0s,\s+got: 48h0m0s`),
 			},
 			{
 				Config:      testAccManagedUserPoolClientConfig_idTokenValidityUnit(rName, 4, cognitoidentityprovider.TimeUnitsTypeMinutes),
-				ExpectError: regexp.MustCompile(`Attribute id_token_validity must have a duration between 5m0s and\s+24h0m0s,\s+got: 4m0s`),
+				ExpectError: regexache.MustCompile(`Attribute id_token_validity must have a duration between 5m0s and\s+24h0m0s,\s+got: 4m0s`),
 			},
 		},
 	})
@@ -375,11 +378,11 @@ func TestAccCognitoIDPManagedUserPoolClient_refreshTokenValidity_error(t *testin
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccManagedUserPoolClientConfig_refreshTokenValidity(rName, 10*365+1),
-				ExpectError: regexp.MustCompile(`Attribute refresh_token_validity must have a duration between 1h0m0s and\s+87600h0m0s,\s+got: 87624h0m0s`),
+				ExpectError: regexache.MustCompile(`Attribute refresh_token_validity must have a duration between 1h0m0s and\s+87600h0m0s,\s+got: 87624h0m0s`),
 			},
 			{
 				Config:      testAccManagedUserPoolClientConfig_refreshTokenValidityUnit(rName, 59, cognitoidentityprovider.TimeUnitsTypeMinutes),
-				ExpectError: regexp.MustCompile(`Attribute refresh_token_validity must have a duration between 1h0m0s and\s+87600h0m0s,\s+got: 59m0s`),
+				ExpectError: regexache.MustCompile(`Attribute refresh_token_validity must have a duration between 1h0m0s and\s+87600h0m0s,\s+got: 59m0s`),
 			},
 		},
 	})
@@ -607,7 +610,7 @@ func TestAccCognitoIDPManagedUserPoolClient_allFields(t *testing.T) {
 				Config: testAccManagedUserPoolClientConfig_allFields(rName, 300),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckUserPoolClientExists(ctx, resourceName, &client),
-					resource.TestMatchResourceAttr(resourceName, "name", regexp.MustCompile(fmt.Sprintf(`^AmazonOpenSearchService-%s`, rName))),
+					resource.TestMatchResourceAttr(resourceName, "name", regexache.MustCompile(fmt.Sprintf(`^AmazonOpenSearchService-%s`, rName))),
 					resource.TestCheckResourceAttr(resourceName, "explicit_auth_flows.#", "3"),
 					resource.TestCheckTypeSetElemAttr(resourceName, "explicit_auth_flows.*", "CUSTOM_AUTH_FLOW_ONLY"),
 					resource.TestCheckTypeSetElemAttr(resourceName, "explicit_auth_flows.*", "USER_PASSWORD_AUTH"),
@@ -668,7 +671,7 @@ func TestAccCognitoIDPManagedUserPoolClient_allFieldsUpdatingOneField(t *testing
 				Config: testAccManagedUserPoolClientConfig_allFields(rName, 299),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckUserPoolClientExists(ctx, resourceName, &client),
-					resource.TestMatchResourceAttr(resourceName, "name", regexp.MustCompile(fmt.Sprintf(`^AmazonOpenSearchService-%s`, rName))),
+					resource.TestMatchResourceAttr(resourceName, "name", regexache.MustCompile(fmt.Sprintf(`^AmazonOpenSearchService-%s`, rName))),
 					resource.TestCheckResourceAttr(resourceName, "explicit_auth_flows.#", "3"),
 					resource.TestCheckTypeSetElemAttr(resourceName, "explicit_auth_flows.*", "CUSTOM_AUTH_FLOW_ONLY"),
 					resource.TestCheckTypeSetElemAttr(resourceName, "explicit_auth_flows.*", "USER_PASSWORD_AUTH"),
diff --git a/internal/service/cognitoidp/resource_server.go b/internal/service/cognitoidp/resource_server.go
index 0666b3f3d0e..7d5d22d217b 100644
--- a/internal/service/cognitoidp/resource_server.go
+++ b/internal/service/cognitoidp/resource_server.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cognitoidp
 
 import (
diff --git a/internal/service/cognitoidp/resource_server_test.go b/internal/service/cognitoidp/resource_server_test.go
index 3e599c30bf1..5ffeca000f1 100644
--- a/internal/service/cognitoidp/resource_server_test.go
+++ b/internal/service/cognitoidp/resource_server_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cognitoidp_test
 
 import (
diff --git a/internal/service/cognitoidp/risk_configuration.go b/internal/service/cognitoidp/risk_configuration.go
index 2498fa72eea..51f6dc7f172 100644
--- a/internal/service/cognitoidp/risk_configuration.go
+++ b/internal/service/cognitoidp/risk_configuration.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cognitoidp
 
 import (
diff --git a/internal/service/cognitoidp/risk_configuration_test.go b/internal/service/cognitoidp/risk_configuration_test.go
index 37a86675e36..f19c22648b4 100644
--- a/internal/service/cognitoidp/risk_configuration_test.go
+++ b/internal/service/cognitoidp/risk_configuration_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cognitoidp_test
 
 import (
diff --git a/internal/service/cognitoidp/service_package_gen.go b/internal/service/cognitoidp/service_package_gen.go
index d0a10a34bd8..f3f2acbbb89 100644
--- a/internal/service/cognitoidp/service_package_gen.go
+++ b/internal/service/cognitoidp/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	cognitoidentityprovider_sdkv1 "github.com/aws/aws-sdk-go/service/cognitoidentityprovider"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -104,4 +105,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*c
 	return cognitoidentityprovider_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/cognitoidp/sweep.go b/internal/service/cognitoidp/sweep.go
index 8ee2377cfc0..952f41f7755 100644
--- a/internal/service/cognitoidp/sweep.go
+++ b/internal/service/cognitoidp/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package cognitoidp
 
@@ -11,9 +11,10 @@ import (
 	"github.com/aws/aws-sdk-go/service/cognitoidentityprovider"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_cognito_user_pool_domain", &resource.Sweeper{
 		Name: "aws_cognito_user_pool_domain",
 		F:    sweepUserPoolDomains,
@@ -30,7 +31,7 @@ func init() {
 
 func sweepUserPoolDomains(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("Error getting client: %s", err)
 	}
@@ -71,7 +72,7 @@ func sweepUserPoolDomains(region string) error {
 	})
 
 	if err != nil {
-		if sweep.SkipSweepError(err) {
+		if awsv1.SkipSweepError(err) {
 			log.Printf("[WARN] Skipping Cognito User Pool Domain sweep for %s: %s", region, err)
 			return nil
 		}
@@ -83,7 +84,7 @@ func sweepUserPoolDomains(region string) error {
 
 func sweepUserPools(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
@@ -114,7 +115,7 @@ func sweepUserPools(region string) error {
 	})
 
 	if err != nil {
-		if sweep.SkipSweepError(err) {
+		if awsv1.SkipSweepError(err) {
 			log.Printf("[WARN] Skipping Cognito User Pool sweep for %s: %s", region, err)
 			return nil
 		}
diff --git a/internal/service/cognitoidp/tags_gen.go b/internal/service/cognitoidp/tags_gen.go
index ed598c74e8d..820dbc4d013 100644
--- a/internal/service/cognitoidp/tags_gen.go
+++ b/internal/service/cognitoidp/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/cognitoidentityprovider"
 	"github.com/aws/aws-sdk-go/service/cognitoidentityprovider/cognitoidentityprovideriface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -54,7 +56,7 @@ func Tags(tags tftags.KeyValueTags) map[string]*string {
 	return aws.StringMap(tags.Map())
 }
 
-// KeyValueTags creates KeyValueTags from cognitoidp service tags.
+// KeyValueTags creates tftags.KeyValueTags from cognitoidp service tags.
 func KeyValueTags(ctx context.Context, tags map[string]*string) tftags.KeyValueTags {
 	return tftags.New(ctx, tags)
 }
@@ -85,6 +87,8 @@ func updateTags(ctx context.Context, conn cognitoidentityprovideriface.CognitoId
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.CognitoIDP)
 	if len(removedTags) > 0 {
diff --git a/internal/service/cognitoidp/test-fixtures/saml-metadata.xml b/internal/service/cognitoidp/test-fixtures/saml-metadata.xml
index fb42fca70f1..f961397cf52 100644
--- a/internal/service/cognitoidp/test-fixtures/saml-metadata.xml
+++ b/internal/service/cognitoidp/test-fixtures/saml-metadata.xml
@@ -1,4 +1,9 @@
 <?xml version="1.0"?>
+<!--
+ Copyright (c) HashiCorp, Inc.
+ SPDX-License-Identifier: MPL-2.0
+-->
+
 <md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" entityID="https://terraform-dev-ed.my.salesforce.com" validUntil="2070-08-31T14:30:09Z">
   <md:IDPSSODescriptor WantAuthnRequestsSigned="false" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
     <md:KeyDescriptor use="signing">
diff --git a/internal/service/cognitoidp/user.go b/internal/service/cognitoidp/user.go
index 1fbb1ac0ecb..fbe9171b0a2 100644
--- a/internal/service/cognitoidp/user.go
+++ b/internal/service/cognitoidp/user.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cognitoidp
 
 import (
diff --git a/internal/service/cognitoidp/user_group.go b/internal/service/cognitoidp/user_group.go
index 55fc0395272..1c0e89abb1d 100644
--- a/internal/service/cognitoidp/user_group.go
+++ b/internal/service/cognitoidp/user_group.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cognitoidp
 
 import (
diff --git a/internal/service/cognitoidp/user_group_test.go b/internal/service/cognitoidp/user_group_test.go
index 6c0abe93b18..09f8aba1b73 100644
--- a/internal/service/cognitoidp/user_group_test.go
+++ b/internal/service/cognitoidp/user_group_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cognitoidp_test
 
 import (
diff --git a/internal/service/cognitoidp/user_in_group.go b/internal/service/cognitoidp/user_in_group.go
index c49564a1445..764a19db415 100644
--- a/internal/service/cognitoidp/user_in_group.go
+++ b/internal/service/cognitoidp/user_in_group.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cognitoidp
 
 import (
diff --git a/internal/service/cognitoidp/user_in_group_test.go b/internal/service/cognitoidp/user_in_group_test.go
index f93738a68db..1b69360a3f0 100644
--- a/internal/service/cognitoidp/user_in_group_test.go
+++ b/internal/service/cognitoidp/user_in_group_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cognitoidp_test
 
 import (
diff --git a/internal/service/cognitoidp/user_pool.go b/internal/service/cognitoidp/user_pool.go
index 5fcf1a36acf..9a514cf0895 100644
--- a/internal/service/cognitoidp/user_pool.go
+++ b/internal/service/cognitoidp/user_pool.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cognitoidp
 
 import (
@@ -5,10 +8,10 @@ import (
 	"fmt"
 	"log"
 	"reflect"
-	"regexp"
 	"strings"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/cognitoidentityprovider"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -192,7 +195,7 @@ func ResourceUserPool() *schema.Resource {
 							Optional: true,
 							ValidateFunc: validation.Any(
 								validation.StringInSlice([]string{""}, false),
-								validation.StringMatch(regexp.MustCompile(`[\p{L}\p{M}\p{S}\p{N}\p{P}]+@[\p{L}\p{M}\p{S}\p{N}\p{P}]+`),
+								validation.StringMatch(regexache.MustCompile(`[\p{L}\p{M}\p{S}\p{N}\p{P}]+@[\p{L}\p{M}\p{S}\p{N}\p{P}]+`),
 									`must satisfy regular expression pattern: [\p{L}\p{M}\p{S}\p{N}\p{P}]+@[\p{L}\p{M}\p{S}\p{N}\p{P}]+`),
 							),
 						},
@@ -346,7 +349,7 @@ func ResourceUserPool() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.Any(
 					validation.StringLenBetween(1, 128),
-					validation.StringMatch(regexp.MustCompile(`[\w\s+=,.@-]+`),
+					validation.StringMatch(regexache.MustCompile(`[\w\s+=,.@-]+`),
 						`must satisfy regular expression pattern: [\w\s+=,.@-]+`),
 				),
 			},
@@ -1810,7 +1813,7 @@ func flattenUserPoolSchema(configuredAttributes, inputs []*cognitoidentityprovid
 			value["number_attribute_constraints"] = []map[string]interface{}{subvalue}
 		}
 
-		if input.StringAttributeConstraints != nil {
+		if input.StringAttributeConstraints != nil && !skipFlatteningStringAttributeContraints(configuredAttributes, input) {
 			subvalue := make(map[string]interface{})
 
 			if input.StringAttributeConstraints.MinLength != nil {
@@ -2297,3 +2300,26 @@ func flattenUserPoolUserAttributeUpdateSettings(u *cognitoidentityprovider.UserA
 
 	return []map[string]interface{}{m}
 }
+
+// skipFlatteningStringAttributeContraints returns true when all of the schema arguments
+// match an existing configured attribute, except an empty "string_attribute_constraints" block.
+// In this situation the Describe API returns default constraint values, and a persistent diff
+// would be present if written to state.
+func skipFlatteningStringAttributeContraints(configuredAttributes []*cognitoidentityprovider.SchemaAttributeType, input *cognitoidentityprovider.SchemaAttributeType) bool {
+	skip := false
+	for _, configuredAttribute := range configuredAttributes {
+		// Root elements are all equal
+		if reflect.DeepEqual(input.AttributeDataType, configuredAttribute.AttributeDataType) &&
+			reflect.DeepEqual(input.DeveloperOnlyAttribute, configuredAttribute.DeveloperOnlyAttribute) &&
+			reflect.DeepEqual(input.Mutable, configuredAttribute.Mutable) &&
+			reflect.DeepEqual(input.Name, configuredAttribute.Name) &&
+			reflect.DeepEqual(input.Required, configuredAttribute.Required) &&
+			// The configured "string_attribute_constraints" object is empty, but the returned value is not
+			(aws.StringValue(configuredAttribute.AttributeDataType) == cognitoidentityprovider.AttributeDataTypeString &&
+				configuredAttribute.StringAttributeConstraints == nil &&
+				input.StringAttributeConstraints != nil) {
+			skip = true
+		}
+	}
+	return skip
+}
diff --git a/internal/service/cognitoidp/user_pool_client.go b/internal/service/cognitoidp/user_pool_client.go
index 68c77e2f99b..4a09f52c713 100644
--- a/internal/service/cognitoidp/user_pool_client.go
+++ b/internal/service/cognitoidp/user_pool_client.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cognitoidp
 
 import (
@@ -23,6 +26,7 @@ import (
 	"github.com/hashicorp/terraform-plugin-framework/resource/schema/int64planmodifier"
 	"github.com/hashicorp/terraform-plugin-framework/resource/schema/planmodifier"
 	"github.com/hashicorp/terraform-plugin-framework/resource/schema/setplanmodifier"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema/stringdefault"
 	"github.com/hashicorp/terraform-plugin-framework/resource/schema/stringplanmodifier"
 	"github.com/hashicorp/terraform-plugin-framework/schema/validator"
 	"github.com/hashicorp/terraform-plugin-framework/types"
@@ -30,7 +34,6 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/create"
 	"github.com/hashicorp/terraform-provider-aws/internal/framework"
 	"github.com/hashicorp/terraform-provider-aws/internal/framework/flex"
-	fwstringplanmodifier "github.com/hashicorp/terraform-provider-aws/internal/framework/stringplanmodifier"
 	fwtypes "github.com/hashicorp/terraform-provider-aws/internal/framework/types"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -300,9 +303,7 @@ func (r *resourceUserPoolClient) Schema(ctx context.Context, request resource.Sc
 						"access_token": schema.StringAttribute{
 							Optional: true,
 							Computed: true,
-							PlanModifiers: []planmodifier.String{
-								fwstringplanmodifier.DefaultValue(cognitoidentityprovider.TimeUnitsTypeHours),
-							},
+							Default:  stringdefault.StaticString(cognitoidentityprovider.TimeUnitsTypeHours),
 							Validators: []validator.String{
 								stringvalidator.OneOf(cognitoidentityprovider.TimeUnitsType_Values()...),
 							},
@@ -310,9 +311,7 @@ func (r *resourceUserPoolClient) Schema(ctx context.Context, request resource.Sc
 						"id_token": schema.StringAttribute{
 							Optional: true,
 							Computed: true,
-							PlanModifiers: []planmodifier.String{
-								fwstringplanmodifier.DefaultValue(cognitoidentityprovider.TimeUnitsTypeHours),
-							},
+							Default:  stringdefault.StaticString(cognitoidentityprovider.TimeUnitsTypeHours),
 							Validators: []validator.String{
 								stringvalidator.OneOf(cognitoidentityprovider.TimeUnitsType_Values()...),
 							},
@@ -320,9 +319,7 @@ func (r *resourceUserPoolClient) Schema(ctx context.Context, request resource.Sc
 						"refresh_token": schema.StringAttribute{
 							Optional: true,
 							Computed: true,
-							PlanModifiers: []planmodifier.String{
-								fwstringplanmodifier.DefaultValue(cognitoidentityprovider.TimeUnitsTypeDays),
-							},
+							Default:  stringdefault.StaticString(cognitoidentityprovider.TimeUnitsTypeDays),
 							Validators: []validator.String{
 								stringvalidator.OneOf(cognitoidentityprovider.TimeUnitsType_Values()...),
 							},
@@ -439,7 +436,7 @@ func (r *resourceUserPoolClient) Read(ctx context.Context, request resource.Read
 	state.RefreshTokenValidity = flex.Int64ToFramework(ctx, poolClient.RefreshTokenValidity)
 	state.SupportedIdentityProviders = flex.FlattenFrameworkStringSetLegacy(ctx, poolClient.SupportedIdentityProviders)
 	if state.TokenValidityUnits.IsNull() && isDefaultTokenValidityUnits(poolClient.TokenValidityUnits) {
-		attributeTypes := framework.AttributeTypesMust[tokenValidityUnits](ctx)
+		attributeTypes := flex.AttributeTypesMust[tokenValidityUnits](ctx)
 		elemType := types.ObjectType{AttrTypes: attributeTypes}
 		state.TokenValidityUnits = types.ListNull(elemType)
 	} else {
@@ -521,7 +518,7 @@ func (r *resourceUserPoolClient) Update(ctx context.Context, request resource.Up
 	config.RefreshTokenValidity = flex.Int64ToFramework(ctx, poolClient.RefreshTokenValidity)
 	config.SupportedIdentityProviders = flex.FlattenFrameworkStringSetLegacy(ctx, poolClient.SupportedIdentityProviders)
 	if !state.TokenValidityUnits.IsNull() && plan.TokenValidityUnits.IsNull() && isDefaultTokenValidityUnits(poolClient.TokenValidityUnits) {
-		attributeTypes := framework.AttributeTypesMust[tokenValidityUnits](ctx)
+		attributeTypes := flex.AttributeTypesMust[tokenValidityUnits](ctx)
 		elemType := types.ObjectType{AttrTypes: attributeTypes}
 		config.TokenValidityUnits = types.ListNull(elemType)
 	} else {
@@ -709,10 +706,10 @@ func (ac *analyticsConfiguration) expand(ctx context.Context) *cognitoidentitypr
 		return nil
 	}
 	result := &cognitoidentityprovider.AnalyticsConfigurationType{
-		ApplicationArn: flex.ARNStringFromFramework(ctx, ac.ApplicationARN),
+		ApplicationArn: flex.StringFromFramework(ctx, ac.ApplicationARN),
 		ApplicationId:  flex.StringFromFramework(ctx, ac.ApplicationID),
 		ExternalId:     flex.StringFromFramework(ctx, ac.ExternalID),
-		RoleArn:        flex.ARNStringFromFramework(ctx, ac.RoleARN),
+		RoleArn:        flex.StringFromFramework(ctx, ac.RoleARN),
 		UserDataShared: flex.BoolFromFramework(ctx, ac.UserDataShared),
 	}
 
@@ -733,7 +730,7 @@ func expandAnaylticsConfiguration(ctx context.Context, list types.List, diags *d
 }
 
 func flattenAnaylticsConfiguration(ctx context.Context, ac *cognitoidentityprovider.AnalyticsConfigurationType, diags *diag.Diagnostics) types.List {
-	attributeTypes := framework.AttributeTypesMust[analyticsConfiguration](ctx)
+	attributeTypes := flex.AttributeTypesMust[analyticsConfiguration](ctx)
 	elemType := types.ObjectType{AttrTypes: attributeTypes}
 
 	if ac == nil {
@@ -799,7 +796,7 @@ func expandTokenValidityUnits(ctx context.Context, list types.List, diags *diag.
 }
 
 func flattenTokenValidityUnits(ctx context.Context, tvu *cognitoidentityprovider.TokenValidityUnitsType) types.List {
-	attributeTypes := framework.AttributeTypesMust[tokenValidityUnits](ctx)
+	attributeTypes := flex.AttributeTypesMust[tokenValidityUnits](ctx)
 	elemType := types.ObjectType{AttrTypes: attributeTypes}
 
 	if tvu == nil || (tvu.AccessToken == nil && tvu.IdToken == nil && tvu.RefreshToken == nil) {
diff --git a/internal/service/cognitoidp/user_pool_client_data_source.go b/internal/service/cognitoidp/user_pool_client_data_source.go
index 6055fb2c9bc..329b3aba191 100644
--- a/internal/service/cognitoidp/user_pool_client_data_source.go
+++ b/internal/service/cognitoidp/user_pool_client_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cognitoidp
 
 import (
diff --git a/internal/service/cognitoidp/user_pool_client_data_source_test.go b/internal/service/cognitoidp/user_pool_client_data_source_test.go
index c18a7871aa2..dbc39772e41 100644
--- a/internal/service/cognitoidp/user_pool_client_data_source_test.go
+++ b/internal/service/cognitoidp/user_pool_client_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cognitoidp_test
 
 import (
diff --git a/internal/service/cognitoidp/user_pool_client_test.go b/internal/service/cognitoidp/user_pool_client_test.go
index 9b88cd05ca3..8ab1b46bec7 100644
--- a/internal/service/cognitoidp/user_pool_client_test.go
+++ b/internal/service/cognitoidp/user_pool_client_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cognitoidp_test
 
 import (
 	"context"
 	"errors"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/cognitoidentityprovider"
 	"github.com/aws/aws-sdk-go/service/pinpoint"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -169,15 +172,15 @@ func TestAccCognitoIDPUserPoolClient_accessTokenValidity_error(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccUserPoolClientConfig_accessTokenValidity(rName, 25),
-				ExpectError: regexp.MustCompile(`Attribute access_token_validity must have a duration between 5m0s and\s+24h0m0s, got: 25h0m0s`),
+				ExpectError: regexache.MustCompile(`Attribute access_token_validity must have a duration between 5m0s and\s+24h0m0s, got: 25h0m0s`),
 			},
 			{
 				Config:      testAccUserPoolClientConfig_accessTokenValidityUnit(rName, 2, cognitoidentityprovider.TimeUnitsTypeDays),
-				ExpectError: regexp.MustCompile(`Attribute access_token_validity must have a duration between 5m0s and\s+24h0m0s, got: 48h0m0s`),
+				ExpectError: regexache.MustCompile(`Attribute access_token_validity must have a duration between 5m0s and\s+24h0m0s, got: 48h0m0s`),
 			},
 			{
 				Config:      testAccUserPoolClientConfig_accessTokenValidityUnit(rName, 4, cognitoidentityprovider.TimeUnitsTypeMinutes),
-				ExpectError: regexp.MustCompile(`Attribute access_token_validity must have a duration between 5m0s and\s+24h0m0s, got: 4m0s`),
+				ExpectError: regexache.MustCompile(`Attribute access_token_validity must have a duration between 5m0s and\s+24h0m0s, got: 4m0s`),
 			},
 		},
 	})
@@ -237,15 +240,15 @@ func TestAccCognitoIDPUserPoolClient_idTokenValidity_error(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccUserPoolClientConfig_idTokenValidity(rName, 25),
-				ExpectError: regexp.MustCompile(`Attribute id_token_validity must have a duration between 5m0s and\s+24h0m0s,\s+got: 25h0m0s`),
+				ExpectError: regexache.MustCompile(`Attribute id_token_validity must have a duration between 5m0s and\s+24h0m0s,\s+got: 25h0m0s`),
 			},
 			{
 				Config:      testAccUserPoolClientConfig_idTokenValidityUnit(rName, 2, cognitoidentityprovider.TimeUnitsTypeDays),
-				ExpectError: regexp.MustCompile(`Attribute id_token_validity must have a duration between 5m0s and\s+24h0m0s,\s+got: 48h0m0s`),
+				ExpectError: regexache.MustCompile(`Attribute id_token_validity must have a duration between 5m0s and\s+24h0m0s,\s+got: 48h0m0s`),
 			},
 			{
 				Config:      testAccUserPoolClientConfig_idTokenValidityUnit(rName, 4, cognitoidentityprovider.TimeUnitsTypeMinutes),
-				ExpectError: regexp.MustCompile(`Attribute id_token_validity must have a duration between 5m0s and\s+24h0m0s,\s+got: 4m0s`),
+				ExpectError: regexache.MustCompile(`Attribute id_token_validity must have a duration between 5m0s and\s+24h0m0s,\s+got: 4m0s`),
 			},
 		},
 	})
@@ -305,11 +308,11 @@ func TestAccCognitoIDPUserPoolClient_refreshTokenValidity_error(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccUserPoolClientConfig_refreshTokenValidity(rName, 10*365+1),
-				ExpectError: regexp.MustCompile(`Attribute refresh_token_validity must have a duration between 1h0m0s and\s+87600h0m0s,\s+got: 87624h0m0s`),
+				ExpectError: regexache.MustCompile(`Attribute refresh_token_validity must have a duration between 1h0m0s and\s+87600h0m0s,\s+got: 87624h0m0s`),
 			},
 			{
 				Config:      testAccUserPoolClientConfig_refreshTokenValidityUnit(rName, 59, cognitoidentityprovider.TimeUnitsTypeMinutes),
-				ExpectError: regexp.MustCompile(`Attribute refresh_token_validity must have a duration between 1h0m0s and\s+87600h0m0s,\s+got: 59m0s`),
+				ExpectError: regexache.MustCompile(`Attribute refresh_token_validity must have a duration between 1h0m0s and\s+87600h0m0s,\s+got: 59m0s`),
 			},
 		},
 	})
@@ -564,7 +567,7 @@ func TestAccCognitoIDPUserPoolClient_allFields(t *testing.T) {
 					resource.TestCheckTypeSetElemAttr(resourceName, "explicit_auth_flows.*", "USER_PASSWORD_AUTH"),
 					resource.TestCheckTypeSetElemAttr(resourceName, "explicit_auth_flows.*", "ADMIN_NO_SRP_AUTH"),
 					resource.TestCheckResourceAttr(resourceName, "generate_secret", "true"),
-					resource.TestMatchResourceAttr(resourceName, "client_secret", regexp.MustCompile(`\w+`)),
+					resource.TestMatchResourceAttr(resourceName, "client_secret", regexache.MustCompile(`\w+`)),
 					resource.TestCheckResourceAttr(resourceName, "read_attributes.#", "1"),
 					resource.TestCheckTypeSetElemAttr(resourceName, "read_attributes.*", "email"),
 					resource.TestCheckResourceAttr(resourceName, "write_attributes.#", "1"),
diff --git a/internal/service/cognitoidp/user_pool_clients_data_source.go b/internal/service/cognitoidp/user_pool_clients_data_source.go
index aabf8a9cfdf..e4d20ccda87 100644
--- a/internal/service/cognitoidp/user_pool_clients_data_source.go
+++ b/internal/service/cognitoidp/user_pool_clients_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cognitoidp
 
 import (
diff --git a/internal/service/cognitoidp/user_pool_clients_data_source_test.go b/internal/service/cognitoidp/user_pool_clients_data_source_test.go
index 2a888e3c298..be7c4d78dee 100644
--- a/internal/service/cognitoidp/user_pool_clients_data_source_test.go
+++ b/internal/service/cognitoidp/user_pool_clients_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cognitoidp_test
 
 import (
diff --git a/internal/service/cognitoidp/user_pool_domain.go b/internal/service/cognitoidp/user_pool_domain.go
index 1828e704b3b..834b47cf51b 100644
--- a/internal/service/cognitoidp/user_pool_domain.go
+++ b/internal/service/cognitoidp/user_pool_domain.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cognitoidp
 
 import (
diff --git a/internal/service/cognitoidp/user_pool_domain_test.go b/internal/service/cognitoidp/user_pool_domain_test.go
index 2daa3832101..c5038a35057 100644
--- a/internal/service/cognitoidp/user_pool_domain_test.go
+++ b/internal/service/cognitoidp/user_pool_domain_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cognitoidp_test
 
 import (
diff --git a/internal/service/cognitoidp/user_pool_signing_certificate_data_source.go b/internal/service/cognitoidp/user_pool_signing_certificate_data_source.go
index 9cababc6338..48df4e17f98 100644
--- a/internal/service/cognitoidp/user_pool_signing_certificate_data_source.go
+++ b/internal/service/cognitoidp/user_pool_signing_certificate_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cognitoidp
 
 import (
diff --git a/internal/service/cognitoidp/user_pool_signing_certificate_data_source_test.go b/internal/service/cognitoidp/user_pool_signing_certificate_data_source_test.go
index e808b8a1dfd..bb1642008d2 100644
--- a/internal/service/cognitoidp/user_pool_signing_certificate_data_source_test.go
+++ b/internal/service/cognitoidp/user_pool_signing_certificate_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cognitoidp_test
 
 import (
diff --git a/internal/service/cognitoidp/user_pool_test.go b/internal/service/cognitoidp/user_pool_test.go
index 73aa4a82529..77bc41f5cab 100644
--- a/internal/service/cognitoidp/user_pool_test.go
+++ b/internal/service/cognitoidp/user_pool_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cognitoidp_test
 
 import (
@@ -5,10 +8,10 @@ import (
 	"errors"
 	"fmt"
 	"os"
-	"regexp"
 	"strings"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/cognitoidentityprovider"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -45,8 +48,8 @@ func TestAccCognitoIDPUserPool_basic(t *testing.T) {
 				Config: testAccUserPoolConfig_name(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckUserPoolExists(ctx, resourceName, nil),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "cognito-idp", regexp.MustCompile(`userpool/.+`)),
-					resource.TestMatchResourceAttr(resourceName, "endpoint", regexp.MustCompile(`^cognito-idp\.[^.]+\.amazonaws.com/[\w-]+_[0-9a-zA-Z]+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "cognito-idp", regexache.MustCompile(`userpool/.+`)),
+					resource.TestMatchResourceAttr(resourceName, "endpoint", regexache.MustCompile(`^cognito-idp\.[^.]+\.amazonaws.com/[\w-]+_[0-9A-Za-z]+$`)),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttrSet(resourceName, "creation_date"),
 					resource.TestCheckResourceAttrSet(resourceName, "last_modified_date"),
@@ -1353,7 +1356,7 @@ func TestAccCognitoIDPUserPool_schemaAttributesRemoved(t *testing.T) {
 			},
 			{
 				Config:      testAccUserPoolConfig_schemaAttributes(rName),
-				ExpectError: regexp.MustCompile("cannot modify or remove schema items"),
+				ExpectError: regexache.MustCompile("cannot modify or remove schema items"),
 			},
 		},
 	})
@@ -1374,7 +1377,38 @@ func TestAccCognitoIDPUserPool_schemaAttributesModified(t *testing.T) {
 			},
 			{
 				Config:      testAccUserPoolConfig_schemaAttributesUpdated(rName, "mybool2"),
-				ExpectError: regexp.MustCompile("cannot modify or remove schema items"),
+				ExpectError: regexache.MustCompile("cannot modify or remove schema items"),
+			},
+		},
+	})
+}
+
+// Ref: https://github.com/hashicorp/terraform-provider-aws/issues/21654
+func TestAccCognitoIDPUserPool_schemaAttributesStringAttributeConstraints(t *testing.T) {
+	ctx := acctest.Context(t)
+	var pool cognitoidentityprovider.DescribeUserPoolOutput
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_cognito_user_pool.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheckIdentityProvider(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, cognitoidentityprovider.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckUserPoolDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				// Omit optional "string_attribute_constraints" schema argument to verify a persistent
+				// diff is not present when AWS returns default values in the nested object.
+				Config: testAccUserPoolConfig_schemaAttributesStringAttributeConstraints(rName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckUserPoolExists(ctx, resourceName, &pool),
+				),
+			},
+			{
+				// Attempting to explicitly set constraints to non-default values after creation
+				// should trigger an error
+				Config:      testAccUserPoolConfig_schemaAttributes(rName),
+				ExpectError: regexache.MustCompile("cannot modify or remove schema items"),
 			},
 		},
 	})
@@ -1561,7 +1595,7 @@ func TestAccCognitoIDPUserPool_withUserAttributeUpdateSettings(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccUserPoolConfig_userAttributeUpdateSettings(rName, "invalid_value"),
-				ExpectError: regexp.MustCompile("expected user_attribute_update_settings.0.attributes_require_verification_before_update.0 to be one of"),
+				ExpectError: regexache.MustCompile("expected user_attribute_update_settings.0.attributes_require_verification_before_update.0 to be one of"),
 			},
 			{
 				Config: testAccUserPoolConfig_userAttributeUpdateSettings(rName, cognitoidentityprovider.VerifiedAttributeTypeEmail),
@@ -2455,6 +2489,30 @@ resource "aws_cognito_user_pool" "test" {
 `, name, boolname)
 }
 
+func testAccUserPoolConfig_schemaAttributesStringAttributeConstraints(name string) string {
+	return fmt.Sprintf(`
+resource "aws_cognito_user_pool" "test" {
+  name = "%[1]s"
+
+  schema {
+    attribute_data_type      = "String"
+    developer_only_attribute = false
+    mutable                  = false
+    name                     = "email"
+    required                 = true
+  }
+
+  schema {
+    attribute_data_type      = "Boolean"
+    developer_only_attribute = true
+    mutable                  = false
+    name                     = "mybool"
+    required                 = false
+  }
+}
+`, name)
+}
+
 func testAccUserPoolConfig_verificationMessageTemplate(name string) string {
 	return fmt.Sprintf(`
 resource "aws_cognito_user_pool" "test" {
diff --git a/internal/service/cognitoidp/user_pool_ui_customization.go b/internal/service/cognitoidp/user_pool_ui_customization.go
index 28ea39a067f..4f81a42b7bb 100644
--- a/internal/service/cognitoidp/user_pool_ui_customization.go
+++ b/internal/service/cognitoidp/user_pool_ui_customization.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cognitoidp
 
 import (
diff --git a/internal/service/cognitoidp/user_pool_ui_customization_test.go b/internal/service/cognitoidp/user_pool_ui_customization_test.go
index 3068d017df0..7b35c890a58 100644
--- a/internal/service/cognitoidp/user_pool_ui_customization_test.go
+++ b/internal/service/cognitoidp/user_pool_ui_customization_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cognitoidp_test
 
 import (
diff --git a/internal/service/cognitoidp/user_pools_data_source.go b/internal/service/cognitoidp/user_pools_data_source.go
index 49f9f395eaf..828dacee1c5 100644
--- a/internal/service/cognitoidp/user_pools_data_source.go
+++ b/internal/service/cognitoidp/user_pools_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cognitoidp
 
 import (
diff --git a/internal/service/cognitoidp/user_pools_data_source_test.go b/internal/service/cognitoidp/user_pools_data_source_test.go
index b4a104c4b9e..630ab135f98 100644
--- a/internal/service/cognitoidp/user_pools_data_source_test.go
+++ b/internal/service/cognitoidp/user_pools_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cognitoidp_test
 
 import (
diff --git a/internal/service/cognitoidp/user_test.go b/internal/service/cognitoidp/user_test.go
index c351ff94d94..f93d62b8f3b 100644
--- a/internal/service/cognitoidp/user_test.go
+++ b/internal/service/cognitoidp/user_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cognitoidp_test
 
 import (
diff --git a/internal/service/cognitoidp/validate.go b/internal/service/cognitoidp/validate.go
index 3ccba82c56e..d04108d8877 100644
--- a/internal/service/cognitoidp/validate.go
+++ b/internal/service/cognitoidp/validate.go
@@ -1,9 +1,12 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cognitoidp
 
 import (
 	"fmt"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/hashicorp/terraform-plugin-framework-validators/stringvalidator"
 	"github.com/hashicorp/terraform-plugin-framework/schema/validator"
 )
@@ -17,7 +20,7 @@ func validResourceServerScopeName(v interface{}, k string) (ws []string, errors
 	if len(value) > 256 {
 		errors = append(errors, fmt.Errorf("%q cannot be longer than 256 character", k))
 	}
-	if !regexp.MustCompile(`[\x21\x23-\x2E\x30-\x5B\x5D-\x7E]+`).MatchString(value) {
+	if !regexache.MustCompile(`[\x21\x23-\x2E\x30-\x5B\x5D-\x7E]+`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(`%q must satisfy regular expression pattern: [\x21\x23-\x2E\x30-\x5B\x5D-\x7E]+`, k))
 	}
 	return
@@ -33,7 +36,7 @@ func validUserGroupName(v interface{}, k string) (ws []string, es []error) {
 		es = append(es, fmt.Errorf("%q cannot be longer than 128 character", k))
 	}
 
-	if !regexp.MustCompile(`[\p{L}\p{M}\p{S}\p{N}\p{P}]+`).MatchString(value) {
+	if !regexache.MustCompile(`[\p{L}\p{M}\p{S}\p{N}\p{P}]+`).MatchString(value) {
 		es = append(es, fmt.Errorf(`%q must satisfy regular expression pattern: [\p{L}\p{M}\p{S}\p{N}\p{P}]+`, k))
 	}
 	return
@@ -49,7 +52,7 @@ func validUserPoolEmailVerificationMessage(v interface{}, k string) (ws []string
 		es = append(es, fmt.Errorf("%q cannot be longer than 20000 characters", k))
 	}
 
-	if !regexp.MustCompile(`[\p{L}\p{M}\p{S}\p{N}\p{P}\s*]*\{####\}[\p{L}\p{M}\p{S}\p{N}\p{P}\s*]*`).MatchString(value) {
+	if !regexache.MustCompile(`[\p{L}\p{M}\p{S}\p{N}\p{P}\s*]*\{####\}[\p{L}\p{M}\p{S}\p{N}\p{P}\s*]*`).MatchString(value) {
 		es = append(es, fmt.Errorf("%q does not contain {####}", k))
 	}
 	return
@@ -65,7 +68,7 @@ func validUserPoolEmailVerificationSubject(v interface{}, k string) (ws []string
 		es = append(es, fmt.Errorf("%q cannot be longer than 140 characters", k))
 	}
 
-	if !regexp.MustCompile(`[\p{L}\p{M}\p{S}\p{N}\p{P}\s]+`).MatchString(value) {
+	if !regexache.MustCompile(`[\p{L}\p{M}\p{S}\p{N}\p{P}\s]+`).MatchString(value) {
 		es = append(es, fmt.Errorf("%q can be composed of any kind of letter, symbols, numeric character, punctuation and whitespaces", k))
 	}
 	return
@@ -73,7 +76,7 @@ func validUserPoolEmailVerificationSubject(v interface{}, k string) (ws []string
 
 func validUserPoolID(v interface{}, k string) (ws []string, es []error) {
 	value := v.(string)
-	if !regexp.MustCompile(`^[\w-]+_[0-9a-zA-Z]+$`).MatchString(value) {
+	if !regexache.MustCompile(`^[\w-]+_[0-9A-Za-z]+$`).MatchString(value) {
 		es = append(es, fmt.Errorf("%q must be the region name followed by an underscore and then alphanumeric pattern", k))
 	}
 	return
@@ -89,11 +92,11 @@ func validUserPoolInviteTemplateEmailMessage(v interface{}, k string) (ws []stri
 		es = append(es, fmt.Errorf("%q cannot be longer than 20000 characters", k))
 	}
 
-	if !regexp.MustCompile(`[\p{L}\p{M}\p{S}\p{N}\p{P}\s*]*\{####\}[\p{L}\p{M}\p{S}\p{N}\p{P}\s*]*`).MatchString(value) {
+	if !regexache.MustCompile(`[\p{L}\p{M}\p{S}\p{N}\p{P}\s*]*\{####\}[\p{L}\p{M}\p{S}\p{N}\p{P}\s*]*`).MatchString(value) {
 		es = append(es, fmt.Errorf("%q does not contain {####}", k))
 	}
 
-	if !regexp.MustCompile(`.*\{username\}.*`).MatchString(value) {
+	if !regexache.MustCompile(`.*\{username\}.*`).MatchString(value) {
 		es = append(es, fmt.Errorf("%q does not contain {username}", k))
 	}
 	return
@@ -109,11 +112,11 @@ func validUserPoolInviteTemplateSMSMessage(v interface{}, k string) (ws []string
 		es = append(es, fmt.Errorf("%q cannot be longer than 140 characters", k))
 	}
 
-	if !regexp.MustCompile(`.*\{####\}.*`).MatchString(value) {
+	if !regexache.MustCompile(`.*\{####\}.*`).MatchString(value) {
 		es = append(es, fmt.Errorf("%q does not contain {####}", k))
 	}
 
-	if !regexp.MustCompile(`.*\{username\}.*`).MatchString(value) {
+	if !regexache.MustCompile(`.*\{username\}.*`).MatchString(value) {
 		es = append(es, fmt.Errorf("%q does not contain {username}", k))
 	}
 	return
@@ -129,7 +132,7 @@ func validUserPoolSchemaName(v interface{}, k string) (ws []string, es []error)
 		es = append(es, fmt.Errorf("%q cannot be longer than 20 character", k))
 	}
 
-	if !regexp.MustCompile(`[\p{L}\p{M}\p{S}\p{N}\p{P}]+`).MatchString(value) {
+	if !regexache.MustCompile(`[\p{L}\p{M}\p{S}\p{N}\p{P}]+`).MatchString(value) {
 		es = append(es, fmt.Errorf(`%q must satisfy regular expression pattern: [\p{L}\p{M}\p{S}\p{N}\p{P}]+`, k))
 	}
 	return
@@ -145,7 +148,7 @@ func validUserPoolSMSAuthenticationMessage(v interface{}, k string) (ws []string
 		es = append(es, fmt.Errorf("%q cannot be longer than 140 characters", k))
 	}
 
-	if !regexp.MustCompile(`.*\{####\}.*`).MatchString(value) {
+	if !regexache.MustCompile(`.*\{####\}.*`).MatchString(value) {
 		es = append(es, fmt.Errorf("%q does not contain {####}", k))
 	}
 	return
@@ -161,7 +164,7 @@ func validUserPoolSMSVerificationMessage(v interface{}, k string) (ws []string,
 		es = append(es, fmt.Errorf("%q cannot be longer than 140 characters", k))
 	}
 
-	if !regexp.MustCompile(`.*\{####\}.*`).MatchString(value) {
+	if !regexache.MustCompile(`.*\{####\}.*`).MatchString(value) {
 		es = append(es, fmt.Errorf("%q does not contain {####}", k))
 	}
 	return
@@ -177,7 +180,7 @@ func validUserPoolTemplateEmailMessage(v interface{}, k string) (ws []string, es
 		es = append(es, fmt.Errorf("%q cannot be longer than 20000 characters", k))
 	}
 
-	if !regexp.MustCompile(`[\p{L}\p{M}\p{S}\p{N}\p{P}\s*]*\{####\}[\p{L}\p{M}\p{S}\p{N}\p{P}\s*]*`).MatchString(value) {
+	if !regexache.MustCompile(`[\p{L}\p{M}\p{S}\p{N}\p{P}\s*]*\{####\}[\p{L}\p{M}\p{S}\p{N}\p{P}\s*]*`).MatchString(value) {
 		es = append(es, fmt.Errorf("%q does not contain {####}", k))
 	}
 	return
@@ -193,7 +196,7 @@ func validUserPoolTemplateEmailMessageByLink(v interface{}, k string) (ws []stri
 		es = append(es, fmt.Errorf("%q cannot be longer than 20000 characters", k))
 	}
 
-	if !regexp.MustCompile(`[\p{L}\p{M}\p{S}\p{N}\p{P}\s*]*\{##[\p{L}\p{M}\p{S}\p{N}\p{P}\s*]*##\}[\p{L}\p{M}\p{S}\p{N}\p{P}\s*]*`).MatchString(value) {
+	if !regexache.MustCompile(`[\p{L}\p{M}\p{S}\p{N}\p{P}\s*]*\{##[\p{L}\p{M}\p{S}\p{N}\p{P}\s*]*##\}[\p{L}\p{M}\p{S}\p{N}\p{P}\s*]*`).MatchString(value) {
 		es = append(es, fmt.Errorf(`%q must satisfy regular expression pattern: [\p{L}\p{M}\p{S}\p{N}\p{P}\s*]*\{##[\p{L}\p{M}\p{S}\p{N}\p{P}\s*]*##\}[\p{L}\p{M}\p{S}\p{N}\p{P}\s*]*`, k))
 	}
 	return
@@ -209,7 +212,7 @@ func validUserPoolTemplateEmailSubject(v interface{}, k string) (ws []string, es
 		es = append(es, fmt.Errorf("%q cannot be longer than 140 characters", k))
 	}
 
-	if !regexp.MustCompile(`[\p{L}\p{M}\p{S}\p{N}\p{P}\s]+`).MatchString(value) {
+	if !regexache.MustCompile(`[\p{L}\p{M}\p{S}\p{N}\p{P}\s]+`).MatchString(value) {
 		es = append(es, fmt.Errorf(`%q must satisfy regular expression pattern: [\p{L}\p{M}\p{S}\p{N}\p{P}\s]+`, k))
 	}
 	return
@@ -225,7 +228,7 @@ func validUserPoolTemplateEmailSubjectByLink(v interface{}, k string) (ws []stri
 		es = append(es, fmt.Errorf("%q cannot be longer than 140 characters", k))
 	}
 
-	if !regexp.MustCompile(`[\p{L}\p{M}\p{S}\p{N}\p{P}\s]+`).MatchString(value) {
+	if !regexache.MustCompile(`[\p{L}\p{M}\p{S}\p{N}\p{P}\s]+`).MatchString(value) {
 		es = append(es, fmt.Errorf(`%q must satisfy regular expression pattern: [\p{L}\p{M}\p{S}\p{N}\p{P}\s]+`, k))
 	}
 	return
@@ -241,7 +244,7 @@ func validUserPoolTemplateSMSMessage(v interface{}, k string) (ws []string, es [
 		es = append(es, fmt.Errorf("%q cannot be longer than 140 characters", k))
 	}
 
-	if !regexp.MustCompile(`.*\{####\}.*`).MatchString(value) {
+	if !regexache.MustCompile(`.*\{####\}.*`).MatchString(value) {
 		es = append(es, fmt.Errorf("%q does not contain {####}", k))
 	}
 	return
@@ -263,11 +266,11 @@ var userPoolClientURLValidator = []validator.String{
 }
 
 var stringValidatorUserPoolClientName = stringvalidator.RegexMatches(
-	regexp.MustCompile(`[\w\s+=,.@-]+`),
+	regexache.MustCompile(`[\w\s+=,.@-]+`),
 	`can include any letter, number, space, tab, or one of "+=,.@-"`,
 )
 
 var stringValidatorpLpMpSpNpP = stringvalidator.RegexMatches(
-	regexp.MustCompile(`[\p{L}\p{M}\p{S}\p{N}\p{P}]+`),
+	regexache.MustCompile(`[\p{L}\p{M}\p{S}\p{N}\p{P}]+`),
 	"can include any valid Unicode letter, combining character, symbol, number, or punctuation",
 )
diff --git a/internal/service/cognitoidp/validate_test.go b/internal/service/cognitoidp/validate_test.go
index fea7541fa9f..00b5d87a9d2 100644
--- a/internal/service/cognitoidp/validate_test.go
+++ b/internal/service/cognitoidp/validate_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cognitoidp
 
 import (
diff --git a/internal/service/comprehend/acc_test.go b/internal/service/comprehend/acc_test.go
index 799e4adefc9..75f6fe46038 100644
--- a/internal/service/comprehend/acc_test.go
+++ b/internal/service/comprehend/acc_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package comprehend_test
 
 import (
diff --git a/internal/service/comprehend/common_model.go b/internal/service/comprehend/common_model.go
index 62c6ee1db88..d35e4d6969c 100644
--- a/internal/service/comprehend/common_model.go
+++ b/internal/service/comprehend/common_model.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package comprehend
 
 import (
diff --git a/internal/service/comprehend/consts.go b/internal/service/comprehend/consts.go
index e57884a12d2..c500235f3cb 100644
--- a/internal/service/comprehend/consts.go
+++ b/internal/service/comprehend/consts.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package comprehend
 
 import (
diff --git a/internal/service/comprehend/document_classifier.go b/internal/service/comprehend/document_classifier.go
index 7bbf4fe5d26..21da16f2340 100644
--- a/internal/service/comprehend/document_classifier.go
+++ b/internal/service/comprehend/document_classifier.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package comprehend
 
 import (
@@ -5,10 +8,10 @@ import (
 	"errors"
 	"fmt"
 	"log"
-	"regexp"
 	"strings"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/aws/arn"
 	"github.com/aws/aws-sdk-go-v2/aws/ratelimit"
@@ -739,7 +742,7 @@ func flattenDocumentClassifierOutputDataConfig(apiObject *types.DocumentClassifi
 		"output_s3_uri": s3Uri,
 	}
 
-	re := regexp.MustCompile(`^(s3://[-a-z0-9.]{3,63}(/.+)?/)[-a-zA-Z0-9]+/output/output\.tar\.gz`)
+	re := regexache.MustCompile(`^(s3://[0-9a-z.-]{3,63}(/.+)?/)[0-9A-Za-z-]+/output/output\.tar\.gz`)
 	match := re.FindStringSubmatch(s3Uri)
 	if match != nil && match[1] != "" {
 		m["s3_uri"] = match[1]
@@ -807,7 +810,7 @@ func DocumentClassifierParseARN(arnString string) (string, error) {
 	if err != nil {
 		return "", err
 	}
-	re := regexp.MustCompile(`^document-classifier/([[:alnum:]-]+)`)
+	re := regexache.MustCompile(`^document-classifier/([[:alnum:]-]+)`)
 	matches := re.FindStringSubmatch(arn.Resource)
 	if len(matches) != 2 {
 		return "", fmt.Errorf("unable to parse %q", arnString)
diff --git a/internal/service/comprehend/document_classifier_test.go b/internal/service/comprehend/document_classifier_test.go
index 24e7699e468..f1a0898e09a 100644
--- a/internal/service/comprehend/document_classifier_test.go
+++ b/internal/service/comprehend/document_classifier_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package comprehend_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/comprehend"
 	"github.com/aws/aws-sdk-go-v2/service/comprehend/types"
@@ -46,7 +49,7 @@ func TestAccComprehendDocumentClassifier_basic(t *testing.T) {
 					testAccCheckDocumentClassifierPublishedVersions(ctx, resourceName, 1),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttrPair(resourceName, "data_access_role_arn", "aws_iam_role.test", "arn"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "comprehend", regexp.MustCompile(fmt.Sprintf(`document-classifier/%s/version/%s$`, rName, uniqueIDPattern()))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "comprehend", regexache.MustCompile(fmt.Sprintf(`document-classifier/%s/version/%s$`, rName, uniqueIDPattern()))),
 					resource.TestCheckResourceAttr(resourceName, "input_data_config.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "input_data_config.0.augmented_manifests.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "input_data_config.0.data_format", string(types.DocumentClassifierDataFormatComprehendCsv)),
@@ -140,7 +143,7 @@ func TestAccComprehendDocumentClassifier_versionName(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "version_name", vName1),
 					resource.TestCheckResourceAttr(resourceName, "version_name_prefix", ""),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "comprehend", regexp.MustCompile(fmt.Sprintf(`document-classifier/%s/version/%s$`, rName, vName1))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "comprehend", regexache.MustCompile(fmt.Sprintf(`document-classifier/%s/version/%s$`, rName, vName1))),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key", "value1"),
 				),
@@ -158,7 +161,7 @@ func TestAccComprehendDocumentClassifier_versionName(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "version_name", vName2),
 					resource.TestCheckResourceAttr(resourceName, "version_name_prefix", ""),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "comprehend", regexp.MustCompile(fmt.Sprintf(`document-classifier/%s/version/%s$`, rName, vName2))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "comprehend", regexache.MustCompile(fmt.Sprintf(`document-classifier/%s/version/%s$`, rName, vName2))),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key", "value2"),
 				),
@@ -200,7 +203,7 @@ func TestAccComprehendDocumentClassifier_versionNameEmpty(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "version_name", ""),
 					resource.TestCheckResourceAttr(resourceName, "version_name_prefix", ""),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "comprehend", regexp.MustCompile(fmt.Sprintf(`document-classifier/%s$`, rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "comprehend", regexache.MustCompile(fmt.Sprintf(`document-classifier/%s$`, rName))),
 				),
 			},
 			{
@@ -239,7 +242,7 @@ func TestAccComprehendDocumentClassifier_versionNameGenerated(t *testing.T) {
 					testAccCheckDocumentClassifierPublishedVersions(ctx, resourceName, 1),
 					acctest.CheckResourceAttrNameGenerated(resourceName, "version_name"),
 					resource.TestCheckResourceAttr(resourceName, "version_name_prefix", id.UniqueIdPrefix),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "comprehend", regexp.MustCompile(fmt.Sprintf(`document-classifier/%s/version/%s$`, rName, uniqueIDPattern()))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "comprehend", regexache.MustCompile(fmt.Sprintf(`document-classifier/%s/version/%s$`, rName, uniqueIDPattern()))),
 				),
 			},
 			{
@@ -278,7 +281,7 @@ func TestAccComprehendDocumentClassifier_versionNamePrefix(t *testing.T) {
 					testAccCheckDocumentClassifierPublishedVersions(ctx, resourceName, 1),
 					acctest.CheckResourceAttrNameFromPrefix(resourceName, "version_name", "tf-acc-test-prefix-"),
 					resource.TestCheckResourceAttr(resourceName, "version_name_prefix", "tf-acc-test-prefix-"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "comprehend", regexp.MustCompile(fmt.Sprintf(`document-classifier/%s/version/%s$`, rName, prefixedUniqueIDPattern("tf-acc-test-prefix-")))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "comprehend", regexache.MustCompile(fmt.Sprintf(`document-classifier/%s/version/%s$`, rName, prefixedUniqueIDPattern("tf-acc-test-prefix-")))),
 				),
 			},
 			{
@@ -316,7 +319,7 @@ func TestAccComprehendDocumentClassifier_testDocuments(t *testing.T) {
 					testAccCheckDocumentClassifierExists(ctx, resourceName, &documentclassifier),
 					testAccCheckDocumentClassifierPublishedVersions(ctx, resourceName, 1),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "comprehend", regexp.MustCompile(fmt.Sprintf(`document-classifier/%s/version/%s$`, rName, uniqueIDPattern()))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "comprehend", regexache.MustCompile(fmt.Sprintf(`document-classifier/%s/version/%s$`, rName, uniqueIDPattern()))),
 					resource.TestCheckResourceAttr(resourceName, "input_data_config.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "input_data_config.0.augmented_manifests.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "input_data_config.0.data_format", string(types.DocumentClassifierDataFormatComprehendCsv)),
@@ -360,19 +363,19 @@ func TestAccComprehendDocumentClassifier_SingleLabel_ValidateNoDelimiterSet(t *t
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccDocumentClassifierConfig_modeDefault_ValidateNoDelimiterSet(rName, tfcomprehend.DocumentClassifierLabelSeparatorDefault),
-				ExpectError: regexp.MustCompile(fmt.Sprintf(`input_data_config.label_delimiter must not be set when mode is %s`, types.DocumentClassifierModeMultiClass)),
+				ExpectError: regexache.MustCompile(fmt.Sprintf(`input_data_config.label_delimiter must not be set when mode is %s`, types.DocumentClassifierModeMultiClass)),
 			},
 			{
 				Config:      testAccDocumentClassifierConfig_modeDefault_ValidateNoDelimiterSet(rName, ">"),
-				ExpectError: regexp.MustCompile(fmt.Sprintf(`input_data_config.label_delimiter must not be set when mode is %s`, types.DocumentClassifierModeMultiClass)),
+				ExpectError: regexache.MustCompile(fmt.Sprintf(`input_data_config.label_delimiter must not be set when mode is %s`, types.DocumentClassifierModeMultiClass)),
 			},
 			{
 				Config:      testAccDocumentClassifierConfig_modeSingleLabel_ValidateNoDelimiterSet(rName, tfcomprehend.DocumentClassifierLabelSeparatorDefault),
-				ExpectError: regexp.MustCompile(fmt.Sprintf(`input_data_config.label_delimiter must not be set when mode is %s`, types.DocumentClassifierModeMultiClass)),
+				ExpectError: regexache.MustCompile(fmt.Sprintf(`input_data_config.label_delimiter must not be set when mode is %s`, types.DocumentClassifierModeMultiClass)),
 			},
 			{
 				Config:      testAccDocumentClassifierConfig_modeSingleLabel_ValidateNoDelimiterSet(rName, ">"),
-				ExpectError: regexp.MustCompile(fmt.Sprintf(`input_data_config.label_delimiter must not be set when mode is %s`, types.DocumentClassifierModeMultiClass)),
+				ExpectError: regexache.MustCompile(fmt.Sprintf(`input_data_config.label_delimiter must not be set when mode is %s`, types.DocumentClassifierModeMultiClass)),
 			},
 		},
 	})
@@ -405,7 +408,7 @@ func TestAccComprehendDocumentClassifier_multiLabel_basic(t *testing.T) {
 					testAccCheckDocumentClassifierPublishedVersions(ctx, resourceName, 1),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttrPair(resourceName, "data_access_role_arn", "aws_iam_role.test", "arn"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "comprehend", regexp.MustCompile(fmt.Sprintf(`document-classifier/%s/version/%s$`, rName, uniqueIDPattern()))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "comprehend", regexache.MustCompile(fmt.Sprintf(`document-classifier/%s/version/%s$`, rName, uniqueIDPattern()))),
 					resource.TestCheckResourceAttr(resourceName, "input_data_config.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "input_data_config.0.augmented_manifests.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "input_data_config.0.data_format", string(types.DocumentClassifierDataFormatComprehendCsv)),
@@ -460,8 +463,8 @@ func TestAccComprehendDocumentClassifier_outputDataConfig_basic(t *testing.T) {
 					testAccCheckDocumentClassifierExists(ctx, resourceName, &documentclassifier),
 					testAccCheckDocumentClassifierPublishedVersions(ctx, resourceName, 1),
 					resource.TestCheckResourceAttr(resourceName, "output_data_config.#", "1"),
-					resource.TestMatchResourceAttr(resourceName, "output_data_config.0.s3_uri", regexp.MustCompile(`s3://.+/outputs`)),
-					resource.TestMatchResourceAttr(resourceName, "output_data_config.0.output_s3_uri", regexp.MustCompile(`s3://.+/outputs/[-A-Za-z0-9]+/output/output.tar.gz`)),
+					resource.TestMatchResourceAttr(resourceName, "output_data_config.0.s3_uri", regexache.MustCompile(`s3://.+/outputs`)),
+					resource.TestMatchResourceAttr(resourceName, "output_data_config.0.output_s3_uri", regexache.MustCompile(`s3://.+/outputs/[0-9A-Za-z-]+/output/output.tar.gz`)),
 				),
 			},
 			{
@@ -815,7 +818,7 @@ func TestAccComprehendDocumentClassifier_multiLabel_labelDelimiter(t *testing.T)
 					testAccCheckDocumentClassifierPublishedVersions(ctx, resourceName, 1),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttrPair(resourceName, "data_access_role_arn", "aws_iam_role.test", "arn"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "comprehend", regexp.MustCompile(fmt.Sprintf(`document-classifier/%s/version/%s$`, rName, uniqueIDPattern()))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "comprehend", regexache.MustCompile(fmt.Sprintf(`document-classifier/%s/version/%s$`, rName, uniqueIDPattern()))),
 					resource.TestCheckResourceAttr(resourceName, "input_data_config.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "input_data_config.0.augmented_manifests.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "input_data_config.0.data_format", string(types.DocumentClassifierDataFormatComprehendCsv)),
diff --git a/internal/service/comprehend/entity_recognizer.go b/internal/service/comprehend/entity_recognizer.go
index 009f99e8b5d..20fb347c621 100644
--- a/internal/service/comprehend/entity_recognizer.go
+++ b/internal/service/comprehend/entity_recognizer.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package comprehend
 
 import (
@@ -5,9 +8,9 @@ import (
 	"errors"
 	"fmt"
 	"log"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/aws/arn"
 	"github.com/aws/aws-sdk-go-v2/aws/ratelimit"
@@ -942,7 +945,7 @@ func EntityRecognizerParseARN(arnString string) (string, error) {
 	if err != nil {
 		return "", err
 	}
-	re := regexp.MustCompile(`^entity-recognizer/([[:alnum:]-]+)`)
+	re := regexache.MustCompile(`^entity-recognizer/([[:alnum:]-]+)`)
 	matches := re.FindStringSubmatch(arn.Resource)
 	if len(matches) != 2 {
 		return "", fmt.Errorf("unable to parse %q", arnString)
diff --git a/internal/service/comprehend/entity_recognizer_test.go b/internal/service/comprehend/entity_recognizer_test.go
index 5692d98ba8f..c1404c16413 100644
--- a/internal/service/comprehend/entity_recognizer_test.go
+++ b/internal/service/comprehend/entity_recognizer_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package comprehend_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/comprehend"
 	"github.com/aws/aws-sdk-go-v2/service/comprehend/types"
@@ -46,7 +49,7 @@ func TestAccComprehendEntityRecognizer_basic(t *testing.T) {
 					testAccCheckEntityRecognizerPublishedVersions(ctx, resourceName, 1),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttrPair(resourceName, "data_access_role_arn", "aws_iam_role.test", "arn"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "comprehend", regexp.MustCompile(fmt.Sprintf(`entity-recognizer/%s/version/%s$`, rName, uniqueIDPattern()))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "comprehend", regexache.MustCompile(fmt.Sprintf(`entity-recognizer/%s/version/%s$`, rName, uniqueIDPattern()))),
 					resource.TestCheckResourceAttr(resourceName, "input_data_config.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "input_data_config.0.entity_types.#", "2"),
 					resource.TestCheckResourceAttr(resourceName, "input_data_config.0.annotations.#", "0"),
@@ -137,7 +140,7 @@ func TestAccComprehendEntityRecognizer_versionName(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "version_name", vName1),
 					resource.TestCheckResourceAttr(resourceName, "version_name_prefix", ""),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "comprehend", regexp.MustCompile(fmt.Sprintf(`entity-recognizer/%s/version/%s$`, rName, vName1))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "comprehend", regexache.MustCompile(fmt.Sprintf(`entity-recognizer/%s/version/%s$`, rName, vName1))),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key", "value1"),
 				),
@@ -155,7 +158,7 @@ func TestAccComprehendEntityRecognizer_versionName(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "version_name", vName2),
 					resource.TestCheckResourceAttr(resourceName, "version_name_prefix", ""),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "comprehend", regexp.MustCompile(fmt.Sprintf(`entity-recognizer/%s/version/%s$`, rName, vName2))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "comprehend", regexache.MustCompile(fmt.Sprintf(`entity-recognizer/%s/version/%s$`, rName, vName2))),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key", "value2"),
 				),
@@ -197,7 +200,7 @@ func TestAccComprehendEntityRecognizer_versionNameEmpty(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "version_name", ""),
 					resource.TestCheckResourceAttr(resourceName, "version_name_prefix", ""),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "comprehend", regexp.MustCompile(fmt.Sprintf(`entity-recognizer/%s$`, rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "comprehend", regexache.MustCompile(fmt.Sprintf(`entity-recognizer/%s$`, rName))),
 				),
 			},
 			{
@@ -236,7 +239,7 @@ func TestAccComprehendEntityRecognizer_versionNameGenerated(t *testing.T) {
 					testAccCheckEntityRecognizerPublishedVersions(ctx, resourceName, 1),
 					acctest.CheckResourceAttrNameGenerated(resourceName, "version_name"),
 					resource.TestCheckResourceAttr(resourceName, "version_name_prefix", id.UniqueIdPrefix),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "comprehend", regexp.MustCompile(fmt.Sprintf(`entity-recognizer/%s/version/%s$`, rName, uniqueIDPattern()))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "comprehend", regexache.MustCompile(fmt.Sprintf(`entity-recognizer/%s/version/%s$`, rName, uniqueIDPattern()))),
 				),
 			},
 			{
@@ -275,7 +278,7 @@ func TestAccComprehendEntityRecognizer_versionNamePrefix(t *testing.T) {
 					testAccCheckEntityRecognizerPublishedVersions(ctx, resourceName, 1),
 					acctest.CheckResourceAttrNameFromPrefix(resourceName, "version_name", "tf-acc-test-prefix-"),
 					resource.TestCheckResourceAttr(resourceName, "version_name_prefix", "tf-acc-test-prefix-"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "comprehend", regexp.MustCompile(fmt.Sprintf(`entity-recognizer/%s/version/%s$`, rName, prefixedUniqueIDPattern("tf-acc-test-prefix-")))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "comprehend", regexache.MustCompile(fmt.Sprintf(`entity-recognizer/%s/version/%s$`, rName, prefixedUniqueIDPattern("tf-acc-test-prefix-")))),
 				),
 			},
 			{
@@ -313,7 +316,7 @@ func TestAccComprehendEntityRecognizer_documents_testDocuments(t *testing.T) {
 					testAccCheckEntityRecognizerExists(ctx, resourceName, &entityrecognizer),
 					testAccCheckEntityRecognizerPublishedVersions(ctx, resourceName, 1),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "comprehend", regexp.MustCompile(fmt.Sprintf(`entity-recognizer/%s/version/%s$`, rName, uniqueIDPattern()))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "comprehend", regexache.MustCompile(fmt.Sprintf(`entity-recognizer/%s/version/%s$`, rName, uniqueIDPattern()))),
 					resource.TestCheckResourceAttr(resourceName, "input_data_config.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "input_data_config.0.entity_types.#", "2"),
 					resource.TestCheckResourceAttr(resourceName, "input_data_config.0.annotations.#", "0"),
@@ -368,7 +371,7 @@ func TestAccComprehendEntityRecognizer_annotations_basic(t *testing.T) {
 					testAccCheckEntityRecognizerPublishedVersions(ctx, resourceName, 1),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttrPair(resourceName, "data_access_role_arn", "aws_iam_role.test", "arn"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "comprehend", regexp.MustCompile(fmt.Sprintf(`entity-recognizer/%s/version/%s$`, rName, uniqueIDPattern()))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "comprehend", regexache.MustCompile(fmt.Sprintf(`entity-recognizer/%s/version/%s$`, rName, uniqueIDPattern()))),
 					resource.TestCheckResourceAttr(resourceName, "input_data_config.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "input_data_config.0.entity_types.#", "2"),
 					resource.TestCheckResourceAttr(resourceName, "input_data_config.0.annotations.#", "1"),
@@ -424,7 +427,7 @@ func TestAccComprehendEntityRecognizer_annotations_testDocuments(t *testing.T) {
 					testAccCheckEntityRecognizerPublishedVersions(ctx, resourceName, 1),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttrPair(resourceName, "data_access_role_arn", "aws_iam_role.test", "arn"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "comprehend", regexp.MustCompile(fmt.Sprintf(`entity-recognizer/%s/version/%s$`, rName, uniqueIDPattern()))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "comprehend", regexache.MustCompile(fmt.Sprintf(`entity-recognizer/%s/version/%s$`, rName, uniqueIDPattern()))),
 					resource.TestCheckResourceAttr(resourceName, "input_data_config.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "input_data_config.0.entity_types.#", "2"),
 					resource.TestCheckResourceAttr(resourceName, "input_data_config.0.annotations.#", "1"),
@@ -473,7 +476,7 @@ func TestAccComprehendEntityRecognizer_annotations_validateNoTestDocuments(t *te
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccEntityRecognizerConfig_annotations_noTestDocuments(rName),
-				ExpectError: regexp.MustCompile("input_data_config.documents.test_s3_uri must be set when input_data_config.annotations.test_s3_uri is set"),
+				ExpectError: regexache.MustCompile("input_data_config.documents.test_s3_uri must be set when input_data_config.annotations.test_s3_uri is set"),
 			},
 		},
 	})
@@ -499,7 +502,7 @@ func TestAccComprehendEntityRecognizer_annotations_validateNoTestAnnotations(t *
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccEntityRecognizerConfig_annotations_noTestAnnotations(rName),
-				ExpectError: regexp.MustCompile("input_data_config.annotations.test_s3_uri must be set when input_data_config.documents.test_s3_uri is set"),
+				ExpectError: regexache.MustCompile("input_data_config.annotations.test_s3_uri must be set when input_data_config.documents.test_s3_uri is set"),
 			},
 		},
 	})
diff --git a/internal/service/comprehend/generate.go b/internal/service/comprehend/generate.go
index 5c7d35627a9..f2a3adadcbb 100644
--- a/internal/service/comprehend/generate.go
+++ b/internal/service/comprehend/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ServiceTagsSlice -ListTags -UpdateTags -AWSSDKVersion=2
 //go:generate go run ./test-fixtures/generate/document_classifier/main.go
 //go:generate go run ./test-fixtures/generate/entity_recognizer/main.go
diff --git a/internal/service/comprehend/service_package_gen.go b/internal/service/comprehend/service_package_gen.go
index a4d3ee74c32..2f7e4b0b6c6 100644
--- a/internal/service/comprehend/service_package_gen.go
+++ b/internal/service/comprehend/service_package_gen.go
@@ -7,6 +7,7 @@ import (
 
 	aws_sdkv2 "github.com/aws/aws-sdk-go-v2/aws"
 	comprehend_sdkv2 "github.com/aws/aws-sdk-go-v2/service/comprehend"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -56,9 +57,11 @@ func (p *servicePackage) NewClient(ctx context.Context, config map[string]any) (
 
 	return comprehend_sdkv2.NewFromConfig(cfg, func(o *comprehend_sdkv2.Options) {
 		if endpoint := config["endpoint"].(string); endpoint != "" {
-			o.EndpointResolver = comprehend_sdkv2.EndpointResolverFromURL(endpoint)
+			o.BaseEndpoint = aws_sdkv2.String(endpoint)
 		}
 	}), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/comprehend/tags_gen.go b/internal/service/comprehend/tags_gen.go
index a2d21dd35ad..3a3976b1217 100644
--- a/internal/service/comprehend/tags_gen.go
+++ b/internal/service/comprehend/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/comprehend"
 	awstypes "github.com/aws/aws-sdk-go-v2/service/comprehend/types"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -102,6 +104,8 @@ func updateTags(ctx context.Context, conn *comprehend.Client, identifier string,
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.Comprehend)
 	if len(removedTags) > 0 {
diff --git a/internal/service/comprehend/test-fixtures/generate/document_classifier/main.go b/internal/service/comprehend/test-fixtures/generate/document_classifier/main.go
index 76bf105df6f..3805e9ad1c8 100644
--- a/internal/service/comprehend/test-fixtures/generate/document_classifier/main.go
+++ b/internal/service/comprehend/test-fixtures/generate/document_classifier/main.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:build generate
 // +build generate
 
diff --git a/internal/service/comprehend/test-fixtures/generate/document_classifier_multilabel/main.go b/internal/service/comprehend/test-fixtures/generate/document_classifier_multilabel/main.go
index 2c28768fa6d..4264d30090c 100644
--- a/internal/service/comprehend/test-fixtures/generate/document_classifier_multilabel/main.go
+++ b/internal/service/comprehend/test-fixtures/generate/document_classifier_multilabel/main.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:build generate
 // +build generate
 
diff --git a/internal/service/comprehend/test-fixtures/generate/entity_recognizer/main.go b/internal/service/comprehend/test-fixtures/generate/entity_recognizer/main.go
index 3247cfdeedf..01678618724 100644
--- a/internal/service/comprehend/test-fixtures/generate/entity_recognizer/main.go
+++ b/internal/service/comprehend/test-fixtures/generate/entity_recognizer/main.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:build generate
 // +build generate
 
diff --git a/internal/service/comprehend/validate.go b/internal/service/comprehend/validate.go
index ab1c4c522e1..ca719862892 100644
--- a/internal/service/comprehend/validate.go
+++ b/internal/service/comprehend/validate.go
@@ -1,8 +1,10 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package comprehend
 
 import (
-	"regexp"
-
+	"github.com/YakDriver/regexache"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 )
@@ -29,4 +31,4 @@ var validIdentifierPrefix = validation.All(
 	validIdentifierPattern,
 )
 
-var validIdentifierPattern = validation.StringMatch(regexp.MustCompile(`^[[:alnum:]-]+$`), "must contain A-Z, a-z, 0-9, and hypen (-)")
+var validIdentifierPattern = validation.StringMatch(regexache.MustCompile(`^[[:alnum:]-]+$`), "must contain A-Z, a-z, 0-9, and hypen (-)")
diff --git a/internal/service/computeoptimizer/generate.go b/internal/service/computeoptimizer/generate.go
index eb0d32ca9f9..01b6d8383f5 100644
--- a/internal/service/computeoptimizer/generate.go
+++ b/internal/service/computeoptimizer/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
 
diff --git a/internal/service/computeoptimizer/service_package_gen.go b/internal/service/computeoptimizer/service_package_gen.go
index 6701cdb1f54..72c0abee804 100644
--- a/internal/service/computeoptimizer/service_package_gen.go
+++ b/internal/service/computeoptimizer/service_package_gen.go
@@ -7,6 +7,7 @@ import (
 
 	aws_sdkv2 "github.com/aws/aws-sdk-go-v2/aws"
 	computeoptimizer_sdkv2 "github.com/aws/aws-sdk-go-v2/service/computeoptimizer"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -39,9 +40,11 @@ func (p *servicePackage) NewClient(ctx context.Context, config map[string]any) (
 
 	return computeoptimizer_sdkv2.NewFromConfig(cfg, func(o *computeoptimizer_sdkv2.Options) {
 		if endpoint := config["endpoint"].(string); endpoint != "" {
-			o.EndpointResolver = computeoptimizer_sdkv2.EndpointResolverFromURL(endpoint)
+			o.BaseEndpoint = aws_sdkv2.String(endpoint)
 		}
 	}), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/configservice/aggregate_authorization.go b/internal/service/configservice/aggregate_authorization.go
index 14d7ed5f605..746aa239611 100644
--- a/internal/service/configservice/aggregate_authorization.go
+++ b/internal/service/configservice/aggregate_authorization.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package configservice
 
 import (
diff --git a/internal/service/configservice/aggregate_authorization_test.go b/internal/service/configservice/aggregate_authorization_test.go
index 96b25ca6683..68cc2c23bdb 100644
--- a/internal/service/configservice/aggregate_authorization_test.go
+++ b/internal/service/configservice/aggregate_authorization_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package configservice_test
 
 // func TestAccConfigServiceAggregateAuthorization_basic(t *testing.T) {
@@ -16,7 +19,7 @@ package configservice_test
 // 				Check: resource.ComposeTestCheckFunc(
 // 					resource.TestCheckResourceAttr(resourceName, "account_id", rString),
 // 					resource.TestCheckResourceAttrPair(resourceName, "region", dataSourceName, "name"),
-// 					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "config", regexp.MustCompile(fmt.Sprintf(`aggregation-authorization/%s/%s$`, rString, acctest.Region()))),
+// 					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "config", regexache.MustCompile(fmt.Sprintf(`aggregation-authorization/%s/%s$`, rString, acctest.Region()))),
 // 				),
 // 			},
 // 			{
diff --git a/internal/service/configservice/config_rule.go b/internal/service/configservice/config_rule.go
index d5efc1b1df3..be5fc3b0885 100644
--- a/internal/service/configservice/config_rule.go
+++ b/internal/service/configservice/config_rule.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package configservice
 
 import (
@@ -5,9 +8,9 @@ import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/configservice"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -17,7 +20,6 @@ import (
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/create"
-	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
@@ -38,15 +40,6 @@ func ResourceConfigRule() *schema.Resource {
 		},
 
 		Schema: map[string]*schema.Schema{
-			"name": {
-				Type:         schema.TypeString,
-				Required:     true,
-				ValidateFunc: validation.StringLenBetween(0, 128),
-			},
-			"rule_id": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
 			"arn": {
 				Type:     schema.TypeString,
 				Computed: true,
@@ -56,6 +49,26 @@ func ResourceConfigRule() *schema.Resource {
 				Optional:     true,
 				ValidateFunc: validation.StringLenBetween(0, 256),
 			},
+			"evaluation_mode": {
+				Type:     schema.TypeSet,
+				Optional: true,
+				Computed: true,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"mode": {
+							Type:         schema.TypeString,
+							Optional:     true,
+							Computed:     true,
+							ValidateFunc: validation.StringInSlice(configservice.EvaluationMode_Values(), false),
+						},
+					},
+				},
+			},
+			"name": {
+				Type:         schema.TypeString,
+				Required:     true,
+				ValidateFunc: validation.StringLenBetween(0, 128),
+			},
 			"input_parameters": {
 				Type:         schema.TypeString,
 				Optional:     true,
@@ -66,6 +79,10 @@ func ResourceConfigRule() *schema.Resource {
 				Optional:     true,
 				ValidateFunc: validation.StringInSlice(configservice.MaximumExecutionFrequency_Values(), false),
 			},
+			"rule_id": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
 			"scope": {
 				Type:     schema.TypeList,
 				MaxItems: 1,
@@ -122,7 +139,7 @@ func ResourceConfigRule() *schema.Resource {
 										Required: true,
 										ValidateFunc: validation.All(
 											validation.StringLenBetween(0, 64),
-											validation.StringMatch(regexp.MustCompile(`^guard\-2\.x\.x$`), "Must match cloudformation-guard version"),
+											validation.StringMatch(regexache.MustCompile(`^guard\-2\.x\.x$`), "Must match cloudformation-guard version"),
 										),
 									},
 									"policy_text": {
@@ -186,6 +203,10 @@ func ResourceConfigRule() *schema.Resource {
 	}
 }
 
+const (
+	ResNameConfigRule = "Config Rule"
+)
+
 func resourceRulePutConfig(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).ConfigServiceConn(ctx)
@@ -200,9 +221,15 @@ func resourceRulePutConfig(ctx context.Context, d *schema.ResourceData, meta int
 	if v, ok := d.GetOk("description"); ok {
 		ruleInput.Description = aws.String(v.(string))
 	}
+
+	if v, ok := d.Get("evaluation_mode").(*schema.Set); ok && v.Len() > 0 {
+		ruleInput.EvaluationModes = expandRulesEvaluationModes(v.List())
+	}
+
 	if v, ok := d.GetOk("input_parameters"); ok {
 		ruleInput.InputParameters = aws.String(v.(string))
 	}
+
 	if v, ok := d.GetOk("maximum_execution_frequency"); ok {
 		ruleInput.MaximumExecutionFrequency = aws.String(v.(string))
 	}
@@ -229,7 +256,7 @@ func resourceRulePutConfig(ctx context.Context, d *schema.ResourceData, meta int
 		_, err = conn.PutConfigRuleWithContext(ctx, &input)
 	}
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "creating AWSConfig rule: %s", err)
+		return append(diags, create.DiagError(names.ConfigService, create.ErrActionUpdating, ResNameConfigRule, name, err)...)
 	}
 
 	d.SetId(name)
@@ -248,6 +275,9 @@ func resourceConfigRuleRead(ctx context.Context, d *schema.ResourceData, meta in
 		d.SetId("")
 		return diags
 	}
+	if err != nil {
+		return append(diags, create.DiagError(names.ConfigService, create.ErrActionReading, ResNameConfigRule, d.Id(), err)...)
+	}
 
 	arn := aws.StringValue(rule.ConfigRuleArn)
 	d.Set("arn", arn)
@@ -257,6 +287,8 @@ func resourceConfigRuleRead(ctx context.Context, d *schema.ResourceData, meta in
 	d.Set("input_parameters", rule.InputParameters)
 	d.Set("maximum_execution_frequency", rule.MaximumExecutionFrequency)
 
+	d.Set("evaluation_mode", flattenRuleEvaluationMode(rule.EvaluationModes))
+
 	if rule.Scope != nil {
 		d.Set("scope", flattenRuleScope(rule.Scope))
 	}
@@ -290,11 +322,11 @@ func resourceConfigRuleDelete(ctx context.Context, d *schema.ResourceData, meta
 		_, err = conn.DeleteConfigRuleWithContext(ctx, input)
 	}
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "Deleting Config Rule failed: %s", err)
+		return append(diags, create.DiagError(names.ConfigService, create.ErrActionDeleting, ResNameConfigRule, d.Id(), err)...)
 	}
 
 	if _, err := waitRuleDeleted(ctx, conn, d.Id()); err != nil {
-		return sdkdiag.AppendErrorf(diags, "waiting for Config Service Rule (%s) to deleted: %s", d.Id(), err)
+		return append(diags, create.DiagError(names.ConfigService, create.ErrActionWaitingForDeletion, ResNameConfigRule, d.Id(), err)...)
 	}
 
 	return diags
diff --git a/internal/service/configservice/config_rule_test.go b/internal/service/configservice/config_rule_test.go
index ce328bb1a33..8273712d254 100644
--- a/internal/service/configservice/config_rule_test.go
+++ b/internal/service/configservice/config_rule_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package configservice_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/configservice"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -37,6 +40,65 @@ func testAccConfigRule_basic(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "source.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "source.0.owner", "AWS"),
 					resource.TestCheckResourceAttr(resourceName, "source.0.source_identifier", "S3_BUCKET_VERSIONING_ENABLED"),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "evaluation_mode.*", map[string]string{
+						"mode": "DETECTIVE",
+					}),
+				),
+			},
+		},
+	})
+}
+
+func testAccConfigRule_evaluationMode(t *testing.T) {
+	ctx := acctest.Context(t)
+	var cr configservice.ConfigRule
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_config_config_rule.test"
+
+	evaluationMode1 := `
+  evaluation_mode {
+    mode = "DETECTIVE"
+  }
+`
+
+	evaluationMode2 := `
+  evaluation_mode {
+    mode = "DETECTIVE"
+  }
+
+  evaluation_mode {
+    mode = "PROACTIVE"
+  }
+`
+	resource.Test(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, configservice.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckConfigRuleDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccConfigRuleConfig_evaluationMode(rName, evaluationMode1),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckConfigRuleExists(ctx, resourceName, &cr),
+					testAccCheckConfigRuleName(resourceName, rName, &cr),
+					resource.TestCheckResourceAttr(resourceName, "name", rName),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "evaluation_mode.*", map[string]string{
+						"mode": "DETECTIVE",
+					}),
+				),
+			},
+			{
+				Config: testAccConfigRuleConfig_evaluationMode(rName, evaluationMode2),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckConfigRuleExists(ctx, resourceName, &cr),
+					testAccCheckConfigRuleName(resourceName, rName, &cr),
+					resource.TestCheckResourceAttr(resourceName, "name", rName),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "evaluation_mode.*", map[string]string{
+						"mode": "DETECTIVE",
+					}),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "evaluation_mode.*", map[string]string{
+						"mode": "PROACTIVE",
+					}),
 				),
 			},
 		},
@@ -60,9 +122,9 @@ func testAccConfigRule_ownerAws(t *testing.T) { // nosemgrep:ci.aws-in-func-name
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckConfigRuleExists(ctx, resourceName, &cr),
 					testAccCheckConfigRuleName(resourceName, rName, &cr),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "config", regexp.MustCompile("config-rule/config-rule-[a-z0-9]+$")),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "config", regexache.MustCompile("config-rule/config-rule-[0-9a-z]+$")),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
-					resource.TestMatchResourceAttr(resourceName, "rule_id", regexp.MustCompile("config-rule-[a-z0-9]+$")),
+					resource.TestMatchResourceAttr(resourceName, "rule_id", regexache.MustCompile("config-rule-[0-9a-z]+$")),
 					resource.TestCheckResourceAttr(resourceName, "description", "Terraform Acceptance tests"),
 					resource.TestCheckResourceAttr(resourceName, "source.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "source.0.owner", "AWS"),
@@ -103,9 +165,9 @@ func testAccConfigRule_customlambda(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckConfigRuleExists(ctx, resourceName, &cr),
 					testAccCheckConfigRuleName(resourceName, expectedName, &cr),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "config", regexp.MustCompile("config-rule/config-rule-[a-z0-9]+$")),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "config", regexache.MustCompile("config-rule/config-rule-[0-9a-z]+$")),
 					resource.TestCheckResourceAttr(resourceName, "name", expectedName),
-					resource.TestMatchResourceAttr(resourceName, "rule_id", regexp.MustCompile("config-rule-[a-z0-9]+$")),
+					resource.TestMatchResourceAttr(resourceName, "rule_id", regexache.MustCompile("config-rule-[0-9a-z]+$")),
 					resource.TestCheckResourceAttr(resourceName, "description", "Terraform Acceptance tests"),
 					resource.TestCheckResourceAttr(resourceName, "maximum_execution_frequency", "Six_Hours"),
 					resource.TestCheckResourceAttr(resourceName, "source.#", "1"),
@@ -148,9 +210,9 @@ func testAccConfigRule_ownerPolicy(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckConfigRuleExists(ctx, resourceName, &cr),
 					testAccCheckConfigRuleName(resourceName, rName, &cr),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "config", regexp.MustCompile("config-rule/config-rule-[a-z0-9]+$")),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "config", regexache.MustCompile("config-rule/config-rule-[0-9a-z]+$")),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
-					resource.TestMatchResourceAttr(resourceName, "rule_id", regexp.MustCompile("config-rule-[a-z0-9]+$")),
+					resource.TestMatchResourceAttr(resourceName, "rule_id", regexache.MustCompile("config-rule-[0-9a-z]+$")),
 					resource.TestCheckResourceAttr(resourceName, "source.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "source.0.owner", "CUSTOM_POLICY"),
 					resource.TestCheckResourceAttr(resourceName, "source.0.source_detail.#", "1"),
@@ -707,3 +769,20 @@ resource "aws_config_config_rule" "test" {
 }
 `, rName, tagKey1, tagValue1, tagKey2, tagValue2)
 }
+
+func testAccConfigRuleConfig_evaluationMode(rName, evaluationMode string) string {
+	return testAccConfigRuleConfig_base(rName) + fmt.Sprintf(`
+resource "aws_config_config_rule" "test" {
+  name = %[1]q
+
+  source {
+    owner             = "AWS"
+    source_identifier = "EIP_ATTACHED"
+  }
+
+%[2]s
+
+  depends_on = [aws_config_configuration_recorder.test]
+}
+`, rName, evaluationMode)
+}
diff --git a/internal/service/configservice/configservice.go b/internal/service/configservice/configservice.go
index 846a05db493..5370844c917 100644
--- a/internal/service/configservice/configservice.go
+++ b/internal/service/configservice/configservice.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package configservice
 
 import (
diff --git a/internal/service/configservice/configservice_test.go b/internal/service/configservice/configservice_test.go
index e8fbd59e1e7..fa4986a7763 100644
--- a/internal/service/configservice/configservice_test.go
+++ b/internal/service/configservice/configservice_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package configservice_test
 
 import (
@@ -10,11 +13,12 @@ func TestAccConfigService_serial(t *testing.T) {
 	t.Parallel()
 
 	testCases := map[string]map[string]func(t *testing.T){
-		"Config": {
+		"ConfigRule": {
 			"basic":            testAccConfigRule_basic,
 			"ownerAws":         testAccConfigRule_ownerAws,
 			"customlambda":     testAccConfigRule_customlambda,
 			"customPolicy":     testAccConfigRule_ownerPolicy,
+			"evaluationMode":   testAccConfigRule_evaluationMode,
 			"scopeTagKey":      testAccConfigRule_Scope_TagKey,
 			"scopeTagKeyEmpty": testAccConfigRule_Scope_TagKey_Empty,
 			"scopeTagValue":    testAccConfigRule_Scope_TagValue,
@@ -27,14 +31,15 @@ func TestAccConfigService_serial(t *testing.T) {
 			"importBasic":  testAccConfigurationRecorderStatus_importBasic,
 		},
 		"ConfigurationRecorder": {
-			"basic":       testAccConfigurationRecorder_basic,
-			"allParams":   testAccConfigurationRecorder_allParams,
-			"importBasic": testAccConfigurationRecorder_importBasic,
+			"basic":          testAccConfigurationRecorder_basic,
+			"allParams":      testAccConfigurationRecorder_allParams,
+			"recordStrategy": testAccConfigurationRecorder_recordStrategy,
+			"disappears":     testAccConfigurationRecorder_disappears,
 		},
 		"ConformancePack": {
 			"basic":                     testAccConformancePack_basic,
 			"disappears":                testAccConformancePack_disappears,
-			"forceNew":                  testAccConformancePack_forceNew,
+			"updateName":                testAccConformancePack_updateName,
 			"inputParameters":           testAccConformancePack_inputParameters,
 			"S3Delivery":                testAccConformancePack_S3Delivery,
 			"S3Template":                testAccConformancePack_S3Template,
@@ -53,7 +58,7 @@ func TestAccConfigService_serial(t *testing.T) {
 			"basic":                 testAccOrganizationConformancePack_basic,
 			"disappears":            testAccOrganizationConformancePack_disappears,
 			"excludedAccounts":      testAccOrganizationConformancePack_excludedAccounts,
-			"forceNew":              testAccOrganizationConformancePack_forceNew,
+			"updateName":            testAccOrganizationConformancePack_updateName,
 			"inputParameters":       testAccOrganizationConformancePack_inputParameters,
 			"S3Delivery":            testAccOrganizationConformancePack_S3Delivery,
 			"S3Template":            testAccOrganizationConformancePack_S3Template,
diff --git a/internal/service/configservice/configuration_aggregator.go b/internal/service/configservice/configuration_aggregator.go
index 40e97a928ef..67871159936 100644
--- a/internal/service/configservice/configuration_aggregator.go
+++ b/internal/service/configservice/configuration_aggregator.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package configservice
 
 import (
diff --git a/internal/service/configservice/configuration_aggregator_test.go b/internal/service/configservice/configuration_aggregator_test.go
index 12110b5f9a1..21217cd0e46 100644
--- a/internal/service/configservice/configuration_aggregator_test.go
+++ b/internal/service/configservice/configuration_aggregator_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package configservice_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/configservice"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -35,7 +38,7 @@ func TestAccConfigServiceConfigurationAggregator_account(t *testing.T) {
 					testAccCheckConfigurationAggregatorExists(ctx, resourceName, &ca),
 					testAccCheckConfigurationAggregatorName(resourceName, rName, &ca),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "config", regexp.MustCompile(`config-aggregator/config-aggregator-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "config", regexache.MustCompile(`config-aggregator/config-aggregator-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "account_aggregation_source.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "account_aggregation_source.0.account_ids.#", "1"),
 					acctest.CheckResourceAttrAccountID(resourceName, "account_aggregation_source.0.account_ids.0"),
diff --git a/internal/service/configservice/configuration_recorder.go b/internal/service/configservice/configuration_recorder.go
index cb51c1710db..7985d95b180 100644
--- a/internal/service/configservice/configuration_recorder.go
+++ b/internal/service/configservice/configuration_recorder.go
@@ -1,20 +1,26 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package configservice
 
 import (
 	"context"
 	"errors"
+	"log"
 
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/configservice"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/customdiff"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
-	"github.com/hashicorp/terraform-provider-aws/internal/create"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
+	"github.com/hashicorp/terraform-provider-aws/internal/flex"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
-	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
 // @SDKResource("aws_config_configuration_recorder")
@@ -29,6 +35,10 @@ func ResourceConfigurationRecorder() *schema.Resource {
 			StateContext: schema.ImportStatePassthroughContext,
 		},
 
+		CustomizeDiff: customdiff.All(
+			resourceConfigCustomizeDiff,
+		),
+
 		Schema: map[string]*schema.Schema{
 			"name": {
 				Type:         schema.TypeString,
@@ -37,11 +47,6 @@ func ResourceConfigurationRecorder() *schema.Resource {
 				Default:      "default",
 				ValidateFunc: validation.StringLenBetween(0, 256),
 			},
-			"role_arn": {
-				Type:         schema.TypeString,
-				Required:     true,
-				ValidateFunc: verify.ValidARN,
-			},
 			"recording_group": {
 				Type:     schema.TypeList,
 				Optional: true,
@@ -54,19 +59,51 @@ func ResourceConfigurationRecorder() *schema.Resource {
 							Optional: true,
 							Default:  true,
 						},
+						"exclusion_by_resource_types": {
+							Type:     schema.TypeList,
+							Optional: true,
+							Computed: true,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"resource_types": {
+										Type:     schema.TypeSet,
+										Optional: true,
+										Elem:     &schema.Schema{Type: schema.TypeString},
+									},
+								},
+							},
+						},
 						"include_global_resource_types": {
 							Type:     schema.TypeBool,
 							Optional: true,
 						},
+						"recording_strategy": {
+							Type:     schema.TypeList,
+							Optional: true,
+							Computed: true,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"use_only": {
+										Type:         schema.TypeString,
+										Optional:     true,
+										ValidateFunc: validation.StringInSlice(configservice.RecordingStrategyType_Values(), false),
+									},
+								},
+							},
+						},
 						"resource_types": {
 							Type:     schema.TypeSet,
-							Set:      schema.HashString,
 							Optional: true,
 							Elem:     &schema.Schema{Type: schema.TypeString},
 						},
 					},
 				},
 			},
+			"role_arn": {
+				Type:         schema.TypeString,
+				Required:     true,
+				ValidateFunc: verify.ValidARN,
+			},
 		},
 	}
 }
@@ -76,24 +113,26 @@ func resourceConfigurationRecorderPut(ctx context.Context, d *schema.ResourceDat
 	conn := meta.(*conns.AWSClient).ConfigServiceConn(ctx)
 
 	name := d.Get("name").(string)
-	recorder := configservice.ConfigurationRecorder{
-		Name:    aws.String(name),
-		RoleARN: aws.String(d.Get("role_arn").(string)),
+	input := &configservice.PutConfigurationRecorderInput{
+		ConfigurationRecorder: &configservice.ConfigurationRecorder{
+			Name:    aws.String(name),
+			RoleARN: aws.String(d.Get("role_arn").(string)),
+		},
 	}
 
-	if g, ok := d.GetOk("recording_group"); ok {
-		recorder.RecordingGroup = expandRecordingGroup(g.([]interface{}))
+	if v, ok := d.GetOk("recording_group"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
+		input.ConfigurationRecorder.RecordingGroup = expandRecordingGroup(v.([]interface{})[0].(map[string]interface{}))
 	}
 
-	input := configservice.PutConfigurationRecorderInput{
-		ConfigurationRecorder: &recorder,
-	}
-	_, err := conn.PutConfigurationRecorderWithContext(ctx, &input)
+	_, err := conn.PutConfigurationRecorderWithContext(ctx, input)
+
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "Creating Configuration Recorder failed: %s", err)
+		return sdkdiag.AppendErrorf(diags, "putting ConfigService Configuration Recorder (%s): %s", name, err)
 	}
 
-	d.SetId(name)
+	if d.IsNewResource() {
+		d.SetId(name)
+	}
 
 	return append(diags, resourceConfigurationRecorderRead(ctx, d, meta)...)
 }
@@ -102,46 +141,24 @@ func resourceConfigurationRecorderRead(ctx context.Context, d *schema.ResourceDa
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).ConfigServiceConn(ctx)
 
-	input := configservice.DescribeConfigurationRecordersInput{
-		ConfigurationRecorderNames: []*string{aws.String(d.Id())},
-	}
-	out, err := conn.DescribeConfigurationRecordersWithContext(ctx, &input)
-	if !d.IsNewResource() && tfawserr.ErrCodeEquals(err, configservice.ErrCodeNoSuchConfigurationRecorderException) {
-		create.LogNotFoundRemoveState(names.ConfigService, create.ErrActionReading, ResNameConfigurationRecorder, d.Id())
-		d.SetId("")
-		return diags
-	}
+	recorder, err := FindConfigurationRecorderByName(ctx, conn, d.Id())
 
-	if err != nil {
-		return create.DiagError(names.ConfigService, create.ErrActionReading, ResNameConfigurationRecorder, d.Id(), err)
-	}
-
-	numberOfRecorders := len(out.ConfigurationRecorders)
-	if !d.IsNewResource() && numberOfRecorders < 1 {
-		create.LogNotFoundRemoveState(names.ConfigService, create.ErrActionReading, ResNameConfigurationRecorder, d.Id())
+	if !d.IsNewResource() && tfresource.NotFound(err) {
+		log.Printf("[WARN] ConfigService Configuration Recorder (%s) not found, removing from state", d.Id())
 		d.SetId("")
 		return diags
 	}
 
-	if d.IsNewResource() && numberOfRecorders < 1 {
-		return create.DiagError(names.ConfigService, create.ErrActionReading, ResNameConfigurationRecorder, d.Id(), errors.New("none found"))
-	}
-
-	if numberOfRecorders > 1 {
-		return sdkdiag.AppendErrorf(diags, "Expected exactly 1 Configuration Recorder, received %d: %#v",
-			numberOfRecorders, out.ConfigurationRecorders)
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "reading ConfigService Configuration Recorder (%s): %s", d.Id(), err)
 	}
 
-	recorder := out.ConfigurationRecorders[0]
-
 	d.Set("name", recorder.Name)
 	d.Set("role_arn", recorder.RoleARN)
 
 	if recorder.RecordingGroup != nil {
-		flattened := flattenRecordingGroup(recorder.RecordingGroup)
-		err = d.Set("recording_group", flattened)
-		if err != nil {
-			return sdkdiag.AppendErrorf(diags, "Failed to set recording_group: %s", err)
+		if err := d.Set("recording_group", flattenRecordingGroup(recorder.RecordingGroup)); err != nil {
+			return sdkdiag.AppendErrorf(diags, "setting recording_group: %s", err)
 		}
 	}
 
@@ -151,14 +168,99 @@ func resourceConfigurationRecorderRead(ctx context.Context, d *schema.ResourceDa
 func resourceConfigurationRecorderDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).ConfigServiceConn(ctx)
-	input := configservice.DeleteConfigurationRecorderInput{
+
+	log.Printf("[DEBUG] Deleting ConfigService Configuration Recorder: %s", d.Id())
+	_, err := conn.DeleteConfigurationRecorderWithContext(ctx, &configservice.DeleteConfigurationRecorderInput{
 		ConfigurationRecorderName: aws.String(d.Id()),
+	})
+
+	if tfawserr.ErrCodeEquals(err, configservice.ErrCodeNoSuchConfigurationRecorderException) {
+		return diags
 	}
-	_, err := conn.DeleteConfigurationRecorderWithContext(ctx, &input)
+
 	if err != nil {
-		if !tfawserr.ErrCodeEquals(err, configservice.ErrCodeNoSuchConfigurationRecorderException) {
-			return sdkdiag.AppendErrorf(diags, "Deleting Configuration Recorder failed: %s", err)
-		}
+		return sdkdiag.AppendErrorf(diags, "deleting ConfigService Configuration Recorder (%s): %s", d.Id(), err)
 	}
+
 	return diags
 }
+
+func FindConfigurationRecorderByName(ctx context.Context, conn *configservice.ConfigService, name string) (*configservice.ConfigurationRecorder, error) {
+	input := &configservice.DescribeConfigurationRecordersInput{
+		ConfigurationRecorderNames: aws.StringSlice([]string{name}),
+	}
+
+	output, err := conn.DescribeConfigurationRecordersWithContext(ctx, input)
+
+	if tfawserr.ErrCodeEquals(err, configservice.ErrCodeNoSuchConfigurationRecorderException) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	if output == nil {
+		return nil, tfresource.NewEmptyResultError(input)
+	}
+
+	return tfresource.AssertSinglePtrResult(output.ConfigurationRecorders)
+}
+
+func resourceConfigCustomizeDiff(_ context.Context, diff *schema.ResourceDiff, v interface{}) error {
+	if diff.Id() == "" { // New resource.
+		if g, ok := diff.GetOk("recording_group"); ok {
+			group := g.([]interface{})[0].(map[string]interface{})
+
+			if h, ok := group["all_supported"]; ok {
+				if i, ok := group["recording_strategy"]; ok && len(i.([]interface{})) > 0 && i.([]interface{})[0] != nil {
+					strategy := i.([]interface{})[0].(map[string]interface{})
+
+					if j, ok := strategy["use_only"].(string); ok {
+						if h.(bool) && j != configservice.RecordingStrategyTypeAllSupportedResourceTypes {
+							return errors.New(` Invalid record group strategy  , all_supported must be set to true  `)
+						}
+
+						if k, ok := group["exclusion_by_resource_types"]; ok && len(k.([]interface{})) > 0 && k.([]interface{})[0] != nil {
+							if h.(bool) {
+								return errors.New(` Invalid record group , all_supported must be set to false when exclusion_by_resource_types is set `)
+							}
+
+							if j != configservice.RecordingStrategyTypeExclusionByResourceTypes {
+								return errors.New(` Invalid record group strategy ,  use only must be set to EXCLUSION_BY_RESOURCE_TYPES`)
+							}
+
+							if l, ok := group["resource_types"]; ok {
+								resourceTypes := flex.ExpandStringSet(l.(*schema.Set))
+								if len(resourceTypes) > 0 {
+									return errors.New(` Invalid record group , resource_types must not be set when exclusion_by_resource_types is set `)
+								}
+							}
+						}
+
+						if l, ok := group["resource_types"]; ok {
+							resourceTypes := flex.ExpandStringSet(l.(*schema.Set))
+							if len(resourceTypes) > 0 {
+								if h.(bool) {
+									return errors.New(` Invalid record group , all_supported must be set to false when resource_types is set `)
+								}
+
+								if j != configservice.RecordingStrategyTypeInclusionByResourceTypes {
+									return errors.New(` Invalid record group strategy ,  use only must be set to INCLUSION_BY_RESOURCE_TYPES`)
+								}
+
+								if m, ok := group["exclusion_by_resource_types"]; ok && len(m.([]interface{})) > 0 && i.([]interface{})[0] != nil {
+									return errors.New(` Invalid record group , exclusion_by_resource_types must not be set when resource_types is set `)
+								}
+							}
+						}
+					}
+				}
+			}
+		}
+	}
+	return nil
+}
diff --git a/internal/service/configservice/configuration_recorder_status.go b/internal/service/configservice/configuration_recorder_status.go
index 5a81200f65a..3dd7910d21e 100644
--- a/internal/service/configservice/configuration_recorder_status.go
+++ b/internal/service/configservice/configuration_recorder_status.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package configservice
 
 import (
diff --git a/internal/service/configservice/configuration_recorder_status_test.go b/internal/service/configservice/configuration_recorder_status_test.go
index 2734a824bda..6e987b02cbb 100644
--- a/internal/service/configservice/configuration_recorder_status_test.go
+++ b/internal/service/configservice/configuration_recorder_status_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package configservice_test
 
 import (
diff --git a/internal/service/configservice/configuration_recorder_test.go b/internal/service/configservice/configuration_recorder_test.go
index 8415b007b74..d9a36202734 100644
--- a/internal/service/configservice/configuration_recorder_test.go
+++ b/internal/service/configservice/configuration_recorder_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package configservice_test
 
 import (
@@ -5,23 +8,50 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/configservice"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	tfconfig "github.com/hashicorp/terraform-provider-aws/internal/service/configservice"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
 func testAccConfigurationRecorder_basic(t *testing.T) {
 	ctx := acctest.Context(t)
 	var cr configservice.ConfigurationRecorder
-	rInt := sdkacctest.RandInt()
-	expectedName := fmt.Sprintf("tf-acc-test-%d", rInt)
-	expectedRoleName := fmt.Sprintf("tf-acc-test-awsconfig-%d", rInt)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_config_configuration_recorder.test"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, configservice.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckConfigurationRecorderDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccConfigurationRecorderConfig_basic(rName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckConfigurationRecorderExists(ctx, resourceName, &cr),
+					resource.TestCheckResourceAttr(resourceName, "name", rName),
+					acctest.CheckResourceAttrGlobalARN(resourceName, "role_arn", "iam", fmt.Sprintf("role/%s", rName)),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
 
-	resourceName := "aws_config_configuration_recorder.foo"
+func testAccConfigurationRecorder_disappears(t *testing.T) {
+	ctx := acctest.Context(t)
+	var cr configservice.ConfigurationRecorder
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_config_configuration_recorder.test"
 
 	resource.Test(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
@@ -30,13 +60,12 @@ func testAccConfigurationRecorder_basic(t *testing.T) {
 		CheckDestroy:             testAccCheckConfigurationRecorderDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccConfigurationRecorderConfig_basic(rInt),
+				Config: testAccConfigurationRecorderConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckConfigurationRecorderExists(ctx, resourceName, &cr),
-					testAccCheckConfigurationRecorderName(resourceName, expectedName, &cr),
-					acctest.CheckResourceAttrGlobalARN(resourceName, "role_arn", "iam", fmt.Sprintf("role/%s", expectedRoleName)),
-					resource.TestCheckResourceAttr(resourceName, "name", expectedName),
+					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfconfig.ResourceConfigurationRecorder(), resourceName),
 				),
+				ExpectNonEmptyPlan: true,
 			},
 		},
 	})
@@ -45,11 +74,8 @@ func testAccConfigurationRecorder_basic(t *testing.T) {
 func testAccConfigurationRecorder_allParams(t *testing.T) {
 	ctx := acctest.Context(t)
 	var cr configservice.ConfigurationRecorder
-	rInt := sdkacctest.RandInt()
-	expectedName := fmt.Sprintf("tf-acc-test-%d", rInt)
-	expectedRoleName := fmt.Sprintf("tf-acc-test-awsconfig-%d", rInt)
-
-	resourceName := "aws_config_configuration_recorder.foo"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_config_configuration_recorder.test"
 
 	resource.Test(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
@@ -58,26 +84,26 @@ func testAccConfigurationRecorder_allParams(t *testing.T) {
 		CheckDestroy:             testAccCheckConfigurationRecorderDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccConfigurationRecorderConfig_allParams(rInt),
+				Config: testAccConfigurationRecorderConfig_allParams(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckConfigurationRecorderExists(ctx, resourceName, &cr),
-					testAccCheckConfigurationRecorderName(resourceName, expectedName, &cr),
-					acctest.CheckResourceAttrGlobalARN(resourceName, "role_arn", "iam", fmt.Sprintf("role/%s", expectedRoleName)),
-					resource.TestCheckResourceAttr(resourceName, "name", expectedName),
+					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "recording_group.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "recording_group.0.all_supported", "false"),
 					resource.TestCheckResourceAttr(resourceName, "recording_group.0.include_global_resource_types", "false"),
 					resource.TestCheckResourceAttr(resourceName, "recording_group.0.resource_types.#", "2"),
+					acctest.CheckResourceAttrGlobalARN(resourceName, "role_arn", "iam", fmt.Sprintf("role/%s", rName)),
 				),
 			},
 		},
 	})
 }
 
-func testAccConfigurationRecorder_importBasic(t *testing.T) {
+func testAccConfigurationRecorder_recordStrategy(t *testing.T) {
 	ctx := acctest.Context(t)
-	resourceName := "aws_config_configuration_recorder.foo"
-	rInt := sdkacctest.RandInt()
+	var cr configservice.ConfigurationRecorder
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_config_configuration_recorder.test"
 
 	resource.Test(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
@@ -86,58 +112,41 @@ func testAccConfigurationRecorder_importBasic(t *testing.T) {
 		CheckDestroy:             testAccCheckConfigurationRecorderDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccConfigurationRecorderConfig_basic(rInt),
-			},
-
-			{
-				ResourceName:      resourceName,
-				ImportState:       true,
-				ImportStateVerify: true,
+				Config: testAccConfigurationRecorderConfig_recordStrategy(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckConfigurationRecorderExists(ctx, resourceName, &cr),
+					resource.TestCheckResourceAttr(resourceName, "name", rName),
+					resource.TestCheckResourceAttr(resourceName, "recording_group.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "recording_group.0.all_supported", "false"),
+					resource.TestCheckResourceAttr(resourceName, "recording_group.0.exclusion_by_resource_types.0.resource_types.#", "2"),
+					resource.TestCheckResourceAttr(resourceName, "recording_group.0.recording_strategy.0.use_only", "EXCLUSION_BY_RESOURCE_TYPES"),
+					acctest.CheckResourceAttrGlobalARN(resourceName, "role_arn", "iam", fmt.Sprintf("role/%s", rName)),
+				),
 			},
 		},
 	})
 }
 
-func testAccCheckConfigurationRecorderName(n string, desired string, obj *configservice.ConfigurationRecorder) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		_, ok := s.RootModule().Resources[n]
-		if !ok {
-			return fmt.Errorf("Not found: %s", n)
-		}
-
-		if *obj.Name != desired {
-			return fmt.Errorf("Expected configuration recorder %q name to be %q, given: %q",
-				n, desired, *obj.Name)
-		}
-
-		return nil
-	}
-}
-
-func testAccCheckConfigurationRecorderExists(ctx context.Context, n string, obj *configservice.ConfigurationRecorder) resource.TestCheckFunc {
+func testAccCheckConfigurationRecorderExists(ctx context.Context, n string, v *configservice.ConfigurationRecorder) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		rs, ok := s.RootModule().Resources[n]
 		if !ok {
-			return fmt.Errorf("Not Found: %s", n)
+			return fmt.Errorf("Not found: %s", n)
 		}
 
 		if rs.Primary.ID == "" {
-			return fmt.Errorf("No configuration recorder ID is set")
+			return fmt.Errorf("No ConfigService Configuration Recorder ID is set")
 		}
 
 		conn := acctest.Provider.Meta().(*conns.AWSClient).ConfigServiceConn(ctx)
-		out, err := conn.DescribeConfigurationRecordersWithContext(ctx, &configservice.DescribeConfigurationRecordersInput{
-			ConfigurationRecorderNames: []*string{aws.String(rs.Primary.Attributes["name"])},
-		})
+
+		output, err := tfconfig.FindConfigurationRecorderByName(ctx, conn, rs.Primary.ID)
+
 		if err != nil {
-			return fmt.Errorf("Failed to describe configuration recorder: %s", err)
-		}
-		if len(out.ConfigurationRecorders) < 1 {
-			return fmt.Errorf("No configuration recorder found when describing %q", rs.Primary.Attributes["name"])
+			return err
 		}
 
-		cr := out.ConfigurationRecorders[0]
-		*obj = *cr
+		*v = *output
 
 		return nil
 	}
@@ -152,31 +161,32 @@ func testAccCheckConfigurationRecorderDestroy(ctx context.Context) resource.Test
 				continue
 			}
 
-			resp, err := conn.DescribeConfigurationRecordersWithContext(ctx, &configservice.DescribeConfigurationRecordersInput{
-				ConfigurationRecorderNames: []*string{aws.String(rs.Primary.Attributes["name"])},
-			})
+			_, err := tfconfig.FindConfigurationRecorderByName(ctx, conn, rs.Primary.ID)
+
+			if tfresource.NotFound(err) {
+				continue
+			}
 
-			if err == nil {
-				if len(resp.ConfigurationRecorders) != 0 &&
-					*resp.ConfigurationRecorders[0].Name == rs.Primary.Attributes["name"] {
-					return fmt.Errorf("Configuration recorder still exists: %s", rs.Primary.Attributes["name"])
-				}
+			if err != nil {
+				return err
 			}
+
+			return fmt.Errorf("ConfigService Configuration Recorder %s still exists", rs.Primary.ID)
 		}
 
 		return nil
 	}
 }
 
-func testAccConfigurationRecorderConfig_basic(randInt int) string {
+func testAccConfigurationRecorderConfig_basic(rName string) string {
 	return fmt.Sprintf(`
-resource "aws_config_configuration_recorder" "foo" {
-  name     = "tf-acc-test-%d"
-  role_arn = aws_iam_role.r.arn
+resource "aws_config_configuration_recorder" "test" {
+  name     = %[1]q
+  role_arn = aws_iam_role.test.arn
 }
 
-resource "aws_iam_role" "r" {
-  name = "tf-acc-test-awsconfig-%d"
+resource "aws_iam_role" "test" {
+  name = %[1]q
 
   assume_role_policy = <<POLICY
 {
@@ -195,9 +205,9 @@ resource "aws_iam_role" "r" {
 POLICY
 }
 
-resource "aws_iam_role_policy" "p" {
-  name = "tf-acc-test-awsconfig-%d"
-  role = aws_iam_role.r.id
+resource "aws_iam_role_policy" "test" {
+  name = %[1]q
+  role = aws_iam_role.test.id
 
   policy = <<EOF
 {
@@ -209,8 +219,8 @@ resource "aws_iam_role_policy" "p" {
       ],
       "Effect": "Allow",
       "Resource": [
-        "${aws_s3_bucket.b.arn}",
-        "${aws_s3_bucket.b.arn}/*"
+        "${aws_s3_bucket.test.arn}",
+        "${aws_s3_bucket.test.arn}/*"
       ]
     }
   ]
@@ -218,24 +228,24 @@ resource "aws_iam_role_policy" "p" {
 EOF
 }
 
-resource "aws_s3_bucket" "b" {
-  bucket        = "tf-acc-test-awsconfig-%d"
+resource "aws_s3_bucket" "test" {
+  bucket        = %[1]q
   force_destroy = true
 }
 
-resource "aws_config_delivery_channel" "foo" {
-  name           = "tf-acc-test-awsconfig-%d"
-  s3_bucket_name = aws_s3_bucket.b.bucket
-  depends_on     = [aws_config_configuration_recorder.foo]
+resource "aws_config_delivery_channel" "test" {
+  name           = %[1]q
+  s3_bucket_name = aws_s3_bucket.test.bucket
+  depends_on     = [aws_config_configuration_recorder.test]
 }
-`, randInt, randInt, randInt, randInt, randInt)
+`, rName)
 }
 
-func testAccConfigurationRecorderConfig_allParams(randInt int) string {
+func testAccConfigurationRecorderConfig_allParams(rName string) string {
 	return fmt.Sprintf(`
-resource "aws_config_configuration_recorder" "foo" {
-  name     = "tf-acc-test-%d"
-  role_arn = aws_iam_role.r.arn
+resource "aws_config_configuration_recorder" "test" {
+  name     = %[1]q
+  role_arn = aws_iam_role.test.arn
 
   recording_group {
     all_supported                 = false
@@ -244,8 +254,84 @@ resource "aws_config_configuration_recorder" "foo" {
   }
 }
 
-resource "aws_iam_role" "r" {
-  name = "tf-acc-test-awsconfig-%d"
+resource "aws_iam_role" "test" {
+  name = %[1]q
+
+  assume_role_policy = <<POLICY
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Action": "sts:AssumeRole",
+      "Principal": {
+        "Service": "config.amazonaws.com"
+      },
+      "Effect": "Allow",
+      "Sid": ""
+    }
+  ]
+}
+POLICY
+}
+
+resource "aws_iam_role_policy" "test" {
+  name = %[1]q
+  role = aws_iam_role.test.id
+
+  policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Action": [
+        "s3:*"
+      ],
+      "Effect": "Allow",
+      "Resource": [
+        "${aws_s3_bucket.test.arn}",
+        "${aws_s3_bucket.test.arn}/*"
+      ]
+    }
+  ]
+}
+EOF
+}
+
+resource "aws_s3_bucket" "test" {
+  bucket        = %[1]q
+  force_destroy = true
+}
+
+resource "aws_config_delivery_channel" "test" {
+  name           = %[1]q
+  s3_bucket_name = aws_s3_bucket.test.bucket
+  depends_on     = [aws_config_configuration_recorder.test]
+}
+`, rName)
+}
+
+func testAccConfigurationRecorderConfig_recordStrategy(rName string) string {
+	return fmt.Sprintf(`
+resource "aws_config_configuration_recorder" "test" {
+  name     = %[1]q
+  role_arn = aws_iam_role.test.arn
+
+  recording_group {
+    all_supported                 = false
+    include_global_resource_types = false
+
+    exclusion_by_resource_types {
+      resource_types = ["AWS::EC2::Instance", "AWS::CloudTrail::Trail"]
+    }
+
+    recording_strategy {
+      use_only = "EXCLUSION_BY_RESOURCE_TYPES"
+    }
+  }
+}
+
+resource "aws_iam_role" "test" {
+  name = %[1]q
 
   assume_role_policy = <<POLICY
 {
@@ -264,9 +350,9 @@ resource "aws_iam_role" "r" {
 POLICY
 }
 
-resource "aws_iam_role_policy" "p" {
-  name = "tf-acc-test-awsconfig-%d"
-  role = aws_iam_role.r.id
+resource "aws_iam_role_policy" "test" {
+  name = %[1]q
+  role = aws_iam_role.test.id
 
   policy = <<EOF
 {
@@ -278,8 +364,8 @@ resource "aws_iam_role_policy" "p" {
       ],
       "Effect": "Allow",
       "Resource": [
-        "${aws_s3_bucket.b.arn}",
-        "${aws_s3_bucket.b.arn}/*"
+        "${aws_s3_bucket.test.arn}",
+        "${aws_s3_bucket.test.arn}/*"
       ]
     }
   ]
@@ -287,15 +373,23 @@ resource "aws_iam_role_policy" "p" {
 EOF
 }
 
-resource "aws_s3_bucket" "b" {
-  bucket        = "tf-acc-test-awsconfig-%d"
+resource "aws_s3_bucket" "test" {
+  bucket        = %[1]q
   force_destroy = true
 }
 
-resource "aws_config_delivery_channel" "foo" {
-  name           = "tf-acc-test-awsconfig-%d"
-  s3_bucket_name = aws_s3_bucket.b.bucket
-  depends_on     = [aws_config_configuration_recorder.foo]
+resource "aws_s3_bucket_ownership_controls" "test" {
+  bucket = aws_s3_bucket.test.id
+
+  rule {
+    object_ownership = "BucketOwnerEnforced"
+  }
+}
+
+resource "aws_config_delivery_channel" "test" {
+  name           = %[1]q
+  s3_bucket_name = aws_s3_bucket.test.bucket
+  depends_on     = [aws_config_configuration_recorder.test]
 }
-`, randInt, randInt, randInt, randInt, randInt)
+`, rName)
 }
diff --git a/internal/service/configservice/conformance_pack.go b/internal/service/configservice/conformance_pack.go
index bff7120447e..2b7609f8d8c 100644
--- a/internal/service/configservice/conformance_pack.go
+++ b/internal/service/configservice/conformance_pack.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package configservice
 
 import (
 	"context"
 	"log"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/configservice"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -70,8 +73,8 @@ func ResourceConformancePack() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 256),
-					validation.StringMatch(regexp.MustCompile(`^[a-zA-Z]`), "must begin with alphabetic character"),
-					validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9-]+$`), "must contain only alphanumeric and hyphen characters")),
+					validation.StringMatch(regexache.MustCompile(`^[A-Za-z]`), "must begin with alphabetic character"),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z-]+$`), "must contain only alphanumeric and hyphen characters")),
 			},
 			"template_body": {
 				Type:             schema.TypeString,
@@ -88,7 +91,7 @@ func ResourceConformancePack() *schema.Resource {
 				Optional: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 1024),
-					validation.StringMatch(regexp.MustCompile(`^s3://`), "must begin with s3://"),
+					validation.StringMatch(regexache.MustCompile(`^s3://`), "must begin with s3://"),
 				),
 				AtLeastOneOf: []string{"template_s3_uri", "template_body"},
 			},
diff --git a/internal/service/configservice/conformance_pack_test.go b/internal/service/configservice/conformance_pack_test.go
index dcc19259817..8cc97459236 100644
--- a/internal/service/configservice/conformance_pack_test.go
+++ b/internal/service/configservice/conformance_pack_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package configservice_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/configservice"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -33,7 +36,7 @@ func testAccConformancePack_basic(t *testing.T) {
 				Config: testAccConformancePackConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckConformancePackExists(ctx, resourceName, &pack),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "config", regexp.MustCompile(fmt.Sprintf("conformance-pack/%s/.+", rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "config", regexache.MustCompile(fmt.Sprintf("conformance-pack/%s/.+", rName))),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "delivery_s3_bucket", ""),
 					resource.TestCheckResourceAttr(resourceName, "delivery_s3_key_prefix", ""),
@@ -52,7 +55,7 @@ func testAccConformancePack_basic(t *testing.T) {
 	})
 }
 
-func testAccConformancePack_forceNew(t *testing.T) {
+func testAccConformancePack_updateName(t *testing.T) {
 	ctx := acctest.Context(t)
 	var before, after configservice.ConformancePackDetail
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
@@ -69,6 +72,7 @@ func testAccConformancePack_forceNew(t *testing.T) {
 				Config: testAccConformancePackConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckConformancePackExists(ctx, resourceName, &before),
+					resource.TestCheckResourceAttr(resourceName, "name", rName),
 				),
 			},
 			{
@@ -76,7 +80,7 @@ func testAccConformancePack_forceNew(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckConformancePackExists(ctx, resourceName, &after),
 					testAccCheckConformancePackRecreated(&before, &after),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "config", regexp.MustCompile(fmt.Sprintf("conformance-pack/%s/.+", rNameUpdated))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "config", regexache.MustCompile(fmt.Sprintf("conformance-pack/%s/.+", rNameUpdated))),
 					resource.TestCheckResourceAttr(resourceName, "name", rNameUpdated),
 					resource.TestCheckResourceAttr(resourceName, "delivery_s3_bucket", ""),
 					resource.TestCheckResourceAttr(resourceName, "delivery_s3_key_prefix", ""),
@@ -135,7 +139,7 @@ func testAccConformancePack_inputParameters(t *testing.T) {
 				Config: testAccConformancePackConfig_inputParameter(rName, "TestKey", "TestValue"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckConformancePackExists(ctx, resourceName, &pack),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "config", regexp.MustCompile(fmt.Sprintf("conformance-pack/%s/.+", rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "config", regexache.MustCompile(fmt.Sprintf("conformance-pack/%s/.+", rName))),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "delivery_s3_bucket", ""),
 					resource.TestCheckResourceAttr(resourceName, "delivery_s3_key_prefix", ""),
@@ -172,7 +176,7 @@ func testAccConformancePack_S3Delivery(t *testing.T) {
 				Config: testAccConformancePackConfig_s3Delivery(rName, rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckConformancePackExists(ctx, resourceName, &pack),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "config", regexp.MustCompile(fmt.Sprintf("conformance-pack/%s/.+", rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "config", regexache.MustCompile(fmt.Sprintf("conformance-pack/%s/.+", rName))),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "delivery_s3_bucket", rName),
 					resource.TestCheckResourceAttr(resourceName, "delivery_s3_key_prefix", rName),
@@ -205,7 +209,7 @@ func testAccConformancePack_S3Template(t *testing.T) {
 				Config: testAccConformancePackConfig_s3Template(rName, rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckConformancePackExists(ctx, resourceName, &pack),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "config", regexp.MustCompile(fmt.Sprintf("conformance-pack/%s/.+", rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "config", regexache.MustCompile(fmt.Sprintf("conformance-pack/%s/.+", rName))),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "delivery_s3_bucket", ""),
 					resource.TestCheckResourceAttr(resourceName, "delivery_s3_key_prefix", ""),
@@ -295,7 +299,7 @@ func testAccConformancePack_updateS3Delivery(t *testing.T) {
 				Config: testAccConformancePackConfig_s3Delivery(rName, bucketName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckConformancePackExists(ctx, resourceName, &pack),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "config", regexp.MustCompile(fmt.Sprintf("conformance-pack/%s/.+", rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "config", regexache.MustCompile(fmt.Sprintf("conformance-pack/%s/.+", rName))),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "delivery_s3_bucket", bucketName),
 					resource.TestCheckResourceAttr(resourceName, "delivery_s3_key_prefix", bucketName),
@@ -335,7 +339,7 @@ func testAccConformancePack_updateS3Template(t *testing.T) {
 				Config: testAccConformancePackConfig_s3Template(rName, bucketName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckConformancePackExists(ctx, resourceName, &pack),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "config", regexp.MustCompile(fmt.Sprintf("conformance-pack/%s/.+", rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "config", regexache.MustCompile(fmt.Sprintf("conformance-pack/%s/.+", rName))),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "delivery_s3_bucket", ""),
 					resource.TestCheckResourceAttr(resourceName, "delivery_s3_key_prefix", ""),
@@ -374,7 +378,7 @@ func testAccConformancePack_updateTemplateBody(t *testing.T) {
 				Config: testAccConformancePackConfig_update(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckConformancePackExists(ctx, resourceName, &pack),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "config", regexp.MustCompile(fmt.Sprintf("conformance-pack/%s/.+", rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "config", regexache.MustCompile(fmt.Sprintf("conformance-pack/%s/.+", rName))),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "delivery_s3_bucket", ""),
 					resource.TestCheckResourceAttr(resourceName, "delivery_s3_key_prefix", ""),
@@ -409,7 +413,7 @@ func testAccConformancePack_S3TemplateAndTemplateBody(t *testing.T) {
 				Config: testAccConformancePackConfig_s3TemplateAndTemplateBody(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckConformancePackExists(ctx, resourceName, &pack),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "config", regexp.MustCompile(fmt.Sprintf("conformance-pack/%s/.+", rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "config", regexache.MustCompile(fmt.Sprintf("conformance-pack/%s/.+", rName))),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "delivery_s3_bucket", ""),
 					resource.TestCheckResourceAttr(resourceName, "delivery_s3_key_prefix", ""),
@@ -642,11 +646,6 @@ resource "aws_s3_bucket" "test" {
   force_destroy = true
 }
 
-resource "aws_s3_bucket_acl" "test" {
-  bucket = aws_s3_bucket.test.id
-  acl    = "private"
-}
-
 resource "aws_config_conformance_pack" "test" {
   depends_on             = [aws_config_configuration_recorder.test]
   name                   = %[2]q
@@ -674,11 +673,6 @@ resource "aws_s3_bucket" "test" {
   force_destroy = true
 }
 
-resource "aws_s3_bucket_acl" "test" {
-  bucket = aws_s3_bucket.test.id
-  acl    = "private"
-}
-
 resource "aws_s3_object" "test" {
   bucket  = aws_s3_bucket.test.id
   key     = %[1]q
@@ -710,11 +704,6 @@ resource "aws_s3_bucket" "test" {
   force_destroy = true
 }
 
-resource "aws_s3_bucket_acl" "test" {
-  bucket = aws_s3_bucket.test.id
-  acl    = "private"
-}
-
 resource "aws_s3_object" "test" {
   bucket  = aws_s3_bucket.test.id
   key     = %[1]q
diff --git a/internal/service/configservice/consts.go b/internal/service/configservice/consts.go
index 34657afde0e..d2db999666a 100644
--- a/internal/service/configservice/consts.go
+++ b/internal/service/configservice/consts.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package configservice
 
 import (
diff --git a/internal/service/configservice/delivery_channel.go b/internal/service/configservice/delivery_channel.go
index 575da123b02..e11593003e6 100644
--- a/internal/service/configservice/delivery_channel.go
+++ b/internal/service/configservice/delivery_channel.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package configservice
 
 import (
diff --git a/internal/service/configservice/delivery_channel_test.go b/internal/service/configservice/delivery_channel_test.go
index 32d1c810266..002f782ab7b 100644
--- a/internal/service/configservice/delivery_channel_test.go
+++ b/internal/service/configservice/delivery_channel_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package configservice_test
 
 import (
diff --git a/internal/service/configservice/find.go b/internal/service/configservice/find.go
index c74f45f3094..c6065c48e91 100644
--- a/internal/service/configservice/find.go
+++ b/internal/service/configservice/find.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package configservice
 
 import (
@@ -23,10 +26,6 @@ func FindConfigRule(ctx context.Context, conn *configservice.ConfigService, name
 		}
 	}
 
-	if output == nil {
-		return nil, nil
-	}
-
 	if output == nil || output.ConfigRules == nil || len(output.ConfigRules) == 0 || output.ConfigRules[0] == nil {
 		return nil, tfresource.NewEmptyResultError(input)
 	}
diff --git a/internal/service/configservice/flex.go b/internal/service/configservice/flex.go
index 42af6a89977..b72a1204733 100644
--- a/internal/service/configservice/flex.go
+++ b/internal/service/configservice/flex.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package configservice
 
 import (
@@ -50,24 +53,76 @@ func expandOrganizationAggregationSource(configured map[string]interface{}) *con
 	return &source
 }
 
-func expandRecordingGroup(configured []interface{}) *configservice.RecordingGroup {
+func expandRecordingGroup(group map[string]interface{}) *configservice.RecordingGroup {
 	recordingGroup := configservice.RecordingGroup{}
-	group := configured[0].(map[string]interface{})
 
 	if v, ok := group["all_supported"]; ok {
 		recordingGroup.AllSupported = aws.Bool(v.(bool))
 	}
 
+	if v, ok := group["exclusion_by_resource_types"]; ok {
+		if len(v.([]interface{})) > 0 {
+			recordingGroup.ExclusionByResourceTypes = expandRecordingGroupExclusionByResourceTypes(v.([]interface{}))
+		}
+	}
+
 	if v, ok := group["include_global_resource_types"]; ok {
 		recordingGroup.IncludeGlobalResourceTypes = aws.Bool(v.(bool))
 	}
 
+	if v, ok := group["recording_strategy"]; ok {
+		if len(v.([]interface{})) > 0 {
+			recordingGroup.RecordingStrategy = expandRecordingGroupRecordingStrategy(v.([]interface{}))
+		}
+	}
+
 	if v, ok := group["resource_types"]; ok {
 		recordingGroup.ResourceTypes = flex.ExpandStringSet(v.(*schema.Set))
 	}
 	return &recordingGroup
 }
 
+func expandRecordingGroupExclusionByResourceTypes(configured []interface{}) *configservice.ExclusionByResourceTypes {
+	exclusionByResourceTypes := configservice.ExclusionByResourceTypes{}
+	exclusion := configured[0].(map[string]interface{})
+	if v, ok := exclusion["resource_types"]; ok {
+		exclusionByResourceTypes.ResourceTypes = flex.ExpandStringSet(v.(*schema.Set))
+	}
+	return &exclusionByResourceTypes
+}
+
+func expandRecordingGroupRecordingStrategy(configured []interface{}) *configservice.RecordingStrategy {
+	recordingStrategy := configservice.RecordingStrategy{}
+	strategy := configured[0].(map[string]interface{})
+	if v, ok := strategy["use_only"].(string); ok {
+		recordingStrategy.UseOnly = aws.String(v)
+	}
+	return &recordingStrategy
+}
+
+func expandRulesEvaluationModes(in []interface{}) []*configservice.EvaluationModeConfiguration {
+	if len(in) == 0 {
+		return nil
+	}
+
+	var out []*configservice.EvaluationModeConfiguration
+	for _, val := range in {
+		m, ok := val.(map[string]interface{})
+		if !ok {
+			continue
+		}
+
+		e := &configservice.EvaluationModeConfiguration{}
+		if v, ok := m["mode"].(string); ok && v != "" {
+			e.Mode = aws.String(v)
+		}
+
+		out = append(out, e)
+	}
+
+	return out
+}
+
 func expandRuleScope(l []interface{}) *configservice.Scope {
 	if len(l) == 0 || l[0] == nil {
 		return nil
@@ -187,17 +242,64 @@ func flattenRecordingGroup(g *configservice.RecordingGroup) []map[string]interfa
 		m["all_supported"] = aws.BoolValue(g.AllSupported)
 	}
 
+	if g.ExclusionByResourceTypes != nil {
+		m["exclusion_by_resource_types"] = flattenExclusionByResourceTypes(g.ExclusionByResourceTypes)
+	}
+
 	if g.IncludeGlobalResourceTypes != nil {
 		m["include_global_resource_types"] = aws.BoolValue(g.IncludeGlobalResourceTypes)
 	}
 
+	if g.RecordingStrategy != nil {
+		m["recording_strategy"] = flattenRecordingGroupRecordingStrategy(g.RecordingStrategy)
+	}
+
 	if g.ResourceTypes != nil && len(g.ResourceTypes) > 0 {
 		m["resource_types"] = flex.FlattenStringSet(g.ResourceTypes)
 	}
 
 	return []map[string]interface{}{m}
 }
+func flattenExclusionByResourceTypes(exclusionByResourceTypes *configservice.ExclusionByResourceTypes) []interface{} {
+	if exclusionByResourceTypes == nil {
+		return nil
+	}
+	m := make(map[string]interface{})
+	if exclusionByResourceTypes.ResourceTypes != nil {
+		m["resource_types"] = flex.FlattenStringSet(exclusionByResourceTypes.ResourceTypes)
+	}
+
+	return []interface{}{m}
+}
+
+func flattenRuleEvaluationMode(in []*configservice.EvaluationModeConfiguration) []interface{} {
+	if len(in) == 0 {
+		return nil
+	}
+
+	var out []interface{}
+	for _, v := range in {
+		m := map[string]interface{}{
+			"mode": aws.StringValue(v.Mode),
+		}
+
+		out = append(out, m)
+	}
+
+	return out
+}
 
+func flattenRecordingGroupRecordingStrategy(recordingStrategy *configservice.RecordingStrategy) []interface{} {
+	if recordingStrategy == nil {
+		return nil
+	}
+	m := make(map[string]interface{})
+	if recordingStrategy.UseOnly != nil {
+		m["use_only"] = aws.StringValue(recordingStrategy.UseOnly)
+	}
+
+	return []interface{}{m}
+}
 func flattenRuleScope(scope *configservice.Scope) []interface{} {
 	var items []interface{}
 
diff --git a/internal/service/configservice/generate.go b/internal/service/configservice/generate.go
index a99eba8049c..74dc65f9061 100644
--- a/internal/service/configservice/generate.go
+++ b/internal/service/configservice/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTags -ServiceTagsSlice -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/configservice/organization_conformance_pack.go b/internal/service/configservice/organization_conformance_pack.go
index 26e407e9b72..626708afa31 100644
--- a/internal/service/configservice/organization_conformance_pack.go
+++ b/internal/service/configservice/organization_conformance_pack.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package configservice
 
 import (
 	"context"
 	"log"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/configservice"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -46,7 +49,7 @@ func ResourceOrganizationConformancePack() *schema.Resource {
 				Optional: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 63),
-					validation.StringMatch(regexp.MustCompile(`^awsconfigconforms`), `must begin with "awsconfigconforms"`),
+					validation.StringMatch(regexache.MustCompile(`^awsconfigconforms`), `must begin with "awsconfigconforms"`),
 				),
 			},
 			"delivery_s3_key_prefix": {
@@ -86,8 +89,8 @@ func ResourceOrganizationConformancePack() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 128),
-					validation.StringMatch(regexp.MustCompile(`^[a-zA-Z]`), "must begin with alphabetic character"),
-					validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9-]+$`), "must contain only alphanumeric and hyphen characters"),
+					validation.StringMatch(regexache.MustCompile(`^[A-Za-z]`), "must begin with alphabetic character"),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z-]+$`), "must contain only alphanumeric and hyphen characters"),
 				),
 			},
 			"template_body": {
@@ -105,7 +108,7 @@ func ResourceOrganizationConformancePack() *schema.Resource {
 				Optional: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 1024),
-					validation.StringMatch(regexp.MustCompile(`^s3://`), "must begin with s3://"),
+					validation.StringMatch(regexache.MustCompile(`^s3://`), "must begin with s3://"),
 				),
 				ConflictsWith: []string{"template_body"},
 			},
diff --git a/internal/service/configservice/organization_conformance_pack_test.go b/internal/service/configservice/organization_conformance_pack_test.go
index e8b770bd114..9f414e12429 100644
--- a/internal/service/configservice/organization_conformance_pack_test.go
+++ b/internal/service/configservice/organization_conformance_pack_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package configservice_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/configservice"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -33,7 +36,7 @@ func testAccOrganizationConformancePack_basic(t *testing.T) {
 				Config: testAccOrganizationConformancePackConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckOrganizationConformancePackExists(ctx, resourceName, &pack),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "config", regexp.MustCompile(fmt.Sprintf("organization-conformance-pack/%s-.+", rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "config", regexache.MustCompile(fmt.Sprintf("organization-conformance-pack/%s-.+", rName))),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "delivery_s3_bucket", ""),
 					resource.TestCheckResourceAttr(resourceName, "delivery_s3_key_prefix", ""),
@@ -124,7 +127,7 @@ func testAccOrganizationConformancePack_excludedAccounts(t *testing.T) {
 	})
 }
 
-func testAccOrganizationConformancePack_forceNew(t *testing.T) {
+func testAccOrganizationConformancePack_updateName(t *testing.T) {
 	ctx := acctest.Context(t)
 	var before, after configservice.OrganizationConformancePack
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
@@ -141,6 +144,7 @@ func testAccOrganizationConformancePack_forceNew(t *testing.T) {
 				Config: testAccOrganizationConformancePackConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckOrganizationConformancePackExists(ctx, resourceName, &before),
+					resource.TestCheckResourceAttr(resourceName, "name", rName),
 				),
 			},
 			{
@@ -148,7 +152,7 @@ func testAccOrganizationConformancePack_forceNew(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckOrganizationConformancePackExists(ctx, resourceName, &after),
 					testAccCheckOrganizationConformancePackRecreated(&before, &after),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "config", regexp.MustCompile(fmt.Sprintf("organization-conformance-pack/%s-.+", rNameUpdated))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "config", regexache.MustCompile(fmt.Sprintf("organization-conformance-pack/%s-.+", rNameUpdated))),
 					resource.TestCheckResourceAttr(resourceName, "name", rNameUpdated),
 					resource.TestCheckResourceAttr(resourceName, "delivery_s3_bucket", ""),
 					resource.TestCheckResourceAttr(resourceName, "delivery_s3_key_prefix", ""),
@@ -248,7 +252,7 @@ func testAccOrganizationConformancePack_S3Template(t *testing.T) {
 				Config: testAccOrganizationConformancePackConfig_s3Template(rName, rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckOrganizationConformancePackExists(ctx, resourceName, &pack),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "config", regexp.MustCompile(fmt.Sprintf("organization-conformance-pack/%s-.+", rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "config", regexache.MustCompile(fmt.Sprintf("organization-conformance-pack/%s-.+", rName))),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "delivery_s3_bucket", ""),
 					resource.TestCheckResourceAttr(resourceName, "delivery_s3_key_prefix", ""),
@@ -647,11 +651,6 @@ resource "aws_s3_bucket" "test" {
   bucket        = %q
   force_destroy = true
 }
-
-resource "aws_s3_bucket_acl" "test" {
-  bucket = aws_s3_bucket.test.id
-  acl    = "private"
-}
 `, rName, bName))
 }
 
@@ -670,11 +669,6 @@ resource "aws_s3_bucket" "test" {
   force_destroy = true
 }
 
-resource "aws_s3_bucket_acl" "test" {
-  bucket = aws_s3_bucket.test.id
-  acl    = "private"
-}
-
 resource "aws_s3_object" "test" {
   bucket  = aws_s3_bucket.test.id
   key     = %[2]q
diff --git a/internal/service/configservice/organization_custom_policy_rule.go b/internal/service/configservice/organization_custom_policy_rule.go
index ec159b4e9cc..6152993d422 100644
--- a/internal/service/configservice/organization_custom_policy_rule.go
+++ b/internal/service/configservice/organization_custom_policy_rule.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package configservice
 
 import (
diff --git a/internal/service/configservice/organization_custom_policy_rule_test.go b/internal/service/configservice/organization_custom_policy_rule_test.go
index a237f95fca0..eeb37ff4750 100644
--- a/internal/service/configservice/organization_custom_policy_rule_test.go
+++ b/internal/service/configservice/organization_custom_policy_rule_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package configservice_test
 
 import (
 	"context"
 	"errors"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/configservice"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -44,7 +47,7 @@ func TestAccConfigServiceOrganizationCustomPolicyRule_basic(t *testing.T) {
 				Config: testAccOrganizationCustomPolicyRuleConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckOrganizationCustomPolicyRuleExists(ctx, resourceName, &rule),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "config", regexp.MustCompile(fmt.Sprintf("organization-config-rule/%s-.+", rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "config", regexache.MustCompile(fmt.Sprintf("organization-config-rule/%s-.+", rName))),
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
 					resource.TestCheckResourceAttr(resourceName, "excluded_accounts.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "input_parameters", ""),
diff --git a/internal/service/configservice/organization_custom_rule.go b/internal/service/configservice/organization_custom_rule.go
index 8472739a17f..f4b77e25bf8 100644
--- a/internal/service/configservice/organization_custom_rule.go
+++ b/internal/service/configservice/organization_custom_rule.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package configservice
 
 import (
diff --git a/internal/service/configservice/organization_custom_rule_test.go b/internal/service/configservice/organization_custom_rule_test.go
index 512f8fbf7b9..e85d72a00a7 100644
--- a/internal/service/configservice/organization_custom_rule_test.go
+++ b/internal/service/configservice/organization_custom_rule_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package configservice_test
 
 import (
 	"context"
 	"errors"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/configservice"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -36,7 +39,7 @@ func testAccOrganizationCustomRule_basic(t *testing.T) {
 				Config: testAccOrganizationCustomRuleConfig_triggerTypes1(rName, "ConfigurationItemChangeNotification"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckOrganizationCustomRuleExists(ctx, resourceName, &rule),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "config", regexp.MustCompile(fmt.Sprintf("organization-config-rule/%s-.+", rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "config", regexache.MustCompile(fmt.Sprintf("organization-config-rule/%s-.+", rName))),
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
 					resource.TestCheckResourceAttr(resourceName, "excluded_accounts.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "input_parameters", ""),
@@ -95,7 +98,7 @@ func testAccOrganizationCustomRule_errorHandling(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccOrganizationCustomRuleConfig_errorHandling(rName),
-				ExpectError: regexp.MustCompile(`InsufficientPermission`),
+				ExpectError: regexache.MustCompile(`InsufficientPermission`),
 			},
 		},
 	})
@@ -190,7 +193,7 @@ func testAccOrganizationCustomRule_InputParameters(t *testing.T) {
 				Config: testAccOrganizationCustomRuleConfig_inputParameters(rName, inputParameters1),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckOrganizationCustomRuleExists(ctx, resourceName, &rule),
-					resource.TestMatchResourceAttr(resourceName, "input_parameters", regexp.MustCompile(`CostCenter`)),
+					resource.TestMatchResourceAttr(resourceName, "input_parameters", regexache.MustCompile(`CostCenter`)),
 				),
 			},
 			{
@@ -202,7 +205,7 @@ func testAccOrganizationCustomRule_InputParameters(t *testing.T) {
 				Config: testAccOrganizationCustomRuleConfig_inputParameters(rName, inputParameters2),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckOrganizationCustomRuleExists(ctx, resourceName, &rule),
-					resource.TestMatchResourceAttr(resourceName, "input_parameters", regexp.MustCompile(`Department`)),
+					resource.TestMatchResourceAttr(resourceName, "input_parameters", regexache.MustCompile(`Department`)),
 				),
 			},
 		},
diff --git a/internal/service/configservice/organization_managed_rule.go b/internal/service/configservice/organization_managed_rule.go
index 2d28f2263ac..6dc8de5cca0 100644
--- a/internal/service/configservice/organization_managed_rule.go
+++ b/internal/service/configservice/organization_managed_rule.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package configservice
 
 import (
diff --git a/internal/service/configservice/organization_managed_rule_test.go b/internal/service/configservice/organization_managed_rule_test.go
index 0d8752fc1d9..1e7ba5a8ee3 100644
--- a/internal/service/configservice/organization_managed_rule_test.go
+++ b/internal/service/configservice/organization_managed_rule_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package configservice_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/configservice"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -32,7 +35,7 @@ func testAccOrganizationManagedRule_basic(t *testing.T) {
 				Config: testAccOrganizationManagedRuleConfig_identifier(rName, "IAM_PASSWORD_POLICY"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckOrganizationManagedRuleExists(ctx, resourceName, &rule),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "config", regexp.MustCompile(fmt.Sprintf("organization-config-rule/%s-.+", rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "config", regexache.MustCompile(fmt.Sprintf("organization-config-rule/%s-.+", rName))),
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
 					resource.TestCheckResourceAttr(resourceName, "excluded_accounts.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "input_parameters", ""),
@@ -90,7 +93,7 @@ func testAccOrganizationManagedRule_errorHandling(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccOrganizationManagedRuleConfig_errorHandling(rName),
-				ExpectError: regexp.MustCompile(`NoAvailableConfigurationRecorder`),
+				ExpectError: regexache.MustCompile(`NoAvailableConfigurationRecorder`),
 			},
 		},
 	})
@@ -185,7 +188,7 @@ func testAccOrganizationManagedRule_InputParameters(t *testing.T) {
 				Config: testAccOrganizationManagedRuleConfig_inputParameters(rName, inputParameters1),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckOrganizationManagedRuleExists(ctx, resourceName, &rule),
-					resource.TestMatchResourceAttr(resourceName, "input_parameters", regexp.MustCompile(`CostCenter`)),
+					resource.TestMatchResourceAttr(resourceName, "input_parameters", regexache.MustCompile(`CostCenter`)),
 				),
 			},
 			{
@@ -197,7 +200,7 @@ func testAccOrganizationManagedRule_InputParameters(t *testing.T) {
 				Config: testAccOrganizationManagedRuleConfig_inputParameters(rName, inputParameters2),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckOrganizationManagedRuleExists(ctx, resourceName, &rule),
-					resource.TestMatchResourceAttr(resourceName, "input_parameters", regexp.MustCompile(`Department`)),
+					resource.TestMatchResourceAttr(resourceName, "input_parameters", regexache.MustCompile(`Department`)),
 				),
 			},
 		},
diff --git a/internal/service/configservice/remediation_configuration.go b/internal/service/configservice/remediation_configuration.go
index b89b8fd20f5..a63e6a9fcc2 100644
--- a/internal/service/configservice/remediation_configuration.go
+++ b/internal/service/configservice/remediation_configuration.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package configservice
 
 import (
@@ -395,8 +398,16 @@ func flattenRemediationParameterValues(parameters map[string]*configservice.Reme
 		items = append(items, item)
 	}
 
-	slices.SortFunc(items, func(a, b interface{}) bool {
-		return a.(map[string]interface{})["name"].(string) < b.(map[string]interface{})["name"].(string)
+	slices.SortFunc(items, func(a, b interface{}) int {
+		if a.(map[string]interface{})["name"].(string) < b.(map[string]interface{})["name"].(string) {
+			return -1
+		}
+
+		if a.(map[string]interface{})["name"].(string) > b.(map[string]interface{})["name"].(string) {
+			return 1
+		}
+
+		return 0
 	})
 
 	return items
diff --git a/internal/service/configservice/remediation_configuration_test.go b/internal/service/configservice/remediation_configuration_test.go
index 26918e27c14..e708d2d3c93 100644
--- a/internal/service/configservice/remediation_configuration_test.go
+++ b/internal/service/configservice/remediation_configuration_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package configservice_test
 
 import (
diff --git a/internal/service/configservice/service_package.go b/internal/service/configservice/service_package.go
index 0817db9ad60..49ed104ba3f 100644
--- a/internal/service/configservice/service_package.go
+++ b/internal/service/configservice/service_package.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package configservice
 
 import (
diff --git a/internal/service/configservice/service_package_gen.go b/internal/service/configservice/service_package_gen.go
index 92d971943c6..42f7adae36b 100644
--- a/internal/service/configservice/service_package_gen.go
+++ b/internal/service/configservice/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	configservice_sdkv1 "github.com/aws/aws-sdk-go/service/configservice"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -102,4 +103,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*c
 	return configservice_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/configservice/status.go b/internal/service/configservice/status.go
index 647b29e7b73..270b4823277 100644
--- a/internal/service/configservice/status.go
+++ b/internal/service/configservice/status.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package configservice
 
 import (
diff --git a/internal/service/configservice/sweep.go b/internal/service/configservice/sweep.go
index 9223c5f1ff6..7aaa491ef92 100644
--- a/internal/service/configservice/sweep.go
+++ b/internal/service/configservice/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package configservice
 
@@ -14,9 +14,10 @@ import (
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_config_aggregate_authorization", &resource.Sweeper{
 		Name: "aws_config_aggregate_authorization",
 		F:    sweepAggregateAuthorizations,
@@ -43,7 +44,7 @@ func init() {
 
 func sweepAggregateAuthorizations(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("Error getting client: %s", err)
 	}
@@ -51,7 +52,7 @@ func sweepAggregateAuthorizations(region string) error {
 
 	aggregateAuthorizations, err := DescribeAggregateAuthorizations(ctx, conn)
 	if err != nil {
-		if sweep.SkipSweepError(err) {
+		if awsv1.SkipSweepError(err) {
 			log.Printf("[WARN] Skipping Config Aggregate Authorizations sweep for %s: %s", region, err)
 			return nil
 		}
@@ -81,7 +82,7 @@ func sweepAggregateAuthorizations(region string) error {
 
 func sweepConfigurationAggregators(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("Error getting client: %s", err)
 	}
@@ -89,7 +90,7 @@ func sweepConfigurationAggregators(region string) error {
 
 	resp, err := conn.DescribeConfigurationAggregatorsWithContext(ctx, &configservice.DescribeConfigurationAggregatorsInput{})
 	if err != nil {
-		if sweep.SkipSweepError(err) {
+		if awsv1.SkipSweepError(err) {
 			log.Printf("[WARN] Skipping Config Configuration Aggregators sweep for %s: %s", region, err)
 			return nil
 		}
@@ -120,7 +121,7 @@ func sweepConfigurationAggregators(region string) error {
 
 func sweepConfigurationRecorder(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -129,7 +130,7 @@ func sweepConfigurationRecorder(region string) error {
 	req := &configservice.DescribeConfigurationRecordersInput{}
 	resp, err := conn.DescribeConfigurationRecordersWithContext(ctx, req)
 	if err != nil {
-		if sweep.SkipSweepError(err) {
+		if awsv1.SkipSweepError(err) {
 			log.Printf("[WARN] Skipping Config Configuration Recorders sweep for %s: %s", region, err)
 			return nil
 		}
@@ -164,7 +165,7 @@ func sweepConfigurationRecorder(region string) error {
 
 func sweepDeliveryChannels(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -185,7 +186,7 @@ func sweepDeliveryChannels(region string) error {
 		return nil
 	})
 	if err != nil {
-		if sweep.SkipSweepError(err) {
+		if awsv1.SkipSweepError(err) {
 			log.Printf("[WARN] Skipping Config Delivery Channels sweep for %s: %s", region, err)
 			return nil
 		}
diff --git a/internal/service/configservice/tags_gen.go b/internal/service/configservice/tags_gen.go
index 3799baf24ce..77c931636de 100644
--- a/internal/service/configservice/tags_gen.go
+++ b/internal/service/configservice/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/configservice"
 	"github.com/aws/aws-sdk-go/service/configservice/configserviceiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -102,6 +104,8 @@ func updateTags(ctx context.Context, conn configserviceiface.ConfigServiceAPI, i
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.ConfigService)
 	if len(removedTags) > 0 {
diff --git a/internal/service/configservice/validate.go b/internal/service/configservice/validate.go
index 86968f0a9a3..f677244bbf8 100644
--- a/internal/service/configservice/validate.go
+++ b/internal/service/configservice/validate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package configservice
 
 import (
diff --git a/internal/service/configservice/wait.go b/internal/service/configservice/wait.go
index 6215ceaa035..e4dfabac5a1 100644
--- a/internal/service/configservice/wait.go
+++ b/internal/service/configservice/wait.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package configservice
 
 import (
diff --git a/internal/service/connect/bot_association.go b/internal/service/connect/bot_association.go
index 0dcd9196584..197797c6b2c 100644
--- a/internal/service/connect/bot_association.go
+++ b/internal/service/connect/bot_association.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package connect
 
 import (
diff --git a/internal/service/connect/bot_association_data_source.go b/internal/service/connect/bot_association_data_source.go
index 729fd8492ad..c2c3eb5813a 100644
--- a/internal/service/connect/bot_association_data_source.go
+++ b/internal/service/connect/bot_association_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package connect
 
 import (
diff --git a/internal/service/connect/bot_association_data_source_test.go b/internal/service/connect/bot_association_data_source_test.go
index b09e0edfb75..b6ff81f459b 100644
--- a/internal/service/connect/bot_association_data_source_test.go
+++ b/internal/service/connect/bot_association_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package connect_test
 
 import (
diff --git a/internal/service/connect/bot_association_test.go b/internal/service/connect/bot_association_test.go
index 8a1a43cf4a5..f15bc4da688 100644
--- a/internal/service/connect/bot_association_test.go
+++ b/internal/service/connect/bot_association_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package connect_test
 
 import (
diff --git a/internal/service/connect/connect_test.go b/internal/service/connect/connect_test.go
index 0dbbfa307bb..b103c4c68e9 100644
--- a/internal/service/connect/connect_test.go
+++ b/internal/service/connect/connect_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package connect_test
 
 import (
diff --git a/internal/service/connect/contact_flow.go b/internal/service/connect/contact_flow.go
index dd58cc80cd2..ad96e3897c8 100644
--- a/internal/service/connect/contact_flow.go
+++ b/internal/service/connect/contact_flow.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package connect
 
 import (
diff --git a/internal/service/connect/contact_flow_data_source.go b/internal/service/connect/contact_flow_data_source.go
index e8bf67cb8b0..b4a69a91442 100644
--- a/internal/service/connect/contact_flow_data_source.go
+++ b/internal/service/connect/contact_flow_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package connect
 
 import (
diff --git a/internal/service/connect/contact_flow_data_source_test.go b/internal/service/connect/contact_flow_data_source_test.go
index c0292eb9e52..d3a6f1400a8 100644
--- a/internal/service/connect/contact_flow_data_source_test.go
+++ b/internal/service/connect/contact_flow_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package connect_test
 
 import (
diff --git a/internal/service/connect/contact_flow_module.go b/internal/service/connect/contact_flow_module.go
index 8916bfd6f5e..fab5a67df35 100644
--- a/internal/service/connect/contact_flow_module.go
+++ b/internal/service/connect/contact_flow_module.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package connect
 
 import (
diff --git a/internal/service/connect/contact_flow_module_data_source.go b/internal/service/connect/contact_flow_module_data_source.go
index aaeb4d4eaab..b5fb79145cd 100644
--- a/internal/service/connect/contact_flow_module_data_source.go
+++ b/internal/service/connect/contact_flow_module_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package connect
 
 import (
diff --git a/internal/service/connect/contact_flow_module_data_source_test.go b/internal/service/connect/contact_flow_module_data_source_test.go
index 82f8c22087b..b3e325990cd 100644
--- a/internal/service/connect/contact_flow_module_data_source_test.go
+++ b/internal/service/connect/contact_flow_module_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package connect_test
 
 import (
diff --git a/internal/service/connect/contact_flow_module_test.go b/internal/service/connect/contact_flow_module_test.go
index 8c81bfb8450..bb809ed1e1b 100644
--- a/internal/service/connect/contact_flow_module_test.go
+++ b/internal/service/connect/contact_flow_module_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package connect_test
 
 import (
diff --git a/internal/service/connect/contact_flow_test.go b/internal/service/connect/contact_flow_test.go
index 498a4c6af10..46b2d01370a 100644
--- a/internal/service/connect/contact_flow_test.go
+++ b/internal/service/connect/contact_flow_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package connect_test
 
 import (
diff --git a/internal/service/connect/enum.go b/internal/service/connect/enum.go
index 90f58bd1cc3..08f9820b2c3 100644
--- a/internal/service/connect/enum.go
+++ b/internal/service/connect/enum.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package connect
 
 import (
diff --git a/internal/service/connect/errors.go b/internal/service/connect/errors.go
index 7a30fcc2ce8..f8ea4c3d83f 100644
--- a/internal/service/connect/errors.go
+++ b/internal/service/connect/errors.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package connect
 
 // Error code constants missing from AWS Go SDK:
diff --git a/internal/service/connect/find.go b/internal/service/connect/find.go
index e0c71b90574..5cda2ca33ef 100644
--- a/internal/service/connect/find.go
+++ b/internal/service/connect/find.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package connect
 
 import (
diff --git a/internal/service/connect/generate.go b/internal/service/connect/generate.go
index f6679cd170e..c81edd5d94e 100644
--- a/internal/service/connect/generate.go
+++ b/internal/service/connect/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ServiceTagsMap -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/connect/hours_of_operation.go b/internal/service/connect/hours_of_operation.go
index ddefd3ca129..433230c9d26 100644
--- a/internal/service/connect/hours_of_operation.go
+++ b/internal/service/connect/hours_of_operation.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package connect
 
 import (
diff --git a/internal/service/connect/hours_of_operation_data_source.go b/internal/service/connect/hours_of_operation_data_source.go
index 543d383df55..050ddcd820a 100644
--- a/internal/service/connect/hours_of_operation_data_source.go
+++ b/internal/service/connect/hours_of_operation_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package connect
 
 import (
diff --git a/internal/service/connect/hours_of_operation_data_source_test.go b/internal/service/connect/hours_of_operation_data_source_test.go
index 5b5042b87d5..3a002213e7b 100644
--- a/internal/service/connect/hours_of_operation_data_source_test.go
+++ b/internal/service/connect/hours_of_operation_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package connect_test
 
 import (
diff --git a/internal/service/connect/hours_of_operation_test.go b/internal/service/connect/hours_of_operation_test.go
index 876a4ddbaae..1884b750d50 100644
--- a/internal/service/connect/hours_of_operation_test.go
+++ b/internal/service/connect/hours_of_operation_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package connect_test
 
 import (
diff --git a/internal/service/connect/id.go b/internal/service/connect/id.go
index ee440fc2a29..6e578d8cb50 100644
--- a/internal/service/connect/id.go
+++ b/internal/service/connect/id.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package connect
 
 import (
diff --git a/internal/service/connect/instance.go b/internal/service/connect/instance.go
index 87c8b7b0ebe..f6fb09e3f59 100644
--- a/internal/service/connect/instance.go
+++ b/internal/service/connect/instance.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package connect
 
 import (
@@ -5,10 +8,10 @@ import (
 	"errors"
 	"fmt"
 	"log"
-	"regexp"
 	"strconv"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/connect"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -91,8 +94,8 @@ func ResourceInstance() *schema.Resource {
 				AtLeastOneOf: []string{"directory_id", "instance_alias"},
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 64),
-					validation.StringMatch(regexp.MustCompile(`^([\da-zA-Z]+)([\da-zA-Z-]+)$`), "must contain only alphanumeric or hyphen characters"),
-					validation.StringDoesNotMatch(regexp.MustCompile(`^(d-).+$`), "can not start with d-"),
+					validation.StringMatch(regexache.MustCompile(`^([0-9A-Za-z]+)([0-9A-Za-z-]+)$`), "must contain only alphanumeric or hyphen characters"),
+					validation.StringDoesNotMatch(regexache.MustCompile(`^(d-).+$`), "can not start with d-"),
 				),
 			},
 			"multi_party_conference_enabled": {
diff --git a/internal/service/connect/instance_data_source.go b/internal/service/connect/instance_data_source.go
index a1bf591c566..a6086929149 100644
--- a/internal/service/connect/instance_data_source.go
+++ b/internal/service/connect/instance_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package connect
 
 import (
diff --git a/internal/service/connect/instance_data_source_test.go b/internal/service/connect/instance_data_source_test.go
index 6f8c437c5fb..58daeffff2e 100644
--- a/internal/service/connect/instance_data_source_test.go
+++ b/internal/service/connect/instance_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package connect_test
 
 import (
diff --git a/internal/service/connect/instance_storage_config.go b/internal/service/connect/instance_storage_config.go
index d2eabb75d5d..121aeb44c8b 100644
--- a/internal/service/connect/instance_storage_config.go
+++ b/internal/service/connect/instance_storage_config.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package connect
 
 import (
diff --git a/internal/service/connect/instance_storage_config_data_source.go b/internal/service/connect/instance_storage_config_data_source.go
index 71b86695cda..a9ea6e907d6 100644
--- a/internal/service/connect/instance_storage_config_data_source.go
+++ b/internal/service/connect/instance_storage_config_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package connect
 
 import (
diff --git a/internal/service/connect/instance_storage_config_data_source_test.go b/internal/service/connect/instance_storage_config_data_source_test.go
index 3b62760decc..49d749fab3a 100644
--- a/internal/service/connect/instance_storage_config_data_source_test.go
+++ b/internal/service/connect/instance_storage_config_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package connect_test
 
 import (
diff --git a/internal/service/connect/instance_storage_config_test.go b/internal/service/connect/instance_storage_config_test.go
index 98cf465d16b..f7751fcd090 100644
--- a/internal/service/connect/instance_storage_config_test.go
+++ b/internal/service/connect/instance_storage_config_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package connect_test
 
 import (
diff --git a/internal/service/connect/instance_test.go b/internal/service/connect/instance_test.go
index fbae48b6b86..1e5d7062203 100644
--- a/internal/service/connect/instance_test.go
+++ b/internal/service/connect/instance_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package connect_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/connect"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -32,7 +35,7 @@ func testAccInstance_basic(t *testing.T) {
 				Config: testAccInstanceConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckInstanceExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "connect", regexp.MustCompile(`instance/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "connect", regexache.MustCompile(`instance/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "auto_resolve_best_voices_enabled", "true"), //verified default result from ListInstanceAttributes()
 					resource.TestCheckResourceAttr(resourceName, "contact_flow_logs_enabled", "false"),       //verified default result from ListInstanceAttributes()
 					resource.TestCheckResourceAttr(resourceName, "contact_lens_enabled", "true"),             //verified default result from ListInstanceAttributes()
@@ -40,10 +43,10 @@ func testAccInstance_basic(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "early_media_enabled", "true"), //verified default result from ListInstanceAttributes()
 					resource.TestCheckResourceAttr(resourceName, "identity_management_type", connect.DirectoryTypeConnectManaged),
 					resource.TestCheckResourceAttr(resourceName, "inbound_calls_enabled", "true"),
-					resource.TestMatchResourceAttr(resourceName, "instance_alias", regexp.MustCompile(rName)),
+					resource.TestMatchResourceAttr(resourceName, "instance_alias", regexache.MustCompile(rName)),
 					resource.TestCheckResourceAttr(resourceName, "multi_party_conference_enabled", "false"),
 					resource.TestCheckResourceAttr(resourceName, "outbound_calls_enabled", "true"),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "service_role", "iam", regexp.MustCompile(`role/aws-service-role/connect.amazonaws.com/.+`)),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "service_role", "iam", regexache.MustCompile(`role/aws-service-role/connect.amazonaws.com/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "status", connect.InstanceStatusActive),
 				),
 			},
@@ -56,14 +59,14 @@ func testAccInstance_basic(t *testing.T) {
 				Config: testAccInstanceConfig_basicFlipped(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckInstanceExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "connect", regexp.MustCompile(`instance/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "connect", regexache.MustCompile(`instance/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "auto_resolve_best_voices_enabled", "false"),
 					resource.TestCheckResourceAttr(resourceName, "contact_flow_logs_enabled", "true"),
 					resource.TestCheckResourceAttr(resourceName, "contact_lens_enabled", "false"),
 					resource.TestCheckResourceAttrSet(resourceName, "created_time"),
 					resource.TestCheckResourceAttr(resourceName, "early_media_enabled", "false"),
 					resource.TestCheckResourceAttr(resourceName, "inbound_calls_enabled", "false"),
-					resource.TestMatchResourceAttr(resourceName, "instance_alias", regexp.MustCompile(rName)),
+					resource.TestMatchResourceAttr(resourceName, "instance_alias", regexache.MustCompile(rName)),
 					resource.TestCheckResourceAttr(resourceName, "multi_party_conference_enabled", "false"),
 					resource.TestCheckResourceAttr(resourceName, "outbound_calls_enabled", "false"),
 					resource.TestCheckResourceAttr(resourceName, "status", connect.InstanceStatusActive),
diff --git a/internal/service/connect/lambda_function_association.go b/internal/service/connect/lambda_function_association.go
index cafbd96dd3e..939eb1e87eb 100644
--- a/internal/service/connect/lambda_function_association.go
+++ b/internal/service/connect/lambda_function_association.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package connect
 
 import (
diff --git a/internal/service/connect/lambda_function_association_data_source.go b/internal/service/connect/lambda_function_association_data_source.go
index 6874d45e555..fa5f68f8bb0 100644
--- a/internal/service/connect/lambda_function_association_data_source.go
+++ b/internal/service/connect/lambda_function_association_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package connect
 
 import (
diff --git a/internal/service/connect/lambda_function_association_data_source_test.go b/internal/service/connect/lambda_function_association_data_source_test.go
index f70070218c1..92121a41336 100644
--- a/internal/service/connect/lambda_function_association_data_source_test.go
+++ b/internal/service/connect/lambda_function_association_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package connect_test
 
 import (
diff --git a/internal/service/connect/lambda_function_association_test.go b/internal/service/connect/lambda_function_association_test.go
index e77c26ed84c..9c2b23b4240 100644
--- a/internal/service/connect/lambda_function_association_test.go
+++ b/internal/service/connect/lambda_function_association_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package connect_test
 
 import (
diff --git a/internal/service/connect/phone_number.go b/internal/service/connect/phone_number.go
index 450d5f3f76c..6a072e1be70 100644
--- a/internal/service/connect/phone_number.go
+++ b/internal/service/connect/phone_number.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package connect
 
 import (
diff --git a/internal/service/connect/phone_number_test.go b/internal/service/connect/phone_number_test.go
index 6944b54cb5f..df1203ee193 100644
--- a/internal/service/connect/phone_number_test.go
+++ b/internal/service/connect/phone_number_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package connect_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/connect"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -98,7 +101,7 @@ func testAccPhoneNumber_prefix(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckPhoneNumberExists(ctx, resourceName, &v),
 					resource.TestCheckResourceAttrSet(resourceName, "phone_number"),
-					resource.TestMatchResourceAttr(resourceName, "phone_number", regexp.MustCompile(fmt.Sprintf("\\%s[0-9]{0,10}", prefix))),
+					resource.TestMatchResourceAttr(resourceName, "phone_number", regexache.MustCompile(fmt.Sprintf("\\%s[0-9]{0,10}", prefix))),
 					resource.TestCheckResourceAttr(resourceName, "prefix", prefix),
 				),
 			},
diff --git a/internal/service/connect/prompt_data_source.go b/internal/service/connect/prompt_data_source.go
index 65698432e0a..ad4e72b12b5 100644
--- a/internal/service/connect/prompt_data_source.go
+++ b/internal/service/connect/prompt_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package connect
 
 import (
diff --git a/internal/service/connect/prompt_data_source_test.go b/internal/service/connect/prompt_data_source_test.go
index 3efad2f1560..c7d4bc6851c 100644
--- a/internal/service/connect/prompt_data_source_test.go
+++ b/internal/service/connect/prompt_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package connect_test
 
 import (
diff --git a/internal/service/connect/queue.go b/internal/service/connect/queue.go
index 498779aff9f..ef138196ff9 100644
--- a/internal/service/connect/queue.go
+++ b/internal/service/connect/queue.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package connect
 
 import (
@@ -26,9 +29,7 @@ func ResourceQueue() *schema.Resource {
 		CreateWithoutTimeout: resourceQueueCreate,
 		ReadWithoutTimeout:   resourceQueueRead,
 		UpdateWithoutTimeout: resourceQueueUpdate,
-		// Queues do not support deletion today. NoOp the Delete method.
-		// Users can rename their queues manually if they want.
-		DeleteWithoutTimeout: schema.NoopContext,
+		DeleteWithoutTimeout: resourceQueueDelete,
 
 		Importer: &schema.ResourceImporter{
 			StateContext: schema.ImportStatePassthroughContext,
@@ -343,6 +344,27 @@ func resourceQueueUpdate(ctx context.Context, d *schema.ResourceData, meta inter
 	return resourceQueueRead(ctx, d, meta)
 }
 
+func resourceQueueDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	conn := meta.(*conns.AWSClient).ConnectConn(ctx)
+
+	instanceID, queueID, err := QueueParseID(d.Id())
+
+	if err != nil {
+		return diag.FromErr(err)
+	}
+
+	_, err = conn.DeleteQueueWithContext(ctx, &connect.DeleteQueueInput{
+		InstanceId: aws.String(instanceID),
+		QueueId:    aws.String(queueID),
+	})
+
+	if err != nil {
+		return diag.Errorf("deleting Queue (%s): %s", d.Id(), err)
+	}
+
+	return nil
+}
+
 func expandOutboundCallerConfig(outboundCallerConfig []interface{}) *connect.OutboundCallerConfig {
 	if len(outboundCallerConfig) == 0 || outboundCallerConfig[0] == nil {
 		return nil
diff --git a/internal/service/connect/queue_data_source.go b/internal/service/connect/queue_data_source.go
index 2e41707ce00..fe1010cad39 100644
--- a/internal/service/connect/queue_data_source.go
+++ b/internal/service/connect/queue_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package connect
 
 import (
diff --git a/internal/service/connect/queue_data_source_test.go b/internal/service/connect/queue_data_source_test.go
index e2eb1347758..f1132bc84e4 100644
--- a/internal/service/connect/queue_data_source_test.go
+++ b/internal/service/connect/queue_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package connect_test
 
 import (
diff --git a/internal/service/connect/queue_test.go b/internal/service/connect/queue_test.go
index b1b210df1db..7e1d8c379e4 100644
--- a/internal/service/connect/queue_test.go
+++ b/internal/service/connect/queue_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package connect_test
 
 import (
@@ -71,8 +74,6 @@ func testAccQueue_basic(t *testing.T) {
 }
 
 func testAccQueue_disappears(t *testing.T) {
-	t.Skip("Queues do not support deletion today")
-
 	ctx := acctest.Context(t)
 
 	var v connect.DescribeQueueOutput
diff --git a/internal/service/connect/quick_connect.go b/internal/service/connect/quick_connect.go
index d96e28a9aa9..a2e71656a22 100644
--- a/internal/service/connect/quick_connect.go
+++ b/internal/service/connect/quick_connect.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package connect
 
 import (
diff --git a/internal/service/connect/quick_connect_data_source.go b/internal/service/connect/quick_connect_data_source.go
index 2df1c68fdb7..3c983149722 100644
--- a/internal/service/connect/quick_connect_data_source.go
+++ b/internal/service/connect/quick_connect_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package connect
 
 import (
diff --git a/internal/service/connect/quick_connect_data_source_test.go b/internal/service/connect/quick_connect_data_source_test.go
index 22e10283600..14c72cecd77 100644
--- a/internal/service/connect/quick_connect_data_source_test.go
+++ b/internal/service/connect/quick_connect_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package connect_test
 
 import (
diff --git a/internal/service/connect/quick_connect_test.go b/internal/service/connect/quick_connect_test.go
index d268cca1687..0ddd5f96a0b 100644
--- a/internal/service/connect/quick_connect_test.go
+++ b/internal/service/connect/quick_connect_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package connect_test
 
 import (
diff --git a/internal/service/connect/routing_profile.go b/internal/service/connect/routing_profile.go
index 6288ee840b3..361e9df85de 100644
--- a/internal/service/connect/routing_profile.go
+++ b/internal/service/connect/routing_profile.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package connect
 
 import (
@@ -31,9 +34,7 @@ func ResourceRoutingProfile() *schema.Resource {
 		CreateWithoutTimeout: resourceRoutingProfileCreate,
 		ReadWithoutTimeout:   resourceRoutingProfileRead,
 		UpdateWithoutTimeout: resourceRoutingProfileUpdate,
-		// Routing profiles do not support deletion today. NoOp the Delete method.
-		// Users can rename their routing profiles manually if they want.
-		DeleteWithoutTimeout: schema.NoopContext,
+		DeleteWithoutTimeout: resourceRoutingProfileDelete,
 
 		Importer: &schema.ResourceImporter{
 			StateContext: schema.ImportStatePassthroughContext,
@@ -370,26 +371,26 @@ func updateQueueConfigs(ctx context.Context, conn *connect.Connect, instanceID,
 	return nil
 }
 
-// func resourceRoutingProfileDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-// 	conn := meta.(*conns.AWSClient).ConnectConn(ctx)
+func resourceRoutingProfileDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	conn := meta.(*conns.AWSClient).ConnectConn(ctx)
 
-// 	instanceID, routingProfileID, err := RoutingProfileParseID(d.Id())
+	instanceID, routingProfileID, err := RoutingProfileParseID(d.Id())
 
-// 	if err != nil {
-// 		return diag.FromErr(err)
-// 	}
+	if err != nil {
+		return diag.FromErr(err)
+	}
 
-// 	_, err = conn.DeleteRoutingProfileWithContext(ctx, &connect.DeleteRoutingProfileInput{
-// 		InstanceId:       aws.String(instanceID),
-// 		RoutingProfileId: aws.String(routingProfileID),
-// 	})
+	_, err = conn.DeleteRoutingProfileWithContext(ctx, &connect.DeleteRoutingProfileInput{
+		InstanceId:       aws.String(instanceID),
+		RoutingProfileId: aws.String(routingProfileID),
+	})
 
-// 	if err != nil {
-// 		return diag.Errorf("deleting RoutingProfile (%s): %s", d.Id(), err)
-// 	}
+	if err != nil {
+		return diag.Errorf("deleting RoutingProfile (%s): %s", d.Id(), err)
+	}
 
-// 	return nil
-// }
+	return nil
+}
 
 func expandRoutingProfileMediaConcurrencies(mediaConcurrencies []interface{}) []*connect.MediaConcurrency {
 	if len(mediaConcurrencies) == 0 {
diff --git a/internal/service/connect/routing_profile_data_source.go b/internal/service/connect/routing_profile_data_source.go
index f9e7c517be9..7675519582d 100644
--- a/internal/service/connect/routing_profile_data_source.go
+++ b/internal/service/connect/routing_profile_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package connect
 
 import (
diff --git a/internal/service/connect/routing_profile_data_source_test.go b/internal/service/connect/routing_profile_data_source_test.go
index 309ac12603d..918742705dc 100644
--- a/internal/service/connect/routing_profile_data_source_test.go
+++ b/internal/service/connect/routing_profile_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package connect_test
 
 import (
diff --git a/internal/service/connect/routing_profile_test.go b/internal/service/connect/routing_profile_test.go
index bae544864e9..1c8d7d7ed47 100644
--- a/internal/service/connect/routing_profile_test.go
+++ b/internal/service/connect/routing_profile_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package connect_test
 
 import (
@@ -74,8 +77,6 @@ func testAccRoutingProfile_basic(t *testing.T) {
 }
 
 func testAccRoutingProfile_disappears(t *testing.T) {
-	t.Skip("Routing Profiles do not support deletion today")
-
 	ctx := acctest.Context(t)
 
 	var v connect.DescribeRoutingProfileOutput
diff --git a/internal/service/connect/security_profile.go b/internal/service/connect/security_profile.go
index 5f3b8aaeb66..d3d339aace5 100644
--- a/internal/service/connect/security_profile.go
+++ b/internal/service/connect/security_profile.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package connect
 
 import (
diff --git a/internal/service/connect/security_profile_data_source.go b/internal/service/connect/security_profile_data_source.go
index aa579878af3..caf63971bfd 100644
--- a/internal/service/connect/security_profile_data_source.go
+++ b/internal/service/connect/security_profile_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package connect
 
 import (
diff --git a/internal/service/connect/security_profile_data_source_test.go b/internal/service/connect/security_profile_data_source_test.go
index 4c28629ca19..f510410092c 100644
--- a/internal/service/connect/security_profile_data_source_test.go
+++ b/internal/service/connect/security_profile_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package connect_test
 
 import (
diff --git a/internal/service/connect/security_profile_test.go b/internal/service/connect/security_profile_test.go
index 516c22e5399..c97b371cb9d 100644
--- a/internal/service/connect/security_profile_test.go
+++ b/internal/service/connect/security_profile_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package connect_test
 
 import (
diff --git a/internal/service/connect/service_package_gen.go b/internal/service/connect/service_package_gen.go
index fb4ee84d3c2..459fcde327f 100644
--- a/internal/service/connect/service_package_gen.go
+++ b/internal/service/connect/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	connect_sdkv1 "github.com/aws/aws-sdk-go/service/connect"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -215,4 +216,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*c
 	return connect_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/connect/status.go b/internal/service/connect/status.go
index 1e29010b3b5..37fceec327f 100644
--- a/internal/service/connect/status.go
+++ b/internal/service/connect/status.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package connect
 
 import (
diff --git a/internal/service/connect/sweep.go b/internal/service/connect/sweep.go
index b69ae99c0db..b743f9620cf 100644
--- a/internal/service/connect/sweep.go
+++ b/internal/service/connect/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package connect
 
@@ -12,9 +12,10 @@ import (
 	"github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_connect_instance", &resource.Sweeper{
 		Name: "aws_connect_instance",
 		F:    sweepInstance,
@@ -23,7 +24,7 @@ func init() {
 
 func sweepInstance(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -63,11 +64,11 @@ func sweepInstance(region string) error {
 		errs = multierror.Append(errs, fmt.Errorf("error listing Connect Instances: %w", err))
 	}
 
-	if err = sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err = sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("error sweeping Connect Instances for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
+	if awsv1.SkipSweepError(errs.ErrorOrNil()) {
 		log.Printf("[WARN] Skipping Connect Instances sweep for %s: %s", region, errs)
 		return nil
 	}
diff --git a/internal/service/connect/tags_gen.go b/internal/service/connect/tags_gen.go
index 7540c49bc70..cafb349e942 100644
--- a/internal/service/connect/tags_gen.go
+++ b/internal/service/connect/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/connect"
 	"github.com/aws/aws-sdk-go/service/connect/connectiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -21,7 +23,7 @@ func Tags(tags tftags.KeyValueTags) map[string]*string {
 	return aws.StringMap(tags.Map())
 }
 
-// KeyValueTags creates KeyValueTags from connect service tags.
+// KeyValueTags creates tftags.KeyValueTags from connect service tags.
 func KeyValueTags(ctx context.Context, tags map[string]*string) tftags.KeyValueTags {
 	return tftags.New(ctx, tags)
 }
@@ -52,6 +54,8 @@ func updateTags(ctx context.Context, conn connectiface.ConnectAPI, identifier st
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.Connect)
 	if len(removedTags) > 0 {
diff --git a/internal/service/connect/user.go b/internal/service/connect/user.go
index b839f2aab6e..22def900b02 100644
--- a/internal/service/connect/user.go
+++ b/internal/service/connect/user.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package connect
 
 import (
diff --git a/internal/service/connect/user_data_source.go b/internal/service/connect/user_data_source.go
index 38aff46be8b..6ce0e1d31a9 100644
--- a/internal/service/connect/user_data_source.go
+++ b/internal/service/connect/user_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package connect
 
 import (
diff --git a/internal/service/connect/user_data_source_test.go b/internal/service/connect/user_data_source_test.go
index 4c8d291fede..6a940e23bf4 100644
--- a/internal/service/connect/user_data_source_test.go
+++ b/internal/service/connect/user_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package connect_test
 
 import (
diff --git a/internal/service/connect/user_hierarchy_group.go b/internal/service/connect/user_hierarchy_group.go
index f14b9de3df1..bc6d14d4491 100644
--- a/internal/service/connect/user_hierarchy_group.go
+++ b/internal/service/connect/user_hierarchy_group.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package connect
 
 import (
diff --git a/internal/service/connect/user_hierarchy_group_data_source.go b/internal/service/connect/user_hierarchy_group_data_source.go
index b0d97a671e9..9d28648ca94 100644
--- a/internal/service/connect/user_hierarchy_group_data_source.go
+++ b/internal/service/connect/user_hierarchy_group_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package connect
 
 import (
diff --git a/internal/service/connect/user_hierarchy_group_data_source_test.go b/internal/service/connect/user_hierarchy_group_data_source_test.go
index b360f113651..98e5b98484e 100644
--- a/internal/service/connect/user_hierarchy_group_data_source_test.go
+++ b/internal/service/connect/user_hierarchy_group_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package connect_test
 
 import (
diff --git a/internal/service/connect/user_hierarchy_group_test.go b/internal/service/connect/user_hierarchy_group_test.go
index b5199cb8089..ed8312cc40f 100644
--- a/internal/service/connect/user_hierarchy_group_test.go
+++ b/internal/service/connect/user_hierarchy_group_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package connect_test
 
 import (
diff --git a/internal/service/connect/user_hierarchy_structure.go b/internal/service/connect/user_hierarchy_structure.go
index dbdb7157513..0b20d011da1 100644
--- a/internal/service/connect/user_hierarchy_structure.go
+++ b/internal/service/connect/user_hierarchy_structure.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package connect
 
 import (
diff --git a/internal/service/connect/user_hierarchy_structure_data_source.go b/internal/service/connect/user_hierarchy_structure_data_source.go
index a0a163f9cee..3094da8f794 100644
--- a/internal/service/connect/user_hierarchy_structure_data_source.go
+++ b/internal/service/connect/user_hierarchy_structure_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package connect
 
 import (
diff --git a/internal/service/connect/user_hierarchy_structure_data_source_test.go b/internal/service/connect/user_hierarchy_structure_data_source_test.go
index 95d16acc1ff..15db6ae9cb3 100644
--- a/internal/service/connect/user_hierarchy_structure_data_source_test.go
+++ b/internal/service/connect/user_hierarchy_structure_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package connect_test
 
 import (
diff --git a/internal/service/connect/user_hierarchy_structure_test.go b/internal/service/connect/user_hierarchy_structure_test.go
index c1e8bc0ca7a..b1b2282da5d 100644
--- a/internal/service/connect/user_hierarchy_structure_test.go
+++ b/internal/service/connect/user_hierarchy_structure_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package connect_test
 
 import (
diff --git a/internal/service/connect/user_test.go b/internal/service/connect/user_test.go
index ea8d3b5bbc4..a41e700c5d9 100644
--- a/internal/service/connect/user_test.go
+++ b/internal/service/connect/user_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package connect_test
 
 import (
diff --git a/internal/service/connect/validate.go b/internal/service/connect/validate.go
index 55403966d3c..8eff2f8e380 100644
--- a/internal/service/connect/validate.go
+++ b/internal/service/connect/validate.go
@@ -1,13 +1,17 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package connect
 
 import (
 	"fmt"
-	"regexp"
+
+	"github.com/YakDriver/regexache"
 )
 
 func validDeskPhoneNumber(v interface{}, k string) (ws []string, errors []error) {
 	value := v.(string)
-	if !regexp.MustCompile(`\+[1-9]\d{1,14}$`).MatchString(value) {
+	if !regexache.MustCompile(`\+[1-9]\d{1,14}$`).MatchString(value) {
 		errors = append(errors, fmt.Errorf("%q (%q) must be a valid phone number", k, v))
 	}
 	return
@@ -15,7 +19,7 @@ func validDeskPhoneNumber(v interface{}, k string) (ws []string, errors []error)
 
 func validPhoneNumberPrefix(v interface{}, k string) (ws []string, errors []error) {
 	value := v.(string)
-	if !regexp.MustCompile(`\+[0-9]{1,11}`).MatchString(value) {
+	if !regexache.MustCompile(`\+[0-9]{1,11}`).MatchString(value) {
 		errors = append(errors, fmt.Errorf("%q (%q) must be a valid phone number prefix and contain + as part of the country code", k, v))
 	}
 	return
diff --git a/internal/service/connect/validate_test.go b/internal/service/connect/validate_test.go
index eca5876e506..59c3113d65c 100644
--- a/internal/service/connect/validate_test.go
+++ b/internal/service/connect/validate_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package connect
 
 import (
diff --git a/internal/service/connect/vocabulary.go b/internal/service/connect/vocabulary.go
index 7c8c700f62d..2bf7d1bd6fb 100644
--- a/internal/service/connect/vocabulary.go
+++ b/internal/service/connect/vocabulary.go
@@ -1,13 +1,16 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package connect
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"strings"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/connect"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -78,7 +81,7 @@ func ResourceVocabulary() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 140),
-					validation.StringMatch(regexp.MustCompile(`^[0-9a-zA-Z._-]+`), "must contain only alphanumeric, period, underscore, and hyphen characters"),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_.-]+`), "must contain only alphanumeric, period, underscore, and hyphen characters"),
 				),
 			},
 			"state": {
diff --git a/internal/service/connect/vocabulary_data_source.go b/internal/service/connect/vocabulary_data_source.go
index 3ee205b4da1..3ba42d9024d 100644
--- a/internal/service/connect/vocabulary_data_source.go
+++ b/internal/service/connect/vocabulary_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package connect
 
 import (
diff --git a/internal/service/connect/vocabulary_data_source_test.go b/internal/service/connect/vocabulary_data_source_test.go
index 9dbee75dcc4..03ec6290b00 100644
--- a/internal/service/connect/vocabulary_data_source_test.go
+++ b/internal/service/connect/vocabulary_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package connect_test
 
 import (
diff --git a/internal/service/connect/vocabulary_test.go b/internal/service/connect/vocabulary_test.go
index 729abd85084..30facae9e1f 100644
--- a/internal/service/connect/vocabulary_test.go
+++ b/internal/service/connect/vocabulary_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package connect_test
 
 import (
diff --git a/internal/service/connect/wait.go b/internal/service/connect/wait.go
index 5aaab59ff68..d06d8c8c4dd 100644
--- a/internal/service/connect/wait.go
+++ b/internal/service/connect/wait.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package connect
 
 import (
diff --git a/internal/service/controltower/control.go b/internal/service/controltower/control.go
index df8a7ac0eb8..aa331ba4b36 100644
--- a/internal/service/controltower/control.go
+++ b/internal/service/controltower/control.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package controltower
 
 import (
diff --git a/internal/service/controltower/control_test.go b/internal/service/controltower/control_test.go
index 5317b02cbc1..0ac8c1fcde3 100644
--- a/internal/service/controltower/control_test.go
+++ b/internal/service/controltower/control_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package controltower_test
 
 import (
diff --git a/internal/service/controltower/controls_data_source.go b/internal/service/controltower/controls_data_source.go
index a0f5756e840..225bbaf93e6 100644
--- a/internal/service/controltower/controls_data_source.go
+++ b/internal/service/controltower/controls_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package controltower
 
 import (
diff --git a/internal/service/controltower/controls_data_source_test.go b/internal/service/controltower/controls_data_source_test.go
index d7e791b4549..3c0a7aa8ac2 100644
--- a/internal/service/controltower/controls_data_source_test.go
+++ b/internal/service/controltower/controls_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package controltower_test
 
 import (
diff --git a/internal/service/controltower/generate.go b/internal/service/controltower/generate.go
index 158e03dbcea..5bed2ff12f6 100644
--- a/internal/service/controltower/generate.go
+++ b/internal/service/controltower/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
 
diff --git a/internal/service/controltower/service_package_gen.go b/internal/service/controltower/service_package_gen.go
index 275f665c57e..02e9a984e42 100644
--- a/internal/service/controltower/service_package_gen.go
+++ b/internal/service/controltower/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	controltower_sdkv1 "github.com/aws/aws-sdk-go/service/controltower"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -51,4 +52,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*c
 	return controltower_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/cur/cur_test.go b/internal/service/cur/cur_test.go
index f50deb843eb..dd06b365e5e 100644
--- a/internal/service/cur/cur_test.go
+++ b/internal/service/cur/cur_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cur_test
 
 import (
@@ -13,13 +16,15 @@ func TestAccCUR_serial(t *testing.T) {
 
 	testCases := map[string]map[string]func(t *testing.T){
 		"ReportDefinition": {
-			"basic":      testAccReportDefinition_basic,
-			"disappears": testAccReportDefinition_disappears,
-			"textOrCsv":  testAccReportDefinition_textOrCSV,
-			"parquet":    testAccReportDefinition_parquet,
-			"athena":     testAccReportDefinition_athena,
-			"refresh":    testAccReportDefinition_refresh,
-			"overwrite":  testAccReportDefinition_overwrite,
+			"basic":                 testAccReportDefinition_basic,
+			"disappears":            testAccReportDefinition_disappears,
+			"textOrCsv":             testAccReportDefinition_textOrCSV,
+			"parquet":               testAccReportDefinition_parquet,
+			"athena":                testAccReportDefinition_athena,
+			"refresh":               testAccReportDefinition_refresh,
+			"overwrite":             testAccReportDefinition_overwrite,
+			"DataSource_basic":      testAccReportDefinitionDataSource_basic,
+			"DataSource_additional": testAccReportDefinitionDataSource_additional,
 		},
 	}
 
diff --git a/internal/service/cur/find.go b/internal/service/cur/find.go
index bce99647601..df4774444ec 100644
--- a/internal/service/cur/find.go
+++ b/internal/service/cur/find.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cur
 
 import (
diff --git a/internal/service/cur/generate.go b/internal/service/cur/generate.go
index 28b3bce210e..30d172b6f9e 100644
--- a/internal/service/cur/generate.go
+++ b/internal/service/cur/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
 
diff --git a/internal/service/cur/report_definition.go b/internal/service/cur/report_definition.go
index 54a3d879ae0..fec86af3b06 100644
--- a/internal/service/cur/report_definition.go
+++ b/internal/service/cur/report_definition.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cur
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/arn"
 	cur "github.com/aws/aws-sdk-go/service/costandusagereportservice"
@@ -39,7 +42,7 @@ func ResourceReportDefinition() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 256),
-					validation.StringMatch(regexp.MustCompile(`[0-9A-Za-z!\-_.*\'()]+`), "The name must be unique, is case sensitive, and can't include spaces."),
+					validation.StringMatch(regexache.MustCompile(`[0-9A-Za-z!\-_.*\'()]+`), "The name must be unique, is case sensitive, and can't include spaces."),
 				),
 			},
 			"time_unit": {
diff --git a/internal/service/cur/report_definition_data_source.go b/internal/service/cur/report_definition_data_source.go
index 68d03382a65..c4af34555c2 100644
--- a/internal/service/cur/report_definition_data_source.go
+++ b/internal/service/cur/report_definition_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cur
 
 import (
diff --git a/internal/service/cur/report_definition_data_source_test.go b/internal/service/cur/report_definition_data_source_test.go
index e3052c42c2b..78f7a34bc0f 100644
--- a/internal/service/cur/report_definition_data_source_test.go
+++ b/internal/service/cur/report_definition_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cur_test
 
 import (
@@ -11,7 +14,7 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
 )
 
-func TestAccCURReportDefinitionDataSource_basic(t *testing.T) {
+func testAccReportDefinitionDataSource_basic(t *testing.T) {
 	ctx := acctest.Context(t)
 	resourceName := "aws_cur_report_definition.test"
 	datasourceName := "data.aws_cur_report_definition.test"
@@ -19,7 +22,7 @@ func TestAccCURReportDefinitionDataSource_basic(t *testing.T) {
 	reportName := sdkacctest.RandomWithPrefix("tf_acc_test")
 	bucketName := fmt.Sprintf("tf-test-bucket-%d", sdkacctest.RandInt())
 
-	resource.ParallelTest(t, resource.TestCase{
+	resource.Test(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckRegion(t, endpoints.UsEast1RegionID) },
 		ErrorCheck:               acctest.ErrorCheck(t, cur.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
@@ -42,7 +45,7 @@ func TestAccCURReportDefinitionDataSource_basic(t *testing.T) {
 	})
 }
 
-func TestAccCURReportDefinitionDataSource_additional(t *testing.T) {
+func testAccReportDefinitionDataSource_additional(t *testing.T) {
 	ctx := acctest.Context(t)
 	resourceName := "aws_cur_report_definition.test"
 	datasourceName := "data.aws_cur_report_definition.test"
@@ -50,7 +53,7 @@ func TestAccCURReportDefinitionDataSource_additional(t *testing.T) {
 	reportName := sdkacctest.RandomWithPrefix("tf_acc_test")
 	bucketName := fmt.Sprintf("tf-test-bucket-%d", sdkacctest.RandInt())
 
-	resource.ParallelTest(t, resource.TestCase{
+	resource.Test(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckRegion(t, endpoints.UsEast1RegionID) },
 		ErrorCheck:               acctest.ErrorCheck(t, cur.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
@@ -82,15 +85,10 @@ data "aws_billing_service_account" "test" {}
 data "aws_partition" "current" {}
 
 resource "aws_s3_bucket" "test" {
-  bucket        = "%[2]s"
+  bucket        = %[2]q
   force_destroy = true
 }
 
-resource "aws_s3_bucket_acl" "test" {
-  bucket = aws_s3_bucket.test.id
-  acl    = "private"
-}
-
 resource "aws_s3_bucket_policy" "test" {
   bucket = aws_s3_bucket.test.id
 
@@ -128,11 +126,11 @@ POLICY
 resource "aws_cur_report_definition" "test" {
   depends_on = [aws_s3_bucket_policy.test] # needed to avoid "ValidationException: Failed to verify customer bucket permission."
 
-  report_name                = "%[1]s"
+  report_name                = %[1]q
   time_unit                  = "DAILY"
   format                     = "textORcsv"
   compression                = "GZIP"
-  additional_schema_elements = ["RESOURCES"]
+  additional_schema_elements = ["RESOURCES", "SPLIT_COST_ALLOCATION_DATA"]
   s3_bucket                  = aws_s3_bucket.test.id
   s3_prefix                  = ""
   s3_region                  = aws_s3_bucket.test.region
@@ -152,15 +150,10 @@ data "aws_billing_service_account" "test" {}
 data "aws_partition" "current" {}
 
 resource "aws_s3_bucket" "test" {
-  bucket        = "%[2]s"
+  bucket        = %[2]q
   force_destroy = true
 }
 
-resource "aws_s3_bucket_acl" "test" {
-  bucket = aws_s3_bucket.test.id
-  acl    = "private"
-}
-
 resource "aws_s3_bucket_policy" "test" {
   bucket = aws_s3_bucket.test.id
 
@@ -198,11 +191,11 @@ POLICY
 resource "aws_cur_report_definition" "test" {
   depends_on = [aws_s3_bucket_policy.test] # needed to avoid "ValidationException: Failed to verify customer bucket permission."
 
-  report_name                = "%[1]s"
+  report_name                = %[1]q
   time_unit                  = "DAILY"
   format                     = "textORcsv"
   compression                = "GZIP"
-  additional_schema_elements = ["RESOURCES"]
+  additional_schema_elements = ["RESOURCES", "SPLIT_COST_ALLOCATION_DATA"]
   s3_bucket                  = aws_s3_bucket.test.id
   s3_prefix                  = ""
   s3_region                  = aws_s3_bucket.test.region
diff --git a/internal/service/cur/report_definition_test.go b/internal/service/cur/report_definition_test.go
index d742144de18..983333f0947 100644
--- a/internal/service/cur/report_definition_test.go
+++ b/internal/service/cur/report_definition_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cur_test
 
 import (
@@ -38,7 +41,7 @@ func testAccReportDefinition_basic(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "report_name", reportName),
 					resource.TestCheckResourceAttr(resourceName, "time_unit", "DAILY"),
 					resource.TestCheckResourceAttr(resourceName, "compression", "GZIP"),
-					resource.TestCheckResourceAttr(resourceName, "additional_schema_elements.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "additional_schema_elements.#", "2"),
 					resource.TestCheckResourceAttr(resourceName, "s3_bucket", bucketName),
 					resource.TestCheckResourceAttr(resourceName, "s3_prefix", ""),
 					resource.TestCheckResourceAttrPair(resourceName, "s3_region", s3BucketResourceName, "region"),
@@ -59,7 +62,7 @@ func testAccReportDefinition_basic(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "report_name", reportName),
 					resource.TestCheckResourceAttr(resourceName, "time_unit", "DAILY"),
 					resource.TestCheckResourceAttr(resourceName, "compression", "GZIP"),
-					resource.TestCheckResourceAttr(resourceName, "additional_schema_elements.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "additional_schema_elements.#", "2"),
 					resource.TestCheckResourceAttr(resourceName, "s3_bucket", bucketName),
 					resource.TestCheckResourceAttr(resourceName, "s3_prefix", "test"),
 					resource.TestCheckResourceAttrPair(resourceName, "s3_region", s3BucketResourceName, "region"),
@@ -97,7 +100,7 @@ func testAccReportDefinition_textOrCSV(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "time_unit", "DAILY"),
 					resource.TestCheckResourceAttr(resourceName, "format", format),
 					resource.TestCheckResourceAttr(resourceName, "compression", compression),
-					resource.TestCheckResourceAttr(resourceName, "additional_schema_elements.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "additional_schema_elements.#", "2"),
 					resource.TestCheckResourceAttr(resourceName, "s3_bucket", bucketName),
 					resource.TestCheckResourceAttr(resourceName, "s3_prefix", bucketPrefix),
 					resource.TestCheckResourceAttrPair(resourceName, "s3_region", s3BucketResourceName, "region"),
@@ -142,7 +145,7 @@ func testAccReportDefinition_parquet(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "time_unit", "DAILY"),
 					resource.TestCheckResourceAttr(resourceName, "format", format),
 					resource.TestCheckResourceAttr(resourceName, "compression", compression),
-					resource.TestCheckResourceAttr(resourceName, "additional_schema_elements.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "additional_schema_elements.#", "2"),
 					resource.TestCheckResourceAttr(resourceName, "s3_bucket", bucketName),
 					resource.TestCheckResourceAttr(resourceName, "s3_prefix", bucketPrefix),
 					resource.TestCheckResourceAttrPair(resourceName, "s3_region", s3BucketResourceName, "region"),
@@ -186,7 +189,7 @@ func testAccReportDefinition_athena(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "time_unit", "DAILY"),
 					resource.TestCheckResourceAttr(resourceName, "format", format),
 					resource.TestCheckResourceAttr(resourceName, "compression", compression),
-					resource.TestCheckResourceAttr(resourceName, "additional_schema_elements.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "additional_schema_elements.#", "2"),
 					resource.TestCheckResourceAttr(resourceName, "s3_bucket", bucketName),
 					resource.TestCheckResourceAttr(resourceName, "s3_prefix", bucketPrefix),
 					resource.TestCheckResourceAttrPair(resourceName, "s3_region", s3BucketResourceName, "region"),
@@ -231,7 +234,7 @@ func testAccReportDefinition_refresh(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "time_unit", "DAILY"),
 					resource.TestCheckResourceAttr(resourceName, "format", format),
 					resource.TestCheckResourceAttr(resourceName, "compression", compression),
-					resource.TestCheckResourceAttr(resourceName, "additional_schema_elements.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "additional_schema_elements.#", "2"),
 					resource.TestCheckResourceAttr(resourceName, "s3_bucket", bucketName),
 					resource.TestCheckResourceAttr(resourceName, "s3_prefix", bucketPrefix),
 					resource.TestCheckResourceAttrPair(resourceName, "s3_region", s3BucketResourceName, "region"),
@@ -276,7 +279,7 @@ func testAccReportDefinition_overwrite(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "time_unit", "DAILY"),
 					resource.TestCheckResourceAttr(resourceName, "format", format),
 					resource.TestCheckResourceAttr(resourceName, "compression", compression),
-					resource.TestCheckResourceAttr(resourceName, "additional_schema_elements.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "additional_schema_elements.#", "2"),
 					resource.TestCheckResourceAttr(resourceName, "s3_bucket", bucketName),
 					resource.TestCheckResourceAttr(resourceName, "s3_prefix", ""),
 					resource.TestCheckResourceAttrPair(resourceName, "s3_region", s3BucketResourceName, "region"),
@@ -371,11 +374,6 @@ resource "aws_s3_bucket" "test" {
   force_destroy = true
 }
 
-resource "aws_s3_bucket_acl" "test" {
-  bucket = aws_s3_bucket.test.id
-  acl    = "private"
-}
-
 data "aws_partition" "current" {}
 
 resource "aws_s3_bucket_policy" "test" {
@@ -419,7 +417,7 @@ resource "aws_cur_report_definition" "test" {
   time_unit                  = "DAILY"
   format                     = "textORcsv"
   compression                = "GZIP"
-  additional_schema_elements = ["RESOURCES"]
+  additional_schema_elements = ["RESOURCES", "SPLIT_COST_ALLOCATION_DATA"]
   s3_bucket                  = aws_s3_bucket.test.id
   s3_prefix                  = %[3]q
   s3_region                  = aws_s3_bucket.test.region
@@ -439,15 +437,10 @@ func testAccReportDefinitionConfig_additional(reportName string, bucketName stri
 
 	return fmt.Sprintf(`
 resource "aws_s3_bucket" "test" {
-  bucket        = "%[2]s"
+  bucket        = %[2]q
   force_destroy = true
 }
 
-resource "aws_s3_bucket_acl" "test" {
-  bucket = aws_s3_bucket.test.id
-  acl    = "private"
-}
-
 data "aws_partition" "current" {}
 
 resource "aws_s3_bucket_policy" "test" {
@@ -487,17 +480,17 @@ POLICY
 resource "aws_cur_report_definition" "test" {
   depends_on = [aws_s3_bucket_policy.test] # needed to avoid "ValidationException: Failed to verify customer bucket permission."
 
-  report_name                = "%[1]s"
+  report_name                = %[1]q
   time_unit                  = "DAILY"
-  format                     = "%[4]s"
-  compression                = "%[5]s"
-  additional_schema_elements = ["RESOURCES"]
+  format                     = %[4]q
+  compression                = %[5]q
+  additional_schema_elements = ["RESOURCES", "SPLIT_COST_ALLOCATION_DATA"]
   s3_bucket                  = aws_s3_bucket.test.id
-  s3_prefix                  = "%[3]s"
+  s3_prefix                  = %[3]q
   s3_region                  = aws_s3_bucket.test.region
 	%[6]s
   refresh_closed_reports = %[7]t
-  report_versioning      = "%[8]s"
+  report_versioning      = %[8]q
 }
 `, reportName, bucketName, bucketPrefix, format, compression, artifactsStr, refreshClosedReports, reportVersioning)
 }
diff --git a/internal/service/cur/service_package_gen.go b/internal/service/cur/service_package_gen.go
index e9e001aa003..581ffce2872 100644
--- a/internal/service/cur/service_package_gen.go
+++ b/internal/service/cur/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	costandusagereportservice_sdkv1 "github.com/aws/aws-sdk-go/service/costandusagereportservice"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -51,4 +52,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*c
 	return costandusagereportservice_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/cur/sweep.go b/internal/service/cur/sweep.go
index 712c28c0c9c..390394105ec 100644
--- a/internal/service/cur/sweep.go
+++ b/internal/service/cur/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package cur
 
@@ -11,9 +11,11 @@ import (
 	cur "github.com/aws/aws-sdk-go/service/costandusagereportservice"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
+	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_cur_report_definition", &resource.Sweeper{
 		Name: "aws_cur_report_definition",
 		F:    sweepReportDefinitions,
@@ -22,7 +24,11 @@ func init() {
 
 func sweepReportDefinitions(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	if region != names.USEast1RegionID {
+		log.Printf("[WARN] Skipping Cost And Usage Report Definition sweep for region: %s", region)
+		return nil
+	}
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -46,15 +52,15 @@ func sweepReportDefinitions(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
-		log.Printf("[WARN] Skipping EC2 Cost And Usage Report Definition sweep for %s: %s", region, err)
+	if awsv1.SkipSweepError(err) {
+		log.Printf("[WARN] Skipping Cost And Usage Report Definition sweep for %s: %s", region, err)
 		return nil
 	}
 	if err != nil {
 		return fmt.Errorf("error listing Cost And Usage Report Definitions (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping Cost And Usage Report Definitions (%s): %w", region, err)
diff --git a/internal/service/dataexchange/data_set.go b/internal/service/dataexchange/data_set.go
index 25ad71a1701..1433cb7d915 100644
--- a/internal/service/dataexchange/data_set.go
+++ b/internal/service/dataexchange/data_set.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package dataexchange
 
 import (
diff --git a/internal/service/dataexchange/data_set_test.go b/internal/service/dataexchange/data_set_test.go
index bff09d50a8d..0c34878c5a4 100644
--- a/internal/service/dataexchange/data_set_test.go
+++ b/internal/service/dataexchange/data_set_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package dataexchange_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/dataexchange"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -36,7 +39,7 @@ func TestAccDataExchangeDataSet_basic(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "description", rName),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "dataexchange", regexp.MustCompile(`data-sets/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "dataexchange", regexache.MustCompile(`data-sets/.+`)),
 				),
 			},
 			{
@@ -50,7 +53,7 @@ func TestAccDataExchangeDataSet_basic(t *testing.T) {
 					testAccCheckDataSetExists(ctx, resourceName, &proj),
 					resource.TestCheckResourceAttr(resourceName, "name", rNameUpdated),
 					resource.TestCheckResourceAttr(resourceName, "description", rNameUpdated),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "dataexchange", regexp.MustCompile(`data-sets/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "dataexchange", regexache.MustCompile(`data-sets/.+`)),
 				),
 			},
 		},
diff --git a/internal/service/dataexchange/find.go b/internal/service/dataexchange/find.go
index 19dfc2d0e10..f79453bc560 100644
--- a/internal/service/dataexchange/find.go
+++ b/internal/service/dataexchange/find.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package dataexchange
 
 import (
diff --git a/internal/service/dataexchange/generate.go b/internal/service/dataexchange/generate.go
index 42f1064d884..3bc2017f691 100644
--- a/internal/service/dataexchange/generate.go
+++ b/internal/service/dataexchange/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTags -ServiceTagsMap -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/dataexchange/revision.go b/internal/service/dataexchange/revision.go
index f17ba291937..d0a919ce11b 100644
--- a/internal/service/dataexchange/revision.go
+++ b/internal/service/dataexchange/revision.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package dataexchange
 
 import (
diff --git a/internal/service/dataexchange/revision_test.go b/internal/service/dataexchange/revision_test.go
index 889c10e8204..d2482297ab5 100644
--- a/internal/service/dataexchange/revision_test.go
+++ b/internal/service/dataexchange/revision_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package dataexchange_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/dataexchange"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -34,7 +37,7 @@ func TestAccDataExchangeRevision_basic(t *testing.T) {
 					testAccCheckRevisionExists(ctx, resourceName, &proj),
 					resource.TestCheckResourceAttrPair(resourceName, "data_set_id", "aws_dataexchange_data_set.test", "id"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "dataexchange", regexp.MustCompile(`data-sets/.+/revisions/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "dataexchange", regexache.MustCompile(`data-sets/.+/revisions/.+`)),
 				),
 			},
 			{
diff --git a/internal/service/dataexchange/service_package_gen.go b/internal/service/dataexchange/service_package_gen.go
index d19c1f125e3..dac6b0d8820 100644
--- a/internal/service/dataexchange/service_package_gen.go
+++ b/internal/service/dataexchange/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	dataexchange_sdkv1 "github.com/aws/aws-sdk-go/service/dataexchange"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -58,4 +59,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*d
 	return dataexchange_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/dataexchange/sweep.go b/internal/service/dataexchange/sweep.go
index 4c625309ab7..9b06af24402 100644
--- a/internal/service/dataexchange/sweep.go
+++ b/internal/service/dataexchange/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package dataexchange
 
@@ -12,9 +12,10 @@ import (
 	"github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_dataexchange_data_set", &resource.Sweeper{
 		Name: "aws_dataexchange_data_set",
 		F:    sweepDataSets,
@@ -23,7 +24,7 @@ func init() {
 
 func sweepDataSets(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
@@ -56,11 +57,11 @@ func sweepDataSets(region string) error {
 		errs = multierror.Append(errs, fmt.Errorf("error listing DataExchange DataSet for %s: %w", region, err))
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("error sweeping DataExchange DataSet for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
+	if awsv1.SkipSweepError(errs.ErrorOrNil()) {
 		log.Printf("[WARN] Skipping DataExchange DataSet sweep for %s: %s", region, errs)
 		return nil
 	}
diff --git a/internal/service/dataexchange/tags_gen.go b/internal/service/dataexchange/tags_gen.go
index 2f212f929e8..d97349220b1 100644
--- a/internal/service/dataexchange/tags_gen.go
+++ b/internal/service/dataexchange/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/dataexchange"
 	"github.com/aws/aws-sdk-go/service/dataexchange/dataexchangeiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -54,7 +56,7 @@ func Tags(tags tftags.KeyValueTags) map[string]*string {
 	return aws.StringMap(tags.Map())
 }
 
-// KeyValueTags creates KeyValueTags from dataexchange service tags.
+// KeyValueTags creates tftags.KeyValueTags from dataexchange service tags.
 func KeyValueTags(ctx context.Context, tags map[string]*string) tftags.KeyValueTags {
 	return tftags.New(ctx, tags)
 }
@@ -85,6 +87,8 @@ func updateTags(ctx context.Context, conn dataexchangeiface.DataExchangeAPI, ide
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.DataExchange)
 	if len(removedTags) > 0 {
diff --git a/internal/service/datapipeline/generate.go b/internal/service/datapipeline/generate.go
index f32a000e7ba..fcee5d2990e 100644
--- a/internal/service/datapipeline/generate.go
+++ b/internal/service/datapipeline/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTagsInIDElem=PipelineId -ServiceTagsSlice -TagOp=AddTags -TagInIDElem=PipelineId -UntagOp=RemoveTags -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/datapipeline/pipeline.go b/internal/service/datapipeline/pipeline.go
index dd15165f919..e8c583fd539 100644
--- a/internal/service/datapipeline/pipeline.go
+++ b/internal/service/datapipeline/pipeline.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package datapipeline
 
 import (
diff --git a/internal/service/datapipeline/pipeline_data_source.go b/internal/service/datapipeline/pipeline_data_source.go
index 678718a8891..1d06d40c0c4 100644
--- a/internal/service/datapipeline/pipeline_data_source.go
+++ b/internal/service/datapipeline/pipeline_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package datapipeline
 
 import (
diff --git a/internal/service/datapipeline/pipeline_data_source_test.go b/internal/service/datapipeline/pipeline_data_source_test.go
index 167187d7c9b..c66dba8ef6c 100644
--- a/internal/service/datapipeline/pipeline_data_source_test.go
+++ b/internal/service/datapipeline/pipeline_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package datapipeline_test
 
 import (
diff --git a/internal/service/datapipeline/pipeline_definition.go b/internal/service/datapipeline/pipeline_definition.go
index 706fecd0642..3d174dc2ec6 100644
--- a/internal/service/datapipeline/pipeline_definition.go
+++ b/internal/service/datapipeline/pipeline_definition.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package datapipeline
 
 import (
diff --git a/internal/service/datapipeline/pipeline_definition_data_source.go b/internal/service/datapipeline/pipeline_definition_data_source.go
index 01607f00bfd..3ea6987aa29 100644
--- a/internal/service/datapipeline/pipeline_definition_data_source.go
+++ b/internal/service/datapipeline/pipeline_definition_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package datapipeline
 
 import (
diff --git a/internal/service/datapipeline/pipeline_definition_data_source_test.go b/internal/service/datapipeline/pipeline_definition_data_source_test.go
index 9bc5c3f4a44..8e187c50eee 100644
--- a/internal/service/datapipeline/pipeline_definition_data_source_test.go
+++ b/internal/service/datapipeline/pipeline_definition_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package datapipeline_test
 
 import (
diff --git a/internal/service/datapipeline/pipeline_definition_test.go b/internal/service/datapipeline/pipeline_definition_test.go
index 461c84ffbdd..c0f3cbffb52 100644
--- a/internal/service/datapipeline/pipeline_definition_test.go
+++ b/internal/service/datapipeline/pipeline_definition_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package datapipeline_test
 
 import (
diff --git a/internal/service/datapipeline/pipeline_test.go b/internal/service/datapipeline/pipeline_test.go
index 3e51a51973e..965bc490556 100644
--- a/internal/service/datapipeline/pipeline_test.go
+++ b/internal/service/datapipeline/pipeline_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package datapipeline_test
 
 import (
diff --git a/internal/service/datapipeline/service_package_gen.go b/internal/service/datapipeline/service_package_gen.go
index 47b807a4582..e82b85ef161 100644
--- a/internal/service/datapipeline/service_package_gen.go
+++ b/internal/service/datapipeline/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	datapipeline_sdkv1 "github.com/aws/aws-sdk-go/service/datapipeline"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -63,4 +64,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*d
 	return datapipeline_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/datapipeline/tags_gen.go b/internal/service/datapipeline/tags_gen.go
index 6740f823ba1..efa5ef6667e 100644
--- a/internal/service/datapipeline/tags_gen.go
+++ b/internal/service/datapipeline/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/datapipeline"
 	"github.com/aws/aws-sdk-go/service/datapipeline/datapipelineiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -69,6 +71,8 @@ func updateTags(ctx context.Context, conn datapipelineiface.DataPipelineAPI, ide
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.DataPipeline)
 	if len(removedTags) > 0 {
diff --git a/internal/service/datasync/agent.go b/internal/service/datasync/agent.go
index d93487583c8..2725d9c6f63 100644
--- a/internal/service/datasync/agent.go
+++ b/internal/service/datasync/agent.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package datasync
 
 import (
@@ -62,6 +65,7 @@ func ResourceAgent() *schema.Resource {
 			"private_link_endpoint": {
 				Type:          schema.TypeString,
 				Optional:      true,
+				Computed:      true,
 				ForceNew:      true,
 				ConflictsWith: []string{"activation_key"},
 			},
@@ -204,8 +208,9 @@ func resourceAgentCreate(ctx context.Context, d *schema.ResourceData, meta inter
 	_, err = tfresource.RetryWhenNotFound(ctx, d.Timeout(schema.TimeoutCreate), func() (interface{}, error) {
 		return FindAgentByARN(ctx, conn, d.Id())
 	})
+
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "waiting for DataSync Agent (%s) creation: %s", d.Id(), err)
+		return sdkdiag.AppendErrorf(diags, "waiting for DataSync Agent (%s) create: %s", d.Id(), err)
 	}
 
 	return append(diags, resourceAgentRead(ctx, d, meta)...)
@@ -283,3 +288,28 @@ func resourceAgentDelete(ctx context.Context, d *schema.ResourceData, meta inter
 
 	return diags
 }
+
+func FindAgentByARN(ctx context.Context, conn *datasync.DataSync, arn string) (*datasync.DescribeAgentOutput, error) {
+	input := &datasync.DescribeAgentInput{
+		AgentArn: aws.String(arn),
+	}
+
+	output, err := conn.DescribeAgentWithContext(ctx, input)
+
+	if tfawserr.ErrMessageContains(err, datasync.ErrCodeInvalidRequestException, "does not exist") {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	if output == nil {
+		return nil, tfresource.NewEmptyResultError(input)
+	}
+
+	return output, nil
+}
diff --git a/internal/service/datasync/agent_test.go b/internal/service/datasync/agent_test.go
index 382b502d1b1..89ef4345ffd 100644
--- a/internal/service/datasync/agent_test.go
+++ b/internal/service/datasync/agent_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package datasync_test
 
 import (
 	"context"
 	"errors"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/datasync"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -34,7 +37,7 @@ func TestAccDataSyncAgent_basic(t *testing.T) {
 				Config: testAccAgentConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckAgentExists(ctx, resourceName, &agent1),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "datasync", regexp.MustCompile(`agent/agent-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "datasync", regexache.MustCompile(`agent/agent-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "name", ""),
 					resource.TestCheckResourceAttr(resourceName, "private_link_endpoint", ""),
 					resource.TestCheckResourceAttr(resourceName, "security_group_arns.#", "0"),
@@ -225,11 +228,11 @@ func testAccCheckAgentDestroy(ctx context.Context) resource.TestCheckFunc {
 	}
 }
 
-func testAccCheckAgentExists(ctx context.Context, resourceName string, agent *datasync.DescribeAgentOutput) resource.TestCheckFunc {
+func testAccCheckAgentExists(ctx context.Context, n string, v *datasync.DescribeAgentOutput) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		rs, ok := s.RootModule().Resources[resourceName]
+		rs, ok := s.RootModule().Resources[n]
 		if !ok {
-			return fmt.Errorf("Not found: %s", resourceName)
+			return fmt.Errorf("Not found: %s", n)
 		}
 
 		conn := acctest.Provider.Meta().(*conns.AWSClient).DataSyncConn(ctx)
@@ -240,7 +243,7 @@ func testAccCheckAgentExists(ctx context.Context, resourceName string, agent *da
 			return err
 		}
 
-		*agent = *output
+		*v = *output
 
 		return nil
 	}
@@ -257,7 +260,11 @@ func testAccCheckAgentNotRecreated(i, j *datasync.DescribeAgentOutput) resource.
 }
 
 func testAccAgentAgentConfig_base(rName string) string {
-	return acctest.ConfigCompose(acctest.ConfigVPCWithSubnets(rName, 1), fmt.Sprintf(`
+	return acctest.ConfigCompose(
+		acctest.ConfigVPCWithSubnets(rName, 1),
+		// See https://docs.aws.amazon.com/datasync/latest/userguide/agent-requirements.html#ec2-instance-types.
+		acctest.AvailableEC2InstanceTypeForAvailabilityZone("aws_subnet.test[0].availability_zone", "m5.2xlarge", "m5.4xlarge"),
+		fmt.Sprintf(`
 # Reference: https://docs.aws.amazon.com/datasync/latest/userguide/deploy-agents.html
 data "aws_ssm_parameter" "aws_service_datasync_ami" {
   name = "/aws/service/datasync/ami"
@@ -317,11 +324,9 @@ resource "aws_instance" "test" {
 
   ami                         = data.aws_ssm_parameter.aws_service_datasync_ami.value
   associate_public_ip_address = true
-
-  # Default instance type from sync.sh
-  instance_type          = "c5.2xlarge"
-  vpc_security_group_ids = [aws_security_group.test.id]
-  subnet_id              = aws_subnet.test[0].id
+  instance_type               = data.aws_ec2_instance_type_offering.available.instance_type
+  vpc_security_group_ids      = [aws_security_group.test.id]
+  subnet_id                   = aws_subnet.test[0].id
 
   tags = {
     Name = %[1]q
diff --git a/internal/service/datasync/common_fsx_protocol_functions.go b/internal/service/datasync/common_fsx_protocol_functions.go
new file mode 100644
index 00000000000..2bb97e5e83a
--- /dev/null
+++ b/internal/service/datasync/common_fsx_protocol_functions.go
@@ -0,0 +1,115 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package datasync
+
+import (
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/datasync"
+)
+
+func expandProtocol(l []interface{}) *datasync.FsxProtocol {
+	if len(l) == 0 || l[0] == nil {
+		return nil
+	}
+
+	m := l[0].(map[string]interface{})
+	protocol := &datasync.FsxProtocol{}
+
+	if v, ok := m["nfs"].([]interface{}); ok {
+		protocol.NFS = expandNFS(v)
+	}
+	if v, ok := m["smb"].([]interface{}); ok {
+		protocol.SMB = expandSMB(v)
+	}
+
+	return protocol
+}
+
+func flattenProtocol(protocol *datasync.FsxProtocol) []interface{} {
+	if protocol == nil {
+		return []interface{}{}
+	}
+
+	m := map[string]interface{}{}
+
+	if protocol.NFS != nil {
+		m["nfs"] = flattenNFS(protocol.NFS)
+	}
+	if protocol.SMB != nil {
+		m["smb"] = flattenSMB(protocol.SMB)
+	}
+
+	return []interface{}{m}
+}
+
+func expandNFS(l []interface{}) *datasync.FsxProtocolNfs {
+	if len(l) == 0 || l[0] == nil {
+		return nil
+	}
+
+	m := l[0].(map[string]interface{})
+
+	protocol := &datasync.FsxProtocolNfs{
+		MountOptions: expandNFSMountOptions(m["mount_options"].([]interface{})),
+	}
+
+	return protocol
+}
+
+func expandSMB(l []interface{}) *datasync.FsxProtocolSmb {
+	if len(l) == 0 || l[0] == nil {
+		return nil
+	}
+
+	m := l[0].(map[string]interface{})
+
+	protocol := &datasync.FsxProtocolSmb{
+		MountOptions: expandSMBMountOptions(m["mount_options"].([]interface{})),
+	}
+	if v, ok := m["domain"].(string); ok && v != "" {
+		protocol.Domain = aws.String(v)
+	}
+	if v, ok := m["password"].(string); ok && v != "" {
+		protocol.Password = aws.String(v)
+	}
+	if v, ok := m["user"].(string); ok && v != "" {
+		protocol.User = aws.String(v)
+	}
+
+	return protocol
+}
+
+// todo: go another level down?
+func flattenNFS(nfs *datasync.FsxProtocolNfs) []interface{} {
+	if nfs == nil {
+		return []interface{}{}
+	}
+
+	m := map[string]interface{}{
+		"mount_options": flattenNFSMountOptions(nfs.MountOptions),
+	}
+
+	return []interface{}{m}
+}
+
+func flattenSMB(smb *datasync.FsxProtocolSmb) []interface{} {
+	if smb == nil {
+		return []interface{}{}
+	}
+
+	m := map[string]interface{}{
+		"mount_options": flattenSMBMountOptions(smb.MountOptions),
+	}
+	if v := smb.Domain; v != nil {
+		m["domain"] = aws.StringValue(v)
+	}
+	if v := smb.Password; v != nil {
+		m["password"] = aws.StringValue(v)
+	}
+	if v := smb.User; v != nil {
+		m["user"] = aws.StringValue(v)
+	}
+
+	return []interface{}{m}
+}
diff --git a/internal/service/datasync/consts.go b/internal/service/datasync/consts.go
index f05e7a6b33b..2bd15873f8b 100644
--- a/internal/service/datasync/consts.go
+++ b/internal/service/datasync/consts.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package datasync
 
 import (
diff --git a/internal/service/datasync/find.go b/internal/service/datasync/find.go
deleted file mode 100644
index e9492ad5f7e..00000000000
--- a/internal/service/datasync/find.go
+++ /dev/null
@@ -1,161 +0,0 @@
-package datasync
-
-import (
-	"context"
-
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/datasync"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
-	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
-)
-
-func FindAgentByARN(ctx context.Context, conn *datasync.DataSync, arn string) (*datasync.DescribeAgentOutput, error) {
-	input := &datasync.DescribeAgentInput{
-		AgentArn: aws.String(arn),
-	}
-
-	output, err := conn.DescribeAgentWithContext(ctx, input)
-
-	if tfawserr.ErrMessageContains(err, datasync.ErrCodeInvalidRequestException, "does not exist") {
-		return nil, &retry.NotFoundError{
-			LastError:   err,
-			LastRequest: input,
-		}
-	}
-
-	if err != nil {
-		return nil, err
-	}
-
-	if output == nil {
-		return nil, tfresource.NewEmptyResultError(input)
-	}
-
-	return output, nil
-}
-
-func FindTaskByARN(ctx context.Context, conn *datasync.DataSync, arn string) (*datasync.DescribeTaskOutput, error) {
-	input := &datasync.DescribeTaskInput{
-		TaskArn: aws.String(arn),
-	}
-
-	output, err := conn.DescribeTaskWithContext(ctx, input)
-
-	if tfawserr.ErrMessageContains(err, datasync.ErrCodeInvalidRequestException, "not found") {
-		return nil, &retry.NotFoundError{
-			LastError:   err,
-			LastRequest: input,
-		}
-	}
-
-	if err != nil {
-		return nil, err
-	}
-
-	if output == nil {
-		return nil, tfresource.NewEmptyResultError(input)
-	}
-
-	return output, nil
-}
-
-func FindLocationHDFSByARN(ctx context.Context, conn *datasync.DataSync, arn string) (*datasync.DescribeLocationHdfsOutput, error) {
-	input := &datasync.DescribeLocationHdfsInput{
-		LocationArn: aws.String(arn),
-	}
-
-	output, err := conn.DescribeLocationHdfsWithContext(ctx, input)
-
-	if tfawserr.ErrMessageContains(err, datasync.ErrCodeInvalidRequestException, "not found") {
-		return nil, &retry.NotFoundError{
-			LastError:   err,
-			LastRequest: input,
-		}
-	}
-
-	if err != nil {
-		return nil, err
-	}
-
-	if output == nil {
-		return nil, tfresource.NewEmptyResultError(input)
-	}
-
-	return output, nil
-}
-
-func FindFSxLustreLocationByARN(ctx context.Context, conn *datasync.DataSync, arn string) (*datasync.DescribeLocationFsxLustreOutput, error) {
-	input := &datasync.DescribeLocationFsxLustreInput{
-		LocationArn: aws.String(arn),
-	}
-
-	output, err := conn.DescribeLocationFsxLustreWithContext(ctx, input)
-
-	if tfawserr.ErrMessageContains(err, datasync.ErrCodeInvalidRequestException, "not found") {
-		return nil, &retry.NotFoundError{
-			LastError:   err,
-			LastRequest: input,
-		}
-	}
-
-	if err != nil {
-		return nil, err
-	}
-
-	if output == nil {
-		return nil, tfresource.NewEmptyResultError(input)
-	}
-
-	return output, nil
-}
-
-func FindFSxOpenZFSLocationByARN(ctx context.Context, conn *datasync.DataSync, arn string) (*datasync.DescribeLocationFsxOpenZfsOutput, error) {
-	input := &datasync.DescribeLocationFsxOpenZfsInput{
-		LocationArn: aws.String(arn),
-	}
-
-	output, err := conn.DescribeLocationFsxOpenZfsWithContext(ctx, input)
-
-	if tfawserr.ErrMessageContains(err, datasync.ErrCodeInvalidRequestException, "not found") {
-		return nil, &retry.NotFoundError{
-			LastError:   err,
-			LastRequest: input,
-		}
-	}
-
-	if err != nil {
-		return nil, err
-	}
-
-	if output == nil {
-		return nil, tfresource.NewEmptyResultError(input)
-	}
-
-	return output, nil
-}
-
-func FindLocationObjectStorageByARN(ctx context.Context, conn *datasync.DataSync, arn string) (*datasync.DescribeLocationObjectStorageOutput, error) {
-	input := &datasync.DescribeLocationObjectStorageInput{
-		LocationArn: aws.String(arn),
-	}
-
-	output, err := conn.DescribeLocationObjectStorageWithContext(ctx, input)
-
-	if tfawserr.ErrMessageContains(err, datasync.ErrCodeInvalidRequestException, "not found") {
-		return nil, &retry.NotFoundError{
-			LastError:   err,
-			LastRequest: input,
-		}
-	}
-
-	if err != nil {
-		return nil, err
-	}
-
-	if output == nil {
-		return nil, tfresource.NewEmptyResultError(input)
-	}
-
-	return output, nil
-}
diff --git a/internal/service/datasync/generate.go b/internal/service/datasync/generate.go
index 642d0434085..da13cbae9e4 100644
--- a/internal/service/datasync/generate.go
+++ b/internal/service/datasync/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTags -ServiceTagsSlice -TagType=TagListEntry -UntagInTagsElem=Keys -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/datasync/location_azure_blob.go b/internal/service/datasync/location_azure_blob.go
new file mode 100644
index 00000000000..605f01d0742
--- /dev/null
+++ b/internal/service/datasync/location_azure_blob.go
@@ -0,0 +1,288 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package datasync
+
+import (
+	"context"
+	"log"
+	"strings"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/datasync"
+	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
+	"github.com/hashicorp/terraform-provider-aws/internal/flex"
+	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/internal/verify"
+	"github.com/hashicorp/terraform-provider-aws/names"
+)
+
+// @SDKResource("aws_datasync_location_azure_blob", name="Location Microsoft Azure Blob Storage")
+// @Tags(identifierAttribute="id")
+func ResourceLocationAzureBlob() *schema.Resource {
+	return &schema.Resource{
+		CreateWithoutTimeout: resourceLocationAzureBlobCreate,
+		ReadWithoutTimeout:   resourceLocationAzureBlobRead,
+		UpdateWithoutTimeout: resourceLocationAzureBlobUpdate,
+		DeleteWithoutTimeout: resourceLocationAzureBlobDelete,
+
+		Importer: &schema.ResourceImporter{
+			StateContext: schema.ImportStatePassthroughContext,
+		},
+
+		Schema: map[string]*schema.Schema{
+			"access_tier": {
+				Type:         schema.TypeString,
+				Optional:     true,
+				Default:      datasync.AzureAccessTierHot,
+				ValidateFunc: validation.StringInSlice(datasync.AzureAccessTier_Values(), false),
+			},
+			"agent_arns": {
+				Type:     schema.TypeSet,
+				Required: true,
+				Elem: &schema.Schema{
+					Type:         schema.TypeString,
+					ValidateFunc: verify.ValidARN,
+				},
+			},
+			"arn": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"authentication_type": {
+				Type:         schema.TypeString,
+				Required:     true,
+				ValidateFunc: validation.StringInSlice(datasync.AzureBlobAuthenticationType_Values(), false),
+			},
+			"blob_type": {
+				Type:         schema.TypeString,
+				Optional:     true,
+				Default:      datasync.AzureBlobTypeBlock,
+				ValidateFunc: validation.StringInSlice(datasync.AzureBlobType_Values(), false),
+			},
+			"container_url": {
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+			"sas_configuration": {
+				Type:     schema.TypeList,
+				Optional: true,
+				MaxItems: 1,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"token": {
+							Type:     schema.TypeString,
+							Required: true,
+						},
+					},
+				},
+			},
+			"subdirectory": {
+				Type:     schema.TypeString,
+				Optional: true,
+				Computed: true,
+				// Ignore missing trailing slash
+				DiffSuppressFunc: func(k, old, new string, d *schema.ResourceData) bool {
+					if new == "/" {
+						return false
+					}
+					if strings.TrimSuffix(old, "/") == strings.TrimSuffix(new, "/") {
+						return true
+					}
+					return false
+				},
+			},
+			names.AttrTags:    tftags.TagsSchema(),
+			names.AttrTagsAll: tftags.TagsSchemaComputed(),
+			"uri": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+		},
+
+		CustomizeDiff: verify.SetTagsDiff,
+	}
+}
+
+func resourceLocationAzureBlobCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).DataSyncConn(ctx)
+
+	input := &datasync.CreateLocationAzureBlobInput{
+		AgentArns:          flex.ExpandStringSet(d.Get("agent_arns").(*schema.Set)),
+		AuthenticationType: aws.String(d.Get("authentication_type").(string)),
+		ContainerUrl:       aws.String(d.Get("container_url").(string)),
+		Tags:               getTagsIn(ctx),
+	}
+
+	if v, ok := d.GetOk("access_tier"); ok {
+		input.AccessTier = aws.String(v.(string))
+	}
+
+	if v, ok := d.GetOk("blob_type"); ok {
+		input.BlobType = aws.String(v.(string))
+	}
+
+	if v, ok := d.GetOk("sas_configuration"); ok {
+		input.SasConfiguration = expandAzureBlobSasConfiguration(v.([]interface{}))
+	}
+
+	if v, ok := d.GetOk("subdirectory"); ok {
+		input.Subdirectory = aws.String(v.(string))
+	}
+
+	output, err := conn.CreateLocationAzureBlobWithContext(ctx, input)
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "creating DataSync Location Microsoft Azure Blob Storage: %s", err)
+	}
+
+	d.SetId(aws.StringValue(output.LocationArn))
+
+	return append(diags, resourceLocationAzureBlobRead(ctx, d, meta)...)
+}
+
+func resourceLocationAzureBlobRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).DataSyncConn(ctx)
+
+	output, err := FindLocationAzureBlobByARN(ctx, conn, d.Id())
+
+	if !d.IsNewResource() && tfresource.NotFound(err) {
+		log.Printf("[WARN] DataSync Location Microsoft Azure Blob Storage (%s) not found, removing from state", d.Id())
+		d.SetId("")
+		return diags
+	}
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "reading DataSync Location Microsoft Azure Blob Storage (%s): %s", d.Id(), err)
+	}
+
+	uri := aws.StringValue(output.LocationUri)
+	subdirectory, err := subdirectoryFromLocationURI(uri)
+	if err != nil {
+		return sdkdiag.AppendFromErr(diags, err)
+	}
+
+	d.Set("access_tier", output.AccessTier)
+	d.Set("agent_arns", aws.StringValueSlice(output.AgentArns))
+	d.Set("arn", output.LocationArn)
+	d.Set("authentication_type", output.AuthenticationType)
+	d.Set("blob_type", output.BlobType)
+	d.Set("container_url", d.Get("container_url"))
+	d.Set("sas_configuration", d.Get("sas_configuration"))
+	d.Set("subdirectory", subdirectory)
+	d.Set("uri", uri)
+
+	return diags
+}
+
+func resourceLocationAzureBlobUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).DataSyncConn(ctx)
+
+	if d.HasChangesExcept("tags", "tags_all") {
+		input := &datasync.UpdateLocationAzureBlobInput{
+			LocationArn: aws.String(d.Id()),
+		}
+
+		if d.HasChange("access_tier") {
+			input.AccessTier = aws.String(d.Get("access_tier").(string))
+		}
+
+		if d.HasChange("agent_arns") {
+			input.AgentArns = flex.ExpandStringSet(d.Get("agent_arns").(*schema.Set))
+		}
+
+		if d.HasChange("authentication_type") {
+			input.AuthenticationType = aws.String(d.Get("authentication_type").(string))
+		}
+
+		if d.HasChange("blob_type") {
+			input.BlobType = aws.String(d.Get("blob_type").(string))
+		}
+
+		if d.HasChange("sas_configuration") {
+			input.SasConfiguration = expandAzureBlobSasConfiguration(d.Get("sas_configuration").([]interface{}))
+		}
+
+		if d.HasChange("subdirectory") {
+			input.Subdirectory = aws.String(d.Get("subdirectory").(string))
+		}
+
+		_, err := conn.UpdateLocationAzureBlobWithContext(ctx, input)
+
+		if err != nil {
+			return sdkdiag.AppendErrorf(diags, "updating DataSync Location Microsoft Azure Blob Storage (%s): %s", d.Id(), err)
+		}
+	}
+
+	return append(diags, resourceLocationAzureBlobRead(ctx, d, meta)...)
+}
+
+func resourceLocationAzureBlobDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).DataSyncConn(ctx)
+
+	log.Printf("[DEBUG] Deleting DataSync LocationMicrosoft Azure Blob Storage: %s", d.Id())
+	_, err := conn.DeleteLocationWithContext(ctx, &datasync.DeleteLocationInput{
+		LocationArn: aws.String(d.Id()),
+	})
+
+	if tfawserr.ErrMessageContains(err, datasync.ErrCodeInvalidRequestException, "not found") {
+		return diags
+	}
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "deleting DataSync Location Microsoft Azure Blob Storage (%s): %s", d.Id(), err)
+	}
+
+	return diags
+}
+
+func FindLocationAzureBlobByARN(ctx context.Context, conn *datasync.DataSync, arn string) (*datasync.DescribeLocationAzureBlobOutput, error) {
+	input := &datasync.DescribeLocationAzureBlobInput{
+		LocationArn: aws.String(arn),
+	}
+
+	output, err := conn.DescribeLocationAzureBlobWithContext(ctx, input)
+
+	if tfawserr.ErrMessageContains(err, datasync.ErrCodeInvalidRequestException, "not found") {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	if output == nil {
+		return nil, tfresource.NewEmptyResultError(input)
+	}
+
+	return output, nil
+}
+
+func expandAzureBlobSasConfiguration(l []interface{}) *datasync.AzureBlobSasConfiguration {
+	if len(l) == 0 || l[0] == nil {
+		return nil
+	}
+
+	m := l[0].(map[string]interface{})
+
+	apiObject := &datasync.AzureBlobSasConfiguration{
+		Token: aws.String(m["token"].(string)),
+	}
+
+	return apiObject
+}
diff --git a/internal/service/datasync/location_azure_blob_test.go b/internal/service/datasync/location_azure_blob_test.go
new file mode 100644
index 00000000000..db1c3259aa8
--- /dev/null
+++ b/internal/service/datasync/location_azure_blob_test.go
@@ -0,0 +1,302 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package datasync_test
+
+import (
+	"context"
+	"fmt"
+	"testing"
+
+	"github.com/YakDriver/regexache"
+	"github.com/aws/aws-sdk-go/service/datasync"
+	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
+	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	tfdatasync "github.com/hashicorp/terraform-provider-aws/internal/service/datasync"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+)
+
+func TestAccDataSyncLocationAzureBlob_basic(t *testing.T) {
+	ctx := acctest.Context(t)
+	var v datasync.DescribeLocationAzureBlobOutput
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_datasync_location_azure_blob.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, datasync.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckLocationAzureBlobDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccLocationAzureBlobConfig_basic(rName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckLocationAzureBlobExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "access_tier", "HOT"),
+					resource.TestCheckResourceAttr(resourceName, "agent_arns.#", "1"),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "datasync", regexache.MustCompile(`location/loc-.+`)),
+					resource.TestCheckResourceAttr(resourceName, "authentication_type", "SAS"),
+					resource.TestCheckResourceAttr(resourceName, "blob_type", "BLOCK"),
+					resource.TestCheckResourceAttr(resourceName, "container_url", "https://example.com/path"),
+					resource.TestCheckResourceAttr(resourceName, "sas_configuration.#", "1"),
+					resource.TestCheckResourceAttrSet(resourceName, "sas_configuration.0.token"),
+					resource.TestCheckResourceAttr(resourceName, "subdirectory", "/path/"),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
+					resource.TestMatchResourceAttr(resourceName, "uri", regexache.MustCompile(`^azure-blob://.+/`)),
+				),
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"container_url", "sas_configuration"},
+			},
+		},
+	})
+}
+
+func TestAccDataSyncLocationAzureBlob_disappears(t *testing.T) {
+	ctx := acctest.Context(t)
+	var v datasync.DescribeLocationAzureBlobOutput
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_datasync_location_azure_blob.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, datasync.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckLocationAzureBlobDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccLocationAzureBlobConfig_basic(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckLocationAzureBlobExists(ctx, resourceName, &v),
+					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfdatasync.ResourceLocationAzureBlob(), resourceName),
+				),
+				ExpectNonEmptyPlan: true,
+			},
+		},
+	})
+}
+
+func TestAccDataSyncLocationAzureBlob_tags(t *testing.T) {
+	ctx := acctest.Context(t)
+	var v datasync.DescribeLocationAzureBlobOutput
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_datasync_location_azure_blob.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, datasync.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckLocationAzureBlobDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccLocationAzureBlobConfig_tags1(rName, "key1", "value1"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckLocationAzureBlobExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
+				),
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"container_url", "sas_configuration"},
+			},
+			{
+				Config: testAccLocationAzureBlobConfig_tags2(rName, "key1", "value1updated", "key2", "value2"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckLocationAzureBlobExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1updated"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
+				),
+			},
+			{
+				Config: testAccLocationAzureBlobConfig_tags1(rName, "key1", "value1"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckLocationAzureBlobExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccDataSyncLocationAzureBlob_update(t *testing.T) {
+	ctx := acctest.Context(t)
+	var v datasync.DescribeLocationAzureBlobOutput
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_datasync_location_azure_blob.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, datasync.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckLocationAzureBlobDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccLocationAzureBlobConfig_basic(rName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckLocationAzureBlobExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "access_tier", "HOT"),
+					resource.TestCheckResourceAttr(resourceName, "agent_arns.#", "1"),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "datasync", regexache.MustCompile(`location/loc-.+`)),
+					resource.TestCheckResourceAttr(resourceName, "authentication_type", "SAS"),
+					resource.TestCheckResourceAttr(resourceName, "blob_type", "BLOCK"),
+					resource.TestCheckResourceAttr(resourceName, "container_url", "https://example.com/path"),
+					resource.TestCheckResourceAttr(resourceName, "sas_configuration.#", "1"),
+					resource.TestCheckResourceAttrSet(resourceName, "sas_configuration.0.token"),
+					resource.TestCheckResourceAttr(resourceName, "subdirectory", "/path/"),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
+					resource.TestMatchResourceAttr(resourceName, "uri", regexache.MustCompile(`^azure-blob://.+/`)),
+				),
+			},
+			{
+				Config: testAccLocationAzureBlobConfig_updated(rName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckLocationAzureBlobExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "access_tier", "COOL"),
+					resource.TestCheckResourceAttr(resourceName, "agent_arns.#", "1"),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "datasync", regexache.MustCompile(`location/loc-.+`)),
+					resource.TestCheckResourceAttr(resourceName, "authentication_type", "SAS"),
+					resource.TestCheckResourceAttr(resourceName, "blob_type", "BLOCK"),
+					resource.TestCheckResourceAttr(resourceName, "container_url", "https://example.com/path"),
+					resource.TestCheckResourceAttr(resourceName, "sas_configuration.#", "1"),
+					resource.TestCheckResourceAttrSet(resourceName, "sas_configuration.0.token"),
+					resource.TestCheckResourceAttr(resourceName, "subdirectory", "/path/"),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
+					resource.TestMatchResourceAttr(resourceName, "uri", regexache.MustCompile(`^azure-blob://.+/`)),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckLocationAzureBlobDestroy(ctx context.Context) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		conn := acctest.Provider.Meta().(*conns.AWSClient).DataSyncConn(ctx)
+
+		for _, rs := range s.RootModule().Resources {
+			if rs.Type != "aws_datasync_location_azure_blob" {
+				continue
+			}
+
+			_, err := tfdatasync.FindLocationAzureBlobByARN(ctx, conn, rs.Primary.ID)
+
+			if tfresource.NotFound(err) {
+				continue
+			}
+
+			if err != nil {
+				return err
+			}
+
+			return fmt.Errorf("DataSync Location Microsoft Azure Blob Storage %s still exists", rs.Primary.ID)
+		}
+
+		return nil
+	}
+}
+
+func testAccCheckLocationAzureBlobExists(ctx context.Context, n string, v *datasync.DescribeLocationAzureBlobOutput) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		conn := acctest.Provider.Meta().(*conns.AWSClient).DataSyncConn(ctx)
+
+		output, err := tfdatasync.FindLocationAzureBlobByARN(ctx, conn, rs.Primary.ID)
+
+		if err != nil {
+			return err
+		}
+
+		*v = *output
+
+		return nil
+	}
+}
+
+func testAccLocationAzureBlobConfig_base(rName string) string {
+	return acctest.ConfigCompose(testAccAgentAgentConfig_base(rName), fmt.Sprintf(`
+resource "aws_datasync_agent" "test" {
+  ip_address = aws_instance.test.public_ip
+  name       = %[1]q
+}
+`, rName))
+}
+
+func testAccLocationAzureBlobConfig_basic(rName string) string {
+	return acctest.ConfigCompose(testAccLocationAzureBlobConfig_base(rName), `
+resource "aws_datasync_location_azure_blob" "test" {
+  agent_arns          = [aws_datasync_agent.test.arn]
+  authentication_type = "SAS"
+  container_url       = "https://example.com/path"
+
+  sas_configuration {
+    token = "sp=r&st=2023-12-20T14:54:52Z&se=2023-12-20T22:54:52Z&spr=https&sv=2021-06-08&sr=c&sig=aBBKDWQvyuVcTPH9EBp%%2FXTI9E%%2F%%2Fmq171%%2BZU178wcwqU%%3D"
+  }
+}
+`)
+}
+
+func testAccLocationAzureBlobConfig_tags1(rName, key1, value1 string) string {
+	return acctest.ConfigCompose(testAccLocationAzureBlobConfig_base(rName), fmt.Sprintf(`
+resource "aws_datasync_location_azure_blob" "test" {
+  agent_arns          = [aws_datasync_agent.test.arn]
+  authentication_type = "SAS"
+  container_url       = "https://example.com/path"
+
+  sas_configuration {
+    token = "sp=r&st=2023-12-20T14:54:52Z&se=2023-12-20T22:54:52Z&spr=https&sv=2021-06-08&sr=c&sig=aBBKDWQvyuVcTPH9EBp%%2FXTI9E%%2F%%2Fmq171%%2BZU178wcwqU%%3D"
+  }
+
+  tags = {
+    %[1]q = %[2]q
+  }
+}
+`, key1, value1))
+}
+
+func testAccLocationAzureBlobConfig_tags2(rName, key1, value1, key2, value2 string) string {
+	return acctest.ConfigCompose(testAccLocationAzureBlobConfig_base(rName), fmt.Sprintf(`
+resource "aws_datasync_location_azure_blob" "test" {
+  agent_arns          = [aws_datasync_agent.test.arn]
+  authentication_type = "SAS"
+  container_url       = "https://example.com/path"
+
+  sas_configuration {
+    token = "sp=r&st=2023-12-20T14:54:52Z&se=2023-12-20T22:54:52Z&spr=https&sv=2021-06-08&sr=c&sig=aBBKDWQvyuVcTPH9EBp%%2FXTI9E%%2F%%2Fmq171%%2BZU178wcwqU%%3D"
+  }
+
+  tags = {
+    %[1]q = %[2]q
+    %[3]q = %[4]q
+  }
+}
+`, key1, value1, key2, value2))
+}
+
+func testAccLocationAzureBlobConfig_updated(rName string) string {
+	return acctest.ConfigCompose(testAccLocationAzureBlobConfig_base(rName), `
+resource "aws_datasync_location_azure_blob" "test" {
+  access_tier         = "COOL"
+  agent_arns          = [aws_datasync_agent.test.arn]
+  authentication_type = "SAS"
+  container_url       = "https://example.com/path"
+
+  sas_configuration {
+    token = "sp=r&st=2023-12-20T14:54:52Z&se=2023-12-20T22:54:52Z&spr=https&sv=2021-06-08&sr=c&sig=aBBKDWQvyuVcTPH9EBp%%2FXTI9E%%2F%%2Fmq171%%2BZU178wcwqU%%3D"
+  }
+}
+`)
+}
diff --git a/internal/service/datasync/location_efs.go b/internal/service/datasync/location_efs.go
index 61decc9a9a2..9f85450dcb3 100644
--- a/internal/service/datasync/location_efs.go
+++ b/internal/service/datasync/location_efs.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package datasync
 
 import (
@@ -9,12 +12,14 @@ import (
 	"github.com/aws/aws-sdk-go/service/datasync"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
 	"github.com/hashicorp/terraform-provider-aws/internal/flex"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -27,21 +32,22 @@ func ResourceLocationEFS() *schema.Resource {
 		ReadWithoutTimeout:   resourceLocationEFSRead,
 		UpdateWithoutTimeout: resourceLocationEFSUpdate,
 		DeleteWithoutTimeout: resourceLocationEFSDelete,
+
 		Importer: &schema.ResourceImporter{
 			StateContext: schema.ImportStatePassthroughContext,
 		},
 
 		Schema: map[string]*schema.Schema{
-			"arn": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
 			"access_point_arn": {
 				Type:         schema.TypeString,
 				Optional:     true,
 				ForceNew:     true,
 				ValidateFunc: verify.ValidARN,
 			},
+			"arn": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
 			"ec2_config": {
 				Type:     schema.TypeList,
 				Required: true,
@@ -136,8 +142,8 @@ func resourceLocationEFSCreate(ctx context.Context, d *schema.ResourceData, meta
 		input.InTransitEncryption = aws.String(v.(string))
 	}
 
-	log.Printf("[DEBUG] Creating DataSync Location EFS: %s", input)
 	output, err := conn.CreateLocationEfsWithContext(ctx, input)
+
 	if err != nil {
 		return sdkdiag.AppendErrorf(diags, "creating DataSync Location EFS: %s", err)
 	}
@@ -151,15 +157,10 @@ func resourceLocationEFSRead(ctx context.Context, d *schema.ResourceData, meta i
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).DataSyncConn(ctx)
 
-	input := &datasync.DescribeLocationEfsInput{
-		LocationArn: aws.String(d.Id()),
-	}
-
-	log.Printf("[DEBUG] Reading DataSync Location EFS: %s", input)
-	output, err := conn.DescribeLocationEfsWithContext(ctx, input)
+	output, err := FindLocationEFSByARN(ctx, conn, d.Id())
 
-	if tfawserr.ErrMessageContains(err, "InvalidRequestException", "not found") {
-		log.Printf("[WARN] DataSync Location EFS %q not found - removing from state", d.Id())
+	if !d.IsNewResource() && tfresource.NotFound(err) {
+		log.Printf("[WARN] DataSync Location EFS (%s) not found, removing from state", d.Id())
 		d.SetId("")
 		return diags
 	}
@@ -168,23 +169,21 @@ func resourceLocationEFSRead(ctx context.Context, d *schema.ResourceData, meta i
 		return sdkdiag.AppendErrorf(diags, "reading DataSync Location EFS (%s): %s", d.Id(), err)
 	}
 
-	subdirectory, err := subdirectoryFromLocationURI(aws.StringValue(output.LocationUri))
-
+	uri := aws.StringValue(output.LocationUri)
+	subdirectory, err := subdirectoryFromLocationURI(uri)
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "reading DataSync Location EFS (%s): %s", d.Id(), err)
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
+	d.Set("access_point_arn", output.AccessPointArn)
 	d.Set("arn", output.LocationArn)
-
 	if err := d.Set("ec2_config", flattenEC2Config(output.Ec2Config)); err != nil {
 		return sdkdiag.AppendErrorf(diags, "setting ec2_config: %s", err)
 	}
-
-	d.Set("subdirectory", subdirectory)
-	d.Set("uri", output.LocationUri)
-	d.Set("access_point_arn", output.AccessPointArn)
 	d.Set("file_system_access_role_arn", output.FileSystemAccessRoleArn)
 	d.Set("in_transit_encryption", output.InTransitEncryption)
+	d.Set("subdirectory", subdirectory)
+	d.Set("uri", uri)
 
 	return diags
 }
@@ -201,14 +200,12 @@ func resourceLocationEFSDelete(ctx context.Context, d *schema.ResourceData, meta
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).DataSyncConn(ctx)
 
-	input := &datasync.DeleteLocationInput{
+	log.Printf("[DEBUG] Deleting DataSync Location EFS: %s", d.Id())
+	_, err := conn.DeleteLocationWithContext(ctx, &datasync.DeleteLocationInput{
 		LocationArn: aws.String(d.Id()),
-	}
+	})
 
-	log.Printf("[DEBUG] Deleting DataSync Location EFS: %s", input)
-	_, err := conn.DeleteLocationWithContext(ctx, input)
-
-	if tfawserr.ErrMessageContains(err, "InvalidRequestException", "not found") {
+	if tfawserr.ErrMessageContains(err, datasync.ErrCodeInvalidRequestException, "not found") {
 		return diags
 	}
 
@@ -219,6 +216,31 @@ func resourceLocationEFSDelete(ctx context.Context, d *schema.ResourceData, meta
 	return diags
 }
 
+func FindLocationEFSByARN(ctx context.Context, conn *datasync.DataSync, arn string) (*datasync.DescribeLocationEfsOutput, error) {
+	input := &datasync.DescribeLocationEfsInput{
+		LocationArn: aws.String(arn),
+	}
+
+	output, err := conn.DescribeLocationEfsWithContext(ctx, input)
+
+	if tfawserr.ErrMessageContains(err, datasync.ErrCodeInvalidRequestException, "not found") {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	if output == nil {
+		return nil, tfresource.NewEmptyResultError(input)
+	}
+
+	return output, nil
+}
+
 func flattenEC2Config(ec2Config *datasync.Ec2Config) []interface{} {
 	if ec2Config == nil {
 		return []interface{}{}
diff --git a/internal/service/datasync/location_efs_test.go b/internal/service/datasync/location_efs_test.go
index a3848263515..c1a070a2a82 100644
--- a/internal/service/datasync/location_efs_test.go
+++ b/internal/service/datasync/location_efs_test.go
@@ -1,26 +1,27 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package datasync_test
 
 import (
 	"context"
-	"errors"
 	"fmt"
-	"regexp"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/aws"
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/datasync"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	tfdatasync "github.com/hashicorp/terraform-provider-aws/internal/service/datasync"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
 func TestAccDataSyncLocationEFS_basic(t *testing.T) {
 	ctx := acctest.Context(t)
-	var locationEfs1 datasync.DescribeLocationEfsOutput
+	var v datasync.DescribeLocationEfsOutput
 	efsFileSystemResourceName := "aws_efs_file_system.test"
 	resourceName := "aws_datasync_location_efs.test"
 	subnetResourceName := "aws_subnet.test"
@@ -35,15 +36,15 @@ func TestAccDataSyncLocationEFS_basic(t *testing.T) {
 			{
 				Config: testAccLocationEFSConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckLocationEFSExists(ctx, resourceName, &locationEfs1),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "datasync", regexp.MustCompile(`location/loc-.+`)),
+					testAccCheckLocationEFSExists(ctx, resourceName, &v),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "datasync", regexache.MustCompile(`location/loc-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "ec2_config.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "ec2_config.0.security_group_arns.#", "1"),
 					resource.TestCheckResourceAttrPair(resourceName, "ec2_config.0.subnet_arn", subnetResourceName, "arn"),
 					resource.TestCheckResourceAttrPair(resourceName, "efs_file_system_arn", efsFileSystemResourceName, "arn"),
 					resource.TestCheckResourceAttr(resourceName, "subdirectory", "/"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
-					resource.TestMatchResourceAttr(resourceName, "uri", regexp.MustCompile(`^efs://.+/`)),
+					resource.TestMatchResourceAttr(resourceName, "uri", regexache.MustCompile(`^efs://.+/`)),
 				),
 			},
 			{
@@ -58,7 +59,7 @@ func TestAccDataSyncLocationEFS_basic(t *testing.T) {
 
 func TestAccDataSyncLocationEFS_accessPointARN(t *testing.T) {
 	ctx := acctest.Context(t)
-	var locationEfs1 datasync.DescribeLocationEfsOutput
+	var v datasync.DescribeLocationEfsOutput
 	resourceName := "aws_datasync_location_efs.test"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
@@ -71,7 +72,7 @@ func TestAccDataSyncLocationEFS_accessPointARN(t *testing.T) {
 			{
 				Config: testAccLocationEFSConfig_accessPointARN(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckLocationEFSExists(ctx, resourceName, &locationEfs1),
+					testAccCheckLocationEFSExists(ctx, resourceName, &v),
 					resource.TestCheckResourceAttrPair(resourceName, "access_point_arn", "aws_efs_access_point.test", "arn"),
 					resource.TestCheckResourceAttr(resourceName, "in_transit_encryption", "TLS1_2"),
 				),
@@ -88,7 +89,7 @@ func TestAccDataSyncLocationEFS_accessPointARN(t *testing.T) {
 
 func TestAccDataSyncLocationEFS_disappears(t *testing.T) {
 	ctx := acctest.Context(t)
-	var locationEfs1 datasync.DescribeLocationEfsOutput
+	var v datasync.DescribeLocationEfsOutput
 	resourceName := "aws_datasync_location_efs.test"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
@@ -101,7 +102,7 @@ func TestAccDataSyncLocationEFS_disappears(t *testing.T) {
 			{
 				Config: testAccLocationEFSConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckLocationEFSExists(ctx, resourceName, &locationEfs1),
+					testAccCheckLocationEFSExists(ctx, resourceName, &v),
 					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfdatasync.ResourceLocationEFS(), resourceName),
 					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfdatasync.ResourceLocationEFS(), resourceName),
 				),
@@ -113,7 +114,7 @@ func TestAccDataSyncLocationEFS_disappears(t *testing.T) {
 
 func TestAccDataSyncLocationEFS_subdirectory(t *testing.T) {
 	ctx := acctest.Context(t)
-	var locationEfs1 datasync.DescribeLocationEfsOutput
+	var v datasync.DescribeLocationEfsOutput
 	resourceName := "aws_datasync_location_efs.test"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
@@ -126,7 +127,7 @@ func TestAccDataSyncLocationEFS_subdirectory(t *testing.T) {
 			{
 				Config: testAccLocationEFSConfig_subdirectory(rName, "/subdirectory1/"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckLocationEFSExists(ctx, resourceName, &locationEfs1),
+					testAccCheckLocationEFSExists(ctx, resourceName, &v),
 					resource.TestCheckResourceAttr(resourceName, "subdirectory", "/subdirectory1/"),
 				),
 			},
@@ -142,7 +143,7 @@ func TestAccDataSyncLocationEFS_subdirectory(t *testing.T) {
 
 func TestAccDataSyncLocationEFS_tags(t *testing.T) {
 	ctx := acctest.Context(t)
-	var locationEfs1, locationEfs2, locationEfs3 datasync.DescribeLocationEfsOutput
+	var v datasync.DescribeLocationEfsOutput
 	resourceName := "aws_datasync_location_efs.test"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
@@ -155,7 +156,7 @@ func TestAccDataSyncLocationEFS_tags(t *testing.T) {
 			{
 				Config: testAccLocationEFSConfig_tags1(rName, "key1", "value1"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckLocationEFSExists(ctx, resourceName, &locationEfs1),
+					testAccCheckLocationEFSExists(ctx, resourceName, &v),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
 				),
@@ -169,8 +170,7 @@ func TestAccDataSyncLocationEFS_tags(t *testing.T) {
 			{
 				Config: testAccLocationEFSConfig_tags2(rName, "key1", "value1updated", "key2", "value2"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckLocationEFSExists(ctx, resourceName, &locationEfs2),
-					testAccCheckLocationEFSNotRecreated(&locationEfs1, &locationEfs2),
+					testAccCheckLocationEFSExists(ctx, resourceName, &v),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1updated"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
@@ -179,8 +179,7 @@ func TestAccDataSyncLocationEFS_tags(t *testing.T) {
 			{
 				Config: testAccLocationEFSConfig_tags1(rName, "key1", "value1"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckLocationEFSExists(ctx, resourceName, &locationEfs3),
-					testAccCheckLocationEFSNotRecreated(&locationEfs2, &locationEfs3),
+					testAccCheckLocationEFSExists(ctx, resourceName, &v),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
 				),
@@ -198,64 +197,45 @@ func testAccCheckLocationEFSDestroy(ctx context.Context) resource.TestCheckFunc
 				continue
 			}
 
-			input := &datasync.DescribeLocationEfsInput{
-				LocationArn: aws.String(rs.Primary.ID),
-			}
-
-			_, err := conn.DescribeLocationEfsWithContext(ctx, input)
+			_, err := tfdatasync.FindLocationEFSByARN(ctx, conn, rs.Primary.ID)
 
-			if tfawserr.ErrMessageContains(err, "InvalidRequestException", "not found") {
-				return nil
+			if tfresource.NotFound(err) {
+				continue
 			}
 
 			if err != nil {
 				return err
 			}
+
+			return fmt.Errorf("DataSync Location EFS %s still exists", rs.Primary.ID)
 		}
 
 		return nil
 	}
 }
 
-func testAccCheckLocationEFSExists(ctx context.Context, resourceName string, locationEfs *datasync.DescribeLocationEfsOutput) resource.TestCheckFunc {
+func testAccCheckLocationEFSExists(ctx context.Context, n string, v *datasync.DescribeLocationEfsOutput) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		rs, ok := s.RootModule().Resources[resourceName]
+		rs, ok := s.RootModule().Resources[n]
 		if !ok {
-			return fmt.Errorf("Not found: %s", resourceName)
+			return fmt.Errorf("Not found: %s", n)
 		}
 
 		conn := acctest.Provider.Meta().(*conns.AWSClient).DataSyncConn(ctx)
-		input := &datasync.DescribeLocationEfsInput{
-			LocationArn: aws.String(rs.Primary.ID),
-		}
 
-		output, err := conn.DescribeLocationEfsWithContext(ctx, input)
+		output, err := tfdatasync.FindLocationEFSByARN(ctx, conn, rs.Primary.ID)
 
 		if err != nil {
 			return err
 		}
 
-		if output == nil {
-			return fmt.Errorf("Location %q does not exist", rs.Primary.ID)
-		}
-
-		*locationEfs = *output
-
-		return nil
-	}
-}
-
-func testAccCheckLocationEFSNotRecreated(i, j *datasync.DescribeLocationEfsOutput) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		if !aws.TimeValue(i.CreationTime).Equal(aws.TimeValue(j.CreationTime)) {
-			return errors.New("DataSync Location EFS was recreated")
-		}
+		*v = *output
 
 		return nil
 	}
 }
 
-func testAccLocationEFSBaseConfig(rName string) string {
+func testAccLocationEFSConfig_base(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_vpc" "test" {
   cidr_block = "10.0.0.0/16"
@@ -296,7 +276,7 @@ resource "aws_efs_mount_target" "test" {
 }
 
 func testAccLocationEFSConfig_basic(rName string) string {
-	return acctest.ConfigCompose(testAccLocationEFSBaseConfig(rName), `
+	return acctest.ConfigCompose(testAccLocationEFSConfig_base(rName), `
 resource "aws_datasync_location_efs" "test" {
   efs_file_system_arn = aws_efs_mount_target.test.file_system_arn
 
@@ -309,7 +289,7 @@ resource "aws_datasync_location_efs" "test" {
 }
 
 func testAccLocationEFSConfig_subdirectory(rName, subdirectory string) string {
-	return acctest.ConfigCompose(testAccLocationEFSBaseConfig(rName), fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccLocationEFSConfig_base(rName), fmt.Sprintf(`
 resource "aws_datasync_location_efs" "test" {
   efs_file_system_arn = aws_efs_mount_target.test.file_system_arn
   subdirectory        = %[1]q
@@ -323,7 +303,7 @@ resource "aws_datasync_location_efs" "test" {
 }
 
 func testAccLocationEFSConfig_tags1(rName, key1, value1 string) string {
-	return acctest.ConfigCompose(testAccLocationEFSBaseConfig(rName), fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccLocationEFSConfig_base(rName), fmt.Sprintf(`
 resource "aws_datasync_location_efs" "test" {
   efs_file_system_arn = aws_efs_mount_target.test.file_system_arn
 
@@ -340,7 +320,7 @@ resource "aws_datasync_location_efs" "test" {
 }
 
 func testAccLocationEFSConfig_tags2(rName, key1, value1, key2, value2 string) string {
-	return acctest.ConfigCompose(testAccLocationEFSBaseConfig(rName), fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccLocationEFSConfig_base(rName), fmt.Sprintf(`
 resource "aws_datasync_location_efs" "test" {
   efs_file_system_arn = aws_efs_mount_target.test.file_system_arn
 
@@ -358,7 +338,7 @@ resource "aws_datasync_location_efs" "test" {
 }
 
 func testAccLocationEFSConfig_accessPointARN(rName string) string {
-	return acctest.ConfigCompose(testAccLocationEFSBaseConfig(rName), fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccLocationEFSConfig_base(rName), fmt.Sprintf(`
 resource "aws_efs_access_point" "test" {
   file_system_id = aws_efs_file_system.test.id
 
diff --git a/internal/service/datasync/location_fsx_lustre_file_system.go b/internal/service/datasync/location_fsx_lustre_file_system.go
index 4ce0ec3f66b..cac05875e6b 100644
--- a/internal/service/datasync/location_fsx_lustre_file_system.go
+++ b/internal/service/datasync/location_fsx_lustre_file_system.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package datasync
 
 import (
@@ -11,6 +14,7 @@ import (
 	"github.com/aws/aws-sdk-go/service/datasync"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
@@ -22,7 +26,7 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
-// @SDKResource("aws_datasync_location_fsx_lustre_file_system", name="Location FSx Lustre File System")
+// @SDKResource("aws_datasync_location_fsx_lustre_file_system", name="Location FSx for Lustre File System")
 // @Tags(identifierAttribute="id")
 func ResourceLocationFSxLustreFileSystem() *schema.Resource {
 	return &schema.Resource{
@@ -30,6 +34,7 @@ func ResourceLocationFSxLustreFileSystem() *schema.Resource {
 		ReadWithoutTimeout:   resourceLocationFSxLustreFileSystemRead,
 		UpdateWithoutTimeout: resourceLocationFSxLustreFileSystemUpdate,
 		DeleteWithoutTimeout: resourceLocationFSxLustreFileSystemDelete,
+
 		Importer: &schema.ResourceImporter{
 			StateContext: func(ctx context.Context, d *schema.ResourceData, meta interface{}) ([]*schema.ResourceData, error) {
 				idParts := strings.Split(d.Id(), "#")
@@ -52,6 +57,10 @@ func ResourceLocationFSxLustreFileSystem() *schema.Resource {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
+			"creation_time": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
 			"fsx_filesystem_arn": {
 				Type:         schema.TypeString,
 				Required:     true,
@@ -82,10 +91,6 @@ func ResourceLocationFSxLustreFileSystem() *schema.Resource {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
-			"creation_time": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
 		},
 
 		CustomizeDiff: verify.SetTagsDiff,
@@ -107,10 +112,10 @@ func resourceLocationFSxLustreFileSystemCreate(ctx context.Context, d *schema.Re
 		input.Subdirectory = aws.String(v.(string))
 	}
 
-	log.Printf("[DEBUG] Creating DataSync Location Fsx Lustre File System: %#v", input)
 	output, err := conn.CreateLocationFsxLustreWithContext(ctx, input)
+
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "creating DataSync Location Fsx Lustre File System: %s", err)
+		return sdkdiag.AppendErrorf(diags, "creating DataSync Location FSx for Lustre File System: %s", err)
 	}
 
 	d.SetId(aws.StringValue(output.LocationArn))
@@ -122,36 +127,31 @@ func resourceLocationFSxLustreFileSystemRead(ctx context.Context, d *schema.Reso
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).DataSyncConn(ctx)
 
-	output, err := FindFSxLustreLocationByARN(ctx, conn, d.Id())
+	output, err := FindLocationFSxLustreByARN(ctx, conn, d.Id())
 
 	if !d.IsNewResource() && tfresource.NotFound(err) {
-		log.Printf("[WARN] DataSync Location Fsx Lustre (%s) not found, removing from state", d.Id())
+		log.Printf("[WARN] DataSync Location FSx for Lustre File System (%s) not found, removing from state", d.Id())
 		d.SetId("")
 		return diags
 	}
 
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "reading DataSync Location Fsx Lustre (%s): %s", d.Id(), err)
+		return sdkdiag.AppendErrorf(diags, "reading DataSync Location FSx for Lustre File System (%s): %s", d.Id(), err)
 	}
 
-	subdirectory, err := subdirectoryFromLocationURI(aws.StringValue(output.LocationUri))
-
+	uri := aws.StringValue(output.LocationUri)
+	subdirectory, err := subdirectoryFromLocationURI(uri)
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "reading DataSync Location Fsx Lustre (%s): %s", d.Id(), err)
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
 	d.Set("arn", output.LocationArn)
+	d.Set("creation_time", output.CreationTime.Format(time.RFC3339))
+	d.Set("fsx_filesystem_arn", d.Get("fsx_filesystem_arn"))
+	d.Set("security_group_arns", aws.StringValueSlice(output.SecurityGroupArns))
 	d.Set("subdirectory", subdirectory)
 	d.Set("uri", output.LocationUri)
 
-	if err := d.Set("security_group_arns", flex.FlattenStringSet(output.SecurityGroupArns)); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting security_group_arns: %s", err)
-	}
-
-	if err := d.Set("creation_time", output.CreationTime.Format(time.RFC3339)); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting creation_time: %s", err)
-	}
-
 	return diags
 }
 
@@ -167,20 +167,43 @@ func resourceLocationFSxLustreFileSystemDelete(ctx context.Context, d *schema.Re
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).DataSyncConn(ctx)
 
-	input := &datasync.DeleteLocationInput{
+	log.Printf("[DEBUG] Deleting DataSync Location FSx for Lustre File System: %s", d.Id())
+	_, err := conn.DeleteLocationWithContext(ctx, &datasync.DeleteLocationInput{
 		LocationArn: aws.String(d.Id()),
-	}
-
-	log.Printf("[DEBUG] Deleting DataSync Location Fsx Lustre File System: %#v", input)
-	_, err := conn.DeleteLocationWithContext(ctx, input)
+	})
 
 	if tfawserr.ErrMessageContains(err, datasync.ErrCodeInvalidRequestException, "not found") {
 		return diags
 	}
 
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "deleting DataSync Location Fsx Lustre (%s): %s", d.Id(), err)
+		return sdkdiag.AppendErrorf(diags, "deleting DataSync Location FSx for Lustre File System (%s): %s", d.Id(), err)
 	}
 
 	return diags
 }
+
+func FindLocationFSxLustreByARN(ctx context.Context, conn *datasync.DataSync, arn string) (*datasync.DescribeLocationFsxLustreOutput, error) {
+	input := &datasync.DescribeLocationFsxLustreInput{
+		LocationArn: aws.String(arn),
+	}
+
+	output, err := conn.DescribeLocationFsxLustreWithContext(ctx, input)
+
+	if tfawserr.ErrMessageContains(err, datasync.ErrCodeInvalidRequestException, "not found") {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	if output == nil {
+		return nil, tfresource.NewEmptyResultError(input)
+	}
+
+	return output, nil
+}
diff --git a/internal/service/datasync/location_fsx_lustre_file_system_test.go b/internal/service/datasync/location_fsx_lustre_file_system_test.go
index 3a723816f77..6e1ca72b198 100644
--- a/internal/service/datasync/location_fsx_lustre_file_system_test.go
+++ b/internal/service/datasync/location_fsx_lustre_file_system_test.go
@@ -1,13 +1,17 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package datasync_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/datasync"
 	"github.com/aws/aws-sdk-go/service/fsx"
+	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
@@ -18,6 +22,7 @@ import (
 
 func TestAccDataSyncLocationFSxLustreFileSystem_basic(t *testing.T) {
 	ctx := acctest.Context(t)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	var locationFsxLustre1 datasync.DescribeLocationFsxLustreOutput
 	resourceName := "aws_datasync_location_fsx_lustre_file_system.test"
 	fsResourceName := "aws_fsx_lustre_file_system.test"
@@ -33,14 +38,14 @@ func TestAccDataSyncLocationFSxLustreFileSystem_basic(t *testing.T) {
 		CheckDestroy:             testAccCheckLocationFSxLustreDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccLocationFSxLustreFileSystemConfig_basic(),
+				Config: testAccLocationFSxLustreFileSystemConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckLocationFSxLustreExists(ctx, resourceName, &locationFsxLustre1),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "datasync", regexp.MustCompile(`location/loc-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "datasync", regexache.MustCompile(`location/loc-.+`)),
 					resource.TestCheckResourceAttrPair(resourceName, "fsx_filesystem_arn", fsResourceName, "arn"),
 					resource.TestCheckResourceAttr(resourceName, "subdirectory", "/"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
-					resource.TestMatchResourceAttr(resourceName, "uri", regexp.MustCompile(`^fsxl://.+/`)),
+					resource.TestMatchResourceAttr(resourceName, "uri", regexache.MustCompile(`^fsxl://.+/`)),
 					resource.TestCheckResourceAttrSet(resourceName, "creation_time"),
 				),
 			},
@@ -56,6 +61,7 @@ func TestAccDataSyncLocationFSxLustreFileSystem_basic(t *testing.T) {
 
 func TestAccDataSyncLocationFSxLustreFileSystem_disappears(t *testing.T) {
 	ctx := acctest.Context(t)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	var locationFsxLustre1 datasync.DescribeLocationFsxLustreOutput
 	resourceName := "aws_datasync_location_fsx_lustre_file_system.test"
 
@@ -70,11 +76,10 @@ func TestAccDataSyncLocationFSxLustreFileSystem_disappears(t *testing.T) {
 		CheckDestroy:             testAccCheckLocationFSxLustreDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccLocationFSxLustreFileSystemConfig_basic(),
+				Config: testAccLocationFSxLustreFileSystemConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckLocationFSxLustreExists(ctx, resourceName, &locationFsxLustre1),
 					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfdatasync.ResourceLocationFSxLustreFileSystem(), resourceName),
-					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfdatasync.ResourceLocationFSxLustreFileSystem(), resourceName),
 				),
 				ExpectNonEmptyPlan: true,
 			},
@@ -84,6 +89,7 @@ func TestAccDataSyncLocationFSxLustreFileSystem_disappears(t *testing.T) {
 
 func TestAccDataSyncLocationFSxLustreFileSystem_subdirectory(t *testing.T) {
 	ctx := acctest.Context(t)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	var locationFsxLustre1 datasync.DescribeLocationFsxLustreOutput
 	resourceName := "aws_datasync_location_fsx_lustre_file_system.test"
 
@@ -98,7 +104,7 @@ func TestAccDataSyncLocationFSxLustreFileSystem_subdirectory(t *testing.T) {
 		CheckDestroy:             testAccCheckLocationFSxLustreDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccLocationFSxLustreFileSystemConfig_subdirectory("/subdirectory1/"),
+				Config: testAccLocationFSxLustreFileSystemConfig_subdirectory(rName, "/subdirectory1/"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckLocationFSxLustreExists(ctx, resourceName, &locationFsxLustre1),
 					resource.TestCheckResourceAttr(resourceName, "subdirectory", "/subdirectory1/"),
@@ -116,6 +122,7 @@ func TestAccDataSyncLocationFSxLustreFileSystem_subdirectory(t *testing.T) {
 
 func TestAccDataSyncLocationFSxLustreFileSystem_tags(t *testing.T) {
 	ctx := acctest.Context(t)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	var locationFsxLustre1 datasync.DescribeLocationFsxLustreOutput
 	resourceName := "aws_datasync_location_fsx_lustre_file_system.test"
 
@@ -130,7 +137,7 @@ func TestAccDataSyncLocationFSxLustreFileSystem_tags(t *testing.T) {
 		CheckDestroy:             testAccCheckLocationFSxLustreDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccLocationFSxLustreFileSystemConfig_tags1("key1", "value1"),
+				Config: testAccLocationFSxLustreFileSystemConfig_tags1(rName, "key1", "value1"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckLocationFSxLustreExists(ctx, resourceName, &locationFsxLustre1),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
@@ -144,7 +151,7 @@ func TestAccDataSyncLocationFSxLustreFileSystem_tags(t *testing.T) {
 				ImportStateIdFunc: testAccLocationFSxLustreImportStateID(resourceName),
 			},
 			{
-				Config: testAccLocationFSxLustreFileSystemConfig_tags2("key1", "value1updated", "key2", "value2"),
+				Config: testAccLocationFSxLustreFileSystemConfig_tags2(rName, "key1", "value1updated", "key2", "value2"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckLocationFSxLustreExists(ctx, resourceName, &locationFsxLustre1),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
@@ -153,7 +160,7 @@ func TestAccDataSyncLocationFSxLustreFileSystem_tags(t *testing.T) {
 				),
 			},
 			{
-				Config: testAccLocationFSxLustreFileSystemConfig_tags1("key1", "value1"),
+				Config: testAccLocationFSxLustreFileSystemConfig_tags1(rName, "key1", "value1"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckLocationFSxLustreExists(ctx, resourceName, &locationFsxLustre1),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
@@ -173,7 +180,7 @@ func testAccCheckLocationFSxLustreDestroy(ctx context.Context) resource.TestChec
 				continue
 			}
 
-			_, err := tfdatasync.FindFSxLustreLocationByARN(ctx, conn, rs.Primary.ID)
+			_, err := tfdatasync.FindLocationFSxLustreByARN(ctx, conn, rs.Primary.ID)
 
 			if tfresource.NotFound(err) {
 				continue
@@ -183,32 +190,29 @@ func testAccCheckLocationFSxLustreDestroy(ctx context.Context) resource.TestChec
 				return err
 			}
 
-			return fmt.Errorf("DataSync Task %s still exists", rs.Primary.ID)
+			return fmt.Errorf("DataSync Location FSx for Lustre File System %s still exists", rs.Primary.ID)
 		}
 
 		return nil
 	}
 }
 
-func testAccCheckLocationFSxLustreExists(ctx context.Context, resourceName string, locationFsxLustre *datasync.DescribeLocationFsxLustreOutput) resource.TestCheckFunc {
+func testAccCheckLocationFSxLustreExists(ctx context.Context, n string, v *datasync.DescribeLocationFsxLustreOutput) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		rs, ok := s.RootModule().Resources[resourceName]
+		rs, ok := s.RootModule().Resources[n]
 		if !ok {
-			return fmt.Errorf("Not found: %s", resourceName)
+			return fmt.Errorf("Not found: %s", n)
 		}
 
 		conn := acctest.Provider.Meta().(*conns.AWSClient).DataSyncConn(ctx)
-		output, err := tfdatasync.FindFSxLustreLocationByARN(ctx, conn, rs.Primary.ID)
+
+		output, err := tfdatasync.FindLocationFSxLustreByARN(ctx, conn, rs.Primary.ID)
 
 		if err != nil {
 			return err
 		}
 
-		if output == nil {
-			return fmt.Errorf("Location %q does not exist", rs.Primary.ID)
-		}
-
-		*locationFsxLustre = *output
+		*v = *output
 
 		return nil
 	}
@@ -225,8 +229,48 @@ func testAccLocationFSxLustreImportStateID(resourceName string) resource.ImportS
 	}
 }
 
-func testAccLocationFSxLustreFileSystemConfig_basic() string {
-	return acctest.ConfigCompose(testAccFSxLustreFileSystemBaseConfig(), `
+func testAccFSxLustreFileSystemConfig_base(rName string) string {
+	return acctest.ConfigCompose(acctest.ConfigVPCWithSubnets(rName, 1), fmt.Sprintf(`
+data "aws_partition" "current" {}
+
+resource "aws_security_group" "test" {
+  name   = %[1]q
+  vpc_id = aws_vpc.test.id
+
+  ingress {
+    cidr_blocks = [aws_vpc.test.cidr_block]
+    from_port   = 0
+    protocol    = -1
+    to_port     = 0
+  }
+
+  egress {
+    cidr_blocks = ["0.0.0.0/0"]
+    from_port   = 0
+    protocol    = "-1"
+    to_port     = 0
+  }
+
+  tags = {
+    Name = %[1]q
+  }
+}
+
+resource "aws_fsx_lustre_file_system" "test" {
+  security_group_ids = [aws_security_group.test.id]
+  storage_capacity   = 1200
+  subnet_ids         = aws_subnet.test[*].id
+  deployment_type    = data.aws_partition.current.partition == "aws-us-gov" ? "SCRATCH_2" : null # GovCloud does not support SCRATCH_1
+
+  tags = {
+    Name = %[1]q
+  }
+}
+`, rName))
+}
+
+func testAccLocationFSxLustreFileSystemConfig_basic(rName string) string {
+	return acctest.ConfigCompose(testAccFSxLustreFileSystemConfig_base(rName), `
 resource "aws_datasync_location_fsx_lustre_file_system" "test" {
   fsx_filesystem_arn  = aws_fsx_lustre_file_system.test.arn
   security_group_arns = [aws_security_group.test.arn]
@@ -234,8 +278,8 @@ resource "aws_datasync_location_fsx_lustre_file_system" "test" {
 `)
 }
 
-func testAccLocationFSxLustreFileSystemConfig_subdirectory(subdirectory string) string {
-	return acctest.ConfigCompose(testAccFSxLustreFileSystemBaseConfig(), fmt.Sprintf(`
+func testAccLocationFSxLustreFileSystemConfig_subdirectory(rName, subdirectory string) string {
+	return acctest.ConfigCompose(testAccFSxLustreFileSystemConfig_base(rName), fmt.Sprintf(`
 resource "aws_datasync_location_fsx_lustre_file_system" "test" {
   fsx_filesystem_arn  = aws_fsx_lustre_file_system.test.arn
   security_group_arns = [aws_security_group.test.arn]
@@ -244,8 +288,8 @@ resource "aws_datasync_location_fsx_lustre_file_system" "test" {
 `, subdirectory))
 }
 
-func testAccLocationFSxLustreFileSystemConfig_tags1(key1, value1 string) string {
-	return acctest.ConfigCompose(testAccFSxLustreFileSystemBaseConfig(), fmt.Sprintf(`
+func testAccLocationFSxLustreFileSystemConfig_tags1(rName, key1, value1 string) string {
+	return acctest.ConfigCompose(testAccFSxLustreFileSystemConfig_base(rName), fmt.Sprintf(`
 resource "aws_datasync_location_fsx_lustre_file_system" "test" {
   fsx_filesystem_arn  = aws_fsx_lustre_file_system.test.arn
   security_group_arns = [aws_security_group.test.arn]
@@ -257,8 +301,8 @@ resource "aws_datasync_location_fsx_lustre_file_system" "test" {
 `, key1, value1))
 }
 
-func testAccLocationFSxLustreFileSystemConfig_tags2(key1, value1, key2, value2 string) string {
-	return acctest.ConfigCompose(testAccFSxLustreFileSystemBaseConfig(), fmt.Sprintf(`
+func testAccLocationFSxLustreFileSystemConfig_tags2(rName, key1, value1, key2, value2 string) string {
+	return acctest.ConfigCompose(testAccFSxLustreFileSystemConfig_base(rName), fmt.Sprintf(`
 resource "aws_datasync_location_fsx_lustre_file_system" "test" {
   fsx_filesystem_arn  = aws_fsx_lustre_file_system.test.arn
   security_group_arns = [aws_security_group.test.arn]
@@ -270,45 +314,3 @@ resource "aws_datasync_location_fsx_lustre_file_system" "test" {
 }
 `, key1, value1, key2, value2))
 }
-
-func testAccFSxLustreFileSystemBaseConfig() string {
-	return acctest.ConfigCompose(acctest.ConfigAvailableAZsNoOptIn(), `
-data "aws_partition" "current" {}
-
-resource "aws_vpc" "test" {
-  cidr_block = "10.0.0.0/16"
-}
-
-resource "aws_subnet" "test" {
-  vpc_id            = aws_vpc.test.id
-  cidr_block        = "10.0.1.0/24"
-  availability_zone = data.aws_availability_zones.available.names[0]
-}
-
-resource "aws_security_group" "test" {
-  description = "security group for FSx testing"
-  vpc_id      = aws_vpc.test.id
-
-  ingress {
-    cidr_blocks = [aws_vpc.test.cidr_block]
-    from_port   = 0
-    protocol    = -1
-    to_port     = 0
-  }
-
-  egress {
-    cidr_blocks = ["0.0.0.0/0"]
-    from_port   = 0
-    protocol    = "-1"
-    to_port     = 0
-  }
-}
-
-resource "aws_fsx_lustre_file_system" "test" {
-  security_group_ids = [aws_security_group.test.id]
-  storage_capacity   = 1200
-  subnet_ids         = [aws_subnet.test.id]
-  deployment_type    = data.aws_partition.current.partition == "aws-us-gov" ? "SCRATCH_2" : null # GovCloud does not support SCRATCH_1
-}
-`)
-}
diff --git a/internal/service/datasync/location_fsx_ontap_file_system.go b/internal/service/datasync/location_fsx_ontap_file_system.go
new file mode 100644
index 00000000000..20263884cf2
--- /dev/null
+++ b/internal/service/datasync/location_fsx_ontap_file_system.go
@@ -0,0 +1,317 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package datasync
+
+import (
+	"context"
+	"fmt"
+	"log"
+	"strings"
+	"time"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/datasync"
+	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
+	"github.com/hashicorp/terraform-provider-aws/internal/flex"
+	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/internal/verify"
+	"github.com/hashicorp/terraform-provider-aws/names"
+)
+
+// @SDKResource("aws_datasync_location_fsx_ontap_file_system", name="Location FSx for NetApp ONTAP File System")
+// @Tags(identifierAttribute="id")
+func ResourceLocationFSxONTAPFileSystem() *schema.Resource {
+	return &schema.Resource{
+		CreateWithoutTimeout: resourceLocationFSxONTAPFileSystemCreate,
+		ReadWithoutTimeout:   resourceLocationFSxONTAPFileSystemRead,
+		UpdateWithoutTimeout: resourceLocationFSxONTAPFileSystemUpdate,
+		DeleteWithoutTimeout: resourceLocationFSxONTAPFileSystemDelete,
+
+		Importer: &schema.ResourceImporter{
+			StateContext: func(ctx context.Context, d *schema.ResourceData, meta interface{}) ([]*schema.ResourceData, error) {
+				idParts := strings.Split(d.Id(), "#")
+				if len(idParts) != 2 || idParts[0] == "" || idParts[1] == "" {
+					return nil, fmt.Errorf("Unexpected format of ID (%q), expected DataSyncLocationArn#FsxSVMArn", d.Id())
+				}
+
+				DSArn := idParts[0]
+				FSxArn := idParts[1]
+
+				d.Set("fsx_filesystem_arn", FSxArn)
+				d.SetId(DSArn)
+
+				return []*schema.ResourceData{d}, nil
+			},
+		},
+
+		Schema: map[string]*schema.Schema{
+			"arn": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"creation_time": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"fsx_filesystem_arn": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"protocol": {
+				Type:     schema.TypeList,
+				Required: true,
+				ForceNew: true,
+				MaxItems: 1,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"nfs": {
+							Type:         schema.TypeList,
+							Optional:     true,
+							ForceNew:     true,
+							MaxItems:     1,
+							ExactlyOneOf: []string{"protocol.0.nfs", "protocol.0.smb"},
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"mount_options": {
+										Type:     schema.TypeList,
+										Required: true,
+										ForceNew: true,
+										MaxItems: 1,
+										Elem: &schema.Resource{
+											Schema: map[string]*schema.Schema{
+												"version": {
+													Type:     schema.TypeString,
+													Default:  datasync.NfsVersionNfs3,
+													Optional: true,
+													ForceNew: true,
+													ValidateFunc: validation.StringInSlice([]string{
+														datasync.NfsVersionNfs3,
+													}, false),
+												},
+											},
+										},
+									},
+								},
+							},
+						},
+						"smb": {
+							Type:         schema.TypeList,
+							Optional:     true,
+							ForceNew:     true,
+							MaxItems:     1,
+							ExactlyOneOf: []string{"protocol.0.nfs", "protocol.0.smb"},
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"domain": {
+										Type:         schema.TypeString,
+										Optional:     true,
+										ForceNew:     true,
+										ValidateFunc: validation.StringLenBetween(1, 253),
+									},
+									"mount_options": {
+										Type:     schema.TypeList,
+										Required: true,
+										ForceNew: true,
+										MaxItems: 1,
+										Elem: &schema.Resource{
+											Schema: map[string]*schema.Schema{
+												"version": {
+													Type:     schema.TypeString,
+													Default:  datasync.SmbVersionAutomatic,
+													Optional: true,
+													ForceNew: true,
+													ValidateFunc: validation.StringInSlice([]string{
+														datasync.SmbVersionAutomatic,
+														datasync.SmbVersionSmb2,
+														datasync.SmbVersionSmb3,
+														datasync.SmbVersionSmb20,
+													}, false),
+												},
+											},
+										},
+									},
+									"password": {
+										Type:         schema.TypeString,
+										Required:     true,
+										ForceNew:     true,
+										Sensitive:    true,
+										ValidateFunc: validation.StringLenBetween(1, 104),
+									},
+									"user": {
+										Type:         schema.TypeString,
+										Required:     true,
+										ForceNew:     true,
+										ValidateFunc: validation.StringLenBetween(1, 104),
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+			"security_group_arns": {
+				Type:     schema.TypeSet,
+				Required: true,
+				ForceNew: true,
+				MinItems: 1,
+				MaxItems: 5,
+				Elem: &schema.Schema{
+					Type:         schema.TypeString,
+					ValidateFunc: verify.ValidARN,
+				},
+			},
+			"storage_virtual_machine_arn": {
+				Type:         schema.TypeString,
+				Required:     true,
+				ForceNew:     true,
+				ValidateFunc: verify.ValidARN,
+			},
+			"subdirectory": {
+				Type:         schema.TypeString,
+				Optional:     true,
+				Computed:     true,
+				ForceNew:     true,
+				ValidateFunc: validation.StringLenBetween(1, 4096),
+			},
+			names.AttrTags:    tftags.TagsSchema(),
+			names.AttrTagsAll: tftags.TagsSchemaComputed(),
+			"uri": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+		},
+
+		CustomizeDiff: verify.SetTagsDiff,
+	}
+}
+
+func resourceLocationFSxONTAPFileSystemCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).DataSyncConn(ctx)
+
+	input := &datasync.CreateLocationFsxOntapInput{
+		Protocol:                 expandProtocol(d.Get("protocol").([]interface{})),
+		SecurityGroupArns:        flex.ExpandStringSet(d.Get("security_group_arns").(*schema.Set)),
+		StorageVirtualMachineArn: aws.String(d.Get("storage_virtual_machine_arn").(string)),
+		Tags:                     getTagsIn(ctx),
+	}
+
+	if v, ok := d.GetOk("subdirectory"); ok {
+		input.Subdirectory = aws.String(v.(string))
+	}
+
+	output, err := conn.CreateLocationFsxOntapWithContext(ctx, input)
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "creating DataSync Location FSx for NetApp ONTAP File System: %s", err)
+	}
+
+	d.SetId(aws.StringValue(output.LocationArn))
+
+	return append(diags, resourceLocationFSxONTAPFileSystemRead(ctx, d, meta)...)
+}
+
+func resourceLocationFSxONTAPFileSystemRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).DataSyncConn(ctx)
+
+	output, err := FindLocationFSxONTAPByARN(ctx, conn, d.Id())
+
+	if !d.IsNewResource() && tfresource.NotFound(err) {
+		log.Printf("[WARN] DataSync Location FSx for NetApp ONTAP File System (%s) not found, removing from state", d.Id())
+		d.SetId("")
+		return diags
+	}
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "reading DataSync Location FSx for NetApp ONTAP File System (%s): %s", d.Id(), err)
+	}
+
+	uri := aws.StringValue(output.LocationUri)
+	subdirectory, err := subdirectoryFromLocationURI(uri)
+	if err != nil {
+		return sdkdiag.AppendFromErr(diags, err)
+	}
+
+	d.Set("arn", output.LocationArn)
+	d.Set("creation_time", output.CreationTime.Format(time.RFC3339))
+	d.Set("fsx_filesystem_arn", output.FsxFilesystemArn)
+	// SMB Password is not returned from the API.
+	if output.Protocol != nil && output.Protocol.SMB != nil && aws.StringValue(output.Protocol.SMB.Password) == "" {
+		if smbPassword := d.Get("protocol.0.smb.0.password").(string); smbPassword != "" {
+			output.Protocol.SMB.Password = aws.String(smbPassword)
+		}
+	}
+	if err := d.Set("protocol", flattenProtocol(output.Protocol)); err != nil {
+		return sdkdiag.AppendErrorf(diags, "setting protocol: %s", err)
+	}
+	d.Set("security_group_arns", aws.StringValueSlice(output.SecurityGroupArns))
+	d.Set("storage_virtual_machine_arn", output.StorageVirtualMachineArn)
+	d.Set("subdirectory", subdirectory)
+	d.Set("uri", uri)
+
+	return diags
+}
+
+func resourceLocationFSxONTAPFileSystemUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+
+	// Tags only.
+
+	return append(diags, resourceLocationFSxONTAPFileSystemRead(ctx, d, meta)...)
+}
+
+func resourceLocationFSxONTAPFileSystemDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).DataSyncConn(ctx)
+
+	input := &datasync.DeleteLocationInput{
+		LocationArn: aws.String(d.Id()),
+	}
+
+	log.Printf("[DEBUG] Deleting DataSync Location FSx for NetApp ONTAP File System: %s", d.Id())
+	_, err := conn.DeleteLocationWithContext(ctx, input)
+
+	if tfawserr.ErrMessageContains(err, datasync.ErrCodeInvalidRequestException, "not found") {
+		return diags
+	}
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "deleting DataSync Location FSx for NetApp ONTAP File System (%s): %s", d.Id(), err)
+	}
+
+	return diags
+}
+
+func FindLocationFSxONTAPByARN(ctx context.Context, conn *datasync.DataSync, arn string) (*datasync.DescribeLocationFsxOntapOutput, error) {
+	input := &datasync.DescribeLocationFsxOntapInput{
+		LocationArn: aws.String(arn),
+	}
+
+	output, err := conn.DescribeLocationFsxOntapWithContext(ctx, input)
+
+	if tfawserr.ErrMessageContains(err, datasync.ErrCodeInvalidRequestException, "not found") {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	if output == nil {
+		return nil, tfresource.NewEmptyResultError(input)
+	}
+
+	return output, nil
+}
diff --git a/internal/service/datasync/location_fsx_ontap_file_system_test.go b/internal/service/datasync/location_fsx_ontap_file_system_test.go
new file mode 100644
index 00000000000..2fb8c704294
--- /dev/null
+++ b/internal/service/datasync/location_fsx_ontap_file_system_test.go
@@ -0,0 +1,463 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package datasync_test
+
+import (
+	"context"
+	"fmt"
+	"testing"
+
+	"github.com/YakDriver/regexache"
+	"github.com/aws/aws-sdk-go/service/datasync"
+	"github.com/aws/aws-sdk-go/service/fsx"
+	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
+	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	tfdatasync "github.com/hashicorp/terraform-provider-aws/internal/service/datasync"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+)
+
+func TestAccDataSyncLocationFSxONTAPFileSystem_basic(t *testing.T) {
+	ctx := acctest.Context(t)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	var v datasync.DescribeLocationFsxOntapOutput
+	resourceName := "aws_datasync_location_fsx_ontap_file_system.test"
+	fsResourceName := "aws_fsx_ontap_file_system.test"
+	svmResourceName := "aws_fsx_ontap_storage_virtual_machine.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, fsx.EndpointsID)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, datasync.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckLocationFSxONTAPDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccLocationFSxONTAPFileSystemConfig_basic(rName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckLocationFSxONTAPExists(ctx, resourceName, &v),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "datasync", regexache.MustCompile(`location/loc-.+`)),
+					resource.TestCheckResourceAttrSet(resourceName, "creation_time"),
+					resource.TestCheckResourceAttrPair(resourceName, "fsx_filesystem_arn", fsResourceName, "arn"),
+					resource.TestCheckResourceAttr(resourceName, "protocol.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "protocol.0.nfs.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "protocol.0.nfs.0.mount_options.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "protocol.0.nfs.0.mount_options.0.version", "NFS3"),
+					resource.TestCheckResourceAttr(resourceName, "protocol.0.smb.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "subdirectory", "/"),
+					resource.TestCheckResourceAttrPair(resourceName, "storage_virtual_machine_arn", svmResourceName, "arn"),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
+					resource.TestMatchResourceAttr(resourceName, "uri", regexache.MustCompile(`^fsxn-(nfs|smb)://.+/`)),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+				ImportStateIdFunc: testAccLocationFSxONTAPImportStateID(resourceName),
+			},
+		},
+	})
+}
+
+func TestAccDataSyncLocationFSxONTAPFileSystem_disappears(t *testing.T) {
+	ctx := acctest.Context(t)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	var v datasync.DescribeLocationFsxOntapOutput
+	resourceName := "aws_datasync_location_fsx_ontap_file_system.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, fsx.EndpointsID)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, datasync.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckLocationFSxONTAPDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccLocationFSxONTAPFileSystemConfig_basic(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckLocationFSxONTAPExists(ctx, resourceName, &v),
+					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfdatasync.ResourceLocationFSxONTAPFileSystem(), resourceName),
+				),
+				ExpectNonEmptyPlan: true,
+			},
+		},
+	})
+}
+
+func TestAccDataSyncLocationFSxONTAPFileSystem_smb(t *testing.T) {
+	ctx := acctest.Context(t)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	netBiosName := "tftest-" + sdkacctest.RandString(7)
+	domainNetbiosName := "tftest" + sdkacctest.RandString(4)
+	domainName := domainNetbiosName + ".local"
+	var v datasync.DescribeLocationFsxOntapOutput
+	resourceName := "aws_datasync_location_fsx_ontap_file_system.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, fsx.EndpointsID)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, datasync.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckLocationFSxONTAPDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccLocationFSxONTAPFileSystemConfig_smb(rName, netBiosName, domainNetbiosName, domainName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckLocationFSxONTAPExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "protocol.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "protocol.0.nfs.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "protocol.0.smb.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "protocol.0.smb.0.domain", domainName),
+					resource.TestCheckResourceAttr(resourceName, "protocol.0.smb.0.mount_options.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "protocol.0.smb.0.mount_options.0.version", "SMB3"),
+					resource.TestCheckResourceAttr(resourceName, "protocol.0.smb.0.password", "MyPassw0rd1"),
+					resource.TestCheckResourceAttr(resourceName, "protocol.0.smb.0.user", "Admin"),
+				),
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"protocol.0.smb.0.password"}, // Not returned from API.
+				ImportStateIdFunc:       testAccLocationFSxONTAPImportStateID(resourceName),
+			},
+		},
+	})
+}
+
+func TestAccDataSyncLocationFSxONTAPFileSystem_subdirectory(t *testing.T) {
+	ctx := acctest.Context(t)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	var v datasync.DescribeLocationFsxOntapOutput
+	resourceName := "aws_datasync_location_fsx_ontap_file_system.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, fsx.EndpointsID)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, datasync.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckLocationFSxONTAPDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccLocationFSxONTAPFileSystemConfig_subdirectory(rName, "/subdirectory1/"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckLocationFSxONTAPExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "subdirectory", "/subdirectory1/"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+				ImportStateIdFunc: testAccLocationFSxONTAPImportStateID(resourceName),
+			},
+		},
+	})
+}
+
+func TestAccDataSyncLocationFSxONTAPFileSystem_tags(t *testing.T) {
+	ctx := acctest.Context(t)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	var v datasync.DescribeLocationFsxOntapOutput
+	resourceName := "aws_datasync_location_fsx_ontap_file_system.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, fsx.EndpointsID)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, datasync.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckLocationFSxONTAPDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccLocationFSxONTAPFileSystemConfig_tags1(rName, "key1", "value1"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckLocationFSxONTAPExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+				ImportStateIdFunc: testAccLocationFSxONTAPImportStateID(resourceName),
+			},
+			{
+				Config: testAccLocationFSxONTAPFileSystemConfig_tags2(rName, "key1", "value1updated", "key2", "value2"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckLocationFSxONTAPExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1updated"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
+				),
+			},
+			{
+				Config: testAccLocationFSxONTAPFileSystemConfig_tags1(rName, "key1", "value1"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckLocationFSxONTAPExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckLocationFSxONTAPDestroy(ctx context.Context) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		conn := acctest.Provider.Meta().(*conns.AWSClient).DataSyncConn(ctx)
+
+		for _, rs := range s.RootModule().Resources {
+			if rs.Type != "aws_datasync_location_fsx_ontap_file_system" {
+				continue
+			}
+
+			_, err := tfdatasync.FindLocationFSxONTAPByARN(ctx, conn, rs.Primary.ID)
+
+			if tfresource.NotFound(err) {
+				continue
+			}
+
+			if err != nil {
+				return err
+			}
+
+			return fmt.Errorf("DataSync Location FSx for NetApp ONTAP File System %s still exists", rs.Primary.ID)
+		}
+
+		return nil
+	}
+}
+
+func testAccCheckLocationFSxONTAPExists(ctx context.Context, n string, v *datasync.DescribeLocationFsxOntapOutput) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		conn := acctest.Provider.Meta().(*conns.AWSClient).DataSyncConn(ctx)
+
+		output, err := tfdatasync.FindLocationFSxONTAPByARN(ctx, conn, rs.Primary.ID)
+
+		if err != nil {
+			return err
+		}
+
+		*v = *output
+
+		return nil
+	}
+}
+
+func testAccLocationFSxONTAPImportStateID(n string) resource.ImportStateIdFunc {
+	return func(s *terraform.State) (string, error) {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return "", fmt.Errorf("Not found: %s", n)
+		}
+
+		return fmt.Sprintf("%s#%s", rs.Primary.ID, rs.Primary.Attributes["fsx_filesystem_arn"]), nil
+	}
+}
+
+func testAccFSxOntapFileSystemConfig_base(rName string, nSubnets int, deploymentType string) string {
+	return acctest.ConfigCompose(acctest.ConfigVPCWithSubnets(rName, nSubnets), fmt.Sprintf(`
+resource "aws_security_group" "test" {
+  name   = %[1]q
+  vpc_id = aws_vpc.test.id
+
+  ingress {
+    cidr_blocks = [aws_vpc.test.cidr_block]
+    from_port   = 0
+    protocol    = -1
+    to_port     = 0
+  }
+
+  egress {
+    cidr_blocks = ["0.0.0.0/0"]
+    from_port   = 0
+    protocol    = "-1"
+    to_port     = 0
+  }
+
+  tags = {
+    Name = %[1]q
+  }
+}
+
+resource "aws_fsx_ontap_file_system" "test" {
+  storage_capacity    = 1024
+  subnet_ids          = aws_subnet.test[*].id
+  deployment_type     = %[2]q
+  throughput_capacity = 512
+  preferred_subnet_id = aws_subnet.test[0].id
+
+  tags = {
+    Name = %[1]q
+  }
+}
+`, rName, deploymentType))
+}
+
+func testAccFSxOntapFileSystemConfig_baseNFS(rName string) string {
+	return acctest.ConfigCompose(testAccFSxOntapFileSystemConfig_base(rName, 1, "SINGLE_AZ_1"), fmt.Sprintf(`
+resource "aws_fsx_ontap_storage_virtual_machine" "test" {
+  file_system_id = aws_fsx_ontap_file_system.test.id
+  name           = %[1]q
+}
+`, rName))
+}
+
+func testAccFSxOntapFileSystemConfig_baseSMB(rName, domainName string) string {
+	return acctest.ConfigCompose(testAccFSxOntapFileSystemConfig_base(rName, 2, "MULTI_AZ_1"), fmt.Sprintf(`
+resource "aws_directory_service_directory" "test" {
+  edition  = "Standard"
+  name     = %[1]q
+  password = "MyPassw0rd1"
+  type     = "MicrosoftAD"
+
+  vpc_settings {
+    subnet_ids = aws_subnet.test[*].id
+    vpc_id     = aws_vpc.test.id
+  }
+}
+`, domainName))
+}
+
+func testAccLocationFSxONTAPFileSystemConfig_basic(rName string) string {
+	return acctest.ConfigCompose(testAccFSxOntapFileSystemConfig_baseNFS(rName), `
+resource "aws_datasync_location_fsx_ontap_file_system" "test" {
+  security_group_arns         = [aws_security_group.test.arn]
+  storage_virtual_machine_arn = aws_fsx_ontap_storage_virtual_machine.test.arn
+
+  protocol {
+    nfs {
+      mount_options {
+        version = "NFS3"
+      }
+    }
+  }
+}
+`)
+}
+
+func testAccLocationFSxONTAPFileSystemConfig_smb(rName, netBiosName, domainNetbiosName, domainName string) string {
+	return acctest.ConfigCompose(testAccFSxOntapFileSystemConfig_baseSMB(rName, domainName), fmt.Sprintf(`
+resource "aws_fsx_ontap_storage_virtual_machine" "test" {
+  file_system_id = aws_fsx_ontap_file_system.test.id
+  name           = %[1]q
+  depends_on     = [aws_directory_service_directory.test]
+
+  active_directory_configuration {
+    netbios_name = %[2]q
+    self_managed_active_directory_configuration {
+      dns_ips                                = aws_directory_service_directory.test.dns_ip_addresses
+      domain_name                            = %[3]q
+      password                               = "MyPassw0rd1"
+      username                               = "Admin"
+      organizational_unit_distinguished_name = "OU=computers,OU=%[4]s"
+      file_system_administrators_group       = "Admins"
+    }
+  }
+}
+
+resource "aws_datasync_location_fsx_ontap_file_system" "test" {
+  security_group_arns         = [aws_security_group.test.arn]
+  storage_virtual_machine_arn = aws_fsx_ontap_storage_virtual_machine.test.arn
+
+  protocol {
+    smb {
+      domain = %[3]q
+
+      mount_options {
+        version = "SMB3"
+      }
+
+      password = "MyPassw0rd1"
+      user     = "Admin"
+    }
+  }
+}
+`, rName, netBiosName, domainName, domainNetbiosName))
+}
+
+func testAccLocationFSxONTAPFileSystemConfig_subdirectory(rName, subdirectory string) string {
+	return acctest.ConfigCompose(testAccFSxOntapFileSystemConfig_baseNFS(rName), fmt.Sprintf(`
+resource "aws_datasync_location_fsx_ontap_file_system" "test" {
+  security_group_arns         = [aws_security_group.test.arn]
+  storage_virtual_machine_arn = aws_fsx_ontap_storage_virtual_machine.test.arn
+  subdirectory                = %[1]q
+
+  protocol {
+    nfs {
+      mount_options {
+        version = "NFS3"
+      }
+    }
+  }
+}
+`, subdirectory))
+}
+
+func testAccLocationFSxONTAPFileSystemConfig_tags1(rName, key1, value1 string) string {
+	return acctest.ConfigCompose(testAccFSxOntapFileSystemConfig_baseNFS(rName), fmt.Sprintf(`
+resource "aws_datasync_location_fsx_ontap_file_system" "test" {
+  security_group_arns         = [aws_security_group.test.arn]
+  storage_virtual_machine_arn = aws_fsx_ontap_storage_virtual_machine.test.arn
+
+  tags = {
+    %[1]q = %[2]q
+  }
+
+  protocol {
+    nfs {
+      mount_options {
+        version = "NFS3"
+      }
+    }
+  }
+}
+`, key1, value1))
+}
+
+func testAccLocationFSxONTAPFileSystemConfig_tags2(rName, key1, value1, key2, value2 string) string {
+	return acctest.ConfigCompose(testAccFSxOntapFileSystemConfig_baseNFS(rName), fmt.Sprintf(`
+resource "aws_datasync_location_fsx_ontap_file_system" "test" {
+  security_group_arns         = [aws_security_group.test.arn]
+  storage_virtual_machine_arn = aws_fsx_ontap_storage_virtual_machine.test.arn
+
+  tags = {
+    %[1]q = %[2]q
+    %[3]q = %[4]q
+  }
+
+  protocol {
+    nfs {
+      mount_options {
+        version = "NFS3"
+      }
+    }
+  }
+}
+`, key1, value1, key2, value2))
+}
diff --git a/internal/service/datasync/location_fsx_openzfs_file_system.go b/internal/service/datasync/location_fsx_openzfs_file_system.go
index f3f0017ec05..cb7bf5c2f72 100644
--- a/internal/service/datasync/location_fsx_openzfs_file_system.go
+++ b/internal/service/datasync/location_fsx_openzfs_file_system.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package datasync
 
 import (
@@ -11,6 +14,7 @@ import (
 	"github.com/aws/aws-sdk-go/service/datasync"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
@@ -22,7 +26,7 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
-// @SDKResource("aws_datasync_location_fsx_openzfs_file_system", name="Location OpenZFS File System")
+// @SDKResource("aws_datasync_location_fsx_openzfs_file_system", name="Location FSx for OpenZFS File System")
 // @Tags(identifierAttribute="id")
 func ResourceLocationFSxOpenZFSFileSystem() *schema.Resource {
 	return &schema.Resource{
@@ -30,6 +34,7 @@ func ResourceLocationFSxOpenZFSFileSystem() *schema.Resource {
 		ReadWithoutTimeout:   resourceLocationFSxOpenZFSFileSystemRead,
 		UpdateWithoutTimeout: resourceLocationFSxOpenZFSFileSystemUpdate,
 		DeleteWithoutTimeout: resourceLocationFSxOpenZFSFileSystemDelete,
+
 		Importer: &schema.ResourceImporter{
 			StateContext: func(ctx context.Context, d *schema.ResourceData, meta interface{}) ([]*schema.ResourceData, error) {
 				idParts := strings.Split(d.Id(), "#")
@@ -52,6 +57,10 @@ func ResourceLocationFSxOpenZFSFileSystem() *schema.Resource {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
+			"creation_time": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
 			"fsx_filesystem_arn": {
 				Type:         schema.TypeString,
 				Required:     true,
@@ -119,10 +128,6 @@ func ResourceLocationFSxOpenZFSFileSystem() *schema.Resource {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
-			"creation_time": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
 		},
 
 		CustomizeDiff: verify.SetTagsDiff,
@@ -133,9 +138,8 @@ func resourceLocationFSxOpenZFSFileSystemCreate(ctx context.Context, d *schema.R
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).DataSyncConn(ctx)
 
-	fsxArn := d.Get("fsx_filesystem_arn").(string)
 	input := &datasync.CreateLocationFsxOpenZfsInput{
-		FsxFilesystemArn:  aws.String(fsxArn),
+		FsxFilesystemArn:  aws.String(d.Get("fsx_filesystem_arn").(string)),
 		Protocol:          expandProtocol(d.Get("protocol").([]interface{})),
 		SecurityGroupArns: flex.ExpandStringSet(d.Get("security_group_arns").(*schema.Set)),
 		Tags:              getTagsIn(ctx),
@@ -145,10 +149,10 @@ func resourceLocationFSxOpenZFSFileSystemCreate(ctx context.Context, d *schema.R
 		input.Subdirectory = aws.String(v.(string))
 	}
 
-	log.Printf("[DEBUG] Creating DataSync Location Fsx OpenZfs File System: %#v", input)
 	output, err := conn.CreateLocationFsxOpenZfsWithContext(ctx, input)
+
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "creating DataSync Location Fsx OpenZfs File System: %s", err)
+		return sdkdiag.AppendErrorf(diags, "creating DataSync Location FSx for OpenZFS File System: %s", err)
 	}
 
 	d.SetId(aws.StringValue(output.LocationArn))
@@ -160,39 +164,33 @@ func resourceLocationFSxOpenZFSFileSystemRead(ctx context.Context, d *schema.Res
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).DataSyncConn(ctx)
 
-	output, err := FindFSxOpenZFSLocationByARN(ctx, conn, d.Id())
+	output, err := FindLocationFSxOpenZFSByARN(ctx, conn, d.Id())
 
 	if !d.IsNewResource() && tfresource.NotFound(err) {
-		log.Printf("[WARN] DataSync Location Fsx OpenZfs (%s) not found, removing from state", d.Id())
+		log.Printf("[WARN] DataSync Location FSx for OpenZFS File System (%s) not found, removing from state", d.Id())
 		d.SetId("")
 		return diags
 	}
 
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "reading DataSync Location Fsx OpenZfs (%s): %s", d.Id(), err)
+		return sdkdiag.AppendErrorf(diags, "reading DataSync Location FSx for OpenZFS File System (%s): %s", d.Id(), err)
 	}
 
-	subdirectory, err := subdirectoryFromLocationURI(aws.StringValue(output.LocationUri))
-
+	uri := aws.StringValue(output.LocationUri)
+	subdirectory, err := subdirectoryFromLocationURI(uri)
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "reading DataSync Location Fsx OpenZfs (%s): %s", d.Id(), err)
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
 	d.Set("arn", output.LocationArn)
-	d.Set("subdirectory", subdirectory)
-	d.Set("uri", output.LocationUri)
-
-	if err := d.Set("security_group_arns", flex.FlattenStringSet(output.SecurityGroupArns)); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting security_group_arns: %s", err)
-	}
-
-	if err := d.Set("creation_time", output.CreationTime.Format(time.RFC3339)); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting creation_time: %s", err)
-	}
-
+	d.Set("creation_time", output.CreationTime.Format(time.RFC3339))
+	d.Set("fsx_filesystem_arn", d.Get("fsx_filesystem_arn"))
 	if err := d.Set("protocol", flattenProtocol(output.Protocol)); err != nil {
 		return sdkdiag.AppendErrorf(diags, "setting protocol: %s", err)
 	}
+	d.Set("security_group_arns", aws.StringValueSlice(output.SecurityGroupArns))
+	d.Set("subdirectory", subdirectory)
+	d.Set("uri", uri)
 
 	return diags
 }
@@ -209,72 +207,43 @@ func resourceLocationFSxOpenZFSFileSystemDelete(ctx context.Context, d *schema.R
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).DataSyncConn(ctx)
 
-	input := &datasync.DeleteLocationInput{
+	log.Printf("[DEBUG] Deleting DataSync Location FSx for OpenZFS File System: %s", d.Id())
+	_, err := conn.DeleteLocationWithContext(ctx, &datasync.DeleteLocationInput{
 		LocationArn: aws.String(d.Id()),
-	}
-
-	log.Printf("[DEBUG] Deleting DataSync Location Fsx OpenZfs File System: %#v", input)
-	_, err := conn.DeleteLocationWithContext(ctx, input)
+	})
 
 	if tfawserr.ErrMessageContains(err, datasync.ErrCodeInvalidRequestException, "not found") {
 		return diags
 	}
 
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "deleting DataSync Location Fsx OpenZfs (%s): %s", d.Id(), err)
+		return sdkdiag.AppendErrorf(diags, "deleting DataSync Location FSx for OpenZFS File System (%s): %s", d.Id(), err)
 	}
 
 	return diags
 }
 
-func expandProtocol(l []interface{}) *datasync.FsxProtocol {
-	if len(l) == 0 || l[0] == nil {
-		return nil
-	}
-
-	m := l[0].(map[string]interface{})
-
-	Protocol := &datasync.FsxProtocol{
-		NFS: expandNFS(m["nfs"].([]interface{})),
-	}
-
-	return Protocol
-}
-
-func flattenProtocol(protocol *datasync.FsxProtocol) []interface{} {
-	if protocol == nil {
-		return []interface{}{}
+func FindLocationFSxOpenZFSByARN(ctx context.Context, conn *datasync.DataSync, arn string) (*datasync.DescribeLocationFsxOpenZfsOutput, error) {
+	input := &datasync.DescribeLocationFsxOpenZfsInput{
+		LocationArn: aws.String(arn),
 	}
 
-	m := map[string]interface{}{
-		"nfs": flattenNFS(protocol.NFS),
-	}
+	output, err := conn.DescribeLocationFsxOpenZfsWithContext(ctx, input)
 
-	return []interface{}{m}
-}
-
-func expandNFS(l []interface{}) *datasync.FsxProtocolNfs {
-	if len(l) == 0 || l[0] == nil {
-		return nil
-	}
-
-	m := l[0].(map[string]interface{})
-
-	Protocol := &datasync.FsxProtocolNfs{
-		MountOptions: expandNFSMountOptions(m["mount_options"].([]interface{})),
+	if tfawserr.ErrMessageContains(err, datasync.ErrCodeInvalidRequestException, "not found") {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
 	}
 
-	return Protocol
-}
-
-func flattenNFS(nfs *datasync.FsxProtocolNfs) []interface{} {
-	if nfs == nil {
-		return []interface{}{}
+	if err != nil {
+		return nil, err
 	}
 
-	m := map[string]interface{}{
-		"mount_options": flattenNFSMountOptions(nfs.MountOptions),
+	if output == nil {
+		return nil, tfresource.NewEmptyResultError(input)
 	}
 
-	return []interface{}{m}
+	return output, nil
 }
diff --git a/internal/service/datasync/location_fsx_openzfs_file_system_test.go b/internal/service/datasync/location_fsx_openzfs_file_system_test.go
index 97732215da0..6ae6e7dccd2 100644
--- a/internal/service/datasync/location_fsx_openzfs_file_system_test.go
+++ b/internal/service/datasync/location_fsx_openzfs_file_system_test.go
@@ -1,13 +1,17 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package datasync_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/datasync"
 	"github.com/aws/aws-sdk-go/service/fsx"
+	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
@@ -18,7 +22,8 @@ import (
 
 func TestAccDataSyncLocationFSxOpenZFSFileSystem_basic(t *testing.T) {
 	ctx := acctest.Context(t)
-	var locationFsxOpenZfs1 datasync.DescribeLocationFsxOpenZfsOutput
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	var v datasync.DescribeLocationFsxOpenZfsOutput
 	resourceName := "aws_datasync_location_fsx_openzfs_file_system.test"
 	fsResourceName := "aws_fsx_openzfs_file_system.test"
 
@@ -33,15 +38,15 @@ func TestAccDataSyncLocationFSxOpenZFSFileSystem_basic(t *testing.T) {
 		CheckDestroy:             testAccCheckLocationFSxOpenZFSDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccLocationFSxOpenZFSFileSystemConfig_basic(),
+				Config: testAccLocationFSxOpenZFSFileSystemConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckLocationFSxOpenZFSExists(ctx, resourceName, &locationFsxOpenZfs1),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "datasync", regexp.MustCompile(`location/loc-.+`)),
+					testAccCheckLocationFSxOpenZFSExists(ctx, resourceName, &v),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "datasync", regexache.MustCompile(`location/loc-.+`)),
+					resource.TestCheckResourceAttrSet(resourceName, "creation_time"),
 					resource.TestCheckResourceAttrPair(resourceName, "fsx_filesystem_arn", fsResourceName, "arn"),
 					resource.TestCheckResourceAttr(resourceName, "subdirectory", "/fsx/"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
-					resource.TestMatchResourceAttr(resourceName, "uri", regexp.MustCompile(`^fsxz://.+/`)),
-					resource.TestCheckResourceAttrSet(resourceName, "creation_time"),
+					resource.TestMatchResourceAttr(resourceName, "uri", regexache.MustCompile(`^fsxz://.+/`)),
 				),
 			},
 			{
@@ -56,7 +61,8 @@ func TestAccDataSyncLocationFSxOpenZFSFileSystem_basic(t *testing.T) {
 
 func TestAccDataSyncLocationFSxOpenZFSFileSystem_disappears(t *testing.T) {
 	ctx := acctest.Context(t)
-	var locationFsxOpenZfs1 datasync.DescribeLocationFsxOpenZfsOutput
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	var v datasync.DescribeLocationFsxOpenZfsOutput
 	resourceName := "aws_datasync_location_fsx_openzfs_file_system.test"
 
 	resource.ParallelTest(t, resource.TestCase{
@@ -70,10 +76,9 @@ func TestAccDataSyncLocationFSxOpenZFSFileSystem_disappears(t *testing.T) {
 		CheckDestroy:             testAccCheckLocationFSxOpenZFSDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccLocationFSxOpenZFSFileSystemConfig_basic(),
+				Config: testAccLocationFSxOpenZFSFileSystemConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckLocationFSxOpenZFSExists(ctx, resourceName, &locationFsxOpenZfs1),
-					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfdatasync.ResourceLocationFSxOpenZFSFileSystem(), resourceName),
+					testAccCheckLocationFSxOpenZFSExists(ctx, resourceName, &v),
 					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfdatasync.ResourceLocationFSxOpenZFSFileSystem(), resourceName),
 				),
 				ExpectNonEmptyPlan: true,
@@ -84,7 +89,8 @@ func TestAccDataSyncLocationFSxOpenZFSFileSystem_disappears(t *testing.T) {
 
 func TestAccDataSyncLocationFSxOpenZFSFileSystem_subdirectory(t *testing.T) {
 	ctx := acctest.Context(t)
-	var locationFsxOpenZfs1 datasync.DescribeLocationFsxOpenZfsOutput
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	var v datasync.DescribeLocationFsxOpenZfsOutput
 	resourceName := "aws_datasync_location_fsx_openzfs_file_system.test"
 
 	resource.ParallelTest(t, resource.TestCase{
@@ -98,9 +104,9 @@ func TestAccDataSyncLocationFSxOpenZFSFileSystem_subdirectory(t *testing.T) {
 		CheckDestroy:             testAccCheckLocationFSxOpenZFSDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccLocationFSxOpenZFSFileSystemConfig_subdirectory("/fsx/subdirectory1/"),
+				Config: testAccLocationFSxOpenZFSFileSystemConfig_subdirectory(rName, "/fsx/subdirectory1/"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckLocationFSxOpenZFSExists(ctx, resourceName, &locationFsxOpenZfs1),
+					testAccCheckLocationFSxOpenZFSExists(ctx, resourceName, &v),
 					resource.TestCheckResourceAttr(resourceName, "subdirectory", "/fsx/subdirectory1/"),
 				),
 			},
@@ -116,7 +122,8 @@ func TestAccDataSyncLocationFSxOpenZFSFileSystem_subdirectory(t *testing.T) {
 
 func TestAccDataSyncLocationFSxOpenZFSFileSystem_tags(t *testing.T) {
 	ctx := acctest.Context(t)
-	var locationFsxOpenZfs1 datasync.DescribeLocationFsxOpenZfsOutput
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	var v datasync.DescribeLocationFsxOpenZfsOutput
 	resourceName := "aws_datasync_location_fsx_openzfs_file_system.test"
 
 	resource.ParallelTest(t, resource.TestCase{
@@ -130,9 +137,9 @@ func TestAccDataSyncLocationFSxOpenZFSFileSystem_tags(t *testing.T) {
 		CheckDestroy:             testAccCheckLocationFSxOpenZFSDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccLocationFSxOpenZFSFileSystemConfig_tags1("key1", "value1"),
+				Config: testAccLocationFSxOpenZFSFileSystemConfig_tags1(rName, "key1", "value1"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckLocationFSxOpenZFSExists(ctx, resourceName, &locationFsxOpenZfs1),
+					testAccCheckLocationFSxOpenZFSExists(ctx, resourceName, &v),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
 				),
@@ -144,18 +151,18 @@ func TestAccDataSyncLocationFSxOpenZFSFileSystem_tags(t *testing.T) {
 				ImportStateIdFunc: testAccLocationFSxOpenZFSImportStateID(resourceName),
 			},
 			{
-				Config: testAccLocationFSxOpenZFSFileSystemConfig_tags2("key1", "value1updated", "key2", "value2"),
+				Config: testAccLocationFSxOpenZFSFileSystemConfig_tags2(rName, "key1", "value1updated", "key2", "value2"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckLocationFSxOpenZFSExists(ctx, resourceName, &locationFsxOpenZfs1),
+					testAccCheckLocationFSxOpenZFSExists(ctx, resourceName, &v),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1updated"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
 				),
 			},
 			{
-				Config: testAccLocationFSxOpenZFSFileSystemConfig_tags1("key1", "value1"),
+				Config: testAccLocationFSxOpenZFSFileSystemConfig_tags1(rName, "key1", "value1"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckLocationFSxOpenZFSExists(ctx, resourceName, &locationFsxOpenZfs1),
+					testAccCheckLocationFSxOpenZFSExists(ctx, resourceName, &v),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
 				),
@@ -173,7 +180,7 @@ func testAccCheckLocationFSxOpenZFSDestroy(ctx context.Context) resource.TestChe
 				continue
 			}
 
-			_, err := tfdatasync.FindFSxOpenZFSLocationByARN(ctx, conn, rs.Primary.ID)
+			_, err := tfdatasync.FindLocationFSxOpenZFSByARN(ctx, conn, rs.Primary.ID)
 
 			if tfresource.NotFound(err) {
 				continue
@@ -183,32 +190,29 @@ func testAccCheckLocationFSxOpenZFSDestroy(ctx context.Context) resource.TestChe
 				return err
 			}
 
-			return fmt.Errorf("DataSync Task %s still exists", rs.Primary.ID)
+			return fmt.Errorf("DataSync Location FSx for OpenZFS File System %s still exists", rs.Primary.ID)
 		}
 
 		return nil
 	}
 }
 
-func testAccCheckLocationFSxOpenZFSExists(ctx context.Context, resourceName string, locationFsxOpenZfs *datasync.DescribeLocationFsxOpenZfsOutput) resource.TestCheckFunc {
+func testAccCheckLocationFSxOpenZFSExists(ctx context.Context, n string, v *datasync.DescribeLocationFsxOpenZfsOutput) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		rs, ok := s.RootModule().Resources[resourceName]
+		rs, ok := s.RootModule().Resources[n]
 		if !ok {
-			return fmt.Errorf("Not found: %s", resourceName)
+			return fmt.Errorf("Not found: %s", n)
 		}
 
 		conn := acctest.Provider.Meta().(*conns.AWSClient).DataSyncConn(ctx)
-		output, err := tfdatasync.FindFSxOpenZFSLocationByARN(ctx, conn, rs.Primary.ID)
+
+		output, err := tfdatasync.FindLocationFSxOpenZFSByARN(ctx, conn, rs.Primary.ID)
 
 		if err != nil {
 			return err
 		}
 
-		if output == nil {
-			return fmt.Errorf("Location %q does not exist", rs.Primary.ID)
-		}
-
-		*locationFsxOpenZfs = *output
+		*v = *output
 
 		return nil
 	}
@@ -225,8 +229,46 @@ func testAccLocationFSxOpenZFSImportStateID(resourceName string) resource.Import
 	}
 }
 
-func testAccLocationFSxOpenZFSFileSystemConfig_basic() string {
-	return acctest.ConfigCompose(testAccFSxOpenZfsFileSystemBaseConfig(), `
+func testAccFSxOpenZfsFileSystemConfig_base(rName string) string {
+	return acctest.ConfigCompose(acctest.ConfigVPCWithSubnets(rName, 1), fmt.Sprintf(`
+resource "aws_security_group" "test" {
+  name   = %[1]q
+  vpc_id = aws_vpc.test.id
+
+  ingress {
+    cidr_blocks = [aws_vpc.test.cidr_block]
+    from_port   = 0
+    protocol    = -1
+    to_port     = 0
+  }
+
+  egress {
+    cidr_blocks = ["0.0.0.0/0"]
+    from_port   = 0
+    protocol    = "-1"
+    to_port     = 0
+  }
+
+  tags = {
+    Name = %[1]q
+  }
+}
+
+resource "aws_fsx_openzfs_file_system" "test" {
+  storage_capacity    = 64
+  subnet_ids          = aws_subnet.test[*].id
+  deployment_type     = "SINGLE_AZ_1"
+  throughput_capacity = 64
+
+  tags = {
+    Name = %[1]q
+  }
+}
+`, rName))
+}
+
+func testAccLocationFSxOpenZFSFileSystemConfig_basic(rName string) string {
+	return acctest.ConfigCompose(testAccFSxOpenZfsFileSystemConfig_base(rName), `
 resource "aws_datasync_location_fsx_openzfs_file_system" "test" {
   fsx_filesystem_arn  = aws_fsx_openzfs_file_system.test.arn
   security_group_arns = [aws_security_group.test.arn]
@@ -242,8 +284,8 @@ resource "aws_datasync_location_fsx_openzfs_file_system" "test" {
 `)
 }
 
-func testAccLocationFSxOpenZFSFileSystemConfig_subdirectory(subdirectory string) string {
-	return acctest.ConfigCompose(testAccFSxOpenZfsFileSystemBaseConfig(), fmt.Sprintf(`
+func testAccLocationFSxOpenZFSFileSystemConfig_subdirectory(rName, subdirectory string) string {
+	return acctest.ConfigCompose(testAccFSxOpenZfsFileSystemConfig_base(rName), fmt.Sprintf(`
 resource "aws_datasync_location_fsx_openzfs_file_system" "test" {
   fsx_filesystem_arn  = aws_fsx_openzfs_file_system.test.arn
   security_group_arns = [aws_security_group.test.arn]
@@ -260,8 +302,8 @@ resource "aws_datasync_location_fsx_openzfs_file_system" "test" {
 `, subdirectory))
 }
 
-func testAccLocationFSxOpenZFSFileSystemConfig_tags1(key1, value1 string) string {
-	return acctest.ConfigCompose(testAccFSxOpenZfsFileSystemBaseConfig(), fmt.Sprintf(`
+func testAccLocationFSxOpenZFSFileSystemConfig_tags1(rName, key1, value1 string) string {
+	return acctest.ConfigCompose(testAccFSxOpenZfsFileSystemConfig_base(rName), fmt.Sprintf(`
 resource "aws_datasync_location_fsx_openzfs_file_system" "test" {
   fsx_filesystem_arn  = aws_fsx_openzfs_file_system.test.arn
   security_group_arns = [aws_security_group.test.arn]
@@ -281,8 +323,8 @@ resource "aws_datasync_location_fsx_openzfs_file_system" "test" {
 `, key1, value1))
 }
 
-func testAccLocationFSxOpenZFSFileSystemConfig_tags2(key1, value1, key2, value2 string) string {
-	return acctest.ConfigCompose(testAccFSxOpenZfsFileSystemBaseConfig(), fmt.Sprintf(`
+func testAccLocationFSxOpenZFSFileSystemConfig_tags2(rName, key1, value1, key2, value2 string) string {
+	return acctest.ConfigCompose(testAccFSxOpenZfsFileSystemConfig_base(rName), fmt.Sprintf(`
 resource "aws_datasync_location_fsx_openzfs_file_system" "test" {
   fsx_filesystem_arn  = aws_fsx_openzfs_file_system.test.arn
   security_group_arns = [aws_security_group.test.arn]
@@ -302,45 +344,3 @@ resource "aws_datasync_location_fsx_openzfs_file_system" "test" {
 }
 `, key1, value1, key2, value2))
 }
-
-func testAccFSxOpenZfsFileSystemBaseConfig() string {
-	return acctest.ConfigCompose(acctest.ConfigAvailableAZsNoOptIn(), `
-data "aws_partition" "current" {}
-
-resource "aws_vpc" "test" {
-  cidr_block = "10.0.0.0/16"
-}
-
-resource "aws_subnet" "test" {
-  vpc_id            = aws_vpc.test.id
-  cidr_block        = "10.0.1.0/24"
-  availability_zone = data.aws_availability_zones.available.names[0]
-}
-
-resource "aws_security_group" "test" {
-  description = "security group for FSx testing"
-  vpc_id      = aws_vpc.test.id
-
-  ingress {
-    cidr_blocks = [aws_vpc.test.cidr_block]
-    from_port   = 0
-    protocol    = -1
-    to_port     = 0
-  }
-
-  egress {
-    cidr_blocks = ["0.0.0.0/0"]
-    from_port   = 0
-    protocol    = "-1"
-    to_port     = 0
-  }
-}
-
-resource "aws_fsx_openzfs_file_system" "test" {
-  storage_capacity    = 64
-  subnet_ids          = [aws_subnet.test.id]
-  deployment_type     = "SINGLE_AZ_1"
-  throughput_capacity = 64
-}
-`)
-}
diff --git a/internal/service/datasync/location_fsx_windows_file_system.go b/internal/service/datasync/location_fsx_windows_file_system.go
index 87e0cc2ced1..a59e8033ba3 100644
--- a/internal/service/datasync/location_fsx_windows_file_system.go
+++ b/internal/service/datasync/location_fsx_windows_file_system.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package datasync
 
 import (
@@ -11,17 +14,19 @@ import (
 	"github.com/aws/aws-sdk-go/service/datasync"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
 	"github.com/hashicorp/terraform-provider-aws/internal/flex"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
-// @SDKResource("aws_datasync_location_fsx_windows_file_system", name="Location FSx Windows File System")
+// @SDKResource("aws_datasync_location_fsx_windows_file_system", name="Location FSx for Windows File Server File System")
 // @Tags(identifierAttribute="id")
 func ResourceLocationFSxWindowsFileSystem() *schema.Resource {
 	return &schema.Resource{
@@ -29,6 +34,7 @@ func ResourceLocationFSxWindowsFileSystem() *schema.Resource {
 		ReadWithoutTimeout:   resourceLocationFSxWindowsFileSystemRead,
 		UpdateWithoutTimeout: resourceLocationFSxWindowsFileSystemUpdate,
 		DeleteWithoutTimeout: resourceLocationFSxWindowsFileSystemDelete,
+
 		Importer: &schema.ResourceImporter{
 			StateContext: func(ctx context.Context, d *schema.ResourceData, meta interface{}) ([]*schema.ResourceData, error) {
 				idParts := strings.Split(d.Id(), "#")
@@ -51,6 +57,16 @@ func ResourceLocationFSxWindowsFileSystem() *schema.Resource {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
+			"creation_time": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"domain": {
+				Type:         schema.TypeString,
+				Optional:     true,
+				ForceNew:     true,
+				ValidateFunc: validation.StringLenBetween(1, 253),
+			},
 			"fsx_filesystem_arn": {
 				Type:         schema.TypeString,
 				Required:     true,
@@ -64,18 +80,6 @@ func ResourceLocationFSxWindowsFileSystem() *schema.Resource {
 				Sensitive:    true,
 				ValidateFunc: validation.StringLenBetween(1, 104),
 			},
-			"user": {
-				Type:         schema.TypeString,
-				Required:     true,
-				ForceNew:     true,
-				ValidateFunc: validation.StringLenBetween(1, 104),
-			},
-			"domain": {
-				Type:         schema.TypeString,
-				Optional:     true,
-				ForceNew:     true,
-				ValidateFunc: validation.StringLenBetween(1, 253),
-			},
 			"security_group_arns": {
 				Type:     schema.TypeSet,
 				Required: true,
@@ -100,9 +104,11 @@ func ResourceLocationFSxWindowsFileSystem() *schema.Resource {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
-			"creation_time": {
-				Type:     schema.TypeString,
-				Computed: true,
+			"user": {
+				Type:         schema.TypeString,
+				Required:     true,
+				ForceNew:     true,
+				ValidateFunc: validation.StringLenBetween(1, 104),
 			},
 		},
 
@@ -114,26 +120,26 @@ func resourceLocationFSxWindowsFileSystemCreate(ctx context.Context, d *schema.R
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).DataSyncConn(ctx)
 
-	fsxArn := d.Get("fsx_filesystem_arn").(string)
 	input := &datasync.CreateLocationFsxWindowsInput{
-		FsxFilesystemArn:  aws.String(fsxArn),
-		User:              aws.String(d.Get("user").(string)),
+		FsxFilesystemArn:  aws.String(d.Get("fsx_filesystem_arn").(string)),
 		Password:          aws.String(d.Get("password").(string)),
 		SecurityGroupArns: flex.ExpandStringSet(d.Get("security_group_arns").(*schema.Set)),
 		Tags:              getTagsIn(ctx),
-	}
-
-	if v, ok := d.GetOk("subdirectory"); ok {
-		input.Subdirectory = aws.String(v.(string))
+		User:              aws.String(d.Get("user").(string)),
 	}
 
 	if v, ok := d.GetOk("domain"); ok {
 		input.Domain = aws.String(v.(string))
 	}
 
+	if v, ok := d.GetOk("subdirectory"); ok {
+		input.Subdirectory = aws.String(v.(string))
+	}
+
 	output, err := conn.CreateLocationFsxWindowsWithContext(ctx, input)
+
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "creating DataSync Location Fsx Windows File System: %s", err)
+		return sdkdiag.AppendErrorf(diags, "creating DataSync Location FSx for Windows File Server File System: %s", err)
 	}
 
 	d.SetId(aws.StringValue(output.LocationArn))
@@ -145,42 +151,32 @@ func resourceLocationFSxWindowsFileSystemRead(ctx context.Context, d *schema.Res
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).DataSyncConn(ctx)
 
-	input := &datasync.DescribeLocationFsxWindowsInput{
-		LocationArn: aws.String(d.Id()),
-	}
-
-	log.Printf("[DEBUG] Reading DataSync Location Fsx Windows: %#v", input)
-	output, err := conn.DescribeLocationFsxWindowsWithContext(ctx, input)
+	output, err := FindLocationFSxWindowsByARN(ctx, conn, d.Id())
 
-	if tfawserr.ErrMessageContains(err, datasync.ErrCodeInvalidRequestException, "not found") {
-		log.Printf("[WARN] DataSync Location Fsx Windows %q not found - removing from state", d.Id())
+	if !d.IsNewResource() && tfresource.NotFound(err) {
+		log.Printf("[WARN] DataSync Location FSx for Windows File Server File System (%s) not found, removing from state", d.Id())
 		d.SetId("")
 		return diags
 	}
 
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "reading DataSync Location Fsx Windows (%s): %s", d.Id(), err)
+		return sdkdiag.AppendErrorf(diags, "reading DataSync Location FSx for Windows File Server File System (%s): %s", d.Id(), err)
 	}
 
-	subdirectory, err := subdirectoryFromLocationURI(aws.StringValue(output.LocationUri))
-
+	uri := aws.StringValue(output.LocationUri)
+	subdirectory, err := subdirectoryFromLocationURI(uri)
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "reading DataSync Location Fsx Windows (%s): %s", d.Id(), err)
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
 	d.Set("arn", output.LocationArn)
+	d.Set("creation_time", output.CreationTime.Format(time.RFC3339))
+	d.Set("domain", output.Domain)
+	d.Set("fsx_filesystem_arn", d.Get("fsx_filesystem_arn"))
+	d.Set("security_group_arns", aws.StringValueSlice(output.SecurityGroupArns))
 	d.Set("subdirectory", subdirectory)
-	d.Set("uri", output.LocationUri)
+	d.Set("uri", uri)
 	d.Set("user", output.User)
-	d.Set("domain", output.Domain)
-
-	if err := d.Set("security_group_arns", flex.FlattenStringSet(output.SecurityGroupArns)); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting security_group_arns: %s", err)
-	}
-
-	if err := d.Set("creation_time", output.CreationTime.Format(time.RFC3339)); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting creation_time: %s", err)
-	}
 
 	return diags
 }
@@ -197,20 +193,43 @@ func resourceLocationFSxWindowsFileSystemDelete(ctx context.Context, d *schema.R
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).DataSyncConn(ctx)
 
-	input := &datasync.DeleteLocationInput{
+	log.Printf("[DEBUG] Deleting DataSync Location FSx for Windows File Server File System: %s", d.Id())
+	_, err := conn.DeleteLocationWithContext(ctx, &datasync.DeleteLocationInput{
 		LocationArn: aws.String(d.Id()),
-	}
-
-	log.Printf("[DEBUG] Deleting DataSync Location Fsx Windows File System: %#v", input)
-	_, err := conn.DeleteLocationWithContext(ctx, input)
+	})
 
 	if tfawserr.ErrMessageContains(err, datasync.ErrCodeInvalidRequestException, "not found") {
 		return diags
 	}
 
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "deleting DataSync Location Fsx Windows (%s): %s", d.Id(), err)
+		return sdkdiag.AppendErrorf(diags, "deleting DataSync Location FSx for Windows File Server File System (%s): %s", d.Id(), err)
 	}
 
 	return diags
 }
+
+func FindLocationFSxWindowsByARN(ctx context.Context, conn *datasync.DataSync, arn string) (*datasync.DescribeLocationFsxWindowsOutput, error) {
+	input := &datasync.DescribeLocationFsxWindowsInput{
+		LocationArn: aws.String(arn),
+	}
+
+	output, err := conn.DescribeLocationFsxWindowsWithContext(ctx, input)
+
+	if tfawserr.ErrMessageContains(err, datasync.ErrCodeInvalidRequestException, "not found") {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	if output == nil {
+		return nil, tfresource.NewEmptyResultError(input)
+	}
+
+	return output, nil
+}
diff --git a/internal/service/datasync/location_fsx_windows_file_system_test.go b/internal/service/datasync/location_fsx_windows_file_system_test.go
index 62b19e625b4..dd6eae48978 100644
--- a/internal/service/datasync/location_fsx_windows_file_system_test.go
+++ b/internal/service/datasync/location_fsx_windows_file_system_test.go
@@ -1,26 +1,28 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package datasync_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/aws"
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/datasync"
 	"github.com/aws/aws-sdk-go/service/fsx"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	tfdatasync "github.com/hashicorp/terraform-provider-aws/internal/service/datasync"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
 func TestAccDataSyncLocationFSxWindowsFileSystem_basic(t *testing.T) {
 	ctx := acctest.Context(t)
-	var locationFsxWindows1 datasync.DescribeLocationFsxWindowsOutput
+	var v datasync.DescribeLocationFsxWindowsOutput
 	resourceName := "aws_datasync_location_fsx_windows_file_system.test"
 	fsResourceName := "aws_fsx_windows_file_system.test"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
@@ -39,12 +41,12 @@ func TestAccDataSyncLocationFSxWindowsFileSystem_basic(t *testing.T) {
 			{
 				Config: testAccLocationFSxWindowsFileSystemConfig_basic(rName, domainName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckLocationFSxWindowsExists(ctx, resourceName, &locationFsxWindows1),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "datasync", regexp.MustCompile(`location/loc-.+`)),
+					testAccCheckLocationFSxWindowsExists(ctx, resourceName, &v),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "datasync", regexache.MustCompile(`location/loc-.+`)),
 					resource.TestCheckResourceAttrPair(resourceName, "fsx_filesystem_arn", fsResourceName, "arn"),
 					resource.TestCheckResourceAttr(resourceName, "subdirectory", "/"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
-					resource.TestMatchResourceAttr(resourceName, "uri", regexp.MustCompile(`^fsxw://.+/`)),
+					resource.TestMatchResourceAttr(resourceName, "uri", regexache.MustCompile(`^fsxw://.+/`)),
 					resource.TestCheckResourceAttrSet(resourceName, "creation_time"),
 				),
 			},
@@ -61,7 +63,7 @@ func TestAccDataSyncLocationFSxWindowsFileSystem_basic(t *testing.T) {
 
 func TestAccDataSyncLocationFSxWindowsFileSystem_disappears(t *testing.T) {
 	ctx := acctest.Context(t)
-	var locationFsxWindows1 datasync.DescribeLocationFsxWindowsOutput
+	var v datasync.DescribeLocationFsxWindowsOutput
 	resourceName := "aws_datasync_location_fsx_windows_file_system.test"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	domainName := acctest.RandomDomainName()
@@ -79,7 +81,7 @@ func TestAccDataSyncLocationFSxWindowsFileSystem_disappears(t *testing.T) {
 			{
 				Config: testAccLocationFSxWindowsFileSystemConfig_basic(rName, domainName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckLocationFSxWindowsExists(ctx, resourceName, &locationFsxWindows1),
+					testAccCheckLocationFSxWindowsExists(ctx, resourceName, &v),
 					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfdatasync.ResourceLocationFSxWindowsFileSystem(), resourceName),
 				),
 				ExpectNonEmptyPlan: true,
@@ -90,7 +92,7 @@ func TestAccDataSyncLocationFSxWindowsFileSystem_disappears(t *testing.T) {
 
 func TestAccDataSyncLocationFSxWindowsFileSystem_subdirectory(t *testing.T) {
 	ctx := acctest.Context(t)
-	var locationFsxWindows1 datasync.DescribeLocationFsxWindowsOutput
+	var v datasync.DescribeLocationFsxWindowsOutput
 	resourceName := "aws_datasync_location_fsx_windows_file_system.test"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	domainName := acctest.RandomDomainName()
@@ -108,7 +110,7 @@ func TestAccDataSyncLocationFSxWindowsFileSystem_subdirectory(t *testing.T) {
 			{
 				Config: testAccLocationFSxWindowsFileSystemConfig_subdirectory(rName, domainName, "/subdirectory1/"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckLocationFSxWindowsExists(ctx, resourceName, &locationFsxWindows1),
+					testAccCheckLocationFSxWindowsExists(ctx, resourceName, &v),
 					resource.TestCheckResourceAttr(resourceName, "subdirectory", "/subdirectory1/"),
 				),
 			},
@@ -125,7 +127,7 @@ func TestAccDataSyncLocationFSxWindowsFileSystem_subdirectory(t *testing.T) {
 
 func TestAccDataSyncLocationFSxWindowsFileSystem_tags(t *testing.T) {
 	ctx := acctest.Context(t)
-	var locationFsxWindows1 datasync.DescribeLocationFsxWindowsOutput
+	var v datasync.DescribeLocationFsxWindowsOutput
 	resourceName := "aws_datasync_location_fsx_windows_file_system.test"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	domainName := acctest.RandomDomainName()
@@ -143,7 +145,7 @@ func TestAccDataSyncLocationFSxWindowsFileSystem_tags(t *testing.T) {
 			{
 				Config: testAccLocationFSxWindowsFileSystemConfig_tags1(rName, domainName, "key1", "value1"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckLocationFSxWindowsExists(ctx, resourceName, &locationFsxWindows1),
+					testAccCheckLocationFSxWindowsExists(ctx, resourceName, &v),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
 				),
@@ -158,7 +160,7 @@ func TestAccDataSyncLocationFSxWindowsFileSystem_tags(t *testing.T) {
 			{
 				Config: testAccLocationFSxWindowsFileSystemConfig_tags2(rName, domainName, "key1", "value1updated", "key2", "value2"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckLocationFSxWindowsExists(ctx, resourceName, &locationFsxWindows1),
+					testAccCheckLocationFSxWindowsExists(ctx, resourceName, &v),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1updated"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
@@ -167,7 +169,7 @@ func TestAccDataSyncLocationFSxWindowsFileSystem_tags(t *testing.T) {
 			{
 				Config: testAccLocationFSxWindowsFileSystemConfig_tags1(rName, domainName, "key1", "value1"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckLocationFSxWindowsExists(ctx, resourceName, &locationFsxWindows1),
+					testAccCheckLocationFSxWindowsExists(ctx, resourceName, &v),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
 				),
@@ -185,48 +187,39 @@ func testAccCheckLocationFSxWindowsDestroy(ctx context.Context) resource.TestChe
 				continue
 			}
 
-			input := &datasync.DescribeLocationFsxWindowsInput{
-				LocationArn: aws.String(rs.Primary.ID),
-			}
-
-			_, err := conn.DescribeLocationFsxWindowsWithContext(ctx, input)
+			_, err := tfdatasync.FindLocationFSxWindowsByARN(ctx, conn, rs.Primary.ID)
 
-			if tfawserr.ErrMessageContains(err, datasync.ErrCodeInvalidRequestException, "not found") {
-				return nil
+			if tfresource.NotFound(err) {
+				continue
 			}
 
 			if err != nil {
 				return err
 			}
+
+			return fmt.Errorf("DataSync Location FSx for Windows File Server File System %s still exists", rs.Primary.ID)
 		}
 
 		return nil
 	}
 }
 
-func testAccCheckLocationFSxWindowsExists(ctx context.Context, resourceName string, locationFsxWindows *datasync.DescribeLocationFsxWindowsOutput) resource.TestCheckFunc {
+func testAccCheckLocationFSxWindowsExists(ctx context.Context, n string, v *datasync.DescribeLocationFsxWindowsOutput) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		rs, ok := s.RootModule().Resources[resourceName]
+		rs, ok := s.RootModule().Resources[n]
 		if !ok {
-			return fmt.Errorf("Not found: %s", resourceName)
+			return fmt.Errorf("Not found: %s", n)
 		}
 
 		conn := acctest.Provider.Meta().(*conns.AWSClient).DataSyncConn(ctx)
-		input := &datasync.DescribeLocationFsxWindowsInput{
-			LocationArn: aws.String(rs.Primary.ID),
-		}
 
-		output, err := conn.DescribeLocationFsxWindowsWithContext(ctx, input)
+		output, err := tfdatasync.FindLocationFSxWindowsByARN(ctx, conn, rs.Primary.ID)
 
 		if err != nil {
 			return err
 		}
 
-		if output == nil {
-			return fmt.Errorf("Location %q does not exist", rs.Primary.ID)
-		}
-
-		*locationFsxWindows = *output
+		*v = *output
 
 		return nil
 	}
@@ -262,8 +255,8 @@ resource "aws_directory_service_directory" "test" {
 func testAccLocationFSxWindowsFileSystemConfig_baseFS(rName, domain string) string {
 	return acctest.ConfigCompose(testAccLocationFSxWindowsFileSystemConfig_base(rName, domain), fmt.Sprintf(`
 resource "aws_security_group" "test" {
-  description = %[1]q
-  vpc_id      = aws_vpc.test.id
+  name   = %[1]q
+  vpc_id = aws_vpc.test.id
 
   ingress {
     cidr_blocks = [aws_vpc.test.cidr_block]
diff --git a/internal/service/datasync/location_hdfs.go b/internal/service/datasync/location_hdfs.go
index 55b1415325e..9cd22982f18 100644
--- a/internal/service/datasync/location_hdfs.go
+++ b/internal/service/datasync/location_hdfs.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package datasync
 
 import (
@@ -9,6 +12,7 @@ import (
 	"github.com/aws/aws-sdk-go/service/datasync"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
@@ -28,15 +32,12 @@ func ResourceLocationHDFS() *schema.Resource {
 		ReadWithoutTimeout:   resourceLocationHDFSRead,
 		UpdateWithoutTimeout: resourceLocationHDFSUpdate,
 		DeleteWithoutTimeout: resourceLocationHDFSDelete,
+
 		Importer: &schema.ResourceImporter{
 			StateContext: schema.ImportStatePassthroughContext,
 		},
 
 		Schema: map[string]*schema.Schema{
-			"arn": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
 			"agent_arns": {
 				Type:     schema.TypeSet,
 				Required: true,
@@ -45,11 +46,24 @@ func ResourceLocationHDFS() *schema.Resource {
 					ValidateFunc: verify.ValidARN,
 				},
 			},
+			"arn": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
 			"authentication_type": {
 				Type:         schema.TypeString,
 				Optional:     true,
 				ValidateFunc: validation.StringInSlice(datasync.HdfsAuthenticationType_Values(), false),
 			},
+			"block_size": {
+				Type:     schema.TypeInt,
+				Optional: true,
+				Default:  128 * 1024 * 1024, // 128 MiB
+				ValidateFunc: validation.All(
+					validation.IntDivisibleBy(512),
+					validation.IntBetween(1048576, 1073741824),
+				),
+			},
 			"kerberos_keytab": {
 				Type:     schema.TypeString,
 				Optional: true,
@@ -68,21 +82,6 @@ func ResourceLocationHDFS() *schema.Resource {
 				Optional:     true,
 				ValidateFunc: validation.StringLenBetween(1, 255),
 			},
-			"block_size": {
-				Type:     schema.TypeInt,
-				Optional: true,
-				Default:  128 * 1024 * 1024, // 128 MiB
-				ValidateFunc: validation.All(
-					validation.IntDivisibleBy(512),
-					validation.IntBetween(1048576, 1073741824),
-				),
-			},
-			"replication_factor": {
-				Type:         schema.TypeInt,
-				Optional:     true,
-				Default:      3,
-				ValidateFunc: validation.IntBetween(1, 512),
-			},
 			"name_node": {
 				Type:     schema.TypeSet,
 				Required: true,
@@ -121,6 +120,12 @@ func ResourceLocationHDFS() *schema.Resource {
 					},
 				},
 			},
+			"replication_factor": {
+				Type:         schema.TypeInt,
+				Optional:     true,
+				Default:      3,
+				ValidateFunc: validation.IntBetween(1, 512),
+			},
 			"simple_user": {
 				Type:         schema.TypeString,
 				Optional:     true,
@@ -159,24 +164,24 @@ func resourceLocationHDFSCreate(ctx context.Context, d *schema.ResourceData, met
 
 	input := &datasync.CreateLocationHdfsInput{
 		AgentArns:          flex.ExpandStringSet(d.Get("agent_arns").(*schema.Set)),
-		NameNodes:          expandHDFSNameNodes(d.Get("name_node").(*schema.Set)),
 		AuthenticationType: aws.String(d.Get("authentication_type").(string)),
+		NameNodes:          expandHDFSNameNodes(d.Get("name_node").(*schema.Set)),
 		Subdirectory:       aws.String(d.Get("subdirectory").(string)),
 		Tags:               getTagsIn(ctx),
 	}
 
-	if v, ok := d.GetOk("simple_user"); ok {
-		input.SimpleUser = aws.String(v.(string))
-	}
-
-	if v, ok := d.GetOk("kerberos_krb5_conf"); ok {
-		input.KerberosKrb5Conf = []byte(v.(string))
+	if v, ok := d.GetOk("block_size"); ok {
+		input.BlockSize = aws.Int64(int64(v.(int)))
 	}
 
 	if v, ok := d.GetOk("kerberos_keytab"); ok {
 		input.KerberosKeytab = []byte(v.(string))
 	}
 
+	if v, ok := d.GetOk("kerberos_krb5_conf"); ok {
+		input.KerberosKrb5Conf = []byte(v.(string))
+	}
+
 	if v, ok := d.GetOk("kerberos_principal"); ok {
 		input.KerberosPrincipal = aws.String(v.(string))
 	}
@@ -185,20 +190,20 @@ func resourceLocationHDFSCreate(ctx context.Context, d *schema.ResourceData, met
 		input.KmsKeyProviderUri = aws.String(v.(string))
 	}
 
-	if v, ok := d.GetOk("block_size"); ok {
-		input.BlockSize = aws.Int64(int64(v.(int)))
+	if v, ok := d.GetOk("qop_configuration"); ok && len(v.([]interface{})) > 0 {
+		input.QopConfiguration = expandHDFSQOPConfiguration(v.([]interface{}))
 	}
 
 	if v, ok := d.GetOk("replication_factor"); ok {
 		input.ReplicationFactor = aws.Int64(int64(v.(int)))
 	}
 
-	if v, ok := d.GetOk("qop_configuration"); ok && len(v.([]interface{})) > 0 {
-		input.QopConfiguration = expandHDFSQOPConfiguration(v.([]interface{}))
+	if v, ok := d.GetOk("simple_user"); ok {
+		input.SimpleUser = aws.String(v.(string))
 	}
 
-	log.Printf("[DEBUG] Creating DataSync Location HDFS: %s", input)
 	output, err := conn.CreateLocationHdfsWithContext(ctx, input)
+
 	if err != nil {
 		return sdkdiag.AppendErrorf(diags, "creating DataSync Location HDFS: %s", err)
 	}
@@ -224,30 +229,28 @@ func resourceLocationHDFSRead(ctx context.Context, d *schema.ResourceData, meta
 		return sdkdiag.AppendErrorf(diags, "reading DataSync Location HDFS (%s): %s", d.Id(), err)
 	}
 
-	subdirectory, err := subdirectoryFromLocationURI(aws.StringValue(output.LocationUri))
-
+	uri := aws.StringValue(output.LocationUri)
+	subdirectory, err := subdirectoryFromLocationURI(uri)
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "reading DataSync Location HDFS (%s): %s", d.Id(), err)
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
-	d.Set("agent_arns", flex.FlattenStringSet(output.AgentArns))
+	d.Set("agent_arns", aws.StringValueSlice(output.AgentArns))
 	d.Set("arn", output.LocationArn)
-	d.Set("simple_user", output.SimpleUser)
 	d.Set("authentication_type", output.AuthenticationType)
-	d.Set("uri", output.LocationUri)
 	d.Set("block_size", output.BlockSize)
-	d.Set("replication_factor", output.ReplicationFactor)
 	d.Set("kerberos_principal", output.KerberosPrincipal)
 	d.Set("kms_key_provider_uri", output.KmsKeyProviderUri)
-	d.Set("subdirectory", subdirectory)
-
 	if err := d.Set("name_node", flattenHDFSNameNodes(output.NameNodes)); err != nil {
 		return sdkdiag.AppendErrorf(diags, "setting name_node: %s", err)
 	}
-
 	if err := d.Set("qop_configuration", flattenHDFSQOPConfiguration(output.QopConfiguration)); err != nil {
 		return sdkdiag.AppendErrorf(diags, "setting qop_configuration: %s", err)
 	}
+	d.Set("replication_factor", output.ReplicationFactor)
+	d.Set("simple_user", output.SimpleUser)
+	d.Set("subdirectory", subdirectory)
+	d.Set("uri", uri)
 
 	return diags
 }
@@ -256,21 +259,21 @@ func resourceLocationHDFSUpdate(ctx context.Context, d *schema.ResourceData, met
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).DataSyncConn(ctx)
 
-	if d.HasChangesExcept("tags_all", "tags") {
+	if d.HasChangesExcept("tags", "tags_all") {
 		input := &datasync.UpdateLocationHdfsInput{
 			LocationArn: aws.String(d.Id()),
 		}
 
-		if d.HasChange("authentication_type") {
-			input.AuthenticationType = aws.String(d.Get("authentication_type").(string))
+		if d.HasChange("agent_arns") {
+			input.AgentArns = flex.ExpandStringSet(d.Get("agent_arns").(*schema.Set))
 		}
 
-		if d.HasChange("subdirectory") {
-			input.Subdirectory = aws.String(d.Get("subdirectory").(string))
+		if d.HasChange("authentication_type") {
+			input.AuthenticationType = aws.String(d.Get("authentication_type").(string))
 		}
 
-		if d.HasChange("simple_user") {
-			input.SimpleUser = aws.String(d.Get("simple_user").(string))
+		if d.HasChange("block_size") {
+			input.BlockSize = aws.Int64(int64(d.Get("block_size").(int)))
 		}
 
 		if d.HasChange("kerberos_keytab") {
@@ -289,27 +292,28 @@ func resourceLocationHDFSUpdate(ctx context.Context, d *schema.ResourceData, met
 			input.KmsKeyProviderUri = aws.String(d.Get("kms_key_provider_uri").(string))
 		}
 
-		if d.HasChange("block_size") {
-			input.BlockSize = aws.Int64(int64(d.Get("block_size").(int)))
+		if d.HasChange("name_node") {
+			input.NameNodes = expandHDFSNameNodes(d.Get("name_node").(*schema.Set))
 		}
 
-		if d.HasChange("replication_factor") {
-			input.ReplicationFactor = aws.Int64(int64(d.Get("replication_factor").(int)))
+		if d.HasChange("qop_configuration") {
+			input.QopConfiguration = expandHDFSQOPConfiguration(d.Get("qop_configuration").([]interface{}))
 		}
 
-		if d.HasChange("agent_arns") {
-			input.AgentArns = flex.ExpandStringSet(d.Get("agent_arns").(*schema.Set))
+		if d.HasChange("replication_factor") {
+			input.ReplicationFactor = aws.Int64(int64(d.Get("replication_factor").(int)))
 		}
 
-		if d.HasChange("name_node") {
-			input.NameNodes = expandHDFSNameNodes(d.Get("name_node").(*schema.Set))
+		if d.HasChange("simple_user") {
+			input.SimpleUser = aws.String(d.Get("simple_user").(string))
 		}
 
-		if d.HasChange("qop_configuration") {
-			input.QopConfiguration = expandHDFSQOPConfiguration(d.Get("qop_configuration").([]interface{}))
+		if d.HasChange("subdirectory") {
+			input.Subdirectory = aws.String(d.Get("subdirectory").(string))
 		}
 
 		_, err := conn.UpdateLocationHdfsWithContext(ctx, input)
+
 		if err != nil {
 			return sdkdiag.AppendErrorf(diags, "updating DataSync Location HDFS (%s): %s", d.Id(), err)
 		}
@@ -322,12 +326,10 @@ func resourceLocationHDFSDelete(ctx context.Context, d *schema.ResourceData, met
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).DataSyncConn(ctx)
 
-	input := &datasync.DeleteLocationInput{
+	log.Printf("[DEBUG] Deleting DataSync Location HDFS: %s", d.Id())
+	_, err := conn.DeleteLocationWithContext(ctx, &datasync.DeleteLocationInput{
 		LocationArn: aws.String(d.Id()),
-	}
-
-	log.Printf("[DEBUG] Deleting DataSync Location HDFS: %s", input)
-	_, err := conn.DeleteLocationWithContext(ctx, input)
+	})
 
 	if tfawserr.ErrMessageContains(err, datasync.ErrCodeInvalidRequestException, "not found") {
 		return diags
@@ -340,6 +342,31 @@ func resourceLocationHDFSDelete(ctx context.Context, d *schema.ResourceData, met
 	return diags
 }
 
+func FindLocationHDFSByARN(ctx context.Context, conn *datasync.DataSync, arn string) (*datasync.DescribeLocationHdfsOutput, error) {
+	input := &datasync.DescribeLocationHdfsInput{
+		LocationArn: aws.String(arn),
+	}
+
+	output, err := conn.DescribeLocationHdfsWithContext(ctx, input)
+
+	if tfawserr.ErrMessageContains(err, datasync.ErrCodeInvalidRequestException, "not found") {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	if output == nil {
+		return nil, tfresource.NewEmptyResultError(input)
+	}
+
+	return output, nil
+}
+
 func expandHDFSNameNodes(l *schema.Set) []*datasync.HdfsNameNode {
 	nameNodes := make([]*datasync.HdfsNameNode, 0)
 	for _, m := range l.List() {
diff --git a/internal/service/datasync/location_hdfs_test.go b/internal/service/datasync/location_hdfs_test.go
index f393586328b..9196cd3d9b7 100644
--- a/internal/service/datasync/location_hdfs_test.go
+++ b/internal/service/datasync/location_hdfs_test.go
@@ -1,13 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package datasync_test
 
 import (
 	"context"
-	"errors"
 	"fmt"
-	"regexp"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/aws"
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/datasync"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -20,8 +21,7 @@ import (
 
 func TestAccDataSyncLocationHDFS_basic(t *testing.T) {
 	ctx := acctest.Context(t)
-	var locationHDFS1 datasync.DescribeLocationHdfsOutput
-
+	var v datasync.DescribeLocationHdfsOutput
 	resourceName := "aws_datasync_location_hdfs.test"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
@@ -34,8 +34,8 @@ func TestAccDataSyncLocationHDFS_basic(t *testing.T) {
 			{
 				Config: testAccLocationHDFSConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckLocationHDFSExists(ctx, resourceName, &locationHDFS1),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "datasync", regexp.MustCompile(`location/loc-.+`)),
+					testAccCheckLocationHDFSExists(ctx, resourceName, &v),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "datasync", regexache.MustCompile(`location/loc-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "agent_arns.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "name_node.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "name_node.*", map[string]string{
@@ -46,7 +46,7 @@ func TestAccDataSyncLocationHDFS_basic(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "block_size", "134217728"),
 					resource.TestCheckResourceAttr(resourceName, "replication_factor", "3"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
-					resource.TestMatchResourceAttr(resourceName, "uri", regexp.MustCompile(`^hdfs://.+/`)),
+					resource.TestMatchResourceAttr(resourceName, "uri", regexache.MustCompile(`^hdfs://.+/`)),
 				),
 			},
 			{
@@ -60,7 +60,7 @@ func TestAccDataSyncLocationHDFS_basic(t *testing.T) {
 
 func TestAccDataSyncLocationHDFS_disappears(t *testing.T) {
 	ctx := acctest.Context(t)
-	var locationHDFS1 datasync.DescribeLocationHdfsOutput
+	var v datasync.DescribeLocationHdfsOutput
 	resourceName := "aws_datasync_location_hdfs.test"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
@@ -73,7 +73,7 @@ func TestAccDataSyncLocationHDFS_disappears(t *testing.T) {
 			{
 				Config: testAccLocationHDFSConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckLocationHDFSExists(ctx, resourceName, &locationHDFS1),
+					testAccCheckLocationHDFSExists(ctx, resourceName, &v),
 					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfdatasync.ResourceLocationHDFS(), resourceName),
 					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfdatasync.ResourceLocationHDFS(), resourceName),
 				),
@@ -85,7 +85,7 @@ func TestAccDataSyncLocationHDFS_disappears(t *testing.T) {
 
 func TestAccDataSyncLocationHDFS_tags(t *testing.T) {
 	ctx := acctest.Context(t)
-	var locationHDFS1, locationHDFS2, locationHDFS3 datasync.DescribeLocationHdfsOutput
+	var v datasync.DescribeLocationHdfsOutput
 	resourceName := "aws_datasync_location_hdfs.test"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
@@ -98,7 +98,7 @@ func TestAccDataSyncLocationHDFS_tags(t *testing.T) {
 			{
 				Config: testAccLocationHDFSConfig_tags1(rName, "key1", "value1"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckLocationHDFSExists(ctx, resourceName, &locationHDFS1),
+					testAccCheckLocationHDFSExists(ctx, resourceName, &v),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
 				),
@@ -111,8 +111,7 @@ func TestAccDataSyncLocationHDFS_tags(t *testing.T) {
 			{
 				Config: testAccLocationHDFSConfig_tags2(rName, "key1", "value1updated", "key2", "value2"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckLocationHDFSExists(ctx, resourceName, &locationHDFS2),
-					testAccCheckLocationHDFSNotRecreated(&locationHDFS1, &locationHDFS2),
+					testAccCheckLocationHDFSExists(ctx, resourceName, &v),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1updated"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
@@ -121,8 +120,7 @@ func TestAccDataSyncLocationHDFS_tags(t *testing.T) {
 			{
 				Config: testAccLocationHDFSConfig_tags1(rName, "key1", "value1"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckLocationHDFSExists(ctx, resourceName, &locationHDFS3),
-					testAccCheckLocationHDFSNotRecreated(&locationHDFS2, &locationHDFS3),
+					testAccCheckLocationHDFSExists(ctx, resourceName, &v),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
 				),
@@ -150,133 +148,36 @@ func testAccCheckLocationHDFSDestroy(ctx context.Context) resource.TestCheckFunc
 				return err
 			}
 
-			return fmt.Errorf("DataSync Task %s still exists", rs.Primary.ID)
+			return fmt.Errorf("DataSync Location HDFS %s still exists", rs.Primary.ID)
 		}
 
 		return nil
 	}
 }
 
-func testAccCheckLocationHDFSExists(ctx context.Context, resourceName string, locationHDFS *datasync.DescribeLocationHdfsOutput) resource.TestCheckFunc {
+func testAccCheckLocationHDFSExists(ctx context.Context, n string, v *datasync.DescribeLocationHdfsOutput) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		rs, ok := s.RootModule().Resources[resourceName]
+		rs, ok := s.RootModule().Resources[n]
 		if !ok {
-			return fmt.Errorf("Not found: %s", resourceName)
+			return fmt.Errorf("Not found: %s", n)
 		}
 
 		conn := acctest.Provider.Meta().(*conns.AWSClient).DataSyncConn(ctx)
+
 		output, err := tfdatasync.FindLocationHDFSByARN(ctx, conn, rs.Primary.ID)
 
 		if err != nil {
 			return err
 		}
 
-		if output == nil {
-			return fmt.Errorf("Location %q does not exist", rs.Primary.ID)
-		}
-
-		*locationHDFS = *output
-
-		return nil
-	}
-}
-
-func testAccCheckLocationHDFSNotRecreated(i, j *datasync.DescribeLocationHdfsOutput) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		if !aws.TimeValue(i.CreationTime).Equal(aws.TimeValue(j.CreationTime)) {
-			return errors.New("DataSync Location HDFS was recreated")
-		}
+		*v = *output
 
 		return nil
 	}
 }
 
 func testAccLocationHDFSConfig_base(rName string) string {
-	return acctest.ConfigCompose(
-		// Reference: https://docs.aws.amazon.com/datasync/latest/userguide/agent-requirements.html
-		acctest.AvailableEC2InstanceTypeForAvailabilityZone("aws_subnet.test.availability_zone", "m5.2xlarge", "m5.4xlarge"),
-		fmt.Sprintf(`
-data "aws_partition" "current" {}
-
-# Reference: https://docs.aws.amazon.com/datasync/latest/userguide/deploy-agents.html
-data "aws_ssm_parameter" "aws_service_datasync_ami" {
-  name = "/aws/service/datasync/ami"
-}
-
-resource "aws_vpc" "test" {
-  cidr_block = "10.0.0.0/16"
-
-  tags = {
-    Name = "tf-acc-test-datasync-location-hdfs"
-  }
-}
-
-resource "aws_subnet" "test" {
-  cidr_block = "10.0.0.0/24"
-  vpc_id     = aws_vpc.test.id
-
-  tags = {
-    Name = "tf-acc-test-datasync-location-hdfs"
-  }
-}
-
-resource "aws_internet_gateway" "test" {
-  vpc_id = aws_vpc.test.id
-
-  tags = {
-    Name = "tf-acc-test-datasync-location-hdfs"
-  }
-}
-
-resource "aws_default_route_table" "test" {
-  default_route_table_id = aws_vpc.test.default_route_table_id
-
-  route {
-    cidr_block = "0.0.0.0/0"
-    gateway_id = aws_internet_gateway.test.id
-  }
-
-  tags = {
-    Name = "tf-acc-test-datasync-location-hdfs"
-  }
-}
-
-resource "aws_security_group" "test" {
-  vpc_id = aws_vpc.test.id
-
-  egress {
-    from_port   = 0
-    to_port     = 0
-    protocol    = "-1"
-    cidr_blocks = ["0.0.0.0/0"]
-  }
-
-  ingress {
-    from_port   = 0
-    to_port     = 0
-    protocol    = "-1"
-    cidr_blocks = ["0.0.0.0/0"]
-  }
-
-  tags = {
-    Name = "tf-acc-test-datasync-hdfs"
-  }
-}
-
-resource "aws_instance" "test" {
-  depends_on = [aws_default_route_table.test]
-
-  ami                         = data.aws_ssm_parameter.aws_service_datasync_ami.value
-  associate_public_ip_address = true
-  instance_type               = data.aws_ec2_instance_type_offering.available.instance_type
-  vpc_security_group_ids      = [aws_security_group.test.id]
-  subnet_id                   = aws_subnet.test.id
-
-  tags = {
-    Name = "tf-acc-test-datasync-hdfs"
-  }
-}
-
+	return acctest.ConfigCompose(testAccAgentAgentConfig_base(rName), fmt.Sprintf(`
 resource "aws_datasync_agent" "test" {
   ip_address = aws_instance.test.public_ip
   name       = %[1]q
@@ -285,7 +186,7 @@ resource "aws_datasync_agent" "test" {
 }
 
 func testAccLocationHDFSConfig_basic(rName string) string {
-	return testAccLocationHDFSConfig_base(rName) + fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccLocationHDFSConfig_base(rName), fmt.Sprintf(`
 resource "aws_datasync_location_hdfs" "test" {
   agent_arns          = [aws_datasync_agent.test.arn]
   authentication_type = "SIMPLE"
@@ -296,11 +197,11 @@ resource "aws_datasync_location_hdfs" "test" {
     port     = 80
   }
 }
-`, rName)
+`, rName))
 }
 
 func testAccLocationHDFSConfig_tags1(rName, key1, value1 string) string {
-	return testAccLocationHDFSConfig_base(rName) + fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccLocationHDFSConfig_base(rName), fmt.Sprintf(`
 resource "aws_datasync_location_hdfs" "test" {
   agent_arns          = [aws_datasync_agent.test.arn]
   authentication_type = "SIMPLE"
@@ -315,11 +216,11 @@ resource "aws_datasync_location_hdfs" "test" {
     %[2]q = %[3]q
   }
 }
-`, rName, key1, value1)
+`, rName, key1, value1))
 }
 
 func testAccLocationHDFSConfig_tags2(rName, key1, value1, key2, value2 string) string {
-	return testAccLocationHDFSConfig_base(rName) + fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccLocationHDFSConfig_base(rName), fmt.Sprintf(`
 resource "aws_datasync_location_hdfs" "test" {
   agent_arns          = [aws_datasync_agent.test.arn]
   authentication_type = "SIMPLE"
@@ -335,5 +236,5 @@ resource "aws_datasync_location_hdfs" "test" {
     %[4]q = %[5]q
   }
 }
-`, rName, key1, value1, key2, value2)
+`, rName, key1, value1, key2, value2))
 }
diff --git a/internal/service/datasync/location_nfs.go b/internal/service/datasync/location_nfs.go
index eb2aee2893f..904bd8cb1be 100644
--- a/internal/service/datasync/location_nfs.go
+++ b/internal/service/datasync/location_nfs.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package datasync
 
 import (
@@ -9,12 +12,14 @@ import (
 	"github.com/aws/aws-sdk-go/service/datasync"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
 	"github.com/hashicorp/terraform-provider-aws/internal/flex"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -27,6 +32,7 @@ func ResourceLocationNFS() *schema.Resource {
 		ReadWithoutTimeout:   resourceLocationNFSRead,
 		UpdateWithoutTimeout: resourceLocationNFSUpdate,
 		DeleteWithoutTimeout: resourceLocationNFSDelete,
+
 		Importer: &schema.ResourceImporter{
 			StateContext: schema.ImportStatePassthroughContext,
 		},
@@ -36,6 +42,23 @@ func ResourceLocationNFS() *schema.Resource {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
+			"mount_options": {
+				Type:             schema.TypeList,
+				Optional:         true,
+				MaxItems:         1,
+				DiffSuppressFunc: verify.SuppressMissingOptionalConfigurationBlock,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"version": {
+							Type:         schema.TypeString,
+							Default:      datasync.NfsVersionAutomatic,
+							Optional:     true,
+							ForceNew:     true,
+							ValidateFunc: validation.StringInSlice(datasync.NfsVersion_Values(), false),
+						},
+					},
+				},
+			},
 			"on_prem_config": {
 				Type:     schema.TypeList,
 				Required: true,
@@ -54,23 +77,6 @@ func ResourceLocationNFS() *schema.Resource {
 					},
 				},
 			},
-			"mount_options": {
-				Type:             schema.TypeList,
-				Optional:         true,
-				MaxItems:         1,
-				DiffSuppressFunc: verify.SuppressMissingOptionalConfigurationBlock,
-				Elem: &schema.Resource{
-					Schema: map[string]*schema.Schema{
-						"version": {
-							Type:         schema.TypeString,
-							Default:      datasync.NfsVersionAutomatic,
-							Optional:     true,
-							ForceNew:     true,
-							ValidateFunc: validation.StringInSlice(datasync.NfsVersion_Values(), false),
-						},
-					},
-				},
-			},
 			"server_hostname": {
 				Type:         schema.TypeString,
 				Required:     true,
@@ -119,8 +125,8 @@ func resourceLocationNFSCreate(ctx context.Context, d *schema.ResourceData, meta
 		input.MountOptions = expandNFSMountOptions(v.([]interface{}))
 	}
 
-	log.Printf("[DEBUG] Creating DataSync Location NFS: %s", input)
 	output, err := conn.CreateLocationNfsWithContext(ctx, input)
+
 	if err != nil {
 		return sdkdiag.AppendErrorf(diags, "creating DataSync Location NFS: %s", err)
 	}
@@ -134,15 +140,10 @@ func resourceLocationNFSRead(ctx context.Context, d *schema.ResourceData, meta i
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).DataSyncConn(ctx)
 
-	input := &datasync.DescribeLocationNfsInput{
-		LocationArn: aws.String(d.Id()),
-	}
+	output, err := FindLocationNFSByARN(ctx, conn, d.Id())
 
-	log.Printf("[DEBUG] Reading DataSync Location NFS: %s", input)
-	output, err := conn.DescribeLocationNfsWithContext(ctx, input)
-
-	if tfawserr.ErrMessageContains(err, "InvalidRequestException", "not found") {
-		log.Printf("[WARN] DataSync Location NFS %q not found - removing from state", d.Id())
+	if !d.IsNewResource() && tfresource.NotFound(err) {
+		log.Printf("[WARN] DataSync Location NFS (%s) not found, removing from state", d.Id())
 		d.SetId("")
 		return diags
 	}
@@ -151,24 +152,21 @@ func resourceLocationNFSRead(ctx context.Context, d *schema.ResourceData, meta i
 		return sdkdiag.AppendErrorf(diags, "reading DataSync Location NFS (%s): %s", d.Id(), err)
 	}
 
-	subdirectory, err := subdirectoryFromLocationURI(aws.StringValue(output.LocationUri))
-
+	uri := aws.StringValue(output.LocationUri)
+	subdirectory, err := subdirectoryFromLocationURI(uri)
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "reading DataSync Location NFS (%s): %s", d.Id(), err)
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
 	d.Set("arn", output.LocationArn)
-
-	if err := d.Set("on_prem_config", flattenOnPremConfig(output.OnPremConfig)); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting on_prem_config: %s", err)
-	}
-
 	if err := d.Set("mount_options", flattenNFSMountOptions(output.MountOptions)); err != nil {
 		return sdkdiag.AppendErrorf(diags, "setting mount_options: %s", err)
 	}
-
+	if err := d.Set("on_prem_config", flattenOnPremConfig(output.OnPremConfig)); err != nil {
+		return sdkdiag.AppendErrorf(diags, "setting on_prem_config: %s", err)
+	}
 	d.Set("subdirectory", subdirectory)
-	d.Set("uri", output.LocationUri)
+	d.Set("uri", uri)
 
 	return diags
 }
@@ -177,7 +175,7 @@ func resourceLocationNFSUpdate(ctx context.Context, d *schema.ResourceData, meta
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).DataSyncConn(ctx)
 
-	if d.HasChangesExcept("tags_all", "tags") {
+	if d.HasChangesExcept("tags", "tags_all") {
 		input := &datasync.UpdateLocationNfsInput{
 			LocationArn:  aws.String(d.Id()),
 			OnPremConfig: expandOnPremConfig(d.Get("on_prem_config").([]interface{})),
@@ -189,6 +187,7 @@ func resourceLocationNFSUpdate(ctx context.Context, d *schema.ResourceData, meta
 		}
 
 		_, err := conn.UpdateLocationNfsWithContext(ctx, input)
+
 		if err != nil {
 			return sdkdiag.AppendErrorf(diags, "updating DataSync Location NFS (%s): %s", d.Id(), err)
 		}
@@ -201,14 +200,12 @@ func resourceLocationNFSDelete(ctx context.Context, d *schema.ResourceData, meta
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).DataSyncConn(ctx)
 
-	input := &datasync.DeleteLocationInput{
+	log.Printf("[DEBUG] Deleting DataSync Location NFS: %s", d.Id())
+	_, err := conn.DeleteLocationWithContext(ctx, &datasync.DeleteLocationInput{
 		LocationArn: aws.String(d.Id()),
-	}
-
-	log.Printf("[DEBUG] Deleting DataSync Location NFS: %s", input)
-	_, err := conn.DeleteLocationWithContext(ctx, input)
+	})
 
-	if tfawserr.ErrMessageContains(err, "InvalidRequestException", "not found") {
+	if tfawserr.ErrMessageContains(err, datasync.ErrCodeInvalidRequestException, "not found") {
 		return diags
 	}
 
@@ -219,6 +216,31 @@ func resourceLocationNFSDelete(ctx context.Context, d *schema.ResourceData, meta
 	return diags
 }
 
+func FindLocationNFSByARN(ctx context.Context, conn *datasync.DataSync, arn string) (*datasync.DescribeLocationNfsOutput, error) {
+	input := &datasync.DescribeLocationNfsInput{
+		LocationArn: aws.String(arn),
+	}
+
+	output, err := conn.DescribeLocationNfsWithContext(ctx, input)
+
+	if tfawserr.ErrMessageContains(err, datasync.ErrCodeInvalidRequestException, "not found") {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	if output == nil {
+		return nil, tfresource.NewEmptyResultError(input)
+	}
+
+	return output, nil
+}
+
 func expandNFSMountOptions(l []interface{}) *datasync.NfsMountOptions {
 	if len(l) == 0 || l[0] == nil {
 		return nil
diff --git a/internal/service/datasync/location_nfs_test.go b/internal/service/datasync/location_nfs_test.go
index b30420490c6..cb093b5819b 100644
--- a/internal/service/datasync/location_nfs_test.go
+++ b/internal/service/datasync/location_nfs_test.go
@@ -1,25 +1,27 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package datasync_test
 
 import (
 	"context"
-	"errors"
 	"fmt"
-	"regexp"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/aws"
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/datasync"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	tfdatasync "github.com/hashicorp/terraform-provider-aws/internal/service/datasync"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
 func TestAccDataSyncLocationNFS_basic(t *testing.T) {
 	ctx := acctest.Context(t)
-	var locationNfs1 datasync.DescribeLocationNfsOutput
+	var v datasync.DescribeLocationNfsOutput
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_datasync_location_nfs.test"
 
@@ -32,8 +34,8 @@ func TestAccDataSyncLocationNFS_basic(t *testing.T) {
 			{
 				Config: testAccLocationNFSConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckLocationNFSExists(ctx, resourceName, &locationNfs1),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "datasync", regexp.MustCompile(`location/loc-.+`)),
+					testAccCheckLocationNFSExists(ctx, resourceName, &v),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "datasync", regexache.MustCompile(`location/loc-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "on_prem_config.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "on_prem_config.0.agent_arns.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "mount_options.#", "1"),
@@ -41,7 +43,7 @@ func TestAccDataSyncLocationNFS_basic(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "server_hostname", "example.com"),
 					resource.TestCheckResourceAttr(resourceName, "subdirectory", "/"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
-					resource.TestMatchResourceAttr(resourceName, "uri", regexp.MustCompile(`^nfs://.+/`)),
+					resource.TestMatchResourceAttr(resourceName, "uri", regexache.MustCompile(`^nfs://.+/`)),
 				),
 			},
 			{
@@ -56,7 +58,7 @@ func TestAccDataSyncLocationNFS_basic(t *testing.T) {
 
 func TestAccDataSyncLocationNFS_mountOptions(t *testing.T) {
 	ctx := acctest.Context(t)
-	var locationNfs1 datasync.DescribeLocationNfsOutput
+	var v datasync.DescribeLocationNfsOutput
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_datasync_location_nfs.test"
 
@@ -69,7 +71,7 @@ func TestAccDataSyncLocationNFS_mountOptions(t *testing.T) {
 			{
 				Config: testAccLocationNFSConfig_mountOptions(rName, "NFS4_0"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckLocationNFSExists(ctx, resourceName, &locationNfs1),
+					testAccCheckLocationNFSExists(ctx, resourceName, &v),
 					resource.TestCheckResourceAttr(resourceName, "mount_options.0.version", "NFS4_0"),
 				),
 			},
@@ -82,7 +84,7 @@ func TestAccDataSyncLocationNFS_mountOptions(t *testing.T) {
 			{
 				Config: testAccLocationNFSConfig_mountOptions(rName, "NFS4_1"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckLocationNFSExists(ctx, resourceName, &locationNfs1),
+					testAccCheckLocationNFSExists(ctx, resourceName, &v),
 					resource.TestCheckResourceAttr(resourceName, "mount_options.0.version", "NFS4_1"),
 				),
 			},
@@ -92,7 +94,7 @@ func TestAccDataSyncLocationNFS_mountOptions(t *testing.T) {
 
 func TestAccDataSyncLocationNFS_disappears(t *testing.T) {
 	ctx := acctest.Context(t)
-	var locationNfs1 datasync.DescribeLocationNfsOutput
+	var v datasync.DescribeLocationNfsOutput
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_datasync_location_nfs.test"
 
@@ -105,8 +107,8 @@ func TestAccDataSyncLocationNFS_disappears(t *testing.T) {
 			{
 				Config: testAccLocationNFSConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckLocationNFSExists(ctx, resourceName, &locationNfs1),
-					testAccCheckLocationNFSDisappears(ctx, &locationNfs1),
+					testAccCheckLocationNFSExists(ctx, resourceName, &v),
+					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfdatasync.ResourceLocationNFS(), resourceName),
 				),
 				ExpectNonEmptyPlan: true,
 			},
@@ -116,7 +118,7 @@ func TestAccDataSyncLocationNFS_disappears(t *testing.T) {
 
 func TestAccDataSyncLocationNFS_AgentARNs_multiple(t *testing.T) {
 	ctx := acctest.Context(t)
-	var locationNfs1 datasync.DescribeLocationNfsOutput
+	var v datasync.DescribeLocationNfsOutput
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_datasync_location_nfs.test"
 
@@ -129,7 +131,7 @@ func TestAccDataSyncLocationNFS_AgentARNs_multiple(t *testing.T) {
 			{
 				Config: testAccLocationNFSConfig_agentARNsMultiple(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckLocationNFSExists(ctx, resourceName, &locationNfs1),
+					testAccCheckLocationNFSExists(ctx, resourceName, &v),
 					resource.TestCheckResourceAttr(resourceName, "on_prem_config.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "on_prem_config.0.agent_arns.#", "2"),
 				),
@@ -147,7 +149,7 @@ func TestAccDataSyncLocationNFS_AgentARNs_multiple(t *testing.T) {
 func TestAccDataSyncLocationNFS_subdirectory(t *testing.T) {
 	ctx := acctest.Context(t)
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
-	var locationNfs1 datasync.DescribeLocationNfsOutput
+	var v datasync.DescribeLocationNfsOutput
 	resourceName := "aws_datasync_location_nfs.test"
 
 	resource.ParallelTest(t, resource.TestCase{
@@ -159,7 +161,7 @@ func TestAccDataSyncLocationNFS_subdirectory(t *testing.T) {
 			{
 				Config: testAccLocationNFSConfig_subdirectory(rName, "/subdirectory1/"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckLocationNFSExists(ctx, resourceName, &locationNfs1),
+					testAccCheckLocationNFSExists(ctx, resourceName, &v),
 					resource.TestCheckResourceAttr(resourceName, "subdirectory", "/subdirectory1/"),
 				),
 			},
@@ -172,7 +174,7 @@ func TestAccDataSyncLocationNFS_subdirectory(t *testing.T) {
 			{
 				Config: testAccLocationNFSConfig_subdirectory(rName, "/subdirectory2/"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckLocationNFSExists(ctx, resourceName, &locationNfs1),
+					testAccCheckLocationNFSExists(ctx, resourceName, &v),
 					resource.TestCheckResourceAttr(resourceName, "subdirectory", "/subdirectory2/"),
 				),
 			},
@@ -182,7 +184,7 @@ func TestAccDataSyncLocationNFS_subdirectory(t *testing.T) {
 
 func TestAccDataSyncLocationNFS_tags(t *testing.T) {
 	ctx := acctest.Context(t)
-	var locationNfs1, locationNfs2, locationNfs3 datasync.DescribeLocationNfsOutput
+	var v datasync.DescribeLocationNfsOutput
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_datasync_location_nfs.test"
 
@@ -195,7 +197,7 @@ func TestAccDataSyncLocationNFS_tags(t *testing.T) {
 			{
 				Config: testAccLocationNFSConfig_tags1(rName, "key1", "value1"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckLocationNFSExists(ctx, resourceName, &locationNfs1),
+					testAccCheckLocationNFSExists(ctx, resourceName, &v),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
 				),
@@ -209,8 +211,7 @@ func TestAccDataSyncLocationNFS_tags(t *testing.T) {
 			{
 				Config: testAccLocationNFSConfig_tags2(rName, "key1", "value1updated", "key2", "value2"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckLocationNFSExists(ctx, resourceName, &locationNfs2),
-					testAccCheckLocationNFSNotRecreated(&locationNfs1, &locationNfs2),
+					testAccCheckLocationNFSExists(ctx, resourceName, &v),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1updated"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
@@ -219,8 +220,7 @@ func TestAccDataSyncLocationNFS_tags(t *testing.T) {
 			{
 				Config: testAccLocationNFSConfig_tags1(rName, "key1", "value1"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckLocationNFSExists(ctx, resourceName, &locationNfs3),
-					testAccCheckLocationNFSNotRecreated(&locationNfs2, &locationNfs3),
+					testAccCheckLocationNFSExists(ctx, resourceName, &v),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
 				),
@@ -238,179 +238,55 @@ func testAccCheckLocationNFSDestroy(ctx context.Context) resource.TestCheckFunc
 				continue
 			}
 
-			input := &datasync.DescribeLocationNfsInput{
-				LocationArn: aws.String(rs.Primary.ID),
-			}
-
-			_, err := conn.DescribeLocationNfsWithContext(ctx, input)
+			_, err := tfdatasync.FindLocationNFSByARN(ctx, conn, rs.Primary.ID)
 
-			if tfawserr.ErrMessageContains(err, "InvalidRequestException", "not found") {
-				return nil
+			if tfresource.NotFound(err) {
+				continue
 			}
 
 			if err != nil {
 				return err
 			}
+
+			return fmt.Errorf("DataSync Location NFS %s still exists", rs.Primary.ID)
 		}
 
 		return nil
 	}
 }
 
-func testAccCheckLocationNFSExists(ctx context.Context, resourceName string, locationNfs *datasync.DescribeLocationNfsOutput) resource.TestCheckFunc {
+func testAccCheckLocationNFSExists(ctx context.Context, n string, v *datasync.DescribeLocationNfsOutput) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		rs, ok := s.RootModule().Resources[resourceName]
+		rs, ok := s.RootModule().Resources[n]
 		if !ok {
-			return fmt.Errorf("Not found: %s", resourceName)
+			return fmt.Errorf("Not found: %s", n)
 		}
 
 		conn := acctest.Provider.Meta().(*conns.AWSClient).DataSyncConn(ctx)
-		input := &datasync.DescribeLocationNfsInput{
-			LocationArn: aws.String(rs.Primary.ID),
-		}
 
-		output, err := conn.DescribeLocationNfsWithContext(ctx, input)
+		output, err := tfdatasync.FindLocationNFSByARN(ctx, conn, rs.Primary.ID)
 
 		if err != nil {
 			return err
 		}
 
-		if output == nil {
-			return fmt.Errorf("Location %q does not exist", rs.Primary.ID)
-		}
-
-		*locationNfs = *output
-
-		return nil
-	}
-}
-
-func testAccCheckLocationNFSDisappears(ctx context.Context, location *datasync.DescribeLocationNfsOutput) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		conn := acctest.Provider.Meta().(*conns.AWSClient).DataSyncConn(ctx)
-
-		input := &datasync.DeleteLocationInput{
-			LocationArn: location.LocationArn,
-		}
-
-		_, err := conn.DeleteLocationWithContext(ctx, input)
-
-		return err
-	}
-}
-
-func testAccCheckLocationNFSNotRecreated(i, j *datasync.DescribeLocationNfsOutput) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		if !aws.TimeValue(i.CreationTime).Equal(aws.TimeValue(j.CreationTime)) {
-			return errors.New("DataSync Location Nfs was recreated")
-		}
+		*v = *output
 
 		return nil
 	}
 }
 
-func testAccLocationNFSBaseConfig(rName string) string {
-	return fmt.Sprintf(`
-data "aws_ami" "aws-thinstaller" {
-  most_recent = true
-  owners      = ["amazon"]
-
-  filter {
-    name   = "name"
-    values = ["aws-thinstaller-*"]
-  }
-}
-
-resource "aws_vpc" "test" {
-  cidr_block = "10.0.0.0/16"
-
-  tags = {
-    Name = "tf-acc-test-datasync-location-nfs"
-  }
-}
-
-resource "aws_subnet" "test" {
-  cidr_block = "10.0.0.0/24"
-  vpc_id     = aws_vpc.test.id
-
-  tags = {
-    Name = "tf-acc-test-datasync-location-nfs"
-  }
-}
-
-resource "aws_internet_gateway" "test" {
-  vpc_id = aws_vpc.test.id
-
-  tags = {
-    Name = "tf-acc-test-datasync-location-nfs"
-  }
-}
-
-resource "aws_route_table" "test" {
-  vpc_id = aws_vpc.test.id
-
-  route {
-    cidr_block = "0.0.0.0/0"
-    gateway_id = aws_internet_gateway.test.id
-  }
-
-  tags = {
-    Name = "tf-acc-test-datasync-location-nfs"
-  }
-}
-
-resource "aws_route_table_association" "test" {
-  subnet_id      = aws_subnet.test.id
-  route_table_id = aws_route_table.test.id
-}
-
-resource "aws_security_group" "test" {
-  vpc_id = aws_vpc.test.id
-
-  egress {
-    from_port   = 0
-    to_port     = 0
-    protocol    = "-1"
-    cidr_blocks = ["0.0.0.0/0"]
-  }
-
-  ingress {
-    from_port   = 0
-    to_port     = 0
-    protocol    = "-1"
-    cidr_blocks = ["0.0.0.0/0"]
-  }
-
-  tags = {
-    Name = "tf-acc-test-datasync-location-nfs"
-  }
-}
-
-resource "aws_instance" "test" {
-  depends_on = [aws_internet_gateway.test]
-
-  ami                         = data.aws_ami.aws-thinstaller.id
-  associate_public_ip_address = true
-
-  # Default instance type from sync.sh
-  instance_type          = "c5.2xlarge"
-  vpc_security_group_ids = [aws_security_group.test.id]
-  subnet_id              = aws_subnet.test.id
-
-  tags = {
-    Name = "tf-acc-test-datasync-location-nfs"
-  }
-}
-
+func testAccLocationNFSConfig_base(rName string) string {
+	return acctest.ConfigCompose(testAccAgentAgentConfig_base(rName), fmt.Sprintf(`
 resource "aws_datasync_agent" "test" {
   ip_address = aws_instance.test.public_ip
-  name       = %q
+  name       = %[1]q
 }
-`, rName)
+`, rName))
 }
 
 func testAccLocationNFSConfig_basic(rName string) string {
-	return testAccLocationNFSBaseConfig(rName) + `
+	return acctest.ConfigCompose(testAccLocationNFSConfig_base(rName), `
 resource "aws_datasync_location_nfs" "test" {
   server_hostname = "example.com"
   subdirectory    = "/"
@@ -419,11 +295,11 @@ resource "aws_datasync_location_nfs" "test" {
     agent_arns = [aws_datasync_agent.test.arn]
   }
 }
-`
+`)
 }
 
 func testAccLocationNFSConfig_mountOptions(rName, option string) string {
-	return testAccLocationNFSBaseConfig(rName) + fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccLocationNFSConfig_base(rName), fmt.Sprintf(`
 resource "aws_datasync_location_nfs" "test" {
   server_hostname = "example.com"
   subdirectory    = "/"
@@ -436,30 +312,28 @@ resource "aws_datasync_location_nfs" "test" {
     version = %[1]q
   }
 }
-`, option)
+`, option))
 }
 
 func testAccLocationNFSConfig_agentARNsMultiple(rName string) string {
-	return testAccLocationNFSBaseConfig(rName) + fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccLocationNFSConfig_base(rName), fmt.Sprintf(`
 resource "aws_instance" "test2" {
   depends_on = [aws_internet_gateway.test]
 
-  ami                         = data.aws_ami.aws-thinstaller.id
+  ami                         = aws_instance.test.ami
   associate_public_ip_address = true
-
-  # Default instance type from sync.sh
-  instance_type          = "c5.2xlarge"
-  vpc_security_group_ids = [aws_security_group.test.id]
-  subnet_id              = aws_subnet.test.id
+  instance_type               = aws_instance.test.instance_type
+  vpc_security_group_ids      = [aws_security_group.test.id]
+  subnet_id                   = aws_subnet.test[0].id
 
   tags = {
-    Name = "tf-acc-test-datasync-location-nfs"
+    Name = %[1]q
   }
 }
 
 resource "aws_datasync_agent" "test2" {
   ip_address = aws_instance.test2.public_ip
-  name       = "%s2"
+  name       = "%[1]s-2"
 }
 
 resource "aws_datasync_location_nfs" "test" {
@@ -473,24 +347,24 @@ resource "aws_datasync_location_nfs" "test" {
     ]
   }
 }
-`, rName)
+`, rName))
 }
 
 func testAccLocationNFSConfig_subdirectory(rName, subdirectory string) string {
-	return testAccLocationNFSBaseConfig(rName) + fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccLocationNFSConfig_base(rName), fmt.Sprintf(`
 resource "aws_datasync_location_nfs" "test" {
   server_hostname = "example.com"
-  subdirectory    = %q
+  subdirectory    = %[1]q
 
   on_prem_config {
     agent_arns = [aws_datasync_agent.test.arn]
   }
 }
-`, subdirectory)
+`, subdirectory))
 }
 
 func testAccLocationNFSConfig_tags1(rName, key1, value1 string) string {
-	return testAccLocationNFSBaseConfig(rName) + fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccLocationNFSConfig_base(rName), fmt.Sprintf(`
 resource "aws_datasync_location_nfs" "test" {
   server_hostname = "example.com"
   subdirectory    = "/"
@@ -500,14 +374,14 @@ resource "aws_datasync_location_nfs" "test" {
   }
 
   tags = {
-    %q = %q
+    %[1]q = %[2]q
   }
 }
-`, key1, value1)
+`, key1, value1))
 }
 
 func testAccLocationNFSConfig_tags2(rName, key1, value1, key2, value2 string) string {
-	return testAccLocationNFSBaseConfig(rName) + fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccLocationNFSConfig_base(rName), fmt.Sprintf(`
 resource "aws_datasync_location_nfs" "test" {
   server_hostname = "example.com"
   subdirectory    = "/"
@@ -517,9 +391,9 @@ resource "aws_datasync_location_nfs" "test" {
   }
 
   tags = {
-    %q = %q
-    %q = %q
+    %[1]q = %[2]q
+    %[3]q = %[4]q
   }
 }
-`, key1, value1, key2, value2)
+`, key1, value1, key2, value2))
 }
diff --git a/internal/service/datasync/location_object_storage.go b/internal/service/datasync/location_object_storage.go
index 9d88e386b2d..18cc783cd5b 100644
--- a/internal/service/datasync/location_object_storage.go
+++ b/internal/service/datasync/location_object_storage.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package datasync
 
 import (
@@ -10,6 +13,7 @@ import (
 	"github.com/aws/aws-sdk-go/service/datasync"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
@@ -35,10 +39,6 @@ func ResourceLocationObjectStorage() *schema.Resource {
 		},
 
 		Schema: map[string]*schema.Schema{
-			"arn": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
 			"access_key": {
 				Type:         schema.TypeString,
 				Optional:     true,
@@ -52,6 +52,10 @@ func ResourceLocationObjectStorage() *schema.Resource {
 					ValidateFunc: verify.ValidARN,
 				},
 			},
+			"arn": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
 			"bucket_name": {
 				Type:         schema.TypeString,
 				Required:     true,
@@ -110,9 +114,9 @@ func resourceLocationObjectStorageCreate(ctx context.Context, d *schema.Resource
 
 	input := &datasync.CreateLocationObjectStorageInput{
 		AgentArns:      flex.ExpandStringSet(d.Get("agent_arns").(*schema.Set)),
-		Subdirectory:   aws.String(d.Get("subdirectory").(string)),
 		BucketName:     aws.String(d.Get("bucket_name").(string)),
 		ServerHostname: aws.String(d.Get("server_hostname").(string)),
+		Subdirectory:   aws.String(d.Get("subdirectory").(string)),
 		Tags:           getTagsIn(ctx),
 	}
 
@@ -120,14 +124,6 @@ func resourceLocationObjectStorageCreate(ctx context.Context, d *schema.Resource
 		input.AccessKey = aws.String(v.(string))
 	}
 
-	if v, ok := d.GetOk("server_protocol"); ok {
-		input.ServerProtocol = aws.String(v.(string))
-	}
-
-	if v, ok := d.GetOk("server_port"); ok {
-		input.ServerPort = aws.Int64(int64(v.(int)))
-	}
-
 	if v, ok := d.GetOk("secret_key"); ok {
 		input.SecretKey = aws.String(v.(string))
 	}
@@ -136,6 +132,14 @@ func resourceLocationObjectStorageCreate(ctx context.Context, d *schema.Resource
 		input.ServerCertificate = []byte(v.(string))
 	}
 
+	if v, ok := d.GetOk("server_port"); ok {
+		input.ServerPort = aws.Int64(int64(v.(int)))
+	}
+
+	if v, ok := d.GetOk("server_protocol"); ok {
+		input.ServerProtocol = aws.String(v.(string))
+	}
+
 	output, err := conn.CreateLocationObjectStorageWithContext(ctx, input)
 
 	if err != nil {
@@ -165,7 +169,6 @@ func resourceLocationObjectStorageRead(ctx context.Context, d *schema.ResourceDa
 
 	uri := aws.StringValue(output.LocationUri)
 	hostname, bucketName, subdirectory, err := decodeObjectStorageURI(uri)
-
 	if err != nil {
 		return sdkdiag.AppendFromErr(diags, err)
 	}
@@ -231,12 +234,10 @@ func resourceLocationObjectStorageDelete(ctx context.Context, d *schema.Resource
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).DataSyncConn(ctx)
 
-	input := &datasync.DeleteLocationInput{
-		LocationArn: aws.String(d.Id()),
-	}
-
 	log.Printf("[DEBUG] Deleting DataSync Location Object Storage: %s", d.Id())
-	_, err := conn.DeleteLocationWithContext(ctx, input)
+	_, err := conn.DeleteLocationWithContext(ctx, &datasync.DeleteLocationInput{
+		LocationArn: aws.String(d.Id()),
+	})
 
 	if tfawserr.ErrMessageContains(err, datasync.ErrCodeInvalidRequestException, "not found") {
 		return diags
@@ -249,6 +250,31 @@ func resourceLocationObjectStorageDelete(ctx context.Context, d *schema.Resource
 	return diags
 }
 
+func FindLocationObjectStorageByARN(ctx context.Context, conn *datasync.DataSync, arn string) (*datasync.DescribeLocationObjectStorageOutput, error) {
+	input := &datasync.DescribeLocationObjectStorageInput{
+		LocationArn: aws.String(arn),
+	}
+
+	output, err := conn.DescribeLocationObjectStorageWithContext(ctx, input)
+
+	if tfawserr.ErrMessageContains(err, datasync.ErrCodeInvalidRequestException, "not found") {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	if output == nil {
+		return nil, tfresource.NewEmptyResultError(input)
+	}
+
+	return output, nil
+}
+
 func decodeObjectStorageURI(uri string) (string, string, string, error) {
 	prefix := "object-storage://"
 	if !strings.HasPrefix(uri, prefix) {
diff --git a/internal/service/datasync/location_object_storage_test.go b/internal/service/datasync/location_object_storage_test.go
index dc3ea896edc..e133dee0250 100644
--- a/internal/service/datasync/location_object_storage_test.go
+++ b/internal/service/datasync/location_object_storage_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package datasync_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/datasync"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -18,7 +21,7 @@ import (
 
 func TestAccDataSyncLocationObjectStorage_basic(t *testing.T) {
 	ctx := acctest.Context(t)
-	var locationObjectStorage datasync.DescribeLocationObjectStorageOutput
+	var v datasync.DescribeLocationObjectStorageOutput
 	resourceName := "aws_datasync_location_object_storage.test"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	domain := acctest.RandomDomainName()
@@ -32,10 +35,10 @@ func TestAccDataSyncLocationObjectStorage_basic(t *testing.T) {
 			{
 				Config: testAccLocationObjectStorageConfig_basic(rName, domain),
 				Check: resource.ComposeAggregateTestCheckFunc(
-					testAccCheckLocationObjectStorageExists(ctx, resourceName, &locationObjectStorage),
+					testAccCheckLocationObjectStorageExists(ctx, resourceName, &v),
 					resource.TestCheckResourceAttr(resourceName, "access_key", ""),
 					resource.TestCheckResourceAttr(resourceName, "agent_arns.#", "1"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "datasync", regexp.MustCompile(`location/loc-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "datasync", regexache.MustCompile(`location/loc-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "bucket_name", rName),
 					resource.TestCheckNoResourceAttr(resourceName, "secret_key"),
 					resource.TestCheckResourceAttr(resourceName, "server_certificate", ""),
@@ -58,7 +61,7 @@ func TestAccDataSyncLocationObjectStorage_basic(t *testing.T) {
 
 func TestAccDataSyncLocationObjectStorage_disappears(t *testing.T) {
 	ctx := acctest.Context(t)
-	var locationObjectStorage datasync.DescribeLocationObjectStorageOutput
+	var v datasync.DescribeLocationObjectStorageOutput
 	resourceName := "aws_datasync_location_object_storage.test"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	domain := acctest.RandomDomainName()
@@ -72,7 +75,7 @@ func TestAccDataSyncLocationObjectStorage_disappears(t *testing.T) {
 			{
 				Config: testAccLocationObjectStorageConfig_basic(rName, domain),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckLocationObjectStorageExists(ctx, resourceName, &locationObjectStorage),
+					testAccCheckLocationObjectStorageExists(ctx, resourceName, &v),
 					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfdatasync.ResourceLocationObjectStorage(), resourceName),
 				),
 				ExpectNonEmptyPlan: true,
@@ -83,7 +86,7 @@ func TestAccDataSyncLocationObjectStorage_disappears(t *testing.T) {
 
 func TestAccDataSyncLocationObjectStorage_tags(t *testing.T) {
 	ctx := acctest.Context(t)
-	var locationObjectStorage datasync.DescribeLocationObjectStorageOutput
+	var v datasync.DescribeLocationObjectStorageOutput
 	resourceName := "aws_datasync_location_object_storage.test"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	domain := acctest.RandomDomainName()
@@ -97,7 +100,7 @@ func TestAccDataSyncLocationObjectStorage_tags(t *testing.T) {
 			{
 				Config: testAccLocationObjectStorageConfig_tags1(rName, domain, "key1", "value1"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckLocationObjectStorageExists(ctx, resourceName, &locationObjectStorage),
+					testAccCheckLocationObjectStorageExists(ctx, resourceName, &v),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
 				),
@@ -110,7 +113,7 @@ func TestAccDataSyncLocationObjectStorage_tags(t *testing.T) {
 			{
 				Config: testAccLocationObjectStorageConfig_tags2(rName, domain, "key1", "value1updated", "key2", "value2"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckLocationObjectStorageExists(ctx, resourceName, &locationObjectStorage),
+					testAccCheckLocationObjectStorageExists(ctx, resourceName, &v),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1updated"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
@@ -119,7 +122,7 @@ func TestAccDataSyncLocationObjectStorage_tags(t *testing.T) {
 			{
 				Config: testAccLocationObjectStorageConfig_tags1(rName, domain, "key1", "value1"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckLocationObjectStorageExists(ctx, resourceName, &locationObjectStorage),
+					testAccCheckLocationObjectStorageExists(ctx, resourceName, &v),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
 				),
@@ -130,7 +133,7 @@ func TestAccDataSyncLocationObjectStorage_tags(t *testing.T) {
 
 func TestAccDataSyncLocationObjectStorage_serverCertificate(t *testing.T) {
 	ctx := acctest.Context(t)
-	var locationObjectStorage datasync.DescribeLocationObjectStorageOutput
+	var v datasync.DescribeLocationObjectStorageOutput
 	resourceName := "aws_datasync_location_object_storage.test"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	domain := acctest.RandomDomainName()
@@ -146,7 +149,7 @@ func TestAccDataSyncLocationObjectStorage_serverCertificate(t *testing.T) {
 			{
 				Config: testAccLocationObjectStorageConfig_serverCertificate(rName, domain, caCertificate),
 				Check: resource.ComposeAggregateTestCheckFunc(
-					testAccCheckLocationObjectStorageExists(ctx, resourceName, &locationObjectStorage),
+					testAccCheckLocationObjectStorageExists(ctx, resourceName, &v),
 					resource.TestCheckResourceAttr(resourceName, "bucket_name", rName),
 					resource.TestCheckResourceAttr(resourceName, "server_certificate", caCertificate),
 					resource.TestCheckResourceAttr(resourceName, "server_hostname", domain),
@@ -213,74 +216,7 @@ func testAccCheckLocationObjectStorageExists(ctx context.Context, n string, v *d
 }
 
 func testAccLocationObjectStorageConfig_base(rName string) string {
-	return acctest.ConfigCompose(
-		acctest.ConfigVPCWithSubnets(rName, 1),
-		// Reference: https://docs.aws.amazon.com/datasync/latest/userguide/agent-requirements.html
-		acctest.AvailableEC2InstanceTypeForAvailabilityZone("aws_subnet.test[0].availability_zone", "m5.2xlarge", "m5.4xlarge"),
-		fmt.Sprintf(`
-# Reference: https://docs.aws.amazon.com/datasync/latest/userguide/deploy-agents.html
-data "aws_ssm_parameter" "aws_service_datasync_ami" {
-  name = "/aws/service/datasync/ami"
-}
-
-resource "aws_internet_gateway" "test" {
-  vpc_id = aws_vpc.test.id
-
-  tags = {
-    Name = %[1]q
-  }
-}
-
-resource "aws_default_route_table" "test" {
-  default_route_table_id = aws_vpc.test.default_route_table_id
-
-  route {
-    cidr_block = "0.0.0.0/0"
-    gateway_id = aws_internet_gateway.test.id
-  }
-
-  tags = {
-    Name = %[1]q
-  }
-}
-
-resource "aws_security_group" "test" {
-  name   = %[1]q
-  vpc_id = aws_vpc.test.id
-
-  egress {
-    from_port   = 0
-    to_port     = 0
-    protocol    = "-1"
-    cidr_blocks = ["0.0.0.0/0"]
-  }
-
-  ingress {
-    from_port   = 0
-    to_port     = 0
-    protocol    = "-1"
-    cidr_blocks = ["0.0.0.0/0"]
-  }
-
-  tags = {
-    Name = %[1]q
-  }
-}
-
-resource "aws_instance" "test" {
-  depends_on = [aws_default_route_table.test]
-
-  ami                         = data.aws_ssm_parameter.aws_service_datasync_ami.value
-  associate_public_ip_address = true
-  instance_type               = data.aws_ec2_instance_type_offering.available.instance_type
-  vpc_security_group_ids      = [aws_security_group.test.id]
-  subnet_id                   = aws_subnet.test[0].id
-
-  tags = {
-    Name = %[1]q
-  }
-}
-
+	return acctest.ConfigCompose(testAccAgentAgentConfig_base(rName), fmt.Sprintf(`
 resource "aws_datasync_agent" "test" {
   ip_address = aws_instance.test.public_ip
   name       = %[1]q
diff --git a/internal/service/datasync/location_s3.go b/internal/service/datasync/location_s3.go
index 911fa6f044c..e4211f2271e 100644
--- a/internal/service/datasync/location_s3.go
+++ b/internal/service/datasync/location_s3.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package datasync
 
 import (
@@ -29,15 +32,12 @@ func ResourceLocationS3() *schema.Resource {
 		ReadWithoutTimeout:   resourceLocationS3Read,
 		UpdateWithoutTimeout: resourceLocationS3Update,
 		DeleteWithoutTimeout: resourceLocationS3Delete,
+
 		Importer: &schema.ResourceImporter{
 			StateContext: schema.ImportStatePassthroughContext,
 		},
 
 		Schema: map[string]*schema.Schema{
-			"arn": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
 			"agent_arns": {
 				Type:     schema.TypeSet,
 				Optional: true,
@@ -47,6 +47,10 @@ func ResourceLocationS3() *schema.Resource {
 					ValidateFunc: verify.ValidARN,
 				},
 			},
+			"arn": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
 			"s3_bucket_arn": {
 				Type:         schema.TypeString,
 				Required:     true,
@@ -122,41 +126,31 @@ func resourceLocationS3Create(ctx context.Context, d *schema.ResourceData, meta
 		input.S3StorageClass = aws.String(v.(string))
 	}
 
-	log.Printf("[DEBUG] Creating DataSync Location S3: %s", input)
-
-	var output *datasync.CreateLocationS3Output
-	err := retry.RetryContext(ctx, propagationTimeout, func() *retry.RetryError {
-		var err error
-		output, err = conn.CreateLocationS3WithContext(ctx, input)
-
-		// Retry for IAM eventual consistency on error:
-		// InvalidRequestException: Unable to assume role. Reason: Access denied when calling sts:AssumeRole
-		if tfawserr.ErrMessageContains(err, datasync.ErrCodeInvalidRequestException, "Unable to assume role") {
-			return retry.RetryableError(err)
-		}
-
-		// Retry for IAM eventual consistency on error:
-		// InvalidRequestException: DataSync location access test failed: could not perform s3:ListObjectsV2 on bucket
-		if tfawserr.ErrMessageContains(err, datasync.ErrCodeInvalidRequestException, "access test failed") {
-			return retry.RetryableError(err)
-		}
-
-		if err != nil {
-			return retry.NonRetryableError(err)
-		}
-
-		return nil
-	})
-
-	if tfresource.TimedOut(err) {
-		output, err = conn.CreateLocationS3WithContext(ctx, input)
-	}
+	outputRaw, err := tfresource.RetryWhen(ctx, propagationTimeout,
+		func() (interface{}, error) {
+			return conn.CreateLocationS3WithContext(ctx, input)
+		},
+		func(err error) (bool, error) {
+			// Retry for IAM eventual consistency on error:
+			// InvalidRequestException: Unable to assume role. Reason: Access denied when calling sts:AssumeRole
+			if tfawserr.ErrMessageContains(err, datasync.ErrCodeInvalidRequestException, "Unable to assume role") {
+				return true, err
+			}
+
+			// Retry for IAM eventual consistency on error:
+			// InvalidRequestException: DataSync location access test failed: could not perform s3:ListObjectsV2 on bucket
+			if tfawserr.ErrMessageContains(err, datasync.ErrCodeInvalidRequestException, "access test failed") {
+				return true, err
+			}
+
+			return false, err
+		})
 
 	if err != nil {
 		return sdkdiag.AppendErrorf(diags, "creating DataSync Location S3: %s", err)
 	}
 
-	d.SetId(aws.StringValue(output.LocationArn))
+	d.SetId(aws.StringValue(outputRaw.(*datasync.CreateLocationS3Output).LocationArn))
 
 	return append(diags, resourceLocationS3Read(ctx, d, meta)...)
 }
@@ -165,15 +159,10 @@ func resourceLocationS3Read(ctx context.Context, d *schema.ResourceData, meta in
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).DataSyncConn(ctx)
 
-	input := &datasync.DescribeLocationS3Input{
-		LocationArn: aws.String(d.Id()),
-	}
-
-	log.Printf("[DEBUG] Reading DataSync Location S3: %s", input)
-	output, err := conn.DescribeLocationS3WithContext(ctx, input)
+	output, err := FindLocationS3ByARN(ctx, conn, d.Id())
 
-	if tfawserr.ErrMessageContains(err, "InvalidRequestException", "not found") {
-		log.Printf("[WARN] DataSync Location S3 %q not found - removing from state", d.Id())
+	if !d.IsNewResource() && tfresource.NotFound(err) {
+		log.Printf("[WARN] DataSync Location S3 (%s) not found, removing from state", d.Id())
 		d.SetId("")
 		return diags
 	}
@@ -182,20 +171,20 @@ func resourceLocationS3Read(ctx context.Context, d *schema.ResourceData, meta in
 		return sdkdiag.AppendErrorf(diags, "reading DataSync Location S3 (%s): %s", d.Id(), err)
 	}
 
+	uri := aws.StringValue(output.LocationUri)
 	subdirectory, err := subdirectoryFromLocationURI(aws.StringValue(output.LocationUri))
-
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "reading DataSync Location S3 (%s): %s", d.Id(), err)
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
-	d.Set("agent_arns", flex.FlattenStringSet(output.AgentArns))
+	d.Set("agent_arns", aws.StringValueSlice(output.AgentArns))
 	d.Set("arn", output.LocationArn)
 	if err := d.Set("s3_config", flattenS3Config(output.S3Config)); err != nil {
 		return sdkdiag.AppendErrorf(diags, "setting s3_config: %s", err)
 	}
 	d.Set("s3_storage_class", output.S3StorageClass)
 	d.Set("subdirectory", subdirectory)
-	d.Set("uri", output.LocationUri)
+	d.Set("uri", uri)
 
 	return diags
 }
@@ -212,14 +201,12 @@ func resourceLocationS3Delete(ctx context.Context, d *schema.ResourceData, meta
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).DataSyncConn(ctx)
 
-	input := &datasync.DeleteLocationInput{
+	log.Printf("[DEBUG] Deleting DataSync Location S3: %s", d.Id())
+	_, err := conn.DeleteLocationWithContext(ctx, &datasync.DeleteLocationInput{
 		LocationArn: aws.String(d.Id()),
-	}
-
-	log.Printf("[DEBUG] Deleting DataSync Location S3: %s", input)
-	_, err := conn.DeleteLocationWithContext(ctx, input)
+	})
 
-	if tfawserr.ErrMessageContains(err, "InvalidRequestException", "not found") {
+	if tfawserr.ErrMessageContains(err, datasync.ErrCodeInvalidRequestException, "not found") {
 		return diags
 	}
 
@@ -230,6 +217,31 @@ func resourceLocationS3Delete(ctx context.Context, d *schema.ResourceData, meta
 	return diags
 }
 
+func FindLocationS3ByARN(ctx context.Context, conn *datasync.DataSync, arn string) (*datasync.DescribeLocationS3Output, error) {
+	input := &datasync.DescribeLocationS3Input{
+		LocationArn: aws.String(arn),
+	}
+
+	output, err := conn.DescribeLocationS3WithContext(ctx, input)
+
+	if tfawserr.ErrMessageContains(err, datasync.ErrCodeInvalidRequestException, "not found") {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	if output == nil {
+		return nil, tfresource.NewEmptyResultError(input)
+	}
+
+	return output, nil
+}
+
 func flattenS3Config(s3Config *datasync.S3Config) []interface{} {
 	if s3Config == nil {
 		return []interface{}{}
diff --git a/internal/service/datasync/location_s3_test.go b/internal/service/datasync/location_s3_test.go
index c9cee27c546..6fa8054df42 100644
--- a/internal/service/datasync/location_s3_test.go
+++ b/internal/service/datasync/location_s3_test.go
@@ -1,26 +1,27 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package datasync_test
 
 import (
 	"context"
-	"errors"
 	"fmt"
-	"regexp"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/aws"
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/datasync"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	tfdatasync "github.com/hashicorp/terraform-provider-aws/internal/service/datasync"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
 func TestAccDataSyncLocationS3_basic(t *testing.T) {
 	ctx := acctest.Context(t)
-	var locationS31 datasync.DescribeLocationS3Output
+	var v datasync.DescribeLocationS3Output
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	iamRoleResourceName := "aws_iam_role.test"
 	resourceName := "aws_datasync_location_s3.test"
@@ -35,16 +36,16 @@ func TestAccDataSyncLocationS3_basic(t *testing.T) {
 			{
 				Config: testAccLocationS3Config_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckLocationS3Exists(ctx, resourceName, &locationS31),
+					testAccCheckLocationS3Exists(ctx, resourceName, &v),
 					resource.TestCheckResourceAttr(resourceName, "agent_arns.#", "0"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "datasync", regexp.MustCompile(`location/loc-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "datasync", regexache.MustCompile(`location/loc-.+`)),
 					resource.TestCheckResourceAttrPair(resourceName, "s3_bucket_arn", s3BucketResourceName, "arn"),
 					resource.TestCheckResourceAttr(resourceName, "s3_config.#", "1"),
 					resource.TestCheckResourceAttrPair(resourceName, "s3_config.0.bucket_access_role_arn", iamRoleResourceName, "arn"),
 					resource.TestCheckResourceAttrSet(resourceName, "s3_storage_class"),
 					resource.TestCheckResourceAttr(resourceName, "subdirectory", "/test/"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
-					resource.TestMatchResourceAttr(resourceName, "uri", regexp.MustCompile(`^s3://.+/`)),
+					resource.TestMatchResourceAttr(resourceName, "uri", regexache.MustCompile(`^s3://.+/`)),
 				),
 			},
 			{
@@ -59,7 +60,7 @@ func TestAccDataSyncLocationS3_basic(t *testing.T) {
 
 func TestAccDataSyncLocationS3_storageClass(t *testing.T) {
 	ctx := acctest.Context(t)
-	var locationS31 datasync.DescribeLocationS3Output
+	var v datasync.DescribeLocationS3Output
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	iamRoleResourceName := "aws_iam_role.test"
 	resourceName := "aws_datasync_location_s3.test"
@@ -74,14 +75,14 @@ func TestAccDataSyncLocationS3_storageClass(t *testing.T) {
 			{
 				Config: testAccLocationS3Config_storageClass(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckLocationS3Exists(ctx, resourceName, &locationS31),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "datasync", regexp.MustCompile(`location/loc-.+`)),
+					testAccCheckLocationS3Exists(ctx, resourceName, &v),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "datasync", regexache.MustCompile(`location/loc-.+`)),
 					resource.TestCheckResourceAttrPair(resourceName, "s3_bucket_arn", s3BucketResourceName, "arn"),
 					resource.TestCheckResourceAttr(resourceName, "s3_config.#", "1"),
 					resource.TestCheckResourceAttrPair(resourceName, "s3_config.0.bucket_access_role_arn", iamRoleResourceName, "arn"),
 					resource.TestCheckResourceAttr(resourceName, "subdirectory", "/test/"),
 					resource.TestCheckResourceAttr(resourceName, "s3_storage_class", "STANDARD_IA"),
-					resource.TestMatchResourceAttr(resourceName, "uri", regexp.MustCompile(`^s3://.+/`)),
+					resource.TestMatchResourceAttr(resourceName, "uri", regexache.MustCompile(`^s3://.+/`)),
 				),
 			},
 			{
@@ -96,7 +97,7 @@ func TestAccDataSyncLocationS3_storageClass(t *testing.T) {
 
 func TestAccDataSyncLocationS3_disappears(t *testing.T) {
 	ctx := acctest.Context(t)
-	var locationS31 datasync.DescribeLocationS3Output
+	var v datasync.DescribeLocationS3Output
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_datasync_location_s3.test"
 
@@ -109,9 +110,9 @@ func TestAccDataSyncLocationS3_disappears(t *testing.T) {
 			{
 				Config: testAccLocationS3Config_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckLocationS3Exists(ctx, resourceName, &locationS31),
+					testAccCheckLocationS3Exists(ctx, resourceName, &v),
 					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfdatasync.ResourceLocationS3(), resourceName),
-					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfdatasync.ResourceLocationS3(), resourceName)),
+				),
 				ExpectNonEmptyPlan: true,
 			},
 		},
@@ -120,7 +121,7 @@ func TestAccDataSyncLocationS3_disappears(t *testing.T) {
 
 func TestAccDataSyncLocationS3_tags(t *testing.T) {
 	ctx := acctest.Context(t)
-	var locationS31, locationS32, locationS33 datasync.DescribeLocationS3Output
+	var v datasync.DescribeLocationS3Output
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_datasync_location_s3.test"
 
@@ -133,7 +134,7 @@ func TestAccDataSyncLocationS3_tags(t *testing.T) {
 			{
 				Config: testAccLocationS3Config_tags1(rName, "key1", "value1"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckLocationS3Exists(ctx, resourceName, &locationS31),
+					testAccCheckLocationS3Exists(ctx, resourceName, &v),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
 				),
@@ -147,8 +148,7 @@ func TestAccDataSyncLocationS3_tags(t *testing.T) {
 			{
 				Config: testAccLocationS3Config_tags2(rName, "key1", "value1updated", "key2", "value2"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckLocationS3Exists(ctx, resourceName, &locationS32),
-					testAccCheckLocationS3NotRecreated(&locationS31, &locationS32),
+					testAccCheckLocationS3Exists(ctx, resourceName, &v),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1updated"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
@@ -157,8 +157,7 @@ func TestAccDataSyncLocationS3_tags(t *testing.T) {
 			{
 				Config: testAccLocationS3Config_tags1(rName, "key1", "value1"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckLocationS3Exists(ctx, resourceName, &locationS33),
-					testAccCheckLocationS3NotRecreated(&locationS32, &locationS33),
+					testAccCheckLocationS3Exists(ctx, resourceName, &v),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
 				),
@@ -176,64 +175,45 @@ func testAccCheckLocationS3Destroy(ctx context.Context) resource.TestCheckFunc {
 				continue
 			}
 
-			input := &datasync.DescribeLocationS3Input{
-				LocationArn: aws.String(rs.Primary.ID),
-			}
-
-			_, err := conn.DescribeLocationS3WithContext(ctx, input)
+			_, err := tfdatasync.FindLocationS3ByARN(ctx, conn, rs.Primary.ID)
 
-			if tfawserr.ErrMessageContains(err, "InvalidRequestException", "not found") {
-				return nil
+			if tfresource.NotFound(err) {
+				continue
 			}
 
 			if err != nil {
 				return err
 			}
+
+			return fmt.Errorf("DataSync Location S3 %s still exists", rs.Primary.ID)
 		}
 
 		return nil
 	}
 }
 
-func testAccCheckLocationS3Exists(ctx context.Context, resourceName string, locationS3 *datasync.DescribeLocationS3Output) resource.TestCheckFunc {
+func testAccCheckLocationS3Exists(ctx context.Context, n string, v *datasync.DescribeLocationS3Output) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		rs, ok := s.RootModule().Resources[resourceName]
+		rs, ok := s.RootModule().Resources[n]
 		if !ok {
-			return fmt.Errorf("Not found: %s", resourceName)
+			return fmt.Errorf("Not found: %s", n)
 		}
 
 		conn := acctest.Provider.Meta().(*conns.AWSClient).DataSyncConn(ctx)
-		input := &datasync.DescribeLocationS3Input{
-			LocationArn: aws.String(rs.Primary.ID),
-		}
 
-		output, err := conn.DescribeLocationS3WithContext(ctx, input)
+		output, err := tfdatasync.FindLocationS3ByARN(ctx, conn, rs.Primary.ID)
 
 		if err != nil {
 			return err
 		}
 
-		if output == nil {
-			return fmt.Errorf("Location %q does not exist", rs.Primary.ID)
-		}
-
-		*locationS3 = *output
-
-		return nil
-	}
-}
-
-func testAccCheckLocationS3NotRecreated(i, j *datasync.DescribeLocationS3Output) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		if !aws.TimeValue(i.CreationTime).Equal(aws.TimeValue(j.CreationTime)) {
-			return errors.New("DataSync Location S3 was recreated")
-		}
+		*v = *output
 
 		return nil
 	}
 }
 
-func testAccLocationS3BaseConfig(rName string) string {
+func testAccLocationS3Config_base(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_iam_role" "test" {
   name = %[1]q
@@ -281,7 +261,7 @@ resource "aws_s3_bucket" "test" {
 }
 
 func testAccLocationS3Config_basic(rName string) string {
-	return testAccLocationS3BaseConfig(rName) + `
+	return acctest.ConfigCompose(testAccLocationS3Config_base(rName), `
 resource "aws_datasync_location_s3" "test" {
   s3_bucket_arn = aws_s3_bucket.test.arn
   subdirectory  = "/test"
@@ -290,11 +270,11 @@ resource "aws_datasync_location_s3" "test" {
     bucket_access_role_arn = aws_iam_role.test.arn
   }
 }
-`
+`)
 }
 
 func testAccLocationS3Config_storageClass(rName string) string {
-	return testAccLocationS3BaseConfig(rName) + `
+	return acctest.ConfigCompose(testAccLocationS3Config_base(rName), `
 resource "aws_datasync_location_s3" "test" {
   s3_bucket_arn    = aws_s3_bucket.test.arn
   subdirectory     = "/test"
@@ -304,11 +284,11 @@ resource "aws_datasync_location_s3" "test" {
     bucket_access_role_arn = aws_iam_role.test.arn
   }
 }
-`
+`)
 }
 
 func testAccLocationS3Config_tags1(rName, key1, value1 string) string {
-	return testAccLocationS3BaseConfig(rName) + fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccLocationS3Config_base(rName), fmt.Sprintf(`
 resource "aws_datasync_location_s3" "test" {
   s3_bucket_arn = aws_s3_bucket.test.arn
   subdirectory  = "/test"
@@ -318,14 +298,14 @@ resource "aws_datasync_location_s3" "test" {
   }
 
   tags = {
-    %q = %q
+    %[1]q = %[2]q
   }
 }
-`, key1, value1)
+`, key1, value1))
 }
 
 func testAccLocationS3Config_tags2(rName, key1, value1, key2, value2 string) string {
-	return testAccLocationS3BaseConfig(rName) + fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccLocationS3Config_base(rName), fmt.Sprintf(`
 resource "aws_datasync_location_s3" "test" {
   s3_bucket_arn = aws_s3_bucket.test.arn
   subdirectory  = "/test"
@@ -335,9 +315,9 @@ resource "aws_datasync_location_s3" "test" {
   }
 
   tags = {
-    %q = %q
-    %q = %q
+    %[1]q = %[2]q
+    %[3]q = %[4]q
   }
 }
-`, key1, value1, key2, value2)
+`, key1, value1, key2, value2))
 }
diff --git a/internal/service/datasync/location_smb.go b/internal/service/datasync/location_smb.go
index 3def2d573c6..ba7dcd526a2 100644
--- a/internal/service/datasync/location_smb.go
+++ b/internal/service/datasync/location_smb.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package datasync
 
 import (
@@ -8,12 +11,14 @@ import (
 	"github.com/aws/aws-sdk-go/service/datasync"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
 	"github.com/hashicorp/terraform-provider-aws/internal/flex"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -26,15 +31,12 @@ func ResourceLocationSMB() *schema.Resource {
 		ReadWithoutTimeout:   resourceLocationSMBRead,
 		UpdateWithoutTimeout: resourceLocationSMBUpdate,
 		DeleteWithoutTimeout: resourceLocationSMBDelete,
+
 		Importer: &schema.ResourceImporter{
 			StateContext: schema.ImportStatePassthroughContext,
 		},
 
 		Schema: map[string]*schema.Schema{
-			"arn": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
 			"agent_arns": {
 				Type:     schema.TypeSet,
 				Required: true,
@@ -43,6 +45,10 @@ func ResourceLocationSMB() *schema.Resource {
 					ValidateFunc: verify.ValidARN,
 				},
 			},
+			"arn": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
 			"domain": {
 				Type:         schema.TypeString,
 				Computed:     true,
@@ -129,6 +135,7 @@ func resourceLocationSMBCreate(ctx context.Context, d *schema.ResourceData, meta
 	}
 
 	output, err := conn.CreateLocationSmbWithContext(ctx, input)
+
 	if err != nil {
 		return sdkdiag.AppendErrorf(diags, "creating DataSync Location SMB: %s", err)
 	}
@@ -142,15 +149,10 @@ func resourceLocationSMBRead(ctx context.Context, d *schema.ResourceData, meta i
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).DataSyncConn(ctx)
 
-	input := &datasync.DescribeLocationSmbInput{
-		LocationArn: aws.String(d.Id()),
-	}
-
-	log.Printf("[DEBUG] Reading DataSync Location SMB: %s", input)
-	output, err := conn.DescribeLocationSmbWithContext(ctx, input)
+	output, err := FindLocationSMBByARN(ctx, conn, d.Id())
 
-	if tfawserr.ErrMessageContains(err, "InvalidRequestException", "not found") {
-		log.Printf("[WARN] DataSync Location SMB %q not found - removing from state", d.Id())
+	if !d.IsNewResource() && tfresource.NotFound(err) {
+		log.Printf("[WARN] DataSync Location SMB (%s) not found, removing from state", d.Id())
 		d.SetId("")
 		return diags
 	}
@@ -159,25 +161,21 @@ func resourceLocationSMBRead(ctx context.Context, d *schema.ResourceData, meta i
 		return sdkdiag.AppendErrorf(diags, "reading DataSync Location SMB (%s): %s", d.Id(), err)
 	}
 
+	uri := aws.StringValue(output.LocationUri)
 	subdirectory, err := subdirectoryFromLocationURI(aws.StringValue(output.LocationUri))
-
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "reading DataSync Location SMB (%s) tags: %s", d.Id(), err)
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
-	d.Set("agent_arns", flex.FlattenStringSet(output.AgentArns))
-
+	d.Set("agent_arns", aws.StringValueSlice(output.AgentArns))
 	d.Set("arn", output.LocationArn)
-
 	d.Set("domain", output.Domain)
-
 	if err := d.Set("mount_options", flattenSMBMountOptions(output.MountOptions)); err != nil {
 		return sdkdiag.AppendErrorf(diags, "setting mount_options: %s", err)
 	}
-
 	d.Set("subdirectory", subdirectory)
+	d.Set("uri", uri)
 	d.Set("user", output.User)
-	d.Set("uri", output.LocationUri)
 
 	return diags
 }
@@ -186,7 +184,7 @@ func resourceLocationSMBUpdate(ctx context.Context, d *schema.ResourceData, meta
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).DataSyncConn(ctx)
 
-	if d.HasChangesExcept("tags_all", "tags") {
+	if d.HasChangesExcept("tags", "tags_all") {
 		input := &datasync.UpdateLocationSmbInput{
 			LocationArn:  aws.String(d.Id()),
 			AgentArns:    flex.ExpandStringSet(d.Get("agent_arns").(*schema.Set)),
@@ -201,6 +199,7 @@ func resourceLocationSMBUpdate(ctx context.Context, d *schema.ResourceData, meta
 		}
 
 		_, err := conn.UpdateLocationSmbWithContext(ctx, input)
+
 		if err != nil {
 			return sdkdiag.AppendErrorf(diags, "updating DataSync Location SMB (%s): %s", d.Id(), err)
 		}
@@ -213,14 +212,12 @@ func resourceLocationSMBDelete(ctx context.Context, d *schema.ResourceData, meta
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).DataSyncConn(ctx)
 
-	input := &datasync.DeleteLocationInput{
+	log.Printf("[DEBUG] Deleting DataSync Location SMB: %s", d.Id())
+	_, err := conn.DeleteLocationWithContext(ctx, &datasync.DeleteLocationInput{
 		LocationArn: aws.String(d.Id()),
-	}
+	})
 
-	log.Printf("[DEBUG] Deleting DataSync Location SMB: %s", input)
-	_, err := conn.DeleteLocationWithContext(ctx, input)
-
-	if tfawserr.ErrMessageContains(err, "InvalidRequestException", "not found") {
+	if tfawserr.ErrMessageContains(err, datasync.ErrCodeInvalidRequestException, "not found") {
 		return diags
 	}
 
@@ -231,6 +228,31 @@ func resourceLocationSMBDelete(ctx context.Context, d *schema.ResourceData, meta
 	return diags
 }
 
+func FindLocationSMBByARN(ctx context.Context, conn *datasync.DataSync, arn string) (*datasync.DescribeLocationSmbOutput, error) {
+	input := &datasync.DescribeLocationSmbInput{
+		LocationArn: aws.String(arn),
+	}
+
+	output, err := conn.DescribeLocationSmbWithContext(ctx, input)
+
+	if tfawserr.ErrMessageContains(err, datasync.ErrCodeInvalidRequestException, "not found") {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	if output == nil {
+		return nil, tfresource.NewEmptyResultError(input)
+	}
+
+	return output, nil
+}
+
 func flattenSMBMountOptions(mountOptions *datasync.SmbMountOptions) []interface{} {
 	if mountOptions == nil {
 		return []interface{}{}
diff --git a/internal/service/datasync/location_smb_test.go b/internal/service/datasync/location_smb_test.go
index 43a989fe680..cc9cdaf21a2 100644
--- a/internal/service/datasync/location_smb_test.go
+++ b/internal/service/datasync/location_smb_test.go
@@ -1,26 +1,27 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package datasync_test
 
 import (
 	"context"
-	"errors"
 	"fmt"
-	"regexp"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/aws"
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/datasync"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	tfdatasync "github.com/hashicorp/terraform-provider-aws/internal/service/datasync"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
 func TestAccDataSyncLocationSMB_basic(t *testing.T) {
 	ctx := acctest.Context(t)
-	var locationSmb1 datasync.DescribeLocationSmbOutput
-
+	var v datasync.DescribeLocationSmbOutput
 	resourceName := "aws_datasync_location_smb.test"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
@@ -33,14 +34,14 @@ func TestAccDataSyncLocationSMB_basic(t *testing.T) {
 			{
 				Config: testAccLocationSMBConfig_basic(rName, "/test/"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckLocationSMBExists(ctx, resourceName, &locationSmb1),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "datasync", regexp.MustCompile(`location/loc-.+`)),
+					testAccCheckLocationSMBExists(ctx, resourceName, &v),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "datasync", regexache.MustCompile(`location/loc-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "agent_arns.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "mount_options.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "mount_options.0.version", "AUTOMATIC"),
 					resource.TestCheckResourceAttr(resourceName, "user", "Guest"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
-					resource.TestMatchResourceAttr(resourceName, "uri", regexp.MustCompile(`^smb://.+/`)),
+					resource.TestMatchResourceAttr(resourceName, "uri", regexache.MustCompile(`^smb://.+/`)),
 				),
 			},
 			{
@@ -52,14 +53,14 @@ func TestAccDataSyncLocationSMB_basic(t *testing.T) {
 			{
 				Config: testAccLocationSMBConfig_basic(rName, "/test2/"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckLocationSMBExists(ctx, resourceName, &locationSmb1),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "datasync", regexp.MustCompile(`location/loc-.+`)),
+					testAccCheckLocationSMBExists(ctx, resourceName, &v),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "datasync", regexache.MustCompile(`location/loc-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "agent_arns.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "mount_options.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "mount_options.0.version", "AUTOMATIC"),
 					resource.TestCheckResourceAttr(resourceName, "user", "Guest"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
-					resource.TestMatchResourceAttr(resourceName, "uri", regexp.MustCompile(`^smb://.+/`)),
+					resource.TestMatchResourceAttr(resourceName, "uri", regexache.MustCompile(`^smb://.+/`)),
 				),
 			},
 		},
@@ -68,7 +69,7 @@ func TestAccDataSyncLocationSMB_basic(t *testing.T) {
 
 func TestAccDataSyncLocationSMB_disappears(t *testing.T) {
 	ctx := acctest.Context(t)
-	var locationSmb1 datasync.DescribeLocationSmbOutput
+	var v datasync.DescribeLocationSmbOutput
 	resourceName := "aws_datasync_location_smb.test"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
@@ -81,8 +82,8 @@ func TestAccDataSyncLocationSMB_disappears(t *testing.T) {
 			{
 				Config: testAccLocationSMBConfig_basic(rName, "/test/"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckLocationSMBExists(ctx, resourceName, &locationSmb1),
-					testAccCheckLocationSMBDisappears(ctx, &locationSmb1),
+					testAccCheckLocationSMBExists(ctx, resourceName, &v),
+					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfdatasync.ResourceLocationSMB(), resourceName),
 				),
 				ExpectNonEmptyPlan: true,
 			},
@@ -92,7 +93,7 @@ func TestAccDataSyncLocationSMB_disappears(t *testing.T) {
 
 func TestAccDataSyncLocationSMB_tags(t *testing.T) {
 	ctx := acctest.Context(t)
-	var locationSmb1, locationSmb2, locationSmb3 datasync.DescribeLocationSmbOutput
+	var v datasync.DescribeLocationSmbOutput
 	resourceName := "aws_datasync_location_smb.test"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
@@ -105,7 +106,7 @@ func TestAccDataSyncLocationSMB_tags(t *testing.T) {
 			{
 				Config: testAccLocationSMBConfig_tags1(rName, "key1", "value1"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckLocationSMBExists(ctx, resourceName, &locationSmb1),
+					testAccCheckLocationSMBExists(ctx, resourceName, &v),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
 				),
@@ -119,8 +120,7 @@ func TestAccDataSyncLocationSMB_tags(t *testing.T) {
 			{
 				Config: testAccLocationSMBConfig_tags2(rName, "key1", "value1updated", "key2", "value2"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckLocationSMBExists(ctx, resourceName, &locationSmb2),
-					testAccCheckLocationSMBNotRecreated(&locationSmb1, &locationSmb2),
+					testAccCheckLocationSMBExists(ctx, resourceName, &v),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1updated"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
@@ -129,8 +129,7 @@ func TestAccDataSyncLocationSMB_tags(t *testing.T) {
 			{
 				Config: testAccLocationSMBConfig_tags1(rName, "key1", "value1"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckLocationSMBExists(ctx, resourceName, &locationSmb3),
-					testAccCheckLocationSMBNotRecreated(&locationSmb2, &locationSmb3),
+					testAccCheckLocationSMBExists(ctx, resourceName, &v),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
 				),
@@ -148,148 +147,46 @@ func testAccCheckLocationSMBDestroy(ctx context.Context) resource.TestCheckFunc
 				continue
 			}
 
-			input := &datasync.DescribeLocationSmbInput{
-				LocationArn: aws.String(rs.Primary.ID),
-			}
-
-			_, err := conn.DescribeLocationSmbWithContext(ctx, input)
+			_, err := tfdatasync.FindLocationSMBByARN(ctx, conn, rs.Primary.ID)
 
-			if tfawserr.ErrMessageContains(err, "InvalidRequestException", "not found") {
-				return nil
+			if tfresource.NotFound(err) {
+				continue
 			}
 
 			if err != nil {
 				return err
 			}
+
+			return fmt.Errorf("DataSync Location SMB %s still exists", rs.Primary.ID)
 		}
 
 		return nil
 	}
 }
 
-func testAccCheckLocationSMBExists(ctx context.Context, resourceName string, locationSmb *datasync.DescribeLocationSmbOutput) resource.TestCheckFunc {
+func testAccCheckLocationSMBExists(ctx context.Context, n string, v *datasync.DescribeLocationSmbOutput) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		rs, ok := s.RootModule().Resources[resourceName]
+		rs, ok := s.RootModule().Resources[n]
 		if !ok {
-			return fmt.Errorf("Not found: %s", resourceName)
+			return fmt.Errorf("Not found: %s", n)
 		}
 
 		conn := acctest.Provider.Meta().(*conns.AWSClient).DataSyncConn(ctx)
-		input := &datasync.DescribeLocationSmbInput{
-			LocationArn: aws.String(rs.Primary.ID),
-		}
 
-		output, err := conn.DescribeLocationSmbWithContext(ctx, input)
+		output, err := tfdatasync.FindLocationSMBByARN(ctx, conn, rs.Primary.ID)
 
 		if err != nil {
 			return err
 		}
 
-		if output == nil {
-			return fmt.Errorf("Location %q does not exist", rs.Primary.ID)
-		}
-
-		*locationSmb = *output
-
-		return nil
-	}
-}
-
-func testAccCheckLocationSMBDisappears(ctx context.Context, location *datasync.DescribeLocationSmbOutput) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		conn := acctest.Provider.Meta().(*conns.AWSClient).DataSyncConn(ctx)
-
-		input := &datasync.DeleteLocationInput{
-			LocationArn: location.LocationArn,
-		}
-
-		_, err := conn.DeleteLocationWithContext(ctx, input)
-
-		return err
-	}
-}
-
-func testAccCheckLocationSMBNotRecreated(i, j *datasync.DescribeLocationSmbOutput) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		if !aws.TimeValue(i.CreationTime).Equal(aws.TimeValue(j.CreationTime)) {
-			return errors.New("DataSync Location SMB was recreated")
-		}
+		*v = *output
 
 		return nil
 	}
 }
 
 func testAccLocationSMBConfig_base(rName string) string {
-	return acctest.ConfigCompose(
-		acctest.ConfigVPCWithSubnets(rName, 1),
-		// Reference: https://docs.aws.amazon.com/datasync/latest/userguide/agent-requirements.html
-		acctest.AvailableEC2InstanceTypeForAvailabilityZone("data.aws_availability_zones.available.names[0]", "m5.2xlarge", "m5.4xlarge"),
-		fmt.Sprintf(`
-data "aws_partition" "current" {}
-
-# Reference: https://docs.aws.amazon.com/datasync/latest/userguide/deploy-agents.html
-data "aws_ssm_parameter" "aws_service_datasync_ami" {
-  name = "/aws/service/datasync/ami"
-}
-
-resource "aws_internet_gateway" "test" {
-  vpc_id = aws_vpc.test.id
-
-  tags = {
-    Name = %[1]q
-  }
-}
-
-resource "aws_default_route_table" "test" {
-  default_route_table_id = aws_vpc.test.default_route_table_id
-
-  route {
-    cidr_block = "0.0.0.0/0"
-    gateway_id = aws_internet_gateway.test.id
-  }
-
-  tags = {
-    Name = %[1]q
-  }
-}
-
-resource "aws_security_group" "test" {
-  name   = %[1]q
-  vpc_id = aws_vpc.test.id
-
-  egress {
-    from_port   = 0
-    to_port     = 0
-    protocol    = "-1"
-    cidr_blocks = ["0.0.0.0/0"]
-  }
-
-  ingress {
-    from_port   = 0
-    to_port     = 0
-    protocol    = "-1"
-    cidr_blocks = ["0.0.0.0/0"]
-  }
-
-  tags = {
-    Name = %[1]q
-  }
-}
-
-resource "aws_instance" "test" {
-  depends_on = [aws_default_route_table.test]
-
-  ami                         = data.aws_ssm_parameter.aws_service_datasync_ami.value
-  associate_public_ip_address = true
-  instance_type               = data.aws_ec2_instance_type_offering.available.instance_type
-  vpc_security_group_ids      = [aws_security_group.test.id]
-  subnet_id                   = aws_subnet.test[0].id
-
-  tags = {
-    Name = %[1]q
-  }
-}
-
+	return acctest.ConfigCompose(testAccAgentAgentConfig_base(rName), fmt.Sprintf(`
 resource "aws_datasync_agent" "test" {
   ip_address = aws_instance.test.public_ip
   name       = %[1]q
diff --git a/internal/service/datasync/service_package_gen.go b/internal/service/datasync/service_package_gen.go
index 8b0c2ceb39a..b0e13b9ed2e 100644
--- a/internal/service/datasync/service_package_gen.go
+++ b/internal/service/datasync/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	datasync_sdkv1 "github.com/aws/aws-sdk-go/service/datasync"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -36,6 +37,14 @@ func (p *servicePackage) SDKResources(ctx context.Context) []*types.ServicePacka
 				IdentifierAttribute: "id",
 			},
 		},
+		{
+			Factory:  ResourceLocationAzureBlob,
+			TypeName: "aws_datasync_location_azure_blob",
+			Name:     "Location Microsoft Azure Blob Storage",
+			Tags: &types.ServicePackageResourceTags{
+				IdentifierAttribute: "id",
+			},
+		},
 		{
 			Factory:  ResourceLocationEFS,
 			TypeName: "aws_datasync_location_efs",
@@ -47,7 +56,15 @@ func (p *servicePackage) SDKResources(ctx context.Context) []*types.ServicePacka
 		{
 			Factory:  ResourceLocationFSxLustreFileSystem,
 			TypeName: "aws_datasync_location_fsx_lustre_file_system",
-			Name:     "Location FSx Lustre File System",
+			Name:     "Location FSx for Lustre File System",
+			Tags: &types.ServicePackageResourceTags{
+				IdentifierAttribute: "id",
+			},
+		},
+		{
+			Factory:  ResourceLocationFSxONTAPFileSystem,
+			TypeName: "aws_datasync_location_fsx_ontap_file_system",
+			Name:     "Location FSx for NetApp ONTAP File System",
 			Tags: &types.ServicePackageResourceTags{
 				IdentifierAttribute: "id",
 			},
@@ -55,7 +72,7 @@ func (p *servicePackage) SDKResources(ctx context.Context) []*types.ServicePacka
 		{
 			Factory:  ResourceLocationFSxOpenZFSFileSystem,
 			TypeName: "aws_datasync_location_fsx_openzfs_file_system",
-			Name:     "Location OpenZFS File System",
+			Name:     "Location FSx for OpenZFS File System",
 			Tags: &types.ServicePackageResourceTags{
 				IdentifierAttribute: "id",
 			},
@@ -63,7 +80,7 @@ func (p *servicePackage) SDKResources(ctx context.Context) []*types.ServicePacka
 		{
 			Factory:  ResourceLocationFSxWindowsFileSystem,
 			TypeName: "aws_datasync_location_fsx_windows_file_system",
-			Name:     "Location FSx Windows File System",
+			Name:     "Location FSx for Windows File Server File System",
 			Tags: &types.ServicePackageResourceTags{
 				IdentifierAttribute: "id",
 			},
@@ -130,4 +147,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*d
 	return datasync_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/datasync/sweep.go b/internal/service/datasync/sweep.go
index 7b0fb2147ea..39aeba02857 100644
--- a/internal/service/datasync/sweep.go
+++ b/internal/service/datasync/sweep.go
@@ -1,65 +1,39 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package datasync
 
 import (
+	"context"
 	"fmt"
 	"log"
-	"strings"
+	"time"
 
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/datasync"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
-	"github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_datasync_agent", &resource.Sweeper{
 		Name: "aws_datasync_agent",
 		F:    sweepAgents,
+		Dependencies: []string{
+			"aws_datasync_location",
+		},
 	})
 
-	resource.AddTestSweepers("aws_datasync_location_efs", &resource.Sweeper{
-		Name: "aws_datasync_location_efs",
-		F:    sweepLocationEFSs,
-	})
-
-	resource.AddTestSweepers("aws_datasync_location_fsx_windows_file_system", &resource.Sweeper{
-		Name: "aws_datasync_location_fsx_windows_file_system",
-		F:    sweepLocationFSxWindows,
-	})
-
-	resource.AddTestSweepers("aws_datasync_location_fsx_lustre_file_system", &resource.Sweeper{
-		Name: "aws_datasync_location_fsx_lustre_file_system",
-		F:    sweepLocationFSxLustres,
-	})
-
-	resource.AddTestSweepers("aws_datasync_location_nfs", &resource.Sweeper{
-		Name: "aws_datasync_location_nfs",
-		F:    sweepLocationNFSs,
-	})
-
-	resource.AddTestSweepers("aws_datasync_location_s3", &resource.Sweeper{
-		Name: "aws_datasync_location_s3",
-		F:    sweepLocationS3s,
-	})
-
-	resource.AddTestSweepers("aws_datasync_location_smb", &resource.Sweeper{
-		Name: "aws_datasync_location_smb",
-		F:    sweepLocationSMBs,
-	})
-
-	resource.AddTestSweepers("aws_datasync_location_hdfs", &resource.Sweeper{
-		Name: "aws_datasync_location_hdfs",
-		F:    sweepLocationHDFSs,
-	})
-
-	resource.AddTestSweepers("aws_datasync_location_object_storage", &resource.Sweeper{
-		Name: "aws_datasync_location_object_storage",
-		F:    sweepLocationObjectStorages,
+	// Pseudo-resource for any DataSync location resource type.
+	resource.AddTestSweepers("aws_datasync_location", &resource.Sweeper{
+		Name: "aws_datasync_location",
+		F:    sweepLocations,
+		Dependencies: []string{
+			"aws_datasync_task",
+		},
 	})
 
 	resource.AddTestSweepers("aws_datasync_task", &resource.Sweeper{
@@ -70,572 +44,154 @@ func init() {
 
 func sweepAgents(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
 	conn := client.DataSyncConn(ctx)
-
 	input := &datasync.ListAgentsInput{}
-	for {
-		output, err := conn.ListAgentsWithContext(ctx, input)
-
-		if sweep.SkipSweepError(err) {
-			log.Printf("[WARN] Skipping DataSync Agent sweep for %s: %s", region, err)
-			return nil
-		}
-
-		if err != nil {
-			return fmt.Errorf("Error retrieving DataSync Agents: %s", err)
-		}
+	sweepResources := make([]sweep.Sweepable, 0)
 
-		if len(output.Agents) == 0 {
-			log.Print("[DEBUG] No DataSync Agents to sweep")
-			return nil
+	err = conn.ListAgentsPagesWithContext(ctx, input, func(page *datasync.ListAgentsOutput, lastPage bool) bool {
+		if page == nil {
+			return !lastPage
 		}
 
-		for _, agent := range output.Agents {
-			name := aws.StringValue(agent.Name)
-
-			log.Printf("[INFO] Deleting DataSync Agent: %s", name)
-			input := &datasync.DeleteAgentInput{
-				AgentArn: agent.AgentArn,
-			}
-
-			_, err := conn.DeleteAgentWithContext(ctx, input)
-
-			if tfawserr.ErrMessageContains(err, datasync.ErrCodeInvalidRequestException, "does not exist") {
-				continue
-			}
+		for _, v := range page.Agents {
+			r := ResourceAgent()
+			d := r.Data(nil)
+			d.SetId(aws.StringValue(v.AgentArn))
 
-			if err != nil {
-				log.Printf("[ERROR] Failed to delete DataSync Agent (%s): %s", name, err)
-			}
+			sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
 		}
 
-		if aws.StringValue(output.NextToken) == "" {
-			break
-		}
+		return !lastPage
+	})
 
-		input.NextToken = output.NextToken
+	if awsv1.SkipSweepError(err) {
+		log.Printf("[WARN] Skipping DataSync Agent sweep for %s: %s", region, err)
+		return nil
 	}
 
-	return nil
-}
-
-func sweepLocationEFSs(region string) error {
-	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
 	if err != nil {
-		return fmt.Errorf("error getting client: %s", err)
+		return fmt.Errorf("error listing DataSync Agents (%s): %w", region, err)
 	}
-	conn := client.DataSyncConn(ctx)
-
-	input := &datasync.ListLocationsInput{}
-	for {
-		output, err := conn.ListLocationsWithContext(ctx, input)
-
-		if sweep.SkipSweepError(err) {
-			log.Printf("[WARN] Skipping DataSync Location EFS sweep for %s: %s", region, err)
-			return nil
-		}
-
-		if err != nil {
-			return fmt.Errorf("Error retrieving DataSync Location EFSs: %s", err)
-		}
-
-		if len(output.Locations) == 0 {
-			log.Print("[DEBUG] No DataSync Location EFSs to sweep")
-			return nil
-		}
-
-		for _, location := range output.Locations {
-			uri := aws.StringValue(location.LocationUri)
-			if !strings.HasPrefix(uri, "efs://") {
-				log.Printf("[INFO] Skipping DataSync Location EFS: %s", uri)
-				continue
-			}
-			log.Printf("[INFO] Deleting DataSync Location EFS: %s", uri)
-			input := &datasync.DeleteLocationInput{
-				LocationArn: location.LocationArn,
-			}
 
-			_, err := conn.DeleteLocationWithContext(ctx, input)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
-			if tfawserr.ErrMessageContains(err, datasync.ErrCodeInvalidRequestException, "not found") {
-				continue
-			}
-
-			if err != nil {
-				log.Printf("[ERROR] Failed to delete DataSync Location EFS (%s): %s", uri, err)
-			}
-		}
-
-		if aws.StringValue(output.NextToken) == "" {
-			break
-		}
-
-		input.NextToken = output.NextToken
-	}
-
-	return nil
-}
-
-func sweepLocationFSxWindows(region string) error {
-	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
 	if err != nil {
-		return fmt.Errorf("error getting client: %w", err)
-	}
-	conn := client.DataSyncConn(ctx)
-
-	input := &datasync.ListLocationsInput{}
-	for {
-		output, err := conn.ListLocationsWithContext(ctx, input)
-
-		if sweep.SkipSweepError(err) {
-			log.Printf("[WARN] Skipping DataSync Location FSX Windows sweep for %s: %s", region, err)
-			return nil
-		}
-
-		if err != nil {
-			return fmt.Errorf("error retrieving DataSync Location FSX Windows: %w", err)
-		}
-
-		if len(output.Locations) == 0 {
-			log.Print("[DEBUG] No DataSync Location FSX Windows File System to sweep")
-			return nil
-		}
-
-		for _, location := range output.Locations {
-			uri := aws.StringValue(location.LocationUri)
-			if !strings.HasPrefix(uri, "fsxw://") {
-				log.Printf("[INFO] Skipping DataSync Location FSX Windows File System: %s", uri)
-				continue
-			}
-			log.Printf("[INFO] Deleting DataSync Location FSX Windows File System: %s", uri)
-			input := &datasync.DeleteLocationInput{
-				LocationArn: location.LocationArn,
-			}
-
-			_, err := conn.DeleteLocationWithContext(ctx, input)
-
-			if tfawserr.ErrMessageContains(err, datasync.ErrCodeInvalidRequestException, "not found") {
-				continue
-			}
-
-			if err != nil {
-				log.Printf("[ERROR] Failed to delete DataSync Location FSX Windows (%s): %s", uri, err)
-			}
-		}
-
-		if aws.StringValue(output.NextToken) == "" {
-			break
-		}
-
-		input.NextToken = output.NextToken
+		return fmt.Errorf("error sweeping DataSync Agents (%s): %w", region, err)
 	}
 
 	return nil
 }
 
-func sweepLocationFSxLustres(region string) error {
+func sweepLocations(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
 	conn := client.DataSyncConn(ctx)
-
-	sweepResources := make([]sweep.Sweepable, 0)
-	var sweeperErrs *multierror.Error
-
 	input := &datasync.ListLocationsInput{}
-	for {
-		output, err := conn.ListLocationsWithContext(ctx, input)
-
-		if sweep.SkipSweepError(err) {
-			log.Printf("[WARN] Skipping DataSync Location FSX Lustre sweep for %s: %s", region, err)
-			return nil
-		}
-
-		if err != nil {
-			return fmt.Errorf("error retrieving DataSync Location FSX Lustre: %w", err)
-		}
-
-		if len(output.Locations) == 0 {
-			log.Print("[DEBUG] No DataSync Location FSX Lustre File System to sweep")
-			return nil
-		}
-
-		for _, location := range output.Locations {
-			uri := aws.StringValue(location.LocationUri)
-			if !strings.HasPrefix(uri, "fsxl://") {
-				log.Printf("[INFO] Skipping DataSync Location FSX Lustre File System: %s", uri)
-				continue
-			}
-			log.Printf("[INFO] Deleting DataSync Location FSX Lustre File System: %s", uri)
-			r := ResourceLocationFSxLustreFileSystem()
-			d := r.Data(nil)
-			d.SetId(aws.StringValue(location.LocationArn))
-
-			sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
-		}
-
-		if aws.StringValue(output.NextToken) == "" {
-			break
-		}
-
-		input.NextToken = output.NextToken
-	}
-
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
-		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error sweeping DataSync Location FSX Lustre File Systems: %w", err))
-	}
-
-	return sweeperErrs.ErrorOrNil()
-}
-
-func sweepLocationNFSs(region string) error {
-	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
-	if err != nil {
-		return fmt.Errorf("error getting client: %s", err)
-	}
-	conn := client.DataSyncConn(ctx)
-
 	sweepResources := make([]sweep.Sweepable, 0)
-	var sweeperErrs *multierror.Error
-
-	input := &datasync.ListLocationsInput{}
-	for {
-		output, err := conn.ListLocationsWithContext(ctx, input)
 
-		if sweep.SkipSweepError(err) {
-			log.Printf("[WARN] Skipping DataSync Location Nfs sweep for %s: %s", region, err)
-			return nil
+	err = conn.ListLocationsPagesWithContext(ctx, input, func(page *datasync.ListLocationsOutput, lastPage bool) bool {
+		if page == nil {
+			return !lastPage
 		}
 
-		if err != nil {
-			return fmt.Errorf("Error retrieving DataSync Location Nfss: %s", err)
-		}
-
-		if len(output.Locations) == 0 {
-			log.Print("[DEBUG] No DataSync Location Nfss to sweep")
-			return nil
-		}
-
-		for _, location := range output.Locations {
-			uri := aws.StringValue(location.LocationUri)
-			if !strings.HasPrefix(uri, "nfs://") {
-				log.Printf("[INFO] Skipping DataSync Location Nfs: %s", uri)
-				continue
+		for _, v := range page.Locations {
+			sweepable := &sweepableLocation{
+				arn:  aws.StringValue(v.LocationArn),
+				conn: conn,
 			}
-			log.Printf("[INFO] Deleting DataSync Location Nfs: %s", uri)
 
-			r := ResourceLocationNFS()
-			d := r.Data(nil)
-			d.SetId(aws.StringValue(location.LocationArn))
-
-			sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
+			sweepResources = append(sweepResources, sweepable)
 		}
 
-		if aws.StringValue(output.NextToken) == "" {
-			break
-		}
-
-		input.NextToken = output.NextToken
-	}
+		return !lastPage
+	})
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
-		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error sweeping DataSync Location Nfs: %w", err))
+	if awsv1.SkipSweepError(err) {
+		log.Printf("[WARN] Skipping DataSync Location sweep for %s: %s", region, err)
+		return nil
 	}
 
-	return sweeperErrs.ErrorOrNil()
-}
-
-func sweepLocationS3s(region string) error {
-	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
 	if err != nil {
-		return fmt.Errorf("error getting client: %s", err)
+		return fmt.Errorf("error listing DataSync Locations (%s): %w", region, err)
 	}
-	conn := client.DataSyncConn(ctx)
 
-	input := &datasync.ListLocationsInput{}
-	for {
-		output, err := conn.ListLocationsWithContext(ctx, input)
-
-		if sweep.SkipSweepError(err) {
-			log.Printf("[WARN] Skipping DataSync Location S3 sweep for %s: %s", region, err)
-			return nil
-		}
-
-		if err != nil {
-			return fmt.Errorf("Error retrieving DataSync Location S3s: %s", err)
-		}
-
-		if len(output.Locations) == 0 {
-			log.Print("[DEBUG] No DataSync Location S3s to sweep")
-			return nil
-		}
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
-		for _, location := range output.Locations {
-			uri := aws.StringValue(location.LocationUri)
-			if !strings.HasPrefix(uri, "s3://") {
-				log.Printf("[INFO] Skipping DataSync Location S3: %s", uri)
-				continue
-			}
-			log.Printf("[INFO] Deleting DataSync Location S3: %s", uri)
-			input := &datasync.DeleteLocationInput{
-				LocationArn: location.LocationArn,
-			}
-
-			_, err := conn.DeleteLocationWithContext(ctx, input)
-
-			if tfawserr.ErrMessageContains(err, datasync.ErrCodeInvalidRequestException, "not found") {
-				continue
-			}
-
-			if err != nil {
-				log.Printf("[ERROR] Failed to delete DataSync Location S3 (%s): %s", uri, err)
-			}
-		}
-
-		if aws.StringValue(output.NextToken) == "" {
-			break
-		}
-
-		input.NextToken = output.NextToken
+	if err != nil {
+		return fmt.Errorf("error sweeping DataSync Locations (%s): %w", region, err)
 	}
 
 	return nil
 }
 
-func sweepLocationSMBs(region string) error {
-	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
-	if err != nil {
-		return fmt.Errorf("error getting client: %w", err)
-	}
-	conn := client.DataSyncConn(ctx)
-
-	sweepResources := make([]sweep.Sweepable, 0)
-	var sweeperErrs *multierror.Error
-
-	input := &datasync.ListLocationsInput{}
-	for {
-		output, err := conn.ListLocationsWithContext(ctx, input)
-
-		if sweep.SkipSweepError(err) {
-			log.Printf("[WARN] Skipping DataSync Location SMB sweep for %s: %s", region, err)
-			return nil
-		}
-
-		if err != nil {
-			return fmt.Errorf("Error retrieving DataSync Location SMBs: %w", err)
-		}
-
-		if len(output.Locations) == 0 {
-			log.Print("[DEBUG] No DataSync Location SMBs to sweep")
-			return nil
-		}
-
-		for _, location := range output.Locations {
-			uri := aws.StringValue(location.LocationUri)
-			if !strings.HasPrefix(uri, "smb://") {
-				log.Printf("[INFO] Skipping DataSync Location SMB: %s", uri)
-				continue
-			}
-			log.Printf("[INFO] Deleting DataSync Location SMB: %s", uri)
-
-			r := ResourceLocationSMB()
-			d := r.Data(nil)
-			d.SetId(aws.StringValue(location.LocationArn))
-
-			sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
-		}
+type sweepableLocation struct {
+	arn  string
+	conn *datasync.DataSync
+}
 
-		if aws.StringValue(output.NextToken) == "" {
-			break
-		}
+func (sweepable *sweepableLocation) Delete(ctx context.Context, timeout time.Duration, optFns ...tfresource.OptionsFunc) error {
+	log.Printf("[DEBUG] Deleting DataSync Location: %s", sweepable.arn)
+	_, err := sweepable.conn.DeleteLocationWithContext(ctx, &datasync.DeleteLocationInput{
+		LocationArn: aws.String(sweepable.arn),
+	})
 
-		input.NextToken = output.NextToken
+	if tfawserr.ErrMessageContains(err, datasync.ErrCodeInvalidRequestException, "not found") {
+		return nil
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
-		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error sweeping DataSync Location SMB: %w", err))
+	if err != nil {
+		return fmt.Errorf("deleting DataSync Location (%s): %w", sweepable.arn, err)
 	}
 
-	return sweeperErrs.ErrorOrNil()
+	return nil
 }
 
-func sweepLocationHDFSs(region string) error {
+func sweepTasks(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
 	conn := client.DataSyncConn(ctx)
-
+	input := &datasync.ListTasksInput{}
 	sweepResources := make([]sweep.Sweepable, 0)
-	var sweeperErrs *multierror.Error
-
-	input := &datasync.ListLocationsInput{}
-	for {
-		output, err := conn.ListLocationsWithContext(ctx, input)
-
-		if sweep.SkipSweepError(err) {
-			log.Printf("[WARN] Skipping DataSync Location HDFS sweep for %s: %s", region, err)
-			return nil
-		}
 
-		if err != nil {
-			return fmt.Errorf("Error retrieving DataSync Location HDFSs: %w", err)
+	err = conn.ListTasksPagesWithContext(ctx, input, func(page *datasync.ListTasksOutput, lastPage bool) bool {
+		if page == nil {
+			return !lastPage
 		}
 
-		if len(output.Locations) == 0 {
-			log.Print("[DEBUG] No DataSync Location HDFSs to sweep")
-			return nil
-		}
-
-		for _, location := range output.Locations {
-			uri := aws.StringValue(location.LocationUri)
-			if !strings.HasPrefix(uri, "hdfs://") {
-				log.Printf("[INFO] Skipping DataSync Location HDFS: %s", uri)
-				continue
-			}
-			log.Printf("[INFO] Deleting DataSync Location HDFS: %s", uri)
-
-			r := ResourceLocationHDFS()
+		for _, v := range page.Tasks {
+			r := ResourceTask()
 			d := r.Data(nil)
-			d.SetId(aws.StringValue(location.LocationArn))
+			d.SetId(aws.StringValue(v.TaskArn))
 
 			sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
 		}
 
-		if aws.StringValue(output.NextToken) == "" {
-			break
-		}
-
-		input.NextToken = output.NextToken
-	}
+		return !lastPage
+	})
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
-		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error sweeping DataSync Location HDFS: %w", err))
+	if awsv1.SkipSweepError(err) {
+		log.Printf("[WARN] Skipping DataSync Task sweep for %s: %s", region, err)
+		return nil
 	}
 
-	return sweeperErrs.ErrorOrNil()
-}
-
-func sweepLocationObjectStorages(region string) error {
-	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
 	if err != nil {
-		return fmt.Errorf("error getting client: %s", err)
+		return fmt.Errorf("error listing DataSync Tasks (%s): %w", region, err)
 	}
-	conn := client.DataSyncConn(ctx)
-
-	input := &datasync.ListLocationsInput{}
-	for {
-		output, err := conn.ListLocationsWithContext(ctx, input)
 
-		if sweep.SkipSweepError(err) {
-			log.Printf("[WARN] Skipping DataSync Location Object Storage sweep for %s: %s", region, err)
-			return nil
-		}
-
-		if err != nil {
-			return fmt.Errorf("Error retrieving DataSync Location Object Storages: %s", err)
-		}
-
-		if len(output.Locations) == 0 {
-			log.Print("[DEBUG] No DataSync Location Object Storages to sweep")
-			return nil
-		}
-
-		for _, location := range output.Locations {
-			uri := aws.StringValue(location.LocationUri)
-			if !strings.HasPrefix(uri, "object-storage://") {
-				log.Printf("[INFO] Skipping DataSync Location Object Storage: %s", uri)
-				continue
-			}
-			log.Printf("[INFO] Deleting DataSync Location Object Storage: %s", uri)
-			input := &datasync.DeleteLocationInput{
-				LocationArn: location.LocationArn,
-			}
-
-			_, err := conn.DeleteLocationWithContext(ctx, input)
-
-			if tfawserr.ErrMessageContains(err, datasync.ErrCodeInvalidRequestException, "not found") {
-				continue
-			}
-
-			if err != nil {
-				log.Printf("[ERROR] Failed to delete DataSync Location Object Storage (%s): %s", uri, err)
-			}
-		}
-
-		if aws.StringValue(output.NextToken) == "" {
-			break
-		}
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
-		input.NextToken = output.NextToken
-	}
-
-	return nil
-}
-
-func sweepTasks(region string) error {
-	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
 	if err != nil {
-		return fmt.Errorf("error getting client: %w", err)
-	}
-	conn := client.DataSyncConn(ctx)
-
-	input := &datasync.ListTasksInput{}
-	for {
-		output, err := conn.ListTasksWithContext(ctx, input)
-
-		if sweep.SkipSweepError(err) {
-			log.Printf("[WARN] Skipping DataSync Task sweep for %s: %s", region, err)
-			return nil
-		}
-
-		if err != nil {
-			return fmt.Errorf("Error retrieving DataSync Tasks: %w", err)
-		}
-
-		if len(output.Tasks) == 0 {
-			log.Print("[DEBUG] No DataSync Tasks to sweep")
-			return nil
-		}
-
-		for _, task := range output.Tasks {
-			name := aws.StringValue(task.Name)
-
-			log.Printf("[INFO] Deleting DataSync Task: %s", name)
-			input := &datasync.DeleteTaskInput{
-				TaskArn: task.TaskArn,
-			}
-
-			_, err := conn.DeleteTaskWithContext(ctx, input)
-
-			if tfawserr.ErrMessageContains(err, datasync.ErrCodeInvalidRequestException, "not found") {
-				continue
-			}
-
-			if err != nil {
-				log.Printf("[ERROR] Failed to delete DataSync Task (%s): %s", name, err)
-			}
-		}
-
-		if aws.StringValue(output.NextToken) == "" {
-			break
-		}
-
-		input.NextToken = output.NextToken
+		return fmt.Errorf("error sweeping DataSync Tasks (%s): %w", region, err)
 	}
 
 	return nil
diff --git a/internal/service/datasync/tags_gen.go b/internal/service/datasync/tags_gen.go
index 8ad08e0749a..c970f250840 100644
--- a/internal/service/datasync/tags_gen.go
+++ b/internal/service/datasync/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/datasync"
 	"github.com/aws/aws-sdk-go/service/datasync/datasynciface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -102,6 +104,8 @@ func updateTags(ctx context.Context, conn datasynciface.DataSyncAPI, identifier
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.DataSync)
 	if len(removedTags) > 0 {
diff --git a/internal/service/datasync/task.go b/internal/service/datasync/task.go
index 16be50c0101..a68f55c416d 100644
--- a/internal/service/datasync/task.go
+++ b/internal/service/datasync/task.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package datasync
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/datasync"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -204,7 +207,7 @@ func ResourceTask() *schema.Resource {
 							Required: true,
 							ValidateFunc: validation.All(
 								validation.StringLenBetween(1, 256),
-								validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9\ \_\*\?\,\|\^\-\/\#\s\(\)\+]*$`),
+								validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_\s #()*+,/?^|-]*$`),
 									"Schedule expressions must have the following syntax: rate(<number>\\\\s?(minutes?|hours?|days?)), cron(<cron_expression>) or at(yyyy-MM-dd'T'HH:mm:ss)."),
 							),
 						},
@@ -341,7 +344,9 @@ func resourceTaskUpdate(ctx context.Context, d *schema.ResourceData, meta interf
 			input.Schedule = expandTaskSchedule(d.Get("schedule").([]interface{}))
 		}
 
-		if _, err := conn.UpdateTaskWithContext(ctx, input); err != nil {
+		_, err := conn.UpdateTaskWithContext(ctx, input)
+
+		if err != nil {
 			return sdkdiag.AppendErrorf(diags, "updating DataSync Task (%s): %s", d.Id(), err)
 		}
 	}
@@ -353,12 +358,10 @@ func resourceTaskDelete(ctx context.Context, d *schema.ResourceData, meta interf
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).DataSyncConn(ctx)
 
-	input := &datasync.DeleteTaskInput{
+	log.Printf("[DEBUG] Deleting DataSync Task: %s", d.Id())
+	_, err := conn.DeleteTaskWithContext(ctx, &datasync.DeleteTaskInput{
 		TaskArn: aws.String(d.Id()),
-	}
-
-	log.Printf("[DEBUG] Deleting DataSync Task: %s", input)
-	_, err := conn.DeleteTaskWithContext(ctx, input)
+	})
 
 	if tfawserr.ErrMessageContains(err, datasync.ErrCodeInvalidRequestException, "not found") {
 		return diags
@@ -371,6 +374,31 @@ func resourceTaskDelete(ctx context.Context, d *schema.ResourceData, meta interf
 	return diags
 }
 
+func FindTaskByARN(ctx context.Context, conn *datasync.DataSync, arn string) (*datasync.DescribeTaskOutput, error) {
+	input := &datasync.DescribeTaskInput{
+		TaskArn: aws.String(arn),
+	}
+
+	output, err := conn.DescribeTaskWithContext(ctx, input)
+
+	if tfawserr.ErrMessageContains(err, datasync.ErrCodeInvalidRequestException, "not found") {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	if output == nil {
+		return nil, tfresource.NewEmptyResultError(input)
+	}
+
+	return output, nil
+}
+
 func statusTask(ctx context.Context, conn *datasync.DataSync, arn string) retry.StateRefreshFunc {
 	return func() (interface{}, string, error) {
 		output, err := FindTaskByARN(ctx, conn, arn)
diff --git a/internal/service/datasync/task_test.go b/internal/service/datasync/task_test.go
index 2f1ba1fd1f9..f13523ae01b 100644
--- a/internal/service/datasync/task_test.go
+++ b/internal/service/datasync/task_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package datasync_test
 
 import (
 	"context"
 	"errors"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/datasync"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -36,7 +39,7 @@ func TestAccDataSyncTask_basic(t *testing.T) {
 				Config: testAccTaskConfig_basic(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckTaskExists(ctx, resourceName, &task1),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "datasync", regexp.MustCompile(`task/task-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "datasync", regexache.MustCompile(`task/task-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "cloudwatch_log_group_arn", ""),
 					resource.TestCheckResourceAttrPair(resourceName, "destination_location_arn", dataSyncDestinationLocationResourceName, "arn"),
 					resource.TestCheckResourceAttr(resourceName, "excludes.#", "0"),
@@ -924,48 +927,7 @@ func testAccPreCheck(ctx context.Context, t *testing.T) {
 }
 
 func testAccTaskConfig_baseLocationS3(rName string) string {
-	return fmt.Sprintf(`
-resource "aws_iam_role" "test" {
-  name = %[1]q
-
-  assume_role_policy = <<POLICY
-{
-  "Version": "2012-10-17",
-  "Statement": [{
-    "Effect": "Allow",
-    "Principal": {
-      "Service": "datasync.amazonaws.com"
-    },
-    "Action": "sts:AssumeRole"
-  }]
-}
-POLICY
-}
-
-resource "aws_s3_bucket" "test" {
-  bucket        = %[1]q
-  force_destroy = true
-}
-
-resource "aws_iam_role_policy" "test" {
-  role   = aws_iam_role.test.id
-  policy = <<POLICY
-{
-  "Version": "2012-10-17",
-  "Statement": [{
-    "Action": [
-      "s3:*"
-    ],
-    "Effect": "Allow",
-    "Resource": [
-      "${aws_s3_bucket.test.arn}",
-      "${aws_s3_bucket.test.arn}/*"
-    ]
-  }]
-}
-POLICY
-}
-
+	return acctest.ConfigCompose(testAccLocationS3Config_base(rName), `
 resource "aws_datasync_location_s3" "test" {
   s3_bucket_arn = aws_s3_bucket.test.arn
   subdirectory  = "/test"
@@ -976,110 +938,18 @@ resource "aws_datasync_location_s3" "test" {
 
   depends_on = [aws_iam_role_policy.test]
 }
-`, rName)
+`)
 }
 
 func testAccTaskConfig_baseLocationNFS(rName string) string {
-	return acctest.ConfigCompose(
-		// Reference: https://docs.aws.amazon.com/datasync/latest/userguide/agent-requirements.html
-		acctest.AvailableEC2InstanceTypeForAvailabilityZone("aws_subnet.test.availability_zone", "m5.2xlarge", "m5.4xlarge"),
-		fmt.Sprintf(`
-# Reference: https://docs.aws.amazon.com/datasync/latest/userguide/deploy-agents.html
-data "aws_ssm_parameter" "test" {
-  name = "/aws/service/datasync/ami"
-}
-
-resource "aws_vpc" "test" {
-  cidr_block           = "10.0.0.0/16"
-  enable_dns_hostnames = true
-  enable_dns_support   = true
-
-  tags = {
-    Name = %[1]q
-  }
-}
-
-resource "aws_subnet" "test" {
-  cidr_block = "10.0.0.0/24"
-  vpc_id     = aws_vpc.test.id
-
-  tags = {
-    Name = %[1]q
-  }
-}
-
-resource "aws_internet_gateway" "test" {
-  vpc_id = aws_vpc.test.id
-
-  tags = {
-    Name = %[1]q
-  }
-}
-
-resource "aws_default_route_table" "test" {
-  default_route_table_id = aws_vpc.test.default_route_table_id
-
-  route {
-    cidr_block = "0.0.0.0/0"
-    gateway_id = aws_internet_gateway.test.id
-  }
-
-  tags = {
-    Name = %[1]q
-  }
-}
-
-resource "aws_security_group" "test" {
-  name   = %[1]q
-  vpc_id = aws_vpc.test.id
-
-  egress {
-    from_port   = 0
-    to_port     = 0
-    protocol    = "-1"
-    cidr_blocks = ["0.0.0.0/0"]
-  }
-
-  ingress {
-    from_port   = 0
-    to_port     = 0
-    protocol    = "-1"
-    cidr_blocks = ["0.0.0.0/0"]
-  }
-
-  tags = {
-    Name = %[1]q
-  }
-}
-
+	return acctest.ConfigCompose(testAccLocationNFSConfig_base(rName), `
 # EFS as our NFS server
 resource "aws_efs_file_system" "test" {}
 
 resource "aws_efs_mount_target" "test" {
   file_system_id  = aws_efs_file_system.test.id
   security_groups = [aws_security_group.test.id]
-  subnet_id       = aws_subnet.test.id
-}
-
-resource "aws_instance" "test" {
-  depends_on = [
-    aws_default_route_table.test,
-  ]
-
-  ami                         = data.aws_ssm_parameter.test.value
-  associate_public_ip_address = true
-  instance_type               = data.aws_ec2_instance_type_offering.available.instance_type
-  vpc_security_group_ids      = [aws_security_group.test.id]
-  subnet_id                   = aws_subnet.test.id
-
-  tags = {
-    Name = %[1]q
-  }
-}
-
-resource "aws_datasync_agent" "test" {
-  ip_address = aws_instance.test.public_ip
-  name       = %[1]q
+  subnet_id       = aws_subnet.test[0].id
 }
 
 resource "aws_datasync_location_nfs" "test" {
@@ -1090,7 +960,7 @@ resource "aws_datasync_location_nfs" "test" {
     agent_arns = [aws_datasync_agent.test.arn]
   }
 }
-`, rName))
+`)
 }
 
 func testAccTaskConfig_basic(rName string) string {
diff --git a/internal/service/datasync/uri.go b/internal/service/datasync/uri.go
index fd8597e38d5..f99c702f076 100644
--- a/internal/service/datasync/uri.go
+++ b/internal/service/datasync/uri.go
@@ -1,16 +1,19 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package datasync
 
 import (
 	"fmt"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws/arn"
 )
 
 var (
-	locationURIPattern                      = regexp.MustCompile(`^(efs|hdfs|nfs|s3|smb|fsx[a-z0-9]+)://(.+)$`)
-	locationURIGlobalIDAndSubdirPattern     = regexp.MustCompile(`^([a-zA-Z0-9.\-]+)(?::\d{0,5})?(/.*)$`)
-	s3OutpostsAccessPointARNResourcePattern = regexp.MustCompile(`^outpost/.*/accesspoint/.*?(/.*)$`)
+	locationURIPattern                      = regexache.MustCompile(`^(azure-blob|efs|fsx[0-9a-z-]+|hdfs|nfs|s3|smb)://(.+)$`)
+	locationURIGlobalIDAndSubdirPattern     = regexache.MustCompile(`^([0-9A-Za-z.-]+)(?::\d{0,5})?(/.*)$`)
+	s3OutpostsAccessPointARNResourcePattern = regexache.MustCompile(`^outpost/.*/accesspoint/.*?(/.*)$`)
 )
 
 // subdirectoryFromLocationURI extracts the subdirectory from a location URI.
diff --git a/internal/service/datasync/uri_test.go b/internal/service/datasync/uri_test.go
index a755f538d89..43f9534cea0 100644
--- a/internal/service/datasync/uri_test.go
+++ b/internal/service/datasync/uri_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package datasync
 
 import "testing"
@@ -156,6 +159,11 @@ func TestSubdirectoryFromLocationURI(t *testing.T) {
 			InputURI:      "object-storage://192.168.1.1/tf-acc-test-5815577519131245007/tf-acc-test-5815577519131245008/",
 			ExpectedError: true,
 		},
+		{
+			TestName:             "Azure blob URI one level",
+			InputURI:             "azure-blob://example.com/path/",
+			ExpectedSubdirectory: "/path/",
+		},
 	}
 
 	for _, testCase := range testCases {
diff --git a/internal/service/dax/cluster.go b/internal/service/dax/cluster.go
index 1a91f495da3..4daf5d73497 100644
--- a/internal/service/dax/cluster.go
+++ b/internal/service/dax/cluster.go
@@ -1,14 +1,17 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package dax
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"sort"
 	"strings"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/dax"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -71,10 +74,10 @@ func ResourceCluster() *schema.Resource {
 				},
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 20),
-					validation.StringMatch(regexp.MustCompile(`^[0-9a-z-]+$`), "must contain only lowercase alphanumeric characters and hyphens"),
-					validation.StringMatch(regexp.MustCompile(`^[a-z]`), "must begin with a lowercase letter"),
-					validation.StringDoesNotMatch(regexp.MustCompile(`--`), "cannot contain two consecutive hyphens"),
-					validation.StringDoesNotMatch(regexp.MustCompile(`-$`), "cannot end with a hyphen"),
+					validation.StringMatch(regexache.MustCompile(`^[0-9a-z-]+$`), "must contain only lowercase alphanumeric characters and hyphens"),
+					validation.StringMatch(regexache.MustCompile(`^[a-z]`), "must begin with a lowercase letter"),
+					validation.StringDoesNotMatch(regexache.MustCompile(`--`), "cannot contain two consecutive hyphens"),
+					validation.StringDoesNotMatch(regexache.MustCompile(`-$`), "cannot end with a hyphen"),
 				),
 			},
 			"iam_role_arn": {
diff --git a/internal/service/dax/cluster_test.go b/internal/service/dax/cluster_test.go
index 77672169139..7b7a9a5e157 100644
--- a/internal/service/dax/cluster_test.go
+++ b/internal/service/dax/cluster_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package dax_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/dax"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -33,11 +36,11 @@ func TestAccDAXCluster_basic(t *testing.T) {
 				Config: testAccClusterConfig_basic(rString),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckClusterExists(ctx, resourceName, &dc),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "dax", regexp.MustCompile("cache/.+")),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "dax", regexache.MustCompile("cache/.+")),
 					resource.TestCheckResourceAttr(
 						resourceName, "cluster_endpoint_encryption_type", "NONE"),
 					resource.TestMatchResourceAttr(
-						resourceName, "cluster_name", regexp.MustCompile(`^tf-\w+$`)),
+						resourceName, "cluster_name", regexache.MustCompile(`^tf-\w+$`)),
 					resource.TestCheckResourceAttrPair(resourceName, "iam_role_arn", iamRoleResourceName, "arn"),
 					resource.TestCheckResourceAttr(
 						resourceName, "node_type", "dax.t2.small"),
@@ -46,19 +49,19 @@ func TestAccDAXCluster_basic(t *testing.T) {
 					resource.TestCheckResourceAttr(
 						resourceName, "description", "test cluster"),
 					resource.TestMatchResourceAttr(
-						resourceName, "parameter_group_name", regexp.MustCompile(`^default.dax`)),
+						resourceName, "parameter_group_name", regexache.MustCompile(`^default.dax`)),
 					resource.TestMatchResourceAttr(
-						resourceName, "maintenance_window", regexp.MustCompile(`^\w{3}:\d{2}:\d{2}-\w{3}:\d{2}:\d{2}$`)),
+						resourceName, "maintenance_window", regexache.MustCompile(`^\w{3}:\d{2}:\d{2}-\w{3}:\d{2}:\d{2}$`)),
 					resource.TestCheckResourceAttr(
 						resourceName, "subnet_group_name", "default"),
 					resource.TestMatchResourceAttr(
-						resourceName, "nodes.0.id", regexp.MustCompile(`^tf-[\w-]+$`)),
+						resourceName, "nodes.0.id", regexache.MustCompile(`^tf-[\w-]+$`)),
 					resource.TestMatchResourceAttr(
-						resourceName, "configuration_endpoint", regexp.MustCompile(`:\d+$`)),
+						resourceName, "configuration_endpoint", regexache.MustCompile(`:\d+$`)),
 					resource.TestCheckResourceAttrSet(
 						resourceName, "cluster_address"),
 					resource.TestMatchResourceAttr(
-						resourceName, "port", regexp.MustCompile(`^\d+$`)),
+						resourceName, "port", regexache.MustCompile(`^\d+$`)),
 					resource.TestCheckResourceAttr(
 						resourceName, "server_side_encryption.#", "1"),
 					resource.TestCheckResourceAttr(
diff --git a/internal/service/dax/consts.go b/internal/service/dax/consts.go
index 5eb0f6620b4..9771d39acc1 100644
--- a/internal/service/dax/consts.go
+++ b/internal/service/dax/consts.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package dax
 
 import (
diff --git a/internal/service/dax/flex.go b/internal/service/dax/flex.go
index e3597e36c9d..224ab855365 100644
--- a/internal/service/dax/flex.go
+++ b/internal/service/dax/flex.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package dax
 
 import (
diff --git a/internal/service/dax/generate.go b/internal/service/dax/generate.go
index e3806dcc36d..ea98d23b767 100644
--- a/internal/service/dax/generate.go
+++ b/internal/service/dax/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTags -ListTagsOp=ListTags -ListTagsInIDElem=ResourceName -ServiceTagsSlice -TagInIDElem=ResourceName -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/dax/parameter_group.go b/internal/service/dax/parameter_group.go
index a7a6c1a3dba..9e8ac6418e3 100644
--- a/internal/service/dax/parameter_group.go
+++ b/internal/service/dax/parameter_group.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package dax
 
 import (
diff --git a/internal/service/dax/parameter_group_test.go b/internal/service/dax/parameter_group_test.go
index e87659ae57a..7824d29eea1 100644
--- a/internal/service/dax/parameter_group_test.go
+++ b/internal/service/dax/parameter_group_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package dax_test
 
 import (
diff --git a/internal/service/dax/service_package_gen.go b/internal/service/dax/service_package_gen.go
index 6b007f7a4f5..b6d0267c154 100644
--- a/internal/service/dax/service_package_gen.go
+++ b/internal/service/dax/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	dax_sdkv1 "github.com/aws/aws-sdk-go/service/dax"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -58,4 +59,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*d
 	return dax_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/dax/subnet_group.go b/internal/service/dax/subnet_group.go
index 74fb71b2740..945b3b75edd 100644
--- a/internal/service/dax/subnet_group.go
+++ b/internal/service/dax/subnet_group.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package dax
 
 import (
diff --git a/internal/service/dax/subnet_group_test.go b/internal/service/dax/subnet_group_test.go
index dd1f70ae844..3380698a3fe 100644
--- a/internal/service/dax/subnet_group_test.go
+++ b/internal/service/dax/subnet_group_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package dax_test
 
 import (
diff --git a/internal/service/dax/sweep.go b/internal/service/dax/sweep.go
index 03001ae4bff..018ebf65bda 100644
--- a/internal/service/dax/sweep.go
+++ b/internal/service/dax/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package dax
 
@@ -11,9 +11,10 @@ import (
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_dax_cluster", &resource.Sweeper{
 		Name: "aws_dax_cluster",
 		F:    sweepClusters,
@@ -22,7 +23,7 @@ func init() {
 
 func sweepClusters(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("Error getting client: %s", err)
 	}
@@ -32,7 +33,7 @@ func sweepClusters(region string) error {
 	if err != nil {
 		// GovCloud (with no DAX support) has an endpoint that responds with:
 		// InvalidParameterValueException: Access Denied to API Version: DAX_V3
-		if sweep.SkipSweepError(err) || tfawserr.ErrMessageContains(err, "InvalidParameterValueException", "Access Denied to API Version: DAX_V3") {
+		if awsv1.SkipSweepError(err) || tfawserr.ErrMessageContains(err, "InvalidParameterValueException", "Access Denied to API Version: DAX_V3") {
 			log.Printf("[WARN] Skipping DAX Cluster sweep for %s: %s", region, err)
 			return nil
 		}
diff --git a/internal/service/dax/tags_gen.go b/internal/service/dax/tags_gen.go
index df9907f562f..35dfbc181d3 100644
--- a/internal/service/dax/tags_gen.go
+++ b/internal/service/dax/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/dax"
 	"github.com/aws/aws-sdk-go/service/dax/daxiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -102,6 +104,8 @@ func updateTags(ctx context.Context, conn daxiface.DAXAPI, identifier string, ol
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.DAX)
 	if len(removedTags) > 0 {
diff --git a/internal/service/deploy/app.go b/internal/service/deploy/app.go
index 7def1498d5f..e3ba6f64bf6 100644
--- a/internal/service/deploy/app.go
+++ b/internal/service/deploy/app.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package deploy
 
 import (
diff --git a/internal/service/deploy/app_test.go b/internal/service/deploy/app_test.go
index d9fa03a6ab6..bb3da7828f3 100644
--- a/internal/service/deploy/app_test.go
+++ b/internal/service/deploy/app_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package deploy_test
 
 import (
diff --git a/internal/service/deploy/deployment_config.go b/internal/service/deploy/deployment_config.go
index e39bfab2ca7..882374f44ba 100644
--- a/internal/service/deploy/deployment_config.go
+++ b/internal/service/deploy/deployment_config.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package deploy
 
 import (
diff --git a/internal/service/deploy/deployment_config_test.go b/internal/service/deploy/deployment_config_test.go
index 0258637f9f0..9dde224c66f 100644
--- a/internal/service/deploy/deployment_config_test.go
+++ b/internal/service/deploy/deployment_config_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package deploy_test
 
 import (
diff --git a/internal/service/deploy/deployment_group.go b/internal/service/deploy/deployment_group.go
index edef2d40272..8bf56490083 100644
--- a/internal/service/deploy/deployment_group.go
+++ b/internal/service/deploy/deployment_group.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package deploy
 
 import (
@@ -35,6 +38,7 @@ func ResourceDeploymentGroup() *schema.Resource {
 		ReadWithoutTimeout:   resourceDeploymentGroupRead,
 		UpdateWithoutTimeout: resourceDeploymentGroupUpdate,
 		DeleteWithoutTimeout: resourceDeploymentGroupDelete,
+
 		Importer: &schema.ResourceImporter{
 			StateContext: func(ctx context.Context, d *schema.ResourceData, meta interface{}) ([]*schema.ResourceData, error) {
 				idParts := strings.Split(d.Id(), ":")
@@ -47,23 +51,13 @@ func ResourceDeploymentGroup() *schema.Resource {
 				deploymentGroupName := idParts[1]
 				conn := meta.(*conns.AWSClient).DeployConn(ctx)
 
-				input := &codedeploy.GetDeploymentGroupInput{
-					ApplicationName:     aws.String(applicationName),
-					DeploymentGroupName: aws.String(deploymentGroupName),
-				}
-
-				log.Printf("[DEBUG] Reading CodeDeploy Application: %s", input)
-				output, err := conn.GetDeploymentGroupWithContext(ctx, input)
+				group, err := FindDeploymentGroupByTwoPartKey(ctx, conn, applicationName, deploymentGroupName)
 
 				if err != nil {
 					return []*schema.ResourceData{}, err
 				}
 
-				if output == nil || output.DeploymentGroupInfo == nil {
-					return []*schema.ResourceData{}, fmt.Errorf("reading CodeDeploy Application (%s): empty response", d.Id())
-				}
-
-				d.SetId(aws.StringValue(output.DeploymentGroupInfo.DeploymentGroupId))
+				d.SetId(aws.StringValue(group.DeploymentGroupId))
 				d.Set("app_name", applicationName)
 				d.Set("deployment_group_name", deploymentGroupName)
 
@@ -72,52 +66,62 @@ func ResourceDeploymentGroup() *schema.Resource {
 		},
 
 		Schema: map[string]*schema.Schema{
-			"arn": {
-				Type:     schema.TypeString,
-				Computed: true,
+			"alarm_configuration": {
+				Type:     schema.TypeList,
+				Optional: true,
+				MaxItems: 1,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"alarms": {
+							Type:     schema.TypeSet,
+							MaxItems: 10,
+							Optional: true,
+							Elem:     &schema.Schema{Type: schema.TypeString},
+						},
+						"enabled": {
+							Type:     schema.TypeBool,
+							Optional: true,
+						},
+						"ignore_poll_alarm_failure": {
+							Type:     schema.TypeBool,
+							Optional: true,
+							Default:  false,
+						},
+					},
+				},
 			},
 			"app_name": {
 				Type:         schema.TypeString,
 				Required:     true,
 				ValidateFunc: validation.StringLenBetween(0, 100),
 			},
-			"compute_platform": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
-			"deployment_group_name": {
-				Type:         schema.TypeString,
-				Required:     true,
-				ValidateFunc: validation.StringLenBetween(0, 100),
-			},
-			"deployment_group_id": {
+			"arn": {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
-
-			"deployment_style": {
-				Type:             schema.TypeList,
-				Optional:         true,
-				DiffSuppressFunc: verify.SuppressMissingOptionalConfigurationBlock,
-				MaxItems:         1,
+			"auto_rollback_configuration": {
+				Type:     schema.TypeList,
+				Optional: true,
+				MaxItems: 1,
 				Elem: &schema.Resource{
 					Schema: map[string]*schema.Schema{
-						"deployment_option": {
-							Type:         schema.TypeString,
-							Optional:     true,
-							Default:      codedeploy.DeploymentOptionWithoutTrafficControl,
-							ValidateFunc: validation.StringInSlice(codedeploy.DeploymentOption_Values(), false),
+						"enabled": {
+							Type:     schema.TypeBool,
+							Optional: true,
 						},
-						"deployment_type": {
-							Type:         schema.TypeString,
-							Optional:     true,
-							Default:      codedeploy.DeploymentTypeInPlace,
-							ValidateFunc: validation.StringInSlice(codedeploy.DeploymentType_Values(), false),
+						"events": {
+							Type:     schema.TypeSet,
+							Optional: true,
+							Elem:     &schema.Schema{Type: schema.TypeString},
 						},
 					},
 				},
 			},
-
+			"autoscaling_groups": {
+				Type:     schema.TypeSet,
+				Optional: true,
+				Elem:     &schema.Schema{Type: schema.TypeString},
+			},
 			"blue_green_deployment_config": {
 				Type:     schema.TypeList,
 				Optional: true,
@@ -143,7 +147,6 @@ func ResourceDeploymentGroup() *schema.Resource {
 								},
 							},
 						},
-
 						"green_fleet_provisioning_option": {
 							Type:     schema.TypeList,
 							Optional: true,
@@ -159,7 +162,6 @@ func ResourceDeploymentGroup() *schema.Resource {
 								},
 							},
 						},
-
 						"terminate_blue_instances_on_deployment_success": {
 							Type:     schema.TypeList,
 							Optional: true,
@@ -182,41 +184,119 @@ func ResourceDeploymentGroup() *schema.Resource {
 					},
 				},
 			},
-
-			"service_role_arn": {
+			"compute_platform": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"deployment_config_name": {
+				Type:         schema.TypeString,
+				Optional:     true,
+				Default:      "CodeDeployDefault.OneAtATime",
+				ValidateFunc: validation.StringLenBetween(0, 100),
+			},
+			"deployment_group_id": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"deployment_group_name": {
 				Type:         schema.TypeString,
 				Required:     true,
-				ValidateFunc: verify.ValidARN,
+				ValidateFunc: validation.StringLenBetween(0, 100),
 			},
-
-			"alarm_configuration": {
-				Type:     schema.TypeList,
+			"deployment_style": {
+				Type:             schema.TypeList,
+				Optional:         true,
+				DiffSuppressFunc: verify.SuppressMissingOptionalConfigurationBlock,
+				MaxItems:         1,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"deployment_option": {
+							Type:         schema.TypeString,
+							Optional:     true,
+							Default:      codedeploy.DeploymentOptionWithoutTrafficControl,
+							ValidateFunc: validation.StringInSlice(codedeploy.DeploymentOption_Values(), false),
+						},
+						"deployment_type": {
+							Type:         schema.TypeString,
+							Optional:     true,
+							Default:      codedeploy.DeploymentTypeInPlace,
+							ValidateFunc: validation.StringInSlice(codedeploy.DeploymentType_Values(), false),
+						},
+					},
+				},
+			},
+			"ec2_tag_filter": {
+				Type:     schema.TypeSet,
 				Optional: true,
-				MaxItems: 1,
 				Elem: &schema.Resource{
 					Schema: map[string]*schema.Schema{
-						"alarms": {
-							Type:     schema.TypeSet,
-							MaxItems: 10,
+						"key": {
+							Type:     schema.TypeString,
 							Optional: true,
-							Set:      schema.HashString,
-							Elem:     &schema.Schema{Type: schema.TypeString},
 						},
-
-						"enabled": {
-							Type:     schema.TypeBool,
+						"type": {
+							Type:         schema.TypeString,
+							Optional:     true,
+							ValidateFunc: validTagFilters,
+						},
+						"value": {
+							Type:     schema.TypeString,
 							Optional: true,
 						},
-
-						"ignore_poll_alarm_failure": {
-							Type:     schema.TypeBool,
+					},
+				},
+				Set: resourceTagFilterHash,
+			},
+			"ec2_tag_set": {
+				Type:     schema.TypeSet,
+				Optional: true,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"ec2_tag_filter": {
+							Type:     schema.TypeSet,
 							Optional: true,
-							Default:  false,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"key": {
+										Type:     schema.TypeString,
+										Optional: true,
+									},
+									"type": {
+										Type:         schema.TypeString,
+										Optional:     true,
+										ValidateFunc: validTagFilters,
+									},
+									"value": {
+										Type:     schema.TypeString,
+										Optional: true,
+									},
+								},
+							},
+							Set: resourceTagFilterHash,
+						},
+					},
+				},
+				Set: resourceTagSetHash,
+			},
+			"ecs_service": {
+				Type:     schema.TypeList,
+				Optional: true,
+				MaxItems: 1,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"cluster_name": {
+							Type:         schema.TypeString,
+							Required:     true,
+							ValidateFunc: validation.NoZeroValues,
+						},
+						"service_name": {
+							Type:         schema.TypeString,
+							Required:     true,
+							ValidateFunc: validation.NoZeroValues,
 						},
 					},
 				},
 			},
-
 			"load_balancer_info": {
 				Type:     schema.TypeList,
 				Optional: true,
@@ -236,7 +316,6 @@ func ResourceDeploymentGroup() *schema.Resource {
 								},
 							},
 						},
-
 						"target_group_info": {
 							Type:     schema.TypeSet,
 							Optional: true,
@@ -250,7 +329,6 @@ func ResourceDeploymentGroup() *schema.Resource {
 								},
 							},
 						},
-
 						"target_group_pair_info": {
 							Type:     schema.TypeList,
 							Optional: true,
@@ -313,77 +391,7 @@ func ResourceDeploymentGroup() *schema.Resource {
 					},
 				},
 			},
-
-			"auto_rollback_configuration": {
-				Type:     schema.TypeList,
-				Optional: true,
-				MaxItems: 1,
-				Elem: &schema.Resource{
-					Schema: map[string]*schema.Schema{
-						"enabled": {
-							Type:     schema.TypeBool,
-							Optional: true,
-						},
-
-						"events": {
-							Type:     schema.TypeSet,
-							Optional: true,
-							Set:      schema.HashString,
-							Elem:     &schema.Schema{Type: schema.TypeString},
-						},
-					},
-				},
-			},
-
-			"autoscaling_groups": {
-				Type:     schema.TypeSet,
-				Optional: true,
-				Elem:     &schema.Schema{Type: schema.TypeString},
-				Set:      schema.HashString,
-			},
-
-			"deployment_config_name": {
-				Type:         schema.TypeString,
-				Optional:     true,
-				Default:      "CodeDeployDefault.OneAtATime",
-				ValidateFunc: validation.StringLenBetween(0, 100),
-			},
-
-			"ec2_tag_set": {
-				Type:     schema.TypeSet,
-				Optional: true,
-				Elem: &schema.Resource{
-					Schema: map[string]*schema.Schema{
-						"ec2_tag_filter": {
-							Type:     schema.TypeSet,
-							Optional: true,
-							Elem: &schema.Resource{
-								Schema: map[string]*schema.Schema{
-									"key": {
-										Type:     schema.TypeString,
-										Optional: true,
-									},
-
-									"type": {
-										Type:         schema.TypeString,
-										Optional:     true,
-										ValidateFunc: validTagFilters,
-									},
-
-									"value": {
-										Type:     schema.TypeString,
-										Optional: true,
-									},
-								},
-							},
-							Set: resourceTagFilterHash,
-						},
-					},
-				},
-				Set: resourceTagSetHash,
-			},
-
-			"ec2_tag_filter": {
+			"on_premises_instance_tag_filter": {
 				Type:     schema.TypeSet,
 				Optional: true,
 				Elem: &schema.Resource{
@@ -392,13 +400,11 @@ func ResourceDeploymentGroup() *schema.Resource {
 							Type:     schema.TypeString,
 							Optional: true,
 						},
-
 						"type": {
 							Type:         schema.TypeString,
 							Optional:     true,
 							ValidateFunc: validTagFilters,
 						},
-
 						"value": {
 							Type:     schema.TypeString,
 							Optional: true,
@@ -407,52 +413,19 @@ func ResourceDeploymentGroup() *schema.Resource {
 				},
 				Set: resourceTagFilterHash,
 			},
-
-			"ecs_service": {
-				Type:     schema.TypeList,
-				Optional: true,
-				MaxItems: 1,
-				Elem: &schema.Resource{
-					Schema: map[string]*schema.Schema{
-						"cluster_name": {
-							Type:         schema.TypeString,
-							Required:     true,
-							ValidateFunc: validation.NoZeroValues,
-						},
-						"service_name": {
-							Type:         schema.TypeString,
-							Required:     true,
-							ValidateFunc: validation.NoZeroValues,
-						},
-					},
-				},
+			"outdated_instances_strategy": {
+				Type:         schema.TypeString,
+				Optional:     true,
+				Default:      codedeploy.OutdatedInstancesStrategyUpdate,
+				ValidateFunc: validation.StringInSlice(codedeploy.OutdatedInstancesStrategy_Values(), false),
 			},
-
-			"on_premises_instance_tag_filter": {
-				Type:     schema.TypeSet,
-				Optional: true,
-				Elem: &schema.Resource{
-					Schema: map[string]*schema.Schema{
-						"key": {
-							Type:     schema.TypeString,
-							Optional: true,
-						},
-
-						"type": {
-							Type:         schema.TypeString,
-							Optional:     true,
-							ValidateFunc: validTagFilters,
-						},
-
-						"value": {
-							Type:     schema.TypeString,
-							Optional: true,
-						},
-					},
-				},
-				Set: resourceTagFilterHash,
+			"service_role_arn": {
+				Type:         schema.TypeString,
+				Required:     true,
+				ValidateFunc: verify.ValidARN,
 			},
-
+			names.AttrTags:    tftags.TagsSchema(),
+			names.AttrTagsAll: tftags.TagsSchemaComputed(),
 			"trigger_configuration": {
 				Type:     schema.TypeSet,
 				Optional: true,
@@ -461,18 +434,15 @@ func ResourceDeploymentGroup() *schema.Resource {
 						"trigger_events": {
 							Type:     schema.TypeSet,
 							Required: true,
-							Set:      schema.HashString,
 							Elem: &schema.Schema{
 								Type:         schema.TypeString,
 								ValidateFunc: validation.StringInSlice(codedeploy.TriggerEventType_Values(), false),
 							},
 						},
-
 						"trigger_name": {
 							Type:     schema.TypeString,
 							Required: true,
 						},
-
 						"trigger_target_arn": {
 							Type:         schema.TypeString,
 							Required:     true,
@@ -482,8 +452,6 @@ func ResourceDeploymentGroup() *schema.Resource {
 				},
 				Set: resourceTriggerHashConfig,
 			},
-			names.AttrTags:    tftags.TagsSchema(),
-			names.AttrTagsAll: tftags.TagsSchemaComputed(),
 		},
 
 		CustomizeDiff: verify.SetTagsDiff,
@@ -554,7 +522,9 @@ func resourceDeploymentGroupCreate(ctx context.Context, d *schema.ResourceData,
 		input.BlueGreenDeploymentConfiguration = ExpandBlueGreenDeploymentConfig(attr.([]interface{}))
 	}
 
-	log.Printf("[DEBUG] Creating CodeDeploy DeploymentGroup %s", applicationName)
+	if attr, ok := d.GetOk("outdated_instances_strategy"); ok {
+		input.OutdatedInstancesStrategy = aws.String(attr.(string))
+	}
 
 	var resp *codedeploy.CreateDeploymentGroupOutput
 	var err error
@@ -580,7 +550,7 @@ func resourceDeploymentGroupCreate(ctx context.Context, d *schema.ResourceData,
 		resp, err = conn.CreateDeploymentGroupWithContext(ctx, &input)
 	}
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "creating CodeDeploy deployment group: %s", err)
+		return sdkdiag.AppendErrorf(diags, "creating CodeDeploy Deployment Group: %s", err)
 	}
 
 	d.SetId(aws.StringValue(resp.DeploymentGroupId))
@@ -592,23 +562,18 @@ func resourceDeploymentGroupRead(ctx context.Context, d *schema.ResourceData, me
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).DeployConn(ctx)
 
-	deploymentGroupName := d.Get("deployment_group_name").(string)
-	resp, err := conn.GetDeploymentGroupWithContext(ctx, &codedeploy.GetDeploymentGroupInput{
-		ApplicationName:     aws.String(d.Get("app_name").(string)),
-		DeploymentGroupName: aws.String(deploymentGroupName),
-	})
+	group, err := FindDeploymentGroupByTwoPartKey(ctx, conn, d.Get("app_name").(string), d.Get("deployment_group_name").(string))
 
-	if !d.IsNewResource() && tfawserr.ErrCodeEquals(err, codedeploy.ErrCodeDeploymentGroupDoesNotExistException) {
+	if !d.IsNewResource() && tfresource.NotFound(err) {
 		log.Printf("[WARN] CodeDeploy Deployment Group (%s) not found, removing from state", d.Id())
 		d.SetId("")
 		return diags
 	}
 
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "finding CodeDeploy Deployment Group (%s): %s", d.Id(), err)
+		return sdkdiag.AppendErrorf(diags, "reading CodeDeploy Deployment Group (%s): %s", d.Id(), err)
 	}
 
-	group := resp.DeploymentGroupInfo
 	appName := aws.StringValue(group.ApplicationName)
 	groupName := aws.StringValue(group.DeploymentGroupName)
 	groupArn := arn.ARN{
@@ -626,6 +591,7 @@ func resourceDeploymentGroupRead(ctx context.Context, d *schema.ResourceData, me
 	d.Set("deployment_group_id", group.DeploymentGroupId)
 	d.Set("compute_platform", group.ComputePlatform)
 	d.Set("service_role_arn", group.ServiceRoleArn)
+	d.Set("outdated_instances_strategy", group.OutdatedInstancesStrategy)
 
 	autoScalingGroups := make([]string, len(group.AutoScalingGroups))
 	for i, autoScalingGroup := range group.AutoScalingGroups {
@@ -765,6 +731,15 @@ func resourceDeploymentGroupUpdate(ctx context.Context, d *schema.ResourceData,
 			input.BlueGreenDeploymentConfiguration = ExpandBlueGreenDeploymentConfig(n.([]interface{}))
 		}
 
+		if d.HasChange("outdated_instances_strategy") {
+			o, n := d.GetChange("outdated_instances_strategy")
+			if n.(string) == "" && o.(string) == codedeploy.OutdatedInstancesStrategyIgnore { // if the user is trying to remove the strategy, set it to update (the default)
+				input.OutdatedInstancesStrategy = aws.String(codedeploy.OutdatedInstancesStrategyUpdate)
+			} else if n.(string) != "" { //
+				input.OutdatedInstancesStrategy = aws.String(n.(string))
+			}
+		}
+
 		log.Printf("[DEBUG] Updating CodeDeploy DeploymentGroup %s", d.Id())
 
 		var err error
@@ -801,7 +776,7 @@ func resourceDeploymentGroupDelete(ctx context.Context, d *schema.ResourceData,
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).DeployConn(ctx)
 
-	log.Printf("[DEBUG] Deleting CodeDeploy DeploymentGroup %s", d.Id())
+	log.Printf("[DEBUG] Deleting CodeDeploy Deployment Group: %s", d.Id())
 	_, err := conn.DeleteDeploymentGroupWithContext(ctx, &codedeploy.DeleteDeploymentGroupInput{
 		ApplicationName:     aws.String(d.Get("app_name").(string)),
 		DeploymentGroupName: aws.String(d.Get("deployment_group_name").(string)),
@@ -817,6 +792,32 @@ func resourceDeploymentGroupDelete(ctx context.Context, d *schema.ResourceData,
 	return diags
 }
 
+func FindDeploymentGroupByTwoPartKey(ctx context.Context, conn *codedeploy.CodeDeploy, applicationName, deploymentGroupName string) (*codedeploy.DeploymentGroupInfo, error) {
+	input := &codedeploy.GetDeploymentGroupInput{
+		ApplicationName:     aws.String(applicationName),
+		DeploymentGroupName: aws.String(deploymentGroupName),
+	}
+
+	output, err := conn.GetDeploymentGroupWithContext(ctx, input)
+
+	if tfawserr.ErrCodeEquals(err, codedeploy.ErrCodeApplicationDoesNotExistException, codedeploy.ErrCodeDeploymentGroupDoesNotExistException) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	if output == nil || output.DeploymentGroupInfo == nil {
+		return nil, tfresource.NewEmptyResultError(input)
+	}
+
+	return output.DeploymentGroupInfo, nil
+}
+
 // buildOnPremTagFilters converts raw schema lists into a list of
 // codedeploy.TagFilters.
 func buildOnPremTagFilters(configured []interface{}) []*codedeploy.TagFilter {
diff --git a/internal/service/deploy/deployment_group_test.go b/internal/service/deploy/deployment_group_test.go
index f329b9e4b5e..715dcb7d837 100644
--- a/internal/service/deploy/deployment_group_test.go
+++ b/internal/service/deploy/deployment_group_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package deploy_test
 
 import (
@@ -8,9 +11,9 @@ import (
 	"sort"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/codedeploy"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -18,6 +21,7 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	tfcodedeploy "github.com/hashicorp/terraform-provider-aws/internal/service/deploy"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
 func TestAccDeployDeploymentGroup_basic(t *testing.T) {
@@ -383,7 +387,7 @@ func TestAccDeployDeploymentGroup_Trigger_multiple(t *testing.T) {
 						"InstanceFailure",
 					}),
 					testAccCheckDeploymentGroupTriggerTargetARN(&group, "test-trigger-2",
-						regexp.MustCompile(fmt.Sprintf("^arn:%s:sns:[^:]+:[0-9]{12}:tf-acc-test-2-%s$", acctest.Partition(), rName))),
+						regexache.MustCompile(fmt.Sprintf("^arn:%s:sns:[^:]+:[0-9]{12}:tf-acc-test-2-%s$", acctest.Partition(), rName))),
 				),
 			},
 			{
@@ -404,7 +408,7 @@ func TestAccDeployDeploymentGroup_Trigger_multiple(t *testing.T) {
 						"InstanceFailure",
 					}),
 					testAccCheckDeploymentGroupTriggerTargetARN(&group, "test-trigger-2",
-						regexp.MustCompile(fmt.Sprintf("^arn:%s:sns:[^:]+:[0-9]{12}:tf-acc-test-3-%s$", acctest.Partition(), rName))),
+						regexache.MustCompile(fmt.Sprintf("^arn:%s:sns:[^:]+:[0-9]{12}:tf-acc-test-3-%s$", acctest.Partition(), rName))),
 				),
 			},
 			{
@@ -1790,6 +1794,66 @@ func TestAccDeployDeploymentGroup_ECS_blueGreen(t *testing.T) {
 	})
 }
 
+func TestAccDeployDeploymentGroup_OutdatedInstancesStrategy_update(t *testing.T) {
+	ctx := acctest.Context(t)
+	var group codedeploy.DeploymentGroupInfo
+	resourceName := "aws_codedeploy_deployment_group.test"
+
+	rName := sdkacctest.RandString(5)
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, codedeploy.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckDeploymentGroupDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccDeploymentGroupConfig_outdatedInstancesStrategy(rName, "UPDATE"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckDeploymentGroupExists(ctx, resourceName, &group),
+					resource.TestCheckResourceAttr(resourceName, "outdated_instances_strategy", "UPDATE"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateIdFunc: testAccDeploymentGroupImportStateIdFunc(resourceName),
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
+func TestAccDeployDeploymentGroup_OutdatedInstancesStrategy_ignore(t *testing.T) {
+	ctx := acctest.Context(t)
+	var group codedeploy.DeploymentGroupInfo
+	resourceName := "aws_codedeploy_deployment_group.test"
+
+	rName := sdkacctest.RandString(5)
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, codedeploy.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckDeploymentGroupDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccDeploymentGroupConfig_outdatedInstancesStrategy(rName, "IGNORE"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckDeploymentGroupExists(ctx, resourceName, &group),
+					resource.TestCheckResourceAttr(resourceName, "outdated_instances_strategy", "IGNORE"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateIdFunc: testAccDeploymentGroupImportStateIdFunc(resourceName),
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
 func TestDeploymentGroup_buildTriggerConfigs(t *testing.T) {
 	t.Parallel()
 
@@ -2344,47 +2408,39 @@ func testAccCheckDeploymentGroupDestroy(ctx context.Context) resource.TestCheckF
 				continue
 			}
 
-			resp, err := conn.GetDeploymentGroupWithContext(ctx, &codedeploy.GetDeploymentGroupInput{
-				ApplicationName:     aws.String(rs.Primary.Attributes["app_name"]),
-				DeploymentGroupName: aws.String(rs.Primary.Attributes["deployment_group_name"]),
-			})
+			_, err := tfcodedeploy.FindDeploymentGroupByTwoPartKey(ctx, conn, rs.Primary.Attributes["app_name"], rs.Primary.Attributes["deployment_group_name"])
 
-			if tfawserr.ErrCodeEquals(err, codedeploy.ErrCodeApplicationDoesNotExistException) {
+			if tfresource.NotFound(err) {
 				continue
 			}
 
-			if err == nil {
-				if resp.DeploymentGroupInfo.DeploymentGroupName != nil {
-					return fmt.Errorf("CodeDeploy deployment group still exists:\n%#v", *resp.DeploymentGroupInfo.DeploymentGroupName)
-				}
+			if err != nil {
+				return err
 			}
 
-			return err
+			return fmt.Errorf("CodeDeploy Deployment Group %s still exists", rs.Primary.ID)
 		}
 
 		return nil
 	}
 }
 
-func testAccCheckDeploymentGroupExists(ctx context.Context, name string, group *codedeploy.DeploymentGroupInfo) resource.TestCheckFunc {
+func testAccCheckDeploymentGroupExists(ctx context.Context, n string, v *codedeploy.DeploymentGroupInfo) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		rs, ok := s.RootModule().Resources[name]
+		rs, ok := s.RootModule().Resources[n]
 		if !ok {
-			return fmt.Errorf("Not found: %s", name)
+			return fmt.Errorf("Not found: %s", n)
 		}
 
 		conn := acctest.Provider.Meta().(*conns.AWSClient).DeployConn(ctx)
 
-		resp, err := conn.GetDeploymentGroupWithContext(ctx, &codedeploy.GetDeploymentGroupInput{
-			ApplicationName:     aws.String(rs.Primary.Attributes["app_name"]),
-			DeploymentGroupName: aws.String(rs.Primary.Attributes["deployment_group_name"]),
-		})
+		output, err := tfcodedeploy.FindDeploymentGroupByTwoPartKey(ctx, conn, rs.Primary.Attributes["app_name"], rs.Primary.Attributes["deployment_group_name"])
 
 		if err != nil {
 			return err
 		}
 
-		*group = *resp.DeploymentGroupInfo
+		*v = *output
 
 		return nil
 	}
@@ -3711,3 +3767,14 @@ resource "aws_codedeploy_deployment_group" "test" {
 }
 `, rName, tagKey1, tagValue1, tagKey2, tagValue2)
 }
+
+func testAccDeploymentGroupConfig_outdatedInstancesStrategy(rName string, outdatedInstancesStrategy string) string {
+	return fmt.Sprintf(`
+resource "aws_codedeploy_deployment_group" "test" {
+  app_name                    = aws_codedeploy_app.test.name
+  deployment_group_name       = "tf-acc-test-%[1]s"
+  service_role_arn            = aws_iam_role.test.arn
+  outdated_instances_strategy = "%[2]s"
+}
+`, rName, outdatedInstancesStrategy) + testAccDeploymentGroupConfig_base(rName)
+}
diff --git a/internal/service/deploy/generate.go b/internal/service/deploy/generate.go
index 442d5ddea4d..b31e992c86d 100644
--- a/internal/service/deploy/generate.go
+++ b/internal/service/deploy/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTags -ServiceTagsSlice -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/deploy/service_package_gen.go b/internal/service/deploy/service_package_gen.go
index 7326a6de937..d6b5f03cecb 100644
--- a/internal/service/deploy/service_package_gen.go
+++ b/internal/service/deploy/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	codedeploy_sdkv1 "github.com/aws/aws-sdk-go/service/codedeploy"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -62,4 +63,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*c
 	return codedeploy_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/deploy/sweep.go b/internal/service/deploy/sweep.go
index 60c655b0b10..bba68aeaaa8 100644
--- a/internal/service/deploy/sweep.go
+++ b/internal/service/deploy/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package deploy
 
@@ -12,9 +12,10 @@ import (
 	"github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_codedeploy_app", &resource.Sweeper{
 		Name: "aws_codedeploy_app",
 		F:    sweepApps,
@@ -23,7 +24,7 @@ func init() {
 
 func sweepApps(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
@@ -57,11 +58,11 @@ func sweepApps(region string) error {
 		errs = multierror.Append(errs, fmt.Errorf("error describing CodeDeploy Applications for %s: %w", region, err))
 	}
 
-	if err = sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err = sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("error sweeping CodeDeploy Applications for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
+	if awsv1.SkipSweepError(errs.ErrorOrNil()) {
 		log.Printf("[WARN] Skipping CodeDeploy Applications sweep for %s: %s", region, errs)
 		return nil
 	}
diff --git a/internal/service/deploy/tags_gen.go b/internal/service/deploy/tags_gen.go
index 35c987045e7..ca8fb4b42c9 100644
--- a/internal/service/deploy/tags_gen.go
+++ b/internal/service/deploy/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/codedeploy"
 	"github.com/aws/aws-sdk-go/service/codedeploy/codedeployiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -102,6 +104,8 @@ func updateTags(ctx context.Context, conn codedeployiface.CodeDeployAPI, identif
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.Deploy)
 	if len(removedTags) > 0 {
diff --git a/internal/service/deploy/validate.go b/internal/service/deploy/validate.go
index e403f0af15d..3337bf2f83e 100644
--- a/internal/service/deploy/validate.go
+++ b/internal/service/deploy/validate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package deploy
 
 import (
diff --git a/internal/service/detective/detective_test.go b/internal/service/detective/detective_test.go
index e59ff06b2a4..1ddfbca9fb8 100644
--- a/internal/service/detective/detective_test.go
+++ b/internal/service/detective/detective_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package detective_test
 
 import (
diff --git a/internal/service/detective/find.go b/internal/service/detective/find.go
index 7324ee02f2c..54c6ce5a4ff 100644
--- a/internal/service/detective/find.go
+++ b/internal/service/detective/find.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package detective
 
 import (
diff --git a/internal/service/detective/generate.go b/internal/service/detective/generate.go
index b2e4bae174e..06ef30ccf6e 100644
--- a/internal/service/detective/generate.go
+++ b/internal/service/detective/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ServiceTagsMap -ListTags -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/detective/graph.go b/internal/service/detective/graph.go
index a1864ccc2bb..bc3505089aa 100644
--- a/internal/service/detective/graph.go
+++ b/internal/service/detective/graph.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package detective
 
 import (
diff --git a/internal/service/detective/graph_test.go b/internal/service/detective/graph_test.go
index a155cc2ed84..283b2022e89 100644
--- a/internal/service/detective/graph_test.go
+++ b/internal/service/detective/graph_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package detective_test
 
 import (
diff --git a/internal/service/detective/invitation_accepter.go b/internal/service/detective/invitation_accepter.go
index d7338e52840..befccf8ecc5 100644
--- a/internal/service/detective/invitation_accepter.go
+++ b/internal/service/detective/invitation_accepter.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package detective
 
 import (
diff --git a/internal/service/detective/invitation_accepter_test.go b/internal/service/detective/invitation_accepter_test.go
index fccb8404d98..dddd940516c 100644
--- a/internal/service/detective/invitation_accepter_test.go
+++ b/internal/service/detective/invitation_accepter_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package detective_test
 
 import (
diff --git a/internal/service/detective/member.go b/internal/service/detective/member.go
index c73e1c1f43b..593eb4061a3 100644
--- a/internal/service/detective/member.go
+++ b/internal/service/detective/member.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package detective
 
 import (
diff --git a/internal/service/detective/member_test.go b/internal/service/detective/member_test.go
index b7dae883f13..99baaf6a57a 100644
--- a/internal/service/detective/member_test.go
+++ b/internal/service/detective/member_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package detective_test
 
 import (
diff --git a/internal/service/detective/service_package_gen.go b/internal/service/detective/service_package_gen.go
index df937e09b10..bfe36c55e9a 100644
--- a/internal/service/detective/service_package_gen.go
+++ b/internal/service/detective/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	detective_sdkv1 "github.com/aws/aws-sdk-go/service/detective"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -58,4 +59,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*d
 	return detective_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/detective/status.go b/internal/service/detective/status.go
index 15ec791e75e..8318551652a 100644
--- a/internal/service/detective/status.go
+++ b/internal/service/detective/status.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package detective
 
 import (
diff --git a/internal/service/detective/tags_gen.go b/internal/service/detective/tags_gen.go
index d593b562b03..aa55884f016 100644
--- a/internal/service/detective/tags_gen.go
+++ b/internal/service/detective/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/detective"
 	"github.com/aws/aws-sdk-go/service/detective/detectiveiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -54,7 +56,7 @@ func Tags(tags tftags.KeyValueTags) map[string]*string {
 	return aws.StringMap(tags.Map())
 }
 
-// KeyValueTags creates KeyValueTags from detective service tags.
+// KeyValueTags creates tftags.KeyValueTags from detective service tags.
 func KeyValueTags(ctx context.Context, tags map[string]*string) tftags.KeyValueTags {
 	return tftags.New(ctx, tags)
 }
@@ -85,6 +87,8 @@ func updateTags(ctx context.Context, conn detectiveiface.DetectiveAPI, identifie
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.Detective)
 	if len(removedTags) > 0 {
diff --git a/internal/service/detective/wait.go b/internal/service/detective/wait.go
index 391ef23b1ba..9b4876e1253 100644
--- a/internal/service/detective/wait.go
+++ b/internal/service/detective/wait.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package detective
 
 import (
diff --git a/internal/service/devicefarm/device_pool.go b/internal/service/devicefarm/device_pool.go
index 0f8f8481379..08d43759535 100644
--- a/internal/service/devicefarm/device_pool.go
+++ b/internal/service/devicefarm/device_pool.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package devicefarm
 
 import (
diff --git a/internal/service/devicefarm/device_pool_test.go b/internal/service/devicefarm/device_pool_test.go
index da98cf5bc1e..92596b14e31 100644
--- a/internal/service/devicefarm/device_pool_test.go
+++ b/internal/service/devicefarm/device_pool_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package devicefarm_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws/endpoints"
 	"github.com/aws/aws-sdk-go/service/devicefarm"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -44,7 +47,7 @@ func TestAccDeviceFarmDevicePool_basic(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckResourceAttrPair(resourceName, "project_arn", "aws_devicefarm_project.test", "arn"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "devicefarm", regexp.MustCompile(`devicepool:.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "devicefarm", regexache.MustCompile(`devicepool:.+`)),
 				),
 			},
 			{
@@ -57,7 +60,7 @@ func TestAccDeviceFarmDevicePool_basic(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDevicePoolExists(ctx, resourceName, &pool),
 					resource.TestCheckResourceAttr(resourceName, "name", rNameUpdated),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "devicefarm", regexp.MustCompile(`devicepool:.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "devicefarm", regexache.MustCompile(`devicepool:.+`)),
 				),
 			},
 		},
diff --git a/internal/service/devicefarm/find.go b/internal/service/devicefarm/find.go
index b71fab7c017..7e774e95880 100644
--- a/internal/service/devicefarm/find.go
+++ b/internal/service/devicefarm/find.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package devicefarm
 
 import (
diff --git a/internal/service/devicefarm/generate.go b/internal/service/devicefarm/generate.go
index 8c3e1eb90b8..3d7ddc520d5 100644
--- a/internal/service/devicefarm/generate.go
+++ b/internal/service/devicefarm/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTags -ListTagsInIDElem=ResourceARN -ServiceTagsSlice -TagInIDElem=ResourceARN -UpdateTags -CreateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/devicefarm/instance_profile.go b/internal/service/devicefarm/instance_profile.go
index d1f55edb353..fb2cee90f88 100644
--- a/internal/service/devicefarm/instance_profile.go
+++ b/internal/service/devicefarm/instance_profile.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package devicefarm
 
 import (
diff --git a/internal/service/devicefarm/instance_profile_test.go b/internal/service/devicefarm/instance_profile_test.go
index 56a69c506d6..4ed7c8a1dff 100644
--- a/internal/service/devicefarm/instance_profile_test.go
+++ b/internal/service/devicefarm/instance_profile_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package devicefarm_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws/endpoints"
 	"github.com/aws/aws-sdk-go/service/devicefarm"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -43,7 +46,7 @@ func TestAccDeviceFarmInstanceProfile_basic(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "reboot_after_use", "true"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "devicefarm", regexp.MustCompile(`instanceprofile:.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "devicefarm", regexache.MustCompile(`instanceprofile:.+`)),
 				),
 			},
 			{
@@ -58,7 +61,7 @@ func TestAccDeviceFarmInstanceProfile_basic(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "name", rNameUpdated),
 					resource.TestCheckResourceAttr(resourceName, "reboot_after_use", "true"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "devicefarm", regexp.MustCompile(`instanceprofile:.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "devicefarm", regexache.MustCompile(`instanceprofile:.+`)),
 				),
 			},
 		},
diff --git a/internal/service/devicefarm/network_profile.go b/internal/service/devicefarm/network_profile.go
index 220421a3f01..5f113348c65 100644
--- a/internal/service/devicefarm/network_profile.go
+++ b/internal/service/devicefarm/network_profile.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package devicefarm
 
 import (
diff --git a/internal/service/devicefarm/network_profile_test.go b/internal/service/devicefarm/network_profile_test.go
index 5dfa14a6747..2b5d7025c32 100644
--- a/internal/service/devicefarm/network_profile_test.go
+++ b/internal/service/devicefarm/network_profile_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package devicefarm_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws/endpoints"
 	"github.com/aws/aws-sdk-go/service/devicefarm"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -46,7 +49,7 @@ func TestAccDeviceFarmNetworkProfile_basic(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "uplink_bandwidth_bits", "104857600"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 					resource.TestCheckResourceAttrPair(resourceName, "project_arn", "aws_devicefarm_project.test", "arn"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "devicefarm", regexp.MustCompile(`networkprofile:.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "devicefarm", regexache.MustCompile(`networkprofile:.+`)),
 				),
 			},
 			{
@@ -64,7 +67,7 @@ func TestAccDeviceFarmNetworkProfile_basic(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "uplink_bandwidth_bits", "104857600"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 					resource.TestCheckResourceAttrPair(resourceName, "project_arn", "aws_devicefarm_project.test", "arn"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "devicefarm", regexp.MustCompile(`networkprofile:.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "devicefarm", regexache.MustCompile(`networkprofile:.+`)),
 				),
 			},
 		},
diff --git a/internal/service/devicefarm/project.go b/internal/service/devicefarm/project.go
index 53df6deb33c..158731c403e 100644
--- a/internal/service/devicefarm/project.go
+++ b/internal/service/devicefarm/project.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package devicefarm
 
 import (
diff --git a/internal/service/devicefarm/project_test.go b/internal/service/devicefarm/project_test.go
index 8eb9f82a72c..2732042b974 100644
--- a/internal/service/devicefarm/project_test.go
+++ b/internal/service/devicefarm/project_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package devicefarm_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws/endpoints"
 	"github.com/aws/aws-sdk-go/service/devicefarm"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -42,7 +45,7 @@ func TestAccDeviceFarmProject_basic(t *testing.T) {
 					testAccCheckProjectExists(ctx, resourceName, &proj),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "devicefarm", regexp.MustCompile(`project:.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "devicefarm", regexache.MustCompile(`project:.+`)),
 				),
 			},
 			{
@@ -55,7 +58,7 @@ func TestAccDeviceFarmProject_basic(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckProjectExists(ctx, resourceName, &proj),
 					resource.TestCheckResourceAttr(resourceName, "name", rNameUpdated),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "devicefarm", regexp.MustCompile(`project:.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "devicefarm", regexache.MustCompile(`project:.+`)),
 				),
 			},
 		},
diff --git a/internal/service/devicefarm/service_package_gen.go b/internal/service/devicefarm/service_package_gen.go
index 99a065a5bb6..073777ea9ac 100644
--- a/internal/service/devicefarm/service_package_gen.go
+++ b/internal/service/devicefarm/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	devicefarm_sdkv1 "github.com/aws/aws-sdk-go/service/devicefarm"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -86,4 +87,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*d
 	return devicefarm_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/devicefarm/sweep.go b/internal/service/devicefarm/sweep.go
index 909a437e18c..c0bc99a3577 100644
--- a/internal/service/devicefarm/sweep.go
+++ b/internal/service/devicefarm/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package devicefarm
 
@@ -12,9 +12,10 @@ import (
 	"github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_devicefarm_project", &resource.Sweeper{
 		Name: "aws_devicefarm_project",
 		F:    sweepProjects,
@@ -28,7 +29,7 @@ func init() {
 
 func sweepProjects(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
@@ -69,11 +70,11 @@ func sweepProjects(region string) error {
 		errs = multierror.Append(errs, fmt.Errorf("error listing DeviceFarm Project for %s: %w", region, err))
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("error sweeping DeviceFarm Project for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping DeviceFarm Project sweep for %s: %s", region, errs)
 		return nil
 	}
@@ -83,7 +84,7 @@ func sweepProjects(region string) error {
 
 func sweepTestGridProjects(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
@@ -124,11 +125,11 @@ func sweepTestGridProjects(region string) error {
 		errs = multierror.Append(errs, fmt.Errorf("error listing DeviceFarm Test Grid Project for %s: %w", region, err))
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("error sweeping DeviceFarm Test Grid Project for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping DeviceFarm Test Grid Project sweep for %s: %s", region, errs)
 		return nil
 	}
diff --git a/internal/service/devicefarm/tags_gen.go b/internal/service/devicefarm/tags_gen.go
index 5878f73a397..f3c00bf3d35 100644
--- a/internal/service/devicefarm/tags_gen.go
+++ b/internal/service/devicefarm/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/devicefarm"
 	"github.com/aws/aws-sdk-go/service/devicefarm/devicefarmiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -111,6 +113,8 @@ func updateTags(ctx context.Context, conn devicefarmiface.DeviceFarmAPI, identif
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.DeviceFarm)
 	if len(removedTags) > 0 {
diff --git a/internal/service/devicefarm/test_grid_project.go b/internal/service/devicefarm/test_grid_project.go
index d43323c1406..df6f57a53e3 100644
--- a/internal/service/devicefarm/test_grid_project.go
+++ b/internal/service/devicefarm/test_grid_project.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package devicefarm
 
 import (
diff --git a/internal/service/devicefarm/test_grid_project_test.go b/internal/service/devicefarm/test_grid_project_test.go
index 743cb773a20..f0bcca3f157 100644
--- a/internal/service/devicefarm/test_grid_project_test.go
+++ b/internal/service/devicefarm/test_grid_project_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package devicefarm_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws/endpoints"
 	"github.com/aws/aws-sdk-go/service/devicefarm"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -43,7 +46,7 @@ func TestAccDeviceFarmTestGridProject_basic(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "vpc_config.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "devicefarm", regexp.MustCompile(`testgrid-project:.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "devicefarm", regexache.MustCompile(`testgrid-project:.+`)),
 				),
 			},
 			{
@@ -56,7 +59,7 @@ func TestAccDeviceFarmTestGridProject_basic(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckProjectTestGridProjectExists(ctx, resourceName, &proj),
 					resource.TestCheckResourceAttr(resourceName, "name", rNameUpdated),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "devicefarm", regexp.MustCompile(`testgrid-project:.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "devicefarm", regexache.MustCompile(`testgrid-project:.+`)),
 				),
 			},
 		},
diff --git a/internal/service/devicefarm/upload.go b/internal/service/devicefarm/upload.go
index 1b8d90e9dfb..53b67c7673a 100644
--- a/internal/service/devicefarm/upload.go
+++ b/internal/service/devicefarm/upload.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package devicefarm
 
 import (
diff --git a/internal/service/devicefarm/upload_test.go b/internal/service/devicefarm/upload_test.go
index d6ddd4f9483..0ca8c1f63fd 100644
--- a/internal/service/devicefarm/upload_test.go
+++ b/internal/service/devicefarm/upload_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package devicefarm_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws/endpoints"
 	"github.com/aws/aws-sdk-go/service/devicefarm"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -41,7 +44,7 @@ func TestAccDeviceFarmUpload_basic(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckUploadExists(ctx, resourceName, &proj),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "devicefarm", regexp.MustCompile(`upload:.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "devicefarm", regexache.MustCompile(`upload:.+`)),
 					resource.TestCheckResourceAttr(resourceName, "type", "APPIUM_JAVA_TESTNG_TEST_SPEC"),
 					resource.TestCheckResourceAttr(resourceName, "category", "PRIVATE"),
 					resource.TestCheckResourceAttrSet(resourceName, "url"),
@@ -58,7 +61,7 @@ func TestAccDeviceFarmUpload_basic(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckUploadExists(ctx, resourceName, &proj),
 					resource.TestCheckResourceAttr(resourceName, "name", rNameUpdated),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "devicefarm", regexp.MustCompile(`upload:.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "devicefarm", regexache.MustCompile(`upload:.+`)),
 					resource.TestCheckResourceAttr(resourceName, "type", "APPIUM_JAVA_TESTNG_TEST_SPEC"),
 					resource.TestCheckResourceAttr(resourceName, "category", "PRIVATE"),
 					resource.TestCheckResourceAttrSet(resourceName, "url"),
diff --git a/internal/service/directconnect/acc_test.go b/internal/service/directconnect/acc_test.go
index a17cc2d5f09..0886a423d3b 100644
--- a/internal/service/directconnect/acc_test.go
+++ b/internal/service/directconnect/acc_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package directconnect_test
 
 import (
diff --git a/internal/service/directconnect/bgp_peer.go b/internal/service/directconnect/bgp_peer.go
index 7413f757bb3..4d48c9cb8bd 100644
--- a/internal/service/directconnect/bgp_peer.go
+++ b/internal/service/directconnect/bgp_peer.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package directconnect
 
 import (
diff --git a/internal/service/directconnect/bgp_peer_test.go b/internal/service/directconnect/bgp_peer_test.go
index 31799d2bac1..ba3a6e17d33 100644
--- a/internal/service/directconnect/bgp_peer_test.go
+++ b/internal/service/directconnect/bgp_peer_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package directconnect_test
 
 import (
diff --git a/internal/service/directconnect/connection.go b/internal/service/directconnect/connection.go
index fdeacced7ab..a8f8693a164 100644
--- a/internal/service/directconnect/connection.go
+++ b/internal/service/directconnect/connection.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package directconnect
 
 import (
diff --git a/internal/service/directconnect/connection_association.go b/internal/service/directconnect/connection_association.go
index 8ef86aace60..384a6b79f4c 100644
--- a/internal/service/directconnect/connection_association.go
+++ b/internal/service/directconnect/connection_association.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package directconnect
 
 import (
diff --git a/internal/service/directconnect/connection_association_test.go b/internal/service/directconnect/connection_association_test.go
index af1bbfee3e7..8191316b8ec 100644
--- a/internal/service/directconnect/connection_association_test.go
+++ b/internal/service/directconnect/connection_association_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package directconnect_test
 
 import (
diff --git a/internal/service/directconnect/connection_confirmation.go b/internal/service/directconnect/connection_confirmation.go
index fb66ff1ca82..7dd9f4e8fb2 100644
--- a/internal/service/directconnect/connection_confirmation.go
+++ b/internal/service/directconnect/connection_confirmation.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package directconnect
 
 import (
diff --git a/internal/service/directconnect/connection_confirmation_test.go b/internal/service/directconnect/connection_confirmation_test.go
index 3fc197650b7..a6372418345 100644
--- a/internal/service/directconnect/connection_confirmation_test.go
+++ b/internal/service/directconnect/connection_confirmation_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package directconnect_test
 
 import (
diff --git a/internal/service/directconnect/connection_data_source.go b/internal/service/directconnect/connection_data_source.go
index bc27441be49..fe7333b5395 100644
--- a/internal/service/directconnect/connection_data_source.go
+++ b/internal/service/directconnect/connection_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package directconnect
 
 import (
diff --git a/internal/service/directconnect/connection_data_source_test.go b/internal/service/directconnect/connection_data_source_test.go
index 6d78c53330b..8eb88a07034 100644
--- a/internal/service/directconnect/connection_data_source_test.go
+++ b/internal/service/directconnect/connection_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package directconnect_test
 
 import (
diff --git a/internal/service/directconnect/connection_test.go b/internal/service/directconnect/connection_test.go
index ad00347f674..877a240d846 100644
--- a/internal/service/directconnect/connection_test.go
+++ b/internal/service/directconnect/connection_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package directconnect_test
 
 import (
 	"context"
 	"fmt"
 	"os"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/directconnect"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -33,7 +36,7 @@ func TestAccDirectConnectConnection_basic(t *testing.T) {
 				Config: testAccConnectionConfig_basic(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckConnectionExists(ctx, resourceName, &connection),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "directconnect", regexp.MustCompile(`dxcon/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "directconnect", regexache.MustCompile(`dxcon/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "bandwidth", "1Gbps"),
 					resource.TestCheckResourceAttrSet(resourceName, "location"),
 					acctest.CheckResourceAttrAccountID(resourceName, "owner_account_id"),
@@ -115,7 +118,7 @@ func TestAccDirectConnectConnection_encryptionMode(t *testing.T) {
 				Config: testAccConnectionConfig_encryptionModeNoEncrypt(connectionName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckConnectionExists(ctx, resourceName, &connection),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "directconnect", regexp.MustCompile(`dxcon/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "directconnect", regexache.MustCompile(`dxcon/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "encryption_mode", "no_encrypt"),
 					resource.TestCheckResourceAttrSet(resourceName, "location"),
 					resource.TestCheckResourceAttr(resourceName, "name", connectionName),
@@ -126,7 +129,7 @@ func TestAccDirectConnectConnection_encryptionMode(t *testing.T) {
 				Config: testAccConnectionConfig_encryptionModeShouldEncrypt(connectionName, ckn, cak),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckConnectionExists(ctx, resourceName, &connection),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "directconnect", regexp.MustCompile(`dxcon/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "directconnect", regexache.MustCompile(`dxcon/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "encryption_mode", "should_encrypt"),
 					resource.TestCheckResourceAttrSet(resourceName, "location"),
 					resource.TestCheckResourceAttr(resourceName, "name", connectionName),
@@ -153,7 +156,7 @@ func TestAccDirectConnectConnection_macsecRequested(t *testing.T) {
 				Config: testAccConnectionConfig_macsecEnabled(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckConnectionExists(ctx, resourceName, &connection),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "directconnect", regexp.MustCompile(`dxcon/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "directconnect", regexache.MustCompile(`dxcon/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "bandwidth", "100Gbps"),
 					resource.TestCheckResourceAttrSet(resourceName, "location"),
 					resource.TestCheckResourceAttr(resourceName, "request_macsec", "true"),
@@ -189,7 +192,7 @@ func TestAccDirectConnectConnection_providerName(t *testing.T) {
 				Config: testAccConnectionConfig_providerName(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckConnectionExists(ctx, resourceName, &connection),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "directconnect", regexp.MustCompile(`dxcon/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "directconnect", regexache.MustCompile(`dxcon/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "bandwidth", "1Gbps"),
 					resource.TestCheckResourceAttrSet(resourceName, "location"),
 					acctest.CheckResourceAttrAccountID(resourceName, "owner_account_id"),
diff --git a/internal/service/directconnect/find.go b/internal/service/directconnect/find.go
index e28d753b167..a9bd6ce7a18 100644
--- a/internal/service/directconnect/find.go
+++ b/internal/service/directconnect/find.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package directconnect
 
 import (
diff --git a/internal/service/directconnect/gateway.go b/internal/service/directconnect/gateway.go
index e694a1acf0a..f8ccdcf5702 100644
--- a/internal/service/directconnect/gateway.go
+++ b/internal/service/directconnect/gateway.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package directconnect
 
 import (
diff --git a/internal/service/directconnect/gateway_association.go b/internal/service/directconnect/gateway_association.go
index adef1f26a2e..5f2b9012615 100644
--- a/internal/service/directconnect/gateway_association.go
+++ b/internal/service/directconnect/gateway_association.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package directconnect
 
 import (
diff --git a/internal/service/directconnect/gateway_association_migrate.go b/internal/service/directconnect/gateway_association_migrate.go
index 5657afb95a7..6b655bb2816 100644
--- a/internal/service/directconnect/gateway_association_migrate.go
+++ b/internal/service/directconnect/gateway_association_migrate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package directconnect
 
 import (
diff --git a/internal/service/directconnect/gateway_association_proposal.go b/internal/service/directconnect/gateway_association_proposal.go
index 1d2672a3c68..f64345ececd 100644
--- a/internal/service/directconnect/gateway_association_proposal.go
+++ b/internal/service/directconnect/gateway_association_proposal.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package directconnect
 
 import (
diff --git a/internal/service/directconnect/gateway_association_proposal_test.go b/internal/service/directconnect/gateway_association_proposal_test.go
index 8eb6812cedf..5d366d179a7 100644
--- a/internal/service/directconnect/gateway_association_proposal_test.go
+++ b/internal/service/directconnect/gateway_association_proposal_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package directconnect_test
 
 import (
diff --git a/internal/service/directconnect/gateway_association_test.go b/internal/service/directconnect/gateway_association_test.go
index 5165b2ff358..187ae16ba64 100644
--- a/internal/service/directconnect/gateway_association_test.go
+++ b/internal/service/directconnect/gateway_association_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package directconnect_test
 
 import (
diff --git a/internal/service/directconnect/gateway_data_source.go b/internal/service/directconnect/gateway_data_source.go
index e95917bdb8f..0765282ae5f 100644
--- a/internal/service/directconnect/gateway_data_source.go
+++ b/internal/service/directconnect/gateway_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package directconnect
 
 import (
diff --git a/internal/service/directconnect/gateway_data_source_test.go b/internal/service/directconnect/gateway_data_source_test.go
index d168c9773d1..395e15bd027 100644
--- a/internal/service/directconnect/gateway_data_source_test.go
+++ b/internal/service/directconnect/gateway_data_source_test.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package directconnect_test
 
 import (
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/directconnect"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -24,7 +27,7 @@ func TestAccDirectConnectGatewayDataSource_basic(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccGatewayDataSourceConfig_nonExistent,
-				ExpectError: regexp.MustCompile(`Direct Connect Gateway not found`),
+				ExpectError: regexache.MustCompile(`Direct Connect Gateway not found`),
 			},
 			{
 				Config: testAccGatewayDataSourceConfig_name(rName, sdkacctest.RandIntRange(64512, 65534)),
diff --git a/internal/service/directconnect/gateway_test.go b/internal/service/directconnect/gateway_test.go
index 7c73510fdfb..be7e8bab52d 100644
--- a/internal/service/directconnect/gateway_test.go
+++ b/internal/service/directconnect/gateway_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package directconnect_test
 
 import (
diff --git a/internal/service/directconnect/generate.go b/internal/service/directconnect/generate.go
index 48fd9d671e6..13a0f277c61 100644
--- a/internal/service/directconnect/generate.go
+++ b/internal/service/directconnect/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/listpages/main.go -ListOps=DescribeDirectConnectGateways,DescribeDirectConnectGatewayAssociations,DescribeDirectConnectGatewayAssociationProposals
 //go:generate go run ../../generate/tags/main.go -ListTags -ListTagsOp=DescribeTags -ListTagsInIDElem=ResourceArns -ListTagsInIDNeedSlice=yes -ListTagsOutTagsElem=ResourceTags[0].Tags -ServiceTagsSlice -UpdateTags -CreateTags
 //go:generate go run ../../generate/servicepackage/main.go
diff --git a/internal/service/directconnect/hosted_connection.go b/internal/service/directconnect/hosted_connection.go
index daba65247a8..c0601520e31 100644
--- a/internal/service/directconnect/hosted_connection.go
+++ b/internal/service/directconnect/hosted_connection.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package directconnect
 
 import (
diff --git a/internal/service/directconnect/hosted_connection_test.go b/internal/service/directconnect/hosted_connection_test.go
index d96932ee585..5bd3d79b3cb 100644
--- a/internal/service/directconnect/hosted_connection_test.go
+++ b/internal/service/directconnect/hosted_connection_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package directconnect_test
 
 import (
diff --git a/internal/service/directconnect/hosted_private_virtual_interface.go b/internal/service/directconnect/hosted_private_virtual_interface.go
index 5b534a5cb49..50af122d5f2 100644
--- a/internal/service/directconnect/hosted_private_virtual_interface.go
+++ b/internal/service/directconnect/hosted_private_virtual_interface.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package directconnect
 
 import (
diff --git a/internal/service/directconnect/hosted_private_virtual_interface_accepter.go b/internal/service/directconnect/hosted_private_virtual_interface_accepter.go
index 7cb88f9cdb0..3744491ffd9 100644
--- a/internal/service/directconnect/hosted_private_virtual_interface_accepter.go
+++ b/internal/service/directconnect/hosted_private_virtual_interface_accepter.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package directconnect
 
 import (
diff --git a/internal/service/directconnect/hosted_private_virtual_interface_test.go b/internal/service/directconnect/hosted_private_virtual_interface_test.go
index c1b339bf00b..75140faa96e 100644
--- a/internal/service/directconnect/hosted_private_virtual_interface_test.go
+++ b/internal/service/directconnect/hosted_private_virtual_interface_test.go
@@ -1,13 +1,16 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package directconnect_test
 
 import (
 	"context"
 	"fmt"
 	"os"
-	"regexp"
 	"strconv"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/directconnect"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -47,7 +50,7 @@ func TestAccDirectConnectHostedPrivateVirtualInterface_basic(t *testing.T) {
 					testAccCheckHostedPrivateVirtualInterfaceExists(ctx, resourceName, &vif),
 					resource.TestCheckResourceAttr(resourceName, "address_family", "ipv4"),
 					resource.TestCheckResourceAttrSet(resourceName, "amazon_side_asn"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "directconnect", regexp.MustCompile(fmt.Sprintf("dxvif/%s", aws.StringValue(vif.VirtualInterfaceId)))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "directconnect", regexache.MustCompile(fmt.Sprintf("dxvif/%s", aws.StringValue(vif.VirtualInterfaceId)))),
 					resource.TestCheckResourceAttrSet(resourceName, "aws_device"),
 					resource.TestCheckResourceAttr(resourceName, "bgp_asn", strconv.Itoa(bgpAsn)),
 					resource.TestCheckResourceAttrSet(resourceName, "bgp_auth_key"),
@@ -106,7 +109,7 @@ func TestAccDirectConnectHostedPrivateVirtualInterface_accepterTags(t *testing.T
 					testAccCheckHostedPrivateVirtualInterfaceExists(ctx, resourceName, &vif),
 					resource.TestCheckResourceAttr(resourceName, "address_family", "ipv4"),
 					resource.TestCheckResourceAttrSet(resourceName, "amazon_side_asn"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "directconnect", regexp.MustCompile(fmt.Sprintf("dxvif/%s", aws.StringValue(vif.VirtualInterfaceId)))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "directconnect", regexache.MustCompile(fmt.Sprintf("dxvif/%s", aws.StringValue(vif.VirtualInterfaceId)))),
 					resource.TestCheckResourceAttrSet(resourceName, "aws_device"),
 					resource.TestCheckResourceAttr(resourceName, "bgp_asn", strconv.Itoa(bgpAsn)),
 					resource.TestCheckResourceAttrSet(resourceName, "bgp_auth_key"),
@@ -132,7 +135,7 @@ func TestAccDirectConnectHostedPrivateVirtualInterface_accepterTags(t *testing.T
 					testAccCheckHostedPrivateVirtualInterfaceExists(ctx, resourceName, &vif),
 					resource.TestCheckResourceAttr(resourceName, "address_family", "ipv4"),
 					resource.TestCheckResourceAttrSet(resourceName, "amazon_side_asn"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "directconnect", regexp.MustCompile(fmt.Sprintf("dxvif/%s", aws.StringValue(vif.VirtualInterfaceId)))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "directconnect", regexache.MustCompile(fmt.Sprintf("dxvif/%s", aws.StringValue(vif.VirtualInterfaceId)))),
 					resource.TestCheckResourceAttrSet(resourceName, "aws_device"),
 					resource.TestCheckResourceAttr(resourceName, "bgp_asn", strconv.Itoa(bgpAsn)),
 					resource.TestCheckResourceAttrSet(resourceName, "bgp_auth_key"),
diff --git a/internal/service/directconnect/hosted_public_virtual_interface.go b/internal/service/directconnect/hosted_public_virtual_interface.go
index 5c2697fbb9e..4f679676055 100644
--- a/internal/service/directconnect/hosted_public_virtual_interface.go
+++ b/internal/service/directconnect/hosted_public_virtual_interface.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package directconnect
 
 import (
diff --git a/internal/service/directconnect/hosted_public_virtual_interface_accepter.go b/internal/service/directconnect/hosted_public_virtual_interface_accepter.go
index ba925bbaf88..b864da38d75 100644
--- a/internal/service/directconnect/hosted_public_virtual_interface_accepter.go
+++ b/internal/service/directconnect/hosted_public_virtual_interface_accepter.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package directconnect
 
 import (
diff --git a/internal/service/directconnect/hosted_public_virtual_interface_test.go b/internal/service/directconnect/hosted_public_virtual_interface_test.go
index 28182612cce..e79a2312964 100644
--- a/internal/service/directconnect/hosted_public_virtual_interface_test.go
+++ b/internal/service/directconnect/hosted_public_virtual_interface_test.go
@@ -1,13 +1,16 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package directconnect_test
 
 import (
 	"context"
 	"fmt"
 	"os"
-	"regexp"
 	"strconv"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/directconnect"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -49,7 +52,7 @@ func TestAccDirectConnectHostedPublicVirtualInterface_basic(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "address_family", "ipv4"),
 					resource.TestCheckResourceAttrSet(resourceName, "amazon_address"),
 					resource.TestCheckResourceAttrSet(resourceName, "amazon_side_asn"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "directconnect", regexp.MustCompile(fmt.Sprintf("dxvif/%s", aws.StringValue(vif.VirtualInterfaceId)))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "directconnect", regexache.MustCompile(fmt.Sprintf("dxvif/%s", aws.StringValue(vif.VirtualInterfaceId)))),
 					resource.TestCheckResourceAttrSet(resourceName, "aws_device"),
 					resource.TestCheckResourceAttr(resourceName, "bgp_asn", strconv.Itoa(bgpAsn)),
 					resource.TestCheckResourceAttrSet(resourceName, "bgp_auth_key"),
@@ -110,7 +113,7 @@ func TestAccDirectConnectHostedPublicVirtualInterface_accepterTags(t *testing.T)
 					resource.TestCheckResourceAttr(resourceName, "address_family", "ipv4"),
 					resource.TestCheckResourceAttr(resourceName, "amazon_address", amazonAddress),
 					resource.TestCheckResourceAttrSet(resourceName, "amazon_side_asn"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "directconnect", regexp.MustCompile(fmt.Sprintf("dxvif/%s", aws.StringValue(vif.VirtualInterfaceId)))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "directconnect", regexache.MustCompile(fmt.Sprintf("dxvif/%s", aws.StringValue(vif.VirtualInterfaceId)))),
 					resource.TestCheckResourceAttrSet(resourceName, "aws_device"),
 					resource.TestCheckResourceAttr(resourceName, "bgp_asn", strconv.Itoa(bgpAsn)),
 					resource.TestCheckResourceAttrSet(resourceName, "bgp_auth_key"),
@@ -137,7 +140,7 @@ func TestAccDirectConnectHostedPublicVirtualInterface_accepterTags(t *testing.T)
 					resource.TestCheckResourceAttr(resourceName, "address_family", "ipv4"),
 					resource.TestCheckResourceAttr(resourceName, "amazon_address", amazonAddress),
 					resource.TestCheckResourceAttrSet(resourceName, "amazon_side_asn"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "directconnect", regexp.MustCompile(fmt.Sprintf("dxvif/%s", aws.StringValue(vif.VirtualInterfaceId)))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "directconnect", regexache.MustCompile(fmt.Sprintf("dxvif/%s", aws.StringValue(vif.VirtualInterfaceId)))),
 					resource.TestCheckResourceAttrSet(resourceName, "aws_device"),
 					resource.TestCheckResourceAttr(resourceName, "bgp_asn", strconv.Itoa(bgpAsn)),
 					resource.TestCheckResourceAttrSet(resourceName, "bgp_auth_key"),
diff --git a/internal/service/directconnect/hosted_transit_virtual_interface.go b/internal/service/directconnect/hosted_transit_virtual_interface.go
index 50c6f5cf822..8dce83bbf10 100644
--- a/internal/service/directconnect/hosted_transit_virtual_interface.go
+++ b/internal/service/directconnect/hosted_transit_virtual_interface.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package directconnect
 
 import (
diff --git a/internal/service/directconnect/hosted_transit_virtual_interface_accepter.go b/internal/service/directconnect/hosted_transit_virtual_interface_accepter.go
index 95071b63884..dc0184894b4 100644
--- a/internal/service/directconnect/hosted_transit_virtual_interface_accepter.go
+++ b/internal/service/directconnect/hosted_transit_virtual_interface_accepter.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package directconnect
 
 import (
diff --git a/internal/service/directconnect/hosted_transit_virtual_interface_test.go b/internal/service/directconnect/hosted_transit_virtual_interface_test.go
index f389ad45d7b..ef72b0b34f7 100644
--- a/internal/service/directconnect/hosted_transit_virtual_interface_test.go
+++ b/internal/service/directconnect/hosted_transit_virtual_interface_test.go
@@ -1,13 +1,16 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package directconnect_test
 
 import (
 	"context"
 	"fmt"
 	"os"
-	"regexp"
 	"strconv"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/directconnect"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -59,7 +62,7 @@ func testAccHostedTransitVirtualInterface_basic(t *testing.T) {
 					testAccCheckHostedTransitVirtualInterfaceExists(ctx, resourceName, &vif),
 					resource.TestCheckResourceAttr(resourceName, "address_family", "ipv4"),
 					resource.TestCheckResourceAttrSet(resourceName, "amazon_side_asn"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "directconnect", regexp.MustCompile(fmt.Sprintf("dxvif/%s", aws.StringValue(vif.VirtualInterfaceId)))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "directconnect", regexache.MustCompile(fmt.Sprintf("dxvif/%s", aws.StringValue(vif.VirtualInterfaceId)))),
 					resource.TestCheckResourceAttrSet(resourceName, "aws_device"),
 					resource.TestCheckResourceAttr(resourceName, "bgp_asn", strconv.Itoa(bgpAsn)),
 					resource.TestCheckResourceAttrSet(resourceName, "bgp_auth_key"),
@@ -119,7 +122,7 @@ func testAccHostedTransitVirtualInterface_accepterTags(t *testing.T) {
 					testAccCheckHostedTransitVirtualInterfaceExists(ctx, resourceName, &vif),
 					resource.TestCheckResourceAttr(resourceName, "address_family", "ipv4"),
 					resource.TestCheckResourceAttrSet(resourceName, "amazon_side_asn"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "directconnect", regexp.MustCompile(fmt.Sprintf("dxvif/%s", aws.StringValue(vif.VirtualInterfaceId)))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "directconnect", regexache.MustCompile(fmt.Sprintf("dxvif/%s", aws.StringValue(vif.VirtualInterfaceId)))),
 					resource.TestCheckResourceAttrSet(resourceName, "aws_device"),
 					resource.TestCheckResourceAttr(resourceName, "bgp_asn", strconv.Itoa(bgpAsn)),
 					resource.TestCheckResourceAttrSet(resourceName, "bgp_auth_key"),
@@ -145,7 +148,7 @@ func testAccHostedTransitVirtualInterface_accepterTags(t *testing.T) {
 					testAccCheckHostedTransitVirtualInterfaceExists(ctx, resourceName, &vif),
 					resource.TestCheckResourceAttr(resourceName, "address_family", "ipv4"),
 					resource.TestCheckResourceAttrSet(resourceName, "amazon_side_asn"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "directconnect", regexp.MustCompile(fmt.Sprintf("dxvif/%s", aws.StringValue(vif.VirtualInterfaceId)))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "directconnect", regexache.MustCompile(fmt.Sprintf("dxvif/%s", aws.StringValue(vif.VirtualInterfaceId)))),
 					resource.TestCheckResourceAttrSet(resourceName, "aws_device"),
 					resource.TestCheckResourceAttr(resourceName, "bgp_asn", strconv.Itoa(bgpAsn)),
 					resource.TestCheckResourceAttrSet(resourceName, "bgp_auth_key"),
diff --git a/internal/service/directconnect/id.go b/internal/service/directconnect/id.go
index d1cfd0dd061..9bef8c3a844 100644
--- a/internal/service/directconnect/id.go
+++ b/internal/service/directconnect/id.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package directconnect
 
 import (
diff --git a/internal/service/directconnect/lag.go b/internal/service/directconnect/lag.go
index f4dc46f01c5..3fe7f9a3585 100644
--- a/internal/service/directconnect/lag.go
+++ b/internal/service/directconnect/lag.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package directconnect
 
 import (
diff --git a/internal/service/directconnect/lag_test.go b/internal/service/directconnect/lag_test.go
index 55d29b51214..9289bdfeaff 100644
--- a/internal/service/directconnect/lag_test.go
+++ b/internal/service/directconnect/lag_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package directconnect_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/directconnect"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -33,7 +36,7 @@ func TestAccDirectConnectLag_basic(t *testing.T) {
 				Config: testAccLagConfig_basic(rName1),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckLagExists(ctx, resourceName, &lag),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "directconnect", regexp.MustCompile(`dxlag/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "directconnect", regexache.MustCompile(`dxlag/.+`)),
 					resource.TestCheckNoResourceAttr(resourceName, "connection_id"),
 					resource.TestCheckResourceAttr(resourceName, "connections_bandwidth", "1Gbps"),
 					resource.TestCheckResourceAttr(resourceName, "force_destroy", "false"),
@@ -50,7 +53,7 @@ func TestAccDirectConnectLag_basic(t *testing.T) {
 				Config: testAccLagConfig_basic(rName2),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckLagExists(ctx, resourceName, &lag),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "directconnect", regexp.MustCompile(`dxlag/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "directconnect", regexache.MustCompile(`dxlag/.+`)),
 					resource.TestCheckNoResourceAttr(resourceName, "connection_id"),
 					resource.TestCheckResourceAttr(resourceName, "connections_bandwidth", "1Gbps"),
 					resource.TestCheckResourceAttr(resourceName, "force_destroy", "false"),
@@ -114,7 +117,7 @@ func TestAccDirectConnectLag_connectionID(t *testing.T) {
 				Config: testAccLagConfig_connectionID(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckLagExists(ctx, resourceName, &lag),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "directconnect", regexp.MustCompile(`dxlag/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "directconnect", regexache.MustCompile(`dxlag/.+`)),
 					resource.TestCheckResourceAttrPair(resourceName, "connection_id", connectionResourceName, "id"),
 					resource.TestCheckResourceAttr(resourceName, "connections_bandwidth", "1Gbps"),
 					resource.TestCheckResourceAttr(resourceName, "force_destroy", "false"),
@@ -153,7 +156,7 @@ func TestAccDirectConnectLag_providerName(t *testing.T) {
 				Config: testAccLagConfig_providerName(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckLagExists(ctx, resourceName, &lag),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "directconnect", regexp.MustCompile(`dxlag/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "directconnect", regexache.MustCompile(`dxlag/.+`)),
 					resource.TestCheckNoResourceAttr(resourceName, "connection_id"),
 					resource.TestCheckResourceAttr(resourceName, "connections_bandwidth", "1Gbps"),
 					resource.TestCheckResourceAttr(resourceName, "force_destroy", "false"),
diff --git a/internal/service/directconnect/location_data_source.go b/internal/service/directconnect/location_data_source.go
index 98af4c08b75..d865335e036 100644
--- a/internal/service/directconnect/location_data_source.go
+++ b/internal/service/directconnect/location_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package directconnect
 
 import (
diff --git a/internal/service/directconnect/location_data_source_test.go b/internal/service/directconnect/location_data_source_test.go
index 6d810b39c0e..371556d77fd 100644
--- a/internal/service/directconnect/location_data_source_test.go
+++ b/internal/service/directconnect/location_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package directconnect_test
 
 import (
diff --git a/internal/service/directconnect/locations_data_source.go b/internal/service/directconnect/locations_data_source.go
index 1c0965e92df..78bfc6437c6 100644
--- a/internal/service/directconnect/locations_data_source.go
+++ b/internal/service/directconnect/locations_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package directconnect
 
 import (
diff --git a/internal/service/directconnect/macsec_key.go b/internal/service/directconnect/macsec_key.go
index 9b54d82683c..84f1c39a70f 100644
--- a/internal/service/directconnect/macsec_key.go
+++ b/internal/service/directconnect/macsec_key.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package directconnect
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"strings"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/directconnect"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
@@ -34,7 +37,7 @@ func ResourceMacSecKeyAssociation() *schema.Resource {
 				Optional: true,
 				// CAK requires CKN
 				RequiredWith: []string{"ckn"},
-				ValidateFunc: validation.StringMatch(regexp.MustCompile(`[a-fA-F0-9]{64}$`), "Must be 64-character hex code string"),
+				ValidateFunc: validation.StringMatch(regexache.MustCompile(`[0-9A-Fa-f]{64}$`), "Must be 64-character hex code string"),
 				ForceNew:     true,
 			},
 			"ckn": {
@@ -42,7 +45,7 @@ func ResourceMacSecKeyAssociation() *schema.Resource {
 				Computed:     true,
 				Optional:     true,
 				AtLeastOneOf: []string{"ckn", "secret_arn"},
-				ValidateFunc: validation.StringMatch(regexp.MustCompile(`[a-fA-F0-9]{64}$`), "Must be 64-character hex code string"),
+				ValidateFunc: validation.StringMatch(regexache.MustCompile(`[0-9A-Fa-f]{64}$`), "Must be 64-character hex code string"),
 				ForceNew:     true,
 			},
 			"connection_id": {
diff --git a/internal/service/directconnect/macsec_key_test.go b/internal/service/directconnect/macsec_key_test.go
index c5adedc98c5..6c63a2bbb07 100644
--- a/internal/service/directconnect/macsec_key_test.go
+++ b/internal/service/directconnect/macsec_key_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package directconnect_test
 
 import (
@@ -5,9 +8,9 @@ import (
 	"encoding/hex"
 	"fmt"
 	"os"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/directconnect"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
@@ -35,7 +38,7 @@ func TestAccDirectConnectMacSecKey_withCkn(t *testing.T) {
 				Config: testAccMacSecConfig_withCkn(ckn, cak, connectionId),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr(resourceName, "connection_id", connectionId),
-					resource.TestMatchResourceAttr(resourceName, "ckn", regexp.MustCompile(ckn)),
+					resource.TestMatchResourceAttr(resourceName, "ckn", regexache.MustCompile(ckn)),
 				),
 			},
 			{
diff --git a/internal/service/directconnect/private_virtual_interface.go b/internal/service/directconnect/private_virtual_interface.go
index a761668e1b6..35389d199e5 100644
--- a/internal/service/directconnect/private_virtual_interface.go
+++ b/internal/service/directconnect/private_virtual_interface.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package directconnect
 
 import (
diff --git a/internal/service/directconnect/private_virtual_interface_test.go b/internal/service/directconnect/private_virtual_interface_test.go
index 7541eb45187..5e6dca4fa71 100644
--- a/internal/service/directconnect/private_virtual_interface_test.go
+++ b/internal/service/directconnect/private_virtual_interface_test.go
@@ -1,13 +1,16 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package directconnect_test
 
 import (
 	"context"
 	"fmt"
 	"os"
-	"regexp"
 	"strconv"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/directconnect"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -44,7 +47,7 @@ func TestAccDirectConnectPrivateVirtualInterface_basic(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "address_family", "ipv4"),
 					resource.TestCheckResourceAttrSet(resourceName, "amazon_address"),
 					resource.TestCheckResourceAttrSet(resourceName, "amazon_side_asn"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "directconnect", regexp.MustCompile(fmt.Sprintf("dxvif/%s", aws.StringValue(vif.VirtualInterfaceId)))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "directconnect", regexache.MustCompile(fmt.Sprintf("dxvif/%s", aws.StringValue(vif.VirtualInterfaceId)))),
 					resource.TestCheckResourceAttrSet(resourceName, "aws_device"),
 					resource.TestCheckResourceAttr(resourceName, "bgp_asn", strconv.Itoa(bgpAsn)),
 					resource.TestCheckResourceAttrSet(resourceName, "bgp_auth_key"),
@@ -65,7 +68,7 @@ func TestAccDirectConnectPrivateVirtualInterface_basic(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "address_family", "ipv4"),
 					resource.TestCheckResourceAttrSet(resourceName, "amazon_address"),
 					resource.TestCheckResourceAttrSet(resourceName, "amazon_side_asn"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "directconnect", regexp.MustCompile(fmt.Sprintf("dxvif/%s", aws.StringValue(vif.VirtualInterfaceId)))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "directconnect", regexache.MustCompile(fmt.Sprintf("dxvif/%s", aws.StringValue(vif.VirtualInterfaceId)))),
 					resource.TestCheckResourceAttrSet(resourceName, "aws_device"),
 					resource.TestCheckResourceAttr(resourceName, "bgp_asn", strconv.Itoa(bgpAsn)),
 					resource.TestCheckResourceAttrSet(resourceName, "bgp_auth_key"),
@@ -117,7 +120,7 @@ func TestAccDirectConnectPrivateVirtualInterface_tags(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "address_family", "ipv4"),
 					resource.TestCheckResourceAttrSet(resourceName, "amazon_address"),
 					resource.TestCheckResourceAttrSet(resourceName, "amazon_side_asn"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "directconnect", regexp.MustCompile(fmt.Sprintf("dxvif/%s", aws.StringValue(vif.VirtualInterfaceId)))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "directconnect", regexache.MustCompile(fmt.Sprintf("dxvif/%s", aws.StringValue(vif.VirtualInterfaceId)))),
 					resource.TestCheckResourceAttrSet(resourceName, "aws_device"),
 					resource.TestCheckResourceAttr(resourceName, "bgp_asn", strconv.Itoa(bgpAsn)),
 					resource.TestCheckResourceAttrSet(resourceName, "bgp_auth_key"),
@@ -141,7 +144,7 @@ func TestAccDirectConnectPrivateVirtualInterface_tags(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "address_family", "ipv4"),
 					resource.TestCheckResourceAttrSet(resourceName, "amazon_address"),
 					resource.TestCheckResourceAttrSet(resourceName, "amazon_side_asn"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "directconnect", regexp.MustCompile(fmt.Sprintf("dxvif/%s", aws.StringValue(vif.VirtualInterfaceId)))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "directconnect", regexache.MustCompile(fmt.Sprintf("dxvif/%s", aws.StringValue(vif.VirtualInterfaceId)))),
 					resource.TestCheckResourceAttrSet(resourceName, "aws_device"),
 					resource.TestCheckResourceAttr(resourceName, "bgp_asn", strconv.Itoa(bgpAsn)),
 					resource.TestCheckResourceAttrSet(resourceName, "bgp_auth_key"),
@@ -197,7 +200,7 @@ func TestAccDirectConnectPrivateVirtualInterface_dxGateway(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "address_family", "ipv4"),
 					resource.TestCheckResourceAttrSet(resourceName, "amazon_address"),
 					resource.TestCheckResourceAttrSet(resourceName, "amazon_side_asn"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "directconnect", regexp.MustCompile(fmt.Sprintf("dxvif/%s", aws.StringValue(vif.VirtualInterfaceId)))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "directconnect", regexache.MustCompile(fmt.Sprintf("dxvif/%s", aws.StringValue(vif.VirtualInterfaceId)))),
 					resource.TestCheckResourceAttrSet(resourceName, "aws_device"),
 					resource.TestCheckResourceAttr(resourceName, "bgp_asn", strconv.Itoa(bgpAsn)),
 					resource.TestCheckResourceAttrSet(resourceName, "bgp_auth_key"),
@@ -250,7 +253,7 @@ func TestAccDirectConnectPrivateVirtualInterface_siteLink(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "address_family", "ipv4"),
 					resource.TestCheckResourceAttrSet(resourceName, "amazon_address"),
 					resource.TestCheckResourceAttrSet(resourceName, "amazon_side_asn"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "directconnect", regexp.MustCompile(fmt.Sprintf("dxvif/%s", aws.StringValue(vif.VirtualInterfaceId)))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "directconnect", regexache.MustCompile(fmt.Sprintf("dxvif/%s", aws.StringValue(vif.VirtualInterfaceId)))),
 					resource.TestCheckResourceAttrSet(resourceName, "aws_device"),
 					resource.TestCheckResourceAttr(resourceName, "bgp_asn", strconv.Itoa(bgpAsn)),
 					resource.TestCheckResourceAttrSet(resourceName, "bgp_auth_key"),
@@ -272,7 +275,7 @@ func TestAccDirectConnectPrivateVirtualInterface_siteLink(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "address_family", "ipv4"),
 					resource.TestCheckResourceAttrSet(resourceName, "amazon_address"),
 					resource.TestCheckResourceAttrSet(resourceName, "amazon_side_asn"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "directconnect", regexp.MustCompile(fmt.Sprintf("dxvif/%s", aws.StringValue(vif.VirtualInterfaceId)))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "directconnect", regexache.MustCompile(fmt.Sprintf("dxvif/%s", aws.StringValue(vif.VirtualInterfaceId)))),
 					resource.TestCheckResourceAttrSet(resourceName, "aws_device"),
 					resource.TestCheckResourceAttr(resourceName, "bgp_asn", strconv.Itoa(bgpAsn)),
 					resource.TestCheckResourceAttrSet(resourceName, "bgp_auth_key"),
diff --git a/internal/service/directconnect/public_virtual_interface.go b/internal/service/directconnect/public_virtual_interface.go
index 3922442aeda..d1580d7de5f 100644
--- a/internal/service/directconnect/public_virtual_interface.go
+++ b/internal/service/directconnect/public_virtual_interface.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package directconnect
 
 import (
diff --git a/internal/service/directconnect/public_virtual_interface_test.go b/internal/service/directconnect/public_virtual_interface_test.go
index 5d461876baa..53b2a9711ea 100644
--- a/internal/service/directconnect/public_virtual_interface_test.go
+++ b/internal/service/directconnect/public_virtual_interface_test.go
@@ -1,13 +1,16 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package directconnect_test
 
 import (
 	"context"
 	"fmt"
 	"os"
-	"regexp"
 	"strconv"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/directconnect"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -49,7 +52,7 @@ func TestAccDirectConnectPublicVirtualInterface_basic(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "address_family", "ipv4"),
 					resource.TestCheckResourceAttr(resourceName, "amazon_address", amazonAddress),
 					resource.TestCheckResourceAttrSet(resourceName, "amazon_side_asn"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "directconnect", regexp.MustCompile(fmt.Sprintf("dxvif/%s", aws.StringValue(vif.VirtualInterfaceId)))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "directconnect", regexache.MustCompile(fmt.Sprintf("dxvif/%s", aws.StringValue(vif.VirtualInterfaceId)))),
 					resource.TestCheckResourceAttrSet(resourceName, "aws_device"),
 					resource.TestCheckResourceAttr(resourceName, "bgp_asn", strconv.Itoa(bgpAsn)),
 					resource.TestCheckResourceAttrSet(resourceName, "bgp_auth_key"),
@@ -102,7 +105,7 @@ func TestAccDirectConnectPublicVirtualInterface_tags(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "address_family", "ipv4"),
 					resource.TestCheckResourceAttr(resourceName, "amazon_address", amazonAddress),
 					resource.TestCheckResourceAttrSet(resourceName, "amazon_side_asn"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "directconnect", regexp.MustCompile(fmt.Sprintf("dxvif/%s", aws.StringValue(vif.VirtualInterfaceId)))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "directconnect", regexache.MustCompile(fmt.Sprintf("dxvif/%s", aws.StringValue(vif.VirtualInterfaceId)))),
 					resource.TestCheckResourceAttrSet(resourceName, "aws_device"),
 					resource.TestCheckResourceAttr(resourceName, "bgp_asn", strconv.Itoa(bgpAsn)),
 					resource.TestCheckResourceAttrSet(resourceName, "bgp_auth_key"),
@@ -126,7 +129,7 @@ func TestAccDirectConnectPublicVirtualInterface_tags(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "address_family", "ipv4"),
 					resource.TestCheckResourceAttr(resourceName, "amazon_address", amazonAddress),
 					resource.TestCheckResourceAttrSet(resourceName, "amazon_side_asn"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "directconnect", regexp.MustCompile(fmt.Sprintf("dxvif/%s", aws.StringValue(vif.VirtualInterfaceId)))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "directconnect", regexache.MustCompile(fmt.Sprintf("dxvif/%s", aws.StringValue(vif.VirtualInterfaceId)))),
 					resource.TestCheckResourceAttrSet(resourceName, "aws_device"),
 					resource.TestCheckResourceAttr(resourceName, "bgp_asn", strconv.Itoa(bgpAsn)),
 					resource.TestCheckResourceAttrSet(resourceName, "bgp_auth_key"),
diff --git a/internal/service/directconnect/router_configuration_data_source.go b/internal/service/directconnect/router_configuration_data_source.go
index 7916f4b150c..02b3bd6edc0 100644
--- a/internal/service/directconnect/router_configuration_data_source.go
+++ b/internal/service/directconnect/router_configuration_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package directconnect
 
 import (
diff --git a/internal/service/directconnect/router_configuration_data_source_test.go b/internal/service/directconnect/router_configuration_data_source_test.go
index 68cd61cc2f8..1114549124f 100644
--- a/internal/service/directconnect/router_configuration_data_source_test.go
+++ b/internal/service/directconnect/router_configuration_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package directconnect_test
 
 import (
diff --git a/internal/service/directconnect/service_package_gen.go b/internal/service/directconnect/service_package_gen.go
index 06080a199b9..df3792aa21c 100644
--- a/internal/service/directconnect/service_package_gen.go
+++ b/internal/service/directconnect/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	directconnect_sdkv1 "github.com/aws/aws-sdk-go/service/directconnect"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -171,4 +172,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*d
 	return directconnect_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/directconnect/status.go b/internal/service/directconnect/status.go
index 8d3fb26aae3..45c3e9b06f4 100644
--- a/internal/service/directconnect/status.go
+++ b/internal/service/directconnect/status.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package directconnect
 
 import (
diff --git a/internal/service/directconnect/sweep.go b/internal/service/directconnect/sweep.go
index b23f0f0a2a6..cff0db50387 100644
--- a/internal/service/directconnect/sweep.go
+++ b/internal/service/directconnect/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package directconnect
 
@@ -14,9 +14,10 @@ import (
 	"github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_dx_connection", &resource.Sweeper{
 		Name: "aws_dx_connection",
 		F:    sweepConnections,
@@ -58,7 +59,7 @@ func init() {
 
 func sweepConnections(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
@@ -73,7 +74,7 @@ func sweepConnections(region string) error {
 	// DescribeConnections has no pagination support
 	output, err := conn.DescribeConnectionsWithContext(ctx, input)
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Direct Connect Connection sweep for %s: %s", region, err)
 		return sweeperErrs.ErrorOrNil()
 	}
@@ -104,7 +105,7 @@ func sweepConnections(region string) error {
 		sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error sweeping Direct Connect Connection: %w", err))
 	}
 
@@ -113,13 +114,12 @@ func sweepConnections(region string) error {
 
 func sweepGatewayAssociationProposals(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
 	conn := client.DirectConnectConn(ctx)
 	input := &directconnect.DescribeDirectConnectGatewayAssociationProposalsInput{}
-	var sweeperErrs *multierror.Error
 	sweepResources := make([]sweep.Sweepable, 0)
 
 	err = describeGatewayAssociationProposalsPages(ctx, conn, input, func(page *directconnect.DescribeDirectConnectGatewayAssociationProposalsOutput, lastPage bool) bool {
@@ -150,27 +150,27 @@ func sweepGatewayAssociationProposals(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Print(fmt.Errorf("[WARN] Skipping Direct Connect Gateway Association Proposal sweep for %s: %w", region, err))
-		return sweeperErrs // In case we have completed some pages, but had errors
+		return nil
 	}
 
 	if err != nil {
-		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error listing Direct Connect Gateway Association Proposals (%s): %w", region, err))
+		return fmt.Errorf("listing Direct Connect Gateway Association Proposals (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
-		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error sweeping Direct Connect Gateway Association Proposals (%s): %w", region, err))
+		return fmt.Errorf("sweeping Direct Connect Gateway Association Proposals (%s): %w", region, err)
 	}
 
-	return sweeperErrs.ErrorOrNil()
+	return nil
 }
 
 func sweepGatewayAssociations(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
@@ -228,7 +228,7 @@ func sweepGatewayAssociations(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Print(fmt.Errorf("[WARN] Skipping Direct Connect Gateway Association sweep for %s: %w", region, err))
 		return sweeperErrs // In case we have completed some pages, but had errors
 	}
@@ -296,7 +296,7 @@ func sweepGatewayAssociations(region string) error {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error listing EC2 Transit Gateways (%s): %w", region, err))
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error sweeping Direct Connect Gateway Associations (%s): %w", region, err))
@@ -307,7 +307,7 @@ func sweepGatewayAssociations(region string) error {
 
 func sweepGateways(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
@@ -372,7 +372,7 @@ func sweepGateways(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Print(fmt.Errorf("[WARN] Skipping Direct Connect Gateway sweep for %s: %w", region, err))
 		return sweeperErrs // In case we have completed some pages, but had errors
 	}
@@ -381,7 +381,7 @@ func sweepGateways(region string) error {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error listing Direct Connect Gateways (%s): %w", region, err))
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error sweeping Direct Connect Gateways (%s): %w", region, err))
@@ -392,7 +392,7 @@ func sweepGateways(region string) error {
 
 func sweepLags(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
@@ -407,7 +407,7 @@ func sweepLags(region string) error {
 	// DescribeLags has no pagination support
 	output, err := conn.DescribeLagsWithContext(ctx, input)
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Direct Connect LAG sweep for %s: %s", region, err)
 		return sweeperErrs.ErrorOrNil()
 	}
@@ -438,7 +438,7 @@ func sweepLags(region string) error {
 		sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error sweeping Direct Connect LAG: %w", err))
 	}
 
@@ -447,7 +447,7 @@ func sweepLags(region string) error {
 
 func sweepMacSecKeys(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
@@ -465,8 +465,13 @@ func sweepMacSecKeys(region string) error {
 
 	output, err := dxConn.DescribeConnectionsWithContext(ctx, dxInput)
 
+	if awsv1.SkipSweepError(err) {
+		log.Printf("[WARN] Skipping Direct Connect MACsec Keys sweep for %s: %s", region, err)
+		return sweeperErrs.ErrorOrNil()
+	}
+
 	if err != nil {
-		sweeperErr := fmt.Errorf("error listing Direct Connect Connections for %s: %w", region, err)
+		sweeperErr := fmt.Errorf(" listing Direct Connect Connections for %s: %w", region, err)
 		log.Printf("[ERROR] %s", sweeperErr)
 		sweeperErrs = multierror.Append(sweeperErrs, sweeperErr)
 		return sweeperErrs.ErrorOrNil()
diff --git a/internal/service/directconnect/tags_gen.go b/internal/service/directconnect/tags_gen.go
index 5a4124f3919..708a0671e74 100644
--- a/internal/service/directconnect/tags_gen.go
+++ b/internal/service/directconnect/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/directconnect"
 	"github.com/aws/aws-sdk-go/service/directconnect/directconnectiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -111,6 +113,8 @@ func updateTags(ctx context.Context, conn directconnectiface.DirectConnectAPI, i
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.DirectConnect)
 	if len(removedTags) > 0 {
diff --git a/internal/service/directconnect/transit_virtual_interface.go b/internal/service/directconnect/transit_virtual_interface.go
index cd7a885e994..314bcbe26ed 100644
--- a/internal/service/directconnect/transit_virtual_interface.go
+++ b/internal/service/directconnect/transit_virtual_interface.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package directconnect
 
 import (
diff --git a/internal/service/directconnect/transit_virtual_interface_test.go b/internal/service/directconnect/transit_virtual_interface_test.go
index 868a6933cbd..5d0ea99e584 100644
--- a/internal/service/directconnect/transit_virtual_interface_test.go
+++ b/internal/service/directconnect/transit_virtual_interface_test.go
@@ -1,13 +1,16 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package directconnect_test
 
 import (
 	"context"
 	"fmt"
 	"os"
-	"regexp"
 	"strconv"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/directconnect"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -57,7 +60,7 @@ func testAccTransitVirtualInterface_basic(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "address_family", "ipv4"),
 					resource.TestCheckResourceAttrSet(resourceName, "amazon_address"),
 					resource.TestCheckResourceAttrSet(resourceName, "amazon_side_asn"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "directconnect", regexp.MustCompile(fmt.Sprintf("dxvif/%s", aws.StringValue(vif.VirtualInterfaceId)))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "directconnect", regexache.MustCompile(fmt.Sprintf("dxvif/%s", aws.StringValue(vif.VirtualInterfaceId)))),
 					resource.TestCheckResourceAttrSet(resourceName, "aws_device"),
 					resource.TestCheckResourceAttr(resourceName, "bgp_asn", strconv.Itoa(bgpAsn)),
 					resource.TestCheckResourceAttrSet(resourceName, "bgp_auth_key"),
@@ -78,7 +81,7 @@ func testAccTransitVirtualInterface_basic(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "address_family", "ipv4"),
 					resource.TestCheckResourceAttrSet(resourceName, "amazon_address"),
 					resource.TestCheckResourceAttrSet(resourceName, "amazon_side_asn"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "directconnect", regexp.MustCompile(fmt.Sprintf("dxvif/%s", aws.StringValue(vif.VirtualInterfaceId)))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "directconnect", regexache.MustCompile(fmt.Sprintf("dxvif/%s", aws.StringValue(vif.VirtualInterfaceId)))),
 					resource.TestCheckResourceAttrSet(resourceName, "aws_device"),
 					resource.TestCheckResourceAttr(resourceName, "bgp_asn", strconv.Itoa(bgpAsn)),
 					resource.TestCheckResourceAttrSet(resourceName, "bgp_auth_key"),
@@ -131,7 +134,7 @@ func testAccTransitVirtualInterface_tags(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "address_family", "ipv4"),
 					resource.TestCheckResourceAttrSet(resourceName, "amazon_address"),
 					resource.TestCheckResourceAttrSet(resourceName, "amazon_side_asn"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "directconnect", regexp.MustCompile(fmt.Sprintf("dxvif/%s", aws.StringValue(vif.VirtualInterfaceId)))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "directconnect", regexache.MustCompile(fmt.Sprintf("dxvif/%s", aws.StringValue(vif.VirtualInterfaceId)))),
 					resource.TestCheckResourceAttrSet(resourceName, "aws_device"),
 					resource.TestCheckResourceAttr(resourceName, "bgp_asn", strconv.Itoa(bgpAsn)),
 					resource.TestCheckResourceAttrSet(resourceName, "bgp_auth_key"),
@@ -155,7 +158,7 @@ func testAccTransitVirtualInterface_tags(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "address_family", "ipv4"),
 					resource.TestCheckResourceAttrSet(resourceName, "amazon_address"),
 					resource.TestCheckResourceAttrSet(resourceName, "amazon_side_asn"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "directconnect", regexp.MustCompile(fmt.Sprintf("dxvif/%s", aws.StringValue(vif.VirtualInterfaceId)))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "directconnect", regexache.MustCompile(fmt.Sprintf("dxvif/%s", aws.StringValue(vif.VirtualInterfaceId)))),
 					resource.TestCheckResourceAttrSet(resourceName, "aws_device"),
 					resource.TestCheckResourceAttr(resourceName, "bgp_asn", strconv.Itoa(bgpAsn)),
 					resource.TestCheckResourceAttrSet(resourceName, "bgp_auth_key"),
@@ -211,7 +214,7 @@ func testAccTransitVirtualInterface_siteLink(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "address_family", "ipv4"),
 					resource.TestCheckResourceAttrSet(resourceName, "amazon_address"),
 					resource.TestCheckResourceAttrSet(resourceName, "amazon_side_asn"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "directconnect", regexp.MustCompile(fmt.Sprintf("dxvif/%s", aws.StringValue(vif.VirtualInterfaceId)))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "directconnect", regexache.MustCompile(fmt.Sprintf("dxvif/%s", aws.StringValue(vif.VirtualInterfaceId)))),
 					resource.TestCheckResourceAttrSet(resourceName, "aws_device"),
 					resource.TestCheckResourceAttr(resourceName, "bgp_asn", strconv.Itoa(bgpAsn)),
 					resource.TestCheckResourceAttrSet(resourceName, "bgp_auth_key"),
@@ -233,7 +236,7 @@ func testAccTransitVirtualInterface_siteLink(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "address_family", "ipv4"),
 					resource.TestCheckResourceAttrSet(resourceName, "amazon_address"),
 					resource.TestCheckResourceAttrSet(resourceName, "amazon_side_asn"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "directconnect", regexp.MustCompile(fmt.Sprintf("dxvif/%s", aws.StringValue(vif.VirtualInterfaceId)))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "directconnect", regexache.MustCompile(fmt.Sprintf("dxvif/%s", aws.StringValue(vif.VirtualInterfaceId)))),
 					resource.TestCheckResourceAttrSet(resourceName, "aws_device"),
 					resource.TestCheckResourceAttr(resourceName, "bgp_asn", strconv.Itoa(bgpAsn)),
 					resource.TestCheckResourceAttrSet(resourceName, "bgp_auth_key"),
diff --git a/internal/service/directconnect/validate.go b/internal/service/directconnect/validate.go
index e54a5fb1f9c..10b599378cf 100644
--- a/internal/service/directconnect/validate.go
+++ b/internal/service/directconnect/validate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package directconnect
 
 import (
diff --git a/internal/service/directconnect/validate_test.go b/internal/service/directconnect/validate_test.go
index 21acbafe432..9533d73f650 100644
--- a/internal/service/directconnect/validate_test.go
+++ b/internal/service/directconnect/validate_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package directconnect
 
 import (
diff --git a/internal/service/directconnect/vif.go b/internal/service/directconnect/vif.go
index 1cb89131674..6c1648a64d1 100644
--- a/internal/service/directconnect/vif.go
+++ b/internal/service/directconnect/vif.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package directconnect
 
 import (
diff --git a/internal/service/directconnect/wait.go b/internal/service/directconnect/wait.go
index 5bb124b09ef..98f6d84dc58 100644
--- a/internal/service/directconnect/wait.go
+++ b/internal/service/directconnect/wait.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package directconnect
 
 import (
diff --git a/internal/service/dlm/generate.go b/internal/service/dlm/generate.go
index c7647c59c3d..80993444437 100644
--- a/internal/service/dlm/generate.go
+++ b/internal/service/dlm/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTags -ServiceTagsMap -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/dlm/lifecycle_policy.go b/internal/service/dlm/lifecycle_policy.go
index 36eabb1e2ff..94680883b58 100644
--- a/internal/service/dlm/lifecycle_policy.go
+++ b/internal/service/dlm/lifecycle_policy.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package dlm
 
 import (
 	"context"
 	"log"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/dlm"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -42,7 +45,7 @@ func ResourceLifecyclePolicy() *schema.Resource {
 				Type:     schema.TypeString,
 				Required: true,
 				ValidateFunc: validation.All(
-					validation.StringMatch(regexp.MustCompile("^[0-9A-Za-z _-]+$"), "see https://docs.aws.amazon.com/cli/latest/reference/dlm/create-lifecycle-policy.html"),
+					validation.StringMatch(regexache.MustCompile("^[0-9A-Za-z _-]+$"), "see https://docs.aws.amazon.com/cli/latest/reference/dlm/create-lifecycle-policy.html"),
 					validation.StringLenBetween(1, 500),
 				),
 			},
@@ -113,7 +116,7 @@ func ResourceLifecyclePolicy() *schema.Resource {
 												"target": {
 													Type:         schema.TypeString,
 													Required:     true,
-													ValidateFunc: validation.StringMatch(regexp.MustCompile(`^[\w:\-\/\*]+$`), ""),
+													ValidateFunc: validation.StringMatch(regexache.MustCompile(`^[\w:\-\/\*]+$`), ""),
 												},
 											},
 										},
@@ -123,7 +126,7 @@ func ResourceLifecyclePolicy() *schema.Resource {
 										Required: true,
 										ValidateFunc: validation.All(
 											validation.StringLenBetween(0, 120),
-											validation.StringMatch(regexp.MustCompile("^[0-9A-Za-z _-]+$"), "see https://docs.aws.amazon.com/dlm/latest/APIReference/API_Action.html"),
+											validation.StringMatch(regexache.MustCompile("^[0-9A-Za-z _-]+$"), "see https://docs.aws.amazon.com/dlm/latest/APIReference/API_Action.html"),
 										),
 									},
 								},
@@ -235,7 +238,7 @@ func ResourceLifecyclePolicy() *schema.Resource {
 												"cron_expression": {
 													Type:         schema.TypeString,
 													Optional:     true,
-													ValidateFunc: validation.StringMatch(regexp.MustCompile("^cron\\([^\n]{11,100}\\)$"), "see https://docs.aws.amazon.com/dlm/latest/APIReference/API_CreateRule.html"),
+													ValidateFunc: validation.StringMatch(regexache.MustCompile("^cron\\([^\n]{11,100}\\)$"), "see https://docs.aws.amazon.com/dlm/latest/APIReference/API_CreateRule.html"),
 												},
 												"interval": {
 													Type:         schema.TypeInt,
@@ -261,7 +264,7 @@ func ResourceLifecyclePolicy() *schema.Resource {
 													MaxItems: 1,
 													Elem: &schema.Schema{
 														Type:         schema.TypeString,
-														ValidateFunc: validation.StringMatch(regexp.MustCompile("^(0[0-9]|1[0-9]|2[0-3]):[0-5][0-9]$"), "see https://docs.aws.amazon.com/dlm/latest/APIReference/API_CreateRule.html#dlm-Type-CreateRule-Times"),
+														ValidateFunc: validation.StringMatch(regexache.MustCompile("^(0[0-9]|1[0-9]|2[0-3]):[0-5][0-9]$"), "see https://docs.aws.amazon.com/dlm/latest/APIReference/API_CreateRule.html#dlm-Type-CreateRule-Times"),
 													},
 												},
 											},
@@ -333,7 +336,7 @@ func ResourceLifecyclePolicy() *schema.Resource {
 												"target": {
 													Type:         schema.TypeString,
 													Required:     true,
-													ValidateFunc: validation.StringMatch(regexp.MustCompile(`^[\w:\-\/\*]+$`), ""),
+													ValidateFunc: validation.StringMatch(regexache.MustCompile(`^[\w:\-\/\*]+$`), ""),
 												},
 											},
 										},
diff --git a/internal/service/dlm/lifecycle_policy_test.go b/internal/service/dlm/lifecycle_policy_test.go
index a0cd406ebf2..acc1b7441d1 100644
--- a/internal/service/dlm/lifecycle_policy_test.go
+++ b/internal/service/dlm/lifecycle_policy_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package dlm_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/dlm"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -32,7 +35,7 @@ func TestAccDLMLifecyclePolicy_basic(t *testing.T) {
 				Config: testAccLifecyclePolicyConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					checkLifecyclePolicyExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "dlm", regexp.MustCompile(`policy/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "dlm", regexache.MustCompile(`policy/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "description", "tf-acc-basic"),
 					resource.TestCheckResourceAttrSet(resourceName, "execution_role_arn"),
 					resource.TestCheckResourceAttr(resourceName, "state", "ENABLED"),
@@ -75,7 +78,7 @@ func TestAccDLMLifecyclePolicy_event(t *testing.T) {
 				Config: testAccLifecyclePolicyConfig_event(rName),
 				Check: resource.ComposeTestCheckFunc(
 					checkLifecyclePolicyExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "dlm", regexp.MustCompile(`policy/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "dlm", regexache.MustCompile(`policy/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "description", "tf-acc-basic"),
 					resource.TestCheckResourceAttrSet(resourceName, "execution_role_arn"),
 					resource.TestCheckResourceAttr(resourceName, "state", "ENABLED"),
diff --git a/internal/service/dlm/service_package_gen.go b/internal/service/dlm/service_package_gen.go
index 10ea5ababf6..9ebd35cd101 100644
--- a/internal/service/dlm/service_package_gen.go
+++ b/internal/service/dlm/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	dlm_sdkv1 "github.com/aws/aws-sdk-go/service/dlm"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -50,4 +51,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*d
 	return dlm_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/dlm/sweep.go b/internal/service/dlm/sweep.go
index 2e2c7aaa647..5d29121c6bf 100644
--- a/internal/service/dlm/sweep.go
+++ b/internal/service/dlm/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package dlm
 
@@ -12,19 +12,19 @@ import (
 	"github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_dlm_lifecycle_policy", &resource.Sweeper{
 		Name: "aws_dlm_lifecycle_policy",
 		F:    sweepLifecyclePolicies,
 	})
-
 }
 
 func sweepLifecyclePolicies(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
@@ -57,11 +57,11 @@ func sweepLifecyclePolicies(region string) error {
 		sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("error sweeping DLM Lifecycle Policy for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping DLM Lifecycle Policy sweep for %s: %s", region, errs)
 		return nil
 	}
diff --git a/internal/service/dlm/tags_gen.go b/internal/service/dlm/tags_gen.go
index 5f3b5bd1422..a033b675e32 100644
--- a/internal/service/dlm/tags_gen.go
+++ b/internal/service/dlm/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/dlm"
 	"github.com/aws/aws-sdk-go/service/dlm/dlmiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -54,7 +56,7 @@ func Tags(tags tftags.KeyValueTags) map[string]*string {
 	return aws.StringMap(tags.Map())
 }
 
-// KeyValueTags creates KeyValueTags from dlm service tags.
+// KeyValueTags creates tftags.KeyValueTags from dlm service tags.
 func KeyValueTags(ctx context.Context, tags map[string]*string) tftags.KeyValueTags {
 	return tftags.New(ctx, tags)
 }
@@ -85,6 +87,8 @@ func updateTags(ctx context.Context, conn dlmiface.DLMAPI, identifier string, ol
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.DLM)
 	if len(removedTags) > 0 {
diff --git a/internal/service/dms/certificate.go b/internal/service/dms/certificate.go
index f8deb299d59..436bc00510c 100644
--- a/internal/service/dms/certificate.go
+++ b/internal/service/dms/certificate.go
@@ -1,20 +1,25 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package dms
 
 import (
 	"context"
 	"encoding/base64"
 	"log"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	dms "github.com/aws/aws-sdk-go/service/databasemigrationservice"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -43,22 +48,24 @@ func ResourceCertificate() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 255),
-					validation.StringMatch(regexp.MustCompile("^[a-zA-Z][a-zA-Z0-9-]+$"), "must start with a letter, only contain alphanumeric characters and hyphens"),
-					validation.StringDoesNotMatch(regexp.MustCompile(`--`), "cannot contain two consecutive hyphens"),
-					validation.StringDoesNotMatch(regexp.MustCompile(`-$`), "cannot end in a hyphen"),
+					validation.StringMatch(regexache.MustCompile("^[A-Za-z][0-9A-Za-z-]+$"), "must start with a letter, only contain alphanumeric characters and hyphens"),
+					validation.StringDoesNotMatch(regexache.MustCompile(`--`), "cannot contain two consecutive hyphens"),
+					validation.StringDoesNotMatch(regexache.MustCompile(`-$`), "cannot end in a hyphen"),
 				),
 			},
 			"certificate_pem": {
-				Type:      schema.TypeString,
-				Optional:  true,
-				ForceNew:  true,
-				Sensitive: true,
+				Type:         schema.TypeString,
+				Optional:     true,
+				ForceNew:     true,
+				Sensitive:    true,
+				ExactlyOneOf: []string{"certificate_pem", "certificate_wallet"},
 			},
 			"certificate_wallet": {
-				Type:      schema.TypeString,
-				Optional:  true,
-				ForceNew:  true,
-				Sensitive: true,
+				Type:         schema.TypeString,
+				Optional:     true,
+				ForceNew:     true,
+				Sensitive:    true,
+				ExactlyOneOf: []string{"certificate_pem", "certificate_wallet"},
 			},
 			names.AttrTags:    tftags.TagsSchema(),
 			names.AttrTagsAll: tftags.TagsSchemaComputed(),
@@ -73,38 +80,31 @@ func resourceCertificateCreate(ctx context.Context, d *schema.ResourceData, meta
 	conn := meta.(*conns.AWSClient).DMSConn(ctx)
 
 	certificateID := d.Get("certificate_id").(string)
-	request := &dms.ImportCertificateInput{
+	input := &dms.ImportCertificateInput{
 		CertificateIdentifier: aws.String(certificateID),
 		Tags:                  getTagsIn(ctx),
 	}
 
-	pem, pemSet := d.GetOk("certificate_pem")
-	wallet, walletSet := d.GetOk("certificate_wallet")
-
-	if !pemSet && !walletSet {
-		return sdkdiag.AppendErrorf(diags, "Must set either certificate_pem or certificate_wallet for DMS Certificate (%s)", certificateID)
-	}
-	if pemSet && walletSet {
-		return sdkdiag.AppendErrorf(diags, "Cannot set both certificate_pem and certificate_wallet for DMS Certificate (%s)", certificateID)
+	if v, ok := d.GetOk("certificate_pem"); ok {
+		input.CertificatePem = aws.String(v.(string))
 	}
 
-	if pemSet {
-		request.CertificatePem = aws.String(pem.(string))
-	}
-	if walletSet {
-		certWallet, err := base64.StdEncoding.DecodeString(wallet.(string))
+	if v, ok := d.GetOk("certificate_wallet"); ok {
+		certWallet, err := base64.StdEncoding.DecodeString(v.(string))
 		if err != nil {
-			return sdkdiag.AppendErrorf(diags, "Base64 decoding certificate_wallet for DMS Certificate (%s): %s", certificateID, err)
+			return sdkdiag.AppendFromErr(diags, err)
 		}
-		request.CertificateWallet = certWallet
+		input.CertificateWallet = certWallet
 	}
 
-	_, err := conn.ImportCertificateWithContext(ctx, request)
+	_, err := conn.ImportCertificateWithContext(ctx, input)
+
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "creating DMS certificate (%s): %s", certificateID, err)
+		return sdkdiag.AppendErrorf(diags, "creating DMS Certificate (%s): %s", certificateID, err)
 	}
 
 	d.SetId(certificateID)
+
 	return append(diags, resourceCertificateRead(ctx, d, meta)...)
 }
 
@@ -112,16 +112,9 @@ func resourceCertificateRead(ctx context.Context, d *schema.ResourceData, meta i
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).DMSConn(ctx)
 
-	response, err := conn.DescribeCertificatesWithContext(ctx, &dms.DescribeCertificatesInput{
-		Filters: []*dms.Filter{
-			{
-				Name:   aws.String("certificate-id"),
-				Values: []*string{aws.String(d.Id())}, // Must use d.Id() to work with import.
-			},
-		},
-	})
+	certificate, err := FindCertificateByID(ctx, conn, d.Id())
 
-	if !d.IsNewResource() && tfawserr.ErrCodeEquals(err, dms.ErrCodeResourceNotFoundFault) {
+	if !d.IsNewResource() && tfresource.NotFound(err) {
 		log.Printf("[WARN] DMS Certificate (%s) not found, removing from state", d.Id())
 		d.SetId("")
 		return diags
@@ -131,16 +124,7 @@ func resourceCertificateRead(ctx context.Context, d *schema.ResourceData, meta i
 		return sdkdiag.AppendErrorf(diags, "reading DMS Certificate (%s): %s", d.Id(), err)
 	}
 
-	if response == nil || len(response.Certificates) == 0 || response.Certificates[0] == nil {
-		if d.IsNewResource() {
-			return sdkdiag.AppendErrorf(diags, "reading DMS Certificate (%s): not found", d.Id())
-		}
-		log.Printf("[WARN] DMS Certificate (%s) not found, removing from state", d.Id())
-		d.SetId("")
-		return diags
-	}
-
-	resourceCertificateSetState(d, response.Certificates[0])
+	resourceCertificateSetState(d, certificate)
 
 	return diags
 }
@@ -157,16 +141,16 @@ func resourceCertificateDelete(ctx context.Context, d *schema.ResourceData, meta
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).DMSConn(ctx)
 
-	request := &dms.DeleteCertificateInput{
+	log.Printf("[DEBUG] Deleting DMS Certificate: %s", d.Id())
+	_, err := conn.DeleteCertificateWithContext(ctx, &dms.DeleteCertificateInput{
 		CertificateArn: aws.String(d.Get("certificate_arn").(string)),
-	}
+	})
 
-	_, err := conn.DeleteCertificateWithContext(ctx, request)
+	if tfawserr.ErrCodeEquals(err, dms.ErrCodeResourceNotFoundFault) {
+		return diags
+	}
 
 	if err != nil {
-		if tfawserr.ErrCodeEquals(err, dms.ErrCodeResourceNotFoundFault) {
-			return diags
-		}
 		return sdkdiag.AppendErrorf(diags, "deleting DMS Certificate (%s): %s", d.Id(), err)
 	}
 
@@ -186,3 +170,57 @@ func resourceCertificateSetState(d *schema.ResourceData, cert *dms.Certificate)
 		d.Set("certificate_wallet", verify.Base64Encode(cert.CertificateWallet))
 	}
 }
+
+func FindCertificateByID(ctx context.Context, conn *dms.DatabaseMigrationService, id string) (*dms.Certificate, error) {
+	input := &dms.DescribeCertificatesInput{
+		Filters: []*dms.Filter{
+			{
+				Name:   aws.String("certificate-id"),
+				Values: []*string{aws.String(id)},
+			},
+		},
+	}
+
+	return findCertificate(ctx, conn, input)
+}
+
+func findCertificate(ctx context.Context, conn *dms.DatabaseMigrationService, input *dms.DescribeCertificatesInput) (*dms.Certificate, error) {
+	output, err := findCertificates(ctx, conn, input)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return tfresource.AssertSinglePtrResult(output)
+}
+
+func findCertificates(ctx context.Context, conn *dms.DatabaseMigrationService, input *dms.DescribeCertificatesInput) ([]*dms.Certificate, error) {
+	var output []*dms.Certificate
+
+	err := conn.DescribeCertificatesPagesWithContext(ctx, input, func(page *dms.DescribeCertificatesOutput, lastPage bool) bool {
+		if page == nil {
+			return !lastPage
+		}
+
+		for _, v := range page.Certificates {
+			if v != nil {
+				output = append(output, v)
+			}
+		}
+
+		return !lastPage
+	})
+
+	if tfawserr.ErrCodeEquals(err, dms.ErrCodeResourceNotFoundFault) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	return output, nil
+}
diff --git a/internal/service/dms/certificate_data_source.go b/internal/service/dms/certificate_data_source.go
index b658fd59c4b..97ff39dd3fd 100644
--- a/internal/service/dms/certificate_data_source.go
+++ b/internal/service/dms/certificate_data_source.go
@@ -1,20 +1,20 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package dms
 
 import (
 	"context"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
-	dms "github.com/aws/aws-sdk-go/service/databasemigrationservice"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
-	"github.com/hashicorp/terraform-provider-aws/internal/create"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
-	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
-	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
 // @SDKDataSource("aws_dms_certificate")
@@ -36,9 +36,9 @@ func DataSourceCertificate() *schema.Resource {
 				Required: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 255),
-					validation.StringMatch(regexp.MustCompile("^[a-zA-Z][a-zA-Z0-9-]+$"), "must start with a letter, only contain alphanumeric characters and hyphens"),
-					validation.StringDoesNotMatch(regexp.MustCompile(`--`), "cannot contain two consecutive hyphens"),
-					validation.StringDoesNotMatch(regexp.MustCompile(`-$`), "cannot end in a hyphen"),
+					validation.StringMatch(regexache.MustCompile("^[A-Za-z][0-9A-Za-z-]+$"), "must start with a letter, only contain alphanumeric characters and hyphens"),
+					validation.StringDoesNotMatch(regexache.MustCompile(`--`), "cannot contain two consecutive hyphens"),
+					validation.StringDoesNotMatch(regexache.MustCompile(`-$`), "cannot end in a hyphen"),
 				),
 			},
 			"certificate_owner": {
@@ -63,6 +63,7 @@ func DataSourceCertificate() *schema.Resource {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
+			"tags": tftags.TagsSchemaComputed(),
 			"valid_from_date": {
 				Type:     schema.TypeString,
 				Computed: true,
@@ -71,80 +72,47 @@ func DataSourceCertificate() *schema.Resource {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
-			"tags": tftags.TagsSchemaComputed(),
 		},
 	}
 }
 
-const (
-	DSNameCertificate = "Certificate Data Source"
-)
-
 func dataSourceCertificateRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).DMSConn(ctx)
 	defaultTagsConfig := meta.(*conns.AWSClient).DefaultTagsConfig
 	ignoreTagsConfig := meta.(*conns.AWSClient).IgnoreTagsConfig
 
 	certificateID := d.Get("certificate_id").(string)
-
 	out, err := FindCertificateByID(ctx, conn, certificateID)
 
 	if err != nil {
-		create.DiagError(names.DMS, create.ErrActionReading, DSNameCertificate, d.Id(), err)
+		return sdkdiag.AppendErrorf(diags, "reading DMS Certificate (%s): %s", certificateID, err)
 	}
 
 	d.SetId(aws.StringValue(out.CertificateIdentifier))
-
+	arn := aws.StringValue(out.CertificateArn)
+	d.Set("certificate_arn", arn)
 	d.Set("certificate_id", out.CertificateIdentifier)
-	d.Set("certificate_arn", out.CertificateArn)
 	d.Set("certificate_pem", out.CertificatePem)
-
-	if out.CertificateWallet != nil && len(out.CertificateWallet) != 0 {
+	if len(out.CertificateWallet) != 0 {
 		d.Set("certificate_wallet", verify.Base64Encode(out.CertificateWallet))
 	}
-
 	d.Set("key_length", out.KeyLength)
 	d.Set("signing_algorithm", out.SigningAlgorithm)
+	d.Set("valid_from_date", out.ValidFromDate.String())
+	d.Set("valid_to_date", out.ValidToDate.String())
 
-	from_date := out.ValidFromDate.String()
-	d.Set("valid_from_date", from_date)
-	to_date := out.ValidToDate.String()
-	d.Set("valid_to_date", to_date)
-
-	tags, err := listTags(ctx, conn, aws.StringValue(out.CertificateArn))
-
+	tags, err := listTags(ctx, conn, arn)
 	if err != nil {
-		return create.DiagError(names.DMS, create.ErrActionReading, DSNameCertificate, d.Id(), err)
+		return sdkdiag.AppendErrorf(diags, "listing tags for DMS Certificate (%s): %s", arn, err)
 	}
 
 	tags = tags.IgnoreAWS().IgnoreConfig(ignoreTagsConfig)
 
 	//lintignore:AWSR002
 	if err := d.Set("tags", tags.RemoveDefaultConfig(defaultTagsConfig).Map()); err != nil {
-		return create.DiagError(names.DMS, create.ErrActionSetting, DSNameCertificate, d.Id(), err)
+		return sdkdiag.AppendErrorf(diags, "setting tags: %s", err)
 	}
 
 	return nil
 }
-
-func FindCertificateByID(ctx context.Context, conn *dms.DatabaseMigrationService, id string) (*dms.Certificate, error) {
-	input := &dms.DescribeCertificatesInput{
-		Filters: []*dms.Filter{
-			{
-				Name:   aws.String("certificate-id"),
-				Values: []*string{aws.String(id)},
-			},
-		},
-	}
-	response, err := conn.DescribeCertificatesWithContext(ctx, input)
-
-	if err != nil {
-		return nil, err
-	}
-
-	if response == nil || len(response.Certificates) == 0 || response.Certificates[0] == nil {
-		return nil, tfresource.NewEmptyResultError(input)
-	}
-
-	return response.Certificates[0], nil
-}
diff --git a/internal/service/dms/certificate_data_source_test.go b/internal/service/dms/certificate_data_source_test.go
index d92e005ae84..7b17bf423e5 100644
--- a/internal/service/dms/certificate_data_source_test.go
+++ b/internal/service/dms/certificate_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package dms_test
 
 import (
@@ -32,15 +35,15 @@ func TestAccDMSCertificateDataSource_basic(t *testing.T) {
 	})
 }
 
-func testAccCertificateDataSourceConfig_basic(certId string) string {
+func testAccCertificateDataSourceConfig_basic(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_dms_certificate" "test" {
-  certificate_id  = "%[1]s"
+  certificate_id  = %[1]q
   certificate_pem = "-----BEGIN CERTIFICATE-----\nMIID2jCCAsKgAwIBAgIJAJ58TJVjU7G1MA0GCSqGSIb3DQEBBQUAMFExCzAJBgNV\nBAYTAlVTMREwDwYDVQQIEwhDb2xvcmFkbzEPMA0GA1UEBxMGRGVudmVyMRAwDgYD\nVQQKEwdDaGFydGVyMQwwCgYDVQQLEwNDU0UwHhcNMTcwMTMwMTkyMDA4WhcNMjYx\nMjA5MTkyMDA4WjBRMQswCQYDVQQGEwJVUzERMA8GA1UECBMIQ29sb3JhZG8xDzAN\nBgNVBAcTBkRlbnZlcjEQMA4GA1UEChMHQ2hhcnRlcjEMMAoGA1UECxMDQ1NFMIIB\nIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAv6dq6VLIImlAaTrckb5w3X6J\nWP7EGz2ChGAXlkEYto6dPCba0v5+f+8UlMOpeB25XGoai7gdItqNWVFpYsgmndx3\nvTad3ukO1zeElKtw5oHPH2plOaiv/gVJaDa9NTeINj0EtGZs74fCOclAzGFX5vBc\nb08ESWBceRgGjGv3nlij4JzHfqTkCKQz6P6pBivQBfk62rcOkkH5rKoaGltRHROS\nMbkwOhu2hN0KmSYTXRvts0LXnZU4N0l2ms39gmr7UNNNlKYINL2JoTs9dNBc7APD\ndZvlEHd+/FjcLCI8hC3t4g4AbfW0okIBCNG0+oVjqGb2DeONSJKsThahXt89MQID\nAQABo4G0MIGxMB0GA1UdDgQWBBQKq8JxjY1GmeZXJjfOMfW0kBIzPDCBgQYDVR0j\nBHoweIAUCqvCcY2NRpnmVyY3zjH1tJASMzyhVaRTMFExCzAJBgNVBAYTAlVTMREw\nDwYDVQQIEwhDb2xvcmFkbzEPMA0GA1UEBxMGRGVudmVyMRAwDgYDVQQKEwdDaGFy\ndGVyMQwwCgYDVQQLEwNDU0WCCQCefEyVY1OxtTAMBgNVHRMEBTADAQH/MA0GCSqG\nSIb3DQEBBQUAA4IBAQAWifoMk5kbv+yuWXvFwHiB4dWUUmMlUlPU/E300yVTRl58\np6DfOgJs7MMftd1KeWqTO+uW134QlTt7+jwI8Jq0uyKCu/O2kJhVtH/Ryog14tGl\n+wLcuIPLbwJI9CwZX4WMBrq4DnYss+6F47i8NCc+Z3MAiG4vtq9ytBmaod0dj2bI\ng4/Lac0e00dql9RnqENh1+dF0V+QgTJCoPkMqDNAlSB8vOodBW81UAb2z12t+IFi\n3X9J3WtCK2+T5brXL6itzewWJ2ALvX3QpmZx7fMHJ3tE+SjjyivE1BbOlzYHx83t\nTeYnm7pS9un7A/UzTDHbs7hPUezLek+H3xTPAnnq\n-----END CERTIFICATE-----\n"
 }
 
 data "aws_dms_certificate" "test" {
   certificate_id = aws_dms_certificate.test.certificate_id
 }
-`, certId)
+`, rName)
 }
diff --git a/internal/service/dms/certificate_test.go b/internal/service/dms/certificate_test.go
index a853b523822..c1840835586 100644
--- a/internal/service/dms/certificate_test.go
+++ b/internal/service/dms/certificate_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package dms_test
 
 import (
@@ -5,21 +8,20 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/aws"
 	dms "github.com/aws/aws-sdk-go/service/databasemigrationservice"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	tfdms "github.com/hashicorp/terraform-provider-aws/internal/service/dms"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
 func TestAccDMSCertificate_basic(t *testing.T) {
 	ctx := acctest.Context(t)
 	resourceName := "aws_dms_certificate.dms_certificate"
-	randId := sdkacctest.RandString(8)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
@@ -28,7 +30,7 @@ func TestAccDMSCertificate_basic(t *testing.T) {
 		CheckDestroy:             testAccCheckCertificateDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccCertificateConfig_basic(randId),
+				Config: testAccCertificateConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCertificateExists(ctx, resourceName),
 					resource.TestCheckResourceAttrSet(resourceName, "certificate_arn"),
@@ -46,7 +48,7 @@ func TestAccDMSCertificate_basic(t *testing.T) {
 func TestAccDMSCertificate_disappears(t *testing.T) {
 	ctx := acctest.Context(t)
 	resourceName := "aws_dms_certificate.dms_certificate"
-	randId := sdkacctest.RandString(8)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
@@ -55,7 +57,7 @@ func TestAccDMSCertificate_disappears(t *testing.T) {
 		CheckDestroy:             nil,
 		Steps: []resource.TestStep{
 			{
-				Config: testAccCertificateConfig_basic(randId),
+				Config: testAccCertificateConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCertificateExists(ctx, resourceName),
 					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfdms.ResourceCertificate(), resourceName),
@@ -96,7 +98,7 @@ func TestAccDMSCertificate_certificateWallet(t *testing.T) {
 func TestAccDMSCertificate_tags(t *testing.T) {
 	ctx := acctest.Context(t)
 	resourceName := "aws_dms_certificate.dms_certificate"
-	randId := sdkacctest.RandString(8)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
@@ -105,7 +107,7 @@ func TestAccDMSCertificate_tags(t *testing.T) {
 		CheckDestroy:             testAccCheckCertificateDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccCertificateConfig_tags1(randId, "key1", "value1"),
+				Config: testAccCertificateConfig_tags1(rName, "key1", "value1"),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCertificateExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
@@ -118,7 +120,7 @@ func TestAccDMSCertificate_tags(t *testing.T) {
 				ImportStateVerify: true,
 			},
 			{
-				Config: testAccCertificateConfig_tags2(randId, "key1", "value1updated", "key2", "value2"),
+				Config: testAccCertificateConfig_tags2(rName, "key1", "value1updated", "key2", "value2"),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCertificateExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
@@ -127,7 +129,7 @@ func TestAccDMSCertificate_tags(t *testing.T) {
 				),
 			},
 			{
-				Config: testAccCertificateConfig_tags1(randId, "key2", "value2"),
+				Config: testAccCertificateConfig_tags1(rName, "key2", "value2"),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCertificateExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
@@ -147,26 +149,17 @@ func testAccCheckCertificateDestroy(ctx context.Context) resource.TestCheckFunc
 
 			conn := acctest.Provider.Meta().(*conns.AWSClient).DMSConn(ctx)
 
-			output, err := conn.DescribeCertificatesWithContext(ctx, &dms.DescribeCertificatesInput{
-				Filters: []*dms.Filter{
-					{
-						Name:   aws.String("certificate-id"),
-						Values: []*string{aws.String(rs.Primary.ID)},
-					},
-				},
-			})
+			_, err := tfdms.FindCertificateByID(ctx, conn, rs.Primary.ID)
 
-			if tfawserr.ErrCodeEquals(err, dms.ErrCodeResourceNotFoundFault) {
+			if tfresource.NotFound(err) {
 				continue
 			}
 
 			if err != nil {
-				return fmt.Errorf("error reading DMS Certificate (%s): %w", rs.Primary.ID, err)
+				return err
 			}
 
-			if output != nil && len(output.Certificates) != 0 {
-				return fmt.Errorf("DMS Certificate (%s) still exists", rs.Primary.ID)
-			}
+			return fmt.Errorf("DMS Certificate %s still exists", rs.Primary.ID)
 		}
 
 		return nil
@@ -180,68 +173,49 @@ func testAccCertificateExists(ctx context.Context, n string) resource.TestCheckF
 			return fmt.Errorf("Not found: %s", n)
 		}
 
-		if rs.Primary.ID == "" {
-			return fmt.Errorf("No ID is set")
-		}
-
 		conn := acctest.Provider.Meta().(*conns.AWSClient).DMSConn(ctx)
 
-		output, err := conn.DescribeCertificatesWithContext(ctx, &dms.DescribeCertificatesInput{
-			Filters: []*dms.Filter{
-				{
-					Name:   aws.String("certificate-id"),
-					Values: []*string{aws.String(rs.Primary.ID)},
-				},
-			},
-		})
-
-		if err != nil {
-			return fmt.Errorf("error reading DMS Certificate (%s): %w", rs.Primary.ID, err)
-		}
+		_, err := tfdms.FindCertificateByID(ctx, conn, rs.Primary.ID)
 
-		if output == nil || len(output.Certificates) == 0 {
-			return fmt.Errorf("DMS Certificate (%s) not found", rs.Primary.ID)
-		}
-
-		return nil
+		return err
 	}
 }
 
-func testAccCertificateConfig_basic(randId string) string {
+func testAccCertificateConfig_basic(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_dms_certificate" "dms_certificate" {
-  certificate_id  = "tf-test-dms-certificate-%[1]s"
+  certificate_id  = %[1]q
   certificate_pem = "-----BEGIN CERTIFICATE-----\nMIID2jCCAsKgAwIBAgIJAJ58TJVjU7G1MA0GCSqGSIb3DQEBBQUAMFExCzAJBgNV\nBAYTAlVTMREwDwYDVQQIEwhDb2xvcmFkbzEPMA0GA1UEBxMGRGVudmVyMRAwDgYD\nVQQKEwdDaGFydGVyMQwwCgYDVQQLEwNDU0UwHhcNMTcwMTMwMTkyMDA4WhcNMjYx\nMjA5MTkyMDA4WjBRMQswCQYDVQQGEwJVUzERMA8GA1UECBMIQ29sb3JhZG8xDzAN\nBgNVBAcTBkRlbnZlcjEQMA4GA1UEChMHQ2hhcnRlcjEMMAoGA1UECxMDQ1NFMIIB\nIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAv6dq6VLIImlAaTrckb5w3X6J\nWP7EGz2ChGAXlkEYto6dPCba0v5+f+8UlMOpeB25XGoai7gdItqNWVFpYsgmndx3\nvTad3ukO1zeElKtw5oHPH2plOaiv/gVJaDa9NTeINj0EtGZs74fCOclAzGFX5vBc\nb08ESWBceRgGjGv3nlij4JzHfqTkCKQz6P6pBivQBfk62rcOkkH5rKoaGltRHROS\nMbkwOhu2hN0KmSYTXRvts0LXnZU4N0l2ms39gmr7UNNNlKYINL2JoTs9dNBc7APD\ndZvlEHd+/FjcLCI8hC3t4g4AbfW0okIBCNG0+oVjqGb2DeONSJKsThahXt89MQID\nAQABo4G0MIGxMB0GA1UdDgQWBBQKq8JxjY1GmeZXJjfOMfW0kBIzPDCBgQYDVR0j\nBHoweIAUCqvCcY2NRpnmVyY3zjH1tJASMzyhVaRTMFExCzAJBgNVBAYTAlVTMREw\nDwYDVQQIEwhDb2xvcmFkbzEPMA0GA1UEBxMGRGVudmVyMRAwDgYDVQQKEwdDaGFy\ndGVyMQwwCgYDVQQLEwNDU0WCCQCefEyVY1OxtTAMBgNVHRMEBTADAQH/MA0GCSqG\nSIb3DQEBBQUAA4IBAQAWifoMk5kbv+yuWXvFwHiB4dWUUmMlUlPU/E300yVTRl58\np6DfOgJs7MMftd1KeWqTO+uW134QlTt7+jwI8Jq0uyKCu/O2kJhVtH/Ryog14tGl\n+wLcuIPLbwJI9CwZX4WMBrq4DnYss+6F47i8NCc+Z3MAiG4vtq9ytBmaod0dj2bI\ng4/Lac0e00dql9RnqENh1+dF0V+QgTJCoPkMqDNAlSB8vOodBW81UAb2z12t+IFi\n3X9J3WtCK2+T5brXL6itzewWJ2ALvX3QpmZx7fMHJ3tE+SjjyivE1BbOlzYHx83t\nTeYnm7pS9un7A/UzTDHbs7hPUezLek+H3xTPAnnq\n-----END CERTIFICATE-----\n"
 }
-`, randId)
+`, rName)
 }
 
 func testAccCertificateConfig_wallet(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_dms_certificate" "dms_certificate" {
-  certificate_id     = %q
+  certificate_id     = %[1]q
   certificate_wallet = filebase64("testdata/oracle_wallet_certificate.pem")
 }
 `, rName)
 }
 
-func testAccCertificateConfig_tags1(randId, tagKey1, tagValue1 string) string {
+func testAccCertificateConfig_tags1(rName, tagKey1, tagValue1 string) string {
 	return fmt.Sprintf(`
 resource "aws_dms_certificate" "dms_certificate" {
-  certificate_id  = "tf-test-dms-certificate-%[1]s"
+  certificate_id  = %[1]q
   certificate_pem = "-----BEGIN CERTIFICATE-----\nMIID2jCCAsKgAwIBAgIJAJ58TJVjU7G1MA0GCSqGSIb3DQEBBQUAMFExCzAJBgNV\nBAYTAlVTMREwDwYDVQQIEwhDb2xvcmFkbzEPMA0GA1UEBxMGRGVudmVyMRAwDgYD\nVQQKEwdDaGFydGVyMQwwCgYDVQQLEwNDU0UwHhcNMTcwMTMwMTkyMDA4WhcNMjYx\nMjA5MTkyMDA4WjBRMQswCQYDVQQGEwJVUzERMA8GA1UECBMIQ29sb3JhZG8xDzAN\nBgNVBAcTBkRlbnZlcjEQMA4GA1UEChMHQ2hhcnRlcjEMMAoGA1UECxMDQ1NFMIIB\nIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAv6dq6VLIImlAaTrckb5w3X6J\nWP7EGz2ChGAXlkEYto6dPCba0v5+f+8UlMOpeB25XGoai7gdItqNWVFpYsgmndx3\nvTad3ukO1zeElKtw5oHPH2plOaiv/gVJaDa9NTeINj0EtGZs74fCOclAzGFX5vBc\nb08ESWBceRgGjGv3nlij4JzHfqTkCKQz6P6pBivQBfk62rcOkkH5rKoaGltRHROS\nMbkwOhu2hN0KmSYTXRvts0LXnZU4N0l2ms39gmr7UNNNlKYINL2JoTs9dNBc7APD\ndZvlEHd+/FjcLCI8hC3t4g4AbfW0okIBCNG0+oVjqGb2DeONSJKsThahXt89MQID\nAQABo4G0MIGxMB0GA1UdDgQWBBQKq8JxjY1GmeZXJjfOMfW0kBIzPDCBgQYDVR0j\nBHoweIAUCqvCcY2NRpnmVyY3zjH1tJASMzyhVaRTMFExCzAJBgNVBAYTAlVTMREw\nDwYDVQQIEwhDb2xvcmFkbzEPMA0GA1UEBxMGRGVudmVyMRAwDgYDVQQKEwdDaGFy\ndGVyMQwwCgYDVQQLEwNDU0WCCQCefEyVY1OxtTAMBgNVHRMEBTADAQH/MA0GCSqG\nSIb3DQEBBQUAA4IBAQAWifoMk5kbv+yuWXvFwHiB4dWUUmMlUlPU/E300yVTRl58\np6DfOgJs7MMftd1KeWqTO+uW134QlTt7+jwI8Jq0uyKCu/O2kJhVtH/Ryog14tGl\n+wLcuIPLbwJI9CwZX4WMBrq4DnYss+6F47i8NCc+Z3MAiG4vtq9ytBmaod0dj2bI\ng4/Lac0e00dql9RnqENh1+dF0V+QgTJCoPkMqDNAlSB8vOodBW81UAb2z12t+IFi\n3X9J3WtCK2+T5brXL6itzewWJ2ALvX3QpmZx7fMHJ3tE+SjjyivE1BbOlzYHx83t\nTeYnm7pS9un7A/UzTDHbs7hPUezLek+H3xTPAnnq\n-----END CERTIFICATE-----\n"
 
   tags = {
     %[2]q = %[3]q
   }
 }
-`, randId, tagKey1, tagValue1)
+`, rName, tagKey1, tagValue1)
 }
 
-func testAccCertificateConfig_tags2(randId, tagKey1, tagValue1, tagKey2, tagValue2 string) string {
+func testAccCertificateConfig_tags2(rName, tagKey1, tagValue1, tagKey2, tagValue2 string) string {
 	return fmt.Sprintf(`
 resource "aws_dms_certificate" "dms_certificate" {
-  certificate_id  = "tf-test-dms-certificate-%[1]s"
+  certificate_id  = %[1]q
   certificate_pem = "-----BEGIN CERTIFICATE-----\nMIID2jCCAsKgAwIBAgIJAJ58TJVjU7G1MA0GCSqGSIb3DQEBBQUAMFExCzAJBgNV\nBAYTAlVTMREwDwYDVQQIEwhDb2xvcmFkbzEPMA0GA1UEBxMGRGVudmVyMRAwDgYD\nVQQKEwdDaGFydGVyMQwwCgYDVQQLEwNDU0UwHhcNMTcwMTMwMTkyMDA4WhcNMjYx\nMjA5MTkyMDA4WjBRMQswCQYDVQQGEwJVUzERMA8GA1UECBMIQ29sb3JhZG8xDzAN\nBgNVBAcTBkRlbnZlcjEQMA4GA1UEChMHQ2hhcnRlcjEMMAoGA1UECxMDQ1NFMIIB\nIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAv6dq6VLIImlAaTrckb5w3X6J\nWP7EGz2ChGAXlkEYto6dPCba0v5+f+8UlMOpeB25XGoai7gdItqNWVFpYsgmndx3\nvTad3ukO1zeElKtw5oHPH2plOaiv/gVJaDa9NTeINj0EtGZs74fCOclAzGFX5vBc\nb08ESWBceRgGjGv3nlij4JzHfqTkCKQz6P6pBivQBfk62rcOkkH5rKoaGltRHROS\nMbkwOhu2hN0KmSYTXRvts0LXnZU4N0l2ms39gmr7UNNNlKYINL2JoTs9dNBc7APD\ndZvlEHd+/FjcLCI8hC3t4g4AbfW0okIBCNG0+oVjqGb2DeONSJKsThahXt89MQID\nAQABo4G0MIGxMB0GA1UdDgQWBBQKq8JxjY1GmeZXJjfOMfW0kBIzPDCBgQYDVR0j\nBHoweIAUCqvCcY2NRpnmVyY3zjH1tJASMzyhVaRTMFExCzAJBgNVBAYTAlVTMREw\nDwYDVQQIEwhDb2xvcmFkbzEPMA0GA1UEBxMGRGVudmVyMRAwDgYDVQQKEwdDaGFy\ndGVyMQwwCgYDVQQLEwNDU0WCCQCefEyVY1OxtTAMBgNVHRMEBTADAQH/MA0GCSqG\nSIb3DQEBBQUAA4IBAQAWifoMk5kbv+yuWXvFwHiB4dWUUmMlUlPU/E300yVTRl58\np6DfOgJs7MMftd1KeWqTO+uW134QlTt7+jwI8Jq0uyKCu/O2kJhVtH/Ryog14tGl\n+wLcuIPLbwJI9CwZX4WMBrq4DnYss+6F47i8NCc+Z3MAiG4vtq9ytBmaod0dj2bI\ng4/Lac0e00dql9RnqENh1+dF0V+QgTJCoPkMqDNAlSB8vOodBW81UAb2z12t+IFi\n3X9J3WtCK2+T5brXL6itzewWJ2ALvX3QpmZx7fMHJ3tE+SjjyivE1BbOlzYHx83t\nTeYnm7pS9un7A/UzTDHbs7hPUezLek+H3xTPAnnq\n-----END CERTIFICATE-----\n"
 
   tags = {
@@ -249,5 +223,5 @@ resource "aws_dms_certificate" "dms_certificate" {
     %[4]q = %[5]q
   }
 }
-`, randId, tagKey1, tagValue1, tagKey2, tagValue2)
+`, rName, tagKey1, tagValue1, tagKey2, tagValue2)
 }
diff --git a/internal/service/dms/consts.go b/internal/service/dms/consts.go
index 3caf64af684..c33690fd770 100644
--- a/internal/service/dms/consts.go
+++ b/internal/service/dms/consts.go
@@ -1,8 +1,25 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package dms
 
+import (
+	"time"
+)
+
+const (
+	propagationTimeout = 2 * time.Minute
+)
+
 const (
 	endpointStatusDeleting = "deleting"
 
+	replicationInstanceStatusAvailable = "available"
+	replicationInstanceStatusCreating  = "creating"
+	replicationInstanceStatusDeleting  = "deleting"
+	replicationInstanceStatusModifying = "modifying"
+	replicationInstanceStatusUpgrading = "upgrading"
+
 	replicationTaskStatusCreating  = "creating"
 	replicationTaskStatusDeleting  = "deleting"
 	replicationTaskStatusFailed    = "failed"
@@ -21,6 +38,7 @@ const (
 	engineNameAuroraServerless           = "aurora-serverless"
 	engineNameAzuredb                    = "azuredb"
 	engineNameAzureSQLManagedInstance    = "azure-sql-managed-instance"
+	engineNameBabelfish                  = "babelfish"
 	engineNameDB2                        = "db2"
 	engineNameDB2zOS                     = "db2-zos"
 	engineNameTransfer                   = "dms-transfer"
@@ -38,6 +56,7 @@ const (
 	engineNamePostgres                   = "postgres"
 	engineNameRedis                      = "redis"
 	engineNameRedshift                   = "redshift"
+	engineNameRedshiftServerless         = "redshift-serverless"
 	engineNameS3                         = "s3"
 	engineNameSQLServer                  = "sqlserver"
 	engineNameSybase                     = "sybase"
@@ -51,6 +70,7 @@ func engineName_Values() []string {
 		engineNameAuroraServerless,
 		engineNameAzuredb,
 		engineNameAzureSQLManagedInstance,
+		engineNameBabelfish,
 		engineNameDB2,
 		engineNameDB2zOS,
 		engineNameTransfer,
@@ -68,6 +88,7 @@ func engineName_Values() []string {
 		engineNamePostgres,
 		engineNameRedis,
 		engineNameRedshift,
+		engineNameRedshiftServerless,
 		engineNameS3,
 		engineNameSQLServer,
 		engineNameSybase,
@@ -120,3 +141,36 @@ func encryptionMode_Values() []string {
 		encryptionModeSseS3,
 	}
 }
+
+const (
+	replicationStatusCreated              = "created"
+	replicationStatusReady                = "ready"
+	replicationStatusRunning              = "running"
+	replicationStatusStopping             = "stopping"
+	replicationStatusStopped              = "stopped"
+	replicationStatusFailed               = "failed"
+	replicationStatusInitialising         = "initializing"
+	replicationStatusMetadataResources    = "preparing_metadata_resources"
+	replicationStatusTestingConnection    = "testing_connection"
+	replicationStatusFetchingMetadata     = "fetching_metadata"
+	replicationStatusCalculatingCapacity  = "calculating_capacity"
+	replicationStatusProvisioningCapacity = "provisioning_capacity"
+	replicationStatusReplicationStarting  = "replication_starting"
+)
+
+const (
+	replicationTypeValueStartReplication = "creating"
+	replicationTypeValueResumeProcessing = "resume-processing"
+)
+
+const (
+	networkTypeDual = "DUAL"
+	networkTypeIPv4 = "IPV4"
+)
+
+func networkType_Values() []string {
+	return []string{
+		networkTypeDual,
+		networkTypeIPv4,
+	}
+}
diff --git a/internal/service/dms/endpoint.go b/internal/service/dms/endpoint.go
index 6472366386a..b147104e692 100644
--- a/internal/service/dms/endpoint.go
+++ b/internal/service/dms/endpoint.go
@@ -1,19 +1,23 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package dms
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"strings"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	dms "github.com/aws/aws-sdk-go/service/databasemigrationservice"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	"github.com/hashicorp/go-cty/cty"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/customdiff"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
@@ -567,6 +571,11 @@ func ResourceEndpoint() *schema.Resource {
 							Optional: true,
 							Default:  "",
 						},
+						"glue_catalog_generation": {
+							Type:     schema.TypeBool,
+							Optional: true,
+							Default:  false,
+						},
 						"ignore_header_rows": {
 							Type:         schema.TypeInt,
 							Optional:     true,
@@ -862,7 +871,7 @@ func resourceEndpointCreate(ctx context.Context, d *schema.ResourceData, meta in
 		}
 
 		input.RedshiftSettings = settings
-	case engineNameSQLServer:
+	case engineNameSQLServer, engineNameBabelfish:
 		if _, ok := d.GetOk("secrets_manager_arn"); ok {
 			input.MicrosoftSQLServerSettings = &dms.MicrosoftSQLServerSettings{
 				SecretsManagerAccessRoleArn: aws.String(d.Get("secrets_manager_access_role_arn").(string)),
@@ -956,10 +965,8 @@ func resourceEndpointRead(ctx context.Context, d *schema.ResourceData, meta inte
 		return sdkdiag.AppendErrorf(diags, "reading DMS Endpoint (%s): %s", d.Id(), err)
 	}
 
-	err = resourceEndpointSetState(d, endpoint)
-
-	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "reading DMS Endpoint (%s): %s", d.Id(), err)
+	if err := resourceEndpointSetState(d, endpoint); err != nil {
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
 	return diags
@@ -1198,7 +1205,7 @@ func resourceEndpointUpdate(ctx context.Context, d *schema.ResourceData, meta in
 					}
 				}
 			}
-		case engineNameSQLServer:
+		case engineNameSQLServer, engineNameBabelfish:
 			if d.HasChanges(
 				"username", "password", "server_name", "port", "database_name", "secrets_manager_access_role_arn",
 				"secrets_manager_arn") {
@@ -1424,7 +1431,7 @@ func resourceEndpointSetState(d *schema.ResourceData, endpoint *dms.Endpoint) er
 	d.Set("endpoint_arn", endpoint.EndpointArn)
 	d.Set("endpoint_id", endpoint.EndpointIdentifier)
 	// For some reason the AWS API only accepts lowercase type but returns it as uppercase
-	d.Set("endpoint_type", strings.ToLower(*endpoint.EndpointType))
+	d.Set("endpoint_type", strings.ToLower(aws.StringValue(endpoint.EndpointType)))
 	d.Set("engine_name", endpoint.EngineName)
 	d.Set("extra_connection_attributes", endpoint.ExtraConnectionAttributes)
 
@@ -1524,7 +1531,7 @@ func resourceEndpointSetState(d *schema.ResourceData, endpoint *dms.Endpoint) er
 		if err := d.Set("redshift_settings", flattenRedshiftSettings(endpoint.RedshiftSettings)); err != nil {
 			return fmt.Errorf("setting redshift_settings: %w", err)
 		}
-	case engineNameSQLServer:
+	case engineNameSQLServer, engineNameBabelfish:
 		if endpoint.MicrosoftSQLServerSettings != nil {
 			d.Set("username", endpoint.MicrosoftSQLServerSettings.Username)
 			d.Set("server_name", endpoint.MicrosoftSQLServerSettings.ServerName)
@@ -2021,6 +2028,9 @@ func expandS3Settings(tfMap map[string]interface{}) *dms.S3Settings {
 	if v, ok := tfMap["external_table_definition"].(string); ok {
 		apiObject.ExternalTableDefinition = aws.String(v)
 	}
+	if v, ok := tfMap["glue_catalog_generation"].(bool); ok {
+		apiObject.GlueCatalogGeneration = aws.Bool(v)
+	}
 	if v, ok := tfMap["ignore_header_rows"].(int); ok {
 		apiObject.IgnoreHeaderRows = aws.Int64(int64(v))
 	}
@@ -2143,6 +2153,9 @@ func flattenS3Settings(apiObject *dms.S3Settings) []map[string]interface{} {
 	if v := apiObject.ExternalTableDefinition; v != nil {
 		tfMap["external_table_definition"] = aws.StringValue(v)
 	}
+	if v := apiObject.GlueCatalogGeneration; v != nil {
+		tfMap["glue_catalog_generation"] = aws.BoolValue(v)
+	}
 	if v := apiObject.IgnoreHeaderRows; v != nil {
 		tfMap["ignore_header_rows"] = aws.Int64Value(v)
 	}
@@ -2232,7 +2245,7 @@ func extraConnectionAttributesToSet(extra string) *schema.Set {
 		// normalize key, from camelCase to snake_case,
 		// and value where hyphens maybe used in a config
 		// but the API returns with underscores
-		matchAllCap := regexp.MustCompile("([a-z])([A-Z])")
+		matchAllCap := regexache.MustCompile("([a-z])([A-Z])")
 		key := matchAllCap.ReplaceAllString(k, "${1}_${2}")
 		normalizedVal := strings.Replace(strings.ToLower(v), "-", "_", -1)
 
@@ -2299,3 +2312,86 @@ func flattenTopLevelConnectionInfo(d *schema.ResourceData, endpoint *dms.Endpoin
 	d.Set("port", endpoint.Port)
 	d.Set("database_name", endpoint.DatabaseName)
 }
+
+func FindEndpointByID(ctx context.Context, conn *dms.DatabaseMigrationService, id string) (*dms.Endpoint, error) {
+	input := &dms.DescribeEndpointsInput{
+		Filters: []*dms.Filter{
+			{
+				Name:   aws.String("endpoint-id"),
+				Values: aws.StringSlice([]string{id}),
+			},
+		},
+	}
+
+	return findEndpoint(ctx, conn, input)
+}
+
+func findEndpoint(ctx context.Context, conn *dms.DatabaseMigrationService, input *dms.DescribeEndpointsInput) (*dms.Endpoint, error) {
+	output, err := findEndpoints(ctx, conn, input)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return tfresource.AssertSinglePtrResult(output)
+}
+
+func findEndpoints(ctx context.Context, conn *dms.DatabaseMigrationService, input *dms.DescribeEndpointsInput) ([]*dms.Endpoint, error) {
+	var output []*dms.Endpoint
+
+	err := conn.DescribeEndpointsPagesWithContext(ctx, input, func(page *dms.DescribeEndpointsOutput, lastPage bool) bool {
+		if page == nil {
+			return !lastPage
+		}
+
+		for _, v := range page.Endpoints {
+			if v != nil {
+				output = append(output, v)
+			}
+		}
+
+		return !lastPage
+	})
+
+	if tfawserr.ErrCodeEquals(err, dms.ErrCodeResourceNotFoundFault) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	return output, nil
+}
+
+func statusEndpoint(ctx context.Context, conn *dms.DatabaseMigrationService, id string) retry.StateRefreshFunc {
+	return func() (interface{}, string, error) {
+		output, err := FindEndpointByID(ctx, conn, id)
+
+		if tfresource.NotFound(err) {
+			return nil, "", nil
+		}
+
+		if err != nil {
+			return nil, "", err
+		}
+
+		return output, aws.StringValue(output.Status), nil
+	}
+}
+
+func waitEndpointDeleted(ctx context.Context, conn *dms.DatabaseMigrationService, id string, timeout time.Duration) error {
+	stateConf := &retry.StateChangeConf{
+		Pending: []string{endpointStatusDeleting},
+		Target:  []string{},
+		Refresh: statusEndpoint(ctx, conn, id),
+		Timeout: timeout,
+	}
+
+	_, err := stateConf.WaitForStateContext(ctx)
+
+	return err
+}
diff --git a/internal/service/dms/endpoint_data_source.go b/internal/service/dms/endpoint_data_source.go
index 0c57144fc79..c6d4c3f95a4 100644
--- a/internal/service/dms/endpoint_data_source.go
+++ b/internal/service/dms/endpoint_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package dms
 
 import (
@@ -7,9 +10,8 @@ import (
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
-	"github.com/hashicorp/terraform-provider-aws/internal/create"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
-	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
 // @SDKDataSource("aws_dms_endpoint")
@@ -28,12 +30,12 @@ func DataSourceEndpoint() *schema.Resource {
 			},
 			"elasticsearch_settings": {
 				Type:     schema.TypeList,
-				Optional: true,
+				Computed: true,
 				Elem: &schema.Resource{
 					Schema: map[string]*schema.Schema{
 						"endpoint_uri": {
 							Type:     schema.TypeString,
-							Required: true,
+							Computed: true,
 						},
 						"error_retry_duration": {
 							Type:     schema.TypeInt,
@@ -45,7 +47,7 @@ func DataSourceEndpoint() *schema.Resource {
 						},
 						"service_access_role_arn": {
 							Type:     schema.TypeString,
-							Required: true,
+							Computed: true,
 						},
 					},
 				},
@@ -68,16 +70,16 @@ func DataSourceEndpoint() *schema.Resource {
 			},
 			"extra_connection_attributes": {
 				Type:     schema.TypeString,
-				Optional: true,
+				Computed: true,
 			},
 			"kafka_settings": {
 				Type:     schema.TypeList,
-				Optional: true,
+				Computed: true,
 				Elem: &schema.Resource{
 					Schema: map[string]*schema.Schema{
 						"broker": {
 							Type:     schema.TypeString,
-							Required: true,
+							Computed: true,
 						},
 						"include_control_details": {
 							Type:     schema.TypeBool,
@@ -200,7 +202,7 @@ func DataSourceEndpoint() *schema.Resource {
 			},
 			"mongodb_settings": {
 				Type:     schema.TypeList,
-				Optional: true,
+				Computed: true,
 				Elem: &schema.Resource{
 					Schema: map[string]*schema.Schema{
 						"auth_mechanism": {
@@ -403,6 +405,10 @@ func DataSourceEndpoint() *schema.Resource {
 							Type:     schema.TypeString,
 							Computed: true,
 						},
+						"glue_catalog_generation": {
+							Type:     schema.TypeBool,
+							Computed: true,
+						},
 						"ignore_headers_row": {
 							Type:     schema.TypeInt,
 							Computed: true,
@@ -491,26 +497,23 @@ func DataSourceEndpoint() *schema.Resource {
 	}
 }
 
-const (
-	DSNameEndpoint = "Endpoint Data Source"
-)
-
 func dataSourceEndpointRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).DMSConn(ctx)
 	defaultTagsConfig := meta.(*conns.AWSClient).DefaultTagsConfig
 	ignoreTagsConfig := meta.(*conns.AWSClient).IgnoreTagsConfig
 
 	endptID := d.Get("endpoint_id").(string)
-
 	out, err := FindEndpointByID(ctx, conn, endptID)
+
 	if err != nil {
-		create.DiagError(names.DMS, create.ErrActionReading, DSNameEndpoint, d.Id(), err)
+		return sdkdiag.AppendErrorf(diags, "reading DMS Endpoint (%s): %s", endptID, err)
 	}
 
 	d.SetId(aws.StringValue(out.EndpointIdentifier))
-
 	d.Set("endpoint_id", out.EndpointIdentifier)
-	d.Set("endpoint_arn", out.EndpointArn)
+	arn := aws.StringValue(out.EndpointArn)
+	d.Set("endpoint_arn", arn)
 	d.Set("endpoint_type", out.EndpointType)
 	d.Set("database_name", out.DatabaseName)
 	d.Set("engine_name", out.EngineName)
@@ -519,22 +522,21 @@ func dataSourceEndpointRead(ctx context.Context, d *schema.ResourceData, meta in
 	d.Set("ssl_mode", out.SslMode)
 	d.Set("username", out.Username)
 
-	err = resourceEndpointSetState(d, out)
-	if err != nil {
-		create.DiagError(names.DMS, create.ErrActionReading, DSNameEndpoint, d.Id(), err)
+	if err := resourceEndpointSetState(d, out); err != nil {
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
-	tags, err := listTags(ctx, conn, aws.StringValue(out.EndpointArn))
+	tags, err := listTags(ctx, conn, arn)
 	if err != nil {
-		return create.DiagError(names.DMS, create.ErrActionReading, DSNameEndpoint, d.Id(), err)
+		return sdkdiag.AppendErrorf(diags, "listing tags for DMS Endpoint (%s): %s", arn, err)
 	}
 
 	tags = tags.IgnoreAWS().IgnoreConfig(ignoreTagsConfig)
 
 	//lintignore:AWSR002
 	if err := d.Set("tags", tags.RemoveDefaultConfig(defaultTagsConfig).Map()); err != nil {
-		return create.DiagError(names.DMS, create.ErrActionSetting, DSNameEndpoint, d.Id(), err)
+		return sdkdiag.AppendErrorf(diags, "setting tags: %s", err)
 	}
 
-	return nil
+	return diags
 }
diff --git a/internal/service/dms/endpoint_data_source_test.go b/internal/service/dms/endpoint_data_source_test.go
index 7dc5b1fd063..c237fabf0a7 100644
--- a/internal/service/dms/endpoint_data_source_test.go
+++ b/internal/service/dms/endpoint_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package dms_test
 
 import (
@@ -11,10 +14,6 @@ import (
 )
 
 func TestAccDMSEndpointDataSource_basic(t *testing.T) {
-	if testing.Short() {
-		t.Skip("skipping long-running test in short mode")
-	}
-
 	ctx := acctest.Context(t)
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_dms_endpoint.test"
diff --git a/internal/service/dms/endpoint_test.go b/internal/service/dms/endpoint_test.go
index e85f3aa9462..bf355246b58 100644
--- a/internal/service/dms/endpoint_test.go
+++ b/internal/service/dms/endpoint_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package dms_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	dms "github.com/aws/aws-sdk-go/service/databasemigrationservice"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -141,7 +144,7 @@ func TestAccDMSEndpoint_Aurora_update(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "password", "tftest-new-password"),
 					resource.TestCheckResourceAttr(resourceName, "database_name", "tftest-new-database_name"),
 					resource.TestCheckResourceAttr(resourceName, "ssl_mode", "none"),
-					resource.TestMatchResourceAttr(resourceName, "extra_connection_attributes", regexp.MustCompile(`EventsPollInterval=40;`)),
+					resource.TestMatchResourceAttr(resourceName, "extra_connection_attributes", regexache.MustCompile(`EventsPollInterval=40;`)),
 				),
 			},
 			{
@@ -237,7 +240,7 @@ func TestAccDMSEndpoint_AuroraPostgreSQL_update(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "password", "tftest-new-password"),
 					resource.TestCheckResourceAttr(resourceName, "database_name", "tftest-new-database_name"),
 					resource.TestCheckResourceAttr(resourceName, "ssl_mode", "require"),
-					resource.TestMatchResourceAttr(resourceName, "extra_connection_attributes", regexp.MustCompile(`ExecuteTimeout=1000;`)),
+					resource.TestMatchResourceAttr(resourceName, "extra_connection_attributes", regexache.MustCompile(`ExecuteTimeout=1000;`)),
 				),
 			},
 			{
@@ -278,6 +281,7 @@ func TestAccDMSEndpoint_S3_basic(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "s3_settings.0.data_format", "csv"),
 					resource.TestCheckResourceAttr(resourceName, "s3_settings.0.date_partition_enabled", "true"),
 					resource.TestCheckResourceAttr(resourceName, "s3_settings.0.date_partition_sequence", "yyyymmddhh"),
+					resource.TestCheckResourceAttr(resourceName, "s3_settings.0.glue_catalog_generation", "false"),
 					resource.TestCheckResourceAttr(resourceName, "s3_settings.0.ignore_header_rows", "0"),
 					resource.TestCheckResourceAttr(resourceName, "s3_settings.0.parquet_version", "parquet-1-0"),
 					resource.TestCheckResourceAttr(resourceName, "s3_settings.0.parquet_timestamp_in_millisecond", "false"),
@@ -308,6 +312,7 @@ func TestAccDMSEndpoint_S3_basic(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "s3_settings.0.bucket_folder", "new-bucket_folder"),
 					resource.TestCheckResourceAttr(resourceName, "s3_settings.0.bucket_name", "new-bucket_name"),
 					resource.TestCheckResourceAttr(resourceName, "s3_settings.0.compression_type", "GZIP"),
+					resource.TestCheckResourceAttr(resourceName, "s3_settings.0.glue_catalog_generation", "false"),
 				),
 			},
 			{
@@ -333,7 +338,7 @@ func TestAccDMSEndpoint_S3_detachTargetOnLobLookupFailureParquet(t *testing.T) {
 				Config: testAccEndpointConfig_s3DetachTargetOnLobLookupFailureParquet(rName, ""),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckEndpointExists(ctx, resourceName),
-					acctest.TestNoMatchResourceAttr(resourceName, "extra_connection_attributes", regexp.MustCompile(`detachTargetOnLobLookupFailureParquet`)),
+					acctest.TestNoMatchResourceAttr(resourceName, "extra_connection_attributes", regexache.MustCompile(`detachTargetOnLobLookupFailureParquet`)),
 					resource.TestCheckResourceAttr(resourceName, "s3_settings.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "s3_settings.0.external_table_definition", "new-external_table_definition"),
 					resource.TestCheckResourceAttr(resourceName, "s3_settings.0.csv_row_delimiter", "\\r"),
@@ -341,6 +346,8 @@ func TestAccDMSEndpoint_S3_detachTargetOnLobLookupFailureParquet(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "s3_settings.0.bucket_folder", "new-bucket_folder"),
 					resource.TestCheckResourceAttr(resourceName, "s3_settings.0.bucket_name", "new-bucket_name"),
 					resource.TestCheckResourceAttr(resourceName, "s3_settings.0.compression_type", "GZIP"),
+					resource.TestCheckResourceAttr(resourceName, "s3_settings.0.glue_catalog_generation", "true"),
+					resource.TestCheckResourceAttr(resourceName, "s3_settings.0.include_op_for_full_load", "true"),
 				),
 			},
 			{
@@ -352,7 +359,7 @@ func TestAccDMSEndpoint_S3_detachTargetOnLobLookupFailureParquet(t *testing.T) {
 				Config: testAccEndpointConfig_s3DetachTargetOnLobLookupFailureParquet(rName, "detachTargetOnLobLookupFailureParquet=false"),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckEndpointExists(ctx, resourceName),
-					resource.TestMatchResourceAttr(resourceName, "extra_connection_attributes", regexp.MustCompile(`detachTargetOnLobLookupFailureParquet=false`)),
+					resource.TestMatchResourceAttr(resourceName, "extra_connection_attributes", regexache.MustCompile(`detachTargetOnLobLookupFailureParquet=false`)),
 					resource.TestCheckResourceAttr(resourceName, "s3_settings.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "s3_settings.0.external_table_definition", "new-external_table_definition"),
 					resource.TestCheckResourceAttr(resourceName, "s3_settings.0.csv_row_delimiter", "\\r"),
@@ -366,7 +373,7 @@ func TestAccDMSEndpoint_S3_detachTargetOnLobLookupFailureParquet(t *testing.T) {
 				Config: testAccEndpointConfig_s3DetachTargetOnLobLookupFailureParquet(rName, "detachTargetOnLobLookupFailureParquet=true"),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckEndpointExists(ctx, resourceName),
-					resource.TestMatchResourceAttr(resourceName, "extra_connection_attributes", regexp.MustCompile(`detachTargetOnLobLookupFailureParquet=true`)),
+					resource.TestMatchResourceAttr(resourceName, "extra_connection_attributes", regexache.MustCompile(`detachTargetOnLobLookupFailureParquet=true`)),
 					resource.TestCheckResourceAttr(resourceName, "s3_settings.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "s3_settings.0.external_table_definition", "new-external_table_definition"),
 					resource.TestCheckResourceAttr(resourceName, "s3_settings.0.csv_row_delimiter", "\\r"),
@@ -396,7 +403,7 @@ func TestAccDMSEndpoint_S3_key(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccEndpointConfig_s3ConnParamKey(rName),
-				ExpectError: regexp.MustCompile(`kms_key_arn must not be set when engine is "s3". Use s3_settings.server_side_encryption_kms_key_id instead`),
+				ExpectError: regexache.MustCompile(`kms_key_arn must not be set when engine is "s3". Use s3_settings.server_side_encryption_kms_key_id instead`),
 			},
 		},
 	})
@@ -418,7 +425,7 @@ func TestAccDMSEndpoint_S3_extraConnectionAttributes(t *testing.T) {
 				Config: testAccEndpointConfig_s3ExtraConnectionAttributes(rName, "", ","),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckEndpointExists(ctx, resourceName),
-					acctest.TestNoMatchResourceAttr(resourceName, "extra_connection_attributes", regexp.MustCompile(`dataFormat=parquet;`)),
+					acctest.TestNoMatchResourceAttr(resourceName, "extra_connection_attributes", regexache.MustCompile(`dataFormat=parquet;`)),
 				),
 			},
 			{
@@ -442,7 +449,7 @@ func TestAccDMSEndpoint_S3_extraConnectionAttributes(t *testing.T) {
 				Config: testAccEndpointConfig_s3ExtraConnectionAttributes(rName, "dataFormat=parquet;", "."),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckEndpointExists(ctx, resourceName),
-					resource.TestMatchResourceAttr(resourceName, "extra_connection_attributes", regexp.MustCompile(`dataFormat=parquet;`)),
+					resource.TestMatchResourceAttr(resourceName, "extra_connection_attributes", regexache.MustCompile(`dataFormat=parquet;`)),
 				),
 			},
 			{
@@ -1009,7 +1016,7 @@ func TestAccDMSEndpoint_MariaDB_update(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "password", "tftest-new-password"),
 					resource.TestCheckResourceAttr(resourceName, "database_name", "tftest-new-database_name"),
 					resource.TestCheckResourceAttr(resourceName, "ssl_mode", "none"),
-					resource.TestMatchResourceAttr(resourceName, "extra_connection_attributes", regexp.MustCompile(`EventsPollInterval=30;`)),
+					resource.TestMatchResourceAttr(resourceName, "extra_connection_attributes", regexache.MustCompile(`EventsPollInterval=30;`)),
 				),
 			},
 			{
@@ -1105,7 +1112,7 @@ func TestAccDMSEndpoint_MySQL_update(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "password", "tftest-new-password"),
 					resource.TestCheckResourceAttr(resourceName, "database_name", "tftest-new-database_name"),
 					resource.TestCheckResourceAttr(resourceName, "ssl_mode", "none"),
-					resource.TestMatchResourceAttr(resourceName, "extra_connection_attributes", regexp.MustCompile(`CleanSrcMetadataOnMismatch=false;`)),
+					resource.TestMatchResourceAttr(resourceName, "extra_connection_attributes", regexache.MustCompile(`CleanSrcMetadataOnMismatch=false;`)),
 				),
 			},
 			{
@@ -1209,7 +1216,7 @@ func TestAccDMSEndpoint_Oracle_update(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "password", "tftest-new-password"),
 					resource.TestCheckResourceAttr(resourceName, "database_name", "tftest-new-database_name"),
 					resource.TestCheckResourceAttr(resourceName, "ssl_mode", "none"),
-					resource.TestMatchResourceAttr(resourceName, "extra_connection_attributes", regexp.MustCompile(`charLengthSemantics=CHAR;`)),
+					resource.TestMatchResourceAttr(resourceName, "extra_connection_attributes", regexache.MustCompile(`charLengthSemantics=CHAR;`)),
 				),
 			},
 			{
@@ -1305,7 +1312,7 @@ func TestAccDMSEndpoint_PostgreSQL_update(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "password", "tftest-new-password"),
 					resource.TestCheckResourceAttr(resourceName, "database_name", "tftest-new-database_name"),
 					resource.TestCheckResourceAttr(resourceName, "ssl_mode", "require"),
-					resource.TestMatchResourceAttr(resourceName, "extra_connection_attributes", regexp.MustCompile(`HeartbeatFrequency=180;`)),
+					resource.TestMatchResourceAttr(resourceName, "extra_connection_attributes", regexache.MustCompile(`HeartbeatFrequency=180;`)),
 				),
 			},
 			{
@@ -1425,7 +1432,47 @@ func TestAccDMSEndpoint_SQLServer_update(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "password", "tftest-new-password"),
 					resource.TestCheckResourceAttr(resourceName, "database_name", "tftest-new-database_name"),
 					resource.TestCheckResourceAttr(resourceName, "ssl_mode", "require"),
-					resource.TestMatchResourceAttr(resourceName, "extra_connection_attributes", regexp.MustCompile(`TlogAccessMode=PreferTlog;`)),
+					resource.TestMatchResourceAttr(resourceName, "extra_connection_attributes", regexache.MustCompile(`TlogAccessMode=PreferTlog;`)),
+				),
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"password"},
+			},
+		},
+	})
+}
+
+func TestAccDMSEndpoint_babelfish(t *testing.T) {
+	ctx := acctest.Context(t)
+	resourceName := "aws_dms_endpoint.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, dms.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckEndpointDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccEndpointConfig_babelfish(rName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckEndpointExists(ctx, resourceName),
+					resource.TestCheckResourceAttrSet(resourceName, "endpoint_arn"),
+				),
+			},
+			{
+				Config: testAccEndpointConfig_babelfishUpdate(rName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckEndpointExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "server_name", "tftest-new-server_name"),
+					resource.TestCheckResourceAttr(resourceName, "port", "27018"),
+					resource.TestCheckResourceAttr(resourceName, "username", "tftest-new-username"),
+					resource.TestCheckResourceAttr(resourceName, "password", "tftest-new-password"),
+					resource.TestCheckResourceAttr(resourceName, "database_name", "tftest-new-database_name"),
+					resource.TestCheckResourceAttr(resourceName, "ssl_mode", "require"),
 				),
 			},
 			{
@@ -1954,7 +2001,7 @@ func TestAccDMSEndpoint_Redshift_update(t *testing.T) {
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckEndpointExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "database_name", "tftest-new-database_name"),
-					resource.TestMatchResourceAttr(resourceName, "extra_connection_attributes", regexp.MustCompile(`acceptanydate=true`)),
+					resource.TestMatchResourceAttr(resourceName, "extra_connection_attributes", regexache.MustCompile(`acceptanydate=true`)),
 					resource.TestCheckResourceAttr(resourceName, "port", "27018"),
 					resource.TestCheckResourceAttr(resourceName, "username", "tftest-new-username"),
 					resource.TestCheckResourceAttr(resourceName, "password", "tftest-new-password"),
@@ -2350,6 +2397,50 @@ resource "aws_dms_endpoint" "test" {
 `, rName)
 }
 
+func testAccEndpointConfig_babelfish(rName string) string {
+	return fmt.Sprintf(`
+resource "aws_dms_endpoint" "test" {
+  endpoint_id   = %[1]q
+  endpoint_type = "target"
+  engine_name   = "babelfish"
+  server_name   = "tftest"
+  port          = 27017
+  username      = "tftest"
+  password      = "tftest"
+  database_name = "tftest"
+  ssl_mode      = "none"
+
+  tags = {
+    Name   = %[1]q
+    Update = "to-update"
+    Remove = "to-remove"
+  }
+}
+`, rName)
+}
+
+func testAccEndpointConfig_babelfishUpdate(rName string) string {
+	return fmt.Sprintf(`
+resource "aws_dms_endpoint" "test" {
+  endpoint_id   = %[1]q
+  endpoint_type = "target"
+  engine_name   = "babelfish"
+  server_name   = "tftest-new-server_name"
+  port          = 27018
+  username      = "tftest-new-username"
+  password      = "tftest-new-password"
+  database_name = "tftest-new-database_name"
+  ssl_mode      = "require"
+
+  tags = {
+    Name   = %[1]q
+    Update = "updated"
+    Add    = "added"
+  }
+}
+`, rName)
+}
+
 func testAccEndpointConfig_dynamoDB(rName string) string {
 	return fmt.Sprintf(`
 data "aws_partition" "current" {}
@@ -2900,6 +2991,7 @@ resource "aws_dms_endpoint" "test" {
     bucket_folder             = "new-bucket_folder"
     bucket_name               = "new-bucket_name"
     compression_type          = "GZIP"
+    glue_catalog_generation   = false
   }
 }
 
@@ -2979,6 +3071,8 @@ resource "aws_dms_endpoint" "test" {
     bucket_folder             = "new-bucket_folder"
     bucket_name               = "new-bucket_name"
     compression_type          = "GZIP"
+    glue_catalog_generation   = true
+    include_op_for_full_load  = true
   }
 }
 
diff --git a/internal/service/dms/event_subscription.go b/internal/service/dms/event_subscription.go
index 19f87f09e1c..6e8226ba0ba 100644
--- a/internal/service/dms/event_subscription.go
+++ b/internal/service/dms/event_subscription.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package dms
 
 import (
diff --git a/internal/service/dms/event_subscription_test.go b/internal/service/dms/event_subscription_test.go
index ec4aefc8d61..c6665a4c870 100644
--- a/internal/service/dms/event_subscription_test.go
+++ b/internal/service/dms/event_subscription_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package dms_test
 
 import (
diff --git a/internal/service/dms/find.go b/internal/service/dms/find.go
deleted file mode 100644
index 26541737a86..00000000000
--- a/internal/service/dms/find.go
+++ /dev/null
@@ -1,94 +0,0 @@
-package dms
-
-import (
-	"context"
-
-	"github.com/aws/aws-sdk-go/aws"
-	dms "github.com/aws/aws-sdk-go/service/databasemigrationservice"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
-	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
-)
-
-func FindEndpointByID(ctx context.Context, conn *dms.DatabaseMigrationService, id string) (*dms.Endpoint, error) {
-	input := &dms.DescribeEndpointsInput{
-		Filters: []*dms.Filter{
-			{
-				Name:   aws.String("endpoint-id"),
-				Values: aws.StringSlice([]string{id}),
-			},
-		},
-	}
-
-	output, err := conn.DescribeEndpointsWithContext(ctx, input)
-
-	if tfawserr.ErrCodeEquals(err, dms.ErrCodeResourceNotFoundFault) {
-		return nil, &retry.NotFoundError{
-			LastError:   err,
-			LastRequest: input,
-		}
-	}
-
-	if err != nil {
-		return nil, err
-	}
-
-	if output == nil || len(output.Endpoints) == 0 || output.Endpoints[0] == nil {
-		return nil, tfresource.NewEmptyResultError(input)
-	}
-
-	if count := len(output.Endpoints); count > 1 {
-		return nil, tfresource.NewTooManyResultsError(count, input)
-	}
-
-	return output.Endpoints[0], nil
-}
-
-func FindReplicationTaskByID(ctx context.Context, conn *dms.DatabaseMigrationService, id string) (*dms.ReplicationTask, error) {
-	input := &dms.DescribeReplicationTasksInput{
-		Filters: []*dms.Filter{
-			{
-				Name:   aws.String("replication-task-id"),
-				Values: []*string{aws.String(id)}, // Must use d.Id() to work with import.
-			},
-		},
-	}
-
-	var results []*dms.ReplicationTask
-
-	err := conn.DescribeReplicationTasksPagesWithContext(ctx, input, func(page *dms.DescribeReplicationTasksOutput, lastPage bool) bool {
-		if page == nil {
-			return !lastPage
-		}
-
-		for _, task := range page.ReplicationTasks {
-			if task == nil {
-				continue
-			}
-			results = append(results, task)
-		}
-
-		return !lastPage
-	})
-
-	if tfawserr.ErrCodeEquals(err, dms.ErrCodeResourceNotFoundFault) {
-		return nil, &retry.NotFoundError{
-			LastError:   err,
-			LastRequest: input,
-		}
-	}
-
-	if err != nil {
-		return nil, err
-	}
-
-	if len(results) == 0 {
-		return nil, tfresource.NewEmptyResultError(input)
-	}
-
-	if count := len(results); count > 1 {
-		return nil, tfresource.NewTooManyResultsError(count, input)
-	}
-
-	return results[0], nil
-}
diff --git a/internal/service/dms/generate.go b/internal/service/dms/generate.go
index e994d773103..a9da99dfa6b 100644
--- a/internal/service/dms/generate.go
+++ b/internal/service/dms/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTags -ListTagsOutTagsElem=TagList -ServiceTagsSlice -TagOp=AddTagsToResource -UntagOp=RemoveTagsFromResource -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/dms/replication_config.go b/internal/service/dms/replication_config.go
new file mode 100644
index 00000000000..0e28a878388
--- /dev/null
+++ b/internal/service/dms/replication_config.go
@@ -0,0 +1,657 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package dms
+
+import (
+	"context"
+	"fmt"
+	"log"
+	"time"
+
+	"github.com/aws/aws-sdk-go/aws"
+	dms "github.com/aws/aws-sdk-go/service/databasemigrationservice"
+	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
+	"github.com/hashicorp/terraform-provider-aws/internal/flex"
+	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/internal/verify"
+	"github.com/hashicorp/terraform-provider-aws/names"
+)
+
+// @SDKResource("aws_dms_replication_config", name="Replication Config")
+// @Tags(identifierAttribute="id")
+func ResourceReplicationConfig() *schema.Resource {
+	return &schema.Resource{
+		CreateWithoutTimeout: resourceReplicationConfigCreate,
+		ReadWithoutTimeout:   resourceReplicationConfigRead,
+		UpdateWithoutTimeout: resourceReplicationConfigUpdate,
+		DeleteWithoutTimeout: resourceReplicationConfigDelete,
+
+		Timeouts: &schema.ResourceTimeout{
+			Create: schema.DefaultTimeout(60 * time.Minute),
+			Update: schema.DefaultTimeout(60 * time.Minute),
+			Delete: schema.DefaultTimeout(60 * time.Minute),
+		},
+
+		Importer: &schema.ResourceImporter{
+			StateContext: schema.ImportStatePassthroughContext,
+		},
+
+		Schema: map[string]*schema.Schema{
+			"arn": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"compute_config": {
+				Type:     schema.TypeList,
+				Required: true,
+				MaxItems: 1,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"availability_zone": {
+							Type:     schema.TypeString,
+							Optional: true,
+							Computed: true,
+							ForceNew: true,
+						},
+						"dns_name_servers": {
+							Type:     schema.TypeString,
+							Optional: true,
+						},
+						"kms_key_id": {
+							Type:         schema.TypeString,
+							Optional:     true,
+							Computed:     true,
+							ForceNew:     true,
+							ValidateFunc: verify.ValidARN,
+						},
+						"max_capacity_units": {
+							Type:     schema.TypeInt,
+							Optional: true,
+						},
+						"min_capacity_units": {
+							Type:     schema.TypeInt,
+							Optional: true,
+						},
+						"multi_az": {
+							Type:     schema.TypeBool,
+							Optional: true,
+							Computed: true,
+						},
+						"preferred_maintenance_window": {
+							Type:         schema.TypeString,
+							Optional:     true,
+							Computed:     true,
+							ValidateFunc: verify.ValidOnceAWeekWindowFormat,
+						},
+						"replication_subnet_group_id": {
+							Type:         schema.TypeString,
+							Required:     true,
+							ForceNew:     true,
+							ValidateFunc: validReplicationSubnetGroupID,
+						},
+						"vpc_security_group_ids": {
+							Type:     schema.TypeSet,
+							Optional: true,
+							Computed: true,
+							Elem:     &schema.Schema{Type: schema.TypeString},
+						},
+					},
+				},
+			},
+			"replication_config_identifier": {
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+			"replication_settings": {
+				Type:     schema.TypeString,
+				Optional: true,
+				Computed: true,
+			},
+			"replication_type": {
+				Type:         schema.TypeString,
+				Required:     true,
+				ValidateFunc: validation.StringInSlice(dms.MigrationTypeValue_Values(), false),
+			},
+			"resource_identifier": {
+				Type:     schema.TypeString,
+				Optional: true,
+				Computed: true,
+				ForceNew: true,
+			},
+			"source_endpoint_arn": {
+				Type:         schema.TypeString,
+				Required:     true,
+				ValidateFunc: verify.ValidARN,
+			},
+			"start_replication": {
+				Type:     schema.TypeBool,
+				Optional: true,
+				Default:  false,
+			},
+			"supplemental_settings": {
+				Type:             schema.TypeString,
+				Optional:         true,
+				ValidateFunc:     validation.StringIsJSON,
+				DiffSuppressFunc: verify.SuppressEquivalentJSONDiffs,
+			},
+			"table_mappings": {
+				Type:             schema.TypeString,
+				Required:         true,
+				ValidateFunc:     validation.StringIsJSON,
+				DiffSuppressFunc: verify.SuppressEquivalentJSONDiffs,
+			},
+			names.AttrTags:    tftags.TagsSchema(),
+			names.AttrTagsAll: tftags.TagsSchemaComputed(),
+			"target_endpoint_arn": {
+				Type:         schema.TypeString,
+				Required:     true,
+				ValidateFunc: verify.ValidARN,
+			},
+		},
+
+		CustomizeDiff: verify.SetTagsDiff,
+	}
+}
+
+func resourceReplicationConfigCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).DMSConn(ctx)
+
+	replicationConfigID := d.Get("replication_config_identifier").(string)
+	input := &dms.CreateReplicationConfigInput{
+		ReplicationConfigIdentifier: aws.String(replicationConfigID),
+		ReplicationType:             aws.String(d.Get("replication_type").(string)),
+		SourceEndpointArn:           aws.String(d.Get("source_endpoint_arn").(string)),
+		TableMappings:               aws.String(d.Get("table_mappings").(string)),
+		Tags:                        getTagsIn(ctx),
+		TargetEndpointArn:           aws.String(d.Get("target_endpoint_arn").(string)),
+	}
+
+	if v, ok := d.GetOk("compute_config"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
+		input.ComputeConfig = expandComputeConfigInput(v.([]interface{})[0].(map[string]interface{}))
+	}
+
+	if v, ok := d.GetOk("replication_settings"); ok {
+		input.ReplicationSettings = aws.String(v.(string))
+	}
+
+	if v, ok := d.GetOk("resource_identifier"); ok {
+		input.ResourceIdentifier = aws.String(v.(string))
+	}
+
+	if v, ok := d.GetOk("supplemental_settings"); ok {
+		input.SupplementalSettings = aws.String(v.(string))
+	}
+
+	output, err := conn.CreateReplicationConfigWithContext(ctx, input)
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "creating DMS Replication Config (%s): %s", replicationConfigID, err)
+	}
+
+	d.SetId(aws.StringValue(output.ReplicationConfig.ReplicationConfigArn))
+
+	if d.Get("start_replication").(bool) {
+		if err := startReplication(ctx, conn, d.Id(), d.Timeout(schema.TimeoutCreate)); err != nil {
+			return sdkdiag.AppendFromErr(diags, err)
+		}
+	}
+
+	return resourceReplicationConfigRead(ctx, d, meta)
+}
+
+func resourceReplicationConfigRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).DMSConn(ctx)
+
+	replicationConfig, err := FindReplicationConfigByARN(ctx, conn, d.Id())
+
+	if !d.IsNewResource() && tfresource.NotFound(err) {
+		log.Printf("[WARN] DMS Replication Config (%s) not found, removing from state", d.Id())
+		d.SetId("")
+		return diags
+	}
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "reading DMS Replication Config (%s): %s", d.Id(), err)
+	}
+
+	d.Set("arn", replicationConfig.ReplicationConfigArn)
+	if err := d.Set("compute_config", flattenComputeConfig(replicationConfig.ComputeConfig)); err != nil {
+		return sdkdiag.AppendErrorf(diags, "setting compute_config: %s", err)
+	}
+	d.Set("replication_config_identifier", replicationConfig.ReplicationConfigIdentifier)
+	d.Set("replication_settings", replicationConfig.ReplicationSettings)
+	d.Set("replication_type", replicationConfig.ReplicationType)
+	d.Set("source_endpoint_arn", replicationConfig.SourceEndpointArn)
+	d.Set("supplemental_settings", replicationConfig.SupplementalSettings)
+	d.Set("table_mappings", replicationConfig.TableMappings)
+	d.Set("target_endpoint_arn", replicationConfig.TargetEndpointArn)
+
+	return diags
+}
+
+func resourceReplicationConfigUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).DMSConn(ctx)
+
+	if d.HasChangesExcept("tags", "tags_all", "start_replication") {
+		if err := stopReplication(ctx, conn, d.Id(), d.Timeout(schema.TimeoutUpdate)); err != nil {
+			return sdkdiag.AppendFromErr(diags, err)
+		}
+
+		input := &dms.ModifyReplicationConfigInput{
+			ReplicationConfigArn: aws.String(d.Id()),
+		}
+
+		if d.HasChange("compute_config") {
+			if v, ok := d.GetOk("compute_config"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
+				input.ComputeConfig = expandComputeConfigInput(v.([]interface{})[0].(map[string]interface{}))
+			}
+		}
+
+		if d.HasChange("replication_settings") {
+			input.ReplicationSettings = aws.String(d.Get("replication_settings").(string))
+		}
+
+		if d.HasChange("replication_type") {
+			input.ReplicationType = aws.String(d.Get("replication_type").(string))
+		}
+
+		if d.HasChange("source_endpoint_arn") {
+			input.SourceEndpointArn = aws.String(d.Get("source_endpoint_arn").(string))
+		}
+
+		if d.HasChange("supplemental_settings") {
+			input.SupplementalSettings = aws.String(d.Get("supplemental_settings").(string))
+		}
+
+		if d.HasChange("table_mappings") {
+			input.TableMappings = aws.String(d.Get("table_mappings").(string))
+		}
+
+		if d.HasChange("target_endpoint_arn") {
+			input.TargetEndpointArn = aws.String(d.Get("target_endpoint_arn").(string))
+		}
+
+		_, err := conn.ModifyReplicationConfigWithContext(ctx, input)
+
+		if err != nil {
+			return sdkdiag.AppendErrorf(diags, "updating DMS Replication Config (%s): %s", d.Id(), err)
+		}
+
+		if d.Get("start_replication").(bool) {
+			if err := startReplication(ctx, conn, d.Id(), d.Timeout(schema.TimeoutUpdate)); err != nil {
+				return sdkdiag.AppendFromErr(diags, err)
+			}
+		}
+	}
+
+	if d.HasChange("start_replication") {
+		var f func(context.Context, *dms.DatabaseMigrationService, string, time.Duration) error
+		if d.Get("start_replication").(bool) {
+			f = startReplication
+		} else {
+			f = stopReplication
+		}
+		if err := f(ctx, conn, d.Id(), d.Timeout(schema.TimeoutUpdate)); err != nil {
+			return sdkdiag.AppendFromErr(diags, err)
+		}
+	}
+
+	return append(diags, resourceReplicationConfigRead(ctx, d, meta)...)
+}
+
+func resourceReplicationConfigDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).DMSConn(ctx)
+
+	if err := stopReplication(ctx, conn, d.Id(), d.Timeout(schema.TimeoutDelete)); err != nil {
+		return sdkdiag.AppendFromErr(diags, err)
+	}
+
+	log.Printf("[DEBUG] Deleting DMS Replication Config: %s", d.Id())
+	_, err := conn.DeleteReplicationConfigWithContext(ctx, &dms.DeleteReplicationConfigInput{
+		ReplicationConfigArn: aws.String(d.Id()),
+	})
+
+	if tfawserr.ErrCodeEquals(err, dms.ErrCodeResourceNotFoundFault) {
+		return diags
+	}
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "deleting DMS Replication Config (%s): %s", d.Id(), err)
+	}
+
+	if _, err := waitReplicationDeleted(ctx, conn, d.Id(), d.Timeout(schema.TimeoutDelete)); err != nil {
+		return sdkdiag.AppendErrorf(diags, "waiting for  DMS Replication Config (%s) delete: %s", d.Id(), err)
+	}
+
+	return diags
+}
+
+func FindReplicationConfigByARN(ctx context.Context, conn *dms.DatabaseMigrationService, arn string) (*dms.ReplicationConfig, error) {
+	input := &dms.DescribeReplicationConfigsInput{
+		Filters: []*dms.Filter{{
+			Name:   aws.String("replication-config-arn"),
+			Values: aws.StringSlice([]string{arn}),
+		}},
+	}
+
+	return findReplicationConfig(ctx, conn, input)
+}
+
+func findReplicationConfig(ctx context.Context, conn *dms.DatabaseMigrationService, input *dms.DescribeReplicationConfigsInput) (*dms.ReplicationConfig, error) {
+	output, err := findReplicationConfigs(ctx, conn, input)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return tfresource.AssertSinglePtrResult(output)
+}
+
+func findReplicationConfigs(ctx context.Context, conn *dms.DatabaseMigrationService, input *dms.DescribeReplicationConfigsInput) ([]*dms.ReplicationConfig, error) {
+	var output []*dms.ReplicationConfig
+
+	err := conn.DescribeReplicationConfigsPagesWithContext(ctx, input, func(page *dms.DescribeReplicationConfigsOutput, lastPage bool) bool {
+		if page == nil {
+			return !lastPage
+		}
+
+		for _, v := range page.ReplicationConfigs {
+			if v != nil {
+				output = append(output, v)
+			}
+		}
+
+		return !lastPage
+	})
+
+	if tfawserr.ErrCodeEquals(err, dms.ErrCodeResourceNotFoundFault) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	return output, nil
+}
+
+func findReplicationByReplicationConfigARN(ctx context.Context, conn *dms.DatabaseMigrationService, arn string) (*dms.Replication, error) {
+	input := &dms.DescribeReplicationsInput{
+		Filters: []*dms.Filter{{
+			Name:   aws.String("replication-config-arn"),
+			Values: aws.StringSlice([]string{arn}),
+		}},
+	}
+
+	return findReplication(ctx, conn, input)
+}
+
+func findReplication(ctx context.Context, conn *dms.DatabaseMigrationService, input *dms.DescribeReplicationsInput) (*dms.Replication, error) {
+	output, err := findReplications(ctx, conn, input)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return tfresource.AssertSinglePtrResult(output)
+}
+
+func findReplications(ctx context.Context, conn *dms.DatabaseMigrationService, input *dms.DescribeReplicationsInput) ([]*dms.Replication, error) {
+	var output []*dms.Replication
+
+	err := conn.DescribeReplicationsPagesWithContext(ctx, input, func(page *dms.DescribeReplicationsOutput, lastPage bool) bool {
+		if page == nil {
+			return !lastPage
+		}
+
+		for _, v := range page.Replications {
+			if v != nil {
+				output = append(output, v)
+			}
+		}
+
+		return !lastPage
+	})
+
+	if tfawserr.ErrCodeEquals(err, dms.ErrCodeResourceNotFoundFault) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	return output, nil
+}
+
+func statusReplication(ctx context.Context, conn *dms.DatabaseMigrationService, arn string) retry.StateRefreshFunc {
+	return func() (interface{}, string, error) {
+		output, err := findReplicationByReplicationConfigARN(ctx, conn, arn)
+
+		if tfresource.NotFound(err) {
+			return nil, "", nil
+		}
+
+		if err != nil {
+			return nil, "", err
+		}
+
+		return output, aws.StringValue(output.Status), nil
+	}
+}
+
+func waitReplicationRunning(ctx context.Context, conn *dms.DatabaseMigrationService, arn string, timeout time.Duration) (*dms.Replication, error) {
+	stateConf := &retry.StateChangeConf{
+		Pending: []string{
+			replicationStatusReady,
+			replicationStatusInitialising,
+			replicationStatusMetadataResources,
+			replicationStatusTestingConnection,
+			replicationStatusFetchingMetadata,
+			replicationStatusCalculatingCapacity,
+			replicationStatusProvisioningCapacity,
+			replicationStatusReplicationStarting,
+		},
+		Target:     []string{replicationStatusRunning, replicationStatusStopped},
+		Refresh:    statusReplication(ctx, conn, arn),
+		Timeout:    timeout,
+		MinTimeout: 10 * time.Second,
+		Delay:      30 * time.Second,
+	}
+
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+
+	if output, ok := outputRaw.(*dms.Replication); ok {
+		return output, err
+	}
+
+	return nil, err
+}
+
+func waitReplicationStopped(ctx context.Context, conn *dms.DatabaseMigrationService, arn string, timeout time.Duration) (*dms.Replication, error) {
+	stateConf := &retry.StateChangeConf{
+		Pending:    []string{replicationStatusStopping, replicationStatusRunning},
+		Target:     []string{replicationStatusStopped},
+		Refresh:    statusReplication(ctx, conn, arn),
+		Timeout:    timeout,
+		MinTimeout: 10 * time.Second,
+		Delay:      60 * time.Second,
+	}
+
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+
+	if output, ok := outputRaw.(*dms.Replication); ok {
+		return output, err
+	}
+
+	return nil, err
+}
+
+func waitReplicationDeleted(ctx context.Context, conn *dms.DatabaseMigrationService, arn string, timeout time.Duration) (*dms.Replication, error) {
+	stateConf := &retry.StateChangeConf{
+		Pending:    []string{replicationTaskStatusDeleting, replicationStatusStopped},
+		Target:     []string{},
+		Refresh:    statusReplication(ctx, conn, arn),
+		Timeout:    timeout,
+		MinTimeout: 10 * time.Second,
+		Delay:      30 * time.Second,
+	}
+
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+
+	if output, ok := outputRaw.(*dms.Replication); ok {
+		return output, err
+	}
+
+	return nil, err
+}
+
+func startReplication(ctx context.Context, conn *dms.DatabaseMigrationService, arn string, timeout time.Duration) error {
+	replication, err := findReplicationByReplicationConfigARN(ctx, conn, arn)
+
+	if err != nil {
+		return fmt.Errorf("reading DMS Replication Config (%s) replication: %s", arn, err)
+	}
+
+	replicationStatus := aws.StringValue(replication.Status)
+
+	if replicationStatus == replicationStatusRunning {
+		return nil
+	}
+
+	startReplicationType := replicationTypeValueStartReplication
+	if replicationStatus != replicationStatusReady {
+		startReplicationType = replicationTypeValueResumeProcessing
+	}
+	input := &dms.StartReplicationInput{
+		ReplicationConfigArn: aws.String(arn),
+		StartReplicationType: aws.String(startReplicationType),
+	}
+
+	_, err = conn.StartReplicationWithContext(ctx, input)
+
+	if err != nil {
+		return fmt.Errorf("starting DMS Serverless Replication (%s): %w", arn, err)
+	}
+
+	if _, err := waitReplicationRunning(ctx, conn, arn, timeout); err != nil {
+		return fmt.Errorf("waiting for DMS Serverless Replication (%s) start: %w", arn, err)
+	}
+
+	return nil
+}
+
+func stopReplication(ctx context.Context, conn *dms.DatabaseMigrationService, arn string, timeout time.Duration) error {
+	replication, err := findReplicationByReplicationConfigARN(ctx, conn, arn)
+
+	if err != nil {
+		return fmt.Errorf("reading DMS Replication Config (%s) replication: %s", arn, err)
+	}
+
+	replicationStatus := aws.StringValue(replication.Status)
+
+	if replicationStatus == replicationStatusStopped || replicationStatus == replicationStatusCreated || replicationStatus == replicationStatusFailed {
+		return nil
+	}
+
+	input := &dms.StopReplicationInput{
+		ReplicationConfigArn: aws.String(arn),
+	}
+
+	_, err = conn.StopReplicationWithContext(ctx, input)
+
+	if err != nil {
+		return fmt.Errorf("stopping DMS Serverless Replication (%s): %w", arn, err)
+	}
+
+	if _, err := waitReplicationStopped(ctx, conn, arn, timeout); err != nil {
+		return fmt.Errorf("waiting for DMS Serverless Replication (%s) stop: %w", arn, err)
+	}
+
+	return nil
+}
+
+func flattenComputeConfig(apiObject *dms.ComputeConfig) []interface{} {
+	if apiObject == nil {
+		return nil
+	}
+
+	tfMap := map[string]interface{}{
+		"availability_zone":            aws.StringValue(apiObject.AvailabilityZone),
+		"dns_name_servers":             aws.StringValue(apiObject.DnsNameServers),
+		"kms_key_id":                   aws.StringValue(apiObject.KmsKeyId),
+		"max_capacity_units":           aws.Int64Value(apiObject.MaxCapacityUnits),
+		"min_capacity_units":           aws.Int64Value(apiObject.MinCapacityUnits),
+		"multi_az":                     aws.BoolValue(apiObject.MultiAZ),
+		"preferred_maintenance_window": aws.StringValue(apiObject.PreferredMaintenanceWindow),
+		"replication_subnet_group_id":  aws.StringValue(apiObject.ReplicationSubnetGroupId),
+		"vpc_security_group_ids":       flex.FlattenStringSet(apiObject.VpcSecurityGroupIds),
+	}
+
+	return []interface{}{tfMap}
+}
+
+func expandComputeConfigInput(tfMap map[string]interface{}) *dms.ComputeConfig {
+	if tfMap == nil {
+		return nil
+	}
+
+	apiObject := &dms.ComputeConfig{}
+
+	if v, ok := tfMap["availability_zone"].(string); ok && v != "" {
+		apiObject.AvailabilityZone = aws.String(v)
+	}
+
+	if v, ok := tfMap["dns_name_servers"].(string); ok && v != "" {
+		apiObject.DnsNameServers = aws.String(v)
+	}
+
+	if v, ok := tfMap["kms_key_id"].(string); ok && v != "" {
+		apiObject.KmsKeyId = aws.String(v)
+	}
+
+	if v, ok := tfMap["max_capacity_units"].(int); ok && v != 0 {
+		apiObject.MaxCapacityUnits = aws.Int64(int64(v))
+	}
+
+	if v, ok := tfMap["min_capacity_units"].(int); ok && v != 0 {
+		apiObject.MinCapacityUnits = aws.Int64(int64(v))
+	}
+
+	if v, ok := tfMap["multi_az"].(bool); ok {
+		apiObject.MultiAZ = aws.Bool(v)
+	}
+
+	if v, ok := tfMap["preferred_maintenance_window"].(string); ok && v != "" {
+		apiObject.PreferredMaintenanceWindow = aws.String(v)
+	}
+
+	if v, ok := tfMap["replication_subnet_group_id"].(string); ok && v != "" {
+		apiObject.ReplicationSubnetGroupId = aws.String(v)
+	}
+
+	if v, ok := tfMap["vpc_security_group_ids"].(*schema.Set); ok && v.Len() > 0 {
+		apiObject.VpcSecurityGroupIds = flex.ExpandStringSet(v)
+	}
+
+	return apiObject
+}
diff --git a/internal/service/dms/replication_config_test.go b/internal/service/dms/replication_config_test.go
new file mode 100644
index 00000000000..3f009e15b7b
--- /dev/null
+++ b/internal/service/dms/replication_config_test.go
@@ -0,0 +1,487 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package dms_test
+
+import (
+	"context"
+	"fmt"
+	"testing"
+
+	dms "github.com/aws/aws-sdk-go/service/databasemigrationservice"
+	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
+	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	tfdms "github.com/hashicorp/terraform-provider-aws/internal/service/dms"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+)
+
+func TestAccDMSReplicationConfig_basic(t *testing.T) {
+	ctx := acctest.Context(t)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_dms_replication_config.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, dms.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckReplicationConfigDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccReplicationConfig_basic(rName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckReplicationConfigExists(ctx, resourceName),
+					resource.TestCheckResourceAttrSet(resourceName, "arn"),
+					resource.TestCheckResourceAttr(resourceName, "compute_config.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "compute_config.0.availability_zone", ""),
+					resource.TestCheckResourceAttr(resourceName, "compute_config.0.dns_name_servers", ""),
+					resource.TestCheckResourceAttr(resourceName, "compute_config.0.kms_key_id", ""),
+					resource.TestCheckResourceAttr(resourceName, "compute_config.0.max_capacity_units", "128"),
+					resource.TestCheckResourceAttr(resourceName, "compute_config.0.min_capacity_units", "2"),
+					resource.TestCheckResourceAttr(resourceName, "compute_config.0.multi_az", "false"),
+					resource.TestCheckResourceAttr(resourceName, "compute_config.0.preferred_maintenance_window", "sun:23:45-mon:00:30"),
+					resource.TestCheckResourceAttrSet(resourceName, "compute_config.0.replication_subnet_group_id"),
+					resource.TestCheckResourceAttr(resourceName, "compute_config.0.vpc_security_group_ids.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "replication_config_identifier", rName),
+					resource.TestCheckResourceAttrSet(resourceName, "replication_settings"),
+					resource.TestCheckResourceAttr(resourceName, "replication_type", "cdc"),
+					resource.TestCheckNoResourceAttr(resourceName, "resource_identifier"),
+					resource.TestCheckResourceAttrSet(resourceName, "source_endpoint_arn"),
+					resource.TestCheckResourceAttr(resourceName, "start_replication", "false"),
+					resource.TestCheckResourceAttr(resourceName, "supplemental_settings", ""),
+					resource.TestCheckResourceAttrSet(resourceName, "table_mappings"),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
+					resource.TestCheckResourceAttrSet(resourceName, "target_endpoint_arn"),
+				),
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"start_replication", "resource_identifier"},
+			},
+		},
+	})
+}
+
+func TestAccDMSReplicationConfig_disappears(t *testing.T) {
+	ctx := acctest.Context(t)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_dms_replication_config.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, dms.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckReplicationConfigDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccReplicationConfig_basic(rName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckReplicationConfigExists(ctx, resourceName),
+					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfdms.ResourceReplicationConfig(), resourceName),
+				),
+				ExpectNonEmptyPlan: true,
+			},
+		},
+	})
+}
+
+func TestAccDMSReplicationConfig_tags(t *testing.T) {
+	ctx := acctest.Context(t)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_dms_replication_config.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, dms.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckReplicationConfigDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccReplicationConfig_tags1(rName, "key1", "value1"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckReplicationConfigExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
+				),
+			},
+			{
+				Config: testAccReplicationConfig_tags2(rName, "key1", "value1updated", "key2", "value2"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckReplicationConfigExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1updated"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
+				),
+			},
+			{
+				Config: testAccReplicationConfig_tags1(rName, "key2", "value2"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckReplicationConfigExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccDMSReplicationConfig_update(t *testing.T) {
+	ctx := acctest.Context(t)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_dms_replication_config.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, dms.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckReplicationConfigDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccReplicationConfig_update(rName, "cdc", 2, 16),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckReplicationConfigExists(ctx, resourceName),
+					resource.TestCheckResourceAttrSet(resourceName, "arn"),
+					resource.TestCheckResourceAttr(resourceName, "replication_type", "cdc"),
+					resource.TestCheckResourceAttr(resourceName, "compute_config.0.max_capacity_units", "16"),
+					resource.TestCheckResourceAttr(resourceName, "compute_config.0.min_capacity_units", "2"),
+				),
+			},
+			{
+				Config: testAccReplicationConfig_update(rName, "cdc", 4, 32),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckReplicationConfigExists(ctx, resourceName),
+					resource.TestCheckResourceAttrSet(resourceName, "arn"),
+					resource.TestCheckResourceAttr(resourceName, "replication_type", "cdc"),
+					resource.TestCheckResourceAttr(resourceName, "compute_config.0.max_capacity_units", "32"),
+					resource.TestCheckResourceAttr(resourceName, "compute_config.0.min_capacity_units", "4"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccDMSReplicationConfig_startReplication(t *testing.T) {
+	ctx := acctest.Context(t)
+
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_dms_replication_config.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, dms.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckReplicationConfigDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccReplicationConfig_startReplication(rName, true),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckReplicationConfigExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "start_replication", "true"),
+				),
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"start_replication", "resource_identifier"},
+			},
+			{
+				Config: testAccReplicationConfig_startReplication(rName, false),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckReplicationConfigExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "start_replication", "false"),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckReplicationConfigExists(ctx context.Context, n string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		conn := acctest.Provider.Meta().(*conns.AWSClient).DMSConn(ctx)
+
+		_, err := tfdms.FindReplicationConfigByARN(ctx, conn, rs.Primary.ID)
+
+		return err
+	}
+}
+
+func testAccCheckReplicationConfigDestroy(ctx context.Context) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		for _, rs := range s.RootModule().Resources {
+			if rs.Type != "aws_dms_replication_config" {
+				continue
+			}
+
+			conn := acctest.Provider.Meta().(*conns.AWSClient).DMSConn(ctx)
+
+			_, err := tfdms.FindReplicationConfigByARN(ctx, conn, rs.Primary.ID)
+
+			if tfresource.NotFound(err) {
+				continue
+			}
+
+			if err != nil {
+				return err
+			}
+
+			return fmt.Errorf("DMS Replication Config %s still exists", rs.Primary.ID)
+		}
+
+		return nil
+	}
+}
+
+func testAccReplicationConfig_base(rName string) string {
+	return acctest.ConfigCompose(acctest.ConfigVPCWithSubnets(rName, 2), fmt.Sprintf(`
+resource "aws_dms_replication_subnet_group" "test" {
+  replication_subnet_group_id          = %[1]q
+  replication_subnet_group_description = "terraform test"
+  subnet_ids                           = aws_subnet.test[*].id
+}
+
+resource "aws_db_subnet_group" "test" {
+  name       = %[1]q
+  subnet_ids = aws_subnet.test[*].id
+}
+
+resource "aws_security_group" "test" {
+  name   = %[1]q
+  vpc_id = aws_vpc.test.id
+
+  ingress {
+    from_port   = 0
+    to_port     = 0
+    protocol    = -1
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+
+  egress {
+    from_port   = 0
+    to_port     = 0
+    protocol    = "-1"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+
+  tags = {
+    Name = %[1]q
+  }
+}
+
+data "aws_rds_engine_version" "default" {
+  engine = "aurora-mysql"
+}
+
+data "aws_rds_orderable_db_instance" "test" {
+  engine                     = data.aws_rds_engine_version.default.engine
+  engine_version             = data.aws_rds_engine_version.default.version
+  preferred_instance_classes = ["db.t3.small", "db.t3.medium", "db.t3.large"]
+}
+
+resource "aws_rds_cluster_parameter_group" "test" {
+  name        = "%[1]s-pg-cluster"
+  family      = data.aws_rds_engine_version.default.parameter_group_family
+  description = "DMS cluster parameter group"
+
+  parameter {
+    name         = "binlog_format"
+    value        = "ROW"
+    apply_method = "pending-reboot"
+  }
+
+  parameter {
+    name         = "binlog_row_image"
+    value        = "Full"
+    apply_method = "pending-reboot"
+  }
+
+  parameter {
+    name         = "binlog_checksum"
+    value        = "NONE"
+    apply_method = "pending-reboot"
+  }
+}
+
+resource "aws_rds_cluster" "source" {
+  cluster_identifier              = "%[1]s-aurora-cluster-source"
+  engine                          = data.aws_rds_orderable_db_instance.test.engine
+  engine_version                  = data.aws_rds_orderable_db_instance.test.engine_version
+  database_name                   = "tftest"
+  master_username                 = "tftest"
+  master_password                 = "mustbeeightcharaters"
+  skip_final_snapshot             = true
+  vpc_security_group_ids          = [aws_security_group.test.id]
+  db_subnet_group_name            = aws_db_subnet_group.test.name
+  db_cluster_parameter_group_name = aws_rds_cluster_parameter_group.test.name
+}
+
+resource "aws_rds_cluster_instance" "source" {
+  identifier           = "%[1]s-source-primary"
+  cluster_identifier   = aws_rds_cluster.source.id
+  engine               = data.aws_rds_orderable_db_instance.test.engine
+  engine_version       = data.aws_rds_orderable_db_instance.test.engine_version
+  instance_class       = data.aws_rds_orderable_db_instance.test.instance_class
+  db_subnet_group_name = aws_db_subnet_group.test.name
+}
+
+resource "aws_rds_cluster" "target" {
+  cluster_identifier     = "%[1]s-aurora-cluster-target"
+  engine                 = data.aws_rds_orderable_db_instance.test.engine
+  engine_version         = data.aws_rds_orderable_db_instance.test.engine_version
+  database_name          = "tftest"
+  master_username        = "tftest"
+  master_password        = "mustbeeightcharaters"
+  skip_final_snapshot    = true
+  vpc_security_group_ids = [aws_security_group.test.id]
+  db_subnet_group_name   = aws_db_subnet_group.test.name
+}
+
+resource "aws_rds_cluster_instance" "target" {
+  identifier           = "%[1]s-target-primary"
+  cluster_identifier   = aws_rds_cluster.target.id
+  engine               = data.aws_rds_orderable_db_instance.test.engine
+  engine_version       = data.aws_rds_orderable_db_instance.test.engine_version
+  instance_class       = data.aws_rds_orderable_db_instance.test.instance_class
+  db_subnet_group_name = aws_db_subnet_group.test.name
+}
+
+resource "aws_dms_endpoint" "target" {
+  database_name = "tftest"
+  endpoint_id   = "%[1]s-target"
+  endpoint_type = "target"
+  engine_name   = "aurora"
+  server_name   = aws_rds_cluster.target.endpoint
+  port          = 3306
+  username      = "tftest"
+  password      = "mustbeeightcharaters"
+}
+
+resource "aws_dms_endpoint" "source" {
+  database_name = "tftest"
+  endpoint_id   = "%[1]s-source"
+  endpoint_type = "source"
+  engine_name   = "aurora"
+  server_name   = aws_rds_cluster.source.endpoint
+  port          = 3306
+  username      = "tftest"
+  password      = "mustbeeightcharaters"
+}
+`, rName))
+}
+
+func testAccReplicationConfig_basic(rName string) string {
+	return acctest.ConfigCompose(testAccReplicationConfig_base(rName), fmt.Sprintf(`
+resource "aws_dms_replication_config" "test" {
+  replication_config_identifier = %[1]q
+  replication_type              = "cdc"
+  source_endpoint_arn           = aws_dms_endpoint.source.endpoint_arn
+  target_endpoint_arn           = aws_dms_endpoint.target.endpoint_arn
+  table_mappings                = "{\"rules\":[{\"rule-type\":\"selection\",\"rule-id\":\"1\",\"rule-name\":\"1\",\"object-locator\":{\"schema-name\":\"%%\",\"table-name\":\"%%\"},\"rule-action\":\"include\"}]}"
+
+  compute_config {
+    replication_subnet_group_id  = aws_dms_replication_subnet_group.test.replication_subnet_group_id
+    max_capacity_units           = "128"
+    min_capacity_units           = "2"
+    preferred_maintenance_window = "sun:23:45-mon:00:30"
+  }
+}
+`, rName))
+}
+
+func testAccReplicationConfig_update(rName, replicationType string, minCapacity, maxCapacity int) string {
+	return acctest.ConfigCompose(testAccReplicationConfig_base(rName), fmt.Sprintf(`
+resource "aws_dms_replication_config" "test" {
+  replication_config_identifier = %[1]q
+  resource_identifier           = %[1]q
+  replication_type              = %[2]q
+  source_endpoint_arn           = aws_dms_endpoint.source.endpoint_arn
+  target_endpoint_arn           = aws_dms_endpoint.target.endpoint_arn
+  table_mappings                = "{\"rules\":[{\"rule-type\":\"selection\",\"rule-id\":\"1\",\"rule-name\":\"1\",\"object-locator\":{\"schema-name\":\"%%\",\"table-name\":\"%%\"},\"rule-action\":\"include\"}]}"
+
+  compute_config {
+    replication_subnet_group_id  = aws_dms_replication_subnet_group.test.replication_subnet_group_id
+    max_capacity_units           = "%[3]d"
+    min_capacity_units           = "%[4]d"
+    preferred_maintenance_window = "sun:23:45-mon:00:30"
+  }
+}
+`, rName, replicationType, maxCapacity, minCapacity))
+}
+
+func testAccReplicationConfig_startReplication(rName string, start bool) string {
+	return acctest.ConfigCompose(testAccReplicationConfig_base(rName), fmt.Sprintf(`
+resource "aws_dms_replication_config" "test" {
+  replication_config_identifier = %[1]q
+  resource_identifier           = %[1]q
+  replication_type              = "cdc"
+  source_endpoint_arn           = aws_dms_endpoint.source.endpoint_arn
+  target_endpoint_arn           = aws_dms_endpoint.target.endpoint_arn
+  table_mappings                = "{\"rules\":[{\"rule-type\":\"selection\",\"rule-id\":\"1\",\"rule-name\":\"1\",\"object-locator\":{\"schema-name\":\"%%\",\"table-name\":\"%%\"},\"rule-action\":\"include\"}]}"
+
+  start_replication = %[2]t
+
+  compute_config {
+    replication_subnet_group_id  = aws_dms_replication_subnet_group.test.replication_subnet_group_id
+    max_capacity_units           = "128"
+    min_capacity_units           = "2"
+    preferred_maintenance_window = "sun:23:45-mon:00:30"
+  }
+}
+`, rName, start))
+}
+
+func testAccReplicationConfig_tags1(rName, tagKey1, tagValue1 string) string {
+	return acctest.ConfigCompose(testAccReplicationConfig_base(rName), fmt.Sprintf(`
+resource "aws_dms_replication_config" "test" {
+  replication_config_identifier = %[1]q
+  replication_type              = "cdc"
+  source_endpoint_arn           = aws_dms_endpoint.source.endpoint_arn
+  target_endpoint_arn           = aws_dms_endpoint.target.endpoint_arn
+  table_mappings                = "{\"rules\":[{\"rule-type\":\"selection\",\"rule-id\":\"1\",\"rule-name\":\"1\",\"object-locator\":{\"schema-name\":\"%%\",\"table-name\":\"%%\"},\"rule-action\":\"include\"}]}"
+
+  compute_config {
+    replication_subnet_group_id  = aws_dms_replication_subnet_group.test.replication_subnet_group_id
+    max_capacity_units           = "128"
+    min_capacity_units           = "2"
+    preferred_maintenance_window = "sun:23:45-mon:00:30"
+  }
+
+  tags = {
+    %[2]q = %[3]q
+  }
+}
+`, rName, tagKey1, tagValue1))
+}
+
+func testAccReplicationConfig_tags2(rName, tagKey1, tagValue1, tagKey2, tagValue2 string) string {
+	return acctest.ConfigCompose(testAccReplicationConfig_base(rName), fmt.Sprintf(`
+resource "aws_dms_replication_config" "test" {
+  replication_config_identifier = %[1]q
+  replication_type              = "cdc"
+  source_endpoint_arn           = aws_dms_endpoint.source.endpoint_arn
+  target_endpoint_arn           = aws_dms_endpoint.target.endpoint_arn
+  table_mappings                = "{\"rules\":[{\"rule-type\":\"selection\",\"rule-id\":\"1\",\"rule-name\":\"1\",\"object-locator\":{\"schema-name\":\"%%\",\"table-name\":\"%%\"},\"rule-action\":\"include\"}]}"
+
+  compute_config {
+    replication_subnet_group_id  = aws_dms_replication_subnet_group.test.replication_subnet_group_id
+    max_capacity_units           = "128"
+    min_capacity_units           = "2"
+    preferred_maintenance_window = "sun:23:45-mon:00:30"
+  }
+
+  tags = {
+    %[2]q = %[3]q
+    %[4]q = %[5]q
+  }
+}
+`, rName, tagKey1, tagValue1, tagKey2, tagValue2))
+}
diff --git a/internal/service/dms/replication_instance.go b/internal/service/dms/replication_instance.go
index cd2093be4f6..45ff5993543 100644
--- a/internal/service/dms/replication_instance.go
+++ b/internal/service/dms/replication_instance.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package dms
 
 import (
@@ -15,7 +18,9 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
 	"github.com/hashicorp/terraform-provider-aws/internal/flex"
+	tfslices "github.com/hashicorp/terraform-provider-aws/internal/slices"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -42,8 +47,8 @@ func ResourceReplicationInstance() *schema.Resource {
 		Schema: map[string]*schema.Schema{
 			"allocated_storage": {
 				Type:         schema.TypeInt,
-				Computed:     true,
 				Optional:     true,
+				Computed:     true,
 				ValidateFunc: validation.IntBetween(5, 6144),
 			},
 			"allow_major_version_upgrade": {
@@ -56,13 +61,13 @@ func ResourceReplicationInstance() *schema.Resource {
 			},
 			"auto_minor_version_upgrade": {
 				Type:     schema.TypeBool,
-				Computed: true,
 				Optional: true,
+				Computed: true,
 			},
 			"availability_zone": {
 				Type:     schema.TypeString,
-				Computed: true,
 				Optional: true,
+				Computed: true,
 				ForceNew: true,
 			},
 			"engine_version": {
@@ -72,26 +77,32 @@ func ResourceReplicationInstance() *schema.Resource {
 			},
 			"kms_key_arn": {
 				Type:         schema.TypeString,
-				Computed:     true,
 				Optional:     true,
+				Computed:     true,
 				ForceNew:     true,
 				ValidateFunc: verify.ValidARN,
 			},
 			"multi_az": {
 				Type:     schema.TypeBool,
-				Computed: true,
 				Optional: true,
+				Computed: true,
 			},
-			"preferred_maintenance_window": {
+			"network_type": {
 				Type:         schema.TypeString,
+				Optional:     true,
 				Computed:     true,
+				ValidateFunc: validation.StringInSlice(networkType_Values(), false),
+			},
+			"preferred_maintenance_window": {
+				Type:         schema.TypeString,
 				Optional:     true,
+				Computed:     true,
 				ValidateFunc: verify.ValidOnceAWeekWindowFormat,
 			},
 			"publicly_accessible": {
 				Type:     schema.TypeBool,
-				Computed: true,
 				Optional: true,
+				Computed: true,
 				ForceNew: true,
 			},
 			"replication_instance_arn": {
@@ -112,28 +123,27 @@ func ResourceReplicationInstance() *schema.Resource {
 			},
 			"replication_instance_private_ips": {
 				Type:     schema.TypeList,
-				Elem:     &schema.Schema{Type: schema.TypeString},
 				Computed: true,
+				Elem:     &schema.Schema{Type: schema.TypeString},
 			},
 			"replication_instance_public_ips": {
 				Type:     schema.TypeList,
-				Elem:     &schema.Schema{Type: schema.TypeString},
 				Computed: true,
+				Elem:     &schema.Schema{Type: schema.TypeString},
 			},
 			"replication_subnet_group_id": {
 				Type:     schema.TypeString,
-				Computed: true,
 				Optional: true,
+				Computed: true,
 				ForceNew: true,
 			},
 			names.AttrTags:    tftags.TagsSchema(),
 			names.AttrTagsAll: tftags.TagsSchemaComputed(),
 			"vpc_security_group_ids": {
 				Type:     schema.TypeSet,
-				Elem:     &schema.Schema{Type: schema.TypeString},
-				Set:      schema.HashString,
-				Computed: true,
 				Optional: true,
+				Computed: true,
+				Elem:     &schema.Schema{Type: schema.TypeString},
 			},
 		},
 
@@ -145,12 +155,13 @@ func resourceReplicationInstanceCreate(ctx context.Context, d *schema.ResourceDa
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).DMSConn(ctx)
 
-	request := &dms.CreateReplicationInstanceInput{
+	replicationInstanceID := d.Get("replication_instance_id").(string)
+	input := &dms.CreateReplicationInstanceInput{
 		AutoMinorVersionUpgrade:       aws.Bool(d.Get("auto_minor_version_upgrade").(bool)),
 		PubliclyAccessible:            aws.Bool(d.Get("publicly_accessible").(bool)),
 		MultiAZ:                       aws.Bool(d.Get("multi_az").(bool)),
 		ReplicationInstanceClass:      aws.String(d.Get("replication_instance_class").(string)),
-		ReplicationInstanceIdentifier: aws.String(d.Get("replication_instance_id").(string)),
+		ReplicationInstanceIdentifier: aws.String(replicationInstanceID),
 		Tags:                          getTagsIn(ctx),
 	}
 
@@ -159,49 +170,40 @@ func resourceReplicationInstanceCreate(ctx context.Context, d *schema.ResourceDa
 	// to set the default value. See GitHub Issue #5694 https://github.com/hashicorp/terraform/issues/5694
 
 	if v, ok := d.GetOk("allocated_storage"); ok {
-		request.AllocatedStorage = aws.Int64(int64(v.(int)))
+		input.AllocatedStorage = aws.Int64(int64(v.(int)))
 	}
 	if v, ok := d.GetOk("availability_zone"); ok {
-		request.AvailabilityZone = aws.String(v.(string))
+		input.AvailabilityZone = aws.String(v.(string))
 	}
 	if v, ok := d.GetOk("engine_version"); ok {
-		request.EngineVersion = aws.String(v.(string))
+		input.EngineVersion = aws.String(v.(string))
 	}
 	if v, ok := d.GetOk("kms_key_arn"); ok {
-		request.KmsKeyId = aws.String(v.(string))
+		input.KmsKeyId = aws.String(v.(string))
+	}
+	if v, ok := d.GetOk("network_type"); ok {
+		input.NetworkType = aws.String(v.(string))
 	}
 	if v, ok := d.GetOk("preferred_maintenance_window"); ok {
-		request.PreferredMaintenanceWindow = aws.String(v.(string))
+		input.PreferredMaintenanceWindow = aws.String(v.(string))
 	}
 	if v, ok := d.GetOk("replication_subnet_group_id"); ok {
-		request.ReplicationSubnetGroupIdentifier = aws.String(v.(string))
+		input.ReplicationSubnetGroupIdentifier = aws.String(v.(string))
 	}
 	if v, ok := d.GetOk("vpc_security_group_ids"); ok {
-		request.VpcSecurityGroupIds = flex.ExpandStringSet(v.(*schema.Set))
+		input.VpcSecurityGroupIds = flex.ExpandStringSet(v.(*schema.Set))
 	}
 
-	log.Println("[DEBUG] DMS create replication instance:", request)
+	_, err := conn.CreateReplicationInstanceWithContext(ctx, input)
 
-	_, err := conn.CreateReplicationInstanceWithContext(ctx, request)
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "creating DMS Replication Instance: %s", err)
+		return sdkdiag.AppendErrorf(diags, "creating DMS Replication Instance (%s): %s", replicationInstanceID, err)
 	}
 
-	d.SetId(d.Get("replication_instance_id").(string))
+	d.SetId(replicationInstanceID)
 
-	stateConf := &retry.StateChangeConf{
-		Pending:    []string{"creating", "modifying"},
-		Target:     []string{"available"},
-		Refresh:    resourceReplicationInstanceStateRefreshFunc(ctx, conn, d.Id()),
-		Timeout:    d.Timeout(schema.TimeoutCreate),
-		MinTimeout: 10 * time.Second,
-		Delay:      30 * time.Second, // Wait 30 secs before starting
-	}
-
-	// Wait, catching any errors
-	_, err = stateConf.WaitForStateContext(ctx)
-	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "waiting for DMS Replication Instance (%s) creation: %s", d.Id(), err)
+	if _, err := waitReplicationInstanceCreated(ctx, conn, d.Id(), d.Timeout(schema.TimeoutCreate)); err != nil {
+		return sdkdiag.AppendErrorf(diags, "waiting for DMS Replication Instance (%s) create: %s", d.Id(), err)
 	}
 
 	return append(diags, resourceReplicationInstanceRead(ctx, d, meta)...)
@@ -211,63 +213,37 @@ func resourceReplicationInstanceRead(ctx context.Context, d *schema.ResourceData
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).DMSConn(ctx)
 
-	response, err := conn.DescribeReplicationInstancesWithContext(ctx, &dms.DescribeReplicationInstancesInput{
-		Filters: []*dms.Filter{
-			{
-				Name:   aws.String("replication-instance-id"),
-				Values: []*string{aws.String(d.Id())}, // Must use d.Id() to work with import.
-			},
-		},
-	})
+	instance, err := FindReplicationInstanceByID(ctx, conn, d.Id())
 
-	if tfawserr.ErrCodeEquals(err, dms.ErrCodeResourceNotFoundFault) {
+	if !d.IsNewResource() && tfresource.NotFound(err) {
 		log.Printf("[WARN] DMS Replication Instance (%s) not found, removing from state", d.Id())
 		d.SetId("")
-		return diags
+		return nil
 	}
 
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "describing DMS Replication Instance (%s): %s", d.Id(), err)
-	}
-
-	if response == nil || len(response.ReplicationInstances) == 0 || response.ReplicationInstances[0] == nil {
-		log.Printf("[WARN] DMS Replication Instance (%s) not found, removing from state", d.Id())
-		d.SetId("")
-		return diags
+		return sdkdiag.AppendErrorf(diags, "reading DMS Replication Instance (%s): %s", d.Id(), err)
 	}
 
-	instance := response.ReplicationInstances[0]
-
 	d.Set("allocated_storage", instance.AllocatedStorage)
 	d.Set("auto_minor_version_upgrade", instance.AutoMinorVersionUpgrade)
 	d.Set("availability_zone", instance.AvailabilityZone)
 	d.Set("engine_version", instance.EngineVersion)
 	d.Set("kms_key_arn", instance.KmsKeyId)
 	d.Set("multi_az", instance.MultiAZ)
+	d.Set("network_type", instance.NetworkType)
 	d.Set("preferred_maintenance_window", instance.PreferredMaintenanceWindow)
 	d.Set("publicly_accessible", instance.PubliclyAccessible)
 	d.Set("replication_instance_arn", instance.ReplicationInstanceArn)
 	d.Set("replication_instance_class", instance.ReplicationInstanceClass)
 	d.Set("replication_instance_id", instance.ReplicationInstanceIdentifier)
-
-	if err := d.Set("replication_instance_private_ips", aws.StringValueSlice(instance.ReplicationInstancePrivateIpAddresses)); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting replication_instance_private_ips: %s", err)
-	}
-
-	if err := d.Set("replication_instance_public_ips", aws.StringValueSlice(instance.ReplicationInstancePublicIpAddresses)); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting replication_instance_private_ips: %s", err)
-	}
-
+	d.Set("replication_instance_private_ips", aws.StringValueSlice(instance.ReplicationInstancePrivateIpAddresses))
+	d.Set("replication_instance_public_ips", aws.StringValueSlice(instance.ReplicationInstancePublicIpAddresses))
 	d.Set("replication_subnet_group_id", instance.ReplicationSubnetGroup.ReplicationSubnetGroupIdentifier)
-
-	vpc_security_group_ids := []string{}
-	for _, sg := range instance.VpcSecurityGroups {
-		vpc_security_group_ids = append(vpc_security_group_ids, aws.StringValue(sg.VpcSecurityGroupId))
-	}
-
-	if err := d.Set("vpc_security_group_ids", vpc_security_group_ids); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting vpc_security_group_ids: %s", err)
-	}
+	vpcSecurityGroupIDs := tfslices.ApplyToAll(instance.VpcSecurityGroups, func(sg *dms.VpcSecurityGroupMembership) string {
+		return aws.StringValue(sg.VpcSecurityGroupId)
+	})
+	d.Set("vpc_security_group_ids", vpcSecurityGroupIDs)
 
 	return diags
 }
@@ -276,80 +252,55 @@ func resourceReplicationInstanceUpdate(ctx context.Context, d *schema.ResourceDa
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).DMSConn(ctx)
 
-	request := &dms.ModifyReplicationInstanceInput{
-		ApplyImmediately:       aws.Bool(d.Get("apply_immediately").(bool)),
-		ReplicationInstanceArn: aws.String(d.Get("replication_instance_arn").(string)),
-	}
-	hasChanges := false
-
-	if d.HasChange("auto_minor_version_upgrade") {
-		request.AutoMinorVersionUpgrade = aws.Bool(d.Get("auto_minor_version_upgrade").(bool))
-		hasChanges = true
-	}
-
-	if d.HasChange("allocated_storage") {
-		if v, ok := d.GetOk("allocated_storage"); ok {
-			request.AllocatedStorage = aws.Int64(int64(v.(int)))
-			hasChanges = true
-		}
-	}
-
-	if v, ok := d.GetOk("allow_major_version_upgrade"); ok {
-		request.AllowMajorVersionUpgrade = aws.Bool(v.(bool))
+	if d.HasChangesExcept("tags", "tags_all", "allow_major_version_upgrade") {
 		// Having allowing_major_version_upgrade by itself should not trigger ModifyReplicationInstance
 		// as it results in InvalidParameterCombination: No modifications were requested
-	}
+		input := &dms.ModifyReplicationInstanceInput{
+			AllowMajorVersionUpgrade: aws.Bool(d.Get("allow_major_version_upgrade").(bool)),
+			ApplyImmediately:         aws.Bool(d.Get("apply_immediately").(bool)),
+			ReplicationInstanceArn:   aws.String(d.Get("replication_instance_arn").(string)),
+		}
 
-	if d.HasChange("engine_version") {
-		if v, ok := d.GetOk("engine_version"); ok {
-			request.EngineVersion = aws.String(v.(string))
-			hasChanges = true
+		if d.HasChange("allocated_storage") {
+			input.AllocatedStorage = aws.Int64(int64(d.Get("allocated_storage").(int)))
 		}
-	}
 
-	if d.HasChange("multi_az") {
-		request.MultiAZ = aws.Bool(d.Get("multi_az").(bool))
-		hasChanges = true
-	}
+		if d.HasChange("auto_minor_version_upgrade") {
+			input.AutoMinorVersionUpgrade = aws.Bool(d.Get("auto_minor_version_upgrade").(bool))
+		}
 
-	if d.HasChange("preferred_maintenance_window") {
-		if v, ok := d.GetOk("preferred_maintenance_window"); ok {
-			request.PreferredMaintenanceWindow = aws.String(v.(string))
-			hasChanges = true
+		if d.HasChange("engine_version") {
+			input.EngineVersion = aws.String(d.Get("engine_version").(string))
 		}
-	}
 
-	if d.HasChange("replication_instance_class") {
-		request.ReplicationInstanceClass = aws.String(d.Get("replication_instance_class").(string))
-		hasChanges = true
-	}
+		if d.HasChange("multi_az") {
+			input.MultiAZ = aws.Bool(d.Get("multi_az").(bool))
+		}
 
-	if d.HasChange("vpc_security_group_ids") {
-		if v, ok := d.GetOk("vpc_security_group_ids"); ok {
-			request.VpcSecurityGroupIds = flex.ExpandStringSet(v.(*schema.Set))
-			hasChanges = true
+		if d.HasChange("network_type") {
+			input.NetworkType = aws.String(d.Get("network_type").(string))
 		}
-	}
 
-	if hasChanges {
-		_, err := conn.ModifyReplicationInstanceWithContext(ctx, request)
-		if err != nil {
-			return sdkdiag.AppendErrorf(diags, "modifying DMS Replication Instance (%s): %s", d.Id(), err)
+		if d.HasChange("preferred_maintenance_window") {
+			input.PreferredMaintenanceWindow = aws.String(d.Get("preferred_maintenance_window").(string))
+		}
+
+		if d.HasChange("replication_instance_class") {
+			input.ReplicationInstanceClass = aws.String(d.Get("replication_instance_class").(string))
 		}
 
-		stateConf := &retry.StateChangeConf{
-			Pending:    []string{"modifying", "upgrading"},
-			Target:     []string{"available"},
-			Refresh:    resourceReplicationInstanceStateRefreshFunc(ctx, conn, d.Id()),
-			Timeout:    d.Timeout(schema.TimeoutUpdate),
-			MinTimeout: 10 * time.Second,
-			Delay:      30 * time.Second, // Wait 30 secs before starting
+		if d.HasChange("vpc_security_group_ids") {
+			input.VpcSecurityGroupIds = flex.ExpandStringSet(d.Get("vpc_security_group_ids").(*schema.Set))
 		}
 
-		// Wait, catching any errors
-		_, err = stateConf.WaitForStateContext(ctx)
+		_, err := conn.ModifyReplicationInstanceWithContext(ctx, input)
+
 		if err != nil {
-			return sdkdiag.AppendErrorf(diags, "waiting for DMS Replication Instance (%s) modification: %s", d.Id(), err)
+			return sdkdiag.AppendErrorf(diags, "updating DMS Replication Instance (%s): %s", d.Id(), err)
+		}
+
+		if _, err := waitReplicationInstanceUpdated(ctx, conn, d.Id(), d.Timeout(schema.TimeoutUpdate)); err != nil {
+			return sdkdiag.AppendErrorf(diags, "waiting for DMS Replication Instance (%s) update: %s", d.Id(), err)
 		}
 	}
 
@@ -360,13 +311,10 @@ func resourceReplicationInstanceDelete(ctx context.Context, d *schema.ResourceDa
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).DMSConn(ctx)
 
-	request := &dms.DeleteReplicationInstanceInput{
+	log.Printf("[DEBUG] Deleting DMS Replication Instance: %s", d.Id())
+	_, err := conn.DeleteReplicationInstanceWithContext(ctx, &dms.DeleteReplicationInstanceInput{
 		ReplicationInstanceArn: aws.String(d.Get("replication_instance_arn").(string)),
-	}
-
-	log.Printf("[DEBUG] DMS delete replication instance: %#v", request)
-
-	_, err := conn.DeleteReplicationInstanceWithContext(ctx, request)
+	})
 
 	if tfawserr.ErrCodeEquals(err, dms.ErrCodeResourceNotFoundFault) {
 		return diags
@@ -376,36 +324,72 @@ func resourceReplicationInstanceDelete(ctx context.Context, d *schema.ResourceDa
 		return sdkdiag.AppendErrorf(diags, "deleting DMS Replication Instance (%s): %s", d.Id(), err)
 	}
 
-	stateConf := &retry.StateChangeConf{
-		Pending:    []string{"deleting"},
-		Target:     []string{},
-		Refresh:    resourceReplicationInstanceStateRefreshFunc(ctx, conn, d.Id()),
-		Timeout:    d.Timeout(schema.TimeoutDelete),
-		MinTimeout: 10 * time.Second,
-		Delay:      30 * time.Second, // Wait 30 secs before starting
+	if _, err := waitReplicationInstanceDeleted(ctx, conn, d.Id(), d.Timeout(schema.TimeoutDelete)); err != nil {
+		return sdkdiag.AppendErrorf(diags, "waiting for DMS Replication Instance (%s) delete: %s", d.Id(), err)
 	}
 
-	// Wait, catching any errors
-	_, err = stateConf.WaitForStateContext(ctx)
+	return diags
+}
+
+func FindReplicationInstanceByID(ctx context.Context, conn *dms.DatabaseMigrationService, id string) (*dms.ReplicationInstance, error) {
+	input := &dms.DescribeReplicationInstancesInput{
+		Filters: []*dms.Filter{
+			{
+				Name:   aws.String("replication-instance-id"),
+				Values: aws.StringSlice([]string{id}),
+			},
+		},
+	}
+
+	return findReplicationInstance(ctx, conn, input)
+}
+
+func findReplicationInstance(ctx context.Context, conn *dms.DatabaseMigrationService, input *dms.DescribeReplicationInstancesInput) (*dms.ReplicationInstance, error) {
+	output, err := findReplicationInstances(ctx, conn, input)
+
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "waiting for DMS Replication Instance (%s) deletion: %s", d.Id(), err)
+		return nil, err
 	}
 
-	return diags
+	return tfresource.AssertSinglePtrResult(output)
 }
 
-func resourceReplicationInstanceStateRefreshFunc(ctx context.Context, conn *dms.DatabaseMigrationService, replicationInstanceID string) retry.StateRefreshFunc {
+func findReplicationInstances(ctx context.Context, conn *dms.DatabaseMigrationService, input *dms.DescribeReplicationInstancesInput) ([]*dms.ReplicationInstance, error) {
+	var output []*dms.ReplicationInstance
+
+	err := conn.DescribeReplicationInstancesPagesWithContext(ctx, input, func(page *dms.DescribeReplicationInstancesOutput, lastPage bool) bool {
+		if page == nil {
+			return !lastPage
+		}
+
+		for _, v := range page.ReplicationInstances {
+			if v != nil {
+				output = append(output, v)
+			}
+		}
+
+		return !lastPage
+	})
+
+	if tfawserr.ErrCodeEquals(err, dms.ErrCodeResourceNotFoundFault) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	return output, nil
+}
+
+func statusReplicationInstance(ctx context.Context, conn *dms.DatabaseMigrationService, id string) retry.StateRefreshFunc {
 	return func() (interface{}, string, error) {
-		v, err := conn.DescribeReplicationInstancesWithContext(ctx, &dms.DescribeReplicationInstancesInput{
-			Filters: []*dms.Filter{
-				{
-					Name:   aws.String("replication-instance-id"),
-					Values: []*string{aws.String(replicationInstanceID)},
-				},
-			},
-		})
+		output, err := FindReplicationInstanceByID(ctx, conn, id)
 
-		if tfawserr.ErrCodeEquals(err, dms.ErrCodeResourceNotFoundFault) {
+		if tfresource.NotFound(err) {
 			return nil, "", nil
 		}
 
@@ -413,10 +397,63 @@ func resourceReplicationInstanceStateRefreshFunc(ctx context.Context, conn *dms.
 			return nil, "", err
 		}
 
-		if v == nil || len(v.ReplicationInstances) == 0 || v.ReplicationInstances[0] == nil {
-			return nil, "", nil
-		}
+		return output, aws.StringValue(output.ReplicationInstanceStatus), nil
+	}
+}
+
+func waitReplicationInstanceCreated(ctx context.Context, conn *dms.DatabaseMigrationService, id string, timeout time.Duration) (*dms.ReplicationInstance, error) {
+	stateConf := &retry.StateChangeConf{
+		Pending:    []string{replicationInstanceStatusCreating, replicationInstanceStatusModifying},
+		Target:     []string{replicationInstanceStatusAvailable},
+		Refresh:    statusReplicationInstance(ctx, conn, id),
+		Timeout:    timeout,
+		MinTimeout: 10 * time.Second,
+		Delay:      30 * time.Second, // Wait 30 secs before starting
+	}
+
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+
+	if output, ok := outputRaw.(*dms.ReplicationInstance); ok {
+		return output, err
+	}
+
+	return nil, err
+}
+
+func waitReplicationInstanceUpdated(ctx context.Context, conn *dms.DatabaseMigrationService, id string, timeout time.Duration) (*dms.ReplicationInstance, error) {
+	stateConf := &retry.StateChangeConf{
+		Pending:    []string{replicationInstanceStatusModifying, replicationInstanceStatusUpgrading},
+		Target:     []string{replicationInstanceStatusAvailable},
+		Refresh:    statusReplicationInstance(ctx, conn, id),
+		Timeout:    timeout,
+		MinTimeout: 10 * time.Second,
+		Delay:      30 * time.Second, // Wait 30 secs before starting
+	}
+
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
 
-		return v, aws.StringValue(v.ReplicationInstances[0].ReplicationInstanceStatus), nil
+	if output, ok := outputRaw.(*dms.ReplicationInstance); ok {
+		return output, err
 	}
+
+	return nil, err
+}
+
+func waitReplicationInstanceDeleted(ctx context.Context, conn *dms.DatabaseMigrationService, id string, timeout time.Duration) (*dms.ReplicationInstance, error) {
+	stateConf := &retry.StateChangeConf{
+		Pending:    []string{replicationInstanceStatusDeleting},
+		Target:     []string{},
+		Refresh:    statusReplicationInstance(ctx, conn, id),
+		Timeout:    timeout,
+		MinTimeout: 10 * time.Second,
+		Delay:      30 * time.Second, // Wait 30 secs before starting
+	}
+
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+
+	if output, ok := outputRaw.(*dms.ReplicationInstance); ok {
+		return output, err
+	}
+
+	return nil, err
 }
diff --git a/internal/service/dms/replication_instance_data_source.go b/internal/service/dms/replication_instance_data_source.go
index 0554dd36fb9..be5b3514ec3 100644
--- a/internal/service/dms/replication_instance_data_source.go
+++ b/internal/service/dms/replication_instance_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package dms
 
 import (
@@ -8,10 +11,9 @@ import (
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
-	"github.com/hashicorp/terraform-provider-aws/internal/create"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
+	tfslices "github.com/hashicorp/terraform-provider-aws/internal/slices"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
-	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
-	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
 // @SDKDataSource("aws_dms_replication_instance")
@@ -24,14 +26,6 @@ func DataSourceReplicationInstance() *schema.Resource {
 				Type:     schema.TypeInt,
 				Computed: true,
 			},
-			"allow_major_version_upgrade": {
-				Type:     schema.TypeBool,
-				Computed: true,
-			},
-			"apply_immediately": {
-				Type:     schema.TypeBool,
-				Computed: true,
-			},
 			"auto_minor_version_upgrade": {
 				Type:     schema.TypeBool,
 				Computed: true,
@@ -52,6 +46,10 @@ func DataSourceReplicationInstance() *schema.Resource {
 				Type:     schema.TypeBool,
 				Computed: true,
 			},
+			"network_type": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
 			"preferred_maintenance_window": {
 				Type:     schema.TypeString,
 				Computed: true,
@@ -86,80 +84,64 @@ func DataSourceReplicationInstance() *schema.Resource {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
+			"tags": tftags.TagsSchemaComputed(),
 			"vpc_security_group_ids": {
 				Type:     schema.TypeSet,
 				Elem:     &schema.Schema{Type: schema.TypeString},
 				Set:      schema.HashString,
 				Computed: true,
 			},
-			"tags": tftags.TagsSchemaComputed(),
 		},
 	}
 }
 
-const (
-	DSNameReplicationInstance = "Replication Instance Data Source"
-)
-
 func dataSourceReplicationInstanceRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).DMSConn(ctx)
 	defaultTagsConfig := meta.(*conns.AWSClient).DefaultTagsConfig
 	ignoreTagsConfig := meta.(*conns.AWSClient).IgnoreTagsConfig
 
 	rID := d.Get("replication_instance_id").(string)
-
 	instance, err := FindReplicationInstanceByID(ctx, conn, rID)
+
 	if err != nil {
-		return create.DiagError(names.DMS, create.ErrActionReading, DSNameReplicationTask, d.Id(), err)
+		return sdkdiag.AppendErrorf(diags, "reading DMS Replication Instance (%s): %s", rID, err)
 	}
 
 	d.SetId(aws.StringValue(instance.ReplicationInstanceIdentifier))
-
 	d.Set("allocated_storage", instance.AllocatedStorage)
 	d.Set("auto_minor_version_upgrade", instance.AutoMinorVersionUpgrade)
 	d.Set("availability_zone", instance.AvailabilityZone)
 	d.Set("engine_version", instance.EngineVersion)
 	d.Set("kms_key_arn", instance.KmsKeyId)
 	d.Set("multi_az", instance.MultiAZ)
+	d.Set("network_type", instance.NetworkType)
 	d.Set("preferred_maintenance_window", instance.PreferredMaintenanceWindow)
 	d.Set("publicly_accessible", instance.PubliclyAccessible)
-	d.Set("replication_instance_arn", instance.ReplicationInstanceArn)
+	arn := aws.StringValue(instance.ReplicationInstanceArn)
+	d.Set("replication_instance_arn", arn)
 	d.Set("replication_instance_class", instance.ReplicationInstanceClass)
 	d.Set("replication_instance_id", instance.ReplicationInstanceIdentifier)
+	d.Set("replication_instance_private_ips", aws.StringValueSlice(instance.ReplicationInstancePrivateIpAddresses))
+	d.Set("replication_instance_public_ips", aws.StringValueSlice(instance.ReplicationInstancePublicIpAddresses))
+	d.Set("replication_subnet_group_id", instance.ReplicationSubnetGroup.ReplicationSubnetGroupIdentifier)
+	vpcSecurityGroupIDs := tfslices.ApplyToAll(instance.VpcSecurityGroups, func(sg *dms.VpcSecurityGroupMembership) string {
+		return aws.StringValue(sg.VpcSecurityGroupId)
+	})
+	d.Set("vpc_security_group_ids", vpcSecurityGroupIDs)
 
-	tags, err := listTags(ctx, conn, aws.StringValue(instance.ReplicationInstanceArn))
+	tags, err := listTags(ctx, conn, arn)
 
 	if err != nil {
-		return create.DiagError(names.DMS, create.ErrActionReading, DSNameReplicationInstance, d.Id(), err)
+		return sdkdiag.AppendErrorf(diags, "listing tags for DMS Replication Instance (%s): %s", arn, err)
 	}
 
 	tags = tags.IgnoreAWS().IgnoreConfig(ignoreTagsConfig)
 
 	//lintignore:AWSR002
 	if err := d.Set("tags", tags.RemoveDefaultConfig(defaultTagsConfig).Map()); err != nil {
-		return create.DiagError(names.DMS, create.ErrActionSetting, DSNameReplicationInstance, d.Id(), err)
-	}
-
-	return nil
-}
-
-func FindReplicationInstanceByID(ctx context.Context, conn *dms.DatabaseMigrationService, id string) (*dms.ReplicationInstance, error) {
-	input := &dms.DescribeReplicationInstancesInput{
-		Filters: []*dms.Filter{
-			{
-				Name:   aws.String("replication-instance-id"),
-				Values: []*string{aws.String(id)},
-			},
-		},
-	}
-	response, err := conn.DescribeReplicationInstancesWithContext(ctx, input)
-	if err != nil {
-		return nil, err
-	}
-
-	if response == nil || len(response.ReplicationInstances) == 0 || response.ReplicationInstances[0] == nil {
-		return nil, tfresource.NewEmptyResultError(input)
+		return sdkdiag.AppendErrorf(diags, "setting tags: %s", err)
 	}
 
-	return response.ReplicationInstances[0], nil
+	return diags
 }
diff --git a/internal/service/dms/replication_instance_data_source_test.go b/internal/service/dms/replication_instance_data_source_test.go
index f29302e4a46..6a98344e16a 100644
--- a/internal/service/dms/replication_instance_data_source_test.go
+++ b/internal/service/dms/replication_instance_data_source_test.go
@@ -1,7 +1,9 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package dms_test
 
 import (
-	"fmt"
 	"testing"
 
 	dms "github.com/aws/aws-sdk-go/service/databasemigrationservice"
@@ -27,7 +29,12 @@ func TestAccDMSReplicationInstanceDataSource_basic(t *testing.T) {
 				Config: testAccReplicationInstanceDataSourceConfig_basic(rName, replicationInstanceClass),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckReplicationInstanceExists(ctx, dataSourceName),
+					resource.TestCheckResourceAttrPair(dataSourceName, "network_type", resourceName, "network_type"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "replication_instance_arn", resourceName, "replication_instance_arn"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "replication_instance_id", resourceName, "replication_instance_id"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "replication_instance_class", resourceName, "replication_instance_class"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "replication_instance_private_ips.#", resourceName, "replication_instance_private_ips.#"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "replication_instance_public_ips.#", resourceName, "replication_instance_public_ips.#"),
 				),
 			},
 		},
@@ -35,15 +42,9 @@ func TestAccDMSReplicationInstanceDataSource_basic(t *testing.T) {
 }
 
 func testAccReplicationInstanceDataSourceConfig_basic(rName, replicationInstanceClass string) string {
-	return fmt.Sprintf(`
-resource "aws_dms_replication_instance" "test" {
-  apply_immediately          = true
-  replication_instance_class = %q
-  replication_instance_id    = %q
-}
-
+	return acctest.ConfigCompose(testAccReplicationInstanceConfig_replicationInstanceClass(rName, replicationInstanceClass), `
 data "aws_dms_replication_instance" "test" {
   replication_instance_id = aws_dms_replication_instance.test.replication_instance_id
 }
-`, replicationInstanceClass, rName)
+`)
 }
diff --git a/internal/service/dms/replication_instance_test.go b/internal/service/dms/replication_instance_test.go
index 59ff1b80cbb..0e9ed8a336e 100644
--- a/internal/service/dms/replication_instance_test.go
+++ b/internal/service/dms/replication_instance_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package dms_test
 
 import (
@@ -5,19 +8,18 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/aws"
 	dms "github.com/aws/aws-sdk-go/service/databasemigrationservice"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	tfdms "github.com/hashicorp/terraform-provider-aws/internal/service/dms"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
 func TestAccDMSReplicationInstance_basic(t *testing.T) {
 	ctx := acctest.Context(t)
-
 	// NOTE: Using larger dms.c4.large here for AWS GovCloud (US) support
 	replicationInstanceClass := "dms.c4.large"
 	resourceName := "aws_dms_replication_instance.test"
@@ -30,22 +32,26 @@ func TestAccDMSReplicationInstance_basic(t *testing.T) {
 		CheckDestroy:             testAccCheckReplicationInstanceDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccReplicationInstanceConfig_class(rName, replicationInstanceClass),
-				Check: resource.ComposeTestCheckFunc(
+				Config: testAccReplicationInstanceConfig_replicationInstanceClass(rName, replicationInstanceClass),
+				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckReplicationInstanceExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "allocated_storage", "100"),
+					resource.TestCheckResourceAttr(resourceName, "auto_minor_version_upgrade", "false"),
 					resource.TestCheckResourceAttrSet(resourceName, "availability_zone"),
 					resource.TestCheckResourceAttrSet(resourceName, "engine_version"),
 					resource.TestCheckResourceAttrSet(resourceName, "kms_key_arn"),
 					resource.TestCheckResourceAttr(resourceName, "multi_az", "false"),
+					resource.TestCheckResourceAttr(resourceName, "network_type", "IPV4"),
 					resource.TestCheckResourceAttrSet(resourceName, "preferred_maintenance_window"),
 					resource.TestCheckResourceAttr(resourceName, "publicly_accessible", "false"),
-					resource.TestCheckResourceAttr(resourceName, "replication_instance_private_ips.#", "1"),
-					// ARN resource is its own unique identifier
 					resource.TestCheckResourceAttrSet(resourceName, "replication_instance_arn"),
 					resource.TestCheckResourceAttr(resourceName, "replication_instance_class", replicationInstanceClass),
 					resource.TestCheckResourceAttr(resourceName, "replication_instance_id", rName),
+					resource.TestCheckResourceAttr(resourceName, "replication_instance_private_ips.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "replication_instance_public_ips.#", "1"),
+					resource.TestCheckResourceAttrSet(resourceName, "replication_subnet_group_id"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
+					resource.TestCheckResourceAttr(resourceName, "vpc_security_group_ids.#", "1"),
 				),
 			},
 			{
@@ -58,6 +64,31 @@ func TestAccDMSReplicationInstance_basic(t *testing.T) {
 	})
 }
 
+func TestAccDMSReplicationInstance_disappears(t *testing.T) {
+	ctx := acctest.Context(t)
+	// NOTE: Using larger dms.c4.large here for AWS GovCloud (US) support
+	replicationInstanceClass := "dms.c4.large"
+	resourceName := "aws_dms_replication_instance.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, dms.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckReplicationInstanceDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccReplicationInstanceConfig_replicationInstanceClass(rName, replicationInstanceClass),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckReplicationInstanceExists(ctx, resourceName),
+					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfdms.ResourceReplicationInstance(), resourceName),
+				),
+				ExpectNonEmptyPlan: true,
+			},
+		},
+	})
+}
+
 func TestAccDMSReplicationInstance_allocatedStorage(t *testing.T) {
 	ctx := acctest.Context(t)
 	resourceName := "aws_dms_replication_instance.test"
@@ -164,63 +195,41 @@ func TestAccDMSReplicationInstance_availabilityZone(t *testing.T) {
 	})
 }
 
-/*
-** Temporarily commented out: "replication_instance_test.go:186: Test validation error: TestStep 1/3 validation error: TestStep missing Config or ImportState".
-
 func TestAccDMSReplicationInstance_engineVersion(t *testing.T) {
+	ctx := acctest.Context(t)
 	resourceName := "aws_dms_replication_instance.test"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
-	// This acceptance test is designed to test engine version upgrades.
-	// Over time, DMS replication instance engine versions are deprecated
-	// so they will eventually error on resource creation, e.g.
-	//   InvalidParameterValueException: No replication engine found with version: 2.4.2
-	// During the PreCheck, we will find candidate engine versions from the
-	// orderable replication instances and generate the TestStep.
-	// We prefer this method over creating a plural data source that
-	// seems impractical for real world usage.
-	testSteps := []resource.TestStep{
-		{},
-		{},
-		{
-			ResourceName:            resourceName,
-			ImportState:             true,
-			ImportStateVerify:       true,
-			ImportStateVerifyIgnore: []string{"allow_major_version_upgrade", "apply_immediately"},
-		},
-	}
-
 	resource.ParallelTest(t, resource.TestCase{
-		PreCheck: func() {
-			acctest.PreCheck(ctx, t)
-
-			engineVersions := testAccReplicationInstanceEngineVersionsPreCheck(t)
-
-			testSteps[0] = resource.TestStep{
-				Config: testAccReplicationInstanceConfig_engineVersion(rName, engineVersions[0]),
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, dms.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckReplicationInstanceDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccReplicationInstanceConfig_engineVersion(rName, "3.4.7"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckReplicationInstanceExists(resourceName),
-					resource.TestCheckResourceAttr(resourceName, "engine_version", engineVersions[0]),
+					testAccCheckReplicationInstanceExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "engine_version", "3.4.7"),
 				),
-			}
-			testSteps[1] = resource.TestStep{
-				Config: testAccReplicationInstanceConfig_engineVersion(rName, engineVersions[1]),
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"allow_major_version_upgrade", "apply_immediately"},
+			},
+			{
+				Config: testAccReplicationInstanceConfig_engineVersion(rName, "3.5.1"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckReplicationInstanceExists(resourceName),
-					resource.TestCheckResourceAttr(resourceName, "engine_version", engineVersions[1]),
+					testAccCheckReplicationInstanceExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "engine_version", "3.5.1"),
 				),
-			}
+			},
 		},
-		ErrorCheck:        acctest.ErrorCheck(t, dms.EndpointsID),
-		ProtoV5ProviderFactories:acctest.ProtoV5ProviderFactories,
-		CheckDestroy:      testAccCheckReplicationInstanceDestroy,
-		Steps:             testSteps,
 	})
 }
 
-**
-*/
-
 func TestAccDMSReplicationInstance_kmsKeyARN(t *testing.T) {
 	ctx := acctest.Context(t)
 	kmsKeyResourceName := "aws_kms_key.test"
@@ -292,7 +301,7 @@ func TestAccDMSReplicationInstance_multiAz(t *testing.T) {
 	})
 }
 
-func TestAccDMSReplicationInstance_preferredMaintenanceWindow(t *testing.T) {
+func TestAccDMSReplicationInstance_networkType(t *testing.T) {
 	ctx := acctest.Context(t)
 	resourceName := "aws_dms_replication_instance.test"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
@@ -304,10 +313,10 @@ func TestAccDMSReplicationInstance_preferredMaintenanceWindow(t *testing.T) {
 		CheckDestroy:             testAccCheckReplicationInstanceDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccReplicationInstanceConfig_preferredMaintenanceWindow(rName, "sun:00:30-sun:02:30"),
+				Config: testAccReplicationInstanceConfig_networkType(rName, "IPV4"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckReplicationInstanceExists(ctx, resourceName),
-					resource.TestCheckResourceAttr(resourceName, "preferred_maintenance_window", "sun:00:30-sun:02:30"),
+					resource.TestCheckResourceAttr(resourceName, "network_type", "IPV4"),
 				),
 			},
 			{
@@ -317,17 +326,17 @@ func TestAccDMSReplicationInstance_preferredMaintenanceWindow(t *testing.T) {
 				ImportStateVerifyIgnore: []string{"apply_immediately"},
 			},
 			{
-				Config: testAccReplicationInstanceConfig_preferredMaintenanceWindow(rName, "mon:00:30-mon:02:30"),
+				Config: testAccReplicationInstanceConfig_networkType(rName, "DUAL"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckReplicationInstanceExists(ctx, resourceName),
-					resource.TestCheckResourceAttr(resourceName, "preferred_maintenance_window", "mon:00:30-mon:02:30"),
+					resource.TestCheckResourceAttr(resourceName, "network_type", "DUAL"),
 				),
 			},
 		},
 	})
 }
 
-func TestAccDMSReplicationInstance_publiclyAccessible(t *testing.T) {
+func TestAccDMSReplicationInstance_preferredMaintenanceWindow(t *testing.T) {
 	ctx := acctest.Context(t)
 	resourceName := "aws_dms_replication_instance.test"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
@@ -339,11 +348,10 @@ func TestAccDMSReplicationInstance_publiclyAccessible(t *testing.T) {
 		CheckDestroy:             testAccCheckReplicationInstanceDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccReplicationInstanceConfig_publiclyAccessible(rName, true),
+				Config: testAccReplicationInstanceConfig_preferredMaintenanceWindow(rName, "sun:00:30-sun:02:30"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckReplicationInstanceExists(ctx, resourceName),
-					resource.TestCheckResourceAttr(resourceName, "publicly_accessible", "true"),
-					resource.TestCheckResourceAttr(resourceName, "replication_instance_public_ips.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "preferred_maintenance_window", "sun:00:30-sun:02:30"),
 				),
 			},
 			{
@@ -352,16 +360,19 @@ func TestAccDMSReplicationInstance_publiclyAccessible(t *testing.T) {
 				ImportStateVerify:       true,
 				ImportStateVerifyIgnore: []string{"apply_immediately"},
 			},
+			{
+				Config: testAccReplicationInstanceConfig_preferredMaintenanceWindow(rName, "mon:00:30-mon:02:30"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckReplicationInstanceExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "preferred_maintenance_window", "mon:00:30-mon:02:30"),
+				),
+			},
 		},
 	})
 }
 
-func TestAccDMSReplicationInstance_replicationInstanceClass(t *testing.T) {
+func TestAccDMSReplicationInstance_publiclyAccessible(t *testing.T) {
 	ctx := acctest.Context(t)
-
-	// NOTE: Using larger dms.c4.(x)?large here for AWS GovCloud (US) support
-	replicationInstanceClass1 := "dms.c4.large"
-	replicationInstanceClass2 := "dms.c4.xlarge"
 	resourceName := "aws_dms_replication_instance.test"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
@@ -372,10 +383,11 @@ func TestAccDMSReplicationInstance_replicationInstanceClass(t *testing.T) {
 		CheckDestroy:             testAccCheckReplicationInstanceDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccReplicationInstanceConfig_class(rName, replicationInstanceClass1),
+				Config: testAccReplicationInstanceConfig_publiclyAccessible(rName, true),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckReplicationInstanceExists(ctx, resourceName),
-					resource.TestCheckResourceAttr(resourceName, "replication_instance_class", replicationInstanceClass1),
+					resource.TestCheckResourceAttr(resourceName, "publicly_accessible", "true"),
+					resource.TestCheckResourceAttr(resourceName, "replication_instance_public_ips.#", "1"),
 				),
 			},
 			{
@@ -384,20 +396,15 @@ func TestAccDMSReplicationInstance_replicationInstanceClass(t *testing.T) {
 				ImportStateVerify:       true,
 				ImportStateVerifyIgnore: []string{"apply_immediately"},
 			},
-			{
-				Config: testAccReplicationInstanceConfig_class(rName, replicationInstanceClass2),
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckReplicationInstanceExists(ctx, resourceName),
-					resource.TestCheckResourceAttr(resourceName, "replication_instance_class", replicationInstanceClass2),
-				),
-			},
 		},
 	})
 }
 
-func TestAccDMSReplicationInstance_replicationSubnetGroupID(t *testing.T) {
+func TestAccDMSReplicationInstance_replicationInstanceClass(t *testing.T) {
 	ctx := acctest.Context(t)
-	dmsReplicationSubnetGroupResourceName := "aws_dms_replication_subnet_group.test"
+	// NOTE: Using larger dms.c4.(x)?large here for AWS GovCloud (US) support
+	replicationInstanceClass1 := "dms.c4.large"
+	replicationInstanceClass2 := "dms.c4.xlarge"
 	resourceName := "aws_dms_replication_instance.test"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
@@ -408,10 +415,10 @@ func TestAccDMSReplicationInstance_replicationSubnetGroupID(t *testing.T) {
 		CheckDestroy:             testAccCheckReplicationInstanceDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccReplicationInstanceConfig_subnetGroupID(rName),
+				Config: testAccReplicationInstanceConfig_replicationInstanceClass(rName, replicationInstanceClass1),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckReplicationInstanceExists(ctx, resourceName),
-					resource.TestCheckResourceAttrPair(resourceName, "replication_subnet_group_id", dmsReplicationSubnetGroupResourceName, "replication_subnet_group_id"),
+					resource.TestCheckResourceAttr(resourceName, "replication_instance_class", replicationInstanceClass1),
 				),
 			},
 			{
@@ -420,6 +427,13 @@ func TestAccDMSReplicationInstance_replicationSubnetGroupID(t *testing.T) {
 				ImportStateVerify:       true,
 				ImportStateVerifyIgnore: []string{"apply_immediately"},
 			},
+			{
+				Config: testAccReplicationInstanceConfig_replicationInstanceClass(rName, replicationInstanceClass2),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckReplicationInstanceExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "replication_instance_class", replicationInstanceClass2),
+				),
+			},
 		},
 	})
 }
@@ -436,7 +450,7 @@ func TestAccDMSReplicationInstance_tags(t *testing.T) {
 		CheckDestroy:             testAccCheckReplicationInstanceDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccReplicationInstanceConfig_tagsOne(rName, "key1", "value1"),
+				Config: testAccReplicationInstanceConfig_tags1(rName, "key1", "value1"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckReplicationInstanceExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
@@ -450,7 +464,7 @@ func TestAccDMSReplicationInstance_tags(t *testing.T) {
 				ImportStateVerifyIgnore: []string{"apply_immediately"},
 			},
 			{
-				Config: testAccReplicationInstanceConfig_tagsTwo(rName, "key1", "value1updated", "key2", "value2"),
+				Config: testAccReplicationInstanceConfig_tags2(rName, "key1", "value1updated", "key2", "value2"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckReplicationInstanceExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
@@ -459,7 +473,7 @@ func TestAccDMSReplicationInstance_tags(t *testing.T) {
 				),
 			},
 			{
-				Config: testAccReplicationInstanceConfig_tagsOne(rName, "key2", "value2"),
+				Config: testAccReplicationInstanceConfig_tags1(rName, "key2", "value2"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckReplicationInstanceExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
@@ -505,49 +519,26 @@ func testAccCheckReplicationInstanceExists(ctx context.Context, n string) resour
 			return fmt.Errorf("Not found: %s", n)
 		}
 
-		if rs.Primary.ID == "" {
-			return fmt.Errorf("No ID is set")
-		}
 		conn := acctest.Provider.Meta().(*conns.AWSClient).DMSConn(ctx)
-		resp, err := conn.DescribeReplicationInstancesWithContext(ctx, &dms.DescribeReplicationInstancesInput{
-			Filters: []*dms.Filter{
-				{
-					Name:   aws.String("replication-instance-id"),
-					Values: []*string{aws.String(rs.Primary.ID)},
-				},
-			},
-		})
 
-		if err != nil {
-			return fmt.Errorf("DMS replication instance error: %v", err)
-		}
-		if resp == nil || len(resp.ReplicationInstances) == 0 {
-			return fmt.Errorf("DMS replication instance not found")
-		}
+		_, err := tfdms.FindReplicationInstanceByID(ctx, conn, rs.Primary.ID)
 
-		return nil
+		return err
 	}
 }
 
 func testAccCheckReplicationInstanceDestroy(ctx context.Context) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
+		conn := acctest.Provider.Meta().(*conns.AWSClient).DMSConn(ctx)
+
 		for _, rs := range s.RootModule().Resources {
 			if rs.Type != "aws_dms_replication_instance" {
 				continue
 			}
 
-			conn := acctest.Provider.Meta().(*conns.AWSClient).DMSConn(ctx)
-
-			resp, err := conn.DescribeReplicationInstancesWithContext(ctx, &dms.DescribeReplicationInstancesInput{
-				Filters: []*dms.Filter{
-					{
-						Name:   aws.String("replication-instance-id"),
-						Values: []*string{aws.String(rs.Primary.ID)},
-					},
-				},
-			})
+			_, err := tfdms.FindReplicationInstanceByID(ctx, conn, rs.Primary.ID)
 
-			if tfawserr.ErrCodeEquals(err, dms.ErrCodeResourceNotFoundFault) {
+			if tfresource.NotFound(err) {
 				continue
 			}
 
@@ -555,349 +546,237 @@ func testAccCheckReplicationInstanceDestroy(ctx context.Context) resource.TestCh
 				return err
 			}
 
-			if resp != nil {
-				for _, replicationInstance := range resp.ReplicationInstances {
-					if aws.StringValue(replicationInstance.ReplicationInstanceIdentifier) == rs.Primary.ID {
-						return fmt.Errorf("DMS Replication Instance (%s) still exists", rs.Primary.ID)
-					}
-				}
-			}
+			return fmt.Errorf("DMS Replication Instance %s still exists", rs.Primary.ID)
 		}
 
 		return nil
 	}
 }
 
-/*
-**
-
-// Ensure at least two engine versions of the replication instance class are available
-func testAccReplicationInstanceEngineVersionsPreCheck(t *testing.T) []string {
-	conn := acctest.Provider.Meta().(*conns.AWSClient).DMSConn(ctx)
-
-	// Gather all orderable DMS replication instances of the instance class
-	// used in the acceptance testing. Not currently available as an input
-	// parameter to the describe API call.
-	var orderableReplicationInstances []*dms.OrderableReplicationInstance
-	input := &dms.DescribeOrderableReplicationInstancesInput{}
-	// NOTE: Using larger dms.c4.large here for AWS GovCloud (US) support
-	replicationInstanceClass := "dms.c4.large"
-
-	err := conn.DescribeOrderableReplicationInstancesPages(input, func(output *dms.DescribeOrderableReplicationInstancesOutput, lastPage bool) bool {
-		for _, orderableReplicationInstance := range output.OrderableReplicationInstances {
-			if orderableReplicationInstance == nil {
-				continue
-			}
-
-			if aws.StringValue(orderableReplicationInstance.ReplicationInstanceClass) == replicationInstanceClass {
-				orderableReplicationInstances = append(orderableReplicationInstances, orderableReplicationInstance)
-			}
-		}
-
-		return !lastPage
-	})
-
-	if err != nil {
-		t.Fatalf("error describing DMS orderable replication instances: %s", err)
-	}
-
-	// Ensure we have enough
-	if len(orderableReplicationInstances) < 2 {
-		t.Fatalf("found (%d) DMS orderable replication instances for instance class (%s), need at least 2", len(orderableReplicationInstances), replicationInstanceClass)
-	}
-
-	// Sort them ascending
-	sort.Slice(orderableReplicationInstances, func(i, j int) bool {
-		return verify.SemVerLessThan(aws.StringValue(orderableReplicationInstances[i].EngineVersion), aws.StringValue(orderableReplicationInstances[j].EngineVersion))
-	})
-
-	engineVersions := make([]string, len(orderableReplicationInstances))
-
-	for i, orderableReplicationInstance := range orderableReplicationInstances {
-		engineVersions[i] = aws.StringValue(orderableReplicationInstance.EngineVersion)
-	}
-
-	return engineVersions
+// Ideally we'd like to be able to leverage the "default" replication subnet group.
+// However, it may not exist or may include deleted subnets.
+func testAccReplicationInstanceConfig_base(rName string) string {
+	return acctest.ConfigCompose(acctest.ConfigVPCWithSubnets(rName, 2), fmt.Sprintf(`
+resource "aws_dms_replication_subnet_group" "test" {
+  replication_subnet_group_id          = %[1]q
+  replication_subnet_group_description = "testing"
+  subnet_ids                           = aws_subnet.test[*].id
+}
+`, rName))
 }
-
-**
-*/
 
 func testAccReplicationInstanceConfig_allocatedStorage(rName string, allocatedStorage int) string {
-	return fmt.Sprintf(`
-data "aws_partition" "current" {
-}
+	return acctest.ConfigCompose(testAccReplicationInstanceConfig_base(rName), fmt.Sprintf(`
+data "aws_partition" "current" {}
 
 resource "aws_dms_replication_instance" "test" {
-  allocated_storage          = %d
-  apply_immediately          = true
-  replication_instance_class = data.aws_partition.current.partition == "aws" ? "dms.t2.micro" : "dms.c4.large"
-  replication_instance_id    = %q
+  allocated_storage           = %[2]d
+  apply_immediately           = true
+  replication_instance_class  = data.aws_partition.current.partition == "aws" ? "dms.t2.micro" : "dms.c4.large"
+  replication_instance_id     = %[1]q
+  replication_subnet_group_id = aws_dms_replication_subnet_group.test.id
 }
-`, allocatedStorage, rName)
+`, rName, allocatedStorage))
 }
 
 func testAccReplicationInstanceConfig_autoMinorVersionUpgrade(rName string, autoMinorVersionUpgrade bool) string {
-	return fmt.Sprintf(`
-data "aws_partition" "current" {
-}
+	return acctest.ConfigCompose(testAccReplicationInstanceConfig_base(rName), fmt.Sprintf(`
+data "aws_partition" "current" {}
 
 resource "aws_dms_replication_instance" "test" {
-  apply_immediately          = true
-  auto_minor_version_upgrade = %t
-  replication_instance_class = data.aws_partition.current.partition == "aws" ? "dms.t2.micro" : "dms.c4.large"
-  replication_instance_id    = %q
+  apply_immediately           = true
+  auto_minor_version_upgrade  = %[2]t
+  replication_instance_class  = data.aws_partition.current.partition == "aws" ? "dms.t2.micro" : "dms.c4.large"
+  replication_instance_id     = %[1]q
+  replication_subnet_group_id = aws_dms_replication_subnet_group.test.id
 }
-`, autoMinorVersionUpgrade, rName)
+`, rName, autoMinorVersionUpgrade))
 }
 
 func testAccReplicationInstanceConfig_availabilityZone(rName string) string {
-	return fmt.Sprintf(`
-data "aws_availability_zones" "available" {
-  state = "available"
-
-  filter {
-    name   = "opt-in-status"
-    values = ["opt-in-not-required"]
-  }
-}
-
-data "aws_partition" "current" {
-}
+	return acctest.ConfigCompose(testAccReplicationInstanceConfig_base(rName), fmt.Sprintf(`
+data "aws_partition" "current" {}
 
 resource "aws_dms_replication_instance" "test" {
-  apply_immediately          = true
-  availability_zone          = data.aws_availability_zones.available.names[0]
-  replication_instance_class = data.aws_partition.current.partition == "aws" ? "dms.t2.micro" : "dms.c4.large"
-  replication_instance_id    = %q
+  apply_immediately           = true
+  availability_zone           = data.aws_availability_zones.available.names[0]
+  replication_instance_class  = data.aws_partition.current.partition == "aws" ? "dms.t2.micro" : "dms.c4.large"
+  replication_instance_id     = %[1]q
+  replication_subnet_group_id = aws_dms_replication_subnet_group.test.id
 }
-`, rName)
+`, rName))
 }
 
-/*
-**
-
 func testAccReplicationInstanceConfig_engineVersion(rName, engineVersion string) string {
-	return fmt.Sprintf(`
-data "aws_partition" "current" {
-}
+	return acctest.ConfigCompose(testAccReplicationInstanceConfig_base(rName), fmt.Sprintf(`
+data "aws_partition" "current" {}
 
 resource "aws_dms_replication_instance" "test" {
   apply_immediately           = true
   allow_major_version_upgrade = true
-  engine_version              = %q
+  engine_version              = %[2]q
   replication_instance_class  = data.aws_partition.current.partition == "aws" ? "dms.t2.micro" : "dms.c4.large"
-  replication_instance_id     = %q
+  replication_instance_id     = %[1]q
+  replication_subnet_group_id = aws_dms_replication_subnet_group.test.id
 }
-`, engineVersion, rName)
+`, rName, engineVersion))
 }
 
-**
-*/
-
 func testAccReplicationInstanceConfig_kmsKeyARN(rName string) string {
-	return fmt.Sprintf(`
-data "aws_partition" "current" {
-}
+	return acctest.ConfigCompose(testAccReplicationInstanceConfig_base(rName), fmt.Sprintf(`
+data "aws_partition" "current" {}
 
 resource "aws_kms_key" "test" {
   deletion_window_in_days = 7
 }
 
 resource "aws_dms_replication_instance" "test" {
-  apply_immediately          = true
-  kms_key_arn                = aws_kms_key.test.arn
-  replication_instance_class = data.aws_partition.current.partition == "aws" ? "dms.t2.micro" : "dms.c4.large"
-  replication_instance_id    = %q
+  apply_immediately           = true
+  kms_key_arn                 = aws_kms_key.test.arn
+  replication_instance_class  = data.aws_partition.current.partition == "aws" ? "dms.t2.micro" : "dms.c4.large"
+  replication_instance_id     = %[1]q
+  replication_subnet_group_id = aws_dms_replication_subnet_group.test.id
 }
-`, rName)
+`, rName))
 }
 
 func testAccReplicationInstanceConfig_multiAz(rName string, multiAz bool) string {
-	return fmt.Sprintf(`
-data "aws_partition" "current" {
-}
+	return acctest.ConfigCompose(testAccReplicationInstanceConfig_base(rName), fmt.Sprintf(`
+data "aws_partition" "current" {}
 
 resource "aws_dms_replication_instance" "test" {
-  apply_immediately          = true
-  multi_az                   = %t
-  replication_instance_class = data.aws_partition.current.partition == "aws" ? "dms.t2.micro" : "dms.c4.large"
-  replication_instance_id    = %q
+  apply_immediately           = true
+  multi_az                    = %[2]t
+  replication_instance_class  = data.aws_partition.current.partition == "aws" ? "dms.t2.micro" : "dms.c4.large"
+  replication_instance_id     = %[1]q
+  replication_subnet_group_id = aws_dms_replication_subnet_group.test.id
 }
-`, multiAz, rName)
+`, rName, multiAz))
 }
 
-func testAccReplicationInstanceConfig_preferredMaintenanceWindow(rName, preferredMaintenanceWindow string) string {
-	return fmt.Sprintf(`
-data "aws_partition" "current" {
-}
-
-resource "aws_dms_replication_instance" "test" {
-  apply_immediately            = true
-  preferred_maintenance_window = %q
-  replication_instance_class   = data.aws_partition.current.partition == "aws" ? "dms.t2.micro" : "dms.c4.large"
-  replication_instance_id      = %q
-}
-`, preferredMaintenanceWindow, rName)
-}
+func testAccReplicationInstanceConfig_networkType(rName, networkType string) string {
+	return acctest.ConfigCompose(acctest.ConfigVPCWithSubnetsIPv6(rName, 2), fmt.Sprintf(`
+data "aws_partition" "current" {}
 
-func testAccReplicationInstanceConfig_publiclyAccessible(rName string, publiclyAccessible bool) string {
-	return fmt.Sprintf(`
-data "aws_partition" "current" {
+resource "aws_dms_replication_subnet_group" "test" {
+  replication_subnet_group_id          = %[1]q
+  replication_subnet_group_description = "testing"
+  subnet_ids                           = aws_subnet.test[*].id
 }
 
 resource "aws_dms_replication_instance" "test" {
-  apply_immediately          = true
-  publicly_accessible        = %t
-  replication_instance_class = data.aws_partition.current.partition == "aws" ? "dms.t2.micro" : "dms.c4.large"
-  replication_instance_id    = %q
+  apply_immediately           = true
+  network_type                = %[2]q
+  replication_instance_class  = data.aws_partition.current.partition == "aws" ? "dms.t2.micro" : "dms.c4.large"
+  replication_instance_id     = %[1]q
+  replication_subnet_group_id = aws_dms_replication_subnet_group.test.id
 }
-`, publiclyAccessible, rName)
+`, rName, networkType))
 }
 
-func testAccReplicationInstanceConfig_class(rName, replicationInstanceClass string) string {
-	return fmt.Sprintf(`
+func testAccReplicationInstanceConfig_preferredMaintenanceWindow(rName, preferredMaintenanceWindow string) string {
+	return acctest.ConfigCompose(testAccReplicationInstanceConfig_base(rName), fmt.Sprintf(`
+data "aws_partition" "current" {}
+
 resource "aws_dms_replication_instance" "test" {
-  apply_immediately          = true
-  replication_instance_class = %q
-  replication_instance_id    = %q
-}
-`, replicationInstanceClass, rName)
+  apply_immediately            = true
+  preferred_maintenance_window = %[2]q
+  replication_instance_class   = data.aws_partition.current.partition == "aws" ? "dms.t2.micro" : "dms.c4.large"
+  replication_instance_id      = %[1]q
+  replication_subnet_group_id  = aws_dms_replication_subnet_group.test.id
 }
-
-func testAccReplicationInstanceConfig_subnetGroupID(rName string) string {
-	return fmt.Sprintf(`
-data "aws_availability_zones" "available" {
-  state = "available"
-
-  filter {
-    name   = "opt-in-status"
-    values = ["opt-in-not-required"]
-  }
+`, rName, preferredMaintenanceWindow))
 }
 
-data "aws_partition" "current" {
-}
+func testAccReplicationInstanceConfig_publiclyAccessible(rName string, publiclyAccessible bool) string {
+	return acctest.ConfigCompose(testAccReplicationInstanceConfig_base(rName), fmt.Sprintf(`
+data "aws_partition" "current" {}
 
-resource "aws_vpc" "test" {
-  cidr_block = "10.1.0.0/16"
+resource "aws_internet_gateway" "test" {
+  vpc_id = aws_vpc.test.id
 
   tags = {
-    Name = %q
+    Name = %[1]q
   }
 }
 
-resource "aws_subnet" "test" {
-  count = 2
-
-  availability_zone = data.aws_availability_zones.available.names[count.index]
-  cidr_block        = "10.1.${count.index}.0/24"
-  vpc_id            = aws_vpc.test.id
+resource "aws_dms_replication_instance" "test" {
+  apply_immediately           = true
+  publicly_accessible         = %[2]t
+  replication_instance_class  = data.aws_partition.current.partition == "aws" ? "dms.t2.micro" : "dms.c4.large"
+  replication_instance_id     = %[1]q
+  replication_subnet_group_id = aws_dms_replication_subnet_group.test.id
 
-  tags = {
-    Name = aws_vpc.test.tags["Name"]
-  }
+  depends_on = [aws_internet_gateway.test]
 }
-
-resource "aws_dms_replication_subnet_group" "test" {
-  replication_subnet_group_description = %q
-  replication_subnet_group_id          = %q
-  subnet_ids                           = aws_subnet.test[*].id
+`, rName, publiclyAccessible))
 }
 
+func testAccReplicationInstanceConfig_replicationInstanceClass(rName, replicationInstanceClass string) string {
+	return acctest.ConfigCompose(testAccReplicationInstanceConfig_base(rName), fmt.Sprintf(`
 resource "aws_dms_replication_instance" "test" {
   apply_immediately           = true
-  replication_instance_class  = data.aws_partition.current.partition == "aws" ? "dms.t2.micro" : "dms.c4.large"
-  replication_instance_id     = %q
-  replication_subnet_group_id = aws_dms_replication_subnet_group.test.replication_subnet_group_id
+  replication_instance_class  = %[1]q
+  replication_instance_id     = %[2]q
+  replication_subnet_group_id = aws_dms_replication_subnet_group.test.id
 }
-`, rName, rName, rName, rName)
+`, replicationInstanceClass, rName))
 }
 
-func testAccReplicationInstanceConfig_tagsOne(rName, key1, value1 string) string {
-	return fmt.Sprintf(`
+func testAccReplicationInstanceConfig_tags1(rName, key1, value1 string) string {
+	return acctest.ConfigCompose(testAccReplicationInstanceConfig_base(rName), fmt.Sprintf(`
 data "aws_partition" "current" {}
 
 resource "aws_dms_replication_instance" "test" {
-  apply_immediately          = true
-  replication_instance_class = data.aws_partition.current.partition == "aws" ? "dms.t2.micro" : "dms.c4.large"
-  replication_instance_id    = %q
+  apply_immediately           = true
+  replication_instance_class  = data.aws_partition.current.partition == "aws" ? "dms.t2.micro" : "dms.c4.large"
+  replication_instance_id     = %[1]q
+  replication_subnet_group_id = aws_dms_replication_subnet_group.test.id
 
   tags = {
-    %q = %q
+    %[2]q = %[3]q
   }
 }
-`, rName, key1, value1)
+`, rName, key1, value1))
 }
 
-func testAccReplicationInstanceConfig_tagsTwo(rName, key1, value1, key2, value2 string) string {
-	return fmt.Sprintf(`
+func testAccReplicationInstanceConfig_tags2(rName, key1, value1, key2, value2 string) string {
+	return acctest.ConfigCompose(testAccReplicationInstanceConfig_base(rName), fmt.Sprintf(`
 data "aws_partition" "current" {}
 
 resource "aws_dms_replication_instance" "test" {
-  apply_immediately          = true
-  replication_instance_class = data.aws_partition.current.partition == "aws" ? "dms.t2.micro" : "dms.c4.large"
-  replication_instance_id    = %q
+  apply_immediately           = true
+  replication_instance_class  = data.aws_partition.current.partition == "aws" ? "dms.t2.micro" : "dms.c4.large"
+  replication_instance_id     = %[1]q
+  replication_subnet_group_id = aws_dms_replication_subnet_group.test.id
 
   tags = {
-    %q = %q
-    %q = %q
+    %[2]q = %[3]q
+    %[4]q = %[5]q
   }
 }
-`, rName, key1, value1, key2, value2)
+`, rName, key1, value1, key2, value2))
 }
 
 func testAccReplicationInstanceConfig_vpcSecurityGroupIDs(rName string) string {
-	return fmt.Sprintf(`
-data "aws_availability_zones" "available" {
-  state = "available"
-
-  filter {
-    name   = "opt-in-status"
-    values = ["opt-in-not-required"]
-  }
-}
-
-data "aws_partition" "current" {
-}
-
-resource "aws_vpc" "test" {
-  cidr_block = "10.1.0.0/16"
-
-  tags = {
-    Name = %q
-  }
-}
+	return acctest.ConfigCompose(testAccReplicationInstanceConfig_base(rName), fmt.Sprintf(`
+data "aws_partition" "current" {}
 
 resource "aws_security_group" "test" {
-  name   = aws_vpc.test.tags["Name"]
+  name   = %[1]q
   vpc_id = aws_vpc.test.id
-}
-
-resource "aws_subnet" "test" {
-  count = 2
-
-  availability_zone = data.aws_availability_zones.available.names[count.index]
-  cidr_block        = "10.1.${count.index}.0/24"
-  vpc_id            = aws_vpc.test.id
 
   tags = {
-    Name = aws_vpc.test.tags["Name"]
+    Name = %[1]q
   }
 }
 
-resource "aws_dms_replication_subnet_group" "test" {
-  replication_subnet_group_description = %q
-  replication_subnet_group_id          = %q
-  subnet_ids                           = aws_subnet.test[*].id
-}
-
 resource "aws_dms_replication_instance" "test" {
   apply_immediately           = true
   replication_instance_class  = data.aws_partition.current.partition == "aws" ? "dms.t2.micro" : "dms.c4.large"
-  replication_instance_id     = %q
+  replication_instance_id     = %[1]q
   replication_subnet_group_id = aws_dms_replication_subnet_group.test.replication_subnet_group_id
   vpc_security_group_ids      = [aws_security_group.test.id]
 }
-`, rName, rName, rName, rName)
+`, rName))
 }
diff --git a/internal/service/dms/replication_subnet_group.go b/internal/service/dms/replication_subnet_group.go
index cf1f0d21848..60c326229ed 100644
--- a/internal/service/dms/replication_subnet_group.go
+++ b/internal/service/dms/replication_subnet_group.go
@@ -1,10 +1,12 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package dms
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"time"
 
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/arn"
@@ -14,8 +16,9 @@ import (
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
-	"github.com/hashicorp/terraform-provider-aws/internal/create"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
 	"github.com/hashicorp/terraform-provider-aws/internal/flex"
+	tfslices "github.com/hashicorp/terraform-provider-aws/internal/slices"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
@@ -31,12 +34,6 @@ func ResourceReplicationSubnetGroup() *schema.Resource {
 		UpdateWithoutTimeout: resourceReplicationSubnetGroupUpdate,
 		DeleteWithoutTimeout: resourceReplicationSubnetGroupDelete,
 
-		Timeouts: &schema.ResourceTimeout{
-			Create: schema.DefaultTimeout(15 * time.Minute),
-			Update: schema.DefaultTimeout(15 * time.Minute),
-			Delete: schema.DefaultTimeout(15 * time.Minute),
-		},
-
 		Importer: &schema.ResourceImporter{
 			StateContext: schema.ImportStatePassthroughContext,
 		},
@@ -58,10 +55,9 @@ func ResourceReplicationSubnetGroup() *schema.Resource {
 			},
 			"subnet_ids": {
 				Type:     schema.TypeSet,
-				Elem:     &schema.Schema{Type: schema.TypeString},
-				Set:      schema.HashString,
 				MinItems: 2,
 				Required: true,
+				Elem:     &schema.Schema{Type: schema.TypeString},
 			},
 			names.AttrTags:    tftags.TagsSchema(),
 			names.AttrTagsAll: tftags.TagsSchemaComputed(),
@@ -75,50 +71,28 @@ func ResourceReplicationSubnetGroup() *schema.Resource {
 	}
 }
 
-const (
-	ResNameReplicationSubnetGroup = "Replication Subnet Group"
-)
-
 func resourceReplicationSubnetGroupCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).DMSConn(ctx)
 
-	request := &dms.CreateReplicationSubnetGroupInput{
-		ReplicationSubnetGroupIdentifier:  aws.String(d.Get("replication_subnet_group_id").(string)),
+	replicationSubnetGroupID := d.Get("replication_subnet_group_id").(string)
+	input := &dms.CreateReplicationSubnetGroupInput{
 		ReplicationSubnetGroupDescription: aws.String(d.Get("replication_subnet_group_description").(string)),
+		ReplicationSubnetGroupIdentifier:  aws.String(replicationSubnetGroupID),
 		SubnetIds:                         flex.ExpandStringSet(d.Get("subnet_ids").(*schema.Set)),
 		Tags:                              getTagsIn(ctx),
 	}
 
-	log.Println("[DEBUG] DMS create replication subnet group:", request)
-
-	err := retry.RetryContext(ctx, propagationTimeout, func() *retry.RetryError {
-		_, err := conn.CreateReplicationSubnetGroupWithContext(ctx, request)
-
-		if tfawserr.ErrCodeEquals(err, dms.ErrCodeAccessDeniedFault) {
-			return retry.RetryableError(err)
-		}
-
-		if err != nil {
-			return retry.NonRetryableError(err)
-		}
-
-		return nil
-	})
-
-	if tfresource.TimedOut(err) {
-		_, err = conn.CreateReplicationSubnetGroupWithContext(ctx, request)
-
-		if err != nil {
-			return create.DiagError(names.DMS, create.ErrActionCreating, ResNameReplicationSubnetGroup, d.Get("replication_subnet_group_id").(string), err)
-		}
-	}
+	_, err := tfresource.RetryWhenAWSErrCodeEquals(ctx, propagationTimeout, func() (interface{}, error) {
+		return conn.CreateReplicationSubnetGroupWithContext(ctx, input)
+	}, dms.ErrCodeAccessDeniedFault)
 
 	if err != nil {
-		return create.DiagError(names.DMS, create.ErrActionCreating, ResNameReplicationSubnetGroup, d.Get("replication_subnet_group_id").(string), err)
+		return sdkdiag.AppendErrorf(diags, "creating DMS Replication Subnet Group (%s): %s", replicationSubnetGroupID, err)
 	}
 
-	d.SetId(d.Get("replication_subnet_group_id").(string))
+	d.SetId(replicationSubnetGroupID)
+
 	return append(diags, resourceReplicationSubnetGroupRead(ctx, d, meta)...)
 }
 
@@ -126,28 +100,16 @@ func resourceReplicationSubnetGroupRead(ctx context.Context, d *schema.ResourceD
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).DMSConn(ctx)
 
-	response, err := conn.DescribeReplicationSubnetGroupsWithContext(ctx, &dms.DescribeReplicationSubnetGroupsInput{
-		Filters: []*dms.Filter{
-			{
-				Name:   aws.String("replication-subnet-group-id"),
-				Values: []*string{aws.String(d.Id())}, // Must use d.Id() to work with import.
-			},
-		},
-	})
+	group, err := FindReplicationSubnetGroupByID(ctx, conn, d.Id())
 
 	if !d.IsNewResource() && tfresource.NotFound(err) {
-		create.LogNotFoundRemoveState(names.DMS, create.ErrActionReading, ResNameReplicationSubnetGroup, d.Id())
+		log.Printf("[WARN] DMS Replication Subnet Group (%s) not found, removing from state", d.Id())
 		d.SetId("")
-		return diags
+		return nil
 	}
 
 	if err != nil {
-		return create.DiagError(names.DMS, create.ErrActionReading, ResNameReplicationSubnetGroup, d.Id(), err)
-	}
-
-	if len(response.ReplicationSubnetGroups) == 0 {
-		d.SetId("")
-		return diags
+		return sdkdiag.AppendErrorf(diags, "reading DMS Replication Subnet Group (%s): %s", d.Id(), err)
 	}
 
 	// The AWS API for DMS subnet groups does not return the ARN which is required to
@@ -160,19 +122,12 @@ func resourceReplicationSubnetGroupRead(ctx context.Context, d *schema.ResourceD
 		Resource:  fmt.Sprintf("subgrp:%s", d.Id()),
 	}.String()
 	d.Set("replication_subnet_group_arn", arn)
-
-	group := response.ReplicationSubnetGroups[0]
-
-	d.SetId(aws.StringValue(group.ReplicationSubnetGroupIdentifier))
-
-	subnet_ids := []string{}
-	for _, subnet := range group.Subnets {
-		subnet_ids = append(subnet_ids, aws.StringValue(subnet.SubnetIdentifier))
-	}
-
 	d.Set("replication_subnet_group_description", group.ReplicationSubnetGroupDescription)
 	d.Set("replication_subnet_group_id", group.ReplicationSubnetGroupIdentifier)
-	d.Set("subnet_ids", subnet_ids)
+	subnetIDs := tfslices.ApplyToAll(group.Subnets, func(sn *dms.Subnet) string {
+		return aws.StringValue(sn.SubnetIdentifier)
+	})
+	d.Set("subnet_ids", subnetIDs)
 	d.Set("vpc_id", group.VpcId)
 
 	return diags
@@ -182,22 +137,23 @@ func resourceReplicationSubnetGroupUpdate(ctx context.Context, d *schema.Resourc
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).DMSConn(ctx)
 
-	// Updates to subnet groups are only valid when sending SubnetIds even if there are no
-	// changes to SubnetIds.
-	request := &dms.ModifyReplicationSubnetGroupInput{
-		ReplicationSubnetGroupIdentifier: aws.String(d.Get("replication_subnet_group_id").(string)),
-		SubnetIds:                        flex.ExpandStringSet(d.Get("subnet_ids").(*schema.Set)),
-	}
+	if d.HasChangesExcept("tags", "tags_all") {
+		// Updates to subnet groups are only valid when sending SubnetIds even if there are no
+		// changes to SubnetIds.
+		input := &dms.ModifyReplicationSubnetGroupInput{
+			ReplicationSubnetGroupIdentifier: aws.String(d.Get("replication_subnet_group_id").(string)),
+			SubnetIds:                        flex.ExpandStringSet(d.Get("subnet_ids").(*schema.Set)),
+		}
 
-	if d.HasChange("replication_subnet_group_description") {
-		request.ReplicationSubnetGroupDescription = aws.String(d.Get("replication_subnet_group_description").(string))
-	}
+		if d.HasChange("replication_subnet_group_description") {
+			input.ReplicationSubnetGroupDescription = aws.String(d.Get("replication_subnet_group_description").(string))
+		}
 
-	log.Println("[DEBUG] DMS update replication subnet group:", request)
+		_, err := conn.ModifyReplicationSubnetGroupWithContext(ctx, input)
 
-	_, err := conn.ModifyReplicationSubnetGroupWithContext(ctx, request)
-	if err != nil {
-		return create.DiagError(names.DMS, create.ErrActionUpdating, ResNameReplicationSubnetGroup, d.Id(), err)
+		if err != nil {
+			return sdkdiag.AppendErrorf(diags, "updating DMS Replication Subnet Group (%s): %s", d.Id(), err)
+		}
 	}
 
 	return append(diags, resourceReplicationSubnetGroupRead(ctx, d, meta)...)
@@ -207,17 +163,72 @@ func resourceReplicationSubnetGroupDelete(ctx context.Context, d *schema.Resourc
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).DMSConn(ctx)
 
-	request := &dms.DeleteReplicationSubnetGroupInput{
-		ReplicationSubnetGroupIdentifier: aws.String(d.Get("replication_subnet_group_id").(string)),
+	log.Printf("[DEBUG] Deleting DMS Replication Subnet Group: %s", d.Id())
+	_, err := conn.DeleteReplicationSubnetGroupWithContext(ctx, &dms.DeleteReplicationSubnetGroupInput{
+		ReplicationSubnetGroupIdentifier: aws.String(d.Id()),
+	})
+
+	if tfawserr.ErrCodeEquals(err, dms.ErrCodeResourceNotFoundFault) {
+		return diags
+	}
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "deleting DMS Replication Subnet Group (%s): %s", d.Id(), err)
+	}
+
+	return diags
+}
+
+func FindReplicationSubnetGroupByID(ctx context.Context, conn *dms.DatabaseMigrationService, id string) (*dms.ReplicationSubnetGroup, error) {
+	input := &dms.DescribeReplicationSubnetGroupsInput{
+		Filters: []*dms.Filter{
+			{
+				Name:   aws.String("replication-subnet-group-id"),
+				Values: aws.StringSlice([]string{id}),
+			},
+		},
+	}
+
+	return findReplicationSubnetGroup(ctx, conn, input)
+}
+
+func findReplicationSubnetGroup(ctx context.Context, conn *dms.DatabaseMigrationService, input *dms.DescribeReplicationSubnetGroupsInput) (*dms.ReplicationSubnetGroup, error) {
+	output, err := findReplicationSubnetGroups(ctx, conn, input)
+
+	if err != nil {
+		return nil, err
 	}
 
-	log.Printf("[DEBUG] DMS delete replication subnet group: %#v", request)
+	return tfresource.AssertSinglePtrResult(output)
+}
+
+func findReplicationSubnetGroups(ctx context.Context, conn *dms.DatabaseMigrationService, input *dms.DescribeReplicationSubnetGroupsInput) ([]*dms.ReplicationSubnetGroup, error) {
+	var output []*dms.ReplicationSubnetGroup
+
+	err := conn.DescribeReplicationSubnetGroupsPagesWithContext(ctx, input, func(page *dms.DescribeReplicationSubnetGroupsOutput, lastPage bool) bool {
+		if page == nil {
+			return !lastPage
+		}
+
+		for _, v := range page.ReplicationSubnetGroups {
+			if v != nil {
+				output = append(output, v)
+			}
+		}
+
+		return !lastPage
+	})
 
-	_, err := conn.DeleteReplicationSubnetGroupWithContext(ctx, request)
+	if tfawserr.ErrCodeEquals(err, dms.ErrCodeResourceNotFoundFault) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
 
 	if err != nil {
-		return create.DiagError(names.DMS, create.ErrActionDeleting, ResNameReplicationSubnetGroup, d.Id(), err)
+		return nil, err
 	}
 
-	return diags
+	return output, nil
 }
diff --git a/internal/service/dms/replication_subnet_group_data_source.go b/internal/service/dms/replication_subnet_group_data_source.go
index 4f18ccaad14..4af81e87e40 100644
--- a/internal/service/dms/replication_subnet_group_data_source.go
+++ b/internal/service/dms/replication_subnet_group_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package dms
 
 import (
@@ -10,10 +13,9 @@ import (
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
-	"github.com/hashicorp/terraform-provider-aws/internal/create"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
+	tfslices "github.com/hashicorp/terraform-provider-aws/internal/slices"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
-	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
-	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
 // @SDKDataSource("aws_dms_replication_subnet_group")
@@ -40,36 +42,32 @@ func DataSourceReplicationSubnetGroup() *schema.Resource {
 			},
 			"subnet_ids": {
 				Type:     schema.TypeSet,
-				Elem:     &schema.Schema{Type: schema.TypeString},
 				Computed: true,
+				Elem:     &schema.Schema{Type: schema.TypeString},
 			},
+			"tags": tftags.TagsSchemaComputed(),
 			"vpc_id": {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
-			"tags": tftags.TagsSchemaComputed(),
 		},
 	}
 }
 
-const (
-	DSNameReplicationSubnetGroup = "Replication Subnet Group Data Source"
-)
-
 func dataSourceReplicationSubnetGroupRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).DMSConn(ctx)
 	defaultTagsConfig := meta.(*conns.AWSClient).DefaultTagsConfig
 	ignoreTagsConfig := meta.(*conns.AWSClient).IgnoreTagsConfig
 
-	subnetID := d.Get("replication_subnet_group_id").(string)
+	replicationSubnetGroupID := d.Get("replication_subnet_group_id").(string)
+	group, err := FindReplicationSubnetGroupByID(ctx, conn, replicationSubnetGroupID)
 
-	out, err := FindReplicationSubnetGroupByID(ctx, conn, subnetID)
 	if err != nil {
-		return create.DiagError(names.DMS, create.ErrActionReading, DSNameReplicationSubnetGroup, d.Id(), err)
+		return sdkdiag.AppendErrorf(diags, "reading DMS Replication Subnet Group (%s): %s", replicationSubnetGroupID, err)
 	}
 
-	d.SetId(aws.StringValue(out.ReplicationSubnetGroupIdentifier))
-
+	d.SetId(aws.StringValue(group.ReplicationSubnetGroupIdentifier))
 	arn := arn.ARN{
 		Partition: meta.(*conns.AWSClient).Partition,
 		Service:   "dms",
@@ -78,49 +76,26 @@ func dataSourceReplicationSubnetGroupRead(ctx context.Context, d *schema.Resourc
 		Resource:  fmt.Sprintf("subgrp:%s", d.Id()),
 	}.String()
 	d.Set("replication_subnet_group_arn", arn)
-
-	d.Set("replication_subnet_group_description", out.ReplicationSubnetGroupDescription)
-	d.Set("replication_subnet_group_id", out.ReplicationSubnetGroupIdentifier)
-	d.Set("vpc_id", out.VpcId)
-
-	subnetIDs := []string{}
-	for _, subnet := range out.Subnets {
-		subnetIDs = append(subnetIDs, aws.StringValue(subnet.SubnetIdentifier))
-	}
+	d.Set("replication_subnet_group_description", group.ReplicationSubnetGroupDescription)
+	d.Set("replication_subnet_group_id", group.ReplicationSubnetGroupIdentifier)
+	subnetIDs := tfslices.ApplyToAll(group.Subnets, func(sn *dms.Subnet) string {
+		return aws.StringValue(sn.SubnetIdentifier)
+	})
 	d.Set("subnet_ids", subnetIDs)
+	d.Set("vpc_id", group.VpcId)
 
 	tags, err := listTags(ctx, conn, arn)
+
 	if err != nil {
-		return create.DiagError(names.DMS, create.ErrActionReading, DSNameReplicationSubnetGroup, d.Id(), err)
+		return sdkdiag.AppendErrorf(diags, "listing tags for DMS Replication Subnet Group (%s): %s", arn, err)
 	}
 
 	tags = tags.IgnoreAWS().IgnoreConfig(ignoreTagsConfig)
 
 	//lintignore:AWSR002
 	if err := d.Set("tags", tags.RemoveDefaultConfig(defaultTagsConfig).Map()); err != nil {
-		return create.DiagError(names.DMS, create.ErrActionSetting, DSNameReplicationSubnetGroup, d.Id(), err)
-	}
-	return nil
-}
-
-func FindReplicationSubnetGroupByID(ctx context.Context, conn *dms.DatabaseMigrationService, id string) (*dms.ReplicationSubnetGroup, error) {
-	input := &dms.DescribeReplicationSubnetGroupsInput{
-		Filters: []*dms.Filter{
-			{
-				Name:   aws.String("replication-subnet-group-id"),
-				Values: []*string{aws.String(id)},
-			},
-		},
-	}
-	response, err := conn.DescribeReplicationSubnetGroupsWithContext(ctx, input)
-
-	if err != nil {
-		return nil, err
-	}
-
-	if response == nil || len(response.ReplicationSubnetGroups) == 0 || response.ReplicationSubnetGroups[0] == nil {
-		return nil, tfresource.NewEmptyResultError(input)
+		return sdkdiag.AppendErrorf(diags, "setting tags: %s", err)
 	}
 
-	return response.ReplicationSubnetGroups[0], nil
+	return diags
 }
diff --git a/internal/service/dms/replication_subnet_group_data_source_test.go b/internal/service/dms/replication_subnet_group_data_source_test.go
index 4b761aba401..cdde81af4ef 100644
--- a/internal/service/dms/replication_subnet_group_data_source_test.go
+++ b/internal/service/dms/replication_subnet_group_data_source_test.go
@@ -1,7 +1,9 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package dms_test
 
 import (
-	"fmt"
 	"testing"
 
 	dms "github.com/aws/aws-sdk-go/service/databasemigrationservice"
@@ -16,22 +18,19 @@ func TestAccDMSReplicationSubnetGroupDataSource_basic(t *testing.T) {
 	resourceName := "aws_dms_replication_subnet_group.test"
 	dataSourceName := "data.aws_dms_replication_subnet_group.test"
 
-	if testing.Short() {
-		t.Skip("skipping long-running test in short mode")
-	}
-
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
 		ErrorCheck:               acctest.ErrorCheck(t, dms.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckReplicationSubnetGroupDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccReplicationSubnetGroupDataSourceConfig_basic(rName),
-				Check: resource.ComposeTestCheckFunc(
+				Check: resource.ComposeAggregateTestCheckFunc(
 					resource.TestCheckResourceAttrPair(dataSourceName, "replication_subnet_group_id", resourceName, "replication_subnet_group_id"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "replication_subnet_group_description", resourceName, "replication_subnet_group_description"),
-					resource.TestCheckResourceAttrSet(resourceName, "vpc_id"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "subnet_ids.#", resourceName, "subnet_ids.#"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "tags.%", resourceName, "tags.%"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "vpc_id", resourceName, "vpc_id"),
 				),
 			},
 		},
@@ -39,59 +38,9 @@ func TestAccDMSReplicationSubnetGroupDataSource_basic(t *testing.T) {
 }
 
 func testAccReplicationSubnetGroupDataSourceConfig_basic(rName string) string {
-	return acctest.ConfigCompose(acctest.ConfigAvailableAZsNoOptIn(), fmt.Sprintf(`
-resource "aws_vpc" "dms_vpc" {
-  cidr_block = "10.1.0.0/16"
-
-  tags = {
-    Name = "terraform-testacc-dms-replication-subnet-group-%[1]s"
-  }
-}
-
-resource "aws_subnet" "dms_subnet_1" {
-  cidr_block        = "10.1.1.0/24"
-  availability_zone = data.aws_availability_zones.available.names[0]
-  vpc_id            = aws_vpc.dms_vpc.id
-
-  tags = {
-    Name = "tf-acc-dms-replication-subnet-group-1-%[1]s"
-  }
-
-  depends_on = [aws_vpc.dms_vpc]
-}
-
-resource "aws_subnet" "dms_subnet_2" {
-  cidr_block        = "10.1.2.0/24"
-  availability_zone = data.aws_availability_zones.available.names[1]
-  vpc_id            = aws_vpc.dms_vpc.id
-
-  tags = {
-    Name = "tf-acc-dms-replication-subnet-group-2-%[1]s"
-  }
-
-  depends_on = [aws_vpc.dms_vpc]
-}
-
-resource "aws_subnet" "dms_subnet_3" {
-  cidr_block        = "10.1.3.0/24"
-  availability_zone = data.aws_availability_zones.available.names[1]
-  vpc_id            = aws_vpc.dms_vpc.id
-
-  tags = {
-    Name = "tf-acc-dms-replication-subnet-group-3-%[1]s"
-  }
-
-  depends_on = [aws_vpc.dms_vpc]
-}
-
-resource "aws_dms_replication_subnet_group" "test" {
-  replication_subnet_group_id          = %[1]q
-  replication_subnet_group_description = "terraform test for replication subnet group"
-  subnet_ids                           = [aws_subnet.dms_subnet_1.id, aws_subnet.dms_subnet_2.id]
-}
-
+	return acctest.ConfigCompose(testAccReplicationSubnetGroupConfig_basic(rName, "testing"), `
 data "aws_dms_replication_subnet_group" "test" {
   replication_subnet_group_id = aws_dms_replication_subnet_group.test.replication_subnet_group_id
 }
-`, rName))
+`)
 }
diff --git a/internal/service/dms/replication_subnet_group_test.go b/internal/service/dms/replication_subnet_group_test.go
index 684c5d87bcb..786d77d949e 100644
--- a/internal/service/dms/replication_subnet_group_test.go
+++ b/internal/service/dms/replication_subnet_group_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package dms_test
 
 import (
@@ -5,20 +8,20 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/aws"
 	dms "github.com/aws/aws-sdk-go/service/databasemigrationservice"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	tfdms "github.com/hashicorp/terraform-provider-aws/internal/service/dms"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
 func TestAccDMSReplicationSubnetGroup_basic(t *testing.T) {
 	ctx := acctest.Context(t)
-	resourceName := "aws_dms_replication_subnet_group.dms_replication_subnet_group"
-	randId := sdkacctest.RandString(8)
+	resourceName := "aws_dms_replication_subnet_group.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
@@ -27,9 +30,14 @@ func TestAccDMSReplicationSubnetGroup_basic(t *testing.T) {
 		CheckDestroy:             testAccCheckReplicationSubnetGroupDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccReplicationSubnetGroupConfig_basic(randId),
-				Check: resource.ComposeTestCheckFunc(
-					checkReplicationSubnetGroupExists(ctx, resourceName),
+				Config: testAccReplicationSubnetGroupConfig_basic(rName, "desc1"),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckReplicationSubnetGroupExists(ctx, resourceName),
+					resource.TestCheckResourceAttrSet(resourceName, "replication_subnet_group_arn"),
+					resource.TestCheckResourceAttr(resourceName, "replication_subnet_group_description", "desc1"),
+					resource.TestCheckResourceAttr(resourceName, "replication_subnet_group_id", rName),
+					resource.TestCheckResourceAttr(resourceName, "subnet_ids.#", "3"),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 					resource.TestCheckResourceAttrSet(resourceName, "vpc_id"),
 				),
 			},
@@ -39,189 +47,160 @@ func TestAccDMSReplicationSubnetGroup_basic(t *testing.T) {
 				ImportStateVerify: true,
 			},
 			{
-				Config: testAccReplicationSubnetGroupConfig_update(randId),
+				Config: testAccReplicationSubnetGroupConfig_basic(rName, "desc2"),
 				Check: resource.ComposeTestCheckFunc(
-					checkReplicationSubnetGroupExists(ctx, resourceName),
+					testAccCheckReplicationSubnetGroupExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "replication_subnet_group_description", "desc2"),
 				),
 			},
 		},
 	})
 }
 
-func checkReplicationSubnetGroupExists(ctx context.Context, n string) resource.TestCheckFunc {
-	providers := []*schema.Provider{acctest.Provider}
-	return checkReplicationSubnetGroupExistsProviders(ctx, n, &providers)
+func TestAccDMSReplicationSubnetGroup_disappears(t *testing.T) {
+	ctx := acctest.Context(t)
+	resourceName := "aws_dms_replication_subnet_group.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, dms.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckReplicationSubnetGroupDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccReplicationSubnetGroupConfig_basic(rName, "desc1"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckReplicationSubnetGroupExists(ctx, resourceName),
+					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfdms.ResourceReplicationSubnetGroup(), resourceName),
+				),
+				ExpectNonEmptyPlan: true,
+			},
+		},
+	})
 }
 
-func checkReplicationSubnetGroupExistsProviders(ctx context.Context, n string, providers *[]*schema.Provider) resource.TestCheckFunc {
+func TestAccDMSReplicationSubnetGroup_tags(t *testing.T) {
+	ctx := acctest.Context(t)
+	resourceName := "aws_dms_replication_subnet_group.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, dms.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckReplicationSubnetGroupDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccReplicationSubnetGroupConfig_tags1(rName, "key1", "value1"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckReplicationSubnetGroupExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				Config: testAccReplicationSubnetGroupConfig_tags2(rName, "key1", "value1updated", "key2", "value2"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckReplicationSubnetGroupExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1updated"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
+				),
+			},
+			{
+				Config: testAccReplicationSubnetGroupConfig_tags1(rName, "key2", "value2"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckReplicationSubnetGroupExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckReplicationSubnetGroupExists(ctx context.Context, n string) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		rs, ok := s.RootModule().Resources[n]
 		if !ok {
 			return fmt.Errorf("Not found: %s", n)
 		}
 
-		if rs.Primary.ID == "" {
-			return fmt.Errorf("No ID is set")
-		}
-		for _, provider := range *providers {
-			// Ignore if Meta is empty, this can happen for validation providers
-			if provider.Meta() == nil {
-				continue
-			}
+		conn := acctest.Provider.Meta().(*conns.AWSClient).DMSConn(ctx)
 
-			conn := provider.Meta().(*conns.AWSClient).DMSConn(ctx)
-			_, err := conn.DescribeReplicationSubnetGroupsWithContext(ctx, &dms.DescribeReplicationSubnetGroupsInput{
-				Filters: []*dms.Filter{
-					{
-						Name:   aws.String("replication-subnet-group-id"),
-						Values: []*string{aws.String(rs.Primary.ID)},
-					},
-				},
-			})
-
-			if err != nil {
-				return fmt.Errorf("DMS replication subnet group error: %v", err)
-			}
-			return nil
-		}
+		_, err := tfdms.FindReplicationSubnetGroupByID(ctx, conn, rs.Primary.ID)
 
-		return fmt.Errorf("DMS replication subnet group not found")
+		return err
 	}
 }
 
 func testAccCheckReplicationSubnetGroupDestroy(ctx context.Context) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
+		conn := acctest.Provider.Meta().(*conns.AWSClient).DMSConn(ctx)
+
 		for _, rs := range s.RootModule().Resources {
 			if rs.Type != "aws_dms_replication_subnet_group" {
 				continue
 			}
 
-			err := checkReplicationSubnetGroupExists(ctx, rs.Primary.ID)
-			if err == nil {
-				return fmt.Errorf("Found replication subnet group that was not destroyed: %s", rs.Primary.ID)
+			_, err := tfdms.FindReplicationSubnetGroupByID(ctx, conn, rs.Primary.ID)
+
+			if tfresource.NotFound(err) {
+				continue
+			}
+
+			if err != nil {
+				return err
 			}
+
+			return fmt.Errorf("DMS Replication Subnet Group %s still exists", rs.Primary.ID)
 		}
 
 		return nil
 	}
 }
 
-func testAccReplicationSubnetGroupConfig_basic(randId string) string {
-	return acctest.ConfigCompose(acctest.ConfigAvailableAZsNoOptIn(), fmt.Sprintf(`
-resource "aws_vpc" "dms_vpc" {
-  cidr_block = "10.1.0.0/16"
-
-  tags = {
-    Name = "terraform-testacc-dms-replication-subnet-group-%[1]s"
-  }
-}
-
-resource "aws_subnet" "dms_subnet_1" {
-  cidr_block        = "10.1.1.0/24"
-  availability_zone = data.aws_availability_zones.available.names[0]
-  vpc_id            = aws_vpc.dms_vpc.id
-
-  tags = {
-    Name = "tf-acc-dms-replication-subnet-group-1-%[1]s"
-  }
-
-  depends_on = [aws_vpc.dms_vpc]
+func testAccReplicationSubnetGroupConfig_basic(rName, description string) string {
+	return acctest.ConfigCompose(acctest.ConfigVPCWithSubnets(rName, 3), fmt.Sprintf(`
+resource "aws_dms_replication_subnet_group" "test" {
+  replication_subnet_group_id          = %[1]q
+  replication_subnet_group_description = %[2]q
+  subnet_ids                           = aws_subnet.test[*].id
 }
-
-resource "aws_subnet" "dms_subnet_2" {
-  cidr_block        = "10.1.2.0/24"
-  availability_zone = data.aws_availability_zones.available.names[1]
-  vpc_id            = aws_vpc.dms_vpc.id
-
-  tags = {
-    Name = "tf-acc-dms-replication-subnet-group-2-%[1]s"
-  }
-
-  depends_on = [aws_vpc.dms_vpc]
+`, rName, description))
 }
 
-resource "aws_subnet" "dms_subnet_3" {
-  cidr_block        = "10.1.3.0/24"
-  availability_zone = data.aws_availability_zones.available.names[1]
-  vpc_id            = aws_vpc.dms_vpc.id
+func testAccReplicationSubnetGroupConfig_tags1(rName, tagKey1, tagValue1 string) string {
+	return acctest.ConfigCompose(acctest.ConfigVPCWithSubnets(rName, 3), fmt.Sprintf(`
+resource "aws_dms_replication_subnet_group" "test" {
+  replication_subnet_group_id          = %[1]q
+  replication_subnet_group_description = "testing"
+  subnet_ids                           = aws_subnet.test[*].id
 
   tags = {
-    Name = "tf-acc-dms-replication-subnet-group-3-%[1]s"
+    %[2]q = %[3]q
   }
-
-  depends_on = [aws_vpc.dms_vpc]
 }
-
-resource "aws_dms_replication_subnet_group" "dms_replication_subnet_group" {
-  replication_subnet_group_id          = "tf-test-dms-replication-subnet-group-%[1]s"
-  replication_subnet_group_description = "terraform test for replication subnet group"
-  subnet_ids                           = [aws_subnet.dms_subnet_1.id, aws_subnet.dms_subnet_2.id]
-
-  tags = {
-    Name   = "tf-test-dms-replication-subnet-group-%[1]s"
-    Update = "to-update"
-    Remove = "to-remove"
-  }
-}
-`, randId))
-}
-
-func testAccReplicationSubnetGroupConfig_update(randId string) string {
-	return acctest.ConfigCompose(acctest.ConfigAvailableAZsNoOptIn(), fmt.Sprintf(`
-resource "aws_vpc" "dms_vpc" {
-  cidr_block = "10.1.0.0/16"
-
-  tags = {
-    Name = "terraform-testacc-dms-replication-subnet-group-%[1]s"
-  }
-}
-
-resource "aws_subnet" "dms_subnet_1" {
-  cidr_block        = "10.1.1.0/24"
-  availability_zone = data.aws_availability_zones.available.names[0]
-  vpc_id            = aws_vpc.dms_vpc.id
-
-  tags = {
-    Name = "tf-acc-dms-replication-subnet-group-1-%[1]s"
-  }
-
-  depends_on = [aws_vpc.dms_vpc]
-}
-
-resource "aws_subnet" "dms_subnet_2" {
-  cidr_block        = "10.1.2.0/24"
-  availability_zone = data.aws_availability_zones.available.names[1]
-  vpc_id            = aws_vpc.dms_vpc.id
-
-  tags = {
-    Name = "tf-acc-dms-replication-subnet-group-2-%[1]s"
-  }
-
-  depends_on = [aws_vpc.dms_vpc]
-}
-
-resource "aws_subnet" "dms_subnet_3" {
-  cidr_block        = "10.1.3.0/24"
-  availability_zone = data.aws_availability_zones.available.names[1]
-  vpc_id            = aws_vpc.dms_vpc.id
-
-  tags = {
-    Name = "tf-acc-dms-replication-subnet-group-3-%[1]s"
-  }
-
-  depends_on = [aws_vpc.dms_vpc]
+`, rName, tagKey1, tagValue1))
 }
 
-resource "aws_dms_replication_subnet_group" "dms_replication_subnet_group" {
-  replication_subnet_group_id          = "tf-test-dms-replication-subnet-group-%[1]s"
-  replication_subnet_group_description = "terraform test for replication subnet group"
-  subnet_ids                           = [aws_subnet.dms_subnet_1.id, aws_subnet.dms_subnet_3.id]
+func testAccReplicationSubnetGroupConfig_tags2(rName, tagKey1, tagValue1, tagKey2, tagValue2 string) string {
+	return acctest.ConfigCompose(acctest.ConfigVPCWithSubnets(rName, 3), fmt.Sprintf(`
+resource "aws_dms_replication_subnet_group" "test" {
+  replication_subnet_group_id          = %[1]q
+  replication_subnet_group_description = "testing"
+  subnet_ids                           = aws_subnet.test[*].id
 
   tags = {
-    Name   = "tf-test-dms-replication-subnet-group-%[1]s"
-    Update = "updated"
-    Add    = "added"
+    %[2]q = %[3]q
+    %[4]q = %[5]q
   }
 }
-`, randId))
+`, rName, tagKey1, tagValue1, tagKey2, tagValue2))
 }
diff --git a/internal/service/dms/replication_task.go b/internal/service/dms/replication_task.go
index 2cb4a4a7e6a..162a3875c16 100644
--- a/internal/service/dms/replication_task.go
+++ b/internal/service/dms/replication_task.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package dms
 
 import (
@@ -12,6 +15,7 @@ import (
 	dms "github.com/aws/aws-sdk-go/service/databasemigrationservice"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
@@ -232,7 +236,11 @@ func resourceReplicationTaskUpdate(ctx context.Context, d *schema.ResourceData,
 		}
 
 		if d.HasChange("replication_task_settings") {
-			input.ReplicationTaskSettings = aws.String(d.Get("replication_task_settings").(string))
+			if v, ok := d.Get("replication_task_settings").(string); ok && v != "" {
+				input.ReplicationTaskSettings = aws.String(v)
+			} else {
+				input.ReplicationTaskSettings = nil
+			}
 		}
 
 		status := d.Get("status").(string)
@@ -405,3 +413,152 @@ func stopReplicationTask(ctx context.Context, id string, conn *dms.DatabaseMigra
 
 	return nil
 }
+
+func FindReplicationTaskByID(ctx context.Context, conn *dms.DatabaseMigrationService, id string) (*dms.ReplicationTask, error) {
+	input := &dms.DescribeReplicationTasksInput{
+		Filters: []*dms.Filter{
+			{
+				Name:   aws.String("replication-task-id"),
+				Values: []*string{aws.String(id)}, // Must use d.Id() to work with import.
+			},
+		},
+	}
+
+	var results []*dms.ReplicationTask
+
+	err := conn.DescribeReplicationTasksPagesWithContext(ctx, input, func(page *dms.DescribeReplicationTasksOutput, lastPage bool) bool {
+		if page == nil {
+			return !lastPage
+		}
+
+		for _, task := range page.ReplicationTasks {
+			if task == nil {
+				continue
+			}
+			results = append(results, task)
+		}
+
+		return !lastPage
+	})
+
+	if tfawserr.ErrCodeEquals(err, dms.ErrCodeResourceNotFoundFault) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	if len(results) == 0 {
+		return nil, tfresource.NewEmptyResultError(input)
+	}
+
+	if count := len(results); count > 1 {
+		return nil, tfresource.NewTooManyResultsError(count, input)
+	}
+
+	return results[0], nil
+}
+
+func statusReplicationTask(ctx context.Context, conn *dms.DatabaseMigrationService, id string) retry.StateRefreshFunc {
+	return func() (interface{}, string, error) {
+		output, err := FindReplicationTaskByID(ctx, conn, id)
+
+		if tfresource.NotFound(err) {
+			return nil, "", nil
+		}
+
+		if err != nil {
+			return nil, "", err
+		}
+
+		return output, aws.StringValue(output.Status), nil
+	}
+}
+
+const (
+	replicationTaskRunningTimeout = 5 * time.Minute
+)
+
+func waitReplicationTaskDeleted(ctx context.Context, conn *dms.DatabaseMigrationService, id string, timeout time.Duration) error {
+	stateConf := &retry.StateChangeConf{
+		Pending:    []string{replicationTaskStatusDeleting},
+		Target:     []string{},
+		Refresh:    statusReplicationTask(ctx, conn, id),
+		Timeout:    timeout,
+		MinTimeout: 10 * time.Second,
+		Delay:      30 * time.Second, // Wait 30 secs before starting
+	}
+
+	// Wait, catching any errors
+	_, err := stateConf.WaitForStateContext(ctx)
+
+	return err
+}
+
+func waitReplicationTaskModified(ctx context.Context, conn *dms.DatabaseMigrationService, id string, timeout time.Duration) error {
+	stateConf := &retry.StateChangeConf{
+		Pending:    []string{replicationTaskStatusModifying},
+		Target:     []string{replicationTaskStatusReady, replicationTaskStatusStopped, replicationTaskStatusFailed},
+		Refresh:    statusReplicationTask(ctx, conn, id),
+		Timeout:    timeout,
+		MinTimeout: 10 * time.Second,
+		Delay:      30 * time.Second, // Wait 30 secs before starting
+	}
+
+	// Wait, catching any errors
+	_, err := stateConf.WaitForStateContext(ctx)
+
+	return err
+}
+
+func waitReplicationTaskReady(ctx context.Context, conn *dms.DatabaseMigrationService, id string, timeout time.Duration) error {
+	stateConf := &retry.StateChangeConf{
+		Pending:    []string{replicationTaskStatusCreating},
+		Target:     []string{replicationTaskStatusReady},
+		Refresh:    statusReplicationTask(ctx, conn, id),
+		Timeout:    timeout,
+		MinTimeout: 10 * time.Second,
+		Delay:      30 * time.Second, // Wait 30 secs before starting
+	}
+
+	// Wait, catching any errors
+	_, err := stateConf.WaitForStateContext(ctx)
+
+	return err
+}
+
+func waitReplicationTaskRunning(ctx context.Context, conn *dms.DatabaseMigrationService, id string) error {
+	stateConf := &retry.StateChangeConf{
+		Pending:    []string{replicationTaskStatusStarting},
+		Target:     []string{replicationTaskStatusRunning},
+		Refresh:    statusReplicationTask(ctx, conn, id),
+		Timeout:    replicationTaskRunningTimeout,
+		MinTimeout: 10 * time.Second,
+		Delay:      30 * time.Second, // Wait 30 secs before starting
+	}
+
+	// Wait, catching any errors
+	_, err := stateConf.WaitForStateContext(ctx)
+
+	return err
+}
+
+func waitReplicationTaskStopped(ctx context.Context, conn *dms.DatabaseMigrationService, id string) error {
+	stateConf := &retry.StateChangeConf{
+		Pending:    []string{replicationTaskStatusStopping, replicationTaskStatusRunning},
+		Target:     []string{replicationTaskStatusStopped},
+		Refresh:    statusReplicationTask(ctx, conn, id),
+		Timeout:    replicationTaskRunningTimeout,
+		MinTimeout: 10 * time.Second,
+		Delay:      60 * time.Second, // Wait 30 secs before starting
+	}
+
+	// Wait, catching any errors
+	_, err := stateConf.WaitForStateContext(ctx)
+
+	return err
+}
diff --git a/internal/service/dms/replication_task_data_source.go b/internal/service/dms/replication_task_data_source.go
index b3a316506ef..f69f06cd2ee 100644
--- a/internal/service/dms/replication_task_data_source.go
+++ b/internal/service/dms/replication_task_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package dms
 
 import (
diff --git a/internal/service/dms/replication_task_data_source_test.go b/internal/service/dms/replication_task_data_source_test.go
index 8cd2658aaeb..0fcde0c5746 100644
--- a/internal/service/dms/replication_task_data_source_test.go
+++ b/internal/service/dms/replication_task_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package dms_test
 
 import (
diff --git a/internal/service/dms/replication_task_test.go b/internal/service/dms/replication_task_test.go
index f66765f2bea..4563e1b16a9 100644
--- a/internal/service/dms/replication_task_test.go
+++ b/internal/service/dms/replication_task_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package dms_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	dms "github.com/aws/aws-sdk-go/service/databasemigrationservice"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -81,8 +84,8 @@ func TestAccDMSReplicationTask_update(t *testing.T) {
 					testAccCheckReplicationTaskExists(ctx, resourceName),
 					resource.TestCheckResourceAttrSet(resourceName, "replication_task_arn"),
 					resource.TestCheckResourceAttr(resourceName, "migration_type", "full-load"),
-					resource.TestMatchResourceAttr(resourceName, "replication_task_settings", regexp.MustCompile("MemoryLimitTotal\":1024")),
-					resource.TestMatchResourceAttr(resourceName, "table_mappings", regexp.MustCompile("rule-name\":\"ZedsDead")),
+					resource.TestMatchResourceAttr(resourceName, "replication_task_settings", regexache.MustCompile("MemoryLimitTotal\":1024")),
+					resource.TestMatchResourceAttr(resourceName, "table_mappings", regexache.MustCompile("rule-name\":\"ZedsDead")),
 				),
 			},
 			{
@@ -90,8 +93,8 @@ func TestAccDMSReplicationTask_update(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckReplicationTaskExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "migration_type", "full-load"),
-					resource.TestMatchResourceAttr(resourceName, "replication_task_settings", regexp.MustCompile("MemoryLimitTotal\":1024")),
-					resource.TestMatchResourceAttr(resourceName, "table_mappings", regexp.MustCompile("rule-name\":\"EMBRZ")),
+					resource.TestMatchResourceAttr(resourceName, "replication_task_settings", regexache.MustCompile("MemoryLimitTotal\":1024")),
+					resource.TestMatchResourceAttr(resourceName, "table_mappings", regexache.MustCompile("rule-name\":\"EMBRZ")),
 				),
 			},
 			{
@@ -105,8 +108,8 @@ func TestAccDMSReplicationTask_update(t *testing.T) {
 					testAccCheckReplicationTaskExists(ctx, resourceName),
 					resource.TestCheckResourceAttrSet(resourceName, "replication_task_arn"),
 					resource.TestCheckResourceAttr(resourceName, "migration_type", "full-load"),
-					resource.TestMatchResourceAttr(resourceName, "replication_task_settings", regexp.MustCompile("MemoryLimitTotal\":1248")),
-					resource.TestMatchResourceAttr(resourceName, "table_mappings", regexp.MustCompile("rule-name\":\"ZedsDead")),
+					resource.TestMatchResourceAttr(resourceName, "replication_task_settings", regexache.MustCompile("MemoryLimitTotal\":1248")),
+					resource.TestMatchResourceAttr(resourceName, "table_mappings", regexache.MustCompile("rule-name\":\"ZedsDead")),
 				),
 			},
 			{
@@ -114,8 +117,8 @@ func TestAccDMSReplicationTask_update(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckReplicationTaskExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "migration_type", "full-load"),
-					resource.TestMatchResourceAttr(resourceName, "replication_task_settings", regexp.MustCompile("MemoryLimitTotal\":1024")),
-					resource.TestMatchResourceAttr(resourceName, "table_mappings", regexp.MustCompile("rule-name\":\"ZedsDead")),
+					resource.TestMatchResourceAttr(resourceName, "replication_task_settings", regexache.MustCompile("MemoryLimitTotal\":1024")),
+					resource.TestMatchResourceAttr(resourceName, "table_mappings", regexache.MustCompile("rule-name\":\"ZedsDead")),
 				),
 			},
 			{
@@ -129,8 +132,8 @@ func TestAccDMSReplicationTask_update(t *testing.T) {
 					testAccCheckReplicationTaskExists(ctx, resourceName),
 					resource.TestCheckResourceAttrSet(resourceName, "replication_task_arn"),
 					resource.TestCheckResourceAttr(resourceName, "migration_type", "full-load"),
-					resource.TestMatchResourceAttr(resourceName, "replication_task_settings", regexp.MustCompile("MemoryLimitTotal\":1248")),
-					resource.TestMatchResourceAttr(resourceName, "table_mappings", regexp.MustCompile("rule-name\":\"ZedsDead")),
+					resource.TestMatchResourceAttr(resourceName, "replication_task_settings", regexache.MustCompile("MemoryLimitTotal\":1248")),
+					resource.TestMatchResourceAttr(resourceName, "table_mappings", regexache.MustCompile("rule-name\":\"ZedsDead")),
 				),
 			},
 			{
@@ -138,8 +141,8 @@ func TestAccDMSReplicationTask_update(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckReplicationTaskExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "migration_type", "full-load"),
-					resource.TestMatchResourceAttr(resourceName, "replication_task_settings", regexp.MustCompile("MemoryLimitTotal\":1024")),
-					resource.TestMatchResourceAttr(resourceName, "table_mappings", regexp.MustCompile("rule-name\":\"EMBRZ")),
+					resource.TestMatchResourceAttr(resourceName, "replication_task_settings", regexache.MustCompile("MemoryLimitTotal\":1024")),
+					resource.TestMatchResourceAttr(resourceName, "table_mappings", regexache.MustCompile("rule-name\":\"EMBRZ")),
 				),
 			},
 			{
@@ -525,9 +528,19 @@ resource "aws_db_subnet_group" "test" {
   }
 }
 
+data "aws_rds_engine_version" "default" {
+  engine = "aurora-mysql"
+}
+
+data "aws_rds_orderable_db_instance" "test" {
+  engine                     = data.aws_rds_engine_version.default.engine
+  engine_version             = data.aws_rds_engine_version.default.version
+  preferred_instance_classes = ["db.t3.small", "db.t3.medium", "db.t3.large"]
+}
+
 resource "aws_rds_cluster_parameter_group" "test" {
   name        = "%[1]s-pg-cluster"
-  family      = "aurora-mysql5.7"
+  family      = data.aws_rds_engine_version.default.parameter_group_family
   description = "DMS cluster parameter group"
 
   parameter {
@@ -549,10 +562,10 @@ resource "aws_rds_cluster_parameter_group" "test" {
   }
 }
 
-resource "aws_rds_cluster" "test1" {
+resource "aws_rds_cluster" "source" {
   cluster_identifier              = "%[1]s-aurora-cluster-source"
-  engine                          = "aurora-mysql"
-  engine_version                  = "5.7.mysql_aurora.2.11.2"
+  engine                          = data.aws_rds_orderable_db_instance.test.engine
+  engine_version                  = data.aws_rds_orderable_db_instance.test.engine_version
   database_name                   = "tftest"
   master_username                 = "tftest"
   master_password                 = "mustbeeightcharaters"
@@ -562,19 +575,19 @@ resource "aws_rds_cluster" "test1" {
   db_cluster_parameter_group_name = aws_rds_cluster_parameter_group.test.name
 }
 
-resource "aws_rds_cluster_instance" "test1" {
-  identifier           = "%[1]s-test1-primary"
-  cluster_identifier   = aws_rds_cluster.test1.id
-  instance_class       = "db.t2.small"
-  engine               = aws_rds_cluster.test1.engine
-  engine_version       = aws_rds_cluster.test1.engine_version
+resource "aws_rds_cluster_instance" "source" {
+  identifier           = "%[1]s-source-primary"
+  cluster_identifier   = aws_rds_cluster.source.id
+  engine               = data.aws_rds_orderable_db_instance.test.engine
+  engine_version       = data.aws_rds_orderable_db_instance.test.engine_version
+  instance_class       = data.aws_rds_orderable_db_instance.test.instance_class
   db_subnet_group_name = aws_db_subnet_group.test.name
 }
 
-resource "aws_rds_cluster" "test2" {
+resource "aws_rds_cluster" "target" {
   cluster_identifier     = "%[1]s-aurora-cluster-target"
-  engine                 = "aurora-mysql"
-  engine_version         = "5.7.mysql_aurora.2.11.2"
+  engine                 = data.aws_rds_orderable_db_instance.test.engine
+  engine_version         = data.aws_rds_orderable_db_instance.test.engine_version
   database_name          = "tftest"
   master_username        = "tftest"
   master_password        = "mustbeeightcharaters"
@@ -583,12 +596,12 @@ resource "aws_rds_cluster" "test2" {
   db_subnet_group_name   = aws_db_subnet_group.test.name
 }
 
-resource "aws_rds_cluster_instance" "test2" {
-  identifier           = "%[1]s-test2-primary"
-  cluster_identifier   = aws_rds_cluster.test2.id
-  instance_class       = "db.t2.small"
-  engine               = aws_rds_cluster.test2.engine
-  engine_version       = aws_rds_cluster.test2.engine_version
+resource "aws_rds_cluster_instance" "target" {
+  identifier           = "%[1]s-target-primary"
+  cluster_identifier   = aws_rds_cluster.target.id
+  engine               = data.aws_rds_orderable_db_instance.test.engine
+  engine_version       = data.aws_rds_orderable_db_instance.test.engine_version
+  instance_class       = data.aws_rds_orderable_db_instance.test.instance_class
   db_subnet_group_name = aws_db_subnet_group.test.name
 }
 
@@ -597,7 +610,7 @@ resource "aws_dms_endpoint" "source" {
   endpoint_id   = "%[1]s-source"
   endpoint_type = "source"
   engine_name   = "aurora"
-  server_name   = aws_rds_cluster.test1.endpoint
+  server_name   = aws_rds_cluster.source.endpoint
   port          = 3306
   username      = "tftest"
   password      = "mustbeeightcharaters"
@@ -608,7 +621,7 @@ resource "aws_dms_endpoint" "target" {
   endpoint_id   = "%[1]s-target"
   endpoint_type = "target"
   engine_name   = "aurora"
-  server_name   = aws_rds_cluster.test2.endpoint
+  server_name   = aws_rds_cluster.target.endpoint
   port          = 3306
   username      = "tftest"
   password      = "mustbeeightcharaters"
@@ -647,7 +660,7 @@ resource "aws_dms_replication_task" "test" {
 
   target_endpoint_arn = aws_dms_endpoint.target.endpoint_arn
 
-  depends_on = [aws_rds_cluster_instance.test1, aws_rds_cluster_instance.test2]
+  depends_on = [aws_rds_cluster_instance.source, aws_rds_cluster_instance.target]
 }
 `, rName, startTask, ruleName))
 }
diff --git a/internal/service/dms/s3_endpoint.go b/internal/service/dms/s3_endpoint.go
index 27c2fd07c51..13aedc90725 100644
--- a/internal/service/dms/s3_endpoint.go
+++ b/internal/service/dms/s3_endpoint.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package dms
 
 import (
@@ -242,6 +245,11 @@ func ResourceS3Endpoint() *schema.Resource {
 					return json
 				},
 			},
+			"glue_catalog_generation": {
+				Type:     schema.TypeBool,
+				Optional: true,
+				Default:  false,
+			},
 			"ignore_header_rows": {
 				Type:         schema.TypeInt,
 				Optional:     true,
@@ -457,6 +465,7 @@ func resourceS3EndpointRead(ctx context.Context, d *schema.ResourceData, meta in
 		d.Set("date_partition_sequence", s3settings.DatePartitionSequence)
 		d.Set("date_partition_timezone", s3settings.DatePartitionTimezone)
 		d.Set("encryption_mode", s3settings.EncryptionMode)
+		d.Set("glue_catalog_generation", s3settings.GlueCatalogGeneration)
 		d.Set("parquet_timestamp_in_millisecond", s3settings.ParquetTimestampInMillisecond)
 		d.Set("parquet_version", s3settings.ParquetVersion)
 		d.Set("preserve_transactions", s3settings.PreserveTransactions)
@@ -567,8 +576,8 @@ func s3Settings(d *schema.ResourceData, target bool) *dms.S3Settings {
 		s3s.AddColumnName = aws.Bool(v)
 	}
 
-	if v, ok := d.Get("add_trailing_padding_character").(bool); ok && target { // target
-		s3s.AddTrailingPaddingCharacter = aws.Bool(v)
+	if v, ok := d.GetOk("add_trailing_padding_character"); ok && target { // target
+		s3s.AddTrailingPaddingCharacter = aws.Bool(v.(bool))
 	}
 
 	if v, ok := d.GetOk("bucket_folder"); ok {
@@ -671,6 +680,10 @@ func s3Settings(d *schema.ResourceData, target bool) *dms.S3Settings {
 		s3s.ExternalTableDefinition = aws.String(v.(string))
 	}
 
+	if v, ok := d.Get("glue_catalog_generation").(bool); ok { // target
+		s3s.GlueCatalogGeneration = aws.Bool(v)
+	}
+
 	if v, ok := d.GetOk("ignore_header_rows"); ok {
 		s3s.IgnoreHeaderRows = aws.Int64(int64(v.(int)))
 	}
diff --git a/internal/service/dms/s3_endpoint_test.go b/internal/service/dms/s3_endpoint_test.go
index d234512f4c1..747e44cd414 100644
--- a/internal/service/dms/s3_endpoint_test.go
+++ b/internal/service/dms/s3_endpoint_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package dms_test
 
 import (
@@ -51,6 +54,7 @@ func TestAccDMSS3Endpoint_basic(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "encoding_type", "plain"),
 					resource.TestCheckResourceAttr(resourceName, "encryption_mode", "SSE_S3"),
 					resource.TestCheckResourceAttrPair(resourceName, "expected_bucket_owner", "data.aws_caller_identity.current", "account_id"),
+					resource.TestCheckResourceAttr(resourceName, "glue_catalog_generation", "true"),
 					resource.TestCheckResourceAttr(resourceName, "ignore_header_rows", "1"),
 					resource.TestCheckResourceAttr(resourceName, "include_op_for_full_load", "true"),
 					resource.TestCheckResourceAttr(resourceName, "max_file_size", "1000000"),
@@ -115,6 +119,7 @@ func TestAccDMSS3Endpoint_update(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "encoding_type", "plain"),
 					resource.TestCheckResourceAttr(resourceName, "encryption_mode", "SSE_S3"),
 					resource.TestCheckResourceAttrPair(resourceName, "expected_bucket_owner", "data.aws_caller_identity.current", "account_id"),
+					resource.TestCheckResourceAttr(resourceName, "glue_catalog_generation", "true"),
 					resource.TestCheckResourceAttr(resourceName, "ignore_header_rows", "1"),
 					resource.TestCheckResourceAttr(resourceName, "include_op_for_full_load", "true"),
 					resource.TestCheckResourceAttr(resourceName, "max_file_size", "1000000"),
@@ -160,6 +165,7 @@ func TestAccDMSS3Endpoint_update(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "encoding_type", "plain"),
 					resource.TestCheckResourceAttr(resourceName, "encryption_mode", "SSE_S3"),
 					resource.TestCheckResourceAttrPair(resourceName, "expected_bucket_owner", "data.aws_caller_identity.current", "account_id"),
+					resource.TestCheckResourceAttr(resourceName, "glue_catalog_generation", "false"),
 					resource.TestCheckResourceAttr(resourceName, "ignore_header_rows", "1"),
 					resource.TestCheckResourceAttr(resourceName, "include_op_for_full_load", "false"),
 					resource.TestCheckResourceAttr(resourceName, "max_file_size", "900000"),
@@ -220,6 +226,7 @@ func TestAccDMSS3Endpoint_simple(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "encoding_type", ""),
 					resource.TestCheckResourceAttr(resourceName, "encryption_mode", ""),
 					resource.TestCheckResourceAttr(resourceName, "expected_bucket_owner", ""),
+					resource.TestCheckResourceAttr(resourceName, "glue_catalog_generation", "false"),
 					resource.TestCheckResourceAttr(resourceName, "ignore_header_rows", "0"),
 					resource.TestCheckResourceAttr(resourceName, "include_op_for_full_load", "false"),
 					resource.TestCheckResourceAttr(resourceName, "max_file_size", "0"),
@@ -299,7 +306,7 @@ func TestAccDMSS3Endpoint_sourceSimple(t *testing.T) {
 				ResourceName:            resourceName,
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"compression_type", "date_partition_enabled", "parquet_timestamp_in_millisecond", "preserve_transactions", "use_csv_no_sup_value"},
+				ImportStateVerifyIgnore: []string{"compression_type", "date_partition_enabled", "parquet_timestamp_in_millisecond", "preserve_transactions", "use_csv_no_sup_value", "glue_catalog_generation"},
 			},
 		},
 	})
@@ -559,6 +566,7 @@ resource "aws_dms_s3_endpoint" "test" {
   timestamp_column_name                       = "tx_commit_time"
   use_csv_no_sup_value                        = false
   use_task_start_time_for_full_load_timestamp = true
+  glue_catalog_generation                     = true
 
   depends_on = [aws_iam_role_policy.test]
 }
@@ -637,6 +645,7 @@ resource "aws_dms_s3_endpoint" "test" {
   timestamp_column_name                       = "tx_commit_time2"
   use_csv_no_sup_value                        = true
   use_task_start_time_for_full_load_timestamp = false
+  glue_catalog_generation                     = false
 
   depends_on = [aws_iam_role_policy.test]
 }
diff --git a/internal/service/dms/service_package_gen.go b/internal/service/dms/service_package_gen.go
index 58032ac713c..d48ac2af062 100644
--- a/internal/service/dms/service_package_gen.go
+++ b/internal/service/dms/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	databasemigrationservice_sdkv1 "github.com/aws/aws-sdk-go/service/databasemigrationservice"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -73,6 +74,14 @@ func (p *servicePackage) SDKResources(ctx context.Context) []*types.ServicePacka
 				IdentifierAttribute: "arn",
 			},
 		},
+		{
+			Factory:  ResourceReplicationConfig,
+			TypeName: "aws_dms_replication_config",
+			Name:     "Replication Config",
+			Tags: &types.ServicePackageResourceTags{
+				IdentifierAttribute: "id",
+			},
+		},
 		{
 			Factory:  ResourceReplicationInstance,
 			TypeName: "aws_dms_replication_instance",
@@ -119,4 +128,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*d
 	return databasemigrationservice_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/dms/status.go b/internal/service/dms/status.go
deleted file mode 100644
index f6874d3b043..00000000000
--- a/internal/service/dms/status.go
+++ /dev/null
@@ -1,42 +0,0 @@
-package dms
-
-import (
-	"context"
-
-	"github.com/aws/aws-sdk-go/aws"
-	dms "github.com/aws/aws-sdk-go/service/databasemigrationservice"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
-	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
-)
-
-func statusEndpoint(ctx context.Context, conn *dms.DatabaseMigrationService, id string) retry.StateRefreshFunc {
-	return func() (interface{}, string, error) {
-		output, err := FindEndpointByID(ctx, conn, id)
-
-		if tfresource.NotFound(err) {
-			return nil, "", nil
-		}
-
-		if err != nil {
-			return nil, "", err
-		}
-
-		return output, aws.StringValue(output.Status), nil
-	}
-}
-
-func statusReplicationTask(ctx context.Context, conn *dms.DatabaseMigrationService, id string) retry.StateRefreshFunc {
-	return func() (interface{}, string, error) {
-		output, err := FindReplicationTaskByID(ctx, conn, id)
-
-		if tfresource.NotFound(err) {
-			return nil, "", nil
-		}
-
-		if err != nil {
-			return nil, "", err
-		}
-
-		return output, aws.StringValue(output.Status), nil
-	}
-}
diff --git a/internal/service/dms/sweep.go b/internal/service/dms/sweep.go
index 305db463bc2..fa4c790edd5 100644
--- a/internal/service/dms/sweep.go
+++ b/internal/service/dms/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package dms
 
@@ -9,49 +9,65 @@ import (
 
 	"github.com/aws/aws-sdk-go/aws"
 	dms "github.com/aws/aws-sdk-go/service/databasemigrationservice"
-	"github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
+	resource.AddTestSweepers("aws_dms_endpoint", &resource.Sweeper{
+		Name: "aws_dms_endpoint",
+		F:    sweepEndpoints,
+		Dependencies: []string{
+			"aws_dms_replication_config",
+		},
+	})
+
+	resource.AddTestSweepers("aws_dms_replication_config", &resource.Sweeper{
+		Name: "aws_dms_replication_config",
+		F:    sweepReplicationConfigs,
+	})
+
 	resource.AddTestSweepers("aws_dms_replication_instance", &resource.Sweeper{
 		Name: "aws_dms_replication_instance",
 		F:    sweepReplicationInstances,
 		Dependencies: []string{
+			"aws_dms_replication_subnet_group",
 			"aws_dms_replication_task",
 		},
 	})
 
+	resource.AddTestSweepers("aws_dms_replication_subnet_group", &resource.Sweeper{
+		Name: "aws_dms_replication_subnet_group",
+		F:    sweepReplicationSubnetGroups,
+	})
+
 	resource.AddTestSweepers("aws_dms_replication_task", &resource.Sweeper{
 		Name: "aws_dms_replication_task",
 		F:    sweepReplicationTasks,
 	})
-
-	resource.AddTestSweepers("aws_dms_endpoint", &resource.Sweeper{
-		Name: "aws_dms_endpoint",
-		F:    sweepEndpoints,
-	})
 }
 
-func sweepReplicationInstances(region string) error {
+func sweepEndpoints(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
-
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
-
 	conn := client.DMSConn(ctx)
+	input := &dms.DescribeEndpointsInput{}
 	sweepResources := make([]sweep.Sweepable, 0)
-	var errs *multierror.Error
 
-	err = conn.DescribeReplicationInstancesPagesWithContext(ctx, &dms.DescribeReplicationInstancesInput{}, func(page *dms.DescribeReplicationInstancesOutput, lastPage bool) bool {
-		for _, instance := range page.ReplicationInstances {
-			r := ResourceReplicationInstance()
+	err = conn.DescribeEndpointsPagesWithContext(ctx, input, func(page *dms.DescribeEndpointsOutput, lastPage bool) bool {
+		if page == nil {
+			return !lastPage
+		}
+
+		for _, v := range page.Endpoints {
+			r := ResourceEndpoint()
 			d := r.Data(nil)
-			d.Set("replication_instance_arn", instance.ReplicationInstanceArn)
-			d.SetId(aws.StringValue(instance.ReplicationInstanceIdentifier))
+			d.SetId(aws.StringValue(v.EndpointIdentifier))
+			d.Set("endpoint_arn", v.EndpointArn)
 
 			sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
 		}
@@ -59,43 +75,43 @@ func sweepReplicationInstances(region string) error {
 		return !lastPage
 	})
 
-	if err != nil {
-		errs = multierror.Append(errs, fmt.Errorf("error describing DMS Replication Instances: %w", err))
+	if awsv1.SkipSweepError(err) {
+		log.Printf("[WARN] Skipping DMS Endpoint sweep for %s: %s", region, err)
+		return nil
 	}
 
-	if err = sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
-		errs = multierror.Append(errs, fmt.Errorf("error sweeping DMS Replication Instances for %s: %w", region, err))
+	if err != nil {
+		return fmt.Errorf("error listing DMS Endpoints (%s): %w", region, err)
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
-		log.Printf("[WARN] Skipping DMS Replication Instance sweep for %s: %s", region, err)
-		return nil
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
+
+	if err != nil {
+		return fmt.Errorf("error sweeping DMS Endpoints (%s): %w", region, err)
 	}
 
-	return errs.ErrorOrNil()
+	return nil
 }
 
-func sweepReplicationTasks(region string) error {
+func sweepReplicationConfigs(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
-
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
-
 	conn := client.DMSConn(ctx)
+	input := &dms.DescribeReplicationConfigsInput{}
 	sweepResources := make([]sweep.Sweepable, 0)
-	var errs *multierror.Error
 
-	input := &dms.DescribeReplicationTasksInput{
-		WithoutSettings: aws.Bool(true),
-	}
-	err = conn.DescribeReplicationTasksPagesWithContext(ctx, input, func(page *dms.DescribeReplicationTasksOutput, lastPage bool) bool {
-		for _, instance := range page.ReplicationTasks {
-			r := ResourceReplicationTask()
+	err = conn.DescribeReplicationConfigsPagesWithContext(ctx, input, func(page *dms.DescribeReplicationConfigsOutput, lastPage bool) bool {
+		if page == nil {
+			return !lastPage
+		}
+
+		for _, v := range page.ReplicationConfigs {
+			r := ResourceReplicationConfig()
 			d := r.Data(nil)
-			d.SetId(aws.StringValue(instance.ReplicationTaskIdentifier))
-			d.Set("replication_task_arn", instance.ReplicationTaskArn)
+			d.SetId(aws.StringValue(v.ReplicationConfigArn))
 
 			sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
 		}
@@ -103,40 +119,88 @@ func sweepReplicationTasks(region string) error {
 		return !lastPage
 	})
 
+	if awsv1.SkipSweepError(err) {
+		log.Printf("[WARN] Skipping DMS Replication Config sweep for %s: %s", region, err)
+		return nil
+	}
+
 	if err != nil {
-		errs = multierror.Append(errs, fmt.Errorf("error describing DMS Replication Tasks: %w", err))
+		return fmt.Errorf("error listing DMS Replication Configs (%s): %w", region, err)
 	}
 
-	if err = sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
-		errs = multierror.Append(errs, fmt.Errorf("error sweeping DMS Replication Tasks for %s: %w", region, err))
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
+
+	if err != nil {
+		return fmt.Errorf("error sweeping DMS Replication Configs (%s): %w", region, err)
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
+	return nil
+}
+
+func sweepReplicationInstances(region string) error {
+	ctx := sweep.Context(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
+	if err != nil {
+		return fmt.Errorf("error getting client: %s", err)
+	}
+	conn := client.DMSConn(ctx)
+	input := &dms.DescribeReplicationInstancesInput{}
+	sweepResources := make([]sweep.Sweepable, 0)
+
+	err = conn.DescribeReplicationInstancesPagesWithContext(ctx, input, func(page *dms.DescribeReplicationInstancesOutput, lastPage bool) bool {
+		if page == nil {
+			return !lastPage
+		}
+
+		for _, v := range page.ReplicationInstances {
+			r := ResourceReplicationInstance()
+			d := r.Data(nil)
+			d.SetId(aws.StringValue(v.ReplicationInstanceIdentifier))
+			d.Set("replication_instance_arn", v.ReplicationInstanceArn)
+
+			sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
+		}
+
+		return !lastPage
+	})
+
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping DMS Replication Instance sweep for %s: %s", region, err)
 		return nil
 	}
 
-	return errs.ErrorOrNil()
+	if err != nil {
+		return fmt.Errorf("error listing DMS Replication Instances (%s): %w", region, err)
+	}
+
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
+
+	if err != nil {
+		return fmt.Errorf("error sweeping DMS Replication Instances (%s): %w", region, err)
+	}
+
+	return nil
 }
 
-func sweepEndpoints(region string) error {
+func sweepReplicationSubnetGroups(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
-
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
-
 	conn := client.DMSConn(ctx)
+	input := &dms.DescribeReplicationSubnetGroupsInput{}
 	sweepResources := make([]sweep.Sweepable, 0)
-	var errs *multierror.Error
 
-	err = conn.DescribeEndpointsPagesWithContext(ctx, &dms.DescribeEndpointsInput{}, func(page *dms.DescribeEndpointsOutput, lastPage bool) bool {
-		for _, ep := range page.Endpoints {
-			r := ResourceEndpoint()
+	err = conn.DescribeReplicationSubnetGroupsPagesWithContext(ctx, input, func(page *dms.DescribeReplicationSubnetGroupsOutput, lastPage bool) bool {
+		if page == nil {
+			return !lastPage
+		}
+
+		for _, v := range page.ReplicationSubnetGroups {
+			r := ResourceReplicationSubnetGroup()
 			d := r.Data(nil)
-			d.Set("endpoint_arn", ep.EndpointArn)
-			d.SetId(aws.StringValue(ep.EndpointIdentifier))
+			d.SetId(aws.StringValue(v.ReplicationSubnetGroupIdentifier))
 
 			sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
 		}
@@ -144,18 +208,67 @@ func sweepEndpoints(region string) error {
 		return !lastPage
 	})
 
+	if awsv1.SkipSweepError(err) {
+		log.Printf("[WARN] Skipping DMS Replication Subnet Group sweep for %s: %s", region, err)
+		return nil
+	}
+
 	if err != nil {
-		errs = multierror.Append(errs, fmt.Errorf("error describing DMS Endpoints: %w", err))
+		return fmt.Errorf("error listing DMS Replication Subnet Groups (%s): %w", region, err)
 	}
 
-	if err = sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
-		errs = multierror.Append(errs, fmt.Errorf("error sweeping DMS Endpoints for %s: %w", region, err))
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
+
+	if err != nil {
+		return fmt.Errorf("error sweeping DMS Replication Subnet Groups (%s): %w", region, err)
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
-		log.Printf("[WARN] Skipping DMS Endpoint sweep for %s: %s", region, err)
+	return nil
+}
+
+func sweepReplicationTasks(region string) error {
+	ctx := sweep.Context(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
+	if err != nil {
+		return fmt.Errorf("error getting client: %s", err)
+	}
+	conn := client.DMSConn(ctx)
+	input := &dms.DescribeReplicationTasksInput{
+		WithoutSettings: aws.Bool(true),
+	}
+	sweepResources := make([]sweep.Sweepable, 0)
+
+	err = conn.DescribeReplicationTasksPagesWithContext(ctx, input, func(page *dms.DescribeReplicationTasksOutput, lastPage bool) bool {
+		if page == nil {
+			return !lastPage
+		}
+
+		for _, v := range page.ReplicationTasks {
+			r := ResourceReplicationTask()
+			d := r.Data(nil)
+			d.SetId(aws.StringValue(v.ReplicationTaskIdentifier))
+			d.Set("replication_task_arn", v.ReplicationTaskArn)
+
+			sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
+		}
+
+		return !lastPage
+	})
+
+	if awsv1.SkipSweepError(err) {
+		log.Printf("[WARN] Skipping DMS Replication Task sweep for %s: %s", region, err)
 		return nil
 	}
 
-	return errs.ErrorOrNil()
+	if err != nil {
+		return fmt.Errorf("error listing DMS Replication Tasks (%s): %w", region, err)
+	}
+
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
+
+	if err != nil {
+		return fmt.Errorf("error sweeping DMS Replication Tasks (%s): %w", region, err)
+	}
+
+	return nil
 }
diff --git a/internal/service/dms/tags_gen.go b/internal/service/dms/tags_gen.go
index ecedfb12efb..887a3a40432 100644
--- a/internal/service/dms/tags_gen.go
+++ b/internal/service/dms/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/databasemigrationservice"
 	"github.com/aws/aws-sdk-go/service/databasemigrationservice/databasemigrationserviceiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -102,6 +104,8 @@ func updateTags(ctx context.Context, conn databasemigrationserviceiface.Database
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.DMS)
 	if len(removedTags) > 0 {
diff --git a/internal/service/dms/validate.go b/internal/service/dms/validate.go
index b5c146fc24b..6666c3c8354 100644
--- a/internal/service/dms/validate.go
+++ b/internal/service/dms/validate.go
@@ -1,9 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package dms
 
 import (
 	"fmt"
-	"regexp"
 	"strings"
+
+	"github.com/YakDriver/regexache"
 )
 
 func validEndpointID(v interface{}, k string) (ws []string, es []error) {
@@ -12,7 +16,7 @@ func validEndpointID(v interface{}, k string) (ws []string, es []error) {
 	if len(val) > 255 {
 		es = append(es, fmt.Errorf("%q must not be longer than 255 characters", k))
 	}
-	if !regexp.MustCompile("^[a-zA-Z][a-zA-Z0-9-]+$").MatchString(val) {
+	if !regexache.MustCompile("^[A-Za-z][0-9A-Za-z-]+$").MatchString(val) {
 		es = append(es, fmt.Errorf("%q must start with a letter, only contain alphanumeric characters and hyphens", k))
 	}
 	if strings.Contains(val, "--") {
@@ -31,7 +35,7 @@ func validReplicationInstanceID(v interface{}, k string) (ws []string, es []erro
 	if len(val) > 63 {
 		es = append(es, fmt.Errorf("%q must not be longer than 63 characters", k))
 	}
-	if !regexp.MustCompile("^[a-zA-Z][a-zA-Z0-9-]+$").MatchString(val) {
+	if !regexache.MustCompile("^[A-Za-z][0-9A-Za-z-]+$").MatchString(val) {
 		es = append(es, fmt.Errorf("%q must start with a letter, only contain alphanumeric characters and hyphens", k))
 	}
 	if strings.Contains(val, "--") {
@@ -53,7 +57,7 @@ func validReplicationSubnetGroupID(v interface{}, k string) (ws []string, es []e
 	if len(val) > 255 {
 		es = append(es, fmt.Errorf("%q must not be longer than 255 characters", k))
 	}
-	if !regexp.MustCompile(`^[a-zA-Z0-9. _-]+$`).MatchString(val) {
+	if !regexache.MustCompile(`^[0-9A-Za-z_ .-]+$`).MatchString(val) {
 		es = append(es, fmt.Errorf("%q must only contain alphanumeric characters, periods, spaces, underscores and hyphens", k))
 	}
 
@@ -66,7 +70,7 @@ func validReplicationTaskID(v interface{}, k string) (ws []string, es []error) {
 	if len(val) > 255 {
 		es = append(es, fmt.Errorf("%q must not be longer than 255 characters", k))
 	}
-	if !regexp.MustCompile("^[a-zA-Z][a-zA-Z0-9-]+$").MatchString(val) {
+	if !regexache.MustCompile("^[A-Za-z][0-9A-Za-z-]+$").MatchString(val) {
 		es = append(es, fmt.Errorf("%q must start with a letter, only contain alphanumeric characters and hyphens", k))
 	}
 	if strings.Contains(val, "--") {
diff --git a/internal/service/dms/validate_test.go b/internal/service/dms/validate_test.go
index 23f7c8d1832..e16967deeaa 100644
--- a/internal/service/dms/validate_test.go
+++ b/internal/service/dms/validate_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package dms
 
 import (
diff --git a/internal/service/dms/wait.go b/internal/service/dms/wait.go
deleted file mode 100644
index 05b1b739ac8..00000000000
--- a/internal/service/dms/wait.go
+++ /dev/null
@@ -1,107 +0,0 @@
-package dms
-
-import (
-	"context"
-	"time"
-
-	dms "github.com/aws/aws-sdk-go/service/databasemigrationservice"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
-)
-
-const (
-	propagationTimeout            = 2 * time.Minute
-	replicationTaskRunningTimeout = 5 * time.Minute
-)
-
-func waitEndpointDeleted(ctx context.Context, conn *dms.DatabaseMigrationService, id string, timeout time.Duration) error {
-	stateConf := &retry.StateChangeConf{
-		Pending: []string{endpointStatusDeleting},
-		Target:  []string{},
-		Refresh: statusEndpoint(ctx, conn, id),
-		Timeout: timeout,
-	}
-
-	_, err := stateConf.WaitForStateContext(ctx)
-
-	return err
-}
-
-func waitReplicationTaskDeleted(ctx context.Context, conn *dms.DatabaseMigrationService, id string, timeout time.Duration) error {
-	stateConf := &retry.StateChangeConf{
-		Pending:    []string{replicationTaskStatusDeleting},
-		Target:     []string{},
-		Refresh:    statusReplicationTask(ctx, conn, id),
-		Timeout:    timeout,
-		MinTimeout: 10 * time.Second,
-		Delay:      30 * time.Second, // Wait 30 secs before starting
-	}
-
-	// Wait, catching any errors
-	_, err := stateConf.WaitForStateContext(ctx)
-
-	return err
-}
-
-func waitReplicationTaskModified(ctx context.Context, conn *dms.DatabaseMigrationService, id string, timeout time.Duration) error {
-	stateConf := &retry.StateChangeConf{
-		Pending:    []string{replicationTaskStatusModifying},
-		Target:     []string{replicationTaskStatusReady, replicationTaskStatusStopped, replicationTaskStatusFailed},
-		Refresh:    statusReplicationTask(ctx, conn, id),
-		Timeout:    timeout,
-		MinTimeout: 10 * time.Second,
-		Delay:      30 * time.Second, // Wait 30 secs before starting
-	}
-
-	// Wait, catching any errors
-	_, err := stateConf.WaitForStateContext(ctx)
-
-	return err
-}
-
-func waitReplicationTaskReady(ctx context.Context, conn *dms.DatabaseMigrationService, id string, timeout time.Duration) error {
-	stateConf := &retry.StateChangeConf{
-		Pending:    []string{replicationTaskStatusCreating},
-		Target:     []string{replicationTaskStatusReady},
-		Refresh:    statusReplicationTask(ctx, conn, id),
-		Timeout:    timeout,
-		MinTimeout: 10 * time.Second,
-		Delay:      30 * time.Second, // Wait 30 secs before starting
-	}
-
-	// Wait, catching any errors
-	_, err := stateConf.WaitForStateContext(ctx)
-
-	return err
-}
-
-func waitReplicationTaskRunning(ctx context.Context, conn *dms.DatabaseMigrationService, id string) error {
-	stateConf := &retry.StateChangeConf{
-		Pending:    []string{replicationTaskStatusStarting},
-		Target:     []string{replicationTaskStatusRunning},
-		Refresh:    statusReplicationTask(ctx, conn, id),
-		Timeout:    replicationTaskRunningTimeout,
-		MinTimeout: 10 * time.Second,
-		Delay:      30 * time.Second, // Wait 30 secs before starting
-	}
-
-	// Wait, catching any errors
-	_, err := stateConf.WaitForStateContext(ctx)
-
-	return err
-}
-
-func waitReplicationTaskStopped(ctx context.Context, conn *dms.DatabaseMigrationService, id string) error {
-	stateConf := &retry.StateChangeConf{
-		Pending:    []string{replicationTaskStatusStopping, replicationTaskStatusRunning},
-		Target:     []string{replicationTaskStatusStopped},
-		Refresh:    statusReplicationTask(ctx, conn, id),
-		Timeout:    replicationTaskRunningTimeout,
-		MinTimeout: 10 * time.Second,
-		Delay:      60 * time.Second, // Wait 30 secs before starting
-	}
-
-	// Wait, catching any errors
-	_, err := stateConf.WaitForStateContext(ctx)
-
-	return err
-}
diff --git a/internal/service/docdb/cluster.go b/internal/service/docdb/cluster.go
index 4f08c4e9b72..17c4c231f16 100644
--- a/internal/service/docdb/cluster.go
+++ b/internal/service/docdb/cluster.go
@@ -1,22 +1,25 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package docdb
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"strings"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/docdb"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/create"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
 	"github.com/hashicorp/terraform-provider-aws/internal/flex"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
@@ -33,8 +36,15 @@ func ResourceCluster() *schema.Resource {
 		ReadWithoutTimeout:   resourceClusterRead,
 		UpdateWithoutTimeout: resourceClusterUpdate,
 		DeleteWithoutTimeout: resourceClusterDelete,
+
 		Importer: &schema.ResourceImporter{
-			StateContext: resourceClusterImport,
+			StateContext: func(ctx context.Context, d *schema.ResourceData, meta interface{}) ([]*schema.ResourceData, error) {
+				// Neither skip_final_snapshot nor final_snapshot_identifier can be fetched
+				// from any API call, so we need to default skip_final_snapshot to true so
+				// that final_snapshot_identifier is not required
+				d.Set("skip_final_snapshot", true)
+				return []*schema.ResourceData{d}, nil
+			},
 		},
 
 		Timeouts: &schema.ResourceTimeout{
@@ -44,20 +54,31 @@ func ResourceCluster() *schema.Resource {
 		},
 
 		Schema: map[string]*schema.Schema{
+			"allow_major_version_upgrade": {
+				Type:     schema.TypeBool,
+				Optional: true,
+			},
+			"apply_immediately": {
+				Type:     schema.TypeBool,
+				Optional: true,
+			},
 			"arn": {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
-
 			"availability_zones": {
 				Type:     schema.TypeSet,
 				Elem:     &schema.Schema{Type: schema.TypeString},
 				Optional: true,
-				ForceNew: true,
 				Computed: true,
-				Set:      schema.HashString,
+				ForceNew: true,
+			},
+			"backup_retention_period": {
+				Type:         schema.TypeInt,
+				Optional:     true,
+				Default:      1,
+				ValidateFunc: validation.IntAtMost(35),
 			},
-
 			"cluster_identifier": {
 				Type:          schema.TypeString,
 				Optional:      true,
@@ -74,146 +95,116 @@ func ResourceCluster() *schema.Resource {
 				ConflictsWith: []string{"cluster_identifier"},
 				ValidateFunc:  validIdentifierPrefix,
 			},
-
 			"cluster_members": {
 				Type:     schema.TypeSet,
 				Elem:     &schema.Schema{Type: schema.TypeString},
 				Optional: true,
 				Computed: true,
-				Set:      schema.HashString,
 			},
-
-			"db_subnet_group_name": {
+			"cluster_resource_id": {
 				Type:     schema.TypeString,
-				Optional: true,
-				ForceNew: true,
 				Computed: true,
 			},
-
 			"db_cluster_parameter_group_name": {
 				Type:     schema.TypeString,
 				Optional: true,
 				Computed: true,
 			},
-
-			"endpoint": {
+			"db_subnet_group_name": {
 				Type:     schema.TypeString,
+				Optional: true,
 				Computed: true,
+				ForceNew: true,
 			},
-
-			"global_cluster_identifier": {
-				Type:         schema.TypeString,
-				Optional:     true,
-				ValidateFunc: validGlobalCusterIdentifier,
+			"deletion_protection": {
+				Type:     schema.TypeBool,
+				Optional: true,
 			},
-
-			"reader_endpoint": {
-				Type:     schema.TypeString,
-				Computed: true,
+			"enabled_cloudwatch_logs_exports": {
+				Type:     schema.TypeList,
+				Optional: true,
+				Elem: &schema.Schema{
+					Type: schema.TypeString,
+					ValidateFunc: validation.StringInSlice([]string{
+						"audit",
+						"profiler",
+					}, false),
+				},
 			},
-
-			"hosted_zone_id": {
+			"endpoint": {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
-
 			"engine": {
 				Type:         schema.TypeString,
 				Optional:     true,
-				Default:      "docdb",
 				ForceNew:     true,
-				ValidateFunc: validEngine(),
+				Default:      engineDocDB,
+				ValidateFunc: validation.StringInSlice(engine_Values(), false),
 			},
-
 			"engine_version": {
 				Type:     schema.TypeString,
 				Optional: true,
 				Computed: true,
 			},
-
-			"storage_encrypted": {
-				Type:     schema.TypeBool,
-				Optional: true,
-				ForceNew: true,
-			},
-
 			"final_snapshot_identifier": {
 				Type:     schema.TypeString,
 				Optional: true,
 				ValidateFunc: func(v interface{}, k string) (ws []string, es []error) {
 					value := v.(string)
-					if !regexp.MustCompile(`^[0-9A-Za-z-]+$`).MatchString(value) {
+					if !regexache.MustCompile(`^[0-9A-Za-z-]+$`).MatchString(value) {
 						es = append(es, fmt.Errorf(
 							"only alphanumeric characters and hyphens allowed in %q", k))
 					}
-					if regexp.MustCompile(`--`).MatchString(value) {
+					if regexache.MustCompile(`--`).MatchString(value) {
 						es = append(es, fmt.Errorf("%q cannot contain two consecutive hyphens", k))
 					}
-					if regexp.MustCompile(`-$`).MatchString(value) {
+					if regexache.MustCompile(`-$`).MatchString(value) {
 						es = append(es, fmt.Errorf("%q cannot end in a hyphen", k))
 					}
 					return
 				},
 			},
-
-			"skip_final_snapshot": {
-				Type:     schema.TypeBool,
-				Optional: true,
-				Default:  false,
+			"global_cluster_identifier": {
+				Type:         schema.TypeString,
+				Optional:     true,
+				ValidateFunc: validGlobalCusterIdentifier,
 			},
-
-			"master_username": {
+			"hosted_zone_id": {
 				Type:     schema.TypeString,
 				Computed: true,
-				Optional: true,
-				ForceNew: true,
 			},
-
+			"kms_key_id": {
+				Type:         schema.TypeString,
+				Optional:     true,
+				Computed:     true,
+				ForceNew:     true,
+				ValidateFunc: verify.ValidARN,
+			},
 			"master_password": {
 				Type:      schema.TypeString,
 				Optional:  true,
 				Sensitive: true,
 			},
-
-			"snapshot_identifier": {
+			"master_username": {
 				Type:     schema.TypeString,
 				Optional: true,
+				Computed: true,
 				ForceNew: true,
-				DiffSuppressFunc: func(k, old, new string, d *schema.ResourceData) bool {
-					// allow snapshot_idenfitier to be removed without forcing re-creation
-					return new == ""
-				},
 			},
-
 			"port": {
 				Type:         schema.TypeInt,
 				Optional:     true,
-				Default:      27017,
 				ForceNew:     true,
+				Default:      27017,
 				ValidateFunc: validation.IntBetween(1150, 65535),
 			},
-
-			"apply_immediately": {
-				Type:     schema.TypeBool,
-				Optional: true,
-				Computed: true,
-			},
-
-			"vpc_security_group_ids": {
-				Type:     schema.TypeSet,
-				Optional: true,
-				Computed: true,
-				Elem:     &schema.Schema{Type: schema.TypeString},
-				Set:      schema.HashString,
-			},
-
 			"preferred_backup_window": {
 				Type:         schema.TypeString,
 				Optional:     true,
 				Computed:     true,
 				ValidateFunc: verify.ValidOnceADayWindowFormat,
 			},
-
 			"preferred_maintenance_window": {
 				Type:     schema.TypeString,
 				Optional: true,
@@ -226,65 +217,53 @@ func ResourceCluster() *schema.Resource {
 				},
 				ValidateFunc: verify.ValidOnceAWeekWindowFormat,
 			},
-
-			"backup_retention_period": {
-				Type:         schema.TypeInt,
-				Optional:     true,
-				Default:      1,
-				ValidateFunc: validation.IntAtMost(35),
-			},
-
-			"kms_key_id": {
-				Type:         schema.TypeString,
-				Optional:     true,
-				Computed:     true,
-				ForceNew:     true,
-				ValidateFunc: verify.ValidARN,
-			},
-
-			"cluster_resource_id": {
+			"reader_endpoint": {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
-
-			"enabled_cloudwatch_logs_exports": {
-				Type:     schema.TypeList,
+			"skip_final_snapshot": {
+				Type:     schema.TypeBool,
 				Optional: true,
-				Elem: &schema.Schema{
-					Type: schema.TypeString,
-					ValidateFunc: validation.StringInSlice([]string{
-						"audit",
-						"profiler",
-					}, false),
+				Default:  false,
+			},
+			"snapshot_identifier": {
+				Type:     schema.TypeString,
+				Optional: true,
+				ForceNew: true,
+				DiffSuppressFunc: func(k, old, new string, d *schema.ResourceData) bool {
+					// allow snapshot_idenfitier to be removed without forcing re-creation
+					return new == ""
 				},
 			},
-
-			"deletion_protection": {
+			"storage_encrypted": {
 				Type:     schema.TypeBool,
 				Optional: true,
+				ForceNew: true,
 			},
-
 			names.AttrTags:    tftags.TagsSchema(),
 			names.AttrTagsAll: tftags.TagsSchemaComputed(),
+			"vpc_security_group_ids": {
+				Type:     schema.TypeSet,
+				Optional: true,
+				Computed: true,
+				Elem:     &schema.Schema{Type: schema.TypeString},
+			},
 		},
 
 		CustomizeDiff: verify.SetTagsDiff,
 	}
 }
 
-func resourceClusterImport(ctx context.Context,
-	d *schema.ResourceData, meta interface{}) ([]*schema.ResourceData, error) {
-	// Neither skip_final_snapshot nor final_snapshot_identifier can be fetched
-	// from any API call, so we need to default skip_final_snapshot to true so
-	// that final_snapshot_identifier is not required
-	d.Set("skip_final_snapshot", true)
-	return []*schema.ResourceData{d}, nil
-}
-
 func resourceClusterCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).DocDBConn(ctx)
 
+	identifier := create.NewNameGenerator(
+		create.WithConfiguredName(d.Get("cluster_identifier").(string)),
+		create.WithConfiguredPrefix(d.Get("cluster_identifier_prefix").(string)),
+		create.WithDefaultPrefix("tf-"),
+	).Generate()
+
 	// Some API calls (e.g. RestoreDBClusterFromSnapshot do not support all
 	// parameters to correctly apply all settings in one pass. For missing
 	// parameters or unsupported configurations, we may need to call
@@ -295,87 +274,69 @@ func resourceClusterCreate(ctx context.Context, d *schema.ResourceData, meta int
 		ApplyImmediately: aws.Bool(true),
 	}
 
-	var identifier string
-	if v, ok := d.GetOk("cluster_identifier"); ok {
-		identifier = v.(string)
-	} else if v, ok := d.GetOk("cluster_identifier_prefix"); ok {
-		identifier = id.PrefixedUniqueId(v.(string))
-	} else {
-		identifier = id.PrefixedUniqueId("tf-")
-	}
-
 	if _, ok := d.GetOk("snapshot_identifier"); ok {
-		opts := docdb.RestoreDBClusterFromSnapshotInput{
+		input := &docdb.RestoreDBClusterFromSnapshotInput{
 			DBClusterIdentifier: aws.String(identifier),
+			DeletionProtection:  aws.Bool(d.Get("deletion_protection").(bool)),
 			Engine:              aws.String(d.Get("engine").(string)),
 			SnapshotIdentifier:  aws.String(d.Get("snapshot_identifier").(string)),
-			DeletionProtection:  aws.Bool(d.Get("deletion_protection").(bool)),
 			Tags:                getTagsIn(ctx),
 		}
 
-		if attr := d.Get("availability_zones").(*schema.Set); attr.Len() > 0 {
-			opts.AvailabilityZones = flex.ExpandStringSet(attr)
+		if v := d.Get("availability_zones").(*schema.Set); v.Len() > 0 {
+			input.AvailabilityZones = flex.ExpandStringSet(v)
 		}
 
-		if attr, ok := d.GetOk("backup_retention_period"); ok {
-			modifyDbClusterInput.BackupRetentionPeriod = aws.Int64(int64(attr.(int)))
+		if v, ok := d.GetOk("backup_retention_period"); ok {
+			modifyDbClusterInput.BackupRetentionPeriod = aws.Int64(int64(v.(int)))
 			requiresModifyDbCluster = true
 		}
 
-		if attr, ok := d.GetOk("db_subnet_group_name"); ok {
-			opts.DBSubnetGroupName = aws.String(attr.(string))
+		if v, ok := d.GetOk("db_cluster_parameter_group_name"); ok {
+			modifyDbClusterInput.DBClusterParameterGroupName = aws.String(v.(string))
+			requiresModifyDbCluster = true
 		}
 
-		if attr, ok := d.GetOk("db_cluster_parameter_group_name"); ok {
-			modifyDbClusterInput.DBClusterParameterGroupName = aws.String(attr.(string))
-			requiresModifyDbCluster = true
+		if v, ok := d.GetOk("db_subnet_group_name"); ok {
+			input.DBSubnetGroupName = aws.String(v.(string))
 		}
 
-		if attr, ok := d.GetOk("enabled_cloudwatch_logs_exports"); ok && len(attr.([]interface{})) > 0 {
-			opts.EnableCloudwatchLogsExports = flex.ExpandStringList(attr.([]interface{}))
+		if v, ok := d.GetOk("enabled_cloudwatch_logs_exports"); ok && len(v.([]interface{})) > 0 {
+			input.EnableCloudwatchLogsExports = flex.ExpandStringList(v.([]interface{}))
 		}
 
-		if attr, ok := d.GetOk("engine_version"); ok {
-			opts.EngineVersion = aws.String(attr.(string))
+		if v, ok := d.GetOk("engine_version"); ok {
+			input.EngineVersion = aws.String(v.(string))
 		}
 
-		if attr, ok := d.GetOk("kms_key_id"); ok {
-			opts.KmsKeyId = aws.String(attr.(string))
+		if v, ok := d.GetOk("kms_key_id"); ok {
+			input.KmsKeyId = aws.String(v.(string))
 		}
 
-		if attr, ok := d.GetOk("port"); ok {
-			opts.Port = aws.Int64(int64(attr.(int)))
+		if v, ok := d.GetOk("port"); ok {
+			input.Port = aws.Int64(int64(v.(int)))
 		}
 
-		if attr, ok := d.GetOk("preferred_backup_window"); ok {
-			modifyDbClusterInput.PreferredBackupWindow = aws.String(attr.(string))
+		if v, ok := d.GetOk("preferred_backup_window"); ok {
+			modifyDbClusterInput.PreferredBackupWindow = aws.String(v.(string))
 			requiresModifyDbCluster = true
 		}
 
-		if attr, ok := d.GetOk("preferred_maintenance_window"); ok {
-			modifyDbClusterInput.PreferredMaintenanceWindow = aws.String(attr.(string))
+		if v, ok := d.GetOk("preferred_maintenance_window"); ok {
+			modifyDbClusterInput.PreferredMaintenanceWindow = aws.String(v.(string))
 			requiresModifyDbCluster = true
 		}
 
-		if attr := d.Get("vpc_security_group_ids").(*schema.Set); attr.Len() > 0 {
-			opts.VpcSecurityGroupIds = flex.ExpandStringSet(attr)
+		if v := d.Get("vpc_security_group_ids").(*schema.Set); v.Len() > 0 {
+			input.VpcSecurityGroupIds = flex.ExpandStringSet(v)
 		}
 
-		err := retry.RetryContext(ctx, propagationTimeout, func() *retry.RetryError {
-			_, err := conn.RestoreDBClusterFromSnapshotWithContext(ctx, &opts)
-			if err != nil {
-				if tfawserr.ErrMessageContains(err, "InvalidParameterValue", "IAM role ARN value is invalid or does not include the required permissions") {
-					return retry.RetryableError(err)
-				}
-				return retry.NonRetryableError(err)
-			}
-			return nil
-		})
-		if tfresource.TimedOut(err) {
-			_, err = conn.RestoreDBClusterFromSnapshotWithContext(ctx, &opts)
-		}
+		_, err := tfresource.RetryWhenAWSErrMessageContains(ctx, propagationTimeout, func() (interface{}, error) {
+			return conn.RestoreDBClusterFromSnapshotWithContext(ctx, input)
+		}, errCodeInvalidParameterValue, "IAM role ARN value is invalid or does not include the required permissions")
+
 		if err != nil {
-			return sdkdiag.AppendErrorf(diags, "creating DocumentDB Cluster: %s", err)
+			return sdkdiag.AppendErrorf(diags, "creating DocumentDB Cluster (restore from snapshot) (%s): %s", identifier, err)
 		}
 	} else {
 		// Secondary DocDB clusters part of a global cluster will not supply the master_password
@@ -392,121 +353,93 @@ func resourceClusterCreate(ctx context.Context, d *schema.ResourceData, meta int
 			}
 		}
 
-		createOpts := &docdb.CreateDBClusterInput{
+		input := &docdb.CreateDBClusterInput{
 			DBClusterIdentifier: aws.String(identifier),
+			DeletionProtection:  aws.Bool(d.Get("deletion_protection").(bool)),
 			Engine:              aws.String(d.Get("engine").(string)),
-			MasterUserPassword:  aws.String(d.Get("master_password").(string)),
 			MasterUsername:      aws.String(d.Get("master_username").(string)),
-			DeletionProtection:  aws.Bool(d.Get("deletion_protection").(bool)),
+			MasterUserPassword:  aws.String(d.Get("master_password").(string)),
 			Tags:                getTagsIn(ctx),
 		}
 
-		if attr, ok := d.GetOk("global_cluster_identifier"); ok {
-			createOpts.GlobalClusterIdentifier = aws.String(attr.(string))
+		if v := d.Get("availability_zones").(*schema.Set); v.Len() > 0 {
+			input.AvailabilityZones = flex.ExpandStringSet(v)
 		}
 
-		if attr, ok := d.GetOk("port"); ok {
-			createOpts.Port = aws.Int64(int64(attr.(int)))
+		if v, ok := d.GetOk("backup_retention_period"); ok {
+			input.BackupRetentionPeriod = aws.Int64(int64(v.(int)))
 		}
 
-		if attr, ok := d.GetOk("db_subnet_group_name"); ok {
-			createOpts.DBSubnetGroupName = aws.String(attr.(string))
+		if v, ok := d.GetOk("db_cluster_parameter_group_name"); ok {
+			input.DBClusterParameterGroupName = aws.String(v.(string))
 		}
 
-		if attr, ok := d.GetOk("db_cluster_parameter_group_name"); ok {
-			createOpts.DBClusterParameterGroupName = aws.String(attr.(string))
+		if v, ok := d.GetOk("db_subnet_group_name"); ok {
+			input.DBSubnetGroupName = aws.String(v.(string))
 		}
 
-		if attr, ok := d.GetOk("engine_version"); ok {
-			createOpts.EngineVersion = aws.String(attr.(string))
+		if v, ok := d.GetOk("enabled_cloudwatch_logs_exports"); ok && len(v.([]interface{})) > 0 {
+			input.EnableCloudwatchLogsExports = flex.ExpandStringList(v.([]interface{}))
 		}
 
-		if attr := d.Get("vpc_security_group_ids").(*schema.Set); attr.Len() > 0 {
-			createOpts.VpcSecurityGroupIds = flex.ExpandStringSet(attr)
+		if v, ok := d.GetOk("engine_version"); ok {
+			input.EngineVersion = aws.String(v.(string))
 		}
 
-		if attr := d.Get("availability_zones").(*schema.Set); attr.Len() > 0 {
-			createOpts.AvailabilityZones = flex.ExpandStringSet(attr)
+		if v, ok := d.GetOk("global_cluster_identifier"); ok {
+			input.GlobalClusterIdentifier = aws.String(v.(string))
 		}
 
-		if v, ok := d.GetOk("backup_retention_period"); ok {
-			createOpts.BackupRetentionPeriod = aws.Int64(int64(v.(int)))
+		if v, ok := d.GetOk("kms_key_id"); ok {
+			input.KmsKeyId = aws.String(v.(string))
+		}
+
+		if v, ok := d.GetOk("port"); ok {
+			input.Port = aws.Int64(int64(v.(int)))
 		}
 
 		if v, ok := d.GetOk("preferred_backup_window"); ok {
-			createOpts.PreferredBackupWindow = aws.String(v.(string))
+			input.PreferredBackupWindow = aws.String(v.(string))
 		}
 
 		if v, ok := d.GetOk("preferred_maintenance_window"); ok {
-			createOpts.PreferredMaintenanceWindow = aws.String(v.(string))
+			input.PreferredMaintenanceWindow = aws.String(v.(string))
 		}
 
-		if attr, ok := d.GetOk("kms_key_id"); ok {
-			createOpts.KmsKeyId = aws.String(attr.(string))
+		if v, ok := d.GetOkExists("storage_encrypted"); ok {
+			input.StorageEncrypted = aws.Bool(v.(bool))
 		}
 
-		if attr, ok := d.GetOk("enabled_cloudwatch_logs_exports"); ok && len(attr.([]interface{})) > 0 {
-			createOpts.EnableCloudwatchLogsExports = flex.ExpandStringList(attr.([]interface{}))
+		if v := d.Get("vpc_security_group_ids").(*schema.Set); v.Len() > 0 {
+			input.VpcSecurityGroupIds = flex.ExpandStringSet(v)
 		}
 
-		if attr, ok := d.GetOkExists("storage_encrypted"); ok {
-			createOpts.StorageEncrypted = aws.Bool(attr.(bool))
-		}
+		_, err := tfresource.RetryWhenAWSErrMessageContains(ctx, propagationTimeout, func() (interface{}, error) {
+			return conn.CreateDBClusterWithContext(ctx, input)
+		}, errCodeInvalidParameterValue, "IAM role ARN value is invalid or does not include the required permissions")
 
-		err := retry.RetryContext(ctx, propagationTimeout, func() *retry.RetryError {
-			var err error
-			_, err = conn.CreateDBClusterWithContext(ctx, createOpts)
-			if err != nil {
-				if tfawserr.ErrMessageContains(err, "InvalidParameterValue", "IAM role ARN value is invalid or does not include the required permissions") {
-					return retry.RetryableError(err)
-				}
-				return retry.NonRetryableError(err)
-			}
-			return nil
-		})
-		if tfresource.TimedOut(err) {
-			_, err = conn.CreateDBClusterWithContext(ctx, createOpts)
-		}
 		if err != nil {
-			return sdkdiag.AppendErrorf(diags, "creating DocumentDB cluster: %s", err)
+			return sdkdiag.AppendErrorf(diags, "creating DocumentDB Cluster (%s): %s", identifier, err)
 		}
 	}
 
 	d.SetId(identifier)
 
-	log.Printf("[INFO] DocumentDB Cluster ID: %s", d.Id())
-
-	log.Println(
-		"[INFO] Waiting for DocumentDB Cluster to be available")
-
-	stateConf := &retry.StateChangeConf{
-		Pending:    resourceClusterCreatePendingStates,
-		Target:     []string{"available"},
-		Refresh:    resourceClusterStateRefreshFunc(ctx, conn, d.Id()),
-		Timeout:    d.Timeout(schema.TimeoutCreate),
-		MinTimeout: 10 * time.Second,
-		Delay:      30 * time.Second,
-	}
-
-	// Wait, catching any errors
-	_, err := stateConf.WaitForStateContext(ctx)
-	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "waiting for DocumentDB Cluster state to be \"available\": %s", err)
+	if _, err := waitDBClusterCreated(ctx, conn, d.Id(), d.Timeout(schema.TimeoutCreate)); err != nil {
+		return sdkdiag.AppendErrorf(diags, "waiting for DocumentDB Cluster (%s) create: %s", d.Id(), err)
 	}
 
 	if requiresModifyDbCluster {
 		modifyDbClusterInput.DBClusterIdentifier = aws.String(d.Id())
 
-		log.Printf("[INFO] DocumentDB Cluster (%s) configuration requires ModifyDBCluster: %s", d.Id(), modifyDbClusterInput)
 		_, err := conn.ModifyDBClusterWithContext(ctx, modifyDbClusterInput)
+
 		if err != nil {
 			return sdkdiag.AppendErrorf(diags, "modifying DocumentDB Cluster (%s): %s", d.Id(), err)
 		}
 
-		log.Printf("[INFO] Waiting for DocumentDB Cluster (%s) to be available", d.Id())
-		err = waitForClusterUpdate(ctx, conn, d.Id(), d.Timeout(schema.TimeoutCreate))
-		if err != nil {
-			return sdkdiag.AppendErrorf(diags, "waiting for DocumentDB Cluster (%s) to be available: %s", d.Id(), err)
+		if _, err := waitDBClusterUpdated(ctx, conn, d.Id(), d.Timeout(schema.TimeoutCreate)); err != nil {
+			return sdkdiag.AppendErrorf(diags, "waiting for DocumentDB Cluster (%s) update: %s", d.Id(), err)
 		}
 	}
 
@@ -517,46 +450,24 @@ func resourceClusterRead(ctx context.Context, d *schema.ResourceData, meta inter
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).DocDBConn(ctx)
 
-	input := &docdb.DescribeDBClustersInput{
-		DBClusterIdentifier: aws.String(d.Id()),
-	}
+	dbc, err := FindDBClusterByID(ctx, conn, d.Id())
 
-	resp, err := conn.DescribeDBClustersWithContext(ctx, input)
-
-	if !d.IsNewResource() && tfawserr.ErrCodeEquals(err, docdb.ErrCodeDBClusterNotFoundFault) {
+	if !d.IsNewResource() && tfresource.NotFound(err) {
 		log.Printf("[WARN] DocumentDB Cluster (%s) not found, removing from state", d.Id())
 		d.SetId("")
-		return diags
+		return nil
 	}
 
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "describing DocumentDB Cluster (%s): %s", d.Id(), err)
-	}
-
-	if resp == nil {
-		return sdkdiag.AppendErrorf(diags, "retrieving DocumentDB cluster: empty response for: %s", input)
-	}
-
-	var dbc *docdb.DBCluster
-	for _, c := range resp.DBClusters {
-		if aws.StringValue(c.DBClusterIdentifier) == d.Id() {
-			dbc = c
-			break
-		}
-	}
-
-	if !d.IsNewResource() && dbc == nil {
-		log.Printf("[WARN] DocumentDB Cluster (%s) not found, removing from state", d.Id())
-		d.SetId("")
-		return diags
+		return sdkdiag.AppendErrorf(diags, "reading DocumentDB Cluster (%s): %s", d.Id(), err)
 	}
 
 	globalCluster, err := findGlobalClusterByARN(ctx, conn, aws.StringValue(dbc.DBClusterArn))
 
 	// Ignore the following API error for regions/partitions that do not support DocDB Global Clusters:
 	// InvalidParameterValue: Access Denied to API Version: APIGlobalDatabases
-	if err != nil && !tfawserr.ErrMessageContains(err, "InvalidParameterValue", "Access Denied to API Version: APIGlobalDatabases") {
-		return sdkdiag.AppendErrorf(diags, "reading DocumentDB Global Cluster information for DB Cluster (%s): %s", d.Id(), err)
+	if err != nil && !tfawserr.ErrMessageContains(err, errCodeInvalidParameterValue, "Access Denied to API Version: APIGlobalDatabases") {
+		return sdkdiag.AppendErrorf(diags, "reading DocumentDB Cluster (%s) Global Cluster information: %s", d.Id(), err)
 	}
 
 	if globalCluster != nil {
@@ -565,35 +476,25 @@ func resourceClusterRead(ctx context.Context, d *schema.ResourceData, meta inter
 		d.Set("global_cluster_identifier", "")
 	}
 
-	if err := d.Set("availability_zones", aws.StringValueSlice(dbc.AvailabilityZones)); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting availability_zones: %s", err)
-	}
-
 	d.Set("arn", dbc.DBClusterArn)
+	d.Set("availability_zones", aws.StringValueSlice(dbc.AvailabilityZones))
 	d.Set("backup_retention_period", dbc.BackupRetentionPeriod)
 	d.Set("cluster_identifier", dbc.DBClusterIdentifier)
-
+	d.Set("cluster_identifier_prefix", create.NamePrefixFromName(aws.StringValue(dbc.DBClusterIdentifier)))
 	var cm []string
 	for _, m := range dbc.DBClusterMembers {
 		cm = append(cm, aws.StringValue(m.DBInstanceIdentifier))
 	}
-	if err := d.Set("cluster_members", cm); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting cluster_members: %s", err)
-	}
-
+	d.Set("cluster_members", cm)
 	d.Set("cluster_resource_id", dbc.DbClusterResourceId)
 	d.Set("db_cluster_parameter_group_name", dbc.DBClusterParameterGroup)
 	d.Set("db_subnet_group_name", dbc.DBSubnetGroup)
-
-	if err := d.Set("enabled_cloudwatch_logs_exports", aws.StringValueSlice(dbc.EnabledCloudwatchLogsExports)); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting enabled_cloudwatch_logs_exports: %s", err)
-	}
-
+	d.Set("deletion_protection", dbc.DeletionProtection)
+	d.Set("enabled_cloudwatch_logs_exports", aws.StringValueSlice(dbc.EnabledCloudwatchLogsExports))
 	d.Set("endpoint", dbc.Endpoint)
 	d.Set("engine_version", dbc.EngineVersion)
 	d.Set("engine", dbc.Engine)
 	d.Set("hosted_zone_id", dbc.HostedZoneId)
-
 	d.Set("kms_key_id", dbc.KmsKeyId)
 	d.Set("master_username", dbc.MasterUsername)
 	d.Set("port", dbc.Port)
@@ -601,15 +502,11 @@ func resourceClusterRead(ctx context.Context, d *schema.ResourceData, meta inter
 	d.Set("preferred_maintenance_window", dbc.PreferredMaintenanceWindow)
 	d.Set("reader_endpoint", dbc.ReaderEndpoint)
 	d.Set("storage_encrypted", dbc.StorageEncrypted)
-	d.Set("deletion_protection", dbc.DeletionProtection)
-
 	var vpcg []string
 	for _, g := range dbc.VpcSecurityGroups {
 		vpcg = append(vpcg, aws.StringValue(g.VpcSecurityGroupId))
 	}
-	if err := d.Set("vpc_security_group_ids", vpcg); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting vpc_security_group_ids: %s", err)
-	}
+	d.Set("vpc_security_group_ids", vpcg)
 
 	return diags
 }
@@ -617,66 +514,88 @@ func resourceClusterRead(ctx context.Context, d *schema.ResourceData, meta inter
 func resourceClusterUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).DocDBConn(ctx)
-	requestUpdate := false
 
-	req := &docdb.ModifyDBClusterInput{
-		ApplyImmediately:    aws.Bool(d.Get("apply_immediately").(bool)),
-		DBClusterIdentifier: aws.String(d.Id()),
-	}
+	if d.HasChangesExcept("tags", "tags_all", "global_cluster_identifier", "skip_final_snapshot") {
+		input := &docdb.ModifyDBClusterInput{
+			ApplyImmediately:    aws.Bool(d.Get("apply_immediately").(bool)),
+			DBClusterIdentifier: aws.String(d.Id()),
+		}
 
-	if d.HasChange("master_password") {
-		req.MasterUserPassword = aws.String(d.Get("master_password").(string))
-		requestUpdate = true
-	}
+		if v, ok := d.GetOk("allow_major_version_upgrade"); ok {
+			input.AllowMajorVersionUpgrade = aws.Bool(v.(bool))
+		}
 
-	if d.HasChange("engine_version") {
-		req.EngineVersion = aws.String(d.Get("engine_version").(string))
-		requestUpdate = true
-	}
+		if d.HasChange("backup_retention_period") {
+			input.BackupRetentionPeriod = aws.Int64(int64(d.Get("backup_retention_period").(int)))
+		}
 
-	if d.HasChange("vpc_security_group_ids") {
-		if attr := d.Get("vpc_security_group_ids").(*schema.Set); attr.Len() > 0 {
-			req.VpcSecurityGroupIds = flex.ExpandStringSet(attr)
-		} else {
-			req.VpcSecurityGroupIds = []*string{}
+		if d.HasChange("db_cluster_parameter_group_name") {
+			input.DBClusterParameterGroupName = aws.String(d.Get("db_cluster_parameter_group_name").(string))
 		}
-		requestUpdate = true
-	}
 
-	if d.HasChange("preferred_backup_window") {
-		req.PreferredBackupWindow = aws.String(d.Get("preferred_backup_window").(string))
-		requestUpdate = true
-	}
+		if d.HasChange("deletion_protection") {
+			input.DeletionProtection = aws.Bool(d.Get("deletion_protection").(bool))
+		}
 
-	if d.HasChange("preferred_maintenance_window") {
-		req.PreferredMaintenanceWindow = aws.String(d.Get("preferred_maintenance_window").(string))
-		requestUpdate = true
-	}
+		if d.HasChange("enabled_cloudwatch_logs_exports") {
+			input.CloudwatchLogsExportConfiguration = expandCloudwatchLogsExportConfiguration(d)
+		}
 
-	if d.HasChange("backup_retention_period") {
-		req.BackupRetentionPeriod = aws.Int64(int64(d.Get("backup_retention_period").(int)))
-		requestUpdate = true
-	}
+		if d.HasChange("engine_version") {
+			input.EngineVersion = aws.String(d.Get("engine_version").(string))
+		}
 
-	if d.HasChange("db_cluster_parameter_group_name") {
-		req.DBClusterParameterGroupName = aws.String(d.Get("db_cluster_parameter_group_name").(string))
-		requestUpdate = true
-	}
+		if d.HasChange("master_password") {
+			input.MasterUserPassword = aws.String(d.Get("master_password").(string))
+		}
 
-	if d.HasChange("enabled_cloudwatch_logs_exports") {
-		req.CloudwatchLogsExportConfiguration = buildCloudWatchLogsExportConfiguration(d)
-		requestUpdate = true
-	}
+		if d.HasChange("preferred_backup_window") {
+			input.PreferredBackupWindow = aws.String(d.Get("preferred_backup_window").(string))
+		}
+
+		if d.HasChange("preferred_maintenance_window") {
+			input.PreferredMaintenanceWindow = aws.String(d.Get("preferred_maintenance_window").(string))
+		}
+
+		if d.HasChange("vpc_security_group_ids") {
+			if v := d.Get("vpc_security_group_ids").(*schema.Set); v.Len() > 0 {
+				input.VpcSecurityGroupIds = flex.ExpandStringSet(v)
+			} else {
+				input.VpcSecurityGroupIds = aws.StringSlice([]string{})
+			}
+		}
+
+		_, err := tfresource.RetryWhen(ctx, 5*time.Minute,
+			func() (interface{}, error) {
+				return conn.ModifyDBClusterWithContext(ctx, input)
+			},
+			func(err error) (bool, error) {
+				if tfawserr.ErrMessageContains(err, errCodeInvalidParameterValue, "IAM role ARN value is invalid or does not include the required permissions") {
+					return true, err
+				}
+				if tfawserr.ErrMessageContains(err, docdb.ErrCodeInvalidDBClusterStateFault, "is not currently in the available state") {
+					return true, err
+				}
+				if tfawserr.ErrMessageContains(err, docdb.ErrCodeInvalidDBClusterStateFault, "cluster is a part of a global cluster") {
+					return true, err
+				}
+
+				return false, err
+			},
+		)
+
+		if err != nil {
+			return sdkdiag.AppendErrorf(diags, "modifying DocumentDB Cluster (%s): %s", d.Id(), err)
+		}
 
-	if d.HasChange("deletion_protection") {
-		req.DeletionProtection = aws.Bool(d.Get("deletion_protection").(bool))
-		requestUpdate = true
+		if _, err := waitDBClusterUpdated(ctx, conn, d.Id(), d.Timeout(schema.TimeoutUpdate)); err != nil {
+			return sdkdiag.AppendErrorf(diags, "waiting for DocumentDB Cluster (%s) update: %s", d.Id(), err)
+		}
 	}
 
 	if d.HasChange("global_cluster_identifier") {
 		oRaw, nRaw := d.GetChange("global_cluster_identifier")
-		o := oRaw.(string)
-		n := nRaw.(string)
+		o, n := oRaw.(string), nRaw.(string)
 
 		if o == "" {
 			return sdkdiag.AppendErrorf(diags, "existing DocumentDB Clusters cannot be added to an existing DocumentDB Global Cluster")
@@ -693,52 +612,19 @@ func resourceClusterUpdate(ctx context.Context, d *schema.ResourceData, meta int
 
 		_, err := conn.RemoveFromGlobalClusterWithContext(ctx, input)
 
-		if err != nil && !tfawserr.ErrCodeEquals(err, docdb.ErrCodeGlobalClusterNotFoundFault) && !tfawserr.ErrMessageContains(err, "InvalidParameterValue", "is not found in global cluster") {
+		if err != nil && !tfawserr.ErrCodeEquals(err, docdb.ErrCodeGlobalClusterNotFoundFault) && !tfawserr.ErrMessageContains(err, errCodeInvalidParameterValue, "is not found in global cluster") {
 			return sdkdiag.AppendErrorf(diags, "removing DocumentDB Cluster (%s) from DocumentDB Global Cluster: %s", d.Id(), err)
 		}
 	}
 
-	if requestUpdate {
-		err := retry.RetryContext(ctx, 5*time.Minute, func() *retry.RetryError {
-			_, err := conn.ModifyDBClusterWithContext(ctx, req)
-			if err != nil {
-				if tfawserr.ErrMessageContains(err, "InvalidParameterValue", "IAM role ARN value is invalid or does not include the required permissions") {
-					return retry.RetryableError(err)
-				}
-
-				if tfawserr.ErrMessageContains(err, docdb.ErrCodeInvalidDBClusterStateFault, "is not currently in the available state") {
-					return retry.RetryableError(err)
-				}
-
-				if tfawserr.ErrMessageContains(err, docdb.ErrCodeInvalidDBClusterStateFault, "DB cluster is not available for modification") {
-					return retry.RetryableError(err)
-				}
-
-				return retry.NonRetryableError(err)
-			}
-			return nil
-		})
-		if tfresource.TimedOut(err) {
-			_, err = conn.ModifyDBClusterWithContext(ctx, req)
-		}
-		if err != nil {
-			return sdkdiag.AppendErrorf(diags, "modifying DocumentDB Cluster (%s): %s", d.Id(), err)
-		}
-
-		log.Printf("[INFO] Waiting for DocumentDB Cluster (%s) to be available", d.Id())
-		err = waitForClusterUpdate(ctx, conn, d.Id(), d.Timeout(schema.TimeoutUpdate))
-		if err != nil {
-			return sdkdiag.AppendErrorf(diags, "waiting for DocumentDB Cluster (%s) to be available: %s", d.Id(), err)
-		}
-	}
-
 	return append(diags, resourceClusterRead(ctx, d, meta)...)
 }
 
 func resourceClusterDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).DocDBConn(ctx)
-	log.Printf("[DEBUG] Destroying DocumentDB Cluster (%s)", d.Id())
+
+	log.Printf("[DEBUG] Deleting DocumentDB Cluster: %s", d.Id())
 
 	// Automatically remove from global cluster to bypass this error on deletion:
 	// InvalidDBClusterStateFault: This cluster is a part of a global cluster, please remove it from globalcluster first
@@ -750,165 +636,236 @@ func resourceClusterDelete(ctx context.Context, d *schema.ResourceData, meta int
 
 		_, err := conn.RemoveFromGlobalClusterWithContext(ctx, input)
 
-		if err != nil && !tfawserr.ErrCodeEquals(err, docdb.ErrCodeGlobalClusterNotFoundFault) && !tfawserr.ErrMessageContains(err, "InvalidParameterValue", "is not found in global cluster") {
-			return sdkdiag.AppendErrorf(diags, "removing DocumentDB Cluster (%s) from DocumentDB Global Cluster: %s", d.Id(), err)
+		if err != nil && !tfawserr.ErrCodeEquals(err, docdb.ErrCodeGlobalClusterNotFoundFault) && !tfawserr.ErrMessageContains(err, errCodeInvalidParameterValue, "is not found in global cluster") {
+			return sdkdiag.AppendErrorf(diags, "removing DocumentDB Cluster (%s) from Global Cluster: %s", d.Id(), err)
 		}
 	}
 
-	deleteOpts := docdb.DeleteDBClusterInput{
+	input := &docdb.DeleteDBClusterInput{
 		DBClusterIdentifier: aws.String(d.Id()),
 	}
 
 	skipFinalSnapshot := d.Get("skip_final_snapshot").(bool)
-	deleteOpts.SkipFinalSnapshot = aws.Bool(skipFinalSnapshot)
+	input.SkipFinalSnapshot = aws.Bool(skipFinalSnapshot)
 
 	if !skipFinalSnapshot {
-		if name, present := d.GetOk("final_snapshot_identifier"); present {
-			deleteOpts.FinalDBSnapshotIdentifier = aws.String(name.(string))
+		if v, ok := d.GetOk("final_snapshot_identifier"); ok {
+			input.FinalDBSnapshotIdentifier = aws.String(v.(string))
 		} else {
 			return sdkdiag.AppendErrorf(diags, "DocumentDB Cluster FinalSnapshotIdentifier is required when a final snapshot is required")
 		}
 	}
 
-	err := retry.RetryContext(ctx, 5*time.Minute, func() *retry.RetryError {
-		_, err := conn.DeleteDBClusterWithContext(ctx, &deleteOpts)
-		if err != nil {
+	_, err := tfresource.RetryWhen(ctx, 5*time.Minute,
+		func() (interface{}, error) {
+			return conn.DeleteDBClusterWithContext(ctx, input)
+		},
+		func(err error) (bool, error) {
 			if tfawserr.ErrMessageContains(err, docdb.ErrCodeInvalidDBClusterStateFault, "is not currently in the available state") {
-				return retry.RetryableError(err)
+				return true, err
 			}
 			if tfawserr.ErrMessageContains(err, docdb.ErrCodeInvalidDBClusterStateFault, "cluster is a part of a global cluster") {
-				return retry.RetryableError(err)
-			}
-			if tfawserr.ErrCodeEquals(err, docdb.ErrCodeDBClusterNotFoundFault) {
-				return nil
+				return true, err
 			}
-			return retry.NonRetryableError(err)
-		}
-		return nil
-	})
-	if tfresource.TimedOut(err) {
-		_, err = conn.DeleteDBClusterWithContext(ctx, &deleteOpts)
-	}
-	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "DocumentDB Cluster cannot be deleted: %s", err)
-	}
 
-	stateConf := &retry.StateChangeConf{
-		Pending:    resourceClusterDeletePendingStates,
-		Target:     []string{"destroyed"},
-		Refresh:    resourceClusterStateRefreshFunc(ctx, conn, d.Id()),
-		Timeout:    d.Timeout(schema.TimeoutDelete),
-		MinTimeout: 10 * time.Second,
-		Delay:      30 * time.Second,
+			return false, err
+		},
+	)
+
+	if tfawserr.ErrCodeEquals(err, docdb.ErrCodeDBClusterNotFoundFault) {
+		return diags
 	}
 
-	// Wait, catching any errors
-	_, err = stateConf.WaitForStateContext(ctx)
 	if err != nil {
 		return sdkdiag.AppendErrorf(diags, "deleting DocumentDB Cluster (%s): %s", d.Id(), err)
 	}
 
+	if _, err := waitDBClusterDeleted(ctx, conn, d.Id(), d.Timeout(schema.TimeoutDelete)); err != nil {
+		return sdkdiag.AppendErrorf(diags, "waiting for DocumentDB Cluster (%s) delete: %s", d.Id(), err)
+	}
+
 	return diags
 }
 
-func resourceClusterStateRefreshFunc(ctx context.Context, conn *docdb.DocDB, dbClusterIdentifier string) retry.StateRefreshFunc {
-	return func() (interface{}, string, error) {
-		resp, err := conn.DescribeDBClustersWithContext(ctx, &docdb.DescribeDBClustersInput{
-			DBClusterIdentifier: aws.String(dbClusterIdentifier),
-		})
+func expandCloudwatchLogsExportConfiguration(d *schema.ResourceData) *docdb.CloudwatchLogsExportConfiguration { // nosemgrep:ci.caps0-in-func-name
+	oraw, nraw := d.GetChange("enabled_cloudwatch_logs_exports")
+	o := oraw.([]interface{})
+	n := nraw.([]interface{})
+
+	create, disable := diffCloudWatchLogsExportConfiguration(o, n)
+
+	return &docdb.CloudwatchLogsExportConfiguration{
+		EnableLogTypes:  flex.ExpandStringList(create),
+		DisableLogTypes: flex.ExpandStringList(disable),
+	}
+}
+
+func diffCloudWatchLogsExportConfiguration(old, new []interface{}) ([]interface{}, []interface{}) {
+	add := make([]interface{}, 0)
+	disable := make([]interface{}, 0)
 
-		if tfawserr.ErrCodeEquals(err, docdb.ErrCodeDBClusterNotFoundFault) {
-			return 42, "destroyed", nil
+	for _, n := range new {
+		if _, contains := verify.SliceContainsString(old, n.(string)); !contains {
+			add = append(add, n)
 		}
+	}
 
-		if err != nil {
-			return nil, "", err
+	for _, o := range old {
+		if _, contains := verify.SliceContainsString(new, o.(string)); !contains {
+			disable = append(disable, o)
 		}
+	}
 
-		var dbc *docdb.DBCluster
+	return add, disable
+}
 
-		for _, c := range resp.DBClusters {
-			if aws.StringValue(c.DBClusterIdentifier) == dbClusterIdentifier {
-				dbc = c
-			}
+func FindDBClusterByID(ctx context.Context, conn *docdb.DocDB, id string) (*docdb.DBCluster, error) {
+	input := &docdb.DescribeDBClustersInput{
+		DBClusterIdentifier: aws.String(id),
+	}
+	output, err := findDBCluster(ctx, conn, input)
+
+	if err != nil {
+		return nil, err
+	}
+
+	// Eventual consistency check.
+	if aws.StringValue(output.DBClusterIdentifier) != id {
+		return nil, &retry.NotFoundError{
+			LastRequest: input,
 		}
+	}
+
+	return output, nil
+}
+
+func findDBCluster(ctx context.Context, conn *docdb.DocDB, input *docdb.DescribeDBClustersInput) (*docdb.DBCluster, error) {
+	output, err := findDBClusters(ctx, conn, input)
 
-		if dbc == nil {
-			return 42, "destroyed", nil
+	if err != nil {
+		return nil, err
+	}
+
+	return tfresource.AssertSinglePtrResult(output)
+}
+
+func findDBClusters(ctx context.Context, conn *docdb.DocDB, input *docdb.DescribeDBClustersInput) ([]*docdb.DBCluster, error) {
+	var output []*docdb.DBCluster
+
+	err := conn.DescribeDBClustersPagesWithContext(ctx, input, func(page *docdb.DescribeDBClustersOutput, lastPage bool) bool {
+		if page == nil {
+			return !lastPage
 		}
 
-		if dbc.Status != nil {
-			log.Printf("[DEBUG] DB Cluster status (%s): %s", dbClusterIdentifier, *dbc.Status)
+		for _, v := range page.DBClusters {
+			if v != nil {
+				output = append(output, v)
+			}
 		}
 
-		return dbc, aws.StringValue(dbc.Status), nil
+		return !lastPage
+	})
+
+	if tfawserr.ErrCodeEquals(err, docdb.ErrCodeDBClusterNotFoundFault) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
 	}
-}
 
-var resourceClusterCreatePendingStates = []string{
-	"creating",
-	"backing-up",
-	"modifying",
-	"preparing-data-migration",
-	"migrating",
-	"resetting-master-credentials",
-}
+	if err != nil {
+		return nil, err
+	}
 
-var resourceClusterDeletePendingStates = []string{
-	"available",
-	"deleting",
-	"backing-up",
-	"modifying",
+	return output, nil
 }
 
-var resourceClusterUpdatePendingStates = []string{
-	"backing-up",
-	"modifying",
-	"resetting-master-credentials",
-	"upgrading",
+func statusDBCluster(ctx context.Context, conn *docdb.DocDB, id string) retry.StateRefreshFunc {
+	return func() (interface{}, string, error) {
+		output, err := FindDBClusterByID(ctx, conn, id)
+
+		if tfresource.NotFound(err) {
+			return nil, "", nil
+		}
+
+		if err != nil {
+			return nil, "", err
+		}
+
+		return output, aws.StringValue(output.Status), nil
+	}
 }
 
-func waitForClusterUpdate(ctx context.Context, conn *docdb.DocDB, id string, timeout time.Duration) error {
+func waitDBClusterCreated(ctx context.Context, conn *docdb.DocDB, id string, timeout time.Duration) (*docdb.DBCluster, error) {
 	stateConf := &retry.StateChangeConf{
-		Pending:    resourceClusterUpdatePendingStates,
+		Pending: []string{
+			"creating",
+			"backing-up",
+			"modifying",
+			"preparing-data-migration",
+			"migrating",
+			"resetting-master-credentials",
+		},
 		Target:     []string{"available"},
-		Refresh:    resourceClusterStateRefreshFunc(ctx, conn, id),
+		Refresh:    statusDBCluster(ctx, conn, id),
 		Timeout:    timeout,
 		MinTimeout: 10 * time.Second,
-		Delay:      30 * time.Second, // Wait 30 secs before starting
+		Delay:      30 * time.Second,
 	}
-	_, err := stateConf.WaitForStateContext(ctx)
-	return err
+
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+
+	if output, ok := outputRaw.(*docdb.DBCluster); ok {
+		return output, err
+	}
+
+	return nil, err
 }
 
-func buildCloudWatchLogsExportConfiguration(d *schema.ResourceData) *docdb.CloudwatchLogsExportConfiguration {
-	oraw, nraw := d.GetChange("enabled_cloudwatch_logs_exports")
-	o := oraw.([]interface{})
-	n := nraw.([]interface{})
+func waitDBClusterUpdated(ctx context.Context, conn *docdb.DocDB, id string, timeout time.Duration) (*docdb.DBCluster, error) { //nolint:unparam
+	stateConf := &retry.StateChangeConf{
+		Pending: []string{
+			"backing-up",
+			"modifying",
+			"resetting-master-credentials",
+			"upgrading",
+		},
+		Target:     []string{"available"},
+		Refresh:    statusDBCluster(ctx, conn, id),
+		Timeout:    timeout,
+		MinTimeout: 10 * time.Second,
+		Delay:      30 * time.Second,
+	}
 
-	create, disable := diffCloudWatchLogsExportConfiguration(o, n)
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
 
-	return &docdb.CloudwatchLogsExportConfiguration{
-		EnableLogTypes:  flex.ExpandStringList(create),
-		DisableLogTypes: flex.ExpandStringList(disable),
+	if output, ok := outputRaw.(*docdb.DBCluster); ok {
+		return output, err
 	}
-}
 
-func diffCloudWatchLogsExportConfiguration(old, new []interface{}) ([]interface{}, []interface{}) {
-	add := make([]interface{}, 0)
-	disable := make([]interface{}, 0)
+	return nil, err
+}
 
-	for _, n := range new {
-		if _, contains := verify.SliceContainsString(old, n.(string)); !contains {
-			add = append(add, n)
-		}
+func waitDBClusterDeleted(ctx context.Context, conn *docdb.DocDB, id string, timeout time.Duration) (*docdb.DBCluster, error) {
+	stateConf := &retry.StateChangeConf{
+		Pending: []string{
+			"available",
+			"deleting",
+			"backing-up",
+			"modifying",
+		},
+		Target:     []string{},
+		Refresh:    statusDBCluster(ctx, conn, id),
+		Timeout:    timeout,
+		MinTimeout: 10 * time.Second,
+		Delay:      30 * time.Second,
 	}
 
-	for _, o := range old {
-		if _, contains := verify.SliceContainsString(new, o.(string)); !contains {
-			disable = append(disable, o)
-		}
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+
+	if output, ok := outputRaw.(*docdb.DBCluster); ok {
+		return output, err
 	}
 
-	return add, disable
+	return nil, err
 }
diff --git a/internal/service/docdb/cluster_instance.go b/internal/service/docdb/cluster_instance.go
index 3a4bd2299ba..0378f2c573b 100644
--- a/internal/service/docdb/cluster_instance.go
+++ b/internal/service/docdb/cluster_instance.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package docdb
 
 import (
@@ -10,12 +13,13 @@ import (
 	"github.com/aws/aws-sdk-go/service/docdb"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/create"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
+	tfslices "github.com/hashicorp/terraform-provider-aws/internal/slices"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
@@ -30,6 +34,7 @@ func ResourceClusterInstance() *schema.Resource {
 		ReadWithoutTimeout:   resourceClusterInstanceRead,
 		UpdateWithoutTimeout: resourceClusterInstanceUpdate,
 		DeleteWithoutTimeout: resourceClusterInstanceDelete,
+
 		Importer: &schema.ResourceImporter{
 			StateContext: schema.ImportStatePassthroughContext,
 		},
@@ -41,12 +46,9 @@ func ResourceClusterInstance() *schema.Resource {
 		},
 
 		Schema: map[string]*schema.Schema{
-			// apply_immediately is used to determine when the update modifications take place.
-			// See http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.DBInstance.Modifying.html
 			"apply_immediately": {
 				Type:     schema.TypeBool,
 				Optional: true,
-				Computed: true,
 			},
 			"arn": {
 				Type:     schema.TypeString,
@@ -60,8 +62,8 @@ func ResourceClusterInstance() *schema.Resource {
 			"availability_zone": {
 				Type:     schema.TypeString,
 				Optional: true,
-				ForceNew: true,
 				Computed: true,
+				ForceNew: true,
 			},
 			"ca_cert_identifier": {
 				Type:     schema.TypeString,
@@ -73,6 +75,10 @@ func ResourceClusterInstance() *schema.Resource {
 				Required: true,
 				ForceNew: true,
 			},
+			"copy_tags_to_snapshot": {
+				Type:     schema.TypeBool,
+				Optional: true,
+			},
 			"db_subnet_group_name": {
 				Type:     schema.TypeString,
 				Computed: true,
@@ -84,7 +90,6 @@ func ResourceClusterInstance() *schema.Resource {
 			"enable_performance_insights": {
 				Type:     schema.TypeBool,
 				Optional: true,
-				Computed: true,
 			},
 			"endpoint": {
 				Type:     schema.TypeString,
@@ -94,8 +99,8 @@ func ResourceClusterInstance() *schema.Resource {
 				Type:         schema.TypeString,
 				Optional:     true,
 				ForceNew:     true,
-				Default:      "docdb",
-				ValidateFunc: validEngine(),
+				Default:      engineDocDB,
+				ValidateFunc: validation.StringInSlice(engine_Values(), false),
 			},
 			"engine_version": {
 				Type:     schema.TypeString,
@@ -180,76 +185,53 @@ func resourceClusterInstanceCreate(ctx context.Context, d *schema.ResourceData,
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).DocDBConn(ctx)
 
+	identifier := create.NewNameGenerator(
+		create.WithConfiguredName(d.Get("identifier").(string)),
+		create.WithConfiguredPrefix(d.Get("identifier_prefix").(string)),
+		create.WithDefaultPrefix("tf-"),
+	).Generate()
 	input := &docdb.CreateDBInstanceInput{
-		DBInstanceClass:         aws.String(d.Get("instance_class").(string)),
+		AutoMinorVersionUpgrade: aws.Bool(d.Get("auto_minor_version_upgrade").(bool)),
 		DBClusterIdentifier:     aws.String(d.Get("cluster_identifier").(string)),
+		DBInstanceClass:         aws.String(d.Get("instance_class").(string)),
+		DBInstanceIdentifier:    aws.String(identifier),
 		Engine:                  aws.String(d.Get("engine").(string)),
 		PromotionTier:           aws.Int64(int64(d.Get("promotion_tier").(int))),
-		AutoMinorVersionUpgrade: aws.Bool(d.Get("auto_minor_version_upgrade").(bool)),
 		Tags:                    getTagsIn(ctx),
 	}
 
-	if attr, ok := d.GetOk("availability_zone"); ok {
-		input.AvailabilityZone = aws.String(attr.(string))
+	if v, ok := d.GetOk("availability_zone"); ok {
+		input.AvailabilityZone = aws.String(v.(string))
 	}
 
-	if attr, ok := d.GetOk("enable_performance_insights"); ok {
-		input.EnablePerformanceInsights = aws.Bool(attr.(bool))
+	if v, ok := d.GetOk("copy_tags_to_snapshot"); ok {
+		input.CopyTagsToSnapshot = aws.Bool(v.(bool))
 	}
 
-	if v, ok := d.GetOk("identifier"); ok {
-		input.DBInstanceIdentifier = aws.String(v.(string))
-	} else {
-		if v, ok := d.GetOk("identifier_prefix"); ok {
-			input.DBInstanceIdentifier = aws.String(id.PrefixedUniqueId(v.(string)))
-		} else {
-			input.DBInstanceIdentifier = aws.String(id.PrefixedUniqueId("tf-"))
-		}
+	if v, ok := d.GetOk("enable_performance_insights"); ok {
+		input.EnablePerformanceInsights = aws.Bool(v.(bool))
 	}
 
-	if attr, ok := d.GetOk("performance_insights_kms_key_id"); ok {
-		input.PerformanceInsightsKMSKeyId = aws.String(attr.(string))
+	if v, ok := d.GetOk("performance_insights_kms_key_id"); ok {
+		input.PerformanceInsightsKMSKeyId = aws.String(v.(string))
 	}
 
-	if attr, ok := d.GetOk("preferred_maintenance_window"); ok {
-		input.PreferredMaintenanceWindow = aws.String(attr.(string))
+	if v, ok := d.GetOk("preferred_maintenance_window"); ok {
+		input.PreferredMaintenanceWindow = aws.String(v.(string))
 	}
 
-	var resp *docdb.CreateDBInstanceOutput
-	err := retry.RetryContext(ctx, propagationTimeout, func() *retry.RetryError {
-		var err error
-		resp, err = conn.CreateDBInstanceWithContext(ctx, input)
-		if err != nil {
-			if tfawserr.ErrMessageContains(err, "InvalidParameterValue", "IAM role ARN value is invalid or does not include the required permissions") {
-				return retry.RetryableError(err)
-			}
-			return retry.NonRetryableError(err)
-		}
-		return nil
-	})
-	if tfresource.TimedOut(err) {
-		resp, err = conn.CreateDBInstanceWithContext(ctx, input)
-	}
+	_, err := tfresource.RetryWhenAWSErrMessageContains(ctx, propagationTimeout, func() (interface{}, error) {
+		return conn.CreateDBInstanceWithContext(ctx, input)
+	}, errCodeInvalidParameterValue, "IAM role ARN value is invalid or does not include the required permissions")
+
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "creating DocumentDB Cluster Instance: %s", err)
+		return sdkdiag.AppendErrorf(diags, "creating DocumentDB Cluster Instance (%s): %s", identifier, err)
 	}
 
-	d.SetId(aws.StringValue(resp.DBInstance.DBInstanceIdentifier))
-
-	// reuse db_instance refresh func
-	stateConf := &retry.StateChangeConf{
-		Pending:    resourceClusterInstanceCreateUpdatePendingStates,
-		Target:     []string{"available"},
-		Refresh:    resourceInstanceStateRefreshFunc(ctx, conn, d.Id()),
-		Timeout:    d.Timeout(schema.TimeoutCreate),
-		MinTimeout: 10 * time.Second,
-		Delay:      30 * time.Second,
-	}
+	d.SetId(identifier)
 
-	// Wait, catching any errors
-	_, err = stateConf.WaitForStateContext(ctx)
-	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "waiting for DocumentDB Cluster Instance (%s) to become available: %s", d.Id(), err)
+	if _, err := waitDBInstanceAvailable(ctx, conn, d.Id(), d.Timeout(schema.TimeoutCreate)); err != nil {
+		return sdkdiag.AppendErrorf(diags, "waiting for DocumentDB Cluster Instance (%s) create: %s", d.Id(), err)
 	}
 
 	return append(diags, resourceClusterInstanceRead(ctx, d, meta)...)
@@ -259,63 +241,46 @@ func resourceClusterInstanceRead(ctx context.Context, d *schema.ResourceData, me
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).DocDBConn(ctx)
 
-	db, err := resourceInstanceRetrieve(ctx, conn, d.Id())
+	db, err := FindDBInstanceByID(ctx, conn, d.Id())
+
 	if !d.IsNewResource() && tfresource.NotFound(err) {
-		log.Printf("[WARN] DocumentDB Cluster Instance (%s): not found, removing from state.", d.Id())
+		log.Printf("[WARN] DocumentDB Cluster Instance (%s) not found, removing from state", d.Id())
 		d.SetId("")
-		return diags
-	}
-	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "retrieving DocumentDB Cluster Instance (%s): %s", d.Id(), err)
-	}
-
-	// Retrieve DB Cluster information, to determine if this Instance is a writer
-	resp, err := conn.DescribeDBClustersWithContext(ctx, &docdb.DescribeDBClustersInput{
-		DBClusterIdentifier: db.DBClusterIdentifier,
-	})
-
-	var dbc *docdb.DBCluster
-	for _, c := range resp.DBClusters {
-		if aws.StringValue(c.DBClusterIdentifier) == aws.StringValue(db.DBClusterIdentifier) {
-			dbc = c
-		}
-	}
-
-	if dbc == nil {
-		return sdkdiag.AppendErrorf(diags, "finding DocumentDB Cluster (%s) for Cluster Instance (%s): %s",
-			aws.StringValue(db.DBClusterIdentifier), aws.StringValue(db.DBInstanceIdentifier), err)
+		return nil
 	}
 
-	for _, m := range dbc.DBClusterMembers {
-		if aws.StringValue(db.DBInstanceIdentifier) == aws.StringValue(m.DBInstanceIdentifier) {
-			if *m.IsClusterWriter {
-				d.Set("writer", true)
-			} else {
-				d.Set("writer", false)
-			}
-		}
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "reading DocumentDB Cluster Instance (%s): %s", d.Id(), err)
 	}
 
-	if db.Endpoint != nil {
-		d.Set("endpoint", db.Endpoint.Address)
-		d.Set("port", db.Endpoint.Port)
-	}
+	clusterID := aws.StringValue(db.DBClusterIdentifier)
+	dbc, err := FindDBClusterByID(ctx, conn, clusterID)
 
-	if db.DBSubnetGroup != nil {
-		d.Set("db_subnet_group_name", db.DBSubnetGroup.DBSubnetGroupName)
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "reading DocumentDB Cluster (%s): %s", clusterID, err)
 	}
 
 	d.Set("arn", db.DBInstanceArn)
 	d.Set("auto_minor_version_upgrade", db.AutoMinorVersionUpgrade)
 	d.Set("availability_zone", db.AvailabilityZone)
+	d.Set("ca_cert_identifier", db.CACertificateIdentifier)
 	d.Set("cluster_identifier", db.DBClusterIdentifier)
+	d.Set("copy_tags_to_snapshot", db.CopyTagsToSnapshot)
+	if db.DBSubnetGroup != nil {
+		d.Set("db_subnet_group_name", db.DBSubnetGroup.DBSubnetGroupName)
+	}
 	d.Set("dbi_resource_id", db.DbiResourceId)
 	// The AWS API does not expose 'EnablePerformanceInsights' the line below should be uncommented
 	// as soon as it is available in the DescribeDBClusters output.
 	//d.Set("enable_performance_insights", db.EnablePerformanceInsights)
-	d.Set("engine_version", db.EngineVersion)
+	if db.Endpoint != nil {
+		d.Set("endpoint", db.Endpoint.Address)
+		d.Set("port", db.Endpoint.Port)
+	}
 	d.Set("engine", db.Engine)
+	d.Set("engine_version", db.EngineVersion)
 	d.Set("identifier", db.DBInstanceIdentifier)
+	d.Set("identifier_prefix", create.NamePrefixFromName(aws.StringValue(db.DBInstanceIdentifier)))
 	d.Set("instance_class", db.DBInstanceClass)
 	d.Set("kms_key_id", db.KmsKeyId)
 	// The AWS API does not expose 'PerformanceInsightsKMSKeyId'  the line below should be uncommented
@@ -326,7 +291,11 @@ func resourceClusterInstanceRead(ctx context.Context, d *schema.ResourceData, me
 	d.Set("promotion_tier", db.PromotionTier)
 	d.Set("publicly_accessible", db.PubliclyAccessible)
 	d.Set("storage_encrypted", db.StorageEncrypted)
-	d.Set("ca_cert_identifier", db.CACertificateIdentifier)
+	if v := tfslices.Filter(dbc.DBClusterMembers, func(v *docdb.DBClusterMember) bool {
+		return aws.StringValue(v.DBInstanceIdentifier) == d.Id()
+	}); len(v) == 1 {
+		d.Set("writer", v[0].IsClusterWriter)
+	}
 
 	return diags
 }
@@ -334,79 +303,54 @@ func resourceClusterInstanceRead(ctx context.Context, d *schema.ResourceData, me
 func resourceClusterInstanceUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).DocDBConn(ctx)
-	requestUpdate := false
-
-	req := &docdb.ModifyDBInstanceInput{
-		ApplyImmediately:     aws.Bool(d.Get("apply_immediately").(bool)),
-		DBInstanceIdentifier: aws.String(d.Id()),
-	}
 
-	if d.HasChange("instance_class") {
-		req.DBInstanceClass = aws.String(d.Get("instance_class").(string))
-		requestUpdate = true
-	}
-
-	if d.HasChange("preferred_maintenance_window") {
-		req.PreferredMaintenanceWindow = aws.String(d.Get("preferred_maintenance_window").(string))
-		requestUpdate = true
-	}
+	if d.HasChangesExcept("tags", "tags_all") {
+		input := &docdb.ModifyDBInstanceInput{
+			ApplyImmediately:     aws.Bool(d.Get("apply_immediately").(bool)),
+			DBInstanceIdentifier: aws.String(d.Id()),
+		}
 
-	if d.HasChange("auto_minor_version_upgrade") {
-		req.AutoMinorVersionUpgrade = aws.Bool(d.Get("auto_minor_version_upgrade").(bool))
-		requestUpdate = true
-	}
+		if d.HasChange("auto_minor_version_upgrade") {
+			input.AutoMinorVersionUpgrade = aws.Bool(d.Get("auto_minor_version_upgrade").(bool))
+		}
 
-	if d.HasChange("promotion_tier") {
-		req.PromotionTier = aws.Int64(int64(d.Get("promotion_tier").(int)))
-		requestUpdate = true
-	}
+		if d.HasChange("ca_cert_identifier") {
+			input.CACertificateIdentifier = aws.String(d.Get("ca_cert_identifier").(string))
+		}
 
-	if d.HasChange("ca_cert_identifier") {
-		req.CACertificateIdentifier = aws.String(d.Get("ca_cert_identifier").(string))
-		requestUpdate = true
-	}
+		if d.HasChange("copy_tags_to_snapshot") {
+			input.CopyTagsToSnapshot = aws.Bool(d.Get("copy_tags_to_snapshot").(bool))
+		}
 
-	if d.HasChange("enable_performance_insights") {
-		req.EnablePerformanceInsights = aws.Bool(d.Get("enable_performance_insights").(bool))
-		requestUpdate = true
-	}
+		if d.HasChange("enable_performance_insights") {
+			input.EnablePerformanceInsights = aws.Bool(d.Get("enable_performance_insights").(bool))
+		}
 
-	if d.HasChange("performance_insights_kms_key_id") {
-		req.PerformanceInsightsKMSKeyId = aws.String(d.Get("performance_insights_kms_key_id").(string))
-		requestUpdate = true
-	}
+		if d.HasChange("instance_class") {
+			input.DBInstanceClass = aws.String(d.Get("instance_class").(string))
+		}
 
-	if requestUpdate {
-		err := retry.RetryContext(ctx, propagationTimeout, func() *retry.RetryError {
-			_, err := conn.ModifyDBInstanceWithContext(ctx, req)
-			if err != nil {
-				if tfawserr.ErrMessageContains(err, "InvalidParameterValue", "IAM role ARN value is invalid or does not include the required permissions") {
-					return retry.RetryableError(err)
-				}
-				return retry.NonRetryableError(err)
-			}
-			return nil
-		})
-		if tfresource.TimedOut(err) {
-			_, err = conn.ModifyDBInstanceWithContext(ctx, req)
+		if d.HasChange("performance_insights_kms_key_id") {
+			input.PerformanceInsightsKMSKeyId = aws.String(d.Get("performance_insights_kms_key_id").(string))
 		}
-		if err != nil {
-			return sdkdiag.AppendErrorf(diags, "modifying DB Instance %s: %s", d.Id(), err)
+
+		if d.HasChange("preferred_maintenance_window") {
+			input.PreferredMaintenanceWindow = aws.String(d.Get("preferred_maintenance_window").(string))
 		}
 
-		// reuse db_instance refresh func
-		stateConf := &retry.StateChangeConf{
-			Pending:    resourceClusterInstanceCreateUpdatePendingStates,
-			Target:     []string{"available"},
-			Refresh:    resourceInstanceStateRefreshFunc(ctx, conn, d.Id()),
-			Timeout:    d.Timeout(schema.TimeoutUpdate),
-			MinTimeout: 10 * time.Second,
-			Delay:      30 * time.Second, // Wait 30 secs before starting
+		if d.HasChange("promotion_tier") {
+			input.PromotionTier = aws.Int64(int64(d.Get("promotion_tier").(int)))
 		}
 
-		// Wait, catching any errors
-		_, err = stateConf.WaitForStateContext(ctx)
+		_, err := tfresource.RetryWhenAWSErrMessageContains(ctx, propagationTimeout, func() (interface{}, error) {
+			return conn.ModifyDBInstanceWithContext(ctx, input)
+		}, errCodeInvalidParameterValue, "IAM role ARN value is invalid or does not include the required permissions")
+
 		if err != nil {
+			return sdkdiag.AppendErrorf(diags, "modifying DocumentDB Cluster Instance (%s): %s", d.Id(), err)
+		}
+
+		if _, err := waitDBInstanceAvailable(ctx, conn, d.Id(), d.Timeout(schema.TimeoutUpdate)); err != nil {
 			return sdkdiag.AppendErrorf(diags, "waiting for DocumentDB Cluster Instance (%s) update: %s", d.Id(), err)
 		}
 	}
@@ -418,92 +362,151 @@ func resourceClusterInstanceDelete(ctx context.Context, d *schema.ResourceData,
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).DocDBConn(ctx)
 
-	opts := docdb.DeleteDBInstanceInput{DBInstanceIdentifier: aws.String(d.Id())}
+	log.Printf("[DEBUG] Deleting DocumentDB Cluster Instance: %s", d.Id())
+	_, err := conn.DeleteDBInstanceWithContext(ctx, &docdb.DeleteDBInstanceInput{
+		DBInstanceIdentifier: aws.String(d.Id()),
+	})
 
-	if _, err := conn.DeleteDBInstanceWithContext(ctx, &opts); err != nil {
+	if err != nil {
 		return sdkdiag.AppendErrorf(diags, "deleting DocumentDB Cluster Instance (%s): %s", d.Id(), err)
 	}
 
-	// re-uses db_instance refresh func
-	log.Println("[INFO] Waiting for DocumentDB Cluster Instance to be destroyed")
-	stateConf := &retry.StateChangeConf{
-		Pending:    resourceClusterInstanceDeletePendingStates,
-		Target:     []string{},
-		Refresh:    resourceInstanceStateRefreshFunc(ctx, conn, d.Id()),
-		Timeout:    d.Timeout(schema.TimeoutDelete),
-		MinTimeout: 10 * time.Second,
-		Delay:      30 * time.Second, // Wait 30 secs before starting
-	}
-
-	if _, err := stateConf.WaitForStateContext(ctx); err != nil {
-		return sdkdiag.AppendErrorf(diags, "waiting for DocumentDB Cluster Instance (%s) deletion: %s", d.Id(), err)
+	if _, err := waitDBInstanceDeleted(ctx, conn, d.Id(), d.Timeout(schema.TimeoutDelete)); err != nil {
+		return sdkdiag.AppendErrorf(diags, "waiting for DocumentDB Cluster Instance (%s) delete: %s", d.Id(), err)
 	}
 
 	return diags
 }
 
-func resourceInstanceStateRefreshFunc(ctx context.Context, conn *docdb.DocDB, id string) retry.StateRefreshFunc {
-	return func() (interface{}, string, error) {
-		v, err := resourceInstanceRetrieve(ctx, conn, id)
+func FindDBInstanceByID(ctx context.Context, conn *docdb.DocDB, id string) (*docdb.DBInstance, error) {
+	input := &docdb.DescribeDBInstancesInput{
+		DBInstanceIdentifier: aws.String(id),
+	}
+	output, err := findDBInstance(ctx, conn, input)
 
-		if tfresource.NotFound(err) {
-			return nil, "", nil
-		}
-		if err != nil {
-			return nil, "", err
-		}
+	if err != nil {
+		return nil, err
+	}
 
-		return v, aws.StringValue(v.DBInstanceStatus), nil
+	// Eventual consistency check.
+	if aws.StringValue(output.DBInstanceIdentifier) != id {
+		return nil, &retry.NotFoundError{
+			LastRequest: input,
+		}
 	}
+
+	return output, nil
 }
 
-// resourceInstanceRetrieve fetches DBInstance information from the AWS
-// API. It returns an error if there is a communication problem or unexpected
-// error with AWS. When the DBInstance is not found, it returns no error and a
-// nil pointer.
-func resourceInstanceRetrieve(ctx context.Context, conn *docdb.DocDB, id string) (*docdb.DBInstance, error) {
-	input := docdb.DescribeDBInstancesInput{
-		DBInstanceIdentifier: aws.String(id),
+func findDBInstance(ctx context.Context, conn *docdb.DocDB, input *docdb.DescribeDBInstancesInput) (*docdb.DBInstance, error) {
+	output, err := findDBInstances(ctx, conn, input)
+
+	if err != nil {
+		return nil, err
 	}
-	out, err := conn.DescribeDBInstancesWithContext(ctx, &input)
+
+	return tfresource.AssertSinglePtrResult(output)
+}
+
+func findDBInstances(ctx context.Context, conn *docdb.DocDB, input *docdb.DescribeDBInstancesInput) ([]*docdb.DBInstance, error) {
+	var output []*docdb.DBInstance
+
+	err := conn.DescribeDBInstancesPagesWithContext(ctx, input, func(page *docdb.DescribeDBInstancesOutput, lastPage bool) bool {
+		if page == nil {
+			return !lastPage
+		}
+
+		for _, v := range page.DBInstances {
+			if v != nil {
+				output = append(output, v)
+			}
+		}
+
+		return !lastPage
+	})
+
 	if tfawserr.ErrCodeEquals(err, docdb.ErrCodeDBInstanceNotFoundFault) {
 		return nil, &retry.NotFoundError{
 			LastError:   err,
 			LastRequest: input,
 		}
 	}
+
 	if err != nil {
 		return nil, err
 	}
 
-	switch count := len(out.DBInstances); count {
-	case 0:
-		return nil, tfresource.NewEmptyResultError(input)
-	case 1:
-		return out.DBInstances[0], nil
-	default:
-		return nil, tfresource.NewTooManyResultsError(count, input)
+	return output, nil
+}
+
+func statusDBInstance(ctx context.Context, conn *docdb.DocDB, id string) retry.StateRefreshFunc {
+	return func() (interface{}, string, error) {
+		output, err := FindDBInstanceByID(ctx, conn, id)
+
+		if tfresource.NotFound(err) {
+			return nil, "", nil
+		}
+
+		if err != nil {
+			return nil, "", err
+		}
+
+		return output, aws.StringValue(output.DBInstanceStatus), nil
 	}
 }
 
-var resourceClusterInstanceCreateUpdatePendingStates = []string{
-	"backing-up",
-	"configuring-enhanced-monitoring",
-	"configuring-iam-database-auth",
-	"configuring-log-exports",
-	"creating",
-	"maintenance",
-	"modifying",
-	"rebooting",
-	"renaming",
-	"resetting-master-credentials",
-	"starting",
-	"storage-optimization",
-	"upgrading",
+func waitDBInstanceAvailable(ctx context.Context, conn *docdb.DocDB, id string, timeout time.Duration) (*docdb.DBInstance, error) { //nolint:unparam
+	stateConf := &retry.StateChangeConf{
+		Pending: []string{
+			"backing-up",
+			"configuring-enhanced-monitoring",
+			"configuring-iam-database-auth",
+			"configuring-log-exports",
+			"creating",
+			"maintenance",
+			"modifying",
+			"rebooting",
+			"renaming",
+			"resetting-master-credentials",
+			"starting",
+			"storage-optimization",
+			"upgrading",
+		},
+		Target:     []string{"available"},
+		Refresh:    statusDBInstance(ctx, conn, id),
+		Timeout:    timeout,
+		MinTimeout: 10 * time.Second,
+		Delay:      30 * time.Second,
+	}
+
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+
+	if output, ok := outputRaw.(*docdb.DBInstance); ok {
+		return output, err
+	}
+
+	return nil, err
 }
 
-var resourceClusterInstanceDeletePendingStates = []string{
-	"configuring-log-exports",
-	"modifying",
-	"deleting",
+func waitDBInstanceDeleted(ctx context.Context, conn *docdb.DocDB, id string, timeout time.Duration) (*docdb.DBInstance, error) {
+	stateConf := &retry.StateChangeConf{
+		Pending: []string{
+			"configuring-log-exports",
+			"modifying",
+			"deleting",
+		},
+		Target:     []string{},
+		Refresh:    statusDBInstance(ctx, conn, id),
+		Timeout:    timeout,
+		MinTimeout: 10 * time.Second,
+		Delay:      30 * time.Second,
+	}
+
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+
+	if output, ok := outputRaw.(*docdb.DBInstance); ok {
+		return output, err
+	}
+
+	return nil, err
 }
diff --git a/internal/service/docdb/cluster_instance_test.go b/internal/service/docdb/cluster_instance_test.go
index a2ca687326b..b8b9bc38024 100644
--- a/internal/service/docdb/cluster_instance_test.go
+++ b/internal/service/docdb/cluster_instance_test.go
@@ -1,94 +1,163 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package docdb_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
-	"strings"
 	"testing"
-	"time"
 
-	"github.com/aws/aws-sdk-go/aws"
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/docdb"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	tfdocdb "github.com/hashicorp/terraform-provider-aws/internal/service/docdb"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
 func TestAccDocDBClusterInstance_basic(t *testing.T) {
 	ctx := acctest.Context(t)
 	var v docdb.DBInstance
-	resourceName := "aws_docdb_cluster_instance.cluster_instances"
+	resourceName := "aws_docdb_cluster_instance.test"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
 		ErrorCheck:               acctest.ErrorCheck(t, docdb.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckClusterDestroy(ctx),
+		CheckDestroy:             testAccCheckClusterInstanceDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccClusterInstanceConfig_basic(rName),
-				Check: resource.ComposeTestCheckFunc(
+				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckClusterInstanceExists(ctx, resourceName, &v),
-					testAccCheckClusterInstanceAttributes(&v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "rds", regexp.MustCompile(`db:.+`)),
+					resource.TestCheckNoResourceAttr(resourceName, "apply_immediately"),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "rds", regexache.MustCompile(fmt.Sprintf("db:%s", rName))),
 					resource.TestCheckResourceAttr(resourceName, "auto_minor_version_upgrade", "true"),
-					resource.TestCheckResourceAttrSet(resourceName, "preferred_maintenance_window"),
-					resource.TestCheckResourceAttrSet(resourceName, "preferred_backup_window"),
-					resource.TestCheckResourceAttrSet(resourceName, "dbi_resource_id"),
 					resource.TestCheckResourceAttrSet(resourceName, "availability_zone"),
-					resource.TestCheckResourceAttrSet(resourceName, "engine_version"),
 					resource.TestCheckResourceAttrSet(resourceName, "ca_cert_identifier"),
+					resource.TestCheckResourceAttrSet(resourceName, "cluster_identifier"),
+					resource.TestCheckResourceAttr(resourceName, "copy_tags_to_snapshot", "false"),
+					resource.TestCheckResourceAttrSet(resourceName, "db_subnet_group_name"),
+					resource.TestCheckResourceAttrSet(resourceName, "dbi_resource_id"),
+					resource.TestCheckNoResourceAttr(resourceName, "enable_performance_insights"),
+					resource.TestCheckResourceAttrSet(resourceName, "endpoint"),
 					resource.TestCheckResourceAttr(resourceName, "engine", "docdb"),
+					resource.TestCheckResourceAttrSet(resourceName, "engine_version"),
+					resource.TestCheckResourceAttr(resourceName, "identifier", rName),
+					resource.TestCheckResourceAttr(resourceName, "identifier_prefix", ""),
+					resource.TestCheckResourceAttrSet(resourceName, "instance_class"),
+					resource.TestCheckResourceAttr(resourceName, "kms_key_id", ""),
+					resource.TestCheckNoResourceAttr(resourceName, "performance_insights_kms_key_id"),
+					resource.TestCheckResourceAttrSet(resourceName, "port"),
+					resource.TestCheckResourceAttrSet(resourceName, "preferred_backup_window"),
+					resource.TestCheckResourceAttrSet(resourceName, "preferred_maintenance_window"),
+					resource.TestCheckResourceAttr(resourceName, "promotion_tier", "0"),
+					resource.TestCheckResourceAttrSet(resourceName, "publicly_accessible"),
+					resource.TestCheckResourceAttrSet(resourceName, "storage_encrypted"),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
+					resource.TestCheckResourceAttr(resourceName, "writer", "true"),
 				),
 			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{
+					"apply_immediately",
+				},
+			},
 			{
 				Config: testAccClusterInstanceConfig_modified(rName),
-				Check: resource.ComposeTestCheckFunc(
+				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckClusterInstanceExists(ctx, resourceName, &v),
-					testAccCheckClusterInstanceAttributes(&v),
+					resource.TestCheckResourceAttr(resourceName, "apply_immediately", "true"),
 					resource.TestCheckResourceAttr(resourceName, "auto_minor_version_upgrade", "false"),
+					resource.TestCheckResourceAttr(resourceName, "promotion_tier", "3"),
 				),
 			},
+		},
+	})
+}
 
+func TestAccDocDBClusterInstance_disappears(t *testing.T) {
+	ctx := acctest.Context(t)
+	var v docdb.DBInstance
+	resourceName := "aws_docdb_cluster_instance.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, docdb.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckClusterInstanceDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccClusterInstanceConfig_basic(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckClusterInstanceExists(ctx, resourceName, &v),
+					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfdocdb.ResourceClusterInstance(), resourceName),
+				),
+				ExpectNonEmptyPlan: true,
+			},
+		},
+	})
+}
+
+func TestAccDocDBClusterInstance_identifierGenerated(t *testing.T) {
+	ctx := acctest.Context(t)
+	var v docdb.DBInstance
+	resourceName := "aws_docdb_cluster_instance.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, docdb.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckClusterInstanceDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccClusterInstanceConfig_identifierGenerated(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckClusterInstanceExists(ctx, resourceName, &v),
+					acctest.CheckResourceAttrNameGeneratedWithPrefix(resourceName, "identifier", "tf-"),
+					resource.TestCheckResourceAttr(resourceName, "identifier_prefix", "tf-"),
+				),
+			},
 			{
 				ResourceName:      resourceName,
 				ImportState:       true,
 				ImportStateVerify: true,
 				ImportStateVerifyIgnore: []string{
 					"apply_immediately",
-					"identifier_prefix",
 				},
 			},
 		},
 	})
 }
 
-func TestAccDocDBClusterInstance_performanceInsights(t *testing.T) {
+func TestAccDocDBClusterInstance_identifierPrefix(t *testing.T) {
 	ctx := acctest.Context(t)
 	var v docdb.DBInstance
 	resourceName := "aws_docdb_cluster_instance.test"
-	rNamePrefix := acctest.ResourcePrefix
-	rName := sdkacctest.RandomWithPrefix(rNamePrefix)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
 		ErrorCheck:               acctest.ErrorCheck(t, docdb.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckClusterDestroy(ctx),
+		CheckDestroy:             testAccCheckClusterInstanceDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccClusterInstanceConfig_performanceInsights(rName),
+				Config: testAccClusterInstanceConfig_identifierPrefix(rName, "tf-acc-test-prefix-"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckClusterInstanceExists(ctx, resourceName, &v),
-					testAccCheckClusterInstanceAttributes(&v),
-					resource.TestCheckResourceAttrSet(resourceName, "enable_performance_insights"),
-					resource.TestCheckResourceAttrSet(resourceName, "performance_insights_kms_key_id"),
+					acctest.CheckResourceAttrNameFromPrefix(resourceName, "identifier", "tf-acc-test-prefix-"),
+					resource.TestCheckResourceAttr(resourceName, "identifier_prefix", "tf-acc-test-prefix-"),
 				),
 			},
 
@@ -98,50 +167,62 @@ func TestAccDocDBClusterInstance_performanceInsights(t *testing.T) {
 				ImportStateVerify: true,
 				ImportStateVerifyIgnore: []string{
 					"apply_immediately",
-					"identifier_prefix",
-					"enable_performance_insights",
-					"performance_insights_kms_key_id",
 				},
 			},
 		},
 	})
 }
 
-func TestAccDocDBClusterInstance_az(t *testing.T) {
+func TestAccDocDBClusterInstance_tags(t *testing.T) {
 	ctx := acctest.Context(t)
 	var v docdb.DBInstance
-	resourceName := "aws_docdb_cluster_instance.cluster_instances"
+	resourceName := "aws_docdb_cluster_instance.test"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
 		ErrorCheck:               acctest.ErrorCheck(t, docdb.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckClusterDestroy(ctx),
+		CheckDestroy:             testAccCheckClusterInstanceDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccClusterInstanceConfig_az(rName),
+				Config: testAccClusterInstanceConfig_tags1(rName, "key1", "value1"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckClusterInstanceExists(ctx, resourceName, &v),
-					testAccCheckClusterInstanceAttributes(&v),
-					resource.TestCheckResourceAttrSet(resourceName, "availability_zone"),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
 				),
 			},
-
 			{
 				ResourceName:      resourceName,
 				ImportState:       true,
 				ImportStateVerify: true,
 				ImportStateVerifyIgnore: []string{
 					"apply_immediately",
-					"identifier_prefix",
 				},
 			},
+			{
+				Config: testAccClusterInstanceConfig_tags2(rName, "key1", "value1updated", "key2", "value2"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckClusterInstanceExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1updated"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
+				),
+			},
+			{
+				Config: testAccClusterInstanceConfig_tags1(rName, "key2", "value2"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckClusterInstanceExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
+				),
+			},
 		},
 	})
 }
 
-func TestAccDocDBClusterInstance_namePrefix(t *testing.T) {
+func TestAccDocDBClusterInstance_performanceInsights(t *testing.T) {
 	ctx := acctest.Context(t)
 	var v docdb.DBInstance
 	resourceName := "aws_docdb_cluster_instance.test"
@@ -152,15 +233,14 @@ func TestAccDocDBClusterInstance_namePrefix(t *testing.T) {
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
 		ErrorCheck:               acctest.ErrorCheck(t, docdb.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckClusterDestroy(ctx),
+		CheckDestroy:             testAccCheckClusterInstanceDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccClusterInstanceConfig_namePrefix(rName, rNamePrefix),
+				Config: testAccClusterInstanceConfig_performanceInsights(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckClusterInstanceExists(ctx, resourceName, &v),
-					testAccCheckClusterInstanceAttributes(&v),
-					resource.TestCheckResourceAttr(resourceName, "db_subnet_group_name", rName),
-					resource.TestMatchResourceAttr(resourceName, "identifier", regexp.MustCompile(fmt.Sprintf("^%s", rNamePrefix))),
+					resource.TestCheckResourceAttrSet(resourceName, "enable_performance_insights"),
+					resource.TestCheckResourceAttrSet(resourceName, "performance_insights_kms_key_id"),
 				),
 			},
 
@@ -170,14 +250,15 @@ func TestAccDocDBClusterInstance_namePrefix(t *testing.T) {
 				ImportStateVerify: true,
 				ImportStateVerifyIgnore: []string{
 					"apply_immediately",
-					"identifier_prefix",
+					"enable_performance_insights",
+					"performance_insights_kms_key_id",
 				},
 			},
 		},
 	})
 }
 
-func TestAccDocDBClusterInstance_generatedName(t *testing.T) {
+func TestAccDocDBClusterInstance_az(t *testing.T) {
 	ctx := acctest.Context(t)
 	var v docdb.DBInstance
 	resourceName := "aws_docdb_cluster_instance.test"
@@ -187,14 +268,13 @@ func TestAccDocDBClusterInstance_generatedName(t *testing.T) {
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
 		ErrorCheck:               acctest.ErrorCheck(t, docdb.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckClusterDestroy(ctx),
+		CheckDestroy:             testAccCheckClusterInstanceDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccClusterInstanceConfig_generatedName(rName),
+				Config: testAccClusterInstanceConfig_az(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckClusterInstanceExists(ctx, resourceName, &v),
-					testAccCheckClusterInstanceAttributes(&v),
-					resource.TestMatchResourceAttr(resourceName, "identifier", regexp.MustCompile("^tf-")),
+					resource.TestCheckResourceAttrSet(resourceName, "availability_zone"),
 				),
 			},
 
@@ -204,7 +284,6 @@ func TestAccDocDBClusterInstance_generatedName(t *testing.T) {
 				ImportStateVerify: true,
 				ImportStateVerifyIgnore: []string{
 					"apply_immediately",
-					"identifier_prefix",
 				},
 			},
 		},
@@ -214,20 +293,20 @@ func TestAccDocDBClusterInstance_generatedName(t *testing.T) {
 func TestAccDocDBClusterInstance_kmsKey(t *testing.T) {
 	ctx := acctest.Context(t)
 	var v docdb.DBInstance
-	resourceName := "aws_docdb_cluster_instance.cluster_instances"
+	resourceName := "aws_docdb_cluster_instance.test"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
 		ErrorCheck:               acctest.ErrorCheck(t, docdb.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckClusterDestroy(ctx),
+		CheckDestroy:             testAccCheckClusterInstanceDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccClusterInstanceConfig_kmsKey(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckClusterInstanceExists(ctx, resourceName, &v),
-					resource.TestCheckResourceAttrPair(resourceName, "kms_key_id", "aws_kms_key.foo", "arn"),
+					resource.TestCheckResourceAttrPair(resourceName, "kms_key_id", "aws_kms_key.test", "arn"),
 				),
 			},
 
@@ -237,77 +316,74 @@ func TestAccDocDBClusterInstance_kmsKey(t *testing.T) {
 				ImportStateVerify: true,
 				ImportStateVerifyIgnore: []string{
 					"apply_immediately",
-					"identifier_prefix",
 				},
 			},
 		},
 	})
 }
 
-// https://github.com/hashicorp/terraform/issues/5350
-func TestAccDocDBClusterInstance_disappears(t *testing.T) {
+func TestAccDocDBClusterInstance_copyTagsToSnapshot(t *testing.T) {
 	ctx := acctest.Context(t)
 	var v docdb.DBInstance
-	resourceName := "aws_docdb_cluster_instance.cluster_instances"
+	resourceName := "aws_docdb_cluster_instance.test"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
 		ErrorCheck:               acctest.ErrorCheck(t, docdb.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckClusterDestroy(ctx),
+		CheckDestroy:             testAccCheckClusterInstanceDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccClusterInstanceConfig_basic(rName),
+				Config: testAccClusterInstanceConfig_copyTagsToSnapshot(rName, true),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckClusterInstanceExists(ctx, resourceName, &v),
-					testAccClusterInstanceDisappears(ctx, &v),
+					resource.TestCheckResourceAttr(resourceName, "copy_tags_to_snapshot", "true"),
 				),
-				// A non-empty plan is what we want. A crash is what we don't want. :)
-				ExpectNonEmptyPlan: true,
+			},
+			{
+				Config: testAccClusterInstanceConfig_copyTagsToSnapshot(rName, false),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckClusterInstanceExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "copy_tags_to_snapshot", "false"),
+				),
+			},
+
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{
+					"apply_immediately",
+				},
 			},
 		},
 	})
 }
 
-func testAccCheckClusterInstanceAttributes(v *docdb.DBInstance) resource.TestCheckFunc {
+func testAccCheckClusterInstanceDestroy(ctx context.Context) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		if *v.Engine != "docdb" {
-			return fmt.Errorf("bad engine, expected \"docdb\": %#v", *v.Engine)
-		}
+		conn := acctest.Provider.Meta().(*conns.AWSClient).DocDBConn(ctx)
 
-		if !strings.HasPrefix(*v.DBClusterIdentifier, acctest.ResourcePrefix) {
-			return fmt.Errorf("Bad Cluster Identifier prefix:\nexpected: %s-*\ngot: %s", acctest.ResourcePrefix, *v.DBClusterIdentifier)
-		}
+		for _, rs := range s.RootModule().Resources {
+			if rs.Type != "aws_docdb_cluster_instance" {
+				continue
+			}
 
-		return nil
-	}
-}
+			_, err := tfdocdb.FindDBInstanceByID(ctx, conn, rs.Primary.ID)
 
-func testAccClusterInstanceDisappears(ctx context.Context, v *docdb.DBInstance) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		conn := acctest.Provider.Meta().(*conns.AWSClient).DocDBConn(ctx)
-		opts := &docdb.DeleteDBInstanceInput{
-			DBInstanceIdentifier: v.DBInstanceIdentifier,
-		}
-		if _, err := conn.DeleteDBInstanceWithContext(ctx, opts); err != nil {
-			return err
-		}
-		return retry.RetryContext(ctx, 40*time.Minute, func() *retry.RetryError {
-			opts := &docdb.DescribeDBInstancesInput{
-				DBInstanceIdentifier: v.DBInstanceIdentifier,
+			if tfresource.NotFound(err) {
+				continue
 			}
-			_, err := conn.DescribeDBInstancesWithContext(ctx, opts)
+
 			if err != nil {
-				if tfawserr.ErrCodeEquals(err, docdb.ErrCodeDBInstanceNotFoundFault) {
-					return nil
-				}
-				return retry.NonRetryableError(
-					fmt.Errorf("Error retrieving DB Instances: %s", err))
+				return err
 			}
-			return retry.RetryableError(fmt.Errorf(
-				"Waiting for instance to be deleted: %v", v.DBInstanceIdentifier))
-		})
+
+			return fmt.Errorf("DocumentDB Cluster Instance %s still exists", rs.Primary.ID)
+		}
+
+		return nil
 	}
 }
 
@@ -318,84 +394,111 @@ func testAccCheckClusterInstanceExists(ctx context.Context, n string, v *docdb.D
 			return fmt.Errorf("Not found: %s", n)
 		}
 
-		if rs.Primary.ID == "" {
-			return fmt.Errorf("No DB Instance ID is set")
-		}
-
 		conn := acctest.Provider.Meta().(*conns.AWSClient).DocDBConn(ctx)
-		resp, err := conn.DescribeDBInstancesWithContext(ctx, &docdb.DescribeDBInstancesInput{
-			DBInstanceIdentifier: aws.String(rs.Primary.ID),
-		})
+
+		output, err := tfdocdb.FindDBInstanceByID(ctx, conn, rs.Primary.ID)
 
 		if err != nil {
 			return err
 		}
 
-		for _, d := range resp.DBInstances {
-			if *d.DBInstanceIdentifier == rs.Primary.ID {
-				*v = *d
-				return nil
-			}
-		}
+		*v = *output
 
-		return fmt.Errorf("DB Cluster (%s) not found", rs.Primary.ID)
+		return nil
 	}
 }
 
-// Add some random to the name, to avoid collision
-func testAccClusterInstanceConfig_basic(rName string) string {
-	return acctest.ConfigCompose(acctest.ConfigAvailableAZsNoOptIn(), fmt.Sprintf(`
-resource "aws_docdb_cluster" "default" {
+func testAccClusterInstanceConfig_base(rName string) string {
+	return fmt.Sprintf(`
+resource "aws_docdb_cluster" "test" {
   cluster_identifier  = %[1]q
-  availability_zones  = [data.aws_availability_zones.available.names[0], data.aws_availability_zones.available.names[1], data.aws_availability_zones.available.names[2]]
-  master_username     = "foo"
-  master_password     = "mustbeeightcharaters"
+  master_password     = "avoid-plaintext-passwords"
+  master_username     = "tfacctest"
   skip_final_snapshot = true
 }
 
 data "aws_docdb_orderable_db_instance" "test" {
-  engine                     = "docdb"
-  preferred_instance_classes = ["db.t3.medium", "db.r4.large", "db.r5.large", "db.r5.xlarge"]
+  engine                     = aws_docdb_cluster.test.engine
+  preferred_instance_classes = ["db.t3.medium", "db.4tg.medium", "db.r5.large", "db.r6g.large"]
+}
+`, rName)
 }
 
-resource "aws_docdb_cluster_instance" "cluster_instances" {
+func testAccClusterInstanceConfig_basic(rName string) string {
+	return acctest.ConfigCompose(testAccClusterInstanceConfig_base(rName), fmt.Sprintf(`
+resource "aws_docdb_cluster_instance" "test" {
   identifier         = %[1]q
-  cluster_identifier = aws_docdb_cluster.default.id
+  cluster_identifier = aws_docdb_cluster.test.id
   instance_class     = data.aws_docdb_orderable_db_instance.test.instance_class
-  promotion_tier     = "3"
 }
 `, rName))
 }
 
 func testAccClusterInstanceConfig_modified(rName string) string {
-	return acctest.ConfigCompose(acctest.ConfigAvailableAZsNoOptIn(), fmt.Sprintf(`
-resource "aws_docdb_cluster" "default" {
-  cluster_identifier  = %[1]q
-  availability_zones  = [data.aws_availability_zones.available.names[0], data.aws_availability_zones.available.names[1], data.aws_availability_zones.available.names[2]]
-  master_username     = "foo"
-  master_password     = "mustbeeightcharaters"
-  skip_final_snapshot = true
-}
-
-data "aws_docdb_orderable_db_instance" "test" {
-  engine                     = "docdb"
-  preferred_instance_classes = ["db.t3.medium", "db.r4.large", "db.r5.large", "db.r5.xlarge"]
-}
-
-resource "aws_docdb_cluster_instance" "cluster_instances" {
+	return acctest.ConfigCompose(testAccClusterInstanceConfig_base(rName), fmt.Sprintf(`
+resource "aws_docdb_cluster_instance" "test" {
   identifier                 = %[1]q
-  cluster_identifier         = aws_docdb_cluster.default.id
+  cluster_identifier         = aws_docdb_cluster.test.id
   instance_class             = data.aws_docdb_orderable_db_instance.test.instance_class
+  apply_immediately          = true
   auto_minor_version_upgrade = false
-  promotion_tier             = "3"
+  promotion_tier             = 3
 }
 `, rName))
 }
 
+func testAccClusterInstanceConfig_identifierGenerated(rName string) string {
+	return acctest.ConfigCompose(testAccClusterInstanceConfig_base(rName), `
+resource "aws_docdb_cluster_instance" "test" {
+  cluster_identifier = aws_docdb_cluster.test.id
+  instance_class     = data.aws_docdb_orderable_db_instance.test.instance_class
+}
+`)
+}
+
+func testAccClusterInstanceConfig_identifierPrefix(rName, prefix string) string {
+	return acctest.ConfigCompose(testAccClusterInstanceConfig_base(rName), fmt.Sprintf(`
+resource "aws_docdb_cluster_instance" "test" {
+  identifier_prefix  = %[1]q
+  cluster_identifier = aws_docdb_cluster.test.id
+  instance_class     = data.aws_docdb_orderable_db_instance.test.instance_class
+}
+`, prefix))
+}
+
+func testAccClusterInstanceConfig_tags1(rName, tagKey1, tagValue1 string) string {
+	return acctest.ConfigCompose(testAccClusterInstanceConfig_base(rName), fmt.Sprintf(`
+resource "aws_docdb_cluster_instance" "test" {
+  identifier         = %[1]q
+  cluster_identifier = aws_docdb_cluster.test.id
+  instance_class     = data.aws_docdb_orderable_db_instance.test.instance_class
+
+  tags = {
+    %[2]q = %[3]q
+  }
+}
+`, rName, tagKey1, tagValue1))
+}
+
+func testAccClusterInstanceConfig_tags2(rName, tagKey1, tagValue1, tagKey2, tagValue2 string) string {
+	return acctest.ConfigCompose(testAccClusterInstanceConfig_base(rName), fmt.Sprintf(`
+resource "aws_docdb_cluster_instance" "test" {
+  identifier         = %[1]q
+  cluster_identifier = aws_docdb_cluster.test.id
+  instance_class     = data.aws_docdb_orderable_db_instance.test.instance_class
+
+  tags = {
+    %[2]q = %[3]q
+    %[4]q = %[5]q
+  }
+}
+`, rName, tagKey1, tagValue1, tagKey2, tagValue2))
+}
+
 func testAccClusterInstanceConfig_performanceInsights(rName string) string {
-	return acctest.ConfigCompose(acctest.ConfigAvailableAZsNoOptIn(), fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccClusterInstanceConfig_base(rName), fmt.Sprintf(`
 resource "aws_kms_key" "test" {
-  description = "Terraform acc test %[1]s"
+  description = %[1]q
 
   policy = <<POLICY
 {
@@ -415,22 +518,10 @@ resource "aws_kms_key" "test" {
 }
 POLICY
 }
-resource "aws_docdb_cluster" "default" {
-  cluster_identifier  = %[1]q
-  availability_zones  = [data.aws_availability_zones.available.names[0], data.aws_availability_zones.available.names[1], data.aws_availability_zones.available.names[2]]
-  master_username     = "foo"
-  master_password     = "mustbeeightcharaters"
-  skip_final_snapshot = true
-}
-
-data "aws_docdb_orderable_db_instance" "test" {
-  engine                     = "docdb"
-  preferred_instance_classes = ["db.t3.medium", "db.r4.large", "db.r5.large", "db.r5.xlarge"]
-}
 
 resource "aws_docdb_cluster_instance" "test" {
   identifier                      = %[1]q
-  cluster_identifier              = aws_docdb_cluster.default.id
+  cluster_identifier              = aws_docdb_cluster.test.id
   instance_class                  = data.aws_docdb_orderable_db_instance.test.instance_class
   promotion_tier                  = "3"
   enable_performance_insights     = true
@@ -441,22 +532,22 @@ resource "aws_docdb_cluster_instance" "test" {
 
 func testAccClusterInstanceConfig_az(rName string) string {
 	return acctest.ConfigCompose(acctest.ConfigAvailableAZsNoOptIn(), fmt.Sprintf(`
-resource "aws_docdb_cluster" "default" {
+resource "aws_docdb_cluster" "test" {
   cluster_identifier  = %[1]q
   availability_zones  = [data.aws_availability_zones.available.names[0], data.aws_availability_zones.available.names[1], data.aws_availability_zones.available.names[2]]
-  master_username     = "foo"
-  master_password     = "mustbeeightcharaters"
+  master_password     = "avoid-plaintext-passwords"
+  master_username     = "tfacctest"
   skip_final_snapshot = true
 }
 
 data "aws_docdb_orderable_db_instance" "test" {
-  engine                     = "docdb"
-  preferred_instance_classes = ["db.t3.medium", "db.r4.large", "db.r5.large", "db.r5.xlarge"]
+  engine                     = aws_docdb_cluster.test.engine
+  preferred_instance_classes = ["db.t3.medium", "db.4tg.medium", "db.r5.large", "db.r6g.large"]
 }
 
-resource "aws_docdb_cluster_instance" "cluster_instances" {
+resource "aws_docdb_cluster_instance" "test" {
   identifier         = %[1]q
-  cluster_identifier = aws_docdb_cluster.default.id
+  cluster_identifier = aws_docdb_cluster.test.id
   instance_class     = data.aws_docdb_orderable_db_instance.test.instance_class
   promotion_tier     = "3"
   availability_zone  = data.aws_availability_zones.available.names[0]
@@ -464,121 +555,10 @@ resource "aws_docdb_cluster_instance" "cluster_instances" {
 `, rName))
 }
 
-func testAccClusterInstanceConfig_namePrefix(rName, rNamePrefix string) string {
-	return acctest.ConfigCompose(acctest.ConfigAvailableAZsNoOptIn(), fmt.Sprintf(`
-data "aws_docdb_orderable_db_instance" "test" {
-  engine                     = "docdb"
-  preferred_instance_classes = ["db.t3.medium", "db.r4.large", "db.r5.large", "db.r5.xlarge"]
-}
-
-resource "aws_docdb_cluster_instance" "test" {
-  identifier_prefix  = %[2]q
-  cluster_identifier = aws_docdb_cluster.test.id
-  instance_class     = data.aws_docdb_orderable_db_instance.test.instance_class
-}
-
-resource "aws_docdb_cluster" "test" {
-  cluster_identifier   = %[1]q
-  master_username      = "root"
-  master_password      = "password"
-  db_subnet_group_name = aws_docdb_subnet_group.test.name
-  skip_final_snapshot  = true
-}
-
-resource "aws_vpc" "test" {
-  cidr_block = "10.0.0.0/16"
-
-  tags = {
-    Name = %[1]q
-  }
-}
-
-resource "aws_subnet" "a" {
-  vpc_id            = aws_vpc.test.id
-  cidr_block        = "10.0.0.0/24"
-  availability_zone = data.aws_availability_zones.available.names[0]
-
-  tags = {
-    Name = "%[1]s-a"
-  }
-}
-
-resource "aws_subnet" "b" {
-  vpc_id            = aws_vpc.test.id
-  cidr_block        = "10.0.1.0/24"
-  availability_zone = data.aws_availability_zones.available.names[1]
-
-  tags = {
-    Name = "%[1]s-b"
-  }
-}
-
-resource "aws_docdb_subnet_group" "test" {
-  name       = %[1]q
-  subnet_ids = [aws_subnet.a.id, aws_subnet.b.id]
-}
-`, rName, rNamePrefix))
-}
-
-func testAccClusterInstanceConfig_generatedName(rName string) string {
-	return acctest.ConfigCompose(acctest.ConfigAvailableAZsNoOptIn(), fmt.Sprintf(`
-data "aws_docdb_orderable_db_instance" "test" {
-  engine                     = "docdb"
-  preferred_instance_classes = ["db.t3.medium", "db.r4.large", "db.r5.large", "db.r5.xlarge"]
-}
-
-resource "aws_docdb_cluster_instance" "test" {
-  cluster_identifier = aws_docdb_cluster.test.id
-  instance_class     = data.aws_docdb_orderable_db_instance.test.instance_class
-}
-
-resource "aws_docdb_cluster" "test" {
-  cluster_identifier   = %[1]q
-  master_username      = "root"
-  master_password      = "password"
-  db_subnet_group_name = aws_docdb_subnet_group.test.name
-  skip_final_snapshot  = true
-}
-
-resource "aws_vpc" "test" {
-  cidr_block = "10.0.0.0/16"
-
-  tags = {
-    Name = %[1]q
-  }
-}
-
-resource "aws_subnet" "a" {
-  vpc_id            = aws_vpc.test.id
-  cidr_block        = "10.0.0.0/24"
-  availability_zone = data.aws_availability_zones.available.names[0]
-
-  tags = {
-    Name = "%[1]s-a"
-  }
-}
-
-resource "aws_subnet" "b" {
-  vpc_id            = aws_vpc.test.id
-  cidr_block        = "10.0.1.0/24"
-  availability_zone = data.aws_availability_zones.available.names[1]
-
-  tags = {
-    Name = "%[1]s-b"
-  }
-}
-
-resource "aws_docdb_subnet_group" "test" {
-  name       = %[1]q
-  subnet_ids = [aws_subnet.a.id, aws_subnet.b.id]
-}
-`, rName))
-}
-
 func testAccClusterInstanceConfig_kmsKey(rName string) string {
 	return acctest.ConfigCompose(acctest.ConfigAvailableAZsNoOptIn(), fmt.Sprintf(`
-resource "aws_kms_key" "foo" {
-  description = "Terraform acc test %[1]s"
+resource "aws_kms_key" "test" {
+  description = %[1]q
 
   policy = <<POLICY
 {
@@ -599,25 +579,36 @@ resource "aws_kms_key" "foo" {
 POLICY
 }
 
-resource "aws_docdb_cluster" "default" {
+resource "aws_docdb_cluster" "test" {
   cluster_identifier  = %[1]q
-  availability_zones  = [data.aws_availability_zones.available.names[0], data.aws_availability_zones.available.names[1], data.aws_availability_zones.available.names[2]]
-  master_username     = "foo"
-  master_password     = "mustbeeightcharaters"
+  master_password     = "avoid-plaintext-passwords"
+  master_username     = "tfacctest"
   storage_encrypted   = true
-  kms_key_id          = aws_kms_key.foo.arn
+  kms_key_id          = aws_kms_key.test.arn
   skip_final_snapshot = true
 }
 
 data "aws_docdb_orderable_db_instance" "test" {
-  engine                     = "docdb"
-  preferred_instance_classes = ["db.t3.medium", "db.r4.large", "db.r5.large", "db.r5.xlarge"]
+  engine                     = aws_docdb_cluster.test.engine
+  preferred_instance_classes = ["db.t3.medium", "db.4tg.medium", "db.r5.large", "db.r6g.large"]
 }
 
-resource "aws_docdb_cluster_instance" "cluster_instances" {
+resource "aws_docdb_cluster_instance" "test" {
   identifier         = %[1]q
-  cluster_identifier = aws_docdb_cluster.default.id
+  cluster_identifier = aws_docdb_cluster.test.id
   instance_class     = data.aws_docdb_orderable_db_instance.test.instance_class
 }
 `, rName))
 }
+
+func testAccClusterInstanceConfig_copyTagsToSnapshot(rName string, flag bool) string {
+	return acctest.ConfigCompose(testAccClusterInstanceConfig_base(rName), fmt.Sprintf(`
+resource "aws_docdb_cluster_instance" "test" {
+  identifier            = %[1]q
+  cluster_identifier    = aws_docdb_cluster.test.id
+  copy_tags_to_snapshot = %[2]t
+  instance_class        = data.aws_docdb_orderable_db_instance.test.instance_class
+  promotion_tier        = "3"
+}
+`, rName, flag))
+}
diff --git a/internal/service/docdb/cluster_parameter_group.go b/internal/service/docdb/cluster_parameter_group.go
index 4120a9957f8..435e1396746 100644
--- a/internal/service/docdb/cluster_parameter_group.go
+++ b/internal/service/docdb/cluster_parameter_group.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package docdb
 
 import (
@@ -10,12 +13,13 @@ import (
 	"github.com/aws/aws-sdk-go/service/docdb"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/create"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
+	tfslices "github.com/hashicorp/terraform-provider-aws/internal/slices"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
@@ -32,6 +36,7 @@ func ResourceClusterParameterGroup() *schema.Resource {
 		ReadWithoutTimeout:   resourceClusterParameterGroupRead,
 		UpdateWithoutTimeout: resourceClusterParameterGroupUpdate,
 		DeleteWithoutTimeout: resourceClusterParameterGroupDelete,
+
 		Importer: &schema.ResourceImporter{
 			StateContext: schema.ImportStatePassthroughContext,
 		},
@@ -41,6 +46,17 @@ func ResourceClusterParameterGroup() *schema.Resource {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
+			"description": {
+				Type:     schema.TypeString,
+				Optional: true,
+				ForceNew: true,
+				Default:  "Managed by Terraform",
+			},
+			"family": {
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
 			"name": {
 				Type:          schema.TypeString,
 				Optional:      true,
@@ -57,22 +73,17 @@ func ResourceClusterParameterGroup() *schema.Resource {
 				ConflictsWith: []string{"name"},
 				ValidateFunc:  validParamGroupNamePrefix,
 			},
-			"family": {
-				Type:     schema.TypeString,
-				Required: true,
-				ForceNew: true,
-			},
-			"description": {
-				Type:     schema.TypeString,
-				Optional: true,
-				ForceNew: true,
-				Default:  "Managed by Terraform",
-			},
 			"parameter": {
 				Type:     schema.TypeSet,
 				Optional: true,
 				Elem: &schema.Resource{
 					Schema: map[string]*schema.Schema{
+						"apply_method": {
+							Type:         schema.TypeString,
+							Optional:     true,
+							Default:      docdb.ApplyMethodPendingReboot,
+							ValidateFunc: validation.StringInSlice(docdb.ApplyMethod_Values(), false),
+						},
 						"name": {
 							Type:     schema.TypeString,
 							Required: true,
@@ -81,15 +92,6 @@ func ResourceClusterParameterGroup() *schema.Resource {
 							Type:     schema.TypeString,
 							Required: true,
 						},
-						"apply_method": {
-							Type:     schema.TypeString,
-							Optional: true,
-							Default:  docdb.ApplyMethodPendingReboot,
-							ValidateFunc: validation.StringInSlice([]string{
-								docdb.ApplyMethodImmediate,
-								docdb.ApplyMethodPendingReboot,
-							}, false),
-						},
 					},
 				},
 			},
@@ -105,74 +107,80 @@ func resourceClusterParameterGroupCreate(ctx context.Context, d *schema.Resource
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).DocDBConn(ctx)
 
-	var groupName string
-	if v, ok := d.GetOk("name"); ok {
-		groupName = v.(string)
-	} else if v, ok := d.GetOk("name_prefix"); ok {
-		groupName = id.PrefixedUniqueId(v.(string))
-	} else {
-		groupName = id.UniqueId()
-	}
-
-	input := docdb.CreateDBClusterParameterGroupInput{
-		DBClusterParameterGroupName: aws.String(groupName),
+	name := create.Name(d.Get("name").(string), d.Get("name_prefix").(string))
+	input := &docdb.CreateDBClusterParameterGroupInput{
+		DBClusterParameterGroupName: aws.String(name),
 		DBParameterGroupFamily:      aws.String(d.Get("family").(string)),
 		Description:                 aws.String(d.Get("description").(string)),
 		Tags:                        getTagsIn(ctx),
 	}
 
-	resp, err := conn.CreateDBClusterParameterGroupWithContext(ctx, &input)
+	_, err := conn.CreateDBClusterParameterGroupWithContext(ctx, input)
+
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "creating DocumentDB Cluster Parameter Group: %s", err)
+		return sdkdiag.AppendErrorf(diags, "creating DocumentDB Cluster Parameter Group (%s): %s", name, err)
 	}
 
-	d.SetId(aws.StringValue(input.DBClusterParameterGroupName))
+	d.SetId(name)
+
+	if v, ok := d.GetOk("parameter"); ok && v.(*schema.Set).Len() > 0 {
+		err := modifyClusterParameterGroupParameters(ctx, conn, d.Id(), expandParameters(v.(*schema.Set).List()))
 
-	d.Set("arn", resp.DBClusterParameterGroup.DBClusterParameterGroupArn)
+		if err != nil {
+			return sdkdiag.AppendFromErr(diags, err)
+		}
+	}
 
-	return append(diags, resourceClusterParameterGroupUpdate(ctx, d, meta)...)
+	return append(diags, resourceClusterParameterGroupRead(ctx, d, meta)...)
 }
 
 func resourceClusterParameterGroupRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).DocDBConn(ctx)
 
-	describeOpts := &docdb.DescribeDBClusterParameterGroupsInput{
-		DBClusterParameterGroupName: aws.String(d.Id()),
+	dbClusterParameterGroup, err := FindDBClusterParameterGroupByName(ctx, conn, d.Id())
+
+	if !d.IsNewResource() && tfresource.NotFound(err) {
+		log.Printf("[WARN] DocumentDB Cluster Parameter Group (%s) not found, removing from state", d.Id())
+		d.SetId("")
+		return diags
 	}
 
-	describeResp, err := conn.DescribeDBClusterParameterGroupsWithContext(ctx, describeOpts)
 	if err != nil {
-		if !d.IsNewResource() && tfawserr.ErrCodeEquals(err, docdb.ErrCodeDBParameterGroupNotFoundFault) {
-			log.Printf("[WARN] DocumentDB Cluster Parameter Group (%s) not found, removing from state", d.Id())
-			d.SetId("")
-			return diags
-		}
 		return sdkdiag.AppendErrorf(diags, "reading DocumentDB Cluster Parameter Group (%s): %s", d.Id(), err)
 	}
 
-	if len(describeResp.DBClusterParameterGroups) != 1 ||
-		aws.StringValue(describeResp.DBClusterParameterGroups[0].DBClusterParameterGroupName) != d.Id() {
-		return sdkdiag.AppendErrorf(diags, "Unable to find Cluster Parameter Group: %#v", describeResp.DBClusterParameterGroups)
-	}
-
-	arn := aws.StringValue(describeResp.DBClusterParameterGroups[0].DBClusterParameterGroupArn)
-	d.Set("arn", arn)
-	d.Set("description", describeResp.DBClusterParameterGroups[0].Description)
-	d.Set("family", describeResp.DBClusterParameterGroups[0].DBParameterGroupFamily)
-	d.Set("name", describeResp.DBClusterParameterGroups[0].DBClusterParameterGroupName)
+	d.Set("arn", dbClusterParameterGroup.DBClusterParameterGroupArn)
+	d.Set("description", dbClusterParameterGroup.Description)
+	d.Set("family", dbClusterParameterGroup.DBParameterGroupFamily)
+	d.Set("name", dbClusterParameterGroup.DBClusterParameterGroupName)
+	d.Set("name_prefix", create.NamePrefixFromName(aws.StringValue(dbClusterParameterGroup.DBClusterParameterGroupName)))
 
-	describeParametersOpts := &docdb.DescribeDBClusterParametersInput{
+	input := &docdb.DescribeDBClusterParametersInput{
 		DBClusterParameterGroupName: aws.String(d.Id()),
 	}
+	var parameters []*docdb.Parameter
+
+	err = conn.DescribeDBClusterParametersPagesWithContext(ctx, input, func(page *docdb.DescribeDBClusterParametersOutput, lastPage bool) bool {
+		if page == nil {
+			return !lastPage
+		}
+
+		for _, v := range page.Parameters {
+			if v != nil {
+				parameters = append(parameters, v)
+			}
+		}
+
+		return !lastPage
+	})
 
-	describeParametersResp, err := conn.DescribeDBClusterParametersWithContext(ctx, describeParametersOpts)
 	if err != nil {
 		return sdkdiag.AppendErrorf(diags, "reading DocumentDB Cluster Parameter Group (%s) parameters: %s", d.Id(), err)
 	}
 
-	if err := d.Set("parameter", flattenParameters(describeParametersResp.Parameters, d.Get("parameter").(*schema.Set).List())); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting DocumentDB cluster parameter: %s", err)
+	if err := d.Set("parameter", flattenParameters(parameters, d.Get("parameter").(*schema.Set).List())); err != nil {
+		return sdkdiag.AppendErrorf(diags, "setting parameter: %s", err)
 	}
 
 	return diags
@@ -194,27 +202,11 @@ func resourceClusterParameterGroupUpdate(ctx context.Context, d *schema.Resource
 		os := o.(*schema.Set)
 		ns := n.(*schema.Set)
 
-		parameters := expandParameters(ns.Difference(os).List())
-		if len(parameters) > 0 {
-			// We can only modify 20 parameters at a time, so walk them until
-			// we've got them all.
-			for parameters != nil {
-				var paramsToModify []*docdb.Parameter
-				if len(parameters) <= clusterParameterGroupMaxParamsBulkEdit {
-					paramsToModify, parameters = parameters[:], nil
-				} else {
-					paramsToModify, parameters = parameters[:clusterParameterGroupMaxParamsBulkEdit], parameters[clusterParameterGroupMaxParamsBulkEdit:]
-				}
-				parameterGroupName := d.Id()
-				modifyOpts := docdb.ModifyDBClusterParameterGroupInput{
-					DBClusterParameterGroupName: aws.String(parameterGroupName),
-					Parameters:                  paramsToModify,
-				}
-
-				_, err := conn.ModifyDBClusterParameterGroupWithContext(ctx, &modifyOpts)
-				if err != nil {
-					return sdkdiag.AppendErrorf(diags, "modifying DocumentDB Cluster Parameter Group: %s", err)
-				}
+		if parameters := expandParameters(ns.Difference(os).List()); len(parameters) > 0 {
+			err := modifyClusterParameterGroupParameters(ctx, conn, d.Id(), parameters)
+
+			if err != nil {
+				return sdkdiag.AppendFromErr(diags, err)
 			}
 		}
 	}
@@ -226,50 +218,105 @@ func resourceClusterParameterGroupDelete(ctx context.Context, d *schema.Resource
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).DocDBConn(ctx)
 
-	deleteOpts := &docdb.DeleteDBClusterParameterGroupInput{
+	log.Printf("[DEBUG] Deleting DocumentDB Cluster Parameter Group: %s", d.Id())
+	_, err := conn.DeleteDBClusterParameterGroupWithContext(ctx, &docdb.DeleteDBClusterParameterGroupInput{
 		DBClusterParameterGroupName: aws.String(d.Id()),
+	})
+
+	if tfawserr.ErrCodeEquals(err, docdb.ErrCodeDBParameterGroupNotFoundFault) {
+		return diags
 	}
 
-	_, err := conn.DeleteDBClusterParameterGroupWithContext(ctx, deleteOpts)
 	if err != nil {
-		if tfawserr.ErrCodeEquals(err, docdb.ErrCodeDBParameterGroupNotFoundFault) {
-			return diags
-		}
 		return sdkdiag.AppendErrorf(diags, "deleting DocumentDB Cluster Parameter Group (%s): %s", d.Id(), err)
 	}
 
-	if err := WaitForClusterParameterGroupDeletion(ctx, conn, d.Id()); err != nil {
-		return sdkdiag.AppendErrorf(diags, "deleting DocumentDB Cluster Parameter Group (%s): %s", d.Id(), err)
+	_, err = tfresource.RetryUntilNotFound(ctx, 10*time.Minute, func() (interface{}, error) {
+		return FindDBClusterParameterGroupByName(ctx, conn, d.Id())
+	})
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "waiting for DocumentDB Cluster Parameter Group (%s) delete: %s", d.Id(), err)
 	}
+
 	return diags
 }
 
-func WaitForClusterParameterGroupDeletion(ctx context.Context, conn *docdb.DocDB, name string) error {
-	params := &docdb.DescribeDBClusterParameterGroupsInput{
+func modifyClusterParameterGroupParameters(ctx context.Context, conn *docdb.DocDB, name string, parameters []*docdb.Parameter) error {
+	// We can only modify 20 parameters at a time, so chunk them until we've got them all.
+	for _, chunk := range tfslices.Chunks(parameters, clusterParameterGroupMaxParamsBulkEdit) {
+		input := &docdb.ModifyDBClusterParameterGroupInput{
+			DBClusterParameterGroupName: aws.String(name),
+			Parameters:                  chunk,
+		}
+
+		_, err := conn.ModifyDBClusterParameterGroupWithContext(ctx, input)
+
+		if err != nil {
+			return fmt.Errorf("modifying DocumentDB Cluster Parameter Group (%s): %w", name, err)
+		}
+	}
+
+	return nil
+}
+
+func FindDBClusterParameterGroupByName(ctx context.Context, conn *docdb.DocDB, name string) (*docdb.DBClusterParameterGroup, error) {
+	input := &docdb.DescribeDBClusterParameterGroupsInput{
 		DBClusterParameterGroupName: aws.String(name),
 	}
+	output, err := findDBClusterParameterGroup(ctx, conn, input)
 
-	err := retry.RetryContext(ctx, 10*time.Minute, func() *retry.RetryError {
-		_, err := conn.DescribeDBClusterParameterGroupsWithContext(ctx, params)
+	if err != nil {
+		return nil, err
+	}
 
-		if tfawserr.ErrCodeEquals(err, docdb.ErrCodeDBParameterGroupNotFoundFault) {
-			return nil
+	// Eventual consistency check.
+	if aws.StringValue(output.DBClusterParameterGroupName) != name {
+		return nil, &retry.NotFoundError{
+			LastRequest: input,
 		}
+	}
 
-		if err != nil {
-			return retry.NonRetryableError(err)
+	return output, nil
+}
+
+func findDBClusterParameterGroup(ctx context.Context, conn *docdb.DocDB, input *docdb.DescribeDBClusterParameterGroupsInput) (*docdb.DBClusterParameterGroup, error) {
+	output, err := findDBClusterParameterGroups(ctx, conn, input)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return tfresource.AssertSinglePtrResult(output)
+}
+
+func findDBClusterParameterGroups(ctx context.Context, conn *docdb.DocDB, input *docdb.DescribeDBClusterParameterGroupsInput) ([]*docdb.DBClusterParameterGroup, error) {
+	var output []*docdb.DBClusterParameterGroup
+
+	err := conn.DescribeDBClusterParameterGroupsPagesWithContext(ctx, input, func(page *docdb.DescribeDBClusterParameterGroupsOutput, lastPage bool) bool {
+		if page == nil {
+			return !lastPage
 		}
 
-		return retry.RetryableError(fmt.Errorf("DocumentDB Parameter Group (%s) still exists", name))
+		for _, v := range page.DBClusterParameterGroups {
+			if v != nil {
+				output = append(output, v)
+			}
+		}
+
+		return !lastPage
 	})
-	if tfresource.TimedOut(err) {
-		_, err = conn.DescribeDBClusterParameterGroupsWithContext(ctx, params)
-		if tfawserr.ErrCodeEquals(err, docdb.ErrCodeDBParameterGroupNotFoundFault) {
-			return nil
+
+	if tfawserr.ErrCodeEquals(err, docdb.ErrCodeDBParameterGroupNotFoundFault) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
 		}
 	}
+
 	if err != nil {
-		return fmt.Errorf("deleting DocumentDB cluster parameter group: %s", err)
+		return nil, err
 	}
-	return nil
+
+	return output, nil
 }
diff --git a/internal/service/docdb/cluster_parameter_group_test.go b/internal/service/docdb/cluster_parameter_group_test.go
index 7d79a28988d..a3e1408da21 100644
--- a/internal/service/docdb/cluster_parameter_group_test.go
+++ b/internal/service/docdb/cluster_parameter_group_test.go
@@ -1,29 +1,30 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package docdb_test
 
 import (
 	"context"
 	"errors"
 	"fmt"
-	"regexp"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/docdb"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	tfdocdb "github.com/hashicorp/terraform-provider-aws/internal/service/docdb"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
 func TestAccDocDBClusterParameterGroup_basic(t *testing.T) {
 	ctx := acctest.Context(t)
 	var v docdb.DBClusterParameterGroup
-	resourceName := "aws_docdb_cluster_parameter_group.bar"
-
-	parameterGroupName := fmt.Sprintf("cluster-parameter-group-test-terraform-%d", sdkacctest.RandInt())
+	resourceName := "aws_docdb_cluster_parameter_group.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
@@ -32,14 +33,13 @@ func TestAccDocDBClusterParameterGroup_basic(t *testing.T) {
 		CheckDestroy:             testAccCheckClusterParameterGroupDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccClusterParameterGroupConfig_basic(parameterGroupName),
-				Check: resource.ComposeTestCheckFunc(
+				Config: testAccClusterParameterGroupConfig_basic(rName),
+				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckClusterParameterGroupExists(ctx, resourceName, &v),
-					testAccCheckClusterParameterGroupAttributes(&v, parameterGroupName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "rds", regexp.MustCompile(fmt.Sprintf("cluster-pg:%s$", parameterGroupName))),
-					resource.TestCheckResourceAttr(resourceName, "name", parameterGroupName),
-					resource.TestCheckResourceAttr(resourceName, "family", "docdb3.6"),
+					resource.TestCheckResourceAttrSet(resourceName, "arn"),
 					resource.TestCheckResourceAttr(resourceName, "description", "Managed by Terraform"),
+					resource.TestCheckResourceAttr(resourceName, "family", "docdb3.6"),
+					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "parameter.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 				),
@@ -53,12 +53,11 @@ func TestAccDocDBClusterParameterGroup_basic(t *testing.T) {
 	})
 }
 
-func TestAccDocDBClusterParameterGroup_systemParameter(t *testing.T) {
+func TestAccDocDBClusterParameterGroup_disappears(t *testing.T) {
 	ctx := acctest.Context(t)
 	var v docdb.DBClusterParameterGroup
-	resourceName := "aws_docdb_cluster_parameter_group.bar"
-
-	parameterGroupName := fmt.Sprintf("cluster-parameter-group-test-terraform-%d", sdkacctest.RandInt())
+	resourceName := "aws_docdb_cluster_parameter_group.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
@@ -67,31 +66,21 @@ func TestAccDocDBClusterParameterGroup_systemParameter(t *testing.T) {
 		CheckDestroy:             testAccCheckClusterParameterGroupDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccClusterParameterGroupConfig_system(parameterGroupName),
+				Config: testAccClusterParameterGroupConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckClusterParameterGroupExists(ctx, resourceName, &v),
-					testAccCheckClusterParameterGroupAttributes(&v, parameterGroupName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "rds", regexp.MustCompile(fmt.Sprintf("cluster-pg:%s$", parameterGroupName))),
-					resource.TestCheckResourceAttr(resourceName, "name", parameterGroupName),
-					resource.TestCheckResourceAttr(resourceName, "family", "docdb3.6"),
-					resource.TestCheckResourceAttr(resourceName, "description", "Managed by Terraform"),
-					resource.TestCheckResourceAttr(resourceName, "parameter.#", "1"),
-					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
+					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfdocdb.ResourceClusterParameterGroup(), resourceName),
 				),
-			},
-			{
-				ResourceName:            resourceName,
-				ImportState:             true,
-				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"parameter"},
+				ExpectNonEmptyPlan: true,
 			},
 		},
 	})
 }
 
-func TestAccDocDBClusterParameterGroup_namePrefix(t *testing.T) {
+func TestAccDocDBClusterParameterGroup_nameGenerated(t *testing.T) {
 	ctx := acctest.Context(t)
 	var v docdb.DBClusterParameterGroup
+	resourceName := "aws_docdb_cluster_parameter_group.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
@@ -100,25 +89,26 @@ func TestAccDocDBClusterParameterGroup_namePrefix(t *testing.T) {
 		CheckDestroy:             testAccCheckClusterParameterGroupDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccClusterParameterGroupConfig_namePrefix,
+				Config: testAccClusterParameterGroupConfig_nameGenerated(),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckClusterParameterGroupExists(ctx, "aws_docdb_cluster_parameter_group.test", &v),
-					resource.TestMatchResourceAttr("aws_docdb_cluster_parameter_group.test", "name", regexp.MustCompile("^tf-test-")),
+					testAccCheckClusterParameterGroupExists(ctx, resourceName, &v),
+					acctest.CheckResourceAttrNameGenerated(resourceName, "name"),
+					resource.TestCheckResourceAttr(resourceName, "name_prefix", id.UniqueIdPrefix),
 				),
 			},
 			{
-				ResourceName:            "aws_docdb_cluster_parameter_group.test",
-				ImportState:             true,
-				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"name_prefix"},
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
 			},
 		},
 	})
 }
 
-func TestAccDocDBClusterParameterGroup_generatedName(t *testing.T) {
+func TestAccDocDBClusterParameterGroup_namePrefix(t *testing.T) {
 	ctx := acctest.Context(t)
 	var v docdb.DBClusterParameterGroup
+	resourceName := "aws_docdb_cluster_parameter_group.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
@@ -127,13 +117,15 @@ func TestAccDocDBClusterParameterGroup_generatedName(t *testing.T) {
 		CheckDestroy:             testAccCheckClusterParameterGroupDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccClusterParameterGroupConfig_generatedName,
+				Config: testAccClusterParameterGroupConfig_namePrefix("tf-acc-test-prefix-"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckClusterParameterGroupExists(ctx, "aws_docdb_cluster_parameter_group.test", &v),
+					testAccCheckClusterParameterGroupExists(ctx, resourceName, &v),
+					acctest.CheckResourceAttrNameFromPrefix(resourceName, "name", "tf-acc-test-prefix-"),
+					resource.TestCheckResourceAttr(resourceName, "name_prefix", "tf-acc-test-prefix-"),
 				),
 			},
 			{
-				ResourceName:      "aws_docdb_cluster_parameter_group.test",
+				ResourceName:      resourceName,
 				ImportState:       true,
 				ImportStateVerify: true,
 			},
@@ -144,9 +136,8 @@ func TestAccDocDBClusterParameterGroup_generatedName(t *testing.T) {
 func TestAccDocDBClusterParameterGroup_description(t *testing.T) {
 	ctx := acctest.Context(t)
 	var v docdb.DBClusterParameterGroup
-	resourceName := "aws_docdb_cluster_parameter_group.bar"
-
-	parameterGroupName := fmt.Sprintf("cluster-parameter-group-test-terraform-%d", sdkacctest.RandInt())
+	resourceName := "aws_docdb_cluster_parameter_group.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
@@ -155,11 +146,10 @@ func TestAccDocDBClusterParameterGroup_description(t *testing.T) {
 		CheckDestroy:             testAccCheckClusterParameterGroupDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccClusterParameterGroupConfig_description(parameterGroupName, "custom description"),
+				Config: testAccClusterParameterGroupConfig_description(rName, "desc1"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckClusterParameterGroupExists(ctx, resourceName, &v),
-					testAccCheckClusterParameterGroupAttributes(&v, parameterGroupName),
-					resource.TestCheckResourceAttr(resourceName, "description", "custom description"),
+					resource.TestCheckResourceAttr(resourceName, "description", "desc1"),
 				),
 			},
 			{
@@ -171,12 +161,11 @@ func TestAccDocDBClusterParameterGroup_description(t *testing.T) {
 	})
 }
 
-func TestAccDocDBClusterParameterGroup_disappears(t *testing.T) {
+func TestAccDocDBClusterParameterGroup_systemParameter(t *testing.T) {
 	ctx := acctest.Context(t)
 	var v docdb.DBClusterParameterGroup
-	resourceName := "aws_docdb_cluster_parameter_group.bar"
-
-	parameterGroupName := fmt.Sprintf("cluster-parameter-group-test-terraform-%d", sdkacctest.RandInt())
+	resourceName := "aws_docdb_cluster_parameter_group.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
@@ -185,12 +174,17 @@ func TestAccDocDBClusterParameterGroup_disappears(t *testing.T) {
 		CheckDestroy:             testAccCheckClusterParameterGroupDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccClusterParameterGroupConfig_basic(parameterGroupName),
+				Config: testAccClusterParameterGroupConfig_systemParameter(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckClusterParameterGroupExists(ctx, resourceName, &v),
-					testAccCheckClusterParameterGroupDisappears(ctx, &v),
+					resource.TestCheckResourceAttr(resourceName, "parameter.#", "1"),
 				),
-				ExpectNonEmptyPlan: true,
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"parameter"},
 			},
 		},
 	})
@@ -199,9 +193,8 @@ func TestAccDocDBClusterParameterGroup_disappears(t *testing.T) {
 func TestAccDocDBClusterParameterGroup_parameter(t *testing.T) {
 	ctx := acctest.Context(t)
 	var v docdb.DBClusterParameterGroup
-	resourceName := "aws_docdb_cluster_parameter_group.bar"
-
-	parameterGroupName := fmt.Sprintf("cluster-parameter-group-test-tf-%d", sdkacctest.RandInt())
+	resourceName := "aws_docdb_cluster_parameter_group.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
@@ -210,10 +203,9 @@ func TestAccDocDBClusterParameterGroup_parameter(t *testing.T) {
 		CheckDestroy:             testAccCheckClusterParameterGroupDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccClusterParameterGroupConfig_basic2(parameterGroupName, "tls", "disabled"),
+				Config: testAccClusterParameterGroupConfig_parameter(rName, "tls", "disabled"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckClusterParameterGroupExists(ctx, resourceName, &v),
-					testAccCheckClusterParameterGroupAttributes(&v, parameterGroupName),
 					resource.TestCheckResourceAttr(resourceName, "parameter.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "parameter.*", map[string]string{
 						"apply_method": "pending-reboot",
@@ -228,10 +220,9 @@ func TestAccDocDBClusterParameterGroup_parameter(t *testing.T) {
 				ImportStateVerify: true,
 			},
 			{
-				Config: testAccClusterParameterGroupConfig_basic2(parameterGroupName, "tls", "enabled"),
+				Config: testAccClusterParameterGroupConfig_parameter(rName, "tls", "enabled"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckClusterParameterGroupExists(ctx, resourceName, &v),
-					testAccCheckClusterParameterGroupAttributes(&v, parameterGroupName),
 					resource.TestCheckResourceAttr(resourceName, "parameter.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "parameter.*", map[string]string{
 						"apply_method": "pending-reboot",
@@ -247,9 +238,8 @@ func TestAccDocDBClusterParameterGroup_parameter(t *testing.T) {
 func TestAccDocDBClusterParameterGroup_tags(t *testing.T) {
 	ctx := acctest.Context(t)
 	var v docdb.DBClusterParameterGroup
-	resourceName := "aws_docdb_cluster_parameter_group.bar"
-
-	parameterGroupName := fmt.Sprintf("cluster-parameter-group-test-tf-%d", sdkacctest.RandInt())
+	resourceName := "aws_docdb_cluster_parameter_group.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
@@ -258,10 +248,9 @@ func TestAccDocDBClusterParameterGroup_tags(t *testing.T) {
 		CheckDestroy:             testAccCheckClusterParameterGroupDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccClusterParameterGroupConfig_tags(parameterGroupName, "key1", "value1"),
+				Config: testAccClusterParameterGroupConfig_tags1(rName, "key1", "value1"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckClusterParameterGroupExists(ctx, resourceName, &v),
-					testAccCheckClusterParameterGroupAttributes(&v, parameterGroupName),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
 				),
@@ -272,19 +261,18 @@ func TestAccDocDBClusterParameterGroup_tags(t *testing.T) {
 				ImportStateVerify: true,
 			},
 			{
-				Config: testAccClusterParameterGroupConfig_tags(parameterGroupName, "key1", "value2"),
+				Config: testAccClusterParameterGroupConfig_tags2(rName, "key1", "value1updated", "key2", "value2"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckClusterParameterGroupExists(ctx, resourceName, &v),
-					testAccCheckClusterParameterGroupAttributes(&v, parameterGroupName),
-					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
-					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value2"),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1updated"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
 				),
 			},
 			{
-				Config: testAccClusterParameterGroupConfig_tags(parameterGroupName, "key2", "value2"),
+				Config: testAccClusterParameterGroupConfig_tags1(rName, "key2", "value2"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckClusterParameterGroupExists(ctx, resourceName, &v),
-					testAccCheckClusterParameterGroupAttributes(&v, parameterGroupName),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
 				),
@@ -302,54 +290,17 @@ func testAccCheckClusterParameterGroupDestroy(ctx context.Context) resource.Test
 				continue
 			}
 
-			resp, err := conn.DescribeDBClusterParameterGroupsWithContext(ctx, &docdb.DescribeDBClusterParameterGroupsInput{
-				DBClusterParameterGroupName: aws.String(rs.Primary.ID),
-			})
+			_, err := tfdocdb.FindDBClusterParameterGroupByName(ctx, conn, rs.Primary.ID)
 
-			if err == nil {
-				if len(resp.DBClusterParameterGroups) != 0 &&
-					aws.StringValue(resp.DBClusterParameterGroups[0].DBClusterParameterGroupName) == rs.Primary.ID {
-					return errors.New("DocumentDB Cluster Parameter Group still exists")
-				}
+			if tfresource.NotFound(err) {
+				continue
 			}
 
 			if err != nil {
-				if tfawserr.ErrCodeEquals(err, docdb.ErrCodeDBParameterGroupNotFoundFault) {
-					return nil
-				}
 				return err
 			}
-		}
-
-		return nil
-	}
-}
-
-func testAccCheckClusterParameterGroupDisappears(ctx context.Context, group *docdb.DBClusterParameterGroup) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		conn := acctest.Provider.Meta().(*conns.AWSClient).DocDBConn(ctx)
-
-		params := &docdb.DeleteDBClusterParameterGroupInput{
-			DBClusterParameterGroupName: group.DBClusterParameterGroupName,
-		}
-
-		_, err := conn.DeleteDBClusterParameterGroupWithContext(ctx, params)
-		if err != nil {
-			return err
-		}
-
-		return tfdocdb.WaitForClusterParameterGroupDeletion(ctx, conn, *group.DBClusterParameterGroupName)
-	}
-}
-
-func testAccCheckClusterParameterGroupAttributes(v *docdb.DBClusterParameterGroup, name string) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		if *v.DBClusterParameterGroupName != name {
-			return fmt.Errorf("bad name: %#v expected: %v", *v.DBClusterParameterGroupName, name)
-		}
 
-		if *v.DBParameterGroupFamily != "docdb3.6" {
-			return fmt.Errorf("bad family: %#v", *v.DBParameterGroupFamily)
+			return fmt.Errorf("DocumentDB Cluster Parameter Group %s still exists", rs.Primary.ID)
 		}
 
 		return nil
@@ -369,39 +320,57 @@ func testAccCheckClusterParameterGroupExists(ctx context.Context, n string, v *d
 
 		conn := acctest.Provider.Meta().(*conns.AWSClient).DocDBConn(ctx)
 
-		opts := docdb.DescribeDBClusterParameterGroupsInput{
-			DBClusterParameterGroupName: aws.String(rs.Primary.ID),
-		}
-
-		resp, err := conn.DescribeDBClusterParameterGroupsWithContext(ctx, &opts)
+		output, err := tfdocdb.FindDBClusterParameterGroupByName(ctx, conn, rs.Primary.ID)
 
 		if err != nil {
 			return err
 		}
 
-		if len(resp.DBClusterParameterGroups) != 1 ||
-			aws.StringValue(resp.DBClusterParameterGroups[0].DBClusterParameterGroupName) != rs.Primary.ID {
-			return fmt.Errorf("DocumentDB Cluster Parameter Group not found: %s", rs.Primary.ID)
-		}
-
-		*v = *resp.DBClusterParameterGroups[0]
+		*v = *output
 
 		return nil
 	}
 }
 
-func testAccClusterParameterGroupConfig_basic(name string) string {
+func testAccClusterParameterGroupConfig_basic(rName string) string {
 	return fmt.Sprintf(`
-resource "aws_docdb_cluster_parameter_group" "bar" {
+resource "aws_docdb_cluster_parameter_group" "test" {
+  family = "docdb3.6"
+  name   = %[1]q
+}
+`, rName)
+}
+
+func testAccClusterParameterGroupConfig_nameGenerated() string {
+	return `
+resource "aws_docdb_cluster_parameter_group" "test" {
   family = "docdb3.6"
-  name   = "%s"
 }
-`, name)
+`
 }
 
-func testAccClusterParameterGroupConfig_system(name string) string {
+func testAccClusterParameterGroupConfig_namePrefix(namePrefix string) string {
 	return fmt.Sprintf(`
-resource "aws_docdb_cluster_parameter_group" "bar" {
+resource "aws_docdb_cluster_parameter_group" "test" {
+  name_prefix = %[1]q
+  family      = "docdb3.6"
+}
+`, namePrefix)
+}
+
+func testAccClusterParameterGroupConfig_description(rName, description string) string {
+	return fmt.Sprintf(`
+resource "aws_docdb_cluster_parameter_group" "test" {
+  family      = "docdb3.6"
+  description = %[2]q
+  name        = %[1]q
+}
+`, rName, description)
+}
+
+func testAccClusterParameterGroupConfig_systemParameter(rName string) string {
+	return fmt.Sprintf(`
+resource "aws_docdb_cluster_parameter_group" "test" {
   family = "docdb3.6"
   name   = "%s"
 
@@ -411,54 +380,46 @@ resource "aws_docdb_cluster_parameter_group" "bar" {
     apply_method = "pending-reboot"
   }
 }
-`, name)
+`, rName)
 }
 
-func testAccClusterParameterGroupConfig_description(name, description string) string {
+func testAccClusterParameterGroupConfig_parameter(rName, pName, pValue string) string {
 	return fmt.Sprintf(`
-resource "aws_docdb_cluster_parameter_group" "bar" {
-  family      = "docdb3.6"
-  description = "%s"
-  name        = "%s"
-}
-`, description, name)
-}
-
-func testAccClusterParameterGroupConfig_basic2(name, pName, pValue string) string {
-	return fmt.Sprintf(`
-resource "aws_docdb_cluster_parameter_group" "bar" {
-  name   = "%s"
+resource "aws_docdb_cluster_parameter_group" "test" {
+  name   = %[1]q
   family = "docdb3.6"
 
   parameter {
-    name  = "%s"
-    value = "%s"
+    name  = %[2]q
+    value = %[3]q
   }
 }
-`, name, pName, pValue)
+`, rName, pName, pValue)
 }
 
-func testAccClusterParameterGroupConfig_tags(name, tKey, tValue string) string {
+func testAccClusterParameterGroupConfig_tags1(rName, tagKey1, tagValue1 string) string {
 	return fmt.Sprintf(`
-resource "aws_docdb_cluster_parameter_group" "bar" {
-  name   = "%s"
+resource "aws_docdb_cluster_parameter_group" "test" {
+  name   = %[1]q
   family = "docdb3.6"
 
   tags = {
-    %s = "%s"
+    %[2]q = %[3]q
   }
 }
-`, name, tKey, tValue)
+`, rName, tagKey1, tagValue1)
 }
 
-const testAccClusterParameterGroupConfig_namePrefix = `
-resource "aws_docdb_cluster_parameter_group" "test" {
-  name_prefix = "tf-test-"
-  family      = "docdb3.6"
-}
-`
-const testAccClusterParameterGroupConfig_generatedName = `
+func testAccClusterParameterGroupConfig_tags2(rName, tagKey1, tagValue1, tagKey2, tagValue2 string) string {
+	return fmt.Sprintf(`
 resource "aws_docdb_cluster_parameter_group" "test" {
+  name   = %[1]q
   family = "docdb3.6"
+
+  tags = {
+    %[2]q = %[3]q
+    %[4]q = %[5]q
+  }
+}
+`, rName, tagKey1, tagValue1, tagKey2, tagValue2)
 }
-`
diff --git a/internal/service/docdb/cluster_snapshot.go b/internal/service/docdb/cluster_snapshot.go
index fe3aae8da5d..a101ab6e18e 100644
--- a/internal/service/docdb/cluster_snapshot.go
+++ b/internal/service/docdb/cluster_snapshot.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package docdb
 
 import (
diff --git a/internal/service/docdb/cluster_snapshot_test.go b/internal/service/docdb/cluster_snapshot_test.go
index b50d13489e5..b88dca38ec8 100644
--- a/internal/service/docdb/cluster_snapshot_test.go
+++ b/internal/service/docdb/cluster_snapshot_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package docdb_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/docdb"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -33,7 +36,7 @@ func TestAccDocDBClusterSnapshot_basic(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckClusterSnapshotExists(ctx, resourceName, &dbClusterSnapshot),
 					resource.TestCheckResourceAttrSet(resourceName, "availability_zones.#"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "db_cluster_snapshot_arn", "rds", regexp.MustCompile(`cluster-snapshot:.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "db_cluster_snapshot_arn", "rds", regexache.MustCompile(`cluster-snapshot:.+`)),
 					resource.TestCheckResourceAttrSet(resourceName, "engine"),
 					resource.TestCheckResourceAttrSet(resourceName, "engine_version"),
 					resource.TestCheckResourceAttr(resourceName, "kms_key_id", ""),
diff --git a/internal/service/docdb/cluster_test.go b/internal/service/docdb/cluster_test.go
index 40d2c6ff025..9f247ea5a66 100644
--- a/internal/service/docdb/cluster_test.go
+++ b/internal/service/docdb/cluster_test.go
@@ -1,22 +1,25 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package docdb_test
 
 import (
 	"context"
 	"errors"
 	"fmt"
-	"log"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/docdb"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	tfdocdb "github.com/hashicorp/terraform-provider-aws/internal/service/docdb"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
 func init() {
@@ -32,8 +35,8 @@ func testAccErrorCheckSkip(t *testing.T) resource.ErrorCheckFunc {
 func TestAccDocDBCluster_basic(t *testing.T) {
 	ctx := acctest.Context(t)
 	var dbCluster docdb.DBCluster
-	rInt := sdkacctest.RandInt()
-	resourceName := "aws_docdb_cluster.default"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_docdb_cluster.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
@@ -42,22 +45,42 @@ func TestAccDocDBCluster_basic(t *testing.T) {
 		CheckDestroy:             testAccCheckClusterDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccClusterConfig_basic(rInt),
-				Check: resource.ComposeTestCheckFunc(
+				Config: testAccClusterConfig_basic(rName),
+				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckClusterExists(ctx, resourceName, &dbCluster),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "rds", regexp.MustCompile(`cluster:.+`)),
-					resource.TestCheckResourceAttr(resourceName, "storage_encrypted", "false"),
-					resource.TestCheckResourceAttr(resourceName, "db_cluster_parameter_group_name", "default.docdb4.0"),
-					resource.TestCheckResourceAttrSet(resourceName, "reader_endpoint"),
+					resource.TestCheckNoResourceAttr(resourceName, "allow_major_version_upgrade"),
+					resource.TestCheckNoResourceAttr(resourceName, "apply_immediately"),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "rds", regexache.MustCompile(fmt.Sprintf("cluster:%s", rName))),
+					resource.TestCheckResourceAttr(resourceName, "availability_zones.#", "3"),
+					resource.TestCheckResourceAttr(resourceName, "backup_retention_period", "1"),
+					resource.TestCheckResourceAttr(resourceName, "cluster_identifier", rName),
+					resource.TestCheckResourceAttr(resourceName, "cluster_identifier_prefix", ""),
+					resource.TestCheckResourceAttr(resourceName, "cluster_members.#", "0"),
 					resource.TestCheckResourceAttrSet(resourceName, "cluster_resource_id"),
+					resource.TestCheckResourceAttrSet(resourceName, "db_cluster_parameter_group_name"),
+					resource.TestCheckResourceAttr(resourceName, "db_subnet_group_name", "default"),
+					resource.TestCheckResourceAttr(resourceName, "deletion_protection", "false"),
+					resource.TestCheckResourceAttr(resourceName, "enabled_cloudwatch_logs_exports.#", "2"),
+					resource.TestCheckResourceAttr(resourceName, "enabled_cloudwatch_logs_exports.0", "audit"),
+					resource.TestCheckResourceAttr(resourceName, "enabled_cloudwatch_logs_exports.1", "profiler"),
+					resource.TestCheckResourceAttrSet(resourceName, "endpoint"),
 					resource.TestCheckResourceAttr(resourceName, "engine", "docdb"),
 					resource.TestCheckResourceAttrSet(resourceName, "engine_version"),
+					resource.TestCheckNoResourceAttr(resourceName, "final_snapshot_identifier"),
+					resource.TestCheckResourceAttr(resourceName, "global_cluster_identifier", ""),
 					resource.TestCheckResourceAttrSet(resourceName, "hosted_zone_id"),
-					resource.TestCheckResourceAttr(resourceName,
-						"enabled_cloudwatch_logs_exports.0", "audit"),
-					resource.TestCheckResourceAttr(resourceName,
-						"enabled_cloudwatch_logs_exports.1", "profiler"),
-					resource.TestCheckResourceAttr(resourceName, "deletion_protection", "false"),
+					resource.TestCheckResourceAttr(resourceName, "kms_key_id", ""),
+					resource.TestCheckResourceAttr(resourceName, "master_password", "avoid-plaintext-passwords"),
+					resource.TestCheckResourceAttr(resourceName, "master_username", "tfacctest"),
+					resource.TestCheckResourceAttr(resourceName, "port", "27017"),
+					resource.TestCheckResourceAttrSet(resourceName, "preferred_backup_window"),
+					resource.TestCheckResourceAttrSet(resourceName, "preferred_maintenance_window"),
+					resource.TestCheckResourceAttrSet(resourceName, "reader_endpoint"),
+					resource.TestCheckResourceAttr(resourceName, "skip_final_snapshot", "true"),
+					resource.TestCheckNoResourceAttr(resourceName, "snapshot_identifier"),
+					resource.TestCheckResourceAttr(resourceName, "storage_encrypted", "false"),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
+					resource.TestCheckResourceAttr(resourceName, "vpc_security_group_ids.#", "1"),
 				),
 			},
 			{
@@ -65,8 +88,8 @@ func TestAccDocDBCluster_basic(t *testing.T) {
 				ImportState:       true,
 				ImportStateVerify: true,
 				ImportStateVerifyIgnore: []string{
+					"allow_major_version_upgrade",
 					"apply_immediately",
-					"cluster_identifier_prefix",
 					"final_snapshot_identifier",
 					"master_password",
 					"skip_final_snapshot",
@@ -76,9 +99,11 @@ func TestAccDocDBCluster_basic(t *testing.T) {
 	})
 }
 
-func TestAccDocDBCluster_namePrefix(t *testing.T) {
+func TestAccDocDBCluster_disappears(t *testing.T) {
 	ctx := acctest.Context(t)
 	var v docdb.DBCluster
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_docdb_cluster.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
@@ -87,32 +112,21 @@ func TestAccDocDBCluster_namePrefix(t *testing.T) {
 		CheckDestroy:             testAccCheckClusterDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccClusterConfig_namePrefix(),
+				Config: testAccClusterConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckClusterExists(ctx, "aws_docdb_cluster.test", &v),
-					resource.TestMatchResourceAttr(
-						"aws_docdb_cluster.test", "cluster_identifier", regexp.MustCompile("^tf-test-")),
+					testAccCheckClusterExists(ctx, resourceName, &v),
+					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfdocdb.ResourceCluster(), resourceName),
 				),
-			},
-			{
-				ResourceName:      "aws_docdb_cluster.test",
-				ImportState:       true,
-				ImportStateVerify: true,
-				ImportStateVerifyIgnore: []string{
-					"apply_immediately",
-					"cluster_identifier_prefix",
-					"final_snapshot_identifier",
-					"master_password",
-					"skip_final_snapshot",
-				},
+				ExpectNonEmptyPlan: true,
 			},
 		},
 	})
 }
 
-func TestAccDocDBCluster_generatedName(t *testing.T) {
+func TestAccDocDBCluster_identifierGenerated(t *testing.T) {
 	ctx := acctest.Context(t)
 	var v docdb.DBCluster
+	resourceName := "aws_docdb_cluster.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
@@ -121,20 +135,20 @@ func TestAccDocDBCluster_generatedName(t *testing.T) {
 		CheckDestroy:             testAccCheckClusterDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccClusterConfig_generatedName(),
+				Config: testAccClusterConfig_identifierGenerated(),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckClusterExists(ctx, "aws_docdb_cluster.test", &v),
-					resource.TestMatchResourceAttr(
-						"aws_docdb_cluster.test", "cluster_identifier", regexp.MustCompile("^tf-")),
+					testAccCheckClusterExists(ctx, resourceName, &v),
+					acctest.CheckResourceAttrNameGeneratedWithPrefix(resourceName, "cluster_identifier", "tf-"),
+					resource.TestCheckResourceAttr(resourceName, "cluster_identifier_prefix", "tf-"),
 				),
 			},
 			{
-				ResourceName:      "aws_docdb_cluster.test",
+				ResourceName:      resourceName,
 				ImportState:       true,
 				ImportStateVerify: true,
 				ImportStateVerifyIgnore: []string{
+					"allow_major_version_upgrade",
 					"apply_immediately",
-					"cluster_identifier_prefix",
 					"final_snapshot_identifier",
 					"master_password",
 					"skip_final_snapshot",
@@ -144,25 +158,23 @@ func TestAccDocDBCluster_generatedName(t *testing.T) {
 	})
 }
 
-func TestAccDocDBCluster_GlobalClusterIdentifier(t *testing.T) {
+func TestAccDocDBCluster_identifierPrefix(t *testing.T) {
 	ctx := acctest.Context(t)
-	var dbCluster1 docdb.DBCluster
-
-	rName := sdkacctest.RandomWithPrefix("tf-acc-test")
-	globalClusterResourceName := "aws_docdb_cluster.test"
+	var v docdb.DBCluster
 	resourceName := "aws_docdb_cluster.test"
 
 	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheckGlobalCluster(ctx, t) },
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
 		ErrorCheck:               acctest.ErrorCheck(t, docdb.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckClusterDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccClusterConfig_globalIdentifier(rName),
+				Config: testAccClusterConfig_identifierPrefix("tf-acc-test-prefix-"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckClusterExists(ctx, resourceName, &dbCluster1),
-					resource.TestCheckResourceAttrPair(resourceName, "global_cluster_identifier", globalClusterResourceName, "id"),
+					testAccCheckClusterExists(ctx, resourceName, &v),
+					acctest.CheckResourceAttrNameFromPrefix(resourceName, "cluster_identifier", "tf-acc-test-prefix-"),
+					resource.TestCheckResourceAttr(resourceName, "cluster_identifier_prefix", "tf-acc-test-prefix-"),
 				),
 			},
 			{
@@ -170,39 +182,35 @@ func TestAccDocDBCluster_GlobalClusterIdentifier(t *testing.T) {
 				ImportState:       true,
 				ImportStateVerify: true,
 				ImportStateVerifyIgnore: []string{
+					"allow_major_version_upgrade",
 					"apply_immediately",
-					"cluster_identifier_prefix",
+					"final_snapshot_identifier",
 					"master_password",
 					"skip_final_snapshot",
-					"snapshot_identifier",
 				},
 			},
 		},
 	})
 }
 
-func TestAccDocDBCluster_GlobalClusterIdentifier_Add(t *testing.T) {
+func TestAccDocDBCluster_tags(t *testing.T) {
 	ctx := acctest.Context(t)
-	var dbCluster1 docdb.DBCluster
-
-	rName := sdkacctest.RandomWithPrefix("tf-acc-test")
+	var v docdb.DBCluster
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_docdb_cluster.test"
 
-	if acctest.Partition() == "aws-us-gov" {
-		t.Skip("DocumentDB Global Cluster is not supported in GovCloud partition")
-	}
-
 	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheckGlobalCluster(ctx, t) },
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
 		ErrorCheck:               acctest.ErrorCheck(t, docdb.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckClusterDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccClusterConfig_globalCompatible(rName),
+				Config: testAccClusterConfig_tags1(rName, "key1", "value1"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckClusterExists(ctx, resourceName, &dbCluster1),
-					resource.TestCheckResourceAttr(resourceName, "global_cluster_identifier", ""),
+					testAccCheckClusterExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
 				),
 			},
 			{
@@ -210,40 +218,51 @@ func TestAccDocDBCluster_GlobalClusterIdentifier_Add(t *testing.T) {
 				ImportState:       true,
 				ImportStateVerify: true,
 				ImportStateVerifyIgnore: []string{
+					"allow_major_version_upgrade",
 					"apply_immediately",
-					"cluster_identifier_prefix",
+					"final_snapshot_identifier",
 					"master_password",
 					"skip_final_snapshot",
-					"snapshot_identifier",
 				},
 			},
 			{
-				Config:      testAccClusterConfig_globalIdentifier(rName),
-				ExpectError: regexp.MustCompile(`existing DocumentDB Clusters cannot be added to an existing DocumentDB Global Cluster`),
+				Config: testAccClusterConfig_tags2(rName, "key1", "value1updated", "key2", "value2"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckClusterExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1updated"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
+				),
+			},
+			{
+				Config: testAccClusterConfig_tags1(rName, "key2", "value2"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckClusterExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
+				),
 			},
 		},
 	})
 }
 
-func TestAccDocDBCluster_GlobalClusterIdentifier_Remove(t *testing.T) {
+func TestAccDocDBCluster_takeFinalSnapshot(t *testing.T) {
 	ctx := acctest.Context(t)
-	var dbCluster1 docdb.DBCluster
-
-	rName := sdkacctest.RandomWithPrefix("tf-acc-test")
-	globalClusterResourceName := "aws_docdb_global_cluster.test"
+	var v docdb.DBCluster
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	snapshotName := fmt.Sprintf("%s-snapshot", rName)
 	resourceName := "aws_docdb_cluster.test"
 
 	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheckGlobalCluster(ctx, t) },
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
 		ErrorCheck:               acctest.ErrorCheck(t, docdb.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckClusterDestroy(ctx),
+		CheckDestroy:             testAccCheckClusterDestroyWithFinalSnapshot(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccClusterConfig_globalIdentifier(rName),
+				Config: testAccClusterConfig_finalSnapshot(rName, snapshotName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckClusterExists(ctx, resourceName, &dbCluster1),
-					resource.TestCheckResourceAttrPair(resourceName, "global_cluster_identifier", globalClusterResourceName, "id"),
+					testAccCheckClusterExists(ctx, resourceName, &v),
 				),
 			},
 			{
@@ -251,44 +270,54 @@ func TestAccDocDBCluster_GlobalClusterIdentifier_Remove(t *testing.T) {
 				ImportState:       true,
 				ImportStateVerify: true,
 				ImportStateVerifyIgnore: []string{
+					"allow_major_version_upgrade",
 					"apply_immediately",
-					"cluster_identifier_prefix",
+					"final_snapshot_identifier",
 					"master_password",
 					"skip_final_snapshot",
-					"snapshot_identifier",
 				},
 			},
+		},
+	})
+}
+
+// This is a regression test to make sure that we always cover the scenario as hightlighted in
+// https://github.com/hashicorp/terraform/issues/11568
+func TestAccDocDBCluster_missingUserNameCausesError(t *testing.T) {
+	ctx := acctest.Context(t)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, docdb.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckClusterDestroy(ctx),
+		Steps: []resource.TestStep{
 			{
-				Config: testAccClusterConfig_globalCompatible(rName),
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckClusterExists(ctx, resourceName, &dbCluster1),
-					resource.TestCheckResourceAttr(resourceName, "global_cluster_identifier", ""),
-				),
+				Config:      testAccClusterConfig_noUsernameOrPassword(rName),
+				ExpectError: regexache.MustCompile(`required field is not set`),
 			},
 		},
 	})
 }
 
-func TestAccDocDBCluster_GlobalClusterIdentifier_Update(t *testing.T) {
+func TestAccDocDBCluster_updateCloudWatchLogsExports(t *testing.T) {
 	ctx := acctest.Context(t)
-	var dbCluster1 docdb.DBCluster
-
-	rName := sdkacctest.RandomWithPrefix("tf-acc-test")
-	globalClusterResourceName1 := "aws_docdb_global_cluster.test.0"
-	globalClusterResourceName2 := "aws_docdb_global_cluster.test.1"
+	var v docdb.DBCluster
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_docdb_cluster.test"
 
 	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheckGlobalCluster(ctx, t) },
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
 		ErrorCheck:               acctest.ErrorCheck(t, docdb.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckClusterDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccClusterConfig_globalIdentifierUpdate(rName, globalClusterResourceName1),
+				Config: testAccClusterConfig_noCloudWatchLogs(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckClusterExists(ctx, resourceName, &dbCluster1),
-					resource.TestCheckResourceAttrPair(resourceName, "global_cluster_identifier", globalClusterResourceName1, "id"),
+					testAccCheckClusterExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "enabled_cloudwatch_logs_exports.#", "0"),
 				),
 			},
 			{
@@ -296,78 +325,52 @@ func TestAccDocDBCluster_GlobalClusterIdentifier_Update(t *testing.T) {
 				ImportState:       true,
 				ImportStateVerify: true,
 				ImportStateVerifyIgnore: []string{
+					"allow_major_version_upgrade",
 					"apply_immediately",
-					"cluster_identifier_prefix",
+					"final_snapshot_identifier",
 					"master_password",
 					"skip_final_snapshot",
-					"snapshot_identifier",
 				},
 			},
 			{
-				Config:      testAccClusterConfig_globalIdentifierUpdate(rName, globalClusterResourceName2),
-				ExpectError: regexp.MustCompile(`existing DocumentDB Clusters cannot be migrated between existing DocumentDB Global Clusters`),
-			},
-		},
-	})
-}
-
-func TestAccDocDBCluster_GlobalClusterIdentifier_PrimarySecondaryClusters(t *testing.T) {
-	ctx := acctest.Context(t)
-	var providers []*schema.Provider
-	var primaryDbCluster, secondaryDbCluster docdb.DBCluster
-
-	rNameGlobal := sdkacctest.RandomWithPrefix("tf-acc-test-global")
-	rNamePrimary := sdkacctest.RandomWithPrefix("tf-acc-test-primary")
-	rNameSecondary := sdkacctest.RandomWithPrefix("tf-acc-test-secondary")
-
-	resourceNamePrimary := "aws_docdb_cluster.primary"
-	resourceNameSecondary := "aws_docdb_cluster.secondary"
-
-	resource.ParallelTest(t, resource.TestCase{
-		PreCheck: func() {
-			acctest.PreCheck(ctx, t)
-			acctest.PreCheckMultipleRegion(t, 2)
-			testAccPreCheckGlobalCluster(ctx, t)
-		},
-		ErrorCheck:               acctest.ErrorCheck(t, docdb.EndpointsID),
-		ProtoV5ProviderFactories: acctest.ProtoV5FactoriesPlusProvidersAlternate(ctx, t, &providers),
-		CheckDestroy:             testAccCheckClusterDestroy(ctx),
-		Steps: []resource.TestStep{
-			{
-				Config: testAccClusterConfig_globalIdentifierPrimarySecondary(rNameGlobal, rNamePrimary, rNameSecondary),
+				Config: testAccClusterConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckClusterExistsProvider(ctx, resourceNamePrimary, &primaryDbCluster, acctest.RegionProviderFunc(acctest.Region(), &providers)),
-					testAccCheckClusterExistsProvider(ctx, resourceNameSecondary, &secondaryDbCluster, acctest.RegionProviderFunc(acctest.AlternateRegion(), &providers)),
+					testAccCheckClusterExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "enabled_cloudwatch_logs_exports.#", "2"),
+					resource.TestCheckResourceAttr(resourceName, "enabled_cloudwatch_logs_exports.0", "audit"),
+					resource.TestCheckResourceAttr(resourceName, "enabled_cloudwatch_logs_exports.1", "profiler"),
 				),
 			},
 		},
 	})
 }
 
-func TestAccDocDBCluster_takeFinalSnapshot(t *testing.T) {
+func TestAccDocDBCluster_kmsKey(t *testing.T) {
 	ctx := acctest.Context(t)
 	var v docdb.DBCluster
-	rInt := sdkacctest.RandInt()
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_docdb_cluster.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
 		ErrorCheck:               acctest.ErrorCheck(t, docdb.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckClusterSnapshot(ctx, rInt),
+		CheckDestroy:             testAccCheckClusterDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccClusterConfig_finalSnapshot(rInt),
+				Config: testAccClusterConfig_kmsKey(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckClusterExists(ctx, "aws_docdb_cluster.default", &v),
+					testAccCheckClusterExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttrPair(resourceName, "kms_key_id", "aws_kms_key.test", "arn"),
 				),
 			},
 			{
-				ResourceName:      "aws_docdb_cluster.default",
+				ResourceName:      resourceName,
 				ImportState:       true,
 				ImportStateVerify: true,
 				ImportStateVerifyIgnore: []string{
+					"allow_major_version_upgrade",
 					"apply_immediately",
-					"cluster_identifier_prefix",
 					"final_snapshot_identifier",
 					"master_password",
 					"skip_final_snapshot",
@@ -377,10 +380,12 @@ func TestAccDocDBCluster_takeFinalSnapshot(t *testing.T) {
 	})
 }
 
-// This is a regression test to make sure that we always cover the scenario as hightlighted in
-// https://github.com/hashicorp/terraform/issues/11568
-func TestAccDocDBCluster_missingUserNameCausesError(t *testing.T) {
+func TestAccDocDBCluster_encrypted(t *testing.T) {
 	ctx := acctest.Context(t)
+	var v docdb.DBCluster
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_docdb_cluster.test"
+
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
 		ErrorCheck:               acctest.ErrorCheck(t, docdb.EndpointsID),
@@ -388,17 +393,33 @@ func TestAccDocDBCluster_missingUserNameCausesError(t *testing.T) {
 		CheckDestroy:             testAccCheckClusterDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config:      testAccClusterConfig_noUsernameOrPassword(sdkacctest.RandInt()),
-				ExpectError: regexp.MustCompile(`required field is not set`),
+				Config: testAccClusterConfig_encrypted(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckClusterExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "storage_encrypted", "true"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{
+					"allow_major_version_upgrade",
+					"apply_immediately",
+					"final_snapshot_identifier",
+					"master_password",
+					"skip_final_snapshot",
+				},
 			},
 		},
 	})
 }
 
-func TestAccDocDBCluster_updateTags(t *testing.T) {
+func TestAccDocDBCluster_backupsUpdate(t *testing.T) {
 	ctx := acctest.Context(t)
 	var v docdb.DBCluster
-	ri := sdkacctest.RandInt()
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_docdb_cluster.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
@@ -407,41 +428,44 @@ func TestAccDocDBCluster_updateTags(t *testing.T) {
 		CheckDestroy:             testAccCheckClusterDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccClusterConfig_basic(ri),
+				Config: testAccClusterConfig_backups(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckClusterExists(ctx, "aws_docdb_cluster.default", &v),
-					resource.TestCheckResourceAttr(
-						"aws_docdb_cluster.default", "tags.%", "1"),
+					testAccCheckClusterExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "backup_retention_period", "5"),
+					resource.TestCheckResourceAttr(resourceName, "preferred_backup_window", "07:00-09:00"),
+					resource.TestCheckResourceAttr(resourceName, "preferred_maintenance_window", "tue:04:00-tue:04:30"),
 				),
 			},
 			{
-				ResourceName:      "aws_docdb_cluster.default",
+				ResourceName:      resourceName,
 				ImportState:       true,
 				ImportStateVerify: true,
 				ImportStateVerifyIgnore: []string{
+					"allow_major_version_upgrade",
 					"apply_immediately",
-					"cluster_identifier_prefix",
 					"final_snapshot_identifier",
 					"master_password",
 					"skip_final_snapshot",
 				},
 			},
 			{
-				Config: testAccClusterConfig_updatedTags(ri),
+				Config: testAccClusterConfig_backupsUpdate(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckClusterExists(ctx, "aws_docdb_cluster.default", &v),
-					resource.TestCheckResourceAttr(
-						"aws_docdb_cluster.default", "tags.%", "2"),
+					testAccCheckClusterExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "backup_retention_period", "10"),
+					resource.TestCheckResourceAttr(resourceName, "preferred_backup_window", "03:00-09:00"),
+					resource.TestCheckResourceAttr(resourceName, "preferred_maintenance_window", "wed:01:00-wed:01:30"),
 				),
 			},
 		},
 	})
 }
 
-func TestAccDocDBCluster_updateCloudWatchLogsExports(t *testing.T) {
+func TestAccDocDBCluster_port(t *testing.T) {
 	ctx := acctest.Context(t)
-	var v docdb.DBCluster
-	ri := sdkacctest.RandInt()
+	var dbCluster1, dbCluster2 docdb.DBCluster
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_docdb_cluster.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
@@ -450,38 +474,41 @@ func TestAccDocDBCluster_updateCloudWatchLogsExports(t *testing.T) {
 		CheckDestroy:             testAccCheckClusterDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccClusterConfig_noCloudWatchLogs(ri),
+				Config: testAccClusterConfig_port(rName, 5432),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckClusterExists(ctx, "aws_docdb_cluster.default", &v),
+					testAccCheckClusterExists(ctx, resourceName, &dbCluster1),
+					resource.TestCheckResourceAttr(resourceName, "port", "5432"),
 				),
 			},
 			{
-				ResourceName:      "aws_docdb_cluster.default",
+				ResourceName:      resourceName,
 				ImportState:       true,
 				ImportStateVerify: true,
 				ImportStateVerifyIgnore: []string{
+					"allow_major_version_upgrade",
 					"apply_immediately",
-					"cluster_identifier_prefix",
 					"final_snapshot_identifier",
 					"master_password",
 					"skip_final_snapshot",
 				},
 			},
 			{
-				Config: testAccClusterConfig_basic(ri),
+				Config: testAccClusterConfig_port(rName, 2345),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckClusterExists(ctx, "aws_docdb_cluster.default", &v),
-					resource.TestCheckResourceAttr("aws_docdb_cluster.default",
-						"enabled_cloudwatch_logs_exports.0", "audit"),
+					testAccCheckClusterExists(ctx, resourceName, &dbCluster2),
+					testAccCheckClusterRecreated(&dbCluster1, &dbCluster2),
+					resource.TestCheckResourceAttr(resourceName, "port", "2345"),
 				),
 			},
 		},
 	})
 }
 
-func TestAccDocDBCluster_kmsKey(t *testing.T) {
+func TestAccDocDBCluster_deleteProtection(t *testing.T) {
 	ctx := acctest.Context(t)
-	var v docdb.DBCluster
+	var dbCluster docdb.DBCluster
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_docdb_cluster.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
@@ -490,55 +517,76 @@ func TestAccDocDBCluster_kmsKey(t *testing.T) {
 		CheckDestroy:             testAccCheckClusterDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccClusterConfig_kmsKey(sdkacctest.RandInt()),
+				Config: testAccClusterConfig_deleteProtection(rName, true),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckClusterExists(ctx, "aws_docdb_cluster.default", &v),
-					resource.TestCheckResourceAttrPair("aws_docdb_cluster.default", "kms_key_id", "aws_kms_key.foo", "arn"),
+					testAccCheckClusterExists(ctx, resourceName, &dbCluster),
+					resource.TestCheckResourceAttr(resourceName, "deletion_protection", "true"),
 				),
 			},
 			{
-				ResourceName:      "aws_docdb_cluster.default",
+				ResourceName:      resourceName,
 				ImportState:       true,
 				ImportStateVerify: true,
 				ImportStateVerifyIgnore: []string{
+					"allow_major_version_upgrade",
 					"apply_immediately",
-					"cluster_identifier_prefix",
 					"final_snapshot_identifier",
 					"master_password",
 					"skip_final_snapshot",
 				},
 			},
+			{
+				Config: testAccClusterConfig_deleteProtection(rName, false),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckClusterExists(ctx, resourceName, &dbCluster),
+					resource.TestCheckResourceAttr(resourceName, "deletion_protection", "false"),
+				),
+			},
+			{
+				Config: testAccClusterConfig_deleteProtection(rName, true),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckClusterExists(ctx, resourceName, &dbCluster),
+					resource.TestCheckResourceAttr(resourceName, "deletion_protection", "true"),
+				),
+			},
+			{
+				Config: testAccClusterConfig_deleteProtection(rName, false),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckClusterExists(ctx, resourceName, &dbCluster),
+					resource.TestCheckResourceAttr(resourceName, "deletion_protection", "false"),
+				),
+			},
 		},
 	})
 }
 
-func TestAccDocDBCluster_encrypted(t *testing.T) {
+func TestAccDocDBCluster_GlobalClusterIdentifier(t *testing.T) {
 	ctx := acctest.Context(t)
-	var v docdb.DBCluster
+	var dbCluster docdb.DBCluster
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	globalClusterResourceName := "aws_docdb_cluster.test"
+	resourceName := "aws_docdb_cluster.test"
 
 	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheckGlobalCluster(ctx, t) },
 		ErrorCheck:               acctest.ErrorCheck(t, docdb.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckClusterDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccClusterConfig_encrypted(sdkacctest.RandInt()),
+				Config: testAccClusterConfig_globalIdentifier(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckClusterExists(ctx, "aws_docdb_cluster.default", &v),
-					resource.TestCheckResourceAttr(
-						"aws_docdb_cluster.default", "storage_encrypted", "true"),
-					resource.TestCheckResourceAttr(
-						"aws_docdb_cluster.default", "db_cluster_parameter_group_name", "default.docdb4.0"),
+					testAccCheckClusterExists(ctx, resourceName, &dbCluster),
+					resource.TestCheckResourceAttrPair(resourceName, "global_cluster_identifier", globalClusterResourceName, "id"),
 				),
 			},
 			{
-				ResourceName:      "aws_docdb_cluster.default",
+				ResourceName:      resourceName,
 				ImportState:       true,
 				ImportStateVerify: true,
 				ImportStateVerifyIgnore: []string{
+					"allow_major_version_upgrade",
 					"apply_immediately",
-					"cluster_identifier_prefix",
 					"final_snapshot_identifier",
 					"master_password",
 					"skip_final_snapshot",
@@ -548,74 +596,67 @@ func TestAccDocDBCluster_encrypted(t *testing.T) {
 	})
 }
 
-func TestAccDocDBCluster_backupsUpdate(t *testing.T) {
+func TestAccDocDBCluster_GlobalClusterIdentifier_Add(t *testing.T) {
 	ctx := acctest.Context(t)
-	var v docdb.DBCluster
+	var dbCluster docdb.DBCluster
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_docdb_cluster.test"
+
+	if acctest.Partition() == "aws-us-gov" {
+		t.Skip("DocumentDB Global Cluster is not supported in GovCloud partition")
+	}
 
-	ri := sdkacctest.RandInt()
 	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheckGlobalCluster(ctx, t) },
 		ErrorCheck:               acctest.ErrorCheck(t, docdb.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckClusterDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccClusterConfig_backups(ri),
+				Config: testAccClusterConfig_globalCompatible(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckClusterExists(ctx, "aws_docdb_cluster.default", &v),
-					resource.TestCheckResourceAttr(
-						"aws_docdb_cluster.default", "preferred_backup_window", "07:00-09:00"),
-					resource.TestCheckResourceAttr(
-						"aws_docdb_cluster.default", "backup_retention_period", "5"),
-					resource.TestCheckResourceAttr(
-						"aws_docdb_cluster.default", "preferred_maintenance_window", "tue:04:00-tue:04:30"),
+					testAccCheckClusterExists(ctx, resourceName, &dbCluster),
+					resource.TestCheckResourceAttr(resourceName, "global_cluster_identifier", ""),
 				),
 			},
 			{
-				ResourceName:      "aws_docdb_cluster.default",
+				ResourceName:      resourceName,
 				ImportState:       true,
 				ImportStateVerify: true,
 				ImportStateVerifyIgnore: []string{
+					"allow_major_version_upgrade",
 					"apply_immediately",
-					"cluster_identifier_prefix",
 					"final_snapshot_identifier",
 					"master_password",
 					"skip_final_snapshot",
 				},
 			},
 			{
-				Config: testAccClusterConfig_backupsUpdate(ri),
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckClusterExists(ctx, "aws_docdb_cluster.default", &v),
-					resource.TestCheckResourceAttr(
-						"aws_docdb_cluster.default", "preferred_backup_window", "03:00-09:00"),
-					resource.TestCheckResourceAttr(
-						"aws_docdb_cluster.default", "backup_retention_period", "10"),
-					resource.TestCheckResourceAttr(
-						"aws_docdb_cluster.default", "preferred_maintenance_window", "wed:01:00-wed:01:30"),
-				),
+				Config:      testAccClusterConfig_globalIdentifier(rName),
+				ExpectError: regexache.MustCompile(`existing DocumentDB Clusters cannot be added to an existing DocumentDB Global Cluster`),
 			},
 		},
 	})
 }
 
-func TestAccDocDBCluster_port(t *testing.T) {
+func TestAccDocDBCluster_GlobalClusterIdentifier_Remove(t *testing.T) {
 	ctx := acctest.Context(t)
-	var dbCluster1, dbCluster2 docdb.DBCluster
-	rInt := sdkacctest.RandInt()
+	var dbCluster docdb.DBCluster
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	globalClusterResourceName := "aws_docdb_global_cluster.test"
 	resourceName := "aws_docdb_cluster.test"
 
 	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheckGlobalCluster(ctx, t) },
 		ErrorCheck:               acctest.ErrorCheck(t, docdb.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckClusterDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccClusterConfig_port(rInt, 5432),
+				Config: testAccClusterConfig_globalIdentifier(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckClusterExists(ctx, resourceName, &dbCluster1),
-					resource.TestCheckResourceAttr(resourceName, "port", "5432"),
+					testAccCheckClusterExists(ctx, resourceName, &dbCluster),
+					resource.TestCheckResourceAttrPair(resourceName, "global_cluster_identifier", globalClusterResourceName, "id"),
 				),
 			},
 			{
@@ -623,41 +664,43 @@ func TestAccDocDBCluster_port(t *testing.T) {
 				ImportState:       true,
 				ImportStateVerify: true,
 				ImportStateVerifyIgnore: []string{
+					"allow_major_version_upgrade",
 					"apply_immediately",
-					"cluster_identifier_prefix",
 					"final_snapshot_identifier",
 					"master_password",
 					"skip_final_snapshot",
 				},
 			},
 			{
-				Config: testAccClusterConfig_port(rInt, 2345),
+				Config: testAccClusterConfig_globalCompatible(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckClusterExists(ctx, resourceName, &dbCluster2),
-					testAccCheckClusterRecreated(&dbCluster1, &dbCluster2),
-					resource.TestCheckResourceAttr(resourceName, "port", "2345"),
+					testAccCheckClusterExists(ctx, resourceName, &dbCluster),
+					resource.TestCheckResourceAttr(resourceName, "global_cluster_identifier", ""),
 				),
 			},
 		},
 	})
 }
 
-func TestAccDocDBCluster_deleteProtection(t *testing.T) {
+func TestAccDocDBCluster_GlobalClusterIdentifier_Update(t *testing.T) {
 	ctx := acctest.Context(t)
 	var dbCluster docdb.DBCluster
-	resourceName := "aws_docdb_cluster.default"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	globalClusterResourceName1 := "aws_docdb_global_cluster.test.0"
+	globalClusterResourceName2 := "aws_docdb_global_cluster.test.1"
+	resourceName := "aws_docdb_cluster.test"
 
 	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheckGlobalCluster(ctx, t) },
 		ErrorCheck:               acctest.ErrorCheck(t, docdb.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckClusterDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccClusterConfig_deleteProtection(true),
+				Config: testAccClusterConfig_globalIdentifierUpdate(rName, globalClusterResourceName1),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckClusterExists(ctx, resourceName, &dbCluster),
-					resource.TestCheckResourceAttr(resourceName, "deletion_protection", "true"),
+					resource.TestCheckResourceAttrPair(resourceName, "global_cluster_identifier", globalClusterResourceName1, "id"),
 				),
 			},
 			{
@@ -665,205 +708,150 @@ func TestAccDocDBCluster_deleteProtection(t *testing.T) {
 				ImportState:       true,
 				ImportStateVerify: true,
 				ImportStateVerifyIgnore: []string{
+					"allow_major_version_upgrade",
 					"apply_immediately",
-					"cluster_identifier_prefix",
 					"final_snapshot_identifier",
 					"master_password",
 					"skip_final_snapshot",
 				},
 			},
 			{
-				Config: testAccClusterConfig_deleteProtection(false),
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckClusterExists(ctx, resourceName, &dbCluster),
-					resource.TestCheckResourceAttr(resourceName, "deletion_protection", "false"),
-				),
+				Config:      testAccClusterConfig_globalIdentifierUpdate(rName, globalClusterResourceName2),
+				ExpectError: regexache.MustCompile(`existing DocumentDB Clusters cannot be migrated between existing DocumentDB Global Clusters`),
 			},
+		},
+	})
+}
+
+func TestAccDocDBCluster_GlobalClusterIdentifier_PrimarySecondaryClusters(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
+	ctx := acctest.Context(t)
+	var providers []*schema.Provider
+	var primaryDbCluster, secondaryDbCluster docdb.DBCluster
+	rNameGlobal := sdkacctest.RandomWithPrefix("tf-acc-test-global")
+	rNamePrimary := sdkacctest.RandomWithPrefix("tf-acc-test-primary")
+	rNameSecondary := sdkacctest.RandomWithPrefix("tf-acc-test-secondary")
+	resourceNamePrimary := "aws_docdb_cluster.primary"
+	resourceNameSecondary := "aws_docdb_cluster.secondary"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckMultipleRegion(t, 2)
+			testAccPreCheckGlobalCluster(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, docdb.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5FactoriesPlusProvidersAlternate(ctx, t, &providers),
+		CheckDestroy:             testAccCheckClusterDestroy(ctx),
+		Steps: []resource.TestStep{
 			{
-				Config: testAccClusterConfig_deleteProtection(true),
+				Config: testAccClusterConfig_globalIdentifierPrimarySecondary(rNameGlobal, rNamePrimary, rNameSecondary),
 				Check: resource.ComposeTestCheckFunc(
+					testAccCheckClusterExistsProvider(ctx, resourceNamePrimary, &primaryDbCluster, acctest.RegionProviderFunc(acctest.Region(), &providers)),
+					testAccCheckClusterExistsProvider(ctx, resourceNameSecondary, &secondaryDbCluster, acctest.RegionProviderFunc(acctest.AlternateRegion(), &providers)),
+				),
+			},
+		},
+	})
+}
+
+func TestAccDocDBCluster_updateEngineMajorVersion(t *testing.T) {
+	ctx := acctest.Context(t)
+	var dbCluster docdb.DBCluster
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_docdb_cluster.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, docdb.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckClusterDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccClusterConfig_engineVersion(rName, "4.0.0"),
+				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckClusterExists(ctx, resourceName, &dbCluster),
-					resource.TestCheckResourceAttr(resourceName, "deletion_protection", "true"),
+					resource.TestCheckResourceAttr(resourceName, "allow_major_version_upgrade", "true"),
+					resource.TestCheckResourceAttr(resourceName, "apply_immediately", "true"),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "rds", regexache.MustCompile(fmt.Sprintf("cluster:%s", rName))),
+					resource.TestCheckResourceAttr(resourceName, "availability_zones.#", "3"),
+					resource.TestCheckResourceAttr(resourceName, "backup_retention_period", "1"),
+					resource.TestCheckResourceAttr(resourceName, "cluster_identifier", rName),
+					resource.TestCheckResourceAttr(resourceName, "cluster_identifier_prefix", ""),
+					resource.TestCheckResourceAttr(resourceName, "cluster_members.#", "0"),
+					resource.TestCheckResourceAttrSet(resourceName, "cluster_resource_id"),
+					resource.TestCheckResourceAttr(resourceName, "db_cluster_parameter_group_name", "default.docdb4.0"),
+					resource.TestCheckResourceAttr(resourceName, "db_subnet_group_name", "default"),
+					resource.TestCheckResourceAttr(resourceName, "deletion_protection", "false"),
+					resource.TestCheckResourceAttr(resourceName, "enabled_cloudwatch_logs_exports.#", "0"),
+					resource.TestCheckResourceAttrSet(resourceName, "endpoint"),
+					resource.TestCheckResourceAttr(resourceName, "engine", "docdb"),
+					resource.TestCheckResourceAttr(resourceName, "engine_version", "4.0.0"),
+					resource.TestCheckNoResourceAttr(resourceName, "final_snapshot_identifier"),
+					resource.TestCheckResourceAttr(resourceName, "global_cluster_identifier", ""),
+					resource.TestCheckResourceAttrSet(resourceName, "hosted_zone_id"),
+					resource.TestCheckResourceAttr(resourceName, "kms_key_id", ""),
+					resource.TestCheckResourceAttr(resourceName, "master_password", "avoid-plaintext-passwords"),
+					resource.TestCheckResourceAttr(resourceName, "master_username", "tfacctest"),
+					resource.TestCheckResourceAttr(resourceName, "port", "27017"),
+					resource.TestCheckResourceAttrSet(resourceName, "preferred_backup_window"),
+					resource.TestCheckResourceAttrSet(resourceName, "preferred_maintenance_window"),
+					resource.TestCheckResourceAttrSet(resourceName, "reader_endpoint"),
+					resource.TestCheckResourceAttr(resourceName, "skip_final_snapshot", "true"),
+					resource.TestCheckNoResourceAttr(resourceName, "snapshot_identifier"),
+					resource.TestCheckResourceAttr(resourceName, "storage_encrypted", "false"),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
+					resource.TestCheckResourceAttr(resourceName, "vpc_security_group_ids.#", "1"),
 				),
 			},
 			{
-				Config: testAccClusterConfig_deleteProtection(false),
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{
+					"allow_major_version_upgrade",
+					"apply_immediately",
+					"final_snapshot_identifier",
+					"master_password",
+					"skip_final_snapshot",
+				},
+			},
+			{
+				Config: testAccClusterConfig_engineVersion(rName, "5.0.0"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckClusterExists(ctx, resourceName, &dbCluster),
-					resource.TestCheckResourceAttr(resourceName, "deletion_protection", "false"),
+					resource.TestCheckResourceAttr(resourceName, "cluster_members.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "db_cluster_parameter_group_name", "default.docdb5.0"),
+					resource.TestCheckResourceAttr(resourceName, "engine_version", "5.0.0"),
 				),
 			},
 		},
 	})
 }
 
-func testAccClusterConfig_globalIdentifierPrimarySecondary(rNameGlobal, rNamePrimary, rNameSecondary string) string {
-	return acctest.ConfigCompose(
-		acctest.ConfigMultipleRegionProvider(2),
-		fmt.Sprintf(`
-data "aws_availability_zones" "alternate" {
-  provider = "awsalternate"
-  state    = "available"
-
-  filter {
-    name   = "opt-in-status"
-    values = ["opt-in-not-required"]
-  }
-}
-
-resource "aws_docdb_global_cluster" "test" {
-  global_cluster_identifier = "%[1]s"
-  engine                    = "docdb"
-  engine_version            = "4.0.0"
-}
-
-resource "aws_docdb_cluster" "primary" {
-  cluster_identifier        = "%[2]s"
-  master_username           = "foo"
-  master_password           = "barbarbar"
-  skip_final_snapshot       = true
-  global_cluster_identifier = aws_docdb_global_cluster.test.id
-  engine                    = aws_docdb_global_cluster.test.engine
-  engine_version            = aws_docdb_global_cluster.test.engine_version
-}
-
-resource "aws_docdb_cluster_instance" "primary" {
-  identifier         = "%[2]s"
-  cluster_identifier = aws_docdb_cluster.primary.id
-  instance_class     = "db.r5.large"
-}
-
-resource "aws_vpc" "alternate" {
-  provider   = "awsalternate"
-  cidr_block = "10.0.0.0/16"
-
-  tags = {
-    Name = "%[3]s"
-  }
-}
-
-resource "aws_subnet" "alternate" {
-  provider          = "awsalternate"
-  count             = 3
-  vpc_id            = aws_vpc.alternate.id
-  availability_zone = data.aws_availability_zones.alternate.names[count.index]
-  cidr_block        = "10.0.${count.index}.0/24"
-
-  tags = {
-    Name = "%[3]s"
-  }
-}
-
-resource "aws_docdb_subnet_group" "alternate" {
-  provider   = "awsalternate"
-  name       = "%[3]s"
-  subnet_ids = aws_subnet.alternate[*].id
-}
-
-resource "aws_docdb_cluster" "secondary" {
-  provider                  = "awsalternate"
-  cluster_identifier        = "%[3]s"
-  skip_final_snapshot       = true
-  db_subnet_group_name      = aws_docdb_subnet_group.alternate.name
-  global_cluster_identifier = aws_docdb_global_cluster.test.id
-  engine                    = aws_docdb_global_cluster.test.engine
-  engine_version            = aws_docdb_global_cluster.test.engine_version
-  depends_on                = [aws_docdb_cluster_instance.primary]
-}
-
-resource "aws_docdb_cluster_instance" "secondary" {
-  provider           = "awsalternate"
-  identifier         = "%[3]s"
-  cluster_identifier = aws_docdb_cluster.secondary.id
-  instance_class     = "db.r5.large"
-}
-`, rNameGlobal, rNamePrimary, rNameSecondary))
-}
-
-func testAccClusterConfig_globalIdentifierUpdate(rName, globalClusterIdentifierResourceName string) string {
-	return fmt.Sprintf(`
-resource "aws_docdb_global_cluster" "test" {
-  count                     = 2
-  engine                    = "docdb"
-  engine_version            = "4.0.0" # version compatible with global
-  global_cluster_identifier = "%[1]s-${count.index}"
-}
-
-resource "aws_docdb_cluster" "test" {
-  cluster_identifier        = %[1]q
-  global_cluster_identifier = %[2]s.id
-  engine_version            = %[2]s.engine_version
-  master_password           = "barbarbarbar"
-  master_username           = "foo"
-  skip_final_snapshot       = true
-}
-`, rName, globalClusterIdentifierResourceName)
-}
-
-func testAccClusterConfig_globalCompatible(rName string) string {
-	return fmt.Sprintf(`
-resource "aws_docdb_cluster" "test" {
-  cluster_identifier  = %[1]q
-  engine_version      = "4.0.0" # version compatible with global
-  master_password     = "barbarbarbar"
-  master_username     = "foo"
-  skip_final_snapshot = true
-}
-`, rName)
-}
-
-func testAccClusterConfig_globalIdentifier(rName string) string {
-	return fmt.Sprintf(`
-resource "aws_docdb_global_cluster" "test" {
-  engine_version            = "4.0.0" # version compatible
-  engine                    = "docdb"
-  global_cluster_identifier = %[1]q
-}
-
-resource "aws_docdb_cluster" "test" {
-  cluster_identifier        = %[1]q
-  global_cluster_identifier = aws_docdb_global_cluster.test.id
-  engine_version            = aws_docdb_global_cluster.test.engine_version
-  master_password           = "barbarbarbar"
-  master_username           = "foo"
-  skip_final_snapshot       = true
-}
-`, rName)
-}
-
 func testAccCheckClusterDestroy(ctx context.Context) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		return testAccCheckClusterDestroyWithProvider(ctx)(s, acctest.Provider)
-	}
-}
-
-func testAccCheckClusterDestroyWithProvider(ctx context.Context) acctest.TestCheckWithProviderFunc {
-	return func(s *terraform.State, provider *schema.Provider) error {
-		conn := provider.Meta().(*conns.AWSClient).DocDBConn(ctx)
+		conn := acctest.Provider.Meta().(*conns.AWSClient).DocDBConn(ctx)
 
 		for _, rs := range s.RootModule().Resources {
 			if rs.Type != "aws_docdb_cluster" {
 				continue
 			}
 
-			// Try to find the Group
-			var err error
-			resp, err := conn.DescribeDBClustersWithContext(ctx, &docdb.DescribeDBClustersInput{
-				DBClusterIdentifier: aws.String(rs.Primary.ID),
-			})
+			_, err := tfdocdb.FindDBClusterByID(ctx, conn, rs.Primary.ID)
 
-			if err == nil {
-				if len(resp.DBClusters) != 0 &&
-					*resp.DBClusters[0].DBClusterIdentifier == rs.Primary.ID {
-					return fmt.Errorf("DB Cluster %s still exists", rs.Primary.ID)
-				}
+			if tfresource.NotFound(err) {
+				continue
 			}
 
-			if tfawserr.ErrCodeEquals(err, docdb.ErrCodeDBClusterNotFoundFault) {
-				continue
+			if err != nil {
+				return err
 			}
 
-			return err
+			return fmt.Errorf("DocumentDB Cluster %s still exists", rs.Primary.ID)
 		}
 
 		return nil
@@ -881,90 +869,69 @@ func testAccCheckClusterExistsProvider(ctx context.Context, n string, v *docdb.D
 			return fmt.Errorf("Not found: %s", n)
 		}
 
-		if rs.Primary.ID == "" {
-			return fmt.Errorf("No DB Instance ID is set")
-		}
+		conn := providerF().Meta().(*conns.AWSClient).DocDBConn(ctx)
 
-		provider := providerF()
-		conn := provider.Meta().(*conns.AWSClient).DocDBConn(ctx)
-		resp, err := conn.DescribeDBClustersWithContext(ctx, &docdb.DescribeDBClustersInput{
-			DBClusterIdentifier: aws.String(rs.Primary.ID),
-		})
+		output, err := tfdocdb.FindDBClusterByID(ctx, conn, rs.Primary.ID)
 
 		if err != nil {
 			return err
 		}
 
-		for _, c := range resp.DBClusters {
-			if *c.DBClusterIdentifier == rs.Primary.ID {
-				*v = *c
-				return nil
-			}
-		}
-
-		return fmt.Errorf("DB Cluster (%s) not found", rs.Primary.ID)
-	}
-}
-
-func testAccCheckClusterRecreated(i, j *docdb.DBCluster) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		if aws.TimeValue(i.ClusterCreateTime).Equal(aws.TimeValue(j.ClusterCreateTime)) {
-			return errors.New("DocumentDB Cluster was not recreated")
-		}
+		*v = *output
 
 		return nil
 	}
 }
 
-func testAccCheckClusterSnapshot(ctx context.Context, rInt int) resource.TestCheckFunc {
+func testAccCheckClusterDestroyWithFinalSnapshot(ctx context.Context) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
+		conn := acctest.Provider.Meta().(*conns.AWSClient).DocDBConn(ctx)
+
 		for _, rs := range s.RootModule().Resources {
 			if rs.Type != "aws_docdb_cluster" {
 				continue
 			}
 
-			// Try and delete the snapshot before we check for the cluster not found
-			snapshot_identifier := fmt.Sprintf("tf-acctest-docdbcluster-snapshot-%d", rInt)
-
-			awsClient := acctest.Provider.Meta().(*conns.AWSClient)
-			conn := awsClient.DocDBConn(ctx)
-
-			log.Printf("[INFO] Deleting the Snapshot %s", snapshot_identifier)
-			_, snapDeleteErr := conn.DeleteDBClusterSnapshotWithContext(ctx, &docdb.DeleteDBClusterSnapshotInput{
-				DBClusterSnapshotIdentifier: aws.String(snapshot_identifier),
+			finalSnapshotID := rs.Primary.Attributes["final_snapshot_identifier"]
+			_, err := conn.DeleteDBClusterSnapshotWithContext(ctx, &docdb.DeleteDBClusterSnapshotInput{
+				DBClusterSnapshotIdentifier: aws.String(finalSnapshotID),
 			})
-			if snapDeleteErr != nil {
-				return snapDeleteErr
+
+			if err != nil {
+				return err
 			}
 
-			// Try to find the Group
-			var err error
-			resp, err := conn.DescribeDBClustersWithContext(ctx, &docdb.DescribeDBClustersInput{
-				DBClusterIdentifier: aws.String(rs.Primary.ID),
-			})
+			_, err = tfdocdb.FindDBClusterByID(ctx, conn, rs.Primary.ID)
 
-			if err == nil {
-				if len(resp.DBClusters) != 0 &&
-					*resp.DBClusters[0].DBClusterIdentifier == rs.Primary.ID {
-					return fmt.Errorf("DB Cluster %s still exists", rs.Primary.ID)
-				}
+			if tfresource.NotFound(err) {
+				continue
 			}
 
-			if tfawserr.ErrCodeEquals(err, docdb.ErrCodeDBClusterNotFoundFault) {
-				continue
+			if err != nil {
+				return err
 			}
 
-			return err
+			return fmt.Errorf("DocumentDB Cluster %s still exists", rs.Primary.ID)
+		}
+
+		return nil
+	}
+}
+
+func testAccCheckClusterRecreated(i, j *docdb.DBCluster) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		if aws.TimeValue(i.ClusterCreateTime).Equal(aws.TimeValue(j.ClusterCreateTime)) {
+			return errors.New("DocumentDB Cluster was not recreated")
 		}
 
 		return nil
 	}
 }
 
-func testAccClusterConfig_basic(n int) string {
+func testAccClusterConfig_basic(rName string) string {
 	return acctest.ConfigCompose(acctest.ConfigAvailableAZsNoOptIn(), fmt.Sprintf(`
-resource "aws_docdb_cluster" "default" {
-  cluster_identifier = "tf-docdb-cluster-%d"
+resource "aws_docdb_cluster" "test" {
+  cluster_identifier = %[1]q
 
   availability_zones = [
     data.aws_availability_zones.available.names[0],
@@ -972,71 +939,74 @@ resource "aws_docdb_cluster" "default" {
     data.aws_availability_zones.available.names[2]
   ]
 
-  master_username                 = "foo"
-  master_password                 = "mustbeeightcharaters"
-  db_cluster_parameter_group_name = "default.docdb4.0"
-  skip_final_snapshot             = true
-
-  tags = {
-    Environment = "production"
-  }
+  master_password     = "avoid-plaintext-passwords"
+  master_username     = "tfacctest"
+  skip_final_snapshot = true
 
   enabled_cloudwatch_logs_exports = [
     "audit",
     "profiler",
   ]
 }
-`, n))
+`, rName))
 }
 
-func testAccClusterConfig_namePrefix() string {
+func testAccClusterConfig_identifierGenerated() string {
 	return `
 resource "aws_docdb_cluster" "test" {
-  cluster_identifier_prefix = "tf-test-"
-  master_username           = "root"
-  master_password           = "password"
-  skip_final_snapshot       = true
+  master_password     = "avoid-plaintext-passwords"
+  master_username     = "tfacctest"
+  skip_final_snapshot = true
 }
 `
 }
 
-func testAccClusterConfig_generatedName() string {
-	return `
+func testAccClusterConfig_identifierPrefix(prefix string) string {
+	return fmt.Sprintf(`
 resource "aws_docdb_cluster" "test" {
-  master_username     = "root"
-  master_password     = "password"
-  skip_final_snapshot = true
+  cluster_identifier_prefix = %[1]q
+  master_password           = "avoid-plaintext-passwords"
+  master_username           = "tfacctest"
+  skip_final_snapshot       = true
 }
-`
+`, prefix)
 }
 
-func testAccClusterConfig_finalSnapshot(n int) string {
-	return acctest.ConfigCompose(acctest.ConfigAvailableAZsNoOptIn(), fmt.Sprintf(`
-resource "aws_docdb_cluster" "default" {
-  cluster_identifier = "tf-docdb-cluster-%[1]d"
+func testAccClusterConfig_tags1(rName, tagKey1, tagValue1 string) string {
+	return fmt.Sprintf(`
+resource "aws_docdb_cluster" "test" {
+  cluster_identifier  = %[1]q
+  master_password     = "avoid-plaintext-passwords"
+  master_username     = "tfacctest"
+  skip_final_snapshot = true
 
-  availability_zones = [
-    data.aws_availability_zones.available.names[0],
-    data.aws_availability_zones.available.names[1],
-    data.aws_availability_zones.available.names[2]
-  ]
+  tags = {
+    %[2]q = %[3]q
+  }
+}
+`, rName, tagKey1, tagValue1)
+}
 
-  master_username                 = "foo"
-  master_password                 = "mustbeeightcharaters"
-  db_cluster_parameter_group_name = "default.docdb4.0"
-  final_snapshot_identifier       = "tf-acctest-docdbcluster-snapshot-%[1]d"
+func testAccClusterConfig_tags2(rName, tagKey1, tagValue1, tagKey2, tagValue2 string) string {
+	return fmt.Sprintf(`
+resource "aws_docdb_cluster" "test" {
+  cluster_identifier  = %[1]q
+  master_password     = "avoid-plaintext-passwords"
+  master_username     = "tfacctest"
+  skip_final_snapshot = true
 
   tags = {
-    Environment = "production"
+    %[2]q = %[3]q
+    %[4]q = %[5]q
   }
 }
-`, n))
+`, rName, tagKey1, tagValue1, tagKey2, tagValue2)
 }
 
-func testAccClusterConfig_noUsernameOrPassword(n int) string {
+func testAccClusterConfig_finalSnapshot(rName, snapshotName string) string {
 	return acctest.ConfigCompose(acctest.ConfigAvailableAZsNoOptIn(), fmt.Sprintf(`
-resource "aws_docdb_cluster" "default" {
-  cluster_identifier = "tf-docdb-cluster-%d"
+resource "aws_docdb_cluster" "test" {
+  cluster_identifier = %[1]q
 
   availability_zones = [
     data.aws_availability_zones.available.names[0],
@@ -1044,15 +1014,17 @@ resource "aws_docdb_cluster" "default" {
     data.aws_availability_zones.available.names[2]
   ]
 
-  skip_final_snapshot = true
+  master_password           = "avoid-plaintext-passwords"
+  master_username           = "tfacctest"
+  final_snapshot_identifier = %[2]q
 }
-`, n))
+`, rName, snapshotName))
 }
 
-func testAccClusterConfig_updatedTags(n int) string {
+func testAccClusterConfig_noUsernameOrPassword(rName string) string {
 	return acctest.ConfigCompose(acctest.ConfigAvailableAZsNoOptIn(), fmt.Sprintf(`
-resource "aws_docdb_cluster" "default" {
-  cluster_identifier = "tf-docdb-cluster-%d"
+resource "aws_docdb_cluster" "test" {
+  cluster_identifier = %[1]q
 
   availability_zones = [
     data.aws_availability_zones.available.names[0],
@@ -1060,23 +1032,15 @@ resource "aws_docdb_cluster" "default" {
     data.aws_availability_zones.available.names[2]
   ]
 
-  master_username                 = "foo"
-  master_password                 = "mustbeeightcharaters"
-  db_cluster_parameter_group_name = "default.docdb4.0"
-  skip_final_snapshot             = true
-
-  tags = {
-    Environment = "production"
-    AnotherTag  = "test"
-  }
+  skip_final_snapshot = true
 }
-`, n))
+`, rName))
 }
 
-func testAccClusterConfig_noCloudWatchLogs(n int) string {
+func testAccClusterConfig_noCloudWatchLogs(rName string) string {
 	return acctest.ConfigCompose(acctest.ConfigAvailableAZsNoOptIn(), fmt.Sprintf(`
-resource "aws_docdb_cluster" "default" {
-  cluster_identifier = "tf-docdb-cluster-%d"
+resource "aws_docdb_cluster" "test" {
+  cluster_identifier = %[1]q
 
   availability_zones = [
     data.aws_availability_zones.available.names[0],
@@ -1084,22 +1048,17 @@ resource "aws_docdb_cluster" "default" {
     data.aws_availability_zones.available.names[2]
   ]
 
-  master_username                 = "foo"
-  master_password                 = "mustbeeightcharaters"
-  db_cluster_parameter_group_name = "default.docdb4.0"
-  skip_final_snapshot             = true
-
-  tags = {
-    Environment = "production"
-  }
+  master_password     = "avoid-plaintext-passwords"
+  master_username     = "tfacctest"
+  skip_final_snapshot = true
 }
-`, n))
+`, rName))
 }
 
-func testAccClusterConfig_kmsKey(n int) string {
+func testAccClusterConfig_kmsKey(rName string) string {
 	return acctest.ConfigCompose(acctest.ConfigAvailableAZsNoOptIn(), fmt.Sprintf(`
-resource "aws_kms_key" "foo" {
-  description = "Terraform acc test %[1]d"
+resource "aws_kms_key" "test" {
+  description = %[1]q
 
   policy = <<POLICY
 {
@@ -1120,28 +1079,27 @@ resource "aws_kms_key" "foo" {
 POLICY
 }
 
-resource "aws_docdb_cluster" "default" {
-  cluster_identifier = "tf-docdb-cluster-%[1]d"
+resource "aws_docdb_cluster" "test" {
+  cluster_identifier = %[1]q
   availability_zones = [
     data.aws_availability_zones.available.names[0],
     data.aws_availability_zones.available.names[1],
     data.aws_availability_zones.available.names[2]
   ]
 
-  master_username                 = "foo"
-  master_password                 = "mustbeeightcharaters"
-  db_cluster_parameter_group_name = "default.docdb4.0"
-  storage_encrypted               = true
-  kms_key_id                      = aws_kms_key.foo.arn
-  skip_final_snapshot             = true
+  master_password     = "avoid-plaintext-passwords"
+  master_username     = "tfacctest"
+  storage_encrypted   = true
+  kms_key_id          = aws_kms_key.test.arn
+  skip_final_snapshot = true
 }
-`, n))
+`, rName))
 }
 
-func testAccClusterConfig_encrypted(n int) string {
+func testAccClusterConfig_encrypted(rName string) string {
 	return acctest.ConfigCompose(acctest.ConfigAvailableAZsNoOptIn(), fmt.Sprintf(`
-resource "aws_docdb_cluster" "default" {
-  cluster_identifier = "tf-docdb-cluster-%d"
+resource "aws_docdb_cluster" "test" {
+  cluster_identifier = %[1]q
 
   availability_zones = [
     data.aws_availability_zones.available.names[0],
@@ -1149,18 +1107,18 @@ resource "aws_docdb_cluster" "default" {
     data.aws_availability_zones.available.names[2]
   ]
 
-  master_username     = "foo"
-  master_password     = "mustbeeightcharaters"
+  master_password     = "avoid-plaintext-passwords"
+  master_username     = "tfacctest"
   storage_encrypted   = true
   skip_final_snapshot = true
 }
-`, n))
+`, rName))
 }
 
-func testAccClusterConfig_backups(n int) string {
+func testAccClusterConfig_backups(rName string) string {
 	return acctest.ConfigCompose(acctest.ConfigAvailableAZsNoOptIn(), fmt.Sprintf(`
-resource "aws_docdb_cluster" "default" {
-  cluster_identifier = "tf-docdb-cluster-%d"
+resource "aws_docdb_cluster" "test" {
+  cluster_identifier = %[1]q
 
   availability_zones = [
     data.aws_availability_zones.available.names[0],
@@ -1168,20 +1126,20 @@ resource "aws_docdb_cluster" "default" {
     data.aws_availability_zones.available.names[2]
   ]
 
-  master_username              = "foo"
-  master_password              = "mustbeeightcharaters"
+  master_password              = "avoid-plaintext-passwords"
+  master_username              = "tfacctest"
   backup_retention_period      = 5
   preferred_backup_window      = "07:00-09:00"
   preferred_maintenance_window = "tue:04:00-tue:04:30"
   skip_final_snapshot          = true
 }
-`, n))
+`, rName))
 }
 
-func testAccClusterConfig_backupsUpdate(n int) string {
+func testAccClusterConfig_backupsUpdate(rName string) string {
 	return acctest.ConfigCompose(acctest.ConfigAvailableAZsNoOptIn(), fmt.Sprintf(`
-resource "aws_docdb_cluster" "default" {
-  cluster_identifier = "tf-docdb-cluster-%d"
+resource "aws_docdb_cluster" "test" {
+  cluster_identifier = %[1]q
 
   availability_zones = [
     data.aws_availability_zones.available.names[0],
@@ -1189,18 +1147,18 @@ resource "aws_docdb_cluster" "default" {
     data.aws_availability_zones.available.names[2]
   ]
 
-  master_username              = "foo"
-  master_password              = "mustbeeightcharaters"
+  master_password              = "avoid-plaintext-passwords"
+  master_username              = "tfacctest"
   backup_retention_period      = 10
   preferred_backup_window      = "03:00-09:00"
   preferred_maintenance_window = "wed:01:00-wed:01:30"
   apply_immediately            = true
   skip_final_snapshot          = true
 }
-`, n))
+`, rName))
 }
 
-func testAccClusterConfig_port(rInt, port int) string {
+func testAccClusterConfig_port(rName string, port int) string {
 	return acctest.ConfigCompose(acctest.ConfigAvailableAZsNoOptIn(), fmt.Sprintf(`
 resource "aws_docdb_cluster" "test" {
   availability_zones = [
@@ -1209,25 +1167,183 @@ resource "aws_docdb_cluster" "test" {
     data.aws_availability_zones.available.names[2]
   ]
 
-  cluster_identifier              = "tf-acc-test-%d"
-  db_cluster_parameter_group_name = "default.docdb4.0"
-  engine                          = "docdb"
-  master_password                 = "mustbeeightcharaters"
-  master_username                 = "foo"
-  port                            = %d
-  skip_final_snapshot             = true
+  cluster_identifier  = %[1]q
+  engine              = "docdb"
+  master_password     = "avoid-plaintext-passwords"
+  master_username     = "tfacctest"
+  port                = %[2]d
+  skip_final_snapshot = true
+}
+`, rName, port))
+}
+
+func testAccClusterConfig_deleteProtection(rName string, isProtected bool) string {
+	return fmt.Sprintf(`
+resource "aws_docdb_cluster" "test" {
+  cluster_identifier  = %[1]q
+  master_username     = "tfacctest"
+  master_password     = "avoid-plaintext-passwords"
+  skip_final_snapshot = true
+  deletion_protection = %[2]t
+}
+`, rName, isProtected)
+}
+
+func testAccClusterConfig_globalIdentifier(rName string) string {
+	return fmt.Sprintf(`
+resource "aws_docdb_global_cluster" "test" {
+  engine_version            = "4.0.0" # version compatible
+  engine                    = "docdb"
+  global_cluster_identifier = %[1]q
+}
+
+resource "aws_docdb_cluster" "test" {
+  cluster_identifier        = %[1]q
+  global_cluster_identifier = aws_docdb_global_cluster.test.id
+  engine_version            = aws_docdb_global_cluster.test.engine_version
+  master_password           = "avoid-plaintext-passwords"
+  master_username           = "tfacctest"
+  skip_final_snapshot       = true
+}
+`, rName)
+}
+
+func testAccClusterConfig_globalCompatible(rName string) string {
+	return fmt.Sprintf(`
+resource "aws_docdb_cluster" "test" {
+  cluster_identifier  = %[1]q
+  engine_version      = "4.0.0" # version compatible with global
+  master_password     = "avoid-plaintext-passwords"
+  master_username     = "tfacctest"
+  skip_final_snapshot = true
 }
-`, rInt, port))
+`, rName)
 }
 
-func testAccClusterConfig_deleteProtection(isProtected bool) string {
+func testAccClusterConfig_globalIdentifierUpdate(rName, globalClusterIdentifierResourceName string) string {
 	return fmt.Sprintf(`
-resource "aws_docdb_cluster" "default" {
-  cluster_identifier_prefix = "tf-test-"
-  master_username           = "root"
-  master_password           = "password"
+resource "aws_docdb_global_cluster" "test" {
+  count                     = 2
+  engine                    = "docdb"
+  engine_version            = "4.0.0" # version compatible with global
+  global_cluster_identifier = "%[1]s-${count.index}"
+}
+
+resource "aws_docdb_cluster" "test" {
+  cluster_identifier        = %[1]q
+  global_cluster_identifier = %[2]s.id
+  engine_version            = %[2]s.engine_version
+  master_password           = "avoid-plaintext-passwords"
+  master_username           = "tfacctest"
   skip_final_snapshot       = true
-  deletion_protection       = %t
 }
-`, isProtected)
+`, rName, globalClusterIdentifierResourceName)
+}
+
+func testAccClusterConfig_globalIdentifierPrimarySecondary(rNameGlobal, rNamePrimary, rNameSecondary string) string {
+	return acctest.ConfigCompose(
+		acctest.ConfigMultipleRegionProvider(2),
+		fmt.Sprintf(`
+data "aws_availability_zones" "alternate" {
+  provider = "awsalternate"
+  state    = "available"
+
+  filter {
+    name   = "opt-in-status"
+    values = ["opt-in-not-required"]
+  }
+}
+
+resource "aws_docdb_global_cluster" "test" {
+  global_cluster_identifier = %[1]q
+  engine                    = "docdb"
+  engine_version            = "4.0.0"
+}
+
+resource "aws_docdb_cluster" "primary" {
+  cluster_identifier        = %[2]q
+  master_password           = "avoid-plaintext-passwords"
+  master_username           = "tfacctest"
+  skip_final_snapshot       = true
+  global_cluster_identifier = aws_docdb_global_cluster.test.id
+  engine                    = aws_docdb_global_cluster.test.engine
+  engine_version            = aws_docdb_global_cluster.test.engine_version
+}
+
+resource "aws_docdb_cluster_instance" "primary" {
+  identifier         = %[2]q
+  cluster_identifier = aws_docdb_cluster.primary.id
+  instance_class     = "db.r5.large"
+}
+
+resource "aws_vpc" "alternate" {
+  provider   = "awsalternate"
+  cidr_block = "10.0.0.0/16"
+
+  tags = {
+    Name = %[3]q
+  }
+}
+
+resource "aws_subnet" "alternate" {
+  provider          = "awsalternate"
+  count             = 3
+  vpc_id            = aws_vpc.alternate.id
+  availability_zone = data.aws_availability_zones.alternate.names[count.index]
+  cidr_block        = "10.0.${count.index}.0/24"
+
+  tags = {
+    Name = %[3]q
+  }
+}
+
+resource "aws_docdb_subnet_group" "alternate" {
+  provider   = "awsalternate"
+  name       = %[3]q
+  subnet_ids = aws_subnet.alternate[*].id
+}
+
+resource "aws_docdb_cluster" "secondary" {
+  provider                  = "awsalternate"
+  cluster_identifier        = %[3]q
+  skip_final_snapshot       = true
+  db_subnet_group_name      = aws_docdb_subnet_group.alternate.name
+  global_cluster_identifier = aws_docdb_global_cluster.test.id
+  engine                    = aws_docdb_global_cluster.test.engine
+  engine_version            = aws_docdb_global_cluster.test.engine_version
+  depends_on                = [aws_docdb_cluster_instance.primary]
+}
+
+resource "aws_docdb_cluster_instance" "secondary" {
+  provider           = "awsalternate"
+  identifier         = %[3]q
+  cluster_identifier = aws_docdb_cluster.secondary.id
+  instance_class     = "db.r5.large"
+}
+`, rNameGlobal, rNamePrimary, rNameSecondary))
+}
+
+func testAccClusterConfig_engineVersion(rName, engineVersion string) string {
+	return fmt.Sprintf(`
+resource "aws_docdb_cluster" "test" {
+  cluster_identifier          = %[1]q
+  engine_version              = %[2]q
+  master_password             = "avoid-plaintext-passwords"
+  master_username             = "tfacctest"
+  skip_final_snapshot         = true
+  apply_immediately           = true
+  allow_major_version_upgrade = true
+}
+
+data "aws_docdb_orderable_db_instance" "test" {
+  engine                     = aws_docdb_cluster.test.engine
+  preferred_instance_classes = ["db.t3.medium", "db.4tg.medium", "db.r5.large", "db.r6g.large"]
+}
+
+resource "aws_docdb_cluster_instance" "test" {
+  identifier         = %[1]q
+  cluster_identifier = aws_docdb_cluster.test.id
+  instance_class     = data.aws_docdb_orderable_db_instance.test.instance_class
+}
+`, rName, engineVersion)
 }
diff --git a/internal/service/docdb/consts.go b/internal/service/docdb/consts.go
index fc573cd750f..3b4099b476e 100644
--- a/internal/service/docdb/consts.go
+++ b/internal/service/docdb/consts.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package docdb
 
 import (
@@ -7,3 +10,17 @@ import (
 const (
 	propagationTimeout = 2 * time.Minute
 )
+
+const (
+	engineDocDB = "docdb" // nosemgrep:ci.docdb-in-const-name,ci.docdb-in-var-name
+)
+
+func engine_Values() []string {
+	return []string{
+		engineDocDB,
+	}
+}
+
+const (
+	errCodeInvalidParameterValue = "InvalidParameterValue"
+)
diff --git a/internal/service/docdb/engine_version_data_source.go b/internal/service/docdb/engine_version_data_source.go
index 63c9066730c..56bbb430501 100644
--- a/internal/service/docdb/engine_version_data_source.go
+++ b/internal/service/docdb/engine_version_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package docdb
 
 import (
diff --git a/internal/service/docdb/engine_version_data_source_test.go b/internal/service/docdb/engine_version_data_source_test.go
index a4ae85e4af0..30a09e3bc19 100644
--- a/internal/service/docdb/engine_version_data_source_test.go
+++ b/internal/service/docdb/engine_version_data_source_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package docdb_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/docdb"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -32,7 +35,7 @@ func TestAccDocDBEngineVersionDataSource_basic(t *testing.T) {
 					resource.TestCheckResourceAttr(dataSourceName, "version", version),
 
 					resource.TestCheckResourceAttrSet(dataSourceName, "engine_description"),
-					resource.TestMatchResourceAttr(dataSourceName, "exportable_log_types.#", regexp.MustCompile(`^[1-9][0-9]*`)),
+					resource.TestMatchResourceAttr(dataSourceName, "exportable_log_types.#", regexache.MustCompile(`^[1-9][0-9]*`)),
 					resource.TestCheckResourceAttrSet(dataSourceName, "parameter_group_family"),
 					resource.TestCheckResourceAttrSet(dataSourceName, "supports_log_exports_to_cloudwatch"),
 					resource.TestCheckResourceAttrSet(dataSourceName, "version_description"),
diff --git a/internal/service/docdb/event_subscription.go b/internal/service/docdb/event_subscription.go
index 686406e4662..98e009e5205 100644
--- a/internal/service/docdb/event_subscription.go
+++ b/internal/service/docdb/event_subscription.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package docdb
 
 import (
diff --git a/internal/service/docdb/event_subscription_test.go b/internal/service/docdb/event_subscription_test.go
index 214b1402754..a015dc93c85 100644
--- a/internal/service/docdb/event_subscription_test.go
+++ b/internal/service/docdb/event_subscription_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package docdb_test
 
 import (
diff --git a/internal/service/docdb/find.go b/internal/service/docdb/find.go
index ff186887534..c7fe5849847 100644
--- a/internal/service/docdb/find.go
+++ b/internal/service/docdb/find.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package docdb
 
 import (
@@ -59,35 +62,6 @@ func findGlobalClusterIDByARN(ctx context.Context, conn *docdb.DocDB, arn string
 	return ""
 }
 
-func FindDBClusterById(ctx context.Context, conn *docdb.DocDB, dBClusterID string) (*docdb.DBCluster, error) {
-	var dBCluster *docdb.DBCluster
-
-	input := &docdb.DescribeDBClustersInput{
-		DBClusterIdentifier: aws.String(dBClusterID),
-	}
-
-	err := conn.DescribeDBClustersPagesWithContext(ctx, input, func(page *docdb.DescribeDBClustersOutput, lastPage bool) bool {
-		if page == nil {
-			return !lastPage
-		}
-
-		for _, dbc := range page.DBClusters {
-			if dbc == nil {
-				continue
-			}
-
-			if aws.StringValue(dbc.DBClusterIdentifier) == dBClusterID {
-				dBCluster = dbc
-				return false
-			}
-		}
-
-		return !lastPage
-	})
-
-	return dBCluster, err
-}
-
 func FindDBClusterSnapshotById(ctx context.Context, conn *docdb.DocDB, dBClusterSnapshotID string) (*docdb.DBClusterSnapshot, error) {
 	var dBClusterSnapshot *docdb.DBClusterSnapshot
 
@@ -117,35 +91,6 @@ func FindDBClusterSnapshotById(ctx context.Context, conn *docdb.DocDB, dBCluster
 	return dBClusterSnapshot, err
 }
 
-func FindDBInstanceById(ctx context.Context, conn *docdb.DocDB, dBInstanceID string) (*docdb.DBInstance, error) {
-	var dBInstance *docdb.DBInstance
-
-	input := &docdb.DescribeDBInstancesInput{
-		DBInstanceIdentifier: aws.String(dBInstanceID),
-	}
-
-	err := conn.DescribeDBInstancesPagesWithContext(ctx, input, func(page *docdb.DescribeDBInstancesOutput, lastPage bool) bool {
-		if page == nil {
-			return !lastPage
-		}
-
-		for _, dbi := range page.DBInstances {
-			if dbi == nil {
-				continue
-			}
-
-			if aws.StringValue(dbi.DBInstanceIdentifier) == dBInstanceID {
-				dBInstance = dbi
-				return false
-			}
-		}
-
-		return !lastPage
-	})
-
-	return dBInstance, err
-}
-
 func FindGlobalClusterById(ctx context.Context, conn *docdb.DocDB, globalClusterID string) (*docdb.GlobalCluster, error) {
 	var globalCluster *docdb.GlobalCluster
 
@@ -175,35 +120,6 @@ func FindGlobalClusterById(ctx context.Context, conn *docdb.DocDB, globalCluster
 	return globalCluster, err
 }
 
-func FindDBSubnetGroupByName(ctx context.Context, conn *docdb.DocDB, dBSubnetGroupName string) (*docdb.DBSubnetGroup, error) {
-	var dBSubnetGroup *docdb.DBSubnetGroup
-
-	input := &docdb.DescribeDBSubnetGroupsInput{
-		DBSubnetGroupName: aws.String(dBSubnetGroupName),
-	}
-
-	err := conn.DescribeDBSubnetGroupsPagesWithContext(ctx, input, func(page *docdb.DescribeDBSubnetGroupsOutput, lastPage bool) bool {
-		if page == nil {
-			return !lastPage
-		}
-
-		for _, sg := range page.DBSubnetGroups {
-			if sg == nil {
-				continue
-			}
-
-			if aws.StringValue(sg.DBSubnetGroupName) == dBSubnetGroupName {
-				dBSubnetGroup = sg
-				return false
-			}
-		}
-
-		return !lastPage
-	})
-
-	return dBSubnetGroup, err
-}
-
 func FindEventSubscriptionByID(ctx context.Context, conn *docdb.DocDB, id string) (*docdb.EventSubscription, error) {
 	var eventSubscription *docdb.EventSubscription
 
diff --git a/internal/service/docdb/flex.go b/internal/service/docdb/flex.go
index ed9a624b0ef..d2d65cc715e 100644
--- a/internal/service/docdb/flex.go
+++ b/internal/service/docdb/flex.go
@@ -1,9 +1,12 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package docdb
 
 import (
 	"fmt"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/docdb"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
@@ -63,7 +66,7 @@ func flattenParameters(list []*docdb.Parameter, parameterList []interface{}) []m
 
 func validEventSubscriptionName(v interface{}, k string) (ws []string, errors []error) {
 	value := v.(string)
-	if !regexp.MustCompile(`^[0-9A-Za-z-]+$`).MatchString(value) {
+	if !regexache.MustCompile(`^[0-9A-Za-z-]+$`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"only alphanumeric characters and hyphens allowed in %q", k))
 	}
@@ -76,7 +79,7 @@ func validEventSubscriptionName(v interface{}, k string) (ws []string, errors []
 
 func validEventSubscriptionNamePrefix(v interface{}, k string) (ws []string, errors []error) {
 	value := v.(string)
-	if !regexp.MustCompile(`^[0-9A-Za-z-]+$`).MatchString(value) {
+	if !regexache.MustCompile(`^[0-9A-Za-z-]+$`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"only alphanumeric characters and hyphens allowed in %q", k))
 	}
diff --git a/internal/service/docdb/generate.go b/internal/service/docdb/generate.go
index 31309047495..6820d934fa4 100644
--- a/internal/service/docdb/generate.go
+++ b/internal/service/docdb/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTags -ListTagsInIDElem=ResourceName -ListTagsOutTagsElem=TagList -ServiceTagsSlice -TagOp=AddTagsToResource -TagInIDElem=ResourceName -UntagOp=RemoveTagsFromResource -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/docdb/global_cluster.go b/internal/service/docdb/global_cluster.go
index 3a649bec7e1..d64be95ff9a 100644
--- a/internal/service/docdb/global_cluster.go
+++ b/internal/service/docdb/global_cluster.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package docdb
 
 import (
@@ -12,6 +15,7 @@ import (
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
@@ -57,7 +61,7 @@ func ResourceGlobalCluster() *schema.Resource {
 				ForceNew:      true,
 				AtLeastOneOf:  []string{"engine", "source_db_cluster_identifier"},
 				ConflictsWith: []string{"source_db_cluster_identifier"},
-				ValidateFunc:  validEngine(),
+				ValidateFunc:  validation.StringInSlice(engine_Values(), false),
 			},
 			"engine_version": {
 				Type:     schema.TypeString,
@@ -336,8 +340,7 @@ func resourceGlobalClusterUpgradeEngineVersion(ctx context.Context, d *schema.Re
 		return err
 	}
 	for _, clusterMember := range globalCluster.GlobalClusterMembers {
-		err := waitForClusterUpdate(ctx, conn, findGlobalClusterIDByARN(ctx, conn, aws.StringValue(clusterMember.DBClusterArn)), d.Timeout(schema.TimeoutUpdate))
-		if err != nil {
+		if _, err := waitDBClusterUpdated(ctx, conn, findGlobalClusterIDByARN(ctx, conn, aws.StringValue(clusterMember.DBClusterArn)), d.Timeout(schema.TimeoutUpdate)); err != nil {
 			return err
 		}
 	}
diff --git a/internal/service/docdb/global_cluster_test.go b/internal/service/docdb/global_cluster_test.go
index d225dfbbcfd..550564d550a 100644
--- a/internal/service/docdb/global_cluster_test.go
+++ b/internal/service/docdb/global_cluster_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package docdb_test
 
 import (
 	"context"
 	"errors"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/docdb"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -42,7 +45,7 @@ func TestAccDocDBGlobalCluster_basic(t *testing.T) {
 					resource.TestCheckResourceAttrSet(resourceName, "engine"),
 					resource.TestCheckResourceAttrSet(resourceName, "engine_version"),
 					resource.TestCheckResourceAttr(resourceName, "global_cluster_identifier", rName),
-					resource.TestMatchResourceAttr(resourceName, "global_cluster_resource_id", regexp.MustCompile(`cluster-.+`)),
+					resource.TestMatchResourceAttr(resourceName, "global_cluster_resource_id", regexache.MustCompile(`cluster-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "storage_encrypted", "false"),
 				),
 			},
diff --git a/internal/service/docdb/orderable_db_instance_data_source.go b/internal/service/docdb/orderable_db_instance_data_source.go
index c8d18927e07..91395002cd7 100644
--- a/internal/service/docdb/orderable_db_instance_data_source.go
+++ b/internal/service/docdb/orderable_db_instance_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package docdb
 
 import (
diff --git a/internal/service/docdb/orderable_db_instance_data_source_test.go b/internal/service/docdb/orderable_db_instance_data_source_test.go
index ba1585c6764..f5e4088871a 100644
--- a/internal/service/docdb/orderable_db_instance_data_source_test.go
+++ b/internal/service/docdb/orderable_db_instance_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package docdb_test
 
 import (
diff --git a/internal/service/docdb/service_package_gen.go b/internal/service/docdb/service_package_gen.go
index 91a06beab17..b7f3ec3f39a 100644
--- a/internal/service/docdb/service_package_gen.go
+++ b/internal/service/docdb/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	docdb_sdkv1 "github.com/aws/aws-sdk-go/service/docdb"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -99,4 +100,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*d
 	return docdb_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/docdb/status.go b/internal/service/docdb/status.go
index 4339116d333..1a268bd3b86 100644
--- a/internal/service/docdb/status.go
+++ b/internal/service/docdb/status.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package docdb
 
 import (
@@ -27,22 +30,6 @@ func statusGlobalClusterRefreshFunc(ctx context.Context, conn *docdb.DocDB, glob
 	}
 }
 
-func statusDBClusterRefreshFunc(ctx context.Context, conn *docdb.DocDB, dBClusterID string) retry.StateRefreshFunc {
-	return func() (interface{}, string, error) {
-		dBCluster, err := FindDBClusterById(ctx, conn, dBClusterID)
-
-		if tfawserr.ErrCodeEquals(err, docdb.ErrCodeDBClusterNotFoundFault) || dBCluster == nil {
-			return nil, DBClusterStatusDeleted, nil
-		}
-
-		if err != nil {
-			return nil, "", fmt.Errorf("reading DocumentDB Cluster (%s): %w", dBClusterID, err)
-		}
-
-		return dBCluster, aws.StringValue(dBCluster.Status), nil
-	}
-}
-
 func statusDBClusterSnapshotRefreshFunc(ctx context.Context, conn *docdb.DocDB, dBClusterSnapshotID string) retry.StateRefreshFunc {
 	return func() (interface{}, string, error) {
 		dBClusterSnapshot, err := FindDBClusterSnapshotById(ctx, conn, dBClusterSnapshotID)
@@ -59,38 +46,6 @@ func statusDBClusterSnapshotRefreshFunc(ctx context.Context, conn *docdb.DocDB,
 	}
 }
 
-func statusDBInstanceRefreshFunc(ctx context.Context, conn *docdb.DocDB, dBInstanceID string) retry.StateRefreshFunc {
-	return func() (interface{}, string, error) {
-		dBInstance, err := FindDBInstanceById(ctx, conn, dBInstanceID)
-
-		if tfawserr.ErrCodeEquals(err, docdb.ErrCodeDBInstanceNotFoundFault) || dBInstance == nil {
-			return nil, DBInstanceStatusDeleted, nil
-		}
-
-		if err != nil {
-			return nil, "", fmt.Errorf("reading DocumentDB Instance (%s): %w", dBInstanceID, err)
-		}
-
-		return dBInstance, aws.StringValue(dBInstance.DBInstanceStatus), nil
-	}
-}
-
-func statusDBSubnetGroupRefreshFunc(ctx context.Context, conn *docdb.DocDB, dBSubnetGroupName string) retry.StateRefreshFunc {
-	return func() (interface{}, string, error) {
-		dBSubnetGroup, err := FindDBSubnetGroupByName(ctx, conn, dBSubnetGroupName)
-
-		if tfawserr.ErrCodeEquals(err, docdb.ErrCodeDBSubnetGroupNotFoundFault) || dBSubnetGroup == nil {
-			return nil, DBSubnetGroupStatusDeleted, nil
-		}
-
-		if err != nil {
-			return nil, "", fmt.Errorf("reading DocumentDB Subnet Group (%s): %w", dBSubnetGroupName, err)
-		}
-
-		return dBSubnetGroup, aws.StringValue(dBSubnetGroup.SubnetGroupStatus), nil
-	}
-}
-
 func statusEventSubscription(ctx context.Context, conn *docdb.DocDB, id string) retry.StateRefreshFunc {
 	return func() (interface{}, string, error) {
 		output, err := FindEventSubscriptionByID(ctx, conn, id)
diff --git a/internal/service/docdb/subnet_group.go b/internal/service/docdb/subnet_group.go
index c7a1f4f3de3..6970e2c9179 100644
--- a/internal/service/docdb/subnet_group.go
+++ b/internal/service/docdb/subnet_group.go
@@ -1,8 +1,10 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package docdb
 
 import (
 	"context"
-	"fmt"
 	"log"
 	"time"
 
@@ -10,10 +12,10 @@ import (
 	"github.com/aws/aws-sdk-go/service/docdb"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/create"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
 	"github.com/hashicorp/terraform-provider-aws/internal/flex"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
@@ -30,6 +32,7 @@ func ResourceSubnetGroup() *schema.Resource {
 		ReadWithoutTimeout:   resourceSubnetGroupRead,
 		UpdateWithoutTimeout: resourceSubnetGroupUpdate,
 		DeleteWithoutTimeout: resourceSubnetGroupDelete,
+
 		Importer: &schema.ResourceImporter{
 			StateContext: schema.ImportStatePassthroughContext,
 		},
@@ -39,7 +42,11 @@ func ResourceSubnetGroup() *schema.Resource {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
-
+			"description": {
+				Type:     schema.TypeString,
+				Optional: true,
+				Default:  "Managed by Terraform",
+			},
 			"name": {
 				Type:          schema.TypeString,
 				Optional:      true,
@@ -56,21 +63,12 @@ func ResourceSubnetGroup() *schema.Resource {
 				ConflictsWith: []string{"name"},
 				ValidateFunc:  validSubnetGroupNamePrefix,
 			},
-
-			"description": {
-				Type:     schema.TypeString,
-				Optional: true,
-				Default:  "Managed by Terraform",
-			},
-
 			"subnet_ids": {
 				Type:     schema.TypeSet,
 				Required: true,
 				MinItems: 1,
 				Elem:     &schema.Schema{Type: schema.TypeString},
-				Set:      schema.HashString,
 			},
-
 			names.AttrTags:    tftags.TagsSchema(),
 			names.AttrTagsAll: tftags.TagsSchemaComputed(),
 		},
@@ -83,30 +81,21 @@ func resourceSubnetGroupCreate(ctx context.Context, d *schema.ResourceData, meta
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).DocDBConn(ctx)
 
-	subnetIds := flex.ExpandStringSet(d.Get("subnet_ids").(*schema.Set))
-
-	var groupName string
-	if v, ok := d.GetOk("name"); ok {
-		groupName = v.(string)
-	} else if v, ok := d.GetOk("name_prefix"); ok {
-		groupName = id.PrefixedUniqueId(v.(string))
-	} else {
-		groupName = id.UniqueId()
-	}
-
-	input := docdb.CreateDBSubnetGroupInput{
-		DBSubnetGroupName:        aws.String(groupName),
+	name := create.Name(d.Get("name").(string), d.Get("name_prefix").(string))
+	input := &docdb.CreateDBSubnetGroupInput{
 		DBSubnetGroupDescription: aws.String(d.Get("description").(string)),
-		SubnetIds:                subnetIds,
+		DBSubnetGroupName:        aws.String(name),
+		SubnetIds:                flex.ExpandStringSet(d.Get("subnet_ids").(*schema.Set)),
 		Tags:                     getTagsIn(ctx),
 	}
 
-	_, err := conn.CreateDBSubnetGroupWithContext(ctx, &input)
+	_, err := conn.CreateDBSubnetGroupWithContext(ctx, input)
+
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "creating DocumentDB Subnet Group: %s", err)
+		return sdkdiag.AppendErrorf(diags, "creating DocumentDB Subnet Group (%s): %s", name, err)
 	}
 
-	d.SetId(groupName)
+	d.SetId(name)
 
 	return append(diags, resourceSubnetGroupRead(ctx, d, meta)...)
 }
@@ -115,41 +104,27 @@ func resourceSubnetGroupRead(ctx context.Context, d *schema.ResourceData, meta i
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).DocDBConn(ctx)
 
-	describeOpts := docdb.DescribeDBSubnetGroupsInput{
-		DBSubnetGroupName: aws.String(d.Id()),
-	}
+	subnetGroup, err := FindDBSubnetGroupByName(ctx, conn, d.Id())
 
-	var subnetGroups []*docdb.DBSubnetGroup
-	if err := conn.DescribeDBSubnetGroupsPagesWithContext(ctx, &describeOpts, func(resp *docdb.DescribeDBSubnetGroupsOutput, lastPage bool) bool {
-		subnetGroups = append(subnetGroups, resp.DBSubnetGroups...)
-		return !lastPage
-	}); err != nil {
-		if !d.IsNewResource() && tfawserr.ErrCodeEquals(err, docdb.ErrCodeDBSubnetGroupNotFoundFault) {
-			log.Printf("[WARN] DocumentDB Subnet Group (%s) not found, removing from state", d.Id())
-			d.SetId("")
-			return diags
-		}
-		return sdkdiag.AppendErrorf(diags, "reading DocumentDB Subnet Group (%s) parameters: %s", d.Id(), err)
-	}
-
-	if !d.IsNewResource() && (len(subnetGroups) != 1 || aws.StringValue(subnetGroups[0].DBSubnetGroupName) != d.Id()) {
+	if !d.IsNewResource() && tfresource.NotFound(err) {
 		log.Printf("[WARN] DocumentDB Subnet Group (%s) not found, removing from state", d.Id())
 		d.SetId("")
 		return diags
 	}
 
-	subnetGroup := subnetGroups[0]
-	d.Set("name", subnetGroup.DBSubnetGroupName)
-	d.Set("description", subnetGroup.DBSubnetGroupDescription)
-	d.Set("arn", subnetGroup.DBSubnetGroupArn)
-
-	subnets := make([]string, 0, len(subnetGroup.Subnets))
-	for _, s := range subnetGroup.Subnets {
-		subnets = append(subnets, aws.StringValue(s.SubnetIdentifier))
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "reading DocumentDB Subnet Group (%s): %s", d.Id(), err)
 	}
-	if err := d.Set("subnet_ids", subnets); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting subnet_ids: %s", err)
+
+	d.Set("arn", subnetGroup.DBSubnetGroupArn)
+	d.Set("description", subnetGroup.DBSubnetGroupDescription)
+	d.Set("name", subnetGroup.DBSubnetGroupName)
+	d.Set("name_prefix", create.NamePrefixFromName(aws.StringValue(subnetGroup.DBSubnetGroupName)))
+	var subnetIDs []string
+	for _, v := range subnetGroup.Subnets {
+		subnetIDs = append(subnetIDs, aws.StringValue(v.SubnetIdentifier))
 	}
+	d.Set("subnet_ids", subnetIDs)
 
 	return diags
 }
@@ -158,21 +133,17 @@ func resourceSubnetGroupUpdate(ctx context.Context, d *schema.ResourceData, meta
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).DocDBConn(ctx)
 
-	if d.HasChanges("subnet_ids", "description") {
-		_, n := d.GetChange("subnet_ids")
-		if n == nil {
-			n = new(schema.Set)
-		}
-		sIds := flex.ExpandStringSet(n.(*schema.Set))
-
-		_, err := conn.ModifyDBSubnetGroupWithContext(ctx, &docdb.ModifyDBSubnetGroupInput{
+	if d.HasChanges("description", "subnet_ids") {
+		input := &docdb.ModifyDBSubnetGroupInput{
 			DBSubnetGroupName:        aws.String(d.Id()),
 			DBSubnetGroupDescription: aws.String(d.Get("description").(string)),
-			SubnetIds:                sIds,
-		})
+			SubnetIds:                flex.ExpandStringSet(d.Get("subnet_ids").(*schema.Set)),
+		}
+
+		_, err := conn.ModifyDBSubnetGroupWithContext(ctx, input)
 
 		if err != nil {
-			return sdkdiag.AppendErrorf(diags, "modifying DocumentDB Subnet Group (%s) parameters: %s", d.Id(), err)
+			return sdkdiag.AppendErrorf(diags, "modifying DocumentDB Subnet Group (%s): %s", d.Id(), err)
 		}
 	}
 
@@ -183,52 +154,87 @@ func resourceSubnetGroupDelete(ctx context.Context, d *schema.ResourceData, meta
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).DocDBConn(ctx)
 
-	delOpts := docdb.DeleteDBSubnetGroupInput{
+	log.Printf("[DEBUG] Deleting DocumentDB Subnet Group: %s", d.Id())
+	_, err := conn.DeleteDBSubnetGroupWithContext(ctx, &docdb.DeleteDBSubnetGroupInput{
 		DBSubnetGroupName: aws.String(d.Id()),
-	}
+	})
 
-	log.Printf("[DEBUG] Deleting DocumentDB Subnet Group: %s", d.Id())
+	if tfawserr.ErrCodeEquals(err, docdb.ErrCodeDBSubnetGroupNotFoundFault) {
+		return diags
+	}
 
-	_, err := conn.DeleteDBSubnetGroupWithContext(ctx, &delOpts)
 	if err != nil {
-		if tfawserr.ErrCodeEquals(err, docdb.ErrCodeDBSubnetGroupNotFoundFault) {
-			return diags
-		}
 		return sdkdiag.AppendErrorf(diags, "deleting DocumentDB Subnet Group (%s): %s", d.Id(), err)
 	}
 
-	if err := WaitForSubnetGroupDeletion(ctx, conn, d.Id()); err != nil {
-		return sdkdiag.AppendErrorf(diags, "deleting DocumentDB Subnet Group (%s): %s", d.Id(), err)
+	_, err = tfresource.RetryUntilNotFound(ctx, 10*time.Minute, func() (interface{}, error) {
+		return FindDBSubnetGroupByName(ctx, conn, d.Id())
+	})
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "waiting for DocumentDB Subnet Group (%s) delete: %s", d.Id(), err)
 	}
+
 	return diags
 }
 
-func WaitForSubnetGroupDeletion(ctx context.Context, conn *docdb.DocDB, name string) error {
-	params := &docdb.DescribeDBSubnetGroupsInput{
+func FindDBSubnetGroupByName(ctx context.Context, conn *docdb.DocDB, name string) (*docdb.DBSubnetGroup, error) {
+	input := &docdb.DescribeDBSubnetGroupsInput{
 		DBSubnetGroupName: aws.String(name),
 	}
+	output, err := findDBSubnetGroup(ctx, conn, input)
 
-	err := retry.RetryContext(ctx, 10*time.Minute, func() *retry.RetryError {
-		_, err := conn.DescribeDBSubnetGroupsWithContext(ctx, params)
+	if err != nil {
+		return nil, err
+	}
 
-		if tfawserr.ErrCodeEquals(err, docdb.ErrCodeDBSubnetGroupNotFoundFault) {
-			return nil
+	// Eventual consistency check.
+	if aws.StringValue(output.DBSubnetGroupName) != name {
+		return nil, &retry.NotFoundError{
+			LastRequest: input,
 		}
+	}
 
-		if err != nil {
-			return retry.NonRetryableError(err)
+	return output, nil
+}
+
+func findDBSubnetGroup(ctx context.Context, conn *docdb.DocDB, input *docdb.DescribeDBSubnetGroupsInput) (*docdb.DBSubnetGroup, error) {
+	output, err := findDBSubnetGroups(ctx, conn, input)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return tfresource.AssertSinglePtrResult(output)
+}
+
+func findDBSubnetGroups(ctx context.Context, conn *docdb.DocDB, input *docdb.DescribeDBSubnetGroupsInput) ([]*docdb.DBSubnetGroup, error) {
+	var output []*docdb.DBSubnetGroup
+
+	err := conn.DescribeDBSubnetGroupsPagesWithContext(ctx, input, func(page *docdb.DescribeDBSubnetGroupsOutput, lastPage bool) bool {
+		if page == nil {
+			return !lastPage
+		}
+
+		for _, v := range page.DBSubnetGroups {
+			if v != nil {
+				output = append(output, v)
+			}
 		}
 
-		return retry.RetryableError(fmt.Errorf("DocumentDB Subnet Group (%s) still exists", name))
+		return !lastPage
 	})
-	if tfresource.TimedOut(err) {
-		_, err = conn.DescribeDBSubnetGroupsWithContext(ctx, params)
-		if tfawserr.ErrCodeEquals(err, docdb.ErrCodeDBSubnetGroupNotFoundFault) {
-			return nil
+
+	if tfawserr.ErrCodeEquals(err, docdb.ErrCodeDBSubnetGroupNotFoundFault) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
 		}
 	}
+
 	if err != nil {
-		return fmt.Errorf("deleting DocumentDB subnet group: %s", err)
+		return nil, err
 	}
-	return nil
+
+	return output, nil
 }
diff --git a/internal/service/docdb/subnet_group_test.go b/internal/service/docdb/subnet_group_test.go
index 3807dec589a..63092271f9f 100644
--- a/internal/service/docdb/subnet_group_test.go
+++ b/internal/service/docdb/subnet_group_test.go
@@ -1,27 +1,29 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package docdb_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/docdb"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	tfdocdb "github.com/hashicorp/terraform-provider-aws/internal/service/docdb"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
 func TestAccDocDBSubnetGroup_basic(t *testing.T) {
 	ctx := acctest.Context(t)
 	var v docdb.DBSubnetGroup
-
-	rName := fmt.Sprintf("tf-test-%d", sdkacctest.RandInt())
+	resourceName := "aws_docdb_subnet_group.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
@@ -31,16 +33,17 @@ func TestAccDocDBSubnetGroup_basic(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config: testAccSubnetGroupConfig_basic(rName),
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckSubnetGroupExists(ctx, "aws_docdb_subnet_group.foo", &v),
-					resource.TestCheckResourceAttr(
-						"aws_docdb_subnet_group.foo", "name", rName),
-					resource.TestCheckResourceAttr(
-						"aws_docdb_subnet_group.foo", "description", "Managed by Terraform"),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckSubnetGroupExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttrSet(resourceName, "arn"),
+					resource.TestCheckResourceAttr(resourceName, "description", "Managed by Terraform"),
+					resource.TestCheckResourceAttr(resourceName, "name", rName),
+					resource.TestCheckResourceAttr(resourceName, "subnet_ids.#", "2"),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 				),
 			},
 			{
-				ResourceName:      "aws_docdb_subnet_group.foo",
+				ResourceName:      resourceName,
 				ImportState:       true,
 				ImportStateVerify: true,
 			},
@@ -51,8 +54,8 @@ func TestAccDocDBSubnetGroup_basic(t *testing.T) {
 func TestAccDocDBSubnetGroup_disappears(t *testing.T) {
 	ctx := acctest.Context(t)
 	var v docdb.DBSubnetGroup
-
-	rName := fmt.Sprintf("tf-test-%d", sdkacctest.RandInt())
+	resourceName := "aws_docdb_subnet_group.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
@@ -63,8 +66,8 @@ func TestAccDocDBSubnetGroup_disappears(t *testing.T) {
 			{
 				Config: testAccSubnetGroupConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckSubnetGroupExists(ctx, "aws_docdb_subnet_group.foo", &v),
-					testAccCheckSubnetGroupDisappears(ctx, &v),
+					testAccCheckSubnetGroupExists(ctx, resourceName, &v),
+					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfdocdb.ResourceSubnetGroup(), resourceName),
 				),
 				ExpectNonEmptyPlan: true,
 			},
@@ -72,9 +75,11 @@ func TestAccDocDBSubnetGroup_disappears(t *testing.T) {
 	})
 }
 
-func TestAccDocDBSubnetGroup_namePrefix(t *testing.T) {
+func TestAccDocDBSubnetGroup_nameGenerated(t *testing.T) {
 	ctx := acctest.Context(t)
 	var v docdb.DBSubnetGroup
+	resourceName := "aws_docdb_subnet_group.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
@@ -83,26 +88,27 @@ func TestAccDocDBSubnetGroup_namePrefix(t *testing.T) {
 		CheckDestroy:             testAccCheckSubnetGroupDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccSubnetGroupConfig_namePrefix(),
+				Config: testAccSubnetGroupConfig_nameGenerated(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckSubnetGroupExists(ctx, "aws_docdb_subnet_group.test", &v),
-					resource.TestMatchResourceAttr(
-						"aws_docdb_subnet_group.test", "name", regexp.MustCompile("^tf_test-")),
+					testAccCheckSubnetGroupExists(ctx, resourceName, &v),
+					acctest.CheckResourceAttrNameGenerated(resourceName, "name"),
+					resource.TestCheckResourceAttr(resourceName, "name_prefix", id.UniqueIdPrefix),
 				),
 			},
 			{
-				ResourceName:            "aws_docdb_subnet_group.test",
-				ImportState:             true,
-				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"name_prefix"},
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
 			},
 		},
 	})
 }
 
-func TestAccDocDBSubnetGroup_generatedName(t *testing.T) {
+func TestAccDocDBSubnetGroup_namePrefix(t *testing.T) {
 	ctx := acctest.Context(t)
 	var v docdb.DBSubnetGroup
+	resourceName := "aws_docdb_subnet_group.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
@@ -111,13 +117,15 @@ func TestAccDocDBSubnetGroup_generatedName(t *testing.T) {
 		CheckDestroy:             testAccCheckSubnetGroupDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccSubnetGroupConfig_generatedName(),
+				Config: testAccSubnetGroupConfig_namePrefix(rName, "tf-acc-test-prefix-"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckSubnetGroupExists(ctx, "aws_docdb_subnet_group.test", &v),
+					testAccCheckSubnetGroupExists(ctx, resourceName, &v),
+					acctest.CheckResourceAttrNameFromPrefix(resourceName, "name", "tf-acc-test-prefix-"),
+					resource.TestCheckResourceAttr(resourceName, "name_prefix", "tf-acc-test-prefix-"),
 				),
 			},
 			{
-				ResourceName:      "aws_docdb_subnet_group.test",
+				ResourceName:      resourceName,
 				ImportState:       true,
 				ImportStateVerify: true,
 			},
@@ -128,8 +136,43 @@ func TestAccDocDBSubnetGroup_generatedName(t *testing.T) {
 func TestAccDocDBSubnetGroup_updateDescription(t *testing.T) {
 	ctx := acctest.Context(t)
 	var v docdb.DBSubnetGroup
+	resourceName := "aws_docdb_subnet_group.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
-	rName := fmt.Sprintf("tf-test-%d", sdkacctest.RandInt())
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, docdb.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckSubnetGroupDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccSubnetGroupConfig_description(rName, "desc1"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckSubnetGroupExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "description", "desc1"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				Config: testAccSubnetGroupConfig_description(rName, "desc2"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckSubnetGroupExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "description", "desc2"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccDocDBSubnetGroup_updateSubnets(t *testing.T) {
+	ctx := acctest.Context(t)
+	var v docdb.DBSubnetGroup
+	resourceName := "aws_docdb_subnet_group.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
@@ -137,28 +180,71 @@ func TestAccDocDBSubnetGroup_updateDescription(t *testing.T) {
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckSubnetGroupDestroy(ctx),
 		Steps: []resource.TestStep{
+			{
+				Config: testAccSubnetGroupConfig_3subnets(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckSubnetGroupExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "subnet_ids.#", "3"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
 			{
 				Config: testAccSubnetGroupConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckSubnetGroupExists(ctx, "aws_docdb_subnet_group.foo", &v),
-					resource.TestCheckResourceAttr(
-						"aws_docdb_subnet_group.foo", "description", "Managed by Terraform"),
+					testAccCheckSubnetGroupExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "subnet_ids.#", "2"),
 				),
 			},
+		},
+	})
+}
+
+func TestAccDocDBSubnetGroup_tags(t *testing.T) {
+	ctx := acctest.Context(t)
+	var v docdb.DBSubnetGroup
+	resourceName := "aws_docdb_subnet_group.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, docdb.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckSubnetGroupDestroy(ctx),
+		Steps: []resource.TestStep{
 			{
-				Config: testAccSubnetGroupConfig_updatedDescription(rName),
+				Config: testAccSubnetGroupConfig_tags1(rName, "key1", "value1"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckSubnetGroupExists(ctx, "aws_docdb_subnet_group.foo", &v),
-					resource.TestCheckResourceAttr(
-						"aws_docdb_subnet_group.foo", "description", "foo description updated"),
+					testAccCheckSubnetGroupExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
 				),
 			},
 			{
-				ResourceName:      "aws_docdb_subnet_group.foo",
+				ResourceName:      resourceName,
 				ImportState:       true,
 				ImportStateVerify: true,
 			},
+			{
+				Config: testAccSubnetGroupConfig_tags2(rName, "key1", "value1updated", "key2", "value2"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckSubnetGroupExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1updated"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
+				),
+			},
+			{
+				Config: testAccSubnetGroupConfig_tags1(rName, "key2", "value2"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckSubnetGroupExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
+				),
+			},
 		},
 	})
 }
@@ -172,42 +258,20 @@ func testAccCheckSubnetGroupDestroy(ctx context.Context) resource.TestCheckFunc
 				continue
 			}
 
-			// Try to find the resource
-			resp, err := conn.DescribeDBSubnetGroupsWithContext(ctx, &docdb.DescribeDBSubnetGroupsInput{DBSubnetGroupName: aws.String(rs.Primary.ID)})
+			_, err := tfdocdb.FindDBSubnetGroupByName(ctx, conn, rs.Primary.ID)
 
-			if err == nil {
-				if len(resp.DBSubnetGroups) != 0 &&
-					aws.StringValue(resp.DBSubnetGroups[0].DBSubnetGroupName) == rs.Primary.ID {
-					return fmt.Errorf("DocumentDB Subnet Group %s still exists", rs.Primary.ID)
-				}
+			if tfresource.NotFound(err) {
+				continue
 			}
 
 			if err != nil {
-				if tfawserr.ErrCodeEquals(err, docdb.ErrCodeDBSubnetGroupNotFoundFault) {
-					return nil
-				}
 				return err
 			}
-		}
 
-		return nil
-	}
-}
-
-func testAccCheckSubnetGroupDisappears(ctx context.Context, group *docdb.DBSubnetGroup) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		conn := acctest.Provider.Meta().(*conns.AWSClient).DocDBConn(ctx)
-
-		params := &docdb.DeleteDBSubnetGroupInput{
-			DBSubnetGroupName: group.DBSubnetGroupName,
+			return fmt.Errorf("DocumentDB Subnet Group %s still exists", rs.Primary.ID)
 		}
 
-		_, err := conn.DeleteDBSubnetGroupWithContext(ctx, params)
-		if err != nil {
-			return err
-		}
-
-		return tfdocdb.WaitForSubnetGroupDeletion(ctx, conn, *group.DBSubnetGroupName)
+		return nil
 	}
 }
 
@@ -218,175 +282,88 @@ func testAccCheckSubnetGroupExists(ctx context.Context, n string, v *docdb.DBSub
 			return fmt.Errorf("Not found: %s", n)
 		}
 
-		if rs.Primary.ID == "" {
-			return fmt.Errorf("No ID is set")
-		}
-
 		conn := acctest.Provider.Meta().(*conns.AWSClient).DocDBConn(ctx)
-		resp, err := conn.DescribeDBSubnetGroupsWithContext(ctx, &docdb.DescribeDBSubnetGroupsInput{DBSubnetGroupName: aws.String(rs.Primary.ID)})
+
+		output, err := tfdocdb.FindDBSubnetGroupByName(ctx, conn, rs.Primary.ID)
+
 		if err != nil {
 			return err
 		}
-		if len(resp.DBSubnetGroups) == 0 {
-			return fmt.Errorf("DbSubnetGroup not found")
-		}
 
-		*v = *resp.DBSubnetGroups[0]
+		*v = *output
 
 		return nil
 	}
 }
 
 func testAccSubnetGroupConfig_basic(rName string) string {
-	return acctest.ConfigCompose(acctest.ConfigAvailableAZsNoOptIn(), fmt.Sprintf(`
-resource "aws_vpc" "foo" {
-  cidr_block = "10.1.0.0/16"
-
-  tags = {
-    Name = "terraform-testacc-docdb-subnet-group"
-  }
-}
-
-resource "aws_subnet" "foo" {
-  cidr_block        = "10.1.1.0/24"
-  availability_zone = data.aws_availability_zones.available.names[0]
-  vpc_id            = aws_vpc.foo.id
-
-  tags = {
-    Name = "tf-acc-docdb-subnet-group-1"
-  }
-}
-
-resource "aws_subnet" "bar" {
-  cidr_block        = "10.1.2.0/24"
-  availability_zone = data.aws_availability_zones.available.names[1]
-  vpc_id            = aws_vpc.foo.id
-
-  tags = {
-    Name = "tf-acc-docdb-subnet-group-2"
-  }
-}
-
-resource "aws_docdb_subnet_group" "foo" {
-  name       = "%s"
-  subnet_ids = [aws_subnet.foo.id, aws_subnet.bar.id]
-
-  tags = {
-    Name = "tf-docdb-subnet-group-test"
-  }
+	return acctest.ConfigCompose(acctest.ConfigVPCWithSubnets(rName, 2), fmt.Sprintf(`
+resource "aws_docdb_subnet_group" "test" {
+  name       = %[1]q
+  subnet_ids = aws_subnet.test[*].id
 }
 `, rName))
 }
 
-func testAccSubnetGroupConfig_updatedDescription(rName string) string {
-	return acctest.ConfigCompose(acctest.ConfigAvailableAZsNoOptIn(), fmt.Sprintf(`
-resource "aws_vpc" "foo" {
-  cidr_block = "10.1.0.0/16"
-
-  tags = {
-    Name = "terraform-testacc-docdb-subnet-group"
-  }
-}
-
-resource "aws_subnet" "foo" {
-  cidr_block        = "10.1.1.0/24"
-  availability_zone = data.aws_availability_zones.available.names[0]
-  vpc_id            = aws_vpc.foo.id
-
-  tags = {
-    Name = "tf-acc-docdb-subnet-group-1"
-  }
+func testAccSubnetGroupConfig_nameGenerated(rName string) string {
+	return acctest.ConfigCompose(acctest.ConfigVPCWithSubnets(rName, 2), `
+resource "aws_docdb_subnet_group" "test" {
+  subnet_ids = aws_subnet.test[*].id
 }
-
-resource "aws_subnet" "bar" {
-  cidr_block        = "10.1.2.0/24"
-  availability_zone = data.aws_availability_zones.available.names[1]
-  vpc_id            = aws_vpc.foo.id
-
-  tags = {
-    Name = "tf-acc-docdb-subnet-group-2"
-  }
+`)
 }
 
-resource "aws_docdb_subnet_group" "foo" {
-  name        = "%s"
-  description = "foo description updated"
-  subnet_ids  = [aws_subnet.foo.id, aws_subnet.bar.id]
-
-  tags = {
-    Name = "tf-docdb-subnet-group-test"
-  }
-}
-`, rName))
+func testAccSubnetGroupConfig_namePrefix(rName, namePrefix string) string {
+	return acctest.ConfigCompose(acctest.ConfigVPCWithSubnets(rName, 2), fmt.Sprintf(`
+resource "aws_docdb_subnet_group" "test" {
+  name_prefix = %[1]q
+  subnet_ids  = aws_subnet.test[*].id
 }
-
-func testAccSubnetGroupConfig_namePrefix() string {
-	return acctest.ConfigCompose(acctest.ConfigAvailableAZsNoOptIn(), `
-resource "aws_vpc" "test" {
-  cidr_block = "10.1.0.0/16"
-
-  tags = {
-    Name = "terraform-testacc-docdb-subnet-group-name-prefix"
-  }
+`, namePrefix))
 }
 
-resource "aws_subnet" "a" {
-  vpc_id            = aws_vpc.test.id
-  cidr_block        = "10.1.1.0/24"
-  availability_zone = data.aws_availability_zones.available.names[0]
-
-  tags = {
-    Name = "tf-acc-docdb-subnet-group-name-prefix-a"
-  }
+func testAccSubnetGroupConfig_description(rName, description string) string {
+	return acctest.ConfigCompose(acctest.ConfigVPCWithSubnets(rName, 2), fmt.Sprintf(`
+resource "aws_docdb_subnet_group" "test" {
+  name        = %[1]q
+  description = %[2]q
+  subnet_ids  = aws_subnet.test[*].id
 }
-
-resource "aws_subnet" "b" {
-  vpc_id            = aws_vpc.test.id
-  cidr_block        = "10.1.2.0/24"
-  availability_zone = data.aws_availability_zones.available.names[1]
-
-  tags = {
-    Name = "tf-acc-docdb-subnet-group-name-prefix-b"
-  }
+`, rName, description))
 }
 
+func testAccSubnetGroupConfig_3subnets(rName string) string {
+	return acctest.ConfigCompose(acctest.ConfigVPCWithSubnets(rName, 3), fmt.Sprintf(`
 resource "aws_docdb_subnet_group" "test" {
-  name_prefix = "tf_test-"
-  subnet_ids  = [aws_subnet.a.id, aws_subnet.b.id]
-}`)
+  name       = %[1]q
+  subnet_ids = aws_subnet.test[*].id
 }
-
-func testAccSubnetGroupConfig_generatedName() string {
-	return acctest.ConfigCompose(acctest.ConfigAvailableAZsNoOptIn(), `
-resource "aws_vpc" "test" {
-  cidr_block = "10.1.0.0/16"
-
-  tags = {
-    Name = "terraform-testacc-docdb-subnet-group-generated-name"
-  }
+`, rName))
 }
 
-resource "aws_subnet" "a" {
-  vpc_id            = aws_vpc.test.id
-  cidr_block        = "10.1.1.0/24"
-  availability_zone = data.aws_availability_zones.available.names[0]
+func testAccSubnetGroupConfig_tags1(rName, tagKey1, tagValue1 string) string {
+	return acctest.ConfigCompose(acctest.ConfigVPCWithSubnets(rName, 2), fmt.Sprintf(`
+resource "aws_docdb_subnet_group" "test" {
+  name       = %[1]q
+  subnet_ids = aws_subnet.test[*].id
 
   tags = {
-    Name = "tf-acc-docdb-subnet-group-generated-name-a"
+    %[2]q = %[3]q
   }
 }
+`, rName, tagKey1, tagValue1))
+}
 
-resource "aws_subnet" "b" {
-  vpc_id            = aws_vpc.test.id
-  cidr_block        = "10.1.2.0/24"
-  availability_zone = data.aws_availability_zones.available.names[1]
+func testAccSubnetGroupConfig_tags2(rName, tagKey1, tagValue1, tagKey2, tagValue2 string) string {
+	return acctest.ConfigCompose(acctest.ConfigVPCWithSubnets(rName, 2), fmt.Sprintf(`
+resource "aws_docdb_subnet_group" "test" {
+  name       = %[1]q
+  subnet_ids = aws_subnet.test[*].id
 
   tags = {
-    Name = "tf-acc-docdb-subnet-group-generated-name-a"
+    %[2]q = %[3]q
+    %[4]q = %[5]q
   }
 }
-
-resource "aws_docdb_subnet_group" "test" {
-  subnet_ids = [aws_subnet.a.id, aws_subnet.b.id]
-}`)
+`, rName, tagKey1, tagValue1, tagKey2, tagValue2))
 }
diff --git a/internal/service/docdb/sweep.go b/internal/service/docdb/sweep.go
index 9bee8e2540e..ab8569b58d9 100644
--- a/internal/service/docdb/sweep.go
+++ b/internal/service/docdb/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package docdb
 
@@ -10,12 +10,12 @@ import (
 
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/docdb"
-	multierror "github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_docdb_global_cluster", &resource.Sweeper{
 		Name: "aws_docdb_global_cluster",
 		F:    sweepGlobalClusters,
@@ -70,46 +70,47 @@ func init() {
 
 func sweepDBClusters(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
-
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
-		return fmt.Errorf("error getting client: %w", err)
+		return fmt.Errorf("error getting client: %d", err)
 	}
-
 	conn := client.DocDBConn(ctx)
 	input := &docdb.DescribeDBClustersInput{}
+	sweepResources := make([]sweep.Sweepable, 0)
 
-	err = conn.DescribeDBClustersPagesWithContext(ctx, input, func(out *docdb.DescribeDBClustersOutput, lastPage bool) bool {
-		for _, dBCluster := range out.DBClusters {
-			id := aws.StringValue(dBCluster.DBClusterIdentifier)
-			input := &docdb.DeleteDBClusterInput{
-				DBClusterIdentifier: dBCluster.DBClusterIdentifier,
-				SkipFinalSnapshot:   aws.Bool(true),
-			}
-
-			log.Printf("[INFO] Deleting DocumentDB Cluster: %s", id)
-
-			_, err := conn.DeleteDBClusterWithContext(ctx, input)
+	err = conn.DescribeDBClustersPagesWithContext(ctx, input, func(page *docdb.DescribeDBClustersOutput, lastPage bool) bool {
+		if page == nil {
+			return !lastPage
+		}
 
-			if err != nil {
-				log.Printf("[ERROR] Failed to delete DocumentDB Cluster (%s): %s", id, err)
-				continue
+		for _, v := range page.DBClusters {
+			r := ResourceCluster()
+			d := r.Data(nil)
+			d.SetId(aws.StringValue(v.DBClusterIdentifier))
+			d.Set("skip_final_snapshot", true)
+			if globalCluster, err := findGlobalClusterByARN(ctx, conn, aws.StringValue(v.DBClusterArn)); err == nil && globalCluster != nil {
+				d.Set("global_cluster_identifier", globalCluster.GlobalClusterIdentifier)
 			}
 
-			if err := WaitForDBClusterDeletion(ctx, conn, id, DBClusterDeleteTimeout); err != nil {
-				log.Printf("[ERROR] Failure while waiting for DocumentDB Cluster (%s) to be deleted: %s", id, err)
-			}
+			sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
 		}
+
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping DocumentDB Cluster sweep for %s: %s", region, err)
 		return nil
 	}
 
 	if err != nil {
-		return fmt.Errorf("retrieving DocumentDB Clusters: %w", err)
+		return fmt.Errorf("error listing DocumentDB Clusters (%s): %w", region, err)
+	}
+
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
+
+	if err != nil {
+		return fmt.Errorf("error sweeping DocumentDB Clusters (%s): %w", region, err)
 	}
 
 	return nil
@@ -117,7 +118,7 @@ func sweepDBClusters(region string) error {
 
 func sweepDBClusterSnapshots(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
@@ -149,7 +150,7 @@ func sweepDBClusterSnapshots(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping DocumentDB Cluster Snapshot sweep for %s: %s", region, err)
 		return nil
 	}
@@ -163,46 +164,50 @@ func sweepDBClusterSnapshots(region string) error {
 
 func sweepDBClusterParameterGroups(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
-
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
-		return fmt.Errorf("error getting client: %w", err)
+		return fmt.Errorf("error getting client: %s", err)
 	}
-
 	conn := client.DocDBConn(ctx)
 	input := &docdb.DescribeDBClusterParameterGroupsInput{}
+	sweepResources := make([]sweep.Sweepable, 0)
 
-	err = conn.DescribeDBClusterParameterGroupsPagesWithContext(ctx, input, func(out *docdb.DescribeDBClusterParameterGroupsOutput, lastPage bool) bool {
-		for _, dBClusterParameterGroup := range out.DBClusterParameterGroups {
-			name := aws.StringValue(dBClusterParameterGroup.DBClusterParameterGroupName)
-			input := &docdb.DeleteDBClusterParameterGroupInput{
-				DBClusterParameterGroupName: dBClusterParameterGroup.DBClusterParameterGroupName,
-			}
+	err = conn.DescribeDBClusterParameterGroupsPagesWithContext(ctx, input, func(page *docdb.DescribeDBClusterParameterGroupsOutput, lastPage bool) bool {
+		if page == nil {
+			return !lastPage
+		}
+
+		for _, v := range page.DBClusterParameterGroups {
+			name := aws.StringValue(v.DBClusterParameterGroupName)
 
 			if strings.HasPrefix(name, "default.") {
-				log.Printf("[INFO] Skipping DocumentDB Parameter Group: %s", name)
+				log.Printf("[INFO] Skipping DocumentDB Cluster Parameter Group: %s", name)
 				continue
 			}
 
-			log.Printf("[INFO] Deleting DocumentDB Cluster Parameter Group: %s", name)
-
-			_, err := conn.DeleteDBClusterParameterGroupWithContext(ctx, input)
+			r := ResourceClusterParameterGroup()
+			d := r.Data(nil)
+			d.SetId(name)
 
-			if err != nil {
-				log.Printf("[ERROR] Failed to delete DocumentDB Parameter Group (%s): %s", name, err)
-				continue
-			}
+			sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
 		}
+
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping DocumentDB Cluster Parameter Group sweep for %s: %s", region, err)
 		return nil
 	}
 
 	if err != nil {
-		return fmt.Errorf("retrieving DocumentDB Cluster Parameter Groups: %w", err)
+		return fmt.Errorf("error listing DocumentDB Cluster Parameter Groups (%s): %w", region, err)
+	}
+
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
+
+	if err != nil {
+		return fmt.Errorf("error sweeping DocumentDB Cluster Parameter Groups (%s): %w", region, err)
 	}
 
 	return nil
@@ -210,26 +215,23 @@ func sweepDBClusterParameterGroups(region string) error {
 
 func sweepDBInstances(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
-
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
-		return fmt.Errorf("error getting client: %w", err)
+		return fmt.Errorf("error getting client: %s", err)
 	}
-
 	conn := client.DocDBConn(ctx)
-	sweepResources := make([]sweep.Sweepable, 0)
-	var errs *multierror.Error
 	input := &docdb.DescribeDBInstancesInput{}
+	sweepResources := make([]sweep.Sweepable, 0)
 
 	err = conn.DescribeDBInstancesPagesWithContext(ctx, input, func(page *docdb.DescribeDBInstancesOutput, lastPage bool) bool {
 		if page == nil {
 			return !lastPage
 		}
 
-		for _, dBInstance := range page.DBInstances {
+		for _, v := range page.DBInstances {
 			r := ResourceClusterInstance()
 			d := r.Data(nil)
-			d.SetId(aws.StringValue(dBInstance.DBInstanceIdentifier))
+			d.SetId(aws.StringValue(v.DBInstanceIdentifier))
 
 			sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
 		}
@@ -237,25 +239,27 @@ func sweepDBInstances(region string) error {
 		return !lastPage
 	})
 
-	if err != nil {
-		errs = multierror.Append(errs, fmt.Errorf("listing DocumentDB Instances for %s: %w", region, err))
+	if awsv1.SkipSweepError(err) {
+		log.Printf("[WARN] Skipping DocumentDB Cluster Instance sweep for %s: %s", region, err)
+		return nil
 	}
 
-	if err = sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
-		errs = multierror.Append(errs, fmt.Errorf("sweeping DocumentDB Instances for %s: %w", region, err))
+	if err != nil {
+		return fmt.Errorf("listing DocumentDB Cluster Instances (%s): %w", region, err)
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
-		log.Printf("[WARN] Skipping DocumentDB Instance sweep for %s: %s", region, errs)
-		return nil
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
+
+	if err != nil {
+		return fmt.Errorf("sweeping DocumentDB Cluster Instances (%s): %w", region, err)
 	}
 
-	return errs.ErrorOrNil()
+	return nil
 }
 
 func sweepGlobalClusters(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
@@ -287,7 +291,7 @@ func sweepGlobalClusters(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping DocumentDB Global Cluster sweep for %s: %s", region, err)
 		return nil
 	}
@@ -301,45 +305,43 @@ func sweepGlobalClusters(region string) error {
 
 func sweepDBSubnetGroups(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
-
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
-		return fmt.Errorf("error getting client: %w", err)
+		return fmt.Errorf("error getting client: %s", err)
 	}
-
 	conn := client.DocDBConn(ctx)
 	input := &docdb.DescribeDBSubnetGroupsInput{}
+	sweepResources := make([]sweep.Sweepable, 0)
 
-	err = conn.DescribeDBSubnetGroupsPagesWithContext(ctx, input, func(out *docdb.DescribeDBSubnetGroupsOutput, lastPage bool) bool {
-		for _, dBSubnetGroup := range out.DBSubnetGroups {
-			name := aws.StringValue(dBSubnetGroup.DBSubnetGroupName)
-			input := &docdb.DeleteDBSubnetGroupInput{
-				DBSubnetGroupName: dBSubnetGroup.DBSubnetGroupName,
-			}
-
-			log.Printf("[INFO] Deleting DocumentDB Subnet Group: %s", name)
-
-			_, err := conn.DeleteDBSubnetGroupWithContext(ctx, input)
+	err = conn.DescribeDBSubnetGroupsPagesWithContext(ctx, input, func(page *docdb.DescribeDBSubnetGroupsOutput, lastPage bool) bool {
+		if page == nil {
+			return !lastPage
+		}
 
-			if err != nil {
-				log.Printf("[ERROR] Failed to delete DocumentDB Subnet Group (%s): %s", name, err)
-				continue
-			}
+		for _, v := range page.DBSubnetGroups {
+			r := ResourceSubnetGroup()
+			d := r.Data(nil)
+			d.SetId(aws.StringValue(v.DBSubnetGroupName))
 
-			if err := WaitForDBSubnetGroupDeletion(ctx, conn, name, DBSubnetGroupDeleteTimeout); err != nil {
-				log.Printf("[ERROR] Failure while waiting for DocumentDB Subnet Group (%s) to be deleted: %s", name, err)
-			}
+			sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
 		}
+
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping DocumentDB Subnet Group sweep for %s: %s", region, err)
 		return nil
 	}
 
 	if err != nil {
-		return fmt.Errorf("retrieving DocumentDB Subnet Groups: %w", err)
+		return fmt.Errorf("error listing DocumentDB Subnet Groups (%s): %w", region, err)
+	}
+
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
+
+	if err != nil {
+		return fmt.Errorf("error sweeping DocumentDB Subnet Groups (%s): %w", region, err)
 	}
 
 	return nil
@@ -347,7 +349,7 @@ func sweepDBSubnetGroups(region string) error {
 
 func sweepEventSubscriptions(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
@@ -379,7 +381,7 @@ func sweepEventSubscriptions(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping DocumentDB Event Subscription sweep for %s: %s", region, err)
 		return nil
 	}
diff --git a/internal/service/docdb/tags_gen.go b/internal/service/docdb/tags_gen.go
index 84c55f7d51b..5375f9c34b7 100644
--- a/internal/service/docdb/tags_gen.go
+++ b/internal/service/docdb/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/docdb"
 	"github.com/aws/aws-sdk-go/service/docdb/docdbiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -102,6 +104,8 @@ func updateTags(ctx context.Context, conn docdbiface.DocDBAPI, identifier string
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.DocDB)
 	if len(removedTags) > 0 {
diff --git a/internal/service/docdb/validate.go b/internal/service/docdb/validate.go
index 6f8f275e995..37251767183 100644
--- a/internal/service/docdb/validate.go
+++ b/internal/service/docdb/validate.go
@@ -1,29 +1,30 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package docdb
 
 import (
 	"fmt"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 )
 
 func validClusterIdentifier(v interface{}, k string) (ws []string, errors []error) {
 	value := v.(string)
-	if !regexp.MustCompile(`^[0-9a-z-]+$`).MatchString(value) {
+	if !regexache.MustCompile(`^[0-9a-z-]+$`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"only lowercase alphanumeric characters and hyphens allowed in %q", k))
 	}
-	if !regexp.MustCompile(`^[a-z]`).MatchString(value) {
+	if !regexache.MustCompile(`^[a-z]`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"first character of %q must be a letter", k))
 	}
-	if regexp.MustCompile(`--`).MatchString(value) {
+	if regexache.MustCompile(`--`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"%q cannot contain two consecutive hyphens", k))
 	}
-	if regexp.MustCompile(`-$`).MatchString(value) {
+	if regexache.MustCompile(`-$`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"%q cannot end with a hyphen", k))
 	}
@@ -32,46 +33,40 @@ func validClusterIdentifier(v interface{}, k string) (ws []string, errors []erro
 
 func validClusterSnapshotIdentifier(v interface{}, k string) (ws []string, errors []error) {
 	value := v.(string)
-	if !regexp.MustCompile(`^[0-9a-z-]+$`).MatchString(value) {
+	if !regexache.MustCompile(`^[0-9a-z-]+$`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"only lowercase alphanumeric characters and hyphens allowed in %q", k))
 	}
-	if !regexp.MustCompile(`^[a-z]`).MatchString(value) {
+	if !regexache.MustCompile(`^[a-z]`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"first character of %q must be a letter", k))
 	}
-	if regexp.MustCompile(`--`).MatchString(value) {
+	if regexache.MustCompile(`--`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"%q cannot contain two consecutive hyphens", k))
 	}
-	if regexp.MustCompile(`-$`).MatchString(value) {
+	if regexache.MustCompile(`-$`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"%q cannot end with a hyphen", k))
 	}
 	return
 }
 
-func validEngine() schema.SchemaValidateFunc {
-	return validation.StringInSlice([]string{
-		"docdb",
-	}, false)
-}
-
 func validIdentifier(v interface{}, k string) (ws []string, errors []error) {
 	value := v.(string)
-	if !regexp.MustCompile(`^[0-9a-z-]+$`).MatchString(value) {
+	if !regexache.MustCompile(`^[0-9a-z-]+$`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"only lowercase alphanumeric characters and hyphens allowed in %q", k))
 	}
-	if !regexp.MustCompile(`^[a-z]`).MatchString(value) {
+	if !regexache.MustCompile(`^[a-z]`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"first character of %q must be a letter", k))
 	}
-	if regexp.MustCompile(`--`).MatchString(value) {
+	if regexache.MustCompile(`--`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"%q cannot contain two consecutive hyphens", k))
 	}
-	if regexp.MustCompile(`-$`).MatchString(value) {
+	if regexache.MustCompile(`-$`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"%q cannot end with a hyphen", k))
 	}
@@ -84,15 +79,15 @@ func validIdentifier(v interface{}, k string) (ws []string, errors []error) {
 
 func validIdentifierPrefix(v interface{}, k string) (ws []string, errors []error) {
 	value := v.(string)
-	if !regexp.MustCompile(`^[0-9a-z-]+$`).MatchString(value) {
+	if !regexache.MustCompile(`^[0-9a-z-]+$`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"only lowercase alphanumeric characters and hyphens allowed in %q", k))
 	}
-	if !regexp.MustCompile(`^[a-z]`).MatchString(value) {
+	if !regexache.MustCompile(`^[a-z]`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"first character of %q must be a letter", k))
 	}
-	if regexp.MustCompile(`--`).MatchString(value) {
+	if regexache.MustCompile(`--`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"%q cannot contain two consecutive hyphens", k))
 	}
@@ -101,19 +96,19 @@ func validIdentifierPrefix(v interface{}, k string) (ws []string, errors []error
 
 func validParamGroupName(v interface{}, k string) (ws []string, errors []error) {
 	value := v.(string)
-	if !regexp.MustCompile(`^[0-9a-z-]+$`).MatchString(value) {
+	if !regexache.MustCompile(`^[0-9a-z-]+$`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"only lowercase alphanumeric characters and hyphens allowed in parameter group %q", k))
 	}
-	if !regexp.MustCompile(`^[a-z]`).MatchString(value) {
+	if !regexache.MustCompile(`^[a-z]`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"first character of parameter group %q must be a letter", k))
 	}
-	if regexp.MustCompile(`--`).MatchString(value) {
+	if regexache.MustCompile(`--`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"parameter group %q cannot contain two consecutive hyphens", k))
 	}
-	if regexp.MustCompile(`-$`).MatchString(value) {
+	if regexache.MustCompile(`-$`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"parameter group %q cannot end with a hyphen", k))
 	}
@@ -126,15 +121,15 @@ func validParamGroupName(v interface{}, k string) (ws []string, errors []error)
 
 func validGlobalCusterIdentifier(v interface{}, k string) (ws []string, errors []error) {
 	value := v.(string)
-	if !regexp.MustCompile(`^[0-9A-Za-z-]+$`).MatchString(value) {
+	if !regexache.MustCompile(`^[0-9A-Za-z-]+$`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"only alphanumeric characters and hyphens allowed in %q", k))
 	}
-	if !regexp.MustCompile(`^[A-Za-z]`).MatchString(value) {
+	if !regexache.MustCompile(`^[A-Za-z]`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"first character of %q must be a letter", k))
 	}
-	if regexp.MustCompile(`--`).MatchString(value) {
+	if regexache.MustCompile(`--`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"%q cannot contain two consecutive hyphens", k))
 	}
@@ -147,15 +142,15 @@ func validGlobalCusterIdentifier(v interface{}, k string) (ws []string, errors [
 
 func validParamGroupNamePrefix(v interface{}, k string) (ws []string, errors []error) {
 	value := v.(string)
-	if !regexp.MustCompile(`^[0-9a-z-]+$`).MatchString(value) {
+	if !regexache.MustCompile(`^[0-9a-z-]+$`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"only lowercase alphanumeric characters and hyphens allowed in parameter group %q", k))
 	}
-	if !regexp.MustCompile(`^[a-z]`).MatchString(value) {
+	if !regexache.MustCompile(`^[a-z]`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"first character of parameter group %q must be a letter", k))
 	}
-	if regexp.MustCompile(`--`).MatchString(value) {
+	if regexache.MustCompile(`--`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"parameter group %q cannot contain two consecutive hyphens", k))
 	}
@@ -168,7 +163,7 @@ func validParamGroupNamePrefix(v interface{}, k string) (ws []string, errors []e
 
 func validSubnetGroupName(v interface{}, k string) (ws []string, errors []error) {
 	value := v.(string)
-	if !regexp.MustCompile(`^[ .0-9a-z-_]+$`).MatchString(value) {
+	if !regexache.MustCompile(`^[0-9a-z_ .-]+$`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"only lowercase alphanumeric characters, hyphens, underscores, periods, and spaces allowed in %q", k))
 	}
@@ -185,7 +180,7 @@ func validSubnetGroupName(v interface{}, k string) (ws []string, errors []error)
 
 func validSubnetGroupNamePrefix(v interface{}, k string) (ws []string, errors []error) {
 	value := v.(string)
-	if !regexp.MustCompile(`^[ .0-9a-z-_]+$`).MatchString(value) {
+	if !regexache.MustCompile(`^[0-9a-z_ .-]+$`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"only lowercase alphanumeric characters, hyphens, underscores, periods, and spaces allowed in %q", k))
 	}
diff --git a/internal/service/docdb/validate_test.go b/internal/service/docdb/validate_test.go
index a05e0bf0955..29920e12ce9 100644
--- a/internal/service/docdb/validate_test.go
+++ b/internal/service/docdb/validate_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package docdb
 
 import (
diff --git a/internal/service/docdb/wait.go b/internal/service/docdb/wait.go
index a7d02417958..7066e119eb6 100644
--- a/internal/service/docdb/wait.go
+++ b/internal/service/docdb/wait.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package docdb
 
 import (
@@ -13,9 +16,6 @@ import (
 
 const (
 	DBClusterSnapshotDeleteTimeout = 5 * time.Minute
-	DBClusterDeleteTimeout         = 5 * time.Minute
-	DBInstanceDeleteTimeout        = 5 * time.Minute
-	DBSubnetGroupDeleteTimeout     = 5 * time.Minute
 	EventSubscriptionDeleteTimeout = 5 * time.Minute
 	GlobalClusterCreateTimeout     = 5 * time.Minute
 	GlobalClusterDeleteTimeout     = 5 * time.Minute
@@ -23,18 +23,9 @@ const (
 )
 
 const (
-	DBClusterStatusAvailable         = "available"
-	DBClusterStatusDeleted           = "deleted"
-	DBClusterStatusDeleting          = "deleting"
-	DBInstanceStatusAvailable        = "available"
-	DBInstanceStatusDeleted          = "deleted"
-	DBInstanceStatusDeleting         = "deleting"
 	DBClusterSnapshotStatusAvailable = "available"
 	DBClusterSnapshotStatusDeleted   = "deleted"
 	DBClusterSnapshotStatusDeleting  = "deleting"
-	DBSubnetGroupStatusAvailable     = "available"
-	DBSubnetGroupStatusDeleted       = "deleted"
-	DBSubnetGroupStatusDeleting      = "deleting"
 	GlobalClusterStatusAvailable     = "available"
 	GlobalClusterStatusCreating      = "creating"
 	GlobalClusterStatusDeleted       = "deleted"
@@ -107,25 +98,6 @@ func waitForGlobalClusterRemoval(ctx context.Context, conn *docdb.DocDB, dbClust
 	return nil
 }
 
-func WaitForDBClusterDeletion(ctx context.Context, conn *docdb.DocDB, dBClusterID string, timeout time.Duration) error {
-	stateConf := &retry.StateChangeConf{
-		Pending:        []string{DBClusterStatusAvailable, DBClusterStatusDeleting},
-		Target:         []string{DBClusterStatusDeleted},
-		Refresh:        statusDBClusterRefreshFunc(ctx, conn, dBClusterID),
-		Timeout:        timeout,
-		NotFoundChecks: 1,
-	}
-
-	log.Printf("[DEBUG] Waiting for DocumentDB Cluster (%s) deletion", dBClusterID)
-	_, err := stateConf.WaitForStateContext(ctx)
-
-	if tfresource.NotFound(err) {
-		return nil
-	}
-
-	return err
-}
-
 func WaitForDBClusterSnapshotDeletion(ctx context.Context, conn *docdb.DocDB, dBClusterSnapshotID string, timeout time.Duration) error {
 	stateConf := &retry.StateChangeConf{
 		Pending:        []string{DBClusterSnapshotStatusAvailable, DBClusterSnapshotStatusDeleting},
@@ -145,25 +117,6 @@ func WaitForDBClusterSnapshotDeletion(ctx context.Context, conn *docdb.DocDB, dB
 	return err
 }
 
-func WaitForDBInstanceDeletion(ctx context.Context, conn *docdb.DocDB, dBInstanceID string, timeout time.Duration) error {
-	stateConf := &retry.StateChangeConf{
-		Pending:        []string{DBInstanceStatusAvailable, DBInstanceStatusDeleting},
-		Target:         []string{DBInstanceStatusDeleted},
-		Refresh:        statusDBInstanceRefreshFunc(ctx, conn, dBInstanceID),
-		Timeout:        timeout,
-		NotFoundChecks: 1,
-	}
-
-	log.Printf("[DEBUG] Waiting for DocumentDB Instance (%s) deletion", dBInstanceID)
-	_, err := stateConf.WaitForStateContext(ctx)
-
-	if tfresource.NotFound(err) {
-		return nil
-	}
-
-	return err
-}
-
 func WaitForGlobalClusterDeletion(ctx context.Context, conn *docdb.DocDB, globalClusterID string, timeout time.Duration) error {
 	stateConf := &retry.StateChangeConf{
 		Pending:        []string{GlobalClusterStatusAvailable, GlobalClusterStatusDeleting},
@@ -183,25 +136,6 @@ func WaitForGlobalClusterDeletion(ctx context.Context, conn *docdb.DocDB, global
 	return err
 }
 
-func WaitForDBSubnetGroupDeletion(ctx context.Context, conn *docdb.DocDB, dBSubnetGroupName string, timeout time.Duration) error {
-	stateConf := &retry.StateChangeConf{
-		Pending:        []string{DBSubnetGroupStatusAvailable, DBSubnetGroupStatusDeleting},
-		Target:         []string{DBSubnetGroupStatusDeleted},
-		Refresh:        statusDBSubnetGroupRefreshFunc(ctx, conn, dBSubnetGroupName),
-		Timeout:        timeout,
-		NotFoundChecks: 1,
-	}
-
-	log.Printf("[DEBUG] Waiting for DocumentDB Subnet Group (%s) deletion", dBSubnetGroupName)
-	_, err := stateConf.WaitForStateContext(ctx)
-
-	if tfresource.NotFound(err) {
-		return nil
-	}
-
-	return err
-}
-
 func waitEventSubscriptionActive(ctx context.Context, conn *docdb.DocDB, id string, timeout time.Duration) (*docdb.EventSubscription, error) { //nolint:unparam
 	stateConf := &retry.StateChangeConf{
 		Pending: []string{"creating", "modifying"},
@@ -219,7 +153,7 @@ func waitEventSubscriptionActive(ctx context.Context, conn *docdb.DocDB, id stri
 	return nil, err
 }
 
-func waitEventSubscriptionDeleted(ctx context.Context, conn *docdb.DocDB, id string, timeout time.Duration) (*docdb.EventSubscription, error) {
+func waitEventSubscriptionDeleted(ctx context.Context, conn *docdb.DocDB, id string, timeout time.Duration) (*docdb.EventSubscription, error) { //nolint:unparam
 	stateConf := &retry.StateChangeConf{
 		Pending: []string{"deleting"},
 		Target:  []string{},
diff --git a/internal/service/docdbelastic/generate.go b/internal/service/docdbelastic/generate.go
index 8d4d6f1f7de..4f56829e80e 100644
--- a/internal/service/docdbelastic/generate.go
+++ b/internal/service/docdbelastic/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
 
diff --git a/internal/service/docdbelastic/service_package_gen.go b/internal/service/docdbelastic/service_package_gen.go
index 5f99a57c6a9..0c249b79bf3 100644
--- a/internal/service/docdbelastic/service_package_gen.go
+++ b/internal/service/docdbelastic/service_package_gen.go
@@ -7,6 +7,7 @@ import (
 
 	aws_sdkv2 "github.com/aws/aws-sdk-go-v2/aws"
 	docdbelastic_sdkv2 "github.com/aws/aws-sdk-go-v2/service/docdbelastic"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -39,9 +40,11 @@ func (p *servicePackage) NewClient(ctx context.Context, config map[string]any) (
 
 	return docdbelastic_sdkv2.NewFromConfig(cfg, func(o *docdbelastic_sdkv2.Options) {
 		if endpoint := config["endpoint"].(string); endpoint != "" {
-			o.EndpointResolver = docdbelastic_sdkv2.EndpointResolverFromURL(endpoint)
+			o.BaseEndpoint = aws_sdkv2.String(endpoint)
 		}
 	}), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/ds/conditional_forwarder.go b/internal/service/ds/conditional_forwarder.go
index b679d3056c2..3694fc4e84e 100644
--- a/internal/service/ds/conditional_forwarder.go
+++ b/internal/service/ds/conditional_forwarder.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ds
 
 import (
diff --git a/internal/service/ds/conditional_forwarder_test.go b/internal/service/ds/conditional_forwarder_test.go
index 1922bd8038e..4987490509f 100644
--- a/internal/service/ds/conditional_forwarder_test.go
+++ b/internal/service/ds/conditional_forwarder_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ds_test
 
 import (
diff --git a/internal/service/ds/directory.go b/internal/service/ds/directory.go
index 1078aa2a29d..33252ddb7db 100644
--- a/internal/service/ds/directory.go
+++ b/internal/service/ds/directory.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ds
 
 import (
diff --git a/internal/service/ds/directory_data_source.go b/internal/service/ds/directory_data_source.go
index d530459b1df..a2aa792c433 100644
--- a/internal/service/ds/directory_data_source.go
+++ b/internal/service/ds/directory_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ds
 
 import (
diff --git a/internal/service/ds/directory_data_source_test.go b/internal/service/ds/directory_data_source_test.go
index 61e5dd542e0..80a590278cf 100644
--- a/internal/service/ds/directory_data_source_test.go
+++ b/internal/service/ds/directory_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ds_test
 
 import (
diff --git a/internal/service/ds/directory_test.go b/internal/service/ds/directory_test.go
index cb5b378788c..a4e4ecfe8b5 100644
--- a/internal/service/ds/directory_test.go
+++ b/internal/service/ds/directory_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ds_test
 
 import (
diff --git a/internal/service/ds/find.go b/internal/service/ds/find.go
index 05bf929d4d6..2073bc00d6f 100644
--- a/internal/service/ds/find.go
+++ b/internal/service/ds/find.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ds
 
 import (
diff --git a/internal/service/ds/generate.go b/internal/service/ds/generate.go
index 1492a1a9bf3..2b4a67038d3 100644
--- a/internal/service/ds/generate.go
+++ b/internal/service/ds/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/listpages/main.go -ListOps=DescribeDirectories,DescribeRegions
 //go:generate go run ../../generate/tags/main.go -ListTags -ListTagsInIDElem=ResourceId -ServiceTagsSlice -TagOp=AddTagsToResource -TagInIDElem=ResourceId -UntagOp=RemoveTagsFromResource -UpdateTags -CreateTags
 //go:generate go run ../../generate/servicepackage/main.go
diff --git a/internal/service/ds/log_subscription.go b/internal/service/ds/log_subscription.go
index 166cb732a28..169714e5356 100644
--- a/internal/service/ds/log_subscription.go
+++ b/internal/service/ds/log_subscription.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ds
 
 import (
diff --git a/internal/service/ds/log_subscription_test.go b/internal/service/ds/log_subscription_test.go
index 99053d98a82..db944465bdc 100644
--- a/internal/service/ds/log_subscription_test.go
+++ b/internal/service/ds/log_subscription_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ds_test
 
 import (
diff --git a/internal/service/ds/radius_settings.go b/internal/service/ds/radius_settings.go
index 7559c2a122d..a507c0c77cb 100644
--- a/internal/service/ds/radius_settings.go
+++ b/internal/service/ds/radius_settings.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ds
 
 import (
diff --git a/internal/service/ds/radius_settings_test.go b/internal/service/ds/radius_settings_test.go
index 1d93e9e366e..54197a50e7e 100644
--- a/internal/service/ds/radius_settings_test.go
+++ b/internal/service/ds/radius_settings_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ds_test
 
 import (
diff --git a/internal/service/ds/region.go b/internal/service/ds/region.go
index 9df7b497826..419dfb543b7 100644
--- a/internal/service/ds/region.go
+++ b/internal/service/ds/region.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ds
 
 import (
diff --git a/internal/service/ds/region_test.go b/internal/service/ds/region_test.go
index 91eb099c6ad..2b3066b55ac 100644
--- a/internal/service/ds/region_test.go
+++ b/internal/service/ds/region_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ds_test
 
 import (
diff --git a/internal/service/ds/service_package_gen.go b/internal/service/ds/service_package_gen.go
index 3a472c623eb..5ee8acec58b 100644
--- a/internal/service/ds/service_package_gen.go
+++ b/internal/service/ds/service_package_gen.go
@@ -10,6 +10,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	directoryservice_sdkv1 "github.com/aws/aws-sdk-go/service/directoryservice"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -93,9 +94,11 @@ func (p *servicePackage) NewClient(ctx context.Context, config map[string]any) (
 
 	return directoryservice_sdkv2.NewFromConfig(cfg, func(o *directoryservice_sdkv2.Options) {
 		if endpoint := config["endpoint"].(string); endpoint != "" {
-			o.EndpointResolver = directoryservice_sdkv2.EndpointResolverFromURL(endpoint)
+			o.BaseEndpoint = aws_sdkv2.String(endpoint)
 		}
 	}), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/ds/shared_directory.go b/internal/service/ds/shared_directory.go
index 90f9ec44376..0494ffa9bb2 100644
--- a/internal/service/ds/shared_directory.go
+++ b/internal/service/ds/shared_directory.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ds
 
 import (
diff --git a/internal/service/ds/shared_directory_accepter.go b/internal/service/ds/shared_directory_accepter.go
index 2794a1c6726..636bbbe1edf 100644
--- a/internal/service/ds/shared_directory_accepter.go
+++ b/internal/service/ds/shared_directory_accepter.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ds
 
 import (
diff --git a/internal/service/ds/shared_directory_accepter_test.go b/internal/service/ds/shared_directory_accepter_test.go
index 636c8b646b2..290e721d3f4 100644
--- a/internal/service/ds/shared_directory_accepter_test.go
+++ b/internal/service/ds/shared_directory_accepter_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ds_test
 
 import (
diff --git a/internal/service/ds/shared_directory_test.go b/internal/service/ds/shared_directory_test.go
index 9ab66c51b0f..286e08fc4bf 100644
--- a/internal/service/ds/shared_directory_test.go
+++ b/internal/service/ds/shared_directory_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ds_test
 
 import (
diff --git a/internal/service/ds/status.go b/internal/service/ds/status.go
index 797cd9069fc..b4af681dd01 100644
--- a/internal/service/ds/status.go
+++ b/internal/service/ds/status.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ds
 
 import (
diff --git a/internal/service/ds/sweep.go b/internal/service/ds/sweep.go
index 30f2298b278..14619ad4624 100644
--- a/internal/service/ds/sweep.go
+++ b/internal/service/ds/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package ds
 
@@ -13,9 +13,10 @@ import (
 	"github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_directory_service_directory", &resource.Sweeper{
 		Name: "aws_directory_service_directory",
 		F:    sweepDirectories,
@@ -40,7 +41,7 @@ func init() {
 
 func sweepDirectories(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
@@ -65,7 +66,7 @@ func sweepDirectories(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Directory Service Directory sweep for %s: %s", region, err)
 		return nil
 	}
@@ -74,7 +75,7 @@ func sweepDirectories(region string) error {
 		return fmt.Errorf("listing Directory Service Directories (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("sweeping Directory Service Directories (%s): %w", region, err)
@@ -85,7 +86,7 @@ func sweepDirectories(region string) error {
 
 func sweepRegions(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
@@ -146,11 +147,11 @@ func sweepRegions(region string) error {
 		errs = multierror.Append(errs, fmt.Errorf("listing Directory Service Directories for %s: %w", region, err))
 	}
 
-	if err = sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err = sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("sweeping Directory Service Regions for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
+	if awsv1.SkipSweepError(errs.ErrorOrNil()) {
 		log.Printf("[WARN] Skipping Directory Service Regions sweep for %s: %s", region, errs)
 		return nil
 	}
diff --git a/internal/service/ds/tags_gen.go b/internal/service/ds/tags_gen.go
index 0f21c9d1d06..e01d9e361a5 100644
--- a/internal/service/ds/tags_gen.go
+++ b/internal/service/ds/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/directoryservice"
 	"github.com/aws/aws-sdk-go/service/directoryservice/directoryserviceiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -111,6 +113,8 @@ func updateTags(ctx context.Context, conn directoryserviceiface.DirectoryService
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.DS)
 	if len(removedTags) > 0 {
diff --git a/internal/service/ds/trust.go b/internal/service/ds/trust.go
index 4b70d534179..e847b718c9d 100644
--- a/internal/service/ds/trust.go
+++ b/internal/service/ds/trust.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ds
 
 import (
@@ -15,8 +18,10 @@ import (
 	"github.com/hashicorp/terraform-plugin-framework/path"
 	"github.com/hashicorp/terraform-plugin-framework/resource"
 	"github.com/hashicorp/terraform-plugin-framework/resource/schema"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema/booldefault"
 	"github.com/hashicorp/terraform-plugin-framework/resource/schema/planmodifier"
 	"github.com/hashicorp/terraform-plugin-framework/resource/schema/setplanmodifier"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema/stringdefault"
 	"github.com/hashicorp/terraform-plugin-framework/resource/schema/stringplanmodifier"
 	"github.com/hashicorp/terraform-plugin-framework/schema/validator"
 	"github.com/hashicorp/terraform-plugin-framework/types"
@@ -25,10 +30,8 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/enum"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/fwdiag"
-	"github.com/hashicorp/terraform-provider-aws/internal/flex"
 	"github.com/hashicorp/terraform-provider-aws/internal/framework"
-	"github.com/hashicorp/terraform-provider-aws/internal/framework/boolplanmodifier"
-	fwstringplanmodifier "github.com/hashicorp/terraform-provider-aws/internal/framework/stringplanmodifier"
+	"github.com/hashicorp/terraform-provider-aws/internal/framework/flex"
 	fwvalidators "github.com/hashicorp/terraform-provider-aws/internal/framework/validators"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -79,9 +82,7 @@ func (r *resourceTrust) Schema(ctx context.Context, req resource.SchemaRequest,
 			"delete_associated_conditional_forwarder": schema.BoolAttribute{
 				Computed: true,
 				Optional: true,
-				PlanModifiers: []planmodifier.Bool{
-					boolplanmodifier.DefaultValue(false),
-				},
+				Default:  booldefault.StaticBool(false),
 			},
 			"directory_id": schema.StringAttribute{
 				Required: true,
@@ -144,12 +145,10 @@ func (r *resourceTrust) Schema(ctx context.Context, req resource.SchemaRequest,
 			"trust_type": schema.StringAttribute{
 				Optional: true,
 				Computed: true,
+				Default:  stringdefault.StaticString(string(awstypes.TrustTypeForest)),
 				Validators: []validator.String{
 					enum.FrameworkValidate[awstypes.TrustType](),
 				},
-				PlanModifiers: []planmodifier.String{
-					fwstringplanmodifier.DefaultValue(string(awstypes.TrustTypeForest)),
-				},
 			},
 		},
 	}
diff --git a/internal/service/ds/trust_test.go b/internal/service/ds/trust_test.go
index b082e6eb581..f2284ef2855 100644
--- a/internal/service/ds/trust_test.go
+++ b/internal/service/ds/trust_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ds_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	awstypes "github.com/aws/aws-sdk-go-v2/service/directoryservice/types"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -38,7 +41,7 @@ func TestAccDSTrust_basic(t *testing.T) {
 				Config: testAccTrustConfig_basic(rName, domainName, domainNameOther),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckTrustExists(ctx, resourceName, &v),
-					resource.TestMatchResourceAttr(resourceName, "id", regexp.MustCompile(`^t-\w{10}`)),
+					resource.TestMatchResourceAttr(resourceName, "id", regexache.MustCompile(`^t-\w{10}`)),
 					resource.TestCheckResourceAttr(resourceName, "conditional_forwarder_ip_addrs.#", "2"),
 					resource.TestCheckResourceAttrPair(resourceName, "directory_id", "aws_directory_service_directory.test", "id"),
 					resource.TestCheckResourceAttr(resourceName, "remote_domain_name", domainNameOther),
@@ -455,7 +458,7 @@ func TestAccDSTrust_deleteAssociatedConditionalForwarder(t *testing.T) {
 				Config: testAccTrustConfig_deleteAssociatedConditionalForwarder(rName, domainName, domainNameOther),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckTrustExists(ctx, resourceName, &v),
-					resource.TestMatchResourceAttr(resourceName, "id", regexp.MustCompile(`^t-\w{10}`)),
+					resource.TestMatchResourceAttr(resourceName, "id", regexache.MustCompile(`^t-\w{10}`)),
 					resource.TestCheckResourceAttr(resourceName, "conditional_forwarder_ip_addrs.#", "2"),
 					resource.TestCheckResourceAttr(resourceName, "delete_associated_conditional_forwarder", "true"),
 				),
diff --git a/internal/service/ds/validate.go b/internal/service/ds/validate.go
index 186038c559e..b8ea7d7f0db 100644
--- a/internal/service/ds/validate.go
+++ b/internal/service/ds/validate.go
@@ -1,18 +1,20 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ds
 
 import (
-	"regexp"
-
+	"github.com/YakDriver/regexache"
 	"github.com/hashicorp/terraform-plugin-framework-validators/stringvalidator"
 	"github.com/hashicorp/terraform-plugin-framework/schema/validator"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 )
 
 var (
-	directoryIDRegex = regexp.MustCompile(`^d-[0-9a-f]{10}$`)
+	directoryIDRegex = regexache.MustCompile(`^d-[0-9a-f]{10}$`)
 
-	domain                = regexp.MustCompile(`^([a-zA-Z0-9]+[\\.-])+([a-zA-Z0-9])+$`)
-	domainWithTrailingDot = regexp.MustCompile(`^([a-zA-Z0-9]+[\\.-])+([a-zA-Z0-9])+[.]?$`)
+	domain                = regexache.MustCompile(`^([0-9A-Za-z]+[\\.-])+([0-9A-Za-z])+$`)
+	domainWithTrailingDot = regexache.MustCompile(`^([0-9A-Za-z]+[\\.-])+([0-9A-Za-z])+[.]?$`)
 )
 
 var directoryIDValidator validator.String = stringvalidator.RegexMatches(directoryIDRegex, "must be a valid Directory Service Directory ID")
@@ -21,4 +23,4 @@ var domainValidator = validation.StringMatch(domain, "must be a fully qualified
 
 var domainWithTrailingDotValidator validator.String = stringvalidator.RegexMatches(domainWithTrailingDot, "must be a fully qualified domain name and may end with a trailing period")
 
-var trustPasswordValidator validator.String = stringvalidator.RegexMatches(regexp.MustCompile(`^(\p{L}|\p{Nd}|\p{P}| )+$`), "can contain upper- and lower-case letters, numbers, and punctuation characters")
+var trustPasswordValidator validator.String = stringvalidator.RegexMatches(regexache.MustCompile(`^(\p{L}|\p{Nd}|\p{P}| )+$`), "can contain upper- and lower-case letters, numbers, and punctuation characters")
diff --git a/internal/service/ds/validate_test.go b/internal/service/ds/validate_test.go
index 964c3aa4bed..bf44b10396f 100644
--- a/internal/service/ds/validate_test.go
+++ b/internal/service/ds/validate_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ds
 
 import (
diff --git a/internal/service/ds/wait.go b/internal/service/ds/wait.go
index 64946f1fcbd..fbba0196e2e 100644
--- a/internal/service/ds/wait.go
+++ b/internal/service/ds/wait.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ds
 
 import (
diff --git a/internal/service/dynamodb/arn.go b/internal/service/dynamodb/arn.go
index 8aedf611f50..5d895c5b854 100644
--- a/internal/service/dynamodb/arn.go
+++ b/internal/service/dynamodb/arn.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package dynamodb
 
 import (
diff --git a/internal/service/dynamodb/arn_test.go b/internal/service/dynamodb/arn_test.go
index bf8de6db4bd..afc91f394bb 100644
--- a/internal/service/dynamodb/arn_test.go
+++ b/internal/service/dynamodb/arn_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package dynamodb_test
 
 import (
diff --git a/internal/service/dynamodb/backup.go b/internal/service/dynamodb/backup.go
index 793f42bc782..2af2f0c6b22 100644
--- a/internal/service/dynamodb/backup.go
+++ b/internal/service/dynamodb/backup.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package dynamodb
 
 import (
@@ -7,7 +10,7 @@ import (
 	"github.com/aws/aws-sdk-go/service/dynamodb"
 )
 
-func listBackupsPages(ctx context.Context, conn *dynamodb.DynamoDB, input *dynamodb.ListBackupsInput, fn func(*dynamodb.ListBackupsOutput, bool) bool) error { //nolint:unused // This function is called from a sweeper.
+func listBackupsPages(ctx context.Context, conn *dynamodb.DynamoDB, input *dynamodb.ListBackupsInput, fn func(*dynamodb.ListBackupsOutput, bool) bool) error {
 	for {
 		output, err := conn.ListBackupsWithContext(ctx, input)
 		if err != nil {
diff --git a/internal/service/dynamodb/contributor_insights.go b/internal/service/dynamodb/contributor_insights.go
index 7029274db43..aac81d4b25a 100644
--- a/internal/service/dynamodb/contributor_insights.go
+++ b/internal/service/dynamodb/contributor_insights.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package dynamodb
 
 import (
diff --git a/internal/service/dynamodb/contributor_insights_test.go b/internal/service/dynamodb/contributor_insights_test.go
index 8b29520102a..30a2fc5297b 100644
--- a/internal/service/dynamodb/contributor_insights_test.go
+++ b/internal/service/dynamodb/contributor_insights_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package dynamodb_test
 
 import (
diff --git a/internal/service/dynamodb/exports_test.go b/internal/service/dynamodb/exports_test.go
index 49f5cd4e8da..b27e345cdb2 100644
--- a/internal/service/dynamodb/exports_test.go
+++ b/internal/service/dynamodb/exports_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package dynamodb
 
 // Exports for use in tests only.
diff --git a/internal/service/dynamodb/find.go b/internal/service/dynamodb/find.go
index 786ae94b40f..0a8f99d13a7 100644
--- a/internal/service/dynamodb/find.go
+++ b/internal/service/dynamodb/find.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package dynamodb
 
 import (
diff --git a/internal/service/dynamodb/flex.go b/internal/service/dynamodb/flex.go
index e0f22593aa4..a95e472decc 100644
--- a/internal/service/dynamodb/flex.go
+++ b/internal/service/dynamodb/flex.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package dynamodb
 
 import (
diff --git a/internal/service/dynamodb/flex_test.go b/internal/service/dynamodb/flex_test.go
index 3db08693a5a..ea6c67fad94 100644
--- a/internal/service/dynamodb/flex_test.go
+++ b/internal/service/dynamodb/flex_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package dynamodb
 
 import (
diff --git a/internal/service/dynamodb/forge.go b/internal/service/dynamodb/forge.go
index 005fe9f9de0..a5371b5d96f 100644
--- a/internal/service/dynamodb/forge.go
+++ b/internal/service/dynamodb/forge.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package dynamodb
 
 import (
diff --git a/internal/service/dynamodb/generate.go b/internal/service/dynamodb/generate.go
index 416e7fa3c25..d03931c957b 100644
--- a/internal/service/dynamodb/generate.go
+++ b/internal/service/dynamodb/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tagresource/main.go
 //go:generate go run ../../generate/tags/main.go -GetTag -ListTags -ListTagsOp=ListTagsOfResource -ServiceTagsSlice -UpdateTags -ParentNotFoundErrCode=ResourceNotFoundException
 //go:generate go run ../../generate/servicepackage/main.go
diff --git a/internal/service/dynamodb/global_table.go b/internal/service/dynamodb/global_table.go
index ebc894054c4..baeee3e13b2 100644
--- a/internal/service/dynamodb/global_table.go
+++ b/internal/service/dynamodb/global_table.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package dynamodb
 
 import (
diff --git a/internal/service/dynamodb/global_table_test.go b/internal/service/dynamodb/global_table_test.go
index 8c6d8ae4fa6..8b977842240 100644
--- a/internal/service/dynamodb/global_table_test.go
+++ b/internal/service/dynamodb/global_table_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package dynamodb_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws/endpoints"
 	"github.com/aws/aws-sdk-go/service/dynamodb"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -34,21 +37,21 @@ func TestAccDynamoDBGlobalTable_basic(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccGlobalTableConfig_invalidName(sdkacctest.RandString(2)),
-				ExpectError: regexp.MustCompile("name length must be between 3 and 255 characters"),
+				ExpectError: regexache.MustCompile("name length must be between 3 and 255 characters"),
 			},
 			{
 				Config:      testAccGlobalTableConfig_invalidName(sdkacctest.RandString(256)),
-				ExpectError: regexp.MustCompile("name length must be between 3 and 255 characters"),
+				ExpectError: regexache.MustCompile("name length must be between 3 and 255 characters"),
 			},
 			{
 				Config:      testAccGlobalTableConfig_invalidName("!!!!"),
-				ExpectError: regexp.MustCompile("name must only include alphanumeric, underscore, period, or hyphen characters"),
+				ExpectError: regexache.MustCompile("name must only include alphanumeric, underscore, period, or hyphen characters"),
 			},
 			{
 				Config: testAccGlobalTableConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckGlobalTableExists(ctx, resourceName),
-					acctest.MatchResourceAttrGlobalARN(resourceName, names.AttrARN, "dynamodb", regexp.MustCompile("global-table/[a-z0-9-]+$")),
+					acctest.MatchResourceAttrGlobalARN(resourceName, names.AttrARN, "dynamodb", regexache.MustCompile("global-table/[0-9a-z-]+$")),
 					resource.TestCheckResourceAttr(resourceName, names.AttrName, rName),
 					resource.TestCheckResourceAttr(resourceName, "replica.#", "1"),
 				),
@@ -81,7 +84,7 @@ func TestAccDynamoDBGlobalTable_multipleRegions(t *testing.T) {
 				Config: testAccGlobalTableConfig_multipleRegions1(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckGlobalTableExists(ctx, resourceName),
-					acctest.MatchResourceAttrGlobalARN(resourceName, names.AttrARN, "dynamodb", regexp.MustCompile("global-table/[a-z0-9-]+$")),
+					acctest.MatchResourceAttrGlobalARN(resourceName, names.AttrARN, "dynamodb", regexache.MustCompile("global-table/[0-9a-z-]+$")),
 					resource.TestCheckResourceAttr(resourceName, names.AttrName, rName),
 					resource.TestCheckResourceAttr(resourceName, "replica.#", "1"),
 				),
diff --git a/internal/service/dynamodb/kinesis_streaming_destination.go b/internal/service/dynamodb/kinesis_streaming_destination.go
index 28b6dbeb6ef..d2e10e34e81 100644
--- a/internal/service/dynamodb/kinesis_streaming_destination.go
+++ b/internal/service/dynamodb/kinesis_streaming_destination.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package dynamodb
 
 import (
diff --git a/internal/service/dynamodb/kinesis_streaming_destination_test.go b/internal/service/dynamodb/kinesis_streaming_destination_test.go
index afcb9c496ef..3c083929c54 100644
--- a/internal/service/dynamodb/kinesis_streaming_destination_test.go
+++ b/internal/service/dynamodb/kinesis_streaming_destination_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package dynamodb_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/dynamodb"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -31,7 +34,7 @@ func TestAccDynamoDBKinesisStreamingDestination_basic(t *testing.T) {
 				Config: testAccKinesisStreamingDestinationConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckKinesisStreamingDestinationExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "stream_arn", "kinesis", regexp.MustCompile(fmt.Sprintf("stream/%s", rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "stream_arn", "kinesis", regexache.MustCompile(fmt.Sprintf("stream/%s", rName))),
 					resource.TestCheckResourceAttr(resourceName, "table_name", rName),
 				),
 			},
diff --git a/internal/service/dynamodb/service_package.go b/internal/service/dynamodb/service_package.go
index dbdad46f58b..8face023d55 100644
--- a/internal/service/dynamodb/service_package.go
+++ b/internal/service/dynamodb/service_package.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package dynamodb
 
 import (
diff --git a/internal/service/dynamodb/service_package_gen.go b/internal/service/dynamodb/service_package_gen.go
index 9034465bb8e..59299d79838 100644
--- a/internal/service/dynamodb/service_package_gen.go
+++ b/internal/service/dynamodb/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	dynamodb_sdkv1 "github.com/aws/aws-sdk-go/service/dynamodb"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -85,4 +86,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*d
 	return dynamodb_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/dynamodb/status.go b/internal/service/dynamodb/status.go
index 90ad1e095e0..4eb294b3641 100644
--- a/internal/service/dynamodb/status.go
+++ b/internal/service/dynamodb/status.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package dynamodb
 
 import (
diff --git a/internal/service/dynamodb/sweep.go b/internal/service/dynamodb/sweep.go
index 79669d53774..7a5d14cbc53 100644
--- a/internal/service/dynamodb/sweep.go
+++ b/internal/service/dynamodb/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package dynamodb
 
@@ -17,11 +17,12 @@ import (
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep/sdk"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_dynamodb_table", &resource.Sweeper{
 		Name: "aws_dynamodb_table",
 		F:    sweepTables,
@@ -35,7 +36,7 @@ func init() {
 
 func sweepTables(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
@@ -53,10 +54,19 @@ func sweepTables(region string) error {
 		}
 
 		for _, tableName := range page.TableNames {
+			id := aws.StringValue(tableName)
+
+			_, err := conn.UpdateTableWithContext(ctx, &dynamodb.UpdateTableInput{
+				DeletionProtectionEnabled: aws.Bool(false),
+				TableName:                 aws.String(id),
+			})
+
+			if err != nil {
+				log.Printf("[WARN] DynamoDB Table (%s): %s", id, err)
+			}
+
 			r := ResourceTable()
 			d := r.Data(nil)
-
-			id := aws.StringValue(tableName)
 			d.SetId(id)
 
 			// read concurrently and gather errors
@@ -92,11 +102,11 @@ func sweepTables(region string) error {
 		errs = multierror.Append(errs, fmt.Errorf("error concurrently reading DynamoDB Tables: %w", err))
 	}
 
-	if err = sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err = sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("error sweeping DynamoDB Tables for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
+	if awsv1.SkipSweepError(errs.ErrorOrNil()) {
 		log.Printf("[WARN] Skipping DynamoDB Tables sweep for %s: %s", region, errs)
 		return nil
 	}
@@ -106,7 +116,7 @@ func sweepTables(region string) error {
 
 func sweepBackups(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
@@ -148,11 +158,11 @@ func sweepBackups(region string) error {
 		errs = multierror.Append(errs, fmt.Errorf("reading DynamoDB Backups: %w", err))
 	}
 
-	if err = sweep.SweepOrchestratorWithContext(ctx, sweepables); err != nil {
+	if err = sweep.SweepOrchestrator(ctx, sweepables); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("sweeping DynamoDB Backups for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
+	if awsv1.SkipSweepError(errs.ErrorOrNil()) {
 		log.Printf("[WARN] Skipping DynamoDB Backups sweep for %s: %s", region, errs)
 		return nil
 	}
diff --git a/internal/service/dynamodb/table.go b/internal/service/dynamodb/table.go
index 5f68f835b6a..3140fb09310 100644
--- a/internal/service/dynamodb/table.go
+++ b/internal/service/dynamodb/table.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package dynamodb
 
 import (
@@ -15,6 +18,7 @@ import (
 	"github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/customdiff"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
@@ -303,6 +307,75 @@ func ResourceTable() *schema.Resource {
 					},
 				},
 			},
+			"import_table": {
+				Type:          schema.TypeList,
+				Optional:      true,
+				MaxItems:      1,
+				ConflictsWith: []string{"restore_source_name"},
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"input_compression_type": {
+							Type:         schema.TypeString,
+							Optional:     true,
+							ValidateFunc: validation.StringInSlice(dynamodb.InputCompressionType_Values(), false),
+						},
+						"input_format": {
+							Type:         schema.TypeString,
+							Required:     true,
+							ValidateFunc: validation.StringInSlice(dynamodb.InputFormat_Values(), false),
+						},
+						"input_format_options": {
+							Type:     schema.TypeList,
+							Optional: true,
+							MaxItems: 1,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"csv": {
+										Type:     schema.TypeList,
+										Optional: true,
+										MaxItems: 1,
+										Elem: &schema.Resource{
+											Schema: map[string]*schema.Schema{
+												"delimiter": {
+													Type:     schema.TypeString,
+													Optional: true,
+												},
+												"header_list": {
+													Type:     schema.TypeSet,
+													Optional: true,
+													Elem:     &schema.Schema{Type: schema.TypeString},
+												},
+											},
+										},
+									},
+								},
+							},
+						},
+						"s3_bucket_source": {
+							Type:     schema.TypeList,
+							MaxItems: 1,
+							Required: true,
+							ForceNew: true,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"bucket": {
+										Type:     schema.TypeString,
+										Required: true,
+									},
+									"bucket_owner": {
+										Type:     schema.TypeString,
+										Optional: true,
+									},
+									"key_prefix": {
+										Type:     schema.TypeString,
+										Optional: true,
+									},
+								},
+							},
+						},
+					},
+				},
+			},
 			"restore_date_time": {
 				Type:         schema.TypeString,
 				Optional:     true,
@@ -310,8 +383,9 @@ func ResourceTable() *schema.Resource {
 				ValidateFunc: verify.ValidUTCTimestamp,
 			},
 			"restore_source_name": {
-				Type:     schema.TypeString,
-				Optional: true,
+				Type:          schema.TypeString,
+				Optional:      true,
+				ConflictsWith: []string{"import_table"},
 			},
 			"restore_to_latest_time": {
 				Type:     schema.TypeBool,
@@ -480,6 +554,70 @@ func resourceTableCreate(ctx context.Context, d *schema.ResourceData, meta inter
 			return false, err
 		})
 
+		if err != nil {
+			return create.DiagError(names.DynamoDB, create.ErrActionCreating, ResNameTable, tableName, err)
+		}
+	} else if vit, ok := d.GetOk("import_table"); ok && len(vit.([]interface{})) > 0 && vit.([]interface{})[0] != nil {
+		input := expandImportTable(vit.([]interface{})[0].(map[string]interface{}))
+
+		tcp := &dynamodb.TableCreationParameters{
+			TableName:   aws.String(tableName),
+			BillingMode: aws.String(d.Get("billing_mode").(string)),
+			KeySchema:   expandKeySchema(keySchemaMap),
+		}
+
+		capacityMap := map[string]interface{}{
+			"write_capacity": d.Get("write_capacity"),
+			"read_capacity":  d.Get("read_capacity"),
+		}
+
+		billingMode := d.Get("billing_mode").(string)
+
+		tcp.ProvisionedThroughput = expandProvisionedThroughput(capacityMap, billingMode)
+
+		if v, ok := d.GetOk("attribute"); ok {
+			aSet := v.(*schema.Set)
+			tcp.AttributeDefinitions = expandAttributes(aSet.List())
+		}
+
+		if v, ok := d.GetOk("server_side_encryption"); ok {
+			tcp.SSESpecification = expandEncryptAtRestOptions(v.([]interface{}))
+		}
+
+		if v, ok := d.GetOk("global_secondary_index"); ok {
+			globalSecondaryIndexes := []*dynamodb.GlobalSecondaryIndex{}
+			gsiSet := v.(*schema.Set)
+
+			for _, gsiObject := range gsiSet.List() {
+				gsi := gsiObject.(map[string]interface{})
+				if err := validateGSIProvisionedThroughput(gsi, billingMode); err != nil {
+					return create.DiagError(names.DynamoDB, create.ErrActionCreating, ResNameTable, d.Get("name").(string), err)
+				}
+
+				gsiObject := expandGlobalSecondaryIndex(gsi, billingMode)
+				globalSecondaryIndexes = append(globalSecondaryIndexes, gsiObject)
+			}
+			tcp.GlobalSecondaryIndexes = globalSecondaryIndexes
+		}
+
+		input.TableCreationParameters = tcp
+
+		_, err := tfresource.RetryWhen(ctx, createTableTimeout, func() (interface{}, error) {
+			return conn.ImportTableWithContext(ctx, input)
+		}, func(err error) (bool, error) {
+			if tfawserr.ErrCodeEquals(err, "ThrottlingException") {
+				return true, err
+			}
+			if tfawserr.ErrMessageContains(err, dynamodb.ErrCodeLimitExceededException, "can be created, updated, or deleted simultaneously") {
+				return true, err
+			}
+			if tfawserr.ErrMessageContains(err, dynamodb.ErrCodeLimitExceededException, "indexed tables that can be created simultaneously") {
+				return true, err
+			}
+
+			return false, err
+		})
+
 		if err != nil {
 			return create.DiagError(names.DynamoDB, create.ErrActionCreating, ResNameTable, tableName, err)
 		}
@@ -2021,6 +2159,30 @@ func expandLocalSecondaryIndexes(cfg []interface{}, keySchemaM map[string]interf
 	return indexes
 }
 
+func expandImportTable(data map[string]interface{}) *dynamodb.ImportTableInput {
+	a := &dynamodb.ImportTableInput{
+		ClientToken: aws.String(id.UniqueId()),
+	}
+
+	if v, ok := data["input_compression_type"].(string); ok {
+		a.InputCompressionType = aws.String(v)
+	}
+
+	if v, ok := data["input_format"].(string); ok {
+		a.InputFormat = aws.String(v)
+	}
+
+	if v, ok := data["input_format_options"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
+		a.InputFormatOptions = expandInputFormatOptions(v)
+	}
+
+	if v, ok := data["s3_bucket_source"].([]interface{}); ok && len(v) > 0 {
+		a.S3BucketSource = expandS3BucketSource(v[0].(map[string]interface{}))
+	}
+
+	return a
+}
+
 func expandGlobalSecondaryIndex(data map[string]interface{}, billingMode string) *dynamodb.GlobalSecondaryIndex {
 	return &dynamodb.GlobalSecondaryIndex{
 		IndexName:             aws.String(data[names.AttrName].(string)),
@@ -2111,6 +2273,53 @@ func expandEncryptAtRestOptions(vOptions []interface{}) *dynamodb.SSESpecificati
 	return options
 }
 
+func expandInputFormatOptions(data []interface{}) *dynamodb.InputFormatOptions {
+	if data == nil {
+		return nil
+	}
+
+	m := data[0].(map[string]interface{})
+	a := &dynamodb.InputFormatOptions{}
+
+	if v, ok := m["csv"].([]interface{}); ok && len(v) > 0 {
+		a.Csv = &dynamodb.CsvOptions{}
+
+		csv := v[0].(map[string]interface{})
+
+		if s, ok := csv["delimiter"].(string); ok && s != "" {
+			a.Csv.Delimiter = aws.String(s)
+		}
+
+		if s, ok := csv["header_list"].(*schema.Set); ok && s.Len() > 0 {
+			a.Csv.HeaderList = flex.ExpandStringSet(s)
+		}
+	}
+
+	return a
+}
+
+func expandS3BucketSource(data map[string]interface{}) *dynamodb.S3BucketSource {
+	if data == nil {
+		return nil
+	}
+
+	a := &dynamodb.S3BucketSource{}
+
+	if s, ok := data["bucket"].(string); ok && s != "" {
+		a.S3Bucket = aws.String(s)
+	}
+
+	if s, ok := data["bucket_owner"].(string); ok && s != "" {
+		a.S3BucketOwner = aws.String(s)
+	}
+
+	if s, ok := data["key_prefix"].(string); ok && s != "" {
+		a.S3KeyPrefix = aws.String(s)
+	}
+
+	return a
+}
+
 // validators
 
 func validateTableAttributes(d *schema.ResourceDiff) error {
diff --git a/internal/service/dynamodb/table_data_source.go b/internal/service/dynamodb/table_data_source.go
index 34e7bf17c33..6267ade462b 100644
--- a/internal/service/dynamodb/table_data_source.go
+++ b/internal/service/dynamodb/table_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package dynamodb
 
 import (
diff --git a/internal/service/dynamodb/table_data_source_test.go b/internal/service/dynamodb/table_data_source_test.go
index b8f20b5bdb0..0fcb8c294c7 100644
--- a/internal/service/dynamodb/table_data_source_test.go
+++ b/internal/service/dynamodb/table_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package dynamodb_test
 
 import (
diff --git a/internal/service/dynamodb/table_item.go b/internal/service/dynamodb/table_item.go
index e35e3e3bab6..fae285cb8ee 100644
--- a/internal/service/dynamodb/table_item.go
+++ b/internal/service/dynamodb/table_item.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package dynamodb
 
 import (
@@ -279,7 +282,7 @@ func BuildExpressionAttributeNames(attrs map[string]*dynamodb.AttributeValue) ma
 }
 
 func cleanKeyName(key string) string {
-	reg, err := regexp.Compile("[^a-zA-Z]+")
+	reg, err := regexp.Compile("[A-Za-z^]+") // suspect regexp
 	if err != nil {
 		log.Printf("[ERROR] clean keyname errored %v", err)
 	}
diff --git a/internal/service/dynamodb/table_item_data_source.go b/internal/service/dynamodb/table_item_data_source.go
index 076178e72bc..bfdb0695144 100644
--- a/internal/service/dynamodb/table_item_data_source.go
+++ b/internal/service/dynamodb/table_item_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package dynamodb
 
 import (
diff --git a/internal/service/dynamodb/table_item_data_source_test.go b/internal/service/dynamodb/table_item_data_source_test.go
index 71cd5fbc79d..32e42667992 100644
--- a/internal/service/dynamodb/table_item_data_source_test.go
+++ b/internal/service/dynamodb/table_item_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package dynamodb_test
 
 import (
diff --git a/internal/service/dynamodb/table_item_test.go b/internal/service/dynamodb/table_item_test.go
index be6b5c5e85f..69a1657e331 100644
--- a/internal/service/dynamodb/table_item_test.go
+++ b/internal/service/dynamodb/table_item_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package dynamodb_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/dynamodb"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -161,7 +164,7 @@ func TestAccDynamoDBTableItem_withDuplicateItemsSameRangeKey(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccTableItemConfig_multiple(tableName, hashKey, rangeKey, firstItem, firstItem),
-				ExpectError: regexp.MustCompile(`ConditionalCheckFailedException: The conditional request failed`),
+				ExpectError: regexache.MustCompile(`ConditionalCheckFailedException: The conditional request failed`),
 			},
 		},
 	})
diff --git a/internal/service/dynamodb/table_migrate.go b/internal/service/dynamodb/table_migrate.go
index 81be642d661..64654ae16e9 100644
--- a/internal/service/dynamodb/table_migrate.go
+++ b/internal/service/dynamodb/table_migrate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package dynamodb
 
 import (
diff --git a/internal/service/dynamodb/table_replica.go b/internal/service/dynamodb/table_replica.go
index 8fc4949d483..425c72a52e8 100644
--- a/internal/service/dynamodb/table_replica.go
+++ b/internal/service/dynamodb/table_replica.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package dynamodb
 
 import (
diff --git a/internal/service/dynamodb/table_replica_test.go b/internal/service/dynamodb/table_replica_test.go
index eb563cebe44..964566656db 100644
--- a/internal/service/dynamodb/table_replica_test.go
+++ b/internal/service/dynamodb/table_replica_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package dynamodb_test
 
 import (
diff --git a/internal/service/dynamodb/table_test.go b/internal/service/dynamodb/table_test.go
index 28d89e5a17d..48dbd842a7e 100644
--- a/internal/service/dynamodb/table_test.go
+++ b/internal/service/dynamodb/table_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package dynamodb_test
 
 import (
@@ -7,6 +10,7 @@ import (
 	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/dynamodb"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -848,7 +852,7 @@ func TestAccDynamoDBTable_streamSpecification(t *testing.T) {
 					testAccCheckInitialTableExists(ctx, resourceName, &conf),
 					resource.TestCheckResourceAttr(resourceName, "stream_enabled", "true"),
 					resource.TestCheckResourceAttr(resourceName, "stream_view_type", "KEYS_ONLY"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "stream_arn", "dynamodb", regexp.MustCompile(fmt.Sprintf("table/%s/stream", rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "stream_arn", "dynamodb", regexache.MustCompile(fmt.Sprintf("table/%s/stream", rName))),
 					resource.TestCheckResourceAttrSet(resourceName, "stream_label"),
 				),
 			},
@@ -863,7 +867,7 @@ func TestAccDynamoDBTable_streamSpecification(t *testing.T) {
 					testAccCheckInitialTableExists(ctx, resourceName, &conf),
 					resource.TestCheckResourceAttr(resourceName, "stream_enabled", "false"),
 					resource.TestCheckResourceAttr(resourceName, "stream_view_type", "KEYS_ONLY"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "stream_arn", "dynamodb", regexp.MustCompile(fmt.Sprintf("table/%s/stream", rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "stream_arn", "dynamodb", regexache.MustCompile(fmt.Sprintf("table/%s/stream", rName))),
 					resource.TestCheckResourceAttrSet(resourceName, "stream_label"),
 				),
 			},
@@ -889,7 +893,7 @@ func TestAccDynamoDBTable_streamSpecificationDiffs(t *testing.T) {
 					testAccCheckInitialTableExists(ctx, resourceName, &conf),
 					resource.TestCheckResourceAttr(resourceName, "stream_enabled", "true"),
 					resource.TestCheckResourceAttr(resourceName, "stream_view_type", "KEYS_ONLY"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "stream_arn", "dynamodb", regexp.MustCompile(fmt.Sprintf("table/%s/stream", rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "stream_arn", "dynamodb", regexache.MustCompile(fmt.Sprintf("table/%s/stream", rName))),
 					resource.TestCheckResourceAttrSet(resourceName, "stream_label"),
 				),
 			},
@@ -899,7 +903,7 @@ func TestAccDynamoDBTable_streamSpecificationDiffs(t *testing.T) {
 					testAccCheckInitialTableExists(ctx, resourceName, &conf),
 					resource.TestCheckResourceAttr(resourceName, "stream_enabled", "true"),
 					resource.TestCheckResourceAttr(resourceName, "stream_view_type", "NEW_IMAGE"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "stream_arn", "dynamodb", regexp.MustCompile(fmt.Sprintf("table/%s/stream", rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "stream_arn", "dynamodb", regexache.MustCompile(fmt.Sprintf("table/%s/stream", rName))),
 					resource.TestCheckResourceAttrSet(resourceName, "stream_label"),
 				),
 			},
@@ -909,7 +913,7 @@ func TestAccDynamoDBTable_streamSpecificationDiffs(t *testing.T) {
 					testAccCheckInitialTableExists(ctx, resourceName, &conf),
 					resource.TestCheckResourceAttr(resourceName, "stream_enabled", "false"),
 					resource.TestCheckResourceAttr(resourceName, "stream_view_type", "NEW_IMAGE"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "stream_arn", "dynamodb", regexp.MustCompile(fmt.Sprintf("table/%s/stream", rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "stream_arn", "dynamodb", regexache.MustCompile(fmt.Sprintf("table/%s/stream", rName))),
 					resource.TestCheckResourceAttrSet(resourceName, "stream_label"),
 				),
 			},
@@ -919,7 +923,7 @@ func TestAccDynamoDBTable_streamSpecificationDiffs(t *testing.T) {
 					testAccCheckInitialTableExists(ctx, resourceName, &conf),
 					resource.TestCheckResourceAttr(resourceName, "stream_enabled", "false"),
 					resource.TestCheckResourceAttr(resourceName, "stream_view_type", "KEYS_ONLY"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "stream_arn", "dynamodb", regexp.MustCompile(fmt.Sprintf("table/%s/stream", rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "stream_arn", "dynamodb", regexache.MustCompile(fmt.Sprintf("table/%s/stream", rName))),
 					resource.TestCheckResourceAttrSet(resourceName, "stream_label"),
 				),
 			},
@@ -929,7 +933,7 @@ func TestAccDynamoDBTable_streamSpecificationDiffs(t *testing.T) {
 					testAccCheckInitialTableExists(ctx, resourceName, &conf),
 					resource.TestCheckResourceAttr(resourceName, "stream_enabled", "false"),
 					resource.TestCheckResourceAttr(resourceName, "stream_view_type", "KEYS_ONLY"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "stream_arn", "dynamodb", regexp.MustCompile(fmt.Sprintf("table/%s/stream", rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "stream_arn", "dynamodb", regexache.MustCompile(fmt.Sprintf("table/%s/stream", rName))),
 					resource.TestCheckResourceAttrSet(resourceName, "stream_label"),
 				),
 			},
@@ -939,7 +943,7 @@ func TestAccDynamoDBTable_streamSpecificationDiffs(t *testing.T) {
 					testAccCheckInitialTableExists(ctx, resourceName, &conf),
 					resource.TestCheckResourceAttr(resourceName, "stream_enabled", "true"),
 					resource.TestCheckResourceAttr(resourceName, "stream_view_type", "KEYS_ONLY"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "stream_arn", "dynamodb", regexp.MustCompile(fmt.Sprintf("table/%s/stream", rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "stream_arn", "dynamodb", regexache.MustCompile(fmt.Sprintf("table/%s/stream", rName))),
 					resource.TestCheckResourceAttrSet(resourceName, "stream_label"),
 				),
 			},
@@ -949,7 +953,7 @@ func TestAccDynamoDBTable_streamSpecificationDiffs(t *testing.T) {
 					testAccCheckInitialTableExists(ctx, resourceName, &conf),
 					resource.TestCheckResourceAttr(resourceName, "stream_enabled", "true"),
 					resource.TestCheckResourceAttr(resourceName, "stream_view_type", "KEYS_ONLY"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "stream_arn", "dynamodb", regexp.MustCompile(fmt.Sprintf("table/%s/stream", rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "stream_arn", "dynamodb", regexache.MustCompile(fmt.Sprintf("table/%s/stream", rName))),
 					resource.TestCheckResourceAttrSet(resourceName, "stream_label"),
 				),
 			},
@@ -967,7 +971,7 @@ func TestAccDynamoDBTable_streamSpecificationValidation(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccTableConfig_streamSpecification("anything", true, ""),
-				ExpectError: regexp.MustCompile(`stream_view_type is required when stream_enabled = true`),
+				ExpectError: regexache.MustCompile(`stream_view_type is required when stream_enabled = true`),
 			},
 		},
 	})
@@ -1504,15 +1508,15 @@ func TestAccDynamoDBTable_attributeUpdateValidation(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccTableConfig_oneAttribute(rName, "firstKey", "unusedKey", "S"),
-				ExpectError: regexp.MustCompile(`attributes must be indexed. Unused attributes: \["unusedKey"\]`),
+				ExpectError: regexache.MustCompile(`attributes must be indexed. Unused attributes: \["unusedKey"\]`),
 			},
 			{
 				Config:      testAccTableConfig_twoAttributes(rName, "firstKey", "secondKey", "firstUnused", "N", "secondUnused", "S"),
-				ExpectError: regexp.MustCompile(`attributes must be indexed. Unused attributes: \["firstUnused"\ \"secondUnused\"]`),
+				ExpectError: regexache.MustCompile(`attributes must be indexed. Unused attributes: \["firstUnused"\ \"secondUnused\"]`),
 			},
 			{
 				Config:      testAccTableConfig_unmatchedIndexes(rName, "firstUnused", "secondUnused"),
-				ExpectError: regexp.MustCompile(`indexes must match a defined attribute. Unmatched indexes:`),
+				ExpectError: regexache.MustCompile(`indexes must match a defined attribute. Unmatched indexes:`),
 			},
 		},
 	})
@@ -1647,7 +1651,7 @@ func TestAccDynamoDBTable_Replica_single(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "replica.#", "1"),
 					acctest.CheckResourceAttrRegionalARN(resourceName, names.AttrARN, "dynamodb", fmt.Sprintf("table/%s", rName)),
 					resource.TestMatchTypeSetElemNestedAttrs(resourceName, "replica.*", map[string]*regexp.Regexp{
-						names.AttrARN: regexp.MustCompile(fmt.Sprintf(`:dynamodb:%s:`, acctest.AlternateRegion())),
+						names.AttrARN: regexache.MustCompile(fmt.Sprintf(`:dynamodb:%s:`, acctest.AlternateRegion())),
 					}),
 				),
 			},
@@ -1705,9 +1709,9 @@ func TestAccDynamoDBTable_Replica_singleStreamSpecification(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "replica.#", "1"),
 					acctest.CheckResourceAttrRegionalARN(resourceName, names.AttrARN, "dynamodb", fmt.Sprintf("table/%s", rName)),
 					resource.TestMatchTypeSetElemNestedAttrs(resourceName, "replica.*", map[string]*regexp.Regexp{
-						names.AttrARN:  regexp.MustCompile(fmt.Sprintf(`:dynamodb:%s:.*table/%s`, acctest.AlternateRegion(), rName)),
-						"stream_arn":   regexp.MustCompile(fmt.Sprintf(`:dynamodb:%s:.*table/%s/stream`, acctest.AlternateRegion(), rName)),
-						"stream_label": regexp.MustCompile(`[0-9]+.*:[0-9]+`),
+						names.AttrARN:  regexache.MustCompile(fmt.Sprintf(`:dynamodb:%s:.*table/%s`, acctest.AlternateRegion(), rName)),
+						"stream_arn":   regexache.MustCompile(fmt.Sprintf(`:dynamodb:%s:.*table/%s/stream`, acctest.AlternateRegion(), rName)),
+						"stream_label": regexache.MustCompile(`[0-9]+.*:[0-9]+`),
 					}),
 				),
 			},
@@ -2543,6 +2547,43 @@ func TestAccDynamoDBTable_backup_overrideEncryption(t *testing.T) {
 	})
 }
 
+// lintignore:AT002
+func TestAccDynamoDBTable_importTable(t *testing.T) {
+	ctx := acctest.Context(t)
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
+	var conf dynamodb.TableDescription
+	resourceName := "aws_dynamodb_table.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, dynamodb.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckTableDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccTableConfig_import(rName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckInitialTableExists(ctx, resourceName, &conf),
+					acctest.CheckResourceAttrRegionalARN(resourceName, "arn", "dynamodb", fmt.Sprintf("table/%s", rName)),
+					resource.TestCheckResourceAttr(resourceName, "name", rName),
+					resource.TestCheckResourceAttr(resourceName, "read_capacity", "1"),
+					resource.TestCheckResourceAttr(resourceName, "write_capacity", "1"),
+					resource.TestCheckResourceAttr(resourceName, "hash_key", rName),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "attribute.*", map[string]string{
+						"name": rName,
+						"type": "S",
+					}),
+					resource.TestCheckResourceAttr(resourceName, "table_class", "STANDARD"),
+				),
+			},
+		},
+	})
+}
+
 func testAccCheckTableDestroy(ctx context.Context) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		conn := acctest.Provider.Meta().(*conns.AWSClient).DynamoDBConn(ctx)
@@ -4406,3 +4447,38 @@ resource "aws_dynamodb_table" "test" {
 }
 `, rName)
 }
+
+func testAccTableConfig_import(rName string) string {
+	return fmt.Sprintf(`
+resource "aws_s3_bucket" "test" {
+  bucket = %[1]q
+}
+
+resource "aws_s3_bucket_object" "test" {
+  bucket  = aws_s3_bucket.test.bucket
+  key     = "data/somedoc.json"
+  content = "{\"Item\":{\"%[1]s\":{\"S\":\"test\"},\"field\":{\"S\":\"test\"}}}"
+}
+
+resource "aws_dynamodb_table" "test" {
+  name           = %[1]q
+  read_capacity  = 1
+  write_capacity = 1
+  hash_key       = %[1]q
+
+  attribute {
+    name = %[1]q
+    type = "S"
+  }
+
+  import_table {
+    input_compression_type = "NONE"
+    input_format           = "DYNAMODB_JSON"
+    s3_bucket_source {
+      bucket     = aws_s3_bucket.test.bucket
+      key_prefix = "data"
+    }
+  }
+}
+`, rName)
+}
diff --git a/internal/service/dynamodb/tag_test.go b/internal/service/dynamodb/tag_test.go
index 044235f52db..865363ba838 100644
--- a/internal/service/dynamodb/tag_test.go
+++ b/internal/service/dynamodb/tag_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package dynamodb_test
 
 import (
diff --git a/internal/service/dynamodb/tags_gen.go b/internal/service/dynamodb/tags_gen.go
index 465fb194522..5945d531a9b 100644
--- a/internal/service/dynamodb/tags_gen.go
+++ b/internal/service/dynamodb/tags_gen.go
@@ -9,8 +9,10 @@ import (
 	"github.com/aws/aws-sdk-go/service/dynamodb"
 	"github.com/aws/aws-sdk-go/service/dynamodb/dynamodbiface"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
@@ -131,6 +133,8 @@ func updateTags(ctx context.Context, conn dynamodbiface.DynamoDBAPI, identifier
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.DynamoDB)
 	if len(removedTags) > 0 {
diff --git a/internal/service/dynamodb/validate.go b/internal/service/dynamodb/validate.go
index 9a17fbf5b98..975c23d4b36 100644
--- a/internal/service/dynamodb/validate.go
+++ b/internal/service/dynamodb/validate.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package dynamodb
 
 import (
 	"errors"
 	"fmt"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 )
 
@@ -14,8 +17,8 @@ func validGlobalTableName(v interface{}, k string) (ws []string, errors []error)
 	if (len(value) > 255) || (len(value) < 3) {
 		errors = append(errors, fmt.Errorf("%s length must be between 3 and 255 characters: %q", k, value))
 	}
-	pattern := `^[a-zA-Z0-9_.-]+$`
-	if !regexp.MustCompile(pattern).MatchString(value) {
+	pattern := `^[0-9A-Za-z_.-]+$`
+	if !regexache.MustCompile(pattern).MatchString(value) {
 		errors = append(errors, fmt.Errorf("%s must only include alphanumeric, underscore, period, or hyphen characters: %q", k, value))
 	}
 	return
diff --git a/internal/service/dynamodb/wait.go b/internal/service/dynamodb/wait.go
index 966e43a4877..ab26a11dae6 100644
--- a/internal/service/dynamodb/wait.go
+++ b/internal/service/dynamodb/wait.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package dynamodb
 
 import (
diff --git a/internal/service/ec2/arn.go b/internal/service/ec2/arn.go
index 99d1712b487..79929c08f99 100644
--- a/internal/service/ec2/arn.go
+++ b/internal/service/ec2/arn.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/arn_test.go b/internal/service/ec2/arn_test.go
index d979aa7817c..aa62bf1eb2d 100644
--- a/internal/service/ec2/arn_test.go
+++ b/internal/service/ec2/arn_test.go
@@ -1,9 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
 	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	tfec2 "github.com/hashicorp/terraform-provider-aws/internal/service/ec2"
 )
 
@@ -19,27 +23,27 @@ func TestInstanceProfileARNToName(t *testing.T) {
 		{
 			TestName:      "empty ARN",
 			InputARN:      "",
-			ExpectedError: regexp.MustCompile(`parsing ARN`),
+			ExpectedError: regexache.MustCompile(`parsing ARN`),
 		},
 		{
 			TestName:      "unparsable ARN",
 			InputARN:      "test",
-			ExpectedError: regexp.MustCompile(`parsing ARN`),
+			ExpectedError: regexache.MustCompile(`parsing ARN`),
 		},
 		{
 			TestName:      "invalid ARN service",
 			InputARN:      "arn:aws:ec2:us-east-1:123456789012:instance/i-12345678", //lintignore:AWSAT003,AWSAT005
-			ExpectedError: regexp.MustCompile(`expected service iam`),
+			ExpectedError: regexache.MustCompile(`expected service iam`),
 		},
 		{
 			TestName:      "invalid ARN resource parts",
 			InputARN:      "arn:aws:iam:us-east-1:123456789012:name", //lintignore:AWSAT003,AWSAT005
-			ExpectedError: regexp.MustCompile(`expected at least 2 resource parts`),
+			ExpectedError: regexache.MustCompile(`expected at least 2 resource parts`),
 		},
 		{
 			TestName:      "invalid ARN resource prefix",
 			InputARN:      "arn:aws:iam:us-east-1:123456789012:role/name", //lintignore:AWSAT003,AWSAT005
-			ExpectedError: regexp.MustCompile(`expected resource prefix instance-profile`),
+			ExpectedError: regexache.MustCompile(`expected resource prefix instance-profile`),
 		},
 		{
 			TestName:     "valid ARN",
diff --git a/internal/service/ec2/common_schema_data_source.go b/internal/service/ec2/common_schema_data_source.go
deleted file mode 100644
index 6c71048d437..00000000000
--- a/internal/service/ec2/common_schema_data_source.go
+++ /dev/null
@@ -1,44 +0,0 @@
-package ec2
-
-import (
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/ec2"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
-)
-
-func BuildFiltersDataSource(set *schema.Set) []*ec2.Filter {
-	var filters []*ec2.Filter
-	for _, v := range set.List() {
-		m := v.(map[string]interface{})
-		var filterValues []*string
-		for _, e := range m["values"].([]interface{}) {
-			filterValues = append(filterValues, aws.String(e.(string)))
-		}
-		filters = append(filters, &ec2.Filter{
-			Name:   aws.String(m["name"].(string)),
-			Values: filterValues,
-		})
-	}
-	return filters
-}
-
-func DataSourceFiltersSchema() *schema.Schema {
-	return &schema.Schema{
-		Type:     schema.TypeSet,
-		Optional: true,
-		Elem: &schema.Resource{
-			Schema: map[string]*schema.Schema{
-				"name": {
-					Type:     schema.TypeString,
-					Required: true,
-				},
-
-				"values": {
-					Type:     schema.TypeList,
-					Required: true,
-					Elem:     &schema.Schema{Type: schema.TypeString},
-				},
-			},
-		},
-	}
-}
diff --git a/internal/service/ec2/consts.go b/internal/service/ec2/consts.go
index ab979ce5f97..787d400d004 100644
--- a/internal/service/ec2/consts.go
+++ b/internal/service/ec2/consts.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/diff.go b/internal/service/ec2/diff.go
index 4112198db9f..a55acdb51d8 100644
--- a/internal/service/ec2/diff.go
+++ b/internal/service/ec2/diff.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
-	"github.com/hashicorp/terraform-provider-aws/internal/verify"
+	"github.com/hashicorp/terraform-provider-aws/internal/types"
 )
 
 // suppressEqualCIDRBlockDiffs provides custom difference suppression for CIDR blocks
 // that have different string values but represent the same CIDR.
 func suppressEqualCIDRBlockDiffs(k, old, new string, d *schema.ResourceData) bool {
-	return verify.CIDRBlocksEqual(old, new)
+	return types.CIDRBlocksEqual(old, new)
 }
diff --git a/internal/service/ec2/ebs_default_kms_key.go b/internal/service/ec2/ebs_default_kms_key.go
index add8cadcc6e..f785001e232 100644
--- a/internal/service/ec2/ebs_default_kms_key.go
+++ b/internal/service/ec2/ebs_default_kms_key.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/ebs_default_kms_key_data_source.go b/internal/service/ec2/ebs_default_kms_key_data_source.go
index 02eca3fb6dc..4a402abe039 100644
--- a/internal/service/ec2/ebs_default_kms_key_data_source.go
+++ b/internal/service/ec2/ebs_default_kms_key_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/ebs_default_kms_key_data_source_test.go b/internal/service/ec2/ebs_default_kms_key_data_source_test.go
index 4df502a1de9..6deb4b5d5d2 100644
--- a/internal/service/ec2/ebs_default_kms_key_data_source_test.go
+++ b/internal/service/ec2/ebs_default_kms_key_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/ebs_default_kms_key_test.go b/internal/service/ec2/ebs_default_kms_key_test.go
index b6a06a4223d..60250c0e3b4 100644
--- a/internal/service/ec2/ebs_default_kms_key_test.go
+++ b/internal/service/ec2/ebs_default_kms_key_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/ebs_encryption_by_default.go b/internal/service/ec2/ebs_encryption_by_default.go
index aa11d24abf6..a796c7719f8 100644
--- a/internal/service/ec2/ebs_encryption_by_default.go
+++ b/internal/service/ec2/ebs_encryption_by_default.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/ebs_encryption_by_default_data_source.go b/internal/service/ec2/ebs_encryption_by_default_data_source.go
index eaf3c2f8598..6007282e918 100644
--- a/internal/service/ec2/ebs_encryption_by_default_data_source.go
+++ b/internal/service/ec2/ebs_encryption_by_default_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/ebs_encryption_by_default_data_source_test.go b/internal/service/ec2/ebs_encryption_by_default_data_source_test.go
index 40871778178..6ba6860542e 100644
--- a/internal/service/ec2/ebs_encryption_by_default_data_source_test.go
+++ b/internal/service/ec2/ebs_encryption_by_default_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/ebs_encryption_by_default_test.go b/internal/service/ec2/ebs_encryption_by_default_test.go
index 0ea8bb2ab31..ef8f801497a 100644
--- a/internal/service/ec2/ebs_encryption_by_default_test.go
+++ b/internal/service/ec2/ebs_encryption_by_default_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/ebs_snapshot.go b/internal/service/ec2/ebs_snapshot.go
index 3e71ed7468d..daa55f8c27b 100644
--- a/internal/service/ec2/ebs_snapshot.go
+++ b/internal/service/ec2/ebs_snapshot.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/ebs_snapshot_copy.go b/internal/service/ec2/ebs_snapshot_copy.go
index 1e5646748e0..f56c76d8af9 100644
--- a/internal/service/ec2/ebs_snapshot_copy.go
+++ b/internal/service/ec2/ebs_snapshot_copy.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/ebs_snapshot_copy_test.go b/internal/service/ec2/ebs_snapshot_copy_test.go
index 98b02559ef6..a119231ab52 100644
--- a/internal/service/ec2/ebs_snapshot_copy_test.go
+++ b/internal/service/ec2/ebs_snapshot_copy_test.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -28,7 +31,7 @@ func TestAccEC2EBSSnapshotCopy_basic(t *testing.T) {
 				Config: testAccEBSSnapshotCopyConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckSnapshotExists(ctx, resourceName, &snapshot),
-					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "ec2", regexp.MustCompile(`snapshot/snap-.+`)),
+					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "ec2", regexache.MustCompile(`snapshot/snap-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 				),
 			},
diff --git a/internal/service/ec2/ebs_snapshot_create_volume_permission.go b/internal/service/ec2/ebs_snapshot_create_volume_permission.go
index 1c4165e42a3..a2698888885 100644
--- a/internal/service/ec2/ebs_snapshot_create_volume_permission.go
+++ b/internal/service/ec2/ebs_snapshot_create_volume_permission.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/ebs_snapshot_create_volume_permission_test.go b/internal/service/ec2/ebs_snapshot_create_volume_permission_test.go
index 5524a6872c2..01f0b1f0705 100644
--- a/internal/service/ec2/ebs_snapshot_create_volume_permission_test.go
+++ b/internal/service/ec2/ebs_snapshot_create_volume_permission_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -80,7 +83,7 @@ func TestAccEC2EBSSnapshotCreateVolumePermission_snapshotOwnerExpectError(t *tes
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccEBSSnapshotCreateVolumePermissionConfig_snapshotOwner(rName),
-				ExpectError: regexp.MustCompile(`owns EBS Snapshot`),
+				ExpectError: regexache.MustCompile(`owns EBS Snapshot`),
 			},
 		},
 	})
diff --git a/internal/service/ec2/ebs_snapshot_data_source.go b/internal/service/ec2/ebs_snapshot_data_source.go
index 7adec1375dc..f9754c8b9ea 100644
--- a/internal/service/ec2/ebs_snapshot_data_source.go
+++ b/internal/service/ec2/ebs_snapshot_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -43,7 +46,7 @@ func DataSourceEBSSnapshot() *schema.Resource {
 				Type:     schema.TypeBool,
 				Computed: true,
 			},
-			"filter": DataSourceFiltersSchema(),
+			"filter": CustomFiltersSchema(),
 			"kms_key_id": {
 				Type:     schema.TypeString,
 				Computed: true,
@@ -124,7 +127,7 @@ func dataSourceEBSSnapshotRead(ctx context.Context, d *schema.ResourceData, meta
 		input.SnapshotIds = flex.ExpandStringList(v.([]interface{}))
 	}
 
-	input.Filters = append(input.Filters, BuildFiltersDataSource(
+	input.Filters = append(input.Filters, BuildCustomFilterList(
 		d.Get("filter").(*schema.Set),
 	)...)
 
diff --git a/internal/service/ec2/ebs_snapshot_data_source_test.go b/internal/service/ec2/ebs_snapshot_data_source_test.go
index 904493826ab..024e9866b5f 100644
--- a/internal/service/ec2/ebs_snapshot_data_source_test.go
+++ b/internal/service/ec2/ebs_snapshot_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/ebs_snapshot_ids_data_source.go b/internal/service/ec2/ebs_snapshot_ids_data_source.go
index 820b57acb64..5d921c7ef86 100644
--- a/internal/service/ec2/ebs_snapshot_ids_data_source.go
+++ b/internal/service/ec2/ebs_snapshot_ids_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -24,7 +27,7 @@ func DataSourceEBSSnapshotIDs() *schema.Resource {
 		},
 
 		Schema: map[string]*schema.Schema{
-			"filter": DataSourceFiltersSchema(),
+			"filter": CustomFiltersSchema(),
 			"ids": {
 				Type:     schema.TypeList,
 				Computed: true,
@@ -58,7 +61,7 @@ func dataSourceEBSSnapshotIDsRead(ctx context.Context, d *schema.ResourceData, m
 		input.RestorableByUserIds = flex.ExpandStringList(v.([]interface{}))
 	}
 
-	input.Filters = append(input.Filters, BuildFiltersDataSource(
+	input.Filters = append(input.Filters, BuildCustomFilterList(
 		d.Get("filter").(*schema.Set),
 	)...)
 
diff --git a/internal/service/ec2/ebs_snapshot_ids_data_source_test.go b/internal/service/ec2/ebs_snapshot_ids_data_source_test.go
index 4df8eddb899..272e43e5c53 100644
--- a/internal/service/ec2/ebs_snapshot_ids_data_source_test.go
+++ b/internal/service/ec2/ebs_snapshot_ids_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/ebs_snapshot_import.go b/internal/service/ec2/ebs_snapshot_import.go
index a774065950b..e25ceb77dce 100644
--- a/internal/service/ec2/ebs_snapshot_import.go
+++ b/internal/service/ec2/ebs_snapshot_import.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -221,7 +224,7 @@ func resourceEBSSnapshotImportCreate(ctx context.Context, d *schema.ResourceData
 		input.RoleName = aws.String(v.(string))
 	}
 
-	outputRaw, err := tfresource.RetryWhenAWSErrMessageContains(ctx, propagationTimeout,
+	outputRaw, err := tfresource.RetryWhenAWSErrMessageContains(ctx, iamPropagationTimeout,
 		func() (interface{}, error) {
 			return conn.ImportSnapshotWithContext(ctx, input)
 		},
diff --git a/internal/service/ec2/ebs_snapshot_import_test.go b/internal/service/ec2/ebs_snapshot_import_test.go
index 188ea31e708..0191212ddce 100644
--- a/internal/service/ec2/ebs_snapshot_import_test.go
+++ b/internal/service/ec2/ebs_snapshot_import_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
@@ -5,10 +8,10 @@ import (
 	"encoding/base64"
 	"fmt"
 	"io"
-	"regexp"
 	"strings"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -33,7 +36,7 @@ func TestAccEC2EBSSnapshotImport_basic(t *testing.T) {
 				Config: testAccEBSSnapshotImportConfig_basic(t, rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckSnapshotExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "ec2", regexp.MustCompile(`snapshot/snap-.+`)),
+					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "ec2", regexache.MustCompile(`snapshot/snap-.+`)),
 					acctest.CheckResourceAttrAccountID(resourceName, "owner_id"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 				),
diff --git a/internal/service/ec2/ebs_snapshot_test.go b/internal/service/ec2/ebs_snapshot_test.go
index baeab6df999..5be338d5843 100644
--- a/internal/service/ec2/ebs_snapshot_test.go
+++ b/internal/service/ec2/ebs_snapshot_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -32,7 +35,7 @@ func TestAccEC2EBSSnapshot_basic(t *testing.T) {
 				Config: testAccEBSSnapshotConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckSnapshotExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "ec2", regexp.MustCompile(`snapshot/snap-.+`)),
+					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "ec2", regexache.MustCompile(`snapshot/snap-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
 					resource.TestCheckResourceAttr(resourceName, "outpost_arn", ""),
 					acctest.CheckResourceAttrAccountID(resourceName, "owner_id"),
diff --git a/internal/service/ec2/ebs_volume.go b/internal/service/ec2/ebs_volume.go
index bc47fe644e3..311db606076 100644
--- a/internal/service/ec2/ebs_volume.go
+++ b/internal/service/ec2/ebs_volume.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/ebs_volume_attachment.go b/internal/service/ec2/ebs_volume_attachment.go
index d9264ab29bb..734798f3fb1 100644
--- a/internal/service/ec2/ebs_volume_attachment.go
+++ b/internal/service/ec2/ebs_volume_attachment.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/ebs_volume_attachment_test.go b/internal/service/ec2/ebs_volume_attachment_test.go
index 45dd34ea266..833c5735535 100644
--- a/internal/service/ec2/ebs_volume_attachment_test.go
+++ b/internal/service/ec2/ebs_volume_attachment_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/ebs_volume_data_source.go b/internal/service/ec2/ebs_volume_data_source.go
index 308a1ea12ec..42d91b6e574 100644
--- a/internal/service/ec2/ebs_volume_data_source.go
+++ b/internal/service/ec2/ebs_volume_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -38,7 +41,7 @@ func DataSourceEBSVolume() *schema.Resource {
 				Type:     schema.TypeBool,
 				Computed: true,
 			},
-			"filter": DataSourceFiltersSchema(),
+			"filter": CustomFiltersSchema(),
 			"iops": {
 				Type:     schema.TypeInt,
 				Computed: true,
@@ -92,7 +95,7 @@ func dataSourceEBSVolumeRead(ctx context.Context, d *schema.ResourceData, meta i
 
 	input := &ec2.DescribeVolumesInput{}
 
-	input.Filters = append(input.Filters, BuildFiltersDataSource(
+	input.Filters = append(input.Filters, BuildCustomFilterList(
 		d.Get("filter").(*schema.Set),
 	)...)
 
diff --git a/internal/service/ec2/ebs_volume_data_source_test.go b/internal/service/ec2/ebs_volume_data_source_test.go
index 80db98eaee3..43243c71beb 100644
--- a/internal/service/ec2/ebs_volume_data_source_test.go
+++ b/internal/service/ec2/ebs_volume_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/ebs_volume_test.go b/internal/service/ec2/ebs_volume_test.go
index d01953c7f22..a22038d5df0 100644
--- a/internal/service/ec2/ebs_volume_test.go
+++ b/internal/service/ec2/ebs_volume_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -32,7 +35,7 @@ func TestAccEC2EBSVolume_basic(t *testing.T) {
 				Config: testAccEBSVolumeConfig_basic,
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckVolumeExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexp.MustCompile(`volume/vol-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`volume/vol-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "encrypted", "false"),
 					resource.TestCheckResourceAttr(resourceName, "iops", "100"),
 					resource.TestCheckResourceAttr(resourceName, "kms_key_id", ""),
@@ -339,7 +342,7 @@ func TestAccEC2EBSVolume_invalidIopsForType(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccEBSVolumeConfig_invalidIOPSForType,
-				ExpectError: regexp.MustCompile(`'iops' must not be set when 'type' is`),
+				ExpectError: regexache.MustCompile(`'iops' must not be set when 'type' is`),
 			},
 		},
 	})
@@ -355,7 +358,7 @@ func TestAccEC2EBSVolume_invalidThroughputForType(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccEBSVolumeConfig_invalidThroughputForType,
-				ExpectError: regexp.MustCompile(`'throughput' must not be set when 'type' is`),
+				ExpectError: regexache.MustCompile(`'throughput' must not be set when 'type' is`),
 			},
 		},
 	})
@@ -479,7 +482,7 @@ func TestAccEC2EBSVolume_multiAttach_gp2(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccEBSVolumeConfig_invalidMultiAttachEnabledForType,
-				ExpectError: regexp.MustCompile(`'multi_attach_enabled' must not be set when 'type' is`),
+				ExpectError: regexache.MustCompile(`'multi_attach_enabled' must not be set when 'type' is`),
 			},
 		},
 	})
@@ -531,7 +534,7 @@ func TestAccEC2EBSVolume_GP3_basic(t *testing.T) {
 				Config: testAccEBSVolumeConfig_sizeTypeIOPSThroughput(rName, "10", "gp3", "", ""),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckVolumeExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexp.MustCompile(`volume/vol-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`volume/vol-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "encrypted", "false"),
 					resource.TestCheckResourceAttr(resourceName, "iops", "3000"),
 					resource.TestCheckResourceAttr(resourceName, "kms_key_id", ""),
@@ -571,7 +574,7 @@ func TestAccEC2EBSVolume_GP3_iops(t *testing.T) {
 				Config: testAccEBSVolumeConfig_sizeTypeIOPSThroughput(rName, "10", "gp3", "4000", "200"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckVolumeExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexp.MustCompile(`volume/vol-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`volume/vol-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "encrypted", "false"),
 					resource.TestCheckResourceAttr(resourceName, "iops", "4000"),
 					resource.TestCheckResourceAttr(resourceName, "kms_key_id", ""),
@@ -595,7 +598,7 @@ func TestAccEC2EBSVolume_GP3_iops(t *testing.T) {
 				Config: testAccEBSVolumeConfig_sizeTypeIOPSThroughput(rName, "10", "gp3", "5000", "200"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckVolumeExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexp.MustCompile(`volume/vol-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`volume/vol-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "encrypted", "false"),
 					resource.TestCheckResourceAttr(resourceName, "iops", "5000"),
 					resource.TestCheckResourceAttr(resourceName, "kms_key_id", ""),
@@ -629,7 +632,7 @@ func TestAccEC2EBSVolume_GP3_throughput(t *testing.T) {
 				Config: testAccEBSVolumeConfig_sizeTypeIOPSThroughput(rName, "10", "gp3", "", "400"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckVolumeExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexp.MustCompile(`volume/vol-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`volume/vol-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "encrypted", "false"),
 					resource.TestCheckResourceAttr(resourceName, "iops", "3000"),
 					resource.TestCheckResourceAttr(resourceName, "kms_key_id", ""),
@@ -653,7 +656,7 @@ func TestAccEC2EBSVolume_GP3_throughput(t *testing.T) {
 				Config: testAccEBSVolumeConfig_sizeTypeIOPSThroughput(rName, "10", "gp3", "", "600"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckVolumeExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexp.MustCompile(`volume/vol-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`volume/vol-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "encrypted", "false"),
 					resource.TestCheckResourceAttr(resourceName, "iops", "3000"),
 					resource.TestCheckResourceAttr(resourceName, "kms_key_id", ""),
@@ -687,7 +690,7 @@ func TestAccEC2EBSVolume_gp3ToGP2(t *testing.T) {
 				Config: testAccEBSVolumeConfig_sizeTypeIOPSThroughput(rName, "10", "gp3", "3000", "400"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckVolumeExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexp.MustCompile(`volume/vol-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`volume/vol-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "encrypted", "false"),
 					resource.TestCheckResourceAttr(resourceName, "iops", "3000"),
 					resource.TestCheckResourceAttr(resourceName, "kms_key_id", ""),
@@ -711,7 +714,7 @@ func TestAccEC2EBSVolume_gp3ToGP2(t *testing.T) {
 				Config: testAccEBSVolumeConfig_sizeTypeIOPSThroughput(rName, "10", "gp2", "", ""),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckVolumeExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexp.MustCompile(`volume/vol-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`volume/vol-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "encrypted", "false"),
 					resource.TestCheckResourceAttr(resourceName, "iops", "100"),
 					resource.TestCheckResourceAttr(resourceName, "kms_key_id", ""),
@@ -745,7 +748,7 @@ func TestAccEC2EBSVolume_io1ToGP3(t *testing.T) {
 				Config: testAccEBSVolumeConfig_sizeTypeIOPSThroughput(rName, "100", "io1", "4000", ""),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckVolumeExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexp.MustCompile(`volume/vol-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`volume/vol-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "encrypted", "false"),
 					resource.TestCheckResourceAttr(resourceName, "iops", "4000"),
 					resource.TestCheckResourceAttr(resourceName, "kms_key_id", ""),
@@ -769,7 +772,7 @@ func TestAccEC2EBSVolume_io1ToGP3(t *testing.T) {
 				Config: testAccEBSVolumeConfig_sizeTypeIOPSThroughput(rName, "100", "gp3", "4000", "125"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckVolumeExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexp.MustCompile(`volume/vol-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`volume/vol-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "encrypted", "false"),
 					resource.TestCheckResourceAttr(resourceName, "iops", "4000"),
 					resource.TestCheckResourceAttr(resourceName, "kms_key_id", ""),
@@ -804,7 +807,7 @@ func TestAccEC2EBSVolume_snapshotID(t *testing.T) {
 				Config: testAccEBSVolumeConfig_snapshotID(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckVolumeExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexp.MustCompile(`volume/vol-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`volume/vol-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "encrypted", "false"),
 					resource.TestCheckResourceAttr(resourceName, "iops", "100"),
 					resource.TestCheckResourceAttr(resourceName, "kms_key_id", ""),
@@ -845,7 +848,7 @@ func TestAccEC2EBSVolume_snapshotIDAndSize(t *testing.T) {
 				Config: testAccEBSVolumeConfig_snapshotIdAndSize(rName, 20),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckVolumeExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexp.MustCompile(`volume/vol-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`volume/vol-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "encrypted", "false"),
 					resource.TestCheckResourceAttr(resourceName, "iops", "100"),
 					resource.TestCheckResourceAttr(resourceName, "kms_key_id", ""),
diff --git a/internal/service/ec2/ebs_volumes_data_source.go b/internal/service/ec2/ebs_volumes_data_source.go
index 5fc334f62a8..deeaac79d1c 100644
--- a/internal/service/ec2/ebs_volumes_data_source.go
+++ b/internal/service/ec2/ebs_volumes_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -23,7 +26,7 @@ func DataSourceEBSVolumes() *schema.Resource {
 		},
 
 		Schema: map[string]*schema.Schema{
-			"filter": DataSourceFiltersSchema(),
+			"filter": CustomFiltersSchema(),
 			"ids": {
 				Type:     schema.TypeList,
 				Computed: true,
@@ -44,7 +47,7 @@ func dataSourceEBSVolumesRead(ctx context.Context, d *schema.ResourceData, meta
 		Tags(tftags.New(ctx, d.Get("tags").(map[string]interface{}))),
 	)...)
 
-	input.Filters = append(input.Filters, BuildFiltersDataSource(
+	input.Filters = append(input.Filters, BuildCustomFilterList(
 		d.Get("filter").(*schema.Set),
 	)...)
 
diff --git a/internal/service/ec2/ebs_volumes_data_source_test.go b/internal/service/ec2/ebs_volumes_data_source_test.go
index 9d0dfad2b51..8e3ee3bcb99 100644
--- a/internal/service/ec2/ebs_volumes_data_source_test.go
+++ b/internal/service/ec2/ebs_volumes_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/ec2_ami.go b/internal/service/ec2/ec2_ami.go
index 3efce6a4f70..bf77c0a5750 100644
--- a/internal/service/ec2/ec2_ami.go
+++ b/internal/service/ec2/ec2_ami.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -385,7 +388,7 @@ func resourceAMIRead(ctx context.Context, d *schema.ResourceData, meta interface
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).EC2Conn(ctx)
 
-	outputRaw, err := tfresource.RetryWhenNewResourceNotFound(ctx, propagationTimeout, func() (interface{}, error) {
+	outputRaw, err := tfresource.RetryWhenNewResourceNotFound(ctx, ec2PropagationTimeout, func() (interface{}, error) {
 		return FindImageByID(ctx, conn, d.Id())
 	}, d.IsNewResource())
 
diff --git a/internal/service/ec2/ec2_ami_copy.go b/internal/service/ec2/ec2_ami_copy.go
index 20bc31a3e79..cc753688a0c 100644
--- a/internal/service/ec2/ec2_ami_copy.go
+++ b/internal/service/ec2/ec2_ami_copy.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/ec2_ami_copy_test.go b/internal/service/ec2/ec2_ami_copy_test.go
index 6dd77c5e9ad..38691af3ce8 100644
--- a/internal/service/ec2/ec2_ami_copy_test.go
+++ b/internal/service/ec2/ec2_ami_copy_test.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -30,7 +33,7 @@ func TestAccEC2AMICopy_basic(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckAMIExists(ctx, resourceName, &image),
 					testAccCheckAMICopyAttributes(&image, rName),
-					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "ec2", regexp.MustCompile(`image/ami-.+`)),
+					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "ec2", regexache.MustCompile(`image/ami-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "usage_operation", "RunInstances"),
 					resource.TestCheckResourceAttr(resourceName, "platform_details", "Linux/UNIX"),
 					resource.TestCheckResourceAttr(resourceName, "image_type", "machine"),
diff --git a/internal/service/ec2/ec2_ami_data_source.go b/internal/service/ec2/ec2_ami_data_source.go
index 9cd1fafeeee..2e154bdc6a9 100644
--- a/internal/service/ec2/ec2_ami_data_source.go
+++ b/internal/service/ec2/ec2_ami_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -5,10 +8,10 @@ import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"sort"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/aws/aws-sdk-go/service/ec2"
@@ -91,7 +94,7 @@ func DataSourceAMI() *schema.Resource {
 				Optional: true,
 				Elem:     &schema.Schema{Type: schema.TypeString},
 			},
-			"filter": DataSourceFiltersSchema(),
+			"filter": CustomFiltersSchema(),
 			"hypervisor": {
 				Type:     schema.TypeString,
 				Computed: true,
@@ -241,7 +244,7 @@ func dataSourceAMIRead(ctx context.Context, d *schema.ResourceData, meta interfa
 	}
 
 	if v, ok := d.GetOk("filter"); ok {
-		input.Filters = BuildFiltersDataSource(v.(*schema.Set))
+		input.Filters = BuildCustomFilterList(v.(*schema.Set))
 	}
 
 	if v, ok := d.GetOk("owners"); ok && len(v.([]interface{})) > 0 {
@@ -256,7 +259,7 @@ func dataSourceAMIRead(ctx context.Context, d *schema.ResourceData, meta interfa
 
 	var filteredImages []*ec2.Image
 	if v, ok := d.GetOk("name_regex"); ok {
-		r := regexp.MustCompile(v.(string))
+		r := regexache.MustCompile(v.(string))
 		for _, image := range images {
 			name := aws.StringValue(image.Name)
 
diff --git a/internal/service/ec2/ec2_ami_data_source_test.go b/internal/service/ec2/ec2_ami_data_source_test.go
index dc3b00ce2f6..adc2f32c686 100644
--- a/internal/service/ec2/ec2_ami_data_source_test.go
+++ b/internal/service/ec2/ec2_ami_data_source_test.go
@@ -1,9 +1,12 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -30,27 +33,27 @@ func TestAccEC2AMIDataSource_natInstance(t *testing.T) {
 					// Tags and product codes may need more testing, but I'm having a hard time finding images with
 					// these attributes set.
 					resource.TestCheckResourceAttr(datasourceName, "architecture", "x86_64"),
-					acctest.MatchResourceAttrRegionalARNNoAccount(datasourceName, "arn", "ec2", regexp.MustCompile(`image/ami-.+`)),
+					acctest.MatchResourceAttrRegionalARNNoAccount(datasourceName, "arn", "ec2", regexache.MustCompile(`image/ami-.+`)),
 					resource.TestCheckResourceAttr(datasourceName, "block_device_mappings.#", "1"),
-					resource.TestMatchResourceAttr(datasourceName, "creation_date", regexp.MustCompile("^20[0-9]{2}-")),
-					resource.TestMatchResourceAttr(datasourceName, "deprecation_time", regexp.MustCompile("^20[0-9]{2}-")),
-					resource.TestMatchResourceAttr(datasourceName, "description", regexp.MustCompile("^Amazon Linux AMI")),
+					resource.TestMatchResourceAttr(datasourceName, "creation_date", regexache.MustCompile("^20[0-9]{2}-")),
+					resource.TestMatchResourceAttr(datasourceName, "deprecation_time", regexache.MustCompile("^20[0-9]{2}-")),
+					resource.TestMatchResourceAttr(datasourceName, "description", regexache.MustCompile("^Amazon Linux AMI")),
 					resource.TestCheckResourceAttr(datasourceName, "ena_support", "true"),
 					resource.TestCheckResourceAttr(datasourceName, "hypervisor", "xen"),
-					resource.TestMatchResourceAttr(datasourceName, "image_id", regexp.MustCompile("^ami-")),
-					resource.TestMatchResourceAttr(datasourceName, "image_location", regexp.MustCompile("^amazon/")),
+					resource.TestMatchResourceAttr(datasourceName, "image_id", regexache.MustCompile("^ami-")),
+					resource.TestMatchResourceAttr(datasourceName, "image_location", regexache.MustCompile("^amazon/")),
 					resource.TestCheckResourceAttr(datasourceName, "image_owner_alias", "amazon"),
 					resource.TestCheckResourceAttr(datasourceName, "image_type", "machine"),
 					resource.TestCheckResourceAttr(datasourceName, "imds_support", ""),
 					resource.TestCheckResourceAttr(datasourceName, "most_recent", "true"),
-					resource.TestMatchResourceAttr(datasourceName, "name", regexp.MustCompile("^amzn-ami-vpc-nat")),
+					resource.TestMatchResourceAttr(datasourceName, "name", regexache.MustCompile("^amzn-ami-vpc-nat")),
 					acctest.MatchResourceAttrAccountID(datasourceName, "owner_id"),
 					resource.TestCheckResourceAttr(datasourceName, "platform_details", "Linux/UNIX"),
 					resource.TestCheckResourceAttr(datasourceName, "product_codes.#", "0"),
 					resource.TestCheckResourceAttr(datasourceName, "public", "true"),
 					resource.TestCheckResourceAttr(datasourceName, "root_device_name", "/dev/xvda"),
 					resource.TestCheckResourceAttr(datasourceName, "root_device_type", "ebs"),
-					resource.TestMatchResourceAttr(datasourceName, "root_snapshot_id", regexp.MustCompile("^snap-")),
+					resource.TestMatchResourceAttr(datasourceName, "root_snapshot_id", regexache.MustCompile("^snap-")),
 					resource.TestCheckResourceAttr(datasourceName, "sriov_net_support", "simple"),
 					resource.TestCheckResourceAttr(datasourceName, "state", "available"),
 					resource.TestCheckResourceAttr(datasourceName, "state_reason.code", "UNSET"),
@@ -78,32 +81,32 @@ func TestAccEC2AMIDataSource_windowsInstance(t *testing.T) {
 				Check: resource.ComposeAggregateTestCheckFunc(
 					resource.TestCheckResourceAttr(datasourceName, "architecture", "x86_64"),
 					resource.TestCheckResourceAttr(datasourceName, "block_device_mappings.#", "27"),
-					resource.TestMatchResourceAttr(datasourceName, "creation_date", regexp.MustCompile("^20[0-9]{2}-")),
-					resource.TestMatchResourceAttr(datasourceName, "deprecation_time", regexp.MustCompile("^20[0-9]{2}-")),
-					resource.TestMatchResourceAttr(datasourceName, "description", regexp.MustCompile("^Microsoft Windows Server")),
+					resource.TestMatchResourceAttr(datasourceName, "creation_date", regexache.MustCompile("^20[0-9]{2}-")),
+					resource.TestMatchResourceAttr(datasourceName, "deprecation_time", regexache.MustCompile("^20[0-9]{2}-")),
+					resource.TestMatchResourceAttr(datasourceName, "description", regexache.MustCompile("^Microsoft Windows Server")),
 					resource.TestCheckResourceAttr(datasourceName, "ena_support", "true"),
 					resource.TestCheckResourceAttr(datasourceName, "hypervisor", "xen"),
-					resource.TestMatchResourceAttr(datasourceName, "image_id", regexp.MustCompile("^ami-")),
-					resource.TestMatchResourceAttr(datasourceName, "image_location", regexp.MustCompile("^amazon/")),
+					resource.TestMatchResourceAttr(datasourceName, "image_id", regexache.MustCompile("^ami-")),
+					resource.TestMatchResourceAttr(datasourceName, "image_location", regexache.MustCompile("^amazon/")),
 					resource.TestCheckResourceAttr(datasourceName, "image_owner_alias", "amazon"),
 					resource.TestCheckResourceAttr(datasourceName, "image_type", "machine"),
 					resource.TestCheckResourceAttr(datasourceName, "most_recent", "true"),
-					resource.TestMatchResourceAttr(datasourceName, "name", regexp.MustCompile("^Windows_Server-2012-R2")),
+					resource.TestMatchResourceAttr(datasourceName, "name", regexache.MustCompile("^Windows_Server-2012-R2")),
 					acctest.MatchResourceAttrAccountID(datasourceName, "owner_id"),
 					resource.TestCheckResourceAttr(datasourceName, "platform", "windows"),
-					resource.TestMatchResourceAttr(datasourceName, "platform_details", regexp.MustCompile(`Windows`)),
+					resource.TestMatchResourceAttr(datasourceName, "platform_details", regexache.MustCompile(`Windows`)),
 					resource.TestCheckResourceAttr(datasourceName, "product_codes.#", "0"),
 					resource.TestCheckResourceAttr(datasourceName, "public", "true"),
 					resource.TestCheckResourceAttr(datasourceName, "root_device_name", "/dev/sda1"),
 					resource.TestCheckResourceAttr(datasourceName, "root_device_type", "ebs"),
-					resource.TestMatchResourceAttr(datasourceName, "root_snapshot_id", regexp.MustCompile("^snap-")),
+					resource.TestMatchResourceAttr(datasourceName, "root_snapshot_id", regexache.MustCompile("^snap-")),
 					resource.TestCheckResourceAttr(datasourceName, "sriov_net_support", "simple"),
 					resource.TestCheckResourceAttr(datasourceName, "state", "available"),
 					resource.TestCheckResourceAttr(datasourceName, "state_reason.code", "UNSET"),
 					resource.TestCheckResourceAttr(datasourceName, "state_reason.message", "UNSET"),
 					resource.TestCheckResourceAttr(datasourceName, "tags.%", "0"),
 					resource.TestCheckResourceAttr(datasourceName, "tpm_support", ""),
-					resource.TestMatchResourceAttr(datasourceName, "usage_operation", regexp.MustCompile(`^RunInstances`)),
+					resource.TestMatchResourceAttr(datasourceName, "usage_operation", regexache.MustCompile(`^RunInstances`)),
 					resource.TestCheckResourceAttr(datasourceName, "virtualization_type", "hvm"),
 				),
 			},
@@ -125,15 +128,15 @@ func TestAccEC2AMIDataSource_instanceStore(t *testing.T) {
 				Check: resource.ComposeAggregateTestCheckFunc(
 					resource.TestCheckResourceAttr(datasourceName, "architecture", "x86_64"),
 					resource.TestCheckResourceAttr(datasourceName, "block_device_mappings.#", "0"),
-					resource.TestMatchResourceAttr(datasourceName, "creation_date", regexp.MustCompile("^20[0-9]{2}-")),
-					resource.TestMatchResourceAttr(datasourceName, "deprecation_time", regexp.MustCompile("^20[0-9]{2}-")),
+					resource.TestMatchResourceAttr(datasourceName, "creation_date", regexache.MustCompile("^20[0-9]{2}-")),
+					resource.TestMatchResourceAttr(datasourceName, "deprecation_time", regexache.MustCompile("^20[0-9]{2}-")),
 					resource.TestCheckResourceAttr(datasourceName, "ena_support", "true"),
 					resource.TestCheckResourceAttr(datasourceName, "hypervisor", "xen"),
-					resource.TestMatchResourceAttr(datasourceName, "image_id", regexp.MustCompile("^ami-")),
-					resource.TestMatchResourceAttr(datasourceName, "image_location", regexp.MustCompile("amzn-ami-minimal-hvm")),
+					resource.TestMatchResourceAttr(datasourceName, "image_id", regexache.MustCompile("^ami-")),
+					resource.TestMatchResourceAttr(datasourceName, "image_location", regexache.MustCompile("amzn-ami-minimal-hvm")),
 					resource.TestCheckResourceAttr(datasourceName, "image_type", "machine"),
 					resource.TestCheckResourceAttr(datasourceName, "most_recent", "true"),
-					resource.TestMatchResourceAttr(datasourceName, "name", regexp.MustCompile("amzn-ami-minimal-hvm")),
+					resource.TestMatchResourceAttr(datasourceName, "name", regexache.MustCompile("amzn-ami-minimal-hvm")),
 					acctest.MatchResourceAttrAccountID(datasourceName, "owner_id"),
 					resource.TestCheckResourceAttr(datasourceName, "platform_details", "Linux/UNIX"),
 					resource.TestCheckResourceAttr(datasourceName, "product_codes.#", "0"),
@@ -166,7 +169,7 @@ func TestAccEC2AMIDataSource_localNameFilter(t *testing.T) {
 			{
 				Config: testAccAMIDataSourceConfig_nameRegex,
 				Check: resource.ComposeTestCheckFunc(
-					resource.TestMatchResourceAttr(datasourceName, "image_id", regexp.MustCompile("^ami-")),
+					resource.TestMatchResourceAttr(datasourceName, "image_id", regexache.MustCompile("^ami-")),
 				),
 			},
 		},
diff --git a/internal/service/ec2/ec2_ami_from_instance.go b/internal/service/ec2/ec2_ami_from_instance.go
index 009dedafcef..b15c02e9c02 100644
--- a/internal/service/ec2/ec2_ami_from_instance.go
+++ b/internal/service/ec2/ec2_ami_from_instance.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/ec2_ami_from_instance_test.go b/internal/service/ec2/ec2_ami_from_instance_test.go
index 1de81d672c3..1ad9c340728 100644
--- a/internal/service/ec2/ec2_ami_from_instance_test.go
+++ b/internal/service/ec2/ec2_ami_from_instance_test.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -28,7 +31,7 @@ func TestAccEC2AMIFromInstance_basic(t *testing.T) {
 				Config: testAccAMIFromInstanceConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckAMIExists(ctx, resourceName, &image),
-					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "ec2", regexp.MustCompile(`image/ami-.+`)),
+					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "ec2", regexache.MustCompile(`image/ami-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "description", "Testing Terraform aws_ami_from_instance resource"),
 					resource.TestCheckResourceAttr(resourceName, "usage_operation", "RunInstances"),
 					resource.TestCheckResourceAttr(resourceName, "platform_details", "Linux/UNIX"),
diff --git a/internal/service/ec2/ec2_ami_ids_data_source.go b/internal/service/ec2/ec2_ami_ids_data_source.go
index 65789a87632..91b1d641457 100644
--- a/internal/service/ec2/ec2_ami_ids_data_source.go
+++ b/internal/service/ec2/ec2_ami_ids_data_source.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"sort"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
@@ -33,7 +36,7 @@ func DataSourceAMIIDs() *schema.Resource {
 				Optional: true,
 				Elem:     &schema.Schema{Type: schema.TypeString},
 			},
-			"filter": DataSourceFiltersSchema(),
+			"filter": CustomFiltersSchema(),
 			"ids": {
 				Type:     schema.TypeList,
 				Computed: true,
@@ -81,7 +84,7 @@ func dataSourceAMIIDsRead(ctx context.Context, d *schema.ResourceData, meta inte
 	}
 
 	if v, ok := d.GetOk("filter"); ok {
-		input.Filters = BuildFiltersDataSource(v.(*schema.Set))
+		input.Filters = BuildCustomFilterList(v.(*schema.Set))
 	}
 
 	images, err := FindImages(ctx, conn, input)
@@ -94,7 +97,7 @@ func dataSourceAMIIDsRead(ctx context.Context, d *schema.ResourceData, meta inte
 	imageIDs := make([]string, 0)
 
 	if v, ok := d.GetOk("name_regex"); ok {
-		r := regexp.MustCompile(v.(string))
+		r := regexache.MustCompile(v.(string))
 		for _, image := range images {
 			name := aws.StringValue(image.Name)
 
diff --git a/internal/service/ec2/ec2_ami_ids_data_source_test.go b/internal/service/ec2/ec2_ami_ids_data_source_test.go
index fa18096882e..90647256381 100644
--- a/internal/service/ec2/ec2_ami_ids_data_source_test.go
+++ b/internal/service/ec2/ec2_ami_ids_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/ec2_ami_launch_permission.go b/internal/service/ec2/ec2_ami_launch_permission.go
index 306c8bc60f8..d53936cb138 100644
--- a/internal/service/ec2/ec2_ami_launch_permission.go
+++ b/internal/service/ec2/ec2_ami_launch_permission.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"strings"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/aws/aws-sdk-go/service/ec2"
@@ -165,7 +168,7 @@ func resourceAMILaunchPermissionImport(ctx context.Context, d *schema.ResourceDa
 	var ok bool
 	if n := len(parts); n >= 2 {
 		if permissionID, imageID := strings.Join(parts[:n-1], importIDSeparator), parts[n-1]; permissionID != "" && imageID != "" {
-			if regexp.MustCompile(`^\d{12}$`).MatchString(permissionID) {
+			if regexache.MustCompile(`^\d{12}$`).MatchString(permissionID) {
 				// AWS account ID.
 				d.SetId(AMILaunchPermissionCreateResourceID(imageID, permissionID, "", "", ""))
 				ok = true
diff --git a/internal/service/ec2/ec2_ami_launch_permission_test.go b/internal/service/ec2/ec2_ami_launch_permission_test.go
index 1587daa2cae..d8d8a427c9a 100644
--- a/internal/service/ec2/ec2_ami_launch_permission_test.go
+++ b/internal/service/ec2/ec2_ami_launch_permission_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/ec2_ami_test.go b/internal/service/ec2/ec2_ami_test.go
index 7bd0e34d235..f0a990b518a 100644
--- a/internal/service/ec2/ec2_ami_test.go
+++ b/internal/service/ec2/ec2_ami_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"strings"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -35,7 +38,7 @@ func TestAccEC2AMI_basic(t *testing.T) {
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckAMIExists(ctx, resourceName, &ami),
 					resource.TestCheckResourceAttr(resourceName, "architecture", "x86_64"),
-					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "ec2", regexp.MustCompile(`image/ami-.+`)),
+					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "ec2", regexache.MustCompile(`image/ami-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
 					resource.TestCheckResourceAttr(resourceName, "ebs_block_device.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "ebs_block_device.*", map[string]string{
@@ -100,7 +103,7 @@ func TestAccEC2AMI_deprecateAt(t *testing.T) {
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckAMIExists(ctx, resourceName, &ami),
 					resource.TestCheckResourceAttr(resourceName, "architecture", "x86_64"),
-					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "ec2", regexp.MustCompile(`image/ami-.+`)),
+					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "ec2", regexache.MustCompile(`image/ami-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "deprecation_time", deprecateAt),
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
 					resource.TestCheckResourceAttr(resourceName, "ebs_block_device.#", "1"),
@@ -141,7 +144,7 @@ func TestAccEC2AMI_deprecateAt(t *testing.T) {
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckAMIExists(ctx, resourceName, &ami),
 					resource.TestCheckResourceAttr(resourceName, "architecture", "x86_64"),
-					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "ec2", regexp.MustCompile(`image/ami-.+`)),
+					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "ec2", regexache.MustCompile(`image/ami-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "deprecation_time", deprecateAtUpdated),
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
 					resource.TestCheckResourceAttr(resourceName, "ebs_block_device.#", "1"),
@@ -193,7 +196,7 @@ func TestAccEC2AMI_description(t *testing.T) {
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckAMIExists(ctx, resourceName, &ami),
 					resource.TestCheckResourceAttr(resourceName, "architecture", "x86_64"),
-					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "ec2", regexp.MustCompile(`image/ami-.+`)),
+					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "ec2", regexache.MustCompile(`image/ami-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "description", desc),
 					resource.TestCheckResourceAttr(resourceName, "ebs_block_device.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "ebs_block_device.*", map[string]string{
@@ -233,7 +236,7 @@ func TestAccEC2AMI_description(t *testing.T) {
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckAMIExists(ctx, resourceName, &ami),
 					resource.TestCheckResourceAttr(resourceName, "architecture", "x86_64"),
-					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "ec2", regexp.MustCompile(`image/ami-.+`)),
+					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "ec2", regexache.MustCompile(`image/ami-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "description", descUpdated),
 					resource.TestCheckResourceAttr(resourceName, "ebs_block_device.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "ebs_block_device.*", map[string]string{
@@ -306,7 +309,7 @@ func TestAccEC2AMI_ephemeralBlockDevices(t *testing.T) {
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckAMIExists(ctx, resourceName, &ami),
 					resource.TestCheckResourceAttr(resourceName, "architecture", "x86_64"),
-					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "ec2", regexp.MustCompile(`image/ami-.+`)),
+					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "ec2", regexache.MustCompile(`image/ami-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
 					resource.TestCheckResourceAttr(resourceName, "ebs_block_device.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "ebs_block_device.*", map[string]string{
@@ -370,7 +373,7 @@ func TestAccEC2AMI_gp3BlockDevice(t *testing.T) {
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckAMIExists(ctx, resourceName, &ami),
 					resource.TestCheckResourceAttr(resourceName, "architecture", "x86_64"),
-					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "ec2", regexp.MustCompile(`image/ami-.+`)),
+					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "ec2", regexache.MustCompile(`image/ami-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
 					resource.TestCheckResourceAttr(resourceName, "ebs_block_device.#", "2"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "ebs_block_device.*", map[string]string{
diff --git a/internal/service/ec2/ec2_availability_zone_data_source.go b/internal/service/ec2/ec2_availability_zone_data_source.go
index 6fda2ab88ea..56a8a3a445b 100644
--- a/internal/service/ec2/ec2_availability_zone_data_source.go
+++ b/internal/service/ec2/ec2_availability_zone_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/ec2_availability_zone_data_source_test.go b/internal/service/ec2/ec2_availability_zone_data_source_test.go
index 352a0a8bd76..d32191e99fa 100644
--- a/internal/service/ec2/ec2_availability_zone_data_source_test.go
+++ b/internal/service/ec2/ec2_availability_zone_data_source_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -29,7 +32,7 @@ func TestAccEC2AvailabilityZoneDataSource_allAvailabilityZones(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr(dataSourceName, "group_name", acctest.Region()),
 					resource.TestCheckResourceAttrPair(dataSourceName, "name", availabilityZonesDataSourceName, "names.0"),
-					resource.TestMatchResourceAttr(dataSourceName, "name_suffix", regexp.MustCompile(`^[a-z]$`)),
+					resource.TestMatchResourceAttr(dataSourceName, "name_suffix", regexache.MustCompile(`^[a-z]$`)),
 					resource.TestCheckResourceAttr(dataSourceName, "network_border_group", acctest.Region()),
 					resource.TestCheckResourceAttr(dataSourceName, "opt_in_status", ec2.AvailabilityZoneOptInStatusOptInNotRequired),
 					resource.TestCheckResourceAttr(dataSourceName, "parent_zone_id", ""),
@@ -58,7 +61,7 @@ func TestAccEC2AvailabilityZoneDataSource_filter(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr(dataSourceName, "group_name", acctest.Region()),
 					resource.TestCheckResourceAttrPair(dataSourceName, "name", availabilityZonesDataSourceName, "names.0"),
-					resource.TestMatchResourceAttr(dataSourceName, "name_suffix", regexp.MustCompile(`^[a-z]$`)),
+					resource.TestMatchResourceAttr(dataSourceName, "name_suffix", regexache.MustCompile(`^[a-z]$`)),
 					resource.TestCheckResourceAttr(dataSourceName, "network_border_group", acctest.Region()),
 					resource.TestCheckResourceAttr(dataSourceName, "opt_in_status", ec2.AvailabilityZoneOptInStatusOptInNotRequired),
 					resource.TestCheckResourceAttr(dataSourceName, "parent_zone_id", ""),
@@ -87,7 +90,7 @@ func TestAccEC2AvailabilityZoneDataSource_localZone(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttrSet(dataSourceName, "group_name"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "name", availabilityZonesDataSourceName, "names.0"),
-					resource.TestMatchResourceAttr(dataSourceName, "name_suffix", regexp.MustCompile(`^[a-z0-9][a-z0-9-]+$`)),
+					resource.TestMatchResourceAttr(dataSourceName, "name_suffix", regexache.MustCompile(`^[0-9a-z][0-9a-z-]+$`)),
 					resource.TestCheckResourceAttrSet(dataSourceName, "network_border_group"),
 					resource.TestCheckResourceAttr(dataSourceName, "opt_in_status", ec2.AvailabilityZoneOptInStatusOptedIn),
 					resource.TestCheckResourceAttrSet(dataSourceName, "parent_zone_id"),
@@ -116,7 +119,7 @@ func TestAccEC2AvailabilityZoneDataSource_name(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr(dataSourceName, "group_name", acctest.Region()),
 					resource.TestCheckResourceAttrPair(dataSourceName, "name", availabilityZonesDataSourceName, "names.0"),
-					resource.TestMatchResourceAttr(dataSourceName, "name_suffix", regexp.MustCompile(`^[a-z]$`)),
+					resource.TestMatchResourceAttr(dataSourceName, "name_suffix", regexache.MustCompile(`^[a-z]$`)),
 					resource.TestCheckResourceAttr(dataSourceName, "network_border_group", acctest.Region()),
 					resource.TestCheckResourceAttr(dataSourceName, "opt_in_status", ec2.AvailabilityZoneOptInStatusOptInNotRequired),
 					resource.TestCheckResourceAttr(dataSourceName, "parent_zone_id", ""),
@@ -145,7 +148,7 @@ func TestAccEC2AvailabilityZoneDataSource_wavelengthZone(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttrSet(dataSourceName, "group_name"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "name", availabilityZonesDataSourceName, "names.0"),
-					resource.TestMatchResourceAttr(dataSourceName, "name_suffix", regexp.MustCompile(`^[a-z0-9][a-z0-9-]+$`)),
+					resource.TestMatchResourceAttr(dataSourceName, "name_suffix", regexache.MustCompile(`^[0-9a-z][0-9a-z-]+$`)),
 					resource.TestCheckResourceAttrSet(dataSourceName, "network_border_group"),
 					resource.TestCheckResourceAttr(dataSourceName, "opt_in_status", ec2.AvailabilityZoneOptInStatusOptedIn),
 					resource.TestCheckResourceAttrSet(dataSourceName, "parent_zone_id"),
@@ -174,7 +177,7 @@ func TestAccEC2AvailabilityZoneDataSource_zoneID(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr(dataSourceName, "group_name", acctest.Region()),
 					resource.TestCheckResourceAttrPair(dataSourceName, "name", availabilityZonesDataSourceName, "names.0"),
-					resource.TestMatchResourceAttr(dataSourceName, "name_suffix", regexp.MustCompile(`^[a-z]$`)),
+					resource.TestMatchResourceAttr(dataSourceName, "name_suffix", regexache.MustCompile(`^[a-z]$`)),
 					resource.TestCheckResourceAttr(dataSourceName, "network_border_group", acctest.Region()),
 					resource.TestCheckResourceAttr(dataSourceName, "opt_in_status", ec2.AvailabilityZoneOptInStatusOptInNotRequired),
 					resource.TestCheckResourceAttr(dataSourceName, "parent_zone_id", ""),
diff --git a/internal/service/ec2/ec2_availability_zone_group.go b/internal/service/ec2/ec2_availability_zone_group.go
index e4111a77797..2e824e76673 100644
--- a/internal/service/ec2/ec2_availability_zone_group.go
+++ b/internal/service/ec2/ec2_availability_zone_group.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/ec2_availability_zone_group_test.go b/internal/service/ec2/ec2_availability_zone_group_test.go
index 490e824cf15..1792dfed26d 100644
--- a/internal/service/ec2/ec2_availability_zone_group_test.go
+++ b/internal/service/ec2/ec2_availability_zone_group_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/ec2_availability_zones_data_source.go b/internal/service/ec2/ec2_availability_zones_data_source.go
index 3ac25e92352..525a4d0cdd0 100644
--- a/internal/service/ec2/ec2_availability_zones_data_source.go
+++ b/internal/service/ec2/ec2_availability_zones_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/ec2_availability_zones_data_source_test.go b/internal/service/ec2/ec2_availability_zones_data_source_test.go
index 3313502a389..d93aee9b02f 100644
--- a/internal/service/ec2/ec2_availability_zones_data_source_test.go
+++ b/internal/service/ec2/ec2_availability_zones_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/ec2_capacity_reservation.go b/internal/service/ec2/ec2_capacity_reservation.go
index 932f582dab2..04dfd3464aa 100644
--- a/internal/service/ec2/ec2_capacity_reservation.go
+++ b/internal/service/ec2/ec2_capacity_reservation.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/ec2_capacity_reservation_test.go b/internal/service/ec2/ec2_capacity_reservation_test.go
index 172b3af9ad5..4472736ce66 100644
--- a/internal/service/ec2/ec2_capacity_reservation_test.go
+++ b/internal/service/ec2/ec2_capacity_reservation_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -34,7 +37,7 @@ func TestAccEC2CapacityReservation_basic(t *testing.T) {
 				Config: testAccCapacityReservationConfig_basic,
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckCapacityReservationExists(ctx, resourceName, &cr),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexp.MustCompile(`capacity-reservation/cr-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`capacity-reservation/cr-.+`)),
 					resource.TestCheckResourceAttrPair(resourceName, "availability_zone", availabilityZonesDataSourceName, "names.0"),
 					resource.TestCheckResourceAttr(resourceName, "ebs_optimized", "false"),
 					resource.TestCheckResourceAttr(resourceName, "end_date", ""),
diff --git a/internal/service/ec2/ec2_eip.go b/internal/service/ec2/ec2_eip.go
index b210a9bee01..d51b1432afa 100644
--- a/internal/service/ec2/ec2_eip.go
+++ b/internal/service/ec2/ec2_eip.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -202,7 +205,7 @@ func resourceEIPRead(ctx context.Context, d *schema.ResourceData, meta interface
 		return sdkdiag.AppendErrorf(diags, `with the retirement of EC2-Classic %s domain EC2 EIPs are no longer supported`, ec2.DomainTypeStandard)
 	}
 
-	outputRaw, err := tfresource.RetryWhenNewResourceNotFound(ctx, propagationTimeout, func() (interface{}, error) {
+	outputRaw, err := tfresource.RetryWhenNewResourceNotFound(ctx, ec2PropagationTimeout, func() (interface{}, error) {
 		return FindEIPByAllocationID(ctx, conn, d.Id())
 	}, d.IsNewResource())
 
@@ -339,7 +342,7 @@ func associateEIP(ctx context.Context, conn *ec2.EC2, allocationID, instanceID,
 		return fmt.Errorf("associating EC2 EIP (%s): %w", allocationID, err)
 	}
 
-	_, err = tfresource.RetryWhen(ctx, propagationTimeout,
+	_, err = tfresource.RetryWhen(ctx, ec2PropagationTimeout,
 		func() (interface{}, error) {
 			return FindEIPByAssociationID(ctx, conn, aws.StringValue(output.AssociationId))
 		},
diff --git a/internal/service/ec2/ec2_eip_association.go b/internal/service/ec2/ec2_eip_association.go
index ecaee419cf5..f2ea615c3b2 100644
--- a/internal/service/ec2/ec2_eip_association.go
+++ b/internal/service/ec2/ec2_eip_association.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -104,7 +107,7 @@ func resourceEIPAssociationCreate(ctx context.Context, d *schema.ResourceData, m
 
 	d.SetId(aws.StringValue(output.AssociationId))
 
-	_, err = tfresource.RetryWhen(ctx, propagationTimeout,
+	_, err = tfresource.RetryWhen(ctx, ec2PropagationTimeout,
 		func() (interface{}, error) {
 			return FindEIPByAssociationID(ctx, conn, d.Id())
 		},
diff --git a/internal/service/ec2/ec2_eip_association_test.go b/internal/service/ec2/ec2_eip_association_test.go
index 1ba2c1a3fff..c88ee0dd886 100644
--- a/internal/service/ec2/ec2_eip_association_test.go
+++ b/internal/service/ec2/ec2_eip_association_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/ec2_eip_data_source.go b/internal/service/ec2/ec2_eip_data_source.go
index 776709ccd1b..47e5d9e96c5 100644
--- a/internal/service/ec2/ec2_eip_data_source.go
+++ b/internal/service/ec2/ec2_eip_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/ec2_eip_data_source_test.go b/internal/service/ec2/ec2_eip_data_source_test.go
index eeaea643f8c..a47709ee60b 100644
--- a/internal/service/ec2/ec2_eip_data_source_test.go
+++ b/internal/service/ec2/ec2_eip_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/ec2_eip_test.go b/internal/service/ec2/ec2_eip_test.go
index 771be5038fe..e6ff5093ba1 100644
--- a/internal/service/ec2/ec2_eip_test.go
+++ b/internal/service/ec2/ec2_eip_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
 	"context"
 	"fmt"
 	"os"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -513,8 +516,8 @@ func TestAccEC2EIP_customerOwnedIPv4Pool(t *testing.T) {
 				Config: testAccEIPConfig_customerOwnedIPv4Pool(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckEIPExists(ctx, resourceName, &conf),
-					resource.TestMatchResourceAttr(resourceName, "customer_owned_ipv4_pool", regexp.MustCompile(`^ipv4pool-coip-.+$`)),
-					resource.TestMatchResourceAttr(resourceName, "customer_owned_ip", regexp.MustCompile(`\d+\.\d+\.\d+\.\d+`)),
+					resource.TestMatchResourceAttr(resourceName, "customer_owned_ipv4_pool", regexache.MustCompile(`^ipv4pool-coip-.+$`)),
+					resource.TestMatchResourceAttr(resourceName, "customer_owned_ip", regexache.MustCompile(`\d+\.\d+\.\d+\.\d+`)),
 				),
 			},
 			{
diff --git a/internal/service/ec2/ec2_eips_data_source.go b/internal/service/ec2/ec2_eips_data_source.go
index 715345ff398..3d4fe55106a 100644
--- a/internal/service/ec2/ec2_eips_data_source.go
+++ b/internal/service/ec2/ec2_eips_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -28,7 +31,7 @@ func DataSourceEIPs() *schema.Resource {
 				Computed: true,
 				Elem:     &schema.Schema{Type: schema.TypeString},
 			},
-			"filter": DataSourceFiltersSchema(),
+			"filter": CustomFiltersSchema(),
 			"public_ips": {
 				Type:     schema.TypeList,
 				Computed: true,
@@ -53,7 +56,7 @@ func dataSourceEIPsRead(ctx context.Context, d *schema.ResourceData, meta interf
 
 	if filters, filtersOk := d.GetOk("filter"); filtersOk {
 		input.Filters = append(input.Filters,
-			BuildFiltersDataSource(filters.(*schema.Set))...)
+			BuildCustomFilterList(filters.(*schema.Set))...)
 	}
 
 	if len(input.Filters) == 0 {
diff --git a/internal/service/ec2/ec2_eips_data_source_test.go b/internal/service/ec2/ec2_eips_data_source_test.go
index dd4be83c433..4299f353803 100644
--- a/internal/service/ec2/ec2_eips_data_source_test.go
+++ b/internal/service/ec2/ec2_eips_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/ec2_fleet.go b/internal/service/ec2/ec2_fleet.go
index 17ef0263cdd..9510c5fe366 100644
--- a/internal/service/ec2/ec2_fleet.go
+++ b/internal/service/ec2/ec2_fleet.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/ec2_fleet_test.go b/internal/service/ec2/ec2_fleet_test.go
index eda1e3ae0bc..4d4ae917d3e 100644
--- a/internal/service/ec2/ec2_fleet_test.go
+++ b/internal/service/ec2/ec2_fleet_test.go
@@ -1,14 +1,17 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
 	"context"
 	"errors"
 	"fmt"
-	"regexp"
 	"strings"
 	"testing"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -36,7 +39,7 @@ func TestAccEC2Fleet_basic(t *testing.T) {
 				Config: testAccFleetConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckFleetExists(ctx, resourceName, &fleet1),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexp.MustCompile(`fleet/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`fleet/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "context", ""),
 					resource.TestCheckResourceAttr(resourceName, "excess_capacity_termination_policy", "termination"),
 					resource.TestCheckResourceAttr(resourceName, "fleet_state", "active"),
@@ -2694,7 +2697,7 @@ func TestAccEC2Fleet_capacityRebalanceInvalidType(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccFleetConfig_invalidTypeForCapacityRebalance(rName),
-				ExpectError: regexp.MustCompile(`Capacity Rebalance maintenance strategies can only be specified for fleets of type maintain`),
+				ExpectError: regexache.MustCompile(`Capacity Rebalance maintenance strategies can only be specified for fleets of type maintain`),
 			},
 		},
 	})
diff --git a/internal/service/ec2/ec2_host.go b/internal/service/ec2/ec2_host.go
index 277778ec39b..f16aebb17dc 100644
--- a/internal/service/ec2/ec2_host.go
+++ b/internal/service/ec2/ec2_host.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -41,6 +44,13 @@ func ResourceHost() *schema.Resource {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
+			"asset_id": {
+				Type:         schema.TypeString,
+				Optional:     true,
+				ForceNew:     true,
+				RequiredWith: []string{"outpost_arn"},
+				Computed:     true,
+			},
 			"auto_placement": {
 				Type:         schema.TypeString,
 				Optional:     true,
@@ -96,6 +106,10 @@ func resourceHostCreate(ctx context.Context, d *schema.ResourceData, meta interf
 		TagSpecifications: getTagSpecificationsIn(ctx, ec2.ResourceTypeDedicatedHost),
 	}
 
+	if v, ok := d.GetOk("asset_id"); ok {
+		input.AssetIds = aws.StringSlice([]string{v.(string)})
+	}
+
 	if v, ok := d.GetOk("instance_family"); ok {
 		input.InstanceFamily = aws.String(v.(string))
 	}
@@ -147,6 +161,7 @@ func resourceHostRead(ctx context.Context, d *schema.ResourceData, meta interfac
 		Resource:  fmt.Sprintf("dedicated-host/%s", d.Id()),
 	}.String()
 	d.Set("arn", arn)
+	d.Set("asset_id", host.AssetId)
 	d.Set("auto_placement", host.AutoPlacement)
 	d.Set("availability_zone", host.AvailabilityZone)
 	d.Set("host_recovery", host.HostRecovery)
diff --git a/internal/service/ec2/ec2_host_data_source.go b/internal/service/ec2/ec2_host_data_source.go
index f4640a713ba..d6444af9065 100644
--- a/internal/service/ec2/ec2_host_data_source.go
+++ b/internal/service/ec2/ec2_host_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -30,6 +33,10 @@ func DataSourceHost() *schema.Resource {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
+			"asset_id": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
 			"auto_placement": {
 				Type:     schema.TypeString,
 				Computed: true,
@@ -42,7 +49,7 @@ func DataSourceHost() *schema.Resource {
 				Type:     schema.TypeInt,
 				Computed: true,
 			},
-			"filter": DataSourceFiltersSchema(),
+			"filter": CustomFiltersSchema(),
 			"host_id": {
 				Type:     schema.TypeString,
 				Optional: true,
@@ -87,7 +94,7 @@ func dataSourceHostRead(ctx context.Context, d *schema.ResourceData, meta interf
 	ignoreTagsConfig := meta.(*conns.AWSClient).IgnoreTagsConfig
 
 	input := &ec2.DescribeHostsInput{
-		Filter: BuildFiltersDataSource(d.Get("filter").(*schema.Set)),
+		Filter: BuildCustomFilterList(d.Get("filter").(*schema.Set)),
 	}
 
 	if v, ok := d.GetOk("host_id"); ok {
@@ -115,6 +122,7 @@ func dataSourceHostRead(ctx context.Context, d *schema.ResourceData, meta interf
 		Resource:  fmt.Sprintf("dedicated-host/%s", d.Id()),
 	}.String()
 	d.Set("arn", arn)
+	d.Set("asset_id", host.AssetId)
 	d.Set("auto_placement", host.AutoPlacement)
 	d.Set("availability_zone", host.AvailabilityZone)
 	d.Set("cores", host.HostProperties.Cores)
diff --git a/internal/service/ec2/ec2_host_data_source_test.go b/internal/service/ec2/ec2_host_data_source_test.go
index d0328e270d1..e1ba4f7b43a 100644
--- a/internal/service/ec2/ec2_host_data_source_test.go
+++ b/internal/service/ec2/ec2_host_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
@@ -58,6 +61,7 @@ func TestAccEC2HostDataSource_filter(t *testing.T) {
 				Config: testAccHostDataSourceConfig_filter(rName),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttrPair(dataSourceName, "arn", resourceName, "arn"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "asset_id", resourceName, "asset_id"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "auto_placement", resourceName, "auto_placement"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "availability_zone", resourceName, "availability_zone"),
 					resource.TestCheckResourceAttrSet(dataSourceName, "cores"),
diff --git a/internal/service/ec2/ec2_host_test.go b/internal/service/ec2/ec2_host_test.go
index f5e2c34577c..a6175183652 100644
--- a/internal/service/ec2/ec2_host_test.go
+++ b/internal/service/ec2/ec2_host_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -31,7 +34,7 @@ func TestAccEC2Host_basic(t *testing.T) {
 				Config: testAccHostConfig_basic(),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckHostExists(ctx, resourceName, &host),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexp.MustCompile(`dedicated-host/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`dedicated-host/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "auto_placement", "on"),
 					resource.TestCheckResourceAttr(resourceName, "host_recovery", "off"),
 					resource.TestCheckResourceAttr(resourceName, "instance_family", ""),
@@ -89,7 +92,7 @@ func TestAccEC2Host_instanceFamily(t *testing.T) {
 				Config: testAccHostConfig_instanceFamily(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckHostExists(ctx, resourceName, &host),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexp.MustCompile(`dedicated-host/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`dedicated-host/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "auto_placement", "off"),
 					resource.TestCheckResourceAttr(resourceName, "host_recovery", "on"),
 					resource.TestCheckResourceAttr(resourceName, "instance_family", "c5"),
@@ -108,7 +111,7 @@ func TestAccEC2Host_instanceFamily(t *testing.T) {
 				Config: testAccHostConfig_instanceType(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckHostExists(ctx, resourceName, &host),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexp.MustCompile(`dedicated-host/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`dedicated-host/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "auto_placement", "on"),
 					resource.TestCheckResourceAttr(resourceName, "host_recovery", "off"),
 					resource.TestCheckResourceAttr(resourceName, "instance_family", ""),
@@ -167,6 +170,29 @@ func TestAccEC2Host_tags(t *testing.T) {
 	})
 }
 
+func TestAccEC2Host_outpostAssetId(t *testing.T) {
+	ctx := acctest.Context(t)
+	var host ec2.Host
+	resourceName := "aws_ec2_host.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckOutpostsOutposts(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, ec2.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckHostDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccHostConfig_outpostAssetId(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckHostExists(ctx, resourceName, &host),
+					resource.TestCheckResourceAttrSet(resourceName, "asset_id"),
+				),
+			},
+		},
+	})
+}
+
 func TestAccEC2Host_outpost(t *testing.T) {
 	ctx := acctest.Context(t)
 	var host ec2.Host
@@ -313,6 +339,31 @@ resource "aws_ec2_host" "test" {
 `, tagKey1, tagValue1, tagKey2, tagValue2))
 }
 
+func testAccHostConfig_outpostAssetId(rName string) string {
+	return acctest.ConfigCompose(acctest.ConfigAvailableAZsNoOptIn(), fmt.Sprintf(`
+data "aws_outposts_outposts" "test" {}
+
+data "aws_outposts_outpost" "test" {
+  id = tolist(data.aws_outposts_outposts.test.ids)[0]
+}
+
+data "aws_outposts_assets" "test" {
+  arn = data.aws_outposts_outpost.test.arn
+}
+
+resource "aws_ec2_host" "test" {
+  asset_id          = tolist(data.aws_outposts_assets.test.asset_ids)[3]
+  instance_family   = "m5d"
+  availability_zone = data.aws_availability_zones.available.names[0]
+  outpost_arn       = data.aws_outposts_outpost.test.arn
+
+  tags = {
+    Name = %[1]q
+  }
+}
+`, rName))
+}
+
 func testAccHostConfig_outpost(rName string) string {
 	return acctest.ConfigCompose(acctest.ConfigAvailableAZsNoOptIn(), fmt.Sprintf(`
 data "aws_outposts_outposts" "test" {}
diff --git a/internal/service/ec2/ec2_image_block_public_access.go b/internal/service/ec2/ec2_image_block_public_access.go
new file mode 100644
index 00000000000..70cc55399ac
--- /dev/null
+++ b/internal/service/ec2/ec2_image_block_public_access.go
@@ -0,0 +1,113 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package ec2
+
+import (
+	"context"
+	"log"
+	"time"
+
+	"github.com/aws/aws-sdk-go-v2/service/ec2"
+	"github.com/aws/aws-sdk-go-v2/service/ec2/types"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/enum"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"golang.org/x/exp/slices"
+)
+
+// @SDKResource("aws_ec2_image_block_public_access", name="Image Block Public Access")
+func ResourceImageBlockPublicAccess() *schema.Resource {
+	return &schema.Resource{
+		CreateWithoutTimeout: resourceImageBlockPublicAccessPut,
+		ReadWithoutTimeout:   resourceImageBlockPublicAccessRead,
+		UpdateWithoutTimeout: resourceImageBlockPublicAccessPut,
+		DeleteWithoutTimeout: schema.NoopContext,
+
+		Timeouts: &schema.ResourceTimeout{
+			Update: schema.DefaultTimeout(10 * time.Minute),
+		},
+
+		Schema: map[string]*schema.Schema{
+			"state": {
+				Type:         schema.TypeString,
+				Required:     true,
+				ValidateFunc: validation.StringInSlice(imageBlockPublicAccessState_Values(), false),
+			},
+		},
+	}
+}
+
+func resourceImageBlockPublicAccessPut(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).EC2Client(ctx)
+
+	state := d.Get("state").(string)
+
+	if slices.Contains(imageBlockPublicAccessEnabledState_Values(), state) {
+		input := &ec2.EnableImageBlockPublicAccessInput{
+			ImageBlockPublicAccessState: types.ImageBlockPublicAccessEnabledState(state),
+		}
+
+		_, err := conn.EnableImageBlockPublicAccess(ctx, input)
+
+		if err != nil {
+			return sdkdiag.AppendErrorf(diags, "enabling EC2 Image Block Public Access: %s", err)
+		}
+	} else {
+		input := &ec2.DisableImageBlockPublicAccessInput{}
+
+		_, err := conn.DisableImageBlockPublicAccess(ctx, input)
+
+		if err != nil {
+			return sdkdiag.AppendErrorf(diags, "disabling EC2 Image Block Public Access: %s", err)
+		}
+	}
+
+	if d.IsNewResource() {
+		d.SetId(meta.(*conns.AWSClient).Region)
+	}
+
+	if err := WaitImageBlockPublicAccessState(ctx, conn, state, d.Timeout(schema.TimeoutUpdate)); err != nil {
+		return sdkdiag.AppendErrorf(diags, "waiting for EC2 Image Block Public Access state (%s): %s", state, err)
+	}
+
+	return append(diags, resourceImageBlockPublicAccessRead(ctx, d, meta)...)
+}
+
+func resourceImageBlockPublicAccessRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).EC2Client(ctx)
+
+	output, err := FindImageBlockPublicAccessState(ctx, conn)
+
+	if !d.IsNewResource() && tfresource.NotFound(err) {
+		log.Printf("[WARN] EC2 Image Block Public Access %s not found, removing from state", d.Id())
+		d.SetId("")
+		return diags
+	}
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "reading EC2 Image Block Public Access (%s): %s", d.Id(), err)
+	}
+
+	d.Set("state", output)
+
+	return diags
+}
+
+func imageBlockPublicAccessDisabledState_Values() []string {
+	return enum.Values[types.ImageBlockPublicAccessDisabledState]()
+}
+
+func imageBlockPublicAccessEnabledState_Values() []string {
+	return enum.Values[types.ImageBlockPublicAccessEnabledState]()
+}
+
+func imageBlockPublicAccessState_Values() []string {
+	return append(imageBlockPublicAccessEnabledState_Values(), imageBlockPublicAccessDisabledState_Values()...)
+}
diff --git a/internal/service/ec2/ec2_image_block_public_access_test.go b/internal/service/ec2/ec2_image_block_public_access_test.go
new file mode 100644
index 00000000000..9fc83f8af3d
--- /dev/null
+++ b/internal/service/ec2/ec2_image_block_public_access_test.go
@@ -0,0 +1,55 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package ec2_test
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
+)
+
+func TestAccEC2ImageBlockPublicAccess_serial(t *testing.T) {
+	t.Parallel()
+
+	testCases := map[string]func(t *testing.T){
+		"basic": testAccImageBlockPublicAccess_basic,
+	}
+
+	acctest.RunSerialTests1Level(t, testCases, 0)
+}
+
+func testAccImageBlockPublicAccess_basic(t *testing.T) {
+	ctx := acctest.Context(t)
+	resourceName := "aws_ec2_image_block_public_access.test"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             acctest.CheckDestroyNoop,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccImageBlockPublicAccessConfig_basic("unblocked"),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(resourceName, "state", "unblocked"),
+				),
+			},
+			{
+				Config: testAccImageBlockPublicAccessConfig_basic("block-new-sharing"),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(resourceName, "state", "block-new-sharing"),
+				),
+			},
+		},
+	})
+}
+
+func testAccImageBlockPublicAccessConfig_basic(state string) string {
+	return fmt.Sprintf(`
+resource "aws_ec2_image_block_public_access" "test" {
+  state = %[1]q
+}
+`, state)
+}
diff --git a/internal/service/ec2/ec2_instance.go b/internal/service/ec2/ec2_instance.go
index c9d7e244318..68e7c1a25a9 100644
--- a/internal/service/ec2/ec2_instance.go
+++ b/internal/service/ec2/ec2_instance.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -9,11 +12,11 @@ import (
 	"errors"
 	"fmt"
 	"log"
-	"regexp"
 	"strconv"
 	"strings"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/aws/aws-sdk-go/service/ec2"
@@ -543,6 +546,12 @@ func ResourceInstance() *schema.Resource {
 							Default:      ec2.InstanceMetadataEndpointStateEnabled,
 							ValidateFunc: validation.StringInSlice(ec2.InstanceMetadataEndpointState_Values(), false),
 						},
+						"http_protocol_ipv6": {
+							Type:         schema.TypeString,
+							Optional:     true,
+							Default:      ec2.InstanceMetadataProtocolStateDisabled,
+							ValidateFunc: validation.StringInSlice(ec2.InstanceMetadataProtocolState_Values(), false),
+						},
 						"http_put_response_hop_limit": {
 							Type:         schema.TypeInt,
 							Optional:     true,
@@ -967,7 +976,7 @@ func resourceInstanceCreate(ctx context.Context, d *schema.ResourceData, meta in
 	}
 
 	log.Printf("[DEBUG] Creating EC2 Instance: %s", input)
-	outputRaw, err := tfresource.RetryWhen(ctx, propagationTimeout,
+	outputRaw, err := tfresource.RetryWhen(ctx, iamPropagationTimeout,
 		func() (interface{}, error) {
 			return conn.RunInstancesWithContext(ctx, input)
 		},
@@ -1504,7 +1513,7 @@ func resourceInstanceUpdate(ctx context.Context, d *schema.ResourceData, meta in
 							return sdkdiag.AppendErrorf(diags, "updating EC2 Instance (%s): %s", d.Id(), err)
 						}
 					} else {
-						err := retry.RetryContext(ctx, propagationTimeout, func() *retry.RetryError {
+						err := retry.RetryContext(ctx, iamPropagationTimeout, func() *retry.RetryError {
 							_, err := conn.ReplaceIamInstanceProfileAssociationWithContext(ctx, input)
 							if err != nil {
 								if tfawserr.ErrMessageContains(err, "InvalidParameterValue", "Invalid IAM Instance Profile") {
@@ -1810,6 +1819,7 @@ func resourceInstanceUpdate(ctx context.Context, d *schema.ResourceData, meta in
 
 				if tfMap["http_endpoint"].(string) == ec2.InstanceMetadataEndpointStateEnabled {
 					// These parameters are not allowed unless HttpEndpoint is enabled.
+					input.HttpProtocolIpv6 = aws.String(tfMap["http_protocol_ipv6"].(string))
 					input.HttpPutResponseHopLimit = aws.Int64(int64(tfMap["http_put_response_hop_limit"].(int)))
 					input.HttpTokens = aws.String(tfMap["http_tokens"].(string))
 					input.InstanceMetadataTags = aws.String(tfMap["instance_metadata_tags"].(string))
@@ -2074,7 +2084,7 @@ func modifyInstanceAttributeWithStopStart(ctx context.Context, conn *ec2.EC2, in
 	}
 
 	// Reference: https://github.com/hashicorp/terraform-provider-aws/issues/16433.
-	_, err := tfresource.RetryWhenAWSErrMessageContains(ctx, propagationTimeout,
+	_, err := tfresource.RetryWhenAWSErrMessageContains(ctx, ec2PropagationTimeout,
 		func() (interface{}, error) {
 			return conn.StartInstancesWithContext(ctx, &ec2.StartInstancesInput{
 				InstanceIds: aws.StringSlice([]string{id}),
@@ -2153,7 +2163,7 @@ func associateInstanceProfile(ctx context.Context, d *schema.ResourceData, conn
 			Name: aws.String(d.Get("iam_instance_profile").(string)),
 		},
 	}
-	err := retry.RetryContext(ctx, propagationTimeout, func() *retry.RetryError {
+	err := retry.RetryContext(ctx, iamPropagationTimeout, func() *retry.RetryError {
 		_, err := conn.AssociateIamInstanceProfileWithContext(ctx, input)
 		if err != nil {
 			if tfawserr.ErrMessageContains(err, "InvalidParameterValue", "Invalid IAM Instance Profile") {
@@ -2885,10 +2895,13 @@ func buildInstanceOpts(ctx context.Context, d *schema.ResourceData, meta interfa
 		}
 	}
 
+	_, assocPubIPA := d.GetOkExists("associate_public_ip_address")
+	_, privIP := d.GetOk("private_ip")
+	_, secPrivIP := d.GetOk("secondary_private_ips")
 	networkInterfaces, interfacesOk := d.GetOk("network_interface")
 
 	// If setting subnet and public address, OR manual network interfaces, populate those now.
-	if hasSubnet || interfacesOk {
+	if (hasSubnet && (assocPubIPA || privIP || secPrivIP)) || interfacesOk {
 		// Otherwise we're attaching (a) network interface(s)
 		opts.NetworkInterfaces = buildNetworkInterfaceOpts(d, groups, networkInterfaces)
 	} else {
@@ -3097,6 +3110,9 @@ func expandInstanceMetadataOptions(l []interface{}) *ec2.InstanceMetadataOptions
 
 	if m["http_endpoint"].(string) == ec2.InstanceMetadataEndpointStateEnabled {
 		// These parameters are not allowed unless HttpEndpoint is enabled
+		if v, ok := m["http_protocol_ipv6"].(string); ok && v != "" {
+			opts.HttpProtocolIpv6 = aws.String(v)
+		}
 
 		if v, ok := m["http_tokens"].(string); ok && v != "" {
 			opts.HttpTokens = aws.String(v)
@@ -3173,6 +3189,7 @@ func flattenInstanceMetadataOptions(opts *ec2.InstanceMetadataOptionsResponse) [
 
 	m := map[string]interface{}{
 		"http_endpoint":               aws.StringValue(opts.HttpEndpoint),
+		"http_protocol_ipv6":          aws.StringValue(opts.HttpProtocolIpv6),
 		"http_put_response_hop_limit": aws.Int64Value(opts.HttpPutResponseHopLimit),
 		"http_tokens":                 aws.StringValue(opts.HttpTokens),
 		"instance_metadata_tags":      aws.StringValue(opts.InstanceMetadataTags),
@@ -3675,7 +3692,7 @@ type InstanceType struct {
 }
 
 func ParseInstanceType(s string) (*InstanceType, error) {
-	matches := regexp.MustCompile(`(([[:alpha:]]+)([[:digit:]])+([[:alpha:]]*))\.([[:alnum:]]+)`).FindStringSubmatch(s)
+	matches := regexache.MustCompile(`(([[:alpha:]]+)([[:digit:]])+([[:alpha:]]*))\.([[:alnum:]]+)`).FindStringSubmatch(s)
 
 	if matches == nil {
 		return nil, fmt.Errorf("invalid EC2 Instance Type name: %s", s)
diff --git a/internal/service/ec2/ec2_instance_connect_endpoint.go b/internal/service/ec2/ec2_instance_connect_endpoint.go
new file mode 100644
index 00000000000..b01be4bf724
--- /dev/null
+++ b/internal/service/ec2/ec2_instance_connect_endpoint.go
@@ -0,0 +1,283 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package ec2
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/ec2"
+	awstypes "github.com/aws/aws-sdk-go-v2/service/ec2/types"
+	"github.com/hashicorp/aws-sdk-go-base/v2/tfawserr"
+	"github.com/hashicorp/terraform-plugin-framework-timeouts/resource/timeouts"
+	"github.com/hashicorp/terraform-plugin-framework/resource"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema/booldefault"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema/boolplanmodifier"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema/listplanmodifier"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema/planmodifier"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema/setplanmodifier"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema/stringplanmodifier"
+	"github.com/hashicorp/terraform-plugin-framework/types"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs/fwdiag"
+	"github.com/hashicorp/terraform-provider-aws/internal/framework"
+	"github.com/hashicorp/terraform-provider-aws/internal/framework/flex"
+	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/names"
+)
+
+// @FrameworkResource(name="Instance Connect Endpoint")
+// @Tags(identifierAttribute="id")
+func newResourceInstanceConnectEndpoint(context.Context) (resource.ResourceWithConfigure, error) {
+	r := &resourceInstanceConnectEndpoint{}
+	r.SetDefaultCreateTimeout(10 * time.Minute)
+	r.SetDefaultDeleteTimeout(10 * time.Minute)
+
+	return r, nil
+}
+
+type resourceInstanceConnectEndpoint struct {
+	framework.ResourceWithConfigure
+	framework.WithImportByID
+	framework.WithTimeouts
+}
+
+func (r *resourceInstanceConnectEndpoint) Metadata(_ context.Context, request resource.MetadataRequest, response *resource.MetadataResponse) {
+	response.TypeName = "aws_ec2_instance_connect_endpoint"
+}
+
+func (r *resourceInstanceConnectEndpoint) Schema(ctx context.Context, req resource.SchemaRequest, resp *resource.SchemaResponse) {
+	resp.Schema = schema.Schema{
+		Attributes: map[string]schema.Attribute{
+			"arn": schema.StringAttribute{
+				Computed: true,
+				PlanModifiers: []planmodifier.String{
+					stringplanmodifier.UseStateForUnknown(),
+				},
+			},
+			"availability_zone": schema.StringAttribute{
+				Computed: true,
+				PlanModifiers: []planmodifier.String{
+					stringplanmodifier.UseStateForUnknown(),
+				},
+			},
+			"dns_name": schema.StringAttribute{
+				Computed: true,
+				PlanModifiers: []planmodifier.String{
+					stringplanmodifier.UseStateForUnknown(),
+				},
+			},
+			"fips_dns_name": schema.StringAttribute{
+				Computed: true,
+				PlanModifiers: []planmodifier.String{
+					stringplanmodifier.UseStateForUnknown(),
+				},
+			},
+			names.AttrID: framework.IDAttribute(),
+			"network_interface_ids": schema.ListAttribute{
+				Computed:    true,
+				ElementType: types.StringType,
+				PlanModifiers: []planmodifier.List{
+					listplanmodifier.UseStateForUnknown(),
+				},
+			},
+			"owner_id": schema.StringAttribute{
+				Computed: true,
+				PlanModifiers: []planmodifier.String{
+					stringplanmodifier.UseStateForUnknown(),
+				},
+			},
+			"preserve_client_ip": schema.BoolAttribute{
+				Optional: true,
+				Computed: true,
+				Default:  booldefault.StaticBool(true),
+				PlanModifiers: []planmodifier.Bool{
+					boolplanmodifier.RequiresReplace(),
+				},
+			},
+			"security_group_ids": schema.SetAttribute{
+				Optional:    true,
+				Computed:    true,
+				ElementType: types.StringType,
+				PlanModifiers: []planmodifier.Set{
+					setplanmodifier.RequiresReplace(),
+				},
+			},
+			"subnet_id": schema.StringAttribute{
+				Required: true,
+				PlanModifiers: []planmodifier.String{
+					stringplanmodifier.RequiresReplace(),
+				},
+			},
+			names.AttrTags:    tftags.TagsAttribute(),
+			names.AttrTagsAll: tftags.TagsAttributeComputedOnly(),
+			"vpc_id": schema.StringAttribute{
+				Computed: true,
+				PlanModifiers: []planmodifier.String{
+					stringplanmodifier.UseStateForUnknown(),
+				},
+			},
+		},
+		Blocks: map[string]schema.Block{
+			names.AttrTimeouts: timeouts.Block(ctx, timeouts.Opts{
+				Create: true,
+				Delete: true,
+			}),
+		},
+	}
+}
+
+func (r *resourceInstanceConnectEndpoint) Create(ctx context.Context, request resource.CreateRequest, response *resource.CreateResponse) {
+	var data resourceInstanceConnectEndpointData
+
+	response.Diagnostics.Append(request.Plan.Get(ctx, &data)...)
+
+	if response.Diagnostics.HasError() {
+		return
+	}
+
+	conn := r.Meta().EC2Client(ctx)
+
+	input := &ec2.CreateInstanceConnectEndpointInput{
+		ClientToken:       aws.String(id.UniqueId()),
+		TagSpecifications: getTagSpecificationsInV2(ctx, awstypes.ResourceTypeInstanceConnectEndpoint),
+	}
+
+	response.Diagnostics.Append(flex.Expand(ctx, &data, input)...)
+
+	if response.Diagnostics.HasError() {
+		return
+	}
+
+	output, err := conn.CreateInstanceConnectEndpoint(ctx, input)
+
+	if err != nil {
+		response.Diagnostics.AddError("creating EC2 Instance Connect Endpoint", err.Error())
+
+		return
+	}
+
+	data.InstanceConnectEndpointId = types.StringPointerValue(output.InstanceConnectEndpoint.InstanceConnectEndpointId)
+	id := data.InstanceConnectEndpointId.ValueString()
+
+	createTimeout := r.CreateTimeout(ctx, data.Timeouts)
+	instanceConnectEndpoint, err := WaitInstanceConnectEndpointCreated(ctx, conn, id, createTimeout)
+	if err != nil {
+		response.Diagnostics.AddError(fmt.Sprintf("waiting for EC2 Instance Connect Endpoint (%s) create", id), err.Error())
+
+		return
+	}
+
+	// Set values for unknowns.
+	response.Diagnostics.Append(flex.Flatten(ctx, instanceConnectEndpoint, &data)...)
+
+	if response.Diagnostics.HasError() {
+		return
+	}
+
+	response.Diagnostics.Append(response.State.Set(ctx, &data)...)
+}
+
+func (r *resourceInstanceConnectEndpoint) Read(ctx context.Context, request resource.ReadRequest, response *resource.ReadResponse) {
+	var data resourceInstanceConnectEndpointData
+
+	response.Diagnostics.Append(request.State.Get(ctx, &data)...)
+
+	if response.Diagnostics.HasError() {
+		return
+	}
+
+	conn := r.Meta().EC2Client(ctx)
+
+	id := data.InstanceConnectEndpointId.ValueString()
+	instanceConnectEndpoint, err := FindInstanceConnectEndpointByID(ctx, conn, id)
+
+	if tfresource.NotFound(err) {
+		response.Diagnostics.Append(fwdiag.NewResourceNotFoundWarningDiagnostic(err))
+		response.State.RemoveResource(ctx)
+
+		return
+	}
+
+	if err != nil {
+		response.Diagnostics.AddError(fmt.Sprintf("reading EC2 Instance Connect Endpoint (%s)", id), err.Error())
+
+		return
+	}
+
+	response.Diagnostics.Append(flex.Flatten(ctx, instanceConnectEndpoint, &data)...)
+
+	if response.Diagnostics.HasError() {
+		return
+	}
+
+	setTagsOutV2(ctx, instanceConnectEndpoint.Tags)
+
+	response.Diagnostics.Append(response.State.Set(ctx, &data)...)
+}
+
+func (r *resourceInstanceConnectEndpoint) Update(ctx context.Context, request resource.UpdateRequest, response *resource.UpdateResponse) {
+	// Tags only.
+}
+
+func (r *resourceInstanceConnectEndpoint) Delete(ctx context.Context, request resource.DeleteRequest, response *resource.DeleteResponse) {
+	var data resourceInstanceConnectEndpointData
+
+	response.Diagnostics.Append(request.State.Get(ctx, &data)...)
+
+	if response.Diagnostics.HasError() {
+		return
+	}
+
+	conn := r.Meta().EC2Client(ctx)
+
+	_, err := conn.DeleteInstanceConnectEndpoint(ctx, &ec2.DeleteInstanceConnectEndpointInput{
+		InstanceConnectEndpointId: flex.StringFromFramework(ctx, data.InstanceConnectEndpointId),
+	})
+
+	if tfawserr.ErrCodeEquals(err, errCodeInvalidInstanceConnectEndpointIdNotFound) {
+		return
+	}
+
+	id := data.InstanceConnectEndpointId.ValueString()
+
+	if err != nil {
+		response.Diagnostics.AddError(fmt.Sprintf("deleting EC2 Instance Connect Endpoint (%s)", id), err.Error())
+
+		return
+	}
+
+	deleteTimeout := r.DeleteTimeout(ctx, data.Timeouts)
+	if _, err := WaitInstanceConnectEndpointDeleted(ctx, conn, id, deleteTimeout); err != nil {
+		response.Diagnostics.AddError(fmt.Sprintf("waiting for EC2 Instance Connect Endpoint (%s) delete", id), err.Error())
+
+		return
+	}
+}
+
+func (r *resourceInstanceConnectEndpoint) ModifyPlan(ctx context.Context, request resource.ModifyPlanRequest, response *resource.ModifyPlanResponse) {
+	r.SetTagsAll(ctx, request, response)
+}
+
+// See https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_Ec2InstanceConnectEndpoint.html.
+type resourceInstanceConnectEndpointData struct {
+	InstanceConnectEndpointArn types.String   `tfsdk:"arn"`
+	AvailabilityZone           types.String   `tfsdk:"availability_zone"`
+	DnsName                    types.String   `tfsdk:"dns_name"`
+	FipsDnsName                types.String   `tfsdk:"fips_dns_name"`
+	InstanceConnectEndpointId  types.String   `tfsdk:"id"`
+	NetworkInterfaceIds        types.List     `tfsdk:"network_interface_ids"`
+	OwnerId                    types.String   `tfsdk:"owner_id"`
+	PreserveClientIp           types.Bool     `tfsdk:"preserve_client_ip"`
+	SecurityGroupIds           types.Set      `tfsdk:"security_group_ids"`
+	SubnetId                   types.String   `tfsdk:"subnet_id"`
+	Tags                       types.Map      `tfsdk:"tags"`
+	TagsAll                    types.Map      `tfsdk:"tags_all"`
+	Timeouts                   timeouts.Value `tfsdk:"timeouts"`
+	VpcId                      types.String   `tfsdk:"vpc_id"`
+}
diff --git a/internal/service/ec2/ec2_instance_connect_endpoint_test.go b/internal/service/ec2/ec2_instance_connect_endpoint_test.go
new file mode 100644
index 00000000000..057e2cef85d
--- /dev/null
+++ b/internal/service/ec2/ec2_instance_connect_endpoint_test.go
@@ -0,0 +1,272 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package ec2_test
+
+import (
+	"context"
+	"fmt"
+	"testing"
+
+	"github.com/YakDriver/regexache"
+	"github.com/aws/aws-sdk-go/service/ec2"
+	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
+	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	tfec2 "github.com/hashicorp/terraform-provider-aws/internal/service/ec2"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+)
+
+func TestAccEC2InstanceConnectEndpoint_basic(t *testing.T) {
+	ctx := acctest.Context(t)
+	resourceName := "aws_ec2_instance_connect_endpoint.test"
+	subnetResourceName := "aws_subnet.test.0"
+	vpcResourceName := "aws_vpc.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, ec2.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckInstanceConnectEndpointDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccInstanceConnectEndpointConfig_basic(rName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckInstanceConnectEndpointExists(ctx, resourceName),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`instance-connect-endpoint/.+`)),
+					resource.TestCheckResourceAttrSet(resourceName, "availability_zone"),
+					resource.TestCheckResourceAttrSet(resourceName, "dns_name"),
+					resource.TestCheckResourceAttrSet(resourceName, "fips_dns_name"),
+					acctest.CheckResourceAttrGreaterThanOrEqualValue(resourceName, "network_interface_ids.#", 1),
+					acctest.CheckResourceAttrAccountID(resourceName, "owner_id"),
+					resource.TestCheckResourceAttr(resourceName, "preserve_client_ip", "true"),
+					resource.TestCheckResourceAttr(resourceName, "security_group_ids.#", "1"),
+					resource.TestCheckResourceAttrPair(resourceName, "subnet_id", subnetResourceName, "id"),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
+					resource.TestCheckResourceAttrPair(resourceName, "vpc_id", vpcResourceName, "id"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
+func TestAccEC2InstanceConnectEndpoint_disappears(t *testing.T) {
+	ctx := acctest.Context(t)
+	resourceName := "aws_ec2_instance_connect_endpoint.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, ec2.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckInstanceConnectEndpointDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccInstanceConnectEndpointConfig_basic(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckInstanceConnectEndpointExists(ctx, resourceName),
+					acctest.CheckFrameworkResourceDisappears(ctx, acctest.Provider, tfec2.ResourceInstanceConnectEndpoint, resourceName),
+				),
+				ExpectNonEmptyPlan: true,
+			},
+		},
+	})
+}
+
+func TestAccEC2InstanceConnectEndpoint_tags(t *testing.T) {
+	ctx := acctest.Context(t)
+	resourceName := "aws_ec2_instance_connect_endpoint.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, ec2.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckInstanceConnectEndpointDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccInstanceConnectEndpointConfig_tags1(rName, "key1", "value1"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckInstanceConnectEndpointExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				Config: testAccInstanceConnectEndpointConfig_tags2(rName, "key1", "value1updated", "key2", "value2"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckInstanceConnectEndpointExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1updated"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
+				),
+			},
+			{
+				Config: testAccInstanceConnectEndpointConfig_tags1(rName, "key2", "value2"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckInstanceConnectEndpointExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccEC2InstanceConnectEndpoint_securityGroupIDs(t *testing.T) {
+	ctx := acctest.Context(t)
+	resourceName := "aws_ec2_instance_connect_endpoint.test"
+	securityGroup1ResourceName := "aws_security_group.test.0"
+	securityGroup2ResourceName := "aws_security_group.test.1"
+	subnetResourceName := "aws_subnet.test.0"
+	vpcResourceName := "aws_vpc.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, ec2.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckInstanceConnectEndpointDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccInstanceConnectEndpointConfig_securityGroupIDs(rName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckInstanceConnectEndpointExists(ctx, resourceName),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`instance-connect-endpoint/.+`)),
+					resource.TestCheckResourceAttrSet(resourceName, "availability_zone"),
+					resource.TestCheckResourceAttrSet(resourceName, "dns_name"),
+					resource.TestCheckResourceAttrSet(resourceName, "fips_dns_name"),
+					acctest.CheckResourceAttrGreaterThanOrEqualValue(resourceName, "network_interface_ids.#", 1),
+					resource.TestCheckResourceAttr(resourceName, "preserve_client_ip", "false"),
+					resource.TestCheckResourceAttr(resourceName, "security_group_ids.#", "2"),
+					resource.TestCheckTypeSetElemAttrPair(resourceName, "security_group_ids.*", securityGroup1ResourceName, "id"),
+					resource.TestCheckTypeSetElemAttrPair(resourceName, "security_group_ids.*", securityGroup2ResourceName, "id"),
+					resource.TestCheckResourceAttrPair(resourceName, "subnet_id", subnetResourceName, "id"),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.Name", rName),
+					resource.TestCheckResourceAttrPair(resourceName, "vpc_id", vpcResourceName, "id"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
+func testAccCheckInstanceConnectEndpointExists(ctx context.Context, n string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+		if rs.Primary.ID == "" {
+			return fmt.Errorf("No EC2 Instance Connect Endpoint ID is set")
+		}
+
+		conn := acctest.Provider.Meta().(*conns.AWSClient).EC2Client(ctx)
+
+		_, err := tfec2.FindInstanceConnectEndpointByID(ctx, conn, rs.Primary.ID)
+
+		return err
+	}
+}
+
+func testAccCheckInstanceConnectEndpointDestroy(ctx context.Context) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		conn := acctest.Provider.Meta().(*conns.AWSClient).EC2Client(ctx)
+
+		for _, rs := range s.RootModule().Resources {
+			if rs.Type != "aws_ec2_instance_connect_endpoint" {
+				continue
+			}
+
+			_, err := tfec2.FindInstanceConnectEndpointByID(ctx, conn, rs.Primary.ID)
+
+			if tfresource.NotFound(err) {
+				continue
+			}
+
+			if err != nil {
+				return err
+			}
+
+			return fmt.Errorf("EC2 Instance Connect Endpoint %s still exists", rs.Primary.ID)
+		}
+
+		return nil
+	}
+}
+
+func testAccInstanceConnectEndpointConfig_basic(rName string) string {
+	return acctest.ConfigCompose(acctest.ConfigVPCWithSubnets(rName, 1), `
+resource "aws_ec2_instance_connect_endpoint" "test" {
+  subnet_id = aws_subnet.test[0].id
+}
+`)
+}
+
+func testAccInstanceConnectEndpointConfig_tags1(rName, tagKey1, tagValue1 string) string {
+	return acctest.ConfigCompose(acctest.ConfigVPCWithSubnets(rName, 1), fmt.Sprintf(`
+resource "aws_ec2_instance_connect_endpoint" "test" {
+  subnet_id = aws_subnet.test[0].id
+
+  tags = {
+    %[1]q = %[2]q
+  }
+}
+`, tagKey1, tagValue1))
+}
+
+func testAccInstanceConnectEndpointConfig_tags2(rName, tagKey1, tagValue1, tagKey2, tagValue2 string) string {
+	return acctest.ConfigCompose(acctest.ConfigVPCWithSubnets(rName, 1), fmt.Sprintf(`
+resource "aws_ec2_instance_connect_endpoint" "test" {
+  subnet_id = aws_subnet.test[0].id
+
+  tags = {
+    %[1]q = %[2]q
+    %[3]q = %[4]q
+  }
+}
+`, tagKey1, tagValue1, tagKey2, tagValue2))
+}
+
+func testAccInstanceConnectEndpointConfig_securityGroupIDs(rName string) string {
+	return acctest.ConfigCompose(acctest.ConfigVPCWithSubnets(rName, 1), fmt.Sprintf(`
+resource "aws_security_group" "test" {
+  count = 2
+
+  name   = "%[1]s-${count.index}"
+  vpc_id = aws_vpc.test.id
+
+  tags = {
+    Name = %[1]q
+  }
+}
+
+resource "aws_ec2_instance_connect_endpoint" "test" {
+  preserve_client_ip = false
+  subnet_id          = aws_subnet.test[0].id
+  security_group_ids = aws_security_group.test[*].id
+
+  tags = {
+    Name = %[1]q
+  }
+}
+`, rName))
+}
diff --git a/internal/service/ec2/ec2_instance_data_source.go b/internal/service/ec2/ec2_instance_data_source.go
index 908d173f4c1..b56374c6163 100644
--- a/internal/service/ec2/ec2_instance_data_source.go
+++ b/internal/service/ec2/ec2_instance_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -225,6 +228,10 @@ func DataSourceInstance() *schema.Resource {
 							Type:     schema.TypeString,
 							Computed: true,
 						},
+						"http_protocol_ipv6": {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
 						"http_put_response_hop_limit": {
 							Type:     schema.TypeInt,
 							Computed: true,
diff --git a/internal/service/ec2/ec2_instance_data_source_test.go b/internal/service/ec2/ec2_instance_data_source_test.go
index d7daef3dec8..5fc4aec3915 100644
--- a/internal/service/ec2/ec2_instance_data_source_test.go
+++ b/internal/service/ec2/ec2_instance_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
@@ -631,6 +634,7 @@ func TestAccEC2InstanceDataSource_metadataOptions(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttrPair(datasourceName, "metadata_options.#", resourceName, "metadata_options.#"),
 					resource.TestCheckResourceAttrPair(datasourceName, "metadata_options.0.http_endpoint", resourceName, "metadata_options.0.http_endpoint"),
+					resource.TestCheckResourceAttrPair(datasourceName, "metadata_options.0.http_protocol_ipv6", resourceName, "metadata_options.0.http_protocol_ipv6"),
 					resource.TestCheckResourceAttrPair(datasourceName, "metadata_options.0.http_tokens", resourceName, "metadata_options.0.http_tokens"),
 					resource.TestCheckResourceAttrPair(datasourceName, "metadata_options.0.http_put_response_hop_limit", resourceName, "metadata_options.0.http_put_response_hop_limit"),
 					resource.TestCheckResourceAttrPair(datasourceName, "metadata_options.0.instance_metadata_tags", resourceName, "metadata_options.0.instance_metadata_tags"),
diff --git a/internal/service/ec2/ec2_instance_migrate.go b/internal/service/ec2/ec2_instance_migrate.go
index 53480d7db82..6ba6ce8518d 100644
--- a/internal/service/ec2/ec2_instance_migrate.go
+++ b/internal/service/ec2/ec2_instance_migrate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/ec2_instance_migrate_test.go b/internal/service/ec2/ec2_instance_migrate_test.go
index 9bc1c90487a..6c846a1da69 100644
--- a/internal/service/ec2/ec2_instance_migrate_test.go
+++ b/internal/service/ec2/ec2_instance_migrate_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/ec2_instance_state.go b/internal/service/ec2/ec2_instance_state.go
index d80f1a3e119..2b812406564 100644
--- a/internal/service/ec2/ec2_instance_state.go
+++ b/internal/service/ec2/ec2_instance_state.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/ec2_instance_state_test.go b/internal/service/ec2/ec2_instance_state_test.go
index 056204af5ca..9f00b933986 100644
--- a/internal/service/ec2/ec2_instance_state_test.go
+++ b/internal/service/ec2/ec2_instance_state_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/ec2_instance_test.go b/internal/service/ec2/ec2_instance_test.go
index 8bbdbe7dbe2..a05cefe68ef 100644
--- a/internal/service/ec2/ec2_instance_test.go
+++ b/internal/service/ec2/ec2_instance_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
@@ -12,6 +15,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/endpoints"
 	"github.com/aws/aws-sdk-go/aws/request"
@@ -200,7 +204,7 @@ func TestAccEC2Instance_basic(t *testing.T) {
 				Config: testAccInstanceConfig_basic(),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckInstanceExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexp.MustCompile(`instance/i-[a-z0-9]+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`instance/i-[0-9a-z]+`)),
 					resource.TestCheckResourceAttr(resourceName, "instance_initiated_shutdown_behavior", "stop"),
 				),
 			},
@@ -367,7 +371,7 @@ func TestAccEC2Instance_atLeastOneOtherEBSVolume(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "root_block_device.#", "0"), // This is an instance store AMI
 					resource.TestCheckResourceAttr(resourceName, "ebs_block_device.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "outpost_arn", ""),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexp.MustCompile(`instance/i-[a-z0-9]+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`instance/i-[0-9a-z]+`)),
 				),
 			},
 			{
@@ -430,7 +434,7 @@ func TestAccEC2Instance_EBSBlockDevice_invalidIopsForVolumeType(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccInstanceConfig_ebsBlockDeviceInvalidIOPS,
-				ExpectError: regexp.MustCompile(`creating resource: iops attribute not supported for ebs_block_device with volume_type gp2`),
+				ExpectError: regexache.MustCompile(`creating resource: iops attribute not supported for ebs_block_device with volume_type gp2`),
 			},
 		},
 	})
@@ -446,7 +450,7 @@ func TestAccEC2Instance_EBSBlockDevice_invalidThroughputForVolumeType(t *testing
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccInstanceConfig_ebsBlockDeviceInvalidThroughput,
-				ExpectError: regexp.MustCompile(`creating resource: throughput attribute not supported for ebs_block_device with volume_type gp2`),
+				ExpectError: regexache.MustCompile(`creating resource: throughput attribute not supported for ebs_block_device with volume_type gp2`),
 			},
 		},
 	})
@@ -713,7 +717,7 @@ func TestAccEC2Instance_gp2WithIopsValue(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccInstanceConfig_gp2IOPSValue(rName),
-				ExpectError: regexp.MustCompile(`creating resource: iops attribute not supported for root_block_device with volume_type gp2`),
+				ExpectError: regexache.MustCompile(`creating resource: iops attribute not supported for root_block_device with volume_type gp2`),
 			},
 		},
 	})
@@ -778,7 +782,7 @@ func TestAccEC2Instance_blockDevices(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckInstanceExists(ctx, resourceName, &v),
 					resource.TestCheckResourceAttr(resourceName, "root_block_device.#", "1"),
-					resource.TestMatchResourceAttr(resourceName, "root_block_device.0.volume_id", regexp.MustCompile("vol-[a-z0-9]+")),
+					resource.TestMatchResourceAttr(resourceName, "root_block_device.0.volume_id", regexache.MustCompile("vol-[0-9a-z]+")),
 					resource.TestCheckResourceAttr(resourceName, "root_block_device.0.volume_size", rootVolumeSize),
 					resource.TestCheckResourceAttr(resourceName, "root_block_device.0.volume_type", "gp2"),
 					resource.TestCheckResourceAttr(resourceName, "ebs_block_device.#", "5"),
@@ -788,7 +792,7 @@ func TestAccEC2Instance_blockDevices(t *testing.T) {
 						"volume_type": "gp2",
 					}),
 					resource.TestMatchTypeSetElemNestedAttrs(resourceName, "ebs_block_device.*", map[string]*regexp.Regexp{
-						"volume_id": regexp.MustCompile("vol-[a-z0-9]+"),
+						"volume_id": regexache.MustCompile("vol-[0-9a-z]+"),
 					}),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "ebs_block_device.*", map[string]string{
 						"device_name": "/dev/sdc",
@@ -810,7 +814,7 @@ func TestAccEC2Instance_blockDevices(t *testing.T) {
 						"iops":        "4000",
 					}),
 					resource.TestMatchTypeSetElemNestedAttrs(resourceName, "ebs_block_device.*", map[string]*regexp.Regexp{
-						"volume_id": regexp.MustCompile("vol-[a-z0-9]+"),
+						"volume_id": regexache.MustCompile("vol-[0-9a-z]+"),
 					}),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "ebs_block_device.*", map[string]string{
 						"device_name": "/dev/sdd",
@@ -818,7 +822,7 @@ func TestAccEC2Instance_blockDevices(t *testing.T) {
 						"volume_size": "12",
 					}),
 					resource.TestMatchTypeSetElemNestedAttrs(resourceName, "ebs_block_device.*", map[string]*regexp.Regexp{
-						"volume_id": regexp.MustCompile("vol-[a-z0-9]+"),
+						"volume_id": regexache.MustCompile("vol-[0-9a-z]+"),
 					}),
 					resource.TestCheckResourceAttr(resourceName, "ephemeral_block_device.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "ephemeral_block_device.*", map[string]string{
@@ -1297,7 +1301,7 @@ func TestAccEC2Instance_ipv6AddressCountAndSingleAddressCausesError(t *testing.T
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccInstanceConfig_ipv6Error(rName),
-				ExpectError: regexp.MustCompile("Conflicting configuration arguments"),
+				ExpectError: regexache.MustCompile("Conflicting configuration arguments"),
 			},
 		},
 	})
@@ -1393,7 +1397,7 @@ func TestAccEC2Instance_networkInstanceRemovingAllSecurityGroups(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "security_groups.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "vpc_security_group_ids.#", "1"),
 				),
-				ExpectError: regexp.MustCompile(`VPC-based instances require at least one security group to be attached`),
+				ExpectError: regexache.MustCompile(`VPC-based instances require at least one security group to be attached`),
 			},
 		},
 	})
@@ -1482,7 +1486,7 @@ func TestAccEC2Instance_BlockDeviceTags_volumeTags(t *testing.T) {
 	})
 }
 
-func TestAccEC2Instance_BlockDeviceTags_withAttachedVolume(t *testing.T) {
+func TestAccEC2Instance_BlockDeviceTags_attachedVolume(t *testing.T) {
 	ctx := acctest.Context(t)
 	var v ec2.Instance
 	resourceName := "aws_instance.test"
@@ -1547,11 +1551,11 @@ func TestAccEC2Instance_BlockDeviceTags_ebsAndRoot(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccInstanceConfig_blockDeviceTagsRootTagsConflict(rName),
-				ExpectError: regexp.MustCompile(`"root_block_device\.0\.tags": conflicts with volume_tags`),
+				ExpectError: regexache.MustCompile(`"root_block_device\.0\.tags": conflicts with volume_tags`),
 			},
 			{
 				Config:      testAccInstanceConfig_blockDeviceTagsEBSTagsConflict(rName),
-				ExpectError: regexp.MustCompile(`"ebs_block_device\.0\.tags": conflicts with volume_tags`),
+				ExpectError: regexache.MustCompile(`"ebs_block_device\.0\.tags": conflicts with volume_tags`),
 			},
 			{
 				Config: testAccInstanceConfig_blockDeviceTagsEBSTags(rName),
@@ -1650,7 +1654,7 @@ func TestAccEC2Instance_instanceProfileChange(t *testing.T) {
 	})
 }
 
-func TestAccEC2Instance_withIAMInstanceProfile(t *testing.T) {
+func TestAccEC2Instance_iamInstanceProfile(t *testing.T) {
 	ctx := acctest.Context(t)
 	var v ec2.Instance
 	resourceName := "aws_instance.test"
@@ -1690,7 +1694,7 @@ func TestAccEC2Instance_withIAMInstanceProfile(t *testing.T) {
 }
 
 // Reference: https://github.com/hashicorp/terraform-provider-aws/issues/17719
-func TestAccEC2Instance_withIAMInstanceProfilePath(t *testing.T) {
+func TestAccEC2Instance_iamInstanceProfilePath(t *testing.T) {
 	ctx := acctest.Context(t)
 	var instance ec2.Instance
 	resourceName := "aws_instance.test"
@@ -3481,7 +3485,7 @@ func TestAccEC2Instance_LaunchTemplate_swapIDAndName(t *testing.T) {
 	})
 }
 
-func TestAccEC2Instance_LaunchTemplate_withIAMInstanceProfile(t *testing.T) {
+func TestAccEC2Instance_LaunchTemplate_iamInstanceProfile(t *testing.T) {
 	ctx := acctest.Context(t)
 	var v ec2.Instance
 	resourceName := "aws_instance.test"
@@ -3530,6 +3534,30 @@ func TestAccEC2Instance_LaunchTemplate_spotAndStop(t *testing.T) {
 	})
 }
 
+func TestAccEC2Instance_LaunchTemplate_vpcSecurityGroup(t *testing.T) {
+	ctx := acctest.Context(t)
+	var v ec2.Instance
+	resourceName := "aws_instance.test"
+	launchTemplateResourceName := "aws_launch_template.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, ec2.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckInstanceDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccInstanceConfig_templateWithVPCSecurityGroups(rName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckInstanceExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttrPair(resourceName, "launch_template.0.id", launchTemplateResourceName, "id"),
+				),
+			},
+		},
+	})
+}
+
 func TestAccEC2Instance_GetPasswordData_falseToTrue(t *testing.T) {
 	ctx := acctest.Context(t)
 	var before, after ec2.Instance
@@ -5004,6 +5032,7 @@ func TestAccEC2Instance_metadataOptions(t *testing.T) {
 					testAccCheckInstanceExists(ctx, resourceName, &v),
 					resource.TestCheckResourceAttr(resourceName, "metadata_options.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "metadata_options.0.http_endpoint", "enabled"),
+					resource.TestCheckResourceAttr(resourceName, "metadata_options.0.http_protocol_ipv6", "disabled"),
 					resource.TestCheckResourceAttr(resourceName, "metadata_options.0.http_tokens", "optional"),
 					resource.TestCheckResourceAttr(resourceName, "metadata_options.0.http_put_response_hop_limit", "1"),
 					resource.TestCheckResourceAttr(resourceName, "metadata_options.0.instance_metadata_tags", "disabled"),
@@ -5015,6 +5044,7 @@ func TestAccEC2Instance_metadataOptions(t *testing.T) {
 					testAccCheckInstanceExists(ctx, resourceName, &v),
 					resource.TestCheckResourceAttr(resourceName, "metadata_options.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "metadata_options.0.http_endpoint", "disabled"),
+					resource.TestCheckResourceAttr(resourceName, "metadata_options.0.http_protocol_ipv6", "disabled"),
 					resource.TestCheckResourceAttr(resourceName, "metadata_options.0.http_tokens", "optional"),
 					resource.TestCheckResourceAttr(resourceName, "metadata_options.0.http_put_response_hop_limit", "1"),
 					resource.TestCheckResourceAttr(resourceName, "metadata_options.0.instance_metadata_tags", "disabled"),
@@ -5026,6 +5056,7 @@ func TestAccEC2Instance_metadataOptions(t *testing.T) {
 					testAccCheckInstanceExists(ctx, resourceName, &v),
 					resource.TestCheckResourceAttr(resourceName, "metadata_options.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "metadata_options.0.http_endpoint", "enabled"),
+					resource.TestCheckResourceAttr(resourceName, "metadata_options.0.http_protocol_ipv6", "enabled"),
 					resource.TestCheckResourceAttr(resourceName, "metadata_options.0.http_tokens", "required"),
 					resource.TestCheckResourceAttr(resourceName, "metadata_options.0.http_put_response_hop_limit", "2"),
 					resource.TestCheckResourceAttr(resourceName, "metadata_options.0.instance_metadata_tags", "enabled"),
@@ -5037,6 +5068,7 @@ func TestAccEC2Instance_metadataOptions(t *testing.T) {
 					testAccCheckInstanceExists(ctx, resourceName, &v),
 					resource.TestCheckResourceAttr(resourceName, "metadata_options.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "metadata_options.0.http_endpoint", "enabled"),
+					resource.TestCheckResourceAttr(resourceName, "metadata_options.0.http_protocol_ipv6", "disabled"),
 					resource.TestCheckResourceAttr(resourceName, "metadata_options.0.http_tokens", "optional"),
 					resource.TestCheckResourceAttr(resourceName, "metadata_options.0.http_put_response_hop_limit", "1"),
 					resource.TestCheckResourceAttr(resourceName, "metadata_options.0.instance_metadata_tags", "disabled"),
@@ -5303,6 +5335,46 @@ func TestAccEC2Instance_CapacityReservation_modifyTarget(t *testing.T) {
 	})
 }
 
+func TestAccEC2Instance_basicWithSpot(t *testing.T) {
+	ctx := acctest.Context(t)
+	var v ec2.Instance
+	resourceName := "aws_instance.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+
+	resource.ParallelTest(t, resource.TestCase{
+		// No subnet_id specified requires default VPC with default subnets.
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, ec2.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckInstanceDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccInstanceConfig_basicWithSpot(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckInstanceExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttrSet(resourceName, "spot_instance_request_id"),
+					resource.TestCheckResourceAttr(resourceName, "instance_lifecycle", "spot"),
+					resource.TestCheckResourceAttr(resourceName, "instance_market_options.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "instance_market_options.0.%", "2"),
+					resource.TestCheckResourceAttr(resourceName, "instance_market_options.0.market_type", "spot"),
+					resource.TestCheckResourceAttr(resourceName, "instance_market_options.0.spot_options.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "instance_market_options.0.spot_options.0.%", "4"),
+					resource.TestCheckResourceAttr(resourceName, "instance_market_options.0.spot_options.0.instance_interruption_behavior", "terminate"),
+					resource.TestCheckResourceAttrSet(resourceName, "instance_market_options.0.spot_options.0.max_price"),
+					resource.TestCheckResourceAttr(resourceName, "instance_market_options.0.spot_options.0.spot_instance_type", "one-time"),
+					resource.TestCheckResourceAttr(resourceName, "instance_market_options.0.spot_options.0.valid_until", ""),
+				),
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"user_data_replace_on_change"},
+			},
+		},
+	})
+}
+
 func testAccCheckInstanceNotRecreated(before, after *ec2.Instance) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		if before, after := aws.StringValue(before.InstanceId), aws.StringValue(after.InstanceId); before != after {
@@ -5325,13 +5397,7 @@ func testAccCheckInstanceRecreated(before, after *ec2.Instance) resource.TestChe
 
 func testAccCheckInstanceDestroy(ctx context.Context) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		return testAccCheckInstanceDestroyWithProvider(ctx)(s, acctest.Provider)
-	}
-}
-
-func testAccCheckInstanceDestroyWithProvider(ctx context.Context) acctest.TestCheckWithProviderFunc {
-	return func(s *terraform.State, provider *schema.Provider) error {
-		conn := provider.Meta().(*conns.AWSClient).EC2Conn(ctx)
+		conn := acctest.Provider.Meta().(*conns.AWSClient).EC2Conn(ctx)
 
 		for _, rs := range s.RootModule().Resources {
 			if rs.Type != "aws_instance" {
@@ -5356,10 +5422,6 @@ func testAccCheckInstanceDestroyWithProvider(ctx context.Context) acctest.TestCh
 }
 
 func testAccCheckInstanceExists(ctx context.Context, n string, v *ec2.Instance) resource.TestCheckFunc {
-	return testAccCheckInstanceExistsWithProvider(ctx, n, v, func() *schema.Provider { return acctest.Provider })
-}
-
-func testAccCheckInstanceExistsWithProvider(ctx context.Context, n string, v *ec2.Instance, providerF func() *schema.Provider) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		rs, ok := s.RootModule().Resources[n]
 		if !ok {
@@ -5370,7 +5432,7 @@ func testAccCheckInstanceExistsWithProvider(ctx context.Context, n string, v *ec
 			return fmt.Errorf("No EC2 Instance ID is set")
 		}
 
-		conn := providerF().Meta().(*conns.AWSClient).EC2Conn(ctx)
+		conn := acctest.Provider.Meta().(*conns.AWSClient).EC2Conn(ctx)
 
 		output, err := tfec2.FindInstanceByID(ctx, conn, rs.Primary.ID)
 
@@ -5426,7 +5488,7 @@ func testAccCheckDetachVolumes(ctx context.Context, instance *ec2.Instance) reso
 func TestInstanceHostIDSchema(t *testing.T) {
 	t.Parallel()
 
-	actualSchema := tfec2.ResourceInstance().Schema["host_id"]
+	actualSchema := tfec2.ResourceInstance().SchemaMap()["host_id"]
 	expectedSchema := &schema.Schema{
 		Type:     schema.TypeString,
 		Optional: true,
@@ -5444,7 +5506,7 @@ func TestInstanceHostIDSchema(t *testing.T) {
 func TestInstanceCPUCoreCountSchema(t *testing.T) {
 	t.Parallel()
 
-	actualSchema := tfec2.ResourceInstance().Schema["cpu_core_count"]
+	actualSchema := tfec2.ResourceInstance().SchemaMap()["cpu_core_count"]
 	expectedSchema := &schema.Schema{
 		Type:          schema.TypeInt,
 		Optional:      true,
@@ -5464,7 +5526,7 @@ func TestInstanceCPUCoreCountSchema(t *testing.T) {
 func TestInstanceCPUThreadsPerCoreSchema(t *testing.T) {
 	t.Parallel()
 
-	actualSchema := tfec2.ResourceInstance().Schema["cpu_threads_per_core"]
+	actualSchema := tfec2.ResourceInstance().SchemaMap()["cpu_threads_per_core"]
 	expectedSchema := &schema.Schema{
 		Type:          schema.TypeInt,
 		Optional:      true,
@@ -5562,46 +5624,6 @@ func defaultSubnetCount(ctx context.Context, t *testing.T) int {
 	return len(subnets)
 }
 
-func TestAccEC2Instance_basicWithSpot(t *testing.T) {
-	ctx := acctest.Context(t)
-	var v ec2.Instance
-	resourceName := "aws_instance.test"
-	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
-
-	resource.ParallelTest(t, resource.TestCase{
-		// No subnet_id specified requires default VPC with default subnets.
-		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, ec2.EndpointsID),
-		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckInstanceDestroy(ctx),
-		Steps: []resource.TestStep{
-			{
-				Config: testAccInstanceConfig_basicWithSpot(rName),
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckInstanceExists(ctx, resourceName, &v),
-					resource.TestCheckResourceAttrSet(resourceName, "spot_instance_request_id"),
-					resource.TestCheckResourceAttr(resourceName, "instance_lifecycle", "spot"),
-					resource.TestCheckResourceAttr(resourceName, "instance_market_options.#", "1"),
-					resource.TestCheckResourceAttr(resourceName, "instance_market_options.0.%", "2"),
-					resource.TestCheckResourceAttr(resourceName, "instance_market_options.0.market_type", "spot"),
-					resource.TestCheckResourceAttr(resourceName, "instance_market_options.0.spot_options.#", "1"),
-					resource.TestCheckResourceAttr(resourceName, "instance_market_options.0.spot_options.0.%", "4"),
-					resource.TestCheckResourceAttr(resourceName, "instance_market_options.0.spot_options.0.instance_interruption_behavior", "terminate"),
-					resource.TestCheckResourceAttrSet(resourceName, "instance_market_options.0.spot_options.0.max_price"),
-					resource.TestCheckResourceAttr(resourceName, "instance_market_options.0.spot_options.0.spot_instance_type", "one-time"),
-					resource.TestCheckResourceAttr(resourceName, "instance_market_options.0.spot_options.0.valid_until", ""),
-				),
-			},
-			{
-				ResourceName:            resourceName,
-				ImportState:             true,
-				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"user_data_replace_on_change"},
-			},
-		},
-	})
-}
-
 // testAccLatestAmazonLinuxPVEBSAMIConfig returns the configuration for a data source that
 // describes the latest Amazon Linux AMI using PV virtualization and an EBS root device.
 // The data source is named 'amzn-ami-minimal-pv-ebs'.
@@ -5829,9 +5851,12 @@ data "aws_vpc" "default" {
 }
 
 resource "aws_security_group" "test" {
-  name        = %[1]q
-  description = %[1]q
-  vpc_id      = data.aws_vpc.default.id
+  name   = %[1]q
+  vpc_id = data.aws_vpc.default.id
+
+  tags = {
+    Name = %[1]q
+  }
 }
 
 resource "aws_instance" "test" {
@@ -5857,9 +5882,12 @@ data "aws_vpc" "default" {
 }
 
 resource "aws_security_group" "test" {
-  name        = %[1]q
-  description = %[1]q
-  vpc_id      = data.aws_vpc.default.id
+  name   = %[1]q
+  vpc_id = data.aws_vpc.default.id
+
+  tags = {
+    Name = %[1]q
+  }
 }
 
 resource "aws_instance" "test" {
@@ -7714,15 +7742,21 @@ resource "aws_subnet" "test2" {
 }
 
 resource "aws_security_group" "test" {
-  vpc_id      = aws_vpc.test.id
-  description = "%[1]s_1"
-  name        = "%[1]s_1"
+  vpc_id = aws_vpc.test.id
+  name   = "%[1]s_1"
+
+  tags = {
+    Name = %[1]q
+  }
 }
 
 resource "aws_security_group" "test2" {
-  vpc_id      = aws_vpc.test.id
-  description = "%[1]s_2"
-  name        = "%[1]s_2"
+  vpc_id = aws_vpc.test.id
+  name   = "%[1]s_2"
+
+  tags = {
+    Name = %[1]q
+  }
 }
 
 resource "aws_instance" "test" {
@@ -7774,15 +7808,21 @@ resource "aws_subnet" "test2" {
 }
 
 resource "aws_security_group" "test" {
-  vpc_id      = aws_vpc.test.id
-  description = "%[1]s_1"
-  name        = "%[1]s_1"
+  vpc_id = aws_vpc.test.id
+  name   = "%[1]s_1"
+
+  tags = {
+    Name = %[1]q
+  }
 }
 
 resource "aws_security_group" "test2" {
-  vpc_id      = aws_vpc.test.id
-  description = "%[1]s_2"
-  name        = "%[1]s_2"
+  vpc_id = aws_vpc.test.id
+  name   = "%[1]s_2"
+
+  tags = {
+    Name = %[1]q
+  }
 }
 
 resource "aws_instance" "test" {
@@ -7825,9 +7865,12 @@ func testAccInstanceConfig_publicAndPrivateSecondaryIPs(rName string, isPublic b
 		testAccInstanceVPCConfig(rName, false, 0),
 		fmt.Sprintf(`
 resource "aws_security_group" "test" {
-  vpc_id      = aws_vpc.test.id
-  description = %[1]q
-  name        = %[1]q
+  vpc_id = aws_vpc.test.id
+  name   = %[1]q
+
+  tags = {
+    Name = %[1]q
+  }
 }
 
 resource "aws_instance" "test" {
@@ -7856,9 +7899,12 @@ func testAccInstanceConfig_privateIPAndSecondaryIPs(rName, privateIP, secondaryI
 		testAccInstanceVPCConfig(rName, false, 0),
 		fmt.Sprintf(`
 resource "aws_security_group" "test" {
-  vpc_id      = aws_vpc.test.id
-  description = %[1]q
-  name        = %[1]q
+  vpc_id = aws_vpc.test.id
+  name   = %[1]q
+
+  tags = {
+    Name = %[1]q
+  }
 }
 
 resource "aws_instance" "test" {
@@ -7886,9 +7932,12 @@ func testAccInstanceConfig_privateIPAndSecondaryIPsNullPrivate(rName, secondaryI
 		testAccInstanceVPCConfig(rName, false, 0),
 		fmt.Sprintf(`
 resource "aws_security_group" "test" {
-  vpc_id      = aws_vpc.test.id
-  description = %[1]q
-  name        = %[1]q
+  vpc_id = aws_vpc.test.id
+  name   = %[1]q
+
+  tags = {
+    Name = %[1]q
+  }
 }
 
 resource "aws_instance" "test" {
@@ -8539,6 +8588,7 @@ resource "aws_instance" "test" {
 
   metadata_options {
     http_endpoint               = "enabled"
+    http_protocol_ipv6          = "enabled"
     http_tokens                 = "required"
     http_put_response_hop_limit = 2
     instance_metadata_tags      = "enabled"
@@ -8564,6 +8614,7 @@ resource "aws_instance" "test" {
 
   metadata_options {
     http_endpoint               = "enabled"
+    http_protocol_ipv6          = "disabled"
     http_tokens                 = "optional"
     http_put_response_hop_limit = 1
     instance_metadata_tags      = "disabled"
@@ -8941,3 +8992,72 @@ resource "aws_instance" "test" {
 }
 `, rName))
 }
+
+func testAccInstanceConfig_templateWithVPCSecurityGroups(rName string) string {
+	return acctest.ConfigCompose(
+		acctest.ConfigLatestAmazonLinuxHVMEBSAMI(),
+		acctest.AvailableEC2InstanceTypeForRegion("t3.micro", "t2.micro", "t1.micro", "m1.small"),
+		testAccInstanceVPCConfig(rName, false, 0),
+		fmt.Sprintf(`
+resource "aws_iam_role" "test" {
+  name = %[1]q
+
+  assume_role_policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Principal": {
+        "Service": [
+          "ec2.amazonaws.com"
+        ]
+      },
+      "Action": [
+        "sts:AssumeRole"
+      ]
+    }
+  ]
+}
+EOF
+}
+
+resource "aws_iam_instance_profile" "test" {
+  name = %[1]q
+  role = aws_iam_role.test.name
+}
+
+resource "aws_security_group" "test" {
+  vpc_id = aws_vpc.test.id
+  name   = %[1]q
+
+  tags = {
+    Name = %[1]q
+  }
+}
+
+resource "aws_launch_template" "test" {
+  name          = %[1]q
+  image_id      = data.aws_ami.amzn-ami-minimal-hvm-ebs.id
+  instance_type = data.aws_ec2_instance_type_offering.available.instance_type
+
+  iam_instance_profile {
+    name = aws_iam_instance_profile.test.name
+  }
+
+  vpc_security_group_ids = [aws_security_group.test.id]
+}
+
+resource "aws_instance" "test" {
+  subnet_id = aws_subnet.test.id
+
+  launch_template {
+    name = aws_launch_template.test.name
+  }
+
+  tags = {
+    Name = %[1]q
+  }
+}
+`, rName))
+}
diff --git a/internal/service/ec2/ec2_instance_type_data_source.go b/internal/service/ec2/ec2_instance_type_data_source.go
index b8da90e8770..547f4f66395 100644
--- a/internal/service/ec2/ec2_instance_type_data_source.go
+++ b/internal/service/ec2/ec2_instance_type_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/ec2_instance_type_data_source_test.go b/internal/service/ec2/ec2_instance_type_data_source_test.go
index c46a9e57428..135745f5f9e 100644
--- a/internal/service/ec2/ec2_instance_type_data_source_test.go
+++ b/internal/service/ec2/ec2_instance_type_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/ec2_instance_type_offering_data_source.go b/internal/service/ec2/ec2_instance_type_offering_data_source.go
index f4fdd514cbc..7289b5a7094 100644
--- a/internal/service/ec2/ec2_instance_type_offering_data_source.go
+++ b/internal/service/ec2/ec2_instance_type_offering_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -23,7 +26,7 @@ func DataSourceInstanceTypeOffering() *schema.Resource {
 		},
 
 		Schema: map[string]*schema.Schema{
-			"filter": DataSourceFiltersSchema(),
+			"filter": CustomFiltersSchema(),
 			"instance_type": {
 				Type:     schema.TypeString,
 				Computed: true,
@@ -49,7 +52,7 @@ func dataSourceInstanceTypeOfferingRead(ctx context.Context, d *schema.ResourceD
 	input := &ec2.DescribeInstanceTypeOfferingsInput{}
 
 	if v, ok := d.GetOk("filter"); ok {
-		input.Filters = BuildFiltersDataSource(v.(*schema.Set))
+		input.Filters = BuildCustomFilterList(v.(*schema.Set))
 	}
 
 	if v, ok := d.GetOk("location_type"); ok {
diff --git a/internal/service/ec2/ec2_instance_type_offering_data_source_test.go b/internal/service/ec2/ec2_instance_type_offering_data_source_test.go
index d142281472b..0a6af63897b 100644
--- a/internal/service/ec2/ec2_instance_type_offering_data_source_test.go
+++ b/internal/service/ec2/ec2_instance_type_offering_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/ec2_instance_type_offerings_data_source.go b/internal/service/ec2/ec2_instance_type_offerings_data_source.go
index 41b28003e6c..c24558cac8c 100644
--- a/internal/service/ec2/ec2_instance_type_offerings_data_source.go
+++ b/internal/service/ec2/ec2_instance_type_offerings_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -23,7 +26,7 @@ func DataSourceInstanceTypeOfferings() *schema.Resource {
 		},
 
 		Schema: map[string]*schema.Schema{
-			"filter": DataSourceFiltersSchema(),
+			"filter": CustomFiltersSchema(),
 			"instance_types": {
 				Type:     schema.TypeList,
 				Computed: true,
@@ -55,7 +58,7 @@ func dataSourceInstanceTypeOfferingsRead(ctx context.Context, d *schema.Resource
 	input := &ec2.DescribeInstanceTypeOfferingsInput{}
 
 	if v, ok := d.GetOk("filter"); ok {
-		input.Filters = BuildFiltersDataSource(v.(*schema.Set))
+		input.Filters = BuildCustomFilterList(v.(*schema.Set))
 	}
 
 	if v, ok := d.GetOk("location_type"); ok {
diff --git a/internal/service/ec2/ec2_instance_type_offerings_data_source_test.go b/internal/service/ec2/ec2_instance_type_offerings_data_source_test.go
index 1f77a90d7bd..1673a00e8e6 100644
--- a/internal/service/ec2/ec2_instance_type_offerings_data_source_test.go
+++ b/internal/service/ec2/ec2_instance_type_offerings_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/ec2_instance_types_data_source.go b/internal/service/ec2/ec2_instance_types_data_source.go
index aeed4c2d312..9f6fb714f47 100644
--- a/internal/service/ec2/ec2_instance_types_data_source.go
+++ b/internal/service/ec2/ec2_instance_types_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -22,7 +25,7 @@ func DataSourceInstanceTypes() *schema.Resource {
 		},
 
 		Schema: map[string]*schema.Schema{
-			"filter": DataSourceFiltersSchema(),
+			"filter": CustomFiltersSchema(),
 			"instance_types": {
 				Type:     schema.TypeList,
 				Computed: true,
@@ -39,7 +42,7 @@ func dataSourceInstanceTypesRead(ctx context.Context, d *schema.ResourceData, me
 	input := &ec2.DescribeInstanceTypesInput{}
 
 	if v, ok := d.GetOk("filter"); ok {
-		input.Filters = BuildFiltersDataSource(v.(*schema.Set))
+		input.Filters = BuildCustomFilterList(v.(*schema.Set))
 	}
 
 	output, err := FindInstanceTypes(ctx, conn, input)
diff --git a/internal/service/ec2/ec2_instance_types_data_source_test.go b/internal/service/ec2/ec2_instance_types_data_source_test.go
index 4dadab4a5ef..e62f45021fb 100644
--- a/internal/service/ec2/ec2_instance_types_data_source_test.go
+++ b/internal/service/ec2/ec2_instance_types_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/ec2_instances_data_source.go b/internal/service/ec2/ec2_instances_data_source.go
index 49f4a00a8b3..4cde50c5171 100644
--- a/internal/service/ec2/ec2_instances_data_source.go
+++ b/internal/service/ec2/ec2_instances_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -25,7 +28,7 @@ func DataSourceInstances() *schema.Resource {
 		},
 
 		Schema: map[string]*schema.Schema{
-			"filter": DataSourceFiltersSchema(),
+			"filter": CustomFiltersSchema(),
 			"ids": {
 				Type:     schema.TypeList,
 				Computed: true,
@@ -81,7 +84,7 @@ func dataSourceInstancesRead(ctx context.Context, d *schema.ResourceData, meta i
 		Tags(tftags.New(ctx, d.Get("instance_tags").(map[string]interface{}))),
 	)...)
 
-	input.Filters = append(input.Filters, BuildFiltersDataSource(
+	input.Filters = append(input.Filters, BuildCustomFilterList(
 		d.Get("filter").(*schema.Set),
 	)...)
 
diff --git a/internal/service/ec2/ec2_instances_data_source_test.go b/internal/service/ec2/ec2_instances_data_source_test.go
index 8dea633ef42..74a87ff554c 100644
--- a/internal/service/ec2/ec2_instances_data_source_test.go
+++ b/internal/service/ec2/ec2_instances_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/ec2_key_pair.go b/internal/service/ec2/ec2_key_pair.go
index e812ca38a68..c1748b90bfe 100644
--- a/internal/service/ec2/ec2_key_pair.go
+++ b/internal/service/ec2/ec2_key_pair.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/ec2_key_pair_data_source.go b/internal/service/ec2/ec2_key_pair_data_source.go
index 4b5b3ed95ea..044630d256c 100644
--- a/internal/service/ec2/ec2_key_pair_data_source.go
+++ b/internal/service/ec2/ec2_key_pair_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -34,7 +37,7 @@ func DataSourceKeyPair() *schema.Resource {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
-			"filter": DataSourceFiltersSchema(),
+			"filter": CustomFiltersSchema(),
 			"fingerprint": {
 				Type:     schema.TypeString,
 				Computed: true,
@@ -73,7 +76,7 @@ func dataSourceKeyPairRead(ctx context.Context, d *schema.ResourceData, meta int
 	input := &ec2.DescribeKeyPairsInput{}
 
 	if v, ok := d.GetOk("filter"); ok {
-		input.Filters = BuildFiltersDataSource(v.(*schema.Set))
+		input.Filters = BuildCustomFilterList(v.(*schema.Set))
 	}
 
 	if v, ok := d.GetOk("key_name"); ok {
diff --git a/internal/service/ec2/ec2_key_pair_data_source_test.go b/internal/service/ec2/ec2_key_pair_data_source_test.go
index 13debd181b1..d6f725510bc 100644
--- a/internal/service/ec2/ec2_key_pair_data_source_test.go
+++ b/internal/service/ec2/ec2_key_pair_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/ec2_key_pair_migrate.go b/internal/service/ec2/ec2_key_pair_migrate.go
index 2ef9315abf0..136a5641dab 100644
--- a/internal/service/ec2/ec2_key_pair_migrate.go
+++ b/internal/service/ec2/ec2_key_pair_migrate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/ec2_key_pair_migrate_test.go b/internal/service/ec2/ec2_key_pair_migrate_test.go
index 7e6bd7b1eea..c1bc6693ce8 100644
--- a/internal/service/ec2/ec2_key_pair_migrate_test.go
+++ b/internal/service/ec2/ec2_key_pair_migrate_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/ec2_key_pair_test.go b/internal/service/ec2/ec2_key_pair_test.go
index 75773ae65e8..778bf4b8337 100644
--- a/internal/service/ec2/ec2_key_pair_test.go
+++ b/internal/service/ec2/ec2_key_pair_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -38,7 +41,7 @@ func TestAccEC2KeyPair_basic(t *testing.T) {
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckKeyPairExists(ctx, resourceName, &keyPair),
 					acctest.CheckResourceAttrRegionalARN(resourceName, "arn", "ec2", fmt.Sprintf("key-pair/%s", rName)),
-					resource.TestMatchResourceAttr(resourceName, "fingerprint", regexp.MustCompile(`[a-f0-9]{2}(:[a-f0-9]{2}){15}`)),
+					resource.TestMatchResourceAttr(resourceName, "fingerprint", regexache.MustCompile(`[0-9a-f]{2}(:[0-9a-f]{2}){15}`)),
 					resource.TestCheckResourceAttr(resourceName, "key_name", rName),
 					resource.TestCheckResourceAttr(resourceName, "key_name_prefix", ""),
 					resource.TestCheckResourceAttr(resourceName, "public_key", publicKey),
diff --git a/internal/service/ec2/ec2_launch_template.go b/internal/service/ec2/ec2_launch_template.go
index af5a772f507..9042f646df2 100644
--- a/internal/service/ec2/ec2_launch_template.go
+++ b/internal/service/ec2/ec2_launch_template.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -19,10 +22,10 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/create"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
-	"github.com/hashicorp/terraform-provider-aws/internal/experimental/nullable"
 	"github.com/hashicorp/terraform-provider-aws/internal/flex"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/internal/types/nullable"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
diff --git a/internal/service/ec2/ec2_launch_template_data_source.go b/internal/service/ec2/ec2_launch_template_data_source.go
index 2ec3179e045..7f2ba70ff2c 100644
--- a/internal/service/ec2/ec2_launch_template_data_source.go
+++ b/internal/service/ec2/ec2_launch_template_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -207,7 +210,7 @@ func DataSourceLaunchTemplate() *schema.Resource {
 					},
 				},
 			},
-			"filter": DataSourceFiltersSchema(),
+			"filter": CustomFiltersSchema(),
 			"hibernation_options": {
 				Type:     schema.TypeList,
 				Computed: true,
@@ -790,7 +793,7 @@ func dataSourceLaunchTemplateRead(ctx context.Context, d *schema.ResourceData, m
 		input.LaunchTemplateNames = aws.StringSlice([]string{v.(string)})
 	}
 
-	input.Filters = append(input.Filters, BuildFiltersDataSource(
+	input.Filters = append(input.Filters, BuildCustomFilterList(
 		d.Get("filter").(*schema.Set),
 	)...)
 
diff --git a/internal/service/ec2/ec2_launch_template_data_source_test.go b/internal/service/ec2/ec2_launch_template_data_source_test.go
index c857670d55d..8d3f8ddac4a 100644
--- a/internal/service/ec2/ec2_launch_template_data_source_test.go
+++ b/internal/service/ec2/ec2_launch_template_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/ec2_launch_template_test.go b/internal/service/ec2/ec2_launch_template_test.go
index 0b5dc627b99..81b43ae29b9 100644
--- a/internal/service/ec2/ec2_launch_template_test.go
+++ b/internal/service/ec2/ec2_launch_template_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"strconv"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -33,7 +36,7 @@ func TestAccEC2LaunchTemplate_basic(t *testing.T) {
 				Config: testAccLaunchTemplateConfig_name(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckLaunchTemplateExists(ctx, resourceName, &template),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexp.MustCompile(`launch-template/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`launch-template/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "block_device_mappings.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "capacity_reservation_specification.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "cpu_options.#", "0"),
diff --git a/internal/service/ec2/ec2_placement_group.go b/internal/service/ec2/ec2_placement_group.go
index 3f931bb260e..7a169a0ddf7 100644
--- a/internal/service/ec2/ec2_placement_group.go
+++ b/internal/service/ec2/ec2_placement_group.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/ec2_placement_group_test.go b/internal/service/ec2/ec2_placement_group_test.go
index f0ac6747691..fae3073b3af 100644
--- a/internal/service/ec2/ec2_placement_group_test.go
+++ b/internal/service/ec2/ec2_placement_group_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/ec2_public_ipv4_pool_data_source.go b/internal/service/ec2/ec2_public_ipv4_pool_data_source.go
index cc788938eba..0cb7b2c65db 100644
--- a/internal/service/ec2/ec2_public_ipv4_pool_data_source.go
+++ b/internal/service/ec2/ec2_public_ipv4_pool_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/ec2_public_ipv4_pool_data_source_test.go b/internal/service/ec2/ec2_public_ipv4_pool_data_source_test.go
index 5c9462910f0..ddcc6304143 100644
--- a/internal/service/ec2/ec2_public_ipv4_pool_data_source_test.go
+++ b/internal/service/ec2/ec2_public_ipv4_pool_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/ec2_public_ipv4_pools_data_source.go b/internal/service/ec2/ec2_public_ipv4_pools_data_source.go
index 1deb135bb0c..e6fdef4dd2a 100644
--- a/internal/service/ec2/ec2_public_ipv4_pools_data_source.go
+++ b/internal/service/ec2/ec2_public_ipv4_pools_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -18,7 +21,7 @@ func DataSourcePublicIPv4Pools() *schema.Resource {
 		ReadWithoutTimeout: dataSourcePublicIPv4PoolsRead,
 
 		Schema: map[string]*schema.Schema{
-			"filter": DataSourceFiltersSchema(),
+			"filter": CustomFiltersSchema(),
 			"pool_ids": {
 				Type:     schema.TypeList,
 				Computed: true,
@@ -39,7 +42,7 @@ func dataSourcePublicIPv4PoolsRead(ctx context.Context, d *schema.ResourceData,
 		Tags(tftags.New(ctx, d.Get("tags").(map[string]interface{}))),
 	)...)
 
-	input.Filters = append(input.Filters, BuildFiltersDataSource(
+	input.Filters = append(input.Filters, BuildCustomFilterList(
 		d.Get("filter").(*schema.Set),
 	)...)
 
diff --git a/internal/service/ec2/ec2_public_ipv4_pools_data_source_test.go b/internal/service/ec2/ec2_public_ipv4_pools_data_source_test.go
index 5d9e095fc85..22aa467b241 100644
--- a/internal/service/ec2/ec2_public_ipv4_pools_data_source_test.go
+++ b/internal/service/ec2/ec2_public_ipv4_pools_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/ec2_serial_console_access.go b/internal/service/ec2/ec2_serial_console_access.go
index e29d1e138a0..7ae26cabe08 100644
--- a/internal/service/ec2/ec2_serial_console_access.go
+++ b/internal/service/ec2/ec2_serial_console_access.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/ec2_serial_console_access_data_source.go b/internal/service/ec2/ec2_serial_console_access_data_source.go
index e7bac7e509d..68be0c89e9f 100644
--- a/internal/service/ec2/ec2_serial_console_access_data_source.go
+++ b/internal/service/ec2/ec2_serial_console_access_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/ec2_serial_console_access_data_source_test.go b/internal/service/ec2/ec2_serial_console_access_data_source_test.go
index b4552d93060..14c28173142 100644
--- a/internal/service/ec2/ec2_serial_console_access_data_source_test.go
+++ b/internal/service/ec2/ec2_serial_console_access_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/ec2_serial_console_access_test.go b/internal/service/ec2/ec2_serial_console_access_test.go
index ca2ffbbfd20..d3724e15753 100644
--- a/internal/service/ec2/ec2_serial_console_access_test.go
+++ b/internal/service/ec2/ec2_serial_console_access_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/ec2_spot_datafeed_subscription.go b/internal/service/ec2/ec2_spot_datafeed_subscription.go
index b1570174b28..f0070bf1ea8 100644
--- a/internal/service/ec2/ec2_spot_datafeed_subscription.go
+++ b/internal/service/ec2/ec2_spot_datafeed_subscription.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/ec2_spot_datafeed_subscription_test.go b/internal/service/ec2/ec2_spot_datafeed_subscription_test.go
index 5cb64c10f8d..6139d30726a 100644
--- a/internal/service/ec2/ec2_spot_datafeed_subscription_test.go
+++ b/internal/service/ec2/ec2_spot_datafeed_subscription_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/ec2_spot_fleet_request.go b/internal/service/ec2/ec2_spot_fleet_request.go
index 782e7ef4e1c..67f6254ccc3 100644
--- a/internal/service/ec2/ec2_spot_fleet_request.go
+++ b/internal/service/ec2/ec2_spot_fleet_request.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -18,10 +21,10 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/create"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
-	"github.com/hashicorp/terraform-provider-aws/internal/experimental/nullable"
 	"github.com/hashicorp/terraform-provider-aws/internal/flex"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/internal/types/nullable"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -993,7 +996,7 @@ func resourceSpotFleetRequestCreate(ctx context.Context, d *schema.ResourceData,
 	}
 
 	log.Printf("[DEBUG] Creating EC2 Spot Fleet Request: %s", input)
-	outputRaw, err := tfresource.RetryWhenAWSErrMessageContains(ctx, propagationTimeout,
+	outputRaw, err := tfresource.RetryWhenAWSErrMessageContains(ctx, iamPropagationTimeout,
 		func() (interface{}, error) {
 			return conn.RequestSpotFleetWithContext(ctx, input)
 		},
diff --git a/internal/service/ec2/ec2_spot_fleet_request_migrate.go b/internal/service/ec2/ec2_spot_fleet_request_migrate.go
index 77d298458dc..e186eb3eedd 100644
--- a/internal/service/ec2/ec2_spot_fleet_request_migrate.go
+++ b/internal/service/ec2/ec2_spot_fleet_request_migrate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/ec2_spot_fleet_request_migrate_test.go b/internal/service/ec2/ec2_spot_fleet_request_migrate_test.go
index 8098f4228c6..5621a0f4d2b 100644
--- a/internal/service/ec2/ec2_spot_fleet_request_migrate_test.go
+++ b/internal/service/ec2/ec2_spot_fleet_request_migrate_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/ec2_spot_fleet_request_test.go b/internal/service/ec2/ec2_spot_fleet_request_test.go
index 51b842645ae..c62331b665e 100644
--- a/internal/service/ec2/ec2_spot_fleet_request_test.go
+++ b/internal/service/ec2/ec2_spot_fleet_request_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
@@ -9,6 +12,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -1907,7 +1911,7 @@ func testAccCheckSpotFleetRequest_IAMInstanceProfileARN(sfr *ec2.SpotFleetReques
 			return fmt.Errorf("Expected IamInstanceProfile to be set, got nil")
 		}
 		//Validate the string whether it is ARN
-		re := regexp.MustCompile(fmt.Sprintf(`arn:%s:iam::\d{12}:instance-profile/?[a-zA-Z0-9+=,.@-_].*`, acctest.Partition()))
+		re := regexache.MustCompile(fmt.Sprintf(`arn:%s:iam::\d{12}:instance-profile/?[0-9A-Za-z@-_+=,.].*`, acctest.Partition())) // regex seems suspicious, @-_ is a range
 		if !re.MatchString(*profile.Arn) {
 			return fmt.Errorf("Expected IamInstanceProfile input as ARN, got %s", *profile.Arn)
 		}
diff --git a/internal/service/ec2/ec2_spot_instance_request.go b/internal/service/ec2/ec2_spot_instance_request.go
index f447d1077e4..db39e66c415 100644
--- a/internal/service/ec2/ec2_spot_instance_request.go
+++ b/internal/service/ec2/ec2_spot_instance_request.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -42,14 +45,15 @@ func ResourceSpotInstanceRequest() *schema.Resource {
 
 		Schema: func() map[string]*schema.Schema {
 			// The Spot Instance Request Schema is based on the AWS Instance schema.
-			s := ResourceInstance().Schema
+			s := ResourceInstance().SchemaMap()
 
-			// Everything on a spot instance is ForceNew (except tags).
+			// Everything on a spot instance is ForceNew (except tags/tags_all).
 			for k, v := range s {
 				if v.Computed && !v.Optional {
 					continue
 				}
-				if k == names.AttrTags {
+				// tags_all is Optional+Computed.
+				if k == names.AttrTags || k == names.AttrTagsAll {
 					continue
 				}
 				v.ForceNew = true
@@ -200,7 +204,7 @@ func resourceSpotInstanceRequestCreate(ctx context.Context, d *schema.ResourceDa
 		input.LaunchSpecification.Placement = instanceOpts.SpotPlacement
 	}
 
-	outputRaw, err := tfresource.RetryWhen(ctx, propagationTimeout,
+	outputRaw, err := tfresource.RetryWhen(ctx, iamPropagationTimeout,
 		func() (interface{}, error) {
 			return conn.RequestSpotInstancesWithContext(ctx, input)
 		},
@@ -239,7 +243,7 @@ func resourceSpotInstanceRequestRead(ctx context.Context, d *schema.ResourceData
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).EC2Conn(ctx)
 
-	outputRaw, err := tfresource.RetryWhenNewResourceNotFound(ctx, propagationTimeout, func() (interface{}, error) {
+	outputRaw, err := tfresource.RetryWhenNewResourceNotFound(ctx, ec2PropagationTimeout, func() (interface{}, error) {
 		return FindSpotInstanceRequestByID(ctx, conn, d.Id())
 	}, d.IsNewResource())
 
diff --git a/internal/service/ec2/ec2_spot_instance_request_test.go b/internal/service/ec2/ec2_spot_instance_request_test.go
index 8fe96150dc4..54adf851251 100644
--- a/internal/service/ec2/ec2_spot_instance_request_test.go
+++ b/internal/service/ec2/ec2_spot_instance_request_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
@@ -76,7 +79,7 @@ func TestAccEC2SpotInstanceRequest_disappears(t *testing.T) {
 
 func TestAccEC2SpotInstanceRequest_tags(t *testing.T) {
 	ctx := acctest.Context(t)
-	var sir ec2.SpotInstanceRequest
+	var sir1, sir2, sir3 ec2.SpotInstanceRequest
 	resourceName := "aws_spot_instance_request.test"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
@@ -89,7 +92,7 @@ func TestAccEC2SpotInstanceRequest_tags(t *testing.T) {
 			{
 				Config: testAccSpotInstanceRequestConfig_tags1(rName, "key1", "value1"),
 				Check: resource.ComposeAggregateTestCheckFunc(
-					testAccCheckSpotInstanceRequestExists(ctx, resourceName, &sir),
+					testAccCheckSpotInstanceRequestExists(ctx, resourceName, &sir1),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
 				),
@@ -103,7 +106,8 @@ func TestAccEC2SpotInstanceRequest_tags(t *testing.T) {
 			{
 				Config: testAccSpotInstanceRequestConfig_tags2(rName, "key1", "value1updated", "key2", "value2"),
 				Check: resource.ComposeAggregateTestCheckFunc(
-					testAccCheckSpotInstanceRequestExists(ctx, resourceName, &sir),
+					testAccCheckSpotInstanceRequestExists(ctx, resourceName, &sir2),
+					testAccCheckSpotInstanceRequestIDsEqual(&sir2, &sir1),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1updated"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
@@ -112,7 +116,8 @@ func TestAccEC2SpotInstanceRequest_tags(t *testing.T) {
 			{
 				Config: testAccSpotInstanceRequestConfig_tags1(rName, "key2", "value2"),
 				Check: resource.ComposeAggregateTestCheckFunc(
-					testAccCheckSpotInstanceRequestExists(ctx, resourceName, &sir),
+					testAccCheckSpotInstanceRequestExists(ctx, resourceName, &sir3),
+					testAccCheckSpotInstanceRequestIDsEqual(&sir3, &sir2),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
 				),
@@ -496,7 +501,7 @@ func TestAccEC2SpotInstanceRequest_interruptUpdate(t *testing.T) {
 				Config: testAccSpotInstanceRequestConfig_interrupt(rName, "terminate"),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckSpotInstanceRequestExists(ctx, resourceName, &sir2),
-					testAccCheckSpotInstanceRequestRecreated(&sir1, &sir2),
+					testAccCheckSpotInstanceRequestIDsNotEqual(&sir1, &sir2),
 					resource.TestCheckResourceAttr(resourceName, "instance_interruption_behavior", "terminate"),
 				),
 			},
@@ -693,10 +698,20 @@ func testAccCheckSpotInstanceRequestAttributesVPC(
 	}
 }
 
-func testAccCheckSpotInstanceRequestRecreated(before, after *ec2.SpotInstanceRequest) resource.TestCheckFunc {
+func testAccCheckSpotInstanceRequestIDsEqual(sir1, sir2 *ec2.SpotInstanceRequest) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		if aws.StringValue(sir1.SpotInstanceRequestId) != aws.StringValue(sir2.SpotInstanceRequestId) {
+			return fmt.Errorf("Spot Instance Request IDs are not equal")
+		}
+
+		return nil
+	}
+}
+
+func testAccCheckSpotInstanceRequestIDsNotEqual(sir1, sir2 *ec2.SpotInstanceRequest) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		if before, after := aws.StringValue(before.InstanceId), aws.StringValue(after.InstanceId); before == after {
-			return fmt.Errorf("Spot Instance (%s) not recreated", before)
+		if aws.StringValue(sir1.SpotInstanceRequestId) == aws.StringValue(sir2.SpotInstanceRequestId) {
+			return fmt.Errorf("Spot Instance Request IDs are equal")
 		}
 
 		return nil
diff --git a/internal/service/ec2/ec2_spot_price_data_source.go b/internal/service/ec2/ec2_spot_price_data_source.go
index 61854a8d680..d634ea128a9 100644
--- a/internal/service/ec2/ec2_spot_price_data_source.go
+++ b/internal/service/ec2/ec2_spot_price_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -22,7 +25,7 @@ func DataSourceSpotPrice() *schema.Resource {
 		},
 
 		Schema: map[string]*schema.Schema{
-			"filter": DataSourceFiltersSchema(),
+			"filter": CustomFiltersSchema(),
 			"instance_type": {
 				Type:     schema.TypeString,
 				Optional: true,
@@ -65,7 +68,7 @@ func dataSourceSpotPriceRead(ctx context.Context, d *schema.ResourceData, meta i
 	}
 
 	if v, ok := d.GetOk("filter"); ok {
-		input.Filters = BuildFiltersDataSource(v.(*schema.Set))
+		input.Filters = BuildCustomFilterList(v.(*schema.Set))
 	}
 
 	var foundSpotPrice []*ec2.SpotPrice
diff --git a/internal/service/ec2/ec2_spot_price_data_source_test.go b/internal/service/ec2/ec2_spot_price_data_source_test.go
index 80de3a7ad72..7a1c4e253d7 100644
--- a/internal/service/ec2/ec2_spot_price_data_source_test.go
+++ b/internal/service/ec2/ec2_spot_price_data_source_test.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
 	"context"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -25,8 +28,8 @@ func TestAccEC2SpotPriceDataSource_basic(t *testing.T) {
 			{
 				Config: testAccSpotPriceDataSourceConfig_basic(),
 				Check: resource.ComposeTestCheckFunc(
-					resource.TestMatchResourceAttr(dataSourceName, "spot_price", regexp.MustCompile(`^\d+\.\d+$`)),
-					resource.TestMatchResourceAttr(dataSourceName, "spot_price_timestamp", regexp.MustCompile(acctest.RFC3339RegexPattern)),
+					resource.TestMatchResourceAttr(dataSourceName, "spot_price", regexache.MustCompile(`^\d+\.\d+$`)),
+					resource.TestMatchResourceAttr(dataSourceName, "spot_price_timestamp", regexache.MustCompile(acctest.RFC3339RegexPattern)),
 				),
 			},
 		},
@@ -46,8 +49,8 @@ func TestAccEC2SpotPriceDataSource_filter(t *testing.T) {
 			{
 				Config: testAccSpotPriceDataSourceConfig_filter(),
 				Check: resource.ComposeTestCheckFunc(
-					resource.TestMatchResourceAttr(dataSourceName, "spot_price", regexp.MustCompile(`^\d+\.\d+$`)),
-					resource.TestMatchResourceAttr(dataSourceName, "spot_price_timestamp", regexp.MustCompile(acctest.RFC3339RegexPattern)),
+					resource.TestMatchResourceAttr(dataSourceName, "spot_price", regexache.MustCompile(`^\d+\.\d+$`)),
+					resource.TestMatchResourceAttr(dataSourceName, "spot_price_timestamp", regexache.MustCompile(acctest.RFC3339RegexPattern)),
 				),
 			},
 		},
diff --git a/internal/service/ec2/errors.go b/internal/service/ec2/errors.go
index c43c09c83e7..4ccd1e9e105 100644
--- a/internal/service/ec2/errors.go
+++ b/internal/service/ec2/errors.go
@@ -1,15 +1,19 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
+	"errors"
 	"fmt"
 
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/awserr"
 	"github.com/aws/aws-sdk-go/service/ec2"
-	multierror "github.com/hashicorp/go-multierror"
 )
 
 const (
+	errCodeAnalysisExistsForNetworkInsightsPath              = "AnalysisExistsForNetworkInsightsPath"
 	errCodeAuthFailure                                       = "AuthFailure"
 	errCodeClientInvalidHostIDNotFound                       = "Client.InvalidHostID.NotFound"
 	errCodeConcurrentMutationLimitExceeded                   = "ConcurrentMutationLimitExceeded"
@@ -41,6 +45,7 @@ const (
 	errCodeInvalidGroupInUse                                 = "InvalidGroup.InUse"
 	errCodeInvalidGroupNotFound                              = "InvalidGroup.NotFound"
 	errCodeInvalidHostIDNotFound                             = "InvalidHostID.NotFound"
+	errCodeInvalidInstanceConnectEndpointIdNotFound          = "InvalidInstanceConnectEndpointId.NotFound"
 	errCodeInvalidInstanceID                                 = "InvalidInstanceID"
 	errCodeInvalidInstanceIDNotFound                         = "InvalidInstanceID.NotFound"
 	errCodeInvalidInternetGatewayIDNotFound                  = "InvalidInternetGatewayID.NotFound"
@@ -87,6 +92,7 @@ const (
 	errCodeInvalidSubnetIDNotFound                           = "InvalidSubnetID.NotFound"
 	errCodeInvalidSubnetIdNotFound                           = "InvalidSubnetId.NotFound"
 	errCodeInvalidTrafficMirrorFilterIdNotFound              = "InvalidTrafficMirrorFilterId.NotFound"
+	errCodeInvalidTrafficMirrorFilterRuleIdNotFound          = "InvalidTrafficMirrorFilterRuleId.NotFound"
 	errCodeInvalidTrafficMirrorSessionIdNotFound             = "InvalidTrafficMirrorSessionId.NotFound"
 	errCodeInvalidTrafficMirrorTargetIdNotFound              = "InvalidTrafficMirrorTargetId.NotFound"
 	errCodeInvalidTransitGatewayAttachmentIDNotFound         = "InvalidTransitGatewayAttachmentID.NotFound"
@@ -94,6 +100,9 @@ const (
 	errCodeInvalidTransitGatewayPolicyTableIdNotFound        = "InvalidTransitGatewayPolicyTableId.NotFound"
 	errCodeInvalidTransitGatewayIDNotFound                   = "InvalidTransitGatewayID.NotFound"
 	errCodeInvalidTransitGatewayMulticastDomainIdNotFound    = "InvalidTransitGatewayMulticastDomainId.NotFound"
+	errCodeInvalidVerifiedAccessGroupIdNotFound              = "InvalidVerifiedAccessGroupId.NotFound"
+	errCodeInvalidVerifiedAccessInstanceIdNotFound           = "InvalidVerifiedAccessInstanceId.NotFound"
+	errCodeInvalidVerifiedAccessTrustProviderIdNotFound      = "InvalidVerifiedAccessTrustProviderId.NotFound"
 	errCodeInvalidVolumeNotFound                             = "InvalidVolume.NotFound"
 	errCodeInvalidVPCCIDRBlockAssociationIDNotFound          = "InvalidVpcCidrBlockAssociationID.NotFound"
 	errCodeInvalidVPCEndpointIdNotFound                      = "InvalidVpcEndpointId.NotFound"
@@ -124,15 +133,15 @@ func CancelSpotFleetRequestError(apiObject *ec2.CancelSpotFleetRequestsErrorItem
 }
 
 func CancelSpotFleetRequestsError(apiObjects []*ec2.CancelSpotFleetRequestsErrorItem) error {
-	var errors *multierror.Error
+	var errs []error
 
 	for _, apiObject := range apiObjects {
 		if err := CancelSpotFleetRequestError(apiObject); err != nil {
-			errors = multierror.Append(errors, fmt.Errorf("%s: %w", aws.StringValue(apiObject.SpotFleetRequestId), err))
+			errs = append(errs, fmt.Errorf("%s: %w", aws.StringValue(apiObject.SpotFleetRequestId), err))
 		}
 	}
 
-	return errors.ErrorOrNil()
+	return errors.Join(errs...)
 }
 
 func DeleteFleetError(apiObject *ec2.DeleteFleetErrorItem) error {
@@ -144,15 +153,15 @@ func DeleteFleetError(apiObject *ec2.DeleteFleetErrorItem) error {
 }
 
 func DeleteFleetsError(apiObjects []*ec2.DeleteFleetErrorItem) error {
-	var errors *multierror.Error
+	var errs []error
 
 	for _, apiObject := range apiObjects {
 		if err := DeleteFleetError(apiObject); err != nil {
-			errors = multierror.Append(errors, fmt.Errorf("%s: %w", aws.StringValue(apiObject.FleetId), err))
+			errs = append(errs, fmt.Errorf("%s: %w", aws.StringValue(apiObject.FleetId), err))
 		}
 	}
 
-	return errors.ErrorOrNil()
+	return errors.Join(errs...)
 }
 
 func UnsuccessfulItemError(apiObject *ec2.UnsuccessfulItemError) error {
@@ -164,19 +173,17 @@ func UnsuccessfulItemError(apiObject *ec2.UnsuccessfulItemError) error {
 }
 
 func UnsuccessfulItemsError(apiObjects []*ec2.UnsuccessfulItem) error {
-	var errors *multierror.Error
+	var errs []error
 
 	for _, apiObject := range apiObjects {
 		if apiObject == nil {
 			continue
 		}
 
-		err := UnsuccessfulItemError(apiObject.Error)
-
-		if err != nil {
-			errors = multierror.Append(errors, fmt.Errorf("%s: %w", aws.StringValue(apiObject.ResourceId), err))
+		if err := UnsuccessfulItemError(apiObject.Error); err != nil {
+			errs = append(errs, fmt.Errorf("%s: %w", aws.StringValue(apiObject.ResourceId), err))
 		}
 	}
 
-	return errors.ErrorOrNil()
+	return errors.Join(errs...)
 }
diff --git a/internal/service/ec2/errors_test.go b/internal/service/ec2/errors_test.go
index 3c86835e148..243711e8872 100644
--- a/internal/service/ec2/errors_test.go
+++ b/internal/service/ec2/errors_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/exports.go b/internal/service/ec2/exports.go
new file mode 100644
index 00000000000..81ab90a92cc
--- /dev/null
+++ b/internal/service/ec2/exports.go
@@ -0,0 +1,8 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package ec2
+
+var (
+	FindVPCByIDV2 = findVPCByIDV2
+)
diff --git a/internal/service/ec2/exports_test.go b/internal/service/ec2/exports_test.go
index 8450dd91963..871f329d292 100644
--- a/internal/service/ec2/exports_test.go
+++ b/internal/service/ec2/exports_test.go
@@ -1,9 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 // Exports for use in tests only.
 var (
+	ResourceInstanceConnectEndpoint  = newResourceInstanceConnectEndpoint
 	ResourceSecurityGroupEgressRule  = newResourceSecurityGroupEgressRule
 	ResourceSecurityGroupIngressRule = newResourceSecurityGroupIngressRule
 
-	UpdateTags = updateTags
+	UpdateTags   = updateTags
+	UpdateTagsV2 = updateTagsV2
 )
diff --git a/internal/service/ec2/filter.go b/internal/service/ec2/filter.go
index 3497a706640..14a74985bf9 100644
--- a/internal/service/ec2/filter.go
+++ b/internal/service/ec2/filter.go
@@ -1,8 +1,12 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
 	"sort"
 
+	awstypes "github.com/aws/aws-sdk-go-v2/service/ec2/types"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ec2"
 )
@@ -57,3 +61,33 @@ func NewFilter(name string, values []string) *ec2.Filter {
 		Values: aws.StringSlice(values),
 	}
 }
+
+func buildAttributeFilterListV2(m map[string]string) []awstypes.Filter {
+	var filters []awstypes.Filter
+
+	// sort the filters by name to make the output deterministic
+	var names []string
+	for k := range m {
+		names = append(names, k)
+	}
+
+	sort.Strings(names)
+
+	for _, name := range names {
+		value := m[name]
+		if value == "" {
+			continue
+		}
+
+		filters = append(filters, newFilterV2(name, []string{value}))
+	}
+
+	return filters
+}
+
+func newFilterV2(name string, values []string) awstypes.Filter {
+	return awstypes.Filter{
+		Name:   aws.String(name),
+		Values: values,
+	}
+}
diff --git a/internal/service/ec2/filters.go b/internal/service/ec2/filters.go
index e6b2b8c5c56..036be38b8d5 100644
--- a/internal/service/ec2/filters.go
+++ b/internal/service/ec2/filters.go
@@ -1,16 +1,20 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
 	"context"
 	"fmt"
 
+	awstypes "github.com/aws/aws-sdk-go-v2/service/ec2/types"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	datasourceschema "github.com/hashicorp/terraform-plugin-framework/datasource/schema"
 	"github.com/hashicorp/terraform-plugin-framework/tfsdk"
 	"github.com/hashicorp/terraform-plugin-framework/types"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
-	"github.com/hashicorp/terraform-provider-aws/internal/flex"
+	"github.com/hashicorp/terraform-provider-aws/internal/framework/flex"
 )
 
 // BuildTagFilterList takes a []*ec2.Tag and produces a []*ec2.Filter that
@@ -70,6 +74,21 @@ func attributeFiltersFromMultimap(m map[string][]string) []*ec2.Filter {
 	return filters
 }
 
+// tagFilters returns an array of EC2 Filter objects to be used when listing resources by tag.
+func tagFilters(ctx context.Context) []*ec2.Filter {
+	tags := getTagsIn(ctx)
+	filters := make([]*ec2.Filter, len(tags))
+
+	for i, tag := range tags {
+		filters[i] = &ec2.Filter{
+			Name:   aws.String(fmt.Sprintf("tag:%s", aws.StringValue(tag.Key))),
+			Values: aws.StringSlice([]string{aws.StringValue(tag.Value)}),
+		}
+	}
+
+	return filters
+}
+
 // CustomFiltersSchema returns a *schema.Schema that represents
 // a set of custom filtering criteria that a user can specify as input
 // to a data source that wraps one of the many "Describe..." API calls
@@ -107,6 +126,28 @@ func CustomFiltersSchema() *schema.Schema {
 	}
 }
 
+func CustomRequiredFiltersSchema() *schema.Schema {
+	return &schema.Schema{
+		Type:     schema.TypeSet,
+		Required: true,
+		Elem: &schema.Resource{
+			Schema: map[string]*schema.Schema{
+				"name": {
+					Type:     schema.TypeString,
+					Required: true,
+				},
+				"values": {
+					Type:     schema.TypeSet,
+					Required: true,
+					Elem: &schema.Schema{
+						Type: schema.TypeString,
+					},
+				},
+			},
+		},
+	}
+}
+
 // CustomFiltersBlock is the Plugin Framework variant of CustomFiltersSchema.
 func CustomFiltersBlock() datasourceschema.Block {
 	return datasourceschema.SetNestedBlock{
@@ -137,7 +178,7 @@ type customFilterData struct {
 // of the "Describe..." functions in the EC2 API.
 //
 // This function is intended only to be used in conjunction with
-// ec2CustomFitlersSchema. See the docs on that function for more details
+// CustomFiltersSchema. See the docs on that function for more details
 // on the configuration pattern this is intended to support.
 func BuildCustomFilterList(filterSet *schema.Set) []*ec2.Filter {
 	if filterSet == nil {
@@ -193,3 +234,32 @@ func BuildCustomFilters(ctx context.Context, filterSet types.Set) []*ec2.Filter
 
 	return filters
 }
+
+func BuildCustomFiltersV2(ctx context.Context, filterSet types.Set) []awstypes.Filter {
+	if filterSet.IsNull() || filterSet.IsUnknown() {
+		return nil
+	}
+
+	var filters []awstypes.Filter
+
+	for _, v := range filterSet.Elements() {
+		var data customFilterData
+
+		if tfsdk.ValueAs(ctx, v, &data).HasError() {
+			continue
+		}
+
+		if data.Name.IsNull() || data.Name.IsUnknown() {
+			continue
+		}
+
+		if v := flex.ExpandFrameworkStringValueSet(ctx, data.Values); v != nil {
+			filters = append(filters, awstypes.Filter{
+				Name:   flex.StringFromFramework(ctx, data.Name),
+				Values: v,
+			})
+		}
+	}
+
+	return filters
+}
diff --git a/internal/service/ec2/filters_test.go b/internal/service/ec2/filters_test.go
index 7eb2914eb99..3cb2dcf770d 100644
--- a/internal/service/ec2/filters_test.go
+++ b/internal/service/ec2/filters_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/find.go b/internal/service/ec2/find.go
index 3a8797e852a..7948a100207 100644
--- a/internal/service/ec2/find.go
+++ b/internal/service/ec2/find.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -7,14 +10,15 @@ import (
 
 	aws_sdkv2 "github.com/aws/aws-sdk-go-v2/aws"
 	ec2_sdkv2 "github.com/aws/aws-sdk-go-v2/service/ec2"
-	"github.com/aws/aws-sdk-go-v2/service/ec2/types"
+	awstypes "github.com/aws/aws-sdk-go-v2/service/ec2/types"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	tfawserr_sdkv2 "github.com/hashicorp/aws-sdk-go-base/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
-	"github.com/hashicorp/terraform-provider-aws/internal/slices"
+	tfslices "github.com/hashicorp/terraform-provider-aws/internal/slices"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
-	"github.com/hashicorp/terraform-provider-aws/internal/verify"
+	"github.com/hashicorp/terraform-provider-aws/internal/types"
 )
 
 func FindAvailabilityZones(ctx context.Context, conn *ec2.EC2, input *ec2.DescribeAvailabilityZonesInput) ([]*ec2.AvailabilityZone, error) {
@@ -2014,7 +2018,7 @@ func FindRouteByIPv4Destination(ctx context.Context, conn *ec2.EC2, routeTableID
 	}
 
 	for _, route := range routeTable.Routes {
-		if verify.CIDRBlocksEqual(aws.StringValue(route.DestinationCidrBlock), destinationCidr) {
+		if types.CIDRBlocksEqual(aws.StringValue(route.DestinationCidrBlock), destinationCidr) {
 			return route, nil
 		}
 	}
@@ -2034,7 +2038,7 @@ func FindRouteByIPv6Destination(ctx context.Context, conn *ec2.EC2, routeTableID
 	}
 
 	for _, route := range routeTable.Routes {
-		if verify.CIDRBlocksEqual(aws.StringValue(route.DestinationIpv6CidrBlock), destinationIpv6Cidr) {
+		if types.CIDRBlocksEqual(aws.StringValue(route.DestinationIpv6CidrBlock), destinationIpv6Cidr) {
 			return route, nil
 		}
 	}
@@ -3252,7 +3256,7 @@ func FindVPCEndpointServicePermission(ctx context.Context, conn *ec2.EC2, servic
 		return nil, err
 	}
 
-	allowedPrincipals = slices.Filter(allowedPrincipals, func(v *ec2.AllowedPrincipal) bool {
+	allowedPrincipals = tfslices.Filter(allowedPrincipals, func(v *ec2.AllowedPrincipal) bool {
 		return aws.StringValue(v.Principal) == principalARN
 	})
 
@@ -4593,37 +4597,27 @@ func FindTransitGatewayPrefixListReferenceByTwoPartKey(ctx context.Context, conn
 	return output, nil
 }
 
-func FindTransitGatewayRoute(ctx context.Context, conn *ec2.EC2, transitGatewayRouteTableID, destination string) (*ec2.TransitGatewayRoute, error) {
+func FindTransitGatewayStaticRoute(ctx context.Context, conn *ec2.EC2, transitGatewayRouteTableID, destination string) (*ec2.TransitGatewayRoute, error) {
 	input := &ec2.SearchTransitGatewayRoutesInput{
 		Filters: BuildAttributeFilterList(map[string]string{
-			"type": ec2.TransitGatewayRouteTypeStatic,
+			"type":                     ec2.TransitGatewayRouteTypeStatic,
+			"route-search.exact-match": destination,
 		}),
 		TransitGatewayRouteTableId: aws.String(transitGatewayRouteTableID),
 	}
 
-	output, err := conn.SearchTransitGatewayRoutesWithContext(ctx, input)
-
-	if tfawserr.ErrCodeEquals(err, errCodeInvalidRouteTableIDNotFound) {
-		return nil, &retry.NotFoundError{
-			LastError:   err,
-			LastRequest: input,
-		}
-	}
+	output, err := FindTransitGatewayRoutes(ctx, conn, input)
 
 	if err != nil {
 		return nil, err
 	}
 
-	if output == nil || len(output.Routes) == 0 {
-		return nil, tfresource.NewEmptyResultError(input)
-	}
-
-	for _, route := range output.Routes {
+	for _, route := range output {
 		if route == nil {
 			continue
 		}
 
-		if v := aws.StringValue(route.DestinationCidrBlock); verify.CIDRBlocksEqual(v, destination) {
+		if v := aws.StringValue(route.DestinationCidrBlock); types.CIDRBlocksEqual(v, destination) {
 			if state := aws.StringValue(route.State); state == ec2.TransitGatewayRouteStateDeleted {
 				return nil, &retry.NotFoundError{
 					Message:     state,
@@ -4631,7 +4625,7 @@ func FindTransitGatewayRoute(ctx context.Context, conn *ec2.EC2, transitGatewayR
 				}
 			}
 
-			route.DestinationCidrBlock = aws.String(verify.CanonicalCIDRBlock(v))
+			route.DestinationCidrBlock = aws.String(types.CanonicalCIDRBlock(v))
 
 			return route, nil
 		}
@@ -4640,6 +4634,27 @@ func FindTransitGatewayRoute(ctx context.Context, conn *ec2.EC2, transitGatewayR
 	return nil, &retry.NotFoundError{}
 }
 
+func FindTransitGatewayRoutes(ctx context.Context, conn *ec2.EC2, input *ec2.SearchTransitGatewayRoutesInput) ([]*ec2.TransitGatewayRoute, error) {
+	output, err := conn.SearchTransitGatewayRoutesWithContext(ctx, input)
+
+	if tfawserr.ErrCodeEquals(err, errCodeInvalidRouteTableIDNotFound) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	if output == nil || len(output.Routes) == 0 {
+		return nil, tfresource.NewEmptyResultError(input)
+	}
+
+	return output.Routes, err
+}
+
 func FindTransitGatewayPolicyTable(ctx context.Context, conn *ec2.EC2, input *ec2.DescribeTransitGatewayPolicyTablesInput) (*ec2.TransitGatewayPolicyTable, error) {
 	output, err := FindTransitGatewayPolicyTables(ctx, conn, input)
 
@@ -6449,6 +6464,38 @@ func FindNATGatewayByID(ctx context.Context, conn *ec2.EC2, id string) (*ec2.Nat
 	return output, nil
 }
 
+func FindNATGatewayAddressByNATGatewayIDAndAllocationID(ctx context.Context, conn *ec2.EC2, natGatewayID, allocationID string) (*ec2.NatGatewayAddress, error) {
+	output, err := FindNATGatewayByID(ctx, conn, natGatewayID)
+
+	if err != nil {
+		return nil, err
+	}
+
+	for _, v := range output.NatGatewayAddresses {
+		if aws.StringValue(v.AllocationId) == allocationID {
+			return v, nil
+		}
+	}
+
+	return nil, &retry.NotFoundError{}
+}
+
+func FindNATGatewayAddressByNATGatewayIDAndPrivateIP(ctx context.Context, conn *ec2.EC2, natGatewayID, privateIP string) (*ec2.NatGatewayAddress, error) {
+	output, err := FindNATGatewayByID(ctx, conn, natGatewayID)
+
+	if err != nil {
+		return nil, err
+	}
+
+	for _, v := range output.NatGatewayAddresses {
+		if aws.StringValue(v.PrivateIp) == privateIP {
+			return v, nil
+		}
+	}
+
+	return nil, &retry.NotFoundError{}
+}
+
 func FindPlacementGroupByName(ctx context.Context, conn *ec2.EC2, name string) (*ec2.PlacementGroup, error) {
 	input := &ec2.DescribePlacementGroupsInput{
 		GroupNames: aws.StringSlice([]string{name}),
@@ -6838,8 +6885,8 @@ func FindSnapshotTierStatusBySnapshotID(ctx context.Context, conn *ec2.EC2, id s
 	return output, nil
 }
 
-func FindNetworkPerformanceMetricSubscriptions(ctx context.Context, conn *ec2_sdkv2.Client, input *ec2_sdkv2.DescribeAwsNetworkPerformanceMetricSubscriptionsInput) ([]types.Subscription, error) {
-	var output []types.Subscription
+func FindNetworkPerformanceMetricSubscriptions(ctx context.Context, conn *ec2_sdkv2.Client, input *ec2_sdkv2.DescribeAwsNetworkPerformanceMetricSubscriptionsInput) ([]awstypes.Subscription, error) {
+	var output []awstypes.Subscription
 	paginator := ec2_sdkv2.NewDescribeAwsNetworkPerformanceMetricSubscriptionsPaginator(conn, input, func(o *ec2_sdkv2.DescribeAwsNetworkPerformanceMetricSubscriptionsPaginatorOptions) {
 		o.Limit = 100
 	})
@@ -6857,7 +6904,7 @@ func FindNetworkPerformanceMetricSubscriptions(ctx context.Context, conn *ec2_sd
 	return output, nil
 }
 
-func FindNetworkPerformanceMetricSubscriptionByFourPartKey(ctx context.Context, conn *ec2_sdkv2.Client, source, destination, metric, statistic string) (*types.Subscription, error) {
+func FindNetworkPerformanceMetricSubscriptionByFourPartKey(ctx context.Context, conn *ec2_sdkv2.Client, source, destination, metric, statistic string) (*awstypes.Subscription, error) {
 	input := &ec2_sdkv2.DescribeAwsNetworkPerformanceMetricSubscriptionsInput{}
 
 	output, err := FindNetworkPerformanceMetricSubscriptions(ctx, conn, input)
@@ -6913,3 +6960,337 @@ func FindInstanceStateByID(ctx context.Context, conn *ec2.EC2, id string) (*ec2.
 
 	return instanceState, nil
 }
+
+func FindInstanceConnectEndpoint(ctx context.Context, conn *ec2_sdkv2.Client, input *ec2_sdkv2.DescribeInstanceConnectEndpointsInput) (*awstypes.Ec2InstanceConnectEndpoint, error) {
+	output, err := FindInstanceConnectEndpoints(ctx, conn, input)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return tfresource.AssertSingleValueResult(output)
+}
+
+func FindInstanceConnectEndpoints(ctx context.Context, conn *ec2_sdkv2.Client, input *ec2_sdkv2.DescribeInstanceConnectEndpointsInput) ([]awstypes.Ec2InstanceConnectEndpoint, error) {
+	var output []awstypes.Ec2InstanceConnectEndpoint
+	paginator := ec2_sdkv2.NewDescribeInstanceConnectEndpointsPaginator(conn, input)
+
+	for paginator.HasMorePages() {
+		page, err := paginator.NextPage(ctx)
+
+		if tfawserr_sdkv2.ErrCodeEquals(err, errCodeInvalidInstanceConnectEndpointIdNotFound) {
+			return nil, &retry.NotFoundError{
+				LastError:   err,
+				LastRequest: input,
+			}
+		}
+
+		if err != nil {
+			return nil, err
+		}
+
+		output = append(output, page.InstanceConnectEndpoints...)
+	}
+
+	return output, nil
+}
+
+func FindInstanceConnectEndpointByID(ctx context.Context, conn *ec2_sdkv2.Client, id string) (*awstypes.Ec2InstanceConnectEndpoint, error) {
+	input := &ec2_sdkv2.DescribeInstanceConnectEndpointsInput{
+		InstanceConnectEndpointIds: []string{id},
+	}
+	output, err := FindInstanceConnectEndpoint(ctx, conn, input)
+
+	if err != nil {
+		return nil, err
+	}
+
+	if state := output.State; state == awstypes.Ec2InstanceConnectEndpointStateDeleteComplete {
+		return nil, &retry.NotFoundError{
+			Message:     string(state),
+			LastRequest: input,
+		}
+	}
+
+	// Eventual consistency check.
+	if aws_sdkv2.ToString(output.InstanceConnectEndpointId) != id {
+		return nil, &retry.NotFoundError{
+			LastRequest: input,
+		}
+	}
+
+	return output, nil
+}
+
+func FindVerifiedAccessGroupPolicyByID(ctx context.Context, conn *ec2_sdkv2.Client, id string) (*ec2_sdkv2.GetVerifiedAccessGroupPolicyOutput, error) {
+	input := &ec2_sdkv2.GetVerifiedAccessGroupPolicyInput{
+		VerifiedAccessGroupId: &id,
+	}
+	output, err := conn.GetVerifiedAccessGroupPolicy(ctx, input)
+
+	if tfawserr_sdkv2.ErrCodeEquals(err, errCodeInvalidVerifiedAccessGroupIdNotFound) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	if output == nil {
+		return nil, tfresource.NewEmptyResultError(input)
+	}
+
+	return output, nil
+}
+
+func FindVerifiedAccessGroup(ctx context.Context, conn *ec2_sdkv2.Client, input *ec2_sdkv2.DescribeVerifiedAccessGroupsInput) (*awstypes.VerifiedAccessGroup, error) {
+	output, err := FindVerifiedAccessGroups(ctx, conn, input)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return tfresource.AssertSingleValueResult(output)
+}
+
+func FindVerifiedAccessGroups(ctx context.Context, conn *ec2_sdkv2.Client, input *ec2_sdkv2.DescribeVerifiedAccessGroupsInput) ([]awstypes.VerifiedAccessGroup, error) {
+	var output []awstypes.VerifiedAccessGroup
+	paginator := ec2_sdkv2.NewDescribeVerifiedAccessGroupsPaginator(conn, input)
+
+	for paginator.HasMorePages() {
+		page, err := paginator.NextPage(ctx)
+
+		if tfawserr_sdkv2.ErrCodeEquals(err, errCodeInvalidVerifiedAccessGroupIdNotFound) {
+			return nil, &retry.NotFoundError{
+				LastError:   err,
+				LastRequest: input,
+			}
+		}
+
+		if err != nil {
+			return nil, err
+		}
+
+		output = append(output, page.VerifiedAccessGroups...)
+	}
+
+	return output, nil
+}
+
+func FindVerifiedAccessGroupByID(ctx context.Context, conn *ec2_sdkv2.Client, id string) (*awstypes.VerifiedAccessGroup, error) {
+	input := &ec2_sdkv2.DescribeVerifiedAccessGroupsInput{
+		VerifiedAccessGroupIds: []string{id},
+	}
+	output, err := FindVerifiedAccessGroup(ctx, conn, input)
+
+	if err != nil {
+		return nil, err
+	}
+
+	// Eventual consistency check.
+	if aws_sdkv2.ToString(output.VerifiedAccessGroupId) != id {
+		return nil, &retry.NotFoundError{
+			LastRequest: input,
+		}
+	}
+
+	return output, nil
+}
+
+func FindVerifiedAccessInstance(ctx context.Context, conn *ec2_sdkv2.Client, input *ec2_sdkv2.DescribeVerifiedAccessInstancesInput) (*awstypes.VerifiedAccessInstance, error) {
+	output, err := FindVerifiedAccessInstances(ctx, conn, input)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return tfresource.AssertSingleValueResult(output)
+}
+
+func FindVerifiedAccessInstances(ctx context.Context, conn *ec2_sdkv2.Client, input *ec2_sdkv2.DescribeVerifiedAccessInstancesInput) ([]awstypes.VerifiedAccessInstance, error) {
+	var output []awstypes.VerifiedAccessInstance
+	paginator := ec2_sdkv2.NewDescribeVerifiedAccessInstancesPaginator(conn, input)
+
+	for paginator.HasMorePages() {
+		page, err := paginator.NextPage(ctx)
+
+		if tfawserr_sdkv2.ErrCodeEquals(err, errCodeInvalidVerifiedAccessInstanceIdNotFound) {
+			return nil, &retry.NotFoundError{
+				LastError:   err,
+				LastRequest: input,
+			}
+		}
+
+		if err != nil {
+			return nil, err
+		}
+
+		output = append(output, page.VerifiedAccessInstances...)
+	}
+
+	return output, nil
+}
+
+func FindVerifiedAccessInstanceByID(ctx context.Context, conn *ec2_sdkv2.Client, id string) (*awstypes.VerifiedAccessInstance, error) {
+	input := &ec2_sdkv2.DescribeVerifiedAccessInstancesInput{
+		VerifiedAccessInstanceIds: []string{id},
+	}
+	output, err := FindVerifiedAccessInstance(ctx, conn, input)
+
+	if err != nil {
+		return nil, err
+	}
+
+	// Eventual consistency check.
+	if aws_sdkv2.ToString(output.VerifiedAccessInstanceId) != id {
+		return nil, &retry.NotFoundError{
+			LastRequest: input,
+		}
+	}
+
+	return output, nil
+}
+
+func FindVerifiedAccessInstanceLoggingConfiguration(ctx context.Context, conn *ec2_sdkv2.Client, input *ec2_sdkv2.DescribeVerifiedAccessInstanceLoggingConfigurationsInput) (*awstypes.VerifiedAccessInstanceLoggingConfiguration, error) {
+	output, err := FindVerifiedAccessInstanceLoggingConfigurations(ctx, conn, input)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return tfresource.AssertSingleValueResult(output)
+}
+
+func FindVerifiedAccessInstanceLoggingConfigurations(ctx context.Context, conn *ec2_sdkv2.Client, input *ec2_sdkv2.DescribeVerifiedAccessInstanceLoggingConfigurationsInput) ([]awstypes.VerifiedAccessInstanceLoggingConfiguration, error) {
+	var output []awstypes.VerifiedAccessInstanceLoggingConfiguration
+	paginator := ec2_sdkv2.NewDescribeVerifiedAccessInstanceLoggingConfigurationsPaginator(conn, input)
+
+	for paginator.HasMorePages() {
+		page, err := paginator.NextPage(ctx)
+
+		if tfawserr_sdkv2.ErrCodeEquals(err, errCodeInvalidVerifiedAccessInstanceIdNotFound) {
+			return nil, &retry.NotFoundError{
+				LastError:   err,
+				LastRequest: input,
+			}
+		}
+
+		if err != nil {
+			return nil, err
+		}
+
+		output = append(output, page.LoggingConfigurations...)
+	}
+
+	return output, nil
+}
+
+func FindVerifiedAccessInstanceLoggingConfigurationByInstanceID(ctx context.Context, conn *ec2_sdkv2.Client, id string) (*awstypes.VerifiedAccessInstanceLoggingConfiguration, error) {
+	input := &ec2_sdkv2.DescribeVerifiedAccessInstanceLoggingConfigurationsInput{
+		VerifiedAccessInstanceIds: []string{id},
+	}
+	output, err := FindVerifiedAccessInstanceLoggingConfiguration(ctx, conn, input)
+
+	if err != nil {
+		return nil, err
+	}
+
+	// Eventual consistency check.
+	if aws_sdkv2.ToString(output.VerifiedAccessInstanceId) != id {
+		return nil, &retry.NotFoundError{
+			LastRequest: input,
+		}
+	}
+
+	return output, nil
+}
+
+func FindVerifiedAccessInstanceTrustProviderAttachmentExists(ctx context.Context, conn *ec2_sdkv2.Client, vaiID, vatpID string) error {
+	output, err := FindVerifiedAccessInstanceByID(ctx, conn, vaiID)
+
+	if err != nil {
+		return err
+	}
+
+	for _, v := range output.VerifiedAccessTrustProviders {
+		if aws_sdkv2.ToString(v.VerifiedAccessTrustProviderId) == vatpID {
+			return nil
+		}
+	}
+
+	return &retry.NotFoundError{
+		LastError: fmt.Errorf("Verified Access Instance (%s) Trust Provider (%s) Association not found", vaiID, vatpID),
+	}
+}
+
+func FindVerifiedAccessTrustProvider(ctx context.Context, conn *ec2_sdkv2.Client, input *ec2_sdkv2.DescribeVerifiedAccessTrustProvidersInput) (*awstypes.VerifiedAccessTrustProvider, error) {
+	output, err := FindVerifiedAccessTrustProviders(ctx, conn, input)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return tfresource.AssertSingleValueResult(output)
+}
+
+func FindVerifiedAccessTrustProviders(ctx context.Context, conn *ec2_sdkv2.Client, input *ec2_sdkv2.DescribeVerifiedAccessTrustProvidersInput) ([]awstypes.VerifiedAccessTrustProvider, error) {
+	var output []awstypes.VerifiedAccessTrustProvider
+	paginator := ec2_sdkv2.NewDescribeVerifiedAccessTrustProvidersPaginator(conn, input)
+
+	for paginator.HasMorePages() {
+		page, err := paginator.NextPage(ctx)
+
+		if tfawserr_sdkv2.ErrCodeEquals(err, errCodeInvalidVerifiedAccessTrustProviderIdNotFound) {
+			return nil, &retry.NotFoundError{
+				LastError:   err,
+				LastRequest: input,
+			}
+		}
+
+		if err != nil {
+			return nil, err
+		}
+
+		output = append(output, page.VerifiedAccessTrustProviders...)
+	}
+
+	return output, nil
+}
+
+func FindVerifiedAccessTrustProviderByID(ctx context.Context, conn *ec2_sdkv2.Client, id string) (*awstypes.VerifiedAccessTrustProvider, error) {
+	input := &ec2_sdkv2.DescribeVerifiedAccessTrustProvidersInput{
+		VerifiedAccessTrustProviderIds: []string{id},
+	}
+	output, err := FindVerifiedAccessTrustProvider(ctx, conn, input)
+
+	if err != nil {
+		return nil, err
+	}
+
+	// Eventual consistency check.
+	if aws_sdkv2.ToString(output.VerifiedAccessTrustProviderId) != id {
+		return nil, &retry.NotFoundError{
+			LastRequest: input,
+		}
+	}
+
+	return output, nil
+}
+
+func FindImageBlockPublicAccessState(ctx context.Context, conn *ec2_sdkv2.Client) (*string, error) {
+	input := &ec2_sdkv2.GetImageBlockPublicAccessStateInput{}
+	output, err := conn.GetImageBlockPublicAccessState(ctx, input)
+
+	if err != nil {
+		return nil, err
+	}
+
+	if output == nil || output.ImageBlockPublicAccessState == nil {
+		return nil, tfresource.NewEmptyResultError(input)
+	}
+
+	return output.ImageBlockPublicAccessState, nil
+}
diff --git a/internal/service/ec2/findv2.go b/internal/service/ec2/findv2.go
new file mode 100644
index 00000000000..a30ff2a1341
--- /dev/null
+++ b/internal/service/ec2/findv2.go
@@ -0,0 +1,289 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package ec2
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/ec2"
+	awstypes "github.com/aws/aws-sdk-go-v2/service/ec2/types"
+	"github.com/hashicorp/aws-sdk-go-base/v2/tfawserr"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+)
+
+func findVPCAttributeV2(ctx context.Context, conn *ec2.Client, vpcID string, attribute awstypes.VpcAttributeName) (bool, error) {
+	input := &ec2.DescribeVpcAttributeInput{
+		Attribute: attribute,
+		VpcId:     aws.String(vpcID),
+	}
+
+	output, err := conn.DescribeVpcAttribute(ctx, input)
+
+	if tfawserr.ErrCodeEquals(err, errCodeInvalidVPCIDNotFound) {
+		return false, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+
+	if err != nil {
+		return false, err
+	}
+
+	if output == nil {
+		return false, tfresource.NewEmptyResultError(input)
+	}
+
+	var v *awstypes.AttributeBooleanValue
+	switch attribute {
+	case awstypes.VpcAttributeNameEnableDnsHostnames:
+		v = output.EnableDnsHostnames
+	case awstypes.VpcAttributeNameEnableDnsSupport:
+		v = output.EnableDnsSupport
+	case awstypes.VpcAttributeNameEnableNetworkAddressUsageMetrics:
+		v = output.EnableNetworkAddressUsageMetrics
+	default:
+		return false, fmt.Errorf("unsupported VPC attribute: %s", attribute)
+	}
+
+	if v == nil {
+		return false, tfresource.NewEmptyResultError(input)
+	}
+
+	return aws.ToBool(v.Value), nil
+}
+
+func findVPCV2(ctx context.Context, conn *ec2.Client, input *ec2.DescribeVpcsInput) (*awstypes.Vpc, error) {
+	output, err := findVPCsV2(ctx, conn, input)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return tfresource.AssertSingleValueResult(output)
+}
+
+func findVPCsV2(ctx context.Context, conn *ec2.Client, input *ec2.DescribeVpcsInput) ([]awstypes.Vpc, error) {
+	var output []awstypes.Vpc
+
+	pages := ec2.NewDescribeVpcsPaginator(conn, input)
+	for pages.HasMorePages() {
+		page, err := pages.NextPage(ctx)
+
+		if tfawserr.ErrCodeEquals(err, errCodeInvalidVPCIDNotFound) {
+			return nil, &retry.NotFoundError{
+				LastError:   err,
+				LastRequest: input,
+			}
+		}
+
+		if err != nil {
+			return nil, err
+		}
+
+		output = append(output, page.Vpcs...)
+	}
+
+	return output, nil
+}
+
+func findVPCByIDV2(ctx context.Context, conn *ec2.Client, id string) (*awstypes.Vpc, error) {
+	input := &ec2.DescribeVpcsInput{
+		VpcIds: []string{id},
+	}
+
+	return findVPCV2(ctx, conn, input)
+}
+
+func findVPCIPv6CIDRBlockAssociationByIDV2(ctx context.Context, conn *ec2.Client, id string) (*awstypes.VpcIpv6CidrBlockAssociation, *awstypes.Vpc, error) {
+	input := &ec2.DescribeVpcsInput{
+		Filters: buildAttributeFilterListV2(map[string]string{
+			"ipv6-cidr-block-association.association-id": id,
+		}),
+	}
+
+	vpc, err := findVPCV2(ctx, conn, input)
+
+	if err != nil {
+		return nil, nil, err
+	}
+
+	for _, association := range vpc.Ipv6CidrBlockAssociationSet {
+		if aws.ToString(association.AssociationId) == id {
+			if state := association.Ipv6CidrBlockState.State; state == awstypes.VpcCidrBlockStateCodeDisassociated {
+				return nil, nil, &retry.NotFoundError{Message: string(state)}
+			}
+
+			return &association, vpc, nil
+		}
+	}
+
+	return nil, nil, &retry.NotFoundError{}
+}
+
+func findVPCDefaultNetworkACLV2(ctx context.Context, conn *ec2.Client, id string) (*awstypes.NetworkAcl, error) {
+	input := &ec2.DescribeNetworkAclsInput{
+		Filters: buildAttributeFilterListV2(map[string]string{
+			"default": "true",
+			"vpc-id":  id,
+		}),
+	}
+
+	return findNetworkACLV2(ctx, conn, input)
+}
+
+func findNetworkACLV2(ctx context.Context, conn *ec2.Client, input *ec2.DescribeNetworkAclsInput) (*awstypes.NetworkAcl, error) {
+	output, err := findNetworkACLsV2(ctx, conn, input)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return tfresource.AssertSingleValueResult(output)
+}
+
+func findNetworkACLsV2(ctx context.Context, conn *ec2.Client, input *ec2.DescribeNetworkAclsInput) ([]awstypes.NetworkAcl, error) {
+	var output []awstypes.NetworkAcl
+
+	pages := ec2.NewDescribeNetworkAclsPaginator(conn, input)
+
+	for pages.HasMorePages() {
+		page, err := pages.NextPage(ctx)
+
+		if tfawserr.ErrCodeEquals(err, errCodeInvalidNetworkACLIDNotFound) {
+			return nil, &retry.NotFoundError{
+				LastError:   err,
+				LastRequest: input,
+			}
+		}
+
+		if err != nil {
+			return nil, err
+		}
+
+		output = append(output, page.NetworkAcls...)
+	}
+
+	return output, nil
+}
+
+func FindVPCDefaultSecurityGroupV2(ctx context.Context, conn *ec2.Client, id string) (*awstypes.SecurityGroup, error) {
+	input := &ec2.DescribeSecurityGroupsInput{
+		Filters: buildAttributeFilterListV2(map[string]string{
+			"group-name": DefaultSecurityGroupName,
+			"vpc-id":     id,
+		}),
+	}
+
+	return findSecurityGroupV2(ctx, conn, input)
+}
+
+func findVPCMainRouteTableV2(ctx context.Context, conn *ec2.Client, id string) (*awstypes.RouteTable, error) {
+	input := &ec2.DescribeRouteTablesInput{
+		Filters: buildAttributeFilterListV2(map[string]string{
+			"association.main": "true",
+			"vpc-id":           id,
+		}),
+	}
+
+	return findRouteTableV2(ctx, conn, input)
+}
+
+func findRouteTableV2(ctx context.Context, conn *ec2.Client, input *ec2.DescribeRouteTablesInput) (*awstypes.RouteTable, error) {
+	output, err := findRouteTablesV2(ctx, conn, input)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return tfresource.AssertSingleValueResult(output)
+}
+
+func findRouteTablesV2(ctx context.Context, conn *ec2.Client, input *ec2.DescribeRouteTablesInput) ([]awstypes.RouteTable, error) {
+	var output []awstypes.RouteTable
+
+	pages := ec2.NewDescribeRouteTablesPaginator(conn, input)
+
+	for pages.HasMorePages() {
+		page, err := pages.NextPage(ctx)
+
+		if tfawserr.ErrCodeEquals(err, errCodeInvalidRouteTableIDNotFound) {
+			return nil, &retry.NotFoundError{
+				LastError:   err,
+				LastRequest: input,
+			}
+		}
+
+		if err != nil {
+			return nil, err
+		}
+
+		output = append(output, page.RouteTables...)
+	}
+
+	return output, nil
+}
+
+func findSecurityGroupV2(ctx context.Context, conn *ec2.Client, input *ec2.DescribeSecurityGroupsInput) (*awstypes.SecurityGroup, error) {
+	output, err := findSecurityGroupsV2(ctx, conn, input)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return tfresource.AssertSingleValueResult(output)
+}
+
+func findSecurityGroupsV2(ctx context.Context, conn *ec2.Client, input *ec2.DescribeSecurityGroupsInput) ([]awstypes.SecurityGroup, error) {
+	var output []awstypes.SecurityGroup
+
+	pages := ec2.NewDescribeSecurityGroupsPaginator(conn, input)
+
+	for pages.HasMorePages() {
+		page, err := pages.NextPage(ctx)
+
+		if tfawserr.ErrCodeEquals(err, errCodeInvalidGroupNotFound, errCodeInvalidSecurityGroupIDNotFound) {
+			return nil, &retry.NotFoundError{
+				LastError:   err,
+				LastRequest: input,
+			}
+		}
+
+		if err != nil {
+			return nil, err
+		}
+
+		output = append(output, page.SecurityGroups...)
+	}
+
+	return output, nil
+}
+
+func findIPAMPoolAllocationsV2(ctx context.Context, conn *ec2.Client, input *ec2.GetIpamPoolAllocationsInput) ([]awstypes.IpamPoolAllocation, error) {
+	var output []awstypes.IpamPoolAllocation
+
+	pages := ec2.NewGetIpamPoolAllocationsPaginator(conn, input)
+
+	for pages.HasMorePages() {
+		page, err := pages.NextPage(ctx)
+
+		if tfawserr.ErrCodeEquals(err, errCodeInvalidIPAMPoolAllocationIdNotFound, errCodeInvalidIPAMPoolIdNotFound) {
+			return nil, &retry.NotFoundError{
+				LastError:   err,
+				LastRequest: input,
+			}
+		}
+
+		if err != nil {
+			return nil, err
+		}
+
+		output = append(output, page.IpamPoolAllocations...)
+	}
+
+	return output, nil
+}
diff --git a/internal/service/ec2/generate.go b/internal/service/ec2/generate.go
index ba6fbaef05f..70a48d5075f 100644
--- a/internal/service/ec2/generate.go
+++ b/internal/service/ec2/generate.go
@@ -1,5 +1,9 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tagresource/main.go -IDAttribName=resource_id
 //go:generate go run ../../generate/tags/main.go -GetTag -ListTags -ListTagsOp=DescribeTags -ListTagsInFiltIDName=resource-id -ListTagsInIDElem=Resources -ServiceTagsSlice -TagOp=CreateTags -TagInIDElem=Resources -TagInIDNeedSlice=yes -TagType2=TagDescription -UntagOp=DeleteTags -UntagInNeedTagType -UntagInTagsElem=Tags -UpdateTags
+//go:generate go run ../../generate/tags/main.go -AWSSDKVersion=2 -ServiceTagsSlice -TagsFunc=TagsV2 -KeyValueTagsFunc=keyValueTagsV2 -GetTagsInFunc=getTagsInV2 -SetTagsOutFunc=setTagsOutV2 -TagOp=CreateTags -TagInIDElem=Resources -TagInIDNeedValueSlice=yes -UntagOp=DeleteTags -UpdateTagsFunc=updateTagsV2 -UntagInNeedTagType -UntagInTagsElem=Tags -UpdateTags -- tagsv2_gen.go
 //go:generate go run ../../generate/listpages/main.go -ListOps=DescribeSpotFleetInstances,DescribeSpotFleetRequestHistory,DescribeVpcEndpointServices
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/ec2/id.go b/internal/service/ec2/id.go
index b6e1064ec1f..270ebb08259 100644
--- a/internal/service/ec2/id.go
+++ b/internal/service/ec2/id.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/ipam_.go b/internal/service/ec2/ipam_.go
index 85014ecd3dd..f47d90f11da 100644
--- a/internal/service/ec2/ipam_.go
+++ b/internal/service/ec2/ipam_.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/ipam_byoip_test.go b/internal/service/ec2/ipam_byoip_test.go
index d7dfa9edbf6..ed2f5ddd904 100644
--- a/internal/service/ec2/ipam_byoip_test.go
+++ b/internal/service/ec2/ipam_byoip_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
 	"fmt"
 	"os"
-	"regexp"
 	"strconv"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
@@ -58,10 +61,10 @@ func TestAccIPAM_byoipIPv6(t *testing.T) {
 				Config: testAccIPAMBYOIPConfig_ipv4IPv6DefaultNetmask(p, m, s),
 				Check: resource.ComposeTestCheckFunc(
 					acctest.CheckVPCExists(ctx, resourceName, &vpc),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexp.MustCompile(`vpc/vpc-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`vpc/vpc-.+`)),
 					resource.TestCheckNoResourceAttr(resourceName, "ipv6_netmask_length"),
-					resource.TestMatchResourceAttr(resourceName, "ipv6_association_id", regexp.MustCompile(`^vpc-cidr-assoc-.+`)),
-					resource.TestMatchResourceAttr(resourceName, "ipv6_cidr_block", regexp.MustCompile(`/56$`)),
+					resource.TestMatchResourceAttr(resourceName, "ipv6_association_id", regexache.MustCompile(`^vpc-cidr-assoc-.+`)),
+					resource.TestMatchResourceAttr(resourceName, "ipv6_cidr_block", regexache.MustCompile(`/56$`)),
 				),
 			},
 			// disassociate ipv6
@@ -75,10 +78,10 @@ func TestAccIPAM_byoipIPv6(t *testing.T) {
 				Config: testAccIPAMBYOIPConfig_ipv6ExplicitNetmask(p, m, s, netmaskLength),
 				Check: resource.ComposeTestCheckFunc(
 					acctest.CheckVPCExists(ctx, resourceName, &vpc),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexp.MustCompile(`vpc/vpc-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`vpc/vpc-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "ipv6_netmask_length", strconv.Itoa(netmaskLength)),
-					resource.TestMatchResourceAttr(resourceName, "ipv6_association_id", regexp.MustCompile(`^vpc-cidr-assoc-.+`)),
-					resource.TestMatchResourceAttr(resourceName, "ipv6_cidr_block", regexp.MustCompile(`/56$`)),
+					resource.TestMatchResourceAttr(resourceName, "ipv6_association_id", regexache.MustCompile(`^vpc-cidr-assoc-.+`)),
+					resource.TestMatchResourceAttr(resourceName, "ipv6_cidr_block", regexache.MustCompile(`/56$`)),
 				),
 			},
 			// // disassociate ipv6
@@ -93,8 +96,8 @@ func TestAccIPAM_byoipIPv6(t *testing.T) {
 				SkipFunc: testAccIPAMConfig_ipv6BYOIPSkipExplicitCIDR(t, ipv6CidrVPC),
 				Check: resource.ComposeTestCheckFunc(
 					acctest.CheckVPCExists(ctx, resourceName, &vpc),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexp.MustCompile(`vpc/vpc-.+`)),
-					resource.TestMatchResourceAttr(resourceName, "ipv6_association_id", regexp.MustCompile(`^vpc-cidr-assoc-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`vpc/vpc-.+`)),
+					resource.TestMatchResourceAttr(resourceName, "ipv6_association_id", regexache.MustCompile(`^vpc-cidr-assoc-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "ipv6_cidr_block", ipv6CidrVPC),
 				),
 			},
diff --git a/internal/service/ec2/ipam_organization_admin_account.go b/internal/service/ec2/ipam_organization_admin_account.go
index 8cbdc05e9ad..47c61a16114 100644
--- a/internal/service/ec2/ipam_organization_admin_account.go
+++ b/internal/service/ec2/ipam_organization_admin_account.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 // ec2 has no action for Describe() to see if IPAM delegated admin has already been assigned
diff --git a/internal/service/ec2/ipam_organization_admin_account_test.go b/internal/service/ec2/ipam_organization_admin_account_test.go
index 685e4f3dd14..e38669bb7f8 100644
--- a/internal/service/ec2/ipam_organization_admin_account_test.go
+++ b/internal/service/ec2/ipam_organization_admin_account_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/organizations"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -36,7 +39,7 @@ func TestAccIPAMOrganizationAdminAccount_basic(t *testing.T) {
 					testAccCheckIPAMOrganizationAdminAccountExists(ctx, resourceName, &organization),
 					resource.TestCheckResourceAttrPair(resourceName, "id", dataSourceIdentity, "account_id"),
 					resource.TestCheckResourceAttr(resourceName, "service_principal", tfec2.IPAMServicePrincipal),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "organizations", regexp.MustCompile("account/.+")),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "organizations", regexache.MustCompile("account/.+")),
 				),
 			},
 			{
diff --git a/internal/service/ec2/ipam_pool.go b/internal/service/ec2/ipam_pool.go
index bc25e20f8fe..17624d541b2 100644
--- a/internal/service/ec2/ipam_pool.go
+++ b/internal/service/ec2/ipam_pool.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/ipam_pool_cidr.go b/internal/service/ec2/ipam_pool_cidr.go
index 260cd18ca92..99aa0f21f39 100644
--- a/internal/service/ec2/ipam_pool_cidr.go
+++ b/internal/service/ec2/ipam_pool_cidr.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/ipam_pool_cidr_allocation.go b/internal/service/ec2/ipam_pool_cidr_allocation.go
index 4ec690442c5..79620d608e3 100644
--- a/internal/service/ec2/ipam_pool_cidr_allocation.go
+++ b/internal/service/ec2/ipam_pool_cidr_allocation.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/ipam_pool_cidr_allocation_test.go b/internal/service/ec2/ipam_pool_cidr_allocation_test.go
index ba68b664e1a..adbd3e264d5 100644
--- a/internal/service/ec2/ipam_pool_cidr_allocation_test.go
+++ b/internal/service/ec2/ipam_pool_cidr_allocation_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"strings"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
@@ -35,8 +38,8 @@ func TestAccIPAMPoolCIDRAllocation_ipv4Basic(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckIPAMPoolCIDRAllocationExists(ctx, resourceName, &allocation),
 					resource.TestCheckResourceAttr(resourceName, "cidr", cidr),
-					resource.TestMatchResourceAttr(resourceName, "id", regexp.MustCompile(`^ipam-pool-alloc-[\da-f]+_ipam-pool(-[\da-f]+)$`)),
-					resource.TestMatchResourceAttr(resourceName, "ipam_pool_allocation_id", regexp.MustCompile(`^ipam-pool-alloc-[\da-f]+$`)),
+					resource.TestMatchResourceAttr(resourceName, "id", regexache.MustCompile(`^ipam-pool-alloc-[0-9a-f]+_ipam-pool(-[0-9a-f]+)$`)),
+					resource.TestMatchResourceAttr(resourceName, "ipam_pool_allocation_id", regexache.MustCompile(`^ipam-pool-alloc-[0-9a-f]+$`)),
 					resource.TestCheckResourceAttrPair(resourceName, "ipam_pool_id", "aws_vpc_ipam_pool.test", "id"),
 				),
 			},
@@ -152,12 +155,12 @@ func TestAccIPAMPoolCIDRAllocation_multiple(t *testing.T) {
 					testAccCheckIPAMPoolCIDRAllocationExists(ctx, resourceName, &allocation1),
 					testAccCheckIPAMPoolCIDRAllocationExists(ctx, resourceName2, &allocation2),
 					resource.TestCheckResourceAttr(resourceName, "cidr", cidr1),
-					resource.TestMatchResourceAttr(resourceName, "id", regexp.MustCompile(`^ipam-pool-alloc-[\da-f]+_ipam-pool(-[\da-f]+)$`)),
-					resource.TestMatchResourceAttr(resourceName, "ipam_pool_allocation_id", regexp.MustCompile(`^ipam-pool-alloc-[\da-f]+$`)),
+					resource.TestMatchResourceAttr(resourceName, "id", regexache.MustCompile(`^ipam-pool-alloc-[0-9a-f]+_ipam-pool(-[0-9a-f]+)$`)),
+					resource.TestMatchResourceAttr(resourceName, "ipam_pool_allocation_id", regexache.MustCompile(`^ipam-pool-alloc-[0-9a-f]+$`)),
 					resource.TestCheckResourceAttrPair(resourceName, "ipam_pool_id", "aws_vpc_ipam_pool.test", "id"),
 					resource.TestCheckResourceAttr(resourceName2, "cidr", cidr2),
-					resource.TestMatchResourceAttr(resourceName2, "id", regexp.MustCompile(`^ipam-pool-alloc-[\da-f]+_ipam-pool(-[\da-f]+)$`)),
-					resource.TestMatchResourceAttr(resourceName2, "ipam_pool_allocation_id", regexp.MustCompile(`^ipam-pool-alloc-[\da-f]+$`)),
+					resource.TestMatchResourceAttr(resourceName2, "id", regexache.MustCompile(`^ipam-pool-alloc-[0-9a-f]+_ipam-pool(-[0-9a-f]+)$`)),
+					resource.TestMatchResourceAttr(resourceName2, "ipam_pool_allocation_id", regexache.MustCompile(`^ipam-pool-alloc-[0-9a-f]+$`)),
 					resource.TestCheckResourceAttrPair(resourceName2, "ipam_pool_id", "aws_vpc_ipam_pool.test", "id"),
 				),
 			},
@@ -196,8 +199,8 @@ func TestAccIPAMPoolCIDRAllocation_differentRegion(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckIPAMPoolCIDRAllocationExistsWithProvider(ctx, resourceName, &allocation, acctest.RegionProviderFunc(acctest.AlternateRegion(), &providers)),
 					resource.TestCheckResourceAttr(resourceName, "cidr", cidr),
-					resource.TestMatchResourceAttr(resourceName, "id", regexp.MustCompile(`^ipam-pool-alloc-[\da-f]+_ipam-pool(-[\da-f]+)$`)),
-					resource.TestMatchResourceAttr(resourceName, "ipam_pool_allocation_id", regexp.MustCompile(`^ipam-pool-alloc-[\da-f]+$`)),
+					resource.TestMatchResourceAttr(resourceName, "id", regexache.MustCompile(`^ipam-pool-alloc-[0-9a-f]+_ipam-pool(-[0-9a-f]+)$`)),
+					resource.TestMatchResourceAttr(resourceName, "ipam_pool_allocation_id", regexache.MustCompile(`^ipam-pool-alloc-[0-9a-f]+$`)),
 					resource.TestCheckResourceAttrPair(resourceName, "ipam_pool_id", "aws_vpc_ipam_pool.test", "id"),
 				),
 			},
diff --git a/internal/service/ec2/ipam_pool_cidr_test.go b/internal/service/ec2/ipam_pool_cidr_test.go
index 9fb9b18720a..89f39f232fc 100644
--- a/internal/service/ec2/ipam_pool_cidr_test.go
+++ b/internal/service/ec2/ipam_pool_cidr_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/ipam_pool_cidrs_data_source.go b/internal/service/ec2/ipam_pool_cidrs_data_source.go
index aa2cae071b1..94ef736fb75 100644
--- a/internal/service/ec2/ipam_pool_cidrs_data_source.go
+++ b/internal/service/ec2/ipam_pool_cidrs_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -22,7 +25,7 @@ func DataSourceIPAMPoolCIDRs() *schema.Resource {
 		},
 
 		Schema: map[string]*schema.Schema{
-			"filter": DataSourceFiltersSchema(),
+			"filter": CustomFiltersSchema(),
 			"ipam_pool_id": {
 				Type:     schema.TypeString,
 				Required: true,
@@ -56,7 +59,7 @@ func dataSourceIPAMPoolCIDRsRead(ctx context.Context, d *schema.ResourceData, me
 		IpamPoolId: aws.String(poolID),
 	}
 
-	input.Filters = append(input.Filters, BuildFiltersDataSource(
+	input.Filters = append(input.Filters, BuildCustomFilterList(
 		d.Get("filter").(*schema.Set),
 	)...)
 
diff --git a/internal/service/ec2/ipam_pool_cidrs_data_source_test.go b/internal/service/ec2/ipam_pool_cidrs_data_source_test.go
index 9110a1ab7c8..35ce7244632 100644
--- a/internal/service/ec2/ipam_pool_cidrs_data_source_test.go
+++ b/internal/service/ec2/ipam_pool_cidrs_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/ipam_pool_data_source.go b/internal/service/ec2/ipam_pool_data_source.go
index 5a7c2994a78..fd3227047fe 100644
--- a/internal/service/ec2/ipam_pool_data_source.go
+++ b/internal/service/ec2/ipam_pool_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -58,7 +61,7 @@ func DataSourceIPAMPool() *schema.Resource {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
-			"filter": DataSourceFiltersSchema(),
+			"filter": CustomFiltersSchema(),
 			"id": {
 				Type:     schema.TypeString,
 				Optional: true,
@@ -111,7 +114,7 @@ func dataSourceIPAMPoolRead(ctx context.Context, d *schema.ResourceData, meta in
 		input.IpamPoolIds = aws.StringSlice([]string{v.(string)})
 	}
 
-	input.Filters = append(input.Filters, BuildFiltersDataSource(
+	input.Filters = append(input.Filters, BuildCustomFilterList(
 		d.Get("filter").(*schema.Set),
 	)...)
 
diff --git a/internal/service/ec2/ipam_pool_data_source_test.go b/internal/service/ec2/ipam_pool_data_source_test.go
index 3bb731a328c..e3a92731be6 100644
--- a/internal/service/ec2/ipam_pool_data_source_test.go
+++ b/internal/service/ec2/ipam_pool_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/ipam_pool_test.go b/internal/service/ec2/ipam_pool_test.go
index 86403f90c62..11048aaafda 100644
--- a/internal/service/ec2/ipam_pool_test.go
+++ b/internal/service/ec2/ipam_pool_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/ipam_pools_data_source.go b/internal/service/ec2/ipam_pools_data_source.go
index 155c58ee357..18e0c52a513 100644
--- a/internal/service/ec2/ipam_pools_data_source.go
+++ b/internal/service/ec2/ipam_pools_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -19,16 +22,12 @@ func DataSourceIPAMPools() *schema.Resource {
 		ReadWithoutTimeout: dataSourceIPAMPoolsRead,
 
 		Schema: map[string]*schema.Schema{
-			"filter": DataSourceFiltersSchema(),
+			"filter": CustomFiltersSchema(),
 			"ipam_pools": {
 				Type:     schema.TypeSet,
 				Computed: true,
 				Elem: &schema.Resource{
 					Schema: map[string]*schema.Schema{
-						"id": {
-							Type:     schema.TypeString,
-							Optional: true,
-						},
 						"address_family": {
 							Type:     schema.TypeString,
 							Computed: true,
@@ -62,6 +61,10 @@ func DataSourceIPAMPools() *schema.Resource {
 							Type:     schema.TypeString,
 							Computed: true,
 						},
+						"id": {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
 						"ipam_scope_id": {
 							Type:     schema.TypeString,
 							Computed: true,
@@ -105,7 +108,7 @@ func dataSourceIPAMPoolsRead(ctx context.Context, d *schema.ResourceData, meta i
 
 	input := &ec2.DescribeIpamPoolsInput{}
 
-	input.Filters = append(input.Filters, BuildFiltersDataSource(
+	input.Filters = append(input.Filters, BuildCustomFilterList(
 		d.Get("filter").(*schema.Set),
 	)...)
 
@@ -136,7 +139,6 @@ func flattenIPAMPools(ctx context.Context, c []*ec2.IpamPool, ignoreTagsConfig *
 func flattenIPAMPool(ctx context.Context, p *ec2.IpamPool, ignoreTagsConfig *tftags.IgnoreConfig) map[string]interface{} {
 	pool := make(map[string]interface{})
 
-	pool["id"] = aws.StringValue(p.IpamPoolId)
 	pool["address_family"] = aws.StringValue(p.AddressFamily)
 	pool["allocation_default_netmask_length"] = aws.Int64Value(p.AllocationDefaultNetmaskLength)
 	pool["allocation_max_netmask_length"] = aws.Int64Value(p.AllocationMaxNetmaskLength)
@@ -146,6 +148,7 @@ func flattenIPAMPool(ctx context.Context, p *ec2.IpamPool, ignoreTagsConfig *tft
 	pool["auto_import"] = aws.BoolValue(p.AutoImport)
 	pool["aws_service"] = aws.StringValue(p.AwsService)
 	pool["description"] = aws.StringValue(p.Description)
+	pool["id"] = aws.StringValue(p.IpamPoolId)
 	pool["ipam_scope_id"] = strings.Split(aws.StringValue(p.IpamScopeArn), "/")[1]
 	pool["ipam_scope_type"] = aws.StringValue(p.IpamScopeType)
 	pool["locale"] = aws.StringValue(p.Locale)
@@ -153,7 +156,6 @@ func flattenIPAMPool(ctx context.Context, p *ec2.IpamPool, ignoreTagsConfig *tft
 	pool["publicly_advertisable"] = aws.BoolValue(p.PubliclyAdvertisable)
 	pool["source_ipam_pool_id"] = aws.StringValue(p.SourceIpamPoolId)
 	pool["state"] = aws.StringValue(p.State)
-
 	if v := p.Tags; v != nil {
 		pool["tags"] = KeyValueTags(ctx, v).IgnoreAWS().IgnoreConfig(ignoreTagsConfig).Map()
 	}
diff --git a/internal/service/ec2/ipam_pools_data_source_test.go b/internal/service/ec2/ipam_pools_data_source_test.go
index 674cae57369..322633d7fed 100644
--- a/internal/service/ec2/ipam_pools_data_source_test.go
+++ b/internal/service/ec2/ipam_pools_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
@@ -33,7 +36,6 @@ func TestAccIPAMPoolsDataSource_basic(t *testing.T) {
 
 					// DS 2 filters on 1 specific pool to validate attributes
 					resource.TestCheckResourceAttr(dataSourceNameTwo, "ipam_pools.#", "1"),
-					resource.TestCheckResourceAttrPair(dataSourceNameTwo, "ipam_pools.0.id", resourceName, "id"),
 					resource.TestCheckResourceAttrPair(dataSourceNameTwo, "ipam_pools.0.address_family", resourceName, "address_family"),
 					resource.TestCheckResourceAttrPair(dataSourceNameTwo, "ipam_pools.0.allocation_default_netmask_length", resourceName, "allocation_default_netmask_length"),
 					resource.TestCheckResourceAttrPair(dataSourceNameTwo, "ipam_pools.0.allocation_max_netmask_length", resourceName, "allocation_max_netmask_length"),
@@ -43,6 +45,7 @@ func TestAccIPAMPoolsDataSource_basic(t *testing.T) {
 					resource.TestCheckResourceAttrPair(dataSourceNameTwo, "ipam_pools.0.auto_import", resourceName, "auto_import"),
 					resource.TestCheckResourceAttrPair(dataSourceNameTwo, "ipam_pools.0.description", resourceName, "description"),
 					resource.TestCheckResourceAttrPair(dataSourceNameTwo, "ipam_pools.0.aws_service", resourceName, "aws_service"),
+					resource.TestCheckResourceAttrPair(dataSourceNameTwo, "ipam_pools.0.id", resourceName, "id"),
 					resource.TestCheckResourceAttrPair(dataSourceNameTwo, "ipam_pools.0.ipam_scope_id", resourceName, "ipam_scope_id"),
 					resource.TestCheckResourceAttrPair(dataSourceNameTwo, "ipam_pools.0.ipam_scope_type", resourceName, "ipam_scope_type"),
 					resource.TestCheckResourceAttrPair(dataSourceNameTwo, "ipam_pools.0.locale", resourceName, "locale"),
diff --git a/internal/service/ec2/ipam_preview_next_cidr.go b/internal/service/ec2/ipam_preview_next_cidr.go
index 98ac0304786..b6447039450 100644
--- a/internal/service/ec2/ipam_preview_next_cidr.go
+++ b/internal/service/ec2/ipam_preview_next_cidr.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/ipam_preview_next_cidr_data_source.go b/internal/service/ec2/ipam_preview_next_cidr_data_source.go
index 8f5fa60f1a3..b0fca9f2263 100644
--- a/internal/service/ec2/ipam_preview_next_cidr_data_source.go
+++ b/internal/service/ec2/ipam_preview_next_cidr_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/ipam_preview_next_cidr_data_source_test.go b/internal/service/ec2/ipam_preview_next_cidr_data_source_test.go
index d7046e729f3..634178d8a96 100644
--- a/internal/service/ec2/ipam_preview_next_cidr_data_source_test.go
+++ b/internal/service/ec2/ipam_preview_next_cidr_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/ipam_preview_next_cidr_test.go b/internal/service/ec2/ipam_preview_next_cidr_test.go
index 49a3fb6487d..82f38aa8eff 100644
--- a/internal/service/ec2/ipam_preview_next_cidr_test.go
+++ b/internal/service/ec2/ipam_preview_next_cidr_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/ipam_resource_discovery.go b/internal/service/ec2/ipam_resource_discovery.go
index f60a667f0a6..46db46c6632 100644
--- a/internal/service/ec2/ipam_resource_discovery.go
+++ b/internal/service/ec2/ipam_resource_discovery.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/ipam_resource_discovery_association.go b/internal/service/ec2/ipam_resource_discovery_association.go
index b61f730b36a..4a6c1ed0b5a 100644
--- a/internal/service/ec2/ipam_resource_discovery_association.go
+++ b/internal/service/ec2/ipam_resource_discovery_association.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/ipam_resource_discovery_association_test.go b/internal/service/ec2/ipam_resource_discovery_association_test.go
index 726fcf852b7..64c9569e43f 100644
--- a/internal/service/ec2/ipam_resource_discovery_association_test.go
+++ b/internal/service/ec2/ipam_resource_discovery_association_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
@@ -32,7 +35,7 @@ func testAccIPAMResourceDiscoveryAssociation_basic(t *testing.T) {
 				Config: testAccIPAMResourceDiscoveryAssociationConfig_basic(),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckIPAMResourceDiscoveryAssociationExists(ctx, resourceName, &rda),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "ec2", regexp.MustCompile(`ipam-resource-discovery-association/ipam-res-disco-assoc-[\da-f]+$`)),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "ec2", regexache.MustCompile(`ipam-resource-discovery-association/ipam-res-disco-assoc-[0-9a-f]+$`)),
 					resource.TestCheckResourceAttrPair(resourceName, "ipam_id", ipamName, "id"),
 					resource.TestCheckResourceAttrPair(resourceName, "ipam_resource_discovery_id", rdName, "id"),
 					acctest.CheckResourceAttrAccountID(resourceName, "owner_id"),
diff --git a/internal/service/ec2/ipam_resource_discovery_test.go b/internal/service/ec2/ipam_resource_discovery_test.go
index e4625f69bd0..de737a75d1a 100644
--- a/internal/service/ec2/ipam_resource_discovery_test.go
+++ b/internal/service/ec2/ipam_resource_discovery_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
@@ -51,7 +54,7 @@ func testAccIPAMResourceDiscovery_basic(t *testing.T) {
 				Config: testAccIPAMResourceDiscoveryConfig_base,
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckIPAMResourceDiscoveryExists(ctx, resourceName, &rd),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "ec2", regexp.MustCompile(`ipam-resource-discovery/ipam-res-disco-[\da-f]+$`)),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "ec2", regexache.MustCompile(`ipam-resource-discovery/ipam-res-disco-[0-9a-f]+$`)),
 					resource.TestCheckResourceAttr(resourceName, "description", "test"),
 					resource.TestCheckResourceAttrPair(resourceName, "ipam_resource_discovery_region", dataSourceRegion, "name"),
 					resource.TestCheckResourceAttr(resourceName, "is_default", "false"),
diff --git a/internal/service/ec2/ipam_scope.go b/internal/service/ec2/ipam_scope.go
index 93171b7fdc6..beb5e1e6e7e 100644
--- a/internal/service/ec2/ipam_scope.go
+++ b/internal/service/ec2/ipam_scope.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/ipam_scope_test.go b/internal/service/ec2/ipam_scope_test.go
index 6153fa16336..b284a70df6b 100644
--- a/internal/service/ec2/ipam_scope_test.go
+++ b/internal/service/ec2/ipam_scope_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/ipam_test.go b/internal/service/ec2/ipam_test.go
index b5995d6da58..9736ced00b3 100644
--- a/internal/service/ec2/ipam_test.go
+++ b/internal/service/ec2/ipam_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
@@ -36,10 +39,10 @@ func TestAccIPAM_basic(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
 					resource.TestCheckResourceAttr(resourceName, "operating_regions.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "scope_count", "2"),
-					resource.TestMatchResourceAttr(resourceName, "private_default_scope_id", regexp.MustCompile(`^ipam-scope-[\da-f]+`)),
-					resource.TestMatchResourceAttr(resourceName, "public_default_scope_id", regexp.MustCompile(`^ipam-scope-[\da-f]+`)),
-					resource.TestMatchResourceAttr(resourceName, "default_resource_discovery_association_id", regexp.MustCompile(`^ipam-res-disco-assoc-[\da-f]+`)),
-					resource.TestMatchResourceAttr(resourceName, "default_resource_discovery_id", regexp.MustCompile(`^ipam-res-disco-[\da-f]+`)),
+					resource.TestMatchResourceAttr(resourceName, "private_default_scope_id", regexache.MustCompile(`^ipam-scope-[0-9a-f]+`)),
+					resource.TestMatchResourceAttr(resourceName, "public_default_scope_id", regexache.MustCompile(`^ipam-scope-[0-9a-f]+`)),
+					resource.TestMatchResourceAttr(resourceName, "default_resource_discovery_association_id", regexache.MustCompile(`^ipam-res-disco-assoc-[0-9a-f]+`)),
+					resource.TestMatchResourceAttr(resourceName, "default_resource_discovery_id", regexache.MustCompile(`^ipam-res-disco-[0-9a-f]+`)),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 				),
 			},
diff --git a/internal/service/ec2/outposts_coip_pool_data_source.go b/internal/service/ec2/outposts_coip_pool_data_source.go
index 1cc372d10a1..2fd31025d47 100644
--- a/internal/service/ec2/outposts_coip_pool_data_source.go
+++ b/internal/service/ec2/outposts_coip_pool_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/outposts_coip_pool_data_source_test.go b/internal/service/ec2/outposts_coip_pool_data_source_test.go
index 551b746ec62..047bed1e0a8 100644
--- a/internal/service/ec2/outposts_coip_pool_data_source_test.go
+++ b/internal/service/ec2/outposts_coip_pool_data_source_test.go
@@ -1,9 +1,12 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
@@ -21,8 +24,8 @@ func TestAccEC2OutpostsCoIPPoolDataSource_filter(t *testing.T) {
 			{
 				Config: testAccOutpostsCoIPPoolDataSourceConfig_filter(),
 				Check: resource.ComposeTestCheckFunc(
-					resource.TestMatchResourceAttr(dataSourceName, "local_gateway_route_table_id", regexp.MustCompile(`^lgw-rtb-`)),
-					resource.TestMatchResourceAttr(dataSourceName, "pool_id", regexp.MustCompile(`^ipv4pool-coip-`)),
+					resource.TestMatchResourceAttr(dataSourceName, "local_gateway_route_table_id", regexache.MustCompile(`^lgw-rtb-`)),
+					resource.TestMatchResourceAttr(dataSourceName, "pool_id", regexache.MustCompile(`^ipv4pool-coip-`)),
 					acctest.CheckResourceAttrGreaterThanValue(dataSourceName, "pool_cidrs.#", 0),
 				),
 			},
@@ -42,9 +45,9 @@ func TestAccEC2OutpostsCoIPPoolDataSource_id(t *testing.T) {
 			{
 				Config: testAccOutpostsCoIPPoolDataSourceConfig_id(),
 				Check: resource.ComposeTestCheckFunc(
-					resource.TestMatchResourceAttr(dataSourceName, "local_gateway_route_table_id", regexp.MustCompile(`^lgw-rtb-`)),
-					resource.TestMatchResourceAttr(dataSourceName, "pool_id", regexp.MustCompile(`^ipv4pool-coip-`)),
-					acctest.MatchResourceAttrRegionalARN(dataSourceName, "arn", "ec2", regexp.MustCompile(`coip-pool/ipv4pool-coip-.+$`)),
+					resource.TestMatchResourceAttr(dataSourceName, "local_gateway_route_table_id", regexache.MustCompile(`^lgw-rtb-`)),
+					resource.TestMatchResourceAttr(dataSourceName, "pool_id", regexache.MustCompile(`^ipv4pool-coip-`)),
+					acctest.MatchResourceAttrRegionalARN(dataSourceName, "arn", "ec2", regexache.MustCompile(`coip-pool/ipv4pool-coip-.+$`)),
 					acctest.CheckResourceAttrGreaterThanValue(dataSourceName, "pool_cidrs.#", 0),
 				),
 			},
diff --git a/internal/service/ec2/outposts_coip_pools_data_source.go b/internal/service/ec2/outposts_coip_pools_data_source.go
index 4742997d742..68dd47a428d 100644
--- a/internal/service/ec2/outposts_coip_pools_data_source.go
+++ b/internal/service/ec2/outposts_coip_pools_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -23,7 +26,7 @@ func DataSourceCoIPPools() *schema.Resource {
 		},
 
 		Schema: map[string]*schema.Schema{
-			"filter": DataSourceFiltersSchema(),
+			"filter": CustomFiltersSchema(),
 			"pool_ids": {
 				Type:     schema.TypeList,
 				Computed: true,
@@ -44,7 +47,7 @@ func dataSourceCoIPPoolsRead(ctx context.Context, d *schema.ResourceData, meta i
 		Tags(tftags.New(ctx, d.Get("tags").(map[string]interface{}))),
 	)...)
 
-	input.Filters = append(input.Filters, BuildFiltersDataSource(
+	input.Filters = append(input.Filters, BuildCustomFilterList(
 		d.Get("filter").(*schema.Set),
 	)...)
 
diff --git a/internal/service/ec2/outposts_coip_pools_data_source_test.go b/internal/service/ec2/outposts_coip_pools_data_source_test.go
index 1cb8a6fabe7..10f021d2c01 100644
--- a/internal/service/ec2/outposts_coip_pools_data_source_test.go
+++ b/internal/service/ec2/outposts_coip_pools_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/outposts_local_gateway_data_source.go b/internal/service/ec2/outposts_local_gateway_data_source.go
index b6c1ea109bc..e0d4bb5159f 100644
--- a/internal/service/ec2/outposts_local_gateway_data_source.go
+++ b/internal/service/ec2/outposts_local_gateway_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/outposts_local_gateway_data_source_test.go b/internal/service/ec2/outposts_local_gateway_data_source_test.go
index 9254fb184d9..f626c684bea 100644
--- a/internal/service/ec2/outposts_local_gateway_data_source_test.go
+++ b/internal/service/ec2/outposts_local_gateway_data_source_test.go
@@ -1,9 +1,12 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
@@ -21,8 +24,8 @@ func TestAccEC2OutpostsLocalGatewayDataSource_basic(t *testing.T) {
 			{
 				Config: testAccOutpostsLocalGatewayDataSourceConfig_id(),
 				Check: resource.ComposeTestCheckFunc(
-					resource.TestMatchResourceAttr(dataSourceName, "id", regexp.MustCompile(`^lgw-`)),
-					acctest.MatchResourceAttrRegionalARN(dataSourceName, "outpost_arn", "outposts", regexp.MustCompile(`outpost/op-.+`)),
+					resource.TestMatchResourceAttr(dataSourceName, "id", regexache.MustCompile(`^lgw-`)),
+					acctest.MatchResourceAttrRegionalARN(dataSourceName, "outpost_arn", "outposts", regexache.MustCompile(`outpost/op-.+`)),
 					acctest.CheckResourceAttrAccountID(dataSourceName, "owner_id"),
 					resource.TestCheckResourceAttr(dataSourceName, "state", "available"),
 				),
diff --git a/internal/service/ec2/outposts_local_gateway_route.go b/internal/service/ec2/outposts_local_gateway_route.go
index 6df7d356dda..e729977529b 100644
--- a/internal/service/ec2/outposts_local_gateway_route.go
+++ b/internal/service/ec2/outposts_local_gateway_route.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/outposts_local_gateway_route_table_data_source.go b/internal/service/ec2/outposts_local_gateway_route_table_data_source.go
index 56ae0dccd8c..5570298dbf5 100644
--- a/internal/service/ec2/outposts_local_gateway_route_table_data_source.go
+++ b/internal/service/ec2/outposts_local_gateway_route_table_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/outposts_local_gateway_route_table_data_source_test.go b/internal/service/ec2/outposts_local_gateway_route_table_data_source_test.go
index db08d739d46..483224b777c 100644
--- a/internal/service/ec2/outposts_local_gateway_route_table_data_source_test.go
+++ b/internal/service/ec2/outposts_local_gateway_route_table_data_source_test.go
@@ -1,9 +1,12 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
@@ -21,9 +24,9 @@ func TestAccEC2OutpostsLocalGatewayRouteTableDataSource_basic(t *testing.T) {
 			{
 				Config: testAccOutpostsLocalGatewayRouteTableDataSourceConfig_routeTableID(),
 				Check: resource.ComposeTestCheckFunc(
-					resource.TestMatchResourceAttr(dataSourceName, "local_gateway_id", regexp.MustCompile(`^lgw-`)),
-					resource.TestMatchResourceAttr(dataSourceName, "local_gateway_route_table_id", regexp.MustCompile(`^lgw-rtb-`)),
-					acctest.MatchResourceAttrRegionalARN(dataSourceName, "outpost_arn", "outposts", regexp.MustCompile(`outpost/op-.+`)),
+					resource.TestMatchResourceAttr(dataSourceName, "local_gateway_id", regexache.MustCompile(`^lgw-`)),
+					resource.TestMatchResourceAttr(dataSourceName, "local_gateway_route_table_id", regexache.MustCompile(`^lgw-rtb-`)),
+					acctest.MatchResourceAttrRegionalARN(dataSourceName, "outpost_arn", "outposts", regexache.MustCompile(`outpost/op-.+`)),
 					resource.TestCheckResourceAttr(dataSourceName, "state", "available"),
 				),
 			},
@@ -43,9 +46,9 @@ func TestAccEC2OutpostsLocalGatewayRouteTableDataSource_filter(t *testing.T) {
 			{
 				Config: testAccOutpostsLocalGatewayRouteTableDataSourceConfig_filter(),
 				Check: resource.ComposeTestCheckFunc(
-					resource.TestMatchResourceAttr(dataSourceName, "local_gateway_id", regexp.MustCompile(`^lgw-`)),
-					resource.TestMatchResourceAttr(dataSourceName, "local_gateway_route_table_id", regexp.MustCompile(`^lgw-rtb-`)),
-					acctest.MatchResourceAttrRegionalARN(dataSourceName, "outpost_arn", "outposts", regexp.MustCompile(`outpost/op-.+`)),
+					resource.TestMatchResourceAttr(dataSourceName, "local_gateway_id", regexache.MustCompile(`^lgw-`)),
+					resource.TestMatchResourceAttr(dataSourceName, "local_gateway_route_table_id", regexache.MustCompile(`^lgw-rtb-`)),
+					acctest.MatchResourceAttrRegionalARN(dataSourceName, "outpost_arn", "outposts", regexache.MustCompile(`outpost/op-.+`)),
 					resource.TestCheckResourceAttr(dataSourceName, "state", "available"),
 				),
 			},
@@ -65,9 +68,9 @@ func TestAccEC2OutpostsLocalGatewayRouteTableDataSource_localGatewayID(t *testin
 			{
 				Config: testAccOutpostsLocalGatewayRouteTableDataSourceConfig_localGatewayID(),
 				Check: resource.ComposeTestCheckFunc(
-					resource.TestMatchResourceAttr(dataSourceName, "local_gateway_id", regexp.MustCompile(`^lgw-`)),
-					resource.TestMatchResourceAttr(dataSourceName, "local_gateway_route_table_id", regexp.MustCompile(`^lgw-rtb-`)),
-					acctest.MatchResourceAttrRegionalARN(dataSourceName, "outpost_arn", "outposts", regexp.MustCompile(`outpost/op-.+`)),
+					resource.TestMatchResourceAttr(dataSourceName, "local_gateway_id", regexache.MustCompile(`^lgw-`)),
+					resource.TestMatchResourceAttr(dataSourceName, "local_gateway_route_table_id", regexache.MustCompile(`^lgw-rtb-`)),
+					acctest.MatchResourceAttrRegionalARN(dataSourceName, "outpost_arn", "outposts", regexache.MustCompile(`outpost/op-.+`)),
 					resource.TestCheckResourceAttr(dataSourceName, "state", "available"),
 				),
 			},
@@ -87,9 +90,9 @@ func TestAccEC2OutpostsLocalGatewayRouteTableDataSource_outpostARN(t *testing.T)
 			{
 				Config: testAccOutpostsLocalGatewayRouteTableDataSourceConfig_outpostARN(),
 				Check: resource.ComposeTestCheckFunc(
-					resource.TestMatchResourceAttr(dataSourceName, "local_gateway_id", regexp.MustCompile(`^lgw-`)),
-					resource.TestMatchResourceAttr(dataSourceName, "local_gateway_route_table_id", regexp.MustCompile(`^lgw-rtb-`)),
-					acctest.MatchResourceAttrRegionalARN(dataSourceName, "outpost_arn", "outposts", regexp.MustCompile(`outpost/op-.+`)),
+					resource.TestMatchResourceAttr(dataSourceName, "local_gateway_id", regexache.MustCompile(`^lgw-`)),
+					resource.TestMatchResourceAttr(dataSourceName, "local_gateway_route_table_id", regexache.MustCompile(`^lgw-rtb-`)),
+					acctest.MatchResourceAttrRegionalARN(dataSourceName, "outpost_arn", "outposts", regexache.MustCompile(`outpost/op-.+`)),
 					resource.TestCheckResourceAttr(dataSourceName, "state", "available"),
 				),
 			},
diff --git a/internal/service/ec2/outposts_local_gateway_route_table_vpc_association.go b/internal/service/ec2/outposts_local_gateway_route_table_vpc_association.go
index fdba9424b8b..393c12db272 100644
--- a/internal/service/ec2/outposts_local_gateway_route_table_vpc_association.go
+++ b/internal/service/ec2/outposts_local_gateway_route_table_vpc_association.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/outposts_local_gateway_route_table_vpc_association_test.go b/internal/service/ec2/outposts_local_gateway_route_table_vpc_association_test.go
index 383151f436d..ff7a612702d 100644
--- a/internal/service/ec2/outposts_local_gateway_route_table_vpc_association_test.go
+++ b/internal/service/ec2/outposts_local_gateway_route_table_vpc_association_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/outposts_local_gateway_route_tables_data_source.go b/internal/service/ec2/outposts_local_gateway_route_tables_data_source.go
index 021ca0baddf..b1dedbe6741 100644
--- a/internal/service/ec2/outposts_local_gateway_route_tables_data_source.go
+++ b/internal/service/ec2/outposts_local_gateway_route_tables_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -23,7 +26,7 @@ func DataSourceLocalGatewayRouteTables() *schema.Resource {
 		},
 
 		Schema: map[string]*schema.Schema{
-			"filter": DataSourceFiltersSchema(),
+			"filter": CustomFiltersSchema(),
 			"ids": {
 				Type:     schema.TypeList,
 				Computed: true,
@@ -44,7 +47,7 @@ func dataSourceLocalGatewayRouteTablesRead(ctx context.Context, d *schema.Resour
 		Tags(tftags.New(ctx, d.Get("tags").(map[string]interface{}))),
 	)...)
 
-	input.Filters = append(input.Filters, BuildFiltersDataSource(
+	input.Filters = append(input.Filters, BuildCustomFilterList(
 		d.Get("filter").(*schema.Set),
 	)...)
 
diff --git a/internal/service/ec2/outposts_local_gateway_route_tables_data_source_test.go b/internal/service/ec2/outposts_local_gateway_route_tables_data_source_test.go
index ac7e4cd1c82..0f017833a43 100644
--- a/internal/service/ec2/outposts_local_gateway_route_tables_data_source_test.go
+++ b/internal/service/ec2/outposts_local_gateway_route_tables_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/outposts_local_gateway_route_test.go b/internal/service/ec2/outposts_local_gateway_route_test.go
index 0839b3245aa..54248d88ef2 100644
--- a/internal/service/ec2/outposts_local_gateway_route_test.go
+++ b/internal/service/ec2/outposts_local_gateway_route_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/outposts_local_gateway_virtual_interface_data_source.go b/internal/service/ec2/outposts_local_gateway_virtual_interface_data_source.go
index bbd79f3940d..e25bb49f7dc 100644
--- a/internal/service/ec2/outposts_local_gateway_virtual_interface_data_source.go
+++ b/internal/service/ec2/outposts_local_gateway_virtual_interface_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/outposts_local_gateway_virtual_interface_data_source_test.go b/internal/service/ec2/outposts_local_gateway_virtual_interface_data_source_test.go
index 62185346505..0436170102b 100644
--- a/internal/service/ec2/outposts_local_gateway_virtual_interface_data_source_test.go
+++ b/internal/service/ec2/outposts_local_gateway_virtual_interface_data_source_test.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -23,13 +26,13 @@ func TestAccEC2OutpostsLocalGatewayVirtualInterfaceDataSource_filter(t *testing.
 			{
 				Config: testAccOutpostsLocalGatewayVirtualInterfaceDataSourceConfig_filter(),
 				Check: resource.ComposeTestCheckFunc(
-					resource.TestMatchResourceAttr(dataSourceName, "id", regexp.MustCompile(`^lgw-vif-`)),
-					resource.TestMatchResourceAttr(dataSourceName, "local_address", regexp.MustCompile(`^\d+\.\d+\.\d+\.\d+/\d+$`)),
-					resource.TestMatchResourceAttr(dataSourceName, "local_bgp_asn", regexp.MustCompile(`^\d+$`)),
-					resource.TestMatchResourceAttr(dataSourceName, "local_gateway_id", regexp.MustCompile(`^lgw-`)),
-					resource.TestMatchResourceAttr(dataSourceName, "peer_address", regexp.MustCompile(`^\d+\.\d+\.\d+\.\d+/\d+$`)),
-					resource.TestMatchResourceAttr(dataSourceName, "peer_bgp_asn", regexp.MustCompile(`^\d+$`)),
-					resource.TestMatchResourceAttr(dataSourceName, "vlan", regexp.MustCompile(`^\d+$`)),
+					resource.TestMatchResourceAttr(dataSourceName, "id", regexache.MustCompile(`^lgw-vif-`)),
+					resource.TestMatchResourceAttr(dataSourceName, "local_address", regexache.MustCompile(`^\d+\.\d+\.\d+\.\d+/\d+$`)),
+					resource.TestMatchResourceAttr(dataSourceName, "local_bgp_asn", regexache.MustCompile(`^\d+$`)),
+					resource.TestMatchResourceAttr(dataSourceName, "local_gateway_id", regexache.MustCompile(`^lgw-`)),
+					resource.TestMatchResourceAttr(dataSourceName, "peer_address", regexache.MustCompile(`^\d+\.\d+\.\d+\.\d+/\d+$`)),
+					resource.TestMatchResourceAttr(dataSourceName, "peer_bgp_asn", regexache.MustCompile(`^\d+$`)),
+					resource.TestMatchResourceAttr(dataSourceName, "vlan", regexache.MustCompile(`^\d+$`)),
 				),
 			},
 		},
@@ -48,13 +51,13 @@ func TestAccEC2OutpostsLocalGatewayVirtualInterfaceDataSource_id(t *testing.T) {
 			{
 				Config: testAccOutpostsLocalGatewayVirtualInterfaceDataSourceConfig_id(),
 				Check: resource.ComposeTestCheckFunc(
-					resource.TestMatchResourceAttr(dataSourceName, "id", regexp.MustCompile(`^lgw-vif-`)),
-					resource.TestMatchResourceAttr(dataSourceName, "local_address", regexp.MustCompile(`^\d+\.\d+\.\d+\.\d+/\d+$`)),
-					resource.TestMatchResourceAttr(dataSourceName, "local_bgp_asn", regexp.MustCompile(`^\d+$`)),
-					resource.TestMatchResourceAttr(dataSourceName, "local_gateway_id", regexp.MustCompile(`^lgw-`)),
-					resource.TestMatchResourceAttr(dataSourceName, "peer_address", regexp.MustCompile(`^\d+\.\d+\.\d+\.\d+/\d+$`)),
-					resource.TestMatchResourceAttr(dataSourceName, "peer_bgp_asn", regexp.MustCompile(`^\d+$`)),
-					resource.TestMatchResourceAttr(dataSourceName, "vlan", regexp.MustCompile(`^\d+$`)),
+					resource.TestMatchResourceAttr(dataSourceName, "id", regexache.MustCompile(`^lgw-vif-`)),
+					resource.TestMatchResourceAttr(dataSourceName, "local_address", regexache.MustCompile(`^\d+\.\d+\.\d+\.\d+/\d+$`)),
+					resource.TestMatchResourceAttr(dataSourceName, "local_bgp_asn", regexache.MustCompile(`^\d+$`)),
+					resource.TestMatchResourceAttr(dataSourceName, "local_gateway_id", regexache.MustCompile(`^lgw-`)),
+					resource.TestMatchResourceAttr(dataSourceName, "peer_address", regexache.MustCompile(`^\d+\.\d+\.\d+\.\d+/\d+$`)),
+					resource.TestMatchResourceAttr(dataSourceName, "peer_bgp_asn", regexache.MustCompile(`^\d+$`)),
+					resource.TestMatchResourceAttr(dataSourceName, "vlan", regexache.MustCompile(`^\d+$`)),
 				),
 			},
 		},
diff --git a/internal/service/ec2/outposts_local_gateway_virtual_interface_group_data_source.go b/internal/service/ec2/outposts_local_gateway_virtual_interface_group_data_source.go
index 5c433f71426..ed61b934f92 100644
--- a/internal/service/ec2/outposts_local_gateway_virtual_interface_group_data_source.go
+++ b/internal/service/ec2/outposts_local_gateway_virtual_interface_group_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/outposts_local_gateway_virtual_interface_group_data_source_test.go b/internal/service/ec2/outposts_local_gateway_virtual_interface_group_data_source_test.go
index 974c28d3acb..04e18920a9a 100644
--- a/internal/service/ec2/outposts_local_gateway_virtual_interface_group_data_source_test.go
+++ b/internal/service/ec2/outposts_local_gateway_virtual_interface_group_data_source_test.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -23,8 +26,8 @@ func TestAccEC2OutpostsLocalGatewayVirtualInterfaceGroupDataSource_filter(t *tes
 			{
 				Config: testAccOutpostsLocalGatewayVirtualInterfaceGroupDataSourceConfig_filter(),
 				Check: resource.ComposeTestCheckFunc(
-					resource.TestMatchResourceAttr(dataSourceName, "id", regexp.MustCompile(`^lgw-vif-grp-`)),
-					resource.TestMatchResourceAttr(dataSourceName, "local_gateway_id", regexp.MustCompile(`^lgw-`)),
+					resource.TestMatchResourceAttr(dataSourceName, "id", regexache.MustCompile(`^lgw-vif-grp-`)),
+					resource.TestMatchResourceAttr(dataSourceName, "local_gateway_id", regexache.MustCompile(`^lgw-`)),
 					resource.TestCheckResourceAttr(dataSourceName, "local_gateway_virtual_interface_ids.#", "2"),
 				),
 			},
@@ -44,8 +47,8 @@ func TestAccEC2OutpostsLocalGatewayVirtualInterfaceGroupDataSource_localGatewayI
 			{
 				Config: testAccOutpostsLocalGatewayVirtualInterfaceGroupDataSourceConfig_id(),
 				Check: resource.ComposeTestCheckFunc(
-					resource.TestMatchResourceAttr(dataSourceName, "id", regexp.MustCompile(`^lgw-vif-grp-`)),
-					resource.TestMatchResourceAttr(dataSourceName, "local_gateway_id", regexp.MustCompile(`^lgw-`)),
+					resource.TestMatchResourceAttr(dataSourceName, "id", regexache.MustCompile(`^lgw-vif-grp-`)),
+					resource.TestMatchResourceAttr(dataSourceName, "local_gateway_id", regexache.MustCompile(`^lgw-`)),
 					resource.TestCheckResourceAttr(dataSourceName, "local_gateway_virtual_interface_ids.#", "2"),
 				),
 			},
diff --git a/internal/service/ec2/outposts_local_gateway_virtual_interface_groups_data_source.go b/internal/service/ec2/outposts_local_gateway_virtual_interface_groups_data_source.go
index 12dbb28926b..234414111ef 100644
--- a/internal/service/ec2/outposts_local_gateway_virtual_interface_groups_data_source.go
+++ b/internal/service/ec2/outposts_local_gateway_virtual_interface_groups_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -23,7 +26,7 @@ func DataSourceLocalGatewayVirtualInterfaceGroups() *schema.Resource {
 		},
 
 		Schema: map[string]*schema.Schema{
-			"filter": DataSourceFiltersSchema(),
+			"filter": CustomFiltersSchema(),
 			"ids": {
 				Type:     schema.TypeList,
 				Computed: true,
@@ -49,7 +52,7 @@ func dataSourceLocalGatewayVirtualInterfaceGroupsRead(ctx context.Context, d *sc
 		Tags(tftags.New(ctx, d.Get("tags").(map[string]interface{}))),
 	)...)
 
-	input.Filters = append(input.Filters, BuildFiltersDataSource(
+	input.Filters = append(input.Filters, BuildCustomFilterList(
 		d.Get("filter").(*schema.Set),
 	)...)
 
diff --git a/internal/service/ec2/outposts_local_gateway_virtual_interface_groups_data_source_test.go b/internal/service/ec2/outposts_local_gateway_virtual_interface_groups_data_source_test.go
index e3538f60b4b..c43a346a378 100644
--- a/internal/service/ec2/outposts_local_gateway_virtual_interface_groups_data_source_test.go
+++ b/internal/service/ec2/outposts_local_gateway_virtual_interface_groups_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/outposts_local_gateways_data_source.go b/internal/service/ec2/outposts_local_gateways_data_source.go
index 8d26b49a463..49de79f8037 100644
--- a/internal/service/ec2/outposts_local_gateways_data_source.go
+++ b/internal/service/ec2/outposts_local_gateways_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -23,7 +26,7 @@ func DataSourceLocalGateways() *schema.Resource {
 		},
 
 		Schema: map[string]*schema.Schema{
-			"filter": DataSourceFiltersSchema(),
+			"filter": CustomFiltersSchema(),
 			"ids": {
 				Type:     schema.TypeList,
 				Computed: true,
@@ -44,7 +47,7 @@ func dataSourceLocalGatewaysRead(ctx context.Context, d *schema.ResourceData, me
 		Tags(tftags.New(ctx, d.Get("tags").(map[string]interface{}))),
 	)...)
 
-	input.Filters = append(input.Filters, BuildFiltersDataSource(
+	input.Filters = append(input.Filters, BuildCustomFilterList(
 		d.Get("filter").(*schema.Set),
 	)...)
 
diff --git a/internal/service/ec2/outposts_local_gateways_data_source_test.go b/internal/service/ec2/outposts_local_gateways_data_source_test.go
index 48abf12fb38..b8461081701 100644
--- a/internal/service/ec2/outposts_local_gateways_data_source_test.go
+++ b/internal/service/ec2/outposts_local_gateways_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/service_package.go b/internal/service/ec2/service_package.go
index 6be5e0e352c..599867c0b31 100644
--- a/internal/service/ec2/service_package.go
+++ b/internal/service/ec2/service_package.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/service_package_gen.go b/internal/service/ec2/service_package_gen.go
index b2032b188db..95167d7f74f 100644
--- a/internal/service/ec2/service_package_gen.go
+++ b/internal/service/ec2/service_package_gen.go
@@ -10,6 +10,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	ec2_sdkv1 "github.com/aws/aws-sdk-go/service/ec2"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -29,6 +30,13 @@ func (p *servicePackage) FrameworkDataSources(ctx context.Context) []*types.Serv
 
 func (p *servicePackage) FrameworkResources(ctx context.Context) []*types.ServicePackageFrameworkResource {
 	return []*types.ServicePackageFrameworkResource{
+		{
+			Factory: newResourceInstanceConnectEndpoint,
+			Name:    "Instance Connect Endpoint",
+			Tags: &types.ServicePackageResourceTags{
+				IdentifierAttribute: "id",
+			},
+		},
 		{
 			Factory: newResourceSecurityGroupEgressRule,
 			Name:    "Security Group Egress Rule",
@@ -228,6 +236,10 @@ func (p *servicePackage) SDKDataSources(ctx context.Context) []*types.ServicePac
 			Factory:  DataSourceTransitGatewayRouteTablePropagations,
 			TypeName: "aws_ec2_transit_gateway_route_table_propagations",
 		},
+		{
+			Factory:  DataSourceTransitGatewayRouteTableRoutes,
+			TypeName: "aws_ec2_transit_gateway_route_table_routes",
+		},
 		{
 			Factory:  DataSourceTransitGatewayRouteTables,
 			TypeName: "aws_ec2_transit_gateway_route_tables",
@@ -327,6 +339,8 @@ func (p *servicePackage) SDKDataSources(ctx context.Context) []*types.ServicePac
 		{
 			Factory:  DataSourceVPC,
 			TypeName: "aws_vpc",
+			Name:     "VPC",
+			Tags:     &types.ServicePackageResourceTags{},
 		},
 		{
 			Factory:  DataSourceVPCDHCPOptions,
@@ -557,6 +571,11 @@ func (p *servicePackage) SDKResources(ctx context.Context) []*types.ServicePacka
 				IdentifierAttribute: "id",
 			},
 		},
+		{
+			Factory:  ResourceImageBlockPublicAccess,
+			TypeName: "aws_ec2_image_block_public_access",
+			Name:     "Image Block Public Access",
+		},
 		{
 			Factory:  ResourceInstanceState,
 			TypeName: "aws_ec2_instance_state",
@@ -929,6 +948,40 @@ func (p *servicePackage) SDKResources(ctx context.Context) []*types.ServicePacka
 				IdentifierAttribute: "id",
 			},
 		},
+		{
+			Factory:  ResourceVerifiedAccessGroup,
+			TypeName: "aws_verifiedaccess_group",
+			Name:     "Verified Access Group",
+			Tags: &types.ServicePackageResourceTags{
+				IdentifierAttribute: "id",
+			},
+		},
+		{
+			Factory:  ResourceVerifiedAccessInstance,
+			TypeName: "aws_verifiedaccess_instance",
+			Name:     "Verified Access Instance",
+			Tags: &types.ServicePackageResourceTags{
+				IdentifierAttribute: "id",
+			},
+		},
+		{
+			Factory:  ResourceVerifiedAccessInstanceLoggingConfiguration,
+			TypeName: "aws_verifiedaccess_instance_logging_configuration",
+			Name:     "Verified Access Instance Logging Configuration",
+		},
+		{
+			Factory:  ResourceVerifiedAccessInstanceTrustProviderAttachment,
+			TypeName: "aws_verifiedaccess_instance_trust_provider_attachment",
+			Name:     "Verified Access Instance Trust Provider Attachment",
+		},
+		{
+			Factory:  ResourceVerifiedAccessTrustProvider,
+			TypeName: "aws_verifiedaccess_trust_provider",
+			Name:     "Verified Access Trust Provider",
+			Tags: &types.ServicePackageResourceTags{
+				IdentifierAttribute: "id",
+			},
+		},
 		{
 			Factory:  ResourceVolumeAttachment,
 			TypeName: "aws_volume_attachment",
@@ -1133,9 +1186,11 @@ func (p *servicePackage) NewClient(ctx context.Context, config map[string]any) (
 
 	return ec2_sdkv2.NewFromConfig(cfg, func(o *ec2_sdkv2.Options) {
 		if endpoint := config["endpoint"].(string); endpoint != "" {
-			o.EndpointResolver = ec2_sdkv2.EndpointResolverFromURL(endpoint)
+			o.BaseEndpoint = aws_sdkv2.String(endpoint)
 		}
 	}), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/ec2/status.go b/internal/service/ec2/status.go
index 388e7f71289..ef75a2588e9 100644
--- a/internal/service/ec2/status.go
+++ b/internal/service/ec2/status.go
@@ -1,9 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
 	"context"
 	"strconv"
 
+	aws_sdkv2 "github.com/aws/aws-sdk-go-v2/aws"
+	ec2_sdkv2 "github.com/aws/aws-sdk-go-v2/service/ec2"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
@@ -350,6 +355,38 @@ func StatusNATGatewayState(ctx context.Context, conn *ec2.EC2, id string) retry.
 	}
 }
 
+func StatusNATGatewayAddressByNATGatewayIDAndAllocationID(ctx context.Context, conn *ec2.EC2, natGatewayID, allocationID string) retry.StateRefreshFunc {
+	return func() (interface{}, string, error) {
+		output, err := FindNATGatewayAddressByNATGatewayIDAndAllocationID(ctx, conn, natGatewayID, allocationID)
+
+		if tfresource.NotFound(err) {
+			return nil, "", nil
+		}
+
+		if err != nil {
+			return nil, "", err
+		}
+
+		return output, aws.StringValue(output.Status), nil
+	}
+}
+
+func StatusNATGatewayAddressByNATGatewayIDAndPrivateIP(ctx context.Context, conn *ec2.EC2, natGatewayID, privateIP string) retry.StateRefreshFunc {
+	return func() (interface{}, string, error) {
+		output, err := FindNATGatewayAddressByNATGatewayIDAndPrivateIP(ctx, conn, natGatewayID, privateIP)
+
+		if tfresource.NotFound(err) {
+			return nil, "", nil
+		}
+
+		if err != nil {
+			return nil, "", err
+		}
+
+		return output, aws.StringValue(output.Status), nil
+	}
+}
+
 const (
 	RouteStatusReady = "ready"
 )
@@ -760,9 +797,9 @@ func StatusTransitGatewayPrefixListReferenceState(ctx context.Context, conn *ec2
 	}
 }
 
-func StatusTransitGatewayRouteState(ctx context.Context, conn *ec2.EC2, transitGatewayRouteTableID, destination string) retry.StateRefreshFunc {
+func StatusTransitGatewayStaticRouteState(ctx context.Context, conn *ec2.EC2, transitGatewayRouteTableID, destination string) retry.StateRefreshFunc {
 	return func() (interface{}, string, error) {
-		output, err := FindTransitGatewayRoute(ctx, conn, transitGatewayRouteTableID, destination)
+		output, err := FindTransitGatewayStaticRoute(ctx, conn, transitGatewayRouteTableID, destination)
 
 		if tfresource.NotFound(err) {
 			return nil, "", nil
@@ -1446,3 +1483,35 @@ func StatusIPAMScopeState(ctx context.Context, conn *ec2.EC2, id string) retry.S
 		return output, aws.StringValue(output.State), nil
 	}
 }
+
+func StatusInstanceConnectEndpointState(ctx context.Context, conn *ec2_sdkv2.Client, id string) retry.StateRefreshFunc {
+	return func() (interface{}, string, error) {
+		output, err := FindInstanceConnectEndpointByID(ctx, conn, id)
+
+		if tfresource.NotFound(err) {
+			return nil, "", nil
+		}
+
+		if err != nil {
+			return nil, "", err
+		}
+
+		return output, string(output.State), nil
+	}
+}
+
+func StatusImageBlockPublicAccessState(ctx context.Context, conn *ec2_sdkv2.Client) retry.StateRefreshFunc {
+	return func() (interface{}, string, error) {
+		output, err := FindImageBlockPublicAccessState(ctx, conn)
+
+		if tfresource.NotFound(err) {
+			return nil, "", nil
+		}
+
+		if err != nil {
+			return nil, "", err
+		}
+
+		return output, aws_sdkv2.ToString(output), nil
+	}
+}
diff --git a/internal/service/ec2/statusv2.go b/internal/service/ec2/statusv2.go
new file mode 100644
index 00000000000..a37abaac216
--- /dev/null
+++ b/internal/service/ec2/statusv2.go
@@ -0,0 +1,62 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package ec2
+
+import (
+	"context"
+	"strconv"
+
+	"github.com/aws/aws-sdk-go-v2/service/ec2"
+	awstypes "github.com/aws/aws-sdk-go-v2/service/ec2/types"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+)
+
+func statusVPCStateV2(ctx context.Context, conn *ec2.Client, id string) retry.StateRefreshFunc {
+	return func() (interface{}, string, error) {
+		output, err := findVPCByIDV2(ctx, conn, id)
+
+		if tfresource.NotFound(err) {
+			return nil, "", nil
+		}
+
+		if err != nil {
+			return nil, "", err
+		}
+
+		return output, string(output.State), nil
+	}
+}
+
+func statusVPCIPv6CIDRBlockAssociationStateV2(ctx context.Context, conn *ec2.Client, id string) retry.StateRefreshFunc {
+	return func() (interface{}, string, error) {
+		output, _, err := findVPCIPv6CIDRBlockAssociationByIDV2(ctx, conn, id)
+
+		if tfresource.NotFound(err) {
+			return nil, "", nil
+		}
+
+		if err != nil {
+			return nil, "", err
+		}
+
+		return output.Ipv6CidrBlockState, string(output.Ipv6CidrBlockState.State), nil
+	}
+}
+
+func statusVPCAttributeValueV2(ctx context.Context, conn *ec2.Client, id string, attribute awstypes.VpcAttributeName) retry.StateRefreshFunc {
+	return func() (interface{}, string, error) {
+		attributeValue, err := findVPCAttributeV2(ctx, conn, id, attribute)
+
+		if tfresource.NotFound(err) {
+			return nil, "", nil
+		}
+
+		if err != nil {
+			return nil, "", err
+		}
+
+		return attributeValue, strconv.FormatBool(attributeValue), nil
+	}
+}
diff --git a/internal/service/ec2/sweep.go b/internal/service/ec2/sweep.go
index 8aef2d7df39..b72fc3b8873 100644
--- a/internal/service/ec2/sweep.go
+++ b/internal/service/ec2/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package ec2
 
@@ -16,9 +16,11 @@ import (
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/framework"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_customer_gateway", &resource.Sweeper{
 		Name: "aws_customer_gateway",
 		F:    sweepCustomerGateways,
@@ -152,6 +154,7 @@ func init() {
 			"aws_db_proxy",
 			"aws_directory_service_directory",
 			"aws_ec2_client_vpn_endpoint",
+			"aws_ec2_traffic_mirror_session",
 			"aws_ec2_transit_gateway_vpc_attachment",
 			"aws_eks_cluster",
 			"aws_elb",
@@ -220,6 +223,7 @@ func init() {
 			"aws_dms_replication_instance",
 			"aws_docdb_subnet_group",
 			"aws_ec2_client_vpn_endpoint",
+			"aws_ec2_instance_connect_endpoint",
 			"aws_ec2_transit_gateway_vpc_attachment",
 			"aws_efs_file_system",
 			"aws_eks_cluster",
@@ -234,6 +238,7 @@ func init() {
 			"aws_fsx_ontap_file_system",
 			"aws_fsx_openzfs_file_system",
 			"aws_fsx_windows_file_system",
+			"aws_grafana_workspace",
 			"aws_iot_topic_rule_destination",
 			"aws_lambda_function",
 			"aws_lb",
@@ -243,6 +248,7 @@ func init() {
 			"aws_network_interface",
 			"aws_networkfirewall_firewall",
 			"aws_opensearch_domain",
+			"aws_quicksight_vpc_connection",
 			"aws_redshift_cluster",
 			"aws_redshift_subnet_group",
 			"aws_route53_resolver_endpoint",
@@ -250,7 +256,27 @@ func init() {
 			"aws_spot_fleet_request",
 			"aws_spot_instance_request",
 			"aws_vpc_endpoint",
-			"aws_grafana_workspace",
+		},
+	})
+
+	resource.AddTestSweepers("aws_ec2_traffic_mirror_filter", &resource.Sweeper{
+		Name: "aws_ec2_traffic_mirror_filter",
+		F:    sweepTrafficMirrorFilters,
+		Dependencies: []string{
+			"aws_ec2_traffic_mirror_session",
+		},
+	})
+
+	resource.AddTestSweepers("aws_ec2_traffic_mirror_session", &resource.Sweeper{
+		Name: "aws_ec2_traffic_mirror_session",
+		F:    sweepTrafficMirrorSessions,
+	})
+
+	resource.AddTestSweepers("aws_ec2_traffic_mirror_target", &resource.Sweeper{
+		Name: "aws_ec2_traffic_mirror_target",
+		F:    sweepTrafficMirrorTargets,
+		Dependencies: []string{
+			"aws_ec2_traffic_mirror_session",
 		},
 	})
 
@@ -337,6 +363,8 @@ func init() {
 			"aws_subnet",
 			"aws_vpc_peering_connection",
 			"aws_vpn_gateway",
+			"aws_vpclattice_service_network",
+			"aws_vpclattice_target_group",
 		},
 		F: sweepVPCs,
 	})
@@ -370,16 +398,20 @@ func init() {
 		F:    sweepAMIs,
 	})
 
-	// aws_vpc_network_performance_metric_subscription
 	resource.AddTestSweepers("aws_vpc_network_performance_metric_subscription", &resource.Sweeper{
 		Name: "aws_vpc_network_performance_metric_subscription",
 		F:    sweepNetworkPerformanceMetricSubscriptions,
 	})
+
+	resource.AddTestSweepers("aws_ec2_instance_connect_endpoint", &resource.Sweeper{
+		Name: "aws_ec2_instance_connect_endpoint",
+		F:    sweepInstanceConnectEndpoints,
+	})
 }
 
 func sweepCapacityReservations(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -387,7 +419,7 @@ func sweepCapacityReservations(region string) error {
 
 	resp, err := conn.DescribeCapacityReservationsWithContext(ctx, &ec2.DescribeCapacityReservationsInput{})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping EC2 Capacity Reservation sweep for %s: %s", region, err)
 		return nil
 	}
@@ -424,7 +456,7 @@ func sweepCapacityReservations(region string) error {
 
 func sweepCarrierGateways(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -448,7 +480,7 @@ func sweepCarrierGateways(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping EC2 Carrier Gateway sweep for %s: %s", region, err)
 		return nil
 	}
@@ -457,7 +489,7 @@ func sweepCarrierGateways(region string) error {
 		return fmt.Errorf("error listing EC2 Carrier Gateways (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping EC2 Carrier Gateways (%s): %w", region, err)
@@ -468,7 +500,7 @@ func sweepCarrierGateways(region string) error {
 
 func sweepClientVPNEndpoints(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
@@ -492,7 +524,7 @@ func sweepClientVPNEndpoints(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping EC2 Client VPN Endpoint sweep for %s: %s", region, err)
 		return nil
 	}
@@ -501,7 +533,7 @@ func sweepClientVPNEndpoints(region string) error {
 		return fmt.Errorf("error listing EC2 Client VPN Endpoints (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping EC2 Client VPN Endpoints (%s): %w", region, err)
@@ -512,7 +544,7 @@ func sweepClientVPNEndpoints(region string) error {
 
 func sweepClientVPNNetworkAssociations(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
@@ -548,7 +580,7 @@ func sweepClientVPNNetworkAssociations(region string) error {
 				return !lastPage
 			})
 
-			if sweep.SkipSweepError(err) {
+			if awsv1.SkipSweepError(err) {
 				continue
 			}
 
@@ -560,7 +592,7 @@ func sweepClientVPNNetworkAssociations(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping EC2 Client VPN Network Association sweep for %s: %s", region, err)
 		return sweeperErrs.ErrorOrNil() // In case we have completed some pages, but had errors
 	}
@@ -569,7 +601,7 @@ func sweepClientVPNNetworkAssociations(region string) error {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error listing EC2 Client VPN Endpoints (%s): %w", region, err))
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error sweeping EC2 Client VPN Network Associations (%s): %w", region, err))
@@ -580,7 +612,7 @@ func sweepClientVPNNetworkAssociations(region string) error {
 
 func sweepFleets(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -610,7 +642,7 @@ func sweepFleets(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping EC2 Fleet sweep for %s: %s", region, err)
 		return sweeperErrs.ErrorOrNil()
 	}
@@ -618,7 +650,7 @@ func sweepFleets(region string) error {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("retrieving EC2 Fleets: %w", err))
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error sweeping EC2 Fleets for %s: %w", region, err))
 	}
 
@@ -627,7 +659,7 @@ func sweepFleets(region string) error {
 
 func sweepEBSVolumes(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -658,7 +690,7 @@ func sweepEBSVolumes(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping EC2 EBS Volume sweep for %s: %s", region, err)
 		return nil
 	}
@@ -667,7 +699,7 @@ func sweepEBSVolumes(region string) error {
 		return fmt.Errorf("error listing EC2 EBS Volumes (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping EC2 EBS Volumes (%s): %w", region, err)
@@ -678,7 +710,7 @@ func sweepEBSVolumes(region string) error {
 
 func sweepEBSSnapshots(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -704,7 +736,7 @@ func sweepEBSSnapshots(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping EBS Snapshot sweep for %s: %s", region, err)
 		return nil
 	}
@@ -713,7 +745,7 @@ func sweepEBSSnapshots(region string) error {
 		return fmt.Errorf("error listing EBS Snapshots (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping EBS Snapshots (%s): %w", region, err)
@@ -724,7 +756,7 @@ func sweepEBSSnapshots(region string) error {
 
 func sweepEgressOnlyInternetGateways(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -748,7 +780,7 @@ func sweepEgressOnlyInternetGateways(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping EC2 Egress-only Internet Gateway sweep for %s: %s", region, err)
 		return nil
 	}
@@ -757,7 +789,7 @@ func sweepEgressOnlyInternetGateways(region string) error {
 		return fmt.Errorf("error listing EC2 Egress-only Internet Gateways (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping EC2 Egress-only Internet Gateways (%s): %w", region, err)
@@ -768,7 +800,7 @@ func sweepEgressOnlyInternetGateways(region string) error {
 
 func sweepEIPs(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
@@ -781,7 +813,7 @@ func sweepEIPs(region string) error {
 
 	output, err := conn.DescribeAddressesWithContext(ctx, input)
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping EC2 EIP sweep for %s: %s", region, err)
 		return nil
 	}
@@ -817,11 +849,11 @@ func sweepEIPs(region string) error {
 		sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
 	}
 
-	if err = sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err = sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("error sweeping EC2 EIPs for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
+	if awsv1.SkipSweepError(errs.ErrorOrNil()) {
 		log.Printf("[WARN] Skipping EC2 EIP sweep for %s: %s", region, errs)
 		return nil
 	}
@@ -831,7 +863,7 @@ func sweepEIPs(region string) error {
 
 func sweepFlowLogs(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -855,7 +887,7 @@ func sweepFlowLogs(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Flow Log sweep for %s: %s", region, err)
 		return nil
 	}
@@ -864,7 +896,7 @@ func sweepFlowLogs(region string) error {
 		return fmt.Errorf("error listing Flow Logs (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping Flow Logs (%s): %w", region, err)
@@ -875,7 +907,7 @@ func sweepFlowLogs(region string) error {
 
 func sweepHosts(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -899,7 +931,7 @@ func sweepHosts(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping EC2 Host sweep for %s: %s", region, err)
 		return nil
 	}
@@ -908,7 +940,7 @@ func sweepHosts(region string) error {
 		return fmt.Errorf("error listing EC2 Hosts (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping EC2 Hosts (%s): %w", region, err)
@@ -919,63 +951,68 @@ func sweepHosts(region string) error {
 
 func sweepInstances(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
-
 	conn := client.EC2Conn(ctx)
+	input := &ec2.DescribeInstancesInput{}
 	sweepResources := make([]sweep.Sweepable, 0)
-	var errs *multierror.Error
 
-	err = conn.DescribeInstancesPagesWithContext(ctx, &ec2.DescribeInstancesInput{}, func(page *ec2.DescribeInstancesOutput, lastPage bool) bool {
+	err = conn.DescribeInstancesPagesWithContext(ctx, input, func(page *ec2.DescribeInstancesOutput, lastPage bool) bool {
 		if page == nil {
 			return !lastPage
 		}
 
-		for _, reservation := range page.Reservations {
-			if reservation == nil {
+		for _, v := range page.Reservations {
+			if v == nil {
 				continue
 			}
 
-			for _, instance := range reservation.Instances {
-				id := aws.StringValue(instance.InstanceId)
+			for _, v := range v.Instances {
+				id := aws.StringValue(v.InstanceId)
 
-				if instance.State != nil && aws.StringValue(instance.State.Name) == ec2.InstanceStateNameTerminated {
+				if v.State != nil && aws.StringValue(v.State.Name) == ec2.InstanceStateNameTerminated {
 					log.Printf("[INFO] Skipping terminated EC2 Instance: %s", id)
 					continue
 				}
 
+				if err := disableInstanceAPIStop(ctx, conn, id, false); err != nil {
+					log.Printf("[INFO] EC2 Instance (%s): %s", id, err)
+				}
+
 				r := ResourceInstance()
 				d := r.Data(nil)
 				d.SetId(id)
-				d.Set("disable_api_stop", false)
 
 				sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
 			}
 		}
+
 		return !lastPage
 	})
 
-	if err != nil {
-		errs = multierror.Append(errs, fmt.Errorf("error describing EC2 Instances for %s: %w", region, err))
+	if awsv1.SkipSweepError(err) {
+		log.Printf("[WARN] Skipping EC2 Instance sweep for %s: %s", region, err)
+		return nil
 	}
 
-	if err = sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
-		errs = multierror.Append(errs, fmt.Errorf("error sweeping EC2 Instances for %s: %w", region, err))
+	if err != nil {
+		return fmt.Errorf("error listing EC2 Instances (%s): %w", region, err)
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
-		log.Printf("[WARN] Skipping EC2 Instance sweep for %s: %s", region, errs)
-		return nil
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
+
+	if err != nil {
+		return fmt.Errorf("error sweeping EC2 Instances (%s): %w", region, err)
 	}
 
-	return errs.ErrorOrNil()
+	return nil
 }
 
 func sweepInternetGateways(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -1038,7 +1075,7 @@ func sweepInternetGateways(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping EC2 Internet Gateway sweep for %s: %s", region, err)
 		return nil
 	}
@@ -1047,7 +1084,7 @@ func sweepInternetGateways(region string) error {
 		return fmt.Errorf("error listing EC2 Internet Gateways (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping EC2 Internet Gateways (%s): %w", region, err)
@@ -1058,7 +1095,7 @@ func sweepInternetGateways(region string) error {
 
 func sweepKeyPairs(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -1068,7 +1105,7 @@ func sweepKeyPairs(region string) error {
 
 	output, err := conn.DescribeKeyPairsWithContext(ctx, input)
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping EC2 Key Pair sweep for %s: %s", region, err)
 		return nil
 	}
@@ -1085,7 +1122,7 @@ func sweepKeyPairs(region string) error {
 		sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping EC2 Key Pairs (%s): %w", region, err)
@@ -1096,7 +1133,7 @@ func sweepKeyPairs(region string) error {
 
 func sweepLaunchTemplates(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -1120,7 +1157,7 @@ func sweepLaunchTemplates(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping EC2 Launch Template sweep for %s: %s", region, err)
 		return nil
 	}
@@ -1129,7 +1166,7 @@ func sweepLaunchTemplates(region string) error {
 		return fmt.Errorf("error listing EC2 Launch Templates (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping EC2 Launch Templates (%s): %w", region, err)
@@ -1140,7 +1177,7 @@ func sweepLaunchTemplates(region string) error {
 
 func sweepNATGateways(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -1164,7 +1201,7 @@ func sweepNATGateways(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping EC2 NAT Gateway sweep for %s: %s", region, err)
 		return nil
 	}
@@ -1173,7 +1210,7 @@ func sweepNATGateways(region string) error {
 		return fmt.Errorf("error listing EC2 NAT Gateways (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping EC2 NAT Gateways (%s): %w", region, err)
@@ -1184,7 +1221,7 @@ func sweepNATGateways(region string) error {
 
 func sweepNetworkACLs(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -1220,7 +1257,7 @@ func sweepNetworkACLs(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping EC2 Network ACL sweep for %s: %s", region, err)
 		return nil
 	}
@@ -1229,7 +1266,7 @@ func sweepNetworkACLs(region string) error {
 		return fmt.Errorf("error listing EC2 Network ACLs (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping EC2 Network ACLs (%s): %w", region, err)
@@ -1240,7 +1277,7 @@ func sweepNetworkACLs(region string) error {
 
 func sweepNetworkInterfaces(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -1271,7 +1308,7 @@ func sweepNetworkInterfaces(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping EC2 Network Interface sweep for %s: %s", region, err)
 		return nil
 	}
@@ -1280,7 +1317,7 @@ func sweepNetworkInterfaces(region string) error {
 		return fmt.Errorf("error listing EC2 Network Interfaces (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping EC2 Network Interfaces (%s): %w", region, err)
@@ -1291,7 +1328,7 @@ func sweepNetworkInterfaces(region string) error {
 
 func sweepNetworkInsightsPaths(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -1319,10 +1356,10 @@ func sweepNetworkInsightsPaths(region string) error {
 	if err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("error listing Network Insights Paths for %s: %w", region, err))
 	}
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("error sweeping Network Insights Paths for %s: %w", region, err))
 	}
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Network Insights Path sweep for %s: %s", region, errs)
 		return nil
 	}
@@ -1331,7 +1368,7 @@ func sweepNetworkInsightsPaths(region string) error {
 
 func sweepPlacementGroups(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -1341,7 +1378,7 @@ func sweepPlacementGroups(region string) error {
 
 	output, err := conn.DescribePlacementGroupsWithContext(ctx, input)
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping EC2 Placement Group sweep for %s: %s", region, err)
 		return nil
 	}
@@ -1358,7 +1395,7 @@ func sweepPlacementGroups(region string) error {
 		sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping EC2 Placement Groups (%s): %w", region, err)
@@ -1369,7 +1406,7 @@ func sweepPlacementGroups(region string) error {
 
 func sweepRouteTables(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
@@ -1475,7 +1512,7 @@ func sweepRouteTables(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping EC2 Route Table sweep for %s: %s", region, err)
 		return sweeperErrs.ErrorOrNil()
 	}
@@ -1489,7 +1526,7 @@ func sweepRouteTables(region string) error {
 
 func sweepSecurityGroups(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
@@ -1531,7 +1568,7 @@ func sweepSecurityGroups(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping EC2 Security Group sweep for %s: %s", region, err)
 		return nil
 	}
@@ -1581,7 +1618,7 @@ func sweepSecurityGroups(region string) error {
 
 func sweepSpotFleetRequests(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
@@ -1619,11 +1656,11 @@ func sweepSpotFleetRequests(region string) error {
 		errs = multierror.Append(errs, fmt.Errorf("error describing EC2 Spot Fleet Requests for %s: %w", region, err))
 	}
 
-	if err = sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err = sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("error sweeping EC2 Spot Fleet Requests for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
+	if awsv1.SkipSweepError(errs.ErrorOrNil()) {
 		log.Printf("[WARN] Skipping EC2 Spot Fleet Requests sweep for %s: %s", region, errs)
 		return nil
 	}
@@ -1633,7 +1670,7 @@ func sweepSpotFleetRequests(region string) error {
 
 func sweepSpotInstanceRequests(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
@@ -1671,11 +1708,11 @@ func sweepSpotInstanceRequests(region string) error {
 		errs = multierror.Append(errs, fmt.Errorf("error describing EC2 Spot Instance Requests for %s: %w", region, err))
 	}
 
-	if err = sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err = sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("error sweeping EC2 Spot Instance Requests for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
+	if awsv1.SkipSweepError(errs.ErrorOrNil()) {
 		log.Printf("[WARN] Skipping EC2 Spot Instance Requests sweep for %s: %s", region, errs)
 		return nil
 	}
@@ -1685,7 +1722,7 @@ func sweepSpotInstanceRequests(region string) error {
 
 func sweepSubnets(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
@@ -1714,7 +1751,7 @@ func sweepSubnets(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping EC2 Subnet sweep for %s: %s", region, err)
 		return nil
 	}
@@ -1723,7 +1760,7 @@ func sweepSubnets(region string) error {
 		return fmt.Errorf("error listing EC2 Subnets (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping EC2 Subnets (%s): %w", region, err)
@@ -1732,9 +1769,141 @@ func sweepSubnets(region string) error {
 	return nil
 }
 
+func sweepTrafficMirrorFilters(region string) error {
+	ctx := sweep.Context(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
+	if err != nil {
+		return fmt.Errorf("error getting client: %s", err)
+	}
+	conn := client.EC2Conn(ctx)
+	input := &ec2.DescribeTrafficMirrorFiltersInput{}
+	sweepResources := make([]sweep.Sweepable, 0)
+
+	err = conn.DescribeTrafficMirrorFiltersPagesWithContext(ctx, input, func(page *ec2.DescribeTrafficMirrorFiltersOutput, lastPage bool) bool {
+		if page == nil {
+			return !lastPage
+		}
+
+		for _, v := range page.TrafficMirrorFilters {
+			r := ResourceTrafficMirrorFilter()
+			d := r.Data(nil)
+			d.SetId(aws.StringValue(v.TrafficMirrorFilterId))
+
+			sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
+		}
+
+		return !lastPage
+	})
+
+	if awsv1.SkipSweepError(err) {
+		log.Printf("[WARN] Skipping EC2 Traffic Mirror Filter sweep for %s: %s", region, err)
+		return nil
+	}
+
+	if err != nil {
+		return fmt.Errorf("error listing EC2 Traffic Mirror Filters (%s): %w", region, err)
+	}
+
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
+
+	if err != nil {
+		return fmt.Errorf("error sweeping EC2 Traffic Mirror Filters (%s): %w", region, err)
+	}
+
+	return nil
+}
+
+func sweepTrafficMirrorSessions(region string) error {
+	ctx := sweep.Context(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
+	if err != nil {
+		return fmt.Errorf("error getting client: %s", err)
+	}
+	conn := client.EC2Conn(ctx)
+	input := &ec2.DescribeTrafficMirrorSessionsInput{}
+	sweepResources := make([]sweep.Sweepable, 0)
+
+	err = conn.DescribeTrafficMirrorSessionsPagesWithContext(ctx, input, func(page *ec2.DescribeTrafficMirrorSessionsOutput, lastPage bool) bool {
+		if page == nil {
+			return !lastPage
+		}
+
+		for _, v := range page.TrafficMirrorSessions {
+			r := ResourceTrafficMirrorSession()
+			d := r.Data(nil)
+			d.SetId(aws.StringValue(v.TrafficMirrorSessionId))
+
+			sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
+		}
+
+		return !lastPage
+	})
+
+	if awsv1.SkipSweepError(err) {
+		log.Printf("[WARN] Skipping EC2 Traffic Mirror Session sweep for %s: %s", region, err)
+		return nil
+	}
+
+	if err != nil {
+		return fmt.Errorf("error listing EC2 Traffic Mirror Sessions (%s): %w", region, err)
+	}
+
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
+
+	if err != nil {
+		return fmt.Errorf("error sweeping EC2 Traffic Mirror Sessions (%s): %w", region, err)
+	}
+
+	return nil
+}
+
+func sweepTrafficMirrorTargets(region string) error {
+	ctx := sweep.Context(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
+	if err != nil {
+		return fmt.Errorf("error getting client: %s", err)
+	}
+	conn := client.EC2Conn(ctx)
+	input := &ec2.DescribeTrafficMirrorTargetsInput{}
+	sweepResources := make([]sweep.Sweepable, 0)
+
+	err = conn.DescribeTrafficMirrorTargetsPagesWithContext(ctx, input, func(page *ec2.DescribeTrafficMirrorTargetsOutput, lastPage bool) bool {
+		if page == nil {
+			return !lastPage
+		}
+
+		for _, v := range page.TrafficMirrorTargets {
+			r := ResourceTrafficMirrorTarget()
+			d := r.Data(nil)
+			d.SetId(aws.StringValue(v.TrafficMirrorTargetId))
+
+			sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
+		}
+
+		return !lastPage
+	})
+
+	if awsv1.SkipSweepError(err) {
+		log.Printf("[WARN] Skipping EC2 Traffic Mirror Target sweep for %s: %s", region, err)
+		return nil
+	}
+
+	if err != nil {
+		return fmt.Errorf("error listing EC2 Traffic Mirror Targets (%s): %w", region, err)
+	}
+
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
+
+	if err != nil {
+		return fmt.Errorf("error sweeping EC2 Traffic Mirror Targets (%s): %w", region, err)
+	}
+
+	return nil
+}
+
 func sweepTransitGateways(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -1762,7 +1931,7 @@ func sweepTransitGateways(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping EC2 Transit Gateway sweep for %s: %s", region, err)
 		return nil
 	}
@@ -1771,7 +1940,7 @@ func sweepTransitGateways(region string) error {
 		return fmt.Errorf("error listing EC2 Transit Gateways (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping EC2 Transit Gateways (%s): %w", region, err)
@@ -1782,7 +1951,7 @@ func sweepTransitGateways(region string) error {
 
 func sweepTransitGatewayConnectPeers(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -1810,7 +1979,7 @@ func sweepTransitGatewayConnectPeers(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping EC2 Transit Gateway Connect Peer sweep for %s: %s", region, err)
 		return nil
 	}
@@ -1819,7 +1988,7 @@ func sweepTransitGatewayConnectPeers(region string) error {
 		return fmt.Errorf("error listing EC2 Transit Gateway Connect Peers (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping EC2 Transit Gateway Connect Peers (%s): %w", region, err)
@@ -1830,7 +1999,7 @@ func sweepTransitGatewayConnectPeers(region string) error {
 
 func sweepTransitGatewayConnects(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -1858,7 +2027,7 @@ func sweepTransitGatewayConnects(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping EC2 Transit Gateway Connect sweep for %s: %s", region, err)
 		return nil
 	}
@@ -1867,7 +2036,7 @@ func sweepTransitGatewayConnects(region string) error {
 		return fmt.Errorf("error listing EC2 Transit Gateway Connects (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping EC2 Transit Gateway Connects (%s): %w", region, err)
@@ -1878,7 +2047,7 @@ func sweepTransitGatewayConnects(region string) error {
 
 func sweepTransitGatewayMulticastDomains(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
@@ -1906,7 +2075,7 @@ func sweepTransitGatewayMulticastDomains(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping EC2 Transit Gateway Multicast Domain sweep for %s: %s", region, err)
 		return nil
 	}
@@ -1915,7 +2084,7 @@ func sweepTransitGatewayMulticastDomains(region string) error {
 		return fmt.Errorf("error listing EC2 Transit Gateway Multicast Domains (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping EC2 Transit Gateway Multicast Domains (%s): %w", region, err)
@@ -1926,7 +2095,7 @@ func sweepTransitGatewayMulticastDomains(region string) error {
 
 func sweepTransitGatewayPeeringAttachments(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -1954,7 +2123,7 @@ func sweepTransitGatewayPeeringAttachments(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping EC2 Transit Gateway Peering Attachment sweep for %s: %s", region, err)
 		return nil
 	}
@@ -1963,7 +2132,7 @@ func sweepTransitGatewayPeeringAttachments(region string) error {
 		return fmt.Errorf("error listing EC2 Transit Gateway Peering Attachments (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping EC2 Transit Gateway Peering Attachments (%s): %w", region, err)
@@ -1974,7 +2143,7 @@ func sweepTransitGatewayPeeringAttachments(region string) error {
 
 func sweepTransitGatewayVPCAttachments(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -2002,7 +2171,7 @@ func sweepTransitGatewayVPCAttachments(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping EC2 Transit Gateway VPC Attachment sweep for %s: %s", region, err)
 		return nil
 	}
@@ -2011,7 +2180,7 @@ func sweepTransitGatewayVPCAttachments(region string) error {
 		return fmt.Errorf("error listing EC2 Transit Gateway VPC Attachments (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping EC2 Transit Gateway VPC Attachments (%s): %w", region, err)
@@ -2022,7 +2191,7 @@ func sweepTransitGatewayVPCAttachments(region string) error {
 
 func sweepVPCDHCPOptions(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -2073,7 +2242,7 @@ func sweepVPCDHCPOptions(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping EC2 DHCP Options Set sweep for %s: %s", region, err)
 		return nil
 	}
@@ -2082,7 +2251,7 @@ func sweepVPCDHCPOptions(region string) error {
 		return fmt.Errorf("error listing EC2 DHCP Options Sets (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping EC2 DHCP Options Sets (%s): %w", region, err)
@@ -2093,7 +2262,7 @@ func sweepVPCDHCPOptions(region string) error {
 
 func sweepVPCEndpointServices(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
@@ -2121,7 +2290,7 @@ func sweepVPCEndpointServices(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping EC2 VPC Endpoint Service sweep for %s: %s", region, err)
 		return nil
 	}
@@ -2130,7 +2299,7 @@ func sweepVPCEndpointServices(region string) error {
 		return fmt.Errorf("error listing EC2 VPC Endpoint Services (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping EC2 VPC Endpoint Services (%s): %w", region, err)
@@ -2141,7 +2310,7 @@ func sweepVPCEndpointServices(region string) error {
 
 func sweepVPCEndpoints(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
@@ -2169,7 +2338,7 @@ func sweepVPCEndpoints(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping EC2 VPC Endpoint sweep for %s: %s", region, err)
 		return nil
 	}
@@ -2178,7 +2347,7 @@ func sweepVPCEndpoints(region string) error {
 		return fmt.Errorf("error listing EC2 VPC Endpoints (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping EC2 VPC Endpoints (%s): %w", region, err)
@@ -2189,7 +2358,7 @@ func sweepVPCEndpoints(region string) error {
 
 func sweepVPCPeeringConnections(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -2213,7 +2382,7 @@ func sweepVPCPeeringConnections(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping EC2 VPC Peering Connection sweep for %s: %s", region, err)
 		return nil
 	}
@@ -2222,7 +2391,7 @@ func sweepVPCPeeringConnections(region string) error {
 		return fmt.Errorf("error listing EC2 VPC Peering Connections (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping EC2 VPC Peering Connections (%s): %w", region, err)
@@ -2233,7 +2402,7 @@ func sweepVPCPeeringConnections(region string) error {
 
 func sweepVPCs(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -2262,7 +2431,7 @@ func sweepVPCs(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping EC2 VPC sweep for %s: %s", region, err)
 		return nil
 	}
@@ -2271,7 +2440,7 @@ func sweepVPCs(region string) error {
 		return fmt.Errorf("error listing EC2 VPCs (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping EC2 VPCs (%s): %w", region, err)
@@ -2282,7 +2451,7 @@ func sweepVPCs(region string) error {
 
 func sweepVPNConnections(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -2292,7 +2461,7 @@ func sweepVPNConnections(region string) error {
 
 	output, err := conn.DescribeVpnConnectionsWithContext(ctx, input)
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping EC2 VPN Connection sweep for %s: %s", region, err)
 		return nil
 	}
@@ -2313,7 +2482,7 @@ func sweepVPNConnections(region string) error {
 		sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping EC2 VPN Connections (%s): %w", region, err)
@@ -2324,7 +2493,7 @@ func sweepVPNConnections(region string) error {
 
 func sweepVPNGateways(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -2334,7 +2503,7 @@ func sweepVPNGateways(region string) error {
 
 	output, err := conn.DescribeVpnGatewaysWithContext(ctx, input)
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping EC2 VPN Gateway sweep for %s: %s", region, err)
 		return nil
 	}
@@ -2363,7 +2532,7 @@ func sweepVPNGateways(region string) error {
 		sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping EC2 VPN Gateways (%s): %w", region, err)
@@ -2374,7 +2543,7 @@ func sweepVPNGateways(region string) error {
 
 func sweepCustomerGateways(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -2384,7 +2553,7 @@ func sweepCustomerGateways(region string) error {
 
 	output, err := conn.DescribeCustomerGatewaysWithContext(ctx, input)
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping EC2 Customer Gateway sweep for %s: %s", region, err)
 		return nil
 	}
@@ -2405,7 +2574,7 @@ func sweepCustomerGateways(region string) error {
 		sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping EC2 Customer Gateways (%s): %w", region, err)
@@ -2416,7 +2585,7 @@ func sweepCustomerGateways(region string) error {
 
 func sweepIPAMs(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -2441,7 +2610,7 @@ func sweepIPAMs(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping IPAM sweep for %s: %s", region, err)
 		return nil
 	}
@@ -2450,7 +2619,7 @@ func sweepIPAMs(region string) error {
 		return fmt.Errorf("error listing IPAMs (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping IPAMs (%s): %w", region, err)
@@ -2461,7 +2630,7 @@ func sweepIPAMs(region string) error {
 
 func sweepIPAMResourceDiscoveries(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -2488,7 +2657,7 @@ func sweepIPAMResourceDiscoveries(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping IPAM Resource Discovery sweep for %s: %s", region, err)
 		return nil
 	}
@@ -2497,7 +2666,7 @@ func sweepIPAMResourceDiscoveries(region string) error {
 		return fmt.Errorf("error listing IPAM Resource Discoveries (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping Resource Discoveries (%s): %w", region, err)
@@ -2508,7 +2677,7 @@ func sweepIPAMResourceDiscoveries(region string) error {
 
 func sweepAMIs(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -2534,7 +2703,7 @@ func sweepAMIs(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping AMI sweep for %s: %s", region, err)
 		return nil
 	}
@@ -2543,7 +2712,7 @@ func sweepAMIs(region string) error {
 		return fmt.Errorf("error listing AMIs (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping AMIs (%s): %w", region, err)
@@ -2554,7 +2723,7 @@ func sweepAMIs(region string) error {
 
 func sweepNetworkPerformanceMetricSubscriptions(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -2579,7 +2748,7 @@ func sweepNetworkPerformanceMetricSubscriptions(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping EC2 AWS Network Performance Metric Subscription sweep for %s: %s", region, err)
 		return nil
 	}
@@ -2588,7 +2757,7 @@ func sweepNetworkPerformanceMetricSubscriptions(region string) error {
 		return fmt.Errorf("error listing EC2 AWS Network Performance Metric Subscriptions (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping EC2 AWS Network Performance Metric Subscriptions (%s): %w", region, err)
@@ -2596,3 +2765,49 @@ func sweepNetworkPerformanceMetricSubscriptions(region string) error {
 
 	return nil
 }
+
+func sweepInstanceConnectEndpoints(region string) error {
+	ctx := sweep.Context(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
+	if err != nil {
+		return fmt.Errorf("error getting client: %w", err)
+	}
+	conn := client.EC2Conn(ctx)
+	input := &ec2.DescribeInstanceConnectEndpointsInput{}
+	sweepResources := make([]sweep.Sweepable, 0)
+
+	err = conn.DescribeInstanceConnectEndpointsPagesWithContext(ctx, input, func(page *ec2.DescribeInstanceConnectEndpointsOutput, lastPage bool) bool {
+		if page == nil {
+			return !lastPage
+		}
+
+		for _, v := range page.InstanceConnectEndpoints {
+			if aws.StringValue(v.State) == ec2.Ec2InstanceConnectEndpointStateDeleteComplete {
+				continue
+			}
+
+			sweepResources = append(sweepResources, framework.NewSweepResource(newResourceInstanceConnectEndpoint, client,
+				framework.NewAttribute("id", aws.StringValue(v.InstanceConnectEndpointId)),
+			))
+		}
+
+		return !lastPage
+	})
+
+	if awsv1.SkipSweepError(err) {
+		log.Printf("[WARN] Skipping EC2 Instance Connect Endpoint sweep for %s: %s", region, err)
+		return nil
+	}
+
+	if err != nil {
+		return fmt.Errorf("error listing EC2 Instance Connect Endpoints (%s): %w", region, err)
+	}
+
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
+
+	if err != nil {
+		return fmt.Errorf("error sweeping EC2 Instance Connect Endpoints (%s): %w", region, err)
+	}
+
+	return nil
+}
diff --git a/internal/service/ec2/tag_test.go b/internal/service/ec2/tag_test.go
index 16113b129e0..6cb2f63addc 100644
--- a/internal/service/ec2/tag_test.go
+++ b/internal/service/ec2/tag_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/tags.go b/internal/service/ec2/tags.go
index 043dc00153b..45b31c484a4 100644
--- a/internal/service/ec2/tags.go
+++ b/internal/service/ec2/tags.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -5,6 +8,7 @@ import (
 	"fmt"
 	"time"
 
+	awstypes "github.com/aws/aws-sdk-go-v2/service/ec2/types"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/aws/aws-sdk-go/service/ec2/ec2iface"
@@ -57,7 +61,7 @@ func tagSpecificationsFromMap(ctx context.Context, m map[string]interface{}, t s
 	}
 }
 
-// getTagSpecificationsIn returns EC2 service tags from Context.
+// getTagSpecificationsIn returns AWS SDK for Go v1 EC2 service tags from Context.
 // nil is returned if there are no input tags.
 func getTagSpecificationsIn(ctx context.Context, resourceType string) []*ec2.TagSpecification {
 	tags := getTagsIn(ctx)
@@ -74,6 +78,23 @@ func getTagSpecificationsIn(ctx context.Context, resourceType string) []*ec2.Tag
 	}
 }
 
+// getTagSpecificationsInV2 returns AWS SDK for Go v2 EC2 service tags from Context.
+// nil is returned if there are no input tags.
+func getTagSpecificationsInV2(ctx context.Context, resourceType awstypes.ResourceType) []awstypes.TagSpecification {
+	tags := getTagsInV2(ctx)
+
+	if len(tags) == 0 {
+		return nil
+	}
+
+	return []awstypes.TagSpecification{
+		{
+			ResourceType: resourceType,
+			Tags:         tags,
+		},
+	}
+}
+
 // tagsFromTagDescriptions returns the tags from the given tag descriptions.
 // No attempt is made to remove duplicates.
 func tagsFromTagDescriptions(tds []*ec2.TagDescription) []*ec2.Tag {
diff --git a/internal/service/ec2/tags_gen.go b/internal/service/ec2/tags_gen.go
index 1c90e226ea5..089c3d15384 100644
--- a/internal/service/ec2/tags_gen.go
+++ b/internal/service/ec2/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/aws/aws-sdk-go/service/ec2/ec2iface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
@@ -159,6 +161,8 @@ func updateTags(ctx context.Context, conn ec2iface.EC2API, identifier string, ol
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.EC2)
 	if len(removedTags) > 0 {
diff --git a/internal/service/ec2/tagsv2_gen.go b/internal/service/ec2/tagsv2_gen.go
new file mode 100644
index 00000000000..d98fef14552
--- /dev/null
+++ b/internal/service/ec2/tagsv2_gen.go
@@ -0,0 +1,106 @@
+// Code generated by internal/generate/tags/main.go; DO NOT EDIT.
+package ec2
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/ec2"
+	awstypes "github.com/aws/aws-sdk-go-v2/service/ec2/types"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
+	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
+	"github.com/hashicorp/terraform-provider-aws/internal/types"
+	"github.com/hashicorp/terraform-provider-aws/names"
+)
+
+// []*SERVICE.Tag handling
+
+// TagsV2 returns ec2 service tags.
+func TagsV2(tags tftags.KeyValueTags) []awstypes.Tag {
+	result := make([]awstypes.Tag, 0, len(tags))
+
+	for k, v := range tags.Map() {
+		tag := awstypes.Tag{
+			Key:   aws.String(k),
+			Value: aws.String(v),
+		}
+
+		result = append(result, tag)
+	}
+
+	return result
+}
+
+// keyValueTagsV2 creates tftags.KeyValueTags from ec2 service tags.
+func keyValueTagsV2(ctx context.Context, tags []awstypes.Tag) tftags.KeyValueTags {
+	m := make(map[string]*string, len(tags))
+
+	for _, tag := range tags {
+		m[aws.ToString(tag.Key)] = tag.Value
+	}
+
+	return tftags.New(ctx, m)
+}
+
+// getTagsInV2 returns ec2 service tags from Context.
+// nil is returned if there are no input tags.
+func getTagsInV2(ctx context.Context) []awstypes.Tag {
+	if inContext, ok := tftags.FromContext(ctx); ok {
+		if tags := TagsV2(inContext.TagsIn.UnwrapOrDefault()); len(tags) > 0 {
+			return tags
+		}
+	}
+
+	return nil
+}
+
+// setTagsOutV2 sets ec2 service tags in Context.
+func setTagsOutV2(ctx context.Context, tags []awstypes.Tag) {
+	if inContext, ok := tftags.FromContext(ctx); ok {
+		inContext.TagsOut = types.Some(keyValueTagsV2(ctx, tags))
+	}
+}
+
+// updateTagsV2 updates ec2 service tags.
+// The identifier is typically the Amazon Resource Name (ARN), although
+// it may also be a different identifier depending on the service.
+func updateTagsV2(ctx context.Context, conn *ec2.Client, identifier string, oldTagsMap, newTagsMap any) error {
+	oldTags := tftags.New(ctx, oldTagsMap)
+	newTags := tftags.New(ctx, newTagsMap)
+
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
+	removedTags := oldTags.Removed(newTags)
+	removedTags = removedTags.IgnoreSystem(names.EC2)
+	if len(removedTags) > 0 {
+		input := &ec2.DeleteTagsInput{
+			Resources: []string{identifier},
+			Tags:      TagsV2(removedTags),
+		}
+
+		_, err := conn.DeleteTags(ctx, input)
+
+		if err != nil {
+			return fmt.Errorf("untagging resource (%s): %w", identifier, err)
+		}
+	}
+
+	updatedTags := oldTags.Updated(newTags)
+	updatedTags = updatedTags.IgnoreSystem(names.EC2)
+	if len(updatedTags) > 0 {
+		input := &ec2.CreateTagsInput{
+			Resources: []string{identifier},
+			Tags:      TagsV2(updatedTags),
+		}
+
+		_, err := conn.CreateTags(ctx, input)
+
+		if err != nil {
+			return fmt.Errorf("tagging resource (%s): %w", identifier, err)
+		}
+	}
+
+	return nil
+}
diff --git a/internal/service/ec2/test-fixtures/userdata-test.sh b/internal/service/ec2/test-fixtures/userdata-test.sh
index 8a058c78617..670a272dbeb 100644
--- a/internal/service/ec2/test-fixtures/userdata-test.sh
+++ b/internal/service/ec2/test-fixtures/userdata-test.sh
@@ -1,4 +1,7 @@
 #!/bin/bash -v
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 apt-get update -y
 apt-get install -y nginx > /tmp/nginx.log
 
diff --git a/internal/service/ec2/transitgateway_.go b/internal/service/ec2/transitgateway_.go
index 86196dc6395..3a0d966a24b 100644
--- a/internal/service/ec2/transitgateway_.go
+++ b/internal/service/ec2/transitgateway_.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
 	"context"
 	"log"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -121,7 +124,7 @@ func ResourceTransitGateway() *schema.Resource {
 					ValidateFunc: verify.IsIPv4CIDRBlockOrIPv6CIDRBlock(
 						validation.All(
 							validation.IsCIDRNetwork(0, 24),
-							validation.StringDoesNotMatch(regexp.MustCompile(`^169\.254\.`), "must not be from range 169.254.0.0/16"),
+							validation.StringDoesNotMatch(regexache.MustCompile(`^169\.254\.`), "must not be from range 169.254.0.0/16"),
 						),
 						validation.IsCIDRNetwork(0, 64),
 					),
diff --git a/internal/service/ec2/transitgateway_attachment_data_source.go b/internal/service/ec2/transitgateway_attachment_data_source.go
index 8d748709eda..4adfdb38180 100644
--- a/internal/service/ec2/transitgateway_attachment_data_source.go
+++ b/internal/service/ec2/transitgateway_attachment_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/transitgateway_attachment_data_source_test.go b/internal/service/ec2/transitgateway_attachment_data_source_test.go
index 25ed3b449ff..d54d1f28fbe 100644
--- a/internal/service/ec2/transitgateway_attachment_data_source_test.go
+++ b/internal/service/ec2/transitgateway_attachment_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/transitgateway_attachments_data_source.go b/internal/service/ec2/transitgateway_attachments_data_source.go
index 15ccc4df2cf..0e10d440f7a 100644
--- a/internal/service/ec2/transitgateway_attachments_data_source.go
+++ b/internal/service/ec2/transitgateway_attachments_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/transitgateway_attachments_data_source_test.go b/internal/service/ec2/transitgateway_attachments_data_source_test.go
index 0973bbe6ce5..69b385556ef 100644
--- a/internal/service/ec2/transitgateway_attachments_data_source_test.go
+++ b/internal/service/ec2/transitgateway_attachments_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/transitgateway_connect.go b/internal/service/ec2/transitgateway_connect.go
index 30789f50d0b..b6a605c3c3b 100644
--- a/internal/service/ec2/transitgateway_connect.go
+++ b/internal/service/ec2/transitgateway_connect.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/transitgateway_connect_data_source.go b/internal/service/ec2/transitgateway_connect_data_source.go
index 1f7069109a1..0140fc97e92 100644
--- a/internal/service/ec2/transitgateway_connect_data_source.go
+++ b/internal/service/ec2/transitgateway_connect_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -23,7 +26,7 @@ func DataSourceTransitGatewayConnect() *schema.Resource {
 		},
 
 		Schema: map[string]*schema.Schema{
-			"filter": DataSourceFiltersSchema(),
+			"filter": CustomFiltersSchema(),
 			"protocol": {
 				Type:     schema.TypeString,
 				Computed: true,
@@ -56,7 +59,7 @@ func dataSourceTransitGatewayConnectRead(ctx context.Context, d *schema.Resource
 		input.TransitGatewayAttachmentIds = aws.StringSlice([]string{v.(string)})
 	}
 
-	input.Filters = append(input.Filters, BuildFiltersDataSource(
+	input.Filters = append(input.Filters, BuildCustomFilterList(
 		d.Get("filter").(*schema.Set),
 	)...)
 
diff --git a/internal/service/ec2/transitgateway_connect_data_source_test.go b/internal/service/ec2/transitgateway_connect_data_source_test.go
index b55ae375b97..ee05f2c00f9 100644
--- a/internal/service/ec2/transitgateway_connect_data_source_test.go
+++ b/internal/service/ec2/transitgateway_connect_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/transitgateway_connect_peer.go b/internal/service/ec2/transitgateway_connect_peer.go
index 70cb9a9fdeb..d1f089323cd 100644
--- a/internal/service/ec2/transitgateway_connect_peer.go
+++ b/internal/service/ec2/transitgateway_connect_peer.go
@@ -1,13 +1,16 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"strconv"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/aws/aws-sdk-go/service/ec2"
@@ -76,12 +79,12 @@ func ResourceTransitGatewayConnectPeer() *schema.Resource {
 					ValidateFunc: verify.IsIPv4CIDRBlockOrIPv6CIDRBlock(
 						validation.All(
 							validation.IsCIDRNetwork(29, 29),
-							validation.StringMatch(regexp.MustCompile(`^169\.254\.`), "IPv4 range must be from range 169.254.0.0/16"),
-							validation.StringDoesNotMatch(regexp.MustCompile(`^169\.254\.([0-5]\.0|169\.248)/29`), "IPv4 range must not be 169.254.([0-5].0|169.248)/29"),
+							validation.StringMatch(regexache.MustCompile(`^169\.254\.`), "IPv4 range must be from range 169.254.0.0/16"),
+							validation.StringDoesNotMatch(regexache.MustCompile(`^169\.254\.([0-5]\.0|169\.248)/29`), "IPv4 range must not be 169.254.([0-5].0|169.248)/29"),
 						),
 						validation.All(
 							validation.IsCIDRNetwork(125, 125),
-							validation.StringMatch(regexp.MustCompile(`^[fF][dD]`), "IPv6 range must be from fd00::/8"),
+							validation.StringMatch(regexache.MustCompile(`^[fF][dD]`), "IPv6 range must be from fd00::/8"),
 						),
 					),
 				},
diff --git a/internal/service/ec2/transitgateway_connect_peer_data_source.go b/internal/service/ec2/transitgateway_connect_peer_data_source.go
index b2e0cab1abb..93002dd3e67 100644
--- a/internal/service/ec2/transitgateway_connect_peer_data_source.go
+++ b/internal/service/ec2/transitgateway_connect_peer_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -44,7 +47,7 @@ func DataSourceTransitGatewayConnectPeer() *schema.Resource {
 				Computed: true,
 				Elem:     &schema.Schema{Type: schema.TypeString},
 			},
-			"filter": DataSourceFiltersSchema(),
+			"filter": CustomFiltersSchema(),
 			"inside_cidr_blocks": {
 				Type:     schema.TypeList,
 				Computed: true,
@@ -82,7 +85,7 @@ func dataSourceTransitGatewayConnectPeerRead(ctx context.Context, d *schema.Reso
 		input.TransitGatewayConnectPeerIds = aws.StringSlice([]string{v.(string)})
 	}
 
-	input.Filters = append(input.Filters, BuildFiltersDataSource(
+	input.Filters = append(input.Filters, BuildCustomFilterList(
 		d.Get("filter").(*schema.Set),
 	)...)
 
diff --git a/internal/service/ec2/transitgateway_connect_peer_data_source_test.go b/internal/service/ec2/transitgateway_connect_peer_data_source_test.go
index 22a87bc11fa..ca94a00f9d1 100644
--- a/internal/service/ec2/transitgateway_connect_peer_data_source_test.go
+++ b/internal/service/ec2/transitgateway_connect_peer_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/transitgateway_connect_peer_test.go b/internal/service/ec2/transitgateway_connect_peer_test.go
index 9b94b01a1e1..c2ec39fd744 100644
--- a/internal/service/ec2/transitgateway_connect_peer_test.go
+++ b/internal/service/ec2/transitgateway_connect_peer_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/transitgateway_connect_test.go b/internal/service/ec2/transitgateway_connect_test.go
index d4031c92bf5..99f879709f5 100644
--- a/internal/service/ec2/transitgateway_connect_test.go
+++ b/internal/service/ec2/transitgateway_connect_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/transitgateway_data_source.go b/internal/service/ec2/transitgateway_data_source.go
index 2beef410420..0bc7dccb4e1 100644
--- a/internal/service/ec2/transitgateway_data_source.go
+++ b/internal/service/ec2/transitgateway_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/transitgateway_data_source_test.go b/internal/service/ec2/transitgateway_data_source_test.go
index d25beccbae7..e5ae503ebac 100644
--- a/internal/service/ec2/transitgateway_data_source_test.go
+++ b/internal/service/ec2/transitgateway_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
@@ -66,6 +69,9 @@ func TestAccTransitGatewayDataSource_serial(t *testing.T) {
 			"Filter": testAccTransitGatewayRouteTablePropagationsDataSource_filter,
 			"basic":  testAccTransitGatewayRouteTablePropagationsDataSource_basic,
 		},
+		"RouteTableRoutes": {
+			"basic": testAccTransitGatewayRouteTableRoutesDataSource_basic,
+		},
 		"VpcAttachment": {
 			"Filter": testAccTransitGatewayVPCAttachmentDataSource_Filter,
 			"ID":     testAccTransitGatewayVPCAttachmentDataSource_ID,
diff --git a/internal/service/ec2/transitgateway_dx_gateway_attachment_data_source.go b/internal/service/ec2/transitgateway_dx_gateway_attachment_data_source.go
index 95b6420be7b..486182c407a 100644
--- a/internal/service/ec2/transitgateway_dx_gateway_attachment_data_source.go
+++ b/internal/service/ec2/transitgateway_dx_gateway_attachment_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/transitgateway_dx_gateway_attachment_data_source_test.go b/internal/service/ec2/transitgateway_dx_gateway_attachment_data_source_test.go
index 3ba0680e345..3e755018b3c 100644
--- a/internal/service/ec2/transitgateway_dx_gateway_attachment_data_source_test.go
+++ b/internal/service/ec2/transitgateway_dx_gateway_attachment_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/transitgateway_multicast_domain.go b/internal/service/ec2/transitgateway_multicast_domain.go
index febc314dfe4..2c98148262a 100644
--- a/internal/service/ec2/transitgateway_multicast_domain.go
+++ b/internal/service/ec2/transitgateway_multicast_domain.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/transitgateway_multicast_domain_association.go b/internal/service/ec2/transitgateway_multicast_domain_association.go
index 0a174a5fc36..cfcc93a9d78 100644
--- a/internal/service/ec2/transitgateway_multicast_domain_association.go
+++ b/internal/service/ec2/transitgateway_multicast_domain_association.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/transitgateway_multicast_domain_association_test.go b/internal/service/ec2/transitgateway_multicast_domain_association_test.go
index df0c19c199a..37c6851addf 100644
--- a/internal/service/ec2/transitgateway_multicast_domain_association_test.go
+++ b/internal/service/ec2/transitgateway_multicast_domain_association_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/transitgateway_multicast_domain_data_source.go b/internal/service/ec2/transitgateway_multicast_domain_data_source.go
index 6a3e13ecf4e..ad225f92792 100644
--- a/internal/service/ec2/transitgateway_multicast_domain_data_source.go
+++ b/internal/service/ec2/transitgateway_multicast_domain_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -47,7 +50,7 @@ func DataSourceTransitGatewayMulticastDomain() *schema.Resource {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
-			"filter": DataSourceFiltersSchema(),
+			"filter": CustomFiltersSchema(),
 			"igmpv2_support": {
 				Type:     schema.TypeString,
 				Computed: true,
@@ -124,7 +127,7 @@ func dataSourceTransitGatewayMulticastDomainRead(ctx context.Context, d *schema.
 		input.TransitGatewayMulticastDomainIds = aws.StringSlice([]string{v.(string)})
 	}
 
-	input.Filters = append(input.Filters, BuildFiltersDataSource(
+	input.Filters = append(input.Filters, BuildCustomFilterList(
 		d.Get("filter").(*schema.Set),
 	)...)
 
diff --git a/internal/service/ec2/transitgateway_multicast_domain_data_source_test.go b/internal/service/ec2/transitgateway_multicast_domain_data_source_test.go
index 60c9e39ebf7..3631a6f3848 100644
--- a/internal/service/ec2/transitgateway_multicast_domain_data_source_test.go
+++ b/internal/service/ec2/transitgateway_multicast_domain_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/transitgateway_multicast_domain_test.go b/internal/service/ec2/transitgateway_multicast_domain_test.go
index b13fb60fa99..1b117638da9 100644
--- a/internal/service/ec2/transitgateway_multicast_domain_test.go
+++ b/internal/service/ec2/transitgateway_multicast_domain_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -32,7 +35,7 @@ func testAccTransitGatewayMulticastDomain_basic(t *testing.T) {
 				Config: testAccTransitGatewayMulticastDomainConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckTransitGatewayMulticastDomainExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexp.MustCompile(`transit-gateway-multicast-domain/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`transit-gateway-multicast-domain/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "auto_accept_shared_associations", "disable"),
 					resource.TestCheckResourceAttr(resourceName, "igmpv2_support", "disable"),
 					acctest.CheckResourceAttrAccountID(resourceName, "owner_id"),
diff --git a/internal/service/ec2/transitgateway_multicast_group_member.go b/internal/service/ec2/transitgateway_multicast_group_member.go
index 4eddcec11fd..807d09dc6cc 100644
--- a/internal/service/ec2/transitgateway_multicast_group_member.go
+++ b/internal/service/ec2/transitgateway_multicast_group_member.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -78,7 +81,7 @@ func resourceTransitGatewayMulticastGroupMemberRead(ctx context.Context, d *sche
 		return diag.FromErr(err)
 	}
 
-	outputRaw, err := tfresource.RetryWhenNewResourceNotFound(ctx, propagationTimeout, func() (interface{}, error) {
+	outputRaw, err := tfresource.RetryWhenNewResourceNotFound(ctx, ec2PropagationTimeout, func() (interface{}, error) {
 		return FindTransitGatewayMulticastGroupMemberByThreePartKey(ctx, conn, multicastDomainID, groupIPAddress, eniID)
 	}, d.IsNewResource())
 
@@ -137,7 +140,7 @@ func deregisterTransitGatewayMulticastGroupMember(ctx context.Context, conn *ec2
 		return fmt.Errorf("deleting EC2 Transit Gateway Multicast Group Member (%s): %w", id, err)
 	}
 
-	_, err = tfresource.RetryUntilNotFound(ctx, propagationTimeout, func() (interface{}, error) {
+	_, err = tfresource.RetryUntilNotFound(ctx, ec2PropagationTimeout, func() (interface{}, error) {
 		return FindTransitGatewayMulticastGroupMemberByThreePartKey(ctx, conn, multicastDomainID, groupIPAddress, eniID)
 	})
 
diff --git a/internal/service/ec2/transitgateway_multicast_group_member_test.go b/internal/service/ec2/transitgateway_multicast_group_member_test.go
index 303c2e3a34d..2c4ff07ec86 100644
--- a/internal/service/ec2/transitgateway_multicast_group_member_test.go
+++ b/internal/service/ec2/transitgateway_multicast_group_member_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/transitgateway_multicast_group_source.go b/internal/service/ec2/transitgateway_multicast_group_source.go
index 0b7240218eb..9704fb3a9f3 100644
--- a/internal/service/ec2/transitgateway_multicast_group_source.go
+++ b/internal/service/ec2/transitgateway_multicast_group_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -78,7 +81,7 @@ func resourceTransitGatewayMulticastGroupSourceRead(ctx context.Context, d *sche
 		return diag.FromErr(err)
 	}
 
-	outputRaw, err := tfresource.RetryWhenNewResourceNotFound(ctx, propagationTimeout, func() (interface{}, error) {
+	outputRaw, err := tfresource.RetryWhenNewResourceNotFound(ctx, ec2PropagationTimeout, func() (interface{}, error) {
 		return FindTransitGatewayMulticastGroupSourceByThreePartKey(ctx, conn, multicastDomainID, groupIPAddress, eniID)
 	}, d.IsNewResource())
 
@@ -137,7 +140,7 @@ func deregisterTransitGatewayMulticastGroupSource(ctx context.Context, conn *ec2
 		return fmt.Errorf("deleting EC2 Transit Gateway Multicast Group Source (%s): %w", id, err)
 	}
 
-	_, err = tfresource.RetryUntilNotFound(ctx, propagationTimeout, func() (interface{}, error) {
+	_, err = tfresource.RetryUntilNotFound(ctx, ec2PropagationTimeout, func() (interface{}, error) {
 		return FindTransitGatewayMulticastGroupSourceByThreePartKey(ctx, conn, multicastDomainID, groupIPAddress, eniID)
 	})
 
diff --git a/internal/service/ec2/transitgateway_multicast_group_source_test.go b/internal/service/ec2/transitgateway_multicast_group_source_test.go
index 4979436b8c4..e8e14f0af8a 100644
--- a/internal/service/ec2/transitgateway_multicast_group_source_test.go
+++ b/internal/service/ec2/transitgateway_multicast_group_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/transitgateway_peering_attachment.go b/internal/service/ec2/transitgateway_peering_attachment.go
index 2e4ab840900..a8b61c00576 100644
--- a/internal/service/ec2/transitgateway_peering_attachment.go
+++ b/internal/service/ec2/transitgateway_peering_attachment.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/transitgateway_peering_attachment_accepter.go b/internal/service/ec2/transitgateway_peering_attachment_accepter.go
index 1ca7f035116..b31c87690e6 100644
--- a/internal/service/ec2/transitgateway_peering_attachment_accepter.go
+++ b/internal/service/ec2/transitgateway_peering_attachment_accepter.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/transitgateway_peering_attachment_accepter_test.go b/internal/service/ec2/transitgateway_peering_attachment_accepter_test.go
index 1c3ede54b01..7b5f4d1294e 100644
--- a/internal/service/ec2/transitgateway_peering_attachment_accepter_test.go
+++ b/internal/service/ec2/transitgateway_peering_attachment_accepter_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/transitgateway_peering_attachment_data_source.go b/internal/service/ec2/transitgateway_peering_attachment_data_source.go
index 71b31218610..f37a8881011 100644
--- a/internal/service/ec2/transitgateway_peering_attachment_data_source.go
+++ b/internal/service/ec2/transitgateway_peering_attachment_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/transitgateway_peering_attachment_data_source_test.go b/internal/service/ec2/transitgateway_peering_attachment_data_source_test.go
index 2c8a0eb17e2..d191d902395 100644
--- a/internal/service/ec2/transitgateway_peering_attachment_data_source_test.go
+++ b/internal/service/ec2/transitgateway_peering_attachment_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/transitgateway_peering_attachment_test.go b/internal/service/ec2/transitgateway_peering_attachment_test.go
index 57b3b796626..dbdb7c6e48e 100644
--- a/internal/service/ec2/transitgateway_peering_attachment_test.go
+++ b/internal/service/ec2/transitgateway_peering_attachment_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/transitgateway_policy_table.go b/internal/service/ec2/transitgateway_policy_table.go
index 433aabaf796..319eb8ff778 100644
--- a/internal/service/ec2/transitgateway_policy_table.go
+++ b/internal/service/ec2/transitgateway_policy_table.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/transitgateway_policy_table_association.go b/internal/service/ec2/transitgateway_policy_table_association.go
index 47186089796..3ddbf41e6b0 100644
--- a/internal/service/ec2/transitgateway_policy_table_association.go
+++ b/internal/service/ec2/transitgateway_policy_table_association.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/transitgateway_policy_table_association_test.go b/internal/service/ec2/transitgateway_policy_table_association_test.go
index f4274b4fc0a..60a261eec53 100644
--- a/internal/service/ec2/transitgateway_policy_table_association_test.go
+++ b/internal/service/ec2/transitgateway_policy_table_association_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/transitgateway_policy_table_test.go b/internal/service/ec2/transitgateway_policy_table_test.go
index 01e9e774ac4..9c304898d29 100644
--- a/internal/service/ec2/transitgateway_policy_table_test.go
+++ b/internal/service/ec2/transitgateway_policy_table_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
 	"context"
 	"errors"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -35,7 +38,7 @@ func testAccTransitGatewayPolicyTable_basic(t *testing.T) {
 				Config: testAccTransitGatewayPolicyTableConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckTransitGatewayPolicyTableExists(ctx, resourceName, &transitGatewayPolicyTable1),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexp.MustCompile(`transit-gateway-policy-table/tgw-ptb-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`transit-gateway-policy-table/tgw-ptb-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "state", "available"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 					resource.TestCheckResourceAttrPair(resourceName, "transit_gateway_id", transitGatewayResourceName, "id"),
diff --git a/internal/service/ec2/transitgateway_prefix_list_reference.go b/internal/service/ec2/transitgateway_prefix_list_reference.go
index d1837a26942..59603221d71 100644
--- a/internal/service/ec2/transitgateway_prefix_list_reference.go
+++ b/internal/service/ec2/transitgateway_prefix_list_reference.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/transitgateway_prefix_list_reference_test.go b/internal/service/ec2/transitgateway_prefix_list_reference_test.go
index 31df9395579..e738d9faa6d 100644
--- a/internal/service/ec2/transitgateway_prefix_list_reference_test.go
+++ b/internal/service/ec2/transitgateway_prefix_list_reference_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/transitgateway_route.go b/internal/service/ec2/transitgateway_route.go
index 96a469a8a31..e94184d19d8 100644
--- a/internal/service/ec2/transitgateway_route.go
+++ b/internal/service/ec2/transitgateway_route.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -98,8 +101,8 @@ func resourceTransitGatewayRouteRead(ctx context.Context, d *schema.ResourceData
 		return sdkdiag.AppendErrorf(diags, "reading EC2 Transit Gateway Route (%s): %s", d.Id(), err)
 	}
 
-	outputRaw, err := tfresource.RetryWhenNewResourceNotFound(ctx, propagationTimeout, func() (interface{}, error) {
-		return FindTransitGatewayRoute(ctx, conn, transitGatewayRouteTableID, destination)
+	outputRaw, err := tfresource.RetryWhenNewResourceNotFound(ctx, ec2PropagationTimeout, func() (interface{}, error) {
+		return FindTransitGatewayStaticRoute(ctx, conn, transitGatewayRouteTableID, destination)
 	}, d.IsNewResource())
 
 	if !d.IsNewResource() && tfresource.NotFound(err) {
diff --git a/internal/service/ec2/transitgateway_route_table.go b/internal/service/ec2/transitgateway_route_table.go
index db2e82ce6eb..28e1c7de650 100644
--- a/internal/service/ec2/transitgateway_route_table.go
+++ b/internal/service/ec2/transitgateway_route_table.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/transitgateway_route_table_association.go b/internal/service/ec2/transitgateway_route_table_association.go
index 51beafd2726..d815a669044 100644
--- a/internal/service/ec2/transitgateway_route_table_association.go
+++ b/internal/service/ec2/transitgateway_route_table_association.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/transitgateway_route_table_association_test.go b/internal/service/ec2/transitgateway_route_table_association_test.go
index 8434e34b067..1315e8a08da 100644
--- a/internal/service/ec2/transitgateway_route_table_association_test.go
+++ b/internal/service/ec2/transitgateway_route_table_association_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
@@ -97,9 +100,9 @@ func testAccTransitGatewayRouteTableAssociation_replaceExistingAssociation(t *te
 					resource.TestCheckResourceAttrSet(resourceName, "resource_type"),
 					resource.TestCheckResourceAttrPair(resourceName, "transit_gateway_attachment_id", transitGatewayVpcAttachmentResourceName, "id"),
 					resource.TestCheckResourceAttrPair(resourceName, "transit_gateway_route_table_id", transitGatewayRouteTableResourceName, "id"),
+					resource.TestCheckResourceAttr(transitGatewayVpcAttachmentResourceName, "transit_gateway_default_route_table_association", "true"),
+					resource.TestCheckResourceAttr(transitGatewayVpcAttachmentResourceName, "transit_gateway_default_route_table_propagation", "true"),
 				),
-				// aws_ec2_transit_gateway_vpc_attachment.test.transit_gateway_default_route_table_association shows diff:
-				ExpectNonEmptyPlan: true,
 			},
 			{
 				ResourceName:            resourceName,
@@ -174,7 +177,7 @@ func testAccCheckTransitGatewayRouteTableAssociationDestroy(ctx context.Context)
 	}
 }
 
-func testAccTransitGatewayRouteTableAssociationConfig_basic(rName string) string {
+func testAccTransitGatewayRouteTableAssociationConfig_base(rName string) string {
 	return acctest.ConfigCompose(acctest.ConfigVPCWithSubnets(rName, 1), fmt.Sprintf(`
 resource "aws_ec2_transit_gateway" "test" {
   tags = {
@@ -182,16 +185,6 @@ resource "aws_ec2_transit_gateway" "test" {
   }
 }
 
-resource "aws_ec2_transit_gateway_vpc_attachment" "test" {
-  subnet_ids                                      = aws_subnet.test[*].id
-  transit_gateway_default_route_table_association = false
-  transit_gateway_id                              = aws_ec2_transit_gateway.test.id
-  vpc_id                                          = aws_vpc.test.id
-
-  tags = {
-    Name = %[1]q
-  }
-}
 
 resource "aws_ec2_transit_gateway_route_table" "test" {
   transit_gateway_id = aws_ec2_transit_gateway.test.id
@@ -200,25 +193,14 @@ resource "aws_ec2_transit_gateway_route_table" "test" {
     Name = %[1]q
   }
 }
-
-resource "aws_ec2_transit_gateway_route_table_association" "test" {
-  transit_gateway_attachment_id  = aws_ec2_transit_gateway_vpc_attachment.test.id
-  transit_gateway_route_table_id = aws_ec2_transit_gateway_route_table.test.id
-}
 `, rName))
 }
 
-func testAccTransitGatewayRouteTableAssociationConfig_replaceExistingAssociation(rName string) string {
-	return acctest.ConfigCompose(acctest.ConfigVPCWithSubnets(rName, 1), fmt.Sprintf(`
-resource "aws_ec2_transit_gateway" "test" {
-  tags = {
-    Name = %[1]q
-  }
-}
-
+func testAccTransitGatewayRouteTableAssociationConfig_basic(rName string) string {
+	return acctest.ConfigCompose(testAccTransitGatewayRouteTableAssociationConfig_base(rName), fmt.Sprintf(`
 resource "aws_ec2_transit_gateway_vpc_attachment" "test" {
   subnet_ids                                      = aws_subnet.test[*].id
-  transit_gateway_default_route_table_association = true
+  transit_gateway_default_route_table_association = false
   transit_gateway_id                              = aws_ec2_transit_gateway.test.id
   vpc_id                                          = aws_vpc.test.id
 
@@ -227,8 +209,19 @@ resource "aws_ec2_transit_gateway_vpc_attachment" "test" {
   }
 }
 
-resource "aws_ec2_transit_gateway_route_table" "test" {
+resource "aws_ec2_transit_gateway_route_table_association" "test" {
+  transit_gateway_attachment_id  = aws_ec2_transit_gateway_vpc_attachment.test.id
+  transit_gateway_route_table_id = aws_ec2_transit_gateway_route_table.test.id
+}
+`, rName))
+}
+
+func testAccTransitGatewayRouteTableAssociationConfig_replaceExistingAssociation(rName string) string {
+	return acctest.ConfigCompose(testAccTransitGatewayRouteTableAssociationConfig_base(rName), fmt.Sprintf(`
+resource "aws_ec2_transit_gateway_vpc_attachment" "test" {
+  subnet_ids         = aws_subnet.test[*].id
   transit_gateway_id = aws_ec2_transit_gateway.test.id
+  vpc_id             = aws_vpc.test.id
 
   tags = {
     Name = %[1]q
diff --git a/internal/service/ec2/transitgateway_route_table_associations_data_source.go b/internal/service/ec2/transitgateway_route_table_associations_data_source.go
index 39c540ee43d..835e6201321 100644
--- a/internal/service/ec2/transitgateway_route_table_associations_data_source.go
+++ b/internal/service/ec2/transitgateway_route_table_associations_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -23,7 +26,7 @@ func DataSourceTransitGatewayRouteTableAssociations() *schema.Resource {
 		},
 
 		Schema: map[string]*schema.Schema{
-			"filter": DataSourceFiltersSchema(),
+			"filter": CustomFiltersSchema(),
 			"ids": {
 				Type:     schema.TypeList,
 				Computed: true,
@@ -48,7 +51,7 @@ func dataSourceTransitGatewayRouteTableAssociationsRead(ctx context.Context, d *
 		input.TransitGatewayRouteTableId = aws.String(v.(string))
 	}
 
-	input.Filters = append(input.Filters, BuildFiltersDataSource(
+	input.Filters = append(input.Filters, BuildCustomFilterList(
 		d.Get("filter").(*schema.Set),
 	)...)
 
diff --git a/internal/service/ec2/transitgateway_route_table_associations_data_source_test.go b/internal/service/ec2/transitgateway_route_table_associations_data_source_test.go
index 98046b9666e..9bd94bb90ef 100644
--- a/internal/service/ec2/transitgateway_route_table_associations_data_source_test.go
+++ b/internal/service/ec2/transitgateway_route_table_associations_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
@@ -50,14 +53,8 @@ func testAccTransitGatewayRouteTableAssociationsDataSource_filter(t *testing.T)
 	})
 }
 
-func testAccTransitGatewayRouteTableAssociationsDataSourceConfig_basic(rName string) string {
-	return acctest.ConfigCompose(acctest.ConfigVPCWithSubnets(rName, 1), fmt.Sprintf(`
-resource "aws_ec2_transit_gateway" "test" {
-  tags = {
-    Name = %[1]q
-  }
-}
-
+func testAccTransitGatewayRouteTableAssociationsDataSourceConfig_base(rName string) string {
+	return acctest.ConfigCompose(testAccTransitGatewayRouteTableAssociationConfig_base(rName), fmt.Sprintf(`
 resource "aws_ec2_transit_gateway_vpc_attachment" "test" {
   subnet_ids         = aws_subnet.test[*].id
   transit_gateway_id = aws_ec2_transit_gateway.test.id
@@ -70,60 +67,25 @@ resource "aws_ec2_transit_gateway_vpc_attachment" "test" {
   }
 }
 
-resource "aws_ec2_transit_gateway_route_table" "test" {
-  transit_gateway_id = aws_ec2_transit_gateway.test.id
-
-  tags = {
-    Name = %[1]q
-  }
-}
-
 resource "aws_ec2_transit_gateway_route_table_association" "test" {
   transit_gateway_attachment_id  = aws_ec2_transit_gateway_vpc_attachment.test.id
   transit_gateway_route_table_id = aws_ec2_transit_gateway_route_table.test.id
 }
+`, rName))
+}
 
+func testAccTransitGatewayRouteTableAssociationsDataSourceConfig_basic(rName string) string {
+	return acctest.ConfigCompose(testAccTransitGatewayRouteTableAssociationsDataSourceConfig_base(rName), `
 data "aws_ec2_transit_gateway_route_table_associations" "test" {
   transit_gateway_route_table_id = aws_ec2_transit_gateway_route_table.test.id
 
   depends_on = [aws_ec2_transit_gateway_route_table_association.test]
 }
-`, rName))
+`)
 }
 
 func testAccTransitGatewayRouteTableAssociationsDataSourceConfig_filter(rName string) string {
-	return acctest.ConfigCompose(acctest.ConfigVPCWithSubnets(rName, 1), fmt.Sprintf(`
-resource "aws_ec2_transit_gateway" "test" {
-  tags = {
-    Name = %[1]q
-  }
-}
-
-resource "aws_ec2_transit_gateway_vpc_attachment" "test" {
-  subnet_ids         = aws_subnet.test[*].id
-  transit_gateway_id = aws_ec2_transit_gateway.test.id
-  vpc_id             = aws_vpc.test.id
-
-  transit_gateway_default_route_table_association = false
-
-  tags = {
-    Name = %[1]q
-  }
-}
-
-resource "aws_ec2_transit_gateway_route_table" "test" {
-  transit_gateway_id = aws_ec2_transit_gateway.test.id
-
-  tags = {
-    Name = %[1]q
-  }
-}
-
-resource "aws_ec2_transit_gateway_route_table_association" "test" {
-  transit_gateway_attachment_id  = aws_ec2_transit_gateway_vpc_attachment.test.id
-  transit_gateway_route_table_id = aws_ec2_transit_gateway_route_table.test.id
-}
-
+	return acctest.ConfigCompose(testAccTransitGatewayRouteTableAssociationsDataSourceConfig_base(rName), `
 data "aws_ec2_transit_gateway_route_table_associations" "test" {
   transit_gateway_route_table_id = aws_ec2_transit_gateway_route_table.test.id
 
@@ -134,5 +96,5 @@ data "aws_ec2_transit_gateway_route_table_associations" "test" {
 
   depends_on = [aws_ec2_transit_gateway_route_table_association.test]
 }
-`, rName))
+`)
 }
diff --git a/internal/service/ec2/transitgateway_route_table_data_source.go b/internal/service/ec2/transitgateway_route_table_data_source.go
index 4e4d45f1e42..420abbff9a5 100644
--- a/internal/service/ec2/transitgateway_route_table_data_source.go
+++ b/internal/service/ec2/transitgateway_route_table_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/transitgateway_route_table_data_source_test.go b/internal/service/ec2/transitgateway_route_table_data_source_test.go
index ef48a8d3052..d9ca2e7ba82 100644
--- a/internal/service/ec2/transitgateway_route_table_data_source_test.go
+++ b/internal/service/ec2/transitgateway_route_table_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/transitgateway_route_table_propagation.go b/internal/service/ec2/transitgateway_route_table_propagation.go
index 45b83faf007..3d6a3a15d0d 100644
--- a/internal/service/ec2/transitgateway_route_table_propagation.go
+++ b/internal/service/ec2/transitgateway_route_table_propagation.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/transitgateway_route_table_propagation_test.go b/internal/service/ec2/transitgateway_route_table_propagation_test.go
index 2e025c810a4..2ad09f41d84 100644
--- a/internal/service/ec2/transitgateway_route_table_propagation_test.go
+++ b/internal/service/ec2/transitgateway_route_table_propagation_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
@@ -135,25 +138,8 @@ func testAccCheckTransitGatewayRouteTablePropagationDestroy(ctx context.Context)
 	}
 }
 
-func testAccTransitGatewayRouteTablePropagationConfig_basic(rName string) string {
-	return fmt.Sprintf(`
-resource "aws_vpc" "test" {
-  cidr_block = "10.0.0.0/16"
-
-  tags = {
-    Name = %[1]q
-  }
-}
-
-resource "aws_subnet" "test" {
-  cidr_block = "10.0.0.0/24"
-  vpc_id     = aws_vpc.test.id
-
-  tags = {
-    Name = %[1]q
-  }
-}
-
+func testAccTransitGatewayRouteTablePropagationConfig_base(rName string) string {
+	return acctest.ConfigCompose(acctest.ConfigVPCWithSubnets(rName, 1), fmt.Sprintf(`
 resource "aws_ec2_transit_gateway" "test" {
   tags = {
     Name = %[1]q
@@ -161,7 +147,7 @@ resource "aws_ec2_transit_gateway" "test" {
 }
 
 resource "aws_ec2_transit_gateway_vpc_attachment" "test" {
-  subnet_ids         = [aws_subnet.test.id]
+  subnet_ids         = aws_subnet.test[*].id
   transit_gateway_id = aws_ec2_transit_gateway.test.id
   vpc_id             = aws_vpc.test.id
 
@@ -177,10 +163,14 @@ resource "aws_ec2_transit_gateway_route_table" "test" {
     Name = %[1]q
   }
 }
+`, rName))
+}
 
+func testAccTransitGatewayRouteTablePropagationConfig_basic(rName string) string {
+	return acctest.ConfigCompose(testAccTransitGatewayRouteTablePropagationConfig_base(rName), `
 resource "aws_ec2_transit_gateway_route_table_propagation" "test" {
   transit_gateway_attachment_id  = aws_ec2_transit_gateway_vpc_attachment.test.id
   transit_gateway_route_table_id = aws_ec2_transit_gateway_route_table.test.id
 }
-`, rName)
+`)
 }
diff --git a/internal/service/ec2/transitgateway_route_table_propagations_data_source.go b/internal/service/ec2/transitgateway_route_table_propagations_data_source.go
index 6f17a7dafb1..3c8d47c290a 100644
--- a/internal/service/ec2/transitgateway_route_table_propagations_data_source.go
+++ b/internal/service/ec2/transitgateway_route_table_propagations_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -23,7 +26,7 @@ func DataSourceTransitGatewayRouteTablePropagations() *schema.Resource {
 		},
 
 		Schema: map[string]*schema.Schema{
-			"filter": DataSourceFiltersSchema(),
+			"filter": CustomFiltersSchema(),
 			"ids": {
 				Type:     schema.TypeList,
 				Computed: true,
@@ -48,7 +51,7 @@ func dataSourceTransitGatewayRouteTablePropagationsRead(ctx context.Context, d *
 		input.TransitGatewayRouteTableId = aws.String(v.(string))
 	}
 
-	input.Filters = append(input.Filters, BuildFiltersDataSource(
+	input.Filters = append(input.Filters, BuildCustomFilterList(
 		d.Get("filter").(*schema.Set),
 	)...)
 
diff --git a/internal/service/ec2/transitgateway_route_table_propagations_data_source_test.go b/internal/service/ec2/transitgateway_route_table_propagations_data_source_test.go
index 13fab242758..5f3b415c301 100644
--- a/internal/service/ec2/transitgateway_route_table_propagations_data_source_test.go
+++ b/internal/service/ec2/transitgateway_route_table_propagations_data_source_test.go
@@ -1,7 +1,9 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
-	"fmt"
 	"testing"
 
 	"github.com/aws/aws-sdk-go/service/ec2"
@@ -51,75 +53,17 @@ func testAccTransitGatewayRouteTablePropagationsDataSource_filter(t *testing.T)
 }
 
 func testAccTransitGatewayRouteTablePropagationsDataSourceConfig_basic(rName string) string {
-	return acctest.ConfigCompose(acctest.ConfigVPCWithSubnets(rName, 1), fmt.Sprintf(`
-resource "aws_ec2_transit_gateway" "test" {
-  tags = {
-    Name = %[1]q
-  }
-}
-
-resource "aws_ec2_transit_gateway_vpc_attachment" "test" {
-  subnet_ids         = aws_subnet.test[*].id
-  transit_gateway_id = aws_ec2_transit_gateway.test.id
-  vpc_id             = aws_vpc.test.id
-
-  tags = {
-    Name = %[1]q
-  }
-}
-
-resource "aws_ec2_transit_gateway_route_table" "test" {
-  transit_gateway_id = aws_ec2_transit_gateway.test.id
-
-  tags = {
-    Name = %[1]q
-  }
-}
-
-resource "aws_ec2_transit_gateway_route_table_propagation" "test" {
-  transit_gateway_attachment_id  = aws_ec2_transit_gateway_vpc_attachment.test.id
-  transit_gateway_route_table_id = aws_ec2_transit_gateway_route_table.test.id
-}
-
+	return acctest.ConfigCompose(testAccTransitGatewayRouteTablePropagationConfig_basic(rName), `
 data "aws_ec2_transit_gateway_route_table_propagations" "test" {
   transit_gateway_route_table_id = aws_ec2_transit_gateway_route_table.test.id
 
   depends_on = [aws_ec2_transit_gateway_route_table_propagation.test]
 }
-`, rName))
+`)
 }
 
 func testAccTransitGatewayRouteTablePropagationsDataSourceConfig_filter(rName string) string {
-	return acctest.ConfigCompose(acctest.ConfigVPCWithSubnets(rName, 1), fmt.Sprintf(`
-resource "aws_ec2_transit_gateway" "test" {
-  tags = {
-    Name = %[1]q
-  }
-}
-
-resource "aws_ec2_transit_gateway_vpc_attachment" "test" {
-  subnet_ids         = aws_subnet.test[*].id
-  transit_gateway_id = aws_ec2_transit_gateway.test.id
-  vpc_id             = aws_vpc.test.id
-
-  tags = {
-    Name = %[1]q
-  }
-}
-
-resource "aws_ec2_transit_gateway_route_table" "test" {
-  transit_gateway_id = aws_ec2_transit_gateway.test.id
-
-  tags = {
-    Name = %[1]q
-  }
-}
-
-resource "aws_ec2_transit_gateway_route_table_propagation" "test" {
-  transit_gateway_attachment_id  = aws_ec2_transit_gateway_vpc_attachment.test.id
-  transit_gateway_route_table_id = aws_ec2_transit_gateway_route_table.test.id
-}
-
+	return acctest.ConfigCompose(testAccTransitGatewayRouteTablePropagationConfig_basic(rName), `
 data "aws_ec2_transit_gateway_route_table_propagations" "test" {
   transit_gateway_route_table_id = aws_ec2_transit_gateway_route_table.test.id
 
@@ -130,5 +74,5 @@ data "aws_ec2_transit_gateway_route_table_propagations" "test" {
 
   depends_on = [aws_ec2_transit_gateway_route_table_propagation.test]
 }
-`, rName))
+`)
 }
diff --git a/internal/service/ec2/transitgateway_route_table_routes_data_source.go b/internal/service/ec2/transitgateway_route_table_routes_data_source.go
new file mode 100644
index 00000000000..6c90822c2c1
--- /dev/null
+++ b/internal/service/ec2/transitgateway_route_table_routes_data_source.go
@@ -0,0 +1,96 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package ec2
+
+import (
+	"context"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/ec2"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
+)
+
+// @SDKDataSource("aws_ec2_transit_gateway_route_table_routes")
+func DataSourceTransitGatewayRouteTableRoutes() *schema.Resource {
+	return &schema.Resource{
+		ReadWithoutTimeout: dataSourceTransitGatewayRouteTableRoutesRead,
+
+		Schema: map[string]*schema.Schema{
+			"filter": CustomRequiredFiltersSchema(),
+			"routes": {
+				Type:     schema.TypeList,
+				Computed: true,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"destination_cidr_block": {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+						"prefix_list_id": {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+						"state": {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+						"transit_gateway_route_table_announcement_id": {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+						"type": {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+					},
+				},
+			},
+			"transit_gateway_route_table_id": {
+				Type:         schema.TypeString,
+				Required:     true,
+				ValidateFunc: validation.NoZeroValues,
+			},
+		},
+	}
+}
+
+func dataSourceTransitGatewayRouteTableRoutesRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).EC2Conn(ctx)
+
+	tgwRouteTableID := d.Get("transit_gateway_route_table_id").(string)
+	input := &ec2.SearchTransitGatewayRoutesInput{
+		Filters:                    BuildCustomFilterList(d.Get("filter").(*schema.Set)),
+		TransitGatewayRouteTableId: aws.String(tgwRouteTableID),
+	}
+
+	output, err := FindTransitGatewayRoutes(ctx, conn, input)
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "reading EC2 Transit Gateway Route Table (%s) Routes: %s", tgwRouteTableID, err)
+	}
+
+	d.SetId(tgwRouteTableID)
+
+	routes := []interface{}{}
+	for _, route := range output {
+		routes = append(routes, map[string]interface{}{
+			"destination_cidr_block": aws.StringValue(route.DestinationCidrBlock),
+			"prefix_list_id":         aws.StringValue(route.PrefixListId),
+			"state":                  aws.StringValue(route.State),
+			"transit_gateway_route_table_announcement_id": aws.StringValue(route.TransitGatewayRouteTableAnnouncementId),
+			"type": aws.StringValue(route.Type),
+		})
+	}
+
+	if err := d.Set("routes", routes); err != nil {
+		return sdkdiag.AppendErrorf(diags, "setting routes: %s", err)
+	}
+
+	return diags
+}
diff --git a/internal/service/ec2/transitgateway_route_table_routes_data_source_test.go b/internal/service/ec2/transitgateway_route_table_routes_data_source_test.go
new file mode 100644
index 00000000000..dfe4a0e01e5
--- /dev/null
+++ b/internal/service/ec2/transitgateway_route_table_routes_data_source_test.go
@@ -0,0 +1,85 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package ec2_test
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/aws/aws-sdk-go/service/ec2"
+	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
+)
+
+func testAccTransitGatewayRouteTableRoutesDataSource_basic(t *testing.T) {
+	ctx := acctest.Context(t)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	dataSourceName := "data.aws_ec2_transit_gateway_route_table_routes.test"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheckTransitGateway(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, ec2.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccTransitGatewayRouteTableRoutesDataSourceConfig_basic(rName),
+				Check: resource.ComposeTestCheckFunc(
+					acctest.CheckResourceAttrGreaterThanValue(dataSourceName, "routes.#", 0),
+				),
+			},
+		},
+	})
+}
+
+func testAccTransitGatewayRouteTableRoutesDataSourceConfig_basic(rName string) string {
+	return acctest.ConfigCompose(acctest.ConfigVPCWithSubnets(rName, 1), fmt.Sprintf(`
+resource "aws_ec2_transit_gateway" "test" {
+  tags = {
+    Name = %[1]q
+  }
+}
+
+resource "aws_ec2_transit_gateway_vpc_attachment" "test" {
+  subnet_ids         = aws_subnet.test[*].id
+  transit_gateway_id = aws_ec2_transit_gateway.test.id
+  vpc_id             = aws_vpc.test.id
+
+  transit_gateway_default_route_table_association = false
+
+  tags = {
+    Name = %[1]q
+  }
+}
+
+resource "aws_ec2_transit_gateway_route_table" "test" {
+  transit_gateway_id = aws_ec2_transit_gateway.test.id
+
+  tags = {
+    Name = %[1]q
+  }
+}
+
+resource "aws_ec2_transit_gateway_route_table_association" "test" {
+  transit_gateway_attachment_id  = aws_ec2_transit_gateway_vpc_attachment.test.id
+  transit_gateway_route_table_id = aws_ec2_transit_gateway_route_table.test.id
+}
+
+resource "aws_ec2_transit_gateway_route_table_propagation" "test" {
+  transit_gateway_attachment_id  = aws_ec2_transit_gateway_vpc_attachment.test.id
+  transit_gateway_route_table_id = aws_ec2_transit_gateway_route_table.test.id
+}
+
+data "aws_ec2_transit_gateway_route_table_routes" "test" {
+  transit_gateway_route_table_id = aws_ec2_transit_gateway_route_table.test.id
+
+  filter {
+    name   = "type"
+    values = ["propagated"]
+  }
+
+  depends_on = [aws_ec2_transit_gateway_route_table_association.test, aws_ec2_transit_gateway_route_table_propagation.test]
+}
+`, rName))
+}
diff --git a/internal/service/ec2/transitgateway_route_table_test.go b/internal/service/ec2/transitgateway_route_table_test.go
index a8b9027a8c7..e5335412842 100644
--- a/internal/service/ec2/transitgateway_route_table_test.go
+++ b/internal/service/ec2/transitgateway_route_table_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
 	"context"
 	"errors"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -35,7 +38,7 @@ func testAccTransitGatewayRouteTable_basic(t *testing.T) {
 				Config: testAccTransitGatewayRouteTableConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckTransitGatewayRouteTableExists(ctx, resourceName, &transitGatewayRouteTable1),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexp.MustCompile(`transit-gateway-route-table/tgw-rtb-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`transit-gateway-route-table/tgw-rtb-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "default_association_route_table", "false"),
 					resource.TestCheckResourceAttr(resourceName, "default_propagation_route_table", "false"),
 					resource.TestCheckResourceAttrPair(resourceName, "transit_gateway_id", transitGatewayResourceName, "id"),
diff --git a/internal/service/ec2/transitgateway_route_tables_data_source.go b/internal/service/ec2/transitgateway_route_tables_data_source.go
index 78688414a86..a84a194184e 100644
--- a/internal/service/ec2/transitgateway_route_tables_data_source.go
+++ b/internal/service/ec2/transitgateway_route_tables_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -23,7 +26,7 @@ func DataSourceTransitGatewayRouteTables() *schema.Resource {
 		},
 
 		Schema: map[string]*schema.Schema{
-			"filter": DataSourceFiltersSchema(),
+			"filter": CustomFiltersSchema(),
 			"ids": {
 				Type:     schema.TypeList,
 				Computed: true,
@@ -44,7 +47,7 @@ func dataSourceTransitGatewayRouteTablesRead(ctx context.Context, d *schema.Reso
 		Tags(tftags.New(ctx, d.Get("tags").(map[string]interface{}))),
 	)...)
 
-	input.Filters = append(input.Filters, BuildFiltersDataSource(
+	input.Filters = append(input.Filters, BuildCustomFilterList(
 		d.Get("filter").(*schema.Set),
 	)...)
 
diff --git a/internal/service/ec2/transitgateway_route_tables_data_source_test.go b/internal/service/ec2/transitgateway_route_tables_data_source_test.go
index 2b6aca95cb4..e940ab200b3 100644
--- a/internal/service/ec2/transitgateway_route_tables_data_source_test.go
+++ b/internal/service/ec2/transitgateway_route_tables_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/transitgateway_route_test.go b/internal/service/ec2/transitgateway_route_test.go
index cb094e447c4..559845455dd 100644
--- a/internal/service/ec2/transitgateway_route_test.go
+++ b/internal/service/ec2/transitgateway_route_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
@@ -181,7 +184,7 @@ func testAccCheckTransitGatewayRouteExists(ctx context.Context, n string, v *ec2
 
 		conn := acctest.Provider.Meta().(*conns.AWSClient).EC2Conn(ctx)
 
-		output, err := tfec2.FindTransitGatewayRoute(ctx, conn, transitGatewayRouteTableID, destination)
+		output, err := tfec2.FindTransitGatewayStaticRoute(ctx, conn, transitGatewayRouteTableID, destination)
 
 		if err != nil {
 			return err
@@ -208,7 +211,7 @@ func testAccCheckTransitGatewayRouteDestroy(ctx context.Context) resource.TestCh
 				return err
 			}
 
-			_, err = tfec2.FindTransitGatewayRoute(ctx, conn, transitGatewayRouteTableID, destination)
+			_, err = tfec2.FindTransitGatewayStaticRoute(ctx, conn, transitGatewayRouteTableID, destination)
 
 			if tfresource.NotFound(err) {
 				continue
diff --git a/internal/service/ec2/transitgateway_test.go b/internal/service/ec2/transitgateway_test.go
index ff2dc2d316a..038af08fd8c 100644
--- a/internal/service/ec2/transitgateway_test.go
+++ b/internal/service/ec2/transitgateway_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
 	"context"
 	"errors"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -164,7 +167,7 @@ func testAccTransitGateway_basic(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckTransitGatewayExists(ctx, resourceName, &transitGateway1),
 					resource.TestCheckResourceAttr(resourceName, "amazon_side_asn", "64512"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexp.MustCompile(`transit-gateway/tgw-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`transit-gateway/tgw-.+`)),
 					resource.TestCheckResourceAttrSet(resourceName, "association_default_route_table_id"),
 					resource.TestCheckResourceAttr(resourceName, "auto_accept_shared_attachments", ec2.AutoAcceptSharedAttachmentsValueDisable),
 					resource.TestCheckResourceAttr(resourceName, "default_route_table_association", ec2.DefaultRouteTableAssociationValueEnable),
diff --git a/internal/service/ec2/transitgateway_vpc_attachment.go b/internal/service/ec2/transitgateway_vpc_attachment.go
index f528b43cfde..2adba22f3fd 100644
--- a/internal/service/ec2/transitgateway_vpc_attachment.go
+++ b/internal/service/ec2/transitgateway_vpc_attachment.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -64,12 +67,12 @@ func ResourceTransitGatewayVPCAttachment() *schema.Resource {
 			"transit_gateway_default_route_table_association": {
 				Type:     schema.TypeBool,
 				Optional: true,
-				Default:  true,
+				Computed: true,
 			},
 			"transit_gateway_default_route_table_propagation": {
 				Type:     schema.TypeBool,
 				Optional: true,
-				Default:  true,
+				Computed: true,
 			},
 			"transit_gateway_id": {
 				Type:         schema.TypeString,
@@ -129,11 +132,22 @@ func resourceTransitGatewayVPCAttachmentCreate(ctx context.Context, d *schema.Re
 
 	// We cannot modify Transit Gateway Route Tables for Resource Access Manager shared Transit Gateways.
 	if aws.StringValue(transitGateway.OwnerId) == aws.StringValue(output.TransitGatewayVpcAttachment.VpcOwnerId) {
-		if err := transitGatewayRouteTableAssociationUpdate(ctx, conn, aws.StringValue(transitGateway.Options.AssociationDefaultRouteTableId), d.Id(), d.Get("transit_gateway_default_route_table_association").(bool)); err != nil {
+		// Default values of transit_gateway_default_route_table_association and transit_gateway_default_route_table_propagation are both 'true'.
+		transitGatewayDefaultRouteTableAssociation := true
+		if v := d.GetRawConfig().GetAttr("transit_gateway_default_route_table_association"); v.IsKnown() && !v.IsNull() {
+			transitGatewayDefaultRouteTableAssociation = v.True()
+		}
+
+		if err := transitGatewayRouteTableAssociationUpdate(ctx, conn, aws.StringValue(transitGateway.Options.AssociationDefaultRouteTableId), d.Id(), transitGatewayDefaultRouteTableAssociation); err != nil {
 			return sdkdiag.AppendErrorf(diags, "creating EC2 Transit Gateway VPC Attachment: %s", err)
 		}
 
-		if err := transitGatewayRouteTablePropagationUpdate(ctx, conn, aws.StringValue(transitGateway.Options.PropagationDefaultRouteTableId), d.Id(), d.Get("transit_gateway_default_route_table_propagation").(bool)); err != nil {
+		transitGatewayDefaultRouteTablePropagation := true
+		if v := d.GetRawConfig().GetAttr("transit_gateway_default_route_table_propagation"); v.IsKnown() && !v.IsNull() {
+			transitGatewayDefaultRouteTablePropagation = v.True()
+		}
+
+		if err := transitGatewayRouteTablePropagationUpdate(ctx, conn, aws.StringValue(transitGateway.Options.PropagationDefaultRouteTableId), d.Id(), transitGatewayDefaultRouteTablePropagation); err != nil {
 			return sdkdiag.AppendErrorf(diags, "creating EC2 Transit Gateway VPC Attachment: %s", err)
 		}
 	}
diff --git a/internal/service/ec2/transitgateway_vpc_attachment_accepter.go b/internal/service/ec2/transitgateway_vpc_attachment_accepter.go
index 5751ed7a53d..601fd793150 100644
--- a/internal/service/ec2/transitgateway_vpc_attachment_accepter.go
+++ b/internal/service/ec2/transitgateway_vpc_attachment_accepter.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/transitgateway_vpc_attachment_accepter_test.go b/internal/service/ec2/transitgateway_vpc_attachment_accepter_test.go
index 32a4c8c93f8..fae7e9ca933 100644
--- a/internal/service/ec2/transitgateway_vpc_attachment_accepter_test.go
+++ b/internal/service/ec2/transitgateway_vpc_attachment_accepter_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/transitgateway_vpc_attachment_data_source.go b/internal/service/ec2/transitgateway_vpc_attachment_data_source.go
index a2008c85d78..43d05f70ef1 100644
--- a/internal/service/ec2/transitgateway_vpc_attachment_data_source.go
+++ b/internal/service/ec2/transitgateway_vpc_attachment_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/transitgateway_vpc_attachment_data_source_test.go b/internal/service/ec2/transitgateway_vpc_attachment_data_source_test.go
index a8586e1e8d7..90645df320d 100644
--- a/internal/service/ec2/transitgateway_vpc_attachment_data_source_test.go
+++ b/internal/service/ec2/transitgateway_vpc_attachment_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
@@ -114,33 +117,9 @@ data "aws_ec2_transit_gateway_vpc_attachment" "test" {
 }
 
 func testAccTransitGatewayVPCAttachmentDataSourceConfig_id(rName string) string {
-	return acctest.ConfigCompose(acctest.ConfigAvailableAZsNoOptInDefaultExclude(), fmt.Sprintf(`
-resource "aws_vpc" "test" {
-  cidr_block = "10.0.0.0/16"
-
-  tags = {
-    Name = %[1]q
-  }
-}
-
-resource "aws_subnet" "test" {
-  availability_zone = data.aws_availability_zones.available.names[0]
-  cidr_block        = "10.0.0.0/24"
-  vpc_id            = aws_vpc.test.id
-
-  tags = {
-    Name = %[1]q
-  }
-}
-
-resource "aws_ec2_transit_gateway" "test" {
-  tags = {
-    Name = %[1]q
-  }
-}
-
+	return acctest.ConfigCompose(testAccTransitGatewayVPCAttachmentConfig_base(rName), fmt.Sprintf(`
 resource "aws_ec2_transit_gateway_vpc_attachment" "test" {
-  subnet_ids         = [aws_subnet.test.id]
+  subnet_ids         = aws_subnet.test[*].id
   transit_gateway_id = aws_ec2_transit_gateway.test.id
   vpc_id             = aws_vpc.test.id
 
diff --git a/internal/service/ec2/transitgateway_vpc_attachment_test.go b/internal/service/ec2/transitgateway_vpc_attachment_test.go
index d1b4ec969d1..93adb36512d 100644
--- a/internal/service/ec2/transitgateway_vpc_attachment_test.go
+++ b/internal/service/ec2/transitgateway_vpc_attachment_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
@@ -232,7 +235,7 @@ func testAccTransitGatewayVPCAttachment_SubnetIDs(t *testing.T) {
 		CheckDestroy:             testAccCheckTransitGatewayVPCAttachmentDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccTransitGatewayVPCAttachmentConfig_subnetIds2(rName),
+				Config: testAccTransitGatewayVPCAttachmentConfig_subnetIDs2(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckTransitGatewayVPCAttachmentExists(ctx, resourceName, &transitGatewayVpcAttachment1),
 					resource.TestCheckResourceAttr(resourceName, "subnet_ids.#", "2"),
@@ -244,7 +247,7 @@ func testAccTransitGatewayVPCAttachment_SubnetIDs(t *testing.T) {
 				ImportStateVerify: true,
 			},
 			{
-				Config: testAccTransitGatewayVPCAttachmentConfig_subnetIds1(rName),
+				Config: testAccTransitGatewayVPCAttachmentConfig_subnetIDs1(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckTransitGatewayVPCAttachmentExists(ctx, resourceName, &transitGatewayVpcAttachment2),
 					testAccCheckTransitGatewayVPCAttachmentNotRecreated(&transitGatewayVpcAttachment1, &transitGatewayVpcAttachment2),
@@ -252,7 +255,7 @@ func testAccTransitGatewayVPCAttachment_SubnetIDs(t *testing.T) {
 				),
 			},
 			{
-				Config: testAccTransitGatewayVPCAttachmentConfig_subnetIds2(rName),
+				Config: testAccTransitGatewayVPCAttachmentConfig_subnetIDs2(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckTransitGatewayVPCAttachmentExists(ctx, resourceName, &transitGatewayVpcAttachment3),
 					testAccCheckTransitGatewayVPCAttachmentNotRecreated(&transitGatewayVpcAttachment2, &transitGatewayVpcAttachment3),
@@ -511,25 +514,7 @@ func testAccCheckTransitGatewayVPCAttachmentNotRecreated(i, j *ec2.TransitGatewa
 }
 
 func testAccTransitGatewayVPCAttachmentConfig_base(rName string) string {
-	return acctest.ConfigCompose(acctest.ConfigAvailableAZsNoOptInDefaultExclude(), fmt.Sprintf(`
-resource "aws_vpc" "test" {
-  cidr_block = "10.0.0.0/16"
-
-  tags = {
-    Name = %[1]q
-  }
-}
-
-resource "aws_subnet" "test" {
-  availability_zone = data.aws_availability_zones.available.names[0]
-  cidr_block        = "10.0.0.0/24"
-  vpc_id            = aws_vpc.test.id
-
-  tags = {
-    Name = %[1]q
-  }
-}
-
+	return acctest.ConfigCompose(acctest.ConfigVPCWithSubnets(rName, 1), fmt.Sprintf(`
 resource "aws_ec2_transit_gateway" "test" {
   tags = {
     Name = %[1]q
@@ -541,7 +526,7 @@ resource "aws_ec2_transit_gateway" "test" {
 func testAccTransitGatewayVPCAttachmentConfig_basic(rName string) string {
 	return acctest.ConfigCompose(testAccTransitGatewayVPCAttachmentConfig_base(rName), `
 resource "aws_ec2_transit_gateway_vpc_attachment" "test" {
-  subnet_ids         = [aws_subnet.test.id]
+  subnet_ids         = aws_subnet.test[*].id
   transit_gateway_id = aws_ec2_transit_gateway.test.id
   vpc_id             = aws_vpc.test.id
 }
@@ -552,7 +537,7 @@ func testAccTransitGatewayVPCAttachmentConfig_applianceModeSupport(rName, appMod
 	return acctest.ConfigCompose(testAccTransitGatewayVPCAttachmentConfig_base(rName), fmt.Sprintf(`
 resource "aws_ec2_transit_gateway_vpc_attachment" "test" {
   appliance_mode_support = %[2]q
-  subnet_ids             = [aws_subnet.test.id]
+  subnet_ids             = aws_subnet.test[*].id
   transit_gateway_id     = aws_ec2_transit_gateway.test.id
   vpc_id                 = aws_vpc.test.id
 
@@ -567,7 +552,7 @@ func testAccTransitGatewayVPCAttachmentConfig_dnsSupport(rName, dnsSupport strin
 	return acctest.ConfigCompose(testAccTransitGatewayVPCAttachmentConfig_base(rName), fmt.Sprintf(`
 resource "aws_ec2_transit_gateway_vpc_attachment" "test" {
   dns_support        = %[2]q
-  subnet_ids         = [aws_subnet.test.id]
+  subnet_ids         = aws_subnet.test[*].id
   transit_gateway_id = aws_ec2_transit_gateway.test.id
   vpc_id             = aws_vpc.test.id
 
@@ -579,27 +564,7 @@ resource "aws_ec2_transit_gateway_vpc_attachment" "test" {
 }
 
 func testAccTransitGatewayVPCAttachmentConfig_ipv6Support(rName, ipv6Support string) string {
-	return acctest.ConfigCompose(acctest.ConfigAvailableAZsNoOptInDefaultExclude(), fmt.Sprintf(`
-resource "aws_vpc" "test" {
-  assign_generated_ipv6_cidr_block = true
-  cidr_block                       = "10.0.0.0/16"
-
-  tags = {
-    Name = %[1]q
-  }
-}
-
-resource "aws_subnet" "test" {
-  availability_zone = data.aws_availability_zones.available.names[0]
-  cidr_block        = "10.0.0.0/24"
-  ipv6_cidr_block   = cidrsubnet(aws_vpc.test.ipv6_cidr_block, 8, 1)
-  vpc_id            = aws_vpc.test.id
-
-  tags = {
-    Name = %[1]q
-  }
-}
-
+	return acctest.ConfigCompose(acctest.ConfigVPCWithSubnetsIPv6(rName, 1), fmt.Sprintf(`
 resource "aws_ec2_transit_gateway" "test" {
   tags = {
     Name = %[1]q
@@ -608,7 +573,7 @@ resource "aws_ec2_transit_gateway" "test" {
 
 resource "aws_ec2_transit_gateway_vpc_attachment" "test" {
   ipv6_support       = %[2]q
-  subnet_ids         = [aws_subnet.test.id]
+  subnet_ids         = aws_subnet.test[*].id
   transit_gateway_id = aws_ec2_transit_gateway.test.id
   vpc_id             = aws_vpc.test.id
 
@@ -620,10 +585,7 @@ resource "aws_ec2_transit_gateway_vpc_attachment" "test" {
 }
 
 func testAccTransitGatewayVPCAttachmentConfig_sharedTransitGateway(rName string) string {
-	return acctest.ConfigCompose(
-		acctest.ConfigAlternateAccountProvider(),
-		acctest.ConfigAvailableAZsNoOptInDefaultExclude(),
-		fmt.Sprintf(`
+	return acctest.ConfigCompose(acctest.ConfigAlternateAccountProvider(), acctest.ConfigVPCWithSubnets(rName, 1), fmt.Sprintf(`
 data "aws_organizations_organization" "test" {}
 
 resource "aws_ec2_transit_gateway" "test" {
@@ -654,28 +616,10 @@ resource "aws_ram_principal_association" "test" {
   resource_share_arn = aws_ram_resource_share.test.id
 }
 
-resource "aws_vpc" "test" {
-  cidr_block = "10.0.0.0/16"
-
-  tags = {
-    Name = %[1]q
-  }
-}
-
-resource "aws_subnet" "test" {
-  availability_zone = data.aws_availability_zones.available.names[0]
-  cidr_block        = "10.0.0.0/24"
-  vpc_id            = aws_vpc.test.id
-
-  tags = {
-    Name = %[1]q
-  }
-}
-
 resource "aws_ec2_transit_gateway_vpc_attachment" "test" {
   depends_on = [aws_ram_principal_association.test, aws_ram_resource_association.test]
 
-  subnet_ids         = [aws_subnet.test.id]
+  subnet_ids         = aws_subnet.test[*].id
   transit_gateway_id = aws_ec2_transit_gateway.test.id
   vpc_id             = aws_vpc.test.id
 
@@ -686,28 +630,8 @@ resource "aws_ec2_transit_gateway_vpc_attachment" "test" {
 `, rName))
 }
 
-func testAccTransitGatewayVPCAttachmentConfig_subnetIds1(rName string) string {
-	return acctest.ConfigCompose(acctest.ConfigAvailableAZsNoOptInDefaultExclude(), fmt.Sprintf(`
-resource "aws_vpc" "test" {
-  cidr_block = "10.0.0.0/16"
-
-  tags = {
-    Name = %[1]q
-  }
-}
-
-resource "aws_subnet" "test" {
-  count = 2
-
-  availability_zone = data.aws_availability_zones.available.names[count.index]
-  cidr_block        = "10.0.${count.index}.0/24"
-  vpc_id            = aws_vpc.test.id
-
-  tags = {
-    Name = %[1]q
-  }
-}
-
+func testAccTransitGatewayVPCAttachmentConfig_subnetIDs1(rName string) string {
+	return acctest.ConfigCompose(acctest.ConfigVPCWithSubnets(rName, 2), fmt.Sprintf(`
 resource "aws_ec2_transit_gateway" "test" {
   tags = {
     Name = %[1]q
@@ -726,28 +650,8 @@ resource "aws_ec2_transit_gateway_vpc_attachment" "test" {
 `, rName))
 }
 
-func testAccTransitGatewayVPCAttachmentConfig_subnetIds2(rName string) string {
-	return acctest.ConfigCompose(acctest.ConfigAvailableAZsNoOptInDefaultExclude(), fmt.Sprintf(`
-resource "aws_vpc" "test" {
-  cidr_block = "10.0.0.0/16"
-
-  tags = {
-    Name = %[1]q
-  }
-}
-
-resource "aws_subnet" "test" {
-  count = 2
-
-  availability_zone = data.aws_availability_zones.available.names[count.index]
-  cidr_block        = "10.0.${count.index}.0/24"
-  vpc_id            = aws_vpc.test.id
-
-  tags = {
-    Name = %[1]q
-  }
-}
-
+func testAccTransitGatewayVPCAttachmentConfig_subnetIDs2(rName string) string {
+	return acctest.ConfigCompose(acctest.ConfigVPCWithSubnets(rName, 2), fmt.Sprintf(`
 resource "aws_ec2_transit_gateway" "test" {
   tags = {
     Name = %[1]q
@@ -769,7 +673,7 @@ resource "aws_ec2_transit_gateway_vpc_attachment" "test" {
 func testAccTransitGatewayVPCAttachmentConfig_tags1(rName, tagKey1, tagValue1 string) string {
 	return acctest.ConfigCompose(testAccTransitGatewayVPCAttachmentConfig_base(rName), fmt.Sprintf(`
 resource "aws_ec2_transit_gateway_vpc_attachment" "test" {
-  subnet_ids         = [aws_subnet.test.id]
+  subnet_ids         = aws_subnet.test[*].id
   transit_gateway_id = aws_ec2_transit_gateway.test.id
   vpc_id             = aws_vpc.test.id
 
@@ -783,7 +687,7 @@ resource "aws_ec2_transit_gateway_vpc_attachment" "test" {
 func testAccTransitGatewayVPCAttachmentConfig_tags2(rName, tagKey1, tagValue1, tagKey2, tagValue2 string) string {
 	return acctest.ConfigCompose(testAccTransitGatewayVPCAttachmentConfig_base(rName), fmt.Sprintf(`
 resource "aws_ec2_transit_gateway_vpc_attachment" "test" {
-  subnet_ids         = [aws_subnet.test.id]
+  subnet_ids         = aws_subnet.test[*].id
   transit_gateway_id = aws_ec2_transit_gateway.test.id
   vpc_id             = aws_vpc.test.id
 
@@ -796,25 +700,7 @@ resource "aws_ec2_transit_gateway_vpc_attachment" "test" {
 }
 
 func testAccTransitGatewayVPCAttachmentConfig_defaultRouteTableAssociationAndPropagationDisabled(rName string) string {
-	return acctest.ConfigCompose(acctest.ConfigAvailableAZsNoOptInDefaultExclude(), fmt.Sprintf(`
-resource "aws_vpc" "test" {
-  cidr_block = "10.0.0.0/16"
-
-  tags = {
-    Name = %[1]q
-  }
-}
-
-resource "aws_subnet" "test" {
-  availability_zone = data.aws_availability_zones.available.names[0]
-  cidr_block        = "10.0.0.0/24"
-  vpc_id            = aws_vpc.test.id
-
-  tags = {
-    Name = %[1]q
-  }
-}
-
+	return acctest.ConfigCompose(acctest.ConfigVPCWithSubnets(rName, 1), fmt.Sprintf(`
 resource "aws_ec2_transit_gateway" "test" {
   default_route_table_association = "disable"
   default_route_table_propagation = "disable"
@@ -825,7 +711,7 @@ resource "aws_ec2_transit_gateway" "test" {
 }
 
 resource "aws_ec2_transit_gateway_vpc_attachment" "test" {
-  subnet_ids                                      = [aws_subnet.test.id]
+  subnet_ids                                      = aws_subnet.test[*].id
   transit_gateway_default_route_table_association = false
   transit_gateway_default_route_table_propagation = false
   transit_gateway_id                              = aws_ec2_transit_gateway.test.id
@@ -841,7 +727,7 @@ resource "aws_ec2_transit_gateway_vpc_attachment" "test" {
 func testAccTransitGatewayVPCAttachmentConfig_defaultRouteTableAssociation(rName string, transitGatewayDefaultRouteTableAssociation bool) string {
 	return acctest.ConfigCompose(testAccTransitGatewayVPCAttachmentConfig_base(rName), fmt.Sprintf(`
 resource "aws_ec2_transit_gateway_vpc_attachment" "test" {
-  subnet_ids                                      = [aws_subnet.test.id]
+  subnet_ids                                      = aws_subnet.test[*].id
   transit_gateway_default_route_table_association = %[2]t
   transit_gateway_id                              = aws_ec2_transit_gateway.test.id
   vpc_id                                          = aws_vpc.test.id
@@ -856,7 +742,7 @@ resource "aws_ec2_transit_gateway_vpc_attachment" "test" {
 func testAccTransitGatewayVPCAttachmentConfig_defaultRouteTablePropagation(rName string, transitGatewayDefaultRouteTablePropagation bool) string {
 	return acctest.ConfigCompose(testAccTransitGatewayVPCAttachmentConfig_base(rName), fmt.Sprintf(`
 resource "aws_ec2_transit_gateway_vpc_attachment" "test" {
-  subnet_ids                                      = [aws_subnet.test.id]
+  subnet_ids                                      = aws_subnet.test[*].id
   transit_gateway_default_route_table_propagation = %[2]t
   transit_gateway_id                              = aws_ec2_transit_gateway.test.id
   vpc_id                                          = aws_vpc.test.id
diff --git a/internal/service/ec2/transitgateway_vpc_attachments_data_source.go b/internal/service/ec2/transitgateway_vpc_attachments_data_source.go
index 545fdd3a3cb..6a5a579e720 100644
--- a/internal/service/ec2/transitgateway_vpc_attachments_data_source.go
+++ b/internal/service/ec2/transitgateway_vpc_attachments_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -21,7 +24,7 @@ func DataSourceTransitGatewayVPCAttachments() *schema.Resource {
 		},
 
 		Schema: map[string]*schema.Schema{
-			"filter": DataSourceFiltersSchema(),
+			"filter": CustomFiltersSchema(),
 			"ids": {
 				Type:     schema.TypeList,
 				Computed: true,
@@ -36,7 +39,7 @@ func dataSourceTransitGatewayVPCAttachmentsRead(ctx context.Context, d *schema.R
 
 	input := &ec2.DescribeTransitGatewayVpcAttachmentsInput{}
 
-	input.Filters = append(input.Filters, BuildFiltersDataSource(
+	input.Filters = append(input.Filters, BuildCustomFilterList(
 		d.Get("filter").(*schema.Set),
 	)...)
 
diff --git a/internal/service/ec2/transitgateway_vpc_attachments_data_source_test.go b/internal/service/ec2/transitgateway_vpc_attachments_data_source_test.go
index f90b7a91619..1b666f004b2 100644
--- a/internal/service/ec2/transitgateway_vpc_attachments_data_source_test.go
+++ b/internal/service/ec2/transitgateway_vpc_attachments_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/transitgateway_vpn_attachment_data_source.go b/internal/service/ec2/transitgateway_vpn_attachment_data_source.go
index ea1f540be63..eaba84041a2 100644
--- a/internal/service/ec2/transitgateway_vpn_attachment_data_source.go
+++ b/internal/service/ec2/transitgateway_vpn_attachment_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/transitgateway_vpn_attachment_data_source_test.go b/internal/service/ec2/transitgateway_vpn_attachment_data_source_test.go
index dd1e7057749..3ab566e1bd5 100644
--- a/internal/service/ec2/transitgateway_vpn_attachment_data_source_test.go
+++ b/internal/service/ec2/transitgateway_vpn_attachment_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/validate.go b/internal/service/ec2/validate.go
index 830a1eb1132..a3ad8d85123 100644
--- a/internal/service/ec2/validate.go
+++ b/internal/service/ec2/validate.go
@@ -1,9 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
 	"fmt"
-	"regexp"
 	"strings"
+
+	"github.com/YakDriver/regexache"
 )
 
 func validSecurityGroupRuleDescription(v interface{}, k string) (ws []string, errors []error) {
@@ -15,8 +19,8 @@ func validSecurityGroupRuleDescription(v interface{}, k string) (ws []string, er
 
 	// https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_IpRange.html. Note that
 	// "" is an allowable description value.
-	pattern := `^[A-Za-z0-9 \.\_\-\:\/\(\)\#\,\@\[\]\+\=\&\;\{\}\!\$\*]*$`
-	if !regexp.MustCompile(pattern).MatchString(value) {
+	pattern := `^[0-9A-Za-z_ .:/()#,@\[\]+=&;{}!$*-]*$`
+	if !regexache.MustCompile(pattern).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"%q doesn't comply with restrictions (%q): %q",
 			k, pattern, value))
diff --git a/internal/service/ec2/validate_test.go b/internal/service/ec2/validate_test.go
index 121c7323a26..85a7e6f48e4 100644
--- a/internal/service/ec2/validate_test.go
+++ b/internal/service/ec2/validate_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/verifiedaccess_group.go b/internal/service/ec2/verifiedaccess_group.go
new file mode 100644
index 00000000000..804ecb00f4a
--- /dev/null
+++ b/internal/service/ec2/verifiedaccess_group.go
@@ -0,0 +1,208 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package ec2
+
+import (
+	"context"
+	"log"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/ec2"
+	"github.com/aws/aws-sdk-go-v2/service/ec2/types"
+	"github.com/hashicorp/aws-sdk-go-base/v2/tfawserr"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
+	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/internal/verify"
+	"github.com/hashicorp/terraform-provider-aws/names"
+)
+
+// @SDKResource("aws_verifiedaccess_group", name="Verified Access Group")
+// @Tags(identifierAttribute="id")
+func ResourceVerifiedAccessGroup() *schema.Resource {
+	return &schema.Resource{
+		CreateWithoutTimeout: resourceVerifiedAccessGroupCreate,
+		ReadWithoutTimeout:   resourceVerifiedAccessGroupRead,
+		UpdateWithoutTimeout: resourceVerifiedAccessGroupUpdate,
+		DeleteWithoutTimeout: resourceVerifiedAccessGroupDelete,
+
+		Importer: &schema.ResourceImporter{
+			StateContext: schema.ImportStatePassthroughContext,
+		},
+
+		Schema: map[string]*schema.Schema{
+			"creation_time": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"deletion_time": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"description": {
+				Type:     schema.TypeString,
+				Computed: true,
+				Optional: true,
+			},
+			"last_updated_time": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"owner": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"policy_document": {
+				Type:     schema.TypeString,
+				Optional: true,
+			},
+			names.AttrTags:    tftags.TagsSchema(),
+			names.AttrTagsAll: tftags.TagsSchemaComputed(),
+			"verifiedaccess_group_arn": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"verifiedaccess_group_id": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"verifiedaccess_instance_id": {
+				Type:     schema.TypeString,
+				Required: true,
+			},
+		},
+
+		CustomizeDiff: verify.SetTagsDiff,
+	}
+}
+
+func resourceVerifiedAccessGroupCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).EC2Client(ctx)
+
+	input := &ec2.CreateVerifiedAccessGroupInput{
+		TagSpecifications:        getTagSpecificationsInV2(ctx, types.ResourceTypeVerifiedAccessGroup),
+		VerifiedAccessInstanceId: aws.String(d.Get("verifiedaccess_instance_id").(string)),
+	}
+
+	if v, ok := d.GetOk("description"); ok {
+		input.Description = aws.String(v.(string))
+	}
+
+	if v, ok := d.GetOk("policy_document"); ok {
+		input.PolicyDocument = aws.String(v.(string))
+	}
+
+	output, err := conn.CreateVerifiedAccessGroup(ctx, input)
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "creating Verified Access Group: %s", err)
+	}
+
+	d.SetId(aws.ToString(output.VerifiedAccessGroup.VerifiedAccessGroupId))
+
+	return append(diags, resourceVerifiedAccessGroupRead(ctx, d, meta)...)
+}
+
+func resourceVerifiedAccessGroupRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).EC2Client(ctx)
+
+	group, err := FindVerifiedAccessGroupByID(ctx, conn, d.Id())
+
+	if !d.IsNewResource() && tfresource.NotFound(err) {
+		log.Printf("[WARN] EC2 Verified Access Group (%s) not found, removing from state", d.Id())
+		d.SetId("")
+		return diags
+	}
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "reading Verified Access Group (%s): %s", d.Id(), err)
+	}
+
+	d.Set("creation_time", group.CreationTime)
+	d.Set("deletion_time", group.DeletionTime)
+	d.Set("description", group.Description)
+	d.Set("last_updated_time", group.LastUpdatedTime)
+	d.Set("owner", group.Owner)
+	d.Set("verifiedaccess_group_arn", group.VerifiedAccessGroupArn)
+	d.Set("verifiedaccess_group_id", group.VerifiedAccessGroupId)
+	d.Set("verifiedaccess_instance_id", group.VerifiedAccessInstanceId)
+
+	setTagsOutV2(ctx, group.Tags)
+
+	output, err := FindVerifiedAccessGroupPolicyByID(ctx, conn, d.Id())
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "reading Verified Access Group (%s) policy: %s", d.Id(), err)
+	}
+
+	d.Set("policy_document", output.PolicyDocument)
+
+	return diags
+}
+
+func resourceVerifiedAccessGroupUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).EC2Client(ctx)
+
+	if d.HasChangesExcept("policy_document", "tags", "tags_all") {
+		input := &ec2.ModifyVerifiedAccessGroupInput{
+			VerifiedAccessGroupId: aws.String(d.Id()),
+		}
+
+		if d.HasChange("description") {
+			input.Description = aws.String(d.Get("description").(string))
+		}
+
+		if d.HasChange("verified_access_instance_id") {
+			input.VerifiedAccessInstanceId = aws.String(d.Get("description").(string))
+		}
+
+		_, err := conn.ModifyVerifiedAccessGroup(ctx, input)
+
+		if err != nil {
+			return sdkdiag.AppendErrorf(diags, "updating Verified Access Group (%s): %s", d.Id(), err)
+		}
+	}
+
+	if d.HasChange("policy_document") {
+		input := &ec2.ModifyVerifiedAccessGroupPolicyInput{
+			PolicyDocument:        aws.String(d.Get("policy_document").(string)),
+			VerifiedAccessGroupId: aws.String(d.Id()),
+			PolicyEnabled:         aws.Bool(true),
+		}
+
+		_, err := conn.ModifyVerifiedAccessGroupPolicy(ctx, input)
+
+		if err != nil {
+			return sdkdiag.AppendErrorf(diags, "updating Verified Access Group (%s) policy: %s", d.Id(), err)
+		}
+	}
+
+	return append(diags, resourceVerifiedAccessGroupRead(ctx, d, meta)...)
+}
+
+func resourceVerifiedAccessGroupDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).EC2Client(ctx)
+
+	log.Printf("[INFO] Deleting Verified Access Group: %s", d.Id())
+	_, err := conn.DeleteVerifiedAccessGroup(ctx, &ec2.DeleteVerifiedAccessGroupInput{
+		VerifiedAccessGroupId: aws.String(d.Id()),
+	})
+
+	if tfawserr.ErrCodeEquals(err, errCodeInvalidVerifiedAccessGroupIdNotFound) {
+		return diags
+	}
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "deleting Verified Access Group (%s): %s", d.Id(), err)
+	}
+
+	return diags
+}
diff --git a/internal/service/ec2/verifiedaccess_group_test.go b/internal/service/ec2/verifiedaccess_group_test.go
new file mode 100644
index 00000000000..39408fa3928
--- /dev/null
+++ b/internal/service/ec2/verifiedaccess_group_test.go
@@ -0,0 +1,406 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package ec2_test
+
+import (
+	"context"
+	"fmt"
+	"testing"
+
+	"github.com/aws/aws-sdk-go-v2/service/ec2/types"
+	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
+	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	tfec2 "github.com/hashicorp/terraform-provider-aws/internal/service/ec2"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/names"
+)
+
+func TestAccVerifiedAccessGroup_basic(t *testing.T) {
+	ctx := acctest.Context(t)
+	var v types.VerifiedAccessGroup
+	resourceName := "aws_verifiedaccess_group.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			testAccPreCheckVerifiedAccess(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, names.EC2),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckVerifiedAccessGroupDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccVerifiedAccessGroupConfig_basic(rName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckVerifiedAccessGroupExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttrSet(resourceName, "creation_time"),
+					resource.TestCheckResourceAttr(resourceName, "deletion_time", ""),
+					resource.TestCheckResourceAttr(resourceName, "description", ""),
+					resource.TestCheckResourceAttrSet(resourceName, "last_updated_time"),
+					acctest.CheckResourceAttrAccountID(resourceName, "owner"),
+					resource.TestCheckResourceAttr(resourceName, "policy_document", ""),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
+					resource.TestCheckResourceAttrSet(resourceName, "verifiedaccess_group_arn"),
+					resource.TestCheckResourceAttrSet(resourceName, "verifiedaccess_group_id"),
+					resource.TestCheckResourceAttrSet(resourceName, "verifiedaccess_instance_id"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
+func TestAccVerifiedAccessGroup_disappears(t *testing.T) {
+	ctx := acctest.Context(t)
+	var v types.VerifiedAccessGroup
+	resourceName := "aws_verifiedaccess_group.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			testAccPreCheckVerifiedAccess(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, names.EC2),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckVerifiedAccessGroupDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccVerifiedAccessGroupConfig_tags1(rName, "key1", "value1"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckVerifiedAccessGroupExists(ctx, resourceName, &v),
+					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfec2.ResourceVerifiedAccessGroup(), resourceName),
+				),
+				ExpectNonEmptyPlan: true,
+			},
+		},
+	})
+}
+
+func TestAccVerifiedAccessGroup_tags(t *testing.T) {
+	ctx := acctest.Context(t)
+	var v types.VerifiedAccessGroup
+	resourceName := "aws_verifiedaccess_group.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			testAccPreCheckVerifiedAccess(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, names.EC2),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckVerifiedAccessGroupDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccVerifiedAccessGroupConfig_tags1(rName, "key1", "value1"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckVerifiedAccessGroupExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
+				),
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{},
+			},
+			{
+				Config: testAccVerifiedAccessGroupConfig_tags2(rName, "key1", "value1updated", "key2", "value2"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckVerifiedAccessGroupExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1updated"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
+				),
+			},
+			{
+				Config: testAccVerifiedAccessGroupConfig_tags1(rName, "key2", "value2"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckVerifiedAccessGroupExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccVerifiedAccessGroup_policy(t *testing.T) {
+	ctx := acctest.Context(t)
+	var v types.VerifiedAccessGroup
+	resourceName := "aws_verifiedaccess_group.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	description := sdkacctest.RandString(100)
+	policyDoc := "permit(principal, action, resource) \nwhen {\ncontext.http_request.method == \"GET\"\n};"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			testAccPreCheckVerifiedAccess(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, names.EC2),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckVerifiedAccessGroupDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccVerifiedAccessGroupConfig_policy(rName, description, policyDoc),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckVerifiedAccessGroupExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "description", description),
+					resource.TestCheckResourceAttr(resourceName, "policy_document", policyDoc),
+				),
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{},
+			},
+		},
+	})
+}
+
+func TestAccVerifiedAccessGroup_updatePolicy(t *testing.T) {
+	ctx := acctest.Context(t)
+	var v types.VerifiedAccessGroup
+	resourceName := "aws_verifiedaccess_group.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	description := sdkacctest.RandString(100)
+	policyDoc := "permit(principal, action, resource) \nwhen {\ncontext.http_request.method == \"GET\"\n};"
+	policyDocUpdate := "permit(principal, action, resource) \nwhen {\ncontext.http_request.method == \"POST\"\n};"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			testAccPreCheckVerifiedAccess(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, names.EC2),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckVerifiedAccessGroupDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccVerifiedAccessGroupConfig_policy(rName, description, policyDoc),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckVerifiedAccessGroupExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "description", description),
+					resource.TestCheckResourceAttr(resourceName, "policy_document", policyDoc),
+				),
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{},
+			},
+			{
+				Config: testAccVerifiedAccessGroupConfig_policy(rName, description, policyDocUpdate),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckVerifiedAccessGroupExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "description", description),
+					resource.TestCheckResourceAttr(resourceName, "policy_document", policyDocUpdate),
+				),
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{},
+			},
+		},
+	})
+}
+func TestAccVerifiedAccessGroup_setPolicy(t *testing.T) {
+	ctx := acctest.Context(t)
+	var v types.VerifiedAccessGroup
+	resourceName := "aws_verifiedaccess_group.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	description := sdkacctest.RandString(100)
+	policyDoc := "permit(principal, action, resource) \nwhen {\ncontext.http_request.method == \"GET\"\n};"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			testAccPreCheckVerifiedAccess(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, names.EC2),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckVerifiedAccessGroupDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccVerifiedAccessGroupConfig_basic(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckVerifiedAccessGroupExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttrSet(resourceName, "creation_time"),
+					resource.TestCheckResourceAttr(resourceName, "deletion_time", ""),
+					resource.TestCheckResourceAttr(resourceName, "description", ""),
+					resource.TestCheckResourceAttrSet(resourceName, "last_updated_time"),
+					acctest.CheckResourceAttrAccountID(resourceName, "owner"),
+					resource.TestCheckResourceAttr(resourceName, "policy_document", ""),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
+					resource.TestCheckResourceAttrSet(resourceName, "verifiedaccess_group_arn"),
+					resource.TestCheckResourceAttrSet(resourceName, "verifiedaccess_group_id"),
+					resource.TestCheckResourceAttrSet(resourceName, "verifiedaccess_instance_id"),
+				),
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{},
+			},
+			{
+				Config: testAccVerifiedAccessGroupConfig_policy(rName, description, policyDoc),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckVerifiedAccessGroupExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "description", description),
+					resource.TestCheckResourceAttr(resourceName, "policy_document", policyDoc),
+				),
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{},
+			},
+		},
+	})
+}
+
+func testAccCheckVerifiedAccessGroupExists(ctx context.Context, n string, v *types.VerifiedAccessGroup) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		conn := acctest.Provider.Meta().(*conns.AWSClient).EC2Client(ctx)
+
+		output, err := tfec2.FindVerifiedAccessGroupByID(ctx, conn, rs.Primary.ID)
+
+		if err != nil {
+			return err
+		}
+
+		*v = *output
+
+		return nil
+	}
+}
+
+func testAccCheckVerifiedAccessGroupDestroy(ctx context.Context) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		conn := acctest.Provider.Meta().(*conns.AWSClient).EC2Client(ctx)
+
+		for _, rs := range s.RootModule().Resources {
+			if rs.Type != "aws_verifiedaccess_group" {
+				continue
+			}
+
+			_, err := tfec2.FindVerifiedAccessGroupByID(ctx, conn, rs.Primary.ID)
+
+			if tfresource.NotFound(err) {
+				continue
+			}
+
+			if err != nil {
+				return err
+			}
+
+			return fmt.Errorf("Verified Access Group %s still exists", rs.Primary.ID)
+		}
+		return nil
+	}
+}
+
+func testAccVerifiedAccessGroupConfig_base(rName string) string {
+	return fmt.Sprintf(`
+resource "aws_verifiedaccess_instance" "test" {
+  tags = {
+    Name = %[1]q
+  }
+}
+
+resource "aws_verifiedaccess_trust_provider" "test" {
+  policy_reference_name    = "test"
+  trust_provider_type      = "user"
+  user_trust_provider_type = "oidc"
+
+  oidc_options {
+    authorization_endpoint = "https://example.com/authorization_endpoint"
+    client_id              = "s6BhdRkqt3"
+    client_secret          = "7Fjfp0ZBr1KtDRbnfVdmIw"
+    issuer                 = "https://example.com"
+    scope                  = "test"
+    token_endpoint         = "https://example.com/token_endpoint"
+    user_info_endpoint     = "https://example.com/user_info_endpoint"
+  }
+
+  tags = {
+    Name = %[1]q
+  }
+}
+
+resource "aws_verifiedaccess_instance_trust_provider_attachment" "test" {
+  verifiedaccess_instance_id       = aws_verifiedaccess_instance.test.id
+  verifiedaccess_trust_provider_id = aws_verifiedaccess_trust_provider.test.id
+}
+`, rName)
+}
+
+func testAccVerifiedAccessGroupConfig_basic(rName string) string {
+	return acctest.ConfigCompose(testAccVerifiedAccessGroupConfig_base(rName), `
+resource "aws_verifiedaccess_group" "test" {
+  verifiedaccess_instance_id = aws_verifiedaccess_instance_trust_provider_attachment.test.verifiedaccess_instance_id
+}
+`)
+}
+
+func testAccVerifiedAccessGroupConfig_tags1(rName, tagKey1, tagValue1 string) string {
+	return acctest.ConfigCompose(testAccVerifiedAccessGroupConfig_base(rName), fmt.Sprintf(`
+resource "aws_verifiedaccess_group" "test" {
+  verifiedaccess_instance_id = aws_verifiedaccess_instance_trust_provider_attachment.test.verifiedaccess_instance_id
+
+  tags = {
+    %[1]q = %[2]q
+  }
+}
+`, tagKey1, tagValue1))
+}
+
+func testAccVerifiedAccessGroupConfig_tags2(rName, tagKey1, tagValue1, tagKey2, tagValue2 string) string {
+	return acctest.ConfigCompose(testAccVerifiedAccessGroupConfig_base(rName), fmt.Sprintf(`
+resource "aws_verifiedaccess_group" "test" {
+  verifiedaccess_instance_id = aws_verifiedaccess_instance_trust_provider_attachment.test.verifiedaccess_instance_id
+
+  tags = {
+    %[1]q = %[2]q
+    %[3]q = %[4]q
+  }
+}
+`, tagKey1, tagValue1, tagKey2, tagValue2))
+}
+
+func testAccVerifiedAccessGroupConfig_policy(rName, description, policy string) string {
+	return acctest.ConfigCompose(testAccVerifiedAccessGroupConfig_base(rName), fmt.Sprintf(`
+resource "aws_verifiedaccess_group" "test" {
+  verifiedaccess_instance_id = aws_verifiedaccess_instance_trust_provider_attachment.test.verifiedaccess_instance_id
+  description                = %[2]q
+  policy_document            = %[3]q
+
+  tags = {
+    Name = %[1]q
+  }
+}
+`, rName, description, policy))
+}
diff --git a/internal/service/ec2/verifiedaccess_instance.go b/internal/service/ec2/verifiedaccess_instance.go
new file mode 100644
index 00000000000..35befa437df
--- /dev/null
+++ b/internal/service/ec2/verifiedaccess_instance.go
@@ -0,0 +1,233 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package ec2
+
+import (
+	"context"
+	"log"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/ec2"
+	"github.com/aws/aws-sdk-go-v2/service/ec2/types"
+	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
+	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/internal/verify"
+	"github.com/hashicorp/terraform-provider-aws/names"
+)
+
+// @SDKResource("aws_verifiedaccess_instance", name="Verified Access Instance")
+// @Tags(identifierAttribute="id")
+func ResourceVerifiedAccessInstance() *schema.Resource {
+	return &schema.Resource{
+		CreateWithoutTimeout: resourceVerifiedAccessInstanceCreate,
+		ReadWithoutTimeout:   resourceVerifiedAccessInstanceRead,
+		UpdateWithoutTimeout: resourceVerifiedAccessInstanceUpdate,
+		DeleteWithoutTimeout: resourceVerifiedAccessInstanceDelete,
+
+		Importer: &schema.ResourceImporter{
+			StateContext: schema.ImportStatePassthroughContext,
+		},
+
+		Schema: map[string]*schema.Schema{
+			"creation_time": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"description": {
+				Type:     schema.TypeString,
+				Optional: true,
+			},
+			"fips_enabled": {
+				Type:     schema.TypeBool,
+				Optional: true,
+				ForceNew: true,
+			},
+			"last_updated_time": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"verified_access_trust_providers": {
+				Type:     schema.TypeList,
+				Computed: true,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"description": {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+						"device_trust_provider_type": {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+						"trust_provider_type": {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+						"user_trust_provider_type": {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+						"verified_access_trust_provider_id": {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+					},
+				},
+			},
+			names.AttrTags:    tftags.TagsSchema(),
+			names.AttrTagsAll: tftags.TagsSchemaComputed(),
+		},
+
+		CustomizeDiff: verify.SetTagsDiff,
+	}
+}
+
+func resourceVerifiedAccessInstanceCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).EC2Client(ctx)
+
+	input := &ec2.CreateVerifiedAccessInstanceInput{
+		ClientToken:       aws.String(id.UniqueId()),
+		TagSpecifications: getTagSpecificationsInV2(ctx, types.ResourceTypeVerifiedAccessInstance),
+	}
+
+	if v, ok := d.GetOk("description"); ok {
+		input.Description = aws.String(v.(string))
+	}
+
+	if v, ok := d.GetOk("fips_enabled"); ok {
+		input.FIPSEnabled = aws.Bool(v.(bool))
+	}
+
+	output, err := conn.CreateVerifiedAccessInstance(ctx, input)
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "creating Verified Access Instance: %s", err)
+	}
+
+	d.SetId(aws.ToString(output.VerifiedAccessInstance.VerifiedAccessInstanceId))
+
+	return append(diags, resourceVerifiedAccessInstanceRead(ctx, d, meta)...)
+}
+
+func resourceVerifiedAccessInstanceRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).EC2Client(ctx)
+
+	output, err := FindVerifiedAccessInstanceByID(ctx, conn, d.Id())
+
+	if !d.IsNewResource() && tfresource.NotFound(err) {
+		log.Printf("[WARN] EC2 Verified Access Instance (%s) not found, removing from state", d.Id())
+		d.SetId("")
+		return diags
+	}
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "reading Verified Access Instance (%s): %s", d.Id(), err)
+	}
+
+	d.Set("creation_time", output.CreationTime)
+	d.Set("description", output.Description)
+	d.Set("fips_enabled", output.FipsEnabled)
+	d.Set("last_updated_time", output.LastUpdatedTime)
+
+	if v := output.VerifiedAccessTrustProviders; v != nil {
+		if err := d.Set("verified_access_trust_providers", flattenVerifiedAccessTrustProviders(v)); err != nil {
+			return sdkdiag.AppendErrorf(diags, "setting verified_access_trust_providers: %s", err)
+		}
+	} else {
+		d.Set("verified_access_trust_providers", nil)
+	}
+
+	setTagsOutV2(ctx, output.Tags)
+
+	return diags
+}
+
+func resourceVerifiedAccessInstanceUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).EC2Client(ctx)
+
+	if d.HasChangesExcept("tags", "tags_all") {
+		input := &ec2.ModifyVerifiedAccessInstanceInput{
+			ClientToken:              aws.String(id.UniqueId()),
+			VerifiedAccessInstanceId: aws.String(d.Id()),
+		}
+
+		if d.HasChange("description") {
+			input.Description = aws.String(d.Get("description").(string))
+		}
+
+		_, err := conn.ModifyVerifiedAccessInstance(ctx, input)
+
+		if err != nil {
+			return sdkdiag.AppendErrorf(diags, "updating Verified Access Instance (%s): %s", d.Id(), err)
+		}
+	}
+
+	return append(diags, resourceVerifiedAccessInstanceRead(ctx, d, meta)...)
+}
+
+func resourceVerifiedAccessInstanceDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).EC2Client(ctx)
+
+	log.Printf("[INFO] Deleting Verified Access Instance: %s", d.Id())
+	_, err := conn.DeleteVerifiedAccessInstance(ctx, &ec2.DeleteVerifiedAccessInstanceInput{
+		ClientToken:              aws.String(id.UniqueId()),
+		VerifiedAccessInstanceId: aws.String(d.Id()),
+	})
+
+	if tfawserr.ErrCodeEquals(err, errCodeInvalidVerifiedAccessInstanceIdNotFound) {
+		return diags
+	}
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "deleting Verified Access Instance (%s): %s", d.Id(), err)
+	}
+
+	return diags
+}
+
+func flattenVerifiedAccessTrustProviders(apiObjects []types.VerifiedAccessTrustProviderCondensed) []interface{} {
+	if len(apiObjects) == 0 {
+		return nil
+	}
+
+	var tfList []interface{}
+
+	for _, apiObject := range apiObjects {
+		v := flattenVerifiedAccessTrustProvider(apiObject)
+
+		if len(v) > 0 {
+			tfList = append(tfList, v)
+		}
+	}
+
+	return tfList
+}
+
+func flattenVerifiedAccessTrustProvider(apiObject types.VerifiedAccessTrustProviderCondensed) map[string]interface{} {
+	tfMap := map[string]interface{}{
+		"device_trust_provider_type": string(apiObject.DeviceTrustProviderType),
+		"trust_provider_type":        string(apiObject.TrustProviderType),
+		"user_trust_provider_type":   string(apiObject.UserTrustProviderType),
+	}
+
+	if v := apiObject.Description; v != nil {
+		tfMap["description"] = aws.ToString(v)
+	}
+
+	if v := apiObject.VerifiedAccessTrustProviderId; v != nil {
+		tfMap["verified_access_trust_provider_id"] = aws.ToString(v)
+	}
+
+	return tfMap
+}
diff --git a/internal/service/ec2/verifiedaccess_instance_logging_configuration.go b/internal/service/ec2/verifiedaccess_instance_logging_configuration.go
new file mode 100644
index 00000000000..36433569227
--- /dev/null
+++ b/internal/service/ec2/verifiedaccess_instance_logging_configuration.go
@@ -0,0 +1,446 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package ec2
+
+import (
+	"context"
+	"log"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/ec2"
+	"github.com/aws/aws-sdk-go-v2/service/ec2/types"
+	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/hashicorp/go-uuid"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/internal/verify"
+)
+
+const (
+	DefaultLogVersionValue = "ocsf-1.0.0-rc.2"
+)
+
+// @SDKResource("aws_verifiedaccess_instance_logging_configuration", name="Verified Access Instance Logging Configuration")
+func ResourceVerifiedAccessInstanceLoggingConfiguration() *schema.Resource {
+	return &schema.Resource{
+		CreateWithoutTimeout: resourceVerifiedAccessInstanceLoggingConfigurationCreate,
+		ReadWithoutTimeout:   resourceVerifiedAccessInstanceLoggingConfigurationRead,
+		UpdateWithoutTimeout: resourceVerifiedAccessInstanceLoggingConfigurationUpdate,
+		DeleteWithoutTimeout: resourceVerifiedAccessInstanceLoggingConfigurationDelete,
+
+		Importer: &schema.ResourceImporter{
+			StateContext: schema.ImportStatePassthroughContext,
+		},
+
+		Schema: map[string]*schema.Schema{
+			"access_logs": {
+				Type:     schema.TypeList,
+				Required: true,
+				MaxItems: 1,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"cloudwatch_logs": {
+							Type:             schema.TypeList,
+							MaxItems:         1,
+							Optional:         true,
+							DiffSuppressFunc: verify.SuppressMissingOptionalConfigurationBlock,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"enabled": {
+										Type:     schema.TypeBool,
+										Required: true,
+									},
+									"log_group": {
+										Type:     schema.TypeString,
+										Optional: true,
+									},
+								},
+							},
+						},
+						"include_trust_context": {
+							Type:     schema.TypeBool,
+							Optional: true,
+							Computed: true,
+						},
+						"kinesis_data_firehose": {
+							Type:             schema.TypeList,
+							Optional:         true,
+							MaxItems:         1,
+							DiffSuppressFunc: verify.SuppressMissingOptionalConfigurationBlock,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"delivery_stream": {
+										Type:     schema.TypeString,
+										Optional: true,
+									},
+									"enabled": {
+										Type:     schema.TypeBool,
+										Required: true,
+									},
+								},
+							},
+						},
+						"log_version": {
+							Type:     schema.TypeString,
+							Optional: true,
+							Computed: true,
+						},
+						"s3": {
+							Type:             schema.TypeList,
+							Optional:         true,
+							MaxItems:         1,
+							DiffSuppressFunc: verify.SuppressMissingOptionalConfigurationBlock,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"bucket_name": {
+										Type:     schema.TypeString,
+										Optional: true,
+									},
+									"bucket_owner": {
+										Type:         schema.TypeString,
+										Optional:     true,
+										Computed:     true, // Describe API returns this value if not set
+										ValidateFunc: verify.ValidAccountID,
+									},
+									"enabled": {
+										Type:     schema.TypeBool,
+										Required: true,
+									},
+									"prefix": {
+										Type:     schema.TypeString,
+										Optional: true,
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+			"verifiedaccess_instance_id": {
+				Type:     schema.TypeString,
+				ForceNew: true,
+				Required: true,
+			},
+		},
+	}
+}
+
+func resourceVerifiedAccessInstanceLoggingConfigurationCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).EC2Client(ctx)
+
+	vaiID := d.Get("verifiedaccess_instance_id").(string)
+
+	uuid, err := uuid.GenerateUUID()
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "generating uuid for ClientToken for Verified Access Instance Logging Configuration %s): %s", vaiID, err)
+	}
+
+	input := &ec2.ModifyVerifiedAccessInstanceLoggingConfigurationInput{
+		AccessLogs:               expandVerifiedAccessInstanceAccessLogs(d.Get("access_logs").([]interface{})),
+		ClientToken:              aws.String(uuid), // can't use aws.String(id.UniqueId()), because it's not a valid uuid
+		VerifiedAccessInstanceId: aws.String(vaiID),
+	}
+
+	output, err := conn.ModifyVerifiedAccessInstanceLoggingConfiguration(ctx, input)
+
+	if err != nil || output == nil {
+		return sdkdiag.AppendErrorf(diags, "creating Verified Access Instance Logging Configuration (%s): %s", vaiID, err)
+	}
+
+	d.SetId(vaiID)
+
+	return append(diags, resourceVerifiedAccessInstanceLoggingConfigurationRead(ctx, d, meta)...)
+}
+
+func resourceVerifiedAccessInstanceLoggingConfigurationRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).EC2Client(ctx)
+
+	vaiID := d.Id()
+
+	output, err := FindVerifiedAccessInstanceLoggingConfigurationByInstanceID(ctx, conn, vaiID)
+
+	if !d.IsNewResource() && tfresource.NotFound(err) {
+		log.Printf("[WARN] EC2 Verified Access Instance Logging Configuration (%s) not found, removing from state", vaiID)
+		d.SetId("")
+		return diags
+	}
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "reading Verified Access Instance Logging Configuration (%s): %s", vaiID, err)
+	}
+
+	if v := output.AccessLogs; v != nil {
+		if err := d.Set("access_logs", flattenVerifiedAccessInstanceAccessLogs(v)); err != nil {
+			return sdkdiag.AppendErrorf(diags, "setting verified access instance access logs: %s", err)
+		}
+	} else {
+		d.Set("access_logs", nil)
+	}
+
+	d.Set("verifiedaccess_instance_id", vaiID)
+
+	return diags
+}
+
+func resourceVerifiedAccessInstanceLoggingConfigurationUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).EC2Client(ctx)
+
+	vaiID := d.Id()
+
+	if d.HasChange("access_logs") {
+		uuid, err := uuid.GenerateUUID()
+		if err != nil {
+			return sdkdiag.AppendErrorf(diags, "generating uuid for ClientToken for Verified Access Instance Logging Configuration %s): %s", vaiID, err)
+		}
+
+		input := &ec2.ModifyVerifiedAccessInstanceLoggingConfigurationInput{
+			AccessLogs:               expandVerifiedAccessInstanceAccessLogs(d.Get("access_logs").([]interface{})),
+			ClientToken:              aws.String(uuid), // can't use aws.String(id.UniqueId()), because it's not a valid uuid
+			VerifiedAccessInstanceId: aws.String(vaiID),
+		}
+
+		_, err = conn.ModifyVerifiedAccessInstanceLoggingConfiguration(ctx, input)
+
+		if err != nil {
+			return sdkdiag.AppendErrorf(diags, "updating Verified Access Instance Logging Configuration (%s): %s", vaiID, err)
+		}
+	}
+
+	return append(diags, resourceVerifiedAccessInstanceLoggingConfigurationRead(ctx, d, meta)...)
+}
+
+func resourceVerifiedAccessInstanceLoggingConfigurationDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).EC2Client(ctx)
+
+	vaiID := d.Id()
+
+	// create structure for reset
+	resetObject := &types.VerifiedAccessLogOptions{
+		CloudWatchLogs: &types.VerifiedAccessLogCloudWatchLogsDestinationOptions{
+			Enabled: aws.Bool(false),
+		},
+		KinesisDataFirehose: &types.VerifiedAccessLogKinesisDataFirehoseDestinationOptions{
+			Enabled: aws.Bool(false),
+		},
+		S3: &types.VerifiedAccessLogS3DestinationOptions{
+			Enabled: aws.Bool(false),
+		},
+		IncludeTrustContext: aws.Bool(false),
+		// reset log_version because ocsf-0.1 is not compatible with enabling include_trust_context
+		// without reset, if practitioners previously applied and destroyed with ocsf-0.1,
+		// ocsf-0.1 will be the new "default" value, leading to errors with include_trust_context
+		LogVersion: aws.String(DefaultLogVersionValue),
+	}
+
+	uuid, err := uuid.GenerateUUID()
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "generating uuid for ClientToken for Verified Access Instance Logging Configuration %s): %s", vaiID, err)
+	}
+
+	log.Printf("[INFO] Deleting Verified Access Instance Logging Configuration: %s", vaiID)
+	input := &ec2.ModifyVerifiedAccessInstanceLoggingConfigurationInput{
+		AccessLogs:               resetObject,
+		ClientToken:              aws.String(uuid), // can't use aws.String(id.UniqueId()), because it's not a valid uuid
+		VerifiedAccessInstanceId: aws.String(vaiID),
+	}
+
+	_, err = conn.ModifyVerifiedAccessInstanceLoggingConfiguration(ctx, input)
+
+	if tfawserr.ErrCodeEquals(err, errCodeInvalidVerifiedAccessInstanceIdNotFound) {
+		return diags
+	}
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "deleting Verified Access Instance Logging Configuration (%s): %s", vaiID, err)
+	}
+
+	return diags
+}
+
+func expandVerifiedAccessInstanceAccessLogs(accessLogs []interface{}) *types.VerifiedAccessLogOptions {
+	if len(accessLogs) == 0 || accessLogs[0] == nil {
+		return nil
+	}
+
+	tfMap, ok := accessLogs[0].(map[string]interface{})
+	if !ok {
+		return nil
+	}
+
+	result := &types.VerifiedAccessLogOptions{}
+
+	if v, ok := tfMap["cloudwatch_logs"].([]interface{}); ok && len(v) > 0 {
+		result.CloudWatchLogs = expandVerifiedAccessLogCloudWatchLogs(v)
+	}
+
+	if v, ok := tfMap["include_trust_context"].(bool); ok {
+		result.IncludeTrustContext = aws.Bool(v)
+	}
+
+	if v, ok := tfMap["kinesis_data_firehose"].([]interface{}); ok && len(v) > 0 {
+		result.KinesisDataFirehose = expandVerifiedAccessLogKinesisDataFirehose(v)
+	}
+
+	if v, ok := tfMap["log_version"].(string); ok && v != "" {
+		result.LogVersion = aws.String(v)
+	}
+
+	if v, ok := tfMap["s3"].([]interface{}); ok && len(v) > 0 {
+		result.S3 = expandVerifiedAccessLogS3(v)
+	}
+
+	return result
+}
+
+func expandVerifiedAccessLogCloudWatchLogs(cloudWatchLogs []interface{}) *types.VerifiedAccessLogCloudWatchLogsDestinationOptions {
+	if len(cloudWatchLogs) == 0 || cloudWatchLogs[0] == nil {
+		return nil
+	}
+
+	tfMap, ok := cloudWatchLogs[0].(map[string]interface{})
+	if !ok {
+		return nil
+	}
+
+	result := &types.VerifiedAccessLogCloudWatchLogsDestinationOptions{
+		Enabled: aws.Bool(tfMap["enabled"].(bool)),
+	}
+
+	if v, ok := tfMap["log_group"].(string); ok && v != "" {
+		result.LogGroup = aws.String(v)
+	}
+
+	return result
+}
+
+func expandVerifiedAccessLogKinesisDataFirehose(kinesisDataFirehose []interface{}) *types.VerifiedAccessLogKinesisDataFirehoseDestinationOptions {
+	if len(kinesisDataFirehose) == 0 || kinesisDataFirehose[0] == nil {
+		return nil
+	}
+
+	tfMap, ok := kinesisDataFirehose[0].(map[string]interface{})
+	if !ok {
+		return nil
+	}
+
+	result := &types.VerifiedAccessLogKinesisDataFirehoseDestinationOptions{
+		Enabled: aws.Bool(tfMap["enabled"].(bool)),
+	}
+
+	if v, ok := tfMap["delivery_stream"].(string); ok && v != "" {
+		result.DeliveryStream = aws.String(v)
+	}
+
+	return result
+}
+
+func expandVerifiedAccessLogS3(s3 []interface{}) *types.VerifiedAccessLogS3DestinationOptions {
+	if len(s3) == 0 || s3[0] == nil {
+		return nil
+	}
+
+	tfMap, ok := s3[0].(map[string]interface{})
+	if !ok {
+		return nil
+	}
+
+	result := &types.VerifiedAccessLogS3DestinationOptions{
+		Enabled: aws.Bool(tfMap["enabled"].(bool)),
+	}
+
+	if v, ok := tfMap["bucket_name"].(string); ok && v != "" {
+		result.BucketName = aws.String(v)
+	}
+
+	// if enabled is true, pass bucket owner, otherwise don't pass it
+	// api error InvalidParameterCombination: The parameter AccessLogs.S3.BucketOwner cannot be used when AccessLogs.S3.Enabled is false
+	if v, ok := tfMap["enabled"].(bool); ok && v {
+		if v, ok := tfMap["bucket_owner"].(string); ok && v != "" {
+			result.BucketOwner = aws.String(v)
+		}
+	}
+
+	if v, ok := tfMap["prefix"].(string); ok && v != "" {
+		result.Prefix = aws.String(v)
+	}
+
+	return result
+}
+
+func flattenVerifiedAccessInstanceAccessLogs(apiObject *types.VerifiedAccessLogs) []interface{} {
+	tfMap := map[string]interface{}{}
+
+	if v := apiObject.CloudWatchLogs; v != nil {
+		tfMap["cloudwatch_logs"] = flattenVerifiedAccessLogCloudWatchLogs(v)
+	}
+
+	if v := apiObject.IncludeTrustContext; v != nil {
+		tfMap["include_trust_context"] = aws.ToBool(v)
+	}
+
+	if v := apiObject.KinesisDataFirehose; v != nil {
+		tfMap["kinesis_data_firehose"] = flattenVerifiedAccessLogKinesisDataFirehose(v)
+	}
+
+	if v := apiObject.LogVersion; v != nil {
+		tfMap["log_version"] = aws.ToString(v)
+	}
+
+	if v := apiObject.S3; v != nil {
+		tfMap["s3"] = flattenVerifiedAccessLogS3(v)
+	}
+
+	return []interface{}{tfMap}
+}
+
+func flattenVerifiedAccessLogCloudWatchLogs(apiObject *types.VerifiedAccessLogCloudWatchLogsDestination) []interface{} {
+	tfMap := map[string]interface{}{
+		"enabled": apiObject.Enabled,
+	}
+
+	if v := apiObject.LogGroup; v != nil {
+		tfMap["log_group"] = aws.ToString(v)
+	}
+
+	return []interface{}{tfMap}
+}
+
+func flattenVerifiedAccessLogKinesisDataFirehose(apiObject *types.VerifiedAccessLogKinesisDataFirehoseDestination) []interface{} {
+	tfMap := map[string]interface{}{
+		"enabled": apiObject.Enabled,
+	}
+
+	if v := apiObject.DeliveryStream; v != nil {
+		tfMap["delivery_stream"] = aws.ToString(v)
+	}
+
+	return []interface{}{tfMap}
+}
+
+func flattenVerifiedAccessLogS3(apiObject *types.VerifiedAccessLogS3Destination) []interface{} {
+	tfMap := map[string]interface{}{
+		"enabled": apiObject.Enabled,
+	}
+
+	if v := apiObject.BucketName; v != nil {
+		tfMap["bucket_name"] = aws.ToString(v)
+	}
+
+	if v := apiObject.BucketOwner; v != nil {
+		tfMap["bucket_owner"] = aws.ToString(v)
+	}
+
+	if v := apiObject.Prefix; v != nil {
+		tfMap["prefix"] = aws.ToString(v)
+	}
+
+	return []interface{}{tfMap}
+}
diff --git a/internal/service/ec2/verifiedaccess_instance_logging_configuration_test.go b/internal/service/ec2/verifiedaccess_instance_logging_configuration_test.go
new file mode 100644
index 00000000000..6eb37624bea
--- /dev/null
+++ b/internal/service/ec2/verifiedaccess_instance_logging_configuration_test.go
@@ -0,0 +1,859 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package ec2_test
+
+import (
+	"context"
+	"fmt"
+	"strconv"
+	"testing"
+
+	"github.com/aws/aws-sdk-go-v2/service/ec2"
+	"github.com/aws/aws-sdk-go-v2/service/ec2/types"
+	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
+	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	tfec2 "github.com/hashicorp/terraform-provider-aws/internal/service/ec2"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/names"
+)
+
+func TestAccVerifiedAccessInstanceLoggingConfiguration_accessLogsIncludeTrustContext(t *testing.T) {
+	ctx := acctest.Context(t)
+
+	var v types.VerifiedAccessInstanceLoggingConfiguration
+	resourceName := "aws_verifiedaccess_instance_logging_configuration.test"
+	instanceResourceName := "aws_verifiedaccess_instance.test"
+
+	include_trust_context_original := true
+	include_trust_context_updated := false
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			testAccPreCheckVerifiedAccessInstanceLoggingConfiguration(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, names.EC2),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckVerifiedAccessInstanceLoggingConfigurationDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccLoggingConfigurationConfig_basic_accessLogsIncludeTrustContext(include_trust_context_original),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckVerifiedAccessInstanceLoggingConfigurationExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "access_logs.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "access_logs.0.include_trust_context", strconv.FormatBool(include_trust_context_original)),
+					resource.TestCheckResourceAttrPair(resourceName, "verifiedaccess_instance_id", instanceResourceName, "id"),
+				),
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{},
+			},
+			{
+				Config: testAccLoggingConfigurationConfig_basic_accessLogsIncludeTrustContext(include_trust_context_updated),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckVerifiedAccessInstanceLoggingConfigurationExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "access_logs.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "access_logs.0.include_trust_context", strconv.FormatBool(include_trust_context_updated)),
+					resource.TestCheckResourceAttrPair(resourceName, "verifiedaccess_instance_id", instanceResourceName, "id"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccVerifiedAccessInstanceLoggingConfiguration_accessLogsLogVersion(t *testing.T) {
+	ctx := acctest.Context(t)
+
+	var v types.VerifiedAccessInstanceLoggingConfiguration
+	resourceName := "aws_verifiedaccess_instance_logging_configuration.test"
+	instanceResourceName := "aws_verifiedaccess_instance.test"
+
+	log_version_original := "ocsf-0.1"
+	log_version_updated := "ocsf-1.0.0-rc.2"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			testAccPreCheckVerifiedAccessInstanceLoggingConfiguration(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, names.EC2),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckVerifiedAccessInstanceLoggingConfigurationDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccLoggingConfigurationConfig_basic_accessLogsLogVersion(log_version_original),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckVerifiedAccessInstanceLoggingConfigurationExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "access_logs.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "access_logs.0.log_version", log_version_original),
+					resource.TestCheckResourceAttrPair(resourceName, "verifiedaccess_instance_id", instanceResourceName, "id"),
+				),
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{},
+			},
+			{
+				Config: testAccLoggingConfigurationConfig_basic_accessLogsLogVersion(log_version_updated),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckVerifiedAccessInstanceLoggingConfigurationExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "access_logs.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "access_logs.0.log_version", log_version_updated),
+					resource.TestCheckResourceAttrPair(resourceName, "verifiedaccess_instance_id", instanceResourceName, "id"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccVerifiedAccessInstanceLoggingConfiguration_accessLogsCloudWatchLogs(t *testing.T) {
+	ctx := acctest.Context(t)
+
+	var v types.VerifiedAccessInstanceLoggingConfiguration
+	resourceName := "aws_verifiedaccess_instance_logging_configuration.test"
+	instanceResourceName := "aws_verifiedaccess_instance.test"
+	logGroupName := "aws_cloudwatch_log_group.test"
+	logGroupName2 := "aws_cloudwatch_log_group.test2"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			testAccPreCheckVerifiedAccessInstanceLoggingConfiguration(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, names.EC2),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckVerifiedAccessInstanceLoggingConfigurationDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccLoggingConfigurationConfig_basic_accessLogsCloudWatchLogs("first"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckVerifiedAccessInstanceLoggingConfigurationExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "access_logs.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "access_logs.0.cloudwatch_logs.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "access_logs.0.cloudwatch_logs.0.enabled", "true"),
+					resource.TestCheckResourceAttrPair(resourceName, "access_logs.0.cloudwatch_logs.0.log_group", logGroupName, "id"),
+					resource.TestCheckResourceAttrPair(resourceName, "verifiedaccess_instance_id", instanceResourceName, "id"),
+				),
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{},
+			},
+			{
+				Config: testAccLoggingConfigurationConfig_basic_accessLogsCloudWatchLogs("second"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckVerifiedAccessInstanceLoggingConfigurationExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "access_logs.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "access_logs.0.cloudwatch_logs.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "access_logs.0.cloudwatch_logs.0.enabled", "true"),
+					resource.TestCheckResourceAttrPair(resourceName, "access_logs.0.cloudwatch_logs.0.log_group", logGroupName2, "id"),
+					resource.TestCheckResourceAttrPair(resourceName, "verifiedaccess_instance_id", instanceResourceName, "id"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccVerifiedAccessInstanceLoggingConfiguration_accessLogsKinesisDataFirehose(t *testing.T) {
+	ctx := acctest.Context(t)
+
+	var v types.VerifiedAccessInstanceLoggingConfiguration
+	resourceName := "aws_verifiedaccess_instance_logging_configuration.test"
+	instanceResourceName := "aws_verifiedaccess_instance.test"
+	kinesisStreamName := "aws_kinesis_firehose_delivery_stream.test"
+	kinesisStreamName2 := "aws_kinesis_firehose_delivery_stream.test2"
+
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	rName2 := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	rName3 := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			testAccPreCheckVerifiedAccessInstanceLoggingConfiguration(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, names.EC2),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckVerifiedAccessInstanceLoggingConfigurationDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccLoggingConfigurationConfig_basic_accessLogsKinesisDataFirehose(rName, rName2, rName3, "first"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckVerifiedAccessInstanceLoggingConfigurationExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "access_logs.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "access_logs.0.kinesis_data_firehose.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "access_logs.0.kinesis_data_firehose.0.enabled", "true"),
+					resource.TestCheckResourceAttrPair(resourceName, "access_logs.0.kinesis_data_firehose.0.delivery_stream", kinesisStreamName, "name"),
+					resource.TestCheckResourceAttrPair(resourceName, "verifiedaccess_instance_id", instanceResourceName, "id"),
+				),
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{},
+			},
+			{
+				Config: testAccLoggingConfigurationConfig_basic_accessLogsKinesisDataFirehose(rName, rName2, rName3, "second"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckVerifiedAccessInstanceLoggingConfigurationExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "access_logs.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "access_logs.0.kinesis_data_firehose.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "access_logs.0.kinesis_data_firehose.0.enabled", "true"),
+					resource.TestCheckResourceAttrPair(resourceName, "access_logs.0.kinesis_data_firehose.0.delivery_stream", kinesisStreamName2, "name"),
+					resource.TestCheckResourceAttrPair(resourceName, "verifiedaccess_instance_id", instanceResourceName, "id"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccVerifiedAccessInstanceLoggingConfiguration_accessLogsS3(t *testing.T) {
+	ctx := acctest.Context(t)
+
+	var v types.VerifiedAccessInstanceLoggingConfiguration
+	resourceName := "aws_verifiedaccess_instance_logging_configuration.test"
+	instanceResourceName := "aws_verifiedaccess_instance.test"
+	bucketName := "aws_s3_bucket.test"
+	bucketName2 := "aws_s3_bucket.test2"
+
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	rName2 := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	prefix_original := "prefix-original"
+	prefix_updated := "prefix-updated"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			testAccPreCheckVerifiedAccessInstanceLoggingConfiguration(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, names.EC2),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckVerifiedAccessInstanceLoggingConfigurationDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccLoggingConfigurationConfig_basic_accessLogsS3(rName, rName2, "first", prefix_original),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckVerifiedAccessInstanceLoggingConfigurationExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "access_logs.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "access_logs.0.s3.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "access_logs.0.s3.0.enabled", "true"),
+					resource.TestCheckResourceAttrPair(resourceName, "access_logs.0.s3.0.bucket_name", bucketName, "id"),
+					acctest.CheckResourceAttrAccountID(resourceName, "access_logs.0.s3.0.bucket_owner"),
+					resource.TestCheckResourceAttr(resourceName, "access_logs.0.s3.0.prefix", prefix_original),
+					resource.TestCheckResourceAttrPair(resourceName, "verifiedaccess_instance_id", instanceResourceName, "id"),
+				),
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{},
+			},
+			{
+				Config: testAccLoggingConfigurationConfig_basic_accessLogsS3(rName, rName2, "second", prefix_updated),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckVerifiedAccessInstanceLoggingConfigurationExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "access_logs.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "access_logs.0.s3.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "access_logs.0.s3.0.enabled", "true"),
+					resource.TestCheckResourceAttrPair(resourceName, "access_logs.0.s3.0.bucket_name", bucketName2, "id"),
+					acctest.CheckResourceAttrAccountID(resourceName, "access_logs.0.s3.0.bucket_owner"),
+					resource.TestCheckResourceAttr(resourceName, "access_logs.0.s3.0.prefix", prefix_updated),
+					resource.TestCheckResourceAttrPair(resourceName, "verifiedaccess_instance_id", instanceResourceName, "id"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccVerifiedAccessInstanceLoggingConfiguration_accessLogsCloudWatchLogsKinesisDataFirehoseS3(t *testing.T) {
+	ctx := acctest.Context(t)
+
+	var v types.VerifiedAccessInstanceLoggingConfiguration
+	resourceName := "aws_verifiedaccess_instance_logging_configuration.test"
+	instanceResourceName := "aws_verifiedaccess_instance.test"
+	logGroupName := "aws_cloudwatch_log_group.test"
+	kinesisStreamName := "aws_kinesis_firehose_delivery_stream.test"
+	bucketName := "aws_s3_bucket.test"
+
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	rName2 := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	rName3 := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			testAccPreCheckVerifiedAccessInstanceLoggingConfiguration(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, names.EC2),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckVerifiedAccessInstanceLoggingConfigurationDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				// Test all 3 logging configurations together - CloudWatch, Kinesis Data Firehose, S3
+				Config: testAccLoggingConfigurationConfig_basic_accessLogsCloudWatchLogsKinesisDataFirehoseS3(rName, rName2, rName3),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckVerifiedAccessInstanceLoggingConfigurationExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "access_logs.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "access_logs.0.cloudwatch_logs.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "access_logs.0.cloudwatch_logs.0.enabled", "true"),
+					resource.TestCheckResourceAttrPair(resourceName, "access_logs.0.cloudwatch_logs.0.log_group", logGroupName, "id"),
+					resource.TestCheckResourceAttr(resourceName, "access_logs.0.kinesis_data_firehose.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "access_logs.0.kinesis_data_firehose.0.enabled", "true"),
+					resource.TestCheckResourceAttrPair(resourceName, "access_logs.0.kinesis_data_firehose.0.delivery_stream", kinesisStreamName, "name"),
+					resource.TestCheckResourceAttr(resourceName, "access_logs.0.s3.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "access_logs.0.s3.0.enabled", "true"),
+					resource.TestCheckResourceAttrPair(resourceName, "access_logs.0.s3.0.bucket_name", bucketName, "id"),
+					resource.TestCheckResourceAttrPair(resourceName, "verifiedaccess_instance_id", instanceResourceName, "id"),
+				),
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{},
+			},
+			{
+				// Test 2 logging configurations together - CloudWatch, Kinesis Data Firehose
+				Config: testAccLoggingConfigurationConfig_basic_accessLogsCloudWatchLogsKinesisDataFirehose(rName, rName2, rName3),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckVerifiedAccessInstanceLoggingConfigurationExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "access_logs.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "access_logs.0.cloudwatch_logs.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "access_logs.0.cloudwatch_logs.0.enabled", "true"),
+					resource.TestCheckResourceAttrPair(resourceName, "access_logs.0.cloudwatch_logs.0.log_group", logGroupName, "id"),
+					resource.TestCheckResourceAttr(resourceName, "access_logs.0.kinesis_data_firehose.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "access_logs.0.kinesis_data_firehose.0.enabled", "true"),
+					resource.TestCheckResourceAttrPair(resourceName, "access_logs.0.kinesis_data_firehose.0.delivery_stream", kinesisStreamName, "name"),
+					resource.TestCheckResourceAttr(resourceName, "access_logs.0.s3.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "access_logs.0.s3.0.enabled", "false"),
+					resource.TestCheckResourceAttrPair(resourceName, "verifiedaccess_instance_id", instanceResourceName, "id"),
+				),
+			},
+			{
+				// Test 2 logging configurations together - CloudWatch, S3
+				Config: testAccLoggingConfigurationConfig_basic_accessLogsCloudWatchLogsS3(rName, rName2, rName3),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckVerifiedAccessInstanceLoggingConfigurationExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "access_logs.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "access_logs.0.cloudwatch_logs.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "access_logs.0.cloudwatch_logs.0.enabled", "true"),
+					resource.TestCheckResourceAttrPair(resourceName, "access_logs.0.cloudwatch_logs.0.log_group", logGroupName, "id"),
+					resource.TestCheckResourceAttr(resourceName, "access_logs.0.kinesis_data_firehose.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "access_logs.0.kinesis_data_firehose.0.enabled", "false"),
+					resource.TestCheckResourceAttr(resourceName, "access_logs.0.s3.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "access_logs.0.s3.0.enabled", "true"),
+					resource.TestCheckResourceAttrPair(resourceName, "access_logs.0.s3.0.bucket_name", bucketName, "id"),
+					resource.TestCheckResourceAttrPair(resourceName, "verifiedaccess_instance_id", instanceResourceName, "id"),
+				),
+			},
+			{
+				// Test 2 logging configurations together - Kinesis Data Firehose, S3
+				Config: testAccLoggingConfigurationConfig_basic_accessLogsKinesisDataFirehoseS3(rName, rName2, rName3),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckVerifiedAccessInstanceLoggingConfigurationExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "access_logs.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "access_logs.0.cloudwatch_logs.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "access_logs.0.cloudwatch_logs.0.enabled", "false"),
+					resource.TestCheckResourceAttr(resourceName, "access_logs.0.kinesis_data_firehose.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "access_logs.0.kinesis_data_firehose.0.enabled", "true"),
+					resource.TestCheckResourceAttrPair(resourceName, "access_logs.0.kinesis_data_firehose.0.delivery_stream", kinesisStreamName, "name"),
+					resource.TestCheckResourceAttr(resourceName, "access_logs.0.s3.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "access_logs.0.s3.0.enabled", "true"),
+					resource.TestCheckResourceAttrPair(resourceName, "access_logs.0.s3.0.bucket_name", bucketName, "id"),
+					resource.TestCheckResourceAttrPair(resourceName, "verifiedaccess_instance_id", instanceResourceName, "id"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccVerifiedAccessInstanceLoggingConfiguration_disappears(t *testing.T) {
+	// note: disappears test does not test the logging configuration since the instance is deleted
+	// the logging configuration cannot be deleted, rather, the boolean flags and logging version are reset to the default values
+	ctx := acctest.Context(t)
+
+	var v types.VerifiedAccessInstanceLoggingConfiguration
+	resourceName := "aws_verifiedaccess_instance.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			testAccPreCheckVerifiedAccessInstanceLoggingConfiguration(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, names.EC2),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckVerifiedAccessInstanceLoggingConfigurationDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccLoggingConfigurationConfig_basic_accessLogsIncludeTrustContext(true),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckVerifiedAccessInstanceLoggingConfigurationExists(ctx, resourceName, &v),
+					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfec2.ResourceVerifiedAccessInstanceLoggingConfiguration(), resourceName),
+				),
+				ExpectNonEmptyPlan: true,
+			},
+		},
+	})
+}
+
+func testAccCheckVerifiedAccessInstanceLoggingConfigurationExists(ctx context.Context, n string, v *types.VerifiedAccessInstanceLoggingConfiguration) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		conn := acctest.Provider.Meta().(*conns.AWSClient).EC2Client(ctx)
+
+		output, err := tfec2.FindVerifiedAccessInstanceLoggingConfigurationByInstanceID(ctx, conn, rs.Primary.ID)
+
+		if err != nil {
+			return err
+		}
+
+		*v = *output
+
+		return nil
+	}
+}
+
+func testAccCheckVerifiedAccessInstanceLoggingConfigurationDestroy(ctx context.Context) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		conn := acctest.Provider.Meta().(*conns.AWSClient).EC2Client(ctx)
+
+		for _, rs := range s.RootModule().Resources {
+			if rs.Type != "aws_verifiedaccess_instance_logging_configuration" {
+				continue
+			}
+
+			_, err := tfec2.FindVerifiedAccessInstanceLoggingConfigurationByInstanceID(ctx, conn, rs.Primary.ID)
+
+			if tfresource.NotFound(err) {
+				continue
+			}
+
+			if err != nil {
+				return err
+			}
+
+			return fmt.Errorf("Verified Access Instance Logging Configuration %s still exists", rs.Primary.ID)
+		}
+
+		return nil
+	}
+}
+
+func testAccPreCheckVerifiedAccessInstanceLoggingConfiguration(ctx context.Context, t *testing.T) {
+	conn := acctest.Provider.Meta().(*conns.AWSClient).EC2Client(ctx)
+
+	input := &ec2.DescribeVerifiedAccessInstanceLoggingConfigurationsInput{}
+	_, err := conn.DescribeVerifiedAccessInstanceLoggingConfigurations(ctx, input)
+
+	if acctest.PreCheckSkipError(err) {
+		t.Skipf("skipping acceptance testing: %s", err)
+	}
+	if err != nil {
+		t.Fatalf("unexpected PreCheck error: %s", err)
+	}
+}
+
+func testAccVerifiedAccessInstanceLoggingConfigurationConfig_instance() string {
+	return `
+resource "aws_verifiedaccess_instance" "test" {}
+`
+}
+
+func testAccVerifiedAccessInstanceLoggingConfigurationConfig_cloudwatch() string {
+	return `
+resource "aws_cloudwatch_log_group" "test" {}
+`
+}
+
+func testAccVerifiedAccessInstanceLoggingConfigurationConfig_cloudwatchTwoLogGroups() string {
+	return `
+resource "aws_cloudwatch_log_group" "test" {}
+
+resource "aws_cloudwatch_log_group" "test2" {}
+`
+}
+
+func testAccInstanceStorageDeliveryStreamConfig_Base(rName string) string {
+	return fmt.Sprintf(`
+data "aws_caller_identity" "current" {}
+data "aws_partition" "current" {}
+
+resource "aws_iam_role" "firehose" {
+  name = %[1]q
+
+  assume_role_policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Sid": "",
+      "Effect": "Allow",
+      "Principal": {
+        "Service": "firehose.amazonaws.com"
+      },
+      "Action": "sts:AssumeRole",
+      "Condition": {
+        "StringEquals": {
+          "sts:ExternalId": "${data.aws_caller_identity.current.account_id}"
+        }
+      }
+    }
+  ]
+}
+EOF
+}
+
+resource "aws_s3_bucket" "bucket" {
+  bucket = %[1]q
+}
+
+resource "aws_iam_role_policy" "firehose" {
+  name = %[1]q
+  role = aws_iam_role.firehose.id
+
+  policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Sid": "",
+      "Effect": "Allow",
+      "Action": [
+        "s3:AbortMultipartUpload",
+        "s3:GetBucketLocation",
+        "s3:GetObject",
+        "s3:ListBucket",
+        "s3:ListBucketMultipartUploads",
+        "s3:PutObject"
+      ],
+      "Resource": [
+        "${aws_s3_bucket.bucket.arn}",
+        "${aws_s3_bucket.bucket.arn}/*"
+      ]
+    },
+    {
+      "Sid": "GlueAccess",
+      "Effect": "Allow",
+      "Action": [
+        "glue:GetTable",
+        "glue:GetTableVersion",
+        "glue:GetTableVersions"
+      ],
+      "Resource": [
+        "*"
+      ]
+    },
+    {
+      "Sid": "LakeFormationDataAccess",
+      "Effect": "Allow",
+      "Action": [
+        "lakeformation:GetDataAccess"
+      ],
+      "Resource": "*"
+    }
+  ]
+}
+EOF
+}
+`, rName)
+}
+
+func testAccVerifiedAccessInstanceLoggingConfigurationConfig_firehose(rName, rName2 string) string {
+	return acctest.ConfigCompose(
+		testAccInstanceStorageDeliveryStreamConfig_Base(rName),
+		fmt.Sprintf(`
+resource "aws_kinesis_firehose_delivery_stream" "test" {
+  depends_on  = [aws_iam_role_policy.firehose]
+  name        = %[1]q
+  destination = "extended_s3"
+
+  extended_s3_configuration {
+    role_arn   = aws_iam_role.firehose.arn
+    bucket_arn = aws_s3_bucket.bucket.arn
+  }
+
+  tags = {
+    LogDeliveryEnabled = "true"
+  }
+}
+`, rName2))
+}
+
+func testAccVerifiedAccessInstanceLoggingConfigurationConfig_firehoseTwoStreams(rName, rName2, rName3 string) string {
+	return acctest.ConfigCompose(
+		testAccInstanceStorageDeliveryStreamConfig_Base(rName),
+		fmt.Sprintf(`
+resource "aws_kinesis_firehose_delivery_stream" "test" {
+  depends_on  = [aws_iam_role_policy.firehose]
+  name        = %[1]q
+  destination = "extended_s3"
+
+  extended_s3_configuration {
+    role_arn   = aws_iam_role.firehose.arn
+    bucket_arn = aws_s3_bucket.bucket.arn
+  }
+
+  tags = {
+    LogDeliveryEnabled = "true"
+  }
+}
+
+resource "aws_kinesis_firehose_delivery_stream" "test2" {
+  depends_on  = [aws_iam_role_policy.firehose]
+  name        = %[2]q
+  destination = "extended_s3"
+
+  extended_s3_configuration {
+    role_arn   = aws_iam_role.firehose.arn
+    bucket_arn = aws_s3_bucket.bucket.arn
+  }
+
+  tags = {
+    LogDeliveryEnabled = "true"
+  }
+}
+`, rName2, rName3))
+}
+
+func testAccVerifiedAccessInstanceLoggingConfigurationConfig_s3(rName string) string {
+	return fmt.Sprintf(`
+resource "aws_s3_bucket" "test" {
+  bucket        = %[1]q
+  force_destroy = true
+}
+`, rName)
+}
+
+func testAccVerifiedAccessInstanceLoggingConfigurationConfig_s3TwoBuckets(rName, rName2 string) string {
+	return fmt.Sprintf(`
+resource "aws_s3_bucket" "test" {
+  bucket        = %[1]q
+  force_destroy = true
+}
+
+resource "aws_s3_bucket" "test2" {
+  bucket        = %[2]q
+  force_destroy = true
+}
+`, rName, rName2)
+}
+
+func testAccLoggingConfigurationConfig_basic_accessLogsIncludeTrustContext(includeTrustContext bool) string {
+	return acctest.ConfigCompose(
+		testAccVerifiedAccessInstanceLoggingConfigurationConfig_instance(),
+		fmt.Sprintf(`
+resource "aws_verifiedaccess_instance_logging_configuration" "test" {
+  access_logs {
+    include_trust_context = %[1]t
+  }
+
+  verifiedaccess_instance_id = aws_verifiedaccess_instance.test.id
+}
+`, includeTrustContext))
+}
+
+func testAccLoggingConfigurationConfig_basic_accessLogsLogVersion(logVersion string) string {
+	return acctest.ConfigCompose(
+		testAccVerifiedAccessInstanceLoggingConfigurationConfig_instance(),
+		fmt.Sprintf(`
+resource "aws_verifiedaccess_instance_logging_configuration" "test" {
+  access_logs {
+    log_version = %[1]q
+  }
+
+  verifiedaccess_instance_id = aws_verifiedaccess_instance.test.id
+}
+`, logVersion))
+}
+
+func testAccLoggingConfigurationConfig_basic_accessLogsCloudWatchLogs(selectLogGroup string) string {
+	return acctest.ConfigCompose(
+		testAccVerifiedAccessInstanceLoggingConfigurationConfig_instance(),
+		testAccVerifiedAccessInstanceLoggingConfigurationConfig_cloudwatchTwoLogGroups(),
+		fmt.Sprintf(`
+locals {
+  select_log_group = %[1]q
+}
+
+resource "aws_verifiedaccess_instance_logging_configuration" "test" {
+  access_logs {
+    cloudwatch_logs {
+      enabled   = true
+      log_group = local.select_log_group == "first" ? aws_cloudwatch_log_group.test.id : aws_cloudwatch_log_group.test2.id
+    }
+  }
+
+  verifiedaccess_instance_id = aws_verifiedaccess_instance.test.id
+}
+`, selectLogGroup))
+}
+
+func testAccLoggingConfigurationConfig_basic_accessLogsKinesisDataFirehose(rName, rName2, rName3, selectStream string) string {
+	return acctest.ConfigCompose(
+		testAccVerifiedAccessInstanceLoggingConfigurationConfig_instance(),
+		testAccVerifiedAccessInstanceLoggingConfigurationConfig_firehoseTwoStreams(rName, rName2, rName3),
+		fmt.Sprintf(`
+locals {
+  select_stream = %[1]q
+}
+
+resource "aws_verifiedaccess_instance_logging_configuration" "test" {
+  access_logs {
+    kinesis_data_firehose {
+      delivery_stream = local.select_stream == "first" ? aws_kinesis_firehose_delivery_stream.test.name : aws_kinesis_firehose_delivery_stream.test2.name
+      enabled         = true
+    }
+  }
+
+  verifiedaccess_instance_id = aws_verifiedaccess_instance.test.id
+}
+`, selectStream))
+}
+
+func testAccLoggingConfigurationConfig_basic_accessLogsS3(rName, rName2, selectBucket, prefix string) string {
+	return acctest.ConfigCompose(
+		testAccVerifiedAccessInstanceLoggingConfigurationConfig_instance(),
+		testAccVerifiedAccessInstanceLoggingConfigurationConfig_s3TwoBuckets(rName, rName2),
+		fmt.Sprintf(`
+locals {
+  select_bucket = %[1]q
+}
+
+data "aws_caller_identity" "test" {}
+
+resource "aws_verifiedaccess_instance_logging_configuration" "test" {
+  access_logs {
+    s3 {
+      enabled      = true
+      bucket_name  = local.select_bucket == "first" ? aws_s3_bucket.test.id : aws_s3_bucket.test2.id
+      bucket_owner = data.aws_caller_identity.test.account_id
+      prefix       = %[2]q
+    }
+  }
+
+  verifiedaccess_instance_id = aws_verifiedaccess_instance.test.id
+}
+`, selectBucket, prefix))
+}
+
+func testAccLoggingConfigurationConfig_basic_accessLogsCloudWatchLogsKinesisDataFirehoseS3(rName, rName2, rName3 string) string {
+	return acctest.ConfigCompose(
+		testAccVerifiedAccessInstanceLoggingConfigurationConfig_instance(),
+		testAccVerifiedAccessInstanceLoggingConfigurationConfig_cloudwatch(),
+		testAccVerifiedAccessInstanceLoggingConfigurationConfig_firehose(rName, rName2),
+		testAccVerifiedAccessInstanceLoggingConfigurationConfig_s3(rName3),
+		`
+resource "aws_verifiedaccess_instance_logging_configuration" "test" {
+  access_logs {
+    cloudwatch_logs {
+      enabled   = true
+      log_group = aws_cloudwatch_log_group.test.id
+    }
+
+    kinesis_data_firehose {
+      delivery_stream = aws_kinesis_firehose_delivery_stream.test.name
+      enabled         = true
+    }
+
+    s3 {
+      enabled     = true
+      bucket_name = aws_s3_bucket.test.id
+    }
+  }
+
+  verifiedaccess_instance_id = aws_verifiedaccess_instance.test.id
+}
+`)
+}
+
+func testAccLoggingConfigurationConfig_basic_accessLogsCloudWatchLogsKinesisDataFirehose(rName, rName2, rName3 string) string {
+	return acctest.ConfigCompose(
+		testAccVerifiedAccessInstanceLoggingConfigurationConfig_instance(),
+		testAccVerifiedAccessInstanceLoggingConfigurationConfig_cloudwatch(),
+		testAccVerifiedAccessInstanceLoggingConfigurationConfig_firehose(rName, rName2),
+		testAccVerifiedAccessInstanceLoggingConfigurationConfig_s3(rName3),
+		`
+resource "aws_verifiedaccess_instance_logging_configuration" "test" {
+  access_logs {
+    cloudwatch_logs {
+      enabled   = true
+      log_group = aws_cloudwatch_log_group.test.id
+    }
+
+    kinesis_data_firehose {
+      delivery_stream = aws_kinesis_firehose_delivery_stream.test.name
+      enabled         = true
+    }
+  }
+
+  verifiedaccess_instance_id = aws_verifiedaccess_instance.test.id
+}
+`)
+}
+
+func testAccLoggingConfigurationConfig_basic_accessLogsCloudWatchLogsS3(rName, rName2, rName3 string) string {
+	return acctest.ConfigCompose(
+		testAccVerifiedAccessInstanceLoggingConfigurationConfig_instance(),
+		testAccVerifiedAccessInstanceLoggingConfigurationConfig_cloudwatch(),
+		testAccVerifiedAccessInstanceLoggingConfigurationConfig_firehose(rName, rName2),
+		testAccVerifiedAccessInstanceLoggingConfigurationConfig_s3(rName3),
+		`
+resource "aws_verifiedaccess_instance_logging_configuration" "test" {
+  access_logs {
+    cloudwatch_logs {
+      enabled   = true
+      log_group = aws_cloudwatch_log_group.test.id
+    }
+
+    s3 {
+      enabled     = true
+      bucket_name = aws_s3_bucket.test.id
+    }
+  }
+
+  verifiedaccess_instance_id = aws_verifiedaccess_instance.test.id
+}
+`)
+}
+
+func testAccLoggingConfigurationConfig_basic_accessLogsKinesisDataFirehoseS3(rName, rName2, rName3 string) string {
+	return acctest.ConfigCompose(
+		testAccVerifiedAccessInstanceLoggingConfigurationConfig_instance(),
+		testAccVerifiedAccessInstanceLoggingConfigurationConfig_cloudwatch(),
+		testAccVerifiedAccessInstanceLoggingConfigurationConfig_firehose(rName, rName2),
+		testAccVerifiedAccessInstanceLoggingConfigurationConfig_s3(rName3),
+		`
+resource "aws_verifiedaccess_instance_logging_configuration" "test" {
+  access_logs {
+    kinesis_data_firehose {
+      delivery_stream = aws_kinesis_firehose_delivery_stream.test.name
+      enabled         = true
+    }
+
+    s3 {
+      enabled     = true
+      bucket_name = aws_s3_bucket.test.id
+    }
+  }
+
+  verifiedaccess_instance_id = aws_verifiedaccess_instance.test.id
+}
+`)
+}
diff --git a/internal/service/ec2/verifiedaccess_instance_test.go b/internal/service/ec2/verifiedaccess_instance_test.go
new file mode 100644
index 00000000000..30430e50f81
--- /dev/null
+++ b/internal/service/ec2/verifiedaccess_instance_test.go
@@ -0,0 +1,340 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package ec2_test
+
+import (
+	"context"
+	"fmt"
+	"strconv"
+	"testing"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/ec2"
+	"github.com/aws/aws-sdk-go-v2/service/ec2/types"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
+	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	tfec2 "github.com/hashicorp/terraform-provider-aws/internal/service/ec2"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/names"
+)
+
+func TestAccVerifiedAccessInstance_basic(t *testing.T) {
+	ctx := acctest.Context(t)
+	var v types.VerifiedAccessInstance
+	resourceName := "aws_verifiedaccess_instance.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			testAccPreCheckVerifiedAccessInstance(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, names.EC2),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckVerifiedAccessInstanceDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccVerifiedAccessInstanceConfig_basic(),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckVerifiedAccessInstanceExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttrSet(resourceName, "creation_time"),
+					resource.TestCheckResourceAttrSet(resourceName, "last_updated_time"),
+					resource.TestCheckResourceAttr(resourceName, "verified_access_trust_providers.#", "0"),
+				),
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{},
+			},
+		},
+	})
+}
+
+func TestAccVerifiedAccessInstance_description(t *testing.T) {
+	ctx := acctest.Context(t)
+	var v1, v2 types.VerifiedAccessInstance
+	resourceName := "aws_verifiedaccess_instance.test"
+
+	originalDescription := "original description"
+	updatedDescription := "updated description"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			testAccPreCheckVerifiedAccessInstance(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, names.EC2),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckVerifiedAccessInstanceDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccVerifiedAccessInstanceConfig_description(originalDescription),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckVerifiedAccessInstanceExists(ctx, resourceName, &v1),
+					resource.TestCheckResourceAttr(resourceName, "description", originalDescription),
+				),
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{},
+			},
+			{
+				Config: testAccVerifiedAccessInstanceConfig_description(updatedDescription),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckVerifiedAccessInstanceExists(ctx, resourceName, &v2),
+					testAccCheckVerifiedAccessInstanceNotRecreated(&v1, &v2),
+					resource.TestCheckResourceAttr(resourceName, "description", updatedDescription),
+				),
+			},
+		},
+	})
+}
+
+func TestAccVerifiedAccessInstance_fipsEnabled(t *testing.T) {
+	ctx := acctest.Context(t)
+	var v1, v2 types.VerifiedAccessInstance
+	resourceName := "aws_verifiedaccess_instance.test"
+
+	originalFipsEnabled := true
+	updatedFipsEnabled := false
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			testAccPreCheckVerifiedAccessInstance(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, names.EC2),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckVerifiedAccessInstanceDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccVerifiedAccessInstanceConfig_fipsEnabled(originalFipsEnabled),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckVerifiedAccessInstanceExists(ctx, resourceName, &v1),
+					resource.TestCheckResourceAttr(resourceName, "fips_enabled", strconv.FormatBool(originalFipsEnabled)),
+				),
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{},
+			},
+			{
+				Config: testAccVerifiedAccessInstanceConfig_fipsEnabled(updatedFipsEnabled),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckVerifiedAccessInstanceExists(ctx, resourceName, &v2),
+					testAccCheckVerifiedAccessInstanceRecreated(&v1, &v2),
+					resource.TestCheckResourceAttr(resourceName, "fips_enabled", strconv.FormatBool(updatedFipsEnabled)),
+				),
+			},
+		},
+	})
+}
+
+func TestAccVerifiedAccessInstance_disappears(t *testing.T) {
+	ctx := acctest.Context(t)
+	var v types.VerifiedAccessInstance
+	resourceName := "aws_verifiedaccess_instance.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			testAccPreCheckVerifiedAccessInstance(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, names.EC2),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckVerifiedAccessInstanceDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccVerifiedAccessInstanceConfig_basic(),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckVerifiedAccessInstanceExists(ctx, resourceName, &v),
+					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfec2.ResourceVerifiedAccessInstance(), resourceName),
+				),
+				ExpectNonEmptyPlan: true,
+			},
+		},
+	})
+}
+
+func TestAccVerifiedAccessInstance_tags(t *testing.T) {
+	ctx := acctest.Context(t)
+	var v1, v2, v3 types.VerifiedAccessInstance
+	resourceName := "aws_verifiedaccess_instance.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			testAccPreCheckVerifiedAccessInstance(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, names.EC2),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckVerifiedAccessInstanceDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccVerifiedAccessInstanceConfig_tags1("key1", "value1"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckVerifiedAccessInstanceExists(ctx, resourceName, &v1),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
+				),
+			},
+			{
+				Config: testAccVerifiedAccessInstanceConfig_tags2("key1", "value1updated", "key2", "value2"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckVerifiedAccessInstanceExists(ctx, resourceName, &v2),
+					testAccCheckVerifiedAccessInstanceNotRecreated(&v1, &v2),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1updated"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
+				),
+			},
+			{
+				Config: testAccVerifiedAccessInstanceConfig_tags1("key2", "value2"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckVerifiedAccessInstanceExists(ctx, resourceName, &v3),
+					testAccCheckVerifiedAccessInstanceNotRecreated(&v2, &v3),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
+				),
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{},
+			},
+		},
+	})
+}
+
+func testAccCheckVerifiedAccessInstanceNotRecreated(before, after *types.VerifiedAccessInstance) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		if before, after := aws.ToString(before.VerifiedAccessInstanceId), aws.ToString(after.VerifiedAccessInstanceId); before != after {
+			return fmt.Errorf("Verified Access Instance (%s/%s) recreated", before, after)
+		}
+
+		return nil
+	}
+}
+
+func testAccCheckVerifiedAccessInstanceRecreated(before, after *types.VerifiedAccessInstance) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		if before, after := aws.ToString(before.VerifiedAccessInstanceId), aws.ToString(after.VerifiedAccessInstanceId); before == after {
+			return fmt.Errorf("Verified Access Instance (%s) not recreated", before)
+		}
+
+		return nil
+	}
+}
+
+func testAccCheckVerifiedAccessInstanceExists(ctx context.Context, n string, v *types.VerifiedAccessInstance) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		conn := acctest.Provider.Meta().(*conns.AWSClient).EC2Client(ctx)
+
+		output, err := tfec2.FindVerifiedAccessInstanceByID(ctx, conn, rs.Primary.ID)
+
+		if err != nil {
+			return err
+		}
+
+		*v = *output
+
+		return nil
+	}
+}
+
+func testAccCheckVerifiedAccessInstanceDestroy(ctx context.Context) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		conn := acctest.Provider.Meta().(*conns.AWSClient).EC2Client(ctx)
+
+		for _, rs := range s.RootModule().Resources {
+			if rs.Type != "aws_verifiedaccess_instance" {
+				continue
+			}
+
+			_, err := tfec2.FindVerifiedAccessInstanceByID(ctx, conn, rs.Primary.ID)
+
+			if tfresource.NotFound(err) {
+				continue
+			}
+
+			if err != nil {
+				return err
+			}
+
+			return fmt.Errorf("Verified Access Instance %s still exists", rs.Primary.ID)
+		}
+
+		return nil
+	}
+}
+
+func testAccPreCheckVerifiedAccessInstance(ctx context.Context, t *testing.T) {
+	conn := acctest.Provider.Meta().(*conns.AWSClient).EC2Client(ctx)
+
+	input := &ec2.DescribeVerifiedAccessInstancesInput{}
+	_, err := conn.DescribeVerifiedAccessInstances(ctx, input)
+
+	if acctest.PreCheckSkipError(err) {
+		t.Skipf("skipping acceptance testing: %s", err)
+	}
+	if err != nil {
+		t.Fatalf("unexpected PreCheck error: %s", err)
+	}
+}
+
+func testAccVerifiedAccessInstanceConfig_basic() string {
+	return `
+resource "aws_verifiedaccess_instance" "test" {}
+`
+}
+
+func testAccVerifiedAccessInstanceConfig_description(description string) string {
+	return fmt.Sprintf(`
+resource "aws_verifiedaccess_instance" "test" {
+  description = %[1]q
+}
+`, description)
+}
+
+func testAccVerifiedAccessInstanceConfig_fipsEnabled(fipsEnabled bool) string {
+	return fmt.Sprintf(`
+resource "aws_verifiedaccess_instance" "test" {
+  fips_enabled = %[1]t
+}
+`, fipsEnabled)
+}
+
+func testAccVerifiedAccessInstanceConfig_tags1(tagKey1, tagValue1 string) string {
+	return fmt.Sprintf(`
+resource "aws_verifiedaccess_instance" "test" {
+  tags = {
+    %[1]q = %[2]q
+  }
+}
+`, tagKey1, tagValue1)
+}
+
+func testAccVerifiedAccessInstanceConfig_tags2(tagKey1, tagValue1, tagKey2, tagValue2 string) string {
+	return fmt.Sprintf(`
+resource "aws_verifiedaccess_instance" "test" {
+  tags = {
+    %[1]q = %[2]q
+    %[3]q = %[4]q
+  }
+}
+`, tagKey1, tagValue1, tagKey2, tagValue2)
+}
diff --git a/internal/service/ec2/verifiedaccess_instance_trust_provider_attachment.go b/internal/service/ec2/verifiedaccess_instance_trust_provider_attachment.go
new file mode 100644
index 00000000000..7f0a982f4ef
--- /dev/null
+++ b/internal/service/ec2/verifiedaccess_instance_trust_provider_attachment.go
@@ -0,0 +1,144 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package ec2
+
+import (
+	"context"
+	"fmt"
+	"log"
+	"strings"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/ec2"
+	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+)
+
+// @SDKResource("aws_verifiedaccess_instance_trust_provider_attachment", name="Verified Access Instance Trust Provider Attachment")
+func ResourceVerifiedAccessInstanceTrustProviderAttachment() *schema.Resource {
+	return &schema.Resource{
+		CreateWithoutTimeout: resourceVerifiedAccessInstanceTrustProviderAttachmentCreate,
+		ReadWithoutTimeout:   resourceVerifiedAccessInstanceTrustProviderAttachmentRead,
+		DeleteWithoutTimeout: resourceVerifiedAccessInstanceTrustProviderAttachmentDelete,
+
+		Importer: &schema.ResourceImporter{
+			StateContext: schema.ImportStatePassthroughContext,
+		},
+
+		Schema: map[string]*schema.Schema{
+			"verifiedaccess_instance_id": {
+				Type:     schema.TypeString,
+				ForceNew: true,
+				Required: true,
+			},
+			"verifiedaccess_trust_provider_id": {
+				Type:     schema.TypeString,
+				ForceNew: true,
+				Required: true,
+			},
+		},
+	}
+}
+
+func resourceVerifiedAccessInstanceTrustProviderAttachmentCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).EC2Client(ctx)
+
+	vaiID := d.Get("verifiedaccess_instance_id").(string)
+	vatpID := d.Get("verifiedaccess_trust_provider_id").(string)
+	resourceID := VerifiedAccessInstanceTrustProviderAttachmentCreateResourceID(vaiID, vatpID)
+	input := &ec2.AttachVerifiedAccessTrustProviderInput{
+		ClientToken:                   aws.String(id.UniqueId()),
+		VerifiedAccessInstanceId:      aws.String(vaiID),
+		VerifiedAccessTrustProviderId: aws.String(vatpID),
+	}
+
+	output, err := conn.AttachVerifiedAccessTrustProvider(ctx, input)
+
+	if err != nil || output == nil {
+		return sdkdiag.AppendErrorf(diags, "creating Verified Access Instance Trust Provider Attachment (%s): %s", resourceID, err)
+	}
+
+	d.SetId(resourceID)
+
+	return append(diags, resourceVerifiedAccessInstanceTrustProviderAttachmentRead(ctx, d, meta)...)
+}
+
+func resourceVerifiedAccessInstanceTrustProviderAttachmentRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).EC2Client(ctx)
+
+	vaiID, vatpID, err := VerifiedAccessInstanceTrustProviderAttachmentParseResourceID(d.Id())
+	if err != nil {
+		return sdkdiag.AppendFromErr(diags, err)
+	}
+
+	err = FindVerifiedAccessInstanceTrustProviderAttachmentExists(ctx, conn, vaiID, vatpID)
+
+	if !d.IsNewResource() && tfresource.NotFound(err) {
+		log.Printf("[WARN] EC2 Verified Access Instance Trust Provider Attachment (%s) not found, removing from state", d.Id())
+		d.SetId("")
+		return diags
+	}
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "reading Verified Access Instance Trust Provider Attachment (%s): %s", d.Id(), err)
+	}
+
+	d.Set("verifiedaccess_instance_id", vaiID)
+	d.Set("verifiedaccess_trust_provider_id", vatpID)
+
+	return diags
+}
+
+func resourceVerifiedAccessInstanceTrustProviderAttachmentDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).EC2Client(ctx)
+
+	vaiID, vatpID, err := VerifiedAccessInstanceTrustProviderAttachmentParseResourceID(d.Id())
+	if err != nil {
+		return sdkdiag.AppendFromErr(diags, err)
+	}
+
+	log.Printf("[INFO] Deleting Verified Access Instance Trust Provider Attachment: %s", d.Id())
+	_, err = conn.DetachVerifiedAccessTrustProvider(ctx, &ec2.DetachVerifiedAccessTrustProviderInput{
+		ClientToken:                   aws.String(id.UniqueId()),
+		VerifiedAccessInstanceId:      aws.String(vaiID),
+		VerifiedAccessTrustProviderId: aws.String(vatpID),
+	})
+
+	if tfawserr.ErrCodeEquals(err, errCodeInvalidVerifiedAccessTrustProviderIdNotFound) {
+		return diags
+	}
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "deleting Verified Access Instance Trust Provider Attachment (%s): %s", d.Id(), err)
+	}
+
+	return diags
+}
+
+const verifiedAccessInstanceTrustProviderAttachmentResourceIDSeparator = "/"
+
+func VerifiedAccessInstanceTrustProviderAttachmentCreateResourceID(vaiID, vatpID string) string {
+	parts := []string{vaiID, vatpID}
+	id := strings.Join(parts, verifiedAccessInstanceTrustProviderAttachmentResourceIDSeparator)
+
+	return id
+}
+
+func VerifiedAccessInstanceTrustProviderAttachmentParseResourceID(id string) (string, string, error) {
+	parts := strings.Split(id, verifiedAccessInstanceTrustProviderAttachmentResourceIDSeparator)
+
+	if len(parts) == 2 && parts[0] != "" && parts[1] != "" {
+		return parts[0], parts[1], nil
+	}
+
+	return "", "", fmt.Errorf("unexpected format for ID (%[1]s), expected VerifiedAccessInstanceID%[2]sVerifiedAccessTrustProviderID", id, verifiedAccessInstanceTrustProviderAttachmentResourceIDSeparator)
+}
diff --git a/internal/service/ec2/verifiedaccess_instance_trust_provider_attachment_test.go b/internal/service/ec2/verifiedaccess_instance_trust_provider_attachment_test.go
new file mode 100644
index 00000000000..1bc0958646d
--- /dev/null
+++ b/internal/service/ec2/verifiedaccess_instance_trust_provider_attachment_test.go
@@ -0,0 +1,147 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package ec2_test
+
+import (
+	"context"
+	"fmt"
+	"testing"
+
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
+	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	tfec2 "github.com/hashicorp/terraform-provider-aws/internal/service/ec2"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/names"
+)
+
+func TestAccVerifiedAccessInstanceTrustProviderAttachment_basic(t *testing.T) {
+	ctx := acctest.Context(t)
+	resourceName := "aws_verifiedaccess_instance_trust_provider_attachment.test"
+	instanceResourceName := "aws_verifiedaccess_instance.test"
+	trustProviderResourceName := "aws_verifiedaccess_trust_provider.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			testAccPreCheckVerifiedAccessInstance(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, names.EC2),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckVerifiedAccessInstanceTrustProviderAttachmentDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccVerifiedAccessInstanceTrustProviderAttachmentConfig_basic(),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckVerifiedAccessInstanceTrustProviderAttachmentExists(ctx, resourceName),
+					resource.TestCheckResourceAttrPair(resourceName, "verifiedaccess_instance_id", instanceResourceName, "id"),
+					resource.TestCheckResourceAttrPair(resourceName, "verifiedaccess_trust_provider_id", trustProviderResourceName, "id"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
+func TestAccVerifiedAccessInstanceTrustProviderAttachment_disappears(t *testing.T) {
+	ctx := acctest.Context(t)
+	resourceName := "aws_verifiedaccess_instance_trust_provider_attachment.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			testAccPreCheckVerifiedAccessInstance(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, names.EC2),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckVerifiedAccessInstanceTrustProviderAttachmentDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccVerifiedAccessInstanceTrustProviderAttachmentConfig_basic(),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckVerifiedAccessInstanceTrustProviderAttachmentExists(ctx, resourceName),
+					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfec2.ResourceVerifiedAccessInstanceTrustProviderAttachment(), resourceName),
+				),
+				ExpectNonEmptyPlan: true,
+			},
+		},
+	})
+}
+
+func testAccCheckVerifiedAccessInstanceTrustProviderAttachmentExists(ctx context.Context, n string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		conn := acctest.Provider.Meta().(*conns.AWSClient).EC2Client(ctx)
+
+		vaiID, vatpID, err := tfec2.VerifiedAccessInstanceTrustProviderAttachmentParseResourceID(rs.Primary.ID)
+		if err != nil {
+			return err
+		}
+
+		err = tfec2.FindVerifiedAccessInstanceTrustProviderAttachmentExists(ctx, conn, vaiID, vatpID)
+
+		return err
+	}
+}
+
+func testAccCheckVerifiedAccessInstanceTrustProviderAttachmentDestroy(ctx context.Context) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		conn := acctest.Provider.Meta().(*conns.AWSClient).EC2Client(ctx)
+
+		for _, rs := range s.RootModule().Resources {
+			if rs.Type != "aws_verifiedaccess_instance_trust_provider_attachment" {
+				continue
+			}
+
+			vaiID, vatpID, err := tfec2.VerifiedAccessInstanceTrustProviderAttachmentParseResourceID(rs.Primary.ID)
+			if err != nil {
+				return err
+			}
+
+			err = tfec2.FindVerifiedAccessInstanceTrustProviderAttachmentExists(ctx, conn, vaiID, vatpID)
+
+			if tfresource.NotFound(err) {
+				continue
+			}
+
+			if err != nil {
+				return err
+			}
+
+			return fmt.Errorf("Verified Access Instance Trust Provider Attachment %s still exists", rs.Primary.ID)
+		}
+
+		return nil
+	}
+}
+
+func testAccVerifiedAccessInstanceTrustProviderAttachmentConfig_basic() string {
+	return `
+resource "aws_verifiedaccess_instance" "test" {}
+
+resource "aws_verifiedaccess_trust_provider" "test" {
+  device_trust_provider_type = "jamf"
+  policy_reference_name      = "test"
+  trust_provider_type        = "device"
+
+  device_options {
+    tenant_id = "test"
+  }
+}
+
+resource "aws_verifiedaccess_instance_trust_provider_attachment" "test" {
+  verifiedaccess_instance_id       = aws_verifiedaccess_instance.test.id
+  verifiedaccess_trust_provider_id = aws_verifiedaccess_trust_provider.test.id
+}
+`
+}
diff --git a/internal/service/ec2/verifiedaccess_trust_provider.go b/internal/service/ec2/verifiedaccess_trust_provider.go
new file mode 100644
index 00000000000..b7566e6c6be
--- /dev/null
+++ b/internal/service/ec2/verifiedaccess_trust_provider.go
@@ -0,0 +1,377 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package ec2
+
+import (
+	"context"
+	"log"
+	"time"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/ec2"
+	"github.com/aws/aws-sdk-go-v2/service/ec2/types"
+	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/enum"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
+	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/internal/verify"
+	"github.com/hashicorp/terraform-provider-aws/names"
+)
+
+// @SDKResource("aws_verifiedaccess_trust_provider", name="Verified Access Trust Provider")
+// @Tags(identifierAttribute="id")
+func ResourceVerifiedAccessTrustProvider() *schema.Resource {
+	return &schema.Resource{
+		CreateWithoutTimeout: resourceVerifiedAccessTrustProviderCreate,
+		ReadWithoutTimeout:   resourceVerifiedAccessTrustProviderRead,
+		UpdateWithoutTimeout: resourceVerifiedAccessTrustProviderUpdate,
+		DeleteWithoutTimeout: resourceVerifiedAccessTrustProviderDelete,
+
+		Importer: &schema.ResourceImporter{
+			StateContext: schema.ImportStatePassthroughContext,
+		},
+
+		Timeouts: &schema.ResourceTimeout{
+			Create: schema.DefaultTimeout(30 * time.Minute),
+			Update: schema.DefaultTimeout(30 * time.Minute),
+			Delete: schema.DefaultTimeout(30 * time.Minute),
+		},
+
+		Schema: map[string]*schema.Schema{
+			"description": {
+				Type:     schema.TypeString,
+				Optional: true,
+			},
+			"device_options": {
+				Type:     schema.TypeList,
+				ForceNew: true,
+				Optional: true,
+				MaxItems: 1,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"tenant_id": {
+							Type:     schema.TypeString,
+							Optional: true,
+						},
+					},
+				},
+			},
+			"device_trust_provider_type": {
+				Type:             schema.TypeString,
+				ForceNew:         true,
+				Optional:         true,
+				ValidateDiagFunc: enum.Validate[types.DeviceTrustProviderType](),
+			},
+			"oidc_options": {
+				Type:     schema.TypeList,
+				Optional: true,
+				MaxItems: 1,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"authorization_endpoint": {
+							Type:         schema.TypeString,
+							ForceNew:     true,
+							Optional:     true,
+							ValidateFunc: validation.IsURLWithHTTPS,
+						},
+						"client_id": {
+							Type:     schema.TypeString,
+							ForceNew: true,
+							Optional: true,
+						},
+						"client_secret": {
+							Type:      schema.TypeString,
+							Required:  true,
+							Sensitive: true,
+						},
+						"issuer": {
+							Type:         schema.TypeString,
+							ForceNew:     true,
+							Optional:     true,
+							ValidateFunc: validation.IsURLWithHTTPS,
+						},
+						"scope": {
+							Type:     schema.TypeString,
+							Optional: true,
+						},
+						"token_endpoint": {
+							Type:         schema.TypeString,
+							ForceNew:     true,
+							Optional:     true,
+							ValidateFunc: validation.IsURLWithHTTPS,
+						},
+						"user_info_endpoint": {
+							Type:         schema.TypeString,
+							ForceNew:     true,
+							Optional:     true,
+							ValidateFunc: validation.IsURLWithHTTPS,
+						},
+					},
+				},
+			},
+			"policy_reference_name": {
+				Type:     schema.TypeString,
+				ForceNew: true,
+				Required: true,
+			},
+			names.AttrTags:    tftags.TagsSchema(),
+			names.AttrTagsAll: tftags.TagsSchemaComputed(),
+			"trust_provider_type": {
+				Type:             schema.TypeString,
+				ForceNew:         true,
+				Required:         true,
+				ValidateDiagFunc: enum.Validate[types.TrustProviderType](),
+			},
+			"user_trust_provider_type": {
+				Type:             schema.TypeString,
+				ForceNew:         true,
+				Optional:         true,
+				ValidateDiagFunc: enum.Validate[types.UserTrustProviderType](),
+			},
+		},
+
+		CustomizeDiff: verify.SetTagsDiff,
+	}
+}
+
+func resourceVerifiedAccessTrustProviderCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).EC2Client(ctx)
+
+	input := &ec2.CreateVerifiedAccessTrustProviderInput{
+		PolicyReferenceName: aws.String(d.Get("policy_reference_name").(string)),
+		TagSpecifications:   getTagSpecificationsInV2(ctx, types.ResourceTypeVerifiedAccessTrustProvider),
+		TrustProviderType:   types.TrustProviderType(d.Get("trust_provider_type").(string)),
+	}
+
+	if v, ok := d.GetOk("description"); ok {
+		input.Description = aws.String(v.(string))
+	}
+
+	if v, ok := d.GetOk("device_options"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
+		input.DeviceOptions = expandCreateVerifiedAccessTrustProviderDeviceOptions(v.([]interface{})[0].(map[string]interface{}))
+	}
+
+	if v, ok := d.GetOk("device_trust_provider_type"); ok {
+		input.DeviceTrustProviderType = types.DeviceTrustProviderType(v.(string))
+	}
+
+	if v, ok := d.GetOk("oidc_options"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
+		input.OidcOptions = expandCreateVerifiedAccessTrustProviderOIDCOptions(v.([]interface{})[0].(map[string]interface{}))
+	}
+
+	if v, ok := d.GetOk("user_trust_provider_type"); ok {
+		input.UserTrustProviderType = types.UserTrustProviderType(v.(string))
+	}
+
+	output, err := conn.CreateVerifiedAccessTrustProvider(ctx, input)
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "creating Verified Access Trust Provider: %s", err)
+	}
+
+	d.SetId(aws.ToString(output.VerifiedAccessTrustProvider.VerifiedAccessTrustProviderId))
+
+	return append(diags, resourceVerifiedAccessTrustProviderRead(ctx, d, meta)...)
+}
+
+func resourceVerifiedAccessTrustProviderRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).EC2Client(ctx)
+
+	output, err := FindVerifiedAccessTrustProviderByID(ctx, conn, d.Id())
+
+	if !d.IsNewResource() && tfresource.NotFound(err) {
+		log.Printf("[WARN] EC2 Verified Access Trust Provider (%s) not found, removing from state", d.Id())
+		d.SetId("")
+		return diags
+	}
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "reading Verified Access Trust Provider (%s): %s", d.Id(), err)
+	}
+
+	d.Set("description", output.Description)
+	if v := output.DeviceOptions; v != nil {
+		if err := d.Set("device_options", flattenDeviceOptions(v)); err != nil {
+			return sdkdiag.AppendErrorf(diags, "setting device_options: %s", err)
+		}
+	} else {
+		d.Set("device_options", nil)
+	}
+	d.Set("device_trust_provider_type", output.DeviceTrustProviderType)
+	if v := output.OidcOptions; v != nil {
+		if err := d.Set("oidc_options", flattenOIDCOptions(v, d.Get("oidc_options.0.client_secret").(string))); err != nil {
+			return sdkdiag.AppendErrorf(diags, "setting oidc_options: %s", err)
+		}
+	} else {
+		d.Set("oidc_options", nil)
+	}
+	d.Set("policy_reference_name", output.PolicyReferenceName)
+	d.Set("trust_provider_type", output.TrustProviderType)
+	d.Set("user_trust_provider_type", output.UserTrustProviderType)
+
+	setTagsOutV2(ctx, output.Tags)
+
+	return diags
+}
+
+func resourceVerifiedAccessTrustProviderUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).EC2Client(ctx)
+
+	if d.HasChangesExcept("tags", "tags_all") {
+		input := &ec2.ModifyVerifiedAccessTrustProviderInput{
+			VerifiedAccessTrustProviderId: aws.String(d.Id()),
+		}
+
+		if d.HasChange("description") {
+			input.Description = aws.String(d.Get("description").(string))
+		}
+
+		if d.HasChange("oidc_options") {
+			if v, ok := d.GetOk("oidc_options"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
+				input.OidcOptions = expandModifyVerifiedAccessTrustProviderOIDCOptions(v.([]interface{})[0].(map[string]interface{}))
+			}
+		}
+
+		_, err := conn.ModifyVerifiedAccessTrustProvider(ctx, input)
+
+		if err != nil {
+			return sdkdiag.AppendErrorf(diags, "updating Verified Access Trust Provider (%s): %s", d.Id(), err)
+		}
+	}
+
+	return append(diags, resourceVerifiedAccessTrustProviderRead(ctx, d, meta)...)
+}
+
+func resourceVerifiedAccessTrustProviderDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).EC2Client(ctx)
+
+	log.Printf("[INFO] Deleting Verified Access Trust Provider: %s", d.Id())
+	_, err := conn.DeleteVerifiedAccessTrustProvider(ctx, &ec2.DeleteVerifiedAccessTrustProviderInput{
+		VerifiedAccessTrustProviderId: aws.String(d.Id()),
+	})
+
+	if tfawserr.ErrCodeEquals(err, errCodeInvalidVerifiedAccessTrustProviderIdNotFound) {
+		return diags
+	}
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "deleting Verified Access Trust Provider (%s): %s", d.Id(), err)
+	}
+
+	return diags
+}
+
+func flattenDeviceOptions(apiObject *types.DeviceOptions) []interface{} {
+	if apiObject == nil {
+		return nil
+	}
+
+	tfMap := map[string]interface{}{}
+
+	if v := apiObject.TenantId; v != nil {
+		tfMap["tenant_id"] = aws.ToString(v)
+	}
+
+	return []interface{}{tfMap}
+}
+
+func flattenOIDCOptions(apiObject *types.OidcOptions, clientSecret string) []interface{} {
+	if apiObject == nil {
+		return nil
+	}
+
+	tfMap := map[string]interface{}{
+		"client_secret": clientSecret,
+	}
+
+	if v := apiObject.AuthorizationEndpoint; v != nil {
+		tfMap["authorization_endpoint"] = aws.ToString(v)
+	}
+	if v := apiObject.ClientId; v != nil {
+		tfMap["client_id"] = aws.ToString(v)
+	}
+	if v := apiObject.Issuer; v != nil {
+		tfMap["issuer"] = aws.ToString(v)
+	}
+	if v := apiObject.Scope; v != nil {
+		tfMap["scope"] = aws.ToString(v)
+	}
+	if v := apiObject.TokenEndpoint; v != nil {
+		tfMap["token_endpoint"] = aws.ToString(v)
+	}
+	if v := apiObject.UserInfoEndpoint; v != nil {
+		tfMap["user_info_endpoint"] = aws.ToString(v)
+	}
+
+	return []interface{}{tfMap}
+}
+
+func expandCreateVerifiedAccessTrustProviderDeviceOptions(tfMap map[string]interface{}) *types.CreateVerifiedAccessTrustProviderDeviceOptions {
+	if tfMap == nil {
+		return nil
+	}
+
+	apiObject := &types.CreateVerifiedAccessTrustProviderDeviceOptions{}
+
+	if v, ok := tfMap["tenant_id"].(string); ok && v != "" {
+		apiObject.TenantId = aws.String(v)
+	}
+
+	return apiObject
+}
+
+func expandCreateVerifiedAccessTrustProviderOIDCOptions(tfMap map[string]interface{}) *types.CreateVerifiedAccessTrustProviderOidcOptions {
+	if tfMap == nil {
+		return nil
+	}
+
+	apiObject := &types.CreateVerifiedAccessTrustProviderOidcOptions{}
+
+	if v, ok := tfMap["authorization_endpoint"].(string); ok && v != "" {
+		apiObject.AuthorizationEndpoint = aws.String(v)
+	}
+	if v, ok := tfMap["client_id"].(string); ok && v != "" {
+		apiObject.ClientId = aws.String(v)
+	}
+	if v, ok := tfMap["client_secret"].(string); ok && v != "" {
+		apiObject.ClientSecret = aws.String(v)
+	}
+	if v, ok := tfMap["issuer"].(string); ok && v != "" {
+		apiObject.Issuer = aws.String(v)
+	}
+	if v, ok := tfMap["scope"].(string); ok && v != "" {
+		apiObject.Scope = aws.String(v)
+	}
+	if v, ok := tfMap["token_endpoint"].(string); ok && v != "" {
+		apiObject.TokenEndpoint = aws.String(v)
+	}
+	if v, ok := tfMap["user_info_endpoint"].(string); ok && v != "" {
+		apiObject.UserInfoEndpoint = aws.String(v)
+	}
+
+	return apiObject
+}
+
+func expandModifyVerifiedAccessTrustProviderOIDCOptions(tfMap map[string]interface{}) *types.ModifyVerifiedAccessTrustProviderOidcOptions {
+	if tfMap == nil {
+		return nil
+	}
+
+	apiObject := &types.ModifyVerifiedAccessTrustProviderOidcOptions{}
+
+	if v, ok := tfMap["scope"].(string); ok && v != "" {
+		apiObject.Scope = aws.String(v)
+	}
+
+	return apiObject
+}
diff --git a/internal/service/ec2/verifiedaccess_trust_provider_test.go b/internal/service/ec2/verifiedaccess_trust_provider_test.go
new file mode 100644
index 00000000000..552ddce46c4
--- /dev/null
+++ b/internal/service/ec2/verifiedaccess_trust_provider_test.go
@@ -0,0 +1,370 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package ec2_test
+
+import (
+	"context"
+	"fmt"
+	"testing"
+
+	"github.com/aws/aws-sdk-go-v2/service/ec2"
+	"github.com/aws/aws-sdk-go-v2/service/ec2/types"
+	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
+	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	tfec2 "github.com/hashicorp/terraform-provider-aws/internal/service/ec2"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/names"
+)
+
+func TestAccVerifiedAccessTrustProvider_basic(t *testing.T) {
+	ctx := acctest.Context(t)
+	var v types.VerifiedAccessTrustProvider
+	resourceName := "aws_verifiedaccess_trust_provider.test"
+	policyReferenceName := "test"
+	trustProviderType := "user"
+	userTrustProviderType := "iam-identity-center"
+	description := sdkacctest.RandString(10)
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, names.EC2)
+			testAccPreCheckVerifiedAccess(ctx, t)
+			acctest.PreCheckIAMServiceLinkedRole(ctx, t, "/aws-service-role/sso.amazonaws.com")
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, names.EC2),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckVerifiedAccessTrustProviderDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccVerifiedAccessTrustProviderConfig_basic(policyReferenceName, trustProviderType, userTrustProviderType, description),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckVerifiedAccessTrustProviderExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "description", description),
+					resource.TestCheckResourceAttr(resourceName, "policy_reference_name", policyReferenceName),
+					resource.TestCheckResourceAttr(resourceName, "trust_provider_type", trustProviderType),
+					resource.TestCheckResourceAttr(resourceName, "user_trust_provider_type", userTrustProviderType),
+				),
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{},
+			},
+		},
+	})
+}
+
+func TestAccVerifiedAccessTrustProvider_deviceOptions(t *testing.T) {
+	ctx := acctest.Context(t)
+	var v types.VerifiedAccessTrustProvider
+	resourceName := "aws_verifiedaccess_trust_provider.test"
+	policyReferenceName := "test"
+	trustProviderType := "device"
+	deviceTrustProviderType := "jamf"
+	tenantId := sdkacctest.RandString(10)
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			testAccPreCheckVerifiedAccess(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, names.EC2),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckVerifiedAccessTrustProviderDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccVerifiedAccessTrustProviderConfig_deviceOptions(policyReferenceName, trustProviderType, deviceTrustProviderType, tenantId),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckVerifiedAccessTrustProviderExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "device_options.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "device_options.0.tenant_id", tenantId),
+					resource.TestCheckResourceAttr(resourceName, "device_trust_provider_type", deviceTrustProviderType),
+					resource.TestCheckResourceAttr(resourceName, "policy_reference_name", policyReferenceName),
+					resource.TestCheckResourceAttr(resourceName, "trust_provider_type", trustProviderType),
+				),
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{},
+			},
+		},
+	})
+}
+
+func TestAccVerifiedAccessTrustProvider_disappears(t *testing.T) {
+	ctx := acctest.Context(t)
+	var v types.VerifiedAccessTrustProvider
+	resourceName := "aws_verifiedaccess_trust_provider.test"
+	policyReferenceName := "test"
+	trustProviderType := "user"
+	userTrustProviderType := "iam-identity-center"
+	description := sdkacctest.RandString(10)
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, names.EC2)
+			acctest.PreCheckIAMServiceLinkedRole(ctx, t, "/aws-service-role/sso.amazonaws.com")
+			testAccPreCheckVerifiedAccess(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, names.EC2),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckVerifiedAccessTrustProviderDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccVerifiedAccessTrustProviderConfig_basic(policyReferenceName, trustProviderType, userTrustProviderType, description),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckVerifiedAccessTrustProviderExists(ctx, resourceName, &v),
+					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfec2.ResourceVerifiedAccessTrustProvider(), resourceName),
+				),
+				ExpectNonEmptyPlan: true,
+			},
+		},
+	})
+}
+
+func TestAccVerifiedAccessTrustProvider_oidcOptions(t *testing.T) {
+	ctx := acctest.Context(t)
+	var v types.VerifiedAccessTrustProvider
+	resourceName := "aws_verifiedaccess_trust_provider.test"
+	policyReferenceName := "test"
+	trustProviderType := "user"
+	userTrustProviderType := "oidc"
+	authorizationEndpoint := "https://authorization.example.com"
+	clientId := sdkacctest.RandString(10)
+	clientSecret := sdkacctest.RandString(10)
+	issuer := "https://issuer.example.com"
+	scope := sdkacctest.RandString(10)
+	tokenEndpoint := "https://token.example.com"
+	userInfoEndpoint := "https://user.example.com"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			testAccPreCheckVerifiedAccess(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, names.EC2),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckVerifiedAccessTrustProviderDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccVerifiedAccessTrustProviderConfig_oidcOptions(policyReferenceName, trustProviderType, userTrustProviderType, authorizationEndpoint, clientId, clientSecret, issuer, scope, tokenEndpoint, userInfoEndpoint),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckVerifiedAccessTrustProviderExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "oidc_options.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "oidc_options.0.authorization_endpoint", authorizationEndpoint),
+					resource.TestCheckResourceAttr(resourceName, "oidc_options.0.client_id", clientId),
+					resource.TestCheckResourceAttr(resourceName, "oidc_options.0.client_secret", clientSecret),
+					resource.TestCheckResourceAttr(resourceName, "oidc_options.0.issuer", issuer),
+					resource.TestCheckResourceAttr(resourceName, "oidc_options.0.scope", scope),
+					resource.TestCheckResourceAttr(resourceName, "oidc_options.0.token_endpoint", tokenEndpoint),
+					resource.TestCheckResourceAttr(resourceName, "oidc_options.0.user_info_endpoint", userInfoEndpoint),
+					resource.TestCheckResourceAttr(resourceName, "policy_reference_name", policyReferenceName),
+					resource.TestCheckResourceAttr(resourceName, "trust_provider_type", trustProviderType),
+					resource.TestCheckResourceAttr(resourceName, "user_trust_provider_type", userTrustProviderType),
+				),
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"oidc_options.0.client_secret"},
+			},
+		},
+	})
+}
+
+func TestAccVerifiedAccessTrustProvider_tags(t *testing.T) {
+	ctx := acctest.Context(t)
+	var v types.VerifiedAccessTrustProvider
+	resourceName := "aws_verifiedaccess_trust_provider.test"
+	policyReferenceName := "test"
+	trustProviderType := "user"
+	userTrustProviderType := "iam-identity-center"
+	description := sdkacctest.RandString(10)
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			testAccPreCheckVerifiedAccess(ctx, t)
+			acctest.PreCheckIAMServiceLinkedRole(ctx, t, "/aws-service-role/sso.amazonaws.com")
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, names.EC2),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckVerifiedAccessTrustProviderDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccVerifiedAccessTrustProviderConfig_tags1(policyReferenceName, trustProviderType, userTrustProviderType, description, "key1", "value1"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckVerifiedAccessTrustProviderExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
+				),
+			},
+			{
+				Config: testAccVerifiedAccessTrustProviderConfig_tags2(policyReferenceName, trustProviderType, userTrustProviderType, description, "key1", "value1updated", "key2", "value2"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckVerifiedAccessTrustProviderExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1updated"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
+				),
+			},
+			{
+				Config: testAccVerifiedAccessTrustProviderConfig_tags1(policyReferenceName, trustProviderType, userTrustProviderType, description, "key2", "value2"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckVerifiedAccessTrustProviderExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
+				),
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{},
+			},
+		},
+	})
+}
+
+func testAccCheckVerifiedAccessTrustProviderExists(ctx context.Context, n string, v *types.VerifiedAccessTrustProvider) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		conn := acctest.Provider.Meta().(*conns.AWSClient).EC2Client(ctx)
+
+		output, err := tfec2.FindVerifiedAccessTrustProviderByID(ctx, conn, rs.Primary.ID)
+
+		if err != nil {
+			return err
+		}
+
+		*v = *output
+
+		return nil
+	}
+}
+
+func testAccCheckVerifiedAccessTrustProviderDestroy(ctx context.Context) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		conn := acctest.Provider.Meta().(*conns.AWSClient).EC2Client(ctx)
+
+		for _, rs := range s.RootModule().Resources {
+			if rs.Type != "aws_verifiedaccess_trust_provider" {
+				continue
+			}
+
+			_, err := tfec2.FindVerifiedAccessTrustProviderByID(ctx, conn, rs.Primary.ID)
+
+			if tfresource.NotFound(err) {
+				continue
+			}
+
+			if err != nil {
+				return err
+			}
+
+			return fmt.Errorf("Verified Access Trust Provider %s still exists", rs.Primary.ID)
+		}
+
+		return nil
+	}
+}
+
+func testAccPreCheckVerifiedAccess(ctx context.Context, t *testing.T) {
+	conn := acctest.Provider.Meta().(*conns.AWSClient).EC2Client(ctx)
+
+	input := &ec2.DescribeVerifiedAccessTrustProvidersInput{}
+	_, err := conn.DescribeVerifiedAccessTrustProviders(ctx, input)
+
+	if acctest.PreCheckSkipError(err) {
+		t.Skipf("skipping acceptance testing: %s", err)
+	}
+	if err != nil {
+		t.Fatalf("unexpected PreCheck error: %s", err)
+	}
+}
+
+func testAccVerifiedAccessTrustProviderConfig_basic(policyReferenceName, trustProviderType, userTrustProviderType, description string) string {
+	return fmt.Sprintf(`
+resource "aws_verifiedaccess_trust_provider" "test" {
+  description              = %[4]q
+  policy_reference_name    = %[1]q
+  trust_provider_type      = %[2]q
+  user_trust_provider_type = %[3]q
+}
+`, policyReferenceName, trustProviderType, userTrustProviderType, description)
+}
+
+func testAccVerifiedAccessTrustProviderConfig_deviceOptions(policyReferenceName, trustProviderType, deviceTrustProviderType, tenantId string) string {
+	return fmt.Sprintf(`
+resource "aws_verifiedaccess_trust_provider" "test" {
+  device_options {
+    tenant_id = %[4]q
+  }
+  device_trust_provider_type = %[3]q
+  policy_reference_name      = %[1]q
+  trust_provider_type        = %[2]q
+}
+`, policyReferenceName, trustProviderType, deviceTrustProviderType, tenantId)
+}
+
+func testAccVerifiedAccessTrustProviderConfig_oidcOptions(policyReferenceName, trustProviderType, userTrustProviderType, authorizationEndpoint, clientId, clientSecret, issuer, scope, tokenEndpoint, userInfoEndpoint string) string {
+	return fmt.Sprintf(`
+resource "aws_verifiedaccess_trust_provider" "test" {
+  oidc_options {
+    authorization_endpoint = %[4]q
+    client_id              = %[5]q
+    client_secret          = %[6]q
+    issuer                 = %[7]q
+    scope                  = %[8]q
+    token_endpoint         = %[9]q
+    user_info_endpoint     = %[10]q
+  }
+  policy_reference_name    = %[1]q
+  trust_provider_type      = %[2]q
+  user_trust_provider_type = %[3]q
+}
+`, policyReferenceName, trustProviderType, userTrustProviderType, authorizationEndpoint, clientId, clientSecret, issuer, scope, tokenEndpoint, userInfoEndpoint)
+}
+
+func testAccVerifiedAccessTrustProviderConfig_tags1(policyReferenceName, trustProviderType, userTrustProviderType, description, tagKey1, tagValue1 string) string {
+	return fmt.Sprintf(`
+resource "aws_verifiedaccess_trust_provider" "test" {
+  description              = %[4]q
+  policy_reference_name    = %[1]q
+  trust_provider_type      = %[2]q
+  user_trust_provider_type = %[3]q
+  tags = {
+    %[5]q = %[6]q
+  }
+}
+`, policyReferenceName, trustProviderType, userTrustProviderType, description, tagKey1, tagValue1)
+}
+
+func testAccVerifiedAccessTrustProviderConfig_tags2(policyReferenceName, trustProviderType, userTrustProviderType, description, tagKey1, tagValue1, tagKey2, tagValue2 string) string {
+	return fmt.Sprintf(`
+resource "aws_verifiedaccess_trust_provider" "test" {
+  description              = %[4]q
+  policy_reference_name    = %[1]q
+  trust_provider_type      = %[2]q
+  user_trust_provider_type = %[3]q
+  tags = {
+    %[5]q = %[6]q
+    %[7]q = %[8]q
+  }
+}
+`, policyReferenceName, trustProviderType, userTrustProviderType, description, tagKey1, tagValue1, tagKey2, tagValue2)
+}
diff --git a/internal/service/ec2/vpc_.go b/internal/service/ec2/vpc_.go
index 639562d19c6..e6cb0dd5d46 100644
--- a/internal/service/ec2/vpc_.go
+++ b/internal/service/ec2/vpc_.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -8,16 +11,18 @@ import (
 	"strings"
 	"time"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/aws/arn"
-	"github.com/aws/aws-sdk-go/service/ec2"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/aws/arn"
+	"github.com/aws/aws-sdk-go-v2/service/ec2"
+	"github.com/aws/aws-sdk-go-v2/service/ec2/types"
+	tfawserr_sdkv2 "github.com/hashicorp/aws-sdk-go-base/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/customdiff"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/enum"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
 	"github.com/hashicorp/terraform-provider-aws/internal/slices"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
@@ -108,8 +113,8 @@ func ResourceVPC() *schema.Resource {
 			"instance_tenancy": {
 				Type:         schema.TypeString,
 				Optional:     true,
-				Default:      ec2.TenancyDefault,
-				ValidateFunc: validation.StringInSlice([]string{ec2.TenancyDefault, ec2.TenancyDedicated}, false),
+				Default:      types.TenancyDefault,
+				ValidateFunc: validation.StringInSlice(enum.Slice(types.TenancyDefault, types.TenancyDedicated), false),
 			},
 			"ipv4_ipam_pool_id": {
 				Type:     schema.TypeString,
@@ -172,12 +177,12 @@ func ResourceVPC() *schema.Resource {
 
 func resourceVPCCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).EC2Conn(ctx)
+	conn := meta.(*conns.AWSClient).EC2Client(ctx)
 
 	input := &ec2.CreateVpcInput{
 		AmazonProvidedIpv6CidrBlock: aws.Bool(d.Get("assign_generated_ipv6_cidr_block").(bool)),
-		InstanceTenancy:             aws.String(d.Get("instance_tenancy").(string)),
-		TagSpecifications:           getTagSpecificationsIn(ctx, ec2.ResourceTypeVpc),
+		InstanceTenancy:             types.Tenancy(d.Get("instance_tenancy").(string)),
+		TagSpecifications:           getTagSpecificationsInV2(ctx, types.ResourceTypeVpc),
 	}
 
 	if v, ok := d.GetOk("cidr_block"); ok {
@@ -189,7 +194,7 @@ func resourceVPCCreate(ctx context.Context, d *schema.ResourceData, meta interfa
 	}
 
 	if v, ok := d.GetOk("ipv4_netmask_length"); ok {
-		input.Ipv4NetmaskLength = aws.Int64(int64(v.(int)))
+		input.Ipv4NetmaskLength = aws.Int32(int32(v.(int)))
 	}
 
 	if v, ok := d.GetOk("ipv6_cidr_block"); ok {
@@ -205,12 +210,12 @@ func resourceVPCCreate(ctx context.Context, d *schema.ResourceData, meta interfa
 	}
 
 	if v, ok := d.GetOk("ipv6_netmask_length"); ok {
-		input.Ipv6NetmaskLength = aws.Int64(int64(v.(int)))
+		input.Ipv6NetmaskLength = aws.Int32(int32(v.(int)))
 	}
 
-	outputRaw, err := tfresource.RetryWhenAWSErrMessageContains(ctx, propagationTimeout, func() (interface{}, error) {
-		return conn.CreateVpcWithContext(ctx, input)
-		// "UnsupportedOperation: The operation AllocateIpamPoolCidr is not supported. Account 123456789012 is not monitored by IPAM ipam-07b079e3392782a55."
+	// "UnsupportedOperation: The operation AllocateIpamPoolCidr is not supported. Account 123456789012 is not monitored by IPAM ipam-07b079e3392782a55."
+	outputRaw, err := tfresource.RetryWhenAWSErrMessageContains(ctx, ec2PropagationTimeout, func() (interface{}, error) {
+		return conn.CreateVpc(ctx, input)
 	}, errCodeUnsupportedOperation, "is not monitored by IPAM")
 
 	if err != nil {
@@ -219,21 +224,19 @@ func resourceVPCCreate(ctx context.Context, d *schema.ResourceData, meta interfa
 
 	output := outputRaw.(*ec2.CreateVpcOutput)
 
-	d.SetId(aws.StringValue(output.Vpc.VpcId))
+	d.SetId(aws.ToString(output.Vpc.VpcId))
 
-	vpc, err := WaitVPCCreated(ctx, conn, d.Id())
+	vpc, err := waitVPCCreatedV2(ctx, conn, d.Id())
 
 	if err != nil {
 		return sdkdiag.AppendErrorf(diags, "waiting for EC2 VPC (%s) create: %s", d.Id(), err)
 	}
 
-	if len(vpc.Ipv6CidrBlockAssociationSet) > 0 && vpc.Ipv6CidrBlockAssociationSet[0] != nil {
-		associationID := aws.StringValue(output.Vpc.Ipv6CidrBlockAssociationSet[0].AssociationId)
-
-		_, err = WaitVPCIPv6CIDRBlockAssociationCreated(ctx, conn, associationID, vpcIPv6CIDRBlockAssociationCreatedTimeout)
+	if len(vpc.Ipv6CidrBlockAssociationSet) > 0 {
+		associationID := aws.ToString(output.Vpc.Ipv6CidrBlockAssociationSet[0].AssociationId)
 
-		if err != nil {
-			return sdkdiag.AppendErrorf(diags, "waiting for EC2 VPC (%s) IPv6 CIDR block (%s) to become associated: %s", d.Id(), associationID, err)
+		if _, err := waitVPCIPv6CIDRBlockAssociationCreatedV2(ctx, conn, associationID, vpcIPv6CIDRBlockAssociationCreatedTimeout); err != nil {
+			return sdkdiag.AppendErrorf(diags, "waiting for EC2 VPC (%s) IPv6 CIDR block (%s) associated: %s", d.Id(), associationID, err)
 		}
 	}
 
@@ -253,10 +256,10 @@ func resourceVPCCreate(ctx context.Context, d *schema.ResourceData, meta interfa
 
 func resourceVPCRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).EC2Conn(ctx)
+	conn := meta.(*conns.AWSClient).EC2Client(ctx)
 
-	outputRaw, err := tfresource.RetryWhenNewResourceNotFound(ctx, propagationTimeout, func() (interface{}, error) {
-		return FindVPCByID(ctx, conn, d.Id())
+	outputRaw, err := tfresource.RetryWhenNewResourceNotFound(ctx, ec2PropagationTimeout, func() (interface{}, error) {
+		return findVPCByIDV2(ctx, conn, d.Id())
 	}, d.IsNewResource())
 
 	if !d.IsNewResource() && tfresource.NotFound(err) {
@@ -269,12 +272,12 @@ func resourceVPCRead(ctx context.Context, d *schema.ResourceData, meta interface
 		return sdkdiag.AppendErrorf(diags, "reading EC2 VPC (%s): %s", d.Id(), err)
 	}
 
-	vpc := outputRaw.(*ec2.Vpc)
+	vpc := outputRaw.(*types.Vpc)
 
-	ownerID := aws.StringValue(vpc.OwnerId)
+	ownerID := aws.ToString(vpc.OwnerId)
 	arn := arn.ARN{
 		Partition: meta.(*conns.AWSClient).Partition,
-		Service:   ec2.ServiceName,
+		Service:   names.EC2,
 		Region:    meta.(*conns.AWSClient).Region,
 		AccountID: ownerID,
 		Resource:  fmt.Sprintf("vpc/%s", d.Id()),
@@ -285,37 +288,37 @@ func resourceVPCRead(ctx context.Context, d *schema.ResourceData, meta interface
 	d.Set("instance_tenancy", vpc.InstanceTenancy)
 	d.Set("owner_id", ownerID)
 
-	if v, err := tfresource.RetryWhenNewResourceNotFound(ctx, propagationTimeout, func() (interface{}, error) {
-		return FindVPCAttribute(ctx, conn, d.Id(), ec2.VpcAttributeNameEnableDnsHostnames)
+	if v, err := tfresource.RetryWhenNewResourceNotFound(ctx, ec2PropagationTimeout, func() (interface{}, error) {
+		return findVPCAttributeV2(ctx, conn, d.Id(), types.VpcAttributeNameEnableDnsHostnames)
 	}, d.IsNewResource()); err != nil {
-		return sdkdiag.AppendErrorf(diags, "reading EC2 VPC (%s) Attribute (%s): %s", d.Id(), ec2.VpcAttributeNameEnableDnsHostnames, err)
+		return sdkdiag.AppendErrorf(diags, "reading EC2 VPC (%s) Attribute (%s): %s", d.Id(), types.VpcAttributeNameEnableDnsHostnames, err)
 	} else {
 		d.Set("enable_dns_hostnames", v)
 	}
 
-	if v, err := tfresource.RetryWhenNewResourceNotFound(ctx, propagationTimeout, func() (interface{}, error) {
-		return FindVPCAttribute(ctx, conn, d.Id(), ec2.VpcAttributeNameEnableDnsSupport)
+	if v, err := tfresource.RetryWhenNewResourceNotFound(ctx, ec2PropagationTimeout, func() (interface{}, error) {
+		return findVPCAttributeV2(ctx, conn, d.Id(), types.VpcAttributeNameEnableDnsSupport)
 	}, d.IsNewResource()); err != nil {
-		return sdkdiag.AppendErrorf(diags, "reading EC2 VPC (%s) Attribute (%s): %s", d.Id(), ec2.VpcAttributeNameEnableDnsSupport, err)
+		return sdkdiag.AppendErrorf(diags, "reading EC2 VPC (%s) Attribute (%s): %s", d.Id(), types.VpcAttributeNameEnableDnsSupport, err)
 	} else {
 		d.Set("enable_dns_support", v)
 	}
 
-	if v, err := tfresource.RetryWhenNewResourceNotFound(ctx, propagationTimeout, func() (interface{}, error) {
-		return FindVPCAttribute(ctx, conn, d.Id(), ec2.VpcAttributeNameEnableNetworkAddressUsageMetrics)
+	if v, err := tfresource.RetryWhenNewResourceNotFound(ctx, ec2PropagationTimeout, func() (interface{}, error) {
+		return findVPCAttributeV2(ctx, conn, d.Id(), types.VpcAttributeNameEnableNetworkAddressUsageMetrics)
 	}, d.IsNewResource()); err != nil {
-		return sdkdiag.AppendErrorf(diags, "reading EC2 VPC (%s) Attribute (%s): %s", d.Id(), ec2.VpcAttributeNameEnableNetworkAddressUsageMetrics, err)
+		return sdkdiag.AppendErrorf(diags, "reading EC2 VPC (%s) Attribute (%s): %s", d.Id(), types.VpcAttributeNameEnableNetworkAddressUsageMetrics, err)
 	} else {
 		d.Set("enable_network_address_usage_metrics", v)
 	}
 
-	if v, err := FindVPCDefaultNetworkACL(ctx, conn, d.Id()); err != nil {
+	if v, err := findVPCDefaultNetworkACLV2(ctx, conn, d.Id()); err != nil {
 		log.Printf("[WARN] Error reading EC2 VPC (%s) default NACL: %s", d.Id(), err)
 	} else {
 		d.Set("default_network_acl_id", v.NetworkAclId)
 	}
 
-	if v, err := FindVPCMainRouteTable(ctx, conn, d.Id()); err != nil {
+	if v, err := findVPCMainRouteTableV2(ctx, conn, d.Id()); err != nil {
 		log.Printf("[WARN] Error reading EC2 VPC (%s) main Route Table: %s", d.Id(), err)
 		d.Set("default_route_table_id", nil)
 		d.Set("main_route_table_id", nil)
@@ -324,7 +327,7 @@ func resourceVPCRead(ctx context.Context, d *schema.ResourceData, meta interface
 		d.Set("main_route_table_id", v.RouteTableId)
 	}
 
-	if v, err := FindVPCDefaultSecurityGroup(ctx, conn, d.Id()); err != nil {
+	if v, err := FindVPCDefaultSecurityGroupV2(ctx, conn, d.Id()); err != nil {
 		log.Printf("[WARN] Error reading EC2 VPC (%s) default Security Group: %s", d.Id(), err)
 		d.Set("default_security_group_id", nil)
 	} else {
@@ -339,8 +342,8 @@ func resourceVPCRead(ctx context.Context, d *schema.ResourceData, meta interface
 		d.Set("ipv6_ipam_pool_id", nil)
 		d.Set("ipv6_netmask_length", nil)
 	} else {
-		cidrBlock := aws.StringValue(ipv6CIDRBlockAssociation.Ipv6CidrBlock)
-		ipv6PoolID := aws.StringValue(ipv6CIDRBlockAssociation.Ipv6Pool)
+		cidrBlock := aws.ToString(ipv6CIDRBlockAssociation.Ipv6CidrBlock)
+		ipv6PoolID := aws.ToString(ipv6CIDRBlockAssociation.Ipv6Pool)
 		isAmazonIPv6Pool := ipv6PoolID == amazonIPv6PoolID
 		d.Set("assign_generated_ipv6_cidr_block", isAmazonIPv6Pool)
 		d.Set("ipv6_association_id", ipv6CIDRBlockAssociation.AssociationId)
@@ -370,14 +373,14 @@ func resourceVPCRead(ctx context.Context, d *schema.ResourceData, meta interface
 		}
 	}
 
-	setTagsOut(ctx, vpc.Tags)
+	setTagsOutV2(ctx, vpc.Tags)
 
 	return diags
 }
 
 func resourceVPCUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).EC2Conn(ctx)
+	conn := meta.(*conns.AWSClient).EC2Client(ctx)
 
 	if d.HasChange("enable_dns_hostnames") {
 		if err := modifyVPCDNSHostnames(ctx, conn, d.Id(), d.Get("enable_dns_hostnames").(bool)); err != nil {
@@ -440,7 +443,7 @@ func resourceVPCUpdate(ctx context.Context, d *schema.ResourceData, meta interfa
 
 func resourceVPCDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).EC2Conn(ctx)
+	conn := meta.(*conns.AWSClient).EC2Client(ctx)
 
 	input := &ec2.DeleteVpcInput{
 		VpcId: aws.String(d.Id()),
@@ -448,10 +451,10 @@ func resourceVPCDelete(ctx context.Context, d *schema.ResourceData, meta interfa
 
 	log.Printf("[INFO] Deleting EC2 VPC: %s", d.Id())
 	_, err := tfresource.RetryWhenAWSErrCodeEquals(ctx, vpcDeletedTimeout, func() (interface{}, error) {
-		return conn.DeleteVpcWithContext(ctx, input)
+		return conn.DeleteVpc(ctx, input)
 	}, errCodeDependencyViolation)
 
-	if tfawserr.ErrCodeEquals(err, errCodeInvalidVPCIDNotFound) {
+	if tfawserr_sdkv2.ErrCodeEquals(err, errCodeInvalidVPCIDNotFound) {
 		return diags
 	}
 
@@ -460,7 +463,7 @@ func resourceVPCDelete(ctx context.Context, d *schema.ResourceData, meta interfa
 	}
 
 	_, err = tfresource.RetryUntilNotFound(ctx, vpcDeletedTimeout, func() (interface{}, error) {
-		return FindVPCByID(ctx, conn, d.Id())
+		return findVPCByIDV2(ctx, conn, d.Id())
 	})
 
 	if err != nil {
@@ -510,7 +513,7 @@ func resourceVPCCustomizeDiff(_ context.Context, diff *schema.ResourceDiff, v in
 
 	if diff.HasChange("instance_tenancy") {
 		old, new := diff.GetChange("instance_tenancy")
-		if old.(string) != ec2.TenancyDedicated || new.(string) != ec2.TenancyDefault {
+		if old.(string) != string(types.TenancyDedicated) || new.(string) != string(types.TenancyDefault) {
 			diff.ForceNew("instance_tenancy")
 		}
 	}
@@ -530,32 +533,31 @@ func resourceVPCCustomizeDiff(_ context.Context, diff *schema.ResourceDiff, v in
 // defaultIPv6CIDRBlockAssociation returns the "default" IPv6 CIDR block.
 // Try and find IPv6 CIDR block information, first by any stored association ID.
 // Then if no IPv6 CIDR block information is available, use the first associated IPv6 CIDR block.
-func defaultIPv6CIDRBlockAssociation(vpc *ec2.Vpc, associationID string) *ec2.VpcIpv6CidrBlockAssociation {
-	var ipv6CIDRBlockAssociation *ec2.VpcIpv6CidrBlockAssociation
+func defaultIPv6CIDRBlockAssociation(vpc *types.Vpc, associationID string) *types.VpcIpv6CidrBlockAssociation {
+	var ipv6CIDRBlockAssociation types.VpcIpv6CidrBlockAssociation
 
 	if associationID != "" {
 		for _, v := range vpc.Ipv6CidrBlockAssociationSet {
-			if state := aws.StringValue(v.Ipv6CidrBlockState.State); state == ec2.VpcCidrBlockStateCodeAssociated && aws.StringValue(v.AssociationId) == associationID {
+			if state := string(v.Ipv6CidrBlockState.State); state == string(types.VpcCidrBlockStateCodeAssociated) && aws.ToString(v.AssociationId) == associationID {
 				ipv6CIDRBlockAssociation = v
-
 				break
 			}
 		}
 	}
 
-	if ipv6CIDRBlockAssociation == nil {
+	if ipv6CIDRBlockAssociation == (types.VpcIpv6CidrBlockAssociation{}) {
 		for _, v := range vpc.Ipv6CidrBlockAssociationSet {
-			if aws.StringValue(v.Ipv6CidrBlockState.State) == ec2.VpcCidrBlockStateCodeAssociated {
+			if string(v.Ipv6CidrBlockState.State) == string(types.VpcCidrBlockStateCodeAssociated) {
 				ipv6CIDRBlockAssociation = v
 			}
 		}
 	}
 
-	return ipv6CIDRBlockAssociation
+	return &ipv6CIDRBlockAssociation
 }
 
 type vpcInfo struct {
-	vpc                              *ec2.Vpc
+	vpc                              *types.Vpc
 	enableDnsHostnames               bool
 	enableDnsSupport                 bool
 	enableNetworkAddressUsageMetrics bool
@@ -563,7 +565,7 @@ type vpcInfo struct {
 
 // modifyVPCAttributesOnCreate sets VPC attributes on resource Create.
 // Called after new VPC creation or existing default VPC adoption.
-func modifyVPCAttributesOnCreate(ctx context.Context, conn *ec2.EC2, d *schema.ResourceData, vpcInfo *vpcInfo) error {
+func modifyVPCAttributesOnCreate(ctx context.Context, conn *ec2.Client, d *schema.ResourceData, vpcInfo *vpcInfo) error {
 	if new, old := d.Get("enable_dns_hostnames").(bool), vpcInfo.enableDnsHostnames; old != new {
 		if err := modifyVPCDNSHostnames(ctx, conn, d.Id(), new); err != nil {
 			return err
@@ -585,57 +587,57 @@ func modifyVPCAttributesOnCreate(ctx context.Context, conn *ec2.EC2, d *schema.R
 	return nil
 }
 
-func modifyVPCDNSHostnames(ctx context.Context, conn *ec2.EC2, vpcID string, v bool) error {
+func modifyVPCDNSHostnames(ctx context.Context, conn *ec2.Client, vpcID string, v bool) error {
 	input := &ec2.ModifyVpcAttributeInput{
-		EnableDnsHostnames: &ec2.AttributeBooleanValue{
+		EnableDnsHostnames: &types.AttributeBooleanValue{
 			Value: aws.Bool(v),
 		},
 		VpcId: aws.String(vpcID),
 	}
 
-	if _, err := conn.ModifyVpcAttributeWithContext(ctx, input); err != nil {
+	if _, err := conn.ModifyVpcAttribute(ctx, input); err != nil {
 		return fmt.Errorf("modifying EnableDnsHostnames: %w", err)
 	}
 
-	if _, err := WaitVPCAttributeUpdated(ctx, conn, vpcID, ec2.VpcAttributeNameEnableDnsHostnames, v); err != nil {
+	if _, err := waitVPCAttributeUpdatedV2(ctx, conn, vpcID, types.VpcAttributeNameEnableDnsHostnames, v); err != nil {
 		return fmt.Errorf("modifying EnableDnsHostnames: waiting for completion: %w", err)
 	}
 
 	return nil
 }
 
-func modifyVPCDNSSupport(ctx context.Context, conn *ec2.EC2, vpcID string, v bool) error {
+func modifyVPCDNSSupport(ctx context.Context, conn *ec2.Client, vpcID string, v bool) error {
 	input := &ec2.ModifyVpcAttributeInput{
-		EnableDnsSupport: &ec2.AttributeBooleanValue{
+		EnableDnsSupport: &types.AttributeBooleanValue{
 			Value: aws.Bool(v),
 		},
 		VpcId: aws.String(vpcID),
 	}
 
-	if _, err := conn.ModifyVpcAttributeWithContext(ctx, input); err != nil {
+	if _, err := conn.ModifyVpcAttribute(ctx, input); err != nil {
 		return fmt.Errorf("modifying EnableDnsSupport: %w", err)
 	}
 
-	if _, err := WaitVPCAttributeUpdated(ctx, conn, vpcID, ec2.VpcAttributeNameEnableDnsSupport, v); err != nil {
+	if _, err := waitVPCAttributeUpdatedV2(ctx, conn, vpcID, types.VpcAttributeNameEnableDnsSupport, v); err != nil {
 		return fmt.Errorf("modifying EnableDnsSupport: waiting for completion: %w", err)
 	}
 
 	return nil
 }
 
-func modifyVPCNetworkAddressUsageMetrics(ctx context.Context, conn *ec2.EC2, vpcID string, v bool) error {
+func modifyVPCNetworkAddressUsageMetrics(ctx context.Context, conn *ec2.Client, vpcID string, v bool) error {
 	input := &ec2.ModifyVpcAttributeInput{
-		EnableNetworkAddressUsageMetrics: &ec2.AttributeBooleanValue{
+		EnableNetworkAddressUsageMetrics: &types.AttributeBooleanValue{
 			Value: aws.Bool(v),
 		},
 		VpcId: aws.String(vpcID),
 	}
 
-	if _, err := conn.ModifyVpcAttributeWithContext(ctx, input); err != nil {
+	if _, err := conn.ModifyVpcAttribute(ctx, input); err != nil {
 		return fmt.Errorf("modifying EnableNetworkAddressUsageMetrics: %w", err)
 	}
 
-	if _, err := WaitVPCAttributeUpdated(ctx, conn, vpcID, ec2.VpcAttributeNameEnableNetworkAddressUsageMetrics, v); err != nil {
+	if _, err := waitVPCAttributeUpdatedV2(ctx, conn, vpcID, types.VpcAttributeNameEnableNetworkAddressUsageMetrics, v); err != nil {
 		return fmt.Errorf("modifying EnableNetworkAddressUsageMetrics: waiting for completion: %w", err)
 	}
 
@@ -644,21 +646,19 @@ func modifyVPCNetworkAddressUsageMetrics(ctx context.Context, conn *ec2.EC2, vpc
 
 // modifyVPCIPv6CIDRBlockAssociation modify's a VPC's IPv6 CIDR block association.
 // Any exiting association is deleted and any new association's ID is returned.
-func modifyVPCIPv6CIDRBlockAssociation(ctx context.Context, conn *ec2.EC2, vpcID, associationID string, amazonProvidedCIDRBlock bool, cidrBlock, ipamPoolID string, netmaskLength int, networkBorderGroup string) (string, error) {
+func modifyVPCIPv6CIDRBlockAssociation(ctx context.Context, conn *ec2.Client, vpcID, associationID string, amazonProvidedCIDRBlock bool, cidrBlock, ipamPoolID string, netmaskLength int, networkBorderGroup string) (string, error) {
 	if associationID != "" {
 		input := &ec2.DisassociateVpcCidrBlockInput{
 			AssociationId: aws.String(associationID),
 		}
 
-		_, err := conn.DisassociateVpcCidrBlockWithContext(ctx, input)
+		_, err := conn.DisassociateVpcCidrBlock(ctx, input)
 
 		if err != nil {
 			return "", fmt.Errorf("disassociating IPv6 CIDR block (%s): %w", associationID, err)
 		}
 
-		_, err = WaitVPCIPv6CIDRBlockAssociationDeleted(ctx, conn, associationID, vpcIPv6CIDRBlockAssociationDeletedTimeout)
-
-		if err != nil {
+		if _, err := waitVPCIPv6CIDRBlockAssociationDeletedV2(ctx, conn, associationID, vpcIPv6CIDRBlockAssociationDeletedTimeout); err != nil {
 			return "", fmt.Errorf("disassociating IPv6 CIDR block (%s): waiting for completion: %w", associationID, err)
 		}
 	}
@@ -685,20 +685,18 @@ func modifyVPCIPv6CIDRBlockAssociation(ctx context.Context, conn *ec2.EC2, vpcID
 		}
 
 		if netmaskLength > 0 {
-			input.Ipv6NetmaskLength = aws.Int64(int64(netmaskLength))
+			input.Ipv6NetmaskLength = aws.Int32(int32(netmaskLength))
 		}
 
-		output, err := conn.AssociateVpcCidrBlockWithContext(ctx, input)
+		output, err := conn.AssociateVpcCidrBlock(ctx, input)
 
 		if err != nil {
 			return "", fmt.Errorf("associating IPv6 CIDR block: %w", err)
 		}
 
-		associationID = aws.StringValue(output.Ipv6CidrBlockAssociation.AssociationId)
+		associationID = aws.ToString(output.Ipv6CidrBlockAssociation.AssociationId)
 
-		_, err = WaitVPCIPv6CIDRBlockAssociationCreated(ctx, conn, associationID, vpcIPv6CIDRBlockAssociationCreatedTimeout)
-
-		if err != nil {
+		if _, err := waitVPCIPv6CIDRBlockAssociationCreatedV2(ctx, conn, associationID, vpcIPv6CIDRBlockAssociationCreatedTimeout); err != nil {
 			return "", fmt.Errorf("associating IPv6 CIDR block: waiting for completion: %w", err)
 		}
 	}
@@ -706,32 +704,32 @@ func modifyVPCIPv6CIDRBlockAssociation(ctx context.Context, conn *ec2.EC2, vpcID
 	return associationID, nil
 }
 
-func modifyVPCTenancy(ctx context.Context, conn *ec2.EC2, vpcID string, v string) error {
+func modifyVPCTenancy(ctx context.Context, conn *ec2.Client, vpcID string, v string) error {
 	input := &ec2.ModifyVpcTenancyInput{
-		InstanceTenancy: aws.String(v),
+		InstanceTenancy: types.VpcTenancy(v),
 		VpcId:           aws.String(vpcID),
 	}
 
-	if _, err := conn.ModifyVpcTenancyWithContext(ctx, input); err != nil {
+	if _, err := conn.ModifyVpcTenancy(ctx, input); err != nil {
 		return fmt.Errorf("modifying Tenancy: %w", err)
 	}
 
 	return nil
 }
 
-func findIPAMPoolAllocationsForVPC(ctx context.Context, conn *ec2.EC2, poolID, vpcID string) ([]*ec2.IpamPoolAllocation, error) {
+func findIPAMPoolAllocationsForVPC(ctx context.Context, conn *ec2.Client, poolID, vpcID string) ([]types.IpamPoolAllocation, error) {
 	input := &ec2.GetIpamPoolAllocationsInput{
 		IpamPoolId: aws.String(poolID),
 	}
 
-	output, err := FindIPAMPoolAllocations(ctx, conn, input)
+	output, err := findIPAMPoolAllocationsV2(ctx, conn, input)
 
 	if err != nil {
 		return nil, err
 	}
 
-	output = slices.Filter(output, func(v *ec2.IpamPoolAllocation) bool {
-		return aws.StringValue(v.ResourceType) == ec2.IpamPoolAllocationResourceTypeVpc && aws.StringValue(v.ResourceId) == vpcID
+	output = slices.Filter(output, func(v types.IpamPoolAllocation) bool {
+		return string(v.ResourceType) == string(types.IpamPoolAllocationResourceTypeVpc) && aws.ToString(v.ResourceId) == vpcID
 	})
 
 	if len(output) == 0 {
diff --git a/internal/service/ec2/vpc_data_source.go b/internal/service/ec2/vpc_data_source.go
index 245dbe2bca2..5cae14434d8 100644
--- a/internal/service/ec2/vpc_data_source.go
+++ b/internal/service/ec2/vpc_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -15,9 +18,11 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
-// @SDKDataSource("aws_vpc")
+// @SDKDataSource("aws_vpc", name="VPC")
+// @Tags
 func DataSourceVPC() *schema.Resource {
 	return &schema.Resource{
 		ReadWithoutTimeout: dataSourceVPCRead,
@@ -109,7 +114,7 @@ func DataSourceVPC() *schema.Resource {
 				Optional: true,
 				Computed: true,
 			},
-			"tags": tftags.TagsSchemaComputed(),
+			names.AttrTags: tftags.TagsSchemaComputed(),
 		},
 	}
 }
@@ -117,7 +122,6 @@ func DataSourceVPC() *schema.Resource {
 func dataSourceVPCRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).EC2Conn(ctx)
-	ignoreTagsConfig := meta.(*conns.AWSClient).IgnoreTagsConfig
 
 	// We specify "default" as boolean, but EC2 filters want
 	// it to be serialized as a string. Note that setting it to
@@ -143,15 +147,9 @@ func dataSourceVPCRead(ctx context.Context, d *schema.ResourceData, meta interfa
 		input.VpcIds = aws.StringSlice([]string{v.(string)})
 	}
 
-	if tags, tagsOk := d.GetOk("tags"); tagsOk {
-		input.Filters = append(input.Filters, BuildTagFilterList(
-			Tags(tftags.New(ctx, tags.(map[string]interface{}))),
-		)...)
-	}
+	input.Filters = append(input.Filters, BuildCustomFilterList(d.Get("filter").(*schema.Set))...)
+	input.Filters = append(input.Filters, tagFilters(ctx)...)
 
-	input.Filters = append(input.Filters, BuildCustomFilterList(
-		d.Get("filter").(*schema.Set),
-	)...)
 	if len(input.Filters) == 0 {
 		// Don't send an empty filters list; the EC2 API won't accept it.
 		input.Filters = nil
@@ -226,9 +224,7 @@ func dataSourceVPCRead(ctx context.Context, d *schema.ResourceData, meta interfa
 		d.Set("ipv6_cidr_block", nil)
 	}
 
-	if err := d.Set("tags", KeyValueTags(ctx, vpc.Tags).IgnoreAWS().IgnoreConfig(ignoreTagsConfig).Map()); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting tags: %s", err)
-	}
+	setTagsOut(ctx, vpc.Tags)
 
 	return diags
 }
diff --git a/internal/service/ec2/vpc_data_source_test.go b/internal/service/ec2/vpc_data_source_test.go
index 8816d391d97..d68c074d4f5 100644
--- a/internal/service/ec2/vpc_data_source_test.go
+++ b/internal/service/ec2/vpc_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/vpc_default_network_acl.go b/internal/service/ec2/vpc_default_network_acl.go
index 549db85a75c..328d83fbf5e 100644
--- a/internal/service/ec2/vpc_default_network_acl.go
+++ b/internal/service/ec2/vpc_default_network_acl.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/vpc_default_network_acl_test.go b/internal/service/ec2/vpc_default_network_acl_test.go
index 315198d5894..ae6632d7979 100644
--- a/internal/service/ec2/vpc_default_network_acl_test.go
+++ b/internal/service/ec2/vpc_default_network_acl_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -33,7 +36,7 @@ func TestAccVPCDefaultNetworkACL_basic(t *testing.T) {
 				Config: testAccVPCDefaultNetworkACLConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDefaultNetworkACLExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexp.MustCompile(`network-acl/acl-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`network-acl/acl-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "egress.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "ingress.#", "0"),
 					acctest.CheckResourceAttrAccountID(resourceName, "owner_id"),
diff --git a/internal/service/ec2/vpc_default_route_table.go b/internal/service/ec2/vpc_default_route_table.go
index 39b66a8181e..1ef761ad7ed 100644
--- a/internal/service/ec2/vpc_default_route_table.go
+++ b/internal/service/ec2/vpc_default_route_table.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/vpc_default_route_table_test.go b/internal/service/ec2/vpc_default_route_table_test.go
index 0edb9d04da2..0f69dc42fc7 100644
--- a/internal/service/ec2/vpc_default_route_table_test.go
+++ b/internal/service/ec2/vpc_default_route_table_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/aws/aws-sdk-go/service/elbv2"
@@ -34,18 +37,18 @@ func TestAccVPCDefaultRouteTable_basic(t *testing.T) {
 			// Verify non-existent Route Table ID behavior
 			{
 				Config:      testAccVPCDefaultRouteTableConfig_id("rtb-00000000"),
-				ExpectError: regexp.MustCompile(`EC2 Default Route Table \(rtb-00000000\): couldn't find resource`),
+				ExpectError: regexache.MustCompile(`EC2 Default Route Table \(rtb-00000000\): couldn't find resource`),
 			},
 			// Verify invalid Route Table ID behavior
 			{
 				Config:      testAccVPCDefaultRouteTableConfig_id("vpc-00000000"),
-				ExpectError: regexp.MustCompile(`EC2 Default Route Table \(vpc-00000000\): couldn't find resource`),
+				ExpectError: regexache.MustCompile(`EC2 Default Route Table \(vpc-00000000\): couldn't find resource`),
 			},
 			{
 				Config: testAccVPCDefaultRouteTableConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRouteTableExists(ctx, resourceName, &routeTable),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexp.MustCompile(`route-table/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`route-table/.+$`)),
 					acctest.CheckResourceAttrAccountID(resourceName, "owner_id"),
 					resource.TestCheckResourceAttr(resourceName, "propagating_vgws.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "route.#", "0"),
@@ -109,7 +112,7 @@ func TestAccVPCDefaultRouteTable_Route_mode(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRouteTableExists(ctx, resourceName, &routeTable),
 					testAccCheckRouteTableNumberOfRoutes(&routeTable, 2),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexp.MustCompile(`route-table/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`route-table/.+$`)),
 					acctest.CheckResourceAttrAccountID(resourceName, "owner_id"),
 					resource.TestCheckResourceAttr(resourceName, "propagating_vgws.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "route.#", "1"),
@@ -129,7 +132,7 @@ func TestAccVPCDefaultRouteTable_Route_mode(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRouteTableExists(ctx, resourceName, &routeTable),
 					testAccCheckRouteTableNumberOfRoutes(&routeTable, 2),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexp.MustCompile(`route-table/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`route-table/.+$`)),
 					acctest.CheckResourceAttrAccountID(resourceName, "owner_id"),
 					resource.TestCheckResourceAttr(resourceName, "propagating_vgws.#", "0"),
 					// The route block from the previous step should still be
@@ -145,7 +148,7 @@ func TestAccVPCDefaultRouteTable_Route_mode(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRouteTableExists(ctx, resourceName, &routeTable),
 					testAccCheckRouteTableNumberOfRoutes(&routeTable, 1),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexp.MustCompile(`route-table/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`route-table/.+$`)),
 					acctest.CheckResourceAttrAccountID(resourceName, "owner_id"),
 					resource.TestCheckResourceAttr(resourceName, "propagating_vgws.#", "0"),
 					// This config uses attribute syntax to set zero routes
@@ -180,7 +183,7 @@ func TestAccVPCDefaultRouteTable_swap(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRouteTableExists(ctx, resourceName, &routeTable),
 					testAccCheckRouteTableNumberOfRoutes(&routeTable, 2),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexp.MustCompile(`route-table/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`route-table/.+$`)),
 					acctest.CheckResourceAttrAccountID(resourceName, "owner_id"),
 					resource.TestCheckResourceAttr(resourceName, "propagating_vgws.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "route.#", "1"),
diff --git a/internal/service/ec2/vpc_default_security_group.go b/internal/service/ec2/vpc_default_security_group.go
index 28522ad7a8f..2e414e7e749 100644
--- a/internal/service/ec2/vpc_default_security_group.go
+++ b/internal/service/ec2/vpc_default_security_group.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/vpc_default_security_group_test.go b/internal/service/ec2/vpc_default_security_group_test.go
index a28115dd121..bf551bb9b3d 100644
--- a/internal/service/ec2/vpc_default_security_group_test.go
+++ b/internal/service/ec2/vpc_default_security_group_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/vpc_default_subnet.go b/internal/service/ec2/vpc_default_subnet.go
index 513f7182a4c..1efae8f241b 100644
--- a/internal/service/ec2/vpc_default_subnet.go
+++ b/internal/service/ec2/vpc_default_subnet.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/vpc_default_subnet_test.go b/internal/service/ec2/vpc_default_subnet_test.go
index 1c18cb6cc3c..59ef4baf16a 100644
--- a/internal/service/ec2/vpc_default_subnet_test.go
+++ b/internal/service/ec2/vpc_default_subnet_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/vpc_default_vpc.go b/internal/service/ec2/vpc_default_vpc.go
index 764d17ee59f..09badf17c12 100644
--- a/internal/service/ec2/vpc_default_vpc.go
+++ b/internal/service/ec2/vpc_default_vpc.go
@@ -1,11 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
 	"context"
 	"log"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/ec2"
+	awstypes "github.com/aws/aws-sdk-go-v2/service/ec2/types"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
@@ -151,10 +155,10 @@ func ResourceDefaultVPC() *schema.Resource {
 
 func resourceDefaultVPCCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics { // nosemgrep:ci.semgrep.tags.calling-UpdateTags-in-resource-create
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).EC2Conn(ctx)
+	conn := meta.(*conns.AWSClient).EC2Client(ctx)
 
 	input := &ec2.DescribeVpcsInput{
-		Filters: BuildAttributeFilterList(
+		Filters: buildAttributeFilterListV2(
 			map[string]string{
 				"isDefault": "true",
 			},
@@ -162,36 +166,34 @@ func resourceDefaultVPCCreate(ctx context.Context, d *schema.ResourceData, meta
 	}
 
 	vpcInfo := &vpcInfo{}
-	vpc, err := FindVPC(ctx, conn, input)
+	vpc, err := findVPCV2(ctx, conn, input)
 
 	if err == nil {
-		log.Printf("[INFO] Found existing EC2 Default VPC")
-		d.SetId(aws.StringValue(vpc.VpcId))
+		d.SetId(aws.ToString(vpc.VpcId))
 		d.Set("existing_default_vpc", true)
 
 		vpcInfo.vpc = vpc
 
-		if v, err := FindVPCAttribute(ctx, conn, d.Id(), ec2.VpcAttributeNameEnableDnsHostnames); err != nil {
-			return sdkdiag.AppendErrorf(diags, "reading EC2 VPC (%s) Attribute (%s): %s", d.Id(), ec2.VpcAttributeNameEnableDnsHostnames, err)
+		if v, err := findVPCAttributeV2(ctx, conn, d.Id(), awstypes.VpcAttributeNameEnableDnsHostnames); err != nil {
+			return sdkdiag.AppendErrorf(diags, "reading EC2 VPC (%s) Attribute (%s): %s", d.Id(), awstypes.VpcAttributeNameEnableDnsHostnames, err)
 		} else {
 			vpcInfo.enableDnsHostnames = v
 		}
 
-		if v, err := FindVPCAttribute(ctx, conn, d.Id(), ec2.VpcAttributeNameEnableDnsSupport); err != nil {
-			return sdkdiag.AppendErrorf(diags, "reading EC2 VPC (%s) Attribute (%s): %s", d.Id(), ec2.VpcAttributeNameEnableDnsSupport, err)
+		if v, err := findVPCAttributeV2(ctx, conn, d.Id(), awstypes.VpcAttributeNameEnableDnsSupport); err != nil {
+			return sdkdiag.AppendErrorf(diags, "reading EC2 VPC (%s) Attribute (%s): %s", d.Id(), awstypes.VpcAttributeNameEnableDnsSupport, err)
 		} else {
 			vpcInfo.enableDnsSupport = v
 		}
-		if v, err := FindVPCAttribute(ctx, conn, d.Id(), ec2.VpcAttributeNameEnableNetworkAddressUsageMetrics); err != nil {
-			return sdkdiag.AppendErrorf(diags, "reading EC2 VPC (%s) Attribute (%s): %s", d.Id(), ec2.VpcAttributeNameEnableNetworkAddressUsageMetrics, err)
+		if v, err := findVPCAttributeV2(ctx, conn, d.Id(), awstypes.VpcAttributeNameEnableNetworkAddressUsageMetrics); err != nil {
+			return sdkdiag.AppendErrorf(diags, "reading EC2 VPC (%s) Attribute (%s): %s", d.Id(), awstypes.VpcAttributeNameEnableNetworkAddressUsageMetrics, err)
 		} else {
 			vpcInfo.enableNetworkAddressUsageMetrics = v
 		}
 	} else if tfresource.NotFound(err) {
 		input := &ec2.CreateDefaultVpcInput{}
 
-		log.Printf("[DEBUG] Creating EC2 Default VPC: %s", input)
-		output, err := conn.CreateDefaultVpcWithContext(ctx, input)
+		output, err := conn.CreateDefaultVpc(ctx, input)
 
 		if err != nil {
 			return sdkdiag.AppendErrorf(diags, "creating EC2 Default VPC: %s", err)
@@ -199,10 +201,10 @@ func resourceDefaultVPCCreate(ctx context.Context, d *schema.ResourceData, meta
 
 		vpc = output.Vpc
 
-		d.SetId(aws.StringValue(vpc.VpcId))
+		d.SetId(aws.ToString(vpc.VpcId))
 		d.Set("existing_default_vpc", false)
 
-		vpc, err = WaitVPCCreated(ctx, conn, d.Id())
+		vpc, err = waitVPCCreatedV2(ctx, conn, d.Id())
 
 		if err != nil {
 			return sdkdiag.AppendErrorf(diags, "waiting for EC2 Default VPC (%s) create: %s", d.Id(), err)
@@ -225,10 +227,10 @@ func resourceDefaultVPCCreate(ctx context.Context, d *schema.ResourceData, meta
 	var oldAssignGeneratedIPv6CIDRBlock bool
 
 	if v := defaultIPv6CIDRBlockAssociation(vpcInfo.vpc, ""); v != nil {
-		associationID = aws.StringValue(v.AssociationId)
-		oldIPv6CIDRBlock = aws.StringValue(v.Ipv6CidrBlock)
-		oldIPv6CIDRBlockNetworkBorderGroup = aws.StringValue(v.NetworkBorderGroup)
-		if ipv6PoolID := aws.StringValue(v.Ipv6Pool); ipv6PoolID == amazonIPv6PoolID {
+		associationID = aws.ToString(v.AssociationId)
+		oldIPv6CIDRBlock = aws.ToString(v.Ipv6CidrBlock)
+		oldIPv6CIDRBlockNetworkBorderGroup = aws.ToString(v.NetworkBorderGroup)
+		if ipv6PoolID := aws.ToString(v.Ipv6Pool); ipv6PoolID == amazonIPv6PoolID {
 			oldAssignGeneratedIPv6CIDRBlock = true
 		} else {
 			oldIPv6PoolID = ipv6PoolID
@@ -269,11 +271,11 @@ func resourceDefaultVPCCreate(ctx context.Context, d *schema.ResourceData, meta
 
 	// Configure tags.
 	ignoreTagsConfig := meta.(*conns.AWSClient).IgnoreTagsConfig
-	newTags := KeyValueTags(ctx, getTagsIn(ctx))
-	oldTags := KeyValueTags(ctx, vpc.Tags).IgnoreSystem(names.EC2).IgnoreConfig(ignoreTagsConfig)
+	newTags := keyValueTagsV2(ctx, getTagsInV2(ctx))
+	oldTags := keyValueTagsV2(ctx, vpc.Tags).IgnoreSystem(names.EC2).IgnoreConfig(ignoreTagsConfig)
 
 	if !oldTags.Equal(newTags) {
-		if err := updateTags(ctx, conn, d.Id(), oldTags, newTags); err != nil {
+		if err := updateTagsV2(ctx, conn, d.Id(), oldTags, newTags); err != nil {
 			return sdkdiag.AppendErrorf(diags, "updating EC2 Default VPC (%s) tags: %s", d.Id(), err)
 		}
 	}
diff --git a/internal/service/ec2/vpc_default_vpc_dhcp_options.go b/internal/service/ec2/vpc_default_vpc_dhcp_options.go
index d940a957003..bcce8535d15 100644
--- a/internal/service/ec2/vpc_default_vpc_dhcp_options.go
+++ b/internal/service/ec2/vpc_default_vpc_dhcp_options.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/vpc_default_vpc_dhcp_options_test.go b/internal/service/ec2/vpc_default_vpc_dhcp_options_test.go
index f1cc0027c93..aaa5a782947 100644
--- a/internal/service/ec2/vpc_default_vpc_dhcp_options_test.go
+++ b/internal/service/ec2/vpc_default_vpc_dhcp_options_test.go
@@ -1,9 +1,12 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
@@ -37,7 +40,7 @@ func testAccDefaultVPCDHCPOptions_basic(t *testing.T) {
 				Config: testAccVPCDefaultVPCDHCPOptionsConfig_basic,
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDHCPOptionsExists(ctx, resourceName, &d),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexp.MustCompile(`dhcp-options/dopt-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`dhcp-options/dopt-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "domain_name", tfec2.RegionalPrivateDNSSuffix(acctest.Region())),
 					resource.TestCheckResourceAttr(resourceName, "domain_name_servers", "AmazonProvidedDNS"),
 					acctest.CheckResourceAttrAccountID(resourceName, "owner_id"),
@@ -64,7 +67,7 @@ func testAccDefaultVPCDHCPOptions_owner(t *testing.T) {
 				Config: testAccVPCDefaultVPCDHCPOptionsConfig_owner,
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDHCPOptionsExists(ctx, resourceName, &d),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexp.MustCompile(`dhcp-options/dopt-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`dhcp-options/dopt-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "domain_name", tfec2.RegionalPrivateDNSSuffix(acctest.Region())),
 					resource.TestCheckResourceAttr(resourceName, "domain_name_servers", "AmazonProvidedDNS"),
 					acctest.CheckResourceAttrAccountID(resourceName, "owner_id"),
diff --git a/internal/service/ec2/vpc_default_vpc_test.go b/internal/service/ec2/vpc_default_vpc_test.go
index ed43699474d..bca36dc819b 100644
--- a/internal/service/ec2/vpc_default_vpc_test.go
+++ b/internal/service/ec2/vpc_default_vpc_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/endpoints"
 	"github.com/aws/aws-sdk-go/service/ec2"
@@ -152,7 +155,7 @@ func testAccDefaultVPC_Existing_assignGeneratedIPv6CIDRBlock(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "force_destroy", "false"),
 					resource.TestCheckResourceAttr(resourceName, "instance_tenancy", "default"),
 					resource.TestCheckResourceAttrSet(resourceName, "ipv6_association_id"),
-					resource.TestMatchResourceAttr(resourceName, "ipv6_cidr_block", regexp.MustCompile(`/56$`)),
+					resource.TestMatchResourceAttr(resourceName, "ipv6_cidr_block", regexache.MustCompile(`/56$`)),
 					resource.TestCheckResourceAttr(resourceName, "ipv6_cidr_block_network_border_group", acctest.Region()),
 					resource.TestCheckResourceAttr(resourceName, "ipv6_ipam_pool_id", ""),
 					resource.TestCheckResourceAttr(resourceName, "ipv6_netmask_length", "0"),
@@ -274,7 +277,7 @@ func testAccDefaultVPC_NotFound_assignGeneratedIPv6CIDRBlock(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "force_destroy", "false"),
 					resource.TestCheckResourceAttr(resourceName, "instance_tenancy", "default"),
 					resource.TestCheckResourceAttrSet(resourceName, "ipv6_association_id"),
-					resource.TestMatchResourceAttr(resourceName, "ipv6_cidr_block", regexp.MustCompile(`/56$`)),
+					resource.TestMatchResourceAttr(resourceName, "ipv6_cidr_block", regexache.MustCompile(`/56$`)),
 					resource.TestCheckResourceAttr(resourceName, "ipv6_cidr_block_network_border_group", acctest.Region()),
 					resource.TestCheckResourceAttr(resourceName, "ipv6_ipam_pool_id", ""),
 					resource.TestCheckResourceAttr(resourceName, "ipv6_netmask_length", "0"),
@@ -350,7 +353,7 @@ func testAccDefaultVPC_NotFound_assignGeneratedIPv6CIDRBlockAdoption(t *testing.
 					resource.TestCheckResourceAttr(resourceName, "force_destroy", "false"),
 					resource.TestCheckResourceAttr(resourceName, "instance_tenancy", "default"),
 					resource.TestCheckResourceAttrSet(resourceName, "ipv6_association_id"),
-					resource.TestMatchResourceAttr(resourceName, "ipv6_cidr_block", regexp.MustCompile(`/56$`)),
+					resource.TestMatchResourceAttr(resourceName, "ipv6_cidr_block", regexache.MustCompile(`/56$`)),
 					resource.TestCheckResourceAttr(resourceName, "ipv6_cidr_block_network_border_group", acctest.Region()),
 					resource.TestCheckResourceAttr(resourceName, "ipv6_ipam_pool_id", ""),
 					resource.TestCheckResourceAttr(resourceName, "ipv6_netmask_length", "0"),
@@ -392,7 +395,7 @@ func testAccDefaultVPC_NotFound_assignGeneratedIPv6CIDRBlockAdoption(t *testing.
 					resource.TestCheckResourceAttr(resourceName, "force_destroy", "false"),
 					resource.TestCheckResourceAttr(resourceName, "instance_tenancy", "default"),
 					resource.TestCheckResourceAttrSet(resourceName, "ipv6_association_id"),
-					resource.TestMatchResourceAttr(resourceName, "ipv6_cidr_block", regexp.MustCompile(`/56$`)),
+					resource.TestMatchResourceAttr(resourceName, "ipv6_cidr_block", regexache.MustCompile(`/56$`)),
 					resource.TestCheckResourceAttr(resourceName, "ipv6_cidr_block_network_border_group", acctest.Region()),
 					resource.TestCheckResourceAttr(resourceName, "ipv6_ipam_pool_id", ""),
 					resource.TestCheckResourceAttr(resourceName, "ipv6_netmask_length", "0"),
diff --git a/internal/service/ec2/vpc_dhcp_options.go b/internal/service/ec2/vpc_dhcp_options.go
index 1d6be3e4ca8..c96fa61a779 100644
--- a/internal/service/ec2/vpc_dhcp_options.go
+++ b/internal/service/ec2/vpc_dhcp_options.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -124,7 +127,7 @@ func resourceVPCDHCPOptionsRead(ctx context.Context, d *schema.ResourceData, met
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).EC2Conn(ctx)
 
-	outputRaw, err := tfresource.RetryWhenNewResourceNotFound(ctx, propagationTimeout, func() (interface{}, error) {
+	outputRaw, err := tfresource.RetryWhenNewResourceNotFound(ctx, ec2PropagationTimeout, func() (interface{}, error) {
 		return FindDHCPOptionsByID(ctx, conn, d.Id())
 	}, d.IsNewResource())
 
diff --git a/internal/service/ec2/vpc_dhcp_options_association.go b/internal/service/ec2/vpc_dhcp_options_association.go
index 7660596f09c..ab44b4e8d41 100644
--- a/internal/service/ec2/vpc_dhcp_options_association.go
+++ b/internal/service/ec2/vpc_dhcp_options_association.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -76,7 +79,7 @@ func resourceVPCDHCPOptionsAssociationRead(ctx context.Context, d *schema.Resour
 		return sdkdiag.AppendErrorf(diags, "reading EC2 VPC DHCP Options Set Association (%s): %s", d.Id(), err)
 	}
 
-	_, err = tfresource.RetryWhenNewResourceNotFound(ctx, propagationTimeout, func() (interface{}, error) {
+	_, err = tfresource.RetryWhenNewResourceNotFound(ctx, ec2PropagationTimeout, func() (interface{}, error) {
 		return nil, FindVPCDHCPOptionsAssociation(ctx, conn, vpcID, dhcpOptionsID)
 	}, d.IsNewResource())
 
diff --git a/internal/service/ec2/vpc_dhcp_options_association_test.go b/internal/service/ec2/vpc_dhcp_options_association_test.go
index 3ae713b1096..98f723b74e9 100644
--- a/internal/service/ec2/vpc_dhcp_options_association_test.go
+++ b/internal/service/ec2/vpc_dhcp_options_association_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/vpc_dhcp_options_data_source.go b/internal/service/ec2/vpc_dhcp_options_data_source.go
index 2a5b0e821d4..358f97d6850 100644
--- a/internal/service/ec2/vpc_dhcp_options_data_source.go
+++ b/internal/service/ec2/vpc_dhcp_options_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/vpc_dhcp_options_data_source_test.go b/internal/service/ec2/vpc_dhcp_options_data_source_test.go
index eb803743744..aad8481a5cd 100644
--- a/internal/service/ec2/vpc_dhcp_options_data_source_test.go
+++ b/internal/service/ec2/vpc_dhcp_options_data_source_test.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -23,7 +26,7 @@ func TestAccVPCDHCPOptionsDataSource_basic(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccVPCDHCPOptionsDataSourceConfig_missing,
-				ExpectError: regexp.MustCompile(`no matching EC2 DHCP Options Set found`),
+				ExpectError: regexache.MustCompile(`no matching EC2 DHCP Options Set found`),
 			},
 			{
 				Config: testAccVPCDHCPOptionsDataSourceConfig_id,
@@ -79,7 +82,7 @@ func TestAccVPCDHCPOptionsDataSource_filter(t *testing.T) {
 			},
 			{
 				Config:      testAccVPCDHCPOptionsDataSourceConfig_filter(rInt, 2),
-				ExpectError: regexp.MustCompile(`multiple EC2 DHCP Options Sets matched`),
+				ExpectError: regexache.MustCompile(`multiple EC2 DHCP Options Sets matched`),
 			},
 			{
 				// We have one last empty step here because otherwise we'll leave the
diff --git a/internal/service/ec2/vpc_dhcp_options_test.go b/internal/service/ec2/vpc_dhcp_options_test.go
index 54495a0cd20..9e88a2af549 100644
--- a/internal/service/ec2/vpc_dhcp_options_test.go
+++ b/internal/service/ec2/vpc_dhcp_options_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -31,7 +34,7 @@ func TestAccVPCDHCPOptions_basic(t *testing.T) {
 				Config: testAccVPCDHCPOptionsConfig_basic,
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDHCPOptionsExists(ctx, resourceName, &d),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexp.MustCompile(`dhcp-options/dopt-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`dhcp-options/dopt-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "domain_name", ""),
 					resource.TestCheckResourceAttr(resourceName, "domain_name_servers.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "netbios_name_servers.#", "0"),
@@ -67,7 +70,7 @@ func TestAccVPCDHCPOptions_full(t *testing.T) {
 				Config: testAccVPCDHCPOptionsConfig_full(rName, domainName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckDHCPOptionsExists(ctx, resourceName, &d),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexp.MustCompile(`dhcp-options/dopt-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`dhcp-options/dopt-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "domain_name", domainName),
 					resource.TestCheckResourceAttr(resourceName, "domain_name_servers.#", "2"),
 					resource.TestCheckResourceAttr(resourceName, "domain_name_servers.0", "127.0.0.1"),
diff --git a/internal/service/ec2/vpc_egress_only_internet_gateway.go b/internal/service/ec2/vpc_egress_only_internet_gateway.go
index 3333ca93f83..7cc526b131c 100644
--- a/internal/service/ec2/vpc_egress_only_internet_gateway.go
+++ b/internal/service/ec2/vpc_egress_only_internet_gateway.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -70,7 +73,7 @@ func resourceEgressOnlyInternetGatewayRead(ctx context.Context, d *schema.Resour
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).EC2Conn(ctx)
 
-	outputRaw, err := tfresource.RetryWhenNewResourceNotFound(ctx, propagationTimeout, func() (interface{}, error) {
+	outputRaw, err := tfresource.RetryWhenNewResourceNotFound(ctx, ec2PropagationTimeout, func() (interface{}, error) {
 		return FindEgressOnlyInternetGatewayByID(ctx, conn, d.Id())
 	}, d.IsNewResource())
 
diff --git a/internal/service/ec2/vpc_egress_only_internet_gateway_test.go b/internal/service/ec2/vpc_egress_only_internet_gateway_test.go
index 2923254cc00..3ee03c1965f 100644
--- a/internal/service/ec2/vpc_egress_only_internet_gateway_test.go
+++ b/internal/service/ec2/vpc_egress_only_internet_gateway_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/vpc_endpoint.go b/internal/service/ec2/vpc_endpoint.go
index c56ed1adefa..73b451451d5 100644
--- a/internal/service/ec2/vpc_endpoint.go
+++ b/internal/service/ec2/vpc_endpoint.go
@@ -1,9 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
 	"context"
 	"fmt"
 	"log"
+	"regexp"
 	"time"
 
 	"github.com/aws/aws-sdk-go/aws"
@@ -85,6 +89,7 @@ func ResourceVPCEndpoint() *schema.Resource {
 						"dns_record_ip_type": {
 							Type:         schema.TypeString,
 							Optional:     true,
+							Computed:     true,
 							ValidateFunc: validation.StringInSlice(ec2.DnsRecordIpType_Values(), false),
 						},
 						"private_dns_only_for_inbound_resolver_endpoint": {
@@ -202,7 +207,13 @@ func resourceVPCEndpointCreate(ctx context.Context, d *schema.ResourceData, meta
 	}
 
 	if v, ok := d.GetOk("dns_options"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
-		input.DnsOptions = expandDNSOptionsSpecification(v.([]interface{})[0].(map[string]interface{}))
+		// PrivateDnsOnlyForInboundResolverEndpoint is only supported for services
+		// that support both gateway and interface endpoints, i.e. S3.
+		if isAmazonS3VPCEndpoint(serviceName) {
+			input.DnsOptions = expandDNSOptionsSpecificationWithPrivateDNSOnly(v.([]interface{})[0].(map[string]interface{}))
+		} else {
+			input.DnsOptions = expandDNSOptionsSpecification(v.([]interface{})[0].(map[string]interface{}))
+		}
 	}
 
 	if v, ok := d.GetOk("ip_address_type"); ok {
@@ -375,12 +386,13 @@ func resourceVPCEndpointUpdate(ctx context.Context, d *schema.ResourceData, meta
 		if d.HasChange("dns_options") {
 			if v, ok := d.GetOk("dns_options"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
 				tfMap := v.([]interface{})[0].(map[string]interface{})
-				apiObject := expandDNSOptionsSpecification(tfMap)
-				if privateDNSEnabled {
-					// Always send PrivateDnsOnlyForInboundResolverEndpoint on update.
-					apiObject.PrivateDnsOnlyForInboundResolverEndpoint = aws.Bool(tfMap["private_dns_only_for_inbound_resolver_endpoint"].(bool))
+				// PrivateDnsOnlyForInboundResolverEndpoint is only supported for services
+				// that support both gateway and interface endpoints, i.e. S3.
+				if isAmazonS3VPCEndpoint(d.Get("service_name").(string)) {
+					input.DnsOptions = expandDNSOptionsSpecificationWithPrivateDNSOnly(tfMap)
+				} else {
+					input.DnsOptions = expandDNSOptionsSpecification(tfMap)
 				}
-				input.DnsOptions = apiObject
 			}
 		}
 
@@ -481,6 +493,11 @@ func vpcEndpointAccept(ctx context.Context, conn *ec2.EC2, vpceID, serviceName s
 	return nil
 }
 
+func isAmazonS3VPCEndpoint(serviceName string) bool {
+	ok, _ := regexp.MatchString("com\\.amazonaws\\.([a-z]+\\-[a-z]+\\-[0-9])\\.s3", serviceName)
+	return ok
+}
+
 func expandDNSOptionsSpecification(tfMap map[string]interface{}) *ec2.DnsOptionsSpecification {
 	if tfMap == nil {
 		return nil
@@ -492,7 +509,21 @@ func expandDNSOptionsSpecification(tfMap map[string]interface{}) *ec2.DnsOptions
 		apiObject.DnsRecordIpType = aws.String(v)
 	}
 
-	if v, ok := tfMap["private_dns_only_for_inbound_resolver_endpoint"].(bool); ok && v {
+	return apiObject
+}
+
+func expandDNSOptionsSpecificationWithPrivateDNSOnly(tfMap map[string]interface{}) *ec2.DnsOptionsSpecification {
+	if tfMap == nil {
+		return nil
+	}
+
+	apiObject := &ec2.DnsOptionsSpecification{}
+
+	if v, ok := tfMap["dns_record_ip_type"].(string); ok && v != "" {
+		apiObject.DnsRecordIpType = aws.String(v)
+	}
+
+	if v, ok := tfMap["private_dns_only_for_inbound_resolver_endpoint"].(bool); ok {
 		apiObject.PrivateDnsOnlyForInboundResolverEndpoint = aws.Bool(v)
 	}
 
diff --git a/internal/service/ec2/vpc_endpoint_connection_accepter.go b/internal/service/ec2/vpc_endpoint_connection_accepter.go
index 7b8e0906e7a..ae00d264ce6 100644
--- a/internal/service/ec2/vpc_endpoint_connection_accepter.go
+++ b/internal/service/ec2/vpc_endpoint_connection_accepter.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/vpc_endpoint_connection_accepter_test.go b/internal/service/ec2/vpc_endpoint_connection_accepter_test.go
index 7749e2d51d0..449c8572566 100644
--- a/internal/service/ec2/vpc_endpoint_connection_accepter_test.go
+++ b/internal/service/ec2/vpc_endpoint_connection_accepter_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/vpc_endpoint_connection_notification.go b/internal/service/ec2/vpc_endpoint_connection_notification.go
index 05835ba6950..48c65a93940 100644
--- a/internal/service/ec2/vpc_endpoint_connection_notification.go
+++ b/internal/service/ec2/vpc_endpoint_connection_notification.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/vpc_endpoint_connection_notification_test.go b/internal/service/ec2/vpc_endpoint_connection_notification_test.go
index 6f8892569d3..f31632f3591 100644
--- a/internal/service/ec2/vpc_endpoint_connection_notification_test.go
+++ b/internal/service/ec2/vpc_endpoint_connection_notification_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/vpc_endpoint_data_source.go b/internal/service/ec2/vpc_endpoint_data_source.go
index 35b8327b32c..72fa9d423f3 100644
--- a/internal/service/ec2/vpc_endpoint_data_source.go
+++ b/internal/service/ec2/vpc_endpoint_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -61,6 +64,10 @@ func DataSourceVPCEndpoint() *schema.Resource {
 							Type:     schema.TypeString,
 							Computed: true,
 						},
+						"private_dns_only_for_inbound_resolver_endpoint": {
+							Type:     schema.TypeBool,
+							Computed: true,
+						},
 					},
 				},
 			},
diff --git a/internal/service/ec2/vpc_endpoint_data_source_test.go b/internal/service/ec2/vpc_endpoint_data_source_test.go
index af8b7d2ab93..5a4391c88a1 100644
--- a/internal/service/ec2/vpc_endpoint_data_source_test.go
+++ b/internal/service/ec2/vpc_endpoint_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/vpc_endpoint_policy.go b/internal/service/ec2/vpc_endpoint_policy.go
index 0aca5d3e327..f1cdaea7b3e 100644
--- a/internal/service/ec2/vpc_endpoint_policy.go
+++ b/internal/service/ec2/vpc_endpoint_policy.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/vpc_endpoint_policy_test.go b/internal/service/ec2/vpc_endpoint_policy_test.go
index 2c31a75fd3c..8c3a78ecb46 100644
--- a/internal/service/ec2/vpc_endpoint_policy_test.go
+++ b/internal/service/ec2/vpc_endpoint_policy_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/vpc_endpoint_route_table_association.go b/internal/service/ec2/vpc_endpoint_route_table_association.go
index 54ebddf7995..46a60d78323 100644
--- a/internal/service/ec2/vpc_endpoint_route_table_association.go
+++ b/internal/service/ec2/vpc_endpoint_route_table_association.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -81,7 +84,7 @@ func resourceVPCEndpointRouteTableAssociationRead(ctx context.Context, d *schema
 	// Human friendly ID for error messages since d.Id() is non-descriptive
 	id := fmt.Sprintf("%s/%s", endpointID, routeTableID)
 
-	_, err := tfresource.RetryWhenNewResourceNotFound(ctx, RouteTableAssociationPropagationTimeout, func() (interface{}, error) {
+	_, err := tfresource.RetryWhenNewResourceNotFound(ctx, ec2PropagationTimeout, func() (interface{}, error) {
 		return nil, FindVPCEndpointRouteTableAssociationExists(ctx, conn, endpointID, routeTableID)
 	}, d.IsNewResource())
 
diff --git a/internal/service/ec2/vpc_endpoint_route_table_association_test.go b/internal/service/ec2/vpc_endpoint_route_table_association_test.go
index 860401738f3..7d1f9d8abcc 100644
--- a/internal/service/ec2/vpc_endpoint_route_table_association_test.go
+++ b/internal/service/ec2/vpc_endpoint_route_table_association_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/vpc_endpoint_security_group_association.go b/internal/service/ec2/vpc_endpoint_security_group_association.go
index 8dba0514e62..f4592491616 100644
--- a/internal/service/ec2/vpc_endpoint_security_group_association.go
+++ b/internal/service/ec2/vpc_endpoint_security_group_association.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/vpc_endpoint_security_group_association_test.go b/internal/service/ec2/vpc_endpoint_security_group_association_test.go
index a634d9a4d31..1d008861d32 100644
--- a/internal/service/ec2/vpc_endpoint_security_group_association_test.go
+++ b/internal/service/ec2/vpc_endpoint_security_group_association_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/vpc_endpoint_service.go b/internal/service/ec2/vpc_endpoint_service.go
index 3637d053797..39123da011b 100644
--- a/internal/service/ec2/vpc_endpoint_service.go
+++ b/internal/service/ec2/vpc_endpoint_service.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/vpc_endpoint_service_allowed_principal.go b/internal/service/ec2/vpc_endpoint_service_allowed_principal.go
index a215daa2194..2ae534a2be2 100644
--- a/internal/service/ec2/vpc_endpoint_service_allowed_principal.go
+++ b/internal/service/ec2/vpc_endpoint_service_allowed_principal.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/vpc_endpoint_service_allowed_principal_test.go b/internal/service/ec2/vpc_endpoint_service_allowed_principal_test.go
index 648df9aa48d..7abb2f1f623 100644
--- a/internal/service/ec2/vpc_endpoint_service_allowed_principal_test.go
+++ b/internal/service/ec2/vpc_endpoint_service_allowed_principal_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -32,7 +35,7 @@ func TestAccVPCEndpointServiceAllowedPrincipal_basic(t *testing.T) {
 				Config: testAccVPCEndpointServiceAllowedPrincipalConfig_basic(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckVPCEndpointServiceAllowedPrincipalExists(ctx, resourceName),
-					resource.TestMatchResourceAttr(resourceName, "id", regexp.MustCompile(`^vpce-svc-perm-\w{17}$`)),
+					resource.TestMatchResourceAttr(resourceName, "id", regexache.MustCompile(`^vpce-svc-perm-\w{17}$`)),
 					resource.TestCheckResourceAttrPair(resourceName, "vpc_endpoint_service_id", "aws_vpc_endpoint_service.test", "id"),
 					resource.TestCheckResourceAttrPair(resourceName, "principal_arn", "data.aws_iam_session_context.current", "issuer_arn"),
 				),
@@ -58,7 +61,7 @@ func TestAccVPCEndpointServiceAllowedPrincipal_multiple(t *testing.T) {
 				Config: testAccVPCEndpointServiceAllowedPrincipalConfig_Multiple(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckVPCEndpointServiceAllowedPrincipalExists(ctx, resourceName),
-					resource.TestMatchResourceAttr(resourceName, "id", regexp.MustCompile(`^vpce-svc-perm-\w{17}$`)),
+					resource.TestMatchResourceAttr(resourceName, "id", regexache.MustCompile(`^vpce-svc-perm-\w{17}$`)),
 					resource.TestCheckResourceAttrPair(resourceName, "vpc_endpoint_service_id", "aws_vpc_endpoint_service.test", "id"),
 					resource.TestCheckResourceAttr(serviceResourceName, "allowed_principals.#", "1"),
 					resource.TestCheckResourceAttrPair(resourceName, "principal_arn", "data.aws_iam_session_context.current", "issuer_arn"),
@@ -156,7 +159,7 @@ func TestAccVPCEndpointServiceAllowedPrincipal_migrateAndTag(t *testing.T) {
 				Config:                   testAccVPCEndpointServiceAllowedPrincipalConfig_tag(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckVPCEndpointServiceAllowedPrincipalExists(ctx, resourceName),
-					resource.TestMatchResourceAttr(resourceName, "id", regexp.MustCompile(`^vpce-svc-perm-\w{17}$`)),
+					resource.TestMatchResourceAttr(resourceName, "id", regexache.MustCompile(`^vpce-svc-perm-\w{17}$`)),
 					resource.TestCheckResourceAttrPair(tagResourceName, "resource_id", resourceName, "id"),
 					resource.TestCheckResourceAttr(tagResourceName, "key", "Name"),
 					resource.TestCheckResourceAttr(tagResourceName, "value", rName),
diff --git a/internal/service/ec2/vpc_endpoint_service_data_source.go b/internal/service/ec2/vpc_endpoint_service_data_source.go
index 96d7662ca3a..46741d21159 100644
--- a/internal/service/ec2/vpc_endpoint_service_data_source.go
+++ b/internal/service/ec2/vpc_endpoint_service_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/vpc_endpoint_service_data_source_test.go b/internal/service/ec2/vpc_endpoint_service_data_source_test.go
index 8c4478d3cd5..f025b2687bc 100644
--- a/internal/service/ec2/vpc_endpoint_service_data_source_test.go
+++ b/internal/service/ec2/vpc_endpoint_service_data_source_test.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -25,7 +28,7 @@ func TestAccVPCEndpointServiceDataSource_gateway(t *testing.T) {
 				Config: testAccVPCEndpointServiceDataSourceConfig_gateway,
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr(datasourceName, "acceptance_required", "false"),
-					acctest.MatchResourceAttrRegionalARN(datasourceName, "arn", "ec2", regexp.MustCompile(`vpc-endpoint-service/vpce-svc-.+`)),
+					acctest.MatchResourceAttrRegionalARN(datasourceName, "arn", "ec2", regexache.MustCompile(`vpc-endpoint-service/vpce-svc-.+`)),
 					acctest.CheckResourceAttrGreaterThanValue(datasourceName, "availability_zones.#", 0),
 					resource.TestCheckResourceAttr(datasourceName, "base_endpoint_dns_names.#", "1"),
 					resource.TestCheckResourceAttr(datasourceName, "manages_vpc_endpoints", "false"),
@@ -55,7 +58,7 @@ func TestAccVPCEndpointServiceDataSource_interface(t *testing.T) {
 				Config: testAccVPCEndpointServiceDataSourceConfig_interface,
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr(datasourceName, "acceptance_required", "false"),
-					acctest.MatchResourceAttrRegionalARN(datasourceName, "arn", "ec2", regexp.MustCompile(`vpc-endpoint-service/vpce-svc-.+`)),
+					acctest.MatchResourceAttrRegionalARN(datasourceName, "arn", "ec2", regexache.MustCompile(`vpc-endpoint-service/vpce-svc-.+`)),
 					acctest.CheckResourceAttrGreaterThanValue(datasourceName, "availability_zones.#", 0),
 					resource.TestCheckResourceAttr(datasourceName, "base_endpoint_dns_names.#", "1"),
 					resource.TestCheckResourceAttr(datasourceName, "manages_vpc_endpoints", "false"),
diff --git a/internal/service/ec2/vpc_endpoint_service_test.go b/internal/service/ec2/vpc_endpoint_service_test.go
index 8d47d0a8afc..43ec7ec3988 100644
--- a/internal/service/ec2/vpc_endpoint_service_test.go
+++ b/internal/service/ec2/vpc_endpoint_service_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -34,7 +37,7 @@ func TestAccVPCEndpointService_basic(t *testing.T) {
 					testAccCheckVPCEndpointServiceExists(ctx, resourceName, &svcCfg),
 					resource.TestCheckResourceAttr(resourceName, "acceptance_required", "false"),
 					resource.TestCheckResourceAttr(resourceName, "allowed_principals.#", "0"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexp.MustCompile(`vpc-endpoint-service/vpce-svc-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`vpc-endpoint-service/vpce-svc-.+`)),
 					acctest.CheckResourceAttrGreaterThanValue(resourceName, "availability_zones.#", 0),
 					acctest.CheckResourceAttrGreaterThanValue(resourceName, "base_endpoint_dns_names.#", 0),
 					resource.TestCheckResourceAttr(resourceName, "gateway_load_balancer_arns.#", "0"),
diff --git a/internal/service/ec2/vpc_endpoint_subnet_association.go b/internal/service/ec2/vpc_endpoint_subnet_association.go
index 561647b9e0e..1a2b190e8fb 100644
--- a/internal/service/ec2/vpc_endpoint_subnet_association.go
+++ b/internal/service/ec2/vpc_endpoint_subnet_association.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/vpc_endpoint_subnet_association_test.go b/internal/service/ec2/vpc_endpoint_subnet_association_test.go
index 86f2a3e50d4..7b4d748b2dd 100644
--- a/internal/service/ec2/vpc_endpoint_subnet_association_test.go
+++ b/internal/service/ec2/vpc_endpoint_subnet_association_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/vpc_endpoint_test.go b/internal/service/ec2/vpc_endpoint_test.go
index b29ddb03e95..b927fc8f8e6 100644
--- a/internal/service/ec2/vpc_endpoint_test.go
+++ b/internal/service/ec2/vpc_endpoint_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -32,7 +35,7 @@ func TestAccVPCEndpoint_gatewayBasic(t *testing.T) {
 				Config: testAccVPCEndpointConfig_gatewayBasic(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckVPCEndpointExists(ctx, resourceName, &endpoint),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexp.MustCompile(`vpc-endpoint/vpce-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`vpc-endpoint/vpce-.+`)),
 					acctest.CheckResourceAttrGreaterThanValue(resourceName, "cidr_blocks.#", 0),
 					resource.TestCheckResourceAttr(resourceName, "dns_entry.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "dns_options.#", "0"),
@@ -75,7 +78,7 @@ func TestAccVPCEndpoint_interfaceBasic(t *testing.T) {
 				Config: testAccVPCEndpointConfig_interfaceBasic(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckVPCEndpointExists(ctx, resourceName, &endpoint),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexp.MustCompile(`vpc-endpoint/vpce-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`vpc-endpoint/vpce-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "cidr_blocks.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "dns_entry.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "dns_options.#", "1"),
@@ -149,6 +152,39 @@ func TestAccVPCEndpoint_interfacePrivateDNS(t *testing.T) {
 	})
 }
 
+func TestAccVPCEndpoint_interfacePrivateDNSNoGateway(t *testing.T) {
+	ctx := acctest.Context(t)
+	var endpoint ec2.VpcEndpoint
+	resourceName := "aws_vpc_endpoint.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, ec2.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckVPCEndpointDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccVPCEndpointConfig_interfacePrivateDNSNoGateway(rName, false),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckVPCEndpointExists(ctx, resourceName, &endpoint),
+					acctest.CheckResourceAttrGreaterThanValue(resourceName, "cidr_blocks.#", 0),
+					resource.TestCheckResourceAttr(resourceName, "dns_entry.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "dns_options.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "dns_options.0.dns_record_ip_type", "ipv4"),
+					resource.TestCheckResourceAttr(resourceName, "dns_options.0.private_dns_only_for_inbound_resolver_endpoint", "false"),
+					resource.TestCheckResourceAttr(resourceName, "private_dns_enabled", "true"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
 func TestAccVPCEndpoint_disappears(t *testing.T) {
 	ctx := acctest.Context(t)
 	var endpoint ec2.VpcEndpoint
@@ -773,7 +809,6 @@ resource "aws_vpc_endpoint" "test" {
   ip_address_type     = "ipv4"
 
   dns_options {
-    dns_record_ip_type                             = "ipv4"
     private_dns_only_for_inbound_resolver_endpoint = %[2]t
   }
 
@@ -787,6 +822,39 @@ resource "aws_vpc_endpoint" "test" {
 `, rName, privateDNSOnlyForInboundResolverEndpoint)
 }
 
+func testAccVPCEndpointConfig_interfacePrivateDNSNoGateway(rName string, privateDNSOnlyForInboundResolverEndpoint bool) string {
+	return fmt.Sprintf(`
+resource "aws_vpc" "test" {
+  cidr_block           = "10.0.0.0/16"
+  enable_dns_support   = true
+  enable_dns_hostnames = true
+
+  tags = {
+    Name = %[1]q
+  }
+}
+
+data "aws_region" "current" {}
+
+resource "aws_vpc_endpoint" "test" {
+  vpc_id              = aws_vpc.test.id
+  service_name        = "com.amazonaws.${data.aws_region.current.name}.s3"
+  private_dns_enabled = true
+  vpc_endpoint_type   = "Interface"
+  ip_address_type     = "ipv4"
+
+  dns_options {
+    dns_record_ip_type                             = "ipv4"
+    private_dns_only_for_inbound_resolver_endpoint = %[2]t
+  }
+
+  tags = {
+    Name = %[1]q
+  }
+}
+`, rName, privateDNSOnlyForInboundResolverEndpoint)
+}
+
 func testAccVPCEndpointConfig_ipAddressType(rName, addressType string) string {
 	return acctest.ConfigCompose(testAccVPCEndpointServiceConfig_baseSupportedIPAddressTypes(rName), fmt.Sprintf(`
 resource "aws_vpc_endpoint_service" "test" {
diff --git a/internal/service/ec2/vpc_flow_log.go b/internal/service/ec2/vpc_flow_log.go
index 53258380f02..11c3511b5b4 100644
--- a/internal/service/ec2/vpc_flow_log.go
+++ b/internal/service/ec2/vpc_flow_log.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -242,7 +245,7 @@ func resourceLogFlowCreate(ctx context.Context, d *schema.ResourceData, meta int
 		input.MaxAggregationInterval = aws.Int64(int64(v.(int)))
 	}
 
-	outputRaw, err := tfresource.RetryWhenAWSErrMessageContains(ctx, propagationTimeout, func() (interface{}, error) {
+	outputRaw, err := tfresource.RetryWhenAWSErrMessageContains(ctx, iamPropagationTimeout, func() (interface{}, error) {
 		return conn.CreateFlowLogsWithContext(ctx, input)
 	}, errCodeInvalidParameter, "Unable to assume given IAM role")
 
diff --git a/internal/service/ec2/vpc_flow_log_test.go b/internal/service/ec2/vpc_flow_log_test.go
index 8ff9f2230b7..aee3291ac4d 100644
--- a/internal/service/ec2/vpc_flow_log_test.go
+++ b/internal/service/ec2/vpc_flow_log_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -35,7 +38,7 @@ func TestAccVPCFlowLog_basic(t *testing.T) {
 				Config: testAccVPCFlowLogConfig_basic(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckFlowLogExists(ctx, resourceName, &flowLog),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexp.MustCompile(`vpc-flow-log/fl-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`vpc-flow-log/fl-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "deliver_cross_account_role", ""),
 					resource.TestCheckResourceAttrPair(resourceName, "iam_role_arn", iamRoleResourceName, "arn"),
 					resource.TestCheckResourceAttr(resourceName, "log_destination", ""),
@@ -141,7 +144,7 @@ func TestAccVPCFlowLog_transitGatewayID(t *testing.T) {
 				Config: testAccVPCFlowLogConfig_transitGatewayID(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckFlowLogExists(ctx, resourceName, &flowLog),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexp.MustCompile(`vpc-flow-log/fl-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`vpc-flow-log/fl-.+`)),
 					resource.TestCheckResourceAttrPair(resourceName, "iam_role_arn", iamRoleResourceName, "arn"),
 					resource.TestCheckResourceAttr(resourceName, "log_destination", ""),
 					resource.TestCheckResourceAttr(resourceName, "log_destination_type", "cloud-watch-logs"),
@@ -178,7 +181,7 @@ func TestAccVPCFlowLog_transitGatewayAttachmentID(t *testing.T) {
 				Config: testAccVPCFlowLogConfig_transitGatewayAttachmentID(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckFlowLogExists(ctx, resourceName, &flowLog),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexp.MustCompile(`vpc-flow-log/fl-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`vpc-flow-log/fl-.+`)),
 					resource.TestCheckResourceAttrPair(resourceName, "iam_role_arn", iamRoleResourceName, "arn"),
 					resource.TestCheckResourceAttr(resourceName, "log_destination", ""),
 					resource.TestCheckResourceAttr(resourceName, "log_destination_type", "cloud-watch-logs"),
@@ -302,7 +305,7 @@ func TestAccVPCFlowLog_LogDestinationTypeS3_invalid(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccVPCFlowLogConfig_destinationTypeS3Invalid(rName),
-				ExpectError: regexp.MustCompile(`(Access Denied for LogDestination|does not exist)`),
+				ExpectError: regexache.MustCompile(`(Access Denied for LogDestination|does not exist)`),
 			},
 		},
 	})
@@ -1238,11 +1241,6 @@ resource "aws_s3_bucket" "bucket" {
   bucket = %[1]q
 }
 
-resource "aws_s3_bucket_acl" "bucket_acl" {
-  bucket = aws_s3_bucket.bucket.id
-  acl    = "private"
-}
-
 resource "aws_iam_role" "test" {
   name = %[1]q
 
diff --git a/internal/service/ec2/vpc_internet_gateway.go b/internal/service/ec2/vpc_internet_gateway.go
index d6698d1e317..9a46a52631a 100644
--- a/internal/service/ec2/vpc_internet_gateway.go
+++ b/internal/service/ec2/vpc_internet_gateway.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -91,7 +94,7 @@ func resourceInternetGatewayRead(ctx context.Context, d *schema.ResourceData, me
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).EC2Conn(ctx)
 
-	outputRaw, err := tfresource.RetryWhenNewResourceNotFound(ctx, propagationTimeout, func() (interface{}, error) {
+	outputRaw, err := tfresource.RetryWhenNewResourceNotFound(ctx, ec2PropagationTimeout, func() (interface{}, error) {
 		return FindInternetGatewayByID(ctx, conn, d.Id())
 	}, d.IsNewResource())
 
diff --git a/internal/service/ec2/vpc_internet_gateway_attachment.go b/internal/service/ec2/vpc_internet_gateway_attachment.go
index 806e8aa658a..539d62945a3 100644
--- a/internal/service/ec2/vpc_internet_gateway_attachment.go
+++ b/internal/service/ec2/vpc_internet_gateway_attachment.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -72,7 +75,7 @@ func resourceInternetGatewayAttachmentRead(ctx context.Context, d *schema.Resour
 		return sdkdiag.AppendErrorf(diags, "reading EC2 Internet Gateway Attachment (%s): %s", d.Id(), err)
 	}
 
-	outputRaw, err := tfresource.RetryWhenNewResourceNotFound(ctx, propagationTimeout, func() (interface{}, error) {
+	outputRaw, err := tfresource.RetryWhenNewResourceNotFound(ctx, ec2PropagationTimeout, func() (interface{}, error) {
 		return FindInternetGatewayAttachment(ctx, conn, igwID, vpcID)
 	}, d.IsNewResource())
 
diff --git a/internal/service/ec2/vpc_internet_gateway_attachment_test.go b/internal/service/ec2/vpc_internet_gateway_attachment_test.go
index 1cdf7d011ef..83ceb47730f 100644
--- a/internal/service/ec2/vpc_internet_gateway_attachment_test.go
+++ b/internal/service/ec2/vpc_internet_gateway_attachment_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/vpc_internet_gateway_data_source.go b/internal/service/ec2/vpc_internet_gateway_data_source.go
index 26fac46eac2..2bf9cc97969 100644
--- a/internal/service/ec2/vpc_internet_gateway_data_source.go
+++ b/internal/service/ec2/vpc_internet_gateway_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/vpc_internet_gateway_data_source_test.go b/internal/service/ec2/vpc_internet_gateway_data_source_test.go
index 3621f7da911..213e6e9df54 100644
--- a/internal/service/ec2/vpc_internet_gateway_data_source_test.go
+++ b/internal/service/ec2/vpc_internet_gateway_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/vpc_internet_gateway_test.go b/internal/service/ec2/vpc_internet_gateway_test.go
index 43e0c0bf255..86d601577e7 100644
--- a/internal/service/ec2/vpc_internet_gateway_test.go
+++ b/internal/service/ec2/vpc_internet_gateway_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -31,7 +34,7 @@ func TestAccVPCInternetGateway_basic(t *testing.T) {
 				Config: testAccVPCInternetGatewayConfig_basic,
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckInternetGatewayExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexp.MustCompile(`internet-gateway/igw-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`internet-gateway/igw-.+`)),
 					acctest.CheckResourceAttrAccountID(resourceName, "owner_id"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 					resource.TestCheckResourceAttr(resourceName, "vpc_id", ""),
diff --git a/internal/service/ec2/vpc_ipv4_cidr_block_association.go b/internal/service/ec2/vpc_ipv4_cidr_block_association.go
index 6392c521196..d414a28b6df 100644
--- a/internal/service/ec2/vpc_ipv4_cidr_block_association.go
+++ b/internal/service/ec2/vpc_ipv4_cidr_block_association.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/vpc_ipv4_cidr_block_association_test.go b/internal/service/ec2/vpc_ipv4_cidr_block_association_test.go
index 6fdf78b9196..754a1d0e99a 100644
--- a/internal/service/ec2/vpc_ipv4_cidr_block_association_test.go
+++ b/internal/service/ec2/vpc_ipv4_cidr_block_association_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/vpc_ipv6_cidr_block_association.go b/internal/service/ec2/vpc_ipv6_cidr_block_association.go
index daaa53953ec..1ff8413f9d6 100644
--- a/internal/service/ec2/vpc_ipv6_cidr_block_association.go
+++ b/internal/service/ec2/vpc_ipv6_cidr_block_association.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/vpc_ipv6_cidr_block_association_test.go b/internal/service/ec2/vpc_ipv6_cidr_block_association_test.go
index 1eccd7412ed..2b0642b7b6d 100644
--- a/internal/service/ec2/vpc_ipv6_cidr_block_association_test.go
+++ b/internal/service/ec2/vpc_ipv6_cidr_block_association_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/vpc_main_route_table_association.go b/internal/service/ec2/vpc_main_route_table_association.go
index 52d5d17892c..5c274c91041 100644
--- a/internal/service/ec2/vpc_main_route_table_association.go
+++ b/internal/service/ec2/vpc_main_route_table_association.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/vpc_main_route_table_association_test.go b/internal/service/ec2/vpc_main_route_table_association_test.go
index 40df4800175..cb56f516c32 100644
--- a/internal/service/ec2/vpc_main_route_table_association_test.go
+++ b/internal/service/ec2/vpc_main_route_table_association_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/vpc_managed_prefix_list.go b/internal/service/ec2/vpc_managed_prefix_list.go
index 2adf41731ac..cbc3433d9e6 100644
--- a/internal/service/ec2/vpc_managed_prefix_list.go
+++ b/internal/service/ec2/vpc_managed_prefix_list.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/vpc_managed_prefix_list_data_source.go b/internal/service/ec2/vpc_managed_prefix_list_data_source.go
index 92b0097f422..2e4133bee2b 100644
--- a/internal/service/ec2/vpc_managed_prefix_list_data_source.go
+++ b/internal/service/ec2/vpc_managed_prefix_list_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/vpc_managed_prefix_list_data_source_test.go b/internal/service/ec2/vpc_managed_prefix_list_data_source_test.go
index 1fdcf1dd580..7d6da88528e 100644
--- a/internal/service/ec2/vpc_managed_prefix_list_data_source_test.go
+++ b/internal/service/ec2/vpc_managed_prefix_list_data_source_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -163,7 +166,7 @@ func TestAccVPCManagedPrefixListDataSource_matchesTooMany(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccVPCManagedPrefixListDataSourceConfig_matchesTooMany,
-				ExpectError: regexp.MustCompile(`multiple EC2 Managed Prefix Lists matched`),
+				ExpectError: regexache.MustCompile(`multiple EC2 Managed Prefix Lists matched`),
 			},
 		},
 	})
diff --git a/internal/service/ec2/vpc_managed_prefix_list_entry.go b/internal/service/ec2/vpc_managed_prefix_list_entry.go
index 2dcaca815db..dca9474bcb3 100644
--- a/internal/service/ec2/vpc_managed_prefix_list_entry.go
+++ b/internal/service/ec2/vpc_managed_prefix_list_entry.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/vpc_managed_prefix_list_entry_test.go b/internal/service/ec2/vpc_managed_prefix_list_entry_test.go
index 925600fb927..95770f3d49b 100644
--- a/internal/service/ec2/vpc_managed_prefix_list_entry_test.go
+++ b/internal/service/ec2/vpc_managed_prefix_list_entry_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -121,7 +124,7 @@ func TestAccVPCManagedPrefixListEntry_expectInvalidTypeError(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccVPCManagedPrefixListEntryConfig_expectInvalidType(rName),
-				ExpectError: regexp.MustCompile(`invalid CIDR address: ::/244`),
+				ExpectError: regexache.MustCompile(`invalid CIDR address: ::/244`),
 			},
 		},
 	})
@@ -139,11 +142,11 @@ func TestAccVPCManagedPrefixListEntry_expectInvalidCIDR(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccVPCManagedPrefixListEntryConfig_invalidIPv4CIDR(rName),
-				ExpectError: regexp.MustCompile("invalid CIDR address: 1.2.3.4/33"),
+				ExpectError: regexache.MustCompile("invalid CIDR address: 1.2.3.4/33"),
 			},
 			{
 				Config:      testAccVPCManagedPrefixListEntryConfig_invalidIPv6CIDR(rName),
-				ExpectError: regexp.MustCompile("invalid CIDR address: ::/244"),
+				ExpectError: regexache.MustCompile("invalid CIDR address: ::/244"),
 			},
 		},
 	})
diff --git a/internal/service/ec2/vpc_managed_prefix_list_test.go b/internal/service/ec2/vpc_managed_prefix_list_test.go
index 5f72a2fbc29..2aada56086a 100644
--- a/internal/service/ec2/vpc_managed_prefix_list_test.go
+++ b/internal/service/ec2/vpc_managed_prefix_list_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -33,7 +36,7 @@ func TestAccVPCManagedPrefixList_basic(t *testing.T) {
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccManagedPrefixListExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "address_family", "IPv4"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexp.MustCompile(`prefix-list/pl-[[:xdigit:]]+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`prefix-list/pl-[[:xdigit:]]+`)),
 					resource.TestCheckResourceAttr(resourceName, "entry.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "max_entries", "1"),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
diff --git a/internal/service/ec2/vpc_managed_prefix_lists_data_source.go b/internal/service/ec2/vpc_managed_prefix_lists_data_source.go
index 1c3cc3b5db9..f13a4082098 100644
--- a/internal/service/ec2/vpc_managed_prefix_lists_data_source.go
+++ b/internal/service/ec2/vpc_managed_prefix_lists_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -17,7 +20,7 @@ func DataSourceManagedPrefixLists() *schema.Resource {
 		ReadWithoutTimeout: dataSourceManagedPrefixListsRead,
 
 		Schema: map[string]*schema.Schema{
-			"filter": DataSourceFiltersSchema(),
+			"filter": CustomFiltersSchema(),
 			"ids": {
 				Type:     schema.TypeList,
 				Computed: true,
@@ -37,7 +40,7 @@ func dataSourceManagedPrefixListsRead(ctx context.Context, d *schema.ResourceDat
 		Tags(tftags.New(ctx, d.Get("tags").(map[string]interface{}))),
 	)...)
 
-	input.Filters = append(input.Filters, BuildFiltersDataSource(
+	input.Filters = append(input.Filters, BuildCustomFilterList(
 		d.Get("filter").(*schema.Set),
 	)...)
 
diff --git a/internal/service/ec2/vpc_managed_prefix_lists_data_source_test.go b/internal/service/ec2/vpc_managed_prefix_lists_data_source_test.go
index 496f6ddd02a..585b5921506 100644
--- a/internal/service/ec2/vpc_managed_prefix_lists_data_source_test.go
+++ b/internal/service/ec2/vpc_managed_prefix_lists_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/vpc_migrate.go b/internal/service/ec2/vpc_migrate.go
index 0196c2c5547..6ce1ced9176 100644
--- a/internal/service/ec2/vpc_migrate.go
+++ b/internal/service/ec2/vpc_migrate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/vpc_migrate_test.go b/internal/service/ec2/vpc_migrate_test.go
index 23743ee0813..ef4d8ad2107 100644
--- a/internal/service/ec2/vpc_migrate_test.go
+++ b/internal/service/ec2/vpc_migrate_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/vpc_nat_gateway.go b/internal/service/ec2/vpc_nat_gateway.go
index 86a92ace5d2..f51a8de9e9e 100644
--- a/internal/service/ec2/vpc_nat_gateway.go
+++ b/internal/service/ec2/vpc_nat_gateway.go
@@ -1,21 +1,29 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
 	"context"
+	"fmt"
 	"log"
+	"time"
 
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/customdiff"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/flex"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
 	"github.com/hashicorp/terraform-provider-aws/names"
+	"golang.org/x/exp/slices"
 )
 
 // @SDKResource("aws_nat_gateway", name="NAT Gateway")
@@ -31,6 +39,12 @@ func ResourceNATGateway() *schema.Resource {
 			StateContext: schema.ImportStatePassthroughContext,
 		},
 
+		Timeouts: &schema.ResourceTimeout{
+			Create: schema.DefaultTimeout(10 * time.Minute),
+			Update: schema.DefaultTimeout(10 * time.Minute),
+			Delete: schema.DefaultTimeout(30 * time.Minute),
+		},
+
 		Schema: map[string]*schema.Schema{
 			"allocation_id": {
 				Type:     schema.TypeString,
@@ -63,6 +77,25 @@ func ResourceNATGateway() *schema.Resource {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
+			"secondary_allocation_ids": {
+				Type:     schema.TypeSet,
+				Optional: true,
+				Elem:     &schema.Schema{Type: schema.TypeString},
+			},
+			"secondary_private_ip_address_count": {
+				Type:          schema.TypeInt,
+				Optional:      true,
+				Computed:      true,
+				ForceNew:      true,
+				ConflictsWith: []string{"secondary_private_ip_addresses"},
+			},
+			"secondary_private_ip_addresses": {
+				Type:          schema.TypeSet,
+				Optional:      true,
+				Computed:      true,
+				Elem:          &schema.Schema{Type: schema.TypeString},
+				ConflictsWith: []string{"secondary_private_ip_address_count"},
+			},
 			"subnet_id": {
 				Type:     schema.TypeString,
 				Required: true,
@@ -72,7 +105,10 @@ func ResourceNATGateway() *schema.Resource {
 			names.AttrTagsAll: tftags.TagsSchemaComputed(),
 		},
 
-		CustomizeDiff: verify.SetTagsDiff,
+		CustomizeDiff: customdiff.All(
+			resourceNATGatewayCustomizeDiff,
+			verify.SetTagsDiff,
+		),
 	}
 }
 
@@ -96,6 +132,18 @@ func resourceNATGatewayCreate(ctx context.Context, d *schema.ResourceData, meta
 		input.PrivateIpAddress = aws.String(v.(string))
 	}
 
+	if v, ok := d.GetOk("secondary_allocation_ids"); ok && v.(*schema.Set).Len() > 0 {
+		input.SecondaryAllocationIds = flex.ExpandStringSet(v.(*schema.Set))
+	}
+
+	if v, ok := d.GetOk("secondary_private_ip_address_count"); ok {
+		input.SecondaryPrivateIpAddressCount = aws.Int64(int64(v.(int)))
+	}
+
+	if v, ok := d.GetOk("secondary_private_ip_addresses"); ok && v.(*schema.Set).Len() > 0 {
+		input.SecondaryPrivateIpAddresses = flex.ExpandStringSet(v.(*schema.Set))
+	}
+
 	if v, ok := d.GetOk("subnet_id"); ok {
 		input.SubnetId = aws.String(v.(string))
 	}
@@ -108,7 +156,7 @@ func resourceNATGatewayCreate(ctx context.Context, d *schema.ResourceData, meta
 
 	d.SetId(aws.StringValue(output.NatGateway.NatGatewayId))
 
-	if _, err := WaitNATGatewayCreated(ctx, conn, d.Id()); err != nil {
+	if _, err := WaitNATGatewayCreated(ctx, conn, d.Id(), d.Timeout(schema.TimeoutCreate)); err != nil {
 		return diag.Errorf("waiting for EC2 NAT Gateway (%s) create: %s", d.Id(), err)
 	}
 
@@ -130,19 +178,30 @@ func resourceNATGatewayRead(ctx context.Context, d *schema.ResourceData, meta in
 		return diag.Errorf("reading EC2 NAT Gateway (%s): %s", d.Id(), err)
 	}
 
+	var secondaryAllocationIDs, secondaryPrivateIPAddresses []string
+
 	for _, address := range ng.NatGatewayAddresses {
 		// Length check guarantees the attributes are always set (#30865).
-		if len(ng.NatGatewayAddresses) == 1 || aws.BoolValue(address.IsPrimary) {
+		if isPrimary := aws.BoolValue(address.IsPrimary); isPrimary || len(ng.NatGatewayAddresses) == 1 {
 			d.Set("allocation_id", address.AllocationId)
 			d.Set("association_id", address.AssociationId)
 			d.Set("network_interface_id", address.NetworkInterfaceId)
 			d.Set("private_ip", address.PrivateIp)
 			d.Set("public_ip", address.PublicIp)
-			break
+		} else if !isPrimary {
+			if allocationID := aws.StringValue(address.AllocationId); allocationID != "" {
+				secondaryAllocationIDs = append(secondaryAllocationIDs, allocationID)
+			}
+			if privateIP := aws.StringValue(address.PrivateIp); privateIP != "" {
+				secondaryPrivateIPAddresses = append(secondaryPrivateIPAddresses, privateIP)
+			}
 		}
 	}
 
 	d.Set("connectivity_type", ng.ConnectivityType)
+	d.Set("secondary_allocation_ids", secondaryAllocationIDs)
+	d.Set("secondary_private_ip_address_count", len(secondaryPrivateIPAddresses))
+	d.Set("secondary_private_ip_addresses", secondaryPrivateIPAddresses)
 	d.Set("subnet_id", ng.SubnetId)
 
 	setTagsOut(ctx, ng.Tags)
@@ -151,7 +210,123 @@ func resourceNATGatewayRead(ctx context.Context, d *schema.ResourceData, meta in
 }
 
 func resourceNATGatewayUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	// Tags only.
+	conn := meta.(*conns.AWSClient).EC2Conn(ctx)
+
+	switch d.Get("connectivity_type").(string) {
+	case ec2.ConnectivityTypePrivate:
+		if d.HasChanges("secondary_private_ip_addresses") {
+			oRaw, nRaw := d.GetChange("secondary_private_ip_addresses")
+			o, n := oRaw.(*schema.Set), nRaw.(*schema.Set)
+
+			if add := n.Difference(o); add.Len() > 0 {
+				input := &ec2.AssignPrivateNatGatewayAddressInput{
+					NatGatewayId:       aws.String(d.Id()),
+					PrivateIpAddresses: flex.ExpandStringSet(add),
+				}
+
+				_, err := conn.AssignPrivateNatGatewayAddressWithContext(ctx, input)
+
+				if err != nil {
+					return diag.Errorf("assigning EC2 NAT Gateway (%s) private IP addresses: %s", d.Id(), err)
+				}
+
+				for _, privateIP := range flex.ExpandStringValueSet(add) {
+					if _, err := WaitNATGatewayAddressAssigned(ctx, conn, d.Id(), privateIP, d.Timeout(schema.TimeoutUpdate)); err != nil {
+						return diag.Errorf("waiting for EC2 NAT Gateway (%s) private IP address (%s) assign: %s", d.Id(), privateIP, err)
+					}
+				}
+			}
+
+			if del := o.Difference(n); del.Len() > 0 {
+				input := &ec2.UnassignPrivateNatGatewayAddressInput{
+					NatGatewayId:       aws.String(d.Id()),
+					PrivateIpAddresses: flex.ExpandStringSet(del),
+				}
+
+				_, err := conn.UnassignPrivateNatGatewayAddressWithContext(ctx, input)
+
+				if err != nil {
+					return diag.Errorf("unassigning EC2 NAT Gateway (%s) private IP addresses: %s", d.Id(), err)
+				}
+
+				for _, privateIP := range flex.ExpandStringValueSet(del) {
+					if _, err := WaitNATGatewayAddressUnassigned(ctx, conn, d.Id(), privateIP, d.Timeout(schema.TimeoutUpdate)); err != nil {
+						return diag.Errorf("waiting for EC2 NAT Gateway (%s) private IP address (%s) unassign: %s", d.Id(), privateIP, err)
+					}
+				}
+			}
+		}
+
+	case ec2.ConnectivityTypePublic:
+		if d.HasChanges("secondary_allocation_ids") {
+			oRaw, nRaw := d.GetChange("secondary_allocation_ids")
+			o, n := oRaw.(*schema.Set), nRaw.(*schema.Set)
+
+			if add := n.Difference(o); add.Len() > 0 {
+				input := &ec2.AssociateNatGatewayAddressInput{
+					AllocationIds: flex.ExpandStringSet(add),
+					NatGatewayId:  aws.String(d.Id()),
+				}
+
+				if d.HasChanges("secondary_private_ip_addresses") {
+					oRaw, nRaw := d.GetChange("secondary_private_ip_addresses")
+					o, n := oRaw.(*schema.Set), nRaw.(*schema.Set)
+
+					if add := n.Difference(o); add.Len() > 0 {
+						input.PrivateIpAddresses = flex.ExpandStringSet(add)
+					}
+				}
+
+				_, err := conn.AssociateNatGatewayAddressWithContext(ctx, input)
+
+				if err != nil {
+					return diag.Errorf("associating EC2 NAT Gateway (%s) allocation IDs: %s", d.Id(), err)
+				}
+
+				for _, allocationID := range flex.ExpandStringValueSet(add) {
+					if _, err := WaitNATGatewayAddressAssociated(ctx, conn, d.Id(), allocationID, d.Timeout(schema.TimeoutUpdate)); err != nil {
+						return diag.Errorf("waiting for EC2 NAT Gateway (%s) allocation ID (%s) associate: %s", d.Id(), allocationID, err)
+					}
+				}
+			}
+
+			if del := o.Difference(n); del.Len() > 0 {
+				natGateway, err := FindNATGatewayByID(ctx, conn, d.Id())
+
+				if err != nil {
+					return diag.Errorf("reading EC2 NAT Gateway (%s): %s", d.Id(), err)
+				}
+
+				allocationIDs := flex.ExpandStringValueSet(del)
+				var associationIDs []string
+
+				for _, natGatewayAddress := range natGateway.NatGatewayAddresses {
+					allocationID := aws.StringValue(natGatewayAddress.AllocationId)
+					if slices.Contains(allocationIDs, allocationID) {
+						associationIDs = append(associationIDs, aws.StringValue(natGatewayAddress.AssociationId))
+					}
+				}
+
+				input := &ec2.DisassociateNatGatewayAddressInput{
+					AssociationIds: aws.StringSlice(associationIDs),
+					NatGatewayId:   aws.String(d.Id()),
+				}
+
+				_, err = conn.DisassociateNatGatewayAddressWithContext(ctx, input)
+
+				if err != nil {
+					return diag.Errorf("disassociating EC2 NAT Gateway (%s) allocation IDs: %s", d.Id(), err)
+				}
+
+				for _, allocationID := range allocationIDs {
+					if _, err := WaitNATGatewayAddressDisassociated(ctx, conn, d.Id(), allocationID, d.Timeout(schema.TimeoutUpdate)); err != nil {
+						return diag.Errorf("waiting for EC2 NAT Gateway (%s) allocation ID (%s) disassociate: %s", d.Id(), allocationID, err)
+					}
+				}
+			}
+		}
+	}
+
 	return resourceNATGatewayRead(ctx, d, meta)
 }
 
@@ -171,9 +346,40 @@ func resourceNATGatewayDelete(ctx context.Context, d *schema.ResourceData, meta
 		return diag.Errorf("deleting EC2 NAT Gateway (%s): %s", d.Id(), err)
 	}
 
-	if _, err := WaitNATGatewayDeleted(ctx, conn, d.Id()); err != nil {
+	if _, err := WaitNATGatewayDeleted(ctx, conn, d.Id(), d.Timeout(schema.TimeoutDelete)); err != nil {
 		return diag.Errorf("waiting for EC2 NAT Gateway (%s) delete: %s", d.Id(), err)
 	}
 
 	return nil
 }
+
+func resourceNATGatewayCustomizeDiff(ctx context.Context, diff *schema.ResourceDiff, meta interface{}) error {
+	switch connectivityType := diff.Get("connectivity_type").(string); connectivityType {
+	case ec2.ConnectivityTypePrivate:
+		if _, ok := diff.GetOk("allocation_id"); ok {
+			return fmt.Errorf(`allocation_id is not supported with connectivity_type = "%s"`, connectivityType)
+		}
+		if v, ok := diff.GetOk("secondary_allocation_ids"); ok && v.(*schema.Set).Len() > 0 {
+			return fmt.Errorf(`secondary_allocation_ids is not supported with connectivity_type = "%s"`, connectivityType)
+		}
+
+	case ec2.ConnectivityTypePublic:
+		if v := diff.GetRawConfig().GetAttr("secondary_private_ip_address_count"); v.IsKnown() && !v.IsNull() {
+			return fmt.Errorf(`secondary_private_ip_address_count is not supported with connectivity_type = "%s"`, connectivityType)
+		}
+
+		if diff.Id() != "" && diff.HasChange("secondary_allocation_ids") {
+			if err := diff.SetNewComputed("secondary_private_ip_address_count"); err != nil {
+				return fmt.Errorf("setting secondary_private_ip_address_count to computed: %s", err)
+			}
+
+			if v := diff.GetRawConfig().GetAttr("secondary_private_ip_addresses"); !v.IsKnown() {
+				if err := diff.SetNewComputed("secondary_private_ip_addresses"); err != nil {
+					return fmt.Errorf("setting secondary_private_ip_addresses to computed: %s", err)
+				}
+			}
+		}
+	}
+
+	return nil
+}
diff --git a/internal/service/ec2/vpc_nat_gateway_data_source.go b/internal/service/ec2/vpc_nat_gateway_data_source.go
index bb077e9efa0..74795dac50d 100644
--- a/internal/service/ec2/vpc_nat_gateway_data_source.go
+++ b/internal/service/ec2/vpc_nat_gateway_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -53,6 +56,20 @@ func DataSourceNATGateway() *schema.Resource {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
+			"secondary_allocation_ids": {
+				Type:     schema.TypeList,
+				Computed: true,
+				Elem:     &schema.Schema{Type: schema.TypeString},
+			},
+			"secondary_private_ip_address_count": {
+				Type:     schema.TypeInt,
+				Computed: true,
+			},
+			"secondary_private_ip_addresses": {
+				Type:     schema.TypeList,
+				Computed: true,
+				Elem:     &schema.Schema{Type: schema.TypeString},
+			},
 			"state": {
 				Type:     schema.TypeString,
 				Optional: true,
@@ -117,18 +134,30 @@ func dataSourceNATGatewayRead(ctx context.Context, d *schema.ResourceData, meta
 	d.Set("subnet_id", ngw.SubnetId)
 	d.Set("vpc_id", ngw.VpcId)
 
+	var secondaryAllocationIDs, secondaryPrivateIPAddresses []string
+
 	for _, address := range ngw.NatGatewayAddresses {
 		// Length check guarantees the attributes are always set (#30865).
-		if len(ngw.NatGatewayAddresses) == 1 || aws.BoolValue(address.IsPrimary) {
+		if isPrimary := aws.BoolValue(address.IsPrimary); isPrimary || len(ngw.NatGatewayAddresses) == 1 {
 			d.Set("allocation_id", address.AllocationId)
 			d.Set("association_id", address.AssociationId)
 			d.Set("network_interface_id", address.NetworkInterfaceId)
 			d.Set("private_ip", address.PrivateIp)
 			d.Set("public_ip", address.PublicIp)
-			break
+		} else if !isPrimary {
+			if allocationID := aws.StringValue(address.AllocationId); allocationID != "" {
+				secondaryAllocationIDs = append(secondaryAllocationIDs, allocationID)
+			}
+			if privateIP := aws.StringValue(address.PrivateIp); privateIP != "" {
+				secondaryPrivateIPAddresses = append(secondaryPrivateIPAddresses, privateIP)
+			}
 		}
 	}
 
+	d.Set("secondary_allocation_ids", secondaryAllocationIDs)
+	d.Set("secondary_private_ip_address_count", len(secondaryPrivateIPAddresses))
+	d.Set("secondary_private_ip_addresses", secondaryPrivateIPAddresses)
+
 	if err := d.Set("tags", KeyValueTags(ctx, ngw.Tags).IgnoreAWS().IgnoreConfig(ignoreTagsConfig).Map()); err != nil {
 		return diag.Errorf("setting tags: %s", err)
 	}
diff --git a/internal/service/ec2/vpc_nat_gateway_data_source_test.go b/internal/service/ec2/vpc_nat_gateway_data_source_test.go
index 30301a0b6b6..1f7a77f54bb 100644
--- a/internal/service/ec2/vpc_nat_gateway_data_source_test.go
+++ b/internal/service/ec2/vpc_nat_gateway_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
@@ -13,8 +16,8 @@ import (
 func TestAccVPCNATGatewayDataSource_basic(t *testing.T) {
 	ctx := acctest.Context(t)
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
-	dataSourceNameById := "data.aws_nat_gateway.test_by_id"
-	dataSourceNameBySubnetId := "data.aws_nat_gateway.test_by_subnet_id"
+	dataSourceNameByID := "data.aws_nat_gateway.test_by_id"
+	dataSourceNameBySubnetID := "data.aws_nat_gateway.test_by_subnet_id"
 	dataSourceNameByTags := "data.aws_nat_gateway.test_by_tags"
 	resourceName := "aws_nat_gateway.test"
 
@@ -25,19 +28,39 @@ func TestAccVPCNATGatewayDataSource_basic(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config: testAccVPCNATGatewayDataSourceConfig_basic(rName),
-				Check: resource.ComposeTestCheckFunc(
-					resource.TestCheckResourceAttrPair(dataSourceNameById, "connectivity_type", resourceName, "connectivity_type"),
-					resource.TestCheckResourceAttrPair(dataSourceNameById, "id", resourceName, "id"),
-					resource.TestCheckResourceAttrPair(dataSourceNameBySubnetId, "subnet_id", resourceName, "subnet_id"),
-					resource.TestCheckResourceAttrPair(dataSourceNameByTags, "tags.Name", resourceName, "tags.Name"),
-					resource.TestCheckResourceAttrSet(dataSourceNameById, "state"),
-					resource.TestCheckResourceAttrSet(dataSourceNameById, "allocation_id"),
-					resource.TestCheckResourceAttrSet(dataSourceNameById, "network_interface_id"),
-					resource.TestCheckResourceAttrSet(dataSourceNameById, "public_ip"),
-					resource.TestCheckResourceAttrSet(dataSourceNameById, "private_ip"),
-					resource.TestCheckNoResourceAttr(dataSourceNameById, "attached_vpc_id"),
-					resource.TestCheckResourceAttrSet(dataSourceNameById, "tags.OtherTag"),
-					resource.TestCheckResourceAttrPair(dataSourceNameById, "association_id", resourceName, "association_id"),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					resource.TestCheckResourceAttrPair(dataSourceNameByID, "allocation_id", resourceName, "allocation_id"),
+					resource.TestCheckResourceAttrPair(dataSourceNameByID, "association_id", resourceName, "association_id"),
+					resource.TestCheckResourceAttrPair(dataSourceNameByID, "connectivity_type", resourceName, "connectivity_type"),
+					resource.TestCheckResourceAttrPair(dataSourceNameByID, "network_interface_id", resourceName, "network_interface_id"),
+					resource.TestCheckResourceAttrPair(dataSourceNameByID, "private_ip", resourceName, "private_ip"),
+					resource.TestCheckResourceAttrPair(dataSourceNameByID, "public_ip", resourceName, "public_ip"),
+					resource.TestCheckResourceAttrPair(dataSourceNameByID, "secondary_allocation_ids.#", resourceName, "secondary_allocation_ids.#"),
+					resource.TestCheckResourceAttrPair(dataSourceNameByID, "secondary_private_ip_address_count", resourceName, "secondary_private_ip_address_count"),
+					resource.TestCheckResourceAttrPair(dataSourceNameByID, "secondary_private_ip_addresses.#", resourceName, "secondary_private_ip_addresses.#"),
+					resource.TestCheckResourceAttrPair(dataSourceNameByID, "tags.#", resourceName, "tags.#"),
+
+					resource.TestCheckResourceAttrPair(dataSourceNameBySubnetID, "allocation_id", resourceName, "allocation_id"),
+					resource.TestCheckResourceAttrPair(dataSourceNameBySubnetID, "association_id", resourceName, "association_id"),
+					resource.TestCheckResourceAttrPair(dataSourceNameBySubnetID, "connectivity_type", resourceName, "connectivity_type"),
+					resource.TestCheckResourceAttrPair(dataSourceNameBySubnetID, "network_interface_id", resourceName, "network_interface_id"),
+					resource.TestCheckResourceAttrPair(dataSourceNameBySubnetID, "private_ip", resourceName, "private_ip"),
+					resource.TestCheckResourceAttrPair(dataSourceNameBySubnetID, "public_ip", resourceName, "public_ip"),
+					resource.TestCheckResourceAttrPair(dataSourceNameBySubnetID, "secondary_allocation_ids.#", resourceName, "secondary_allocation_ids.#"),
+					resource.TestCheckResourceAttrPair(dataSourceNameBySubnetID, "secondary_private_ip_address_count", resourceName, "secondary_private_ip_address_count"),
+					resource.TestCheckResourceAttrPair(dataSourceNameBySubnetID, "secondary_private_ip_addresses.#", resourceName, "secondary_private_ip_addresses.#"),
+					resource.TestCheckResourceAttrPair(dataSourceNameBySubnetID, "tags.#", resourceName, "tags.#"),
+
+					resource.TestCheckResourceAttrPair(dataSourceNameByTags, "allocation_id", resourceName, "allocation_id"),
+					resource.TestCheckResourceAttrPair(dataSourceNameByTags, "association_id", resourceName, "association_id"),
+					resource.TestCheckResourceAttrPair(dataSourceNameByTags, "connectivity_type", resourceName, "connectivity_type"),
+					resource.TestCheckResourceAttrPair(dataSourceNameByTags, "network_interface_id", resourceName, "network_interface_id"),
+					resource.TestCheckResourceAttrPair(dataSourceNameByTags, "private_ip", resourceName, "private_ip"),
+					resource.TestCheckResourceAttrPair(dataSourceNameByTags, "public_ip", resourceName, "public_ip"),
+					resource.TestCheckResourceAttrPair(dataSourceNameByTags, "secondary_allocation_ids.#", resourceName, "secondary_allocation_ids.#"),
+					resource.TestCheckResourceAttrPair(dataSourceNameByTags, "secondary_private_ip_address_count", resourceName, "secondary_private_ip_address_count"),
+					resource.TestCheckResourceAttrPair(dataSourceNameByTags, "secondary_private_ip_addresses.#", resourceName, "secondary_private_ip_addresses.#"),
+					resource.TestCheckResourceAttrPair(dataSourceNameByTags, "tags.#", resourceName, "tags.#"),
 				),
 			},
 		},
@@ -45,48 +68,13 @@ func TestAccVPCNATGatewayDataSource_basic(t *testing.T) {
 }
 
 func testAccVPCNATGatewayDataSourceConfig_basic(rName string) string {
-	return acctest.ConfigCompose(acctest.ConfigAvailableAZsNoOptIn(), fmt.Sprintf(`
-resource "aws_vpc" "test" {
-  cidr_block = "172.5.0.0/16"
-
-  tags = {
-    Name = %[1]q
-  }
-}
-
-resource "aws_subnet" "test" {
-  vpc_id            = aws_vpc.test.id
-  cidr_block        = "172.5.123.0/24"
-  availability_zone = data.aws_availability_zones.available.names[0]
-
-  tags = {
-    Name = %[1]q
-  }
-}
-
-resource "aws_eip" "test" {
-  domain = "vpc"
-
-  tags = {
-    Name = %[1]q
-  }
-}
-
-resource "aws_internet_gateway" "test" {
-  vpc_id = aws_vpc.test.id
-
-  tags = {
-    Name = %[1]q
-  }
-}
-
+	return acctest.ConfigCompose(testAccNATGatewayConfig_base(rName), fmt.Sprintf(`
 resource "aws_nat_gateway" "test" {
-  subnet_id     = aws_subnet.test.id
+  subnet_id     = aws_subnet.public.id
   allocation_id = aws_eip.test.id
 
   tags = {
-    Name     = %[1]q
-    OtherTag = "some-value"
+    Name = %[1]q
   }
 
   depends_on = [aws_internet_gateway.test]
diff --git a/internal/service/ec2/vpc_nat_gateway_test.go b/internal/service/ec2/vpc_nat_gateway_test.go
index 4482d0bd4d6..ba0deb85d09 100644
--- a/internal/service/ec2/vpc_nat_gateway_test.go
+++ b/internal/service/ec2/vpc_nat_gateway_test.go
@@ -1,8 +1,12 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
 	"context"
 	"fmt"
+	"strconv"
 	"testing"
 
 	"github.com/aws/aws-sdk-go/service/ec2"
@@ -37,6 +41,9 @@ func TestAccVPCNATGateway_basic(t *testing.T) {
 					resource.TestCheckResourceAttrSet(resourceName, "network_interface_id"),
 					resource.TestCheckResourceAttrSet(resourceName, "private_ip"),
 					resource.TestCheckResourceAttrSet(resourceName, "public_ip"),
+					resource.TestCheckResourceAttr(resourceName, "secondary_allocation_ids.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "secondary_private_ip_address_count", "0"),
+					resource.TestCheckResourceAttr(resourceName, "secondary_private_ip_addresses.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "tags.#", "0"),
 				),
 			},
@@ -95,8 +102,9 @@ func TestAccVPCNATGateway_ConnectivityType_private(t *testing.T) {
 					resource.TestCheckResourceAttrSet(resourceName, "network_interface_id"),
 					resource.TestCheckResourceAttrSet(resourceName, "private_ip"),
 					resource.TestCheckResourceAttr(resourceName, "public_ip", ""),
-					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
-					resource.TestCheckResourceAttr(resourceName, "tags.Name", rName),
+					resource.TestCheckResourceAttr(resourceName, "secondary_allocation_ids.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "secondary_private_ip_address_count", "0"),
+					resource.TestCheckResourceAttr(resourceName, "secondary_private_ip_addresses.#", "0"),
 				),
 			},
 			{
@@ -130,6 +138,9 @@ func TestAccVPCNATGateway_privateIP(t *testing.T) {
 					resource.TestCheckResourceAttrSet(resourceName, "network_interface_id"),
 					resource.TestCheckResourceAttr(resourceName, "private_ip", "10.0.0.8"),
 					resource.TestCheckResourceAttr(resourceName, "public_ip", ""),
+					resource.TestCheckResourceAttr(resourceName, "secondary_allocation_ids.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "secondary_private_ip_address_count", "0"),
+					resource.TestCheckResourceAttr(resourceName, "secondary_private_ip_addresses.#", "0"),
 				),
 			},
 			{
@@ -187,6 +198,206 @@ func TestAccVPCNATGateway_tags(t *testing.T) {
 	})
 }
 
+func TestAccVPCNATGateway_secondaryAllocationIDs(t *testing.T) {
+	ctx := acctest.Context(t)
+	var natGateway ec2.NatGateway
+	resourceName := "aws_nat_gateway.test"
+	eipResourceName := "aws_eip.secondary"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, ec2.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckNATGatewayDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccVPCNATGatewayConfig_secondaryAllocationIDs(rName, true),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckNATGatewayExists(ctx, resourceName, &natGateway),
+					resource.TestCheckResourceAttr(resourceName, "secondary_allocation_ids.#", "1"),
+					resource.TestCheckTypeSetElemAttrPair(resourceName, "secondary_allocation_ids.*", eipResourceName, "id"),
+					resource.TestCheckResourceAttr(resourceName, "secondary_private_ip_address_count", "1"),
+					resource.TestCheckResourceAttr(resourceName, "secondary_private_ip_addresses.#", "1"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				Config: testAccVPCNATGatewayConfig_secondaryAllocationIDs(rName, false),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckNATGatewayExists(ctx, resourceName, &natGateway),
+					resource.TestCheckResourceAttr(resourceName, "secondary_allocation_ids.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "secondary_private_ip_address_count", "0"),
+					resource.TestCheckResourceAttr(resourceName, "secondary_private_ip_addresses.#", "0"),
+				),
+			},
+			{
+				Config: testAccVPCNATGatewayConfig_secondaryAllocationIDs(rName, true),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckNATGatewayExists(ctx, resourceName, &natGateway),
+					resource.TestCheckResourceAttr(resourceName, "secondary_allocation_ids.#", "1"),
+					resource.TestCheckTypeSetElemAttrPair(resourceName, "secondary_allocation_ids.*", eipResourceName, "id"),
+					resource.TestCheckResourceAttr(resourceName, "secondary_private_ip_address_count", "1"),
+					resource.TestCheckResourceAttr(resourceName, "secondary_private_ip_addresses.#", "1"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccVPCNATGateway_secondaryPrivateIPAddressCount(t *testing.T) {
+	ctx := acctest.Context(t)
+	var natGateway ec2.NatGateway
+	resourceName := "aws_nat_gateway.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+
+	secondaryPrivateIpAddressCount := 3
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, ec2.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckNATGatewayDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccVPCNATGatewayConfig_secondaryPrivateIPAddressCount(rName, secondaryPrivateIpAddressCount),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckNATGatewayExists(ctx, resourceName, &natGateway),
+					resource.TestCheckResourceAttr(resourceName, "secondary_allocation_ids.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "secondary_private_ip_address_count", strconv.Itoa(secondaryPrivateIpAddressCount)),
+					resource.TestCheckResourceAttr(resourceName, "secondary_private_ip_addresses.#", strconv.Itoa(secondaryPrivateIpAddressCount)),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
+func TestAccVPCNATGateway_secondaryPrivateIPAddresses(t *testing.T) {
+	ctx := acctest.Context(t)
+	var natGateway ec2.NatGateway
+	resourceName := "aws_nat_gateway.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	eipResourceName := "aws_eip.secondary"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, ec2.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckNATGatewayDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccVPCNATGatewayConfig_secondaryPrivateIPAddresses(rName, true),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckNATGatewayExists(ctx, resourceName, &natGateway),
+					resource.TestCheckResourceAttr(resourceName, "secondary_allocation_ids.#", "1"),
+					resource.TestCheckTypeSetElemAttrPair(resourceName, "secondary_allocation_ids.*", eipResourceName, "id"),
+					resource.TestCheckResourceAttr(resourceName, "secondary_private_ip_address_count", "1"),
+					resource.TestCheckResourceAttr(resourceName, "secondary_private_ip_addresses.#", "1"),
+					resource.TestCheckTypeSetElemAttr(resourceName, "secondary_private_ip_addresses.*", "10.0.1.5"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				Config: testAccVPCNATGatewayConfig_secondaryPrivateIPAddresses(rName, false),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckNATGatewayExists(ctx, resourceName, &natGateway),
+					resource.TestCheckResourceAttr(resourceName, "secondary_allocation_ids.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "secondary_private_ip_address_count", "0"),
+					resource.TestCheckResourceAttr(resourceName, "secondary_private_ip_addresses.#", "0"),
+				),
+			},
+			{
+				Config: testAccVPCNATGatewayConfig_secondaryPrivateIPAddresses(rName, true),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckNATGatewayExists(ctx, resourceName, &natGateway),
+					resource.TestCheckResourceAttr(resourceName, "secondary_allocation_ids.#", "1"),
+					resource.TestCheckTypeSetElemAttrPair(resourceName, "secondary_allocation_ids.*", eipResourceName, "id"),
+					resource.TestCheckResourceAttr(resourceName, "secondary_private_ip_address_count", "1"),
+					resource.TestCheckResourceAttr(resourceName, "secondary_private_ip_addresses.#", "1"),
+					resource.TestCheckTypeSetElemAttr(resourceName, "secondary_private_ip_addresses.*", "10.0.1.5"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccVPCNATGateway_SecondaryPrivateIPAddresses_private(t *testing.T) {
+	ctx := acctest.Context(t)
+	var natGateway ec2.NatGateway
+	resourceName := "aws_nat_gateway.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, ec2.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckNATGatewayDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccVPCNATGatewayConfig_secondaryPrivateIPAddresses_private(rName, 5),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckNATGatewayExists(ctx, resourceName, &natGateway),
+					resource.TestCheckResourceAttr(resourceName, "secondary_allocation_ids.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "secondary_private_ip_address_count", "5"),
+					resource.TestCheckResourceAttr(resourceName, "secondary_private_ip_addresses.#", "5"),
+					resource.TestCheckTypeSetElemAttr(resourceName, "secondary_private_ip_addresses.*", "10.0.1.5"),
+					resource.TestCheckTypeSetElemAttr(resourceName, "secondary_private_ip_addresses.*", "10.0.1.6"),
+					resource.TestCheckTypeSetElemAttr(resourceName, "secondary_private_ip_addresses.*", "10.0.1.7"),
+					resource.TestCheckTypeSetElemAttr(resourceName, "secondary_private_ip_addresses.*", "10.0.1.8"),
+					resource.TestCheckTypeSetElemAttr(resourceName, "secondary_private_ip_addresses.*", "10.0.1.9"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				Config: testAccVPCNATGatewayConfig_secondaryPrivateIPAddresses_private(rName, 7),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckNATGatewayExists(ctx, resourceName, &natGateway),
+					resource.TestCheckResourceAttr(resourceName, "secondary_allocation_ids.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "secondary_private_ip_address_count", "7"),
+					resource.TestCheckResourceAttr(resourceName, "secondary_private_ip_addresses.#", "7"),
+					resource.TestCheckTypeSetElemAttr(resourceName, "secondary_private_ip_addresses.*", "10.0.1.5"),
+					resource.TestCheckTypeSetElemAttr(resourceName, "secondary_private_ip_addresses.*", "10.0.1.6"),
+					resource.TestCheckTypeSetElemAttr(resourceName, "secondary_private_ip_addresses.*", "10.0.1.7"),
+					resource.TestCheckTypeSetElemAttr(resourceName, "secondary_private_ip_addresses.*", "10.0.1.8"),
+					resource.TestCheckTypeSetElemAttr(resourceName, "secondary_private_ip_addresses.*", "10.0.1.9"),
+					resource.TestCheckTypeSetElemAttr(resourceName, "secondary_private_ip_addresses.*", "10.0.1.10"),
+					resource.TestCheckTypeSetElemAttr(resourceName, "secondary_private_ip_addresses.*", "10.0.1.11"),
+				),
+			},
+			{
+				Config: testAccVPCNATGatewayConfig_secondaryPrivateIPAddresses_private(rName, 4),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckNATGatewayExists(ctx, resourceName, &natGateway),
+					resource.TestCheckResourceAttr(resourceName, "secondary_allocation_ids.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "secondary_private_ip_address_count", "4"),
+					resource.TestCheckResourceAttr(resourceName, "secondary_private_ip_addresses.#", "4"),
+					resource.TestCheckTypeSetElemAttr(resourceName, "secondary_private_ip_addresses.*", "10.0.1.5"),
+					resource.TestCheckTypeSetElemAttr(resourceName, "secondary_private_ip_addresses.*", "10.0.1.6"),
+					resource.TestCheckTypeSetElemAttr(resourceName, "secondary_private_ip_addresses.*", "10.0.1.7"),
+					resource.TestCheckTypeSetElemAttr(resourceName, "secondary_private_ip_addresses.*", "10.0.1.8"),
+				),
+			},
+		},
+	})
+}
+
 func testAccCheckNATGatewayDestroy(ctx context.Context) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		conn := acctest.Provider.Meta().(*conns.AWSClient).EC2Conn(ctx)
@@ -354,3 +565,84 @@ resource "aws_nat_gateway" "test" {
 }
 `, tagKey1, tagValue1, tagKey2, tagValue2))
 }
+
+func testAccVPCNATGatewayConfig_secondaryAllocationIDs(rName string, hasSecondary bool) string {
+	return acctest.ConfigCompose(testAccNATGatewayConfig_base(rName), fmt.Sprintf(`
+resource "aws_eip" "secondary" {
+  domain = "vpc"
+
+  tags = {
+    Name = %[1]q
+  }
+}
+
+resource "aws_nat_gateway" "test" {
+  allocation_id            = aws_eip.test.id
+  subnet_id                = aws_subnet.public.id
+  secondary_allocation_ids = %[2]t ? [aws_eip.secondary.id] : null
+
+  tags = {
+    Name = %[1]q
+  }
+
+  depends_on = [aws_internet_gateway.test]
+}
+`, rName, hasSecondary))
+}
+
+func testAccVPCNATGatewayConfig_secondaryPrivateIPAddressCount(rName string, secondaryPrivateIpAddressCount int) string {
+	return acctest.ConfigCompose(testAccNATGatewayConfig_base(rName), fmt.Sprintf(`
+resource "aws_nat_gateway" "test" {
+  connectivity_type                  = "private"
+  subnet_id                          = aws_subnet.public.id
+  secondary_private_ip_address_count = %[2]d
+
+  tags = {
+    Name = %[1]q
+  }
+
+  depends_on = [aws_internet_gateway.test]
+}
+`, rName, secondaryPrivateIpAddressCount))
+}
+
+func testAccVPCNATGatewayConfig_secondaryPrivateIPAddresses(rName string, hasSecondary bool) string {
+	return acctest.ConfigCompose(testAccNATGatewayConfig_base(rName), fmt.Sprintf(`
+resource "aws_eip" "secondary" {
+  domain = "vpc"
+
+  tags = {
+    Name = %[1]q
+  }
+}
+
+resource "aws_nat_gateway" "test" {
+  allocation_id                  = aws_eip.test.id
+  subnet_id                      = aws_subnet.private.id
+  secondary_allocation_ids       = %[2]t ? [aws_eip.secondary.id] : null
+  secondary_private_ip_addresses = %[2]t ? ["10.0.1.5"] : null
+
+  tags = {
+    Name = %[1]q
+  }
+
+  depends_on = [aws_internet_gateway.test]
+}
+`, rName, hasSecondary))
+}
+
+func testAccVPCNATGatewayConfig_secondaryPrivateIPAddresses_private(rName string, n int) string {
+	return acctest.ConfigCompose(testAccNATGatewayConfig_base(rName), fmt.Sprintf(`
+resource "aws_nat_gateway" "test" {
+  connectivity_type              = "private"
+  subnet_id                      = aws_subnet.private.id
+  secondary_private_ip_addresses = [for n in range(%[2]d) : "10.0.1.${5 + n}"]
+
+  tags = {
+    Name = %[1]q
+  }
+
+  depends_on = [aws_internet_gateway.test]
+}
+`, rName, n))
+}
diff --git a/internal/service/ec2/vpc_nat_gateways_data_source.go b/internal/service/ec2/vpc_nat_gateways_data_source.go
index f2760917df3..8969ec3bb48 100644
--- a/internal/service/ec2/vpc_nat_gateways_data_source.go
+++ b/internal/service/ec2/vpc_nat_gateways_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -22,7 +25,7 @@ func DataSourceNATGateways() *schema.Resource {
 		},
 
 		Schema: map[string]*schema.Schema{
-			"filter": DataSourceFiltersSchema(),
+			"filter": CustomFiltersSchema(),
 			"ids": {
 				Type:     schema.TypeList,
 				Computed: true,
@@ -56,7 +59,7 @@ func dataSourceNATGatewaysRead(ctx context.Context, d *schema.ResourceData, meta
 		)...)
 	}
 
-	input.Filter = append(input.Filter, BuildFiltersDataSource(
+	input.Filter = append(input.Filter, BuildCustomFilterList(
 		d.Get("filter").(*schema.Set),
 	)...)
 
diff --git a/internal/service/ec2/vpc_nat_gateways_data_source_test.go b/internal/service/ec2/vpc_nat_gateways_data_source_test.go
index 288ae44c596..cbdc1688767 100644
--- a/internal/service/ec2/vpc_nat_gateways_data_source_test.go
+++ b/internal/service/ec2/vpc_nat_gateways_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/vpc_network_acl.go b/internal/service/ec2/vpc_network_acl.go
index 83c37cf3d24..537dfcd4362 100644
--- a/internal/service/ec2/vpc_network_acl.go
+++ b/internal/service/ec2/vpc_network_acl.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -182,7 +185,7 @@ func resourceNetworkACLRead(ctx context.Context, d *schema.ResourceData, meta in
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).EC2Conn(ctx)
 
-	outputRaw, err := tfresource.RetryWhenNewResourceNotFound(ctx, propagationTimeout, func() (interface{}, error) {
+	outputRaw, err := tfresource.RetryWhenNewResourceNotFound(ctx, ec2PropagationTimeout, func() (interface{}, error) {
 		return FindNetworkACLByID(ctx, conn, d.Id())
 	}, d.IsNewResource())
 
@@ -281,7 +284,7 @@ func resourceNetworkACLDelete(ctx context.Context, d *schema.ResourceData, meta
 	}
 
 	log.Printf("[INFO] Deleting EC2 Network ACL: %s", d.Id())
-	_, err = tfresource.RetryWhenAWSErrCodeEquals(ctx, propagationTimeout, func() (interface{}, error) {
+	_, err = tfresource.RetryWhenAWSErrCodeEquals(ctx, ec2PropagationTimeout, func() (interface{}, error) {
 		return conn.DeleteNetworkAclWithContext(ctx, input)
 	}, errCodeDependencyViolation)
 
diff --git a/internal/service/ec2/vpc_network_acl_association.go b/internal/service/ec2/vpc_network_acl_association.go
index e199078d91d..cad52b58b9e 100644
--- a/internal/service/ec2/vpc_network_acl_association.go
+++ b/internal/service/ec2/vpc_network_acl_association.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -59,7 +62,7 @@ func resourceNetworkACLAssociationRead(ctx context.Context, d *schema.ResourceDa
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).EC2Conn(ctx)
 
-	outputRaw, err := tfresource.RetryWhenNewResourceNotFound(ctx, propagationTimeout, func() (interface{}, error) {
+	outputRaw, err := tfresource.RetryWhenNewResourceNotFound(ctx, ec2PropagationTimeout, func() (interface{}, error) {
 		return FindNetworkACLAssociationByID(ctx, conn, d.Id())
 	}, d.IsNewResource())
 
@@ -126,7 +129,7 @@ func networkACLAssociationCreate(ctx context.Context, conn *ec2.EC2, naclID, sub
 	}
 
 	log.Printf("[DEBUG] Creating EC2 Network ACL Association: %s", input)
-	outputRaw, err := tfresource.RetryWhenAWSErrCodeEquals(ctx, propagationTimeout, func() (interface{}, error) {
+	outputRaw, err := tfresource.RetryWhenAWSErrCodeEquals(ctx, ec2PropagationTimeout, func() (interface{}, error) {
 		return conn.ReplaceNetworkAclAssociationWithContext(ctx, input)
 	}, errCodeInvalidAssociationIDNotFound)
 
diff --git a/internal/service/ec2/vpc_network_acl_association_test.go b/internal/service/ec2/vpc_network_acl_association_test.go
index 4ebe5153382..11445050d01 100644
--- a/internal/service/ec2/vpc_network_acl_association_test.go
+++ b/internal/service/ec2/vpc_network_acl_association_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/vpc_network_acl_rule.go b/internal/service/ec2/vpc_network_acl_rule.go
index 37d67d242c7..a347754edba 100644
--- a/internal/service/ec2/vpc_network_acl_rule.go
+++ b/internal/service/ec2/vpc_network_acl_rule.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -181,7 +184,7 @@ func resourceNetworkACLRuleRead(ctx context.Context, d *schema.ResourceData, met
 	naclID := d.Get("network_acl_id").(string)
 	ruleNumber := d.Get("rule_number").(int)
 
-	outputRaw, err := tfresource.RetryWhenNewResourceNotFound(ctx, propagationTimeout, func() (interface{}, error) {
+	outputRaw, err := tfresource.RetryWhenNewResourceNotFound(ctx, ec2PropagationTimeout, func() (interface{}, error) {
 		return FindNetworkACLEntryByThreePartKey(ctx, conn, naclID, egress, ruleNumber)
 	}, d.IsNewResource())
 
diff --git a/internal/service/ec2/vpc_network_acl_rule_test.go b/internal/service/ec2/vpc_network_acl_rule_test.go
index 3f4f7afcfe5..12c048a65b5 100644
--- a/internal/service/ec2/vpc_network_acl_rule_test.go
+++ b/internal/service/ec2/vpc_network_acl_rule_test.go
@@ -1,13 +1,16 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"strconv"
 	"strings"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -255,7 +258,7 @@ func TestAccVPCNetworkACLRule_ipv6VPCAssignGeneratedIPv6CIDRBlockUpdate(t *testi
 					acctest.CheckVPCExists(ctx, vpcResourceName, &v),
 					testAccCheckNetworkACLRuleExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(vpcResourceName, "assign_generated_ipv6_cidr_block", "true"),
-					resource.TestMatchResourceAttr(vpcResourceName, "ipv6_cidr_block", regexp.MustCompile(`/56$`)),
+					resource.TestMatchResourceAttr(vpcResourceName, "ipv6_cidr_block", regexache.MustCompile(`/56$`)),
 				),
 			},
 			{
diff --git a/internal/service/ec2/vpc_network_acl_test.go b/internal/service/ec2/vpc_network_acl_test.go
index cbf9d73c4a4..bc24d16972d 100644
--- a/internal/service/ec2/vpc_network_acl_test.go
+++ b/internal/service/ec2/vpc_network_acl_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -33,7 +36,7 @@ func TestAccVPCNetworkACL_basic(t *testing.T) {
 				Config: testAccVPCNetworkACLConfig_basic(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckNetworkACLExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexp.MustCompile(`network-acl/acl-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`network-acl/acl-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "egress.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "ingress.#", "0"),
 					acctest.CheckResourceAttrAccountID(resourceName, "owner_id"),
diff --git a/internal/service/ec2/vpc_network_acls_data_source.go b/internal/service/ec2/vpc_network_acls_data_source.go
index dc72721bb59..3e923834e0c 100644
--- a/internal/service/ec2/vpc_network_acls_data_source.go
+++ b/internal/service/ec2/vpc_network_acls_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -23,7 +26,7 @@ func DataSourceNetworkACLs() *schema.Resource {
 		},
 
 		Schema: map[string]*schema.Schema{
-			"filter": DataSourceFiltersSchema(),
+			"filter": CustomFiltersSchema(),
 			"ids": {
 				Type:     schema.TypeList,
 				Computed: true,
@@ -56,7 +59,7 @@ func dataSourceNetworkACLsRead(ctx context.Context, d *schema.ResourceData, meta
 		Tags(tftags.New(ctx, d.Get("tags").(map[string]interface{}))),
 	)...)
 
-	input.Filters = append(input.Filters, BuildFiltersDataSource(
+	input.Filters = append(input.Filters, BuildCustomFilterList(
 		d.Get("filter").(*schema.Set),
 	)...)
 
diff --git a/internal/service/ec2/vpc_network_acls_data_source_test.go b/internal/service/ec2/vpc_network_acls_data_source_test.go
index 0f2692b6fa9..9a5374f2ced 100644
--- a/internal/service/ec2/vpc_network_acls_data_source_test.go
+++ b/internal/service/ec2/vpc_network_acls_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/vpc_network_insights_analysis.go b/internal/service/ec2/vpc_network_insights_analysis.go
index e518b02a37f..5b974be44f0 100644
--- a/internal/service/ec2/vpc_network_insights_analysis.go
+++ b/internal/service/ec2/vpc_network_insights_analysis.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -2167,7 +2170,7 @@ func flattenTransitGatewayRouteTableRoute(apiObject *ec2.TransitGatewayRouteTabl
 	}
 
 	if v := apiObject.RouteOrigin; v != nil {
-		tfMap["route_orign"] = aws.StringValue(v)
+		tfMap["route_origin"] = aws.StringValue(v)
 	}
 
 	if v := apiObject.State; v != nil {
diff --git a/internal/service/ec2/vpc_network_insights_analysis_data_source.go b/internal/service/ec2/vpc_network_insights_analysis_data_source.go
index e10b643a6d8..5e36d838752 100644
--- a/internal/service/ec2/vpc_network_insights_analysis_data_source.go
+++ b/internal/service/ec2/vpc_network_insights_analysis_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/vpc_network_insights_analysis_data_source_test.go b/internal/service/ec2/vpc_network_insights_analysis_data_source_test.go
index 16146ca8761..0325a2b624b 100644
--- a/internal/service/ec2/vpc_network_insights_analysis_data_source_test.go
+++ b/internal/service/ec2/vpc_network_insights_analysis_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/vpc_network_insights_analysis_test.go b/internal/service/ec2/vpc_network_insights_analysis_test.go
index 565bf6cc64e..ea3af861df7 100644
--- a/internal/service/ec2/vpc_network_insights_analysis_test.go
+++ b/internal/service/ec2/vpc_network_insights_analysis_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -31,7 +34,7 @@ func TestAccVPCNetworkInsightsAnalysis_basic(t *testing.T) {
 				Config: testAccVPCNetworkInsightsAnalysisConfig_basic(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckNetworkInsightsAnalysisExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexp.MustCompile(`network-insights-analysis/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`network-insights-analysis/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "filter_in_arns.#", "0"),
 					resource.TestCheckResourceAttrPair(resourceName, "network_insights_path_id", "aws_ec2_network_insights_path.test", "id"),
 					resource.TestCheckResourceAttr(resourceName, "path_found", "true"),
@@ -135,7 +138,7 @@ func TestAccVPCNetworkInsightsAnalysis_filterInARNs(t *testing.T) {
 				Config: testAccVPCNetworkInsightsAnalysisConfig_filterInARNs(rName, "vpc-peering-connection/pcx-fakearn1"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckNetworkInsightsAnalysisExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "filter_in_arns.0", "ec2", regexp.MustCompile(`vpc-peering-connection/pcx-fakearn1$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "filter_in_arns.0", "ec2", regexache.MustCompile(`vpc-peering-connection/pcx-fakearn1$`)),
 				),
 			},
 			{
@@ -148,7 +151,7 @@ func TestAccVPCNetworkInsightsAnalysis_filterInARNs(t *testing.T) {
 				Config: testAccVPCNetworkInsightsAnalysisConfig_filterInARNs(rName, "vpc-peering-connection/pcx-fakearn2"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckNetworkInsightsAnalysisExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "filter_in_arns.0", "ec2", regexp.MustCompile(`vpc-peering-connection/pcx-fakearn2$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "filter_in_arns.0", "ec2", regexache.MustCompile(`vpc-peering-connection/pcx-fakearn2$`)),
 				),
 			},
 		},
@@ -174,12 +177,6 @@ func TestAccVPCNetworkInsightsAnalysis_waitForCompletion(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "status", "running"),
 				),
 			},
-			{
-				ResourceName:            resourceName,
-				ImportState:             true,
-				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"wait_for_completion"},
-			},
 			{
 				Config: testAccVPCNetworkInsightsAnalysisConfig_waitForCompletion(rName, true),
 				Check: resource.ComposeTestCheckFunc(
diff --git a/internal/service/ec2/vpc_network_insights_path.go b/internal/service/ec2/vpc_network_insights_path.go
index 8fe13a93a21..ede94387b65 100644
--- a/internal/service/ec2/vpc_network_insights_path.go
+++ b/internal/service/ec2/vpc_network_insights_path.go
@@ -1,8 +1,12 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
 	"context"
 	"log"
+	"strings"
 
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ec2"
@@ -35,10 +39,15 @@ func ResourceNetworkInsightsPath() *schema.Resource {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
-			"destination": {
+			"destination_arn": {
 				Type:     schema.TypeString,
-				Required: true,
-				ForceNew: true,
+				Computed: true,
+			},
+			"destination": {
+				Type:             schema.TypeString,
+				Required:         true,
+				ForceNew:         true,
+				DiffSuppressFunc: suppressEquivalentIDOrARN,
 			},
 			"destination_ip": {
 				Type:     schema.TypeString,
@@ -57,9 +66,14 @@ func ResourceNetworkInsightsPath() *schema.Resource {
 				ValidateFunc: validation.StringInSlice(ec2.Protocol_Values(), false),
 			},
 			"source": {
+				Type:             schema.TypeString,
+				Required:         true,
+				ForceNew:         true,
+				DiffSuppressFunc: suppressEquivalentIDOrARN,
+			},
+			"source_arn": {
 				Type:     schema.TypeString,
-				Required: true,
-				ForceNew: true,
+				Computed: true,
 			},
 			"source_ip": {
 				Type:     schema.TypeString,
@@ -96,7 +110,6 @@ func resourceNetworkInsightsPathCreate(ctx context.Context, d *schema.ResourceDa
 		input.SourceIp = aws.String(v.(string))
 	}
 
-	log.Printf("[DEBUG] Creating EC2 Network Insights Path: %s", input)
 	output, err := conn.CreateNetworkInsightsPathWithContext(ctx, input)
 
 	if err != nil {
@@ -125,10 +138,12 @@ func resourceNetworkInsightsPathRead(ctx context.Context, d *schema.ResourceData
 
 	d.Set("arn", nip.NetworkInsightsPathArn)
 	d.Set("destination", nip.Destination)
+	d.Set("destination_arn", nip.DestinationArn)
 	d.Set("destination_ip", nip.DestinationIp)
 	d.Set("destination_port", nip.DestinationPort)
 	d.Set("protocol", nip.Protocol)
 	d.Set("source", nip.Source)
+	d.Set("source_arn", nip.SourceArn)
 	d.Set("source_ip", nip.SourceIp)
 
 	setTagsOut(ctx, nip.Tags)
@@ -145,9 +160,11 @@ func resourceNetworkInsightsPathDelete(ctx context.Context, d *schema.ResourceDa
 	conn := meta.(*conns.AWSClient).EC2Conn(ctx)
 
 	log.Printf("[DEBUG] Deleting EC2 Network Insights Path: %s", d.Id())
-	_, err := conn.DeleteNetworkInsightsPathWithContext(ctx, &ec2.DeleteNetworkInsightsPathInput{
-		NetworkInsightsPathId: aws.String(d.Id()),
-	})
+	_, err := tfresource.RetryWhenAWSErrCodeEquals(ctx, ec2PropagationTimeout, func() (interface{}, error) {
+		return conn.DeleteNetworkInsightsPathWithContext(ctx, &ec2.DeleteNetworkInsightsPathInput{
+			NetworkInsightsPathId: aws.String(d.Id()),
+		})
+	}, errCodeAnalysisExistsForNetworkInsightsPath)
 
 	if tfawserr.ErrCodeEquals(err, errCodeInvalidNetworkInsightsPathIdNotFound) {
 		return nil
@@ -159,3 +176,16 @@ func resourceNetworkInsightsPathDelete(ctx context.Context, d *schema.ResourceDa
 
 	return nil
 }
+
+// idFromIDOrARN return a resource ID from an ID or ARN.
+func idFromIDOrARN(idOrARN string) string {
+	// e.g. "eni-02ae120b80627a68f" or
+	// "arn:aws:ec2:ap-southeast-2:123456789012:network-interface/eni-02ae120b80627a68f".
+	return idOrARN[strings.LastIndex(idOrARN, "/")+1:]
+}
+
+// suppressEquivalentIDOrARN provides custom difference suppression
+// for strings that represent equal resource IDs or ARNs.
+func suppressEquivalentIDOrARN(_, old, new string, _ *schema.ResourceData) bool {
+	return idFromIDOrARN(old) == idFromIDOrARN(new)
+}
diff --git a/internal/service/ec2/vpc_network_insights_path_data_source.go b/internal/service/ec2/vpc_network_insights_path_data_source.go
index 20bb87da794..de44586d8bd 100644
--- a/internal/service/ec2/vpc_network_insights_path_data_source.go
+++ b/internal/service/ec2/vpc_network_insights_path_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -26,6 +29,10 @@ func DataSourceNetworkInsightsPath() *schema.Resource {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
+			"destination_arn": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
 			"destination_ip": {
 				Type:     schema.TypeString,
 				Computed: true,
@@ -48,6 +55,10 @@ func DataSourceNetworkInsightsPath() *schema.Resource {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
+			"source_arn": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
 			"source_ip": {
 				Type:     schema.TypeString,
 				Computed: true,
@@ -86,11 +97,13 @@ func dataSourceNetworkInsightsPathRead(ctx context.Context, d *schema.ResourceDa
 	d.SetId(networkInsightsPathID)
 	d.Set("arn", nip.NetworkInsightsPathArn)
 	d.Set("destination", nip.Destination)
+	d.Set("destination_arn", nip.DestinationArn)
 	d.Set("destination_ip", nip.DestinationIp)
 	d.Set("destination_port", nip.DestinationPort)
 	d.Set("network_insights_path_id", networkInsightsPathID)
 	d.Set("protocol", nip.Protocol)
 	d.Set("source", nip.Source)
+	d.Set("source_arn", nip.SourceArn)
 	d.Set("source_ip", nip.SourceIp)
 
 	if err := d.Set("tags", KeyValueTags(ctx, nip.Tags).IgnoreAWS().IgnoreConfig(ignoreTagsConfig).Map()); err != nil {
diff --git a/internal/service/ec2/vpc_network_insights_path_data_source_test.go b/internal/service/ec2/vpc_network_insights_path_data_source_test.go
index baa9895b7d3..b6cf943cc69 100644
--- a/internal/service/ec2/vpc_network_insights_path_data_source_test.go
+++ b/internal/service/ec2/vpc_network_insights_path_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
@@ -26,11 +29,13 @@ func TestAccVPCNetworkInsightsPathDataSource_basic(t *testing.T) {
 				Check: resource.ComposeAggregateTestCheckFunc(
 					resource.TestCheckResourceAttrPair(datasourceName, "arn", resourceName, "arn"),
 					resource.TestCheckResourceAttrPair(datasourceName, "destination", resourceName, "destination"),
+					resource.TestCheckResourceAttrPair(datasourceName, "destination_arn", resourceName, "destination_arn"),
 					resource.TestCheckResourceAttrPair(datasourceName, "destination_ip", resourceName, "destination_ip"),
 					resource.TestCheckResourceAttrPair(datasourceName, "destination_port", resourceName, "destination_port"),
 					resource.TestCheckResourceAttrPair(datasourceName, "network_insights_path_id", resourceName, "id"),
 					resource.TestCheckResourceAttrPair(datasourceName, "protocol", resourceName, "protocol"),
 					resource.TestCheckResourceAttrPair(datasourceName, "source", resourceName, "source"),
+					resource.TestCheckResourceAttrPair(datasourceName, "source_arn", resourceName, "source_arn"),
 					resource.TestCheckResourceAttrPair(datasourceName, "source_ip", resourceName, "source_ip"),
 					resource.TestCheckResourceAttrPair(datasourceName, "tags.%", resourceName, "tags.%"),
 				),
diff --git a/internal/service/ec2/vpc_network_insights_path_test.go b/internal/service/ec2/vpc_network_insights_path_test.go
index cea051505d4..4effba77d57 100644
--- a/internal/service/ec2/vpc_network_insights_path_test.go
+++ b/internal/service/ec2/vpc_network_insights_path_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -31,12 +34,14 @@ func TestAccVPCNetworkInsightsPath_basic(t *testing.T) {
 				Config: testAccVPCNetworkInsightsPathConfig_basic(rName, "tcp"),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckNetworkInsightsPathExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexp.MustCompile(`network-insights-path/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`network-insights-path/.+$`)),
 					resource.TestCheckResourceAttrPair(resourceName, "destination", "aws_network_interface.test.1", "id"),
+					resource.TestCheckResourceAttrPair(resourceName, "destination_arn", "aws_network_interface.test.1", "arn"),
 					resource.TestCheckResourceAttr(resourceName, "destination_ip", ""),
 					resource.TestCheckResourceAttr(resourceName, "destination_port", "0"),
 					resource.TestCheckResourceAttr(resourceName, "protocol", "tcp"),
 					resource.TestCheckResourceAttrPair(resourceName, "source", "aws_network_interface.test.0", "id"),
+					resource.TestCheckResourceAttrPair(resourceName, "source_arn", "aws_network_interface.test.0", "arn"),
 					resource.TestCheckResourceAttr(resourceName, "source_ip", ""),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 				),
@@ -118,6 +123,36 @@ func TestAccVPCNetworkInsightsPath_tags(t *testing.T) {
 	})
 }
 
+func TestAccVPCNetworkInsightsPath_sourceAndDestinationARN(t *testing.T) {
+	ctx := acctest.Context(t)
+	resourceName := "aws_ec2_network_insights_path.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, ec2.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckNetworkInsightsPathDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccVPCNetworkInsightsPathConfig_sourceAndDestinationARN(rName, "tcp"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckNetworkInsightsPathExists(ctx, resourceName),
+					resource.TestCheckResourceAttrPair(resourceName, "destination", "aws_network_interface.test.1", "id"),
+					resource.TestCheckResourceAttrPair(resourceName, "destination_arn", "aws_network_interface.test.1", "arn"),
+					resource.TestCheckResourceAttrPair(resourceName, "source", "aws_network_interface.test.0", "id"),
+					resource.TestCheckResourceAttrPair(resourceName, "source_arn", "aws_network_interface.test.0", "arn"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
 func TestAccVPCNetworkInsightsPath_sourceIP(t *testing.T) {
 	ctx := acctest.Context(t)
 	resourceName := "aws_ec2_network_insights_path.test"
@@ -334,6 +369,26 @@ resource "aws_ec2_network_insights_path" "test" {
 `, rName, tagKey1, tagValue1, tagKey2, tagValue2))
 }
 
+func testAccVPCNetworkInsightsPathConfig_sourceAndDestinationARN(rName, protocol string) string {
+	return acctest.ConfigCompose(acctest.ConfigVPCWithSubnets(rName, 1), fmt.Sprintf(`
+resource "aws_network_interface" "test" {
+  count = 2
+
+  subnet_id = aws_subnet.test[0].id
+
+  tags = {
+    Name = %[1]q
+  }
+}
+
+resource "aws_ec2_network_insights_path" "test" {
+  source      = aws_network_interface.test[0].arn
+  destination = aws_network_interface.test[1].arn
+  protocol    = %[2]q
+}
+`, rName, protocol))
+}
+
 func testAccVPCNetworkInsightsPathConfig_sourceIP(rName, sourceIP string) string {
 	return acctest.ConfigCompose(acctest.ConfigVPCWithSubnets(rName, 1), fmt.Sprintf(`
 resource "aws_internet_gateway" "test" {
diff --git a/internal/service/ec2/vpc_network_interface.go b/internal/service/ec2/vpc_network_interface.go
index 78f2c2c77ee..381bd976799 100644
--- a/internal/service/ec2/vpc_network_interface.go
+++ b/internal/service/ec2/vpc_network_interface.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -486,7 +489,7 @@ func resourceNetworkInterfaceRead(ctx context.Context, d *schema.ResourceData, m
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).EC2Conn(ctx)
 
-	outputRaw, err := tfresource.RetryWhenNewResourceNotFound(ctx, propagationTimeout, func() (interface{}, error) {
+	outputRaw, err := tfresource.RetryWhenNewResourceNotFound(ctx, ec2PropagationTimeout, func() (interface{}, error) {
 		return FindNetworkInterfaceByID(ctx, conn, d.Id())
 	}, d.IsNewResource())
 
@@ -1473,6 +1476,8 @@ func deleteLingeringENIs(ctx context.Context, conn *ec2.EC2, filterName, resourc
 
 	err = multierror.Append(err, deleteLingeringComprehendENIs(ctx, &g, conn, filterName, resourceId, timeout))
 
+	err = multierror.Append(err, deleteLingeringDMSENIs(ctx, &g, conn, filterName, resourceId, timeout))
+
 	return multierror.Append(err, g.Wait()).ErrorOrNil()
 }
 
@@ -1581,6 +1586,54 @@ func deleteLingeringComprehendENIs(ctx context.Context, g *multierror.Group, con
 	return nil
 }
 
+func deleteLingeringDMSENIs(ctx context.Context, g *multierror.Group, conn *ec2.EC2, filterName, resourceId string, timeout time.Duration) error {
+	// Deletion appears to take approximately 5 minutes
+	if minimumTimeout := 10 * time.Minute; timeout < minimumTimeout {
+		timeout = minimumTimeout
+	}
+
+	enis, err := FindNetworkInterfaces(ctx, conn, &ec2.DescribeNetworkInterfacesInput{
+		Filters: BuildAttributeFilterList(map[string]string{
+			filterName: resourceId,
+		}),
+	})
+	if err != nil {
+		return fmt.Errorf("listing EC2 Network Interfaces: %w", err)
+	}
+
+	networkInterfaces := make([]*ec2.NetworkInterface, 0, len(enis))
+	for _, v := range enis {
+		if aws.StringValue(v.Description) == "DMSNetworkInterface" {
+			networkInterfaces = append(networkInterfaces, v)
+		}
+	}
+
+	for _, v := range networkInterfaces {
+		v := v
+		g.Go(func() error {
+			networkInterfaceID := aws.StringValue(v.NetworkInterfaceId)
+
+			if v.Attachment != nil {
+				err = DetachNetworkInterface(ctx, conn, networkInterfaceID, aws.StringValue(v.Attachment.AttachmentId), timeout)
+
+				if err != nil {
+					return fmt.Errorf("detaching Comprehend ENI (%s): %w", networkInterfaceID, err)
+				}
+			}
+
+			err := DeleteNetworkInterface(ctx, conn, networkInterfaceID)
+
+			if err != nil {
+				return fmt.Errorf("deleting Comprehend ENI (%s): %w", networkInterfaceID, err)
+			}
+
+			return nil
+		})
+	}
+
+	return nil
+}
+
 // Flattens security group identifiers into a []string, where the elements returned are the GroupIDs
 func FlattenGroupIdentifiers(dtos []*ec2.GroupIdentifier) []string {
 	ids := make([]string, 0, len(dtos))
diff --git a/internal/service/ec2/vpc_network_interface_attachment.go b/internal/service/ec2/vpc_network_interface_attachment.go
index ff9d8d0b88b..faec365b891 100644
--- a/internal/service/ec2/vpc_network_interface_attachment.go
+++ b/internal/service/ec2/vpc_network_interface_attachment.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/vpc_network_interface_attachment_test.go b/internal/service/ec2/vpc_network_interface_attachment_test.go
index dc65d681155..f7d501db614 100644
--- a/internal/service/ec2/vpc_network_interface_attachment_test.go
+++ b/internal/service/ec2/vpc_network_interface_attachment_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/vpc_network_interface_data_source.go b/internal/service/ec2/vpc_network_interface_data_source.go
index 11174ccd955..da39c2cd46d 100644
--- a/internal/service/ec2/vpc_network_interface_data_source.go
+++ b/internal/service/ec2/vpc_network_interface_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -97,7 +100,7 @@ func DataSourceNetworkInterface() *schema.Resource {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
-			"filter": DataSourceFiltersSchema(),
+			"filter": CustomFiltersSchema(),
 			"id": {
 				Type:     schema.TypeString,
 				Optional: true,
@@ -167,7 +170,7 @@ func dataSourceNetworkInterfaceRead(ctx context.Context, d *schema.ResourceData,
 	input := &ec2.DescribeNetworkInterfacesInput{}
 
 	if v, ok := d.GetOk("filter"); ok {
-		input.Filters = BuildFiltersDataSource(v.(*schema.Set))
+		input.Filters = BuildCustomFilterList(v.(*schema.Set))
 	}
 
 	if v, ok := d.GetOk("id"); ok {
diff --git a/internal/service/ec2/vpc_network_interface_data_source_test.go b/internal/service/ec2/vpc_network_interface_data_source_test.go
index 09b89c38c53..7eaf401df9e 100644
--- a/internal/service/ec2/vpc_network_interface_data_source_test.go
+++ b/internal/service/ec2/vpc_network_interface_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/vpc_network_interface_sg_attachment.go b/internal/service/ec2/vpc_network_interface_sg_attachment.go
index c276b9a05b6..3e95eec051a 100644
--- a/internal/service/ec2/vpc_network_interface_sg_attachment.go
+++ b/internal/service/ec2/vpc_network_interface_sg_attachment.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -96,7 +99,7 @@ func resourceNetworkInterfaceSGAttachmentRead(ctx context.Context, d *schema.Res
 
 	networkInterfaceID := d.Get("network_interface_id").(string)
 	sgID := d.Get("security_group_id").(string)
-	outputRaw, err := tfresource.RetryWhenNewResourceNotFound(ctx, propagationTimeout, func() (interface{}, error) {
+	outputRaw, err := tfresource.RetryWhenNewResourceNotFound(ctx, ec2PropagationTimeout, func() (interface{}, error) {
 		return FindNetworkInterfaceSecurityGroup(ctx, conn, networkInterfaceID, sgID)
 	}, d.IsNewResource())
 
diff --git a/internal/service/ec2/vpc_network_interface_sg_attachment_test.go b/internal/service/ec2/vpc_network_interface_sg_attachment_test.go
index 05204c1b03d..c5a0fe3a4e3 100644
--- a/internal/service/ec2/vpc_network_interface_sg_attachment_test.go
+++ b/internal/service/ec2/vpc_network_interface_sg_attachment_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/vpc_network_interface_test.go b/internal/service/ec2/vpc_network_interface_test.go
index 3b71c409271..b4025e9b864 100644
--- a/internal/service/ec2/vpc_network_interface_test.go
+++ b/internal/service/ec2/vpc_network_interface_test.go
@@ -1,14 +1,17 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
 	"context"
 	"fmt"
 	"reflect"
-	"regexp"
 	"sort"
 	"strings"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/endpoints"
 	"github.com/aws/aws-sdk-go/service/ec2"
@@ -61,7 +64,7 @@ func TestAccVPCNetworkInterface_basic(t *testing.T) {
 				Config: testAccVPCNetworkInterfaceConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckENIExists(ctx, resourceName, &conf),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexp.MustCompile(`network-interface/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`network-interface/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "attachment.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
 					resource.TestCheckResourceAttr(resourceName, "interface_type", "interface"),
diff --git a/internal/service/ec2/vpc_network_interfaces_data_source.go b/internal/service/ec2/vpc_network_interfaces_data_source.go
index df084affc9f..ec625e06aad 100644
--- a/internal/service/ec2/vpc_network_interfaces_data_source.go
+++ b/internal/service/ec2/vpc_network_interfaces_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -23,7 +26,7 @@ func DataSourceNetworkInterfaces() *schema.Resource {
 		},
 
 		Schema: map[string]*schema.Schema{
-			"filter": DataSourceFiltersSchema(),
+			"filter": CustomFiltersSchema(),
 			"ids": {
 				Type:     schema.TypeList,
 				Computed: true,
@@ -44,7 +47,7 @@ func dataSourceNetworkInterfacesRead(ctx context.Context, d *schema.ResourceData
 		Tags(tftags.New(ctx, d.Get("tags").(map[string]interface{}))),
 	)...)
 
-	input.Filters = append(input.Filters, BuildFiltersDataSource(
+	input.Filters = append(input.Filters, BuildCustomFilterList(
 		d.Get("filter").(*schema.Set),
 	)...)
 
diff --git a/internal/service/ec2/vpc_network_interfaces_data_source_test.go b/internal/service/ec2/vpc_network_interfaces_data_source_test.go
index 733d53434e1..52d6f2f5421 100644
--- a/internal/service/ec2/vpc_network_interfaces_data_source_test.go
+++ b/internal/service/ec2/vpc_network_interfaces_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/vpc_network_performance_metric_subscription.go b/internal/service/ec2/vpc_network_performance_metric_subscription.go
index 4155a26ad5d..cac7c6e82c2 100644
--- a/internal/service/ec2/vpc_network_performance_metric_subscription.go
+++ b/internal/service/ec2/vpc_network_performance_metric_subscription.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/vpc_network_performance_metric_subscription_test.go b/internal/service/ec2/vpc_network_performance_metric_subscription_test.go
index f117a636396..349afc11a1d 100644
--- a/internal/service/ec2/vpc_network_performance_metric_subscription_test.go
+++ b/internal/service/ec2/vpc_network_performance_metric_subscription_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/vpc_peering_connection.go b/internal/service/ec2/vpc_peering_connection.go
index 52ada088f39..3f1e4201467 100644
--- a/internal/service/ec2/vpc_peering_connection.go
+++ b/internal/service/ec2/vpc_peering_connection.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -321,7 +324,7 @@ func modifyVPCPeeringConnectionOptions(ctx context.Context, conn *ec2.EC2, d *sc
 
 	// Retry reading back the modified options to deal with eventual consistency.
 	// Often this is to do with a delay transitioning from pending-acceptance to active.
-	err := retry.RetryContext(ctx, VPCPeeringConnectionOptionsPropagationTimeout, func() *retry.RetryError { // nosemgrep:ci.helper-schema-retry-RetryContext-without-TimeoutError-check
+	err := retry.RetryContext(ctx, ec2PropagationTimeout, func() *retry.RetryError { // nosemgrep:ci.helper-schema-retry-RetryContext-without-TimeoutError-check
 		vpcPeeringConnection, err := FindVPCPeeringConnectionByID(ctx, conn, d.Id())
 
 		if err != nil {
diff --git a/internal/service/ec2/vpc_peering_connection_accepter.go b/internal/service/ec2/vpc_peering_connection_accepter.go
index 65538d248ff..0ebe4d396c0 100644
--- a/internal/service/ec2/vpc_peering_connection_accepter.go
+++ b/internal/service/ec2/vpc_peering_connection_accepter.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/vpc_peering_connection_accepter_test.go b/internal/service/ec2/vpc_peering_connection_accepter_test.go
index 9aecfd1f4d5..bd22870fc74 100644
--- a/internal/service/ec2/vpc_peering_connection_accepter_test.go
+++ b/internal/service/ec2/vpc_peering_connection_accepter_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/vpc_peering_connection_data_source.go b/internal/service/ec2/vpc_peering_connection_data_source.go
index cb3e0cad5ed..a67236c9317 100644
--- a/internal/service/ec2/vpc_peering_connection_data_source.go
+++ b/internal/service/ec2/vpc_peering_connection_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/vpc_peering_connection_data_source_test.go b/internal/service/ec2/vpc_peering_connection_data_source_test.go
index cbf9d7db847..a764503454c 100644
--- a/internal/service/ec2/vpc_peering_connection_data_source_test.go
+++ b/internal/service/ec2/vpc_peering_connection_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/vpc_peering_connection_options.go b/internal/service/ec2/vpc_peering_connection_options.go
index 0e610787e3b..cb02993cecc 100644
--- a/internal/service/ec2/vpc_peering_connection_options.go
+++ b/internal/service/ec2/vpc_peering_connection_options.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/vpc_peering_connection_options_test.go b/internal/service/ec2/vpc_peering_connection_options_test.go
index f121d4621e6..a4634ea1452 100644
--- a/internal/service/ec2/vpc_peering_connection_options_test.go
+++ b/internal/service/ec2/vpc_peering_connection_options_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/vpc_peering_connection_test.go b/internal/service/ec2/vpc_peering_connection_test.go
index 3b4c9557b61..41400400b4a 100644
--- a/internal/service/ec2/vpc_peering_connection_test.go
+++ b/internal/service/ec2/vpc_peering_connection_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
@@ -235,7 +238,7 @@ func TestAccVPCPeeringConnection_failedState(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccVPCPeeringConnectionConfig_failedState(rName),
-				ExpectError: regexp.MustCompile(`unexpected state 'failed'`),
+				ExpectError: regexache.MustCompile(`unexpected state 'failed'`),
 			},
 		},
 	})
@@ -256,7 +259,7 @@ func TestAccVPCPeeringConnection_peerRegionAutoAccept(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccVPCPeeringConnectionConfig_alternateRegionAutoAccept(rName, true),
-				ExpectError: regexp.MustCompile("`peer_region` cannot be set whilst `auto_accept` is `true` when creating an EC2 VPC Peering Connection"),
+				ExpectError: regexache.MustCompile("`peer_region` cannot be set whilst `auto_accept` is `true` when creating an EC2 VPC Peering Connection"),
 			},
 		},
 	})
@@ -372,7 +375,7 @@ func TestAccVPCPeeringConnection_optionsNoAutoAccept(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccVPCPeeringConnectionConfig_accepterRequesterOptionsNoAutoAccept(rName),
-				ExpectError: regexp.MustCompile(`is not active`),
+				ExpectError: regexache.MustCompile(`is not active`),
 			},
 		},
 	})
diff --git a/internal/service/ec2/vpc_peering_connections_data_source.go b/internal/service/ec2/vpc_peering_connections_data_source.go
index cfa0a18bfd6..37b779f873b 100644
--- a/internal/service/ec2/vpc_peering_connections_data_source.go
+++ b/internal/service/ec2/vpc_peering_connections_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -23,7 +26,7 @@ func DataSourceVPCPeeringConnections() *schema.Resource {
 		},
 
 		Schema: map[string]*schema.Schema{
-			"filter": DataSourceFiltersSchema(),
+			"filter": CustomFiltersSchema(),
 			"ids": {
 				Type:     schema.TypeList,
 				Computed: true,
@@ -43,7 +46,7 @@ func dataSourceVPCPeeringConnectionsRead(ctx context.Context, d *schema.Resource
 	input.Filters = append(input.Filters, BuildTagFilterList(
 		Tags(tftags.New(ctx, d.Get("tags").(map[string]interface{}))),
 	)...)
-	input.Filters = append(input.Filters, BuildFiltersDataSource(
+	input.Filters = append(input.Filters, BuildCustomFilterList(
 		d.Get("filter").(*schema.Set),
 	)...)
 	if len(input.Filters) == 0 {
diff --git a/internal/service/ec2/vpc_peering_connections_data_source_test.go b/internal/service/ec2/vpc_peering_connections_data_source_test.go
index fdde68f31f5..e12d1ce2ff2 100644
--- a/internal/service/ec2/vpc_peering_connections_data_source_test.go
+++ b/internal/service/ec2/vpc_peering_connections_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/vpc_prefix_list_data_source.go b/internal/service/ec2/vpc_prefix_list_data_source.go
index d7ba985fb1f..3a9e78809ce 100644
--- a/internal/service/ec2/vpc_prefix_list_data_source.go
+++ b/internal/service/ec2/vpc_prefix_list_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/vpc_prefix_list_data_source_test.go b/internal/service/ec2/vpc_prefix_list_data_source_test.go
index 58ccd72fd98..23e3ec5f63a 100644
--- a/internal/service/ec2/vpc_prefix_list_data_source_test.go
+++ b/internal/service/ec2/vpc_prefix_list_data_source_test.go
@@ -1,9 +1,12 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
@@ -64,7 +67,7 @@ func TestAccVPCPrefixListDataSource_nameDoesNotOverrideFilter(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccVPCPrefixListDataSourceConfig_nameDoesNotOverrideFilter,
-				ExpectError: regexp.MustCompile(`no matching EC2 Prefix List found`),
+				ExpectError: regexache.MustCompile(`no matching EC2 Prefix List found`),
 			},
 		},
 	})
diff --git a/internal/service/ec2/vpc_route.go b/internal/service/ec2/vpc_route.go
index 18312411c52..9ad717ca1f1 100644
--- a/internal/service/ec2/vpc_route.go
+++ b/internal/service/ec2/vpc_route.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -183,13 +186,13 @@ func resourceRouteCreate(ctx context.Context, d *schema.ResourceData, meta inter
 	destinationAttributeKey, destination, err := routeDestinationAttribute(d)
 
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "creating Route: %s", err)
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
 	targetAttributeKey, target, err := routeTargetAttribute(d)
 
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "creating Route: %s", err)
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
 	routeTableID := d.Get("route_table_id").(string)
@@ -271,11 +274,10 @@ func resourceRouteRead(ctx context.Context, d *schema.ResourceData, meta interfa
 	destinationAttributeKey, destination, err := routeDestinationAttribute(d)
 
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "reading Route: %s", err)
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
 	var routeFinder RouteFinder
-
 	switch destinationAttributeKey {
 	case routeDestinationCIDRBlock:
 		routeFinder = FindRouteByIPv4Destination
@@ -288,8 +290,9 @@ func resourceRouteRead(ctx context.Context, d *schema.ResourceData, meta interfa
 	}
 
 	routeTableID := d.Get("route_table_id").(string)
-
-	route, err := routeFinder(ctx, conn, routeTableID, destination)
+	outputRaw, err := tfresource.RetryWhenNewResourceNotFound(ctx, ec2PropagationTimeout, func() (interface{}, error) {
+		return routeFinder(ctx, conn, routeTableID, destination)
+	}, d.IsNewResource())
 
 	if !d.IsNewResource() && tfresource.NotFound(err) {
 		log.Printf("[WARN] Route in Route Table (%s) with destination (%s) not found, removing from state", routeTableID, destination)
@@ -301,6 +304,7 @@ func resourceRouteRead(ctx context.Context, d *schema.ResourceData, meta interfa
 		return sdkdiag.AppendErrorf(diags, "reading Route in Route Table (%s) with destination (%s): %s", routeTableID, destination, err)
 	}
 
+	route := outputRaw.(*ec2.Route)
 	d.Set("carrier_gateway_id", route.CarrierGatewayId)
 	d.Set("core_network_arn", route.CoreNetworkArn)
 	d.Set(routeDestinationCIDRBlock, route.DestinationCidrBlock)
@@ -335,13 +339,13 @@ func resourceRouteUpdate(ctx context.Context, d *schema.ResourceData, meta inter
 	destinationAttributeKey, destination, err := routeDestinationAttribute(d)
 
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "updating Route: %s", err)
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
 	targetAttributeKey, target, err := routeTargetAttribute(d)
 
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "updating Route: %s", err)
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
 	routeTableID := d.Get("route_table_id").(string)
@@ -416,7 +420,7 @@ func resourceRouteDelete(ctx context.Context, d *schema.ResourceData, meta inter
 	destinationAttributeKey, destination, err := routeDestinationAttribute(d)
 
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "deleting Route: %s", err)
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
 	routeTableID := d.Get("route_table_id").(string)
diff --git a/internal/service/ec2/vpc_route_data_source.go b/internal/service/ec2/vpc_route_data_source.go
index f09dc064e2f..500cbf5a598 100644
--- a/internal/service/ec2/vpc_route_data_source.go
+++ b/internal/service/ec2/vpc_route_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/vpc_route_data_source_test.go b/internal/service/ec2/vpc_route_data_source_test.go
index 61c02f2ce95..89d260f21a4 100644
--- a/internal/service/ec2/vpc_route_data_source_test.go
+++ b/internal/service/ec2/vpc_route_data_source_test.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -197,7 +200,7 @@ func TestAccVPCRouteDataSource_gatewayVPCEndpoint(t *testing.T) {
 			},
 			{
 				Config:      testAccVPCRouteDataSourceConfig_gatewayEndpoint(rName),
-				ExpectError: regexp.MustCompile(`No routes matching supplied arguments found in Route Table`),
+				ExpectError: regexache.MustCompile(`No routes matching supplied arguments found in Route Table`),
 			},
 		},
 	})
@@ -277,7 +280,7 @@ resource "aws_instance" "test" {
 resource "aws_route" "instance" {
   route_table_id         = aws_route_table.test.id
   destination_cidr_block = "10.0.1.0/24"
-  instance_id            = aws_instance.test.id
+  network_interface_id   = aws_instance.test.primary_network_interface_id
 }
 
 data "aws_route" "by_peering_connection_id" {
diff --git a/internal/service/ec2/vpc_route_table.go b/internal/service/ec2/vpc_route_table.go
index 80f9043fc51..e8ebb5a92ec 100644
--- a/internal/service/ec2/vpc_route_table.go
+++ b/internal/service/ec2/vpc_route_table.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -19,6 +22,7 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	itypes "github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -206,7 +210,8 @@ func resourceRouteTableCreate(ctx context.Context, d *schema.ResourceData, meta
 func resourceRouteTableRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).EC2Conn(ctx)
-	outputRaw, err := tfresource.RetryWhenNewResourceNotFound(ctx, RouteTableAssociationPropagationTimeout, func() (interface{}, error) {
+
+	outputRaw, err := tfresource.RetryWhenNewResourceNotFound(ctx, ec2PropagationTimeout, func() (interface{}, error) {
 		return FindRouteTableByID(ctx, conn, d.Id())
 	}, d.IsNewResource())
 
@@ -238,7 +243,7 @@ func resourceRouteTableRead(ctx context.Context, d *schema.ResourceData, meta in
 	if err := d.Set("propagating_vgws", propagatingVGWs); err != nil {
 		return sdkdiag.AppendErrorf(diags, "setting propagating_vgws: %s", err)
 	}
-	if err := d.Set("route", flattenRoutes(ctx, conn, routeTable.Routes)); err != nil {
+	if err := d.Set("route", flattenRoutes(ctx, conn, d, routeTable.Routes)); err != nil {
 		return sdkdiag.AppendErrorf(diags, "setting route: %s", err)
 	}
 	d.Set("vpc_id", routeTable.VpcId)
@@ -387,7 +392,7 @@ func resourceRouteTableHash(v interface{}) int {
 	}
 
 	if v, ok := m["ipv6_cidr_block"]; ok {
-		buf.WriteString(fmt.Sprintf("%s-", verify.CanonicalCIDRBlock(v.(string))))
+		buf.WriteString(fmt.Sprintf("%s-", itypes.CanonicalCIDRBlock(v.(string))))
 	}
 
 	if v, ok := m["cidr_block"]; ok {
@@ -475,6 +480,25 @@ func routeTableAddRoute(ctx context.Context, conn *ec2.EC2, routeTableID string,
 
 	input.RouteTableId = aws.String(routeTableID)
 
+	_, target := routeTableRouteTargetAttribute(tfMap)
+
+	if target == gatewayIDLocal {
+		// created by AWS so probably doesn't need a retry but just to be sure
+		// we provide a small one
+		_, err := tfresource.RetryWhenAWSErrCodeEquals(ctx, time.Second*15,
+			func() (interface{}, error) {
+				return routeFinder(ctx, conn, routeTableID, destination)
+			},
+			errCodeInvalidRouteNotFound,
+		)
+
+		if tfresource.NotFound(err) {
+			return fmt.Errorf("local route cannot be created but must exist to be adopted, %s %s does not exist", target, destination)
+		}
+
+		return nil
+	}
+
 	_, err := tfresource.RetryWhenAWSErrCodeEquals(ctx, timeout,
 		func() (interface{}, error) {
 			return conn.CreateRouteWithContext(ctx, input)
@@ -714,7 +738,11 @@ func expandReplaceRouteInput(tfMap map[string]interface{}) *ec2.ReplaceRouteInpu
 	}
 
 	if v, ok := tfMap["gateway_id"].(string); ok && v != "" {
-		apiObject.GatewayId = aws.String(v)
+		if v == gatewayIDLocal {
+			apiObject.LocalTarget = aws.Bool(true)
+		} else {
+			apiObject.GatewayId = aws.String(v)
+		}
 	}
 
 	if v, ok := tfMap["local_gateway_id"].(string); ok && v != "" {
@@ -806,7 +834,7 @@ func flattenRoute(apiObject *ec2.Route) map[string]interface{} {
 	return tfMap
 }
 
-func flattenRoutes(ctx context.Context, conn *ec2.EC2, apiObjects []*ec2.Route) []interface{} {
+func flattenRoutes(ctx context.Context, conn *ec2.EC2, d *schema.ResourceData, apiObjects []*ec2.Route) []interface{} {
 	if len(apiObjects) == 0 {
 		return nil
 	}
@@ -818,7 +846,13 @@ func flattenRoutes(ctx context.Context, conn *ec2.EC2, apiObjects []*ec2.Route)
 			continue
 		}
 
-		if gatewayID := aws.StringValue(apiObject.GatewayId); gatewayID == gatewayIDLocal || gatewayID == gatewayIDVPCLattice {
+		if gatewayID := aws.StringValue(apiObject.GatewayId); gatewayID == gatewayIDVPCLattice {
+			continue
+		}
+
+		// local routes from config need to be included but not default local routes, as determined by hasLocalConfig
+		// see local route tests
+		if gatewayID := aws.StringValue(apiObject.GatewayId); gatewayID == gatewayIDLocal && !hasLocalConfig(d, apiObject) {
 			continue
 		}
 
@@ -849,6 +883,35 @@ func flattenRoutes(ctx context.Context, conn *ec2.EC2, apiObjects []*ec2.Route)
 	return tfList
 }
 
+// hasLocalConfig along with flattenRoutes prevents default local routes from
+// being stored in state but allows configured local routes to be stored in
+// state. hasLocalConfig checks the ResourceData and flattenRoutes skips or
+// includes the route. Normally, you can't count on ResourceData to represent
+// config. However, in this case, a local gateway route in ResourceData must
+// come from config because of the gatekeeping done by hasLocalConfig and
+// flattenRoutes.
+func hasLocalConfig(d *schema.ResourceData, apiObject *ec2.Route) bool {
+	if apiObject.GatewayId == nil {
+		return false
+	}
+	if v, ok := d.GetOk("route"); ok && v.(*schema.Set).Len() > 0 {
+		for _, v := range v.(*schema.Set).List() {
+			v := v.(map[string]interface{})
+			if v["cidr_block"].(string) != aws.StringValue(apiObject.DestinationCidrBlock) &&
+				v["destination_prefix_list_id"] != aws.StringValue(apiObject.DestinationPrefixListId) &&
+				v["ipv6_cidr_block"] != aws.StringValue(apiObject.DestinationIpv6CidrBlock) {
+				continue
+			}
+
+			if v["gateway_id"].(string) == gatewayIDLocal {
+				return true
+			}
+		}
+	}
+
+	return false
+}
+
 // routeTableRouteDestinationAttribute returns the attribute key and value of the route table route's destination.
 func routeTableRouteDestinationAttribute(m map[string]interface{}) (string, string) {
 	for _, key := range routeTableValidDestinations {
diff --git a/internal/service/ec2/vpc_route_table_association.go b/internal/service/ec2/vpc_route_table_association.go
index 89d4803327f..5fce2f8e86c 100644
--- a/internal/service/ec2/vpc_route_table_association.go
+++ b/internal/service/ec2/vpc_route_table_association.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -72,8 +75,7 @@ func resourceRouteTableAssociationCreate(ctx context.Context, d *schema.Resource
 		input.SubnetId = aws.String(v.(string))
 	}
 
-	log.Printf("[DEBUG] Creating Route Table Association: %s", input)
-	output, err := tfresource.RetryWhenAWSErrCodeEquals(ctx, RouteTableAssociationPropagationTimeout,
+	output, err := tfresource.RetryWhenAWSErrCodeEquals(ctx, ec2PropagationTimeout,
 		func() (interface{}, error) {
 			return conn.AssociateRouteTableWithContext(ctx, input)
 		},
@@ -86,7 +88,6 @@ func resourceRouteTableAssociationCreate(ctx context.Context, d *schema.Resource
 
 	d.SetId(aws.StringValue(output.(*ec2.AssociateRouteTableOutput).AssociationId))
 
-	log.Printf("[DEBUG] Waiting for Route Table Association (%s) creation", d.Id())
 	if _, err := WaitRouteTableAssociationCreated(ctx, conn, d.Id(), d.Timeout(schema.TimeoutCreate)); err != nil {
 		return sdkdiag.AppendErrorf(diags, "waiting for Route Table Association (%s) create: %s", d.Id(), err)
 	}
@@ -98,7 +99,7 @@ func resourceRouteTableAssociationRead(ctx context.Context, d *schema.ResourceDa
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).EC2Conn(ctx)
 
-	outputRaw, err := tfresource.RetryWhenNewResourceNotFound(ctx, propagationTimeout, func() (interface{}, error) {
+	outputRaw, err := tfresource.RetryWhenNewResourceNotFound(ctx, ec2PropagationTimeout, func() (interface{}, error) {
 		return FindRouteTableAssociationByID(ctx, conn, d.Id())
 	}, d.IsNewResource())
 
@@ -150,7 +151,6 @@ func resourceRouteTableAssociationUpdate(ctx context.Context, d *schema.Resource
 
 	d.SetId(aws.StringValue(output.NewAssociationId))
 
-	log.Printf("[DEBUG] Waiting for Route Table Association (%s) update", d.Id())
 	if _, err := WaitRouteTableAssociationUpdated(ctx, conn, d.Id(), d.Timeout(schema.TimeoutUpdate)); err != nil {
 		return sdkdiag.AppendErrorf(diags, "waiting for Route Table Association (%s) update: %s", d.Id(), err)
 	}
@@ -230,7 +230,6 @@ func routeTableAssociationDelete(ctx context.Context, conn *ec2.EC2, association
 		return fmt.Errorf("deleting Route Table Association (%s): %w", associationID, err)
 	}
 
-	log.Printf("[DEBUG] Waiting for Route Table Association (%s) deletion", associationID)
 	if _, err := WaitRouteTableAssociationDeleted(ctx, conn, associationID, timeout); err != nil {
 		return fmt.Errorf("deleting Route Table Association (%s): waiting for completion: %w", associationID, err)
 	}
diff --git a/internal/service/ec2/vpc_route_table_association_test.go b/internal/service/ec2/vpc_route_table_association_test.go
index d65f55945be..997095bb939 100644
--- a/internal/service/ec2/vpc_route_table_association_test.go
+++ b/internal/service/ec2/vpc_route_table_association_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/vpc_route_table_data_source.go b/internal/service/ec2/vpc_route_table_data_source.go
index 1053638f0ed..4874fee9d5f 100644
--- a/internal/service/ec2/vpc_route_table_data_source.go
+++ b/internal/service/ec2/vpc_route_table_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/vpc_route_table_data_source_test.go b/internal/service/ec2/vpc_route_table_data_source_test.go
index f6f907793cd..5bcdd0b315e 100644
--- a/internal/service/ec2/vpc_route_table_data_source_test.go
+++ b/internal/service/ec2/vpc_route_table_data_source_test.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -34,7 +37,7 @@ func TestAccVPCRouteTableDataSource_basic(t *testing.T) {
 				Config: testAccVPCRouteTableDataSourceConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					// By tags.
-					acctest.MatchResourceAttrRegionalARN(datasource1Name, "arn", "ec2", regexp.MustCompile(`route-table/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(datasource1Name, "arn", "ec2", regexache.MustCompile(`route-table/.+$`)),
 					resource.TestCheckResourceAttrPair(datasource1Name, "id", rtResourceName, "id"),
 					resource.TestCheckResourceAttrPair(datasource1Name, "route_table_id", rtResourceName, "id"),
 					resource.TestCheckResourceAttrPair(datasource1Name, "owner_id", rtResourceName, "owner_id"),
@@ -46,7 +49,7 @@ func TestAccVPCRouteTableDataSource_basic(t *testing.T) {
 					testAccCheckListHasSomeElementAttrPair(datasource1Name, "associations", "gateway_id", igwResourceName, "id"),
 					resource.TestCheckResourceAttr(datasource1Name, "tags.Name", rName),
 					// By filter.
-					acctest.MatchResourceAttrRegionalARN(datasource2Name, "arn", "ec2", regexp.MustCompile(`route-table/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(datasource2Name, "arn", "ec2", regexache.MustCompile(`route-table/.+$`)),
 					resource.TestCheckResourceAttrPair(datasource2Name, "id", rtResourceName, "id"),
 					resource.TestCheckResourceAttrPair(datasource2Name, "route_table_id", rtResourceName, "id"),
 					resource.TestCheckResourceAttrPair(datasource2Name, "owner_id", rtResourceName, "owner_id"),
@@ -58,7 +61,7 @@ func TestAccVPCRouteTableDataSource_basic(t *testing.T) {
 					testAccCheckListHasSomeElementAttrPair(datasource2Name, "associations", "gateway_id", igwResourceName, "id"),
 					resource.TestCheckResourceAttr(datasource2Name, "tags.Name", rName),
 					// By subnet ID.
-					acctest.MatchResourceAttrRegionalARN(datasource3Name, "arn", "ec2", regexp.MustCompile(`route-table/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(datasource3Name, "arn", "ec2", regexache.MustCompile(`route-table/.+$`)),
 					resource.TestCheckResourceAttrPair(datasource3Name, "id", rtResourceName, "id"),
 					resource.TestCheckResourceAttrPair(datasource3Name, "route_table_id", rtResourceName, "id"),
 					resource.TestCheckResourceAttrPair(datasource3Name, "owner_id", rtResourceName, "owner_id"),
@@ -70,7 +73,7 @@ func TestAccVPCRouteTableDataSource_basic(t *testing.T) {
 					testAccCheckListHasSomeElementAttrPair(datasource3Name, "associations", "gateway_id", igwResourceName, "id"),
 					resource.TestCheckResourceAttr(datasource3Name, "tags.Name", rName),
 					// By route table ID.
-					acctest.MatchResourceAttrRegionalARN(datasource4Name, "arn", "ec2", regexp.MustCompile(`route-table/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(datasource4Name, "arn", "ec2", regexache.MustCompile(`route-table/.+$`)),
 					resource.TestCheckResourceAttrPair(datasource4Name, "id", rtResourceName, "id"),
 					resource.TestCheckResourceAttrPair(datasource4Name, "route_table_id", rtResourceName, "id"),
 					resource.TestCheckResourceAttrPair(datasource4Name, "owner_id", rtResourceName, "owner_id"),
@@ -82,7 +85,7 @@ func TestAccVPCRouteTableDataSource_basic(t *testing.T) {
 					testAccCheckListHasSomeElementAttrPair(datasource4Name, "associations", "gateway_id", igwResourceName, "id"),
 					resource.TestCheckResourceAttr(datasource4Name, "tags.Name", rName),
 					// By gateway ID.
-					acctest.MatchResourceAttrRegionalARN(datasource5Name, "arn", "ec2", regexp.MustCompile(`route-table/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(datasource5Name, "arn", "ec2", regexache.MustCompile(`route-table/.+$`)),
 					resource.TestCheckResourceAttrPair(datasource5Name, "id", rtResourceName, "id"),
 					resource.TestCheckResourceAttrPair(datasource5Name, "route_table_id", rtResourceName, "id"),
 					resource.TestCheckResourceAttrPair(datasource5Name, "owner_id", rtResourceName, "owner_id"),
@@ -144,7 +147,7 @@ func testAccCheckListHasSomeElementAttrPair(nameFirst string, resourceAttr strin
 		}
 
 		attrsFirst := make([]string, 0, len(isFirst.Attributes))
-		attrMatcher := regexp.MustCompile(fmt.Sprintf("%s\\.\\d+\\.%s", resourceAttr, elementAttr))
+		attrMatcher := regexache.MustCompile(fmt.Sprintf("%s\\.\\d+\\.%s", resourceAttr, elementAttr))
 		for k := range isFirst.Attributes {
 			if attrMatcher.MatchString(k) {
 				attrsFirst = append(attrsFirst, k)
diff --git a/internal/service/ec2/vpc_route_table_test.go b/internal/service/ec2/vpc_route_table_test.go
index a7b6cd857a0..62509a09510 100644
--- a/internal/service/ec2/vpc_route_table_test.go
+++ b/internal/service/ec2/vpc_route_table_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
@@ -36,7 +39,7 @@ func TestAccVPCRouteTable_basic(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRouteTableExists(ctx, resourceName, &routeTable),
 					testAccCheckRouteTableNumberOfRoutes(&routeTable, 1),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexp.MustCompile(`route-table/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`route-table/.+$`)),
 					acctest.CheckResourceAttrAccountID(resourceName, "owner_id"),
 					resource.TestCheckResourceAttr(resourceName, "propagating_vgws.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "route.#", "0"),
@@ -121,7 +124,7 @@ func TestAccVPCRouteTable_ipv4ToInternetGateway(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRouteTableExists(ctx, resourceName, &routeTable),
 					testAccCheckRouteTableNumberOfRoutes(&routeTable, 3),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexp.MustCompile(`route-table/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`route-table/.+$`)),
 					acctest.CheckResourceAttrAccountID(resourceName, "owner_id"),
 					resource.TestCheckResourceAttr(resourceName, "propagating_vgws.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "route.#", "2"),
@@ -136,7 +139,7 @@ func TestAccVPCRouteTable_ipv4ToInternetGateway(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRouteTableExists(ctx, resourceName, &routeTable),
 					testAccCheckRouteTableNumberOfRoutes(&routeTable, 3),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexp.MustCompile(`route-table/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`route-table/.+$`)),
 					acctest.CheckResourceAttrAccountID(resourceName, "owner_id"),
 					resource.TestCheckResourceAttr(resourceName, "propagating_vgws.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "route.#", "2"),
@@ -174,7 +177,7 @@ func TestAccVPCRouteTable_ipv4ToInstance(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRouteTableExists(ctx, resourceName, &routeTable),
 					testAccCheckRouteTableNumberOfRoutes(&routeTable, 2),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexp.MustCompile(`route-table/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`route-table/.+$`)),
 					acctest.CheckResourceAttrAccountID(resourceName, "owner_id"),
 					resource.TestCheckResourceAttr(resourceName, "propagating_vgws.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "route.#", "1"),
@@ -211,7 +214,7 @@ func TestAccVPCRouteTable_ipv6ToEgressOnlyInternetGateway(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRouteTableExists(ctx, resourceName, &routeTable),
 					testAccCheckRouteTableNumberOfRoutes(&routeTable, 3),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexp.MustCompile(`route-table/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`route-table/.+$`)),
 					acctest.CheckResourceAttrAccountID(resourceName, "owner_id"),
 					resource.TestCheckResourceAttr(resourceName, "propagating_vgws.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "route.#", "1"),
@@ -296,7 +299,7 @@ func TestAccVPCRouteTable_requireRouteDestination(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccVPCRouteTableConfig_noDestination(rName),
-				ExpectError: regexp.MustCompile("creating route: one of `cidr_block"),
+				ExpectError: regexache.MustCompile("creating route: one of `cidr_block"),
 			},
 		},
 	})
@@ -314,7 +317,7 @@ func TestAccVPCRouteTable_requireRouteTarget(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccVPCRouteTableConfig_noTarget(rName),
-				ExpectError: regexp.MustCompile(`creating route: one of .*\begress_only_gateway_id\b`),
+				ExpectError: regexache.MustCompile(`creating route: one of .*\begress_only_gateway_id\b`),
 			},
 		},
 	})
@@ -340,7 +343,7 @@ func TestAccVPCRouteTable_Route_mode(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRouteTableExists(ctx, resourceName, &routeTable),
 					testAccCheckRouteTableNumberOfRoutes(&routeTable, 3),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexp.MustCompile(`route-table/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`route-table/.+$`)),
 					acctest.CheckResourceAttrAccountID(resourceName, "owner_id"),
 					resource.TestCheckResourceAttr(resourceName, "propagating_vgws.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "route.#", "2"),
@@ -360,7 +363,7 @@ func TestAccVPCRouteTable_Route_mode(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRouteTableExists(ctx, resourceName, &routeTable),
 					testAccCheckRouteTableNumberOfRoutes(&routeTable, 3),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexp.MustCompile(`route-table/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`route-table/.+$`)),
 					acctest.CheckResourceAttrAccountID(resourceName, "owner_id"),
 					resource.TestCheckResourceAttr(resourceName, "propagating_vgws.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "route.#", "2"),
@@ -380,7 +383,7 @@ func TestAccVPCRouteTable_Route_mode(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRouteTableExists(ctx, resourceName, &routeTable),
 					testAccCheckRouteTableNumberOfRoutes(&routeTable, 1),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexp.MustCompile(`route-table/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`route-table/.+$`)),
 					acctest.CheckResourceAttrAccountID(resourceName, "owner_id"),
 					resource.TestCheckResourceAttr(resourceName, "propagating_vgws.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "route.#", "0"),
@@ -420,7 +423,7 @@ func TestAccVPCRouteTable_ipv4ToTransitGateway(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRouteTableExists(ctx, resourceName, &routeTable),
 					testAccCheckRouteTableNumberOfRoutes(&routeTable, 2),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexp.MustCompile(`route-table/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`route-table/.+$`)),
 					acctest.CheckResourceAttrAccountID(resourceName, "owner_id"),
 					resource.TestCheckResourceAttr(resourceName, "propagating_vgws.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "route.#", "1"),
@@ -461,7 +464,7 @@ func TestAccVPCRouteTable_ipv4ToVPCEndpoint(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRouteTableExists(ctx, resourceName, &routeTable),
 					testAccCheckRouteTableNumberOfRoutes(&routeTable, 2),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexp.MustCompile(`route-table/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`route-table/.+$`)),
 					acctest.CheckResourceAttrAccountID(resourceName, "owner_id"),
 					resource.TestCheckResourceAttr(resourceName, "propagating_vgws.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "route.#", "1"),
@@ -498,7 +501,7 @@ func TestAccVPCRouteTable_ipv4ToCarrierGateway(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRouteTableExists(ctx, resourceName, &routeTable),
 					testAccCheckRouteTableNumberOfRoutes(&routeTable, 2),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexp.MustCompile(`route-table/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`route-table/.+$`)),
 					acctest.CheckResourceAttrAccountID(resourceName, "owner_id"),
 					resource.TestCheckResourceAttr(resourceName, "propagating_vgws.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "route.#", "1"),
@@ -535,7 +538,7 @@ func TestAccVPCRouteTable_ipv4ToLocalGateway(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRouteTableExists(ctx, resourceName, &routeTable),
 					testAccCheckRouteTableNumberOfRoutes(&routeTable, 2),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexp.MustCompile(`route-table/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`route-table/.+$`)),
 					acctest.CheckResourceAttrAccountID(resourceName, "owner_id"),
 					resource.TestCheckResourceAttr(resourceName, "propagating_vgws.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "route.#", "1"),
@@ -572,7 +575,7 @@ func TestAccVPCRouteTable_ipv4ToVPCPeeringConnection(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRouteTableExists(ctx, resourceName, &routeTable),
 					testAccCheckRouteTableNumberOfRoutes(&routeTable, 2),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexp.MustCompile(`route-table/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`route-table/.+$`)),
 					acctest.CheckResourceAttrAccountID(resourceName, "owner_id"),
 					resource.TestCheckResourceAttr(resourceName, "propagating_vgws.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "route.#", "1"),
@@ -609,7 +612,7 @@ func TestAccVPCRouteTable_vgwRoutePropagation(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRouteTableExists(ctx, resourceName, &routeTable),
 					testAccCheckRouteTableNumberOfRoutes(&routeTable, 1),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexp.MustCompile(`route-table/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`route-table/.+$`)),
 					acctest.CheckResourceAttrAccountID(resourceName, "owner_id"),
 					resource.TestCheckResourceAttr(resourceName, "propagating_vgws.#", "1"),
 					resource.TestCheckTypeSetElemAttrPair(resourceName, "propagating_vgws.*", vgwResourceName1, "id"),
@@ -623,7 +626,7 @@ func TestAccVPCRouteTable_vgwRoutePropagation(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRouteTableExists(ctx, resourceName, &routeTable),
 					testAccCheckRouteTableNumberOfRoutes(&routeTable, 1),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexp.MustCompile(`route-table/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`route-table/.+$`)),
 					acctest.CheckResourceAttrAccountID(resourceName, "owner_id"),
 					resource.TestCheckResourceAttr(resourceName, "propagating_vgws.#", "1"),
 					resource.TestCheckTypeSetElemAttrPair(resourceName, "propagating_vgws.*", vgwResourceName2, "id"),
@@ -698,7 +701,7 @@ func TestAccVPCRouteTable_ipv4ToNatGateway(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRouteTableExists(ctx, resourceName, &routeTable),
 					testAccCheckRouteTableNumberOfRoutes(&routeTable, 2),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexp.MustCompile(`route-table/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`route-table/.+$`)),
 					acctest.CheckResourceAttrAccountID(resourceName, "owner_id"),
 					resource.TestCheckResourceAttr(resourceName, "propagating_vgws.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "route.#", "1"),
@@ -735,7 +738,7 @@ func TestAccVPCRouteTable_IPv6ToNetworkInterface_unattached(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRouteTableExists(ctx, resourceName, &routeTable),
 					testAccCheckRouteTableNumberOfRoutes(&routeTable, 3),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexp.MustCompile(`route-table/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`route-table/.+$`)),
 					acctest.CheckResourceAttrAccountID(resourceName, "owner_id"),
 					resource.TestCheckResourceAttr(resourceName, "propagating_vgws.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "route.#", "1"),
@@ -774,7 +777,7 @@ func TestAccVPCRouteTable_IPv4ToNetworkInterfaces_unattached(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRouteTableExists(ctx, resourceName, &routeTable),
 					testAccCheckRouteTableNumberOfRoutes(&routeTable, 1),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexp.MustCompile(`route-table/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`route-table/.+$`)),
 					acctest.CheckResourceAttrAccountID(resourceName, "owner_id"),
 					resource.TestCheckResourceAttr(resourceName, "propagating_vgws.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "route.#", "0"),
@@ -786,7 +789,7 @@ func TestAccVPCRouteTable_IPv4ToNetworkInterfaces_unattached(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRouteTableExists(ctx, resourceName, &routeTable),
 					testAccCheckRouteTableNumberOfRoutes(&routeTable, 3),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexp.MustCompile(`route-table/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`route-table/.+$`)),
 					acctest.CheckResourceAttrAccountID(resourceName, "owner_id"),
 					resource.TestCheckResourceAttr(resourceName, "propagating_vgws.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "route.#", "2"),
@@ -806,7 +809,7 @@ func TestAccVPCRouteTable_IPv4ToNetworkInterfaces_unattached(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRouteTableExists(ctx, resourceName, &routeTable),
 					testAccCheckRouteTableNumberOfRoutes(&routeTable, 3),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexp.MustCompile(`route-table/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`route-table/.+$`)),
 					acctest.CheckResourceAttrAccountID(resourceName, "owner_id"),
 					resource.TestCheckResourceAttr(resourceName, "propagating_vgws.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "route.#", "2"),
@@ -821,7 +824,7 @@ func TestAccVPCRouteTable_IPv4ToNetworkInterfaces_unattached(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRouteTableExists(ctx, resourceName, &routeTable),
 					testAccCheckRouteTableNumberOfRoutes(&routeTable, 1),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexp.MustCompile(`route-table/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`route-table/.+$`)),
 					acctest.CheckResourceAttrAccountID(resourceName, "owner_id"),
 					resource.TestCheckResourceAttr(resourceName, "propagating_vgws.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "route.#", "0"),
@@ -850,7 +853,7 @@ func TestAccVPCRouteTable_vpcMultipleCIDRs(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRouteTableExists(ctx, resourceName, &routeTable),
 					testAccCheckRouteTableNumberOfRoutes(&routeTable, 2),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexp.MustCompile(`route-table/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`route-table/.+$`)),
 					acctest.CheckResourceAttrAccountID(resourceName, "owner_id"),
 					resource.TestCheckResourceAttr(resourceName, "propagating_vgws.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "route.#", "0"),
@@ -890,7 +893,7 @@ func TestAccVPCRouteTable_gatewayVPCEndpoint(t *testing.T) {
 					// Refresh the route table once the VPC endpoint route is present.
 					testAccCheckRouteTableExists(ctx, resourceName, &routeTable),
 					testAccCheckRouteTableNumberOfRoutes(&routeTable, 2),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexp.MustCompile(`route-table/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`route-table/.+$`)),
 					acctest.CheckResourceAttrAccountID(resourceName, "owner_id"),
 					resource.TestCheckResourceAttr(resourceName, "propagating_vgws.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "route.#", "0"),
@@ -935,7 +938,7 @@ func TestAccVPCRouteTable_multipleRoutes(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRouteTableExists(ctx, resourceName, &routeTable),
 					testAccCheckRouteTableNumberOfRoutes(&routeTable, 5),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexp.MustCompile(`route-table/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`route-table/.+$`)),
 					acctest.CheckResourceAttrAccountID(resourceName, "owner_id"),
 					resource.TestCheckResourceAttr(resourceName, "propagating_vgws.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "route.#", "3"),
@@ -954,7 +957,7 @@ func TestAccVPCRouteTable_multipleRoutes(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRouteTableExists(ctx, resourceName, &routeTable),
 					testAccCheckRouteTableNumberOfRoutes(&routeTable, 5),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexp.MustCompile(`route-table/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`route-table/.+$`)),
 					acctest.CheckResourceAttrAccountID(resourceName, "owner_id"),
 					resource.TestCheckResourceAttr(resourceName, "propagating_vgws.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "route.#", "3"),
@@ -973,7 +976,7 @@ func TestAccVPCRouteTable_multipleRoutes(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRouteTableExists(ctx, resourceName, &routeTable),
 					testAccCheckRouteTableNumberOfRoutes(&routeTable, 5),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexp.MustCompile(`route-table/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`route-table/.+$`)),
 					acctest.CheckResourceAttrAccountID(resourceName, "owner_id"),
 					resource.TestCheckResourceAttr(resourceName, "propagating_vgws.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "route.#", "3"),
@@ -1012,7 +1015,7 @@ func TestAccVPCRouteTable_prefixListToInternetGateway(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRouteTableExists(ctx, resourceName, &routeTable),
 					testAccCheckRouteTableNumberOfRoutes(&routeTable, 2),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexp.MustCompile(`route-table/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`route-table/.+$`)),
 					acctest.CheckResourceAttrAccountID(resourceName, "owner_id"),
 					resource.TestCheckResourceAttr(resourceName, "propagating_vgws.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "route.#", "1"),
@@ -1030,6 +1033,190 @@ func TestAccVPCRouteTable_prefixListToInternetGateway(t *testing.T) {
 	})
 }
 
+func TestAccVPCRouteTable_localRoute(t *testing.T) {
+	ctx := acctest.Context(t)
+	var routeTable ec2.RouteTable
+	var vpc ec2.Vpc
+	resourceName := "aws_route_table.test"
+	vpcResourceName := "aws_vpc.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, ec2.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckRouteDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccVPCRouteTableConfig_basic(rName),
+				Check: resource.ComposeTestCheckFunc(
+					acctest.CheckVPCExists(ctx, vpcResourceName, &vpc),
+					testAccCheckRouteTableExists(ctx, resourceName, &routeTable),
+					testAccCheckRouteTableNumberOfRoutes(&routeTable, 1),
+				),
+			},
+			{
+				Config:            testAccVPCRouteTableConfig_ipv4Local(rName),
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
+func TestAccVPCRouteTable_localRouteAdoptUpdate(t *testing.T) {
+	ctx := acctest.Context(t)
+	var routeTable ec2.RouteTable
+	var vpc ec2.Vpc
+	resourceName := "aws_route_table.test"
+	vpcResourceName := "aws_vpc.test"
+	eniResourceName := "aws_network_interface.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	vpcCIDR := "10.1.0.0/16"
+	localGatewayCIDR := "10.1.0.0/16"
+	localGatewayCIDRBad := "10.2.0.0/16"
+	subnetCIDR := "10.1.1.0/24"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, ec2.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckRouteDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config:      testAccVPCRouteTableConfig_ipv4NetworkInterfaceToLocal(rName, vpcCIDR, localGatewayCIDRBad, subnetCIDR),
+				ExpectError: regexache.MustCompile("must exist to be adopted"),
+			},
+			{
+				Config: testAccVPCRouteTableConfig_ipv4NetworkInterfaceToLocal(rName, vpcCIDR, localGatewayCIDR, subnetCIDR),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					acctest.CheckVPCExists(ctx, vpcResourceName, &vpc),
+					testAccCheckRouteTableExists(ctx, resourceName, &routeTable),
+					testAccCheckRouteTableNumberOfRoutes(&routeTable, 1),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "route.*", map[string]string{
+						"gateway_id": "local",
+						"cidr_block": localGatewayCIDR,
+					}),
+				),
+			},
+			{
+				Config: testAccVPCRouteTableConfig_ipv4LocalNetworkInterface(rName, vpcCIDR, subnetCIDR),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					acctest.CheckVPCExists(ctx, vpcResourceName, &vpc),
+					testAccCheckRouteTableExists(ctx, resourceName, &routeTable),
+					testAccCheckRouteTableNumberOfRoutes(&routeTable, 1),
+					testAccCheckRouteTableRoute(resourceName, "cidr_block", vpcCIDR, "network_interface_id", eniResourceName, "id"),
+				),
+			},
+			{
+				Config: testAccVPCRouteTableConfig_ipv4NetworkInterfaceToLocal(rName, vpcCIDR, localGatewayCIDR, subnetCIDR),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					acctest.CheckVPCExists(ctx, vpcResourceName, &vpc),
+					testAccCheckRouteTableExists(ctx, resourceName, &routeTable),
+					testAccCheckRouteTableNumberOfRoutes(&routeTable, 1),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "route.*", map[string]string{
+						"gateway_id": "local",
+						"cidr_block": localGatewayCIDR,
+					}),
+				),
+			},
+		},
+	})
+}
+
+func TestAccVPCRouteTable_localRouteImportUpdate(t *testing.T) {
+	ctx := acctest.Context(t)
+	var routeTable ec2.RouteTable
+	var vpc ec2.Vpc
+	resourceName := "aws_route_table.test"
+	rteResourceName := "aws_route.test"
+	vpcResourceName := "aws_vpc.test"
+	eniResourceName := "aws_network_interface.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	vpcCIDR := "10.1.0.0/16"
+	localGatewayCIDR := "10.1.0.0/16"
+	subnetCIDR := "10.1.1.0/24"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, ec2.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckRouteDestroy(ctx),
+		Steps: []resource.TestStep{
+			// This test is a little wonky. Because there's no way (that I
+			// could figure anyway) to use aws_route_table to import a local
+			// route and then persist it to the next step since the route is
+			// inline rather than a separate resource. Instead, it uses
+			// aws_route config rather than aws_route_table w/ inline routes
+			// for steps 1-3 and then does slight of hand, switching
+			// to aws_route_table to finish the test.
+			{
+				Config: testAccVPCRouteConfig_ipv4NoRoute(rName),
+				Check: resource.ComposeTestCheckFunc(
+					acctest.CheckVPCExists(ctx, vpcResourceName, &vpc),
+					testAccCheckRouteTableExists(ctx, resourceName, &routeTable),
+					testAccCheckRouteTableNumberOfRoutes(&routeTable, 1),
+				),
+			},
+			{
+				Config:       testAccVPCRouteConfig_ipv4Local(rName),
+				ResourceName: rteResourceName,
+				ImportState:  true,
+				ImportStateIdFunc: func(rt *ec2.RouteTable, v *ec2.Vpc) resource.ImportStateIdFunc {
+					return func(s *terraform.State) (string, error) {
+						return fmt.Sprintf("%s_%s", aws.StringValue(rt.RouteTableId), aws.StringValue(v.CidrBlock)), nil
+					}
+				}(&routeTable, &vpc),
+				ImportStatePersist: true,
+				// Don't verify the state as the local route isn't actually in the pre-import state.
+				// Just running ImportState verifies that we can import a local route.
+				ImportStateVerify: false,
+			},
+			{
+				Config: testAccVPCRouteConfig_ipv4LocalToNetworkInterface(rName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					acctest.CheckVPCExists(ctx, vpcResourceName, &vpc),
+					testAccCheckRouteTableExists(ctx, resourceName, &routeTable),
+					testAccCheckRouteTableNumberOfRoutes(&routeTable, 1),
+					resource.TestCheckResourceAttr(rteResourceName, "gateway_id", ""),
+					resource.TestCheckResourceAttrPair(rteResourceName, "network_interface_id", eniResourceName, "id"),
+				),
+			},
+			{
+				Config: testAccVPCRouteTableConfig_ipv4LocalNetworkInterface(rName, vpcCIDR, subnetCIDR),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					acctest.CheckVPCExists(ctx, vpcResourceName, &vpc),
+					testAccCheckRouteTableExists(ctx, resourceName, &routeTable),
+					testAccCheckRouteTableNumberOfRoutes(&routeTable, 1),
+					testAccCheckRouteTableRoute(resourceName, "cidr_block", vpcCIDR, "network_interface_id", eniResourceName, "id"),
+				),
+			},
+			{
+				Config: testAccVPCRouteTableConfig_ipv4NetworkInterfaceToLocal(rName, vpcCIDR, localGatewayCIDR, subnetCIDR),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					acctest.CheckVPCExists(ctx, vpcResourceName, &vpc),
+					testAccCheckRouteTableExists(ctx, resourceName, &routeTable),
+					testAccCheckRouteTableNumberOfRoutes(&routeTable, 1),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "route.*", map[string]string{
+						"gateway_id": "local",
+						"cidr_block": localGatewayCIDR,
+					}),
+				),
+			},
+			{
+				Config: testAccVPCRouteTableConfig_ipv4LocalNetworkInterface(rName, vpcCIDR, subnetCIDR),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					acctest.CheckVPCExists(ctx, vpcResourceName, &vpc),
+					testAccCheckRouteTableExists(ctx, resourceName, &routeTable),
+					testAccCheckRouteTableNumberOfRoutes(&routeTable, 1),
+					testAccCheckRouteTableRoute(resourceName, "cidr_block", vpcCIDR, "network_interface_id", eniResourceName, "id"),
+				),
+			},
+		},
+	})
+}
+
 func testAccCheckRouteTableExists(ctx context.Context, n string, v *ec2.RouteTable) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		rs, ok := s.RootModule().Resources[n]
@@ -1666,6 +1853,10 @@ func testAccVPCRouteTableConfig_ipv4EndpointID(rName, destinationCidr string) st
 		fmt.Sprintf(`
 data "aws_caller_identity" "current" {}
 
+data "aws_iam_session_context" "current" {
+  arn = data.aws_caller_identity.current.arn
+}
+
 resource "aws_vpc" "test" {
   cidr_block = "10.10.10.0/25"
 
@@ -1695,7 +1886,7 @@ resource "aws_lb" "test" {
 
 resource "aws_vpc_endpoint_service" "test" {
   acceptance_required        = false
-  allowed_principals         = [data.aws_caller_identity.current.arn]
+  allowed_principals         = [data.aws_iam_session_context.current.issuer_arn]
   gateway_load_balancer_arns = [aws_lb.test.arn]
 
   tags = {
@@ -2257,3 +2448,108 @@ resource "aws_route_table" "test" {
 }
 `, rName)
 }
+
+func testAccVPCRouteTableConfig_ipv4Local(rName string) string {
+	return fmt.Sprintf(`
+resource "aws_vpc" "test" {
+  cidr_block = "10.1.0.0/16"
+
+  tags = {
+    Name = %[1]q
+  }
+}
+
+resource "aws_route_table" "test" {
+  vpc_id = aws_vpc.test.id
+
+  route {
+    cidr_block = aws_vpc.test.cidr_block
+    gateway_id = "local"
+  }
+}
+`, rName)
+}
+
+func testAccVPCRouteTableConfig_ipv4LocalNetworkInterface(rName, vpcCIDR, subnetCIDR string) string {
+	return fmt.Sprintf(`
+resource "aws_vpc" "test" {
+  cidr_block = %[2]q
+
+  tags = {
+    Name = %[1]q
+  }
+}
+
+resource "aws_route_table" "test" {
+  vpc_id = aws_vpc.test.id
+
+  route {
+    cidr_block           = aws_vpc.test.cidr_block
+    network_interface_id = aws_network_interface.test.id
+  }
+
+  tags = {
+    Name = %[1]q
+  }
+}
+
+resource "aws_subnet" "test" {
+  cidr_block = %[3]q
+  vpc_id     = aws_vpc.test.id
+
+  tags = {
+    Name = %[1]q
+  }
+}
+
+resource "aws_network_interface" "test" {
+  subnet_id = aws_subnet.test.id
+
+  tags = {
+    Name = %[1]q
+  }
+}
+`, rName, vpcCIDR, subnetCIDR)
+}
+
+func testAccVPCRouteTableConfig_ipv4NetworkInterfaceToLocal(rName, vpcCIDR, gatewayCIDR, subnetCIDR string) string {
+	return fmt.Sprintf(`
+resource "aws_vpc" "test" {
+  cidr_block = %[2]q
+
+  tags = {
+    Name = %[1]q
+  }
+}
+
+resource "aws_route_table" "test" {
+  vpc_id = aws_vpc.test.id
+
+  route {
+    cidr_block = %[3]q
+    gateway_id = "local"
+  }
+
+  tags = {
+    Name = %[1]q
+  }
+}
+
+resource "aws_subnet" "test" {
+  cidr_block = %[4]q
+  vpc_id     = aws_vpc.test.id
+
+  tags = {
+    Name = %[1]q
+  }
+}
+
+resource "aws_network_interface" "test" {
+  subnet_id = aws_subnet.test.id
+
+  tags = {
+    Name = %[1]q
+  }
+}
+`, rName, vpcCIDR, gatewayCIDR, subnetCIDR)
+}
diff --git a/internal/service/ec2/vpc_route_tables_data_source.go b/internal/service/ec2/vpc_route_tables_data_source.go
index 1324e1c225c..86e83c017b5 100644
--- a/internal/service/ec2/vpc_route_tables_data_source.go
+++ b/internal/service/ec2/vpc_route_tables_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -23,7 +26,7 @@ func DataSourceRouteTables() *schema.Resource {
 		},
 
 		Schema: map[string]*schema.Schema{
-			"filter": DataSourceFiltersSchema(),
+			"filter": CustomFiltersSchema(),
 			"ids": {
 				Type:     schema.TypeList,
 				Computed: true,
@@ -56,7 +59,7 @@ func dataSourceRouteTablesRead(ctx context.Context, d *schema.ResourceData, meta
 		Tags(tftags.New(ctx, d.Get("tags").(map[string]interface{}))),
 	)...)
 
-	input.Filters = append(input.Filters, BuildFiltersDataSource(
+	input.Filters = append(input.Filters, BuildCustomFilterList(
 		d.Get("filter").(*schema.Set),
 	)...)
 
diff --git a/internal/service/ec2/vpc_route_tables_data_source_test.go b/internal/service/ec2/vpc_route_tables_data_source_test.go
index 8dbf6a99c79..db93c5fe53c 100644
--- a/internal/service/ec2/vpc_route_tables_data_source_test.go
+++ b/internal/service/ec2/vpc_route_tables_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/vpc_route_test.go b/internal/service/ec2/vpc_route_test.go
index ce32e0eb227..d3be532c38e 100644
--- a/internal/service/ec2/vpc_route_test.go
+++ b/internal/service/ec2/vpc_route_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
@@ -3313,6 +3316,10 @@ func testAccVPCRouteConfig_resourceIPv4Endpoint(rName, destinationCidr string) s
 		fmt.Sprintf(`
 data "aws_caller_identity" "current" {}
 
+data "aws_iam_session_context" "current" {
+  arn = data.aws_caller_identity.current.arn
+}
+
 resource "aws_vpc" "test" {
   cidr_block = "10.10.10.0/25"
 
@@ -3342,7 +3349,7 @@ resource "aws_lb" "test" {
 
 resource "aws_vpc_endpoint_service" "test" {
   acceptance_required        = false
-  allowed_principals         = [data.aws_caller_identity.current.arn]
+  allowed_principals         = [data.aws_iam_session_context.current.issuer_arn]
   gateway_load_balancer_arns = [aws_lb.test.arn]
 
   tags = {
@@ -3383,6 +3390,10 @@ func testAccVPCRouteConfig_resourceIPv6Endpoint(rName, destinationIpv6Cidr strin
 		fmt.Sprintf(`
 data "aws_caller_identity" "current" {}
 
+data "aws_iam_session_context" "current" {
+  arn = data.aws_caller_identity.current.arn
+}
+
 resource "aws_vpc" "test" {
   cidr_block = "10.10.10.0/25"
 
@@ -3412,7 +3423,7 @@ resource "aws_lb" "test" {
 
 resource "aws_vpc_endpoint_service" "test" {
   acceptance_required        = false
-  allowed_principals         = [data.aws_caller_identity.current.arn]
+  allowed_principals         = [data.aws_iam_session_context.current.issuer_arn]
   gateway_load_balancer_arns = [aws_lb.test.arn]
 
   tags = {
@@ -3567,6 +3578,10 @@ resource "aws_nat_gateway" "test" {
 
 data "aws_caller_identity" "current" {}
 
+data "aws_iam_session_context" "current" {
+  arn = data.aws_caller_identity.current.arn
+}
+
 resource "aws_lb" "test" {
   load_balancer_type = "gateway"
   name               = %[1]q
@@ -3578,7 +3593,7 @@ resource "aws_lb" "test" {
 
 resource "aws_vpc_endpoint_service" "test" {
   acceptance_required        = false
-  allowed_principals         = [data.aws_caller_identity.current.arn]
+  allowed_principals         = [data.aws_iam_session_context.current.issuer_arn]
   gateway_load_balancer_arns = [aws_lb.test.arn]
 
   tags = {
diff --git a/internal/service/ec2/vpc_security_group.go b/internal/service/ec2/vpc_security_group.go
index b5c87e25ab7..48be193e59d 100644
--- a/internal/service/ec2/vpc_security_group.go
+++ b/internal/service/ec2/vpc_security_group.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -5,12 +8,12 @@ import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"sort"
 	"strconv"
 	"strings"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/aws/aws-sdk-go/service/ec2"
@@ -73,7 +76,7 @@ func ResourceSecurityGroup() *schema.Resource {
 				ConflictsWith: []string{"name_prefix"},
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(0, 255),
-					validation.StringDoesNotMatch(regexp.MustCompile(`^sg-`), "cannot begin with sg-"),
+					validation.StringDoesNotMatch(regexache.MustCompile(`^sg-`), "cannot begin with sg-"),
 				),
 			},
 			"name_prefix": {
@@ -84,7 +87,7 @@ func ResourceSecurityGroup() *schema.Resource {
 				ConflictsWith: []string{"name"},
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(0, 255-id.UniqueIDSuffixLength),
-					validation.StringDoesNotMatch(regexp.MustCompile(`^sg-`), "cannot begin with sg-"),
+					validation.StringDoesNotMatch(regexache.MustCompile(`^sg-`), "cannot begin with sg-"),
 				),
 			},
 			"owner_id": {
@@ -397,7 +400,7 @@ func resourceSecurityGroupDelete(ctx context.Context, d *schema.ResourceData, me
 		return diag.Errorf("deleting Security Group (%s): %s", d.Id(), err)
 	}
 
-	_, err = tfresource.RetryUntilNotFound(ctx, propagationTimeout, func() (interface{}, error) {
+	_, err = tfresource.RetryUntilNotFound(ctx, ec2PropagationTimeout, func() (interface{}, error) {
 		return FindSecurityGroupByID(ctx, conn, d.Id())
 	})
 
diff --git a/internal/service/ec2/vpc_security_group_data_source.go b/internal/service/ec2/vpc_security_group_data_source.go
index aa9b38cc273..29e1d0f63d2 100644
--- a/internal/service/ec2/vpc_security_group_data_source.go
+++ b/internal/service/ec2/vpc_security_group_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/vpc_security_group_data_source_test.go b/internal/service/ec2/vpc_security_group_data_source_test.go
index 6c7e6c3e0a6..50b184802e7 100644
--- a/internal/service/ec2/vpc_security_group_data_source_test.go
+++ b/internal/service/ec2/vpc_security_group_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/vpc_security_group_egress_rule.go b/internal/service/ec2/vpc_security_group_egress_rule.go
index 0c7e40aef3a..3bd4bf886f6 100644
--- a/internal/service/ec2/vpc_security_group_egress_rule.go
+++ b/internal/service/ec2/vpc_security_group_egress_rule.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -6,7 +9,7 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform-plugin-framework/resource"
-	"github.com/hashicorp/terraform-provider-aws/internal/flex"
+	"github.com/hashicorp/terraform-provider-aws/internal/framework/flex"
 )
 
 // @FrameworkResource(name="Security Group Egress Rule")
diff --git a/internal/service/ec2/vpc_security_group_egress_rule_test.go b/internal/service/ec2/vpc_security_group_egress_rule_test.go
index 60cdf09ee49..1666628e3df 100644
--- a/internal/service/ec2/vpc_security_group_egress_rule_test.go
+++ b/internal/service/ec2/vpc_security_group_egress_rule_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/vpc_security_group_ingress_rule.go b/internal/service/ec2/vpc_security_group_ingress_rule.go
index 07baa5d9fd0..0b867c6616a 100644
--- a/internal/service/ec2/vpc_security_group_ingress_rule.go
+++ b/internal/service/ec2/vpc_security_group_ingress_rule.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -19,8 +22,8 @@ import (
 	"github.com/hashicorp/terraform-plugin-framework/schema/validator"
 	"github.com/hashicorp/terraform-plugin-framework/types"
 	"github.com/hashicorp/terraform-plugin-log/tflog"
-	"github.com/hashicorp/terraform-provider-aws/internal/flex"
 	"github.com/hashicorp/terraform-provider-aws/internal/framework"
+	"github.com/hashicorp/terraform-provider-aws/internal/framework/flex"
 	fwvalidators "github.com/hashicorp/terraform-provider-aws/internal/framework/validators"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
@@ -134,7 +137,7 @@ func (r *resourceSecurityGroupRule) Schema(ctx context.Context, req resource.Sch
 				Optional: true,
 			},
 			"security_group_id": schema.StringAttribute{
-				Optional: true,
+				Required: true,
 				PlanModifiers: []planmodifier.String{
 					stringplanmodifier.RequiresReplace(),
 				},
@@ -177,8 +180,8 @@ func (r *resourceSecurityGroupRule) Create(ctx context.Context, request resource
 	data.ID = types.StringValue(securityGroupRuleID)
 
 	conn := r.Meta().EC2Conn(ctx)
-	if err := updateTags(ctx, conn, data.ID.ValueString(), nil, KeyValueTags(ctx, getTagsIn(ctx))); err != nil {
-		response.Diagnostics.AddError(fmt.Sprintf("adding VPC Security Group Rule (%s) tags", data.ID.ValueString()), err.Error())
+	if err := createTags(ctx, conn, data.ID.ValueString(), getTagsIn(ctx)); err != nil {
+		response.Diagnostics.AddError(fmt.Sprintf("setting VPC Security Group Rule (%s) tags", data.ID.ValueString()), err.Error())
 
 		return
 	}
diff --git a/internal/service/ec2/vpc_security_group_ingress_rule_test.go b/internal/service/ec2/vpc_security_group_ingress_rule_test.go
index 704ab35d0cd..c11c00eb069 100644
--- a/internal/service/ec2/vpc_security_group_ingress_rule_test.go
+++ b/internal/service/ec2/vpc_security_group_ingress_rule_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
 	"context"
 	"errors"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/google/go-cmp/cmp"
@@ -912,7 +915,7 @@ func TestAccVPCSecurityGroupIngressRule_ReferencedSecurityGroupID_peerVPC(t *tes
 					resource.TestCheckResourceAttr(resourceName, "from_port", "80"),
 					resource.TestCheckResourceAttr(resourceName, "ip_protocol", "tcp"),
 					resource.TestCheckNoResourceAttr(resourceName, "prefix_list_id"),
-					resource.TestMatchResourceAttr(resourceName, "referenced_security_group_id", regexp.MustCompile("^[0-9]{12}/sg-[0-9a-z]{17}$")),
+					resource.TestMatchResourceAttr(resourceName, "referenced_security_group_id", regexache.MustCompile("^[0-9]{12}/sg-[0-9a-z]{17}$")),
 					resource.TestCheckResourceAttrSet(resourceName, "security_group_rule_id"),
 					resource.TestCheckNoResourceAttr(resourceName, "tags"),
 					resource.TestCheckResourceAttr(resourceName, "to_port", "8080"),
diff --git a/internal/service/ec2/vpc_security_group_migrate.go b/internal/service/ec2/vpc_security_group_migrate.go
index a83fe431349..385baec959e 100644
--- a/internal/service/ec2/vpc_security_group_migrate.go
+++ b/internal/service/ec2/vpc_security_group_migrate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/vpc_security_group_migrate_test.go b/internal/service/ec2/vpc_security_group_migrate_test.go
index 51f789f405e..8d54ce6de9c 100644
--- a/internal/service/ec2/vpc_security_group_migrate_test.go
+++ b/internal/service/ec2/vpc_security_group_migrate_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/vpc_security_group_rule.go b/internal/service/ec2/vpc_security_group_rule.go
index ab79b04b71e..30f2264632d 100644
--- a/internal/service/ec2/vpc_security_group_rule.go
+++ b/internal/service/ec2/vpc_security_group_rule.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/vpc_security_group_rule_data_source.go b/internal/service/ec2/vpc_security_group_rule_data_source.go
index e834c193d38..ffa261acaf6 100644
--- a/internal/service/ec2/vpc_security_group_rule_data_source.go
+++ b/internal/service/ec2/vpc_security_group_rule_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -11,8 +14,8 @@ import (
 	"github.com/hashicorp/terraform-plugin-framework/datasource"
 	"github.com/hashicorp/terraform-plugin-framework/datasource/schema"
 	"github.com/hashicorp/terraform-plugin-framework/types"
-	"github.com/hashicorp/terraform-provider-aws/internal/flex"
 	"github.com/hashicorp/terraform-provider-aws/internal/framework"
+	"github.com/hashicorp/terraform-provider-aws/internal/framework/flex"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
diff --git a/internal/service/ec2/vpc_security_group_rule_data_source_test.go b/internal/service/ec2/vpc_security_group_rule_data_source_test.go
index 4e46a4e7a3c..7907d0dadb2 100644
--- a/internal/service/ec2/vpc_security_group_rule_data_source_test.go
+++ b/internal/service/ec2/vpc_security_group_rule_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/vpc_security_group_rule_migrate.go b/internal/service/ec2/vpc_security_group_rule_migrate.go
index 95e11eaafd3..f3b48fc5b06 100644
--- a/internal/service/ec2/vpc_security_group_rule_migrate.go
+++ b/internal/service/ec2/vpc_security_group_rule_migrate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/vpc_security_group_rule_migrate_test.go b/internal/service/ec2/vpc_security_group_rule_migrate_test.go
index 36ee22af7a5..f175474ebc7 100644
--- a/internal/service/ec2/vpc_security_group_rule_migrate_test.go
+++ b/internal/service/ec2/vpc_security_group_rule_migrate_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/vpc_security_group_rule_test.go b/internal/service/ec2/vpc_security_group_rule_test.go
index 35d2ff86577..26f1ef4bb68 100644
--- a/internal/service/ec2/vpc_security_group_rule_test.go
+++ b/internal/service/ec2/vpc_security_group_rule_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
 	"fmt"
-	"regexp"
 	"strconv"
 	"strings"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -179,7 +182,7 @@ func TestAccVPCSecurityGroupRule_IngressSourceWithAccount_id(t *testing.T) {
 					resource.TestCheckResourceAttrPair(resourceName, "security_group_id", sgResourceName, "id"),
 					resource.TestCheckResourceAttrSet(resourceName, "security_group_rule_id"),
 					resource.TestCheckResourceAttr(resourceName, "self", "false"),
-					resource.TestMatchResourceAttr(resourceName, "source_security_group_id", regexp.MustCompile("^[0-9]{12}/sg-[0-9a-z]{17}$")),
+					resource.TestMatchResourceAttr(resourceName, "source_security_group_id", regexache.MustCompile("^[0-9]{12}/sg-[0-9a-z]{17}$")),
 					resource.TestCheckResourceAttr(resourceName, "to_port", "0"),
 					resource.TestCheckResourceAttr(resourceName, "type", "ingress"),
 				),
@@ -409,7 +412,7 @@ func TestAccVPCSecurityGroupRule_expectInvalidTypeError(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccVPCSecurityGroupRuleConfig_expectInvalidType(rName),
-				ExpectError: regexp.MustCompile(`expected type to be one of \[egress ingress\]`),
+				ExpectError: regexache.MustCompile(`expected type to be one of \[egress ingress\]`),
 			},
 		},
 	})
@@ -427,11 +430,11 @@ func TestAccVPCSecurityGroupRule_expectInvalidCIDR(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccVPCSecurityGroupRuleConfig_invalidIPv4CIDR(rName),
-				ExpectError: regexp.MustCompile("invalid CIDR address: 1.2.3.4/33"),
+				ExpectError: regexache.MustCompile("invalid CIDR address: 1.2.3.4/33"),
 			},
 			{
 				Config:      testAccVPCSecurityGroupRuleConfig_invalidIPv6CIDR(rName),
-				ExpectError: regexp.MustCompile("invalid CIDR address: ::/244"),
+				ExpectError: regexache.MustCompile("invalid CIDR address: ::/244"),
 			},
 		},
 	})
@@ -689,7 +692,7 @@ func TestAccVPCSecurityGroupRule_prefixListEmptyString(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccVPCSecurityGroupRuleConfig_prefixListEmptyString(rName),
-				ExpectError: regexp.MustCompile(`prefix_list_ids.0 must not be empty`),
+				ExpectError: regexache.MustCompile(`prefix_list_ids.0 must not be empty`),
 			},
 		},
 	})
diff --git a/internal/service/ec2/vpc_security_group_rules_data_source.go b/internal/service/ec2/vpc_security_group_rules_data_source.go
index fca76fe166a..8c66dcc1fe3 100644
--- a/internal/service/ec2/vpc_security_group_rules_data_source.go
+++ b/internal/service/ec2/vpc_security_group_rules_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -8,8 +11,8 @@ import (
 	"github.com/hashicorp/terraform-plugin-framework/datasource"
 	"github.com/hashicorp/terraform-plugin-framework/datasource/schema"
 	"github.com/hashicorp/terraform-plugin-framework/types"
-	"github.com/hashicorp/terraform-provider-aws/internal/flex"
 	"github.com/hashicorp/terraform-provider-aws/internal/framework"
+	"github.com/hashicorp/terraform-provider-aws/internal/framework/flex"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 )
 
diff --git a/internal/service/ec2/vpc_security_group_rules_data_source_test.go b/internal/service/ec2/vpc_security_group_rules_data_source_test.go
index 6e5132a8db7..8b1ffacfeef 100644
--- a/internal/service/ec2/vpc_security_group_rules_data_source_test.go
+++ b/internal/service/ec2/vpc_security_group_rules_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/vpc_security_group_rules_matching_test.go b/internal/service/ec2/vpc_security_group_rules_matching_test.go
index cdf88f52f89..2bb30d811c1 100644
--- a/internal/service/ec2/vpc_security_group_rules_matching_test.go
+++ b/internal/service/ec2/vpc_security_group_rules_matching_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/vpc_security_group_test.go b/internal/service/ec2/vpc_security_group_test.go
index b6c9d829838..02be1f4c74c 100644
--- a/internal/service/ec2/vpc_security_group_test.go
+++ b/internal/service/ec2/vpc_security_group_test.go
@@ -1,14 +1,17 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
 	"context"
 	"fmt"
 	"reflect"
-	"regexp"
 	"strconv"
 	"strings"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
@@ -886,7 +889,7 @@ func TestAccVPCSecurityGroup_basic(t *testing.T) {
 				Config: testAccVPCSecurityGroupConfig_name(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckSecurityGroupExists(ctx, resourceName, &group),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexp.MustCompile(`security-group/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`security-group/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "description", "Managed by Terraform"),
 					resource.TestCheckResourceAttr(resourceName, "egress.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "ingress.#", "0"),
@@ -1483,7 +1486,7 @@ func TestAccVPCSecurityGroup_forceRevokeRulesTrue(t *testing.T) {
 			// DependencyViolation error
 			{
 				Config:      testAccVPCSecurityGroupConfig_revokeBaseRemoved(rName),
-				ExpectError: regexp.MustCompile("DependencyViolation"),
+				ExpectError: regexache.MustCompile("DependencyViolation"),
 			},
 			// Restore the config (a no-op plan) but also remove the dependencies
 			// between the groups with testRemoveCycle
@@ -1571,7 +1574,7 @@ func TestAccVPCSecurityGroup_forceRevokeRulesFalse(t *testing.T) {
 			// DependencyViolation error
 			{
 				Config:      testAccVPCSecurityGroupConfig_revokeBaseRemoved(rName),
-				ExpectError: regexp.MustCompile("DependencyViolation"),
+				ExpectError: regexache.MustCompile("DependencyViolation"),
 			},
 			// Restore the config (a no-op plan) but also remove the dependencies
 			// between the groups with testRemoveCycle
@@ -2178,19 +2181,19 @@ func TestAccVPCSecurityGroup_invalidCIDRBlock(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccVPCSecurityGroupConfig_invalidIngressCIDR,
-				ExpectError: regexp.MustCompile("invalid CIDR address: 1.2.3.4/33"),
+				ExpectError: regexache.MustCompile("invalid CIDR address: 1.2.3.4/33"),
 			},
 			{
 				Config:      testAccVPCSecurityGroupConfig_invalidEgressCIDR,
-				ExpectError: regexp.MustCompile("invalid CIDR address: 1.2.3.4/33"),
+				ExpectError: regexache.MustCompile("invalid CIDR address: 1.2.3.4/33"),
 			},
 			{
 				Config:      testAccVPCSecurityGroupConfig_invalidIPv6IngressCIDR,
-				ExpectError: regexp.MustCompile("invalid CIDR address: ::/244"),
+				ExpectError: regexache.MustCompile("invalid CIDR address: ::/244"),
 			},
 			{
 				Config:      testAccVPCSecurityGroupConfig_invalidIPv6EgressCIDR,
-				ExpectError: regexp.MustCompile("invalid CIDR address: ::/244"),
+				ExpectError: regexache.MustCompile("invalid CIDR address: ::/244"),
 			},
 		},
 	})
@@ -2466,7 +2469,7 @@ func TestAccVPCSecurityGroup_RuleLimit_exceededAppend(t *testing.T) {
 			// append a rule to step over the limit
 			{
 				Config:      testAccVPCSecurityGroupConfig_ruleLimit(rName, 0, ruleLimit+1),
-				ExpectError: regexp.MustCompile("RulesPerSecurityGroupLimitExceeded"),
+				ExpectError: regexache.MustCompile("RulesPerSecurityGroupLimitExceeded"),
 			},
 			{
 				PreConfig: func() {
@@ -2515,7 +2518,7 @@ func TestAccVPCSecurityGroup_RuleLimit_cidrBlockExceededAppend(t *testing.T) {
 			// append a rule to step over the limit
 			{
 				Config:      testAccVPCSecurityGroupConfig_cidrBlockRuleLimit(rName, 0, ruleLimit+1),
-				ExpectError: regexp.MustCompile("RulesPerSecurityGroupLimitExceeded"),
+				ExpectError: regexache.MustCompile("RulesPerSecurityGroupLimitExceeded"),
 			},
 			{
 				PreConfig: func() {
@@ -2579,7 +2582,7 @@ func TestAccVPCSecurityGroup_RuleLimit_exceededPrepend(t *testing.T) {
 			// prepend a rule to step over the limit
 			{
 				Config:      testAccVPCSecurityGroupConfig_ruleLimit(rName, 1, ruleLimit+1),
-				ExpectError: regexp.MustCompile("RulesPerSecurityGroupLimitExceeded"),
+				ExpectError: regexache.MustCompile("RulesPerSecurityGroupLimitExceeded"),
 			},
 			{
 				PreConfig: func() {
@@ -2627,7 +2630,7 @@ func TestAccVPCSecurityGroup_RuleLimit_exceededAllNew(t *testing.T) {
 			// add a rule to step over the limit with entirely new rules
 			{
 				Config:      testAccVPCSecurityGroupConfig_ruleLimit(rName, 100, ruleLimit+1),
-				ExpectError: regexp.MustCompile("RulesPerSecurityGroupLimitExceeded"),
+				ExpectError: regexache.MustCompile("RulesPerSecurityGroupLimitExceeded"),
 			},
 			{
 				// all the rules should have been revoked and the add failed
@@ -2670,7 +2673,7 @@ func TestAccVPCSecurityGroup_rulesDropOnError(t *testing.T) {
 			// Add a bad rule to trigger API error
 			{
 				Config:      testAccVPCSecurityGroupConfig_rulesDropOnErrorAddBadRule(rName),
-				ExpectError: regexp.MustCompile("InvalidGroupId.Malformed"),
+				ExpectError: regexache.MustCompile("InvalidGroupId.Malformed"),
 			},
 			// All originally added rules must survive. This will return non-empty plan if anything changed.
 			{
@@ -2706,7 +2709,7 @@ func TestAccVPCSecurityGroup_emrDependencyViolation(t *testing.T) {
 				Config: testAccVPCSecurityGroupConfig_emrLinkedRulesDestroy(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckSecurityGroupExists(ctx, resourceName, &group),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexp.MustCompile(`security-group/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`security-group/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "egress.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "ingress.#", "1"),
 					acctest.CheckResourceAttrAccountID(resourceName, "owner_id"),
@@ -2714,7 +2717,7 @@ func TestAccVPCSecurityGroup_emrDependencyViolation(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 					resource.TestCheckResourceAttrPair(resourceName, "vpc_id", "aws_vpc.test", "id"),
 				),
-				ExpectError: regexp.MustCompile("unexpected state"),
+				ExpectError: regexache.MustCompile("unexpected state"),
 			},
 		},
 	})
diff --git a/internal/service/ec2/vpc_security_groups_data_source.go b/internal/service/ec2/vpc_security_groups_data_source.go
index 9d2bce1e201..aa5ee9ddfb1 100644
--- a/internal/service/ec2/vpc_security_groups_data_source.go
+++ b/internal/service/ec2/vpc_security_groups_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -29,7 +32,7 @@ func DataSourceSecurityGroups() *schema.Resource {
 				Computed: true,
 				Elem:     &schema.Schema{Type: schema.TypeString},
 			},
-			"filter": DataSourceFiltersSchema(),
+			"filter": CustomFiltersSchema(),
 			"ids": {
 				Type:     schema.TypeList,
 				Computed: true,
@@ -54,7 +57,7 @@ func dataSourceSecurityGroupsRead(ctx context.Context, d *schema.ResourceData, m
 		Tags(tftags.New(ctx, d.Get("tags").(map[string]interface{}))),
 	)...)
 
-	input.Filters = append(input.Filters, BuildFiltersDataSource(
+	input.Filters = append(input.Filters, BuildCustomFilterList(
 		d.Get("filter").(*schema.Set),
 	)...)
 
diff --git a/internal/service/ec2/vpc_security_groups_data_source_test.go b/internal/service/ec2/vpc_security_groups_data_source_test.go
index 7bfbad0ea62..422ab006676 100644
--- a/internal/service/ec2/vpc_security_groups_data_source_test.go
+++ b/internal/service/ec2/vpc_security_groups_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/vpc_subnet.go b/internal/service/ec2/vpc_subnet.go
index bcf0140591f..44e3c841979 100644
--- a/internal/service/ec2/vpc_subnet.go
+++ b/internal/service/ec2/vpc_subnet.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -225,7 +228,7 @@ func resourceSubnetRead(ctx context.Context, d *schema.ResourceData, meta interf
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).EC2Conn(ctx)
 
-	outputRaw, err := tfresource.RetryWhenNewResourceNotFound(ctx, SubnetPropagationTimeout, func() (interface{}, error) {
+	outputRaw, err := tfresource.RetryWhenNewResourceNotFound(ctx, ec2PropagationTimeout, func() (interface{}, error) {
 		return FindSubnetByID(ctx, conn, d.Id())
 	}, d.IsNewResource())
 
@@ -297,6 +300,20 @@ func resourceSubnetUpdate(ctx context.Context, d *schema.ResourceData, meta inte
 		}
 	}
 
+	// If we're disabling IPv6 assignment for new ENIs, do that before modifying the IPv6 CIDR block.
+	if d.HasChange("assign_ipv6_address_on_creation") && !d.Get("assign_ipv6_address_on_creation").(bool) {
+		if err := modifySubnetAssignIPv6AddressOnCreation(ctx, conn, d.Id(), false); err != nil {
+			return sdkdiag.AppendFromErr(diags, err)
+		}
+	}
+
+	// If we're enabling dns64 and resource_name_dns_aaaa_record_on_launch, do that after modifying the IPv6 CIDR block.
+	if d.HasChange("ipv6_cidr_block") {
+		if err := modifySubnetIPv6CIDRBlockAssociation(ctx, conn, d.Id(), d.Get("ipv6_cidr_block_association_id").(string), d.Get("ipv6_cidr_block").(string)); err != nil {
+			return sdkdiag.AppendFromErr(diags, err)
+		}
+	}
+
 	if d.HasChange("enable_dns64") {
 		if err := modifySubnetEnableDNS64(ctx, conn, d.Id(), d.Get("enable_dns64").(bool)); err != nil {
 			return sdkdiag.AppendFromErr(diags, err)
@@ -333,19 +350,6 @@ func resourceSubnetUpdate(ctx context.Context, d *schema.ResourceData, meta inte
 		}
 	}
 
-	// If we're disabling IPv6 assignment for new ENIs, do that before modifying the IPv6 CIDR block.
-	if d.HasChange("assign_ipv6_address_on_creation") && !d.Get("assign_ipv6_address_on_creation").(bool) {
-		if err := modifySubnetAssignIPv6AddressOnCreation(ctx, conn, d.Id(), false); err != nil {
-			return sdkdiag.AppendFromErr(diags, err)
-		}
-	}
-
-	if d.HasChange("ipv6_cidr_block") {
-		if err := modifySubnetIPv6CIDRBlockAssociation(ctx, conn, d.Id(), d.Get("ipv6_cidr_block_association_id").(string), d.Get("ipv6_cidr_block").(string)); err != nil {
-			return sdkdiag.AppendFromErr(diags, err)
-		}
-	}
-
 	// If we're enabling IPv6 assignment for new ENIs, do that after modifying the IPv6 CIDR block.
 	if d.HasChange("assign_ipv6_address_on_creation") && d.Get("assign_ipv6_address_on_creation").(bool) {
 		if err := modifySubnetAssignIPv6AddressOnCreation(ctx, conn, d.Id(), true); err != nil {
diff --git a/internal/service/ec2/vpc_subnet_cidr_reservation.go b/internal/service/ec2/vpc_subnet_cidr_reservation.go
index 3bc7b73cc33..6a3c06368f8 100644
--- a/internal/service/ec2/vpc_subnet_cidr_reservation.go
+++ b/internal/service/ec2/vpc_subnet_cidr_reservation.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/vpc_subnet_cidr_reservation_test.go b/internal/service/ec2/vpc_subnet_cidr_reservation_test.go
index 32e9d9aaf25..eeafc378eb6 100644
--- a/internal/service/ec2/vpc_subnet_cidr_reservation_test.go
+++ b/internal/service/ec2/vpc_subnet_cidr_reservation_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/vpc_subnet_data_source.go b/internal/service/ec2/vpc_subnet_data_source.go
index 09465ab374f..4f87e826a42 100644
--- a/internal/service/ec2/vpc_subnet_data_source.go
+++ b/internal/service/ec2/vpc_subnet_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/vpc_subnet_data_source_test.go b/internal/service/ec2/vpc_subnet_data_source_test.go
index c0f2d1776d3..767513f3154 100644
--- a/internal/service/ec2/vpc_subnet_data_source_test.go
+++ b/internal/service/ec2/vpc_subnet_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/vpc_subnet_migrate.go b/internal/service/ec2/vpc_subnet_migrate.go
index 554dee657be..c5b5575cd21 100644
--- a/internal/service/ec2/vpc_subnet_migrate.go
+++ b/internal/service/ec2/vpc_subnet_migrate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/vpc_subnet_migrate_test.go b/internal/service/ec2/vpc_subnet_migrate_test.go
index 1be26e60b41..087ec548eb5 100644
--- a/internal/service/ec2/vpc_subnet_migrate_test.go
+++ b/internal/service/ec2/vpc_subnet_migrate_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/vpc_subnet_test.go b/internal/service/ec2/vpc_subnet_test.go
index aecdb8391fb..f9a809ed1e4 100644
--- a/internal/service/ec2/vpc_subnet_test.go
+++ b/internal/service/ec2/vpc_subnet_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -33,7 +36,7 @@ func TestAccVPCSubnet_basic(t *testing.T) {
 				Config: testAccVPCSubnetConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckSubnetExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexp.MustCompile(`subnet/subnet-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`subnet/subnet-.+`)),
 					resource.TestCheckResourceAttrSet(resourceName, "availability_zone"),
 					resource.TestCheckResourceAttrSet(resourceName, "availability_zone_id"),
 					resource.TestCheckResourceAttr(resourceName, "cidr_block", "10.1.1.0/24"),
@@ -796,6 +799,42 @@ func TestAccVPCSubnet_enableDNS64(t *testing.T) {
 	})
 }
 
+func TestAccVPCSubnet_ipv4ToIPv6(t *testing.T) {
+	ctx := acctest.Context(t)
+	var subnet ec2.Subnet
+	resourceName := "aws_subnet.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, ec2.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckSubnetDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccVPCSubnetConfig_ipv4ToIPv6Before(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckSubnetExists(ctx, resourceName, &subnet),
+					resource.TestCheckResourceAttr(resourceName, "assign_ipv6_address_on_creation", "false"),
+					resource.TestCheckResourceAttr(resourceName, "enable_dns64", "false"),
+					resource.TestCheckResourceAttr(resourceName, "enable_resource_name_dns_aaaa_record_on_launch", "false"),
+					resource.TestCheckResourceAttr(resourceName, "ipv6_cidr_block", ""),
+				),
+			},
+			{
+				Config: testAccVPCSubnetConfig_ipv4ToIPv6After(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckSubnetExists(ctx, resourceName, &subnet),
+					resource.TestCheckResourceAttr(resourceName, "assign_ipv6_address_on_creation", "true"),
+					resource.TestCheckResourceAttr(resourceName, "enable_dns64", "true"),
+					resource.TestCheckResourceAttr(resourceName, "enable_resource_name_dns_aaaa_record_on_launch", "true"),
+					resource.TestCheckResourceAttrSet(resourceName, "ipv6_cidr_block"),
+				),
+			},
+		},
+	})
+}
+
 func TestAccVPCSubnet_enableLNIAtDeviceIndex(t *testing.T) {
 	ctx := acctest.Context(t)
 	var subnet ec2.Subnet
@@ -1494,3 +1533,55 @@ resource "aws_subnet" "test" {
 }
 `, rName)
 }
+
+func testAccVPCSubnetConfig_ipv4ToIPv6Before(rName string) string {
+	return fmt.Sprintf(`
+resource "aws_vpc" "test" {
+  cidr_block                       = "10.10.0.0/16"
+  assign_generated_ipv6_cidr_block = false
+
+  tags = {
+    Name = %[1]q
+  }
+}
+
+resource "aws_subnet" "test" {
+  assign_ipv6_address_on_creation                = false
+  cidr_block                                     = cidrsubnet(aws_vpc.test.cidr_block, 8, 1)
+  enable_dns64                                   = false
+  enable_resource_name_dns_aaaa_record_on_launch = false
+  ipv6_cidr_block                                = null
+  vpc_id                                         = aws_vpc.test.id
+
+  tags = {
+    Name = %[1]q
+  }
+}
+`, rName)
+}
+
+func testAccVPCSubnetConfig_ipv4ToIPv6After(rName string) string {
+	return fmt.Sprintf(`
+resource "aws_vpc" "test" {
+  cidr_block                       = "10.10.0.0/16"
+  assign_generated_ipv6_cidr_block = true
+
+  tags = {
+    Name = %[1]q
+  }
+}
+
+resource "aws_subnet" "test" {
+  assign_ipv6_address_on_creation                = true
+  cidr_block                                     = cidrsubnet(aws_vpc.test.cidr_block, 8, 1)
+  enable_dns64                                   = true
+  enable_resource_name_dns_aaaa_record_on_launch = true
+  ipv6_cidr_block                                = cidrsubnet(aws_vpc.test.ipv6_cidr_block, 8, 1)
+  vpc_id                                         = aws_vpc.test.id
+
+  tags = {
+    Name = %[1]q
+  }
+}
+`, rName)
+}
diff --git a/internal/service/ec2/vpc_subnets_data_source.go b/internal/service/ec2/vpc_subnets_data_source.go
index 8c6e62499c9..5d12dd014a3 100644
--- a/internal/service/ec2/vpc_subnets_data_source.go
+++ b/internal/service/ec2/vpc_subnets_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -23,7 +26,7 @@ func DataSourceSubnets() *schema.Resource {
 		},
 
 		Schema: map[string]*schema.Schema{
-			"filter": DataSourceFiltersSchema(),
+			"filter": CustomFiltersSchema(),
 			"ids": {
 				Type:     schema.TypeList,
 				Computed: true,
@@ -48,7 +51,7 @@ func dataSourceSubnetsRead(ctx context.Context, d *schema.ResourceData, meta int
 
 	if filters, filtersOk := d.GetOk("filter"); filtersOk {
 		input.Filters = append(input.Filters,
-			BuildFiltersDataSource(filters.(*schema.Set))...)
+			BuildCustomFilterList(filters.(*schema.Set))...)
 	}
 
 	if len(input.Filters) == 0 {
diff --git a/internal/service/ec2/vpc_subnets_data_source_test.go b/internal/service/ec2/vpc_subnets_data_source_test.go
index e22667905f8..cb6a1155c68 100644
--- a/internal/service/ec2/vpc_subnets_data_source_test.go
+++ b/internal/service/ec2/vpc_subnets_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/vpc_test.go b/internal/service/ec2/vpc_test.go
index 8a35f89928e..789c1cc688e 100644
--- a/internal/service/ec2/vpc_test.go
+++ b/internal/service/ec2/vpc_test.go
@@ -1,15 +1,18 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"strings"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/aws"
+	"github.com/YakDriver/regexache"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	awstypes "github.com/aws/aws-sdk-go-v2/service/ec2/types"
 	"github.com/aws/aws-sdk-go/aws/endpoints"
-	"github.com/aws/aws-sdk-go/service/ec2"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
@@ -17,24 +20,25 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	tfec2 "github.com/hashicorp/terraform-provider-aws/internal/service/ec2"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
 func TestAccVPC_basic(t *testing.T) {
 	ctx := acctest.Context(t)
-	var vpc ec2.Vpc
+	var vpc awstypes.Vpc
 	resourceName := "aws_vpc.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, ec2.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckVPCDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccVPCConfig_basic,
 				Check: resource.ComposeAggregateTestCheckFunc(
-					acctest.CheckVPCExists(ctx, resourceName, &vpc),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexp.MustCompile(`vpc/vpc-.+`)),
+					acctest.CheckVPCExistsV2(ctx, resourceName, &vpc),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`vpc/vpc-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "assign_generated_ipv6_cidr_block", "false"),
 					resource.TestCheckResourceAttr(resourceName, "cidr_block", "10.1.0.0/16"),
 					resource.TestCheckResourceAttrSet(resourceName, "default_network_acl_id"),
@@ -68,19 +72,19 @@ func TestAccVPC_basic(t *testing.T) {
 
 func TestAccVPC_disappears(t *testing.T) {
 	ctx := acctest.Context(t)
-	var vpc ec2.Vpc
+	var vpc awstypes.Vpc
 	resourceName := "aws_vpc.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, ec2.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.EC2),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckVPCDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccVPCConfig_basic,
 				Check: resource.ComposeTestCheckFunc(
-					acctest.CheckVPCExists(ctx, resourceName, &vpc),
+					acctest.CheckVPCExistsV2(ctx, resourceName, &vpc),
 					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfec2.ResourceVPC(), resourceName),
 				),
 				ExpectNonEmptyPlan: true,
@@ -91,19 +95,19 @@ func TestAccVPC_disappears(t *testing.T) {
 
 func TestAccVPC_tags(t *testing.T) {
 	ctx := acctest.Context(t)
-	var vpc ec2.Vpc
+	var vpc1, vpc2, vpc3 awstypes.Vpc
 	resourceName := "aws_vpc.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, ec2.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.EC2),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckVPCDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccVPCConfig_tags1("key1", "value1"),
 				Check: resource.ComposeTestCheckFunc(
-					acctest.CheckVPCExists(ctx, resourceName, &vpc),
+					acctest.CheckVPCExistsV2(ctx, resourceName, &vpc1),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
 				),
@@ -116,7 +120,8 @@ func TestAccVPC_tags(t *testing.T) {
 			{
 				Config: testAccVPCConfig_tags2("key1", "value1updated", "key2", "value2"),
 				Check: resource.ComposeTestCheckFunc(
-					acctest.CheckVPCExists(ctx, resourceName, &vpc),
+					acctest.CheckVPCExistsV2(ctx, resourceName, &vpc2),
+					testAccCheckVPCIDsEqual(&vpc2, &vpc1),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1updated"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
@@ -125,7 +130,8 @@ func TestAccVPC_tags(t *testing.T) {
 			{
 				Config: testAccVPCConfig_tags1("key2", "value2"),
 				Check: resource.ComposeTestCheckFunc(
-					acctest.CheckVPCExists(ctx, resourceName, &vpc),
+					acctest.CheckVPCExistsV2(ctx, resourceName, &vpc3),
+					testAccCheckVPCIDsEqual(&vpc3, &vpc2),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
 				),
@@ -136,19 +142,19 @@ func TestAccVPC_tags(t *testing.T) {
 
 func TestAccVPC_tags_computed(t *testing.T) {
 	ctx := acctest.Context(t)
-	var vpc ec2.Vpc
+	var vpc awstypes.Vpc
 	resourceName := "aws_vpc.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, ec2.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.EC2),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckVPCDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccVPCConfig_tags_computed,
 				Check: resource.ComposeTestCheckFunc(
-					acctest.CheckVPCExists(ctx, resourceName, &vpc),
+					acctest.CheckVPCExistsV2(ctx, resourceName, &vpc),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 					resource.TestCheckResourceAttrSet(resourceName, "tags.eip"),
 				),
@@ -159,19 +165,19 @@ func TestAccVPC_tags_computed(t *testing.T) {
 
 func TestAccVPC_tags_null(t *testing.T) {
 	ctx := acctest.Context(t)
-	var vpc ec2.Vpc
+	var vpc awstypes.Vpc
 	resourceName := "aws_vpc.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, ec2.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.EC2),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckVPCDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccVPCConfig_tags_null,
 				Check: resource.ComposeTestCheckFunc(
-					acctest.CheckVPCExists(ctx, resourceName, &vpc),
+					acctest.CheckVPCExistsV2(ctx, resourceName, &vpc),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 				),
 			},
@@ -181,12 +187,12 @@ func TestAccVPC_tags_null(t *testing.T) {
 
 func TestAccVPC_DefaultTags_zeroValue(t *testing.T) {
 	ctx := acctest.Context(t)
-	var vpc ec2.Vpc
+	var vpc awstypes.Vpc
 	resourceName := "aws_vpc.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, ec2.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.EC2),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckVPCDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -196,7 +202,7 @@ func TestAccVPC_DefaultTags_zeroValue(t *testing.T) {
 					testAccVPCConfig_basic,
 				),
 				Check: resource.ComposeTestCheckFunc(
-					acctest.CheckVPCExists(ctx, resourceName, &vpc),
+					acctest.CheckVPCExistsV2(ctx, resourceName, &vpc),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 					resource.TestCheckResourceAttr(resourceName, "tags_all.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags_all.key1", ""),
@@ -208,7 +214,7 @@ func TestAccVPC_DefaultTags_zeroValue(t *testing.T) {
 					testAccVPCConfig_tags1("key2", ""),
 				),
 				Check: resource.ComposeTestCheckFunc(
-					acctest.CheckVPCExists(ctx, resourceName, &vpc),
+					acctest.CheckVPCExistsV2(ctx, resourceName, &vpc),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags_all.%", "2"),
 					resource.TestCheckResourceAttr(resourceName, "tags_all.key1", ""),
@@ -221,7 +227,7 @@ func TestAccVPC_DefaultTags_zeroValue(t *testing.T) {
 					testAccVPCConfig_tags1("key2", ""),
 				),
 				Check: resource.ComposeTestCheckFunc(
-					acctest.CheckVPCExists(ctx, resourceName, &vpc),
+					acctest.CheckVPCExistsV2(ctx, resourceName, &vpc),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags_all.%", "2"),
 					resource.TestCheckResourceAttr(resourceName, "tags_all.key1", "value1"),
@@ -234,12 +240,12 @@ func TestAccVPC_DefaultTags_zeroValue(t *testing.T) {
 
 func TestAccVPC_DefaultTags_providerOnlyTestAccVPC_DefaultTags_providerOnly(t *testing.T) {
 	ctx := acctest.Context(t)
-	var vpc ec2.Vpc
+	var vpc awstypes.Vpc
 	resourceName := "aws_vpc.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, ec2.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.EC2),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckVPCDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -249,7 +255,7 @@ func TestAccVPC_DefaultTags_providerOnlyTestAccVPC_DefaultTags_providerOnly(t *t
 					testAccVPCConfig_basic,
 				),
 				Check: resource.ComposeTestCheckFunc(
-					acctest.CheckVPCExists(ctx, resourceName, &vpc),
+					acctest.CheckVPCExistsV2(ctx, resourceName, &vpc),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 					resource.TestCheckResourceAttr(resourceName, "tags_all.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags_all.providerkey1", "providervalue1"),
@@ -266,7 +272,7 @@ func TestAccVPC_DefaultTags_providerOnlyTestAccVPC_DefaultTags_providerOnly(t *t
 					testAccVPCConfig_basic,
 				),
 				Check: resource.ComposeTestCheckFunc(
-					acctest.CheckVPCExists(ctx, resourceName, &vpc),
+					acctest.CheckVPCExistsV2(ctx, resourceName, &vpc),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 					resource.TestCheckResourceAttr(resourceName, "tags_all.%", "2"),
 					resource.TestCheckResourceAttr(resourceName, "tags_all.providerkey1", "providervalue1"),
@@ -279,7 +285,7 @@ func TestAccVPC_DefaultTags_providerOnlyTestAccVPC_DefaultTags_providerOnly(t *t
 					testAccVPCConfig_basic,
 				),
 				Check: resource.ComposeTestCheckFunc(
-					acctest.CheckVPCExists(ctx, resourceName, &vpc),
+					acctest.CheckVPCExistsV2(ctx, resourceName, &vpc),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 					resource.TestCheckResourceAttr(resourceName, "tags_all.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags_all.providerkey1", "value1"),
@@ -291,19 +297,19 @@ func TestAccVPC_DefaultTags_providerOnlyTestAccVPC_DefaultTags_providerOnly(t *t
 
 func TestAccVPC_DefaultTags_updateToProviderOnly(t *testing.T) {
 	ctx := acctest.Context(t)
-	var vpc ec2.Vpc
+	var vpc awstypes.Vpc
 	resourceName := "aws_vpc.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, ec2.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.EC2),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckVPCDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccVPCConfig_tags1("key1", "value1"),
 				Check: resource.ComposeTestCheckFunc(
-					acctest.CheckVPCExists(ctx, resourceName, &vpc),
+					acctest.CheckVPCExistsV2(ctx, resourceName, &vpc),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags_all.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
@@ -316,7 +322,7 @@ func TestAccVPC_DefaultTags_updateToProviderOnly(t *testing.T) {
 					testAccVPCConfig_basic,
 				),
 				Check: resource.ComposeTestCheckFunc(
-					acctest.CheckVPCExists(ctx, resourceName, &vpc),
+					acctest.CheckVPCExistsV2(ctx, resourceName, &vpc),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 					resource.TestCheckResourceAttr(resourceName, "tags_all.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags_all.key1", "value1"),
@@ -333,12 +339,12 @@ func TestAccVPC_DefaultTags_updateToProviderOnly(t *testing.T) {
 
 func TestAccVPC_DefaultTags_updateToResourceOnly(t *testing.T) {
 	ctx := acctest.Context(t)
-	var vpc ec2.Vpc
+	var vpc awstypes.Vpc
 	resourceName := "aws_vpc.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, ec2.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.EC2),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckVPCDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -348,7 +354,7 @@ func TestAccVPC_DefaultTags_updateToResourceOnly(t *testing.T) {
 					testAccVPCConfig_basic,
 				),
 				Check: resource.ComposeTestCheckFunc(
-					acctest.CheckVPCExists(ctx, resourceName, &vpc),
+					acctest.CheckVPCExistsV2(ctx, resourceName, &vpc),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 					resource.TestCheckResourceAttr(resourceName, "tags_all.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags_all.key1", "value1"),
@@ -357,7 +363,7 @@ func TestAccVPC_DefaultTags_updateToResourceOnly(t *testing.T) {
 			{
 				Config: testAccVPCConfig_tags1("key1", "value1"),
 				Check: resource.ComposeTestCheckFunc(
-					acctest.CheckVPCExists(ctx, resourceName, &vpc),
+					acctest.CheckVPCExistsV2(ctx, resourceName, &vpc),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags_all.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
@@ -375,12 +381,12 @@ func TestAccVPC_DefaultTags_updateToResourceOnly(t *testing.T) {
 
 func TestAccVPC_DefaultTagsProviderAndResource_nonOverlappingTag(t *testing.T) {
 	ctx := acctest.Context(t)
-	var vpc ec2.Vpc
+	var vpc awstypes.Vpc
 	resourceName := "aws_vpc.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, ec2.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.EC2),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckVPCDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -390,7 +396,7 @@ func TestAccVPC_DefaultTagsProviderAndResource_nonOverlappingTag(t *testing.T) {
 					testAccVPCConfig_tags1("resourcekey1", "resourcevalue1"),
 				),
 				Check: resource.ComposeTestCheckFunc(
-					acctest.CheckVPCExists(ctx, resourceName, &vpc),
+					acctest.CheckVPCExistsV2(ctx, resourceName, &vpc),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags_all.%", "2"),
 					resource.TestCheckResourceAttr(resourceName, "tags.resourcekey1", "resourcevalue1"),
@@ -409,7 +415,7 @@ func TestAccVPC_DefaultTagsProviderAndResource_nonOverlappingTag(t *testing.T) {
 					testAccVPCConfig_tags2("resourcekey1", "resourcevalue1", "resourcekey2", "resourcevalue2"),
 				),
 				Check: resource.ComposeTestCheckFunc(
-					acctest.CheckVPCExists(ctx, resourceName, &vpc),
+					acctest.CheckVPCExistsV2(ctx, resourceName, &vpc),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
 					resource.TestCheckResourceAttr(resourceName, "tags_all.%", "3"),
 					resource.TestCheckResourceAttr(resourceName, "tags.resourcekey1", "resourcevalue1"),
@@ -425,7 +431,7 @@ func TestAccVPC_DefaultTagsProviderAndResource_nonOverlappingTag(t *testing.T) {
 					testAccVPCConfig_tags1("resourcekey3", "resourcevalue3"),
 				),
 				Check: resource.ComposeTestCheckFunc(
-					acctest.CheckVPCExists(ctx, resourceName, &vpc),
+					acctest.CheckVPCExistsV2(ctx, resourceName, &vpc),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags_all.%", "2"),
 					resource.TestCheckResourceAttr(resourceName, "tags.resourcekey3", "resourcevalue3"),
@@ -439,12 +445,12 @@ func TestAccVPC_DefaultTagsProviderAndResource_nonOverlappingTag(t *testing.T) {
 
 func TestAccVPC_DefaultTagsProviderAndResource_overlappingTag(t *testing.T) {
 	ctx := acctest.Context(t)
-	var vpc ec2.Vpc
+	var vpc awstypes.Vpc
 	resourceName := "aws_vpc.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, ec2.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.EC2),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckVPCDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -454,7 +460,7 @@ func TestAccVPC_DefaultTagsProviderAndResource_overlappingTag(t *testing.T) {
 					testAccVPCConfig_tags1("overlapkey1", "resourcevalue1"),
 				),
 				Check: resource.ComposeTestCheckFunc(
-					acctest.CheckVPCExists(ctx, resourceName, &vpc),
+					acctest.CheckVPCExistsV2(ctx, resourceName, &vpc),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags_all.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags.overlapkey1", "resourcevalue1"),
@@ -471,7 +477,7 @@ func TestAccVPC_DefaultTagsProviderAndResource_overlappingTag(t *testing.T) {
 					testAccVPCConfig_tags2("overlapkey1", "resourcevalue1", "overlapkey2", "resourcevalue2"),
 				),
 				Check: resource.ComposeTestCheckFunc(
-					acctest.CheckVPCExists(ctx, resourceName, &vpc),
+					acctest.CheckVPCExistsV2(ctx, resourceName, &vpc),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
 					resource.TestCheckResourceAttr(resourceName, "tags_all.%", "2"),
 					resource.TestCheckResourceAttr(resourceName, "tags.overlapkey1", "resourcevalue1"),
@@ -486,7 +492,7 @@ func TestAccVPC_DefaultTagsProviderAndResource_overlappingTag(t *testing.T) {
 					testAccVPCConfig_tags1("overlapkey1", "resourcevalue2"),
 				),
 				Check: resource.ComposeTestCheckFunc(
-					acctest.CheckVPCExists(ctx, resourceName, &vpc),
+					acctest.CheckVPCExistsV2(ctx, resourceName, &vpc),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags_all.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags.overlapkey1", "resourcevalue2"),
@@ -499,12 +505,12 @@ func TestAccVPC_DefaultTagsProviderAndResource_overlappingTag(t *testing.T) {
 
 func TestAccVPC_DefaultTagsProviderAndResource_duplicateTag(t *testing.T) {
 	ctx := acctest.Context(t)
-	var vpc ec2.Vpc
+	var vpc awstypes.Vpc
 	resourceName := "aws_vpc.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, ec2.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.EC2),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             nil,
 		Steps: []resource.TestStep{
@@ -514,7 +520,7 @@ func TestAccVPC_DefaultTagsProviderAndResource_duplicateTag(t *testing.T) {
 					testAccVPCConfig_tags1("overlapkey", "overlapvalue"),
 				),
 				Check: resource.ComposeTestCheckFunc(
-					acctest.CheckVPCExists(ctx, resourceName, &vpc),
+					acctest.CheckVPCExistsV2(ctx, resourceName, &vpc),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags_all.%", "1"),
 				),
@@ -525,12 +531,12 @@ func TestAccVPC_DefaultTagsProviderAndResource_duplicateTag(t *testing.T) {
 
 func TestAccVPC_DefaultTagsProviderAndResource_moveDuplicateTags(t *testing.T) {
 	ctx := acctest.Context(t)
-	var vpc ec2.Vpc
+	var vpc awstypes.Vpc
 	resourceName := "aws_vpc.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, ec2.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.EC2),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             nil,
 		Steps: []resource.TestStep{
@@ -539,7 +545,7 @@ func TestAccVPC_DefaultTagsProviderAndResource_moveDuplicateTags(t *testing.T) {
 					testAccVPCConfig_tags1("overlapkey", "overlapvalue"),
 				),
 				Check: resource.ComposeTestCheckFunc(
-					acctest.CheckVPCExists(ctx, resourceName, &vpc),
+					acctest.CheckVPCExistsV2(ctx, resourceName, &vpc),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags_all.%", "1"),
 				),
@@ -550,7 +556,7 @@ func TestAccVPC_DefaultTagsProviderAndResource_moveDuplicateTags(t *testing.T) {
 					acctest.ConfigDefaultTags_Tags1("overlapkey", "overlapvalue"),
 				),
 				Check: resource.ComposeTestCheckFunc(
-					acctest.CheckVPCExists(ctx, resourceName, &vpc),
+					acctest.CheckVPCExistsV2(ctx, resourceName, &vpc),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 					resource.TestCheckResourceAttr(resourceName, "tags_all.%", "1"),
 				),
@@ -560,7 +566,7 @@ func TestAccVPC_DefaultTagsProviderAndResource_moveDuplicateTags(t *testing.T) {
 					testAccVPCConfig_tags1("overlapkey", "overlapvalue"),
 				),
 				Check: resource.ComposeTestCheckFunc(
-					acctest.CheckVPCExists(ctx, resourceName, &vpc),
+					acctest.CheckVPCExistsV2(ctx, resourceName, &vpc),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags_all.%", "1"),
 				),
@@ -576,19 +582,19 @@ func TestAccVPC_DefaultTagsProviderAndResource_moveDuplicateTags(t *testing.T) {
 // Reference: https://github.com/hashicorp/terraform-provider-aws/issues/18366
 func TestAccVPC_DynamicResourceTagsMergedWithLocals_ignoreChanges(t *testing.T) {
 	ctx := acctest.Context(t)
-	var vpc ec2.Vpc
+	var vpc awstypes.Vpc
 	resourceName := "aws_vpc.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, ec2.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.EC2),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckVPCDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccVPCConfig_ignoreChangesDynamicTagsMergedLocals("localkey", "localvalue"),
 				Check: resource.ComposeTestCheckFunc(
-					acctest.CheckVPCExists(ctx, resourceName, &vpc),
+					acctest.CheckVPCExistsV2(ctx, resourceName, &vpc),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "3"),
 					resource.TestCheckResourceAttr(resourceName, "tags.localkey", "localvalue"),
 					resource.TestCheckResourceAttrSet(resourceName, "tags.created_at"),
@@ -606,7 +612,7 @@ func TestAccVPC_DynamicResourceTagsMergedWithLocals_ignoreChanges(t *testing.T)
 			{
 				Config: testAccVPCConfig_ignoreChangesDynamicTagsMergedLocals("localkey", "localvalue"),
 				Check: resource.ComposeTestCheckFunc(
-					acctest.CheckVPCExists(ctx, resourceName, &vpc),
+					acctest.CheckVPCExistsV2(ctx, resourceName, &vpc),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "3"),
 					resource.TestCheckResourceAttr(resourceName, "tags.localkey", "localvalue"),
 					resource.TestCheckResourceAttrSet(resourceName, "tags.created_at"),
@@ -631,19 +637,19 @@ func TestAccVPC_DynamicResourceTagsMergedWithLocals_ignoreChanges(t *testing.T)
 // Reference: https://github.com/hashicorp/terraform-provider-aws/issues/18366
 func TestAccVPC_DynamicResourceTags_ignoreChanges(t *testing.T) {
 	ctx := acctest.Context(t)
-	var vpc ec2.Vpc
+	var vpc awstypes.Vpc
 	resourceName := "aws_vpc.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, ec2.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.EC2),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckVPCDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccVPCConfig_ignoreChangesDynamicTags,
 				Check: resource.ComposeTestCheckFunc(
-					acctest.CheckVPCExists(ctx, resourceName, &vpc),
+					acctest.CheckVPCExistsV2(ctx, resourceName, &vpc),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
 					resource.TestCheckResourceAttrSet(resourceName, "tags.created_at"),
 					resource.TestCheckResourceAttrSet(resourceName, "tags.updated_at"),
@@ -659,7 +665,7 @@ func TestAccVPC_DynamicResourceTags_ignoreChanges(t *testing.T) {
 			{
 				Config: testAccVPCConfig_ignoreChangesDynamicTags,
 				Check: resource.ComposeTestCheckFunc(
-					acctest.CheckVPCExists(ctx, resourceName, &vpc),
+					acctest.CheckVPCExistsV2(ctx, resourceName, &vpc),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
 					resource.TestCheckResourceAttrSet(resourceName, "tags.created_at"),
 					resource.TestCheckResourceAttrSet(resourceName, "tags.updated_at"),
@@ -677,19 +683,19 @@ func TestAccVPC_DynamicResourceTags_ignoreChanges(t *testing.T) {
 
 func TestAccVPC_defaultAndIgnoreTags(t *testing.T) {
 	ctx := acctest.Context(t)
-	var vpc ec2.Vpc
+	var vpc awstypes.Vpc
 	resourceName := "aws_vpc.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, ec2.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.EC2),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckVPCDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccVPCConfig_tags1("key1", "value1"),
 				Check: resource.ComposeTestCheckFunc(
-					acctest.CheckVPCExists(ctx, resourceName, &vpc),
+					acctest.CheckVPCExistsV2(ctx, resourceName, &vpc),
 					testAccCheckVPCUpdateTags(ctx, &vpc, nil, map[string]string{"defaultkey1": "defaultvalue1"}),
 				),
 				ExpectNonEmptyPlan: true,
@@ -714,19 +720,19 @@ func TestAccVPC_defaultAndIgnoreTags(t *testing.T) {
 
 func TestAccVPC_ignoreTags(t *testing.T) {
 	ctx := acctest.Context(t)
-	var vpc ec2.Vpc
+	var vpc awstypes.Vpc
 	resourceName := "aws_vpc.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, ec2.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.EC2),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckVPCDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccVPCConfig_tags1("key1", "value1"),
 				Check: resource.ComposeTestCheckFunc(
-					acctest.CheckVPCExists(ctx, resourceName, &vpc),
+					acctest.CheckVPCExistsV2(ctx, resourceName, &vpc),
 					testAccCheckVPCUpdateTags(ctx, &vpc, nil, map[string]string{"ignorekey1": "ignorevalue1"}),
 				),
 				ExpectNonEmptyPlan: true,
@@ -745,21 +751,21 @@ func TestAccVPC_ignoreTags(t *testing.T) {
 
 func TestAccVPC_tenancy(t *testing.T) {
 	ctx := acctest.Context(t)
-	var vpcDedicated ec2.Vpc
-	var vpcDefault ec2.Vpc
+	var vpcDedicated awstypes.Vpc
+	var vpcDefault awstypes.Vpc
 	resourceName := "aws_vpc.test"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, ec2.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.EC2),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckVPCDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccVPCConfig_dedicatedTenancy(rName),
 				Check: resource.ComposeTestCheckFunc(
-					acctest.CheckVPCExists(ctx, resourceName, &vpcDedicated),
+					acctest.CheckVPCExistsV2(ctx, resourceName, &vpcDedicated),
 					resource.TestCheckResourceAttr(resourceName, "instance_tenancy", "dedicated"),
 				),
 			},
@@ -771,7 +777,7 @@ func TestAccVPC_tenancy(t *testing.T) {
 			{
 				Config: testAccVPCConfig_default(rName),
 				Check: resource.ComposeTestCheckFunc(
-					acctest.CheckVPCExists(ctx, resourceName, &vpcDefault),
+					acctest.CheckVPCExistsV2(ctx, resourceName, &vpcDefault),
 					resource.TestCheckResourceAttr(resourceName, "instance_tenancy", "default"),
 					testAccCheckVPCIDsEqual(&vpcDedicated, &vpcDefault),
 				),
@@ -779,7 +785,7 @@ func TestAccVPC_tenancy(t *testing.T) {
 			{
 				Config: testAccVPCConfig_dedicatedTenancy(rName),
 				Check: resource.ComposeTestCheckFunc(
-					acctest.CheckVPCExists(ctx, resourceName, &vpcDedicated),
+					acctest.CheckVPCExistsV2(ctx, resourceName, &vpcDedicated),
 					resource.TestCheckResourceAttr(resourceName, "instance_tenancy", "dedicated"),
 					testAccCheckVPCIDsNotEqual(&vpcDedicated, &vpcDefault),
 				),
@@ -790,27 +796,27 @@ func TestAccVPC_tenancy(t *testing.T) {
 
 func TestAccVPC_updateDNSHostnames(t *testing.T) {
 	ctx := acctest.Context(t)
-	var vpc ec2.Vpc
+	var vpc awstypes.Vpc
 	resourceName := "aws_vpc.test"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, ec2.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.EC2),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckVPCDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccVPCConfig_default(rName),
 				Check: resource.ComposeTestCheckFunc(
-					acctest.CheckVPCExists(ctx, resourceName, &vpc),
+					acctest.CheckVPCExistsV2(ctx, resourceName, &vpc),
 					resource.TestCheckResourceAttr(resourceName, "enable_dns_hostnames", "false"),
 				),
 			},
 			{
 				Config: testAccVPCConfig_enableDNSHostnames(rName),
 				Check: resource.ComposeTestCheckFunc(
-					acctest.CheckVPCExists(ctx, resourceName, &vpc),
+					acctest.CheckVPCExistsV2(ctx, resourceName, &vpc),
 					resource.TestCheckResourceAttr(resourceName, "enable_dns_hostnames", "true"),
 				),
 			},
@@ -821,20 +827,20 @@ func TestAccVPC_updateDNSHostnames(t *testing.T) {
 // https://github.com/hashicorp/terraform/issues/1301
 func TestAccVPC_bothDNSOptionsSet(t *testing.T) {
 	ctx := acctest.Context(t)
-	var vpc ec2.Vpc
+	var vpc awstypes.Vpc
 	resourceName := "aws_vpc.test"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, ec2.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.EC2),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckVPCDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccVPCConfig_bothDNSOptions(rName),
 				Check: resource.ComposeTestCheckFunc(
-					acctest.CheckVPCExists(ctx, resourceName, &vpc),
+					acctest.CheckVPCExistsV2(ctx, resourceName, &vpc),
 					resource.TestCheckResourceAttr(resourceName, "enable_dns_hostnames", "true"),
 					resource.TestCheckResourceAttr(resourceName, "enable_dns_support", "true"),
 				),
@@ -851,20 +857,20 @@ func TestAccVPC_bothDNSOptionsSet(t *testing.T) {
 // https://github.com/hashicorp/terraform/issues/10168
 func TestAccVPC_disabledDNSSupport(t *testing.T) {
 	ctx := acctest.Context(t)
-	var vpc ec2.Vpc
+	var vpc awstypes.Vpc
 	resourceName := "aws_vpc.test"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, ec2.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.EC2),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckVPCDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccVPCConfig_disabledDNSSupport(rName),
 				Check: resource.ComposeTestCheckFunc(
-					acctest.CheckVPCExists(ctx, resourceName, &vpc),
+					acctest.CheckVPCExistsV2(ctx, resourceName, &vpc),
 					resource.TestCheckResourceAttr(resourceName, "enable_dns_support", "false"),
 				),
 			},
@@ -879,20 +885,20 @@ func TestAccVPC_disabledDNSSupport(t *testing.T) {
 
 func TestAccVPC_enableNetworkAddressUsageMetrics(t *testing.T) {
 	ctx := acctest.Context(t)
-	var vpc ec2.Vpc
+	var vpc awstypes.Vpc
 	resourceName := "aws_vpc.test"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionNot(t, endpoints.AwsUsGovPartitionID) },
-		ErrorCheck:               acctest.ErrorCheck(t, ec2.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.EC2),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckVPCDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccVPCConfig_enableNetworkAddressUsageMetrics(rName),
 				Check: resource.ComposeTestCheckFunc(
-					acctest.CheckVPCExists(ctx, resourceName, &vpc),
+					acctest.CheckVPCExistsV2(ctx, resourceName, &vpc),
 					resource.TestCheckResourceAttr(resourceName, "enable_network_address_usage_metrics", "true"),
 				),
 			},
@@ -907,24 +913,24 @@ func TestAccVPC_enableNetworkAddressUsageMetrics(t *testing.T) {
 
 func TestAccVPC_assignGeneratedIPv6CIDRBlock(t *testing.T) {
 	ctx := acctest.Context(t)
-	var vpc ec2.Vpc
+	var vpc awstypes.Vpc
 	resourceName := "aws_vpc.test"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, ec2.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.EC2),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckVPCDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccVPCConfig_assignGeneratedIPv6CIDRBlock(rName, true),
 				Check: resource.ComposeAggregateTestCheckFunc(
-					acctest.CheckVPCExists(ctx, resourceName, &vpc),
+					acctest.CheckVPCExistsV2(ctx, resourceName, &vpc),
 					resource.TestCheckResourceAttr(resourceName, "assign_generated_ipv6_cidr_block", "true"),
 					resource.TestCheckResourceAttr(resourceName, "cidr_block", "10.1.0.0/16"),
 					resource.TestCheckResourceAttrSet(resourceName, "ipv6_association_id"),
-					resource.TestMatchResourceAttr(resourceName, "ipv6_cidr_block", regexp.MustCompile(`/56$`)),
+					resource.TestMatchResourceAttr(resourceName, "ipv6_cidr_block", regexache.MustCompile(`/56$`)),
 				),
 			},
 			{
@@ -935,7 +941,7 @@ func TestAccVPC_assignGeneratedIPv6CIDRBlock(t *testing.T) {
 			{
 				Config: testAccVPCConfig_assignGeneratedIPv6CIDRBlock(rName, false),
 				Check: resource.ComposeAggregateTestCheckFunc(
-					acctest.CheckVPCExists(ctx, resourceName, &vpc),
+					acctest.CheckVPCExistsV2(ctx, resourceName, &vpc),
 					resource.TestCheckResourceAttr(resourceName, "assign_generated_ipv6_cidr_block", "false"),
 					resource.TestCheckResourceAttr(resourceName, "cidr_block", "10.1.0.0/16"),
 					resource.TestCheckResourceAttr(resourceName, "ipv6_association_id", ""),
@@ -945,11 +951,11 @@ func TestAccVPC_assignGeneratedIPv6CIDRBlock(t *testing.T) {
 			{
 				Config: testAccVPCConfig_assignGeneratedIPv6CIDRBlock(rName, true),
 				Check: resource.ComposeAggregateTestCheckFunc(
-					acctest.CheckVPCExists(ctx, resourceName, &vpc),
+					acctest.CheckVPCExistsV2(ctx, resourceName, &vpc),
 					resource.TestCheckResourceAttr(resourceName, "assign_generated_ipv6_cidr_block", "true"),
 					resource.TestCheckResourceAttr(resourceName, "cidr_block", "10.1.0.0/16"),
 					resource.TestCheckResourceAttrSet(resourceName, "ipv6_association_id"),
-					resource.TestMatchResourceAttr(resourceName, "ipv6_cidr_block", regexp.MustCompile(`/56$`)),
+					resource.TestMatchResourceAttr(resourceName, "ipv6_cidr_block", regexache.MustCompile(`/56$`)),
 				),
 			},
 		},
@@ -958,7 +964,7 @@ func TestAccVPC_assignGeneratedIPv6CIDRBlock(t *testing.T) {
 
 func TestAccVPC_assignGeneratedIPv6CIDRBlockWithNetworkBorderGroup(t *testing.T) {
 	ctx := acctest.Context(t)
-	var vpc ec2.Vpc
+	var vpc awstypes.Vpc
 	resourceName := "aws_vpc.test"
 	azDataSourceName := "data.aws_availability_zone.test"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
@@ -972,14 +978,14 @@ func TestAccVPC_assignGeneratedIPv6CIDRBlockWithNetworkBorderGroup(t *testing.T)
 			//  for a new or existing VPCs only for us-west-2-lax-1a and use-west-2-lax-1b. All other Local Zones don't support IPv6."
 			testAccPreCheckLocalZoneAvailable(ctx, t, "us-west-2-lax-1") //lintignore:AWSAT003
 		},
-		ErrorCheck:               acctest.ErrorCheck(t, ec2.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.EC2),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckVPCDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccVPCConfig_assignGeneratedIPv6CIDRBlockOptionalNetworkBorderGroup(rName, true),
 				Check: resource.ComposeAggregateTestCheckFunc(
-					acctest.CheckVPCExists(ctx, resourceName, &vpc),
+					acctest.CheckVPCExistsV2(ctx, resourceName, &vpc),
 					resource.TestCheckResourceAttr(resourceName, "assign_generated_ipv6_cidr_block", "true"),
 					resource.TestCheckResourceAttrSet(resourceName, "ipv6_association_id"),
 					resource.TestCheckResourceAttrSet(resourceName, "ipv6_cidr_block"),
@@ -996,7 +1002,7 @@ func TestAccVPC_assignGeneratedIPv6CIDRBlockWithNetworkBorderGroup(t *testing.T)
 			{
 				Config: testAccVPCConfig_assignGeneratedIPv6CIDRBlockOptionalNetworkBorderGroup(rName, false),
 				Check: resource.ComposeAggregateTestCheckFunc(
-					acctest.CheckVPCExists(ctx, resourceName, &vpc),
+					acctest.CheckVPCExistsV2(ctx, resourceName, &vpc),
 					resource.TestCheckResourceAttr(resourceName, "assign_generated_ipv6_cidr_block", "true"),
 					resource.TestCheckResourceAttrSet(resourceName, "ipv6_association_id"),
 					resource.TestCheckResourceAttrSet(resourceName, "ipv6_cidr_block"),
@@ -1015,20 +1021,20 @@ func TestAccVPC_IPAMIPv4BasicNetmask(t *testing.T) {
 		t.Skip("skipping long-running test in short mode")
 	}
 
-	var vpc ec2.Vpc
+	var vpc awstypes.Vpc
 	resourceName := "aws_vpc.test"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, ec2.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.EC2),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckVPCDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccVPCConfig_ipamIPv4(rName, 28),
 				Check: resource.ComposeTestCheckFunc(
-					acctest.CheckVPCExists(ctx, resourceName, &vpc),
+					acctest.CheckVPCExistsV2(ctx, resourceName, &vpc),
 					testAccCheckVPCCIDRPrefix(&vpc, "28"),
 				),
 			},
@@ -1042,21 +1048,21 @@ func TestAccVPC_IPAMIPv4BasicExplicitCIDR(t *testing.T) {
 		t.Skip("skipping long-running test in short mode")
 	}
 
-	var vpc ec2.Vpc
+	var vpc awstypes.Vpc
 	resourceName := "aws_vpc.test"
 	cidr := "172.2.0.32/28"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, ec2.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.EC2),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckVPCDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccVPCConfig_ipamIPv4ExplicitCIDR(rName, cidr),
 				Check: resource.ComposeTestCheckFunc(
-					acctest.CheckVPCExists(ctx, resourceName, &vpc),
+					acctest.CheckVPCExistsV2(ctx, resourceName, &vpc),
 					resource.TestCheckResourceAttr(resourceName, "cidr_block", cidr),
 				),
 			},
@@ -1070,25 +1076,25 @@ func TestAccVPC_IPAMIPv6(t *testing.T) {
 		t.Skip("skipping long-running test in short mode")
 	}
 
-	var vpc ec2.Vpc
+	var vpc awstypes.Vpc
 	resourceName := "aws_vpc.test"
 	ipamPoolResourceName := "aws_vpc_ipam_pool.test"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, ec2.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.EC2),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckVPCDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccVPCConfig_ipamIPv6(rName, 28),
 				Check: resource.ComposeAggregateTestCheckFunc(
-					acctest.CheckVPCExists(ctx, resourceName, &vpc),
+					acctest.CheckVPCExistsV2(ctx, resourceName, &vpc),
 					resource.TestCheckResourceAttr(resourceName, "assign_generated_ipv6_cidr_block", "false"),
 					resource.TestCheckResourceAttr(resourceName, "cidr_block", "10.1.0.0/16"),
 					resource.TestCheckResourceAttrSet(resourceName, "ipv6_association_id"),
-					resource.TestMatchResourceAttr(resourceName, "ipv6_cidr_block", regexp.MustCompile(`/56$`)),
+					resource.TestMatchResourceAttr(resourceName, "ipv6_cidr_block", regexache.MustCompile(`/56$`)),
 					resource.TestCheckResourceAttrSet(resourceName, "ipv6_cidr_block_network_border_group"),
 					resource.TestCheckResourceAttrPair(resourceName, "ipv6_ipam_pool_id", ipamPoolResourceName, "id"),
 					resource.TestCheckResourceAttr(resourceName, "ipv6_netmask_length", "56"),
@@ -1100,14 +1106,14 @@ func TestAccVPC_IPAMIPv6(t *testing.T) {
 
 func testAccCheckVPCDestroy(ctx context.Context) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		conn := acctest.Provider.Meta().(*conns.AWSClient).EC2Conn(ctx)
+		conn := acctest.Provider.Meta().(*conns.AWSClient).EC2Client(ctx)
 
 		for _, rs := range s.RootModule().Resources {
 			if rs.Type != "aws_vpc" {
 				continue
 			}
 
-			_, err := tfec2.FindVPCByID(ctx, conn, rs.Primary.ID)
+			_, err := tfec2.FindVPCByIDV2(ctx, conn, rs.Primary.ID)
 
 			if tfresource.NotFound(err) {
 				continue
@@ -1124,27 +1130,27 @@ func testAccCheckVPCDestroy(ctx context.Context) resource.TestCheckFunc {
 	}
 }
 
-func testAccCheckVPCUpdateTags(ctx context.Context, vpc *ec2.Vpc, oldTags, newTags map[string]string) resource.TestCheckFunc {
+func testAccCheckVPCUpdateTags(ctx context.Context, vpc *awstypes.Vpc, oldTags, newTags map[string]string) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		conn := acctest.Provider.Meta().(*conns.AWSClient).EC2Conn(ctx)
+		conn := acctest.Provider.Meta().(*conns.AWSClient).EC2Client(ctx)
 
-		return tfec2.UpdateTags(ctx, conn, aws.StringValue(vpc.VpcId), oldTags, newTags)
+		return tfec2.UpdateTagsV2(ctx, conn, aws.ToString(vpc.VpcId), oldTags, newTags)
 	}
 }
 
-func testAccCheckVPCCIDRPrefix(vpc *ec2.Vpc, expected string) resource.TestCheckFunc {
+func testAccCheckVPCCIDRPrefix(vpc *awstypes.Vpc, expected string) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		if strings.Split(aws.StringValue(vpc.CidrBlock), "/")[1] != expected {
-			return fmt.Errorf("Bad cidr prefix: got %s, expected %s", aws.StringValue(vpc.CidrBlock), expected)
+		if strings.Split(aws.ToString(vpc.CidrBlock), "/")[1] != expected {
+			return fmt.Errorf("Bad cidr prefix: got %s, expected %s", aws.ToString(vpc.CidrBlock), expected)
 		}
 
 		return nil
 	}
 }
 
-func testAccCheckVPCIDsEqual(vpc1, vpc2 *ec2.Vpc) resource.TestCheckFunc {
+func testAccCheckVPCIDsEqual(vpc1, vpc2 *awstypes.Vpc) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		if aws.StringValue(vpc1.VpcId) != aws.StringValue(vpc2.VpcId) {
+		if aws.ToString(vpc1.VpcId) != aws.ToString(vpc2.VpcId) {
 			return fmt.Errorf("VPC IDs are not equal")
 		}
 
@@ -1152,9 +1158,9 @@ func testAccCheckVPCIDsEqual(vpc1, vpc2 *ec2.Vpc) resource.TestCheckFunc {
 	}
 }
 
-func testAccCheckVPCIDsNotEqual(vpc1, vpc2 *ec2.Vpc) resource.TestCheckFunc {
+func testAccCheckVPCIDsNotEqual(vpc1, vpc2 *awstypes.Vpc) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		if aws.StringValue(vpc1.VpcId) == aws.StringValue(vpc2.VpcId) {
+		if aws.ToString(vpc1.VpcId) == aws.ToString(vpc2.VpcId) {
 			return fmt.Errorf("VPC IDs are equal")
 		}
 
diff --git a/internal/service/ec2/vpc_traffic_mirror_filter.go b/internal/service/ec2/vpc_traffic_mirror_filter.go
index be4c8220370..0d6a190ab20 100644
--- a/internal/service/ec2/vpc_traffic_mirror_filter.go
+++ b/internal/service/ec2/vpc_traffic_mirror_filter.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -8,6 +11,7 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/aws/aws-sdk-go/service/ec2"
+	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
@@ -165,6 +169,10 @@ func resourceTrafficMirrorFilterDelete(ctx context.Context, d *schema.ResourceDa
 		TrafficMirrorFilterId: aws.String(d.Id()),
 	})
 
+	if tfawserr.ErrCodeEquals(err, errCodeInvalidTrafficMirrorFilterIdNotFound) {
+		return diags
+	}
+
 	if err != nil {
 		return sdkdiag.AppendErrorf(diags, "deleting EC2 Traffic Mirror Filter (%s): %s", d.Id(), err)
 	}
diff --git a/internal/service/ec2/vpc_traffic_mirror_filter_rule.go b/internal/service/ec2/vpc_traffic_mirror_filter_rule.go
index 0fbd45eb3fc..45cd4f70b90 100644
--- a/internal/service/ec2/vpc_traffic_mirror_filter_rule.go
+++ b/internal/service/ec2/vpc_traffic_mirror_filter_rule.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -9,6 +12,7 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/aws/aws-sdk-go/service/ec2"
+	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
@@ -244,16 +248,16 @@ func resourceTrafficMirrorFilterRuleUpdate(ctx context.Context, d *schema.Resour
 		}
 	}
 
-	if d.HasChange("source_cidr_block") {
-		input.SourceCidrBlock = aws.String(d.Get("source_cidr_block").(string))
-	}
-
 	if d.HasChange("rule_action") {
 		input.RuleAction = aws.String(d.Get("rule_action").(string))
 	}
 
 	if d.HasChange("rule_number") {
-		input.RuleNumber = aws.Int64(int64(d.Get("rule_action").(int)))
+		input.RuleNumber = aws.Int64(int64(d.Get("rule_number").(int)))
+	}
+
+	if d.HasChange("source_cidr_block") {
+		input.SourceCidrBlock = aws.String(d.Get("source_cidr_block").(string))
 	}
 
 	if d.HasChange("source_port_range") {
@@ -292,6 +296,10 @@ func resourceTrafficMirrorFilterRuleDelete(ctx context.Context, d *schema.Resour
 		TrafficMirrorFilterRuleId: aws.String(d.Id()),
 	})
 
+	if tfawserr.ErrCodeEquals(err, errCodeInvalidTrafficMirrorFilterRuleIdNotFound) {
+		return diags
+	}
+
 	if err != nil {
 		return sdkdiag.AppendErrorf(diags, "deleting EC2 Traffic Mirror Filter Rule (%s): %s", d.Id(), err)
 	}
diff --git a/internal/service/ec2/vpc_traffic_mirror_filter_rule_test.go b/internal/service/ec2/vpc_traffic_mirror_filter_rule_test.go
index 19f8b1d7072..8f8b7c09712 100644
--- a/internal/service/ec2/vpc_traffic_mirror_filter_rule_test.go
+++ b/internal/service/ec2/vpc_traffic_mirror_filter_rule_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"strconv"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
@@ -21,7 +24,8 @@ func TestAccVPCTrafficMirrorFilterRule_basic(t *testing.T) {
 	resourceName := "aws_ec2_traffic_mirror_filter_rule.test"
 	dstCidr := "10.0.0.0/8"
 	srcCidr := "0.0.0.0/0"
-	ruleNum := 1
+	ruleNum1 := 1
+	ruleNum2 := 2
 	action := "accept"
 	direction := "ingress"
 	description := "test rule"
@@ -42,14 +46,14 @@ func TestAccVPCTrafficMirrorFilterRule_basic(t *testing.T) {
 		Steps: []resource.TestStep{
 			//create
 			{
-				Config: testAccVPCTrafficMirrorFilterRuleConfig_basic(dstCidr, srcCidr, action, direction, ruleNum),
+				Config: testAccVPCTrafficMirrorFilterRuleConfig_basic(dstCidr, srcCidr, action, direction, ruleNum1),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckTrafficMirrorFilterRuleExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", ec2.ServiceName, regexp.MustCompile(`traffic-mirror-filter-rule/tmfr-.+`)),
-					resource.TestMatchResourceAttr(resourceName, "traffic_mirror_filter_id", regexp.MustCompile("tmf-.*")),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", ec2.ServiceName, regexache.MustCompile(`traffic-mirror-filter-rule/tmfr-.+`)),
+					resource.TestMatchResourceAttr(resourceName, "traffic_mirror_filter_id", regexache.MustCompile("tmf-.*")),
 					resource.TestCheckResourceAttr(resourceName, "destination_cidr_block", dstCidr),
 					resource.TestCheckResourceAttr(resourceName, "rule_action", action),
-					resource.TestCheckResourceAttr(resourceName, "rule_number", strconv.Itoa(ruleNum)),
+					resource.TestCheckResourceAttr(resourceName, "rule_number", strconv.Itoa(ruleNum1)),
 					resource.TestCheckResourceAttr(resourceName, "source_cidr_block", srcCidr),
 					resource.TestCheckResourceAttr(resourceName, "traffic_direction", direction),
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
@@ -60,13 +64,34 @@ func TestAccVPCTrafficMirrorFilterRule_basic(t *testing.T) {
 			},
 			// Add all optionals
 			{
-				Config: testAccVPCTrafficMirrorFilterRuleConfig_full(dstCidr, srcCidr, action, direction, description, ruleNum, srcPortFrom, srcPortTo, dstPortFrom, dstPortTo, protocol),
+				Config: testAccVPCTrafficMirrorFilterRuleConfig_full(dstCidr, srcCidr, action, direction, description, ruleNum1, srcPortFrom, srcPortTo, dstPortFrom, dstPortTo, protocol),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckTrafficMirrorFilterRuleExists(ctx, resourceName),
-					resource.TestMatchResourceAttr(resourceName, "traffic_mirror_filter_id", regexp.MustCompile("tmf-.*")),
+					resource.TestMatchResourceAttr(resourceName, "traffic_mirror_filter_id", regexache.MustCompile("tmf-.*")),
 					resource.TestCheckResourceAttr(resourceName, "destination_cidr_block", dstCidr),
 					resource.TestCheckResourceAttr(resourceName, "rule_action", action),
-					resource.TestCheckResourceAttr(resourceName, "rule_number", strconv.Itoa(ruleNum)),
+					resource.TestCheckResourceAttr(resourceName, "rule_number", strconv.Itoa(ruleNum1)),
+					resource.TestCheckResourceAttr(resourceName, "source_cidr_block", srcCidr),
+					resource.TestCheckResourceAttr(resourceName, "traffic_direction", direction),
+					resource.TestCheckResourceAttr(resourceName, "description", description),
+					resource.TestCheckResourceAttr(resourceName, "destination_port_range.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "destination_port_range.0.from_port", strconv.Itoa(dstPortFrom)),
+					resource.TestCheckResourceAttr(resourceName, "destination_port_range.0.to_port", strconv.Itoa(dstPortTo)),
+					resource.TestCheckResourceAttr(resourceName, "source_port_range.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "source_port_range.0.from_port", strconv.Itoa(srcPortFrom)),
+					resource.TestCheckResourceAttr(resourceName, "source_port_range.0.to_port", strconv.Itoa(srcPortTo)),
+					resource.TestCheckResourceAttr(resourceName, "protocol", strconv.Itoa(protocol)),
+				),
+			},
+			// Updates
+			{
+				Config: testAccVPCTrafficMirrorFilterRuleConfig_full(dstCidr, srcCidr, action, direction, description, ruleNum2, srcPortFrom, srcPortTo, dstPortFrom, dstPortTo, protocol),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckTrafficMirrorFilterRuleExists(ctx, resourceName),
+					resource.TestMatchResourceAttr(resourceName, "traffic_mirror_filter_id", regexache.MustCompile("tmf-.*")),
+					resource.TestCheckResourceAttr(resourceName, "destination_cidr_block", dstCidr),
+					resource.TestCheckResourceAttr(resourceName, "rule_action", action),
+					resource.TestCheckResourceAttr(resourceName, "rule_number", strconv.Itoa(ruleNum2)),
 					resource.TestCheckResourceAttr(resourceName, "source_cidr_block", srcCidr),
 					resource.TestCheckResourceAttr(resourceName, "traffic_direction", direction),
 					resource.TestCheckResourceAttr(resourceName, "description", description),
@@ -81,13 +106,13 @@ func TestAccVPCTrafficMirrorFilterRule_basic(t *testing.T) {
 			},
 			// remove optionals
 			{
-				Config: testAccVPCTrafficMirrorFilterRuleConfig_basic(dstCidr, srcCidr, action, direction, ruleNum),
+				Config: testAccVPCTrafficMirrorFilterRuleConfig_basic(dstCidr, srcCidr, action, direction, ruleNum1),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckTrafficMirrorFilterRuleExists(ctx, resourceName),
-					resource.TestMatchResourceAttr(resourceName, "traffic_mirror_filter_id", regexp.MustCompile("tmf-.*")),
+					resource.TestMatchResourceAttr(resourceName, "traffic_mirror_filter_id", regexache.MustCompile("tmf-.*")),
 					resource.TestCheckResourceAttr(resourceName, "destination_cidr_block", dstCidr),
 					resource.TestCheckResourceAttr(resourceName, "rule_action", action),
-					resource.TestCheckResourceAttr(resourceName, "rule_number", strconv.Itoa(ruleNum)),
+					resource.TestCheckResourceAttr(resourceName, "rule_number", strconv.Itoa(ruleNum1)),
 					resource.TestCheckResourceAttr(resourceName, "source_cidr_block", srcCidr),
 					resource.TestCheckResourceAttr(resourceName, "traffic_direction", direction),
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
diff --git a/internal/service/ec2/vpc_traffic_mirror_filter_test.go b/internal/service/ec2/vpc_traffic_mirror_filter_test.go
index 26e5d8e0e4e..a80be105e18 100644
--- a/internal/service/ec2/vpc_traffic_mirror_filter_test.go
+++ b/internal/service/ec2/vpc_traffic_mirror_filter_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
@@ -35,7 +38,7 @@ func TestAccVPCTrafficMirrorFilter_basic(t *testing.T) {
 				Config: testAccVPCTrafficMirrorFilterConfig_basic(description),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckTrafficMirrorFilterExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexp.MustCompile(`traffic-mirror-filter/tmf-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`traffic-mirror-filter/tmf-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "description", description),
 					resource.TestCheckResourceAttr(resourceName, "network_services.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
diff --git a/internal/service/ec2/vpc_traffic_mirror_session.go b/internal/service/ec2/vpc_traffic_mirror_session.go
index 8745e16e906..7551b5d0afb 100644
--- a/internal/service/ec2/vpc_traffic_mirror_session.go
+++ b/internal/service/ec2/vpc_traffic_mirror_session.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -8,6 +11,7 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/aws/aws-sdk-go/service/ec2"
+	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
@@ -227,6 +231,10 @@ func resourceTrafficMirrorSessionDelete(ctx context.Context, d *schema.ResourceD
 		TrafficMirrorSessionId: aws.String(d.Id()),
 	})
 
+	if tfawserr.ErrCodeEquals(err, errCodeInvalidTrafficMirrorSessionIdNotFound) {
+		return diags
+	}
+
 	if err != nil {
 		return sdkdiag.AppendErrorf(diags, "deleting EC2 Traffic Mirror Session (%s): %s", d.Id(), err)
 	}
diff --git a/internal/service/ec2/vpc_traffic_mirror_session_test.go b/internal/service/ec2/vpc_traffic_mirror_session_test.go
index bbf5a2f1bdb..596cfe584db 100644
--- a/internal/service/ec2/vpc_traffic_mirror_session_test.go
+++ b/internal/service/ec2/vpc_traffic_mirror_session_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"strconv"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -45,10 +48,10 @@ func TestAccVPCTrafficMirrorSession_basic(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
 					resource.TestCheckResourceAttr(resourceName, "packet_length", "0"),
 					resource.TestCheckResourceAttr(resourceName, "session_number", strconv.Itoa(session)),
-					resource.TestMatchResourceAttr(resourceName, "virtual_network_id", regexp.MustCompile(`\d+`)),
+					resource.TestMatchResourceAttr(resourceName, "virtual_network_id", regexache.MustCompile(`\d+`)),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 					acctest.CheckResourceAttrAccountID(resourceName, "owner_id"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexp.MustCompile(`traffic-mirror-session/tms-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`traffic-mirror-session/tms-.+`)),
 				),
 			},
 			// update of description, packet length and VNI
@@ -70,7 +73,7 @@ func TestAccVPCTrafficMirrorSession_basic(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
 					resource.TestCheckResourceAttr(resourceName, "packet_length", "0"),
 					resource.TestCheckResourceAttr(resourceName, "session_number", strconv.Itoa(session)),
-					resource.TestMatchResourceAttr(resourceName, "virtual_network_id", regexp.MustCompile(`\d+`)),
+					resource.TestMatchResourceAttr(resourceName, "virtual_network_id", regexache.MustCompile(`\d+`)),
 				),
 			},
 			// import test without VNI
@@ -290,10 +293,18 @@ resource "aws_lb" "test" {
   enable_deletion_protection = false
 }
 
-resource "aws_ec2_traffic_mirror_filter" "test" {}
+resource "aws_ec2_traffic_mirror_filter" "test" {
+  tags = {
+    Name = %[1]q
+  }
+}
 
 resource "aws_ec2_traffic_mirror_target" "test" {
   network_load_balancer_arn = aws_lb.test.arn
+
+  tags = {
+    Name = %[1]q
+  }
 }
 `, rName))
 }
@@ -382,10 +393,16 @@ resource "aws_ec2_traffic_mirror_target" "test" {
   count = 2
 
   network_interface_id = aws_instance.target[count.index].primary_network_interface_id
+
+  tags = {
+    Name = %[1]q
+  }
 }
 
 resource "aws_ec2_traffic_mirror_filter" "test" {
-  description = %[1]q
+  tags = {
+    Name = %[1]q
+  }
 }
 
 resource "aws_ec2_traffic_mirror_session" "test" {
@@ -394,6 +411,10 @@ resource "aws_ec2_traffic_mirror_session" "test" {
   traffic_mirror_target_id = aws_ec2_traffic_mirror_target.test[%[2]d].id
   network_interface_id     = aws_instance.test.primary_network_interface_id
   session_number           = %[3]d
+
+  tags = {
+    Name = %[1]q
+  }
 }
 `, rName, idx, session))
 }
diff --git a/internal/service/ec2/vpc_traffic_mirror_target.go b/internal/service/ec2/vpc_traffic_mirror_target.go
index c8adfb56505..e630e77b8ef 100644
--- a/internal/service/ec2/vpc_traffic_mirror_target.go
+++ b/internal/service/ec2/vpc_traffic_mirror_target.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -8,6 +11,7 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/aws/aws-sdk-go/service/ec2"
+	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
@@ -172,6 +176,10 @@ func resourceTrafficMirrorTargetDelete(ctx context.Context, d *schema.ResourceDa
 		TrafficMirrorTargetId: aws.String(d.Id()),
 	})
 
+	if tfawserr.ErrCodeEquals(err, errCodeInvalidTrafficMirrorTargetIdNotFound) {
+		return diags
+	}
+
 	if err != nil {
 		return sdkdiag.AppendErrorf(diags, "deleting EC2 Traffic Mirror Target (%s): %s", d.Id(), err)
 	}
diff --git a/internal/service/ec2/vpc_traffic_mirror_target_test.go b/internal/service/ec2/vpc_traffic_mirror_target_test.go
index dc5d398ef10..cedd2fb90c5 100644
--- a/internal/service/ec2/vpc_traffic_mirror_target_test.go
+++ b/internal/service/ec2/vpc_traffic_mirror_target_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -37,7 +40,7 @@ func TestAccVPCTrafficMirrorTarget_nlb(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckTrafficMirrorTargetExists(ctx, resourceName, &v),
 					acctest.CheckResourceAttrAccountID(resourceName, "owner_id"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexp.MustCompile(`traffic-mirror-target/tmt-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`traffic-mirror-target/tmt-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "description", description),
 					resource.TestCheckResourceAttrPair(resourceName, "network_load_balancer_arn", "aws_lb.test", "arn"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
@@ -73,8 +76,7 @@ func TestAccVPCTrafficMirrorTarget_eni(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckTrafficMirrorTargetExists(ctx, resourceName, &v),
 					resource.TestCheckResourceAttr(resourceName, "description", description),
-					resource.TestMatchResourceAttr(resourceName, "network_interface_id", regexp.MustCompile("eni-.*")),
-					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
+					resource.TestMatchResourceAttr(resourceName, "network_interface_id", regexache.MustCompile("eni-.*")),
 				),
 			},
 			{
@@ -282,6 +284,10 @@ resource "aws_instance" "test" {
 resource "aws_ec2_traffic_mirror_target" "test" {
   description          = %[2]q
   network_interface_id = aws_instance.test.primary_network_interface_id
+
+  tags = {
+    Name = %[1]q
+  }
 }
 `, rName, description))
 }
@@ -336,10 +342,14 @@ func testAccVPCTrafficMirrorTargetConfig_gwlb(rName, description string) string
 		testAccVPCEndpointConfig_gatewayLoadBalancer(rName),
 		fmt.Sprintf(`
 resource "aws_ec2_traffic_mirror_target" "test" {
-  description                       = %[1]q
+  description                       = %[2]q
   gateway_load_balancer_endpoint_id = aws_vpc_endpoint.test.id
+
+  tags = {
+    Name = %[1]q
+  }
 }
-`, description))
+`, rName, description))
 }
 
 func testAccPreCheckTrafficMirrorTarget(ctx context.Context, t *testing.T) {
diff --git a/internal/service/ec2/vpc_vpcs_data_source.go b/internal/service/ec2/vpc_vpcs_data_source.go
index 4669e8f2286..3073f58ec58 100644
--- a/internal/service/ec2/vpc_vpcs_data_source.go
+++ b/internal/service/ec2/vpc_vpcs_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -23,7 +26,7 @@ func DataSourceVPCs() *schema.Resource {
 		},
 
 		Schema: map[string]*schema.Schema{
-			"filter": DataSourceFiltersSchema(),
+			"filter": CustomFiltersSchema(),
 			"ids": {
 				Type:     schema.TypeList,
 				Computed: true,
@@ -48,7 +51,7 @@ func dataSourceVPCsRead(ctx context.Context, d *schema.ResourceData, meta interf
 
 	if filters, filtersOk := d.GetOk("filter"); filtersOk {
 		input.Filters = append(input.Filters,
-			BuildFiltersDataSource(filters.(*schema.Set))...)
+			BuildCustomFilterList(filters.(*schema.Set))...)
 	}
 
 	if len(input.Filters) == 0 {
diff --git a/internal/service/ec2/vpc_vpcs_data_source_test.go b/internal/service/ec2/vpc_vpcs_data_source_test.go
index 13b2d96ff50..241ae2a8dc4 100644
--- a/internal/service/ec2/vpc_vpcs_data_source_test.go
+++ b/internal/service/ec2/vpc_vpcs_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/vpnclient_authorization_rule.go b/internal/service/ec2/vpnclient_authorization_rule.go
index 8ecb6379648..9800c2ac3b0 100644
--- a/internal/service/ec2/vpnclient_authorization_rule.go
+++ b/internal/service/ec2/vpnclient_authorization_rule.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/vpnclient_authorization_rule_test.go b/internal/service/ec2/vpnclient_authorization_rule_test.go
index 70e5ae8a4bb..7655f46047b 100644
--- a/internal/service/ec2/vpnclient_authorization_rule_test.go
+++ b/internal/service/ec2/vpnclient_authorization_rule_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/vpnclient_endpoint.go b/internal/service/ec2/vpnclient_endpoint.go
index 714d4ec652c..996339bd50c 100644
--- a/internal/service/ec2/vpnclient_endpoint.go
+++ b/internal/service/ec2/vpnclient_endpoint.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -176,6 +179,10 @@ func ResourceClientVPNEndpoint() *schema.Resource {
 				Default:      ec2.SelfServicePortalDisabled,
 				ValidateFunc: validation.StringInSlice(ec2.SelfServicePortal_Values(), false),
 			},
+			"self_service_portal_url": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
 			"server_certificate_arn": {
 				Type:         schema.TypeString,
 				Required:     true,
@@ -342,6 +349,7 @@ func resourceClientVPNEndpointRead(ctx context.Context, d *schema.ResourceData,
 	} else {
 		d.Set("self_service_portal", ec2.SelfServicePortalDisabled)
 	}
+	d.Set("self_service_portal_url", ep.SelfServicePortalUrl)
 	d.Set("server_certificate_arn", ep.ServerCertificateArn)
 	d.Set("session_timeout_hours", ep.SessionTimeoutHours)
 	d.Set("split_tunnel", ep.SplitTunnel)
diff --git a/internal/service/ec2/vpnclient_endpoint_data_source.go b/internal/service/ec2/vpnclient_endpoint_data_source.go
index 6aae3c0da08..765d42d894e 100644
--- a/internal/service/ec2/vpnclient_endpoint_data_source.go
+++ b/internal/service/ec2/vpnclient_endpoint_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -132,7 +135,7 @@ func DataSourceClientVPNEndpoint() *schema.Resource {
 				Computed: true,
 				Elem:     &schema.Schema{Type: schema.TypeString},
 			},
-			"filter": DataSourceFiltersSchema(),
+			"filter": CustomFiltersSchema(),
 			"security_group_ids": {
 				Type:     schema.TypeList,
 				Computed: true,
@@ -142,6 +145,10 @@ func DataSourceClientVPNEndpoint() *schema.Resource {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
+			"self_service_portal_url": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
 			"server_certificate_arn": {
 				Type:     schema.TypeString,
 				Computed: true,
@@ -186,7 +193,7 @@ func dataSourceClientVPNEndpointRead(ctx context.Context, d *schema.ResourceData
 		Tags(tftags.New(ctx, d.Get("tags").(map[string]interface{}))),
 	)...)
 
-	input.Filters = append(input.Filters, BuildFiltersDataSource(
+	input.Filters = append(input.Filters, BuildCustomFilterList(
 		d.Get("filter").(*schema.Set),
 	)...)
 
@@ -244,6 +251,7 @@ func dataSourceClientVPNEndpointRead(ctx context.Context, d *schema.ResourceData
 	} else {
 		d.Set("self_service_portal", ec2.SelfServicePortalDisabled)
 	}
+	d.Set("self_service_portal_url", ep.SelfServicePortalUrl)
 	d.Set("server_certificate_arn", ep.ServerCertificateArn)
 	d.Set("session_timeout_hours", ep.SessionTimeoutHours)
 	d.Set("split_tunnel", ep.SplitTunnel)
diff --git a/internal/service/ec2/vpnclient_endpoint_data_source_test.go b/internal/service/ec2/vpnclient_endpoint_data_source_test.go
index 1a57186887d..88d161cc50b 100644
--- a/internal/service/ec2/vpnclient_endpoint_data_source_test.go
+++ b/internal/service/ec2/vpnclient_endpoint_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
@@ -38,6 +41,7 @@ func testAccClientVPNEndpointDataSource_basic(t *testing.T) {
 					resource.TestCheckResourceAttrPair(datasource1Name, "dns_servers.#", resourceName, "dns_servers.#"),
 					resource.TestCheckResourceAttrPair(datasource1Name, "security_group_ids.#", resourceName, "security_group_ids.#"),
 					resource.TestCheckResourceAttrPair(datasource1Name, "self_service_portal", resourceName, "self_service_portal"),
+					resource.TestCheckResourceAttrPair(datasource1Name, "self_service_portal_url", resourceName, "self_service_portal_url"),
 					resource.TestCheckResourceAttrPair(datasource1Name, "server_certificate_arn", resourceName, "server_certificate_arn"),
 					resource.TestCheckResourceAttrPair(datasource1Name, "session_timeout_hours", resourceName, "session_timeout_hours"),
 					resource.TestCheckResourceAttrPair(datasource1Name, "split_tunnel", resourceName, "split_tunnel"),
@@ -57,6 +61,7 @@ func testAccClientVPNEndpointDataSource_basic(t *testing.T) {
 					resource.TestCheckResourceAttrPair(datasource2Name, "dns_name", resourceName, "dns_name"),
 					resource.TestCheckResourceAttrPair(datasource2Name, "dns_servers.#", resourceName, "dns_servers.#"),
 					resource.TestCheckResourceAttrPair(datasource2Name, "security_group_ids.#", resourceName, "security_group_ids.#"),
+					resource.TestCheckResourceAttrPair(datasource2Name, "self_service_portal_url", resourceName, "self_service_portal_url"),
 					resource.TestCheckResourceAttrPair(datasource2Name, "self_service_portal", resourceName, "self_service_portal"),
 					resource.TestCheckResourceAttrPair(datasource2Name, "server_certificate_arn", resourceName, "server_certificate_arn"),
 					resource.TestCheckResourceAttrPair(datasource2Name, "session_timeout_hours", resourceName, "session_timeout_hours"),
@@ -77,6 +82,7 @@ func testAccClientVPNEndpointDataSource_basic(t *testing.T) {
 					resource.TestCheckResourceAttrPair(datasource3Name, "dns_name", resourceName, "dns_name"),
 					resource.TestCheckResourceAttrPair(datasource3Name, "dns_servers.#", resourceName, "dns_servers.#"),
 					resource.TestCheckResourceAttrPair(datasource3Name, "security_group_ids.#", resourceName, "security_group_ids.#"),
+					resource.TestCheckResourceAttrPair(datasource2Name, "self_service_portal_url", resourceName, "self_service_portal_url"),
 					resource.TestCheckResourceAttrPair(datasource3Name, "self_service_portal", resourceName, "self_service_portal"),
 					resource.TestCheckResourceAttrPair(datasource3Name, "server_certificate_arn", resourceName, "server_certificate_arn"),
 					resource.TestCheckResourceAttrPair(datasource3Name, "session_timeout_hours", resourceName, "session_timeout_hours"),
diff --git a/internal/service/ec2/vpnclient_endpoint_test.go b/internal/service/ec2/vpnclient_endpoint_test.go
index 468850a0b4d..8ab479bb261 100644
--- a/internal/service/ec2/vpnclient_endpoint_test.go
+++ b/internal/service/ec2/vpnclient_endpoint_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
 	"context"
 	"fmt"
 	"os"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -104,7 +107,7 @@ func testAccClientVPNEndpoint_basic(t *testing.T) {
 				Config: testAccClientVPNEndpointConfig_basic(t, rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckClientVPNEndpointExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexp.MustCompile(`client-vpn-endpoint/cvpn-endpoint-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`client-vpn-endpoint/cvpn-endpoint-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "authentication_options.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "authentication_options.*", map[string]string{
 						"type": "certificate-authentication",
@@ -124,6 +127,7 @@ func testAccClientVPNEndpoint_basic(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "dns_servers.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "security_group_ids.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "self_service_portal", "disabled"),
+					resource.TestCheckResourceAttr(resourceName, "self_service_portal_url", ""),
 					resource.TestCheckResourceAttrSet(resourceName, "server_certificate_arn"),
 					resource.TestCheckResourceAttr(resourceName, "session_timeout_hours", "24"),
 					resource.TestCheckResourceAttr(resourceName, "split_tunnel", "false"),
@@ -623,6 +627,7 @@ func testAccClientVPNEndpoint_selfServicePortal(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckClientVPNEndpointExists(ctx, resourceName, &v),
 					resource.TestCheckResourceAttr(resourceName, "self_service_portal", "enabled"),
+					resource.TestCheckResourceAttrSet(resourceName, "self_service_portal_url"),
 				),
 			},
 			{
@@ -635,6 +640,7 @@ func testAccClientVPNEndpoint_selfServicePortal(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckClientVPNEndpointExists(ctx, resourceName, &v),
 					resource.TestCheckResourceAttr(resourceName, "self_service_portal", "disabled"),
+					resource.TestCheckResourceAttr(resourceName, "self_service_portal_url", ""),
 				),
 			},
 		},
diff --git a/internal/service/ec2/vpnclient_network_association.go b/internal/service/ec2/vpnclient_network_association.go
index c55f2356bf3..e2755136501 100644
--- a/internal/service/ec2/vpnclient_network_association.go
+++ b/internal/service/ec2/vpnclient_network_association.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/vpnclient_network_association_test.go b/internal/service/ec2/vpnclient_network_association_test.go
index 85dbdcb6102..e45f4a68f0e 100644
--- a/internal/service/ec2/vpnclient_network_association_test.go
+++ b/internal/service/ec2/vpnclient_network_association_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -35,7 +38,7 @@ func testAccClientVPNNetworkAssociation_basic(t *testing.T) {
 				Config: testAccClientVPNNetworkAssociationConfig_basic(t, rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckClientVPNNetworkAssociationExists(ctx, resourceName, &assoc),
-					resource.TestMatchResourceAttr(resourceName, "association_id", regexp.MustCompile("^cvpn-assoc-[a-z0-9]+$")),
+					resource.TestMatchResourceAttr(resourceName, "association_id", regexache.MustCompile("^cvpn-assoc-[0-9a-z]+$")),
 					resource.TestCheckResourceAttrPair(resourceName, "id", resourceName, "association_id"),
 					resource.TestCheckResourceAttrPair(resourceName, "client_vpn_endpoint_id", endpointResourceName, "id"),
 					resource.TestCheckResourceAttrPair(resourceName, "subnet_id", subnetResourceName, "id"),
@@ -71,8 +74,8 @@ func testAccClientVPNNetworkAssociation_multipleSubnets(t *testing.T) {
 				Config: testAccClientVPNNetworkAssociationConfig_multipleSubnets(t, rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckClientVPNNetworkAssociationExists(ctx, resourceNames[0], &assoc),
-					resource.TestMatchResourceAttr(resourceNames[0], "association_id", regexp.MustCompile("^cvpn-assoc-[a-z0-9]+$")),
-					resource.TestMatchResourceAttr(resourceNames[1], "association_id", regexp.MustCompile("^cvpn-assoc-[a-z0-9]+$")),
+					resource.TestMatchResourceAttr(resourceNames[0], "association_id", regexache.MustCompile("^cvpn-assoc-[0-9a-z]+$")),
+					resource.TestMatchResourceAttr(resourceNames[1], "association_id", regexache.MustCompile("^cvpn-assoc-[0-9a-z]+$")),
 					resource.TestCheckResourceAttrPair(resourceNames[0], "id", resourceNames[0], "association_id"),
 					resource.TestCheckResourceAttrPair(resourceNames[0], "client_vpn_endpoint_id", endpointResourceName, "id"),
 					resource.TestCheckResourceAttrPair(resourceNames[0], "subnet_id", subnetResourceNames[0], "id"),
diff --git a/internal/service/ec2/vpnclient_route.go b/internal/service/ec2/vpnclient_route.go
index 684062d5740..ffd3c8d1b3d 100644
--- a/internal/service/ec2/vpnclient_route.go
+++ b/internal/service/ec2/vpnclient_route.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -85,8 +88,7 @@ func resourceClientVPNRouteCreate(ctx context.Context, d *schema.ResourceData, m
 		input.Description = aws.String(v.(string))
 	}
 
-	log.Printf("[DEBUG] Creating EC2 Client VPN Route: %s", input)
-	_, err := tfresource.RetryWhenAWSErrCodeEquals(ctx, propagationTimeout, func() (interface{}, error) {
+	_, err := tfresource.RetryWhenAWSErrCodeEquals(ctx, ec2PropagationTimeout, func() (interface{}, error) {
 		return conn.CreateClientVpnRouteWithContext(ctx, input)
 	}, errCodeInvalidClientVPNActiveAssociationNotFound)
 
diff --git a/internal/service/ec2/vpnclient_route_test.go b/internal/service/ec2/vpnclient_route_test.go
index 8333d31f69a..0f25bafce9d 100644
--- a/internal/service/ec2/vpnclient_route_test.go
+++ b/internal/service/ec2/vpnclient_route_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/vpnsite_connection.go b/internal/service/ec2/vpnsite_connection.go
index dce1ef05ee8..ed816741103 100644
--- a/internal/service/ec2/vpnsite_connection.go
+++ b/internal/service/ec2/vpnsite_connection.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -6,11 +9,11 @@ import (
 	"fmt"
 	"log"
 	"net"
-	"regexp"
 	"sort"
 	"strconv"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/aws/aws-sdk-go/service/ec2"
@@ -1668,8 +1671,8 @@ func CustomerGatewayConfigurationToTunnelInfo(xmlConfig string, tunnel1PreShared
 func validVPNConnectionTunnelPreSharedKey() schema.SchemaValidateFunc {
 	return validation.All(
 		validation.StringLenBetween(8, 64),
-		validation.StringDoesNotMatch(regexp.MustCompile(`^0`), "cannot start with zero character"),
-		validation.StringMatch(regexp.MustCompile(`^[0-9a-zA-Z_.]+$`), "can only contain alphanumeric, period and underscore characters"),
+		validation.StringDoesNotMatch(regexache.MustCompile(`^0`), "cannot start with zero character"),
+		validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_.]+$`), "can only contain alphanumeric, period and underscore characters"),
 	)
 }
 
@@ -1688,7 +1691,7 @@ func validVPNConnectionTunnelInsideCIDR() schema.SchemaValidateFunc {
 
 	return validation.All(
 		validation.IsCIDRNetwork(30, 30),
-		validation.StringMatch(regexp.MustCompile(`^169\.254\.`), "must be within 169.254.0.0/16"),
+		validation.StringMatch(regexache.MustCompile(`^169\.254\.`), "must be within 169.254.0.0/16"),
 		validation.StringNotInSlice(disallowedCidrs, false),
 	)
 }
@@ -1696,7 +1699,7 @@ func validVPNConnectionTunnelInsideCIDR() schema.SchemaValidateFunc {
 func validVPNConnectionTunnelInsideIPv6CIDR() schema.SchemaValidateFunc {
 	return validation.All(
 		validation.IsCIDRNetwork(126, 126),
-		validation.StringMatch(regexp.MustCompile(`^fd00:`), "must be within fd00::/8"),
+		validation.StringMatch(regexache.MustCompile(`^fd00:`), "must be within fd00::/8"),
 	)
 }
 
diff --git a/internal/service/ec2/vpnsite_connection_route.go b/internal/service/ec2/vpnsite_connection_route.go
index d9a38cf3da5..a7801a118d3 100644
--- a/internal/service/ec2/vpnsite_connection_route.go
+++ b/internal/service/ec2/vpnsite_connection_route.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/vpnsite_connection_route_test.go b/internal/service/ec2/vpnsite_connection_route_test.go
index 9f63b4430a7..6138af1dcc5 100644
--- a/internal/service/ec2/vpnsite_connection_route_test.go
+++ b/internal/service/ec2/vpnsite_connection_route_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/vpnsite_connection_test.go b/internal/service/ec2/vpnsite_connection_test.go
index 380d9be42d1..2e8b81a4291 100644
--- a/internal/service/ec2/vpnsite_connection_test.go
+++ b/internal/service/ec2/vpnsite_connection_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
 	"context"
 	"fmt"
 	"reflect"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -168,7 +171,7 @@ func TestAccSiteVPNConnection_basic(t *testing.T) {
 				Config: testAccSiteVPNConnectionConfig_basic(rName, rBgpAsn),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccVPNConnectionExists(ctx, resourceName, &vpn),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexp.MustCompile(`vpn-connection/vpn-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`vpn-connection/vpn-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "core_network_arn", ""),
 					resource.TestCheckResourceAttr(resourceName, "core_network_attachment_arn", ""),
 					resource.TestCheckResourceAttrSet(resourceName, "customer_gateway_configuration"),
@@ -264,7 +267,7 @@ func TestAccSiteVPNConnection_withoutTGWorVGW(t *testing.T) {
 				Config: testAccSiteVPNConnectionConfig_withoutTGWorVGW(rName, rBgpAsn),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccVPNConnectionExists(ctx, resourceName, &vpn),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexp.MustCompile(`vpn-connection/vpn-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`vpn-connection/vpn-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "core_network_arn", ""),
 					resource.TestCheckResourceAttr(resourceName, "core_network_attachment_arn", ""),
 					resource.TestCheckResourceAttrSet(resourceName, "customer_gateway_configuration"),
@@ -408,7 +411,7 @@ func TestAccSiteVPNConnection_transitGatewayID(t *testing.T) {
 				Config: testAccSiteVPNConnectionConfig_transitGateway(rName, rBgpAsn),
 				Check: resource.ComposeTestCheckFunc(
 					testAccVPNConnectionExists(ctx, resourceName, &vpn),
-					resource.TestMatchResourceAttr(resourceName, "transit_gateway_attachment_id", regexp.MustCompile(`tgw-attach-.+`)),
+					resource.TestMatchResourceAttr(resourceName, "transit_gateway_attachment_id", regexache.MustCompile(`tgw-attach-.+`)),
 					resource.TestCheckResourceAttrPair(resourceName, "transit_gateway_id", transitGatewayResourceName, "id"),
 				),
 			},
@@ -514,7 +517,7 @@ func TestAccSiteVPNConnection_tunnel1PreSharedKey(t *testing.T) {
 func TestAccSiteVPNConnection_tunnelOptions(t *testing.T) {
 	ctx := acctest.Context(t)
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
-	badCidrRangeErr := regexp.MustCompile(`expected \w+ to not be any of \[[\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/30\s?]+\]`)
+	badCidrRangeErr := regexache.MustCompile(`expected \w+ to not be any of \[[\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/30\s?]+\]`)
 	rBgpAsn := sdkacctest.RandIntRange(64512, 65534)
 	resourceName := "aws_vpn_connection.test"
 	var vpn ec2.VpnConnection
@@ -569,15 +572,15 @@ func TestAccSiteVPNConnection_tunnelOptions(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccSiteVPNConnectionConfig_singleTunnelOptions(rName, rBgpAsn, "12345678", "not-a-cidr"),
-				ExpectError: regexp.MustCompile(`invalid CIDR address: not-a-cidr`),
+				ExpectError: regexache.MustCompile(`invalid CIDR address: not-a-cidr`),
 			},
 			{
 				Config:      testAccSiteVPNConnectionConfig_singleTunnelOptions(rName, rBgpAsn, "12345678", "169.254.254.0/31"),
-				ExpectError: regexp.MustCompile(`expected "\w+" to contain a network Value with between 30 and 30 significant bits`),
+				ExpectError: regexache.MustCompile(`expected "\w+" to contain a network Value with between 30 and 30 significant bits`),
 			},
 			{
 				Config:      testAccSiteVPNConnectionConfig_singleTunnelOptions(rName, rBgpAsn, "12345678", "172.16.0.0/30"),
-				ExpectError: regexp.MustCompile(`must be within 169.254.0.0/16`),
+				ExpectError: regexache.MustCompile(`must be within 169.254.0.0/16`),
 			},
 			{
 				Config:      testAccSiteVPNConnectionConfig_singleTunnelOptions(rName, rBgpAsn, "12345678", "169.254.0.0/30"),
@@ -609,19 +612,19 @@ func TestAccSiteVPNConnection_tunnelOptions(t *testing.T) {
 			},
 			{
 				Config:      testAccSiteVPNConnectionConfig_singleTunnelOptions(rName, rBgpAsn, "1234567", "169.254.254.0/30"),
-				ExpectError: regexp.MustCompile(`expected length of \w+ to be in the range \(8 - 64\)`),
+				ExpectError: regexache.MustCompile(`expected length of \w+ to be in the range \(8 - 64\)`),
 			},
 			{
 				Config:      testAccSiteVPNConnectionConfig_singleTunnelOptions(rName, rBgpAsn, sdkacctest.RandStringFromCharSet(65, sdkacctest.CharSetAlpha), "169.254.254.0/30"),
-				ExpectError: regexp.MustCompile(`expected length of \w+ to be in the range \(8 - 64\)`),
+				ExpectError: regexache.MustCompile(`expected length of \w+ to be in the range \(8 - 64\)`),
 			},
 			{
 				Config:      testAccSiteVPNConnectionConfig_singleTunnelOptions(rName, rBgpAsn, "01234567", "169.254.254.0/30"),
-				ExpectError: regexp.MustCompile(`cannot start with zero character`),
+				ExpectError: regexache.MustCompile(`cannot start with zero character`),
 			},
 			{
 				Config:      testAccSiteVPNConnectionConfig_singleTunnelOptions(rName, rBgpAsn, "1234567!", "169.254.254.0/30"),
-				ExpectError: regexp.MustCompile(`can only contain alphanumeric, period and underscore characters`),
+				ExpectError: regexache.MustCompile(`can only contain alphanumeric, period and underscore characters`),
 			},
 			{
 				Config: testAccSiteVPNConnectionConfig_tunnelOptions(rName, rBgpAsn, "192.168.1.1/32", "192.168.1.2/32", tunnel1, tunnel2),
diff --git a/internal/service/ec2/vpnsite_customer_gateway.go b/internal/service/ec2/vpnsite_customer_gateway.go
index 4fc1a2f7c11..e4d922c8430 100644
--- a/internal/service/ec2/vpnsite_customer_gateway.go
+++ b/internal/service/ec2/vpnsite_customer_gateway.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/vpnsite_customer_gateway_data_source.go b/internal/service/ec2/vpnsite_customer_gateway_data_source.go
index 8226c591840..fdadebbd281 100644
--- a/internal/service/ec2/vpnsite_customer_gateway_data_source.go
+++ b/internal/service/ec2/vpnsite_customer_gateway_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -42,7 +45,7 @@ func DataSourceCustomerGateway() *schema.Resource {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
-			"filter": DataSourceFiltersSchema(),
+			"filter": CustomFiltersSchema(),
 			"id": {
 				Type:     schema.TypeString,
 				Optional: true,
@@ -68,7 +71,7 @@ func dataSourceCustomerGatewayRead(ctx context.Context, d *schema.ResourceData,
 	input := &ec2.DescribeCustomerGatewaysInput{}
 
 	if v, ok := d.GetOk("filter"); ok {
-		input.Filters = BuildFiltersDataSource(v.(*schema.Set))
+		input.Filters = BuildCustomFilterList(v.(*schema.Set))
 	}
 
 	if v, ok := d.GetOk("id"); ok {
diff --git a/internal/service/ec2/vpnsite_customer_gateway_data_source_test.go b/internal/service/ec2/vpnsite_customer_gateway_data_source_test.go
index 36ea0257a3f..e5cb04ffcd3 100644
--- a/internal/service/ec2/vpnsite_customer_gateway_data_source_test.go
+++ b/internal/service/ec2/vpnsite_customer_gateway_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/vpnsite_customer_gateway_test.go b/internal/service/ec2/vpnsite_customer_gateway_test.go
index 3dd71954201..0d9f007c993 100644
--- a/internal/service/ec2/vpnsite_customer_gateway_test.go
+++ b/internal/service/ec2/vpnsite_customer_gateway_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"strconv"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/acmpca"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -34,7 +37,7 @@ func TestAccSiteVPNCustomerGateway_basic(t *testing.T) {
 				Config: testAccSiteVPNCustomerGatewayConfig_basic(rBgpAsn),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckCustomerGatewayExists(ctx, resourceName, &gateway),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexp.MustCompile(`customer-gateway/cgw-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`customer-gateway/cgw-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "bgp_asn", strconv.Itoa(rBgpAsn)),
 					resource.TestCheckResourceAttr(resourceName, "certificate_arn", ""),
 					resource.TestCheckResourceAttr(resourceName, "device_name", ""),
diff --git a/internal/service/ec2/vpnsite_gateway.go b/internal/service/ec2/vpnsite_gateway.go
index 2c463b8afd7..41b7c27ddf2 100644
--- a/internal/service/ec2/vpnsite_gateway.go
+++ b/internal/service/ec2/vpnsite_gateway.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -83,7 +86,6 @@ func resourceVPNGatewayCreate(ctx context.Context, d *schema.ResourceData, meta
 		input.AmazonSideAsn = aws.Int64(v)
 	}
 
-	log.Printf("[DEBUG] Creating EC2 VPN Gateway: %s", input)
 	output, err := conn.CreateVpnGatewayWithContext(ctx, input)
 
 	if err != nil {
@@ -105,7 +107,7 @@ func resourceVPNGatewayRead(ctx context.Context, d *schema.ResourceData, meta in
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).EC2Conn(ctx)
 
-	outputRaw, err := tfresource.RetryWhenNewResourceNotFound(ctx, propagationTimeout, func() (interface{}, error) {
+	outputRaw, err := tfresource.RetryWhenNewResourceNotFound(ctx, ec2PropagationTimeout, func() (interface{}, error) {
 		return FindVPNGatewayByID(ctx, conn, d.Id())
 	}, d.IsNewResource())
 
@@ -203,19 +205,16 @@ func attachVPNGatewayToVPC(ctx context.Context, conn *ec2.EC2, vpnGatewayID, vpc
 		VpnGatewayId: aws.String(vpnGatewayID),
 	}
 
-	log.Printf("[INFO] Attaching EC2 VPN Gateway (%s) to VPC (%s)", vpnGatewayID, vpcID)
-	_, err := tfresource.RetryWhenAWSErrCodeEquals(ctx, propagationTimeout, func() (interface{}, error) {
+	_, err := tfresource.RetryWhenAWSErrCodeEquals(ctx, ec2PropagationTimeout, func() (interface{}, error) {
 		return conn.AttachVpnGatewayWithContext(ctx, input)
 	}, errCodeInvalidVPNGatewayIDNotFound)
 
 	if err != nil {
-		return fmt.Errorf("attaching to VPC (%s): %w", vpcID, err)
+		return fmt.Errorf("attaching EC2 VPN Gateway (%s) to VPC (%s): %w", vpnGatewayID, vpcID, err)
 	}
 
-	_, err = WaitVPNGatewayVPCAttachmentAttached(ctx, conn, vpnGatewayID, vpcID)
-
-	if err != nil {
-		return fmt.Errorf("attaching to VPC (%s): waiting for completion: %w", vpcID, err)
+	if _, err := WaitVPNGatewayVPCAttachmentAttached(ctx, conn, vpnGatewayID, vpcID); err != nil {
+		return fmt.Errorf("waiting for EC2 VPN Gateway (%s) to VPC (%s) attachment create: %w", vpnGatewayID, vpcID, err)
 	}
 
 	return nil
@@ -227,7 +226,6 @@ func detachVPNGatewayFromVPC(ctx context.Context, conn *ec2.EC2, vpnGatewayID, v
 		VpnGatewayId: aws.String(vpnGatewayID),
 	}
 
-	log.Printf("[INFO] Detaching EC2 VPN Gateway (%s) from VPC (%s)", vpnGatewayID, vpcID)
 	_, err := conn.DetachVpnGatewayWithContext(ctx, input)
 
 	if tfawserr.ErrCodeEquals(err, errCodeInvalidVPNGatewayAttachmentNotFound, errCodeInvalidVPNGatewayIDNotFound) {
@@ -235,13 +233,11 @@ func detachVPNGatewayFromVPC(ctx context.Context, conn *ec2.EC2, vpnGatewayID, v
 	}
 
 	if err != nil {
-		return fmt.Errorf("detaching from VPC (%s): %w", vpcID, err)
+		return fmt.Errorf("detaching EC2 VPN Gateway (%s) from VPC (%s): %w", vpnGatewayID, vpcID, err)
 	}
 
-	_, err = WaitVPNGatewayVPCAttachmentDetached(ctx, conn, vpnGatewayID, vpcID)
-
-	if err != nil {
-		return fmt.Errorf("detaching from VPC (%s): waiting for completion: %w", vpcID, err)
+	if _, err := WaitVPNGatewayVPCAttachmentDetached(ctx, conn, vpnGatewayID, vpcID); err != nil {
+		return fmt.Errorf("waiting for EC2 VPN Gateway (%s) to VPC (%s) attachment delete: %w", vpnGatewayID, vpcID, err)
 	}
 
 	return nil
diff --git a/internal/service/ec2/vpnsite_gateway_attachment.go b/internal/service/ec2/vpnsite_gateway_attachment.go
index ea8af4dc50c..2e37b32d4ae 100644
--- a/internal/service/ec2/vpnsite_gateway_attachment.go
+++ b/internal/service/ec2/vpnsite_gateway_attachment.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/vpnsite_gateway_attachment_test.go b/internal/service/ec2/vpnsite_gateway_attachment_test.go
index 10d7b3c01cd..ec2162cc5d8 100644
--- a/internal/service/ec2/vpnsite_gateway_attachment_test.go
+++ b/internal/service/ec2/vpnsite_gateway_attachment_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/vpnsite_gateway_data_source.go b/internal/service/ec2/vpnsite_gateway_data_source.go
index e91c9bc06ec..6d94b5970df 100644
--- a/internal/service/ec2/vpnsite_gateway_data_source.go
+++ b/internal/service/ec2/vpnsite_gateway_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/vpnsite_gateway_data_source_test.go b/internal/service/ec2/vpnsite_gateway_data_source_test.go
index cdc9972ad66..2bdab45e8a3 100644
--- a/internal/service/ec2/vpnsite_gateway_data_source_test.go
+++ b/internal/service/ec2/vpnsite_gateway_data_source_test.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -56,7 +59,7 @@ func TestAccSiteVPNGatewayDataSource_attached(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttrPair(dataSourceName, "id", "aws_vpn_gateway.test", "id"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "attached_vpc_id", "aws_vpc.test", "id"),
-					resource.TestMatchResourceAttr(dataSourceName, "state", regexp.MustCompile("(?i)available")),
+					resource.TestMatchResourceAttr(dataSourceName, "state", regexache.MustCompile("(?i)available")),
 				),
 			},
 		},
diff --git a/internal/service/ec2/vpnsite_gateway_route_propagation.go b/internal/service/ec2/vpnsite_gateway_route_propagation.go
index 23e9c743129..644ec71f2dc 100644
--- a/internal/service/ec2/vpnsite_gateway_route_propagation.go
+++ b/internal/service/ec2/vpnsite_gateway_route_propagation.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/vpnsite_gateway_route_propagation_test.go b/internal/service/ec2/vpnsite_gateway_route_propagation_test.go
index 48b1f129865..a0b098a9d4d 100644
--- a/internal/service/ec2/vpnsite_gateway_route_propagation_test.go
+++ b/internal/service/ec2/vpnsite_gateway_route_propagation_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
diff --git a/internal/service/ec2/vpnsite_gateway_test.go b/internal/service/ec2/vpnsite_gateway_test.go
index 9904a729673..27c102d950c 100644
--- a/internal/service/ec2/vpnsite_gateway_test.go
+++ b/internal/service/ec2/vpnsite_gateway_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -50,7 +53,7 @@ func TestAccSiteVPNGateway_basic(t *testing.T) {
 				Config: testAccSiteVPNGatewayConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckVPNGatewayExists(ctx, resourceName, &v1),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexp.MustCompile(`vpn-gateway/vgw-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`vpn-gateway/vgw-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 				),
 			},
diff --git a/internal/service/ec2/wait.go b/internal/service/ec2/wait.go
index 7aff3519229..0c433184fc7 100644
--- a/internal/service/ec2/wait.go
+++ b/internal/service/ec2/wait.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
@@ -7,11 +10,15 @@ import (
 	"strconv"
 	"time"
 
+	aws_sdkv2 "github.com/aws/aws-sdk-go-v2/aws"
+	ec2_sdkv2 "github.com/aws/aws-sdk-go-v2/service/ec2"
+	"github.com/aws/aws-sdk-go-v2/service/ec2/types"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	multierror "github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
+	"github.com/hashicorp/terraform-provider-aws/internal/enum"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
@@ -20,9 +27,14 @@ const (
 	InstanceStartTimeout = 10 * time.Minute
 	InstanceStopTimeout  = 10 * time.Minute
 
-	// General timeout for EC2 resource creations to propagate.
+	// General timeout for IAM resource change to propagate.
+	// See https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_general.html#troubleshoot_general_eventual-consistency.
+	// We have settled on 2 minutes as the best timeout value.
+	iamPropagationTimeout = 2 * time.Minute
+
+	// General timeout for EC2 resource changes to propagate.
 	// See https://docs.aws.amazon.com/AWSEC2/latest/APIReference/query-api-troubleshooting.html#eventual-consistency.
-	propagationTimeout = 2 * time.Minute
+	ec2PropagationTimeout = 5 * time.Minute // nosemgrep:ci.ec2-in-const-name, ci.ec2-in-var-name
 
 	RouteNotFoundChecks                        = 1000 // Should exceed any reasonable custom timeout value.
 	RouteTableNotFoundChecks                   = 1000 // Should exceed any reasonable custom timeout value.
@@ -436,7 +448,7 @@ func WaitInstanceIAMInstanceProfileUpdated(ctx context.Context, conn *ec2.EC2, i
 	stateConf := &retry.StateChangeConf{
 		Target:     []string{expectedValue},
 		Refresh:    StatusInstanceIAMInstanceProfile(ctx, conn, instanceID),
-		Timeout:    propagationTimeout,
+		Timeout:    ec2PropagationTimeout,
 		Delay:      10 * time.Second,
 		MinTimeout: 3 * time.Second,
 	}
@@ -580,7 +592,7 @@ func WaitInstanceCapacityReservationSpecificationUpdated(ctx context.Context, co
 	stateConf := &retry.StateChangeConf{
 		Target:     []string{strconv.FormatBool(true)},
 		Refresh:    StatusInstanceCapacityReservationSpecificationEquals(ctx, conn, instanceID, expectedValue),
-		Timeout:    propagationTimeout,
+		Timeout:    ec2PropagationTimeout,
 		Delay:      10 * time.Second,
 		MinTimeout: 3 * time.Second,
 	}
@@ -689,8 +701,6 @@ func WaitRouteReady(ctx context.Context, conn *ec2.EC2, routeFinder RouteFinder,
 }
 
 const (
-	RouteTableAssociationPropagationTimeout = 5 * time.Minute
-
 	RouteTableAssociationCreatedTimeout = 5 * time.Minute
 	RouteTableAssociationUpdatedTimeout = 5 * time.Minute
 	RouteTableAssociationDeletedTimeout = 5 * time.Minute
@@ -817,8 +827,6 @@ func WaitSecurityGroupCreated(ctx context.Context, conn *ec2.EC2, id string, tim
 }
 
 const (
-	SubnetPropagationTimeout                     = 2 * time.Minute
-	SubnetAttributePropagationTimeout            = 5 * time.Minute
 	SubnetIPv6CIDRBlockAssociationCreatedTimeout = 3 * time.Minute
 	SubnetIPv6CIDRBlockAssociationDeletedTimeout = 3 * time.Minute
 )
@@ -886,7 +894,7 @@ func waitSubnetAssignIPv6AddressOnCreationUpdated(ctx context.Context, conn *ec2
 	stateConf := &retry.StateChangeConf{
 		Target:     []string{strconv.FormatBool(expectedValue)},
 		Refresh:    StatusSubnetAssignIPv6AddressOnCreation(ctx, conn, subnetID),
-		Timeout:    SubnetAttributePropagationTimeout,
+		Timeout:    ec2PropagationTimeout,
 		Delay:      10 * time.Second,
 		MinTimeout: 3 * time.Second,
 	}
@@ -904,7 +912,7 @@ func waitSubnetEnableLniAtDeviceIndexUpdated(ctx context.Context, conn *ec2.EC2,
 	stateConf := &retry.StateChangeConf{
 		Target:     []string{strconv.FormatInt(expectedValue, 10)},
 		Refresh:    StatusSubnetEnableLniAtDeviceIndex(ctx, conn, subnetID),
-		Timeout:    SubnetAttributePropagationTimeout,
+		Timeout:    ec2PropagationTimeout,
 		Delay:      10 * time.Second,
 		MinTimeout: 3 * time.Second,
 	}
@@ -922,7 +930,7 @@ func waitSubnetEnableDNS64Updated(ctx context.Context, conn *ec2.EC2, subnetID s
 	stateConf := &retry.StateChangeConf{
 		Target:     []string{strconv.FormatBool(expectedValue)},
 		Refresh:    StatusSubnetEnableDNS64(ctx, conn, subnetID),
-		Timeout:    SubnetAttributePropagationTimeout,
+		Timeout:    ec2PropagationTimeout,
 		Delay:      10 * time.Second,
 		MinTimeout: 3 * time.Second,
 	}
@@ -940,7 +948,7 @@ func waitSubnetEnableResourceNameDNSAAAARecordOnLaunchUpdated(ctx context.Contex
 	stateConf := &retry.StateChangeConf{
 		Target:     []string{strconv.FormatBool(expectedValue)},
 		Refresh:    StatusSubnetEnableResourceNameDNSAAAARecordOnLaunch(ctx, conn, subnetID),
-		Timeout:    SubnetAttributePropagationTimeout,
+		Timeout:    ec2PropagationTimeout,
 		Delay:      10 * time.Second,
 		MinTimeout: 3 * time.Second,
 	}
@@ -958,7 +966,7 @@ func waitSubnetEnableResourceNameDNSARecordOnLaunchUpdated(ctx context.Context,
 	stateConf := &retry.StateChangeConf{
 		Target:     []string{strconv.FormatBool(expectedValue)},
 		Refresh:    StatusSubnetEnableResourceNameDNSARecordOnLaunch(ctx, conn, subnetID),
-		Timeout:    SubnetAttributePropagationTimeout,
+		Timeout:    ec2PropagationTimeout,
 		Delay:      10 * time.Second,
 		MinTimeout: 3 * time.Second,
 	}
@@ -976,7 +984,7 @@ func WaitSubnetMapCustomerOwnedIPOnLaunchUpdated(ctx context.Context, conn *ec2.
 	stateConf := &retry.StateChangeConf{
 		Target:     []string{strconv.FormatBool(expectedValue)},
 		Refresh:    StatusSubnetMapCustomerOwnedIPOnLaunch(ctx, conn, subnetID),
-		Timeout:    SubnetAttributePropagationTimeout,
+		Timeout:    ec2PropagationTimeout,
 		Delay:      10 * time.Second,
 		MinTimeout: 3 * time.Second,
 	}
@@ -994,7 +1002,7 @@ func WaitSubnetMapPublicIPOnLaunchUpdated(ctx context.Context, conn *ec2.EC2, su
 	stateConf := &retry.StateChangeConf{
 		Target:     []string{strconv.FormatBool(expectedValue)},
 		Refresh:    StatusSubnetMapPublicIPOnLaunch(ctx, conn, subnetID),
-		Timeout:    SubnetAttributePropagationTimeout,
+		Timeout:    ec2PropagationTimeout,
 		Delay:      10 * time.Second,
 		MinTimeout: 3 * time.Second,
 	}
@@ -1012,7 +1020,7 @@ func WaitSubnetPrivateDNSHostnameTypeOnLaunchUpdated(ctx context.Context, conn *
 	stateConf := &retry.StateChangeConf{
 		Target:     []string{expectedValue},
 		Refresh:    StatusSubnetPrivateDNSHostnameTypeOnLaunch(ctx, conn, subnetID),
-		Timeout:    SubnetAttributePropagationTimeout,
+		Timeout:    ec2PropagationTimeout,
 		Delay:      10 * time.Second,
 		MinTimeout: 3 * time.Second,
 	}
@@ -1358,7 +1366,7 @@ func WaitTransitGatewayRouteCreated(ctx context.Context, conn *ec2.EC2, transitG
 		Pending: []string{ec2.TransitGatewayRouteStatePending},
 		Target:  []string{ec2.TransitGatewayRouteStateActive, ec2.TransitGatewayRouteStateBlackhole},
 		Timeout: TransitGatewayRouteCreatedTimeout,
-		Refresh: StatusTransitGatewayRouteState(ctx, conn, transitGatewayRouteTableID, destination),
+		Refresh: StatusTransitGatewayStaticRouteState(ctx, conn, transitGatewayRouteTableID, destination),
 	}
 
 	outputRaw, err := stateConf.WaitForStateContext(ctx)
@@ -1375,7 +1383,7 @@ func WaitTransitGatewayRouteDeleted(ctx context.Context, conn *ec2.EC2, transitG
 		Pending: []string{ec2.TransitGatewayRouteStateActive, ec2.TransitGatewayRouteStateBlackhole, ec2.TransitGatewayRouteStateDeleting},
 		Target:  []string{},
 		Timeout: TransitGatewayRouteDeletedTimeout,
-		Refresh: StatusTransitGatewayRouteState(ctx, conn, transitGatewayRouteTableID, destination),
+		Refresh: StatusTransitGatewayStaticRouteState(ctx, conn, transitGatewayRouteTableID, destination),
 	}
 
 	outputRaw, err := stateConf.WaitForStateContext(ctx)
@@ -1781,9 +1789,8 @@ func WaitVolumeModificationComplete(ctx context.Context, conn *ec2.EC2, id strin
 }
 
 const (
-	vpcAttributePropagationTimeout = 5 * time.Minute
-	vpcCreatedTimeout              = 10 * time.Minute
-	vpcDeletedTimeout              = 5 * time.Minute
+	vpcCreatedTimeout = 10 * time.Minute
+	vpcDeletedTimeout = 5 * time.Minute
 )
 
 func WaitVPCCreated(ctx context.Context, conn *ec2.EC2, id string) (*ec2.Vpc, error) {
@@ -1807,7 +1814,7 @@ func WaitVPCAttributeUpdated(ctx context.Context, conn *ec2.EC2, vpcID string, a
 	stateConf := &retry.StateChangeConf{
 		Target:     []string{strconv.FormatBool(expectedValue)},
 		Refresh:    StatusVPCAttributeValue(ctx, conn, vpcID, attribute),
-		Timeout:    vpcAttributePropagationTimeout,
+		Timeout:    ec2PropagationTimeout,
 		Delay:      10 * time.Second,
 		MinTimeout: 3 * time.Second,
 	}
@@ -1918,10 +1925,6 @@ func WaitVPCIPv6CIDRBlockAssociationDeleted(ctx context.Context, conn *ec2.EC2,
 	return nil, err
 }
 
-const (
-	VPCPeeringConnectionOptionsPropagationTimeout = 3 * time.Minute
-)
-
 func WaitVPCPeeringConnectionActive(ctx context.Context, conn *ec2.EC2, id string, timeout time.Duration) (*ec2.VpcPeeringConnection, error) {
 	stateConf := &retry.StateChangeConf{
 		Pending: []string{ec2.VpcPeeringConnectionStateReasonCodeInitiatingRequest, ec2.VpcPeeringConnectionStateReasonCodeProvisioning},
@@ -2046,17 +2049,12 @@ func WaitCustomerGatewayDeleted(ctx context.Context, conn *ec2.EC2, id string) (
 	return nil, err
 }
 
-const (
-	natGatewayCreatedTimeout = 10 * time.Minute
-	natGatewayDeletedTimeout = 30 * time.Minute
-)
-
-func WaitNATGatewayCreated(ctx context.Context, conn *ec2.EC2, id string) (*ec2.NatGateway, error) {
+func WaitNATGatewayCreated(ctx context.Context, conn *ec2.EC2, id string, timeout time.Duration) (*ec2.NatGateway, error) {
 	stateConf := &retry.StateChangeConf{
 		Pending: []string{ec2.NatGatewayStatePending},
 		Target:  []string{ec2.NatGatewayStateAvailable},
 		Refresh: StatusNATGatewayState(ctx, conn, id),
-		Timeout: natGatewayCreatedTimeout,
+		Timeout: timeout,
 	}
 
 	outputRaw, err := stateConf.WaitForStateContext(ctx)
@@ -2072,12 +2070,12 @@ func WaitNATGatewayCreated(ctx context.Context, conn *ec2.EC2, id string) (*ec2.
 	return nil, err
 }
 
-func WaitNATGatewayDeleted(ctx context.Context, conn *ec2.EC2, id string) (*ec2.NatGateway, error) {
+func WaitNATGatewayDeleted(ctx context.Context, conn *ec2.EC2, id string, timeout time.Duration) (*ec2.NatGateway, error) {
 	stateConf := &retry.StateChangeConf{
 		Pending:    []string{ec2.NatGatewayStateDeleting},
 		Target:     []string{},
 		Refresh:    StatusNATGatewayState(ctx, conn, id),
-		Timeout:    natGatewayDeletedTimeout,
+		Timeout:    timeout,
 		Delay:      10 * time.Second,
 		MinTimeout: 10 * time.Second,
 	}
@@ -2095,6 +2093,90 @@ func WaitNATGatewayDeleted(ctx context.Context, conn *ec2.EC2, id string) (*ec2.
 	return nil, err
 }
 
+func WaitNATGatewayAddressAssigned(ctx context.Context, conn *ec2.EC2, natGatewayID, privateIP string, timeout time.Duration) (*ec2.NatGatewayAddress, error) {
+	stateConf := &retry.StateChangeConf{
+		Pending: []string{ec2.NatGatewayAddressStatusAssigning},
+		Target:  []string{ec2.NatGatewayAddressStatusSucceeded},
+		Refresh: StatusNATGatewayAddressByNATGatewayIDAndPrivateIP(ctx, conn, natGatewayID, privateIP),
+		Timeout: timeout,
+	}
+
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+
+	if output, ok := outputRaw.(*ec2.NatGatewayAddress); ok {
+		if status := aws.StringValue(output.Status); status == ec2.NatGatewayAddressStatusFailed {
+			tfresource.SetLastError(err, errors.New(aws.StringValue(output.FailureMessage)))
+		}
+
+		return output, err
+	}
+
+	return nil, err
+}
+
+func WaitNATGatewayAddressAssociated(ctx context.Context, conn *ec2.EC2, natGatewayID, allocationID string, timeout time.Duration) (*ec2.NatGatewayAddress, error) {
+	stateConf := &retry.StateChangeConf{
+		Pending: []string{ec2.NatGatewayAddressStatusAssociating},
+		Target:  []string{ec2.NatGatewayAddressStatusSucceeded},
+		Refresh: StatusNATGatewayAddressByNATGatewayIDAndAllocationID(ctx, conn, natGatewayID, allocationID),
+		Timeout: timeout,
+	}
+
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+
+	if output, ok := outputRaw.(*ec2.NatGatewayAddress); ok {
+		if status := aws.StringValue(output.Status); status == ec2.NatGatewayAddressStatusFailed {
+			tfresource.SetLastError(err, errors.New(aws.StringValue(output.FailureMessage)))
+		}
+
+		return output, err
+	}
+
+	return nil, err
+}
+
+func WaitNATGatewayAddressDisassociated(ctx context.Context, conn *ec2.EC2, natGatewayID, allocationID string, timeout time.Duration) (*ec2.NatGatewayAddress, error) {
+	stateConf := &retry.StateChangeConf{
+		Pending: []string{ec2.NatGatewayAddressStatusSucceeded, ec2.NatGatewayAddressStatusDisassociating},
+		Target:  []string{},
+		Refresh: StatusNATGatewayAddressByNATGatewayIDAndAllocationID(ctx, conn, natGatewayID, allocationID),
+		Timeout: timeout,
+	}
+
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+
+	if output, ok := outputRaw.(*ec2.NatGatewayAddress); ok {
+		if status := aws.StringValue(output.Status); status == ec2.NatGatewayAddressStatusFailed {
+			tfresource.SetLastError(err, errors.New(aws.StringValue(output.FailureMessage)))
+		}
+
+		return output, err
+	}
+
+	return nil, err
+}
+
+func WaitNATGatewayAddressUnassigned(ctx context.Context, conn *ec2.EC2, natGatewayID, privateIP string, timeout time.Duration) (*ec2.NatGatewayAddress, error) {
+	stateConf := &retry.StateChangeConf{
+		Pending: []string{ec2.NatGatewayAddressStatusUnassigning},
+		Target:  []string{},
+		Refresh: StatusNATGatewayAddressByNATGatewayIDAndPrivateIP(ctx, conn, natGatewayID, privateIP),
+		Timeout: timeout,
+	}
+
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+
+	if output, ok := outputRaw.(*ec2.NatGatewayAddress); ok {
+		if status := aws.StringValue(output.Status); status == ec2.NatGatewayAddressStatusFailed {
+			tfresource.SetLastError(err, errors.New(aws.StringValue(output.FailureMessage)))
+		}
+
+		return output, err
+	}
+
+	return nil, err
+}
+
 const (
 	vpnConnectionCreatedTimeout = 40 * time.Minute
 	vpnConnectionDeletedTimeout = 30 * time.Minute
@@ -2710,7 +2792,7 @@ func WaitVPCEndpointRouteTableAssociationDeleted(ctx context.Context, conn *ec2.
 		Pending:                   []string{VPCEndpointRouteTableAssociationStatusReady},
 		Target:                    []string{},
 		Refresh:                   StatusVPCEndpointRouteTableAssociation(ctx, conn, vpcEndpointID, routeTableID),
-		Timeout:                   propagationTimeout,
+		Timeout:                   ec2PropagationTimeout,
 		ContinuousTargetOccurence: 2,
 	}
 
@@ -2724,7 +2806,7 @@ func WaitVPCEndpointRouteTableAssociationReady(ctx context.Context, conn *ec2.EC
 		Pending:                   []string{},
 		Target:                    []string{VPCEndpointRouteTableAssociationStatusReady},
 		Refresh:                   StatusVPCEndpointRouteTableAssociation(ctx, conn, vpcEndpointID, routeTableID),
-		Timeout:                   propagationTimeout,
+		Timeout:                   ec2PropagationTimeout,
 		ContinuousTargetOccurence: 2,
 	}
 
@@ -3202,3 +3284,53 @@ func WaitInstanceReadyWithContext(ctx context.Context, conn *ec2.EC2, id string,
 
 	return nil, err
 }
+
+func WaitInstanceConnectEndpointCreated(ctx context.Context, conn *ec2_sdkv2.Client, id string, timeout time.Duration) (*types.Ec2InstanceConnectEndpoint, error) {
+	stateConf := &retry.StateChangeConf{
+		Pending: enum.Slice(types.Ec2InstanceConnectEndpointStateCreateInProgress),
+		Target:  enum.Slice(types.Ec2InstanceConnectEndpointStateCreateComplete),
+		Refresh: StatusInstanceConnectEndpointState(ctx, conn, id),
+		Timeout: timeout,
+	}
+
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+
+	if output, ok := outputRaw.(*types.Ec2InstanceConnectEndpoint); ok {
+		tfresource.SetLastError(err, errors.New(aws_sdkv2.ToString(output.StateMessage)))
+
+		return output, err
+	}
+
+	return nil, err
+}
+
+func WaitInstanceConnectEndpointDeleted(ctx context.Context, conn *ec2_sdkv2.Client, id string, timeout time.Duration) (*types.Ec2InstanceConnectEndpoint, error) {
+	stateConf := &retry.StateChangeConf{
+		Pending: enum.Slice(types.Ec2InstanceConnectEndpointStateDeleteInProgress),
+		Target:  []string{},
+		Refresh: StatusInstanceConnectEndpointState(ctx, conn, id),
+		Timeout: timeout,
+	}
+
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+
+	if output, ok := outputRaw.(*types.Ec2InstanceConnectEndpoint); ok {
+		tfresource.SetLastError(err, errors.New(aws_sdkv2.ToString(output.StateMessage)))
+
+		return output, err
+	}
+
+	return nil, err
+}
+
+func WaitImageBlockPublicAccessState(ctx context.Context, conn *ec2_sdkv2.Client, target string, timeout time.Duration) error {
+	stateConf := &retry.StateChangeConf{
+		Target:  []string{target},
+		Refresh: StatusImageBlockPublicAccessState(ctx, conn),
+		Timeout: timeout,
+	}
+
+	_, err := stateConf.WaitForStateContext(ctx)
+
+	return err
+}
diff --git a/internal/service/ec2/waitv2.go b/internal/service/ec2/waitv2.go
new file mode 100644
index 00000000000..c47658bc283
--- /dev/null
+++ b/internal/service/ec2/waitv2.go
@@ -0,0 +1,99 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package ec2
+
+import (
+	"context"
+	"errors"
+	"strconv"
+	"time"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/ec2"
+	"github.com/aws/aws-sdk-go-v2/service/ec2/types"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
+	"github.com/hashicorp/terraform-provider-aws/internal/enum"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+)
+
+func waitVPCCreatedV2(ctx context.Context, conn *ec2.Client, id string) (*types.Vpc, error) {
+	stateConf := &retry.StateChangeConf{
+		Pending: enum.Slice(types.VpcStatePending),
+		Target:  enum.Slice(types.VpcStateAvailable),
+		Refresh: statusVPCStateV2(ctx, conn, id),
+		Timeout: vpcCreatedTimeout,
+	}
+
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+
+	if output, ok := outputRaw.(*types.Vpc); ok {
+		return output, err
+	}
+
+	return nil, err
+}
+
+func waitVPCIPv6CIDRBlockAssociationCreatedV2(ctx context.Context, conn *ec2.Client, id string, timeout time.Duration) (*types.VpcCidrBlockState, error) { //nolint:unparam
+	stateConf := &retry.StateChangeConf{
+		Pending:    enum.Slice(types.VpcCidrBlockStateCodeAssociating, types.VpcCidrBlockStateCodeDisassociated, types.VpcCidrBlockStateCodeFailing),
+		Target:     enum.Slice(types.VpcCidrBlockStateCodeAssociated),
+		Refresh:    statusVPCIPv6CIDRBlockAssociationStateV2(ctx, conn, id),
+		Timeout:    timeout,
+		Delay:      10 * time.Second,
+		MinTimeout: 5 * time.Second,
+	}
+
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+
+	if output, ok := outputRaw.(*types.VpcCidrBlockState); ok {
+		if state := output.State; state == types.VpcCidrBlockStateCodeFailed {
+			tfresource.SetLastError(err, errors.New(aws.ToString(output.StatusMessage)))
+		}
+
+		return output, err
+	}
+
+	return nil, err
+}
+
+func waitVPCAttributeUpdatedV2(ctx context.Context, conn *ec2.Client, vpcID string, attribute types.VpcAttributeName, expectedValue bool) (*types.Vpc, error) { //nolint:unparam
+	stateConf := &retry.StateChangeConf{
+		Target:     []string{strconv.FormatBool(expectedValue)},
+		Refresh:    statusVPCAttributeValueV2(ctx, conn, vpcID, attribute),
+		Timeout:    ec2PropagationTimeout,
+		Delay:      10 * time.Second,
+		MinTimeout: 3 * time.Second,
+	}
+
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+
+	if output, ok := outputRaw.(*types.Vpc); ok {
+		return output, err
+	}
+
+	return nil, err
+}
+
+func waitVPCIPv6CIDRBlockAssociationDeletedV2(ctx context.Context, conn *ec2.Client, id string, timeout time.Duration) (*types.VpcCidrBlockState, error) {
+	stateConf := &retry.StateChangeConf{
+		Pending:    enum.Slice(types.VpcCidrBlockStateCodeAssociated, types.VpcCidrBlockStateCodeDisassociating, types.VpcCidrBlockStateCodeFailing),
+		Target:     []string{},
+		Refresh:    statusVPCIPv6CIDRBlockAssociationStateV2(ctx, conn, id),
+		Timeout:    timeout,
+		Delay:      10 * time.Second,
+		MinTimeout: 5 * time.Second,
+	}
+
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+
+	if output, ok := outputRaw.(*types.VpcCidrBlockState); ok {
+		if state := output.State; state == types.VpcCidrBlockStateCodeFailed {
+			tfresource.SetLastError(err, errors.New(aws.ToString(output.StatusMessage)))
+		}
+
+		return output, err
+	}
+
+	return nil, err
+}
diff --git a/internal/service/ec2/wavelength_carrier_gateway.go b/internal/service/ec2/wavelength_carrier_gateway.go
index 974541598a9..26a28b5098f 100644
--- a/internal/service/ec2/wavelength_carrier_gateway.go
+++ b/internal/service/ec2/wavelength_carrier_gateway.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2
 
 import (
diff --git a/internal/service/ec2/wavelength_carrier_gateway_test.go b/internal/service/ec2/wavelength_carrier_gateway_test.go
index e98b53251be..d26d4c9de32 100644
--- a/internal/service/ec2/wavelength_carrier_gateway_test.go
+++ b/internal/service/ec2/wavelength_carrier_gateway_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ec2_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -33,7 +36,7 @@ func TestAccWavelengthCarrierGateway_basic(t *testing.T) {
 				Config: testAccWavelengthCarrierGatewayConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckCarrierGatewayExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexp.MustCompile(`carrier-gateway/cagw-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ec2", regexache.MustCompile(`carrier-gateway/cagw-.+`)),
 					acctest.CheckResourceAttrAccountID(resourceName, "owner_id"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 					resource.TestCheckResourceAttrPair(resourceName, "vpc_id", vpcResourceName, "id"),
diff --git a/internal/service/ecr/authorization_token_data_source.go b/internal/service/ecr/authorization_token_data_source.go
index 85784e451be..77c5c94f051 100644
--- a/internal/service/ecr/authorization_token_data_source.go
+++ b/internal/service/ecr/authorization_token_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ecr
 
 import (
diff --git a/internal/service/ecr/authorization_token_data_source_test.go b/internal/service/ecr/authorization_token_data_source_test.go
index 2d0968909c4..d56b9de98f1 100644
--- a/internal/service/ecr/authorization_token_data_source_test.go
+++ b/internal/service/ecr/authorization_token_data_source_test.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ecr_test
 
 import (
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/ecr"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -28,7 +31,7 @@ func TestAccECRAuthorizationTokenDataSource_basic(t *testing.T) {
 					resource.TestCheckResourceAttrSet(dataSourceName, "proxy_endpoint"),
 					resource.TestCheckResourceAttrSet(dataSourceName, "expires_at"),
 					resource.TestCheckResourceAttrSet(dataSourceName, "user_name"),
-					resource.TestMatchResourceAttr(dataSourceName, "user_name", regexp.MustCompile(`AWS`)),
+					resource.TestMatchResourceAttr(dataSourceName, "user_name", regexache.MustCompile(`AWS`)),
 					resource.TestCheckResourceAttrSet(dataSourceName, "password"),
 				),
 			},
@@ -40,7 +43,7 @@ func TestAccECRAuthorizationTokenDataSource_basic(t *testing.T) {
 					resource.TestCheckResourceAttrSet(dataSourceName, "proxy_endpoint"),
 					resource.TestCheckResourceAttrSet(dataSourceName, "expires_at"),
 					resource.TestCheckResourceAttrSet(dataSourceName, "user_name"),
-					resource.TestMatchResourceAttr(dataSourceName, "user_name", regexp.MustCompile(`AWS`)),
+					resource.TestMatchResourceAttr(dataSourceName, "user_name", regexache.MustCompile(`AWS`)),
 					resource.TestCheckResourceAttrSet(dataSourceName, "password"),
 				),
 			},
diff --git a/internal/service/ecr/consts.go b/internal/service/ecr/consts.go
index 7b1774acc19..a324e427309 100644
--- a/internal/service/ecr/consts.go
+++ b/internal/service/ecr/consts.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ecr
 
 import (
diff --git a/internal/service/ecr/errorcheck_test.go b/internal/service/ecr/errorcheck_test.go
index 2ebd3ad6481..f0ee803650a 100644
--- a/internal/service/ecr/errorcheck_test.go
+++ b/internal/service/ecr/errorcheck_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ecr_test
 
 import (
diff --git a/internal/service/ecr/find.go b/internal/service/ecr/find.go
index c1783193d77..fd6e63143ca 100644
--- a/internal/service/ecr/find.go
+++ b/internal/service/ecr/find.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ecr
 
 import (
diff --git a/internal/service/ecr/generate.go b/internal/service/ecr/generate.go
index 1d97af7fe16..c56b40a0d16 100644
--- a/internal/service/ecr/generate.go
+++ b/internal/service/ecr/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTags -ServiceTagsSlice -UpdateTags -CreateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/ecr/image_data_source.go b/internal/service/ecr/image_data_source.go
index 54e7741c218..61f863970c8 100644
--- a/internal/service/ecr/image_data_source.go
+++ b/internal/service/ecr/image_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ecr
 
 import (
@@ -113,8 +116,14 @@ func dataSourceImageRead(ctx context.Context, d *schema.ResourceData, meta inter
 			return sdkdiag.AppendErrorf(diags, "Your query returned more than one result. Please try a more specific search criteria, or set `most_recent` attribute to true.")
 		}
 
-		slices.SortFunc(imageDetails, func(a, b *ecr.ImageDetail) bool {
-			return aws.TimeValue(a.ImagePushedAt).After(aws.TimeValue(b.ImagePushedAt))
+		slices.SortFunc(imageDetails, func(a, b *ecr.ImageDetail) int {
+			if aws.TimeValue(a.ImagePushedAt).After(aws.TimeValue(b.ImagePushedAt)) {
+				return -1
+			}
+			if aws.TimeValue(a.ImagePushedAt).Before(aws.TimeValue(b.ImagePushedAt)) {
+				return 1
+			}
+			return 0
 		})
 	}
 
diff --git a/internal/service/ecr/image_data_source_test.go b/internal/service/ecr/image_data_source_test.go
index 05f03bc1e76..b2534568b55 100644
--- a/internal/service/ecr/image_data_source_test.go
+++ b/internal/service/ecr/image_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ecr_test
 
 import (
diff --git a/internal/service/ecr/lifecycle_policy.go b/internal/service/ecr/lifecycle_policy.go
index d5d92f1c985..9e9c9e9c44a 100644
--- a/internal/service/ecr/lifecycle_policy.go
+++ b/internal/service/ecr/lifecycle_policy.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ecr
 
 import (
diff --git a/internal/service/ecr/lifecycle_policy_test.go b/internal/service/ecr/lifecycle_policy_test.go
index 17004302029..5b3bacc0f31 100644
--- a/internal/service/ecr/lifecycle_policy_test.go
+++ b/internal/service/ecr/lifecycle_policy_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ecr_test
 
 import (
diff --git a/internal/service/ecr/pull_through_cache_rule.go b/internal/service/ecr/pull_through_cache_rule.go
index 4e391e82485..de356d55963 100644
--- a/internal/service/ecr/pull_through_cache_rule.go
+++ b/internal/service/ecr/pull_through_cache_rule.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ecr
 
 import (
 	"context"
 	"log"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ecr"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -34,7 +37,7 @@ func ResourcePullThroughCacheRule() *schema.Resource {
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(2, 20),
 					validation.StringMatch(
-						regexp.MustCompile(`^[a-z0-9]+(?:[._-][a-z0-9]+)*$`),
+						regexache.MustCompile(`^[0-9a-z]+(?:[._-][0-9a-z]+)*$`),
 						"must only include alphanumeric, underscore, period, or hyphen characters"),
 				),
 			},
diff --git a/internal/service/ecr/pull_through_cache_rule_data_source.go b/internal/service/ecr/pull_through_cache_rule_data_source.go
index cbd70ec57c8..65bd8491754 100644
--- a/internal/service/ecr/pull_through_cache_rule_data_source.go
+++ b/internal/service/ecr/pull_through_cache_rule_data_source.go
@@ -1,9 +1,12 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ecr
 
 import (
 	"context"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
@@ -23,7 +26,7 @@ func DataSourcePullThroughCacheRule() *schema.Resource {
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(2, 20),
 					validation.StringMatch(
-						regexp.MustCompile(`^[a-z0-9]+(?:[._-][a-z0-9]+)*$`),
+						regexache.MustCompile(`^[0-9a-z]+(?:[._-][0-9a-z]+)*$`),
 						"must only include alphanumeric, underscore, period, or hyphen characters"),
 				),
 			},
diff --git a/internal/service/ecr/pull_through_cache_rule_data_source_test.go b/internal/service/ecr/pull_through_cache_rule_data_source_test.go
index 7e15d01c239..f0e1ef7b84a 100644
--- a/internal/service/ecr/pull_through_cache_rule_data_source_test.go
+++ b/internal/service/ecr/pull_through_cache_rule_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ecr_test
 
 import (
diff --git a/internal/service/ecr/pull_through_cache_rule_test.go b/internal/service/ecr/pull_through_cache_rule_test.go
index 52426c6b921..a7afde6da90 100644
--- a/internal/service/ecr/pull_through_cache_rule_test.go
+++ b/internal/service/ecr/pull_through_cache_rule_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ecr_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/ecr"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -88,7 +91,7 @@ func TestAccECRPullThroughCacheRule_failWhenAlreadyExists(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckPullThroughCacheRuleExists(ctx, resourceName),
 				),
-				ExpectError: regexp.MustCompile(`PullThroughCacheRuleAlreadyExistsException`),
+				ExpectError: regexache.MustCompile(`PullThroughCacheRuleAlreadyExistsException`),
 			},
 		},
 	})
diff --git a/internal/service/ecr/registry_policy.go b/internal/service/ecr/registry_policy.go
index e747d1966cb..53c030854ff 100644
--- a/internal/service/ecr/registry_policy.go
+++ b/internal/service/ecr/registry_policy.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ecr
 
 import (
diff --git a/internal/service/ecr/registry_policy_test.go b/internal/service/ecr/registry_policy_test.go
index 07b8f3b19c3..6a45ea8c0ea 100644
--- a/internal/service/ecr/registry_policy_test.go
+++ b/internal/service/ecr/registry_policy_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ecr_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/ecr"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -41,7 +44,7 @@ func testAccRegistryPolicy_basic(t *testing.T) {
 				Config: testAccRegistryPolicyConfig_basic(),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRegistryPolicyExists(ctx, resourceName, &v),
-					resource.TestMatchResourceAttr(resourceName, "policy", regexp.MustCompile(`"ecr:ReplicateImage".+`)),
+					resource.TestMatchResourceAttr(resourceName, "policy", regexache.MustCompile(`"ecr:ReplicateImage".+`)),
 					acctest.CheckResourceAttrAccountID(resourceName, "registry_id"),
 				),
 			},
@@ -54,8 +57,8 @@ func testAccRegistryPolicy_basic(t *testing.T) {
 				Config: testAccRegistryPolicyConfig_updated(),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRegistryPolicyExists(ctx, resourceName, &v),
-					resource.TestMatchResourceAttr(resourceName, "policy", regexp.MustCompile(`"ecr:ReplicateImage".+`)),
-					resource.TestMatchResourceAttr(resourceName, "policy", regexp.MustCompile(`"ecr:CreateRepository".+`)),
+					resource.TestMatchResourceAttr(resourceName, "policy", regexache.MustCompile(`"ecr:ReplicateImage".+`)),
+					resource.TestMatchResourceAttr(resourceName, "policy", regexache.MustCompile(`"ecr:CreateRepository".+`)),
 					acctest.CheckResourceAttrAccountID(resourceName, "registry_id"),
 				),
 			},
diff --git a/internal/service/ecr/registry_scanning_configuration.go b/internal/service/ecr/registry_scanning_configuration.go
index f75d6245ebc..54a36925d27 100644
--- a/internal/service/ecr/registry_scanning_configuration.go
+++ b/internal/service/ecr/registry_scanning_configuration.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ecr
 
 import (
 	"context"
 	"log"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ecr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
@@ -48,7 +51,7 @@ func ResourceRegistryScanningConfiguration() *schema.Resource {
 										Required: true,
 										ValidateFunc: validation.All(
 											validation.StringLenBetween(1, 256),
-											validation.StringMatch(regexp.MustCompile(`^[a-z0-9*](?:[._\-/a-z0-9*]?[a-z0-9*]+)*$`), "must contain only lowercase alphanumeric, dot, underscore, hyphen, wildcard, and colon characters"),
+											validation.StringMatch(regexache.MustCompile(`^[0-9a-z*](?:[0-9a-z_./*-]?[0-9a-z*]+)*$`), "must contain only lowercase alphanumeric, dot, underscore, hyphen, wildcard, and colon characters"),
 										),
 									},
 									"filter_type": {
@@ -133,10 +136,6 @@ func resourceRegistryScanningConfigurationDelete(ctx context.Context, d *schema.
 // Helper functions
 
 func expandScanningRegistryRules(l []interface{}) []*ecr.RegistryScanningRule {
-	if len(l) == 0 || l[0] == nil {
-		return nil
-	}
-
 	rules := make([]*ecr.RegistryScanningRule, 0)
 
 	for _, rule := range l {
diff --git a/internal/service/ecr/registry_scanning_configuration_test.go b/internal/service/ecr/registry_scanning_configuration_test.go
index 14a632a7cb5..bf9b17940db 100644
--- a/internal/service/ecr/registry_scanning_configuration_test.go
+++ b/internal/service/ecr/registry_scanning_configuration_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ecr_test
 
 import (
@@ -106,6 +109,25 @@ func testAccRegistryScanningConfiguration_update(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "scan_type", "ENHANCED"),
 				),
 			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				Config: testAccRegistryScanningConfigurationConfig_basic(),
+				Check: resource.ComposeTestCheckFunc(
+					testAccRegistryScanningConfigurationExists(ctx, resourceName, &v),
+					acctest.CheckResourceAttrAccountID(resourceName, "registry_id"),
+					resource.TestCheckResourceAttr(resourceName, "rule.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "scan_type", "BASIC"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
 		},
 	})
 }
diff --git a/internal/service/ecr/replication_configuration.go b/internal/service/ecr/replication_configuration.go
index 899db3a52e5..c537ce532b6 100644
--- a/internal/service/ecr/replication_configuration.go
+++ b/internal/service/ecr/replication_configuration.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ecr
 
 import (
diff --git a/internal/service/ecr/replication_configuration_test.go b/internal/service/ecr/replication_configuration_test.go
index c5d0f65acbf..67fc5018d31 100644
--- a/internal/service/ecr/replication_configuration_test.go
+++ b/internal/service/ecr/replication_configuration_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ecr_test
 
 import (
diff --git a/internal/service/ecr/repository.go b/internal/service/ecr/repository.go
index 10f466e9096..159f33ea851 100644
--- a/internal/service/ecr/repository.go
+++ b/internal/service/ecr/repository.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ecr
 
 import (
diff --git a/internal/service/ecr/repository_data_source.go b/internal/service/ecr/repository_data_source.go
index 335cc4f7719..52961212386 100644
--- a/internal/service/ecr/repository_data_source.go
+++ b/internal/service/ecr/repository_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ecr
 
 import (
@@ -140,9 +143,15 @@ func dataSourceRepositoryRead(ctx context.Context, d *schema.ResourceData, meta
 		return sdkdiag.AppendErrorf(diags, "reading images for ECR Repository (%s): %s", d.Id(), err)
 	}
 
-	if len(imageDetails) > 1 {
-		slices.SortFunc(imageDetails, func(a, b *ecr.ImageDetail) bool {
-			return aws.TimeValue(a.ImagePushedAt).After(aws.TimeValue(b.ImagePushedAt))
+	if len(imageDetails) >= 1 {
+		slices.SortFunc(imageDetails, func(a, b *ecr.ImageDetail) int {
+			if aws.TimeValue(a.ImagePushedAt).After(aws.TimeValue(b.ImagePushedAt)) {
+				return -1
+			}
+			if aws.TimeValue(a.ImagePushedAt).Before(aws.TimeValue(b.ImagePushedAt)) {
+				return 1
+			}
+			return 0
 		})
 
 		d.Set("most_recent_image_tags", aws.StringValueSlice(imageDetails[0].ImageTags))
diff --git a/internal/service/ecr/repository_data_source_test.go b/internal/service/ecr/repository_data_source_test.go
index 2c84980a2e6..f894d7989c6 100644
--- a/internal/service/ecr/repository_data_source_test.go
+++ b/internal/service/ecr/repository_data_source_test.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ecr_test
 
 import (
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/ecr"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -77,7 +80,7 @@ func TestAccECRRepositoryDataSource_nonExistent(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccRepositoryDataSourceConfig_nonExistent,
-				ExpectError: regexp.MustCompile(`couldn't find resource`),
+				ExpectError: regexache.MustCompile(`couldn't find resource`),
 			},
 		},
 	})
diff --git a/internal/service/ecr/repository_policy.go b/internal/service/ecr/repository_policy.go
index 3a534b27ca9..cafc71a8ddd 100644
--- a/internal/service/ecr/repository_policy.go
+++ b/internal/service/ecr/repository_policy.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ecr
 
 import (
diff --git a/internal/service/ecr/repository_policy_test.go b/internal/service/ecr/repository_policy_test.go
index dc2c7db8c53..cabd2a574b4 100644
--- a/internal/service/ecr/repository_policy_test.go
+++ b/internal/service/ecr/repository_policy_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ecr_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ecr"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -33,7 +36,7 @@ func TestAccECRRepositoryPolicy_basic(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRepositoryPolicyExists(resourceName),
 					resource.TestCheckResourceAttrPair(resourceName, "repository", "aws_ecr_repository.test", "name"),
-					resource.TestMatchResourceAttr(resourceName, "policy", regexp.MustCompile(rName)),
+					resource.TestMatchResourceAttr(resourceName, "policy", regexache.MustCompile(rName)),
 					acctest.CheckResourceAttrAccountID(resourceName, "registry_id"),
 				),
 			},
@@ -47,8 +50,8 @@ func TestAccECRRepositoryPolicy_basic(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRepositoryPolicyExists(resourceName),
 					resource.TestCheckResourceAttrPair(resourceName, "repository", "aws_ecr_repository.test", "name"),
-					resource.TestMatchResourceAttr(resourceName, "policy", regexp.MustCompile(rName)),
-					resource.TestMatchResourceAttr(resourceName, "policy", regexp.MustCompile("ecr:DescribeImages")),
+					resource.TestMatchResourceAttr(resourceName, "policy", regexache.MustCompile(rName)),
+					resource.TestMatchResourceAttr(resourceName, "policy", regexache.MustCompile("ecr:DescribeImages")),
 					acctest.CheckResourceAttrAccountID(resourceName, "registry_id"),
 				),
 			},
@@ -71,8 +74,8 @@ func TestAccECRRepositoryPolicy_IAM_basic(t *testing.T) {
 				Config: testAccRepositoryPolicyConfig_iamRole(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRepositoryPolicyExists(resourceName),
-					resource.TestMatchResourceAttr(resourceName, "policy", regexp.MustCompile(rName)),
-					resource.TestMatchResourceAttr(resourceName, "policy", regexp.MustCompile("iam")),
+					resource.TestMatchResourceAttr(resourceName, "policy", regexache.MustCompile(rName)),
+					resource.TestMatchResourceAttr(resourceName, "policy", regexache.MustCompile("iam")),
 				),
 			},
 			{
@@ -100,8 +103,8 @@ func TestAccECRRepositoryPolicy_IAM_principalOrder(t *testing.T) {
 				Config: testAccRepositoryPolicyConfig_iamRoleOrderJSONEncode(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRepositoryPolicyExists(resourceName),
-					resource.TestMatchResourceAttr(resourceName, "policy", regexp.MustCompile(rName)),
-					resource.TestMatchResourceAttr(resourceName, "policy", regexp.MustCompile("iam")),
+					resource.TestMatchResourceAttr(resourceName, "policy", regexache.MustCompile(rName)),
+					resource.TestMatchResourceAttr(resourceName, "policy", regexache.MustCompile("iam")),
 				),
 			},
 			{
diff --git a/internal/service/ecr/repository_test.go b/internal/service/ecr/repository_test.go
index f45e19e470d..1c4baf7f810 100644
--- a/internal/service/ecr/repository_test.go
+++ b/internal/service/ecr/repository_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ecr_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ecr"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -222,7 +225,7 @@ func TestAccECRRepository_Encryption_kms(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "encryption_configuration.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "encryption_configuration.0.encryption_type", ecr.EncryptionTypeKms),
 					// This will be the default ECR service KMS key. We don't currently have a way to look this up.
-					acctest.MatchResourceAttrRegionalARN(resourceName, "encryption_configuration.0.kms_key", "kms", regexp.MustCompile(fmt.Sprintf("key/%s$", verify.UUIDRegexPattern))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "encryption_configuration.0.kms_key", "kms", regexache.MustCompile(fmt.Sprintf("key/%s$", verify.UUIDRegexPattern))),
 				),
 			},
 			{
diff --git a/internal/service/ecr/service_package_gen.go b/internal/service/ecr/service_package_gen.go
index 80aa8515137..21c06cb21fe 100644
--- a/internal/service/ecr/service_package_gen.go
+++ b/internal/service/ecr/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	ecr_sdkv1 "github.com/aws/aws-sdk-go/service/ecr"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -91,4 +92,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*e
 	return ecr_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/ecr/sweep.go b/internal/service/ecr/sweep.go
index 5e92412d7fd..2b4fb47cb48 100644
--- a/internal/service/ecr/sweep.go
+++ b/internal/service/ecr/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package ecr
 
@@ -13,9 +13,10 @@ import (
 	"github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_ecr_repository", &resource.Sweeper{
 		Name: "aws_ecr_repository",
 		F:    sweepRepositories,
@@ -24,7 +25,7 @@ func init() {
 
 func sweepRepositories(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
@@ -59,7 +60,7 @@ func sweepRepositories(region string) error {
 		return !lastPage
 	})
 	if err != nil {
-		if sweep.SkipSweepError(err) {
+		if awsv1.SkipSweepError(err) {
 			log.Printf("[WARN] Skipping ECR repository sweep for %s: %s", region, err)
 			return nil
 		}
diff --git a/internal/service/ecr/tags_gen.go b/internal/service/ecr/tags_gen.go
index 7d75f0d328e..876c7730907 100644
--- a/internal/service/ecr/tags_gen.go
+++ b/internal/service/ecr/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ecr"
 	"github.com/aws/aws-sdk-go/service/ecr/ecriface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -111,6 +113,8 @@ func updateTags(ctx context.Context, conn ecriface.ECRAPI, identifier string, ol
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.ECR)
 	if len(removedTags) > 0 {
diff --git a/internal/service/ecrpublic/authorization_token_data_source.go b/internal/service/ecrpublic/authorization_token_data_source.go
index 29534b9057c..720cc3a2311 100644
--- a/internal/service/ecrpublic/authorization_token_data_source.go
+++ b/internal/service/ecrpublic/authorization_token_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ecrpublic
 
 import (
diff --git a/internal/service/ecrpublic/authorization_token_data_source_test.go b/internal/service/ecrpublic/authorization_token_data_source_test.go
index 1a192008b2d..f1b5ed1d75c 100644
--- a/internal/service/ecrpublic/authorization_token_data_source_test.go
+++ b/internal/service/ecrpublic/authorization_token_data_source_test.go
@@ -1,9 +1,12 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ecrpublic_test
 
 import (
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws/endpoints"
 	"github.com/aws/aws-sdk-go/service/ecr"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -25,7 +28,7 @@ func TestAccECRPublicAuthorizationTokenDataSource_basic(t *testing.T) {
 					resource.TestCheckResourceAttrSet(dataSourceName, "authorization_token"),
 					resource.TestCheckResourceAttrSet(dataSourceName, "expires_at"),
 					resource.TestCheckResourceAttrSet(dataSourceName, "user_name"),
-					resource.TestMatchResourceAttr(dataSourceName, "user_name", regexp.MustCompile(`AWS`)),
+					resource.TestMatchResourceAttr(dataSourceName, "user_name", regexache.MustCompile(`AWS`)),
 					resource.TestCheckResourceAttrSet(dataSourceName, "password"),
 				),
 			},
diff --git a/internal/service/ecrpublic/generate.go b/internal/service/ecrpublic/generate.go
index 90928b51d01..5e9838dab92 100644
--- a/internal/service/ecrpublic/generate.go
+++ b/internal/service/ecrpublic/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTags -ServiceTagsSlice -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/ecrpublic/repository.go b/internal/service/ecrpublic/repository.go
index c455466f3cb..9696fe6f1f0 100644
--- a/internal/service/ecrpublic/repository.go
+++ b/internal/service/ecrpublic/repository.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ecrpublic
 
 import (
@@ -5,9 +8,9 @@ import (
 	"encoding/base64"
 	"fmt"
 	"log"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ecrpublic"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -49,7 +52,7 @@ func ResourceRepository() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(2, 205),
-					validation.StringMatch(regexp.MustCompile(`(?:[a-z0-9]+(?:[._-][a-z0-9]+)*/)*[a-z0-9]+(?:[._-][a-z0-9]+)*`), "see: https://docs.aws.amazon.com/AmazonECRPublic/latest/APIReference/API_CreateRepository.html#API_CreateRepository_RequestSyntax"),
+					validation.StringMatch(regexache.MustCompile(`(?:[0-9a-z]+(?:[._-][0-9a-z]+)*/)*[0-9a-z]+(?:[._-][0-9a-z]+)*`), "see: https://docs.aws.amazon.com/AmazonECRPublic/latest/APIReference/API_CreateRepository.html#API_CreateRepository_RequestSyntax"),
 				),
 			},
 			"catalog_data": {
diff --git a/internal/service/ecrpublic/repository_policy.go b/internal/service/ecrpublic/repository_policy.go
index b02616f9431..671eabc100d 100644
--- a/internal/service/ecrpublic/repository_policy.go
+++ b/internal/service/ecrpublic/repository_policy.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ecrpublic
 
 import (
diff --git a/internal/service/ecrpublic/repository_policy_test.go b/internal/service/ecrpublic/repository_policy_test.go
index dcfd31e60dc..501f4a88249 100644
--- a/internal/service/ecrpublic/repository_policy_test.go
+++ b/internal/service/ecrpublic/repository_policy_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ecrpublic_test
 
 import (
diff --git a/internal/service/ecrpublic/repository_test.go b/internal/service/ecrpublic/repository_test.go
index 38f9c8b57ab..c6f95e0ef45 100644
--- a/internal/service/ecrpublic/repository_test.go
+++ b/internal/service/ecrpublic/repository_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ecrpublic_test
 
 import (
diff --git a/internal/service/ecrpublic/service_package_gen.go b/internal/service/ecrpublic/service_package_gen.go
index 6fa0f91e370..08cc778d7b9 100644
--- a/internal/service/ecrpublic/service_package_gen.go
+++ b/internal/service/ecrpublic/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	ecrpublic_sdkv1 "github.com/aws/aws-sdk-go/service/ecrpublic"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -59,4 +60,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*e
 	return ecrpublic_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/ecrpublic/sweep.go b/internal/service/ecrpublic/sweep.go
index 482d4827040..10654b31130 100644
--- a/internal/service/ecrpublic/sweep.go
+++ b/internal/service/ecrpublic/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package ecrpublic
 
@@ -11,9 +11,10 @@ import (
 	"github.com/aws/aws-sdk-go/service/ecrpublic"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_ecrpublic_repository", &resource.Sweeper{
 		Name: "aws_ecrpublic_repository",
 		F:    sweepRepositories,
@@ -22,7 +23,7 @@ func init() {
 
 func sweepRepositories(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -48,7 +49,7 @@ func sweepRepositories(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping ECR Public Repository sweep for %s: %s", region, err)
 		return nil
 	}
@@ -57,7 +58,7 @@ func sweepRepositories(region string) error {
 		return fmt.Errorf("error listing ECR Public Repositories (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping ECR Public Repositories (%s): %w", region, err)
diff --git a/internal/service/ecrpublic/tags_gen.go b/internal/service/ecrpublic/tags_gen.go
index f14b333d18e..d6dda0b252b 100644
--- a/internal/service/ecrpublic/tags_gen.go
+++ b/internal/service/ecrpublic/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ecrpublic"
 	"github.com/aws/aws-sdk-go/service/ecrpublic/ecrpubliciface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -102,6 +104,8 @@ func updateTags(ctx context.Context, conn ecrpubliciface.ECRPublicAPI, identifie
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.ECRPublic)
 	if len(removedTags) > 0 {
diff --git a/internal/service/ecs/account_setting_default.go b/internal/service/ecs/account_setting_default.go
index 55e2451a9bd..746fe80dfca 100644
--- a/internal/service/ecs/account_setting_default.go
+++ b/internal/service/ecs/account_setting_default.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ecs
 
 import (
diff --git a/internal/service/ecs/account_setting_default_test.go b/internal/service/ecs/account_setting_default_test.go
index 23e0dc98c7f..5db7d49e094 100644
--- a/internal/service/ecs/account_setting_default_test.go
+++ b/internal/service/ecs/account_setting_default_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ecs_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ecs"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -31,7 +34,7 @@ func TestAccECSAccountSettingDefault_containerInstanceLongARNFormat(t *testing.T
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr(resourceName, "name", settingName),
 					resource.TestCheckResourceAttr(resourceName, "value", "enabled"),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "principal_arn", "iam", regexp.MustCompile("root")),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "principal_arn", "iam", regexache.MustCompile("root")),
 				),
 			},
 			{
@@ -60,7 +63,7 @@ func TestAccECSAccountSettingDefault_serviceLongARNFormat(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr(resourceName, "name", settingName),
 					resource.TestCheckResourceAttr(resourceName, "value", "enabled"),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "principal_arn", "iam", regexp.MustCompile("root")),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "principal_arn", "iam", regexache.MustCompile("root")),
 				),
 			},
 			{
@@ -89,7 +92,7 @@ func TestAccECSAccountSettingDefault_taskLongARNFormat(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr(resourceName, "name", settingName),
 					resource.TestCheckResourceAttr(resourceName, "value", "enabled"),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "principal_arn", "iam", regexp.MustCompile("root")),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "principal_arn", "iam", regexache.MustCompile("root")),
 				),
 			},
 			{
@@ -118,7 +121,7 @@ func TestAccECSAccountSettingDefault_vpcTrunking(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr(resourceName, "name", settingName),
 					resource.TestCheckResourceAttr(resourceName, "value", "enabled"),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "principal_arn", "iam", regexp.MustCompile("root")),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "principal_arn", "iam", regexache.MustCompile("root")),
 				),
 			},
 			{
@@ -147,7 +150,7 @@ func TestAccECSAccountSettingDefault_containerInsights(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr(resourceName, "name", settingName),
 					resource.TestCheckResourceAttr(resourceName, "value", "enabled"),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "principal_arn", "iam", regexp.MustCompile("root")),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "principal_arn", "iam", regexache.MustCompile("root")),
 				),
 			},
 			{
diff --git a/internal/service/ecs/capacity_provider.go b/internal/service/ecs/capacity_provider.go
index 89e92e4dcc0..ae413198690 100644
--- a/internal/service/ecs/capacity_provider.go
+++ b/internal/service/ecs/capacity_provider.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ecs
 
 import (
diff --git a/internal/service/ecs/capacity_provider_test.go b/internal/service/ecs/capacity_provider_test.go
index 09332cf70d5..0b5142fcf3c 100644
--- a/internal/service/ecs/capacity_provider_test.go
+++ b/internal/service/ecs/capacity_provider_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ecs_test
 
 import (
diff --git a/internal/service/ecs/cluster.go b/internal/service/ecs/cluster.go
index bb3f60cc3a5..fc5cd133800 100644
--- a/internal/service/ecs/cluster.go
+++ b/internal/service/ecs/cluster.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ecs
 
 import (
diff --git a/internal/service/ecs/cluster_capacity_providers.go b/internal/service/ecs/cluster_capacity_providers.go
index 4e390ca1420..35ff52c0c94 100644
--- a/internal/service/ecs/cluster_capacity_providers.go
+++ b/internal/service/ecs/cluster_capacity_providers.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ecs
 
 import (
diff --git a/internal/service/ecs/cluster_capacity_providers_test.go b/internal/service/ecs/cluster_capacity_providers_test.go
index f058fe832f5..fda541b8f5e 100644
--- a/internal/service/ecs/cluster_capacity_providers_test.go
+++ b/internal/service/ecs/cluster_capacity_providers_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ecs_test
 
 import (
diff --git a/internal/service/ecs/cluster_data_source.go b/internal/service/ecs/cluster_data_source.go
index 0df9e97902e..06d4b7b0306 100644
--- a/internal/service/ecs/cluster_data_source.go
+++ b/internal/service/ecs/cluster_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ecs
 
 import (
diff --git a/internal/service/ecs/cluster_data_source_test.go b/internal/service/ecs/cluster_data_source_test.go
index 481c23ab198..f3313597f05 100644
--- a/internal/service/ecs/cluster_data_source_test.go
+++ b/internal/service/ecs/cluster_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ecs_test
 
 import (
diff --git a/internal/service/ecs/cluster_test.go b/internal/service/ecs/cluster_test.go
index 1b74057048d..36178ff8087 100644
--- a/internal/service/ecs/cluster_test.go
+++ b/internal/service/ecs/cluster_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ecs_test
 
 import (
diff --git a/internal/service/ecs/consts.go b/internal/service/ecs/consts.go
index 3dfae22b648..51cea2cb9ae 100644
--- a/internal/service/ecs/consts.go
+++ b/internal/service/ecs/consts.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ecs
 
 import (
diff --git a/internal/service/ecs/container_definition_data_source.go b/internal/service/ecs/container_definition_data_source.go
index ae6fc54c0ea..0db5a4d8fca 100644
--- a/internal/service/ecs/container_definition_data_source.go
+++ b/internal/service/ecs/container_definition_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ecs
 
 import (
diff --git a/internal/service/ecs/container_definition_data_source_test.go b/internal/service/ecs/container_definition_data_source_test.go
index 0e172591d03..8fdf91de7ee 100644
--- a/internal/service/ecs/container_definition_data_source_test.go
+++ b/internal/service/ecs/container_definition_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ecs_test
 
 import (
diff --git a/internal/service/ecs/find.go b/internal/service/ecs/find.go
index 11e8e550517..d8635e37baf 100644
--- a/internal/service/ecs/find.go
+++ b/internal/service/ecs/find.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ecs
 
 import (
diff --git a/internal/service/ecs/flex.go b/internal/service/ecs/flex.go
index bb28fdeeb07..a9d9042e711 100644
--- a/internal/service/ecs/flex.go
+++ b/internal/service/ecs/flex.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ecs
 
 import (
diff --git a/internal/service/ecs/generate.go b/internal/service/ecs/generate.go
index bcbdb51bcdf..b9c02534b90 100644
--- a/internal/service/ecs/generate.go
+++ b/internal/service/ecs/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/listpages/main.go -ListOps=DescribeCapacityProviders
 //go:generate go run ../../generate/tagresource/main.go
 //go:generate go run ../../generate/tags/main.go -GetTag -ListTags -ServiceTagsSlice -UpdateTags -CreateTags -ParentNotFoundErrCode=InvalidParameterException "-ParentNotFoundErrMsg=The specified cluster is inactive. Specify an active cluster and try again."
diff --git a/internal/service/ecs/service.go b/internal/service/ecs/service.go
index 0760563d843..139abef7aea 100644
--- a/internal/service/ecs/service.go
+++ b/internal/service/ecs/service.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ecs
 
 import (
diff --git a/internal/service/ecs/service_data_source.go b/internal/service/ecs/service_data_source.go
index 0698a833af8..0a2e47aa186 100644
--- a/internal/service/ecs/service_data_source.go
+++ b/internal/service/ecs/service_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ecs
 
 import (
diff --git a/internal/service/ecs/service_data_source_test.go b/internal/service/ecs/service_data_source_test.go
index 98aa9337e7c..466853d8ee6 100644
--- a/internal/service/ecs/service_data_source_test.go
+++ b/internal/service/ecs/service_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ecs_test
 
 import (
diff --git a/internal/service/ecs/service_package_gen.go b/internal/service/ecs/service_package_gen.go
index 484f062430d..1f800c59c81 100644
--- a/internal/service/ecs/service_package_gen.go
+++ b/internal/service/ecs/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	ecs_sdkv1 "github.com/aws/aws-sdk-go/service/ecs"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -115,4 +116,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*e
 	return ecs_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/ecs/service_test.go b/internal/service/ecs/service_test.go
index 7af22d5221b..f5c0aa175b7 100644
--- a/internal/service/ecs/service_test.go
+++ b/internal/service/ecs/service_test.go
@@ -1,13 +1,16 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ecs_test
 
 import (
 	"context"
 	"fmt"
 	"math"
-	"regexp"
 	"testing"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ecs"
 	"github.com/aws/aws-sdk-go/service/servicediscovery"
@@ -153,7 +156,7 @@ func TestAccECSService_basicImport(t *testing.T) {
 				ImportStateId:     fmt.Sprintf("%s/nonexistent", rName),
 				ImportState:       true,
 				ImportStateVerify: false,
-				ExpectError:       regexp.MustCompile(`Cannot import non-existent remote object`),
+				ExpectError:       regexache.MustCompile(`Cannot import non-existent remote object`),
 			},
 		},
 	})
@@ -350,11 +353,11 @@ func TestAccECSService_healthCheckGracePeriodSeconds(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccServiceConfig_healthCheckGracePeriodSeconds(rName, -1),
-				ExpectError: regexp.MustCompile(`expected health_check_grace_period_seconds to be in the range`),
+				ExpectError: regexache.MustCompile(`expected health_check_grace_period_seconds to be in the range`),
 			},
 			{
 				Config:      testAccServiceConfig_healthCheckGracePeriodSeconds(rName, math.MaxInt32+1),
-				ExpectError: regexp.MustCompile(`expected health_check_grace_period_seconds to be in the range`),
+				ExpectError: regexache.MustCompile(`expected health_check_grace_period_seconds to be in the range`),
 			},
 			{
 				Config: testAccServiceConfig_healthCheckGracePeriodSeconds(rName, 300),
@@ -886,7 +889,7 @@ func TestAccECSService_PlacementStrategy_missing(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccServiceConfig_placementStrategyType(rName, ""),
-				ExpectError: regexp.MustCompile(`expected ordered_placement_strategy.0.type to be one of`),
+				ExpectError: regexache.MustCompile(`expected ordered_placement_strategy.0.type to be one of`),
 			},
 		},
 	})
diff --git a/internal/service/ecs/status.go b/internal/service/ecs/status.go
index 5befd24c5c5..580b79ee184 100644
--- a/internal/service/ecs/status.go
+++ b/internal/service/ecs/status.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ecs
 
 import (
diff --git a/internal/service/ecs/sweep.go b/internal/service/ecs/sweep.go
index 1b0dc6cc92f..e917ace6f1e 100644
--- a/internal/service/ecs/sweep.go
+++ b/internal/service/ecs/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package ecs
 
@@ -12,9 +12,10 @@ import (
 	multierror "github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_ecs_capacity_provider", &resource.Sweeper{
 		Name: "aws_ecs_capacity_provider",
 		F:    sweepCapacityProviders,
@@ -48,7 +49,7 @@ func init() {
 
 func sweepCapacityProviders(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
@@ -79,7 +80,7 @@ func sweepCapacityProviders(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping ECS Capacity Provider sweep for %s: %s", region, err)
 		return nil
 	}
@@ -88,7 +89,7 @@ func sweepCapacityProviders(region string) error {
 		return fmt.Errorf("error listing ECS Capacity Providers (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping ECS Capacity Providers (%s): %w", region, err)
@@ -99,7 +100,7 @@ func sweepCapacityProviders(region string) error {
 
 func sweepClusters(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -123,7 +124,7 @@ func sweepClusters(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping ECS Cluster sweep for %s: %s", region, err)
 		return nil
 	}
@@ -132,7 +133,7 @@ func sweepClusters(region string) error {
 		return fmt.Errorf("error listing ECS Clusters (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping ECS Clusters (%s): %w", region, err)
@@ -143,7 +144,7 @@ func sweepClusters(region string) error {
 
 func sweepServices(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -180,7 +181,7 @@ func sweepServices(region string) error {
 				return !lastPage
 			})
 
-			if sweep.SkipSweepError(err) {
+			if awsv1.SkipSweepError(err) {
 				continue
 			}
 
@@ -192,7 +193,7 @@ func sweepServices(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping ECS Service sweep for %s: %s", region, err)
 		return sweeperErrs.ErrorOrNil() // In case we have completed some pages, but had errors
 	}
@@ -201,7 +202,7 @@ func sweepServices(region string) error {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error listing ECS Clusters (%s): %w", region, err))
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error sweeping ECS Services (%s): %w", region, err))
@@ -212,7 +213,7 @@ func sweepServices(region string) error {
 
 func sweepTaskDefinitions(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -237,7 +238,7 @@ func sweepTaskDefinitions(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping ECS Task Definition sweep for %s: %s", region, err)
 		return nil
 	}
@@ -246,7 +247,7 @@ func sweepTaskDefinitions(region string) error {
 		return fmt.Errorf("error listing ECS Task Definitions (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping ECS Task Definitions (%s): %w", region, err)
diff --git a/internal/service/ecs/tag_test.go b/internal/service/ecs/tag_test.go
index 6cbd9cd9bef..7c4346c3001 100644
--- a/internal/service/ecs/tag_test.go
+++ b/internal/service/ecs/tag_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ecs_test
 
 import (
diff --git a/internal/service/ecs/tags_gen.go b/internal/service/ecs/tags_gen.go
index 30ae0a62414..b6f8903a0e4 100644
--- a/internal/service/ecs/tags_gen.go
+++ b/internal/service/ecs/tags_gen.go
@@ -9,8 +9,10 @@ import (
 	"github.com/aws/aws-sdk-go/service/ecs"
 	"github.com/aws/aws-sdk-go/service/ecs/ecsiface"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
@@ -140,6 +142,8 @@ func updateTags(ctx context.Context, conn ecsiface.ECSAPI, identifier string, ol
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.ECS)
 	if len(removedTags) > 0 {
diff --git a/internal/service/ecs/task_definition.go b/internal/service/ecs/task_definition.go
index 98430c7d8cc..19a780d5fa5 100644
--- a/internal/service/ecs/task_definition.go
+++ b/internal/service/ecs/task_definition.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ecs
 
 import (
@@ -6,9 +9,9 @@ import (
 	"encoding/json"
 	"fmt"
 	"log"
-	"regexp"
 	"strings"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/aws/aws-sdk-go/private/protocol/json/jsonutil"
@@ -126,7 +129,7 @@ func ResourceTaskDefinition() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 255),
-					validation.StringMatch(regexp.MustCompile("^[0-9A-Za-z_-]+$"), "see https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_TaskDefinition.html"),
+					validation.StringMatch(regexache.MustCompile("^[0-9A-Za-z_-]+$"), "see https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_TaskDefinition.html"),
 				),
 			},
 			"inference_accelerator": {
@@ -368,7 +371,8 @@ func ResourceTaskDefinition() *schema.Resource {
 										Type:         schema.TypeInt,
 										ForceNew:     true,
 										Optional:     true,
-										ValidateFunc: validation.IsPortNumber,
+										ValidateFunc: validation.IsPortNumberOrZero,
+										Default:      0,
 									},
 								},
 							},
diff --git a/internal/service/ecs/task_definition_data_source.go b/internal/service/ecs/task_definition_data_source.go
index 75900b30b93..0f2bd0fa13c 100644
--- a/internal/service/ecs/task_definition_data_source.go
+++ b/internal/service/ecs/task_definition_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ecs
 
 import (
diff --git a/internal/service/ecs/task_definition_data_source_test.go b/internal/service/ecs/task_definition_data_source_test.go
index d6fdce77d71..69a0b026a12 100644
--- a/internal/service/ecs/task_definition_data_source_test.go
+++ b/internal/service/ecs/task_definition_data_source_test.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ecs_test
 
 import (
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/ecs"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -28,7 +31,7 @@ func TestAccECSTaskDefinitionDataSource_ecsTaskDefinition(t *testing.T) {
 					resource.TestCheckResourceAttrPair(dataSourceName, "execution_role_arn", "aws_iam_role.execution", "arn"),
 					resource.TestCheckResourceAttr(dataSourceName, "family", rName),
 					resource.TestCheckResourceAttr(dataSourceName, "network_mode", "bridge"),
-					resource.TestMatchResourceAttr(dataSourceName, "revision", regexp.MustCompile("^[1-9][0-9]*$")),
+					resource.TestMatchResourceAttr(dataSourceName, "revision", regexache.MustCompile("^[1-9][0-9]*$")),
 					resource.TestCheckResourceAttr(dataSourceName, "status", "ACTIVE"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "task_role_arn", "aws_iam_role.test", "arn"),
 				),
diff --git a/internal/service/ecs/task_definition_equivalency.go b/internal/service/ecs/task_definition_equivalency.go
index a3607d8082a..43a649a594f 100644
--- a/internal/service/ecs/task_definition_equivalency.go
+++ b/internal/service/ecs/task_definition_equivalency.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ecs
 
 import (
diff --git a/internal/service/ecs/task_definition_equivalency_test.go b/internal/service/ecs/task_definition_equivalency_test.go
index 633e8ed048a..40efcc046aa 100644
--- a/internal/service/ecs/task_definition_equivalency_test.go
+++ b/internal/service/ecs/task_definition_equivalency_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ecs_test
 
 import (
diff --git a/internal/service/ecs/task_definition_migrate.go b/internal/service/ecs/task_definition_migrate.go
index c09a9ae0ffd..3683b8bf3a4 100644
--- a/internal/service/ecs/task_definition_migrate.go
+++ b/internal/service/ecs/task_definition_migrate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ecs
 
 import (
diff --git a/internal/service/ecs/task_definition_test.go b/internal/service/ecs/task_definition_test.go
index 5dfe9563d13..2d919ce3856 100644
--- a/internal/service/ecs/task_definition_test.go
+++ b/internal/service/ecs/task_definition_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ecs_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/endpoints"
 	"github.com/aws/aws-sdk-go/service/ecs"
@@ -66,7 +69,6 @@ func Test_StripRevision(t *testing.T) {
 func TestAccECSTaskDefinition_basic(t *testing.T) {
 	ctx := acctest.Context(t)
 	var def ecs.TaskDefinition
-
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_ecs_task_definition.test"
 
@@ -80,16 +82,16 @@ func TestAccECSTaskDefinition_basic(t *testing.T) {
 				Config: testAccTaskDefinitionConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckTaskDefinitionExists(ctx, resourceName, &def),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ecs", regexp.MustCompile(`task-definition/.+`)),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn_without_revision", "ecs", regexp.MustCompile(`task-definition/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ecs", regexache.MustCompile(`task-definition/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn_without_revision", "ecs", regexache.MustCompile(`task-definition/.+`)),
 				),
 			},
 			{
 				Config: testAccTaskDefinitionConfig_modified(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckTaskDefinitionExists(ctx, resourceName, &def),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ecs", regexp.MustCompile(`task-definition/.+`)),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn_without_revision", "ecs", regexp.MustCompile(`task-definition/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ecs", regexache.MustCompile(`task-definition/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn_without_revision", "ecs", regexache.MustCompile(`task-definition/.+`)),
 				),
 			},
 			{
@@ -107,7 +109,6 @@ func TestAccECSTaskDefinition_basic(t *testing.T) {
 func TestAccECSTaskDefinition_scratchVolume(t *testing.T) {
 	ctx := acctest.Context(t)
 	var def ecs.TaskDefinition
-
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_ecs_task_definition.test"
 
@@ -137,7 +138,6 @@ func TestAccECSTaskDefinition_scratchVolume(t *testing.T) {
 func TestAccECSTaskDefinition_DockerVolume_basic(t *testing.T) {
 	ctx := acctest.Context(t)
 	var def ecs.TaskDefinition
-
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_ecs_task_definition.test"
 
@@ -181,7 +181,6 @@ func TestAccECSTaskDefinition_DockerVolume_basic(t *testing.T) {
 func TestAccECSTaskDefinition_DockerVolume_minimal(t *testing.T) {
 	ctx := acctest.Context(t)
 	var def ecs.TaskDefinition
-
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_ecs_task_definition.test"
 
@@ -217,7 +216,6 @@ func TestAccECSTaskDefinition_DockerVolume_minimal(t *testing.T) {
 func TestAccECSTaskDefinition_runtimePlatform(t *testing.T) {
 	ctx := acctest.Context(t)
 	var def ecs.TaskDefinition
-
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_ecs_task_definition.test"
 
@@ -252,7 +250,6 @@ func TestAccECSTaskDefinition_runtimePlatform(t *testing.T) {
 func TestAccECSTaskDefinition_Fargate_runtimePlatform(t *testing.T) {
 	ctx := acctest.Context(t)
 	var def ecs.TaskDefinition
-
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_ecs_task_definition.test"
 
@@ -287,7 +284,6 @@ func TestAccECSTaskDefinition_Fargate_runtimePlatform(t *testing.T) {
 func TestAccECSTaskDefinition_Fargate_runtimePlatformWithoutArch(t *testing.T) {
 	ctx := acctest.Context(t)
 	var def ecs.TaskDefinition
-
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_ecs_task_definition.test"
 
@@ -321,7 +317,6 @@ func TestAccECSTaskDefinition_Fargate_runtimePlatformWithoutArch(t *testing.T) {
 func TestAccECSTaskDefinition_EFSVolume_minimal(t *testing.T) {
 	ctx := acctest.Context(t)
 	var def ecs.TaskDefinition
-
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_ecs_task_definition.test"
 
@@ -357,7 +352,6 @@ func TestAccECSTaskDefinition_EFSVolume_minimal(t *testing.T) {
 func TestAccECSTaskDefinition_EFSVolume_basic(t *testing.T) {
 	ctx := acctest.Context(t)
 	var def ecs.TaskDefinition
-
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_ecs_task_definition.test"
 
@@ -391,12 +385,50 @@ func TestAccECSTaskDefinition_EFSVolume_basic(t *testing.T) {
 	})
 }
 
-func TestAccECSTaskDefinition_EFSVolume_transitEncryption(t *testing.T) {
+func TestAccECSTaskDefinition_EFSVolume_transitEncryptionMinimal(t *testing.T) {
 	ctx := acctest.Context(t)
 	var def ecs.TaskDefinition
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_ecs_task_definition.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, ecs.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckTaskDefinitionDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccTaskDefinitionConfig_transitEncryptionEFSVolumeMinimal(rName, "null"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckTaskDefinitionExists(ctx, resourceName, &def),
+					resource.TestCheckResourceAttr(resourceName, "volume.#", "1"),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "volume.*", map[string]string{
+						"name":                       rName,
+						"efs_volume_configuration.#": "1",
+						"efs_volume_configuration.0.root_directory":     "/",
+						"efs_volume_configuration.0.transit_encryption": "ENABLED",
+						// "efs_volume_configuration.0.transit_encryption_port": "0",
+					}),
+					resource.TestCheckTypeSetElemAttrPair(resourceName, "volume.*.efs_volume_configuration.0.file_system_id", "aws_efs_file_system.test", "id"),
+				),
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateIdFunc:       testAccTaskDefinitionImportStateIdFunc(resourceName),
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"skip_destroy"},
+			},
+		},
+	})
+}
 
+func TestAccECSTaskDefinition_EFSVolume_transitEncryption(t *testing.T) {
+	ctx := acctest.Context(t)
+	var def ecs.TaskDefinition
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_ecs_task_definition.test"
+
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
 		ErrorCheck:               acctest.ErrorCheck(t, ecs.EndpointsID),
@@ -429,10 +461,46 @@ func TestAccECSTaskDefinition_EFSVolume_transitEncryption(t *testing.T) {
 	})
 }
 
-func TestAccECSTaskDefinition_EFSVolume_accessPoint(t *testing.T) {
+func TestAccECSTaskDefinition_EFSVolume_transitEncryptionDisabled(t *testing.T) {
 	ctx := acctest.Context(t)
 	var def ecs.TaskDefinition
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_ecs_task_definition.test"
 
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, ecs.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckTaskDefinitionDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccTaskDefinitionConfig_transitEncryptionEFSVolumeDisabled(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckTaskDefinitionExists(ctx, resourceName, &def),
+					resource.TestCheckResourceAttr(resourceName, "volume.#", "1"),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "volume.*", map[string]string{
+						"name":                       rName,
+						"efs_volume_configuration.#": "1",
+						"efs_volume_configuration.0.root_directory":     "/",
+						"efs_volume_configuration.0.transit_encryption": "DISABLED",
+					}),
+					resource.TestCheckTypeSetElemAttrPair(resourceName, "volume.*.efs_volume_configuration.0.file_system_id", "aws_efs_file_system.test", "id"),
+				),
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateIdFunc:       testAccTaskDefinitionImportStateIdFunc(resourceName),
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"skip_destroy"},
+			},
+		},
+	})
+}
+
+func TestAccECSTaskDefinition_EFSVolume_accessPoint(t *testing.T) {
+	ctx := acctest.Context(t)
+	var def ecs.TaskDefinition
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_ecs_task_definition.test"
 
@@ -474,10 +542,8 @@ func TestAccECSTaskDefinition_EFSVolume_accessPoint(t *testing.T) {
 func TestAccECSTaskDefinition_fsxWinFileSystem(t *testing.T) {
 	ctx := acctest.Context(t)
 	var def ecs.TaskDefinition
-
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_ecs_task_definition.test"
-
 	domainName := acctest.RandomDomainName()
 
 	if testing.Short() {
@@ -524,7 +590,6 @@ func TestAccECSTaskDefinition_fsxWinFileSystem(t *testing.T) {
 func TestAccECSTaskDefinition_DockerVolume_taskScoped(t *testing.T) {
 	ctx := acctest.Context(t)
 	var def ecs.TaskDefinition
-
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_ecs_task_definition.test"
 
@@ -557,10 +622,9 @@ func TestAccECSTaskDefinition_DockerVolume_taskScoped(t *testing.T) {
 func TestAccECSTaskDefinition_service(t *testing.T) {
 	ctx := acctest.Context(t)
 	var def ecs.TaskDefinition
-	var service ecs.Service
-
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_ecs_task_definition.test"
+	var service ecs.Service
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
@@ -596,7 +660,6 @@ func TestAccECSTaskDefinition_service(t *testing.T) {
 func TestAccECSTaskDefinition_taskRoleARN(t *testing.T) {
 	ctx := acctest.Context(t)
 	var def ecs.TaskDefinition
-
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_ecs_task_definition.test"
 
@@ -626,7 +689,6 @@ func TestAccECSTaskDefinition_taskRoleARN(t *testing.T) {
 func TestAccECSTaskDefinition_networkMode(t *testing.T) {
 	ctx := acctest.Context(t)
 	var def ecs.TaskDefinition
-
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_ecs_task_definition.test"
 
@@ -657,7 +719,6 @@ func TestAccECSTaskDefinition_networkMode(t *testing.T) {
 func TestAccECSTaskDefinition_ipcMode(t *testing.T) {
 	ctx := acctest.Context(t)
 	var def ecs.TaskDefinition
-
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_ecs_task_definition.test"
 
@@ -688,7 +749,6 @@ func TestAccECSTaskDefinition_ipcMode(t *testing.T) {
 func TestAccECSTaskDefinition_pidMode(t *testing.T) {
 	ctx := acctest.Context(t)
 	var def ecs.TaskDefinition
-
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_ecs_task_definition.test"
 
@@ -719,7 +779,6 @@ func TestAccECSTaskDefinition_pidMode(t *testing.T) {
 func TestAccECSTaskDefinition_constraint(t *testing.T) {
 	ctx := acctest.Context(t)
 	var def ecs.TaskDefinition
-
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_ecs_task_definition.test"
 
@@ -750,9 +809,7 @@ func TestAccECSTaskDefinition_constraint(t *testing.T) {
 
 func TestAccECSTaskDefinition_changeVolumesForcesNewResource(t *testing.T) {
 	ctx := acctest.Context(t)
-	var before ecs.TaskDefinition
-	var after ecs.TaskDefinition
-
+	var before, after ecs.TaskDefinition
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_ecs_task_definition.test"
 
@@ -789,10 +846,9 @@ func TestAccECSTaskDefinition_changeVolumesForcesNewResource(t *testing.T) {
 // Regression for https://github.com/hashicorp/terraform-provider-aws/issues/2336
 func TestAccECSTaskDefinition_arrays(t *testing.T) {
 	ctx := acctest.Context(t)
-	var conf ecs.TaskDefinition
-	resourceName := "aws_ecs_task_definition.test"
-
+	var def ecs.TaskDefinition
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_ecs_task_definition.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
@@ -803,7 +859,7 @@ func TestAccECSTaskDefinition_arrays(t *testing.T) {
 			{
 				Config: testAccTaskDefinitionConfig_arrays(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckTaskDefinitionExists(ctx, resourceName, &conf),
+					testAccCheckTaskDefinitionExists(ctx, resourceName, &def),
 				),
 			},
 			{
@@ -819,8 +875,7 @@ func TestAccECSTaskDefinition_arrays(t *testing.T) {
 
 func TestAccECSTaskDefinition_Fargate_basic(t *testing.T) {
 	ctx := acctest.Context(t)
-	var conf ecs.TaskDefinition
-
+	var def ecs.TaskDefinition
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_ecs_task_definition.test"
 
@@ -833,7 +888,7 @@ func TestAccECSTaskDefinition_Fargate_basic(t *testing.T) {
 			{
 				Config: testAccTaskDefinitionConfig_fargate(rName, `[{"protocol": "tcp", "containerPort": 8000}]`),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckTaskDefinitionExists(ctx, resourceName, &conf),
+					testAccCheckTaskDefinitionExists(ctx, resourceName, &def),
 					resource.TestCheckResourceAttr(resourceName, "requires_compatibilities.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "cpu", "256"),
 					resource.TestCheckResourceAttr(resourceName, "memory", "512"),
@@ -857,8 +912,7 @@ func TestAccECSTaskDefinition_Fargate_basic(t *testing.T) {
 
 func TestAccECSTaskDefinition_Fargate_ephemeralStorage(t *testing.T) {
 	ctx := acctest.Context(t)
-	var conf ecs.TaskDefinition
-
+	var def ecs.TaskDefinition
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_ecs_task_definition.test"
 
@@ -871,7 +925,7 @@ func TestAccECSTaskDefinition_Fargate_ephemeralStorage(t *testing.T) {
 			{
 				Config: testAccTaskDefinitionConfig_fargateEphemeralStorage(rName, `[{"protocol": "tcp", "containerPort": 8000}]`),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckTaskDefinitionExists(ctx, resourceName, &conf),
+					testAccCheckTaskDefinitionExists(ctx, resourceName, &def),
 					resource.TestCheckResourceAttr(resourceName, "requires_compatibilities.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "cpu", "256"),
 					resource.TestCheckResourceAttr(resourceName, "memory", "512"),
@@ -892,8 +946,7 @@ func TestAccECSTaskDefinition_Fargate_ephemeralStorage(t *testing.T) {
 
 func TestAccECSTaskDefinition_executionRole(t *testing.T) {
 	ctx := acctest.Context(t)
-	var conf ecs.TaskDefinition
-
+	var def ecs.TaskDefinition
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_ecs_task_definition.test"
 
@@ -906,7 +959,7 @@ func TestAccECSTaskDefinition_executionRole(t *testing.T) {
 			{
 				Config: testAccTaskDefinitionConfig_executionRole(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckTaskDefinitionExists(ctx, resourceName, &conf),
+					testAccCheckTaskDefinitionExists(ctx, resourceName, &def),
 				),
 			},
 			{
@@ -924,7 +977,6 @@ func TestAccECSTaskDefinition_executionRole(t *testing.T) {
 func TestAccECSTaskDefinition_disappears(t *testing.T) {
 	ctx := acctest.Context(t)
 	var def ecs.TaskDefinition
-
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_ecs_task_definition.test"
 
@@ -952,7 +1004,7 @@ func TestAccECSTaskDefinition_disappears(t *testing.T) {
 
 func TestAccECSTaskDefinition_tags(t *testing.T) {
 	ctx := acctest.Context(t)
-	var taskDefinition ecs.TaskDefinition
+	var def ecs.TaskDefinition
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_ecs_task_definition.test"
 
@@ -965,7 +1017,7 @@ func TestAccECSTaskDefinition_tags(t *testing.T) {
 			{
 				Config: testAccTaskDefinitionConfig_tags1(rName, "key1", "value1"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckTaskDefinitionExists(ctx, resourceName, &taskDefinition),
+					testAccCheckTaskDefinitionExists(ctx, resourceName, &def),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
 				),
@@ -980,7 +1032,7 @@ func TestAccECSTaskDefinition_tags(t *testing.T) {
 			{
 				Config: testAccTaskDefinitionConfig_tags2(rName, "key1", "value1updated", "key2", "value2"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckTaskDefinitionExists(ctx, resourceName, &taskDefinition),
+					testAccCheckTaskDefinitionExists(ctx, resourceName, &def),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1updated"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
@@ -989,7 +1041,7 @@ func TestAccECSTaskDefinition_tags(t *testing.T) {
 			{
 				Config: testAccTaskDefinitionConfig_tags1(rName, "key2", "value2"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckTaskDefinitionExists(ctx, resourceName, &taskDefinition),
+					testAccCheckTaskDefinitionExists(ctx, resourceName, &def),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
 				),
@@ -1000,10 +1052,9 @@ func TestAccECSTaskDefinition_tags(t *testing.T) {
 
 func TestAccECSTaskDefinition_proxy(t *testing.T) {
 	ctx := acctest.Context(t)
-	var taskDefinition ecs.TaskDefinition
+	var def ecs.TaskDefinition
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_ecs_task_definition.test"
-
 	containerName := "web"
 	proxyType := "APPMESH"
 	ignoredUid := "1337"
@@ -1023,8 +1074,8 @@ func TestAccECSTaskDefinition_proxy(t *testing.T) {
 			{
 				Config: testAccTaskDefinitionConfig_proxyConfiguration(rName, containerName, proxyType, ignoredUid, ignoredGid, appPorts, proxyIngressPort, proxyEgressPort, egressIgnoredPorts, egressIgnoredIPs),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckTaskDefinitionExists(ctx, resourceName, &taskDefinition),
-					testAccCheckTaskDefinitionProxyConfiguration(&taskDefinition, containerName, proxyType, ignoredUid, ignoredGid, appPorts, proxyIngressPort, proxyEgressPort, egressIgnoredPorts, egressIgnoredIPs),
+					testAccCheckTaskDefinitionExists(ctx, resourceName, &def),
+					testAccCheckTaskDefinitionProxyConfiguration(&def, containerName, proxyType, ignoredUid, ignoredGid, appPorts, proxyIngressPort, proxyEgressPort, egressIgnoredPorts, egressIgnoredIPs),
 				),
 			},
 			{
@@ -1041,7 +1092,6 @@ func TestAccECSTaskDefinition_proxy(t *testing.T) {
 func TestAccECSTaskDefinition_inferenceAccelerator(t *testing.T) {
 	ctx := acctest.Context(t)
 	var def ecs.TaskDefinition
-
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_ecs_task_definition.test"
 
@@ -1081,7 +1131,7 @@ func TestAccECSTaskDefinition_invalidContainerDefinition(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccTaskDefinitionConfig_invalidContainerDefinition(rName),
-				ExpectError: regexp.MustCompile(`invalid container definition supplied at index \(1\)`),
+				ExpectError: regexache.MustCompile(`invalid container definition supplied at index \(1\)`),
 			},
 		},
 	})
@@ -1887,7 +1937,9 @@ TASK_DEFINITION
 func testAccTaskDefinitionConfig_efsVolumeMinimal(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_efs_file_system" "test" {
-  creation_token = %[1]q
+  tags = {
+    Name = %[1]q
+  }
 }
 
 resource "aws_ecs_task_definition" "test" {
@@ -1920,7 +1972,9 @@ TASK_DEFINITION
 func testAccTaskDefinitionConfig_efsVolume(rName, rDir string) string {
 	return fmt.Sprintf(`
 resource "aws_efs_file_system" "test" {
-  creation_token = %[1]q
+  tags = {
+    Name = %[1]q
+  }
 }
 
 resource "aws_ecs_task_definition" "test" {
@@ -1951,10 +2005,49 @@ TASK_DEFINITION
 `, rName, rDir)
 }
 
+func testAccTaskDefinitionConfig_transitEncryptionEFSVolumeMinimal(rName, transitEncryptionPort string) string {
+	return fmt.Sprintf(`
+resource "aws_efs_file_system" "test" {
+  tags = {
+    Name = %[1]q
+  }
+}
+
+resource "aws_ecs_task_definition" "test" {
+  family = %[1]q
+
+  container_definitions = <<TASK_DEFINITION
+[
+  {
+    "name": "sleep",
+    "image": "busybox",
+    "cpu": 10,
+    "command": ["sleep","360"],
+    "memory": 10,
+    "essential": true
+  }
+]
+TASK_DEFINITION
+
+  volume {
+    name = %[1]q
+
+    efs_volume_configuration {
+      file_system_id          = aws_efs_file_system.test.id
+      transit_encryption      = "ENABLED"
+      transit_encryption_port = %[2]s
+    }
+  }
+}
+`, rName, transitEncryptionPort)
+}
+
 func testAccTaskDefinitionConfig_transitEncryptionEFSVolume(rName, tEnc string, tEncPort int) string {
 	return fmt.Sprintf(`
 resource "aws_efs_file_system" "test" {
-  creation_token = %[1]q
+  tags = {
+    Name = %[1]q
+  }
 }
 
 resource "aws_ecs_task_definition" "test" {
@@ -1987,10 +2080,53 @@ TASK_DEFINITION
 `, rName, tEnc, tEncPort)
 }
 
+func testAccTaskDefinitionConfig_transitEncryptionEFSVolumeDisabled(rName string) string {
+	return fmt.Sprintf(`
+resource "aws_efs_file_system" "test" {
+  tags = {
+    Name = %[1]q
+  }
+}
+
+resource "aws_ecs_task_definition" "test" {
+  family = %[1]q
+
+  container_definitions = <<TASK_DEFINITION
+[
+  {
+    "name": "sleep",
+    "image": "busybox",
+    "cpu": 10,
+    "command": ["sleep","360"],
+    "memory": 10,
+    "essential": true
+  }
+]
+TASK_DEFINITION
+
+  volume {
+    name = %[1]q
+
+    efs_volume_configuration {
+      file_system_id     = aws_efs_file_system.test.id
+      root_directory     = "/"
+      transit_encryption = "DISABLED"
+
+      authorization_config {
+        iam = "DISABLED"
+      }
+    }
+  }
+}
+`, rName)
+}
+
 func testAccTaskDefinitionConfig_efsAccessPoint(rName, useIam string) string {
 	return fmt.Sprintf(`
 resource "aws_efs_file_system" "test" {
-  creation_token = %[1]q
+  tags = {
+    Name = %[1]q
+  }
 }
 
 resource "aws_efs_access_point" "test" {
diff --git a/internal/service/ecs/task_execution_data_source.go b/internal/service/ecs/task_execution_data_source.go
index 90bb43d084b..2487065df93 100644
--- a/internal/service/ecs/task_execution_data_source.go
+++ b/internal/service/ecs/task_execution_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ecs
 
 import (
@@ -430,7 +433,7 @@ func expandContainerOverride(tfList []interface{}) []*ecs.ContainerOverride {
 			co.Memory = aws.Int64(int64(v.(int)))
 		}
 		if v, ok := tfMap["memory_reservation"]; ok {
-			co.Memory = aws.Int64(int64(v.(int)))
+			co.MemoryReservation = aws.Int64(int64(v.(int)))
 		}
 		if v, ok := tfMap["resource_requirements"]; ok {
 			co.ResourceRequirements = expandResourceRequirements(v.(*schema.Set))
diff --git a/internal/service/ecs/task_execution_data_source_test.go b/internal/service/ecs/task_execution_data_source_test.go
index ff4cabc6e80..60a0b592872 100644
--- a/internal/service/ecs/task_execution_data_source_test.go
+++ b/internal/service/ecs/task_execution_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ecs_test
 
 import (
diff --git a/internal/service/ecs/task_set.go b/internal/service/ecs/task_set.go
index 1ce05470ee2..728234f3caa 100644
--- a/internal/service/ecs/task_set.go
+++ b/internal/service/ecs/task_set.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ecs
 
 import (
diff --git a/internal/service/ecs/task_set_test.go b/internal/service/ecs/task_set_test.go
index 124867ea58a..18ea0914d4f 100644
--- a/internal/service/ecs/task_set_test.go
+++ b/internal/service/ecs/task_set_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ecs_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ecs"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -32,7 +35,7 @@ func TestAccECSTaskSet_basic(t *testing.T) {
 				Config: testAccTaskSetConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckTaskSetExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ecs", regexp.MustCompile(fmt.Sprintf("task-set/%[1]s/%[1]s/ecs-svc/.+", rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ecs", regexache.MustCompile(fmt.Sprintf("task-set/%[1]s/%[1]s/ecs-svc/.+", rName))),
 					resource.TestCheckResourceAttr(resourceName, "service_registries.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "load_balancer.#", "0"),
 				),
diff --git a/internal/service/ecs/validate.go b/internal/service/ecs/validate.go
index 9b887db021b..7b0abc85fbb 100644
--- a/internal/service/ecs/validate.go
+++ b/internal/service/ecs/validate.go
@@ -1,9 +1,12 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ecs
 
 import (
 	"fmt"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 )
 
@@ -11,7 +14,7 @@ func validateClusterName(v interface{}, k string) (ws []string, errors []error)
 	return validation.All(
 		validation.StringLenBetween(1, 255),
 		validation.StringMatch(
-			regexp.MustCompile("[a-zA-Z0-9_-]+"),
+			regexache.MustCompile("[0-9A-Za-z_-]+"),
 			"The cluster name must consist of alphanumerics, hyphens, and underscores."),
 	)(v, k)
 }
diff --git a/internal/service/ecs/validate_test.go b/internal/service/ecs/validate_test.go
index e71ea511aa5..71c0be520ff 100644
--- a/internal/service/ecs/validate_test.go
+++ b/internal/service/ecs/validate_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ecs
 
 import (
diff --git a/internal/service/ecs/wait.go b/internal/service/ecs/wait.go
index 66013207961..47546258871 100644
--- a/internal/service/ecs/wait.go
+++ b/internal/service/ecs/wait.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ecs
 
 import (
diff --git a/internal/service/efs/access_point.go b/internal/service/efs/access_point.go
index 58b1713a7f9..d6c87267da3 100644
--- a/internal/service/efs/access_point.go
+++ b/internal/service/efs/access_point.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package efs
 
 import (
diff --git a/internal/service/efs/access_point_data_source.go b/internal/service/efs/access_point_data_source.go
index c3410e4d685..4fac9c1e90d 100644
--- a/internal/service/efs/access_point_data_source.go
+++ b/internal/service/efs/access_point_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package efs
 
 import (
diff --git a/internal/service/efs/access_point_data_source_test.go b/internal/service/efs/access_point_data_source_test.go
index efb0c48dfe3..f2eef346d3d 100644
--- a/internal/service/efs/access_point_data_source_test.go
+++ b/internal/service/efs/access_point_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package efs_test
 
 import (
diff --git a/internal/service/efs/access_point_test.go b/internal/service/efs/access_point_test.go
index f0deb4e3c41..355ac8786b0 100644
--- a/internal/service/efs/access_point_test.go
+++ b/internal/service/efs/access_point_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package efs_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/efs"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -36,7 +39,7 @@ func TestAccEFSAccessPoint_basic(t *testing.T) {
 					testAccCheckAccessPointExists(ctx, resourceName, &ap),
 					resource.TestCheckResourceAttrPair(resourceName, "file_system_arn", fsResourceName, "arn"),
 					resource.TestCheckResourceAttrPair(resourceName, "file_system_id", fsResourceName, "id"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elasticfilesystem", regexp.MustCompile(`access-point/fsap-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elasticfilesystem", regexache.MustCompile(`access-point/fsap-.+`)),
 					resource.TestCheckResourceAttrSet(resourceName, "owner_id"),
 					resource.TestCheckResourceAttr(resourceName, "tags.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "posix_user.#", "0"),
diff --git a/internal/service/efs/access_points_data_source.go b/internal/service/efs/access_points_data_source.go
index 9f93b2716bf..e238d6acc4b 100644
--- a/internal/service/efs/access_points_data_source.go
+++ b/internal/service/efs/access_points_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package efs
 
 import (
diff --git a/internal/service/efs/access_points_data_source_test.go b/internal/service/efs/access_points_data_source_test.go
index 1d29e6c9a32..72ed9f99863 100644
--- a/internal/service/efs/access_points_data_source_test.go
+++ b/internal/service/efs/access_points_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package efs_test
 
 import (
diff --git a/internal/service/efs/backup_policy.go b/internal/service/efs/backup_policy.go
index 56db4d23363..c44bdb240c1 100644
--- a/internal/service/efs/backup_policy.go
+++ b/internal/service/efs/backup_policy.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package efs
 
 import (
diff --git a/internal/service/efs/backup_policy_test.go b/internal/service/efs/backup_policy_test.go
index a80d12af1e6..a42ae3297fd 100644
--- a/internal/service/efs/backup_policy_test.go
+++ b/internal/service/efs/backup_policy_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package efs_test
 
 import (
diff --git a/internal/service/efs/consts.go b/internal/service/efs/consts.go
new file mode 100644
index 00000000000..2f6f21432f2
--- /dev/null
+++ b/internal/service/efs/consts.go
@@ -0,0 +1,12 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package efs
+
+import (
+	"time"
+)
+
+const (
+	propagationTimeout = 2 * time.Minute
+)
diff --git a/internal/service/efs/file_system.go b/internal/service/efs/file_system.go
index 27dfef1d36b..2396340945e 100644
--- a/internal/service/efs/file_system.go
+++ b/internal/service/efs/file_system.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package efs
 
 import (
@@ -16,6 +19,7 @@ import (
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	tfslices "github.com/hashicorp/terraform-provider-aws/internal/slices"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
@@ -96,6 +100,10 @@ func ResourceFileSystem() *schema.Resource {
 					},
 				},
 			},
+			"name": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
 			"number_of_mount_targets": {
 				Type:     schema.TypeInt,
 				Computed: true,
@@ -150,14 +158,13 @@ func ResourceFileSystem() *schema.Resource {
 func resourceFileSystemCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	conn := meta.(*conns.AWSClient).EFSConn(ctx)
 
-	creationToken := ""
+	var creationToken string
 	if v, ok := d.GetOk("creation_token"); ok {
 		creationToken = v.(string)
 	} else {
 		creationToken = id.UniqueId()
 	}
 	throughputMode := d.Get("throughput_mode").(string)
-
 	input := &efs.CreateFileSystemInput{
 		CreationToken:  aws.String(creationToken),
 		Tags:           getTagsIn(ctx),
@@ -239,17 +246,17 @@ func resourceFileSystemRead(ctx context.Context, d *schema.ResourceData, meta in
 	d.Set("dns_name", meta.(*conns.AWSClient).RegionalHostname(fmt.Sprintf("%s.efs", aws.StringValue(fs.FileSystemId))))
 	d.Set("encrypted", fs.Encrypted)
 	d.Set("kms_key_id", fs.KmsKeyId)
+	d.Set("name", fs.Name)
 	d.Set("number_of_mount_targets", fs.NumberOfMountTargets)
 	d.Set("owner_id", fs.OwnerId)
 	d.Set("performance_mode", fs.PerformanceMode)
 	d.Set("provisioned_throughput_in_mibps", fs.ProvisionedThroughputInMibps)
-	d.Set("throughput_mode", fs.ThroughputMode)
-
-	setTagsOut(ctx, fs.Tags)
-
 	if err := d.Set("size_in_bytes", flattenFileSystemSizeInBytes(fs.SizeInBytes)); err != nil {
 		return diag.Errorf("setting size_in_bytes: %s", err)
 	}
+	d.Set("throughput_mode", fs.ThroughputMode)
+
+	setTagsOut(ctx, fs.Tags)
 
 	output, err := conn.DescribeLifecycleConfigurationWithContext(ctx, &efs.DescribeLifecycleConfigurationInput{
 		FileSystemId: aws.String(d.Id()),
@@ -271,7 +278,6 @@ func resourceFileSystemUpdate(ctx context.Context, d *schema.ResourceData, meta
 
 	if d.HasChanges("provisioned_throughput_in_mibps", "throughput_mode") {
 		throughputMode := d.Get("throughput_mode").(string)
-
 		input := &efs.UpdateFileSystemInput{
 			FileSystemId:   aws.String(d.Id()),
 			ThroughputMode: aws.String(throughputMode),
@@ -338,12 +344,32 @@ func resourceFileSystemDelete(ctx context.Context, d *schema.ResourceData, meta
 	return nil
 }
 
-func FindFileSystemByID(ctx context.Context, conn *efs.EFS, id string) (*efs.FileSystemDescription, error) {
-	input := &efs.DescribeFileSystemsInput{
-		FileSystemId: aws.String(id),
+func findFileSystem(ctx context.Context, conn *efs.EFS, input *efs.DescribeFileSystemsInput, filter tfslices.Predicate[*efs.FileSystemDescription]) (*efs.FileSystemDescription, error) {
+	output, err := findFileSystems(ctx, conn, input, filter)
+
+	if err != nil {
+		return nil, err
 	}
 
-	output, err := conn.DescribeFileSystemsWithContext(ctx, input)
+	return tfresource.AssertSinglePtrResult(output)
+}
+
+func findFileSystems(ctx context.Context, conn *efs.EFS, input *efs.DescribeFileSystemsInput, filter tfslices.Predicate[*efs.FileSystemDescription]) ([]*efs.FileSystemDescription, error) {
+	var output []*efs.FileSystemDescription
+
+	err := conn.DescribeFileSystemsPagesWithContext(ctx, input, func(page *efs.DescribeFileSystemsOutput, lastPage bool) bool {
+		if page == nil {
+			return !lastPage
+		}
+
+		for _, v := range page.FileSystems {
+			if v != nil && filter(v) {
+				output = append(output, v)
+			}
+		}
+
+		return !lastPage
+	})
 
 	if tfawserr.ErrCodeEquals(err, efs.ErrCodeFileSystemNotFound) {
 		return nil, &retry.NotFoundError{
@@ -356,11 +382,15 @@ func FindFileSystemByID(ctx context.Context, conn *efs.EFS, id string) (*efs.Fil
 		return nil, err
 	}
 
-	if output == nil || output.FileSystems == nil || len(output.FileSystems) == 0 || output.FileSystems[0] == nil {
-		return nil, tfresource.NewEmptyResultError(input)
+	return output, nil
+}
+
+func FindFileSystemByID(ctx context.Context, conn *efs.EFS, id string) (*efs.FileSystemDescription, error) {
+	input := &efs.DescribeFileSystemsInput{
+		FileSystemId: aws.String(id),
 	}
 
-	return output.FileSystems[0], nil
+	return findFileSystem(ctx, conn, input, tfslices.PredicateTrue[*efs.FileSystemDescription]())
 }
 
 func statusFileSystemLifeCycleState(ctx context.Context, conn *efs.EFS, id string) retry.StateRefreshFunc {
diff --git a/internal/service/efs/file_system_data_source.go b/internal/service/efs/file_system_data_source.go
index 4035e42316e..397629a6edd 100644
--- a/internal/service/efs/file_system_data_source.go
+++ b/internal/service/efs/file_system_data_source.go
@@ -1,9 +1,11 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package efs
 
 import (
 	"context"
 	"fmt"
-	"log"
 
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/efs"
@@ -12,7 +14,9 @@ import (
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
+	tfslices "github.com/hashicorp/terraform-provider-aws/internal/slices"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
 // @SDKDataSource("aws_efs_file_system")
@@ -39,6 +43,10 @@ func DataSourceFileSystem() *schema.Resource {
 				Computed:     true,
 				ValidateFunc: validation.StringLenBetween(0, 64),
 			},
+			"dns_name": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
 			"encrypted": {
 				Type:     schema.TypeBool,
 				Computed: true,
@@ -52,16 +60,27 @@ func DataSourceFileSystem() *schema.Resource {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
-			"performance_mode": {
-				Type:     schema.TypeString,
+			"lifecycle_policy": {
+				Type:     schema.TypeList,
 				Computed: true,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"transition_to_ia": {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+						"transition_to_primary_storage_class": {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+					},
+				},
 			},
-			"dns_name": {
+			"name": {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
-			"tags": tftags.TagsSchemaComputed(),
-			"throughput_mode": {
+			"performance_mode": {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
@@ -73,21 +92,10 @@ func DataSourceFileSystem() *schema.Resource {
 				Type:     schema.TypeInt,
 				Computed: true,
 			},
-			"lifecycle_policy": {
-				Type:     schema.TypeList,
+			"tags": tftags.TagsSchemaComputed(),
+			"throughput_mode": {
+				Type:     schema.TypeString,
 				Computed: true,
-				Elem: &schema.Resource{
-					Schema: map[string]*schema.Schema{
-						"transition_to_ia": {
-							Type:     schema.TypeString,
-							Computed: true,
-						},
-						"transition_to_primary_storage_class": {
-							Type:     schema.TypeString,
-							Computed: true,
-						},
-					},
-				},
 			},
 		},
 	}
@@ -98,66 +106,46 @@ func dataSourceFileSystemRead(ctx context.Context, d *schema.ResourceData, meta
 	conn := meta.(*conns.AWSClient).EFSConn(ctx)
 	ignoreTagsConfig := meta.(*conns.AWSClient).IgnoreTagsConfig
 
-	tagsToMatch := tftags.New(ctx, d.Get("tags").(map[string]interface{})).IgnoreAWS().IgnoreConfig(ignoreTagsConfig)
-
-	describeEfsOpts := &efs.DescribeFileSystemsInput{}
+	input := &efs.DescribeFileSystemsInput{}
 
 	if v, ok := d.GetOk("creation_token"); ok {
-		describeEfsOpts.CreationToken = aws.String(v.(string))
+		input.CreationToken = aws.String(v.(string))
 	}
 
 	if v, ok := d.GetOk("file_system_id"); ok {
-		describeEfsOpts.FileSystemId = aws.String(v.(string))
-	}
-
-	log.Printf("[DEBUG] Reading EFS File System: %s", describeEfsOpts)
-	describeResp, err := conn.DescribeFileSystemsWithContext(ctx, describeEfsOpts)
-	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "reading EFS FileSystem: %s", err)
-	}
-
-	if describeResp == nil || len(describeResp.FileSystems) == 0 {
-		return sdkdiag.AppendErrorf(diags, "reading EFS FileSystem: empty output")
+		input.FileSystemId = aws.String(v.(string))
 	}
 
-	results := describeResp.FileSystems
+	filter := tfslices.PredicateTrue[*efs.FileSystemDescription]()
 
-	if len(tagsToMatch) > 0 {
-		var fileSystems []*efs.FileSystemDescription
-
-		for _, fileSystem := range describeResp.FileSystems {
-			tags := KeyValueTags(ctx, fileSystem.Tags)
-
-			if !tags.ContainsAll(tagsToMatch) {
-				continue
-			}
-
-			fileSystems = append(fileSystems, fileSystem)
+	if tagsToMatch := tftags.New(ctx, d.Get("tags").(map[string]interface{})).IgnoreAWS().IgnoreConfig(ignoreTagsConfig); len(tagsToMatch) > 0 {
+		filter = func(v *efs.FileSystemDescription) bool {
+			return KeyValueTags(ctx, v.Tags).ContainsAll(tagsToMatch)
 		}
-
-		results = fileSystems
 	}
 
-	if count := len(results); count != 1 {
-		return sdkdiag.AppendErrorf(diags, "Search returned %d results, please revise so only one is returned", count)
-	}
+	fs, err := findFileSystem(ctx, conn, input, filter)
 
-	fs := results[0]
+	if err != nil {
+		return sdkdiag.AppendFromErr(diags, tfresource.SingularDataSourceFindError("EFS file system", err))
+	}
 
 	d.SetId(aws.StringValue(fs.FileSystemId))
+	d.Set("arn", fs.FileSystemArn)
 	d.Set("availability_zone_id", fs.AvailabilityZoneId)
 	d.Set("availability_zone_name", fs.AvailabilityZoneName)
 	d.Set("creation_token", fs.CreationToken)
-	d.Set("performance_mode", fs.PerformanceMode)
-	d.Set("arn", fs.FileSystemArn)
+	d.Set("dns_name", meta.(*conns.AWSClient).RegionalHostname(fmt.Sprintf("%s.efs", aws.StringValue(fs.FileSystemId))))
 	d.Set("file_system_id", fs.FileSystemId)
 	d.Set("encrypted", fs.Encrypted)
 	d.Set("kms_key_id", fs.KmsKeyId)
+	d.Set("name", fs.Name)
+	d.Set("performance_mode", fs.PerformanceMode)
 	d.Set("provisioned_throughput_in_mibps", fs.ProvisionedThroughputInMibps)
-	d.Set("throughput_mode", fs.ThroughputMode)
 	if fs.SizeInBytes != nil {
 		d.Set("size_in_bytes", fs.SizeInBytes.Value)
 	}
+	d.Set("throughput_mode", fs.ThroughputMode)
 
 	if err := d.Set("tags", KeyValueTags(ctx, fs.Tags).IgnoreAWS().IgnoreConfig(ignoreTagsConfig).Map()); err != nil {
 		return sdkdiag.AppendErrorf(diags, "setting tags: %s", err)
@@ -175,7 +163,5 @@ func dataSourceFileSystemRead(ctx context.Context, d *schema.ResourceData, meta
 		return sdkdiag.AppendErrorf(diags, "setting lifecycle_policy: %s", err)
 	}
 
-	d.Set("dns_name", meta.(*conns.AWSClient).RegionalHostname(fmt.Sprintf("%s.efs", aws.StringValue(fs.FileSystemId))))
-
 	return diags
 }
diff --git a/internal/service/efs/file_system_data_source_test.go b/internal/service/efs/file_system_data_source_test.go
index 6b4a67ff9b8..d4913f6ef01 100644
--- a/internal/service/efs/file_system_data_source_test.go
+++ b/internal/service/efs/file_system_data_source_test.go
@@ -1,14 +1,16 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package efs_test
 
 import (
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/efs"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
-	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
 )
 
@@ -25,7 +27,6 @@ func TestAccEFSFileSystemDataSource_id(t *testing.T) {
 			{
 				Config: testAccFileSystemDataSourceConfig_id,
 				Check: resource.ComposeTestCheckFunc(
-					testAccFileSystemCheckDataSource(dataSourceName, resourceName),
 					resource.TestCheckResourceAttrPair(dataSourceName, "arn", resourceName, "arn"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "performance_mode", resourceName, "performance_mode"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "creation_token", resourceName, "creation_token"),
@@ -33,10 +34,11 @@ func TestAccEFSFileSystemDataSource_id(t *testing.T) {
 					resource.TestCheckResourceAttrPair(dataSourceName, "kms_key_id", resourceName, "kms_key_id"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "tags", resourceName, "tags"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "dns_name", resourceName, "dns_name"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "name", resourceName, "name"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "provisioned_throughput_in_mibps", resourceName, "provisioned_throughput_in_mibps"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "throughput_mode", resourceName, "throughput_mode"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "lifecycle_policy", resourceName, "lifecycle_policy"),
-					resource.TestMatchResourceAttr(dataSourceName, "size_in_bytes", regexp.MustCompile(`^\d+$`)),
+					resource.TestMatchResourceAttr(dataSourceName, "size_in_bytes", regexache.MustCompile(`^\d+$`)),
 				),
 			},
 		},
@@ -56,7 +58,6 @@ func TestAccEFSFileSystemDataSource_tags(t *testing.T) {
 			{
 				Config: testAccFileSystemDataSourceConfig_tags,
 				Check: resource.ComposeTestCheckFunc(
-					testAccFileSystemCheckDataSource(dataSourceName, resourceName),
 					resource.TestCheckResourceAttrPair(dataSourceName, "arn", resourceName, "arn"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "performance_mode", resourceName, "performance_mode"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "creation_token", resourceName, "creation_token"),
@@ -64,10 +65,11 @@ func TestAccEFSFileSystemDataSource_tags(t *testing.T) {
 					resource.TestCheckResourceAttrPair(dataSourceName, "kms_key_id", resourceName, "kms_key_id"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "tags", resourceName, "tags"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "dns_name", resourceName, "dns_name"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "name", resourceName, "name"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "provisioned_throughput_in_mibps", resourceName, "provisioned_throughput_in_mibps"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "throughput_mode", resourceName, "throughput_mode"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "lifecycle_policy", resourceName, "lifecycle_policy"),
-					resource.TestMatchResourceAttr(dataSourceName, "size_in_bytes", regexp.MustCompile(`^\d+$`)),
+					resource.TestMatchResourceAttr(dataSourceName, "size_in_bytes", regexache.MustCompile(`^\d+$`)),
 				),
 			},
 		},
@@ -87,7 +89,6 @@ func TestAccEFSFileSystemDataSource_name(t *testing.T) {
 			{
 				Config: testAccFileSystemDataSourceConfig_name,
 				Check: resource.ComposeTestCheckFunc(
-					testAccFileSystemCheckDataSource(dataSourceName, resourceName),
 					resource.TestCheckResourceAttrPair(dataSourceName, "arn", resourceName, "arn"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "performance_mode", resourceName, "performance_mode"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "creation_token", resourceName, "creation_token"),
@@ -98,7 +99,7 @@ func TestAccEFSFileSystemDataSource_name(t *testing.T) {
 					resource.TestCheckResourceAttrPair(dataSourceName, "provisioned_throughput_in_mibps", resourceName, "provisioned_throughput_in_mibps"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "throughput_mode", resourceName, "throughput_mode"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "lifecycle_policy", resourceName, "lifecycle_policy"),
-					resource.TestMatchResourceAttr(dataSourceName, "size_in_bytes", regexp.MustCompile(`^\d+$`)),
+					resource.TestMatchResourceAttr(dataSourceName, "size_in_bytes", regexache.MustCompile(`^\d+$`)),
 				),
 			},
 		},
@@ -118,7 +119,6 @@ func TestAccEFSFileSystemDataSource_availabilityZone(t *testing.T) {
 			{
 				Config: testAccFileSystemDataSourceConfig_availabilityZone,
 				Check: resource.ComposeTestCheckFunc(
-					testAccFileSystemCheckDataSource(dataSourceName, resourceName),
 					resource.TestCheckResourceAttrPair(dataSourceName, "availability_zone_id", resourceName, "availability_zone_id"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "availability_zone_name", resourceName, "availability_zone_name"),
 				),
@@ -146,46 +146,12 @@ func TestAccEFSFileSystemDataSource_nonExistent_tags(t *testing.T) {
 			},
 			{
 				Config:      testAccFileSystemDataSourceConfig_tagsNonExistent(rName),
-				ExpectError: regexp.MustCompile(`Search returned 0 results`),
+				ExpectError: regexache.MustCompile(`no matching EFS file system found`),
 			},
 		},
 	})
 }
 
-func testAccFileSystemCheckDataSource(dName, rName string) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		rs, ok := s.RootModule().Resources[dName]
-		if !ok {
-			return fmt.Errorf("root module has no resource called %s", dName)
-		}
-
-		efsRs, ok := s.RootModule().Resources[rName]
-		if !ok {
-			return fmt.Errorf("can't find aws_efs_file_system.test in state")
-		}
-
-		attr := rs.Primary.Attributes
-
-		if attr["creation_token"] != efsRs.Primary.Attributes["creation_token"] {
-			return fmt.Errorf(
-				"creation_token is %s; want %s",
-				attr["creation_token"],
-				efsRs.Primary.Attributes["creation_token"],
-			)
-		}
-
-		if attr["id"] != efsRs.Primary.Attributes["id"] {
-			return fmt.Errorf(
-				"file_system_id is %s; want %s",
-				attr["id"],
-				efsRs.Primary.Attributes["id"],
-			)
-		}
-
-		return nil
-	}
-}
-
 func testAccFileSystemConfig_dataSourceBasic(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_efs_file_system" "test" {
diff --git a/internal/service/efs/file_system_policy.go b/internal/service/efs/file_system_policy.go
index dd08af8c792..ab6bd5e6528 100644
--- a/internal/service/efs/file_system_policy.go
+++ b/internal/service/efs/file_system_policy.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package efs
 
 import (
@@ -24,6 +27,7 @@ func ResourceFileSystemPolicy() *schema.Resource {
 		ReadWithoutTimeout:   resourceFileSystemPolicyRead,
 		UpdateWithoutTimeout: resourceFileSystemPolicyPut,
 		DeleteWithoutTimeout: resourceFileSystemPolicyDelete,
+
 		Importer: &schema.ResourceImporter{
 			StateContext: schema.ImportStatePassthroughContext,
 		},
@@ -59,9 +63,8 @@ func resourceFileSystemPolicyPut(ctx context.Context, d *schema.ResourceData, me
 	conn := meta.(*conns.AWSClient).EFSConn(ctx)
 
 	policy, err := structure.NormalizeJsonString(d.Get("policy").(string))
-
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "policy (%s) is invalid JSON: %s", policy, err)
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
 	fsID := d.Get("file_system_id").(string)
@@ -71,15 +74,17 @@ func resourceFileSystemPolicyPut(ctx context.Context, d *schema.ResourceData, me
 		Policy:                         aws.String(policy),
 	}
 
-	log.Printf("[DEBUG] Putting EFS File System Policy: %s", input)
-
-	_, err = conn.PutFileSystemPolicyWithContext(ctx, input)
+	_, err = tfresource.RetryWhenAWSErrMessageContains(ctx, propagationTimeout, func() (interface{}, error) {
+		return conn.PutFileSystemPolicyWithContext(ctx, input)
+	}, efs.ErrCodeInvalidPolicyException, "Policy contains invalid Principal block")
 
 	if err != nil {
 		return sdkdiag.AppendErrorf(diags, "putting EFS File System Policy (%s): %s", fsID, err)
 	}
 
-	d.SetId(fsID)
+	if d.IsNewResource() {
+		d.SetId(fsID)
+	}
 
 	return append(diags, resourceFileSystemPolicyRead(ctx, d, meta)...)
 }
@@ -103,15 +108,13 @@ func resourceFileSystemPolicyRead(ctx context.Context, d *schema.ResourceData, m
 	d.Set("file_system_id", output.FileSystemId)
 
 	policyToSet, err := verify.SecondJSONUnlessEquivalent(d.Get("policy").(string), aws.StringValue(output.Policy))
-
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "while setting policy (%s), encountered: %s", policyToSet, err)
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
 	policyToSet, err = structure.NormalizeJsonString(policyToSet)
-
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "policy (%s) is an invalid JSON: %s", policyToSet, err)
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
 	d.Set("policy", policyToSet)
diff --git a/internal/service/efs/file_system_policy_test.go b/internal/service/efs/file_system_policy_test.go
index 0d0f82b2b9a..d880cc8a1c9 100644
--- a/internal/service/efs/file_system_policy_test.go
+++ b/internal/service/efs/file_system_policy_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package efs_test
 
 import (
diff --git a/internal/service/efs/file_system_test.go b/internal/service/efs/file_system_test.go
index 467775c8a21..d2c4f7d6715 100644
--- a/internal/service/efs/file_system_test.go
+++ b/internal/service/efs/file_system_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package efs_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/efs"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -31,11 +34,12 @@ func TestAccEFSFileSystem_basic(t *testing.T) {
 				Config: testAccFileSystemConfig_basic,
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckFileSystem(ctx, resourceName, &desc),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elasticfilesystem", regexp.MustCompile(`file-system/fs-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elasticfilesystem", regexache.MustCompile(`file-system/fs-.+`)),
 					resource.TestCheckResourceAttrSet(resourceName, "creation_token"),
-					acctest.MatchResourceAttrRegionalHostname(resourceName, "dns_name", "efs", regexp.MustCompile(`fs-[^.]+`)),
+					acctest.MatchResourceAttrRegionalHostname(resourceName, "dns_name", "efs", regexache.MustCompile(`fs-[^.]+`)),
 					resource.TestCheckResourceAttr(resourceName, "encrypted", "false"),
 					resource.TestCheckResourceAttr(resourceName, "lifecycle_policy.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "name", ""),
 					resource.TestCheckResourceAttr(resourceName, "number_of_mount_targets", "0"),
 					acctest.MatchResourceAttrAccountID(resourceName, "owner_id"),
 					resource.TestCheckResourceAttr(resourceName, "performance_mode", "generalPurpose"),
@@ -215,8 +219,11 @@ func TestAccEFSFileSystem_kmsKey(t *testing.T) {
 				Config: testAccFileSystemConfig_kmsKey(rName, true),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckFileSystem(ctx, resourceName, &desc),
-					resource.TestCheckResourceAttrPair(resourceName, "kms_key_id", kmsKeyResourceName, "arn"),
 					resource.TestCheckResourceAttr(resourceName, "encrypted", "true"),
+					resource.TestCheckResourceAttrPair(resourceName, "kms_key_id", kmsKeyResourceName, "arn"),
+					resource.TestCheckResourceAttr(resourceName, "name", rName),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.Name", rName),
 				),
 			},
 			{
@@ -240,7 +247,7 @@ func TestAccEFSFileSystem_kmsWithoutEncryption(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccFileSystemConfig_kmsKey(rName, false),
-				ExpectError: regexp.MustCompile(`encrypted must be set to true when kms_key_id is specified`),
+				ExpectError: regexache.MustCompile(`encrypted must be set to true when kms_key_id is specified`),
 			},
 		},
 	})
@@ -334,7 +341,7 @@ func TestAccEFSFileSystem_lifecyclePolicy(t *testing.T) {
 					"transition_to_ia",
 					"invalid_value",
 				),
-				ExpectError: regexp.MustCompile(`got invalid_value`),
+				ExpectError: regexache.MustCompile(`got invalid_value`),
 			},
 			{
 				Config: testAccFileSystemConfig_lifecyclePolicy(
@@ -568,6 +575,10 @@ resource "aws_kms_key" "test" {
 resource "aws_efs_file_system" "test" {
   encrypted  = %[2]t
   kms_key_id = aws_kms_key.test.arn
+
+  tags = {
+    Name = %[1]q
+  }
 }
 `, rName, enable)
 }
diff --git a/internal/service/efs/find.go b/internal/service/efs/find.go
index 95df7736599..9204154dfb8 100644
--- a/internal/service/efs/find.go
+++ b/internal/service/efs/find.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package efs
 
 import (
diff --git a/internal/service/efs/generate.go b/internal/service/efs/generate.go
index 7209ecbd7c6..87e0cb30452 100644
--- a/internal/service/efs/generate.go
+++ b/internal/service/efs/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/listpages/main.go -ListOps=DescribeMountTargets -InputPaginator=Marker -OutputPaginator=NextMarker
 //go:generate go run ../../generate/tags/main.go -ListTags -ListTagsOp=DescribeTags -ListTagsInIDElem=FileSystemId -ServiceTagsSlice -TagInIDElem=ResourceId -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
diff --git a/internal/service/efs/mount_target.go b/internal/service/efs/mount_target.go
index e05fee3c32c..2d1bb3bd25b 100644
--- a/internal/service/efs/mount_target.go
+++ b/internal/service/efs/mount_target.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package efs
 
 import ( // nosemgrep:ci.semgrep.aws.multiple-service-imports
diff --git a/internal/service/efs/mount_target_data_source.go b/internal/service/efs/mount_target_data_source.go
index 917eae72074..bcfbcca3c82 100644
--- a/internal/service/efs/mount_target_data_source.go
+++ b/internal/service/efs/mount_target_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package efs
 
 import (
diff --git a/internal/service/efs/mount_target_data_source_test.go b/internal/service/efs/mount_target_data_source_test.go
index 7c0625d3a11..b63c3ac9434 100644
--- a/internal/service/efs/mount_target_data_source_test.go
+++ b/internal/service/efs/mount_target_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package efs_test
 
 import (
diff --git a/internal/service/efs/mount_target_test.go b/internal/service/efs/mount_target_test.go
index 9b15c142244..be9498e62f9 100644
--- a/internal/service/efs/mount_target_test.go
+++ b/internal/service/efs/mount_target_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package efs_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/efs"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -35,9 +38,9 @@ func TestAccEFSMountTarget_basic(t *testing.T) {
 					testAccCheckMountTargetExists(ctx, resourceName, &mount),
 					resource.TestCheckResourceAttrSet(resourceName, "availability_zone_id"),
 					resource.TestCheckResourceAttrSet(resourceName, "availability_zone_name"),
-					acctest.MatchResourceAttrRegionalHostname(resourceName, "dns_name", "efs", regexp.MustCompile(`fs-[^.]+`)),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "file_system_arn", "elasticfilesystem", regexp.MustCompile(`file-system/fs-.+`)),
-					resource.TestMatchResourceAttr(resourceName, "ip_address", regexp.MustCompile(`\d+\.\d+\.\d+\.\d+`)),
+					acctest.MatchResourceAttrRegionalHostname(resourceName, "dns_name", "efs", regexache.MustCompile(`fs-[^.]+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "file_system_arn", "elasticfilesystem", regexache.MustCompile(`file-system/fs-.+`)),
+					resource.TestMatchResourceAttr(resourceName, "ip_address", regexache.MustCompile(`\d+\.\d+\.\d+\.\d+`)),
 					resource.TestCheckResourceAttrSet(resourceName, "mount_target_dns_name"),
 					resource.TestCheckResourceAttrSet(resourceName, "network_interface_id"),
 					acctest.CheckResourceAttrAccountID(resourceName, "owner_id"),
@@ -53,8 +56,8 @@ func TestAccEFSMountTarget_basic(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckMountTargetExists(ctx, resourceName, &mount),
 					testAccCheckMountTargetExists(ctx, resourceName2, &mount),
-					acctest.MatchResourceAttrRegionalHostname(resourceName, "dns_name", "efs", regexp.MustCompile(`fs-[^.]+`)),
-					acctest.MatchResourceAttrRegionalHostname(resourceName2, "dns_name", "efs", regexp.MustCompile(`fs-[^.]+`)),
+					acctest.MatchResourceAttrRegionalHostname(resourceName, "dns_name", "efs", regexache.MustCompile(`fs-[^.]+`)),
+					acctest.MatchResourceAttrRegionalHostname(resourceName2, "dns_name", "efs", regexache.MustCompile(`fs-[^.]+`)),
 				),
 			},
 		},
@@ -130,7 +133,7 @@ func TestAccEFSMountTarget_IPAddress_emptyString(t *testing.T) {
 				Config: testAccMountTargetConfig_ipAddressNullIP(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckMountTargetExists(ctx, resourceName, &mount),
-					resource.TestMatchResourceAttr(resourceName, "ip_address", regexp.MustCompile(`\d+\.\d+\.\d+\.\d+`)),
+					resource.TestMatchResourceAttr(resourceName, "ip_address", regexache.MustCompile(`\d+\.\d+\.\d+\.\d+`)),
 				),
 			},
 			{
diff --git a/internal/service/efs/replication_configuration.go b/internal/service/efs/replication_configuration.go
index d8e95452167..f8783a732d1 100644
--- a/internal/service/efs/replication_configuration.go
+++ b/internal/service/efs/replication_configuration.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package efs
 
 import (
diff --git a/internal/service/efs/replication_configuration_test.go b/internal/service/efs/replication_configuration_test.go
index ad81111a858..11f136a707f 100644
--- a/internal/service/efs/replication_configuration_test.go
+++ b/internal/service/efs/replication_configuration_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package efs_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/efs"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -39,7 +42,7 @@ func TestAccEFSReplicationConfiguration_basic(t *testing.T) {
 					testAccCheckReplicationConfigurationExists(ctx, resourceName),
 					resource.TestCheckResourceAttrSet(resourceName, "creation_time"),
 					resource.TestCheckResourceAttr(resourceName, "destination.#", "1"),
-					resource.TestMatchResourceAttr(resourceName, "destination.0.file_system_id", regexp.MustCompile(`fs-.+`)),
+					resource.TestMatchResourceAttr(resourceName, "destination.0.file_system_id", regexache.MustCompile(`fs-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "destination.0.region", region),
 					resource.TestCheckResourceAttr(resourceName, "destination.0.status", efs.ReplicationStatusEnabled),
 					resource.TestCheckResourceAttrPair(resourceName, "original_source_file_system_arn", fsResourceName, "arn"),
@@ -112,7 +115,7 @@ func TestAccEFSReplicationConfiguration_allAttributes(t *testing.T) {
 					resource.TestCheckResourceAttrSet(resourceName, "creation_time"),
 					resource.TestCheckResourceAttr(resourceName, "destination.#", "1"),
 					resource.TestCheckResourceAttrPair(resourceName, "destination.0.availability_zone_name", "data.aws_availability_zones.available", "names.0"),
-					resource.TestMatchResourceAttr(resourceName, "destination.0.file_system_id", regexp.MustCompile(`fs-.+`)),
+					resource.TestMatchResourceAttr(resourceName, "destination.0.file_system_id", regexache.MustCompile(`fs-.+`)),
 					resource.TestCheckResourceAttrPair(resourceName, "destination.0.kms_key_id", kmsKeyResourceName, "key_id"),
 					resource.TestCheckResourceAttr(resourceName, "destination.0.region", alternateRegion),
 					resource.TestCheckResourceAttr(resourceName, "destination.0.status", efs.ReplicationStatusEnabled),
diff --git a/internal/service/efs/service_package_gen.go b/internal/service/efs/service_package_gen.go
index 9904b0d73ee..1a99347b981 100644
--- a/internal/service/efs/service_package_gen.go
+++ b/internal/service/efs/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	efs_sdkv1 "github.com/aws/aws-sdk-go/service/efs"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -91,4 +92,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*e
 	return efs_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/efs/status.go b/internal/service/efs/status.go
index 13f8b1623e9..f9083d2dd19 100644
--- a/internal/service/efs/status.go
+++ b/internal/service/efs/status.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package efs
 
 import (
diff --git a/internal/service/efs/sweep.go b/internal/service/efs/sweep.go
index 913b1370ef8..832ec2762e1 100644
--- a/internal/service/efs/sweep.go
+++ b/internal/service/efs/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package efs
 
@@ -12,9 +12,10 @@ import (
 	multierror "github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_efs_access_point", &resource.Sweeper{
 		Name: "aws_efs_access_point",
 		F:    sweepAccessPoints,
@@ -37,7 +38,7 @@ func init() {
 
 func sweepAccessPoints(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
@@ -72,7 +73,7 @@ func sweepAccessPoints(region string) error {
 				return !lastPage
 			})
 
-			if sweep.SkipSweepError(err) {
+			if awsv1.SkipSweepError(err) {
 				continue
 			}
 
@@ -84,7 +85,7 @@ func sweepAccessPoints(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping EFS Access Point sweep for %s: %s", region, err)
 		return sweeperErrs.ErrorOrNil() // In case we have completed some pages, but had errors
 	}
@@ -93,7 +94,7 @@ func sweepAccessPoints(region string) error {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error listing EFS File Systems (%s): %w", region, err))
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error sweeping EFS Access Points (%s): %w", region, err))
@@ -104,7 +105,7 @@ func sweepAccessPoints(region string) error {
 
 func sweepFileSystems(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
@@ -128,7 +129,7 @@ func sweepFileSystems(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping EFS File System sweep for %s: %s", region, err)
 		return nil
 	}
@@ -137,7 +138,7 @@ func sweepFileSystems(region string) error {
 		return fmt.Errorf("error listing EFS File Systems (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping EFS File Systems (%s): %w", region, err)
@@ -148,7 +149,7 @@ func sweepFileSystems(region string) error {
 
 func sweepMountTargets(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
@@ -183,7 +184,7 @@ func sweepMountTargets(region string) error {
 				return !lastPage
 			})
 
-			if sweep.SkipSweepError(err) {
+			if awsv1.SkipSweepError(err) {
 				continue
 			}
 
@@ -195,7 +196,7 @@ func sweepMountTargets(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping EFS Mount Target sweep for %s: %s", region, err)
 		return sweeperErrs.ErrorOrNil() // In case we have completed some pages, but had errors
 	}
@@ -204,7 +205,7 @@ func sweepMountTargets(region string) error {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error listing EFS File Systems (%s): %w", region, err))
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error sweeping EFS Mount Targets (%s): %w", region, err))
diff --git a/internal/service/efs/tags_gen.go b/internal/service/efs/tags_gen.go
index ed96a331662..5931c30e736 100644
--- a/internal/service/efs/tags_gen.go
+++ b/internal/service/efs/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/efs"
 	"github.com/aws/aws-sdk-go/service/efs/efsiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -102,6 +104,8 @@ func updateTags(ctx context.Context, conn efsiface.EFSAPI, identifier string, ol
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.EFS)
 	if len(removedTags) > 0 {
diff --git a/internal/service/efs/wait.go b/internal/service/efs/wait.go
index 35a344130c7..77f0d95dcdd 100644
--- a/internal/service/efs/wait.go
+++ b/internal/service/efs/wait.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package efs
 
 import (
diff --git a/internal/service/eks/addon.go b/internal/service/eks/addon.go
index 0c6e8a07d50..ab089032a25 100644
--- a/internal/service/eks/addon.go
+++ b/internal/service/eks/addon.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package eks
 
 import (
 	"context"
 	"log"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/eks"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -55,7 +58,7 @@ func ResourceAddon() *schema.Resource {
 				Computed: true,
 				ValidateFunc: validation.All(
 					// Regular expression taken from: https://semver.org/#is-there-a-suggested-regular-expression-regex-to-check-a-semver-string
-					validation.StringMatch(regexp.MustCompile(`^v(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?$`), "must follow semantic version format"),
+					validation.StringMatch(regexache.MustCompile(`^v(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[A-Za-z-][0-9A-Za-z-]*)(?:\.(?:0|[1-9]\d*|\d*[A-Za-z-][0-9A-Za-z-]*))*))?(?:\+([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?$`), "must follow semantic version format"),
 				),
 			},
 			"arn": {
diff --git a/internal/service/eks/addon_data_source.go b/internal/service/eks/addon_data_source.go
index 1a255734cec..7779c12f741 100644
--- a/internal/service/eks/addon_data_source.go
+++ b/internal/service/eks/addon_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package eks
 
 import (
diff --git a/internal/service/eks/addon_data_source_test.go b/internal/service/eks/addon_data_source_test.go
index 33653dd95a0..9091f9676b8 100644
--- a/internal/service/eks/addon_data_source_test.go
+++ b/internal/service/eks/addon_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package eks_test
 
 import (
diff --git a/internal/service/eks/addon_test.go b/internal/service/eks/addon_test.go
index dc8405f7584..47cd54ac3ae 100644
--- a/internal/service/eks/addon_test.go
+++ b/internal/service/eks/addon_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package eks_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/eks"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -36,7 +39,7 @@ func TestAccEKSAddon_basic(t *testing.T) {
 					testAccCheckAddonExists(ctx, addonResourceName, &addon),
 					resource.TestCheckResourceAttr(addonResourceName, "addon_name", addonName),
 					resource.TestCheckResourceAttrSet(addonResourceName, "addon_version"),
-					acctest.MatchResourceAttrRegionalARN(addonResourceName, "arn", "eks", regexp.MustCompile(fmt.Sprintf("addon/%s/%s/.+$", rName, addonName))),
+					acctest.MatchResourceAttrRegionalARN(addonResourceName, "arn", "eks", regexache.MustCompile(fmt.Sprintf("addon/%s/%s/.+$", rName, addonName))),
 					resource.TestCheckResourceAttrPair(addonResourceName, "cluster_name", clusterResourceName, "name"),
 					resource.TestCheckResourceAttr(addonResourceName, "configuration_values", ""),
 					resource.TestCheckNoResourceAttr(addonResourceName, "preserve"),
@@ -340,7 +343,7 @@ func TestAccEKSAddon_configurationValues(t *testing.T) {
 			},
 			{
 				Config:      testAccAddonConfig_configurationValues(rName, addonName, addonVersion, invalidConfigurationValues, eks.ResolveConflictsOverwrite),
-				ExpectError: regexp.MustCompile(`InvalidParameterException: ConfigurationValue provided in request is not supported`),
+				ExpectError: regexache.MustCompile(`InvalidParameterException: ConfigurationValue provided in request is not supported`),
 			},
 		},
 	})
diff --git a/internal/service/eks/addon_version_data_source.go b/internal/service/eks/addon_version_data_source.go
index 61940e74c14..47264e58ea5 100644
--- a/internal/service/eks/addon_version_data_source.go
+++ b/internal/service/eks/addon_version_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package eks
 
 import (
diff --git a/internal/service/eks/addon_version_data_source_test.go b/internal/service/eks/addon_version_data_source_test.go
index 4f6e713c3fc..576fc022b33 100644
--- a/internal/service/eks/addon_version_data_source_test.go
+++ b/internal/service/eks/addon_version_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package eks_test
 
 import (
diff --git a/internal/service/eks/arn.go b/internal/service/eks/arn.go
index f1aacf98017..a8ece1dada7 100644
--- a/internal/service/eks/arn.go
+++ b/internal/service/eks/arn.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 /*
 This file is a hard copy of:
 https://github.com/kubernetes-sigs/aws-iam-authenticator/blob/7547c74e660f8d34d9980f2c69aa008eed1f48d0/pkg/arn/arn.go
diff --git a/internal/service/eks/arn_test.go b/internal/service/eks/arn_test.go
index 6635ae28e58..18b1d08ffe7 100644
--- a/internal/service/eks/arn_test.go
+++ b/internal/service/eks/arn_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 /*
 This file is a hard copy of:
 https://github.com/kubernetes-sigs/aws-iam-authenticator/blob/7547c74e660f8d34d9980f2c69aa008eed1f48d0/pkg/arn/arn_test.go
diff --git a/internal/service/eks/cluster.go b/internal/service/eks/cluster.go
index 1be02df16dd..83bf69868ea 100644
--- a/internal/service/eks/cluster.go
+++ b/internal/service/eks/cluster.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package eks
 
 import (
 	"context"
 	"log"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/eks"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -160,7 +163,7 @@ func ResourceCluster() *schema.Resource {
 							ForceNew: true,
 							ValidateFunc: validation.All(
 								validation.IsCIDRNetwork(12, 24),
-								validation.StringMatch(regexp.MustCompile(`^(10|172\.(1[6-9]|2[0-9]|3[0-1])|192\.168)\..*`), "must be within 10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16"),
+								validation.StringMatch(regexache.MustCompile(`^(10|172\.(1[6-9]|2[0-9]|3[0-1])|192\.168)\..*`), "must be within 10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16"),
 							),
 						},
 						"service_ipv6_cidr": {
diff --git a/internal/service/eks/cluster_auth_data_source.go b/internal/service/eks/cluster_auth_data_source.go
index 917cecf85d2..c97a8092909 100644
--- a/internal/service/eks/cluster_auth_data_source.go
+++ b/internal/service/eks/cluster_auth_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package eks
 
 import (
diff --git a/internal/service/eks/cluster_auth_data_source_test.go b/internal/service/eks/cluster_auth_data_source_test.go
index 4fc869488db..2e58cd74b3f 100644
--- a/internal/service/eks/cluster_auth_data_source_test.go
+++ b/internal/service/eks/cluster_auth_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package eks_test
 
 import (
diff --git a/internal/service/eks/cluster_data_source.go b/internal/service/eks/cluster_data_source.go
index 8eb075049fb..18cc7eeeb9f 100644
--- a/internal/service/eks/cluster_data_source.go
+++ b/internal/service/eks/cluster_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package eks
 
 import (
diff --git a/internal/service/eks/cluster_data_source_test.go b/internal/service/eks/cluster_data_source_test.go
index 54e68c36b04..4cab4dd9196 100644
--- a/internal/service/eks/cluster_data_source_test.go
+++ b/internal/service/eks/cluster_data_source_test.go
@@ -1,9 +1,12 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package eks_test
 
 import (
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/eks"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -40,7 +43,7 @@ func TestAccEKSClusterDataSource_basic(t *testing.T) {
 					resource.TestCheckResourceAttrPair(resourceName, "kubernetes_network_config.0.ip_family", dataSourceResourceName, "kubernetes_network_config.0.ip_family"),
 					resource.TestCheckResourceAttrPair(resourceName, "kubernetes_network_config.0.service_ipv4_cidr", dataSourceResourceName, "kubernetes_network_config.0.service_ipv4_cidr"),
 					resource.TestCheckResourceAttrPair(resourceName, "kubernetes_network_config.0.service_ipv6_cidr", dataSourceResourceName, "kubernetes_network_config.0.service_ipv6_cidr"),
-					resource.TestMatchResourceAttr(dataSourceResourceName, "platform_version", regexp.MustCompile(`^eks\.\d+$`)),
+					resource.TestMatchResourceAttr(dataSourceResourceName, "platform_version", regexache.MustCompile(`^eks\.\d+$`)),
 					resource.TestCheckResourceAttrPair(resourceName, "role_arn", dataSourceResourceName, "role_arn"),
 					resource.TestCheckResourceAttrPair(resourceName, "status", dataSourceResourceName, "status"),
 					resource.TestCheckResourceAttrPair(resourceName, "tags.%", dataSourceResourceName, "tags.%"),
@@ -85,7 +88,7 @@ func TestAccEKSClusterDataSource_outpost(t *testing.T) {
 					resource.TestCheckResourceAttrPair(resourceName, "kubernetes_network_config.0.ip_family", dataSourceResourceName, "kubernetes_network_config.0.ip_family"),
 					resource.TestCheckResourceAttrPair(resourceName, "kubernetes_network_config.0.service_ipv4_cidr", dataSourceResourceName, "kubernetes_network_config.0.service_ipv4_cidr"),
 					resource.TestCheckResourceAttrPair(resourceName, "kubernetes_network_config.0.service_ipv6_cidr", dataSourceResourceName, "kubernetes_network_config.0.service_ipv6_cidr"),
-					resource.TestMatchResourceAttr(dataSourceResourceName, "platform_version", regexp.MustCompile(`^eks-local-outposts\.\d+$`)),
+					resource.TestMatchResourceAttr(dataSourceResourceName, "platform_version", regexache.MustCompile(`^eks-local-outposts\.\d+$`)),
 					resource.TestCheckResourceAttrPair(resourceName, "role_arn", dataSourceResourceName, "role_arn"),
 					resource.TestCheckResourceAttrPair(resourceName, "status", dataSourceResourceName, "status"),
 					resource.TestCheckResourceAttrPair(resourceName, "tags.%", dataSourceResourceName, "tags.%"),
diff --git a/internal/service/eks/cluster_test.go b/internal/service/eks/cluster_test.go
index eacae227159..f4a8e94dae8 100644
--- a/internal/service/eks/cluster_test.go
+++ b/internal/service/eks/cluster_test.go
@@ -1,13 +1,16 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package eks_test
 
 import (
 	"context"
 	"errors"
 	"fmt"
-	"regexp"
 	"strings"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/eks"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -40,29 +43,29 @@ func TestAccEKSCluster_basic(t *testing.T) {
 				Config: testAccClusterConfig_required(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckClusterExists(ctx, resourceName, &cluster),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "eks", regexp.MustCompile(fmt.Sprintf("cluster/%s$", rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "eks", regexache.MustCompile(fmt.Sprintf("cluster/%s$", rName))),
 					resource.TestCheckResourceAttr(resourceName, "certificate_authority.#", "1"),
 					resource.TestCheckResourceAttrSet(resourceName, "certificate_authority.0.data"),
 					resource.TestCheckNoResourceAttr(resourceName, "cluster_id"),
-					resource.TestMatchResourceAttr(resourceName, "endpoint", regexp.MustCompile(`^https://`)),
+					resource.TestMatchResourceAttr(resourceName, "endpoint", regexache.MustCompile(`^https://`)),
 					resource.TestCheckResourceAttr(resourceName, "identity.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "identity.0.oidc.#", "1"),
-					resource.TestMatchResourceAttr(resourceName, "identity.0.oidc.0.issuer", regexp.MustCompile(`^https://`)),
+					resource.TestMatchResourceAttr(resourceName, "identity.0.oidc.0.issuer", regexache.MustCompile(`^https://`)),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "kubernetes_network_config.#", "1"),
 					resource.TestCheckResourceAttrSet(resourceName, "kubernetes_network_config.0.service_ipv4_cidr"),
 					resource.TestCheckResourceAttr(resourceName, "kubernetes_network_config.0.ip_family", "ipv4"),
-					resource.TestMatchResourceAttr(resourceName, "platform_version", regexp.MustCompile(`^eks\.\d+$`)),
+					resource.TestMatchResourceAttr(resourceName, "platform_version", regexache.MustCompile(`^eks\.\d+$`)),
 					resource.TestCheckResourceAttrPair(resourceName, "role_arn", "aws_iam_role.test", "arn"),
 					resource.TestCheckResourceAttr(resourceName, "status", eks.ClusterStatusActive),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
-					resource.TestMatchResourceAttr(resourceName, "version", regexp.MustCompile(`^\d+\.\d+$`)),
+					resource.TestMatchResourceAttr(resourceName, "version", regexache.MustCompile(`^\d+\.\d+$`)),
 					resource.TestCheckResourceAttr(resourceName, "vpc_config.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "vpc_config.0.endpoint_private_access", "false"),
 					resource.TestCheckResourceAttr(resourceName, "vpc_config.0.endpoint_public_access", "true"),
 					resource.TestCheckResourceAttr(resourceName, "vpc_config.0.security_group_ids.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "vpc_config.0.subnet_ids.#", "2"),
-					resource.TestMatchResourceAttr(resourceName, "vpc_config.0.vpc_id", regexp.MustCompile(`^vpc-.+`)),
+					resource.TestMatchResourceAttr(resourceName, "vpc_config.0.vpc_id", regexache.MustCompile(`^vpc-.+`)),
 				),
 			},
 			{
@@ -520,23 +523,23 @@ func TestAccEKSCluster_Network_serviceIPv4CIDR(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccClusterConfig_networkServiceIPv4CIDR(rName, `"10.0.0.0/11"`),
-				ExpectError: regexp.MustCompile(`expected .* to contain a network Value with between`),
+				ExpectError: regexache.MustCompile(`expected .* to contain a network Value with between`),
 			},
 			{
 				Config:      testAccClusterConfig_networkServiceIPv4CIDR(rName, `"10.0.0.0/25"`),
-				ExpectError: regexp.MustCompile(`expected .* to contain a network Value with between`),
+				ExpectError: regexache.MustCompile(`expected .* to contain a network Value with between`),
 			},
 			{
 				Config:      testAccClusterConfig_networkServiceIPv4CIDR(rName, `"9.0.0.0/16"`),
-				ExpectError: regexp.MustCompile(`must be within`),
+				ExpectError: regexache.MustCompile(`must be within`),
 			},
 			{
 				Config:      testAccClusterConfig_networkServiceIPv4CIDR(rName, `"172.14.0.0/24"`),
-				ExpectError: regexp.MustCompile(`must be within`),
+				ExpectError: regexache.MustCompile(`must be within`),
 			},
 			{
 				Config:      testAccClusterConfig_networkServiceIPv4CIDR(rName, `"192.167.0.0/24"`),
-				ExpectError: regexp.MustCompile(`must be within`),
+				ExpectError: regexache.MustCompile(`must be within`),
 			},
 			{
 				Config: testAccClusterConfig_networkServiceIPv4CIDR(rName, `"192.168.0.0/24"`),
@@ -583,11 +586,11 @@ func TestAccEKSCluster_Network_ipFamily(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccClusterConfig_networkIPFamily(rName, `"v6"`),
-				ExpectError: regexp.MustCompile(`expected .* to be one of \[ipv4 ipv6]`),
+				ExpectError: regexache.MustCompile(`expected .* to be one of \[ipv4 ipv6]`),
 			},
 			{
 				Config:      testAccClusterConfig_networkIPFamily(rName, `"IPv4"`),
-				ExpectError: regexp.MustCompile(`expected .* to be one of \[ipv4 ipv6]`),
+				ExpectError: regexache.MustCompile(`expected .* to be one of \[ipv4 ipv6]`),
 			},
 			{
 				Config: testAccClusterConfig_networkIPFamily(rName, `"ipv6"`),
@@ -637,7 +640,7 @@ func TestAccEKSCluster_Outpost_create(t *testing.T) {
 				Config: testAccClusterConfig_outpost(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckClusterExists(ctx, resourceName, &cluster),
-					resource.TestMatchResourceAttr(resourceName, "cluster_id", regexp.MustCompile(`^[0-9a-fA-F]{8}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{12}$`)),
+					resource.TestMatchResourceAttr(resourceName, "cluster_id", regexache.MustCompile(`^[0-9A-Fa-f]{8}\b-[0-9A-Fa-f]{4}\b-[0-9A-Fa-f]{4}\b-[0-9A-Fa-f]{4}\b-[0-9A-Fa-f]{12}$`)),
 					resource.TestCheckResourceAttr(resourceName, "outpost_config.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "outpost_config.0.control_plane_instance_type", controlPlaneInstanceType),
 					resource.TestCheckResourceAttr(resourceName, "outpost_config.0.outpost_arns.#", "1"),
@@ -669,7 +672,7 @@ func TestAccEKSCluster_Outpost_placement(t *testing.T) {
 				Config: testAccClusterConfig_outpostPlacement(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckClusterExists(ctx, resourceName, &cluster),
-					resource.TestMatchResourceAttr(resourceName, "cluster_id", regexp.MustCompile(`^[0-9a-fA-F]{8}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{12}$`)),
+					resource.TestMatchResourceAttr(resourceName, "cluster_id", regexache.MustCompile(`^[0-9A-Fa-f]{8}\b-[0-9A-Fa-f]{4}\b-[0-9A-Fa-f]{4}\b-[0-9A-Fa-f]{4}\b-[0-9A-Fa-f]{12}$`)),
 					resource.TestCheckResourceAttr(resourceName, "outpost_config.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "outpost_config.0.control_plane_instance_type", controlPlaneInstanceType),
 					resource.TestCheckResourceAttr(resourceName, "outpost_config.0.outpost_arns.#", "1"),
diff --git a/internal/service/eks/clusters_data_source.go b/internal/service/eks/clusters_data_source.go
index dbceba8c974..ffdd46b1a90 100644
--- a/internal/service/eks/clusters_data_source.go
+++ b/internal/service/eks/clusters_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package eks
 
 import (
diff --git a/internal/service/eks/clusters_data_source_test.go b/internal/service/eks/clusters_data_source_test.go
index 72fdb6e3319..a35a5c0f752 100644
--- a/internal/service/eks/clusters_data_source_test.go
+++ b/internal/service/eks/clusters_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package eks_test
 
 import (
diff --git a/internal/service/eks/consts.go b/internal/service/eks/consts.go
index 09168e1649a..4bf92304f5c 100644
--- a/internal/service/eks/consts.go
+++ b/internal/service/eks/consts.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package eks
 
 import (
diff --git a/internal/service/eks/errors.go b/internal/service/eks/errors.go
index 6bf3e10d1ff..ee8ac774ab2 100644
--- a/internal/service/eks/errors.go
+++ b/internal/service/eks/errors.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package eks
 
 import (
diff --git a/internal/service/eks/fargate_profile.go b/internal/service/eks/fargate_profile.go
index 87eb1afe335..55a4954086d 100644
--- a/internal/service/eks/fargate_profile.go
+++ b/internal/service/eks/fargate_profile.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package eks
 
 import (
diff --git a/internal/service/eks/fargate_profile_test.go b/internal/service/eks/fargate_profile_test.go
index ec6367ede3c..7bfca00372f 100644
--- a/internal/service/eks/fargate_profile_test.go
+++ b/internal/service/eks/fargate_profile_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package eks_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws/endpoints"
 	"github.com/aws/aws-sdk-go/service/eks"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -35,7 +38,7 @@ func TestAccEKSFargateProfile_basic(t *testing.T) {
 				Config: testAccFargateProfileConfig_name(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckFargateProfileExists(ctx, resourceName, &fargateProfile),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "eks", regexp.MustCompile(fmt.Sprintf("fargateprofile/%[1]s/%[1]s/.+", rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "eks", regexache.MustCompile(fmt.Sprintf("fargateprofile/%[1]s/%[1]s/.+", rName))),
 					resource.TestCheckResourceAttrPair(resourceName, "cluster_name", eksClusterResourceName, "name"),
 					resource.TestCheckResourceAttr(resourceName, "fargate_profile_name", rName),
 					resource.TestCheckResourceAttrPair(resourceName, "pod_execution_role_arn", iamRoleResourceName, "arn"),
diff --git a/internal/service/eks/find.go b/internal/service/eks/find.go
index 55aec84a7ea..2d5b5e6e11e 100644
--- a/internal/service/eks/find.go
+++ b/internal/service/eks/find.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package eks
 
 import (
diff --git a/internal/service/eks/generate.go b/internal/service/eks/generate.go
index 8ad2e3afb0a..d9cf18f5965 100644
--- a/internal/service/eks/generate.go
+++ b/internal/service/eks/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTags -ServiceTagsMap -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/eks/id.go b/internal/service/eks/id.go
index 66c86d64104..d91fdaf2e4b 100644
--- a/internal/service/eks/id.go
+++ b/internal/service/eks/id.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package eks
 
 import (
diff --git a/internal/service/eks/identity_provider_config.go b/internal/service/eks/identity_provider_config.go
index 75ebc3f74c9..7bd35298854 100644
--- a/internal/service/eks/identity_provider_config.go
+++ b/internal/service/eks/identity_provider_config.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package eks
 
 import (
@@ -94,7 +97,7 @@ func ResourceIdentityProviderConfig() *schema.Resource {
 							Type:     schema.TypeMap,
 							Optional: true,
 							ForceNew: true,
-							ValidateDiagFunc: verify.ValidAllDiag(
+							ValidateDiagFunc: validation.AllDiag(
 								validation.MapKeyLenBetween(1, 63),
 								validation.MapValueLenBetween(1, 253),
 							),
diff --git a/internal/service/eks/identity_provider_config_test.go b/internal/service/eks/identity_provider_config_test.go
index 5b69901ba7f..e0fd7f1fa95 100644
--- a/internal/service/eks/identity_provider_config_test.go
+++ b/internal/service/eks/identity_provider_config_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package eks_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/eks"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -31,13 +34,13 @@ func TestAccEKSIdentityProviderConfig_basic(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccIdentityProviderConfigConfig_issuerURL(rName, "http://example.com"),
-				ExpectError: regexp.MustCompile(`expected .* to have a url with schema of: "https", got http://example.com`),
+				ExpectError: regexache.MustCompile(`expected .* to have a url with schema of: "https", got http://example.com`),
 			},
 			{
 				Config: testAccIdentityProviderConfigConfig_name(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckIdentityProviderExistsConfig(ctx, resourceName, &config),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "eks", regexp.MustCompile(fmt.Sprintf("identityproviderconfig/%[1]s/oidc/%[1]s/.+", rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "eks", regexache.MustCompile(fmt.Sprintf("identityproviderconfig/%[1]s/oidc/%[1]s/.+", rName))),
 					resource.TestCheckResourceAttrPair(resourceName, "cluster_name", eksClusterResourceName, "name"),
 					resource.TestCheckResourceAttr(resourceName, "oidc.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "oidc.0.client_id", "example.net"),
diff --git a/internal/service/eks/node_group.go b/internal/service/eks/node_group.go
index ca8dd1b0e92..ad1a8af448b 100644
--- a/internal/service/eks/node_group.go
+++ b/internal/service/eks/node_group.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package eks
 
 import (
diff --git a/internal/service/eks/node_group_data_source.go b/internal/service/eks/node_group_data_source.go
index 22bf7f0c4a4..32cbdf4af4c 100644
--- a/internal/service/eks/node_group_data_source.go
+++ b/internal/service/eks/node_group_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package eks
 
 import (
diff --git a/internal/service/eks/node_group_data_source_test.go b/internal/service/eks/node_group_data_source_test.go
index a25102e66ae..e44c6c34166 100644
--- a/internal/service/eks/node_group_data_source_test.go
+++ b/internal/service/eks/node_group_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package eks_test
 
 import (
diff --git a/internal/service/eks/node_group_test.go b/internal/service/eks/node_group_test.go
index 0d3bc1e662b..379a7ee0ab3 100644
--- a/internal/service/eks/node_group_test.go
+++ b/internal/service/eks/node_group_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package eks_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/eks"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -40,7 +43,7 @@ func TestAccEKSNodeGroup_basic(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckNodeGroupExists(ctx, resourceName, &nodeGroup),
 					resource.TestCheckResourceAttr(resourceName, "ami_type", eks.AMITypesAl2X8664),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "eks", regexp.MustCompile(fmt.Sprintf("nodegroup/%[1]s/%[1]s/.+", rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "eks", regexache.MustCompile(fmt.Sprintf("nodegroup/%[1]s/%[1]s/.+", rName))),
 					resource.TestCheckResourceAttrPair(resourceName, "cluster_name", eksClusterResourceName, "name"),
 					resource.TestCheckResourceAttr(resourceName, "capacity_type", eks.CapacityTypesOnDemand),
 					resource.TestCheckResourceAttr(resourceName, "disk_size", "20"),
@@ -49,7 +52,7 @@ func TestAccEKSNodeGroup_basic(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "node_group_name", rName),
 					resource.TestCheckResourceAttr(resourceName, "node_group_name_prefix", ""),
 					resource.TestCheckResourceAttrPair(resourceName, "node_role_arn", iamRoleResourceName, "arn"),
-					resource.TestMatchResourceAttr(resourceName, "release_version", regexp.MustCompile(`^\d+\.\d+\.\d+-\d{8}$`)),
+					resource.TestMatchResourceAttr(resourceName, "release_version", regexache.MustCompile(`^\d+\.\d+\.\d+-\d{8}$`)),
 					resource.TestCheckResourceAttr(resourceName, "remote_access.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "resources.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "resources.0.autoscaling_groups.#", "1"),
diff --git a/internal/service/eks/node_groups_data_source.go b/internal/service/eks/node_groups_data_source.go
index 3301fd5c582..4f3eb7bc7dc 100644
--- a/internal/service/eks/node_groups_data_source.go
+++ b/internal/service/eks/node_groups_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package eks
 
 import (
diff --git a/internal/service/eks/node_groups_data_source_test.go b/internal/service/eks/node_groups_data_source_test.go
index f770915782f..2dd1c1c8942 100644
--- a/internal/service/eks/node_groups_data_source_test.go
+++ b/internal/service/eks/node_groups_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package eks_test
 
 import (
diff --git a/internal/service/eks/service_package_gen.go b/internal/service/eks/service_package_gen.go
index 33b6ca1bc1c..9e6d4ad9270 100644
--- a/internal/service/eks/service_package_gen.go
+++ b/internal/service/eks/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	eks_sdkv1 "github.com/aws/aws-sdk-go/service/eks"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -111,4 +112,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*e
 	return eks_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/eks/status.go b/internal/service/eks/status.go
index 641c7abd757..1716b138070 100644
--- a/internal/service/eks/status.go
+++ b/internal/service/eks/status.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package eks
 
 import (
diff --git a/internal/service/eks/sweep.go b/internal/service/eks/sweep.go
index 1378a1dd66c..b6338af1e91 100644
--- a/internal/service/eks/sweep.go
+++ b/internal/service/eks/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package eks
 
@@ -13,9 +13,10 @@ import (
 	multierror "github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_eks_addon", &resource.Sweeper{
 		Name: "aws_eks_addon",
 		F:    sweepAddons,
@@ -50,7 +51,7 @@ func init() {
 
 func sweepAddons(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
@@ -87,7 +88,7 @@ func sweepAddons(region string) error {
 				return !lastPage
 			})
 
-			if sweep.SkipSweepError(err) {
+			if awsv1.SkipSweepError(err) {
 				continue
 			}
 
@@ -105,7 +106,7 @@ func sweepAddons(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Print(fmt.Errorf("[WARN] Skipping EKS Add-Ons sweep for %s: %w", region, err))
 		return sweeperErrs.ErrorOrNil() // In case we have completed some pages, but had errors
 	}
@@ -114,7 +115,7 @@ func sweepAddons(region string) error {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error listing EKS Clusters (%s): %w", region, err))
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error sweeping EKS Add-Ons (%s): %w", region, err))
@@ -125,7 +126,7 @@ func sweepAddons(region string) error {
 
 func sweepClusters(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -149,7 +150,7 @@ func sweepClusters(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping EKS Clusters sweep for %s: %s", region, err)
 		return nil
 	}
@@ -158,7 +159,7 @@ func sweepClusters(region string) error {
 		return fmt.Errorf("error listing EKS Clusters (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping EKS Clusters (%s): %w", region, err)
@@ -169,7 +170,7 @@ func sweepClusters(region string) error {
 
 func sweepFargateProfiles(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
@@ -204,7 +205,7 @@ func sweepFargateProfiles(region string) error {
 				return !lastPage
 			})
 
-			if sweep.SkipSweepError(err) {
+			if awsv1.SkipSweepError(err) {
 				continue
 			}
 
@@ -222,7 +223,7 @@ func sweepFargateProfiles(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping EKS Fargate Profiles sweep for %s: %s", region, err)
 		return sweeperErrs.ErrorOrNil() // In case we have completed some pages, but had errors
 	}
@@ -231,7 +232,7 @@ func sweepFargateProfiles(region string) error {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error listing EKS Clusters (%s): %w", region, err))
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error sweeping EKS Fargate Profiles (%s): %w", region, err))
@@ -242,7 +243,7 @@ func sweepFargateProfiles(region string) error {
 
 func sweepIdentityProvidersConfig(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
@@ -278,7 +279,7 @@ func sweepIdentityProvidersConfig(region string) error {
 				return !lastPage
 			})
 
-			if sweep.SkipSweepError(err) {
+			if awsv1.SkipSweepError(err) {
 				continue
 			}
 
@@ -296,7 +297,7 @@ func sweepIdentityProvidersConfig(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Print(fmt.Errorf("[WARN] Skipping EKS Identity Provider Configs sweep for %s: %w", region, err))
 		return sweeperErrs // In case we have completed some pages, but had errors
 	}
@@ -305,7 +306,7 @@ func sweepIdentityProvidersConfig(region string) error {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error listing EKS Clusters (%s): %w", region, err))
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error sweeping EKS Identity Provider Configs (%s): %w", region, err))
@@ -316,7 +317,7 @@ func sweepIdentityProvidersConfig(region string) error {
 
 func sweepNodeGroups(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
@@ -351,7 +352,7 @@ func sweepNodeGroups(region string) error {
 				return !lastPage
 			})
 
-			if sweep.SkipSweepError(err) {
+			if awsv1.SkipSweepError(err) {
 				continue
 			}
 
@@ -369,7 +370,7 @@ func sweepNodeGroups(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping EKS Node Groups sweep for %s: %s", region, err)
 		return sweeperErrs.ErrorOrNil() // In case we have completed some pages, but had errors
 	}
@@ -378,7 +379,7 @@ func sweepNodeGroups(region string) error {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error listing EKS Clusters (%s): %w", region, err))
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error sweeping EKS Node Groups (%s): %w", region, err))
diff --git a/internal/service/eks/tags_gen.go b/internal/service/eks/tags_gen.go
index f2fdc261b76..b83a214f802 100644
--- a/internal/service/eks/tags_gen.go
+++ b/internal/service/eks/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/eks"
 	"github.com/aws/aws-sdk-go/service/eks/eksiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -54,7 +56,7 @@ func Tags(tags tftags.KeyValueTags) map[string]*string {
 	return aws.StringMap(tags.Map())
 }
 
-// KeyValueTags creates KeyValueTags from eks service tags.
+// KeyValueTags creates tftags.KeyValueTags from eks service tags.
 func KeyValueTags(ctx context.Context, tags map[string]*string) tftags.KeyValueTags {
 	return tftags.New(ctx, tags)
 }
@@ -85,6 +87,8 @@ func updateTags(ctx context.Context, conn eksiface.EKSAPI, identifier string, ol
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.EKS)
 	if len(removedTags) > 0 {
diff --git a/internal/service/eks/token_test.go b/internal/service/eks/token_test.go
index e791ec2bc6f..d109edd959b 100644
--- a/internal/service/eks/token_test.go
+++ b/internal/service/eks/token_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 /*
 This file is a hard copy of:
 https://github.com/kubernetes-sigs/aws-iam-authenticator/blob/7547c74e660f8d34d9980f2c69aa008eed1f48d0/pkg/token/token_test.go
diff --git a/internal/service/eks/validate.go b/internal/service/eks/validate.go
index 3099019f740..9195a044cbb 100644
--- a/internal/service/eks/validate.go
+++ b/internal/service/eks/validate.go
@@ -1,8 +1,12 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package eks
 
 import (
 	"fmt"
-	"regexp"
+
+	"github.com/YakDriver/regexache"
 )
 
 func validClusterName(v interface{}, k string) (ws []string, errors []error) {
@@ -13,8 +17,8 @@ func validClusterName(v interface{}, k string) (ws []string, errors []error) {
 	}
 
 	// https://docs.aws.amazon.com/eks/latest/APIReference/API_CreateCluster.html#API_CreateCluster_RequestSyntax
-	pattern := `^[0-9A-Za-z][A-Za-z0-9\-_]+$`
-	if !regexp.MustCompile(pattern).MatchString(value) {
+	pattern := `^[0-9A-Za-z][0-9A-Za-z_-]+$`
+	if !regexache.MustCompile(pattern).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"%q doesn't comply with restrictions (%q): %q",
 			k, pattern, value))
diff --git a/internal/service/eks/validate_test.go b/internal/service/eks/validate_test.go
index 352a6bb2bcd..f6627cc6538 100644
--- a/internal/service/eks/validate_test.go
+++ b/internal/service/eks/validate_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package eks
 
 import (
diff --git a/internal/service/eks/wait.go b/internal/service/eks/wait.go
index 34fa213a1aa..57a94e414fd 100644
--- a/internal/service/eks/wait.go
+++ b/internal/service/eks/wait.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package eks
 
 import (
diff --git a/internal/service/elasticache/cluster.go b/internal/service/elasticache/cluster.go
index 2f8cb2f837d..7fccd5fffe6 100644
--- a/internal/service/elasticache/cluster.go
+++ b/internal/service/elasticache/cluster.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elasticache
 
 import (
@@ -5,12 +8,12 @@ import (
 	"errors"
 	"fmt"
 	"log"
-	"regexp"
 	"sort"
 	"strconv"
 	"strings"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/elasticache"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -22,10 +25,10 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
-	"github.com/hashicorp/terraform-provider-aws/internal/experimental/nullable"
 	"github.com/hashicorp/terraform-provider-aws/internal/flex"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/internal/types/nullable"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -124,10 +127,10 @@ func ResourceCluster() *schema.Resource {
 				},
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 50),
-					validation.StringMatch(regexp.MustCompile(`^[0-9a-z-]+$`), "must contain only lowercase alphanumeric characters and hyphens"),
-					validation.StringMatch(regexp.MustCompile(`^[a-z]`), "must begin with a lowercase letter"),
-					validation.StringDoesNotMatch(regexp.MustCompile(`--`), "cannot contain two consecutive hyphens"),
-					validation.StringDoesNotMatch(regexp.MustCompile(`-$`), "cannot end with a hyphen"),
+					validation.StringMatch(regexache.MustCompile(`^[0-9a-z-]+$`), "must contain only lowercase alphanumeric characters and hyphens"),
+					validation.StringMatch(regexache.MustCompile(`^[a-z]`), "must begin with a lowercase letter"),
+					validation.StringDoesNotMatch(regexache.MustCompile(`--`), "cannot contain two consecutive hyphens"),
+					validation.StringDoesNotMatch(regexache.MustCompile(`-$`), "cannot end with a hyphen"),
 				),
 			},
 			"configuration_endpoint": {
@@ -323,6 +326,12 @@ func ResourceCluster() *schema.Resource {
 				Computed: true,
 				ForceNew: true,
 			},
+			"transit_encryption_enabled": {
+				Type:     schema.TypeBool,
+				ForceNew: true,
+				Optional: true,
+				Computed: true,
+			},
 			names.AttrTags:    tftags.TagsSchema(),
 			names.AttrTagsAll: tftags.TagsSchemaComputed(),
 		},
@@ -434,6 +443,10 @@ func resourceClusterCreate(ctx context.Context, d *schema.ResourceData, meta int
 		input.SnapshotName = aws.String(v.(string))
 	}
 
+	if v, ok := d.GetOk("transit_encryption_enabled"); ok {
+		input.TransitEncryptionEnabled = aws.Bool(v.(bool))
+	}
+
 	if v, ok := d.GetOk("az_mode"); ok {
 		input.AZMode = aws.String(v.(string))
 	}
@@ -540,6 +553,7 @@ func resourceClusterRead(ctx context.Context, d *schema.ResourceData, meta inter
 	d.Set("ip_discovery", c.IpDiscovery)
 	d.Set("network_type", c.NetworkType)
 	d.Set("preferred_outpost_arn", c.PreferredOutpostArn)
+	d.Set("transit_encryption_enabled", c.TransitEncryptionEnabled)
 
 	return diags
 }
diff --git a/internal/service/elasticache/cluster_data_source.go b/internal/service/elasticache/cluster_data_source.go
index 306cad88c80..9e48676917a 100644
--- a/internal/service/elasticache/cluster_data_source.go
+++ b/internal/service/elasticache/cluster_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elasticache
 
 import (
diff --git a/internal/service/elasticache/cluster_data_source_test.go b/internal/service/elasticache/cluster_data_source_test.go
index f60d8b5d2c6..2cdf3d59bcb 100644
--- a/internal/service/elasticache/cluster_data_source_test.go
+++ b/internal/service/elasticache/cluster_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elasticache_test
 
 import (
diff --git a/internal/service/elasticache/cluster_test.go b/internal/service/elasticache/cluster_test.go
index 44a1a925f69..98f83eae9ae 100644
--- a/internal/service/elasticache/cluster_test.go
+++ b/internal/service/elasticache/cluster_test.go
@@ -1,14 +1,17 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elasticache_test
 
 import (
 	"context"
 	"errors"
 	"fmt"
-	"regexp"
 	"strconv"
 	"strings"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/elasticache"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -94,7 +97,7 @@ func TestAccElastiCacheCluster_Engine_redis(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "cache_nodes.0.id", "0001"),
 					resource.TestCheckResourceAttr(resourceName, "cache_nodes.0.outpost_arn", ""),
 					resource.TestCheckResourceAttr(resourceName, "engine", "redis"),
-					resource.TestMatchResourceAttr(resourceName, "engine_version_actual", regexp.MustCompile(`^7\.[[:digit:]]+\.[[:digit:]]+$`)),
+					resource.TestMatchResourceAttr(resourceName, "engine_version_actual", regexache.MustCompile(`^7\.[[:digit:]]+\.[[:digit:]]+$`)),
 					resource.TestCheckResourceAttr(resourceName, "ip_discovery", "ipv4"),
 					resource.TestCheckResourceAttr(resourceName, "network_type", "ipv4"),
 					resource.TestCheckNoResourceAttr(resourceName, "outpost_mode"),
@@ -165,7 +168,7 @@ func TestAccElastiCacheCluster_Engine_None(t *testing.T) {
 				Config: testAccClusterConfig_engineNone(rName),
 				// Verify "ExactlyOneOf" in the schema for "engine" and "replication_group_id"
 				// throws a plan-time error when neither are configured.
-				ExpectError: regexp.MustCompile(`Invalid combination of arguments`),
+				ExpectError: regexache.MustCompile(`Invalid combination of arguments`),
 			},
 		},
 	})
@@ -525,11 +528,11 @@ func TestAccElastiCacheCluster_AZMode_memcached(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccClusterConfig_azModeMemcached(rName, "unknown"),
-				ExpectError: regexp.MustCompile(`expected az_mode to be one of .*, got unknown`),
+				ExpectError: regexache.MustCompile(`expected az_mode to be one of .*, got unknown`),
 			},
 			{
 				Config:      testAccClusterConfig_azModeMemcached(rName, "cross-az"),
-				ExpectError: regexp.MustCompile(`az_mode "cross-az" is not supported with num_cache_nodes = 1`),
+				ExpectError: regexache.MustCompile(`az_mode "cross-az" is not supported with num_cache_nodes = 1`),
 			},
 			{
 				Config: testAccClusterConfig_azModeMemcached(rName, "single-az"),
@@ -540,7 +543,7 @@ func TestAccElastiCacheCluster_AZMode_memcached(t *testing.T) {
 			},
 			{
 				Config:      testAccClusterConfig_azModeMemcached(rName, "cross-az"),
-				ExpectError: regexp.MustCompile(`az_mode "cross-az" is not supported with num_cache_nodes = 1`),
+				ExpectError: regexache.MustCompile(`az_mode "cross-az" is not supported with num_cache_nodes = 1`),
 			},
 		},
 	})
@@ -564,11 +567,11 @@ func TestAccElastiCacheCluster_AZMode_redis(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccClusterConfig_azModeRedis(rName, "unknown"),
-				ExpectError: regexp.MustCompile(`expected az_mode to be one of .*, got unknown`),
+				ExpectError: regexache.MustCompile(`expected az_mode to be one of .*, got unknown`),
 			},
 			{
 				Config:      testAccClusterConfig_azModeRedis(rName, "cross-az"),
-				ExpectError: regexp.MustCompile(`az_mode "cross-az" is not supported with num_cache_nodes = 1`),
+				ExpectError: regexache.MustCompile(`az_mode "cross-az" is not supported with num_cache_nodes = 1`),
 			},
 			{
 				Config: testAccClusterConfig_azModeRedis(rName, "single-az"),
@@ -633,7 +636,7 @@ func TestAccElastiCacheCluster_EngineVersion_redis(t *testing.T) {
 		t.Skip("skipping long-running test in short mode")
 	}
 
-	var v1, v2, v3, v4, v5, v6, v7, v8 elasticache.CacheCluster
+	var v1, v2, v3, v4, v5, v6 elasticache.CacheCluster
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_elasticache_cluster.test"
 
@@ -644,54 +647,36 @@ func TestAccElastiCacheCluster_EngineVersion_redis(t *testing.T) {
 		CheckDestroy:             testAccCheckClusterDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccClusterConfig_engineVersionRedis(rName, "3.2.6"),
+				Config: testAccClusterConfig_engineVersionRedis(rName, "4.0.10"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckClusterExists(ctx, resourceName, &v1),
-					resource.TestCheckResourceAttr(resourceName, "engine_version", "3.2.6"),
-					resource.TestCheckResourceAttr(resourceName, "engine_version_actual", "3.2.6"),
-				),
-			},
-			{
-				Config: testAccClusterConfig_engineVersionRedis(rName, "3.2.4"),
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckClusterExists(ctx, resourceName, &v2),
-					testAccCheckClusterRecreated(&v1, &v2),
-					resource.TestCheckResourceAttr(resourceName, "engine_version", "3.2.4"),
-					resource.TestCheckResourceAttr(resourceName, "engine_version_actual", "3.2.4"),
-				),
-			},
-			{
-				Config: testAccClusterConfig_engineVersionRedis(rName, "3.2.10"),
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckClusterExists(ctx, resourceName, &v3),
-					testAccCheckClusterNotRecreated(&v2, &v3),
-					resource.TestCheckResourceAttr(resourceName, "engine_version", "3.2.10"),
-					resource.TestCheckResourceAttr(resourceName, "engine_version_actual", "3.2.10"),
+					resource.TestCheckResourceAttr(resourceName, "engine_version", "4.0.10"),
+					resource.TestCheckResourceAttr(resourceName, "engine_version_actual", "4.0.10"),
 				),
 			},
 			{
 				Config: testAccClusterConfig_engineVersionRedis(rName, "6.0"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckClusterExists(ctx, resourceName, &v4),
-					testAccCheckClusterNotRecreated(&v3, &v4),
+					testAccCheckClusterExists(ctx, resourceName, &v2),
+					testAccCheckClusterNotRecreated(&v1, &v2),
 					resource.TestCheckResourceAttr(resourceName, "engine_version", "6.0"),
-					resource.TestMatchResourceAttr(resourceName, "engine_version_actual", regexp.MustCompile(`^6\.0\.[[:digit:]]+$`)),
+					resource.TestMatchResourceAttr(resourceName, "engine_version_actual", regexache.MustCompile(`^6\.0\.[[:digit:]]+$`)),
 				),
 			},
 			{
 				Config: testAccClusterConfig_engineVersionRedis(rName, "6.2"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckClusterExists(ctx, resourceName, &v5),
-					testAccCheckClusterNotRecreated(&v4, &v5),
+					testAccCheckClusterExists(ctx, resourceName, &v3),
+					testAccCheckClusterNotRecreated(&v2, &v3),
 					resource.TestCheckResourceAttr(resourceName, "engine_version", "6.2"),
-					resource.TestMatchResourceAttr(resourceName, "engine_version_actual", regexp.MustCompile(`^6\.2\.[[:digit:]]+$`)),
+					resource.TestMatchResourceAttr(resourceName, "engine_version_actual", regexache.MustCompile(`^6\.2\.[[:digit:]]+$`)),
 				),
 			},
 			{
 				Config: testAccClusterConfig_engineVersionRedis(rName, "5.0.6"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckClusterExists(ctx, resourceName, &v6),
-					testAccCheckClusterRecreated(&v5, &v6),
+					testAccCheckClusterExists(ctx, resourceName, &v4),
+					testAccCheckClusterRecreated(&v3, &v4),
 					resource.TestCheckResourceAttr(resourceName, "engine_version", "5.0.6"),
 					resource.TestCheckResourceAttr(resourceName, "engine_version_actual", "5.0.6"),
 				),
@@ -699,19 +684,19 @@ func TestAccElastiCacheCluster_EngineVersion_redis(t *testing.T) {
 			{
 				Config: testAccClusterConfig_engineVersionRedis(rName, "6.x"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckClusterExists(ctx, resourceName, &v7),
-					testAccCheckClusterNotRecreated(&v6, &v7),
+					testAccCheckClusterExists(ctx, resourceName, &v5),
+					testAccCheckClusterNotRecreated(&v4, &v5),
 					resource.TestCheckResourceAttr(resourceName, "engine_version", "6.x"),
-					resource.TestMatchResourceAttr(resourceName, "engine_version_actual", regexp.MustCompile(`^6\.[[:digit:]]+\.[[:digit:]]+$`)),
+					resource.TestMatchResourceAttr(resourceName, "engine_version_actual", regexache.MustCompile(`^6\.[[:digit:]]+\.[[:digit:]]+$`)),
 				),
 			},
 			{
 				Config: testAccClusterConfig_engineVersionRedis(rName, "6.0"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckClusterExists(ctx, resourceName, &v8),
-					testAccCheckClusterRecreated(&v7, &v8),
+					testAccCheckClusterExists(ctx, resourceName, &v6),
+					testAccCheckClusterRecreated(&v5, &v6),
 					resource.TestCheckResourceAttr(resourceName, "engine_version", "6.0"),
-					resource.TestMatchResourceAttr(resourceName, "engine_version_actual", regexp.MustCompile(`^6\.0\.[[:digit:]]+$`)),
+					resource.TestMatchResourceAttr(resourceName, "engine_version_actual", regexache.MustCompile(`^6\.0\.[[:digit:]]+$`)),
 				),
 			},
 		},
@@ -800,7 +785,7 @@ func TestAccElastiCacheCluster_NumCacheNodes_redis(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccClusterConfig_numCacheNodesRedis(rName, 2),
-				ExpectError: regexp.MustCompile(`engine "redis" does not support num_cache_nodes > 1`),
+				ExpectError: regexache.MustCompile(`engine "redis" does not support num_cache_nodes > 1`),
 			},
 		},
 	})
@@ -836,6 +821,37 @@ func TestAccElastiCacheCluster_ReplicationGroupID_availabilityZone(t *testing.T)
 	})
 }
 
+func TestAccElastiCacheCluster_ReplicationGroupID_transitEncryption(t *testing.T) {
+	ctx := acctest.Context(t)
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
+	var cluster elasticache.CacheCluster
+	var replicationGroup elasticache.ReplicationGroup
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	clusterResourceName := "aws_elasticache_cluster.test"
+	replicationGroupResourceName := "aws_elasticache_replication_group.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, elasticache.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckClusterDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccClusterConfig_replicationGroupIDTransitEncryption(rName, true),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckReplicationGroupExists(ctx, replicationGroupResourceName, &replicationGroup),
+					testAccCheckClusterExists(ctx, clusterResourceName, &cluster),
+					testAccCheckClusterReplicationGroupIDAttribute(&cluster, &replicationGroup),
+					resource.TestCheckResourceAttr(clusterResourceName, "transit_encryption_enabled", "true"),
+				),
+			},
+		},
+	})
+}
+
 func TestAccElastiCacheCluster_ReplicationGroupID_singleReplica(t *testing.T) {
 	ctx := acctest.Context(t)
 	if testing.Short() {
@@ -922,7 +938,7 @@ func TestAccElastiCacheCluster_Memcached_finalSnapshot(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccClusterConfig_memcachedFinalSnapshot(rName),
-				ExpectError: regexp.MustCompile(`engine "memcached" does not support final_snapshot_identifier`),
+				ExpectError: regexache.MustCompile(`engine "memcached" does not support final_snapshot_identifier`),
 			},
 		},
 	})
@@ -1225,6 +1241,42 @@ func TestAccElastiCacheCluster_tagWithOtherModification(t *testing.T) {
 	})
 }
 
+func TestAccElastiCacheCluster_TransitEncryption(t *testing.T) {
+	ctx := acctest.Context(t)
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+	var cluster elasticache.CacheCluster
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_elasticache_cluster.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, elasticache.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckClusterDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config:      testAccClusterConfig_transitEncryption(rName, "memcached", "1.6.6"),
+				ExpectError: regexache.MustCompile(`InvalidParameterCombination: Encryption features are not supported for engine version 1.6.6. Please use engine version 1.6.12`),
+			},
+			{
+				Config:      testAccClusterConfig_transitEncryption(rName, "redis", "6.2"),
+				ExpectError: regexache.MustCompile(`InvalidParameterCombination: Encryption feature is not supported for engine REDIS.`),
+			},
+			{
+				Config: testAccClusterConfig_transitEncryption(rName, "memcached", "1.6.12"),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckClusterExists(ctx, resourceName, &cluster),
+					resource.TestCheckResourceAttr(resourceName, "engine", "memcached"),
+					resource.TestCheckResourceAttr(resourceName, "engine_version", "1.6.12"),
+					resource.TestCheckResourceAttr(resourceName, "transit_encryption_enabled", "true"),
+				),
+			},
+		},
+	})
+}
+
 func TestAccElastiCacheCluster_outpost_memcached(t *testing.T) {
 	ctx := acctest.Context(t)
 	if testing.Short() {
@@ -1288,7 +1340,7 @@ func TestAccElastiCacheCluster_outpost_redis(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "cache_nodes.0.id", "0001"),
 					resource.TestCheckResourceAttrSet(resourceName, "cache_nodes.0.outpost_arn"),
 					resource.TestCheckResourceAttr(resourceName, "engine", "redis"),
-					resource.TestMatchResourceAttr(resourceName, "engine_version_actual", regexp.MustCompile(`^7\.[[:digit:]]+\.[[:digit:]]+$`)),
+					resource.TestMatchResourceAttr(resourceName, "engine_version_actual", regexache.MustCompile(`^7\.[[:digit:]]+\.[[:digit:]]+$`)),
 					resource.TestCheckResourceAttr(resourceName, "port", "6379"),
 					resource.TestCheckResourceAttr(resourceName, "auto_minor_version_upgrade", "true"),
 				),
@@ -1916,12 +1968,35 @@ resource "aws_elasticache_replication_group" "test" {
 
 resource "aws_elasticache_cluster" "test" {
   availability_zone    = data.aws_availability_zones.available.names[0]
-  cluster_id           = "%[1]s1"
+  cluster_id           = "%[1]s-1"
   replication_group_id = aws_elasticache_replication_group.test.id
 }
 `, rName))
 }
 
+func testAccClusterConfig_replicationGroupIDTransitEncryption(rName string, enabled bool) string {
+	return acctest.ConfigCompose(acctest.ConfigAvailableAZsNoOptIn(), fmt.Sprintf(`
+resource "aws_elasticache_replication_group" "test" {
+  description                = "Terraform Acceptance Testing"
+  replication_group_id       = %[1]q
+  node_type                  = "cache.t3.medium"
+  num_cache_clusters         = 1
+  port                       = 6379
+  transit_encryption_enabled = %[2]t
+
+  lifecycle {
+    ignore_changes = [num_cache_clusters]
+  }
+}
+
+resource "aws_elasticache_cluster" "test" {
+  availability_zone    = data.aws_availability_zones.available.names[0]
+  cluster_id           = "%[1]s-1"
+  replication_group_id = aws_elasticache_replication_group.test.id
+}
+`, rName, enabled))
+}
+
 func testAccClusterConfig_replicationGroupIDReplica(rName string, count int) string {
 	return fmt.Sprintf(`
 resource "aws_elasticache_replication_group" "test" {
@@ -1938,7 +2013,7 @@ resource "aws_elasticache_replication_group" "test" {
 
 resource "aws_elasticache_cluster" "test" {
   count                = %[2]d
-  cluster_id           = "%[1]s${count.index}"
+  cluster_id           = "%[1]s-${count.index}"
   replication_group_id = aws_elasticache_replication_group.test.id
 }
 `, rName, count)
@@ -2150,3 +2225,17 @@ resource "aws_elasticache_cluster" "test" {
 }
 `, rName, version, tagKey1, tagValue1)
 }
+
+func testAccClusterConfig_transitEncryption(rName, engine, version string) string {
+	return fmt.Sprintf(`
+resource "aws_elasticache_cluster" "test" {
+  apply_immediately          = true
+  cluster_id                 = "%[1]s"
+  engine                     = "%[2]s"
+  engine_version             = "%[3]s"
+  node_type                  = "cache.t3.medium"
+  num_cache_nodes            = 1
+  transit_encryption_enabled = true
+}
+`, rName, engine, version)
+}
diff --git a/internal/service/elasticache/diff.go b/internal/service/elasticache/diff.go
index 979ea1da74b..dfedae91963 100644
--- a/internal/service/elasticache/diff.go
+++ b/internal/service/elasticache/diff.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elasticache
 
 import (
diff --git a/internal/service/elasticache/engine_version.go b/internal/service/elasticache/engine_version.go
index 604cb7840e4..37feace6aff 100644
--- a/internal/service/elasticache/engine_version.go
+++ b/internal/service/elasticache/engine_version.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elasticache
 
 import (
@@ -6,6 +9,7 @@ import (
 	"math"
 	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	multierror "github.com/hashicorp/go-multierror"
 	gversion "github.com/hashicorp/go-version"
@@ -17,9 +21,9 @@ const (
 	versionStringRegexpPattern         = "^" + versionStringRegexpInternalPattern + "$"
 )
 
-var versionStringRegexp = regexp.MustCompile(versionStringRegexpPattern)
+var versionStringRegexp = regexache.MustCompile(versionStringRegexpPattern)
 
-func validMemcachedVersionString(v interface{}, k string) (ws []string, errors []error) {
+func validMemcachedVersionString(v any, k string) (ws []string, errors []error) {
 	value := v.(string)
 
 	if !versionStringRegexp.MatchString(value) {
@@ -37,22 +41,22 @@ const (
 )
 
 var (
-	redisVersionRegexp       = regexp.MustCompile(redisVersionRegexpPattern)
-	redisVersionPostV6Regexp = regexp.MustCompile(redisVersionPostV6RegexpPattern)
+	redisVersionRegexp       = regexache.MustCompile(redisVersionRegexpPattern)
+	redisVersionPostV6Regexp = regexache.MustCompile(redisVersionPostV6RegexpPattern)
 )
 
-func validRedisVersionString(v interface{}, k string) (ws []string, errors []error) {
+func validRedisVersionString(v any, k string) (ws []string, errors []error) {
 	value := v.(string)
 
 	if !redisVersionRegexp.MatchString(value) {
-		errors = append(errors, fmt.Errorf("%s: Redis versions must match <major>.<minor> when using version 6 or higher, or <major>.<minor>.<patch>", k))
+		errors = append(errors, fmt.Errorf("%s: %s is invalid. For Redis v6 or higher, use <major>.<minor>. For Redis v5 or lower, use <major>.<minor>.<patch>.", k, value))
 	}
 
 	return
 }
 
 // CustomizeDiffValidateClusterEngineVersion validates the correct format for `engine_version`, based on `engine`
-func CustomizeDiffValidateClusterEngineVersion(_ context.Context, diff *schema.ResourceDiff, _ interface{}) error {
+func CustomizeDiffValidateClusterEngineVersion(_ context.Context, diff *schema.ResourceDiff, _ any) error {
 	engineVersion, ok := diff.GetOk("engine_version")
 	if !ok {
 		return nil
@@ -80,16 +84,37 @@ func validateClusterEngineVersion(engine, engineVersion string) error {
 }
 
 // customizeDiffEngineVersionForceNewOnDowngrade causes re-creation of the resource if the version is being downgraded
-func customizeDiffEngineVersionForceNewOnDowngrade(_ context.Context, diff *schema.ResourceDiff, _ interface{}) error {
+func customizeDiffEngineVersionForceNewOnDowngrade(_ context.Context, diff *schema.ResourceDiff, _ any) error {
 	return engineVersionForceNewOnDowngrade(diff)
 }
 
 type getChangeDiffer interface {
-	GetChange(key string) (interface{}, interface{})
+	Get(key string) any
+	GetChange(key string) (any, any)
 }
 
 func engineVersionIsDowngrade(diff getChangeDiffer) (bool, error) {
 	o, n := diff.GetChange("engine_version")
+	if o == "6.x" {
+		actual := diff.Get("engine_version_actual")
+		aVersion, err := gversion.NewVersion(actual.(string))
+		if err != nil {
+			return false, fmt.Errorf("parsing current engine_version: %w", err)
+		}
+		nVersion, err := normalizeEngineVersion(n.(string))
+		if err != nil {
+			return false, fmt.Errorf("parsing new engine_version: %w", err)
+		}
+
+		aSegments := aVersion.Segments()
+		nSegments := nVersion.Segments()
+
+		if nSegments[0] != aSegments[0] {
+			return nSegments[0] < aSegments[0], nil
+		}
+		return nSegments[1] < aSegments[1], nil
+	}
+
 	oVersion, err := normalizeEngineVersion(o.(string))
 	if err != nil {
 		return false, fmt.Errorf("parsing old engine_version: %w", err)
@@ -104,7 +129,8 @@ func engineVersionIsDowngrade(diff getChangeDiffer) (bool, error) {
 
 type forceNewDiffer interface {
 	Id() string
-	GetChange(key string) (interface{}, interface{})
+	Get(key string) any
+	GetChange(key string) (any, any)
 	HasChange(key string) bool
 	ForceNew(key string) error
 }
diff --git a/internal/service/elasticache/engine_version_test.go b/internal/service/elasticache/engine_version_test.go
index bb5867d28e8..f5a5aa88f0a 100644
--- a/internal/service/elasticache/engine_version_test.go
+++ b/internal/service/elasticache/engine_version_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elasticache
 
 import (
@@ -6,6 +9,7 @@ import (
 	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/hashicorp/go-version"
 )
 
@@ -299,87 +303,85 @@ type mockGetChangeDiffer struct {
 	old, new string
 }
 
-func (d *mockGetChangeDiffer) GetChange(key string) (interface{}, interface{}) {
+func (d *mockGetChangeDiffer) GetChange(key string) (any, any) {
 	return d.old, d.new
 }
 
+func (d *mockGetChangeDiffer) Get(key string) any {
+	return ""
+}
+
 func TestCustomizeDiffEngineVersionIsDowngrade(t *testing.T) {
 	t.Parallel()
 
 	testcases := map[string]struct {
-		old, new string
-		expected bool
+		old, new    string
+		isDowngrade bool
 	}{
 		"no change": {
-			old:      "1.2.3",
-			new:      "1.2.3",
-			expected: false,
+			old:         "1.2.3",
+			new:         "1.2.3",
+			isDowngrade: false,
 		},
 
 		"upgrade minor versions": {
-			old:      "1.2.3",
-			new:      "1.3.5",
-			expected: false,
+			old:         "1.2.3",
+			new:         "1.3.5",
+			isDowngrade: false,
 		},
 
 		"upgrade major versions": {
-			old:      "1.2.3",
-			new:      "2.4.6",
-			expected: false,
+			old:         "1.2.3",
+			new:         "2.4.6",
+			isDowngrade: false,
 		},
 
 		"upgrade major 6.x": {
-			old:      "5.0.6",
-			new:      "6.x",
-			expected: false,
+			old:         "5.0.6",
+			new:         "6.x",
+			isDowngrade: false,
 		},
 
 		"upgrade major 6.digit": {
-			old:      "5.0.6",
-			new:      "6.0",
-			expected: false,
+			old:         "5.0.6",
+			new:         "6.0",
+			isDowngrade: false,
 		},
 
 		"downgrade minor versions": {
-			old:      "1.3.5",
-			new:      "1.2.3",
-			expected: true,
+			old:         "1.3.5",
+			new:         "1.2.3",
+			isDowngrade: true,
 		},
 
 		"downgrade major versions": {
-			old:      "2.4.6",
-			new:      "1.2.3",
-			expected: true,
-		},
-
-		"downgrade from major 6.x": {
-			old:      "6.x",
-			new:      "5.0.6",
-			expected: true,
+			old:         "2.4.6",
+			new:         "1.2.3",
+			isDowngrade: true,
 		},
 
 		"downgrade major 6.digit": {
-			old:      "6.2",
-			new:      "6.0",
-			expected: true,
+			old:         "6.2",
+			new:         "6.0",
+			isDowngrade: true,
 		},
 
 		"switch major 6.digit to 6.x": {
-			old:      "6.2",
-			new:      "6.x",
-			expected: false,
+			old:         "6.2",
+			new:         "6.x",
+			isDowngrade: false,
 		},
 
 		"downgrade from major 7.digit to 6.x": {
-			old:      "7.2",
-			new:      "6.x",
-			expected: true,
+			old:         "7.2",
+			new:         "6.x",
+			isDowngrade: true,
 		},
 
 		"downgrade from major 7.digit to 6.digit": {
-			old:      "7.2",
-			new:      "6.2",
-			expected: true,
+			old:         "7.2",
+			new:         "6.2",
+			isDowngrade: true,
 		},
 	}
 
@@ -399,8 +401,84 @@ func TestCustomizeDiffEngineVersionIsDowngrade(t *testing.T) {
 				t.Fatalf("no error expected, got %s", err)
 			}
 
-			if testcase.expected != actual {
-				t.Errorf("expected %t, got %t", testcase.expected, actual)
+			if testcase.isDowngrade != actual {
+				t.Errorf("expected %t, got %t", testcase.isDowngrade, actual)
+			}
+		})
+	}
+}
+
+func TestCustomizeDiffEngineVersionIsDowngrade_6xTo6digit(t *testing.T) {
+	t.Parallel()
+
+	// Version 6.x currently maps to v6.2. In case that changes, we need to check
+	testcases := map[string]struct {
+		versionOld       string
+		actualVersionOld string
+		versionNew       string
+		isDowngrade      bool
+	}{
+		"minor downgrade to 6.0": {
+			versionOld:       "6.x",
+			actualVersionOld: "6.2.1",
+			versionNew:       "6.0",
+			isDowngrade:      true,
+		},
+
+		"same version": {
+			versionOld:       "6.x",
+			actualVersionOld: "6.2.1",
+			versionNew:       "6.2",
+			isDowngrade:      false,
+		},
+
+		"minor upgrade": {
+			versionOld:       "6.x",
+			actualVersionOld: "6.2.1",
+			versionNew:       "6.4",
+			isDowngrade:      false,
+		},
+
+		"major downgrade from 6.x": {
+			versionOld:       "6.x",
+			actualVersionOld: "6.2.1",
+			versionNew:       "5.0.6",
+			isDowngrade:      true,
+		},
+
+		"major upgrade from 6.x": {
+			versionOld:       "6.x",
+			actualVersionOld: "6.2.1",
+			versionNew:       "7.0",
+			isDowngrade:      false,
+		},
+	}
+
+	for name, testcase := range testcases {
+		testcase := testcase
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			diff := mockChangesDiffer{
+				values: map[string]mockDiff{
+					"engine_version": {
+						old: testcase.versionOld,
+						new: testcase.versionNew,
+					},
+					"engine_version_actual": {
+						old: testcase.actualVersionOld,
+					},
+				},
+			}
+
+			actual, err := engineVersionIsDowngrade(&diff)
+
+			if err != nil {
+				t.Fatalf("no error expected, got %s", err)
+			}
+
+			if testcase.isDowngrade != actual {
+				t.Errorf("expected %t, got %t", testcase.isDowngrade, actual)
 			}
 		})
 	}
@@ -417,11 +495,15 @@ func (d *mockForceNewDiffer) Id() string {
 	return d.id
 }
 
+func (d *mockForceNewDiffer) Get(key string) any {
+	return d.old
+}
+
 func (d *mockForceNewDiffer) HasChange(key string) bool {
 	return d.hasChange || d.old != d.new
 }
 
-func (d *mockForceNewDiffer) GetChange(key string) (interface{}, interface{}) {
+func (d *mockForceNewDiffer) GetChange(key string) (any, any) {
 	return d.old, d.new
 }
 
@@ -483,7 +565,7 @@ func TestCustomizeDiffEngineVersionForceNewOnDowngrade(t *testing.T) {
 		},
 
 		"upgrade major 7.digit": {
-			old:            "6.x",
+			old:            "6.2",
 			new:            "7.0",
 			expectForceNew: false,
 		},
@@ -500,12 +582,6 @@ func TestCustomizeDiffEngineVersionForceNewOnDowngrade(t *testing.T) {
 			expectForceNew: true,
 		},
 
-		"downgrade from major 6.x": {
-			old:            "6.x",
-			new:            "5.0.6",
-			expectForceNew: true,
-		},
-
 		"downgrade major 6.digit": {
 			old:            "6.2",
 			new:            "6.0",
@@ -674,11 +750,15 @@ type mockDiff struct {
 	hasChange bool // force HasChange() to return true
 }
 
+func (d mockDiff) Get() any {
+	return d.old
+}
+
 func (d mockDiff) HasChange() bool {
 	return d.hasChange || d.old != d.new
 }
 
-func (d mockDiff) GetChange() (interface{}, interface{}) {
+func (d mockDiff) GetChange() (any, any) {
 	return d.old, d.new
 }
 
@@ -691,11 +771,15 @@ func (d *mockChangesDiffer) Id() string {
 	return d.id
 }
 
+func (d *mockChangesDiffer) Get(key string) any {
+	return d.values[key].Get()
+}
+
 func (d *mockChangesDiffer) HasChange(key string) bool {
 	return d.values[key].HasChange()
 }
 
-func (d *mockChangesDiffer) GetChange(key string) (interface{}, interface{}) {
+func (d *mockChangesDiffer) GetChange(key string) (any, any) {
 	return d.values[key].GetChange()
 }
 
@@ -727,7 +811,7 @@ func TestParamGroupNameRequiresMajorVersionUpgrade(t *testing.T) {
 			isNew:       true,
 			paramOld:    "old",
 			paramNew:    "",
-			expectError: regexp.MustCompile(`cannot change parameter group name without upgrading major engine version`),
+			expectError: regexache.MustCompile(`cannot change parameter group name without upgrading major engine version`),
 		},
 
 		// new resource with version changes can only be verified at apply-time
@@ -748,7 +832,7 @@ func TestParamGroupNameRequiresMajorVersionUpgrade(t *testing.T) {
 			paramNew:    "new",
 			versionOld:  "6.0",
 			versionNew:  "6.0",
-			expectError: regexp.MustCompile(`cannot change parameter group name without upgrading major engine version`),
+			expectError: regexache.MustCompile(`cannot change parameter group name without upgrading major engine version`),
 		},
 
 		"update, param group change, version spurious diff": {
@@ -757,7 +841,7 @@ func TestParamGroupNameRequiresMajorVersionUpgrade(t *testing.T) {
 			versionOld:       "6.0",
 			versionNew:       "6.0",
 			versionHasChange: true,
-			expectError:      regexp.MustCompile(`cannot change parameter group name without upgrading major engine version`),
+			expectError:      regexache.MustCompile(`cannot change parameter group name without upgrading major engine version`),
 		},
 
 		"update, param group change, minor version change": {
@@ -765,7 +849,7 @@ func TestParamGroupNameRequiresMajorVersionUpgrade(t *testing.T) {
 			paramNew:    "new",
 			versionOld:  "6.0",
 			versionNew:  "6.2",
-			expectError: regexp.MustCompile(`cannot change parameter group name on minor engine version upgrade, upgrading from 6\.0\.[[:digit:]]+ to 6\.2\.[[:digit:]]+`),
+			expectError: regexache.MustCompile(`cannot change parameter group name on minor engine version upgrade, upgrading from 6\.0\.[[:digit:]]+ to 6\.2\.[[:digit:]]+`),
 		},
 
 		"update, param group change, major version change": {
diff --git a/internal/service/elasticache/find.go b/internal/service/elasticache/find.go
index abaf1117926..3469c30e284 100644
--- a/internal/service/elasticache/find.go
+++ b/internal/service/elasticache/find.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elasticache
 
 import (
@@ -187,7 +190,8 @@ func FindParameterGroupByName(ctx context.Context, conn *elasticache.ElastiCache
 	input := elasticache.DescribeCacheParameterGroupsInput{
 		CacheParameterGroupName: aws.String(name),
 	}
-	out, err := conn.DescribeCacheParameterGroupsWithContext(ctx, &input)
+
+	output, err := conn.DescribeCacheParameterGroupsWithContext(ctx, &input)
 
 	if tfawserr.ErrCodeEquals(err, elasticache.ErrCodeCacheParameterGroupNotFoundFault) {
 		return nil, &retry.NotFoundError{
@@ -195,18 +199,16 @@ func FindParameterGroupByName(ctx context.Context, conn *elasticache.ElastiCache
 			LastRequest: input,
 		}
 	}
+
 	if err != nil {
 		return nil, err
 	}
 
-	switch count := len(out.CacheParameterGroups); count {
-	case 0:
+	if output == nil {
 		return nil, tfresource.NewEmptyResultError(input)
-	case 1:
-		return out.CacheParameterGroups[0], nil
-	default:
-		return nil, tfresource.NewTooManyResultsError(count, input)
 	}
+
+	return tfresource.AssertSinglePtrResult(output.CacheParameterGroups)
 }
 
 type redisParameterGroupFilter func(group *elasticache.CacheParameterGroup) bool
diff --git a/internal/service/elasticache/flex.go b/internal/service/elasticache/flex.go
index 87fa713d7f5..10419cd1d2d 100644
--- a/internal/service/elasticache/flex.go
+++ b/internal/service/elasticache/flex.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elasticache
 
 import (
diff --git a/internal/service/elasticache/generate.go b/internal/service/elasticache/generate.go
index 6919e17a32b..b6f9413373d 100644
--- a/internal/service/elasticache/generate.go
+++ b/internal/service/elasticache/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTags -ListTagsInIDElem=ResourceName -ListTagsOutTagsElem=TagList -ServiceTagsSlice -TagOp=AddTagsToResource -TagInIDElem=ResourceName -UntagOp=RemoveTagsFromResource -UpdateTags -CreateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/elasticache/global_replication_group.go b/internal/service/elasticache/global_replication_group.go
index b2df8847720..bd141aefba7 100644
--- a/internal/service/elasticache/global_replication_group.go
+++ b/internal/service/elasticache/global_replication_group.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elasticache
 
 import (
@@ -9,6 +12,7 @@ import (
 	"strconv"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/elasticache"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -45,7 +49,7 @@ func ResourceGlobalReplicationGroup() *schema.Resource {
 		DeleteWithoutTimeout: resourceGlobalReplicationGroupDelete,
 		Importer: &schema.ResourceImporter{
 			StateContext: func(ctx context.Context, d *schema.ResourceData, meta any) ([]*schema.ResourceData, error) {
-				re := regexp.MustCompile("^" + GlobalReplicationGroupRegionPrefixFormat)
+				re := regexache.MustCompile("^" + GlobalReplicationGroupRegionPrefixFormat)
 				d.Set("global_replication_group_id_suffix", re.ReplaceAllLiteralString(d.Id(), ""))
 
 				return []*schema.ResourceData{d}, nil
@@ -667,8 +671,14 @@ func globalReplcationGroupNodeGroupIncrease(ctx context.Context, conn *elasticac
 }
 
 func globalReplicationGroupNodeGroupDecrease(ctx context.Context, conn *elasticache.ElastiCache, id string, requested int, nodeGroupIDs []string) error {
-	slices.SortFunc(nodeGroupIDs, func(a, b string) bool {
-		return globalReplicationGroupNodeNumber(a) < globalReplicationGroupNodeNumber(b)
+	slices.SortFunc(nodeGroupIDs, func(a, b string) int {
+		if globalReplicationGroupNodeNumber(a) < globalReplicationGroupNodeNumber(b) {
+			return -1
+		}
+		if globalReplicationGroupNodeNumber(a) > globalReplicationGroupNodeNumber(b) {
+			return 1
+		}
+		return 0
 	})
 	nodeGroupIDs = nodeGroupIDs[:requested]
 
@@ -683,7 +693,7 @@ func globalReplicationGroupNodeGroupDecrease(ctx context.Context, conn *elastica
 }
 
 func globalReplicationGroupNodeNumber(id string) int {
-	re := regexp.MustCompile(`^.+-0{0,3}(\d+)$`)
+	re := regexache.MustCompile(`^.+-0{0,3}(\d+)$`)
 	matches := re.FindStringSubmatch(id)
 	if len(matches) == 2 {
 		if v, err := strconv.Atoi(matches[1]); err == nil {
diff --git a/internal/service/elasticache/global_replication_group_test.go b/internal/service/elasticache/global_replication_group_test.go
index 948809619ef..bc733739ce8 100644
--- a/internal/service/elasticache/global_replication_group_test.go
+++ b/internal/service/elasticache/global_replication_group_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elasticache_test
 
 import (
@@ -6,6 +9,7 @@ import (
 	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/elasticache"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -49,7 +53,7 @@ func TestAccElastiCacheGlobalReplicationGroup_basic(t *testing.T) {
 					testAccCheckGlobalReplicationGroupExists(ctx, resourceName, &globalReplicationGroup),
 					testAccCheckReplicationGroupExists(ctx, primaryReplicationGroupResourceName, &primaryReplicationGroup),
 					testAccCheckReplicationGroupParameterGroup(ctx, &primaryReplicationGroup, &pg),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "elasticache", regexp.MustCompile(`globalreplicationgroup:`+tfelasticache.GlobalReplicationGroupRegionPrefixFormat+rName)),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "elasticache", regexache.MustCompile(`globalreplicationgroup:`+tfelasticache.GlobalReplicationGroupRegionPrefixFormat+rName)),
 					resource.TestCheckResourceAttrPair(resourceName, "at_rest_encryption_enabled", primaryReplicationGroupResourceName, "at_rest_encryption_enabled"),
 					resource.TestCheckResourceAttr(resourceName, "auth_token_enabled", "false"),
 					resource.TestCheckResourceAttrPair(resourceName, "automatic_failover_enabled", primaryReplicationGroupResourceName, "automatic_failover_enabled"),
@@ -58,7 +62,7 @@ func TestAccElastiCacheGlobalReplicationGroup_basic(t *testing.T) {
 					resource.TestCheckResourceAttrPair(resourceName, "engine", primaryReplicationGroupResourceName, "engine"),
 					resource.TestCheckResourceAttrPair(resourceName, "engine_version_actual", primaryReplicationGroupResourceName, "engine_version_actual"),
 					resource.TestCheckResourceAttr(resourceName, "global_replication_group_id_suffix", rName),
-					resource.TestMatchResourceAttr(resourceName, "global_replication_group_id", regexp.MustCompile(tfelasticache.GlobalReplicationGroupRegionPrefixFormat+rName)),
+					resource.TestMatchResourceAttr(resourceName, "global_replication_group_id", regexache.MustCompile(tfelasticache.GlobalReplicationGroupRegionPrefixFormat+rName)),
 					resource.TestCheckResourceAttr(resourceName, "global_replication_group_description", tfelasticache.EmptyDescription),
 					resource.TestCheckResourceAttr(resourceName, "global_node_groups.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "num_node_groups", "0"),
@@ -624,13 +628,13 @@ func TestAccElastiCacheGlobalReplicationGroup_SetNumNodeGroupsOnCreate_Increase(
 					resource.TestCheckResourceAttr(resourceName, "cluster_enabled", "true"),
 					resource.TestCheckResourceAttr(resourceName, "global_node_groups.#", "3"),
 					resource.TestMatchTypeSetElemNestedAttrs(resourceName, "global_node_groups.*", map[string]*regexp.Regexp{
-						"global_node_group_id": regexp.MustCompile(fmt.Sprintf("^[a-z]+-%s-0001$", rName)),
+						"global_node_group_id": regexache.MustCompile(fmt.Sprintf("^[a-z]+-%s-0001$", rName)),
 					}),
 					resource.TestMatchTypeSetElemNestedAttrs(resourceName, "global_node_groups.*", map[string]*regexp.Regexp{
-						"global_node_group_id": regexp.MustCompile(fmt.Sprintf("^[a-z]+-%s-0002$", rName)),
+						"global_node_group_id": regexache.MustCompile(fmt.Sprintf("^[a-z]+-%s-0002$", rName)),
 					}),
 					resource.TestMatchTypeSetElemNestedAttrs(resourceName, "global_node_groups.*", map[string]*regexp.Regexp{
-						"global_node_group_id": regexp.MustCompile(fmt.Sprintf("^[a-z]+-%s-0003$", rName)),
+						"global_node_group_id": regexache.MustCompile(fmt.Sprintf("^[a-z]+-%s-0003$", rName)),
 					}),
 					resource.TestCheckResourceAttr(resourceName, "num_node_groups", "3"),
 					resource.TestCheckResourceAttr(primaryReplicationGroupResourceName, "num_node_groups", "2"),
@@ -673,8 +677,8 @@ func TestAccElastiCacheGlobalReplicationGroup_SetNumNodeGroupsOnCreate_Decrease(
 					resource.TestCheckResourceAttr(resourceName, "cluster_enabled", "true"),
 					resource.TestCheckResourceAttr(resourceName, "global_node_groups.#", "1"),
 					resource.TestMatchTypeSetElemNestedAttrs(resourceName, "global_node_groups.*", map[string]*regexp.Regexp{
-						"global_node_group_id": regexp.MustCompile(fmt.Sprintf("^[a-z]+-%s-0001$", rName)),
-						"slots":                regexp.MustCompile("^0-16383$"), // all slots
+						"global_node_group_id": regexache.MustCompile(fmt.Sprintf("^[a-z]+-%s-0001$", rName)),
+						"slots":                regexache.MustCompile("^0-16383$"), // all slots
 					}),
 					resource.TestCheckResourceAttr(resourceName, "num_node_groups", "1"),
 					resource.TestCheckResourceAttr(primaryReplicationGroupResourceName, "num_node_groups", "3"),
@@ -717,10 +721,10 @@ func TestAccElastiCacheGlobalReplicationGroup_SetNumNodeGroupsOnUpdate_Increase(
 					resource.TestCheckResourceAttr(resourceName, "cluster_enabled", "true"),
 					resource.TestCheckResourceAttr(resourceName, "global_node_groups.#", "2"),
 					resource.TestMatchTypeSetElemNestedAttrs(resourceName, "global_node_groups.*", map[string]*regexp.Regexp{
-						"global_node_group_id": regexp.MustCompile(fmt.Sprintf("^[a-z]+-%s-0001$", rName)),
+						"global_node_group_id": regexache.MustCompile(fmt.Sprintf("^[a-z]+-%s-0001$", rName)),
 					}),
 					resource.TestMatchTypeSetElemNestedAttrs(resourceName, "global_node_groups.*", map[string]*regexp.Regexp{
-						"global_node_group_id": regexp.MustCompile(fmt.Sprintf("^[a-z]+-%s-0002$", rName)),
+						"global_node_group_id": regexache.MustCompile(fmt.Sprintf("^[a-z]+-%s-0002$", rName)),
 					}),
 					resource.TestCheckResourceAttr(resourceName, "num_node_groups", "2"),
 					resource.TestCheckResourceAttr(primaryReplicationGroupResourceName, "num_node_groups", "2"),
@@ -734,13 +738,13 @@ func TestAccElastiCacheGlobalReplicationGroup_SetNumNodeGroupsOnUpdate_Increase(
 					resource.TestCheckResourceAttr(resourceName, "cluster_enabled", "true"),
 					resource.TestCheckResourceAttr(resourceName, "global_node_groups.#", "3"),
 					resource.TestMatchTypeSetElemNestedAttrs(resourceName, "global_node_groups.*", map[string]*regexp.Regexp{
-						"global_node_group_id": regexp.MustCompile(fmt.Sprintf("^[a-z]+-%s-0001$", rName)),
+						"global_node_group_id": regexache.MustCompile(fmt.Sprintf("^[a-z]+-%s-0001$", rName)),
 					}),
 					resource.TestMatchTypeSetElemNestedAttrs(resourceName, "global_node_groups.*", map[string]*regexp.Regexp{
-						"global_node_group_id": regexp.MustCompile(fmt.Sprintf("^[a-z]+-%s-0002$", rName)),
+						"global_node_group_id": regexache.MustCompile(fmt.Sprintf("^[a-z]+-%s-0002$", rName)),
 					}),
 					resource.TestMatchTypeSetElemNestedAttrs(resourceName, "global_node_groups.*", map[string]*regexp.Regexp{
-						"global_node_group_id": regexp.MustCompile(fmt.Sprintf("^[a-z]+-%s-0003$", rName)),
+						"global_node_group_id": regexache.MustCompile(fmt.Sprintf("^[a-z]+-%s-0003$", rName)),
 					}),
 					resource.TestCheckResourceAttr(resourceName, "num_node_groups", "3"),
 					resource.TestCheckResourceAttr(primaryReplicationGroupResourceName, "num_node_groups", "2"),
@@ -783,10 +787,10 @@ func TestAccElastiCacheGlobalReplicationGroup_SetNumNodeGroupsOnUpdate_Decrease(
 					resource.TestCheckResourceAttr(resourceName, "cluster_enabled", "true"),
 					resource.TestCheckResourceAttr(resourceName, "global_node_groups.#", "2"),
 					resource.TestMatchTypeSetElemNestedAttrs(resourceName, "global_node_groups.*", map[string]*regexp.Regexp{
-						"global_node_group_id": regexp.MustCompile(fmt.Sprintf("^[a-z]+-%s-0001$", rName)),
+						"global_node_group_id": regexache.MustCompile(fmt.Sprintf("^[a-z]+-%s-0001$", rName)),
 					}),
 					resource.TestMatchTypeSetElemNestedAttrs(resourceName, "global_node_groups.*", map[string]*regexp.Regexp{
-						"global_node_group_id": regexp.MustCompile(fmt.Sprintf("^[a-z]+-%s-0002$", rName)),
+						"global_node_group_id": regexache.MustCompile(fmt.Sprintf("^[a-z]+-%s-0002$", rName)),
 					}),
 					resource.TestCheckResourceAttr(resourceName, "num_node_groups", "2"),
 					resource.TestCheckResourceAttr(primaryReplicationGroupResourceName, "num_node_groups", "2"),
@@ -800,8 +804,8 @@ func TestAccElastiCacheGlobalReplicationGroup_SetNumNodeGroupsOnUpdate_Decrease(
 					resource.TestCheckResourceAttr(resourceName, "cluster_enabled", "true"),
 					resource.TestCheckResourceAttr(resourceName, "global_node_groups.#", "1"),
 					resource.TestMatchTypeSetElemNestedAttrs(resourceName, "global_node_groups.*", map[string]*regexp.Regexp{
-						"global_node_group_id": regexp.MustCompile(fmt.Sprintf("^[a-z]+-%s-0001$", rName)),
-						"slots":                regexp.MustCompile("^0-16383$"), // all slots
+						"global_node_group_id": regexache.MustCompile(fmt.Sprintf("^[a-z]+-%s-0001$", rName)),
+						"slots":                regexache.MustCompile("^0-16383$"), // all slots
 					}),
 					resource.TestCheckResourceAttr(resourceName, "num_node_groups", "1"),
 					resource.TestCheckResourceAttr(primaryReplicationGroupResourceName, "num_node_groups", "2"),
@@ -837,7 +841,7 @@ func TestAccElastiCacheGlobalReplicationGroup_SetEngineVersionOnCreate_NoChange_
 				Config: testAccGlobalReplicationGroupConfig_engineVersion(rName, primaryReplicationGroupId, "6.2", "6.2"),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckGlobalReplicationGroupExists(ctx, resourceName, &globalReplicationGroup),
-					resource.TestMatchResourceAttr(resourceName, "engine_version_actual", regexp.MustCompile(`^6\.2\.[[:digit:]]+$`)),
+					resource.TestMatchResourceAttr(resourceName, "engine_version_actual", regexache.MustCompile(`^6\.2\.[[:digit:]]+$`)),
 				),
 			},
 			{
@@ -870,7 +874,7 @@ func TestAccElastiCacheGlobalReplicationGroup_SetEngineVersionOnCreate_NoChange_
 				Config: testAccGlobalReplicationGroupConfig_engineVersion(rName, primaryReplicationGroupId, "6.2", "6.x"),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckGlobalReplicationGroupExists(ctx, resourceName, &globalReplicationGroup),
-					resource.TestMatchResourceAttr(resourceName, "engine_version_actual", regexp.MustCompile(`^6\.2\.[[:digit:]]+$`)),
+					resource.TestMatchResourceAttr(resourceName, "engine_version_actual", regexache.MustCompile(`^6\.2\.[[:digit:]]+$`)),
 				),
 			},
 			{
@@ -941,8 +945,8 @@ func TestAccElastiCacheGlobalReplicationGroup_SetEngineVersionOnCreate_MinorUpgr
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckGlobalReplicationGroupExists(ctx, resourceName, &globalReplicationGroup),
 					testAccCheckReplicationGroupExists(ctx, primaryReplicationGroupResourceName, &rg),
-					resource.TestMatchResourceAttr(resourceName, "engine_version_actual", regexp.MustCompile(`^6\.2\.[[:digit:]]+$`)),
-					testAccMatchReplicationGroupActualVersion(ctx, &rg, regexp.MustCompile(`^6\.2\.[[:digit:]]+$`)),
+					resource.TestMatchResourceAttr(resourceName, "engine_version_actual", regexache.MustCompile(`^6\.2\.[[:digit:]]+$`)),
+					testAccMatchReplicationGroupActualVersion(ctx, &rg, regexache.MustCompile(`^6\.2\.[[:digit:]]+$`)),
 				),
 			},
 			{
@@ -979,8 +983,8 @@ func TestAccElastiCacheGlobalReplicationGroup_SetEngineVersionOnCreate_MinorUpgr
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckGlobalReplicationGroupExists(ctx, resourceName, &globalReplicationGroup),
 					testAccCheckReplicationGroupExists(ctx, primaryReplicationGroupResourceName, &rg),
-					resource.TestMatchResourceAttr(resourceName, "engine_version_actual", regexp.MustCompile(`^6\.0\.[[:digit:]]+$`)),
-					testAccMatchReplicationGroupActualVersion(ctx, &rg, regexp.MustCompile(`^6\.0\.[[:digit:]]+$`)),
+					resource.TestMatchResourceAttr(resourceName, "engine_version_actual", regexache.MustCompile(`^6\.0\.[[:digit:]]+$`)),
+					testAccMatchReplicationGroupActualVersion(ctx, &rg, regexache.MustCompile(`^6\.0\.[[:digit:]]+$`)),
 				),
 			},
 		},
@@ -1012,8 +1016,8 @@ func TestAccElastiCacheGlobalReplicationGroup_SetEngineVersionOnCreate_MajorUpgr
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckGlobalReplicationGroupExists(ctx, resourceName, &globalReplicationGroup),
 					testAccCheckReplicationGroupExists(ctx, primaryReplicationGroupResourceName, &rg),
-					resource.TestMatchResourceAttr(resourceName, "engine_version_actual", regexp.MustCompile(`^6\.2\.[[:digit:]]+$`)),
-					testAccMatchReplicationGroupActualVersion(ctx, &rg, regexp.MustCompile(`^6\.2\.[[:digit:]]+$`)),
+					resource.TestMatchResourceAttr(resourceName, "engine_version_actual", regexache.MustCompile(`^6\.2\.[[:digit:]]+$`)),
+					testAccMatchReplicationGroupActualVersion(ctx, &rg, regexache.MustCompile(`^6\.2\.[[:digit:]]+$`)),
 				),
 			},
 			{
@@ -1051,8 +1055,8 @@ func TestAccElastiCacheGlobalReplicationGroup_SetEngineVersionOnCreate_MajorUpgr
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckGlobalReplicationGroupExists(ctx, resourceName, &globalReplicationGroup),
 					testAccCheckReplicationGroupExists(ctx, primaryReplicationGroupResourceName, &rg),
-					resource.TestMatchResourceAttr(resourceName, "engine_version_actual", regexp.MustCompile(`^6\.2\.[[:digit:]]+$`)),
-					testAccMatchReplicationGroupActualVersion(ctx, &rg, regexp.MustCompile(`^6\.2\.[[:digit:]]+$`)),
+					resource.TestMatchResourceAttr(resourceName, "engine_version_actual", regexache.MustCompile(`^6\.2\.[[:digit:]]+$`)),
+					testAccMatchReplicationGroupActualVersion(ctx, &rg, regexache.MustCompile(`^6\.2\.[[:digit:]]+$`)),
 				),
 			},
 			{
@@ -1082,7 +1086,7 @@ func TestAccElastiCacheGlobalReplicationGroup_SetEngineVersionOnCreate_MinorDown
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccGlobalReplicationGroupConfig_engineVersion(rName, primaryReplicationGroupId, "6.2", "6.0"),
-				ExpectError: regexp.MustCompile(`cannot downgrade version when creating, is 6.2.[[:digit:]]+, want 6.0.[[:digit:]]+`),
+				ExpectError: regexache.MustCompile(`cannot downgrade version when creating, is 6.2.[[:digit:]]+, want 6.0.[[:digit:]]+`),
 			},
 		},
 	})
@@ -1101,7 +1105,7 @@ func TestAccElastiCacheGlobalReplicationGroup_SetParameterGroupOnCreate_NoVersio
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccGlobalReplicationGroupConfig_param(rName, primaryReplicationGroupId, "6.2", "default.redis6.x"),
-				ExpectError: regexp.MustCompile(`cannot change parameter group name without upgrading major engine version`),
+				ExpectError: regexache.MustCompile(`cannot change parameter group name without upgrading major engine version`),
 				PlanOnly:    true,
 			},
 		},
@@ -1121,7 +1125,7 @@ func TestAccElastiCacheGlobalReplicationGroup_SetParameterGroupOnCreate_MinorUpg
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccGlobalReplicationGroupConfig_engineVersionParam(rName, primaryReplicationGroupId, "6.0", "6.2", "default.redis6.x"),
-				ExpectError: regexp.MustCompile(`cannot change parameter group name on minor engine version upgrade, upgrading from 6\.0\.[[:digit:]]+ to 6\.2\.[[:digit:]]+`),
+				ExpectError: regexache.MustCompile(`cannot change parameter group name on minor engine version upgrade, upgrading from 6\.0\.[[:digit:]]+ to 6\.2\.[[:digit:]]+`),
 			},
 		},
 	})
@@ -1150,14 +1154,14 @@ func TestAccElastiCacheGlobalReplicationGroup_SetEngineVersionOnUpdate_MinorUpgr
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckGlobalReplicationGroupExists(ctx, resourceName, &globalReplicationGroup),
 					resource.TestCheckResourceAttrPair(resourceName, "engine_version_actual", primaryReplicationGroupResourceName, "engine_version_actual"),
-					resource.TestMatchResourceAttr(resourceName, "engine_version_actual", regexp.MustCompile(`^6\.0\.[[:digit:]]+$`)),
+					resource.TestMatchResourceAttr(resourceName, "engine_version_actual", regexache.MustCompile(`^6\.0\.[[:digit:]]+$`)),
 				),
 			},
 			{
 				Config: testAccGlobalReplicationGroupConfig_engineVersion(rName, primaryReplicationGroupId, "6.0", "6.2"),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckGlobalReplicationGroupExists(ctx, resourceName, &globalReplicationGroup),
-					resource.TestMatchResourceAttr(resourceName, "engine_version_actual", regexp.MustCompile(`^6\.2\.[[:digit:]]+$`)),
+					resource.TestMatchResourceAttr(resourceName, "engine_version_actual", regexache.MustCompile(`^6\.2\.[[:digit:]]+$`)),
 				),
 			},
 		},
@@ -1187,7 +1191,7 @@ func TestAccElastiCacheGlobalReplicationGroup_SetEngineVersionOnUpdate_MinorUpgr
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckGlobalReplicationGroupExists(ctx, resourceName, &globalReplicationGroup),
 					resource.TestCheckResourceAttrPair(resourceName, "engine_version_actual", primaryReplicationGroupResourceName, "engine_version_actual"),
-					resource.TestMatchResourceAttr(resourceName, "engine_version_actual", regexp.MustCompile(`^6\.0\.[[:digit:]]+$`)),
+					resource.TestMatchResourceAttr(resourceName, "engine_version_actual", regexache.MustCompile(`^6\.0\.[[:digit:]]+$`)),
 				),
 			},
 			{
@@ -1221,12 +1225,12 @@ func TestAccElastiCacheGlobalReplicationGroup_SetEngineVersionOnUpdate_MinorDown
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckGlobalReplicationGroupExists(ctx, resourceName, &globalReplicationGroup),
 					resource.TestCheckResourceAttrPair(resourceName, "engine_version_actual", primaryReplicationGroupResourceName, "engine_version_actual"),
-					resource.TestMatchResourceAttr(resourceName, "engine_version_actual", regexp.MustCompile(`^6\.2\.[[:digit:]]+$`)),
+					resource.TestMatchResourceAttr(resourceName, "engine_version_actual", regexache.MustCompile(`^6\.2\.[[:digit:]]+$`)),
 				),
 			},
 			{
 				Config:      testAccGlobalReplicationGroupConfig_engineVersion(rName, primaryReplicationGroupId, "6.2", "6.0"),
-				ExpectError: regexp.MustCompile(`Downgrading ElastiCache Global Replication Group \(.*\) engine version requires replacement`),
+				ExpectError: regexache.MustCompile(`Downgrading ElastiCache Global Replication Group \(.*\) engine version requires replacement`),
 			},
 			// This step fails with: Error running pre-apply refresh
 			// {
@@ -1238,7 +1242,7 @@ func TestAccElastiCacheGlobalReplicationGroup_SetEngineVersionOnUpdate_MinorDown
 			// 	Check: resource.ComposeAggregateTestCheckFunc(
 			// 		testAccCheckGlobalReplicationGroupExists(resourceName, &globalReplicationGroup),
 			// 		resource.TestCheckResourceAttrPair(resourceName, "engine_version_actual", primaryReplicationGroupResourceName, "engine_version_actual"),
-			// 		resource.TestMatchResourceAttr(resourceName, "engine_version_actual", regexp.MustCompile(`^6\.0\.[[:digit:]]+$`)),
+			// 		resource.TestMatchResourceAttr(resourceName, "engine_version_actual", regexache.MustCompile(`^6\.0\.[[:digit:]]+$`)),
 			// 	),
 			// },
 		},
@@ -1280,7 +1284,7 @@ func TestAccElastiCacheGlobalReplicationGroup_SetEngineVersionOnUpdate_MajorUpgr
 				Config: testAccGlobalReplicationGroupConfig_engineVersionParam(rName, primaryReplicationGroupId, "5.0.6", "6.2", "default.redis6.x"),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckGlobalReplicationGroupExists(ctx, resourceName, &globalReplicationGroup),
-					resource.TestMatchResourceAttr(resourceName, "engine_version_actual", regexp.MustCompile(`^6\.2\.[[:digit:]]+$`)),
+					resource.TestMatchResourceAttr(resourceName, "engine_version_actual", regexache.MustCompile(`^6\.2\.[[:digit:]]+$`)),
 				),
 			},
 		},
@@ -1322,7 +1326,7 @@ func TestAccElastiCacheGlobalReplicationGroup_SetEngineVersionOnUpdate_MajorUpgr
 				Config: testAccGlobalReplicationGroupConfig_engineVersionParam(rName, primaryReplicationGroupId, "5.0.6", "6.x", "default.redis6.x"),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckGlobalReplicationGroupExists(ctx, resourceName, &globalReplicationGroup),
-					resource.TestMatchResourceAttr(resourceName, "engine_version_actual", regexp.MustCompile(`^6\.2\.[[:digit:]]+$`)),
+					resource.TestMatchResourceAttr(resourceName, "engine_version_actual", regexache.MustCompile(`^6\.2\.[[:digit:]]+$`)),
 				),
 			},
 		},
@@ -1352,12 +1356,12 @@ func TestAccElastiCacheGlobalReplicationGroup_SetParameterGroupOnUpdate_NoVersio
 				Config: testAccGlobalReplicationGroupConfig_engineVersionInherit(rName, primaryReplicationGroupId, "6.2"),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckGlobalReplicationGroupExists(ctx, resourceName, &globalReplicationGroup),
-					resource.TestMatchResourceAttr(resourceName, "engine_version_actual", regexp.MustCompile(`^6\.2\.[[:digit:]]+$`)),
+					resource.TestMatchResourceAttr(resourceName, "engine_version_actual", regexache.MustCompile(`^6\.2\.[[:digit:]]+$`)),
 				),
 			},
 			{
 				Config:      testAccGlobalReplicationGroupConfig_param(rName, primaryReplicationGroupId, "6.2", "default.redis6.x"),
-				ExpectError: regexp.MustCompile(`cannot change parameter group name without upgrading major engine version`),
+				ExpectError: regexache.MustCompile(`cannot change parameter group name without upgrading major engine version`),
 				PlanOnly:    true,
 			},
 		},
@@ -1387,12 +1391,12 @@ func TestAccElastiCacheGlobalReplicationGroup_SetParameterGroupOnUpdate_MinorUpg
 				Config: testAccGlobalReplicationGroupConfig_engineVersionInherit(rName, primaryReplicationGroupId, "6.0"),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckGlobalReplicationGroupExists(ctx, resourceName, &globalReplicationGroup),
-					resource.TestMatchResourceAttr(resourceName, "engine_version_actual", regexp.MustCompile(`^6\.0\.[[:digit:]]+$`)),
+					resource.TestMatchResourceAttr(resourceName, "engine_version_actual", regexache.MustCompile(`^6\.0\.[[:digit:]]+$`)),
 				),
 			},
 			{
 				Config:      testAccGlobalReplicationGroupConfig_engineVersionParam(rName, primaryReplicationGroupId, "6.0", "6.2", "default.redis6.x"),
-				ExpectError: regexp.MustCompile(`cannot change parameter group name on minor engine version upgrade, upgrading from 6\.0\.[[:digit:]]+ to 6\.2\.[[:digit:]]+`),
+				ExpectError: regexache.MustCompile(`cannot change parameter group name on minor engine version upgrade, upgrading from 6\.0\.[[:digit:]]+ to 6\.2\.[[:digit:]]+`),
 				PlanOnly:    true,
 			},
 		},
@@ -1423,12 +1427,12 @@ func TestAccElastiCacheGlobalReplicationGroup_UpdateParameterGroupName(t *testin
 				Config: testAccGlobalReplicationGroupConfig_engineVersionParam(rName, primaryReplicationGroupId, "5.0.6", "6.2", "default.redis6.x"),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckGlobalReplicationGroupExists(ctx, resourceName, &globalReplicationGroup),
-					resource.TestMatchResourceAttr(resourceName, "engine_version_actual", regexp.MustCompile(`^6\.2\.[[:digit:]]+$`)),
+					resource.TestMatchResourceAttr(resourceName, "engine_version_actual", regexache.MustCompile(`^6\.2\.[[:digit:]]+$`)),
 				),
 			},
 			{
 				Config:      testAccGlobalReplicationGroupConfig_engineVersionCustomParam(rName, primaryReplicationGroupId, "5.0.6", "6.2", parameterGroupName, "redis6.x"),
-				ExpectError: regexp.MustCompile(`cannot change parameter group name without upgrading major engine version`),
+				ExpectError: regexache.MustCompile(`cannot change parameter group name without upgrading major engine version`),
 				PlanOnly:    true,
 			},
 		},
diff --git a/internal/service/elasticache/parameter_group.go b/internal/service/elasticache/parameter_group.go
index e2e5733b05d..f1545bec927 100644
--- a/internal/service/elasticache/parameter_group.go
+++ b/internal/service/elasticache/parameter_group.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elasticache
 
 import (
@@ -31,32 +34,34 @@ func ResourceParameterGroup() *schema.Resource {
 		ReadWithoutTimeout:   resourceParameterGroupRead,
 		UpdateWithoutTimeout: resourceParameterGroupUpdate,
 		DeleteWithoutTimeout: resourceParameterGroupDelete,
+
 		Importer: &schema.ResourceImporter{
 			StateContext: schema.ImportStatePassthroughContext,
 		},
+
 		Schema: map[string]*schema.Schema{
-			"name": {
+			"arn": {
 				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"description": {
+				Type:     schema.TypeString,
+				Optional: true,
 				ForceNew: true,
-				Required: true,
-				StateFunc: func(val interface{}) string {
-					return strings.ToLower(val.(string))
-				},
+				Default:  "Managed by Terraform",
 			},
 			"family": {
 				Type:     schema.TypeString,
 				Required: true,
 				ForceNew: true,
 			},
-			"description": {
+			"name": {
 				Type:     schema.TypeString,
-				Optional: true,
 				ForceNew: true,
-				Default:  "Managed by Terraform",
-			},
-			"arn": {
-				Type:     schema.TypeString,
-				Computed: true,
+				Required: true,
+				StateFunc: func(val interface{}) string {
+					return strings.ToLower(val.(string))
+				},
 			},
 			"parameter": {
 				Type:     schema.TypeSet,
@@ -78,6 +83,7 @@ func ResourceParameterGroup() *schema.Resource {
 			names.AttrTags:    tftags.TagsSchema(),
 			names.AttrTagsAll: tftags.TagsSchemaComputed(),
 		},
+
 		CustomizeDiff: verify.SetTagsDiff,
 	}
 }
@@ -86,29 +92,29 @@ func resourceParameterGroupCreate(ctx context.Context, d *schema.ResourceData, m
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).ElastiCacheConn(ctx)
 
-	input := elasticache.CreateCacheParameterGroupInput{
-		CacheParameterGroupName:   aws.String(d.Get("name").(string)),
+	name := d.Get("name").(string)
+	input := &elasticache.CreateCacheParameterGroupInput{
+		CacheParameterGroupName:   aws.String(name),
 		CacheParameterGroupFamily: aws.String(d.Get("family").(string)),
 		Description:               aws.String(d.Get("description").(string)),
 		Tags:                      getTagsIn(ctx),
 	}
 
-	resp, err := conn.CreateCacheParameterGroupWithContext(ctx, &input)
+	output, err := conn.CreateCacheParameterGroupWithContext(ctx, input)
 
 	if input.Tags != nil && verify.ErrorISOUnsupported(conn.PartitionID, err) {
 		log.Printf("[WARN] failed creating ElastiCache Parameter Group with tags: %s. Trying create without tags.", err)
 
 		input.Tags = nil
-		resp, err = conn.CreateCacheParameterGroupWithContext(ctx, &input)
+		output, err = conn.CreateCacheParameterGroupWithContext(ctx, input)
 	}
 
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "creating ElastiCache Parameter Group: %s", err)
+		return sdkdiag.AppendErrorf(diags, "creating ElastiCache Parameter Group (%s): %s", name, err)
 	}
 
-	d.SetId(aws.StringValue(resp.CacheParameterGroup.CacheParameterGroupName))
-	d.Set("arn", resp.CacheParameterGroup.ARN)
-	log.Printf("[INFO] ElastiCache Parameter Group ID: %s", d.Id())
+	d.SetId(aws.StringValue(output.CacheParameterGroup.CacheParameterGroupName))
+	d.Set("arn", output.CacheParameterGroup.ARN)
 
 	return append(diags, resourceParameterGroupUpdate(ctx, d, meta)...)
 }
@@ -118,27 +124,35 @@ func resourceParameterGroupRead(ctx context.Context, d *schema.ResourceData, met
 	conn := meta.(*conns.AWSClient).ElastiCacheConn(ctx)
 
 	parameterGroup, err := FindParameterGroupByName(ctx, conn, d.Id())
+
+	if !d.IsNewResource() && tfresource.NotFound(err) {
+		log.Printf("[WARN] ElastiCache Parameter Group (%s) not found, removing from state", d.Id())
+		d.SetId("")
+		return diags
+	}
+
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "unable to find ElastiCache Parameter Group (%s): %s", d.Id(), err)
+		return sdkdiag.AppendErrorf(diags, "reading ElastiCache Parameter Group (%s): %s", d.Id(), err)
 	}
 
-	d.Set("name", parameterGroup.CacheParameterGroupName)
-	d.Set("family", parameterGroup.CacheParameterGroupFamily)
-	d.Set("description", parameterGroup.Description)
 	d.Set("arn", parameterGroup.ARN)
+	d.Set("description", parameterGroup.Description)
+	d.Set("family", parameterGroup.CacheParameterGroupFamily)
+	d.Set("name", parameterGroup.CacheParameterGroupName)
 
-	// Only include user customized parameters as there's hundreds of system/default ones
-	describeParametersOpts := elasticache.DescribeCacheParametersInput{
+	// Only include user customized parameters as there's hundreds of system/default ones.
+	input := &elasticache.DescribeCacheParametersInput{
 		CacheParameterGroupName: aws.String(d.Id()),
 		Source:                  aws.String("user"),
 	}
 
-	describeParametersResp, err := conn.DescribeCacheParametersWithContext(ctx, &describeParametersOpts)
+	output, err := conn.DescribeCacheParametersWithContext(ctx, input)
+
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "reading ElastiCache Parameter Group (%s): %s", d.Id(), err)
+		return sdkdiag.AppendErrorf(diags, "reading ElastiCache Parameter Group (%s) parameters: %s", d.Id(), err)
 	}
 
-	d.Set("parameter", FlattenParameters(describeParametersResp.Parameters))
+	d.Set("parameter", FlattenParameters(output.Parameters))
 
 	return diags
 }
diff --git a/internal/service/elasticache/parameter_group_test.go b/internal/service/elasticache/parameter_group_test.go
index 88b3c3aa6ac..b4b0e93762c 100644
--- a/internal/service/elasticache/parameter_group_test.go
+++ b/internal/service/elasticache/parameter_group_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elasticache_test
 
 import (
@@ -8,7 +11,6 @@ import (
 
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/elasticache"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -16,13 +18,14 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	tfelasticache "github.com/hashicorp/terraform-provider-aws/internal/service/elasticache"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
 func TestAccElastiCacheParameterGroup_basic(t *testing.T) {
 	ctx := acctest.Context(t)
 	var v elasticache.CacheParameterGroup
 	resourceName := "aws_elasticache_parameter_group.test"
-	rName := fmt.Sprintf("parameter-group-test-terraform-%d", sdkacctest.RandInt())
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
@@ -50,11 +53,35 @@ func TestAccElastiCacheParameterGroup_basic(t *testing.T) {
 	})
 }
 
+func TestAccElastiCacheParameterGroup_disappears(t *testing.T) {
+	ctx := acctest.Context(t)
+	var v elasticache.CacheParameterGroup
+	resourceName := "aws_elasticache_parameter_group.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, elasticache.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckParameterGroupDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccParameterGroupConfig_basic(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckParameterGroupExists(ctx, resourceName, &v),
+					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfelasticache.ResourceParameterGroup(), resourceName),
+				),
+				ExpectNonEmptyPlan: true,
+			},
+		},
+	})
+}
+
 func TestAccElastiCacheParameterGroup_addParameter(t *testing.T) {
 	ctx := acctest.Context(t)
 	var v elasticache.CacheParameterGroup
 	resourceName := "aws_elasticache_parameter_group.test"
-	rName := fmt.Sprintf("parameter-group-test-terraform-%d", sdkacctest.RandInt())
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
@@ -102,7 +129,7 @@ func TestAccElastiCacheParameterGroup_removeAllParameters(t *testing.T) {
 	ctx := acctest.Context(t)
 	var v elasticache.CacheParameterGroup
 	resourceName := "aws_elasticache_parameter_group.test"
-	rName := fmt.Sprintf("parameter-group-test-terraform-%d", sdkacctest.RandInt())
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
@@ -142,7 +169,7 @@ func TestAccElastiCacheParameterGroup_RemoveReservedMemoryParameter_allParameter
 	ctx := acctest.Context(t)
 	var cacheParameterGroup1 elasticache.CacheParameterGroup
 	resourceName := "aws_elasticache_parameter_group.test"
-	rName := fmt.Sprintf("parameter-group-test-terraform-%d", sdkacctest.RandInt())
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
@@ -183,7 +210,7 @@ func TestAccElastiCacheParameterGroup_RemoveReservedMemoryParameter_remainingPar
 	ctx := acctest.Context(t)
 	var cacheParameterGroup1 elasticache.CacheParameterGroup
 	resourceName := "aws_elasticache_parameter_group.test"
-	rName := fmt.Sprintf("parameter-group-test-terraform-%d", sdkacctest.RandInt())
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
@@ -232,7 +259,7 @@ func TestAccElastiCacheParameterGroup_switchReservedMemoryParameter(t *testing.T
 	ctx := acctest.Context(t)
 	var cacheParameterGroup1 elasticache.CacheParameterGroup
 	resourceName := "aws_elasticache_parameter_group.test"
-	rName := fmt.Sprintf("parameter-group-test-terraform-%d", sdkacctest.RandInt())
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
@@ -277,7 +304,7 @@ func TestAccElastiCacheParameterGroup_updateReservedMemoryParameter(t *testing.T
 	ctx := acctest.Context(t)
 	var cacheParameterGroup1 elasticache.CacheParameterGroup
 	resourceName := "aws_elasticache_parameter_group.test"
-	rName := fmt.Sprintf("parameter-group-test-terraform-%d", sdkacctest.RandInt())
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
@@ -349,7 +376,7 @@ func TestAccElastiCacheParameterGroup_description(t *testing.T) {
 	ctx := acctest.Context(t)
 	var v elasticache.CacheParameterGroup
 	resourceName := "aws_elasticache_parameter_group.test"
-	rName := fmt.Sprintf("parameter-group-test-terraform-%d", sdkacctest.RandInt())
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
@@ -377,7 +404,7 @@ func TestAccElastiCacheParameterGroup_tags(t *testing.T) {
 	ctx := acctest.Context(t)
 	var cacheParameterGroup1 elasticache.CacheParameterGroup
 	resourceName := "aws_elasticache_parameter_group.test"
-	rName := fmt.Sprintf("parameter-group-test-terraform-%d", sdkacctest.RandInt())
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
@@ -427,37 +454,17 @@ func testAccCheckParameterGroupDestroy(ctx context.Context) resource.TestCheckFu
 				continue
 			}
 
-			resp, err := conn.DescribeCacheParameterGroupsWithContext(ctx, &elasticache.DescribeCacheParameterGroupsInput{
-				CacheParameterGroupName: aws.String(rs.Primary.ID),
-			})
+			_, err := tfelasticache.FindParameterGroupByName(ctx, conn, rs.Primary.ID)
 
-			if err == nil {
-				if len(resp.CacheParameterGroups) != 0 &&
-					*resp.CacheParameterGroups[0].CacheParameterGroupName == rs.Primary.ID {
-					return fmt.Errorf("Cache Parameter Group still exists")
-				}
+			if tfresource.NotFound(err) {
+				continue
 			}
 
-			if tfawserr.ErrCodeEquals(err, elasticache.ErrCodeCacheParameterGroupNotFoundFault) {
-				return nil
-			}
 			if err != nil {
 				return err
 			}
-		}
-
-		return nil
-	}
-}
-
-func testAccCheckParameterGroupAttributes(v *elasticache.CacheParameterGroup, rName string) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		if *v.CacheParameterGroupName != rName {
-			return fmt.Errorf("bad name: %#v", v.CacheParameterGroupName)
-		}
 
-		if *v.CacheParameterGroupFamily != "redis2.8" {
-			return fmt.Errorf("bad family: %#v", v.CacheParameterGroupFamily)
+			return fmt.Errorf("ElastiCache Parameter Group %s still exists", rs.Primary.ID)
 		}
 
 		return nil
@@ -472,27 +479,32 @@ func testAccCheckParameterGroupExists(ctx context.Context, n string, v *elastica
 		}
 
 		if rs.Primary.ID == "" {
-			return fmt.Errorf("No Cache Parameter Group ID is set")
+			return fmt.Errorf("No ElastiCache Parameter Group ID is set")
 		}
 
 		conn := acctest.Provider.Meta().(*conns.AWSClient).ElastiCacheConn(ctx)
 
-		opts := elasticache.DescribeCacheParameterGroupsInput{
-			CacheParameterGroupName: aws.String(rs.Primary.ID),
-		}
-
-		resp, err := conn.DescribeCacheParameterGroupsWithContext(ctx, &opts)
+		output, err := tfelasticache.FindParameterGroupByName(ctx, conn, rs.Primary.ID)
 
 		if err != nil {
 			return err
 		}
 
-		if len(resp.CacheParameterGroups) != 1 ||
-			*resp.CacheParameterGroups[0].CacheParameterGroupName != rs.Primary.ID {
-			return fmt.Errorf("Cache Parameter Group not found")
+		*v = *output
+
+		return nil
+	}
+}
+
+func testAccCheckParameterGroupAttributes(v *elasticache.CacheParameterGroup, rName string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		if *v.CacheParameterGroupName != rName {
+			return fmt.Errorf("bad name: %#v", v.CacheParameterGroupName)
 		}
 
-		*v = *resp.CacheParameterGroups[0]
+		if *v.CacheParameterGroupFamily != "redis2.8" {
+			return fmt.Errorf("bad family: %#v", v.CacheParameterGroupFamily)
+		}
 
 		return nil
 	}
@@ -502,7 +514,7 @@ func testAccParameterGroupConfig_basic(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_elasticache_parameter_group" "test" {
   family = "redis2.8"
-  name   = %q
+  name   = %[1]q
 }
 `, rName)
 }
@@ -510,9 +522,9 @@ resource "aws_elasticache_parameter_group" "test" {
 func testAccParameterGroupConfig_description(rName, description string) string {
 	return fmt.Sprintf(`
 resource "aws_elasticache_parameter_group" "test" {
-  description = %q
+  description = %[1]q
   family      = "redis2.8"
-  name        = %q
+  name        = %[2]q
 }
 `, description, rName)
 }
@@ -520,12 +532,12 @@ resource "aws_elasticache_parameter_group" "test" {
 func testAccParameterGroupConfig_1(rName, family, parameterName1, parameterValue1 string) string {
 	return fmt.Sprintf(`
 resource "aws_elasticache_parameter_group" "test" {
-  family = %q
-  name   = %q
+  family = %[1]q
+  name   = %[2]q
 
   parameter {
-    name  = %q
-    value = %q
+    name  = %[3]q
+    value = %[4]q
   }
 }
 `, family, rName, parameterName1, parameterValue1)
@@ -534,17 +546,17 @@ resource "aws_elasticache_parameter_group" "test" {
 func testAccParameterGroupConfig_2(rName, family, parameterName1, parameterValue1, parameterName2, parameterValue2 string) string {
 	return fmt.Sprintf(`
 resource "aws_elasticache_parameter_group" "test" {
-  family = %q
-  name   = %q
+  family = %[1]q
+  name   = %[2]q
 
   parameter {
-    name  = %q
-    value = %q
+    name  = %[3]q
+    value = %[4]q
   }
 
   parameter {
-    name  = %q
-    value = %q
+    name  = %[5]q
+    value = %[6]q
   }
 }
 `, family, rName, parameterName1, parameterValue1, parameterName2, parameterValue2)
diff --git a/internal/service/elasticache/replication_group.go b/internal/service/elasticache/replication_group.go
index 00b47762b67..bde210b0dea 100644
--- a/internal/service/elasticache/replication_group.go
+++ b/internal/service/elasticache/replication_group.go
@@ -1,13 +1,16 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elasticache
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"strings"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/elasticache"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -20,10 +23,10 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
-	"github.com/hashicorp/terraform-provider-aws/internal/experimental/nullable"
 	"github.com/hashicorp/terraform-provider-aws/internal/flex"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/internal/types/nullable"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -131,6 +134,12 @@ func ResourceReplicationGroup() *schema.Resource {
 					"snapshot_name",
 				},
 			},
+			"ip_discovery": {
+				Type:         schema.TypeString,
+				Optional:     true,
+				Computed:     true,
+				ValidateFunc: validation.StringInSlice(elasticache.IpDiscovery_Values(), false),
+			},
 			"log_delivery_configuration": {
 				Type:     schema.TypeSet,
 				Optional: true,
@@ -180,6 +189,13 @@ func ResourceReplicationGroup() *schema.Resource {
 				Optional: true,
 				Default:  false,
 			},
+			"network_type": {
+				Type:         schema.TypeString,
+				Optional:     true,
+				Computed:     true,
+				ForceNew:     true,
+				ValidateFunc: validation.StringInSlice(elasticache.NetworkType_Values(), false),
+			},
 			"node_type": {
 				Type:     schema.TypeString,
 				Optional: true,
@@ -402,6 +418,14 @@ func resourceReplicationGroupCreate(ctx context.Context, d *schema.ResourceData,
 		input.CacheParameterGroupName = aws.String(v.(string))
 	}
 
+	if v, ok := d.GetOk("ip_discovery"); ok {
+		input.IpDiscovery = aws.String(v.(string))
+	}
+
+	if v, ok := d.GetOk("network_type"); ok {
+		input.NetworkType = aws.String(v.(string))
+	}
+
 	if v, ok := d.GetOk("port"); ok {
 		input.Port = aws.Int64(int64(v.(int)))
 	}
@@ -594,6 +618,9 @@ func resourceReplicationGroupRead(ctx context.Context, d *schema.ResourceData, m
 	d.Set("arn", rgp.ARN)
 	d.Set("data_tiering_enabled", aws.StringValue(rgp.DataTiering) == elasticache.DataTieringStatusEnabled)
 
+	d.Set("ip_discovery", rgp.IpDiscovery)
+	d.Set("network_type", rgp.NetworkType)
+
 	d.Set("log_delivery_configuration", flattenLogDeliveryConfigurations(rgp.LogDeliveryConfigurations))
 	d.Set("snapshot_window", rgp.SnapshotWindow)
 	d.Set("snapshot_retention_limit", rgp.SnapshotRetentionLimit)
@@ -691,6 +718,16 @@ func resourceReplicationGroupUpdate(ctx context.Context, d *schema.ResourceData,
 			requestUpdate = true
 		}
 
+		if d.HasChange("ip_discovery") {
+			input.IpDiscovery = aws.String(d.Get("ip_discovery").(string))
+			requestUpdate = true
+		}
+
+		if d.HasChange("network_type") {
+			input.IpDiscovery = aws.String(d.Get("network_type").(string))
+			requestUpdate = true
+		}
+
 		if d.HasChange("automatic_failover_enabled") {
 			input.AutomaticFailoverEnabled = aws.Bool(d.Get("automatic_failover_enabled").(bool))
 			requestUpdate = true
@@ -1104,8 +1141,8 @@ func decreaseReplicationGroupNumCacheClusters(ctx context.Context, conn *elastic
 
 var validateReplicationGroupID schema.SchemaValidateFunc = validation.All(
 	validation.StringLenBetween(1, 40),
-	validation.StringMatch(regexp.MustCompile(`^[0-9a-zA-Z-]+$`), "must contain only alphanumeric characters and hyphens"),
-	validation.StringMatch(regexp.MustCompile(`^[a-zA-Z]`), "must begin with a letter"),
-	validation.StringDoesNotMatch(regexp.MustCompile(`--`), "cannot contain two consecutive hyphens"),
-	validation.StringDoesNotMatch(regexp.MustCompile(`-$`), "cannot end with a hyphen"),
+	validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z-]+$`), "must contain only alphanumeric characters and hyphens"),
+	validation.StringMatch(regexache.MustCompile(`^[A-Za-z]`), "must begin with a letter"),
+	validation.StringDoesNotMatch(regexache.MustCompile(`--`), "cannot contain two consecutive hyphens"),
+	validation.StringDoesNotMatch(regexache.MustCompile(`-$`), "cannot end with a hyphen"),
 )
diff --git a/internal/service/elasticache/replication_group_data_source.go b/internal/service/elasticache/replication_group_data_source.go
index 116387565c0..90bf3b8c4a9 100644
--- a/internal/service/elasticache/replication_group_data_source.go
+++ b/internal/service/elasticache/replication_group_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elasticache
 
 import (
diff --git a/internal/service/elasticache/replication_group_data_source_test.go b/internal/service/elasticache/replication_group_data_source_test.go
index 3706a3fdd72..09583191b24 100644
--- a/internal/service/elasticache/replication_group_data_source_test.go
+++ b/internal/service/elasticache/replication_group_data_source_test.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elasticache_test
 
 import (
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/elasticache"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -117,7 +120,7 @@ func TestAccElastiCacheReplicationGroupDataSource_nonExistent(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccReplicationGroupDataSourceConfig_nonExistent,
-				ExpectError: regexp.MustCompile(`couldn't find resource`),
+				ExpectError: regexache.MustCompile(`couldn't find resource`),
 			},
 		},
 	})
diff --git a/internal/service/elasticache/replication_group_test.go b/internal/service/elasticache/replication_group_test.go
index dc483cace31..e79c6c9a4d9 100644
--- a/internal/service/elasticache/replication_group_test.go
+++ b/internal/service/elasticache/replication_group_test.go
@@ -1,15 +1,18 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elasticache_test
 
 import (
 	"context"
 	"errors"
 	"fmt"
-	"regexp"
 	"strconv"
 	"strings"
 	"testing"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/elasticache"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -157,7 +160,7 @@ func TestAccElastiCacheReplicationGroup_EngineVersion_v7(t *testing.T) {
 					testAccCheckReplicationGroupExists(ctx, resourceName, &rg),
 					resource.TestCheckResourceAttr(resourceName, "engine", "redis"),
 					resource.TestCheckResourceAttr(resourceName, "engine_version", "7.0"),
-					resource.TestMatchResourceAttr(resourceName, "engine_version_actual", regexp.MustCompile(`^7\.[[:digit:]]+\.[[:digit:]]+$`)),
+					resource.TestMatchResourceAttr(resourceName, "engine_version_actual", regexache.MustCompile(`^7\.[[:digit:]]+\.[[:digit:]]+$`)),
 				),
 			},
 			{
@@ -176,7 +179,7 @@ func TestAccElastiCacheReplicationGroup_EngineVersion_update(t *testing.T) {
 		t.Skip("skipping long-running test in short mode")
 	}
 
-	var v1, v2, v3, v4, v5, v6, v7, v8 elasticache.ReplicationGroup
+	var v1, v2, v3, v4, v5, v6 elasticache.ReplicationGroup
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_elasticache_replication_group.test"
 
@@ -187,86 +190,101 @@ func TestAccElastiCacheReplicationGroup_EngineVersion_update(t *testing.T) {
 		CheckDestroy:             testAccCheckReplicationGroupDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccReplicationGroupConfig_engineVersion(rName, "3.2.6"),
+				Config: testAccReplicationGroupConfig_engineVersion(rName, "4.0.10"),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckReplicationGroupExists(ctx, resourceName, &v1),
-					resource.TestCheckResourceAttr(resourceName, "engine_version", "3.2.6"),
-					resource.TestCheckResourceAttr(resourceName, "engine_version_actual", "3.2.6"),
+					resource.TestCheckResourceAttr(resourceName, "engine_version", "4.0.10"),
+					resource.TestCheckResourceAttr(resourceName, "engine_version_actual", "4.0.10"),
 				),
 			},
 			{
-				ResourceName:            resourceName,
-				ImportState:             true,
-				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"apply_immediately"},
-			},
-			{
-				Config: testAccReplicationGroupConfig_engineVersion(rName, "3.2.4"),
+				Config: testAccReplicationGroupConfig_engineVersion(rName, "6.0"),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckReplicationGroupExists(ctx, resourceName, &v2),
-					testAccCheckReplicationGroupRecreated(&v1, &v2),
-					resource.TestCheckResourceAttr(resourceName, "engine_version", "3.2.4"),
-					resource.TestCheckResourceAttr(resourceName, "engine_version_actual", "3.2.4"),
+					testAccCheckReplicationGroupNotRecreated(&v1, &v2),
+					resource.TestCheckResourceAttr(resourceName, "engine_version", "6.0"),
+					resource.TestMatchResourceAttr(resourceName, "engine_version_actual", regexache.MustCompile(`^6\.0\.[[:digit:]]+$`)),
 				),
 			},
 			{
-				Config: testAccReplicationGroupConfig_engineVersion(rName, "3.2.10"),
+				Config: testAccReplicationGroupConfig_engineVersion(rName, "6.2"),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckReplicationGroupExists(ctx, resourceName, &v3),
 					testAccCheckReplicationGroupNotRecreated(&v2, &v3),
-					resource.TestCheckResourceAttr(resourceName, "engine_version", "3.2.10"),
-					resource.TestCheckResourceAttr(resourceName, "engine_version_actual", "3.2.10"),
+					resource.TestCheckResourceAttr(resourceName, "engine_version", "6.2"),
+					resource.TestMatchResourceAttr(resourceName, "engine_version_actual", regexache.MustCompile(`^6\.2\.[[:digit:]]+$`)),
 				),
 			},
 			{
-				Config: testAccReplicationGroupConfig_engineVersion(rName, "6.0"),
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"apply_immediately"},
+			},
+			{
+				Config: testAccReplicationGroupConfig_engineVersion(rName, "5.0.6"),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckReplicationGroupExists(ctx, resourceName, &v4),
-					testAccCheckReplicationGroupNotRecreated(&v3, &v4),
-					resource.TestCheckResourceAttr(resourceName, "engine_version", "6.0"),
-					resource.TestMatchResourceAttr(resourceName, "engine_version_actual", regexp.MustCompile(`^6\.0\.[[:digit:]]+$`)),
+					testAccCheckReplicationGroupRecreated(&v3, &v4),
+					resource.TestCheckResourceAttr(resourceName, "engine_version", "5.0.6"),
+					resource.TestCheckResourceAttr(resourceName, "engine_version_actual", "5.0.6"),
 				),
 			},
 			{
-				Config: testAccReplicationGroupConfig_engineVersion(rName, "6.2"),
+				Config: testAccReplicationGroupConfig_engineVersion(rName, "6.x"),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckReplicationGroupExists(ctx, resourceName, &v5),
 					testAccCheckReplicationGroupNotRecreated(&v4, &v5),
-					resource.TestCheckResourceAttr(resourceName, "engine_version", "6.2"),
-					resource.TestMatchResourceAttr(resourceName, "engine_version_actual", regexp.MustCompile(`^6\.2\.[[:digit:]]+$`)),
+					resource.TestCheckResourceAttr(resourceName, "engine_version", "6.x"),
+					resource.TestMatchResourceAttr(resourceName, "engine_version_actual", regexache.MustCompile(`^6\.[[:digit:]]+\.[[:digit:]]+$`)),
 				),
 			},
 			{
-				ResourceName:            resourceName,
-				ImportState:             true,
-				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"apply_immediately"},
-			},
-			{
-				Config: testAccReplicationGroupConfig_engineVersion(rName, "5.0.6"),
+				Config: testAccReplicationGroupConfig_engineVersion(rName, "6.0"),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckReplicationGroupExists(ctx, resourceName, &v6),
 					testAccCheckReplicationGroupRecreated(&v5, &v6),
-					resource.TestCheckResourceAttr(resourceName, "engine_version", "5.0.6"),
-					resource.TestCheckResourceAttr(resourceName, "engine_version_actual", "5.0.6"),
+					resource.TestCheckResourceAttr(resourceName, "engine_version", "6.0"),
+					resource.TestMatchResourceAttr(resourceName, "engine_version_actual", regexache.MustCompile(`^6\.0\.[[:digit:]]+$`)),
 				),
 			},
+		},
+	})
+}
+
+func TestAccElastiCacheReplicationGroup_EngineVersion_6xToRealVersion(t *testing.T) {
+	ctx := acctest.Context(t)
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
+	var v1, v2 elasticache.ReplicationGroup
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_elasticache_replication_group.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, elasticache.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckReplicationGroupDestroy(ctx),
+		Steps: []resource.TestStep{
 			{
 				Config: testAccReplicationGroupConfig_engineVersion(rName, "6.x"),
 				Check: resource.ComposeAggregateTestCheckFunc(
-					testAccCheckReplicationGroupExists(ctx, resourceName, &v7),
-					testAccCheckReplicationGroupNotRecreated(&v6, &v7),
+					testAccCheckReplicationGroupExists(ctx, resourceName, &v1),
 					resource.TestCheckResourceAttr(resourceName, "engine_version", "6.x"),
-					resource.TestMatchResourceAttr(resourceName, "engine_version_actual", regexp.MustCompile(`^6\.[[:digit:]]+\.[[:digit:]]+$`)),
+					resource.TestMatchResourceAttr(resourceName, "engine_version_actual", regexache.MustCompile(`^6\.[[:digit:]]+\.[[:digit:]]+$`)),
 				),
 			},
 			{
-				Config: testAccReplicationGroupConfig_engineVersion(rName, "6.0"),
+				// TODO: This will break if there's a Redis 6.x version higher than 6.2.
+				// If we create an `aws_elasticache_engine_versions` data source, we can use that to get the expected version
+				Config: testAccReplicationGroupConfig_engineVersion(rName, "6.2"),
 				Check: resource.ComposeAggregateTestCheckFunc(
-					testAccCheckReplicationGroupExists(ctx, resourceName, &v8),
-					testAccCheckReplicationGroupRecreated(&v7, &v8),
-					resource.TestCheckResourceAttr(resourceName, "engine_version", "6.0"),
-					resource.TestMatchResourceAttr(resourceName, "engine_version_actual", regexp.MustCompile(`^6\.0\.[[:digit:]]+$`)),
+					testAccCheckReplicationGroupExists(ctx, resourceName, &v2),
+					testAccCheckReplicationGroupNotRecreated(&v1, &v2),
+					resource.TestCheckResourceAttr(resourceName, "engine_version", "6.2"),
+					resource.TestMatchResourceAttr(resourceName, "engine_version_actual", regexache.MustCompile(`^6\.2\.[[:digit:]]+$`)),
 				),
 			},
 		},
@@ -693,11 +711,11 @@ func TestAccElastiCacheReplicationGroup_multiAzInVPC(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "snapshot_retention_limit", "7"),
 					resource.TestCheckResourceAttrSet(resourceName, "primary_endpoint_address"),
 					func(s *terraform.State) error {
-						return resource.TestMatchResourceAttr(resourceName, "primary_endpoint_address", regexp.MustCompile(fmt.Sprintf("%s\\..+\\.%s", aws.StringValue(rg.ReplicationGroupId), acctest.PartitionDNSSuffix())))(s)
+						return resource.TestMatchResourceAttr(resourceName, "primary_endpoint_address", regexache.MustCompile(fmt.Sprintf("%s\\..+\\.%s", aws.StringValue(rg.ReplicationGroupId), acctest.PartitionDNSSuffix())))(s)
 					},
 					resource.TestCheckResourceAttrSet(resourceName, "reader_endpoint_address"),
 					func(s *terraform.State) error {
-						return resource.TestMatchResourceAttr(resourceName, "reader_endpoint_address", regexp.MustCompile(fmt.Sprintf("%s-ro\\..+\\.%s", aws.StringValue(rg.ReplicationGroupId), acctest.PartitionDNSSuffix())))(s)
+						return resource.TestMatchResourceAttr(resourceName, "reader_endpoint_address", regexache.MustCompile(fmt.Sprintf("%s-ro\\..+\\.%s", aws.StringValue(rg.ReplicationGroupId), acctest.PartitionDNSSuffix())))(s)
 					},
 				),
 			},
@@ -738,11 +756,11 @@ func TestAccElastiCacheReplicationGroup_deprecatedAvailabilityZones_multiAzInVPC
 					resource.TestCheckResourceAttr(resourceName, "snapshot_retention_limit", "7"),
 					resource.TestCheckResourceAttrSet(resourceName, "primary_endpoint_address"),
 					func(s *terraform.State) error {
-						return resource.TestMatchResourceAttr(resourceName, "primary_endpoint_address", regexp.MustCompile(fmt.Sprintf("%s\\..+\\.%s", aws.StringValue(rg.ReplicationGroupId), acctest.PartitionDNSSuffix())))(s)
+						return resource.TestMatchResourceAttr(resourceName, "primary_endpoint_address", regexache.MustCompile(fmt.Sprintf("%s\\..+\\.%s", aws.StringValue(rg.ReplicationGroupId), acctest.PartitionDNSSuffix())))(s)
 					},
 					resource.TestCheckResourceAttrSet(resourceName, "reader_endpoint_address"),
 					func(s *terraform.State) error {
-						return resource.TestMatchResourceAttr(resourceName, "reader_endpoint_address", regexp.MustCompile(fmt.Sprintf("%s-ro\\..+\\.%s", aws.StringValue(rg.ReplicationGroupId), acctest.PartitionDNSSuffix())))(s)
+						return resource.TestMatchResourceAttr(resourceName, "reader_endpoint_address", regexache.MustCompile(fmt.Sprintf("%s-ro\\..+\\.%s", aws.StringValue(rg.ReplicationGroupId), acctest.PartitionDNSSuffix())))(s)
 					},
 				),
 			},
@@ -768,7 +786,90 @@ func TestAccElastiCacheReplicationGroup_ValidationMultiAz_noAutomaticFailover(t
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccReplicationGroupConfig_multiAZNoAutomaticFailover(rName),
-				ExpectError: regexp.MustCompile("automatic_failover_enabled must be true if multi_az_enabled is true"),
+				ExpectError: regexache.MustCompile("automatic_failover_enabled must be true if multi_az_enabled is true"),
+			},
+		},
+	})
+}
+
+func TestAccElastiCacheReplicationGroup_ipDiscovery(t *testing.T) {
+	ctx := acctest.Context(t)
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
+	var rg elasticache.ReplicationGroup
+	resourceName := "aws_elasticache_replication_group.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, elasticache.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckReplicationGroupDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccReplicationGroupConfig_ipDiscovery(rName, "ipv6"),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckReplicationGroupExists(ctx, resourceName, &rg),
+					resource.TestCheckResourceAttr(resourceName, "cluster_enabled", "true"),
+					resource.TestCheckResourceAttr(resourceName, "port", "6379"),
+					resource.TestCheckResourceAttr(resourceName, "node_type", "cache.t3.small"),
+					resource.TestCheckResourceAttr(resourceName, "num_node_groups", "2"),
+					resource.TestCheckResourceAttr(resourceName, "replicas_per_node_group", "1"),
+					resource.TestCheckResourceAttr(resourceName, "num_cache_clusters", "4"),
+					resource.TestCheckResourceAttr(resourceName, "parameter_group_name", "default.redis7.cluster.on"),
+					resource.TestCheckResourceAttr(resourceName, "automatic_failover_enabled", "true"),
+					resource.TestCheckResourceAttr(resourceName, "ip_discovery", "ipv6"),
+				),
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"apply_immediately", "preferred_cache_cluster_azs"},
+			},
+		},
+	})
+}
+
+func TestAccElastiCacheReplicationGroup_networkType(t *testing.T) {
+	ctx := acctest.Context(t)
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
+	var rg elasticache.ReplicationGroup
+	resourceName := "aws_elasticache_replication_group.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, elasticache.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckReplicationGroupDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccReplicationGroupConfig_networkType(rName, "ipv6", "dual_stack"),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckReplicationGroupExists(ctx, resourceName, &rg),
+					resource.TestCheckResourceAttr(resourceName, "cluster_enabled", "true"),
+					resource.TestCheckResourceAttr(resourceName, "port", "6379"),
+					resource.TestCheckResourceAttr(resourceName, "node_type", "cache.t3.small"),
+					resource.TestCheckResourceAttr(resourceName, "num_node_groups", "2"),
+					resource.TestCheckResourceAttr(resourceName, "replicas_per_node_group", "1"),
+					resource.TestCheckResourceAttr(resourceName, "num_cache_clusters", "4"),
+					resource.TestCheckResourceAttr(resourceName, "parameter_group_name", "default.redis7.cluster.on"),
+					resource.TestCheckResourceAttr(resourceName, "automatic_failover_enabled", "true"),
+					resource.TestCheckResourceAttr(resourceName, "ip_discovery", "ipv6"),
+					resource.TestCheckResourceAttr(resourceName, "network_type", "dual_stack"),
+				),
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"apply_immediately", "preferred_cache_cluster_azs"},
 			},
 		},
 	})
@@ -840,7 +941,7 @@ func TestAccElastiCacheReplicationGroup_ClusterMode_nonClusteredParameterGroup(t
 					resource.TestCheckResourceAttr(resourceName, "parameter_group_name", "default.redis6.x"),
 					resource.TestCheckResourceAttr(resourceName, "num_node_groups", "1"),
 					resource.TestCheckResourceAttr(resourceName, "replicas_per_node_group", "1"),
-					resource.TestMatchResourceAttr(resourceName, "primary_endpoint_address", regexp.MustCompile(fmt.Sprintf("%s\\..+\\.%s", rName, acctest.PartitionDNSSuffix()))),
+					resource.TestMatchResourceAttr(resourceName, "primary_endpoint_address", regexache.MustCompile(fmt.Sprintf("%s\\..+\\.%s", rName, acctest.PartitionDNSSuffix()))),
 					resource.TestCheckNoResourceAttr(resourceName, "configuration_endpoint_address"),
 					resource.TestCheckResourceAttr(resourceName, "num_cache_clusters", "2"),
 					resource.TestCheckResourceAttr(resourceName, "member_clusters.#", "2"),
@@ -1152,7 +1253,7 @@ func TestAccElastiCacheReplicationGroup_clusteringAndCacheNodesCausesError(t *te
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccReplicationGroupConfig_nativeRedisClusterError(rName),
-				ExpectError: regexp.MustCompile(`"num_node_groups": conflicts with num_cache_clusters`),
+				ExpectError: regexache.MustCompile(`"num_node_groups": conflicts with num_cache_clusters`),
 			},
 		},
 	})
@@ -1924,7 +2025,7 @@ func TestAccElastiCacheReplicationGroup_Validation_noNodeType(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccReplicationGroupConfig_validationNoNodeType(rName),
-				ExpectError: regexp.MustCompile(`"node_type" is required unless "global_replication_group_id" is set.`),
+				ExpectError: regexache.MustCompile(`"node_type" is required unless "global_replication_group_id" is set.`),
 			},
 		},
 	})
@@ -1949,7 +2050,7 @@ func TestAccElastiCacheReplicationGroup_Validation_globalReplicationGroupIdAndNo
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccReplicationGroupConfig_validationGlobalIdAndNodeType(rName),
-				ExpectError: regexp.MustCompile(`"global_replication_group_id": conflicts with node_type`),
+				ExpectError: regexache.MustCompile(`"global_replication_group_id": conflicts with node_type`),
 			},
 		},
 	})
@@ -1988,7 +2089,7 @@ func TestAccElastiCacheReplicationGroup_GlobalReplicationGroupID_basic(t *testin
 					resource.TestCheckResourceAttrPair(resourceName, "node_type", primaryGroupResourceName, "node_type"),
 					resource.TestCheckResourceAttrPair(resourceName, "engine", primaryGroupResourceName, "engine"),
 					resource.TestCheckResourceAttrPair(resourceName, "engine_version", primaryGroupResourceName, "engine_version"),
-					resource.TestMatchResourceAttr(resourceName, "parameter_group_name", regexp.MustCompile(fmt.Sprintf("^global-datastore-%s-", rName))),
+					resource.TestMatchResourceAttr(resourceName, "parameter_group_name", regexache.MustCompile(fmt.Sprintf("^global-datastore-%s-", rName))),
 					resource.TestCheckResourceAttr(resourceName, "num_cache_clusters", "1"),
 					resource.TestCheckResourceAttr(primaryGroupResourceName, "num_cache_clusters", "2"),
 				),
@@ -2041,7 +2142,7 @@ func TestAccElastiCacheReplicationGroup_GlobalReplicationGroupID_full(t *testing
 					resource.TestCheckResourceAttrPair(resourceName, "node_type", primaryGroupResourceName, "node_type"),
 					resource.TestCheckResourceAttrPair(resourceName, "engine", primaryGroupResourceName, "engine"),
 					resource.TestCheckResourceAttrPair(resourceName, "engine_version", primaryGroupResourceName, "engine_version"),
-					resource.TestMatchResourceAttr(resourceName, "parameter_group_name", regexp.MustCompile(fmt.Sprintf("^global-datastore-%s-", rName))),
+					resource.TestMatchResourceAttr(resourceName, "parameter_group_name", regexache.MustCompile(fmt.Sprintf("^global-datastore-%s-", rName))),
 
 					resource.TestCheckResourceAttr(resourceName, "num_cache_clusters", strconv.Itoa(initialNumCacheClusters)),
 					resource.TestCheckResourceAttrPair(resourceName, "multi_az_enabled", primaryGroupResourceName, "multi_az_enabled"),
@@ -2138,7 +2239,7 @@ func TestAccElastiCacheReplicationGroup_GlobalReplicationGroupIDClusterMode_basi
 					resource.TestCheckResourceAttr(resourceName, "num_node_groups", "2"),
 					resource.TestCheckResourceAttr(resourceName, "replicas_per_node_group", "1"),
 					resource.TestCheckResourceAttr(resourceName, "automatic_failover_enabled", "true"),
-					resource.TestMatchResourceAttr(resourceName, "parameter_group_name", regexp.MustCompile(fmt.Sprintf("^global-datastore-%s-", rName))),
+					resource.TestMatchResourceAttr(resourceName, "parameter_group_name", regexache.MustCompile(fmt.Sprintf("^global-datastore-%s-", rName))),
 
 					resource.TestCheckResourceAttr(primaryGroupResourceName, "num_node_groups", "2"),
 					resource.TestCheckResourceAttr(primaryGroupResourceName, "replicas_per_node_group", "2"),
@@ -2186,7 +2287,7 @@ func TestAccElastiCacheReplicationGroup_GlobalReplicationGroupIDClusterModeValid
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccReplicationGroupConfig_globalIDClusterModeNumNodeOnSecondary(rName),
-				ExpectError: regexp.MustCompile(`"global_replication_group_id": conflicts with num_node_groups`),
+				ExpectError: regexache.MustCompile(`"global_replication_group_id": conflicts with num_node_groups`),
 			},
 		},
 	})
@@ -2580,7 +2681,7 @@ func testCheckEngineStuffDefault(ctx context.Context, resourceName string) resou
 			return resource.TestCheckResourceAttr(resourceName, "engine_version", *version.EngineVersion)(s)
 		},
 		func(s *terraform.State) error {
-			return resource.TestMatchResourceAttr(resourceName, "engine_version_actual", regexp.MustCompile(fmt.Sprintf(`^%s\.[[:digit:]]+$`, *version.EngineVersion)))(s)
+			return resource.TestMatchResourceAttr(resourceName, "engine_version_actual", regexache.MustCompile(fmt.Sprintf(`^%s\.[[:digit:]]+$`, *version.EngineVersion)))(s)
 		},
 		func(s *terraform.State) error {
 			return resource.TestCheckResourceAttr(resourceName, "parameter_group_name", *parameterGroup.CacheParameterGroupName)(s)
@@ -2645,7 +2746,7 @@ func testCheckEngineStuffClusterEnabledDefault(ctx context.Context, resourceName
 			return resource.TestCheckResourceAttr(resourceName, "engine_version", *version.EngineVersion)(s)
 		},
 		func(s *terraform.State) error {
-			return resource.TestMatchResourceAttr(resourceName, "engine_version_actual", regexp.MustCompile(fmt.Sprintf(`^%s\.[[:digit:]]+$`, *version.EngineVersion)))(s)
+			return resource.TestMatchResourceAttr(resourceName, "engine_version_actual", regexache.MustCompile(fmt.Sprintf(`^%s\.[[:digit:]]+$`, *version.EngineVersion)))(s)
 		},
 		func(s *terraform.State) error {
 			return resource.TestCheckResourceAttr(resourceName, "parameter_group_name", *parameterGroup.CacheParameterGroupName)(s)
@@ -2726,10 +2827,17 @@ resource "aws_elasticache_replication_group" "test" {
 func testAccReplicationGroupConfig_v7(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_elasticache_replication_group" "test" {
-  replication_group_id          = %[1]q
-  replication_group_description = "test description"
-  node_type                     = "cache.t3.small"
-  engine_version                = "7.0"
+  replication_group_id = %[1]q
+  description          = "test description"
+  node_type            = "cache.t3.small"
+  engine_version       = "7.0"
+  parameter_group_name = aws_elasticache_parameter_group.test.name
+  engine               = "redis"
+}
+
+resource "aws_elasticache_parameter_group" "test" {
+  name   = %[1]q
+  family = "redis7"
 }
 `, rName)
 }
@@ -2996,6 +3104,86 @@ resource "aws_security_group" "test" {
 	)
 }
 
+func testAccReplicationGroupConfig_ipDiscovery(rName, ipDiscovery string) string {
+	return acctest.ConfigCompose(
+		acctest.ConfigVPCWithSubnetsIPv6(rName, 2),
+		fmt.Sprintf(`
+resource "aws_elasticache_replication_group" "test" {
+  replication_group_id       = %[1]q
+  description                = "test description"
+  node_type                  = "cache.t3.small"
+  num_node_groups            = 2
+  replicas_per_node_group    = 1
+  port                       = 6379
+  parameter_group_name       = "default.redis7.cluster.on"
+  automatic_failover_enabled = true
+  subnet_group_name          = aws_elasticache_subnet_group.test.name
+  ip_discovery               = %[2]q
+  network_type               = "dual_stack"
+  security_group_ids         = [aws_security_group.test.id]
+}
+
+resource "aws_elasticache_subnet_group" "test" {
+  name       = %[1]q
+  subnet_ids = aws_subnet.test[*].id
+}
+
+resource "aws_security_group" "test" {
+  name        = %[1]q
+  description = "tf-test-security-group-descr"
+  vpc_id      = aws_vpc.test.id
+
+  ingress {
+    from_port   = -1
+    to_port     = -1
+    protocol    = "icmp"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+}
+`, rName, ipDiscovery),
+	)
+}
+
+func testAccReplicationGroupConfig_networkType(rName, ipDiscovery, networkType string) string {
+	return acctest.ConfigCompose(
+		acctest.ConfigVPCWithSubnetsIPv6(rName, 2),
+		fmt.Sprintf(`
+resource "aws_elasticache_replication_group" "test" {
+  replication_group_id       = %[1]q
+  description                = "test description"
+  node_type                  = "cache.t3.small"
+  num_node_groups            = 2
+  replicas_per_node_group    = 1
+  port                       = 6379
+  parameter_group_name       = "default.redis7.cluster.on"
+  automatic_failover_enabled = true
+  subnet_group_name          = aws_elasticache_subnet_group.test.name
+  ip_discovery               = %[2]q
+  network_type               = %[3]q
+  security_group_ids         = [aws_security_group.test.id]
+}
+
+resource "aws_elasticache_subnet_group" "test" {
+  name       = %[1]q
+  subnet_ids = aws_subnet.test[*].id
+}
+
+resource "aws_security_group" "test" {
+  name        = %[1]q
+  description = "tf-test-security-group-descr"
+  vpc_id      = aws_vpc.test.id
+
+  ingress {
+    from_port   = -1
+    to_port     = -1
+    protocol    = "icmp"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+}
+`, rName, ipDiscovery, networkType),
+	)
+}
+
 func testAccReplicationGroupConfig_multiAZNoAutomaticFailover(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_elasticache_replication_group" "test" {
@@ -3170,8 +3358,6 @@ resource "aws_elasticache_replication_group" "test" {
   port                       = 6379
   subnet_group_name          = aws_elasticache_subnet_group.test.name
   security_group_ids         = [aws_security_group.test.id]
-  parameter_group_name       = "default.redis3.2"
-  engine_version             = "3.2.6"
   at_rest_encryption_enabled = true
   kms_key_id                 = aws_kms_key.test.arn
 }
@@ -3213,8 +3399,6 @@ resource "aws_elasticache_replication_group" "test" {
   port                       = 6379
   subnet_group_name          = aws_elasticache_subnet_group.test.name
   security_group_ids         = [aws_security_group.test.id]
-  parameter_group_name       = "default.redis3.2"
-  engine_version             = "3.2.6"
   at_rest_encryption_enabled = true
 }
 
diff --git a/internal/service/elasticache/service.go b/internal/service/elasticache/service.go
index d4b7ff0734f..439a7f5b420 100644
--- a/internal/service/elasticache/service.go
+++ b/internal/service/elasticache/service.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elasticache
 
 const (
diff --git a/internal/service/elasticache/service_package_gen.go b/internal/service/elasticache/service_package_gen.go
index 8eeb1b4b032..3845f2843fc 100644
--- a/internal/service/elasticache/service_package_gen.go
+++ b/internal/service/elasticache/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	elasticache_sdkv1 "github.com/aws/aws-sdk-go/service/elasticache"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -115,4 +116,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*e
 	return elasticache_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/elasticache/status.go b/internal/service/elasticache/status.go
index 48d254fafa6..a1d1b6b480f 100644
--- a/internal/service/elasticache/status.go
+++ b/internal/service/elasticache/status.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elasticache
 
 import (
diff --git a/internal/service/elasticache/subnet_group.go b/internal/service/elasticache/subnet_group.go
index 1c22fc0d263..47ffb9fa19f 100644
--- a/internal/service/elasticache/subnet_group.go
+++ b/internal/service/elasticache/subnet_group.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elasticache
 
 import (
diff --git a/internal/service/elasticache/subnet_group_data_source.go b/internal/service/elasticache/subnet_group_data_source.go
index 9d6a59797ad..52e5314b73b 100644
--- a/internal/service/elasticache/subnet_group_data_source.go
+++ b/internal/service/elasticache/subnet_group_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elasticache
 
 import (
diff --git a/internal/service/elasticache/subnet_group_data_source_test.go b/internal/service/elasticache/subnet_group_data_source_test.go
index a8a05671503..c3c2ef99ef9 100644
--- a/internal/service/elasticache/subnet_group_data_source_test.go
+++ b/internal/service/elasticache/subnet_group_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elasticache_test
 
 import (
diff --git a/internal/service/elasticache/subnet_group_test.go b/internal/service/elasticache/subnet_group_test.go
index b7049e8be4a..9e8346c91ef 100644
--- a/internal/service/elasticache/subnet_group_test.go
+++ b/internal/service/elasticache/subnet_group_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elasticache_test
 
 import (
diff --git a/internal/service/elasticache/sweep.go b/internal/service/elasticache/sweep.go
index 252a71ece46..89bba6ff19b 100644
--- a/internal/service/elasticache/sweep.go
+++ b/internal/service/elasticache/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package elasticache
 
@@ -15,6 +15,7 @@ import (
 	"github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
 // These timeouts are lower to fail faster during sweepers
@@ -23,7 +24,7 @@ const (
 	sweeperGlobalReplicationGroupDefaultUpdatedTimeout      = 10 * time.Minute
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_elasticache_cluster", &resource.Sweeper{
 		Name: "aws_elasticache_cluster",
 		F:    sweepClusters,
@@ -66,7 +67,7 @@ func init() {
 
 func sweepClusters(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
@@ -100,7 +101,7 @@ func sweepClusters(region string) error {
 		}
 		return !lastPage
 	})
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping ElastiCache Cluster sweep for %s: %s", region, err)
 		return sweeperErrs.ErrorOrNil() // In case we have completed some pages, but had errors
 	}
@@ -113,7 +114,7 @@ func sweepClusters(region string) error {
 
 func sweepGlobalReplicationGroups(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
@@ -154,7 +155,7 @@ func sweepGlobalReplicationGroups(region string) error {
 
 	grgErrs := grgGroup.Wait()
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping ElastiCache Global Replication Group sweep for %q: %s", region, err)
 		return grgErrs.ErrorOrNil() // In case we have completed some pages, but had errors
 	}
@@ -168,7 +169,7 @@ func sweepGlobalReplicationGroups(region string) error {
 
 func sweepParameterGroups(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
@@ -199,7 +200,7 @@ func sweepParameterGroups(region string) error {
 		return !lastPage
 	})
 	if err != nil {
-		if sweep.SkipSweepError(err) {
+		if awsv1.SkipSweepError(err) {
 			log.Printf("[WARN] Skipping ElastiCache Parameter Group sweep for %s: %s", region, err)
 			return nil
 		}
@@ -210,7 +211,7 @@ func sweepParameterGroups(region string) error {
 
 func sweepReplicationGroups(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
@@ -246,13 +247,13 @@ func sweepReplicationGroups(region string) error {
 		errs = multierror.Append(errs, fmt.Errorf("error describing ElastiCache Replication Groups: %w", err))
 	}
 
-	if err = sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err = sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("error sweeping ElastiCache Replication Groups for %s: %w", region, err))
 	}
 
 	// waiting for deletion is not necessary in the sweeper since the resource's delete waits
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
+	if awsv1.SkipSweepError(errs.ErrorOrNil()) {
 		log.Printf("[WARN] Skipping ElastiCache Replication Group sweep for %s: %s", region, errs)
 		return nil
 	}
@@ -262,7 +263,7 @@ func sweepReplicationGroups(region string) error {
 
 func sweepSubnetGroups(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
@@ -293,7 +294,7 @@ func sweepSubnetGroups(region string) error {
 		return !lastPage
 	})
 	if err != nil {
-		if sweep.SkipSweepError(err) {
+		if awsv1.SkipSweepError(err) {
 			log.Printf("[WARN] Skipping ElastiCache Subnet Group sweep for %s: %s", region, err)
 			return nil
 		}
diff --git a/internal/service/elasticache/tags_gen.go b/internal/service/elasticache/tags_gen.go
index ec0b575a155..07b0c1b6127 100644
--- a/internal/service/elasticache/tags_gen.go
+++ b/internal/service/elasticache/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/elasticache"
 	"github.com/aws/aws-sdk-go/service/elasticache/elasticacheiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -111,6 +113,8 @@ func updateTags(ctx context.Context, conn elasticacheiface.ElastiCacheAPI, ident
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.ElastiCache)
 	if len(removedTags) > 0 {
diff --git a/internal/service/elasticache/user.go b/internal/service/elasticache/user.go
index 96bf1c97f9f..b5e8b3bb292 100644
--- a/internal/service/elasticache/user.go
+++ b/internal/service/elasticache/user.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elasticache
 
 import (
diff --git a/internal/service/elasticache/user_data_source.go b/internal/service/elasticache/user_data_source.go
index c0a6c4bd493..5e0d3015743 100644
--- a/internal/service/elasticache/user_data_source.go
+++ b/internal/service/elasticache/user_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elasticache
 
 import (
diff --git a/internal/service/elasticache/user_data_source_test.go b/internal/service/elasticache/user_data_source_test.go
index 78de2aada81..956e4d4aa17 100644
--- a/internal/service/elasticache/user_data_source_test.go
+++ b/internal/service/elasticache/user_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elasticache_test
 
 import (
diff --git a/internal/service/elasticache/user_group.go b/internal/service/elasticache/user_group.go
index 79b01b8b695..76283038037 100644
--- a/internal/service/elasticache/user_group.go
+++ b/internal/service/elasticache/user_group.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elasticache
 
 import (
diff --git a/internal/service/elasticache/user_group_association.go b/internal/service/elasticache/user_group_association.go
index 0628b27ce5f..ab8fb7ad74c 100644
--- a/internal/service/elasticache/user_group_association.go
+++ b/internal/service/elasticache/user_group_association.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elasticache
 
 import (
diff --git a/internal/service/elasticache/user_group_association_test.go b/internal/service/elasticache/user_group_association_test.go
index 0e52a51fd81..31f3551ab4d 100644
--- a/internal/service/elasticache/user_group_association_test.go
+++ b/internal/service/elasticache/user_group_association_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elasticache_test
 
 import (
diff --git a/internal/service/elasticache/user_group_test.go b/internal/service/elasticache/user_group_test.go
index 5f07266d570..b23e0acb1fa 100644
--- a/internal/service/elasticache/user_group_test.go
+++ b/internal/service/elasticache/user_group_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elasticache_test
 
 import (
diff --git a/internal/service/elasticache/user_test.go b/internal/service/elasticache/user_test.go
index b324fd732a5..d6175fcf6a6 100644
--- a/internal/service/elasticache/user_test.go
+++ b/internal/service/elasticache/user_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elasticache_test
 
 import (
diff --git a/internal/service/elasticache/validate.go b/internal/service/elasticache/validate.go
index 6eeb223d090..eb6b9280a4a 100644
--- a/internal/service/elasticache/validate.go
+++ b/internal/service/elasticache/validate.go
@@ -1,8 +1,12 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elasticache
 
 import (
 	"fmt"
-	"regexp"
+
+	"github.com/YakDriver/regexache"
 )
 
 func validReplicationGroupAuthToken(v interface{}, k string) (ws []string, errors []error) {
@@ -11,7 +15,7 @@ func validReplicationGroupAuthToken(v interface{}, k string) (ws []string, error
 		errors = append(errors, fmt.Errorf(
 			"%q must contain from 16 to 128 alphanumeric characters or symbols (excluding @, \", and /)", k))
 	}
-	if !regexp.MustCompile(`^[^@"\/]+$`).MatchString(value) {
+	if !regexache.MustCompile(`^[^@"\/]+$`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"only alphanumeric characters or symbols (excluding @, \", and /) allowed in %q", k))
 	}
diff --git a/internal/service/elasticache/validate_test.go b/internal/service/elasticache/validate_test.go
index 609b7e9f561..2a5891b6476 100644
--- a/internal/service/elasticache/validate_test.go
+++ b/internal/service/elasticache/validate_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elasticache
 
 import (
diff --git a/internal/service/elasticache/wait.go b/internal/service/elasticache/wait.go
index a63d8862de2..bde501cac98 100644
--- a/internal/service/elasticache/wait.go
+++ b/internal/service/elasticache/wait.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elasticache
 
 import (
diff --git a/internal/service/elasticbeanstalk/application.go b/internal/service/elasticbeanstalk/application.go
index af252695093..37a2ae7ac17 100644
--- a/internal/service/elasticbeanstalk/application.go
+++ b/internal/service/elasticbeanstalk/application.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elasticbeanstalk
 
 import (
diff --git a/internal/service/elasticbeanstalk/application_data_source.go b/internal/service/elasticbeanstalk/application_data_source.go
index 77f8b0ebf16..bec09bab0ac 100644
--- a/internal/service/elasticbeanstalk/application_data_source.go
+++ b/internal/service/elasticbeanstalk/application_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elasticbeanstalk
 
 import (
diff --git a/internal/service/elasticbeanstalk/application_data_source_test.go b/internal/service/elasticbeanstalk/application_data_source_test.go
index e311cc689d0..6c31f579f22 100644
--- a/internal/service/elasticbeanstalk/application_data_source_test.go
+++ b/internal/service/elasticbeanstalk/application_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elasticbeanstalk_test
 
 import (
diff --git a/internal/service/elasticbeanstalk/application_test.go b/internal/service/elasticbeanstalk/application_test.go
index 92108ee4f92..76ff2e30e68 100644
--- a/internal/service/elasticbeanstalk/application_test.go
+++ b/internal/service/elasticbeanstalk/application_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elasticbeanstalk_test
 
 import (
diff --git a/internal/service/elasticbeanstalk/application_version.go b/internal/service/elasticbeanstalk/application_version.go
index 8d2a19540b6..5d4ea640320 100644
--- a/internal/service/elasticbeanstalk/application_version.go
+++ b/internal/service/elasticbeanstalk/application_version.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elasticbeanstalk
 
 import (
diff --git a/internal/service/elasticbeanstalk/application_version_test.go b/internal/service/elasticbeanstalk/application_version_test.go
index 2d1ef677336..dbbf19a53e9 100644
--- a/internal/service/elasticbeanstalk/application_version_test.go
+++ b/internal/service/elasticbeanstalk/application_version_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elasticbeanstalk_test
 
 import (
diff --git a/internal/service/elasticbeanstalk/configuration_template.go b/internal/service/elasticbeanstalk/configuration_template.go
index 637bd66007b..6bd163a333c 100644
--- a/internal/service/elasticbeanstalk/configuration_template.go
+++ b/internal/service/elasticbeanstalk/configuration_template.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elasticbeanstalk
 
 import (
diff --git a/internal/service/elasticbeanstalk/configuration_template_test.go b/internal/service/elasticbeanstalk/configuration_template_test.go
index 611066dd2fe..40bf27c30b1 100644
--- a/internal/service/elasticbeanstalk/configuration_template_test.go
+++ b/internal/service/elasticbeanstalk/configuration_template_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elasticbeanstalk_test
 
 import (
diff --git a/internal/service/elasticbeanstalk/environment.go b/internal/service/elasticbeanstalk/environment.go
index 5d7592f90bf..31da9128381 100644
--- a/internal/service/elasticbeanstalk/environment.go
+++ b/internal/service/elasticbeanstalk/environment.go
@@ -1,14 +1,17 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elasticbeanstalk
 
 import ( // nosemgrep:ci.semgrep.aws.multiple-service-imports
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"sort"
 	"strings"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/aws/aws-sdk-go/service/elasticbeanstalk"
@@ -72,7 +75,7 @@ const (
 )
 
 var (
-	environmentCNAMERegex = regexp.MustCompile(`(^[^.]+)(.\w{2}-\w{4,9}-\d)?\.(elasticbeanstalk\.com|eb\.amazonaws\.com\.cn)$`)
+	environmentCNAMERegex = regexache.MustCompile(`(^[^.]+)(.\w{2}-\w{4,9}-\d)?\.(elasticbeanstalk\.com|eb\.amazonaws\.com\.cn)$`)
 )
 
 // @SDKResource("aws_elastic_beanstalk_environment", name="Environment")
@@ -676,8 +679,14 @@ func findEnvironmentErrorsByID(ctx context.Context, conn *elasticbeanstalk.Elast
 		return nil
 	}
 
-	slices.SortFunc(output, func(a, b *elasticbeanstalk.EventDescription) bool {
-		return a.EventDate.Before(aws.TimeValue(b.EventDate))
+	slices.SortFunc(output, func(a, b *elasticbeanstalk.EventDescription) int {
+		if a.EventDate.Before(aws.TimeValue(b.EventDate)) {
+			return -1
+		}
+		if a.EventDate.After(aws.TimeValue(b.EventDate)) {
+			return 1
+		}
+		return 0
 	})
 
 	var errors *multierror.Error
diff --git a/internal/service/elasticbeanstalk/environment_migrate.go b/internal/service/elasticbeanstalk/environment_migrate.go
index 296f4fcf12b..779b322fedd 100644
--- a/internal/service/elasticbeanstalk/environment_migrate.go
+++ b/internal/service/elasticbeanstalk/environment_migrate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elasticbeanstalk
 
 import (
diff --git a/internal/service/elasticbeanstalk/environment_migrate_test.go b/internal/service/elasticbeanstalk/environment_migrate_test.go
index 05115368395..f73d6d4208c 100644
--- a/internal/service/elasticbeanstalk/environment_migrate_test.go
+++ b/internal/service/elasticbeanstalk/environment_migrate_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elasticbeanstalk_test
 
 import (
diff --git a/internal/service/elasticbeanstalk/environment_test.go b/internal/service/elasticbeanstalk/environment_test.go
index c3246cb456b..1b0d82ce36c 100644
--- a/internal/service/elasticbeanstalk/environment_test.go
+++ b/internal/service/elasticbeanstalk/environment_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elasticbeanstalk_test
 
 import (
@@ -5,10 +8,10 @@ import (
 	"fmt"
 	"log"
 	"reflect"
-	"regexp"
 	"sort"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/elasticbeanstalk"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -25,11 +28,11 @@ func TestAccElasticBeanstalkEnvironment_basic(t *testing.T) {
 	var app elasticbeanstalk.EnvironmentDescription
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_elastic_beanstalk_environment.test"
-	beanstalkAsgNameRegexp := regexp.MustCompile("awseb.+?AutoScalingGroup[^,]+")
-	beanstalkElbNameRegexp := regexp.MustCompile("awseb.+?EBLoa[^,]+")
-	beanstalkInstancesNameRegexp := regexp.MustCompile("i-([0-9a-fA-F]{8}|[0-9a-fA-F]{17})")
-	beanstalkLcNameRegexp := regexp.MustCompile("awseb.+?AutoScalingLaunch[^,]+")
-	beanstalkEndpointURL := regexp.MustCompile("awseb.+?EBLoa[^,].+?elb.amazonaws.com")
+	beanstalkAsgNameRegexp := regexache.MustCompile("awseb.+?AutoScalingGroup[^,]+")
+	beanstalkElbNameRegexp := regexache.MustCompile("awseb.+?EBLoa[^,]+")
+	beanstalkInstancesNameRegexp := regexache.MustCompile("i-([0-9A-Fa-f]{8}|[0-9A-Fa-f]{17})")
+	beanstalkLcNameRegexp := regexache.MustCompile("awseb.+?AutoScalingLaunch[^,]+")
+	beanstalkEndpointURL := regexache.MustCompile("awseb.+?EBLoa[^,].+?elb.amazonaws.com")
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
@@ -91,7 +94,7 @@ func TestAccElasticBeanstalkEnvironment_tier(t *testing.T) {
 	var app elasticbeanstalk.EnvironmentDescription
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_elastic_beanstalk_environment.test"
-	beanstalkQueuesNameRegexp := regexp.MustCompile("https://sqs.+?awseb[^,]+")
+	beanstalkQueuesNameRegexp := regexache.MustCompile("https://sqs.+?awseb[^,]+")
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
@@ -125,7 +128,7 @@ func TestAccElasticBeanstalkEnvironment_cnamePrefix(t *testing.T) {
 	var app elasticbeanstalk.EnvironmentDescription
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_elastic_beanstalk_environment.test"
-	beanstalkCnameRegexp := regexp.MustCompile("^" + rName + ".+?elasticbeanstalk.com$")
+	beanstalkCnameRegexp := regexache.MustCompile("^" + rName + ".+?elasticbeanstalk.com$")
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
diff --git a/internal/service/elasticbeanstalk/flex.go b/internal/service/elasticbeanstalk/flex.go
index efb3c0bea27..b0c8da80fef 100644
--- a/internal/service/elasticbeanstalk/flex.go
+++ b/internal/service/elasticbeanstalk/flex.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elasticbeanstalk
 
 import (
diff --git a/internal/service/elasticbeanstalk/generate.go b/internal/service/elasticbeanstalk/generate.go
index fd596fa9f50..013b79a31d7 100644
--- a/internal/service/elasticbeanstalk/generate.go
+++ b/internal/service/elasticbeanstalk/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTags -ListTagsOutTagsElem=ResourceTags -ServiceTagsSlice -TagOp=UpdateTagsForResource -TagInTagsElem=TagsToAdd -UntagOp=UpdateTagsForResource -UntagInTagsElem=TagsToRemove -UpdateTags
 //go:generate go run ../../generate/listpages/main.go -ListOps=DescribeEnvironments
 //go:generate go run ../../generate/servicepackage/main.go
diff --git a/internal/service/elasticbeanstalk/hosted_zone_data_source.go b/internal/service/elasticbeanstalk/hosted_zone_data_source.go
index de95b69832f..4e38cd7e44a 100644
--- a/internal/service/elasticbeanstalk/hosted_zone_data_source.go
+++ b/internal/service/elasticbeanstalk/hosted_zone_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elasticbeanstalk
 
 import (
diff --git a/internal/service/elasticbeanstalk/hosted_zone_data_source_test.go b/internal/service/elasticbeanstalk/hosted_zone_data_source_test.go
index 604c8c1ef7b..0aa4ff28a80 100644
--- a/internal/service/elasticbeanstalk/hosted_zone_data_source_test.go
+++ b/internal/service/elasticbeanstalk/hosted_zone_data_source_test.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elasticbeanstalk_test
 
 import (
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/elasticbeanstalk"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
@@ -54,7 +57,7 @@ func TestAccElasticBeanstalkHostedZoneDataSource_region(t *testing.T) {
 			},
 			{
 				Config:      testAccHostedZoneDataSourceConfig_byRegion("ss-pluto-1"),
-				ExpectError: regexp.MustCompile("Unsupported region"),
+				ExpectError: regexache.MustCompile("Unsupported region"),
 			},
 		},
 	})
diff --git a/internal/service/elasticbeanstalk/service_package_gen.go b/internal/service/elasticbeanstalk/service_package_gen.go
index 5efea7b68f5..d469473a98c 100644
--- a/internal/service/elasticbeanstalk/service_package_gen.go
+++ b/internal/service/elasticbeanstalk/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	elasticbeanstalk_sdkv1 "github.com/aws/aws-sdk-go/service/elasticbeanstalk"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -83,4 +84,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*e
 	return elasticbeanstalk_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/elasticbeanstalk/solution_stack_data_source.go b/internal/service/elasticbeanstalk/solution_stack_data_source.go
index d11808311e6..07534e1fc21 100644
--- a/internal/service/elasticbeanstalk/solution_stack_data_source.go
+++ b/internal/service/elasticbeanstalk/solution_stack_data_source.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elasticbeanstalk
 
 import (
 	"context"
 	"log"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/elasticbeanstalk"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
@@ -56,7 +59,7 @@ func dataSourceSolutionStackRead(ctx context.Context, d *schema.ResourceData, me
 
 	var filteredSolutionStacks []*string
 
-	r := regexp.MustCompile(nameRegex.(string))
+	r := regexache.MustCompile(nameRegex.(string))
 	for _, solutionStack := range resp.SolutionStacks {
 		if r.MatchString(*solutionStack) {
 			filteredSolutionStacks = append(filteredSolutionStacks, solutionStack)
diff --git a/internal/service/elasticbeanstalk/solution_stack_data_source_test.go b/internal/service/elasticbeanstalk/solution_stack_data_source_test.go
index c5c2f4a12b1..6d4251f0be3 100644
--- a/internal/service/elasticbeanstalk/solution_stack_data_source_test.go
+++ b/internal/service/elasticbeanstalk/solution_stack_data_source_test.go
@@ -1,9 +1,12 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elasticbeanstalk_test
 
 import (
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/elasticbeanstalk"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
@@ -21,7 +24,7 @@ func TestAccElasticBeanstalkSolutionStackDataSource_basic(t *testing.T) {
 			{
 				Config: testAccSolutionStackDataSourceConfig_basic,
 				Check: resource.ComposeTestCheckFunc(
-					resource.TestMatchResourceAttr(dataSourceName, "name", regexp.MustCompile("^64bit Amazon Linux (.*) running Python (.*)$")),
+					resource.TestMatchResourceAttr(dataSourceName, "name", regexache.MustCompile("^64bit Amazon Linux (.*) running Python (.*)$")),
 				),
 			},
 		},
diff --git a/internal/service/elasticbeanstalk/sweep.go b/internal/service/elasticbeanstalk/sweep.go
index f2ac7892381..3b2633db4a9 100644
--- a/internal/service/elasticbeanstalk/sweep.go
+++ b/internal/service/elasticbeanstalk/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package elasticbeanstalk
 
@@ -13,9 +13,10 @@ import (
 	"github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_elastic_beanstalk_application", &resource.Sweeper{
 		Name:         "aws_elastic_beanstalk_application",
 		Dependencies: []string{"aws_elastic_beanstalk_environment"},
@@ -30,7 +31,7 @@ func init() {
 
 func sweepApplications(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -38,7 +39,7 @@ func sweepApplications(region string) error {
 
 	resp, err := conn.DescribeApplicationsWithContext(ctx, &elasticbeanstalk.DescribeApplicationsInput{})
 	if err != nil {
-		if sweep.SkipSweepError(err) {
+		if awsv1.SkipSweepError(err) {
 			log.Printf("[WARN] Skipping Elastic Beanstalk Application sweep for %s: %s", region, err)
 			return nil
 		}
@@ -71,7 +72,7 @@ func sweepApplications(region string) error {
 
 func sweepEnvironments(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
@@ -99,7 +100,7 @@ func sweepEnvironments(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Elastic Beanstalk Environment sweep for %s: %s", region, err)
 		return nil
 	}
@@ -108,7 +109,7 @@ func sweepEnvironments(region string) error {
 		return fmt.Errorf("listing Elastic Beanstalk Environments (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("sweeping Elastic Beanstalk Environments (%s): %w", region, err)
diff --git a/internal/service/elasticbeanstalk/tags_gen.go b/internal/service/elasticbeanstalk/tags_gen.go
index 7f1f6980b46..e974c1f9e74 100644
--- a/internal/service/elasticbeanstalk/tags_gen.go
+++ b/internal/service/elasticbeanstalk/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/elasticbeanstalk"
 	"github.com/aws/aws-sdk-go/service/elasticbeanstalk/elasticbeanstalkiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -101,6 +103,9 @@ func setTagsOut(ctx context.Context, tags []*elasticbeanstalk.Tag) {
 func updateTags(ctx context.Context, conn elasticbeanstalkiface.ElasticBeanstalkAPI, identifier string, oldTagsMap, newTagsMap any) error {
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
+
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.ElasticBeanstalk)
 	updatedTags := oldTags.Updated(newTags)
diff --git a/internal/service/elasticsearch/acc_test.go b/internal/service/elasticsearch/acc_test.go
index 76009068d76..2424584bdaf 100644
--- a/internal/service/elasticsearch/acc_test.go
+++ b/internal/service/elasticsearch/acc_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elasticsearch_test
 
 import (
diff --git a/internal/service/elasticsearch/consts.go b/internal/service/elasticsearch/consts.go
index de1ab351ac7..1845f4a1f5a 100644
--- a/internal/service/elasticsearch/consts.go
+++ b/internal/service/elasticsearch/consts.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elasticsearch
 
 import (
diff --git a/internal/service/elasticsearch/domain.go b/internal/service/elasticsearch/domain.go
index 26bddaabca0..e826e9a8124 100644
--- a/internal/service/elasticsearch/domain.go
+++ b/internal/service/elasticsearch/domain.go
@@ -1,13 +1,16 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elasticsearch
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"strings"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	elasticsearch "github.com/aws/aws-sdk-go/service/elasticsearchservice"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -335,7 +338,7 @@ func ResourceDomain() *schema.Resource {
 				Type:     schema.TypeString,
 				Required: true,
 				ForceNew: true,
-				ValidateFunc: validation.StringMatch(regexp.MustCompile(`^[a-z][0-9a-z\-]{2,27}$`),
+				ValidateFunc: validation.StringMatch(regexache.MustCompile(`^[a-z][0-9a-z\-]{2,27}$`),
 					"must start with a lowercase alphabet and be at least 3 and no more than 28 characters long."+
 						" Valid characters are a-z (lowercase letters), 0-9, and - (hyphen)."),
 			},
@@ -804,7 +807,7 @@ func resourceDomainRead(ctx context.Context, d *schema.ResourceData, meta interf
 	}
 
 	if ds.VPCOptions != nil {
-		if err := d.Set("vpc_options", flattenVPCDerivedInfo(ds.VPCOptions)); err != nil {
+		if err := d.Set("vpc_options", []interface{}{flattenVPCDerivedInfo(ds.VPCOptions)}); err != nil {
 			return sdkdiag.AppendErrorf(diags, "setting vpc_options: %s", err)
 		}
 
@@ -1246,3 +1249,31 @@ func advancedOptionsIgnoreDefault(o map[string]interface{}, n map[string]interfa
 
 	return n
 }
+
+// EBSVolumeTypePermitsIopsInput returns true if the volume type supports the Iops input
+//
+// This check prevents a ValidationException when updating EBS volume types from a value
+// that supports IOPS (ex. gp3) to one that doesn't (ex. gp2).
+func EBSVolumeTypePermitsIopsInput(volumeType string) bool {
+	permittedTypes := []string{elasticsearch.VolumeTypeGp3, elasticsearch.VolumeTypeIo1}
+	for _, t := range permittedTypes {
+		if volumeType == t {
+			return true
+		}
+	}
+	return false
+}
+
+// EBSVolumeTypePermitsIopsInput returns true if the volume type supports the Throughput input
+//
+// This check prevents a ValidationException when updating EBS volume types from a value
+// that supports Throughput (ex. gp3) to one that doesn't (ex. gp2).
+func EBSVolumeTypePermitsThroughputInput(volumeType string) bool {
+	permittedTypes := []string{elasticsearch.VolumeTypeGp3}
+	for _, t := range permittedTypes {
+		if volumeType == t {
+			return true
+		}
+	}
+	return false
+}
diff --git a/internal/service/elasticsearch/domain_data_source.go b/internal/service/elasticsearch/domain_data_source.go
index 125cbda17a4..5efb402272c 100644
--- a/internal/service/elasticsearch/domain_data_source.go
+++ b/internal/service/elasticsearch/domain_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elasticsearch
 
 import (
@@ -416,7 +419,7 @@ func dataSourceDomainRead(ctx context.Context, d *schema.ResourceData, meta inte
 	}
 
 	if ds.VPCOptions != nil {
-		if err := d.Set("vpc_options", flattenVPCDerivedInfo(ds.VPCOptions)); err != nil {
+		if err := d.Set("vpc_options", []interface{}{flattenVPCDerivedInfo(ds.VPCOptions)}); err != nil {
 			return sdkdiag.AppendErrorf(diags, "setting vpc_options: %s", err)
 		}
 
diff --git a/internal/service/elasticsearch/domain_data_source_test.go b/internal/service/elasticsearch/domain_data_source_test.go
index 5008c45482b..8c82fbb7112 100644
--- a/internal/service/elasticsearch/domain_data_source_test.go
+++ b/internal/service/elasticsearch/domain_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elasticsearch_test
 
 import (
diff --git a/internal/service/elasticsearch/domain_policy.go b/internal/service/elasticsearch/domain_policy.go
index 6d227aebd87..33ad70f3e12 100644
--- a/internal/service/elasticsearch/domain_policy.go
+++ b/internal/service/elasticsearch/domain_policy.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elasticsearch
 
 import (
diff --git a/internal/service/elasticsearch/domain_policy_test.go b/internal/service/elasticsearch/domain_policy_test.go
index 2ff434b3de8..10d60481e13 100644
--- a/internal/service/elasticsearch/domain_policy_test.go
+++ b/internal/service/elasticsearch/domain_policy_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elasticsearch_test
 
 import (
diff --git a/internal/service/elasticsearch/domain_saml_options.go b/internal/service/elasticsearch/domain_saml_options.go
index 8f3d25fa9cc..c8a732ecdcb 100644
--- a/internal/service/elasticsearch/domain_saml_options.go
+++ b/internal/service/elasticsearch/domain_saml_options.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elasticsearch
 
 import (
diff --git a/internal/service/elasticsearch/domain_saml_options_test.go b/internal/service/elasticsearch/domain_saml_options_test.go
index 55b7d29634a..f32c8e4e98a 100644
--- a/internal/service/elasticsearch/domain_saml_options_test.go
+++ b/internal/service/elasticsearch/domain_saml_options_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elasticsearch_test
 
 import (
diff --git a/internal/service/elasticsearch/domain_structure.go b/internal/service/elasticsearch/domain_structure.go
index f8b605162f7..84b39e8d7a6 100644
--- a/internal/service/elasticsearch/domain_structure.go
+++ b/internal/service/elasticsearch/domain_structure.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elasticsearch
 
 import (
diff --git a/internal/service/elasticsearch/domain_test.go b/internal/service/elasticsearch/domain_test.go
index a147dc0d433..a24012514ef 100644
--- a/internal/service/elasticsearch/domain_test.go
+++ b/internal/service/elasticsearch/domain_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elasticsearch_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/cognitoidentityprovider"
 	elasticsearch "github.com/aws/aws-sdk-go/service/elasticsearchservice"
@@ -19,6 +22,58 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
+func TestEBSVolumeTypePermitsIopsInput(t *testing.T) {
+	t.Parallel()
+
+	testCases := []struct {
+		name       string
+		volumeType string
+		want       bool
+	}{
+		{"empty", "", false},
+		{"gp2", elasticsearch.VolumeTypeGp2, false},
+		{"gp3", elasticsearch.VolumeTypeGp3, true},
+		{"io1", elasticsearch.VolumeTypeIo1, true},
+		{"standard", elasticsearch.VolumeTypeStandard, false},
+	}
+	for _, testCase := range testCases {
+		testCase := testCase
+		t.Run(testCase.name, func(t *testing.T) {
+			t.Parallel()
+
+			if got := tfelasticsearch.EBSVolumeTypePermitsIopsInput(testCase.volumeType); got != testCase.want {
+				t.Errorf("EBSVolumeTypePermitsIopsInput() = %v, want %v", got, testCase.want)
+			}
+		})
+	}
+}
+
+func TestEBSVolumeTypePermitsThroughputInput(t *testing.T) {
+	t.Parallel()
+
+	testCases := []struct {
+		name       string
+		volumeType string
+		want       bool
+	}{
+		{"empty", "", false},
+		{"gp2", elasticsearch.VolumeTypeGp2, false},
+		{"gp3", elasticsearch.VolumeTypeGp3, true},
+		{"io1", elasticsearch.VolumeTypeIo1, false},
+		{"standard", elasticsearch.VolumeTypeStandard, false},
+	}
+	for _, testCase := range testCases {
+		testCase := testCase
+		t.Run(testCase.name, func(t *testing.T) {
+			t.Parallel()
+
+			if got := tfelasticsearch.EBSVolumeTypePermitsThroughputInput(testCase.volumeType); got != testCase.want {
+				t.Errorf("EBSVolumeTypePermitsThroughputInput() = %v, want %v", got, testCase.want)
+			}
+		})
+	}
+}
+
 func TestAccElasticsearchDomain_basic(t *testing.T) {
 	ctx := acctest.Context(t)
 	if testing.Short() {
@@ -40,7 +95,7 @@ func TestAccElasticsearchDomain_basic(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDomainExists(ctx, resourceName, &domain),
 					resource.TestCheckResourceAttr(resourceName, "elasticsearch_version", "1.5"),
-					resource.TestMatchResourceAttr(resourceName, "kibana_endpoint", regexp.MustCompile(`.*es\..*/_plugin/kibana/`)),
+					resource.TestMatchResourceAttr(resourceName, "kibana_endpoint", regexache.MustCompile(`.*es\..*/_plugin/kibana/`)),
 					resource.TestCheckResourceAttr(resourceName, "vpc_options.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 				),
@@ -390,7 +445,7 @@ func TestAccElasticsearchDomain_duplicate(t *testing.T) {
 					resource.TestCheckResourceAttr(
 						resourceName, "elasticsearch_version", "1.5"),
 				),
-				ExpectError: regexp.MustCompile(`Elasticsearch Domain .+ already exists`),
+				ExpectError: regexache.MustCompile(`Elasticsearch Domain .+ already exists`),
 			},
 		},
 	})
@@ -591,7 +646,7 @@ func TestAccElasticsearchDomain_AutoTuneOptions(t *testing.T) {
 					testAccCheckDomainExists(ctx, resourceName, &domain),
 					resource.TestCheckResourceAttr(
 						resourceName, "elasticsearch_version", "6.7"),
-					resource.TestMatchResourceAttr(resourceName, "kibana_endpoint", regexp.MustCompile(`.*es\..*/_plugin/kibana/`)),
+					resource.TestMatchResourceAttr(resourceName, "kibana_endpoint", regexache.MustCompile(`.*es\..*/_plugin/kibana/`)),
 					resource.TestCheckResourceAttr(resourceName, "auto_tune_options.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "auto_tune_options.0.desired_state", "ENABLED"),
 					resource.TestCheckResourceAttr(resourceName, "auto_tune_options.0.maintenance_schedule.#", "1"),
@@ -1426,6 +1481,55 @@ func TestAccElasticsearchDomain_VolumeType_update(t *testing.T) {
 		}})
 }
 
+// Verifies that EBS volume_type can be changed from gp3 to a type which does not
+// support the throughput and iops input values (ex. gp2)
+//
+// Reference: https://github.com/hashicorp/terraform-provider-aws/issues/32613
+func TestAccElasticsearchDomain_VolumeType_gp3ToGP2(t *testing.T) {
+	ctx := acctest.Context(t)
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
+	var input elasticsearch.ElasticsearchDomainStatus
+	rName := testAccRandomDomainName()
+	resourceName := "aws_elasticsearch_domain.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheckIAMServiceLinkedRole(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, elasticsearch.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckDomainDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccDomainConfig_clusterEBSVolumeGP3DefaultIopsThroughput(rName, 10),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckDomainExists(ctx, resourceName, &input),
+					resource.TestCheckResourceAttr(resourceName, "ebs_options.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "ebs_options.0.ebs_enabled", "true"),
+					resource.TestCheckResourceAttr(resourceName, "ebs_options.0.volume_size", "10"),
+					resource.TestCheckResourceAttr(resourceName, "ebs_options.0.volume_type", "gp3"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateId:     rName,
+				ImportStateVerify: true,
+			},
+			{
+				Config: testAccDomainConfig_clusterEBSVolumeGP2(rName, 10),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckDomainExists(ctx, resourceName, &input),
+					resource.TestCheckResourceAttr(resourceName, "ebs_options.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "ebs_options.0.ebs_enabled", "true"),
+					resource.TestCheckResourceAttr(resourceName, "ebs_options.0.volume_size", "10"),
+					resource.TestCheckResourceAttr(resourceName, "ebs_options.0.volume_type", "gp2"),
+				),
+			},
+		}})
+}
+
 // Reference: https://github.com/hashicorp/terraform-provider-aws/issues/13867
 func TestAccElasticsearchDomain_VolumeType_missing(t *testing.T) {
 	if testing.Short() {
@@ -2114,6 +2218,44 @@ resource "aws_elasticsearch_domain" "test" {
 `, rName, volumeSize, volumeThroughput, volumeIops)
 }
 
+func testAccDomainConfig_clusterEBSVolumeGP3DefaultIopsThroughput(rName string, volumeSize int) string {
+	return fmt.Sprintf(`
+resource "aws_elasticsearch_domain" "test" {
+  domain_name           = %[1]q
+  elasticsearch_version = "7.10"
+
+  ebs_options {
+    ebs_enabled = true
+    volume_size = %[2]d
+    volume_type = "gp3"
+  }
+
+  cluster_config {
+    instance_type = "t3.small.elasticsearch"
+  }
+}
+`, rName, volumeSize)
+}
+
+func testAccDomainConfig_clusterEBSVolumeGP2(rName string, volumeSize int) string {
+	return fmt.Sprintf(`
+resource "aws_elasticsearch_domain" "test" {
+  domain_name           = %[1]q
+  elasticsearch_version = "7.10"
+
+  ebs_options {
+    ebs_enabled = true
+    volume_size = %[2]d
+    volume_type = "gp2"
+  }
+
+  cluster_config {
+    instance_type = "t3.small.elasticsearch"
+  }
+}
+`, rName, volumeSize)
+}
+
 func testAccDomainConfig_clusterUpdateVersion(rName, version string) string {
 	return fmt.Sprintf(`
 resource "aws_elasticsearch_domain" "test" {
@@ -2912,16 +3054,16 @@ func testAccDomainConfig_logPublishingOptions(rName, logType string) string {
 			  master_user_password = "Barbarbarbar1!"
 			}
 	  	}
-	
+
 		domain_endpoint_options {
 	  		enforce_https       = true
 	  		tls_security_policy = "Policy-Min-TLS-1-2-2019-07"
 		}
-	
+
 		encrypt_at_rest {
 			enabled = true
 		}
-	
+
 		node_to_node_encryption {
 			enabled = true
 		}`
diff --git a/internal/service/elasticsearch/exports_test.go b/internal/service/elasticsearch/exports_test.go
new file mode 100644
index 00000000000..8e98793e424
--- /dev/null
+++ b/internal/service/elasticsearch/exports_test.go
@@ -0,0 +1,9 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+package elasticsearch
+
+// Exports for use in tests only.
+var (
+	FindVPCEndpointByID = findVPCEndpointByID
+	VPCEndpointsError   = vpcEndpointsError
+)
diff --git a/internal/service/elasticsearch/find.go b/internal/service/elasticsearch/find.go
index aaf67806021..41bf9b858de 100644
--- a/internal/service/elasticsearch/find.go
+++ b/internal/service/elasticsearch/find.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elasticsearch
 
 import (
diff --git a/internal/service/elasticsearch/flex.go b/internal/service/elasticsearch/flex.go
index b0d1a5b0295..a620dde0348 100644
--- a/internal/service/elasticsearch/flex.go
+++ b/internal/service/elasticsearch/flex.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elasticsearch
 
 import (
@@ -76,17 +79,19 @@ func expandEBSOptions(m map[string]interface{}) *elasticsearch.EBSOptions {
 		options.EBSEnabled = aws.Bool(ebsEnabled.(bool))
 
 		if ebsEnabled.(bool) {
-			if v, ok := m["iops"]; ok && v.(int) > 0 {
-				options.Iops = aws.Int64(int64(v.(int)))
-			}
-			if v, ok := m["throughput"]; ok && v.(int) > 0 {
-				options.Throughput = aws.Int64(int64(v.(int)))
-			}
 			if v, ok := m["volume_size"]; ok && v.(int) > 0 {
 				options.VolumeSize = aws.Int64(int64(v.(int)))
 			}
+			var volumeType string
 			if v, ok := m["volume_type"]; ok && v.(string) != "" {
-				options.VolumeType = aws.String(v.(string))
+				volumeType = v.(string)
+				options.VolumeType = aws.String(volumeType)
+			}
+			if v, ok := m["iops"]; ok && v.(int) > 0 && EBSVolumeTypePermitsIopsInput(volumeType) {
+				options.Iops = aws.Int64(int64(v.(int)))
+			}
+			if v, ok := m["throughput"]; ok && v.(int) > 0 && EBSVolumeTypePermitsThroughputInput(volumeType) {
+				options.Throughput = aws.Int64(int64(v.(int)))
 			}
 		}
 	}
@@ -108,13 +113,17 @@ func expandEncryptAtRestOptions(m map[string]interface{}) *elasticsearch.Encrypt
 }
 
 func expandVPCOptions(m map[string]interface{}) *elasticsearch.VPCOptions {
+	if m == nil {
+		return nil
+	}
+
 	options := elasticsearch.VPCOptions{}
 
-	if v, ok := m["security_group_ids"]; ok {
-		options.SecurityGroupIds = flex.ExpandStringSet(v.(*schema.Set))
+	if v, ok := m["security_group_ids"].(*schema.Set); ok && v.Len() > 0 {
+		options.SecurityGroupIds = flex.ExpandStringSet(v)
 	}
-	if v, ok := m["subnet_ids"]; ok {
-		options.SubnetIds = flex.ExpandStringSet(v.(*schema.Set))
+	if v, ok := m["subnet_ids"].(*schema.Set); ok && v.Len() > 0 {
+		options.SubnetIds = flex.ExpandStringSet(v)
 	}
 
 	return &options
@@ -210,7 +219,11 @@ func flattenSnapshotOptions(snapshotOptions *elasticsearch.SnapshotOptions) []ma
 	return []map[string]interface{}{m}
 }
 
-func flattenVPCDerivedInfo(o *elasticsearch.VPCDerivedInfo) []map[string]interface{} {
+func flattenVPCDerivedInfo(o *elasticsearch.VPCDerivedInfo) map[string]interface{} {
+	if o == nil {
+		return nil
+	}
+
 	m := map[string]interface{}{}
 
 	if o.AvailabilityZones != nil {
@@ -226,5 +239,5 @@ func flattenVPCDerivedInfo(o *elasticsearch.VPCDerivedInfo) []map[string]interfa
 		m["vpc_id"] = aws.StringValue(o.VPCId)
 	}
 
-	return []map[string]interface{}{m}
+	return m
 }
diff --git a/internal/service/elasticsearch/generate.go b/internal/service/elasticsearch/generate.go
index b8483faf7d7..362e91cd0ae 100644
--- a/internal/service/elasticsearch/generate.go
+++ b/internal/service/elasticsearch/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTags -ListTagsOp=ListTags -ListTagsInIDElem=ARN -ListTagsOutTagsElem=TagList -ServiceTagsSlice -TagOp=AddTags -TagInIDElem=ARN -TagInTagsElem=TagList -UntagOp=RemoveTags -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/elasticsearch/service_package_gen.go b/internal/service/elasticsearch/service_package_gen.go
index b5faa318f52..af4b5be0f03 100644
--- a/internal/service/elasticsearch/service_package_gen.go
+++ b/internal/service/elasticsearch/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	elasticsearchservice_sdkv1 "github.com/aws/aws-sdk-go/service/elasticsearchservice"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -49,6 +50,10 @@ func (p *servicePackage) SDKResources(ctx context.Context) []*types.ServicePacka
 			Factory:  ResourceDomainSAMLOptions,
 			TypeName: "aws_elasticsearch_domain_saml_options",
 		},
+		{
+			Factory:  ResourceVPCEndpoint,
+			TypeName: "aws_elasticsearch_vpc_endpoint",
+		},
 	}
 }
 
@@ -63,4 +68,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*e
 	return elasticsearchservice_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/elasticsearch/status.go b/internal/service/elasticsearch/status.go
index dd51fff6506..5ce295a7c77 100644
--- a/internal/service/elasticsearch/status.go
+++ b/internal/service/elasticsearch/status.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elasticsearch
 
 import (
diff --git a/internal/service/elasticsearch/sweep.go b/internal/service/elasticsearch/sweep.go
index 3e77a185a65..620b7604642 100644
--- a/internal/service/elasticsearch/sweep.go
+++ b/internal/service/elasticsearch/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package elasticsearch
 
@@ -12,9 +12,10 @@ import (
 	"github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_elasticsearch_domain", &resource.Sweeper{
 		Name: "aws_elasticsearch_domain",
 		F:    sweepDomains,
@@ -23,7 +24,7 @@ func init() {
 
 func sweepDomains(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
@@ -38,7 +39,7 @@ func sweepDomains(region string) error {
 	// ListDomainNames has no pagination support whatsoever
 	output, err := conn.ListDomainNamesWithContext(ctx, input)
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Elasticsearch Domain sweep for %s: %s", region, err)
 		return errs.ErrorOrNil()
 	}
@@ -62,6 +63,11 @@ func sweepDomains(region string) error {
 
 		name := aws.StringValue(domainInfo.DomainName)
 
+		if engineType := aws.StringValue(domainInfo.EngineType); engineType != elasticsearchservice.EngineTypeElasticsearch {
+			log.Printf("[INFO] Skipping Elasticsearch Domain %s: EngineType = %s", name, engineType)
+			continue
+		}
+
 		// Elasticsearch Domains have regularly gotten stuck in a "being deleted" state
 		// e.g. Deleted and Processing are both true for days in the API
 		// Filter out domains that are Deleted already.
@@ -87,11 +93,11 @@ func sweepDomains(region string) error {
 		sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
 	}
 
-	if err = sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err = sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("error sweeping Elasticsearch Domains for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
+	if awsv1.SkipSweepError(errs.ErrorOrNil()) {
 		log.Printf("[WARN] Skipping Elasticsearch Domain sweep for %s: %s", region, errs)
 		return nil
 	}
diff --git a/internal/service/elasticsearch/tags_gen.go b/internal/service/elasticsearch/tags_gen.go
index 70f310da133..cc9182a1f3a 100644
--- a/internal/service/elasticsearch/tags_gen.go
+++ b/internal/service/elasticsearch/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/elasticsearchservice"
 	"github.com/aws/aws-sdk-go/service/elasticsearchservice/elasticsearchserviceiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -102,6 +104,8 @@ func updateTags(ctx context.Context, conn elasticsearchserviceiface.Elasticsearc
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.Elasticsearch)
 	if len(removedTags) > 0 {
diff --git a/internal/service/elasticsearch/vpc_endpoint.go b/internal/service/elasticsearch/vpc_endpoint.go
new file mode 100644
index 00000000000..5c10b19e44b
--- /dev/null
+++ b/internal/service/elasticsearch/vpc_endpoint.go
@@ -0,0 +1,331 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package elasticsearch
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"log"
+	"time"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/elasticsearchservice"
+	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/internal/verify"
+)
+
+// @SDKResource("aws_elasticsearch_vpc_endpoint")
+func ResourceVPCEndpoint() *schema.Resource {
+	return &schema.Resource{
+		CreateWithoutTimeout: resourceVPCEndpointCreate,
+		ReadWithoutTimeout:   resourceVPCEndpointRead,
+		UpdateWithoutTimeout: resourceVPCEndpointUpdate,
+		DeleteWithoutTimeout: resourceVPCEndpointDelete,
+
+		Importer: &schema.ResourceImporter{
+			StateContext: schema.ImportStatePassthroughContext,
+		},
+
+		Timeouts: &schema.ResourceTimeout{
+			Create: schema.DefaultTimeout(60 * time.Minute),
+			Update: schema.DefaultTimeout(60 * time.Minute),
+			Delete: schema.DefaultTimeout(90 * time.Minute),
+		},
+
+		Schema: map[string]*schema.Schema{
+			"domain_arn": {
+				Type:         schema.TypeString,
+				Required:     true,
+				ForceNew:     true,
+				ValidateFunc: verify.ValidARN,
+			},
+			"endpoint": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"vpc_options": {
+				Type:     schema.TypeList,
+				Required: true,
+				MaxItems: 1,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"availability_zones": {
+							Type:     schema.TypeSet,
+							Computed: true,
+							Elem:     &schema.Schema{Type: schema.TypeString},
+						},
+						"security_group_ids": {
+							Type:     schema.TypeSet,
+							Optional: true,
+							Computed: true,
+							Elem:     &schema.Schema{Type: schema.TypeString},
+						},
+						"subnet_ids": {
+							Type:     schema.TypeSet,
+							Required: true,
+							Elem:     &schema.Schema{Type: schema.TypeString},
+						},
+						"vpc_id": {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+					},
+				},
+			},
+		},
+	}
+}
+
+func resourceVPCEndpointCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).ElasticsearchConn(ctx)
+
+	input := &elasticsearchservice.CreateVpcEndpointInput{
+		DomainArn:  aws.String(d.Get("domain_arn").(string)),
+		VpcOptions: expandVPCOptions(d.Get("vpc_options").([]interface{})[0].(map[string]interface{})),
+	}
+
+	output, err := conn.CreateVpcEndpointWithContext(ctx, input)
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "creating Elasticsearch VPC Endpoint: %s", err)
+	}
+
+	d.SetId(aws.StringValue(output.VpcEndpoint.VpcEndpointId))
+
+	if err := waitVPCEndpointCreated(ctx, conn, d.Id(), d.Timeout(schema.TimeoutCreate)); err != nil {
+		return sdkdiag.AppendErrorf(diags, "waiting for Elasticsearch VPC Endpoint (%s) create: %s", d.Id(), err)
+	}
+
+	return append(diags, resourceVPCEndpointRead(ctx, d, meta)...)
+}
+
+func resourceVPCEndpointRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).ElasticsearchConn(ctx)
+
+	endpoint, err := findVPCEndpointByID(ctx, conn, d.Id())
+
+	if !d.IsNewResource() && tfresource.NotFound(err) {
+		log.Printf("[WARN] Elasticsearch VPC Endpoint (%s) not found, removing from state", d.Id())
+		d.SetId("")
+		return diags
+	}
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "reading Elasticsearch VPC Endpoint (%s): %s", d.Id(), err)
+	}
+
+	d.Set("domain_arn", endpoint.DomainArn)
+	d.Set("endpoint", endpoint.Endpoint)
+	if endpoint.VpcOptions != nil {
+		if err := d.Set("vpc_options", []interface{}{flattenVPCDerivedInfo(endpoint.VpcOptions)}); err != nil {
+			return diag.Errorf("setting vpc_options: %s", err)
+		}
+	} else {
+		d.Set("vpc_options", nil)
+	}
+
+	return diags
+}
+
+func resourceVPCEndpointUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).ElasticsearchConn(ctx)
+
+	input := &elasticsearchservice.UpdateVpcEndpointInput{
+		VpcOptions:    expandVPCOptions(d.Get("vpc_options").([]interface{})[0].(map[string]interface{})),
+		VpcEndpointId: aws.String(d.Id()),
+	}
+
+	_, err := conn.UpdateVpcEndpointWithContext(ctx, input)
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "updating Elasticsearch VPC Endpoint (%s): %s", d.Id(), err)
+	}
+
+	if err := waitVPCEndpointUpdated(ctx, conn, d.Id(), d.Timeout(schema.TimeoutUpdate)); err != nil {
+		return sdkdiag.AppendErrorf(diags, "waiting for Elasticsearch VPC Endpoint (%s) update: %s", d.Id(), err)
+	}
+
+	return append(diags, resourceVPCEndpointRead(ctx, d, meta)...)
+}
+
+func resourceVPCEndpointDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).ElasticsearchConn(ctx)
+
+	log.Printf("[DEBUG] Deleting Elasticsearch VPC Endpoint: %s", d.Id())
+	_, err := conn.DeleteVpcEndpointWithContext(ctx, &elasticsearchservice.DeleteVpcEndpointInput{
+		VpcEndpointId: aws.String(d.Id()),
+	})
+
+	if tfawserr.ErrCodeEquals(err, elasticsearchservice.ErrCodeResourceNotFoundException) {
+		return diags
+	}
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "deleting Elasticsearch VPC Endpoint (%s): %s", d.Id(), err)
+	}
+
+	if err := waitVPCEndpointDeleted(ctx, conn, d.Id(), d.Timeout(schema.TimeoutDelete)); err != nil {
+		return sdkdiag.AppendErrorf(diags, "waiting for Elasticsearch VPC Endpoint (%s) delete: %s", d.Id(), err)
+	}
+
+	return diags
+}
+
+type vpcEndpointNotFoundError struct {
+	apiError error
+}
+
+func (e *vpcEndpointNotFoundError) Error() string {
+	if e.apiError != nil {
+		return e.apiError.Error()
+	}
+
+	return "VPC endpoint not found"
+}
+
+func (e *vpcEndpointNotFoundError) Is(err error) bool {
+	_, ok := err.(*vpcEndpointNotFoundError)
+	return ok
+}
+
+func (e *vpcEndpointNotFoundError) As(target any) bool {
+	t, ok := target.(**retry.NotFoundError)
+	if !ok {
+		return false
+	}
+
+	*t = &retry.NotFoundError{
+		Message: e.Error(),
+	}
+
+	return true
+}
+
+func vpcEndpointError(apiObject *elasticsearchservice.VpcEndpointError) error {
+	if apiObject == nil {
+		return nil
+	}
+
+	errorCode := aws.StringValue(apiObject.ErrorCode)
+	innerError := fmt.Errorf("%s: %s", errorCode, aws.StringValue(apiObject.ErrorMessage))
+	err := fmt.Errorf("%s: %w", aws.StringValue(apiObject.VpcEndpointId), innerError)
+
+	if errorCode == elasticsearchservice.VpcEndpointErrorCodeEndpointNotFound {
+		err = &vpcEndpointNotFoundError{apiError: err}
+	}
+
+	return err
+}
+
+func vpcEndpointsError(apiObjects []*elasticsearchservice.VpcEndpointError) error {
+	var errs []error
+
+	for _, apiObject := range apiObjects {
+		errs = append(errs, vpcEndpointError(apiObject))
+	}
+
+	return errors.Join(errs...)
+}
+
+func findVPCEndpointByID(ctx context.Context, conn *elasticsearchservice.ElasticsearchService, id string) (*elasticsearchservice.VpcEndpoint, error) {
+	input := &elasticsearchservice.DescribeVpcEndpointsInput{
+		VpcEndpointIds: aws.StringSlice([]string{id}),
+	}
+
+	return findVPCEndpoint(ctx, conn, input)
+}
+
+func findVPCEndpoint(ctx context.Context, conn *elasticsearchservice.ElasticsearchService, input *elasticsearchservice.DescribeVpcEndpointsInput) (*elasticsearchservice.VpcEndpoint, error) {
+	output, err := findVPCEndpoints(ctx, conn, input)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return tfresource.AssertSinglePtrResult(output)
+}
+
+func findVPCEndpoints(ctx context.Context, conn *elasticsearchservice.ElasticsearchService, input *elasticsearchservice.DescribeVpcEndpointsInput) ([]*elasticsearchservice.VpcEndpoint, error) {
+	output, err := conn.DescribeVpcEndpointsWithContext(ctx, input)
+
+	if err != nil {
+		return nil, err
+	}
+
+	if output == nil {
+		return nil, tfresource.NewEmptyResultError(input)
+	}
+
+	if errs := output.VpcEndpointErrors; len(errs) > 0 {
+		return nil, vpcEndpointsError(errs)
+	}
+
+	return output.VpcEndpoints, nil
+}
+
+func statusVPCEndpoint(ctx context.Context, conn *elasticsearchservice.ElasticsearchService, id string) retry.StateRefreshFunc {
+	return func() (interface{}, string, error) {
+		output, err := findVPCEndpointByID(ctx, conn, id)
+
+		if tfresource.NotFound(err) {
+			return nil, "", nil
+		}
+
+		if err != nil {
+			return nil, "", err
+		}
+
+		return output, aws.StringValue(output.Status), nil
+	}
+}
+
+func waitVPCEndpointCreated(ctx context.Context, conn *elasticsearchservice.ElasticsearchService, id string, timeout time.Duration) error {
+	stateConf := &retry.StateChangeConf{
+		Pending: []string{elasticsearchservice.VpcEndpointStatusCreating},
+		Target:  []string{elasticsearchservice.VpcEndpointStatusActive},
+		Refresh: statusVPCEndpoint(ctx, conn, id),
+		Timeout: timeout,
+	}
+
+	_, err := stateConf.WaitForStateContext(ctx)
+
+	return err
+}
+
+func waitVPCEndpointUpdated(ctx context.Context, conn *elasticsearchservice.ElasticsearchService, id string, timeout time.Duration) error {
+	stateConf := &retry.StateChangeConf{
+		Pending: []string{elasticsearchservice.VpcEndpointStatusUpdating},
+		Target:  []string{elasticsearchservice.VpcEndpointStatusActive},
+		Refresh: statusVPCEndpoint(ctx, conn, id),
+		Timeout: timeout,
+	}
+
+	_, err := stateConf.WaitForStateContext(ctx)
+
+	return err
+}
+
+func waitVPCEndpointDeleted(ctx context.Context, conn *elasticsearchservice.ElasticsearchService, id string, timeout time.Duration) error {
+	stateConf := &retry.StateChangeConf{
+		Pending: []string{elasticsearchservice.VpcEndpointStatusDeleting},
+		Target:  []string{},
+		Refresh: statusVPCEndpoint(ctx, conn, id),
+		Timeout: timeout,
+	}
+
+	_, err := stateConf.WaitForStateContext(ctx)
+
+	return err
+}
diff --git a/internal/service/elasticsearch/vpc_endpoint_test.go b/internal/service/elasticsearch/vpc_endpoint_test.go
new file mode 100644
index 00000000000..3d2ab82802b
--- /dev/null
+++ b/internal/service/elasticsearch/vpc_endpoint_test.go
@@ -0,0 +1,348 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package elasticsearch_test
+
+import (
+	"context"
+	"fmt"
+	"testing"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/elasticsearchservice"
+	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
+	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	tfelasticsearch "github.com/hashicorp/terraform-provider-aws/internal/service/elasticsearch"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+)
+
+func TestVPCEndpointErrorsNotFound(t *testing.T) {
+	t.Parallel()
+
+	testCases := []struct {
+		name       string
+		apiObjects []*elasticsearchservice.VpcEndpointError
+		notFound   bool
+	}{
+		{
+			name: "nil input",
+		},
+		{
+			name:       "slice of nil input",
+			apiObjects: []*elasticsearchservice.VpcEndpointError{nil, nil},
+		},
+		{
+			name: "single SERVER_ERROR",
+			apiObjects: []*elasticsearchservice.VpcEndpointError{{
+				ErrorCode:     aws.String(elasticsearchservice.VpcEndpointErrorCodeServerError),
+				ErrorMessage:  aws.String("fail"),
+				VpcEndpointId: aws.String("aos-12345678"),
+			}},
+		},
+		{
+			name: "single ENDPOINT_NOT_FOUND",
+			apiObjects: []*elasticsearchservice.VpcEndpointError{{
+				ErrorCode:     aws.String(elasticsearchservice.VpcEndpointErrorCodeEndpointNotFound),
+				ErrorMessage:  aws.String("Endpoint does not exist"),
+				VpcEndpointId: aws.String("aos-12345678"),
+			}},
+			notFound: true,
+		},
+		{
+			name: "no ENDPOINT_NOT_FOUND in many",
+			apiObjects: []*elasticsearchservice.VpcEndpointError{
+				{
+					ErrorCode:     aws.String(elasticsearchservice.VpcEndpointErrorCodeServerError),
+					ErrorMessage:  aws.String("fail"),
+					VpcEndpointId: aws.String("aos-abcd0123"),
+				},
+				{
+					ErrorCode:     aws.String(elasticsearchservice.VpcEndpointErrorCodeServerError),
+					ErrorMessage:  aws.String("crash"),
+					VpcEndpointId: aws.String("aos-12345678"),
+				},
+			},
+		},
+		{
+			name: "single ENDPOINT_NOT_FOUND in many",
+			apiObjects: []*elasticsearchservice.VpcEndpointError{
+				{
+					ErrorCode:     aws.String(elasticsearchservice.VpcEndpointErrorCodeServerError),
+					ErrorMessage:  aws.String("fail"),
+					VpcEndpointId: aws.String("aos-abcd0123"),
+				},
+				{
+					ErrorCode:     aws.String(elasticsearchservice.VpcEndpointErrorCodeEndpointNotFound),
+					ErrorMessage:  aws.String("Endpoint does not exist"),
+					VpcEndpointId: aws.String("aos-12345678"),
+				},
+			},
+			notFound: true,
+		},
+	}
+
+	for _, testCase := range testCases {
+		testCase := testCase
+		t.Run(testCase.name, func(t *testing.T) {
+			t.Parallel()
+
+			if got, want := tfresource.NotFound(tfelasticsearch.VPCEndpointsError(testCase.apiObjects)), testCase.notFound; got != want {
+				t.Errorf("NotFound = %v, want %v", got, want)
+			}
+		})
+	}
+}
+
+func TestAccElasticsearchVPCEndpoint_basic(t *testing.T) {
+	ctx := acctest.Context(t)
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
+	var v elasticsearchservice.VpcEndpoint
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	domainName := testAccRandomDomainName()
+	resourceName := "aws_elasticsearch_vpc_endpoint.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, elasticsearchservice.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckVPCEndpointDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccVPCEndpointConfig_basic(rName, domainName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckVPCEndpointExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttrSet(resourceName, "endpoint"),
+					resource.TestCheckResourceAttr(resourceName, "vpc_options.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "vpc_options.0.availability_zones.#", "2"),
+					resource.TestCheckResourceAttr(resourceName, "vpc_options.0.security_group_ids.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "vpc_options.0.subnet_ids.#", "2"),
+					resource.TestCheckResourceAttrSet(resourceName, "vpc_options.0.vpc_id"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
+func TestAccElasticsearchVPCEndpoint_disappears(t *testing.T) {
+	ctx := acctest.Context(t)
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
+	var v elasticsearchservice.VpcEndpoint
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	domainName := testAccRandomDomainName()
+	resourceName := "aws_elasticsearch_vpc_endpoint.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, elasticsearchservice.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckVPCEndpointDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccVPCEndpointConfig_basic(rName, domainName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckVPCEndpointExists(ctx, resourceName, &v),
+					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfelasticsearch.ResourceVPCEndpoint(), resourceName),
+				),
+				ExpectNonEmptyPlan: true,
+			},
+		},
+	})
+}
+
+func TestAccElasticsearchVPCEndpoint_update(t *testing.T) {
+	ctx := acctest.Context(t)
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
+	var v elasticsearchservice.VpcEndpoint
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	domainName := testAccRandomDomainName()
+	resourceName := "aws_elasticsearch_vpc_endpoint.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, elasticsearchservice.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckVPCEndpointDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccVPCEndpointConfig_basic(rName, domainName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckVPCEndpointExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttrSet(resourceName, "endpoint"),
+					resource.TestCheckResourceAttr(resourceName, "vpc_options.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "vpc_options.0.availability_zones.#", "2"),
+					resource.TestCheckResourceAttr(resourceName, "vpc_options.0.security_group_ids.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "vpc_options.0.subnet_ids.#", "2"),
+					resource.TestCheckResourceAttrSet(resourceName, "vpc_options.0.vpc_id"),
+				),
+			},
+			{
+				Config: testAccVPCEndpointConfig_updated(rName, domainName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckVPCEndpointExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttrSet(resourceName, "endpoint"),
+					resource.TestCheckResourceAttr(resourceName, "vpc_options.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "vpc_options.0.availability_zones.#", "2"),
+					resource.TestCheckResourceAttr(resourceName, "vpc_options.0.security_group_ids.#", "2"),
+					resource.TestCheckResourceAttr(resourceName, "vpc_options.0.subnet_ids.#", "2"),
+					resource.TestCheckResourceAttrSet(resourceName, "vpc_options.0.vpc_id"),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckVPCEndpointExists(ctx context.Context, n string, v *elasticsearchservice.VpcEndpoint) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		conn := acctest.Provider.Meta().(*conns.AWSClient).ElasticsearchConn(ctx)
+
+		output, err := tfelasticsearch.FindVPCEndpointByID(ctx, conn, rs.Primary.ID)
+
+		if err != nil {
+			return err
+		}
+
+		*v = *output
+
+		return nil
+	}
+}
+
+func testAccCheckVPCEndpointDestroy(ctx context.Context) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		for _, rs := range s.RootModule().Resources {
+			if rs.Type != "aws_elasticsearch_vpc_endpoint" {
+				continue
+			}
+
+			conn := acctest.Provider.Meta().(*conns.AWSClient).ElasticsearchConn(ctx)
+
+			_, err := tfelasticsearch.FindVPCEndpointByID(ctx, conn, rs.Primary.ID)
+
+			if tfresource.NotFound(err) {
+				continue
+			}
+
+			if err != nil {
+				return err
+			}
+
+			return fmt.Errorf("elasticsearch VPC Endpoint %s still exists", rs.Primary.ID)
+		}
+
+		return nil
+	}
+}
+
+func testAccVPCEndpointConfig_base(rName, domainName string) string {
+	return acctest.ConfigCompose(acctest.ConfigVPCWithSubnets(rName, 2), fmt.Sprintf(`
+resource "aws_security_group" "test" {
+  name   = %[1]q
+  vpc_id = aws_vpc.test.id
+
+  tags = {
+    Name = %[1]q
+  }
+}
+
+resource "aws_elasticsearch_domain" "test" {
+  domain_name = %[2]q
+
+  ebs_options {
+    ebs_enabled = true
+    volume_size = 10
+  }
+
+  cluster_config {
+    instance_count         = 2
+    zone_awareness_enabled = true
+    instance_type          = "t2.medium.elasticsearch"
+  }
+
+  vpc_options {
+    security_group_ids = [aws_security_group.test.id]
+    subnet_ids         = aws_subnet.test[*].id
+  }
+}
+
+resource "aws_vpc" "client" {
+  cidr_block = "10.0.0.0/16"
+
+  enable_dns_support   = true
+  enable_dns_hostnames = true
+
+  tags = {
+    Name = %[1]q
+  }
+}
+
+resource "aws_subnet" "client" {
+  count = 2
+
+  vpc_id            = aws_vpc.client.id
+  availability_zone = data.aws_availability_zones.available.names[count.index]
+  cidr_block        = cidrsubnet(aws_vpc.client.cidr_block, 8, count.index)
+
+  tags = {
+    Name = %[1]q
+  }
+}
+
+resource "aws_security_group" "client" {
+  count = 2
+
+  name   = "%[1]s-client-${count.index}"
+  vpc_id = aws_vpc.client.id
+
+  tags = {
+    Name = %[1]q
+  }
+}
+`, rName, domainName))
+}
+
+func testAccVPCEndpointConfig_basic(rName, domainName string) string {
+	return acctest.ConfigCompose(testAccVPCEndpointConfig_base(rName, domainName), `
+resource "aws_elasticsearch_vpc_endpoint" "test" {
+  domain_arn = aws_elasticsearch_domain.test.arn
+
+  vpc_options {
+    subnet_ids = aws_subnet.client[*].id
+  }
+}
+`)
+}
+
+func testAccVPCEndpointConfig_updated(rName, domainName string) string {
+	return acctest.ConfigCompose(testAccVPCEndpointConfig_base(rName, domainName), `
+resource "aws_elasticsearch_vpc_endpoint" "test" {
+  domain_arn = aws_elasticsearch_domain.test.arn
+
+  vpc_options {
+    subnet_ids         = aws_subnet.client[*].id
+    security_group_ids = aws_security_group.client[*].id
+  }
+}
+`)
+}
diff --git a/internal/service/elasticsearch/wait.go b/internal/service/elasticsearch/wait.go
index 4bedb96dc98..6d7d6326e06 100644
--- a/internal/service/elasticsearch/wait.go
+++ b/internal/service/elasticsearch/wait.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elasticsearch
 
 import (
diff --git a/internal/service/elastictranscoder/generate.go b/internal/service/elastictranscoder/generate.go
index b6caa9decd4..f70c4d3760b 100644
--- a/internal/service/elastictranscoder/generate.go
+++ b/internal/service/elastictranscoder/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
 
diff --git a/internal/service/elastictranscoder/pipeline.go b/internal/service/elastictranscoder/pipeline.go
index ac8f858e5f4..0ea2fba8bdb 100644
--- a/internal/service/elastictranscoder/pipeline.go
+++ b/internal/service/elastictranscoder/pipeline.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elastictranscoder
 
 import (
 	"context"
 	"log"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/elastictranscoder"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -114,7 +117,7 @@ func ResourcePipeline() *schema.Resource {
 				Computed: true,
 				ForceNew: true,
 				ValidateFunc: validation.All(
-					validation.StringMatch(regexp.MustCompile(`^[.0-9A-Za-z-_]+$`),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_.-]+$`),
 						"only alphanumeric characters, hyphens, underscores, and periods allowed"),
 					validation.StringLenBetween(1, 40),
 				),
diff --git a/internal/service/elastictranscoder/pipeline_test.go b/internal/service/elastictranscoder/pipeline_test.go
index bcc104206e1..33d923bbcea 100644
--- a/internal/service/elastictranscoder/pipeline_test.go
+++ b/internal/service/elastictranscoder/pipeline_test.go
@@ -1,13 +1,16 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elastictranscoder_test
 
 import (
 	"context"
 	"fmt"
 	"reflect"
-	"regexp"
 	"sort"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/elastictranscoder"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -35,7 +38,7 @@ func TestAccElasticTranscoderPipeline_basic(t *testing.T) {
 				Config: testAccPipelineConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckPipelineExists(ctx, resourceName, pipeline),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elastictranscoder", regexp.MustCompile(`pipeline/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elastictranscoder", regexache.MustCompile(`pipeline/.+`)),
 				),
 			},
 			{
@@ -334,11 +337,6 @@ EOF
 resource "aws_s3_bucket" "test" {
   bucket = %[1]q
 }
-
-resource "aws_s3_bucket_acl" "test" {
-  bucket = aws_s3_bucket.test.id
-  acl    = "private"
-}
 `, rName)
 }
 
@@ -396,11 +394,6 @@ EOF
 resource "aws_s3_bucket" "test" {
   bucket = %[1]q
 }
-
-resource "aws_s3_bucket_acl" "test" {
-  bucket = aws_s3_bucket.test.id
-  acl    = "private"
-}
 `, rName)
 }
 
@@ -446,28 +439,13 @@ resource "aws_s3_bucket" "content_bucket" {
   bucket = "%[1]s-content"
 }
 
-resource "aws_s3_bucket_acl" "content_bucket_acl" {
-  bucket = aws_s3_bucket.content_bucket.id
-  acl    = "private"
-}
-
 resource "aws_s3_bucket" "input_bucket" {
   bucket = "%[1]s-input"
 }
 
-resource "aws_s3_bucket_acl" "input_bucket_acl" {
-  bucket = aws_s3_bucket.input_bucket.id
-  acl    = "private"
-}
-
 resource "aws_s3_bucket" "thumb_bucket" {
   bucket = "%[1]s-thumb"
 }
-
-resource "aws_s3_bucket_acl" "thumb_bucket_acl" {
-  bucket = aws_s3_bucket.thumb_bucket.id
-  acl    = "private"
-}
 `, rName)
 }
 
@@ -513,28 +491,13 @@ resource "aws_s3_bucket" "content_bucket" {
   bucket = "%[1]s-content"
 }
 
-resource "aws_s3_bucket_acl" "content_bucket_acl" {
-  bucket = aws_s3_bucket.content_bucket.id
-  acl    = "private"
-}
-
 resource "aws_s3_bucket" "input_bucket" {
   bucket = "%[1]s-input"
 }
 
-resource "aws_s3_bucket_acl" "input_bucket_acl" {
-  bucket = aws_s3_bucket.input_bucket.id
-  acl    = "private"
-}
-
 resource "aws_s3_bucket" "thumb_bucket" {
   bucket = "%[1]s-thumb"
 }
-
-resource "aws_s3_bucket_acl" "thumb_bucket_acl" {
-  bucket = aws_s3_bucket.thumb_bucket.id
-  acl    = "private"
-}
 `, rName)
 }
 
@@ -591,11 +554,6 @@ EOF
 resource "aws_s3_bucket" "test" {
   bucket = %[1]q
 }
-
-resource "aws_s3_bucket_acl" "test" {
-  bucket = aws_s3_bucket.test.id
-  acl    = "private"
-}
 `, rName)
 }
 
@@ -637,11 +595,6 @@ resource "aws_s3_bucket" "test" {
   bucket = %[1]q
 }
 
-resource "aws_s3_bucket_acl" "test" {
-  bucket = aws_s3_bucket.test.id
-  acl    = "private"
-}
-
 resource "aws_sns_topic" "test" {
   name = %[1]q
 
@@ -701,11 +654,6 @@ resource "aws_s3_bucket" "test" {
   bucket = %[1]q
 }
 
-resource "aws_s3_bucket_acl" "test" {
-  bucket = aws_s3_bucket.test.id
-  acl    = "private"
-}
-
 resource "aws_sns_topic" "test" {
   name = %[1]q
 
diff --git a/internal/service/elastictranscoder/preset.go b/internal/service/elastictranscoder/preset.go
index 89d8f4c50b7..266d6941061 100644
--- a/internal/service/elastictranscoder/preset.go
+++ b/internal/service/elastictranscoder/preset.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elastictranscoder
 
 import (
diff --git a/internal/service/elastictranscoder/preset_test.go b/internal/service/elastictranscoder/preset_test.go
index 24fd3f2bb63..1d6774d74af 100644
--- a/internal/service/elastictranscoder/preset_test.go
+++ b/internal/service/elastictranscoder/preset_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elastictranscoder_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/elastictranscoder"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -33,7 +36,7 @@ func TestAccElasticTranscoderPreset_basic(t *testing.T) {
 				Config: testAccPresetConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckPresetExists(ctx, resourceName, &preset),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elastictranscoder", regexp.MustCompile(`preset/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elastictranscoder", regexache.MustCompile(`preset/.+`)),
 				),
 			},
 			{
diff --git a/internal/service/elastictranscoder/service_package_gen.go b/internal/service/elastictranscoder/service_package_gen.go
index a6b0742a2a4..18c4a859477 100644
--- a/internal/service/elastictranscoder/service_package_gen.go
+++ b/internal/service/elastictranscoder/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	elastictranscoder_sdkv1 "github.com/aws/aws-sdk-go/service/elastictranscoder"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -50,4 +51,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*e
 	return elastictranscoder_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/elb/app_cookie_stickiness_policy.go b/internal/service/elb/app_cookie_stickiness_policy.go
index bba4cc496a4..bb84ac383e2 100644
--- a/internal/service/elb/app_cookie_stickiness_policy.go
+++ b/internal/service/elb/app_cookie_stickiness_policy.go
@@ -1,13 +1,16 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elb
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"strconv"
 	"strings"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/elb"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -52,7 +55,7 @@ func ResourceAppCookieStickinessPolicy() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: func(v interface{}, k string) (ws []string, es []error) {
 					value := v.(string)
-					if !regexp.MustCompile(`^[0-9A-Za-z-]+$`).MatchString(value) {
+					if !regexache.MustCompile(`^[0-9A-Za-z-]+$`).MatchString(value) {
 						es = append(es, fmt.Errorf(
 							"only alphanumeric characters and hyphens allowed in %q", k))
 					}
diff --git a/internal/service/elb/app_cookie_stickiness_policy_test.go b/internal/service/elb/app_cookie_stickiness_policy_test.go
index 60a97e24a3f..70c5ecf2609 100644
--- a/internal/service/elb/app_cookie_stickiness_policy_test.go
+++ b/internal/service/elb/app_cookie_stickiness_policy_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elb_test
 
 import (
diff --git a/internal/service/elb/attachment.go b/internal/service/elb/attachment.go
index 250f0574d31..4dad85856f7 100644
--- a/internal/service/elb/attachment.go
+++ b/internal/service/elb/attachment.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elb
 
 import (
diff --git a/internal/service/elb/attachment_test.go b/internal/service/elb/attachment_test.go
index 1e95cf0af41..2658c2e19de 100644
--- a/internal/service/elb/attachment_test.go
+++ b/internal/service/elb/attachment_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elb_test
 
 import (
diff --git a/internal/service/elb/backend_server_policy.go b/internal/service/elb/backend_server_policy.go
index 2ca6971acdf..7f84b5e6a18 100644
--- a/internal/service/elb/backend_server_policy.go
+++ b/internal/service/elb/backend_server_policy.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elb
 
 import (
diff --git a/internal/service/elb/backend_server_policy_test.go b/internal/service/elb/backend_server_policy_test.go
index 61c2ce86a6f..3c39e29f7ed 100644
--- a/internal/service/elb/backend_server_policy_test.go
+++ b/internal/service/elb/backend_server_policy_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elb_test
 
 import (
diff --git a/internal/service/elb/enum.go b/internal/service/elb/enum.go
index 824e52048d1..527a0fe0999 100644
--- a/internal/service/elb/enum.go
+++ b/internal/service/elb/enum.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elb
 
 const (
diff --git a/internal/service/elb/flex.go b/internal/service/elb/flex.go
index 676525774b2..8ee89ec4c9b 100644
--- a/internal/service/elb/flex.go
+++ b/internal/service/elb/flex.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elb
 
 import (
diff --git a/internal/service/elb/flex_test.go b/internal/service/elb/flex_test.go
index 95266c1621d..fa72b9ef0a5 100644
--- a/internal/service/elb/flex_test.go
+++ b/internal/service/elb/flex_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elb
 
 import (
diff --git a/internal/service/elb/generate.go b/internal/service/elb/generate.go
index 4c1b8ec5fb1..00321adf62d 100644
--- a/internal/service/elb/generate.go
+++ b/internal/service/elb/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTags -ListTagsOp=DescribeTags -ListTagsInIDElem=LoadBalancerNames -ListTagsInIDNeedSlice=yes -ListTagsOutTagsElem=TagDescriptions[0].Tags -ServiceTagsSlice -TagOp=AddTags -TagInIDElem=LoadBalancerNames -TagInIDNeedSlice=yes -TagKeyType=TagKeyOnly -UntagOp=RemoveTags -UntagInNeedTagKeyType=yes -UntagInTagsElem=Tags -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/elb/hosted_zone_id_data_source.go b/internal/service/elb/hosted_zone_id_data_source.go
index 02cbde5cd7f..7248ca2754c 100644
--- a/internal/service/elb/hosted_zone_id_data_source.go
+++ b/internal/service/elb/hosted_zone_id_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elb
 
 import (
@@ -35,6 +38,7 @@ var HostedZoneIdPerRegionMap = map[string]string{
 	endpoints.EuWest1RegionID:      "Z32O12XQLNTSW2",
 	endpoints.EuWest2RegionID:      "ZHURV8PSTC4K8",
 	endpoints.EuWest3RegionID:      "Z3Q77PNBQS71R4",
+	endpoints.IlCentral1RegionID:   "Z09170902867EHPV2DABU",
 	endpoints.MeCentral1RegionID:   "Z08230872XQRWHG2XF6I",
 	endpoints.MeSouth1RegionID:     "ZS929ML54UICD",
 	endpoints.SaEast1RegionID:      "Z2P70J7HTTTPLU",
diff --git a/internal/service/elb/hosted_zone_id_data_source_test.go b/internal/service/elb/hosted_zone_id_data_source_test.go
index 927ae670be8..147f1ff4f20 100644
--- a/internal/service/elb/hosted_zone_id_data_source_test.go
+++ b/internal/service/elb/hosted_zone_id_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elb_test
 
 import (
diff --git a/internal/service/elb/lb_cookie_stickiness_policy.go b/internal/service/elb/lb_cookie_stickiness_policy.go
index b09f4b3818d..e2e25d49f45 100644
--- a/internal/service/elb/lb_cookie_stickiness_policy.go
+++ b/internal/service/elb/lb_cookie_stickiness_policy.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elb
 
 import (
diff --git a/internal/service/elb/lb_cookie_stickiness_policy_test.go b/internal/service/elb/lb_cookie_stickiness_policy_test.go
index 7797ed02a70..26b8d5ef861 100644
--- a/internal/service/elb/lb_cookie_stickiness_policy_test.go
+++ b/internal/service/elb/lb_cookie_stickiness_policy_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elb_test
 
 import (
diff --git a/internal/service/elb/lb_ssl_negotiation_policy.go b/internal/service/elb/lb_ssl_negotiation_policy.go
index 7fcabd2789e..85d14a1fd58 100644
--- a/internal/service/elb/lb_ssl_negotiation_policy.go
+++ b/internal/service/elb/lb_ssl_negotiation_policy.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elb
 
 import (
diff --git a/internal/service/elb/lb_ssl_negotiation_policy_test.go b/internal/service/elb/lb_ssl_negotiation_policy_test.go
index e13fbea95a7..a47e1ae9971 100644
--- a/internal/service/elb/lb_ssl_negotiation_policy_test.go
+++ b/internal/service/elb/lb_ssl_negotiation_policy_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elb_test
 
 import (
diff --git a/internal/service/elb/listener_policy.go b/internal/service/elb/listener_policy.go
index fbeac26de7b..8ac42723a7f 100644
--- a/internal/service/elb/listener_policy.go
+++ b/internal/service/elb/listener_policy.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elb
 
 import (
diff --git a/internal/service/elb/listener_policy_test.go b/internal/service/elb/listener_policy_test.go
index 29c091bbdd0..a65210f1df2 100644
--- a/internal/service/elb/listener_policy_test.go
+++ b/internal/service/elb/listener_policy_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elb_test
 
 import (
diff --git a/internal/service/elb/load_balancer.go b/internal/service/elb/load_balancer.go
index f86a0bf7631..3829935584b 100644
--- a/internal/service/elb/load_balancer.go
+++ b/internal/service/elb/load_balancer.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elb
 
 import ( // nosemgrep:ci.semgrep.aws.multiple-service-imports
@@ -5,11 +8,11 @@ import ( // nosemgrep:ci.semgrep.aws.multiple-service-imports
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"strconv"
 	"strings"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/aws/aws-sdk-go/service/ec2"
@@ -18,7 +21,6 @@ import ( // nosemgrep:ci.semgrep.aws.multiple-service-imports
 	multierror "github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/customdiff"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
@@ -230,6 +232,7 @@ func ResourceLoadBalancer() *schema.Resource {
 			"name_prefix": {
 				Type:          schema.TypeString,
 				Optional:      true,
+				Computed:      true,
 				ForceNew:      true,
 				ConflictsWith: []string{"name"},
 				ValidateFunc:  validNamePrefix,
@@ -269,26 +272,19 @@ func resourceLoadBalancerCreate(ctx context.Context, d *schema.ResourceData, met
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).ELBConn(ctx)
 
-	var elbName string
-	if v, ok := d.GetOk("name"); ok {
-		elbName = v.(string)
-	} else {
-		if v, ok := d.GetOk("name_prefix"); ok {
-			elbName = id.PrefixedUniqueId(v.(string))
-		} else {
-			elbName = id.PrefixedUniqueId("tf-lb-")
-		}
-	}
-
 	listeners, err := ExpandListeners(d.Get("listener").(*schema.Set).List())
-
 	if err != nil {
 		return sdkdiag.AppendFromErr(diags, err)
 	}
 
+	elbName := create.NewNameGenerator(
+		create.WithConfiguredName(d.Get("name").(string)),
+		create.WithConfiguredPrefix(d.Get("name_prefix").(string)),
+		create.WithDefaultPrefix("tf-lb-"),
+	).Generate()
 	input := &elb.CreateLoadBalancerInput{
-		LoadBalancerName: aws.String(elbName),
 		Listeners:        listeners,
+		LoadBalancerName: aws.String(elbName),
 		Tags:             getTagsIn(ctx),
 	}
 
@@ -367,6 +363,7 @@ func resourceLoadBalancerRead(ctx context.Context, d *schema.ResourceData, meta
 	d.Set("internal", scheme)
 	d.Set("listener", flattenListeners(lb.ListenerDescriptions))
 	d.Set("name", lb.LoadBalancerName)
+	d.Set("name_prefix", create.NamePrefixFromName(aws.StringValue(lb.LoadBalancerName)))
 	d.Set("security_groups", flex.FlattenStringList(lb.SecurityGroups))
 	d.Set("subnets", flex.FlattenStringList(lb.Subnets))
 	d.Set("zone_id", lb.CanonicalHostedZoneNameID)
@@ -841,7 +838,7 @@ func ValidHeathCheckTarget(v interface{}, k string) (ws []string, errors []error
 	value := v.(string)
 
 	// Parse the Health Check target value.
-	matches := regexp.MustCompile(`\A(\w+):(\d+)(.+)?\z`).FindStringSubmatch(value)
+	matches := regexache.MustCompile(`\A(\w+):(\d+)(.+)?\z`).FindStringSubmatch(value)
 
 	// Check if the value contains a valid target.
 	if matches == nil || len(matches) < 1 {
diff --git a/internal/service/elb/load_balancer_data_source.go b/internal/service/elb/load_balancer_data_source.go
index 85cc79aecd6..be77f84b19b 100644
--- a/internal/service/elb/load_balancer_data_source.go
+++ b/internal/service/elb/load_balancer_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elb
 
 import (
diff --git a/internal/service/elb/load_balancer_data_source_test.go b/internal/service/elb/load_balancer_data_source_test.go
index d155418ca78..ebae55e5348 100644
--- a/internal/service/elb/load_balancer_data_source_test.go
+++ b/internal/service/elb/load_balancer_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elb_test
 
 import (
diff --git a/internal/service/elb/load_balancer_test.go b/internal/service/elb/load_balancer_test.go
index 418bcd3b8c5..2608e616c6a 100644
--- a/internal/service/elb/load_balancer_test.go
+++ b/internal/service/elb/load_balancer_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elb_test
 
 import ( // nosemgrep:ci.semgrep.aws.multiple-service-imports
@@ -5,10 +8,9 @@ import ( // nosemgrep:ci.semgrep.aws.multiple-service-imports
 	"fmt"
 	"math/rand"
 	"reflect"
-	"regexp"
 	"testing"
-	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/elb"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -149,8 +151,6 @@ func TestValidLoadBalancerHealthCheckTarget(t *testing.T) {
 	}
 
 	randomRunes := func(n int) string {
-		rand.Seed(time.Now().UTC().UnixNano())
-
 		// A complete set of modern Katakana characters.
 		runes := []rune("アイウエオ" +
 			"カキクケコガギグゲゴサシスセソザジズゼゾ" +
@@ -253,13 +253,21 @@ func TestAccELBLoadBalancer_basic(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config: testAccLoadBalancerConfig_basic(rName),
-				Check: resource.ComposeTestCheckFunc(
+				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckLoadBalancerExists(ctx, resourceName, &conf),
 					testAccCheckLoadBalancerAttributes(&conf),
+					resource.TestCheckResourceAttr(resourceName, "access_logs.#", "0"),
 					resource.TestCheckResourceAttrSet(resourceName, "arn"),
 					resource.TestCheckResourceAttr(resourceName, "availability_zones.#", "3"),
+					resource.TestCheckResourceAttr(resourceName, "connection_draining", "false"),
+					resource.TestCheckResourceAttr(resourceName, "connection_draining_timeout", "300"),
 					resource.TestCheckResourceAttr(resourceName, "cross_zone_load_balancing", "true"),
 					resource.TestCheckResourceAttr(resourceName, "desync_mitigation_mode", "defensive"),
+					resource.TestCheckResourceAttrSet(resourceName, "dns_name"),
+					resource.TestCheckResourceAttr(resourceName, "health_check.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "idle_timeout", "60"),
+					resource.TestCheckResourceAttr(resourceName, "instances.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "internal", "false"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "listener.*", map[string]string{
 						"instance_port":     "8000",
 						"instance_protocol": "http",
@@ -267,8 +275,13 @@ func TestAccELBLoadBalancer_basic(t *testing.T) {
 						"lb_protocol":       "http",
 					}),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
+					resource.TestCheckResourceAttr(resourceName, "name_prefix", ""),
+					resource.TestCheckResourceAttr(resourceName, "security_groups.#", "1"),
+					resource.TestCheckResourceAttrSet(resourceName, "source_security_group"),
+					resource.TestCheckResourceAttrSet(resourceName, "source_security_group_id"),
 					resource.TestCheckResourceAttr(resourceName, "subnets.#", "3"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
+					resource.TestCheckResourceAttrSet(resourceName, "zone_id"),
 				),
 			},
 			{
@@ -304,10 +317,9 @@ func TestAccELBLoadBalancer_disappears(t *testing.T) {
 	})
 }
 
-func TestAccELBLoadBalancer_namePrefix(t *testing.T) {
+func TestAccELBLoadBalancer_nameGenerated(t *testing.T) {
 	ctx := acctest.Context(t)
 	var conf elb.LoadBalancerDescription
-	nameRegex := regexp.MustCompile("^tfacc-")
 	resourceName := "aws_elb.test"
 
 	resource.ParallelTest(t, resource.TestCase{
@@ -317,20 +329,25 @@ func TestAccELBLoadBalancer_namePrefix(t *testing.T) {
 		CheckDestroy:             testAccCheckLoadBalancerDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccLoadBalancerConfig_namePrefix,
+				Config: testAccLoadBalancerConfig_nameGenerated(),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckLoadBalancerExists(ctx, resourceName, &conf),
-					resource.TestMatchResourceAttr(resourceName, "name", nameRegex),
+					acctest.CheckResourceAttrNameGeneratedWithPrefix(resourceName, "name", "tf-lb-"),
+					resource.TestCheckResourceAttr(resourceName, "name_prefix", "tf-lb-"),
 				),
 			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
 		},
 	})
 }
 
-func TestAccELBLoadBalancer_nameGenerated(t *testing.T) {
+func TestAccELBLoadBalancer_namePrefix(t *testing.T) {
 	ctx := acctest.Context(t)
 	var conf elb.LoadBalancerDescription
-	generatedNameRegexp := regexp.MustCompile("^tf-lb-")
 	resourceName := "aws_elb.test"
 
 	resource.ParallelTest(t, resource.TestCase{
@@ -340,12 +357,18 @@ func TestAccELBLoadBalancer_nameGenerated(t *testing.T) {
 		CheckDestroy:             testAccCheckLoadBalancerDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccLoadBalancerConfig_nameGenerated,
+				Config: testAccLoadBalancerConfig_namePrefix("tf-px-"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckLoadBalancerExists(ctx, resourceName, &conf),
-					resource.TestMatchResourceAttr(resourceName, "name", generatedNameRegexp),
+					acctest.CheckResourceAttrNameFromPrefix(resourceName, "name", "tf-px-"),
+					resource.TestCheckResourceAttr(resourceName, "name_prefix", "tf-px-"),
 				),
 			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
 		},
 	})
 }
@@ -505,7 +528,7 @@ func TestAccELBLoadBalancer_AccessLogs_disabled(t *testing.T) {
 func TestAccELBLoadBalancer_generatesNameForZeroValue(t *testing.T) {
 	ctx := acctest.Context(t)
 	var conf elb.LoadBalancerDescription
-	generatedNameRegexp := regexp.MustCompile("^tf-lb-")
+	generatedNameRegexp := regexache.MustCompile("^tf-lb-")
 	resourceName := "aws_elb.test"
 
 	resource.ParallelTest(t, resource.TestCase{
@@ -581,7 +604,7 @@ func TestAccELBLoadBalancer_ListenerSSLCertificateID_iamServerCertificate(t *tes
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccLoadBalancerConfig_listenerIAMServerCertificate(rName, certificate, key, "tcp"),
-				ExpectError: regexp.MustCompile(`"ssl_certificate_id" may be set only when "protocol" is "https" or "ssl"`),
+				ExpectError: regexache.MustCompile(`"ssl_certificate_id" may be set only when "protocol" is "https" or "ssl"`),
 			},
 			{
 				Config: testAccLoadBalancerConfig_listenerIAMServerCertificate(rName, certificate, key, "https"),
@@ -592,7 +615,7 @@ func TestAccELBLoadBalancer_ListenerSSLCertificateID_iamServerCertificate(t *tes
 			},
 			{
 				Config:      testAccLoadBalancerConfig_listenerIAMServerCertificateAddInvalidListener(rName, certificate, key),
-				ExpectError: regexp.MustCompile(`"ssl_certificate_id" may be set only when "protocol" is "https" or "ssl"`),
+				ExpectError: regexache.MustCompile(`"ssl_certificate_id" may be set only when "protocol" is "https" or "ssl"`),
 			},
 		},
 	})
@@ -1236,9 +1259,9 @@ resource "aws_elb" "test" {
 `, rName))
 }
 
-var testAccLoadBalancerConfig_namePrefix = acctest.ConfigCompose(acctest.ConfigAvailableAZsNoOptIn(), `
+func testAccLoadBalancerConfig_nameGenerated() string {
+	return acctest.ConfigCompose(acctest.ConfigAvailableAZsNoOptIn(), `
 resource "aws_elb" "test" {
-  name_prefix        = "tfacc-"
   availability_zones = [data.aws_availability_zones.available.names[0], data.aws_availability_zones.available.names[1], data.aws_availability_zones.available.names[2]]
 
   listener {
@@ -1249,9 +1272,12 @@ resource "aws_elb" "test" {
   }
 }
 `)
+}
 
-var testAccLoadBalancerConfig_nameGenerated = acctest.ConfigCompose(acctest.ConfigAvailableAZsNoOptIn(), `
+func testAccLoadBalancerConfig_namePrefix(namePrefix string) string {
+	return acctest.ConfigCompose(acctest.ConfigAvailableAZsNoOptIn(), fmt.Sprintf(`
 resource "aws_elb" "test" {
+  name_prefix        = %[1]q
   availability_zones = [data.aws_availability_zones.available.names[0], data.aws_availability_zones.available.names[1], data.aws_availability_zones.available.names[2]]
 
   listener {
@@ -1261,7 +1287,8 @@ resource "aws_elb" "test" {
     lb_protocol       = "http"
   }
 }
-`)
+`, namePrefix))
+}
 
 var testAccLoadBalancerConfig_zeroValueName = acctest.ConfigCompose(acctest.ConfigAvailableAZsNoOptIn(), `
 resource "aws_elb" "test" {
diff --git a/internal/service/elb/policy.go b/internal/service/elb/policy.go
index 9ccac7cd991..6a41202a21c 100644
--- a/internal/service/elb/policy.go
+++ b/internal/service/elb/policy.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elb
 
 import (
diff --git a/internal/service/elb/policy_test.go b/internal/service/elb/policy_test.go
index 8197cdbc37a..35b4eabefb2 100644
--- a/internal/service/elb/policy_test.go
+++ b/internal/service/elb/policy_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elb_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/elb"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -104,7 +107,7 @@ func TestAccELBPolicy_SSLNegotiationPolicyType_computedAttributesOnly(t *testing
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckPolicyExists(ctx, resourceName, &policy),
 					resource.TestCheckResourceAttr(resourceName, "policy_type_name", tfelb.SSLNegotiationPolicyType),
-					resource.TestMatchResourceAttr(resourceName, "policy_attribute.#", regexp.MustCompile(`[^0]+`)),
+					resource.TestMatchResourceAttr(resourceName, "policy_attribute.#", regexache.MustCompile(`[^0]+`)),
 				),
 			},
 		},
diff --git a/internal/service/elb/proxy_protocol_policy.go b/internal/service/elb/proxy_protocol_policy.go
index 77270b4a4a1..91aab9a4223 100644
--- a/internal/service/elb/proxy_protocol_policy.go
+++ b/internal/service/elb/proxy_protocol_policy.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elb
 
 import (
diff --git a/internal/service/elb/proxy_protocol_policy_test.go b/internal/service/elb/proxy_protocol_policy_test.go
index 9b5bac4d48b..41d1e8cc80c 100644
--- a/internal/service/elb/proxy_protocol_policy_test.go
+++ b/internal/service/elb/proxy_protocol_policy_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elb_test
 
 import (
diff --git a/internal/service/elb/service_account_data_source.go b/internal/service/elb/service_account_data_source.go
index b0e099ba8ce..c3782ce263e 100644
--- a/internal/service/elb/service_account_data_source.go
+++ b/internal/service/elb/service_account_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elb
 
 import (
diff --git a/internal/service/elb/service_account_data_source_test.go b/internal/service/elb/service_account_data_source_test.go
index 464cc9cf395..2eb56655f8f 100644
--- a/internal/service/elb/service_account_data_source_test.go
+++ b/internal/service/elb/service_account_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elb_test
 
 import (
diff --git a/internal/service/elb/service_package_gen.go b/internal/service/elb/service_package_gen.go
index bf69c5e893a..6c32ff38fe7 100644
--- a/internal/service/elb/service_package_gen.go
+++ b/internal/service/elb/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	elb_sdkv1 "github.com/aws/aws-sdk-go/service/elb"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -95,4 +96,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*e
 	return elb_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/elb/sweep.go b/internal/service/elb/sweep.go
index d4af6bcdc46..b36331b761a 100644
--- a/internal/service/elb/sweep.go
+++ b/internal/service/elb/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package elb
 
@@ -11,9 +11,10 @@ import (
 	"github.com/aws/aws-sdk-go/service/elb"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_elb", &resource.Sweeper{
 		Name: "aws_elb",
 		F:    sweepLoadBalancers,
@@ -22,7 +23,7 @@ func init() {
 
 func sweepLoadBalancers(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -46,7 +47,7 @@ func sweepLoadBalancers(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping ELB Classic Load Balancer sweep for %s: %s", region, err)
 		return nil
 	}
@@ -55,7 +56,7 @@ func sweepLoadBalancers(region string) error {
 		return fmt.Errorf("error listing ELB Classic Load Balancers (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping ELB Classic Load Balancers (%s): %w", region, err)
diff --git a/internal/service/elb/tags_gen.go b/internal/service/elb/tags_gen.go
index 26f32e7336c..eca6a22938c 100644
--- a/internal/service/elb/tags_gen.go
+++ b/internal/service/elb/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/elb"
 	"github.com/aws/aws-sdk-go/service/elb/elbiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -117,6 +119,8 @@ func updateTags(ctx context.Context, conn elbiface.ELBAPI, identifier string, ol
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.ELB)
 	if len(removedTags) > 0 {
diff --git a/internal/service/elb/validate.go b/internal/service/elb/validate.go
index f670921c4b1..6210dd5c40d 100644
--- a/internal/service/elb/validate.go
+++ b/internal/service/elb/validate.go
@@ -1,8 +1,12 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elb
 
 import (
 	"fmt"
-	"regexp"
+
+	"github.com/YakDriver/regexache"
 )
 
 func ValidName(v interface{}, k string) (ws []string, errors []error) {
@@ -14,16 +18,16 @@ func ValidName(v interface{}, k string) (ws []string, errors []error) {
 		errors = append(errors, fmt.Errorf(
 			"%q cannot be longer than 32 characters: %q", k, value))
 	}
-	if !regexp.MustCompile(`^[0-9A-Za-z-]+$`).MatchString(value) {
+	if !regexache.MustCompile(`^[0-9A-Za-z-]+$`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"only alphanumeric characters and hyphens allowed in %q: %q",
 			k, value))
 	}
-	if regexp.MustCompile(`^-`).MatchString(value) {
+	if regexache.MustCompile(`^-`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"%q cannot begin with a hyphen: %q", k, value))
 	}
-	if regexp.MustCompile(`-$`).MatchString(value) {
+	if regexache.MustCompile(`-$`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"%q cannot end with a hyphen: %q", k, value))
 	}
@@ -32,7 +36,7 @@ func ValidName(v interface{}, k string) (ws []string, errors []error) {
 
 func validNamePrefix(v interface{}, k string) (ws []string, errors []error) {
 	value := v.(string)
-	if !regexp.MustCompile(`^[0-9A-Za-z-]+$`).MatchString(value) {
+	if !regexache.MustCompile(`^[0-9A-Za-z-]+$`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"only alphanumeric characters and hyphens allowed in %q: %q",
 			k, value))
@@ -41,7 +45,7 @@ func validNamePrefix(v interface{}, k string) (ws []string, errors []error) {
 		errors = append(errors, fmt.Errorf(
 			"%q cannot be longer than 6 characters: %q", k, value))
 	}
-	if regexp.MustCompile(`^-`).MatchString(value) {
+	if regexache.MustCompile(`^-`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"%q cannot begin with a hyphen: %q", k, value))
 	}
diff --git a/internal/service/elb/validate_test.go b/internal/service/elb/validate_test.go
index 686b0f92394..4f74417488a 100644
--- a/internal/service/elb/validate_test.go
+++ b/internal/service/elb/validate_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elb
 
 import (
diff --git a/internal/service/elbv2/const.go b/internal/service/elbv2/const.go
index 742b6648328..1a0c5b661ce 100644
--- a/internal/service/elbv2/const.go
+++ b/internal/service/elbv2/const.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elbv2
 
 const (
diff --git a/internal/service/elbv2/find.go b/internal/service/elbv2/find.go
index 297f6346580..fa1ecb3814b 100644
--- a/internal/service/elbv2/find.go
+++ b/internal/service/elbv2/find.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elbv2
 
 import (
diff --git a/internal/service/elbv2/generate.go b/internal/service/elbv2/generate.go
index e75a94d139c..d3fc79cf148 100644
--- a/internal/service/elbv2/generate.go
+++ b/internal/service/elbv2/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTags -ListTagsOp=DescribeTags -ListTagsInIDElem=ResourceArns -ListTagsInIDNeedSlice=yes -ListTagsOutTagsElem=TagDescriptions[0].Tags -ServiceTagsSlice -TagOp=AddTags -TagInIDElem=ResourceArns -TagInIDNeedSlice=yes -UntagOp=RemoveTags -UpdateTags -CreateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/elbv2/hosted_zone_id_data_source.go b/internal/service/elbv2/hosted_zone_id_data_source.go
index c391c43488e..733c46ea282 100644
--- a/internal/service/elbv2/hosted_zone_id_data_source.go
+++ b/internal/service/elbv2/hosted_zone_id_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elbv2
 
 import (
@@ -38,6 +41,7 @@ var HostedZoneIdPerRegionALBMap = map[string]string{
 	endpoints.EuWest1RegionID:      "Z32O12XQLNTSW2",
 	endpoints.EuWest2RegionID:      "ZHURV8PSTC4K8",
 	endpoints.EuWest3RegionID:      "Z3Q77PNBQS71R4",
+	endpoints.IlCentral1RegionID:   "Z09170902867EHPV2DABU",
 	endpoints.MeCentral1RegionID:   "Z08230872XQRWHG2XF6I",
 	endpoints.MeSouth1RegionID:     "ZS929ML54UICD",
 	endpoints.SaEast1RegionID:      "Z2P70J7HTTTPLU",
@@ -74,6 +78,7 @@ var HostedZoneIdPerRegionNLBMap = map[string]string{
 	endpoints.EuWest1RegionID:      "Z2IFOLAFXWLO4F",
 	endpoints.EuWest2RegionID:      "ZD4D7Y8KGAS4G",
 	endpoints.EuWest3RegionID:      "Z1CMS0P5QUZ6D5",
+	endpoints.IlCentral1RegionID:   "Z0313266YDI6ZRHTGQY4",
 	endpoints.MeCentral1RegionID:   "Z00282643NTTLPANJJG2P",
 	endpoints.MeSouth1RegionID:     "Z3QSRYVP46NYYV",
 	endpoints.SaEast1RegionID:      "ZTK26PT1VY4CU",
diff --git a/internal/service/elbv2/hosted_zone_id_data_source_test.go b/internal/service/elbv2/hosted_zone_id_data_source_test.go
index 0c2458cc6a6..90271f25673 100644
--- a/internal/service/elbv2/hosted_zone_id_data_source_test.go
+++ b/internal/service/elbv2/hosted_zone_id_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elbv2_test
 
 import (
diff --git a/internal/service/elbv2/id.go b/internal/service/elbv2/id.go
index 364ea85be16..74338265616 100644
--- a/internal/service/elbv2/id.go
+++ b/internal/service/elbv2/id.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elbv2
 
 import (
diff --git a/internal/service/elbv2/listener.go b/internal/service/elbv2/listener.go
index 0a1014f8f9b..5764f3c4b62 100644
--- a/internal/service/elbv2/listener.go
+++ b/internal/service/elbv2/listener.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elbv2
 
 import (
@@ -5,12 +8,12 @@ import (
 	"errors"
 	"fmt"
 	"log"
-	"regexp"
 	"sort"
 	"strconv"
 	"strings"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/elbv2"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -219,7 +222,7 @@ func ResourceListener() *schema.Resource {
 										Type:         schema.TypeString,
 										Optional:     true,
 										Computed:     true,
-										ValidateFunc: validation.StringMatch(regexp.MustCompile(`^[245]\d\d$`), ""),
+										ValidateFunc: validation.StringMatch(regexache.MustCompile(`^[245]\d\d$`), ""),
 									},
 								},
 							},
diff --git a/internal/service/elbv2/listener_certificate.go b/internal/service/elbv2/listener_certificate.go
index abeef93f964..41bc51726d7 100644
--- a/internal/service/elbv2/listener_certificate.go
+++ b/internal/service/elbv2/listener_certificate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elbv2
 
 import (
@@ -181,6 +184,12 @@ func findListenerCertificate(ctx context.Context, conn *elbv2.ELBV2, certificate
 	}
 
 	resp, err := conn.DescribeListenerCertificatesWithContext(ctx, params)
+	if tfawserr.ErrCodeEquals(err, elbv2.ErrCodeListenerNotFoundException) {
+		return &retry.NotFoundError{
+			LastRequest: params,
+			LastError:   err,
+		}
+	}
 	if err != nil {
 		return err
 	}
diff --git a/internal/service/elbv2/listener_certificate_test.go b/internal/service/elbv2/listener_certificate_test.go
index 62c812fd56c..19b9d6e6301 100644
--- a/internal/service/elbv2/listener_certificate_test.go
+++ b/internal/service/elbv2/listener_certificate_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elbv2_test
 
 import (
@@ -180,6 +183,32 @@ func TestAccELBV2ListenerCertificate_disappears(t *testing.T) {
 	})
 }
 
+func TestAccELBV2ListenerCertificate_disappears_Listener(t *testing.T) {
+	ctx := acctest.Context(t)
+	key := acctest.TLSRSAPrivateKeyPEM(t, 2048)
+	certificate := acctest.TLSRSAX509SelfSignedCertificatePEM(t, key, "example.com")
+	resourceName := "aws_lb_listener_certificate.test"
+	listenerResourceName := "aws_lb_listener.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, elbv2.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckListenerCertificateDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccListenerCertificateConfig_basic(rName, key, certificate),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckListenerCertificateExists(resourceName),
+					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfelbv2.ResourceListener(), listenerResourceName),
+				),
+				ExpectNonEmptyPlan: true,
+			},
+		},
+	})
+}
+
 func testAccCheckListenerCertificateDestroy(ctx context.Context) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		conn := acctest.Provider.Meta().(*conns.AWSClient).ELBV2Conn(ctx)
diff --git a/internal/service/elbv2/listener_data_source.go b/internal/service/elbv2/listener_data_source.go
index 548af585c4f..ac188f7fab2 100644
--- a/internal/service/elbv2/listener_data_source.go
+++ b/internal/service/elbv2/listener_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elbv2
 
 import (
diff --git a/internal/service/elbv2/listener_data_source_test.go b/internal/service/elbv2/listener_data_source_test.go
index 84b5cce9b4f..d1b92809330 100644
--- a/internal/service/elbv2/listener_data_source_test.go
+++ b/internal/service/elbv2/listener_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elbv2_test
 
 import (
@@ -143,7 +146,7 @@ func TestAccELBV2ListenerDataSource_DefaultAction_forward(t *testing.T) {
 }
 
 func testAccListenerDataSourceConfig_basic(rName string) string {
-	return acctest.ConfigCompose(testAccListenerBaseConfig(rName), fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccListenerConfig_base(rName), fmt.Sprintf(`
 resource "aws_lb_listener" "test" {
   load_balancer_arn = aws_lb.test.id
   protocol          = "HTTP"
@@ -199,7 +202,7 @@ data "aws_lb_listener" "from_lb_and_port" {
 }
 
 func testAccListenerDataSourceConfig_backwardsCompatibility(rName string) string {
-	return acctest.ConfigCompose(testAccListenerBaseConfig(rName), fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccListenerConfig_base(rName), fmt.Sprintf(`
 resource "aws_alb_listener" "test" {
   load_balancer_arn = aws_alb.test.id
   protocol          = "HTTP"
@@ -255,7 +258,7 @@ data "aws_alb_listener" "from_lb_and_port" {
 }
 
 func testAccListenerDataSourceConfig_https(rName, certificate, key string) string {
-	return acctest.ConfigCompose(testAccListenerBaseConfig(rName), fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccListenerConfig_base(rName), fmt.Sprintf(`
 resource "aws_lb_listener" "test" {
   load_balancer_arn = aws_lb.test.id
   protocol          = "HTTPS"
diff --git a/internal/service/elbv2/listener_rule.go b/internal/service/elbv2/listener_rule.go
index 5f8f9cade1b..b0e8369d6bd 100644
--- a/internal/service/elbv2/listener_rule.go
+++ b/internal/service/elbv2/listener_rule.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elbv2
 
 import (
@@ -5,12 +8,12 @@ import (
 	"errors"
 	"fmt"
 	"log"
-	"regexp"
 	"sort"
 	"strconv"
 	"strings"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/elbv2"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -229,7 +232,7 @@ func ResourceListenerRule() *schema.Resource {
 										Type:         schema.TypeString,
 										Optional:     true,
 										Computed:     true,
-										ValidateFunc: validation.StringMatch(regexp.MustCompile(`^[245]\d\d$`), ""),
+										ValidateFunc: validation.StringMatch(regexache.MustCompile(`^[245]\d\d$`), ""),
 									},
 								},
 							},
@@ -382,7 +385,7 @@ func ResourceListenerRule() *schema.Resource {
 									"http_header_name": {
 										Type:         schema.TypeString,
 										Required:     true,
-										ValidateFunc: validation.StringMatch(regexp.MustCompile("^[A-Za-z0-9!#$%&'*+-.^_`|~]{1,40}$"), ""),
+										ValidateFunc: validation.StringMatch(regexache.MustCompile("^[0-9A-Za-z_!#$%&'*+,.^`|~-]{1,40}$"), ""), // was "," meant to be included? +-. creates a range including: +,-.
 									},
 									"values": {
 										Type: schema.TypeSet,
@@ -406,7 +409,7 @@ func ResourceListenerRule() *schema.Resource {
 										Type: schema.TypeSet,
 										Elem: &schema.Schema{
 											Type:         schema.TypeString,
-											ValidateFunc: validation.StringMatch(regexp.MustCompile(`^[A-Za-z-_]{1,40}$`), ""),
+											ValidateFunc: validation.StringMatch(regexache.MustCompile(`^[A-Za-z-_]{1,40}$`), ""),
 										},
 										Required: true,
 										Set:      schema.HashString,
@@ -908,7 +911,7 @@ func validListenerRulePriority(v interface{}, k string) (ws []string, errors []e
 // (arn:aws:elasticloadbalancing:us-east-1:012345678912:listener)-rule(/app/name/0123456789abcdef/abcdef0123456789)/456789abcedf1234
 // concat to become:
 // arn:aws:elasticloadbalancing:us-east-1:012345678912:listener/app/name/0123456789abcdef/abcdef0123456789
-var lbListenerARNFromRuleARNRegexp = regexp.MustCompile(`^(arn:.+:listener)-rule(/.+)/[^/]+$`)
+var lbListenerARNFromRuleARNRegexp = regexache.MustCompile(`^(arn:.+:listener)-rule(/.+)/[^/]+$`)
 
 func ListenerARNFromRuleARN(ruleArn string) string {
 	if arnComponents := lbListenerARNFromRuleARNRegexp.FindStringSubmatch(ruleArn); len(arnComponents) > 1 {
diff --git a/internal/service/elbv2/listener_rule_test.go b/internal/service/elbv2/listener_rule_test.go
index 412e7dad753..a08de5c0d8a 100644
--- a/internal/service/elbv2/listener_rule_test.go
+++ b/internal/service/elbv2/listener_rule_test.go
@@ -1,13 +1,16 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elbv2_test
 
 import (
 	"context"
 	"errors"
 	"fmt"
-	"regexp"
 	"strconv"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/elbv2"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -81,7 +84,7 @@ func TestAccELBV2ListenerRule_basic(t *testing.T) {
 				Config: testAccListenerRuleConfig_basic(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckListenerRuleExists(ctx, resourceName, &conf),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elasticloadbalancing", regexp.MustCompile(fmt.Sprintf(`listener-rule/app/%s/.+$`, rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elasticloadbalancing", regexache.MustCompile(fmt.Sprintf(`listener-rule/app/%s/.+$`, rName))),
 					resource.TestCheckResourceAttrPair(resourceName, "listener_arn", listenerResourceName, "arn"),
 					resource.TestCheckResourceAttr(resourceName, "priority", "100"),
 					resource.TestCheckResourceAttr(resourceName, "action.#", "1"),
@@ -196,7 +199,7 @@ func TestAccELBV2ListenerRule_forwardWeighted(t *testing.T) {
 				Config: testAccListenerRuleConfig_forwardWeighted(lbName, targetGroupName1, targetGroupName2),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckListenerRuleExists(ctx, resourceName, &conf),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elasticloadbalancing", regexp.MustCompile(fmt.Sprintf(`listener-rule/app/%s/.+$`, lbName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elasticloadbalancing", regexache.MustCompile(fmt.Sprintf(`listener-rule/app/%s/.+$`, lbName))),
 					resource.TestCheckResourceAttrPair(resourceName, "listener_arn", frontEndListenerResourceName, "arn"),
 					resource.TestCheckResourceAttr(resourceName, "priority", "100"),
 					resource.TestCheckResourceAttr(resourceName, "action.#", "1"),
@@ -217,7 +220,7 @@ func TestAccELBV2ListenerRule_forwardWeighted(t *testing.T) {
 				Config: testAccListenerRuleConfig_changeForwardWeightedStickiness(lbName, targetGroupName1, targetGroupName2),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckListenerRuleExists(ctx, resourceName, &conf),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elasticloadbalancing", regexp.MustCompile(fmt.Sprintf(`listener-rule/app/%s/.+$`, lbName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elasticloadbalancing", regexache.MustCompile(fmt.Sprintf(`listener-rule/app/%s/.+$`, lbName))),
 					resource.TestCheckResourceAttrPair(resourceName, "listener_arn", frontEndListenerResourceName, "arn"),
 					resource.TestCheckResourceAttr(resourceName, "priority", "100"),
 					resource.TestCheckResourceAttr(resourceName, "action.#", "1"),
@@ -238,7 +241,7 @@ func TestAccELBV2ListenerRule_forwardWeighted(t *testing.T) {
 				Config: testAccListenerRuleConfig_changeForwardWeightedToBasic(lbName, targetGroupName1, targetGroupName2),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckListenerRuleExists(ctx, resourceName, &conf),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elasticloadbalancing", regexp.MustCompile(fmt.Sprintf(`listener-rule/app/%s/.+$`, lbName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elasticloadbalancing", regexache.MustCompile(fmt.Sprintf(`listener-rule/app/%s/.+$`, lbName))),
 					resource.TestCheckResourceAttrPair(resourceName, "listener_arn", frontEndListenerResourceName, "arn"),
 					resource.TestCheckResourceAttr(resourceName, "priority", "100"),
 					resource.TestCheckResourceAttr(resourceName, "action.#", "1"),
@@ -276,7 +279,7 @@ func TestAccELBV2ListenerRule_backwardsCompatibility(t *testing.T) {
 				Config: testAccListenerRuleConfig_backwardsCompatibility(lbName, targetGroupName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckListenerRuleExists(ctx, resourceName, &conf),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elasticloadbalancing", regexp.MustCompile(fmt.Sprintf(`listener-rule/app/%s/.+$`, lbName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elasticloadbalancing", regexache.MustCompile(fmt.Sprintf(`listener-rule/app/%s/.+$`, lbName))),
 					resource.TestCheckResourceAttrPair(resourceName, "listener_arn", frontEndListenerResourceName, "arn"),
 					resource.TestCheckResourceAttr(resourceName, "priority", "100"),
 					resource.TestCheckResourceAttr(resourceName, "action.#", "1"),
@@ -322,7 +325,7 @@ func TestAccELBV2ListenerRule_redirect(t *testing.T) {
 				Config: testAccListenerRuleConfig_redirect(lbName, "null"),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckListenerRuleExists(ctx, resourceName, &conf),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elasticloadbalancing", regexp.MustCompile(fmt.Sprintf(`listener-rule/app/%s/.+$`, lbName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elasticloadbalancing", regexache.MustCompile(fmt.Sprintf(`listener-rule/app/%s/.+$`, lbName))),
 					resource.TestCheckResourceAttrPair(resourceName, "listener_arn", frontEndListenerResourceName, "arn"),
 					resource.TestCheckResourceAttr(resourceName, "priority", "100"),
 					resource.TestCheckResourceAttr(resourceName, "action.#", "1"),
@@ -346,7 +349,7 @@ func TestAccELBV2ListenerRule_redirect(t *testing.T) {
 				Config: testAccListenerRuleConfig_redirect(lbName, "param1=value1"),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckListenerRuleExists(ctx, resourceName, &conf),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elasticloadbalancing", regexp.MustCompile(fmt.Sprintf(`listener-rule/app/%s/.+$`, lbName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elasticloadbalancing", regexache.MustCompile(fmt.Sprintf(`listener-rule/app/%s/.+$`, lbName))),
 					resource.TestCheckResourceAttrPair(resourceName, "listener_arn", frontEndListenerResourceName, "arn"),
 					resource.TestCheckResourceAttr(resourceName, "priority", "100"),
 					resource.TestCheckResourceAttr(resourceName, "action.#", "1"),
@@ -370,7 +373,7 @@ func TestAccELBV2ListenerRule_redirect(t *testing.T) {
 				Config: testAccListenerRuleConfig_redirect(lbName, ""),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckListenerRuleExists(ctx, resourceName, &conf),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elasticloadbalancing", regexp.MustCompile(fmt.Sprintf(`listener-rule/app/%s/.+$`, lbName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elasticloadbalancing", regexache.MustCompile(fmt.Sprintf(`listener-rule/app/%s/.+$`, lbName))),
 					resource.TestCheckResourceAttrPair(resourceName, "listener_arn", frontEndListenerResourceName, "arn"),
 					resource.TestCheckResourceAttr(resourceName, "priority", "100"),
 					resource.TestCheckResourceAttr(resourceName, "action.#", "1"),
@@ -412,7 +415,7 @@ func TestAccELBV2ListenerRule_fixedResponse(t *testing.T) {
 				Config: testAccListenerRuleConfig_fixedResponse(lbName, "Fixed response content"),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckListenerRuleExists(ctx, resourceName, &conf),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elasticloadbalancing", regexp.MustCompile(fmt.Sprintf(`listener-rule/app/%s/.+$`, lbName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elasticloadbalancing", regexache.MustCompile(fmt.Sprintf(`listener-rule/app/%s/.+$`, lbName))),
 					resource.TestCheckResourceAttrPair(resourceName, "listener_arn", frontEndListenerResourceName, "arn"),
 					resource.TestCheckResourceAttr(resourceName, "priority", "100"),
 					resource.TestCheckResourceAttr(resourceName, "action.#", "1"),
@@ -602,11 +605,11 @@ func TestAccELBV2ListenerRule_priority(t *testing.T) {
 			},
 			{
 				Config:      testAccListenerRuleConfig_priority50001(rName),
-				ExpectError: regexp.MustCompile(`creating LB Listener Rule: ValidationError`),
+				ExpectError: regexache.MustCompile(`creating ELBv2 Listener Rule: ValidationError`),
 			},
 			{
 				Config:      testAccListenerRuleConfig_priorityInUse(rName),
-				ExpectError: regexp.MustCompile(`creating LB Listener Rule: PriorityInUse`),
+				ExpectError: regexache.MustCompile(`creating ELBv2 Listener Rule: PriorityInUse`),
 			},
 		},
 	})
@@ -635,7 +638,7 @@ func TestAccELBV2ListenerRule_cognito(t *testing.T) {
 				Config: testAccListenerRuleConfig_cognito(rName, key, certificate),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckListenerRuleExists(ctx, resourceName, &conf),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elasticloadbalancing", regexp.MustCompile(fmt.Sprintf(`listener-rule/app/%s/.+$`, rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elasticloadbalancing", regexache.MustCompile(fmt.Sprintf(`listener-rule/app/%s/.+$`, rName))),
 					resource.TestCheckResourceAttrPair(resourceName, "listener_arn", listenerResourceName, "arn"),
 					resource.TestCheckResourceAttr(resourceName, "priority", "100"),
 					resource.TestCheckResourceAttr(resourceName, "action.#", "2"),
@@ -676,7 +679,7 @@ func TestAccELBV2ListenerRule_oidc(t *testing.T) {
 				Config: testAccListenerRuleConfig_oidc(rName, key, certificate),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckListenerRuleExists(ctx, resourceName, &conf),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elasticloadbalancing", regexp.MustCompile(fmt.Sprintf(`listener-rule/app/%s/.+$`, rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elasticloadbalancing", regexache.MustCompile(fmt.Sprintf(`listener-rule/app/%s/.+$`, rName))),
 					resource.TestCheckResourceAttrPair(resourceName, "listener_arn", listenerResourceName, "arn"),
 					resource.TestCheckResourceAttr(resourceName, "priority", "100"),
 					resource.TestCheckResourceAttr(resourceName, "action.#", "2"),
@@ -759,7 +762,7 @@ func TestAccELBV2ListenerRule_ActionOrder_recreates(t *testing.T) {
 
 func TestAccELBV2ListenerRule_conditionAttributesCount(t *testing.T) {
 	ctx := acctest.Context(t)
-	err_many := regexp.MustCompile("Only one of host_header, http_header, http_request_method, path_pattern, query_string or source_ip can be set in a condition block")
+	err_many := regexache.MustCompile("Only one of host_header, http_header, http_request_method, path_pattern, query_string or source_ip can be set in a condition block")
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
@@ -809,7 +812,7 @@ func TestAccELBV2ListenerRule_conditionHostHeader(t *testing.T) {
 				Config: testAccListenerRuleConfig_conditionHostHeader(lbName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckListenerRuleExists(ctx, resourceName, &conf),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elasticloadbalancing", regexp.MustCompile(fmt.Sprintf(`listener-rule/app/%s/.+$`, lbName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elasticloadbalancing", regexache.MustCompile(fmt.Sprintf(`listener-rule/app/%s/.+$`, lbName))),
 					resource.TestCheckResourceAttrPair(resourceName, "listener_arn", frontEndListenerResourceName, "arn"),
 					resource.TestCheckResourceAttr(resourceName, "priority", "100"),
 					resource.TestCheckResourceAttr(resourceName, "action.#", "1"),
@@ -849,7 +852,7 @@ func TestAccELBV2ListenerRule_conditionHTTPHeader(t *testing.T) {
 				Config: testAccListenerRuleConfig_conditionHTTPHeader(lbName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckListenerRuleExists(ctx, resourceName, &conf),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elasticloadbalancing", regexp.MustCompile(fmt.Sprintf(`listener-rule/app/%s/.+$`, lbName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elasticloadbalancing", regexache.MustCompile(fmt.Sprintf(`listener-rule/app/%s/.+$`, lbName))),
 					resource.TestCheckResourceAttrPair(resourceName, "listener_arn", frontEndListenerResourceName, "arn"),
 					resource.TestCheckResourceAttr(resourceName, "priority", "100"),
 					resource.TestCheckResourceAttr(resourceName, "action.#", "1"),
@@ -893,7 +896,7 @@ func TestAccELBV2ListenerRule_ConditionHTTPHeader_invalid(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccListenerRuleConfig_conditionHTTPHeaderInvalid(),
-				ExpectError: regexp.MustCompile(`expected value of condition.0.http_header.0.http_header_name to match regular expression`),
+				ExpectError: regexache.MustCompile(`expected value of condition.0.http_header.0.http_header_name to match regular expression`),
 			},
 		},
 	})
@@ -917,7 +920,7 @@ func TestAccELBV2ListenerRule_conditionHTTPRequestMethod(t *testing.T) {
 				Config: testAccListenerRuleConfig_conditionHTTPRequestMethod(lbName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckListenerRuleExists(ctx, resourceName, &conf),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elasticloadbalancing", regexp.MustCompile(fmt.Sprintf(`listener-rule/app/%s/.+$`, lbName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elasticloadbalancing", regexache.MustCompile(fmt.Sprintf(`listener-rule/app/%s/.+$`, lbName))),
 					resource.TestCheckResourceAttrPair(resourceName, "listener_arn", frontEndListenerResourceName, "arn"),
 					resource.TestCheckResourceAttr(resourceName, "priority", "100"),
 					resource.TestCheckResourceAttr(resourceName, "action.#", "1"),
@@ -957,7 +960,7 @@ func TestAccELBV2ListenerRule_conditionPathPattern(t *testing.T) {
 				Config: testAccListenerRuleConfig_conditionPathPattern(lbName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckListenerRuleExists(ctx, resourceName, &conf),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elasticloadbalancing", regexp.MustCompile(fmt.Sprintf(`listener-rule/app/%s/.+$`, lbName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elasticloadbalancing", regexache.MustCompile(fmt.Sprintf(`listener-rule/app/%s/.+$`, lbName))),
 					resource.TestCheckResourceAttrPair(resourceName, "listener_arn", frontEndListenerResourceName, "arn"),
 					resource.TestCheckResourceAttr(resourceName, "priority", "100"),
 					resource.TestCheckResourceAttr(resourceName, "action.#", "1"),
@@ -997,7 +1000,7 @@ func TestAccELBV2ListenerRule_conditionQueryString(t *testing.T) {
 				Config: testAccListenerRuleConfig_conditionQueryString(lbName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckListenerRuleExists(ctx, resourceName, &conf),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elasticloadbalancing", regexp.MustCompile(fmt.Sprintf(`listener-rule/app/%s/.+$`, lbName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elasticloadbalancing", regexache.MustCompile(fmt.Sprintf(`listener-rule/app/%s/.+$`, lbName))),
 					resource.TestCheckResourceAttrPair(resourceName, "listener_arn", frontEndListenerResourceName, "arn"),
 					resource.TestCheckResourceAttr(resourceName, "priority", "100"),
 					resource.TestCheckResourceAttr(resourceName, "action.#", "1"),
@@ -1061,7 +1064,7 @@ func TestAccELBV2ListenerRule_conditionSourceIP(t *testing.T) {
 				Config: testAccListenerRuleConfig_conditionSourceIP(lbName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckListenerRuleExists(ctx, resourceName, &conf),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elasticloadbalancing", regexp.MustCompile(fmt.Sprintf(`listener-rule/app/%s/.+$`, lbName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elasticloadbalancing", regexache.MustCompile(fmt.Sprintf(`listener-rule/app/%s/.+$`, lbName))),
 					resource.TestCheckResourceAttrPair(resourceName, "listener_arn", frontEndListenerResourceName, "arn"),
 					resource.TestCheckResourceAttr(resourceName, "priority", "100"),
 					resource.TestCheckResourceAttr(resourceName, "action.#", "1"),
@@ -1105,7 +1108,7 @@ func TestAccELBV2ListenerRule_conditionUpdateMixed(t *testing.T) {
 				Config: testAccListenerRuleConfig_conditionMixed(lbName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckListenerRuleExists(ctx, resourceName, &conf),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elasticloadbalancing", regexp.MustCompile(fmt.Sprintf(`listener-rule/app/%s/.+$`, lbName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elasticloadbalancing", regexache.MustCompile(fmt.Sprintf(`listener-rule/app/%s/.+$`, lbName))),
 					resource.TestCheckResourceAttrPair(resourceName, "listener_arn", frontEndListenerResourceName, "arn"),
 					resource.TestCheckResourceAttr(resourceName, "action.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "condition.#", "2"),
@@ -1124,7 +1127,7 @@ func TestAccELBV2ListenerRule_conditionUpdateMixed(t *testing.T) {
 				Config: testAccListenerRuleConfig_conditionMixedUpdated(lbName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckListenerRuleExists(ctx, resourceName, &conf),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elasticloadbalancing", regexp.MustCompile(fmt.Sprintf(`listener-rule/app/%s/.+$`, lbName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elasticloadbalancing", regexache.MustCompile(fmt.Sprintf(`listener-rule/app/%s/.+$`, lbName))),
 					resource.TestCheckResourceAttrPair(resourceName, "listener_arn", frontEndListenerResourceName, "arn"),
 					resource.TestCheckResourceAttr(resourceName, "action.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "condition.#", "2"),
@@ -1143,7 +1146,7 @@ func TestAccELBV2ListenerRule_conditionUpdateMixed(t *testing.T) {
 				Config: testAccListenerRuleConfig_conditionMixedUpdated2(lbName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckListenerRuleExists(ctx, resourceName, &conf),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elasticloadbalancing", regexp.MustCompile(fmt.Sprintf(`listener-rule/app/%s/.+$`, lbName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elasticloadbalancing", regexache.MustCompile(fmt.Sprintf(`listener-rule/app/%s/.+$`, lbName))),
 					resource.TestCheckResourceAttrPair(resourceName, "listener_arn", frontEndListenerResourceName, "arn"),
 					resource.TestCheckResourceAttr(resourceName, "action.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "condition.#", "2"),
@@ -1180,7 +1183,7 @@ func TestAccELBV2ListenerRule_conditionMultiple(t *testing.T) {
 				Config: testAccListenerRuleConfig_conditionMultiple(lbName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckListenerRuleExists(ctx, resourceName, &conf),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elasticloadbalancing", regexp.MustCompile(fmt.Sprintf(`listener-rule/app/%s/.+$`, lbName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elasticloadbalancing", regexache.MustCompile(fmt.Sprintf(`listener-rule/app/%s/.+$`, lbName))),
 					resource.TestCheckResourceAttrPair(resourceName, "listener_arn", frontEndListenerResourceName, "arn"),
 					resource.TestCheckResourceAttr(resourceName, "priority", "100"),
 					resource.TestCheckResourceAttr(resourceName, "action.#", "1"),
@@ -1264,7 +1267,7 @@ func TestAccELBV2ListenerRule_conditionUpdateMultiple(t *testing.T) {
 				Config: testAccListenerRuleConfig_conditionMultiple(lbName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckListenerRuleExists(ctx, resourceName, &conf),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elasticloadbalancing", regexp.MustCompile(fmt.Sprintf(`listener-rule/app/%s/.+$`, lbName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elasticloadbalancing", regexache.MustCompile(fmt.Sprintf(`listener-rule/app/%s/.+$`, lbName))),
 					resource.TestCheckResourceAttrPair(resourceName, "listener_arn", frontEndListenerResourceName, "arn"),
 					resource.TestCheckResourceAttr(resourceName, "action.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "condition.#", "5"),
@@ -1304,7 +1307,7 @@ func TestAccELBV2ListenerRule_conditionUpdateMultiple(t *testing.T) {
 				Config: testAccListenerRuleConfig_conditionMultipleUpdated(lbName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckListenerRuleExists(ctx, resourceName, &conf),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elasticloadbalancing", regexp.MustCompile(fmt.Sprintf(`listener-rule/app/%s/.+$`, lbName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elasticloadbalancing", regexache.MustCompile(fmt.Sprintf(`listener-rule/app/%s/.+$`, lbName))),
 					resource.TestCheckResourceAttrPair(resourceName, "listener_arn", frontEndListenerResourceName, "arn"),
 					resource.TestCheckResourceAttr(resourceName, "action.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "condition.#", "5"),
diff --git a/internal/service/elbv2/listener_test.go b/internal/service/elbv2/listener_test.go
index 756708cdb4a..dd476a634b7 100644
--- a/internal/service/elbv2/listener_test.go
+++ b/internal/service/elbv2/listener_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elbv2_test
 
 import (
 	"context"
 	"errors"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/elbv2"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -36,7 +39,7 @@ func TestAccELBV2Listener_basic(t *testing.T) {
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckListenerExists(ctx, resourceName, &conf),
 					resource.TestCheckResourceAttrPair(resourceName, "load_balancer_arn", "aws_lb.test", "arn"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elasticloadbalancing", regexp.MustCompile("listener/.+$")),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elasticloadbalancing", regexache.MustCompile("listener/.+$")),
 					resource.TestCheckResourceAttr(resourceName, "protocol", "HTTP"),
 					resource.TestCheckResourceAttr(resourceName, "port", "80"),
 					resource.TestCheckResourceAttr(resourceName, "default_action.#", "1"),
@@ -121,7 +124,7 @@ func TestAccELBV2Listener_forwardWeighted(t *testing.T) {
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckListenerExists(ctx, resourceName, &conf),
 					resource.TestCheckResourceAttrPair(resourceName, "load_balancer_arn", "aws_lb.test", "arn"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elasticloadbalancing", regexp.MustCompile("listener/.+$")),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elasticloadbalancing", regexache.MustCompile("listener/.+$")),
 					resource.TestCheckResourceAttr(resourceName, "protocol", "HTTP"),
 					resource.TestCheckResourceAttr(resourceName, "port", "80"),
 					resource.TestCheckResourceAttr(resourceName, "default_action.#", "1"),
@@ -145,7 +148,7 @@ func TestAccELBV2Listener_forwardWeighted(t *testing.T) {
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckListenerExists(ctx, resourceName, &conf),
 					resource.TestCheckResourceAttrPair(resourceName, "load_balancer_arn", "aws_lb.test", "arn"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elasticloadbalancing", regexp.MustCompile("listener/.+$")),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elasticloadbalancing", regexache.MustCompile("listener/.+$")),
 					resource.TestCheckResourceAttr(resourceName, "protocol", "HTTP"),
 					resource.TestCheckResourceAttr(resourceName, "port", "80"),
 					resource.TestCheckResourceAttr(resourceName, "default_action.#", "1"),
@@ -169,7 +172,7 @@ func TestAccELBV2Listener_forwardWeighted(t *testing.T) {
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckListenerExists(ctx, resourceName, &conf),
 					resource.TestCheckResourceAttrPair(resourceName, "load_balancer_arn", "aws_lb.test", "arn"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elasticloadbalancing", regexp.MustCompile("listener/.+$")),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elasticloadbalancing", regexache.MustCompile("listener/.+$")),
 					resource.TestCheckResourceAttr(resourceName, "protocol", "HTTP"),
 					resource.TestCheckResourceAttr(resourceName, "port", "80"),
 					resource.TestCheckResourceAttr(resourceName, "default_action.#", "1"),
@@ -201,7 +204,7 @@ func TestAccELBV2Listener_Protocol_upd(t *testing.T) {
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckListenerExists(ctx, resourceName, &conf),
 					resource.TestCheckResourceAttrPair(resourceName, "load_balancer_arn", "aws_lb.test", "arn"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elasticloadbalancing", regexp.MustCompile("listener/.+$")),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elasticloadbalancing", regexache.MustCompile("listener/.+$")),
 					resource.TestCheckResourceAttr(resourceName, "protocol", "UDP"),
 					resource.TestCheckResourceAttr(resourceName, "port", "514"),
 					resource.TestCheckResourceAttr(resourceName, "default_action.#", "1"),
@@ -238,7 +241,7 @@ func TestAccELBV2Listener_backwardsCompatibility(t *testing.T) {
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckListenerExists(ctx, resourceName, &conf),
 					resource.TestCheckResourceAttrPair(resourceName, "load_balancer_arn", "aws_alb.test", "arn"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elasticloadbalancing", regexp.MustCompile("listener/.+$")),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elasticloadbalancing", regexache.MustCompile("listener/.+$")),
 					resource.TestCheckResourceAttr(resourceName, "protocol", "HTTP"),
 					resource.TestCheckResourceAttr(resourceName, "port", "80"),
 					resource.TestCheckResourceAttr(resourceName, "default_action.#", "1"),
@@ -277,7 +280,7 @@ func TestAccELBV2Listener_Protocol_https(t *testing.T) {
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckListenerExists(ctx, resourceName, &conf),
 					resource.TestCheckResourceAttrPair(resourceName, "load_balancer_arn", "aws_lb.test", "arn"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elasticloadbalancing", regexp.MustCompile("listener/.+$")),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elasticloadbalancing", regexache.MustCompile("listener/.+$")),
 					resource.TestCheckResourceAttr(resourceName, "protocol", "HTTPS"),
 					resource.TestCheckResourceAttr(resourceName, "port", "443"),
 					resource.TestCheckResourceAttr(resourceName, "default_action.#", "1"),
@@ -382,7 +385,7 @@ func TestAccELBV2Listener_redirect(t *testing.T) {
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckListenerExists(ctx, resourceName, &conf),
 					resource.TestCheckResourceAttrPair(resourceName, "load_balancer_arn", "aws_lb.test", "arn"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elasticloadbalancing", regexp.MustCompile("listener/.+$")),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elasticloadbalancing", regexache.MustCompile("listener/.+$")),
 					resource.TestCheckResourceAttr(resourceName, "protocol", "HTTP"),
 					resource.TestCheckResourceAttr(resourceName, "port", "80"),
 					resource.TestCheckResourceAttr(resourceName, "default_action.#", "1"),
@@ -425,7 +428,7 @@ func TestAccELBV2Listener_fixedResponse(t *testing.T) {
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckListenerExists(ctx, resourceName, &conf),
 					resource.TestCheckResourceAttrPair(resourceName, "load_balancer_arn", "aws_lb.test", "arn"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elasticloadbalancing", regexp.MustCompile("listener/.+$")),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elasticloadbalancing", regexache.MustCompile("listener/.+$")),
 					resource.TestCheckResourceAttr(resourceName, "protocol", "HTTP"),
 					resource.TestCheckResourceAttr(resourceName, "port", "80"),
 					resource.TestCheckResourceAttr(resourceName, "default_action.#", "1"),
@@ -467,7 +470,7 @@ func TestAccELBV2Listener_cognito(t *testing.T) {
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckListenerExists(ctx, resourceName, &conf),
 					resource.TestCheckResourceAttrPair(resourceName, "load_balancer_arn", "aws_lb.test", "arn"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elasticloadbalancing", regexp.MustCompile("listener/.+$")),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elasticloadbalancing", regexache.MustCompile("listener/.+$")),
 					resource.TestCheckResourceAttr(resourceName, "protocol", "HTTPS"),
 					resource.TestCheckResourceAttr(resourceName, "port", "443"),
 					resource.TestCheckResourceAttr(resourceName, "default_action.#", "2"),
@@ -512,7 +515,7 @@ func TestAccELBV2Listener_oidc(t *testing.T) {
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckListenerExists(ctx, resourceName, &conf),
 					resource.TestCheckResourceAttrPair(resourceName, "load_balancer_arn", "aws_lb.test", "arn"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elasticloadbalancing", regexp.MustCompile("listener/.+$")),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elasticloadbalancing", regexache.MustCompile("listener/.+$")),
 					resource.TestCheckResourceAttr(resourceName, "protocol", "HTTPS"),
 					resource.TestCheckResourceAttr(resourceName, "port", "443"),
 					resource.TestCheckResourceAttr(resourceName, "default_action.#", "2"),
@@ -691,7 +694,7 @@ func testAccCheckListenerDestroy(ctx context.Context) resource.TestCheckFunc {
 	}
 }
 
-func testAccListenerBaseConfig(rName string) string {
+func testAccListenerConfig_base(rName string) string {
 	return acctest.ConfigCompose(acctest.ConfigAvailableAZsNoOptIn(), fmt.Sprintf(`
 resource "aws_vpc" "test" {
   cidr_block = "10.0.0.0/16"
@@ -740,7 +743,7 @@ resource "aws_security_group" "test" {
 }
 
 func testAccListenerConfig_basic(rName string) string {
-	return acctest.ConfigCompose(testAccListenerBaseConfig(rName), fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccListenerConfig_base(rName), fmt.Sprintf(`
 resource "aws_lb_listener" "test" {
   load_balancer_arn = aws_lb.test.id
   protocol          = "HTTP"
@@ -791,7 +794,7 @@ resource "aws_lb_target_group" "test" {
 }
 
 func testAccListenerConfig_forwardWeighted(rName, rName2 string) string {
-	return acctest.ConfigCompose(testAccListenerBaseConfig(rName), fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccListenerConfig_base(rName), fmt.Sprintf(`
 resource "aws_lb_listener" "test" {
   load_balancer_arn = aws_lb.test.id
   protocol          = "HTTP"
@@ -875,7 +878,7 @@ resource "aws_lb_target_group" "test2" {
 }
 
 func testAccListenerConfig_changeForwardWeightedStickiness(rName, rName2 string) string {
-	return acctest.ConfigCompose(testAccListenerBaseConfig(rName), fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccListenerConfig_base(rName), fmt.Sprintf(`
 resource "aws_lb_listener" "test" {
   load_balancer_arn = aws_lb.test.id
   protocol          = "HTTP"
@@ -964,7 +967,7 @@ resource "aws_lb_target_group" "test2" {
 }
 
 func testAccListenerConfig_changeForwardWeightedToBasic(rName, rName2 string) string {
-	return acctest.ConfigCompose(testAccListenerBaseConfig(rName), fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccListenerConfig_base(rName), fmt.Sprintf(`
 resource "aws_lb_listener" "test" {
   load_balancer_arn = aws_lb.test.id
   protocol          = "HTTP"
@@ -1037,7 +1040,7 @@ resource "aws_lb_target_group" "test2" {
 }
 
 func testAccListenerConfig_basicUdp(rName string) string {
-	return acctest.ConfigCompose(testAccListenerBaseConfig(rName), fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccListenerConfig_base(rName), fmt.Sprintf(`
 resource "aws_lb_listener" "test" {
   load_balancer_arn = aws_lb.test.id
   protocol          = "UDP"
@@ -1090,7 +1093,7 @@ resource "aws_internet_gateway" "test" {
 }
 
 func testAccListenerConfig_backwardsCompatibility(rName string) string {
-	return acctest.ConfigCompose(testAccListenerBaseConfig(rName), fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccListenerConfig_base(rName), fmt.Sprintf(`
 resource "aws_alb_listener" "test" {
   load_balancer_arn = aws_alb.test.id
   protocol          = "HTTP"
@@ -1141,7 +1144,7 @@ resource "aws_alb_target_group" "test" {
 }
 
 func testAccListenerConfig_https(rName, key, certificate string) string {
-	return acctest.ConfigCompose(testAccListenerBaseConfig(rName), fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccListenerConfig_base(rName), fmt.Sprintf(`
 resource "aws_lb_listener" "test" {
   load_balancer_arn = aws_lb.test.id
   protocol          = "HTTPS"
@@ -1266,7 +1269,7 @@ resource "aws_lb_listener" "test" {
 }
 
 func testAccListenerConfig_protocolTLS(rName, key, certificate string) string {
-	return acctest.ConfigCompose(testAccListenerBaseConfig(rName), fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccListenerConfig_base(rName), fmt.Sprintf(`
 resource "aws_acm_certificate" "test" {
   certificate_body = "%[2]s"
   private_key      = "%[3]s"
@@ -1323,7 +1326,7 @@ resource "aws_lb_listener" "test" {
 }
 
 func testAccListenerConfig_redirect(rName string) string {
-	return acctest.ConfigCompose(testAccListenerBaseConfig(rName), fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccListenerConfig_base(rName), fmt.Sprintf(`
 resource "aws_lb_listener" "test" {
   load_balancer_arn = aws_lb.test.id
   protocol          = "HTTP"
@@ -1357,7 +1360,7 @@ resource "aws_lb" "test" {
 }
 
 func testAccListenerConfig_fixedResponse(rName string) string {
-	return acctest.ConfigCompose(testAccListenerBaseConfig(rName), fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccListenerConfig_base(rName), fmt.Sprintf(`
 resource "aws_lb_listener" "test" {
   load_balancer_arn = aws_lb.test.id
   protocol          = "HTTP"
@@ -1391,7 +1394,7 @@ resource "aws_lb" "test" {
 }
 
 func testAccListenerConfig_cognito(rName, key, certificate string) string {
-	return acctest.ConfigCompose(testAccListenerBaseConfig(rName), fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccListenerConfig_base(rName), fmt.Sprintf(`
 resource "aws_lb" "test" {
   name                       = %[1]q
   internal                   = false
@@ -1495,7 +1498,7 @@ resource "aws_lb_listener" "test" {
 }
 
 func testAccListenerConfig_oidc(rName, key, certificate string) string {
-	return acctest.ConfigCompose(testAccListenerBaseConfig(rName), fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccListenerConfig_base(rName), fmt.Sprintf(`
 resource "aws_lb" "test" {
   name                       = %[1]q
   internal                   = false
@@ -1577,7 +1580,7 @@ resource "aws_lb_listener" "test" {
 }
 
 func testAccListenerConfig_defaultActionOrder(rName, key, certificate string) string {
-	return acctest.ConfigCompose(testAccListenerBaseConfig(rName), fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccListenerConfig_base(rName), fmt.Sprintf(`
 resource "aws_lb_listener" "test" {
   load_balancer_arn = aws_lb.test.id
   protocol          = "HTTPS"
@@ -1652,7 +1655,7 @@ resource "aws_lb_target_group" "test" {
 }
 
 func testAccListenerConfig_tags1(rName, tagKey1, tagValue1 string) string {
-	return acctest.ConfigCompose(testAccListenerBaseConfig(rName), fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccListenerConfig_base(rName), fmt.Sprintf(`
 resource "aws_lb_listener" "test" {
   load_balancer_arn = aws_lb.test.id
   protocol          = "HTTP"
@@ -1707,7 +1710,7 @@ resource "aws_lb_target_group" "test" {
 }
 
 func testAccListenerConfig_tags2(rName, tagKey1, tagValue1, tagKey2, tagValue2 string) string {
-	return acctest.ConfigCompose(testAccListenerBaseConfig(rName), fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccListenerConfig_base(rName), fmt.Sprintf(`
 resource "aws_lb_listener" "test" {
   load_balancer_arn = aws_lb.test.id
   protocol          = "HTTP"
diff --git a/internal/service/elbv2/load_balancer.go b/internal/service/elbv2/load_balancer.go
index b7a1874ecb8..018b4306795 100644
--- a/internal/service/elbv2/load_balancer.go
+++ b/internal/service/elbv2/load_balancer.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elbv2
 
 import ( // nosemgrep:ci.semgrep.aws.multiple-service-imports
@@ -6,10 +9,10 @@ import ( // nosemgrep:ci.semgrep.aws.multiple-service-imports
 	"errors"
 	"fmt"
 	"log"
-	"regexp"
 	"strconv"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/aws/aws-sdk-go/service/elbv2"
@@ -17,7 +20,6 @@ import ( // nosemgrep:ci.semgrep.aws.multiple-service-imports
 	multierror "github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/customdiff"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
@@ -47,9 +49,8 @@ func ResourceLoadBalancer() *schema.Resource {
 			StateContext: schema.ImportStatePassthroughContext,
 		},
 
-		// Subnets are ForceNew for Network Load Balancers
 		CustomizeDiff: customdiff.Sequence(
-			customizeDiffNLBSubnets,
+			customizeDiffNLB,
 			verify.SetTagsDiff,
 		),
 
@@ -117,6 +118,17 @@ func ResourceLoadBalancer() *schema.Resource {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
+			"dns_record_client_routing_policy": {
+				Type:             schema.TypeString,
+				Optional:         true,
+				Default:          "any_availability_zone",
+				DiffSuppressFunc: suppressIfLBTypeNot(elbv2.LoadBalancerTypeEnumNetwork),
+				ValidateFunc: validation.StringInSlice([]string{
+					"availability_zone_affinity",
+					"partial_availability_zone_affinity",
+					"any_availability_zone",
+				}, false),
+			},
 			"drop_invalid_header_fields": {
 				Type:             schema.TypeBool,
 				Optional:         true,
@@ -194,6 +206,7 @@ func ResourceLoadBalancer() *schema.Resource {
 			"name_prefix": {
 				Type:          schema.TypeString,
 				Optional:      true,
+				Computed:      true,
 				ForceNew:      true,
 				ConflictsWith: []string{"name"},
 				ValidateFunc:  validNamePrefix,
@@ -206,9 +219,9 @@ func ResourceLoadBalancer() *schema.Resource {
 			},
 			"security_groups": {
 				Type:     schema.TypeSet,
-				Elem:     &schema.Schema{Type: schema.TypeString},
-				Computed: true,
 				Optional: true,
+				Computed: true,
+				Elem:     &schema.Schema{Type: schema.TypeString},
 			},
 			"subnet_mapping": {
 				Type:     schema.TypeSet,
@@ -305,14 +318,23 @@ func resourceLoadBalancerCreate(ctx context.Context, d *schema.ResourceData, met
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).ELBV2Conn(ctx)
 
-	var name string
-	if v, ok := d.GetOk("name"); ok {
-		name = v.(string)
-	} else if v, ok := d.GetOk("name_prefix"); ok {
-		name = id.PrefixedUniqueId(v.(string))
-	} else {
-		name = id.PrefixedUniqueId("tf-lb-")
+	name := create.NewNameGenerator(
+		create.WithConfiguredName(d.Get("name").(string)),
+		create.WithConfiguredPrefix(d.Get("name_prefix").(string)),
+		create.WithDefaultPrefix("tf-lb-"),
+	).Generate()
+	exist, err := FindLoadBalancer(ctx, conn, &elbv2.DescribeLoadBalancersInput{
+		Names: aws.StringSlice([]string{name}),
+	})
+
+	if err != nil && !tfresource.NotFound(err) {
+		return sdkdiag.AppendErrorf(diags, "reading ELBv2 Load Balancer (%s): %s", name, err)
+	}
+
+	if exist != nil {
+		return sdkdiag.AppendErrorf(diags, "ELBv2 Load Balancer (%s) already exists", name)
 	}
+
 	d.Set("name", name)
 
 	lbType := d.Get("load_balancer_type").(string)
@@ -512,7 +534,21 @@ func resourceLoadBalancerUpdate(ctx context.Context, d *schema.ResourceData, met
 			})
 		}
 
-	case elbv2.LoadBalancerTypeEnumGateway, elbv2.LoadBalancerTypeEnumNetwork:
+	case elbv2.LoadBalancerTypeEnumGateway:
+		if d.HasChange("enable_cross_zone_load_balancing") || d.IsNewResource() {
+			attributes = append(attributes, &elbv2.LoadBalancerAttribute{
+				Key:   aws.String("load_balancing.cross_zone.enabled"),
+				Value: aws.String(fmt.Sprintf("%t", d.Get("enable_cross_zone_load_balancing").(bool))),
+			})
+		}
+
+	case elbv2.LoadBalancerTypeEnumNetwork:
+		if d.HasChange("dns_record_client_routing_policy") || d.IsNewResource() {
+			attributes = append(attributes, &elbv2.LoadBalancerAttribute{
+				Key:   aws.String("dns_record.client_routing_policy"),
+				Value: aws.String(d.Get("dns_record_client_routing_policy").(string)),
+			})
+		}
 		if d.HasChange("enable_cross_zone_load_balancing") || d.IsNewResource() {
 			attributes = append(attributes, &elbv2.LoadBalancerAttribute{
 				Key:   aws.String("load_balancing.cross_zone.enabled"),
@@ -544,7 +580,7 @@ func resourceLoadBalancerUpdate(ctx context.Context, d *schema.ResourceData, met
 				break
 			}
 
-			re := regexp.MustCompile(`attribute key ('|")?([^'" ]+)('|")? is not recognized`)
+			re := regexache.MustCompile(`attribute key ('|")?([^'" ]+)('|")? is not recognized`)
 			if sm := re.FindStringSubmatch(err.Error()); len(sm) > 1 {
 				log.Printf("[WARN] failed to modify Load Balancer (%s), unsupported attribute (%s): %s", d.Id(), sm[2], err)
 				input.Attributes = removeAttribute(input.Attributes, sm[2])
@@ -843,7 +879,7 @@ func waitForNLBNetworkInterfacesToDetach(ctx context.Context, conn *ec2.EC2, lbA
 }
 
 func getLBNameFromARN(arn string) (string, error) {
-	re := regexp.MustCompile("([^/]+/[^/]+/[^/]+)$")
+	re := regexache.MustCompile("([^/]+/[^/]+/[^/]+)$")
 	matches := re.FindStringSubmatch(arn)
 	if len(matches) != 2 {
 		return "", fmt.Errorf("unexpected ARN format: %q", arn)
@@ -886,7 +922,7 @@ func SuffixFromARN(arn *string) string {
 		return ""
 	}
 
-	if arnComponents := regexp.MustCompile(`arn:.*:loadbalancer/(.*)`).FindAllStringSubmatch(*arn, -1); len(arnComponents) == 1 {
+	if arnComponents := regexache.MustCompile(`arn:.*:loadbalancer/(.*)`).FindAllStringSubmatch(*arn, -1); len(arnComponents) == 1 {
 		if len(arnComponents[0]) == 2 {
 			return arnComponents[0][1]
 		}
@@ -907,6 +943,7 @@ func flattenResource(ctx context.Context, d *schema.ResourceData, meta interface
 	d.Set("ip_address_type", lb.IpAddressType)
 	d.Set("load_balancer_type", lb.Type)
 	d.Set("name", lb.LoadBalancerName)
+	d.Set("name_prefix", create.NamePrefixFromName(aws.StringValue(lb.LoadBalancerName)))
 	d.Set("security_groups", aws.StringValueSlice(lb.SecurityGroups))
 	d.Set("vpc_id", lb.VpcId)
 	d.Set("zone_id", lb.CanonicalHostedZoneId)
@@ -940,6 +977,10 @@ func flattenResource(ctx context.Context, d *schema.ResourceData, meta interface
 			accessLogMap["bucket"] = aws.StringValue(attr.Value)
 		case "access_logs.s3.prefix":
 			accessLogMap["prefix"] = aws.StringValue(attr.Value)
+		case "dns_record.client_routing_policy":
+			dnsClientRoutingPolicy := aws.StringValue(attr.Value)
+			log.Printf("[DEBUG] Setting NLB DNS Record Client Routing Policy: %s", dnsClientRoutingPolicy)
+			d.Set("dns_record_client_routing_policy", dnsClientRoutingPolicy)
 		case "idle_timeout.timeout_seconds":
 			timeout, err := strconv.Atoi(aws.StringValue(attr.Value))
 			if err != nil {
@@ -997,14 +1038,17 @@ func flattenResource(ctx context.Context, d *schema.ResourceData, meta interface
 	return nil
 }
 
-// Load balancers of type 'network' cannot have their subnets updated at
-// this time. If the type is 'network' and subnets have changed, mark the
-// diff as a ForceNew operation
-func customizeDiffNLBSubnets(_ context.Context, diff *schema.ResourceDiff, v interface{}) error {
+// Load balancers of type 'network' cannot have their subnets updated,
+// cannot have security groups added if none are present, and cannot have
+// all security groups removed. If the type is 'network' and any of these
+// conditions are met, mark the diff as a ForceNew operation.
+func customizeDiffNLB(_ context.Context, diff *schema.ResourceDiff, v interface{}) error {
 	// The current criteria for determining if the operation should be ForceNew:
 	// - lb of type "network"
 	// - existing resource (id is not "")
 	// - there are actual changes to be made in the subnets
+	//   OR security groups are being added where none currently exist
+	//   OR all security groups are being removed
 	//
 	// Any other combination should be treated as normal. At this time, subnet
 	// handling is the only known difference between Network Load Balancers and
@@ -1019,26 +1063,26 @@ func customizeDiffNLBSubnets(_ context.Context, diff *schema.ResourceDiff, v int
 		return nil
 	}
 
+	// Get diff for subnets.
 	o, n := diff.GetChange("subnets")
-	if o == nil {
-		o = new(schema.Set)
-	}
-	if n == nil {
-		n = new(schema.Set)
-	}
-	os := o.(*schema.Set)
-	ns := n.(*schema.Set)
-	remove := os.Difference(ns).List()
-	add := ns.Difference(os).List()
-	if len(remove) > 0 || len(add) > 0 {
-		if err := diff.SetNew("subnets", n); err != nil {
+	os, ns := o.(*schema.Set), n.(*schema.Set)
+
+	if add, del := ns.Difference(os).List(), os.Difference(ns).List(); len(del) > 0 || len(add) > 0 {
+		if err := diff.ForceNew("subnets"); err != nil {
 			return err
 		}
+	}
 
-		if err := diff.ForceNew("subnets"); err != nil {
+	// Get diff for security groups.
+	o, n = diff.GetChange("security_groups")
+	os, ns = o.(*schema.Set), n.(*schema.Set)
+
+	if (os.Len() == 0 && ns.Len() > 0) || (ns.Len() == 0 && os.Len() > 0) {
+		if err := diff.ForceNew("security_groups"); err != nil {
 			return err
 		}
 	}
+
 	return nil
 }
 
diff --git a/internal/service/elbv2/load_balancer_data_source.go b/internal/service/elbv2/load_balancer_data_source.go
index c6f9a9526bb..77e1b5cbd73 100644
--- a/internal/service/elbv2/load_balancer_data_source.go
+++ b/internal/service/elbv2/load_balancer_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elbv2
 
 import (
diff --git a/internal/service/elbv2/load_balancer_data_source_test.go b/internal/service/elbv2/load_balancer_data_source_test.go
index c7aadfe5f47..ca77fe5329e 100644
--- a/internal/service/elbv2/load_balancer_data_source_test.go
+++ b/internal/service/elbv2/load_balancer_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elbv2_test
 
 import (
diff --git a/internal/service/elbv2/load_balancer_test.go b/internal/service/elbv2/load_balancer_test.go
index 727c118c707..b29d4a2683c 100644
--- a/internal/service/elbv2/load_balancer_test.go
+++ b/internal/service/elbv2/load_balancer_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elbv2_test
 
 import (
@@ -7,6 +10,7 @@ import (
 	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/elbv2"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -81,7 +85,7 @@ func TestAccELBV2LoadBalancer_ALB_basic(t *testing.T) {
 					testAccCheckLoadBalancerExists(ctx, resourceName, &conf),
 					resource.TestCheckResourceAttr(resourceName, "access_logs.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "access_logs.0.enabled", "false"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elasticloadbalancing", regexp.MustCompile(fmt.Sprintf("loadbalancer/app/%s/.+", rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elasticloadbalancing", regexache.MustCompile(fmt.Sprintf("loadbalancer/app/%s/.+", rName))),
 					resource.TestCheckResourceAttr(resourceName, "desync_mitigation_mode", "defensive"),
 					resource.TestCheckResourceAttrSet(resourceName, "dns_name"),
 					resource.TestCheckResourceAttr(resourceName, "enable_deletion_protection", "false"),
@@ -92,6 +96,7 @@ func TestAccELBV2LoadBalancer_ALB_basic(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "ip_address_type", "ipv4"),
 					resource.TestCheckResourceAttr(resourceName, "load_balancer_type", "application"),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
+					resource.TestCheckResourceAttr(resourceName, "name_prefix", ""),
 					resource.TestCheckResourceAttr(resourceName, "security_groups.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "subnets.#", "2"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
@@ -108,7 +113,7 @@ func TestAccELBV2LoadBalancer_NLB_basic(t *testing.T) {
 	ctx := acctest.Context(t)
 	var conf elbv2.LoadBalancer
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
-	resourceName := "aws_lb.lb_test"
+	resourceName := "aws_lb.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
@@ -122,13 +127,15 @@ func TestAccELBV2LoadBalancer_NLB_basic(t *testing.T) {
 					testAccCheckLoadBalancerExists(ctx, resourceName, &conf),
 					resource.TestCheckResourceAttr(resourceName, "access_logs.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "access_logs.0.enabled", "false"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elasticloadbalancing", regexp.MustCompile(fmt.Sprintf("loadbalancer/net/%s/.+", rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elasticloadbalancing", regexache.MustCompile(fmt.Sprintf("loadbalancer/net/%s/.+", rName))),
 					resource.TestCheckResourceAttrSet(resourceName, "dns_name"),
+					resource.TestCheckResourceAttr(resourceName, "dns_record_client_routing_policy", "any_availability_zone"),
 					resource.TestCheckResourceAttr(resourceName, "enable_deletion_protection", "false"),
 					resource.TestCheckResourceAttr(resourceName, "internal", "true"),
 					resource.TestCheckResourceAttr(resourceName, "ip_address_type", "ipv4"),
 					resource.TestCheckResourceAttr(resourceName, "load_balancer_type", "network"),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
+					resource.TestCheckResourceAttr(resourceName, "name_prefix", ""),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags.Name", rName),
 					resource.TestCheckResourceAttrSet(resourceName, "zone_id"),
@@ -154,7 +161,7 @@ func TestAccELBV2LoadBalancer_LoadBalancerType_gateway(t *testing.T) {
 				Config: testAccLoadBalancerConfig_typeGateway(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckLoadBalancerExists(ctx, resourceName, &conf),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elasticloadbalancing", regexp.MustCompile(fmt.Sprintf("loadbalancer/gwy/%s/.+", rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elasticloadbalancing", regexache.MustCompile(fmt.Sprintf("loadbalancer/gwy/%s/.+", rName))),
 					resource.TestCheckResourceAttr(resourceName, "load_balancer_type", elbv2.LoadBalancerTypeEnumGateway),
 				),
 			},
@@ -197,7 +204,7 @@ func TestAccELBV2LoadBalancer_disappears(t *testing.T) {
 	})
 }
 
-func TestAccELBV2LoadBalancer_ipv6SubnetMapping(t *testing.T) {
+func TestAccELBV2LoadBalancer_nameGenerated(t *testing.T) {
 	ctx := acctest.Context(t)
 	var conf elbv2.LoadBalancer
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
@@ -210,12 +217,11 @@ func TestAccELBV2LoadBalancer_ipv6SubnetMapping(t *testing.T) {
 		CheckDestroy:             testAccCheckLoadBalancerDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccLoadBalancerConfig_ipv6(rName),
+				Config: testAccLoadBalancerConfig_nameGenerated(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckLoadBalancerExists(ctx, resourceName, &conf),
-					resource.TestMatchTypeSetElemNestedAttrs(resourceName, "subnet_mapping.*", map[string]*regexp.Regexp{
-						"ipv6_address": regexp.MustCompile("[a-f0-6]+:[a-f0-6:]+"),
-					}),
+					acctest.CheckResourceAttrNameGeneratedWithPrefix(resourceName, "name", "tf-lb-"),
+					resource.TestCheckResourceAttr(resourceName, "name_prefix", "tf-lb-"),
 				),
 			},
 			{
@@ -225,6 +231,7 @@ func TestAccELBV2LoadBalancer_ipv6SubnetMapping(t *testing.T) {
 				ImportStateVerifyIgnore: []string{
 					"drop_invalid_header_fields",
 					"enable_http2",
+					"enable_waf_fail_open",
 					"idle_timeout",
 				},
 			},
@@ -232,25 +239,48 @@ func TestAccELBV2LoadBalancer_ipv6SubnetMapping(t *testing.T) {
 	})
 }
 
-func TestAccELBV2LoadBalancer_LoadBalancerTypeGateway_enableCrossZoneLoadBalancing(t *testing.T) {
+func TestAccELBV2LoadBalancer_nameGeneratedForZeroValue(t *testing.T) {
 	ctx := acctest.Context(t)
 	var conf elbv2.LoadBalancer
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_lb.test"
 
 	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheckGatewayLoadBalancer(ctx, t) },
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
 		ErrorCheck:               acctest.ErrorCheck(t, elbv2.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckLoadBalancerDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccLoadBalancerConfig_typeGatewayEnableCrossZoneBalancing(rName, true),
+				Config: testAccLoadBalancerConfig_zeroValueName(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckLoadBalancerExists(ctx, resourceName, &conf),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elasticloadbalancing", regexp.MustCompile(fmt.Sprintf("loadbalancer/gwy/%s/.+", rName))),
-					resource.TestCheckResourceAttr(resourceName, "load_balancer_type", elbv2.LoadBalancerTypeEnumGateway),
-					resource.TestCheckResourceAttr(resourceName, "enable_cross_zone_load_balancing", "true"),
+					acctest.CheckResourceAttrNameGeneratedWithPrefix(resourceName, "name", "tf-lb-"),
+					resource.TestCheckResourceAttr(resourceName, "name_prefix", "tf-lb-"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccELBV2LoadBalancer_namePrefix(t *testing.T) {
+	ctx := acctest.Context(t)
+	var conf elbv2.LoadBalancer
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_lb.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, elbv2.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckLoadBalancerDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccLoadBalancerConfig_namePrefix(rName, "tf-px-"),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckLoadBalancerExists(ctx, resourceName, &conf),
+					acctest.CheckResourceAttrNameFromPrefix(resourceName, "name", "tf-px-"),
+					resource.TestCheckResourceAttr(resourceName, "name_prefix", "tf-px-"),
 				),
 			},
 			{
@@ -264,64 +294,42 @@ func TestAccELBV2LoadBalancer_LoadBalancerTypeGateway_enableCrossZoneLoadBalanci
 					"idle_timeout",
 				},
 			},
-			{
-				Config: testAccLoadBalancerConfig_typeGatewayEnableCrossZoneBalancing(rName, false),
-				Check: resource.ComposeAggregateTestCheckFunc(
-					testAccCheckLoadBalancerExists(ctx, resourceName, &conf),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elasticloadbalancing", regexp.MustCompile(fmt.Sprintf("loadbalancer/gwy/%s/.+", rName))),
-					resource.TestCheckResourceAttr(resourceName, "load_balancer_type", elbv2.LoadBalancerTypeEnumGateway),
-					resource.TestCheckResourceAttr(resourceName, "enable_cross_zone_load_balancing", "false"),
-				),
-			},
 		},
 	})
 }
 
-func TestAccELBV2LoadBalancer_ALB_outpost(t *testing.T) {
+func TestAccELBV2LoadBalancer_duplicateName(t *testing.T) {
 	ctx := acctest.Context(t)
 	var conf elbv2.LoadBalancer
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
-	resourceName := "aws_lb.lb_test"
+	resourceName := "aws_lb.test"
 
 	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckOutpostsOutposts(ctx, t) },
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
 		ErrorCheck:               acctest.ErrorCheck(t, elbv2.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckLoadBalancerDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccLoadBalancerConfig_outpost(rName),
+				Config: testAccLoadBalancerConfig_basic(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckLoadBalancerExists(ctx, resourceName, &conf),
-					resource.TestCheckResourceAttr(resourceName, "access_logs.#", "1"),
-					resource.TestCheckResourceAttr(resourceName, "access_logs.0.enabled", "false"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elasticloadbalancing", regexp.MustCompile(fmt.Sprintf("loadbalancer/app/%s/.+", rName))),
-					resource.TestCheckResourceAttrSet(resourceName, "dns_name"),
-					resource.TestCheckResourceAttr(resourceName, "enable_deletion_protection", "false"),
-					resource.TestCheckResourceAttr(resourceName, "idle_timeout", "30"),
-					resource.TestCheckResourceAttr(resourceName, "ip_address_type", "ipv4"),
-					resource.TestCheckResourceAttr(resourceName, "load_balancer_type", "application"),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
-					resource.TestCheckResourceAttr(resourceName, "security_groups.#", "1"),
-					resource.TestCheckResourceAttr(resourceName, "subnets.#", "1"),
-					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
-					resource.TestCheckResourceAttr(resourceName, "tags.Name", rName),
-					resource.TestCheckResourceAttr(resourceName, "subnet_mapping.#", "1"),
-					resource.TestCheckResourceAttrSet(resourceName, "subnet_mapping.0.outpost_id"),
-					resource.TestCheckResourceAttrSet(resourceName, "customer_owned_ipv4_pool"),
-					resource.TestCheckResourceAttrSet(resourceName, "vpc_id"),
-					resource.TestCheckResourceAttrSet(resourceName, "zone_id"),
 				),
 			},
+			{
+				Config:      testAccLoadBalancerConfig_duplicateName(rName),
+				ExpectError: regexache.MustCompile(`already exists`),
+			},
 		},
 	})
 }
 
-func TestAccELBV2LoadBalancer_networkLoadBalancerEIP(t *testing.T) {
+func TestAccELBV2LoadBalancer_tags(t *testing.T) {
 	ctx := acctest.Context(t)
 	var conf elbv2.LoadBalancer
-	resourceName := "aws_lb.lb_test"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_lb.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
@@ -330,25 +338,35 @@ func TestAccELBV2LoadBalancer_networkLoadBalancerEIP(t *testing.T) {
 		CheckDestroy:             testAccCheckLoadBalancerDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccLoadBalancerConfig_nlbEIP(rName),
+				Config: testAccLoadBalancerConfig_tags1(rName, "key1", "value1"),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckLoadBalancerExists(ctx, resourceName, &conf),
-					resource.TestCheckResourceAttr(resourceName, "name", rName),
-					resource.TestCheckResourceAttr(resourceName, "internal", "false"),
-					resource.TestCheckResourceAttr(resourceName, "ip_address_type", "ipv4"),
-					resource.TestCheckResourceAttrSet(resourceName, "zone_id"),
-					resource.TestCheckResourceAttrSet(resourceName, "dns_name"),
-					resource.TestCheckResourceAttrSet(resourceName, "arn"),
-					resource.TestCheckResourceAttr(resourceName, "load_balancer_type", "network"),
-					resource.TestCheckResourceAttr(resourceName, "enable_deletion_protection", "false"),
-					resource.TestCheckResourceAttr(resourceName, "subnet_mapping.#", "2"),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
+				),
+			},
+			{
+				Config: testAccLoadBalancerConfig_tags2(rName, "key1", "value1updated", "key2", "value2"),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckLoadBalancerExists(ctx, resourceName, &conf),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1updated"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
+				),
+			},
+			{
+				Config: testAccLoadBalancerConfig_tags1(rName, "key2", "value2"),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckLoadBalancerExists(ctx, resourceName, &conf),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
 				),
 			},
 		},
 	})
 }
 
-func TestAccELBV2LoadBalancer_NLB_privateIPv4Address(t *testing.T) {
+func TestAccELBV2LoadBalancer_ipv6SubnetMapping(t *testing.T) {
 	ctx := acctest.Context(t)
 	var conf elbv2.LoadBalancer
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
@@ -361,87 +379,118 @@ func TestAccELBV2LoadBalancer_NLB_privateIPv4Address(t *testing.T) {
 		CheckDestroy:             testAccCheckLoadBalancerDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccLoadBalancerConfig_nlbPrivateIPV4Address(rName),
+				Config: testAccLoadBalancerConfig_ipv6(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckLoadBalancerExists(ctx, resourceName, &conf),
-					resource.TestCheckResourceAttr(resourceName, "internal", "true"),
-					resource.TestCheckResourceAttr(resourceName, "load_balancer_type", "network"),
-					resource.TestCheckResourceAttr(resourceName, "subnet_mapping.#", "1"),
+					resource.TestMatchTypeSetElemNestedAttrs(resourceName, "subnet_mapping.*", map[string]*regexp.Regexp{
+						"ipv6_address": regexache.MustCompile("[0-6a-f]+:[0-6a-f:]+"),
+					}),
 				),
 			},
 			{
 				ResourceName:      resourceName,
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{
+					"drop_invalid_header_fields",
+					"enable_http2",
+					"idle_timeout",
+				},
 			},
 		},
 	})
 }
 
-func TestAccELBV2LoadBalancer_backwardsCompatibility(t *testing.T) {
+func TestAccELBV2LoadBalancer_LoadBalancerTypeGateway_enableCrossZoneLoadBalancing(t *testing.T) {
 	ctx := acctest.Context(t)
 	var conf elbv2.LoadBalancer
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
-	resourceName := "aws_alb.lb_test"
+	resourceName := "aws_lb.test"
 
 	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheckGatewayLoadBalancer(ctx, t) },
 		ErrorCheck:               acctest.ErrorCheck(t, elbv2.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckLoadBalancerDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccLoadBalancerConfig_backwardsCompatibility(rName),
+				Config: testAccLoadBalancerConfig_typeGatewayEnableCrossZoneBalancing(rName, true),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckLoadBalancerExists(ctx, resourceName, &conf),
-					resource.TestCheckResourceAttr(resourceName, "name", rName),
-					resource.TestCheckResourceAttr(resourceName, "internal", "true"),
-					resource.TestCheckResourceAttr(resourceName, "subnets.#", "2"),
-					resource.TestCheckResourceAttr(resourceName, "security_groups.#", "1"),
-					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
-					resource.TestCheckResourceAttr(resourceName, "tags.Name", rName),
-					resource.TestCheckResourceAttr(resourceName, "enable_deletion_protection", "false"),
-					resource.TestCheckResourceAttr(resourceName, "idle_timeout", "30"),
-					resource.TestCheckResourceAttr(resourceName, "ip_address_type", "ipv4"),
-					resource.TestCheckResourceAttr(resourceName, "load_balancer_type", "application"),
-					resource.TestCheckResourceAttrSet(resourceName, "vpc_id"),
-					resource.TestCheckResourceAttrSet(resourceName, "zone_id"),
-					resource.TestCheckResourceAttrSet(resourceName, "dns_name"),
-					resource.TestCheckResourceAttrSet(resourceName, "arn"),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elasticloadbalancing", regexache.MustCompile(fmt.Sprintf("loadbalancer/gwy/%s/.+", rName))),
+					resource.TestCheckResourceAttr(resourceName, "load_balancer_type", elbv2.LoadBalancerTypeEnumGateway),
+					resource.TestCheckResourceAttr(resourceName, "enable_cross_zone_load_balancing", "true"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{
+					"drop_invalid_header_fields",
+					"enable_http2",
+					"enable_waf_fail_open",
+					"idle_timeout",
+				},
+			},
+			{
+				Config: testAccLoadBalancerConfig_typeGatewayEnableCrossZoneBalancing(rName, false),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckLoadBalancerExists(ctx, resourceName, &conf),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elasticloadbalancing", regexache.MustCompile(fmt.Sprintf("loadbalancer/gwy/%s/.+", rName))),
+					resource.TestCheckResourceAttr(resourceName, "load_balancer_type", elbv2.LoadBalancerTypeEnumGateway),
+					resource.TestCheckResourceAttr(resourceName, "enable_cross_zone_load_balancing", "false"),
 				),
 			},
 		},
 	})
 }
 
-func TestAccELBV2LoadBalancer_generatedName(t *testing.T) {
+func TestAccELBV2LoadBalancer_ALB_outpost(t *testing.T) {
 	ctx := acctest.Context(t)
 	var conf elbv2.LoadBalancer
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
-	resourceName := "aws_lb.lb_test"
+	resourceName := "aws_lb.test"
 
 	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckOutpostsOutposts(ctx, t) },
 		ErrorCheck:               acctest.ErrorCheck(t, elbv2.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckLoadBalancerDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccLoadBalancerConfig_generatedName(rName),
+				Config: testAccLoadBalancerConfig_outpost(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckLoadBalancerExists(ctx, resourceName, &conf),
-					resource.TestCheckResourceAttrSet(resourceName, "name"),
+					resource.TestCheckResourceAttr(resourceName, "access_logs.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "access_logs.0.enabled", "false"),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elasticloadbalancing", regexache.MustCompile(fmt.Sprintf("loadbalancer/app/%s/.+", rName))),
+					resource.TestCheckResourceAttrSet(resourceName, "dns_name"),
+					resource.TestCheckResourceAttr(resourceName, "enable_deletion_protection", "false"),
+					resource.TestCheckResourceAttr(resourceName, "idle_timeout", "30"),
+					resource.TestCheckResourceAttr(resourceName, "ip_address_type", "ipv4"),
+					resource.TestCheckResourceAttr(resourceName, "load_balancer_type", "application"),
+					resource.TestCheckResourceAttr(resourceName, "name", rName),
+					resource.TestCheckResourceAttr(resourceName, "security_groups.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "subnets.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.Name", rName),
+					resource.TestCheckResourceAttr(resourceName, "subnet_mapping.#", "1"),
+					resource.TestCheckResourceAttrSet(resourceName, "subnet_mapping.0.outpost_id"),
+					resource.TestCheckResourceAttrSet(resourceName, "customer_owned_ipv4_pool"),
+					resource.TestCheckResourceAttrSet(resourceName, "vpc_id"),
+					resource.TestCheckResourceAttrSet(resourceName, "zone_id"),
 				),
 			},
 		},
 	})
 }
 
-func TestAccELBV2LoadBalancer_generatesNameForZeroValue(t *testing.T) {
+func TestAccELBV2LoadBalancer_networkLoadBalancerEIP(t *testing.T) {
 	ctx := acctest.Context(t)
 	var conf elbv2.LoadBalancer
+	resourceName := "aws_lb.test"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
-	resourceName := "aws_lb.lb_test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
@@ -450,21 +499,29 @@ func TestAccELBV2LoadBalancer_generatesNameForZeroValue(t *testing.T) {
 		CheckDestroy:             testAccCheckLoadBalancerDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccLoadBalancerConfig_zeroValueName(rName),
+				Config: testAccLoadBalancerConfig_nlbEIP(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckLoadBalancerExists(ctx, resourceName, &conf),
-					resource.TestCheckResourceAttrSet(resourceName, "name"),
+					resource.TestCheckResourceAttr(resourceName, "name", rName),
+					resource.TestCheckResourceAttr(resourceName, "internal", "false"),
+					resource.TestCheckResourceAttr(resourceName, "ip_address_type", "ipv4"),
+					resource.TestCheckResourceAttrSet(resourceName, "zone_id"),
+					resource.TestCheckResourceAttrSet(resourceName, "dns_name"),
+					resource.TestCheckResourceAttrSet(resourceName, "arn"),
+					resource.TestCheckResourceAttr(resourceName, "load_balancer_type", "network"),
+					resource.TestCheckResourceAttr(resourceName, "enable_deletion_protection", "false"),
+					resource.TestCheckResourceAttr(resourceName, "subnet_mapping.#", "2"),
 				),
 			},
 		},
 	})
 }
 
-func TestAccELBV2LoadBalancer_namePrefix(t *testing.T) {
+func TestAccELBV2LoadBalancer_NLB_privateIPv4Address(t *testing.T) {
 	ctx := acctest.Context(t)
 	var conf elbv2.LoadBalancer
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
-	resourceName := "aws_lb.lb_test"
+	resourceName := "aws_lb.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
@@ -473,23 +530,28 @@ func TestAccELBV2LoadBalancer_namePrefix(t *testing.T) {
 		CheckDestroy:             testAccCheckLoadBalancerDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccLoadBalancerConfig_namePrefix(rName),
+				Config: testAccLoadBalancerConfig_nlbPrivateIPV4Address(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckLoadBalancerExists(ctx, resourceName, &conf),
-					resource.TestCheckResourceAttrSet(resourceName, "name"),
-					resource.TestMatchResourceAttr(resourceName, "name",
-						regexp.MustCompile("^tf-lb-")),
+					resource.TestCheckResourceAttr(resourceName, "internal", "true"),
+					resource.TestCheckResourceAttr(resourceName, "load_balancer_type", "network"),
+					resource.TestCheckResourceAttr(resourceName, "subnet_mapping.#", "1"),
 				),
 			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
 		},
 	})
 }
 
-func TestAccELBV2LoadBalancer_tags(t *testing.T) {
+func TestAccELBV2LoadBalancer_backwardsCompatibility(t *testing.T) {
 	ctx := acctest.Context(t)
 	var conf elbv2.LoadBalancer
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
-	resourceName := "aws_lb.test"
+	resourceName := "aws_alb.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
@@ -498,28 +560,23 @@ func TestAccELBV2LoadBalancer_tags(t *testing.T) {
 		CheckDestroy:             testAccCheckLoadBalancerDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccLoadBalancerConfig_tags1(rName, "key1", "value1"),
-				Check: resource.ComposeAggregateTestCheckFunc(
-					testAccCheckLoadBalancerExists(ctx, resourceName, &conf),
-					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
-					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
-				),
-			},
-			{
-				Config: testAccLoadBalancerConfig_tags2(rName, "key1", "value1updated", "key2", "value2"),
-				Check: resource.ComposeAggregateTestCheckFunc(
-					testAccCheckLoadBalancerExists(ctx, resourceName, &conf),
-					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
-					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1updated"),
-					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
-				),
-			},
-			{
-				Config: testAccLoadBalancerConfig_tags1(rName, "key2", "value2"),
+				Config: testAccLoadBalancerConfig_backwardsCompatibility(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckLoadBalancerExists(ctx, resourceName, &conf),
+					resource.TestCheckResourceAttr(resourceName, "name", rName),
+					resource.TestCheckResourceAttr(resourceName, "internal", "true"),
+					resource.TestCheckResourceAttr(resourceName, "subnets.#", "2"),
+					resource.TestCheckResourceAttr(resourceName, "security_groups.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
-					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
+					resource.TestCheckResourceAttr(resourceName, "tags.Name", rName),
+					resource.TestCheckResourceAttr(resourceName, "enable_deletion_protection", "false"),
+					resource.TestCheckResourceAttr(resourceName, "idle_timeout", "30"),
+					resource.TestCheckResourceAttr(resourceName, "ip_address_type", "ipv4"),
+					resource.TestCheckResourceAttr(resourceName, "load_balancer_type", "application"),
+					resource.TestCheckResourceAttrSet(resourceName, "vpc_id"),
+					resource.TestCheckResourceAttrSet(resourceName, "zone_id"),
+					resource.TestCheckResourceAttrSet(resourceName, "dns_name"),
+					resource.TestCheckResourceAttrSet(resourceName, "arn"),
 				),
 			},
 		},
@@ -530,7 +587,7 @@ func TestAccELBV2LoadBalancer_NetworkLoadBalancer_updateCrossZone(t *testing.T)
 	ctx := acctest.Context(t)
 	var pre, mid, post elbv2.LoadBalancer
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
-	resourceName := "aws_lb.lb_test"
+	resourceName := "aws_lb.test"
 
 	if testing.Short() {
 		t.Skip("skipping long-running test in short mode")
@@ -556,7 +613,7 @@ func TestAccELBV2LoadBalancer_NetworkLoadBalancer_updateCrossZone(t *testing.T)
 					testAccCheckLoadBalancerExists(ctx, resourceName, &mid),
 					testAccCheckLoadBalancerAttribute(ctx, resourceName, "load_balancing.cross_zone.enabled", "false"),
 					resource.TestCheckResourceAttr(resourceName, "enable_cross_zone_load_balancing", "false"),
-					testAccChecklbARNs(&pre, &mid),
+					testAccCheckLoadBalancerNotRecreated(&pre, &mid),
 				),
 			},
 			{
@@ -565,7 +622,7 @@ func TestAccELBV2LoadBalancer_NetworkLoadBalancer_updateCrossZone(t *testing.T)
 					testAccCheckLoadBalancerExists(ctx, resourceName, &post),
 					testAccCheckLoadBalancerAttribute(ctx, resourceName, "load_balancing.cross_zone.enabled", "true"),
 					resource.TestCheckResourceAttr(resourceName, "enable_cross_zone_load_balancing", "true"),
-					testAccChecklbARNs(&mid, &post),
+					testAccCheckLoadBalancerNotRecreated(&mid, &post),
 				),
 			},
 		},
@@ -576,7 +633,7 @@ func TestAccELBV2LoadBalancer_ApplicationLoadBalancer_updateHTTP2(t *testing.T)
 	ctx := acctest.Context(t)
 	var pre, mid, post elbv2.LoadBalancer
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
-	resourceName := "aws_lb.lb_test"
+	resourceName := "aws_lb.test"
 
 	if testing.Short() {
 		t.Skip("skipping long-running test in short mode")
@@ -602,7 +659,7 @@ func TestAccELBV2LoadBalancer_ApplicationLoadBalancer_updateHTTP2(t *testing.T)
 					testAccCheckLoadBalancerExists(ctx, resourceName, &mid),
 					testAccCheckLoadBalancerAttribute(ctx, resourceName, "routing.http2.enabled", "true"),
 					resource.TestCheckResourceAttr(resourceName, "enable_http2", "true"),
-					testAccChecklbARNs(&pre, &mid),
+					testAccCheckLoadBalancerNotRecreated(&pre, &mid),
 				),
 			},
 			{
@@ -611,7 +668,7 @@ func TestAccELBV2LoadBalancer_ApplicationLoadBalancer_updateHTTP2(t *testing.T)
 					testAccCheckLoadBalancerExists(ctx, resourceName, &post),
 					testAccCheckLoadBalancerAttribute(ctx, resourceName, "routing.http2.enabled", "false"),
 					resource.TestCheckResourceAttr(resourceName, "enable_http2", "false"),
-					testAccChecklbARNs(&mid, &post),
+					testAccCheckLoadBalancerNotRecreated(&mid, &post),
 				),
 			},
 		},
@@ -636,27 +693,27 @@ func TestAccELBV2LoadBalancer_ApplicationLoadBalancer_updateDropInvalidHeaderFie
 			{
 				Config: testAccLoadBalancerConfig_enableDropInvalidHeaderFields(rName, false),
 				Check: resource.ComposeAggregateTestCheckFunc(
-					testAccCheckLoadBalancerExists(ctx, "aws_lb.lb_test", &pre),
-					testAccCheckLoadBalancerAttribute(ctx, "aws_lb.lb_test", "routing.http.drop_invalid_header_fields.enabled", "false"),
-					resource.TestCheckResourceAttr("aws_lb.lb_test", "drop_invalid_header_fields", "false"),
+					testAccCheckLoadBalancerExists(ctx, "aws_lb.test", &pre),
+					testAccCheckLoadBalancerAttribute(ctx, "aws_lb.test", "routing.http.drop_invalid_header_fields.enabled", "false"),
+					resource.TestCheckResourceAttr("aws_lb.test", "drop_invalid_header_fields", "false"),
 				),
 			},
 			{
 				Config: testAccLoadBalancerConfig_enableDropInvalidHeaderFields(rName, true),
 				Check: resource.ComposeAggregateTestCheckFunc(
-					testAccCheckLoadBalancerExists(ctx, "aws_lb.lb_test", &mid),
-					testAccCheckLoadBalancerAttribute(ctx, "aws_lb.lb_test", "routing.http.drop_invalid_header_fields.enabled", "true"),
-					resource.TestCheckResourceAttr("aws_lb.lb_test", "drop_invalid_header_fields", "true"),
-					testAccChecklbARNs(&pre, &mid),
+					testAccCheckLoadBalancerExists(ctx, "aws_lb.test", &mid),
+					testAccCheckLoadBalancerAttribute(ctx, "aws_lb.test", "routing.http.drop_invalid_header_fields.enabled", "true"),
+					resource.TestCheckResourceAttr("aws_lb.test", "drop_invalid_header_fields", "true"),
+					testAccCheckLoadBalancerNotRecreated(&pre, &mid),
 				),
 			},
 			{
 				Config: testAccLoadBalancerConfig_enableDropInvalidHeaderFields(rName, false),
 				Check: resource.ComposeAggregateTestCheckFunc(
-					testAccCheckLoadBalancerExists(ctx, "aws_lb.lb_test", &post),
-					testAccCheckLoadBalancerAttribute(ctx, "aws_lb.lb_test", "routing.http.drop_invalid_header_fields.enabled", "false"),
-					resource.TestCheckResourceAttr("aws_lb.lb_test", "drop_invalid_header_fields", "false"),
-					testAccChecklbARNs(&mid, &post),
+					testAccCheckLoadBalancerExists(ctx, "aws_lb.test", &post),
+					testAccCheckLoadBalancerAttribute(ctx, "aws_lb.test", "routing.http.drop_invalid_header_fields.enabled", "false"),
+					resource.TestCheckResourceAttr("aws_lb.test", "drop_invalid_header_fields", "false"),
+					testAccCheckLoadBalancerNotRecreated(&mid, &post),
 				),
 			},
 		},
@@ -681,27 +738,27 @@ func TestAccELBV2LoadBalancer_ApplicationLoadBalancer_updatePreserveHostHeader(t
 			{
 				Config: testAccLoadBalancerConfig_enablePreserveHostHeader(rName, false),
 				Check: resource.ComposeAggregateTestCheckFunc(
-					testAccCheckLoadBalancerExists(ctx, "aws_lb.lb_test", &pre),
-					testAccCheckLoadBalancerAttribute(ctx, "aws_lb.lb_test", "routing.http.preserve_host_header.enabled", "false"),
-					resource.TestCheckResourceAttr("aws_lb.lb_test", "preserve_host_header", "false"),
+					testAccCheckLoadBalancerExists(ctx, "aws_lb.test", &pre),
+					testAccCheckLoadBalancerAttribute(ctx, "aws_lb.test", "routing.http.preserve_host_header.enabled", "false"),
+					resource.TestCheckResourceAttr("aws_lb.test", "preserve_host_header", "false"),
 				),
 			},
 			{
 				Config: testAccLoadBalancerConfig_enablePreserveHostHeader(rName, true),
 				Check: resource.ComposeAggregateTestCheckFunc(
-					testAccCheckLoadBalancerExists(ctx, "aws_lb.lb_test", &mid),
-					testAccCheckLoadBalancerAttribute(ctx, "aws_lb.lb_test", "routing.http.preserve_host_header.enabled", "true"),
-					resource.TestCheckResourceAttr("aws_lb.lb_test", "preserve_host_header", "true"),
-					testAccChecklbARNs(&pre, &mid),
+					testAccCheckLoadBalancerExists(ctx, "aws_lb.test", &mid),
+					testAccCheckLoadBalancerAttribute(ctx, "aws_lb.test", "routing.http.preserve_host_header.enabled", "true"),
+					resource.TestCheckResourceAttr("aws_lb.test", "preserve_host_header", "true"),
+					testAccCheckLoadBalancerNotRecreated(&pre, &mid),
 				),
 			},
 			{
 				Config: testAccLoadBalancerConfig_enablePreserveHostHeader(rName, false),
 				Check: resource.ComposeAggregateTestCheckFunc(
-					testAccCheckLoadBalancerExists(ctx, "aws_lb.lb_test", &post),
-					testAccCheckLoadBalancerAttribute(ctx, "aws_lb.lb_test", "routing.http.preserve_host_header.enabled", "false"),
-					resource.TestCheckResourceAttr("aws_lb.lb_test", "preserve_host_header", "false"),
-					testAccChecklbARNs(&mid, &post),
+					testAccCheckLoadBalancerExists(ctx, "aws_lb.test", &post),
+					testAccCheckLoadBalancerAttribute(ctx, "aws_lb.test", "routing.http.preserve_host_header.enabled", "false"),
+					resource.TestCheckResourceAttr("aws_lb.test", "preserve_host_header", "false"),
+					testAccCheckLoadBalancerNotRecreated(&mid, &post),
 				),
 			},
 		},
@@ -712,7 +769,7 @@ func TestAccELBV2LoadBalancer_ApplicationLoadBalancer_updateDeletionProtection(t
 	ctx := acctest.Context(t)
 	var pre, mid, post elbv2.LoadBalancer
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
-	resourceName := "aws_lb.lb_test"
+	resourceName := "aws_lb.test"
 
 	if testing.Short() {
 		t.Skip("skipping long-running test in short mode")
@@ -738,7 +795,7 @@ func TestAccELBV2LoadBalancer_ApplicationLoadBalancer_updateDeletionProtection(t
 					testAccCheckLoadBalancerExists(ctx, resourceName, &mid),
 					testAccCheckLoadBalancerAttribute(ctx, resourceName, "deletion_protection.enabled", "true"),
 					resource.TestCheckResourceAttr(resourceName, "enable_deletion_protection", "true"),
-					testAccChecklbARNs(&pre, &mid),
+					testAccCheckLoadBalancerNotRecreated(&pre, &mid),
 				),
 			},
 			{
@@ -747,7 +804,7 @@ func TestAccELBV2LoadBalancer_ApplicationLoadBalancer_updateDeletionProtection(t
 					testAccCheckLoadBalancerExists(ctx, resourceName, &post),
 					testAccCheckLoadBalancerAttribute(ctx, resourceName, "deletion_protection.enabled", "false"),
 					resource.TestCheckResourceAttr(resourceName, "enable_deletion_protection", "false"),
-					testAccChecklbARNs(&mid, &post),
+					testAccCheckLoadBalancerNotRecreated(&mid, &post),
 				),
 			},
 		},
@@ -758,7 +815,7 @@ func TestAccELBV2LoadBalancer_ApplicationLoadBalancer_updateWAFFailOpen(t *testi
 	ctx := acctest.Context(t)
 	var pre, mid, post elbv2.LoadBalancer
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
-	resourceName := "aws_lb.lb_test"
+	resourceName := "aws_lb.test"
 
 	if testing.Short() {
 		t.Skip("skipping long-running test in short mode")
@@ -787,7 +844,7 @@ func TestAccELBV2LoadBalancer_ApplicationLoadBalancer_updateWAFFailOpen(t *testi
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckLoadBalancerExists(ctx, resourceName, &mid),
 					resource.TestCheckResourceAttr(resourceName, "enable_waf_fail_open", "true"),
-					testAccChecklbARNs(&pre, &mid),
+					testAccCheckLoadBalancerNotRecreated(&pre, &mid),
 				),
 			},
 			{
@@ -800,18 +857,18 @@ func TestAccELBV2LoadBalancer_ApplicationLoadBalancer_updateWAFFailOpen(t *testi
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckLoadBalancerExists(ctx, resourceName, &post),
 					resource.TestCheckResourceAttr(resourceName, "enable_waf_fail_open", "false"),
-					testAccChecklbARNs(&mid, &post),
+					testAccCheckLoadBalancerNotRecreated(&mid, &post),
 				),
 			},
 		},
 	})
 }
 
-func TestAccELBV2LoadBalancer_updatedIPAddressType(t *testing.T) {
+func TestAccELBV2LoadBalancer_updateIPAddressType(t *testing.T) {
 	ctx := acctest.Context(t)
 	var pre, post elbv2.LoadBalancer
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
-	resourceName := "aws_lb.lb_test"
+	resourceName := "aws_lb.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
@@ -820,14 +877,14 @@ func TestAccELBV2LoadBalancer_updatedIPAddressType(t *testing.T) {
 		CheckDestroy:             testAccCheckLoadBalancerDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccLoadBalancerConfig_ipAddressType(rName),
+				Config: testAccLoadBalancerConfig_ipAddressType(rName, "ipv4"),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckLoadBalancerExists(ctx, resourceName, &pre),
 					resource.TestCheckResourceAttr(resourceName, "ip_address_type", "ipv4"),
 				),
 			},
 			{
-				Config: testAccLoadBalancerConfig_ipAddressTypeUpdated(rName),
+				Config: testAccLoadBalancerConfig_ipAddressType(rName, "dualstack"),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckLoadBalancerExists(ctx, resourceName, &post),
 					resource.TestCheckResourceAttr(resourceName, "ip_address_type", "dualstack"),
@@ -837,7 +894,7 @@ func TestAccELBV2LoadBalancer_updatedIPAddressType(t *testing.T) {
 	})
 }
 
-func TestAccELBV2LoadBalancer_updatedSecurityGroups(t *testing.T) {
+func TestAccELBV2LoadBalancer_ApplicationLoadBalancer_updatedSecurityGroups(t *testing.T) {
 	ctx := acctest.Context(t)
 	var pre, post elbv2.LoadBalancer
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
@@ -861,18 +918,18 @@ func TestAccELBV2LoadBalancer_updatedSecurityGroups(t *testing.T) {
 				),
 			},
 			{
-				Config: testAccLoadBalancerConfig_updateSecurityGroups(rName),
+				Config: testAccLoadBalancerConfig_albUpdateSecurityGroups(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckLoadBalancerExists(ctx, resourceName, &post),
 					resource.TestCheckResourceAttr(resourceName, "security_groups.#", "2"),
-					testAccChecklbARNs(&pre, &post),
+					testAccCheckLoadBalancerNotRecreated(&pre, &post),
 				),
 			},
 		},
 	})
 }
 
-func TestAccELBV2LoadBalancer_updatedSubnets(t *testing.T) {
+func TestAccELBV2LoadBalancer_ApplicationLoadBalancer_updateSubnets(t *testing.T) {
 	ctx := acctest.Context(t)
 	var pre, post elbv2.LoadBalancer
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
@@ -899,8 +956,8 @@ func TestAccELBV2LoadBalancer_updatedSubnets(t *testing.T) {
 				Config: testAccLoadBalancerConfig_updateSubnets(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckLoadBalancerExists(ctx, resourceName, &post),
+					testAccCheckLoadBalancerNotRecreated(&pre, &post),
 					resource.TestCheckResourceAttr(resourceName, "subnets.#", "3"),
-					testAccChecklbARNs(&pre, &post),
 				),
 			},
 		},
@@ -910,7 +967,7 @@ func TestAccELBV2LoadBalancer_updatedSubnets(t *testing.T) {
 // TestAccELBV2LoadBalancer_noSecurityGroup regression tests the issue in #8264,
 // where if an ALB is created without a security group, a default one
 // is assigned.
-func TestAccELBV2LoadBalancer_noSecurityGroup(t *testing.T) {
+func TestAccELBV2LoadBalancer_ApplicationLoadBalancer_noSecurityGroup(t *testing.T) {
 	ctx := acctest.Context(t)
 	var conf elbv2.LoadBalancer
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
@@ -923,7 +980,7 @@ func TestAccELBV2LoadBalancer_noSecurityGroup(t *testing.T) {
 		CheckDestroy:             testAccCheckLoadBalancerDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccLoadBalancerConfig_nosg(rName),
+				Config: testAccLoadBalancerConfig_albNoSecurityGroups(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckLoadBalancerExists(ctx, resourceName, &conf),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
@@ -941,7 +998,7 @@ func TestAccELBV2LoadBalancer_noSecurityGroup(t *testing.T) {
 	})
 }
 
-func TestAccELBV2LoadBalancer_ALB_accessLogs(t *testing.T) {
+func TestAccELBV2LoadBalancer_ApplicationLoadBalancer_accessLogs(t *testing.T) {
 	ctx := acctest.Context(t)
 	var conf elbv2.LoadBalancer
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
@@ -1033,7 +1090,7 @@ func TestAccELBV2LoadBalancer_ALB_accessLogs(t *testing.T) {
 	})
 }
 
-func TestAccELBV2LoadBalancer_ALBAccessLogs_prefix(t *testing.T) {
+func TestAccELBV2LoadBalancer_ApplicationLoadBalancer_accessLogsPrefix(t *testing.T) {
 	ctx := acctest.Context(t)
 	var conf elbv2.LoadBalancer
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
@@ -1107,7 +1164,7 @@ func TestAccELBV2LoadBalancer_ALBAccessLogs_prefix(t *testing.T) {
 	})
 }
 
-func TestAccELBV2LoadBalancer_NLB_accessLogs(t *testing.T) {
+func TestAccELBV2LoadBalancer_NetworkLoadBalancer_accessLogs(t *testing.T) {
 	ctx := acctest.Context(t)
 	if testing.Short() {
 		t.Skip("skipping long-running test in short mode")
@@ -1199,7 +1256,7 @@ func TestAccELBV2LoadBalancer_NLB_accessLogs(t *testing.T) {
 	})
 }
 
-func TestAccELBV2LoadBalancer_NLBAccessLogs_prefix(t *testing.T) {
+func TestAccELBV2LoadBalancer_NetworkLoadBalancer_accessLogsPrefix(t *testing.T) {
 	ctx := acctest.Context(t)
 	if testing.Short() {
 		t.Skip("skipping long-running test in short mode")
@@ -1273,7 +1330,7 @@ func TestAccELBV2LoadBalancer_NLBAccessLogs_prefix(t *testing.T) {
 	})
 }
 
-func TestAccELBV2LoadBalancer_NetworkLoadBalancerSubnet_change(t *testing.T) {
+func TestAccELBV2LoadBalancer_NetworkLoadBalancer_updateDNSRecordClientRoutingPolicy(t *testing.T) {
 	ctx := acctest.Context(t)
 	var conf elbv2.LoadBalancer
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
@@ -1286,23 +1343,120 @@ func TestAccELBV2LoadBalancer_NetworkLoadBalancerSubnet_change(t *testing.T) {
 		CheckDestroy:             testAccCheckLoadBalancerDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccLoadBalancerConfig_nlbSubnets(rName),
+				Config: testAccLoadBalancerConfig_nlbDNSRecordClientRoutingPolicyAffinity(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckLoadBalancerExists(ctx, resourceName, &conf),
-					resource.TestCheckResourceAttr(resourceName, "subnets.#", "3"),
+					resource.TestCheckResourceAttr(resourceName, "dns_record_client_routing_policy", "availability_zone_affinity"),
 				),
 			},
-		},
-	})
-}
-
-func TestAccELBV2LoadBalancer_updateDesyncMitigationMode(t *testing.T) {
-	ctx := acctest.Context(t)
-	if testing.Short() {
-		t.Skip("skipping long-running test in short mode")
-	}
-
-	var pre, mid, post elbv2.LoadBalancer
+			{
+				Config: testAccLoadBalancerConfig_nlbDNSRecordClientRoutingPolicyPartialAffinity(rName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckLoadBalancerExists(ctx, resourceName, &conf),
+					resource.TestCheckResourceAttr(resourceName, "dns_record_client_routing_policy", "partial_availability_zone_affinity"),
+				),
+			},
+			{
+				Config: testAccLoadBalancerConfig_nlbDNSRecordClientRoutingPolicyAnyAvailabilityZone(rName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckLoadBalancerExists(ctx, resourceName, &conf),
+					resource.TestCheckResourceAttr(resourceName, "dns_record_client_routing_policy", "any_availability_zone"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
+func TestAccELBV2LoadBalancer_NetworkLoadBalancer_updateSecurityGroups(t *testing.T) {
+	ctx := acctest.Context(t)
+	var lb1, lb2, lb3, lb4 elbv2.LoadBalancer
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_lb.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, elbv2.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckLoadBalancerDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccLoadBalancerConfig_nlbSecurityGroups(rName, 0),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckLoadBalancerExists(ctx, resourceName, &lb1),
+					resource.TestCheckResourceAttr(resourceName, "security_groups.#", "0"),
+				),
+			},
+			{
+				Config: testAccLoadBalancerConfig_nlbSecurityGroups(rName, 1),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckLoadBalancerExists(ctx, resourceName, &lb2),
+					testAccCheckLoadBalancerRecreated(&lb2, &lb1),
+					resource.TestCheckResourceAttr(resourceName, "security_groups.#", "1"),
+				),
+			},
+			{
+				Config: testAccLoadBalancerConfig_nlbSecurityGroups(rName, 2),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckLoadBalancerExists(ctx, resourceName, &lb3),
+					testAccCheckLoadBalancerNotRecreated(&lb3, &lb2),
+					resource.TestCheckResourceAttr(resourceName, "security_groups.#", "2"),
+				),
+			},
+			{
+				Config: testAccLoadBalancerConfig_nlbSecurityGroups(rName, 0),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckLoadBalancerExists(ctx, resourceName, &lb4),
+					testAccCheckLoadBalancerRecreated(&lb4, &lb3),
+					resource.TestCheckResourceAttr(resourceName, "security_groups.#", "0"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccELBV2LoadBalancer_NetworkLoadBalancer_updateSubnets(t *testing.T) {
+	ctx := acctest.Context(t)
+	var pre, post elbv2.LoadBalancer
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_lb.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, elbv2.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckLoadBalancerDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccLoadBalancerConfig_nlbSubnets(rName, 2),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckLoadBalancerExists(ctx, resourceName, &pre),
+					resource.TestCheckResourceAttr(resourceName, "subnets.#", "2"),
+				),
+			},
+			{
+				Config: testAccLoadBalancerConfig_nlbSubnets(rName, 3),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckLoadBalancerExists(ctx, resourceName, &post),
+					testAccCheckLoadBalancerRecreated(&post, &pre),
+					resource.TestCheckResourceAttr(resourceName, "subnets.#", "3"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccELBV2LoadBalancer_updateDesyncMitigationMode(t *testing.T) {
+	ctx := acctest.Context(t)
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
+	var pre, mid, post elbv2.LoadBalancer
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_lb.test"
 
@@ -1512,10 +1666,20 @@ func TestAccELBV2LoadBalancer_ALB_updateXffClientPort(t *testing.T) {
 	})
 }
 
-func testAccChecklbARNs(pre, post *elbv2.LoadBalancer) resource.TestCheckFunc {
+func testAccCheckLoadBalancerNotRecreated(i, j *elbv2.LoadBalancer) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		if aws.StringValue(i.LoadBalancerArn) != aws.StringValue(j.LoadBalancerArn) {
+			return errors.New("ELBv2 Load Balancer was recreated")
+		}
+
+		return nil
+	}
+}
+
+func testAccCheckLoadBalancerRecreated(i, j *elbv2.LoadBalancer) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		if aws.StringValue(pre.LoadBalancerArn) != aws.StringValue(post.LoadBalancerArn) {
-			return errors.New("LB has been recreated. ARNs are different")
+		if aws.StringValue(i.LoadBalancerArn) == aws.StringValue(j.LoadBalancerArn) {
+			return errors.New("ELBv2 Load Balancer was not recreated")
 		}
 
 		return nil
@@ -1677,10 +1841,9 @@ resource "aws_lb" "test" {
 `, rName))
 }
 
-func testAccLoadBalancerConfig_tags1(rName, tagKey1, tagValue1 string) string {
+func testAccLoadBalancerConfig_nameGenerated(rName string) string {
 	return acctest.ConfigCompose(testAccLoadBalancerConfig_baseInternal(rName, 2), fmt.Sprintf(`
 resource "aws_lb" "test" {
-  name            = %[1]q
   internal        = true
   security_groups = [aws_security_group.test.id]
   subnets         = aws_subnet.test[*].id
@@ -1689,16 +1852,16 @@ resource "aws_lb" "test" {
   enable_deletion_protection = false
 
   tags = {
-    %[2]q = %[3]q
+    Name = %[1]q
   }
 }
-`, rName, tagKey1, tagValue1))
+`, rName))
 }
 
-func testAccLoadBalancerConfig_tags2(rName, tagKey1, tagValue1, tagKey2, tagValue2 string) string {
+func testAccLoadBalancerConfig_zeroValueName(rName string) string {
 	return acctest.ConfigCompose(testAccLoadBalancerConfig_baseInternal(rName, 2), fmt.Sprintf(`
 resource "aws_lb" "test" {
-  name            = %[1]q
+  name            = ""
   internal        = true
   security_groups = [aws_security_group.test.id]
   subnets         = aws_subnet.test[*].id
@@ -1707,21 +1870,24 @@ resource "aws_lb" "test" {
   enable_deletion_protection = false
 
   tags = {
-    %[2]q = %[3]q
-    %[4]q = %[5]q
+    Name = %[1]q
   }
 }
-`, rName, tagKey1, tagValue1, tagKey2, tagValue2))
-}
 
-func testAccLoadBalancerConfig_ipAddressTypeUpdated(rName string) string {
-	return acctest.ConfigCompose(acctest.ConfigAvailableAZsNoOptIn(), fmt.Sprintf(`
-resource "aws_lb" "lb_test" {
-  name            = %[1]q
-  security_groups = [aws_security_group.alb_test.id]
-  subnets         = [aws_subnet.alb_test_1.id, aws_subnet.alb_test_2.id]
+# See https://github.com/hashicorp/terraform-provider-aws/issues/2498
+output "lb_name" {
+  value = aws_lb.test.name
+}
+`, rName))
+}
 
-  ip_address_type = "dualstack"
+func testAccLoadBalancerConfig_namePrefix(rName, namePrefix string) string {
+	return acctest.ConfigCompose(testAccLoadBalancerConfig_baseInternal(rName, 2), fmt.Sprintf(`
+resource "aws_lb" "test" {
+  name_prefix     = %[2]q
+  internal        = true
+  security_groups = [aws_security_group.test.id]
+  subnets         = aws_subnet.test[*].id
 
   idle_timeout               = 30
   enable_deletion_protection = false
@@ -1730,111 +1896,68 @@ resource "aws_lb" "lb_test" {
     Name = %[1]q
   }
 }
-
-resource "aws_lb_listener" "test" {
-  load_balancer_arn = aws_lb.lb_test.id
-  protocol          = "HTTP"
-  port              = "80"
-
-  default_action {
-    target_group_arn = aws_lb_target_group.test.id
-    type             = "forward"
-  }
+`, rName, namePrefix))
 }
 
-resource "aws_lb_target_group" "test" {
-  name     = %[1]q
-  port     = 80
-  protocol = "HTTP"
-  vpc_id   = aws_vpc.alb_test.id
-
-  deregistration_delay = 200
-
-  stickiness {
-    type            = "lb_cookie"
-    cookie_duration = 10000
-  }
-
-  health_check {
-    path                = "/health2"
-    interval            = 30
-    port                = 8082
-    protocol            = "HTTPS"
-    timeout             = 4
-    healthy_threshold   = 4
-    unhealthy_threshold = 4
-    matcher             = "200"
-  }
-}
+func testAccLoadBalancerConfig_duplicateName(rName string) string {
+	return acctest.ConfigCompose(testAccLoadBalancerConfig_basic(rName), fmt.Sprintf(`
+resource "aws_lb" "test2" {
+  name            = %[1]q
+  internal        = true
+  security_groups = [aws_security_group.test.id]
+  subnets         = aws_subnet.test[*].id
 
-resource "aws_egress_only_internet_gateway" "igw" {
-  vpc_id = aws_vpc.alb_test.id
+  idle_timeout               = 30
+  enable_deletion_protection = false
 }
-
-resource "aws_vpc" "alb_test" {
-  cidr_block                       = "10.0.0.0/16"
-  assign_generated_ipv6_cidr_block = true
-
-  tags = {
-    Name = %[1]q
-  }
+`, rName))
 }
 
-resource "aws_internet_gateway" "foo" {
-  vpc_id = aws_vpc.alb_test.id
-}
+func testAccLoadBalancerConfig_tags1(rName, tagKey1, tagValue1 string) string {
+	return acctest.ConfigCompose(testAccLoadBalancerConfig_baseInternal(rName, 2), fmt.Sprintf(`
+resource "aws_lb" "test" {
+  name            = %[1]q
+  internal        = true
+  security_groups = [aws_security_group.test.id]
+  subnets         = aws_subnet.test[*].id
 
-resource "aws_subnet" "alb_test_1" {
-  vpc_id                  = aws_vpc.alb_test.id
-  cidr_block              = "10.0.1.0/24"
-  map_public_ip_on_launch = true
-  availability_zone       = data.aws_availability_zones.available.names[0]
-  ipv6_cidr_block         = cidrsubnet(aws_vpc.alb_test.ipv6_cidr_block, 8, 1)
+  idle_timeout               = 30
+  enable_deletion_protection = false
 
   tags = {
-    Name = %[1]q
+    %[2]q = %[3]q
   }
 }
-
-resource "aws_subnet" "alb_test_2" {
-  vpc_id                  = aws_vpc.alb_test.id
-  cidr_block              = "10.0.2.0/24"
-  map_public_ip_on_launch = true
-  availability_zone       = data.aws_availability_zones.available.names[1]
-  ipv6_cidr_block         = cidrsubnet(aws_vpc.alb_test.ipv6_cidr_block, 8, 2)
-
-  tags = {
-    Name = %[1]q
-  }
+`, rName, tagKey1, tagValue1))
 }
 
-resource "aws_security_group" "alb_test" {
-  name        = "allow_all_alb_test"
-  description = "Used for ALB Testing"
-  vpc_id      = aws_vpc.alb_test.id
+func testAccLoadBalancerConfig_tags2(rName, tagKey1, tagValue1, tagKey2, tagValue2 string) string {
+	return acctest.ConfigCompose(testAccLoadBalancerConfig_baseInternal(rName, 2), fmt.Sprintf(`
+resource "aws_lb" "test" {
+  name            = %[1]q
+  internal        = true
+  security_groups = [aws_security_group.test.id]
+  subnets         = aws_subnet.test[*].id
 
-  ingress {
-    from_port   = 0
-    to_port     = 0
-    protocol    = "-1"
-    cidr_blocks = ["0.0.0.0/0"]
-  }
+  idle_timeout               = 30
+  enable_deletion_protection = false
 
   tags = {
-    Name = %[1]q
+    %[2]q = %[3]q
+    %[4]q = %[5]q
   }
 }
-`, rName))
+`, rName, tagKey1, tagValue1, tagKey2, tagValue2))
 }
 
-func testAccLoadBalancerConfig_ipAddressType(rName string) string {
-	return acctest.ConfigCompose(acctest.ConfigAvailableAZsNoOptIn(), fmt.Sprintf(`
-resource "aws_lb" "lb_test" {
+func testAccLoadBalancerConfig_ipAddressType(rName, ipAddressType string) string {
+	return acctest.ConfigCompose(acctest.ConfigVPCWithSubnetsIPv6(rName, 2), fmt.Sprintf(`
+resource "aws_lb" "test" {
   name            = %[1]q
-  security_groups = [aws_security_group.alb_test.id]
-  subnets         = [aws_subnet.alb_test_1.id, aws_subnet.alb_test_2.id]
+  security_groups = [aws_security_group.test.id]
+  subnets         = aws_subnet.test[*].id
 
-  ip_address_type = "ipv4"
+  ip_address_type = %[2]q
 
   idle_timeout               = 30
   enable_deletion_protection = false
@@ -1842,102 +1965,42 @@ resource "aws_lb" "lb_test" {
   tags = {
     Name = %[1]q
   }
-}
-
-resource "aws_lb_listener" "test" {
-  load_balancer_arn = aws_lb.lb_test.id
-  protocol          = "HTTP"
-  port              = "80"
-
-  default_action {
-    target_group_arn = aws_lb_target_group.test.id
-    type             = "forward"
-  }
-}
-
-resource "aws_lb_target_group" "test" {
-  name     = %[1]q
-  port     = 80
-  protocol = "HTTP"
-  vpc_id   = aws_vpc.alb_test.id
-
-  deregistration_delay = 200
-
-  stickiness {
-    type            = "lb_cookie"
-    cookie_duration = 10000
-  }
-
-  health_check {
-    path                = "/health2"
-    interval            = 30
-    port                = 8082
-    protocol            = "HTTPS"
-    timeout             = 4
-    healthy_threshold   = 4
-    unhealthy_threshold = 4
-    matcher             = "200"
-  }
-}
 
-resource "aws_egress_only_internet_gateway" "igw" {
-  vpc_id = aws_vpc.alb_test.id
+  depends_on = [aws_egress_only_internet_gateway.test, aws_internet_gateway.test]
 }
 
-resource "aws_vpc" "alb_test" {
-  cidr_block                       = "10.0.0.0/16"
-  assign_generated_ipv6_cidr_block = true
+resource "aws_security_group" "test" {
+  name   = %[1]q
+  vpc_id = aws_vpc.test.id
 
-  tags = {
-    Name = %[1]q
+  ingress {
+    from_port   = 0
+    to_port     = 0
+    protocol    = "-1"
+    cidr_blocks = ["0.0.0.0/0"]
   }
-}
-
-resource "aws_internet_gateway" "foo" {
-  vpc_id = aws_vpc.alb_test.id
-}
-
-resource "aws_subnet" "alb_test_1" {
-  vpc_id                  = aws_vpc.alb_test.id
-  cidr_block              = "10.0.1.0/24"
-  map_public_ip_on_launch = true
-  availability_zone       = data.aws_availability_zones.available.names[0]
-  ipv6_cidr_block         = cidrsubnet(aws_vpc.alb_test.ipv6_cidr_block, 8, 1)
 
   tags = {
     Name = %[1]q
   }
 }
 
-resource "aws_subnet" "alb_test_2" {
-  vpc_id                  = aws_vpc.alb_test.id
-  cidr_block              = "10.0.2.0/24"
-  map_public_ip_on_launch = true
-  availability_zone       = data.aws_availability_zones.available.names[1]
-  ipv6_cidr_block         = cidrsubnet(aws_vpc.alb_test.ipv6_cidr_block, 8, 2)
+resource "aws_egress_only_internet_gateway" "test" {
+  vpc_id = aws_vpc.test.id
 
   tags = {
     Name = %[1]q
   }
 }
 
-resource "aws_security_group" "alb_test" {
-  name        = "allow_all_alb_test"
-  description = "Used for ALB Testing"
-  vpc_id      = aws_vpc.alb_test.id
-
-  ingress {
-    from_port   = 0
-    to_port     = 0
-    protocol    = "-1"
-    cidr_blocks = ["0.0.0.0/0"]
-  }
+resource "aws_internet_gateway" "test" {
+  vpc_id = aws_vpc.test.id
 
   tags = {
     Name = %[1]q
   }
 }
-`, rName))
+`, rName, ipAddressType))
 }
 
 func testAccLoadBalancerConfig_outpost(rName string) string {
@@ -1958,33 +2021,37 @@ data "aws_ec2_local_gateway_route_table" "test" {
 
 resource "aws_ec2_local_gateway_route_table_vpc_association" "test" {
   local_gateway_route_table_id = data.aws_ec2_local_gateway_route_table.test.id
-  vpc_id                       = aws_vpc.alb_test.id
+  vpc_id                       = aws_vpc.test.id
 }
 
 resource "aws_route_table" "test" {
-  vpc_id     = aws_vpc.alb_test.id
+  vpc_id     = aws_vpc.test.id
   depends_on = [aws_ec2_local_gateway_route_table_vpc_association.test]
+
+  tags = {
+    Name = %[1]q
+  }
 }
 
 resource "aws_route_table_association" "a" {
-  subnet_id      = aws_subnet.alb_test.id
+  subnet_id      = aws_subnet.test.id
   route_table_id = aws_route_table.test.id
 }
 
-resource "aws_lb" "lb_test" {
+resource "aws_lb" "test" {
   name                       = %[1]q
-  security_groups            = [aws_security_group.alb_test.id]
+  security_groups            = [aws_security_group.test.id]
   customer_owned_ipv4_pool   = tolist(data.aws_ec2_coip_pools.test.pool_ids)[0]
   idle_timeout               = 30
   enable_deletion_protection = false
-  subnets                    = [aws_subnet.alb_test.id]
+  subnets                    = [aws_subnet.test.id]
 
   tags = {
     Name = %[1]q
   }
 }
 
-resource "aws_vpc" "alb_test" {
+resource "aws_vpc" "test" {
   cidr_block = "10.0.0.0/16"
 
   tags = {
@@ -1992,8 +2059,8 @@ resource "aws_vpc" "alb_test" {
   }
 }
 
-resource "aws_subnet" "alb_test" {
-  vpc_id            = aws_vpc.alb_test.id
+resource "aws_subnet" "test" {
+  vpc_id            = aws_vpc.test.id
   cidr_block        = "10.0.0.0/24"
   availability_zone = data.aws_outposts_outpost.test.availability_zone
   outpost_arn       = data.aws_outposts_outpost.test.arn
@@ -2003,10 +2070,10 @@ resource "aws_subnet" "alb_test" {
   }
 }
 
-resource "aws_security_group" "alb_test" {
-  name        = "allow_all_alb_test"
+resource "aws_security_group" "test" {
+  name        = %[1]q
   description = "Used for ALB Testing"
-  vpc_id      = aws_vpc.alb_test.id
+  vpc_id      = aws_vpc.test.id
 
   ingress {
     from_port   = 0
@@ -2030,12 +2097,12 @@ resource "aws_security_group" "alb_test" {
 }
 
 func testAccLoadBalancerConfig_enableHTTP2(rName string, http2 bool) string {
-	return acctest.ConfigCompose(acctest.ConfigAvailableAZsNoOptIn(), fmt.Sprintf(`
-resource "aws_lb" "lb_test" {
+	return acctest.ConfigCompose(testAccLoadBalancerConfig_baseInternal(rName, 2), fmt.Sprintf(`
+resource "aws_lb" "test" {
   name            = %[1]q
   internal        = true
-  security_groups = [aws_security_group.alb_test.id]
-  subnets         = aws_subnet.alb_test[*].id
+  security_groups = [aws_security_group.test.id]
+  subnets         = aws_subnet.test[*].id
 
   idle_timeout               = 30
   enable_deletion_protection = false
@@ -2046,65 +2113,16 @@ resource "aws_lb" "lb_test" {
     Name = %[1]q
   }
 }
-
-variable "subnets" {
-  default = ["10.0.1.0/24", "10.0.2.0/24"]
-  type    = list(string)
+`, rName, http2))
 }
 
-resource "aws_vpc" "alb_test" {
-  cidr_block = "10.0.0.0/16"
-
-  tags = {
-    Name = %[1]q
-  }
-}
-
-resource "aws_subnet" "alb_test" {
-  count                   = 2
-  vpc_id                  = aws_vpc.alb_test.id
-  cidr_block              = element(var.subnets, count.index)
-  map_public_ip_on_launch = true
-  availability_zone       = element(data.aws_availability_zones.available.names, count.index)
-
-  tags = {
-    Name = "tf-acc-lb-basic-${count.index}"
-  }
-}
-
-resource "aws_security_group" "alb_test" {
-  name        = "allow_all_alb_test"
-  description = "Used for ALB Testing"
-  vpc_id      = aws_vpc.alb_test.id
-
-  ingress {
-    from_port   = 0
-    to_port     = 0
-    protocol    = "-1"
-    cidr_blocks = ["0.0.0.0/0"]
-  }
-
-  egress {
-    from_port   = 0
-    to_port     = 0
-    protocol    = "-1"
-    cidr_blocks = ["0.0.0.0/0"]
-  }
-
-  tags = {
-    Name = %[1]q
-  }
-}
-`, rName, http2))
-}
-
-func testAccLoadBalancerConfig_enableDropInvalidHeaderFields(rName string, dropInvalid bool) string {
-	return acctest.ConfigCompose(acctest.ConfigAvailableAZsNoOptIn(), fmt.Sprintf(`
-resource "aws_lb" "lb_test" {
-  name            = %[1]q
-  internal        = true
-  security_groups = [aws_security_group.alb_test.id]
-  subnets         = aws_subnet.alb_test[*].id
+func testAccLoadBalancerConfig_enableDropInvalidHeaderFields(rName string, dropInvalid bool) string {
+	return acctest.ConfigCompose(testAccLoadBalancerConfig_baseInternal(rName, 2), fmt.Sprintf(`
+resource "aws_lb" "test" {
+  name            = %[1]q
+  internal        = true
+  security_groups = [aws_security_group.test.id]
+  subnets         = aws_subnet.test[*].id
 
   idle_timeout               = 30
   enable_deletion_protection = false
@@ -2115,65 +2133,16 @@ resource "aws_lb" "lb_test" {
     Name = %[1]q
   }
 }
-
-variable "subnets" {
-  default = ["10.0.1.0/24", "10.0.2.0/24"]
-  type    = list(string)
-}
-
-resource "aws_vpc" "alb_test" {
-  cidr_block = "10.0.0.0/16"
-
-  tags = {
-    Name = %[1]q
-  }
-}
-
-resource "aws_subnet" "alb_test" {
-  count                   = 2
-  vpc_id                  = aws_vpc.alb_test.id
-  cidr_block              = element(var.subnets, count.index)
-  map_public_ip_on_launch = true
-  availability_zone       = element(data.aws_availability_zones.available.names, count.index)
-
-  tags = {
-    Name = "tf-acc-lb-basic-${count.index}"
-  }
-}
-
-resource "aws_security_group" "alb_test" {
-  name        = "allow_all_alb_test"
-  description = "Used for ALB Testing"
-  vpc_id      = aws_vpc.alb_test.id
-
-  ingress {
-    from_port   = 0
-    to_port     = 0
-    protocol    = "-1"
-    cidr_blocks = ["0.0.0.0/0"]
-  }
-
-  egress {
-    from_port   = 0
-    to_port     = 0
-    protocol    = "-1"
-    cidr_blocks = ["0.0.0.0/0"]
-  }
-
-  tags = {
-    Name = %[1]q
-  }
-}
 `, rName, dropInvalid))
 }
 
 func testAccLoadBalancerConfig_enablePreserveHostHeader(rName string, enablePreserveHostHeader bool) string {
-	return acctest.ConfigCompose(acctest.ConfigAvailableAZsNoOptIn(), fmt.Sprintf(`
-resource "aws_lb" "lb_test" {
+	return acctest.ConfigCompose(testAccLoadBalancerConfig_baseInternal(rName, 2), fmt.Sprintf(`
+resource "aws_lb" "test" {
   name            = %[1]q
   internal        = true
-  security_groups = [aws_security_group.alb_test.id]
-  subnets         = aws_subnet.alb_test[*].id
+  security_groups = [aws_security_group.test.id]
+  subnets         = aws_subnet.test[*].id
 
   idle_timeout               = 30
   enable_deletion_protection = false
@@ -2184,672 +2153,229 @@ resource "aws_lb" "lb_test" {
     Name = %[1]q
   }
 }
-
-variable "subnets" {
-  default = ["10.0.1.0/24", "10.0.2.0/24"]
-  type    = list(string)
-}
-
-resource "aws_vpc" "alb_test" {
-  cidr_block = "10.0.0.0/16"
-
-  tags = {
-    Name = %[1]q
-  }
-}
-
-resource "aws_subnet" "alb_test" {
-  count                   = 2
-  vpc_id                  = aws_vpc.alb_test.id
-  cidr_block              = element(var.subnets, count.index)
-  map_public_ip_on_launch = true
-  availability_zone       = element(data.aws_availability_zones.available.names, count.index)
-
-  tags = {
-    Name = "tf-acc-lb-basic-${count.index}"
-  }
-}
-
-resource "aws_security_group" "alb_test" {
-  name        = "allow_all_alb_test"
-  description = "Used for ALB Testing"
-  vpc_id      = aws_vpc.alb_test.id
-
-  ingress {
-    from_port   = 0
-    to_port     = 0
-    protocol    = "-1"
-    cidr_blocks = ["0.0.0.0/0"]
-  }
-
-  egress {
-    from_port   = 0
-    to_port     = 0
-    protocol    = "-1"
-    cidr_blocks = ["0.0.0.0/0"]
-  }
-
-  tags = {
-    Name = %[1]q
-  }
-}
 `, rName, enablePreserveHostHeader))
 }
 
 func testAccLoadBalancerConfig_enableDeletionProtection(rName string, deletionProtection bool) string {
-	return acctest.ConfigCompose(acctest.ConfigAvailableAZsNoOptIn(), fmt.Sprintf(`
-resource "aws_lb" "lb_test" {
-  name            = %[1]q
-  internal        = true
-  security_groups = [aws_security_group.alb_test.id]
-  subnets         = aws_subnet.alb_test[*].id
-
-  idle_timeout               = 30
-  enable_deletion_protection = %[2]t
-
-  tags = {
-    Name = %[1]q
-  }
-}
-
-variable "subnets" {
-  default = ["10.0.1.0/24", "10.0.2.0/24"]
-  type    = list(string)
-}
-
-resource "aws_vpc" "alb_test" {
-  cidr_block = "10.0.0.0/16"
-
-  tags = {
-    Name = %[1]q
-  }
-}
-
-resource "aws_subnet" "alb_test" {
-  count                   = 2
-  vpc_id                  = aws_vpc.alb_test.id
-  cidr_block              = element(var.subnets, count.index)
-  map_public_ip_on_launch = true
-  availability_zone       = element(data.aws_availability_zones.available.names, count.index)
-
-  tags = {
-    Name = "tf-acc-lb-basic-${count.index}"
-  }
-}
-
-resource "aws_security_group" "alb_test" {
-  name        = "allow_all_alb_test"
-  description = "Used for ALB Testing"
-  vpc_id      = aws_vpc.alb_test.id
-
-  ingress {
-    from_port   = 0
-    to_port     = 0
-    protocol    = "-1"
-    cidr_blocks = ["0.0.0.0/0"]
-  }
-
-  egress {
-    from_port   = 0
-    to_port     = 0
-    protocol    = "-1"
-    cidr_blocks = ["0.0.0.0/0"]
-  }
-
-  tags = {
-    Name = %[1]q
-  }
-}
-`, rName, deletionProtection))
-}
-
-func testAccLoadBalancerConfig_enableWAFFailOpen(rName string, wafFailOpen bool) string {
-	return acctest.ConfigCompose(
-		acctest.ConfigAvailableAZsNoOptIn(),
-		fmt.Sprintf(`
-resource "aws_lb" "lb_test" {
-  name            = %[1]q
-  internal        = true
-  security_groups = [aws_security_group.alb_test.id]
-  subnets         = aws_subnet.alb_test[*].id
-
-  idle_timeout               = 30
-  enable_deletion_protection = false
-
-  enable_waf_fail_open = %[2]t
-
-  tags = {
-    Name = %[1]q
-  }
-}
-
-variable "subnets" {
-  default = ["10.0.1.0/24", "10.0.2.0/24"]
-  type    = list(string)
-}
-
-resource "aws_vpc" "alb_test" {
-  cidr_block = "10.0.0.0/16"
-
-  tags = {
-    Name = %[1]q
-  }
-}
-
-resource "aws_subnet" "alb_test" {
-  count                   = 2
-  vpc_id                  = aws_vpc.alb_test.id
-  cidr_block              = element(var.subnets, count.index)
-  map_public_ip_on_launch = true
-  availability_zone       = element(data.aws_availability_zones.available.names, count.index)
-
-  tags = {
-    Name = "tf-acc-lb-basic-${count.index}"
-  }
-}
-
-resource "aws_security_group" "alb_test" {
-  name        = "allow_all_alb_test"
-  description = "Used for ALB Testing"
-  vpc_id      = aws_vpc.alb_test.id
-
-  ingress {
-    from_port   = 0
-    to_port     = 0
-    protocol    = "-1"
-    cidr_blocks = ["0.0.0.0/0"]
-  }
-
-  egress {
-    from_port   = 0
-    to_port     = 0
-    protocol    = "-1"
-    cidr_blocks = ["0.0.0.0/0"]
-  }
-
-  tags = {
-    Name = %[1]q
-  }
-}
-`, rName, wafFailOpen))
-}
-
-func testAccLoadBalancerConfig_nlb(rName string, cz bool) string {
-	return acctest.ConfigCompose(acctest.ConfigAvailableAZsNoOptIn(), fmt.Sprintf(`
-resource "aws_lb" "lb_test" {
-  name               = %[1]q
-  internal           = true
-  load_balancer_type = "network"
-
-  enable_deletion_protection       = false
-  enable_cross_zone_load_balancing = %[2]t
-
-  subnet_mapping {
-    subnet_id = aws_subnet.alb_test.id
-  }
-
-  tags = {
-    Name = %[1]q
-  }
-}
-
-resource "aws_vpc" "alb_test" {
-  cidr_block = "10.10.0.0/16"
-
-  tags = {
-    Name = %[1]q
-  }
-}
-
-resource "aws_subnet" "alb_test" {
-  vpc_id                  = aws_vpc.alb_test.id
-  cidr_block              = "10.10.0.0/21"
-  map_public_ip_on_launch = true
-  availability_zone       = data.aws_availability_zones.available.names[0]
-
-  tags = {
-    Name = %[1]q
-  }
-}
-`, rName, cz))
-}
-
-func testAccLoadBalancerConfig_typeGateway(rName string) string {
-	return acctest.ConfigCompose(
-		acctest.ConfigAvailableAZsNoOptIn(),
-		fmt.Sprintf(`
-resource "aws_vpc" "test" {
-  cidr_block = "10.10.10.0/25"
-
-  tags = {
-    Name = %[1]q
-  }
-}
-
-resource "aws_subnet" "test" {
-  availability_zone = data.aws_availability_zones.available.names[0]
-  cidr_block        = cidrsubnet(aws_vpc.test.cidr_block, 2, 0)
-  vpc_id            = aws_vpc.test.id
-
-  tags = {
-    Name = %[1]q
-  }
-}
-
-resource "aws_lb" "test" {
-  load_balancer_type = "gateway"
-  name               = %[1]q
-
-  subnet_mapping {
-    subnet_id = aws_subnet.test.id
-  }
-}
-`, rName))
-}
-
-func testAccLoadBalancerConfig_ipv6(rName string) string {
-	return acctest.ConfigCompose(
-		acctest.ConfigAvailableAZsNoOptIn(),
-		fmt.Sprintf(`
-resource "aws_vpc" "test" {
-  assign_generated_ipv6_cidr_block = true
-  cidr_block                       = "10.10.10.0/25"
-
-  tags = {
-    Name = %[1]q
-  }
-}
-
-resource "aws_internet_gateway" "gw" {
-  vpc_id = aws_vpc.test.id
-
-  tags = {
-    Name = %[1]q
-  }
-}
-
-resource "aws_subnet" "test" {
-  availability_zone = data.aws_availability_zones.available.names[0]
-  cidr_block        = cidrsubnet(aws_vpc.test.cidr_block, 2, 0)
-  ipv6_cidr_block   = cidrsubnet(aws_vpc.test.ipv6_cidr_block, 8, 16)
-  vpc_id            = aws_vpc.test.id
-
-  tags = {
-    Name = %[1]q
-  }
-}
-
-resource "aws_lb" "test" {
-  name                       = %[1]q
-  load_balancer_type         = "network"
-  enable_deletion_protection = false
-
-  subnet_mapping {
-    subnet_id    = aws_subnet.test.id
-    ipv6_address = cidrhost(cidrsubnet(aws_vpc.test.ipv6_cidr_block, 8, 16), 5)
-  }
-
-  tags = {
-    Name = %[1]q
-  }
-
-  depends_on = [aws_internet_gateway.gw]
-}
-`, rName))
-}
-
-func testAccLoadBalancerConfig_typeGatewayEnableCrossZoneBalancing(rName string, enableCrossZoneLoadBalancing bool) string {
-	return acctest.ConfigCompose(
-		acctest.ConfigAvailableAZsNoOptIn(),
-		fmt.Sprintf(`
-resource "aws_vpc" "test" {
-  cidr_block = "10.10.10.0/25"
-
-  tags = {
-    Name = %[1]q
-  }
-}
-
-resource "aws_subnet" "test" {
-  availability_zone = data.aws_availability_zones.available.names[0]
-  cidr_block        = cidrsubnet(aws_vpc.test.cidr_block, 2, 0)
-  vpc_id            = aws_vpc.test.id
-
-  tags = {
-    Name = %[1]q
-  }
-}
-
-resource "aws_lb" "test" {
-  enable_cross_zone_load_balancing = %[2]t
-  load_balancer_type               = "gateway"
-  name                             = %[1]q
-
-  subnet_mapping {
-    subnet_id = aws_subnet.test.id
-  }
-}
-`, rName, enableCrossZoneLoadBalancing))
-}
-
-func testAccLoadBalancerConfig_nlbEIP(rName string) string {
-	return acctest.ConfigCompose(acctest.ConfigAvailableAZsNoOptIn(), fmt.Sprintf(`
-resource "aws_vpc" "main" {
-  cidr_block = "10.10.0.0/16"
-
-  tags = {
-    Name = %[1]q
-  }
-}
-
-resource "aws_subnet" "public" {
-  count             = 2
-  availability_zone = data.aws_availability_zones.available.names[count.index]
-  cidr_block        = "10.10.${count.index}.0/24"
-  vpc_id            = aws_vpc.main.id
-
-  tags = {
-    Name = "tf-acc-lb-network-load-balancer-eip-${count.index}"
-  }
-}
-
-resource "aws_internet_gateway" "default" {
-  vpc_id = aws_vpc.main.id
-}
-
-resource "aws_route_table" "public" {
-  vpc_id = aws_vpc.main.id
-
-  route {
-    cidr_block = "0.0.0.0/0"
-    gateway_id = aws_internet_gateway.default.id
-  }
-}
-
-resource "aws_route_table_association" "a" {
-  count          = 2
-  subnet_id      = aws_subnet.public[count.index].id
-  route_table_id = aws_route_table.public.id
-}
-
-resource "aws_lb" "lb_test" {
-  name               = %[1]q
-  load_balancer_type = "network"
-
-  subnet_mapping {
-    subnet_id     = aws_subnet.public[0].id
-    allocation_id = aws_eip.lb[0].id
-  }
-
-  subnet_mapping {
-    subnet_id     = aws_subnet.public[1].id
-    allocation_id = aws_eip.lb[1].id
-  }
-
-  depends_on = [aws_internet_gateway.default]
-}
-
-resource "aws_eip" "lb" {
-  count = 2
-}
-`, rName))
-}
-
-func testAccLoadBalancerConfig_nlbPrivateIPV4Address(rName string) string {
-	return acctest.ConfigCompose(acctest.ConfigAvailableAZsNoOptIn(), fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccLoadBalancerConfig_baseInternal(rName, 2), fmt.Sprintf(`
 resource "aws_lb" "test" {
-  name                       = %[1]q
-  internal                   = true
-  load_balancer_type         = "network"
-  enable_deletion_protection = false
-
-  subnet_mapping {
-    subnet_id            = aws_subnet.test.id
-    private_ipv4_address = "10.10.0.15"
-  }
-
-  tags = {
-    Name = %[1]q
-  }
-}
-
-resource "aws_vpc" "test" {
-  cidr_block = "10.10.0.0/16"
-
-  tags = {
-    Name = %[1]q
-  }
-}
-
-resource "aws_subnet" "test" {
-  vpc_id                  = aws_vpc.test.id
-  cidr_block              = "10.10.0.0/21"
-  map_public_ip_on_launch = true
-  availability_zone       = data.aws_availability_zones.available.names[0]
+  name            = %[1]q
+  internal        = true
+  security_groups = [aws_security_group.test.id]
+  subnets         = aws_subnet.test[*].id
+
+  idle_timeout               = 30
+  enable_deletion_protection = %[2]t
 
   tags = {
     Name = %[1]q
   }
 }
-`, rName))
+`, rName, deletionProtection))
 }
 
-func testAccLoadBalancerConfig_backwardsCompatibility(rName string) string {
-	return acctest.ConfigCompose(acctest.ConfigAvailableAZsNoOptIn(), fmt.Sprintf(`
-resource "aws_alb" "lb_test" {
+func testAccLoadBalancerConfig_enableWAFFailOpen(rName string, wafFailOpen bool) string {
+	return acctest.ConfigCompose(testAccLoadBalancerConfig_baseInternal(rName, 2), fmt.Sprintf(`
+resource "aws_lb" "test" {
   name            = %[1]q
   internal        = true
-  security_groups = [aws_security_group.alb_test.id]
-  subnets         = aws_subnet.alb_test[*].id
+  security_groups = [aws_security_group.test.id]
+  subnets         = aws_subnet.test[*].id
 
   idle_timeout               = 30
   enable_deletion_protection = false
 
+  enable_waf_fail_open = %[2]t
+
   tags = {
     Name = %[1]q
   }
 }
-
-variable "subnets" {
-  default = ["10.0.1.0/24", "10.0.2.0/24"]
-  type    = list(string)
+`, rName, wafFailOpen))
 }
 
-resource "aws_vpc" "alb_test" {
-  cidr_block = "10.0.0.0/16"
+func testAccLoadBalancerConfig_nlb(rName string, cz bool) string {
+	return acctest.ConfigCompose(acctest.ConfigVPCWithSubnets(rName, 1), fmt.Sprintf(`
+resource "aws_lb" "test" {
+  name               = %[1]q
+  internal           = true
+  load_balancer_type = "network"
+
+  enable_deletion_protection       = false
+  enable_cross_zone_load_balancing = %[2]t
+
+  subnet_mapping {
+    subnet_id = aws_subnet.test[0].id
+  }
 
   tags = {
     Name = %[1]q
   }
 }
+`, rName, cz))
+}
 
-resource "aws_subnet" "alb_test" {
-  count                   = 2
-  vpc_id                  = aws_vpc.alb_test.id
-  cidr_block              = element(var.subnets, count.index)
-  map_public_ip_on_launch = true
-  availability_zone       = element(data.aws_availability_zones.available.names, count.index)
+func testAccLoadBalancerConfig_typeGateway(rName string) string {
+	return acctest.ConfigCompose(acctest.ConfigVPCWithSubnets(rName, 1), fmt.Sprintf(`
+resource "aws_lb" "test" {
+  load_balancer_type = "gateway"
+  name               = %[1]q
 
-  tags = {
-    Name = "tf-acc-lb-bc-${count.index}"
+  subnet_mapping {
+    subnet_id = aws_subnet.test[0].id
   }
 }
+`, rName))
+}
 
-resource "aws_security_group" "alb_test" {
-  name        = "allow_all_alb_test"
-  description = "Used for ALB Testing"
-  vpc_id      = aws_vpc.alb_test.id
+func testAccLoadBalancerConfig_ipv6(rName string) string {
+	return acctest.ConfigCompose(acctest.ConfigVPCWithSubnetsIPv6(rName, 1), fmt.Sprintf(`
+resource "aws_internet_gateway" "test" {
+  vpc_id = aws_vpc.test.id
 
-  ingress {
-    from_port   = 0
-    to_port     = 0
-    protocol    = "-1"
-    cidr_blocks = ["0.0.0.0/0"]
+  tags = {
+    Name = %[1]q
   }
+}
 
-  egress {
-    from_port   = 0
-    to_port     = 0
-    protocol    = "-1"
-    cidr_blocks = ["0.0.0.0/0"]
+resource "aws_lb" "test" {
+  name                       = %[1]q
+  load_balancer_type         = "network"
+  enable_deletion_protection = false
+
+  subnet_mapping {
+    subnet_id    = aws_subnet.test[0].id
+    ipv6_address = cidrhost(cidrsubnet(aws_vpc.test.ipv6_cidr_block, 8, 0), 5)
   }
 
   tags = {
     Name = %[1]q
   }
+
+  depends_on = [aws_internet_gateway.test]
 }
 `, rName))
 }
 
-func testAccLoadBalancerConfig_generatedName(rName string) string {
-	return acctest.ConfigCompose(
-		acctest.ConfigAvailableAZsNoOptIn(),
-		fmt.Sprintf(`
-resource "aws_lb" "lb_test" {
-  internal        = true
-  security_groups = [aws_security_group.alb_test.id]
-  subnets         = aws_subnet.alb_test[*].id
-
-  idle_timeout               = 30
-  enable_deletion_protection = false
+func testAccLoadBalancerConfig_typeGatewayEnableCrossZoneBalancing(rName string, enableCrossZoneLoadBalancing bool) string {
+	return acctest.ConfigCompose(acctest.ConfigVPCWithSubnets(rName, 1), fmt.Sprintf(`
+resource "aws_lb" "test" {
+  enable_cross_zone_load_balancing = %[2]t
+  load_balancer_type               = "gateway"
+  name                             = %[1]q
 
-  tags = {
-    Name = %[1]q
+  subnet_mapping {
+    subnet_id = aws_subnet.test[0].id
   }
 }
-
-variable "subnets" {
-  default = ["10.0.1.0/24", "10.0.2.0/24"]
-  type    = list(string)
+`, rName, enableCrossZoneLoadBalancing))
 }
 
-resource "aws_vpc" "alb_test" {
-  cidr_block = "10.0.0.0/16"
+func testAccLoadBalancerConfig_nlbEIP(rName string) string {
+	return acctest.ConfigCompose(acctest.ConfigVPCWithSubnets(rName, 2), fmt.Sprintf(`
+resource "aws_internet_gateway" "test" {
+  vpc_id = aws_vpc.test.id
 
   tags = {
     Name = %[1]q
   }
 }
 
-resource "aws_internet_gateway" "gw" {
-  vpc_id = aws_vpc.alb_test.id
+resource "aws_route_table" "test" {
+  vpc_id = aws_vpc.test.id
+
+  route {
+    cidr_block = "0.0.0.0/0"
+    gateway_id = aws_internet_gateway.test.id
+  }
 
   tags = {
     Name = %[1]q
   }
 }
 
-resource "aws_subnet" "alb_test" {
-  count                   = 2
-  vpc_id                  = aws_vpc.alb_test.id
-  cidr_block              = element(var.subnets, count.index)
-  map_public_ip_on_launch = true
-  availability_zone       = element(data.aws_availability_zones.available.names, count.index)
-
-  tags = {
-    Name = "%[1]s-${count.index}"
-  }
+resource "aws_route_table_association" "test" {
+  count          = 2
+  subnet_id      = aws_subnet.test[count.index].id
+  route_table_id = aws_route_table.test.id
 }
 
-resource "aws_security_group" "alb_test" {
-  name        = "allow_all_alb_test"
-  description = "Used for ALB Testing"
-  vpc_id      = aws_vpc.alb_test.id
+resource "aws_lb" "test" {
+  name               = %[1]q
+  load_balancer_type = "network"
 
-  ingress {
-    from_port   = 0
-    to_port     = 0
-    protocol    = "-1"
-    cidr_blocks = ["0.0.0.0/0"]
+  subnet_mapping {
+    subnet_id     = aws_subnet.test[0].id
+    allocation_id = aws_eip.test[0].id
   }
 
-  egress {
-    from_port   = 0
-    to_port     = 0
-    protocol    = "-1"
-    cidr_blocks = ["0.0.0.0/0"]
+  subnet_mapping {
+    subnet_id     = aws_subnet.test[1].id
+    allocation_id = aws_eip.test[1].id
   }
 
-  tags = {
-    Name = %[1]q
-  }
-}
-`, rName))
+  depends_on = [aws_internet_gateway.test]
 }
 
-func testAccLoadBalancerConfig_zeroValueName(rName string) string {
-	return acctest.ConfigCompose(
-		acctest.ConfigAvailableAZsNoOptIn(),
-		fmt.Sprintf(`
-resource "aws_lb" "lb_test" {
-  name            = ""
-  internal        = true
-  security_groups = [aws_security_group.alb_test.id]
-  subnets         = aws_subnet.alb_test[*].id
-
-  idle_timeout               = 30
-  enable_deletion_protection = false
+resource "aws_eip" "test" {
+  count = 2
 
   tags = {
     Name = %[1]q
   }
 }
-
-# See https://github.com/hashicorp/terraform-provider-aws/issues/2498
-output "lb_name" {
-  value = aws_lb.lb_test.name
+`, rName))
 }
 
-variable "subnets" {
-  default = ["10.0.1.0/24", "10.0.2.0/24"]
-  type    = list(string)
-}
+func testAccLoadBalancerConfig_nlbPrivateIPV4Address(rName string) string {
+	return acctest.ConfigCompose(acctest.ConfigAvailableAZsNoOptIn(), fmt.Sprintf(`
+resource "aws_lb" "test" {
+  name                       = %[1]q
+  internal                   = true
+  load_balancer_type         = "network"
+  enable_deletion_protection = false
 
-resource "aws_vpc" "alb_test" {
-  cidr_block = "10.0.0.0/16"
+  subnet_mapping {
+    subnet_id            = aws_subnet.test.id
+    private_ipv4_address = "10.10.0.15"
+  }
 
   tags = {
     Name = %[1]q
   }
 }
 
-resource "aws_internet_gateway" "gw" {
-  vpc_id = aws_vpc.alb_test.id
+resource "aws_vpc" "test" {
+  cidr_block = "10.10.0.0/16"
 
   tags = {
     Name = %[1]q
   }
 }
 
-resource "aws_subnet" "alb_test" {
-  count                   = 2
-  vpc_id                  = aws_vpc.alb_test.id
-  cidr_block              = element(var.subnets, count.index)
+resource "aws_subnet" "test" {
+  vpc_id                  = aws_vpc.test.id
+  cidr_block              = "10.10.0.0/21"
   map_public_ip_on_launch = true
-  availability_zone       = element(data.aws_availability_zones.available.names, count.index)
+  availability_zone       = data.aws_availability_zones.available.names[0]
 
   tags = {
-    Name = "tf-acc-lb-zero-value-name-${count.index}"
+    Name = %[1]q
   }
 }
+`, rName))
+}
 
-resource "aws_security_group" "alb_test" {
-  name        = "allow_all_alb_test"
-  description = "Used for ALB Testing"
-  vpc_id      = aws_vpc.alb_test.id
-
-  ingress {
-    from_port   = 0
-    to_port     = 0
-    protocol    = "-1"
-    cidr_blocks = ["0.0.0.0/0"]
-  }
+func testAccLoadBalancerConfig_nlbDNSRecordClientRoutingPolicyAffinity(rName string) string {
+	return acctest.ConfigCompose(acctest.ConfigVPCWithSubnets(rName, 1), fmt.Sprintf(`
+resource "aws_lb" "test" {
+  name                             = %[1]q
+  dns_record_client_routing_policy = "availability_zone_affinity"
+  internal                         = true
+  load_balancer_type               = "network"
 
-  egress {
-    from_port   = 0
-    to_port     = 0
-    protocol    = "-1"
-    cidr_blocks = ["0.0.0.0/0"]
+  subnet_mapping {
+    subnet_id = aws_subnet.test[0].id
   }
 
   tags = {
@@ -2859,67 +2385,54 @@ resource "aws_security_group" "alb_test" {
 `, rName))
 }
 
-func testAccLoadBalancerConfig_namePrefix(rName string) string {
-	return acctest.ConfigCompose(
-		acctest.ConfigAvailableAZsNoOptIn(),
-		fmt.Sprintf(`
-resource "aws_lb" "lb_test" {
-  name_prefix     = "tf-lb-"
-  internal        = true
-  security_groups = [aws_security_group.alb_test.id]
-  subnets         = aws_subnet.alb_test[*].id
+func testAccLoadBalancerConfig_nlbDNSRecordClientRoutingPolicyAnyAvailabilityZone(rName string) string {
+	return acctest.ConfigCompose(acctest.ConfigVPCWithSubnets(rName, 1), fmt.Sprintf(`
+resource "aws_lb" "test" {
+  name                             = %[1]q
+  dns_record_client_routing_policy = "any_availability_zone"
+  internal                         = true
+  load_balancer_type               = "network"
 
-  idle_timeout               = 30
-  enable_deletion_protection = false
+  subnet_mapping {
+    subnet_id = aws_subnet.test[0].id
+  }
 
   tags = {
     Name = %[1]q
   }
 }
-
-variable "subnets" {
-  default = ["10.0.1.0/24", "10.0.2.0/24"]
-  type    = list(string)
+`, rName))
 }
 
-resource "aws_vpc" "alb_test" {
-  cidr_block = "10.0.0.0/16"
+func testAccLoadBalancerConfig_nlbDNSRecordClientRoutingPolicyPartialAffinity(rName string) string {
+	return acctest.ConfigCompose(acctest.ConfigVPCWithSubnets(rName, 1), fmt.Sprintf(`
+resource "aws_lb" "test" {
+  name                             = %[1]q
+  dns_record_client_routing_policy = "partial_availability_zone_affinity"
+  internal                         = true
+  load_balancer_type               = "network"
 
-  tags = {
-    Name = %[1]q
+  subnet_mapping {
+    subnet_id = aws_subnet.test[0].id
   }
-}
-
-resource "aws_subnet" "alb_test" {
-  count                   = 2
-  vpc_id                  = aws_vpc.alb_test.id
-  cidr_block              = element(var.subnets, count.index)
-  map_public_ip_on_launch = true
-  availability_zone       = element(data.aws_availability_zones.available.names, count.index)
 
   tags = {
-    Name = "%[1]s-${count.index}"
+    Name = %[1]q
   }
 }
+`, rName))
+}
 
-resource "aws_security_group" "alb_test" {
-  name        = "allow_all_alb_test"
-  description = "Used for ALB Testing"
-  vpc_id      = aws_vpc.alb_test.id
-
-  ingress {
-    from_port   = 0
-    to_port     = 0
-    protocol    = "-1"
-    cidr_blocks = ["0.0.0.0/0"]
-  }
+func testAccLoadBalancerConfig_backwardsCompatibility(rName string) string {
+	return acctest.ConfigCompose(testAccLoadBalancerConfig_baseInternal(rName, 2), fmt.Sprintf(`
+resource "aws_alb" "test" {
+  name            = %[1]q
+  internal        = true
+  security_groups = [aws_security_group.test.id]
+  subnets         = aws_subnet.test[*].id
 
-  egress {
-    from_port   = 0
-    to_port     = 0
-    protocol    = "-1"
-    cidr_blocks = ["0.0.0.0/0"]
-  }
+  idle_timeout               = 30
+  enable_deletion_protection = false
 
   tags = {
     Name = %[1]q
@@ -2928,7 +2441,7 @@ resource "aws_security_group" "alb_test" {
 `, rName))
 }
 
-func testAccLoadBalancerConfig_updateSecurityGroups(rName string) string {
+func testAccLoadBalancerConfig_albUpdateSecurityGroups(rName string) string {
 	return acctest.ConfigCompose(testAccLoadBalancerConfig_baseInternal(rName, 3), fmt.Sprintf(`
 resource "aws_lb" "test" {
   name            = %[1]q
@@ -2972,7 +2485,7 @@ resource "aws_lb" "test" {
 `, rName))
 }
 
-func testAccLoadBalancerConfig_nosg(rName string) string {
+func testAccLoadBalancerConfig_albNoSecurityGroups(rName string) string {
 	return acctest.ConfigCompose(acctest.ConfigVPCWithSubnets(rName, 2), fmt.Sprintf(`
 resource "aws_lb" "test" {
   name     = %[1]q
@@ -3106,8 +2619,45 @@ resource "aws_lb" "test" {
 `, rName))
 }
 
-func testAccLoadBalancerConfig_nlbSubnets(rName string) string {
-	return acctest.ConfigCompose(acctest.ConfigVPCWithSubnets(rName, 3), fmt.Sprintf(`
+func testAccLoadBalancerConfig_nlbSecurityGroups(rName string, n int) string {
+	return acctest.ConfigCompose(acctest.ConfigVPCWithSubnets(rName, 2), fmt.Sprintf(`
+resource "aws_security_group" "test" {
+  count = 3
+
+  name   = "%[1]s-${count.index}"
+  vpc_id = aws_vpc.test.id
+
+  ingress {
+    from_port   = 0
+    to_port     = 0
+    protocol    = "-1"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+
+  egress {
+    from_port   = 0
+    to_port     = 0
+    protocol    = "-1"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+
+  tags = {
+    Name = %[1]q
+  }
+}
+
+resource "aws_lb" "test" {
+  internal           = true
+  load_balancer_type = "network"
+  name               = %[1]q
+  subnets            = aws_subnet.test[*].id
+  security_groups    = slice(aws_security_group.test[*].id, 0, %[2]d)
+}
+`, rName, n))
+}
+
+func testAccLoadBalancerConfig_nlbSubnets(rName string, subnetCount int) string {
+	return acctest.ConfigCompose(acctest.ConfigVPCWithSubnets(rName, subnetCount), fmt.Sprintf(`
 resource "aws_lb" "test" {
   name = %[1]q
 
diff --git a/internal/service/elbv2/load_balancers_data_source.go b/internal/service/elbv2/load_balancers_data_source.go
index 6134a4c9a52..7693e68a15e 100644
--- a/internal/service/elbv2/load_balancers_data_source.go
+++ b/internal/service/elbv2/load_balancers_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elbv2
 
 import (
diff --git a/internal/service/elbv2/load_balancers_data_source_test.go b/internal/service/elbv2/load_balancers_data_source_test.go
index 8ea3d59dbde..819fc9cbc3f 100644
--- a/internal/service/elbv2/load_balancers_data_source_test.go
+++ b/internal/service/elbv2/load_balancers_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elbv2_test
 
 import (
diff --git a/internal/service/elbv2/service_package_gen.go b/internal/service/elbv2/service_package_gen.go
index b461f1e5a7f..57e5abc0a71 100644
--- a/internal/service/elbv2/service_package_gen.go
+++ b/internal/service/elbv2/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	elbv2_sdkv1 "github.com/aws/aws-sdk-go/service/elbv2"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -155,4 +156,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*e
 	return elbv2_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/elbv2/sweep.go b/internal/service/elbv2/sweep.go
index e4a477eaf29..ab41a0494ab 100644
--- a/internal/service/elbv2/sweep.go
+++ b/internal/service/elbv2/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package elbv2
 
@@ -12,9 +12,10 @@ import (
 	"github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_lb", &resource.Sweeper{
 		Name: "aws_lb",
 		F:    sweepLoadBalancers,
@@ -41,7 +42,7 @@ func init() {
 
 func sweepLoadBalancers(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("getting client: %s", err)
 	}
@@ -68,7 +69,7 @@ func sweepLoadBalancers(region string) error {
 		}
 		return !lastPage
 	})
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping LB sweep for %s: %s", region, err)
 		return sweeperErrs.ErrorOrNil() // In case we have completed some pages, but had errors
 	}
@@ -81,7 +82,7 @@ func sweepLoadBalancers(region string) error {
 
 func sweepTargetGroups(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("getting client: %w", err)
 	}
@@ -107,7 +108,7 @@ func sweepTargetGroups(region string) error {
 		return !lastPage
 	})
 	if err != nil {
-		if sweep.SkipSweepError(err) {
+		if awsv1.SkipSweepError(err) {
 			log.Printf("[WARN] Skipping LB Target Group sweep for %s: %s", region, err)
 			return nil
 		}
@@ -118,7 +119,7 @@ func sweepTargetGroups(region string) error {
 
 func sweepListeners(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("getting client: %s", err)
 	}
@@ -168,11 +169,11 @@ func sweepListeners(region string) error {
 		errs = multierror.Append(errs, fmt.Errorf("error describing ELBv2 Listeners for %s: %w", region, err))
 	}
 
-	if err = sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err = sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("error sweeping ELBv2 Listeners for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
+	if awsv1.SkipSweepError(errs.ErrorOrNil()) {
 		log.Printf("[WARN] Skipping ELBv2 Listener sweep for %s: %s", region, errs)
 		return nil
 	}
diff --git a/internal/service/elbv2/tags_gen.go b/internal/service/elbv2/tags_gen.go
index 6cc5877e01c..64d1387a8b2 100644
--- a/internal/service/elbv2/tags_gen.go
+++ b/internal/service/elbv2/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/elbv2"
 	"github.com/aws/aws-sdk-go/service/elbv2/elbv2iface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -111,6 +113,8 @@ func updateTags(ctx context.Context, conn elbv2iface.ELBV2API, identifier string
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.ELBV2)
 	if len(removedTags) > 0 {
diff --git a/internal/service/elbv2/target_group.go b/internal/service/elbv2/target_group.go
index 4c877fab9b5..3c510e710bb 100644
--- a/internal/service/elbv2/target_group.go
+++ b/internal/service/elbv2/target_group.go
@@ -1,29 +1,32 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elbv2
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"strconv"
 	"strings"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/elbv2"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/customdiff"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/create"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
-	"github.com/hashicorp/terraform-provider-aws/internal/experimental/nullable"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/internal/types/nullable"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -64,7 +67,7 @@ func ResourceTargetGroup() *schema.Resource {
 			"connection_termination": {
 				Type:     schema.TypeBool,
 				Optional: true,
-				Default:  false,
+				Computed: true,
 			},
 			"deregistration_delay": {
 				Type:         nullable.TypeNullableInt,
@@ -184,6 +187,7 @@ func ResourceTargetGroup() *schema.Resource {
 			"name_prefix": {
 				Type:          schema.TypeString,
 				Optional:      true,
+				Computed:      true,
 				ForceNew:      true,
 				ConflictsWith: []string{"name"},
 				ValidateFunc:  validTargetGroupNamePrefix,
@@ -312,6 +316,19 @@ func ResourceTargetGroup() *schema.Resource {
 					},
 				},
 			},
+			"target_health_state": {
+				Type:     schema.TypeList,
+				Optional: true,
+				Computed: true,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"enable_unhealthy_connection_termination": {
+							Type:     schema.TypeBool,
+							Required: true,
+						},
+					},
+				},
+			},
 			"target_type": {
 				Type:         schema.TypeString,
 				Optional:     true,
@@ -338,27 +355,23 @@ func resourceTargetGroupCreate(ctx context.Context, d *schema.ResourceData, meta
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).ELBV2Conn(ctx)
 
-	var groupName string
-	if v, ok := d.GetOk("name"); ok {
-		groupName = v.(string)
-	} else if v, ok := d.GetOk("name_prefix"); ok {
-		groupName = id.PrefixedUniqueId(v.(string))
-	} else {
-		groupName = id.PrefixedUniqueId("tf-")
-	}
-
-	existingTg, err := FindTargetGroupByName(ctx, conn, groupName)
+	name := create.NewNameGenerator(
+		create.WithConfiguredName(d.Get("name").(string)),
+		create.WithConfiguredPrefix(d.Get("name_prefix").(string)),
+		create.WithDefaultPrefix("tf-"),
+	).Generate()
+	exist, err := FindTargetGroupByName(ctx, conn, name)
 
 	if err != nil && !tfresource.NotFound(err) {
-		return sdkdiag.AppendErrorf(diags, "reading ELBv2 Target Group (%s): %s", groupName, err)
+		return sdkdiag.AppendErrorf(diags, "reading ELBv2 Target Group (%s): %s", name, err)
 	}
 
-	if existingTg != nil {
-		return sdkdiag.AppendErrorf(diags, "ELBv2 Target Group (%s) already exists", groupName)
+	if exist != nil {
+		return sdkdiag.AppendErrorf(diags, "ELBv2 Target Group (%s) already exists", name)
 	}
 
 	input := &elbv2.CreateTargetGroupInput{
-		Name:       aws.String(groupName),
+		Name:       aws.String(name),
 		Tags:       getTagsIn(ctx),
 		TargetType: aws.String(d.Get("target_type").(string)),
 	}
@@ -449,7 +462,7 @@ func resourceTargetGroupCreate(ctx context.Context, d *schema.ResourceData, meta
 	}
 
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "creating LB Target Group: %s", err)
+		return sdkdiag.AppendErrorf(diags, "creating ELBv2 Target Group (%s): %s", name, err)
 	}
 
 	if len(output.TargetGroups) == 0 {
@@ -537,6 +550,22 @@ func resourceTargetGroupCreate(ctx context.Context, d *schema.ResourceData, meta
 			}
 		}
 
+		// Only supported for TCP & TLS protocols
+		if v, ok := d.Get("protocol").(string); ok {
+			if v == elbv2.ProtocolEnumTcp || v == elbv2.ProtocolEnumTls {
+				if v, ok := d.GetOk("target_health_state"); ok && len(v.([]interface{})) > 0 {
+					targetHealthStateBlock := v.([]interface{})
+					targetHealthState := targetHealthStateBlock[0].(map[string]interface{})
+					attrs = append(attrs,
+						&elbv2.TargetGroupAttribute{
+							Key:   aws.String("target_health_state.unhealthy.connection_termination.enabled"),
+							Value: aws.String(strconv.FormatBool(targetHealthState["enable_unhealthy_connection_termination"].(bool))),
+						},
+					)
+				}
+			}
+		}
+
 		if v, ok := d.GetOk("stickiness"); ok && len(v.([]interface{})) > 0 {
 			stickinessBlocks := v.([]interface{})
 			stickiness := stickinessBlocks[0].(map[string]interface{})
@@ -789,6 +818,18 @@ func resourceTargetGroupUpdate(ctx context.Context, d *schema.ResourceData, meta
 			})
 		}
 
+		if d.HasChange("target_health_state") {
+			targetHealthStateBlock := d.Get("target_health_state").([]interface{})
+			if len(targetHealthStateBlock) == 1 {
+				targetHealthState := targetHealthStateBlock[0].(map[string]interface{})
+				attrs = append(attrs,
+					&elbv2.TargetGroupAttribute{
+						Key:   aws.String("target_health_state.unhealthy.connection_termination.enabled"),
+						Value: aws.String(strconv.FormatBool(targetHealthState["enable_unhealthy_connection_termination"].(bool))),
+					})
+			}
+		}
+
 		if d.HasChange("target_failover") {
 			failoverBlock := d.Get("target_failover").([]interface{})
 			if len(failoverBlock) == 1 {
@@ -1008,7 +1049,7 @@ func TargetGroupSuffixFromARN(arn *string) string {
 		return ""
 	}
 
-	if arnComponents := regexp.MustCompile(`arn:.*:targetgroup/(.*)`).FindAllStringSubmatch(*arn, -1); len(arnComponents) == 1 {
+	if arnComponents := regexache.MustCompile(`arn:.*:targetgroup/(.*)`).FindAllStringSubmatch(*arn, -1); len(arnComponents) == 1 {
 		if len(arnComponents[0]) == 2 {
 			return fmt.Sprintf("targetgroup/%s", arnComponents[0][1])
 		}
@@ -1023,9 +1064,10 @@ func flattenTargetGroupResource(ctx context.Context, d *schema.ResourceData, met
 
 	d.Set("arn", targetGroup.TargetGroupArn)
 	d.Set("arn_suffix", TargetGroupSuffixFromARN(targetGroup.TargetGroupArn))
+	d.Set("ip_address_type", targetGroup.IpAddressType)
 	d.Set("name", targetGroup.TargetGroupName)
+	d.Set("name_prefix", create.NamePrefixFromName(aws.StringValue(targetGroup.TargetGroupName)))
 	d.Set("target_type", targetGroup.TargetType)
-	d.Set("ip_address_type", targetGroup.IpAddressType)
 
 	if err := d.Set("health_check", flattenLbTargetGroupHealthCheck(targetGroup)); err != nil {
 		return fmt.Errorf("setting health_check: %w", err)
@@ -1101,6 +1143,14 @@ func flattenTargetGroupResource(ctx context.Context, d *schema.ResourceData, met
 		return fmt.Errorf("setting stickiness: %w", err)
 	}
 
+	targetHealthStateAttr, err := flattenTargetHealthState(attrResp.Attributes)
+	if err != nil {
+		return fmt.Errorf("flattening target health state: %w", err)
+	}
+	if err := d.Set("target_health_state", targetHealthStateAttr); err != nil {
+		return fmt.Errorf("setting target health state: %w", err)
+	}
+
 	// Set target failover attributes for GWLB
 	targetFailoverAttr := flattenTargetGroupFailover(attrResp.Attributes)
 	if err != nil {
@@ -1114,6 +1164,27 @@ func flattenTargetGroupResource(ctx context.Context, d *schema.ResourceData, met
 	return nil
 }
 
+func flattenTargetHealthState(attributes []*elbv2.TargetGroupAttribute) ([]interface{}, error) {
+	if len(attributes) == 0 {
+		return []interface{}{}, nil
+	}
+
+	m := make(map[string]interface{})
+
+	for _, attr := range attributes {
+		switch aws.StringValue(attr.Key) {
+		case "target_health_state.unhealthy.connection_termination.enabled":
+			enabled, err := strconv.ParseBool(aws.StringValue(attr.Value))
+			if err != nil {
+				return nil, fmt.Errorf("converting target_health_state.unhealthy.connection_termination to bool: %s", aws.StringValue(attr.Value))
+			}
+			m["enable_unhealthy_connection_termination"] = enabled
+		}
+	}
+
+	return []interface{}{m}, nil
+}
+
 func flattenTargetGroupFailover(attributes []*elbv2.TargetGroupAttribute) []interface{} {
 	if len(attributes) == 0 {
 		return []interface{}{}
diff --git a/internal/service/elbv2/target_group_attachment.go b/internal/service/elbv2/target_group_attachment.go
index 8cf7797c15e..70433ac3a2b 100644
--- a/internal/service/elbv2/target_group_attachment.go
+++ b/internal/service/elbv2/target_group_attachment.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elbv2
 
 import (
diff --git a/internal/service/elbv2/target_group_attachment_test.go b/internal/service/elbv2/target_group_attachment_test.go
index 8fc450069af..7412ac9f716 100644
--- a/internal/service/elbv2/target_group_attachment_test.go
+++ b/internal/service/elbv2/target_group_attachment_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elbv2_test
 
 import (
diff --git a/internal/service/elbv2/target_group_data_source.go b/internal/service/elbv2/target_group_data_source.go
index bf1634f089c..abf14508c53 100644
--- a/internal/service/elbv2/target_group_data_source.go
+++ b/internal/service/elbv2/target_group_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elbv2
 
 import (
diff --git a/internal/service/elbv2/target_group_data_source_test.go b/internal/service/elbv2/target_group_data_source_test.go
index da322b7b73b..64cea03ae3c 100644
--- a/internal/service/elbv2/target_group_data_source_test.go
+++ b/internal/service/elbv2/target_group_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elbv2_test
 
 import (
diff --git a/internal/service/elbv2/target_group_test.go b/internal/service/elbv2/target_group_test.go
index 6c35ff015bc..f35aeb0ecd4 100644
--- a/internal/service/elbv2/target_group_test.go
+++ b/internal/service/elbv2/target_group_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elbv2_test
 
 import (
 	"context"
 	"errors"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/elbv2"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -84,6 +87,226 @@ func TestALBTargetGroupCloudWatchSuffixFromARN(t *testing.T) {
 	}
 }
 
+func TestAccELBV2TargetGroup_basic(t *testing.T) {
+	ctx := acctest.Context(t)
+	var conf elbv2.TargetGroup
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_lb_target_group.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, elbv2.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckTargetGroupDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccTargetGroupConfig_basic(rName, 200),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckTargetGroupExists(ctx, resourceName, &conf),
+					resource.TestCheckResourceAttrSet(resourceName, "arn"),
+					resource.TestCheckResourceAttr(resourceName, "name", rName),
+					resource.TestCheckResourceAttr(resourceName, "name_prefix", ""),
+					resource.TestCheckResourceAttr(resourceName, "port", "443"),
+					resource.TestCheckResourceAttr(resourceName, "protocol", "HTTPS"),
+					resource.TestCheckResourceAttr(resourceName, "protocol_version", "HTTP1"),
+					resource.TestCheckResourceAttrSet(resourceName, "vpc_id"),
+					resource.TestCheckResourceAttr(resourceName, "deregistration_delay", "200"),
+					resource.TestCheckResourceAttr(resourceName, "slow_start", "0"),
+					resource.TestCheckResourceAttr(resourceName, "stickiness.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "stickiness.0.enabled", "true"),
+					resource.TestCheckResourceAttr(resourceName, "stickiness.0.type", "lb_cookie"),
+					resource.TestCheckResourceAttr(resourceName, "stickiness.0.cookie_duration", "10000"),
+					resource.TestCheckResourceAttr(resourceName, "health_check.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "health_check.0.path", "/health"),
+					resource.TestCheckResourceAttr(resourceName, "health_check.0.enabled", "true"),
+					resource.TestCheckResourceAttr(resourceName, "health_check.0.interval", "60"),
+					resource.TestCheckResourceAttr(resourceName, "health_check.0.port", "8081"),
+					resource.TestCheckResourceAttr(resourceName, "health_check.0.protocol", "HTTP"),
+					resource.TestCheckResourceAttr(resourceName, "health_check.0.timeout", "3"),
+					resource.TestCheckResourceAttr(resourceName, "health_check.0.healthy_threshold", "3"),
+					resource.TestCheckResourceAttr(resourceName, "health_check.0.unhealthy_threshold", "3"),
+					resource.TestCheckResourceAttr(resourceName, "health_check.0.matcher", "200-299"),
+					resource.TestCheckNoResourceAttr(resourceName, "preserve_client_ip"),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.Name", rName),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{
+					"connection_termination",
+					"lambda_multi_value_headers_enabled",
+					"proxy_protocol_v2",
+					"slow_start",
+				},
+			},
+		},
+	})
+}
+
+func TestAccELBV2TargetGroup_disappears(t *testing.T) {
+	ctx := acctest.Context(t)
+	var conf elbv2.TargetGroup
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_lb_target_group.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, elbv2.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckTargetGroupDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccTargetGroupConfig_basic(rName, 200),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckTargetGroupExists(ctx, resourceName, &conf),
+					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfelbv2.ResourceTargetGroup(), resourceName),
+				),
+				ExpectNonEmptyPlan: true,
+			},
+		},
+	})
+}
+
+func TestAccELBV2TargetGroup_nameGenerated(t *testing.T) {
+	ctx := acctest.Context(t)
+	var conf elbv2.TargetGroup
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_lb_target_group.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, elbv2.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckTargetGroupDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccTargetGroupConfig_nameGenerated(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckTargetGroupExists(ctx, resourceName, &conf),
+					acctest.CheckResourceAttrNameGeneratedWithPrefix(resourceName, "name", "tf-"),
+					resource.TestCheckResourceAttr(resourceName, "name_prefix", "tf-"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{
+					"connection_termination",
+					"lambda_multi_value_headers_enabled",
+					"proxy_protocol_v2",
+					"slow_start",
+				},
+			},
+		},
+	})
+}
+
+func TestAccELBV2TargetGroup_namePrefix(t *testing.T) {
+	ctx := acctest.Context(t)
+	var conf elbv2.TargetGroup
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_lb_target_group.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, elbv2.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckTargetGroupDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccTargetGroupConfig_namePrefix(rName, "tf-px-"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckTargetGroupExists(ctx, resourceName, &conf),
+					acctest.CheckResourceAttrNameFromPrefix(resourceName, "name", "tf-px-"),
+					resource.TestCheckResourceAttr(resourceName, "name_prefix", "tf-px-"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{
+					"connection_termination",
+					"lambda_multi_value_headers_enabled",
+					"proxy_protocol_v2",
+					"slow_start",
+				},
+			},
+		},
+	})
+}
+
+func TestAccELBV2TargetGroup_duplicateName(t *testing.T) {
+	ctx := acctest.Context(t)
+	var targetGroup elbv2.TargetGroup
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_lb_target_group.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, elbv2.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckTargetGroupDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccTargetGroupConfig_basic(rName, 200),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckTargetGroupExists(ctx, resourceName, &targetGroup),
+				),
+			},
+			{
+				Config:      testAccTargetGroupConfig_duplicateName(rName, 200),
+				ExpectError: regexache.MustCompile(`already exists`),
+			},
+		},
+	})
+}
+
+func TestAccELBV2TargetGroup_tags(t *testing.T) {
+	ctx := acctest.Context(t)
+	var conf elbv2.TargetGroup
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_lb_target_group.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, elbv2.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckTargetGroupDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccTargetGroupConfig_tags1(rName, "key1", "value1"),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckTargetGroupExists(ctx, resourceName, &conf),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
+				),
+			},
+			{
+				Config: testAccTargetGroupConfig_tags2(rName, "key1", "value1updated", "key2", "value2"),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckTargetGroupExists(ctx, resourceName, &conf),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1updated"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
+				),
+			},
+			{
+				Config: testAccTargetGroupConfig_tags1(rName, "key2", "value2"),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckTargetGroupExists(ctx, resourceName, &conf),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
+				),
+			},
+		},
+	})
+}
+
 func TestAccELBV2TargetGroup_backwardsCompatibility(t *testing.T) {
 	ctx := acctest.Context(t)
 	var conf elbv2.TargetGroup
@@ -391,53 +614,6 @@ func TestAccELBV2TargetGroup_attrsOnCreate(t *testing.T) {
 	})
 }
 
-func TestAccELBV2TargetGroup_basic(t *testing.T) {
-	ctx := acctest.Context(t)
-	var conf elbv2.TargetGroup
-	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
-	resourceName := "aws_lb_target_group.test"
-
-	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, elbv2.EndpointsID),
-		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckTargetGroupDestroy(ctx),
-		Steps: []resource.TestStep{
-			{
-				Config: testAccTargetGroupConfig_basic(rName, 200),
-				Check: resource.ComposeAggregateTestCheckFunc(
-					testAccCheckTargetGroupExists(ctx, resourceName, &conf),
-					resource.TestCheckResourceAttrSet(resourceName, "arn"),
-					resource.TestCheckResourceAttr(resourceName, "name", rName),
-					resource.TestCheckResourceAttr(resourceName, "port", "443"),
-					resource.TestCheckResourceAttr(resourceName, "protocol", "HTTPS"),
-					resource.TestCheckResourceAttr(resourceName, "protocol_version", "HTTP1"),
-					resource.TestCheckResourceAttrSet(resourceName, "vpc_id"),
-					resource.TestCheckResourceAttr(resourceName, "deregistration_delay", "200"),
-					resource.TestCheckResourceAttr(resourceName, "slow_start", "0"),
-					resource.TestCheckResourceAttr(resourceName, "stickiness.#", "1"),
-					resource.TestCheckResourceAttr(resourceName, "stickiness.0.enabled", "true"),
-					resource.TestCheckResourceAttr(resourceName, "stickiness.0.type", "lb_cookie"),
-					resource.TestCheckResourceAttr(resourceName, "stickiness.0.cookie_duration", "10000"),
-					resource.TestCheckResourceAttr(resourceName, "health_check.#", "1"),
-					resource.TestCheckResourceAttr(resourceName, "health_check.0.path", "/health"),
-					resource.TestCheckResourceAttr(resourceName, "health_check.0.enabled", "true"),
-					resource.TestCheckResourceAttr(resourceName, "health_check.0.interval", "60"),
-					resource.TestCheckResourceAttr(resourceName, "health_check.0.port", "8081"),
-					resource.TestCheckResourceAttr(resourceName, "health_check.0.protocol", "HTTP"),
-					resource.TestCheckResourceAttr(resourceName, "health_check.0.timeout", "3"),
-					resource.TestCheckResourceAttr(resourceName, "health_check.0.healthy_threshold", "3"),
-					resource.TestCheckResourceAttr(resourceName, "health_check.0.unhealthy_threshold", "3"),
-					resource.TestCheckResourceAttr(resourceName, "health_check.0.matcher", "200-299"),
-					resource.TestCheckNoResourceAttr(resourceName, "preserve_client_ip"),
-					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
-					resource.TestCheckResourceAttr(resourceName, "tags.Name", rName),
-				),
-			},
-		},
-	})
-}
-
 func TestAccELBV2TargetGroup_udp(t *testing.T) {
 	ctx := acctest.Context(t)
 	var conf elbv2.TargetGroup
@@ -664,11 +840,11 @@ timeout  = 4
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccTargetGroupConfig_nlbDefaults(rName, healthCheckInvalid1),
-				ExpectError: regexp.MustCompile("health_check.path is not supported for target_groups with TCP protocol"),
+				ExpectError: regexache.MustCompile("health_check.path is not supported for target_groups with TCP protocol"),
 			},
 			{
 				Config:      testAccTargetGroupConfig_nlbDefaults(rName, healthCheckInvalid2),
-				ExpectError: regexp.MustCompile("health_check.matcher is not supported for target_groups with TCP protocol"),
+				ExpectError: regexache.MustCompile("health_check.matcher is not supported for target_groups with TCP protocol"),
 			},
 			{
 				Config: testAccTargetGroupConfig_nlbDefaults(rName, healthCheckValid),
@@ -680,81 +856,23 @@ timeout  = 4
 					resource.TestCheckResourceAttr(resourceName, "protocol", "TCP"),
 					resource.TestCheckResourceAttrSet(resourceName, "vpc_id"),
 					resource.TestCheckResourceAttr(resourceName, "deregistration_delay", "200"),
-					resource.TestCheckResourceAttr(resourceName, "slow_start", "0"),
-					resource.TestCheckResourceAttr(resourceName, "health_check.#", "1"),
-					resource.TestCheckResourceAttr(resourceName, "health_check.0.interval", "10"),
-					resource.TestCheckResourceAttr(resourceName, "health_check.0.port", "8081"),
-					resource.TestCheckResourceAttr(resourceName, "health_check.0.protocol", "TCP"),
-					resource.TestCheckResourceAttr(resourceName, "health_check.0.timeout", "4"),
-					resource.TestCheckResourceAttr(resourceName, "health_check.0.healthy_threshold", "3"),
-					resource.TestCheckResourceAttr(resourceName, "health_check.0.unhealthy_threshold", "3"),
-					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
-					resource.TestCheckResourceAttr(resourceName, "tags.Name", rName),
-				),
-			},
-		},
-	})
-}
-
-func TestAccELBV2TargetGroup_HealthCheck_enable(t *testing.T) {
-	ctx := acctest.Context(t)
-	var conf elbv2.TargetGroup
-	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
-	resourceName := "aws_lb_target_group.test"
-
-	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, elbv2.EndpointsID),
-		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckTargetGroupDestroy(ctx),
-		Steps: []resource.TestStep{
-			{
-				Config: testAccTargetGroupConfig_noHealthcheck(rName),
-				Check: resource.ComposeAggregateTestCheckFunc(
-					testAccCheckTargetGroupExists(ctx, resourceName, &conf),
-					resource.TestCheckResourceAttrSet(resourceName, "arn"),
-					resource.TestCheckResourceAttr(resourceName, "name", rName),
-					resource.TestCheckResourceAttr(resourceName, "health_check.#", "1"),
-					resource.TestCheckResourceAttr(resourceName, "health_check.0.enabled", "false"),
-				),
-			},
-			{
-				Config: testAccTargetGroupConfig_enableHealthcheck(rName),
-				Check: resource.ComposeAggregateTestCheckFunc(
-					testAccCheckTargetGroupExists(ctx, resourceName, &conf),
-					resource.TestCheckResourceAttrSet(resourceName, "arn"),
-					resource.TestCheckResourceAttr(resourceName, "name", rName),
-					resource.TestCheckResourceAttr(resourceName, "health_check.#", "1"),
-					resource.TestCheckResourceAttr(resourceName, "health_check.0.enabled", "true"),
-				),
-			},
-		},
-	})
-}
-
-func TestAccELBV2TargetGroup_Name_generated(t *testing.T) {
-	ctx := acctest.Context(t)
-	var conf elbv2.TargetGroup
-	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
-	resourceName := "aws_lb_target_group.test"
-
-	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, elbv2.EndpointsID),
-		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckTargetGroupDestroy(ctx),
-		Steps: []resource.TestStep{
-			{
-				Config: testAccTargetGroupConfig_generatedName(rName),
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckTargetGroupExists(ctx, resourceName, &conf),
+					resource.TestCheckResourceAttr(resourceName, "slow_start", "0"),
+					resource.TestCheckResourceAttr(resourceName, "health_check.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "health_check.0.interval", "10"),
+					resource.TestCheckResourceAttr(resourceName, "health_check.0.port", "8081"),
+					resource.TestCheckResourceAttr(resourceName, "health_check.0.protocol", "TCP"),
+					resource.TestCheckResourceAttr(resourceName, "health_check.0.timeout", "4"),
+					resource.TestCheckResourceAttr(resourceName, "health_check.0.healthy_threshold", "3"),
+					resource.TestCheckResourceAttr(resourceName, "health_check.0.unhealthy_threshold", "3"),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.Name", rName),
 				),
 			},
 		},
 	})
 }
 
-func TestAccELBV2TargetGroup_Name_prefix(t *testing.T) {
+func TestAccELBV2TargetGroup_HealthCheck_enable(t *testing.T) {
 	ctx := acctest.Context(t)
 	var conf elbv2.TargetGroup
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
@@ -767,10 +885,23 @@ func TestAccELBV2TargetGroup_Name_prefix(t *testing.T) {
 		CheckDestroy:             testAccCheckTargetGroupDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccTargetGroupConfig_namePrefix(rName),
-				Check: resource.ComposeTestCheckFunc(
+				Config: testAccTargetGroupConfig_noHealthcheck(rName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckTargetGroupExists(ctx, resourceName, &conf),
+					resource.TestCheckResourceAttrSet(resourceName, "arn"),
+					resource.TestCheckResourceAttr(resourceName, "name", rName),
+					resource.TestCheckResourceAttr(resourceName, "health_check.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "health_check.0.enabled", "false"),
+				),
+			},
+			{
+				Config: testAccTargetGroupConfig_enableHealthcheck(rName),
+				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckTargetGroupExists(ctx, resourceName, &conf),
-					resource.TestMatchResourceAttr(resourceName, "name", regexp.MustCompile("^tf-")),
+					resource.TestCheckResourceAttrSet(resourceName, "arn"),
+					resource.TestCheckResourceAttr(resourceName, "name", rName),
+					resource.TestCheckResourceAttr(resourceName, "health_check.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "health_check.0.enabled", "true"),
 				),
 			},
 		},
@@ -1183,15 +1314,15 @@ func TestAccELBV2TargetGroup_Stickiness_invalidALB(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccTargetGroupConfig_stickinessValidity(rName, "HTTP", "source_ip", true),
-				ExpectError: regexp.MustCompile("Stickiness type 'source_ip' is not supported for target groups with"),
+				ExpectError: regexache.MustCompile("Stickiness type 'source_ip' is not supported for target groups with"),
 			},
 			{
 				Config:      testAccTargetGroupConfig_stickinessValidity(rName, "HTTPS", "source_ip", true),
-				ExpectError: regexp.MustCompile("Stickiness type 'source_ip' is not supported for target groups with"),
+				ExpectError: regexache.MustCompile("Stickiness type 'source_ip' is not supported for target groups with"),
 			},
 			{
 				Config:      testAccTargetGroupConfig_stickinessValidity(rName, "TLS", "lb_cookie", true),
-				ExpectError: regexp.MustCompile("Stickiness type 'lb_cookie' is not supported for target groups with"),
+				ExpectError: regexache.MustCompile("Stickiness type 'lb_cookie' is not supported for target groups with"),
 			},
 			{
 				Config:             testAccTargetGroupConfig_stickinessValidity(rName, "TCP_UDP", "lb_cookie", false),
@@ -1214,19 +1345,19 @@ func TestAccELBV2TargetGroup_Stickiness_invalidNLB(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccTargetGroupConfig_stickinessValidity(rName, "TCP", "lb_cookie", true),
-				ExpectError: regexp.MustCompile("Stickiness type 'lb_cookie' is not supported for target groups with"),
+				ExpectError: regexache.MustCompile("Stickiness type 'lb_cookie' is not supported for target groups with"),
 			},
 			{
 				Config:      testAccTargetGroupConfig_stickinessValidity(rName, "TCP", "lb_cookie", false),
-				ExpectError: regexp.MustCompile("Stickiness type 'lb_cookie' is not supported for target groups with"),
+				ExpectError: regexache.MustCompile("Stickiness type 'lb_cookie' is not supported for target groups with"),
 			},
 			{
 				Config:      testAccTargetGroupConfig_stickinessValidity(rName, "UDP", "lb_cookie", true),
-				ExpectError: regexp.MustCompile("Stickiness type 'lb_cookie' is not supported for target groups with"),
+				ExpectError: regexache.MustCompile("Stickiness type 'lb_cookie' is not supported for target groups with"),
 			},
 			{
 				Config:      testAccTargetGroupConfig_stickinessValidity(rName, "TCP_UDP", "lb_cookie", true),
-				ExpectError: regexp.MustCompile("Stickiness type 'lb_cookie' is not supported for target groups with"),
+				ExpectError: regexache.MustCompile("Stickiness type 'lb_cookie' is not supported for target groups with"),
 			},
 		},
 	})
@@ -1320,47 +1451,6 @@ func TestAccELBV2TargetGroup_Stickiness_validNLB(t *testing.T) {
 	})
 }
 
-func TestAccELBV2TargetGroup_tags(t *testing.T) {
-	ctx := acctest.Context(t)
-	var conf elbv2.TargetGroup
-	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
-	resourceName := "aws_lb_target_group.test"
-
-	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, elbv2.EndpointsID),
-		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckTargetGroupDestroy(ctx),
-		Steps: []resource.TestStep{
-			{
-				Config: testAccTargetGroupConfig_tags1(rName, "key1", "value1"),
-				Check: resource.ComposeAggregateTestCheckFunc(
-					testAccCheckTargetGroupExists(ctx, resourceName, &conf),
-					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
-					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
-				),
-			},
-			{
-				Config: testAccTargetGroupConfig_tags2(rName, "key1", "value1updated", "key2", "value2"),
-				Check: resource.ComposeAggregateTestCheckFunc(
-					testAccCheckTargetGroupExists(ctx, resourceName, &conf),
-					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
-					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1updated"),
-					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
-				),
-			},
-			{
-				Config: testAccTargetGroupConfig_tags1(rName, "key2", "value2"),
-				Check: resource.ComposeAggregateTestCheckFunc(
-					testAccCheckTargetGroupExists(ctx, resourceName, &conf),
-					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
-					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
-				),
-			},
-		},
-	})
-}
-
 func TestAccELBV2TargetGroup_Stickiness_updateAppEnabled(t *testing.T) {
 	ctx := acctest.Context(t)
 	var conf elbv2.TargetGroup
@@ -1915,15 +2005,15 @@ func TestAccELBV2TargetGroup_ALBAlias_missingPortProtocolVPC(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccTargetGroupConfig_albMissingPort(rName),
-				ExpectError: regexp.MustCompile(`port should be set when target type is`),
+				ExpectError: regexache.MustCompile(`port should be set when target type is`),
 			},
 			{
 				Config:      testAccTargetGroupConfig_albMissingProtocol(rName),
-				ExpectError: regexp.MustCompile(`protocol should be set when target type is`),
+				ExpectError: regexache.MustCompile(`protocol should be set when target type is`),
 			},
 			{
 				Config:      testAccTargetGroupConfig_albMissingVPC(rName),
-				ExpectError: regexp.MustCompile(`vpc_id should be set when target type is`),
+				ExpectError: regexache.MustCompile(`vpc_id should be set when target type is`),
 			},
 		},
 	})
@@ -1945,7 +2035,7 @@ func TestAccELBV2TargetGroup_ALBAlias_namePrefix(t *testing.T) {
 				Config: testAccTargetGroupConfig_albNamePrefix(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckTargetGroupExists(ctx, resourceName, &conf),
-					resource.TestMatchResourceAttr(resourceName, "name", regexp.MustCompile("^tf-")),
+					resource.TestMatchResourceAttr(resourceName, "name", regexache.MustCompile("^tf-")),
 				),
 			},
 		},
@@ -2252,11 +2342,11 @@ func TestAccELBV2TargetGroup_ALBAlias_updateStickinessEnabled(t *testing.T) {
 	})
 }
 
-func TestAccELBV2TargetGroup_Name_noDuplicates(t *testing.T) {
+func TestAccELBV2TargetGroup_targetHealthStateUnhealthyConnectionTermination(t *testing.T) {
 	ctx := acctest.Context(t)
 	var targetGroup elbv2.TargetGroup
-	tgName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
-	resourceName := "aws_lb_target_group.first"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_lb_target_group.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
@@ -2265,15 +2355,44 @@ func TestAccELBV2TargetGroup_Name_noDuplicates(t *testing.T) {
 		CheckDestroy:             testAccCheckTargetGroupDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccTargetGroupConfig_duplicateNameFirst(tgName),
+				Config: testAccTargetGroupConfig_targetHealthStateConnectionTermination(rName, "TCP", false),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckTargetGroupExists(ctx, resourceName, &targetGroup),
+					resource.TestCheckResourceAttr(resourceName, "name", rName),
+					resource.TestCheckResourceAttr(resourceName, "protocol", "TCP"),
+					resource.TestCheckResourceAttr(resourceName, "target_health_state.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "target_health_state.0.enable_unhealthy_connection_termination", "false"),
+				),
+			},
+			{
+				Config: testAccTargetGroupConfig_targetHealthStateConnectionTermination(rName, "TCP", true),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckTargetGroupExists(ctx, resourceName, &targetGroup),
+					resource.TestCheckResourceAttr(resourceName, "name", rName),
+					resource.TestCheckResourceAttr(resourceName, "protocol", "TCP"),
+					resource.TestCheckResourceAttr(resourceName, "target_health_state.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "target_health_state.0.enable_unhealthy_connection_termination", "true"),
+				),
+			},
+			{
+				Config: testAccTargetGroupConfig_targetHealthStateConnectionTermination(rName, "TLS", false),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckTargetGroupExists(ctx, resourceName, &targetGroup),
-					resource.TestCheckResourceAttr(resourceName, "name", tgName),
+					resource.TestCheckResourceAttr(resourceName, "name", rName),
+					resource.TestCheckResourceAttr(resourceName, "protocol", "TLS"),
+					resource.TestCheckResourceAttr(resourceName, "target_health_state.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "target_health_state.0.enable_unhealthy_connection_termination", "false"),
 				),
 			},
 			{
-				Config:      testAccTargetGroupConfig_duplicateNameFirstAndSecond(tgName),
-				ExpectError: regexp.MustCompile("ELBv2 Target Group (.*?) already exist"),
+				Config: testAccTargetGroupConfig_targetHealthStateConnectionTermination(rName, "TLS", true),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckTargetGroupExists(ctx, resourceName, &targetGroup),
+					resource.TestCheckResourceAttr(resourceName, "name", rName),
+					resource.TestCheckResourceAttr(resourceName, "protocol", "TLS"),
+					resource.TestCheckResourceAttr(resourceName, "target_health_state.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "target_health_state.0.enable_unhealthy_connection_termination", "true"),
+				),
 			},
 		},
 	})
@@ -2336,18 +2455,197 @@ func testAccCheckTargetGroupNotRecreated(i, j *elbv2.TargetGroup) resource.TestC
 			return errors.New("ELBv2 Target Group was recreated")
 		}
 
-		return nil
-	}
+		return nil
+	}
+}
+
+func testAccCheckTargetGroupRecreated(i, j *elbv2.TargetGroup) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		if aws.StringValue(i.TargetGroupArn) == aws.StringValue(j.TargetGroupArn) {
+			return errors.New("ELBv2 Target Group was not recreated")
+		}
+
+		return nil
+	}
+}
+
+func testAccTargetGroupConfig_basic(rName string, deregDelay int) string {
+	return fmt.Sprintf(`
+resource "aws_lb_target_group" "test" {
+  name     = %[1]q
+  port     = 443
+  protocol = "HTTPS"
+  vpc_id   = aws_vpc.test.id
+
+  deregistration_delay = %[2]d
+  slow_start           = 0
+
+  stickiness {
+    type            = "lb_cookie"
+    cookie_duration = 10000
+  }
+
+  health_check {
+    path                = "/health"
+    interval            = 60
+    port                = 8081
+    protocol            = "HTTP"
+    timeout             = 3
+    healthy_threshold   = 3
+    unhealthy_threshold = 3
+    matcher             = "200-299"
+  }
+
+  tags = {
+    Name = %[1]q
+  }
+}
+
+resource "aws_vpc" "test" {
+  cidr_block = "10.0.0.0/16"
+
+  tags = {
+    Name = %[1]q
+  }
+}
+`, rName, deregDelay)
+}
+
+func testAccTargetGroupConfig_nameGenerated(rName string) string {
+	return fmt.Sprintf(`
+resource "aws_lb_target_group" "test" {
+  port     = 80
+  protocol = "HTTP"
+  vpc_id   = aws_vpc.test.id
+}
+
+resource "aws_vpc" "test" {
+  cidr_block = "10.0.0.0/16"
+
+  tags = {
+    Name = %[1]q
+  }
+}
+`, rName)
+}
+
+func testAccTargetGroupConfig_namePrefix(rName, namePrefix string) string {
+	return fmt.Sprintf(`
+resource "aws_lb_target_group" "test" {
+  name_prefix = %[2]q
+  port        = 80
+  protocol    = "HTTP"
+  vpc_id      = aws_vpc.test.id
+}
+
+resource "aws_vpc" "test" {
+  cidr_block = "10.0.0.0/16"
+
+  tags = {
+    Name = %[1]q
+  }
+}
+`, rName, namePrefix)
+}
+
+func testAccTargetGroupConfig_duplicateName(rName string, deregDelay int) string {
+	return acctest.ConfigCompose(testAccTargetGroupConfig_basic(rName, deregDelay), fmt.Sprintf(`
+resource "aws_lb_target_group" "test2" {
+  name     = %[1]q
+  port     = 443
+  protocol = "HTTPS"
+  vpc_id   = aws_vpc.test.id
+
+  tags = {
+    Name = %[1]q
+  }
+}
+`, rName))
+}
+
+func testAccTargetGroupConfig_tags1(rName, tagKey1, tagValue1 string) string {
+	return fmt.Sprintf(`
+resource "aws_lb_target_group" "test" {
+  name     = %[1]q
+  port     = 443
+  protocol = "HTTPS"
+  vpc_id   = aws_vpc.test.id
+
+  deregistration_delay = 200
+  slow_start           = 0
+
+  stickiness {
+    type            = "lb_cookie"
+    cookie_duration = 10000
+  }
+
+  health_check {
+    path                = "/health"
+    interval            = 60
+    port                = 8081
+    protocol            = "HTTP"
+    timeout             = 3
+    healthy_threshold   = 3
+    unhealthy_threshold = 3
+    matcher             = "200-299"
+  }
+
+  tags = {
+    %[2]q = %[3]q
+  }
+}
+
+resource "aws_vpc" "test" {
+  cidr_block = "10.0.0.0/16"
+
+  tags = {
+    Name = %[1]q
+  }
+}
+`, rName, tagKey1, tagValue1)
+}
+
+func testAccTargetGroupConfig_tags2(rName, tagKey1, tagValue1, tagKey2, tagValue2 string) string {
+	return fmt.Sprintf(`
+resource "aws_lb_target_group" "test" {
+  name     = %[1]q
+  port     = 443
+  protocol = "HTTPS"
+  vpc_id   = aws_vpc.test.id
+
+  deregistration_delay = 200
+  slow_start           = 0
+
+  stickiness {
+    type            = "lb_cookie"
+    cookie_duration = 10000
+  }
+
+  health_check {
+    path                = "/health"
+    interval            = 60
+    port                = 8081
+    protocol            = "HTTP"
+    timeout             = 3
+    healthy_threshold   = 3
+    unhealthy_threshold = 3
+    matcher             = "200-299"
+  }
+
+  tags = {
+    %[2]q = %[3]q
+    %[4]q = %[5]q
+  }
 }
 
-func testAccCheckTargetGroupRecreated(i, j *elbv2.TargetGroup) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		if aws.StringValue(i.TargetGroupArn) == aws.StringValue(j.TargetGroupArn) {
-			return errors.New("ELBv2 Target Group was not recreated")
-		}
+resource "aws_vpc" "test" {
+  cidr_block = "10.0.0.0/16"
 
-		return nil
-	}
+  tags = {
+    Name = %[1]q
+  }
+}
+`, rName, tagKey1, tagValue1, tagKey2, tagValue2)
 }
 
 func testAccTargetGroupConfig_albDefaults(rName string) string {
@@ -2513,91 +2811,6 @@ resource "aws_lb_target_group" "test" {
 `, rName, failoverType)
 }
 
-func testAccTargetGroupConfig_tags1(rName, tagKey1, tagValue1 string) string {
-	return fmt.Sprintf(`
-resource "aws_lb_target_group" "test" {
-  name     = %[1]q
-  port     = 443
-  protocol = "HTTPS"
-  vpc_id   = aws_vpc.test.id
-
-  deregistration_delay = 200
-  slow_start           = 0
-
-  stickiness {
-    type            = "lb_cookie"
-    cookie_duration = 10000
-  }
-
-  health_check {
-    path                = "/health"
-    interval            = 60
-    port                = 8081
-    protocol            = "HTTP"
-    timeout             = 3
-    healthy_threshold   = 3
-    unhealthy_threshold = 3
-    matcher             = "200-299"
-  }
-
-  tags = {
-    %[2]q = %[3]q
-  }
-}
-
-resource "aws_vpc" "test" {
-  cidr_block = "10.0.0.0/16"
-
-  tags = {
-    Name = %[1]q
-  }
-}
-`, rName, tagKey1, tagValue1)
-}
-
-func testAccTargetGroupConfig_tags2(rName, tagKey1, tagValue1, tagKey2, tagValue2 string) string {
-	return fmt.Sprintf(`
-resource "aws_lb_target_group" "test" {
-  name     = %[1]q
-  port     = 443
-  protocol = "HTTPS"
-  vpc_id   = aws_vpc.test.id
-
-  deregistration_delay = 200
-  slow_start           = 0
-
-  stickiness {
-    type            = "lb_cookie"
-    cookie_duration = 10000
-  }
-
-  health_check {
-    path                = "/health"
-    interval            = 60
-    port                = 8081
-    protocol            = "HTTP"
-    timeout             = 3
-    healthy_threshold   = 3
-    unhealthy_threshold = 3
-    matcher             = "200-299"
-  }
-
-  tags = {
-    %[2]q = %[3]q
-    %[4]q = %[5]q
-  }
-}
-
-resource "aws_vpc" "test" {
-  cidr_block = "10.0.0.0/16"
-
-  tags = {
-    Name = %[1]q
-  }
-}
-`, rName, tagKey1, tagValue1, tagKey2, tagValue2)
-}
-
 func testAccTargetGroupConfig_grpcProtocolVersion(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_lb_target_group" "test" {
@@ -2803,48 +3016,6 @@ resource "aws_vpc" "test" {
 `, rName, appSstickinessBlock)
 }
 
-func testAccTargetGroupConfig_basic(rName string, deregDelay int) string {
-	return fmt.Sprintf(`
-resource "aws_lb_target_group" "test" {
-  name     = %[1]q
-  port     = 443
-  protocol = "HTTPS"
-  vpc_id   = aws_vpc.test.id
-
-  deregistration_delay = %[2]d
-  slow_start           = 0
-
-  stickiness {
-    type            = "lb_cookie"
-    cookie_duration = 10000
-  }
-
-  health_check {
-    path                = "/health"
-    interval            = 60
-    port                = 8081
-    protocol            = "HTTP"
-    timeout             = 3
-    healthy_threshold   = 3
-    unhealthy_threshold = 3
-    matcher             = "200-299"
-  }
-
-  tags = {
-    Name = %[1]q
-  }
-}
-
-resource "aws_vpc" "test" {
-  cidr_block = "10.0.0.0/16"
-
-  tags = {
-    Name = %[1]q
-  }
-}
-`, rName, deregDelay)
-}
-
 func testAccTargetGroupConfig_basicUdp(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_lb_target_group" "test" {
@@ -2887,43 +3058,6 @@ resource "aws_lb_target_group" "test" {
 `, rName)
 }
 
-func testAccTargetGroupConfig_generatedName(rName string) string {
-	return fmt.Sprintf(`
-resource "aws_lb_target_group" "test" {
-  port     = 80
-  protocol = "HTTP"
-  vpc_id   = aws_vpc.test.id
-}
-
-resource "aws_vpc" "test" {
-  cidr_block = "10.0.0.0/16"
-
-  tags = {
-    Name = %[1]q
-  }
-}
-`, rName)
-}
-
-func testAccTargetGroupConfig_namePrefix(rName string) string {
-	return fmt.Sprintf(`
-resource "aws_lb_target_group" "test" {
-  name_prefix = "tf-"
-  port        = 80
-  protocol    = "HTTP"
-  vpc_id      = aws_vpc.test.id
-}
-
-resource "aws_vpc" "test" {
-  cidr_block = "10.0.0.0/16"
-
-  tags = {
-    Name = %[1]q
-  }
-}
-`, rName)
-}
-
 func testAccTargetGroupConfig_preserveClientIP(rName string, preserveClientIP bool) string {
 	return fmt.Sprintf(`
 resource "aws_lb_target_group" "test" {
@@ -3040,6 +3174,29 @@ resource "aws_vpc" "test" {
 `, protocol, stickyType, enabled, rName)
 }
 
+func testAccTargetGroupConfig_targetHealthStateConnectionTermination(rName, protocol string, enabled bool) string {
+	return fmt.Sprintf(`
+resource "aws_lb_target_group" "test" {
+  name     = %[1]q
+  port     = 25
+  protocol = %[2]q
+  vpc_id   = aws_vpc.test.id
+
+  target_health_state {
+    enable_unhealthy_connection_termination = %[3]t
+  }
+}
+
+resource "aws_vpc" "test" {
+  cidr_block = "10.0.0.0/16"
+
+  tags = {
+    Name = %[1]q
+  }
+}
+`, rName, protocol, enabled)
+}
+
 func testAccTargetGroupConfig_typeTCP(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_lb_target_group" "test" {
@@ -3924,60 +4081,3 @@ resource "aws_vpc" "test" {
   }
 }`, rName)
 }
-
-func testAccTargetGroupConfig_duplicateNameFirst(rName string) string {
-	return fmt.Sprintf(`
-resource "aws_lb_target_group" "first" {
-  name     = %[1]q
-  port     = 443
-  protocol = "HTTPS"
-  vpc_id   = aws_vpc.test.id
-
-  tags = {
-    Name = %[1]q
-  }
-}
-
-resource "aws_vpc" "test" {
-  cidr_block = "10.0.0.0/16"
-
-  tags = {
-    Name = %[1]q
-  }
-}
-`, rName)
-}
-
-func testAccTargetGroupConfig_duplicateNameFirstAndSecond(rName string) string {
-	return fmt.Sprintf(`
-resource "aws_lb_target_group" "first" {
-  name     = %[1]q
-  port     = 443
-  protocol = "HTTPS"
-  vpc_id   = aws_vpc.test.id
-
-  tags = {
-    Name = %[1]q
-  }
-}
-
-resource "aws_lb_target_group" "second" {
-  name     = %[1]q
-  port     = 443
-  protocol = "HTTPS"
-  vpc_id   = aws_vpc.test.id
-
-  tags = {
-    Name = %[1]q
-  }
-}
-
-resource "aws_vpc" "test" {
-  cidr_block = "10.0.0.0/16"
-
-  tags = {
-    Name = %[1]q
-  }
-}
-`, rName)
-}
diff --git a/internal/service/elbv2/validate.go b/internal/service/elbv2/validate.go
index 60e120102c8..efae650391a 100644
--- a/internal/service/elbv2/validate.go
+++ b/internal/service/elbv2/validate.go
@@ -1,9 +1,12 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elbv2
 
 import (
 	"fmt"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 )
 
@@ -16,20 +19,20 @@ func validName(v interface{}, k string) (ws []string, errors []error) {
 		errors = append(errors, fmt.Errorf(
 			"%q cannot be longer than 32 characters: %q", k, value))
 	}
-	if !regexp.MustCompile(`^[0-9A-Za-z-]+$`).MatchString(value) {
+	if !regexache.MustCompile(`^[0-9A-Za-z-]+$`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"only alphanumeric characters and hyphens allowed in %q: %q",
 			k, value))
 	}
-	if regexp.MustCompile(`^-`).MatchString(value) {
+	if regexache.MustCompile(`^-`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"%q cannot begin with a hyphen: %q", k, value))
 	}
-	if regexp.MustCompile(`-$`).MatchString(value) {
+	if regexache.MustCompile(`-$`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"%q cannot end with a hyphen: %q", k, value))
 	}
-	if regexp.MustCompile(`^internal-`).MatchString(value) {
+	if regexache.MustCompile(`^internal-`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			`%q cannot begin with "internal-": %q`, k, value))
 	}
@@ -38,7 +41,7 @@ func validName(v interface{}, k string) (ws []string, errors []error) {
 
 func validNamePrefix(v interface{}, k string) (ws []string, errors []error) {
 	value := v.(string)
-	if !regexp.MustCompile(`^[0-9A-Za-z-]+$`).MatchString(value) {
+	if !regexache.MustCompile(`^[0-9A-Za-z-]+$`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"only alphanumeric characters and hyphens allowed in %q: %q",
 			k, value))
@@ -47,11 +50,11 @@ func validNamePrefix(v interface{}, k string) (ws []string, errors []error) {
 		errors = append(errors, fmt.Errorf(
 			"%q cannot be longer than 6 characters: %q", k, value))
 	}
-	if regexp.MustCompile(`^-`).MatchString(value) {
+	if regexache.MustCompile(`^-`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"%q cannot begin with a hyphen: %q", k, value))
 	}
-	if regexp.MustCompile(`^internal-`).MatchString(value) {
+	if regexache.MustCompile(`^internal-`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			`%q cannot begin with "internal-": %q`, k, value))
 	}
@@ -64,15 +67,15 @@ func validTargetGroupName(v interface{}, k string) (ws []string, errors []error)
 		errors = append(errors, fmt.Errorf(
 			"%q cannot be longer than 32 characters", k))
 	}
-	if !regexp.MustCompile(`^[0-9A-Za-z-]+$`).MatchString(value) {
+	if !regexache.MustCompile(`^[0-9A-Za-z-]+$`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"only alphanumeric characters and hyphens allowed in %q", k))
 	}
-	if regexp.MustCompile(`^-`).MatchString(value) {
+	if regexache.MustCompile(`^-`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"%q cannot begin with a hyphen", k))
 	}
-	if regexp.MustCompile(`-$`).MatchString(value) {
+	if regexache.MustCompile(`-$`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"%q cannot end with a hyphen", k))
 	}
@@ -86,11 +89,11 @@ func validTargetGroupNamePrefix(v interface{}, k string) (ws []string, errors []
 		errors = append(errors, fmt.Errorf(
 			"%q cannot be longer than %d characters", k, prefixMaxLength))
 	}
-	if !regexp.MustCompile(`^[0-9A-Za-z-]+$`).MatchString(value) {
+	if !regexache.MustCompile(`^[0-9A-Za-z-]+$`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"only alphanumeric characters and hyphens allowed in %q", k))
 	}
-	if regexp.MustCompile(`^-`).MatchString(value) {
+	if regexache.MustCompile(`^-`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"%q cannot begin with a hyphen", k))
 	}
diff --git a/internal/service/elbv2/validate_test.go b/internal/service/elbv2/validate_test.go
index e7a62b134bb..6ebbab39df0 100644
--- a/internal/service/elbv2/validate_test.go
+++ b/internal/service/elbv2/validate_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package elbv2
 
 import (
diff --git a/internal/service/emr/block_public_access_configuration.go b/internal/service/emr/block_public_access_configuration.go
index a3ae9f1d5f4..bed58c5d714 100644
--- a/internal/service/emr/block_public_access_configuration.go
+++ b/internal/service/emr/block_public_access_configuration.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package emr
 
 import (
diff --git a/internal/service/emr/block_public_access_configuration_test.go b/internal/service/emr/block_public_access_configuration_test.go
index d61b575ec4d..46f7c5f6632 100644
--- a/internal/service/emr/block_public_access_configuration_test.go
+++ b/internal/service/emr/block_public_access_configuration_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package emr_test
 
 import (
diff --git a/internal/service/emr/cluster.go b/internal/service/emr/cluster.go
index df320ffc913..5cd02c2ae82 100644
--- a/internal/service/emr/cluster.go
+++ b/internal/service/emr/cluster.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package emr
 
 import (
@@ -1737,7 +1740,7 @@ func expandBootstrapActions(bootstrapActions []interface{}) []*emr.BootstrapActi
 			Name: aws.String(actionName),
 			ScriptBootstrapAction: &emr.ScriptBootstrapActionConfig{
 				Path: aws.String(actionPath),
-				Args: flex.ExpandStringList(actionArgs),
+				Args: flex.ExpandStringListEmpty(actionArgs),
 			},
 		}
 		actionsOut = append(actionsOut, action)
diff --git a/internal/service/emr/cluster_test.go b/internal/service/emr/cluster_test.go
index d97d4967ee1..09c3d721f46 100644
--- a/internal/service/emr/cluster_test.go
+++ b/internal/service/emr/cluster_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package emr_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/endpoints"
 	"github.com/aws/aws-sdk-go/service/ec2"
@@ -37,7 +40,7 @@ func TestAccEMRCluster_basic(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckClusterExists(ctx, resourceName, &cluster),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elasticmapreduce", regexp.MustCompile("cluster/.+$")),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elasticmapreduce", regexache.MustCompile("cluster/.+$")),
 					resource.TestCheckResourceAttr(resourceName, "release_label", "emr-4.6.0"),
 					resource.TestCheckResourceAttr(resourceName, "applications.#", "1"),
 					resource.TestCheckTypeSetElemAttr(resourceName, "applications.*", "Spark"),
@@ -218,7 +221,7 @@ func TestAccEMRCluster_sJSON(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckClusterExists(ctx, resourceName, &cluster),
 					resource.TestMatchResourceAttr(resourceName, "configurations_json",
-						regexp.MustCompile("{\"JAVA_HOME\":\"/usr/lib/jvm/java-1.8.0\".+")),
+						regexache.MustCompile("{\"JAVA_HOME\":\"/usr/lib/jvm/java-1.8.0\".+")),
 				),
 			},
 			{
@@ -559,7 +562,7 @@ func TestAccEMRCluster_EC2Attributes_defaultManagedSecurityGroups(t *testing.T)
 			{
 				Config:      testAccClusterConfig_ec2AttributesDefaultManagedSecurityGroups(rName),
 				Destroy:     true,
-				ExpectError: regexp.MustCompile(`DependencyViolation`),
+				ExpectError: regexache.MustCompile(`DependencyViolation`),
 			},
 			{
 				PreConfig: func() {
@@ -1027,7 +1030,7 @@ func TestAccEMRCluster_Bootstrap_ordering(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config: testAccClusterConfig_bootstrap(rName),
-				Check: resource.ComposeTestCheckFunc(
+				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckClusterExists(ctx, resourceName, &cluster),
 					resource.TestCheckResourceAttr(resourceName, "bootstrap_action.#", "2"),
 					resource.TestCheckResourceAttr(resourceName, "bootstrap_action.0.name", "runif"),
@@ -1037,7 +1040,18 @@ func TestAccEMRCluster_Bootstrap_ordering(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "bootstrap_action.0.args.1", "echo running on master node"),
 					resource.TestCheckResourceAttr(resourceName, "bootstrap_action.1.name", "test"),
 					resource.TestCheckResourceAttr(resourceName, "bootstrap_action.1.path", fmt.Sprintf("s3://%s/testscript.sh", rName)),
-					resource.TestCheckResourceAttr(resourceName, "bootstrap_action.1.args.#", "10"),
+					resource.TestCheckResourceAttr(resourceName, "bootstrap_action.1.args.#", "11"),
+					resource.TestCheckResourceAttr(resourceName, "bootstrap_action.1.args.0", "0"),
+					resource.TestCheckResourceAttr(resourceName, "bootstrap_action.1.args.1", "1"),
+					resource.TestCheckResourceAttr(resourceName, "bootstrap_action.1.args.2", ""),
+					resource.TestCheckResourceAttr(resourceName, "bootstrap_action.1.args.3", "3"),
+					resource.TestCheckResourceAttr(resourceName, "bootstrap_action.1.args.4", "4"),
+					resource.TestCheckResourceAttr(resourceName, "bootstrap_action.1.args.5", "5"),
+					resource.TestCheckResourceAttr(resourceName, "bootstrap_action.1.args.6", "6"),
+					resource.TestCheckResourceAttr(resourceName, "bootstrap_action.1.args.7", "7"),
+					resource.TestCheckResourceAttr(resourceName, "bootstrap_action.1.args.8", "8"),
+					resource.TestCheckResourceAttr(resourceName, "bootstrap_action.1.args.9", "9"),
+					resource.TestCheckResourceAttr(resourceName, "bootstrap_action.1.args.10", "10"),
 				),
 			},
 			{
@@ -1052,7 +1066,7 @@ func TestAccEMRCluster_Bootstrap_ordering(t *testing.T) {
 			},
 			{
 				Config: testAccClusterConfig_bootstrapAdd(rName),
-				Check: resource.ComposeTestCheckFunc(
+				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckClusterExists(ctx, resourceName, &cluster),
 					resource.TestCheckResourceAttr(resourceName, "bootstrap_action.#", "3"),
 					resource.TestCheckResourceAttr(resourceName, "bootstrap_action.0.name", "runif"),
@@ -1062,7 +1076,18 @@ func TestAccEMRCluster_Bootstrap_ordering(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "bootstrap_action.0.args.1", "echo running on master node"),
 					resource.TestCheckResourceAttr(resourceName, "bootstrap_action.1.name", "test"),
 					resource.TestCheckResourceAttr(resourceName, "bootstrap_action.1.path", fmt.Sprintf("s3://%s/testscript.sh", rName)),
-					resource.TestCheckResourceAttr(resourceName, "bootstrap_action.1.args.#", "10"),
+					resource.TestCheckResourceAttr(resourceName, "bootstrap_action.1.args.#", "11"),
+					resource.TestCheckResourceAttr(resourceName, "bootstrap_action.1.args.0", "0"),
+					resource.TestCheckResourceAttr(resourceName, "bootstrap_action.1.args.1", "1"),
+					resource.TestCheckResourceAttr(resourceName, "bootstrap_action.1.args.2", ""),
+					resource.TestCheckResourceAttr(resourceName, "bootstrap_action.1.args.3", "3"),
+					resource.TestCheckResourceAttr(resourceName, "bootstrap_action.1.args.4", "4"),
+					resource.TestCheckResourceAttr(resourceName, "bootstrap_action.1.args.5", "5"),
+					resource.TestCheckResourceAttr(resourceName, "bootstrap_action.1.args.6", "6"),
+					resource.TestCheckResourceAttr(resourceName, "bootstrap_action.1.args.7", "7"),
+					resource.TestCheckResourceAttr(resourceName, "bootstrap_action.1.args.8", "8"),
+					resource.TestCheckResourceAttr(resourceName, "bootstrap_action.1.args.9", "9"),
+					resource.TestCheckResourceAttr(resourceName, "bootstrap_action.1.args.10", "10"),
 					resource.TestCheckResourceAttr(resourceName, "bootstrap_action.2.name", "runif-2"),
 					resource.TestCheckResourceAttr(resourceName, "bootstrap_action.2.path", "s3://elasticmapreduce/bootstrap-actions/run-if"),
 					resource.TestCheckResourceAttr(resourceName, "bootstrap_action.2.args.#", "2"),
@@ -1082,7 +1107,7 @@ func TestAccEMRCluster_Bootstrap_ordering(t *testing.T) {
 			},
 			{
 				Config: testAccClusterConfig_bootstrapReorder(rName),
-				Check: resource.ComposeTestCheckFunc(
+				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckClusterExists(ctx, resourceName, &cluster),
 					resource.TestCheckResourceAttr(resourceName, "bootstrap_action.#", "3"),
 					resource.TestCheckResourceAttr(resourceName, "bootstrap_action.0.name", "runif"),
@@ -1092,7 +1117,18 @@ func TestAccEMRCluster_Bootstrap_ordering(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "bootstrap_action.0.args.1", "echo running on master node"),
 					resource.TestCheckResourceAttr(resourceName, "bootstrap_action.2.name", "test"),
 					resource.TestCheckResourceAttr(resourceName, "bootstrap_action.2.path", fmt.Sprintf("s3://%s/testscript.sh", rName)),
-					resource.TestCheckResourceAttr(resourceName, "bootstrap_action.2.args.#", "10"),
+					resource.TestCheckResourceAttr(resourceName, "bootstrap_action.2.args.#", "11"),
+					resource.TestCheckResourceAttr(resourceName, "bootstrap_action.2.args.0", "0"),
+					resource.TestCheckResourceAttr(resourceName, "bootstrap_action.2.args.1", "1"),
+					resource.TestCheckResourceAttr(resourceName, "bootstrap_action.2.args.2", ""),
+					resource.TestCheckResourceAttr(resourceName, "bootstrap_action.2.args.3", "3"),
+					resource.TestCheckResourceAttr(resourceName, "bootstrap_action.2.args.4", "4"),
+					resource.TestCheckResourceAttr(resourceName, "bootstrap_action.2.args.5", "5"),
+					resource.TestCheckResourceAttr(resourceName, "bootstrap_action.2.args.6", "6"),
+					resource.TestCheckResourceAttr(resourceName, "bootstrap_action.2.args.7", "7"),
+					resource.TestCheckResourceAttr(resourceName, "bootstrap_action.2.args.8", "8"),
+					resource.TestCheckResourceAttr(resourceName, "bootstrap_action.2.args.9", "9"),
+					resource.TestCheckResourceAttr(resourceName, "bootstrap_action.2.args.10", "10"),
 					resource.TestCheckResourceAttr(resourceName, "bootstrap_action.1.name", "runif-2"),
 					resource.TestCheckResourceAttr(resourceName, "bootstrap_action.1.path", "s3://elasticmapreduce/bootstrap-actions/run-if"),
 					resource.TestCheckResourceAttr(resourceName, "bootstrap_action.1.args.#", "2"),
@@ -1351,7 +1387,7 @@ func TestAccEMRCluster_s3LogEncryption(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckClusterExists(ctx, resourceName, &cluster),
 					resource.TestCheckResourceAttr(resourceName, "log_uri", bucketName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "log_encryption_kms_key_id", "kms", regexp.MustCompile(`key/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "log_encryption_kms_key_id", "kms", regexache.MustCompile(`key/.+`)),
 				),
 			},
 			{
@@ -2039,26 +2075,46 @@ resource "aws_iam_role_policy_attachment" "emr_autoscaling_role" {
 `, rName)
 }
 
-func testAccClusterBootstrapActionBucketConfig(rName string) string {
+func testAccClusterConfig_baseBootstrapActionBucket(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_s3_bucket" "tester" {
   bucket = %[1]q
 }
 
+resource "aws_s3_bucket_public_access_block" "tester" {
+  bucket = aws_s3_bucket.tester.id
+
+  block_public_acls       = false
+  block_public_policy     = false
+  ignore_public_acls      = false
+  restrict_public_buckets = false
+}
+
+resource "aws_s3_bucket_ownership_controls" "tester" {
+  bucket = aws_s3_bucket.tester.id
+  rule {
+    object_ownership = "BucketOwnerPreferred"
+  }
+}
+
 resource "aws_s3_bucket_acl" "tester" {
+  depends_on = [
+    aws_s3_bucket_public_access_block.tester,
+    aws_s3_bucket_ownership_controls.tester,
+  ]
+
   bucket = aws_s3_bucket.tester.id
   acl    = "public-read"
 }
 
 resource "aws_s3_object" "testobject" {
-  bucket  = aws_s3_bucket.tester.bucket
+  bucket  = aws_s3_bucket_acl.tester.bucket
   key     = "testscript.sh"
   content = <<EOF
 #!/bin/bash
 echo $@
 EOF
 
-
   acl = "public-read"
 }
 `, rName)
@@ -3013,7 +3069,7 @@ func testAccClusterConfig_bootstrap(rName string) string {
 		testAccClusterConfig_baseVPC(rName, false),
 		testAccClusterConfig_baseIAMServiceRole(rName),
 		testAccClusterConfig_baseIAMInstanceProfile(rName),
-		testAccClusterBootstrapActionBucketConfig(rName),
+		testAccClusterConfig_baseBootstrapActionBucket(rName),
 		fmt.Sprintf(`
 data "aws_partition" "current" {}
 
@@ -3056,8 +3112,10 @@ resource "aws_emr_cluster" "test" {
     path = "s3://${aws_s3_object.testobject.bucket}/${aws_s3_object.testobject.key}"
     name = "test"
 
-    args = ["1",
-      "2",
+    args = [
+      "0",
+      "1",
+      "",
       "3",
       "4",
       "5",
@@ -3077,7 +3135,7 @@ func testAccClusterConfig_bootstrapAdd(rName string) string {
 		testAccClusterConfig_baseVPC(rName, false),
 		testAccClusterConfig_baseIAMServiceRole(rName),
 		testAccClusterConfig_baseIAMInstanceProfile(rName),
-		testAccClusterBootstrapActionBucketConfig(rName),
+		testAccClusterConfig_baseBootstrapActionBucket(rName),
 		fmt.Sprintf(`
 data "aws_partition" "current" {}
 
@@ -3120,8 +3178,10 @@ resource "aws_emr_cluster" "test" {
     path = "s3://${aws_s3_object.testobject.bucket}/${aws_s3_object.testobject.key}"
     name = "test"
 
-    args = ["1",
-      "2",
+    args = [
+      "0",
+      "1",
+      "",
       "3",
       "4",
       "5",
@@ -3147,7 +3207,7 @@ func testAccClusterConfig_bootstrapReorder(rName string) string {
 		testAccClusterConfig_baseVPC(rName, false),
 		testAccClusterConfig_baseIAMServiceRole(rName),
 		testAccClusterConfig_baseIAMInstanceProfile(rName),
-		testAccClusterBootstrapActionBucketConfig(rName),
+		testAccClusterConfig_baseBootstrapActionBucket(rName),
 		fmt.Sprintf(`
 data "aws_partition" "current" {}
 
@@ -3196,8 +3256,10 @@ resource "aws_emr_cluster" "test" {
     path = "s3://${aws_s3_object.testobject.bucket}/${aws_s3_object.testobject.key}"
     name = "test"
 
-    args = ["1",
-      "2",
+    args = [
+      "0",
+      "1",
+      "",
       "3",
       "4",
       "5",
@@ -3780,7 +3842,7 @@ func testAccClusterConfig_instanceFleets(rName string) string {
 		testAccClusterConfig_baseVPC(rName, false),
 		testAccClusterConfig_baseIAMServiceRole(rName),
 		testAccClusterConfig_baseIAMInstanceProfile(rName),
-		testAccClusterBootstrapActionBucketConfig(rName),
+		testAccClusterConfig_baseBootstrapActionBucket(rName),
 		fmt.Sprintf(`
 data "aws_partition" "current" {}
 
@@ -3868,7 +3930,7 @@ func testAccClusterConfig_instanceFleetMultipleSubnets(rName string) string {
 		testAccClusterConfig_baseVPC(rName, false),
 		testAccClusterConfig_baseIAMServiceRole(rName),
 		testAccClusterConfig_baseIAMInstanceProfile(rName),
-		testAccClusterBootstrapActionBucketConfig(rName),
+		testAccClusterConfig_baseBootstrapActionBucket(rName),
 		fmt.Sprintf(`
 data "aws_partition" "current" {}
 
@@ -3968,7 +4030,7 @@ func testAccClusterConfig_instanceFleetsMasterOnly(rName string) string {
 		testAccClusterConfig_baseVPC(rName, false),
 		testAccClusterConfig_baseIAMServiceRole(rName),
 		testAccClusterConfig_baseIAMInstanceProfile(rName),
-		testAccClusterBootstrapActionBucketConfig(rName),
+		testAccClusterConfig_baseBootstrapActionBucket(rName),
 		fmt.Sprintf(`
 data "aws_partition" "current" {}
 
diff --git a/internal/service/emr/consts.go b/internal/service/emr/consts.go
index 5e05fa6db9c..1590d7e7774 100644
--- a/internal/service/emr/consts.go
+++ b/internal/service/emr/consts.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package emr
 
 import (
diff --git a/internal/service/emr/errors.go b/internal/service/emr/errors.go
index b81bafc5470..1061eaae4ec 100644
--- a/internal/service/emr/errors.go
+++ b/internal/service/emr/errors.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package emr
 
 const (
diff --git a/internal/service/emr/find.go b/internal/service/emr/find.go
index 238be25c187..4c5fef4ffda 100644
--- a/internal/service/emr/find.go
+++ b/internal/service/emr/find.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package emr
 
 import (
@@ -84,8 +87,8 @@ func FindStudioByID(ctx context.Context, conn *emr.EMR, id string) (*emr.Studio,
 	return output.Studio, nil
 }
 
-func FindStudioSessionMappingByID(ctx context.Context, conn *emr.EMR, id string) (*emr.SessionMappingDetail, error) {
-	studioId, identityType, identityId, err := readStudioSessionMapping(id)
+func FindStudioSessionMappingByIDOrName(ctx context.Context, conn *emr.EMR, id string) (*emr.SessionMappingDetail, error) {
+	studioId, identityType, identityIdOrName, err := readStudioSessionMapping(id)
 	if err != nil {
 		return nil, err
 	}
@@ -93,7 +96,12 @@ func FindStudioSessionMappingByID(ctx context.Context, conn *emr.EMR, id string)
 	input := &emr.GetStudioSessionMappingInput{
 		StudioId:     aws.String(studioId),
 		IdentityType: aws.String(identityType),
-		IdentityId:   aws.String(identityId),
+	}
+
+	if isIdentityId(identityIdOrName) {
+		input.IdentityId = aws.String(identityIdOrName)
+	} else {
+		input.IdentityName = aws.String(identityIdOrName)
 	}
 
 	output, err := conn.GetStudioSessionMappingWithContext(ctx, input)
diff --git a/internal/service/emr/generate.go b/internal/service/emr/generate.go
index 4f142b304ae..4e567f657a8 100644
--- a/internal/service/emr/generate.go
+++ b/internal/service/emr/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTagsInIDElem=ResourceId -ServiceTagsSlice -TagOp=AddTags -TagInIDElem=ResourceId -UntagOp=RemoveTags -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/emr/id.go b/internal/service/emr/id.go
index a2789f382f9..49a78482b73 100644
--- a/internal/service/emr/id.go
+++ b/internal/service/emr/id.go
@@ -1,14 +1,34 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package emr
 
 import (
 	"fmt"
 	"strings"
+
+	"github.com/YakDriver/regexache"
 )
 
-func readStudioSessionMapping(id string) (studioId, identityType, identityId string, err error) {
-	idParts := strings.Split(id, ":")
-	if len(idParts) != 3 {
-		return "", "", "", fmt.Errorf("expected ID in format studio-id:identity-type:identity-id, received: %s", id)
+const IdentityIdPattern = `([0-9a-f]{10}-|)[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}`
+
+var IdentityIdPatternRegexp = regexache.MustCompile(IdentityIdPattern)
+
+func isIdentityId(identityIdOrName string) bool {
+	return IdentityIdPatternRegexp.MatchString(identityIdOrName)
+}
+
+func readStudioSessionMapping(id string) (studioId, identityType, identityIdOrName string, err error) {
+	idOrNameParts := strings.Split(id, ":")
+	if len(idOrNameParts) == 3 {
+		return idOrNameParts[0], idOrNameParts[1], idOrNameParts[2], nil
+	}
+
+	if isIdentityId(identityIdOrName) {
+		err = fmt.Errorf("expected ID in format studio-id:identity-type:identity-id, received: %s", identityIdOrName)
+	} else {
+		err = fmt.Errorf("expected ID in format studio-id:identity-type:identity-name, received: %s", identityIdOrName)
 	}
-	return idParts[0], idParts[1], idParts[2], nil
+
+	return "", "", "", err
 }
diff --git a/internal/service/emr/instance_fleet.go b/internal/service/emr/instance_fleet.go
index 61214c77502..940f74a298b 100644
--- a/internal/service/emr/instance_fleet.go
+++ b/internal/service/emr/instance_fleet.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package emr
 
 import (
@@ -329,9 +332,13 @@ func resourceInstanceFleetDelete(ctx context.Context, d *schema.ResourceData, me
 		},
 	})
 
+	// Ignore certain errors that indicate the fleet is already (being) deleted
 	if tfawserr.ErrMessageContains(err, emr.ErrCodeInvalidRequestException, "instance fleet may only be modified when the cluster is running or waiting") {
 		return diags
 	}
+	if tfawserr.ErrMessageContains(err, emr.ErrCodeInvalidRequestException, "A job flow that is shutting down, terminated, or finished may not be modified") {
+		return diags
+	}
 
 	if err != nil {
 		return sdkdiag.AppendErrorf(diags, "deleting EMR Instance Fleet (%s): %s", d.Id(), err)
diff --git a/internal/service/emr/instance_fleet_test.go b/internal/service/emr/instance_fleet_test.go
index 47660666dbd..4219db4668d 100644
--- a/internal/service/emr/instance_fleet_test.go
+++ b/internal/service/emr/instance_fleet_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package emr_test
 
 import (
diff --git a/internal/service/emr/instance_group.go b/internal/service/emr/instance_group.go
index 74cf9996384..bd156fcf0bf 100644
--- a/internal/service/emr/instance_group.go
+++ b/internal/service/emr/instance_group.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package emr
 
 import (
diff --git a/internal/service/emr/instance_group_test.go b/internal/service/emr/instance_group_test.go
index 12ef52eec8a..1eed1c5d614 100644
--- a/internal/service/emr/instance_group_test.go
+++ b/internal/service/emr/instance_group_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package emr_test
 
 import (
diff --git a/internal/service/emr/managed_scaling_policy.go b/internal/service/emr/managed_scaling_policy.go
index 1cff705e632..5dbd0fa73db 100644
--- a/internal/service/emr/managed_scaling_policy.go
+++ b/internal/service/emr/managed_scaling_policy.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package emr
 
 import (
diff --git a/internal/service/emr/managed_scaling_policy_test.go b/internal/service/emr/managed_scaling_policy_test.go
index d10bd33b201..0b150213962 100644
--- a/internal/service/emr/managed_scaling_policy_test.go
+++ b/internal/service/emr/managed_scaling_policy_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package emr_test
 
 import (
diff --git a/internal/service/emr/release_labels_data_source.go b/internal/service/emr/release_labels_data_source.go
index b7d582d893d..c5cb109cd82 100644
--- a/internal/service/emr/release_labels_data_source.go
+++ b/internal/service/emr/release_labels_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package emr
 
 import (
diff --git a/internal/service/emr/release_labels_data_source_test.go b/internal/service/emr/release_labels_data_source_test.go
index ef3a5c44f34..a53bccbf6ef 100644
--- a/internal/service/emr/release_labels_data_source_test.go
+++ b/internal/service/emr/release_labels_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package emr_test
 
 import (
diff --git a/internal/service/emr/security_configuration.go b/internal/service/emr/security_configuration.go
index 8900c397606..3671fabd9d8 100644
--- a/internal/service/emr/security_configuration.go
+++ b/internal/service/emr/security_configuration.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package emr
 
 import (
@@ -10,10 +13,13 @@ import (
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/create"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
 // @SDKResource("aws_emr_security_configuration")
@@ -22,11 +28,22 @@ func ResourceSecurityConfiguration() *schema.Resource {
 		CreateWithoutTimeout: resourceSecurityConfigurationCreate,
 		ReadWithoutTimeout:   resourceSecurityConfigurationRead,
 		DeleteWithoutTimeout: resourceSecurityConfigurationDelete,
+
 		Importer: &schema.ResourceImporter{
 			StateContext: schema.ImportStatePassthroughContext,
 		},
 
 		Schema: map[string]*schema.Schema{
+			"configuration": {
+				Type:         schema.TypeString,
+				Required:     true,
+				ForceNew:     true,
+				ValidateFunc: validation.StringIsJSON,
+			},
+			"creation_date": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
 			"name": {
 				Type:          schema.TypeString,
 				Optional:      true,
@@ -38,22 +55,11 @@ func ResourceSecurityConfiguration() *schema.Resource {
 			"name_prefix": {
 				Type:          schema.TypeString,
 				Optional:      true,
+				Computed:      true,
 				ForceNew:      true,
 				ConflictsWith: []string{"name"},
 				ValidateFunc:  validation.StringLenBetween(0, 10280-id.UniqueIDSuffixLength),
 			},
-
-			"configuration": {
-				Type:         schema.TypeString,
-				Required:     true,
-				ForceNew:     true,
-				ValidateFunc: validation.StringIsJSON,
-			},
-
-			"creation_date": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
 		},
 	}
 }
@@ -62,27 +68,24 @@ func resourceSecurityConfigurationCreate(ctx context.Context, d *schema.Resource
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).EMRConn(ctx)
 
-	var emrSCName string
-	if v, ok := d.GetOk("name"); ok {
-		emrSCName = v.(string)
-	} else {
-		if v, ok := d.GetOk("name_prefix"); ok {
-			emrSCName = id.PrefixedUniqueId(v.(string))
-		} else {
-			emrSCName = id.PrefixedUniqueId("tf-emr-sc-")
-		}
+	name := create.NewNameGenerator(
+		create.WithConfiguredName(d.Get("name").(string)),
+		create.WithConfiguredPrefix(d.Get("name_prefix").(string)),
+		create.WithDefaultPrefix("tf-emr-sc-"),
+	).Generate()
+	input := &emr.CreateSecurityConfigurationInput{
+		Name:                  aws.String(name),
+		SecurityConfiguration: aws.String(d.Get("configuration").(string)),
 	}
 
-	resp, err := conn.CreateSecurityConfigurationWithContext(ctx, &emr.CreateSecurityConfigurationInput{
-		Name:                  aws.String(emrSCName),
-		SecurityConfiguration: aws.String(d.Get("configuration").(string)),
-	})
+	output, err := conn.CreateSecurityConfigurationWithContext(ctx, input)
 
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "creating EMR Security Configuration (%s): %s", emrSCName, err)
+		return sdkdiag.AppendErrorf(diags, "creating EMR Security Configuration (%s): %s", name, err)
 	}
 
-	d.SetId(aws.StringValue(resp.Name))
+	d.SetId(aws.StringValue(output.Name))
+
 	return append(diags, resourceSecurityConfigurationRead(ctx, d, meta)...)
 }
 
@@ -90,21 +93,22 @@ func resourceSecurityConfigurationRead(ctx context.Context, d *schema.ResourceDa
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).EMRConn(ctx)
 
-	resp, err := conn.DescribeSecurityConfigurationWithContext(ctx, &emr.DescribeSecurityConfigurationInput{
-		Name: aws.String(d.Id()),
-	})
+	output, err := FindSecurityConfigurationByName(ctx, conn, d.Id())
+
+	if !d.IsNewResource() && tfresource.NotFound(err) {
+		log.Printf("[WARN] EMR Security Configuration (%s) not found, removing from state", d.Id())
+		d.SetId("")
+		return diags
+	}
+
 	if err != nil {
-		if tfawserr.ErrMessageContains(err, "InvalidRequestException", "does not exist") {
-			log.Printf("[WARN] EMR Security Configuration (%s) not found, removing from state", d.Id())
-			d.SetId("")
-			return diags
-		}
 		return sdkdiag.AppendErrorf(diags, "reading EMR Security Configuration (%s): %s", d.Id(), err)
 	}
 
-	d.Set("creation_date", aws.TimeValue(resp.CreationDateTime).Format(time.RFC3339))
-	d.Set("name", resp.Name)
-	d.Set("configuration", resp.SecurityConfiguration)
+	d.Set("configuration", output.SecurityConfiguration)
+	d.Set("creation_date", aws.TimeValue(output.CreationDateTime).Format(time.RFC3339))
+	d.Set("name", output.Name)
+	d.Set("name_prefix", create.NamePrefixFromName(aws.StringValue(output.Name)))
 
 	return diags
 }
@@ -113,15 +117,43 @@ func resourceSecurityConfigurationDelete(ctx context.Context, d *schema.Resource
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).EMRConn(ctx)
 
+	log.Printf("[INFO] Deleting EMR Security Configuration: %s", d.Id())
 	_, err := conn.DeleteSecurityConfigurationWithContext(ctx, &emr.DeleteSecurityConfigurationInput{
 		Name: aws.String(d.Id()),
 	})
+
+	if tfawserr.ErrMessageContains(err, emr.ErrCodeInvalidRequestException, "does not exist") {
+		return diags
+	}
+
 	if err != nil {
-		if tfawserr.ErrMessageContains(err, "InvalidRequestException", "does not exist") {
-			return diags
-		}
 		return sdkdiag.AppendErrorf(diags, "deleting EMR Security Configuration (%s): %s", d.Id(), err)
 	}
 
 	return diags
 }
+
+func FindSecurityConfigurationByName(ctx context.Context, conn *emr.EMR, name string) (*emr.DescribeSecurityConfigurationOutput, error) {
+	input := &emr.DescribeSecurityConfigurationInput{
+		Name: aws.String(name),
+	}
+
+	output, err := conn.DescribeSecurityConfigurationWithContext(ctx, input)
+
+	if tfawserr.ErrMessageContains(err, emr.ErrCodeInvalidRequestException, "does not exist") {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	if output == nil {
+		return nil, tfresource.NewEmptyResultError(input)
+	}
+
+	return output, err
+}
diff --git a/internal/service/emr/security_configuration_test.go b/internal/service/emr/security_configuration_test.go
index 39057f91546..9c3207dd6b9 100644
--- a/internal/service/emr/security_configuration_test.go
+++ b/internal/service/emr/security_configuration_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package emr_test
 
 import (
@@ -5,17 +8,19 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/emr"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	tfemr "github.com/hashicorp/terraform-provider-aws/internal/service/emr"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
 func TestAccEMRSecurityConfiguration_basic(t *testing.T) {
 	ctx := acctest.Context(t)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_emr_security_configuration.test"
 
 	resource.ParallelTest(t, resource.TestCase{
@@ -25,10 +30,90 @@ func TestAccEMRSecurityConfiguration_basic(t *testing.T) {
 		CheckDestroy:             testAccCheckSecurityConfigurationDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccSecurityConfigurationConfig_basic,
+				Config: testAccSecurityConfigurationConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckSecurityConfigurationExists(ctx, resourceName),
+					resource.TestCheckResourceAttrSet(resourceName, "configuration"),
 					acctest.CheckResourceAttrRFC3339(resourceName, "creation_date"),
+					resource.TestCheckResourceAttr(resourceName, "name", rName),
+					resource.TestCheckResourceAttr(resourceName, "name_prefix", ""),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
+func TestAccEMRSecurityConfiguration_disappears(t *testing.T) {
+	ctx := acctest.Context(t)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_emr_security_configuration.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, emr.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckSecurityConfigurationDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccSecurityConfigurationConfig_basic(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckSecurityConfigurationExists(ctx, resourceName),
+					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfemr.ResourceSecurityConfiguration(), resourceName),
+				),
+				ExpectNonEmptyPlan: true,
+			},
+		},
+	})
+}
+
+func TestAccEMRSecurityConfiguration_nameGenerated(t *testing.T) {
+	ctx := acctest.Context(t)
+	resourceName := "aws_emr_security_configuration.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, emr.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckSecurityConfigurationDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccSecurityConfigurationConfig_nameGenerated(),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckSecurityConfigurationExists(ctx, resourceName),
+					acctest.CheckResourceAttrNameGeneratedWithPrefix(resourceName, "name", "tf-emr-sc-"),
+					resource.TestCheckResourceAttr(resourceName, "name_prefix", "tf-emr-sc-"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
+func TestAccEMRSecurityConfiguration_namePrefix(t *testing.T) {
+	ctx := acctest.Context(t)
+	resourceName := "aws_emr_security_configuration.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, emr.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckSecurityConfigurationDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccSecurityConfigurationConfig_namePrefix("tf-acc-test-prefix-"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckSecurityConfigurationExists(ctx, resourceName),
+					acctest.CheckResourceAttrNameFromPrefix(resourceName, "name", "tf-acc-test-prefix-"),
+					resource.TestCheckResourceAttr(resourceName, "name_prefix", "tf-acc-test-prefix-"),
 				),
 			},
 			{
@@ -43,29 +128,23 @@ func TestAccEMRSecurityConfiguration_basic(t *testing.T) {
 func testAccCheckSecurityConfigurationDestroy(ctx context.Context) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		conn := acctest.Provider.Meta().(*conns.AWSClient).EMRConn(ctx)
+
 		for _, rs := range s.RootModule().Resources {
 			if rs.Type != "aws_emr_security_configuration" {
 				continue
 			}
 
-			// Try to find the Security Configuration
-			resp, err := conn.DescribeSecurityConfigurationWithContext(ctx, &emr.DescribeSecurityConfigurationInput{
-				Name: aws.String(rs.Primary.ID),
-			})
+			_, err := tfemr.FindSecurityConfigurationByName(ctx, conn, rs.Primary.ID)
 
-			if tfawserr.ErrMessageContains(err, "InvalidRequestException", "does not exist") {
-				return nil
+			if tfresource.NotFound(err) {
+				continue
 			}
 
 			if err != nil {
 				return err
 			}
 
-			if resp != nil && aws.StringValue(resp.Name) == rs.Primary.ID {
-				return fmt.Errorf("Error: EMR Security Configuration still exists: %s", aws.StringValue(resp.Name))
-			}
-
-			return nil
+			return fmt.Errorf("EMR Security Configuration %s still exists", rs.Primary.ID)
 		}
 
 		return nil
@@ -79,35 +158,48 @@ func testAccCheckSecurityConfigurationExists(ctx context.Context, n string) reso
 			return fmt.Errorf("Not found: %s", n)
 		}
 
-		if rs.Primary.ID == "" {
-			return fmt.Errorf("No EMR Security Configuration ID is set")
-		}
-
 		conn := acctest.Provider.Meta().(*conns.AWSClient).EMRConn(ctx)
-		resp, err := conn.DescribeSecurityConfigurationWithContext(ctx, &emr.DescribeSecurityConfigurationInput{
-			Name: aws.String(rs.Primary.ID),
-		})
-		if err != nil {
-			return err
-		}
-
-		if resp.Name == nil {
-			return fmt.Errorf("EMR Security Configuration had nil name which shouldn't happen")
-		}
 
-		if *resp.Name != rs.Primary.ID {
-			return fmt.Errorf("EMR Security Configuration name mismatch, got (%s), expected (%s)", *resp.Name, rs.Primary.ID)
-		}
+		_, err := tfemr.FindSecurityConfigurationByName(ctx, conn, rs.Primary.ID)
 
-		return nil
+		return err
 	}
 }
 
-const testAccSecurityConfigurationConfig_basic = `
+func testAccSecurityConfigurationConfig_basic(rName string) string {
+	return fmt.Sprintf(`
 data "aws_partition" "current" {}
-
 data "aws_region" "current" {}
+data "aws_caller_identity" "current" {}
+
+resource "aws_emr_security_configuration" "test" {
+  name = %[1]q
+
+  configuration = <<EOF
+{
+  "EncryptionConfiguration": {
+    "AtRestEncryptionConfiguration": {
+      "S3EncryptionConfiguration": {
+        "EncryptionMode": "SSE-S3"
+      },
+      "LocalDiskEncryptionConfiguration": {
+        "EncryptionKeyProviderType": "AwsKms",
+        "AwsKmsKey": "arn:${data.aws_partition.current.partition}:kms:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:alias/tf_emr_test_key"
+      }
+    },
+    "EnableInTransitEncryption": false,
+    "EnableAtRestEncryption": true
+  }
+}
+EOF
+}
+`, rName)
+}
 
+func testAccSecurityConfigurationConfig_nameGenerated() string {
+	return `
+data "aws_partition" "current" {}
+data "aws_region" "current" {}
 data "aws_caller_identity" "current" {}
 
 resource "aws_emr_security_configuration" "test" {
@@ -130,3 +222,34 @@ resource "aws_emr_security_configuration" "test" {
 EOF
 }
 `
+}
+
+func testAccSecurityConfigurationConfig_namePrefix(namePrefix string) string {
+	return fmt.Sprintf(`
+data "aws_partition" "current" {}
+data "aws_region" "current" {}
+data "aws_caller_identity" "current" {}
+
+resource "aws_emr_security_configuration" "test" {
+  name_prefix = %[1]q
+
+  configuration = <<EOF
+{
+  "EncryptionConfiguration": {
+    "AtRestEncryptionConfiguration": {
+      "S3EncryptionConfiguration": {
+        "EncryptionMode": "SSE-S3"
+      },
+      "LocalDiskEncryptionConfiguration": {
+        "EncryptionKeyProviderType": "AwsKms",
+        "AwsKmsKey": "arn:${data.aws_partition.current.partition}:kms:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:alias/tf_emr_test_key"
+      }
+    },
+    "EnableInTransitEncryption": false,
+    "EnableAtRestEncryption": true
+  }
+}
+EOF
+}
+`, namePrefix)
+}
diff --git a/internal/service/emr/service_package_gen.go b/internal/service/emr/service_package_gen.go
index 4f32a9edf1b..94d5db4633c 100644
--- a/internal/service/emr/service_package_gen.go
+++ b/internal/service/emr/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	emr_sdkv1 "github.com/aws/aws-sdk-go/service/emr"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -87,4 +88,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*e
 	return emr_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/emr/status.go b/internal/service/emr/status.go
index ef3fb39af26..affeeace57d 100644
--- a/internal/service/emr/status.go
+++ b/internal/service/emr/status.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package emr
 
 import (
diff --git a/internal/service/emr/studio.go b/internal/service/emr/studio.go
index 20af2e21325..a0b8060f439 100644
--- a/internal/service/emr/studio.go
+++ b/internal/service/emr/studio.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package emr
 
 import (
diff --git a/internal/service/emr/studio_session_mapping.go b/internal/service/emr/studio_session_mapping.go
index fbf67d656c3..e7eb05a39f4 100644
--- a/internal/service/emr/studio_session_mapping.go
+++ b/internal/service/emr/studio_session_mapping.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package emr
 
 import (
@@ -67,7 +70,7 @@ func resourceStudioSessionMappingCreate(ctx context.Context, d *schema.ResourceD
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).EMRConn(ctx)
 
-	var id string
+	var idOrName string
 	studioId := d.Get("studio_id").(string)
 	identityType := d.Get("identity_type").(string)
 	input := &emr.CreateStudioSessionMappingInput{
@@ -78,12 +81,12 @@ func resourceStudioSessionMappingCreate(ctx context.Context, d *schema.ResourceD
 
 	if v, ok := d.GetOk("identity_id"); ok {
 		input.IdentityId = aws.String(v.(string))
-		id = v.(string)
+		idOrName = v.(string)
 	}
 
 	if v, ok := d.GetOk("identity_name"); ok {
 		input.IdentityName = aws.String(v.(string))
-		id = v.(string)
+		idOrName = v.(string)
 	}
 
 	_, err := conn.CreateStudioSessionMappingWithContext(ctx, input)
@@ -91,7 +94,7 @@ func resourceStudioSessionMappingCreate(ctx context.Context, d *schema.ResourceD
 		return sdkdiag.AppendErrorf(diags, "creating EMR Studio Session Mapping: %s", err)
 	}
 
-	d.SetId(fmt.Sprintf("%s:%s:%s", studioId, identityType, id))
+	d.SetId(fmt.Sprintf("%s:%s:%s", studioId, identityType, idOrName))
 
 	return append(diags, resourceStudioSessionMappingRead(ctx, d, meta)...)
 }
@@ -100,7 +103,7 @@ func resourceStudioSessionMappingUpdate(ctx context.Context, d *schema.ResourceD
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).EMRConn(ctx)
 
-	studioId, identityType, identityId, err := readStudioSessionMapping(d.Id())
+	studioId, identityType, identityIdOrName, err := readStudioSessionMapping(d.Id())
 	if err != nil {
 		return sdkdiag.AppendErrorf(diags, "updating EMR Studio Session Mapping (%s): %s", d.Id(), err)
 	}
@@ -109,7 +112,12 @@ func resourceStudioSessionMappingUpdate(ctx context.Context, d *schema.ResourceD
 		SessionPolicyArn: aws.String(d.Get("session_policy_arn").(string)),
 		IdentityType:     aws.String(identityType),
 		StudioId:         aws.String(studioId),
-		IdentityId:       aws.String(identityId),
+	}
+
+	if isIdentityId(identityIdOrName) {
+		input.IdentityId = aws.String(identityIdOrName)
+	} else {
+		input.IdentityName = aws.String(identityIdOrName)
 	}
 
 	_, err = conn.UpdateStudioSessionMappingWithContext(ctx, input)
@@ -124,7 +132,7 @@ func resourceStudioSessionMappingRead(ctx context.Context, d *schema.ResourceDat
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).EMRConn(ctx)
 
-	mapping, err := FindStudioSessionMappingByID(ctx, conn, d.Id())
+	mapping, err := FindStudioSessionMappingByIDOrName(ctx, conn, d.Id())
 	if !d.IsNewResource() && tfresource.NotFound(err) {
 		log.Printf("[WARN] EMR Studio Session Mapping (%s) not found, removing from state", d.Id())
 		d.SetId("")
@@ -147,7 +155,8 @@ func resourceStudioSessionMappingRead(ctx context.Context, d *schema.ResourceDat
 func resourceStudioSessionMappingDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).EMRConn(ctx)
-	studioId, identityType, identityId, err := readStudioSessionMapping(d.Id())
+
+	studioId, identityType, identityIdOrName, err := readStudioSessionMapping(d.Id())
 	if err != nil {
 		return sdkdiag.AppendErrorf(diags, "deleting EMR Studio Session Mapping (%s): %s", d.Id(), err)
 	}
@@ -155,7 +164,12 @@ func resourceStudioSessionMappingDelete(ctx context.Context, d *schema.ResourceD
 	input := &emr.DeleteStudioSessionMappingInput{
 		IdentityType: aws.String(identityType),
 		StudioId:     aws.String(studioId),
-		IdentityId:   aws.String(identityId),
+	}
+
+	if isIdentityId(identityIdOrName) {
+		input.IdentityId = aws.String(identityIdOrName)
+	} else {
+		input.IdentityName = aws.String(identityIdOrName)
 	}
 
 	log.Printf("[INFO] Deleting EMR Studio Session Mapping: %s", d.Id())
diff --git a/internal/service/emr/studio_session_mapping_test.go b/internal/service/emr/studio_session_mapping_test.go
index 1c04469934d..070a6da3b1d 100644
--- a/internal/service/emr/studio_session_mapping_test.go
+++ b/internal/service/emr/studio_session_mapping_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package emr_test
 
 import (
@@ -23,11 +26,13 @@ func TestAccEMRStudioSessionMapping_basic(t *testing.T) {
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	updatedName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	uName := os.Getenv("AWS_IDENTITY_STORE_USER_ID")
+	gName := os.Getenv("AWS_IDENTITY_STORE_GROUP_NAME")
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck: func() {
 			acctest.PreCheck(ctx, t)
 			testAccPreCheckUserID(t)
+			testAccPreCheckGroupName(t)
 		},
 		ErrorCheck:               acctest.ErrorCheck(t, emr.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
@@ -43,6 +48,16 @@ func TestAccEMRStudioSessionMapping_basic(t *testing.T) {
 					resource.TestCheckResourceAttrPair(resourceName, "session_policy_arn", "aws_iam_policy.test", "arn"),
 				),
 			},
+			{
+				Config: testAccStudioSessionMappingConfig_basic2(rName, gName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckStudioSessionMappingExists(ctx, resourceName, &studio),
+					resource.TestCheckResourceAttr(resourceName, "identity_name", gName),
+					resource.TestCheckResourceAttr(resourceName, "identity_type", "GROUP"),
+					resource.TestCheckResourceAttrPair(resourceName, "studio_id", "aws_emr_studio.test", "id"),
+					resource.TestCheckResourceAttrPair(resourceName, "session_policy_arn", "aws_iam_policy.test", "arn"),
+				),
+			},
 			{
 				ResourceName:      resourceName,
 				ImportState:       true,
@@ -58,6 +73,16 @@ func TestAccEMRStudioSessionMapping_basic(t *testing.T) {
 					resource.TestCheckResourceAttrPair(resourceName, "session_policy_arn", "aws_iam_policy.test2", "arn"),
 				),
 			},
+			{
+				Config: testAccStudioSessionMappingConfig_updated2(rName, gName, updatedName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckStudioSessionMappingExists(ctx, resourceName, &studio),
+					resource.TestCheckResourceAttr(resourceName, "identity_name", gName),
+					resource.TestCheckResourceAttr(resourceName, "identity_type", "GROUP"),
+					resource.TestCheckResourceAttrPair(resourceName, "studio_id", "aws_emr_studio.test", "id"),
+					resource.TestCheckResourceAttrPair(resourceName, "session_policy_arn", "aws_iam_policy.test2", "arn"),
+				),
+			},
 		},
 	})
 }
@@ -68,11 +93,13 @@ func TestAccEMRStudioSessionMapping_disappears(t *testing.T) {
 	resourceName := "aws_emr_studio_session_mapping.test"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	uName := os.Getenv("AWS_IDENTITY_STORE_USER_ID")
+	gName := os.Getenv("AWS_IDENTITY_STORE_GROUP_NAME")
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck: func() {
 			acctest.PreCheck(ctx, t)
 			testAccPreCheckUserID(t)
+			testAccPreCheckGroupName(t)
 		},
 		ErrorCheck:               acctest.ErrorCheck(t, emr.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
@@ -87,6 +114,15 @@ func TestAccEMRStudioSessionMapping_disappears(t *testing.T) {
 				),
 				ExpectNonEmptyPlan: true,
 			},
+			{
+				Config: testAccStudioSessionMappingConfig_basic2(rName, gName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckStudioSessionMappingExists(ctx, resourceName, &studio),
+					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfemr.ResourceStudioSessionMapping(), resourceName),
+					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfemr.ResourceStudioSessionMapping(), resourceName),
+				),
+				ExpectNonEmptyPlan: true,
+			},
 		},
 	})
 }
@@ -100,7 +136,7 @@ func testAccCheckStudioSessionMappingExists(ctx context.Context, resourceName st
 
 		conn := acctest.Provider.Meta().(*conns.AWSClient).EMRConn(ctx)
 
-		output, err := tfemr.FindStudioSessionMappingByID(ctx, conn, rs.Primary.ID)
+		output, err := tfemr.FindStudioSessionMappingByIDOrName(ctx, conn, rs.Primary.ID)
 		if err != nil {
 			return err
 		}
@@ -124,7 +160,7 @@ func testAccCheckStudioSessionMappingDestroy(ctx context.Context) resource.TestC
 				continue
 			}
 
-			_, err := tfemr.FindStudioSessionMappingByID(ctx, conn, rs.Primary.ID)
+			_, err := tfemr.FindStudioSessionMappingByIDOrName(ctx, conn, rs.Primary.ID)
 			if tfresource.NotFound(err) {
 				continue
 			}
@@ -146,6 +182,13 @@ func testAccPreCheckUserID(t *testing.T) {
 	}
 }
 
+func testAccPreCheckGroupName(t *testing.T) {
+	if os.Getenv("AWS_IDENTITY_STORE_GROUP_NAME") == "" {
+		t.Skip("AWS_IDENTITY_STORE_GROUP_NAME env var must be set for AWS Identity Store Group acceptance test. " +
+			"This is required until ListGroups API returns results without filtering by name.")
+	}
+}
+
 func testAccStudioSessionMappingConfigBase(rName string) string {
 	return acctest.ConfigCompose(acctest.ConfigAvailableAZsNoOptIn(), fmt.Sprintf(`
 data "aws_partition" "current" {}
@@ -165,11 +208,6 @@ resource "aws_s3_bucket" "test" {
   force_destroy = true
 }
 
-resource "aws_s3_bucket_acl" "test" {
-  bucket = aws_s3_bucket.test.id
-  acl    = "private"
-}
-
 resource "aws_iam_role" "test" {
   name               = %[1]q
   path               = "/"
@@ -261,6 +299,17 @@ resource "aws_emr_studio_session_mapping" "test" {
 `, uName))
 }
 
+func testAccStudioSessionMappingConfig_basic2(rName, gName string) string {
+	return acctest.ConfigCompose(testAccStudioSessionMappingConfigBase(rName), fmt.Sprintf(`
+resource "aws_emr_studio_session_mapping" "test" {
+  studio_id          = aws_emr_studio.test.id
+  identity_type      = "GROUP"
+  identity_name      = %[1]q
+  session_policy_arn = aws_iam_policy.test.arn
+}
+`, gName))
+}
+
 func testAccStudioSessionMappingConfig_updated(rName, uName, updatedName string) string {
 	return acctest.ConfigCompose(testAccStudioSessionMappingConfigBase(rName), fmt.Sprintf(`
 resource "aws_iam_policy" "test2" {
@@ -292,3 +341,35 @@ resource "aws_emr_studio_session_mapping" "test" {
 }
 `, uName, updatedName))
 }
+
+func testAccStudioSessionMappingConfig_updated2(rName, gName, updatedName string) string {
+	return acctest.ConfigCompose(testAccStudioSessionMappingConfigBase(rName), fmt.Sprintf(`
+resource "aws_iam_policy" "test2" {
+  name   = %[2]q
+  policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Action": [
+        "s3:*"
+      ],
+      "Resource": [
+        "${aws_s3_bucket.test.arn}/*",
+		"${aws_s3_bucket.test.arn}"
+      ]
+    }
+  ]
+}
+EOF
+}
+
+resource "aws_emr_studio_session_mapping" "test" {
+  studio_id          = aws_emr_studio.test.id
+  identity_type      = "GROUP"
+  identity_name      = %[1]q
+  session_policy_arn = aws_iam_policy.test2.arn
+}
+`, gName, updatedName))
+}
diff --git a/internal/service/emr/studio_test.go b/internal/service/emr/studio_test.go
index bb54f0c0563..6fa66557dee 100644
--- a/internal/service/emr/studio_test.go
+++ b/internal/service/emr/studio_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package emr_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/emr"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -33,7 +36,7 @@ func TestAccEMRStudio_sso(t *testing.T) {
 				Config: testAccStudioConfig_sso(rName1, rName1),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckStudioExists(ctx, resourceName, &studio),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elasticmapreduce", regexp.MustCompile(`studio/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elasticmapreduce", regexache.MustCompile(`studio/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "name", rName1),
 					resource.TestCheckResourceAttr(resourceName, "auth_mode", "SSO"),
 					resource.TestCheckResourceAttrSet(resourceName, "url"),
@@ -55,7 +58,7 @@ func TestAccEMRStudio_sso(t *testing.T) {
 				Config: testAccStudioConfig_sso(rName1, rName2),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckStudioExists(ctx, resourceName, &studio),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elasticmapreduce", regexp.MustCompile(`studio/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "elasticmapreduce", regexache.MustCompile(`studio/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "name", rName2),
 					resource.TestCheckResourceAttr(resourceName, "auth_mode", "SSO"),
 					resource.TestCheckResourceAttrSet(resourceName, "url"),
diff --git a/internal/service/emr/sweep.go b/internal/service/emr/sweep.go
index a983474abb7..fe2f7c2758f 100644
--- a/internal/service/emr/sweep.go
+++ b/internal/service/emr/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package emr
 
@@ -12,9 +12,10 @@ import (
 	"github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_emr_cluster", &resource.Sweeper{
 		Name: "aws_emr_cluster",
 		F:    sweepClusters,
@@ -28,7 +29,7 @@ func init() {
 
 func sweepClusters(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
@@ -65,7 +66,7 @@ func sweepClusters(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping EMR Clusters sweep for %s: %s", region, err)
 		return nil
 	}
@@ -74,7 +75,7 @@ func sweepClusters(region string) error {
 		return fmt.Errorf("error listing EMR Clusters (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping EMR Clusters (%s): %w", region, err)
@@ -85,7 +86,7 @@ func sweepClusters(region string) error {
 
 func sweepStudios(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
@@ -112,7 +113,7 @@ func sweepStudios(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping EMR Studios sweep for %s: %s", region, sweeperErrs)
 		return nil
 	}
@@ -120,7 +121,7 @@ func sweepStudios(region string) error {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error listing EMR Studios for %s: %w", region, err))
 	}
 
-	if err = sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err = sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error sweeping EMR Studios for %s: %w", region, err))
 	}
 
diff --git a/internal/service/emr/tags_gen.go b/internal/service/emr/tags_gen.go
index c3194900d4f..76d694046bf 100644
--- a/internal/service/emr/tags_gen.go
+++ b/internal/service/emr/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/emr"
 	"github.com/aws/aws-sdk-go/service/emr/emriface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -69,6 +71,8 @@ func updateTags(ctx context.Context, conn emriface.EMRAPI, identifier string, ol
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.EMR)
 	if len(removedTags) > 0 {
diff --git a/internal/service/emr/validate.go b/internal/service/emr/validate.go
index e8a2c23307b..8e0e4fd979a 100644
--- a/internal/service/emr/validate.go
+++ b/internal/service/emr/validate.go
@@ -1,9 +1,12 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package emr
 
 import (
 	"fmt"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 )
@@ -14,9 +17,9 @@ func validCustomAMIID(v interface{}, k string) (ws []string, errors []error) {
 		errors = append(errors, fmt.Errorf("%q cannot be longer than 256 characters", k))
 	}
 
-	if !regexp.MustCompile(`^ami\-[a-z0-9]+$`).MatchString(value) {
+	if !regexache.MustCompile(`^ami\-[0-9a-z]+$`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
-			"%q must begin with 'ami-' and be comprised of only [a-z0-9]: %v", k, value))
+			"%q must begin with 'ami-' and be comprised of only [0-9a-z]: %v", k, value))
 	}
 
 	return
diff --git a/internal/service/emr/validate_test.go b/internal/service/emr/validate_test.go
index d05482f7032..037a5216e20 100644
--- a/internal/service/emr/validate_test.go
+++ b/internal/service/emr/validate_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package emr
 
 import (
diff --git a/internal/service/emr/wait.go b/internal/service/emr/wait.go
index 5d3ed38ec65..84e7c0f6e65 100644
--- a/internal/service/emr/wait.go
+++ b/internal/service/emr/wait.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package emr
 
 import (
diff --git a/internal/service/emrcontainers/generate.go b/internal/service/emrcontainers/generate.go
index 831ed32fbbc..3a048572da2 100644
--- a/internal/service/emrcontainers/generate.go
+++ b/internal/service/emrcontainers/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTags -ServiceTagsMap -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/emrcontainers/job_template.go b/internal/service/emrcontainers/job_template.go
index 0b12d7a5f22..62888b45c92 100644
--- a/internal/service/emrcontainers/job_template.go
+++ b/internal/service/emrcontainers/job_template.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package emrcontainers
 
 import (
 	"context"
 	"log"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/emrcontainers"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -242,7 +245,7 @@ func ResourceJobTemplate() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 64),
-					validation.StringMatch(regexp.MustCompile(`[.\-_/#A-Za-z0-9]+`), "must contain only alphanumeric, hyphen, underscore, dot and # characters"),
+					validation.StringMatch(regexache.MustCompile(`[0-9A-Za-z_./#-]+`), "must contain only alphanumeric, hyphen, underscore, dot and # characters"),
 				),
 			},
 			names.AttrTags:    tftags.TagsSchemaForceNew(),
diff --git a/internal/service/emrcontainers/job_template_test.go b/internal/service/emrcontainers/job_template_test.go
index 95c294bd0a4..37dac806589 100644
--- a/internal/service/emrcontainers/job_template_test.go
+++ b/internal/service/emrcontainers/job_template_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package emrcontainers_test
 
 import (
diff --git a/internal/service/emrcontainers/service_package_gen.go b/internal/service/emrcontainers/service_package_gen.go
index ae5d3579e84..20072a6650a 100644
--- a/internal/service/emrcontainers/service_package_gen.go
+++ b/internal/service/emrcontainers/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	emrcontainers_sdkv1 "github.com/aws/aws-sdk-go/service/emrcontainers"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -63,4 +64,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*e
 	return emrcontainers_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/emrcontainers/sweep.go b/internal/service/emrcontainers/sweep.go
index 57b388846b4..a355f85f0f8 100644
--- a/internal/service/emrcontainers/sweep.go
+++ b/internal/service/emrcontainers/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package emrcontainers
 
@@ -11,9 +11,10 @@ import (
 	"github.com/aws/aws-sdk-go/service/emrcontainers"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_emrcontainers_virtual_cluster", &resource.Sweeper{
 		Name: "aws_emrcontainers_virtual_cluster",
 		F:    sweepVirtualClusters,
@@ -27,7 +28,7 @@ func init() {
 
 func sweepVirtualClusters(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -55,7 +56,7 @@ func sweepVirtualClusters(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping EMR Containers Virtual Cluster sweep for %s: %s", region, err)
 		return nil
 	}
@@ -64,7 +65,7 @@ func sweepVirtualClusters(region string) error {
 		return fmt.Errorf("error listing EMR Containers Virtual Clusters (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping EMR Containers Virtual Clusters (%s): %w", region, err)
@@ -75,7 +76,7 @@ func sweepVirtualClusters(region string) error {
 
 func sweepJobTemplates(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -99,7 +100,7 @@ func sweepJobTemplates(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping EMR Containers Job Template sweep for %s: %s", region, err)
 		return nil
 	}
@@ -108,7 +109,7 @@ func sweepJobTemplates(region string) error {
 		return fmt.Errorf("error listing EMR Containers Job Templates (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping EMR Containers Job Templates (%s): %w", region, err)
diff --git a/internal/service/emrcontainers/tags_gen.go b/internal/service/emrcontainers/tags_gen.go
index 5e1fc338581..28781419c8a 100644
--- a/internal/service/emrcontainers/tags_gen.go
+++ b/internal/service/emrcontainers/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/emrcontainers"
 	"github.com/aws/aws-sdk-go/service/emrcontainers/emrcontainersiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -54,7 +56,7 @@ func Tags(tags tftags.KeyValueTags) map[string]*string {
 	return aws.StringMap(tags.Map())
 }
 
-// KeyValueTags creates KeyValueTags from emrcontainers service tags.
+// KeyValueTags creates tftags.KeyValueTags from emrcontainers service tags.
 func KeyValueTags(ctx context.Context, tags map[string]*string) tftags.KeyValueTags {
 	return tftags.New(ctx, tags)
 }
@@ -85,6 +87,8 @@ func updateTags(ctx context.Context, conn emrcontainersiface.EMRContainersAPI, i
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.EMRContainers)
 	if len(removedTags) > 0 {
diff --git a/internal/service/emrcontainers/virtual_cluster.go b/internal/service/emrcontainers/virtual_cluster.go
index fd7abc15f6d..057c7aab5c9 100644
--- a/internal/service/emrcontainers/virtual_cluster.go
+++ b/internal/service/emrcontainers/virtual_cluster.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package emrcontainers
 
 import (
 	"context"
 	"log"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/emrcontainers"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -96,7 +99,7 @@ func ResourceVirtualCluster() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 64),
-					validation.StringMatch(regexp.MustCompile(`[.\-_/#A-Za-z0-9]+`), "must contain only alphanumeric, hyphen, underscore, dot and # characters"),
+					validation.StringMatch(regexache.MustCompile(`[0-9A-Za-z_./#-]+`), "must contain only alphanumeric, hyphen, underscore, dot and # characters"),
 				),
 			},
 			names.AttrTags:    tftags.TagsSchema(),
diff --git a/internal/service/emrcontainers/virtual_cluster_data_source.go b/internal/service/emrcontainers/virtual_cluster_data_source.go
index 0d5352468c2..28fe524817a 100644
--- a/internal/service/emrcontainers/virtual_cluster_data_source.go
+++ b/internal/service/emrcontainers/virtual_cluster_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package emrcontainers
 
 import (
diff --git a/internal/service/emrcontainers/virtual_cluster_data_source_test.go b/internal/service/emrcontainers/virtual_cluster_data_source_test.go
index 0f1a38bacb1..f0e4e96fb4e 100644
--- a/internal/service/emrcontainers/virtual_cluster_data_source_test.go
+++ b/internal/service/emrcontainers/virtual_cluster_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package emrcontainers_test
 
 import (
diff --git a/internal/service/emrcontainers/virtual_cluster_test.go b/internal/service/emrcontainers/virtual_cluster_test.go
index c543bdfda94..c070a77079d 100644
--- a/internal/service/emrcontainers/virtual_cluster_test.go
+++ b/internal/service/emrcontainers/virtual_cluster_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package emrcontainers_test
 
 import (
diff --git a/internal/service/emrserverless/application.go b/internal/service/emrserverless/application.go
index eb44a2e3f75..0ad248eec09 100644
--- a/internal/service/emrserverless/application.go
+++ b/internal/service/emrserverless/application.go
@@ -1,18 +1,26 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package emrserverless
 
 import (
 	"context"
+	"errors"
 	"log"
 	"strings"
+	"time"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/emrserverless"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/emrserverless"
+	"github.com/aws/aws-sdk-go-v2/service/emrserverless/types"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/enum"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
 	"github.com/hashicorp/terraform-provider-aws/internal/flex"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
@@ -23,12 +31,13 @@ import (
 
 // @SDKResource("aws_emrserverless_application", name="Application")
 // @Tags(identifierAttribute="arn")
-func ResourceApplication() *schema.Resource {
+func resourceApplication() *schema.Resource {
 	return &schema.Resource{
 		CreateWithoutTimeout: resourceApplicationCreate,
 		ReadWithoutTimeout:   resourceApplicationRead,
 		UpdateWithoutTimeout: resourceApplicationUpdate,
 		DeleteWithoutTimeout: resourceApplicationDelete,
+
 		Importer: &schema.ResourceImporter{
 			StateContext: schema.ImportStatePassthroughContext,
 		},
@@ -37,10 +46,10 @@ func ResourceApplication() *schema.Resource {
 
 		Schema: map[string]*schema.Schema{
 			"architecture": {
-				Type:         schema.TypeString,
-				Optional:     true,
-				Default:      emrserverless.ArchitectureX8664,
-				ValidateFunc: validation.StringInSlice(emrserverless.Architecture_Values(), false),
+				Type:             schema.TypeString,
+				Optional:         true,
+				Default:          types.ArchitectureX8664,
+				ValidateDiagFunc: enum.Validate[types.Architecture](),
 			},
 			"arn": {
 				Type:     schema.TypeString,
@@ -201,7 +210,6 @@ func ResourceApplication() *schema.Resource {
 			"release_label": {
 				Type:     schema.TypeString,
 				Required: true,
-				ForceNew: true,
 			},
 			names.AttrTags:    tftags.TagsSchema(),
 			names.AttrTagsAll: tftags.TagsSchemaComputed(),
@@ -219,7 +227,7 @@ func ResourceApplication() *schema.Resource {
 
 func resourceApplicationCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).EMRServerlessConn(ctx)
+	conn := meta.(*conns.AWSClient).EMRServerlessClient(ctx)
 
 	name := d.Get("name").(string)
 	input := &emrserverless.CreateApplicationInput{
@@ -231,7 +239,7 @@ func resourceApplicationCreate(ctx context.Context, d *schema.ResourceData, meta
 	}
 
 	if v, ok := d.GetOk("architecture"); ok {
-		input.Architecture = aws.String(v.(string))
+		input.Architecture = types.Architecture(v.(string))
 	}
 
 	if v, ok := d.GetOk("auto_start_configuration"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
@@ -258,13 +266,13 @@ func resourceApplicationCreate(ctx context.Context, d *schema.ResourceData, meta
 		input.NetworkConfiguration = expandNetworkConfiguration(v.([]interface{})[0].(map[string]interface{}))
 	}
 
-	result, err := conn.CreateApplicationWithContext(ctx, input)
+	output, err := conn.CreateApplication(ctx, input)
 
 	if err != nil {
 		return sdkdiag.AppendErrorf(diags, "creating EMR Serveless Application (%s): %s", name, err)
 	}
 
-	d.SetId(aws.StringValue(result.ApplicationId))
+	d.SetId(aws.ToString(output.ApplicationId))
 
 	if _, err := waitApplicationCreated(ctx, conn, d.Id()); err != nil {
 		return sdkdiag.AppendErrorf(diags, "waiting for EMR Serveless Application (%s) create: %s", d.Id(), err)
@@ -275,9 +283,9 @@ func resourceApplicationCreate(ctx context.Context, d *schema.ResourceData, meta
 
 func resourceApplicationRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).EMRServerlessConn(ctx)
+	conn := meta.(*conns.AWSClient).EMRServerlessClient(ctx)
 
-	application, err := FindApplicationByID(ctx, conn, d.Id())
+	application, err := findApplicationByID(ctx, conn, d.Id())
 
 	if !d.IsNewResource() && tfresource.NotFound(err) {
 		log.Printf("[WARN] EMR Serverless Application (%s) not found, removing from state", d.Id())
@@ -293,7 +301,7 @@ func resourceApplicationRead(ctx context.Context, d *schema.ResourceData, meta i
 	d.Set("arn", application.Arn)
 	d.Set("name", application.Name)
 	d.Set("release_label", application.ReleaseLabel)
-	d.Set("type", strings.ToLower(aws.StringValue(application.Type)))
+	d.Set("type", strings.ToLower(aws.ToString(application.Type)))
 
 	if err := d.Set("auto_start_configuration", []interface{}{flattenAutoStartConfig(application.AutoStartConfiguration)}); err != nil {
 		return sdkdiag.AppendErrorf(diags, "setting auto_start_configuration: %s", err)
@@ -326,7 +334,7 @@ func resourceApplicationRead(ctx context.Context, d *schema.ResourceData, meta i
 
 func resourceApplicationUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).EMRServerlessConn(ctx)
+	conn := meta.(*conns.AWSClient).EMRServerlessClient(ctx)
 
 	if d.HasChangesExcept("tags", "tags_all") {
 		input := &emrserverless.UpdateApplicationInput{
@@ -335,7 +343,7 @@ func resourceApplicationUpdate(ctx context.Context, d *schema.ResourceData, meta
 		}
 
 		if v, ok := d.GetOk("architecture"); ok {
-			input.Architecture = aws.String(v.(string))
+			input.Architecture = types.Architecture(v.(string))
 		}
 
 		if v, ok := d.GetOk("auto_start_configuration"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
@@ -362,8 +370,11 @@ func resourceApplicationUpdate(ctx context.Context, d *schema.ResourceData, meta
 			input.NetworkConfiguration = expandNetworkConfiguration(v.([]interface{})[0].(map[string]interface{}))
 		}
 
-		log.Printf("[DEBUG] Updating EMR Serveless Application: %s", input)
-		_, err := conn.UpdateApplicationWithContext(ctx, input)
+		if v, ok := d.GetOk("release_label"); ok {
+			input.ReleaseLabel = aws.String(v.(string))
+		}
+
+		_, err := conn.UpdateApplication(ctx, input)
 
 		if err != nil {
 			return sdkdiag.AppendErrorf(diags, "updating EMR Serveless Application (%s): %s", d.Id(), err)
@@ -375,14 +386,14 @@ func resourceApplicationUpdate(ctx context.Context, d *schema.ResourceData, meta
 
 func resourceApplicationDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).EMRServerlessConn(ctx)
+	conn := meta.(*conns.AWSClient).EMRServerlessClient(ctx)
 
 	log.Printf("[INFO] Deleting EMR Serverless Application: %s", d.Id())
-	_, err := conn.DeleteApplicationWithContext(ctx, &emrserverless.DeleteApplicationInput{
+	_, err := conn.DeleteApplication(ctx, &emrserverless.DeleteApplicationInput{
 		ApplicationId: aws.String(d.Id()),
 	})
 
-	if tfawserr.ErrCodeEquals(err, emrserverless.ErrCodeResourceNotFoundException) {
+	if errs.IsA[*types.ResourceNotFoundException](err) {
 		return diags
 	}
 
@@ -397,12 +408,113 @@ func resourceApplicationDelete(ctx context.Context, d *schema.ResourceData, meta
 	return diags
 }
 
-func expandAutoStartConfig(tfMap map[string]interface{}) *emrserverless.AutoStartConfig {
+func findApplicationByID(ctx context.Context, conn *emrserverless.Client, id string) (*types.Application, error) {
+	input := &emrserverless.GetApplicationInput{
+		ApplicationId: aws.String(id),
+	}
+
+	output, err := conn.GetApplication(ctx, input)
+
+	if errs.IsA[*types.ResourceNotFoundException](err) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	if output == nil || output.Application == nil {
+		return nil, tfresource.NewEmptyResultError(input)
+	}
+
+	if output.Application.State == types.ApplicationStateTerminated {
+		return nil, tfresource.NewEmptyResultError(input)
+	}
+
+	return output.Application, nil
+}
+
+func statusApplication(ctx context.Context, conn *emrserverless.Client, id string) retry.StateRefreshFunc {
+	return func() (interface{}, string, error) {
+		output, err := findApplicationByID(ctx, conn, id)
+
+		if tfresource.NotFound(err) {
+			return nil, "", nil
+		}
+
+		if err != nil {
+			return nil, "", err
+		}
+
+		return output, string(output.State), nil
+	}
+}
+
+func waitApplicationCreated(ctx context.Context, conn *emrserverless.Client, id string) (*types.Application, error) {
+	const (
+		timeout    = 75 * time.Minute
+		minTimeout = 10 * time.Second
+		delay      = 30 * time.Second
+	)
+	stateConf := &retry.StateChangeConf{
+		Pending:    enum.Slice(types.ApplicationStateCreating),
+		Target:     enum.Slice(types.ApplicationStateCreated),
+		Refresh:    statusApplication(ctx, conn, id),
+		Timeout:    timeout,
+		MinTimeout: minTimeout,
+		Delay:      delay,
+	}
+
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+
+	if output, ok := outputRaw.(*types.Application); ok {
+		if stateChangeReason := output.StateDetails; stateChangeReason != nil {
+			tfresource.SetLastError(err, errors.New(aws.ToString(stateChangeReason)))
+		}
+
+		return output, err
+	}
+
+	return nil, err
+}
+
+func waitApplicationTerminated(ctx context.Context, conn *emrserverless.Client, id string) (*types.Application, error) {
+	const (
+		timeout    = 20 * time.Minute
+		minTimeout = 10 * time.Second
+		delay      = 30 * time.Second
+	)
+	stateConf := &retry.StateChangeConf{
+		Pending:    enum.Values[types.ApplicationState](),
+		Target:     []string{},
+		Refresh:    statusApplication(ctx, conn, id),
+		Timeout:    timeout,
+		MinTimeout: minTimeout,
+		Delay:      delay,
+	}
+
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+
+	if output, ok := outputRaw.(*types.Application); ok {
+		if stateChangeReason := output.StateDetails; stateChangeReason != nil {
+			tfresource.SetLastError(err, errors.New(aws.ToString(stateChangeReason)))
+		}
+
+		return output, err
+	}
+
+	return nil, err
+}
+
+func expandAutoStartConfig(tfMap map[string]interface{}) *types.AutoStartConfig {
 	if tfMap == nil {
 		return nil
 	}
 
-	apiObject := &emrserverless.AutoStartConfig{}
+	apiObject := &types.AutoStartConfig{}
 
 	if v, ok := tfMap["enabled"].(bool); ok {
 		apiObject.Enabled = aws.Bool(v)
@@ -411,7 +523,7 @@ func expandAutoStartConfig(tfMap map[string]interface{}) *emrserverless.AutoStar
 	return apiObject
 }
 
-func flattenAutoStartConfig(apiObject *emrserverless.AutoStartConfig) map[string]interface{} {
+func flattenAutoStartConfig(apiObject *types.AutoStartConfig) map[string]interface{} {
 	if apiObject == nil {
 		return nil
 	}
@@ -419,31 +531,31 @@ func flattenAutoStartConfig(apiObject *emrserverless.AutoStartConfig) map[string
 	tfMap := map[string]interface{}{}
 
 	if v := apiObject.Enabled; v != nil {
-		tfMap["enabled"] = aws.BoolValue(v)
+		tfMap["enabled"] = aws.ToBool(v)
 	}
 
 	return tfMap
 }
 
-func expandAutoStopConfig(tfMap map[string]interface{}) *emrserverless.AutoStopConfig {
+func expandAutoStopConfig(tfMap map[string]interface{}) *types.AutoStopConfig {
 	if tfMap == nil {
 		return nil
 	}
 
-	apiObject := &emrserverless.AutoStopConfig{}
+	apiObject := &types.AutoStopConfig{}
 
 	if v, ok := tfMap["enabled"].(bool); ok {
 		apiObject.Enabled = aws.Bool(v)
 	}
 
 	if v, ok := tfMap["idle_timeout_minutes"].(int); ok {
-		apiObject.IdleTimeoutMinutes = aws.Int64(int64(v))
+		apiObject.IdleTimeoutMinutes = aws.Int32(int32(v))
 	}
 
 	return apiObject
 }
 
-func flattenAutoStopConfig(apiObject *emrserverless.AutoStopConfig) map[string]interface{} {
+func flattenAutoStopConfig(apiObject *types.AutoStopConfig) map[string]interface{} {
 	if apiObject == nil {
 		return nil
 	}
@@ -451,22 +563,22 @@ func flattenAutoStopConfig(apiObject *emrserverless.AutoStopConfig) map[string]i
 	tfMap := map[string]interface{}{}
 
 	if v := apiObject.Enabled; v != nil {
-		tfMap["enabled"] = aws.BoolValue(v)
+		tfMap["enabled"] = aws.ToBool(v)
 	}
 
 	if v := apiObject.IdleTimeoutMinutes; v != nil {
-		tfMap["idle_timeout_minutes"] = aws.Int64Value(v)
+		tfMap["idle_timeout_minutes"] = aws.ToInt32(v)
 	}
 
 	return tfMap
 }
 
-func expandMaximumCapacity(tfMap map[string]interface{}) *emrserverless.MaximumAllowedResources {
+func expandMaximumCapacity(tfMap map[string]interface{}) *types.MaximumAllowedResources {
 	if tfMap == nil {
 		return nil
 	}
 
-	apiObject := &emrserverless.MaximumAllowedResources{}
+	apiObject := &types.MaximumAllowedResources{}
 
 	if v, ok := tfMap["cpu"].(string); ok && v != "" {
 		apiObject.Cpu = aws.String(v)
@@ -483,7 +595,7 @@ func expandMaximumCapacity(tfMap map[string]interface{}) *emrserverless.MaximumA
 	return apiObject
 }
 
-func flattenMaximumCapacity(apiObject *emrserverless.MaximumAllowedResources) map[string]interface{} {
+func flattenMaximumCapacity(apiObject *types.MaximumAllowedResources) map[string]interface{} {
 	if apiObject == nil {
 		return nil
 	}
@@ -491,39 +603,39 @@ func flattenMaximumCapacity(apiObject *emrserverless.MaximumAllowedResources) ma
 	tfMap := map[string]interface{}{}
 
 	if v := apiObject.Cpu; v != nil {
-		tfMap["cpu"] = aws.StringValue(v)
+		tfMap["cpu"] = aws.ToString(v)
 	}
 
 	if v := apiObject.Disk; v != nil {
-		tfMap["disk"] = aws.StringValue(v)
+		tfMap["disk"] = aws.ToString(v)
 	}
 
 	if v := apiObject.Memory; v != nil {
-		tfMap["memory"] = aws.StringValue(v)
+		tfMap["memory"] = aws.ToString(v)
 	}
 
 	return tfMap
 }
 
-func expandNetworkConfiguration(tfMap map[string]interface{}) *emrserverless.NetworkConfiguration {
+func expandNetworkConfiguration(tfMap map[string]interface{}) *types.NetworkConfiguration {
 	if tfMap == nil {
 		return nil
 	}
 
-	apiObject := &emrserverless.NetworkConfiguration{}
+	apiObject := &types.NetworkConfiguration{}
 
 	if v, ok := tfMap["security_group_ids"].(*schema.Set); ok && v.Len() > 0 {
-		apiObject.SecurityGroupIds = flex.ExpandStringSet(v)
+		apiObject.SecurityGroupIds = flex.ExpandStringValueSet(v)
 	}
 
 	if v, ok := tfMap["subnet_ids"].(*schema.Set); ok && v.Len() > 0 {
-		apiObject.SubnetIds = flex.ExpandStringSet(v)
+		apiObject.SubnetIds = flex.ExpandStringValueSet(v)
 	}
 
 	return apiObject
 }
 
-func flattenNetworkConfiguration(apiObject *emrserverless.NetworkConfiguration) map[string]interface{} {
+func flattenNetworkConfiguration(apiObject *types.NetworkConfiguration) map[string]interface{} {
 	if apiObject == nil {
 		return nil
 	}
@@ -531,22 +643,22 @@ func flattenNetworkConfiguration(apiObject *emrserverless.NetworkConfiguration)
 	tfMap := map[string]interface{}{}
 
 	if v := apiObject.SecurityGroupIds; v != nil {
-		tfMap["security_group_ids"] = flex.FlattenStringSet(v)
+		tfMap["security_group_ids"] = flex.FlattenStringValueSet(v)
 	}
 
 	if v := apiObject.SubnetIds; v != nil {
-		tfMap["subnet_ids"] = flex.FlattenStringSet(v)
+		tfMap["subnet_ids"] = flex.FlattenStringValueSet(v)
 	}
 
 	return tfMap
 }
 
-func expandImageConfiguration(tfMap map[string]interface{}) *emrserverless.ImageConfigurationInput_ {
+func expandImageConfiguration(tfMap map[string]interface{}) *types.ImageConfigurationInput {
 	if tfMap == nil {
 		return nil
 	}
 
-	apiObject := &emrserverless.ImageConfigurationInput_{}
+	apiObject := &types.ImageConfigurationInput{}
 
 	if v, ok := tfMap["image_uri"].(string); ok && v != "" {
 		apiObject.ImageUri = aws.String(v)
@@ -555,7 +667,7 @@ func expandImageConfiguration(tfMap map[string]interface{}) *emrserverless.Image
 	return apiObject
 }
 
-func flattenImageConfiguration(apiObject *emrserverless.ImageConfiguration) []interface{} {
+func flattenImageConfiguration(apiObject *types.ImageConfiguration) []interface{} {
 	if apiObject == nil || apiObject.ImageUri == nil {
 		return nil
 	}
@@ -564,19 +676,19 @@ func flattenImageConfiguration(apiObject *emrserverless.ImageConfiguration) []in
 
 	if v := apiObject.ImageUri; v != nil {
 		tfList = append(tfList, map[string]interface{}{
-			"image_uri": aws.StringValue(v),
+			"image_uri": aws.ToString(v),
 		})
 	}
 
 	return tfList
 }
 
-func expandInitialCapacity(tfMap *schema.Set) map[string]*emrserverless.InitialCapacityConfig {
+func expandInitialCapacity(tfMap *schema.Set) map[string]types.InitialCapacityConfig {
 	if tfMap == nil {
 		return nil
 	}
 
-	configs := make(map[string]*emrserverless.InitialCapacityConfig)
+	configs := make(map[string]types.InitialCapacityConfig)
 
 	for _, tfMapRaw := range tfMap.List() {
 		config, ok := tfMapRaw.(map[string]interface{})
@@ -595,7 +707,7 @@ func expandInitialCapacity(tfMap *schema.Set) map[string]*emrserverless.InitialC
 	return configs
 }
 
-func flattenInitialCapacity(apiObject map[string]*emrserverless.InitialCapacityConfig) []interface{} {
+func flattenInitialCapacity(apiObject map[string]types.InitialCapacityConfig) []interface{} {
 	if apiObject == nil {
 		return nil
 	}
@@ -603,28 +715,20 @@ func flattenInitialCapacity(apiObject map[string]*emrserverless.InitialCapacityC
 	var tfList []interface{}
 
 	for capacityType, config := range apiObject {
-		if config == nil {
-			continue
-		}
-
 		tfList = append(tfList, map[string]interface{}{
 			"initial_capacity_type":   capacityType,
-			"initial_capacity_config": []interface{}{flattenInitialCapacityConfig(config)},
+			"initial_capacity_config": []interface{}{flattenInitialCapacityConfig(&config)},
 		})
 	}
 
 	return tfList
 }
 
-func expandInitialCapacityConfig(tfMap map[string]interface{}) *emrserverless.InitialCapacityConfig {
-	if tfMap == nil {
-		return nil
-	}
-
-	apiObject := &emrserverless.InitialCapacityConfig{}
+func expandInitialCapacityConfig(tfMap map[string]interface{}) types.InitialCapacityConfig {
+	apiObject := types.InitialCapacityConfig{}
 
 	if v, ok := tfMap["worker_count"].(int); ok {
-		apiObject.WorkerCount = aws.Int64(int64(v))
+		apiObject.WorkerCount = int64(v)
 	}
 
 	if v, ok := tfMap["worker_configuration"].([]interface{}); ok && v[0] != nil {
@@ -634,15 +738,13 @@ func expandInitialCapacityConfig(tfMap map[string]interface{}) *emrserverless.In
 	return apiObject
 }
 
-func flattenInitialCapacityConfig(apiObject *emrserverless.InitialCapacityConfig) map[string]interface{} {
+func flattenInitialCapacityConfig(apiObject *types.InitialCapacityConfig) map[string]interface{} {
 	if apiObject == nil {
 		return nil
 	}
 
-	tfMap := map[string]interface{}{}
-
-	if v := apiObject.WorkerCount; v != nil {
-		tfMap["worker_count"] = aws.Int64Value(v)
+	tfMap := map[string]interface{}{
+		"worker_count": apiObject.WorkerCount,
 	}
 
 	if v := apiObject.WorkerConfiguration; v != nil {
@@ -652,12 +754,12 @@ func flattenInitialCapacityConfig(apiObject *emrserverless.InitialCapacityConfig
 	return tfMap
 }
 
-func expandWorkerResourceConfig(tfMap map[string]interface{}) *emrserverless.WorkerResourceConfig {
+func expandWorkerResourceConfig(tfMap map[string]interface{}) *types.WorkerResourceConfig {
 	if tfMap == nil {
 		return nil
 	}
 
-	apiObject := &emrserverless.WorkerResourceConfig{}
+	apiObject := &types.WorkerResourceConfig{}
 
 	if v, ok := tfMap["cpu"].(string); ok && v != "" {
 		apiObject.Cpu = aws.String(v)
@@ -674,7 +776,7 @@ func expandWorkerResourceConfig(tfMap map[string]interface{}) *emrserverless.Wor
 	return apiObject
 }
 
-func flattenWorkerResourceConfig(apiObject *emrserverless.WorkerResourceConfig) map[string]interface{} {
+func flattenWorkerResourceConfig(apiObject *types.WorkerResourceConfig) map[string]interface{} {
 	if apiObject == nil {
 		return nil
 	}
@@ -682,15 +784,15 @@ func flattenWorkerResourceConfig(apiObject *emrserverless.WorkerResourceConfig)
 	tfMap := map[string]interface{}{}
 
 	if v := apiObject.Cpu; v != nil {
-		tfMap["cpu"] = aws.StringValue(v)
+		tfMap["cpu"] = aws.ToString(v)
 	}
 
 	if v := apiObject.Disk; v != nil {
-		tfMap["disk"] = aws.StringValue(v)
+		tfMap["disk"] = aws.ToString(v)
 	}
 
 	if v := apiObject.Memory; v != nil {
-		tfMap["memory"] = aws.StringValue(v)
+		tfMap["memory"] = aws.ToString(v)
 	}
 
 	return tfMap
diff --git a/internal/service/emrserverless/application_test.go b/internal/service/emrserverless/application_test.go
index 5b483dc6604..f06dcf26553 100644
--- a/internal/service/emrserverless/application_test.go
+++ b/internal/service/emrserverless/application_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package emrserverless_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/service/emrserverless"
+	"github.com/YakDriver/regexache"
+	"github.com/aws/aws-sdk-go-v2/service/emrserverless/types"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
@@ -14,17 +17,18 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	tfemrserverless "github.com/hashicorp/terraform-provider-aws/internal/service/emrserverless"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
 func TestAccEMRServerlessApplication_basic(t *testing.T) {
 	ctx := acctest.Context(t)
-	var application emrserverless.Application
+	var application types.Application
 	resourceName := "aws_emrserverless_application.test"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, emrserverless.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.EMRServerlessEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckApplicationDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -32,7 +36,7 @@ func TestAccEMRServerlessApplication_basic(t *testing.T) {
 				Config: testAccApplicationConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckApplicationExists(ctx, resourceName, &application),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "emr-serverless", regexp.MustCompile(`/applications/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "emr-serverless", regexache.MustCompile(`/applications/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "type", "hive"),
 					resource.TestCheckResourceAttr(resourceName, "architecture", "X86_64"),
@@ -58,13 +62,13 @@ func TestAccEMRServerlessApplication_basic(t *testing.T) {
 
 func TestAccEMRServerlessApplication_arch(t *testing.T) {
 	ctx := acctest.Context(t)
-	var application emrserverless.Application
+	var application types.Application
 	resourceName := "aws_emrserverless_application.test"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, emrserverless.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.EMRServerlessEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckApplicationDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -91,15 +95,50 @@ func TestAccEMRServerlessApplication_arch(t *testing.T) {
 	})
 }
 
+func TestAccEMRServerlessApplication_releaseLabel(t *testing.T) {
+	ctx := acctest.Context(t)
+	var application types.Application
+	resourceName := "aws_emrserverless_application.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, names.EMRServerlessEndpointID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckApplicationDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccApplicationConfig_releaseLabel(rName, "emr-6.10.0"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckApplicationExists(ctx, resourceName, &application),
+					resource.TestCheckResourceAttr(resourceName, "release_label", "emr-6.10.0"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				Config: testAccApplicationConfig_releaseLabel(rName, "emr-6.11.0"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckApplicationExists(ctx, resourceName, &application),
+					resource.TestCheckResourceAttr(resourceName, "release_label", "emr-6.11.0"),
+				),
+			},
+		},
+	})
+}
+
 func TestAccEMRServerlessApplication_initialCapacity(t *testing.T) {
 	ctx := acctest.Context(t)
-	var application emrserverless.Application
+	var application types.Application
 	resourceName := "aws_emrserverless_application.test"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, emrserverless.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.EMRServerlessEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckApplicationDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -143,12 +182,12 @@ func TestAccEMRServerlessApplication_imageConfiguration(t *testing.T) {
 	if testing.Short() {
 		t.Skip("skipping long-running test in short mode")
 	}
-	var application emrserverless.Application
+	var application types.Application
 	resourceName := "aws_emrserverless_application.test"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
-	firstVersionRegex := regexp.MustCompile(`1\.0\.0`)
-	secondVersionRegex := regexp.MustCompile(`1\.0\.1`)
+	firstVersionRegex := regexache.MustCompile(`1\.0\.0`)
+	secondVersionRegex := regexache.MustCompile(`1\.0\.1`)
 
 	firstImageConfig, err := testAccApplicationConfig_imageConfiguration(rName, "1.0.0", "1.0.1", "1.0.0")
 	if err != nil {
@@ -162,7 +201,7 @@ func TestAccEMRServerlessApplication_imageConfiguration(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, emrserverless.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.EMRServerlessEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckApplicationDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -193,13 +232,13 @@ func TestAccEMRServerlessApplication_imageConfiguration(t *testing.T) {
 
 func TestAccEMRServerlessApplication_maxCapacity(t *testing.T) {
 	ctx := acctest.Context(t)
-	var application emrserverless.Application
+	var application types.Application
 	resourceName := "aws_emrserverless_application.test"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, emrserverless.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.EMRServerlessEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckApplicationDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -231,13 +270,13 @@ func TestAccEMRServerlessApplication_maxCapacity(t *testing.T) {
 
 func TestAccEMRServerlessApplication_network(t *testing.T) {
 	ctx := acctest.Context(t)
-	var application emrserverless.Application
+	var application types.Application
 	resourceName := "aws_emrserverless_application.test"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, emrserverless.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.EMRServerlessEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckApplicationDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -261,13 +300,13 @@ func TestAccEMRServerlessApplication_network(t *testing.T) {
 
 func TestAccEMRServerlessApplication_disappears(t *testing.T) {
 	ctx := acctest.Context(t)
-	var application emrserverless.Application
+	var application types.Application
 	resourceName := "aws_emrserverless_application.test"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, emrserverless.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.EMRServerlessEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckApplicationDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -286,13 +325,13 @@ func TestAccEMRServerlessApplication_disappears(t *testing.T) {
 
 func TestAccEMRServerlessApplication_tags(t *testing.T) {
 	ctx := acctest.Context(t)
-	var application emrserverless.Application
+	var application types.Application
 	resourceName := "aws_emrserverless_application.test"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, emrserverless.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.EMRServerlessEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckApplicationDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -330,14 +369,14 @@ func TestAccEMRServerlessApplication_tags(t *testing.T) {
 	})
 }
 
-func testAccCheckApplicationExists(ctx context.Context, resourceName string, application *emrserverless.Application) resource.TestCheckFunc {
+func testAccCheckApplicationExists(ctx context.Context, resourceName string, application *types.Application) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		rs, ok := s.RootModule().Resources[resourceName]
 		if !ok {
 			return fmt.Errorf("Not found: %s", resourceName)
 		}
 
-		conn := acctest.Provider.Meta().(*conns.AWSClient).EMRServerlessConn(ctx)
+		conn := acctest.Provider.Meta().(*conns.AWSClient).EMRServerlessClient(ctx)
 
 		output, err := tfemrserverless.FindApplicationByID(ctx, conn, rs.Primary.ID)
 		if err != nil {
@@ -356,7 +395,7 @@ func testAccCheckApplicationExists(ctx context.Context, resourceName string, app
 
 func testAccCheckApplicationDestroy(ctx context.Context) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		conn := acctest.Provider.Meta().(*conns.AWSClient).EMRServerlessConn(ctx)
+		conn := acctest.Provider.Meta().(*conns.AWSClient).EMRServerlessClient(ctx)
 
 		for _, rs := range s.RootModule().Resources {
 			if rs.Type != "aws_emrserverless_application" {
@@ -364,6 +403,7 @@ func testAccCheckApplicationDestroy(ctx context.Context) resource.TestCheckFunc
 			}
 
 			_, err := tfemrserverless.FindApplicationByID(ctx, conn, rs.Primary.ID)
+
 			if tfresource.NotFound(err) {
 				continue
 			}
@@ -388,6 +428,16 @@ resource "aws_emrserverless_application" "test" {
 `, rName)
 }
 
+func testAccApplicationConfig_releaseLabel(rName string, rl string) string {
+	return fmt.Sprintf(`
+resource "aws_emrserverless_application" "test" {
+  name          = %[1]q
+  release_label = %[2]q
+  type          = "spark"
+}
+`, rName, rl)
+}
+
 func testAccApplicationConfig_initialCapacity(rName, cpu string) string {
 	return fmt.Sprintf(`
 resource "aws_emrserverless_application" "test" {
@@ -445,6 +495,10 @@ resource "aws_security_group" "test" {
     protocol    = "-1"
     cidr_blocks = ["0.0.0.0/0"]
   }
+
+  tags = {
+    Name = %[1]q
+  }
 }
 
 resource "aws_emrserverless_application" "test" {
@@ -529,6 +583,10 @@ resource "aws_ecr_repository" "test" {
 
 resource "aws_vpc" "test" {
   cidr_block = "10.0.0.0/16"
+
+  tags = {
+    Name = %[1]q
+  }
 }
 
 resource "aws_default_route_table" "test" {
@@ -542,12 +600,20 @@ resource "aws_default_route_table" "test" {
 
 resource "aws_internet_gateway" "test" {
   vpc_id = aws_vpc.test.id
+
+  tags = {
+    Name = %[1]q
+  }
 }
 
 resource "aws_subnet" "test" {
   cidr_block              = cidrsubnet(aws_vpc.test.cidr_block, 8, 0)
   map_public_ip_on_launch = true
   vpc_id                  = aws_vpc.test.id
+
+  tags = {
+    Name = %[1]q
+  }
 }
 
 resource "aws_default_security_group" "test" {
diff --git a/internal/service/emrserverless/exports_test.go b/internal/service/emrserverless/exports_test.go
new file mode 100644
index 00000000000..6bc0b5797b2
--- /dev/null
+++ b/internal/service/emrserverless/exports_test.go
@@ -0,0 +1,11 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package emrserverless
+
+// Exports for use in tests only.
+var (
+	FindApplicationByID = findApplicationByID
+
+	ResourceApplication = resourceApplication
+)
diff --git a/internal/service/emrserverless/find.go b/internal/service/emrserverless/find.go
deleted file mode 100644
index 4640038a859..00000000000
--- a/internal/service/emrserverless/find.go
+++ /dev/null
@@ -1,40 +0,0 @@
-package emrserverless
-
-import (
-	"context"
-
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/emrserverless"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
-	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
-)
-
-func FindApplicationByID(ctx context.Context, conn *emrserverless.EMRServerless, id string) (*emrserverless.Application, error) {
-	input := &emrserverless.GetApplicationInput{
-		ApplicationId: aws.String(id),
-	}
-
-	output, err := conn.GetApplicationWithContext(ctx, input)
-
-	if tfawserr.ErrCodeEquals(err, emrserverless.ErrCodeResourceNotFoundException) {
-		return nil, &retry.NotFoundError{
-			LastError:   err,
-			LastRequest: input,
-		}
-	}
-
-	if err != nil {
-		return nil, err
-	}
-
-	if output == nil || output.Application == nil {
-		return nil, tfresource.NewEmptyResultError(input)
-	}
-
-	if aws.StringValue(output.Application.State) == emrserverless.ApplicationStateTerminated {
-		return nil, tfresource.NewEmptyResultError(input)
-	}
-
-	return output.Application, nil
-}
diff --git a/internal/service/emrserverless/generate.go b/internal/service/emrserverless/generate.go
index 0fc475d5cdc..9ebb9e6039a 100644
--- a/internal/service/emrserverless/generate.go
+++ b/internal/service/emrserverless/generate.go
@@ -1,4 +1,7 @@
-//go:generate go run ../../generate/tags/main.go -ListTags -ServiceTagsMap -UpdateTags
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+//go:generate go run ../../generate/tags/main.go -AWSSDKVersion=2 -ListTags -ServiceTagsMap -UpdateTags -KVTValues -SkipTypesImp
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
 
diff --git a/internal/service/emrserverless/service_package_gen.go b/internal/service/emrserverless/service_package_gen.go
index 40938bf1ad8..36d024658ae 100644
--- a/internal/service/emrserverless/service_package_gen.go
+++ b/internal/service/emrserverless/service_package_gen.go
@@ -5,9 +5,9 @@ package emrserverless
 import (
 	"context"
 
-	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
-	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
-	emrserverless_sdkv1 "github.com/aws/aws-sdk-go/service/emrserverless"
+	aws_sdkv2 "github.com/aws/aws-sdk-go-v2/aws"
+	emrserverless_sdkv2 "github.com/aws/aws-sdk-go-v2/service/emrserverless"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -29,7 +29,7 @@ func (p *servicePackage) SDKDataSources(ctx context.Context) []*types.ServicePac
 func (p *servicePackage) SDKResources(ctx context.Context) []*types.ServicePackageSDKResource {
 	return []*types.ServicePackageSDKResource{
 		{
-			Factory:  ResourceApplication,
+			Factory:  resourceApplication,
 			TypeName: "aws_emrserverless_application",
 			Name:     "Application",
 			Tags: &types.ServicePackageResourceTags{
@@ -43,11 +43,17 @@ func (p *servicePackage) ServicePackageName() string {
 	return names.EMRServerless
 }
 
-// NewConn returns a new AWS SDK for Go v1 client for this service package's AWS API.
-func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*emrserverless_sdkv1.EMRServerless, error) {
-	sess := config["session"].(*session_sdkv1.Session)
+// NewClient returns a new AWS SDK for Go v2 client for this service package's AWS API.
+func (p *servicePackage) NewClient(ctx context.Context, config map[string]any) (*emrserverless_sdkv2.Client, error) {
+	cfg := *(config["aws_sdkv2_config"].(*aws_sdkv2.Config))
 
-	return emrserverless_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
+	return emrserverless_sdkv2.NewFromConfig(cfg, func(o *emrserverless_sdkv2.Options) {
+		if endpoint := config["endpoint"].(string); endpoint != "" {
+			o.BaseEndpoint = aws_sdkv2.String(endpoint)
+		}
+	}), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/emrserverless/status.go b/internal/service/emrserverless/status.go
deleted file mode 100644
index 8751d96eaa3..00000000000
--- a/internal/service/emrserverless/status.go
+++ /dev/null
@@ -1,26 +0,0 @@
-package emrserverless
-
-import (
-	"context"
-
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/emrserverless"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
-	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
-)
-
-func statusApplication(ctx context.Context, conn *emrserverless.EMRServerless, id string) retry.StateRefreshFunc {
-	return func() (interface{}, string, error) {
-		output, err := FindApplicationByID(ctx, conn, id)
-
-		if tfresource.NotFound(err) {
-			return nil, "", nil
-		}
-
-		if err != nil {
-			return nil, "", err
-		}
-
-		return output, aws.StringValue(output.State), nil
-	}
-}
diff --git a/internal/service/emrserverless/sweep.go b/internal/service/emrserverless/sweep.go
index 6a8ae216fb7..fe41ee2221b 100644
--- a/internal/service/emrserverless/sweep.go
+++ b/internal/service/emrserverless/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package emrserverless
 
@@ -7,13 +7,15 @@ import (
 	"fmt"
 	"log"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/emrserverless"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/emrserverless"
+	"github.com/aws/aws-sdk-go-v2/service/emrserverless/types"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv2"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_emrserverless_application", &resource.Sweeper{
 		Name: "aws_emrserverless_application",
 		F:    sweepApplications,
@@ -22,44 +24,41 @@ func init() {
 
 func sweepApplications(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
-	conn := client.EMRServerlessConn(ctx)
+	conn := client.EMRServerlessClient(ctx)
 	input := &emrserverless.ListApplicationsInput{}
 	sweepResources := make([]sweep.Sweepable, 0)
 
-	err = conn.ListApplicationsPagesWithContext(ctx, input, func(page *emrserverless.ListApplicationsOutput, lastPage bool) bool {
-		if page == nil {
-			return !lastPage
+	pages := emrserverless.NewListApplicationsPaginator(conn, input)
+	for pages.HasMorePages() {
+		page, err := pages.NextPage(ctx)
+
+		if awsv2.SkipSweepError(err) {
+			log.Printf("[WARN] Skipping EMR Serverless Application sweep for %s: %s", region, err)
+			return nil
+		}
+
+		if err != nil {
+			return fmt.Errorf("error listing EMR Serverless Applications (%s): %w", region, err)
 		}
 
 		for _, v := range page.Applications {
-			if aws.StringValue(v.State) == emrserverless.ApplicationStateTerminated {
+			if v.State == types.ApplicationStateTerminated {
 				continue
 			}
 
-			r := ResourceApplication()
+			r := resourceApplication()
 			d := r.Data(nil)
-			d.SetId(aws.StringValue(v.Id))
+			d.SetId(aws.ToString(v.Id))
 
 			sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
 		}
-
-		return !lastPage
-	})
-
-	if sweep.SkipSweepError(err) {
-		log.Printf("[WARN] Skipping EMR Serverless Application sweep for %s: %s", region, err)
-		return nil
-	}
-
-	if err != nil {
-		return fmt.Errorf("error listing EMR Serverless Applications (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping EMR Serverless Applications (%s): %w", region, err)
diff --git a/internal/service/emrserverless/tags_gen.go b/internal/service/emrserverless/tags_gen.go
index 79c0c2e0f62..b26eda3b448 100644
--- a/internal/service/emrserverless/tags_gen.go
+++ b/internal/service/emrserverless/tags_gen.go
@@ -5,10 +5,11 @@ import (
 	"context"
 	"fmt"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/emrserverless"
-	"github.com/aws/aws-sdk-go/service/emrserverless/emrserverlessiface"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/emrserverless"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -17,12 +18,12 @@ import (
 // listTags lists emrserverless service tags.
 // The identifier is typically the Amazon Resource Name (ARN), although
 // it may also be a different identifier depending on the service.
-func listTags(ctx context.Context, conn emrserverlessiface.EMRServerlessAPI, identifier string) (tftags.KeyValueTags, error) {
+func listTags(ctx context.Context, conn *emrserverless.Client, identifier string) (tftags.KeyValueTags, error) {
 	input := &emrserverless.ListTagsForResourceInput{
 		ResourceArn: aws.String(identifier),
 	}
 
-	output, err := conn.ListTagsForResourceWithContext(ctx, input)
+	output, err := conn.ListTagsForResource(ctx, input)
 
 	if err != nil {
 		return tftags.New(ctx, nil), err
@@ -34,7 +35,7 @@ func listTags(ctx context.Context, conn emrserverlessiface.EMRServerlessAPI, ide
 // ListTags lists emrserverless service tags and set them in Context.
 // It is called from outside this package.
 func (p *servicePackage) ListTags(ctx context.Context, meta any, identifier string) error {
-	tags, err := listTags(ctx, meta.(*conns.AWSClient).EMRServerlessConn(ctx), identifier)
+	tags, err := listTags(ctx, meta.(*conns.AWSClient).EMRServerlessClient(ctx), identifier)
 
 	if err != nil {
 		return err
@@ -47,21 +48,21 @@ func (p *servicePackage) ListTags(ctx context.Context, meta any, identifier stri
 	return nil
 }
 
-// map[string]*string handling
+// map[string]string handling
 
 // Tags returns emrserverless service tags.
-func Tags(tags tftags.KeyValueTags) map[string]*string {
-	return aws.StringMap(tags.Map())
+func Tags(tags tftags.KeyValueTags) map[string]string {
+	return tags.Map()
 }
 
-// KeyValueTags creates KeyValueTags from emrserverless service tags.
-func KeyValueTags(ctx context.Context, tags map[string]*string) tftags.KeyValueTags {
+// KeyValueTags creates tftags.KeyValueTags from emrserverless service tags.
+func KeyValueTags(ctx context.Context, tags map[string]string) tftags.KeyValueTags {
 	return tftags.New(ctx, tags)
 }
 
 // getTagsIn returns emrserverless service tags from Context.
 // nil is returned if there are no input tags.
-func getTagsIn(ctx context.Context) map[string]*string {
+func getTagsIn(ctx context.Context) map[string]string {
 	if inContext, ok := tftags.FromContext(ctx); ok {
 		if tags := Tags(inContext.TagsIn.UnwrapOrDefault()); len(tags) > 0 {
 			return tags
@@ -72,7 +73,7 @@ func getTagsIn(ctx context.Context) map[string]*string {
 }
 
 // setTagsOut sets emrserverless service tags in Context.
-func setTagsOut(ctx context.Context, tags map[string]*string) {
+func setTagsOut(ctx context.Context, tags map[string]string) {
 	if inContext, ok := tftags.FromContext(ctx); ok {
 		inContext.TagsOut = types.Some(KeyValueTags(ctx, tags))
 	}
@@ -81,19 +82,21 @@ func setTagsOut(ctx context.Context, tags map[string]*string) {
 // updateTags updates emrserverless service tags.
 // The identifier is typically the Amazon Resource Name (ARN), although
 // it may also be a different identifier depending on the service.
-func updateTags(ctx context.Context, conn emrserverlessiface.EMRServerlessAPI, identifier string, oldTagsMap, newTagsMap any) error {
+func updateTags(ctx context.Context, conn *emrserverless.Client, identifier string, oldTagsMap, newTagsMap any) error {
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.EMRServerless)
 	if len(removedTags) > 0 {
 		input := &emrserverless.UntagResourceInput{
 			ResourceArn: aws.String(identifier),
-			TagKeys:     aws.StringSlice(removedTags.Keys()),
+			TagKeys:     removedTags.Keys(),
 		}
 
-		_, err := conn.UntagResourceWithContext(ctx, input)
+		_, err := conn.UntagResource(ctx, input)
 
 		if err != nil {
 			return fmt.Errorf("untagging resource (%s): %w", identifier, err)
@@ -108,7 +111,7 @@ func updateTags(ctx context.Context, conn emrserverlessiface.EMRServerlessAPI, i
 			Tags:        Tags(updatedTags),
 		}
 
-		_, err := conn.TagResourceWithContext(ctx, input)
+		_, err := conn.TagResource(ctx, input)
 
 		if err != nil {
 			return fmt.Errorf("tagging resource (%s): %w", identifier, err)
@@ -121,5 +124,5 @@ func updateTags(ctx context.Context, conn emrserverlessiface.EMRServerlessAPI, i
 // UpdateTags updates emrserverless service tags.
 // It is called from outside this package.
 func (p *servicePackage) UpdateTags(ctx context.Context, meta any, identifier string, oldTags, newTags any) error {
-	return updateTags(ctx, meta.(*conns.AWSClient).EMRServerlessConn(ctx), identifier, oldTags, newTags)
+	return updateTags(ctx, meta.(*conns.AWSClient).EMRServerlessClient(ctx), identifier, oldTags, newTags)
 }
diff --git a/internal/service/emrserverless/wait.go b/internal/service/emrserverless/wait.go
deleted file mode 100644
index 59608469087..00000000000
--- a/internal/service/emrserverless/wait.go
+++ /dev/null
@@ -1,68 +0,0 @@
-package emrserverless
-
-import (
-	"context"
-	"fmt"
-	"time"
-
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/emrserverless"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
-	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
-)
-
-const (
-	ApplicationCreatedTimeout    = 75 * time.Minute
-	ApplicationCreatedMinTimeout = 10 * time.Second
-	ApplicationCreatedDelay      = 30 * time.Second
-
-	ApplicationDeletedTimeout    = 20 * time.Minute
-	ApplicationDeletedMinTimeout = 10 * time.Second
-	ApplicationDeletedDelay      = 30 * time.Second
-)
-
-func waitApplicationCreated(ctx context.Context, conn *emrserverless.EMRServerless, id string) (*emrserverless.Application, error) {
-	stateConf := &retry.StateChangeConf{
-		Pending:    []string{emrserverless.ApplicationStateCreating},
-		Target:     []string{emrserverless.ApplicationStateCreated},
-		Refresh:    statusApplication(ctx, conn, id),
-		Timeout:    ApplicationCreatedTimeout,
-		MinTimeout: ApplicationCreatedMinTimeout,
-		Delay:      ApplicationCreatedDelay,
-	}
-
-	outputRaw, err := stateConf.WaitForStateContext(ctx)
-
-	if output, ok := outputRaw.(*emrserverless.Application); ok {
-		if stateChangeReason := output.StateDetails; stateChangeReason != nil {
-			tfresource.SetLastError(err, fmt.Errorf(aws.StringValue(stateChangeReason)))
-		}
-
-		return output, err
-	}
-
-	return nil, err
-}
-
-func waitApplicationTerminated(ctx context.Context, conn *emrserverless.EMRServerless, id string) (*emrserverless.Application, error) {
-	stateConf := &retry.StateChangeConf{
-		Pending:    emrserverless.ApplicationState_Values(),
-		Target:     []string{},
-		Refresh:    statusApplication(ctx, conn, id),
-		Timeout:    ApplicationDeletedTimeout,
-		MinTimeout: ApplicationDeletedMinTimeout,
-		Delay:      ApplicationDeletedDelay,
-	}
-
-	outputRaw, err := stateConf.WaitForStateContext(ctx)
-
-	if output, ok := outputRaw.(*emrserverless.Application); ok {
-		if stateChangeReason := output.StateDetails; stateChangeReason != nil {
-			tfresource.SetLastError(err, fmt.Errorf(aws.StringValue(stateChangeReason)))
-		}
-
-		return output, err
-	}
-
-	return nil, err
-}
diff --git a/internal/service/events/api_destination.go b/internal/service/events/api_destination.go
index 1ec38c2f840..33f9a8ecfcb 100644
--- a/internal/service/events/api_destination.go
+++ b/internal/service/events/api_destination.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package events
 
 import (
 	"context"
 	"log"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/eventbridge"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -34,7 +37,7 @@ func ResourceAPIDestination() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 64),
-					validation.StringMatch(regexp.MustCompile(`^[\.\-_A-Za-z0-9]+`), ""),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_.-]+`), ""),
 				),
 			},
 			"description": {
diff --git a/internal/service/events/api_destination_test.go b/internal/service/events/api_destination_test.go
index 21c10192dde..6f62772dc11 100644
--- a/internal/service/events/api_destination_test.go
+++ b/internal/service/events/api_destination_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package events_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/eventbridge"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -16,7 +19,7 @@ import (
 	tfevents "github.com/hashicorp/terraform-provider-aws/internal/service/events"
 )
 
-const uuidRegex = "[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"
+const uuidRegex = "[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}$"
 
 func TestAccEventsAPIDestination_basic(t *testing.T) {
 	ctx := acctest.Context(t)
@@ -46,7 +49,7 @@ func TestAccEventsAPIDestination_basic(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckAPIDestinationExists(ctx, resourceName, &v1),
 					resource.TestCheckResourceAttr(resourceName, "name", name),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "events", regexp.MustCompile(fmt.Sprintf("api-destination/%s/%s", name, uuidRegex))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "events", regexache.MustCompile(fmt.Sprintf("api-destination/%s/%s", name, uuidRegex))),
 					resource.TestCheckResourceAttr(resourceName, "http_method", httpMethod),
 					resource.TestCheckResourceAttr(resourceName, "invocation_endpoint", invocationEndpoint),
 				),
@@ -65,7 +68,7 @@ func TestAccEventsAPIDestination_basic(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckAPIDestinationExists(ctx, resourceName, &v2),
 					resource.TestCheckResourceAttr(resourceName, "name", nameModified),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "events", regexp.MustCompile(fmt.Sprintf("api-destination/%s/%s", nameModified, uuidRegex))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "events", regexache.MustCompile(fmt.Sprintf("api-destination/%s/%s", nameModified, uuidRegex))),
 					testAccCheckAPIDestinationRecreated(&v1, &v2),
 					resource.TestCheckResourceAttr(resourceName, "http_method", httpMethodModified),
 					resource.TestCheckResourceAttr(resourceName, "invocation_endpoint", invocationEndpointModified),
diff --git a/internal/service/events/archive.go b/internal/service/events/archive.go
index 7c5ca44e2f9..cddefc6d559 100644
--- a/internal/service/events/archive.go
+++ b/internal/service/events/archive.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package events
 
 import (
diff --git a/internal/service/events/archive_test.go b/internal/service/events/archive_test.go
index 62146269536..61d2d805ef5 100644
--- a/internal/service/events/archive_test.go
+++ b/internal/service/events/archive_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package events_test
 
 import (
diff --git a/internal/service/events/bus.go b/internal/service/events/bus.go
index f3836f08fbf..1a79ae189e2 100644
--- a/internal/service/events/bus.go
+++ b/internal/service/events/bus.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package events
 
 import (
diff --git a/internal/service/events/bus_data_source.go b/internal/service/events/bus_data_source.go
index 8d7c29f9302..9983b11a356 100644
--- a/internal/service/events/bus_data_source.go
+++ b/internal/service/events/bus_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package events
 
 import (
diff --git a/internal/service/events/bus_data_source_test.go b/internal/service/events/bus_data_source_test.go
index da16a9b3638..96b02f373ad 100644
--- a/internal/service/events/bus_data_source_test.go
+++ b/internal/service/events/bus_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package events_test
 
 import (
diff --git a/internal/service/events/bus_policy.go b/internal/service/events/bus_policy.go
index bce9fa1b87a..a9c72cc742a 100644
--- a/internal/service/events/bus_policy.go
+++ b/internal/service/events/bus_policy.go
@@ -1,8 +1,10 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package events
 
 import (
 	"context"
-	"fmt"
 	"log"
 
 	"github.com/aws/aws-sdk-go/aws"
@@ -22,10 +24,11 @@ import (
 // @SDKResource("aws_cloudwatch_event_bus_policy")
 func ResourceBusPolicy() *schema.Resource {
 	return &schema.Resource{
-		CreateWithoutTimeout: resourceBusPolicyCreate,
+		CreateWithoutTimeout: resourceBusPolicyPut,
 		ReadWithoutTimeout:   resourceBusPolicyRead,
-		UpdateWithoutTimeout: resourceBusPolicyUpdate,
+		UpdateWithoutTimeout: resourceBusPolicyPut,
 		DeleteWithoutTimeout: resourceBusPolicyDelete,
+
 		Importer: &schema.ResourceImporter{
 			StateContext: func(ctx context.Context, d *schema.ResourceData, meta interface{}) ([]*schema.ResourceData, error) {
 				d.Set("event_bus_name", d.Id())
@@ -56,88 +59,72 @@ func ResourceBusPolicy() *schema.Resource {
 	}
 }
 
-func resourceBusPolicyCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+func resourceBusPolicyPut(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).EventsConn(ctx)
 
-	eventBusName := d.Get("event_bus_name").(string)
-
 	policy, err := structure.NormalizeJsonString(d.Get("policy").(string))
-
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "policy (%s) is invalid JSON: %s", policy, err)
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
-	input := eventbridge.PutPermissionInput{
+	var eventBusName string
+	if d.IsNewResource() {
+		eventBusName = d.Get("event_bus_name").(string)
+	} else {
+		eventBusName = d.Id()
+	}
+	input := &eventbridge.PutPermissionInput{
 		EventBusName: aws.String(eventBusName),
 		Policy:       aws.String(policy),
 	}
 
-	log.Printf("[DEBUG] Creating EventBridge policy: %s", input)
-	_, err = conn.PutPermissionWithContext(ctx, &input)
+	_, err = conn.PutPermissionWithContext(ctx, input)
+
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "Creating EventBridge policy failed: %s", err)
+		return sdkdiag.AppendErrorf(diags, "creating EventBridge Event Bus (%s) Policy: %s", eventBusName, err)
 	}
 
-	d.SetId(eventBusName)
+	if d.IsNewResource() {
+		d.SetId(eventBusName)
+	}
+
+	_, err = tfresource.RetryWhenNotFound(ctx, propagationTimeout, func() (interface{}, error) {
+		return FindEventBusPolicyByName(ctx, conn, d.Id())
+	})
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "wait for EventBridge Event Bus (%s) Policy create: %s", d.Id(), err)
+	}
 
 	return append(diags, resourceBusPolicyRead(ctx, d, meta)...)
 }
 
-// See also: https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_DescribeEventBus.html
 func resourceBusPolicyRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).EventsConn(ctx)
 
-	eventBusName := d.Id()
-
-	input := eventbridge.DescribeEventBusInput{
-		Name: aws.String(eventBusName),
-	}
-	var output *eventbridge.DescribeEventBusOutput
-	var err error
-	var policy *string
-
-	// Especially with concurrent PutPermission calls there can be a slight delay
-	err = retry.RetryContext(ctx, propagationTimeout, func() *retry.RetryError {
-		log.Printf("[DEBUG] Reading EventBridge bus: %s", input)
-		output, err = conn.DescribeEventBusWithContext(ctx, &input)
-		if err != nil {
-			return retry.NonRetryableError(fmt.Errorf("reading EventBridge permission (%s) failed: %w", d.Id(), err))
-		}
-
-		policy, err = getEventBusPolicy(output)
-		if err != nil {
-			return retry.RetryableError(err)
-		}
-		return nil
-	})
-
-	if tfresource.TimedOut(err) {
-		output, err = conn.DescribeEventBusWithContext(ctx, &input)
-		if output != nil {
-			policy, err = getEventBusPolicy(output)
-		}
-	}
+	policy, err := FindEventBusPolicyByName(ctx, conn, d.Id())
 
 	if !d.IsNewResource() && tfresource.NotFound(err) {
-		log.Printf("[WARN] Policy on EventBridge Bus (%s) not found, removing from state", d.Id())
+		log.Printf("[WARN] EventBridge Event Bus (%s) Policy not found, removing from state", d.Id())
 		d.SetId("")
 		return diags
 	}
+
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "reading policy from EventBridge Bus (%s): %s", d.Id(), err)
+		return sdkdiag.AppendErrorf(diags, "reading EventBridge Event Bus (%s) Policy: %s", d.Id(), err)
 	}
 
-	busName := aws.StringValue(output.Name)
-	if busName == "" {
-		busName = DefaultEventBusName
+	eventBusName := d.Id()
+	if eventBusName == "" {
+		eventBusName = DefaultEventBusName
 	}
-	d.Set("event_bus_name", busName)
+	d.Set("event_bus_name", eventBusName)
 
 	policyToSet, err := verify.PolicyToSet(d.Get("policy").(string), aws.StringValue(policy))
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "reading policy from EventBridge Bus (%s): %s", d.Id(), err)
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
 	d.Set("policy", policyToSet)
@@ -145,62 +132,37 @@ func resourceBusPolicyRead(ctx context.Context, d *schema.ResourceData, meta int
 	return diags
 }
 
-func getEventBusPolicy(output *eventbridge.DescribeEventBusOutput) (*string, error) {
-	if output == nil || output.Policy == nil {
-		return nil, &retry.NotFoundError{
-			Message:      fmt.Sprintf("Policy for EventBridge Bus (%s) not found", *output.Name),
-			LastResponse: output,
-		}
-	}
-
-	return output.Policy, nil
-}
-
-func resourceBusPolicyUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+func resourceBusPolicyDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).EventsConn(ctx)
 
-	eventBusName := d.Id()
-
-	policy, err := structure.NormalizeJsonString(d.Get("policy").(string))
-
-	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "policy (%s) is invalid JSON: %s", policy, err)
-	}
+	log.Printf("[DEBUG] Deleting EventBridge Event Bus Policy: %s", d.Id())
+	_, err := conn.RemovePermissionWithContext(ctx, &eventbridge.RemovePermissionInput{
+		EventBusName:         aws.String(d.Id()),
+		RemoveAllPermissions: aws.Bool(true),
+	})
 
-	input := eventbridge.PutPermissionInput{
-		EventBusName: aws.String(eventBusName),
-		Policy:       aws.String(policy),
+	if tfawserr.ErrCodeEquals(err, eventbridge.ErrCodeResourceNotFoundException) {
+		return diags
 	}
 
-	log.Printf("[DEBUG] Update EventBridge Bus policy: %s", input)
-	_, err = conn.PutPermissionWithContext(ctx, &input)
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "updating policy for EventBridge Bus (%s): %s", d.Id(), err)
+		return sdkdiag.AppendErrorf(diags, "deleting EventBridge Event Bus (%s) Policy: %s", d.Id(), err)
 	}
 
-	return append(diags, resourceBusPolicyRead(ctx, d, meta)...)
+	return diags
 }
 
-func resourceBusPolicyDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).EventsConn(ctx)
+func FindEventBusPolicyByName(ctx context.Context, conn *eventbridge.EventBridge, name string) (*string, error) {
+	output, err := FindEventBusByName(ctx, conn, name)
 
-	eventBusName := d.Id()
-	removeAllPermissions := true
-
-	input := eventbridge.RemovePermissionInput{
-		EventBusName:         aws.String(eventBusName),
-		RemoveAllPermissions: &removeAllPermissions,
+	if err != nil {
+		return nil, err
 	}
 
-	log.Printf("[DEBUG] Delete EventBridge Bus Policy: %s", input)
-	_, err := conn.RemovePermissionWithContext(ctx, &input)
-	if tfawserr.ErrCodeEquals(err, eventbridge.ErrCodeResourceNotFoundException) {
-		return diags
-	}
-	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "deleting policy for EventBridge Bus (%s): %s", d.Id(), err)
+	if aws.StringValue(output.Policy) == "" {
+		return nil, &retry.NotFoundError{}
 	}
-	return diags
+
+	return output.Policy, nil
 }
diff --git a/internal/service/events/bus_policy_test.go b/internal/service/events/bus_policy_test.go
index cb977b4b06c..10bf4e1c4b0 100644
--- a/internal/service/events/bus_policy_test.go
+++ b/internal/service/events/bus_policy_test.go
@@ -1,7 +1,11 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package events_test
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"testing"
 
@@ -19,7 +23,7 @@ import (
 func TestAccEventsBusPolicy_basic(t *testing.T) {
 	ctx := acctest.Context(t)
 	resourceName := "aws_cloudwatch_event_bus_policy.test"
-	rstring := sdkacctest.RandString(5)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
@@ -28,14 +32,14 @@ func TestAccEventsBusPolicy_basic(t *testing.T) {
 		CheckDestroy:             testAccCheckBusDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccBusPolicyConfig_basic(rstring),
+				Config: testAccBusPolicyConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBusPolicyExists(ctx, resourceName),
 					testAccBusPolicyDocument(ctx, resourceName),
 				),
 			},
 			{
-				Config: testAccBusPolicyConfig_update(rstring),
+				Config: testAccBusPolicyConfig_update(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBusPolicyExists(ctx, resourceName),
 					testAccBusPolicyDocument(ctx, resourceName),
@@ -79,7 +83,7 @@ func TestAccEventsBusPolicy_ignoreEquivalent(t *testing.T) {
 func TestAccEventsBusPolicy_disappears(t *testing.T) {
 	ctx := acctest.Context(t)
 	resourceName := "aws_cloudwatch_event_bus_policy.test"
-	rstring := sdkacctest.RandString(5)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
@@ -88,7 +92,7 @@ func TestAccEventsBusPolicy_disappears(t *testing.T) {
 		CheckDestroy:             testAccCheckBusDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccBusPolicyConfig_basic(rstring),
+				Config: testAccBusPolicyConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBusPolicyExists(ctx, resourceName),
 					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfevents.ResourceBusPolicy(), resourceName),
@@ -99,73 +103,69 @@ func TestAccEventsBusPolicy_disappears(t *testing.T) {
 	})
 }
 
-func testAccCheckBusPolicyExists(ctx context.Context, pr string) resource.TestCheckFunc {
-	return func(state *terraform.State) error {
-		eventBusResource, ok := state.RootModule().Resources[pr]
-		if !ok {
-			return fmt.Errorf("Not found: %s", pr)
-		}
-
-		if eventBusResource.Primary.ID == "" {
-			return fmt.Errorf("No ID is set")
-		}
+func TestAccEventsBusPolicy_disappears_EventBus(t *testing.T) {
+	ctx := acctest.Context(t)
+	resourceName := "aws_cloudwatch_event_bus_policy.test"
+	parentResourceName := "aws_cloudwatch_event_bus.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
-		eventBusName := eventBusResource.Primary.ID
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, eventbridge.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckBusDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccBusPolicyConfig_basic(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckBusPolicyExists(ctx, resourceName),
+					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfevents.ResourceBus(), parentResourceName),
+				),
+				ExpectNonEmptyPlan: true,
+			},
+		},
+	})
+}
 
-		input := &eventbridge.DescribeEventBusInput{
-			Name: aws.String(eventBusName),
+func testAccCheckBusPolicyExists(ctx context.Context, n string) resource.TestCheckFunc {
+	return func(state *terraform.State) error {
+		rs, ok := state.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
 		}
 
 		conn := acctest.Provider.Meta().(*conns.AWSClient).EventsConn(ctx)
-		describedEventBus, err := conn.DescribeEventBusWithContext(ctx, input)
 
-		if err != nil {
-			return fmt.Errorf("Reading EventBridge bus policy for '%s' failed: %w", pr, err)
-		}
-		if describedEventBus.Policy == nil || len(*describedEventBus.Policy) == 0 {
-			return fmt.Errorf("Not found: %s", pr)
-		}
+		_, err := tfevents.FindEventBusPolicyByName(ctx, conn, rs.Primary.ID)
 
-		return nil
+		return err
 	}
 }
 
-func testAccBusPolicyDocument(ctx context.Context, pr string) resource.TestCheckFunc {
+func testAccBusPolicyDocument(ctx context.Context, n string) resource.TestCheckFunc {
 	return func(state *terraform.State) error {
-		eventBusPolicyResource, ok := state.RootModule().Resources[pr]
+		rs, ok := state.RootModule().Resources[n]
 		if !ok {
-			return fmt.Errorf("Not found: %s", pr)
-		}
-
-		if eventBusPolicyResource.Primary.ID == "" {
-			return fmt.Errorf("No ID is set")
+			return fmt.Errorf("Not found: %s", n)
 		}
 
-		eventBusName := eventBusPolicyResource.Primary.ID
+		conn := acctest.Provider.Meta().(*conns.AWSClient).EventsConn(ctx)
 
-		input := &eventbridge.DescribeEventBusInput{
-			Name: aws.String(eventBusName),
-		}
+		policy, err := tfevents.FindEventBusPolicyByName(ctx, conn, rs.Primary.ID)
 
-		conn := acctest.Provider.Meta().(*conns.AWSClient).EventsConn(ctx)
-		describedEventBus, err := conn.DescribeEventBusWithContext(ctx, input)
 		if err != nil {
-			return fmt.Errorf("Reading EventBridge bus policy for '%s' failed: %w", pr, err)
-		}
-
-		if describedEventBus.Policy == nil || len(*describedEventBus.Policy) == 0 {
-			return fmt.Errorf("Not found: %s", pr)
+			return err
 		}
 
-		if equivalent, err := awspolicy.PoliciesAreEquivalent(eventBusPolicyResource.Primary.Attributes["policy"], aws.StringValue(describedEventBus.Policy)); err != nil || !equivalent {
-			return fmt.Errorf("EventBridge bus policy not equivalent for '%s'", pr)
+		if equivalent, err := awspolicy.PoliciesAreEquivalent(rs.Primary.Attributes["policy"], aws.StringValue(policy)); err != nil || !equivalent {
+			return errors.New(`EventBridge Event Bus Policies not equivalent`)
 		}
 
 		return nil
 	}
 }
 
-func testAccBusPolicyConfig_basic(name string) string {
+func testAccBusPolicyConfig_basic(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_cloudwatch_event_bus" "test" {
   name = %[1]q
@@ -193,10 +193,10 @@ resource "aws_cloudwatch_event_bus_policy" "test" {
   policy         = data.aws_iam_policy_document.access.json
   event_bus_name = aws_cloudwatch_event_bus.test.name
 }
-`, name)
+`, rName)
 }
 
-func testAccBusPolicyConfig_update(name string) string {
+func testAccBusPolicyConfig_update(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_cloudwatch_event_bus" "test" {
   name = %[1]q
@@ -237,7 +237,7 @@ resource "aws_cloudwatch_event_bus_policy" "test" {
   policy         = data.aws_iam_policy_document.access.json
   event_bus_name = aws_cloudwatch_event_bus.test.name
 }
-`, name)
+`, rName)
 }
 
 func testAccBusPolicyConfig_order(rName string) string {
diff --git a/internal/service/events/bus_test.go b/internal/service/events/bus_test.go
index d7b8ec93d0c..8749da74c59 100644
--- a/internal/service/events/bus_test.go
+++ b/internal/service/events/bus_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package events_test
 
 import (
 	"context"
 	"fmt"
 	"os"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/eventbridge"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -129,7 +132,7 @@ func TestAccEventsBus_default(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccBusConfig_basic("default"),
-				ExpectError: regexp.MustCompile(`cannot be 'default'`),
+				ExpectError: regexache.MustCompile(`cannot be 'default'`),
 			},
 		},
 	})
diff --git a/internal/service/events/connection.go b/internal/service/events/connection.go
index ad9c0964cbc..3721f2b2214 100644
--- a/internal/service/events/connection.go
+++ b/internal/service/events/connection.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package events
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/eventbridge"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -106,7 +109,7 @@ func ResourceConnection() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 64),
-					validation.StringMatch(regexp.MustCompile(`^[\.\-_A-Za-z0-9]+`), ""),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_.-]+`), ""),
 				),
 			},
 			"description": {
diff --git a/internal/service/events/connection_data_source.go b/internal/service/events/connection_data_source.go
index 1b6903ce106..4bae5239d03 100644
--- a/internal/service/events/connection_data_source.go
+++ b/internal/service/events/connection_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package events
 
 import (
diff --git a/internal/service/events/connection_data_source_test.go b/internal/service/events/connection_data_source_test.go
index 313ec9e5138..795ca2ce94f 100644
--- a/internal/service/events/connection_data_source_test.go
+++ b/internal/service/events/connection_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package events_test
 
 import (
diff --git a/internal/service/events/connection_test.go b/internal/service/events/connection_test.go
index 48fa4991d70..b37c6de6b7d 100644
--- a/internal/service/events/connection_test.go
+++ b/internal/service/events/connection_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package events_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"strconv"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/eventbridge"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -72,7 +75,7 @@ func TestAccEventsConnection_apiKey(t *testing.T) {
 				),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckConnectionExists(ctx, resourceName, &v2),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "events", regexp.MustCompile(fmt.Sprintf("connection/%s/%s", nameModified, uuidRegex))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "events", regexache.MustCompile(fmt.Sprintf("connection/%s/%s", nameModified, uuidRegex))),
 					testAccCheckConnectionRecreated(&v1, &v2),
 					resource.TestCheckResourceAttr(resourceName, "name", nameModified),
 					resource.TestCheckResourceAttr(resourceName, "description", descriptionModified),
@@ -155,7 +158,7 @@ func TestAccEventsConnection_basic(t *testing.T) {
 				),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckConnectionExists(ctx, resourceName, &v2),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "events", regexp.MustCompile(fmt.Sprintf("connection/%s/%s", nameModified, uuidRegex))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "events", regexache.MustCompile(fmt.Sprintf("connection/%s/%s", nameModified, uuidRegex))),
 					testAccCheckConnectionRecreated(&v1, &v2),
 					resource.TestCheckResourceAttr(resourceName, "name", nameModified),
 					resource.TestCheckResourceAttr(resourceName, "description", descriptionModified),
@@ -310,7 +313,7 @@ func TestAccEventsConnection_oAuth(t *testing.T) {
 				),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckConnectionExists(ctx, resourceName, &v2),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "events", regexp.MustCompile(fmt.Sprintf("connection/%s/%s", nameModified, uuidRegex))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "events", regexache.MustCompile(fmt.Sprintf("connection/%s/%s", nameModified, uuidRegex))),
 					testAccCheckConnectionRecreated(&v1, &v2),
 					resource.TestCheckResourceAttr(resourceName, "name", nameModified),
 					resource.TestCheckResourceAttr(resourceName, "description", descriptionModified),
diff --git a/internal/service/events/consts.go b/internal/service/events/consts.go
index 0bd20d8203c..15e608e3fd2 100644
--- a/internal/service/events/consts.go
+++ b/internal/service/events/consts.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package events
 
 import (
diff --git a/internal/service/events/endpoint.go b/internal/service/events/endpoint.go
index c680b260fba..30573df1b7d 100644
--- a/internal/service/events/endpoint.go
+++ b/internal/service/events/endpoint.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package events
 
 import (
 	"context"
 	"errors"
 	"log"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/eventbridge"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -65,7 +68,7 @@ func ResourceEndpoint() *schema.Resource {
 				Type:         schema.TypeString,
 				Required:     true,
 				ForceNew:     true,
-				ValidateFunc: validation.StringMatch(regexp.MustCompile(`^[\.\-_A-Za-z0-9]{1,64}$`), "Maximum of 64 characters consisting of numbers, lower/upper case letters, .,-,_."),
+				ValidateFunc: validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_.-]{1,64}$`), "Maximum of 64 characters consisting of numbers, lower/upper case letters, .,-,_."),
 			},
 			"replication_config": {
 				Type:     schema.TypeList,
diff --git a/internal/service/events/endpoint_test.go b/internal/service/events/endpoint_test.go
index 2ff50d874e4..01e4d4b86d0 100644
--- a/internal/service/events/endpoint_test.go
+++ b/internal/service/events/endpoint_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package events_test
 
 import (
diff --git a/internal/service/events/find.go b/internal/service/events/find.go
index a023561bbbe..fea8573a59f 100644
--- a/internal/service/events/find.go
+++ b/internal/service/events/find.go
@@ -1,9 +1,12 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package events
 
 import (
 	"context"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/eventbridge"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -63,7 +66,7 @@ func FindTargetByThreePartKey(ctx context.Context, conn *eventbridge.EventBridge
 		return !lastPage
 	})
 
-	if tfawserr.ErrCodeEquals(err, "ValidationException", eventbridge.ErrCodeResourceNotFoundException) || (err != nil && regexp.MustCompile(" not found$").MatchString(err.Error())) {
+	if tfawserr.ErrCodeEquals(err, "ValidationException", eventbridge.ErrCodeResourceNotFoundException) || (err != nil && regexache.MustCompile(" not found$").MatchString(err.Error())) {
 		return nil, &retry.NotFoundError{
 			LastError:   err,
 			LastRequest: input,
diff --git a/internal/service/events/generate.go b/internal/service/events/generate.go
index 3a6f3438e98..9861732aef1 100644
--- a/internal/service/events/generate.go
+++ b/internal/service/events/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/listpages/main.go -ListOps=ListEventBuses,ListRules,ListTargetsByRule
 //go:generate go run ../../generate/tags/main.go -ListTags -ListTagsInIDElem=ResourceARN -ServiceTagsSlice -TagInIDElem=ResourceARN -UpdateTags -CreateTags
 //go:generate go run ../../generate/servicepackage/main.go
diff --git a/internal/service/events/id.go b/internal/service/events/id.go
index 799c778b1f3..8d563b11d78 100644
--- a/internal/service/events/id.go
+++ b/internal/service/events/id.go
@@ -1,14 +1,18 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package events
 
 import (
 	"fmt"
-	"regexp"
 	"strings"
+
+	"github.com/YakDriver/regexache"
 )
 
 var (
-	eventBusARNPattern     = regexp.MustCompile(`^arn:aws[\w-]*:events:[a-z]{2}-[a-z]+-[\w-]+:[0-9]{12}:event-bus\/[\.\-_A-Za-z0-9]+$`)
-	partnerEventBusPattern = regexp.MustCompile(`^aws\.partner(/[\.\-_A-Za-z0-9]+){2,}$`)
+	eventBusARNPattern     = regexache.MustCompile(`^arn:aws[\w-]*:events:[a-z]{2}-[a-z]+-[\w-]+:[0-9]{12}:event-bus\/[0-9A-Za-z_.-]+$`)
+	partnerEventBusPattern = regexache.MustCompile(`^(?:arn:aws[\w-]*:events:[a-z]{2}-[a-z]+-[\w-]+:[0-9]{12}:event-bus\/)?aws\.partner(/[0-9A-Za-z_.-]+){2,}$`)
 )
 
 const permissionResourceIDSeparator = "/"
@@ -76,8 +80,10 @@ func RuleParseResourceID(id string) (string, string, error) {
 
 // Terraform resource IDs for Targets are not parseable as the separator used ("-") is also a valid character in both the rule name and the target ID.
 
-const targetResourceIDSeparator = "-"
-const targetImportIDSeparator = "/"
+const (
+	targetResourceIDSeparator = "-"
+	targetImportIDSeparator   = "/"
+)
 
 func TargetCreateResourceID(eventBusName, ruleName, targetID string) string {
 	var parts []string
diff --git a/internal/service/events/id_test.go b/internal/service/events/id_test.go
index 027104e713e..ba568bfcf40 100644
--- a/internal/service/events/id_test.go
+++ b/internal/service/events/id_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package events_test
 
 import (
@@ -145,6 +148,14 @@ func TestRuleParseResourceID(t *testing.T) {
 			ExpectedPart0: "arn:aws:events:us-east-2:123456789012:event-bus/default",
 			ExpectedPart1: "TestRule",
 		},
+		{
+			TestName: "ARN based partner event bus",
+			// lintignore:AWSAT003,AWSAT005
+			InputID: "arn:aws:events:us-east-2:123456789012:event-bus/aws.partner/genesys.com/cloud/a12bc345-d678-90e1-2f34-gh5678i9012ej/_genesys/TestRule",
+			// lintignore:AWSAT003,AWSAT005
+			ExpectedPart0: "arn:aws:events:us-east-2:123456789012:event-bus/aws.partner/genesys.com/cloud/a12bc345-d678-90e1-2f34-gh5678i9012ej/_genesys",
+			ExpectedPart1: "TestRule",
+		},
 		{
 			TestName:      "empty both parts",
 			InputID:       "/",
@@ -314,6 +325,15 @@ func TestTargetParseImportID(t *testing.T) {
 			ExpectedPart1: "TestRule",
 			ExpectedPart2: "TestTarget",
 		},
+		{
+			TestName: "ARN based partner event bus",
+			// lintignore:AWSAT003,AWSAT005
+			InputID: "arn:aws:events:us-east-2:123456789012:event-bus/aws.partner/genesys.com/cloud/a12bc345-d678-90e1-2f34-gh5678i9012ej/_genesys/TestRule/TestTarget",
+			// lintignore:AWSAT003,AWSAT005
+			ExpectedPart0: "arn:aws:events:us-east-2:123456789012:event-bus/aws.partner/genesys.com/cloud/a12bc345-d678-90e1-2f34-gh5678i9012ej/_genesys",
+			ExpectedPart1: "TestRule",
+			ExpectedPart2: "TestTarget",
+		},
 		{
 			TestName:      "empty partner event rule and target",
 			InputID:       "aws.partner/example.com/Test//",
diff --git a/internal/service/events/permission.go b/internal/service/events/permission.go
index 40b010ecaf0..6e338084f78 100644
--- a/internal/service/events/permission.go
+++ b/internal/service/events/permission.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package events
 
 import (
@@ -5,8 +8,8 @@ import (
 	"encoding/json"
 	"fmt"
 	"log"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/aws/aws-sdk-go/aws/awsutil"
@@ -266,7 +269,7 @@ func validatePermissionAction(v interface{}, k string) (ws []string, es []error)
 		es = append(es, fmt.Errorf("%q must be between 1 and 64 characters", k))
 	}
 
-	if !regexp.MustCompile(`^events:[a-zA-Z]+$`).MatchString(value) {
+	if !regexache.MustCompile(`^events:[A-Za-z]+$`).MatchString(value) {
 		es = append(es, fmt.Errorf("%q must be: events: followed by one or more alphabetic characters", k))
 	}
 	return
@@ -275,7 +278,7 @@ func validatePermissionAction(v interface{}, k string) (ws []string, es []error)
 // https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_PutPermission.html#API_PutPermission_RequestParameters
 func validatePermissionPrincipal(v interface{}, k string) (ws []string, es []error) {
 	value := v.(string)
-	if !regexp.MustCompile(`^(\d{12}|\*)$`).MatchString(value) {
+	if !regexache.MustCompile(`^(\d{12}|\*)$`).MatchString(value) {
 		es = append(es, fmt.Errorf("%q must be * or a 12 digit AWS account ID", k))
 	}
 	return
@@ -288,7 +291,7 @@ func validatePermissionStatementID(v interface{}, k string) (ws []string, es []e
 		es = append(es, fmt.Errorf("%q must be between 1 and 64 characters", k))
 	}
 
-	if !regexp.MustCompile(`^[a-zA-Z0-9-_]+$`).MatchString(value) {
+	if !regexache.MustCompile(`^[0-9A-Za-z_-]+$`).MatchString(value) {
 		es = append(es, fmt.Errorf("%q must be one or more alphanumeric, hyphen, or underscore characters", k))
 	}
 	return
diff --git a/internal/service/events/permission_test.go b/internal/service/events/permission_test.go
index 4e675e6e11d..aa382594e81 100644
--- a/internal/service/events/permission_test.go
+++ b/internal/service/events/permission_test.go
@@ -1,13 +1,16 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package events_test
 
 import (
 	"context"
 	"encoding/json"
 	"fmt"
-	"regexp"
 	"testing"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/eventbridge"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -35,31 +38,31 @@ func TestAccEventsPermission_basic(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccPermissionConfig_basic("", statementID),
-				ExpectError: regexp.MustCompile(`must be \* or a 12 digit AWS account ID`),
+				ExpectError: regexache.MustCompile(`must be \* or a 12 digit AWS account ID`),
 			},
 			{
 				Config:      testAccPermissionConfig_basic(".", statementID),
-				ExpectError: regexp.MustCompile(`must be \* or a 12 digit AWS account ID`),
+				ExpectError: regexache.MustCompile(`must be \* or a 12 digit AWS account ID`),
 			},
 			{
 				Config:      testAccPermissionConfig_basic("12345678901", statementID),
-				ExpectError: regexp.MustCompile(`must be \* or a 12 digit AWS account ID`),
+				ExpectError: regexache.MustCompile(`must be \* or a 12 digit AWS account ID`),
 			},
 			{
 				Config:      testAccPermissionConfig_basic("abcdefghijkl", statementID),
-				ExpectError: regexp.MustCompile(`must be \* or a 12 digit AWS account ID`),
+				ExpectError: regexache.MustCompile(`must be \* or a 12 digit AWS account ID`),
 			},
 			{
 				Config:      testAccPermissionConfig_basic(principal1, ""),
-				ExpectError: regexp.MustCompile(`must be between 1 and 64 characters`),
+				ExpectError: regexache.MustCompile(`must be between 1 and 64 characters`),
 			},
 			{
 				Config:      testAccPermissionConfig_basic(principal1, sdkacctest.RandString(65)),
-				ExpectError: regexp.MustCompile(`must be between 1 and 64 characters`),
+				ExpectError: regexache.MustCompile(`must be between 1 and 64 characters`),
 			},
 			{
 				Config:      testAccPermissionConfig_basic(principal1, " "),
-				ExpectError: regexp.MustCompile(`must be one or more alphanumeric, hyphen, or underscore characters`),
+				ExpectError: regexache.MustCompile(`must be one or more alphanumeric, hyphen, or underscore characters`),
 			},
 			{
 				Config: testAccPermissionConfig_basic(principal1, statementID),
@@ -140,19 +143,19 @@ func TestAccEventsPermission_action(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccPermissionConfig_action("", principal, statementID),
-				ExpectError: regexp.MustCompile(`must be between 1 and 64 characters`),
+				ExpectError: regexache.MustCompile(`must be between 1 and 64 characters`),
 			},
 			{
 				Config:      testAccPermissionConfig_action(sdkacctest.RandString(65), principal, statementID),
-				ExpectError: regexp.MustCompile(`must be between 1 and 64 characters`),
+				ExpectError: regexache.MustCompile(`must be between 1 and 64 characters`),
 			},
 			{
 				Config:      testAccPermissionConfig_action("events:", principal, statementID),
-				ExpectError: regexp.MustCompile(`must be: events: followed by one or more alphabetic characters`),
+				ExpectError: regexache.MustCompile(`must be: events: followed by one or more alphabetic characters`),
 			},
 			{
 				Config:      testAccPermissionConfig_action("events:1", principal, statementID),
-				ExpectError: regexp.MustCompile(`must be: events: followed by one or more alphabetic characters`),
+				ExpectError: regexache.MustCompile(`must be: events: followed by one or more alphabetic characters`),
 			},
 			{
 				Config: testAccPermissionConfig_action("events:PutEvents", principal, statementID),
diff --git a/internal/service/events/rule.go b/internal/service/events/rule.go
index 6a6c4370662..8ccf033a5b8 100644
--- a/internal/service/events/rule.go
+++ b/internal/service/events/rule.go
@@ -1,7 +1,12 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package events
 
 import (
+	"bytes"
 	"context"
+	"encoding/json"
 	"fmt"
 	"log"
 	"time"
@@ -12,7 +17,6 @@ import (
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/structure"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/create"
@@ -65,7 +69,7 @@ func ResourceRule() *schema.Resource {
 				ValidateFunc: validateEventPatternValue(),
 				AtLeastOneOf: []string{"schedule_expression", "event_pattern"},
 				StateFunc: func(v interface{}) string {
-					json, _ := structure.NormalizeJsonString(v.(string))
+					json, _ := RuleEventPatternJSONDecoder(v.(string))
 					return json
 				},
 			},
@@ -185,7 +189,7 @@ func resourceRuleRead(ctx context.Context, d *schema.ResourceData, meta interfac
 	d.Set("description", output.Description)
 	d.Set("event_bus_name", eventBusName) // Use event bus name from resource ID as API response may collapse any ARN.
 	if output.EventPattern != nil {
-		pattern, err := structure.NormalizeJsonString(aws.StringValue(output.EventPattern))
+		pattern, err := RuleEventPatternJSONDecoder(aws.StringValue(output.EventPattern))
 		if err != nil {
 			return sdkdiag.AppendErrorf(diags, "event pattern contains an invalid JSON: %s", err)
 		}
@@ -295,6 +299,34 @@ func FindRuleByTwoPartKey(ctx context.Context, conn *eventbridge.EventBridge, ev
 	return output, nil
 }
 
+// RuleEventPatternJSONDecoder decodes unicode translation of <,>,&
+func RuleEventPatternJSONDecoder(jsonString interface{}) (string, error) {
+	var j interface{}
+
+	if jsonString == nil || jsonString.(string) == "" {
+		return "", nil
+	}
+
+	s := jsonString.(string)
+
+	err := json.Unmarshal([]byte(s), &j)
+	if err != nil {
+		return s, err
+	}
+
+	b, err := json.Marshal(j)
+	if err != nil {
+		return "", err
+	}
+
+	if bytes.Contains(b, []byte("\\u003c")) || bytes.Contains(b, []byte("\\u003e")) || bytes.Contains(b, []byte("\\u0026")) {
+		b = bytes.Replace(b, []byte("\\u003c"), []byte("<"), -1)
+		b = bytes.Replace(b, []byte("\\u003e"), []byte(">"), -1)
+		b = bytes.Replace(b, []byte("\\u0026"), []byte("&"), -1)
+	}
+	return string(b[:]), nil
+}
+
 func expandPutRuleInput(d *schema.ResourceData, name string) *eventbridge.PutRuleInput {
 	apiObject := &eventbridge.PutRuleInput{
 		Name: aws.String(name),
@@ -309,7 +341,7 @@ func expandPutRuleInput(d *schema.ResourceData, name string) *eventbridge.PutRul
 	}
 
 	if v, ok := d.GetOk("event_pattern"); ok {
-		json, _ := structure.NormalizeJsonString(v)
+		json, _ := RuleEventPatternJSONDecoder(v.(string))
 		apiObject.EventPattern = aws.String(json)
 	}
 
@@ -332,7 +364,7 @@ func expandPutRuleInput(d *schema.ResourceData, name string) *eventbridge.PutRul
 
 func validateEventPatternValue() schema.SchemaValidateFunc {
 	return func(v interface{}, k string) (ws []string, errors []error) {
-		json, err := structure.NormalizeJsonString(v)
+		json, err := RuleEventPatternJSONDecoder(v.(string))
 		if err != nil {
 			errors = append(errors, fmt.Errorf("%q contains an invalid JSON: %w", k, err))
 
diff --git a/internal/service/events/rule_test.go b/internal/service/events/rule_test.go
index 6383dff823c..4484f529502 100644
--- a/internal/service/events/rule_test.go
+++ b/internal/service/events/rule_test.go
@@ -1,14 +1,18 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package events_test
 
 import (
 	"context"
 	"fmt"
 	"os"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/eventbridge"
+	"github.com/google/go-cmp/cmp"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
@@ -29,6 +33,41 @@ func testAccErrorCheckSkip(t *testing.T) resource.ErrorCheckFunc {
 	)
 }
 
+func TestRuleEventPatternJSONDecoder(t *testing.T) {
+	t.Parallel()
+
+	type testCase struct {
+		input    string
+		expected string
+	}
+	tests := map[string]testCase{
+		"lessThanGreaterThan": {
+			input:    `{"detail":{"count":[{"numeric":["\u003e",0,"\u003c",5]}]}}`,
+			expected: `{"detail":{"count":[{"numeric":[">",0,"<",5]}]}}`,
+		},
+		"ampersand": {
+			input:    `{"detail":{"count":[{"numeric":["\u0026",0,"\u0026",5]}]}}`,
+			expected: `{"detail":{"count":[{"numeric":["&",0,"&",5]}]}}`,
+		},
+	}
+
+	for name, test := range tests {
+		name, test := name, test
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			got, err := tfevents.RuleEventPatternJSONDecoder(test.input)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			if diff := cmp.Diff(got, test.expected); diff != "" {
+				t.Errorf("unexpected diff (+wanted, -got): %s", diff)
+			}
+		})
+	}
+}
+
 func TestAccEventsRule_basic(t *testing.T) {
 	ctx := acctest.Context(t)
 	var v1, v2, v3 eventbridge.DescribeRuleOutput
@@ -46,7 +85,7 @@ func TestAccEventsRule_basic(t *testing.T) {
 				Config: testAccRuleConfig_basic(rName1),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRuleExists(ctx, resourceName, &v1),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "events", regexp.MustCompile(fmt.Sprintf(`rule/%s$`, rName1))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "events", regexache.MustCompile(fmt.Sprintf(`rule/%s$`, rName1))),
 					resource.TestCheckResourceAttr(resourceName, "name", rName1),
 					resource.TestCheckResourceAttr(resourceName, "name_prefix", ""),
 					resource.TestCheckResourceAttr(resourceName, "schedule_expression", "rate(1 hour)"),
@@ -75,7 +114,7 @@ func TestAccEventsRule_basic(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRuleExists(ctx, resourceName, &v2),
 					testAccCheckRuleRecreated(&v1, &v2),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "events", regexp.MustCompile(fmt.Sprintf(`rule/%s$`, rName2))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "events", regexache.MustCompile(fmt.Sprintf(`rule/%s$`, rName2))),
 					resource.TestCheckResourceAttr(resourceName, "name", rName2),
 					resource.TestCheckResourceAttr(resourceName, "event_bus_name", "default"),
 					resource.TestCheckResourceAttr(resourceName, "schedule_expression", "rate(1 hour)"),
@@ -89,7 +128,7 @@ func TestAccEventsRule_basic(t *testing.T) {
 				Config: testAccRuleConfig_defaultBusName(rName2),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRuleExists(ctx, resourceName, &v3),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "events", regexp.MustCompile(fmt.Sprintf(`rule/%s$`, rName2))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "events", regexache.MustCompile(fmt.Sprintf(`rule/%s$`, rName2))),
 					testAccCheckRuleNotRecreated(&v2, &v3),
 					resource.TestCheckResourceAttr(resourceName, "name", rName2),
 					resource.TestCheckResourceAttr(resourceName, "event_bus_name", "default"),
@@ -120,7 +159,7 @@ func TestAccEventsRule_eventBusName(t *testing.T) {
 					testAccCheckRuleExists(ctx, resourceName, &v1),
 					resource.TestCheckResourceAttr(resourceName, "name", rName1),
 					resource.TestCheckResourceAttr(resourceName, "event_bus_name", busName1),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "events", regexp.MustCompile(fmt.Sprintf(`rule/%s/%s$`, busName1, rName1))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "events", regexache.MustCompile(fmt.Sprintf(`rule/%s/%s$`, busName1, rName1))),
 				),
 			},
 			{
@@ -144,7 +183,7 @@ func TestAccEventsRule_eventBusName(t *testing.T) {
 					testAccCheckRuleRecreated(&v2, &v3),
 					resource.TestCheckResourceAttr(resourceName, "name", rName2),
 					resource.TestCheckResourceAttr(resourceName, "event_bus_name", busName2),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "events", regexp.MustCompile(fmt.Sprintf(`rule/%s/%s$`, busName2, rName2))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "events", regexache.MustCompile(fmt.Sprintf(`rule/%s/%s$`, busName2, rName2))),
 				),
 			},
 		},
@@ -256,6 +295,31 @@ func TestAccEventsRule_pattern(t *testing.T) {
 	})
 }
 
+func TestAccEventsRule_patternJSONEncoder(t *testing.T) {
+	ctx := acctest.Context(t)
+	var v1 eventbridge.DescribeRuleOutput
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_cloudwatch_event_rule.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, eventbridge.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckRuleDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccRuleConfig_patternJSONEncoder(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckRuleExists(ctx, resourceName, &v1),
+					resource.TestCheckResourceAttr(resourceName, "name", rName),
+					resource.TestCheckResourceAttr(resourceName, "schedule_expression", ""),
+					acctest.CheckResourceAttrEquivalentJSON(resourceName, "event_pattern", `{"detail":{"count":[{"numeric":[">",0,"<",5]}]}}`),
+				),
+			},
+		},
+	})
+}
+
 func TestAccEventsRule_scheduleAndPattern(t *testing.T) {
 	ctx := acctest.Context(t)
 	var v eventbridge.DescribeRuleOutput
@@ -456,7 +520,7 @@ func TestAccEventsRule_partnerEventBus(t *testing.T) {
 				Config: testAccRuleConfig_partnerBus(rName, busName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRuleExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "events", regexp.MustCompile(fmt.Sprintf(`rule/%s/%s$`, busName, rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "events", regexache.MustCompile(fmt.Sprintf(`rule/%s/%s$`, busName, rName))),
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
 					resource.TestCheckResourceAttr(resourceName, "event_bus_name", busName),
 					acctest.CheckResourceAttrEquivalentJSON(resourceName, "event_pattern", "{\"source\":[\"aws.ec2\"]}"),
@@ -493,7 +557,7 @@ func TestAccEventsRule_eventBusARN(t *testing.T) {
 				Config: testAccRuleConfig_busARN(rName, eventBusName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRuleExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "events", regexp.MustCompile(fmt.Sprintf(`rule/%s/%s$`, eventBusName, rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "events", regexache.MustCompile(fmt.Sprintf(`rule/%s/%s$`, eventBusName, rName))),
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
 					resource.TestCheckResourceAttrPair(resourceName, "event_bus_name", "aws_cloudwatch_event_bus.test", "arn"),
 					acctest.CheckResourceAttrEquivalentJSON(resourceName, "event_pattern", "{\"source\":[\"aws.ec2\"]}"),
@@ -685,6 +749,15 @@ PATTERN
 `, rName, pattern)
 }
 
+func testAccRuleConfig_patternJSONEncoder(rName string) string {
+	return fmt.Sprintf(`
+resource "aws_cloudwatch_event_rule" "test" {
+  name          = %[1]q
+  event_pattern = jsonencode({ "detail" : { "count" : [{ "numeric" : [">", 0, "<", 5] }] } })
+}
+`, rName)
+}
+
 func testAccRuleConfig_scheduleAndPattern(rName, pattern string) string {
 	return fmt.Sprintf(`
 resource "aws_cloudwatch_event_rule" "test" {
diff --git a/internal/service/events/service_package_gen.go b/internal/service/events/service_package_gen.go
index 82339085e7a..727fc83c172 100644
--- a/internal/service/events/service_package_gen.go
+++ b/internal/service/events/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	eventbridge_sdkv1 "github.com/aws/aws-sdk-go/service/eventbridge"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -100,4 +101,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*e
 	return eventbridge_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/events/source_data_source.go b/internal/service/events/source_data_source.go
index bd1693e5f6a..1a95588d741 100644
--- a/internal/service/events/source_data_source.go
+++ b/internal/service/events/source_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package events
 
 import (
diff --git a/internal/service/events/source_data_source_test.go b/internal/service/events/source_data_source_test.go
index 68236a117cd..3e4390db89c 100644
--- a/internal/service/events/source_data_source_test.go
+++ b/internal/service/events/source_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package events_test
 
 import (
diff --git a/internal/service/events/status.go b/internal/service/events/status.go
index 0db4838bd6f..37a7c3aef54 100644
--- a/internal/service/events/status.go
+++ b/internal/service/events/status.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package events
 
 import (
diff --git a/internal/service/events/sweep.go b/internal/service/events/sweep.go
index e7059325ec3..7e0333d3f5a 100644
--- a/internal/service/events/sweep.go
+++ b/internal/service/events/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package events
 
@@ -13,9 +13,10 @@ import (
 	"github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_cloudwatch_event_api_destination", &resource.Sweeper{
 		Name: "aws_cloudwatch_event_api_destination",
 		F:    sweepAPIDestination,
@@ -68,7 +69,7 @@ func init() {
 
 func sweepAPIDestination(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("Error getting client: %w", err)
 	}
@@ -83,7 +84,7 @@ func sweepAPIDestination(region string) error {
 	for {
 		output, err := conn.ListApiDestinationsWithContext(ctx, input)
 
-		if sweep.SkipSweepError(err) {
+		if awsv1.SkipSweepError(err) {
 			log.Printf("[WARN] Skipping EventBridge API Destination sweep for %s: %s", region, err)
 			return nil
 		}
@@ -101,7 +102,6 @@ func sweepAPIDestination(region string) error {
 	}
 
 	for _, apiDestination := range apiDestinations {
-
 		input := &eventbridge.DeleteApiDestinationInput{
 			Name: apiDestination.Name,
 		}
@@ -119,7 +119,7 @@ func sweepAPIDestination(region string) error {
 
 func sweepArchives(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("Error getting client: %w", err)
 	}
@@ -130,7 +130,7 @@ func sweepArchives(region string) error {
 	for {
 		output, err := conn.ListArchivesWithContext(ctx, input)
 
-		if sweep.SkipSweepError(err) {
+		if awsv1.SkipSweepError(err) {
 			log.Printf("[WARN] Skipping EventBridge archive sweep for %s: %s", region, err)
 			return nil
 		}
@@ -170,7 +170,7 @@ func sweepArchives(region string) error {
 
 func sweepBuses(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("Error getting client: %w", err)
 	}
@@ -200,7 +200,7 @@ func sweepBuses(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping EventBridge event bus sweep for %s: %s", region, err)
 		return sweeperErrs.ErrorOrNil() // In case we have completed some pages, but had errors
 	}
@@ -208,7 +208,7 @@ func sweepBuses(region string) error {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error listing EventBridge event buses: %w", err))
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error sweeping EventBridge Event Buses: %w", err))
 	}
 
@@ -217,7 +217,7 @@ func sweepBuses(region string) error {
 
 func sweepConnection(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("Error getting client: %w", err)
 	}
@@ -232,7 +232,7 @@ func sweepConnection(region string) error {
 	for {
 		output, err := conn.ListConnectionsWithContext(ctx, input)
 
-		if sweep.SkipSweepError(err) {
+		if awsv1.SkipSweepError(err) {
 			log.Printf("[WARN] Skipping EventBridge Connection sweep for %s: %s", region, err)
 			return nil
 		}
@@ -265,7 +265,7 @@ func sweepConnection(region string) error {
 
 func sweepPermissions(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("Error getting client: %w", err)
 	}
@@ -273,7 +273,7 @@ func sweepPermissions(region string) error {
 
 	output, err := conn.DescribeEventBusWithContext(ctx, &eventbridge.DescribeEventBusInput{})
 	if err != nil {
-		if sweep.SkipSweepError(err) {
+		if awsv1.SkipSweepError(err) {
 			log.Printf("[WARN] Skipping EventBridge Permission sweep for %s: %s", region, err)
 			return nil
 		}
@@ -310,7 +310,7 @@ func sweepPermissions(region string) error {
 
 func sweepRules(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
@@ -354,7 +354,7 @@ func sweepRules(region string) error {
 				return !lastPage
 			})
 
-			if sweep.SkipSweepError(err) {
+			if awsv1.SkipSweepError(err) {
 				continue
 			}
 
@@ -366,7 +366,7 @@ func sweepRules(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping EventBridge Rule sweep for %s: %s", region, err)
 		return sweeperErrs.ErrorOrNil() // In case we have completed some pages, but had errors
 	}
@@ -380,7 +380,7 @@ func sweepRules(region string) error {
 
 func sweepTargets(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
@@ -438,7 +438,7 @@ func sweepTargets(region string) error {
 						return !lastPage
 					})
 
-					if sweep.SkipSweepError(err) {
+					if awsv1.SkipSweepError(err) {
 						continue
 					}
 
@@ -450,7 +450,7 @@ func sweepTargets(region string) error {
 				return !lastPage
 			})
 
-			if sweep.SkipSweepError(err) {
+			if awsv1.SkipSweepError(err) {
 				continue
 			}
 
@@ -462,7 +462,7 @@ func sweepTargets(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping EventBridge Rule sweep for %s: %s", region, err)
 		return sweeperErrs.ErrorOrNil() // In case we have completed some pages, but had errors
 	}
diff --git a/internal/service/events/tags_gen.go b/internal/service/events/tags_gen.go
index 6dab6ba9bd7..25a666e566f 100644
--- a/internal/service/events/tags_gen.go
+++ b/internal/service/events/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/eventbridge"
 	"github.com/aws/aws-sdk-go/service/eventbridge/eventbridgeiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -111,6 +113,8 @@ func updateTags(ctx context.Context, conn eventbridgeiface.EventBridgeAPI, ident
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.Events)
 	if len(removedTags) > 0 {
diff --git a/internal/service/events/target.go b/internal/service/events/target.go
index 102c7857878..9bb1c282eeb 100644
--- a/internal/service/events/target.go
+++ b/internal/service/events/target.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package events
 
 import (
@@ -5,8 +8,8 @@ import (
 	"fmt"
 	"log"
 	"math"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/awserr"
 	"github.com/aws/aws-sdk-go/service/eventbridge"
@@ -244,9 +247,9 @@ func ResourceTarget() *schema.Resource {
 							Optional: true,
 							ValidateDiagFunc: allDiagFunc(
 								validation.MapKeyLenBetween(0, 512),
-								validation.MapKeyMatch(regexp.MustCompile(`^[!#$%&'*+-.^_|~0-9a-zA-Z]+$`), ""),
+								validation.MapKeyMatch(regexache.MustCompile(`^[0-9A-Za-z_!#$%&'*+,.^|~-]+$`), ""), // was "," meant to be included? +-. creates a range including: +,-.
 								validation.MapValueLenBetween(0, 512),
-								validation.MapValueMatch(regexp.MustCompile(`^[ \t]*[\x20-\x7E]+([ \t]+[\x20-\x7E]+)*[ \t]*$`), ""),
+								validation.MapValueMatch(regexache.MustCompile(`^[ \t]*[\x20-\x7E]+([ \t]+[\x20-\x7E]+)*[ \t]*$`), ""),
 							),
 							Elem: &schema.Schema{Type: schema.TypeString},
 						},
@@ -260,9 +263,9 @@ func ResourceTarget() *schema.Resource {
 							Optional: true,
 							ValidateDiagFunc: allDiagFunc(
 								validation.MapKeyLenBetween(0, 512),
-								validation.MapKeyMatch(regexp.MustCompile(`[^\x00-\x1F\x7F]+`), ""),
+								validation.MapKeyMatch(regexache.MustCompile(`[^\x00-\x1F\x7F]+`), ""),
 								validation.MapValueLenBetween(0, 512),
-								validation.MapValueMatch(regexp.MustCompile(`[^\x00-\x09\x0B\x0C\x0E-\x1F\x7F]+`), ""),
+								validation.MapValueMatch(regexache.MustCompile(`[^\x00-\x09\x0B\x0C\x0E-\x1F\x7F]+`), ""),
 							),
 							Elem: &schema.Schema{Type: schema.TypeString},
 						},
@@ -299,7 +302,7 @@ func ResourceTarget() *schema.Resource {
 							Elem:     &schema.Schema{Type: schema.TypeString},
 							ValidateFunc: validation.All(
 								mapMaxItems(targetInputTransformerMaxInputPaths),
-								mapKeysDoNotMatch(regexp.MustCompile(`^AWS.*$`), "input_path must not start with \"AWS\""),
+								mapKeysDoNotMatch(regexache.MustCompile(`^AWS.*$`), "input_path must not start with \"AWS\""),
 							),
 						},
 						"input_template": {
@@ -415,6 +418,33 @@ func ResourceTarget() *schema.Resource {
 					},
 				},
 			},
+			"sagemaker_pipeline_target": {
+				Type:             schema.TypeList,
+				Optional:         true,
+				MaxItems:         1,
+				DiffSuppressFunc: verify.SuppressMissingOptionalConfigurationBlock,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"pipeline_parameter_list": {
+							Type:     schema.TypeSet,
+							Optional: true,
+							MaxItems: 200,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"name": {
+										Type:     schema.TypeString,
+										Required: true,
+									},
+									"value": {
+										Type:     schema.TypeString,
+										Required: true,
+									},
+								},
+							},
+						},
+					},
+				},
+			},
 			"sqs_target": {
 				Type:     schema.TypeList,
 				Optional: true,
@@ -537,6 +567,12 @@ func resourceTargetRead(ctx context.Context, d *schema.ResourceData, meta interf
 		}
 	}
 
+	if t.SageMakerPipelineParameters != nil {
+		if err := d.Set("sagemaker_pipeline_target", flattenTargetSageMakerPipelineParameters(t.SageMakerPipelineParameters)); err != nil {
+			return diag.Errorf("setting sagemaker_pipeline_parameters: %s", err)
+		}
+	}
+
 	if t.SqsParameters != nil {
 		if err := d.Set("sqs_target", flattenTargetSQSParameters(t.SqsParameters)); err != nil {
 			return diag.Errorf("setting sqs_target: %s", err)
@@ -698,6 +734,10 @@ func buildPutTargetInputStruct(ctx context.Context, d *schema.ResourceData) *eve
 		e.SqsParameters = expandTargetSQSParameters(v.([]interface{}))
 	}
 
+	if v, ok := d.GetOk("sagemaker_pipeline_target"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
+		e.SageMakerPipelineParameters = expandTargetSageMakerPipelineParameters(v.([]interface{}))
+	}
+
 	if v, ok := d.GetOk("input_transformer"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
 		e.InputTransformer = expandTransformerParameters(v.([]interface{}))
 	}
@@ -915,6 +955,48 @@ func expandTargetSQSParameters(config []interface{}) *eventbridge.SqsParameters
 	return sqsParameters
 }
 
+func expandTargetSageMakerPipelineParameterList(tfList []interface{}) []*eventbridge.SageMakerPipelineParameter {
+	if len(tfList) == 0 {
+		return nil
+	}
+
+	var result []*eventbridge.SageMakerPipelineParameter
+
+	for _, tfMapRaw := range tfList {
+		if tfMapRaw == nil {
+			continue
+		}
+
+		tfMap := tfMapRaw.(map[string]interface{})
+
+		apiObject := &eventbridge.SageMakerPipelineParameter{}
+
+		if v, ok := tfMap["name"].(string); ok && v != "" {
+			apiObject.Name = aws.String(v)
+		}
+
+		if v, ok := tfMap["value"].(string); ok && v != "" {
+			apiObject.Value = aws.String(v)
+		}
+
+		result = append(result, apiObject)
+	}
+
+	return result
+}
+
+func expandTargetSageMakerPipelineParameters(config []interface{}) *eventbridge.SageMakerPipelineParameters {
+	sageMakerPipelineParameters := &eventbridge.SageMakerPipelineParameters{}
+	for _, c := range config {
+		param := c.(map[string]interface{})
+		if v, ok := param["pipeline_parameter_list"].(*schema.Set); ok && v.Len() > 0 {
+			sageMakerPipelineParameters.PipelineParameterList = expandTargetSageMakerPipelineParameterList(v.List())
+		}
+	}
+
+	return sageMakerPipelineParameters
+}
+
 func expandTargetHTTPParameters(tfMap map[string]interface{}) *eventbridge.HttpParameters {
 	if tfMap == nil {
 		return nil
@@ -1066,6 +1148,28 @@ func flattenTargetKinesisParameters(kinesisParameters *eventbridge.KinesisParame
 	return result
 }
 
+func flattenTargetSageMakerPipelineParameters(sageMakerParameters *eventbridge.SageMakerPipelineParameters) []map[string]interface{} {
+	config := make(map[string]interface{})
+	config["pipeline_parameter_list"] = flattenTargetSageMakerPipelineParameter(sageMakerParameters.PipelineParameterList)
+	result := []map[string]interface{}{config}
+	return result
+}
+
+func flattenTargetSageMakerPipelineParameter(pcs []*eventbridge.SageMakerPipelineParameter) []map[string]interface{} {
+	if len(pcs) == 0 {
+		return nil
+	}
+	results := make([]map[string]interface{}, 0)
+	for _, pc := range pcs {
+		c := make(map[string]interface{})
+		c["name"] = aws.StringValue(pc.Name)
+		c["value"] = aws.StringValue(pc.Value)
+
+		results = append(results, c)
+	}
+	return results
+}
+
 func flattenTargetSQSParameters(sqsParameters *eventbridge.SqsParameters) []map[string]interface{} {
 	config := make(map[string]interface{})
 	config["message_group_id"] = aws.StringValue(sqsParameters.MessageGroupId)
diff --git a/internal/service/events/target_migrate.go b/internal/service/events/target_migrate.go
index 7a6315a0c71..952f2bdfc1e 100644
--- a/internal/service/events/target_migrate.go
+++ b/internal/service/events/target_migrate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package events
 
 import (
diff --git a/internal/service/events/target_migrate_test.go b/internal/service/events/target_migrate_test.go
index b2a351014ba..f3370d6e898 100644
--- a/internal/service/events/target_migrate_test.go
+++ b/internal/service/events/target_migrate_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package events_test
 
 import (
diff --git a/internal/service/events/target_test.go b/internal/service/events/target_test.go
index 74275d5190a..520d6bf1be0 100644
--- a/internal/service/events/target_test.go
+++ b/internal/service/events/target_test.go
@@ -1,14 +1,17 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package events_test
 
 import (
 	"context"
 	"fmt"
 	"os"
-	"regexp"
 	"strconv"
 	"strings"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws/endpoints"
 	"github.com/aws/aws-sdk-go/service/eventbridge"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -35,23 +38,26 @@ func TestAccEventsTarget_basic(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config: testAccTargetConfig_basic(rName),
-				Check: resource.ComposeTestCheckFunc(
+				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckTargetExists(ctx, resourceName, &v),
-					resource.TestCheckResourceAttr(resourceName, "rule", rName),
-					resource.TestCheckResourceAttr(resourceName, "event_bus_name", "default"),
-					resource.TestCheckResourceAttr(resourceName, "target_id", rName),
 					resource.TestCheckResourceAttrPair(resourceName, "arn", snsTopicResourceName, "arn"),
-
-					resource.TestCheckResourceAttr(resourceName, "input", ""),
-					resource.TestCheckResourceAttr(resourceName, "input_path", ""),
-					resource.TestCheckResourceAttr(resourceName, "role_arn", ""),
-					resource.TestCheckResourceAttr(resourceName, "run_command_targets.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "batch_target.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "dead_letter_config.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "ecs_target.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "event_bus_name", "default"),
 					resource.TestCheckResourceAttr(resourceName, "http_target.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "input", ""),
+					resource.TestCheckResourceAttr(resourceName, "input_path", ""),
+					resource.TestCheckResourceAttr(resourceName, "input_transformer.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "kinesis_target.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "redshift_target.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "retry_policy.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "role_arn", ""),
+					resource.TestCheckResourceAttr(resourceName, "rule", rName),
+					resource.TestCheckResourceAttr(resourceName, "run_command_targets.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "sagemaker_pipeline_target.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "sqs_target.#", "0"),
-					resource.TestCheckResourceAttr(resourceName, "input_transformer.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_id", rName),
 				),
 			},
 			{
@@ -155,8 +161,8 @@ func TestAccEventsTarget_eventBusARN(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckTargetExists(ctx, resourceName, &v),
 					resource.TestCheckResourceAttr(resourceName, "rule", ruleName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "events", regexp.MustCompile(fmt.Sprintf("event-bus/%s", destinationEventBusName))),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "event_bus_name", "events", regexp.MustCompile(fmt.Sprintf("event-bus/%s", originEventBusName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "events", regexache.MustCompile(fmt.Sprintf("event-bus/%s", destinationEventBusName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "event_bus_name", "events", regexache.MustCompile(fmt.Sprintf("event-bus/%s", originEventBusName))),
 					resource.TestCheckResourceAttr(resourceName, "target_id", targetID),
 				),
 			},
@@ -815,6 +821,41 @@ func TestAccEventsTarget_sqs(t *testing.T) {
 	})
 }
 
+func TestAccEventsTarget_sageMakerPipeline(t *testing.T) {
+	ctx := acctest.Context(t)
+	var v eventbridge.Target
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_cloudwatch_event_target.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, eventbridge.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckTargetDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccTargetConfig_sageMakerPipeline(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckTargetExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttrPair(resourceName, "arn", "aws_sagemaker_pipeline.test", "arn"),
+					resource.TestCheckResourceAttr(resourceName, "sagemaker_pipeline_target.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "sagemaker_pipeline_target.0.pipeline_parameter_list.#", "1"),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "sagemaker_pipeline_target.0.pipeline_parameter_list.*", map[string]string{
+						"name":  "key",
+						"value": "value",
+					}),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateIdFunc: testAccTargetImportStateIdFunc(resourceName),
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
 func TestAccEventsTarget_Input_transformer(t *testing.T) {
 	ctx := acctest.Context(t)
 	resourceName := "aws_cloudwatch_event_target.test"
@@ -851,7 +892,7 @@ func TestAccEventsTarget_Input_transformer(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccTargetConfig_inputTransformer(rName, tooManyInputPaths),
-				ExpectError: regexp.MustCompile(`.*expected number of items in.* to be less than or equal to.*`),
+				ExpectError: regexache.MustCompile(`.*expected number of items in.* to be less than or equal to.*`),
 			},
 			{
 				Config: testAccTargetConfig_inputTransformer(rName, validInputPaths),
@@ -2180,6 +2221,107 @@ resource "aws_sqs_queue" "test" {
 `, rName)
 }
 
+func testAccTargetConfig_sageMakerPipeline(rName string) string {
+	return fmt.Sprintf(`
+data "aws_partition" "current" {}
+
+resource "aws_cloudwatch_event_rule" "test" {
+  name                = %[1]q
+  description         = "schedule_batch_test"
+  schedule_expression = "rate(5 minutes)"
+}
+
+resource "aws_cloudwatch_event_target" "test" {
+  arn      = aws_sagemaker_pipeline.test.arn
+  rule     = aws_cloudwatch_event_rule.test.id
+  role_arn = aws_iam_role.test.arn
+
+  sagemaker_pipeline_target {
+    pipeline_parameter_list {
+      name  = "key"
+      value = "value"
+    }
+  }
+
+  target_id = %[1]q
+}
+
+resource "aws_iam_role" "test" {
+  name = %[1]q
+
+  assume_role_policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Action": "sts:AssumeRole",
+      "Principal": {
+        "Service": "events.${data.aws_partition.current.dns_suffix}"
+      },
+      "Effect": "Allow",
+      "Sid": ""
+    }
+  ]
+}
+EOF
+}
+
+resource "aws_iam_role_policy" "test" {
+  name = %[1]q
+  role = aws_iam_role.test.id
+
+  policy = <<EOF
+{
+    "Version": "2012-10-17",
+    "Statement": [
+        {
+            "Action": "sagemaker:*",
+            "Effect": "Allow",
+            "Resource": [
+                "*"
+            ]
+        }
+    ]
+}
+EOF
+}
+
+resource "aws_iam_role" "sagemaker" {
+  name               = "%[1]s-2"
+  path               = "/"
+  assume_role_policy = data.aws_iam_policy_document.test.json
+}
+
+data "aws_iam_policy_document" "test" {
+  statement {
+    actions = ["sts:AssumeRole"]
+
+    principals {
+      type        = "Service"
+      identifiers = ["sagemaker.amazonaws.com"]
+    }
+  }
+}
+
+resource "aws_sagemaker_pipeline" "test" {
+  pipeline_name         = %[1]q
+  pipeline_display_name = %[1]q
+  role_arn              = aws_iam_role.sagemaker.arn
+
+  pipeline_definition = jsonencode({
+    Version = "2020-12-01"
+    Steps = [{
+      Name = "Test"
+      Type = "Fail"
+      Arguments = {
+        ErrorMessage = "test"
+      }
+    }]
+  })
+}
+`, rName)
+}
+
 func testAccTargetConfig_inputTransformer(rName string, inputPathKeys []string) string {
 	var inputPaths, inputTemplates strings.Builder
 
diff --git a/internal/service/events/validate.go b/internal/service/events/validate.go
index bcc1ddf8c00..f831bd43f80 100644
--- a/internal/service/events/validate.go
+++ b/internal/service/events/validate.go
@@ -1,9 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package events
 
 import (
 	"fmt"
 	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/aws/aws-sdk-go/service/eventbridge"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
@@ -19,8 +23,8 @@ func validateRuleName(v interface{}, k string) (ws []string, errors []error) {
 	}
 
 	// http://docs.aws.amazon.com/eventbridge/latest/APIReference/API_PutRule.html
-	pattern := `^[\.\-_A-Za-z0-9]+$`
-	if !regexp.MustCompile(pattern).MatchString(value) {
+	pattern := `^[0-9A-Za-z_.-]+$`
+	if !regexache.MustCompile(pattern).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"%q doesn't comply with restrictions (%q): %q",
 			k, pattern, value))
@@ -37,8 +41,8 @@ func validateTargetID(v interface{}, k string) (ws []string, errors []error) {
 	}
 
 	// http://docs.aws.amazon.com/eventbridge/latest/APIReference/API_Target.html
-	pattern := `^[\.\-_A-Za-z0-9]+$`
-	if !regexp.MustCompile(pattern).MatchString(value) {
+	pattern := `^[0-9A-Za-z_.-]+$`
+	if !regexache.MustCompile(pattern).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"%q doesn't comply with restrictions (%q): %q",
 			k, pattern, value))
@@ -83,7 +87,7 @@ func mapMaxItems(max int) schema.SchemaValidateFunc {
 
 var validArchiveName = validation.All(
 	validation.StringLenBetween(1, 48),
-	validation.StringMatch(regexp.MustCompile(`^`+validNameCharClass+`$`), ""),
+	validation.StringMatch(regexache.MustCompile(`^`+validNameCharClass+`$`), ""),
 )
 
 var validBusName = validation.All(
@@ -99,7 +103,7 @@ var validBusNameOrARN = validation.All(
 	),
 )
 
-var validBusNameFormat = validation.StringMatch(regexp.MustCompile(`^`+validBusNameCharClass+`$`), "")
+var validBusNameFormat = validation.StringMatch(regexache.MustCompile(`^`+validBusNameCharClass+`$`), "")
 
 func eventBusARNCheck(v any, k string, arn arn.ARN) (ws []string, errors []error) {
 	if !isEventBusARN(arn) {
@@ -110,12 +114,12 @@ func eventBusARNCheck(v any, k string, arn arn.ARN) (ws []string, errors []error
 
 var validSourceName = validation.All(
 	validation.StringLenBetween(1, 256),
-	validation.StringMatch(regexp.MustCompile(`^aws\.partner(/`+validNameCharClass+`){2,}$`), ""),
+	validation.StringMatch(regexache.MustCompile(`^aws\.partner(/`+validNameCharClass+`){2,}$`), ""),
 )
 
 var validCustomEventBusName = validation.All(
 	validation.StringLenBetween(1, 256),
-	validation.StringDoesNotMatch(regexp.MustCompile(`^default$`), "cannot be 'default'"),
+	validation.StringDoesNotMatch(regexache.MustCompile(`^default$`), "cannot be 'default'"),
 )
 
 func isEventBusARN(arn arn.ARN) bool {
@@ -123,7 +127,7 @@ func isEventBusARN(arn arn.ARN) bool {
 		return false
 	}
 
-	re := regexp.MustCompile(`^event-bus/(` + validBusNameCharClass + `)$`)
+	re := regexache.MustCompile(`^event-bus/(` + validBusNameCharClass + `)$`)
 
 	return re.MatchString(arn.Resource)
 }
diff --git a/internal/service/events/validate_test.go b/internal/service/events/validate_test.go
index f82029dcc81..14cf3a2aa83 100644
--- a/internal/service/events/validate_test.go
+++ b/internal/service/events/validate_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package events
 
 import (
diff --git a/internal/service/events/wait.go b/internal/service/events/wait.go
index 4c4764de3c9..0ab814c9fae 100644
--- a/internal/service/events/wait.go
+++ b/internal/service/events/wait.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package events
 
 import (
diff --git a/internal/service/evidently/feature.go b/internal/service/evidently/feature.go
index 0dc58533ae6..29f39c8b31a 100644
--- a/internal/service/evidently/feature.go
+++ b/internal/service/evidently/feature.go
@@ -1,14 +1,17 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package evidently
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"strconv"
 	"strings"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/cloudwatchevidently"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -16,10 +19,10 @@ import (
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
-	"github.com/hashicorp/terraform-provider-aws/internal/experimental/nullable"
 	"github.com/hashicorp/terraform-provider-aws/internal/flex"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/internal/types/nullable"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -58,7 +61,7 @@ func ResourceFeature() *schema.Resource {
 				Computed: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 127),
-					validation.StringMatch(regexp.MustCompile(`^[-a-zA-Z0-9._]*$`), "alphanumeric and can contain hyphens, underscores, and periods"),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_.-]*$`), "alphanumeric and can contain hyphens, underscores, and periods"),
 				),
 			},
 			"description": {
@@ -69,10 +72,10 @@ func ResourceFeature() *schema.Resource {
 			"entity_overrides": {
 				Type:     schema.TypeMap,
 				Optional: true,
-				ValidateDiagFunc: verify.ValidAllDiag(
+				ValidateDiagFunc: validation.AllDiag(
 					validation.MapKeyLenBetween(1, 512),
 					validation.MapValueLenBetween(1, 127),
-					validation.MapValueMatch(regexp.MustCompile(`^[-a-zA-Z0-9._]*$`), "alphanumeric and can contain hyphens, underscores, and periods"),
+					validation.MapValueMatch(regexache.MustCompile(`^[0-9A-Za-z_.-]*$`), "alphanumeric and can contain hyphens, underscores, and periods"),
 				),
 				Elem: &schema.Schema{Type: schema.TypeString},
 			},
@@ -108,7 +111,7 @@ func ResourceFeature() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 127),
-					validation.StringMatch(regexp.MustCompile(`^[-a-zA-Z0-9._]*$`), "alphanumeric and can contain hyphens, underscores, and periods"),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_.-]*$`), "alphanumeric and can contain hyphens, underscores, and periods"),
 				),
 			},
 			"project": {
@@ -117,7 +120,7 @@ func ResourceFeature() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(0, 2048),
-					validation.StringMatch(regexp.MustCompile(`(^[a-zA-Z0-9._-]*$)|(arn:[^:]*:[^:]*:[^:]*:[^:]*:project/[a-zA-Z0-9._-]*)`), "name or arn of the project"),
+					validation.StringMatch(regexache.MustCompile(`(^[0-9A-Za-z_.-]*$)|(arn:[^:]*:[^:]*:[^:]*:[^:]*:project/[0-9A-Za-z_.-]*)`), "name or arn of the project"),
 				),
 				DiffSuppressFunc: func(k, old, new string, d *schema.ResourceData) bool {
 					// case 1: User-defined string (old) is a name and is the suffix of API-returned string (new). Check non-empty old in resoure creation scenario
@@ -147,7 +150,7 @@ func ResourceFeature() *schema.Resource {
 							Required: true,
 							ValidateFunc: validation.All(
 								validation.StringLenBetween(1, 127),
-								validation.StringMatch(regexp.MustCompile(`^[-a-zA-Z0-9._]*$`), "alphanumeric and can contain hyphens, underscores, and periods"),
+								validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_.-]*$`), "alphanumeric and can contain hyphens, underscores, and periods"),
 							),
 						},
 						"value": {
diff --git a/internal/service/evidently/feature_test.go b/internal/service/evidently/feature_test.go
index bbed156196e..405e40d3251 100644
--- a/internal/service/evidently/feature_test.go
+++ b/internal/service/evidently/feature_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package evidently_test
 
 import (
diff --git a/internal/service/evidently/find.go b/internal/service/evidently/find.go
index 9e27124861d..5fe0b279516 100644
--- a/internal/service/evidently/find.go
+++ b/internal/service/evidently/find.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package evidently
 
 import (
diff --git a/internal/service/evidently/generate.go b/internal/service/evidently/generate.go
index fba22d74ef4..360376ded08 100644
--- a/internal/service/evidently/generate.go
+++ b/internal/service/evidently/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ServiceTagsMap -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/evidently/launch.go b/internal/service/evidently/launch.go
index 43973151896..32893a286f6 100644
--- a/internal/service/evidently/launch.go
+++ b/internal/service/evidently/launch.go
@@ -1,13 +1,16 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package evidently
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"strings"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/cloudwatchevidently"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -89,7 +92,7 @@ func ResourceLaunch() *schema.Resource {
 							Required: true,
 							ValidateFunc: validation.All(
 								validation.StringLenBetween(1, 127),
-								validation.StringMatch(regexp.MustCompile(`^[-a-zA-Z0-9._]*$`), "alphanumeric and can contain hyphens, underscores, and periods"),
+								validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_.-]*$`), "alphanumeric and can contain hyphens, underscores, and periods"),
 							),
 						},
 						"name": {
@@ -97,7 +100,7 @@ func ResourceLaunch() *schema.Resource {
 							Required: true,
 							ValidateFunc: validation.All(
 								validation.StringLenBetween(1, 127),
-								validation.StringMatch(regexp.MustCompile(`^[-a-zA-Z0-9._]*$`), "alphanumeric and can contain hyphens, underscores, and periods"),
+								validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_.-]*$`), "alphanumeric and can contain hyphens, underscores, and periods"),
 							),
 						},
 						"variation": {
@@ -105,7 +108,7 @@ func ResourceLaunch() *schema.Resource {
 							Required: true,
 							ValidateFunc: validation.All(
 								validation.StringLenBetween(1, 127),
-								validation.StringMatch(regexp.MustCompile(`^[-a-zA-Z0-9._]*$`), "alphanumeric and can contain hyphens, underscores, and periods"),
+								validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_.-]*$`), "alphanumeric and can contain hyphens, underscores, and periods"),
 							),
 						},
 					},
@@ -173,7 +176,7 @@ func ResourceLaunch() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 127),
-					validation.StringMatch(regexp.MustCompile(`^[-a-zA-Z0-9._]*$`), "alphanumeric and can contain hyphens, underscores, and periods"),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_.-]*$`), "alphanumeric and can contain hyphens, underscores, and periods"),
 				),
 			},
 			"project": {
@@ -182,7 +185,7 @@ func ResourceLaunch() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(0, 2048),
-					validation.StringMatch(regexp.MustCompile(`(^[a-zA-Z0-9._-]*$)|(arn:[^:]*:[^:]*:[^:]*:[^:]*:project/[a-zA-Z0-9._-]*)`), "name or arn of the project"),
+					validation.StringMatch(regexache.MustCompile(`(^[0-9A-Za-z_.-]*$)|(arn:[^:]*:[^:]*:[^:]*:[^:]*:project/[0-9A-Za-z_.-]*)`), "name or arn of the project"),
 				),
 				DiffSuppressFunc: func(k, old, new string, d *schema.ResourceData) bool {
 					// case 1: User-defined string (old) is a name and is the suffix of API-returned string (new). Check non-empty old in resoure creation scenario
@@ -215,9 +218,9 @@ func ResourceLaunch() *schema.Resource {
 									"group_weights": {
 										Type:     schema.TypeMap,
 										Required: true,
-										ValidateDiagFunc: verify.ValidAllDiag(
+										ValidateDiagFunc: validation.AllDiag(
 											validation.MapKeyLenBetween(1, 127),
-											validation.MapKeyMatch(regexp.MustCompile(`^[-a-zA-Z0-9._]*$`), "alphanumeric and can contain hyphens, underscores, and periods"),
+											validation.MapKeyMatch(regexache.MustCompile(`^[0-9A-Za-z_.-]*$`), "alphanumeric and can contain hyphens, underscores, and periods"),
 										),
 										Elem: &schema.Schema{
 											Type:         schema.TypeInt,
@@ -240,7 +243,7 @@ func ResourceLaunch() *schema.Resource {
 													Required: true,
 													ValidateFunc: validation.All(
 														validation.StringLenBetween(0, 2048),
-														validation.StringMatch(regexp.MustCompile(`(^[a-zA-Z0-9._-]*$)|(arn:[^:]*:[^:]*:[^:]*:[^:]*:segment/[a-zA-Z0-9._-]*)`), "name or arn of the segment"),
+														validation.StringMatch(regexache.MustCompile(`(^[0-9A-Za-z_.-]*$)|(arn:[^:]*:[^:]*:[^:]*:[^:]*:segment/[0-9A-Za-z._-]*)`), "name or arn of the segment"),
 													),
 													DiffSuppressFunc: func(k, old, new string, d *schema.ResourceData) bool {
 														// case 1: User-defined string (old) is a name and is the suffix of API-returned string (new). Check non-empty old in resoure creation scenario
@@ -251,9 +254,9 @@ func ResourceLaunch() *schema.Resource {
 												"weights": {
 													Type:     schema.TypeMap,
 													Required: true,
-													ValidateDiagFunc: verify.ValidAllDiag(
+													ValidateDiagFunc: validation.AllDiag(
 														validation.MapKeyLenBetween(1, 127),
-														validation.MapKeyMatch(regexp.MustCompile(`^[-a-zA-Z0-9._]*$`), "alphanumeric and can contain hyphens, underscores, and periods"),
+														validation.MapKeyMatch(regexache.MustCompile(`^[0-9A-Za-z_.-]*$`), "alphanumeric and can contain hyphens, underscores, and periods"),
 													),
 													Elem: &schema.Schema{
 														Type:         schema.TypeInt,
diff --git a/internal/service/evidently/launch_test.go b/internal/service/evidently/launch_test.go
index 20d3f2f92e1..0a318962727 100644
--- a/internal/service/evidently/launch_test.go
+++ b/internal/service/evidently/launch_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package evidently_test
 
 import (
diff --git a/internal/service/evidently/project.go b/internal/service/evidently/project.go
index 15c95c9307f..d99dd100127 100644
--- a/internal/service/evidently/project.go
+++ b/internal/service/evidently/project.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package evidently
 
 import (
 	"context"
 	"log"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/cloudwatchevidently"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -75,7 +78,7 @@ func ResourceProject() *schema.Resource {
 										Optional: true,
 										ValidateFunc: validation.All(
 											validation.StringLenBetween(1, 512),
-											validation.StringMatch(regexp.MustCompile(`^[-a-zA-Z0-9._/]+$`), "must be a valid CloudWatch Log Group name"),
+											validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_./-]+$`), "must be a valid CloudWatch Log Group name"),
 										),
 									},
 								},
@@ -95,7 +98,7 @@ func ResourceProject() *schema.Resource {
 										Optional: true,
 										ValidateFunc: validation.All(
 											validation.StringLenBetween(3, 63),
-											validation.StringMatch(regexp.MustCompile(`^[a-z0-9][-a-z0-9]*[a-z0-9]$`), "must be a valid Bucket name"),
+											validation.StringMatch(regexache.MustCompile(`^[0-9a-z][0-9a-z-]*[0-9a-z]$`), "must be a valid Bucket name"),
 										),
 									},
 									"prefix": {
@@ -103,7 +106,7 @@ func ResourceProject() *schema.Resource {
 										Optional: true,
 										ValidateFunc: validation.All(
 											validation.StringLenBetween(1, 1024),
-											validation.StringMatch(regexp.MustCompile(`^[-a-zA-Z0-9!_.*'()/]*$`), "must be a valid prefix name"),
+											validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_!.*'()/-]*$`), "must be a valid prefix name"),
 										),
 									},
 								},
@@ -139,7 +142,7 @@ func ResourceProject() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 127),
-					validation.StringMatch(regexp.MustCompile(`^[-a-zA-Z0-9._]*$`), "alphanumeric and can contain hyphens, underscores, and periods"),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_.-]*$`), "alphanumeric and can contain hyphens, underscores, and periods"),
 				),
 			},
 			"status": {
diff --git a/internal/service/evidently/project_test.go b/internal/service/evidently/project_test.go
index fb2ddf23654..ad272eacf96 100644
--- a/internal/service/evidently/project_test.go
+++ b/internal/service/evidently/project_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package evidently_test
 
 import (
diff --git a/internal/service/evidently/segment.go b/internal/service/evidently/segment.go
index 43b66a89dfc..ed84722f264 100644
--- a/internal/service/evidently/segment.go
+++ b/internal/service/evidently/segment.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package evidently
 
 import (
 	"context"
 	"log"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/cloudwatchevidently"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -66,7 +69,7 @@ func ResourceSegment() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 64),
-					validation.StringMatch(regexp.MustCompile(`^[-a-zA-Z0-9._]*$`), "alphanumeric and can contain hyphens, underscores, and periods"),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_.-]*$`), "alphanumeric and can contain hyphens, underscores, and periods"),
 				),
 			},
 			"pattern": {
diff --git a/internal/service/evidently/segment_test.go b/internal/service/evidently/segment_test.go
index ab4f2e76f58..0730a17408c 100644
--- a/internal/service/evidently/segment_test.go
+++ b/internal/service/evidently/segment_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package evidently_test
 
 import (
diff --git a/internal/service/evidently/service_package_gen.go b/internal/service/evidently/service_package_gen.go
index 41bf4860883..4de7208b9cf 100644
--- a/internal/service/evidently/service_package_gen.go
+++ b/internal/service/evidently/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	cloudwatchevidently_sdkv1 "github.com/aws/aws-sdk-go/service/cloudwatchevidently"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -74,4 +75,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*c
 	return cloudwatchevidently_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/evidently/status.go b/internal/service/evidently/status.go
index eae94eb0e77..f2e831ad7b1 100644
--- a/internal/service/evidently/status.go
+++ b/internal/service/evidently/status.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package evidently
 
 import (
diff --git a/internal/service/evidently/sweep.go b/internal/service/evidently/sweep.go
index 2cfa8905cfa..6bf7b31bab4 100644
--- a/internal/service/evidently/sweep.go
+++ b/internal/service/evidently/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package evidently
 
@@ -12,9 +12,10 @@ import (
 	"github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_evidently_project", &resource.Sweeper{
 		Name: "aws_evidently_project",
 		F:    sweepProject,
@@ -23,7 +24,7 @@ func init() {
 
 func sweepProject(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("Error getting client: %w", err)
 	}
@@ -48,7 +49,7 @@ func sweepProject(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Evidently Project sweep for %s: %s", region, err)
 		return sweeperErrs.ErrorOrNil()
 	}
@@ -57,7 +58,7 @@ func sweepProject(region string) error {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error listing Evidently Projects for %s: %w", region, err))
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error sweeping Evidently Projects for %s: %w", region, err))
 	}
 
diff --git a/internal/service/evidently/tags_gen.go b/internal/service/evidently/tags_gen.go
index 00367368b9d..d464e14b818 100644
--- a/internal/service/evidently/tags_gen.go
+++ b/internal/service/evidently/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/cloudwatchevidently"
 	"github.com/aws/aws-sdk-go/service/cloudwatchevidently/cloudwatchevidentlyiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -21,7 +23,7 @@ func Tags(tags tftags.KeyValueTags) map[string]*string {
 	return aws.StringMap(tags.Map())
 }
 
-// KeyValueTags creates KeyValueTags from evidently service tags.
+// KeyValueTags creates tftags.KeyValueTags from evidently service tags.
 func KeyValueTags(ctx context.Context, tags map[string]*string) tftags.KeyValueTags {
 	return tftags.New(ctx, tags)
 }
@@ -52,6 +54,8 @@ func updateTags(ctx context.Context, conn cloudwatchevidentlyiface.CloudWatchEvi
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.Evidently)
 	if len(removedTags) > 0 {
diff --git a/internal/service/evidently/wait.go b/internal/service/evidently/wait.go
index cc64c9261ce..f6c23f8db30 100644
--- a/internal/service/evidently/wait.go
+++ b/internal/service/evidently/wait.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package evidently
 
 import (
diff --git a/internal/service/finspace/generate.go b/internal/service/finspace/generate.go
index 417ccf380dc..d0b2ec2728c 100644
--- a/internal/service/finspace/generate.go
+++ b/internal/service/finspace/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ServiceTagsMap -AWSSDKVersion=2 -KVTValues -ListTags -CreateTags -UpdateTags -SkipTypesImp
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/finspace/kx_cluster.go b/internal/service/finspace/kx_cluster.go
index 7018d80db02..36760452873 100644
--- a/internal/service/finspace/kx_cluster.go
+++ b/internal/service/finspace/kx_cluster.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package finspace
 
 import (
@@ -39,9 +42,9 @@ func ResourceKxCluster() *schema.Resource {
 		},
 
 		Timeouts: &schema.ResourceTimeout{
-			Create: schema.DefaultTimeout(30 * time.Minute),
+			Create: schema.DefaultTimeout(45 * time.Minute),
 			Update: schema.DefaultTimeout(2 * time.Minute), // Tags only
-			Delete: schema.DefaultTimeout(40 * time.Minute),
+			Delete: schema.DefaultTimeout(60 * time.Minute),
 		},
 
 		Schema: map[string]*schema.Schema{
@@ -114,16 +117,15 @@ func ResourceKxCluster() *schema.Resource {
 				Elem: &schema.Resource{
 					Schema: map[string]*schema.Schema{
 						"size": {
-							Type:         schema.TypeInt,
-							Required:     true,
-							ForceNew:     true,
-							ValidateFunc: validation.IntBetween(1200, 33600),
+							Type:     schema.TypeInt,
+							Required: true,
+							ForceNew: true,
 						},
 						"type": {
 							Type:         schema.TypeString,
 							Required:     true,
 							ForceNew:     true,
-							ValidateFunc: validation.StringLenBetween(8, 10),
+							ValidateFunc: validation.StringLenBetween(1, 32),
 						},
 					},
 				},
@@ -183,7 +185,7 @@ func ResourceKxCluster() *schema.Resource {
 				Optional: true,
 				Elem:     &schema.Schema{Type: schema.TypeString},
 				ForceNew: true,
-				ValidateDiagFunc: verify.ValidAllDiag(
+				ValidateDiagFunc: validation.AllDiag(
 					validation.MapKeyLenBetween(1, 50),
 					validation.MapValueLenBetween(1, 50),
 				),
@@ -200,7 +202,7 @@ func ResourceKxCluster() *schema.Resource {
 					Schema: map[string]*schema.Schema{
 						"cache_configurations": {
 							Type:     schema.TypeList,
-							Required: true,
+							Optional: true,
 							ForceNew: true,
 							Elem: &schema.Resource{
 								Schema: map[string]*schema.Schema{
@@ -208,16 +210,13 @@ func ResourceKxCluster() *schema.Resource {
 										Type:     schema.TypeString,
 										Required: true,
 										ForceNew: true,
-										ValidateFunc: validation.StringInSlice([]string{
-											"CACHE_1000",
-										}, true),
 									},
 									"db_paths": {
 										Type: schema.TypeSet,
 										Elem: &schema.Schema{
 											Type: schema.TypeString,
 										},
-										Required: true,
+										Optional: true,
 										ForceNew: true,
 									},
 								},
@@ -300,7 +299,7 @@ func ResourceKxCluster() *schema.Resource {
 							Type:         schema.TypeInt,
 							Required:     true,
 							ForceNew:     true,
-							ValidateFunc: validation.IntBetween(4, 16000),
+							ValidateFunc: validation.IntBetween(10, 16000),
 						},
 					},
 				},
@@ -717,7 +716,7 @@ func expandSavedownStorageConfiguration(tfList []interface{}) *types.KxSavedownS
 	}
 
 	if v, ok := tfMap["size"].(int); ok && v != 0 {
-		a.Size = int32(v)
+		a.Size = aws.Int32(int32(v))
 	}
 
 	return a
@@ -1006,7 +1005,7 @@ func flattenSavedownStorageConfiguration(apiObject *types.KxSavedownStorageConfi
 		m["type"] = v
 	}
 
-	if v := apiObject.Size; v >= 4 && v <= 16000 {
+	if v := aws.ToInt32(apiObject.Size); v >= 10 && v <= 16000 {
 		m["size"] = v
 	}
 
diff --git a/internal/service/finspace/kx_cluster_test.go b/internal/service/finspace/kx_cluster_test.go
index 41a9a3965e9..c6eb9938a9d 100644
--- a/internal/service/finspace/kx_cluster_test.go
+++ b/internal/service/finspace/kx_cluster_test.go
@@ -1,9 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package finspace_test
 
 import (
 	"context"
 	"errors"
 	"fmt"
+	"os"
 	"testing"
 
 	"github.com/aws/aws-sdk-go-v2/aws"
@@ -19,6 +23,15 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
+func testAccPreCheckManagedKxLicenseEnabled(t *testing.T) {
+	if os.Getenv("FINSPACE_MANAGED_KX_LICENSE_ENABLED") == "" {
+		t.Skip(
+			"Environment variable FINSPACE_MANAGED_KX_LICENSE_ENABLED is not set. " +
+				"Certain managed KX resources require the target account to have an active " +
+				"license. Set the environment variable to any value to enable these tests.")
+	}
+}
+
 func TestAccFinSpaceKxCluster_basic(t *testing.T) {
 	if testing.Short() {
 		t.Skip("skipping long-running test in short mode")
@@ -33,6 +46,7 @@ func TestAccFinSpaceKxCluster_basic(t *testing.T) {
 		PreCheck: func() {
 			acctest.PreCheck(ctx, t)
 			acctest.PreCheckPartitionHasService(t, finspace.ServiceID)
+			testAccPreCheckManagedKxLicenseEnabled(t)
 		},
 		ErrorCheck:               acctest.ErrorCheck(t, finspace.ServiceID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
@@ -69,6 +83,7 @@ func TestAccFinSpaceKxCluster_disappears(t *testing.T) {
 		PreCheck: func() {
 			acctest.PreCheck(ctx, t)
 			acctest.PreCheckPartitionHasService(t, finspace.ServiceID)
+			testAccPreCheckManagedKxLicenseEnabled(t)
 		},
 		ErrorCheck:               acctest.ErrorCheck(t, finspace.ServiceID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
@@ -100,6 +115,7 @@ func TestAccFinSpaceKxCluster_description(t *testing.T) {
 		PreCheck: func() {
 			acctest.PreCheck(ctx, t)
 			acctest.PreCheckPartitionHasService(t, finspace.ServiceID)
+			testAccPreCheckManagedKxLicenseEnabled(t)
 		},
 		ErrorCheck:               acctest.ErrorCheck(t, finspace.ServiceID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
@@ -130,6 +146,7 @@ func TestAccFinSpaceKxCluster_database(t *testing.T) {
 		PreCheck: func() {
 			acctest.PreCheck(ctx, t)
 			acctest.PreCheckPartitionHasService(t, finspace.ServiceID)
+			testAccPreCheckManagedKxLicenseEnabled(t)
 		},
 		ErrorCheck:               acctest.ErrorCheck(t, finspace.ServiceID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
@@ -146,6 +163,111 @@ func TestAccFinSpaceKxCluster_database(t *testing.T) {
 	})
 }
 
+func TestAccFinSpaceKxCluster_cacheConfigurations(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
+	ctx := acctest.Context(t)
+	var kxcluster finspace.GetKxClusterOutput
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_finspace_kx_cluster.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, finspace.ServiceID)
+			testAccPreCheckManagedKxLicenseEnabled(t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, finspace.ServiceID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckKxClusterDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccKxClusterConfig_cacheConfigurations(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckKxClusterExists(ctx, resourceName, &kxcluster),
+					resource.TestCheckResourceAttr(resourceName, "status", string(types.KxClusterStatusRunning)),
+				),
+			},
+		},
+	})
+}
+
+func TestAccFinSpaceKxCluster_cache250Configurations(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
+	ctx := acctest.Context(t)
+	var kxcluster finspace.GetKxClusterOutput
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_finspace_kx_cluster.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, finspace.ServiceID)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, finspace.ServiceID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckKxClusterDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccKxClusterConfig_cache250Configurations(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckKxClusterExists(ctx, resourceName, &kxcluster),
+					resource.TestCheckResourceAttr(resourceName, "status", string(types.KxClusterStatusRunning)),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "cache_storage_configurations.*", map[string]string{
+						"size": "1200",
+						"type": "CACHE_250",
+					}),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "database.0.cache_configurations.*", map[string]string{
+						"cache_type": "CACHE_250",
+					}),
+				),
+			},
+		},
+	})
+}
+
+func TestAccFinSpaceKxCluster_cache12Configurations(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
+	ctx := acctest.Context(t)
+	var kxcluster finspace.GetKxClusterOutput
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_finspace_kx_cluster.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, finspace.ServiceID)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, finspace.ServiceID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckKxClusterDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccKxClusterConfig_cache12Configurations(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckKxClusterExists(ctx, resourceName, &kxcluster),
+					resource.TestCheckResourceAttr(resourceName, "status", string(types.KxClusterStatusRunning)),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "cache_storage_configurations.*", map[string]string{
+						"size": "6000",
+						"type": "CACHE_12",
+					}),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "database.0.cache_configurations.*", map[string]string{
+						"cache_type": "CACHE_12",
+					}),
+				),
+			},
+		},
+	})
+}
+
 func TestAccFinSpaceKxCluster_code(t *testing.T) {
 	if testing.Short() {
 		t.Skip("skipping long-running test in short mode")
@@ -161,6 +283,7 @@ func TestAccFinSpaceKxCluster_code(t *testing.T) {
 		PreCheck: func() {
 			acctest.PreCheck(ctx, t)
 			acctest.PreCheckPartitionHasService(t, finspace.ServiceID)
+			testAccPreCheckManagedKxLicenseEnabled(t)
 		},
 		ErrorCheck:               acctest.ErrorCheck(t, finspace.ServiceID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
@@ -190,6 +313,7 @@ func TestAccFinSpaceKxCluster_multiAZ(t *testing.T) {
 		PreCheck: func() {
 			acctest.PreCheck(ctx, t)
 			acctest.PreCheckPartitionHasService(t, finspace.ServiceID)
+			testAccPreCheckManagedKxLicenseEnabled(t)
 		},
 		ErrorCheck:               acctest.ErrorCheck(t, finspace.ServiceID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
@@ -220,6 +344,7 @@ func TestAccFinSpaceKxCluster_rdb(t *testing.T) {
 		PreCheck: func() {
 			acctest.PreCheck(ctx, t)
 			acctest.PreCheckPartitionHasService(t, finspace.ServiceID)
+			testAccPreCheckManagedKxLicenseEnabled(t)
 		},
 		ErrorCheck:               acctest.ErrorCheck(t, finspace.ServiceID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
@@ -250,6 +375,7 @@ func TestAccFinSpaceKxCluster_executionRole(t *testing.T) {
 		PreCheck: func() {
 			acctest.PreCheck(ctx, t)
 			acctest.PreCheckPartitionHasService(t, finspace.ServiceID)
+			testAccPreCheckManagedKxLicenseEnabled(t)
 		},
 		ErrorCheck:               acctest.ErrorCheck(t, finspace.ServiceID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
@@ -280,6 +406,7 @@ func TestAccFinSpaceKxCluster_autoScaling(t *testing.T) {
 		PreCheck: func() {
 			acctest.PreCheck(ctx, t)
 			acctest.PreCheckPartitionHasService(t, finspace.ServiceID)
+			testAccPreCheckManagedKxLicenseEnabled(t)
 		},
 		ErrorCheck:               acctest.ErrorCheck(t, finspace.ServiceID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
@@ -313,6 +440,7 @@ func TestAccFinSpaceKxCluster_initializationScript(t *testing.T) {
 		PreCheck: func() {
 			acctest.PreCheck(ctx, t)
 			acctest.PreCheckPartitionHasService(t, finspace.ServiceID)
+			testAccPreCheckManagedKxLicenseEnabled(t)
 		},
 		ErrorCheck:               acctest.ErrorCheck(t, finspace.ServiceID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
@@ -342,6 +470,7 @@ func TestAccFinSpaceKxCluster_commandLineArgs(t *testing.T) {
 		PreCheck: func() {
 			acctest.PreCheck(ctx, t)
 			acctest.PreCheckPartitionHasService(t, finspace.ServiceID)
+			testAccPreCheckManagedKxLicenseEnabled(t)
 		},
 		ErrorCheck:               acctest.ErrorCheck(t, finspace.ServiceID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
@@ -373,6 +502,7 @@ func TestAccFinSpaceKxCluster_tags(t *testing.T) {
 		PreCheck: func() {
 			acctest.PreCheck(ctx, t)
 			acctest.PreCheckPartitionHasService(t, finspace.ServiceID)
+			testAccPreCheckManagedKxLicenseEnabled(t)
 		},
 		ErrorCheck:               acctest.ErrorCheck(t, finspace.ServiceID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
@@ -730,6 +860,42 @@ resource "aws_finspace_kx_database" "test" {
   environment_id = aws_finspace_kx_environment.test.id
 }
 
+resource "aws_finspace_kx_cluster" "test" {
+  name                 = %[1]q
+  environment_id       = aws_finspace_kx_environment.test.id
+  type                 = "HDB"
+  release_label        = "1.0"
+  az_mode              = "SINGLE"
+  availability_zone_id = aws_finspace_kx_environment.test.availability_zones[0]
+
+  database {
+    database_name = aws_finspace_kx_database.test.name
+  }
+
+  capacity_configuration {
+    node_count = 2
+    node_type  = "kx.s.xlarge"
+  }
+
+  vpc_configuration {
+    vpc_id             = aws_vpc.test.id
+    security_group_ids = [aws_security_group.test.id]
+    subnet_ids         = [aws_subnet.test.id]
+    ip_address_type    = "IP_V4"
+  }
+}
+`, rName))
+}
+
+func testAccKxClusterConfig_cacheConfigurations(rName string) string {
+	return acctest.ConfigCompose(
+		testAccKxClusterConfigBase(rName),
+		fmt.Sprintf(`
+resource "aws_finspace_kx_database" "test" {
+  name           = %[1]q
+  environment_id = aws_finspace_kx_environment.test.id
+}
+
 resource "aws_finspace_kx_cluster" "test" {
   name                 = %[1]q
   environment_id       = aws_finspace_kx_environment.test.id
@@ -766,6 +932,96 @@ resource "aws_finspace_kx_cluster" "test" {
 `, rName))
 }
 
+func testAccKxClusterConfig_cache250Configurations(rName string) string {
+	return acctest.ConfigCompose(
+		testAccKxClusterConfigBase(rName),
+		fmt.Sprintf(`
+resource "aws_finspace_kx_database" "test" {
+  name           = %[1]q
+  environment_id = aws_finspace_kx_environment.test.id
+}
+
+resource "aws_finspace_kx_cluster" "test" {
+  name                 = %[1]q
+  environment_id       = aws_finspace_kx_environment.test.id
+  type                 = "HDB"
+  release_label        = "1.0"
+  az_mode              = "SINGLE"
+  availability_zone_id = aws_finspace_kx_environment.test.availability_zones[0]
+
+  cache_storage_configurations {
+    type = "CACHE_250"
+    size = 1200
+  }
+
+  database {
+    database_name = aws_finspace_kx_database.test.name
+    cache_configurations {
+      cache_type = "CACHE_250"
+      db_paths   = ["/"]
+    }
+  }
+
+  capacity_configuration {
+    node_count = 2
+    node_type  = "kx.s.xlarge"
+  }
+
+  vpc_configuration {
+    vpc_id             = aws_vpc.test.id
+    security_group_ids = [aws_security_group.test.id]
+    subnet_ids         = [aws_subnet.test.id]
+    ip_address_type    = "IP_V4"
+  }
+}
+`, rName))
+}
+
+func testAccKxClusterConfig_cache12Configurations(rName string) string {
+	return acctest.ConfigCompose(
+		testAccKxClusterConfigBase(rName),
+		fmt.Sprintf(`
+resource "aws_finspace_kx_database" "test" {
+  name           = %[1]q
+  environment_id = aws_finspace_kx_environment.test.id
+}
+
+resource "aws_finspace_kx_cluster" "test" {
+  name                 = %[1]q
+  environment_id       = aws_finspace_kx_environment.test.id
+  type                 = "HDB"
+  release_label        = "1.0"
+  az_mode              = "SINGLE"
+  availability_zone_id = aws_finspace_kx_environment.test.availability_zones[0]
+
+  cache_storage_configurations {
+    type = "CACHE_12"
+    size = 6000
+  }
+
+  database {
+    database_name = aws_finspace_kx_database.test.name
+    cache_configurations {
+      cache_type = "CACHE_12"
+      db_paths   = ["/"]
+    }
+  }
+
+  capacity_configuration {
+    node_count = 2
+    node_type  = "kx.s.xlarge"
+  }
+
+  vpc_configuration {
+    vpc_id             = aws_vpc.test.id
+    security_group_ids = [aws_security_group.test.id]
+    subnet_ids         = [aws_subnet.test.id]
+    ip_address_type    = "IP_V4"
+  }
+}
+`, rName))
+}
+
 func testAccKxClusterConfig_code(rName, path string) string {
 	return acctest.ConfigCompose(
 		testAccKxClusterConfigBase(rName),
diff --git a/internal/service/finspace/kx_database.go b/internal/service/finspace/kx_database.go
index 2ff61db8071..ca953294001 100644
--- a/internal/service/finspace/kx_database.go
+++ b/internal/service/finspace/kx_database.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package finspace
 
 import (
diff --git a/internal/service/finspace/kx_database_test.go b/internal/service/finspace/kx_database_test.go
index ed4a29b4aa2..1797ba028a4 100644
--- a/internal/service/finspace/kx_database_test.go
+++ b/internal/service/finspace/kx_database_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package finspace_test
 
 import (
diff --git a/internal/service/finspace/kx_environment.go b/internal/service/finspace/kx_environment.go
index f8a256ee30a..d9968affdf9 100644
--- a/internal/service/finspace/kx_environment.go
+++ b/internal/service/finspace/kx_environment.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package finspace
 
 import (
@@ -40,7 +43,7 @@ func ResourceKxEnvironment() *schema.Resource {
 		Timeouts: &schema.ResourceTimeout{
 			Create: schema.DefaultTimeout(30 * time.Minute),
 			Update: schema.DefaultTimeout(30 * time.Minute),
-			Delete: schema.DefaultTimeout(30 * time.Minute),
+			Delete: schema.DefaultTimeout(45 * time.Minute),
 		},
 
 		Schema: map[string]*schema.Schema{
@@ -116,16 +119,81 @@ func ResourceKxEnvironment() *schema.Resource {
 				MaxItems: 1,
 				Elem: &schema.Resource{
 					Schema: map[string]*schema.Schema{
-						"transit_gateway_id": {
-							Type:         schema.TypeString,
-							Required:     true,
-							ValidateFunc: validation.StringLenBetween(1, 32),
+						"attachment_network_acl_configuration": {
+							Type:     schema.TypeList,
+							Optional: true,
+							MaxItems: 100,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"cidr_block": {
+										Type:         schema.TypeString,
+										Required:     true,
+										ValidateFunc: validation.IsCIDR,
+									},
+									"icmp_type_code": {
+										Type:     schema.TypeList,
+										Optional: true,
+										MaxItems: 1,
+										Elem: &schema.Resource{
+											Schema: map[string]*schema.Schema{
+												"type": {
+													Type:     schema.TypeInt,
+													Required: true,
+												},
+												"code": {
+													Type:     schema.TypeInt,
+													Required: true,
+												},
+											},
+										},
+									},
+									"port_range": {
+										Type:     schema.TypeList,
+										Optional: true,
+										MaxItems: 1,
+										Elem: &schema.Resource{
+											Schema: map[string]*schema.Schema{
+												"from": {
+													Type:         schema.TypeInt,
+													Required:     true,
+													ValidateFunc: validation.IsPortNumber,
+												},
+												"to": {
+													Type:         schema.TypeInt,
+													Required:     true,
+													ValidateFunc: validation.IsPortNumber,
+												},
+											},
+										},
+									},
+									"protocol": {
+										Type:         schema.TypeString,
+										Required:     true,
+										ValidateFunc: validation.StringLenBetween(1, 5),
+									},
+									"rule_action": {
+										Type:             schema.TypeString,
+										Required:         true,
+										ValidateDiagFunc: enum.Validate[types.RuleAction](),
+									},
+									"rule_number": {
+										Type:         schema.TypeInt,
+										Required:     true,
+										ValidateFunc: validation.IntBetween(1, 32766),
+									},
+								},
+							},
 						},
 						"routable_cidr_space": {
 							Type:         schema.TypeString,
 							Required:     true,
 							ValidateFunc: validation.IsCIDR,
 						},
+						"transit_gateway_id": {
+							Type:         schema.TypeString,
+							Required:     true,
+							ValidateFunc: validation.StringLenBetween(1, 32),
+						},
 					},
 				},
 			},
@@ -262,11 +330,11 @@ func resourceKxEnvironmentDelete(ctx context.Context, d *schema.ResourceData, me
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).FinSpaceClient(ctx)
 
-	log.Printf("[INFO] Deleting FinSpace KxEnvironment %s", d.Id())
-
+	log.Printf("[INFO] Deleting FinSpace Kx Environment: %s", d.Id())
 	_, err := conn.DeleteKxEnvironment(ctx, &finspace.DeleteKxEnvironmentInput{
 		EnvironmentId: aws.String(d.Id()),
 	})
+
 	if errs.IsA[*types.ResourceNotFoundException](err) ||
 		errs.IsAErrorMessageContains[*types.ValidationException](err, "The Environment is in DELETED state") {
 		log.Printf("[DEBUG] FinSpace KxEnvironment %s already deleted. Nothing to delete.", d.Id())
@@ -494,9 +562,87 @@ func expandTransitGatewayConfiguration(tfList []interface{}) *types.TransitGatew
 		a.RoutableCIDRSpace = aws.String(v)
 	}
 
+	if v, ok := tfMap["attachment_network_acl_configuration"]; ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
+		a.AttachmentNetworkAclConfiguration = expandAttachmentNetworkACLConfigurations(v.([]interface{}))
+	}
+
+	return a
+}
+
+func expandAttachmentNetworkACLConfigurations(tfList []interface{}) []types.NetworkACLEntry {
+	if len(tfList) == 0 {
+		return nil
+	}
+
+	var s []types.NetworkACLEntry
+	for _, r := range tfList {
+		m, ok := r.(map[string]interface{})
+		if !ok {
+			continue
+		}
+
+		a := expandAttachmentNetworkACLConfiguration(m)
+		if a == nil {
+			continue
+		}
+
+		s = append(s, *a)
+	}
+	return s
+}
+
+func expandAttachmentNetworkACLConfiguration(tfMap map[string]interface{}) *types.NetworkACLEntry {
+	if tfMap == nil {
+		return nil
+	}
+
+	a := &types.NetworkACLEntry{}
+	if v, ok := tfMap["rule_number"].(int); ok && v > 0 {
+		a.RuleNumber = aws.Int32(int32(v))
+	}
+	if v, ok := tfMap["protocol"].(string); ok && v != "" {
+		a.Protocol = &v
+	}
+	if v, ok := tfMap["rule_action"].(string); ok && v != "" {
+		a.RuleAction = types.RuleAction(v)
+	}
+	if v, ok := tfMap["cidr_block"].(string); ok && v != "" {
+		a.CidrBlock = &v
+	}
+	if v, ok := tfMap["port_range"]; ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
+		a.PortRange = expandPortRange(v.([]interface{}))
+	}
+	if v, ok := tfMap["icmp_type_code"]; ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
+		a.IcmpTypeCode = expandIcmpTypeCode(v.([]interface{}))
+	}
+
 	return a
 }
 
+func expandPortRange(tfList []interface{}) *types.PortRange {
+	if len(tfList) == 0 || tfList[0] == nil {
+		return nil
+	}
+	tfMap := tfList[0].(map[string]interface{})
+
+	return &types.PortRange{
+		From: int32(tfMap["from"].(int)),
+		To:   int32(tfMap["to"].(int)),
+	}
+}
+
+func expandIcmpTypeCode(tfList []interface{}) *types.IcmpTypeCode {
+	if len(tfList) == 0 || tfList[0] == nil {
+		return nil
+	}
+	tfMap := tfList[0].(map[string]interface{})
+
+	return &types.IcmpTypeCode{
+		Code: int32(tfMap["code"].(int)),
+		Type: int32(tfMap["type"].(int)),
+	}
+}
+
 func expandCustomDNSConfiguration(tfMap map[string]interface{}) *types.CustomDNSServer {
 	if tfMap == nil {
 		return nil
@@ -556,6 +702,72 @@ func flattenTransitGatewayConfiguration(apiObject *types.TransitGatewayConfigura
 		m["routable_cidr_space"] = aws.ToString(v)
 	}
 
+	if v := apiObject.AttachmentNetworkAclConfiguration; v != nil {
+		m["attachment_network_acl_configuration"] = flattenAttachmentNetworkACLConfigurations(v)
+	}
+
+	return []interface{}{m}
+}
+
+func flattenAttachmentNetworkACLConfigurations(apiObjects []types.NetworkACLEntry) []interface{} {
+	if len(apiObjects) == 0 {
+		return nil
+	}
+
+	var l []interface{}
+
+	for _, apiObject := range apiObjects {
+		l = append(l, flattenAttachmentNetworkACLConfiguration(&apiObject))
+	}
+
+	return l
+}
+
+func flattenAttachmentNetworkACLConfiguration(apiObject *types.NetworkACLEntry) map[string]interface{} {
+	if apiObject == nil {
+		return nil
+	}
+
+	m := map[string]interface{}{
+		"cidr_block":  aws.ToString(apiObject.CidrBlock),
+		"protocol":    aws.ToString(apiObject.Protocol),
+		"rule_action": apiObject.RuleAction,
+		"rule_number": apiObject.RuleNumber,
+	}
+
+	if v := apiObject.PortRange; v != nil {
+		m["port_range"] = flattenPortRange(v)
+	}
+	if v := apiObject.IcmpTypeCode; v != nil {
+		m["icmp_type_code"] = flattenIcmpTypeCode(v)
+	}
+
+	return m
+}
+
+func flattenPortRange(apiObject *types.PortRange) []interface{} {
+	if apiObject == nil {
+		return nil
+	}
+
+	m := map[string]interface{}{
+		"from": apiObject.From,
+		"to":   apiObject.To,
+	}
+
+	return []interface{}{m}
+}
+
+func flattenIcmpTypeCode(apiObject *types.IcmpTypeCode) []interface{} {
+	if apiObject == nil {
+		return nil
+	}
+
+	m := map[string]interface{}{
+		"type": apiObject.Type,
+		"code": apiObject.Code,
+	}
+
 	return []interface{}{m}
 }
 
diff --git a/internal/service/finspace/kx_environment_test.go b/internal/service/finspace/kx_environment_test.go
index 87ea3942b74..59cece2fa7f 100644
--- a/internal/service/finspace/kx_environment_test.go
+++ b/internal/service/finspace/kx_environment_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package finspace_test
 
 import (
@@ -237,6 +240,83 @@ func TestAccFinSpaceKxEnvironment_transitGateway(t *testing.T) {
 	})
 }
 
+func TestAccFinSpaceKxEnvironment_attachmentNetworkACLConfiguration(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
+	ctx := acctest.Context(t)
+	var kxenvironment finspace.GetKxEnvironmentOutput
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_finspace_kx_environment.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, finspace.ServiceID)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, finspace.ServiceID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckKxEnvironmentDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccKxEnvironmentConfig_attachmentNetworkACLConfig(rName, "100.64.0.0/26"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckKxEnvironmentExists(ctx, resourceName, &kxenvironment),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "transit_gateway_configuration.*", map[string]string{
+						"routable_cidr_space": "100.64.0.0/26",
+					}),
+					resource.TestCheckResourceAttr(resourceName, "transit_gateway_configuration.0.attachment_network_acl_configuration.#", "1"),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "transit_gateway_configuration.0.attachment_network_acl_configuration.*", map[string]string{
+						"protocol":    "6",
+						"rule_action": "allow",
+						"cidr_block":  "0.0.0.0/0",
+						"rule_number": "1",
+					}),
+				),
+			},
+			{
+				Config: testAccKxEnvironmentConfig_attachmentNetworkACLConfig2(rName, "100.64.0.0/26"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckKxEnvironmentExists(ctx, resourceName, &kxenvironment),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "transit_gateway_configuration.*", map[string]string{
+						"routable_cidr_space": "100.64.0.0/26",
+					}),
+					resource.TestCheckResourceAttr(resourceName, "transit_gateway_configuration.0.attachment_network_acl_configuration.#", "2"),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "transit_gateway_configuration.0.attachment_network_acl_configuration.*", map[string]string{
+						"protocol":    "6",
+						"rule_action": "allow",
+						"cidr_block":  "0.0.0.0/0",
+						"rule_number": "1",
+					}),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "transit_gateway_configuration.0.attachment_network_acl_configuration.*", map[string]string{
+						"protocol":    "4",
+						"rule_action": "allow",
+						"cidr_block":  "0.0.0.0/0",
+						"rule_number": "20",
+					}),
+				),
+			},
+			{
+				Config: testAccKxEnvironmentConfig_attachmentNetworkACLConfig(rName, "100.64.0.0/26"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckKxEnvironmentExists(ctx, resourceName, &kxenvironment),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "transit_gateway_configuration.*", map[string]string{
+						"routable_cidr_space": "100.64.0.0/26",
+					}),
+					resource.TestCheckResourceAttr(resourceName, "transit_gateway_configuration.0.attachment_network_acl_configuration.#", "1"),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "transit_gateway_configuration.0.attachment_network_acl_configuration.*", map[string]string{
+						"protocol":    "6",
+						"rule_action": "allow",
+						"cidr_block":  "0.0.0.0/0",
+						"rule_number": "1",
+					}),
+				),
+			},
+		},
+	})
+}
+
 func TestAccFinSpaceKxEnvironment_tags(t *testing.T) {
 	if testing.Short() {
 		t.Skip("skipping long-running test in short mode")
@@ -392,6 +472,88 @@ resource "aws_finspace_kx_environment" "test" {
 `, rName, cidr))
 }
 
+func testAccKxEnvironmentConfig_attachmentNetworkACLConfig(rName, cidr string) string {
+	return acctest.ConfigCompose(
+		testAccKxEnvironmentConfigBase(),
+		fmt.Sprintf(`
+resource "aws_ec2_transit_gateway" "test" {
+  description = "test"
+}
+
+resource "aws_finspace_kx_environment" "test" {
+  name       = %[1]q
+  kms_key_id = aws_kms_key.test.arn
+
+  transit_gateway_configuration {
+    transit_gateway_id  = aws_ec2_transit_gateway.test.id
+    routable_cidr_space = %[2]q
+    attachment_network_acl_configuration {
+      rule_number = 1
+      protocol    = "6"
+      rule_action = "allow"
+      cidr_block  = "0.0.0.0/0"
+      port_range {
+        from = 53
+        to   = 53
+      }
+      icmp_type_code {
+        type = -1
+        code = -1
+      }
+    }
+  }
+}
+`, rName, cidr))
+}
+
+func testAccKxEnvironmentConfig_attachmentNetworkACLConfig2(rName, cidr string) string {
+	return acctest.ConfigCompose(
+		testAccKxEnvironmentConfigBase(),
+		fmt.Sprintf(`
+resource "aws_ec2_transit_gateway" "test" {
+  description = "test"
+}
+
+resource "aws_finspace_kx_environment" "test" {
+  name       = %[1]q
+  kms_key_id = aws_kms_key.test.arn
+
+  transit_gateway_configuration {
+    transit_gateway_id  = aws_ec2_transit_gateway.test.id
+    routable_cidr_space = %[2]q
+    attachment_network_acl_configuration {
+      rule_number = 1
+      protocol    = "6"
+      rule_action = "allow"
+      cidr_block  = "0.0.0.0/0"
+      port_range {
+        from = 53
+        to   = 53
+      }
+      icmp_type_code {
+        type = -1
+        code = -1
+      }
+    }
+    attachment_network_acl_configuration {
+      rule_number = 20
+      protocol    = "4"
+      rule_action = "allow"
+      cidr_block  = "0.0.0.0/0"
+      port_range {
+        from = 51
+        to   = 51
+      }
+      icmp_type_code {
+        type = -1
+        code = -1
+      }
+    }
+  }
+}
+`, rName, cidr))
+}
+
 func testAccKxEnvironmentConfig_dnsConfig(rName, serverName, serverIP string) string {
 	return acctest.ConfigCompose(
 		testAccKxEnvironmentConfigBase(),
diff --git a/internal/service/finspace/kx_user.go b/internal/service/finspace/kx_user.go
index f8adcd6798e..e5252329290 100644
--- a/internal/service/finspace/kx_user.go
+++ b/internal/service/finspace/kx_user.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package finspace
 
 import (
diff --git a/internal/service/finspace/kx_user_test.go b/internal/service/finspace/kx_user_test.go
index d7189576cfe..254f878afce 100644
--- a/internal/service/finspace/kx_user_test.go
+++ b/internal/service/finspace/kx_user_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package finspace_test
 
 import (
diff --git a/internal/service/finspace/service_package_gen.go b/internal/service/finspace/service_package_gen.go
index b0e1258e97c..42b687b450e 100644
--- a/internal/service/finspace/service_package_gen.go
+++ b/internal/service/finspace/service_package_gen.go
@@ -7,6 +7,7 @@ import (
 
 	aws_sdkv2 "github.com/aws/aws-sdk-go-v2/aws"
 	finspace_sdkv2 "github.com/aws/aws-sdk-go-v2/service/finspace"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -72,9 +73,11 @@ func (p *servicePackage) NewClient(ctx context.Context, config map[string]any) (
 
 	return finspace_sdkv2.NewFromConfig(cfg, func(o *finspace_sdkv2.Options) {
 		if endpoint := config["endpoint"].(string); endpoint != "" {
-			o.EndpointResolver = finspace_sdkv2.EndpointResolverFromURL(endpoint)
+			o.BaseEndpoint = aws_sdkv2.String(endpoint)
 		}
 	}), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/finspace/sweep.go b/internal/service/finspace/sweep.go
new file mode 100644
index 00000000000..41b18d125e5
--- /dev/null
+++ b/internal/service/finspace/sweep.go
@@ -0,0 +1,71 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package finspace
+
+import (
+	"fmt"
+	"log"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/finspace"
+	"github.com/aws/aws-sdk-go-v2/service/finspace/types"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv2"
+)
+
+func RegisterSweepers() {
+	resource.AddTestSweepers("aws_finspace_kx_environment", &resource.Sweeper{
+		Name: "aws_finspace_kx_environment",
+		F:    sweepKxEnvironments,
+	})
+}
+
+func sweepKxEnvironments(region string) error {
+	ctx := sweep.Context(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
+	if err != nil {
+		return fmt.Errorf("error getting client: %s", err)
+	}
+	conn := client.FinSpaceClient(ctx)
+	input := &finspace.ListKxEnvironmentsInput{}
+	sweepResources := make([]sweep.Sweepable, 0)
+
+	pages := finspace.NewListKxEnvironmentsPaginator(conn, input)
+	for pages.HasMorePages() {
+		page, err := pages.NextPage(ctx)
+
+		if awsv2.SkipSweepError(err) {
+			log.Printf("[WARN] Skipping FinSpace Kx Environment sweep for %s: %s", region, err)
+			return nil
+		}
+
+		if err != nil {
+			return fmt.Errorf("error listing FinSpace Kx Environments (%s): %w", region, err)
+		}
+
+		for _, v := range page.Environments {
+			id := aws.ToString(v.EnvironmentId)
+
+			if status := v.Status; status == types.EnvironmentStatusDeleted || status == types.EnvironmentStatusDeleting || status == types.EnvironmentStatusCreating {
+				log.Printf("[INFO] Skipping FinSpace Kx Environment %s: Status=%s", id, status)
+				continue
+			}
+
+			r := ResourceKxEnvironment()
+			d := r.Data(nil)
+			d.SetId(id)
+
+			sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
+		}
+	}
+
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
+
+	if err != nil {
+		return fmt.Errorf("error sweeping FinSpace Kx Environments (%s): %w", region, err)
+	}
+
+	return nil
+}
diff --git a/internal/service/finspace/tags_gen.go b/internal/service/finspace/tags_gen.go
index 3798ba327ca..15f29f5f6d4 100644
--- a/internal/service/finspace/tags_gen.go
+++ b/internal/service/finspace/tags_gen.go
@@ -7,7 +7,9 @@ import (
 
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/finspace"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -53,7 +55,7 @@ func Tags(tags tftags.KeyValueTags) map[string]string {
 	return tags.Map()
 }
 
-// KeyValueTags creates KeyValueTags from finspace service tags.
+// KeyValueTags creates tftags.KeyValueTags from finspace service tags.
 func KeyValueTags(ctx context.Context, tags map[string]string) tftags.KeyValueTags {
 	return tftags.New(ctx, tags)
 }
@@ -93,6 +95,8 @@ func updateTags(ctx context.Context, conn *finspace.Client, identifier string, o
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.FinSpace)
 	if len(removedTags) > 0 {
diff --git a/internal/service/firehose/consts.go b/internal/service/firehose/consts.go
index 7b6465190c8..722660cb182 100644
--- a/internal/service/firehose/consts.go
+++ b/internal/service/firehose/consts.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package firehose
 
 import (
diff --git a/internal/service/firehose/delivery_stream.go b/internal/service/firehose/delivery_stream.go
index 07ba35f9266..5546c767974 100644
--- a/internal/service/firehose/delivery_stream.go
+++ b/internal/service/firehose/delivery_stream.go
@@ -1,19 +1,22 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package firehose
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"strings"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/aws/aws-sdk-go/service/firehose"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/customdiff"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
@@ -26,776 +29,1286 @@ import (
 )
 
 const (
-	destinationTypeExtendedS3    = "extended_s3"
-	destinationTypeElasticsearch = "elasticsearch"
-	destinationTypeOpensearch    = "opensearch"
-	destinationTypeRedshift      = "redshift"
-	destinationTypeSplunk        = "splunk"
-	destinationTypeHTTPEndpoint  = "http_endpoint"
+	destinationTypeElasticsearch        = "elasticsearch"
+	destinationTypeExtendedS3           = "extended_s3"
+	destinationTypeHTTPEndpoint         = "http_endpoint"
+	destinationTypeOpenSearch           = "opensearch"
+	destinationTypeOpenSearchServerless = "opensearchserverless"
+	destinationTypeRedshift             = "redshift"
+	destinationTypeSplunk               = "splunk"
 )
 
-func cloudWatchLoggingOptionsSchema() *schema.Schema {
-	return &schema.Schema{
-		Type:     schema.TypeList,
-		MaxItems: 1,
-		Optional: true,
-		Computed: true,
-		Elem: &schema.Resource{
-			Schema: map[string]*schema.Schema{
-				"enabled": {
-					Type:     schema.TypeBool,
-					Optional: true,
-					Default:  false,
-				},
-
-				"log_group_name": {
-					Type:     schema.TypeString,
-					Optional: true,
-				},
-
-				"log_stream_name": {
-					Type:     schema.TypeString,
-					Optional: true,
-				},
-			},
-		},
+func destinationType_Values() []string {
+	return []string{
+		destinationTypeElasticsearch,
+		destinationTypeExtendedS3,
+		destinationTypeHTTPEndpoint,
+		destinationTypeOpenSearch,
+		destinationTypeOpenSearchServerless,
+		destinationTypeRedshift,
+		destinationTypeSplunk,
 	}
 }
 
-func dynamicPartitioningConfigurationSchema() *schema.Schema {
-	return &schema.Schema{
-		Type:     schema.TypeList,
-		MaxItems: 1,
-		Optional: true,
-		ForceNew: true,
-		Elem: &schema.Resource{
-			Schema: map[string]*schema.Schema{
-				"enabled": {
-					Type:     schema.TypeBool,
-					Optional: true,
-					Default:  false,
-					ForceNew: true,
-				},
-				"retry_duration": {
-					Type:         schema.TypeInt,
-					Optional:     true,
-					Default:      300,
-					ValidateFunc: validation.IntBetween(0, 7200),
-				},
+// @SDKResource("aws_kinesis_firehose_delivery_stream", name="Delivery Stream")
+// @Tags(identifierAttribute="name")
+func ResourceDeliveryStream() *schema.Resource {
+	//lintignore:R011
+	return &schema.Resource{
+		CreateWithoutTimeout: resourceDeliveryStreamCreate,
+		ReadWithoutTimeout:   resourceDeliveryStreamRead,
+		UpdateWithoutTimeout: resourceDeliveryStreamUpdate,
+		DeleteWithoutTimeout: resourceDeliveryStreamDelete,
+
+		Importer: &schema.ResourceImporter{
+			StateContext: func(ctx context.Context, d *schema.ResourceData, meta interface{}) ([]*schema.ResourceData, error) {
+				idErr := fmt.Errorf("Expected ID in format of arn:PARTITION:firehose:REGION:ACCOUNTID:deliverystream/NAME and provided: %s", d.Id())
+				resARN, err := arn.Parse(d.Id())
+				if err != nil {
+					return nil, idErr
+				}
+				resourceParts := strings.Split(resARN.Resource, "/")
+				if len(resourceParts) != 2 {
+					return nil, idErr
+				}
+				d.Set("name", resourceParts[1])
+				return []*schema.ResourceData{d}, nil
 			},
 		},
-	}
-}
 
-func requestConfigurationSchema() *schema.Schema {
-	return &schema.Schema{
-		Type:     schema.TypeList,
-		MaxItems: 1,
-		Optional: true,
-		Computed: true,
-		Elem: &schema.Resource{
-			Schema: map[string]*schema.Schema{
-				"content_encoding": {
-					Type:         schema.TypeString,
-					Optional:     true,
-					Default:      firehose.ContentEncodingNone,
-					ValidateFunc: validation.StringInSlice(firehose.ContentEncoding_Values(), false),
-				},
+		Timeouts: &schema.ResourceTimeout{
+			Create: schema.DefaultTimeout(30 * time.Minute),
+			Update: schema.DefaultTimeout(10 * time.Minute),
+			Delete: schema.DefaultTimeout(30 * time.Minute),
+		},
 
-				"common_attributes": {
+		SchemaVersion: 1,
+		MigrateState:  MigrateState,
+		SchemaFunc: func() map[string]*schema.Schema {
+			cloudWatchLoggingOptionsSchema := func() *schema.Schema {
+				return &schema.Schema{
 					Type:     schema.TypeList,
+					MaxItems: 1,
 					Optional: true,
+					Computed: true,
 					Elem: &schema.Resource{
 						Schema: map[string]*schema.Schema{
-							"name": {
+							"enabled": {
+								Type:     schema.TypeBool,
+								Optional: true,
+								Default:  false,
+							},
+							"log_group_name": {
 								Type:     schema.TypeString,
-								Required: true,
+								Optional: true,
 							},
-							"value": {
+							"log_stream_name": {
 								Type:     schema.TypeString,
-								Required: true,
+								Optional: true,
 							},
 						},
 					},
-				},
-			},
-		},
-	}
-}
-
-func s3BackupConfigurationSchema() *schema.Schema {
-	return &schema.Schema{
-		Type:     schema.TypeList,
-		MaxItems: 1,
-		Optional: true,
-		Elem:     s3ConfigurationElem(),
-	}
-}
-
-func s3ConfigurationSchema() *schema.Schema {
-	return &schema.Schema{
-		Type:     schema.TypeList,
-		MaxItems: 1,
-		Required: true,
-		Elem:     s3ConfigurationElem(),
-	}
-}
-
-func s3ConfigurationElem() *schema.Resource {
-	return &schema.Resource{
-		Schema: map[string]*schema.Schema{
-			"bucket_arn": {
-				Type:         schema.TypeString,
-				Required:     true,
-				ValidateFunc: verify.ValidARN,
-			},
-
-			"buffering_size": {
-				Type:         schema.TypeInt,
-				Optional:     true,
-				Default:      5,
-				ValidateFunc: validation.IntAtLeast(1),
-			},
-
-			"buffering_interval": {
-				Type:         schema.TypeInt,
-				Optional:     true,
-				Default:      300,
-				ValidateFunc: validation.IntAtLeast(60),
-			},
-
-			"compression_format": {
-				Type:         schema.TypeString,
-				Optional:     true,
-				Default:      firehose.CompressionFormatUncompressed,
-				ValidateFunc: validation.StringInSlice(firehose.CompressionFormat_Values(), false),
-			},
-
-			"error_output_prefix": {
-				Type:         schema.TypeString,
-				Optional:     true,
-				ValidateFunc: validation.StringLenBetween(0, 1024),
-			},
-
-			"kms_key_arn": {
-				Type:         schema.TypeString,
-				Optional:     true,
-				ValidateFunc: verify.ValidARN,
-			},
-
-			"role_arn": {
-				Type:         schema.TypeString,
-				Required:     true,
-				ValidateFunc: verify.ValidARN,
-			},
-
-			"prefix": {
-				Type:     schema.TypeString,
-				Optional: true,
-			},
-
-			"cloudwatch_logging_options": cloudWatchLoggingOptionsSchema(),
-		},
-	}
-}
-
-func processingConfigurationSchema() *schema.Schema {
-	return &schema.Schema{
-		Type:             schema.TypeList,
-		Optional:         true,
-		MaxItems:         1,
-		DiffSuppressFunc: verify.SuppressMissingOptionalConfigurationBlock,
-		Elem: &schema.Resource{
-			Schema: map[string]*schema.Schema{
-				"enabled": {
-					Type:     schema.TypeBool,
-					Optional: true,
-				},
-				"processors": {
+				}
+			}
+			dynamicPartitioningConfigurationSchema := func() *schema.Schema {
+				return &schema.Schema{
 					Type:     schema.TypeList,
+					MaxItems: 1,
 					Optional: true,
+					ForceNew: true,
 					Elem: &schema.Resource{
 						Schema: map[string]*schema.Schema{
-							"parameters": {
+							"enabled": {
+								Type:     schema.TypeBool,
+								Optional: true,
+								Default:  false,
+								ForceNew: true,
+							},
+							"retry_duration": {
+								Type:         schema.TypeInt,
+								Optional:     true,
+								Default:      300,
+								ValidateFunc: validation.IntBetween(0, 7200),
+							},
+						},
+					},
+				}
+			}
+			processingConfigurationSchema := func() *schema.Schema {
+				return &schema.Schema{
+					Type:             schema.TypeList,
+					Optional:         true,
+					MaxItems:         1,
+					DiffSuppressFunc: verify.SuppressMissingOptionalConfigurationBlock,
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"enabled": {
+								Type:     schema.TypeBool,
+								Optional: true,
+							},
+							"processors": {
 								Type:     schema.TypeList,
 								Optional: true,
 								Elem: &schema.Resource{
 									Schema: map[string]*schema.Schema{
-										"parameter_name": {
-											Type:         schema.TypeString,
-											Required:     true,
-											ValidateFunc: validation.StringInSlice(firehose.ProcessorParameterName_Values(), false),
+										"parameters": {
+											Type:     schema.TypeList,
+											Optional: true,
+											Elem: &schema.Resource{
+												Schema: map[string]*schema.Schema{
+													"parameter_name": {
+														Type:         schema.TypeString,
+														Required:     true,
+														ValidateFunc: validation.StringInSlice(firehose.ProcessorParameterName_Values(), false),
+													},
+													"parameter_value": {
+														Type:         schema.TypeString,
+														Required:     true,
+														ValidateFunc: validation.StringLenBetween(1, 5120),
+													},
+												},
+											},
 										},
-										"parameter_value": {
+										"type": {
 											Type:         schema.TypeString,
 											Required:     true,
-											ValidateFunc: validation.StringLenBetween(1, 5120),
+											ValidateFunc: validation.StringInSlice(firehose.ProcessorType_Values(), false),
+										},
+									},
+								},
+							},
+						},
+					},
+				}
+			}
+			requestConfigurationSchema := func() *schema.Schema {
+				return &schema.Schema{
+					Type:     schema.TypeList,
+					MaxItems: 1,
+					Optional: true,
+					Computed: true,
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"common_attributes": {
+								Type:     schema.TypeList,
+								Optional: true,
+								Elem: &schema.Resource{
+									Schema: map[string]*schema.Schema{
+										"name": {
+											Type:     schema.TypeString,
+											Required: true,
+										},
+										"value": {
+											Type:     schema.TypeString,
+											Required: true,
 										},
 									},
 								},
 							},
-							"type": {
+							"content_encoding": {
+								Type:         schema.TypeString,
+								Optional:     true,
+								Default:      firehose.ContentEncodingNone,
+								ValidateFunc: validation.StringInSlice(firehose.ContentEncoding_Values(), false),
+							},
+						},
+					},
+				}
+			}
+			s3ConfigurationElem := func() *schema.Resource {
+				return &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"bucket_arn": {
+							Type:         schema.TypeString,
+							Required:     true,
+							ValidateFunc: verify.ValidARN,
+						},
+						"buffering_interval": {
+							Type:         schema.TypeInt,
+							Optional:     true,
+							Default:      300,
+							ValidateFunc: validation.IntAtLeast(60),
+						},
+						"buffering_size": {
+							Type:         schema.TypeInt,
+							Optional:     true,
+							Default:      5,
+							ValidateFunc: validation.IntAtLeast(1),
+						},
+						"cloudwatch_logging_options": cloudWatchLoggingOptionsSchema(),
+						"compression_format": {
+							Type:         schema.TypeString,
+							Optional:     true,
+							Default:      firehose.CompressionFormatUncompressed,
+							ValidateFunc: validation.StringInSlice(firehose.CompressionFormat_Values(), false),
+						},
+						"error_output_prefix": {
+							Type:         schema.TypeString,
+							Optional:     true,
+							ValidateFunc: validation.StringLenBetween(0, 1024),
+						},
+						"kms_key_arn": {
+							Type:         schema.TypeString,
+							Optional:     true,
+							ValidateFunc: verify.ValidARN,
+						},
+						"prefix": {
+							Type:     schema.TypeString,
+							Optional: true,
+						},
+						"role_arn": {
+							Type:         schema.TypeString,
+							Required:     true,
+							ValidateFunc: verify.ValidARN,
+						},
+					},
+				}
+			}
+			s3BackupConfigurationSchema := func() *schema.Schema {
+				return &schema.Schema{
+					Type:     schema.TypeList,
+					MaxItems: 1,
+					Optional: true,
+					Elem:     s3ConfigurationElem(),
+				}
+			}
+			s3ConfigurationSchema := func() *schema.Schema {
+				return &schema.Schema{
+					Type:     schema.TypeList,
+					MaxItems: 1,
+					Required: true,
+					Elem:     s3ConfigurationElem(),
+				}
+			}
+
+			return map[string]*schema.Schema{
+				"arn": {
+					Type:     schema.TypeString,
+					Optional: true,
+					Computed: true,
+				},
+				"destination": {
+					Type:     schema.TypeString,
+					Required: true,
+					ForceNew: true,
+					StateFunc: func(v interface{}) string {
+						value := v.(string)
+						return strings.ToLower(value)
+					},
+					ValidateFunc: validation.StringInSlice(destinationType_Values(), false),
+				},
+				"destination_id": {
+					Type:     schema.TypeString,
+					Optional: true,
+					Computed: true,
+				},
+				"elasticsearch_configuration": {
+					Type:     schema.TypeList,
+					Optional: true,
+					MaxItems: 1,
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"buffering_interval": {
+								Type:         schema.TypeInt,
+								Optional:     true,
+								Default:      300,
+								ValidateFunc: validation.IntBetween(60, 900),
+							},
+							"buffering_size": {
+								Type:         schema.TypeInt,
+								Optional:     true,
+								Default:      5,
+								ValidateFunc: validation.IntBetween(1, 100),
+							},
+							"cloudwatch_logging_options": cloudWatchLoggingOptionsSchema(),
+							"cluster_endpoint": {
+								Type:          schema.TypeString,
+								Optional:      true,
+								ConflictsWith: []string{"elasticsearch_configuration.0.domain_arn"},
+							},
+							"domain_arn": {
+								Type:          schema.TypeString,
+								Optional:      true,
+								ValidateFunc:  verify.ValidARN,
+								ConflictsWith: []string{"elasticsearch_configuration.0.cluster_endpoint"},
+							},
+							"index_name": {
+								Type:     schema.TypeString,
+								Required: true,
+							},
+							"index_rotation_period": {
+								Type:         schema.TypeString,
+								Optional:     true,
+								Default:      firehose.ElasticsearchIndexRotationPeriodOneDay,
+								ValidateFunc: validation.StringInSlice(firehose.ElasticsearchIndexRotationPeriod_Values(), false),
+							},
+							"processing_configuration": processingConfigurationSchema(),
+							"retry_duration": {
+								Type:         schema.TypeInt,
+								Optional:     true,
+								Default:      300,
+								ValidateFunc: validation.IntBetween(0, 7200),
+							},
+							"role_arn": {
 								Type:         schema.TypeString,
 								Required:     true,
-								ValidateFunc: validation.StringInSlice(firehose.ProcessorType_Values(), false),
+								ValidateFunc: verify.ValidARN,
+							},
+							"s3_backup_mode": {
+								Type:         schema.TypeString,
+								ForceNew:     true,
+								Optional:     true,
+								Default:      firehose.ElasticsearchS3BackupModeFailedDocumentsOnly,
+								ValidateFunc: validation.StringInSlice(firehose.ElasticsearchS3BackupMode_Values(), false),
+							},
+							"s3_configuration": s3ConfigurationSchema(),
+							"type_name": {
+								Type:         schema.TypeString,
+								Optional:     true,
+								ValidateFunc: validation.StringLenBetween(0, 100),
+							},
+							"vpc_config": {
+								Type:     schema.TypeList,
+								Optional: true,
+								ForceNew: true,
+								MaxItems: 1,
+								Elem: &schema.Resource{
+									Schema: map[string]*schema.Schema{
+										"role_arn": {
+											Type:         schema.TypeString,
+											Required:     true,
+											ForceNew:     true,
+											ValidateFunc: verify.ValidARN,
+										},
+										"security_group_ids": {
+											Type:     schema.TypeSet,
+											Required: true,
+											ForceNew: true,
+											Elem:     &schema.Schema{Type: schema.TypeString},
+										},
+										"subnet_ids": {
+											Type:     schema.TypeSet,
+											Required: true,
+											ForceNew: true,
+											Elem:     &schema.Schema{Type: schema.TypeString},
+										},
+										"vpc_id": {
+											Type:     schema.TypeString,
+											Computed: true,
+										},
+									},
+								},
 							},
 						},
 					},
 				},
-			},
-		},
-	}
-}
-
-func flattenCloudWatchLoggingOptions(clo *firehose.CloudWatchLoggingOptions) []interface{} {
-	if clo == nil {
-		return []interface{}{}
-	}
-
-	cloudwatchLoggingOptions := map[string]interface{}{
-		"enabled": aws.BoolValue(clo.Enabled),
-	}
-	if aws.BoolValue(clo.Enabled) {
-		cloudwatchLoggingOptions["log_group_name"] = aws.StringValue(clo.LogGroupName)
-		cloudwatchLoggingOptions["log_stream_name"] = aws.StringValue(clo.LogStreamName)
-	}
-	return []interface{}{cloudwatchLoggingOptions}
-}
-
-func flattenElasticsearchConfiguration(description *firehose.ElasticsearchDestinationDescription) []map[string]interface{} {
-	if description == nil {
-		return []map[string]interface{}{}
-	}
-
-	m := map[string]interface{}{
-		"cloudwatch_logging_options": flattenCloudWatchLoggingOptions(description.CloudWatchLoggingOptions),
-		"role_arn":                   aws.StringValue(description.RoleARN),
-		"type_name":                  aws.StringValue(description.TypeName),
-		"index_name":                 aws.StringValue(description.IndexName),
-		"s3_backup_mode":             aws.StringValue(description.S3BackupMode),
-		"s3_configuration":           flattenS3Configuration(description.S3DestinationDescription),
-		"index_rotation_period":      aws.StringValue(description.IndexRotationPeriod),
-		"vpc_config":                 flattenVPCConfiguration(description.VpcConfigurationDescription),
-		"processing_configuration":   flattenProcessingConfiguration(description.ProcessingConfiguration, aws.StringValue(description.RoleARN)),
-	}
-
-	if description.DomainARN != nil {
-		m["domain_arn"] = aws.StringValue(description.DomainARN)
-	}
-
-	if description.ClusterEndpoint != nil {
-		m["cluster_endpoint"] = aws.StringValue(description.ClusterEndpoint)
-	}
-
-	if description.BufferingHints != nil {
-		m["buffering_interval"] = int(aws.Int64Value(description.BufferingHints.IntervalInSeconds))
-		m["buffering_size"] = int(aws.Int64Value(description.BufferingHints.SizeInMBs))
-	}
-
-	if description.RetryOptions != nil {
-		m["retry_duration"] = int(aws.Int64Value(description.RetryOptions.DurationInSeconds))
-	}
-
-	return []map[string]interface{}{m}
-}
-
-func flattenOpensearchConfiguration(description *firehose.AmazonopensearchserviceDestinationDescription) []map[string]interface{} {
-	if description == nil {
-		return []map[string]interface{}{}
-	}
-
-	m := map[string]interface{}{
-		"cloudwatch_logging_options": flattenCloudWatchLoggingOptions(description.CloudWatchLoggingOptions),
-		"role_arn":                   aws.StringValue(description.RoleARN),
-		"type_name":                  aws.StringValue(description.TypeName),
-		"index_name":                 aws.StringValue(description.IndexName),
-		"s3_backup_mode":             aws.StringValue(description.S3BackupMode),
-		"s3_configuration":           flattenS3Configuration(description.S3DestinationDescription),
-		"index_rotation_period":      aws.StringValue(description.IndexRotationPeriod),
-		"vpc_config":                 flattenVPCConfiguration(description.VpcConfigurationDescription),
-		"processing_configuration":   flattenProcessingConfiguration(description.ProcessingConfiguration, aws.StringValue(description.RoleARN)),
-	}
-
-	if description.DomainARN != nil {
-		m["domain_arn"] = aws.StringValue(description.DomainARN)
-	}
-
-	if description.ClusterEndpoint != nil {
-		m["cluster_endpoint"] = aws.StringValue(description.ClusterEndpoint)
-	}
-
-	if description.BufferingHints != nil {
-		m["buffering_interval"] = int(aws.Int64Value(description.BufferingHints.IntervalInSeconds))
-		m["buffering_size"] = int(aws.Int64Value(description.BufferingHints.SizeInMBs))
-	}
-
-	if description.RetryOptions != nil {
-		m["retry_duration"] = int(aws.Int64Value(description.RetryOptions.DurationInSeconds))
-	}
-
-	return []map[string]interface{}{m}
-}
-
-func flattenVPCConfiguration(description *firehose.VpcConfigurationDescription) []map[string]interface{} {
-	if description == nil {
-		return []map[string]interface{}{}
-	}
-
-	m := map[string]interface{}{
-		"vpc_id":             aws.StringValue(description.VpcId),
-		"subnet_ids":         flex.FlattenStringSet(description.SubnetIds),
-		"security_group_ids": flex.FlattenStringSet(description.SecurityGroupIds),
-		"role_arn":           aws.StringValue(description.RoleARN),
-	}
-
-	return []map[string]interface{}{m}
-}
-
-func flattenExtendedS3Configuration(description *firehose.ExtendedS3DestinationDescription) []map[string]interface{} {
-	if description == nil {
-		return []map[string]interface{}{}
-	}
-
-	m := map[string]interface{}{
-		"bucket_arn":                           aws.StringValue(description.BucketARN),
-		"cloudwatch_logging_options":           flattenCloudWatchLoggingOptions(description.CloudWatchLoggingOptions),
-		"compression_format":                   aws.StringValue(description.CompressionFormat),
-		"data_format_conversion_configuration": flattenDataFormatConversionConfiguration(description.DataFormatConversionConfiguration),
-		"error_output_prefix":                  aws.StringValue(description.ErrorOutputPrefix),
-		"prefix":                               aws.StringValue(description.Prefix),
-		"processing_configuration":             flattenProcessingConfiguration(description.ProcessingConfiguration, aws.StringValue(description.RoleARN)),
-		"dynamic_partitioning_configuration":   flattenDynamicPartitioningConfiguration(description.DynamicPartitioningConfiguration),
-		"role_arn":                             aws.StringValue(description.RoleARN),
-		"s3_backup_configuration":              flattenS3Configuration(description.S3BackupDescription),
-		"s3_backup_mode":                       aws.StringValue(description.S3BackupMode),
-	}
-
-	if description.BufferingHints != nil {
-		m["buffering_interval"] = int(aws.Int64Value(description.BufferingHints.IntervalInSeconds))
-		m["buffering_size"] = int(aws.Int64Value(description.BufferingHints.SizeInMBs))
-	}
-
-	if description.EncryptionConfiguration != nil && description.EncryptionConfiguration.KMSEncryptionConfig != nil {
-		m["kms_key_arn"] = aws.StringValue(description.EncryptionConfiguration.KMSEncryptionConfig.AWSKMSKeyARN)
-	}
-
-	return []map[string]interface{}{m}
-}
-
-func flattenRedshiftConfiguration(description *firehose.RedshiftDestinationDescription, configuredPassword string) []map[string]interface{} {
-	if description == nil {
-		return []map[string]interface{}{}
-	}
-
-	m := map[string]interface{}{
-		"cloudwatch_logging_options": flattenCloudWatchLoggingOptions(description.CloudWatchLoggingOptions),
-		"cluster_jdbcurl":            aws.StringValue(description.ClusterJDBCURL),
-		"password":                   configuredPassword,
-		"processing_configuration":   flattenProcessingConfiguration(description.ProcessingConfiguration, aws.StringValue(description.RoleARN)),
-		"role_arn":                   aws.StringValue(description.RoleARN),
-		"s3_backup_configuration":    flattenS3Configuration(description.S3BackupDescription),
-		"s3_backup_mode":             aws.StringValue(description.S3BackupMode),
-		"s3_configuration":           flattenS3Configuration(description.S3DestinationDescription),
-		"username":                   aws.StringValue(description.Username),
-	}
-
-	if description.CopyCommand != nil {
-		m["copy_options"] = aws.StringValue(description.CopyCommand.CopyOptions)
-		m["data_table_columns"] = aws.StringValue(description.CopyCommand.DataTableColumns)
-		m["data_table_name"] = aws.StringValue(description.CopyCommand.DataTableName)
-	}
-
-	if description.RetryOptions != nil {
-		m["retry_duration"] = int(aws.Int64Value(description.RetryOptions.DurationInSeconds))
-	}
-
-	return []map[string]interface{}{m}
-}
-
-func flattenSplunkConfiguration(description *firehose.SplunkDestinationDescription) []map[string]interface{} {
-	if description == nil {
-		return []map[string]interface{}{}
-	}
-	m := map[string]interface{}{
-		"cloudwatch_logging_options": flattenCloudWatchLoggingOptions(description.CloudWatchLoggingOptions),
-		"hec_acknowledgment_timeout": int(aws.Int64Value(description.HECAcknowledgmentTimeoutInSeconds)),
-		"hec_endpoint_type":          aws.StringValue(description.HECEndpointType),
-		"hec_endpoint":               aws.StringValue(description.HECEndpoint),
-		"hec_token":                  aws.StringValue(description.HECToken),
-		"processing_configuration":   flattenProcessingConfiguration(description.ProcessingConfiguration, ""),
-		"s3_backup_mode":             aws.StringValue(description.S3BackupMode),
-		"s3_configuration":           flattenS3Configuration(description.S3DestinationDescription),
-	}
-
-	if description.RetryOptions != nil {
-		m["retry_duration"] = int(aws.Int64Value(description.RetryOptions.DurationInSeconds))
-	}
-
-	return []map[string]interface{}{m}
-}
-
-func flattenS3Configuration(description *firehose.S3DestinationDescription) []map[string]interface{} {
-	if description == nil {
-		return []map[string]interface{}{}
-	}
-
-	m := map[string]interface{}{
-		"bucket_arn":                 aws.StringValue(description.BucketARN),
-		"cloudwatch_logging_options": flattenCloudWatchLoggingOptions(description.CloudWatchLoggingOptions),
-		"compression_format":         aws.StringValue(description.CompressionFormat),
-		"error_output_prefix":        aws.StringValue(description.ErrorOutputPrefix),
-		"prefix":                     aws.StringValue(description.Prefix),
-		"role_arn":                   aws.StringValue(description.RoleARN),
-	}
-
-	if description.BufferingHints != nil {
-		m["buffering_interval"] = int(aws.Int64Value(description.BufferingHints.IntervalInSeconds))
-		m["buffering_size"] = int(aws.Int64Value(description.BufferingHints.SizeInMBs))
-	}
-
-	if description.EncryptionConfiguration != nil && description.EncryptionConfiguration.KMSEncryptionConfig != nil {
-		m["kms_key_arn"] = aws.StringValue(description.EncryptionConfiguration.KMSEncryptionConfig.AWSKMSKeyARN)
-	}
-
-	return []map[string]interface{}{m}
-}
-
-func flattenDataFormatConversionConfiguration(dfcc *firehose.DataFormatConversionConfiguration) []map[string]interface{} {
-	if dfcc == nil {
-		return []map[string]interface{}{}
-	}
-
-	enabled := aws.BoolValue(dfcc.Enabled)
-	ifc := flattenInputFormatConfiguration(dfcc.InputFormatConfiguration)
-	ofc := flattenOutputFormatConfiguration(dfcc.OutputFormatConfiguration)
-	sc := flattenSchemaConfiguration(dfcc.SchemaConfiguration)
-
-	// The AWS SDK can represent "no data format conversion configuration" in two ways:
-	// 1. With a nil value
-	// 2. With enabled set to false and nil for ALL the config sections.
-	// We normalize this with an empty configuration in the state due
-	// to the existing Default: true on the enabled attribute.
-	if !enabled && len(ifc) == 0 && len(ofc) == 0 && len(sc) == 0 {
-		return []map[string]interface{}{}
-	}
-
-	m := map[string]interface{}{
-		"enabled":                     enabled,
-		"input_format_configuration":  ifc,
-		"output_format_configuration": ofc,
-		"schema_configuration":        sc,
-	}
-
-	return []map[string]interface{}{m}
-}
-
-func flattenInputFormatConfiguration(ifc *firehose.InputFormatConfiguration) []map[string]interface{} {
-	if ifc == nil {
-		return []map[string]interface{}{}
-	}
-
-	m := map[string]interface{}{
-		"deserializer": flattenDeserializer(ifc.Deserializer),
-	}
-
-	return []map[string]interface{}{m}
-}
-
-func flattenDeserializer(deserializer *firehose.Deserializer) []map[string]interface{} {
-	if deserializer == nil {
-		return []map[string]interface{}{}
-	}
-
-	m := map[string]interface{}{
-		"hive_json_ser_de":   flattenHiveJSONSerDe(deserializer.HiveJsonSerDe),
-		"open_x_json_ser_de": flattenOpenXJSONSerDe(deserializer.OpenXJsonSerDe),
-	}
-
-	return []map[string]interface{}{m}
-}
-
-func flattenHiveJSONSerDe(hjsd *firehose.HiveJsonSerDe) []map[string]interface{} {
-	if hjsd == nil {
-		return []map[string]interface{}{}
-	}
-
-	m := map[string]interface{}{
-		"timestamp_formats": flex.FlattenStringList(hjsd.TimestampFormats),
-	}
-
-	return []map[string]interface{}{m}
-}
-
-func flattenOpenXJSONSerDe(oxjsd *firehose.OpenXJsonSerDe) []map[string]interface{} {
-	if oxjsd == nil {
-		return []map[string]interface{}{}
-	}
-
-	m := map[string]interface{}{
-		"column_to_json_key_mappings":              aws.StringValueMap(oxjsd.ColumnToJsonKeyMappings),
-		"convert_dots_in_json_keys_to_underscores": aws.BoolValue(oxjsd.ConvertDotsInJsonKeysToUnderscores),
-	}
-
-	// API omits default values
-	// Return defaults that are not type zero values to prevent extraneous difference
-
-	m["case_insensitive"] = true
-	if oxjsd.CaseInsensitive != nil {
-		m["case_insensitive"] = aws.BoolValue(oxjsd.CaseInsensitive)
-	}
-
-	return []map[string]interface{}{m}
-}
-
-func flattenOutputFormatConfiguration(ofc *firehose.OutputFormatConfiguration) []map[string]interface{} {
-	if ofc == nil {
-		return []map[string]interface{}{}
-	}
-
-	m := map[string]interface{}{
-		"serializer": flattenSerializer(ofc.Serializer),
-	}
-
-	return []map[string]interface{}{m}
-}
-
-func flattenSerializer(serializer *firehose.Serializer) []map[string]interface{} {
-	if serializer == nil {
-		return []map[string]interface{}{}
-	}
-
-	m := map[string]interface{}{
-		"orc_ser_de":     flattenOrcSerDe(serializer.OrcSerDe),
-		"parquet_ser_de": flattenParquetSerDe(serializer.ParquetSerDe),
-	}
-
-	return []map[string]interface{}{m}
-}
-
-func flattenOrcSerDe(osd *firehose.OrcSerDe) []map[string]interface{} {
-	if osd == nil {
-		return []map[string]interface{}{}
-	}
-
-	m := map[string]interface{}{
-		"bloom_filter_columns":     aws.StringValueSlice(osd.BloomFilterColumns),
-		"dictionary_key_threshold": aws.Float64Value(osd.DictionaryKeyThreshold),
-		"enable_padding":           aws.BoolValue(osd.EnablePadding),
-	}
-
-	// API omits default values
-	// Return defaults that are not type zero values to prevent extraneous difference
-
-	m["block_size_bytes"] = 268435456
-	if osd.BlockSizeBytes != nil {
-		m["block_size_bytes"] = int(aws.Int64Value(osd.BlockSizeBytes))
-	}
-
-	m["bloom_filter_false_positive_probability"] = 0.05
-	if osd.BloomFilterFalsePositiveProbability != nil {
-		m["bloom_filter_false_positive_probability"] = aws.Float64Value(osd.BloomFilterFalsePositiveProbability)
-	}
-
-	m["compression"] = firehose.OrcCompressionSnappy
-	if osd.Compression != nil {
-		m["compression"] = aws.StringValue(osd.Compression)
-	}
-
-	m["format_version"] = firehose.OrcFormatVersionV012
-	if osd.FormatVersion != nil {
-		m["format_version"] = aws.StringValue(osd.FormatVersion)
-	}
-
-	m["padding_tolerance"] = 0.05
-	if osd.PaddingTolerance != nil {
-		m["padding_tolerance"] = aws.Float64Value(osd.PaddingTolerance)
-	}
-
-	m["row_index_stride"] = 10000
-	if osd.RowIndexStride != nil {
-		m["row_index_stride"] = int(aws.Int64Value(osd.RowIndexStride))
-	}
-
-	m["stripe_size_bytes"] = 67108864
-	if osd.StripeSizeBytes != nil {
-		m["stripe_size_bytes"] = int(aws.Int64Value(osd.StripeSizeBytes))
-	}
-
-	return []map[string]interface{}{m}
-}
-
-func flattenParquetSerDe(psd *firehose.ParquetSerDe) []map[string]interface{} {
-	if psd == nil {
-		return []map[string]interface{}{}
-	}
-
-	m := map[string]interface{}{
-		"enable_dictionary_compression": aws.BoolValue(psd.EnableDictionaryCompression),
-		"max_padding_bytes":             int(aws.Int64Value(psd.MaxPaddingBytes)),
-	}
-
-	// API omits default values
-	// Return defaults that are not type zero values to prevent extraneous difference
-
-	m["block_size_bytes"] = 268435456
-	if psd.BlockSizeBytes != nil {
-		m["block_size_bytes"] = int(aws.Int64Value(psd.BlockSizeBytes))
-	}
-
-	m["compression"] = firehose.ParquetCompressionSnappy
-	if psd.Compression != nil {
-		m["compression"] = aws.StringValue(psd.Compression)
-	}
-
-	m["page_size_bytes"] = 1048576
-	if psd.PageSizeBytes != nil {
-		m["page_size_bytes"] = int(aws.Int64Value(psd.PageSizeBytes))
-	}
-
-	m["writer_version"] = firehose.ParquetWriterVersionV1
-	if psd.WriterVersion != nil {
-		m["writer_version"] = aws.StringValue(psd.WriterVersion)
-	}
-
-	return []map[string]interface{}{m}
-}
-
-func flattenSchemaConfiguration(sc *firehose.SchemaConfiguration) []map[string]interface{} {
-	if sc == nil {
-		return []map[string]interface{}{}
-	}
-
-	m := map[string]interface{}{
-		"catalog_id":    aws.StringValue(sc.CatalogId),
-		"database_name": aws.StringValue(sc.DatabaseName),
-		"region":        aws.StringValue(sc.Region),
-		"role_arn":      aws.StringValue(sc.RoleARN),
-		"table_name":    aws.StringValue(sc.TableName),
-		"version_id":    aws.StringValue(sc.VersionId),
-	}
+				"extended_s3_configuration": {
+					Type:     schema.TypeList,
+					Optional: true,
+					MaxItems: 1,
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"bucket_arn": {
+								Type:         schema.TypeString,
+								Required:     true,
+								ValidateFunc: verify.ValidARN,
+							},
+							"buffering_interval": {
+								Type:     schema.TypeInt,
+								Optional: true,
+								Default:  300,
+							},
+							"buffering_size": {
+								Type:     schema.TypeInt,
+								Optional: true,
+								Default:  5,
+							},
+							"cloudwatch_logging_options": cloudWatchLoggingOptionsSchema(),
+							"compression_format": {
+								Type:         schema.TypeString,
+								Optional:     true,
+								Default:      firehose.CompressionFormatUncompressed,
+								ValidateFunc: validation.StringInSlice(firehose.CompressionFormat_Values(), false),
+							},
+							"data_format_conversion_configuration": {
+								Type:     schema.TypeList,
+								Optional: true,
+								MaxItems: 1,
+								Elem: &schema.Resource{
+									Schema: map[string]*schema.Schema{
+										"enabled": {
+											Type:     schema.TypeBool,
+											Optional: true,
+											Default:  true,
+										},
+										"input_format_configuration": {
+											Type:     schema.TypeList,
+											Required: true,
+											MaxItems: 1,
+											Elem: &schema.Resource{
+												Schema: map[string]*schema.Schema{
+													"deserializer": {
+														Type:     schema.TypeList,
+														Required: true,
+														MaxItems: 1,
+														Elem: &schema.Resource{
+															Schema: map[string]*schema.Schema{
+																"hive_json_ser_de": {
+																	Type:          schema.TypeList,
+																	Optional:      true,
+																	MaxItems:      1,
+																	ConflictsWith: []string{"extended_s3_configuration.0.data_format_conversion_configuration.0.input_format_configuration.0.deserializer.0.open_x_json_ser_de"},
+																	Elem: &schema.Resource{
+																		Schema: map[string]*schema.Schema{
+																			"timestamp_formats": {
+																				Type:     schema.TypeList,
+																				Optional: true,
+																				Elem:     &schema.Schema{Type: schema.TypeString},
+																			},
+																		},
+																	},
+																},
+																"open_x_json_ser_de": {
+																	Type:          schema.TypeList,
+																	Optional:      true,
+																	MaxItems:      1,
+																	ConflictsWith: []string{"extended_s3_configuration.0.data_format_conversion_configuration.0.input_format_configuration.0.deserializer.0.hive_json_ser_de"},
+																	Elem: &schema.Resource{
+																		Schema: map[string]*schema.Schema{
+																			"case_insensitive": {
+																				Type:     schema.TypeBool,
+																				Optional: true,
+																				Default:  true,
+																			},
+																			"column_to_json_key_mappings": {
+																				Type:     schema.TypeMap,
+																				Optional: true,
+																				Elem:     &schema.Schema{Type: schema.TypeString},
+																			},
+																			"convert_dots_in_json_keys_to_underscores": {
+																				Type:     schema.TypeBool,
+																				Optional: true,
+																				Default:  false,
+																			},
+																		},
+																	},
+																},
+															},
+														},
+													},
+												},
+											},
+										},
+										"output_format_configuration": {
+											Type:     schema.TypeList,
+											Required: true,
+											MaxItems: 1,
+											Elem: &schema.Resource{
+												Schema: map[string]*schema.Schema{
+													"serializer": {
+														Type:     schema.TypeList,
+														Required: true,
+														MaxItems: 1,
+														Elem: &schema.Resource{
+															Schema: map[string]*schema.Schema{
+																"orc_ser_de": {
+																	Type:          schema.TypeList,
+																	Optional:      true,
+																	MaxItems:      1,
+																	ConflictsWith: []string{"extended_s3_configuration.0.data_format_conversion_configuration.0.output_format_configuration.0.serializer.0.parquet_ser_de"},
+																	Elem: &schema.Resource{
+																		Schema: map[string]*schema.Schema{
+																			"block_size_bytes": {
+																				Type:     schema.TypeInt,
+																				Optional: true,
+																				// 256 MiB
+																				Default: 268435456,
+																				// 64 MiB
+																				ValidateFunc: validation.IntAtLeast(67108864),
+																			},
+																			"bloom_filter_columns": {
+																				Type:     schema.TypeList,
+																				Optional: true,
+																				Elem:     &schema.Schema{Type: schema.TypeString},
+																			},
+																			"bloom_filter_false_positive_probability": {
+																				Type:     schema.TypeFloat,
+																				Optional: true,
+																				Default:  0.05,
+																			},
+																			"compression": {
+																				Type:         schema.TypeString,
+																				Optional:     true,
+																				Default:      firehose.OrcCompressionSnappy,
+																				ValidateFunc: validation.StringInSlice(firehose.OrcCompression_Values(), false),
+																			},
+																			"dictionary_key_threshold": {
+																				Type:     schema.TypeFloat,
+																				Optional: true,
+																				Default:  0.0,
+																			},
+																			"enable_padding": {
+																				Type:     schema.TypeBool,
+																				Optional: true,
+																				Default:  false,
+																			},
+																			"format_version": {
+																				Type:         schema.TypeString,
+																				Optional:     true,
+																				Default:      firehose.OrcFormatVersionV012,
+																				ValidateFunc: validation.StringInSlice(firehose.OrcFormatVersion_Values(), false),
+																			},
+																			"padding_tolerance": {
+																				Type:     schema.TypeFloat,
+																				Optional: true,
+																				Default:  0.05,
+																			},
+																			"row_index_stride": {
+																				Type:         schema.TypeInt,
+																				Optional:     true,
+																				Default:      10000,
+																				ValidateFunc: validation.IntAtLeast(1000),
+																			},
+																			"stripe_size_bytes": {
+																				Type:     schema.TypeInt,
+																				Optional: true,
+																				// 64 MiB
+																				Default: 67108864,
+																				// 8 MiB
+																				ValidateFunc: validation.IntAtLeast(8388608),
+																			},
+																		},
+																	},
+																},
+																"parquet_ser_de": {
+																	Type:          schema.TypeList,
+																	Optional:      true,
+																	MaxItems:      1,
+																	ConflictsWith: []string{"extended_s3_configuration.0.data_format_conversion_configuration.0.output_format_configuration.0.serializer.0.orc_ser_de"},
+																	Elem: &schema.Resource{
+																		Schema: map[string]*schema.Schema{
+																			"block_size_bytes": {
+																				Type:     schema.TypeInt,
+																				Optional: true,
+																				// 256 MiB
+																				Default: 268435456,
+																				// 64 MiB
+																				ValidateFunc: validation.IntAtLeast(67108864),
+																			},
+																			"compression": {
+																				Type:         schema.TypeString,
+																				Optional:     true,
+																				Default:      firehose.ParquetCompressionSnappy,
+																				ValidateFunc: validation.StringInSlice(firehose.ParquetCompression_Values(), false),
+																			},
+																			"enable_dictionary_compression": {
+																				Type:     schema.TypeBool,
+																				Optional: true,
+																				Default:  false,
+																			},
+																			"max_padding_bytes": {
+																				Type:     schema.TypeInt,
+																				Optional: true,
+																				Default:  0,
+																			},
+																			"page_size_bytes": {
+																				Type:     schema.TypeInt,
+																				Optional: true,
+																				// 1 MiB
+																				Default: 1048576,
+																				// 64 KiB
+																				ValidateFunc: validation.IntAtLeast(65536),
+																			},
+																			"writer_version": {
+																				Type:         schema.TypeString,
+																				Optional:     true,
+																				Default:      firehose.ParquetWriterVersionV1,
+																				ValidateFunc: validation.StringInSlice(firehose.ParquetWriterVersion_Values(), false),
+																			},
+																		},
+																	},
+																},
+															},
+														},
+													},
+												},
+											},
+										},
+										"schema_configuration": {
+											Type:     schema.TypeList,
+											Required: true,
+											MaxItems: 1,
+											Elem: &schema.Resource{
+												Schema: map[string]*schema.Schema{
+													"catalog_id": {
+														Type:     schema.TypeString,
+														Optional: true,
+														Computed: true,
+													},
+													"database_name": {
+														Type:     schema.TypeString,
+														Required: true,
+													},
+													"region": {
+														Type:     schema.TypeString,
+														Optional: true,
+														Computed: true,
+													},
+													"role_arn": {
+														Type:         schema.TypeString,
+														Required:     true,
+														ValidateFunc: verify.ValidARN,
+													},
+													"table_name": {
+														Type:     schema.TypeString,
+														Required: true,
+													},
+													"version_id": {
+														Type:     schema.TypeString,
+														Optional: true,
+														Default:  "LATEST",
+													},
+												},
+											},
+										},
+									},
+								},
+							},
+							"dynamic_partitioning_configuration": dynamicPartitioningConfigurationSchema(),
+							"error_output_prefix": {
+								Type:         schema.TypeString,
+								Optional:     true,
+								ValidateFunc: validation.StringLenBetween(0, 1024),
+							},
+							"kms_key_arn": {
+								Type:         schema.TypeString,
+								Optional:     true,
+								ValidateFunc: verify.ValidARN,
+							},
+							"prefix": {
+								Type:     schema.TypeString,
+								Optional: true,
+							},
+							"processing_configuration": processingConfigurationSchema(),
+							"role_arn": {
+								Type:         schema.TypeString,
+								Required:     true,
+								ValidateFunc: verify.ValidARN,
+							},
+							"s3_backup_configuration": s3BackupConfigurationSchema(),
+							"s3_backup_mode": {
+								Type:         schema.TypeString,
+								Optional:     true,
+								Default:      firehose.S3BackupModeDisabled,
+								ValidateFunc: validation.StringInSlice(firehose.S3BackupMode_Values(), false),
+							},
+						},
+					},
+				},
+				"http_endpoint_configuration": {
+					Type:     schema.TypeList,
+					Optional: true,
+					MaxItems: 1,
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"access_key": {
+								Type:         schema.TypeString,
+								Optional:     true,
+								ValidateFunc: validation.StringLenBetween(0, 4096),
+								Sensitive:    true,
+							},
+							"buffering_interval": {
+								Type:         schema.TypeInt,
+								Optional:     true,
+								Default:      300,
+								ValidateFunc: validation.IntBetween(60, 900),
+							},
+							"buffering_size": {
+								Type:         schema.TypeInt,
+								Optional:     true,
+								Default:      5,
+								ValidateFunc: validation.IntBetween(1, 100),
+							},
+							"cloudwatch_logging_options": cloudWatchLoggingOptionsSchema(),
+							"name": {
+								Type:     schema.TypeString,
+								Optional: true,
+								ValidateFunc: validation.All(
+									validation.StringLenBetween(1, 256),
+								),
+							},
+							"processing_configuration": processingConfigurationSchema(),
+							"request_configuration":    requestConfigurationSchema(),
+							"retry_duration": {
+								Type:         schema.TypeInt,
+								Optional:     true,
+								Default:      300,
+								ValidateFunc: validation.IntBetween(0, 7200),
+							},
+							"role_arn": {
+								Type:         schema.TypeString,
+								Optional:     true,
+								ValidateFunc: verify.ValidARN,
+							},
+							"s3_backup_mode": {
+								Type:         schema.TypeString,
+								Optional:     true,
+								Default:      firehose.HttpEndpointS3BackupModeFailedDataOnly,
+								ValidateFunc: validation.StringInSlice(firehose.HttpEndpointS3BackupMode_Values(), false),
+							},
+							"s3_configuration": s3ConfigurationSchema(),
+							"url": {
+								Type:     schema.TypeString,
+								Required: true,
+								ValidateFunc: validation.All(
+									validation.StringLenBetween(1, 1000),
+									validation.StringMatch(regexache.MustCompile(`^https://.*$`), ""),
+								),
+							},
+						},
+					},
+				},
+				"kinesis_source_configuration": {
+					Type:          schema.TypeList,
+					ForceNew:      true,
+					Optional:      true,
+					MaxItems:      1,
+					ConflictsWith: []string{"msk_source_configuration", "server_side_encryption"},
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"kinesis_stream_arn": {
+								Type:         schema.TypeString,
+								Required:     true,
+								ForceNew:     true,
+								ValidateFunc: verify.ValidARN,
+							},
+							"role_arn": {
+								Type:         schema.TypeString,
+								Required:     true,
+								ForceNew:     true,
+								ValidateFunc: verify.ValidARN,
+							},
+						},
+					},
+				},
+				"msk_source_configuration": {
+					Type:          schema.TypeList,
+					ForceNew:      true,
+					Optional:      true,
+					MaxItems:      1,
+					ConflictsWith: []string{"kinesis_source_configuration", "server_side_encryption"},
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"authentication_configuration": {
+								Type:     schema.TypeList,
+								ForceNew: true,
+								Required: true,
+								MaxItems: 1,
+								Elem: &schema.Resource{
+									Schema: map[string]*schema.Schema{
+										"connectivity": {
+											Type:         schema.TypeString,
+											Required:     true,
+											ForceNew:     true,
+											ValidateFunc: validation.StringInSlice(firehose.Connectivity_Values(), false),
+										},
+										"role_arn": {
+											Type:         schema.TypeString,
+											Required:     true,
+											ForceNew:     true,
+											ValidateFunc: verify.ValidARN,
+										},
+									},
+								},
+							},
+							"msk_cluster_arn": {
+								Type:         schema.TypeString,
+								Required:     true,
+								ForceNew:     true,
+								ValidateFunc: verify.ValidARN,
+							},
+							"topic_name": {
+								Type:     schema.TypeString,
+								Required: true,
+								ForceNew: true,
+							},
+						},
+					},
+				},
+				"name": {
+					Type:         schema.TypeString,
+					Required:     true,
+					ForceNew:     true,
+					ValidateFunc: validation.StringLenBetween(1, 64),
+				},
+				"opensearch_configuration": {
+					Type:     schema.TypeList,
+					Optional: true,
+					MaxItems: 1,
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"buffering_interval": {
+								Type:         schema.TypeInt,
+								Optional:     true,
+								Default:      300,
+								ValidateFunc: validation.IntBetween(60, 900),
+							},
+							"buffering_size": {
+								Type:         schema.TypeInt,
+								Optional:     true,
+								Default:      5,
+								ValidateFunc: validation.IntBetween(1, 100),
+							},
+							"cloudwatch_logging_options": cloudWatchLoggingOptionsSchema(),
+							"cluster_endpoint": {
+								Type:          schema.TypeString,
+								Optional:      true,
+								ConflictsWith: []string{"opensearch_configuration.0.domain_arn"},
+							},
+							"domain_arn": {
+								Type:          schema.TypeString,
+								Optional:      true,
+								ValidateFunc:  verify.ValidARN,
+								ConflictsWith: []string{"opensearch_configuration.0.cluster_endpoint"},
+							},
+							"index_name": {
+								Type:     schema.TypeString,
+								Required: true,
+							},
+							"index_rotation_period": {
+								Type:         schema.TypeString,
+								Optional:     true,
+								Default:      firehose.AmazonopensearchserviceIndexRotationPeriodOneDay,
+								ValidateFunc: validation.StringInSlice(firehose.AmazonopensearchserviceIndexRotationPeriod_Values(), false),
+							},
+							"processing_configuration": processingConfigurationSchema(),
+							"retry_duration": {
+								Type:         schema.TypeInt,
+								Optional:     true,
+								Default:      300,
+								ValidateFunc: validation.IntBetween(0, 7200),
+							},
+							"role_arn": {
+								Type:         schema.TypeString,
+								Required:     true,
+								ValidateFunc: verify.ValidARN,
+							},
+							"s3_backup_mode": {
+								Type:         schema.TypeString,
+								ForceNew:     true,
+								Optional:     true,
+								Default:      firehose.AmazonopensearchserviceS3BackupModeFailedDocumentsOnly,
+								ValidateFunc: validation.StringInSlice(firehose.AmazonopensearchserviceS3BackupMode_Values(), false),
+							},
+							"s3_configuration": s3ConfigurationSchema(),
+							"type_name": {
+								Type:         schema.TypeString,
+								Optional:     true,
+								ValidateFunc: validation.StringLenBetween(0, 100),
+							},
+							"vpc_config": {
+								Type:     schema.TypeList,
+								Optional: true,
+								ForceNew: true,
+								MaxItems: 1,
+								Elem: &schema.Resource{
+									Schema: map[string]*schema.Schema{
+										"role_arn": {
+											Type:         schema.TypeString,
+											Required:     true,
+											ForceNew:     true,
+											ValidateFunc: verify.ValidARN,
+										},
+										"security_group_ids": {
+											Type:     schema.TypeSet,
+											Required: true,
+											ForceNew: true,
+											Elem:     &schema.Schema{Type: schema.TypeString},
+										},
+										"subnet_ids": {
+											Type:     schema.TypeSet,
+											Required: true,
+											ForceNew: true,
+											Elem:     &schema.Schema{Type: schema.TypeString},
+										},
+										"vpc_id": {
+											Type:     schema.TypeString,
+											Computed: true,
+										},
+									},
+								},
+							},
+						},
+					},
+				},
+				"opensearchserverless_configuration": {
+					Type:     schema.TypeList,
+					Optional: true,
+					MaxItems: 1,
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"buffering_interval": {
+								Type:         schema.TypeInt,
+								Optional:     true,
+								Default:      300,
+								ValidateFunc: validation.IntBetween(60, 900),
+							},
+							"buffering_size": {
+								Type:         schema.TypeInt,
+								Optional:     true,
+								Default:      5,
+								ValidateFunc: validation.IntBetween(1, 100),
+							},
+							"cloudwatch_logging_options": cloudWatchLoggingOptionsSchema(),
+							"collection_endpoint": {
+								Type:     schema.TypeString,
+								Required: true,
+							},
+							"index_name": {
+								Type:     schema.TypeString,
+								Required: true,
+							},
+							"processing_configuration": processingConfigurationSchema(),
+							"retry_duration": {
+								Type:         schema.TypeInt,
+								Optional:     true,
+								Default:      300,
+								ValidateFunc: validation.IntBetween(0, 7200),
+							},
+							"role_arn": {
+								Type:         schema.TypeString,
+								Required:     true,
+								ValidateFunc: verify.ValidARN,
+							},
+							"s3_backup_mode": {
+								Type:         schema.TypeString,
+								ForceNew:     true,
+								Optional:     true,
+								Default:      firehose.AmazonOpenSearchServerlessS3BackupModeFailedDocumentsOnly,
+								ValidateFunc: validation.StringInSlice(firehose.AmazonOpenSearchServerlessS3BackupMode_Values(), false),
+							},
+							"s3_configuration": s3ConfigurationSchema(),
+							"vpc_config": {
+								Type:     schema.TypeList,
+								Optional: true,
+								ForceNew: true,
+								MaxItems: 1,
+								Elem: &schema.Resource{
+									Schema: map[string]*schema.Schema{
+										"role_arn": {
+											Type:         schema.TypeString,
+											Required:     true,
+											ForceNew:     true,
+											ValidateFunc: verify.ValidARN,
+										},
+										"security_group_ids": {
+											Type:     schema.TypeSet,
+											Required: true,
+											ForceNew: true,
+											Elem:     &schema.Schema{Type: schema.TypeString},
+										},
+										"subnet_ids": {
+											Type:     schema.TypeSet,
+											Required: true,
+											ForceNew: true,
+											Elem:     &schema.Schema{Type: schema.TypeString},
+										},
+										"vpc_id": {
+											Type:     schema.TypeString,
+											Computed: true,
+										},
+									},
+								},
+							},
+						},
+					},
+				},
+				"redshift_configuration": {
+					Type:     schema.TypeList,
+					Optional: true,
+					MaxItems: 1,
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"cloudwatch_logging_options": cloudWatchLoggingOptionsSchema(),
+							"cluster_jdbcurl": {
+								Type:     schema.TypeString,
+								Required: true,
+							},
+							"copy_options": {
+								Type:     schema.TypeString,
+								Optional: true,
+							},
+							"data_table_columns": {
+								Type:     schema.TypeString,
+								Optional: true,
+							},
+							"data_table_name": {
+								Type:     schema.TypeString,
+								Required: true,
+							},
+							"password": {
+								Type:      schema.TypeString,
+								Required:  true,
+								Sensitive: true,
+							},
+							"processing_configuration": processingConfigurationSchema(),
+							"retry_duration": {
+								Type:         schema.TypeInt,
+								Optional:     true,
+								Default:      3600,
+								ValidateFunc: validation.IntBetween(0, 7200),
+							},
+							"role_arn": {
+								Type:         schema.TypeString,
+								Required:     true,
+								ValidateFunc: verify.ValidARN,
+							},
+							"s3_backup_configuration": s3BackupConfigurationSchema(),
+							"s3_backup_mode": {
+								Type:         schema.TypeString,
+								Optional:     true,
+								Default:      firehose.S3BackupModeDisabled,
+								ValidateFunc: validation.StringInSlice(firehose.S3BackupMode_Values(), false),
+							},
+							"s3_configuration": s3ConfigurationSchema(),
+							"username": {
+								Type:     schema.TypeString,
+								Required: true,
+							},
+						},
+					},
+				},
+				"server_side_encryption": {
+					Type:             schema.TypeList,
+					Optional:         true,
+					MaxItems:         1,
+					DiffSuppressFunc: verify.SuppressMissingOptionalConfigurationBlock,
+					ConflictsWith:    []string{"kinesis_source_configuration", "msk_source_configuration"},
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"enabled": {
+								Type:     schema.TypeBool,
+								Optional: true,
+								Default:  false,
+							},
+							"key_arn": {
+								Type:         schema.TypeString,
+								Optional:     true,
+								ValidateFunc: verify.ValidARN,
+								RequiredWith: []string{"server_side_encryption.0.enabled", "server_side_encryption.0.key_type"},
+							},
+							"key_type": {
+								Type:         schema.TypeString,
+								Optional:     true,
+								Default:      firehose.KeyTypeAwsOwnedCmk,
+								ValidateFunc: validation.StringInSlice(firehose.KeyType_Values(), false),
+								RequiredWith: []string{"server_side_encryption.0.enabled"},
+							},
+						},
+					},
+				},
+				"splunk_configuration": {
+					Type:     schema.TypeList,
+					Optional: true,
+					MaxItems: 1,
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"cloudwatch_logging_options": cloudWatchLoggingOptionsSchema(),
+							"hec_acknowledgment_timeout": {
+								Type:         schema.TypeInt,
+								Optional:     true,
+								Default:      180,
+								ValidateFunc: validation.IntBetween(180, 600),
+							},
+							"hec_endpoint": {
+								Type:     schema.TypeString,
+								Required: true,
+							},
+							"hec_endpoint_type": {
+								Type:         schema.TypeString,
+								Optional:     true,
+								Default:      firehose.HECEndpointTypeRaw,
+								ValidateFunc: validation.StringInSlice(firehose.HECEndpointType_Values(), false),
+							},
+							"hec_token": {
+								Type:     schema.TypeString,
+								Required: true,
+							},
+							"processing_configuration": processingConfigurationSchema(),
+							"retry_duration": {
+								Type:         schema.TypeInt,
+								Optional:     true,
+								Default:      3600,
+								ValidateFunc: validation.IntBetween(0, 7200),
+							},
+							"s3_backup_mode": {
+								Type:         schema.TypeString,
+								Optional:     true,
+								Default:      firehose.SplunkS3BackupModeFailedEventsOnly,
+								ValidateFunc: validation.StringInSlice(firehose.SplunkS3BackupMode_Values(), false),
+							},
+							"s3_configuration": s3ConfigurationSchema(),
+						},
+					},
+				},
+				names.AttrTags:    tftags.TagsSchema(),
+				names.AttrTagsAll: tftags.TagsSchemaComputed(),
+				"version_id": {
+					Type:     schema.TypeString,
+					Optional: true,
+					Computed: true,
+				},
+			}
+		},
 
-	return []map[string]interface{}{m}
-}
+		CustomizeDiff: customdiff.All(
+			verify.SetTagsDiff,
+			func(ctx context.Context, d *schema.ResourceDiff, meta interface{}) error {
+				destination := d.Get("destination").(string)
+				requiredAttribute := map[string]string{
+					destinationTypeElasticsearch:        "elasticsearch_configuration",
+					destinationTypeExtendedS3:           "extended_s3_configuration",
+					destinationTypeHTTPEndpoint:         "http_endpoint_configuration",
+					destinationTypeOpenSearch:           "opensearch_configuration",
+					destinationTypeOpenSearchServerless: "opensearchserverless_configuration",
+					destinationTypeRedshift:             "redshift_configuration",
+					destinationTypeSplunk:               "splunk_configuration",
+				}[destination]
+
+				if _, ok := d.GetOk(requiredAttribute); !ok {
+					return fmt.Errorf("when destination is '%s', %s is required", destination, requiredAttribute)
+				}
 
-func flattenRequestConfiguration(rc *firehose.HttpEndpointRequestConfiguration) []map[string]interface{} {
-	if rc == nil {
-		return []map[string]interface{}{}
+				return nil
+			},
+		),
 	}
+}
 
-	requestConfiguration := make([]map[string]interface{}, 1)
+func resourceDeliveryStreamCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).FirehoseConn(ctx)
 
-	commonAttributes := make([]interface{}, 0)
-	for _, params := range rc.CommonAttributes {
-		name := aws.StringValue(params.AttributeName)
-		value := aws.StringValue(params.AttributeValue)
+	sn := d.Get("name").(string)
+	input := &firehose.CreateDeliveryStreamInput{
+		DeliveryStreamName: aws.String(sn),
+		DeliveryStreamType: aws.String(firehose.DeliveryStreamTypeDirectPut),
+		Tags:               getTagsIn(ctx),
+	}
 
-		commonAttributes = append(commonAttributes, map[string]interface{}{
-			"name":  name,
-			"value": value,
-		})
+	if v, ok := d.GetOk("kinesis_source_configuration"); ok {
+		input.DeliveryStreamType = aws.String(firehose.DeliveryStreamTypeKinesisStreamAsSource)
+		input.KinesisStreamSourceConfiguration = expandKinesisStreamSourceConfiguration(v.([]interface{})[0].(map[string]interface{}))
+	} else if v, ok := d.GetOk("msk_source_configuration"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
+		input.DeliveryStreamType = aws.String(firehose.DeliveryStreamTypeMskasSource)
+		input.MSKSourceConfiguration = expandMSKSourceConfiguration(v.([]interface{})[0].(map[string]interface{}))
 	}
 
-	requestConfiguration[0] = map[string]interface{}{
-		"common_attributes": commonAttributes,
-		"content_encoding":  aws.StringValue(rc.ContentEncoding),
+	switch d.Get("destination").(string) {
+	case destinationTypeElasticsearch:
+		if v, ok := d.GetOk("elasticsearch_configuration"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
+			input.ElasticsearchDestinationConfiguration = expandElasticsearchDestinationConfiguration(v.([]interface{})[0].(map[string]interface{}))
+		}
+	case destinationTypeExtendedS3:
+		if v, ok := d.GetOk("extended_s3_configuration"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
+			input.ExtendedS3DestinationConfiguration = expandExtendedS3DestinationConfiguration(v.([]interface{})[0].(map[string]interface{}))
+		}
+	case destinationTypeHTTPEndpoint:
+		if v, ok := d.GetOk("http_endpoint_configuration"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
+			input.HttpEndpointDestinationConfiguration = expandHTTPEndpointDestinationConfiguration(v.([]interface{})[0].(map[string]interface{}))
+		}
+	case destinationTypeOpenSearch:
+		if v, ok := d.GetOk("opensearch_configuration"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
+			input.AmazonopensearchserviceDestinationConfiguration = expandAmazonopensearchserviceDestinationConfiguration(v.([]interface{})[0].(map[string]interface{}))
+		}
+	case destinationTypeOpenSearchServerless:
+		if v, ok := d.GetOk("opensearchserverless_configuration"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
+			input.AmazonOpenSearchServerlessDestinationConfiguration = expandAmazonOpenSearchServerlessDestinationConfiguration(v.([]interface{})[0].(map[string]interface{}))
+		}
+	case destinationTypeRedshift:
+		if v, ok := d.GetOk("redshift_configuration"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
+			input.RedshiftDestinationConfiguration = expandRedshiftDestinationConfiguration(v.([]interface{})[0].(map[string]interface{}))
+		}
+	case destinationTypeSplunk:
+		if v, ok := d.GetOk("splunk_configuration"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
+			input.SplunkDestinationConfiguration = expandSplunkDestinationConfiguration(v.([]interface{})[0].(map[string]interface{}))
+		}
 	}
 
-	return requestConfiguration
-}
+	_, err := retryDeliveryStreamOp(ctx, func() (interface{}, error) {
+		return conn.CreateDeliveryStreamWithContext(ctx, input)
+	})
 
-func flattenProcessingConfiguration(pc *firehose.ProcessingConfiguration, roleArn string) []map[string]interface{} {
-	if pc == nil {
-		return []map[string]interface{}{}
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "creating Kinesis Firehose Delivery Stream (%s): %s", sn, err)
 	}
 
-	processingConfiguration := make([]map[string]interface{}, 1)
+	output, err := waitDeliveryStreamCreated(ctx, conn, sn, d.Timeout(schema.TimeoutCreate))
 
-	// It is necessary to explicitly filter this out
-	// to prevent diffs during routine use and retain the ability
-	// to show diffs if any field has drifted
-	defaultLambdaParams := map[string]string{
-		"NumberOfRetries":         "3",
-		"RoleArn":                 roleArn,
-		"BufferSizeInMBs":         "3",
-		"BufferIntervalInSeconds": "60",
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "waiting for Kinesis Firehose Delivery Stream (%s) create: %s", sn, err)
 	}
 
-	processors := make([]interface{}, len(pc.Processors))
-	for i, p := range pc.Processors {
-		t := aws.StringValue(p.Type)
-		parameters := make([]interface{}, 0)
+	d.SetId(aws.StringValue(output.DeliveryStreamARN))
 
-		for _, params := range p.Parameters {
-			name := aws.StringValue(params.ParameterName)
-			value := aws.StringValue(params.ParameterValue)
+	if v, ok := d.GetOk("server_side_encryption"); ok && !isDeliveryStreamOptionDisabled(v) {
+		input := &firehose.StartDeliveryStreamEncryptionInput{
+			DeliveryStreamEncryptionConfigurationInput: expandDeliveryStreamEncryptionConfigurationInput(v.([]interface{})),
+			DeliveryStreamName:                         aws.String(sn),
+		}
 
-			if t == firehose.ProcessorTypeLambda {
-				// Ignore defaults
-				if v, ok := defaultLambdaParams[name]; ok && v == value {
-					continue
-				}
-			}
+		_, err := conn.StartDeliveryStreamEncryptionWithContext(ctx, input)
 
-			parameters = append(parameters, map[string]interface{}{
-				"parameter_name":  name,
-				"parameter_value": value,
-			})
+		if err != nil {
+			return sdkdiag.AppendErrorf(diags, "starting Kinesis Firehose Delivery Stream (%s) encryption: %s", sn, err)
 		}
 
-		processors[i] = map[string]interface{}{
-			"type":       t,
-			"parameters": parameters,
+		if _, err := waitDeliveryStreamEncryptionEnabled(ctx, conn, sn, d.Timeout(schema.TimeoutCreate)); err != nil {
+			return sdkdiag.AppendErrorf(diags, "waiting for Kinesis Firehose Delivery Stream (%s) encryption enable: %s", sn, err)
 		}
 	}
-	processingConfiguration[0] = map[string]interface{}{
-		"enabled":    aws.BoolValue(pc.Enabled),
-		"processors": processors,
-	}
-	return processingConfiguration
-}
-
-func flattenDynamicPartitioningConfiguration(dpc *firehose.DynamicPartitioningConfiguration) []map[string]interface{} {
-	if dpc == nil {
-		return []map[string]interface{}{}
-	}
-
-	dynamicPartitioningConfiguration := make([]map[string]interface{}, 1)
 
-	dynamicPartitioningConfiguration[0] = map[string]interface{}{
-		"enabled": aws.BoolValue(dpc.Enabled),
-	}
+	return append(diags, resourceDeliveryStreamRead(ctx, d, meta)...)
+}
 
-	if dpc.RetryOptions != nil && dpc.RetryOptions.DurationInSeconds != nil {
-		dynamicPartitioningConfiguration[0]["retry_duration"] = int(aws.Int64Value(dpc.RetryOptions.DurationInSeconds))
-	}
+func resourceDeliveryStreamRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).FirehoseConn(ctx)
 
-	return dynamicPartitioningConfiguration
-}
+	sn := d.Get("name").(string)
+	s, err := FindDeliveryStreamByName(ctx, conn, sn)
 
-func flattenSourceConfiguration(desc *firehose.KinesisStreamSourceDescription) []interface{} {
-	if desc == nil {
-		return []interface{}{}
+	if !d.IsNewResource() && tfresource.NotFound(err) {
+		log.Printf("[WARN] Kinesis Firehose Delivery Stream (%s) not found, removing from state", d.Id())
+		d.SetId("")
+		return diags
 	}
 
-	mDesc := map[string]interface{}{
-		"kinesis_stream_arn": aws.StringValue(desc.KinesisStreamARN),
-		"role_arn":           aws.StringValue(desc.RoleARN),
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "reading Kinesis Firehose Delivery Stream (%s): %s", sn, err)
 	}
 
-	return []interface{}{mDesc}
-}
-
-func flattenDeliveryStream(d *schema.ResourceData, s *firehose.DeliveryStreamDescription) error {
-	d.Set("version_id", s.VersionId)
 	d.Set("arn", s.DeliveryStreamARN)
+	if v := s.Source; v != nil {
+		if v := v.KinesisStreamSourceDescription; v != nil {
+			if err := d.Set("kinesis_source_configuration", flattenKinesisStreamSourceDescription(v)); err != nil {
+				return sdkdiag.AppendErrorf(diags, "setting kinesis_source_configuration: %s", err)
+			}
+		}
+		if v := v.MSKSourceDescription; v != nil {
+			if err := d.Set("msk_source_configuration", []interface{}{flattenMSKSourceDescription(v)}); err != nil {
+				return diag.Errorf("setting msk_source_configuration: %s", err)
+			}
+		}
+	}
 	d.Set("name", s.DeliveryStreamName)
+	d.Set("version_id", s.VersionId)
 
 	sseOptions := map[string]interface{}{
 		"enabled":  false,
 		"key_type": firehose.KeyTypeAwsOwnedCmk,
 	}
-	if s.DeliveryStreamEncryptionConfiguration != nil &&
-		aws.StringValue(s.DeliveryStreamEncryptionConfiguration.Status) == firehose.DeliveryStreamEncryptionStatusEnabled {
+	if s.DeliveryStreamEncryptionConfiguration != nil && aws.StringValue(s.DeliveryStreamEncryptionConfiguration.Status) == firehose.DeliveryStreamEncryptionStatusEnabled {
 		sseOptions["enabled"] = true
 
 		if v := s.DeliveryStreamEncryptionConfiguration.KeyARN; v != nil {
@@ -805,2403 +1318,1972 @@ func flattenDeliveryStream(d *schema.ResourceData, s *firehose.DeliveryStreamDes
 			sseOptions["key_type"] = aws.StringValue(v)
 		}
 	}
-
 	if err := d.Set("server_side_encryption", []map[string]interface{}{sseOptions}); err != nil {
-		return fmt.Errorf("setting server_side_encryption: %s", err)
-	}
-
-	if s.Source != nil {
-		if err := d.Set("kinesis_source_configuration", flattenSourceConfiguration(s.Source.KinesisStreamSourceDescription)); err != nil {
-			return fmt.Errorf("setting kinesis_source_configuration: %s", err)
-		}
+		return sdkdiag.AppendErrorf(diags, "setting server_side_encryption: %s", err)
 	}
 
 	if len(s.Destinations) > 0 {
 		destination := s.Destinations[0]
-		if destination.RedshiftDestinationDescription != nil {
-			d.Set("destination", destinationTypeRedshift)
-			configuredPassword := d.Get("redshift_configuration.0.password").(string)
-			if err := d.Set("redshift_configuration", flattenRedshiftConfiguration(destination.RedshiftDestinationDescription, configuredPassword)); err != nil {
-				return fmt.Errorf("setting redshift_configuration: %s", err)
-			}
-		} else if destination.ElasticsearchDestinationDescription != nil {
+		switch {
+		case destination.ElasticsearchDestinationDescription != nil:
 			d.Set("destination", destinationTypeElasticsearch)
-			if err := d.Set("elasticsearch_configuration", flattenElasticsearchConfiguration(destination.ElasticsearchDestinationDescription)); err != nil {
-				return fmt.Errorf("setting elasticsearch_configuration: %s", err)
+			if err := d.Set("elasticsearch_configuration", flattenElasticsearchDestinationDescription(destination.ElasticsearchDestinationDescription)); err != nil {
+				return sdkdiag.AppendErrorf(diags, "setting elasticsearch_configuration: %s", err)
 			}
-		} else if destination.AmazonopensearchserviceDestinationDescription != nil {
-			d.Set("destination", destinationTypeOpensearch)
-			if err := d.Set("opensearch_configuration", flattenOpensearchConfiguration(destination.AmazonopensearchserviceDestinationDescription)); err != nil {
-				return fmt.Errorf("setting opensearch_configuration: %s", err)
-			}
-		} else if destination.SplunkDestinationDescription != nil {
-			d.Set("destination", destinationTypeSplunk)
-			if err := d.Set("splunk_configuration", flattenSplunkConfiguration(destination.SplunkDestinationDescription)); err != nil {
-				return fmt.Errorf("setting splunk_configuration: %s", err)
-			}
-		} else if destination.HttpEndpointDestinationDescription != nil {
+		case destination.HttpEndpointDestinationDescription != nil:
 			d.Set("destination", destinationTypeHTTPEndpoint)
 			configuredAccessKey := d.Get("http_endpoint_configuration.0.access_key").(string)
-			if err := d.Set("http_endpoint_configuration", flattenHTTPEndpointConfiguration(destination.HttpEndpointDestinationDescription, configuredAccessKey)); err != nil {
-				return fmt.Errorf("setting http_endpoint_configuration: %s", err)
+			if err := d.Set("http_endpoint_configuration", flattenHTTPEndpointDestinationDescription(destination.HttpEndpointDestinationDescription, configuredAccessKey)); err != nil {
+				return sdkdiag.AppendErrorf(diags, "setting http_endpoint_configuration: %s", err)
 			}
-		} else {
+		case destination.AmazonopensearchserviceDestinationDescription != nil:
+			d.Set("destination", destinationTypeOpenSearch)
+			if err := d.Set("opensearch_configuration", flattenAmazonopensearchserviceDestinationDescription(destination.AmazonopensearchserviceDestinationDescription)); err != nil {
+				return sdkdiag.AppendErrorf(diags, "setting opensearch_configuration: %s", err)
+			}
+		case destination.AmazonOpenSearchServerlessDestinationDescription != nil:
+			d.Set("destination", destinationTypeOpenSearchServerless)
+			if err := d.Set("opensearchserverless_configuration", flattenAmazonOpenSearchServerlessDestinationDescription(destination.AmazonOpenSearchServerlessDestinationDescription)); err != nil {
+				return sdkdiag.AppendErrorf(diags, "setting opensearchserverless_configuration: %s", err)
+			}
+		case destination.RedshiftDestinationDescription != nil:
+			d.Set("destination", destinationTypeRedshift)
+			configuredPassword := d.Get("redshift_configuration.0.password").(string)
+			if err := d.Set("redshift_configuration", flattenRedshiftDestinationDescription(destination.RedshiftDestinationDescription, configuredPassword)); err != nil {
+				return sdkdiag.AppendErrorf(diags, "setting redshift_configuration: %s", err)
+			}
+		case destination.SplunkDestinationDescription != nil:
+			d.Set("destination", destinationTypeSplunk)
+			if err := d.Set("splunk_configuration", flattenSplunkDestinationDescription(destination.SplunkDestinationDescription)); err != nil {
+				return sdkdiag.AppendErrorf(diags, "setting splunk_configuration: %s", err)
+			}
+		default:
 			d.Set("destination", destinationTypeExtendedS3)
-			if err := d.Set("extended_s3_configuration", flattenExtendedS3Configuration(destination.ExtendedS3DestinationDescription)); err != nil {
-				return fmt.Errorf("setting extended_s3_configuration: %s", err)
+			if err := d.Set("extended_s3_configuration", flattenExtendedS3DestinationDescription(destination.ExtendedS3DestinationDescription)); err != nil {
+				return sdkdiag.AppendErrorf(diags, "setting extended_s3_configuration: %s", err)
 			}
 		}
 		d.Set("destination_id", destination.DestinationId)
 	}
 
-	return nil
+	return diags
 }
 
-func flattenHTTPEndpointConfiguration(description *firehose.HttpEndpointDestinationDescription, configuredAccessKey string) []map[string]interface{} {
-	if description == nil {
-		return []map[string]interface{}{}
-	}
-	m := map[string]interface{}{
-		"access_key":                 configuredAccessKey,
-		"url":                        aws.StringValue(description.EndpointConfiguration.Url),
-		"name":                       aws.StringValue(description.EndpointConfiguration.Name),
-		"role_arn":                   aws.StringValue(description.RoleARN),
-		"s3_backup_mode":             aws.StringValue(description.S3BackupMode),
-		"s3_configuration":           flattenS3Configuration(description.S3DestinationDescription),
-		"request_configuration":      flattenRequestConfiguration(description.RequestConfiguration),
-		"cloudwatch_logging_options": flattenCloudWatchLoggingOptions(description.CloudWatchLoggingOptions),
-		"processing_configuration":   flattenProcessingConfiguration(description.ProcessingConfiguration, aws.StringValue(description.RoleARN)),
-	}
+func resourceDeliveryStreamUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).FirehoseConn(ctx)
 
-	if description.RetryOptions != nil {
-		m["retry_duration"] = int(aws.Int64Value(description.RetryOptions.DurationInSeconds))
+	sn := d.Get("name").(string)
+
+	if d.HasChangesExcept("tags", "tags_all") {
+		input := &firehose.UpdateDestinationInput{
+			CurrentDeliveryStreamVersionId: aws.String(d.Get("version_id").(string)),
+			DeliveryStreamName:             aws.String(sn),
+			DestinationId:                  aws.String(d.Get("destination_id").(string)),
+		}
+
+		switch d.Get("destination").(string) {
+		case destinationTypeElasticsearch:
+			if v, ok := d.GetOk("elasticsearch_configuration"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
+				input.ElasticsearchDestinationUpdate = expandElasticsearchDestinationUpdate(v.([]interface{})[0].(map[string]interface{}))
+			}
+		case destinationTypeExtendedS3:
+			if v, ok := d.GetOk("extended_s3_configuration"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
+				input.ExtendedS3DestinationUpdate = expandExtendedS3DestinationUpdate(v.([]interface{})[0].(map[string]interface{}))
+			}
+		case destinationTypeHTTPEndpoint:
+			if v, ok := d.GetOk("http_endpoint_configuration"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
+				input.HttpEndpointDestinationUpdate = expandHTTPEndpointDestinationUpdate(v.([]interface{})[0].(map[string]interface{}))
+			}
+		case destinationTypeOpenSearch:
+			if v, ok := d.GetOk("opensearch_configuration"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
+				input.AmazonopensearchserviceDestinationUpdate = expandAmazonopensearchserviceDestinationUpdate(v.([]interface{})[0].(map[string]interface{}))
+			}
+		case destinationTypeOpenSearchServerless:
+			if v, ok := d.GetOk("opensearchserverless_configuration"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
+				input.AmazonOpenSearchServerlessDestinationUpdate = expandAmazonOpenSearchServerlessDestinationUpdate(v.([]interface{})[0].(map[string]interface{}))
+			}
+		case destinationTypeRedshift:
+			if v, ok := d.GetOk("redshift_configuration"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
+				input.RedshiftDestinationUpdate = expandRedshiftDestinationUpdate(v.([]interface{})[0].(map[string]interface{}))
+			}
+		case destinationTypeSplunk:
+			if v, ok := d.GetOk("splunk_configuration"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
+				input.SplunkDestinationUpdate = expandSplunkDestinationUpdate(v.([]interface{})[0].(map[string]interface{}))
+			}
+		}
+
+		_, err := retryDeliveryStreamOp(ctx, func() (interface{}, error) {
+			return conn.UpdateDestinationWithContext(ctx, input)
+		})
+
+		if err != nil {
+			return sdkdiag.AppendErrorf(diags, "updating Kinesis Firehose Delivery Stream (%s): %s", sn, err)
+		}
 	}
 
-	if description.BufferingHints != nil {
-		m["buffering_interval"] = int(aws.Int64Value(description.BufferingHints.IntervalInSeconds))
-		m["buffering_size"] = int(aws.Int64Value(description.BufferingHints.SizeInMBs))
+	if d.HasChange("server_side_encryption") {
+		v := d.Get("server_side_encryption")
+		if isDeliveryStreamOptionDisabled(v) {
+			input := &firehose.StopDeliveryStreamEncryptionInput{
+				DeliveryStreamName: aws.String(sn),
+			}
+
+			_, err := conn.StopDeliveryStreamEncryptionWithContext(ctx, input)
+
+			if err != nil {
+				return sdkdiag.AppendErrorf(diags, "stopping Kinesis Firehose Delivery Stream (%s) encryption: %s", sn, err)
+			}
+
+			if _, err := waitDeliveryStreamEncryptionDisabled(ctx, conn, sn, d.Timeout(schema.TimeoutUpdate)); err != nil {
+				return sdkdiag.AppendErrorf(diags, "waiting for Kinesis Firehose Delivery Stream (%s) encryption disable: %s", sn, err)
+			}
+		} else {
+			input := &firehose.StartDeliveryStreamEncryptionInput{
+				DeliveryStreamEncryptionConfigurationInput: expandDeliveryStreamEncryptionConfigurationInput(v.([]interface{})),
+				DeliveryStreamName:                         aws.String(sn),
+			}
+
+			_, err := conn.StartDeliveryStreamEncryptionWithContext(ctx, input)
+
+			if err != nil {
+				return sdkdiag.AppendErrorf(diags, "starting Kinesis Firehose Delivery Stream (%s) encryption: %s", sn, err)
+			}
+
+			if _, err := waitDeliveryStreamEncryptionEnabled(ctx, conn, sn, d.Timeout(schema.TimeoutUpdate)); err != nil {
+				return sdkdiag.AppendErrorf(diags, "waiting for Kinesis Firehose Delivery Stream (%s) encryption enable: %s", sn, err)
+			}
+		}
 	}
 
-	return []map[string]interface{}{m}
+	return append(diags, resourceDeliveryStreamRead(ctx, d, meta)...)
 }
 
-// @SDKResource("aws_kinesis_firehose_delivery_stream", name="Delivery Stream")
-// @Tags(identifierAttribute="name")
-func ResourceDeliveryStream() *schema.Resource {
-	//lintignore:R011
-	return &schema.Resource{
-		CreateWithoutTimeout: resourceDeliveryStreamCreate,
-		ReadWithoutTimeout:   resourceDeliveryStreamRead,
-		UpdateWithoutTimeout: resourceDeliveryStreamUpdate,
-		DeleteWithoutTimeout: resourceDeliveryStreamDelete,
+func resourceDeliveryStreamDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).FirehoseConn(ctx)
 
-		Importer: &schema.ResourceImporter{
-			StateContext: func(ctx context.Context, d *schema.ResourceData, meta interface{}) ([]*schema.ResourceData, error) {
-				idErr := fmt.Errorf("Expected ID in format of arn:PARTITION:firehose:REGION:ACCOUNTID:deliverystream/NAME and provided: %s", d.Id())
-				resARN, err := arn.Parse(d.Id())
-				if err != nil {
-					return nil, idErr
-				}
-				resourceParts := strings.Split(resARN.Resource, "/")
-				if len(resourceParts) != 2 {
-					return nil, idErr
-				}
-				d.Set("name", resourceParts[1])
-				return []*schema.ResourceData{d}, nil
-			},
-		},
+	sn := d.Get("name").(string)
+
+	log.Printf("[DEBUG] Deleting Kinesis Firehose Delivery Stream: (%s)", sn)
+	_, err := conn.DeleteDeliveryStreamWithContext(ctx, &firehose.DeleteDeliveryStreamInput{
+		DeliveryStreamName: aws.String(sn),
+	})
+
+	if tfawserr.ErrCodeEquals(err, firehose.ErrCodeResourceNotFoundException) {
+		return diags
+	}
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "deleting Kinesis Firehose Delivery Stream (%s): %s", sn, err)
+	}
+
+	if _, err := waitDeliveryStreamDeleted(ctx, conn, sn, d.Timeout(schema.TimeoutDelete)); err != nil {
+		return sdkdiag.AppendErrorf(diags, "waiting for Kinesis Firehose Delivery Stream (%s) delete: %s", sn, err)
+	}
 
-		Timeouts: &schema.ResourceTimeout{
-			Create: schema.DefaultTimeout(30 * time.Minute),
-			Update: schema.DefaultTimeout(10 * time.Minute),
-			Delete: schema.DefaultTimeout(30 * time.Minute),
-		},
+	return diags
+}
 
-		CustomizeDiff: verify.SetTagsDiff,
+func retryDeliveryStreamOp(ctx context.Context, f func() (interface{}, error)) (interface{}, error) {
+	return tfresource.RetryWhen(ctx, propagationTimeout,
+		f,
+		func(err error) (bool, error) {
+			// Access was denied when calling Glue. Please ensure that the role specified in the data format conversion configuration has the necessary permissions.
+			if tfawserr.ErrMessageContains(err, firehose.ErrCodeInvalidArgumentException, "Access was denied") {
+				return true, err
+			}
+			if tfawserr.ErrMessageContains(err, firehose.ErrCodeInvalidArgumentException, "is not authorized to") {
+				return true, err
+			}
+			if tfawserr.ErrMessageContains(err, firehose.ErrCodeInvalidArgumentException, "Please make sure the role specified in VpcConfiguration has permissions") {
+				return true, err
+			}
+			// InvalidArgumentException: Verify that the IAM role has access to the Elasticsearch domain.
+			if tfawserr.ErrMessageContains(err, firehose.ErrCodeInvalidArgumentException, "Verify that the IAM role has access") {
+				return true, err
+			}
+			if tfawserr.ErrMessageContains(err, firehose.ErrCodeInvalidArgumentException, "Firehose is unable to assume role") {
+				return true, err
+			}
+			return false, err
+		},
+	)
+}
 
-		SchemaVersion: 1,
-		MigrateState:  MigrateState,
-		Schema: map[string]*schema.Schema{
-			"name": {
-				Type:         schema.TypeString,
-				Required:     true,
-				ForceNew:     true,
-				ValidateFunc: validation.StringLenBetween(1, 64),
-			},
+func expandKinesisStreamSourceConfiguration(source map[string]interface{}) *firehose.KinesisStreamSourceConfiguration {
+	configuration := &firehose.KinesisStreamSourceConfiguration{
+		KinesisStreamARN: aws.String(source["kinesis_stream_arn"].(string)),
+		RoleARN:          aws.String(source["role_arn"].(string)),
+	}
 
-			names.AttrTags:    tftags.TagsSchema(),
-			names.AttrTagsAll: tftags.TagsSchemaComputed(),
+	return configuration
+}
 
-			"server_side_encryption": {
-				Type:             schema.TypeList,
-				Optional:         true,
-				MaxItems:         1,
-				DiffSuppressFunc: verify.SuppressMissingOptionalConfigurationBlock,
-				ConflictsWith:    []string{"kinesis_source_configuration"},
-				Elem: &schema.Resource{
-					Schema: map[string]*schema.Schema{
-						"enabled": {
-							Type:     schema.TypeBool,
-							Optional: true,
-							Default:  false,
-						},
+func expandS3DestinationConfiguration(tfList []interface{}) *firehose.S3DestinationConfiguration {
+	s3 := tfList[0].(map[string]interface{})
 
-						"key_type": {
-							Type:         schema.TypeString,
-							Optional:     true,
-							Default:      firehose.KeyTypeAwsOwnedCmk,
-							ValidateFunc: validation.StringInSlice(firehose.KeyType_Values(), false),
-							RequiredWith: []string{"server_side_encryption.0.enabled"},
-						},
+	configuration := &firehose.S3DestinationConfiguration{
+		BucketARN: aws.String(s3["bucket_arn"].(string)),
+		RoleARN:   aws.String(s3["role_arn"].(string)),
+		BufferingHints: &firehose.BufferingHints{
+			IntervalInSeconds: aws.Int64(int64(s3["buffering_interval"].(int))),
+			SizeInMBs:         aws.Int64(int64(s3["buffering_size"].(int))),
+		},
+		Prefix:                  expandPrefix(s3),
+		CompressionFormat:       aws.String(s3["compression_format"].(string)),
+		EncryptionConfiguration: expandEncryptionConfiguration(s3),
+	}
 
-						"key_arn": {
-							Type:         schema.TypeString,
-							Optional:     true,
-							ValidateFunc: verify.ValidARN,
-							RequiredWith: []string{"server_side_encryption.0.enabled", "server_side_encryption.0.key_type"},
-						},
-					},
-				},
-			},
+	if v, ok := s3["error_output_prefix"].(string); ok && v != "" {
+		configuration.ErrorOutputPrefix = aws.String(v)
+	}
 
-			"kinesis_source_configuration": {
-				Type:          schema.TypeList,
-				ForceNew:      true,
-				Optional:      true,
-				MaxItems:      1,
-				ConflictsWith: []string{"server_side_encryption"},
-				Elem: &schema.Resource{
-					Schema: map[string]*schema.Schema{
-						"kinesis_stream_arn": {
-							Type:         schema.TypeString,
-							Required:     true,
-							ForceNew:     true,
-							ValidateFunc: verify.ValidARN,
-						},
+	if _, ok := s3["cloudwatch_logging_options"]; ok {
+		configuration.CloudWatchLoggingOptions = expandCloudWatchLoggingOptions(s3)
+	}
 
-						"role_arn": {
-							Type:         schema.TypeString,
-							Required:     true,
-							ForceNew:     true,
-							ValidateFunc: verify.ValidARN,
-						},
-					},
-				},
-			},
+	return configuration
+}
 
-			"destination": {
-				Type:     schema.TypeString,
-				Required: true,
-				ForceNew: true,
-				StateFunc: func(v interface{}) string {
-					value := v.(string)
-					return strings.ToLower(value)
-				},
-				ValidateFunc: validation.StringInSlice([]string{
-					destinationTypeExtendedS3,
-					destinationTypeRedshift,
-					destinationTypeElasticsearch,
-					destinationTypeOpensearch,
-					destinationTypeSplunk,
-					destinationTypeHTTPEndpoint,
-				}, false),
-			},
+func expandS3DestinationConfigurationBackup(d map[string]interface{}) *firehose.S3DestinationConfiguration {
+	config := d["s3_backup_configuration"].([]interface{})
+	if len(config) == 0 {
+		return nil
+	}
 
-			"extended_s3_configuration": {
-				Type:     schema.TypeList,
-				Optional: true,
-				MaxItems: 1,
-				Elem: &schema.Resource{
-					Schema: map[string]*schema.Schema{
-						"bucket_arn": {
-							Type:         schema.TypeString,
-							Required:     true,
-							ValidateFunc: verify.ValidARN,
-						},
+	s3 := config[0].(map[string]interface{})
 
-						"buffering_size": {
-							Type:     schema.TypeInt,
-							Optional: true,
-							Default:  5,
-						},
+	configuration := &firehose.S3DestinationConfiguration{
+		BucketARN: aws.String(s3["bucket_arn"].(string)),
+		RoleARN:   aws.String(s3["role_arn"].(string)),
+		BufferingHints: &firehose.BufferingHints{
+			IntervalInSeconds: aws.Int64(int64(s3["buffering_interval"].(int))),
+			SizeInMBs:         aws.Int64(int64(s3["buffering_size"].(int))),
+		},
+		Prefix:                  expandPrefix(s3),
+		CompressionFormat:       aws.String(s3["compression_format"].(string)),
+		EncryptionConfiguration: expandEncryptionConfiguration(s3),
+	}
 
-						"buffering_interval": {
-							Type:     schema.TypeInt,
-							Optional: true,
-							Default:  300,
-						},
+	if _, ok := s3["cloudwatch_logging_options"]; ok {
+		configuration.CloudWatchLoggingOptions = expandCloudWatchLoggingOptions(s3)
+	}
 
-						"compression_format": {
-							Type:         schema.TypeString,
-							Optional:     true,
-							Default:      firehose.CompressionFormatUncompressed,
-							ValidateFunc: validation.StringInSlice(firehose.CompressionFormat_Values(), false),
-						},
+	if v, ok := s3["error_output_prefix"].(string); ok && v != "" {
+		configuration.ErrorOutputPrefix = aws.String(v)
+	}
 
-						"data_format_conversion_configuration": {
-							Type:     schema.TypeList,
-							Optional: true,
-							MaxItems: 1,
-							Elem: &schema.Resource{
-								Schema: map[string]*schema.Schema{
-									"enabled": {
-										Type:     schema.TypeBool,
-										Optional: true,
-										Default:  true,
-									},
-									"input_format_configuration": {
-										Type:     schema.TypeList,
-										Required: true,
-										MaxItems: 1,
-										Elem: &schema.Resource{
-											Schema: map[string]*schema.Schema{
-												"deserializer": {
-													Type:     schema.TypeList,
-													Required: true,
-													MaxItems: 1,
-													Elem: &schema.Resource{
-														Schema: map[string]*schema.Schema{
-															"hive_json_ser_de": {
-																Type:          schema.TypeList,
-																Optional:      true,
-																MaxItems:      1,
-																ConflictsWith: []string{"extended_s3_configuration.0.data_format_conversion_configuration.0.input_format_configuration.0.deserializer.0.open_x_json_ser_de"},
-																Elem: &schema.Resource{
-																	Schema: map[string]*schema.Schema{
-																		"timestamp_formats": {
-																			Type:     schema.TypeList,
-																			Optional: true,
-																			Elem:     &schema.Schema{Type: schema.TypeString},
-																		},
-																	},
-																},
-															},
-															"open_x_json_ser_de": {
-																Type:          schema.TypeList,
-																Optional:      true,
-																MaxItems:      1,
-																ConflictsWith: []string{"extended_s3_configuration.0.data_format_conversion_configuration.0.input_format_configuration.0.deserializer.0.hive_json_ser_de"},
-																Elem: &schema.Resource{
-																	Schema: map[string]*schema.Schema{
-																		"case_insensitive": {
-																			Type:     schema.TypeBool,
-																			Optional: true,
-																			Default:  true,
-																		},
-																		"column_to_json_key_mappings": {
-																			Type:     schema.TypeMap,
-																			Optional: true,
-																			Elem:     &schema.Schema{Type: schema.TypeString},
-																		},
-																		"convert_dots_in_json_keys_to_underscores": {
-																			Type:     schema.TypeBool,
-																			Optional: true,
-																			Default:  false,
-																		},
-																	},
-																},
-															},
-														},
-													},
-												},
-											},
-										},
-									},
-									"output_format_configuration": {
-										Type:     schema.TypeList,
-										Required: true,
-										MaxItems: 1,
-										Elem: &schema.Resource{
-											Schema: map[string]*schema.Schema{
-												"serializer": {
-													Type:     schema.TypeList,
-													Required: true,
-													MaxItems: 1,
-													Elem: &schema.Resource{
-														Schema: map[string]*schema.Schema{
-															"orc_ser_de": {
-																Type:          schema.TypeList,
-																Optional:      true,
-																MaxItems:      1,
-																ConflictsWith: []string{"extended_s3_configuration.0.data_format_conversion_configuration.0.output_format_configuration.0.serializer.0.parquet_ser_de"},
-																Elem: &schema.Resource{
-																	Schema: map[string]*schema.Schema{
-																		"block_size_bytes": {
-																			Type:     schema.TypeInt,
-																			Optional: true,
-																			// 256 MiB
-																			Default: 268435456,
-																			// 64 MiB
-																			ValidateFunc: validation.IntAtLeast(67108864),
-																		},
-																		"bloom_filter_columns": {
-																			Type:     schema.TypeList,
-																			Optional: true,
-																			Elem:     &schema.Schema{Type: schema.TypeString},
-																		},
-																		"bloom_filter_false_positive_probability": {
-																			Type:     schema.TypeFloat,
-																			Optional: true,
-																			Default:  0.05,
-																		},
-																		"compression": {
-																			Type:         schema.TypeString,
-																			Optional:     true,
-																			Default:      firehose.OrcCompressionSnappy,
-																			ValidateFunc: validation.StringInSlice(firehose.OrcCompression_Values(), false),
-																		},
-																		"dictionary_key_threshold": {
-																			Type:     schema.TypeFloat,
-																			Optional: true,
-																			Default:  0.0,
-																		},
-																		"enable_padding": {
-																			Type:     schema.TypeBool,
-																			Optional: true,
-																			Default:  false,
-																		},
-																		"format_version": {
-																			Type:         schema.TypeString,
-																			Optional:     true,
-																			Default:      firehose.OrcFormatVersionV012,
-																			ValidateFunc: validation.StringInSlice(firehose.OrcFormatVersion_Values(), false),
-																		},
-																		"padding_tolerance": {
-																			Type:     schema.TypeFloat,
-																			Optional: true,
-																			Default:  0.05,
-																		},
-																		"row_index_stride": {
-																			Type:         schema.TypeInt,
-																			Optional:     true,
-																			Default:      10000,
-																			ValidateFunc: validation.IntAtLeast(1000),
-																		},
-																		"stripe_size_bytes": {
-																			Type:     schema.TypeInt,
-																			Optional: true,
-																			// 64 MiB
-																			Default: 67108864,
-																			// 8 MiB
-																			ValidateFunc: validation.IntAtLeast(8388608),
-																		},
-																	},
-																},
-															},
-															"parquet_ser_de": {
-																Type:          schema.TypeList,
-																Optional:      true,
-																MaxItems:      1,
-																ConflictsWith: []string{"extended_s3_configuration.0.data_format_conversion_configuration.0.output_format_configuration.0.serializer.0.orc_ser_de"},
-																Elem: &schema.Resource{
-																	Schema: map[string]*schema.Schema{
-																		"block_size_bytes": {
-																			Type:     schema.TypeInt,
-																			Optional: true,
-																			// 256 MiB
-																			Default: 268435456,
-																			// 64 MiB
-																			ValidateFunc: validation.IntAtLeast(67108864),
-																		},
-																		"compression": {
-																			Type:         schema.TypeString,
-																			Optional:     true,
-																			Default:      firehose.ParquetCompressionSnappy,
-																			ValidateFunc: validation.StringInSlice(firehose.ParquetCompression_Values(), false),
-																		},
-																		"enable_dictionary_compression": {
-																			Type:     schema.TypeBool,
-																			Optional: true,
-																			Default:  false,
-																		},
-																		"max_padding_bytes": {
-																			Type:     schema.TypeInt,
-																			Optional: true,
-																			Default:  0,
-																		},
-																		"page_size_bytes": {
-																			Type:     schema.TypeInt,
-																			Optional: true,
-																			// 1 MiB
-																			Default: 1048576,
-																			// 64 KiB
-																			ValidateFunc: validation.IntAtLeast(65536),
-																		},
-																		"writer_version": {
-																			Type:         schema.TypeString,
-																			Optional:     true,
-																			Default:      firehose.ParquetWriterVersionV1,
-																			ValidateFunc: validation.StringInSlice(firehose.ParquetWriterVersion_Values(), false),
-																		},
-																	},
-																},
-															},
-														},
-													},
-												},
-											},
-										},
-									},
-									"schema_configuration": {
-										Type:     schema.TypeList,
-										Required: true,
-										MaxItems: 1,
-										Elem: &schema.Resource{
-											Schema: map[string]*schema.Schema{
-												"catalog_id": {
-													Type:     schema.TypeString,
-													Optional: true,
-													Computed: true,
-												},
-												"database_name": {
-													Type:     schema.TypeString,
-													Required: true,
-												},
-												"region": {
-													Type:     schema.TypeString,
-													Optional: true,
-													Computed: true,
-												},
-												"role_arn": {
-													Type:         schema.TypeString,
-													Required:     true,
-													ValidateFunc: verify.ValidARN,
-												},
-												"table_name": {
-													Type:     schema.TypeString,
-													Required: true,
-												},
-												"version_id": {
-													Type:     schema.TypeString,
-													Optional: true,
-													Default:  "LATEST",
-												},
-											},
-										},
-									},
-								},
-							},
-						},
+	return configuration
+}
 
-						"error_output_prefix": {
-							Type:         schema.TypeString,
-							Optional:     true,
-							ValidateFunc: validation.StringLenBetween(0, 1024),
-						},
+func expandExtendedS3DestinationConfiguration(s3 map[string]interface{}) *firehose.ExtendedS3DestinationConfiguration {
+	configuration := &firehose.ExtendedS3DestinationConfiguration{
+		BucketARN: aws.String(s3["bucket_arn"].(string)),
+		RoleARN:   aws.String(s3["role_arn"].(string)),
+		BufferingHints: &firehose.BufferingHints{
+			IntervalInSeconds: aws.Int64(int64(s3["buffering_interval"].(int))),
+			SizeInMBs:         aws.Int64(int64(s3["buffering_size"].(int))),
+		},
+		Prefix:                            expandPrefix(s3),
+		CompressionFormat:                 aws.String(s3["compression_format"].(string)),
+		DataFormatConversionConfiguration: expandDataFormatConversionConfiguration(s3["data_format_conversion_configuration"].([]interface{})),
+		EncryptionConfiguration:           expandEncryptionConfiguration(s3),
+	}
 
-						"kms_key_arn": {
-							Type:         schema.TypeString,
-							Optional:     true,
-							ValidateFunc: verify.ValidARN,
-						},
+	if _, ok := s3["processing_configuration"]; ok {
+		configuration.ProcessingConfiguration = expandProcessingConfiguration(s3)
+	}
 
-						"role_arn": {
-							Type:         schema.TypeString,
-							Required:     true,
-							ValidateFunc: verify.ValidARN,
-						},
+	if _, ok := s3["dynamic_partitioning_configuration"]; ok {
+		configuration.DynamicPartitioningConfiguration = expandDynamicPartitioningConfiguration(s3)
+	}
 
-						"prefix": {
-							Type:     schema.TypeString,
-							Optional: true,
-						},
+	if _, ok := s3["cloudwatch_logging_options"]; ok {
+		configuration.CloudWatchLoggingOptions = expandCloudWatchLoggingOptions(s3)
+	}
 
-						"s3_backup_mode": {
-							Type:         schema.TypeString,
-							Optional:     true,
-							Default:      firehose.S3BackupModeDisabled,
-							ValidateFunc: validation.StringInSlice(firehose.S3BackupMode_Values(), false),
-						},
+	if v, ok := s3["error_output_prefix"].(string); ok && v != "" {
+		configuration.ErrorOutputPrefix = aws.String(v)
+	}
 
-						"s3_backup_configuration": s3BackupConfigurationSchema(),
+	if s3BackupMode, ok := s3["s3_backup_mode"]; ok {
+		configuration.S3BackupMode = aws.String(s3BackupMode.(string))
+		configuration.S3BackupConfiguration = expandS3DestinationConfigurationBackup(s3)
+	}
 
-						"cloudwatch_logging_options": cloudWatchLoggingOptionsSchema(),
+	return configuration
+}
 
-						"dynamic_partitioning_configuration": dynamicPartitioningConfigurationSchema(),
+func expandS3DestinationUpdate(tfList []interface{}) *firehose.S3DestinationUpdate {
+	s3 := tfList[0].(map[string]interface{})
+	configuration := &firehose.S3DestinationUpdate{
+		BucketARN: aws.String(s3["bucket_arn"].(string)),
+		RoleARN:   aws.String(s3["role_arn"].(string)),
+		BufferingHints: &firehose.BufferingHints{
+			IntervalInSeconds: aws.Int64((int64)(s3["buffering_interval"].(int))),
+			SizeInMBs:         aws.Int64((int64)(s3["buffering_size"].(int))),
+		},
+		ErrorOutputPrefix:        aws.String(s3["error_output_prefix"].(string)),
+		Prefix:                   expandPrefix(s3),
+		CompressionFormat:        aws.String(s3["compression_format"].(string)),
+		EncryptionConfiguration:  expandEncryptionConfiguration(s3),
+		CloudWatchLoggingOptions: expandCloudWatchLoggingOptions(s3),
+	}
 
-						"processing_configuration": processingConfigurationSchema(),
-					},
-				},
-			},
+	if _, ok := s3["cloudwatch_logging_options"]; ok {
+		configuration.CloudWatchLoggingOptions = expandCloudWatchLoggingOptions(s3)
+	}
 
-			"redshift_configuration": {
-				Type:     schema.TypeList,
-				Optional: true,
-				MaxItems: 1,
-				Elem: &schema.Resource{
-					Schema: map[string]*schema.Schema{
-						"cloudwatch_logging_options": cloudWatchLoggingOptionsSchema(),
+	return configuration
+}
 
-						"cluster_jdbcurl": {
-							Type:     schema.TypeString,
-							Required: true,
-						},
+func expandS3DestinationUpdateBackup(d map[string]interface{}) *firehose.S3DestinationUpdate {
+	config := d["s3_backup_configuration"].([]interface{})
+	if len(config) == 0 {
+		return nil
+	}
 
-						"copy_options": {
-							Type:     schema.TypeString,
-							Optional: true,
-						},
+	s3 := config[0].(map[string]interface{})
 
-						"data_table_columns": {
-							Type:     schema.TypeString,
-							Optional: true,
-						},
+	configuration := &firehose.S3DestinationUpdate{
+		BucketARN: aws.String(s3["bucket_arn"].(string)),
+		RoleARN:   aws.String(s3["role_arn"].(string)),
+		BufferingHints: &firehose.BufferingHints{
+			IntervalInSeconds: aws.Int64((int64)(s3["buffering_interval"].(int))),
+			SizeInMBs:         aws.Int64((int64)(s3["buffering_size"].(int))),
+		},
+		ErrorOutputPrefix:        aws.String(s3["error_output_prefix"].(string)),
+		Prefix:                   expandPrefix(s3),
+		CompressionFormat:        aws.String(s3["compression_format"].(string)),
+		EncryptionConfiguration:  expandEncryptionConfiguration(s3),
+		CloudWatchLoggingOptions: expandCloudWatchLoggingOptions(s3),
+	}
 
-						"data_table_name": {
-							Type:     schema.TypeString,
-							Required: true,
-						},
+	if _, ok := s3["cloudwatch_logging_options"]; ok {
+		configuration.CloudWatchLoggingOptions = expandCloudWatchLoggingOptions(s3)
+	}
 
-						"password": {
-							Type:      schema.TypeString,
-							Required:  true,
-							Sensitive: true,
-						},
+	return configuration
+}
 
-						"processing_configuration": processingConfigurationSchema(),
+func expandExtendedS3DestinationUpdate(s3 map[string]interface{}) *firehose.ExtendedS3DestinationUpdate {
+	configuration := &firehose.ExtendedS3DestinationUpdate{
+		BucketARN: aws.String(s3["bucket_arn"].(string)),
+		RoleARN:   aws.String(s3["role_arn"].(string)),
+		BufferingHints: &firehose.BufferingHints{
+			IntervalInSeconds: aws.Int64((int64)(s3["buffering_interval"].(int))),
+			SizeInMBs:         aws.Int64((int64)(s3["buffering_size"].(int))),
+		},
+		ErrorOutputPrefix:                 aws.String(s3["error_output_prefix"].(string)),
+		Prefix:                            expandPrefix(s3),
+		CompressionFormat:                 aws.String(s3["compression_format"].(string)),
+		EncryptionConfiguration:           expandEncryptionConfiguration(s3),
+		DataFormatConversionConfiguration: expandDataFormatConversionConfiguration(s3["data_format_conversion_configuration"].([]interface{})),
+		CloudWatchLoggingOptions:          expandCloudWatchLoggingOptions(s3),
+		ProcessingConfiguration:           expandProcessingConfiguration(s3),
+	}
 
-						"retry_duration": {
-							Type:         schema.TypeInt,
-							Optional:     true,
-							Default:      3600,
-							ValidateFunc: validation.IntBetween(0, 7200),
-						},
+	if _, ok := s3["cloudwatch_logging_options"]; ok {
+		configuration.CloudWatchLoggingOptions = expandCloudWatchLoggingOptions(s3)
+	}
 
-						"role_arn": {
-							Type:         schema.TypeString,
-							Required:     true,
-							ValidateFunc: verify.ValidARN,
-						},
+	if _, ok := s3["dynamic_partitioning_configuration"]; ok {
+		configuration.DynamicPartitioningConfiguration = expandDynamicPartitioningConfiguration(s3)
+	}
 
-						"s3_backup_mode": {
-							Type:         schema.TypeString,
-							Optional:     true,
-							Default:      firehose.S3BackupModeDisabled,
-							ValidateFunc: validation.StringInSlice(firehose.S3BackupMode_Values(), false),
-						},
+	if s3BackupMode, ok := s3["s3_backup_mode"]; ok {
+		configuration.S3BackupMode = aws.String(s3BackupMode.(string))
+		configuration.S3BackupUpdate = expandS3DestinationUpdateBackup(s3)
+	}
 
-						"s3_backup_configuration": s3BackupConfigurationSchema(),
+	return configuration
+}
 
-						"s3_configuration": s3ConfigurationSchema(),
+func expandDataFormatConversionConfiguration(l []interface{}) *firehose.DataFormatConversionConfiguration {
+	if len(l) == 0 || l[0] == nil {
+		// It is possible to just pass nil here, but this seems to be the
+		// canonical form that AWS uses, and is less likely to produce diffs.
+		return &firehose.DataFormatConversionConfiguration{
+			Enabled: aws.Bool(false),
+		}
+	}
 
-						"username": {
-							Type:     schema.TypeString,
-							Required: true,
-						},
-					},
-				},
-			},
+	m := l[0].(map[string]interface{})
 
-			"elasticsearch_configuration": {
-				Type:     schema.TypeList,
-				Optional: true,
-				MaxItems: 1,
-				Elem: &schema.Resource{
-					Schema: map[string]*schema.Schema{
-						"buffering_interval": {
-							Type:         schema.TypeInt,
-							Optional:     true,
-							Default:      300,
-							ValidateFunc: validation.IntBetween(60, 900),
-						},
+	return &firehose.DataFormatConversionConfiguration{
+		Enabled:                   aws.Bool(m["enabled"].(bool)),
+		InputFormatConfiguration:  expandInputFormatConfiguration(m["input_format_configuration"].([]interface{})),
+		OutputFormatConfiguration: expandOutputFormatConfiguration(m["output_format_configuration"].([]interface{})),
+		SchemaConfiguration:       expandSchemaConfiguration(m["schema_configuration"].([]interface{})),
+	}
+}
 
-						"buffering_size": {
-							Type:         schema.TypeInt,
-							Optional:     true,
-							Default:      5,
-							ValidateFunc: validation.IntBetween(1, 100),
-						},
+func expandInputFormatConfiguration(l []interface{}) *firehose.InputFormatConfiguration {
+	if len(l) == 0 || l[0] == nil {
+		return nil
+	}
 
-						"cloudwatch_logging_options": cloudWatchLoggingOptionsSchema(),
+	m := l[0].(map[string]interface{})
 
-						"cluster_endpoint": {
-							Type:          schema.TypeString,
-							Optional:      true,
-							ConflictsWith: []string{"elasticsearch_configuration.0.domain_arn"},
-						},
+	return &firehose.InputFormatConfiguration{
+		Deserializer: expandDeserializer(m["deserializer"].([]interface{})),
+	}
+}
 
-						"domain_arn": {
-							Type:          schema.TypeString,
-							Optional:      true,
-							ValidateFunc:  verify.ValidARN,
-							ConflictsWith: []string{"elasticsearch_configuration.0.cluster_endpoint"},
-						},
+func expandDeserializer(l []interface{}) *firehose.Deserializer {
+	if len(l) == 0 || l[0] == nil {
+		return nil
+	}
 
-						"index_name": {
-							Type:     schema.TypeString,
-							Required: true,
-						},
+	m := l[0].(map[string]interface{})
 
-						"index_rotation_period": {
-							Type:         schema.TypeString,
-							Optional:     true,
-							Default:      firehose.ElasticsearchIndexRotationPeriodOneDay,
-							ValidateFunc: validation.StringInSlice(firehose.ElasticsearchIndexRotationPeriod_Values(), false),
-						},
+	return &firehose.Deserializer{
+		HiveJsonSerDe:  expandHiveJSONSerDe(m["hive_json_ser_de"].([]interface{})),
+		OpenXJsonSerDe: expandOpenXJSONSerDe(m["open_x_json_ser_de"].([]interface{})),
+	}
+}
 
-						"processing_configuration": processingConfigurationSchema(),
+func expandHiveJSONSerDe(l []interface{}) *firehose.HiveJsonSerDe {
+	if len(l) == 0 {
+		return nil
+	}
 
-						"retry_duration": {
-							Type:         schema.TypeInt,
-							Optional:     true,
-							Default:      300,
-							ValidateFunc: validation.IntBetween(0, 7200),
-						},
+	if l[0] == nil {
+		return &firehose.HiveJsonSerDe{}
+	}
 
-						"role_arn": {
-							Type:         schema.TypeString,
-							Required:     true,
-							ValidateFunc: verify.ValidARN,
-						},
+	m := l[0].(map[string]interface{})
 
-						"s3_configuration": s3ConfigurationSchema(),
+	return &firehose.HiveJsonSerDe{
+		TimestampFormats: flex.ExpandStringList(m["timestamp_formats"].([]interface{})),
+	}
+}
 
-						"s3_backup_mode": {
-							Type:         schema.TypeString,
-							ForceNew:     true,
-							Optional:     true,
-							Default:      firehose.ElasticsearchS3BackupModeFailedDocumentsOnly,
-							ValidateFunc: validation.StringInSlice(firehose.ElasticsearchS3BackupMode_Values(), false),
-						},
+func expandOpenXJSONSerDe(l []interface{}) *firehose.OpenXJsonSerDe {
+	if len(l) == 0 {
+		return nil
+	}
 
-						"type_name": {
-							Type:         schema.TypeString,
-							Optional:     true,
-							ValidateFunc: validation.StringLenBetween(0, 100),
-						},
+	if l[0] == nil {
+		return &firehose.OpenXJsonSerDe{}
+	}
 
-						"vpc_config": {
-							Type:     schema.TypeList,
-							Optional: true,
-							ForceNew: true,
-							MaxItems: 1,
-							Elem: &schema.Resource{
-								Schema: map[string]*schema.Schema{
-									"vpc_id": {
-										Type:     schema.TypeString,
-										Computed: true,
-									},
-									"subnet_ids": {
-										Type:     schema.TypeSet,
-										Required: true,
-										ForceNew: true,
-										Elem:     &schema.Schema{Type: schema.TypeString},
-									},
-									"security_group_ids": {
-										Type:     schema.TypeSet,
-										Required: true,
-										ForceNew: true,
-										Elem:     &schema.Schema{Type: schema.TypeString},
-									},
-									"role_arn": {
-										Type:         schema.TypeString,
-										Required:     true,
-										ForceNew:     true,
-										ValidateFunc: verify.ValidARN,
-									},
-								},
-							},
-						},
-					},
-				},
-			},
+	m := l[0].(map[string]interface{})
 
-			"opensearch_configuration": {
-				Type:     schema.TypeList,
-				Optional: true,
-				MaxItems: 1,
-				Elem: &schema.Resource{
-					Schema: map[string]*schema.Schema{
-						"buffering_interval": {
-							Type:         schema.TypeInt,
-							Optional:     true,
-							Default:      300,
-							ValidateFunc: validation.IntBetween(60, 900),
-						},
+	return &firehose.OpenXJsonSerDe{
+		CaseInsensitive:                    aws.Bool(m["case_insensitive"].(bool)),
+		ColumnToJsonKeyMappings:            flex.ExpandStringMap(m["column_to_json_key_mappings"].(map[string]interface{})),
+		ConvertDotsInJsonKeysToUnderscores: aws.Bool(m["convert_dots_in_json_keys_to_underscores"].(bool)),
+	}
+}
 
-						"buffering_size": {
-							Type:         schema.TypeInt,
-							Optional:     true,
-							Default:      5,
-							ValidateFunc: validation.IntBetween(1, 100),
-						},
+func expandOutputFormatConfiguration(l []interface{}) *firehose.OutputFormatConfiguration {
+	if len(l) == 0 || l[0] == nil {
+		return nil
+	}
 
-						"domain_arn": {
-							Type:          schema.TypeString,
-							Optional:      true,
-							ValidateFunc:  verify.ValidARN,
-							ConflictsWith: []string{"opensearch_configuration.0.cluster_endpoint"},
-						},
+	m := l[0].(map[string]interface{})
 
-						"index_name": {
-							Type:     schema.TypeString,
-							Required: true,
-						},
+	return &firehose.OutputFormatConfiguration{
+		Serializer: expandSerializer(m["serializer"].([]interface{})),
+	}
+}
 
-						"index_rotation_period": {
-							Type:         schema.TypeString,
-							Optional:     true,
-							Default:      firehose.AmazonopensearchserviceIndexRotationPeriodOneDay,
-							ValidateFunc: validation.StringInSlice(firehose.AmazonopensearchserviceIndexRotationPeriod_Values(), false),
-						},
+func expandSerializer(l []interface{}) *firehose.Serializer {
+	if len(l) == 0 || l[0] == nil {
+		return nil
+	}
 
-						"retry_duration": {
-							Type:         schema.TypeInt,
-							Optional:     true,
-							Default:      300,
-							ValidateFunc: validation.IntBetween(0, 7200),
-						},
+	m := l[0].(map[string]interface{})
 
-						"role_arn": {
-							Type:         schema.TypeString,
-							Required:     true,
-							ValidateFunc: verify.ValidARN,
-						},
+	return &firehose.Serializer{
+		OrcSerDe:     expandOrcSerDe(m["orc_ser_de"].([]interface{})),
+		ParquetSerDe: expandParquetSerDe(m["parquet_ser_de"].([]interface{})),
+	}
+}
 
-						"s3_configuration": s3ConfigurationSchema(),
+func expandOrcSerDe(l []interface{}) *firehose.OrcSerDe {
+	if len(l) == 0 {
+		return nil
+	}
 
-						"s3_backup_mode": {
-							Type:         schema.TypeString,
-							ForceNew:     true,
-							Optional:     true,
-							Default:      firehose.AmazonopensearchserviceS3BackupModeFailedDocumentsOnly,
-							ValidateFunc: validation.StringInSlice(firehose.AmazonopensearchserviceS3BackupMode_Values(), false),
-						},
+	if l[0] == nil {
+		return &firehose.OrcSerDe{}
+	}
 
-						"type_name": {
-							Type:         schema.TypeString,
-							Optional:     true,
-							ValidateFunc: validation.StringLenBetween(0, 100),
-						},
+	m := l[0].(map[string]interface{})
 
-						"vpc_config": {
-							Type:     schema.TypeList,
-							Optional: true,
-							ForceNew: true,
-							MaxItems: 1,
-							Elem: &schema.Resource{
-								Schema: map[string]*schema.Schema{
-									"vpc_id": {
-										Type:     schema.TypeString,
-										Computed: true,
-									},
-									"subnet_ids": {
-										Type:     schema.TypeSet,
-										Required: true,
-										ForceNew: true,
-										Elem:     &schema.Schema{Type: schema.TypeString},
-									},
-									"security_group_ids": {
-										Type:     schema.TypeSet,
-										Required: true,
-										ForceNew: true,
-										Elem:     &schema.Schema{Type: schema.TypeString},
-									},
-									"role_arn": {
-										Type:         schema.TypeString,
-										Required:     true,
-										ForceNew:     true,
-										ValidateFunc: verify.ValidARN,
-									},
-								},
-							},
-						},
+	orcSerDe := &firehose.OrcSerDe{
+		BlockSizeBytes:                      aws.Int64(int64(m["block_size_bytes"].(int))),
+		BloomFilterFalsePositiveProbability: aws.Float64(m["bloom_filter_false_positive_probability"].(float64)),
+		Compression:                         aws.String(m["compression"].(string)),
+		DictionaryKeyThreshold:              aws.Float64(m["dictionary_key_threshold"].(float64)),
+		EnablePadding:                       aws.Bool(m["enable_padding"].(bool)),
+		FormatVersion:                       aws.String(m["format_version"].(string)),
+		PaddingTolerance:                    aws.Float64(m["padding_tolerance"].(float64)),
+		RowIndexStride:                      aws.Int64(int64(m["row_index_stride"].(int))),
+		StripeSizeBytes:                     aws.Int64(int64(m["stripe_size_bytes"].(int))),
+	}
 
-						"cloudwatch_logging_options": cloudWatchLoggingOptionsSchema(),
+	if v, ok := m["bloom_filter_columns"].([]interface{}); ok && len(v) > 0 {
+		orcSerDe.BloomFilterColumns = flex.ExpandStringList(v)
+	}
 
-						"processing_configuration": processingConfigurationSchema(),
-						"cluster_endpoint": {
-							Type:          schema.TypeString,
-							Optional:      true,
-							ConflictsWith: []string{"opensearch_configuration.0.domain_arn"},
-						},
-					},
-				},
-			},
+	return orcSerDe
+}
 
-			"splunk_configuration": {
-				Type:     schema.TypeList,
-				Optional: true,
-				MaxItems: 1,
-				Elem: &schema.Resource{
-					Schema: map[string]*schema.Schema{
-						"hec_acknowledgment_timeout": {
-							Type:         schema.TypeInt,
-							Optional:     true,
-							Default:      180,
-							ValidateFunc: validation.IntBetween(180, 600),
-						},
+func expandParquetSerDe(l []interface{}) *firehose.ParquetSerDe {
+	if len(l) == 0 {
+		return nil
+	}
 
-						"hec_endpoint": {
-							Type:     schema.TypeString,
-							Required: true,
-						},
+	if l[0] == nil {
+		return &firehose.ParquetSerDe{}
+	}
 
-						"hec_endpoint_type": {
-							Type:     schema.TypeString,
-							Optional: true,
-							Default:  firehose.HECEndpointTypeRaw,
-							ValidateFunc: validation.StringInSlice([]string{
-								firehose.HECEndpointTypeRaw,
-								firehose.HECEndpointTypeEvent,
-							}, false),
-						},
+	m := l[0].(map[string]interface{})
 
-						"hec_token": {
-							Type:     schema.TypeString,
-							Required: true,
-						},
+	return &firehose.ParquetSerDe{
+		BlockSizeBytes:              aws.Int64(int64(m["block_size_bytes"].(int))),
+		Compression:                 aws.String(m["compression"].(string)),
+		EnableDictionaryCompression: aws.Bool(m["enable_dictionary_compression"].(bool)),
+		MaxPaddingBytes:             aws.Int64(int64(m["max_padding_bytes"].(int))),
+		PageSizeBytes:               aws.Int64(int64(m["page_size_bytes"].(int))),
+		WriterVersion:               aws.String(m["writer_version"].(string)),
+	}
+}
 
-						"retry_duration": {
-							Type:         schema.TypeInt,
-							Optional:     true,
-							Default:      3600,
-							ValidateFunc: validation.IntBetween(0, 7200),
-						},
+func expandSchemaConfiguration(l []interface{}) *firehose.SchemaConfiguration {
+	if len(l) == 0 || l[0] == nil {
+		return nil
+	}
 
-						"s3_backup_mode": {
-							Type:     schema.TypeString,
-							Optional: true,
-							Default:  firehose.SplunkS3BackupModeFailedEventsOnly,
-							ValidateFunc: validation.StringInSlice([]string{
-								firehose.SplunkS3BackupModeFailedEventsOnly,
-								firehose.SplunkS3BackupModeAllEvents,
-							}, false),
-						},
+	m := l[0].(map[string]interface{})
 
-						"s3_configuration": s3ConfigurationSchema(),
+	config := &firehose.SchemaConfiguration{
+		DatabaseName: aws.String(m["database_name"].(string)),
+		RoleARN:      aws.String(m["role_arn"].(string)),
+		TableName:    aws.String(m["table_name"].(string)),
+		VersionId:    aws.String(m["version_id"].(string)),
+	}
 
-						"cloudwatch_logging_options": cloudWatchLoggingOptionsSchema(),
+	if v, ok := m["catalog_id"].(string); ok && v != "" {
+		config.CatalogId = aws.String(v)
+	}
+	if v, ok := m["region"].(string); ok && v != "" {
+		config.Region = aws.String(v)
+	}
 
-						"processing_configuration": processingConfigurationSchema(),
-					},
-				},
-			},
+	return config
+}
 
-			"http_endpoint_configuration": {
-				Type:     schema.TypeList,
-				Optional: true,
-				MaxItems: 1,
-				Elem: &schema.Resource{
-					Schema: map[string]*schema.Schema{
-						"url": {
-							Type:     schema.TypeString,
-							Required: true,
-							ValidateFunc: validation.All(
-								validation.StringLenBetween(1, 1000),
-								validation.StringMatch(regexp.MustCompile(`^https://.*$`), ""),
-							),
-						},
+func expandDynamicPartitioningConfiguration(s3 map[string]interface{}) *firehose.DynamicPartitioningConfiguration {
+	config := s3["dynamic_partitioning_configuration"].([]interface{})
+	if len(config) == 0 {
+		return nil
+	}
 
-						"name": {
-							Type:     schema.TypeString,
-							Optional: true,
-							ValidateFunc: validation.All(
-								validation.StringLenBetween(1, 256),
-							),
-						},
+	dynamicPartitioningConfig := config[0].(map[string]interface{})
+	DynamicPartitioningConfiguration := &firehose.DynamicPartitioningConfiguration{
+		Enabled: aws.Bool(dynamicPartitioningConfig["enabled"].(bool)),
+	}
 
-						"access_key": {
-							Type:         schema.TypeString,
-							Optional:     true,
-							ValidateFunc: validation.StringLenBetween(0, 4096),
-							Sensitive:    true,
-						},
+	if retryDuration, ok := dynamicPartitioningConfig["retry_duration"]; ok {
+		DynamicPartitioningConfiguration.RetryOptions = &firehose.RetryOptions{
+			DurationInSeconds: aws.Int64(int64(retryDuration.(int))),
+		}
+	}
 
-						"retry_duration": {
-							Type:         schema.TypeInt,
-							Optional:     true,
-							Default:      300,
-							ValidateFunc: validation.IntBetween(0, 7200),
-						},
+	return DynamicPartitioningConfiguration
+}
 
-						"role_arn": {
-							Type:         schema.TypeString,
-							Optional:     true,
-							ValidateFunc: verify.ValidARN,
-						},
+func expandProcessingConfiguration(s3 map[string]interface{}) *firehose.ProcessingConfiguration {
+	config := s3["processing_configuration"].([]interface{})
+	if len(config) == 0 || config[0] == nil {
+		// It is possible to just pass nil here, but this seems to be the
+		// canonical form that AWS uses, and is less likely to produce diffs.
+		return &firehose.ProcessingConfiguration{
+			Enabled:    aws.Bool(false),
+			Processors: []*firehose.Processor{},
+		}
+	}
 
-						"s3_backup_mode": {
-							Type:         schema.TypeString,
-							Optional:     true,
-							Default:      firehose.HttpEndpointS3BackupModeFailedDataOnly,
-							ValidateFunc: validation.StringInSlice(firehose.HttpEndpointS3BackupMode_Values(), false),
-						},
+	processingConfiguration := config[0].(map[string]interface{})
 
-						"s3_configuration": s3ConfigurationSchema(),
+	return &firehose.ProcessingConfiguration{
+		Enabled:    aws.Bool(processingConfiguration["enabled"].(bool)),
+		Processors: expandProcessors(processingConfiguration["processors"].([]interface{})),
+	}
+}
 
-						"buffering_interval": {
-							Type:         schema.TypeInt,
-							Optional:     true,
-							Default:      300,
-							ValidateFunc: validation.IntBetween(60, 900),
-						},
+func expandProcessors(processingConfigurationProcessors []interface{}) []*firehose.Processor {
+	processors := []*firehose.Processor{}
 
-						"buffering_size": {
-							Type:         schema.TypeInt,
-							Optional:     true,
-							Default:      5,
-							ValidateFunc: validation.IntBetween(1, 100),
-						},
+	for _, processor := range processingConfigurationProcessors {
+		extractedProcessor := expandProcessor(processor.(map[string]interface{}))
+		if extractedProcessor != nil {
+			processors = append(processors, extractedProcessor)
+		}
+	}
 
-						"request_configuration": requestConfigurationSchema(),
+	return processors
+}
 
-						"cloudwatch_logging_options": cloudWatchLoggingOptionsSchema(),
+func expandProcessor(processingConfigurationProcessor map[string]interface{}) *firehose.Processor {
+	var processor *firehose.Processor
+	processorType := processingConfigurationProcessor["type"].(string)
+	if processorType != "" {
+		processor = &firehose.Processor{
+			Type:       aws.String(processorType),
+			Parameters: expandProcessorParameters(processingConfigurationProcessor["parameters"].([]interface{})),
+		}
+	}
+	return processor
+}
 
-						"processing_configuration": processingConfigurationSchema(),
-					},
-				},
-			},
+func expandProcessorParameters(processorParameters []interface{}) []*firehose.ProcessorParameter {
+	parameters := []*firehose.ProcessorParameter{}
 
-			"arn": {
-				Type:     schema.TypeString,
-				Optional: true,
-				Computed: true,
-			},
+	for _, attr := range processorParameters {
+		parameters = append(parameters, expandProcessorParameter(attr.(map[string]interface{})))
+	}
 
-			"version_id": {
-				Type:     schema.TypeString,
-				Optional: true,
-				Computed: true,
-			},
+	return parameters
+}
 
-			"destination_id": {
-				Type:     schema.TypeString,
-				Optional: true,
-				Computed: true,
-			},
-		},
+func expandProcessorParameter(processorParameter map[string]interface{}) *firehose.ProcessorParameter {
+	parameter := &firehose.ProcessorParameter{
+		ParameterName:  aws.String(processorParameter["parameter_name"].(string)),
+		ParameterValue: aws.String(processorParameter["parameter_value"].(string)),
 	}
+
+	return parameter
 }
 
-func createSourceConfig(source map[string]interface{}) *firehose.KinesisStreamSourceConfiguration {
-	configuration := &firehose.KinesisStreamSourceConfiguration{
-		KinesisStreamARN: aws.String(source["kinesis_stream_arn"].(string)),
-		RoleARN:          aws.String(source["role_arn"].(string)),
+func expandEncryptionConfiguration(s3 map[string]interface{}) *firehose.EncryptionConfiguration {
+	if key, ok := s3["kms_key_arn"]; ok && len(key.(string)) > 0 {
+		return &firehose.EncryptionConfiguration{
+			KMSEncryptionConfig: &firehose.KMSEncryptionConfig{
+				AWSKMSKeyARN: aws.String(key.(string)),
+			},
+		}
 	}
 
-	return configuration
+	return &firehose.EncryptionConfiguration{
+		NoEncryptionConfig: aws.String(firehose.NoEncryptionConfigNoEncryption),
+	}
 }
 
-func createS3Config(tfList []interface{}) *firehose.S3DestinationConfiguration {
-	s3 := tfList[0].(map[string]interface{})
+func expandCloudWatchLoggingOptions(s3 map[string]interface{}) *firehose.CloudWatchLoggingOptions {
+	config := s3["cloudwatch_logging_options"].([]interface{})
+	if len(config) == 0 {
+		return nil
+	}
 
-	configuration := &firehose.S3DestinationConfiguration{
-		BucketARN: aws.String(s3["bucket_arn"].(string)),
-		RoleARN:   aws.String(s3["role_arn"].(string)),
-		BufferingHints: &firehose.BufferingHints{
-			IntervalInSeconds: aws.Int64(int64(s3["buffering_interval"].(int))),
-			SizeInMBs:         aws.Int64(int64(s3["buffering_size"].(int))),
-		},
-		Prefix:                  extractPrefixConfiguration(s3),
-		CompressionFormat:       aws.String(s3["compression_format"].(string)),
-		EncryptionConfiguration: extractEncryptionConfiguration(s3),
+	loggingConfig := config[0].(map[string]interface{})
+	loggingOptions := &firehose.CloudWatchLoggingOptions{
+		Enabled: aws.Bool(loggingConfig["enabled"].(bool)),
 	}
 
-	if v, ok := s3["error_output_prefix"].(string); ok && v != "" {
-		configuration.ErrorOutputPrefix = aws.String(v)
+	if v, ok := loggingConfig["log_group_name"]; ok {
+		loggingOptions.LogGroupName = aws.String(v.(string))
 	}
 
-	if _, ok := s3["cloudwatch_logging_options"]; ok {
-		configuration.CloudWatchLoggingOptions = extractCloudWatchLoggingConfiguration(s3)
+	if v, ok := loggingConfig["log_stream_name"]; ok {
+		loggingOptions.LogStreamName = aws.String(v.(string))
 	}
 
-	return configuration
+	return loggingOptions
 }
 
-func expandS3BackupConfig(d map[string]interface{}) *firehose.S3DestinationConfiguration {
-	config := d["s3_backup_configuration"].([]interface{})
+func expandVPCConfiguration(es map[string]interface{}) *firehose.VpcConfiguration {
+	config := es["vpc_config"].([]interface{})
 	if len(config) == 0 {
 		return nil
 	}
 
-	s3 := config[0].(map[string]interface{})
+	vpcConfig := config[0].(map[string]interface{})
 
-	configuration := &firehose.S3DestinationConfiguration{
-		BucketARN: aws.String(s3["bucket_arn"].(string)),
-		RoleARN:   aws.String(s3["role_arn"].(string)),
-		BufferingHints: &firehose.BufferingHints{
-			IntervalInSeconds: aws.Int64(int64(s3["buffering_interval"].(int))),
-			SizeInMBs:         aws.Int64(int64(s3["buffering_size"].(int))),
-		},
-		Prefix:                  extractPrefixConfiguration(s3),
-		CompressionFormat:       aws.String(s3["compression_format"].(string)),
-		EncryptionConfiguration: extractEncryptionConfiguration(s3),
+	return &firehose.VpcConfiguration{
+		RoleARN:          aws.String(vpcConfig["role_arn"].(string)),
+		SubnetIds:        flex.ExpandStringSet(vpcConfig["subnet_ids"].(*schema.Set)),
+		SecurityGroupIds: flex.ExpandStringSet(vpcConfig["security_group_ids"].(*schema.Set)),
 	}
+}
 
-	if _, ok := s3["cloudwatch_logging_options"]; ok {
-		configuration.CloudWatchLoggingOptions = extractCloudWatchLoggingConfiguration(s3)
+func expandPrefix(s3 map[string]interface{}) *string {
+	if v, ok := s3["prefix"]; ok {
+		return aws.String(v.(string))
 	}
 
-	if v, ok := s3["error_output_prefix"].(string); ok && v != "" {
-		configuration.ErrorOutputPrefix = aws.String(v)
+	return nil
+}
+
+func expandRedshiftDestinationConfiguration(redshift map[string]interface{}) *firehose.RedshiftDestinationConfiguration {
+	configuration := &firehose.RedshiftDestinationConfiguration{
+		ClusterJDBCURL:  aws.String(redshift["cluster_jdbcurl"].(string)),
+		RetryOptions:    expandRedshiftRetryOptions(redshift),
+		Password:        aws.String(redshift["password"].(string)),
+		Username:        aws.String(redshift["username"].(string)),
+		RoleARN:         aws.String(redshift["role_arn"].(string)),
+		CopyCommand:     expandCopyCommand(redshift),
+		S3Configuration: expandS3DestinationConfiguration(redshift["s3_configuration"].([]interface{})),
+	}
+
+	if _, ok := redshift["cloudwatch_logging_options"]; ok {
+		configuration.CloudWatchLoggingOptions = expandCloudWatchLoggingOptions(redshift)
+	}
+	if _, ok := redshift["processing_configuration"]; ok {
+		configuration.ProcessingConfiguration = expandProcessingConfiguration(redshift)
+	}
+	if s3BackupMode, ok := redshift["s3_backup_mode"]; ok {
+		configuration.S3BackupMode = aws.String(s3BackupMode.(string))
+		configuration.S3BackupConfiguration = expandS3DestinationConfigurationBackup(redshift)
 	}
 
 	return configuration
 }
 
-func createExtendedS3Config(d *schema.ResourceData) *firehose.ExtendedS3DestinationConfiguration {
-	s3 := d.Get("extended_s3_configuration").([]interface{})[0].(map[string]interface{})
+func expandRedshiftDestinationUpdate(redshift map[string]interface{}) *firehose.RedshiftDestinationUpdate {
+	configuration := &firehose.RedshiftDestinationUpdate{
+		ClusterJDBCURL: aws.String(redshift["cluster_jdbcurl"].(string)),
+		RetryOptions:   expandRedshiftRetryOptions(redshift),
+		Password:       aws.String(redshift["password"].(string)),
+		Username:       aws.String(redshift["username"].(string)),
+		RoleARN:        aws.String(redshift["role_arn"].(string)),
+		CopyCommand:    expandCopyCommand(redshift),
+	}
 
-	configuration := &firehose.ExtendedS3DestinationConfiguration{
-		BucketARN: aws.String(s3["bucket_arn"].(string)),
-		RoleARN:   aws.String(s3["role_arn"].(string)),
-		BufferingHints: &firehose.BufferingHints{
-			IntervalInSeconds: aws.Int64(int64(s3["buffering_interval"].(int))),
-			SizeInMBs:         aws.Int64(int64(s3["buffering_size"].(int))),
-		},
-		Prefix:                            extractPrefixConfiguration(s3),
-		CompressionFormat:                 aws.String(s3["compression_format"].(string)),
-		DataFormatConversionConfiguration: expandDataFormatConversionConfiguration(s3["data_format_conversion_configuration"].([]interface{})),
-		EncryptionConfiguration:           extractEncryptionConfiguration(s3),
+	s3Config := expandS3DestinationUpdate(redshift["s3_configuration"].([]interface{}))
+	// Redshift does not currently support ErrorOutputPrefix,
+	// which is set to the empty string within "updateS3Config",
+	// thus we must remove it here to avoid an InvalidArgumentException.
+	s3Config.ErrorOutputPrefix = nil
+	configuration.S3Update = s3Config
+
+	if _, ok := redshift["cloudwatch_logging_options"]; ok {
+		configuration.CloudWatchLoggingOptions = expandCloudWatchLoggingOptions(redshift)
+	}
+	if _, ok := redshift["processing_configuration"]; ok {
+		configuration.ProcessingConfiguration = expandProcessingConfiguration(redshift)
+	}
+	if s3BackupMode, ok := redshift["s3_backup_mode"]; ok {
+		configuration.S3BackupMode = aws.String(s3BackupMode.(string))
+		configuration.S3BackupUpdate = expandS3DestinationUpdateBackup(redshift)
+		if configuration.S3BackupUpdate != nil {
+			// Redshift does not currently support ErrorOutputPrefix,
+			// which is set to the empty string within "updateS3BackupConfig",
+			// thus we must remove it here to avoid an InvalidArgumentException.
+			configuration.S3BackupUpdate.ErrorOutputPrefix = nil
+		}
+	}
+
+	return configuration
+}
+
+func expandElasticsearchDestinationConfiguration(es map[string]interface{}) *firehose.ElasticsearchDestinationConfiguration {
+	config := &firehose.ElasticsearchDestinationConfiguration{
+		BufferingHints:  expandElasticsearchBufferingHints(es),
+		IndexName:       aws.String(es["index_name"].(string)),
+		RetryOptions:    expandElasticsearchRetryOptions(es),
+		RoleARN:         aws.String(es["role_arn"].(string)),
+		TypeName:        aws.String(es["type_name"].(string)),
+		S3Configuration: expandS3DestinationConfiguration(es["s3_configuration"].([]interface{})),
 	}
 
-	if _, ok := s3["processing_configuration"]; ok {
-		configuration.ProcessingConfiguration = extractProcessingConfiguration(s3)
+	if v, ok := es["domain_arn"]; ok && v.(string) != "" {
+		config.DomainARN = aws.String(v.(string))
 	}
 
-	if _, ok := s3["dynamic_partitioning_configuration"]; ok {
-		configuration.DynamicPartitioningConfiguration = extractDynamicPartitioningConfiguration(s3)
+	if v, ok := es["cluster_endpoint"]; ok && v.(string) != "" {
+		config.ClusterEndpoint = aws.String(v.(string))
 	}
 
-	if _, ok := s3["cloudwatch_logging_options"]; ok {
-		configuration.CloudWatchLoggingOptions = extractCloudWatchLoggingConfiguration(s3)
+	if _, ok := es["cloudwatch_logging_options"]; ok {
+		config.CloudWatchLoggingOptions = expandCloudWatchLoggingOptions(es)
 	}
 
-	if v, ok := s3["error_output_prefix"].(string); ok && v != "" {
-		configuration.ErrorOutputPrefix = aws.String(v)
+	if _, ok := es["processing_configuration"]; ok {
+		config.ProcessingConfiguration = expandProcessingConfiguration(es)
 	}
 
-	if s3BackupMode, ok := s3["s3_backup_mode"]; ok {
-		configuration.S3BackupMode = aws.String(s3BackupMode.(string))
-		configuration.S3BackupConfiguration = expandS3BackupConfig(d.Get("extended_s3_configuration").([]interface{})[0].(map[string]interface{}))
+	if indexRotationPeriod, ok := es["index_rotation_period"]; ok {
+		config.IndexRotationPeriod = aws.String(indexRotationPeriod.(string))
+	}
+	if s3BackupMode, ok := es["s3_backup_mode"]; ok {
+		config.S3BackupMode = aws.String(s3BackupMode.(string))
 	}
 
-	return configuration
-}
+	if _, ok := es["vpc_config"]; ok {
+		config.VpcConfiguration = expandVPCConfiguration(es)
+	}
 
-func updateS3Config(tfList []interface{}) *firehose.S3DestinationUpdate {
-	s3 := tfList[0].(map[string]interface{})
+	return config
+}
 
-	configuration := &firehose.S3DestinationUpdate{
-		BucketARN: aws.String(s3["bucket_arn"].(string)),
-		RoleARN:   aws.String(s3["role_arn"].(string)),
-		BufferingHints: &firehose.BufferingHints{
-			IntervalInSeconds: aws.Int64((int64)(s3["buffering_interval"].(int))),
-			SizeInMBs:         aws.Int64((int64)(s3["buffering_size"].(int))),
-		},
-		ErrorOutputPrefix:        aws.String(s3["error_output_prefix"].(string)),
-		Prefix:                   extractPrefixConfiguration(s3),
-		CompressionFormat:        aws.String(s3["compression_format"].(string)),
-		EncryptionConfiguration:  extractEncryptionConfiguration(s3),
-		CloudWatchLoggingOptions: extractCloudWatchLoggingConfiguration(s3),
+func expandElasticsearchDestinationUpdate(es map[string]interface{}) *firehose.ElasticsearchDestinationUpdate {
+	update := &firehose.ElasticsearchDestinationUpdate{
+		BufferingHints: expandElasticsearchBufferingHints(es),
+		IndexName:      aws.String(es["index_name"].(string)),
+		RetryOptions:   expandElasticsearchRetryOptions(es),
+		RoleARN:        aws.String(es["role_arn"].(string)),
+		TypeName:       aws.String(es["type_name"].(string)),
+		S3Update:       expandS3DestinationUpdate(es["s3_configuration"].([]interface{})),
 	}
 
-	if _, ok := s3["cloudwatch_logging_options"]; ok {
-		configuration.CloudWatchLoggingOptions = extractCloudWatchLoggingConfiguration(s3)
+	if v, ok := es["domain_arn"]; ok && v.(string) != "" {
+		update.DomainARN = aws.String(v.(string))
 	}
 
-	return configuration
-}
-
-func updateS3BackupConfig(d map[string]interface{}) *firehose.S3DestinationUpdate {
-	config := d["s3_backup_configuration"].([]interface{})
-	if len(config) == 0 {
-		return nil
+	if v, ok := es["cluster_endpoint"]; ok && v.(string) != "" {
+		update.ClusterEndpoint = aws.String(v.(string))
 	}
 
-	s3 := config[0].(map[string]interface{})
+	if _, ok := es["cloudwatch_logging_options"]; ok {
+		update.CloudWatchLoggingOptions = expandCloudWatchLoggingOptions(es)
+	}
 
-	configuration := &firehose.S3DestinationUpdate{
-		BucketARN: aws.String(s3["bucket_arn"].(string)),
-		RoleARN:   aws.String(s3["role_arn"].(string)),
-		BufferingHints: &firehose.BufferingHints{
-			IntervalInSeconds: aws.Int64((int64)(s3["buffering_interval"].(int))),
-			SizeInMBs:         aws.Int64((int64)(s3["buffering_size"].(int))),
-		},
-		ErrorOutputPrefix:        aws.String(s3["error_output_prefix"].(string)),
-		Prefix:                   extractPrefixConfiguration(s3),
-		CompressionFormat:        aws.String(s3["compression_format"].(string)),
-		EncryptionConfiguration:  extractEncryptionConfiguration(s3),
-		CloudWatchLoggingOptions: extractCloudWatchLoggingConfiguration(s3),
+	if _, ok := es["processing_configuration"]; ok {
+		update.ProcessingConfiguration = expandProcessingConfiguration(es)
 	}
 
-	if _, ok := s3["cloudwatch_logging_options"]; ok {
-		configuration.CloudWatchLoggingOptions = extractCloudWatchLoggingConfiguration(s3)
+	if indexRotationPeriod, ok := es["index_rotation_period"]; ok {
+		update.IndexRotationPeriod = aws.String(indexRotationPeriod.(string))
 	}
 
-	return configuration
+	return update
 }
 
-func updateExtendedS3Config(d *schema.ResourceData) *firehose.ExtendedS3DestinationUpdate {
-	s3 := d.Get("extended_s3_configuration").([]interface{})[0].(map[string]interface{})
-
-	configuration := &firehose.ExtendedS3DestinationUpdate{
-		BucketARN: aws.String(s3["bucket_arn"].(string)),
-		RoleARN:   aws.String(s3["role_arn"].(string)),
-		BufferingHints: &firehose.BufferingHints{
-			IntervalInSeconds: aws.Int64((int64)(s3["buffering_interval"].(int))),
-			SizeInMBs:         aws.Int64((int64)(s3["buffering_size"].(int))),
-		},
-		ErrorOutputPrefix:                 aws.String(s3["error_output_prefix"].(string)),
-		Prefix:                            extractPrefixConfiguration(s3),
-		CompressionFormat:                 aws.String(s3["compression_format"].(string)),
-		EncryptionConfiguration:           extractEncryptionConfiguration(s3),
-		DataFormatConversionConfiguration: expandDataFormatConversionConfiguration(s3["data_format_conversion_configuration"].([]interface{})),
-		CloudWatchLoggingOptions:          extractCloudWatchLoggingConfiguration(s3),
-		ProcessingConfiguration:           extractProcessingConfiguration(s3),
+func expandAmazonopensearchserviceDestinationConfiguration(es map[string]interface{}) *firehose.AmazonopensearchserviceDestinationConfiguration {
+	config := &firehose.AmazonopensearchserviceDestinationConfiguration{
+		BufferingHints:  expandAmazonopensearchserviceBufferingHints(es),
+		IndexName:       aws.String(es["index_name"].(string)),
+		RetryOptions:    expandAmazonopensearchserviceRetryOptions(es),
+		RoleARN:         aws.String(es["role_arn"].(string)),
+		TypeName:        aws.String(es["type_name"].(string)),
+		S3Configuration: expandS3DestinationConfiguration(es["s3_configuration"].([]interface{})),
 	}
 
-	if _, ok := s3["cloudwatch_logging_options"]; ok {
-		configuration.CloudWatchLoggingOptions = extractCloudWatchLoggingConfiguration(s3)
+	if v, ok := es["domain_arn"]; ok && v.(string) != "" {
+		config.DomainARN = aws.String(v.(string))
 	}
 
-	if _, ok := s3["dynamic_partitioning_configuration"]; ok {
-		configuration.DynamicPartitioningConfiguration = extractDynamicPartitioningConfiguration(s3)
+	if v, ok := es["cluster_endpoint"]; ok && v.(string) != "" {
+		config.ClusterEndpoint = aws.String(v.(string))
 	}
 
-	if s3BackupMode, ok := s3["s3_backup_mode"]; ok {
-		configuration.S3BackupMode = aws.String(s3BackupMode.(string))
-		configuration.S3BackupUpdate = updateS3BackupConfig(d.Get("extended_s3_configuration").([]interface{})[0].(map[string]interface{}))
+	if _, ok := es["cloudwatch_logging_options"]; ok {
+		config.CloudWatchLoggingOptions = expandCloudWatchLoggingOptions(es)
 	}
 
-	return configuration
-}
-
-func expandDataFormatConversionConfiguration(l []interface{}) *firehose.DataFormatConversionConfiguration {
-	if len(l) == 0 || l[0] == nil {
-		// It is possible to just pass nil here, but this seems to be the
-		// canonical form that AWS uses, and is less likely to produce diffs.
-		return &firehose.DataFormatConversionConfiguration{
-			Enabled: aws.Bool(false),
-		}
+	if _, ok := es["processing_configuration"]; ok {
+		config.ProcessingConfiguration = expandProcessingConfiguration(es)
 	}
 
-	m := l[0].(map[string]interface{})
-
-	return &firehose.DataFormatConversionConfiguration{
-		Enabled:                   aws.Bool(m["enabled"].(bool)),
-		InputFormatConfiguration:  expandInputFormatConfiguration(m["input_format_configuration"].([]interface{})),
-		OutputFormatConfiguration: expandOutputFormatConfiguration(m["output_format_configuration"].([]interface{})),
-		SchemaConfiguration:       expandSchemaConfiguration(m["schema_configuration"].([]interface{})),
+	if indexRotationPeriod, ok := es["index_rotation_period"]; ok {
+		config.IndexRotationPeriod = aws.String(indexRotationPeriod.(string))
 	}
-}
-
-func expandInputFormatConfiguration(l []interface{}) *firehose.InputFormatConfiguration {
-	if len(l) == 0 || l[0] == nil {
-		return nil
+	if s3BackupMode, ok := es["s3_backup_mode"]; ok {
+		config.S3BackupMode = aws.String(s3BackupMode.(string))
 	}
 
-	m := l[0].(map[string]interface{})
-
-	return &firehose.InputFormatConfiguration{
-		Deserializer: expandDeserializer(m["deserializer"].([]interface{})),
+	if _, ok := es["vpc_config"]; ok {
+		config.VpcConfiguration = expandVPCConfiguration(es)
 	}
+
+	return config
 }
 
-func expandDeserializer(l []interface{}) *firehose.Deserializer {
-	if len(l) == 0 || l[0] == nil {
-		return nil
+func expandAmazonopensearchserviceDestinationUpdate(es map[string]interface{}) *firehose.AmazonopensearchserviceDestinationUpdate {
+	update := &firehose.AmazonopensearchserviceDestinationUpdate{
+		BufferingHints: expandAmazonopensearchserviceBufferingHints(es),
+		IndexName:      aws.String(es["index_name"].(string)),
+		RetryOptions:   expandAmazonopensearchserviceRetryOptions(es),
+		RoleARN:        aws.String(es["role_arn"].(string)),
+		TypeName:       aws.String(es["type_name"].(string)),
+		S3Update:       expandS3DestinationUpdate(es["s3_configuration"].([]interface{})),
 	}
 
-	m := l[0].(map[string]interface{})
-
-	return &firehose.Deserializer{
-		HiveJsonSerDe:  expandHiveJSONSerDe(m["hive_json_ser_de"].([]interface{})),
-		OpenXJsonSerDe: expandOpenXJSONSerDe(m["open_x_json_ser_de"].([]interface{})),
+	if v, ok := es["domain_arn"]; ok && v.(string) != "" {
+		update.DomainARN = aws.String(v.(string))
 	}
-}
 
-func expandHiveJSONSerDe(l []interface{}) *firehose.HiveJsonSerDe {
-	if len(l) == 0 {
-		return nil
+	if v, ok := es["cluster_endpoint"]; ok && v.(string) != "" {
+		update.ClusterEndpoint = aws.String(v.(string))
 	}
 
-	if l[0] == nil {
-		return &firehose.HiveJsonSerDe{}
+	if _, ok := es["cloudwatch_logging_options"]; ok {
+		update.CloudWatchLoggingOptions = expandCloudWatchLoggingOptions(es)
 	}
 
-	m := l[0].(map[string]interface{})
+	if _, ok := es["processing_configuration"]; ok {
+		update.ProcessingConfiguration = expandProcessingConfiguration(es)
+	}
 
-	return &firehose.HiveJsonSerDe{
-		TimestampFormats: flex.ExpandStringList(m["timestamp_formats"].([]interface{})),
+	if indexRotationPeriod, ok := es["index_rotation_period"]; ok {
+		update.IndexRotationPeriod = aws.String(indexRotationPeriod.(string))
 	}
+
+	return update
 }
 
-func expandOpenXJSONSerDe(l []interface{}) *firehose.OpenXJsonSerDe {
-	if len(l) == 0 {
-		return nil
+func expandAmazonOpenSearchServerlessDestinationConfiguration(es map[string]interface{}) *firehose.AmazonOpenSearchServerlessDestinationConfiguration {
+	config := &firehose.AmazonOpenSearchServerlessDestinationConfiguration{
+		BufferingHints:  expandAmazonOpenSearchServerlessBufferingHints(es),
+		IndexName:       aws.String(es["index_name"].(string)),
+		RetryOptions:    expandAmazonOpenSearchServerlessRetryOptions(es),
+		RoleARN:         aws.String(es["role_arn"].(string)),
+		S3Configuration: expandS3DestinationConfiguration(es["s3_configuration"].([]interface{})),
 	}
 
-	if l[0] == nil {
-		return &firehose.OpenXJsonSerDe{}
+	if v, ok := es["collection_endpoint"]; ok && v.(string) != "" {
+		config.CollectionEndpoint = aws.String(v.(string))
 	}
 
-	m := l[0].(map[string]interface{})
-
-	return &firehose.OpenXJsonSerDe{
-		CaseInsensitive:                    aws.Bool(m["case_insensitive"].(bool)),
-		ColumnToJsonKeyMappings:            flex.ExpandStringMap(m["column_to_json_key_mappings"].(map[string]interface{})),
-		ConvertDotsInJsonKeysToUnderscores: aws.Bool(m["convert_dots_in_json_keys_to_underscores"].(bool)),
+	if _, ok := es["cloudwatch_logging_options"]; ok {
+		config.CloudWatchLoggingOptions = expandCloudWatchLoggingOptions(es)
 	}
-}
 
-func expandOutputFormatConfiguration(l []interface{}) *firehose.OutputFormatConfiguration {
-	if len(l) == 0 || l[0] == nil {
-		return nil
+	if _, ok := es["processing_configuration"]; ok {
+		config.ProcessingConfiguration = expandProcessingConfiguration(es)
 	}
 
-	m := l[0].(map[string]interface{})
+	if s3BackupMode, ok := es["s3_backup_mode"]; ok {
+		config.S3BackupMode = aws.String(s3BackupMode.(string))
+	}
 
-	return &firehose.OutputFormatConfiguration{
-		Serializer: expandSerializer(m["serializer"].([]interface{})),
+	if _, ok := es["vpc_config"]; ok {
+		config.VpcConfiguration = expandVPCConfiguration(es)
 	}
+
+	return config
 }
 
-func expandSerializer(l []interface{}) *firehose.Serializer {
-	if len(l) == 0 || l[0] == nil {
-		return nil
+func expandAmazonOpenSearchServerlessDestinationUpdate(es map[string]interface{}) *firehose.AmazonOpenSearchServerlessDestinationUpdate {
+	update := &firehose.AmazonOpenSearchServerlessDestinationUpdate{
+		BufferingHints: expandAmazonOpenSearchServerlessBufferingHints(es),
+		IndexName:      aws.String(es["index_name"].(string)),
+		RetryOptions:   expandAmazonOpenSearchServerlessRetryOptions(es),
+		RoleARN:        aws.String(es["role_arn"].(string)),
+		S3Update:       expandS3DestinationUpdate(es["s3_configuration"].([]interface{})),
+	}
+	if v, ok := es["collection_endpoint"]; ok && v.(string) != "" {
+		update.CollectionEndpoint = aws.String(v.(string))
 	}
 
-	m := l[0].(map[string]interface{})
+	if _, ok := es["cloudwatch_logging_options"]; ok {
+		update.CloudWatchLoggingOptions = expandCloudWatchLoggingOptions(es)
+	}
 
-	return &firehose.Serializer{
-		OrcSerDe:     expandOrcSerDe(m["orc_ser_de"].([]interface{})),
-		ParquetSerDe: expandParquetSerDe(m["parquet_ser_de"].([]interface{})),
+	if _, ok := es["processing_configuration"]; ok {
+		update.ProcessingConfiguration = expandProcessingConfiguration(es)
 	}
+
+	return update
 }
 
-func expandOrcSerDe(l []interface{}) *firehose.OrcSerDe {
-	if len(l) == 0 {
-		return nil
+func expandSplunkDestinationConfiguration(splunk map[string]interface{}) *firehose.SplunkDestinationConfiguration {
+	configuration := &firehose.SplunkDestinationConfiguration{
+		HECToken:                          aws.String(splunk["hec_token"].(string)),
+		HECEndpointType:                   aws.String(splunk["hec_endpoint_type"].(string)),
+		HECEndpoint:                       aws.String(splunk["hec_endpoint"].(string)),
+		HECAcknowledgmentTimeoutInSeconds: aws.Int64(int64(splunk["hec_acknowledgment_timeout"].(int))),
+		RetryOptions:                      expandSplunkRetryOptions(splunk),
+		S3Configuration:                   expandS3DestinationConfiguration(splunk["s3_configuration"].([]interface{})),
 	}
 
-	if l[0] == nil {
-		return &firehose.OrcSerDe{}
+	if _, ok := splunk["processing_configuration"]; ok {
+		configuration.ProcessingConfiguration = expandProcessingConfiguration(splunk)
 	}
 
-	m := l[0].(map[string]interface{})
-
-	orcSerDe := &firehose.OrcSerDe{
-		BlockSizeBytes:                      aws.Int64(int64(m["block_size_bytes"].(int))),
-		BloomFilterFalsePositiveProbability: aws.Float64(m["bloom_filter_false_positive_probability"].(float64)),
-		Compression:                         aws.String(m["compression"].(string)),
-		DictionaryKeyThreshold:              aws.Float64(m["dictionary_key_threshold"].(float64)),
-		EnablePadding:                       aws.Bool(m["enable_padding"].(bool)),
-		FormatVersion:                       aws.String(m["format_version"].(string)),
-		PaddingTolerance:                    aws.Float64(m["padding_tolerance"].(float64)),
-		RowIndexStride:                      aws.Int64(int64(m["row_index_stride"].(int))),
-		StripeSizeBytes:                     aws.Int64(int64(m["stripe_size_bytes"].(int))),
+	if _, ok := splunk["cloudwatch_logging_options"]; ok {
+		configuration.CloudWatchLoggingOptions = expandCloudWatchLoggingOptions(splunk)
 	}
-
-	if v, ok := m["bloom_filter_columns"].([]interface{}); ok && len(v) > 0 {
-		orcSerDe.BloomFilterColumns = flex.ExpandStringList(v)
+	if s3BackupMode, ok := splunk["s3_backup_mode"]; ok {
+		configuration.S3BackupMode = aws.String(s3BackupMode.(string))
 	}
 
-	return orcSerDe
+	return configuration
 }
 
-func expandParquetSerDe(l []interface{}) *firehose.ParquetSerDe {
-	if len(l) == 0 {
-		return nil
+func expandSplunkDestinationUpdate(splunk map[string]interface{}) *firehose.SplunkDestinationUpdate {
+	configuration := &firehose.SplunkDestinationUpdate{
+		HECToken:                          aws.String(splunk["hec_token"].(string)),
+		HECEndpointType:                   aws.String(splunk["hec_endpoint_type"].(string)),
+		HECEndpoint:                       aws.String(splunk["hec_endpoint"].(string)),
+		HECAcknowledgmentTimeoutInSeconds: aws.Int64(int64(splunk["hec_acknowledgment_timeout"].(int))),
+		RetryOptions:                      expandSplunkRetryOptions(splunk),
+		S3Update:                          expandS3DestinationUpdate(splunk["s3_configuration"].([]interface{})),
 	}
 
-	if l[0] == nil {
-		return &firehose.ParquetSerDe{}
+	if _, ok := splunk["processing_configuration"]; ok {
+		configuration.ProcessingConfiguration = expandProcessingConfiguration(splunk)
 	}
 
-	m := l[0].(map[string]interface{})
-
-	return &firehose.ParquetSerDe{
-		BlockSizeBytes:              aws.Int64(int64(m["block_size_bytes"].(int))),
-		Compression:                 aws.String(m["compression"].(string)),
-		EnableDictionaryCompression: aws.Bool(m["enable_dictionary_compression"].(bool)),
-		MaxPaddingBytes:             aws.Int64(int64(m["max_padding_bytes"].(int))),
-		PageSizeBytes:               aws.Int64(int64(m["page_size_bytes"].(int))),
-		WriterVersion:               aws.String(m["writer_version"].(string)),
+	if _, ok := splunk["cloudwatch_logging_options"]; ok {
+		configuration.CloudWatchLoggingOptions = expandCloudWatchLoggingOptions(splunk)
 	}
+	if s3BackupMode, ok := splunk["s3_backup_mode"]; ok {
+		configuration.S3BackupMode = aws.String(s3BackupMode.(string))
+	}
+
+	return configuration
 }
 
-func expandSchemaConfiguration(l []interface{}) *firehose.SchemaConfiguration {
-	if len(l) == 0 || l[0] == nil {
-		return nil
+func expandHTTPEndpointDestinationConfiguration(HttpEndpoint map[string]interface{}) *firehose.HttpEndpointDestinationConfiguration {
+	configuration := &firehose.HttpEndpointDestinationConfiguration{
+		RetryOptions:    expandHTTPEndpointRetryOptions(HttpEndpoint),
+		RoleARN:         aws.String(HttpEndpoint["role_arn"].(string)),
+		S3Configuration: expandS3DestinationConfiguration(HttpEndpoint["s3_configuration"].([]interface{})),
 	}
 
-	m := l[0].(map[string]interface{})
+	configuration.EndpointConfiguration = expandHTTPEndpointConfiguration(HttpEndpoint)
 
-	config := &firehose.SchemaConfiguration{
-		DatabaseName: aws.String(m["database_name"].(string)),
-		RoleARN:      aws.String(m["role_arn"].(string)),
-		TableName:    aws.String(m["table_name"].(string)),
-		VersionId:    aws.String(m["version_id"].(string)),
-	}
+	bufferingHints := &firehose.HttpEndpointBufferingHints{}
 
-	if v, ok := m["catalog_id"].(string); ok && v != "" {
-		config.CatalogId = aws.String(v)
+	if bufferingInterval, ok := HttpEndpoint["buffering_interval"].(int); ok {
+		bufferingHints.IntervalInSeconds = aws.Int64(int64(bufferingInterval))
 	}
-	if v, ok := m["region"].(string); ok && v != "" {
-		config.Region = aws.String(v)
+	if bufferingSize, ok := HttpEndpoint["buffering_size"].(int); ok {
+		bufferingHints.SizeInMBs = aws.Int64(int64(bufferingSize))
 	}
+	configuration.BufferingHints = bufferingHints
 
-	return config
-}
-
-func extractDynamicPartitioningConfiguration(s3 map[string]interface{}) *firehose.DynamicPartitioningConfiguration {
-	config := s3["dynamic_partitioning_configuration"].([]interface{})
-	if len(config) == 0 {
-		return nil
+	if _, ok := HttpEndpoint["processing_configuration"]; ok {
+		configuration.ProcessingConfiguration = expandProcessingConfiguration(HttpEndpoint)
 	}
 
-	dynamicPartitioningConfig := config[0].(map[string]interface{})
-	DynamicPartitioningConfiguration := &firehose.DynamicPartitioningConfiguration{
-		Enabled: aws.Bool(dynamicPartitioningConfig["enabled"].(bool)),
+	if _, ok := HttpEndpoint["request_configuration"]; ok {
+		configuration.RequestConfiguration = expandHTTPEndpointRequestConfiguration(HttpEndpoint)
 	}
 
-	if retryDuration, ok := dynamicPartitioningConfig["retry_duration"]; ok {
-		DynamicPartitioningConfiguration.RetryOptions = &firehose.RetryOptions{
-			DurationInSeconds: aws.Int64(int64(retryDuration.(int))),
-		}
+	if _, ok := HttpEndpoint["cloudwatch_logging_options"]; ok {
+		configuration.CloudWatchLoggingOptions = expandCloudWatchLoggingOptions(HttpEndpoint)
+	}
+	if s3BackupMode, ok := HttpEndpoint["s3_backup_mode"]; ok {
+		configuration.S3BackupMode = aws.String(s3BackupMode.(string))
 	}
 
-	return DynamicPartitioningConfiguration
+	return configuration
 }
 
-func extractProcessingConfiguration(s3 map[string]interface{}) *firehose.ProcessingConfiguration {
-	config := s3["processing_configuration"].([]interface{})
-	if len(config) == 0 || config[0] == nil {
-		// It is possible to just pass nil here, but this seems to be the
-		// canonical form that AWS uses, and is less likely to produce diffs.
-		return &firehose.ProcessingConfiguration{
-			Enabled:    aws.Bool(false),
-			Processors: []*firehose.Processor{},
-		}
+func expandHTTPEndpointDestinationUpdate(HttpEndpoint map[string]interface{}) *firehose.HttpEndpointDestinationUpdate {
+	configuration := &firehose.HttpEndpointDestinationUpdate{
+		RetryOptions: expandHTTPEndpointRetryOptions(HttpEndpoint),
+		RoleARN:      aws.String(HttpEndpoint["role_arn"].(string)),
+		S3Update:     expandS3DestinationUpdate(HttpEndpoint["s3_configuration"].([]interface{})),
 	}
 
-	processingConfiguration := config[0].(map[string]interface{})
-
-	return &firehose.ProcessingConfiguration{
-		Enabled:    aws.Bool(processingConfiguration["enabled"].(bool)),
-		Processors: extractProcessors(processingConfiguration["processors"].([]interface{})),
-	}
-}
+	configuration.EndpointConfiguration = expandHTTPEndpointConfiguration(HttpEndpoint)
 
-func extractProcessors(processingConfigurationProcessors []interface{}) []*firehose.Processor {
-	processors := []*firehose.Processor{}
+	bufferingHints := &firehose.HttpEndpointBufferingHints{}
 
-	for _, processor := range processingConfigurationProcessors {
-		extractedProcessor := extractProcessor(processor.(map[string]interface{}))
-		if extractedProcessor != nil {
-			processors = append(processors, extractedProcessor)
-		}
+	if bufferingInterval, ok := HttpEndpoint["buffering_interval"].(int); ok {
+		bufferingHints.IntervalInSeconds = aws.Int64(int64(bufferingInterval))
 	}
+	if bufferingSize, ok := HttpEndpoint["buffering_size"].(int); ok {
+		bufferingHints.SizeInMBs = aws.Int64(int64(bufferingSize))
+	}
+	configuration.BufferingHints = bufferingHints
 
-	return processors
-}
+	if _, ok := HttpEndpoint["processing_configuration"]; ok {
+		configuration.ProcessingConfiguration = expandProcessingConfiguration(HttpEndpoint)
+	}
 
-func extractProcessor(processingConfigurationProcessor map[string]interface{}) *firehose.Processor {
-	var processor *firehose.Processor
-	processorType := processingConfigurationProcessor["type"].(string)
-	if processorType != "" {
-		processor = &firehose.Processor{
-			Type:       aws.String(processorType),
-			Parameters: extractProcessorParameters(processingConfigurationProcessor["parameters"].([]interface{})),
-		}
+	if _, ok := HttpEndpoint["request_configuration"]; ok {
+		configuration.RequestConfiguration = expandHTTPEndpointRequestConfiguration(HttpEndpoint)
 	}
-	return processor
-}
 
-func extractProcessorParameters(processorParameters []interface{}) []*firehose.ProcessorParameter {
-	parameters := []*firehose.ProcessorParameter{}
+	if _, ok := HttpEndpoint["cloudwatch_logging_options"]; ok {
+		configuration.CloudWatchLoggingOptions = expandCloudWatchLoggingOptions(HttpEndpoint)
+	}
 
-	for _, attr := range processorParameters {
-		parameters = append(parameters, extractProcessorParameter(attr.(map[string]interface{})))
+	if s3BackupMode, ok := HttpEndpoint["s3_backup_mode"]; ok {
+		configuration.S3BackupMode = aws.String(s3BackupMode.(string))
 	}
 
-	return parameters
+	return configuration
 }
 
-func extractProcessorParameter(processorParameter map[string]interface{}) *firehose.ProcessorParameter {
-	parameter := &firehose.ProcessorParameter{
-		ParameterName:  aws.String(processorParameter["parameter_name"].(string)),
-		ParameterValue: aws.String(processorParameter["parameter_value"].(string)),
-	}
+func expandHTTPEndpointCommonAttributes(ca []interface{}) []*firehose.HttpEndpointCommonAttribute {
+	CommonAttributes := make([]*firehose.HttpEndpointCommonAttribute, 0, len(ca))
 
-	return parameter
-}
+	for _, raw := range ca {
+		data := raw.(map[string]interface{})
 
-func extractEncryptionConfiguration(s3 map[string]interface{}) *firehose.EncryptionConfiguration {
-	if key, ok := s3["kms_key_arn"]; ok && len(key.(string)) > 0 {
-		return &firehose.EncryptionConfiguration{
-			KMSEncryptionConfig: &firehose.KMSEncryptionConfig{
-				AWSKMSKeyARN: aws.String(key.(string)),
-			},
+		a := &firehose.HttpEndpointCommonAttribute{
+			AttributeName:  aws.String(data["name"].(string)),
+			AttributeValue: aws.String(data["value"].(string)),
 		}
+		CommonAttributes = append(CommonAttributes, a)
 	}
 
-	return &firehose.EncryptionConfiguration{
-		NoEncryptionConfig: aws.String(firehose.NoEncryptionConfigNoEncryption),
-	}
+	return CommonAttributes
 }
 
-func extractCloudWatchLoggingConfiguration(s3 map[string]interface{}) *firehose.CloudWatchLoggingOptions {
-	config := s3["cloudwatch_logging_options"].([]interface{})
+func expandHTTPEndpointRequestConfiguration(rc map[string]interface{}) *firehose.HttpEndpointRequestConfiguration {
+	config := rc["request_configuration"].([]interface{})
 	if len(config) == 0 {
 		return nil
 	}
 
-	loggingConfig := config[0].(map[string]interface{})
-	loggingOptions := &firehose.CloudWatchLoggingOptions{
-		Enabled: aws.Bool(loggingConfig["enabled"].(bool)),
-	}
+	requestConfig := config[0].(map[string]interface{})
+	RequestConfiguration := &firehose.HttpEndpointRequestConfiguration{}
 
-	if v, ok := loggingConfig["log_group_name"]; ok {
-		loggingOptions.LogGroupName = aws.String(v.(string))
+	if contentEncoding, ok := requestConfig["content_encoding"]; ok {
+		RequestConfiguration.ContentEncoding = aws.String(contentEncoding.(string))
 	}
 
-	if v, ok := loggingConfig["log_stream_name"]; ok {
-		loggingOptions.LogStreamName = aws.String(v.(string))
+	if commonAttributes, ok := requestConfig["common_attributes"]; ok {
+		RequestConfiguration.CommonAttributes = expandHTTPEndpointCommonAttributes(commonAttributes.([]interface{}))
 	}
 
-	return loggingOptions
+	return RequestConfiguration
 }
 
-func extractVPCConfiguration(es map[string]interface{}) *firehose.VpcConfiguration {
-	config := es["vpc_config"].([]interface{})
-	if len(config) == 0 {
-		return nil
+func expandHTTPEndpointConfiguration(ep map[string]interface{}) *firehose.HttpEndpointConfiguration {
+	endpointConfiguration := &firehose.HttpEndpointConfiguration{
+		Url: aws.String(ep["url"].(string)),
 	}
 
-	vpcConfig := config[0].(map[string]interface{})
+	if Name, ok := ep["name"]; ok {
+		endpointConfiguration.Name = aws.String(Name.(string))
+	}
 
-	return &firehose.VpcConfiguration{
-		RoleARN:          aws.String(vpcConfig["role_arn"].(string)),
-		SubnetIds:        flex.ExpandStringSet(vpcConfig["subnet_ids"].(*schema.Set)),
-		SecurityGroupIds: flex.ExpandStringSet(vpcConfig["security_group_ids"].(*schema.Set)),
+	if AccessKey, ok := ep["access_key"]; ok {
+		endpointConfiguration.AccessKey = aws.String(AccessKey.(string))
 	}
+
+	return endpointConfiguration
 }
 
-func extractPrefixConfiguration(s3 map[string]interface{}) *string {
-	if v, ok := s3["prefix"]; ok {
-		return aws.String(v.(string))
+func expandElasticsearchBufferingHints(es map[string]interface{}) *firehose.ElasticsearchBufferingHints {
+	bufferingHints := &firehose.ElasticsearchBufferingHints{}
+
+	if bufferingInterval, ok := es["buffering_interval"].(int); ok {
+		bufferingHints.IntervalInSeconds = aws.Int64(int64(bufferingInterval))
+	}
+	if bufferingSize, ok := es["buffering_size"].(int); ok {
+		bufferingHints.SizeInMBs = aws.Int64(int64(bufferingSize))
 	}
 
-	return nil
+	return bufferingHints
 }
 
-func createRedshiftConfig(d *schema.ResourceData) (*firehose.RedshiftDestinationConfiguration, error) {
-	redshiftRaw, ok := d.GetOk("redshift_configuration")
-	if !ok {
-		return nil, elasticsearchDestinationRequiredParamErr("redshift_configuration", destinationTypeRedshift)
+func expandAmazonopensearchserviceBufferingHints(es map[string]interface{}) *firehose.AmazonopensearchserviceBufferingHints {
+	bufferingHints := &firehose.AmazonopensearchserviceBufferingHints{}
+
+	if bufferingInterval, ok := es["buffering_interval"].(int); ok {
+		bufferingHints.IntervalInSeconds = aws.Int64(int64(bufferingInterval))
+	}
+	if bufferingSize, ok := es["buffering_size"].(int); ok {
+		bufferingHints.SizeInMBs = aws.Int64(int64(bufferingSize))
 	}
-	rl := redshiftRaw.([]interface{})
 
-	redshift := rl[0].(map[string]interface{})
+	return bufferingHints
+}
 
-	configuration := &firehose.RedshiftDestinationConfiguration{
-		ClusterJDBCURL:  aws.String(redshift["cluster_jdbcurl"].(string)),
-		RetryOptions:    extractRedshiftRetryOptions(redshift),
-		Password:        aws.String(redshift["password"].(string)),
-		Username:        aws.String(redshift["username"].(string)),
-		RoleARN:         aws.String(redshift["role_arn"].(string)),
-		CopyCommand:     extractCopyCommandConfiguration(redshift),
-		S3Configuration: createS3Config(redshift["s3_configuration"].([]interface{})),
-	}
+func expandAmazonOpenSearchServerlessBufferingHints(es map[string]interface{}) *firehose.AmazonOpenSearchServerlessBufferingHints {
+	bufferingHints := &firehose.AmazonOpenSearchServerlessBufferingHints{}
 
-	if _, ok := redshift["cloudwatch_logging_options"]; ok {
-		configuration.CloudWatchLoggingOptions = extractCloudWatchLoggingConfiguration(redshift)
-	}
-	if _, ok := redshift["processing_configuration"]; ok {
-		configuration.ProcessingConfiguration = extractProcessingConfiguration(redshift)
+	if bufferingInterval, ok := es["buffering_interval"].(int); ok {
+		bufferingHints.IntervalInSeconds = aws.Int64(int64(bufferingInterval))
 	}
-	if s3BackupMode, ok := redshift["s3_backup_mode"]; ok {
-		configuration.S3BackupMode = aws.String(s3BackupMode.(string))
-		configuration.S3BackupConfiguration = expandS3BackupConfig(d.Get("redshift_configuration").([]interface{})[0].(map[string]interface{}))
+	if bufferingSize, ok := es["buffering_size"].(int); ok {
+		bufferingHints.SizeInMBs = aws.Int64(int64(bufferingSize))
 	}
 
-	return configuration, nil
+	return bufferingHints
 }
 
-func updateRedshiftConfig(d *schema.ResourceData) (*firehose.RedshiftDestinationUpdate, error) {
-	redshiftRaw, ok := d.GetOk("redshift_configuration")
-	if !ok {
-		return nil, elasticsearchDestinationRequiredParamErr("redshift_configuration", destinationTypeRedshift)
+func expandElasticsearchRetryOptions(es map[string]interface{}) *firehose.ElasticsearchRetryOptions {
+	retryOptions := &firehose.ElasticsearchRetryOptions{}
+
+	if retryDuration, ok := es["retry_duration"].(int); ok {
+		retryOptions.DurationInSeconds = aws.Int64(int64(retryDuration))
 	}
-	rl := redshiftRaw.([]interface{})
 
-	redshift := rl[0].(map[string]interface{})
+	return retryOptions
+}
+
+func expandAmazonopensearchserviceRetryOptions(es map[string]interface{}) *firehose.AmazonopensearchserviceRetryOptions {
+	retryOptions := &firehose.AmazonopensearchserviceRetryOptions{}
 
-	configuration := &firehose.RedshiftDestinationUpdate{
-		ClusterJDBCURL: aws.String(redshift["cluster_jdbcurl"].(string)),
-		RetryOptions:   extractRedshiftRetryOptions(redshift),
-		Password:       aws.String(redshift["password"].(string)),
-		Username:       aws.String(redshift["username"].(string)),
-		RoleARN:        aws.String(redshift["role_arn"].(string)),
-		CopyCommand:    extractCopyCommandConfiguration(redshift),
+	if retryDuration, ok := es["retry_duration"].(int); ok {
+		retryOptions.DurationInSeconds = aws.Int64(int64(retryDuration))
 	}
 
-	s3Config := updateS3Config(redshift["s3_configuration"].([]interface{}))
-	// Redshift does not currently support ErrorOutputPrefix,
-	// which is set to the empty string within "updateS3Config",
-	// thus we must remove it here to avoid an InvalidArgumentException.
-	s3Config.ErrorOutputPrefix = nil
-	configuration.S3Update = s3Config
+	return retryOptions
+}
 
-	if _, ok := redshift["cloudwatch_logging_options"]; ok {
-		configuration.CloudWatchLoggingOptions = extractCloudWatchLoggingConfiguration(redshift)
-	}
-	if _, ok := redshift["processing_configuration"]; ok {
-		configuration.ProcessingConfiguration = extractProcessingConfiguration(redshift)
-	}
-	if s3BackupMode, ok := redshift["s3_backup_mode"]; ok {
-		configuration.S3BackupMode = aws.String(s3BackupMode.(string))
-		configuration.S3BackupUpdate = updateS3BackupConfig(d.Get("redshift_configuration").([]interface{})[0].(map[string]interface{}))
-		if configuration.S3BackupUpdate != nil {
-			// Redshift does not currently support ErrorOutputPrefix,
-			// which is set to the empty string within "updateS3BackupConfig",
-			// thus we must remove it here to avoid an InvalidArgumentException.
-			configuration.S3BackupUpdate.ErrorOutputPrefix = nil
-		}
+func expandAmazonOpenSearchServerlessRetryOptions(es map[string]interface{}) *firehose.AmazonOpenSearchServerlessRetryOptions {
+	retryOptions := &firehose.AmazonOpenSearchServerlessRetryOptions{}
+
+	if retryDuration, ok := es["retry_duration"].(int); ok {
+		retryOptions.DurationInSeconds = aws.Int64(int64(retryDuration))
 	}
 
-	return configuration, nil
+	return retryOptions
 }
 
-func elasticsearchDestinationRequiredParamErr(param, destination string) error {
-	return fmt.Errorf(`%q is required when "destination" is %q`, param, destination)
-}
+func expandHTTPEndpointRetryOptions(tfMap map[string]interface{}) *firehose.HttpEndpointRetryOptions {
+	retryOptions := &firehose.HttpEndpointRetryOptions{}
 
-func createElasticsearchConfig(d *schema.ResourceData) (*firehose.ElasticsearchDestinationConfiguration, error) {
-	esConfig, ok := d.GetOk("elasticsearch_configuration")
-	if !ok {
-		return nil, elasticsearchDestinationRequiredParamErr("elasticsearch_configuration", destinationTypeElasticsearch)
+	if retryDuration, ok := tfMap["retry_duration"].(int); ok {
+		retryOptions.DurationInSeconds = aws.Int64(int64(retryDuration))
 	}
-	esList := esConfig.([]interface{})
 
-	es := esList[0].(map[string]interface{})
+	return retryOptions
+}
 
-	config := &firehose.ElasticsearchDestinationConfiguration{
-		BufferingHints:  extractElasticsearchBufferingHints(es),
-		IndexName:       aws.String(es["index_name"].(string)),
-		RetryOptions:    extractElasticsearchRetryOptions(es),
-		RoleARN:         aws.String(es["role_arn"].(string)),
-		TypeName:        aws.String(es["type_name"].(string)),
-		S3Configuration: createS3Config(es["s3_configuration"].([]interface{})),
-	}
+func expandRedshiftRetryOptions(redshift map[string]interface{}) *firehose.RedshiftRetryOptions {
+	retryOptions := &firehose.RedshiftRetryOptions{}
 
-	if v, ok := es["domain_arn"]; ok && v.(string) != "" {
-		config.DomainARN = aws.String(v.(string))
+	if retryDuration, ok := redshift["retry_duration"].(int); ok {
+		retryOptions.DurationInSeconds = aws.Int64(int64(retryDuration))
 	}
 
-	if v, ok := es["cluster_endpoint"]; ok && v.(string) != "" {
-		config.ClusterEndpoint = aws.String(v.(string))
-	}
+	return retryOptions
+}
 
-	if _, ok := es["cloudwatch_logging_options"]; ok {
-		config.CloudWatchLoggingOptions = extractCloudWatchLoggingConfiguration(es)
-	}
+func expandSplunkRetryOptions(splunk map[string]interface{}) *firehose.SplunkRetryOptions {
+	retryOptions := &firehose.SplunkRetryOptions{}
 
-	if _, ok := es["processing_configuration"]; ok {
-		config.ProcessingConfiguration = extractProcessingConfiguration(es)
+	if retryDuration, ok := splunk["retry_duration"].(int); ok {
+		retryOptions.DurationInSeconds = aws.Int64(int64(retryDuration))
 	}
 
-	if indexRotationPeriod, ok := es["index_rotation_period"]; ok {
-		config.IndexRotationPeriod = aws.String(indexRotationPeriod.(string))
+	return retryOptions
+}
+
+func expandCopyCommand(redshift map[string]interface{}) *firehose.CopyCommand {
+	cmd := &firehose.CopyCommand{
+		DataTableName: aws.String(redshift["data_table_name"].(string)),
 	}
-	if s3BackupMode, ok := es["s3_backup_mode"]; ok {
-		config.S3BackupMode = aws.String(s3BackupMode.(string))
+	if copyOptions, ok := redshift["copy_options"]; ok {
+		cmd.CopyOptions = aws.String(copyOptions.(string))
 	}
-
-	if _, ok := es["vpc_config"]; ok {
-		config.VpcConfiguration = extractVPCConfiguration(es)
+	if columns, ok := redshift["data_table_columns"]; ok {
+		cmd.DataTableColumns = aws.String(columns.(string))
 	}
 
-	return config, nil
+	return cmd
 }
 
-func updateElasticsearchConfig(d *schema.ResourceData) (*firehose.ElasticsearchDestinationUpdate, error) {
-	esConfig, ok := d.GetOk("elasticsearch_configuration")
+func expandDeliveryStreamEncryptionConfigurationInput(tfList []interface{}) *firehose.DeliveryStreamEncryptionConfigurationInput {
+	if len(tfList) == 0 {
+		return nil
+	}
+
+	tfMap, ok := tfList[0].(map[string]interface{})
+
 	if !ok {
-		return nil, elasticsearchDestinationRequiredParamErr("elasticsearch_configuration", destinationTypeElasticsearch)
+		return nil
 	}
-	esList := esConfig.([]interface{})
 
-	es := esList[0].(map[string]interface{})
+	apiObject := &firehose.DeliveryStreamEncryptionConfigurationInput{}
 
-	update := &firehose.ElasticsearchDestinationUpdate{
-		BufferingHints: extractElasticsearchBufferingHints(es),
-		IndexName:      aws.String(es["index_name"].(string)),
-		RetryOptions:   extractElasticsearchRetryOptions(es),
-		RoleARN:        aws.String(es["role_arn"].(string)),
-		TypeName:       aws.String(es["type_name"].(string)),
-		S3Update:       updateS3Config(es["s3_configuration"].([]interface{})),
+	if v, ok := tfMap["key_arn"].(string); ok && v != "" {
+		apiObject.KeyARN = aws.String(v)
 	}
 
-	if v, ok := es["domain_arn"]; ok && v.(string) != "" {
-		update.DomainARN = aws.String(v.(string))
+	if v, ok := tfMap["key_type"].(string); ok && v != "" {
+		apiObject.KeyType = aws.String(v)
 	}
 
-	if v, ok := es["cluster_endpoint"]; ok && v.(string) != "" {
-		update.ClusterEndpoint = aws.String(v.(string))
+	return apiObject
+}
+
+func expandMSKSourceConfiguration(tfMap map[string]interface{}) *firehose.MSKSourceConfiguration {
+	if tfMap == nil {
+		return nil
 	}
 
-	if _, ok := es["cloudwatch_logging_options"]; ok {
-		update.CloudWatchLoggingOptions = extractCloudWatchLoggingConfiguration(es)
+	apiObject := &firehose.MSKSourceConfiguration{}
+
+	if v, ok := tfMap["authentication_configuration"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
+		apiObject.AuthenticationConfiguration = expandAuthenticationConfiguration(v[0].(map[string]interface{}))
 	}
 
-	if _, ok := es["processing_configuration"]; ok {
-		update.ProcessingConfiguration = extractProcessingConfiguration(es)
+	if v, ok := tfMap["msk_cluster_arn"].(string); ok && v != "" {
+		apiObject.MSKClusterARN = aws.String(v)
 	}
 
-	if indexRotationPeriod, ok := es["index_rotation_period"]; ok {
-		update.IndexRotationPeriod = aws.String(indexRotationPeriod.(string))
+	if v, ok := tfMap["topic_name"].(string); ok && v != "" {
+		apiObject.TopicName = aws.String(v)
 	}
 
-	return update, nil
+	return apiObject
 }
 
-func createOpensearchConfig(d *schema.ResourceData) (*firehose.AmazonopensearchserviceDestinationConfiguration, error) {
-	esConfig, ok := d.GetOk("opensearch_configuration")
-	if !ok {
-		return nil, elasticsearchDestinationRequiredParamErr("opensearch_configuration", destinationTypeOpensearch)
+func expandAuthenticationConfiguration(tfMap map[string]interface{}) *firehose.AuthenticationConfiguration {
+	if tfMap == nil {
+		return nil
 	}
-	esList := esConfig.([]interface{})
 
-	es := esList[0].(map[string]interface{})
+	apiObject := &firehose.AuthenticationConfiguration{}
 
-	config := &firehose.AmazonopensearchserviceDestinationConfiguration{
-		BufferingHints:  extractOpensearchBufferingHints(es),
-		IndexName:       aws.String(es["index_name"].(string)),
-		RetryOptions:    extractOpensearchRetryOptions(es),
-		RoleARN:         aws.String(es["role_arn"].(string)),
-		TypeName:        aws.String(es["type_name"].(string)),
-		S3Configuration: createS3Config(es["s3_configuration"].([]interface{})),
+	if v, ok := tfMap["connectivity"].(string); ok && v != "" {
+		apiObject.Connectivity = aws.String(v)
 	}
 
-	if v, ok := es["domain_arn"]; ok && v.(string) != "" {
-		config.DomainARN = aws.String(v.(string))
+	if v, ok := tfMap["role_arn"].(string); ok && v != "" {
+		apiObject.RoleARN = aws.String(v)
 	}
 
-	if v, ok := es["cluster_endpoint"]; ok && v.(string) != "" {
-		config.ClusterEndpoint = aws.String(v.(string))
-	}
+	return apiObject
+}
 
-	if _, ok := es["cloudwatch_logging_options"]; ok {
-		config.CloudWatchLoggingOptions = extractCloudWatchLoggingConfiguration(es)
+func flattenMSKSourceDescription(apiObject *firehose.MSKSourceDescription) map[string]interface{} {
+	if apiObject == nil {
+		return nil
 	}
 
-	if _, ok := es["processing_configuration"]; ok {
-		config.ProcessingConfiguration = extractProcessingConfiguration(es)
-	}
+	tfMap := map[string]interface{}{}
 
-	if indexRotationPeriod, ok := es["index_rotation_period"]; ok {
-		config.IndexRotationPeriod = aws.String(indexRotationPeriod.(string))
+	if v := apiObject.AuthenticationConfiguration; v != nil {
+		tfMap["authentication_configuration"] = []interface{}{flattenAuthenticationConfiguration(v)}
 	}
-	if s3BackupMode, ok := es["s3_backup_mode"]; ok {
-		config.S3BackupMode = aws.String(s3BackupMode.(string))
+
+	if v := apiObject.MSKClusterARN; v != nil {
+		tfMap["msk_cluster_arn"] = aws.StringValue(v)
 	}
 
-	if _, ok := es["vpc_config"]; ok {
-		config.VpcConfiguration = extractVPCConfiguration(es)
+	if v := apiObject.TopicName; v != nil {
+		tfMap["topic_name"] = aws.StringValue(v)
 	}
 
-	return config, nil
+	return tfMap
 }
 
-func updateOpensearchConfig(d *schema.ResourceData) (*firehose.AmazonopensearchserviceDestinationUpdate, error) {
-	esConfig, ok := d.GetOk("opensearch_configuration")
-	if !ok {
-		return nil, elasticsearchDestinationRequiredParamErr("elasticsearch_configuration", destinationTypeOpensearch)
+func flattenAuthenticationConfiguration(apiObject *firehose.AuthenticationConfiguration) map[string]interface{} {
+	if apiObject == nil {
+		return nil
 	}
-	esList := esConfig.([]interface{})
 
-	es := esList[0].(map[string]interface{})
+	tfMap := map[string]interface{}{}
 
-	update := &firehose.AmazonopensearchserviceDestinationUpdate{
-		BufferingHints: extractOpensearchBufferingHints(es),
-		IndexName:      aws.String(es["index_name"].(string)),
-		RetryOptions:   extractOpensearchRetryOptions(es),
-		RoleARN:        aws.String(es["role_arn"].(string)),
-		TypeName:       aws.String(es["type_name"].(string)),
-		S3Update:       updateS3Config(es["s3_configuration"].([]interface{})),
+	if v := apiObject.Connectivity; v != nil {
+		tfMap["connectivity"] = aws.StringValue(v)
 	}
 
-	if v, ok := es["domain_arn"]; ok && v.(string) != "" {
-		update.DomainARN = aws.String(v.(string))
+	if v := apiObject.RoleARN; v != nil {
+		tfMap["role_arn"] = aws.StringValue(v)
 	}
 
-	if v, ok := es["cluster_endpoint"]; ok && v.(string) != "" {
-		update.ClusterEndpoint = aws.String(v.(string))
-	}
+	return tfMap
+}
 
-	if _, ok := es["cloudwatch_logging_options"]; ok {
-		update.CloudWatchLoggingOptions = extractCloudWatchLoggingConfiguration(es)
+func flattenCloudWatchLoggingOptions(clo *firehose.CloudWatchLoggingOptions) []interface{} {
+	if clo == nil {
+		return []interface{}{}
 	}
 
-	if _, ok := es["processing_configuration"]; ok {
-		update.ProcessingConfiguration = extractProcessingConfiguration(es)
+	cloudwatchLoggingOptions := map[string]interface{}{
+		"enabled": aws.BoolValue(clo.Enabled),
 	}
-
-	if indexRotationPeriod, ok := es["index_rotation_period"]; ok {
-		update.IndexRotationPeriod = aws.String(indexRotationPeriod.(string))
+	if aws.BoolValue(clo.Enabled) {
+		cloudwatchLoggingOptions["log_group_name"] = aws.StringValue(clo.LogGroupName)
+		cloudwatchLoggingOptions["log_stream_name"] = aws.StringValue(clo.LogStreamName)
 	}
-
-	return update, nil
+	return []interface{}{cloudwatchLoggingOptions}
 }
 
-func createSplunkConfig(d *schema.ResourceData) (*firehose.SplunkDestinationConfiguration, error) {
-	splunkRaw, ok := d.GetOk("splunk_configuration")
-	if !ok {
-		return nil, elasticsearchDestinationRequiredParamErr("splunk_configuration", destinationTypeSplunk)
+func flattenElasticsearchDestinationDescription(description *firehose.ElasticsearchDestinationDescription) []map[string]interface{} {
+	if description == nil {
+		return []map[string]interface{}{}
 	}
-	sl := splunkRaw.([]interface{})
 
-	splunk := sl[0].(map[string]interface{})
+	m := map[string]interface{}{
+		"cloudwatch_logging_options": flattenCloudWatchLoggingOptions(description.CloudWatchLoggingOptions),
+		"role_arn":                   aws.StringValue(description.RoleARN),
+		"type_name":                  aws.StringValue(description.TypeName),
+		"index_name":                 aws.StringValue(description.IndexName),
+		"s3_backup_mode":             aws.StringValue(description.S3BackupMode),
+		"s3_configuration":           flattenS3DestinationDescription(description.S3DestinationDescription),
+		"index_rotation_period":      aws.StringValue(description.IndexRotationPeriod),
+		"vpc_config":                 flattenVPCConfigurationDescription(description.VpcConfigurationDescription),
+		"processing_configuration":   flattenProcessingConfiguration(description.ProcessingConfiguration, aws.StringValue(description.RoleARN)),
+	}
 
-	configuration := &firehose.SplunkDestinationConfiguration{
-		HECToken:                          aws.String(splunk["hec_token"].(string)),
-		HECEndpointType:                   aws.String(splunk["hec_endpoint_type"].(string)),
-		HECEndpoint:                       aws.String(splunk["hec_endpoint"].(string)),
-		HECAcknowledgmentTimeoutInSeconds: aws.Int64(int64(splunk["hec_acknowledgment_timeout"].(int))),
-		RetryOptions:                      extractSplunkRetryOptions(splunk),
-		S3Configuration:                   createS3Config(splunk["s3_configuration"].([]interface{})),
+	if description.DomainARN != nil {
+		m["domain_arn"] = aws.StringValue(description.DomainARN)
 	}
 
-	if _, ok := splunk["processing_configuration"]; ok {
-		configuration.ProcessingConfiguration = extractProcessingConfiguration(splunk)
+	if description.ClusterEndpoint != nil {
+		m["cluster_endpoint"] = aws.StringValue(description.ClusterEndpoint)
 	}
 
-	if _, ok := splunk["cloudwatch_logging_options"]; ok {
-		configuration.CloudWatchLoggingOptions = extractCloudWatchLoggingConfiguration(splunk)
+	if description.BufferingHints != nil {
+		m["buffering_interval"] = int(aws.Int64Value(description.BufferingHints.IntervalInSeconds))
+		m["buffering_size"] = int(aws.Int64Value(description.BufferingHints.SizeInMBs))
 	}
-	if s3BackupMode, ok := splunk["s3_backup_mode"]; ok {
-		configuration.S3BackupMode = aws.String(s3BackupMode.(string))
+
+	if description.RetryOptions != nil {
+		m["retry_duration"] = int(aws.Int64Value(description.RetryOptions.DurationInSeconds))
 	}
 
-	return configuration, nil
+	return []map[string]interface{}{m}
 }
 
-func updateSplunkConfig(d *schema.ResourceData) (*firehose.SplunkDestinationUpdate, error) {
-	splunkRaw, ok := d.GetOk("splunk_configuration")
-	if !ok {
-		return nil, elasticsearchDestinationRequiredParamErr("splunk_configuration", destinationTypeSplunk)
+func flattenAmazonopensearchserviceDestinationDescription(description *firehose.AmazonopensearchserviceDestinationDescription) []map[string]interface{} {
+	if description == nil {
+		return []map[string]interface{}{}
 	}
-	sl := splunkRaw.([]interface{})
 
-	splunk := sl[0].(map[string]interface{})
+	m := map[string]interface{}{
+		"cloudwatch_logging_options": flattenCloudWatchLoggingOptions(description.CloudWatchLoggingOptions),
+		"role_arn":                   aws.StringValue(description.RoleARN),
+		"type_name":                  aws.StringValue(description.TypeName),
+		"index_name":                 aws.StringValue(description.IndexName),
+		"s3_backup_mode":             aws.StringValue(description.S3BackupMode),
+		"s3_configuration":           flattenS3DestinationDescription(description.S3DestinationDescription),
+		"index_rotation_period":      aws.StringValue(description.IndexRotationPeriod),
+		"vpc_config":                 flattenVPCConfigurationDescription(description.VpcConfigurationDescription),
+		"processing_configuration":   flattenProcessingConfiguration(description.ProcessingConfiguration, aws.StringValue(description.RoleARN)),
+	}
 
-	configuration := &firehose.SplunkDestinationUpdate{
-		HECToken:                          aws.String(splunk["hec_token"].(string)),
-		HECEndpointType:                   aws.String(splunk["hec_endpoint_type"].(string)),
-		HECEndpoint:                       aws.String(splunk["hec_endpoint"].(string)),
-		HECAcknowledgmentTimeoutInSeconds: aws.Int64(int64(splunk["hec_acknowledgment_timeout"].(int))),
-		RetryOptions:                      extractSplunkRetryOptions(splunk),
-		S3Update:                          updateS3Config(splunk["s3_configuration"].([]interface{})),
+	if description.DomainARN != nil {
+		m["domain_arn"] = aws.StringValue(description.DomainARN)
 	}
 
-	if _, ok := splunk["processing_configuration"]; ok {
-		configuration.ProcessingConfiguration = extractProcessingConfiguration(splunk)
+	if description.ClusterEndpoint != nil {
+		m["cluster_endpoint"] = aws.StringValue(description.ClusterEndpoint)
 	}
 
-	if _, ok := splunk["cloudwatch_logging_options"]; ok {
-		configuration.CloudWatchLoggingOptions = extractCloudWatchLoggingConfiguration(splunk)
+	if description.BufferingHints != nil {
+		m["buffering_interval"] = int(aws.Int64Value(description.BufferingHints.IntervalInSeconds))
+		m["buffering_size"] = int(aws.Int64Value(description.BufferingHints.SizeInMBs))
 	}
-	if s3BackupMode, ok := splunk["s3_backup_mode"]; ok {
-		configuration.S3BackupMode = aws.String(s3BackupMode.(string))
+
+	if description.RetryOptions != nil {
+		m["retry_duration"] = int(aws.Int64Value(description.RetryOptions.DurationInSeconds))
 	}
 
-	return configuration, nil
+	return []map[string]interface{}{m}
 }
 
-func createHTTPEndpointConfig(d *schema.ResourceData) (*firehose.HttpEndpointDestinationConfiguration, error) {
-	HttpEndpointRaw, ok := d.GetOk("http_endpoint_configuration")
-	if !ok {
-		return nil, elasticsearchDestinationRequiredParamErr("http_endpoint_configuration", destinationTypeHTTPEndpoint)
+func flattenAmazonOpenSearchServerlessDestinationDescription(description *firehose.AmazonOpenSearchServerlessDestinationDescription) []map[string]interface{} {
+	if description == nil {
+		return []map[string]interface{}{}
 	}
-	sl := HttpEndpointRaw.([]interface{})
-
-	HttpEndpoint := sl[0].(map[string]interface{})
 
-	configuration := &firehose.HttpEndpointDestinationConfiguration{
-		RetryOptions:    extractHTTPEndpointRetryOptions(HttpEndpoint),
-		RoleARN:         aws.String(HttpEndpoint["role_arn"].(string)),
-		S3Configuration: createS3Config(HttpEndpoint["s3_configuration"].([]interface{})),
+	m := map[string]interface{}{
+		"cloudwatch_logging_options": flattenCloudWatchLoggingOptions(description.CloudWatchLoggingOptions),
+		"role_arn":                   aws.StringValue(description.RoleARN),
+		"index_name":                 aws.StringValue(description.IndexName),
+		"s3_backup_mode":             aws.StringValue(description.S3BackupMode),
+		"s3_configuration":           flattenS3DestinationDescription(description.S3DestinationDescription),
+		"vpc_config":                 flattenVPCConfigurationDescription(description.VpcConfigurationDescription),
+		"processing_configuration":   flattenProcessingConfiguration(description.ProcessingConfiguration, aws.StringValue(description.RoleARN)),
 	}
 
-	configuration.EndpointConfiguration = extractHTTPEndpointConfiguration(HttpEndpoint)
-
-	bufferingHints := &firehose.HttpEndpointBufferingHints{}
-
-	if bufferingInterval, ok := HttpEndpoint["buffering_interval"].(int); ok {
-		bufferingHints.IntervalInSeconds = aws.Int64(int64(bufferingInterval))
-	}
-	if bufferingSize, ok := HttpEndpoint["buffering_size"].(int); ok {
-		bufferingHints.SizeInMBs = aws.Int64(int64(bufferingSize))
+	if description.CollectionEndpoint != nil {
+		m["collection_endpoint"] = aws.StringValue(description.CollectionEndpoint)
 	}
-	configuration.BufferingHints = bufferingHints
 
-	if _, ok := HttpEndpoint["processing_configuration"]; ok {
-		configuration.ProcessingConfiguration = extractProcessingConfiguration(HttpEndpoint)
+	if description.BufferingHints != nil {
+		m["buffering_interval"] = int(aws.Int64Value(description.BufferingHints.IntervalInSeconds))
+		m["buffering_size"] = int(aws.Int64Value(description.BufferingHints.SizeInMBs))
 	}
 
-	if _, ok := HttpEndpoint["request_configuration"]; ok {
-		configuration.RequestConfiguration = extractRequestConfiguration(HttpEndpoint)
+	if description.RetryOptions != nil {
+		m["retry_duration"] = int(aws.Int64Value(description.RetryOptions.DurationInSeconds))
 	}
 
-	if _, ok := HttpEndpoint["cloudwatch_logging_options"]; ok {
-		configuration.CloudWatchLoggingOptions = extractCloudWatchLoggingConfiguration(HttpEndpoint)
+	return []map[string]interface{}{m}
+}
+
+func flattenVPCConfigurationDescription(description *firehose.VpcConfigurationDescription) []map[string]interface{} {
+	if description == nil {
+		return []map[string]interface{}{}
 	}
-	if s3BackupMode, ok := HttpEndpoint["s3_backup_mode"]; ok {
-		configuration.S3BackupMode = aws.String(s3BackupMode.(string))
+
+	m := map[string]interface{}{
+		"vpc_id":             aws.StringValue(description.VpcId),
+		"subnet_ids":         flex.FlattenStringSet(description.SubnetIds),
+		"security_group_ids": flex.FlattenStringSet(description.SecurityGroupIds),
+		"role_arn":           aws.StringValue(description.RoleARN),
 	}
 
-	return configuration, nil
+	return []map[string]interface{}{m}
 }
 
-func updateHTTPEndpointConfig(d *schema.ResourceData) (*firehose.HttpEndpointDestinationUpdate, error) {
-	HttpEndpointRaw, ok := d.GetOk("http_endpoint_configuration")
-	if !ok {
-		return nil, elasticsearchDestinationRequiredParamErr("http_endpoint_configuration", destinationTypeHTTPEndpoint)
+func flattenExtendedS3DestinationDescription(description *firehose.ExtendedS3DestinationDescription) []map[string]interface{} {
+	if description == nil {
+		return []map[string]interface{}{}
 	}
-	sl := HttpEndpointRaw.([]interface{})
 
-	HttpEndpoint := sl[0].(map[string]interface{})
-
-	configuration := &firehose.HttpEndpointDestinationUpdate{
-		RetryOptions: extractHTTPEndpointRetryOptions(HttpEndpoint),
-		RoleARN:      aws.String(HttpEndpoint["role_arn"].(string)),
-		S3Update:     updateS3Config(HttpEndpoint["s3_configuration"].([]interface{})),
+	m := map[string]interface{}{
+		"bucket_arn":                           aws.StringValue(description.BucketARN),
+		"cloudwatch_logging_options":           flattenCloudWatchLoggingOptions(description.CloudWatchLoggingOptions),
+		"compression_format":                   aws.StringValue(description.CompressionFormat),
+		"data_format_conversion_configuration": flattenDataFormatConversionConfiguration(description.DataFormatConversionConfiguration),
+		"error_output_prefix":                  aws.StringValue(description.ErrorOutputPrefix),
+		"prefix":                               aws.StringValue(description.Prefix),
+		"processing_configuration":             flattenProcessingConfiguration(description.ProcessingConfiguration, aws.StringValue(description.RoleARN)),
+		"dynamic_partitioning_configuration":   flattenDynamicPartitioningConfiguration(description.DynamicPartitioningConfiguration),
+		"role_arn":                             aws.StringValue(description.RoleARN),
+		"s3_backup_configuration":              flattenS3DestinationDescription(description.S3BackupDescription),
+		"s3_backup_mode":                       aws.StringValue(description.S3BackupMode),
 	}
 
-	configuration.EndpointConfiguration = extractHTTPEndpointConfiguration(HttpEndpoint)
-
-	bufferingHints := &firehose.HttpEndpointBufferingHints{}
-
-	if bufferingInterval, ok := HttpEndpoint["buffering_interval"].(int); ok {
-		bufferingHints.IntervalInSeconds = aws.Int64(int64(bufferingInterval))
+	if description.BufferingHints != nil {
+		m["buffering_interval"] = int(aws.Int64Value(description.BufferingHints.IntervalInSeconds))
+		m["buffering_size"] = int(aws.Int64Value(description.BufferingHints.SizeInMBs))
 	}
-	if bufferingSize, ok := HttpEndpoint["buffering_size"].(int); ok {
-		bufferingHints.SizeInMBs = aws.Int64(int64(bufferingSize))
+
+	if description.EncryptionConfiguration != nil && description.EncryptionConfiguration.KMSEncryptionConfig != nil {
+		m["kms_key_arn"] = aws.StringValue(description.EncryptionConfiguration.KMSEncryptionConfig.AWSKMSKeyARN)
 	}
-	configuration.BufferingHints = bufferingHints
 
-	if _, ok := HttpEndpoint["processing_configuration"]; ok {
-		configuration.ProcessingConfiguration = extractProcessingConfiguration(HttpEndpoint)
+	return []map[string]interface{}{m}
+}
+
+func flattenRedshiftDestinationDescription(description *firehose.RedshiftDestinationDescription, configuredPassword string) []map[string]interface{} {
+	if description == nil {
+		return []map[string]interface{}{}
 	}
 
-	if _, ok := HttpEndpoint["request_configuration"]; ok {
-		configuration.RequestConfiguration = extractRequestConfiguration(HttpEndpoint)
+	m := map[string]interface{}{
+		"cloudwatch_logging_options": flattenCloudWatchLoggingOptions(description.CloudWatchLoggingOptions),
+		"cluster_jdbcurl":            aws.StringValue(description.ClusterJDBCURL),
+		"password":                   configuredPassword,
+		"processing_configuration":   flattenProcessingConfiguration(description.ProcessingConfiguration, aws.StringValue(description.RoleARN)),
+		"role_arn":                   aws.StringValue(description.RoleARN),
+		"s3_backup_configuration":    flattenS3DestinationDescription(description.S3BackupDescription),
+		"s3_backup_mode":             aws.StringValue(description.S3BackupMode),
+		"s3_configuration":           flattenS3DestinationDescription(description.S3DestinationDescription),
+		"username":                   aws.StringValue(description.Username),
 	}
 
-	if _, ok := HttpEndpoint["cloudwatch_logging_options"]; ok {
-		configuration.CloudWatchLoggingOptions = extractCloudWatchLoggingConfiguration(HttpEndpoint)
+	if description.CopyCommand != nil {
+		m["copy_options"] = aws.StringValue(description.CopyCommand.CopyOptions)
+		m["data_table_columns"] = aws.StringValue(description.CopyCommand.DataTableColumns)
+		m["data_table_name"] = aws.StringValue(description.CopyCommand.DataTableName)
 	}
 
-	if s3BackupMode, ok := HttpEndpoint["s3_backup_mode"]; ok {
-		configuration.S3BackupMode = aws.String(s3BackupMode.(string))
+	if description.RetryOptions != nil {
+		m["retry_duration"] = int(aws.Int64Value(description.RetryOptions.DurationInSeconds))
 	}
 
-	return configuration, nil
+	return []map[string]interface{}{m}
 }
 
-func extractCommonAttributes(ca []interface{}) []*firehose.HttpEndpointCommonAttribute {
-	CommonAttributes := make([]*firehose.HttpEndpointCommonAttribute, 0, len(ca))
-
-	for _, raw := range ca {
-		data := raw.(map[string]interface{})
+func flattenSplunkDestinationDescription(description *firehose.SplunkDestinationDescription) []map[string]interface{} {
+	if description == nil {
+		return []map[string]interface{}{}
+	}
+	m := map[string]interface{}{
+		"cloudwatch_logging_options": flattenCloudWatchLoggingOptions(description.CloudWatchLoggingOptions),
+		"hec_acknowledgment_timeout": int(aws.Int64Value(description.HECAcknowledgmentTimeoutInSeconds)),
+		"hec_endpoint_type":          aws.StringValue(description.HECEndpointType),
+		"hec_endpoint":               aws.StringValue(description.HECEndpoint),
+		"hec_token":                  aws.StringValue(description.HECToken),
+		"processing_configuration":   flattenProcessingConfiguration(description.ProcessingConfiguration, ""),
+		"s3_backup_mode":             aws.StringValue(description.S3BackupMode),
+		"s3_configuration":           flattenS3DestinationDescription(description.S3DestinationDescription),
+	}
 
-		a := &firehose.HttpEndpointCommonAttribute{
-			AttributeName:  aws.String(data["name"].(string)),
-			AttributeValue: aws.String(data["value"].(string)),
-		}
-		CommonAttributes = append(CommonAttributes, a)
+	if description.RetryOptions != nil {
+		m["retry_duration"] = int(aws.Int64Value(description.RetryOptions.DurationInSeconds))
 	}
 
-	return CommonAttributes
+	return []map[string]interface{}{m}
 }
 
-func extractRequestConfiguration(rc map[string]interface{}) *firehose.HttpEndpointRequestConfiguration {
-	config := rc["request_configuration"].([]interface{})
-	if len(config) == 0 {
-		return nil
+func flattenS3DestinationDescription(description *firehose.S3DestinationDescription) []map[string]interface{} {
+	if description == nil {
+		return []map[string]interface{}{}
 	}
 
-	requestConfig := config[0].(map[string]interface{})
-	RequestConfiguration := &firehose.HttpEndpointRequestConfiguration{}
+	m := map[string]interface{}{
+		"bucket_arn":                 aws.StringValue(description.BucketARN),
+		"cloudwatch_logging_options": flattenCloudWatchLoggingOptions(description.CloudWatchLoggingOptions),
+		"compression_format":         aws.StringValue(description.CompressionFormat),
+		"error_output_prefix":        aws.StringValue(description.ErrorOutputPrefix),
+		"prefix":                     aws.StringValue(description.Prefix),
+		"role_arn":                   aws.StringValue(description.RoleARN),
+	}
 
-	if contentEncoding, ok := requestConfig["content_encoding"]; ok {
-		RequestConfiguration.ContentEncoding = aws.String(contentEncoding.(string))
+	if description.BufferingHints != nil {
+		m["buffering_interval"] = int(aws.Int64Value(description.BufferingHints.IntervalInSeconds))
+		m["buffering_size"] = int(aws.Int64Value(description.BufferingHints.SizeInMBs))
 	}
 
-	if commonAttributes, ok := requestConfig["common_attributes"]; ok {
-		RequestConfiguration.CommonAttributes = extractCommonAttributes(commonAttributes.([]interface{}))
+	if description.EncryptionConfiguration != nil && description.EncryptionConfiguration.KMSEncryptionConfig != nil {
+		m["kms_key_arn"] = aws.StringValue(description.EncryptionConfiguration.KMSEncryptionConfig.AWSKMSKeyARN)
 	}
 
-	return RequestConfiguration
+	return []map[string]interface{}{m}
 }
 
-func extractHTTPEndpointConfiguration(ep map[string]interface{}) *firehose.HttpEndpointConfiguration {
-	endpointConfiguration := &firehose.HttpEndpointConfiguration{
-		Url: aws.String(ep["url"].(string)),
+func flattenDataFormatConversionConfiguration(dfcc *firehose.DataFormatConversionConfiguration) []map[string]interface{} {
+	if dfcc == nil {
+		return []map[string]interface{}{}
 	}
 
-	if Name, ok := ep["name"]; ok {
-		endpointConfiguration.Name = aws.String(Name.(string))
+	enabled := aws.BoolValue(dfcc.Enabled)
+	ifc := flattenInputFormatConfiguration(dfcc.InputFormatConfiguration)
+	ofc := flattenOutputFormatConfiguration(dfcc.OutputFormatConfiguration)
+	sc := flattenSchemaConfiguration(dfcc.SchemaConfiguration)
+
+	// The AWS SDK can represent "no data format conversion configuration" in two ways:
+	// 1. With a nil value
+	// 2. With enabled set to false and nil for ALL the config sections.
+	// We normalize this with an empty configuration in the state due
+	// to the existing Default: true on the enabled attribute.
+	if !enabled && len(ifc) == 0 && len(ofc) == 0 && len(sc) == 0 {
+		return []map[string]interface{}{}
 	}
 
-	if AccessKey, ok := ep["access_key"]; ok {
-		endpointConfiguration.AccessKey = aws.String(AccessKey.(string))
+	m := map[string]interface{}{
+		"enabled":                     enabled,
+		"input_format_configuration":  ifc,
+		"output_format_configuration": ofc,
+		"schema_configuration":        sc,
 	}
 
-	return endpointConfiguration
+	return []map[string]interface{}{m}
 }
 
-func extractElasticsearchBufferingHints(es map[string]interface{}) *firehose.ElasticsearchBufferingHints {
-	bufferingHints := &firehose.ElasticsearchBufferingHints{}
-
-	if bufferingInterval, ok := es["buffering_interval"].(int); ok {
-		bufferingHints.IntervalInSeconds = aws.Int64(int64(bufferingInterval))
+func flattenInputFormatConfiguration(ifc *firehose.InputFormatConfiguration) []map[string]interface{} {
+	if ifc == nil {
+		return []map[string]interface{}{}
 	}
-	if bufferingSize, ok := es["buffering_size"].(int); ok {
-		bufferingHints.SizeInMBs = aws.Int64(int64(bufferingSize))
+
+	m := map[string]interface{}{
+		"deserializer": flattenDeserializer(ifc.Deserializer),
 	}
 
-	return bufferingHints
+	return []map[string]interface{}{m}
 }
 
-func extractOpensearchBufferingHints(es map[string]interface{}) *firehose.AmazonopensearchserviceBufferingHints {
-	bufferingHints := &firehose.AmazonopensearchserviceBufferingHints{}
-
-	if bufferingInterval, ok := es["buffering_interval"].(int); ok {
-		bufferingHints.IntervalInSeconds = aws.Int64(int64(bufferingInterval))
+func flattenDeserializer(deserializer *firehose.Deserializer) []map[string]interface{} {
+	if deserializer == nil {
+		return []map[string]interface{}{}
 	}
-	if bufferingSize, ok := es["buffering_size"].(int); ok {
-		bufferingHints.SizeInMBs = aws.Int64(int64(bufferingSize))
+
+	m := map[string]interface{}{
+		"hive_json_ser_de":   flattenHiveJSONSerDe(deserializer.HiveJsonSerDe),
+		"open_x_json_ser_de": flattenOpenXJSONSerDe(deserializer.OpenXJsonSerDe),
 	}
 
-	return bufferingHints
+	return []map[string]interface{}{m}
 }
 
-func extractElasticsearchRetryOptions(es map[string]interface{}) *firehose.ElasticsearchRetryOptions {
-	retryOptions := &firehose.ElasticsearchRetryOptions{}
+func flattenHiveJSONSerDe(hjsd *firehose.HiveJsonSerDe) []map[string]interface{} {
+	if hjsd == nil {
+		return []map[string]interface{}{}
+	}
 
-	if retryDuration, ok := es["retry_duration"].(int); ok {
-		retryOptions.DurationInSeconds = aws.Int64(int64(retryDuration))
+	m := map[string]interface{}{
+		"timestamp_formats": flex.FlattenStringList(hjsd.TimestampFormats),
 	}
 
-	return retryOptions
+	return []map[string]interface{}{m}
 }
 
-func extractOpensearchRetryOptions(es map[string]interface{}) *firehose.AmazonopensearchserviceRetryOptions {
-	retryOptions := &firehose.AmazonopensearchserviceRetryOptions{}
-
-	if retryDuration, ok := es["retry_duration"].(int); ok {
-		retryOptions.DurationInSeconds = aws.Int64(int64(retryDuration))
+func flattenOpenXJSONSerDe(oxjsd *firehose.OpenXJsonSerDe) []map[string]interface{} {
+	if oxjsd == nil {
+		return []map[string]interface{}{}
 	}
 
-	return retryOptions
-}
+	m := map[string]interface{}{
+		"column_to_json_key_mappings":              aws.StringValueMap(oxjsd.ColumnToJsonKeyMappings),
+		"convert_dots_in_json_keys_to_underscores": aws.BoolValue(oxjsd.ConvertDotsInJsonKeysToUnderscores),
+	}
 
-func extractHTTPEndpointRetryOptions(tfMap map[string]interface{}) *firehose.HttpEndpointRetryOptions {
-	retryOptions := &firehose.HttpEndpointRetryOptions{}
+	// API omits default values
+	// Return defaults that are not type zero values to prevent extraneous difference
 
-	if retryDuration, ok := tfMap["retry_duration"].(int); ok {
-		retryOptions.DurationInSeconds = aws.Int64(int64(retryDuration))
+	m["case_insensitive"] = true
+	if oxjsd.CaseInsensitive != nil {
+		m["case_insensitive"] = aws.BoolValue(oxjsd.CaseInsensitive)
 	}
 
-	return retryOptions
+	return []map[string]interface{}{m}
 }
 
-func extractRedshiftRetryOptions(redshift map[string]interface{}) *firehose.RedshiftRetryOptions {
-	retryOptions := &firehose.RedshiftRetryOptions{}
+func flattenOutputFormatConfiguration(ofc *firehose.OutputFormatConfiguration) []map[string]interface{} {
+	if ofc == nil {
+		return []map[string]interface{}{}
+	}
 
-	if retryDuration, ok := redshift["retry_duration"].(int); ok {
-		retryOptions.DurationInSeconds = aws.Int64(int64(retryDuration))
+	m := map[string]interface{}{
+		"serializer": flattenSerializer(ofc.Serializer),
 	}
 
-	return retryOptions
+	return []map[string]interface{}{m}
 }
 
-func extractSplunkRetryOptions(splunk map[string]interface{}) *firehose.SplunkRetryOptions {
-	retryOptions := &firehose.SplunkRetryOptions{}
+func flattenSerializer(serializer *firehose.Serializer) []map[string]interface{} {
+	if serializer == nil {
+		return []map[string]interface{}{}
+	}
 
-	if retryDuration, ok := splunk["retry_duration"].(int); ok {
-		retryOptions.DurationInSeconds = aws.Int64(int64(retryDuration))
+	m := map[string]interface{}{
+		"orc_ser_de":     flattenOrcSerDe(serializer.OrcSerDe),
+		"parquet_ser_de": flattenParquetSerDe(serializer.ParquetSerDe),
 	}
 
-	return retryOptions
+	return []map[string]interface{}{m}
 }
 
-func extractCopyCommandConfiguration(redshift map[string]interface{}) *firehose.CopyCommand {
-	cmd := &firehose.CopyCommand{
-		DataTableName: aws.String(redshift["data_table_name"].(string)),
-	}
-	if copyOptions, ok := redshift["copy_options"]; ok {
-		cmd.CopyOptions = aws.String(copyOptions.(string))
-	}
-	if columns, ok := redshift["data_table_columns"]; ok {
-		cmd.DataTableColumns = aws.String(columns.(string))
+func flattenOrcSerDe(osd *firehose.OrcSerDe) []map[string]interface{} {
+	if osd == nil {
+		return []map[string]interface{}{}
 	}
 
-	return cmd
-}
-
-func resourceDeliveryStreamCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	var diags diag.Diagnostics
+	m := map[string]interface{}{
+		"bloom_filter_columns":     aws.StringValueSlice(osd.BloomFilterColumns),
+		"dictionary_key_threshold": aws.Float64Value(osd.DictionaryKeyThreshold),
+		"enable_padding":           aws.BoolValue(osd.EnablePadding),
+	}
 
-	sn := d.Get("name").(string)
+	// API omits default values
+	// Return defaults that are not type zero values to prevent extraneous difference
 
-	if err := validateSchema(d); err != nil {
-		return sdkdiag.AppendErrorf(diags, "creating Kinesis Firehose Delivery Stream (%s): %s", sn, err)
+	m["block_size_bytes"] = 268435456
+	if osd.BlockSizeBytes != nil {
+		m["block_size_bytes"] = int(aws.Int64Value(osd.BlockSizeBytes))
 	}
 
-	conn := meta.(*conns.AWSClient).FirehoseConn(ctx)
-	input := &firehose.CreateDeliveryStreamInput{
-		DeliveryStreamName: aws.String(sn),
-		Tags:               getTagsIn(ctx),
+	m["bloom_filter_false_positive_probability"] = 0.05
+	if osd.BloomFilterFalsePositiveProbability != nil {
+		m["bloom_filter_false_positive_probability"] = aws.Float64Value(osd.BloomFilterFalsePositiveProbability)
 	}
 
-	if v, ok := d.GetOk("kinesis_source_configuration"); ok {
-		sourceConfig := createSourceConfig(v.([]interface{})[0].(map[string]interface{}))
-		input.KinesisStreamSourceConfiguration = sourceConfig
-		input.DeliveryStreamType = aws.String(firehose.DeliveryStreamTypeKinesisStreamAsSource)
-	} else {
-		input.DeliveryStreamType = aws.String(firehose.DeliveryStreamTypeDirectPut)
+	m["compression"] = firehose.OrcCompressionSnappy
+	if osd.Compression != nil {
+		m["compression"] = aws.StringValue(osd.Compression)
 	}
 
-	if d.Get("destination").(string) == destinationTypeExtendedS3 {
-		extendedS3Config := createExtendedS3Config(d)
-		input.ExtendedS3DestinationConfiguration = extendedS3Config
-	} else {
-		if d.Get("destination").(string) == destinationTypeElasticsearch {
-			esConfig, err := createElasticsearchConfig(d)
-			if err != nil {
-				return sdkdiag.AppendErrorf(diags, "creating Kinesis Firehose Delivery Stream (%s): %s", sn, err)
-			}
-			input.ElasticsearchDestinationConfiguration = esConfig
-		} else if d.Get("destination").(string) == destinationTypeOpensearch {
-			osConfig, err := createOpensearchConfig(d)
-			if err != nil {
-				return sdkdiag.AppendErrorf(diags, "creating Kinesis Firehose Delivery Stream (%s): %s", sn, err)
-			}
-			input.AmazonopensearchserviceDestinationConfiguration = osConfig
-		} else if d.Get("destination").(string) == destinationTypeRedshift {
-			rc, err := createRedshiftConfig(d)
-			if err != nil {
-				return sdkdiag.AppendErrorf(diags, "creating Kinesis Firehose Delivery Stream (%s): %s", sn, err)
-			}
-			input.RedshiftDestinationConfiguration = rc
-		} else if d.Get("destination").(string) == destinationTypeSplunk {
-			spConfig, err := createSplunkConfig(d)
-			if err != nil {
-				return sdkdiag.AppendErrorf(diags, "creating Kinesis Firehose Delivery Stream (%s): %s", sn, err)
-			}
-			input.SplunkDestinationConfiguration = spConfig
-		} else if d.Get("destination").(string) == destinationTypeHTTPEndpoint {
-			httpConfig, err := createHTTPEndpointConfig(d)
-			if err != nil {
-				return sdkdiag.AppendErrorf(diags, "creating Kinesis Firehose Delivery Stream (%s): %s", sn, err)
-			}
-			input.HttpEndpointDestinationConfiguration = httpConfig
-		}
+	m["format_version"] = firehose.OrcFormatVersionV012
+	if osd.FormatVersion != nil {
+		m["format_version"] = aws.StringValue(osd.FormatVersion)
 	}
 
-	err := retry.RetryContext(ctx, propagationTimeout, func() *retry.RetryError {
-		_, err := conn.CreateDeliveryStreamWithContext(ctx, input)
-		if err != nil {
-			// Access was denied when calling Glue. Please ensure that the role specified in the data format conversion configuration has the necessary permissions.
-			if tfawserr.ErrMessageContains(err, firehose.ErrCodeInvalidArgumentException, "Access was denied") {
-				return retry.RetryableError(err)
-			}
-
-			if tfawserr.ErrMessageContains(err, firehose.ErrCodeInvalidArgumentException, "is not authorized to") {
-				return retry.RetryableError(err)
-			}
-
-			if tfawserr.ErrMessageContains(err, firehose.ErrCodeInvalidArgumentException, "Please make sure the role specified in VpcConfiguration has permissions") {
-				return retry.RetryableError(err)
-			}
-
-			// InvalidArgumentException: Verify that the IAM role has access to the Elasticsearch domain.
-			if tfawserr.ErrMessageContains(err, firehose.ErrCodeInvalidArgumentException, "Verify that the IAM role has access") {
-				return retry.RetryableError(err)
-			}
-
-			if tfawserr.ErrMessageContains(err, firehose.ErrCodeInvalidArgumentException, "Firehose is unable to assume role") {
-				return retry.RetryableError(err)
-			}
-
-			return retry.NonRetryableError(err)
-		}
+	m["padding_tolerance"] = 0.05
+	if osd.PaddingTolerance != nil {
+		m["padding_tolerance"] = aws.Float64Value(osd.PaddingTolerance)
+	}
 
-		return nil
-	})
-	if tfresource.TimedOut(err) {
-		_, err = conn.CreateDeliveryStreamWithContext(ctx, input)
+	m["row_index_stride"] = 10000
+	if osd.RowIndexStride != nil {
+		m["row_index_stride"] = int(aws.Int64Value(osd.RowIndexStride))
 	}
-	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "creating Kinesis Firehose Delivery Stream (%s): %s", sn, err)
+
+	m["stripe_size_bytes"] = 67108864
+	if osd.StripeSizeBytes != nil {
+		m["stripe_size_bytes"] = int(aws.Int64Value(osd.StripeSizeBytes))
 	}
 
-	s, err := waitDeliveryStreamCreated(ctx, conn, sn, d.Timeout(schema.TimeoutCreate))
+	return []map[string]interface{}{m}
+}
+
+func flattenParquetSerDe(psd *firehose.ParquetSerDe) []map[string]interface{} {
+	if psd == nil {
+		return []map[string]interface{}{}
+	}
 
-	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "creating Kinesis Firehose Delivery Stream (%s): waiting for completion: %s", sn, err)
+	m := map[string]interface{}{
+		"enable_dictionary_compression": aws.BoolValue(psd.EnableDictionaryCompression),
+		"max_padding_bytes":             int(aws.Int64Value(psd.MaxPaddingBytes)),
 	}
 
-	d.SetId(aws.StringValue(s.DeliveryStreamARN))
-	d.Set("arn", s.DeliveryStreamARN)
+	// API omits default values
+	// Return defaults that are not type zero values to prevent extraneous difference
 
-	if v, ok := d.GetOk("server_side_encryption"); ok && !isDeliveryStreamOptionDisabled(v) {
-		startInput := &firehose.StartDeliveryStreamEncryptionInput{
-			DeliveryStreamName:                         aws.String(sn),
-			DeliveryStreamEncryptionConfigurationInput: expandDeliveryStreamEncryptionConfigurationInput(v.([]interface{})),
-		}
+	m["block_size_bytes"] = 268435456
+	if psd.BlockSizeBytes != nil {
+		m["block_size_bytes"] = int(aws.Int64Value(psd.BlockSizeBytes))
+	}
 
-		_, err := conn.StartDeliveryStreamEncryptionWithContext(ctx, startInput)
+	m["compression"] = firehose.ParquetCompressionSnappy
+	if psd.Compression != nil {
+		m["compression"] = aws.StringValue(psd.Compression)
+	}
 
-		if err != nil {
-			return sdkdiag.AppendErrorf(diags, "starting Kinesis Firehose Delivery Stream (%s) encryption: %s", sn, err)
-		}
+	m["page_size_bytes"] = 1048576
+	if psd.PageSizeBytes != nil {
+		m["page_size_bytes"] = int(aws.Int64Value(psd.PageSizeBytes))
+	}
 
-		if _, err := waitDeliveryStreamEncryptionEnabled(ctx, conn, sn, d.Timeout(schema.TimeoutCreate)); err != nil {
-			return sdkdiag.AppendErrorf(diags, "waiting for Kinesis Firehose Delivery Stream (%s) encryption enable: %s", sn, err)
-		}
+	m["writer_version"] = firehose.ParquetWriterVersionV1
+	if psd.WriterVersion != nil {
+		m["writer_version"] = aws.StringValue(psd.WriterVersion)
 	}
 
-	return append(diags, resourceDeliveryStreamRead(ctx, d, meta)...)
+	return []map[string]interface{}{m}
 }
 
-func validateSchema(d *schema.ResourceData) error {
-	_, extendedS3Exists := d.GetOk("extended_s3_configuration")
+func flattenSchemaConfiguration(sc *firehose.SchemaConfiguration) []map[string]interface{} {
+	if sc == nil {
+		return []map[string]interface{}{}
+	}
 
-	if d.Get("destination").(string) == destinationTypeExtendedS3 {
-		if !extendedS3Exists {
-			return fmt.Errorf(
-				"when destination is 'extended_s3', extended_s3_configuration is required",
-			)
-		}
+	m := map[string]interface{}{
+		"catalog_id":    aws.StringValue(sc.CatalogId),
+		"database_name": aws.StringValue(sc.DatabaseName),
+		"region":        aws.StringValue(sc.Region),
+		"role_arn":      aws.StringValue(sc.RoleARN),
+		"table_name":    aws.StringValue(sc.TableName),
+		"version_id":    aws.StringValue(sc.VersionId),
 	}
 
-	return nil
+	return []map[string]interface{}{m}
 }
 
-func resourceDeliveryStreamUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	var diags diag.Diagnostics
+func flattenHTTPEndpointRequestConfiguration(rc *firehose.HttpEndpointRequestConfiguration) []map[string]interface{} {
+	if rc == nil {
+		return []map[string]interface{}{}
+	}
 
-	sn := d.Get("name").(string)
+	requestConfiguration := make([]map[string]interface{}, 1)
+
+	commonAttributes := make([]interface{}, 0)
+	for _, params := range rc.CommonAttributes {
+		name := aws.StringValue(params.AttributeName)
+		value := aws.StringValue(params.AttributeValue)
 
-	if err := validateSchema(d); err != nil {
-		return sdkdiag.AppendErrorf(diags, "updating Kinesis Firehose Delivery Stream (%s): %s", sn, err)
+		commonAttributes = append(commonAttributes, map[string]interface{}{
+			"name":  name,
+			"value": value,
+		})
 	}
 
-	conn := meta.(*conns.AWSClient).FirehoseConn(ctx)
+	requestConfiguration[0] = map[string]interface{}{
+		"common_attributes": commonAttributes,
+		"content_encoding":  aws.StringValue(rc.ContentEncoding),
+	}
 
-	if d.HasChangesExcept("tags", "tags_all") {
-		updateInput := &firehose.UpdateDestinationInput{
-			DeliveryStreamName:             aws.String(sn),
-			CurrentDeliveryStreamVersionId: aws.String(d.Get("version_id").(string)),
-			DestinationId:                  aws.String(d.Get("destination_id").(string)),
-		}
+	return requestConfiguration
+}
 
-		if d.Get("destination").(string) == destinationTypeExtendedS3 {
-			extendedS3Config := updateExtendedS3Config(d)
-			updateInput.ExtendedS3DestinationUpdate = extendedS3Config
-		} else {
-			if d.Get("destination").(string) == destinationTypeElasticsearch {
-				esUpdate, err := updateElasticsearchConfig(d)
-				if err != nil {
-					return sdkdiag.AppendErrorf(diags, "updating Kinesis Firehose Delivery Stream (%s): %s", sn, err)
-				}
-				updateInput.ElasticsearchDestinationUpdate = esUpdate
-			} else if d.Get("destination").(string) == destinationTypeOpensearch {
-				esUpdate, err := updateOpensearchConfig(d)
-				if err != nil {
-					return sdkdiag.AppendErrorf(diags, "updating Kinesis Firehose Delivery Stream (%s): %s", sn, err)
-				}
-				updateInput.AmazonopensearchserviceDestinationUpdate = esUpdate
-			} else if d.Get("destination").(string) == destinationTypeRedshift {
-				rc, err := updateRedshiftConfig(d)
-				if err != nil {
-					return sdkdiag.AppendErrorf(diags, "updating Kinesis Firehose Delivery Stream (%s): %s", sn, err)
-				}
-				updateInput.RedshiftDestinationUpdate = rc
-			} else if d.Get("destination").(string) == destinationTypeSplunk {
-				rc, err := updateSplunkConfig(d)
-				if err != nil {
-					return sdkdiag.AppendErrorf(diags, "updating Kinesis Firehose Delivery Stream (%s): %s", sn, err)
-				}
-				updateInput.SplunkDestinationUpdate = rc
-			} else if d.Get("destination").(string) == destinationTypeHTTPEndpoint {
-				rc, err := updateHTTPEndpointConfig(d)
-				if err != nil {
-					return sdkdiag.AppendErrorf(diags, "updating Kinesis Firehose Delivery Stream (%s): %s", sn, err)
-				}
-				updateInput.HttpEndpointDestinationUpdate = rc
-			}
-		}
+func flattenProcessingConfiguration(pc *firehose.ProcessingConfiguration, roleArn string) []map[string]interface{} {
+	if pc == nil {
+		return []map[string]interface{}{}
+	}
 
-		err := retry.RetryContext(ctx, propagationTimeout, func() *retry.RetryError {
-			_, err := conn.UpdateDestinationWithContext(ctx, updateInput)
-			if err != nil {
-				// Access was denied when calling Glue. Please ensure that the role specified in the data format conversion configuration has the necessary permissions.
-				if tfawserr.ErrMessageContains(err, firehose.ErrCodeInvalidArgumentException, "Access was denied") {
-					return retry.RetryableError(err)
-				}
+	processingConfiguration := make([]map[string]interface{}, 1)
 
-				if tfawserr.ErrMessageContains(err, firehose.ErrCodeInvalidArgumentException, "is not authorized to") {
-					return retry.RetryableError(err)
-				}
+	// It is necessary to explicitly filter this out
+	// to prevent diffs during routine use and retain the ability
+	// to show diffs if any field has drifted
+	defaultLambdaParams := map[string]string{
+		"NumberOfRetries":         "3",
+		"RoleArn":                 roleArn,
+		"BufferSizeInMBs":         "3",
+		"BufferIntervalInSeconds": "60",
+	}
 
-				if tfawserr.ErrMessageContains(err, firehose.ErrCodeInvalidArgumentException, "Please make sure the role specified in VpcConfiguration has permissions") {
-					return retry.RetryableError(err)
-				}
+	processors := make([]interface{}, len(pc.Processors))
+	for i, p := range pc.Processors {
+		t := aws.StringValue(p.Type)
+		parameters := make([]interface{}, 0)
 
-				// InvalidArgumentException: Verify that the IAM role has access to the Elasticsearch domain.
-				if tfawserr.ErrMessageContains(err, firehose.ErrCodeInvalidArgumentException, "Verify that the IAM role has access") {
-					return retry.RetryableError(err)
-				}
+		for _, params := range p.Parameters {
+			name := aws.StringValue(params.ParameterName)
+			value := aws.StringValue(params.ParameterValue)
 
-				if tfawserr.ErrMessageContains(err, firehose.ErrCodeInvalidArgumentException, "Firehose is unable to assume role") {
-					return retry.RetryableError(err)
+			if t == firehose.ProcessorTypeLambda {
+				// Ignore defaults
+				if v, ok := defaultLambdaParams[name]; ok && v == value {
+					continue
 				}
-
-				return retry.NonRetryableError(err)
 			}
 
-			return nil
-		})
-
-		if tfresource.TimedOut(err) {
-			_, err = conn.UpdateDestinationWithContext(ctx, updateInput)
+			parameters = append(parameters, map[string]interface{}{
+				"parameter_name":  name,
+				"parameter_value": value,
+			})
 		}
 
-		if err != nil {
-			return sdkdiag.AppendErrorf(diags, "updating Kinesis Firehose Delivery Stream (%s): %s", sn, err)
+		processors[i] = map[string]interface{}{
+			"type":       t,
+			"parameters": parameters,
 		}
 	}
+	processingConfiguration[0] = map[string]interface{}{
+		"enabled":    aws.BoolValue(pc.Enabled),
+		"processors": processors,
+	}
+	return processingConfiguration
+}
 
-	if d.HasChange("server_side_encryption") {
-		_, n := d.GetChange("server_side_encryption")
-		if isDeliveryStreamOptionDisabled(n) {
-			_, err := conn.StopDeliveryStreamEncryptionWithContext(ctx, &firehose.StopDeliveryStreamEncryptionInput{
-				DeliveryStreamName: aws.String(sn),
-			})
-
-			if err != nil {
-				return sdkdiag.AppendErrorf(diags, "stopping Kinesis Firehose Delivery Stream (%s) encryption: %s", sn, err)
-			}
-
-			if _, err := waitDeliveryStreamEncryptionDisabled(ctx, conn, sn, d.Timeout(schema.TimeoutUpdate)); err != nil {
-				return sdkdiag.AppendErrorf(diags, "waiting for Kinesis Firehose Delivery Stream (%s) encryption disable: %s", sn, err)
-			}
-		} else {
-			startInput := &firehose.StartDeliveryStreamEncryptionInput{
-				DeliveryStreamName:                         aws.String(sn),
-				DeliveryStreamEncryptionConfigurationInput: expandDeliveryStreamEncryptionConfigurationInput(n.([]interface{})),
-			}
+func flattenDynamicPartitioningConfiguration(dpc *firehose.DynamicPartitioningConfiguration) []map[string]interface{} {
+	if dpc == nil {
+		return []map[string]interface{}{}
+	}
 
-			_, err := conn.StartDeliveryStreamEncryptionWithContext(ctx, startInput)
+	dynamicPartitioningConfiguration := make([]map[string]interface{}, 1)
 
-			if err != nil {
-				return sdkdiag.AppendErrorf(diags, "starting Kinesis Firehose Delivery Stream (%s) encryption: %s", sn, err)
-			}
+	dynamicPartitioningConfiguration[0] = map[string]interface{}{
+		"enabled": aws.BoolValue(dpc.Enabled),
+	}
 
-			if _, err := waitDeliveryStreamEncryptionEnabled(ctx, conn, sn, d.Timeout(schema.TimeoutUpdate)); err != nil {
-				return sdkdiag.AppendErrorf(diags, "waiting for Kinesis Firehose Delivery Stream (%s) encryption enable: %s", sn, err)
-			}
-		}
+	if dpc.RetryOptions != nil && dpc.RetryOptions.DurationInSeconds != nil {
+		dynamicPartitioningConfiguration[0]["retry_duration"] = int(aws.Int64Value(dpc.RetryOptions.DurationInSeconds))
 	}
 
-	return append(diags, resourceDeliveryStreamRead(ctx, d, meta)...)
+	return dynamicPartitioningConfiguration
 }
 
-func resourceDeliveryStreamRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).FirehoseConn(ctx)
-
-	sn := d.Get("name").(string)
-	s, err := FindDeliveryStreamByName(ctx, conn, sn)
-
-	if !d.IsNewResource() && tfresource.NotFound(err) {
-		log.Printf("[WARN] Kinesis Firehose Delivery Stream (%s) not found, removing from state", d.Id())
-		d.SetId("")
-		return diags
-	}
-
-	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "reading Kinesis Firehose Delivery Stream (%s): %s", sn, err)
+func flattenKinesisStreamSourceDescription(desc *firehose.KinesisStreamSourceDescription) []interface{} {
+	if desc == nil {
+		return []interface{}{}
 	}
 
-	if err := flattenDeliveryStream(d, s); err != nil {
-		return sdkdiag.AppendErrorf(diags, "reading Kinesis Firehose Delivery Stream (%s): %s", sn, err)
+	mDesc := map[string]interface{}{
+		"kinesis_stream_arn": aws.StringValue(desc.KinesisStreamARN),
+		"role_arn":           aws.StringValue(desc.RoleARN),
 	}
 
-	return diags
+	return []interface{}{mDesc}
 }
 
-func resourceDeliveryStreamDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).FirehoseConn(ctx)
-
-	sn := d.Get("name").(string)
-	log.Printf("[DEBUG] Deleting Kinesis Firehose Delivery Stream: (%s)", sn)
-	_, err := conn.DeleteDeliveryStreamWithContext(ctx, &firehose.DeleteDeliveryStreamInput{
-		DeliveryStreamName: aws.String(sn),
-	})
-
-	if tfawserr.ErrCodeEquals(err, firehose.ErrCodeResourceNotFoundException) {
-		return diags
+func flattenHTTPEndpointDestinationDescription(description *firehose.HttpEndpointDestinationDescription, configuredAccessKey string) []map[string]interface{} {
+	if description == nil {
+		return []map[string]interface{}{}
 	}
-
-	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "deleting Kinesis Firehose Delivery Stream (%s): %s", sn, err)
+	m := map[string]interface{}{
+		"access_key":                 configuredAccessKey,
+		"url":                        aws.StringValue(description.EndpointConfiguration.Url),
+		"name":                       aws.StringValue(description.EndpointConfiguration.Name),
+		"role_arn":                   aws.StringValue(description.RoleARN),
+		"s3_backup_mode":             aws.StringValue(description.S3BackupMode),
+		"s3_configuration":           flattenS3DestinationDescription(description.S3DestinationDescription),
+		"request_configuration":      flattenHTTPEndpointRequestConfiguration(description.RequestConfiguration),
+		"cloudwatch_logging_options": flattenCloudWatchLoggingOptions(description.CloudWatchLoggingOptions),
+		"processing_configuration":   flattenProcessingConfiguration(description.ProcessingConfiguration, aws.StringValue(description.RoleARN)),
 	}
 
-	_, err = waitDeliveryStreamDeleted(ctx, conn, sn, d.Timeout(schema.TimeoutDelete))
+	if description.RetryOptions != nil {
+		m["retry_duration"] = int(aws.Int64Value(description.RetryOptions.DurationInSeconds))
+	}
 
-	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "waiting for Kinesis Firehose Delivery Stream (%s) delete: %s", sn, err)
+	if description.BufferingHints != nil {
+		m["buffering_interval"] = int(aws.Int64Value(description.BufferingHints.IntervalInSeconds))
+		m["buffering_size"] = int(aws.Int64Value(description.BufferingHints.SizeInMBs))
 	}
 
-	return diags
+	return []map[string]interface{}{m}
 }
 
 func isDeliveryStreamOptionDisabled(v interface{}) bool {
-	options := v.([]interface{})
-	if len(options) == 0 || options[0] == nil {
+	tfList := v.([]interface{})
+	if len(tfList) == 0 || tfList[0] == nil {
 		return true
 	}
-	optionMap := options[0].(map[string]interface{})
+	tfMap := tfList[0].(map[string]interface{})
 
 	var enabled bool
 
-	if v, ok := optionMap["enabled"]; ok {
+	if v, ok := tfMap["enabled"]; ok {
 		enabled = v.(bool)
 	}
 
 	return !enabled
 }
-
-func expandDeliveryStreamEncryptionConfigurationInput(tfList []interface{}) *firehose.DeliveryStreamEncryptionConfigurationInput {
-	if len(tfList) == 0 {
-		return nil
-	}
-
-	tfMap, ok := tfList[0].(map[string]interface{})
-
-	if !ok {
-		return nil
-	}
-
-	apiObject := &firehose.DeliveryStreamEncryptionConfigurationInput{}
-
-	if v, ok := tfMap["key_arn"].(string); ok && v != "" {
-		apiObject.KeyARN = aws.String(v)
-	}
-
-	if v, ok := tfMap["key_type"].(string); ok && v != "" {
-		apiObject.KeyType = aws.String(v)
-	}
-
-	return apiObject
-}
diff --git a/internal/service/firehose/delivery_stream_data_source.go b/internal/service/firehose/delivery_stream_data_source.go
index eaf613f9e87..490705c8723 100644
--- a/internal/service/firehose/delivery_stream_data_source.go
+++ b/internal/service/firehose/delivery_stream_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package firehose
 
 import (
diff --git a/internal/service/firehose/delivery_stream_data_source_test.go b/internal/service/firehose/delivery_stream_data_source_test.go
index 9e2fa78329a..6310b1512c4 100644
--- a/internal/service/firehose/delivery_stream_data_source_test.go
+++ b/internal/service/firehose/delivery_stream_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package firehose_test
 
 import (
@@ -99,11 +102,6 @@ resource "aws_s3_bucket" "bucket" {
   bucket = %[1]q
 }
 
-resource "aws_s3_bucket_acl" "test" {
-  bucket = aws_s3_bucket.bucket.id
-  acl    = "private"
-}
-
 resource "aws_kinesis_firehose_delivery_stream" "test" {
   name        = %[1]q
   destination = "extended_s3"
diff --git a/internal/service/firehose/delivery_stream_migrate.go b/internal/service/firehose/delivery_stream_migrate.go
index a0de631a88b..049a75ff49e 100644
--- a/internal/service/firehose/delivery_stream_migrate.go
+++ b/internal/service/firehose/delivery_stream_migrate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package firehose
 
 import (
diff --git a/internal/service/firehose/delivery_stream_migrate_test.go b/internal/service/firehose/delivery_stream_migrate_test.go
index a78a448585c..bf468f4e6ce 100644
--- a/internal/service/firehose/delivery_stream_migrate_test.go
+++ b/internal/service/firehose/delivery_stream_migrate_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package firehose_test
 
 import (
diff --git a/internal/service/firehose/delivery_stream_test.go b/internal/service/firehose/delivery_stream_test.go
index 57104bf94dc..a1fedd51f0f 100644
--- a/internal/service/firehose/delivery_stream_test.go
+++ b/internal/service/firehose/delivery_stream_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package firehose_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"strings"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/firehose"
 	"github.com/aws/aws-sdk-go/service/lambda"
@@ -17,6 +20,7 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	tffirehose "github.com/hashicorp/terraform-provider-aws/internal/service/firehose"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
 func TestAccFirehoseDeliveryStream_basic(t *testing.T) {
@@ -33,9 +37,54 @@ func TestAccFirehoseDeliveryStream_basic(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config: testAccDeliveryStreamConfig_extendedS3basic(rName),
-				Check: resource.ComposeTestCheckFunc(
+				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckDeliveryStreamExists(ctx, resourceName, &stream),
-					testAccCheckDeliveryStreamAttributes(&stream, nil, nil, nil, nil, nil, nil, nil),
+					resource.TestCheckResourceAttrSet(resourceName, "arn"),
+					resource.TestCheckResourceAttr(resourceName, "destination", "extended_s3"),
+					resource.TestCheckResourceAttrSet(resourceName, "destination_id"),
+					resource.TestCheckResourceAttr(resourceName, "elasticsearch_configuration.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "extended_s3_configuration.#", "1"),
+					resource.TestCheckResourceAttrSet(resourceName, "extended_s3_configuration.0.bucket_arn"),
+					resource.TestCheckResourceAttr(resourceName, "extended_s3_configuration.0.buffering_interval", "300"),
+					resource.TestCheckResourceAttr(resourceName, "extended_s3_configuration.0.buffering_size", "5"),
+					resource.TestCheckResourceAttr(resourceName, "extended_s3_configuration.0.cloudwatch_logging_options.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "extended_s3_configuration.0.cloudwatch_logging_options.0.enabled", "false"),
+					resource.TestCheckResourceAttr(resourceName, "extended_s3_configuration.0.cloudwatch_logging_options.0.log_group_name", ""),
+					resource.TestCheckResourceAttr(resourceName, "extended_s3_configuration.0.cloudwatch_logging_options.0.log_stream_name", ""),
+					resource.TestCheckResourceAttr(resourceName, "extended_s3_configuration.0.compression_format", "UNCOMPRESSED"),
+					resource.TestCheckResourceAttr(resourceName, "extended_s3_configuration.0.data_format_conversion_configuration.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "extended_s3_configuration.0.dynamic_partitioning_configuration.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "extended_s3_configuration.0.error_output_prefix", ""),
+					resource.TestCheckResourceAttr(resourceName, "extended_s3_configuration.0.kms_key_arn", ""),
+					resource.TestCheckResourceAttr(resourceName, "extended_s3_configuration.0.prefix", ""),
+					resource.TestCheckResourceAttr(resourceName, "extended_s3_configuration.0.processing_configuration.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "extended_s3_configuration.0.processing_configuration.0.enabled", "true"),
+					resource.TestCheckResourceAttr(resourceName, "extended_s3_configuration.0.processing_configuration.0.processors.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "extended_s3_configuration.0.processing_configuration.0.processors.0.type", "Lambda"),
+					resource.TestCheckResourceAttr(resourceName, "extended_s3_configuration.0.processing_configuration.0.processors.0.parameters.#", "3"),
+					resource.TestCheckResourceAttr(resourceName, "extended_s3_configuration.0.processing_configuration.0.processors.0.parameters.0.parameter_name", "LambdaArn"),
+					resource.TestCheckResourceAttrSet(resourceName, "extended_s3_configuration.0.processing_configuration.0.processors.0.parameters.0.parameter_value"),
+					resource.TestCheckResourceAttr(resourceName, "extended_s3_configuration.0.processing_configuration.0.processors.0.parameters.1.parameter_name", "BufferSizeInMBs"),
+					resource.TestCheckResourceAttr(resourceName, "extended_s3_configuration.0.processing_configuration.0.processors.0.parameters.1.parameter_value", "1"),
+					resource.TestCheckResourceAttr(resourceName, "extended_s3_configuration.0.processing_configuration.0.processors.0.parameters.2.parameter_name", "BufferIntervalInSeconds"),
+					resource.TestCheckResourceAttr(resourceName, "extended_s3_configuration.0.processing_configuration.0.processors.0.parameters.2.parameter_value", "70"),
+					resource.TestCheckResourceAttrSet(resourceName, "extended_s3_configuration.0.role_arn"),
+					resource.TestCheckResourceAttr(resourceName, "extended_s3_configuration.0.s3_backup_configuration.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "extended_s3_configuration.0.s3_backup_mode", "Disabled"),
+					resource.TestCheckResourceAttr(resourceName, "http_endpoint_configuration.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "kinesis_source_configuration.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "msk_source_configuration.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "name", rName),
+					resource.TestCheckResourceAttr(resourceName, "opensearch_configuration.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "opensearchserverless_configuration.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "redshift_configuration.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "server_side_encryption.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "server_side_encryption.0.enabled", "false"),
+					resource.TestCheckResourceAttr(resourceName, "server_side_encryption.0.key_arn", ""),
+					resource.TestCheckResourceAttr(resourceName, "server_side_encryption.0.key_type", "AWS_OWNED_CMK"),
+					resource.TestCheckResourceAttr(resourceName, "splunk_configuration.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
+					resource.TestCheckResourceAttrSet(resourceName, "version_id"),
 				),
 			},
 			{
@@ -48,13 +97,13 @@ func TestAccFirehoseDeliveryStream_basic(t *testing.T) {
 				ResourceName:  resourceName,
 				ImportState:   true,
 				ImportStateId: "just-a-name",
-				ExpectError:   regexp.MustCompile(`Expected ID in format`),
+				ExpectError:   regexache.MustCompile(`Expected ID in format`),
 			},
 			{
 				ResourceName:  resourceName,
 				ImportState:   true,
 				ImportStateId: "arn:aws:firehose:us-east-1:123456789012:missing-slash", //lintignore:AWSAT003,AWSAT005
-				ExpectError:   regexp.MustCompile(`Expected ID in format`),
+				ExpectError:   regexache.MustCompile(`Expected ID in format`),
 			},
 		},
 	})
@@ -813,7 +862,7 @@ func TestAccFirehoseDeliveryStream_ExtendedS3_kinesisStreamSource(t *testing.T)
 		CheckDestroy:             testAccCheckDeliveryStreamDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccDeliveryStreamConfig_extendedS3Source(rName),
+				Config: testAccDeliveryStreamConfig_extendedS3KinesisSource(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDeliveryStreamExists(ctx, resourceName, &stream),
 					testAccCheckDeliveryStreamAttributes(&stream, nil, nil, nil, nil, nil, nil, nil),
@@ -828,6 +877,40 @@ func TestAccFirehoseDeliveryStream_ExtendedS3_kinesisStreamSource(t *testing.T)
 	})
 }
 
+func TestAccFirehoseDeliveryStream_ExtendedS3_mskClusterSource(t *testing.T) {
+	ctx := acctest.Context(t)
+	var stream firehose.DeliveryStreamDescription
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_kinesis_firehose_delivery_stream.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, firehose.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckDeliveryStreamDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccDeliveryStreamConfig_extendedS3MSKSource(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckDeliveryStreamExists(ctx, resourceName, &stream),
+					resource.TestCheckResourceAttr(resourceName, "kinesis_source_configuration.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "msk_source_configuration.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "msk_source_configuration.0.authentication_configuration.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "msk_source_configuration.0.authentication_configuration.0.connectivity", "PRIVATE"),
+					resource.TestCheckResourceAttrSet(resourceName, "msk_source_configuration.0.authentication_configuration.0.role_arn"),
+					resource.TestCheckResourceAttrSet(resourceName, "msk_source_configuration.0.msk_cluster_arn"),
+					resource.TestCheckResourceAttr(resourceName, "msk_source_configuration.0.topic_name", "test"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
 func TestAccFirehoseDeliveryStream_redshiftUpdates(t *testing.T) {
 	ctx := acctest.Context(t)
 	var stream firehose.DeliveryStreamDescription
@@ -1592,6 +1675,143 @@ func TestAccFirehoseDeliveryStream_Opensearch_ErrorOutputPrefix(t *testing.T) {
 	})
 }
 
+func TestAccFirehoseDeliveryStream_openSearchServerlessUpdates(t *testing.T) {
+	ctx := acctest.Context(t)
+	var stream firehose.DeliveryStreamDescription
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_kinesis_firehose_delivery_stream.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, names.OpenSearchServerlessEndpointID)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, firehose.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckDeliveryStreamDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccDeliveryStreamConfig_openSearchServerlessBasic(rName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckDeliveryStreamExists(ctx, resourceName, &stream),
+					resource.TestCheckResourceAttrSet(resourceName, "arn"),
+					resource.TestCheckResourceAttr(resourceName, "destination", "opensearchserverless"),
+					resource.TestCheckResourceAttrSet(resourceName, "destination_id"),
+					resource.TestCheckResourceAttr(resourceName, "elasticsearch_configuration.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "extended_s3_configuration.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "http_endpoint_configuration.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "kinesis_source_configuration.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "name", rName),
+					resource.TestCheckResourceAttr(resourceName, "opensearch_configuration.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "opensearchserverless_configuration.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "opensearchserverless_configuration.0.buffering_interval", "300"),
+					resource.TestCheckResourceAttr(resourceName, "opensearchserverless_configuration.0.buffering_size", "5"),
+					resource.TestCheckResourceAttr(resourceName, "opensearchserverless_configuration.0.cloudwatch_logging_options.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "opensearchserverless_configuration.0.cloudwatch_logging_options.0.enabled", "false"),
+					resource.TestCheckResourceAttr(resourceName, "opensearchserverless_configuration.0.cloudwatch_logging_options.0.log_group_name", ""),
+					resource.TestCheckResourceAttr(resourceName, "opensearchserverless_configuration.0.cloudwatch_logging_options.0.log_stream_name", ""),
+					resource.TestCheckResourceAttrSet(resourceName, "opensearchserverless_configuration.0.collection_endpoint"),
+					resource.TestCheckResourceAttr(resourceName, "opensearchserverless_configuration.0.index_name", "test"),
+					resource.TestCheckResourceAttr(resourceName, "opensearchserverless_configuration.0.processing_configuration.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "opensearchserverless_configuration.0.processing_configuration.0.enabled", "false"),
+					resource.TestCheckResourceAttr(resourceName, "opensearchserverless_configuration.0.processing_configuration.0.processors.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "opensearchserverless_configuration.0.retry_duration", "300"),
+					resource.TestCheckResourceAttrSet(resourceName, "opensearchserverless_configuration.0.role_arn"),
+					resource.TestCheckResourceAttr(resourceName, "opensearchserverless_configuration.0.s3_backup_mode", "FailedDocumentsOnly"),
+					resource.TestCheckResourceAttr(resourceName, "opensearchserverless_configuration.0.s3_configuration.#", "1"),
+					resource.TestCheckResourceAttrSet(resourceName, "opensearchserverless_configuration.0.s3_configuration.0.bucket_arn"),
+					resource.TestCheckResourceAttr(resourceName, "opensearchserverless_configuration.0.s3_configuration.0.buffering_interval", "300"),
+					resource.TestCheckResourceAttr(resourceName, "opensearchserverless_configuration.0.s3_configuration.0.buffering_size", "5"),
+					resource.TestCheckResourceAttr(resourceName, "opensearchserverless_configuration.0.s3_configuration.0.cloudwatch_logging_options.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "opensearchserverless_configuration.0.s3_configuration.0.cloudwatch_logging_options.0.enabled", "false"),
+					resource.TestCheckResourceAttr(resourceName, "opensearchserverless_configuration.0.s3_configuration.0.cloudwatch_logging_options.0.log_group_name", ""),
+					resource.TestCheckResourceAttr(resourceName, "opensearchserverless_configuration.0.s3_configuration.0.cloudwatch_logging_options.0.log_stream_name", ""),
+					resource.TestCheckResourceAttr(resourceName, "opensearchserverless_configuration.0.s3_configuration.0.compression_format", "UNCOMPRESSED"),
+					resource.TestCheckResourceAttr(resourceName, "opensearchserverless_configuration.0.s3_configuration.0.error_output_prefix", ""),
+					resource.TestCheckResourceAttr(resourceName, "opensearchserverless_configuration.0.s3_configuration.0.kms_key_arn", ""),
+					resource.TestCheckResourceAttr(resourceName, "opensearchserverless_configuration.0.s3_configuration.0.prefix", ""),
+					resource.TestCheckResourceAttrSet(resourceName, "opensearchserverless_configuration.0.s3_configuration.0.role_arn"),
+					resource.TestCheckResourceAttr(resourceName, "opensearchserverless_configuration.0.vpc_config.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "redshift_configuration.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "server_side_encryption.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "server_side_encryption.0.enabled", "false"),
+					resource.TestCheckResourceAttr(resourceName, "server_side_encryption.0.key_arn", ""),
+					resource.TestCheckResourceAttr(resourceName, "server_side_encryption.0.key_type", "AWS_OWNED_CMK"),
+					resource.TestCheckResourceAttr(resourceName, "splunk_configuration.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
+					resource.TestCheckResourceAttrSet(resourceName, "version_id"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				Config: testAccDeliveryStreamConfig_openSearchServerlessUpdate(rName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckDeliveryStreamExists(ctx, resourceName, &stream),
+					resource.TestCheckResourceAttrSet(resourceName, "arn"),
+					resource.TestCheckResourceAttr(resourceName, "destination", "opensearchserverless"),
+					resource.TestCheckResourceAttrSet(resourceName, "destination_id"),
+					resource.TestCheckResourceAttr(resourceName, "elasticsearch_configuration.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "extended_s3_configuration.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "http_endpoint_configuration.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "kinesis_source_configuration.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "msk_source_configuration.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "name", rName),
+					resource.TestCheckResourceAttr(resourceName, "opensearch_configuration.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "opensearchserverless_configuration.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "opensearchserverless_configuration.0.buffering_interval", "500"),
+					resource.TestCheckResourceAttr(resourceName, "opensearchserverless_configuration.0.buffering_size", "10"),
+					resource.TestCheckResourceAttr(resourceName, "opensearchserverless_configuration.0.cloudwatch_logging_options.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "opensearchserverless_configuration.0.cloudwatch_logging_options.0.enabled", "false"),
+					resource.TestCheckResourceAttr(resourceName, "opensearchserverless_configuration.0.cloudwatch_logging_options.0.log_group_name", ""),
+					resource.TestCheckResourceAttr(resourceName, "opensearchserverless_configuration.0.cloudwatch_logging_options.0.log_stream_name", ""),
+					resource.TestCheckResourceAttrSet(resourceName, "opensearchserverless_configuration.0.collection_endpoint"),
+					resource.TestCheckResourceAttr(resourceName, "opensearchserverless_configuration.0.index_name", "test"),
+					resource.TestCheckResourceAttr(resourceName, "opensearchserverless_configuration.0.processing_configuration.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "opensearchserverless_configuration.0.processing_configuration.0.enabled", "false"),
+					resource.TestCheckResourceAttr(resourceName, "opensearchserverless_configuration.0.processing_configuration.0.processors.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "opensearchserverless_configuration.0.processing_configuration.0.processors.0.type", "Lambda"),
+					resource.TestCheckResourceAttr(resourceName, "opensearchserverless_configuration.0.processing_configuration.0.processors.0.parameters.#", "3"),
+					resource.TestCheckResourceAttr(resourceName, "opensearchserverless_configuration.0.processing_configuration.0.processors.0.parameters.0.parameter_name", "LambdaArn"),
+					resource.TestCheckResourceAttrSet(resourceName, "opensearchserverless_configuration.0.processing_configuration.0.processors.0.parameters.0.parameter_value"),
+					resource.TestCheckResourceAttr(resourceName, "opensearchserverless_configuration.0.processing_configuration.0.processors.0.parameters.1.parameter_name", "BufferSizeInMBs"),
+					resource.TestCheckResourceAttr(resourceName, "opensearchserverless_configuration.0.processing_configuration.0.processors.0.parameters.1.parameter_value", "1"),
+					resource.TestCheckResourceAttr(resourceName, "opensearchserverless_configuration.0.processing_configuration.0.processors.0.parameters.2.parameter_name", "BufferIntervalInSeconds"),
+					resource.TestCheckResourceAttr(resourceName, "opensearchserverless_configuration.0.processing_configuration.0.processors.0.parameters.2.parameter_value", "70"),
+					resource.TestCheckResourceAttr(resourceName, "opensearchserverless_configuration.0.retry_duration", "300"),
+					resource.TestCheckResourceAttrSet(resourceName, "opensearchserverless_configuration.0.role_arn"),
+					resource.TestCheckResourceAttr(resourceName, "opensearchserverless_configuration.0.s3_backup_mode", "FailedDocumentsOnly"),
+					resource.TestCheckResourceAttr(resourceName, "opensearchserverless_configuration.0.s3_configuration.#", "1"),
+					resource.TestCheckResourceAttrSet(resourceName, "opensearchserverless_configuration.0.s3_configuration.0.bucket_arn"),
+					resource.TestCheckResourceAttr(resourceName, "opensearchserverless_configuration.0.s3_configuration.0.buffering_interval", "300"),
+					resource.TestCheckResourceAttr(resourceName, "opensearchserverless_configuration.0.s3_configuration.0.buffering_size", "5"),
+					resource.TestCheckResourceAttr(resourceName, "opensearchserverless_configuration.0.s3_configuration.0.cloudwatch_logging_options.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "opensearchserverless_configuration.0.s3_configuration.0.cloudwatch_logging_options.0.enabled", "false"),
+					resource.TestCheckResourceAttr(resourceName, "opensearchserverless_configuration.0.s3_configuration.0.cloudwatch_logging_options.0.log_group_name", ""),
+					resource.TestCheckResourceAttr(resourceName, "opensearchserverless_configuration.0.s3_configuration.0.cloudwatch_logging_options.0.log_stream_name", ""),
+					resource.TestCheckResourceAttr(resourceName, "opensearchserverless_configuration.0.s3_configuration.0.compression_format", "UNCOMPRESSED"),
+					resource.TestCheckResourceAttr(resourceName, "opensearchserverless_configuration.0.s3_configuration.0.error_output_prefix", ""),
+					resource.TestCheckResourceAttr(resourceName, "opensearchserverless_configuration.0.s3_configuration.0.kms_key_arn", ""),
+					resource.TestCheckResourceAttr(resourceName, "opensearchserverless_configuration.0.s3_configuration.0.prefix", ""),
+					resource.TestCheckResourceAttrSet(resourceName, "opensearchserverless_configuration.0.s3_configuration.0.role_arn"),
+					resource.TestCheckResourceAttr(resourceName, "opensearchserverless_configuration.0.vpc_config.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "redshift_configuration.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "server_side_encryption.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "server_side_encryption.0.enabled", "false"),
+					resource.TestCheckResourceAttr(resourceName, "server_side_encryption.0.key_arn", ""),
+					resource.TestCheckResourceAttr(resourceName, "server_side_encryption.0.key_type", "AWS_OWNED_CMK"),
+					resource.TestCheckResourceAttr(resourceName, "splunk_configuration.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
+					resource.TestCheckResourceAttrSet(resourceName, "version_id"),
+				),
+			},
+		},
+	})
+}
+
 // Regression test for https://github.com/hashicorp/terraform-provider-aws/issues/1657
 func TestAccFirehoseDeliveryStream_missingProcessing(t *testing.T) {
 	ctx := acctest.Context(t)
@@ -1901,8 +2121,8 @@ func testAccCheckLambdaFunctionDestroy(ctx context.Context) resource.TestCheckFu
 func testAccDeliveryStreamConfig_base(rName string) string {
 	return fmt.Sprintf(`
 data "aws_caller_identity" "current" {}
-
 data "aws_partition" "current" {}
+data "aws_region" "current" {}
 
 resource "aws_iam_role" "firehose" {
   name = %[1]q
@@ -2106,10 +2326,121 @@ EOF
 `, rName)
 }
 
+func testAccDeliveryStreamConfig_baseMSKClusterSource(rName string) string {
+	return acctest.ConfigCompose(acctest.ConfigAvailableAZsNoOptIn(), fmt.Sprintf(`
+resource "aws_vpc" "test" {
+  cidr_block = "10.0.0.0/16"
+
+  enable_dns_hostnames = true
+
+  tags = {
+    Name = %[1]q
+  }
+}
+
+resource "aws_subnet" "test" {
+  count = 2
+
+  vpc_id            = aws_vpc.test.id
+  availability_zone = data.aws_availability_zones.available.names[count.index]
+  cidr_block        = cidrsubnet(aws_vpc.test.cidr_block, 8, count.index)
+
+  tags = {
+    Name = %[1]q
+  }
+}
+
+resource "aws_msk_serverless_cluster" "test" {
+  cluster_name = %[1]q
+
+  client_authentication {
+    sasl {
+      iam {
+        enabled = true
+      }
+    }
+  }
+
+  vpc_config {
+    subnet_ids = aws_subnet.test[*].id
+  }
+}
+
+resource "aws_msk_cluster_policy" "test" {
+  cluster_arn = aws_msk_serverless_cluster.test.arn
+
+  policy = jsonencode({
+    Version = "2012-10-17",
+    Statement = [{
+      Sid    = "testMskClusterPolicy"
+      Effect = "Allow"
+      Principal = {
+        "Service" = "firehose.amazonaws.com"
+      }
+      Action = [
+        "kafka:CreateVpcConnection",
+      ]
+      Resource = aws_msk_serverless_cluster.test.arn
+    }]
+  })
+}
+
+resource "aws_iam_role" "msk_source" {
+  name = "%[1]s-cluster"
+
+  assume_role_policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Sid": "",
+      "Effect": "Allow",
+      "Principal": {
+        "Service": "firehose.amazonaws.com"
+      },
+      "Action": "sts:AssumeRole",
+      "Condition": {
+        "StringEquals": {
+          "sts:ExternalId": "${data.aws_caller_identity.current.account_id}"
+        }
+      }
+    }
+  ]
+}
+EOF
+}
+
+resource "aws_iam_role_policy" "msk_source" {
+  name = "%[1]s-cluster"
+  role = aws_iam_role.msk_source.id
+
+  policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Sid": "",
+      "Effect": "Allow",
+      "Action": [
+        "kafka:GetBootstrapBrokers",
+        "kafka:DescribeCluster",
+        "kafka:DescribeClusterV2",
+        "kafka-cluster:Connect"
+      ],
+      "Resource": [
+        "${aws_msk_serverless_cluster.test.arn}"
+      ]
+    }
+  ]
+}
+EOF
+}
+`, rName))
+}
+
 func testAccDeliveryStreamConfig_s3CloudWatchLogging(rName string) string {
 	return fmt.Sprintf(`
 data "aws_caller_identity" "current" {}
-
 data "aws_partition" "current" {}
 
 resource "aws_iam_role" "firehose" {
@@ -2287,7 +2618,7 @@ resource "aws_kinesis_firehose_delivery_stream" "test" {
 `, rName))
 }
 
-func testAccDeliveryStreamConfig_extendedS3Source(rName string) string {
+func testAccDeliveryStreamConfig_extendedS3KinesisSource(rName string) string {
 	return acctest.ConfigCompose(
 		testAccDeliveryStreamConfig_base(rName),
 		testAccDeliveryStreamConfig_baseKinesisStreamSource(rName),
@@ -2311,6 +2642,35 @@ resource "aws_kinesis_firehose_delivery_stream" "test" {
 `, rName))
 }
 
+func testAccDeliveryStreamConfig_extendedS3MSKSource(rName string) string {
+	return acctest.ConfigCompose(
+		testAccDeliveryStreamConfig_base(rName),
+		testAccDeliveryStreamConfig_baseMSKClusterSource(rName),
+		fmt.Sprintf(`
+resource "aws_kinesis_firehose_delivery_stream" "test" {
+  depends_on = [aws_iam_role_policy.firehose, aws_iam_role_policy.msk_source, aws_msk_cluster_policy.test]
+  name       = %[1]q
+
+  msk_source_configuration {
+    authentication_configuration {
+      connectivity = "PRIVATE"
+      role_arn     = aws_iam_role.msk_source.arn
+    }
+
+    msk_cluster_arn = aws_msk_serverless_cluster.test.arn
+    topic_name      = "test"
+  }
+
+  destination = "extended_s3"
+
+  extended_s3_configuration {
+    role_arn   = aws_iam_role.firehose.arn
+    bucket_arn = aws_s3_bucket.bucket.arn
+  }
+}
+`, rName))
+}
+
 func testAccDeliveryStreamConfig_extendedS3DataFormatConversionConfigurationEnabled(rName string, enabled bool) string {
 	return acctest.ConfigCompose(testAccDeliveryStreamConfig_base(rName), fmt.Sprintf(`
 resource "aws_glue_catalog_database" "test" {
@@ -3935,6 +4295,120 @@ resource "aws_kinesis_firehose_delivery_stream" "test" {
 }`, rName))
 }
 
+func testAccDeliveryStreamConfig_baseOpenSearchServerless(rName string) string {
+	return acctest.ConfigCompose(testAccDeliveryStreamConfig_base(rName), fmt.Sprintf(`
+resource "aws_opensearchserverless_security_policy" "test" {
+  name = %[1]q
+  type = "encryption"
+  policy = jsonencode({
+    "Rules" = [
+      {
+        "Resource" = [
+          "collection/%[1]s"
+        ],
+        "ResourceType" = "collection"
+      }
+    ],
+    "AWSOwnedKey" = true
+  })
+}
+
+resource "aws_opensearchserverless_collection" "test" {
+  name = %[1]q
+
+  depends_on = [aws_opensearchserverless_security_policy.test]
+}
+
+resource "aws_iam_role_policy" "firehose-aoss" {
+  name   = "%[1]s-aoss"
+  role   = aws_iam_role.firehose.id
+  policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Action": [
+        "aoss:*"
+      ],
+      "Resource": [
+        "${aws_opensearchserverless_collection.test.arn}"
+      ]
+    }
+  ]
+}
+EOF
+}
+`, rName))
+}
+
+func testAccDeliveryStreamConfig_openSearchServerlessBasic(rName string) string {
+	return acctest.ConfigCompose(testAccDeliveryStreamConfig_baseOpenSearchServerless(rName), fmt.Sprintf(`
+resource "aws_kinesis_firehose_delivery_stream" "test" {
+  depends_on = [aws_iam_role_policy.firehose-aoss]
+
+  name        = %[1]q
+  destination = "opensearchserverless"
+
+  opensearchserverless_configuration {
+    collection_endpoint = aws_opensearchserverless_collection.test.collection_endpoint
+    role_arn            = aws_iam_role.firehose.arn
+    index_name          = "test"
+
+    s3_configuration {
+      role_arn   = aws_iam_role.firehose.arn
+      bucket_arn = aws_s3_bucket.bucket.arn
+    }
+  }
+}
+`, rName))
+}
+
+func testAccDeliveryStreamConfig_openSearchServerlessUpdate(rName string) string {
+	return acctest.ConfigCompose(testAccDeliveryStreamConfig_baseOpenSearchServerless(rName), testAccDeliveryStreamConfig_baseLambda(rName), fmt.Sprintf(`
+resource "aws_kinesis_firehose_delivery_stream" "test" {
+  depends_on = [aws_iam_role_policy.firehose-aoss]
+
+  name        = %[1]q
+  destination = "opensearchserverless"
+
+  opensearchserverless_configuration {
+    collection_endpoint = aws_opensearchserverless_collection.test.collection_endpoint
+    role_arn            = aws_iam_role.firehose.arn
+    index_name          = "test"
+    buffering_interval  = 500
+    buffering_size      = 10
+
+    s3_configuration {
+      role_arn   = aws_iam_role.firehose.arn
+      bucket_arn = aws_s3_bucket.bucket.arn
+    }
+
+    processing_configuration {
+      enabled = false
+
+      processors {
+        type = "Lambda"
+
+        parameters {
+          parameter_name  = "LambdaArn"
+          parameter_value = "${aws_lambda_function.lambda_function_test.arn}:$LATEST"
+        }
+        parameters {
+          parameter_name  = "BufferSizeInMBs"
+          parameter_value = "1"
+        }
+        parameters {
+          parameter_name  = "BufferIntervalInSeconds"
+          parameter_value = "70"
+        }
+      }
+    }
+  }
+}
+`, rName))
+}
+
 func testAccDeliveryStreamConfig_missingProcessingConfiguration(rName string) string {
 	return fmt.Sprintf(`
 data "aws_partition" "current" {}
diff --git a/internal/service/firehose/find.go b/internal/service/firehose/find.go
index 934d616645a..08fdad4747f 100644
--- a/internal/service/firehose/find.go
+++ b/internal/service/firehose/find.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package firehose
 
 import (
diff --git a/internal/service/firehose/generate.go b/internal/service/firehose/generate.go
index 043ad9b6fee..51d3a4c78ab 100644
--- a/internal/service/firehose/generate.go
+++ b/internal/service/firehose/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTags -ListTagsOp=ListTagsForDeliveryStream -ListTagsInIDElem=DeliveryStreamName -ServiceTagsSlice -TagOp=TagDeliveryStream -TagInIDElem=DeliveryStreamName -UntagOp=UntagDeliveryStream -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/firehose/list_pages.go b/internal/service/firehose/list_pages.go
index 22167ae35f4..77d13ff106f 100644
--- a/internal/service/firehose/list_pages.go
+++ b/internal/service/firehose/list_pages.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package firehose
 
 import (
@@ -9,7 +12,7 @@ import (
 
 // Custom Kinesis Firehose service lister functions using the same format as generated code.
 
-func listDeliveryStreamsPages(ctx context.Context, conn *firehose.Firehose, input *firehose.ListDeliveryStreamsInput, fn func(*firehose.ListDeliveryStreamsOutput, bool) bool) error { //nolint:unused // This function is called from a sweeper.
+func listDeliveryStreamsPages(ctx context.Context, conn *firehose.Firehose, input *firehose.ListDeliveryStreamsInput, fn func(*firehose.ListDeliveryStreamsOutput, bool) bool) error {
 	for {
 		output, err := conn.ListDeliveryStreamsWithContext(ctx, input)
 		if err != nil {
diff --git a/internal/service/firehose/service_package_gen.go b/internal/service/firehose/service_package_gen.go
index 977486bba2a..2453db4b3d6 100644
--- a/internal/service/firehose/service_package_gen.go
+++ b/internal/service/firehose/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	firehose_sdkv1 "github.com/aws/aws-sdk-go/service/firehose"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -55,4 +56,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*f
 	return firehose_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/firehose/status.go b/internal/service/firehose/status.go
index 7e18648e331..77f584abc57 100644
--- a/internal/service/firehose/status.go
+++ b/internal/service/firehose/status.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package firehose
 
 import (
diff --git a/internal/service/firehose/sweep.go b/internal/service/firehose/sweep.go
index c11ebfecef4..63c10039464 100644
--- a/internal/service/firehose/sweep.go
+++ b/internal/service/firehose/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package firehose
 
@@ -12,9 +12,10 @@ import (
 	"github.com/aws/aws-sdk-go/service/firehose"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_kinesis_firehose_delivery_stream", &resource.Sweeper{
 		Name: "aws_kinesis_firehose_delivery_stream",
 		F:    sweepDeliveryStreams,
@@ -23,7 +24,7 @@ func init() {
 
 func sweepDeliveryStreams(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -56,7 +57,7 @@ func sweepDeliveryStreams(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Kinesis Firehose Delivery Stream sweep for %s: %s", region, err)
 		return nil
 	}
@@ -65,7 +66,7 @@ func sweepDeliveryStreams(region string) error {
 		return fmt.Errorf("error listing Kinesis Firehose Delivery Streams (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping Kinesis Firehose Delivery Streams (%s): %w", region, err)
diff --git a/internal/service/firehose/tags_gen.go b/internal/service/firehose/tags_gen.go
index f57525f2d84..d16d6f61de8 100644
--- a/internal/service/firehose/tags_gen.go
+++ b/internal/service/firehose/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/firehose"
 	"github.com/aws/aws-sdk-go/service/firehose/firehoseiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -102,6 +104,8 @@ func updateTags(ctx context.Context, conn firehoseiface.FirehoseAPI, identifier
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.Firehose)
 	if len(removedTags) > 0 {
diff --git a/internal/service/firehose/wait.go b/internal/service/firehose/wait.go
index aea82d251fa..6b99127077b 100644
--- a/internal/service/firehose/wait.go
+++ b/internal/service/firehose/wait.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package firehose
 
 import (
diff --git a/internal/service/fis/experiment_template.go b/internal/service/fis/experiment_template.go
index 3735ee8ef01..fed343de23c 100644
--- a/internal/service/fis/experiment_template.go
+++ b/internal/service/fis/experiment_template.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package fis
 
 import (
 	"context"
 	"errors"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/fis"
 	"github.com/aws/aws-sdk-go-v2/service/fis/types"
@@ -59,7 +62,7 @@ func ResourceExperimentTemplate() *schema.Resource {
 							Required: true,
 							ValidateFunc: validation.All(
 								validation.StringLenBetween(0, 128),
-								validation.StringMatch(regexp.MustCompile(`^aws:[a-z0-9-]+:[a-zA-Z0-9/-]+$`), "must be in the format of aws:service-name:action-name"),
+								validation.StringMatch(regexache.MustCompile(`^aws:[0-9a-z-]+:[0-9A-Za-z/-]+$`), "must be in the format of aws:service-name:action-name"),
 							),
 						},
 						"description": {
@@ -126,6 +129,49 @@ func ResourceExperimentTemplate() *schema.Resource {
 				Required:     true,
 				ValidateFunc: validation.StringLenBetween(0, 512),
 			},
+			"log_configuration": {
+				Type:     schema.TypeList,
+				Optional: true,
+				MaxItems: 1,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"cloudwatch_logs_configuration": {
+							Type:     schema.TypeList,
+							Optional: true,
+							MaxItems: 1,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"log_group_arn": {
+										Type:     schema.TypeString,
+										Required: true,
+									},
+								},
+							},
+						},
+						"log_schema_version": {
+							Type:     schema.TypeInt,
+							Required: true,
+						},
+						"s3_configuration": {
+							Type:     schema.TypeList,
+							Optional: true,
+							MaxItems: 1,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"bucket_name": {
+										Type:     schema.TypeString,
+										Required: true,
+									},
+									"prefix": {
+										Type:     schema.TypeString,
+										Optional: true,
+									},
+								},
+							},
+						},
+					},
+				},
+			},
 			"role_arn": {
 				Type:         schema.TypeString,
 				Required:     true,
@@ -181,6 +227,11 @@ func ResourceExperimentTemplate() *schema.Resource {
 							Required:     true,
 							ValidateFunc: validation.StringLenBetween(0, 64),
 						},
+						"parameters": {
+							Type:     schema.TypeMap,
+							Optional: true,
+							Elem:     &schema.Schema{Type: schema.TypeString},
+						},
 						"resource_arns": {
 							Type:     schema.TypeSet,
 							Optional: true,
@@ -220,7 +271,7 @@ func ResourceExperimentTemplate() *schema.Resource {
 							Required: true,
 							ValidateFunc: validation.All(
 								validation.StringLenBetween(0, 64),
-								validation.StringMatch(regexp.MustCompile(`^(ALL|COUNT\(\d+\)|PERCENT\(\d+\))$`), "must be one of ALL, COUNT(number), PERCENT(number)"),
+								validation.StringMatch(regexache.MustCompile(`^(ALL|COUNT\(\d+\)|PERCENT\(\d+\))$`), "must be one of ALL, COUNT(number), PERCENT(number)"),
 							),
 						},
 					},
@@ -236,12 +287,13 @@ func resourceExperimentTemplateCreate(ctx context.Context, d *schema.ResourceDat
 	conn := meta.(*conns.AWSClient).FISClient(ctx)
 
 	input := &fis.CreateExperimentTemplateInput{
-		Actions:        expandExperimentTemplateActions(d.Get("action").(*schema.Set)),
-		ClientToken:    aws.String(id.UniqueId()),
-		Description:    aws.String(d.Get("description").(string)),
-		RoleArn:        aws.String(d.Get("role_arn").(string)),
-		StopConditions: expandExperimentTemplateStopConditions(d.Get("stop_condition").(*schema.Set)),
-		Tags:           getTagsIn(ctx),
+		Actions:          expandExperimentTemplateActions(d.Get("action").(*schema.Set)),
+		ClientToken:      aws.String(id.UniqueId()),
+		Description:      aws.String(d.Get("description").(string)),
+		LogConfiguration: expandExperimentTemplateLogConfiguration(d.Get("log_configuration").([]interface{})),
+		RoleArn:          aws.String(d.Get("role_arn").(string)),
+		StopConditions:   expandExperimentTemplateStopConditions(d.Get("stop_condition").(*schema.Set)),
+		Tags:             getTagsIn(ctx),
 	}
 
 	targets, err := expandExperimentTemplateTargets(d.Get("target").(*schema.Set))
@@ -296,6 +348,10 @@ func resourceExperimentTemplateRead(ctx context.Context, d *schema.ResourceData,
 		return create.DiagSettingError(names.FIS, ResNameExperimentTemplate, d.Id(), "action", err)
 	}
 
+	if err := d.Set("log_configuration", flattenExperimentTemplateLogConfiguration(experimentTemplate.LogConfiguration)); err != nil {
+		return create.DiagSettingError(names.FIS, ResNameExperimentTemplate, d.Id(), "log_configuration", err)
+	}
+
 	if err := d.Set("stop_condition", flattenExperimentTemplateStopConditions(experimentTemplate.StopConditions)); err != nil {
 		return create.DiagSettingError(names.FIS, ResNameExperimentTemplate, d.Id(), "stop_condition", err)
 	}
@@ -312,37 +368,44 @@ func resourceExperimentTemplateRead(ctx context.Context, d *schema.ResourceData,
 func resourceExperimentTemplateUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	conn := meta.(*conns.AWSClient).FISClient(ctx)
 
-	input := &fis.UpdateExperimentTemplateInput{
-		Id: aws.String(d.Id()),
-	}
+	if d.HasChangesExcept("tags", "tags_all") {
+		input := &fis.UpdateExperimentTemplateInput{
+			Id: aws.String(d.Id()),
+		}
 
-	if d.HasChange("action") {
-		input.Actions = expandExperimentTemplateActionsForUpdate(d.Get("action").(*schema.Set))
-	}
+		if d.HasChange("action") {
+			input.Actions = expandExperimentTemplateActionsForUpdate(d.Get("action").(*schema.Set))
+		}
 
-	if d.HasChange("description") {
-		input.Description = aws.String(d.Get("description").(string))
-	}
+		if d.HasChange("description") {
+			input.Description = aws.String(d.Get("description").(string))
+		}
 
-	if d.HasChange("role_arn") {
-		input.RoleArn = aws.String(d.Get("role_arn").(string))
-	}
+		if d.HasChange("log_configuration") {
+			config := expandExperimentTemplateLogConfigurationForUpdate(d.Get("log_configuration").([]interface{}))
+			input.LogConfiguration = config
+		}
 
-	if d.HasChange("stop_condition") {
-		input.StopConditions = expandExperimentTemplateStopConditionsForUpdate(d.Get("stop_condition").(*schema.Set))
-	}
+		if d.HasChange("role_arn") {
+			input.RoleArn = aws.String(d.Get("role_arn").(string))
+		}
+
+		if d.HasChange("stop_condition") {
+			input.StopConditions = expandExperimentTemplateStopConditionsForUpdate(d.Get("stop_condition").(*schema.Set))
+		}
 
-	if d.HasChange("target") {
-		targets, err := expandExperimentTemplateTargetsForUpdate(d.Get("target").(*schema.Set))
+		if d.HasChange("target") {
+			targets, err := expandExperimentTemplateTargetsForUpdate(d.Get("target").(*schema.Set))
+			if err != nil {
+				return create.DiagError(names.FIS, create.ErrActionUpdating, ResNameExperimentTemplate, d.Id(), err)
+			}
+			input.Targets = targets
+		}
+
+		_, err := conn.UpdateExperimentTemplate(ctx, input)
 		if err != nil {
 			return create.DiagError(names.FIS, create.ErrActionUpdating, ResNameExperimentTemplate, d.Id(), err)
 		}
-		input.Targets = targets
-	}
-
-	_, err := conn.UpdateExperimentTemplate(ctx, input)
-	if err != nil {
-		return create.DiagError(names.FIS, create.ErrActionUpdating, ResNameExperimentTemplate, d.Id(), err)
 	}
 
 	return resourceExperimentTemplateRead(ctx, d, meta)
@@ -473,6 +536,58 @@ func expandExperimentTemplateStopConditions(l *schema.Set) []types.CreateExperim
 	return items
 }
 
+func expandExperimentTemplateLogConfiguration(l []interface{}) *types.CreateExperimentTemplateLogConfigurationInput {
+	if len(l) == 0 {
+		return nil
+	}
+
+	raw := l[0].(map[string]interface{})
+
+	config := types.CreateExperimentTemplateLogConfigurationInput{
+		LogSchemaVersion: aws.Int32(int32(raw["log_schema_version"].(int))),
+	}
+
+	if v, ok := raw["cloudwatch_logs_configuration"].([]interface{}); ok && len(v) > 0 {
+		config.CloudWatchLogsConfiguration = expandExperimentTemplateCloudWatchLogsConfiguration(v)
+	}
+
+	if v, ok := raw["s3_configuration"].([]interface{}); ok && len(v) > 0 {
+		config.S3Configuration = expandExperimentTemplateS3Configuration(v)
+	}
+
+	return &config
+}
+
+func expandExperimentTemplateCloudWatchLogsConfiguration(l []interface{}) *types.ExperimentTemplateCloudWatchLogsLogConfigurationInput {
+	if len(l) == 0 {
+		return nil
+	}
+
+	raw := l[0].(map[string]interface{})
+
+	config := types.ExperimentTemplateCloudWatchLogsLogConfigurationInput{
+		LogGroupArn: aws.String(raw["log_group_arn"].(string)),
+	}
+	return &config
+}
+
+func expandExperimentTemplateS3Configuration(l []interface{}) *types.ExperimentTemplateS3LogConfigurationInput {
+	if len(l) == 0 {
+		return nil
+	}
+
+	raw := l[0].(map[string]interface{})
+
+	config := types.ExperimentTemplateS3LogConfigurationInput{
+		BucketName: aws.String(raw["bucket_name"].(string)),
+	}
+	if v, ok := raw["prefix"].(string); ok && v != "" {
+		config.Prefix = aws.String(v)
+	}
+
+	return &config
+}
+
 func expandExperimentTemplateStopConditionsForUpdate(l *schema.Set) []types.UpdateExperimentTemplateStopConditionInput {
 	if l.Len() == 0 {
 		return nil
@@ -543,6 +658,10 @@ func expandExperimentTemplateTargets(l *schema.Set) (map[string]types.CreateExpe
 			config.SelectionMode = aws.String(v)
 		}
 
+		if v, ok := raw["parameters"].(map[string]interface{}); ok && len(v) > 0 {
+			config.Parameters = flex.ExpandStringValueMap(v)
+		}
+
 		if v, ok := raw["name"].(string); ok && v != "" {
 			attrs[v] = config
 		}
@@ -595,6 +714,10 @@ func expandExperimentTemplateTargetsForUpdate(l *schema.Set) (map[string]types.U
 			config.SelectionMode = aws.String(v)
 		}
 
+		if v, ok := raw["parameters"].(map[string]interface{}); ok && len(v) > 0 {
+			config.Parameters = flex.ExpandStringValueMap(v)
+		}
+
 		if v, ok := raw["name"].(string); ok && v != "" {
 			attrs[v] = config
 		}
@@ -603,6 +726,26 @@ func expandExperimentTemplateTargetsForUpdate(l *schema.Set) (map[string]types.U
 	return attrs, nil
 }
 
+func expandExperimentTemplateLogConfigurationForUpdate(l []interface{}) *types.UpdateExperimentTemplateLogConfigurationInput {
+	if len(l) == 0 {
+		return &types.UpdateExperimentTemplateLogConfigurationInput{}
+	}
+
+	raw := l[0].(map[string]interface{})
+	config := types.UpdateExperimentTemplateLogConfigurationInput{
+		LogSchemaVersion: aws.Int32(int32(raw["log_schema_version"].(int))),
+	}
+	if v, ok := raw["cloudwatch_logs_configuration"].([]interface{}); ok && len(v) > 0 {
+		config.CloudWatchLogsConfiguration = expandExperimentTemplateCloudWatchLogsConfiguration(v)
+	}
+
+	if v, ok := raw["s3_configuration"].([]interface{}); ok && len(v) > 0 {
+		config.S3Configuration = expandExperimentTemplateS3Configuration(v)
+	}
+
+	return &config
+}
+
 func expandExperimentTemplateActionParameteres(l *schema.Set) map[string]string {
 	if l.Len() == 0 {
 		return nil
@@ -725,6 +868,7 @@ func flattenExperimentTemplateTargets(configured map[string]types.ExperimentTemp
 		item["resource_tag"] = flattenExperimentTemplateTargetResourceTags(v.ResourceTags)
 		item["resource_type"] = aws.ToString(v.ResourceType)
 		item["selection_mode"] = aws.ToString(v.SelectionMode)
+		item["parameters"] = v.Parameters
 
 		item["name"] = k
 
@@ -734,6 +878,47 @@ func flattenExperimentTemplateTargets(configured map[string]types.ExperimentTemp
 	return dataResources
 }
 
+func flattenExperimentTemplateLogConfiguration(configured *types.ExperimentTemplateLogConfiguration) []map[string]interface{} {
+	if configured == nil {
+		return make([]map[string]interface{}, 0)
+	}
+
+	dataResources := make([]map[string]interface{}, 1)
+	dataResources[0] = make(map[string]interface{})
+	dataResources[0]["log_schema_version"] = configured.LogSchemaVersion
+	dataResources[0]["cloudwatch_logs_configuration"] = flattenCloudWatchLogsConfiguration(configured.CloudWatchLogsConfiguration)
+	dataResources[0]["s3_configuration"] = flattenS3Configuration(configured.S3Configuration)
+
+	return dataResources
+}
+
+func flattenCloudWatchLogsConfiguration(configured *types.ExperimentTemplateCloudWatchLogsLogConfiguration) []map[string]interface{} {
+	if configured == nil {
+		return make([]map[string]interface{}, 0)
+	}
+
+	dataResources := make([]map[string]interface{}, 1)
+	dataResources[0] = make(map[string]interface{})
+	dataResources[0]["log_group_arn"] = configured.LogGroupArn
+
+	return dataResources
+}
+
+func flattenS3Configuration(configured *types.ExperimentTemplateS3LogConfiguration) []map[string]interface{} {
+	if configured == nil {
+		return make([]map[string]interface{}, 0)
+	}
+
+	dataResources := make([]map[string]interface{}, 1)
+	dataResources[0] = make(map[string]interface{})
+	dataResources[0]["bucket_name"] = configured.BucketName
+	if aws.ToString(configured.Prefix) != "" {
+		dataResources[0]["prefix"] = configured.Prefix
+	}
+
+	return dataResources
+}
+
 func flattenExperimentTemplateActionParameters(configured map[string]string) []map[string]interface{} {
 	dataResources := make([]map[string]interface{}, 0, len(configured))
 
@@ -801,15 +986,18 @@ func validExperimentTemplateStopConditionSource() schema.SchemaValidateFunc {
 }
 
 func validExperimentTemplateActionTargetKey() schema.SchemaValidateFunc {
+	// See https://docs.aws.amazon.com/fis/latest/userguide/actions.html#action-targets
 	allowedStopConditionSources := []string{
 		"Cluster",
 		"Clusters",
 		"DBInstances",
 		"Instances",
 		"Nodegroups",
+		"Pods",
 		"Roles",
 		"SpotInstances",
 		"Subnets",
+		"Tasks",
 		"Volumes",
 	}
 
diff --git a/internal/service/fis/experiment_template_test.go b/internal/service/fis/experiment_template_test.go
index 24ce85f944f..4e5fa011e68 100644
--- a/internal/service/fis/experiment_template_test.go
+++ b/internal/service/fis/experiment_template_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package fis_test
 
 import (
@@ -313,6 +316,108 @@ func TestAccFISExperimentTemplate_ebs(t *testing.T) {
 	})
 }
 
+func TestAccFISExperimentTemplate_ebsParameters(t *testing.T) {
+	ctx := acctest.Context(t)
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_fis_experiment_template.test"
+	var conf types.ExperimentTemplate
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, fis.ServiceID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckExperimentTemplateDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccExperimentTemplateConfig_ebsVolumeParameters(rName, "EBS Volume Pause I/O Experiment", "ebs-paused-io-action", "EBS Volume Pause I/O", "aws:ebs:pause-volume-io", "Volumes", "ebs-volume-to-pause-io", "duration", "PT6M", "aws:ec2:ebs-volume", "ALL", "env", "test"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccExperimentTemplateExists(ctx, resourceName, &conf),
+					resource.TestCheckResourceAttr(resourceName, "description", "EBS Volume Pause I/O Experiment"),
+					resource.TestCheckResourceAttrPair(resourceName, "role_arn", "aws_iam_role.test_fis", "arn"),
+					resource.TestCheckResourceAttr(resourceName, "stop_condition.0.source", "none"),
+					resource.TestCheckResourceAttr(resourceName, "stop_condition.0.value", ""),
+					resource.TestCheckResourceAttr(resourceName, "stop_condition.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "action.0.name", "ebs-paused-io-action"),
+					resource.TestCheckResourceAttr(resourceName, "action.0.description", "EBS Volume Pause I/O"),
+					resource.TestCheckResourceAttr(resourceName, "action.0.action_id", "aws:ebs:pause-volume-io"),
+					resource.TestCheckResourceAttr(resourceName, "action.0.parameter.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "action.0.parameter.0.key", "duration"),
+					resource.TestCheckResourceAttr(resourceName, "action.0.parameter.0.value", "PT6M"),
+					resource.TestCheckResourceAttr(resourceName, "action.0.start_after.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "action.0.target.0.key", "Volumes"),
+					resource.TestCheckResourceAttr(resourceName, "action.0.target.0.value", "ebs-volume-to-pause-io"),
+					resource.TestCheckResourceAttr(resourceName, "action.0.target.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "action.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "target.0.name", "ebs-volume-to-pause-io"),
+					resource.TestCheckResourceAttr(resourceName, "target.0.resource_type", "aws:ec2:ebs-volume"),
+					resource.TestCheckResourceAttr(resourceName, "target.0.selection_mode", "ALL"),
+					resource.TestCheckResourceAttr(resourceName, "target.0.parameters.%", "1"),
+					resource.TestCheckResourceAttrPair(resourceName, "target.0.parameters.availabilityZoneIdentifier", "aws_ebs_volume.test", "availability_zone"),
+					resource.TestCheckResourceAttr(resourceName, "target.0.filter.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target.0.resource_tag.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "target.0.resource_tag.0.key", "Name"),
+					resource.TestCheckResourceAttrPair(resourceName, "target.0.resource_tag.0.value", "aws_ebs_volume.test", "tags.Name"),
+					resource.TestCheckResourceAttr(resourceName, "target.#", "1"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccFISExperimentTemplate_loggingConfiguration(t *testing.T) {
+	ctx := acctest.Context(t)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_fis_experiment_template.test"
+	var conf types.ExperimentTemplate
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, fis.ServiceID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckExperimentTemplateDestroy(ctx),
+		Steps: []resource.TestStep{
+			// Cloudwatch Logging
+			{
+				Config: testAccExperimentTemplateConfig_logConfigCloudWatch(rName, "An experiment template for testing", "test-action-1", "", "aws:ec2:terminate-instances", "Instances", "to-terminate-1", "aws:ec2:instance", "COUNT(1)", "env", "test"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccExperimentTemplateExists(ctx, resourceName, &conf),
+					resource.TestCheckResourceAttr(resourceName, "log_configuration.0.log_schema_version", "2"),
+					acctest.CheckResourceAttrRegionalARN(resourceName, "log_configuration.0.cloudwatch_logs_configuration.0.log_group_arn", "logs", fmt.Sprintf("log-group:%s:*", rName)),
+				),
+			},
+			// Delete Logging
+			{
+				Config: testAccExperimentTemplateConfig_basic(rName, "An experiment template for testing", "test-action-1", "", "aws:ec2:terminate-instances", "Instances", "to-terminate-1", "aws:ec2:instance", "COUNT(1)", "env", "test"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccExperimentTemplateExists(ctx, resourceName, &conf),
+				),
+			},
+			// S3 Logging
+			{
+				Config: testAccExperimentTemplateConfig_logConfigS3(rName, "An experiment template for testing", "test-action-1", "", "aws:ec2:terminate-instances", "Instances", "to-terminate-1", "aws:ec2:instance", "COUNT(1)", "env", "test"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccExperimentTemplateExists(ctx, resourceName, &conf),
+					resource.TestCheckResourceAttr(resourceName, "log_configuration.0.log_schema_version", "2"),
+					resource.TestCheckResourceAttr(resourceName, "log_configuration.0.s3_configuration.0.bucket_name", rName),
+					resource.TestCheckResourceAttr(resourceName, "log_configuration.0.s3_configuration.0.prefix", ""),
+				),
+			},
+			{
+				Config: testAccExperimentTemplateConfig_logConfigS3Prefix(rName, "An experiment template for testing", "test-action-1", "", "aws:ec2:terminate-instances", "Instances", "to-terminate-1", "aws:ec2:instance", "COUNT(1)", "env", "test"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccExperimentTemplateExists(ctx, resourceName, &conf),
+					resource.TestCheckResourceAttr(resourceName, "log_configuration.0.log_schema_version", "2"),
+					resource.TestCheckResourceAttr(resourceName, "log_configuration.0.s3_configuration.0.bucket_name", rName),
+					resource.TestCheckResourceAttr(resourceName, "log_configuration.0.s3_configuration.0.prefix", "test"),
+				),
+			},
+		},
+	})
+}
+
 func testAccExperimentTemplateExists(ctx context.Context, resourceName string, config *types.ExperimentTemplate) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		rs, ok := s.RootModule().Resources[resourceName]
@@ -695,3 +800,269 @@ resource "aws_fis_experiment_template" "test" {
 }
 `, rName+"-fis", desc, actionName, actionDesc, actionID, actionTargetK, actionTargetV, paramK1, paramV1, targetResType, targetSelectMode, targetResTagK, targetResTagV))
 }
+
+func testAccExperimentTemplateConfig_ebsVolumeParameters(rName, desc, actionName, actionDesc, actionID, actionTargetK, actionTargetV, paramK1, paramV1, targetResType, targetSelectMode, targetResTagK, targetResTagV string) string {
+	return acctest.ConfigCompose(testAccExperimentTemplateConfig_baseEBSVolume(rName), fmt.Sprintf(`
+resource "aws_iam_role" "test_fis" {
+  name = %[1]q
+  assume_role_policy = jsonencode({
+    Statement = [{
+      Action = "sts:AssumeRole"
+      Effect = "Allow"
+      Principal = {
+        Service = [
+          "fis.${data.aws_partition.current.dns_suffix}",
+        ]
+      }
+    }]
+    Version = "2012-10-17"
+  })
+}
+resource "aws_fis_experiment_template" "test" {
+  description = %[2]q
+  role_arn    = aws_iam_role.test_fis.arn
+  stop_condition {
+    source = "none"
+  }
+  action {
+    name        = %[3]q
+    description = %[4]q
+    action_id   = %[5]q
+    target {
+      key   = %[6]q
+      value = %[7]q
+    }
+    parameter {
+      key   = %[8]q
+      value = %[9]q
+    }
+  }
+  target {
+    name           = %[7]q
+    resource_type  = %[10]q
+    selection_mode = %[11]q
+    resource_tag {
+      key   = "Name"
+      value = aws_ebs_volume.test.tags.Name
+    }
+    parameters = {
+      availabilityZoneIdentifier = aws_ebs_volume.test.availability_zone
+    }
+  }
+  tags = {
+    Name = %[1]q
+  }
+}
+`, rName+"-fis", desc, actionName, actionDesc, actionID, actionTargetK, actionTargetV, paramK1, paramV1, targetResType, targetSelectMode, targetResTagK, targetResTagV))
+}
+
+func testAccExperimentTemplateConfig_logConfigCloudWatch(rName, desc, actionName, actionDesc, actionID, actionTargetK, actionTargetV, targetResType, targetSelectMode, targetResTagK, targetResTagV string) string {
+	return fmt.Sprintf(`
+data "aws_partition" "current" {}
+
+resource "aws_iam_role" "test" {
+  name = %[1]q
+
+  assume_role_policy = jsonencode({
+    Statement = [{
+      Action = "sts:AssumeRole"
+      Effect = "Allow"
+      Principal = {
+        Service = [
+          "fis.${data.aws_partition.current.dns_suffix}",
+        ]
+      }
+    }]
+    Version = "2012-10-17"
+  })
+}
+
+resource "aws_cloudwatch_log_group" "test" {
+  name = %[1]q
+}
+
+resource "aws_fis_experiment_template" "test" {
+  description = %[2]q
+  role_arn    = aws_iam_role.test.arn
+
+  stop_condition {
+    source = "none"
+  }
+
+  action {
+    name        = %[3]q
+    description = %[4]q
+    action_id   = %[5]q
+
+    target {
+      key   = %[6]q
+      value = %[7]q
+    }
+  }
+
+  target {
+    name           = %[7]q
+    resource_type  = %[8]q
+    selection_mode = %[9]q
+
+    resource_tag {
+      key   = %[10]q
+      value = %[11]q
+    }
+  }
+
+  log_configuration {
+    log_schema_version = 2
+
+    cloudwatch_logs_configuration {
+      log_group_arn = "${aws_cloudwatch_log_group.test.arn}:*"
+    }
+  }
+
+  tags = {
+    Name = %[1]q
+  }
+}
+`, rName, desc, actionName, actionDesc, actionID, actionTargetK, actionTargetV, targetResType, targetSelectMode, targetResTagK, targetResTagV)
+}
+
+func testAccExperimentTemplateConfig_logConfigS3(rName, desc, actionName, actionDesc, actionID, actionTargetK, actionTargetV, targetResType, targetSelectMode, targetResTagK, targetResTagV string) string {
+	return fmt.Sprintf(`
+data "aws_partition" "current" {}
+
+resource "aws_iam_role" "test" {
+  name = %[1]q
+
+  assume_role_policy = jsonencode({
+    Statement = [{
+      Action = "sts:AssumeRole"
+      Effect = "Allow"
+      Principal = {
+        Service = [
+          "fis.${data.aws_partition.current.dns_suffix}",
+        ]
+      }
+    }]
+    Version = "2012-10-17"
+  })
+}
+
+resource "aws_s3_bucket" "test" {
+  bucket = %[1]q
+}
+
+resource "aws_fis_experiment_template" "test" {
+  description = %[2]q
+  role_arn    = aws_iam_role.test.arn
+
+  stop_condition {
+    source = "none"
+  }
+
+  action {
+    name        = %[3]q
+    description = %[4]q
+    action_id   = %[5]q
+
+    target {
+      key   = %[6]q
+      value = %[7]q
+    }
+  }
+
+  target {
+    name           = %[7]q
+    resource_type  = %[8]q
+    selection_mode = %[9]q
+
+    resource_tag {
+      key   = %[10]q
+      value = %[11]q
+    }
+  }
+
+  log_configuration {
+    log_schema_version = 2
+
+    s3_configuration {
+      bucket_name = aws_s3_bucket.test.bucket
+    }
+  }
+
+  tags = {
+    Name = %[1]q
+  }
+}
+`, rName, desc, actionName, actionDesc, actionID, actionTargetK, actionTargetV, targetResType, targetSelectMode, targetResTagK, targetResTagV)
+}
+
+func testAccExperimentTemplateConfig_logConfigS3Prefix(rName, desc, actionName, actionDesc, actionID, actionTargetK, actionTargetV, targetResType, targetSelectMode, targetResTagK, targetResTagV string) string {
+	return fmt.Sprintf(`
+data "aws_partition" "current" {}
+
+resource "aws_iam_role" "test" {
+  name = %[1]q
+
+  assume_role_policy = jsonencode({
+    Statement = [{
+      Action = "sts:AssumeRole"
+      Effect = "Allow"
+      Principal = {
+        Service = [
+          "fis.${data.aws_partition.current.dns_suffix}",
+        ]
+      }
+    }]
+    Version = "2012-10-17"
+  })
+}
+
+resource "aws_s3_bucket" "test" {
+  bucket = %[1]q
+}
+
+resource "aws_fis_experiment_template" "test" {
+  description = %[2]q
+  role_arn    = aws_iam_role.test.arn
+
+  stop_condition {
+    source = "none"
+  }
+
+  action {
+    name        = %[3]q
+    description = %[4]q
+    action_id   = %[5]q
+
+    target {
+      key   = %[6]q
+      value = %[7]q
+    }
+  }
+
+  target {
+    name           = %[7]q
+    resource_type  = %[8]q
+    selection_mode = %[9]q
+
+    resource_tag {
+      key   = %[10]q
+      value = %[11]q
+    }
+  }
+
+  log_configuration {
+    log_schema_version = 2
+
+    s3_configuration {
+      bucket_name = aws_s3_bucket.test.bucket
+      prefix      = "test"
+    }
+  }
+
+  tags = {
+    Name = %[1]q
+  }
+}
+`, rName, desc, actionName, actionDesc, actionID, actionTargetK, actionTargetV, targetResType, targetSelectMode, targetResTagK, targetResTagV)
+}
diff --git a/internal/service/fis/generate.go b/internal/service/fis/generate.go
index d3a0ab6eb2c..300a13fd097 100644
--- a/internal/service/fis/generate.go
+++ b/internal/service/fis/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -AWSSDKVersion=2 -ListTags -ServiceTagsMap -UpdateTags -KVTValues -SkipTypesImp
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/fis/service_package_gen.go b/internal/service/fis/service_package_gen.go
index 2d3d0c108ee..d1d3af871f5 100644
--- a/internal/service/fis/service_package_gen.go
+++ b/internal/service/fis/service_package_gen.go
@@ -7,6 +7,7 @@ import (
 
 	aws_sdkv2 "github.com/aws/aws-sdk-go-v2/aws"
 	fis_sdkv2 "github.com/aws/aws-sdk-go-v2/service/fis"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -46,9 +47,11 @@ func (p *servicePackage) NewClient(ctx context.Context, config map[string]any) (
 
 	return fis_sdkv2.NewFromConfig(cfg, func(o *fis_sdkv2.Options) {
 		if endpoint := config["endpoint"].(string); endpoint != "" {
-			o.EndpointResolver = fis_sdkv2.EndpointResolverFromURL(endpoint)
+			o.BaseEndpoint = aws_sdkv2.String(endpoint)
 		}
 	}), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/fis/sweep.go b/internal/service/fis/sweep.go
index f2d23ab8dfd..9668fa11d98 100644
--- a/internal/service/fis/sweep.go
+++ b/internal/service/fis/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package fis
 
@@ -14,7 +14,7 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_fis_experiment_template", &resource.Sweeper{
 		Name: "aws_fis_experiment_template",
 		F:    sweepExperimentTemplates,
@@ -23,7 +23,7 @@ func init() {
 
 func sweepExperimentTemplates(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
@@ -53,7 +53,7 @@ func sweepExperimentTemplates(region string) error {
 		}
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping FIS Experiment Templates (%s): %w", region, err)
diff --git a/internal/service/fis/tags_gen.go b/internal/service/fis/tags_gen.go
index dc67bc98a07..b6f0264965a 100644
--- a/internal/service/fis/tags_gen.go
+++ b/internal/service/fis/tags_gen.go
@@ -7,7 +7,9 @@ import (
 
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/fis"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -53,7 +55,7 @@ func Tags(tags tftags.KeyValueTags) map[string]string {
 	return tags.Map()
 }
 
-// KeyValueTags creates KeyValueTags from fis service tags.
+// KeyValueTags creates tftags.KeyValueTags from fis service tags.
 func KeyValueTags(ctx context.Context, tags map[string]string) tftags.KeyValueTags {
 	return tftags.New(ctx, tags)
 }
@@ -84,6 +86,8 @@ func updateTags(ctx context.Context, conn *fis.Client, identifier string, oldTag
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.FIS)
 	if len(removedTags) > 0 {
diff --git a/internal/service/fms/admin_account.go b/internal/service/fms/admin_account.go
index 52d48c172e8..2da51479c4f 100644
--- a/internal/service/fms/admin_account.go
+++ b/internal/service/fms/admin_account.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package fms
 
 import (
@@ -13,11 +16,12 @@ import (
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
 )
 
 // @SDKResource("aws_fms_admin_account")
-func ResourceAdminAccount() *schema.Resource {
+func resourceAdminAccount() *schema.Resource {
 	return &schema.Resource{
 		CreateWithoutTimeout: resourceAdminAccountCreate,
 		ReadWithoutTimeout:   resourceAdminAccountRead,
@@ -27,6 +31,11 @@ func ResourceAdminAccount() *schema.Resource {
 			StateContext: schema.ImportStatePassthroughContext,
 		},
 
+		Timeouts: &schema.ResourceTimeout{
+			Create: schema.DefaultTimeout(30 * time.Minute),
+			Delete: schema.DefaultTimeout(10 * time.Minute),
+		},
+
 		Schema: map[string]*schema.Schema{
 			"account_id": {
 				Type:         schema.TypeString,
@@ -43,36 +52,20 @@ func resourceAdminAccountCreate(ctx context.Context, d *schema.ResourceData, met
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).FMSConn(ctx)
 
-	// Ensure there is not an existing FMS Admin Account
-	output, err := conn.GetAdminAccountWithContext(ctx, &fms.GetAdminAccountInput{})
+	// Ensure there is not an existing FMS Admin Account.
+	output, err := findAdminAccount(ctx, conn)
 
-	if err != nil && !tfawserr.ErrCodeEquals(err, fms.ErrCodeResourceNotFoundException) {
-		return sdkdiag.AppendErrorf(diags, "getting FMS Admin Account: %s", err)
-	}
-
-	if output != nil && output.AdminAccount != nil && aws.StringValue(output.RoleStatus) == fms.AccountRoleStatusReady {
+	if !tfresource.NotFound(err) {
 		return sdkdiag.AppendErrorf(diags, "FMS Admin Account (%s) already associated: import this Terraform resource to manage", aws.StringValue(output.AdminAccount))
 	}
 
 	accountID := meta.(*conns.AWSClient).AccountID
-
 	if v, ok := d.GetOk("account_id"); ok {
 		accountID = v.(string)
 	}
 
-	stateConf := &retry.StateChangeConf{
-		Pending: []string{
-			fms.AccountRoleStatusDeleted, // Recreating association can return this status
-			fms.AccountRoleStatusCreating,
-		},
-		Target:  []string{fms.AccountRoleStatusReady},
-		Refresh: associateAdminAccountRefreshFunc(ctx, conn, accountID),
-		Timeout: 30 * time.Minute,
-		Delay:   10 * time.Second,
-	}
-
-	if _, err := stateConf.WaitForStateContext(ctx); err != nil {
-		return sdkdiag.AppendErrorf(diags, "waiting for FMS Admin Account (%s) association: %s", accountID, err)
+	if _, err := waitAdminAccountCreated(ctx, conn, accountID, d.Timeout(schema.TimeoutCreate)); err != nil {
+		return sdkdiag.AppendErrorf(diags, "waiting for FMS Admin Account (%s) create: %s", d.Id(), err)
 	}
 
 	d.SetId(accountID)
@@ -80,64 +73,20 @@ func resourceAdminAccountCreate(ctx context.Context, d *schema.ResourceData, met
 	return append(diags, resourceAdminAccountRead(ctx, d, meta)...)
 }
 
-func associateAdminAccountRefreshFunc(ctx context.Context, conn *fms.FMS, accountId string) retry.StateRefreshFunc {
-	// This is all wrapped in a refresh func since AssociateAdminAccount returns
-	// success even though it failed if called too quickly after creating an organization
-	return func() (interface{}, string, error) {
-		req := &fms.AssociateAdminAccountInput{
-			AdminAccount: aws.String(accountId),
-		}
-
-		_, aserr := conn.AssociateAdminAccountWithContext(ctx, req)
-		if aserr != nil {
-			return nil, "", aserr
-		}
-
-		res, err := conn.GetAdminAccountWithContext(ctx, &fms.GetAdminAccountInput{})
-		if err != nil {
-			// FMS returns an AccessDeniedException if no account is associated,
-			// but does not define this in its error codes
-			if tfawserr.ErrMessageContains(err, "AccessDeniedException", "is not currently delegated by AWS FM") {
-				return nil, "", nil
-			}
-			if tfawserr.ErrCodeEquals(err, fms.ErrCodeResourceNotFoundException) {
-				return nil, "", nil
-			}
-			return nil, "", err
-		}
-
-		if aws.StringValue(res.AdminAccount) != accountId {
-			return nil, "", nil
-		}
-
-		return res, aws.StringValue(res.RoleStatus), err
-	}
-}
-
 func resourceAdminAccountRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).FMSConn(ctx)
 
-	output, err := conn.GetAdminAccountWithContext(ctx, &fms.GetAdminAccountInput{})
+	output, err := findAdminAccount(ctx, conn)
 
-	if !d.IsNewResource() && tfawserr.ErrCodeEquals(err, fms.ErrCodeResourceNotFoundException) {
+	if !d.IsNewResource() && tfresource.NotFound(err) {
 		log.Printf("[WARN] FMS Admin Account (%s) not found, removing from state", d.Id())
 		d.SetId("")
 		return diags
 	}
 
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "getting FMS Admin Account (%s): %s", d.Id(), err)
-	}
-
-	if aws.StringValue(output.RoleStatus) == fms.AccountRoleStatusDeleted {
-		if d.IsNewResource() {
-			return sdkdiag.AppendErrorf(diags, "getting FMS Admin Account (%s): %s after creation", d.Id(), aws.StringValue(output.RoleStatus))
-		}
-
-		log.Printf("[WARN] FMS Admin Account (%s) not found, removing from state", d.Id())
-		d.SetId("")
-		return diags
+		return sdkdiag.AppendErrorf(diags, "reading FMS Admin Account (%s): %s", d.Id(), err)
 	}
 
 	d.Set("account_id", output.AdminAccount)
@@ -155,39 +104,136 @@ func resourceAdminAccountDelete(ctx context.Context, d *schema.ResourceData, met
 		return sdkdiag.AppendErrorf(diags, "disassociating FMS Admin Account (%s): %s", d.Id(), err)
 	}
 
-	if err := waitForAdminAccountDeletion(ctx, conn); err != nil {
-		return sdkdiag.AppendErrorf(diags, "waiting for FMS Admin Account (%s) disassociation: %s", d.Id(), err)
+	if _, err := waitAdminAccountDeleted(ctx, conn, d.Timeout(schema.TimeoutDelete)); err != nil {
+		return sdkdiag.AppendErrorf(diags, "waiting for FMS Admin Account (%s) delete: %s", d.Id(), err)
 	}
 
 	return diags
 }
 
-func waitForAdminAccountDeletion(ctx context.Context, conn *fms.FMS) error {
+func findAdminAccount(ctx context.Context, conn *fms.FMS) (*fms.GetAdminAccountOutput, error) {
+	input := &fms.GetAdminAccountInput{}
+
+	output, err := conn.GetAdminAccountWithContext(ctx, input)
+
+	if tfawserr.ErrCodeEquals(err, fms.ErrCodeResourceNotFoundException) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	if output == nil {
+		return nil, tfresource.NewEmptyResultError(input)
+	}
+
+	if status := aws.StringValue(output.RoleStatus); status == fms.AccountRoleStatusDeleted {
+		return nil, &retry.NotFoundError{
+			Message:     status,
+			LastRequest: input,
+		}
+	}
+
+	return output, nil
+}
+
+func statusAssociateAdminAccount(ctx context.Context, conn *fms.FMS, accountID string) retry.StateRefreshFunc {
+	// This is all wrapped in a StateRefreshFunc since AssociateAdminAccount returns
+	// success even though it failed if called too quickly after creating an Organization.
+	return func() (interface{}, string, error) {
+		input := &fms.AssociateAdminAccountInput{
+			AdminAccount: aws.String(accountID),
+		}
+
+		_, err := conn.AssociateAdminAccountWithContext(ctx, input)
+
+		if err != nil {
+			return nil, "", err
+		}
+
+		output, err := conn.GetAdminAccountWithContext(ctx, &fms.GetAdminAccountInput{})
+
+		// FMS returns an AccessDeniedException if no account is associated,
+		// but does not define this in its error codes.
+		if tfawserr.ErrMessageContains(err, "AccessDeniedException", "is not currently delegated by AWS FM") {
+			return nil, "", nil
+		}
+
+		if tfawserr.ErrCodeEquals(err, fms.ErrCodeResourceNotFoundException) {
+			return nil, "", nil
+		}
+
+		if err != nil {
+			return nil, "", err
+		}
+
+		if aws.StringValue(output.AdminAccount) != accountID {
+			return nil, "", nil
+		}
+
+		return output, aws.StringValue(output.RoleStatus), err
+	}
+}
+
+func statusAdminAccount(ctx context.Context, conn *fms.FMS) retry.StateRefreshFunc {
+	return func() (interface{}, string, error) {
+		output, err := findAdminAccount(ctx, conn)
+
+		if tfresource.NotFound(err) {
+			return nil, "", nil
+		}
+
+		if err != nil {
+			return nil, "", err
+		}
+
+		return output, aws.StringValue(output.RoleStatus), nil
+	}
+}
+
+func waitAdminAccountCreated(ctx context.Context, conn *fms.FMS, accountID string, timeout time.Duration) (*fms.GetAdminAccountOutput, error) {
 	stateConf := &retry.StateChangeConf{
 		Pending: []string{
-			fms.AccountRoleStatusDeleting,
-			fms.AccountRoleStatusPendingDeletion,
-			fms.AccountRoleStatusReady,
+			fms.AccountRoleStatusDeleted, // Recreating association can return this status.
+			fms.AccountRoleStatusCreating,
 		},
-		Target: []string{fms.AccountRoleStatusDeleted},
-		Refresh: func() (interface{}, string, error) {
-			output, err := conn.GetAdminAccountWithContext(ctx, &fms.GetAdminAccountInput{})
+		Target:  []string{fms.AccountRoleStatusReady},
+		Refresh: statusAssociateAdminAccount(ctx, conn, accountID),
+		Timeout: timeout,
+		Delay:   10 * time.Second,
+	}
 
-			if tfawserr.ErrCodeEquals(err, fms.ErrCodeResourceNotFoundException) {
-				return output, fms.AccountRoleStatusDeleted, nil
-			}
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
 
-			if err != nil {
-				return nil, "", err
-			}
+	if output, ok := outputRaw.(*fms.GetAdminAccountOutput); ok {
+		return output, err
+	}
 
-			return output, aws.StringValue(output.RoleStatus), nil
+	return nil, err
+}
+
+func waitAdminAccountDeleted(ctx context.Context, conn *fms.FMS, timeout time.Duration) (*fms.GetAdminAccountOutput, error) {
+	stateConf := &retry.StateChangeConf{
+		Pending: []string{
+			fms.AccountRoleStatusDeleting,
+			fms.AccountRoleStatusPendingDeletion,
+			fms.AccountRoleStatusReady,
 		},
-		Timeout: 10 * time.Minute,
+		Target:  []string{},
+		Refresh: statusAdminAccount(ctx, conn),
+		Timeout: timeout,
 		Delay:   10 * time.Second,
 	}
 
-	_, err := stateConf.WaitForStateContext(ctx)
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+
+	if output, ok := outputRaw.(*fms.GetAdminAccountOutput); ok {
+		return output, err
+	}
 
-	return err
+	return nil, err
 }
diff --git a/internal/service/fms/admin_account_test.go b/internal/service/fms/admin_account_test.go
index 0d1be92b973..fddee37d089 100644
--- a/internal/service/fms/admin_account_test.go
+++ b/internal/service/fms/admin_account_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package fms_test
 
 import (
@@ -5,14 +8,14 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/endpoints"
 	"github.com/aws/aws-sdk-go/service/fms"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	tffms "github.com/hashicorp/terraform-provider-aws/internal/service/fms"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
 func testAccAdminAccount_basic(t *testing.T) {
@@ -23,7 +26,33 @@ func testAccAdminAccount_basic(t *testing.T) {
 		PreCheck: func() {
 			acctest.PreCheck(ctx, t)
 			acctest.PreCheckRegion(t, endpoints.UsEast1RegionID)
-			acctest.PreCheckOrganizationsAccount(ctx, t)
+			acctest.PreCheckOrganizationsEnabled(ctx, t)
+			acctest.PreCheckOrganizationManagementAccount(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, fms.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckAdminAccountDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccAdminAccountConfig_basic,
+				Check: resource.ComposeTestCheckFunc(
+					acctest.CheckResourceAttrAccountID(resourceName, "account_id"),
+				),
+			},
+		},
+	})
+}
+
+func testAccAdminAccount_disappears(t *testing.T) {
+	ctx := acctest.Context(t)
+	resourceName := "aws_fms_admin_account.test"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckRegion(t, endpoints.UsEast1RegionID)
+			acctest.PreCheckOrganizationsEnabled(ctx, t)
+			acctest.PreCheckOrganizationManagementAccount(ctx, t)
 		},
 		ErrorCheck:               acctest.ErrorCheck(t, fms.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
@@ -33,7 +62,9 @@ func testAccAdminAccount_basic(t *testing.T) {
 				Config: testAccAdminAccountConfig_basic,
 				Check: resource.ComposeTestCheckFunc(
 					acctest.CheckResourceAttrAccountID(resourceName, "account_id"),
+					acctest.CheckResourceDisappears(ctx, acctest.Provider, tffms.ResourceAdminAccount(), resourceName),
 				),
+				ExpectNonEmptyPlan: true,
 			},
 		},
 	})
@@ -48,9 +79,9 @@ func testAccCheckAdminAccountDestroy(ctx context.Context) resource.TestCheckFunc
 				continue
 			}
 
-			output, err := conn.GetAdminAccountWithContext(ctx, &fms.GetAdminAccountInput{})
+			_, err := tffms.FindAdminAccount(ctx, conn)
 
-			if tfawserr.ErrCodeEquals(err, fms.ErrCodeResourceNotFoundException) {
+			if tfresource.NotFound(err) {
 				continue
 			}
 
@@ -58,11 +89,7 @@ func testAccCheckAdminAccountDestroy(ctx context.Context) resource.TestCheckFunc
 				return err
 			}
 
-			if aws.StringValue(output.RoleStatus) == fms.AccountRoleStatusDeleted {
-				continue
-			}
-
-			return fmt.Errorf("FMS Admin Account (%s) still exists with status: %s", aws.StringValue(output.AdminAccount), aws.StringValue(output.RoleStatus))
+			return fmt.Errorf("FMS Admin Account %s still exists", rs.Primary.ID)
 		}
 
 		return nil
@@ -70,14 +97,9 @@ func testAccCheckAdminAccountDestroy(ctx context.Context) resource.TestCheckFunc
 }
 
 const testAccAdminAccountConfig_basic = `
-data "aws_partition" "current" {}
-
-resource "aws_organizations_organization" "test" {
-  aws_service_access_principals = ["fms.${data.aws_partition.current.dns_suffix}"]
-  feature_set                   = "ALL"
-}
+data "aws_caller_identity" "current" {}
 
 resource "aws_fms_admin_account" "test" {
-  account_id = aws_organizations_organization.test.master_account_id
+  account_id = data.aws_caller_identity.current.account_id
 }
 `
diff --git a/internal/service/fms/exports_test.go b/internal/service/fms/exports_test.go
new file mode 100644
index 00000000000..42bd8e6b323
--- /dev/null
+++ b/internal/service/fms/exports_test.go
@@ -0,0 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package fms
+
+// Exports for use in tests only.
+var (
+	ResourceAdminAccount = resourceAdminAccount
+	ResourcePolicy       = resourcePolicy
+
+	FindAdminAccount          = findAdminAccount
+	FindPolicyByID            = findPolicyByID
+	RemoveEmptyFieldsFromJSON = removeEmptyFieldsFromJSON
+)
diff --git a/internal/service/fms/fms_test.go b/internal/service/fms/fms_test.go
index 365b5eb1061..c80a0d02bc3 100644
--- a/internal/service/fms/fms_test.go
+++ b/internal/service/fms/fms_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package fms_test
 
 import (
@@ -11,15 +14,20 @@ func TestAccFMS_serial(t *testing.T) {
 
 	testCases := map[string]map[string]func(t *testing.T){
 		"AdminAccount": {
-			"basic": testAccAdminAccount_basic,
+			"basic":      testAccAdminAccount_basic,
+			"disappears": testAccAdminAccount_disappears,
 		},
 		"Policy": {
+			"alb":                    testAccPolicy_alb,
 			"basic":                  testAccPolicy_basic,
 			"cloudfrontDistribution": testAccPolicy_cloudFrontDistribution,
+			"disappears":             testAccPolicy_disappears,
 			"includeMap":             testAccPolicy_includeMap,
-			"update":                 testAccPolicy_update,
+			"policyOption":           testAccPolicy_policyOption,
 			"resourceTags":           testAccPolicy_resourceTags,
+			"securityGroup":          testAccPolicy_securityGroup,
 			"tags":                   testAccPolicy_tags,
+			"update":                 testAccPolicy_update,
 		},
 	}
 
diff --git a/internal/service/fms/generate.go b/internal/service/fms/generate.go
index 289a02bc310..64625868c77 100644
--- a/internal/service/fms/generate.go
+++ b/internal/service/fms/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTags -ListTagsOp=ListTagsForResource -ListTagsInIDElem=ResourceArn -ListTagsOutTagsElem=TagList -ServiceTagsSlice -TagOp=TagResource -TagInTagsElem=TagList -TagInIDElem=ResourceArn -UpdateTags -TagType=Tag
 
 //go:generate go run ../../generate/servicepackage/main.go
diff --git a/internal/service/fms/managed_service_data.go b/internal/service/fms/managed_service_data.go
new file mode 100644
index 00000000000..46591259947
--- /dev/null
+++ b/internal/service/fms/managed_service_data.go
@@ -0,0 +1,71 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package fms
+
+import (
+	"encoding/json"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/fms/ujson"
+	"github.com/hashicorp/terraform-provider-aws/internal/verify"
+)
+
+// suppressEquivalentManagedServiceDataJSON provides custom difference suppression
+// for strings that are equivalent once empty fields have been removed.
+func suppressEquivalentManagedServiceDataJSON(k, old, new string, d *schema.ResourceData) bool {
+	if !json.Valid([]byte(old)) || !json.Valid([]byte(new)) {
+		return old == new
+	}
+
+	old, new = removeEmptyFieldsFromJSON(old), removeEmptyFieldsFromJSON(new)
+
+	return verify.JSONStringsEqual(old, new)
+}
+
+// removeEmptyFieldsFromJSON removes `null` and empty array (`[]`) fields from a valid JSON string.
+func removeEmptyFieldsFromJSON(in string) string {
+	out := make([]byte, 0, len(in))
+	lenBeforeArray := 0
+
+	err := ujson.Walk([]byte(in), func(_ int, key, value []byte) bool {
+		n := len(out)
+
+		// For valid JSON, value will never be empty.
+		skip := false
+		switch value[0] {
+		case 'n': // Null (null)
+			skip = true
+		case '[': // Start of array
+			lenBeforeArray = n
+		case ']': // End of array
+			if out[n-1] == '[' {
+				// Truncate output.
+				out = out[:lenBeforeArray]
+				lenBeforeArray = 0
+				skip = true
+			}
+		}
+
+		if skip {
+			return false
+		}
+
+		if n != 0 && ujson.ShouldAddComma(value, out[n-1]) {
+			out = append(out, ',')
+		}
+		if len(key) > 0 {
+			out = append(out, key...)
+			out = append(out, ':')
+		}
+		out = append(out, value...)
+
+		return true
+	})
+
+	if err != nil {
+		return ""
+	}
+
+	return string(out)
+}
diff --git a/internal/service/fms/managed_service_data_test.go b/internal/service/fms/managed_service_data_test.go
new file mode 100644
index 00000000000..035550c29b3
--- /dev/null
+++ b/internal/service/fms/managed_service_data_test.go
@@ -0,0 +1,72 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package fms_test
+
+import (
+	"testing"
+
+	tffms "github.com/hashicorp/terraform-provider-aws/internal/service/fms"
+)
+
+func TestRemoveEmptyFieldsFromJSON(t *testing.T) {
+	t.Parallel()
+
+	testCases := []struct {
+		testName string
+		input    string
+		want     string
+	}{
+		{
+			testName: "empty JSON",
+			input:    "{}",
+			want:     "{}",
+		},
+		{
+			testName: "single field",
+			input:    `{ "key": 42 }`,
+			want:     `{"key":42}`,
+		},
+		{
+			testName: "single null field",
+			input:    `{"key": null}`,
+			want:     `{}`,
+		},
+		{
+			testName: "single empty array field",
+			input:    `{"key": []}`,
+			want:     `{}`,
+		},
+		{
+			testName: "null field and empty array field",
+			input:    `{"key1": [], "key2": null}`,
+			want:     `{}`,
+		},
+		{
+			testName: "AWS DNS_FIREWALL example",
+			input:    "{\"type\":\"DNS_FIREWALL\",\"preProcessRuleGroups\":[{\"ruleGroupId\":\"rslvr-frg-1\",\"priority\":10}],\"postProcessRuleGroups\":[{\"ruleGroupId\":\"rslvr-frg-2\",\"priority\":9911}]}",
+			want:     "{\"type\":\"DNS_FIREWALL\",\"preProcessRuleGroups\":[{\"ruleGroupId\":\"rslvr-frg-1\",\"priority\":10}],\"postProcessRuleGroups\":[{\"ruleGroupId\":\"rslvr-frg-2\",\"priority\":9911}]}",
+		},
+		{
+			testName: "AWS IMPORT_NETWORK_FIREWALL example",
+			input:    "{\"type\":\"IMPORT_NETWORK_FIREWALL\",\"awsNetworkFirewallConfig\":{\"networkFirewallStatelessRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-west-2:000000000000:stateless-rulegroup/rg1\",\"priority\":1}],\"networkFirewallStatelessDefaultActions\":[\"aws:drop\"],\"networkFirewallStatelessFragmentDefaultActions\":[\"aws:pass\"],\"networkFirewallStatelessCustomActions\":[],\"networkFirewallStatefulRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-west-2:aws-managed:stateful-rulegroup/ThreatSignaturesEmergingEventsStrictOrder\",\"priority\":8}],\"networkFirewallStatefulEngineOptions\":{\"ruleOrder\":\"STRICT_ORDER\"},\"networkFirewallStatefulDefaultActions\":[\"aws:drop_strict\"]}}", //lintignore:AWSAT003,AWSAT005
+			want:     "{\"type\":\"IMPORT_NETWORK_FIREWALL\",\"awsNetworkFirewallConfig\":{\"networkFirewallStatelessRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-west-2:000000000000:stateless-rulegroup/rg1\",\"priority\":1}],\"networkFirewallStatelessDefaultActions\":[\"aws:drop\"],\"networkFirewallStatelessFragmentDefaultActions\":[\"aws:pass\"],\"networkFirewallStatefulRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-west-2:aws-managed:stateful-rulegroup/ThreatSignaturesEmergingEventsStrictOrder\",\"priority\":8}],\"networkFirewallStatefulEngineOptions\":{\"ruleOrder\":\"STRICT_ORDER\"},\"networkFirewallStatefulDefaultActions\":[\"aws:drop_strict\"]}}",                                              //lintignore:AWSAT003,AWSAT005
+		},
+		{
+			testName: "AWS NETWORK_FIREWALL example",
+			input:    "{\"type\":\"NETWORK_FIREWALL\",\"awsNetworkFirewallConfig\":{\"networkFirewallStatelessRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateless-rulegroup/test\",\"priority\":1}],\"networkFirewallStatelessDefaultActions\":[\"aws:forward_to_sfe\",\"customActionName\"],\"networkFirewallStatelessFragmentDefaultActions\":[\"aws:forward_to_sfe\",\"customActionName\"],\"networkFirewallStatelessCustomActions\":[{\"actionName\":\"customActionName\",\"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"metricdimensionvalue\"}]}}}],\"networkFirewallStatefulRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateful-rulegroup/test\"}],\"networkFirewallLoggingConfiguration\":{\"logDestinationConfigs\":[{\"logDestinationType\":\"S3\",\"logType\":\"ALERT\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}},{\"logDestinationType\":\"S3\",\"logType\":\"FLOW\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}}],\"overrideExistingConfig\":true}},\"firewallDeploymentModel\":{\"centralizedFirewallDeploymentModel\":{\"centralizedFirewallOrchestrationConfig\":{\"inspectionVpcIds\":[{\"resourceId\":\"vpc-1234\",\"accountId\":\"123456789011\"}],\"firewallCreationConfig\":{\"endpointLocation\":{\"availabilityZoneConfigList\":[{\"availabilityZoneId\":null,\"availabilityZoneName\":\"us-east-1a\",\"allowedIPV4CidrList\":[\"10.0.0.0/28\"]}]}},\"allowedIPV4CidrList\":[]}}}}", //lintignore:AWSAT003,AWSAT005
+			want:     "{\"type\":\"NETWORK_FIREWALL\",\"awsNetworkFirewallConfig\":{\"networkFirewallStatelessRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateless-rulegroup/test\",\"priority\":1}],\"networkFirewallStatelessDefaultActions\":[\"aws:forward_to_sfe\",\"customActionName\"],\"networkFirewallStatelessFragmentDefaultActions\":[\"aws:forward_to_sfe\",\"customActionName\"],\"networkFirewallStatelessCustomActions\":[{\"actionName\":\"customActionName\",\"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"metricdimensionvalue\"}]}}}],\"networkFirewallStatefulRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateful-rulegroup/test\"}],\"networkFirewallLoggingConfiguration\":{\"logDestinationConfigs\":[{\"logDestinationType\":\"S3\",\"logType\":\"ALERT\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}},{\"logDestinationType\":\"S3\",\"logType\":\"FLOW\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}}],\"overrideExistingConfig\":true}},\"firewallDeploymentModel\":{\"centralizedFirewallDeploymentModel\":{\"centralizedFirewallOrchestrationConfig\":{\"inspectionVpcIds\":[{\"resourceId\":\"vpc-1234\",\"accountId\":\"123456789011\"}],\"firewallCreationConfig\":{\"endpointLocation\":{\"availabilityZoneConfigList\":[{\"availabilityZoneName\":\"us-east-1a\",\"allowedIPV4CidrList\":[\"10.0.0.0/28\"]}]}}}}}}",                                                        //lintignore:AWSAT003,AWSAT005
+		},
+	}
+
+	for _, testCase := range testCases {
+		testCase := testCase
+		t.Run(testCase.testName, func(t *testing.T) {
+			t.Parallel()
+
+			if got, want := tffms.RemoveEmptyFieldsFromJSON(testCase.input), testCase.want; got != want {
+				t.Errorf("RemoveEmptyFieldsFromJSON(%q) = %q, want %q", testCase.input, got, want)
+			}
+		})
+	}
+}
diff --git a/internal/service/fms/policy.go b/internal/service/fms/policy.go
index d96eb87a01f..62e0a91ca9f 100644
--- a/internal/service/fms/policy.go
+++ b/internal/service/fms/policy.go
@@ -1,16 +1,20 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package fms
 
 import (
 	"context"
 	"log"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/fms"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/structure"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
@@ -23,7 +27,7 @@ import (
 
 // @SDKResource("aws_fms_policy", name="Policy")
 // @Tags(identifierAttribute="arn")
-func ResourcePolicy() *schema.Resource {
+func resourcePolicy() *schema.Resource {
 	return &schema.Resource{
 		CreateWithoutTimeout: resourcePolicyCreate,
 		ReadWithoutTimeout:   resourcePolicyRead,
@@ -124,7 +128,7 @@ func ResourcePolicy() *schema.Resource {
 				Type:          schema.TypeString,
 				Optional:      true,
 				Computed:      true,
-				ValidateFunc:  validation.StringMatch(regexp.MustCompile(`^([\p{L}\p{Z}\p{N}_.:/=+\-@]*)$`), "must match a supported resource type, such as AWS::EC2::VPC, see also: https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_Policy.html"),
+				ValidateFunc:  validation.StringMatch(regexache.MustCompile(`^([\p{L}\p{Z}\p{N}_.:/=+\-@]*)$`), "must match a supported resource type, such as AWS::EC2::VPC, see also: https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_Policy.html"),
 				ConflictsWith: []string{"resource_type_list"},
 			},
 			"resource_type_list": {
@@ -133,7 +137,7 @@ func ResourcePolicy() *schema.Resource {
 				Computed: true,
 				Elem: &schema.Schema{
 					Type:         schema.TypeString,
-					ValidateFunc: validation.StringMatch(regexp.MustCompile(`^([\p{L}\p{Z}\p{N}_.:/=+\-@]*)$`), "must match a supported resource type, such as AWS::EC2::VPC, see also: https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_Policy.html"),
+					ValidateFunc: validation.StringMatch(regexache.MustCompile(`^([\p{L}\p{Z}\p{N}_.:/=+\-@]*)$`), "must match a supported resource type, such as AWS::EC2::VPC, see also: https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_Policy.html"),
 				},
 				ConflictsWith: []string{"resource_type"},
 			},
@@ -144,9 +148,52 @@ func ResourcePolicy() *schema.Resource {
 				Elem: &schema.Resource{
 					Schema: map[string]*schema.Schema{
 						"managed_service_data": {
-							Type:             schema.TypeString,
-							Optional:         true,
-							DiffSuppressFunc: verify.SuppressEquivalentJSONDiffs,
+							Type:                  schema.TypeString,
+							Optional:              true,
+							ValidateFunc:          validation.StringIsJSON,
+							DiffSuppressFunc:      suppressEquivalentManagedServiceDataJSON,
+							DiffSuppressOnRefresh: true,
+							StateFunc: func(v interface{}) string {
+								json, _ := structure.NormalizeJsonString(v)
+								return json
+							},
+						},
+						"policy_option": {
+							Type:     schema.TypeList,
+							Optional: true,
+							MaxItems: 1,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"network_firewall_policy": {
+										Type:     schema.TypeList,
+										Optional: true,
+										MaxItems: 1,
+										Elem: &schema.Resource{
+											Schema: map[string]*schema.Schema{
+												"firewall_deployment_model": {
+													Type:         schema.TypeString,
+													Optional:     true,
+													ValidateFunc: validation.StringInSlice(fms.FirewallDeploymentModel_Values(), false),
+												},
+											},
+										},
+									},
+									"third_party_firewall_policy": {
+										Type:     schema.TypeList,
+										Optional: true,
+										MaxItems: 1,
+										Elem: &schema.Resource{
+											Schema: map[string]*schema.Schema{
+												"firewall_deployment_model": {
+													Type:         schema.TypeString,
+													Optional:     true,
+													ValidateFunc: validation.StringInSlice(fms.FirewallDeploymentModel_Values(), false),
+												},
+											},
+										},
+									},
+								},
+							},
 						},
 						"type": {
 							Type:     schema.TypeString,
@@ -185,7 +232,7 @@ func resourcePolicyRead(ctx context.Context, d *schema.ResourceData, meta interf
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).FMSConn(ctx)
 
-	output, err := FindPolicyByID(ctx, conn, d.Id())
+	output, err := findPolicyByID(ctx, conn, d.Id())
 
 	if !d.IsNewResource() && tfresource.NotFound(err) {
 		log.Printf("[WARN] FMS Policy %s not found, removing from state", d.Id())
@@ -219,9 +266,10 @@ func resourcePolicyRead(ctx context.Context, d *schema.ResourceData, meta interf
 	if err := d.Set("resource_type_list", policy.ResourceTypeList); err != nil {
 		sdkdiag.AppendErrorf(diags, "setting resource_type_list: %s", err)
 	}
-	securityServicePolicy := []map[string]string{{
+	securityServicePolicy := []map[string]interface{}{{
 		"type":                 aws.StringValue(policy.SecurityServicePolicyData.Type),
 		"managed_service_data": aws.StringValue(policy.SecurityServicePolicyData.ManagedServiceData),
+		"policy_option":        flattenPolicyOption(policy.SecurityServicePolicyData.PolicyOption),
 	}}
 	if err := d.Set("security_service_policy_data", securityServicePolicy); err != nil {
 		sdkdiag.AppendErrorf(diags, "setting security_service_policy_data: %s", err)
@@ -270,7 +318,7 @@ func resourcePolicyDelete(ctx context.Context, d *schema.ResourceData, meta inte
 	return diags
 }
 
-func FindPolicyByID(ctx context.Context, conn *fms.FMS, id string) (*fms.GetPolicyOutput, error) {
+func findPolicyByID(ctx context.Context, conn *fms.FMS, id string) (*fms.GetPolicyOutput, error) {
 	input := &fms.GetPolicyInput{
 		PolicyId: aws.String(id),
 	}
@@ -329,9 +377,59 @@ func resourcePolicyExpandPolicy(d *schema.ResourceData) *fms.Policy {
 		Type:               aws.String(securityServicePolicy["type"].(string)),
 	}
 
+	if v, ok := securityServicePolicy["policy_option"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
+		fmsPolicy.SecurityServicePolicyData.PolicyOption = expandPolicyOption(v[0].(map[string]interface{}))
+	}
+
 	return fmsPolicy
 }
 
+func expandPolicyOption(tfMap map[string]interface{}) *fms.PolicyOption {
+	if tfMap == nil {
+		return nil
+	}
+
+	apiObject := &fms.PolicyOption{}
+
+	if v, ok := tfMap["network_firewall_policy"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
+		apiObject.NetworkFirewallPolicy = expandPolicyOptionNetworkFirewall(v[0].(map[string]interface{}))
+	}
+
+	if v, ok := tfMap["third_party_firewall_policy"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
+		apiObject.ThirdPartyFirewallPolicy = expandPolicyOptionThirdPartyFirewall(v[0].(map[string]interface{}))
+	}
+
+	return apiObject
+}
+
+func expandPolicyOptionNetworkFirewall(tfMap map[string]interface{}) *fms.NetworkFirewallPolicy {
+	if tfMap == nil {
+		return nil
+	}
+
+	apiObject := &fms.NetworkFirewallPolicy{}
+
+	if v, ok := tfMap["firewall_deployment_model"].(string); ok {
+		apiObject.FirewallDeploymentModel = aws.String(v)
+	}
+
+	return apiObject
+}
+
+func expandPolicyOptionThirdPartyFirewall(tfMap map[string]interface{}) *fms.ThirdPartyFirewallPolicy {
+	if tfMap == nil {
+		return nil
+	}
+
+	apiObject := &fms.ThirdPartyFirewallPolicy{}
+
+	if v, ok := tfMap["firewall_deployment_model"].(string); ok {
+		apiObject.FirewallDeploymentModel = aws.String(v)
+	}
+
+	return apiObject
+}
+
 func expandPolicyMap(set []interface{}) map[string][]*string {
 	fmsPolicyMap := map[string][]*string{}
 	if len(set) > 0 {
@@ -372,6 +470,52 @@ func flattenPolicyMap(fmsPolicyMap map[string][]*string) []interface{} {
 	return []interface{}{flatPolicyMap}
 }
 
+func flattenPolicyOption(fmsPolicyOption *fms.PolicyOption) []interface{} {
+	if fmsPolicyOption == nil {
+		return nil
+	}
+
+	tfMap := map[string]interface{}{}
+
+	if v := fmsPolicyOption.NetworkFirewallPolicy; v != nil {
+		tfMap["network_firewall_policy"] = flattenPolicyOptionNetworkFirewall(fmsPolicyOption.NetworkFirewallPolicy)
+	}
+
+	if v := fmsPolicyOption.ThirdPartyFirewallPolicy; v != nil {
+		tfMap["third_party_firewall_policy"] = flattenPolicyOptionThirdPartyFirewall(fmsPolicyOption.ThirdPartyFirewallPolicy)
+	}
+
+	return []interface{}{tfMap}
+}
+
+func flattenPolicyOptionNetworkFirewall(fmsNetworkFirewallPolicy *fms.NetworkFirewallPolicy) []interface{} {
+	if fmsNetworkFirewallPolicy == nil {
+		return nil
+	}
+
+	tfMap := map[string]interface{}{}
+
+	if v := fmsNetworkFirewallPolicy.FirewallDeploymentModel; v != nil {
+		tfMap["firewall_deployment_model"] = aws.StringValue(v)
+	}
+
+	return []interface{}{tfMap}
+}
+
+func flattenPolicyOptionThirdPartyFirewall(fmsThirdPartyFirewallPolicy *fms.ThirdPartyFirewallPolicy) []interface{} {
+	if fmsThirdPartyFirewallPolicy == nil {
+		return nil
+	}
+
+	tfMap := map[string]interface{}{}
+
+	if v := fmsThirdPartyFirewallPolicy.FirewallDeploymentModel; v != nil {
+		tfMap["firewall_deployment_model"] = aws.StringValue(v)
+	}
+
+	return []interface{}{tfMap}
+}
+
 func flattenResourceTags(resourceTags []*fms.ResourceTag) map[string]interface{} {
 	resTags := map[string]interface{}{}
 
diff --git a/internal/service/fms/policy_test.go b/internal/service/fms/policy_test.go
index 8a3935a6f02..686319c73ee 100644
--- a/internal/service/fms/policy_test.go
+++ b/internal/service/fms/policy_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package fms_test
 
 import (
@@ -54,6 +57,34 @@ func testAccPolicy_basic(t *testing.T) {
 	})
 }
 
+func testAccPolicy_disappears(t *testing.T) {
+	ctx := acctest.Context(t)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_fms_policy.test"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckRegion(t, endpoints.UsEast1RegionID)
+			acctest.PreCheckOrganizationsEnabled(ctx, t)
+			acctest.PreCheckOrganizationManagementAccount(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, fms.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckPolicyDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccPolicyConfig_basic(rName, rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckPolicyExists(ctx, resourceName),
+					acctest.CheckResourceDisappears(ctx, acctest.Provider, tffms.ResourcePolicy(), resourceName),
+				),
+				ExpectNonEmptyPlan: true,
+			},
+		},
+	})
+}
+
 func testAccPolicy_cloudFrontDistribution(t *testing.T) {
 	ctx := acctest.Context(t)
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
@@ -154,6 +185,49 @@ func testAccPolicy_update(t *testing.T) {
 	})
 }
 
+func testAccPolicy_policyOption(t *testing.T) {
+	acctest.Skip(t, "PolicyOption not returned from AWS API")
+
+	ctx := acctest.Context(t)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_fms_policy.test"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckOrganizationsEnabled(ctx, t)
+			acctest.PreCheckOrganizationManagementAccount(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, fms.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckPolicyDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccPolicyConfig_policyOption(rName, rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckPolicyExists(ctx, resourceName),
+					acctest.CheckResourceAttrRegionalARNIgnoreRegionAndAccount(resourceName, "arn", "fms", "policy/.+"),
+					resource.TestCheckResourceAttr(resourceName, "delete_unused_fm_managed_resources", "false"),
+					resource.TestCheckResourceAttr(resourceName, "name", rName),
+					resource.TestCheckResourceAttr(resourceName, "security_service_policy_data.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "security_service_policy_data.0.policy_option.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "security_service_policy_data.0.policy_option.0.network_firewall_policy.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "security_service_policy_data.0.policy_option.0.network_firewall_policy.0.firewall_deployment_model", "CENTRALIZED"),
+					resource.TestCheckResourceAttr(resourceName, "security_service_policy_data.0.policy_option.0.third_party_firewall_policy.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "security_service_policy_data.0.policy_option.0.third_party_firewall_policy.0.firewall_deployment_model", "DISTRIBUTED"),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
+				),
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"policy_update_token", "delete_all_policy_resources"},
+			},
+		},
+	})
+}
+
 func testAccPolicy_resourceTags(t *testing.T) {
 	ctx := acctest.Context(t)
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
@@ -226,6 +300,72 @@ func testAccPolicy_tags(t *testing.T) {
 	})
 }
 
+func testAccPolicy_alb(t *testing.T) {
+	ctx := acctest.Context(t)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_fms_policy.test"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckRegion(t, endpoints.UsEast1RegionID)
+			acctest.PreCheckOrganizationsEnabled(ctx, t)
+			acctest.PreCheckOrganizationManagementAccount(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, fms.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckPolicyDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccPolicyConfig_alb(rName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckPolicyExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "name", rName),
+					resource.TestCheckResourceAttr(resourceName, "resource_type", "ResourceTypeList"),
+					resource.TestCheckResourceAttr(resourceName, "resource_type_list.#", "1"),
+					resource.TestCheckTypeSetElemAttr(resourceName, "resource_type_list.*", "AWS::ElasticLoadBalancingV2::LoadBalancer"),
+					resource.TestCheckResourceAttr(resourceName, "security_service_policy_data.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "security_service_policy_data.0.type", "WAFV2"),
+					acctest.CheckResourceAttrJMES(resourceName, "security_service_policy_data.0.managed_service_data", "type", "WAFV2"),
+					acctest.CheckResourceAttrJMES(resourceName, "security_service_policy_data.0.managed_service_data", "defaultAction.type", "ALLOW"),
+				),
+			},
+		},
+	})
+}
+
+func testAccPolicy_securityGroup(t *testing.T) {
+	ctx := acctest.Context(t)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_fms_policy.test"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckRegion(t, endpoints.UsEast1RegionID)
+			acctest.PreCheckOrganizationsEnabled(ctx, t)
+			acctest.PreCheckOrganizationManagementAccount(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, fms.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckPolicyDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccPolicyConfig_securityGroup(rName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckPolicyExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "name", rName),
+					resource.TestCheckResourceAttr(resourceName, "resource_type", "AWS::EC2::SecurityGroup"),
+					resource.TestCheckResourceAttr(resourceName, "security_service_policy_data.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "security_service_policy_data.0.type", "SECURITY_GROUPS_CONTENT_AUDIT"),
+					acctest.CheckResourceAttrJMES(resourceName, "security_service_policy_data.0.managed_service_data", "type", "SECURITY_GROUPS_CONTENT_AUDIT"),
+					acctest.CheckResourceAttrJMES(resourceName, "security_service_policy_data.0.managed_service_data", "securityGroupAction.type", "ALLOW"),
+				),
+			},
+		},
+	})
+}
+
 func testAccCheckPolicyDestroy(ctx context.Context) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		conn := acctest.Provider.Meta().(*conns.AWSClient).FMSConn(ctx)
@@ -271,20 +411,39 @@ func testAccCheckPolicyExists(ctx context.Context, n string) resource.TestCheckF
 	}
 }
 
-const testAccPolicyConfig_baseOrgMgmtAccount = `
-data "aws_caller_identity" "current" {}
+func testAccPolicyConfig_basic(policyName, ruleGroupName string) string {
+	return acctest.ConfigCompose(testAccAdminAccountConfig_basic, fmt.Sprintf(`
+resource "aws_fms_policy" "test" {
+  exclude_resource_tags = false
+  name                  = %[1]q
+  description           = "test description"
+  remediation_enabled   = false
+  resource_type_list    = ["AWS::ElasticLoadBalancingV2::LoadBalancer"]
+
+  exclude_map {
+    account = [data.aws_caller_identity.current.account_id]
+  }
+
+  security_service_policy_data {
+    type                 = "WAF"
+    managed_service_data = "{\"type\": \"WAF\", \"ruleGroups\": [{\"id\":\"${aws_wafregional_rule_group.test.id}\", \"overrideAction\" : {\"type\": \"COUNT\"}}],\"defaultAction\": {\"type\": \"BLOCK\"}, \"overrideCustomerWebACLAssociation\": false}"
+  }
 
-resource "aws_fms_admin_account" "test" {
-  account_id = data.aws_caller_identity.current.account_id
+  depends_on = [aws_fms_admin_account.test]
 }
-`
 
-func testAccPolicyConfig_basic(policyName, ruleGroupName string) string {
-	return acctest.ConfigCompose(testAccPolicyConfig_baseOrgMgmtAccount, fmt.Sprintf(`
+resource "aws_wafregional_rule_group" "test" {
+  metric_name = "MyTest"
+  name        = %[2]q
+}
+`, policyName, ruleGroupName))
+}
+
+func testAccPolicyConfig_policyOption(policyName, ruleGroupName string) string {
+	return acctest.ConfigCompose(testAccAdminAccountConfig_basic, fmt.Sprintf(`
 resource "aws_fms_policy" "test" {
   exclude_resource_tags = false
   name                  = %[1]q
-  description           = "test description"
   remediation_enabled   = false
   resource_type_list    = ["AWS::ElasticLoadBalancingV2::LoadBalancer"]
 
@@ -295,6 +454,16 @@ resource "aws_fms_policy" "test" {
   security_service_policy_data {
     type                 = "WAF"
     managed_service_data = "{\"type\": \"WAF\", \"ruleGroups\": [{\"id\":\"${aws_wafregional_rule_group.test.id}\", \"overrideAction\" : {\"type\": \"COUNT\"}}],\"defaultAction\": {\"type\": \"BLOCK\"}, \"overrideCustomerWebACLAssociation\": false}"
+
+    policy_option {
+      network_firewall_policy {
+        firewall_deployment_model = "CENTRALIZED"
+      }
+
+      third_party_firewall_policy {
+        firewall_deployment_model = "DISTRIBUTED"
+      }
+    }
   }
 
   depends_on = [aws_fms_admin_account.test]
@@ -308,7 +477,9 @@ resource "aws_wafregional_rule_group" "test" {
 }
 
 func testAccPolicyConfig_cloudFrontDistribution(rName string) string {
-	return acctest.ConfigCompose(testAccPolicyConfig_baseOrgMgmtAccount, fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccAdminAccountConfig_basic, fmt.Sprintf(`
+data "aws_partition" "current" {}
+
 resource "aws_fms_policy" "test" {
   exclude_resource_tags = false
   name                  = %[1]q
@@ -368,14 +539,13 @@ resource "aws_iam_role" "test" {
 
 resource "aws_s3_bucket" "test" {
   bucket = %[1]q
-  acl    = "private"
 }
 
 resource "aws_kinesis_firehose_delivery_stream" "test" {
-  name        = %[1]q
-  destination = "s3"
+  name        = "aws-waf-logs-%[1]s"
+  destination = "extended_s3"
 
-  s3_configuration {
+  extended_s3_configuration {
     role_arn   = aws_iam_role.test.arn
     bucket_arn = aws_s3_bucket.test.arn
   }
@@ -384,7 +554,7 @@ resource "aws_kinesis_firehose_delivery_stream" "test" {
 }
 
 func testAccPolicyConfig_updated(policyName, ruleGroupName string) string {
-	return acctest.ConfigCompose(testAccPolicyConfig_baseOrgMgmtAccount, fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccAdminAccountConfig_basic, fmt.Sprintf(`
 resource "aws_fms_policy" "test" {
   exclude_resource_tags = false
   name                  = %[1]q
@@ -415,7 +585,7 @@ resource "aws_wafregional_rule_group" "test" {
 }
 
 func testAccPolicyConfig_include(rName string) string {
-	return acctest.ConfigCompose(testAccPolicyConfig_baseOrgMgmtAccount, fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccAdminAccountConfig_basic, fmt.Sprintf(`
 resource "aws_fms_policy" "test" {
   exclude_resource_tags = false
   name                  = %[1]q
@@ -442,7 +612,7 @@ resource "aws_wafregional_rule_group" "test" {
 }
 
 func testAccPolicyConfig_resourceTags1(rName, tagKey1, tagValue1 string) string {
-	return acctest.ConfigCompose(testAccPolicyConfig_baseOrgMgmtAccount, fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccAdminAccountConfig_basic, fmt.Sprintf(`
 resource "aws_fms_policy" "test" {
   exclude_resource_tags = false
   name                  = %[1]q
@@ -469,7 +639,7 @@ resource "aws_wafregional_rule_group" "test" {
 }
 
 func testAccPolicyConfig_resourceTags2(rName, tagKey1, tagValue1, tagKey2, tagValue2 string) string {
-	return acctest.ConfigCompose(testAccPolicyConfig_baseOrgMgmtAccount, fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccAdminAccountConfig_basic, fmt.Sprintf(`
 resource "aws_fms_policy" "test" {
   exclude_resource_tags = false
   name                  = %[1]q
@@ -497,7 +667,7 @@ resource "aws_wafregional_rule_group" "test" {
 }
 
 func testAccPolicyConfig_tags1(rName, tagKey1, tagValue1 string) string {
-	return acctest.ConfigCompose(testAccPolicyConfig_baseOrgMgmtAccount, fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccAdminAccountConfig_basic, fmt.Sprintf(`
 resource "aws_fms_policy" "test" {
   exclude_resource_tags = false
   name                  = %[1]q
@@ -524,7 +694,7 @@ resource "aws_wafregional_rule_group" "test" {
 }
 
 func testAccPolicyConfig_tags2(rName, tagKey1, tagValue1, tagKey2, tagValue2 string) string {
-	return acctest.ConfigCompose(testAccPolicyConfig_baseOrgMgmtAccount, fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccAdminAccountConfig_basic, fmt.Sprintf(`
 resource "aws_fms_policy" "test" {
   exclude_resource_tags = false
   name                  = %[1]q
@@ -550,3 +720,133 @@ resource "aws_wafregional_rule_group" "test" {
 }
 `, rName, tagKey1, tagValue1, tagKey2, tagValue2))
 }
+
+func testAccPolicyConfig_alb(rName string) string {
+	return acctest.ConfigCompose(testAccAdminAccountConfig_basic, fmt.Sprintf(`
+locals {
+  msd = {
+    type = "WAFV2"
+    preProcessRuleGroups = [
+      {
+        overrideAction = {
+          type = "NONE"
+        }
+        managedRuleGroupIdentifier = {
+          vendorName           = "AWS"
+          managedRuleGroupName = "AWSManagedRulesAmazonIpReputationList"
+          version              = null
+        }
+        ruleGroupArn           = null
+        ruleGroupType          = "ManagedRuleGroup"
+        excludeRules           = null
+        sampledRequestsEnabled = true
+      },
+      {
+        overrideAction = {
+          type = "NONE"
+        },
+        managedRuleGroupIdentifier = {
+          vendorName           = "AWS"
+          managedRuleGroupName = "AWSManagedRulesKnownBadInputsRuleSet"
+          version              = "Version_1.1"
+        },
+        ruleGroupArn           = null
+        ruleGroupType          = "ManagedRuleGroup"
+        excludeRules           = null
+        sampledRequestsEnabled = true
+      }
+    ]
+    postProcessRuleGroups                   = []
+    loggingConfiguration                    = null
+    sampledRequestsEnabledForDefaultActions = true
+    defaultAction = {
+      type = "ALLOW"
+    }
+    overrideCustomerWebACLAssociation = true
+  }
+}
+
+resource "aws_fms_policy" "test" {
+  name = %[1]q
+  resource_tags = {
+    "disable" = ""
+  }
+  exclude_resource_tags       = true
+  remediation_enabled         = true
+  resource_type_list          = ["AWS::ElasticLoadBalancingV2::LoadBalancer"]
+  delete_all_policy_resources = false
+
+  security_service_policy_data {
+    type                 = "WAFV2"
+    managed_service_data = jsonencode(local.msd)
+  }
+
+  depends_on = [aws_fms_admin_account.test]
+}
+`, rName))
+}
+
+func testAccPolicyConfig_securityGroup(rName string) string {
+	return acctest.ConfigCompose(testAccAdminAccountConfig_basic, fmt.Sprintf(`
+resource "aws_vpc" "test" {
+  cidr_block = "10.0.0.0/16"
+
+  tags = {
+    Name = %[1]q
+  }
+}
+
+resource "aws_security_group" "test" {
+  name   = %[1]q
+  vpc_id = aws_vpc.test.id
+
+  tags = {
+    Name = %[1]q
+  }
+
+  ingress {
+    protocol    = "6"
+    from_port   = 80
+    to_port     = 8000
+    cidr_blocks = ["10.0.0.0/8"]
+    description = ""
+  }
+
+  egress {
+    protocol    = "tcp"
+    from_port   = 80
+    to_port     = 8000
+    cidr_blocks = ["10.0.0.0/8"]
+    description = ""
+  }
+}
+
+resource "aws_fms_policy" "test" {
+  name                        = %[1]q
+  delete_all_policy_resources = false
+  exclude_resource_tags       = false
+  remediation_enabled         = false
+  resource_type               = "AWS::EC2::SecurityGroup"
+
+  security_service_policy_data {
+    type = "SECURITY_GROUPS_CONTENT_AUDIT"
+
+    managed_service_data = jsonencode({
+      type = "SECURITY_GROUPS_CONTENT_AUDIT",
+
+      securityGroupAction = {
+        type = "ALLOW"
+      },
+
+      securityGroups = [
+        {
+          id = aws_security_group.test.id
+        }
+      ],
+    })
+  }
+
+  depends_on = [aws_fms_admin_account.test]
+}
+`, rName))
+}
diff --git a/internal/service/fms/service_package.go b/internal/service/fms/service_package.go
index 229468cca72..4cc0bfd776e 100644
--- a/internal/service/fms/service_package.go
+++ b/internal/service/fms/service_package.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package fms
 
 import (
diff --git a/internal/service/fms/service_package_gen.go b/internal/service/fms/service_package_gen.go
index 7fbf282a95e..4445e5de36f 100644
--- a/internal/service/fms/service_package_gen.go
+++ b/internal/service/fms/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	fms_sdkv1 "github.com/aws/aws-sdk-go/service/fms"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -29,11 +30,11 @@ func (p *servicePackage) SDKDataSources(ctx context.Context) []*types.ServicePac
 func (p *servicePackage) SDKResources(ctx context.Context) []*types.ServicePackageSDKResource {
 	return []*types.ServicePackageSDKResource{
 		{
-			Factory:  ResourceAdminAccount,
+			Factory:  resourceAdminAccount,
 			TypeName: "aws_fms_admin_account",
 		},
 		{
-			Factory:  ResourcePolicy,
+			Factory:  resourcePolicy,
 			TypeName: "aws_fms_policy",
 			Name:     "Policy",
 			Tags: &types.ServicePackageResourceTags{
@@ -54,4 +55,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*f
 	return fms_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/fms/tags_gen.go b/internal/service/fms/tags_gen.go
index 4413889d158..740a23368c6 100644
--- a/internal/service/fms/tags_gen.go
+++ b/internal/service/fms/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/fms"
 	"github.com/aws/aws-sdk-go/service/fms/fmsiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -102,6 +104,8 @@ func updateTags(ctx context.Context, conn fmsiface.FMSAPI, identifier string, ol
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.FMS)
 	if len(removedTags) > 0 {
diff --git a/internal/service/fms/ujson/LICENSE b/internal/service/fms/ujson/LICENSE
new file mode 100644
index 00000000000..f57b29a5092
--- /dev/null
+++ b/internal/service/fms/ujson/LICENSE
@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2020 Oliver N
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/internal/service/fms/ujson/quote.go b/internal/service/fms/ujson/quote.go
new file mode 100644
index 00000000000..8a25bbb324d
--- /dev/null
+++ b/internal/service/fms/ujson/quote.go
@@ -0,0 +1,90 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+package ujson
+
+import (
+	"bytes"
+	"strconv"
+	"unicode/utf8"
+	"unsafe"
+)
+
+// ErrSyntax indicates that the value has invalid syntax.
+var ErrSyntax = strconv.ErrSyntax
+
+// AppendQuote appends a double-quoted string valid for json key and value, to
+// dst and returns the extended buffer.
+func AppendQuote(dst []byte, s []byte) []byte {
+	return strconv.AppendQuote(dst, unsafeBytesToString(s))
+}
+
+// AppendQuoteToASCII appends a double-quoted string valid for json key and
+// value, to dst and returns the extended buffer.
+func AppendQuoteToASCII(dst []byte, s []byte) []byte {
+	return strconv.AppendQuoteToASCII(dst, unsafeBytesToString(s))
+}
+
+// AppendQuoteToGraphic appends a double-quoted string valid for json key and
+// value, to dst and returns the extended buffer.
+func AppendQuoteToGraphic(dst []byte, s []byte) []byte {
+	return strconv.AppendQuoteToGraphic(dst, unsafeBytesToString(s))
+}
+
+// AppendQuoteString returns a double-quoted string valid for json key or value.
+func AppendQuoteString(dst []byte, s string) []byte {
+	return strconv.AppendQuote(dst, s)
+}
+
+// Unquote decodes a double-quoted string key or value to retrieve the
+// original string value. It will avoid allocation whenever possible.
+//
+// The code is inspired by strconv.Unquote, but only accepts valid json string.
+func Unquote(s []byte) ([]byte, error) {
+	n := len(s)
+	if n < 2 {
+		return nil, ErrSyntax
+	}
+	if s[0] != '"' || s[n-1] != '"' {
+		return nil, ErrSyntax
+	}
+	s = s[1 : n-1]
+	if bytes.IndexByte(s, '\n') != -1 {
+		return nil, ErrSyntax
+	}
+
+	// avoid allocation if the string is trivial
+	if bytes.IndexByte(s, '\\') == -1 {
+		if utf8.Valid(s) {
+			return s, nil
+		}
+	}
+
+	// the following code is taken from strconv.Unquote (with modification)
+	var runeTmp [utf8.UTFMax]byte
+	buf := make([]byte, 0, 3*len(s)/2) // Try to avoid more allocations.
+	for len(s) > 0 {
+		// Convert []byte to string for satisfying UnquoteChar. We won't keep
+		// the retured string, so it's safe to use unsafe here.
+		c, multibyte, tail, err := strconv.UnquoteChar(unsafeBytesToString(s), '"')
+		if err != nil {
+			return nil, err
+		}
+
+		// UnquoteChar returns tail as the remaining unprocess string. Because
+		// we are processing []byte, we use len(tail) to get the remaining bytes
+		// instead.
+		s = s[len(s)-len(tail):]
+		if c < utf8.RuneSelf || !multibyte {
+			buf = append(buf, byte(c))
+		} else {
+			n = utf8.EncodeRune(runeTmp[:], c)
+			buf = append(buf, runeTmp[:n]...)
+		}
+	}
+	return buf, nil
+}
+
+//go:nosplit
+func unsafeBytesToString(b []byte) string {
+	return *(*string)(unsafe.Pointer(&b))
+}
diff --git a/internal/service/fms/ujson/quote_test.go b/internal/service/fms/ujson/quote_test.go
new file mode 100644
index 00000000000..e0ec6064b45
--- /dev/null
+++ b/internal/service/fms/ujson/quote_test.go
@@ -0,0 +1,162 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package ujson_test
+
+import (
+	"errors"
+	"testing"
+
+	"github.com/hashicorp/terraform-provider-aws/internal/service/fms/ujson"
+)
+
+type quoteTest struct {
+	in      string
+	out     string
+	ascii   string
+	graphic string
+}
+
+var quotetests = []quoteTest{
+	{"\a\b\f\r\n\t\v", `"\a\b\f\r\n\t\v"`, `"\a\b\f\r\n\t\v"`, `"\a\b\f\r\n\t\v"`},
+	{"\\", `"\\"`, `"\\"`, `"\\"`},
+	{"abc\xffdef", `"abc\xffdef"`, `"abc\xffdef"`, `"abc\xffdef"`},
+	{"\u263a", `"☺"`, `"\u263a"`, `"☺"`},
+	{"\U0010ffff", `"\U0010ffff"`, `"\U0010ffff"`, `"\U0010ffff"`},
+	{"\x04", `"\x04"`, `"\x04"`, `"\x04"`},
+	// Some non-printable but graphic runes. Final column is double-quoted.
+	{"!\u00a0!\u2000!\u3000!", `"!\u00a0!\u2000!\u3000!"`, `"!\u00a0!\u2000!\u3000!"`, "\"!\u00a0!\u2000!\u3000!\""},
+}
+
+func TestQuote(t *testing.T) {
+	t.Parallel()
+
+	for _, tt := range quotetests {
+		if out := ujson.AppendQuote([]byte("abc"), []byte(tt.in)); string(out) != "abc"+tt.out {
+			t.Errorf("AppendQuote(%q, %s) = %s, want %s", "abc", tt.in, out, "abc"+tt.out)
+		}
+	}
+}
+
+func TestQuoteToASCII(t *testing.T) {
+	t.Parallel()
+
+	for _, tt := range quotetests {
+		if out := ujson.AppendQuoteToASCII([]byte("abc"), []byte(tt.in)); string(out) != "abc"+tt.ascii {
+			t.Errorf("AppendQuoteToASCII(%q, %s) = %s, want %s", "abc", tt.in, out, "abc"+tt.ascii)
+		}
+	}
+}
+
+func TestQuoteToGraphic(t *testing.T) {
+	t.Parallel()
+
+	for _, tt := range quotetests {
+		if out := ujson.AppendQuoteToGraphic([]byte("abc"), []byte(tt.in)); string(out) != "abc"+tt.graphic {
+			t.Errorf("AppendQuoteToGraphic(%q, %s) = %s, want %s", "abc", tt.in, out, "abc"+tt.graphic)
+		}
+	}
+}
+
+type unQuoteTest struct {
+	in  string
+	out string
+}
+
+var unquotetests = []unQuoteTest{
+	{`""`, ""},
+	{`"a"`, "a"},
+	{`"abc"`, "abc"},
+	{`"☺"`, "☺"},
+	{`"hello world"`, "hello world"},
+	{`"\xFF"`, "\xFF"},
+	{`"\377"`, "\377"},
+	{`"\u1234"`, "\u1234"},
+	{`"\U00010111"`, "\U00010111"},
+	{`"\U0001011111"`, "\U0001011111"},
+	{`"\a\b\f\n\r\t\v\\\""`, "\a\b\f\n\r\t\v\\\""},
+	{`"'"`, "'"},
+}
+
+var misquoted = []string{
+	``,
+	`"`,
+	`"a`,
+	`"'`,
+	`b"`,
+	`"\"`,
+	`"\9"`,
+	`"\19"`,
+	`"\129"`,
+	`'\'`,
+	`'\9'`,
+	`'\19'`,
+	`'\129'`,
+	`'ab'`,
+	`"\x1!"`,
+	`"\U12345678"`,
+	`"\z"`,
+	"`",
+	"`xxx",
+	"`\"",
+	`"\'"`,
+	`'\"'`,
+	"\"\n\"",
+	"\"\\n\n\"",
+	"'\n'",
+}
+
+func TestUnquote(t *testing.T) {
+	t.Parallel()
+
+	for _, tt := range unquotetests {
+		if out, err := ujson.Unquote([]byte(tt.in)); err != nil || string(out) != tt.out {
+			t.Errorf("Unquote(%#q) = %q, %v want %q, nil", tt.in, out, err, tt.out)
+		}
+	}
+
+	// run the quote tests too, backward
+	for _, tt := range quotetests {
+		if in, err := ujson.Unquote([]byte(tt.out)); string(in) != tt.in {
+			t.Errorf("Unquote(%#q) = %q, %v, want %q, nil", tt.out, in, err, tt.in)
+		}
+	}
+
+	for _, s := range misquoted {
+		if out, err := ujson.Unquote([]byte(s)); out != nil || !errors.Is(err, ujson.ErrSyntax) {
+			t.Errorf("Unquote(%#q) = %q, %v want %q, %v", s, out, err, "", ujson.ErrSyntax)
+		}
+	}
+}
+
+// Issue 23685: invalid UTF-8 should not go through the fast path.
+func TestUnquoteInvalidUTF8(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		in string
+
+		// one of:
+		want    string
+		wantErr string
+	}{
+		{in: `"foo"`, want: "foo"},
+		{in: `"foo`, wantErr: "invalid syntax"},
+		{in: `"` + "\xc0" + `"`, want: "\xef\xbf\xbd"},
+		{in: `"a` + "\xc0" + `"`, want: "a\xef\xbf\xbd"},
+		{in: `"\t` + "\xc0" + `"`, want: "\t\xef\xbf\xbd"},
+	}
+	for i, tt := range tests {
+		got, err := ujson.Unquote([]byte(tt.in))
+		var gotErr string
+		if err != nil {
+			gotErr = err.Error()
+		}
+		if gotErr != tt.wantErr {
+			t.Errorf("%d. Unquote(%q) = err %v; want %q", i, tt.in, err, tt.wantErr)
+		}
+		if tt.wantErr == "" && err == nil && string(got) != tt.want {
+			t.Errorf("%d. Unquote(%q) = %02x; want %02x", i, tt.in, got, []byte(tt.want))
+		}
+	}
+}
diff --git "a/internal/service/fms/ujson/\302\265json.go" "b/internal/service/fms/ujson/\302\265json.go"
new file mode 100644
index 00000000000..45ca81e1945
--- /dev/null
+++ "b/internal/service/fms/ujson/\302\265json.go"
@@ -0,0 +1,227 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+// Package ujson implements a fast and minimal JSON parser and transformer that
+// works on unstructured json. Example use cases:
+//
+//  1. Walk through unstructured json:
+//     - Print all keys and values
+//     - Extract some values
+//  2. Transform unstructured json:
+//     - Remove all spaces
+//     - Reformat
+//     - Remove blacklist fields
+//     - Wrap int64 in string for processing by JavaScript
+//
+// without fully unmarshalling it into a map[string]interface{}
+//
+// CAUTION: Behaviour is undefined on invalid json. Use on trusted input only.
+//
+// The single most important function is "Walk()", which parses the given json
+// and call callback function for each key/value pair processed.
+//
+//	{
+//	    "id": 12345,
+//	    "name": "foo",
+//	    "numbers": ["one", "two"],
+//	    "tags": {"color": "red", "priority": "high"},
+//	    "active": true
+//	}
+//
+// Calling "Walk()" with the above input will produce:
+//
+//	| level | key        | value   |
+//	|-------|------------|---------|
+//	|   0   |            | {       |
+//	|   1   | "id"       | 12345   |
+//	|   1   | "name"     | "foo"   |
+//	|   1   | "numbers"  | [       |
+//	|   2   |            | "one"   |
+//	|   2   |            | "two"   |
+//	|   1   |            | ]       |
+//	|   1   | "tags"     | {       |
+//	|   2   | "color"    | "red"   |
+//	|   2   | "priority" | "high"  |
+//	|   1   |            | }       |
+//	|   1   | "active"   | true    |
+//	|   0   |            | }       |
+//
+// "level" indicates the indentation of the key/value pair as if the json is
+// formatted properly. Keys and values are provided as raw literal. Strings are
+// always double-quoted. To get the original string, use "Unquote".
+//
+// "value" will never be empty (for valid json). You can test the first byte
+// ("value[0]") to get its type:
+//
+//   - 'n'     : Null ("null")
+//   - 'f', 't': Boolean ("false", "true")
+//   - '0'-'9' : Number
+//   - '"'     : String, see "Unquote"
+//   - '[', ']': Array
+//   - '{', '}': Object
+//
+// When processing arrays and objects, first the open bracket ("[", "{") will be
+// provided as "value", followed by its children, and finally the close bracket
+// ("]", "}"). When encountering open brackets, you can make the callback
+// function return "false" to skip the array/object entirely.
+package ujson
+
+import "fmt"
+
+// Walk parses the given json and call "callback" for each key/value pair. See
+// examples for sample callback params.
+//
+// The function "callback":
+//
+//   - may convert key and value to string for processing
+//   - may return false to skip processing the current object or array
+//   - must not modify any slice it receives.
+func Walk(input []byte, callback func(level int, key, value []byte) bool) error {
+	var key []byte
+	i, si, ei, st, sst := 0, 0, 0, 0, 1024
+
+	// trim the last newline
+	if len(input) > 0 && input[len(input)-1] == '\n' {
+		input = input[:len(input)-1]
+	}
+
+value:
+	si = i
+	switch input[i] {
+	case 'n', 't': // null, true
+		i += 4
+		ei = i
+		if st <= sst {
+			callback(st, key, input[si:i])
+		}
+		key = nil
+		goto closing
+	case 'f': // false
+		i += 5
+		ei = i
+		if st <= sst {
+			callback(st, key, input[si:i])
+		}
+		key = nil
+		goto closing
+	case '{', '[':
+		if st <= sst && !callback(st, key, input[i:i+1]) {
+			sst = st
+		}
+		key = nil
+		st++
+		i++
+		if input[i] == '}' || input[i] == ']' {
+			goto closing
+		}
+		goto value
+	case '"': // scan string
+		for {
+			i++
+			switch input[i] {
+			case '\\': // \. - skip 2
+				i++
+			case '"': // end of string
+				i++
+				ei = i // space, ignore
+				for input[i] == ' ' ||
+					input[i] == '\t' ||
+					input[i] == '\n' ||
+					input[i] == '\r' {
+					i++
+				}
+				if input[i] != ':' {
+					if st <= sst {
+						callback(st, key, input[si:ei])
+					}
+					key = nil
+				}
+				goto closing
+			}
+		}
+	case ' ', '\t', '\n', '\r': // space, ignore
+		i++
+		goto value
+	default: // scan number
+		for i < len(input) {
+			switch input[i] {
+			case ',', '}', ']', ' ', '\t', '\n', '\r':
+				ei = i
+				for input[i] == ' ' ||
+					input[i] == '\t' ||
+					input[i] == '\n' ||
+					input[i] == '\r' {
+					i++
+				}
+				if st <= sst {
+					callback(st, key, input[si:ei])
+				}
+				key = nil
+				goto closing
+			}
+			i++
+		}
+	}
+
+closing:
+	if i >= len(input) {
+		return nil
+	}
+	switch input[i] {
+	case ':':
+		key = input[si:ei]
+		i++
+		goto value
+	case ',':
+		i++
+		goto value
+	case ']', '}':
+		st--
+		if st == sst {
+			sst = 1024
+		} else if st < sst {
+			callback(st, nil, input[i:i+1])
+		}
+		if st <= 0 {
+			return nil
+		}
+		i++
+		goto closing
+	case ' ', '\t', '\n', '\r':
+		i++ // space, ignore
+		goto closing
+	default:
+		return parseError(i, input[i], `expect ']', '}' or ','`)
+	}
+}
+
+func parseError(i int, c byte, msg string) error {
+	return fmt.Errorf("µjson: error at %v '%c' 0x%2x: %v", i, c, c, msg)
+}
+
+// ShouldAddComma decides if a comma should be appended while constructing
+// output json. See Reconstruct for an example of rebuilding the json.
+func ShouldAddComma(value []byte, lastChar byte) bool {
+	// for valid json, the value will never be empty, so we can safely test only
+	// the first byte
+	return value[0] != '}' && value[0] != ']' &&
+		lastChar != ',' && lastChar != '{' && lastChar != '['
+}
+
+// Reconstruct walks through the input json and rebuild it. It's put here as an
+// example of using Walk.
+func Reconstruct(input []byte) ([]byte, error) {
+	b := make([]byte, 0, len(input))
+	err := Walk(input, func(st int, key, value []byte) bool {
+		if len(b) != 0 && ShouldAddComma(value, b[len(b)-1]) {
+			b = append(b, ',')
+		}
+		if len(key) > 0 {
+			b = append(b, key...)
+			b = append(b, ':')
+		}
+		b = append(b, value...)
+		return true
+	})
+	return b, err
+}
diff --git "a/internal/service/fms/ujson/\302\265json_test.go" "b/internal/service/fms/ujson/\302\265json_test.go"
new file mode 100644
index 00000000000..8f84077c0d5
--- /dev/null
+++ "b/internal/service/fms/ujson/\302\265json_test.go"
@@ -0,0 +1,360 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package ujson
+
+import (
+	"fmt"
+	"strings"
+	"testing"
+)
+
+func TestWalk(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		input    string
+		expected string
+	}{
+		{
+			`null`,
+			`
+0  null`,
+		},
+		{
+			"null\n", // end with newline
+			`
+0  null`,
+		},
+		{
+			`{}`,
+			`
+0  {
+0  }`,
+		},
+		{
+			`{"foo":""}`,
+			`
+0  {
+1 "foo" ""
+0  }`,
+		},
+		{
+			`{"foo": ""}`, // Space
+			`
+0  {
+1 "foo" ""
+0  }`,
+		},
+		{
+			`{"foo":"bar"}`,
+			`
+0  {
+1 "foo" "bar"
+0  }`,
+		},
+		{
+			`{"foo":"bar","baz":""}`,
+			`
+0  {
+1 "foo" "bar"
+1 "baz" ""
+0  }`,
+		},
+		{
+			`{ "foo" : "bar" , "baz" : 2 }`, // Space
+			`
+0  {
+1 "foo" "bar"
+1 "baz" 2
+0  }`,
+		},
+		{
+			`{"foo":null}`,
+			`
+0  {
+1 "foo" null
+0  }`,
+		},
+		{
+			`{"foo":123}`,
+			`
+0  {
+1 "foo" 123
+0  }`,
+		},
+		{
+			`{"foo":-123}`,
+			`
+0  {
+1 "foo" -123
+0  }`,
+		},
+		{
+			`{"foo":42.1}`,
+			`
+0  {
+1 "foo" 42.1
+0  }`,
+		},
+		{
+			`{"foo":+0}`,
+			`
+0  {
+1 "foo" +0
+0  }`,
+		},
+		{
+			`{"foo":"b\"ar"}`,
+			`
+0  {
+1 "foo" "b\"ar"
+0  }`,
+		},
+		{
+			`{"😀":"🎶\""}`,
+			`
+0  {
+1 "😀" "🎶\""
+0  }`,
+		},
+		{
+			`{"foo":{}}`,
+			`
+0  {
+1 "foo" {
+1  }
+0  }`,
+		},
+		{
+			`{"foo":{"bar":false,"baz":true,"quix":null}}`,
+			`
+0  {
+1 "foo" {
+2 "bar" false
+2 "baz" true
+2 "quix" null
+1  }
+0  }`,
+		},
+		{
+			`{"1":{"1.1":{"1.1.1":"foo","1.1.2":"bar"},"1.2":{"1.2.1":"baz"}}}`,
+			`
+0  {
+1 "1" {
+2 "1.1" {
+3 "1.1.1" "foo"
+3 "1.1.2" "bar"
+2  }
+2 "1.2" {
+3 "1.2.1" "baz"
+2  }
+1  }
+0  }`,
+		},
+		{
+			`[]`,
+			`
+0  [
+0  ]`,
+		},
+		{
+			`[null]`,
+			`
+0  [
+1  null
+0  ]`,
+		},
+		{
+			`[0]`,
+			`
+0  [
+1  0
+0  ]`,
+		},
+		{
+			`["foo"]`,
+			`
+0  [
+1  "foo"
+0  ]`,
+		},
+		{
+			`["",""]`,
+			`
+0  [
+1  ""
+1  ""
+0  ]`,
+		},
+		{
+			`["foo","bar"]`,
+			`
+0  [
+1  "foo"
+1  "bar"
+0  ]`,
+		},
+		{
+			`[[]]`,
+			`
+0  [
+1  [
+1  ]
+0  ]`,
+		},
+		{
+			`[{},[]]`,
+			`
+0  [
+1  {
+1  }
+1  [
+1  ]
+0  ]`,
+		},
+		{
+			`{"foo":[]}`,
+			`
+0  {
+1 "foo" [
+1  ]
+0  }`,
+		},
+		{
+			`{"foo":[{"k":"v"}]}`,
+			`
+0  {
+1 "foo" [
+2  {
+3 "k" "v"
+2  }
+1  ]
+0  }`,
+		},
+		{
+			`{"foo":[{"k1":"v1","k2":"v2"}]}`,
+			`
+0  {
+1 "foo" [
+2  {
+3 "k1" "v1"
+3 "k2" "v2"
+2  }
+1  ]
+0  }`,
+		},
+		{
+			`{"foo":[{"k1.1":"v1.1","k1.2":"v1.2"},{"k2.1":"v2.1"}],"bar":{}}`,
+			`
+0  {
+1 "foo" [
+2  {
+3 "k1.1" "v1.1"
+3 "k1.2" "v1.2"
+2  }
+2  {
+3 "k2.1" "v2.1"
+2  }
+1  ]
+1 "bar" {
+1  }
+0  }`,
+		},
+		{
+			`{"1":[{"2":{"k1":"v1","k2":"v2"}}]}`,
+			`
+0  {
+1 "1" [
+2  {
+3 "2" {
+4 "k1" "v1"
+4 "k2" "v2"
+3  }
+2  }
+1  ]
+0  }`,
+		},
+		{
+			`{"1":[{"2":[{"k1":"v1","k2":"v2"},{"k3":"v3"}]}]}`,
+			`
+0  {
+1 "1" [
+2  {
+3 "2" [
+4  {
+5 "k1" "v1"
+5 "k2" "v2"
+4  }
+4  {
+5 "k3" "v3"
+4  }
+3  ]
+2  }
+1  ]
+0  }`,
+		},
+		{
+			`{ "1" : [ { "2": [ { "k1" : "v1" , "k2" : "v2" } ,{"k3":"v3" } ] } ] }`,
+			`
+0  {
+1 "1" [
+2  {
+3 "2" [
+4  {
+5 "k1" "v1"
+5 "k2" "v2"
+4  }
+4  {
+5 "k3" "v3"
+4  }
+3  ]
+2  }
+1  ]
+0  }`,
+		},
+	}
+
+	for _, tt := range tests {
+		tt := tt
+		t.Run("Walk/"+tt.input, func(t *testing.T) {
+			t.Parallel()
+
+			var b strings.Builder
+			err := Walk([]byte(tt.input),
+				func(st int, key, value []byte) bool {
+					fmt.Fprintf(&b, "\n%v %s %s", st, key, value)
+					return true
+				})
+			if err != nil {
+				t.Error(err)
+			} else if b.String() != tt.expected {
+				t.Errorf("\nExpect: `%v`\nOutput: `%v`\n", tt.expected, b.String())
+			}
+		})
+	}
+
+	for _, tt := range tests {
+		tt := tt
+		t.Run("Reconstruct/"+tt.input, func(t *testing.T) {
+			t.Parallel()
+
+			// Handle the special testcase ending with newline. This test
+			// reconstructs output json and compare with the input. Because
+			// reconstruct will not append the last newline, so we must trim it
+			// before comparing.
+			expected := tt.input
+			if expected[len(expected)-1] == '\n' {
+				expected = expected[:len(expected)-1]
+			}
+			expected = strings.Replace(expected, " ", "", -1)
+
+			data, err := Reconstruct([]byte(tt.input))
+			if err != nil {
+				t.Error(err)
+			} else if s := string(data); s != expected {
+				t.Errorf("\nExpect: %v\nOutput: %v\n", expected, s)
+			}
+		})
+	}
+}
diff --git a/internal/service/fsx/backup.go b/internal/service/fsx/backup.go
index 5554a5e36bf..6d1375a4d74 100644
--- a/internal/service/fsx/backup.go
+++ b/internal/service/fsx/backup.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package fsx
 
 import (
diff --git a/internal/service/fsx/backup_test.go b/internal/service/fsx/backup_test.go
index 75a65fd1c7a..1b988a8fadd 100644
--- a/internal/service/fsx/backup_test.go
+++ b/internal/service/fsx/backup_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package fsx_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"strings"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/fsx"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -33,7 +36,7 @@ func TestAccFSxBackup_basic(t *testing.T) {
 				Config: testAccBackupConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBackupExists(ctx, resourceName, &backup),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "fsx", regexp.MustCompile(`backup/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "fsx", regexache.MustCompile(`backup/.+`)),
 					acctest.CheckResourceAttrAccountID(resourceName, "owner_id"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 				),
@@ -65,7 +68,7 @@ func TestAccFSxBackup_ontapBasic(t *testing.T) {
 				Config: testAccBackupConfig_ontapBasic(rName, vName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBackupExists(ctx, resourceName, &backup),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "fsx", regexp.MustCompile(`backup/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "fsx", regexache.MustCompile(`backup/.+`)),
 					acctest.CheckResourceAttrAccountID(resourceName, "owner_id"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 				),
@@ -95,7 +98,7 @@ func TestAccFSxBackup_openzfsBasic(t *testing.T) {
 				Config: testAccBackupConfig_openZFSBasic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBackupExists(ctx, resourceName, &backup),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "fsx", regexp.MustCompile(`backup/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "fsx", regexache.MustCompile(`backup/.+`)),
 					acctest.CheckResourceAttrAccountID(resourceName, "owner_id"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 				),
@@ -125,7 +128,7 @@ func TestAccFSxBackup_windowsBasic(t *testing.T) {
 				Config: testAccBackupConfig_windowsBasic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBackupExists(ctx, resourceName, &backup),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "fsx", regexp.MustCompile(`backup/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "fsx", regexache.MustCompile(`backup/.+`)),
 					acctest.CheckResourceAttrAccountID(resourceName, "owner_id"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 				),
diff --git a/internal/service/fsx/common_schema_data_source.go b/internal/service/fsx/common_schema_data_source.go
index bb6c07a515f..e471b2490ff 100644
--- a/internal/service/fsx/common_schema_data_source.go
+++ b/internal/service/fsx/common_schema_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package fsx
 
 import (
@@ -42,3 +45,41 @@ func DataSourceSnapshotFiltersSchema() *schema.Schema {
 		},
 	}
 }
+
+func BuildStorageVirtualMachineFiltersDataSource(set *schema.Set) []*fsx.StorageVirtualMachineFilter {
+	var filters []*fsx.StorageVirtualMachineFilter
+	for _, v := range set.List() {
+		m := v.(map[string]interface{})
+		var filterValues []*string
+		for _, e := range m["values"].([]interface{}) {
+			filterValues = append(filterValues, aws.String(e.(string)))
+		}
+
+		filters = append(filters, &fsx.StorageVirtualMachineFilter{
+			Name:   aws.String(m["name"].(string)),
+			Values: filterValues,
+		})
+	}
+
+	return filters
+}
+
+func DataSourceStorageVirtualMachineFiltersSchema() *schema.Schema {
+	return &schema.Schema{
+		Type:     schema.TypeSet,
+		Optional: true,
+		Elem: &schema.Resource{
+			Schema: map[string]*schema.Schema{
+				"name": {
+					Type:     schema.TypeString,
+					Required: true,
+				},
+				"values": {
+					Type:     schema.TypeList,
+					Required: true,
+					Elem:     &schema.Schema{Type: schema.TypeString},
+				},
+			},
+		},
+	}
+}
diff --git a/internal/service/fsx/data_repository_association.go b/internal/service/fsx/data_repository_association.go
index c88665bff15..9944bd7219b 100644
--- a/internal/service/fsx/data_repository_association.go
+++ b/internal/service/fsx/data_repository_association.go
@@ -1,17 +1,22 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package fsx
 
 import (
 	"context"
+	"errors"
 	"log"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/fsx"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/customdiff"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
@@ -31,6 +36,7 @@ func ResourceDataRepositoryAssociation() *schema.Resource {
 		ReadWithoutTimeout:   resourceDataRepositoryAssociationRead,
 		UpdateWithoutTimeout: resourceDataRepositoryAssociationUpdate,
 		DeleteWithoutTimeout: resourceDataRepositoryAssociationDelete,
+
 		Importer: &schema.ResourceImporter{
 			StateContext: schema.ImportStatePassthroughContext,
 		},
@@ -61,16 +67,21 @@ func ResourceDataRepositoryAssociation() *schema.Resource {
 				Required: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(3, 900),
-					validation.StringMatch(regexp.MustCompile(`^s3://`), "must begin with s3://"),
+					validation.StringMatch(regexache.MustCompile(`^s3://`), "must begin with s3://"),
 				),
 			},
+			"delete_data_in_filesystem": {
+				Type:     schema.TypeBool,
+				Optional: true,
+				Default:  false,
+			},
 			"file_system_id": {
 				Type:     schema.TypeString,
 				ForceNew: true,
 				Required: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(11, 21),
-					validation.StringMatch(regexp.MustCompile(`^fs-[0-9a-f]*`), "must begin with fs-"),
+					validation.StringMatch(regexache.MustCompile(`^fs-[0-9a-f]*`), "must begin with fs-"),
 				),
 			},
 			"file_system_path": {
@@ -79,7 +90,7 @@ func ResourceDataRepositoryAssociation() *schema.Resource {
 				Required: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 4096),
-					validation.StringMatch(regexp.MustCompile(`^/.*`), "path must begin with /"),
+					validation.StringMatch(regexache.MustCompile(`^/.*`), "path must begin with /"),
 				),
 			},
 			"imported_file_chunk_size": {
@@ -139,11 +150,6 @@ func ResourceDataRepositoryAssociation() *schema.Resource {
 				},
 				DiffSuppressFunc: verify.SuppressMissingOptionalConfigurationBlock,
 			},
-			"delete_data_in_filesystem": {
-				Type:     schema.TypeBool,
-				Optional: true,
-				Default:  false,
-			},
 			names.AttrTags:    tftags.TagsSchema(),
 			names.AttrTagsAll: tftags.TagsSchemaComputed(),
 		},
@@ -181,44 +187,13 @@ func resourceDataRepositoryAssociationCreate(ctx context.Context, d *schema.Reso
 	result, err := conn.CreateDataRepositoryAssociationWithContext(ctx, input)
 
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "creating FSx Lustre Data Repository Association: %s", err)
+		return sdkdiag.AppendErrorf(diags, "creating FSx for Lustre Data Repository Association: %s", err)
 	}
 
 	d.SetId(aws.StringValue(result.Association.AssociationId))
 
 	if _, err := waitDataRepositoryAssociationCreated(ctx, conn, d.Id(), d.Timeout(schema.TimeoutCreate)); err != nil {
-		return sdkdiag.AppendErrorf(diags, "waiting for FSx Lustre Data Repository Association (%s) create: %s", d.Id(), err)
-	}
-
-	return append(diags, resourceDataRepositoryAssociationRead(ctx, d, meta)...)
-}
-
-func resourceDataRepositoryAssociationUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).FSxConn(ctx)
-
-	if d.HasChangesExcept("tags_all", "tags") {
-		input := &fsx.UpdateDataRepositoryAssociationInput{
-			ClientRequestToken: aws.String(id.UniqueId()),
-			AssociationId:      aws.String(d.Id()),
-		}
-
-		if d.HasChange("imported_file_chunk_size") {
-			input.ImportedFileChunkSize = aws.Int64(int64(d.Get("imported_file_chunk_size").(int)))
-		}
-
-		if d.HasChange("s3") {
-			input.S3 = expandDataRepositoryAssociationS3(d.Get("s3").([]interface{}))
-		}
-
-		_, err := conn.UpdateDataRepositoryAssociationWithContext(ctx, input)
-		if err != nil {
-			return sdkdiag.AppendErrorf(diags, "updating FSX Lustre Data Repository Association (%s): %s", d.Id(), err)
-		}
-
-		if _, err := waitDataRepositoryAssociationUpdated(ctx, conn, d.Id(), d.Timeout(schema.TimeoutUpdate)); err != nil {
-			return sdkdiag.AppendErrorf(diags, "waiting for FSx Lustre Data Repository Association (%s) update: %s", d.Id(), err)
-		}
+		return sdkdiag.AppendErrorf(diags, "waiting for FSx for Lustre Data Repository Association (%s) create: %s", d.Id(), err)
 	}
 
 	return append(diags, resourceDataRepositoryAssociationRead(ctx, d, meta)...)
@@ -229,14 +204,15 @@ func resourceDataRepositoryAssociationRead(ctx context.Context, d *schema.Resour
 	conn := meta.(*conns.AWSClient).FSxConn(ctx)
 
 	association, err := FindDataRepositoryAssociationByID(ctx, conn, d.Id())
+
 	if !d.IsNewResource() && tfresource.NotFound(err) {
-		log.Printf("[WARN] FSx Lustre Data Repository Association (%s) not found, removing from state", d.Id())
+		log.Printf("[WARN] FSx for Lustre Data Repository Association (%s) not found, removing from state", d.Id())
 		d.SetId("")
 		return diags
 	}
 
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "reading FSx Lustre Data Repository Association (%s): %s", d.Id(), err)
+		return sdkdiag.AppendErrorf(diags, "reading FSx for Lustre Data Repository Association (%s): %s", d.Id(), err)
 	}
 
 	d.Set("arn", association.ResourceARN)
@@ -246,7 +222,7 @@ func resourceDataRepositoryAssociationRead(ctx context.Context, d *schema.Resour
 	d.Set("file_system_path", association.FileSystemPath)
 	d.Set("imported_file_chunk_size", association.ImportedFileChunkSize)
 	if err := d.Set("s3", flattenDataRepositoryAssociationS3(association.S3)); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting s3 data repository configuration: %s", err)
+		return sdkdiag.AppendErrorf(diags, "setting s3: %s", err)
 	}
 
 	setTagsOut(ctx, association.Tags)
@@ -254,17 +230,49 @@ func resourceDataRepositoryAssociationRead(ctx context.Context, d *schema.Resour
 	return diags
 }
 
+func resourceDataRepositoryAssociationUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).FSxConn(ctx)
+
+	if d.HasChangesExcept("tags", "tags_all") {
+		input := &fsx.UpdateDataRepositoryAssociationInput{
+			AssociationId:      aws.String(d.Id()),
+			ClientRequestToken: aws.String(id.UniqueId()),
+		}
+
+		if d.HasChange("imported_file_chunk_size") {
+			input.ImportedFileChunkSize = aws.Int64(int64(d.Get("imported_file_chunk_size").(int)))
+		}
+
+		if d.HasChange("s3") {
+			input.S3 = expandDataRepositoryAssociationS3(d.Get("s3").([]interface{}))
+		}
+
+		_, err := conn.UpdateDataRepositoryAssociationWithContext(ctx, input)
+
+		if err != nil {
+			return sdkdiag.AppendErrorf(diags, "updating FSx for Lustre Data Repository Association (%s): %s", d.Id(), err)
+		}
+
+		if _, err := waitDataRepositoryAssociationUpdated(ctx, conn, d.Id(), d.Timeout(schema.TimeoutUpdate)); err != nil {
+			return sdkdiag.AppendErrorf(diags, "waiting for FSx for Lustre Data Repository Association (%s) update: %s", d.Id(), err)
+		}
+	}
+
+	return append(diags, resourceDataRepositoryAssociationRead(ctx, d, meta)...)
+}
+
 func resourceDataRepositoryAssociationDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).FSxConn(ctx)
 
 	request := &fsx.DeleteDataRepositoryAssociationInput{
-		ClientRequestToken:     aws.String(id.UniqueId()),
 		AssociationId:          aws.String(d.Id()),
+		ClientRequestToken:     aws.String(id.UniqueId()),
 		DeleteDataInFileSystem: aws.Bool(d.Get("delete_data_in_filesystem").(bool)),
 	}
 
-	log.Printf("[DEBUG] Deleting FSx Lustre Data Repository Association: %s", d.Id())
+	log.Printf("[DEBUG] Deleting FSx for Lustre Data Repository Association: %s", d.Id())
 	_, err := conn.DeleteDataRepositoryAssociationWithContext(ctx, request)
 
 	if tfawserr.ErrCodeEquals(err, fsx.ErrCodeDataRepositoryAssociationNotFound) {
@@ -272,11 +280,11 @@ func resourceDataRepositoryAssociationDelete(ctx context.Context, d *schema.Reso
 	}
 
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "deleting FSx Lustre Data Repository Association (%s): %s", d.Id(), err)
+		return sdkdiag.AppendErrorf(diags, "deleting FSx for Lustre Data Repository Association (%s): %s", d.Id(), err)
 	}
 
 	if _, err := waitDataRepositoryAssociationDeleted(ctx, conn, d.Id(), d.Timeout(schema.TimeoutDelete)); err != nil {
-		return sdkdiag.AppendErrorf(diags, "waiting for FSx Lustre Data Repository Association (%s) to deleted: %s", d.Id(), err)
+		return sdkdiag.AppendErrorf(diags, "waiting for FSx for Lustre Data Repository Association (%s) delete: %s", d.Id(), err)
 	}
 
 	return diags
@@ -372,3 +380,134 @@ func flattenS3AutoImportPolicy(policy *fsx.AutoImportPolicy) []map[string][]inte
 
 	return []map[string][]interface{}{result}
 }
+
+func FindDataRepositoryAssociationByID(ctx context.Context, conn *fsx.FSx, id string) (*fsx.DataRepositoryAssociation, error) {
+	input := &fsx.DescribeDataRepositoryAssociationsInput{
+		AssociationIds: aws.StringSlice([]string{id}),
+	}
+
+	return findDataRepositoryAssociation(ctx, conn, input)
+}
+
+func findDataRepositoryAssociation(ctx context.Context, conn *fsx.FSx, input *fsx.DescribeDataRepositoryAssociationsInput) (*fsx.DataRepositoryAssociation, error) {
+	output, err := findDataRepositoryAssociations(ctx, conn, input)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return tfresource.AssertSinglePtrResult(output)
+}
+
+func findDataRepositoryAssociations(ctx context.Context, conn *fsx.FSx, input *fsx.DescribeDataRepositoryAssociationsInput) ([]*fsx.DataRepositoryAssociation, error) {
+	var output []*fsx.DataRepositoryAssociation
+
+	err := conn.DescribeDataRepositoryAssociationsPagesWithContext(ctx, input, func(page *fsx.DescribeDataRepositoryAssociationsOutput, lastPage bool) bool {
+		if page == nil {
+			return !lastPage
+		}
+
+		for _, v := range page.Associations {
+			if v != nil {
+				output = append(output, v)
+			}
+		}
+
+		return !lastPage
+	})
+
+	if tfawserr.ErrCodeEquals(err, fsx.ErrCodeDataRepositoryAssociationNotFound) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	return output, nil
+}
+
+func statusDataRepositoryAssociation(ctx context.Context, conn *fsx.FSx, id string) retry.StateRefreshFunc {
+	return func() (interface{}, string, error) {
+		output, err := FindDataRepositoryAssociationByID(ctx, conn, id)
+
+		if tfresource.NotFound(err) {
+			return nil, "", nil
+		}
+
+		if err != nil {
+			return nil, "", err
+		}
+
+		return output, aws.StringValue(output.Lifecycle), nil
+	}
+}
+
+func waitDataRepositoryAssociationCreated(ctx context.Context, conn *fsx.FSx, id string, timeout time.Duration) (*fsx.DataRepositoryAssociation, error) {
+	stateConf := &retry.StateChangeConf{
+		Pending: []string{fsx.DataRepositoryLifecycleCreating},
+		Target:  []string{fsx.DataRepositoryLifecycleAvailable},
+		Refresh: statusDataRepositoryAssociation(ctx, conn, id),
+		Timeout: timeout,
+		Delay:   30 * time.Second,
+	}
+
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+
+	if output, ok := outputRaw.(*fsx.DataRepositoryAssociation); ok {
+		if status, details := aws.StringValue(output.Lifecycle), output.FailureDetails; status == fsx.DataRepositoryLifecycleFailed && details != nil {
+			tfresource.SetLastError(err, errors.New(aws.StringValue(output.FailureDetails.Message)))
+		}
+
+		return output, err
+	}
+
+	return nil, err
+}
+
+func waitDataRepositoryAssociationUpdated(ctx context.Context, conn *fsx.FSx, id string, timeout time.Duration) (*fsx.DataRepositoryAssociation, error) {
+	stateConf := &retry.StateChangeConf{
+		Pending: []string{fsx.DataRepositoryLifecycleUpdating},
+		Target:  []string{fsx.DataRepositoryLifecycleAvailable},
+		Refresh: statusDataRepositoryAssociation(ctx, conn, id),
+		Timeout: timeout,
+		Delay:   30 * time.Second,
+	}
+
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+
+	if output, ok := outputRaw.(*fsx.DataRepositoryAssociation); ok {
+		if status, details := aws.StringValue(output.Lifecycle), output.FailureDetails; status == fsx.DataRepositoryLifecycleFailed && details != nil {
+			tfresource.SetLastError(err, errors.New(aws.StringValue(output.FailureDetails.Message)))
+		}
+
+		return output, err
+	}
+
+	return nil, err
+}
+
+func waitDataRepositoryAssociationDeleted(ctx context.Context, conn *fsx.FSx, id string, timeout time.Duration) (*fsx.DataRepositoryAssociation, error) {
+	stateConf := &retry.StateChangeConf{
+		Pending: []string{fsx.DataRepositoryLifecycleAvailable, fsx.DataRepositoryLifecycleDeleting},
+		Target:  []string{},
+		Refresh: statusDataRepositoryAssociation(ctx, conn, id),
+		Timeout: timeout,
+		Delay:   30 * time.Second,
+	}
+
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+
+	if output, ok := outputRaw.(*fsx.DataRepositoryAssociation); ok {
+		if status, details := aws.StringValue(output.Lifecycle), output.FailureDetails; status == fsx.DataRepositoryLifecycleFailed && details != nil {
+			tfresource.SetLastError(err, errors.New(aws.StringValue(output.FailureDetails.Message)))
+		}
+
+		return output, err
+	}
+
+	return nil, err
+}
diff --git a/internal/service/fsx/data_repository_association_test.go b/internal/service/fsx/data_repository_association_test.go
index c7112f4aec4..c4249a3dce6 100644
--- a/internal/service/fsx/data_repository_association_test.go
+++ b/internal/service/fsx/data_repository_association_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package fsx_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"strings"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/endpoints"
 	"github.com/aws/aws-sdk-go/service/fsx"
@@ -21,30 +24,31 @@ import (
 
 func TestAccFSxDataRepositoryAssociation_basic(t *testing.T) {
 	ctx := acctest.Context(t)
-	if acctest.Partition() == endpoints.AwsUsGovPartitionID {
-		t.Skip("PERSISTENT_2 deployment_type is not supported in GovCloud partition")
-	}
-
 	var association fsx.DataRepositoryAssociation
 	resourceName := "aws_fsx_data_repository_association.test"
-	bucketName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
-	bucketPath := fmt.Sprintf("s3://%s", bucketName)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	bucketPath := fmt.Sprintf("s3://%s", rName)
 	fileSystemPath := "/test"
 
 	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, fsx.EndpointsID)
+			// PERSISTENT_2 deployment_type is not supported in GovCloud partition.
+			acctest.PreCheckPartitionNot(t, endpoints.AwsUsGovPartitionID)
+		},
 		ErrorCheck:               acctest.ErrorCheck(t, fsx.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckDataRepositoryAssociationDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccDataRepositoryAssociationConfig_fileSystemPath(bucketName, fileSystemPath),
+				Config: testAccDataRepositoryAssociationConfig_fileSystemPath(rName, rName, fileSystemPath),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDataRepositoryAssociationExists(ctx, resourceName, &association),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "fsx", regexp.MustCompile(`association/fs-.+/dra-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "fsx", regexache.MustCompile(`association/fs-.+/dra-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "batch_import_meta_data_on_create", "false"),
 					resource.TestCheckResourceAttr(resourceName, "data_repository_path", bucketPath),
-					resource.TestMatchResourceAttr(resourceName, "file_system_id", regexp.MustCompile(`fs-.+`)),
+					resource.TestMatchResourceAttr(resourceName, "file_system_id", regexache.MustCompile(`fs-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "file_system_path", fileSystemPath),
 					resource.TestCheckResourceAttrSet(resourceName, "imported_file_chunk_size"),
 				),
@@ -61,23 +65,24 @@ func TestAccFSxDataRepositoryAssociation_basic(t *testing.T) {
 
 func TestAccFSxDataRepositoryAssociation_disappears(t *testing.T) {
 	ctx := acctest.Context(t)
-	if acctest.Partition() == endpoints.AwsUsGovPartitionID {
-		t.Skip("PERSISTENT_2 deployment_type is not supported in GovCloud partition")
-	}
-
 	var association fsx.DataRepositoryAssociation
 	resourceName := "aws_fsx_data_repository_association.test"
-	bucketName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	fileSystemPath := "/test"
 
 	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, fsx.EndpointsID)
+			// PERSISTENT_2 deployment_type is not supported in GovCloud partition.
+			acctest.PreCheckPartitionNot(t, endpoints.AwsUsGovPartitionID)
+		},
 		ErrorCheck:               acctest.ErrorCheck(t, fsx.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckDataRepositoryAssociationDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccDataRepositoryAssociationConfig_fileSystemPath(bucketName, fileSystemPath),
+				Config: testAccDataRepositoryAssociationConfig_fileSystemPath(rName, rName, fileSystemPath),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDataRepositoryAssociationExists(ctx, resourceName, &association),
 					acctest.CheckResourceDisappears(ctx, acctest.Provider, tffsx.ResourceDataRepositoryAssociation(), resourceName),
@@ -90,24 +95,25 @@ func TestAccFSxDataRepositoryAssociation_disappears(t *testing.T) {
 
 func TestAccFSxDataRepositoryAssociation_disappears_ParentFileSystem(t *testing.T) {
 	ctx := acctest.Context(t)
-	if acctest.Partition() == endpoints.AwsUsGovPartitionID {
-		t.Skip("PERSISTENT_2 deployment_type is not supported in GovCloud partition")
-	}
-
 	var association fsx.DataRepositoryAssociation
 	parentResourceName := "aws_fsx_lustre_file_system.test"
 	resourceName := "aws_fsx_data_repository_association.test"
-	bucketName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	fileSystemPath := "/test"
 
 	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, fsx.EndpointsID)
+			// PERSISTENT_2 deployment_type is not supported in GovCloud partition.
+			acctest.PreCheckPartitionNot(t, endpoints.AwsUsGovPartitionID)
+		},
 		ErrorCheck:               acctest.ErrorCheck(t, fsx.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckDataRepositoryAssociationDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccDataRepositoryAssociationConfig_fileSystemPath(bucketName, fileSystemPath),
+				Config: testAccDataRepositoryAssociationConfig_fileSystemPath(rName, rName, fileSystemPath),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDataRepositoryAssociationExists(ctx, resourceName, &association),
 					acctest.CheckResourceDisappears(ctx, acctest.Provider, tffsx.ResourceLustreFileSystem(), parentResourceName),
@@ -120,24 +126,25 @@ func TestAccFSxDataRepositoryAssociation_disappears_ParentFileSystem(t *testing.
 
 func TestAccFSxDataRepositoryAssociation_fileSystemPathUpdated(t *testing.T) {
 	ctx := acctest.Context(t)
-	if acctest.Partition() == endpoints.AwsUsGovPartitionID {
-		t.Skip("PERSISTENT_2 deployment_type is not supported in GovCloud partition")
-	}
-
 	var association1, association2 fsx.DataRepositoryAssociation
 	resourceName := "aws_fsx_data_repository_association.test"
-	bucketName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	fileSystemPath1 := "/test1"
 	fileSystemPath2 := "/test2"
 
 	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, fsx.EndpointsID)
+			// PERSISTENT_2 deployment_type is not supported in GovCloud partition.
+			acctest.PreCheckPartitionNot(t, endpoints.AwsUsGovPartitionID)
+		},
 		ErrorCheck:               acctest.ErrorCheck(t, fsx.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckDataRepositoryAssociationDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccDataRepositoryAssociationConfig_fileSystemPath(bucketName, fileSystemPath1),
+				Config: testAccDataRepositoryAssociationConfig_fileSystemPath(rName, rName, fileSystemPath1),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDataRepositoryAssociationExists(ctx, resourceName, &association1),
 					resource.TestCheckResourceAttr(resourceName, "file_system_path", fileSystemPath1),
@@ -150,7 +157,7 @@ func TestAccFSxDataRepositoryAssociation_fileSystemPathUpdated(t *testing.T) {
 				ImportStateVerifyIgnore: []string{"delete_data_in_filesystem"},
 			},
 			{
-				Config: testAccDataRepositoryAssociationConfig_fileSystemPath(bucketName, fileSystemPath2),
+				Config: testAccDataRepositoryAssociationConfig_fileSystemPath(rName, rName, fileSystemPath2),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDataRepositoryAssociationExists(ctx, resourceName, &association2),
 					testAccCheckDataRepositoryAssociationRecreated(&association1, &association2),
@@ -163,12 +170,9 @@ func TestAccFSxDataRepositoryAssociation_fileSystemPathUpdated(t *testing.T) {
 
 func TestAccFSxDataRepositoryAssociation_dataRepositoryPathUpdated(t *testing.T) {
 	ctx := acctest.Context(t)
-	if acctest.Partition() == endpoints.AwsUsGovPartitionID {
-		t.Skip("PERSISTENT_2 deployment_type is not supported in GovCloud partition")
-	}
-
 	var association1, association2 fsx.DataRepositoryAssociation
 	resourceName := "aws_fsx_data_repository_association.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	bucketName1 := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	bucketPath1 := fmt.Sprintf("s3://%s", bucketName1)
 	bucketName2 := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
@@ -176,13 +180,18 @@ func TestAccFSxDataRepositoryAssociation_dataRepositoryPathUpdated(t *testing.T)
 	fileSystemPath := "/test"
 
 	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, fsx.EndpointsID)
+			// PERSISTENT_2 deployment_type is not supported in GovCloud partition.
+			acctest.PreCheckPartitionNot(t, endpoints.AwsUsGovPartitionID)
+		},
 		ErrorCheck:               acctest.ErrorCheck(t, fsx.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckDataRepositoryAssociationDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccDataRepositoryAssociationConfig_fileSystemPath(bucketName1, fileSystemPath),
+				Config: testAccDataRepositoryAssociationConfig_fileSystemPath(rName, bucketName1, fileSystemPath),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDataRepositoryAssociationExists(ctx, resourceName, &association1),
 					resource.TestCheckResourceAttr(resourceName, "data_repository_path", bucketPath1),
@@ -195,7 +204,7 @@ func TestAccFSxDataRepositoryAssociation_dataRepositoryPathUpdated(t *testing.T)
 				ImportStateVerifyIgnore: []string{"delete_data_in_filesystem"},
 			},
 			{
-				Config: testAccDataRepositoryAssociationConfig_fileSystemPath(bucketName2, fileSystemPath),
+				Config: testAccDataRepositoryAssociationConfig_fileSystemPath(rName, bucketName2, fileSystemPath),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDataRepositoryAssociationExists(ctx, resourceName, &association2),
 					testAccCheckDataRepositoryAssociationRecreated(&association1, &association2),
@@ -209,23 +218,24 @@ func TestAccFSxDataRepositoryAssociation_dataRepositoryPathUpdated(t *testing.T)
 // lintignore:AT002
 func TestAccFSxDataRepositoryAssociation_importedFileChunkSize(t *testing.T) {
 	ctx := acctest.Context(t)
-	if acctest.Partition() == endpoints.AwsUsGovPartitionID {
-		t.Skip("PERSISTENT_2 deployment_type is not supported in GovCloud partition")
-	}
-
 	var association fsx.DataRepositoryAssociation
 	resourceName := "aws_fsx_data_repository_association.test"
-	bucketName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	fileSystemPath := "/test"
 
 	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, fsx.EndpointsID)
+			// PERSISTENT_2 deployment_type is not supported in GovCloud partition.
+			acctest.PreCheckPartitionNot(t, endpoints.AwsUsGovPartitionID)
+		},
 		ErrorCheck:               acctest.ErrorCheck(t, fsx.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckDataRepositoryAssociationDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccDataRepositoryAssociationConfig_importedFileChunkSize(bucketName, fileSystemPath, 256),
+				Config: testAccDataRepositoryAssociationConfig_importedFileChunkSize(rName, rName, fileSystemPath, 256),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDataRepositoryAssociationExists(ctx, resourceName, &association),
 					resource.TestCheckResourceAttr(resourceName, "imported_file_chunk_size", "256"),
@@ -244,23 +254,24 @@ func TestAccFSxDataRepositoryAssociation_importedFileChunkSize(t *testing.T) {
 // lintignore:AT002
 func TestAccFSxDataRepositoryAssociation_importedFileChunkSizeUpdated(t *testing.T) {
 	ctx := acctest.Context(t)
-	if acctest.Partition() == endpoints.AwsUsGovPartitionID {
-		t.Skip("PERSISTENT_2 deployment_type is not supported in GovCloud partition")
-	}
-
 	var association1, association2 fsx.DataRepositoryAssociation
 	resourceName := "aws_fsx_data_repository_association.test"
-	bucketName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	fileSystemPath := "/test"
 
 	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, fsx.EndpointsID)
+			// PERSISTENT_2 deployment_type is not supported in GovCloud partition.
+			acctest.PreCheckPartitionNot(t, endpoints.AwsUsGovPartitionID)
+		},
 		ErrorCheck:               acctest.ErrorCheck(t, fsx.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckDataRepositoryAssociationDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccDataRepositoryAssociationConfig_importedFileChunkSize(bucketName, fileSystemPath, 256),
+				Config: testAccDataRepositoryAssociationConfig_importedFileChunkSize(rName, rName, fileSystemPath, 256),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDataRepositoryAssociationExists(ctx, resourceName, &association1),
 					resource.TestCheckResourceAttr(resourceName, "imported_file_chunk_size", "256"),
@@ -273,7 +284,7 @@ func TestAccFSxDataRepositoryAssociation_importedFileChunkSizeUpdated(t *testing
 				ImportStateVerifyIgnore: []string{"delete_data_in_filesystem"},
 			},
 			{
-				Config: testAccDataRepositoryAssociationConfig_importedFileChunkSize(bucketName, fileSystemPath, 512),
+				Config: testAccDataRepositoryAssociationConfig_importedFileChunkSize(rName, rName, fileSystemPath, 512),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDataRepositoryAssociationExists(ctx, resourceName, &association2),
 					testAccCheckDataRepositoryAssociationNotRecreated(&association1, &association2),
@@ -286,23 +297,24 @@ func TestAccFSxDataRepositoryAssociation_importedFileChunkSizeUpdated(t *testing
 
 func TestAccFSxDataRepositoryAssociation_deleteDataInFilesystem(t *testing.T) {
 	ctx := acctest.Context(t)
-	if acctest.Partition() == endpoints.AwsUsGovPartitionID {
-		t.Skip("PERSISTENT_2 deployment_type is not supported in GovCloud partition")
-	}
-
 	var association fsx.DataRepositoryAssociation
 	resourceName := "aws_fsx_data_repository_association.test"
-	bucketName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	fileSystemPath := "/test"
 
 	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, fsx.EndpointsID)
+			// PERSISTENT_2 deployment_type is not supported in GovCloud partition.
+			acctest.PreCheckPartitionNot(t, endpoints.AwsUsGovPartitionID)
+		},
 		ErrorCheck:               acctest.ErrorCheck(t, fsx.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckDataRepositoryAssociationDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccDataRepositoryAssociationConfig_deleteInFilesystem(bucketName, fileSystemPath, "true"),
+				Config: testAccDataRepositoryAssociationConfig_deleteInFilesystem(rName, rName, fileSystemPath, "true"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDataRepositoryAssociationExists(ctx, resourceName, &association),
 					resource.TestCheckResourceAttr(resourceName, "delete_data_in_filesystem", "true"),
@@ -320,24 +332,25 @@ func TestAccFSxDataRepositoryAssociation_deleteDataInFilesystem(t *testing.T) {
 
 func TestAccFSxDataRepositoryAssociation_s3AutoExportPolicy(t *testing.T) {
 	ctx := acctest.Context(t)
-	if acctest.Partition() == endpoints.AwsUsGovPartitionID {
-		t.Skip("PERSISTENT_2 deployment_type is not supported in GovCloud partition")
-	}
-
 	var association fsx.DataRepositoryAssociation
 	resourceName := "aws_fsx_data_repository_association.test"
-	bucketName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	fileSystemPath := "/test"
 	events := []string{"NEW", "CHANGED", "DELETED"}
 
 	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, fsx.EndpointsID)
+			// PERSISTENT_2 deployment_type is not supported in GovCloud partition.
+			acctest.PreCheckPartitionNot(t, endpoints.AwsUsGovPartitionID)
+		},
 		ErrorCheck:               acctest.ErrorCheck(t, fsx.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckDataRepositoryAssociationDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccDataRepositoryAssociationConfig_s3AutoExportPolicy(bucketName, fileSystemPath, events),
+				Config: testAccDataRepositoryAssociationConfig_s3AutoExportPolicy(rName, rName, fileSystemPath, events),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDataRepositoryAssociationExists(ctx, resourceName, &association),
 					resource.TestCheckResourceAttr(resourceName, "s3.0.auto_export_policy.0.events.0", "NEW"),
@@ -357,25 +370,26 @@ func TestAccFSxDataRepositoryAssociation_s3AutoExportPolicy(t *testing.T) {
 
 func TestAccFSxDataRepositoryAssociation_s3AutoExportPolicyUpdate(t *testing.T) {
 	ctx := acctest.Context(t)
-	if acctest.Partition() == endpoints.AwsUsGovPartitionID {
-		t.Skip("PERSISTENT_2 deployment_type is not supported in GovCloud partition")
-	}
-
 	var association1, association2 fsx.DataRepositoryAssociation
 	resourceName := "aws_fsx_data_repository_association.test"
-	bucketName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	fileSystemPath := "/test"
 	events1 := []string{"NEW", "CHANGED", "DELETED"}
 	events2 := []string{"NEW"}
 
 	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, fsx.EndpointsID)
+			// PERSISTENT_2 deployment_type is not supported in GovCloud partition.
+			acctest.PreCheckPartitionNot(t, endpoints.AwsUsGovPartitionID)
+		},
 		ErrorCheck:               acctest.ErrorCheck(t, fsx.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckDataRepositoryAssociationDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccDataRepositoryAssociationConfig_s3AutoExportPolicy(bucketName, fileSystemPath, events1),
+				Config: testAccDataRepositoryAssociationConfig_s3AutoExportPolicy(rName, rName, fileSystemPath, events1),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDataRepositoryAssociationExists(ctx, resourceName, &association1),
 					resource.TestCheckResourceAttr(resourceName, "s3.0.auto_export_policy.0.events.0", "NEW"),
@@ -390,7 +404,7 @@ func TestAccFSxDataRepositoryAssociation_s3AutoExportPolicyUpdate(t *testing.T)
 				ImportStateVerifyIgnore: []string{"delete_data_in_filesystem"},
 			},
 			{
-				Config: testAccDataRepositoryAssociationConfig_s3AutoExportPolicy(bucketName, fileSystemPath, events2),
+				Config: testAccDataRepositoryAssociationConfig_s3AutoExportPolicy(rName, rName, fileSystemPath, events2),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDataRepositoryAssociationExists(ctx, resourceName, &association2),
 					testAccCheckDataRepositoryAssociationNotRecreated(&association1, &association2),
@@ -403,24 +417,25 @@ func TestAccFSxDataRepositoryAssociation_s3AutoExportPolicyUpdate(t *testing.T)
 
 func TestAccFSxDataRepositoryAssociation_s3AutoImportPolicy(t *testing.T) {
 	ctx := acctest.Context(t)
-	if acctest.Partition() == endpoints.AwsUsGovPartitionID {
-		t.Skip("PERSISTENT_2 deployment_type is not supported in GovCloud partition")
-	}
-
 	var association fsx.DataRepositoryAssociation
 	resourceName := "aws_fsx_data_repository_association.test"
-	bucketName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	fileSystemPath := "/test"
 	events := []string{"NEW", "CHANGED", "DELETED"}
 
 	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, fsx.EndpointsID)
+			// PERSISTENT_2 deployment_type is not supported in GovCloud partition.
+			acctest.PreCheckPartitionNot(t, endpoints.AwsUsGovPartitionID)
+		},
 		ErrorCheck:               acctest.ErrorCheck(t, fsx.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckDataRepositoryAssociationDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccDataRepositoryAssociationConfig_s3AutoImportPolicy(bucketName, fileSystemPath, events),
+				Config: testAccDataRepositoryAssociationConfig_s3AutoImportPolicy(rName, rName, fileSystemPath, events),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDataRepositoryAssociationExists(ctx, resourceName, &association),
 					resource.TestCheckResourceAttr(resourceName, "s3.0.auto_import_policy.0.events.0", "NEW"),
@@ -440,25 +455,26 @@ func TestAccFSxDataRepositoryAssociation_s3AutoImportPolicy(t *testing.T) {
 
 func TestAccFSxDataRepositoryAssociation_s3AutoImportPolicyUpdate(t *testing.T) {
 	ctx := acctest.Context(t)
-	if acctest.Partition() == endpoints.AwsUsGovPartitionID {
-		t.Skip("PERSISTENT_2 deployment_type is not supported in GovCloud partition")
-	}
-
 	var association1, association2 fsx.DataRepositoryAssociation
 	resourceName := "aws_fsx_data_repository_association.test"
-	bucketName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	fileSystemPath := "/test"
 	events1 := []string{"NEW", "CHANGED", "DELETED"}
 	events2 := []string{"NEW"}
 
 	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, fsx.EndpointsID)
+			// PERSISTENT_2 deployment_type is not supported in GovCloud partition.
+			acctest.PreCheckPartitionNot(t, endpoints.AwsUsGovPartitionID)
+		},
 		ErrorCheck:               acctest.ErrorCheck(t, fsx.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckDataRepositoryAssociationDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccDataRepositoryAssociationConfig_s3AutoImportPolicy(bucketName, fileSystemPath, events1),
+				Config: testAccDataRepositoryAssociationConfig_s3AutoImportPolicy(rName, rName, fileSystemPath, events1),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDataRepositoryAssociationExists(ctx, resourceName, &association1),
 					resource.TestCheckResourceAttr(resourceName, "s3.0.auto_import_policy.0.events.0", "NEW"),
@@ -473,7 +489,7 @@ func TestAccFSxDataRepositoryAssociation_s3AutoImportPolicyUpdate(t *testing.T)
 				ImportStateVerifyIgnore: []string{"delete_data_in_filesystem"},
 			},
 			{
-				Config: testAccDataRepositoryAssociationConfig_s3AutoImportPolicy(bucketName, fileSystemPath, events2),
+				Config: testAccDataRepositoryAssociationConfig_s3AutoImportPolicy(rName, rName, fileSystemPath, events2),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDataRepositoryAssociationExists(ctx, resourceName, &association2),
 					testAccCheckDataRepositoryAssociationNotRecreated(&association1, &association2),
@@ -486,23 +502,24 @@ func TestAccFSxDataRepositoryAssociation_s3AutoImportPolicyUpdate(t *testing.T)
 
 func TestAccFSxDataRepositoryAssociation_s3FullPolicy(t *testing.T) {
 	ctx := acctest.Context(t)
-	if acctest.Partition() == endpoints.AwsUsGovPartitionID {
-		t.Skip("PERSISTENT_2 deployment_type is not supported in GovCloud partition")
-	}
-
 	var association fsx.DataRepositoryAssociation
 	resourceName := "aws_fsx_data_repository_association.test"
-	bucketName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	fileSystemPath := "/test"
 
 	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, fsx.EndpointsID)
+			// PERSISTENT_2 deployment_type is not supported in GovCloud partition.
+			acctest.PreCheckPartitionNot(t, endpoints.AwsUsGovPartitionID)
+		},
 		ErrorCheck:               acctest.ErrorCheck(t, fsx.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckDataRepositoryAssociationDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccDataRepositoryAssociationConfig_s3FullPolicy(bucketName, fileSystemPath),
+				Config: testAccDataRepositoryAssociationConfig_s3FullPolicy(rName, rName, fileSystemPath),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDataRepositoryAssociationExists(ctx, resourceName, &association),
 					resource.TestCheckResourceAttr(resourceName, "s3.0.auto_export_policy.0.events.0", "NEW"),
@@ -523,25 +540,22 @@ func TestAccFSxDataRepositoryAssociation_s3FullPolicy(t *testing.T) {
 	})
 }
 
-func testAccCheckDataRepositoryAssociationExists(ctx context.Context, resourceName string, assoc *fsx.DataRepositoryAssociation) resource.TestCheckFunc {
+func testAccCheckDataRepositoryAssociationExists(ctx context.Context, n string, v *fsx.DataRepositoryAssociation) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		rs, ok := s.RootModule().Resources[resourceName]
+		rs, ok := s.RootModule().Resources[n]
 		if !ok {
-			return fmt.Errorf("Not found: %s", resourceName)
+			return fmt.Errorf("Not found: %s", n)
 		}
 
 		conn := acctest.Provider.Meta().(*conns.AWSClient).FSxConn(ctx)
 
-		association, err := tffsx.FindDataRepositoryAssociationByID(ctx, conn, rs.Primary.ID)
+		output, err := tffsx.FindDataRepositoryAssociationByID(ctx, conn, rs.Primary.ID)
+
 		if err != nil {
 			return err
 		}
 
-		if association == nil {
-			return fmt.Errorf("FSx Lustre Data Repository Association (%s) not found", rs.Primary.ID)
-		}
-
-		*assoc = *association
+		*v = *output
 
 		return nil
 	}
@@ -552,19 +566,23 @@ func testAccCheckDataRepositoryAssociationDestroy(ctx context.Context) resource.
 		conn := acctest.Provider.Meta().(*conns.AWSClient).FSxConn(ctx)
 
 		for _, rs := range s.RootModule().Resources {
-			if rs.Type != "aws_fsx_lustre_file_system" {
+			if rs.Type != "aws_fsx_data_repository_association" {
 				continue
 			}
 
-			filesystem, err := tffsx.FindFileSystemByID(ctx, conn, rs.Primary.ID)
+			_, err := tffsx.FindDataRepositoryAssociationByID(ctx, conn, rs.Primary.ID)
+
 			if tfresource.NotFound(err) {
 				continue
 			}
 
-			if filesystem != nil {
-				return fmt.Errorf("FSx Lustre File System (%s) still exists", rs.Primary.ID)
+			if err != nil {
+				return err
 			}
+
+			return fmt.Errorf("FSx for Lustre Data Repository Association %s still exists", rs.Primary.ID)
 		}
+
 		return nil
 	}
 }
@@ -589,11 +607,11 @@ func testAccCheckDataRepositoryAssociationRecreated(i, j *fsx.DataRepositoryAsso
 	}
 }
 
-func testAccDataRepositoryAssociationConfig_s3Bucket(bucketName string) string {
-	return acctest.ConfigCompose(testAccLustreFileSystemBaseConfig(), fmt.Sprintf(`
+func testAccDataRepositoryAssociationConfig_s3Bucket(rName, bucketName string) string {
+	return acctest.ConfigCompose(testAccLustreFileSystemConfig_base(rName), fmt.Sprintf(`
 resource "aws_fsx_lustre_file_system" "test" {
   storage_capacity            = 1200
-  subnet_ids                  = [aws_subnet.test1.id]
+  subnet_ids                  = aws_subnet.test[*].id
   deployment_type             = "PERSISTENT_2"
   per_unit_storage_throughput = 125
 }
@@ -604,8 +622,8 @@ resource "aws_s3_bucket" "test" {
 `, bucketName))
 }
 
-func testAccDataRepositoryAssociationConfig_fileSystemPath(bucketName, fileSystemPath string) string {
-	return acctest.ConfigCompose(testAccDataRepositoryAssociationConfig_s3Bucket(bucketName), fmt.Sprintf(`
+func testAccDataRepositoryAssociationConfig_fileSystemPath(rName, bucketName, fileSystemPath string) string {
+	return acctest.ConfigCompose(testAccDataRepositoryAssociationConfig_s3Bucket(rName, bucketName), fmt.Sprintf(`
 resource "aws_fsx_data_repository_association" "test" {
   file_system_id       = aws_fsx_lustre_file_system.test.id
   data_repository_path = "s3://%[1]s"
@@ -614,9 +632,10 @@ resource "aws_fsx_data_repository_association" "test" {
 `, bucketName, fileSystemPath))
 }
 
-func testAccDataRepositoryAssociationConfig_importedFileChunkSize(bucketName, fileSystemPath string, fileChunkSize int64) string {
+func testAccDataRepositoryAssociationConfig_importedFileChunkSize(rName, bucketName, fileSystemPath string, fileChunkSize int64) string {
 	bucketPath := fmt.Sprintf("s3://%s", bucketName)
-	return acctest.ConfigCompose(testAccDataRepositoryAssociationConfig_s3Bucket(bucketName), fmt.Sprintf(`
+
+	return acctest.ConfigCompose(testAccDataRepositoryAssociationConfig_s3Bucket(rName, bucketName), fmt.Sprintf(`
 resource "aws_fsx_data_repository_association" "test" {
   file_system_id           = aws_fsx_lustre_file_system.test.id
   data_repository_path     = %[1]q
@@ -626,9 +645,9 @@ resource "aws_fsx_data_repository_association" "test" {
 `, bucketPath, fileSystemPath, fileChunkSize))
 }
 
-func testAccDataRepositoryAssociationConfig_deleteInFilesystem(bucketName, fileSystemPath, deleteDataInFilesystem string) string {
+func testAccDataRepositoryAssociationConfig_deleteInFilesystem(rName, bucketName, fileSystemPath, deleteDataInFilesystem string) string {
 	bucketPath := fmt.Sprintf("s3://%s", bucketName)
-	return acctest.ConfigCompose(testAccDataRepositoryAssociationConfig_s3Bucket(bucketName), fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccDataRepositoryAssociationConfig_s3Bucket(rName, bucketName), fmt.Sprintf(`
 resource "aws_fsx_data_repository_association" "test" {
   file_system_id            = aws_fsx_lustre_file_system.test.id
   data_repository_path      = %[1]q
@@ -638,10 +657,10 @@ resource "aws_fsx_data_repository_association" "test" {
 `, bucketPath, fileSystemPath, deleteDataInFilesystem))
 }
 
-func testAccDataRepositoryAssociationConfig_s3AutoExportPolicy(bucketName, fileSystemPath string, events []string) string {
+func testAccDataRepositoryAssociationConfig_s3AutoExportPolicy(rName, bucketName, fileSystemPath string, events []string) string {
 	bucketPath := fmt.Sprintf("s3://%s", bucketName)
 	eventsString := strings.Replace(fmt.Sprintf("%q", events), " ", ", ", -1)
-	return acctest.ConfigCompose(testAccDataRepositoryAssociationConfig_s3Bucket(bucketName), fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccDataRepositoryAssociationConfig_s3Bucket(rName, bucketName), fmt.Sprintf(`
 resource "aws_fsx_data_repository_association" "test" {
   file_system_id       = aws_fsx_lustre_file_system.test.id
   data_repository_path = %[1]q
@@ -656,10 +675,10 @@ resource "aws_fsx_data_repository_association" "test" {
 `, bucketPath, fileSystemPath, eventsString))
 }
 
-func testAccDataRepositoryAssociationConfig_s3AutoImportPolicy(bucketName, fileSystemPath string, events []string) string {
+func testAccDataRepositoryAssociationConfig_s3AutoImportPolicy(rName, bucketName, fileSystemPath string, events []string) string {
 	bucketPath := fmt.Sprintf("s3://%s", bucketName)
 	eventsString := strings.Replace(fmt.Sprintf("%q", events), " ", ", ", -1)
-	return acctest.ConfigCompose(testAccDataRepositoryAssociationConfig_s3Bucket(bucketName), fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccDataRepositoryAssociationConfig_s3Bucket(rName, bucketName), fmt.Sprintf(`
 resource "aws_fsx_data_repository_association" "test" {
   file_system_id       = aws_fsx_lustre_file_system.test.id
   data_repository_path = %[1]q
@@ -674,9 +693,9 @@ resource "aws_fsx_data_repository_association" "test" {
 `, bucketPath, fileSystemPath, eventsString))
 }
 
-func testAccDataRepositoryAssociationConfig_s3FullPolicy(bucketName, fileSystemPath string) string {
+func testAccDataRepositoryAssociationConfig_s3FullPolicy(rName, bucketName, fileSystemPath string) string {
 	bucketPath := fmt.Sprintf("s3://%s", bucketName)
-	return acctest.ConfigCompose(testAccDataRepositoryAssociationConfig_s3Bucket(bucketName), fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccDataRepositoryAssociationConfig_s3Bucket(rName, bucketName), fmt.Sprintf(`
 resource "aws_fsx_data_repository_association" "test" {
   file_system_id       = aws_fsx_lustre_file_system.test.id
   data_repository_path = %[1]q
diff --git a/internal/service/fsx/file_cache.go b/internal/service/fsx/file_cache.go
index 5a01af3cce0..62da3a38935 100644
--- a/internal/service/fsx/file_cache.go
+++ b/internal/service/fsx/file_cache.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package fsx
 
 import (
 	"context"
 	"log"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/fsx"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -116,7 +119,7 @@ func ResourceFileCache() *schema.Resource {
 											Type: schema.TypeString,
 											ValidateFunc: validation.All(
 												validation.StringLenBetween(7, 15),
-												validation.StringMatch(regexp.MustCompile(`^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$`), "invalid pattern"),
+												validation.StringMatch(regexache.MustCompile(`^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$`), "invalid pattern"),
 											),
 										},
 									},
@@ -167,7 +170,7 @@ func ResourceFileCache() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 20),
-					validation.StringMatch(regexp.MustCompile(`^[0-9](.[0-9]*)*$`), "invalid pattern"),
+					validation.StringMatch(regexache.MustCompile(`^[0-9](.[0-9]*)*$`), "invalid pattern"),
 				),
 			},
 			"kms_key_id": {
@@ -241,7 +244,7 @@ func ResourceFileCache() *schema.Resource {
 							Optional: true,
 							ValidateFunc: validation.All(
 								validation.StringLenBetween(7, 7),
-								validation.StringMatch(regexp.MustCompile(`^[1-7]:([01]\d|2[0-3]):?([0-5]\d)$`), "invalid pattern"),
+								validation.StringMatch(regexache.MustCompile(`^[1-7]:([01]\d|2[0-3]):?([0-5]\d)$`), "invalid pattern"),
 							),
 						},
 					},
@@ -363,9 +366,8 @@ func resourceFileCacheRead(ctx context.Context, d *schema.ResourceData, meta int
 	d.Set("subnet_ids", aws.StringValueSlice(filecache.SubnetIds))
 	d.Set("vpc_id", filecache.VpcId)
 
-	if err := d.Set("data_repository_association_ids", filecache.DataRepositoryAssociationIds); err != nil {
-		return create.DiagError(names.FSx, create.ErrActionSetting, ResNameFileCache, d.Id(), err)
-	}
+	dataRepositoryAssociationIDs := aws.StringValueSlice(filecache.DataRepositoryAssociationIds)
+	d.Set("data_repository_association_ids", dataRepositoryAssociationIDs)
 	if err := d.Set("lustre_configuration", flattenFileCacheLustreConfiguration(filecache.LustreConfiguration)); err != nil {
 		return create.DiagError(names.FSx, create.ErrActionSetting, ResNameFileCache, d.Id(), err)
 	}
@@ -378,7 +380,7 @@ func resourceFileCacheRead(ctx context.Context, d *schema.ResourceData, meta int
 
 	// Lookup and set Data Repository Associations
 
-	dataRepositoryAssociations, _ := findDataRepositoryAssociationsByIDs(ctx, conn, filecache.DataRepositoryAssociationIds)
+	dataRepositoryAssociations, _ := findDataRepositoryAssociationsByIDs(ctx, conn, dataRepositoryAssociationIDs)
 
 	defaultTagsConfig := meta.(*conns.AWSClient).DefaultTagsConfig
 	ignoreTagsConfig := meta.(*conns.AWSClient).IgnoreTagsConfig
@@ -613,3 +615,11 @@ func expandFileCacheLustreMetadataConfiguration(l []interface{}) *fsx.FileCacheL
 	}
 	return req
 }
+
+func findDataRepositoryAssociationsByIDs(ctx context.Context, conn *fsx.FSx, ids []string) ([]*fsx.DataRepositoryAssociation, error) {
+	input := &fsx.DescribeDataRepositoryAssociationsInput{
+		AssociationIds: aws.StringSlice(ids),
+	}
+
+	return findDataRepositoryAssociations(ctx, conn, input)
+}
diff --git a/internal/service/fsx/file_cache_test.go b/internal/service/fsx/file_cache_test.go
index e747b3e704e..e59c7b5884f 100644
--- a/internal/service/fsx/file_cache_test.go
+++ b/internal/service/fsx/file_cache_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package fsx_test
 
 import (
 	"context"
 	"errors"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/fsx"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -62,11 +65,11 @@ func testAccFileCache_basic(t *testing.T) {
 				Config: testAccFileCacheConfig_basic(),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckFileCacheExists(ctx, resourceName, &filecache),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "fsx", regexp.MustCompile(`file-cache/fc-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "fsx", regexache.MustCompile(`file-cache/fc-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "file_cache_type", "LUSTRE"),
 					resource.TestCheckResourceAttr(resourceName, "file_cache_type_version", "2.12"),
-					resource.TestMatchResourceAttr(resourceName, "id", regexp.MustCompile(`fc-.+`)),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "kms_key_id", "kms", regexp.MustCompile(`key\/.+`)),
+					resource.TestMatchResourceAttr(resourceName, "id", regexache.MustCompile(`fc-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "kms_key_id", "kms", regexache.MustCompile(`key\/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "lustre_configuration.0.deployment_type", "CACHE_1"),
 					resource.TestCheckResourceAttr(resourceName, "lustre_configuration.0.metadata_configuration.0.storage_capacity", "2400"),
 					resource.TestCheckResourceAttr(resourceName, "lustre_configuration.0.per_unit_storage_throughput", "1000"),
diff --git a/internal/service/fsx/find.go b/internal/service/fsx/find.go
index d8b3fdafe20..c24a32bda5d 100644
--- a/internal/service/fsx/find.go
+++ b/internal/service/fsx/find.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package fsx
 
 import (
@@ -10,27 +13,6 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
-func FindAdministrativeActionByFileSystemIDAndActionType(ctx context.Context, conn *fsx.FSx, fsID, actionType string) (*fsx.AdministrativeAction, error) {
-	fileSystem, err := FindFileSystemByID(ctx, conn, fsID)
-
-	if err != nil {
-		return nil, err
-	}
-
-	for _, administrativeAction := range fileSystem.AdministrativeActions {
-		if administrativeAction == nil {
-			continue
-		}
-
-		if aws.StringValue(administrativeAction.AdministrativeActionType) == actionType {
-			return administrativeAction, nil
-		}
-	}
-
-	// If the administrative action isn't found, assume it's complete.
-	return &fsx.AdministrativeAction{Status: aws.String(fsx.StatusCompleted)}, nil
-}
-
 func FindBackupByID(ctx context.Context, conn *fsx.FSx, id string) (*fsx.Backup, error) {
 	input := &fsx.DescribeBackupsInput{
 		BackupIds: aws.StringSlice([]string{id}),
@@ -89,192 +71,6 @@ func findFileCacheByID(ctx context.Context, conn *fsx.FSx, id string) (*fsx.File
 	return fileCaches[0], nil
 }
 
-func findDataRepositoryAssociationsByIDs(ctx context.Context, conn *fsx.FSx, ids []*string) ([]*fsx.DataRepositoryAssociation, error) {
-	input := &fsx.DescribeDataRepositoryAssociationsInput{
-		AssociationIds: ids,
-	}
-	var dataRepositoryAssociations []*fsx.DataRepositoryAssociation
-
-	err := conn.DescribeDataRepositoryAssociationsPagesWithContext(ctx, input, func(page *fsx.DescribeDataRepositoryAssociationsOutput, lastPage bool) bool {
-		if page == nil {
-			return !lastPage
-		}
-		dataRepositoryAssociations = append(dataRepositoryAssociations, page.Associations...)
-		return !lastPage
-	})
-
-	if tfawserr.ErrCodeEquals(err, fsx.ErrCodeDataRepositoryAssociationNotFound) {
-		return nil, &retry.NotFoundError{
-			LastError:   err,
-			LastRequest: input,
-		}
-	}
-	if err != nil {
-		return nil, err
-	}
-	if len(dataRepositoryAssociations) == 0 || dataRepositoryAssociations[0] == nil {
-		return nil, tfresource.NewEmptyResultError(input)
-	}
-
-	return dataRepositoryAssociations, nil
-}
-
-func FindFileSystemByID(ctx context.Context, conn *fsx.FSx, id string) (*fsx.FileSystem, error) {
-	input := &fsx.DescribeFileSystemsInput{
-		FileSystemIds: []*string{aws.String(id)},
-	}
-
-	var filesystems []*fsx.FileSystem
-
-	err := conn.DescribeFileSystemsPagesWithContext(ctx, input, func(page *fsx.DescribeFileSystemsOutput, lastPage bool) bool {
-		if page == nil {
-			return !lastPage
-		}
-
-		filesystems = append(filesystems, page.FileSystems...)
-
-		return !lastPage
-	})
-
-	if tfawserr.ErrCodeEquals(err, fsx.ErrCodeFileSystemNotFound) {
-		return nil, &retry.NotFoundError{
-			LastError:   err,
-			LastRequest: input,
-		}
-	}
-
-	if err != nil {
-		return nil, err
-	}
-
-	if len(filesystems) == 0 || filesystems[0] == nil {
-		return nil, tfresource.NewEmptyResultError(input)
-	}
-
-	if count := len(filesystems); count > 1 {
-		return nil, tfresource.NewTooManyResultsError(count, input)
-	}
-
-	return filesystems[0], nil
-}
-
-func FindDataRepositoryAssociationByID(ctx context.Context, conn *fsx.FSx, id string) (*fsx.DataRepositoryAssociation, error) {
-	input := &fsx.DescribeDataRepositoryAssociationsInput{
-		AssociationIds: []*string{aws.String(id)},
-	}
-
-	var associations []*fsx.DataRepositoryAssociation
-
-	err := conn.DescribeDataRepositoryAssociationsPagesWithContext(ctx, input, func(page *fsx.DescribeDataRepositoryAssociationsOutput, lastPage bool) bool {
-		if page == nil {
-			return !lastPage
-		}
-
-		associations = append(associations, page.Associations...)
-
-		return !lastPage
-	})
-
-	if tfawserr.ErrCodeEquals(err, fsx.ErrCodeDataRepositoryAssociationNotFound) {
-		return nil, &retry.NotFoundError{
-			LastError:   err,
-			LastRequest: input,
-		}
-	}
-
-	if err != nil {
-		return nil, err
-	}
-
-	if len(associations) == 0 || associations[0] == nil {
-		return nil, tfresource.NewEmptyResultError(input)
-	}
-
-	if count := len(associations); count > 1 {
-		return nil, tfresource.NewTooManyResultsError(count, input)
-	}
-
-	return associations[0], nil
-}
-
-func FindStorageVirtualMachineByID(ctx context.Context, conn *fsx.FSx, id string) (*fsx.StorageVirtualMachine, error) {
-	input := &fsx.DescribeStorageVirtualMachinesInput{
-		StorageVirtualMachineIds: []*string{aws.String(id)},
-	}
-
-	var storageVirtualMachines []*fsx.StorageVirtualMachine
-
-	err := conn.DescribeStorageVirtualMachinesPagesWithContext(ctx, input, func(page *fsx.DescribeStorageVirtualMachinesOutput, lastPage bool) bool {
-		if page == nil {
-			return !lastPage
-		}
-
-		storageVirtualMachines = append(storageVirtualMachines, page.StorageVirtualMachines...)
-
-		return !lastPage
-	})
-
-	if tfawserr.ErrCodeEquals(err, fsx.ErrCodeStorageVirtualMachineNotFound) {
-		return nil, &retry.NotFoundError{
-			LastError:   err,
-			LastRequest: input,
-		}
-	}
-
-	if err != nil {
-		return nil, err
-	}
-
-	if len(storageVirtualMachines) == 0 || storageVirtualMachines[0] == nil {
-		return nil, tfresource.NewEmptyResultError(input)
-	}
-
-	if count := len(storageVirtualMachines); count > 1 {
-		return nil, tfresource.NewTooManyResultsError(count, input)
-	}
-
-	return storageVirtualMachines[0], nil
-}
-
-func FindVolumeByID(ctx context.Context, conn *fsx.FSx, id string) (*fsx.Volume, error) {
-	input := &fsx.DescribeVolumesInput{
-		VolumeIds: []*string{aws.String(id)},
-	}
-
-	var volumes []*fsx.Volume
-
-	err := conn.DescribeVolumesPagesWithContext(ctx, input, func(page *fsx.DescribeVolumesOutput, lastPage bool) bool {
-		if page == nil {
-			return !lastPage
-		}
-
-		volumes = append(volumes, page.Volumes...)
-
-		return !lastPage
-	})
-
-	if tfawserr.ErrCodeEquals(err, fsx.ErrCodeVolumeNotFound) {
-		return nil, &retry.NotFoundError{
-			LastError:   err,
-			LastRequest: input,
-		}
-	}
-
-	if err != nil {
-		return nil, err
-	}
-
-	if len(volumes) == 0 || volumes[0] == nil {
-		return nil, tfresource.NewEmptyResultError(input)
-	}
-
-	if count := len(volumes); count > 1 {
-		return nil, tfresource.NewTooManyResultsError(count, input)
-	}
-
-	return volumes[0], nil
-}
-
 func FindSnapshotByID(ctx context.Context, conn *fsx.FSx, id string) (*fsx.Snapshot, error) {
 	input := &fsx.DescribeSnapshotsInput{
 		SnapshotIds: aws.StringSlice([]string{id}),
diff --git a/internal/service/fsx/generate.go b/internal/service/fsx/generate.go
index b89d7b7979b..f79c17d8d92 100644
--- a/internal/service/fsx/generate.go
+++ b/internal/service/fsx/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTags -ListTagsInIDElem=ResourceARN -ServiceTagsSlice -TagInIDElem=ResourceARN -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/fsx/lustre_file_system.go b/internal/service/fsx/lustre_file_system.go
index f0ab163f7fb..a9ddb842a8c 100644
--- a/internal/service/fsx/lustre_file_system.go
+++ b/internal/service/fsx/lustre_file_system.go
@@ -1,13 +1,17 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package fsx
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"log"
-	"regexp"
 	"strings"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/aws/aws-sdk-go/service/fsx"
@@ -15,11 +19,13 @@ import (
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/customdiff"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
 	"github.com/hashicorp/terraform-provider-aws/internal/flex"
+	tfslices "github.com/hashicorp/terraform-provider-aws/internal/slices"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
@@ -49,142 +55,54 @@ func ResourceLustreFileSystem() *schema.Resource {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
-			"backup_id": {
-				Type:     schema.TypeString,
-				Optional: true,
-				ForceNew: true,
-			},
-			"dns_name": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
-			"export_path": {
-				Type:     schema.TypeString,
-				Optional: true,
-				Computed: true,
-				ForceNew: true,
-				ValidateFunc: validation.All(
-					validation.StringLenBetween(3, 900),
-					validation.StringMatch(regexp.MustCompile(`^s3://`), "must begin with s3://"),
-				),
-			},
-			"import_path": {
-				Type:     schema.TypeString,
-				Optional: true,
-				ForceNew: true,
-				ValidateFunc: validation.All(
-					validation.StringLenBetween(3, 900),
-					validation.StringMatch(regexp.MustCompile(`^s3://`), "must begin with s3://"),
-				),
+			"auto_import_policy": {
+				Type:         schema.TypeString,
+				Optional:     true,
+				Computed:     true,
+				ValidateFunc: validation.StringInSlice(fsx.AutoImportPolicyType_Values(), false),
 			},
-			"imported_file_chunk_size": {
+			"automatic_backup_retention_days": {
 				Type:         schema.TypeInt,
 				Optional:     true,
 				Computed:     true,
-				ForceNew:     true,
-				ValidateFunc: validation.IntBetween(1, 512000),
-			},
-			"mount_name": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
-			"network_interface_ids": {
-				// As explained in https://docs.aws.amazon.com/fsx/latest/LustreGuide/mounting-on-premises.html, the first
-				// network_interface_id is the primary one, so ordering matters. Use TypeList instead of TypeSet to preserve it.
-				Type:     schema.TypeList,
-				Computed: true,
-				Elem:     &schema.Schema{Type: schema.TypeString},
+				ValidateFunc: validation.IntBetween(0, 90),
 			},
-			"owner_id": {
+			"backup_id": {
 				Type:     schema.TypeString,
-				Computed: true,
-			},
-			"security_group_ids": {
-				Type:     schema.TypeSet,
 				Optional: true,
 				ForceNew: true,
-				MaxItems: 50,
-				Elem:     &schema.Schema{Type: schema.TypeString},
-			},
-			"storage_capacity": {
-				Type:         schema.TypeInt,
-				Optional:     true,
-				ValidateFunc: validation.IntAtLeast(1200),
 			},
-			"subnet_ids": {
-				Type:     schema.TypeList,
-				Required: true,
+			"copy_tags_to_backups": {
+				Type:     schema.TypeBool,
+				Optional: true,
 				ForceNew: true,
-				MinItems: 1,
-				MaxItems: 1,
-				Elem:     &schema.Schema{Type: schema.TypeString},
-			},
-			names.AttrTags:    tftags.TagsSchema(),
-			names.AttrTagsAll: tftags.TagsSchemaComputed(),
-			"vpc_id": {
-				Type:     schema.TypeString,
-				Computed: true,
+				Default:  false,
 			},
-			"weekly_maintenance_start_time": {
+			"daily_automatic_backup_start_time": {
 				Type:     schema.TypeString,
 				Optional: true,
 				Computed: true,
 				ValidateFunc: validation.All(
-					validation.StringLenBetween(7, 7),
-					validation.StringMatch(regexp.MustCompile(`^[1-7]:([01]\d|2[0-3]):?([0-5]\d)$`), "must be in the format d:HH:MM"),
+					validation.StringLenBetween(5, 5),
+					validation.StringMatch(regexache.MustCompile(`^([01]\d|2[0-3]):?([0-5]\d)$`), "must be in the format HH:MM"),
 				),
 			},
-			"deployment_type": {
+			"data_compression_type": {
 				Type:         schema.TypeString,
 				Optional:     true,
-				ForceNew:     true,
-				Default:      fsx.LustreDeploymentTypeScratch1,
-				ValidateFunc: validation.StringInSlice(fsx.LustreDeploymentType_Values(), false),
+				ValidateFunc: validation.StringInSlice(fsx.DataCompressionType_Values(), false),
+				Default:      fsx.DataCompressionTypeNone,
 			},
-			"kms_key_id": {
+			"deployment_type": {
 				Type:         schema.TypeString,
 				Optional:     true,
-				Computed:     true,
 				ForceNew:     true,
-				ValidateFunc: verify.ValidARN,
-			},
-			"per_unit_storage_throughput": {
-				Type:     schema.TypeInt,
-				Optional: true,
-				ForceNew: true,
-				ValidateFunc: validation.IntInSlice([]int{
-					12,
-					40,
-					50,
-					100,
-					125,
-					200,
-					250,
-					500,
-					1000,
-				}),
-			},
-			"automatic_backup_retention_days": {
-				Type:         schema.TypeInt,
-				Optional:     true,
-				Computed:     true,
-				ValidateFunc: validation.IntBetween(0, 90),
+				Default:      fsx.LustreDeploymentTypeScratch1,
+				ValidateFunc: validation.StringInSlice(fsx.LustreDeploymentType_Values(), false),
 			},
-			"daily_automatic_backup_start_time": {
+			"dns_name": {
 				Type:     schema.TypeString,
-				Optional: true,
 				Computed: true,
-				ValidateFunc: validation.All(
-					validation.StringLenBetween(5, 5),
-					validation.StringMatch(regexp.MustCompile(`^([01]\d|2[0-3]):?([0-5]\d)$`), "must be in the format HH:MM"),
-				),
-			},
-			"storage_type": {
-				Type:         schema.TypeString,
-				Optional:     true,
-				ForceNew:     true,
-				Default:      fsx.StorageTypeSsd,
-				ValidateFunc: validation.StringInSlice(fsx.StorageType_Values(), false),
 			},
 			"drive_cache_type": {
 				Type:         schema.TypeString,
@@ -192,23 +110,15 @@ func ResourceLustreFileSystem() *schema.Resource {
 				ForceNew:     true,
 				ValidateFunc: validation.StringInSlice(fsx.DriveCacheType_Values(), false),
 			},
-			"auto_import_policy": {
-				Type:         schema.TypeString,
-				Optional:     true,
-				Computed:     true,
-				ValidateFunc: validation.StringInSlice(fsx.AutoImportPolicyType_Values(), false),
-			},
-			"copy_tags_to_backups": {
-				Type:     schema.TypeBool,
+			"export_path": {
+				Type:     schema.TypeString,
 				Optional: true,
+				Computed: true,
 				ForceNew: true,
-				Default:  false,
-			},
-			"data_compression_type": {
-				Type:         schema.TypeString,
-				Optional:     true,
-				ValidateFunc: validation.StringInSlice(fsx.DataCompressionType_Values(), false),
-				Default:      fsx.DataCompressionTypeNone,
+				ValidateFunc: validation.All(
+					validation.StringLenBetween(3, 900),
+					validation.StringMatch(regexache.MustCompile(`^s3://`), "must begin with s3://"),
+				),
 			},
 			"file_system_type_version": {
 				Type:     schema.TypeString,
@@ -217,9 +127,32 @@ func ResourceLustreFileSystem() *schema.Resource {
 				Optional: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 20),
-					validation.StringMatch(regexp.MustCompile(`^[0-9].[0-9]+$`), "must be in format x.y"),
+					validation.StringMatch(regexache.MustCompile(`^[0-9].[0-9]+$`), "must be in format x.y"),
+				),
+			},
+			"import_path": {
+				Type:     schema.TypeString,
+				Optional: true,
+				ForceNew: true,
+				ValidateFunc: validation.All(
+					validation.StringLenBetween(3, 900),
+					validation.StringMatch(regexache.MustCompile(`^s3://`), "must begin with s3://"),
 				),
 			},
+			"imported_file_chunk_size": {
+				Type:         schema.TypeInt,
+				Optional:     true,
+				Computed:     true,
+				ForceNew:     true,
+				ValidateFunc: validation.IntBetween(1, 512000),
+			},
+			"kms_key_id": {
+				Type:         schema.TypeString,
+				Optional:     true,
+				Computed:     true,
+				ForceNew:     true,
+				ValidateFunc: verify.ValidARN,
+			},
 			"log_configuration": {
 				Type:     schema.TypeList,
 				Optional: true,
@@ -245,6 +178,37 @@ func ResourceLustreFileSystem() *schema.Resource {
 					},
 				},
 			},
+			"mount_name": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"network_interface_ids": {
+				// As explained in https://docs.aws.amazon.com/fsx/latest/LustreGuide/mounting-on-premises.html, the first
+				// network_interface_id is the primary one, so ordering matters. Use TypeList instead of TypeSet to preserve it.
+				Type:     schema.TypeList,
+				Computed: true,
+				Elem:     &schema.Schema{Type: schema.TypeString},
+			},
+			"owner_id": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"per_unit_storage_throughput": {
+				Type:     schema.TypeInt,
+				Optional: true,
+				ForceNew: true,
+				ValidateFunc: validation.IntInSlice([]int{
+					12,
+					40,
+					50,
+					100,
+					125,
+					200,
+					250,
+					500,
+					1000,
+				}),
+			},
 			"root_squash_configuration": {
 				Type:     schema.TypeList,
 				Optional: true,
@@ -256,17 +220,59 @@ func ResourceLustreFileSystem() *schema.Resource {
 							Optional: true,
 							Elem: &schema.Schema{
 								Type:         schema.TypeString,
-								ValidateFunc: validation.StringMatch(regexp.MustCompile(`^([0-9\[\]\-]*\.){3}([0-9\[\]\-]*)@tcp$`), "must be in the standard Lustre NID foramt"),
+								ValidateFunc: validation.StringMatch(regexache.MustCompile(`^([0-9\[\]\-]*\.){3}([0-9\[\]\-]*)@tcp$`), "must be in the standard Lustre NID foramt"),
 							},
 						},
 						"root_squash": {
 							Type:         schema.TypeString,
 							Optional:     true,
-							ValidateFunc: validation.StringMatch(regexp.MustCompile(`^([0-9]{1,10}):([0-9]{1,10})$`), "must be in the format UID:GID"),
+							ValidateFunc: validation.StringMatch(regexache.MustCompile(`^([0-9]{1,10}):([0-9]{1,10})$`), "must be in the format UID:GID"),
 						},
 					},
 				},
 			},
+			"security_group_ids": {
+				Type:     schema.TypeSet,
+				Optional: true,
+				ForceNew: true,
+				MaxItems: 50,
+				Elem:     &schema.Schema{Type: schema.TypeString},
+			},
+			"storage_capacity": {
+				Type:         schema.TypeInt,
+				Optional:     true,
+				ValidateFunc: validation.IntAtLeast(1200),
+			},
+			"storage_type": {
+				Type:         schema.TypeString,
+				Optional:     true,
+				ForceNew:     true,
+				Default:      fsx.StorageTypeSsd,
+				ValidateFunc: validation.StringInSlice(fsx.StorageType_Values(), false),
+			},
+			"subnet_ids": {
+				Type:     schema.TypeList,
+				Required: true,
+				ForceNew: true,
+				MinItems: 1,
+				MaxItems: 1,
+				Elem:     &schema.Schema{Type: schema.TypeString},
+			},
+			names.AttrTags:    tftags.TagsSchema(),
+			names.AttrTagsAll: tftags.TagsSchemaComputed(),
+			"vpc_id": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"weekly_maintenance_start_time": {
+				Type:     schema.TypeString,
+				Optional: true,
+				Computed: true,
+				ValidateFunc: validation.All(
+					validation.StringLenBetween(7, 7),
+					validation.StringMatch(regexache.MustCompile(`^[1-7]:([01]\d|2[0-3]):?([0-5]\d)$`), "must be in the format d:HH:MM"),
+				),
+			},
 		},
 
 		CustomizeDiff: customdiff.Sequence(
@@ -294,152 +300,206 @@ func resourceLustreFileSystemCreate(ctx context.Context, d *schema.ResourceData,
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).FSxConn(ctx)
 
-	input := &fsx.CreateFileSystemInput{
+	inputC := &fsx.CreateFileSystemInput{
 		ClientRequestToken: aws.String(id.UniqueId()),
 		FileSystemType:     aws.String(fsx.FileSystemTypeLustre),
-		StorageCapacity:    aws.Int64(int64(d.Get("storage_capacity").(int))),
-		StorageType:        aws.String(d.Get("storage_type").(string)),
-		SubnetIds:          flex.ExpandStringList(d.Get("subnet_ids").([]interface{})),
 		LustreConfiguration: &fsx.CreateFileSystemLustreConfiguration{
 			DeploymentType: aws.String(d.Get("deployment_type").(string)),
 		},
-		Tags: getTagsIn(ctx),
+		StorageCapacity: aws.Int64(int64(d.Get("storage_capacity").(int))),
+		StorageType:     aws.String(d.Get("storage_type").(string)),
+		SubnetIds:       flex.ExpandStringList(d.Get("subnet_ids").([]interface{})),
+		Tags:            getTagsIn(ctx),
 	}
-
-	backupInput := &fsx.CreateFileSystemFromBackupInput{
+	inputB := &fsx.CreateFileSystemFromBackupInput{
 		ClientRequestToken: aws.String(id.UniqueId()),
-		StorageType:        aws.String(d.Get("storage_type").(string)),
-		SubnetIds:          flex.ExpandStringList(d.Get("subnet_ids").([]interface{})),
 		LustreConfiguration: &fsx.CreateFileSystemLustreConfiguration{
 			DeploymentType: aws.String(d.Get("deployment_type").(string)),
 		},
-		Tags: getTagsIn(ctx),
+		StorageType: aws.String(d.Get("storage_type").(string)),
+		SubnetIds:   flex.ExpandStringList(d.Get("subnet_ids").([]interface{})),
+		Tags:        getTagsIn(ctx),
 	}
 
-	//Applicable only for TypePersistent1 and TypePersistent2
-	if v, ok := d.GetOk("kms_key_id"); ok {
-		input.KmsKeyId = aws.String(v.(string))
-		backupInput.KmsKeyId = aws.String(v.(string))
+	if v, ok := d.GetOk("auto_import_policy"); ok {
+		inputC.LustreConfiguration.AutoImportPolicy = aws.String(v.(string))
+		inputB.LustreConfiguration.AutoImportPolicy = aws.String(v.(string))
 	}
 
 	if v, ok := d.GetOk("automatic_backup_retention_days"); ok {
-		input.LustreConfiguration.AutomaticBackupRetentionDays = aws.Int64(int64(v.(int)))
-		backupInput.LustreConfiguration.AutomaticBackupRetentionDays = aws.Int64(int64(v.(int)))
+		inputC.LustreConfiguration.AutomaticBackupRetentionDays = aws.Int64(int64(v.(int)))
+		inputB.LustreConfiguration.AutomaticBackupRetentionDays = aws.Int64(int64(v.(int)))
 	}
 
-	if v, ok := d.GetOk("daily_automatic_backup_start_time"); ok {
-		input.LustreConfiguration.DailyAutomaticBackupStartTime = aws.String(v.(string))
-		backupInput.LustreConfiguration.DailyAutomaticBackupStartTime = aws.String(v.(string))
+	if v, ok := d.GetOk("copy_tags_to_backups"); ok {
+		inputC.LustreConfiguration.CopyTagsToBackups = aws.Bool(v.(bool))
+		inputB.LustreConfiguration.CopyTagsToBackups = aws.Bool(v.(bool))
 	}
 
-	if v, ok := d.GetOk("export_path"); ok {
-		input.LustreConfiguration.ExportPath = aws.String(v.(string))
-		backupInput.LustreConfiguration.ExportPath = aws.String(v.(string))
+	if v, ok := d.GetOk("daily_automatic_backup_start_time"); ok {
+		inputC.LustreConfiguration.DailyAutomaticBackupStartTime = aws.String(v.(string))
+		inputB.LustreConfiguration.DailyAutomaticBackupStartTime = aws.String(v.(string))
 	}
 
-	if v, ok := d.GetOk("import_path"); ok {
-		input.LustreConfiguration.ImportPath = aws.String(v.(string))
-		backupInput.LustreConfiguration.ImportPath = aws.String(v.(string))
+	if v, ok := d.GetOk("data_compression_type"); ok {
+		inputC.LustreConfiguration.DataCompressionType = aws.String(v.(string))
+		inputB.LustreConfiguration.DataCompressionType = aws.String(v.(string))
 	}
 
-	if v, ok := d.GetOk("imported_file_chunk_size"); ok {
-		input.LustreConfiguration.ImportedFileChunkSize = aws.Int64(int64(v.(int)))
-		backupInput.LustreConfiguration.ImportedFileChunkSize = aws.Int64(int64(v.(int)))
+	if v, ok := d.GetOk("drive_cache_type"); ok {
+		inputC.LustreConfiguration.DriveCacheType = aws.String(v.(string))
+		inputB.LustreConfiguration.DriveCacheType = aws.String(v.(string))
 	}
 
-	if v, ok := d.GetOk("security_group_ids"); ok {
-		input.SecurityGroupIds = flex.ExpandStringSet(v.(*schema.Set))
-		backupInput.SecurityGroupIds = flex.ExpandStringSet(v.(*schema.Set))
+	if v, ok := d.GetOk("export_path"); ok {
+		inputC.LustreConfiguration.ExportPath = aws.String(v.(string))
+		inputB.LustreConfiguration.ExportPath = aws.String(v.(string))
 	}
 
-	if v, ok := d.GetOk("weekly_maintenance_start_time"); ok {
-		input.LustreConfiguration.WeeklyMaintenanceStartTime = aws.String(v.(string))
-		backupInput.LustreConfiguration.WeeklyMaintenanceStartTime = aws.String(v.(string))
+	if v, ok := d.GetOk("file_system_type_version"); ok {
+		inputC.FileSystemTypeVersion = aws.String(v.(string))
+		inputB.FileSystemTypeVersion = aws.String(v.(string))
 	}
 
-	if v, ok := d.GetOk("per_unit_storage_throughput"); ok {
-		input.LustreConfiguration.PerUnitStorageThroughput = aws.Int64(int64(v.(int)))
-		backupInput.LustreConfiguration.PerUnitStorageThroughput = aws.Int64(int64(v.(int)))
+	if v, ok := d.GetOk("import_path"); ok {
+		inputC.LustreConfiguration.ImportPath = aws.String(v.(string))
+		inputB.LustreConfiguration.ImportPath = aws.String(v.(string))
 	}
 
-	if v, ok := d.GetOk("drive_cache_type"); ok {
-		input.LustreConfiguration.DriveCacheType = aws.String(v.(string))
-		backupInput.LustreConfiguration.DriveCacheType = aws.String(v.(string))
+	if v, ok := d.GetOk("imported_file_chunk_size"); ok {
+		inputC.LustreConfiguration.ImportedFileChunkSize = aws.Int64(int64(v.(int)))
+		inputB.LustreConfiguration.ImportedFileChunkSize = aws.Int64(int64(v.(int)))
 	}
 
-	if v, ok := d.GetOk("auto_import_policy"); ok {
-		input.LustreConfiguration.AutoImportPolicy = aws.String(v.(string))
-		backupInput.LustreConfiguration.AutoImportPolicy = aws.String(v.(string))
+	// Applicable only for TypePersistent1 and TypePersistent2.
+	if v, ok := d.GetOk("kms_key_id"); ok {
+		inputC.KmsKeyId = aws.String(v.(string))
+		inputB.KmsKeyId = aws.String(v.(string))
 	}
 
-	if v, ok := d.GetOk("copy_tags_to_backups"); ok {
-		input.LustreConfiguration.CopyTagsToBackups = aws.Bool(v.(bool))
-		backupInput.LustreConfiguration.CopyTagsToBackups = aws.Bool(v.(bool))
+	if v, ok := d.GetOk("log_configuration"); ok && len(v.([]interface{})) > 0 {
+		inputC.LustreConfiguration.LogConfiguration = expandLustreLogCreateConfiguration(v.([]interface{}))
+		inputB.LustreConfiguration.LogConfiguration = expandLustreLogCreateConfiguration(v.([]interface{}))
 	}
 
-	if v, ok := d.GetOk("data_compression_type"); ok {
-		input.LustreConfiguration.DataCompressionType = aws.String(v.(string))
-		backupInput.LustreConfiguration.DataCompressionType = aws.String(v.(string))
+	if v, ok := d.GetOk("per_unit_storage_throughput"); ok {
+		inputC.LustreConfiguration.PerUnitStorageThroughput = aws.Int64(int64(v.(int)))
+		inputB.LustreConfiguration.PerUnitStorageThroughput = aws.Int64(int64(v.(int)))
 	}
 
-	if v, ok := d.GetOk("file_system_type_version"); ok {
-		input.FileSystemTypeVersion = aws.String(v.(string))
-		backupInput.FileSystemTypeVersion = aws.String(v.(string))
+	if v, ok := d.GetOk("root_squash_configuration"); ok && len(v.([]interface{})) > 0 {
+		inputC.LustreConfiguration.RootSquashConfiguration = expandLustreRootSquashConfiguration(v.([]interface{}))
+		inputB.LustreConfiguration.RootSquashConfiguration = expandLustreRootSquashConfiguration(v.([]interface{}))
 	}
 
-	if v, ok := d.GetOk("log_configuration"); ok && len(v.([]interface{})) > 0 {
-		input.LustreConfiguration.LogConfiguration = expandLustreLogCreateConfiguration(v.([]interface{}))
-		backupInput.LustreConfiguration.LogConfiguration = expandLustreLogCreateConfiguration(v.([]interface{}))
+	if v, ok := d.GetOk("security_group_ids"); ok {
+		inputC.SecurityGroupIds = flex.ExpandStringSet(v.(*schema.Set))
+		inputB.SecurityGroupIds = flex.ExpandStringSet(v.(*schema.Set))
 	}
 
-	if v, ok := d.GetOk("root_squash_configuration"); ok && len(v.([]interface{})) > 0 {
-		input.LustreConfiguration.RootSquashConfiguration = expandLustreRootSquashConfiguration(v.([]interface{}))
-		backupInput.LustreConfiguration.RootSquashConfiguration = expandLustreRootSquashConfiguration(v.([]interface{}))
+	if v, ok := d.GetOk("weekly_maintenance_start_time"); ok {
+		inputC.LustreConfiguration.WeeklyMaintenanceStartTime = aws.String(v.(string))
+		inputB.LustreConfiguration.WeeklyMaintenanceStartTime = aws.String(v.(string))
 	}
 
 	if v, ok := d.GetOk("backup_id"); ok {
-		backupInput.BackupId = aws.String(v.(string))
+		backupID := v.(string)
+		inputB.BackupId = aws.String(backupID)
 
-		log.Printf("[DEBUG] Creating FSx Lustre File System: %s", backupInput)
-		result, err := conn.CreateFileSystemFromBackupWithContext(ctx, backupInput)
+		output, err := conn.CreateFileSystemFromBackupWithContext(ctx, inputB)
 
 		if err != nil {
-			return sdkdiag.AppendErrorf(diags, "creating FSx Lustre File System from backup: %s", err)
+			return sdkdiag.AppendErrorf(diags, "creating FSx for Lustre File System from backup (%s): %s", backupID, err)
 		}
 
-		d.SetId(aws.StringValue(result.FileSystem.FileSystemId))
+		d.SetId(aws.StringValue(output.FileSystem.FileSystemId))
 	} else {
-		log.Printf("[DEBUG] Creating FSx Lustre File System: %s", input)
-		result, err := conn.CreateFileSystemWithContext(ctx, input)
+		output, err := conn.CreateFileSystemWithContext(ctx, inputC)
 
 		if err != nil {
-			return sdkdiag.AppendErrorf(diags, "creating FSx Lustre File System: %s", err)
+			return sdkdiag.AppendErrorf(diags, "creating FSx for Lustre File System: %s", err)
 		}
 
-		d.SetId(aws.StringValue(result.FileSystem.FileSystemId))
+		d.SetId(aws.StringValue(output.FileSystem.FileSystemId))
 	}
 
 	if _, err := waitFileSystemCreated(ctx, conn, d.Id(), d.Timeout(schema.TimeoutCreate)); err != nil {
-		return sdkdiag.AppendErrorf(diags, "waiting for FSx Lustre File System (%s) create: %s", d.Id(), err)
+		return sdkdiag.AppendErrorf(diags, "waiting for FSx for Lustre File System (%s) create: %s", d.Id(), err)
 	}
 
 	return append(diags, resourceLustreFileSystemRead(ctx, d, meta)...)
 }
 
+func resourceLustreFileSystemRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).FSxConn(ctx)
+
+	filesystem, err := FindLustreFileSystemByID(ctx, conn, d.Id())
+
+	if !d.IsNewResource() && tfresource.NotFound(err) {
+		log.Printf("[WARN] FSx for Lustre File System (%s) not found, removing from state", d.Id())
+		d.SetId("")
+		return diags
+	}
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "reading FSx for Lustre File System (%s): %s", d.Id(), err)
+	}
+
+	lustreConfig := filesystem.LustreConfiguration
+	if lustreConfig.DataRepositoryConfiguration == nil {
+		// Initialize an empty structure to simplify d.Set() handling.
+		lustreConfig.DataRepositoryConfiguration = &fsx.DataRepositoryConfiguration{}
+	}
+
+	d.Set("arn", filesystem.ResourceARN)
+	d.Set("auto_import_policy", lustreConfig.DataRepositoryConfiguration.AutoImportPolicy)
+	d.Set("automatic_backup_retention_days", lustreConfig.AutomaticBackupRetentionDays)
+	d.Set("copy_tags_to_backups", lustreConfig.CopyTagsToBackups)
+	d.Set("daily_automatic_backup_start_time", lustreConfig.DailyAutomaticBackupStartTime)
+	d.Set("data_compression_type", lustreConfig.DataCompressionType)
+	d.Set("deployment_type", lustreConfig.DeploymentType)
+	d.Set("dns_name", filesystem.DNSName)
+	d.Set("drive_cache_type", lustreConfig.DriveCacheType)
+	d.Set("export_path", lustreConfig.DataRepositoryConfiguration.ExportPath)
+	d.Set("file_system_type_version", filesystem.FileSystemTypeVersion)
+	d.Set("import_path", lustreConfig.DataRepositoryConfiguration.ImportPath)
+	d.Set("imported_file_chunk_size", lustreConfig.DataRepositoryConfiguration.ImportedFileChunkSize)
+	d.Set("kms_key_id", filesystem.KmsKeyId)
+	if err := d.Set("log_configuration", flattenLustreLogConfiguration(lustreConfig.LogConfiguration)); err != nil {
+		return sdkdiag.AppendErrorf(diags, "setting log_configuration: %s", err)
+	}
+	d.Set("mount_name", lustreConfig.MountName)
+	d.Set("network_interface_ids", aws.StringValueSlice(filesystem.NetworkInterfaceIds))
+	d.Set("owner_id", filesystem.OwnerId)
+	d.Set("per_unit_storage_throughput", lustreConfig.PerUnitStorageThroughput)
+	if err := d.Set("root_squash_configuration", flattenLustreRootSquashConfiguration(lustreConfig.RootSquashConfiguration)); err != nil {
+		return sdkdiag.AppendErrorf(diags, "setting root_squash_configuration: %s", err)
+	}
+	d.Set("storage_capacity", filesystem.StorageCapacity)
+	d.Set("storage_type", filesystem.StorageType)
+	d.Set("subnet_ids", aws.StringValueSlice(filesystem.SubnetIds))
+	d.Set("vpc_id", filesystem.VpcId)
+	d.Set("weekly_maintenance_start_time", lustreConfig.WeeklyMaintenanceStartTime)
+
+	setTagsOut(ctx, filesystem.Tags)
+
+	return diags
+}
+
 func resourceLustreFileSystemUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).FSxConn(ctx)
 
-	if d.HasChangesExcept("tags_all", "tags") {
-		var waitAdminAction = false
+	if d.HasChangesExcept("tags", "tags_all") {
 		input := &fsx.UpdateFileSystemInput{
 			ClientRequestToken:  aws.String(id.UniqueId()),
 			FileSystemId:        aws.String(d.Id()),
 			LustreConfiguration: &fsx.UpdateFileSystemLustreConfiguration{},
 		}
 
-		if d.HasChange("weekly_maintenance_start_time") {
-			input.LustreConfiguration.WeeklyMaintenanceStartTime = aws.String(d.Get("weekly_maintenance_start_time").(string))
+		if d.HasChange("auto_import_policy") {
+			input.LustreConfiguration.AutoImportPolicy = aws.String(d.Get("auto_import_policy").(string))
 		}
 
 		if d.HasChange("automatic_backup_retention_days") {
@@ -450,143 +510,64 @@ func resourceLustreFileSystemUpdate(ctx context.Context, d *schema.ResourceData,
 			input.LustreConfiguration.DailyAutomaticBackupStartTime = aws.String(d.Get("daily_automatic_backup_start_time").(string))
 		}
 
-		if d.HasChange("auto_import_policy") {
-			input.LustreConfiguration.AutoImportPolicy = aws.String(d.Get("auto_import_policy").(string))
-		}
-
-		if d.HasChange("storage_capacity") {
-			input.StorageCapacity = aws.Int64(int64(d.Get("storage_capacity").(int)))
-		}
-
 		if v, ok := d.GetOk("data_compression_type"); ok {
 			input.LustreConfiguration.DataCompressionType = aws.String(v.(string))
 		}
 
 		if d.HasChange("log_configuration") {
 			input.LustreConfiguration.LogConfiguration = expandLustreLogCreateConfiguration(d.Get("log_configuration").([]interface{}))
-			waitAdminAction = true
 		}
 
 		if d.HasChange("root_squash_configuration") {
 			input.LustreConfiguration.RootSquashConfiguration = expandLustreRootSquashConfiguration(d.Get("root_squash_configuration").([]interface{}))
-			waitAdminAction = true
 		}
 
+		if d.HasChange("storage_capacity") {
+			input.StorageCapacity = aws.Int64(int64(d.Get("storage_capacity").(int)))
+		}
+
+		if d.HasChange("weekly_maintenance_start_time") {
+			input.LustreConfiguration.WeeklyMaintenanceStartTime = aws.String(d.Get("weekly_maintenance_start_time").(string))
+		}
+
+		startTime := time.Now()
 		_, err := conn.UpdateFileSystemWithContext(ctx, input)
+
 		if err != nil {
-			return sdkdiag.AppendErrorf(diags, "updating FSX Lustre File System (%s): %s", d.Id(), err)
+			return sdkdiag.AppendErrorf(diags, "updating FSX for Lustre File System (%s): %s", d.Id(), err)
 		}
 
-		if _, err := waitFileSystemUpdated(ctx, conn, d.Id(), d.Timeout(schema.TimeoutUpdate)); err != nil {
-			return sdkdiag.AppendErrorf(diags, "waiting for FSx Lustre File System (%s) update: %s", d.Id(), err)
+		if _, err := waitFileSystemUpdated(ctx, conn, d.Id(), startTime, d.Timeout(schema.TimeoutUpdate)); err != nil {
+			return sdkdiag.AppendErrorf(diags, "waiting for FSx for Lustre File System (%s) update: %s", d.Id(), err)
 		}
 
-		if waitAdminAction {
-			if _, err := waitAdministrativeActionCompleted(ctx, conn, d.Id(), fsx.AdministrativeActionTypeFileSystemUpdate, d.Timeout(schema.TimeoutUpdate)); err != nil {
-				return sdkdiag.AppendErrorf(diags, "waiting for FSx Lustre File System (%s) Log Configuratio to be updated: %s", d.Id(), err)
-			}
+		if _, err := waitFileSystemAdministrativeActionCompleted(ctx, conn, d.Id(), fsx.AdministrativeActionTypeFileSystemUpdate, d.Timeout(schema.TimeoutUpdate)); err != nil {
+			return sdkdiag.AppendErrorf(diags, "waiting for FSx for Lustre File System (%s) administrative action (%s) complete: %s", d.Id(), fsx.AdministrativeActionTypeFileSystemUpdate, err)
 		}
 	}
 
 	return append(diags, resourceLustreFileSystemRead(ctx, d, meta)...)
 }
 
-func resourceLustreFileSystemRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).FSxConn(ctx)
-
-	filesystem, err := FindFileSystemByID(ctx, conn, d.Id())
-	if !d.IsNewResource() && tfresource.NotFound(err) {
-		log.Printf("[WARN] FSx Lustre File System (%s) not found, removing from state", d.Id())
-		d.SetId("")
-		return diags
-	}
-
-	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "reading FSx Lustre File System (%s): %s", d.Id(), err)
-	}
-
-	lustreConfig := filesystem.LustreConfiguration
-
-	if filesystem.WindowsConfiguration != nil {
-		return sdkdiag.AppendErrorf(diags, "expected FSx Lustre File System, found FSx Windows File System: %s", d.Id())
-	}
-
-	if lustreConfig == nil {
-		return sdkdiag.AppendErrorf(diags, "describing FSx Lustre File System (%s): empty Lustre configuration", d.Id())
-	}
-
-	if lustreConfig.DataRepositoryConfiguration == nil {
-		// Initialize an empty structure to simplify d.Set() handling
-		lustreConfig.DataRepositoryConfiguration = &fsx.DataRepositoryConfiguration{}
-	}
-
-	d.Set("arn", filesystem.ResourceARN)
-	d.Set("dns_name", filesystem.DNSName)
-	d.Set("export_path", lustreConfig.DataRepositoryConfiguration.ExportPath)
-	d.Set("import_path", lustreConfig.DataRepositoryConfiguration.ImportPath)
-	d.Set("auto_import_policy", lustreConfig.DataRepositoryConfiguration.AutoImportPolicy)
-	d.Set("imported_file_chunk_size", lustreConfig.DataRepositoryConfiguration.ImportedFileChunkSize)
-	d.Set("deployment_type", lustreConfig.DeploymentType)
-	d.Set("per_unit_storage_throughput", lustreConfig.PerUnitStorageThroughput)
-	d.Set("mount_name", lustreConfig.MountName)
-	d.Set("storage_type", filesystem.StorageType)
-	d.Set("drive_cache_type", lustreConfig.DriveCacheType)
-	d.Set("kms_key_id", filesystem.KmsKeyId)
-
-	if err := d.Set("network_interface_ids", aws.StringValueSlice(filesystem.NetworkInterfaceIds)); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting network_interface_ids: %s", err)
-	}
-
-	d.Set("owner_id", filesystem.OwnerId)
-	d.Set("storage_capacity", filesystem.StorageCapacity)
-
-	if err := d.Set("subnet_ids", aws.StringValueSlice(filesystem.SubnetIds)); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting subnet_ids: %s", err)
-	}
-
-	if err := d.Set("log_configuration", flattenLustreLogConfiguration(lustreConfig.LogConfiguration)); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting log_configuration: %s", err)
-	}
-
-	if err := d.Set("root_squash_configuration", flattenLustreRootSquashConfiguration(lustreConfig.RootSquashConfiguration)); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting root_squash_configuration: %s", err)
-	}
-
-	setTagsOut(ctx, filesystem.Tags)
-
-	d.Set("vpc_id", filesystem.VpcId)
-	d.Set("weekly_maintenance_start_time", lustreConfig.WeeklyMaintenanceStartTime)
-	d.Set("automatic_backup_retention_days", lustreConfig.AutomaticBackupRetentionDays)
-	d.Set("daily_automatic_backup_start_time", lustreConfig.DailyAutomaticBackupStartTime)
-	d.Set("copy_tags_to_backups", lustreConfig.CopyTagsToBackups)
-	d.Set("data_compression_type", lustreConfig.DataCompressionType)
-	d.Set("file_system_type_version", filesystem.FileSystemTypeVersion)
-
-	return diags
-}
-
 func resourceLustreFileSystemDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).FSxConn(ctx)
 
-	request := &fsx.DeleteFileSystemInput{
+	log.Printf("[DEBUG] Deleting FSx for Lustre File System: %s", d.Id())
+	_, err := conn.DeleteFileSystemWithContext(ctx, &fsx.DeleteFileSystemInput{
 		FileSystemId: aws.String(d.Id()),
-	}
-
-	log.Printf("[DEBUG] Deleting FSx Lustre File System: %s", d.Id())
-	_, err := conn.DeleteFileSystemWithContext(ctx, request)
+	})
 
 	if tfawserr.ErrCodeEquals(err, fsx.ErrCodeFileSystemNotFound) {
 		return diags
 	}
 
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "deleting FSx Lustre File System (%s): %s", d.Id(), err)
+		return sdkdiag.AppendErrorf(diags, "deleting FSx for Lustre File System (%s): %s", d.Id(), err)
 	}
 
 	if _, err := waitFileSystemDeleted(ctx, conn, d.Id(), d.Timeout(schema.TimeoutDelete)); err != nil {
-		return sdkdiag.AppendErrorf(diags, "waiting for FSx Lustre File System (%s) to deleted: %s", d.Id(), err)
+		return sdkdiag.AppendErrorf(diags, "waiting for FSx for Lustre File System (%s) delete: %s", d.Id(), err)
 	}
 
 	return diags
@@ -676,3 +657,236 @@ func logStateFunc(v interface{}) string {
 	}
 	return value
 }
+
+func FindLustreFileSystemByID(ctx context.Context, conn *fsx.FSx, id string) (*fsx.FileSystem, error) {
+	output, err := findFileSystemByIDAndType(ctx, conn, id, fsx.FileSystemTypeLustre)
+
+	if err != nil {
+		return nil, err
+	}
+
+	if output.LustreConfiguration == nil {
+		return nil, tfresource.NewEmptyResultError(nil)
+	}
+
+	return output, nil
+}
+
+func findFileSystemByID(ctx context.Context, conn *fsx.FSx, id string) (*fsx.FileSystem, error) {
+	input := &fsx.DescribeFileSystemsInput{
+		FileSystemIds: aws.StringSlice([]string{id}),
+	}
+
+	return findFileSystem(ctx, conn, input, tfslices.PredicateTrue[*fsx.FileSystem]())
+}
+
+func findFileSystemByIDAndType(ctx context.Context, conn *fsx.FSx, fsID, fsType string) (*fsx.FileSystem, error) {
+	input := &fsx.DescribeFileSystemsInput{
+		FileSystemIds: aws.StringSlice([]string{fsID}),
+	}
+	filter := func(fs *fsx.FileSystem) bool {
+		return aws.StringValue(fs.FileSystemType) == fsType
+	}
+
+	return findFileSystem(ctx, conn, input, filter)
+}
+
+func findFileSystem(ctx context.Context, conn *fsx.FSx, input *fsx.DescribeFileSystemsInput, filter tfslices.Predicate[*fsx.FileSystem]) (*fsx.FileSystem, error) {
+	output, err := findFileSystems(ctx, conn, input, filter)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return tfresource.AssertSinglePtrResult(output)
+}
+
+func findFileSystems(ctx context.Context, conn *fsx.FSx, input *fsx.DescribeFileSystemsInput, filter tfslices.Predicate[*fsx.FileSystem]) ([]*fsx.FileSystem, error) {
+	var output []*fsx.FileSystem
+
+	err := conn.DescribeFileSystemsPagesWithContext(ctx, input, func(page *fsx.DescribeFileSystemsOutput, lastPage bool) bool {
+		if page == nil {
+			return !lastPage
+		}
+
+		for _, v := range page.FileSystems {
+			if v != nil && filter(v) {
+				output = append(output, v)
+			}
+		}
+
+		return !lastPage
+	})
+
+	if tfawserr.ErrCodeEquals(err, fsx.ErrCodeFileSystemNotFound) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	return output, nil
+}
+
+func statusFileSystem(ctx context.Context, conn *fsx.FSx, id string) retry.StateRefreshFunc {
+	return func() (interface{}, string, error) {
+		output, err := findFileSystemByID(ctx, conn, id)
+
+		if tfresource.NotFound(err) {
+			return nil, "", nil
+		}
+
+		if err != nil {
+			return nil, "", err
+		}
+
+		return output, aws.StringValue(output.Lifecycle), nil
+	}
+}
+
+func waitFileSystemCreated(ctx context.Context, conn *fsx.FSx, id string, timeout time.Duration) (*fsx.FileSystem, error) { //nolint:unparam
+	stateConf := &retry.StateChangeConf{
+		Pending: []string{fsx.FileSystemLifecycleCreating},
+		Target:  []string{fsx.FileSystemLifecycleAvailable},
+		Refresh: statusFileSystem(ctx, conn, id),
+		Timeout: timeout,
+		Delay:   30 * time.Second,
+	}
+
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+
+	if output, ok := outputRaw.(*fsx.FileSystem); ok {
+		if status, details := aws.StringValue(output.Lifecycle), output.FailureDetails; status == fsx.FileSystemLifecycleFailed && details != nil {
+			tfresource.SetLastError(err, errors.New(aws.StringValue(details.Message)))
+		}
+
+		return output, err
+	}
+
+	return nil, err
+}
+
+func waitFileSystemUpdated(ctx context.Context, conn *fsx.FSx, id string, startTime time.Time, timeout time.Duration) (*fsx.FileSystem, error) { //nolint:unparam
+	stateConf := &retry.StateChangeConf{
+		Pending: []string{fsx.FileSystemLifecycleUpdating},
+		Target:  []string{fsx.FileSystemLifecycleAvailable},
+		Refresh: statusFileSystem(ctx, conn, id),
+		Timeout: timeout,
+		Delay:   30 * time.Second,
+	}
+
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+
+	if output, ok := outputRaw.(*fsx.FileSystem); ok {
+		switch status := aws.StringValue(output.Lifecycle); status {
+		case fsx.FileSystemLifecycleFailed, fsx.FileSystemLifecycleMisconfigured, fsx.FileSystemLifecycleMisconfiguredUnavailable:
+			// Report any failed non-FILE_SYSTEM_UPDATE administrative actions.
+			// See https://docs.aws.amazon.com/fsx/latest/APIReference/API_AdministrativeAction.html#FSx-Type-AdministrativeAction-AdministrativeActionType.
+			administrativeActions := tfslices.Filter(output.AdministrativeActions, func(v *fsx.AdministrativeAction) bool {
+				return v != nil && aws.StringValue(v.Status) == fsx.StatusFailed && aws.StringValue(v.AdministrativeActionType) != fsx.AdministrativeActionTypeFileSystemUpdate && v.FailureDetails != nil && startTime.Before(aws.TimeValue(v.RequestTime))
+			})
+			administrativeActionsError := errors.Join(tfslices.ApplyToAll(administrativeActions, func(v *fsx.AdministrativeAction) error {
+				return fmt.Errorf("%s: %s", aws.StringValue(v.AdministrativeActionType), aws.StringValue(v.FailureDetails.Message))
+			})...)
+
+			if details := output.FailureDetails; details != nil {
+				if message := aws.StringValue(details.Message); administrativeActionsError != nil {
+					tfresource.SetLastError(err, fmt.Errorf("%s: %w", message, administrativeActionsError))
+				} else {
+					tfresource.SetLastError(err, errors.New(message))
+				}
+			} else {
+				tfresource.SetLastError(err, administrativeActionsError)
+			}
+		}
+
+		return output, err
+	}
+
+	return nil, err
+}
+
+func waitFileSystemDeleted(ctx context.Context, conn *fsx.FSx, id string, timeout time.Duration) (*fsx.FileSystem, error) { //nolint:unparam
+	stateConf := &retry.StateChangeConf{
+		Pending: []string{fsx.FileSystemLifecycleAvailable, fsx.FileSystemLifecycleDeleting},
+		Target:  []string{},
+		Refresh: statusFileSystem(ctx, conn, id),
+		Timeout: timeout,
+		Delay:   30 * time.Second,
+	}
+
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+
+	if output, ok := outputRaw.(*fsx.FileSystem); ok {
+		if status, details := aws.StringValue(output.Lifecycle), output.FailureDetails; status == fsx.FileSystemLifecycleFailed && details != nil {
+			tfresource.SetLastError(err, errors.New(aws.StringValue(details.Message)))
+		}
+
+		return output, err
+	}
+
+	return nil, err
+}
+
+func findFileSystemAdministrativeAction(ctx context.Context, conn *fsx.FSx, fsID, actionType string) (*fsx.AdministrativeAction, error) {
+	output, err := findFileSystemByID(ctx, conn, fsID)
+
+	if err != nil {
+		return nil, err
+	}
+
+	for _, v := range output.AdministrativeActions {
+		if v == nil {
+			continue
+		}
+
+		if aws.StringValue(v.AdministrativeActionType) == actionType {
+			return v, nil
+		}
+	}
+
+	// If the administrative action isn't found, assume it's complete.
+	return &fsx.AdministrativeAction{Status: aws.String(fsx.StatusCompleted)}, nil
+}
+
+func statusFileSystemAdministrativeAction(ctx context.Context, conn *fsx.FSx, fsID, actionType string) retry.StateRefreshFunc {
+	return func() (interface{}, string, error) {
+		output, err := findFileSystemAdministrativeAction(ctx, conn, fsID, actionType)
+
+		if tfresource.NotFound(err) {
+			return nil, "", nil
+		}
+
+		if err != nil {
+			return nil, "", err
+		}
+
+		return output, aws.StringValue(output.Status), nil
+	}
+}
+
+func waitFileSystemAdministrativeActionCompleted(ctx context.Context, conn *fsx.FSx, fsID, actionType string, timeout time.Duration) (*fsx.AdministrativeAction, error) { //nolint:unparam
+	stateConf := &retry.StateChangeConf{
+		Pending: []string{fsx.StatusInProgress, fsx.StatusPending},
+		Target:  []string{fsx.StatusCompleted, fsx.StatusUpdatedOptimizing},
+		Refresh: statusFileSystemAdministrativeAction(ctx, conn, fsID, actionType),
+		Timeout: timeout,
+		Delay:   30 * time.Second,
+	}
+
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+
+	if output, ok := outputRaw.(*fsx.AdministrativeAction); ok {
+		if status, details := aws.StringValue(output.Status), output.FailureDetails; status == fsx.StatusFailed && details != nil {
+			tfresource.SetLastError(err, errors.New(aws.StringValue(output.FailureDetails.Message)))
+		}
+
+		return output, err
+	}
+
+	return nil, err
+}
diff --git a/internal/service/fsx/lustre_file_system_test.go b/internal/service/fsx/lustre_file_system_test.go
index af1fa3be351..6795c9949ac 100644
--- a/internal/service/fsx/lustre_file_system_test.go
+++ b/internal/service/fsx/lustre_file_system_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package fsx_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/endpoints"
 	"github.com/aws/aws-sdk-go/service/fsx"
@@ -22,7 +25,7 @@ func TestAccFSxLustreFileSystem_basic(t *testing.T) {
 	ctx := acctest.Context(t)
 	var filesystem fsx.FileSystem
 	resourceName := "aws_fsx_lustre_file_system.test"
-
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	deploymentType := fsx.LustreDeploymentTypeScratch1
 	if acctest.Partition() == endpoints.AwsUsGovPartitionID {
 		deploymentType = fsx.LustreDeploymentTypeScratch2 // SCRATCH_1 not supported in GovCloud
@@ -35,30 +38,30 @@ func TestAccFSxLustreFileSystem_basic(t *testing.T) {
 		CheckDestroy:             testAccCheckLustreFileSystemDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccLustreFileSystemConfig_subnetIDs1(),
-				Check: resource.ComposeTestCheckFunc(
+				Config: testAccLustreFileSystemConfig_basic(rName),
+				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckLustreFileSystemExists(ctx, resourceName, &filesystem),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "fsx", regexp.MustCompile(`file-system/fs-.+`)),
-					resource.TestMatchResourceAttr(resourceName, "dns_name", regexp.MustCompile(`fs-.+\.fsx\.`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "fsx", regexache.MustCompile(`file-system/fs-.+`)),
+					resource.TestCheckResourceAttr(resourceName, "automatic_backup_retention_days", "0"),
+					resource.TestCheckResourceAttr(resourceName, "copy_tags_to_backups", "false"),
+					resource.TestCheckResourceAttr(resourceName, "data_compression_type", fsx.DataCompressionTypeNone),
+					resource.TestCheckResourceAttr(resourceName, "deployment_type", deploymentType),
+					resource.TestMatchResourceAttr(resourceName, "dns_name", regexache.MustCompile(`fs-.+\.fsx\.`)),
 					resource.TestCheckResourceAttr(resourceName, "export_path", ""),
 					resource.TestCheckResourceAttr(resourceName, "import_path", ""),
 					resource.TestCheckResourceAttr(resourceName, "imported_file_chunk_size", "0"),
+					resource.TestCheckResourceAttr(resourceName, "log_configuration.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "log_configuration.0.level", "DISABLED"),
 					resource.TestCheckResourceAttrSet(resourceName, "mount_name"),
 					resource.TestCheckResourceAttr(resourceName, "network_interface_ids.#", "2"),
 					acctest.CheckResourceAttrAccountID(resourceName, "owner_id"),
+					resource.TestCheckResourceAttr(resourceName, "security_group_ids.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "storage_capacity", "1200"),
+					resource.TestCheckResourceAttr(resourceName, "storage_type", fsx.StorageTypeSsd),
 					resource.TestCheckResourceAttr(resourceName, "subnet_ids.#", "1"),
-					resource.TestCheckResourceAttr(resourceName, "security_group_ids.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
-					resource.TestMatchResourceAttr(resourceName, "vpc_id", regexp.MustCompile(`^vpc-.+`)),
-					resource.TestMatchResourceAttr(resourceName, "weekly_maintenance_start_time", regexp.MustCompile(`^\d:\d\d:\d\d$`)),
-					resource.TestCheckResourceAttr(resourceName, "deployment_type", deploymentType),
-					resource.TestCheckResourceAttr(resourceName, "automatic_backup_retention_days", "0"),
-					resource.TestCheckResourceAttr(resourceName, "storage_type", fsx.StorageTypeSsd),
-					resource.TestCheckResourceAttr(resourceName, "copy_tags_to_backups", "false"),
-					resource.TestCheckResourceAttr(resourceName, "data_compression_type", fsx.DataCompressionTypeNone),
-					resource.TestCheckResourceAttr(resourceName, "log_configuration.#", "1"),
-					resource.TestCheckResourceAttr(resourceName, "log_configuration.0.level", "DISABLED"),
+					resource.TestMatchResourceAttr(resourceName, "vpc_id", regexache.MustCompile(`^vpc-.+`)),
+					resource.TestMatchResourceAttr(resourceName, "weekly_maintenance_start_time", regexache.MustCompile(`^\d:\d\d:\d\d$`)),
 				),
 			},
 			{
@@ -75,6 +78,7 @@ func TestAccFSxLustreFileSystem_disappears(t *testing.T) {
 	ctx := acctest.Context(t)
 	var filesystem fsx.FileSystem
 	resourceName := "aws_fsx_lustre_file_system.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
@@ -83,7 +87,7 @@ func TestAccFSxLustreFileSystem_disappears(t *testing.T) {
 		CheckDestroy:             testAccCheckLustreFileSystemDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccLustreFileSystemConfig_subnetIDs1(),
+				Config: testAccLustreFileSystemConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckLustreFileSystemExists(ctx, resourceName, &filesystem),
 					acctest.CheckResourceDisappears(ctx, acctest.Provider, tffsx.ResourceLustreFileSystem(), resourceName),
@@ -98,6 +102,7 @@ func TestAccFSxLustreFileSystem_dataCompression(t *testing.T) {
 	ctx := acctest.Context(t)
 	var filesystem fsx.FileSystem
 	resourceName := "aws_fsx_lustre_file_system.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
@@ -106,7 +111,7 @@ func TestAccFSxLustreFileSystem_dataCompression(t *testing.T) {
 		CheckDestroy:             testAccCheckLustreFileSystemDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccLustreFileSystemConfig_compression(),
+				Config: testAccLustreFileSystemConfig_compression(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckLustreFileSystemExists(ctx, resourceName, &filesystem),
 					resource.TestCheckResourceAttr(resourceName, "data_compression_type", fsx.DataCompressionTypeLz4),
@@ -119,14 +124,14 @@ func TestAccFSxLustreFileSystem_dataCompression(t *testing.T) {
 				ImportStateVerifyIgnore: []string{"security_group_ids"},
 			},
 			{
-				Config: testAccLustreFileSystemConfig_subnetIDs1(),
+				Config: testAccLustreFileSystemConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckLustreFileSystemExists(ctx, resourceName, &filesystem),
 					resource.TestCheckResourceAttr(resourceName, "data_compression_type", fsx.DataCompressionTypeNone),
 				),
 			},
 			{
-				Config: testAccLustreFileSystemConfig_compression(),
+				Config: testAccLustreFileSystemConfig_compression(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckLustreFileSystemExists(ctx, resourceName, &filesystem),
 					resource.TestCheckResourceAttr(resourceName, "data_compression_type", fsx.DataCompressionTypeLz4),
@@ -255,6 +260,7 @@ func TestAccFSxLustreFileSystem_securityGroupIDs(t *testing.T) {
 	ctx := acctest.Context(t)
 	var filesystem1, filesystem2 fsx.FileSystem
 	resourceName := "aws_fsx_lustre_file_system.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
@@ -263,7 +269,7 @@ func TestAccFSxLustreFileSystem_securityGroupIDs(t *testing.T) {
 		CheckDestroy:             testAccCheckLustreFileSystemDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccLustreFileSystemConfig_securityGroupIDs1(),
+				Config: testAccLustreFileSystemConfig_securityGroupIDs1(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckLustreFileSystemExists(ctx, resourceName, &filesystem1),
 					resource.TestCheckResourceAttr(resourceName, "security_group_ids.#", "1"),
@@ -276,7 +282,7 @@ func TestAccFSxLustreFileSystem_securityGroupIDs(t *testing.T) {
 				ImportStateVerifyIgnore: []string{"security_group_ids"},
 			},
 			{
-				Config: testAccLustreFileSystemConfig_securityGroupIDs2(),
+				Config: testAccLustreFileSystemConfig_securityGroupIDs2(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckLustreFileSystemExists(ctx, resourceName, &filesystem2),
 					testAccCheckLustreFileSystemRecreated(&filesystem1, &filesystem2),
@@ -291,6 +297,7 @@ func TestAccFSxLustreFileSystem_storageCapacity(t *testing.T) {
 	ctx := acctest.Context(t)
 	var filesystem1, filesystem2 fsx.FileSystem
 	resourceName := "aws_fsx_lustre_file_system.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
@@ -299,7 +306,7 @@ func TestAccFSxLustreFileSystem_storageCapacity(t *testing.T) {
 		CheckDestroy:             testAccCheckLustreFileSystemDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccLustreFileSystemConfig_storageCapacity(7200),
+				Config: testAccLustreFileSystemConfig_storageCapacity(rName, 7200),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckLustreFileSystemExists(ctx, resourceName, &filesystem1),
 					resource.TestCheckResourceAttr(resourceName, "storage_capacity", "7200"),
@@ -312,7 +319,7 @@ func TestAccFSxLustreFileSystem_storageCapacity(t *testing.T) {
 				ImportStateVerifyIgnore: []string{"security_group_ids"},
 			},
 			{
-				Config: testAccLustreFileSystemConfig_storageCapacity(1200),
+				Config: testAccLustreFileSystemConfig_storageCapacity(rName, 1200),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckLustreFileSystemExists(ctx, resourceName, &filesystem2),
 					testAccCheckLustreFileSystemRecreated(&filesystem1, &filesystem2),
@@ -327,6 +334,7 @@ func TestAccFSxLustreFileSystem_storageCapacityUpdate(t *testing.T) {
 	ctx := acctest.Context(t)
 	var filesystem1, filesystem2, filesystem3 fsx.FileSystem
 	resourceName := "aws_fsx_lustre_file_system.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
@@ -335,7 +343,7 @@ func TestAccFSxLustreFileSystem_storageCapacityUpdate(t *testing.T) {
 		CheckDestroy:             testAccCheckLustreFileSystemDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccLustreFileSystemConfig_storageCapacityScratch2(7200),
+				Config: testAccLustreFileSystemConfig_storageCapacityScratch2(rName, 7200),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckLustreFileSystemExists(ctx, resourceName, &filesystem1),
 					resource.TestCheckResourceAttr(resourceName, "storage_capacity", "7200"),
@@ -348,7 +356,7 @@ func TestAccFSxLustreFileSystem_storageCapacityUpdate(t *testing.T) {
 				ImportStateVerifyIgnore: []string{"security_group_ids"},
 			},
 			{
-				Config: testAccLustreFileSystemConfig_storageCapacityScratch2(1200),
+				Config: testAccLustreFileSystemConfig_storageCapacityScratch2(rName, 1200),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckLustreFileSystemExists(ctx, resourceName, &filesystem2),
 					testAccCheckLustreFileSystemRecreated(&filesystem1, &filesystem2),
@@ -356,7 +364,7 @@ func TestAccFSxLustreFileSystem_storageCapacityUpdate(t *testing.T) {
 				),
 			},
 			{
-				Config: testAccLustreFileSystemConfig_storageCapacityScratch2(7200),
+				Config: testAccLustreFileSystemConfig_storageCapacityScratch2(rName, 7200),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckLustreFileSystemExists(ctx, resourceName, &filesystem3),
 					testAccCheckLustreFileSystemNotRecreated(&filesystem2, &filesystem3),
@@ -371,6 +379,7 @@ func TestAccFSxLustreFileSystem_fileSystemTypeVersion(t *testing.T) {
 	ctx := acctest.Context(t)
 	var filesystem1, filesystem2 fsx.FileSystem
 	resourceName := "aws_fsx_lustre_file_system.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
@@ -379,7 +388,7 @@ func TestAccFSxLustreFileSystem_fileSystemTypeVersion(t *testing.T) {
 		CheckDestroy:             testAccCheckLustreFileSystemDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccLustreFileSystemConfig_typeVersion("2.10"),
+				Config: testAccLustreFileSystemConfig_typeVersion(rName, "2.10"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckLustreFileSystemExists(ctx, resourceName, &filesystem1),
 					resource.TestCheckResourceAttr(resourceName, "file_system_type_version", "2.10"),
@@ -392,7 +401,7 @@ func TestAccFSxLustreFileSystem_fileSystemTypeVersion(t *testing.T) {
 				ImportStateVerifyIgnore: []string{"security_group_ids"},
 			},
 			{
-				Config: testAccLustreFileSystemConfig_typeVersion("2.12"),
+				Config: testAccLustreFileSystemConfig_typeVersion(rName, "2.12"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckLustreFileSystemExists(ctx, resourceName, &filesystem2),
 					testAccCheckLustreFileSystemRecreated(&filesystem1, &filesystem2),
@@ -407,6 +416,7 @@ func TestAccFSxLustreFileSystem_tags(t *testing.T) {
 	ctx := acctest.Context(t)
 	var filesystem1, filesystem2, filesystem3 fsx.FileSystem
 	resourceName := "aws_fsx_lustre_file_system.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
@@ -415,7 +425,7 @@ func TestAccFSxLustreFileSystem_tags(t *testing.T) {
 		CheckDestroy:             testAccCheckLustreFileSystemDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccLustreFileSystemConfig_tags1("key1", "value1"),
+				Config: testAccLustreFileSystemConfig_tags1(rName, "key1", "value1"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckLustreFileSystemExists(ctx, resourceName, &filesystem1),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
@@ -429,7 +439,7 @@ func TestAccFSxLustreFileSystem_tags(t *testing.T) {
 				ImportStateVerifyIgnore: []string{"security_group_ids"},
 			},
 			{
-				Config: testAccLustreFileSystemConfig_tags2("key1", "value1updated", "key2", "value2"),
+				Config: testAccLustreFileSystemConfig_tags2(rName, "key1", "value1updated", "key2", "value2"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckLustreFileSystemExists(ctx, resourceName, &filesystem2),
 					testAccCheckLustreFileSystemNotRecreated(&filesystem1, &filesystem2),
@@ -439,7 +449,7 @@ func TestAccFSxLustreFileSystem_tags(t *testing.T) {
 				),
 			},
 			{
-				Config: testAccLustreFileSystemConfig_tags1("key2", "value2"),
+				Config: testAccLustreFileSystemConfig_tags1(rName, "key2", "value2"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckLustreFileSystemExists(ctx, resourceName, &filesystem3),
 					testAccCheckLustreFileSystemNotRecreated(&filesystem2, &filesystem3),
@@ -455,6 +465,7 @@ func TestAccFSxLustreFileSystem_weeklyMaintenanceStartTime(t *testing.T) {
 	ctx := acctest.Context(t)
 	var filesystem1, filesystem2 fsx.FileSystem
 	resourceName := "aws_fsx_lustre_file_system.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
@@ -463,7 +474,7 @@ func TestAccFSxLustreFileSystem_weeklyMaintenanceStartTime(t *testing.T) {
 		CheckDestroy:             testAccCheckLustreFileSystemDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccLustreFileSystemConfig_weeklyMaintenanceStartTime("1:01:01"),
+				Config: testAccLustreFileSystemConfig_weeklyMaintenanceStartTime(rName, "1:01:01"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckLustreFileSystemExists(ctx, resourceName, &filesystem1),
 					resource.TestCheckResourceAttr(resourceName, "weekly_maintenance_start_time", "1:01:01"),
@@ -476,7 +487,7 @@ func TestAccFSxLustreFileSystem_weeklyMaintenanceStartTime(t *testing.T) {
 				ImportStateVerifyIgnore: []string{"security_group_ids"},
 			},
 			{
-				Config: testAccLustreFileSystemConfig_weeklyMaintenanceStartTime("2:02:02"),
+				Config: testAccLustreFileSystemConfig_weeklyMaintenanceStartTime(rName, "2:02:02"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckLustreFileSystemExists(ctx, resourceName, &filesystem2),
 					testAccCheckLustreFileSystemNotRecreated(&filesystem1, &filesystem2),
@@ -491,6 +502,7 @@ func TestAccFSxLustreFileSystem_automaticBackupRetentionDays(t *testing.T) {
 	ctx := acctest.Context(t)
 	var filesystem1, filesystem2 fsx.FileSystem
 	resourceName := "aws_fsx_lustre_file_system.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
@@ -499,7 +511,7 @@ func TestAccFSxLustreFileSystem_automaticBackupRetentionDays(t *testing.T) {
 		CheckDestroy:             testAccCheckLustreFileSystemDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccLustreFileSystemConfig_automaticBackupRetentionDays(90),
+				Config: testAccLustreFileSystemConfig_automaticBackupRetentionDays(rName, 90),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckLustreFileSystemExists(ctx, resourceName, &filesystem1),
 					resource.TestCheckResourceAttr(resourceName, "automatic_backup_retention_days", "90"),
@@ -512,7 +524,7 @@ func TestAccFSxLustreFileSystem_automaticBackupRetentionDays(t *testing.T) {
 				ImportStateVerifyIgnore: []string{"security_group_ids"},
 			},
 			{
-				Config: testAccLustreFileSystemConfig_automaticBackupRetentionDays(0),
+				Config: testAccLustreFileSystemConfig_automaticBackupRetentionDays(rName, 0),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckLustreFileSystemExists(ctx, resourceName, &filesystem2),
 					testAccCheckLustreFileSystemNotRecreated(&filesystem1, &filesystem2),
@@ -520,7 +532,7 @@ func TestAccFSxLustreFileSystem_automaticBackupRetentionDays(t *testing.T) {
 				),
 			},
 			{
-				Config: testAccLustreFileSystemConfig_automaticBackupRetentionDays(1),
+				Config: testAccLustreFileSystemConfig_automaticBackupRetentionDays(rName, 1),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckLustreFileSystemExists(ctx, resourceName, &filesystem1),
 					resource.TestCheckResourceAttr(resourceName, "automatic_backup_retention_days", "1"),
@@ -534,6 +546,7 @@ func TestAccFSxLustreFileSystem_dailyAutomaticBackupStartTime(t *testing.T) {
 	ctx := acctest.Context(t)
 	var filesystem1, filesystem2 fsx.FileSystem
 	resourceName := "aws_fsx_lustre_file_system.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
@@ -542,7 +555,7 @@ func TestAccFSxLustreFileSystem_dailyAutomaticBackupStartTime(t *testing.T) {
 		CheckDestroy:             testAccCheckLustreFileSystemDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccLustreFileSystemConfig_dailyAutomaticBackupStartTime("01:01"),
+				Config: testAccLustreFileSystemConfig_dailyAutomaticBackupStartTime(rName, "01:01"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckLustreFileSystemExists(ctx, resourceName, &filesystem1),
 					resource.TestCheckResourceAttr(resourceName, "daily_automatic_backup_start_time", "01:01"),
@@ -555,7 +568,7 @@ func TestAccFSxLustreFileSystem_dailyAutomaticBackupStartTime(t *testing.T) {
 				ImportStateVerifyIgnore: []string{"security_group_ids"},
 			},
 			{
-				Config: testAccLustreFileSystemConfig_dailyAutomaticBackupStartTime("02:02"),
+				Config: testAccLustreFileSystemConfig_dailyAutomaticBackupStartTime(rName, "02:02"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckLustreFileSystemExists(ctx, resourceName, &filesystem2),
 					testAccCheckLustreFileSystemNotRecreated(&filesystem1, &filesystem2),
@@ -570,6 +583,7 @@ func TestAccFSxLustreFileSystem_deploymentTypePersistent1(t *testing.T) {
 	ctx := acctest.Context(t)
 	var filesystem fsx.FileSystem
 	resourceName := "aws_fsx_lustre_file_system.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
@@ -578,14 +592,14 @@ func TestAccFSxLustreFileSystem_deploymentTypePersistent1(t *testing.T) {
 		CheckDestroy:             testAccCheckLustreFileSystemDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccLustreFileSystemConfig_persistent1DeploymentType(50),
+				Config: testAccLustreFileSystemConfig_persistent1DeploymentType(rName, 50),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckLustreFileSystemExists(ctx, resourceName, &filesystem),
 					// per_unit_storage_throughput=50 is only available with deployment_type=PERSISTENT_1, so we test both here.
 					resource.TestCheckResourceAttr(resourceName, "per_unit_storage_throughput", "50"),
 					resource.TestCheckResourceAttr(resourceName, "deployment_type", fsx.LustreDeploymentTypePersistent1),
 					resource.TestCheckResourceAttr(resourceName, "automatic_backup_retention_days", "0"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "kms_key_id", "kms", regexp.MustCompile(`key/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "kms_key_id", "kms", regexache.MustCompile(`key/.+`)),
 					// We don't know the randomly generated mount_name ahead of time like for SCRATCH_1 deployment types.
 					resource.TestCheckResourceAttrSet(resourceName, "mount_name"),
 				),
@@ -604,6 +618,7 @@ func TestAccFSxLustreFileSystem_deploymentTypePersistent2(t *testing.T) {
 	ctx := acctest.Context(t)
 	var filesystem fsx.FileSystem
 	resourceName := "aws_fsx_lustre_file_system.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
@@ -612,14 +627,14 @@ func TestAccFSxLustreFileSystem_deploymentTypePersistent2(t *testing.T) {
 		CheckDestroy:             testAccCheckLustreFileSystemDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccLustreFileSystemConfig_persistent2DeploymentType(125),
+				Config: testAccLustreFileSystemConfig_persistent2DeploymentType(rName, 125),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckLustreFileSystemExists(ctx, resourceName, &filesystem),
 					// per_unit_storage_throughput=125 is only available with deployment_type=PERSISTENT_2, so we test both here.
 					resource.TestCheckResourceAttr(resourceName, "per_unit_storage_throughput", "125"),
 					resource.TestCheckResourceAttr(resourceName, "deployment_type", fsx.LustreDeploymentTypePersistent2),
 					resource.TestCheckResourceAttr(resourceName, "automatic_backup_retention_days", "0"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "kms_key_id", "kms", regexp.MustCompile(`key/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "kms_key_id", "kms", regexache.MustCompile(`key/.+`)),
 					// We don't know the randomly generated mount_name ahead of time like for SCRATCH_1 deployment types.
 					resource.TestCheckResourceAttrSet(resourceName, "mount_name"),
 				),
@@ -678,6 +693,7 @@ func TestAccFSxLustreFileSystem_rootSquashConfig(t *testing.T) {
 	ctx := acctest.Context(t)
 	var filesystem fsx.FileSystem
 	resourceName := "aws_fsx_lustre_file_system.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
@@ -686,7 +702,7 @@ func TestAccFSxLustreFileSystem_rootSquashConfig(t *testing.T) {
 		CheckDestroy:             testAccCheckLustreFileSystemDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccLustreFileSystemConfig_rootSquash("365534:65534"),
+				Config: testAccLustreFileSystemConfig_rootSquash(rName, "365534:65534"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckLustreFileSystemExists(ctx, resourceName, &filesystem),
 					resource.TestCheckResourceAttr(resourceName, "root_squash_configuration.#", "1"),
@@ -700,7 +716,7 @@ func TestAccFSxLustreFileSystem_rootSquashConfig(t *testing.T) {
 				ImportStateVerifyIgnore: []string{"security_group_ids"},
 			},
 			{
-				Config: testAccLustreFileSystemConfig_rootSquash("355534:64534"),
+				Config: testAccLustreFileSystemConfig_rootSquash(rName, "355534:64534"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckLustreFileSystemExists(ctx, resourceName, &filesystem),
 					resource.TestCheckResourceAttr(resourceName, "root_squash_configuration.#", "1"),
@@ -715,6 +731,7 @@ func TestAccFSxLustreFileSystem_fromBackup(t *testing.T) {
 	ctx := acctest.Context(t)
 	var filesystem fsx.FileSystem
 	resourceName := "aws_fsx_lustre_file_system.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
@@ -723,7 +740,7 @@ func TestAccFSxLustreFileSystem_fromBackup(t *testing.T) {
 		CheckDestroy:             testAccCheckLustreFileSystemDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccLustreFileSystemConfig_fromBackup(),
+				Config: testAccLustreFileSystemConfig_fromBackup(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckLustreFileSystemExists(ctx, resourceName, &filesystem),
 					resource.TestCheckResourceAttr(resourceName, "per_unit_storage_throughput", "50"),
@@ -747,6 +764,7 @@ func TestAccFSxLustreFileSystem_kmsKeyID(t *testing.T) {
 	resourceName := "aws_fsx_lustre_file_system.test"
 	kmsKeyResourceName1 := "aws_kms_key.test1"
 	kmsKeyResourceName2 := "aws_kms_key.test2"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
@@ -755,7 +773,7 @@ func TestAccFSxLustreFileSystem_kmsKeyID(t *testing.T) {
 		CheckDestroy:             testAccCheckLustreFileSystemDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccLustreFileSystemConfig_kmsKeyID1(),
+				Config: testAccLustreFileSystemConfig_kmsKeyID1(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckLustreFileSystemExists(ctx, resourceName, &filesystem1),
 					resource.TestCheckResourceAttr(resourceName, "deployment_type", fsx.LustreDeploymentTypePersistent1),
@@ -769,11 +787,11 @@ func TestAccFSxLustreFileSystem_kmsKeyID(t *testing.T) {
 				ImportStateVerifyIgnore: []string{"security_group_ids"},
 			},
 			{
-				Config: testAccLustreFileSystemConfig_kmsKeyID2(),
+				Config: testAccLustreFileSystemConfig_kmsKeyID2(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckLustreFileSystemExists(ctx, resourceName, &filesystem2),
 					resource.TestCheckResourceAttr(resourceName, "deployment_type", fsx.LustreDeploymentTypePersistent1),
-					testAccCheckWindowsFileSystemRecreated(&filesystem1, &filesystem2),
+					testAccCheckLustreFileSystemRecreated(&filesystem1, &filesystem2),
 					resource.TestCheckResourceAttrPair(resourceName, "kms_key_id", kmsKeyResourceName2, "arn"),
 				),
 			},
@@ -785,6 +803,7 @@ func TestAccFSxLustreFileSystem_deploymentTypeScratch2(t *testing.T) {
 	ctx := acctest.Context(t)
 	var filesystem fsx.FileSystem
 	resourceName := "aws_fsx_lustre_file_system.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
@@ -793,7 +812,7 @@ func TestAccFSxLustreFileSystem_deploymentTypeScratch2(t *testing.T) {
 		CheckDestroy:             testAccCheckLustreFileSystemDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccLustreFileSystemConfig_deploymentType(fsx.LustreDeploymentTypeScratch2),
+				Config: testAccLustreFileSystemConfig_deploymentType(rName, fsx.LustreDeploymentTypeScratch2),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckLustreFileSystemExists(ctx, resourceName, &filesystem),
 					resource.TestCheckResourceAttr(resourceName, "deployment_type", fsx.LustreDeploymentTypeScratch2),
@@ -815,6 +834,7 @@ func TestAccFSxLustreFileSystem_storageTypeHddDriveCacheRead(t *testing.T) {
 	ctx := acctest.Context(t)
 	var filesystem fsx.FileSystem
 	resourceName := "aws_fsx_lustre_file_system.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
@@ -823,7 +843,7 @@ func TestAccFSxLustreFileSystem_storageTypeHddDriveCacheRead(t *testing.T) {
 		CheckDestroy:             testAccCheckLustreFileSystemDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccLustreFileSystemConfig_hddStorageType(fsx.DriveCacheTypeRead),
+				Config: testAccLustreFileSystemConfig_hddStorageType(rName, fsx.DriveCacheTypeRead),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckLustreFileSystemExists(ctx, resourceName, &filesystem),
 					resource.TestCheckResourceAttr(resourceName, "storage_type", fsx.StorageTypeHdd),
@@ -844,6 +864,7 @@ func TestAccFSxLustreFileSystem_storageTypeHddDriveCacheNone(t *testing.T) {
 	ctx := acctest.Context(t)
 	var filesystem fsx.FileSystem
 	resourceName := "aws_fsx_lustre_file_system.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
@@ -852,7 +873,7 @@ func TestAccFSxLustreFileSystem_storageTypeHddDriveCacheNone(t *testing.T) {
 		CheckDestroy:             testAccCheckLustreFileSystemDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccLustreFileSystemConfig_hddStorageType(fsx.DriveCacheTypeNone),
+				Config: testAccLustreFileSystemConfig_hddStorageType(rName, fsx.DriveCacheTypeNone),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckLustreFileSystemExists(ctx, resourceName, &filesystem),
 					resource.TestCheckResourceAttr(resourceName, "storage_type", fsx.StorageTypeHdd),
@@ -873,6 +894,7 @@ func TestAccFSxLustreFileSystem_copyTagsToBackups(t *testing.T) {
 	ctx := acctest.Context(t)
 	var filesystem fsx.FileSystem
 	resourceName := "aws_fsx_lustre_file_system.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
@@ -881,7 +903,7 @@ func TestAccFSxLustreFileSystem_copyTagsToBackups(t *testing.T) {
 		CheckDestroy:             testAccCheckLustreFileSystemDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccLustreFileSystemConfig_copyTagsToBackups(),
+				Config: testAccLustreFileSystemConfig_copyTagsToBackups(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckLustreFileSystemExists(ctx, resourceName, &filesystem),
 					resource.TestCheckResourceAttr(resourceName, "copy_tags_to_backups", "true"),
@@ -933,25 +955,22 @@ func TestAccFSxLustreFileSystem_autoImportPolicy(t *testing.T) {
 	})
 }
 
-func testAccCheckLustreFileSystemExists(ctx context.Context, resourceName string, fs *fsx.FileSystem) resource.TestCheckFunc {
+func testAccCheckLustreFileSystemExists(ctx context.Context, n string, v *fsx.FileSystem) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		rs, ok := s.RootModule().Resources[resourceName]
+		rs, ok := s.RootModule().Resources[n]
 		if !ok {
-			return fmt.Errorf("Not found: %s", resourceName)
+			return fmt.Errorf("Not found: %s", n)
 		}
 
 		conn := acctest.Provider.Meta().(*conns.AWSClient).FSxConn(ctx)
 
-		filesystem, err := tffsx.FindFileSystemByID(ctx, conn, rs.Primary.ID)
+		output, err := tffsx.FindLustreFileSystemByID(ctx, conn, rs.Primary.ID)
+
 		if err != nil {
 			return err
 		}
 
-		if filesystem == nil {
-			return fmt.Errorf("FSx Lustre File System (%s) not found", rs.Primary.ID)
-		}
-
-		*fs = *filesystem
+		*v = *output
 
 		return nil
 	}
@@ -966,15 +985,19 @@ func testAccCheckLustreFileSystemDestroy(ctx context.Context) resource.TestCheck
 				continue
 			}
 
-			filesystem, err := tffsx.FindFileSystemByID(ctx, conn, rs.Primary.ID)
+			_, err := tffsx.FindLustreFileSystemByID(ctx, conn, rs.Primary.ID)
+
 			if tfresource.NotFound(err) {
 				continue
 			}
 
-			if filesystem != nil {
-				return fmt.Errorf("FSx Lustre File System (%s) still exists", rs.Primary.ID)
+			if err != nil {
+				return err
 			}
+
+			return fmt.Errorf("FSx for Lustre File System %s still exists", rs.Primary.ID)
 		}
+
 		return nil
 	}
 }
@@ -982,7 +1005,7 @@ func testAccCheckLustreFileSystemDestroy(ctx context.Context) resource.TestCheck
 func testAccCheckLustreFileSystemNotRecreated(i, j *fsx.FileSystem) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		if aws.StringValue(i.FileSystemId) != aws.StringValue(j.FileSystemId) {
-			return fmt.Errorf("FSx File System (%s) recreated", aws.StringValue(i.FileSystemId))
+			return fmt.Errorf("FSx for Lustre File System (%s) recreated", aws.StringValue(i.FileSystemId))
 		}
 
 		return nil
@@ -992,96 +1015,93 @@ func testAccCheckLustreFileSystemNotRecreated(i, j *fsx.FileSystem) resource.Tes
 func testAccCheckLustreFileSystemRecreated(i, j *fsx.FileSystem) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		if aws.StringValue(i.FileSystemId) == aws.StringValue(j.FileSystemId) {
-			return fmt.Errorf("FSx File System (%s) not recreated", aws.StringValue(i.FileSystemId))
+			return fmt.Errorf("FSx for Lustre File System (%s) not recreated", aws.StringValue(i.FileSystemId))
 		}
 
 		return nil
 	}
 }
 
-func testAccLustreFileSystemBaseConfig() string {
-	return acctest.ConfigCompose(acctest.ConfigAvailableAZsNoOptIn(), `
+func testAccLustreFileSystemConfig_base(rName string) string {
+	return acctest.ConfigCompose(acctest.ConfigVPCWithSubnets(rName, 1), `
 data "aws_partition" "current" {}
-
-resource "aws_vpc" "test" {
-  cidr_block = "10.0.0.0/16"
+`)
 }
 
-resource "aws_subnet" "test1" {
-  vpc_id            = aws_vpc.test.id
-  cidr_block        = "10.0.1.0/24"
-  availability_zone = data.aws_availability_zones.available.names[0]
+func testAccLustreFileSystemConfig_basic(rName string) string {
+	return acctest.ConfigCompose(testAccLustreFileSystemConfig_base(rName), `
+resource "aws_fsx_lustre_file_system" "test" {
+  storage_capacity = 1200
+  subnet_ids       = aws_subnet.test[*].id
+  deployment_type  = data.aws_partition.current.partition == "aws-us-gov" ? "SCRATCH_2" : null # GovCloud does not support SCRATCH_1
 }
 `)
 }
 
 func testAccLustreFileSystemConfig_exportPath(rName, exportPrefix string) string {
-	return acctest.ConfigCompose(testAccLustreFileSystemBaseConfig(), fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccLustreFileSystemConfig_base(rName), fmt.Sprintf(`
 resource "aws_s3_bucket" "test" {
   bucket = %[1]q
 }
 
-resource "aws_s3_bucket_acl" "test" {
-  bucket = aws_s3_bucket.test.id
-  acl    = "private"
-}
-
 resource "aws_fsx_lustre_file_system" "test" {
   export_path      = "s3://${aws_s3_bucket.test.bucket}%[2]s"
   import_path      = "s3://${aws_s3_bucket.test.bucket}"
   storage_capacity = 1200
-  subnet_ids       = [aws_subnet.test1.id]
+  subnet_ids       = aws_subnet.test[*].id
   deployment_type  = data.aws_partition.current.partition == "aws-us-gov" ? "SCRATCH_2" : null # GovCloud does not support SCRATCH_1
+
+  tags = {
+    Name = %[1]q
+  }
 }
 `, rName, exportPrefix))
 }
 
 func testAccLustreFileSystemConfig_importPath(rName, importPrefix string) string {
-	return acctest.ConfigCompose(testAccLustreFileSystemBaseConfig(), fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccLustreFileSystemConfig_base(rName), fmt.Sprintf(`
 resource "aws_s3_bucket" "test" {
   bucket = %[1]q
 }
 
-resource "aws_s3_bucket_acl" "test" {
-  bucket = aws_s3_bucket.test.id
-  acl    = "private"
-}
-
 resource "aws_fsx_lustre_file_system" "test" {
   import_path      = "s3://${aws_s3_bucket.test.bucket}%[2]s"
   storage_capacity = 1200
-  subnet_ids       = [aws_subnet.test1.id]
+  subnet_ids       = aws_subnet.test[*].id
   deployment_type  = data.aws_partition.current.partition == "aws-us-gov" ? "SCRATCH_2" : null # GovCloud does not support SCRATCH_1
+
+  tags = {
+    Name = %[1]q
+  }
 }
 `, rName, importPrefix))
 }
 
 func testAccLustreFileSystemConfig_importedChunkSize(rName string, importedFileChunkSize int) string {
-	return acctest.ConfigCompose(testAccLustreFileSystemBaseConfig(), fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccLustreFileSystemConfig_base(rName), fmt.Sprintf(`
 resource "aws_s3_bucket" "test" {
   bucket = %[1]q
 }
 
-resource "aws_s3_bucket_acl" "test" {
-  bucket = aws_s3_bucket.test.id
-  acl    = "private"
-}
-
 resource "aws_fsx_lustre_file_system" "test" {
   import_path              = "s3://${aws_s3_bucket.test.bucket}"
   imported_file_chunk_size = %[2]d
   storage_capacity         = 1200
-  subnet_ids               = [aws_subnet.test1.id]
+  subnet_ids               = aws_subnet.test[*].id
   deployment_type          = data.aws_partition.current.partition == "aws-us-gov" ? "SCRATCH_2" : null # GovCloud does not support SCRATCH_1
+
+  tags = {
+    Name = %[1]q
+  }
 }
 `, rName, importedFileChunkSize))
 }
 
-func testAccLustreFileSystemConfig_securityGroupIDs1() string {
-	return acctest.ConfigCompose(testAccLustreFileSystemBaseConfig(), `
+func testAccLustreFileSystemConfig_securityGroupIDs1(rName string) string {
+	return acctest.ConfigCompose(testAccLustreFileSystemConfig_base(rName), fmt.Sprintf(`
 resource "aws_security_group" "test1" {
-  description = "security group for FSx testing"
-  vpc_id      = aws_vpc.test.id
+  name   = "%[1]s-1"
+  vpc_id = aws_vpc.test.id
 
   ingress {
     cidr_blocks = [aws_vpc.test.cidr_block]
@@ -1096,22 +1116,30 @@ resource "aws_security_group" "test1" {
     protocol    = "-1"
     to_port     = 0
   }
+
+  tags = {
+    Name = %[1]q
+  }
 }
 
 resource "aws_fsx_lustre_file_system" "test" {
   security_group_ids = [aws_security_group.test1.id]
   storage_capacity   = 1200
-  subnet_ids         = [aws_subnet.test1.id]
+  subnet_ids         = aws_subnet.test[*].id
   deployment_type    = data.aws_partition.current.partition == "aws-us-gov" ? "SCRATCH_2" : null # GovCloud does not support SCRATCH_1
+
+  tags = {
+    Name = %[1]q
+  }
 }
-`)
+`, rName))
 }
 
-func testAccLustreFileSystemConfig_securityGroupIDs2() string {
-	return acctest.ConfigCompose(testAccLustreFileSystemBaseConfig(), `
+func testAccLustreFileSystemConfig_securityGroupIDs2(rName string) string {
+	return acctest.ConfigCompose(testAccLustreFileSystemConfig_base(rName), fmt.Sprintf(`
 resource "aws_security_group" "test1" {
-  description = "security group for FSx testing"
-  vpc_id      = aws_vpc.test.id
+  name   = "%[1]s-1"
+  vpc_id = aws_vpc.test.id
 
   ingress {
     cidr_blocks = [aws_vpc.test.cidr_block]
@@ -1126,11 +1154,15 @@ resource "aws_security_group" "test1" {
     protocol    = "-1"
     to_port     = 0
   }
+
+  tags = {
+    Name = %[1]q
+  }
 }
 
 resource "aws_security_group" "test2" {
-  description = "security group for FSx testing"
-  vpc_id      = aws_vpc.test.id
+  name   = "%[1]s-2"
+  vpc_id = aws_vpc.test.id
 
   ingress {
     cidr_blocks = [aws_vpc.test.cidr_block]
@@ -1145,63 +1177,73 @@ resource "aws_security_group" "test2" {
     protocol    = "-1"
     to_port     = 0
   }
+
+  tags = {
+    Name = %[1]q
+  }
 }
 
 resource "aws_fsx_lustre_file_system" "test" {
   security_group_ids = [aws_security_group.test1.id, aws_security_group.test2.id]
   storage_capacity   = 1200
-  subnet_ids         = [aws_subnet.test1.id]
+  subnet_ids         = aws_subnet.test[*].id
   deployment_type    = data.aws_partition.current.partition == "aws-us-gov" ? "SCRATCH_2" : null # GovCloud does not support SCRATCH_1
+
+  tags = {
+    Name = %[1]q
+  }
 }
-`)
+`, rName))
 }
 
-func testAccLustreFileSystemConfig_typeVersion(fileSystemTypeVersion string) string {
-	return acctest.ConfigCompose(testAccLustreFileSystemBaseConfig(), fmt.Sprintf(`
+func testAccLustreFileSystemConfig_typeVersion(rName, fileSystemTypeVersion string) string {
+	return acctest.ConfigCompose(testAccLustreFileSystemConfig_base(rName), fmt.Sprintf(`
 resource "aws_fsx_lustre_file_system" "test" {
-  file_system_type_version = %[1]q
+  file_system_type_version = %[2]q
   storage_capacity         = 1200
-  subnet_ids               = [aws_subnet.test1.id]
+  subnet_ids               = aws_subnet.test[*].id
   deployment_type          = data.aws_partition.current.partition == "aws-us-gov" ? "SCRATCH_2" : null # GovCloud does not support SCRATCH_1
+
+  tags = {
+    Name = %[1]q
+  }
 }
-`, fileSystemTypeVersion))
+`, rName, fileSystemTypeVersion))
 }
 
-func testAccLustreFileSystemConfig_storageCapacity(storageCapacity int) string {
-	return acctest.ConfigCompose(testAccLustreFileSystemBaseConfig(), fmt.Sprintf(`
+func testAccLustreFileSystemConfig_storageCapacity(rName string, storageCapacity int) string {
+	return acctest.ConfigCompose(testAccLustreFileSystemConfig_base(rName), fmt.Sprintf(`
 resource "aws_fsx_lustre_file_system" "test" {
-  storage_capacity = %[1]d
-  subnet_ids       = [aws_subnet.test1.id]
+  storage_capacity = %[2]d
+  subnet_ids       = aws_subnet.test[*].id
   deployment_type  = data.aws_partition.current.partition == "aws-us-gov" ? "SCRATCH_2" : null # GovCloud does not support SCRATCH_1
+
+  tags = {
+    Name = %[1]q
+  }
 }
-`, storageCapacity))
+`, rName, storageCapacity))
 }
 
-func testAccLustreFileSystemConfig_storageCapacityScratch2(storageCapacity int) string {
-	return acctest.ConfigCompose(testAccLustreFileSystemBaseConfig(), fmt.Sprintf(`
+func testAccLustreFileSystemConfig_storageCapacityScratch2(rName string, storageCapacity int) string {
+	return acctest.ConfigCompose(testAccLustreFileSystemConfig_base(rName), fmt.Sprintf(`
 resource "aws_fsx_lustre_file_system" "test" {
-  storage_capacity = %[1]d
-  subnet_ids       = [aws_subnet.test1.id]
+  storage_capacity = %[2]d
+  subnet_ids       = aws_subnet.test[*].id
   deployment_type  = "SCRATCH_2"
-}
-`, storageCapacity))
-}
 
-func testAccLustreFileSystemConfig_subnetIDs1() string {
-	return acctest.ConfigCompose(testAccLustreFileSystemBaseConfig(), `
-resource "aws_fsx_lustre_file_system" "test" {
-  storage_capacity = 1200
-  subnet_ids       = [aws_subnet.test1.id]
-  deployment_type  = data.aws_partition.current.partition == "aws-us-gov" ? "SCRATCH_2" : null # GovCloud does not support SCRATCH_1
+  tags = {
+    Name = %[1]q
+  }
 }
-`)
+`, rName, storageCapacity))
 }
 
-func testAccLustreFileSystemConfig_tags1(tagKey1, tagValue1 string) string {
-	return acctest.ConfigCompose(testAccLustreFileSystemBaseConfig(), fmt.Sprintf(`
+func testAccLustreFileSystemConfig_tags1(rName, tagKey1, tagValue1 string) string {
+	return acctest.ConfigCompose(testAccLustreFileSystemConfig_base(rName), fmt.Sprintf(`
 resource "aws_fsx_lustre_file_system" "test" {
   storage_capacity = 1200
-  subnet_ids       = [aws_subnet.test1.id]
+  subnet_ids       = aws_subnet.test[*].id
   deployment_type  = data.aws_partition.current.partition == "aws-us-gov" ? "SCRATCH_2" : null # GovCloud does not support SCRATCH_1
 
   tags = {
@@ -1211,11 +1253,11 @@ resource "aws_fsx_lustre_file_system" "test" {
 `, tagKey1, tagValue1))
 }
 
-func testAccLustreFileSystemConfig_tags2(tagKey1, tagValue1, tagKey2, tagValue2 string) string {
-	return acctest.ConfigCompose(testAccLustreFileSystemBaseConfig(), fmt.Sprintf(`
+func testAccLustreFileSystemConfig_tags2(rName, tagKey1, tagValue1, tagKey2, tagValue2 string) string {
+	return acctest.ConfigCompose(testAccLustreFileSystemConfig_base(rName), fmt.Sprintf(`
 resource "aws_fsx_lustre_file_system" "test" {
   storage_capacity = 1200
-  subnet_ids       = [aws_subnet.test1.id]
+  subnet_ids       = aws_subnet.test[*].id
   deployment_type  = data.aws_partition.current.partition == "aws-us-gov" ? "SCRATCH_2" : null # GovCloud does not support SCRATCH_1
 
   tags = {
@@ -1226,218 +1268,281 @@ resource "aws_fsx_lustre_file_system" "test" {
 `, tagKey1, tagValue1, tagKey2, tagValue2))
 }
 
-func testAccLustreFileSystemConfig_weeklyMaintenanceStartTime(weeklyMaintenanceStartTime string) string {
-	return acctest.ConfigCompose(testAccLustreFileSystemBaseConfig(), fmt.Sprintf(`
+func testAccLustreFileSystemConfig_weeklyMaintenanceStartTime(rName, weeklyMaintenanceStartTime string) string {
+	return acctest.ConfigCompose(testAccLustreFileSystemConfig_base(rName), fmt.Sprintf(`
 resource "aws_fsx_lustre_file_system" "test" {
   storage_capacity              = 1200
-  subnet_ids                    = [aws_subnet.test1.id]
-  weekly_maintenance_start_time = %[1]q
+  subnet_ids                    = aws_subnet.test[*].id
+  weekly_maintenance_start_time = %[2]q
   deployment_type               = data.aws_partition.current.partition == "aws-us-gov" ? "SCRATCH_2" : null # GovCloud does not support SCRATCH_1
+
+  tags = {
+    Name = %[1]q
+  }
 }
-`, weeklyMaintenanceStartTime))
+`, rName, weeklyMaintenanceStartTime))
 }
 
-func testAccLustreFileSystemConfig_dailyAutomaticBackupStartTime(dailyAutomaticBackupStartTime string) string {
-	return acctest.ConfigCompose(testAccLustreFileSystemBaseConfig(), fmt.Sprintf(`
+func testAccLustreFileSystemConfig_dailyAutomaticBackupStartTime(rName, dailyAutomaticBackupStartTime string) string {
+	return acctest.ConfigCompose(testAccLustreFileSystemConfig_base(rName), fmt.Sprintf(`
 resource "aws_fsx_lustre_file_system" "test" {
   storage_capacity                  = 1200
-  subnet_ids                        = [aws_subnet.test1.id]
+  subnet_ids                        = aws_subnet.test[*].id
   deployment_type                   = "PERSISTENT_1"
   per_unit_storage_throughput       = 50
-  daily_automatic_backup_start_time = %[1]q
+  daily_automatic_backup_start_time = %[2]q
   automatic_backup_retention_days   = 1
+
+  tags = {
+    Name = %[1]q
+  }
 }
-`, dailyAutomaticBackupStartTime))
+`, rName, dailyAutomaticBackupStartTime))
 }
 
-func testAccLustreFileSystemConfig_automaticBackupRetentionDays(retention int) string {
-	return acctest.ConfigCompose(testAccLustreFileSystemBaseConfig(), fmt.Sprintf(`
+func testAccLustreFileSystemConfig_automaticBackupRetentionDays(rName string, retention int) string {
+	return acctest.ConfigCompose(testAccLustreFileSystemConfig_base(rName), fmt.Sprintf(`
 resource "aws_fsx_lustre_file_system" "test" {
   storage_capacity                = 1200
-  subnet_ids                      = [aws_subnet.test1.id]
+  subnet_ids                      = aws_subnet.test[*].id
   deployment_type                 = "PERSISTENT_1"
   per_unit_storage_throughput     = 50
-  automatic_backup_retention_days = %[1]d
+  automatic_backup_retention_days = %[2]d
+
+  tags = {
+    Name = %[1]q
+  }
 }
-`, retention))
+`, rName, retention))
 }
 
-func testAccLustreFileSystemConfig_deploymentType(deploymentType string) string {
-	return acctest.ConfigCompose(testAccLustreFileSystemBaseConfig(), fmt.Sprintf(`
+func testAccLustreFileSystemConfig_deploymentType(rName, deploymentType string) string {
+	return acctest.ConfigCompose(testAccLustreFileSystemConfig_base(rName), fmt.Sprintf(`
 resource "aws_fsx_lustre_file_system" "test" {
   storage_capacity = 1200
-  subnet_ids       = [aws_subnet.test1.id]
-  deployment_type  = %[1]q
+  subnet_ids       = aws_subnet.test[*].id
+  deployment_type  = %[2]q
+
+  tags = {
+    Name = %[1]q
+  }
 }
-`, deploymentType))
+`, rName, deploymentType))
 }
 
-func testAccLustreFileSystemConfig_persistent1DeploymentType(perUnitStorageThroughput int) string {
-	return acctest.ConfigCompose(testAccLustreFileSystemBaseConfig(), fmt.Sprintf(`
+func testAccLustreFileSystemConfig_persistent1DeploymentType(rName string, perUnitStorageThroughput int) string {
+	return acctest.ConfigCompose(testAccLustreFileSystemConfig_base(rName), fmt.Sprintf(`
 resource "aws_fsx_lustre_file_system" "test" {
   storage_capacity            = 1200
-  subnet_ids                  = [aws_subnet.test1.id]
+  subnet_ids                  = aws_subnet.test[*].id
   deployment_type             = "PERSISTENT_1"
-  per_unit_storage_throughput = %[1]d
+  per_unit_storage_throughput = %[2]d
+
+  tags = {
+    Name = %[1]q
+  }
 }
-`, perUnitStorageThroughput))
+`, rName, perUnitStorageThroughput))
 }
 
-func testAccLustreFileSystemConfig_persistent2DeploymentType(perUnitStorageThroughput int) string {
-	return acctest.ConfigCompose(testAccLustreFileSystemBaseConfig(), fmt.Sprintf(`
+func testAccLustreFileSystemConfig_persistent2DeploymentType(rName string, perUnitStorageThroughput int) string {
+	return acctest.ConfigCompose(testAccLustreFileSystemConfig_base(rName), fmt.Sprintf(`
 resource "aws_fsx_lustre_file_system" "test" {
   storage_capacity            = 1200
-  subnet_ids                  = [aws_subnet.test1.id]
+  subnet_ids                  = aws_subnet.test[*].id
   deployment_type             = "PERSISTENT_2"
-  per_unit_storage_throughput = %[1]d
+  per_unit_storage_throughput = %[2]d
+
+  tags = {
+    Name = %[1]q
+  }
 }
-`, perUnitStorageThroughput))
+`, rName, perUnitStorageThroughput))
 }
 
-func testAccLustreFileSystemConfig_fromBackup() string {
-	return acctest.ConfigCompose(testAccLustreFileSystemBaseConfig(), `
+func testAccLustreFileSystemConfig_fromBackup(rName string) string {
+	return acctest.ConfigCompose(testAccLustreFileSystemConfig_base(rName), fmt.Sprintf(`
 resource "aws_fsx_lustre_file_system" "base" {
   storage_capacity            = 1200
-  subnet_ids                  = [aws_subnet.test1.id]
+  subnet_ids                  = aws_subnet.test[*].id
   deployment_type             = "PERSISTENT_1"
   per_unit_storage_throughput = 50
+
+  tags = {
+    Name = %[1]q
+  }
 }
 
 resource "aws_fsx_backup" "test" {
   file_system_id = aws_fsx_lustre_file_system.base.id
+
+  tags = {
+    Name = %[1]q
+  }
 }
 
 resource "aws_fsx_lustre_file_system" "test" {
   storage_capacity            = 1200
-  subnet_ids                  = [aws_subnet.test1.id]
+  subnet_ids                  = aws_subnet.test[*].id
   deployment_type             = "PERSISTENT_1"
   per_unit_storage_throughput = 50
   backup_id                   = aws_fsx_backup.test.id
+
+  tags = {
+    Name = %[1]q
+  }
 }
-`)
+`, rName))
 }
 
-func testAccLustreFileSystemConfig_kmsKeyID1() string {
-	return acctest.ConfigCompose(testAccLustreFileSystemBaseConfig(), `
+func testAccLustreFileSystemConfig_kmsKeyID1(rName string) string {
+	return acctest.ConfigCompose(testAccLustreFileSystemConfig_base(rName), fmt.Sprintf(`
 resource "aws_kms_key" "test1" {
-  description             = "FSx KMS Testing key"
+  description             = "%[1]s-1"
   deletion_window_in_days = 7
 }
 
 resource "aws_fsx_lustre_file_system" "test" {
   storage_capacity            = 1200
-  subnet_ids                  = [aws_subnet.test1.id]
+  subnet_ids                  = aws_subnet.test[*].id
   deployment_type             = "PERSISTENT_1"
   per_unit_storage_throughput = 50
   kms_key_id                  = aws_kms_key.test1.arn
+
+  tags = {
+    Name = %[1]q
+  }
 }
-`)
+`, rName))
 }
 
-func testAccLustreFileSystemConfig_kmsKeyID2() string {
-	return acctest.ConfigCompose(testAccLustreFileSystemBaseConfig(), `
+func testAccLustreFileSystemConfig_kmsKeyID2(rName string) string {
+	return acctest.ConfigCompose(testAccLustreFileSystemConfig_base(rName), fmt.Sprintf(`
 resource "aws_kms_key" "test2" {
-  description             = "FSx KMS Testing key"
+  description             = "%[1]s-2"
   deletion_window_in_days = 7
 }
 
 resource "aws_fsx_lustre_file_system" "test" {
   storage_capacity            = 1200
-  subnet_ids                  = [aws_subnet.test1.id]
+  subnet_ids                  = aws_subnet.test[*].id
   deployment_type             = "PERSISTENT_1"
   per_unit_storage_throughput = 50
   kms_key_id                  = aws_kms_key.test2.arn
+
+  tags = {
+    Name = %[1]q
+  }
 }
-`)
+`, rName))
 }
 
-func testAccLustreFileSystemConfig_hddStorageType(drive_cache_type string) string {
-	return acctest.ConfigCompose(testAccLustreFileSystemBaseConfig(), fmt.Sprintf(`
+func testAccLustreFileSystemConfig_hddStorageType(rName, driveCacheType string) string {
+	return acctest.ConfigCompose(testAccLustreFileSystemConfig_base(rName), fmt.Sprintf(`
 resource "aws_fsx_lustre_file_system" "test" {
   storage_capacity            = 6000
-  subnet_ids                  = [aws_subnet.test1.id]
+  subnet_ids                  = aws_subnet.test[*].id
   deployment_type             = "PERSISTENT_1"
   per_unit_storage_throughput = 12
   storage_type                = "HDD"
-  drive_cache_type            = %[1]q
+  drive_cache_type            = %[2]q
+
+  tags = {
+    Name = %[1]q
+  }
 }
-`, drive_cache_type))
+`, rName, driveCacheType))
 }
 
 func testAccLustreFileSystemConfig_autoImportPolicy(rName, exportPrefix, policy string) string {
-	return acctest.ConfigCompose(testAccLustreFileSystemBaseConfig(), fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccLustreFileSystemConfig_base(rName), fmt.Sprintf(`
 resource "aws_s3_bucket" "test" {
   bucket = %[1]q
 }
 
-resource "aws_s3_bucket_acl" "test" {
-  bucket = aws_s3_bucket.test.id
-  acl    = "private"
-}
-
 resource "aws_fsx_lustre_file_system" "test" {
   export_path        = "s3://${aws_s3_bucket.test.bucket}%[2]s"
   import_path        = "s3://${aws_s3_bucket.test.bucket}"
   auto_import_policy = %[3]q
   storage_capacity   = 1200
-  subnet_ids         = [aws_subnet.test1.id]
+  subnet_ids         = aws_subnet.test[*].id
   deployment_type    = data.aws_partition.current.partition == "aws-us-gov" ? "SCRATCH_2" : null # GovCloud does not support SCRATCH_1
+
+  tags = {
+    Name = %[1]q
+  }
 }
 `, rName, exportPrefix, policy))
 }
 
-func testAccLustreFileSystemConfig_copyTagsToBackups() string {
-	return acctest.ConfigCompose(testAccLustreFileSystemBaseConfig(), `
+func testAccLustreFileSystemConfig_copyTagsToBackups(rName string) string {
+	return acctest.ConfigCompose(testAccLustreFileSystemConfig_base(rName), fmt.Sprintf(`
 resource "aws_fsx_lustre_file_system" "test" {
   storage_capacity            = 1200
   deployment_type             = "PERSISTENT_1"
-  subnet_ids                  = [aws_subnet.test1.id]
+  subnet_ids                  = aws_subnet.test[*].id
   per_unit_storage_throughput = 50
   copy_tags_to_backups        = true
+
+  tags = {
+    Name = %[1]q
+  }
 }
-`)
+`, rName))
 }
 
-func testAccLustreFileSystemConfig_compression() string {
-	return acctest.ConfigCompose(testAccLustreFileSystemBaseConfig(), `
+func testAccLustreFileSystemConfig_compression(rName string) string {
+	return acctest.ConfigCompose(testAccLustreFileSystemConfig_base(rName), fmt.Sprintf(`
 resource "aws_fsx_lustre_file_system" "test" {
   storage_capacity      = 1200
-  subnet_ids            = [aws_subnet.test1.id]
+  subnet_ids            = aws_subnet.test[*].id
   deployment_type       = data.aws_partition.current.partition == "aws-us-gov" ? "SCRATCH_2" : null # GovCloud does not support SCRATCH_1
   data_compression_type = "LZ4"
+
+  tags = {
+    Name = %[1]q
+  }
 }
-`)
+`, rName))
 }
 
 func testAccLustreFileSystemConfig_log(rName, status string) string {
-	return acctest.ConfigCompose(testAccLustreFileSystemBaseConfig(), fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccLustreFileSystemConfig_base(rName), fmt.Sprintf(`
 resource aws_cloudwatch_log_group "test" {
   name = "/aws/fsx/%[1]s"
 }
 
 resource "aws_fsx_lustre_file_system" "test" {
   storage_capacity = 1200
-  subnet_ids       = [aws_subnet.test1.id]
+  subnet_ids       = aws_subnet.test[*].id
   deployment_type  = data.aws_partition.current.partition == "aws-us-gov" ? "SCRATCH_2" : null # GovCloud does not support SCRATCH_1
 
   log_configuration {
     destination = aws_cloudwatch_log_group.test.arn
     level       = %[2]q
   }
+
+  tags = {
+    Name = %[1]q
+  }
 }
 `, rName, status))
 }
 
-func testAccLustreFileSystemConfig_rootSquash(uid string) string {
-	return acctest.ConfigCompose(testAccLustreFileSystemBaseConfig(), fmt.Sprintf(`
+func testAccLustreFileSystemConfig_rootSquash(rName, uid string) string {
+	return acctest.ConfigCompose(testAccLustreFileSystemConfig_base(rName), fmt.Sprintf(`
 resource "aws_fsx_lustre_file_system" "test" {
   storage_capacity = 1200
-  subnet_ids       = [aws_subnet.test1.id]
+  subnet_ids       = aws_subnet.test[*].id
   deployment_type  = data.aws_partition.current.partition == "aws-us-gov" ? "SCRATCH_2" : null # GovCloud does not support SCRATCH_1
 
   root_squash_configuration {
-    root_squash = %[1]q
+    root_squash = %[2]q
+  }
+
+  tags = {
+    Name = %[1]q
   }
 }
-`, uid))
+`, rName, uid))
 }
diff --git a/internal/service/fsx/ontap_file_system.go b/internal/service/fsx/ontap_file_system.go
index cb0831e88aa..e65d87065b7 100644
--- a/internal/service/fsx/ontap_file_system.go
+++ b/internal/service/fsx/ontap_file_system.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package fsx
 
 import (
 	"context"
 	"log"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/fsx"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -24,12 +27,13 @@ import (
 
 // @SDKResource("aws_fsx_ontap_file_system", name="ONTAP File System")
 // @Tags(identifierAttribute="arn")
-func ResourceOntapFileSystem() *schema.Resource {
+func ResourceONTAPFileSystem() *schema.Resource {
 	return &schema.Resource{
-		CreateWithoutTimeout: resourceOntapFileSystemCreate,
-		ReadWithoutTimeout:   resourceOntapFileSystemRead,
-		UpdateWithoutTimeout: resourceOntapFileSystemUpdate,
-		DeleteWithoutTimeout: resourceOntapFileSystemDelete,
+		CreateWithoutTimeout: resourceONTAPFileSystemCreate,
+		ReadWithoutTimeout:   resourceONTAPFileSystemRead,
+		UpdateWithoutTimeout: resourceONTAPFileSystemUpdate,
+		DeleteWithoutTimeout: resourceONTAPFileSystemDelete,
+
 		Importer: &schema.ResourceImporter{
 			StateContext: schema.ImportStatePassthroughContext,
 		},
@@ -57,7 +61,7 @@ func ResourceOntapFileSystem() *schema.Resource {
 				Computed: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(5, 5),
-					validation.StringMatch(regexp.MustCompile(`^([01]\d|2[0-3]):?([0-5]\d)$`), "must be in the format HH:MM"),
+					validation.StringMatch(regexache.MustCompile(`^([01]\d|2[0-3]):?([0-5]\d)$`), "must be in the format HH:MM"),
 				),
 			},
 			"deployment_type": {
@@ -77,7 +81,7 @@ func ResourceOntapFileSystem() *schema.Resource {
 							Type:         schema.TypeInt,
 							Optional:     true,
 							Computed:     true,
-							ValidateFunc: validation.IntBetween(0, 80000),
+							ValidateFunc: validation.IntBetween(0, 160000),
 						},
 						"mode": {
 							Type:         schema.TypeString,
@@ -92,6 +96,13 @@ func ResourceOntapFileSystem() *schema.Resource {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
+			"endpoint_ip_address_range": {
+				Type:         schema.TypeString,
+				Optional:     true,
+				Computed:     true,
+				ForceNew:     true,
+				ValidateFunc: verify.ValidIPv4CIDRNetworkAddress,
+			},
 			"endpoints": {
 				Type:     schema.TypeList,
 				Computed: true,
@@ -134,13 +145,6 @@ func ResourceOntapFileSystem() *schema.Resource {
 					},
 				},
 			},
-			"endpoint_ip_address_range": {
-				Type:         schema.TypeString,
-				Optional:     true,
-				Computed:     true,
-				ForceNew:     true,
-				ValidateFunc: verify.ValidIPv4CIDRNetworkAddress,
-			},
 			"fsx_admin_password": {
 				Type:         schema.TypeString,
 				Optional:     true,
@@ -170,17 +174,17 @@ func ResourceOntapFileSystem() *schema.Resource {
 				Required: true,
 				ForceNew: true,
 			},
-			"security_group_ids": {
+			"route_table_ids": {
 				Type:     schema.TypeSet,
 				Optional: true,
-				ForceNew: true,
+				Computed: true,
 				MaxItems: 50,
 				Elem:     &schema.Schema{Type: schema.TypeString},
 			},
-			"route_table_ids": {
+			"security_group_ids": {
 				Type:     schema.TypeSet,
 				Optional: true,
-				Computed: true,
+				ForceNew: true,
 				MaxItems: 50,
 				Elem:     &schema.Schema{Type: schema.TypeString},
 			},
@@ -221,7 +225,7 @@ func ResourceOntapFileSystem() *schema.Resource {
 				Computed: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(7, 7),
-					validation.StringMatch(regexp.MustCompile(`^[1-7]:([01]\d|2[0-3]):?([0-5]\d)$`), "must be in the format d:HH:MM"),
+					validation.StringMatch(regexache.MustCompile(`^[1-7]:([01]\d|2[0-3]):?([0-5]\d)$`), "must be in the format d:HH:MM"),
 				),
 			},
 		},
@@ -230,31 +234,23 @@ func ResourceOntapFileSystem() *schema.Resource {
 	}
 }
 
-func resourceOntapFileSystemCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+func resourceONTAPFileSystemCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).FSxConn(ctx)
 
 	input := &fsx.CreateFileSystemInput{
 		ClientRequestToken: aws.String(id.UniqueId()),
 		FileSystemType:     aws.String(fsx.FileSystemTypeOntap),
-		StorageCapacity:    aws.Int64(int64(d.Get("storage_capacity").(int))),
-		StorageType:        aws.String(d.Get("storage_type").(string)),
-		SubnetIds:          flex.ExpandStringList(d.Get("subnet_ids").([]interface{})),
 		OntapConfiguration: &fsx.CreateFileSystemOntapConfiguration{
-			DeploymentType:               aws.String(d.Get("deployment_type").(string)),
 			AutomaticBackupRetentionDays: aws.Int64(int64(d.Get("automatic_backup_retention_days").(int))),
-			ThroughputCapacity:           aws.Int64(int64(d.Get("throughput_capacity").(int))),
+			DeploymentType:               aws.String(d.Get("deployment_type").(string)),
 			PreferredSubnetId:            aws.String(d.Get("preferred_subnet_id").(string)),
+			ThroughputCapacity:           aws.Int64(int64(d.Get("throughput_capacity").(int))),
 		},
-		Tags: getTagsIn(ctx),
-	}
-
-	if v, ok := d.GetOk("kms_key_id"); ok {
-		input.KmsKeyId = aws.String(v.(string))
-	}
-
-	if v, ok := d.GetOk("endpoint_ip_address_range"); ok {
-		input.OntapConfiguration.EndpointIpAddressRange = aws.String(v.(string))
+		StorageCapacity: aws.Int64(int64(d.Get("storage_capacity").(int))),
+		StorageType:     aws.String(d.Get("storage_type").(string)),
+		SubnetIds:       flex.ExpandStringList(d.Get("subnet_ids").([]interface{})),
+		Tags:            getTagsIn(ctx),
 	}
 
 	if v, ok := d.GetOk("daily_automatic_backup_start_time"); ok {
@@ -265,10 +261,18 @@ func resourceOntapFileSystemCreate(ctx context.Context, d *schema.ResourceData,
 		input.OntapConfiguration.DiskIopsConfiguration = expandOntapFileDiskIopsConfiguration(v.([]interface{}))
 	}
 
+	if v, ok := d.GetOk("endpoint_ip_address_range"); ok {
+		input.OntapConfiguration.EndpointIpAddressRange = aws.String(v.(string))
+	}
+
 	if v, ok := d.GetOk("fsx_admin_password"); ok {
 		input.OntapConfiguration.FsxAdminPassword = aws.String(v.(string))
 	}
 
+	if v, ok := d.GetOk("kms_key_id"); ok {
+		input.KmsKeyId = aws.String(v.(string))
+	}
+
 	if v, ok := d.GetOk("route_table_ids"); ok {
 		input.OntapConfiguration.RouteTableIds = flex.ExpandStringSet(v.(*schema.Set))
 	}
@@ -281,98 +285,80 @@ func resourceOntapFileSystemCreate(ctx context.Context, d *schema.ResourceData,
 		input.OntapConfiguration.WeeklyMaintenanceStartTime = aws.String(v.(string))
 	}
 
-	result, err := conn.CreateFileSystemWithContext(ctx, input)
+	output, err := conn.CreateFileSystemWithContext(ctx, input)
 
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "creating FSx ONTAP File System: %s", err)
+		return sdkdiag.AppendErrorf(diags, "creating FSx for NetApp ONTAP File System: %s", err)
 	}
 
-	d.SetId(aws.StringValue(result.FileSystem.FileSystemId))
+	d.SetId(aws.StringValue(output.FileSystem.FileSystemId))
 
 	if _, err := waitFileSystemCreated(ctx, conn, d.Id(), d.Timeout(schema.TimeoutCreate)); err != nil {
-		return sdkdiag.AppendErrorf(diags, "waiting for FSx ONTAP File System (%s) create: %s", d.Id(), err)
+		return sdkdiag.AppendErrorf(diags, "waiting for FSx for NetApp ONTAP File System (%s) create: %s", d.Id(), err)
 	}
 
-	return append(diags, resourceOntapFileSystemRead(ctx, d, meta)...)
+	return append(diags, resourceONTAPFileSystemRead(ctx, d, meta)...)
 }
 
-func resourceOntapFileSystemRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+func resourceONTAPFileSystemRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).FSxConn(ctx)
 
-	filesystem, err := FindFileSystemByID(ctx, conn, d.Id())
+	filesystem, err := FindONTAPFileSystemByID(ctx, conn, d.Id())
 
 	if !d.IsNewResource() && tfresource.NotFound(err) {
-		log.Printf("[WARN] FSx ONTAP File System (%s) not found, removing from state", d.Id())
+		log.Printf("[WARN] FSx for NetApp ONTAP File System (%s) not found, removing from state", d.Id())
 		d.SetId("")
 		return diags
 	}
 
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "reading FSx ONTAP File System (%s): %s", d.Id(), err)
+		return sdkdiag.AppendErrorf(diags, "reading FSx for NetApp ONTAP File System (%s): %s", d.Id(), err)
 	}
 
 	ontapConfig := filesystem.OntapConfiguration
-	if ontapConfig == nil {
-		return sdkdiag.AppendErrorf(diags, "describing FSx ONTAP File System (%s): empty ONTAP configuration", d.Id())
-	}
 
 	d.Set("arn", filesystem.ResourceARN)
-	d.Set("dns_name", filesystem.DNSName)
-	d.Set("deployment_type", ontapConfig.DeploymentType)
-	d.Set("storage_type", filesystem.StorageType)
-	d.Set("vpc_id", filesystem.VpcId)
-	d.Set("weekly_maintenance_start_time", ontapConfig.WeeklyMaintenanceStartTime)
 	d.Set("automatic_backup_retention_days", ontapConfig.AutomaticBackupRetentionDays)
 	d.Set("daily_automatic_backup_start_time", ontapConfig.DailyAutomaticBackupStartTime)
-	d.Set("throughput_capacity", ontapConfig.ThroughputCapacity)
-	d.Set("preferred_subnet_id", ontapConfig.PreferredSubnetId)
-	d.Set("endpoint_ip_address_range", ontapConfig.EndpointIpAddressRange)
-	d.Set("owner_id", filesystem.OwnerId)
-	d.Set("storage_capacity", filesystem.StorageCapacity)
-	d.Set("fsx_admin_password", d.Get("fsx_admin_password").(string))
-	d.Set("kms_key_id", filesystem.KmsKeyId)
-
-	if err := d.Set("network_interface_ids", aws.StringValueSlice(filesystem.NetworkInterfaceIds)); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting network_interface_ids: %s", err)
-	}
-
-	if err := d.Set("subnet_ids", aws.StringValueSlice(filesystem.SubnetIds)); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting subnet_ids: %s", err)
-	}
-
-	if err := d.Set("route_table_ids", aws.StringValueSlice(ontapConfig.RouteTableIds)); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting subnet_ids: %s", err)
+	d.Set("deployment_type", ontapConfig.DeploymentType)
+	if err := d.Set("disk_iops_configuration", flattenOntapFileDiskIopsConfiguration(ontapConfig.DiskIopsConfiguration)); err != nil {
+		return sdkdiag.AppendErrorf(diags, "setting disk_iops_configuration: %s", err)
 	}
-
+	d.Set("dns_name", filesystem.DNSName)
+	d.Set("endpoint_ip_address_range", ontapConfig.EndpointIpAddressRange)
 	if err := d.Set("endpoints", flattenOntapFileSystemEndpoints(ontapConfig.Endpoints)); err != nil {
 		return sdkdiag.AppendErrorf(diags, "setting endpoints: %s", err)
 	}
-
-	if err := d.Set("disk_iops_configuration", flattenOntapFileDiskIopsConfiguration(ontapConfig.DiskIopsConfiguration)); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting disk_iops_configuration: %s", err)
-	}
+	d.Set("fsx_admin_password", d.Get("fsx_admin_password").(string))
+	d.Set("kms_key_id", filesystem.KmsKeyId)
+	d.Set("network_interface_ids", aws.StringValueSlice(filesystem.NetworkInterfaceIds))
+	d.Set("owner_id", filesystem.OwnerId)
+	d.Set("preferred_subnet_id", ontapConfig.PreferredSubnetId)
+	d.Set("route_table_ids", aws.StringValueSlice(ontapConfig.RouteTableIds))
+	d.Set("storage_capacity", filesystem.StorageCapacity)
+	d.Set("storage_type", filesystem.StorageType)
+	d.Set("subnet_ids", aws.StringValueSlice(filesystem.SubnetIds))
+	d.Set("throughput_capacity", ontapConfig.ThroughputCapacity)
+	d.Set("vpc_id", filesystem.VpcId)
+	d.Set("weekly_maintenance_start_time", ontapConfig.WeeklyMaintenanceStartTime)
 
 	setTagsOut(ctx, filesystem.Tags)
 
 	return diags
 }
 
-func resourceOntapFileSystemUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+func resourceONTAPFileSystemUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).FSxConn(ctx)
 
-	if d.HasChangesExcept("tags_all", "tags") {
+	if d.HasChangesExcept("tags", "tags_all") {
 		input := &fsx.UpdateFileSystemInput{
 			ClientRequestToken: aws.String(id.UniqueId()),
 			FileSystemId:       aws.String(d.Id()),
 			OntapConfiguration: &fsx.UpdateFileSystemOntapConfiguration{},
 		}
 
-		if d.HasChange("storage_capacity") {
-			input.StorageCapacity = aws.Int64(int64(d.Get("storage_capacity").(int)))
-		}
-
 		if d.HasChange("automatic_backup_retention_days") {
 			input.OntapConfiguration.AutomaticBackupRetentionDays = aws.Int64(int64(d.Get("automatic_backup_retention_days").(int)))
 		}
@@ -381,61 +367,64 @@ func resourceOntapFileSystemUpdate(ctx context.Context, d *schema.ResourceData,
 			input.OntapConfiguration.DailyAutomaticBackupStartTime = aws.String(d.Get("daily_automatic_backup_start_time").(string))
 		}
 
-		if d.HasChange("fsx_admin_password") {
-			input.OntapConfiguration.FsxAdminPassword = aws.String(d.Get("fsx_admin_password").(string))
-		}
-
-		if d.HasChange("weekly_maintenance_start_time") {
-			input.OntapConfiguration.WeeklyMaintenanceStartTime = aws.String(d.Get("weekly_maintenance_start_time").(string))
-		}
-
-		if d.HasChange("throughput_capacity") {
-			input.OntapConfiguration.ThroughputCapacity = aws.Int64(int64(d.Get("throughput_capacity").(int)))
-		}
-
 		if d.HasChange("disk_iops_configuration") {
 			input.OntapConfiguration.DiskIopsConfiguration = expandOntapFileDiskIopsConfiguration(d.Get("disk_iops_configuration").([]interface{}))
 		}
 
+		if d.HasChange("fsx_admin_password") {
+			input.OntapConfiguration.FsxAdminPassword = aws.String(d.Get("fsx_admin_password").(string))
+		}
+
 		if d.HasChange("route_table_ids") {
 			o, n := d.GetChange("route_table_ids")
-			ns := n.(*schema.Set)
-			os := o.(*schema.Set)
-			added := ns.Difference(os)
-			removed := os.Difference(ns)
+			os, ns := o.(*schema.Set), n.(*schema.Set)
+			add, del := flex.ExpandStringValueSet(ns.Difference(os)), flex.ExpandStringValueSet(os.Difference(ns))
 
-			if added.Len() > 0 {
-				input.OntapConfiguration.AddRouteTableIds = flex.ExpandStringSet(added)
+			if len(add) > 0 {
+				input.OntapConfiguration.AddRouteTableIds = aws.StringSlice(add)
 			}
 
-			if removed.Len() > 0 {
-				input.OntapConfiguration.RemoveRouteTableIds = flex.ExpandStringSet(removed)
+			if len(del) > 0 {
+				input.OntapConfiguration.RemoveRouteTableIds = aws.StringSlice(del)
 			}
 		}
 
+		if d.HasChange("storage_capacity") {
+			input.StorageCapacity = aws.Int64(int64(d.Get("storage_capacity").(int)))
+		}
+
+		if d.HasChange("throughput_capacity") {
+			input.OntapConfiguration.ThroughputCapacity = aws.Int64(int64(d.Get("throughput_capacity").(int)))
+		}
+
+		if d.HasChange("weekly_maintenance_start_time") {
+			input.OntapConfiguration.WeeklyMaintenanceStartTime = aws.String(d.Get("weekly_maintenance_start_time").(string))
+		}
+
+		startTime := time.Now()
 		_, err := conn.UpdateFileSystemWithContext(ctx, input)
 
 		if err != nil {
-			return sdkdiag.AppendErrorf(diags, "updating FSx ONTAP File System (%s): %s", d.Id(), err)
+			return sdkdiag.AppendErrorf(diags, "updating FSx for NetApp ONTAP File System (%s): %s", d.Id(), err)
 		}
 
-		if _, err := waitFileSystemUpdated(ctx, conn, d.Id(), d.Timeout(schema.TimeoutUpdate)); err != nil {
-			return sdkdiag.AppendErrorf(diags, "waiting for FSx ONTAP File System (%s) update: %s", d.Id(), err)
+		if _, err := waitFileSystemUpdated(ctx, conn, d.Id(), startTime, d.Timeout(schema.TimeoutUpdate)); err != nil {
+			return sdkdiag.AppendErrorf(diags, "waiting for FSx for NetApp ONTAP File System (%s) update: %s", d.Id(), err)
 		}
 
-		if _, err := waitAdministrativeActionCompleted(ctx, conn, d.Id(), fsx.AdministrativeActionTypeFileSystemUpdate, d.Timeout(schema.TimeoutUpdate)); err != nil {
-			return sdkdiag.AppendErrorf(diags, "waiting for FSx ONTAP File System (%s) update: %s", d.Id(), err)
+		if _, err := waitFileSystemAdministrativeActionCompleted(ctx, conn, d.Id(), fsx.AdministrativeActionTypeFileSystemUpdate, d.Timeout(schema.TimeoutUpdate)); err != nil {
+			return sdkdiag.AppendErrorf(diags, "waiting for FSx for NetApp ONTAP File System (%s) administrative action (%s) complete: %s", d.Id(), fsx.AdministrativeActionTypeFileSystemUpdate, err)
 		}
 	}
 
-	return append(diags, resourceOntapFileSystemRead(ctx, d, meta)...)
+	return append(diags, resourceONTAPFileSystemRead(ctx, d, meta)...)
 }
 
-func resourceOntapFileSystemDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+func resourceONTAPFileSystemDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).FSxConn(ctx)
 
-	log.Printf("[DEBUG] Deleting FSx ONTAP File System: %s", d.Id())
+	log.Printf("[DEBUG] Deleting FSx for NetApp ONTAP File System: %s", d.Id())
 	_, err := conn.DeleteFileSystemWithContext(ctx, &fsx.DeleteFileSystemInput{
 		FileSystemId: aws.String(d.Id()),
 	})
@@ -445,11 +434,11 @@ func resourceOntapFileSystemDelete(ctx context.Context, d *schema.ResourceData,
 	}
 
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "deleting FSx ONTAP File System (%s): %s", d.Id(), err)
+		return sdkdiag.AppendErrorf(diags, "deleting FSx for NetApp ONTAP File System (%s): %s", d.Id(), err)
 	}
 
 	if _, err := waitFileSystemDeleted(ctx, conn, d.Id(), d.Timeout(schema.TimeoutDelete)); err != nil {
-		return sdkdiag.AppendErrorf(diags, "waiting for FSx ONTAP File System (%s) delete: %s", d.Id(), err)
+		return sdkdiag.AppendErrorf(diags, "waiting for FSx for NetApp ONTAP File System (%s) delete: %s", d.Id(), err)
 	}
 
 	return diags
@@ -521,3 +510,17 @@ func flattenOntapFileSystemEndpoint(rs *fsx.FileSystemEndpoint) []interface{} {
 
 	return []interface{}{m}
 }
+
+func FindONTAPFileSystemByID(ctx context.Context, conn *fsx.FSx, id string) (*fsx.FileSystem, error) {
+	output, err := findFileSystemByIDAndType(ctx, conn, id, fsx.FileSystemTypeOntap)
+
+	if err != nil {
+		return nil, err
+	}
+
+	if output.OntapConfiguration == nil {
+		return nil, tfresource.NewEmptyResultError(nil)
+	}
+
+	return output, nil
+}
diff --git a/internal/service/fsx/ontap_file_system_data_source.go b/internal/service/fsx/ontap_file_system_data_source.go
new file mode 100644
index 00000000000..bef59df0332
--- /dev/null
+++ b/internal/service/fsx/ontap_file_system_data_source.go
@@ -0,0 +1,214 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package fsx
+
+import (
+	"context"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
+	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
+)
+
+// @SDKDataSource("aws_fsx_ontap_file_system", name="Ontap File System")
+func DataSourceONTAPFileSystem() *schema.Resource {
+	return &schema.Resource{
+		ReadWithoutTimeout: dataSourceONTAPFileSystemRead,
+
+		Schema: map[string]*schema.Schema{
+			"arn": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"automatic_backup_retention_days": {
+				Type:     schema.TypeInt,
+				Computed: true,
+			},
+			"daily_automatic_backup_start_time": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"deployment_type": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"disk_iops_configuration": {
+				Type:     schema.TypeList,
+				Computed: true,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"iops": {
+							Type:     schema.TypeInt,
+							Computed: true,
+						},
+						"mode": {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+					},
+				},
+			},
+			"dns_name": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"endpoint_ip_address_range": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"endpoints": {
+				Type:     schema.TypeList,
+				Computed: true,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"intercluster": {
+							Type:     schema.TypeList,
+							Computed: true,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"dns_name": {
+										Type:     schema.TypeString,
+										Computed: true,
+									},
+									"ip_addresses": {
+										Type:     schema.TypeSet,
+										Computed: true,
+										Elem:     &schema.Schema{Type: schema.TypeString},
+									},
+								},
+							},
+						},
+						"management": {
+							Type:     schema.TypeList,
+							Computed: true,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"dns_name": {
+										Type:     schema.TypeString,
+										Computed: true,
+									},
+									"ip_addresses": {
+										Type:     schema.TypeSet,
+										Computed: true,
+										Elem:     &schema.Schema{Type: schema.TypeString},
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+			"id": {
+				Type:     schema.TypeString,
+				Required: true,
+			},
+			"kms_key_id": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"network_interface_ids": {
+				Type:     schema.TypeList,
+				Computed: true,
+				Elem:     &schema.Schema{Type: schema.TypeString},
+			},
+			"owner_id": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"preferred_subnet_id": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"route_table_ids": {
+				Type:     schema.TypeSet,
+				Computed: true,
+				Elem:     &schema.Schema{Type: schema.TypeString},
+			},
+			"storage_capacity": {
+				Type:     schema.TypeInt,
+				Computed: true,
+			},
+			"storage_type": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"subnet_ids": {
+				Type:     schema.TypeList,
+				Computed: true,
+				Elem: &schema.Schema{
+					Type: schema.TypeString,
+				},
+			},
+			"tags": tftags.TagsSchemaComputed(),
+			"throughput_capacity": {
+				Type:     schema.TypeInt,
+				Computed: true,
+			},
+			"vpc_id": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"weekly_maintenance_start_time": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+		},
+	}
+}
+
+const (
+	DSNameOntapFileSystem = "Ontap File System Data Source"
+)
+
+func dataSourceONTAPFileSystemRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+
+	conn := meta.(*conns.AWSClient).FSxConn(ctx)
+	defaultTagsConfig := meta.(*conns.AWSClient).DefaultTagsConfig
+	ignoreTagsConfig := meta.(*conns.AWSClient).IgnoreTagsConfig
+
+	id := d.Get("id").(string)
+	filesystem, err := FindONTAPFileSystemByID(ctx, conn, id)
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "reading FSx for NetApp ONTAP File System (%s): %s", id, err)
+	}
+
+	d.SetId(aws.StringValue(filesystem.FileSystemId))
+	d.Set("arn", filesystem.ResourceARN)
+	d.Set("automatic_backup_retention_days", filesystem.OntapConfiguration.AutomaticBackupRetentionDays)
+	d.Set("daily_automatic_backup_start_time", filesystem.OntapConfiguration.DailyAutomaticBackupStartTime)
+	d.Set("deployment_type", filesystem.OntapConfiguration.DeploymentType)
+	if err := d.Set("disk_iops_configuration", flattenOntapFileDiskIopsConfiguration(filesystem.OntapConfiguration.DiskIopsConfiguration)); err != nil {
+		return sdkdiag.AppendErrorf(diags, "setting disk_iops_configuration: %s", err)
+	}
+	d.Set("dns_name", filesystem.DNSName)
+	d.Set("endpoint_ip_address_range", filesystem.OntapConfiguration.EndpointIpAddressRange)
+	if err := d.Set("endpoints", flattenOntapFileSystemEndpoints(filesystem.OntapConfiguration.Endpoints)); err != nil {
+		return sdkdiag.AppendErrorf(diags, "setting endpoints: %s", err)
+	}
+	d.Set("kms_key_id", filesystem.KmsKeyId)
+	d.Set("network_interface_ids", aws.StringValueSlice(filesystem.NetworkInterfaceIds))
+	d.Set("owner_id", filesystem.OwnerId)
+	d.Set("preferred_subnet_id", filesystem.OntapConfiguration.PreferredSubnetId)
+	d.Set("route_table_ids", aws.StringValueSlice(filesystem.OntapConfiguration.RouteTableIds))
+	d.Set("storage_capacity", filesystem.StorageCapacity)
+	d.Set("storage_type", filesystem.StorageType)
+	d.Set("subnet_ids", aws.StringValueSlice(filesystem.SubnetIds))
+	d.Set("throughput_capacity", filesystem.OntapConfiguration.ThroughputCapacity)
+	d.Set("vpc_id", filesystem.VpcId)
+	d.Set("weekly_maintenance_start_time", filesystem.OntapConfiguration.WeeklyMaintenanceStartTime)
+
+	tags := KeyValueTags(ctx, filesystem.Tags).IgnoreAWS().IgnoreConfig(ignoreTagsConfig)
+
+	//lintignore:AWSR002
+	if err := d.Set("tags", tags.RemoveDefaultConfig(defaultTagsConfig).Map()); err != nil {
+		return sdkdiag.AppendErrorf(diags, "setting tags: %s", err)
+	}
+
+	return diags
+}
diff --git a/internal/service/fsx/ontap_file_system_data_source_test.go b/internal/service/fsx/ontap_file_system_data_source_test.go
new file mode 100644
index 00000000000..950a6fba09b
--- /dev/null
+++ b/internal/service/fsx/ontap_file_system_data_source_test.go
@@ -0,0 +1,65 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package fsx_test
+
+import (
+	"testing"
+
+	"github.com/aws/aws-sdk-go/service/fsx"
+	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
+)
+
+func TestAccFSxONTAPFileSystemDataSource_Id(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
+	ctx := acctest.Context(t)
+	resourceName := "aws_fsx_ontap_file_system.test"
+	datasourceName := "data.aws_fsx_ontap_file_system.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, fsx.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccONTAPFileSystemDataSourceConfig_id(rName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					resource.TestCheckResourceAttrPair(datasourceName, "arn", resourceName, "arn"),
+					resource.TestCheckResourceAttrPair(datasourceName, "automatic_backup_retention_days", resourceName, "automatic_backup_retention_days"),
+					resource.TestCheckResourceAttrPair(datasourceName, "daily_automatic_backup_start_time", resourceName, "daily_automatic_backup_start_time"),
+					resource.TestCheckResourceAttrPair(datasourceName, "deployment_type", resourceName, "deployment_type"),
+					resource.TestCheckResourceAttrPair(datasourceName, "disk_iops_configuration.#", resourceName, "disk_iops_configuration.#"),
+					resource.TestCheckResourceAttrPair(datasourceName, "dns_name", resourceName, "dns_name"),
+					resource.TestCheckResourceAttrPair(datasourceName, "endpoint_ip_address_range", resourceName, "endpoint_ip_address_range"),
+					resource.TestCheckResourceAttrPair(datasourceName, "endpoints.#", resourceName, "endpoints.#"),
+					resource.TestCheckResourceAttrPair(datasourceName, "kms_key_id", resourceName, "kms_key_id"),
+					resource.TestCheckResourceAttrPair(datasourceName, "network_interface_ids.#", resourceName, "network_interface_ids.#"),
+					resource.TestCheckResourceAttrPair(datasourceName, "owner_id", resourceName, "owner_id"),
+					resource.TestCheckResourceAttrPair(datasourceName, "preferred_subnet_id", resourceName, "preferred_subnet_id"),
+					resource.TestCheckResourceAttrPair(datasourceName, "route_table_ids.#", resourceName, "route_table_ids.#"),
+					resource.TestCheckResourceAttrPair(datasourceName, "storage_capacity", resourceName, "storage_capacity"),
+					resource.TestCheckResourceAttrPair(datasourceName, "storage_type", resourceName, "storage_type"),
+					resource.TestCheckResourceAttrPair(datasourceName, "subnet_ids.#", resourceName, "subnet_ids.#"),
+					resource.TestCheckResourceAttrPair(datasourceName, "tags.%", resourceName, "tags.%"),
+					resource.TestCheckResourceAttrPair(datasourceName, "throughput_capacity", resourceName, "throughput_capacity"),
+					resource.TestCheckResourceAttrPair(datasourceName, "vpc_id", resourceName, "vpc_id"),
+					resource.TestCheckResourceAttrPair(datasourceName, "weekly_maintenance_start_time", resourceName, "weekly_maintenance_start_time"),
+				),
+			},
+		},
+	})
+}
+
+func testAccONTAPFileSystemDataSourceConfig_id(rName string) string {
+	return acctest.ConfigCompose(testAccONTAPFileSystemConfig_basic(rName), `
+data "aws_fsx_ontap_file_system" "test" {
+  id = aws_fsx_ontap_file_system.test.id
+}
+`)
+}
diff --git a/internal/service/fsx/ontap_file_system_test.go b/internal/service/fsx/ontap_file_system_test.go
index 2678a3bfda8..64dd825cb17 100644
--- a/internal/service/fsx/ontap_file_system_test.go
+++ b/internal/service/fsx/ontap_file_system_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package fsx_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/fsx"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -17,7 +20,7 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
-func TestAccFSxOntapFileSystem_basic(t *testing.T) {
+func TestAccFSxONTAPFileSystem_basic(t *testing.T) {
 	ctx := acctest.Context(t)
 	var filesystem fsx.FileSystem
 	resourceName := "aws_fsx_ontap_file_system.test"
@@ -27,39 +30,39 @@ func TestAccFSxOntapFileSystem_basic(t *testing.T) {
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
 		ErrorCheck:               acctest.ErrorCheck(t, fsx.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckOntapFileSystemDestroy(ctx),
+		CheckDestroy:             testAccCheckONTAPFileSystemDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccONTAPFileSystemConfig_basic(rName),
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOntapFileSystemExists(ctx, resourceName, &filesystem),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "fsx", regexp.MustCompile(`file-system/fs-.+`)),
-					resource.TestCheckResourceAttr(resourceName, "network_interface_ids.#", "2"),
-					acctest.CheckResourceAttrAccountID(resourceName, "owner_id"),
-					resource.TestCheckResourceAttr(resourceName, "storage_capacity", "1024"),
-					resource.TestCheckTypeSetElemAttrPair(resourceName, "subnet_ids.*", "aws_subnet.test1", "id"),
-					resource.TestCheckTypeSetElemAttrPair(resourceName, "subnet_ids.*", "aws_subnet.test2", "id"),
-					resource.TestCheckResourceAttr(resourceName, "security_group_ids.#", "0"),
-					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
-					resource.TestCheckResourceAttrPair(resourceName, "vpc_id", "aws_vpc.test", "id"),
-					resource.TestMatchResourceAttr(resourceName, "weekly_maintenance_start_time", regexp.MustCompile(`^\d:\d\d:\d\d$`)),
-					resource.TestCheckResourceAttr(resourceName, "deployment_type", fsx.OntapDeploymentTypeMultiAz1),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckONTAPFileSystemExists(ctx, resourceName, &filesystem),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "fsx", regexache.MustCompile(`file-system/fs-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "automatic_backup_retention_days", "0"),
-					resource.TestCheckResourceAttr(resourceName, "storage_type", fsx.StorageTypeSsd),
-					resource.TestCheckResourceAttrSet(resourceName, "kms_key_id"),
+					resource.TestCheckResourceAttr(resourceName, "deployment_type", fsx.OntapDeploymentTypeMultiAz1),
+					resource.TestCheckResourceAttr(resourceName, "disk_iops_configuration.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "disk_iops_configuration.0.iops", "3072"),
+					resource.TestCheckResourceAttr(resourceName, "disk_iops_configuration.0.mode", "AUTOMATIC"),
 					resource.TestCheckResourceAttrSet(resourceName, "endpoint_ip_address_range"),
-					resource.TestCheckResourceAttr(resourceName, "route_table_ids.#", "1"),
-					resource.TestCheckTypeSetElemAttrPair(resourceName, "route_table_ids.*", "aws_vpc.test", "default_route_table_id"),
-					resource.TestCheckResourceAttr(resourceName, "throughput_capacity", "128"),
-					resource.TestCheckResourceAttrPair(resourceName, "preferred_subnet_id", "aws_subnet.test1", "id"),
 					resource.TestCheckResourceAttr(resourceName, "endpoints.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "endpoints.0.intercluster.#", "1"),
 					resource.TestCheckResourceAttrSet(resourceName, "endpoints.0.intercluster.0.dns_name"),
 					resource.TestCheckResourceAttr(resourceName, "endpoints.0.management.#", "1"),
 					resource.TestCheckResourceAttrSet(resourceName, "endpoints.0.management.0.dns_name"),
-					resource.TestCheckResourceAttr(resourceName, "disk_iops_configuration.#", "1"),
-					resource.TestCheckResourceAttr(resourceName, "disk_iops_configuration.0.mode", "AUTOMATIC"),
-					resource.TestCheckResourceAttr(resourceName, "disk_iops_configuration.0.iops", "3072"),
+					resource.TestCheckResourceAttrSet(resourceName, "kms_key_id"),
+					resource.TestCheckResourceAttr(resourceName, "network_interface_ids.#", "2"),
+					acctest.CheckResourceAttrAccountID(resourceName, "owner_id"),
+					resource.TestCheckResourceAttrPair(resourceName, "preferred_subnet_id", "aws_subnet.test.0", "id"),
+					resource.TestCheckResourceAttr(resourceName, "route_table_ids.#", "1"),
+					resource.TestCheckTypeSetElemAttrPair(resourceName, "route_table_ids.*", "aws_vpc.test", "default_route_table_id"),
+					resource.TestCheckResourceAttr(resourceName, "security_group_ids.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "storage_capacity", "1024"),
+					resource.TestCheckResourceAttr(resourceName, "storage_type", fsx.StorageTypeSsd),
+					resource.TestCheckTypeSetElemAttrPair(resourceName, "subnet_ids.*", "aws_subnet.test.0", "id"),
+					resource.TestCheckTypeSetElemAttrPair(resourceName, "subnet_ids.*", "aws_subnet.test.1", "id"),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
+					resource.TestCheckResourceAttr(resourceName, "throughput_capacity", "128"),
+					resource.TestCheckResourceAttrPair(resourceName, "vpc_id", "aws_vpc.test", "id"),
+					resource.TestMatchResourceAttr(resourceName, "weekly_maintenance_start_time", regexache.MustCompile(`^\d:\d\d:\d\d$`)),
 				),
 			},
 			{
@@ -72,7 +75,7 @@ func TestAccFSxOntapFileSystem_basic(t *testing.T) {
 	})
 }
 
-func TestAccFSxOntapFileSystem_fsxSingleAz(t *testing.T) {
+func TestAccFSxONTAPFileSystem_singleAZ(t *testing.T) {
 	ctx := acctest.Context(t)
 	var filesystem fsx.FileSystem
 	resourceName := "aws_fsx_ontap_file_system.test"
@@ -82,13 +85,13 @@ func TestAccFSxOntapFileSystem_fsxSingleAz(t *testing.T) {
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
 		ErrorCheck:               acctest.ErrorCheck(t, fsx.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckOntapFileSystemDestroy(ctx),
+		CheckDestroy:             testAccCheckONTAPFileSystemDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccONTAPFileSystemConfig_singleAz(rName),
+				Config: testAccONTAPFileSystemConfig_singleAZ(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOntapFileSystemExists(ctx, resourceName, &filesystem),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "fsx", regexp.MustCompile(`file-system/fs-.+`)),
+					testAccCheckONTAPFileSystemExists(ctx, resourceName, &filesystem),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "fsx", regexache.MustCompile(`file-system/fs-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "deployment_type", fsx.OntapDeploymentTypeSingleAz1),
 				),
 			},
@@ -102,7 +105,7 @@ func TestAccFSxOntapFileSystem_fsxSingleAz(t *testing.T) {
 	})
 }
 
-func TestAccFSxOntapFileSystem_fsxAdminPassword(t *testing.T) {
+func TestAccFSxONTAPFileSystem_fsxAdminPassword(t *testing.T) {
 	ctx := acctest.Context(t)
 	var filesystem1, filesystem2 fsx.FileSystem
 	resourceName := "aws_fsx_ontap_file_system.test"
@@ -114,12 +117,12 @@ func TestAccFSxOntapFileSystem_fsxAdminPassword(t *testing.T) {
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
 		ErrorCheck:               acctest.ErrorCheck(t, fsx.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckOntapFileSystemDestroy(ctx),
+		CheckDestroy:             testAccCheckONTAPFileSystemDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccONTAPFileSystemConfig_adminPassword(rName, pass1),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOntapFileSystemExists(ctx, resourceName, &filesystem1),
+					testAccCheckONTAPFileSystemExists(ctx, resourceName, &filesystem1),
 					resource.TestCheckResourceAttr(resourceName, "fsx_admin_password", pass1),
 				),
 			},
@@ -132,8 +135,8 @@ func TestAccFSxOntapFileSystem_fsxAdminPassword(t *testing.T) {
 			{
 				Config: testAccONTAPFileSystemConfig_adminPassword(rName, pass2),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOntapFileSystemExists(ctx, resourceName, &filesystem2),
-					testAccCheckOntapFileSystemNotRecreated(&filesystem1, &filesystem2),
+					testAccCheckONTAPFileSystemExists(ctx, resourceName, &filesystem2),
+					testAccCheckONTAPFileSystemNotRecreated(&filesystem1, &filesystem2),
 					resource.TestCheckResourceAttr(resourceName, "fsx_admin_password", pass2),
 				),
 			},
@@ -141,7 +144,7 @@ func TestAccFSxOntapFileSystem_fsxAdminPassword(t *testing.T) {
 	})
 }
 
-func TestAccFSxOntapFileSystem_endpointIPAddressRange(t *testing.T) {
+func TestAccFSxONTAPFileSystem_endpointIPAddressRange(t *testing.T) {
 	ctx := acctest.Context(t)
 	var filesystem fsx.FileSystem
 	resourceName := "aws_fsx_ontap_file_system.test"
@@ -151,12 +154,12 @@ func TestAccFSxOntapFileSystem_endpointIPAddressRange(t *testing.T) {
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
 		ErrorCheck:               acctest.ErrorCheck(t, fsx.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckOntapFileSystemDestroy(ctx),
+		CheckDestroy:             testAccCheckONTAPFileSystemDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccONTAPFileSystemConfig_endpointIPAddressRange(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOntapFileSystemExists(ctx, resourceName, &filesystem),
+					testAccCheckONTAPFileSystemExists(ctx, resourceName, &filesystem),
 					resource.TestCheckResourceAttr(resourceName, "endpoint_ip_address_range", "198.19.255.0/24"),
 				),
 			},
@@ -170,7 +173,7 @@ func TestAccFSxOntapFileSystem_endpointIPAddressRange(t *testing.T) {
 	})
 }
 
-func TestAccFSxOntapFileSystem_diskIops(t *testing.T) {
+func TestAccFSxONTAPFileSystem_diskIOPS(t *testing.T) {
 	ctx := acctest.Context(t)
 	var filesystem fsx.FileSystem
 	resourceName := "aws_fsx_ontap_file_system.test"
@@ -180,12 +183,12 @@ func TestAccFSxOntapFileSystem_diskIops(t *testing.T) {
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
 		ErrorCheck:               acctest.ErrorCheck(t, fsx.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckOntapFileSystemDestroy(ctx),
+		CheckDestroy:             testAccCheckONTAPFileSystemDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccONTAPFileSystemConfig_diskIOPSConfiguration(rName, 3072),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOntapFileSystemExists(ctx, resourceName, &filesystem),
+					testAccCheckONTAPFileSystemExists(ctx, resourceName, &filesystem),
 					resource.TestCheckResourceAttr(resourceName, "disk_iops_configuration.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "disk_iops_configuration.0.mode", "USER_PROVISIONED"),
 					resource.TestCheckResourceAttr(resourceName, "disk_iops_configuration.0.iops", "3072"),
@@ -200,7 +203,7 @@ func TestAccFSxOntapFileSystem_diskIops(t *testing.T) {
 			{
 				Config: testAccONTAPFileSystemConfig_diskIOPSConfiguration(rName, 4000),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOntapFileSystemExists(ctx, resourceName, &filesystem),
+					testAccCheckONTAPFileSystemExists(ctx, resourceName, &filesystem),
 					resource.TestCheckResourceAttr(resourceName, "disk_iops_configuration.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "disk_iops_configuration.0.mode", "USER_PROVISIONED"),
 					resource.TestCheckResourceAttr(resourceName, "disk_iops_configuration.0.iops", "4000"),
@@ -210,7 +213,7 @@ func TestAccFSxOntapFileSystem_diskIops(t *testing.T) {
 	})
 }
 
-func TestAccFSxOntapFileSystem_disappears(t *testing.T) {
+func TestAccFSxONTAPFileSystem_disappears(t *testing.T) {
 	ctx := acctest.Context(t)
 	var filesystem fsx.FileSystem
 	resourceName := "aws_fsx_ontap_file_system.test"
@@ -220,13 +223,13 @@ func TestAccFSxOntapFileSystem_disappears(t *testing.T) {
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
 		ErrorCheck:               acctest.ErrorCheck(t, fsx.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckOntapFileSystemDestroy(ctx),
+		CheckDestroy:             testAccCheckONTAPFileSystemDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccONTAPFileSystemConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOntapFileSystemExists(ctx, resourceName, &filesystem),
-					acctest.CheckResourceDisappears(ctx, acctest.Provider, tffsx.ResourceOntapFileSystem(), resourceName),
+					testAccCheckONTAPFileSystemExists(ctx, resourceName, &filesystem),
+					acctest.CheckResourceDisappears(ctx, acctest.Provider, tffsx.ResourceONTAPFileSystem(), resourceName),
 				),
 				ExpectNonEmptyPlan: true,
 			},
@@ -234,7 +237,7 @@ func TestAccFSxOntapFileSystem_disappears(t *testing.T) {
 	})
 }
 
-func TestAccFSxOntapFileSystem_securityGroupIDs(t *testing.T) {
+func TestAccFSxONTAPFileSystem_securityGroupIDs(t *testing.T) {
 	ctx := acctest.Context(t)
 	var filesystem1, filesystem2 fsx.FileSystem
 	resourceName := "aws_fsx_ontap_file_system.test"
@@ -244,12 +247,12 @@ func TestAccFSxOntapFileSystem_securityGroupIDs(t *testing.T) {
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
 		ErrorCheck:               acctest.ErrorCheck(t, fsx.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckOntapFileSystemDestroy(ctx),
+		CheckDestroy:             testAccCheckONTAPFileSystemDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccONTAPFileSystemConfig_securityGroupIDs1(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOntapFileSystemExists(ctx, resourceName, &filesystem1),
+					testAccCheckONTAPFileSystemExists(ctx, resourceName, &filesystem1),
 					resource.TestCheckResourceAttr(resourceName, "security_group_ids.#", "1"),
 				),
 			},
@@ -262,8 +265,8 @@ func TestAccFSxOntapFileSystem_securityGroupIDs(t *testing.T) {
 			{
 				Config: testAccONTAPFileSystemConfig_securityGroupIDs2(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOntapFileSystemExists(ctx, resourceName, &filesystem2),
-					testAccCheckOntapFileSystemRecreated(&filesystem1, &filesystem2),
+					testAccCheckONTAPFileSystemExists(ctx, resourceName, &filesystem2),
+					testAccCheckONTAPFileSystemRecreated(&filesystem1, &filesystem2),
 					resource.TestCheckResourceAttr(resourceName, "security_group_ids.#", "2"),
 				),
 			},
@@ -271,7 +274,7 @@ func TestAccFSxOntapFileSystem_securityGroupIDs(t *testing.T) {
 	})
 }
 
-func TestAccFSxOntapFileSystem_routeTableIDs(t *testing.T) {
+func TestAccFSxONTAPFileSystem_routeTableIDs(t *testing.T) {
 	ctx := acctest.Context(t)
 	var filesystem1 fsx.FileSystem
 	resourceName := "aws_fsx_ontap_file_system.test"
@@ -281,12 +284,12 @@ func TestAccFSxOntapFileSystem_routeTableIDs(t *testing.T) {
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
 		ErrorCheck:               acctest.ErrorCheck(t, fsx.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckOntapFileSystemDestroy(ctx),
+		CheckDestroy:             testAccCheckONTAPFileSystemDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccONTAPFileSystemConfig_routeTable(rName, 1),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOntapFileSystemExists(ctx, resourceName, &filesystem1),
+					testAccCheckONTAPFileSystemExists(ctx, resourceName, &filesystem1),
 					resource.TestCheckResourceAttr(resourceName, "route_table_ids.#", "1"),
 					resource.TestCheckTypeSetElemAttrPair(resourceName, "route_table_ids.*", "aws_route_table.test.0", "id"),
 				),
@@ -300,7 +303,7 @@ func TestAccFSxOntapFileSystem_routeTableIDs(t *testing.T) {
 			{
 				Config: testAccONTAPFileSystemConfig_routeTable(rName, 2),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOntapFileSystemExists(ctx, resourceName, &filesystem1),
+					testAccCheckONTAPFileSystemExists(ctx, resourceName, &filesystem1),
 					resource.TestCheckResourceAttr(resourceName, "route_table_ids.#", "2"),
 					resource.TestCheckTypeSetElemAttrPair(resourceName, "route_table_ids.*", "aws_route_table.test.0", "id"),
 					resource.TestCheckTypeSetElemAttrPair(resourceName, "route_table_ids.*", "aws_route_table.test.1", "id"),
@@ -309,7 +312,7 @@ func TestAccFSxOntapFileSystem_routeTableIDs(t *testing.T) {
 			{
 				Config: testAccONTAPFileSystemConfig_routeTable(rName, 1),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOntapFileSystemExists(ctx, resourceName, &filesystem1),
+					testAccCheckONTAPFileSystemExists(ctx, resourceName, &filesystem1),
 					resource.TestCheckResourceAttr(resourceName, "route_table_ids.#", "1"),
 					resource.TestCheckTypeSetElemAttrPair(resourceName, "route_table_ids.*", "aws_route_table.test.0", "id"),
 				),
@@ -318,7 +321,7 @@ func TestAccFSxOntapFileSystem_routeTableIDs(t *testing.T) {
 	})
 }
 
-func TestAccFSxOntapFileSystem_tags(t *testing.T) {
+func TestAccFSxONTAPFileSystem_tags(t *testing.T) {
 	ctx := acctest.Context(t)
 	var filesystem1, filesystem2, filesystem3 fsx.FileSystem
 	resourceName := "aws_fsx_ontap_file_system.test"
@@ -328,12 +331,12 @@ func TestAccFSxOntapFileSystem_tags(t *testing.T) {
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
 		ErrorCheck:               acctest.ErrorCheck(t, fsx.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckOntapFileSystemDestroy(ctx),
+		CheckDestroy:             testAccCheckONTAPFileSystemDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccONTAPFileSystemConfig_tags1(rName, "key1", "value1"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOntapFileSystemExists(ctx, resourceName, &filesystem1),
+					testAccCheckONTAPFileSystemExists(ctx, resourceName, &filesystem1),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
 				),
@@ -347,8 +350,8 @@ func TestAccFSxOntapFileSystem_tags(t *testing.T) {
 			{
 				Config: testAccONTAPFileSystemConfig_tags2(rName, "key1", "value1updated", "key2", "value2"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOntapFileSystemExists(ctx, resourceName, &filesystem2),
-					testAccCheckOntapFileSystemNotRecreated(&filesystem1, &filesystem2),
+					testAccCheckONTAPFileSystemExists(ctx, resourceName, &filesystem2),
+					testAccCheckONTAPFileSystemNotRecreated(&filesystem1, &filesystem2),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1updated"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
@@ -357,8 +360,8 @@ func TestAccFSxOntapFileSystem_tags(t *testing.T) {
 			{
 				Config: testAccONTAPFileSystemConfig_tags1(rName, "key2", "value2"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOntapFileSystemExists(ctx, resourceName, &filesystem3),
-					testAccCheckOntapFileSystemNotRecreated(&filesystem2, &filesystem3),
+					testAccCheckONTAPFileSystemExists(ctx, resourceName, &filesystem3),
+					testAccCheckONTAPFileSystemNotRecreated(&filesystem2, &filesystem3),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
 				),
@@ -367,7 +370,7 @@ func TestAccFSxOntapFileSystem_tags(t *testing.T) {
 	})
 }
 
-func TestAccFSxOntapFileSystem_weeklyMaintenanceStartTime(t *testing.T) {
+func TestAccFSxONTAPFileSystem_weeklyMaintenanceStartTime(t *testing.T) {
 	ctx := acctest.Context(t)
 	var filesystem1, filesystem2 fsx.FileSystem
 	resourceName := "aws_fsx_ontap_file_system.test"
@@ -377,12 +380,12 @@ func TestAccFSxOntapFileSystem_weeklyMaintenanceStartTime(t *testing.T) {
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
 		ErrorCheck:               acctest.ErrorCheck(t, fsx.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckOntapFileSystemDestroy(ctx),
+		CheckDestroy:             testAccCheckONTAPFileSystemDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccONTAPFileSystemConfig_weeklyMaintenanceStartTime(rName, "1:01:01"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOntapFileSystemExists(ctx, resourceName, &filesystem1),
+					testAccCheckONTAPFileSystemExists(ctx, resourceName, &filesystem1),
 					resource.TestCheckResourceAttr(resourceName, "weekly_maintenance_start_time", "1:01:01"),
 				),
 			},
@@ -395,8 +398,8 @@ func TestAccFSxOntapFileSystem_weeklyMaintenanceStartTime(t *testing.T) {
 			{
 				Config: testAccONTAPFileSystemConfig_weeklyMaintenanceStartTime(rName, "2:02:02"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOntapFileSystemExists(ctx, resourceName, &filesystem2),
-					testAccCheckOntapFileSystemNotRecreated(&filesystem1, &filesystem2),
+					testAccCheckONTAPFileSystemExists(ctx, resourceName, &filesystem2),
+					testAccCheckONTAPFileSystemNotRecreated(&filesystem1, &filesystem2),
 					resource.TestCheckResourceAttr(resourceName, "weekly_maintenance_start_time", "2:02:02"),
 				),
 			},
@@ -404,7 +407,7 @@ func TestAccFSxOntapFileSystem_weeklyMaintenanceStartTime(t *testing.T) {
 	})
 }
 
-func TestAccFSxOntapFileSystem_automaticBackupRetentionDays(t *testing.T) {
+func TestAccFSxONTAPFileSystem_automaticBackupRetentionDays(t *testing.T) {
 	ctx := acctest.Context(t)
 	var filesystem1, filesystem2 fsx.FileSystem
 	resourceName := "aws_fsx_ontap_file_system.test"
@@ -414,12 +417,12 @@ func TestAccFSxOntapFileSystem_automaticBackupRetentionDays(t *testing.T) {
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
 		ErrorCheck:               acctest.ErrorCheck(t, fsx.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckOntapFileSystemDestroy(ctx),
+		CheckDestroy:             testAccCheckONTAPFileSystemDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccONTAPFileSystemConfig_automaticBackupRetentionDays(rName, 90),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOntapFileSystemExists(ctx, resourceName, &filesystem1),
+					testAccCheckONTAPFileSystemExists(ctx, resourceName, &filesystem1),
 					resource.TestCheckResourceAttr(resourceName, "automatic_backup_retention_days", "90"),
 				),
 			},
@@ -432,15 +435,15 @@ func TestAccFSxOntapFileSystem_automaticBackupRetentionDays(t *testing.T) {
 			{
 				Config: testAccONTAPFileSystemConfig_automaticBackupRetentionDays(rName, 0),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOntapFileSystemExists(ctx, resourceName, &filesystem2),
-					testAccCheckOntapFileSystemNotRecreated(&filesystem1, &filesystem2),
+					testAccCheckONTAPFileSystemExists(ctx, resourceName, &filesystem2),
+					testAccCheckONTAPFileSystemNotRecreated(&filesystem1, &filesystem2),
 					resource.TestCheckResourceAttr(resourceName, "automatic_backup_retention_days", "0"),
 				),
 			},
 			{
 				Config: testAccONTAPFileSystemConfig_automaticBackupRetentionDays(rName, 1),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOntapFileSystemExists(ctx, resourceName, &filesystem1),
+					testAccCheckONTAPFileSystemExists(ctx, resourceName, &filesystem1),
 					resource.TestCheckResourceAttr(resourceName, "automatic_backup_retention_days", "1"),
 				),
 			},
@@ -448,7 +451,7 @@ func TestAccFSxOntapFileSystem_automaticBackupRetentionDays(t *testing.T) {
 	})
 }
 
-func TestAccFSxOntapFileSystem_kmsKeyID(t *testing.T) {
+func TestAccFSxONTAPFileSystem_kmsKeyID(t *testing.T) {
 	ctx := acctest.Context(t)
 	var filesystem fsx.FileSystem
 	resourceName := "aws_fsx_ontap_file_system.test"
@@ -458,12 +461,12 @@ func TestAccFSxOntapFileSystem_kmsKeyID(t *testing.T) {
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
 		ErrorCheck:               acctest.ErrorCheck(t, fsx.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckOntapFileSystemDestroy(ctx),
+		CheckDestroy:             testAccCheckONTAPFileSystemDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccONTAPFileSystemConfig_kmsKeyID(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOntapFileSystemExists(ctx, resourceName, &filesystem),
+					testAccCheckONTAPFileSystemExists(ctx, resourceName, &filesystem),
 					resource.TestCheckResourceAttrPair(resourceName, "kms_key_id", "aws_kms_key.test", "arn"),
 				),
 			},
@@ -477,7 +480,7 @@ func TestAccFSxOntapFileSystem_kmsKeyID(t *testing.T) {
 	})
 }
 
-func TestAccFSxOntapFileSystem_dailyAutomaticBackupStartTime(t *testing.T) {
+func TestAccFSxONTAPFileSystem_dailyAutomaticBackupStartTime(t *testing.T) {
 	ctx := acctest.Context(t)
 	var filesystem1, filesystem2 fsx.FileSystem
 	resourceName := "aws_fsx_ontap_file_system.test"
@@ -492,7 +495,7 @@ func TestAccFSxOntapFileSystem_dailyAutomaticBackupStartTime(t *testing.T) {
 			{
 				Config: testAccONTAPFileSystemConfig_dailyAutomaticBackupStartTime(rName, "01:01"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOntapFileSystemExists(ctx, resourceName, &filesystem1),
+					testAccCheckONTAPFileSystemExists(ctx, resourceName, &filesystem1),
 					resource.TestCheckResourceAttr(resourceName, "daily_automatic_backup_start_time", "01:01"),
 				),
 			},
@@ -505,8 +508,8 @@ func TestAccFSxOntapFileSystem_dailyAutomaticBackupStartTime(t *testing.T) {
 			{
 				Config: testAccONTAPFileSystemConfig_dailyAutomaticBackupStartTime(rName, "02:02"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOntapFileSystemExists(ctx, resourceName, &filesystem2),
-					testAccCheckOntapFileSystemNotRecreated(&filesystem1, &filesystem2),
+					testAccCheckONTAPFileSystemExists(ctx, resourceName, &filesystem2),
+					testAccCheckONTAPFileSystemNotRecreated(&filesystem1, &filesystem2),
 					resource.TestCheckResourceAttr(resourceName, "daily_automatic_backup_start_time", "02:02"),
 				),
 			},
@@ -514,7 +517,7 @@ func TestAccFSxOntapFileSystem_dailyAutomaticBackupStartTime(t *testing.T) {
 	})
 }
 
-func TestAccFSxOntapFileSystem_throughputCapacity(t *testing.T) {
+func TestAccFSxONTAPFileSystem_throughputCapacity(t *testing.T) {
 	ctx := acctest.Context(t)
 	var filesystem1, filesystem2 fsx.FileSystem
 	resourceName := "aws_fsx_ontap_file_system.test"
@@ -524,12 +527,12 @@ func TestAccFSxOntapFileSystem_throughputCapacity(t *testing.T) {
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
 		ErrorCheck:               acctest.ErrorCheck(t, fsx.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckOntapFileSystemDestroy(ctx),
+		CheckDestroy:             testAccCheckONTAPFileSystemDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccONTAPFileSystemConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOntapFileSystemExists(ctx, resourceName, &filesystem1),
+					testAccCheckONTAPFileSystemExists(ctx, resourceName, &filesystem1),
 					resource.TestCheckResourceAttr(resourceName, "throughput_capacity", "128"),
 				),
 			},
@@ -542,8 +545,8 @@ func TestAccFSxOntapFileSystem_throughputCapacity(t *testing.T) {
 			{
 				Config: testAccONTAPFileSystemConfig_throughputCapacity(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOntapFileSystemExists(ctx, resourceName, &filesystem2),
-					testAccCheckOntapFileSystemNotRecreated(&filesystem1, &filesystem2),
+					testAccCheckONTAPFileSystemExists(ctx, resourceName, &filesystem2),
+					testAccCheckONTAPFileSystemNotRecreated(&filesystem1, &filesystem2),
 					resource.TestCheckResourceAttr(resourceName, "throughput_capacity", "256"),
 				),
 			},
@@ -551,7 +554,7 @@ func TestAccFSxOntapFileSystem_throughputCapacity(t *testing.T) {
 	})
 }
 
-func TestAccFSxOntapFileSystem_storageCapacity(t *testing.T) {
+func TestAccFSxONTAPFileSystem_storageCapacity(t *testing.T) {
 	ctx := acctest.Context(t)
 	var filesystem1, filesystem2 fsx.FileSystem
 	resourceName := "aws_fsx_ontap_file_system.test"
@@ -561,12 +564,12 @@ func TestAccFSxOntapFileSystem_storageCapacity(t *testing.T) {
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
 		ErrorCheck:               acctest.ErrorCheck(t, fsx.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckOntapFileSystemDestroy(ctx),
+		CheckDestroy:             testAccCheckONTAPFileSystemDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccONTAPFileSystemConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOntapFileSystemExists(ctx, resourceName, &filesystem1),
+					testAccCheckONTAPFileSystemExists(ctx, resourceName, &filesystem1),
 					resource.TestCheckResourceAttr(resourceName, "storage_capacity", "1024"),
 				),
 			},
@@ -579,8 +582,8 @@ func TestAccFSxOntapFileSystem_storageCapacity(t *testing.T) {
 			{
 				Config: testAccONTAPFileSystemConfig_storageCapacity(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOntapFileSystemExists(ctx, resourceName, &filesystem2),
-					testAccCheckOntapFileSystemNotRecreated(&filesystem1, &filesystem2),
+					testAccCheckONTAPFileSystemExists(ctx, resourceName, &filesystem2),
+					testAccCheckONTAPFileSystemNotRecreated(&filesystem1, &filesystem2),
 					resource.TestCheckResourceAttr(resourceName, "storage_capacity", "2048"),
 				),
 			},
@@ -588,31 +591,28 @@ func TestAccFSxOntapFileSystem_storageCapacity(t *testing.T) {
 	})
 }
 
-func testAccCheckOntapFileSystemExists(ctx context.Context, resourceName string, fs *fsx.FileSystem) resource.TestCheckFunc {
+func testAccCheckONTAPFileSystemExists(ctx context.Context, n string, v *fsx.FileSystem) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		rs, ok := s.RootModule().Resources[resourceName]
+		rs, ok := s.RootModule().Resources[n]
 		if !ok {
-			return fmt.Errorf("Not found: %s", resourceName)
+			return fmt.Errorf("Not found: %s", n)
 		}
 
 		conn := acctest.Provider.Meta().(*conns.AWSClient).FSxConn(ctx)
 
-		filesystem, err := tffsx.FindFileSystemByID(ctx, conn, rs.Primary.ID)
+		output, err := tffsx.FindONTAPFileSystemByID(ctx, conn, rs.Primary.ID)
+
 		if err != nil {
 			return err
 		}
 
-		if filesystem == nil {
-			return fmt.Errorf("FSx ONTAP File System (%s) not found", rs.Primary.ID)
-		}
-
-		*fs = *filesystem
+		*v = *output
 
 		return nil
 	}
 }
 
-func testAccCheckOntapFileSystemDestroy(ctx context.Context) resource.TestCheckFunc {
+func testAccCheckONTAPFileSystemDestroy(ctx context.Context) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		conn := acctest.Provider.Meta().(*conns.AWSClient).FSxConn(ctx)
 
@@ -621,105 +621,83 @@ func testAccCheckOntapFileSystemDestroy(ctx context.Context) resource.TestCheckF
 				continue
 			}
 
-			filesystem, err := tffsx.FindFileSystemByID(ctx, conn, rs.Primary.ID)
+			_, err := tffsx.FindONTAPFileSystemByID(ctx, conn, rs.Primary.ID)
+
 			if tfresource.NotFound(err) {
 				continue
 			}
 
-			if filesystem != nil {
-				return fmt.Errorf("FSx ONTAP File System (%s) still exists", rs.Primary.ID)
+			if err != nil {
+				return err
 			}
+
+			return fmt.Errorf("FSx for NetApp ONTAP File System (%s) still exists", rs.Primary.ID)
 		}
+
 		return nil
 	}
 }
 
-func testAccCheckOntapFileSystemNotRecreated(i, j *fsx.FileSystem) resource.TestCheckFunc {
+func testAccCheckONTAPFileSystemNotRecreated(i, j *fsx.FileSystem) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		if aws.StringValue(i.FileSystemId) != aws.StringValue(j.FileSystemId) {
-			return fmt.Errorf("FSx ONTAP File System (%s) recreated", aws.StringValue(i.FileSystemId))
+			return fmt.Errorf("FSx for NetApp ONTAP File System (%s) recreated", aws.StringValue(i.FileSystemId))
 		}
 
 		return nil
 	}
 }
 
-func testAccCheckOntapFileSystemRecreated(i, j *fsx.FileSystem) resource.TestCheckFunc {
+func testAccCheckONTAPFileSystemRecreated(i, j *fsx.FileSystem) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		if aws.StringValue(i.FileSystemId) == aws.StringValue(j.FileSystemId) {
-			return fmt.Errorf("FSx ONTAP File System (%s) not recreated", aws.StringValue(i.FileSystemId))
+			return fmt.Errorf("FSx for NetApp ONTAP File System (%s) not recreated", aws.StringValue(i.FileSystemId))
 		}
 
 		return nil
 	}
 }
 
-func testAccOntapFileSystemBaseConfig(rName string) string {
-	return acctest.ConfigCompose(acctest.ConfigAvailableAZsNoOptIn(), fmt.Sprintf(`
-data "aws_partition" "current" {}
-
-resource "aws_vpc" "test" {
-  cidr_block = "10.0.0.0/16"
-
-  tags = {
-    Name = %[1]q
-  }
-}
-
-resource "aws_subnet" "test1" {
-  vpc_id            = aws_vpc.test.id
-  cidr_block        = "10.0.1.0/24"
-  availability_zone = data.aws_availability_zones.available.names[0]
-
-  tags = {
-    Name = %[1]q
-  }
-}
-
-resource "aws_subnet" "test2" {
-  vpc_id            = aws_vpc.test.id
-  cidr_block        = "10.0.2.0/24"
-  availability_zone = data.aws_availability_zones.available.names[1]
-
-  tags = {
-    Name = %[1]q
-  }
-}
-`, rName))
+func testAccONTAPFileSystemConfig_base(rName string) string {
+	return acctest.ConfigVPCWithSubnets(rName, 2)
 }
 
 func testAccONTAPFileSystemConfig_basic(rName string) string {
-	return acctest.ConfigCompose(testAccOntapFileSystemBaseConfig(rName), `
+	return acctest.ConfigCompose(testAccONTAPFileSystemConfig_base(rName), `
 resource "aws_fsx_ontap_file_system" "test" {
   storage_capacity    = 1024
-  subnet_ids          = [aws_subnet.test1.id, aws_subnet.test2.id]
+  subnet_ids          = aws_subnet.test[*].id
   deployment_type     = "MULTI_AZ_1"
   throughput_capacity = 128
-  preferred_subnet_id = aws_subnet.test1.id
+  preferred_subnet_id = aws_subnet.test[0].id
 }
 `)
 }
 
-func testAccONTAPFileSystemConfig_singleAz(rName string) string {
-	return acctest.ConfigCompose(testAccOntapFileSystemBaseConfig(rName), `
+func testAccONTAPFileSystemConfig_singleAZ(rName string) string {
+	return acctest.ConfigCompose(testAccONTAPFileSystemConfig_base(rName), fmt.Sprintf(`
 resource "aws_fsx_ontap_file_system" "test" {
   storage_capacity    = 1024
-  subnet_ids          = [aws_subnet.test1.id]
+  subnet_ids          = [aws_subnet.test[0].id]
   deployment_type     = "SINGLE_AZ_1"
   throughput_capacity = 128
-  preferred_subnet_id = aws_subnet.test1.id
+  preferred_subnet_id = aws_subnet.test[0].id
+
+  tags = {
+    Name = %[1]q
+  }
 }
-`)
+`, rName))
 }
 
 func testAccONTAPFileSystemConfig_adminPassword(rName, pass string) string {
-	return acctest.ConfigCompose(testAccOntapFileSystemBaseConfig(rName), fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccONTAPFileSystemConfig_base(rName), fmt.Sprintf(`
 resource "aws_fsx_ontap_file_system" "test" {
   storage_capacity    = 1024
-  subnet_ids          = [aws_subnet.test1.id, aws_subnet.test2.id]
+  subnet_ids          = aws_subnet.test[*].id
   deployment_type     = "MULTI_AZ_1"
   throughput_capacity = 128
-  preferred_subnet_id = aws_subnet.test1.id
+  preferred_subnet_id = aws_subnet.test[0].id
   fsx_admin_password  = %[2]q
 
   tags = {
@@ -730,13 +708,13 @@ resource "aws_fsx_ontap_file_system" "test" {
 }
 
 func testAccONTAPFileSystemConfig_endpointIPAddressRange(rName string) string {
-	return acctest.ConfigCompose(testAccOntapFileSystemBaseConfig(rName), fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccONTAPFileSystemConfig_base(rName), fmt.Sprintf(`
 resource "aws_fsx_ontap_file_system" "test" {
   storage_capacity          = 1024
-  subnet_ids                = [aws_subnet.test1.id, aws_subnet.test2.id]
+  subnet_ids                = aws_subnet.test[*].id
   deployment_type           = "MULTI_AZ_1"
   throughput_capacity       = 128
-  preferred_subnet_id       = aws_subnet.test1.id
+  preferred_subnet_id       = aws_subnet.test[0].id
   endpoint_ip_address_range = "198.19.255.0/24"
 
   tags = {
@@ -747,13 +725,13 @@ resource "aws_fsx_ontap_file_system" "test" {
 }
 
 func testAccONTAPFileSystemConfig_diskIOPSConfiguration(rName string, iops int) string {
-	return acctest.ConfigCompose(testAccOntapFileSystemBaseConfig(rName), fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccONTAPFileSystemConfig_base(rName), fmt.Sprintf(`
 resource "aws_fsx_ontap_file_system" "test" {
   storage_capacity    = 1024
-  subnet_ids          = [aws_subnet.test1.id, aws_subnet.test2.id]
+  subnet_ids          = aws_subnet.test[*].id
   deployment_type     = "MULTI_AZ_1"
   throughput_capacity = 128
-  preferred_subnet_id = aws_subnet.test1.id
+  preferred_subnet_id = aws_subnet.test[0].id
 
   disk_iops_configuration {
     mode = "USER_PROVISIONED"
@@ -768,7 +746,7 @@ resource "aws_fsx_ontap_file_system" "test" {
 }
 
 func testAccONTAPFileSystemConfig_routeTable(rName string, cnt int) string {
-	return acctest.ConfigCompose(testAccOntapFileSystemBaseConfig(rName), fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccONTAPFileSystemConfig_base(rName), fmt.Sprintf(`
 resource "aws_internet_gateway" "test" {
   vpc_id = aws_vpc.test.id
 
@@ -794,10 +772,10 @@ resource "aws_route_table" "test" {
 
 resource "aws_fsx_ontap_file_system" "test" {
   storage_capacity    = 1024
-  subnet_ids          = [aws_subnet.test1.id, aws_subnet.test2.id]
+  subnet_ids          = aws_subnet.test[*].id
   deployment_type     = "MULTI_AZ_1"
   throughput_capacity = 128
-  preferred_subnet_id = aws_subnet.test1.id
+  preferred_subnet_id = aws_subnet.test[0].id
   route_table_ids     = aws_route_table.test[*].id
 
   tags = {
@@ -808,10 +786,10 @@ resource "aws_fsx_ontap_file_system" "test" {
 }
 
 func testAccONTAPFileSystemConfig_securityGroupIDs1(rName string) string {
-	return acctest.ConfigCompose(testAccOntapFileSystemBaseConfig(rName), fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccONTAPFileSystemConfig_base(rName), fmt.Sprintf(`
 resource "aws_security_group" "test1" {
-  description = "security group for FSx testing"
-  vpc_id      = aws_vpc.test.id
+  name   = "%[1]s-1"
+  vpc_id = aws_vpc.test.id
 
   ingress {
     cidr_blocks = [aws_vpc.test.cidr_block]
@@ -835,10 +813,10 @@ resource "aws_security_group" "test1" {
 resource "aws_fsx_ontap_file_system" "test" {
   security_group_ids  = [aws_security_group.test1.id]
   storage_capacity    = 1024
-  subnet_ids          = [aws_subnet.test1.id, aws_subnet.test2.id]
+  subnet_ids          = aws_subnet.test[*].id
   deployment_type     = "MULTI_AZ_1"
   throughput_capacity = 128
-  preferred_subnet_id = aws_subnet.test1.id
+  preferred_subnet_id = aws_subnet.test[0].id
 
   tags = {
     Name = %[1]q
@@ -848,10 +826,10 @@ resource "aws_fsx_ontap_file_system" "test" {
 }
 
 func testAccONTAPFileSystemConfig_securityGroupIDs2(rName string) string {
-	return acctest.ConfigCompose(testAccOntapFileSystemBaseConfig(rName), fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccONTAPFileSystemConfig_base(rName), fmt.Sprintf(`
 resource "aws_security_group" "test1" {
-  description = "security group for FSx testing"
-  vpc_id      = aws_vpc.test.id
+  name   = "%[1]s-1"
+  vpc_id = aws_vpc.test.id
 
   ingress {
     cidr_blocks = [aws_vpc.test.cidr_block]
@@ -873,8 +851,8 @@ resource "aws_security_group" "test1" {
 }
 
 resource "aws_security_group" "test2" {
-  description = "security group for FSx testing"
-  vpc_id      = aws_vpc.test.id
+  name   = "%[1]s-2"
+  vpc_id = aws_vpc.test.id
 
   ingress {
     cidr_blocks = [aws_vpc.test.cidr_block]
@@ -898,10 +876,10 @@ resource "aws_security_group" "test2" {
 resource "aws_fsx_ontap_file_system" "test" {
   security_group_ids  = [aws_security_group.test1.id, aws_security_group.test2.id]
   storage_capacity    = 1024
-  subnet_ids          = [aws_subnet.test1.id, aws_subnet.test2.id]
+  subnet_ids          = aws_subnet.test[*].id
   deployment_type     = "MULTI_AZ_1"
   throughput_capacity = 128
-  preferred_subnet_id = aws_subnet.test1.id
+  preferred_subnet_id = aws_subnet.test[0].id
 
   tags = {
     Name = %[1]q
@@ -911,13 +889,13 @@ resource "aws_fsx_ontap_file_system" "test" {
 }
 
 func testAccONTAPFileSystemConfig_tags1(rName, tagKey1, tagValue1 string) string {
-	return acctest.ConfigCompose(testAccOntapFileSystemBaseConfig(rName), fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccONTAPFileSystemConfig_base(rName), fmt.Sprintf(`
 resource "aws_fsx_ontap_file_system" "test" {
   storage_capacity    = 1024
-  subnet_ids          = [aws_subnet.test1.id, aws_subnet.test2.id]
+  subnet_ids          = aws_subnet.test[*].id
   deployment_type     = "MULTI_AZ_1"
   throughput_capacity = 128
-  preferred_subnet_id = aws_subnet.test1.id
+  preferred_subnet_id = aws_subnet.test[0].id
 
   tags = {
     %[1]q = %[2]q
@@ -927,13 +905,13 @@ resource "aws_fsx_ontap_file_system" "test" {
 }
 
 func testAccONTAPFileSystemConfig_tags2(rName, tagKey1, tagValue1, tagKey2, tagValue2 string) string {
-	return acctest.ConfigCompose(testAccOntapFileSystemBaseConfig(rName), fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccONTAPFileSystemConfig_base(rName), fmt.Sprintf(`
 resource "aws_fsx_ontap_file_system" "test" {
   storage_capacity    = 1024
-  subnet_ids          = [aws_subnet.test1.id, aws_subnet.test2.id]
+  subnet_ids          = aws_subnet.test[*].id
   deployment_type     = "MULTI_AZ_1"
   throughput_capacity = 128
-  preferred_subnet_id = aws_subnet.test1.id
+  preferred_subnet_id = aws_subnet.test[0].id
 
   tags = {
     %[1]q = %[2]q
@@ -944,13 +922,13 @@ resource "aws_fsx_ontap_file_system" "test" {
 }
 
 func testAccONTAPFileSystemConfig_weeklyMaintenanceStartTime(rName, weeklyMaintenanceStartTime string) string {
-	return acctest.ConfigCompose(testAccOntapFileSystemBaseConfig(rName), fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccONTAPFileSystemConfig_base(rName), fmt.Sprintf(`
 resource "aws_fsx_ontap_file_system" "test" {
   storage_capacity              = 1024
-  subnet_ids                    = [aws_subnet.test1.id, aws_subnet.test2.id]
+  subnet_ids                    = aws_subnet.test[*].id
   deployment_type               = "MULTI_AZ_1"
   throughput_capacity           = 128
-  preferred_subnet_id           = aws_subnet.test1.id
+  preferred_subnet_id           = aws_subnet.test[0].id
   weekly_maintenance_start_time = %[2]q
 
   tags = {
@@ -961,13 +939,13 @@ resource "aws_fsx_ontap_file_system" "test" {
 }
 
 func testAccONTAPFileSystemConfig_dailyAutomaticBackupStartTime(rName, dailyAutomaticBackupStartTime string) string {
-	return acctest.ConfigCompose(testAccOntapFileSystemBaseConfig(rName), fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccONTAPFileSystemConfig_base(rName), fmt.Sprintf(`
 resource "aws_fsx_ontap_file_system" "test" {
   storage_capacity                  = 1024
-  subnet_ids                        = [aws_subnet.test1.id, aws_subnet.test2.id]
+  subnet_ids                        = aws_subnet.test[*].id
   deployment_type                   = "MULTI_AZ_1"
   throughput_capacity               = 128
-  preferred_subnet_id               = aws_subnet.test1.id
+  preferred_subnet_id               = aws_subnet.test[0].id
   daily_automatic_backup_start_time = %[2]q
   automatic_backup_retention_days   = 1
 
@@ -979,13 +957,13 @@ resource "aws_fsx_ontap_file_system" "test" {
 }
 
 func testAccONTAPFileSystemConfig_automaticBackupRetentionDays(rName string, retention int) string {
-	return acctest.ConfigCompose(testAccOntapFileSystemBaseConfig(rName), fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccONTAPFileSystemConfig_base(rName), fmt.Sprintf(`
 resource "aws_fsx_ontap_file_system" "test" {
   storage_capacity                = 1024
-  subnet_ids                      = [aws_subnet.test1.id, aws_subnet.test2.id]
+  subnet_ids                      = aws_subnet.test[*].id
   deployment_type                 = "MULTI_AZ_1"
   throughput_capacity             = 128
-  preferred_subnet_id             = aws_subnet.test1.id
+  preferred_subnet_id             = aws_subnet.test[0].id
   automatic_backup_retention_days = %[2]d
 
   tags = {
@@ -996,7 +974,7 @@ resource "aws_fsx_ontap_file_system" "test" {
 }
 
 func testAccONTAPFileSystemConfig_kmsKeyID(rName string) string {
-	return acctest.ConfigCompose(testAccOntapFileSystemBaseConfig(rName), fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccONTAPFileSystemConfig_base(rName), fmt.Sprintf(`
 resource "aws_kms_key" "test" {
   description             = %[1]q
   deletion_window_in_days = 7
@@ -1004,10 +982,10 @@ resource "aws_kms_key" "test" {
 
 resource "aws_fsx_ontap_file_system" "test" {
   storage_capacity    = 1024
-  subnet_ids          = [aws_subnet.test1.id, aws_subnet.test2.id]
+  subnet_ids          = aws_subnet.test[*].id
   deployment_type     = "MULTI_AZ_1"
   throughput_capacity = 128
-  preferred_subnet_id = aws_subnet.test1.id
+  preferred_subnet_id = aws_subnet.test[0].id
   kms_key_id          = aws_kms_key.test.arn
 
   tags = {
@@ -1018,25 +996,33 @@ resource "aws_fsx_ontap_file_system" "test" {
 }
 
 func testAccONTAPFileSystemConfig_throughputCapacity(rName string) string {
-	return acctest.ConfigCompose(testAccOntapFileSystemBaseConfig(rName), `
+	return acctest.ConfigCompose(testAccONTAPFileSystemConfig_base(rName), fmt.Sprintf(`
 resource "aws_fsx_ontap_file_system" "test" {
   storage_capacity    = 1024
-  subnet_ids          = [aws_subnet.test1.id, aws_subnet.test2.id]
+  subnet_ids          = aws_subnet.test[*].id
   deployment_type     = "MULTI_AZ_1"
   throughput_capacity = 256
-  preferred_subnet_id = aws_subnet.test1.id
+  preferred_subnet_id = aws_subnet.test[0].id
+
+  tags = {
+    Name = %[1]q
+  }
 }
-`)
+`, rName))
 }
 
 func testAccONTAPFileSystemConfig_storageCapacity(rName string) string {
-	return acctest.ConfigCompose(testAccOntapFileSystemBaseConfig(rName), `
+	return acctest.ConfigCompose(testAccONTAPFileSystemConfig_base(rName), fmt.Sprintf(`
 resource "aws_fsx_ontap_file_system" "test" {
   storage_capacity    = 2048
-  subnet_ids          = [aws_subnet.test1.id, aws_subnet.test2.id]
+  subnet_ids          = aws_subnet.test[*].id
   deployment_type     = "MULTI_AZ_1"
   throughput_capacity = 128
-  preferred_subnet_id = aws_subnet.test1.id
+  preferred_subnet_id = aws_subnet.test[0].id
+
+  tags = {
+    Name = %[1]q
+  }
 }
-`)
+`, rName))
 }
diff --git a/internal/service/fsx/ontap_storage_virtual_machine.go b/internal/service/fsx/ontap_storage_virtual_machine.go
index b33a3164981..26677d845a4 100644
--- a/internal/service/fsx/ontap_storage_virtual_machine.go
+++ b/internal/service/fsx/ontap_storage_virtual_machine.go
@@ -1,9 +1,12 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package fsx
 
 import (
 	"context"
+	"errors"
 	"log"
-	"strings"
 	"time"
 
 	"github.com/aws/aws-sdk-go/aws"
@@ -11,11 +14,13 @@ import (
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
 	"github.com/hashicorp/terraform-provider-aws/internal/flex"
+	tfslices "github.com/hashicorp/terraform-provider-aws/internal/slices"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
@@ -24,12 +29,13 @@ import (
 
 // @SDKResource("aws_fsx_ontap_storage_virtual_machine", name="ONTAP Storage Virtual Machine")
 // @Tags(identifierAttribute="arn")
-func ResourceOntapStorageVirtualMachine() *schema.Resource {
+func ResourceONTAPStorageVirtualMachine() *schema.Resource {
 	return &schema.Resource{
-		CreateWithoutTimeout: resourceOntapStorageVirtualMachineCreate,
-		ReadWithoutTimeout:   resourceOntapStorageVirtualMachineRead,
-		UpdateWithoutTimeout: resourceOntapStorageVirtualMachineUpdate,
-		DeleteWithoutTimeout: resourceOntapStorageVirtualMachineDelete,
+		CreateWithoutTimeout: resourceONTAPStorageVirtualMachineCreate,
+		ReadWithoutTimeout:   resourceONTAPStorageVirtualMachineRead,
+		UpdateWithoutTimeout: resourceONTAPStorageVirtualMachineUpdate,
+		DeleteWithoutTimeout: resourceONTAPStorageVirtualMachineDelete,
+
 		Importer: &schema.ResourceImporter{
 			StateContext: schema.ImportStatePassthroughContext,
 		},
@@ -43,17 +49,13 @@ func ResourceOntapStorageVirtualMachine() *schema.Resource {
 		SchemaVersion: 1,
 		StateUpgraders: []schema.StateUpgrader{
 			{
-				Type:    ResourceOntapStorageVirtualMachineV0().CoreConfigSchema().ImpliedType(),
-				Upgrade: ResourceOntapStorageVirtualMachineStateUpgradeV0,
+				Type:    ResourceONTAPStorageVirtualMachineV0().CoreConfigSchema().ImpliedType(),
+				Upgrade: ResourceONTAPStorageVirtualMachineStateUpgradeV0,
 				Version: 0,
 			},
 		},
 
 		Schema: map[string]*schema.Schema{
-			"arn": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
 			"active_directory_configuration": {
 				Type:     schema.TypeList,
 				Optional: true,
@@ -61,12 +63,10 @@ func ResourceOntapStorageVirtualMachine() *schema.Resource {
 				Elem: &schema.Resource{
 					Schema: map[string]*schema.Schema{
 						"netbios_name": {
-							Type:     schema.TypeString,
-							Optional: true,
-							DiffSuppressFunc: func(k, old, new string, d *schema.ResourceData) bool {
-								return strings.EqualFold(old, new)
-							},
-							ValidateFunc: validation.StringLenBetween(1, 15),
+							Type:             schema.TypeString,
+							Optional:         true,
+							DiffSuppressFunc: verify.SuppressEquivalentStringCaseInsensitive,
+							ValidateFunc:     validation.StringLenBetween(1, 15),
 						},
 						"self_managed_active_directory_configuration": {
 							Type:     schema.TypeList,
@@ -87,19 +87,16 @@ func ResourceOntapStorageVirtualMachine() *schema.Resource {
 									"domain_name": {
 										Type:         schema.TypeString,
 										Required:     true,
-										ForceNew:     true,
 										ValidateFunc: validation.StringLenBetween(1, 255),
 									},
 									"file_system_administrators_group": {
 										Type:         schema.TypeString,
 										Optional:     true,
-										ForceNew:     true,
 										ValidateFunc: validation.StringLenBetween(1, 256),
 									},
 									"organizational_unit_distinguished_name": {
 										Type:         schema.TypeString,
 										Optional:     true,
-										ForceNew:     true,
 										ValidateFunc: validation.StringLenBetween(1, 2000),
 									},
 									"password": {
@@ -119,6 +116,10 @@ func ResourceOntapStorageVirtualMachine() *schema.Resource {
 					},
 				},
 			},
+			"arn": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
 			"endpoints": {
 				Type:     schema.TypeList,
 				Computed: true,
@@ -198,6 +199,7 @@ func ResourceOntapStorageVirtualMachine() *schema.Resource {
 			"file_system_id": {
 				Type:         schema.TypeString,
 				Required:     true,
+				ForceNew:     true,
 				ValidateFunc: validation.StringLenBetween(11, 21),
 			},
 			"name": {
@@ -234,18 +236,19 @@ func ResourceOntapStorageVirtualMachine() *schema.Resource {
 	}
 }
 
-func resourceOntapStorageVirtualMachineCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+func resourceONTAPStorageVirtualMachineCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).FSxConn(ctx)
 
+	name := d.Get("name").(string)
 	input := &fsx.CreateStorageVirtualMachineInput{
 		FileSystemId: aws.String(d.Get("file_system_id").(string)),
-		Name:         aws.String(d.Get("name").(string)),
+		Name:         aws.String(name),
 		Tags:         getTagsIn(ctx),
 	}
 
 	if v, ok := d.GetOk("active_directory_configuration"); ok {
-		input.ActiveDirectoryConfiguration = expandOntapSvmActiveDirectoryConfigurationCreate(v.([]interface{}))
+		input.ActiveDirectoryConfiguration = expandCreateSvmActiveDirectoryConfiguration(v.([]interface{}))
 	}
 
 	if v, ok := d.GetOk("root_volume_security_style"); ok {
@@ -256,22 +259,22 @@ func resourceOntapStorageVirtualMachineCreate(ctx context.Context, d *schema.Res
 		input.SvmAdminPassword = aws.String(v.(string))
 	}
 
-	result, err := conn.CreateStorageVirtualMachineWithContext(ctx, input)
+	output, err := conn.CreateStorageVirtualMachineWithContext(ctx, input)
 
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "creating FSx Storage Virtual System: %s", err)
+		return sdkdiag.AppendErrorf(diags, "creating FSx ONTAP Storage Virtual Machine (%s): %s", name, err)
 	}
 
-	d.SetId(aws.StringValue(result.StorageVirtualMachine.StorageVirtualMachineId))
+	d.SetId(aws.StringValue(output.StorageVirtualMachine.StorageVirtualMachineId))
 
 	if _, err := waitStorageVirtualMachineCreated(ctx, conn, d.Id(), d.Timeout(schema.TimeoutCreate)); err != nil {
-		return sdkdiag.AppendErrorf(diags, "waiting for FSx Storage Virtual Machine (%s) create: %s", d.Id(), err)
+		return sdkdiag.AppendErrorf(diags, "waiting for FSx ONTAP Storage Virtual Machine (%s) create: %s", d.Id(), err)
 	}
 
-	return append(diags, resourceOntapStorageVirtualMachineRead(ctx, d, meta)...)
+	return append(diags, resourceONTAPStorageVirtualMachineRead(ctx, d, meta)...)
 }
 
-func resourceOntapStorageVirtualMachineRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+func resourceONTAPStorageVirtualMachineRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).FSxConn(ctx)
 
@@ -287,38 +290,36 @@ func resourceOntapStorageVirtualMachineRead(ctx context.Context, d *schema.Resou
 		return sdkdiag.AppendErrorf(diags, "reading FSx ONTAP Storage Virtual Machine (%s): %s", d.Id(), err)
 	}
 
+	if err := d.Set("active_directory_configuration", flattenSvmActiveDirectoryConfiguration(d, storageVirtualMachine.ActiveDirectoryConfiguration)); err != nil {
+		return sdkdiag.AppendErrorf(diags, "setting svm_active_directory: %s", err)
+	}
 	d.Set("arn", storageVirtualMachine.ResourceARN)
-	d.Set("name", storageVirtualMachine.Name)
+	if err := d.Set("endpoints", flattenSvmEndpoints(storageVirtualMachine.Endpoints)); err != nil {
+		return sdkdiag.AppendErrorf(diags, "setting endpoints: %s", err)
+	}
 	d.Set("file_system_id", storageVirtualMachine.FileSystemId)
-	//RootVolumeSecurityStyle and SVMAdminPassword are write only properties so they don't get returned from the describe API so we just store the original setting to state
+	d.Set("name", storageVirtualMachine.Name)
+	// RootVolumeSecurityStyle and SVMAdminPassword are write only properties so they don't get returned from the describe API so we just store the original setting to state
 	d.Set("root_volume_security_style", d.Get("root_volume_security_style").(string))
-	d.Set("svm_admin_password", d.Get("svm_admin_password").(string))
 	d.Set("subtype", storageVirtualMachine.Subtype)
+	d.Set("svm_admin_password", d.Get("svm_admin_password").(string))
 	d.Set("uuid", storageVirtualMachine.UUID)
 
-	if err := d.Set("active_directory_configuration", flattenOntapSvmActiveDirectoryConfiguration(d, storageVirtualMachine.ActiveDirectoryConfiguration)); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting svm_active_directory: %s", err)
-	}
-
-	if err := d.Set("endpoints", flattenOntapStorageVirtualMachineEndpoints(storageVirtualMachine.Endpoints)); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting endpoints: %s", err)
-	}
-
 	return diags
 }
 
-func resourceOntapStorageVirtualMachineUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+func resourceONTAPStorageVirtualMachineUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).FSxConn(ctx)
 
-	if d.HasChangesExcept("tags_all", "tags") {
+	if d.HasChangesExcept("tags", "tags_all") {
 		input := &fsx.UpdateStorageVirtualMachineInput{
 			ClientRequestToken:      aws.String(id.UniqueId()),
 			StorageVirtualMachineId: aws.String(d.Id()),
 		}
 
 		if d.HasChange("active_directory_configuration") {
-			input.ActiveDirectoryConfiguration = expandOntapSvmActiveDirectoryConfigurationUpdate(d.Get("active_directory_configuration").([]interface{}))
+			input.ActiveDirectoryConfiguration = expandUpdateSvmActiveDirectoryConfiguration(d.Get("active_directory_configuration").([]interface{}))
 		}
 
 		if d.HasChange("svm_admin_password") {
@@ -336,10 +337,10 @@ func resourceOntapStorageVirtualMachineUpdate(ctx context.Context, d *schema.Res
 		}
 	}
 
-	return append(diags, resourceOntapStorageVirtualMachineRead(ctx, d, meta)...)
+	return append(diags, resourceONTAPStorageVirtualMachineRead(ctx, d, meta)...)
 }
 
-func resourceOntapStorageVirtualMachineDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+func resourceONTAPStorageVirtualMachineDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).FSxConn(ctx)
 
@@ -363,7 +364,7 @@ func resourceOntapStorageVirtualMachineDelete(ctx context.Context, d *schema.Res
 	return diags
 }
 
-func expandOntapSvmActiveDirectoryConfigurationCreate(cfg []interface{}) *fsx.CreateSvmActiveDirectoryConfiguration {
+func expandCreateSvmActiveDirectoryConfiguration(cfg []interface{}) *fsx.CreateSvmActiveDirectoryConfiguration {
 	if len(cfg) < 1 {
 		return nil
 	}
@@ -377,13 +378,13 @@ func expandOntapSvmActiveDirectoryConfigurationCreate(cfg []interface{}) *fsx.Cr
 	}
 
 	if v, ok := conf["self_managed_active_directory_configuration"].([]interface{}); ok {
-		out.SelfManagedActiveDirectoryConfiguration = expandOntapSvmSelfManagedActiveDirectoryConfiguration(v)
+		out.SelfManagedActiveDirectoryConfiguration = expandSelfManagedActiveDirectoryConfiguration(v)
 	}
 
 	return &out
 }
 
-func expandOntapSvmSelfManagedActiveDirectoryConfiguration(cfg []interface{}) *fsx.SelfManagedActiveDirectoryConfiguration {
+func expandSelfManagedActiveDirectoryConfiguration(cfg []interface{}) *fsx.SelfManagedActiveDirectoryConfiguration {
 	if len(cfg) < 1 {
 		return nil
 	}
@@ -419,7 +420,7 @@ func expandOntapSvmSelfManagedActiveDirectoryConfiguration(cfg []interface{}) *f
 	return &out
 }
 
-func expandOntapSvmActiveDirectoryConfigurationUpdate(cfg []interface{}) *fsx.UpdateSvmActiveDirectoryConfiguration {
+func expandUpdateSvmActiveDirectoryConfiguration(cfg []interface{}) *fsx.UpdateSvmActiveDirectoryConfiguration {
 	if len(cfg) < 1 {
 		return nil
 	}
@@ -428,14 +429,18 @@ func expandOntapSvmActiveDirectoryConfigurationUpdate(cfg []interface{}) *fsx.Up
 
 	out := fsx.UpdateSvmActiveDirectoryConfiguration{}
 
+	if v, ok := conf["netbios_name"].(string); ok && len(v) > 0 {
+		out.NetBiosName = aws.String(v)
+	}
+
 	if v, ok := conf["self_managed_active_directory_configuration"].([]interface{}); ok {
-		out.SelfManagedActiveDirectoryConfiguration = expandOntapSvmSelfManagedActiveDirectoryConfigurationUpdate(v)
+		out.SelfManagedActiveDirectoryConfiguration = expandSelfManagedActiveDirectoryConfigurationUpdates(v)
 	}
 
 	return &out
 }
 
-func expandOntapSvmSelfManagedActiveDirectoryConfigurationUpdate(cfg []interface{}) *fsx.SelfManagedActiveDirectoryConfigurationUpdates {
+func expandSelfManagedActiveDirectoryConfigurationUpdates(cfg []interface{}) *fsx.SelfManagedActiveDirectoryConfigurationUpdates {
 	if len(cfg) < 1 {
 		return nil
 	}
@@ -448,18 +453,30 @@ func expandOntapSvmSelfManagedActiveDirectoryConfigurationUpdate(cfg []interface
 		out.DnsIps = flex.ExpandStringSet(v)
 	}
 
-	if v, ok := conf["password"].(string); ok {
+	if v, ok := conf["domain_name"].(string); ok && len(v) > 0 {
+		out.DomainName = aws.String(v)
+	}
+
+	if v, ok := conf["file_system_administrators_group"].(string); ok && len(v) > 0 {
+		out.FileSystemAdministratorsGroup = aws.String(v)
+	}
+
+	if v, ok := conf["organizational_unit_distinguished_name"].(string); ok && len(v) > 0 {
+		out.OrganizationalUnitDistinguishedName = aws.String(v)
+	}
+
+	if v, ok := conf["password"].(string); ok && len(v) > 0 {
 		out.Password = aws.String(v)
 	}
 
-	if v, ok := conf["username"].(string); ok {
+	if v, ok := conf["username"].(string); ok && len(v) > 0 {
 		out.UserName = aws.String(v)
 	}
 
 	return &out
 }
 
-func flattenOntapSvmActiveDirectoryConfiguration(d *schema.ResourceData, rs *fsx.SvmActiveDirectoryConfiguration) []interface{} {
+func flattenSvmActiveDirectoryConfiguration(d *schema.ResourceData, rs *fsx.SvmActiveDirectoryConfiguration) []interface{} {
 	if rs == nil {
 		return []interface{}{}
 	}
@@ -470,13 +487,13 @@ func flattenOntapSvmActiveDirectoryConfiguration(d *schema.ResourceData, rs *fsx
 	}
 
 	if rs.SelfManagedActiveDirectoryConfiguration != nil {
-		m["self_managed_active_directory_configuration"] = flattenOntapSelfManagedActiveDirectoryConfiguration(d, rs.SelfManagedActiveDirectoryConfiguration)
+		m["self_managed_active_directory_configuration"] = flattenSelfManagedActiveDirectoryAttributes(d, rs.SelfManagedActiveDirectoryConfiguration)
 	}
 
 	return []interface{}{m}
 }
 
-func flattenOntapSelfManagedActiveDirectoryConfiguration(d *schema.ResourceData, rs *fsx.SelfManagedActiveDirectoryAttributes) []interface{} {
+func flattenSelfManagedActiveDirectoryAttributes(d *schema.ResourceData, rs *fsx.SelfManagedActiveDirectoryAttributes) []interface{} {
 	if rs == nil {
 		return []interface{}{}
 	}
@@ -490,10 +507,6 @@ func flattenOntapSelfManagedActiveDirectoryConfiguration(d *schema.ResourceData,
 		m["domain_name"] = aws.StringValue(rs.DomainName)
 	}
 
-	if rs.FileSystemAdministratorsGroup != nil {
-		m["file_system_administrators_group"] = aws.StringValue(rs.FileSystemAdministratorsGroup)
-	}
-
 	if rs.OrganizationalUnitDistinguishedName != nil {
 		if _, ok := d.GetOk("active_directory_configuration.0.self_managed_active_directory_configuration.0.organizational_unit_distinguished_name"); ok {
 			m["organizational_unit_distinguished_name"] = aws.StringValue(rs.OrganizationalUnitDistinguishedName)
@@ -505,37 +518,42 @@ func flattenOntapSelfManagedActiveDirectoryConfiguration(d *schema.ResourceData,
 	}
 
 	// Since we are in a configuration block and the FSx API does not return
-	// the password, we need to set the value if we can or Terraform will
-	// show a difference for the argument from empty string to the value.
+	// the password or file_system_administrators_group, we need to set the values
+	// if we can or Terraform will show a difference for the argument from empty string to the value.
 	// This is not a pattern that should be used normally.
 	// See also: flattenEmrKerberosAttributes
-	m["password"] = d.Get("active_directory_configuration.0.self_managed_active_directory_configuration.0.password").(string)
+	if v, ok := d.GetOk("active_directory_configuration.0.self_managed_active_directory_configuration.0.file_system_administrators_group"); ok {
+		m["file_system_administrators_group"] = v.(string)
+	}
+	if v, ok := d.GetOk("active_directory_configuration.0.self_managed_active_directory_configuration.0.password"); ok {
+		m["password"] = v.(string)
+	}
 
 	return []interface{}{m}
 }
 
-func flattenOntapStorageVirtualMachineEndpoints(rs *fsx.SvmEndpoints) []interface{} {
+func flattenSvmEndpoints(rs *fsx.SvmEndpoints) []interface{} {
 	if rs == nil {
 		return []interface{}{}
 	}
 
 	m := make(map[string]interface{})
 	if rs.Iscsi != nil {
-		m["iscsi"] = flattenOntapStorageVirtualMachineEndpoint(rs.Iscsi)
+		m["iscsi"] = flattenSvmEndpoint(rs.Iscsi)
 	}
 	if rs.Management != nil {
-		m["management"] = flattenOntapStorageVirtualMachineEndpoint(rs.Management)
+		m["management"] = flattenSvmEndpoint(rs.Management)
 	}
 	if rs.Nfs != nil {
-		m["nfs"] = flattenOntapStorageVirtualMachineEndpoint(rs.Nfs)
+		m["nfs"] = flattenSvmEndpoint(rs.Nfs)
 	}
 	if rs.Smb != nil {
-		m["smb"] = flattenOntapStorageVirtualMachineEndpoint(rs.Smb)
+		m["smb"] = flattenSvmEndpoint(rs.Smb)
 	}
 	return []interface{}{m}
 }
 
-func flattenOntapStorageVirtualMachineEndpoint(rs *fsx.SvmEndpoint) []interface{} {
+func flattenSvmEndpoint(rs *fsx.SvmEndpoint) []interface{} {
 	if rs == nil {
 		return []interface{}{}
 	}
@@ -550,3 +568,134 @@ func flattenOntapStorageVirtualMachineEndpoint(rs *fsx.SvmEndpoint) []interface{
 
 	return []interface{}{m}
 }
+
+func FindStorageVirtualMachineByID(ctx context.Context, conn *fsx.FSx, id string) (*fsx.StorageVirtualMachine, error) {
+	input := &fsx.DescribeStorageVirtualMachinesInput{
+		StorageVirtualMachineIds: []*string{aws.String(id)},
+	}
+
+	return findStorageVirtualMachine(ctx, conn, input, tfslices.PredicateTrue[*fsx.StorageVirtualMachine]())
+}
+
+func findStorageVirtualMachine(ctx context.Context, conn *fsx.FSx, input *fsx.DescribeStorageVirtualMachinesInput, filter tfslices.Predicate[*fsx.StorageVirtualMachine]) (*fsx.StorageVirtualMachine, error) {
+	output, err := findStorageVirtualMachines(ctx, conn, input, filter)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return tfresource.AssertSinglePtrResult(output)
+}
+
+func findStorageVirtualMachines(ctx context.Context, conn *fsx.FSx, input *fsx.DescribeStorageVirtualMachinesInput, filter tfslices.Predicate[*fsx.StorageVirtualMachine]) ([]*fsx.StorageVirtualMachine, error) {
+	var output []*fsx.StorageVirtualMachine
+
+	err := conn.DescribeStorageVirtualMachinesPagesWithContext(ctx, input, func(page *fsx.DescribeStorageVirtualMachinesOutput, lastPage bool) bool {
+		if page == nil {
+			return !lastPage
+		}
+
+		for _, v := range page.StorageVirtualMachines {
+			if v != nil && filter(v) {
+				output = append(output, v)
+			}
+		}
+
+		return !lastPage
+	})
+
+	if tfawserr.ErrCodeEquals(err, fsx.ErrCodeStorageVirtualMachineNotFound) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	return output, nil
+}
+
+func statusStorageVirtualMachine(ctx context.Context, conn *fsx.FSx, id string) retry.StateRefreshFunc {
+	return func() (interface{}, string, error) {
+		output, err := FindStorageVirtualMachineByID(ctx, conn, id)
+
+		if tfresource.NotFound(err) {
+			return nil, "", nil
+		}
+
+		if err != nil {
+			return nil, "", err
+		}
+
+		return output, aws.StringValue(output.Lifecycle), nil
+	}
+}
+
+func waitStorageVirtualMachineCreated(ctx context.Context, conn *fsx.FSx, id string, timeout time.Duration) (*fsx.StorageVirtualMachine, error) {
+	stateConf := &retry.StateChangeConf{
+		Pending: []string{fsx.StorageVirtualMachineLifecycleCreating, fsx.StorageVirtualMachineLifecyclePending},
+		Target:  []string{fsx.StorageVirtualMachineLifecycleCreated, fsx.StorageVirtualMachineLifecycleMisconfigured},
+		Refresh: statusStorageVirtualMachine(ctx, conn, id),
+		Timeout: timeout,
+		Delay:   30 * time.Second,
+	}
+
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+
+	if output, ok := outputRaw.(*fsx.StorageVirtualMachine); ok {
+		if reason := output.LifecycleTransitionReason; reason != nil {
+			tfresource.SetLastError(err, errors.New(aws.StringValue(reason.Message)))
+		}
+
+		return output, err
+	}
+
+	return nil, err
+}
+
+func waitStorageVirtualMachineUpdated(ctx context.Context, conn *fsx.FSx, id string, timeout time.Duration) (*fsx.StorageVirtualMachine, error) {
+	stateConf := &retry.StateChangeConf{
+		Pending: []string{fsx.StorageVirtualMachineLifecyclePending},
+		Target:  []string{fsx.StorageVirtualMachineLifecycleCreated, fsx.StorageVirtualMachineLifecycleMisconfigured},
+		Refresh: statusStorageVirtualMachine(ctx, conn, id),
+		Timeout: timeout,
+		Delay:   30 * time.Second,
+	}
+
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+
+	if output, ok := outputRaw.(*fsx.StorageVirtualMachine); ok {
+		if reason := output.LifecycleTransitionReason; reason != nil {
+			tfresource.SetLastError(err, errors.New(aws.StringValue(reason.Message)))
+		}
+
+		return output, err
+	}
+
+	return nil, err
+}
+
+func waitStorageVirtualMachineDeleted(ctx context.Context, conn *fsx.FSx, id string, timeout time.Duration) (*fsx.StorageVirtualMachine, error) {
+	stateConf := &retry.StateChangeConf{
+		Pending: []string{fsx.StorageVirtualMachineLifecycleCreated, fsx.StorageVirtualMachineLifecycleDeleting},
+		Target:  []string{},
+		Refresh: statusStorageVirtualMachine(ctx, conn, id),
+		Timeout: timeout,
+		Delay:   30 * time.Second,
+	}
+
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+
+	if output, ok := outputRaw.(*fsx.StorageVirtualMachine); ok {
+		if reason := output.LifecycleTransitionReason; reason != nil {
+			tfresource.SetLastError(err, errors.New(aws.StringValue(reason.Message)))
+		}
+
+		return output, err
+	}
+
+	return nil, err
+}
diff --git a/internal/service/fsx/ontap_storage_virtual_machine_data_source.go b/internal/service/fsx/ontap_storage_virtual_machine_data_source.go
new file mode 100644
index 00000000000..3fccf025850
--- /dev/null
+++ b/internal/service/fsx/ontap_storage_virtual_machine_data_source.go
@@ -0,0 +1,260 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package fsx
+
+import (
+	"context"
+	"time"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/fsx"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
+	tfslices "github.com/hashicorp/terraform-provider-aws/internal/slices"
+	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
+)
+
+// @SDKDataSource("aws_fsx_ontap_storage_virtual_machine", name="ONTAP Storage Virtual Machine")
+func DataSourceONTAPStorageVirtualMachine() *schema.Resource {
+	return &schema.Resource{
+		ReadWithoutTimeout: dataSourceONTAPStorageVirtualMachineRead,
+
+		Schema: map[string]*schema.Schema{
+			"active_directory_configuration": {
+				Type:     schema.TypeList,
+				Computed: true,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"netbios_name": {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+						"self_managed_active_directory_configuration": {
+							Type:     schema.TypeList,
+							Computed: true,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"dns_ips": {
+										Type:     schema.TypeSet,
+										Computed: true,
+										Elem:     &schema.Schema{Type: schema.TypeString},
+									},
+									"domain_name": {
+										Type:     schema.TypeString,
+										Computed: true,
+									},
+									"file_system_administrators_group": {
+										Type:     schema.TypeString,
+										Computed: true,
+									},
+									"organizational_unit_distinguished_name": {
+										Type:     schema.TypeString,
+										Computed: true,
+									},
+									"username": {
+										Type:     schema.TypeString,
+										Computed: true,
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+			"arn": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"creation_time": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"endpoints": {
+				Type:     schema.TypeList,
+				Computed: true,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"iscsi": {
+							Type:     schema.TypeList,
+							Computed: true,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"dns_name": {
+										Type:     schema.TypeString,
+										Computed: true,
+									},
+									"ip_addresses": {
+										Type:     schema.TypeSet,
+										Computed: true,
+										Elem:     &schema.Schema{Type: schema.TypeString},
+									},
+								},
+							},
+						},
+						"management": {
+							Type:     schema.TypeList,
+							Computed: true,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"dns_name": {
+										Type:     schema.TypeString,
+										Computed: true,
+									},
+									"ip_addresses": {
+										Type:     schema.TypeSet,
+										Computed: true,
+										Elem:     &schema.Schema{Type: schema.TypeString},
+									},
+								},
+							},
+						},
+						"nfs": {
+							Type:     schema.TypeList,
+							Computed: true,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"dns_name": {
+										Type:     schema.TypeString,
+										Computed: true,
+									},
+									"ip_addresses": {
+										Type:     schema.TypeSet,
+										Computed: true,
+										Elem:     &schema.Schema{Type: schema.TypeString},
+									},
+								},
+							},
+						},
+						"smb": {
+							Type:     schema.TypeList,
+							Computed: true,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"dns_name": {
+										Type:     schema.TypeString,
+										Computed: true,
+									},
+									"ip_addresses": {
+										Type:     schema.TypeSet,
+										Computed: true,
+										Elem:     &schema.Schema{Type: schema.TypeString},
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+			"file_system_id": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"filter": DataSourceStorageVirtualMachineFiltersSchema(),
+			"id": {
+				Type:     schema.TypeString,
+				Optional: true,
+				Computed: true,
+			},
+			"lifecycle_status": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"lifecycle_transition_reason": {
+				Type:     schema.TypeSet,
+				Computed: true,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"message": {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+					},
+				},
+			},
+			"name": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"subtype": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"tags": tftags.TagsSchemaComputed(),
+			"uuid": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+		},
+	}
+}
+
+func dataSourceONTAPStorageVirtualMachineRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).FSxConn(ctx)
+	defaultTagsConfig := meta.(*conns.AWSClient).DefaultTagsConfig
+	ignoreTagsConfig := meta.(*conns.AWSClient).IgnoreTagsConfig
+
+	input := &fsx.DescribeStorageVirtualMachinesInput{}
+
+	if id, ok := d.GetOk("id"); ok {
+		input.StorageVirtualMachineIds = []*string{aws.String(id.(string))}
+	}
+
+	input.Filters = BuildStorageVirtualMachineFiltersDataSource(
+		d.Get("filter").(*schema.Set),
+	)
+
+	if len(input.Filters) == 0 {
+		input.Filters = nil
+	}
+
+	svm, err := findStorageVirtualMachine(ctx, conn, input, tfslices.PredicateTrue[*fsx.StorageVirtualMachine]())
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "reading FSx ONTAP Storage Virtual Machine: %s", err)
+	}
+
+	d.SetId(aws.StringValue(svm.StorageVirtualMachineId))
+	if err := d.Set("active_directory_configuration", flattenSvmActiveDirectoryConfiguration(d, svm.ActiveDirectoryConfiguration)); err != nil {
+		return sdkdiag.AppendErrorf(diags, "setting svm_active_directory: %s", err)
+	}
+	d.Set("arn", svm.ResourceARN)
+	d.Set("creation_time", svm.CreationTime.Format(time.RFC3339))
+	if err := d.Set("endpoints", flattenSvmEndpoints(svm.Endpoints)); err != nil {
+		return sdkdiag.AppendErrorf(diags, "setting endpoints: %s", err)
+	}
+	d.Set("file_system_id", svm.FileSystemId)
+	d.Set("lifecycle_status", svm.Lifecycle)
+	if err := d.Set("lifecycle_transition_reason", flattenLifecycleTransitionReason(svm.LifecycleTransitionReason)); err != nil {
+		return sdkdiag.AppendErrorf(diags, "setting lifecycle_transition_reason: %s", err)
+	}
+	d.Set("name", svm.Name)
+	d.Set("subtype", svm.Subtype)
+	d.Set("uuid", svm.UUID)
+
+	tags := KeyValueTags(ctx, svm.Tags).IgnoreAWS().IgnoreConfig(ignoreTagsConfig)
+
+	//lintignore:AWSR002
+	if err := d.Set("tags", tags.RemoveDefaultConfig(defaultTagsConfig).Map()); err != nil {
+		return sdkdiag.AppendErrorf(diags, "setting tags: %s", err)
+	}
+
+	return diags
+}
+
+func flattenLifecycleTransitionReason(rs *fsx.LifecycleTransitionReason) []interface{} {
+	if rs == nil {
+		return []interface{}{}
+	}
+
+	m := make(map[string]interface{})
+
+	if rs.Message != nil {
+		m["message"] = aws.StringValue(rs.Message)
+	}
+
+	return []interface{}{m}
+}
diff --git a/internal/service/fsx/ontap_storage_virtual_machine_data_source_test.go b/internal/service/fsx/ontap_storage_virtual_machine_data_source_test.go
new file mode 100644
index 00000000000..2bb73af2b09
--- /dev/null
+++ b/internal/service/fsx/ontap_storage_virtual_machine_data_source_test.go
@@ -0,0 +1,100 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package fsx_test
+
+import (
+	"testing"
+
+	"github.com/aws/aws-sdk-go/service/fsx"
+	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
+)
+
+func TestAccFSxONTAPStorageVirtualMachineDataSource_Id(t *testing.T) {
+	ctx := acctest.Context(t)
+
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
+	resourceName := "aws_fsx_ontap_storage_virtual_machine.test"
+	dataSourceName := "data.aws_fsx_ontap_storage_virtual_machine.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, fsx.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccONTAPStorageVirtualMachineDataSourceConfig_Id(rName),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttrPair(dataSourceName, "arn", resourceName, "arn"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "active_directory_configuration.#", resourceName, "active_directory_configuration.#"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "endpoints.#", resourceName, "endpoints.#"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "file_system_id", resourceName, "file_system_id"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "id", resourceName, "id"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "name", resourceName, "name"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "subtype", resourceName, "subtype"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "uuid", resourceName, "uuid"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccFSxONTAPStorageVirtualMachineDataSource_Filter(t *testing.T) {
+	ctx := acctest.Context(t)
+
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
+	resourceName := "aws_fsx_ontap_storage_virtual_machine.test"
+	dataSourceName := "data.aws_fsx_ontap_storage_virtual_machine.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, fsx.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccONTAPStorageVirtualMachineDataSourceConfig_Filter(rName),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttrPair(dataSourceName, "arn", resourceName, "arn"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "active_directory_configuration.#", resourceName, "active_directory_configuration.#"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "endpoints.#", resourceName, "endpoints.#"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "file_system_id", resourceName, "file_system_id"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "id", resourceName, "id"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "name", resourceName, "name"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "subtype", resourceName, "subtype"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "uuid", resourceName, "uuid"),
+				),
+			},
+		},
+	})
+}
+
+func testAccONTAPStorageVirtualMachineDataSourceConfig_Id(rName string) string {
+	return acctest.ConfigCompose(testAccONTAPStorageVirtualMachineConfig_basic(rName), `
+data "aws_fsx_ontap_storage_virtual_machine" "test" {
+  id = aws_fsx_ontap_storage_virtual_machine.test.id
+}
+`)
+}
+
+func testAccONTAPStorageVirtualMachineDataSourceConfig_Filter(rName string) string {
+	return acctest.ConfigCompose(testAccONTAPStorageVirtualMachineConfig_basic(rName), `
+data "aws_fsx_ontap_storage_virtual_machine" "test" {
+  filter {
+    name   = "file-system-id"
+    values = [aws_fsx_ontap_file_system.test.id]
+  }
+
+  depends_on = [aws_fsx_ontap_storage_virtual_machine.test]
+}
+`)
+}
diff --git a/internal/service/fsx/ontap_storage_virtual_machine_migrate.go b/internal/service/fsx/ontap_storage_virtual_machine_migrate.go
index d424d7b4b7d..6df18227843 100644
--- a/internal/service/fsx/ontap_storage_virtual_machine_migrate.go
+++ b/internal/service/fsx/ontap_storage_virtual_machine_migrate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package fsx
 
 import (
@@ -12,7 +15,7 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
-func ResourceOntapStorageVirtualMachineV0() *schema.Resource {
+func ResourceONTAPStorageVirtualMachineV0() *schema.Resource {
 	return &schema.Resource{
 		SchemaVersion: 0,
 		Schema: map[string]*schema.Schema{
@@ -207,7 +210,7 @@ func ResourceOntapStorageVirtualMachineV0() *schema.Resource {
 	}
 }
 
-func ResourceOntapStorageVirtualMachineStateUpgradeV0(_ context.Context, rawState map[string]interface{}, meta interface{}) (map[string]interface{}, error) {
+func ResourceONTAPStorageVirtualMachineStateUpgradeV0(_ context.Context, rawState map[string]interface{}, meta interface{}) (map[string]interface{}, error) {
 	log.Printf("[DEBUG] Attributes before migration: %#v", rawState)
 
 	rawState["active_directory_configuration.0.self_managed_active_directory_configuration.0.organizational_unit_distinguished_name"] = rawState["active_directory_configuration.0.self_managed_active_directory_configuration.0.organizational_unit_distinguidshed_name"]
diff --git a/internal/service/fsx/ontap_storage_virtual_machine_migrate_test.go b/internal/service/fsx/ontap_storage_virtual_machine_migrate_test.go
index cd8d61b072e..e6056558a57 100644
--- a/internal/service/fsx/ontap_storage_virtual_machine_migrate_test.go
+++ b/internal/service/fsx/ontap_storage_virtual_machine_migrate_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package fsx_test
 
 import (
@@ -26,7 +29,7 @@ func TestOntapStorageVirtualMachineStateUpgradeV0(t *testing.T) {
 	t.Parallel()
 
 	expected := testOntapStorageVirtualMachineStateDataV1()
-	actual, err := tffsx.ResourceOntapStorageVirtualMachineStateUpgradeV0(ctx, testOntapStorageVirtualMachineStateDataV0(), nil)
+	actual, err := tffsx.ResourceONTAPStorageVirtualMachineStateUpgradeV0(ctx, testOntapStorageVirtualMachineStateDataV0(), nil)
 
 	if err != nil {
 		t.Fatalf("error migrating state: %s", err)
diff --git a/internal/service/fsx/ontap_storage_virtual_machine_test.go b/internal/service/fsx/ontap_storage_virtual_machine_test.go
index 3b31c3f8af1..b86c9c9648d 100644
--- a/internal/service/fsx/ontap_storage_virtual_machine_test.go
+++ b/internal/service/fsx/ontap_storage_virtual_machine_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package fsx_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"strings"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/fsx"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -18,7 +21,7 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
-func TestAccFSxOntapStorageVirtualMachine_basic(t *testing.T) {
+func TestAccFSxONTAPStorageVirtualMachine_basic(t *testing.T) {
 	ctx := acctest.Context(t)
 	var storageVirtualMachine fsx.StorageVirtualMachine
 	resourceName := "aws_fsx_ontap_storage_virtual_machine.test"
@@ -28,13 +31,13 @@ func TestAccFSxOntapStorageVirtualMachine_basic(t *testing.T) {
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
 		ErrorCheck:               acctest.ErrorCheck(t, fsx.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckOntapStorageVirtualMachineDestroy(ctx),
+		CheckDestroy:             testAccCheckONTAPStorageVirtualMachineDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccONTAPStorageVirtualMachineConfig_basic(rName),
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOntapStorageVirtualMachineExists(ctx, resourceName, &storageVirtualMachine),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "fsx", regexp.MustCompile(`storage-virtual-machine/fs-.+`)),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckONTAPStorageVirtualMachineExists(ctx, resourceName, &storageVirtualMachine),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "fsx", regexache.MustCompile(`storage-virtual-machine/fs-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "endpoints.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "endpoints.0.iscsi.#", "1"),
 					resource.TestCheckResourceAttrSet(resourceName, "endpoints.0.iscsi.0.dns_name"),
@@ -58,7 +61,7 @@ func TestAccFSxOntapStorageVirtualMachine_basic(t *testing.T) {
 	})
 }
 
-func TestAccFSxOntapStorageVirtualMachine_rootVolumeSecurityStyle(t *testing.T) {
+func TestAccFSxONTAPStorageVirtualMachine_rootVolumeSecurityStyle(t *testing.T) {
 	ctx := acctest.Context(t)
 	var storageVirtualMachine fsx.StorageVirtualMachine
 	resourceName := "aws_fsx_ontap_storage_virtual_machine.test"
@@ -68,13 +71,13 @@ func TestAccFSxOntapStorageVirtualMachine_rootVolumeSecurityStyle(t *testing.T)
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
 		ErrorCheck:               acctest.ErrorCheck(t, fsx.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckOntapStorageVirtualMachineDestroy(ctx),
+		CheckDestroy:             testAccCheckONTAPStorageVirtualMachineDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccONTAPStorageVirtualMachineConfig_rootVolumeSecurityStyle(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOntapStorageVirtualMachineExists(ctx, resourceName, &storageVirtualMachine),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "fsx", regexp.MustCompile(`storage-virtual-machine/fs-.+`)),
+					testAccCheckONTAPStorageVirtualMachineExists(ctx, resourceName, &storageVirtualMachine),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "fsx", regexache.MustCompile(`storage-virtual-machine/fs-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 					resource.TestCheckResourceAttr(resourceName, "endpoints.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "endpoints.0.iscsi.#", "1"),
@@ -96,7 +99,7 @@ func TestAccFSxOntapStorageVirtualMachine_rootVolumeSecurityStyle(t *testing.T)
 	})
 }
 
-func TestAccFSxOntapStorageVirtualMachine_svmAdminPassword(t *testing.T) {
+func TestAccFSxONTAPStorageVirtualMachine_svmAdminPassword(t *testing.T) {
 	ctx := acctest.Context(t)
 	var storageVirtualMachine1, storageVirtualMachine2 fsx.StorageVirtualMachine
 	resourceName := "aws_fsx_ontap_storage_virtual_machine.test"
@@ -108,12 +111,12 @@ func TestAccFSxOntapStorageVirtualMachine_svmAdminPassword(t *testing.T) {
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
 		ErrorCheck:               acctest.ErrorCheck(t, fsx.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckOntapStorageVirtualMachineDestroy(ctx),
+		CheckDestroy:             testAccCheckONTAPStorageVirtualMachineDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccONTAPStorageVirtualMachineConfig_svmAdminPassword(rName, pass1),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOntapStorageVirtualMachineExists(ctx, resourceName, &storageVirtualMachine1),
+					testAccCheckONTAPStorageVirtualMachineExists(ctx, resourceName, &storageVirtualMachine1),
 					resource.TestCheckResourceAttr(resourceName, "svm_admin_password", pass1),
 				),
 			},
@@ -126,8 +129,8 @@ func TestAccFSxOntapStorageVirtualMachine_svmAdminPassword(t *testing.T) {
 			{
 				Config: testAccONTAPStorageVirtualMachineConfig_svmAdminPassword(rName, pass2),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOntapStorageVirtualMachineExists(ctx, resourceName, &storageVirtualMachine2),
-					testAccCheckOntapStorageVirtualMachineNotRecreated(&storageVirtualMachine1, &storageVirtualMachine2),
+					testAccCheckONTAPStorageVirtualMachineExists(ctx, resourceName, &storageVirtualMachine2),
+					testAccCheckONTAPStorageVirtualMachineNotRecreated(&storageVirtualMachine1, &storageVirtualMachine2),
 					resource.TestCheckResourceAttr(resourceName, "svm_admin_password", pass2),
 				),
 			},
@@ -135,7 +138,7 @@ func TestAccFSxOntapStorageVirtualMachine_svmAdminPassword(t *testing.T) {
 	})
 }
 
-func TestAccFSxOntapStorageVirtualMachine_disappears(t *testing.T) {
+func TestAccFSxONTAPStorageVirtualMachine_disappears(t *testing.T) {
 	ctx := acctest.Context(t)
 	var storageVirtualMachine fsx.StorageVirtualMachine
 	resourceName := "aws_fsx_ontap_storage_virtual_machine.test"
@@ -145,13 +148,13 @@ func TestAccFSxOntapStorageVirtualMachine_disappears(t *testing.T) {
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
 		ErrorCheck:               acctest.ErrorCheck(t, fsx.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckOntapStorageVirtualMachineDestroy(ctx),
+		CheckDestroy:             testAccCheckONTAPStorageVirtualMachineDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccONTAPStorageVirtualMachineConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOntapStorageVirtualMachineExists(ctx, resourceName, &storageVirtualMachine),
-					acctest.CheckResourceDisappears(ctx, acctest.Provider, tffsx.ResourceOntapStorageVirtualMachine(), resourceName),
+					testAccCheckONTAPStorageVirtualMachineExists(ctx, resourceName, &storageVirtualMachine),
+					acctest.CheckResourceDisappears(ctx, acctest.Provider, tffsx.ResourceONTAPStorageVirtualMachine(), resourceName),
 				),
 				ExpectNonEmptyPlan: true,
 			},
@@ -159,7 +162,7 @@ func TestAccFSxOntapStorageVirtualMachine_disappears(t *testing.T) {
 	})
 }
 
-func TestAccFSxOntapStorageVirtualMachine_name(t *testing.T) {
+func TestAccFSxONTAPStorageVirtualMachine_name(t *testing.T) {
 	ctx := acctest.Context(t)
 	var storageVirtualMachine1, storageVirtualMachine2 fsx.StorageVirtualMachine
 	resourceName := "aws_fsx_ontap_storage_virtual_machine.test"
@@ -170,12 +173,12 @@ func TestAccFSxOntapStorageVirtualMachine_name(t *testing.T) {
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
 		ErrorCheck:               acctest.ErrorCheck(t, fsx.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckOntapStorageVirtualMachineDestroy(ctx),
+		CheckDestroy:             testAccCheckONTAPStorageVirtualMachineDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccONTAPStorageVirtualMachineConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOntapStorageVirtualMachineExists(ctx, resourceName, &storageVirtualMachine1),
+					testAccCheckONTAPStorageVirtualMachineExists(ctx, resourceName, &storageVirtualMachine1),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 				),
 			},
@@ -187,8 +190,8 @@ func TestAccFSxOntapStorageVirtualMachine_name(t *testing.T) {
 			{
 				Config: testAccONTAPStorageVirtualMachineConfig_basic(rName2),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOntapStorageVirtualMachineExists(ctx, resourceName, &storageVirtualMachine2),
-					testAccCheckOntapStorageVirtualMachineRecreated(&storageVirtualMachine1, &storageVirtualMachine2),
+					testAccCheckONTAPStorageVirtualMachineExists(ctx, resourceName, &storageVirtualMachine2),
+					testAccCheckONTAPStorageVirtualMachineRecreated(&storageVirtualMachine1, &storageVirtualMachine2),
 					resource.TestCheckResourceAttr(resourceName, "name", rName2),
 				),
 			},
@@ -196,7 +199,7 @@ func TestAccFSxOntapStorageVirtualMachine_name(t *testing.T) {
 	})
 }
 
-func TestAccFSxOntapStorageVirtualMachine_tags(t *testing.T) {
+func TestAccFSxONTAPStorageVirtualMachine_tags(t *testing.T) {
 	ctx := acctest.Context(t)
 	var storageVirtualMachine1, storageVirtualMachine2, storageVirtualMachine3 fsx.StorageVirtualMachine
 	resourceName := "aws_fsx_ontap_storage_virtual_machine.test"
@@ -206,12 +209,12 @@ func TestAccFSxOntapStorageVirtualMachine_tags(t *testing.T) {
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
 		ErrorCheck:               acctest.ErrorCheck(t, fsx.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckOntapStorageVirtualMachineDestroy(ctx),
+		CheckDestroy:             testAccCheckONTAPStorageVirtualMachineDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccONTAPStorageVirtualMachineConfig_tags1(rName, "key1", "value1"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOntapStorageVirtualMachineExists(ctx, resourceName, &storageVirtualMachine1),
+					testAccCheckONTAPStorageVirtualMachineExists(ctx, resourceName, &storageVirtualMachine1),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
 				),
@@ -224,8 +227,8 @@ func TestAccFSxOntapStorageVirtualMachine_tags(t *testing.T) {
 			{
 				Config: testAccONTAPStorageVirtualMachineConfig_tags2(rName, "key1", "value1updated", "key2", "value2"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOntapStorageVirtualMachineExists(ctx, resourceName, &storageVirtualMachine2),
-					testAccCheckOntapStorageVirtualMachineNotRecreated(&storageVirtualMachine1, &storageVirtualMachine2),
+					testAccCheckONTAPStorageVirtualMachineExists(ctx, resourceName, &storageVirtualMachine2),
+					testAccCheckONTAPStorageVirtualMachineNotRecreated(&storageVirtualMachine1, &storageVirtualMachine2),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1updated"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
@@ -234,8 +237,8 @@ func TestAccFSxOntapStorageVirtualMachine_tags(t *testing.T) {
 			{
 				Config: testAccONTAPStorageVirtualMachineConfig_tags1(rName, "key2", "value2"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOntapStorageVirtualMachineExists(ctx, resourceName, &storageVirtualMachine3),
-					testAccCheckOntapStorageVirtualMachineNotRecreated(&storageVirtualMachine2, &storageVirtualMachine3),
+					testAccCheckONTAPStorageVirtualMachineExists(ctx, resourceName, &storageVirtualMachine3),
+					testAccCheckONTAPStorageVirtualMachineNotRecreated(&storageVirtualMachine2, &storageVirtualMachine3),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
 				),
@@ -244,33 +247,35 @@ func TestAccFSxOntapStorageVirtualMachine_tags(t *testing.T) {
 	})
 }
 
-func TestAccFSxOntapStorageVirtualMachine_activeDirectory(t *testing.T) {
+func TestAccFSxONTAPStorageVirtualMachine_activeDirectoryCreate(t *testing.T) {
 	ctx := acctest.Context(t)
-	var storageVirtualMachine1 fsx.StorageVirtualMachine
+	var storageVirtualMachine fsx.StorageVirtualMachine
 	resourceName := "aws_fsx_ontap_storage_virtual_machine.test"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	netBiosName := "tftest-" + sdkacctest.RandString(7)
-	domainNetbiosName := "tftestcorp"
-	domainName := "tftestcorp.local"
-	domainPassword1 := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	domainNetbiosName := "tftest" + sdkacctest.RandString(4)
+	domainName := domainNetbiosName + ".local"
+	domainPassword := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
 		ErrorCheck:               acctest.ErrorCheck(t, fsx.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckOntapStorageVirtualMachineDestroy(ctx),
+		CheckDestroy:             testAccCheckONTAPStorageVirtualMachineDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccONTAPStorageVirtualMachineConfig_virutalSelfManagedActiveDirectory(rName, netBiosName, domainNetbiosName, domainName, domainPassword1),
+				Config: testAccONTAPStorageVirtualMachineConfig_selfManagedActiveDirectory(rName, netBiosName, domainNetbiosName, domainName, domainPassword),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOntapStorageVirtualMachineExists(ctx, resourceName, &storageVirtualMachine1),
+					testAccCheckONTAPStorageVirtualMachineExists(ctx, resourceName, &storageVirtualMachine),
 					resource.TestCheckResourceAttr(resourceName, "active_directory_configuration.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "active_directory_configuration.0.netbios_name", strings.ToUpper(netBiosName)),
 					resource.TestCheckResourceAttr(resourceName, "active_directory_configuration.0.self_managed_active_directory_configuration.0.domain_name", domainName),
+					resource.TestCheckResourceAttr(resourceName, "active_directory_configuration.0.self_managed_active_directory_configuration.0.file_system_administrators_group", "Admins"),
+					resource.TestCheckResourceAttr(resourceName, "active_directory_configuration.0.self_managed_active_directory_configuration.0.organizational_unit_distinguished_name", fmt.Sprintf("OU=computers,OU=%s", domainNetbiosName)),
+					resource.TestCheckResourceAttr(resourceName, "active_directory_configuration.0.self_managed_active_directory_configuration.0.password", domainPassword),
+					resource.TestCheckResourceAttr(resourceName, "active_directory_configuration.0.self_managed_active_directory_configuration.0.username", "Admin"),
 					resource.TestCheckResourceAttr(resourceName, "endpoints.0.smb.#", "1"),
 					resource.TestCheckResourceAttrSet(resourceName, "endpoints.0.smb.0.dns_name"),
-					resource.TestCheckResourceAttr(resourceName, "active_directory_configuration.0.self_managed_active_directory_configuration.0.organizational_unit_distinguished_name", fmt.Sprintf("OU=computers,OU=%s", domainNetbiosName)),
-					resource.TestCheckResourceAttr(resourceName, "active_directory_configuration.0.self_managed_active_directory_configuration.0.password", domainPassword1),
 				),
 			},
 			{
@@ -285,31 +290,69 @@ func TestAccFSxOntapStorageVirtualMachine_activeDirectory(t *testing.T) {
 	})
 }
 
-func testAccCheckOntapStorageVirtualMachineExists(ctx context.Context, resourceName string, svm *fsx.StorageVirtualMachine) resource.TestCheckFunc {
+func TestAccFSxONTAPStorageVirtualMachine_activeDirectoryJoin(t *testing.T) {
+	ctx := acctest.Context(t)
+	var storageVirtualMachine1, storageVirtualMachine2 fsx.StorageVirtualMachine
+	resourceName := "aws_fsx_ontap_storage_virtual_machine.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	netBiosName := "tftest-" + sdkacctest.RandString(7)
+	domainNetbiosName := "tftest" + sdkacctest.RandString(4)
+	domainName := domainNetbiosName + ".local"
+	domainPassword := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
+		ErrorCheck:               acctest.ErrorCheck(t, fsx.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckONTAPStorageVirtualMachineDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccONTAPStorageVirtualMachineConfig_basic(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckONTAPStorageVirtualMachineExists(ctx, resourceName, &storageVirtualMachine1),
+					resource.TestCheckResourceAttr(resourceName, "active_directory_configuration.#", "0"),
+				),
+			},
+			{
+				Config: testAccONTAPStorageVirtualMachineConfig_selfManagedActiveDirectory(rName, netBiosName, domainNetbiosName, domainName, domainPassword),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckONTAPStorageVirtualMachineExists(ctx, resourceName, &storageVirtualMachine2),
+					testAccCheckONTAPStorageVirtualMachineNotRecreated(&storageVirtualMachine1, &storageVirtualMachine2),
+					resource.TestCheckResourceAttr(resourceName, "active_directory_configuration.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "active_directory_configuration.0.netbios_name", netBiosName),
+					resource.TestCheckResourceAttr(resourceName, "active_directory_configuration.0.self_managed_active_directory_configuration.0.domain_name", domainName),
+					resource.TestCheckResourceAttr(resourceName, "active_directory_configuration.0.self_managed_active_directory_configuration.0.file_system_administrators_group", "Admins"),
+					resource.TestCheckResourceAttr(resourceName, "active_directory_configuration.0.self_managed_active_directory_configuration.0.organizational_unit_distinguished_name", fmt.Sprintf("OU=computers,OU=%s", domainNetbiosName)),
+					resource.TestCheckResourceAttr(resourceName, "active_directory_configuration.0.self_managed_active_directory_configuration.0.password", domainPassword),
+					resource.TestCheckResourceAttr(resourceName, "active_directory_configuration.0.self_managed_active_directory_configuration.0.username", "Admin"),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckONTAPStorageVirtualMachineExists(ctx context.Context, n string, v *fsx.StorageVirtualMachine) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		rs, ok := s.RootModule().Resources[resourceName]
+		rs, ok := s.RootModule().Resources[n]
 		if !ok {
-			return fmt.Errorf("Not found: %s", resourceName)
+			return fmt.Errorf("Not found: %s", n)
 		}
 
 		conn := acctest.Provider.Meta().(*conns.AWSClient).FSxConn(ctx)
 
-		storageVirtualMachine, err := tffsx.FindStorageVirtualMachineByID(ctx, conn, rs.Primary.ID)
+		output, err := tffsx.FindStorageVirtualMachineByID(ctx, conn, rs.Primary.ID)
+
 		if err != nil {
 			return err
 		}
 
-		if storageVirtualMachine == nil {
-			return fmt.Errorf("FSx ONTAP Storage Virtual Machine (%s) not found", rs.Primary.ID)
-		}
-
-		*svm = *storageVirtualMachine
+		*v = *output
 
 		return nil
 	}
 }
 
-func testAccCheckOntapStorageVirtualMachineDestroy(ctx context.Context) resource.TestCheckFunc {
+func testAccCheckONTAPStorageVirtualMachineDestroy(ctx context.Context) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		conn := acctest.Provider.Meta().(*conns.AWSClient).FSxConn(ctx)
 
@@ -318,77 +361,47 @@ func testAccCheckOntapStorageVirtualMachineDestroy(ctx context.Context) resource
 				continue
 			}
 
-			storageVirtualMachine, err := tffsx.FindStorageVirtualMachineByID(ctx, conn, rs.Primary.ID)
+			_, err := tffsx.FindStorageVirtualMachineByID(ctx, conn, rs.Primary.ID)
+
 			if tfresource.NotFound(err) {
 				continue
 			}
 
-			if storageVirtualMachine != nil {
-				return fmt.Errorf("FSx ONTAP Storage Virtual Machine (%s) still exists", rs.Primary.ID)
-			}
+			return fmt.Errorf("FSx ONTAP Storage Virtual Machine (%s) still exists", rs.Primary.ID)
 		}
+
 		return nil
 	}
 }
 
-func testAccCheckOntapStorageVirtualMachineNotRecreated(i, j *fsx.StorageVirtualMachine) resource.TestCheckFunc {
+func testAccCheckONTAPStorageVirtualMachineNotRecreated(i, j *fsx.StorageVirtualMachine) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		if aws.StringValue(i.StorageVirtualMachineId) != aws.StringValue(j.StorageVirtualMachineId) {
-			return fmt.Errorf("FSx Storage Virtual Machine (%s) recreated", aws.StringValue(i.StorageVirtualMachineId))
+			return fmt.Errorf("FSx ONTAP Storage Virtual Machine (%s) recreated", aws.StringValue(i.StorageVirtualMachineId))
 		}
 
 		return nil
 	}
 }
 
-func testAccCheckOntapStorageVirtualMachineRecreated(i, j *fsx.StorageVirtualMachine) resource.TestCheckFunc {
+func testAccCheckONTAPStorageVirtualMachineRecreated(i, j *fsx.StorageVirtualMachine) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		if aws.StringValue(i.StorageVirtualMachineId) == aws.StringValue(j.StorageVirtualMachineId) {
-			return fmt.Errorf("FSx Storage Virtual Machine (%s) not recreated", aws.StringValue(i.StorageVirtualMachineId))
+			return fmt.Errorf("FSx ONTAP Storage Virtual Machine (%s) not recreated", aws.StringValue(i.StorageVirtualMachineId))
 		}
 
 		return nil
 	}
 }
 
-func testAccOntapStorageVirtualMachineBaseConfig(rName string) string {
-	return acctest.ConfigCompose(acctest.ConfigAvailableAZsNoOptIn(), fmt.Sprintf(`
-data "aws_partition" "current" {}
-
-resource "aws_vpc" "test" {
-  cidr_block = "10.0.0.0/16"
-
-  tags = {
-    Name = %[1]q
-  }
-}
-
-resource "aws_subnet" "test1" {
-  vpc_id            = aws_vpc.test.id
-  cidr_block        = "10.0.1.0/24"
-  availability_zone = data.aws_availability_zones.available.names[0]
-
-  tags = {
-    Name = %[1]q
-  }
-}
-
-resource "aws_subnet" "test2" {
-  vpc_id            = aws_vpc.test.id
-  cidr_block        = "10.0.2.0/24"
-  availability_zone = data.aws_availability_zones.available.names[1]
-
-  tags = {
-    Name = %[1]q
-  }
-}
-
+func testAccONTAPStorageVirtualMachineConfig_base(rName string) string {
+	return acctest.ConfigCompose(testAccONTAPFileSystemConfig_base(rName), fmt.Sprintf(`
 resource "aws_fsx_ontap_file_system" "test" {
   storage_capacity    = 1024
-  subnet_ids          = [aws_subnet.test1.id, aws_subnet.test2.id]
+  subnet_ids          = aws_subnet.test[*].id
   deployment_type     = "MULTI_AZ_1"
   throughput_capacity = 512
-  preferred_subnet_id = aws_subnet.test1.id
+  preferred_subnet_id = aws_subnet.test[0].id
 
   tags = {
     Name = %[1]q
@@ -397,25 +410,24 @@ resource "aws_fsx_ontap_file_system" "test" {
 `, rName))
 }
 
-func testAccOntapStorageVirtualMachineADConfig(rName string, domainName string, domainPassword string) string {
-	return acctest.ConfigCompose(testAccOntapStorageVirtualMachineBaseConfig(rName), fmt.Sprintf(`
-
+func testAccONTAPStorageVirtualMachineADConfig_base(rName, domainName, domainPassword string) string {
+	return acctest.ConfigCompose(testAccONTAPStorageVirtualMachineConfig_base(rName), fmt.Sprintf(`
 resource "aws_directory_service_directory" "test" {
   edition  = "Standard"
-  name     = %[2]q
-  password = %[3]q
+  name     = %[1]q
+  password = %[2]q
   type     = "MicrosoftAD"
 
   vpc_settings {
-    subnet_ids = [aws_subnet.test1.id, aws_subnet.test2.id]
+    subnet_ids = aws_subnet.test[*].id
     vpc_id     = aws_vpc.test.id
   }
 }
-`, rName, domainName, domainPassword))
+`, domainName, domainPassword))
 }
 
 func testAccONTAPStorageVirtualMachineConfig_basic(rName string) string {
-	return acctest.ConfigCompose(testAccOntapStorageVirtualMachineBaseConfig(rName), fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccONTAPStorageVirtualMachineConfig_base(rName), fmt.Sprintf(`
 resource "aws_fsx_ontap_storage_virtual_machine" "test" {
   file_system_id = aws_fsx_ontap_file_system.test.id
   name           = %[1]q
@@ -424,7 +436,7 @@ resource "aws_fsx_ontap_storage_virtual_machine" "test" {
 }
 
 func testAccONTAPStorageVirtualMachineConfig_rootVolumeSecurityStyle(rName string) string {
-	return acctest.ConfigCompose(testAccOntapStorageVirtualMachineBaseConfig(rName), fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccONTAPStorageVirtualMachineConfig_base(rName), fmt.Sprintf(`
 resource "aws_fsx_ontap_storage_virtual_machine" "test" {
   file_system_id             = aws_fsx_ontap_file_system.test.id
   name                       = %[1]q
@@ -433,8 +445,8 @@ resource "aws_fsx_ontap_storage_virtual_machine" "test" {
 `, rName))
 }
 
-func testAccONTAPStorageVirtualMachineConfig_svmAdminPassword(rName string, pass string) string {
-	return acctest.ConfigCompose(testAccOntapStorageVirtualMachineBaseConfig(rName), fmt.Sprintf(`
+func testAccONTAPStorageVirtualMachineConfig_svmAdminPassword(rName, pass string) string {
+	return acctest.ConfigCompose(testAccONTAPStorageVirtualMachineConfig_base(rName), fmt.Sprintf(`
 resource "aws_fsx_ontap_storage_virtual_machine" "test" {
   file_system_id     = aws_fsx_ontap_file_system.test.id
   name               = %[1]q
@@ -444,7 +456,7 @@ resource "aws_fsx_ontap_storage_virtual_machine" "test" {
 }
 
 func testAccONTAPStorageVirtualMachineConfig_tags1(rName, tagKey1, tagValue1 string) string {
-	return acctest.ConfigCompose(testAccOntapStorageVirtualMachineBaseConfig(rName), fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccONTAPStorageVirtualMachineConfig_base(rName), fmt.Sprintf(`
 resource "aws_fsx_ontap_storage_virtual_machine" "test" {
   file_system_id = aws_fsx_ontap_file_system.test.id
   name           = %[1]q
@@ -457,7 +469,7 @@ resource "aws_fsx_ontap_storage_virtual_machine" "test" {
 }
 
 func testAccONTAPStorageVirtualMachineConfig_tags2(rName, tagKey1, tagValue1, tagKey2, tagValue2 string) string {
-	return acctest.ConfigCompose(testAccOntapStorageVirtualMachineBaseConfig(rName), fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccONTAPStorageVirtualMachineConfig_base(rName), fmt.Sprintf(`
 resource "aws_fsx_ontap_storage_virtual_machine" "test" {
   file_system_id = aws_fsx_ontap_file_system.test.id
   name           = %[1]q
@@ -470,8 +482,8 @@ resource "aws_fsx_ontap_storage_virtual_machine" "test" {
 `, rName, tagKey1, tagValue1, tagKey2, tagValue2))
 }
 
-func testAccONTAPStorageVirtualMachineConfig_virutalSelfManagedActiveDirectory(rName string, netBiosName string, domainNetbiosName string, domainName string, domainPassword string) string {
-	return acctest.ConfigCompose(testAccOntapStorageVirtualMachineADConfig(rName, domainName, domainPassword), fmt.Sprintf(`
+func testAccONTAPStorageVirtualMachineConfig_selfManagedActiveDirectory(rName, netBiosName, domainNetbiosName, domainName, domainPassword string) string {
+	return acctest.ConfigCompose(testAccONTAPStorageVirtualMachineADConfig_base(rName, domainName, domainPassword), fmt.Sprintf(`
 resource "aws_fsx_ontap_storage_virtual_machine" "test" {
   file_system_id = aws_fsx_ontap_file_system.test.id
   name           = %[1]q
@@ -485,6 +497,7 @@ resource "aws_fsx_ontap_storage_virtual_machine" "test" {
       password                               = %[4]q
       username                               = "Admin"
       organizational_unit_distinguished_name = "OU=computers,OU=%[5]s"
+      file_system_administrators_group       = "Admins"
     }
   }
 }
diff --git a/internal/service/fsx/ontap_storage_virtual_machines_data_source.go b/internal/service/fsx/ontap_storage_virtual_machines_data_source.go
new file mode 100644
index 00000000000..6094e66f7b1
--- /dev/null
+++ b/internal/service/fsx/ontap_storage_virtual_machines_data_source.go
@@ -0,0 +1,64 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package fsx
+
+import (
+	"context"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/fsx"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
+	tfslices "github.com/hashicorp/terraform-provider-aws/internal/slices"
+)
+
+// @SDKDataSource("aws_fsx_ontap_storage_virtual_machines", name="ONTAP Storage Virtual Machines")
+func DataSourceONTAPStorageVirtualMachines() *schema.Resource {
+	return &schema.Resource{
+		ReadWithoutTimeout: dataSourceONTAPStorageVirtualMachinesRead,
+
+		Schema: map[string]*schema.Schema{
+			"filter": DataSourceStorageVirtualMachineFiltersSchema(),
+			"ids": {
+				Type:     schema.TypeList,
+				Computed: true,
+				Elem:     &schema.Schema{Type: schema.TypeString},
+			},
+		},
+	}
+}
+
+func dataSourceONTAPStorageVirtualMachinesRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).FSxConn(ctx)
+
+	input := &fsx.DescribeStorageVirtualMachinesInput{}
+
+	input.Filters = BuildStorageVirtualMachineFiltersDataSource(
+		d.Get("filter").(*schema.Set),
+	)
+
+	if len(input.Filters) == 0 {
+		input.Filters = nil
+	}
+
+	svms, err := findStorageVirtualMachines(ctx, conn, input, tfslices.PredicateTrue[*fsx.StorageVirtualMachine]())
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "reading FSx ONTAP Storage Virtual Machines: %s", err)
+	}
+
+	var svmIDs []string
+
+	for _, svm := range svms {
+		svmIDs = append(svmIDs, aws.StringValue(svm.StorageVirtualMachineId))
+	}
+
+	d.SetId(meta.(*conns.AWSClient).Region)
+	d.Set("ids", svmIDs)
+
+	return diags
+}
diff --git a/internal/service/fsx/ontap_storage_virtual_machines_data_source_test.go b/internal/service/fsx/ontap_storage_virtual_machines_data_source_test.go
new file mode 100644
index 00000000000..1d2082310eb
--- /dev/null
+++ b/internal/service/fsx/ontap_storage_virtual_machines_data_source_test.go
@@ -0,0 +1,59 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package fsx_test
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/aws/aws-sdk-go/service/fsx"
+	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
+)
+
+func TestAccFSxONTAPStorageVirtualMachinesDataSource_Filter(t *testing.T) {
+	ctx := acctest.Context(t)
+
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
+	dataSourceName := "data.aws_fsx_ontap_storage_virtual_machines.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, fsx.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccONTAPStorageVirtualMachinesDataSourceConfig_filter(rName),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(dataSourceName, "ids.#", "2"),
+				),
+			},
+		},
+	})
+}
+
+func testAccONTAPStorageVirtualMachinesDataSourceConfig_filter(rName string) string {
+	return acctest.ConfigCompose(testAccONTAPStorageVirtualMachineConfig_base(rName), fmt.Sprintf(`
+resource "aws_fsx_ontap_storage_virtual_machine" "test" {
+  count = 2
+
+  file_system_id = aws_fsx_ontap_file_system.test.id
+  name           = "%[1]s-${count.index}"
+}
+
+data "aws_fsx_ontap_storage_virtual_machines" "test" {
+  filter {
+    name   = "file-system-id"
+    values = [aws_fsx_ontap_file_system.test.id]
+  }
+
+  depends_on = [aws_fsx_ontap_storage_virtual_machine.test]
+}
+`, rName))
+}
diff --git a/internal/service/fsx/ontap_volume.go b/internal/service/fsx/ontap_volume.go
index 553b1e9bb67..6ef01fa1627 100644
--- a/internal/service/fsx/ontap_volume.go
+++ b/internal/service/fsx/ontap_volume.go
@@ -1,7 +1,12 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package fsx
 
 import (
 	"context"
+	"errors"
+	"fmt"
 	"log"
 	"time"
 
@@ -10,10 +15,12 @@ import (
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
+	tfslices "github.com/hashicorp/terraform-provider-aws/internal/slices"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
@@ -22,15 +29,16 @@ import (
 
 // @SDKResource("aws_fsx_ontap_volume", name="ONTAP Volume")
 // @Tags(identifierAttribute="arn")
-func ResourceOntapVolume() *schema.Resource {
+func ResourceONTAPVolume() *schema.Resource {
 	return &schema.Resource{
-		CreateWithoutTimeout: resourceOntapVolumeCreate,
-		ReadWithoutTimeout:   resourceOntapVolumeRead,
-		UpdateWithoutTimeout: resourceOntapVolumeUpdate,
-		DeleteWithoutTimeout: resourceOntapVolumeDelete,
+		CreateWithoutTimeout: resourceONTAPVolumeCreate,
+		ReadWithoutTimeout:   resourceONTAPVolumeRead,
+		UpdateWithoutTimeout: resourceONTAPVolumeUpdate,
+		DeleteWithoutTimeout: resourceONTAPVolumeDelete,
 
 		Importer: &schema.ResourceImporter{
 			StateContext: func(ctx context.Context, d *schema.ResourceData, meta interface{}) ([]*schema.ResourceData, error) {
+				d.Set("bypass_snaplock_enterprise_retention", false)
 				d.Set("skip_final_backup", false)
 
 				return []*schema.ResourceData{d}, nil
@@ -48,6 +56,16 @@ func ResourceOntapVolume() *schema.Resource {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
+			"bypass_snaplock_enterprise_retention": {
+				Type:     schema.TypeBool,
+				Optional: true,
+				Default:  false,
+			},
+			"copy_tags_to_backups": {
+				Type:     schema.TypeBool,
+				Optional: true,
+				Default:  false,
+			},
 			"file_system_id": {
 				Type:     schema.TypeString,
 				Computed: true,
@@ -90,6 +108,139 @@ func ResourceOntapVolume() *schema.Resource {
 				Optional: true,
 				Default:  false,
 			},
+			"snaplock_configuration": {
+				Type:     schema.TypeList,
+				Optional: true,
+				MaxItems: 1,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"audit_log_volume": {
+							Type:     schema.TypeBool,
+							Optional: true,
+							Default:  false,
+						},
+						"autocommit_period": {
+							Type:             schema.TypeList,
+							Optional:         true,
+							Computed:         true,
+							DiffSuppressFunc: verify.SuppressMissingOptionalConfigurationBlock,
+							MaxItems:         1,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"type": {
+										Type:         schema.TypeString,
+										Optional:     true,
+										Computed:     true,
+										ValidateFunc: validation.StringInSlice(fsx.AutocommitPeriodType_Values(), false),
+									},
+									"value": {
+										Type:         schema.TypeInt,
+										Optional:     true,
+										ValidateFunc: validation.IntBetween(1, 65535),
+									},
+								},
+							},
+						},
+						"privileged_delete": {
+							Type:         schema.TypeString,
+							Optional:     true,
+							Default:      fsx.PrivilegedDeleteDisabled,
+							ValidateFunc: validation.StringInSlice(fsx.PrivilegedDelete_Values(), false),
+						},
+						"retention_period": {
+							Type:             schema.TypeList,
+							Optional:         true,
+							Computed:         true,
+							DiffSuppressFunc: verify.SuppressMissingOptionalConfigurationBlock,
+							MaxItems:         1,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"default_retention": {
+										Type:     schema.TypeList,
+										Optional: true,
+										Computed: true,
+										MaxItems: 1,
+										Elem: &schema.Resource{
+											Schema: map[string]*schema.Schema{
+												"type": {
+													Type:         schema.TypeString,
+													Optional:     true,
+													Computed:     true,
+													ValidateFunc: validation.StringInSlice(fsx.RetentionPeriodType_Values(), false),
+												},
+												"value": {
+													Type:         schema.TypeInt,
+													Optional:     true,
+													ValidateFunc: validation.IntBetween(0, 65535),
+												},
+											},
+										},
+									},
+									"maximum_retention": {
+										Type:     schema.TypeList,
+										Optional: true,
+										Computed: true,
+										MaxItems: 1,
+										Elem: &schema.Resource{
+											Schema: map[string]*schema.Schema{
+												"type": {
+													Type:         schema.TypeString,
+													Optional:     true,
+													Computed:     true,
+													ValidateFunc: validation.StringInSlice(fsx.RetentionPeriodType_Values(), false),
+												},
+												"value": {
+													Type:         schema.TypeInt,
+													Optional:     true,
+													ValidateFunc: validation.IntBetween(0, 65535),
+												},
+											},
+										},
+									},
+									"minimum_retention": {
+										Type:     schema.TypeList,
+										Optional: true,
+										Computed: true,
+										MaxItems: 1,
+										Elem: &schema.Resource{
+											Schema: map[string]*schema.Schema{
+												"type": {
+													Type:         schema.TypeString,
+													Optional:     true,
+													Computed:     true,
+													ValidateFunc: validation.StringInSlice(fsx.RetentionPeriodType_Values(), false),
+												},
+												"value": {
+													Type:         schema.TypeInt,
+													Optional:     true,
+													ValidateFunc: validation.IntBetween(0, 65535),
+												},
+											},
+										},
+									},
+								},
+							},
+						},
+						"snaplock_type": {
+							Type:         schema.TypeString,
+							Required:     true,
+							ForceNew:     true,
+							ValidateFunc: validation.StringInSlice(fsx.SnaplockType_Values(), false),
+						},
+						"volume_append_mode_enabled": {
+							Type:     schema.TypeBool,
+							Optional: true,
+							Default:  false,
+						},
+					},
+				},
+			},
+			"snapshot_policy": {
+				Type:         schema.TypeString,
+				Optional:     true,
+				Computed:     true,
+				ValidateFunc: validation.StringLenBetween(1, 255),
+			},
 			"storage_efficiency_enabled": {
 				Type:     schema.TypeBool,
 				Optional: true,
@@ -135,92 +286,117 @@ func ResourceOntapVolume() *schema.Resource {
 				ValidateFunc: validation.StringInSlice(fsx.VolumeType_Values(), false),
 			},
 		},
+
 		CustomizeDiff: verify.SetTagsDiff,
 	}
 }
 
-func resourceOntapVolumeCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+func resourceONTAPVolumeCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).FSxConn(ctx)
 
-	name := d.Get("name").(string)
-	input := &fsx.CreateVolumeInput{
-		Name: aws.String(name),
-		OntapConfiguration: &fsx.CreateOntapVolumeConfiguration{
-			SizeInMegabytes:         aws.Int64(int64(d.Get("size_in_megabytes").(int))),
-			StorageVirtualMachineId: aws.String(d.Get("storage_virtual_machine_id").(string)),
-		},
-		Tags:       getTagsIn(ctx),
-		VolumeType: aws.String(d.Get("volume_type").(string)),
+	ontapConfig := &fsx.CreateOntapVolumeConfiguration{
+		SizeInMegabytes:         aws.Int64(int64(d.Get("size_in_megabytes").(int))),
+		StorageVirtualMachineId: aws.String(d.Get("storage_virtual_machine_id").(string)),
+	}
+
+	if v, ok := d.GetOk("copy_tags_to_backups"); ok {
+		ontapConfig.CopyTagsToBackups = aws.Bool(v.(bool))
 	}
 
 	if v, ok := d.GetOk("junction_path"); ok {
-		input.OntapConfiguration.JunctionPath = aws.String(v.(string))
+		ontapConfig.JunctionPath = aws.String(v.(string))
 	}
 
 	if v, ok := d.GetOk("ontap_volume_type"); ok {
-		input.OntapConfiguration.OntapVolumeType = aws.String(v.(string))
+		ontapConfig.OntapVolumeType = aws.String(v.(string))
 	}
 
 	if v, ok := d.GetOk("security_style"); ok {
-		input.OntapConfiguration.SecurityStyle = aws.String(v.(string))
+		ontapConfig.SecurityStyle = aws.String(v.(string))
+	}
+
+	if v, ok := d.GetOk("snaplock_configuration"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
+		ontapConfig.SnaplockConfiguration = expandCreateSnaplockConfiguration(v.([]interface{})[0].(map[string]interface{}))
+	}
+
+	if v, ok := d.GetOk("snapshot_policy"); ok {
+		ontapConfig.SnapshotPolicy = aws.String(v.(string))
 	}
 
 	if v, ok := d.GetOkExists("storage_efficiency_enabled"); ok {
-		input.OntapConfiguration.StorageEfficiencyEnabled = aws.Bool(v.(bool))
+		ontapConfig.StorageEfficiencyEnabled = aws.Bool(v.(bool))
 	}
 
-	if v, ok := d.GetOk("tiering_policy"); ok {
-		input.OntapConfiguration.TieringPolicy = expandOntapVolumeTieringPolicy(v.([]interface{}))
+	if v, ok := d.GetOk("tiering_policy"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
+		ontapConfig.TieringPolicy = expandTieringPolicy(v.([]interface{})[0].(map[string]interface{}))
 	}
 
-	result, err := conn.CreateVolumeWithContext(ctx, input)
+	name := d.Get("name").(string)
+	input := &fsx.CreateVolumeInput{
+		Name:               aws.String(name),
+		OntapConfiguration: ontapConfig,
+		Tags:               getTagsIn(ctx),
+		VolumeType:         aws.String(d.Get("volume_type").(string)),
+	}
+
+	output, err := conn.CreateVolumeWithContext(ctx, input)
 
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "creating FSx ONTAP Volume (%s): %s", name, err)
+		return sdkdiag.AppendErrorf(diags, "creating FSx for NetApp ONTAP Volume (%s): %s", name, err)
 	}
 
-	d.SetId(aws.StringValue(result.Volume.VolumeId))
+	d.SetId(aws.StringValue(output.Volume.VolumeId))
 
 	if _, err := waitVolumeCreated(ctx, conn, d.Id(), d.Timeout(schema.TimeoutCreate)); err != nil {
-		return sdkdiag.AppendErrorf(diags, "waiting for FSx ONTAP Volume (%s) create: %s", d.Id(), err)
+		return sdkdiag.AppendErrorf(diags, "waiting for FSx for NetApp ONTAP Volume (%s) create: %s", d.Id(), err)
 	}
 
-	return append(diags, resourceOntapVolumeRead(ctx, d, meta)...)
+	return append(diags, resourceONTAPVolumeRead(ctx, d, meta)...)
 }
 
-func resourceOntapVolumeRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+func resourceONTAPVolumeRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).FSxConn(ctx)
 
-	volume, err := FindVolumeByID(ctx, conn, d.Id())
+	volume, err := FindONTAPVolumeByID(ctx, conn, d.Id())
 
 	if !d.IsNewResource() && tfresource.NotFound(err) {
-		log.Printf("[WARN] FSx ONTAP Volume (%s) not found, removing from state", d.Id())
+		log.Printf("[WARN] FSx for NetApp ONTAP Volume (%s) not found, removing from state", d.Id())
 		d.SetId("")
 		return diags
 	}
 
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "reading FSx ONTAP Volume (%s): %s", d.Id(), err)
+		return sdkdiag.AppendErrorf(diags, "reading FSx for NetApp ONTAP Volume (%s): %s", d.Id(), err)
 	}
 
 	ontapConfig := volume.OntapConfiguration
-	if ontapConfig == nil {
-		return sdkdiag.AppendErrorf(diags, "reading FSx ONTAP Volume (%s): empty ONTAP configuration", d.Id())
-	}
 
 	d.Set("arn", volume.ResourceARN)
-	d.Set("name", volume.Name)
+	d.Set("copy_tags_to_backups", ontapConfig.CopyTagsToBackups)
 	d.Set("file_system_id", volume.FileSystemId)
 	d.Set("junction_path", ontapConfig.JunctionPath)
+	d.Set("name", volume.Name)
 	d.Set("ontap_volume_type", ontapConfig.OntapVolumeType)
 	d.Set("security_style", ontapConfig.SecurityStyle)
 	d.Set("size_in_megabytes", ontapConfig.SizeInMegabytes)
+	if ontapConfig.SnaplockConfiguration != nil {
+		if err := d.Set("snaplock_configuration", []interface{}{flattenSnaplockConfiguration(ontapConfig.SnaplockConfiguration)}); err != nil {
+			return diag.Errorf("setting snaplock_configuration: %s", err)
+		}
+	} else {
+		d.Set("snaplock_configuration", nil)
+	}
+	d.Set("snapshot_policy", ontapConfig.SnapshotPolicy)
 	d.Set("storage_efficiency_enabled", ontapConfig.StorageEfficiencyEnabled)
 	d.Set("storage_virtual_machine_id", ontapConfig.StorageVirtualMachineId)
-	if err := d.Set("tiering_policy", flattenOntapVolumeTieringPolicy(ontapConfig.TieringPolicy)); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting tiering_policy: %s", err)
+	if ontapConfig.TieringPolicy != nil {
+		if err := d.Set("tiering_policy", []interface{}{flattenTieringPolicy(ontapConfig.TieringPolicy)}); err != nil {
+			return diag.Errorf("setting tiering_policy: %s", err)
+		}
+	} else {
+		d.Set("tiering_policy", nil)
 	}
 	d.Set("uuid", ontapConfig.UUID)
 	d.Set("volume_type", volume.VolumeType)
@@ -228,59 +404,83 @@ func resourceOntapVolumeRead(ctx context.Context, d *schema.ResourceData, meta i
 	return diags
 }
 
-func resourceOntapVolumeUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+func resourceONTAPVolumeUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).FSxConn(ctx)
 
-	if d.HasChangesExcept("tags_all", "tags") {
-		input := &fsx.UpdateVolumeInput{
-			ClientRequestToken: aws.String(id.UniqueId()),
-			OntapConfiguration: &fsx.UpdateOntapVolumeConfiguration{},
-			VolumeId:           aws.String(d.Id()),
+	if d.HasChangesExcept("tags", "tags_all") {
+		ontapConfig := &fsx.UpdateOntapVolumeConfiguration{}
+
+		if d.HasChange("copy_tags_to_backups") {
+			ontapConfig.CopyTagsToBackups = aws.Bool(d.Get("copy_tags_to_backups").(bool))
 		}
 
 		if d.HasChange("junction_path") {
-			input.OntapConfiguration.JunctionPath = aws.String(d.Get("junction_path").(string))
+			ontapConfig.JunctionPath = aws.String(d.Get("junction_path").(string))
 		}
 
 		if d.HasChange("security_style") {
-			input.OntapConfiguration.SecurityStyle = aws.String(d.Get("security_style").(string))
+			ontapConfig.SecurityStyle = aws.String(d.Get("security_style").(string))
 		}
 
 		if d.HasChange("size_in_megabytes") {
-			input.OntapConfiguration.SizeInMegabytes = aws.Int64(int64(d.Get("size_in_megabytes").(int)))
+			ontapConfig.SizeInMegabytes = aws.Int64(int64(d.Get("size_in_megabytes").(int)))
+		}
+
+		if d.HasChange("snaplock_configuration") {
+			if v, ok := d.GetOk("snaplock_configuration"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
+				ontapConfig.SnaplockConfiguration = expandUpdateSnaplockConfiguration(v.([]interface{})[0].(map[string]interface{}))
+			}
+		}
+
+		if d.HasChange("snapshot_policy") {
+			ontapConfig.SnapshotPolicy = aws.String(d.Get("snapshot_policy").(string))
 		}
 
 		if d.HasChange("storage_efficiency_enabled") {
-			input.OntapConfiguration.StorageEfficiencyEnabled = aws.Bool(d.Get("storage_efficiency_enabled").(bool))
+			ontapConfig.StorageEfficiencyEnabled = aws.Bool(d.Get("storage_efficiency_enabled").(bool))
 		}
 
 		if d.HasChange("tiering_policy") {
-			input.OntapConfiguration.TieringPolicy = expandOntapVolumeTieringPolicy(d.Get("tiering_policy").([]interface{}))
+			if v, ok := d.GetOk("tiering_policy"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
+				ontapConfig.TieringPolicy = expandTieringPolicy(v.([]interface{})[0].(map[string]interface{}))
+			}
 		}
 
+		input := &fsx.UpdateVolumeInput{
+			ClientRequestToken: aws.String(id.UniqueId()),
+			OntapConfiguration: ontapConfig,
+			VolumeId:           aws.String(d.Id()),
+		}
+
+		startTime := time.Now()
 		_, err := conn.UpdateVolumeWithContext(ctx, input)
 
 		if err != nil {
-			return sdkdiag.AppendErrorf(diags, "updating FSx ONTAP Volume (%s): %s", d.Id(), err)
+			return sdkdiag.AppendErrorf(diags, "updating FSx for NetApp ONTAP Volume (%s): %s", d.Id(), err)
+		}
+
+		if _, err := waitVolumeUpdated(ctx, conn, d.Id(), startTime, d.Timeout(schema.TimeoutUpdate)); err != nil {
+			return sdkdiag.AppendErrorf(diags, "waiting for FSx for NetApp ONTAP Volume (%s) update: %s", d.Id(), err)
 		}
 
-		if _, err := waitVolumeUpdated(ctx, conn, d.Id(), d.Timeout(schema.TimeoutUpdate)); err != nil {
-			return sdkdiag.AppendErrorf(diags, "waiting for FSx ONTAP Volume (%s) update: %s", d.Id(), err)
+		if _, err := waitVolumeAdministrativeActionCompleted(ctx, conn, d.Id(), fsx.AdministrativeActionTypeVolumeUpdate, d.Timeout(schema.TimeoutUpdate)); err != nil {
+			return sdkdiag.AppendErrorf(diags, "waiting for FSx for NetApp ONTAP Volume (%s) administrative action (%s) complete: %s", d.Id(), fsx.AdministrativeActionTypeVolumeUpdate, err)
 		}
 	}
 
-	return append(diags, resourceOntapVolumeRead(ctx, d, meta)...)
+	return append(diags, resourceONTAPVolumeRead(ctx, d, meta)...)
 }
 
-func resourceOntapVolumeDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+func resourceONTAPVolumeDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).FSxConn(ctx)
 
-	log.Printf("[DEBUG] Deleting FSx ONTAP Volume: %s", d.Id())
+	log.Printf("[DEBUG] Deleting FSx for NetApp ONTAP Volume: %s", d.Id())
 	_, err := conn.DeleteVolumeWithContext(ctx, &fsx.DeleteVolumeInput{
 		OntapConfiguration: &fsx.DeleteVolumeOntapConfiguration{
-			SkipFinalBackup: aws.Bool(d.Get("skip_final_backup").(bool)),
+			BypassSnaplockEnterpriseRetention: aws.Bool(d.Get("bypass_snaplock_enterprise_retention").(bool)),
+			SkipFinalBackup:                   aws.Bool(d.Get("skip_final_backup").(bool)),
 		},
 		VolumeId: aws.String(d.Id()),
 	})
@@ -290,53 +490,501 @@ func resourceOntapVolumeDelete(ctx context.Context, d *schema.ResourceData, meta
 	}
 
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "deleting FSx ONTAP Volume (%s): %s", d.Id(), err)
+		return sdkdiag.AppendErrorf(diags, "deleting FSx for NetApp ONTAP Volume (%s): %s", d.Id(), err)
 	}
 
 	if _, err := waitVolumeDeleted(ctx, conn, d.Id(), d.Timeout(schema.TimeoutDelete)); err != nil {
-		return sdkdiag.AppendErrorf(diags, "waiting for FSx ONTAP Volume (%s) delete: %s", d.Id(), err)
+		return sdkdiag.AppendErrorf(diags, "waiting for FSx for NetApp ONTAP Volume (%s) delete: %s", d.Id(), err)
 	}
 
 	return diags
 }
 
-func expandOntapVolumeTieringPolicy(cfg []interface{}) *fsx.TieringPolicy {
-	if len(cfg) < 1 {
+const minTieringPolicyCoolingPeriod = 2
+
+func expandTieringPolicy(tfMap map[string]interface{}) *fsx.TieringPolicy {
+	if tfMap == nil {
 		return nil
 	}
 
-	conf := cfg[0].(map[string]interface{})
+	apiObject := &fsx.TieringPolicy{}
 
-	out := fsx.TieringPolicy{}
+	// Cooling period only accepts a minimum of 2 but int will return 0 not nil if unset.
+	// Therefore we only set it if it is 2 or more.
+	if v, ok := tfMap["cooling_period"].(int); ok && v >= minTieringPolicyCoolingPeriod {
+		apiObject.CoolingPeriod = aws.Int64(int64(v))
+	}
 
-	//Cooling period only accepts a minimum of 2 but int will return 0 not nil if unset
-	//Therefore we only set it if it is 2 or more
-	if v, ok := conf["cooling_period"].(int); ok && v >= 2 {
-		out.CoolingPeriod = aws.Int64(int64(v))
+	if v, ok := tfMap["name"].(string); ok && v != "" {
+		apiObject.Name = aws.String(v)
 	}
 
-	if v, ok := conf["name"].(string); ok {
-		out.Name = aws.String(v)
+	return apiObject
+}
+
+func flattenTieringPolicy(apiObject *fsx.TieringPolicy) map[string]interface{} {
+	if apiObject == nil {
+		return nil
 	}
 
-	return &out
+	tfMap := map[string]interface{}{}
+
+	if v := apiObject.CoolingPeriod; v != nil {
+		if v := aws.Int64Value(v); v >= minTieringPolicyCoolingPeriod {
+			tfMap["cooling_period"] = v
+		}
+	}
+
+	if v := apiObject.Name; v != nil {
+		tfMap["name"] = aws.StringValue(v)
+	}
+
+	return tfMap
+}
+
+func expandCreateSnaplockConfiguration(tfMap map[string]interface{}) *fsx.CreateSnaplockConfiguration {
+	if tfMap == nil {
+		return nil
+	}
+
+	apiObject := &fsx.CreateSnaplockConfiguration{}
+
+	if v, ok := tfMap["audit_log_volume"].(bool); ok && v {
+		apiObject.AuditLogVolume = aws.Bool(v)
+	}
+
+	if v, ok := tfMap["autocommit_period"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
+		apiObject.AutocommitPeriod = expandAutocommitPeriod(v[0].(map[string]interface{}))
+	}
+
+	if v, ok := tfMap["privileged_delete"].(string); ok && v != "" {
+		apiObject.PrivilegedDelete = aws.String(v)
+	}
+
+	if v, ok := tfMap["retention_period"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
+		apiObject.RetentionPeriod = expandSnaplockRetentionPeriod(v[0].(map[string]interface{}))
+	}
+
+	if v, ok := tfMap["snaplock_type"].(string); ok && v != "" {
+		apiObject.SnaplockType = aws.String(v)
+	}
+
+	if v, ok := tfMap["volume_append_mode_enabled"].(bool); ok && v {
+		apiObject.VolumeAppendModeEnabled = aws.Bool(v)
+	}
+
+	return apiObject
 }
 
-func flattenOntapVolumeTieringPolicy(rs *fsx.TieringPolicy) []interface{} {
-	if rs == nil {
-		return []interface{}{}
+func expandUpdateSnaplockConfiguration(tfMap map[string]interface{}) *fsx.UpdateSnaplockConfiguration {
+	if tfMap == nil {
+		return nil
+	}
+
+	apiObject := &fsx.UpdateSnaplockConfiguration{}
+
+	if v, ok := tfMap["audit_log_volume"].(bool); ok && v {
+		apiObject.AuditLogVolume = aws.Bool(v)
+	}
+
+	if v, ok := tfMap["autocommit_period"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
+		apiObject.AutocommitPeriod = expandAutocommitPeriod(v[0].(map[string]interface{}))
 	}
 
-	minCoolingPeriod := 2
+	if v, ok := tfMap["privileged_delete"].(string); ok && v != "" {
+		apiObject.PrivilegedDelete = aws.String(v)
+	}
+
+	if v, ok := tfMap["retention_period"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
+		apiObject.RetentionPeriod = expandSnaplockRetentionPeriod(v[0].(map[string]interface{}))
+	}
 
-	m := make(map[string]interface{})
-	if aws.Int64Value(rs.CoolingPeriod) >= int64(minCoolingPeriod) {
-		m["cooling_period"] = aws.Int64Value(rs.CoolingPeriod)
+	if v, ok := tfMap["volume_append_mode_enabled"].(bool); ok && v {
+		apiObject.VolumeAppendModeEnabled = aws.Bool(v)
 	}
 
-	if rs.Name != nil {
-		m["name"] = aws.StringValue(rs.Name)
+	return apiObject
+}
+
+func expandAutocommitPeriod(tfMap map[string]interface{}) *fsx.AutocommitPeriod {
+	if tfMap == nil {
+		return nil
+	}
+
+	apiObject := &fsx.AutocommitPeriod{}
+
+	if v, ok := tfMap["type"].(string); ok && v != "" {
+		apiObject.Type = aws.String(v)
+	}
+
+	if v, ok := tfMap["value"].(int); ok && v != 0 {
+		apiObject.Value = aws.Int64(int64(v))
+	}
+
+	return apiObject
+}
+
+func expandSnaplockRetentionPeriod(tfMap map[string]interface{}) *fsx.SnaplockRetentionPeriod {
+	if tfMap == nil {
+		return nil
+	}
+
+	apiObject := &fsx.SnaplockRetentionPeriod{}
+
+	if v, ok := tfMap["default_retention"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
+		apiObject.DefaultRetention = expandRetentionPeriod(v[0].(map[string]interface{}))
+	}
+
+	if v, ok := tfMap["maximum_retention"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
+		apiObject.MaximumRetention = expandRetentionPeriod(v[0].(map[string]interface{}))
+	}
+
+	if v, ok := tfMap["minimum_retention"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
+		apiObject.MinimumRetention = expandRetentionPeriod(v[0].(map[string]interface{}))
+	}
+
+	return apiObject
+}
+
+func expandRetentionPeriod(tfMap map[string]interface{}) *fsx.RetentionPeriod {
+	if tfMap == nil {
+		return nil
+	}
+
+	apiObject := &fsx.RetentionPeriod{}
+
+	if v, ok := tfMap["type"].(string); ok && v != "" {
+		apiObject.Type = aws.String(v)
+	}
+
+	if v, ok := tfMap["value"].(int); ok && v != 0 {
+		apiObject.Value = aws.Int64(int64(v))
+	}
+
+	return apiObject
+}
+
+func flattenSnaplockConfiguration(apiObject *fsx.SnaplockConfiguration) map[string]interface{} {
+	if apiObject == nil {
+		return nil
+	}
+
+	tfMap := map[string]interface{}{}
+
+	if v := apiObject.AuditLogVolume; v != nil {
+		tfMap["audit_log_volume"] = aws.BoolValue(v)
+	}
+
+	if v := apiObject.AutocommitPeriod; v != nil {
+		tfMap["autocommit_period"] = []interface{}{flattenAutocommitPeriod(v)}
+	}
+
+	if v := apiObject.PrivilegedDelete; v != nil {
+		tfMap["privileged_delete"] = aws.StringValue(v)
+	}
+
+	if v := apiObject.RetentionPeriod; v != nil {
+		tfMap["retention_period"] = []interface{}{flattenSnaplockRetentionPeriod(v)}
+	}
+
+	if v := apiObject.SnaplockType; v != nil {
+		tfMap["snaplock_type"] = aws.StringValue(v)
+	}
+
+	if v := apiObject.VolumeAppendModeEnabled; v != nil {
+		tfMap["volume_append_mode_enabled"] = aws.BoolValue(v)
+	}
+
+	return tfMap
+}
+
+func flattenAutocommitPeriod(apiObject *fsx.AutocommitPeriod) map[string]interface{} {
+	if apiObject == nil {
+		return nil
+	}
+
+	tfMap := map[string]interface{}{}
+
+	if v := apiObject.Type; v != nil {
+		tfMap["type"] = aws.StringValue(v)
+	}
+
+	if v := apiObject.Value; v != nil {
+		tfMap["value"] = aws.Int64Value(v)
+	}
+
+	return tfMap
+}
+
+func flattenSnaplockRetentionPeriod(apiObject *fsx.SnaplockRetentionPeriod) map[string]interface{} {
+	if apiObject == nil {
+		return nil
+	}
+
+	tfMap := map[string]interface{}{}
+
+	if v := apiObject.DefaultRetention; v != nil {
+		tfMap["default_retention"] = []interface{}{flattenRetentionPeriod(v)}
+	}
+
+	if v := apiObject.MaximumRetention; v != nil {
+		tfMap["maximum_retention"] = []interface{}{flattenRetentionPeriod(v)}
+	}
+
+	if v := apiObject.MinimumRetention; v != nil {
+		tfMap["minimum_retention"] = []interface{}{flattenRetentionPeriod(v)}
+	}
+
+	return tfMap
+}
+
+func flattenRetentionPeriod(apiObject *fsx.RetentionPeriod) map[string]interface{} {
+	if apiObject == nil {
+		return nil
+	}
+
+	tfMap := map[string]interface{}{}
+
+	if v := apiObject.Type; v != nil {
+		tfMap["type"] = aws.StringValue(v)
+	}
+
+	if v := apiObject.Value; v != nil {
+		tfMap["value"] = aws.Int64Value(v)
+	}
+
+	return tfMap
+}
+
+func FindONTAPVolumeByID(ctx context.Context, conn *fsx.FSx, id string) (*fsx.Volume, error) {
+	output, err := findVolumeByIDAndType(ctx, conn, id, fsx.VolumeTypeOntap)
+
+	if err != nil {
+		return nil, err
+	}
+
+	if output.OntapConfiguration == nil {
+		return nil, tfresource.NewEmptyResultError(nil)
+	}
+
+	return output, nil
+}
+
+func findVolumeByID(ctx context.Context, conn *fsx.FSx, id string) (*fsx.Volume, error) {
+	input := &fsx.DescribeVolumesInput{
+		VolumeIds: aws.StringSlice([]string{id}),
+	}
+
+	return findVolume(ctx, conn, input, tfslices.PredicateTrue[*fsx.Volume]())
+}
+
+func findVolumeByIDAndType(ctx context.Context, conn *fsx.FSx, volID, volType string) (*fsx.Volume, error) {
+	input := &fsx.DescribeVolumesInput{
+		VolumeIds: aws.StringSlice([]string{volID}),
+	}
+	filter := func(fs *fsx.Volume) bool {
+		return aws.StringValue(fs.VolumeType) == volType
+	}
+
+	return findVolume(ctx, conn, input, filter)
+}
+
+func findVolume(ctx context.Context, conn *fsx.FSx, input *fsx.DescribeVolumesInput, filter tfslices.Predicate[*fsx.Volume]) (*fsx.Volume, error) {
+	output, err := findVolumes(ctx, conn, input, filter)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return tfresource.AssertSinglePtrResult(output)
+}
+
+func findVolumes(ctx context.Context, conn *fsx.FSx, input *fsx.DescribeVolumesInput, filter tfslices.Predicate[*fsx.Volume]) ([]*fsx.Volume, error) {
+	var output []*fsx.Volume
+
+	err := conn.DescribeVolumesPagesWithContext(ctx, input, func(page *fsx.DescribeVolumesOutput, lastPage bool) bool {
+		if page == nil {
+			return !lastPage
+		}
+
+		for _, v := range page.Volumes {
+			if v != nil && filter(v) {
+				output = append(output, v)
+			}
+		}
+
+		return !lastPage
+	})
+
+	if tfawserr.ErrCodeEquals(err, fsx.ErrCodeVolumeNotFound) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	return output, nil
+}
+
+func statusVolume(ctx context.Context, conn *fsx.FSx, id string) retry.StateRefreshFunc {
+	return func() (interface{}, string, error) {
+		output, err := findVolumeByID(ctx, conn, id)
+
+		if tfresource.NotFound(err) {
+			return nil, "", nil
+		}
+
+		if err != nil {
+			return nil, "", err
+		}
+
+		return output, aws.StringValue(output.Lifecycle), nil
+	}
+}
+
+func waitVolumeCreated(ctx context.Context, conn *fsx.FSx, id string, timeout time.Duration) (*fsx.Volume, error) { //nolint:unparam
+	stateConf := &retry.StateChangeConf{
+		Pending: []string{fsx.VolumeLifecycleCreating, fsx.VolumeLifecyclePending},
+		Target:  []string{fsx.VolumeLifecycleCreated, fsx.VolumeLifecycleMisconfigured, fsx.VolumeLifecycleAvailable},
+		Refresh: statusVolume(ctx, conn, id),
+		Timeout: timeout,
+		Delay:   30 * time.Second,
+	}
+
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+
+	if output, ok := outputRaw.(*fsx.Volume); ok {
+		if status, reason := aws.StringValue(output.Lifecycle), output.LifecycleTransitionReason; status == fsx.VolumeLifecycleFailed && reason != nil {
+			tfresource.SetLastError(err, errors.New(aws.StringValue(reason.Message)))
+		}
+
+		return output, err
+	}
+
+	return nil, err
+}
+
+func waitVolumeUpdated(ctx context.Context, conn *fsx.FSx, id string, startTime time.Time, timeout time.Duration) (*fsx.Volume, error) { //nolint:unparam
+	stateConf := &retry.StateChangeConf{
+		Pending: []string{fsx.VolumeLifecyclePending},
+		Target:  []string{fsx.VolumeLifecycleCreated, fsx.VolumeLifecycleMisconfigured, fsx.VolumeLifecycleAvailable},
+		Refresh: statusVolume(ctx, conn, id),
+		Timeout: timeout,
+		Delay:   150 * time.Second,
+	}
+
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+
+	if output, ok := outputRaw.(*fsx.Volume); ok {
+		switch status := aws.StringValue(output.Lifecycle); status {
+		case fsx.VolumeLifecycleFailed:
+			// Report any failed non-VOLUME_UPDATE administrative actions.
+			// See https://docs.aws.amazon.com/fsx/latest/APIReference/API_AdministrativeAction.html#FSx-Type-AdministrativeAction-AdministrativeActionType.
+			administrativeActions := tfslices.Filter(output.AdministrativeActions, func(v *fsx.AdministrativeAction) bool {
+				return v != nil && aws.StringValue(v.Status) == fsx.StatusFailed && aws.StringValue(v.AdministrativeActionType) != fsx.AdministrativeActionTypeVolumeUpdate && v.FailureDetails != nil && startTime.Before(aws.TimeValue(v.RequestTime))
+			})
+			administrativeActionsError := errors.Join(tfslices.ApplyToAll(administrativeActions, func(v *fsx.AdministrativeAction) error {
+				return fmt.Errorf("%s: %s", aws.StringValue(v.AdministrativeActionType), aws.StringValue(v.FailureDetails.Message))
+			})...)
+
+			if reason := output.LifecycleTransitionReason; reason != nil {
+				if message := aws.StringValue(reason.Message); administrativeActionsError != nil {
+					tfresource.SetLastError(err, fmt.Errorf("%s: %w", message, administrativeActionsError))
+				} else {
+					tfresource.SetLastError(err, errors.New(message))
+				}
+			} else {
+				tfresource.SetLastError(err, administrativeActionsError)
+			}
+		}
+
+		return output, err
+	}
+
+	return nil, err
+}
+
+func waitVolumeDeleted(ctx context.Context, conn *fsx.FSx, id string, timeout time.Duration) (*fsx.Volume, error) { //nolint:unparam
+	stateConf := &retry.StateChangeConf{
+		Pending: []string{fsx.VolumeLifecycleCreated, fsx.VolumeLifecycleMisconfigured, fsx.VolumeLifecycleAvailable, fsx.VolumeLifecycleDeleting},
+		Target:  []string{},
+		Refresh: statusVolume(ctx, conn, id),
+		Timeout: timeout,
+		Delay:   30 * time.Second,
+	}
+
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+
+	if output, ok := outputRaw.(*fsx.Volume); ok {
+		if status, reason := aws.StringValue(output.Lifecycle), output.LifecycleTransitionReason; status == fsx.VolumeLifecycleFailed && reason != nil {
+			tfresource.SetLastError(err, errors.New(aws.StringValue(reason.Message)))
+		}
+
+		return output, err
+	}
+
+	return nil, err
+}
+
+func findVolumeAdministrativeAction(ctx context.Context, conn *fsx.FSx, volID, actionType string) (*fsx.AdministrativeAction, error) {
+	output, err := findVolumeByID(ctx, conn, volID)
+
+	if err != nil {
+		return nil, err
+	}
+
+	for _, v := range output.AdministrativeActions {
+		if v == nil {
+			continue
+		}
+
+		if aws.StringValue(v.AdministrativeActionType) == actionType {
+			return v, nil
+		}
+	}
+
+	// If the administrative action isn't found, assume it's complete.
+	return &fsx.AdministrativeAction{Status: aws.String(fsx.StatusCompleted)}, nil
+}
+
+func statusVolumeAdministrativeAction(ctx context.Context, conn *fsx.FSx, volID, actionType string) retry.StateRefreshFunc {
+	return func() (interface{}, string, error) {
+		output, err := findVolumeAdministrativeAction(ctx, conn, volID, actionType)
+
+		if tfresource.NotFound(err) {
+			return nil, "", nil
+		}
+
+		if err != nil {
+			return nil, "", err
+		}
+
+		return output, aws.StringValue(output.Status), nil
+	}
+}
+
+func waitVolumeAdministrativeActionCompleted(ctx context.Context, conn *fsx.FSx, volID, actionType string, timeout time.Duration) (*fsx.AdministrativeAction, error) { //nolint:unparam
+	stateConf := &retry.StateChangeConf{
+		Pending: []string{fsx.StatusInProgress, fsx.StatusPending},
+		Target:  []string{fsx.StatusCompleted, fsx.StatusUpdatedOptimizing},
+		Refresh: statusVolumeAdministrativeAction(ctx, conn, volID, actionType),
+		Timeout: timeout,
+		Delay:   30 * time.Second,
+	}
+
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+
+	if output, ok := outputRaw.(*fsx.AdministrativeAction); ok {
+		if status, details := aws.StringValue(output.Status), output.FailureDetails; status == fsx.StatusFailed && details != nil {
+			tfresource.SetLastError(err, errors.New(aws.StringValue(output.FailureDetails.Message)))
+		}
+
+		return output, err
 	}
 
-	return []interface{}{m}
+	return nil, err
 }
diff --git a/internal/service/fsx/ontap_volume_test.go b/internal/service/fsx/ontap_volume_test.go
index 7cd16656d62..02fdaa004a1 100644
--- a/internal/service/fsx/ontap_volume_test.go
+++ b/internal/service/fsx/ontap_volume_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package fsx_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/fsx"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -17,7 +20,7 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
-func TestAccFSxOntapVolume_basic(t *testing.T) {
+func TestAccFSxONTAPVolume_basic(t *testing.T) {
 	ctx := acctest.Context(t)
 	var volume fsx.Volume
 	resourceName := "aws_fsx_ontap_volume.test"
@@ -27,13 +30,15 @@ func TestAccFSxOntapVolume_basic(t *testing.T) {
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
 		ErrorCheck:               acctest.ErrorCheck(t, fsx.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckOntapVolumeDestroy(ctx),
+		CheckDestroy:             testAccCheckONTAPVolumeDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccONTAPVolumeConfig_basic(rName),
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOntapVolumeExists(ctx, resourceName, &volume),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "fsx", regexp.MustCompile(`volume/fs-.+/fsvol-.+`)),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckONTAPVolumeExists(ctx, resourceName, &volume),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "fsx", regexache.MustCompile(`volume/fs-.+/fsvol-.+`)),
+					resource.TestCheckResourceAttr(resourceName, "bypass_snaplock_enterprise_retention", "false"),
+					resource.TestCheckResourceAttr(resourceName, "copy_tags_to_backups", "false"),
 					resource.TestCheckResourceAttrSet(resourceName, "file_system_id"),
 					resource.TestCheckResourceAttr(resourceName, "junction_path", fmt.Sprintf("/%[1]s", rName)),
 					resource.TestCheckResourceAttr(resourceName, "ontap_volume_type", "RW"),
@@ -41,24 +46,26 @@ func TestAccFSxOntapVolume_basic(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "security_style", ""),
 					resource.TestCheckResourceAttr(resourceName, "size_in_megabytes", "1024"),
 					resource.TestCheckResourceAttr(resourceName, "skip_final_backup", "false"),
+					resource.TestCheckResourceAttr(resourceName, "snaplock_configuration.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "snapshot_policy", "default"),
 					resource.TestCheckResourceAttr(resourceName, "storage_efficiency_enabled", "true"),
 					resource.TestCheckResourceAttrSet(resourceName, "storage_virtual_machine_id"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
+					resource.TestCheckResourceAttr(resourceName, "tiering_policy.#", "1"),
 					resource.TestCheckResourceAttrSet(resourceName, "uuid"),
 					resource.TestCheckResourceAttr(resourceName, "volume_type", "ONTAP"),
 				),
 			},
 			{
-				ResourceName:            resourceName,
-				ImportState:             true,
-				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"skip_final_backup"},
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
 			},
 		},
 	})
 }
 
-func TestAccFSxOntapVolume_disappears(t *testing.T) {
+func TestAccFSxONTAPVolume_disappears(t *testing.T) {
 	ctx := acctest.Context(t)
 	var volume fsx.Volume
 	resourceName := "aws_fsx_ontap_volume.test"
@@ -68,13 +75,13 @@ func TestAccFSxOntapVolume_disappears(t *testing.T) {
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
 		ErrorCheck:               acctest.ErrorCheck(t, fsx.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckOntapVolumeDestroy(ctx),
+		CheckDestroy:             testAccCheckONTAPVolumeDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccONTAPVolumeConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOntapVolumeExists(ctx, resourceName, &volume),
-					acctest.CheckResourceDisappears(ctx, acctest.Provider, tffsx.ResourceOntapVolume(), resourceName),
+					testAccCheckONTAPVolumeExists(ctx, resourceName, &volume),
+					acctest.CheckResourceDisappears(ctx, acctest.Provider, tffsx.ResourceONTAPVolume(), resourceName),
 				),
 				ExpectNonEmptyPlan: true,
 			},
@@ -82,45 +89,44 @@ func TestAccFSxOntapVolume_disappears(t *testing.T) {
 	})
 }
 
-func TestAccFSxOntapVolume_name(t *testing.T) {
+func TestAccFSxONTAPVolume_copyTagsToBackups(t *testing.T) {
 	ctx := acctest.Context(t)
 	var volume1, volume2 fsx.Volume
 	resourceName := "aws_fsx_ontap_volume.test"
 	rName := fmt.Sprintf("tf_acc_test_%d", sdkacctest.RandInt())
-	rName2 := fmt.Sprintf("tf_acc_test_%d", sdkacctest.RandInt())
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
 		ErrorCheck:               acctest.ErrorCheck(t, fsx.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckOntapVolumeDestroy(ctx),
+		CheckDestroy:             testAccCheckONTAPVolumeDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccONTAPVolumeConfig_basic(rName),
+				Config: testAccONTAPVolumeConfig_copyTagsToBackups(rName, true),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOntapVolumeExists(ctx, resourceName, &volume1),
-					resource.TestCheckResourceAttr(resourceName, "name", rName),
+					testAccCheckONTAPVolumeExists(ctx, resourceName, &volume1),
+					resource.TestCheckResourceAttr(resourceName, "copy_tags_to_backups", "true"),
 				),
 			},
 			{
 				ResourceName:            resourceName,
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"skip_final_backup"},
+				ImportStateVerifyIgnore: []string{"bypass_snaplock_enterprise_retention", "skip_final_backup"},
 			},
 			{
-				Config: testAccONTAPVolumeConfig_basic(rName2),
+				Config: testAccONTAPVolumeConfig_copyTagsToBackups(rName, false),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOntapVolumeExists(ctx, resourceName, &volume2),
-					testAccCheckOntapVolumeRecreated(&volume1, &volume2),
-					resource.TestCheckResourceAttr(resourceName, "name", rName2),
+					testAccCheckONTAPVolumeExists(ctx, resourceName, &volume2),
+					testAccCheckONTAPVolumeNotRecreated(&volume1, &volume2),
+					resource.TestCheckResourceAttr(resourceName, "copy_tags_to_backups", "false"),
 				),
 			},
 		},
 	})
 }
 
-func TestAccFSxOntapVolume_junctionPath(t *testing.T) {
+func TestAccFSxONTAPVolume_junctionPath(t *testing.T) {
 	ctx := acctest.Context(t)
 	var volume1, volume2 fsx.Volume
 	resourceName := "aws_fsx_ontap_volume.test"
@@ -132,12 +138,12 @@ func TestAccFSxOntapVolume_junctionPath(t *testing.T) {
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
 		ErrorCheck:               acctest.ErrorCheck(t, fsx.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckOntapVolumeDestroy(ctx),
+		CheckDestroy:             testAccCheckONTAPVolumeDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccONTAPVolumeConfig_junctionPath(rName, jPath1),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOntapVolumeExists(ctx, resourceName, &volume1),
+					testAccCheckONTAPVolumeExists(ctx, resourceName, &volume1),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "junction_path", jPath1),
 				),
@@ -146,13 +152,13 @@ func TestAccFSxOntapVolume_junctionPath(t *testing.T) {
 				ResourceName:            resourceName,
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"skip_final_backup"},
+				ImportStateVerifyIgnore: []string{"bypass_snaplock_enterprise_retention", "skip_final_backup"},
 			},
 			{
 				Config: testAccONTAPVolumeConfig_junctionPath(rName, jPath2),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOntapVolumeExists(ctx, resourceName, &volume2),
-					testAccCheckOntapVolumeNotRecreated(&volume1, &volume2),
+					testAccCheckONTAPVolumeExists(ctx, resourceName, &volume2),
+					testAccCheckONTAPVolumeNotRecreated(&volume1, &volume2),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "junction_path", jPath2),
 				),
@@ -161,7 +167,45 @@ func TestAccFSxOntapVolume_junctionPath(t *testing.T) {
 	})
 }
 
-func TestAccFSxOntapVolume_ontapVolumeType(t *testing.T) {
+func TestAccFSxONTAPVolume_name(t *testing.T) {
+	ctx := acctest.Context(t)
+	var volume1, volume2 fsx.Volume
+	resourceName := "aws_fsx_ontap_volume.test"
+	rName := fmt.Sprintf("tf_acc_test_%d", sdkacctest.RandInt())
+	rName2 := fmt.Sprintf("tf_acc_test_%d", sdkacctest.RandInt())
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
+		ErrorCheck:               acctest.ErrorCheck(t, fsx.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckONTAPVolumeDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccONTAPVolumeConfig_basic(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckONTAPVolumeExists(ctx, resourceName, &volume1),
+					resource.TestCheckResourceAttr(resourceName, "name", rName),
+				),
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"bypass_snaplock_enterprise_retention", "skip_final_backup"},
+			},
+			{
+				Config: testAccONTAPVolumeConfig_basic(rName2),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckONTAPVolumeExists(ctx, resourceName, &volume2),
+					testAccCheckONTAPVolumeRecreated(&volume1, &volume2),
+					resource.TestCheckResourceAttr(resourceName, "name", rName2),
+				),
+			},
+		},
+	})
+}
+
+func TestAccFSxONTAPVolume_ontapVolumeType(t *testing.T) {
 	ctx := acctest.Context(t)
 	var volume fsx.Volume
 	resourceName := "aws_fsx_ontap_volume.test"
@@ -171,13 +215,12 @@ func TestAccFSxOntapVolume_ontapVolumeType(t *testing.T) {
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
 		ErrorCheck:               acctest.ErrorCheck(t, fsx.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckOntapVolumeDestroy(ctx),
+		CheckDestroy:             testAccCheckONTAPVolumeDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccONTAPVolumeConfig_ontapVolumeTypeDP(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOntapVolumeExists(ctx, resourceName, &volume),
-					resource.TestCheckResourceAttr(resourceName, "name", rName),
+					testAccCheckONTAPVolumeExists(ctx, resourceName, &volume),
 					resource.TestCheckResourceAttr(resourceName, "ontap_volume_type", "DP"),
 				),
 			},
@@ -185,13 +228,13 @@ func TestAccFSxOntapVolume_ontapVolumeType(t *testing.T) {
 				ResourceName:            resourceName,
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"skip_final_backup"},
+				ImportStateVerifyIgnore: []string{"bypass_snaplock_enterprise_retention", "skip_final_backup"},
 			},
 		},
 	})
 }
 
-func TestAccFSxOntapVolume_securityStyle(t *testing.T) {
+func TestAccFSxONTAPVolume_securityStyle(t *testing.T) {
 	ctx := acctest.Context(t)
 	var volume1, volume2, volume3 fsx.Volume
 	resourceName := "aws_fsx_ontap_volume.test"
@@ -201,12 +244,12 @@ func TestAccFSxOntapVolume_securityStyle(t *testing.T) {
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
 		ErrorCheck:               acctest.ErrorCheck(t, fsx.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckOntapVolumeDestroy(ctx),
+		CheckDestroy:             testAccCheckONTAPVolumeDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccONTAPVolumeConfig_securityStyle(rName, "UNIX"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOntapVolumeExists(ctx, resourceName, &volume1),
+					testAccCheckONTAPVolumeExists(ctx, resourceName, &volume1),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "security_style", "UNIX"),
 				),
@@ -215,13 +258,13 @@ func TestAccFSxOntapVolume_securityStyle(t *testing.T) {
 				ResourceName:            resourceName,
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"skip_final_backup"},
+				ImportStateVerifyIgnore: []string{"bypass_snaplock_enterprise_retention", "skip_final_backup"},
 			},
 			{
 				Config: testAccONTAPVolumeConfig_securityStyle(rName, "NTFS"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOntapVolumeExists(ctx, resourceName, &volume2),
-					testAccCheckOntapVolumeNotRecreated(&volume1, &volume2),
+					testAccCheckONTAPVolumeExists(ctx, resourceName, &volume2),
+					testAccCheckONTAPVolumeNotRecreated(&volume1, &volume2),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "security_style", "NTFS"),
 				),
@@ -229,8 +272,8 @@ func TestAccFSxOntapVolume_securityStyle(t *testing.T) {
 			{
 				Config: testAccONTAPVolumeConfig_securityStyle(rName, "MIXED"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOntapVolumeExists(ctx, resourceName, &volume3),
-					testAccCheckOntapVolumeNotRecreated(&volume1, &volume3),
+					testAccCheckONTAPVolumeExists(ctx, resourceName, &volume3),
+					testAccCheckONTAPVolumeNotRecreated(&volume1, &volume3),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "security_style", "MIXED"),
 				),
@@ -239,7 +282,7 @@ func TestAccFSxOntapVolume_securityStyle(t *testing.T) {
 	})
 }
 
-func TestAccFSxOntapVolume_size(t *testing.T) {
+func TestAccFSxONTAPVolume_size(t *testing.T) {
 	ctx := acctest.Context(t)
 	var volume1, volume2 fsx.Volume
 	resourceName := "aws_fsx_ontap_volume.test"
@@ -251,12 +294,12 @@ func TestAccFSxOntapVolume_size(t *testing.T) {
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
 		ErrorCheck:               acctest.ErrorCheck(t, fsx.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckOntapVolumeDestroy(ctx),
+		CheckDestroy:             testAccCheckONTAPVolumeDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccONTAPVolumeConfig_size(rName, size1),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOntapVolumeExists(ctx, resourceName, &volume1),
+					testAccCheckONTAPVolumeExists(ctx, resourceName, &volume1),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "size_in_megabytes", fmt.Sprint(size1)),
 				),
@@ -265,13 +308,13 @@ func TestAccFSxOntapVolume_size(t *testing.T) {
 				ResourceName:            resourceName,
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"skip_final_backup"},
+				ImportStateVerifyIgnore: []string{"bypass_snaplock_enterprise_retention", "skip_final_backup"},
 			},
 			{
 				Config: testAccONTAPVolumeConfig_size(rName, size2),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOntapVolumeExists(ctx, resourceName, &volume2),
-					testAccCheckOntapVolumeNotRecreated(&volume1, &volume2),
+					testAccCheckONTAPVolumeExists(ctx, resourceName, &volume2),
+					testAccCheckONTAPVolumeNotRecreated(&volume1, &volume2),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "size_in_megabytes", fmt.Sprint(size2)),
 				),
@@ -280,22 +323,141 @@ func TestAccFSxOntapVolume_size(t *testing.T) {
 	})
 }
 
-func TestAccFSxOntapVolume_storageEfficiency(t *testing.T) {
+func TestAccFSxONTAPVolume_snaplock(t *testing.T) {
+	ctx := acctest.Context(t)
+	var volume1 /*, volume2*/ fsx.Volume
+	resourceName := "aws_fsx_ontap_volume.test"
+	rName := fmt.Sprintf("tf_acc_test_%d", sdkacctest.RandInt())
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
+		ErrorCheck:               acctest.ErrorCheck(t, fsx.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckONTAPVolumeDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccONTAPVolumeConfig_snaplockCreate(rName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckONTAPVolumeExists(ctx, resourceName, &volume1),
+					resource.TestCheckResourceAttr(resourceName, "bypass_snaplock_enterprise_retention", "true"),
+					resource.TestCheckResourceAttr(resourceName, "snaplock_configuration.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "snaplock_configuration.0.audit_log_volume", "false"),
+					resource.TestCheckResourceAttr(resourceName, "snaplock_configuration.0.autocommit_period.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "snaplock_configuration.0.autocommit_period.0.type", "NONE"),
+					resource.TestCheckResourceAttr(resourceName, "snaplock_configuration.0.autocommit_period.0.value", "0"),
+					resource.TestCheckResourceAttr(resourceName, "snaplock_configuration.0.privileged_delete", "DISABLED"),
+					resource.TestCheckResourceAttr(resourceName, "snaplock_configuration.0.retention_period.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "snaplock_configuration.0.retention_period.0.default_retention.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "snaplock_configuration.0.retention_period.0.default_retention.0.type", "YEARS"),
+					resource.TestCheckResourceAttr(resourceName, "snaplock_configuration.0.retention_period.0.default_retention.0.value", "0"),
+					resource.TestCheckResourceAttr(resourceName, "snaplock_configuration.0.retention_period.0.maximum_retention.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "snaplock_configuration.0.retention_period.0.maximum_retention.0.type", "YEARS"),
+					resource.TestCheckResourceAttr(resourceName, "snaplock_configuration.0.retention_period.0.maximum_retention.0.value", "30"),
+					resource.TestCheckResourceAttr(resourceName, "snaplock_configuration.0.retention_period.0.minimum_retention.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "snaplock_configuration.0.retention_period.0.minimum_retention.0.type", "YEARS"),
+					resource.TestCheckResourceAttr(resourceName, "snaplock_configuration.0.retention_period.0.minimum_retention.0.value", "0"),
+					resource.TestCheckResourceAttr(resourceName, "snaplock_configuration.0.snaplock_type", "ENTERPRISE"),
+					resource.TestCheckResourceAttr(resourceName, "snaplock_configuration.0.volume_append_mode_enabled", "false"),
+				),
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"bypass_snaplock_enterprise_retention", "skip_final_backup"},
+			},
+			/*
+				See https://docs.aws.amazon.com/fsx/latest/ONTAPGuide/how-snaplock-works.html#snaplock-audit-log-volume.
+				> The minimum retention period for a SnapLock audit log volume is six months. Until this retention period expires, the SnapLock audit log volume and the SVM and file system that are associated with it can't be deleted even if the volume was created in SnapLock Enterprise mode.
+
+				{
+					Config: testAccONTAPVolumeConfig_snaplockUpdate(rName),
+					Check: resource.ComposeAggregateTestCheckFunc(
+						testAccCheckONTAPVolumeExists(ctx, resourceName, &volume2),
+						testAccCheckONTAPVolumeNotRecreated(&volume1, &volume2),
+						resource.TestCheckResourceAttr(resourceName, "bypass_snaplock_enterprise_retention", "true"),
+						resource.TestCheckResourceAttr(resourceName, "snaplock_configuration.#", "1"),
+						resource.TestCheckResourceAttr(resourceName, "snaplock_configuration.0.audit_log_volume", "true"),
+						resource.TestCheckResourceAttr(resourceName, "snaplock_configuration.0.autocommit_period.#", "1"),
+						resource.TestCheckResourceAttr(resourceName, "snaplock_configuration.0.autocommit_period.0.type", "DAYS"),
+						resource.TestCheckResourceAttr(resourceName, "snaplock_configuration.0.autocommit_period.0.value", "14"),
+						resource.TestCheckResourceAttr(resourceName, "snaplock_configuration.0.privileged_delete", "PERMANENTLY_DISABLED"),
+						resource.TestCheckResourceAttr(resourceName, "snaplock_configuration.0.retention_period.#", "1"),
+						resource.TestCheckResourceAttr(resourceName, "snaplock_configuration.0.retention_period.0.default_retention.#", "1"),
+						resource.TestCheckResourceAttr(resourceName, "snaplock_configuration.0.retention_period.0.default_retention.0.type", "DAYS"),
+						resource.TestCheckResourceAttr(resourceName, "snaplock_configuration.0.retention_period.0.default_retention.0.value", "30"),
+						resource.TestCheckResourceAttr(resourceName, "snaplock_configuration.0.retention_period.0.maximum_retention.#", "1"),
+						resource.TestCheckResourceAttr(resourceName, "snaplock_configuration.0.retention_period.0.maximum_retention.0.type", "MONTHS"),
+						resource.TestCheckResourceAttr(resourceName, "snaplock_configuration.0.retention_period.0.maximum_retention.0.value", "9"),
+						resource.TestCheckResourceAttr(resourceName, "snaplock_configuration.0.retention_period.0.minimum_retention.#", "1"),
+						resource.TestCheckResourceAttr(resourceName, "snaplock_configuration.0.retention_period.0.minimum_retention.0.type", "HOURS"),
+						resource.TestCheckResourceAttr(resourceName, "snaplock_configuration.0.retention_period.0.minimum_retention.0.value", "24"),
+						resource.TestCheckResourceAttr(resourceName, "snaplock_configuration.0.snaplock_type", "ENTERPRISE"),
+						resource.TestCheckResourceAttr(resourceName, "snaplock_configuration.0.volume_append_mode_enabled", "true"),
+					),
+				},
+			*/
+		},
+	})
+}
+
+func TestAccFSxONTAPVolume_snapshotPolicy(t *testing.T) {
 	ctx := acctest.Context(t)
 	var volume1, volume2 fsx.Volume
 	resourceName := "aws_fsx_ontap_volume.test"
 	rName := fmt.Sprintf("tf_acc_test_%d", sdkacctest.RandInt())
+	policy1 := "default"
+	policy2 := "none"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
 		ErrorCheck:               acctest.ErrorCheck(t, fsx.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckOntapVolumeDestroy(ctx),
+		CheckDestroy:             testAccCheckONTAPVolumeDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccONTAPVolumeConfig_snapshotPolicy(rName, policy1),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckONTAPVolumeExists(ctx, resourceName, &volume1),
+					resource.TestCheckResourceAttr(resourceName, "name", rName),
+					resource.TestCheckResourceAttr(resourceName, "snapshot_policy", fmt.Sprint(policy1)),
+				),
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"bypass_snaplock_enterprise_retention", "skip_final_backup"},
+			},
+			{
+				Config: testAccONTAPVolumeConfig_snapshotPolicy(rName, policy2),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckONTAPVolumeExists(ctx, resourceName, &volume2),
+					testAccCheckONTAPVolumeNotRecreated(&volume1, &volume2),
+					resource.TestCheckResourceAttr(resourceName, "name", rName),
+					resource.TestCheckResourceAttr(resourceName, "snapshot_policy", fmt.Sprint(policy2)),
+				),
+			},
+		},
+	})
+}
+
+func TestAccFSxONTAPVolume_storageEfficiency(t *testing.T) {
+	ctx := acctest.Context(t)
+	var volume1, volume2 fsx.Volume
+	resourceName := "aws_fsx_ontap_volume.test"
+	rName := fmt.Sprintf("tf_acc_test_%d", sdkacctest.RandInt())
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
+		ErrorCheck:               acctest.ErrorCheck(t, fsx.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckONTAPVolumeDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccONTAPVolumeConfig_storageEfficiency(rName, true),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOntapVolumeExists(ctx, resourceName, &volume1),
+					testAccCheckONTAPVolumeExists(ctx, resourceName, &volume1),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "storage_efficiency_enabled", "true"),
 				),
@@ -304,13 +466,13 @@ func TestAccFSxOntapVolume_storageEfficiency(t *testing.T) {
 				ResourceName:            resourceName,
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"skip_final_backup"},
+				ImportStateVerifyIgnore: []string{"bypass_snaplock_enterprise_retention", "skip_final_backup"},
 			},
 			{
 				Config: testAccONTAPVolumeConfig_storageEfficiency(rName, false),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOntapVolumeExists(ctx, resourceName, &volume2),
-					testAccCheckOntapVolumeNotRecreated(&volume1, &volume2),
+					testAccCheckONTAPVolumeExists(ctx, resourceName, &volume2),
+					testAccCheckONTAPVolumeNotRecreated(&volume1, &volume2),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "storage_efficiency_enabled", "false"),
 				),
@@ -319,7 +481,7 @@ func TestAccFSxOntapVolume_storageEfficiency(t *testing.T) {
 	})
 }
 
-func TestAccFSxOntapVolume_tags(t *testing.T) {
+func TestAccFSxONTAPVolume_tags(t *testing.T) {
 	ctx := acctest.Context(t)
 	var volume1, volume2, volume3 fsx.Volume
 	resourceName := "aws_fsx_ontap_volume.test"
@@ -329,12 +491,12 @@ func TestAccFSxOntapVolume_tags(t *testing.T) {
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
 		ErrorCheck:               acctest.ErrorCheck(t, fsx.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckOntapVolumeDestroy(ctx),
+		CheckDestroy:             testAccCheckONTAPVolumeDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccONTAPVolumeConfig_tags1(rName, "key1", "value1"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOntapVolumeExists(ctx, resourceName, &volume1),
+					testAccCheckONTAPVolumeExists(ctx, resourceName, &volume1),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
 				),
@@ -343,13 +505,13 @@ func TestAccFSxOntapVolume_tags(t *testing.T) {
 				ResourceName:            resourceName,
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"skip_final_backup"},
+				ImportStateVerifyIgnore: []string{"bypass_snaplock_enterprise_retention", "skip_final_backup"},
 			},
 			{
 				Config: testAccONTAPVolumeConfig_tags2(rName, "key1", "value1updated", "key2", "value2"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOntapVolumeExists(ctx, resourceName, &volume2),
-					testAccCheckOntapVolumeNotRecreated(&volume1, &volume2),
+					testAccCheckONTAPVolumeExists(ctx, resourceName, &volume2),
+					testAccCheckONTAPVolumeNotRecreated(&volume1, &volume2),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1updated"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
@@ -358,8 +520,8 @@ func TestAccFSxOntapVolume_tags(t *testing.T) {
 			{
 				Config: testAccONTAPVolumeConfig_tags1(rName, "key2", "value2"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOntapVolumeExists(ctx, resourceName, &volume3),
-					testAccCheckOntapVolumeNotRecreated(&volume2, &volume3),
+					testAccCheckONTAPVolumeExists(ctx, resourceName, &volume3),
+					testAccCheckONTAPVolumeNotRecreated(&volume2, &volume3),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
 				),
@@ -368,7 +530,7 @@ func TestAccFSxOntapVolume_tags(t *testing.T) {
 	})
 }
 
-func TestAccFSxOntapVolume_tieringPolicy(t *testing.T) {
+func TestAccFSxONTAPVolume_tieringPolicy(t *testing.T) {
 	ctx := acctest.Context(t)
 	var volume1, volume2, volume3, volume4 fsx.Volume
 	resourceName := "aws_fsx_ontap_volume.test"
@@ -378,12 +540,12 @@ func TestAccFSxOntapVolume_tieringPolicy(t *testing.T) {
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
 		ErrorCheck:               acctest.ErrorCheck(t, fsx.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckOntapVolumeDestroy(ctx),
+		CheckDestroy:             testAccCheckONTAPVolumeDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccONTAPVolumeConfig_tieringPolicyNoCooling(rName, "NONE"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOntapVolumeExists(ctx, resourceName, &volume1),
+					testAccCheckONTAPVolumeExists(ctx, resourceName, &volume1),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "tiering_policy.0.name", "NONE"),
 				),
@@ -392,13 +554,13 @@ func TestAccFSxOntapVolume_tieringPolicy(t *testing.T) {
 				ResourceName:            resourceName,
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"skip_final_backup"},
+				ImportStateVerifyIgnore: []string{"bypass_snaplock_enterprise_retention", "skip_final_backup"},
 			},
 			{
 				Config: testAccONTAPVolumeConfig_tieringPolicy(rName, "SNAPSHOT_ONLY", 10),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOntapVolumeExists(ctx, resourceName, &volume2),
-					testAccCheckOntapVolumeNotRecreated(&volume1, &volume2),
+					testAccCheckONTAPVolumeExists(ctx, resourceName, &volume2),
+					testAccCheckONTAPVolumeNotRecreated(&volume1, &volume2),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "tiering_policy.0.name", "SNAPSHOT_ONLY"),
 					resource.TestCheckResourceAttr(resourceName, "tiering_policy.0.cooling_period", "10"),
@@ -407,8 +569,8 @@ func TestAccFSxOntapVolume_tieringPolicy(t *testing.T) {
 			{
 				Config: testAccONTAPVolumeConfig_tieringPolicy(rName, "AUTO", 60),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOntapVolumeExists(ctx, resourceName, &volume3),
-					testAccCheckOntapVolumeNotRecreated(&volume1, &volume3),
+					testAccCheckONTAPVolumeExists(ctx, resourceName, &volume3),
+					testAccCheckONTAPVolumeNotRecreated(&volume1, &volume3),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "tiering_policy.0.name", "AUTO"),
 					resource.TestCheckResourceAttr(resourceName, "tiering_policy.0.cooling_period", "60"),
@@ -417,8 +579,8 @@ func TestAccFSxOntapVolume_tieringPolicy(t *testing.T) {
 			{
 				Config: testAccONTAPVolumeConfig_tieringPolicyNoCooling(rName, "ALL"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOntapVolumeExists(ctx, resourceName, &volume4),
-					testAccCheckOntapVolumeNotRecreated(&volume1, &volume4),
+					testAccCheckONTAPVolumeExists(ctx, resourceName, &volume4),
+					testAccCheckONTAPVolumeNotRecreated(&volume1, &volume4),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "tiering_policy.0.name", "ALL"),
 				),
@@ -427,7 +589,7 @@ func TestAccFSxOntapVolume_tieringPolicy(t *testing.T) {
 	})
 }
 
-func testAccCheckOntapVolumeExists(ctx context.Context, n string, v *fsx.Volume) resource.TestCheckFunc {
+func testAccCheckONTAPVolumeExists(ctx context.Context, n string, v *fsx.Volume) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		rs, ok := s.RootModule().Resources[n]
 		if !ok {
@@ -436,7 +598,7 @@ func testAccCheckOntapVolumeExists(ctx context.Context, n string, v *fsx.Volume)
 
 		conn := acctest.Provider.Meta().(*conns.AWSClient).FSxConn(ctx)
 
-		output, err := tffsx.FindVolumeByID(ctx, conn, rs.Primary.ID)
+		output, err := tffsx.FindONTAPVolumeByID(ctx, conn, rs.Primary.ID)
 
 		if err != nil {
 			return err
@@ -448,7 +610,7 @@ func testAccCheckOntapVolumeExists(ctx context.Context, n string, v *fsx.Volume)
 	}
 }
 
-func testAccCheckOntapVolumeDestroy(ctx context.Context) resource.TestCheckFunc {
+func testAccCheckONTAPVolumeDestroy(ctx context.Context) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		conn := acctest.Provider.Meta().(*conns.AWSClient).FSxConn(ctx)
 
@@ -457,41 +619,43 @@ func testAccCheckOntapVolumeDestroy(ctx context.Context) resource.TestCheckFunc
 				continue
 			}
 
-			volume, err := tffsx.FindVolumeByID(ctx, conn, rs.Primary.ID)
+			_, err := tffsx.FindONTAPVolumeByID(ctx, conn, rs.Primary.ID)
 
 			if tfresource.NotFound(err) {
 				continue
 			}
 
-			if volume != nil {
-				return fmt.Errorf("FSx ONTAP Volume (%s) still exists", rs.Primary.ID)
+			if err != nil {
+				return err
 			}
+
+			return fmt.Errorf("FSx for NetApp ONTAP Volume %s still exists", rs.Primary.ID)
 		}
 		return nil
 	}
 }
 
-func testAccCheckOntapVolumeNotRecreated(i, j *fsx.Volume) resource.TestCheckFunc {
+func testAccCheckONTAPVolumeNotRecreated(i, j *fsx.Volume) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		if aws.StringValue(i.VolumeId) != aws.StringValue(j.VolumeId) {
-			return fmt.Errorf("FSx ONTAP Volume (%s) recreated", aws.StringValue(i.VolumeId))
+			return fmt.Errorf("FSx for NetApp ONTAP Volume (%s) recreated", aws.StringValue(i.VolumeId))
 		}
 
 		return nil
 	}
 }
 
-func testAccCheckOntapVolumeRecreated(i, j *fsx.Volume) resource.TestCheckFunc {
+func testAccCheckONTAPVolumeRecreated(i, j *fsx.Volume) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		if aws.StringValue(i.VolumeId) == aws.StringValue(j.VolumeId) {
-			return fmt.Errorf("FSx ONTAP Volume (%s) not recreated", aws.StringValue(i.VolumeId))
+			return fmt.Errorf("FSx for NetApp ONTAP Volume (%s) not recreated", aws.StringValue(i.VolumeId))
 		}
 
 		return nil
 	}
 }
 
-func testAccOntapVolumeConfig_base(rName string) string {
+func testAccONTAPVolumeConfig_base(rName string) string {
 	return acctest.ConfigCompose(acctest.ConfigVPCWithSubnets(rName, 2), fmt.Sprintf(`
 resource "aws_fsx_ontap_file_system" "test" {
   storage_capacity    = 1024
@@ -513,7 +677,7 @@ resource "aws_fsx_ontap_storage_virtual_machine" "test" {
 }
 
 func testAccONTAPVolumeConfig_basic(rName string) string {
-	return acctest.ConfigCompose(testAccOntapVolumeConfig_base(rName), fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccONTAPVolumeConfig_base(rName), fmt.Sprintf(`
 resource "aws_fsx_ontap_volume" "test" {
   name                       = %[1]q
   junction_path              = "/%[1]s"
@@ -524,8 +688,21 @@ resource "aws_fsx_ontap_volume" "test" {
 `, rName))
 }
 
-func testAccONTAPVolumeConfig_junctionPath(rName string, junctionPath string) string {
-	return acctest.ConfigCompose(testAccOntapVolumeConfig_base(rName), fmt.Sprintf(`
+func testAccONTAPVolumeConfig_copyTagsToBackups(rName string, copyTagsToBackups bool) string {
+	return acctest.ConfigCompose(testAccONTAPVolumeConfig_base(rName), fmt.Sprintf(`
+resource "aws_fsx_ontap_volume" "test" {
+  name                       = %[1]q
+  junction_path              = "/%[1]s"
+  size_in_megabytes          = 1024
+  storage_efficiency_enabled = true
+  storage_virtual_machine_id = aws_fsx_ontap_storage_virtual_machine.test.id
+  copy_tags_to_backups       = %[2]t
+}
+`, rName, copyTagsToBackups))
+}
+
+func testAccONTAPVolumeConfig_junctionPath(rName, junctionPath string) string {
+	return acctest.ConfigCompose(testAccONTAPVolumeConfig_base(rName), fmt.Sprintf(`
 resource "aws_fsx_ontap_volume" "test" {
   name                       = %[1]q
   junction_path              = %[2]q
@@ -537,7 +714,7 @@ resource "aws_fsx_ontap_volume" "test" {
 }
 
 func testAccONTAPVolumeConfig_ontapVolumeTypeDP(rName string) string {
-	return acctest.ConfigCompose(testAccOntapVolumeConfig_base(rName), fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccONTAPVolumeConfig_base(rName), fmt.Sprintf(`
 resource "aws_fsx_ontap_volume" "test" {
   name                       = %[1]q
   ontap_volume_type          = "DP"
@@ -548,8 +725,8 @@ resource "aws_fsx_ontap_volume" "test" {
 `, rName))
 }
 
-func testAccONTAPVolumeConfig_securityStyle(rName string, securityStyle string) string {
-	return acctest.ConfigCompose(testAccOntapVolumeConfig_base(rName), fmt.Sprintf(`
+func testAccONTAPVolumeConfig_securityStyle(rName, securityStyle string) string {
+	return acctest.ConfigCompose(testAccONTAPVolumeConfig_base(rName), fmt.Sprintf(`
 resource "aws_fsx_ontap_volume" "test" {
   name                       = %[1]q
   junction_path              = "/%[1]s"
@@ -562,7 +739,7 @@ resource "aws_fsx_ontap_volume" "test" {
 }
 
 func testAccONTAPVolumeConfig_size(rName string, size int) string {
-	return acctest.ConfigCompose(testAccOntapVolumeConfig_base(rName), fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccONTAPVolumeConfig_base(rName), fmt.Sprintf(`
 resource "aws_fsx_ontap_volume" "test" {
   name                       = %[1]q
   junction_path              = "/%[1]s"
@@ -573,8 +750,84 @@ resource "aws_fsx_ontap_volume" "test" {
 `, rName, size))
 }
 
+func testAccONTAPVolumeConfig_snaplockCreate(rName string) string {
+	return acctest.ConfigCompose(testAccONTAPVolumeConfig_base(rName), fmt.Sprintf(`
+resource "aws_fsx_ontap_volume" "test" {
+  name                       = %[1]q
+  junction_path              = "/%[1]s"
+  size_in_megabytes          = 1024
+  storage_efficiency_enabled = true
+  storage_virtual_machine_id = aws_fsx_ontap_storage_virtual_machine.test.id
+
+  snaplock_configuration {
+    snaplock_type = "ENTERPRISE"
+  }
+
+  bypass_snaplock_enterprise_retention = true
+}
+`, rName))
+}
+
+/*
+func testAccONTAPVolumeConfig_snaplockUpdate(rName string) string {
+	return acctest.ConfigCompose(testAccONTAPVolumeConfig_base(rName), fmt.Sprintf(`
+resource "aws_fsx_ontap_volume" "test" {
+  name                       = %[1]q
+  junction_path              = "/snaplock_audit_log"
+  size_in_megabytes          = 1024
+  storage_efficiency_enabled = true
+  storage_virtual_machine_id = aws_fsx_ontap_storage_virtual_machine.test.id
+
+  snaplock_configuration {
+    audit_log_volume           = true
+    privileged_delete          = "PERMANENTLY_DISABLED"
+    snaplock_type              = "ENTERPRISE"
+    volume_append_mode_enabled = true
+
+    autocommit_period {
+      type  = "DAYS"
+      value = 14
+    }
+
+    retention_period {
+      default_retention {
+        type  = "DAYS"
+        value = 30
+      }
+
+      maximum_retention {
+        type  = "MONTHS"
+        value = 9
+      }
+
+      minimum_retention {
+        type  = "HOURS"
+        value = 24
+      }
+    }
+  }
+
+  bypass_snaplock_enterprise_retention = true
+}
+`, rName))
+}
+*/
+
+func testAccONTAPVolumeConfig_snapshotPolicy(rName, snapshotPolicy string) string {
+	return acctest.ConfigCompose(testAccONTAPVolumeConfig_base(rName), fmt.Sprintf(`
+resource "aws_fsx_ontap_volume" "test" {
+  name                       = %[1]q
+  junction_path              = "/%[1]s"
+  size_in_megabytes          = 1024
+  snapshot_policy            = %[2]q
+  storage_efficiency_enabled = true
+  storage_virtual_machine_id = aws_fsx_ontap_storage_virtual_machine.test.id
+}
+`, rName, snapshotPolicy))
+}
+
 func testAccONTAPVolumeConfig_storageEfficiency(rName string, storageEfficiencyEnabled bool) string {
-	return acctest.ConfigCompose(testAccOntapVolumeConfig_base(rName), fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccONTAPVolumeConfig_base(rName), fmt.Sprintf(`
 resource "aws_fsx_ontap_volume" "test" {
   name                       = %[1]q
   junction_path              = "/%[1]s"
@@ -585,8 +838,8 @@ resource "aws_fsx_ontap_volume" "test" {
 `, rName, storageEfficiencyEnabled))
 }
 
-func testAccONTAPVolumeConfig_tieringPolicy(rName string, policy string, coolingPeriod int) string {
-	return acctest.ConfigCompose(testAccOntapVolumeConfig_base(rName), fmt.Sprintf(`
+func testAccONTAPVolumeConfig_tieringPolicy(rName, policy string, coolingPeriod int) string {
+	return acctest.ConfigCompose(testAccONTAPVolumeConfig_base(rName), fmt.Sprintf(`
 resource "aws_fsx_ontap_volume" "test" {
   name                       = %[1]q
   junction_path              = "/%[1]s"
@@ -602,8 +855,8 @@ resource "aws_fsx_ontap_volume" "test" {
 `, rName, policy, coolingPeriod))
 }
 
-func testAccONTAPVolumeConfig_tieringPolicyNoCooling(rName string, policy string) string {
-	return acctest.ConfigCompose(testAccOntapVolumeConfig_base(rName), fmt.Sprintf(`
+func testAccONTAPVolumeConfig_tieringPolicyNoCooling(rName, policy string) string {
+	return acctest.ConfigCompose(testAccONTAPVolumeConfig_base(rName), fmt.Sprintf(`
 resource "aws_fsx_ontap_volume" "test" {
   name                       = %[1]q
   junction_path              = "/%[1]s"
@@ -619,7 +872,7 @@ resource "aws_fsx_ontap_volume" "test" {
 }
 
 func testAccONTAPVolumeConfig_tags1(rName, tagKey1, tagValue1 string) string {
-	return acctest.ConfigCompose(testAccOntapVolumeConfig_base(rName), fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccONTAPVolumeConfig_base(rName), fmt.Sprintf(`
 resource "aws_fsx_ontap_volume" "test" {
   name                       = %[1]q
   junction_path              = "/%[1]s"
@@ -635,7 +888,7 @@ resource "aws_fsx_ontap_volume" "test" {
 }
 
 func testAccONTAPVolumeConfig_tags2(rName, tagKey1, tagValue1, tagKey2, tagValue2 string) string {
-	return acctest.ConfigCompose(testAccOntapVolumeConfig_base(rName), fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccONTAPVolumeConfig_base(rName), fmt.Sprintf(`
 resource "aws_fsx_ontap_volume" "test" {
   name                       = %[1]q
   junction_path              = "/%[1]s"
diff --git a/internal/service/fsx/openzfs_file_system.go b/internal/service/fsx/openzfs_file_system.go
index 9243d3063d9..c02c32af978 100644
--- a/internal/service/fsx/openzfs_file_system.go
+++ b/internal/service/fsx/openzfs_file_system.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package fsx
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/fsx"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -27,12 +30,12 @@ import (
 
 // @SDKResource("aws_fsx_openzfs_file_system", name="OpenZFS File System")
 // @Tags(identifierAttribute="arn")
-func ResourceOpenzfsFileSystem() *schema.Resource {
+func ResourceOpenZFSFileSystem() *schema.Resource {
 	return &schema.Resource{
-		CreateWithoutTimeout: resourceOpenzfsFileSystemCreate,
-		ReadWithoutTimeout:   resourceOpenzfsFileSystemRead,
-		UpdateWithoutTimeout: resourceOpenzfsFileSystemUpdate,
-		DeleteWithoutTimeout: resourceOpenzfsFileSystemDelete,
+		CreateWithoutTimeout: resourceOpenZFSFileSystemCreate,
+		ReadWithoutTimeout:   resourceOpenZFSFileSystemRead,
+		UpdateWithoutTimeout: resourceOpenZFSFileSystemUpdate,
+		DeleteWithoutTimeout: resourceOpenZFSFileSystemDelete,
 
 		Importer: &schema.ResourceImporter{
 			StateContext: schema.ImportStatePassthroughContext,
@@ -76,7 +79,7 @@ func ResourceOpenzfsFileSystem() *schema.Resource {
 				Computed: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(5, 5),
-					validation.StringMatch(regexp.MustCompile(`^([01]\d|2[0-3]):?([0-5]\d)$`), "must be in the format HH:MM"),
+					validation.StringMatch(regexache.MustCompile(`^([01]\d|2[0-3]):?([0-5]\d)$`), "must be in the format HH:MM"),
 				),
 			},
 			"deployment_type": {
@@ -106,6 +109,37 @@ func ResourceOpenzfsFileSystem() *schema.Resource {
 					},
 				},
 			},
+			"dns_name": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"endpoint_ip_address_range": {
+				Type:     schema.TypeString,
+				Optional: true,
+				Computed: true,
+				ForceNew: true,
+			},
+			"kms_key_id": {
+				Type:         schema.TypeString,
+				Optional:     true,
+				Computed:     true,
+				ForceNew:     true,
+				ValidateFunc: verify.ValidARN,
+			},
+			"network_interface_ids": {
+				Type:     schema.TypeList,
+				Computed: true,
+				Elem:     &schema.Schema{Type: schema.TypeString},
+			},
+			"owner_id": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"preferred_subnet_id": {
+				Type:     schema.TypeString,
+				Optional: true,
+				ForceNew: true,
+			},
 			"root_volume_configuration": {
 				Type:     schema.TypeList,
 				Optional: true,
@@ -140,7 +174,7 @@ func ResourceOpenzfsFileSystem() *schema.Resource {
 													Required: true,
 													ValidateFunc: validation.All(
 														validation.StringLenBetween(1, 128),
-														validation.StringMatch(regexp.MustCompile(`^[ -~]{1,128}$`), "must be either IP Address or CIDR"),
+														validation.StringMatch(regexache.MustCompile(`^[ -~]{1,128}$`), "must be either IP Address or CIDR"),
 													),
 												},
 												"options": {
@@ -198,30 +232,17 @@ func ResourceOpenzfsFileSystem() *schema.Resource {
 					},
 				},
 			},
-			"dns_name": {
+			"root_volume_id": {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
-			"kms_key_id": {
-				Type:         schema.TypeString,
-				Optional:     true,
-				Computed:     true,
-				ForceNew:     true,
-				ValidateFunc: verify.ValidARN,
-			},
-			"network_interface_ids": {
-				Type:     schema.TypeList,
+			"route_table_ids": {
+				Type:     schema.TypeSet,
+				Optional: true,
 				Computed: true,
+				MaxItems: 50,
 				Elem:     &schema.Schema{Type: schema.TypeString},
 			},
-			"owner_id": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
-			"root_volume_id": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
 			"security_group_ids": {
 				Type:     schema.TypeSet,
 				Optional: true,
@@ -246,7 +267,6 @@ func ResourceOpenzfsFileSystem() *schema.Resource {
 				Required: true,
 				ForceNew: true,
 				MinItems: 1,
-				MaxItems: 1,
 				Elem:     &schema.Schema{Type: schema.TypeString},
 			},
 			names.AttrTags:    tftags.TagsSchema(),
@@ -265,7 +285,7 @@ func ResourceOpenzfsFileSystem() *schema.Resource {
 				Computed: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(7, 7),
-					validation.StringMatch(regexp.MustCompile(`^[1-7]:([01]\d|2[0-3]):?([0-5]\d)$`), "must be in the format d:HH:MM"),
+					validation.StringMatch(regexache.MustCompile(`^[1-7]:([01]\d|2[0-3]):?([0-5]\d)$`), "must be in the format d:HH:MM"),
 				),
 			},
 		},
@@ -275,8 +295,8 @@ func ResourceOpenzfsFileSystem() *schema.Resource {
 			validateDiskConfigurationIOPS,
 			func(_ context.Context, d *schema.ResourceDiff, meta interface{}) error {
 				var (
-					singleAZ1ThroughputCapacityValues = []int{64, 128, 256, 512, 1024, 2048, 3072, 4096}
-					singleAZ2ThroughputCapacityValues = []int{160, 320, 640, 1280, 2560, 3840, 5120, 7680, 10240}
+					singleAZ1ThroughputCapacityValues            = []int{64, 128, 256, 512, 1024, 2048, 3072, 4096}
+					singleAZ2AndMultiAZ1ThroughputCapacityValues = []int{160, 320, 640, 1280, 2560, 3840, 5120, 7680, 10240}
 				)
 
 				switch deploymentType, throughputCapacity := d.Get("deployment_type").(string), d.Get("throughput_capacity").(int); deploymentType {
@@ -284,9 +304,9 @@ func ResourceOpenzfsFileSystem() *schema.Resource {
 					if !slices.Contains(singleAZ1ThroughputCapacityValues, throughputCapacity) {
 						return fmt.Errorf("%d is not a valid value for `throughput_capacity` when `deployment_type` is %q. Valid values: %v", throughputCapacity, deploymentType, singleAZ1ThroughputCapacityValues)
 					}
-				case fsx.OpenZFSDeploymentTypeSingleAz2:
-					if !slices.Contains(singleAZ2ThroughputCapacityValues, throughputCapacity) {
-						return fmt.Errorf("%d is not a valid value for `throughput_capacity` when `deployment_type` is %q. Valid values: %v", throughputCapacity, deploymentType, singleAZ2ThroughputCapacityValues)
+				case fsx.OpenZFSDeploymentTypeSingleAz2, fsx.OpenZFSDeploymentTypeMultiAz1:
+					if !slices.Contains(singleAZ2AndMultiAZ1ThroughputCapacityValues, throughputCapacity) {
+						return fmt.Errorf("%d is not a valid value for `throughput_capacity` when `deployment_type` is %q. Valid values: %v", throughputCapacity, deploymentType, singleAZ2AndMultiAZ1ThroughputCapacityValues)
 					}
 					// default:
 					// Allow validation to pass for unknown/new types.
@@ -322,201 +342,190 @@ func validateDiskConfigurationIOPS(_ context.Context, d *schema.ResourceDiff, me
 	return nil
 }
 
-func resourceOpenzfsFileSystemCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+func resourceOpenZFSFileSystemCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).FSxConn(ctx)
 
-	input := &fsx.CreateFileSystemInput{
+	inputC := &fsx.CreateFileSystemInput{
 		ClientRequestToken: aws.String(id.UniqueId()),
 		FileSystemType:     aws.String(fsx.FileSystemTypeOpenzfs),
-		StorageCapacity:    aws.Int64(int64(d.Get("storage_capacity").(int))),
-		StorageType:        aws.String(d.Get("storage_type").(string)),
-		SubnetIds:          flex.ExpandStringList(d.Get("subnet_ids").([]interface{})),
 		OpenZFSConfiguration: &fsx.CreateFileSystemOpenZFSConfiguration{
 			DeploymentType:               aws.String(d.Get("deployment_type").(string)),
 			AutomaticBackupRetentionDays: aws.Int64(int64(d.Get("automatic_backup_retention_days").(int))),
 		},
-		Tags: getTagsIn(ctx),
+		StorageCapacity: aws.Int64(int64(d.Get("storage_capacity").(int))),
+		StorageType:     aws.String(d.Get("storage_type").(string)),
+		SubnetIds:       flex.ExpandStringList(d.Get("subnet_ids").([]interface{})),
+		Tags:            getTagsIn(ctx),
 	}
-
-	backupInput := &fsx.CreateFileSystemFromBackupInput{
+	inputB := &fsx.CreateFileSystemFromBackupInput{
 		ClientRequestToken: aws.String(id.UniqueId()),
-		StorageType:        aws.String(d.Get("storage_type").(string)),
-		SubnetIds:          flex.ExpandStringList(d.Get("subnet_ids").([]interface{})),
 		OpenZFSConfiguration: &fsx.CreateFileSystemOpenZFSConfiguration{
 			DeploymentType:               aws.String(d.Get("deployment_type").(string)),
 			AutomaticBackupRetentionDays: aws.Int64(int64(d.Get("automatic_backup_retention_days").(int))),
 		},
-		Tags: getTagsIn(ctx),
+		StorageType: aws.String(d.Get("storage_type").(string)),
+		SubnetIds:   flex.ExpandStringList(d.Get("subnet_ids").([]interface{})),
+		Tags:        getTagsIn(ctx),
+	}
+
+	if v, ok := d.GetOk("copy_tags_to_backups"); ok {
+		inputC.OpenZFSConfiguration.CopyTagsToBackups = aws.Bool(v.(bool))
+		inputB.OpenZFSConfiguration.CopyTagsToBackups = aws.Bool(v.(bool))
+	}
+
+	if v, ok := d.GetOk("copy_tags_to_volumes"); ok {
+		inputC.OpenZFSConfiguration.CopyTagsToVolumes = aws.Bool(v.(bool))
+		inputB.OpenZFSConfiguration.CopyTagsToVolumes = aws.Bool(v.(bool))
+	}
+
+	if v, ok := d.GetOk("daily_automatic_backup_start_time"); ok {
+		inputC.OpenZFSConfiguration.DailyAutomaticBackupStartTime = aws.String(v.(string))
+		inputB.OpenZFSConfiguration.DailyAutomaticBackupStartTime = aws.String(v.(string))
 	}
 
 	if v, ok := d.GetOk("disk_iops_configuration"); ok {
-		input.OpenZFSConfiguration.DiskIopsConfiguration = expandOpenzfsFileDiskIopsConfiguration(v.([]interface{}))
-		backupInput.OpenZFSConfiguration.DiskIopsConfiguration = expandOpenzfsFileDiskIopsConfiguration(v.([]interface{}))
+		inputC.OpenZFSConfiguration.DiskIopsConfiguration = expandDiskIopsConfiguration(v.([]interface{}))
+		inputB.OpenZFSConfiguration.DiskIopsConfiguration = expandDiskIopsConfiguration(v.([]interface{}))
 	}
 
-	if v, ok := d.GetOk("root_volume_configuration"); ok {
-		input.OpenZFSConfiguration.RootVolumeConfiguration = expandOpenzfsRootVolumeConfiguration(v.([]interface{}))
-		backupInput.OpenZFSConfiguration.RootVolumeConfiguration = expandOpenzfsRootVolumeConfiguration(v.([]interface{}))
+	if v, ok := d.GetOk("endpoint_ip_address_range"); ok {
+		inputC.OpenZFSConfiguration.EndpointIpAddressRange = aws.String(v.(string))
+		inputB.OpenZFSConfiguration.EndpointIpAddressRange = aws.String(v.(string))
 	}
 
 	if v, ok := d.GetOk("kms_key_id"); ok {
-		input.KmsKeyId = aws.String(v.(string))
-		backupInput.KmsKeyId = aws.String(v.(string))
+		inputC.KmsKeyId = aws.String(v.(string))
+		inputB.KmsKeyId = aws.String(v.(string))
 	}
 
-	if v, ok := d.GetOk("daily_automatic_backup_start_time"); ok {
-		input.OpenZFSConfiguration.DailyAutomaticBackupStartTime = aws.String(v.(string))
-		backupInput.OpenZFSConfiguration.DailyAutomaticBackupStartTime = aws.String(v.(string))
+	if v, ok := d.GetOk("preferred_subnet_id"); ok {
+		inputC.OpenZFSConfiguration.PreferredSubnetId = aws.String(v.(string))
+		inputB.OpenZFSConfiguration.PreferredSubnetId = aws.String(v.(string))
 	}
 
-	if v, ok := d.GetOk("security_group_ids"); ok {
-		input.SecurityGroupIds = flex.ExpandStringSet(v.(*schema.Set))
-		backupInput.SecurityGroupIds = flex.ExpandStringSet(v.(*schema.Set))
+	if v, ok := d.GetOk("root_volume_configuration"); ok {
+		inputC.OpenZFSConfiguration.RootVolumeConfiguration = expandOpenZFSCreateRootVolumeConfiguration(v.([]interface{}))
+		inputB.OpenZFSConfiguration.RootVolumeConfiguration = expandOpenZFSCreateRootVolumeConfiguration(v.([]interface{}))
 	}
 
-	if v, ok := d.GetOk("weekly_maintenance_start_time"); ok {
-		input.OpenZFSConfiguration.WeeklyMaintenanceStartTime = aws.String(v.(string))
-		backupInput.OpenZFSConfiguration.WeeklyMaintenanceStartTime = aws.String(v.(string))
+	if v, ok := d.GetOk("route_table_ids"); ok {
+		inputC.OpenZFSConfiguration.RouteTableIds = flex.ExpandStringSet(v.(*schema.Set))
+		inputB.OpenZFSConfiguration.RouteTableIds = flex.ExpandStringSet(v.(*schema.Set))
 	}
 
-	if v, ok := d.GetOk("throughput_capacity"); ok {
-		input.OpenZFSConfiguration.ThroughputCapacity = aws.Int64(int64(v.(int)))
-		backupInput.OpenZFSConfiguration.ThroughputCapacity = aws.Int64(int64(v.(int)))
+	if v, ok := d.GetOk("security_group_ids"); ok {
+		inputC.SecurityGroupIds = flex.ExpandStringSet(v.(*schema.Set))
+		inputB.SecurityGroupIds = flex.ExpandStringSet(v.(*schema.Set))
 	}
 
-	if v, ok := d.GetOk("copy_tags_to_backups"); ok {
-		input.OpenZFSConfiguration.CopyTagsToBackups = aws.Bool(v.(bool))
-		backupInput.OpenZFSConfiguration.CopyTagsToBackups = aws.Bool(v.(bool))
+	if v, ok := d.GetOk("throughput_capacity"); ok {
+		inputC.OpenZFSConfiguration.ThroughputCapacity = aws.Int64(int64(v.(int)))
+		inputB.OpenZFSConfiguration.ThroughputCapacity = aws.Int64(int64(v.(int)))
 	}
 
-	if v, ok := d.GetOk("copy_tags_to_volumes"); ok {
-		input.OpenZFSConfiguration.CopyTagsToVolumes = aws.Bool(v.(bool))
-		backupInput.OpenZFSConfiguration.CopyTagsToVolumes = aws.Bool(v.(bool))
+	if v, ok := d.GetOk("weekly_maintenance_start_time"); ok {
+		inputC.OpenZFSConfiguration.WeeklyMaintenanceStartTime = aws.String(v.(string))
+		inputB.OpenZFSConfiguration.WeeklyMaintenanceStartTime = aws.String(v.(string))
 	}
 
 	if v, ok := d.GetOk("backup_id"); ok {
-		backupInput.BackupId = aws.String(v.(string))
+		backupID := v.(string)
+		inputB.BackupId = aws.String(backupID)
 
-		log.Printf("[DEBUG] Creating FSx OpenZFS File System: %s", backupInput)
-		result, err := conn.CreateFileSystemFromBackupWithContext(ctx, backupInput)
+		output, err := conn.CreateFileSystemFromBackupWithContext(ctx, inputB)
 
 		if err != nil {
-			return sdkdiag.AppendErrorf(diags, "creating FSx OpenZFS File System from backup: %s", err)
+			return sdkdiag.AppendErrorf(diags, "creating FSx for OpenZFS File System from backup (%s): %s", backupID, err)
 		}
 
-		d.SetId(aws.StringValue(result.FileSystem.FileSystemId))
+		d.SetId(aws.StringValue(output.FileSystem.FileSystemId))
 	} else {
-		log.Printf("[DEBUG] Creating FSx OpenZFS File System: %s", input)
-		result, err := conn.CreateFileSystemWithContext(ctx, input)
+		output, err := conn.CreateFileSystemWithContext(ctx, inputC)
 
 		if err != nil {
-			return sdkdiag.AppendErrorf(diags, "creating FSx OpenZFS File System: %s", err)
+			return sdkdiag.AppendErrorf(diags, "creating FSx for OpenZFS File System: %s", err)
 		}
 
-		d.SetId(aws.StringValue(result.FileSystem.FileSystemId))
+		d.SetId(aws.StringValue(output.FileSystem.FileSystemId))
 	}
 
 	if _, err := waitFileSystemCreated(ctx, conn, d.Id(), d.Timeout(schema.TimeoutCreate)); err != nil {
-		return sdkdiag.AppendErrorf(diags, "waiting for FSx OpenZFS File System (%s) create: %s", d.Id(), err)
+		return sdkdiag.AppendErrorf(diags, "waiting for FSx for OpenZFS File System (%s) create: %s", d.Id(), err)
 	}
 
-	return append(diags, resourceOpenzfsFileSystemRead(ctx, d, meta)...)
+	return append(diags, resourceOpenZFSFileSystemRead(ctx, d, meta)...)
 }
 
-func resourceOpenzfsFileSystemRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+func resourceOpenZFSFileSystemRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).FSxConn(ctx)
 
-	filesystem, err := FindFileSystemByID(ctx, conn, d.Id())
+	filesystem, err := FindOpenZFSFileSystemByID(ctx, conn, d.Id())
+
 	if !d.IsNewResource() && tfresource.NotFound(err) {
-		log.Printf("[WARN] FSx OpenZFS File System (%s) not found, removing from state", d.Id())
+		log.Printf("[WARN] FSx for OpenZFS File System (%s) not found, removing from state", d.Id())
 		d.SetId("")
 		return diags
 	}
 
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "reading FSx OpenZFS File System (%s): %s", d.Id(), err)
-	}
-
-	openzfsConfig := filesystem.OpenZFSConfiguration
-
-	if filesystem.WindowsConfiguration != nil {
-		return sdkdiag.AppendErrorf(diags, "expected FSx OpenZFS File System, found FSx Windows File System: %s", d.Id())
-	}
-
-	if filesystem.LustreConfiguration != nil {
-		return sdkdiag.AppendErrorf(diags, "expected FSx OpenZFS File System, found FSx Lustre File System: %s", d.Id())
+		return sdkdiag.AppendErrorf(diags, "reading FSx for OpenZFS File System (%s): %s", d.Id(), err)
 	}
 
-	if filesystem.OntapConfiguration != nil {
-		return sdkdiag.AppendErrorf(diags, "expected FSx OpeZFS File System, found FSx ONTAP File System: %s", d.Id())
-	}
-
-	if openzfsConfig == nil {
-		return sdkdiag.AppendErrorf(diags, "describing FSx OpenZFS File System (%s): empty Openzfs configuration", d.Id())
-	}
+	openZFSConfig := filesystem.OpenZFSConfiguration
 
 	d.Set("arn", filesystem.ResourceARN)
+	d.Set("automatic_backup_retention_days", openZFSConfig.AutomaticBackupRetentionDays)
+	d.Set("copy_tags_to_backups", openZFSConfig.CopyTagsToBackups)
+	d.Set("copy_tags_to_volumes", openZFSConfig.CopyTagsToVolumes)
+	d.Set("daily_automatic_backup_start_time", openZFSConfig.DailyAutomaticBackupStartTime)
+	d.Set("deployment_type", openZFSConfig.DeploymentType)
+	if err := d.Set("disk_iops_configuration", flattenDiskIopsConfiguration(openZFSConfig.DiskIopsConfiguration)); err != nil {
+		return sdkdiag.AppendErrorf(diags, "setting disk_iops_configuration: %s", err)
+	}
 	d.Set("dns_name", filesystem.DNSName)
-	d.Set("deployment_type", openzfsConfig.DeploymentType)
-	d.Set("throughput_capacity", openzfsConfig.ThroughputCapacity)
-	d.Set("storage_type", filesystem.StorageType)
+	d.Set("endpoint_ip_address_range", openZFSConfig.EndpointIpAddressRange)
 	d.Set("kms_key_id", filesystem.KmsKeyId)
-
-	if err := d.Set("network_interface_ids", aws.StringValueSlice(filesystem.NetworkInterfaceIds)); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting network_interface_ids: %s", err)
-	}
-
+	d.Set("network_interface_ids", aws.StringValueSlice(filesystem.NetworkInterfaceIds))
 	d.Set("owner_id", filesystem.OwnerId)
-	d.Set("root_volume_id", openzfsConfig.RootVolumeId)
+	d.Set("preferred_subnet_id", openZFSConfig.PreferredSubnetId)
+	rootVolumeID := aws.StringValue(openZFSConfig.RootVolumeId)
+	d.Set("root_volume_id", rootVolumeID)
+	d.Set("route_table_ids", aws.StringValueSlice(openZFSConfig.RouteTableIds))
 	d.Set("storage_capacity", filesystem.StorageCapacity)
-
-	if err := d.Set("subnet_ids", aws.StringValueSlice(filesystem.SubnetIds)); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting subnet_ids: %s", err)
-	}
+	d.Set("storage_type", filesystem.StorageType)
+	d.Set("subnet_ids", aws.StringValueSlice(filesystem.SubnetIds))
+	d.Set("throughput_capacity", openZFSConfig.ThroughputCapacity)
+	d.Set("vpc_id", filesystem.VpcId)
+	d.Set("weekly_maintenance_start_time", openZFSConfig.WeeklyMaintenanceStartTime)
 
 	setTagsOut(ctx, filesystem.Tags)
 
-	if err := d.Set("disk_iops_configuration", flattenOpenzfsFileDiskIopsConfiguration(openzfsConfig.DiskIopsConfiguration)); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting disk_iops_configuration: %s", err)
-	}
-
-	d.Set("vpc_id", filesystem.VpcId)
-	d.Set("weekly_maintenance_start_time", openzfsConfig.WeeklyMaintenanceStartTime)
-	d.Set("automatic_backup_retention_days", openzfsConfig.AutomaticBackupRetentionDays)
-	d.Set("daily_automatic_backup_start_time", openzfsConfig.DailyAutomaticBackupStartTime)
-	d.Set("copy_tags_to_backups", openzfsConfig.CopyTagsToBackups)
-	d.Set("copy_tags_to_volumes", openzfsConfig.CopyTagsToVolumes)
-
-	rootVolume, err := FindVolumeByID(ctx, conn, *openzfsConfig.RootVolumeId)
+	rootVolume, err := FindOpenZFSVolumeByID(ctx, conn, rootVolumeID)
 
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "reading FSx OpenZFS Root Volume Configuration (%s): %s", *openzfsConfig.RootVolumeId, err)
+		return sdkdiag.AppendErrorf(diags, "reading FSx for OpenZFS File System (%s) root volume (%s): %s", d.Id(), rootVolumeID, err)
 	}
 
-	if err := d.Set("root_volume_configuration", flattenOpenzfsRootVolumeConfiguration(rootVolume)); err != nil {
+	if err := d.Set("root_volume_configuration", flattenOpenZFSFileSystemRootVolume(rootVolume)); err != nil {
 		return sdkdiag.AppendErrorf(diags, "setting root_volume_configuration: %s", err)
 	}
 
 	return diags
 }
 
-func resourceOpenzfsFileSystemUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+func resourceOpenZFSFileSystemUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).FSxConn(ctx)
 
-	if d.HasChangesExcept("tags_all", "tags") {
+	if d.HasChangesExcept("tags", "tags_all") {
 		input := &fsx.UpdateFileSystemInput{
 			ClientRequestToken:   aws.String(id.UniqueId()),
 			FileSystemId:         aws.String(d.Id()),
 			OpenZFSConfiguration: &fsx.UpdateFileSystemOpenZFSConfiguration{},
 		}
 
-		if d.HasChange("storage_capacity") {
-			input.StorageCapacity = aws.Int64(int64(d.Get("storage_capacity").(int)))
-		}
-
 		if d.HasChange("automatic_backup_retention_days") {
 			input.OpenZFSConfiguration.AutomaticBackupRetentionDays = aws.Int64(int64(d.Get("automatic_backup_retention_days").(int)))
 		}
@@ -533,61 +542,83 @@ func resourceOpenzfsFileSystemUpdate(ctx context.Context, d *schema.ResourceData
 			input.OpenZFSConfiguration.DailyAutomaticBackupStartTime = aws.String(d.Get("daily_automatic_backup_start_time").(string))
 		}
 
-		if d.HasChange("throughput_capacity") {
-			input.OpenZFSConfiguration.ThroughputCapacity = aws.Int64(int64(d.Get("throughput_capacity").(int)))
+		if d.HasChange("disk_iops_configuration") {
+			input.OpenZFSConfiguration.DiskIopsConfiguration = expandDiskIopsConfiguration(d.Get("disk_iops_configuration").([]interface{}))
 		}
 
-		if d.HasChange("disk_iops_configuration") {
-			input.OpenZFSConfiguration.DiskIopsConfiguration = expandOpenzfsFileDiskIopsConfiguration(d.Get("disk_iops_configuration").([]interface{}))
+		if d.HasChange("route_table_ids") {
+			o, n := d.GetChange("route_table_ids")
+			os, ns := o.(*schema.Set), n.(*schema.Set)
+			add, del := flex.ExpandStringValueSet(ns.Difference(os)), flex.ExpandStringValueSet(os.Difference(ns))
+
+			if len(add) > 0 {
+				input.OpenZFSConfiguration.AddRouteTableIds = aws.StringSlice(add)
+			}
+			if len(del) > 0 {
+				input.OpenZFSConfiguration.RemoveRouteTableIds = aws.StringSlice(del)
+			}
+		}
+
+		if d.HasChange("storage_capacity") {
+			input.StorageCapacity = aws.Int64(int64(d.Get("storage_capacity").(int)))
+		}
+
+		if d.HasChange("throughput_capacity") {
+			input.OpenZFSConfiguration.ThroughputCapacity = aws.Int64(int64(d.Get("throughput_capacity").(int)))
 		}
 
 		if d.HasChange("weekly_maintenance_start_time") {
 			input.OpenZFSConfiguration.WeeklyMaintenanceStartTime = aws.String(d.Get("weekly_maintenance_start_time").(string))
 		}
 
+		startTime := time.Now()
 		_, err := conn.UpdateFileSystemWithContext(ctx, input)
 
 		if err != nil {
-			return sdkdiag.AppendErrorf(diags, "updating FSx OpenZFS File System (%s): %s", d.Id(), err)
+			return sdkdiag.AppendErrorf(diags, "updating FSx for OpenZFS File System (%s): %s", d.Id(), err)
 		}
 
-		if _, err := waitFileSystemUpdated(ctx, conn, d.Id(), d.Timeout(schema.TimeoutUpdate)); err != nil {
-			return sdkdiag.AppendErrorf(diags, "waiting for FSx OpenZFS File System (%s) update: %s", d.Id(), err)
+		if _, err := waitFileSystemUpdated(ctx, conn, d.Id(), startTime, d.Timeout(schema.TimeoutUpdate)); err != nil {
+			return sdkdiag.AppendErrorf(diags, "waiting for FSx for OpenZFS File System (%s) update: %s", d.Id(), err)
 		}
 
-		if _, err := waitAdministrativeActionCompleted(ctx, conn, d.Id(), fsx.AdministrativeActionTypeFileSystemUpdate, d.Timeout(schema.TimeoutUpdate)); err != nil {
-			return sdkdiag.AppendErrorf(diags, "waiting for FSx OpenZFS File System (%s) update: %s", d.Id(), err)
+		if _, err := waitFileSystemAdministrativeActionCompleted(ctx, conn, d.Id(), fsx.AdministrativeActionTypeFileSystemUpdate, d.Timeout(schema.TimeoutUpdate)); err != nil {
+			return sdkdiag.AppendErrorf(diags, "waiting for FSx for OpenZFS File System (%s) administrative action (%s) complete: %s", d.Id(), fsx.AdministrativeActionTypeFileSystemUpdate, err)
 		}
 
 		if d.HasChange("root_volume_configuration") {
+			rootVolumeID := d.Get("root_volume_id").(string)
 			input := &fsx.UpdateVolumeInput{
 				ClientRequestToken:   aws.String(id.UniqueId()),
-				VolumeId:             aws.String(d.Get("root_volume_id").(string)),
-				OpenZFSConfiguration: &fsx.UpdateOpenZFSVolumeConfiguration{},
+				OpenZFSConfiguration: expandUpdateOpenZFSVolumeConfiguration(d.Get("root_volume_configuration").([]interface{})),
+				VolumeId:             aws.String(rootVolumeID),
 			}
 
-			input.OpenZFSConfiguration = expandOpenzfsUpdateRootVolumeConfiguration(d.Get("root_volume_configuration").([]interface{}))
-
+			startTime := time.Now()
 			_, err := conn.UpdateVolumeWithContext(ctx, input)
 
 			if err != nil {
-				return sdkdiag.AppendErrorf(diags, "updating FSx OpenZFS Root Volume (%s): %s", d.Get("root_volume_id").(string), err)
+				return sdkdiag.AppendErrorf(diags, "updating FSx for OpenZFS Root Volume (%s): %s", rootVolumeID, err)
+			}
+
+			if _, err := waitVolumeUpdated(ctx, conn, rootVolumeID, startTime, d.Timeout(schema.TimeoutUpdate)); err != nil {
+				return sdkdiag.AppendErrorf(diags, "waiting for FSx for OpenZFS Root Volume (%s) update: %s", rootVolumeID, err)
 			}
 
-			if _, err := waitVolumeUpdated(ctx, conn, d.Get("root_volume_id").(string), d.Timeout(schema.TimeoutUpdate)); err != nil {
-				return sdkdiag.AppendErrorf(diags, "waiting for FSx OpenZFS Root Volume (%s) update: %s", d.Get("root_volume_id").(string), err)
+			if _, err := waitVolumeAdministrativeActionCompleted(ctx, conn, rootVolumeID, fsx.AdministrativeActionTypeVolumeUpdate, d.Timeout(schema.TimeoutUpdate)); err != nil {
+				return sdkdiag.AppendErrorf(diags, "waiting for FSx for OpenZFS Volume (%s) administrative action (%s) complete: %s", rootVolumeID, fsx.AdministrativeActionTypeVolumeUpdate, err)
 			}
 		}
 	}
 
-	return append(diags, resourceOpenzfsFileSystemRead(ctx, d, meta)...)
+	return append(diags, resourceOpenZFSFileSystemRead(ctx, d, meta)...)
 }
 
-func resourceOpenzfsFileSystemDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+func resourceOpenZFSFileSystemDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).FSxConn(ctx)
 
-	log.Printf("[DEBUG] Deleting FSx OpenZFS File System: %s", d.Id())
+	log.Printf("[DEBUG] Deleting FSx for OpenZFS File System: %s", d.Id())
 	_, err := conn.DeleteFileSystemWithContext(ctx, &fsx.DeleteFileSystemInput{
 		FileSystemId: aws.String(d.Id()),
 	})
@@ -597,17 +628,17 @@ func resourceOpenzfsFileSystemDelete(ctx context.Context, d *schema.ResourceData
 	}
 
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "deleting FSx OpenZFS File System (%s): %s", d.Id(), err)
+		return sdkdiag.AppendErrorf(diags, "deleting FSx for OpenZFS File System (%s): %s", d.Id(), err)
 	}
 
 	if _, err := waitFileSystemDeleted(ctx, conn, d.Id(), d.Timeout(schema.TimeoutDelete)); err != nil {
-		return sdkdiag.AppendErrorf(diags, "waiting for FSx OpenZFS File System (%s) delete: %s", d.Id(), err)
+		return sdkdiag.AppendErrorf(diags, "waiting for FSx for OpenZFS File System (%s) delete: %s", d.Id(), err)
 	}
 
 	return diags
 }
 
-func expandOpenzfsFileDiskIopsConfiguration(cfg []interface{}) *fsx.DiskIopsConfiguration {
+func expandDiskIopsConfiguration(cfg []interface{}) *fsx.DiskIopsConfiguration {
 	if len(cfg) < 1 {
 		return nil
 	}
@@ -627,7 +658,7 @@ func expandOpenzfsFileDiskIopsConfiguration(cfg []interface{}) *fsx.DiskIopsConf
 	return &out
 }
 
-func expandOpenzfsRootVolumeConfiguration(cfg []interface{}) *fsx.OpenZFSCreateRootVolumeConfiguration {
+func expandOpenZFSCreateRootVolumeConfiguration(cfg []interface{}) *fsx.OpenZFSCreateRootVolumeConfiguration {
 	if len(cfg) < 1 {
 		return nil
 	}
@@ -653,17 +684,17 @@ func expandOpenzfsRootVolumeConfiguration(cfg []interface{}) *fsx.OpenZFSCreateR
 	}
 
 	if v, ok := conf["user_and_group_quotas"]; ok {
-		out.UserAndGroupQuotas = expandOpenzfsUserAndGroupQuotas(v.(*schema.Set).List())
+		out.UserAndGroupQuotas = expandOpenZFSUserOrGroupQuotas(v.(*schema.Set).List())
 	}
 
 	if v, ok := conf["nfs_exports"].([]interface{}); ok {
-		out.NfsExports = expandOpenzfsNFSExports(v)
+		out.NfsExports = expandOpenZFSNfsExports(v)
 	}
 
 	return &out
 }
 
-func expandOpenzfsUpdateRootVolumeConfiguration(cfg []interface{}) *fsx.UpdateOpenZFSVolumeConfiguration {
+func expandUpdateOpenZFSVolumeConfiguration(cfg []interface{}) *fsx.UpdateOpenZFSVolumeConfiguration {
 	if len(cfg) < 1 {
 		return nil
 	}
@@ -685,102 +716,17 @@ func expandOpenzfsUpdateRootVolumeConfiguration(cfg []interface{}) *fsx.UpdateOp
 	}
 
 	if v, ok := conf["user_and_group_quotas"]; ok {
-		out.UserAndGroupQuotas = expandOpenzfsUserAndGroupQuotas(v.(*schema.Set).List())
+		out.UserAndGroupQuotas = expandOpenZFSUserOrGroupQuotas(v.(*schema.Set).List())
 	}
 
 	if v, ok := conf["nfs_exports"].([]interface{}); ok {
-		out.NfsExports = expandOpenzfsNFSExports(v)
+		out.NfsExports = expandOpenZFSNfsExports(v)
 	}
 
 	return &out
 }
 
-func expandOpenzfsUserAndGroupQuotas(cfg []interface{}) []*fsx.OpenZFSUserOrGroupQuota {
-	quotas := []*fsx.OpenZFSUserOrGroupQuota{}
-
-	for _, quota := range cfg {
-		expandedQuota := expandOpenzfsUserAndGroupQuota(quota.(map[string]interface{}))
-		if expandedQuota != nil {
-			quotas = append(quotas, expandedQuota)
-		}
-	}
-
-	return quotas
-}
-
-func expandOpenzfsUserAndGroupQuota(conf map[string]interface{}) *fsx.OpenZFSUserOrGroupQuota {
-	if len(conf) < 1 {
-		return nil
-	}
-
-	out := fsx.OpenZFSUserOrGroupQuota{}
-
-	if v, ok := conf["id"].(int); ok {
-		out.Id = aws.Int64(int64(v))
-	}
-
-	if v, ok := conf["storage_capacity_quota_gib"].(int); ok {
-		out.StorageCapacityQuotaGiB = aws.Int64(int64(v))
-	}
-
-	if v, ok := conf["type"].(string); ok {
-		out.Type = aws.String(v)
-	}
-
-	return &out
-}
-
-func expandOpenzfsNFSExports(cfg []interface{}) []*fsx.OpenZFSNfsExport {
-	exports := []*fsx.OpenZFSNfsExport{}
-
-	for _, export := range cfg {
-		expandedExport := expandOpenzfsNFSExport(export.(map[string]interface{}))
-		if expandedExport != nil {
-			exports = append(exports, expandedExport)
-		}
-	}
-
-	return exports
-}
-
-func expandOpenzfsNFSExport(cfg map[string]interface{}) *fsx.OpenZFSNfsExport {
-	out := fsx.OpenZFSNfsExport{}
-
-	if v, ok := cfg["client_configurations"]; ok {
-		out.ClientConfigurations = expandOpenzfsClinetConfigurations(v.(*schema.Set).List())
-	}
-
-	return &out
-}
-
-func expandOpenzfsClinetConfigurations(cfg []interface{}) []*fsx.OpenZFSClientConfiguration {
-	configurations := []*fsx.OpenZFSClientConfiguration{}
-
-	for _, configuration := range cfg {
-		expandedConfiguration := expandOpenzfsClientConfiguration(configuration.(map[string]interface{}))
-		if expandedConfiguration != nil {
-			configurations = append(configurations, expandedConfiguration)
-		}
-	}
-
-	return configurations
-}
-
-func expandOpenzfsClientConfiguration(conf map[string]interface{}) *fsx.OpenZFSClientConfiguration {
-	out := fsx.OpenZFSClientConfiguration{}
-
-	if v, ok := conf["clients"].(string); ok && len(v) > 0 {
-		out.Clients = aws.String(v)
-	}
-
-	if v, ok := conf["options"].([]interface{}); ok {
-		out.Options = flex.ExpandStringList(v)
-	}
-
-	return &out
-}
-
-func flattenOpenzfsFileDiskIopsConfiguration(rs *fsx.DiskIopsConfiguration) []interface{} {
+func flattenDiskIopsConfiguration(rs *fsx.DiskIopsConfiguration) []interface{} {
 	if rs == nil {
 		return []interface{}{}
 	}
@@ -796,7 +742,7 @@ func flattenOpenzfsFileDiskIopsConfiguration(rs *fsx.DiskIopsConfiguration) []in
 	return []interface{}{m}
 }
 
-func flattenOpenzfsRootVolumeConfiguration(rs *fsx.Volume) []interface{} {
+func flattenOpenZFSFileSystemRootVolume(rs *fsx.Volume) []interface{} {
 	if rs == nil {
 		return []interface{}{}
 	}
@@ -809,7 +755,7 @@ func flattenOpenzfsRootVolumeConfiguration(rs *fsx.Volume) []interface{} {
 		m["data_compression_type"] = aws.StringValue(rs.OpenZFSConfiguration.DataCompressionType)
 	}
 	if rs.OpenZFSConfiguration.NfsExports != nil {
-		m["nfs_exports"] = flattenOpenzfsFileNFSExports(rs.OpenZFSConfiguration.NfsExports)
+		m["nfs_exports"] = flattenOpenZFSNfsExports(rs.OpenZFSConfiguration.NfsExports)
 	}
 	if rs.OpenZFSConfiguration.ReadOnly != nil {
 		m["read_only"] = aws.BoolValue(rs.OpenZFSConfiguration.ReadOnly)
@@ -818,65 +764,22 @@ func flattenOpenzfsRootVolumeConfiguration(rs *fsx.Volume) []interface{} {
 		m["record_size_kib"] = aws.Int64Value(rs.OpenZFSConfiguration.RecordSizeKiB)
 	}
 	if rs.OpenZFSConfiguration.UserAndGroupQuotas != nil {
-		m["user_and_group_quotas"] = flattenOpenzfsFileUserAndGroupQuotas(rs.OpenZFSConfiguration.UserAndGroupQuotas)
+		m["user_and_group_quotas"] = flattenOpenZFSUserOrGroupQuotas(rs.OpenZFSConfiguration.UserAndGroupQuotas)
 	}
 
 	return []interface{}{m}
 }
 
-func flattenOpenzfsFileNFSExports(rs []*fsx.OpenZFSNfsExport) []map[string]interface{} {
-	exports := make([]map[string]interface{}, 0)
-
-	for _, export := range rs {
-		if export != nil {
-			cfg := make(map[string]interface{})
-			cfg["client_configurations"] = flattenOpenzfsClientConfigurations(export.ClientConfigurations)
-			exports = append(exports, cfg)
-		}
-	}
-
-	if len(exports) > 0 {
-		return exports
-	}
-
-	return nil
-}
-
-func flattenOpenzfsClientConfigurations(rs []*fsx.OpenZFSClientConfiguration) []map[string]interface{} {
-	configurations := make([]map[string]interface{}, 0)
+func FindOpenZFSFileSystemByID(ctx context.Context, conn *fsx.FSx, id string) (*fsx.FileSystem, error) {
+	output, err := findFileSystemByIDAndType(ctx, conn, id, fsx.FileSystemTypeOpenzfs)
 
-	for _, configuration := range rs {
-		if configuration != nil {
-			cfg := make(map[string]interface{})
-			cfg["clients"] = aws.StringValue(configuration.Clients)
-			cfg["options"] = flex.FlattenStringList(configuration.Options)
-			configurations = append(configurations, cfg)
-		}
-	}
-
-	if len(configurations) > 0 {
-		return configurations
-	}
-
-	return nil
-}
-
-func flattenOpenzfsFileUserAndGroupQuotas(rs []*fsx.OpenZFSUserOrGroupQuota) []map[string]interface{} {
-	quotas := make([]map[string]interface{}, 0)
-
-	for _, quota := range rs {
-		if quota != nil {
-			cfg := make(map[string]interface{})
-			cfg["id"] = aws.Int64Value(quota.Id)
-			cfg["storage_capacity_quota_gib"] = aws.Int64Value(quota.StorageCapacityQuotaGiB)
-			cfg["type"] = aws.StringValue(quota.Type)
-			quotas = append(quotas, cfg)
-		}
+	if err != nil {
+		return nil, err
 	}
 
-	if len(quotas) > 0 {
-		return quotas
+	if output.OpenZFSConfiguration == nil {
+		return nil, tfresource.NewEmptyResultError(nil)
 	}
 
-	return nil
+	return output, nil
 }
diff --git a/internal/service/fsx/openzfs_file_system_test.go b/internal/service/fsx/openzfs_file_system_test.go
index c0e3c936da1..f1b64363652 100644
--- a/internal/service/fsx/openzfs_file_system_test.go
+++ b/internal/service/fsx/openzfs_file_system_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package fsx_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/fsx"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -27,7 +30,7 @@ func testAccErrorCheckSkip(t *testing.T) resource.ErrorCheckFunc {
 	)
 }
 
-func TestAccFSxOpenzfsFileSystem_basic(t *testing.T) {
+func TestAccFSxOpenZFSFileSystem_basic(t *testing.T) {
 	ctx := acctest.Context(t)
 	var filesystem fsx.FileSystem
 	resourceName := "aws_fsx_openzfs_file_system.test"
@@ -37,31 +40,28 @@ func TestAccFSxOpenzfsFileSystem_basic(t *testing.T) {
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
 		ErrorCheck:               acctest.ErrorCheck(t, fsx.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckOpenzfsFileSystemDestroy(ctx),
+		CheckDestroy:             testAccCheckOpenZFSFileSystemDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccOpenZFSFileSystemConfig_basic(rName),
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOpenzfsFileSystemExists(ctx, resourceName, &filesystem),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "fsx", regexp.MustCompile(`file-system/fs-.+`)),
-					resource.TestCheckResourceAttr(resourceName, "network_interface_ids.#", "1"),
-					acctest.CheckResourceAttrAccountID(resourceName, "owner_id"),
-					resource.TestCheckResourceAttrSet(resourceName, "root_volume_id"),
-					resource.TestCheckResourceAttrSet(resourceName, "dns_name"),
-					resource.TestCheckResourceAttr(resourceName, "storage_capacity", "64"),
-					resource.TestCheckTypeSetElemAttrPair(resourceName, "subnet_ids.*", "aws_subnet.test.0", "id"),
-					resource.TestCheckResourceAttr(resourceName, "security_group_ids.#", "0"),
-					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
-					resource.TestCheckResourceAttrPair(resourceName, "vpc_id", "aws_vpc.test", "id"),
-					resource.TestMatchResourceAttr(resourceName, "weekly_maintenance_start_time", regexp.MustCompile(`^\d:\d\d:\d\d$`)),
-					resource.TestCheckResourceAttr(resourceName, "deployment_type", fsx.OpenZFSDeploymentTypeSingleAz1),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckOpenZFSFileSystemExists(ctx, resourceName, &filesystem),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "fsx", regexache.MustCompile(`file-system/fs-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "automatic_backup_retention_days", "0"),
-					resource.TestCheckResourceAttr(resourceName, "storage_type", fsx.StorageTypeSsd),
-					resource.TestCheckResourceAttrSet(resourceName, "kms_key_id"),
-					resource.TestCheckResourceAttr(resourceName, "throughput_capacity", "64"),
+					resource.TestCheckNoResourceAttr(resourceName, "backup_id"),
+					resource.TestCheckResourceAttr(resourceName, "copy_tags_to_backups", "false"),
+					resource.TestCheckResourceAttr(resourceName, "copy_tags_to_volumes", "false"),
+					resource.TestCheckResourceAttr(resourceName, "daily_automatic_backup_start_time", ""),
+					resource.TestCheckResourceAttr(resourceName, "deployment_type", fsx.OpenZFSDeploymentTypeSingleAz1),
 					resource.TestCheckResourceAttr(resourceName, "disk_iops_configuration.#", "1"),
-					resource.TestCheckResourceAttr(resourceName, "disk_iops_configuration.0.mode", "AUTOMATIC"),
 					resource.TestCheckResourceAttr(resourceName, "disk_iops_configuration.0.iops", "192"),
+					resource.TestCheckResourceAttr(resourceName, "disk_iops_configuration.0.mode", "AUTOMATIC"),
+					resource.TestCheckResourceAttrSet(resourceName, "dns_name"),
+					resource.TestCheckResourceAttr(resourceName, "endpoint_ip_address_range", ""),
+					resource.TestCheckResourceAttrSet(resourceName, "kms_key_id"),
+					resource.TestCheckResourceAttr(resourceName, "network_interface_ids.#", "1"),
+					acctest.CheckResourceAttrAccountID(resourceName, "owner_id"),
+					resource.TestCheckResourceAttr(resourceName, "preferred_subnet_id", ""),
 					resource.TestCheckResourceAttr(resourceName, "root_volume_configuration.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "root_volume_configuration.0.data_compression_type", "NONE"),
 					resource.TestCheckResourceAttr(resourceName, "root_volume_configuration.0.nfs_exports.#", "1"),
@@ -73,19 +73,29 @@ func TestAccFSxOpenzfsFileSystem_basic(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "root_volume_configuration.0.read_only", "false"),
 					resource.TestCheckResourceAttr(resourceName, "root_volume_configuration.0.record_size_kib", "128"),
 					resource.TestCheckResourceAttr(resourceName, "root_volume_configuration.0.user_and_group_quotas.#", "2"),
+					resource.TestCheckResourceAttrSet(resourceName, "root_volume_id"),
+					resource.TestCheckResourceAttr(resourceName, "route_table_ids.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "security_group_ids.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "storage_capacity", "64"),
+					resource.TestCheckResourceAttr(resourceName, "storage_type", fsx.StorageTypeSsd),
+					resource.TestCheckResourceAttr(resourceName, "subnet_ids.#", "1"),
+					resource.TestCheckTypeSetElemAttrPair(resourceName, "subnet_ids.*", "aws_subnet.test.0", "id"),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
+					resource.TestCheckResourceAttr(resourceName, "throughput_capacity", "64"),
+					resource.TestCheckResourceAttrPair(resourceName, "vpc_id", "aws_vpc.test", "id"),
+					resource.TestMatchResourceAttr(resourceName, "weekly_maintenance_start_time", regexache.MustCompile(`^\d:\d\d:\d\d$`)),
 				),
 			},
 			{
-				ResourceName:            resourceName,
-				ImportState:             true,
-				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"security_group_ids"},
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
 			},
 		},
 	})
 }
 
-func TestAccFSxOpenzfsFileSystem_diskIops(t *testing.T) {
+func TestAccFSxOpenZFSFileSystem_diskIops(t *testing.T) {
 	ctx := acctest.Context(t)
 	var filesystem fsx.FileSystem
 	resourceName := "aws_fsx_openzfs_file_system.test"
@@ -95,12 +105,12 @@ func TestAccFSxOpenzfsFileSystem_diskIops(t *testing.T) {
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
 		ErrorCheck:               acctest.ErrorCheck(t, fsx.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckOpenzfsFileSystemDestroy(ctx),
+		CheckDestroy:             testAccCheckOpenZFSFileSystemDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccOpenZFSFileSystemConfig_diskIOPSConfiguration(rName, 192),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOpenzfsFileSystemExists(ctx, resourceName, &filesystem),
+					testAccCheckOpenZFSFileSystemExists(ctx, resourceName, &filesystem),
 					resource.TestCheckResourceAttr(resourceName, "disk_iops_configuration.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "disk_iops_configuration.0.mode", "USER_PROVISIONED"),
 					resource.TestCheckResourceAttr(resourceName, "disk_iops_configuration.0.iops", "192"),
@@ -115,7 +125,7 @@ func TestAccFSxOpenzfsFileSystem_diskIops(t *testing.T) {
 			{
 				Config: testAccOpenZFSFileSystemConfig_diskIOPSConfiguration(rName, 200),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOpenzfsFileSystemExists(ctx, resourceName, &filesystem),
+					testAccCheckOpenZFSFileSystemExists(ctx, resourceName, &filesystem),
 					resource.TestCheckResourceAttr(resourceName, "disk_iops_configuration.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "disk_iops_configuration.0.mode", "USER_PROVISIONED"),
 					resource.TestCheckResourceAttr(resourceName, "disk_iops_configuration.0.iops", "200"),
@@ -125,7 +135,7 @@ func TestAccFSxOpenzfsFileSystem_diskIops(t *testing.T) {
 	})
 }
 
-func TestAccFSxOpenzfsFileSystem_disappears(t *testing.T) {
+func TestAccFSxOpenZFSFileSystem_disappears(t *testing.T) {
 	ctx := acctest.Context(t)
 	var filesystem fsx.FileSystem
 	resourceName := "aws_fsx_openzfs_file_system.test"
@@ -135,13 +145,13 @@ func TestAccFSxOpenzfsFileSystem_disappears(t *testing.T) {
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
 		ErrorCheck:               acctest.ErrorCheck(t, fsx.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckOpenzfsFileSystemDestroy(ctx),
+		CheckDestroy:             testAccCheckOpenZFSFileSystemDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccOpenZFSFileSystemConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOpenzfsFileSystemExists(ctx, resourceName, &filesystem),
-					acctest.CheckResourceDisappears(ctx, acctest.Provider, tffsx.ResourceOpenzfsFileSystem(), resourceName),
+					testAccCheckOpenZFSFileSystemExists(ctx, resourceName, &filesystem),
+					acctest.CheckResourceDisappears(ctx, acctest.Provider, tffsx.ResourceOpenZFSFileSystem(), resourceName),
 				),
 				ExpectNonEmptyPlan: true,
 			},
@@ -149,7 +159,7 @@ func TestAccFSxOpenzfsFileSystem_disappears(t *testing.T) {
 	})
 }
 
-func TestAccFSxOpenzfsFileSystem_rootVolume(t *testing.T) {
+func TestAccFSxOpenZFSFileSystem_rootVolume(t *testing.T) {
 	ctx := acctest.Context(t)
 	var filesystem1, filesystem2, filesystem3 fsx.FileSystem
 	resourceName := "aws_fsx_openzfs_file_system.test"
@@ -159,12 +169,12 @@ func TestAccFSxOpenzfsFileSystem_rootVolume(t *testing.T) {
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
 		ErrorCheck:               acctest.ErrorCheck(t, fsx.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckOpenzfsFileSystemDestroy(ctx),
+		CheckDestroy:             testAccCheckOpenZFSFileSystemDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccOpenZFSFileSystemConfig_rootVolume1(rName, "NONE", "false", 128),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOpenzfsFileSystemExists(ctx, resourceName, &filesystem1),
+					testAccCheckOpenZFSFileSystemExists(ctx, resourceName, &filesystem1),
 					resource.TestCheckResourceAttr(resourceName, "root_volume_configuration.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "root_volume_configuration.0.data_compression_type", "NONE"),
 					resource.TestCheckResourceAttr(resourceName, "root_volume_configuration.0.nfs_exports.#", "1"),
@@ -175,12 +185,22 @@ func TestAccFSxOpenzfsFileSystem_rootVolume(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "root_volume_configuration.0.nfs_exports.0.client_configurations.0.options.1", "rw"),
 					resource.TestCheckResourceAttr(resourceName, "root_volume_configuration.0.read_only", "false"),
 					resource.TestCheckResourceAttr(resourceName, "root_volume_configuration.0.record_size_kib", "128"),
-					resource.TestCheckResourceAttr(resourceName, "root_volume_configuration.0.user_and_group_quotas.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "root_volume_configuration.0.user_and_group_quotas.#", "3"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "root_volume_configuration.0.user_and_group_quotas.*", map[string]string{
 						"id":                         "10",
 						"storage_capacity_quota_gib": "128",
 						"type":                       "USER",
 					}),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "root_volume_configuration.0.user_and_group_quotas.*", map[string]string{
+						"id":                         "0",
+						"storage_capacity_quota_gib": "0",
+						"type":                       "USER",
+					}),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "root_volume_configuration.0.user_and_group_quotas.*", map[string]string{
+						"id":                         "0",
+						"storage_capacity_quota_gib": "0",
+						"type":                       "GROUP",
+					}),
 				),
 			},
 			{
@@ -192,8 +212,8 @@ func TestAccFSxOpenzfsFileSystem_rootVolume(t *testing.T) {
 			{
 				Config: testAccOpenZFSFileSystemConfig_rootVolume2(rName, "ZSTD", "true", 256, 8),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOpenzfsFileSystemExists(ctx, resourceName, &filesystem2),
-					testAccCheckOpenzfsFileSystemNotRecreated(&filesystem1, &filesystem2),
+					testAccCheckOpenZFSFileSystemExists(ctx, resourceName, &filesystem2),
+					testAccCheckOpenZFSFileSystemNotRecreated(&filesystem1, &filesystem2),
 					resource.TestCheckResourceAttr(resourceName, "root_volume_configuration.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "root_volume_configuration.0.data_compression_type", "ZSTD"),
 					resource.TestCheckResourceAttr(resourceName, "root_volume_configuration.0.nfs_exports.#", "1"),
@@ -204,19 +224,29 @@ func TestAccFSxOpenzfsFileSystem_rootVolume(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "root_volume_configuration.0.nfs_exports.0.client_configurations.0.options.1", "rw"),
 					resource.TestCheckResourceAttr(resourceName, "root_volume_configuration.0.read_only", "true"),
 					resource.TestCheckResourceAttr(resourceName, "root_volume_configuration.0.record_size_kib", "8"),
-					resource.TestCheckResourceAttr(resourceName, "root_volume_configuration.0.user_and_group_quotas.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "root_volume_configuration.0.user_and_group_quotas.#", "3"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "root_volume_configuration.0.user_and_group_quotas.*", map[string]string{
 						"id":                         "10",
 						"storage_capacity_quota_gib": "256",
 						"type":                       "USER",
 					}),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "root_volume_configuration.0.user_and_group_quotas.*", map[string]string{
+						"id":                         "0",
+						"storage_capacity_quota_gib": "0",
+						"type":                       "USER",
+					}),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "root_volume_configuration.0.user_and_group_quotas.*", map[string]string{
+						"id":                         "0",
+						"storage_capacity_quota_gib": "0",
+						"type":                       "GROUP",
+					}),
 				),
 			},
 			{
 				Config: testAccOpenZFSFileSystemConfig_rootVolume3Client(rName, "NONE", "false", 128, 1024, 512),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOpenzfsFileSystemExists(ctx, resourceName, &filesystem3),
-					testAccCheckOpenzfsFileSystemNotRecreated(&filesystem1, &filesystem3),
+					testAccCheckOpenZFSFileSystemExists(ctx, resourceName, &filesystem3),
+					testAccCheckOpenZFSFileSystemNotRecreated(&filesystem1, &filesystem3),
 					resource.TestCheckResourceAttr(resourceName, "root_volume_configuration.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "root_volume_configuration.0.data_compression_type", "NONE"),
 					resource.TestCheckResourceAttr(resourceName, "root_volume_configuration.0.nfs_exports.#", "1"),
@@ -233,7 +263,7 @@ func TestAccFSxOpenzfsFileSystem_rootVolume(t *testing.T) {
 					}),
 					resource.TestCheckResourceAttr(resourceName, "root_volume_configuration.0.read_only", "false"),
 					resource.TestCheckResourceAttr(resourceName, "root_volume_configuration.0.record_size_kib", "512"),
-					resource.TestCheckResourceAttr(resourceName, "root_volume_configuration.0.user_and_group_quotas.#", "4"),
+					resource.TestCheckResourceAttr(resourceName, "root_volume_configuration.0.user_and_group_quotas.#", "6"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "root_volume_configuration.0.user_and_group_quotas.*", map[string]string{
 						"id":                         "10",
 						"storage_capacity_quota_gib": "128",
@@ -254,18 +284,28 @@ func TestAccFSxOpenzfsFileSystem_rootVolume(t *testing.T) {
 						"storage_capacity_quota_gib": "128",
 						"type":                       "USER",
 					}),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "root_volume_configuration.0.user_and_group_quotas.*", map[string]string{
+						"id":                         "0",
+						"storage_capacity_quota_gib": "0",
+						"type":                       "USER",
+					}),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "root_volume_configuration.0.user_and_group_quotas.*", map[string]string{
+						"id":                         "0",
+						"storage_capacity_quota_gib": "0",
+						"type":                       "GROUP",
+					}),
 				),
 			},
 			{
 				Config: testAccOpenZFSFileSystemConfig_rootVolume4(rName, "NONE", "false", 128, 1024),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOpenzfsFileSystemExists(ctx, resourceName, &filesystem1),
+					testAccCheckOpenZFSFileSystemExists(ctx, resourceName, &filesystem1),
 					resource.TestCheckResourceAttr(resourceName, "root_volume_configuration.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "root_volume_configuration.0.data_compression_type", "NONE"),
 					resource.TestCheckResourceAttr(resourceName, "root_volume_configuration.0.nfs_exports.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "root_volume_configuration.0.read_only", "false"),
 					resource.TestCheckResourceAttr(resourceName, "root_volume_configuration.0.record_size_kib", "128"),
-					resource.TestCheckResourceAttr(resourceName, "root_volume_configuration.0.user_and_group_quotas.#", "4"),
+					resource.TestCheckResourceAttr(resourceName, "root_volume_configuration.0.user_and_group_quotas.#", "6"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "root_volume_configuration.0.user_and_group_quotas.*", map[string]string{
 						"id":                         "10",
 						"storage_capacity_quota_gib": "128",
@@ -286,13 +326,23 @@ func TestAccFSxOpenzfsFileSystem_rootVolume(t *testing.T) {
 						"storage_capacity_quota_gib": "128",
 						"type":                       "USER",
 					}),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "root_volume_configuration.0.user_and_group_quotas.*", map[string]string{
+						"id":                         "0",
+						"storage_capacity_quota_gib": "0",
+						"type":                       "USER",
+					}),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "root_volume_configuration.0.user_and_group_quotas.*", map[string]string{
+						"id":                         "0",
+						"storage_capacity_quota_gib": "0",
+						"type":                       "GROUP",
+					}),
 				),
 			},
 		},
 	})
 }
 
-func TestAccFSxOpenzfsFileSystem_securityGroupIDs(t *testing.T) {
+func TestAccFSxOpenZFSFileSystem_securityGroupIDs(t *testing.T) {
 	ctx := acctest.Context(t)
 	var filesystem1, filesystem2 fsx.FileSystem
 	resourceName := "aws_fsx_openzfs_file_system.test"
@@ -302,12 +352,12 @@ func TestAccFSxOpenzfsFileSystem_securityGroupIDs(t *testing.T) {
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
 		ErrorCheck:               acctest.ErrorCheck(t, fsx.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckOpenzfsFileSystemDestroy(ctx),
+		CheckDestroy:             testAccCheckOpenZFSFileSystemDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccOpenZFSFileSystemConfig_securityGroupIDs1(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOpenzfsFileSystemExists(ctx, resourceName, &filesystem1),
+					testAccCheckOpenZFSFileSystemExists(ctx, resourceName, &filesystem1),
 					resource.TestCheckResourceAttr(resourceName, "security_group_ids.#", "1"),
 				),
 			},
@@ -320,8 +370,8 @@ func TestAccFSxOpenzfsFileSystem_securityGroupIDs(t *testing.T) {
 			{
 				Config: testAccOpenZFSFileSystemConfig_securityGroupIDs2(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOpenzfsFileSystemExists(ctx, resourceName, &filesystem2),
-					testAccCheckOpenzfsFileSystemRecreated(&filesystem1, &filesystem2),
+					testAccCheckOpenZFSFileSystemExists(ctx, resourceName, &filesystem2),
+					testAccCheckOpenZFSFileSystemRecreated(&filesystem1, &filesystem2),
 					resource.TestCheckResourceAttr(resourceName, "security_group_ids.#", "2"),
 				),
 			},
@@ -329,7 +379,7 @@ func TestAccFSxOpenzfsFileSystem_securityGroupIDs(t *testing.T) {
 	})
 }
 
-func TestAccFSxOpenzfsFileSystem_tags(t *testing.T) {
+func TestAccFSxOpenZFSFileSystem_tags(t *testing.T) {
 	ctx := acctest.Context(t)
 	var filesystem1, filesystem2, filesystem3 fsx.FileSystem
 	resourceName := "aws_fsx_openzfs_file_system.test"
@@ -339,12 +389,12 @@ func TestAccFSxOpenzfsFileSystem_tags(t *testing.T) {
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
 		ErrorCheck:               acctest.ErrorCheck(t, fsx.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckOpenzfsFileSystemDestroy(ctx),
+		CheckDestroy:             testAccCheckOpenZFSFileSystemDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccOpenZFSFileSystemConfig_tags1(rName, "key1", "value1"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOpenzfsFileSystemExists(ctx, resourceName, &filesystem1),
+					testAccCheckOpenZFSFileSystemExists(ctx, resourceName, &filesystem1),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
 				),
@@ -358,8 +408,8 @@ func TestAccFSxOpenzfsFileSystem_tags(t *testing.T) {
 			{
 				Config: testAccOpenZFSFileSystemConfig_tags2(rName, "key1", "value1updated", "key2", "value2"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOpenzfsFileSystemExists(ctx, resourceName, &filesystem2),
-					testAccCheckOpenzfsFileSystemNotRecreated(&filesystem1, &filesystem2),
+					testAccCheckOpenZFSFileSystemExists(ctx, resourceName, &filesystem2),
+					testAccCheckOpenZFSFileSystemNotRecreated(&filesystem1, &filesystem2),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1updated"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
@@ -368,8 +418,8 @@ func TestAccFSxOpenzfsFileSystem_tags(t *testing.T) {
 			{
 				Config: testAccOpenZFSFileSystemConfig_tags1(rName, "key2", "value2"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOpenzfsFileSystemExists(ctx, resourceName, &filesystem3),
-					testAccCheckOpenzfsFileSystemNotRecreated(&filesystem2, &filesystem3),
+					testAccCheckOpenZFSFileSystemExists(ctx, resourceName, &filesystem3),
+					testAccCheckOpenZFSFileSystemNotRecreated(&filesystem2, &filesystem3),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
 				),
@@ -378,7 +428,7 @@ func TestAccFSxOpenzfsFileSystem_tags(t *testing.T) {
 	})
 }
 
-func TestAccFSxOpenzfsFileSystem_copyTags(t *testing.T) {
+func TestAccFSxOpenZFSFileSystem_copyTags(t *testing.T) {
 	ctx := acctest.Context(t)
 	var filesystem1, filesystem2 fsx.FileSystem
 	resourceName := "aws_fsx_openzfs_file_system.test"
@@ -388,12 +438,12 @@ func TestAccFSxOpenzfsFileSystem_copyTags(t *testing.T) {
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
 		ErrorCheck:               acctest.ErrorCheck(t, fsx.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckOpenzfsFileSystemDestroy(ctx),
+		CheckDestroy:             testAccCheckOpenZFSFileSystemDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccOpenZFSFileSystemConfig_copyTags(rName, "key1", "value1", "true"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOpenzfsFileSystemExists(ctx, resourceName, &filesystem1),
+					testAccCheckOpenZFSFileSystemExists(ctx, resourceName, &filesystem1),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
 					resource.TestCheckResourceAttr(resourceName, "copy_tags_to_backups", "true"),
@@ -409,8 +459,8 @@ func TestAccFSxOpenzfsFileSystem_copyTags(t *testing.T) {
 			{
 				Config: testAccOpenZFSFileSystemConfig_copyTags(rName, "key1", "value1", "false"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOpenzfsFileSystemExists(ctx, resourceName, &filesystem2),
-					testAccCheckOpenzfsFileSystemNotRecreated(&filesystem1, &filesystem2),
+					testAccCheckOpenZFSFileSystemExists(ctx, resourceName, &filesystem2),
+					testAccCheckOpenZFSFileSystemNotRecreated(&filesystem1, &filesystem2),
 					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
 					resource.TestCheckResourceAttr(resourceName, "copy_tags_to_backups", "false"),
 					resource.TestCheckResourceAttr(resourceName, "copy_tags_to_volumes", "false"),
@@ -420,7 +470,7 @@ func TestAccFSxOpenzfsFileSystem_copyTags(t *testing.T) {
 	})
 }
 
-func TestAccFSxOpenzfsFileSystem_throughput(t *testing.T) {
+func TestAccFSxOpenZFSFileSystem_throughput(t *testing.T) {
 	ctx := acctest.Context(t)
 	var filesystem1, filesystem2 fsx.FileSystem
 	resourceName := "aws_fsx_openzfs_file_system.test"
@@ -430,12 +480,12 @@ func TestAccFSxOpenzfsFileSystem_throughput(t *testing.T) {
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
 		ErrorCheck:               acctest.ErrorCheck(t, fsx.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckOpenzfsFileSystemDestroy(ctx),
+		CheckDestroy:             testAccCheckOpenZFSFileSystemDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccOpenZFSFileSystemConfig_throughput(rName, 64),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOpenzfsFileSystemExists(ctx, resourceName, &filesystem1),
+					testAccCheckOpenZFSFileSystemExists(ctx, resourceName, &filesystem1),
 					resource.TestCheckResourceAttr(resourceName, "throughput_capacity", "64"),
 				),
 			},
@@ -448,8 +498,8 @@ func TestAccFSxOpenzfsFileSystem_throughput(t *testing.T) {
 			{
 				Config: testAccOpenZFSFileSystemConfig_throughput(rName, 128),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOpenzfsFileSystemExists(ctx, resourceName, &filesystem2),
-					testAccCheckOpenzfsFileSystemNotRecreated(&filesystem1, &filesystem2),
+					testAccCheckOpenZFSFileSystemExists(ctx, resourceName, &filesystem2),
+					testAccCheckOpenZFSFileSystemNotRecreated(&filesystem1, &filesystem2),
 					resource.TestCheckResourceAttr(resourceName, "throughput_capacity", "128"),
 				),
 			},
@@ -457,7 +507,7 @@ func TestAccFSxOpenzfsFileSystem_throughput(t *testing.T) {
 	})
 }
 
-func TestAccFSxOpenzfsFileSystem_storageType(t *testing.T) {
+func TestAccFSxOpenZFSFileSystem_storageType(t *testing.T) {
 	ctx := acctest.Context(t)
 	var filesystem1 fsx.FileSystem
 	resourceName := "aws_fsx_openzfs_file_system.test"
@@ -467,12 +517,12 @@ func TestAccFSxOpenzfsFileSystem_storageType(t *testing.T) {
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
 		ErrorCheck:               acctest.ErrorCheck(t, fsx.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckOpenzfsFileSystemDestroy(ctx),
+		CheckDestroy:             testAccCheckOpenZFSFileSystemDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccOpenZFSFileSystemConfig_storageType(rName, "SSD"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOpenzfsFileSystemExists(ctx, resourceName, &filesystem1),
+					testAccCheckOpenZFSFileSystemExists(ctx, resourceName, &filesystem1),
 					resource.TestCheckResourceAttr(resourceName, "storage_type", "SSD"),
 				),
 			},
@@ -486,7 +536,7 @@ func TestAccFSxOpenzfsFileSystem_storageType(t *testing.T) {
 	})
 }
 
-func TestAccFSxOpenzfsFileSystem_weeklyMaintenanceStartTime(t *testing.T) {
+func TestAccFSxOpenZFSFileSystem_weeklyMaintenanceStartTime(t *testing.T) {
 	ctx := acctest.Context(t)
 	var filesystem1, filesystem2 fsx.FileSystem
 	resourceName := "aws_fsx_openzfs_file_system.test"
@@ -496,12 +546,12 @@ func TestAccFSxOpenzfsFileSystem_weeklyMaintenanceStartTime(t *testing.T) {
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
 		ErrorCheck:               acctest.ErrorCheck(t, fsx.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckOpenzfsFileSystemDestroy(ctx),
+		CheckDestroy:             testAccCheckOpenZFSFileSystemDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccOpenZFSFileSystemConfig_weeklyMaintenanceStartTime(rName, "1:01:01"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOpenzfsFileSystemExists(ctx, resourceName, &filesystem1),
+					testAccCheckOpenZFSFileSystemExists(ctx, resourceName, &filesystem1),
 					resource.TestCheckResourceAttr(resourceName, "weekly_maintenance_start_time", "1:01:01"),
 				),
 			},
@@ -514,8 +564,8 @@ func TestAccFSxOpenzfsFileSystem_weeklyMaintenanceStartTime(t *testing.T) {
 			{
 				Config: testAccOpenZFSFileSystemConfig_weeklyMaintenanceStartTime(rName, "2:02:02"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOpenzfsFileSystemExists(ctx, resourceName, &filesystem2),
-					testAccCheckOpenzfsFileSystemNotRecreated(&filesystem1, &filesystem2),
+					testAccCheckOpenZFSFileSystemExists(ctx, resourceName, &filesystem2),
+					testAccCheckOpenZFSFileSystemNotRecreated(&filesystem1, &filesystem2),
 					resource.TestCheckResourceAttr(resourceName, "weekly_maintenance_start_time", "2:02:02"),
 				),
 			},
@@ -523,7 +573,7 @@ func TestAccFSxOpenzfsFileSystem_weeklyMaintenanceStartTime(t *testing.T) {
 	})
 }
 
-func TestAccFSxOpenzfsFileSystem_automaticBackupRetentionDays(t *testing.T) {
+func TestAccFSxOpenZFSFileSystem_automaticBackupRetentionDays(t *testing.T) {
 	ctx := acctest.Context(t)
 	var filesystem1, filesystem2 fsx.FileSystem
 	resourceName := "aws_fsx_openzfs_file_system.test"
@@ -533,12 +583,12 @@ func TestAccFSxOpenzfsFileSystem_automaticBackupRetentionDays(t *testing.T) {
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
 		ErrorCheck:               acctest.ErrorCheck(t, fsx.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckOpenzfsFileSystemDestroy(ctx),
+		CheckDestroy:             testAccCheckOpenZFSFileSystemDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccOpenZFSFileSystemConfig_automaticBackupRetentionDays(rName, 90),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOpenzfsFileSystemExists(ctx, resourceName, &filesystem1),
+					testAccCheckOpenZFSFileSystemExists(ctx, resourceName, &filesystem1),
 					resource.TestCheckResourceAttr(resourceName, "automatic_backup_retention_days", "90"),
 				),
 			},
@@ -551,15 +601,15 @@ func TestAccFSxOpenzfsFileSystem_automaticBackupRetentionDays(t *testing.T) {
 			{
 				Config: testAccOpenZFSFileSystemConfig_automaticBackupRetentionDays(rName, 0),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOpenzfsFileSystemExists(ctx, resourceName, &filesystem2),
-					testAccCheckOpenzfsFileSystemNotRecreated(&filesystem1, &filesystem2),
+					testAccCheckOpenZFSFileSystemExists(ctx, resourceName, &filesystem2),
+					testAccCheckOpenZFSFileSystemNotRecreated(&filesystem1, &filesystem2),
 					resource.TestCheckResourceAttr(resourceName, "automatic_backup_retention_days", "0"),
 				),
 			},
 			{
 				Config: testAccOpenZFSFileSystemConfig_automaticBackupRetentionDays(rName, 1),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOpenzfsFileSystemExists(ctx, resourceName, &filesystem1),
+					testAccCheckOpenZFSFileSystemExists(ctx, resourceName, &filesystem1),
 					resource.TestCheckResourceAttr(resourceName, "automatic_backup_retention_days", "1"),
 				),
 			},
@@ -567,7 +617,7 @@ func TestAccFSxOpenzfsFileSystem_automaticBackupRetentionDays(t *testing.T) {
 	})
 }
 
-func TestAccFSxOpenzfsFileSystem_kmsKeyID(t *testing.T) {
+func TestAccFSxOpenZFSFileSystem_kmsKeyID(t *testing.T) {
 	ctx := acctest.Context(t)
 	var filesystem fsx.FileSystem
 	resourceName := "aws_fsx_openzfs_file_system.test"
@@ -577,12 +627,12 @@ func TestAccFSxOpenzfsFileSystem_kmsKeyID(t *testing.T) {
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
 		ErrorCheck:               acctest.ErrorCheck(t, fsx.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckOpenzfsFileSystemDestroy(ctx),
+		CheckDestroy:             testAccCheckOpenZFSFileSystemDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccOpenZFSFileSystemConfig_kmsKeyID(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOpenzfsFileSystemExists(ctx, resourceName, &filesystem),
+					testAccCheckOpenZFSFileSystemExists(ctx, resourceName, &filesystem),
 					resource.TestCheckResourceAttrPair(resourceName, "kms_key_id", "aws_kms_key.test", "arn"),
 				),
 			},
@@ -596,7 +646,7 @@ func TestAccFSxOpenzfsFileSystem_kmsKeyID(t *testing.T) {
 	})
 }
 
-func TestAccFSxOpenzfsFileSystem_dailyAutomaticBackupStartTime(t *testing.T) {
+func TestAccFSxOpenZFSFileSystem_dailyAutomaticBackupStartTime(t *testing.T) {
 	ctx := acctest.Context(t)
 	var filesystem1, filesystem2 fsx.FileSystem
 	resourceName := "aws_fsx_openzfs_file_system.test"
@@ -606,12 +656,12 @@ func TestAccFSxOpenzfsFileSystem_dailyAutomaticBackupStartTime(t *testing.T) {
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
 		ErrorCheck:               acctest.ErrorCheck(t, fsx.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckOpenzfsFileSystemDestroy(ctx),
+		CheckDestroy:             testAccCheckOpenZFSFileSystemDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccOpenZFSFileSystemConfig_dailyAutomaticBackupStartTime(rName, "01:01"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOpenzfsFileSystemExists(ctx, resourceName, &filesystem1),
+					testAccCheckOpenZFSFileSystemExists(ctx, resourceName, &filesystem1),
 					resource.TestCheckResourceAttr(resourceName, "daily_automatic_backup_start_time", "01:01"),
 				),
 			},
@@ -624,8 +674,8 @@ func TestAccFSxOpenzfsFileSystem_dailyAutomaticBackupStartTime(t *testing.T) {
 			{
 				Config: testAccOpenZFSFileSystemConfig_dailyAutomaticBackupStartTime(rName, "02:02"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOpenzfsFileSystemExists(ctx, resourceName, &filesystem2),
-					testAccCheckOpenzfsFileSystemNotRecreated(&filesystem1, &filesystem2),
+					testAccCheckOpenZFSFileSystemExists(ctx, resourceName, &filesystem2),
+					testAccCheckOpenZFSFileSystemNotRecreated(&filesystem1, &filesystem2),
 					resource.TestCheckResourceAttr(resourceName, "daily_automatic_backup_start_time", "02:02"),
 				),
 			},
@@ -633,7 +683,7 @@ func TestAccFSxOpenzfsFileSystem_dailyAutomaticBackupStartTime(t *testing.T) {
 	})
 }
 
-func TestAccFSxOpenzfsFileSystem_throughputCapacity(t *testing.T) {
+func TestAccFSxOpenZFSFileSystem_throughputCapacity(t *testing.T) {
 	ctx := acctest.Context(t)
 	var filesystem1, filesystem2 fsx.FileSystem
 	resourceName := "aws_fsx_openzfs_file_system.test"
@@ -643,12 +693,12 @@ func TestAccFSxOpenzfsFileSystem_throughputCapacity(t *testing.T) {
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
 		ErrorCheck:               acctest.ErrorCheck(t, fsx.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckOpenzfsFileSystemDestroy(ctx),
+		CheckDestroy:             testAccCheckOpenZFSFileSystemDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccOpenZFSFileSystemConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOpenzfsFileSystemExists(ctx, resourceName, &filesystem1),
+					testAccCheckOpenZFSFileSystemExists(ctx, resourceName, &filesystem1),
 					resource.TestCheckResourceAttr(resourceName, "throughput_capacity", "64"),
 				),
 			},
@@ -659,10 +709,10 @@ func TestAccFSxOpenzfsFileSystem_throughputCapacity(t *testing.T) {
 				ImportStateVerifyIgnore: []string{"security_group_ids"},
 			},
 			{
-				Config: testAccOpenzfsFileSystemConfig_throughputCapacity(rName),
+				Config: testAccOpenZFSFileSystemConfig_throughputCapacity(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOpenzfsFileSystemExists(ctx, resourceName, &filesystem2),
-					testAccCheckOpenzfsFileSystemNotRecreated(&filesystem1, &filesystem2),
+					testAccCheckOpenZFSFileSystemExists(ctx, resourceName, &filesystem2),
+					testAccCheckOpenZFSFileSystemNotRecreated(&filesystem1, &filesystem2),
 					resource.TestCheckResourceAttr(resourceName, "throughput_capacity", "128"),
 				),
 			},
@@ -670,7 +720,7 @@ func TestAccFSxOpenzfsFileSystem_throughputCapacity(t *testing.T) {
 	})
 }
 
-func TestAccFSxOpenzfsFileSystem_storageCapacity(t *testing.T) {
+func TestAccFSxOpenZFSFileSystem_storageCapacity(t *testing.T) {
 	ctx := acctest.Context(t)
 	var filesystem1, filesystem2 fsx.FileSystem
 	resourceName := "aws_fsx_openzfs_file_system.test"
@@ -680,12 +730,12 @@ func TestAccFSxOpenzfsFileSystem_storageCapacity(t *testing.T) {
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
 		ErrorCheck:               acctest.ErrorCheck(t, fsx.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckOpenzfsFileSystemDestroy(ctx),
+		CheckDestroy:             testAccCheckOpenZFSFileSystemDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccOpenZFSFileSystemConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOpenzfsFileSystemExists(ctx, resourceName, &filesystem1),
+					testAccCheckOpenZFSFileSystemExists(ctx, resourceName, &filesystem1),
 					resource.TestCheckResourceAttr(resourceName, "storage_capacity", "64"),
 				),
 			},
@@ -696,10 +746,10 @@ func TestAccFSxOpenzfsFileSystem_storageCapacity(t *testing.T) {
 				ImportStateVerifyIgnore: []string{"security_group_ids"},
 			},
 			{
-				Config: testAccOpenzfsFileSystemConfig_storageCapacity(rName),
+				Config: testAccOpenZFSFileSystemConfig_storageCapacity(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOpenzfsFileSystemExists(ctx, resourceName, &filesystem2),
-					testAccCheckOpenzfsFileSystemNotRecreated(&filesystem1, &filesystem2),
+					testAccCheckOpenZFSFileSystemExists(ctx, resourceName, &filesystem2),
+					testAccCheckOpenZFSFileSystemNotRecreated(&filesystem1, &filesystem2),
 					resource.TestCheckResourceAttr(resourceName, "storage_capacity", "75"),
 				),
 			},
@@ -707,7 +757,7 @@ func TestAccFSxOpenzfsFileSystem_storageCapacity(t *testing.T) {
 	})
 }
 
-func TestAccFSxOpenzfsFileSystem_deploymentType(t *testing.T) {
+func TestAccFSxOpenZFSFileSystem_deploymentType(t *testing.T) {
 	ctx := acctest.Context(t)
 	var filesystem1, filesystem2 fsx.FileSystem
 	resourceName := "aws_fsx_openzfs_file_system.test"
@@ -717,12 +767,12 @@ func TestAccFSxOpenzfsFileSystem_deploymentType(t *testing.T) {
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
 		ErrorCheck:               acctest.ErrorCheck(t, fsx.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckOpenzfsFileSystemDestroy(ctx),
+		CheckDestroy:             testAccCheckOpenZFSFileSystemDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccOpenzfsFileSystemConfig_deploymentType(rName, "SINGLE_AZ_1", 64),
+				Config: testAccOpenZFSFileSystemConfig_deploymentType(rName, "SINGLE_AZ_1", 64),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOpenzfsFileSystemExists(ctx, resourceName, &filesystem1),
+					testAccCheckOpenZFSFileSystemExists(ctx, resourceName, &filesystem1),
 					resource.TestCheckResourceAttr(resourceName, "deployment_type", "SINGLE_AZ_1"),
 					resource.TestCheckResourceAttr(resourceName, "throughput_capacity", "64"),
 				),
@@ -734,10 +784,10 @@ func TestAccFSxOpenzfsFileSystem_deploymentType(t *testing.T) {
 				ImportStateVerifyIgnore: []string{"security_group_ids"},
 			},
 			{
-				Config: testAccOpenzfsFileSystemConfig_deploymentType(rName, "SINGLE_AZ_2", 160),
+				Config: testAccOpenZFSFileSystemConfig_deploymentType(rName, "SINGLE_AZ_2", 160),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOpenzfsFileSystemExists(ctx, resourceName, &filesystem2),
-					testAccCheckOpenzfsFileSystemRecreated(&filesystem1, &filesystem2),
+					testAccCheckOpenZFSFileSystemExists(ctx, resourceName, &filesystem2),
+					testAccCheckOpenZFSFileSystemRecreated(&filesystem1, &filesystem2),
 					resource.TestCheckResourceAttr(resourceName, "deployment_type", "SINGLE_AZ_2"),
 					resource.TestCheckResourceAttr(resourceName, "throughput_capacity", "160"),
 				),
@@ -746,78 +796,196 @@ func TestAccFSxOpenzfsFileSystem_deploymentType(t *testing.T) {
 	})
 }
 
-func testAccCheckOpenzfsFileSystemExists(ctx context.Context, resourceName string, fs *fsx.FileSystem) resource.TestCheckFunc {
+func TestAccFSxOpenZFSFileSystem_multiAZ(t *testing.T) {
+	ctx := acctest.Context(t)
+	var filesystem fsx.FileSystem
+	resourceName := "aws_fsx_openzfs_file_system.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
+		ErrorCheck:               acctest.ErrorCheck(t, fsx.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckOpenZFSFileSystemDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccOpenZFSFileSystemConfig_multiAZ(rName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckOpenZFSFileSystemExists(ctx, resourceName, &filesystem),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "fsx", regexache.MustCompile(`file-system/fs-.+`)),
+					resource.TestCheckResourceAttr(resourceName, "automatic_backup_retention_days", "0"),
+					resource.TestCheckNoResourceAttr(resourceName, "backup_id"),
+					resource.TestCheckResourceAttr(resourceName, "copy_tags_to_backups", "false"),
+					resource.TestCheckResourceAttr(resourceName, "copy_tags_to_volumes", "false"),
+					resource.TestCheckResourceAttr(resourceName, "daily_automatic_backup_start_time", ""),
+					resource.TestCheckResourceAttr(resourceName, "deployment_type", fsx.OpenZFSDeploymentTypeMultiAz1),
+					resource.TestCheckResourceAttr(resourceName, "disk_iops_configuration.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "disk_iops_configuration.0.iops", "192"),
+					resource.TestCheckResourceAttr(resourceName, "disk_iops_configuration.0.mode", "AUTOMATIC"),
+					resource.TestCheckResourceAttrSet(resourceName, "dns_name"),
+					resource.TestCheckResourceAttrSet(resourceName, "endpoint_ip_address_range"),
+					resource.TestCheckResourceAttrSet(resourceName, "kms_key_id"),
+					resource.TestCheckResourceAttr(resourceName, "network_interface_ids.#", "2"),
+					acctest.CheckResourceAttrAccountID(resourceName, "owner_id"),
+					resource.TestCheckResourceAttrPair(resourceName, "preferred_subnet_id", "aws_subnet.test.0", "id"),
+					resource.TestCheckResourceAttr(resourceName, "root_volume_configuration.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "root_volume_configuration.0.data_compression_type", "NONE"),
+					resource.TestCheckResourceAttr(resourceName, "root_volume_configuration.0.nfs_exports.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "root_volume_configuration.0.nfs_exports.0.client_configurations.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "root_volume_configuration.0.nfs_exports.0.client_configurations.0.clients", "*"),
+					resource.TestCheckResourceAttr(resourceName, "root_volume_configuration.0.nfs_exports.0.client_configurations.0.options.#", "2"),
+					resource.TestCheckResourceAttr(resourceName, "root_volume_configuration.0.nfs_exports.0.client_configurations.0.options.0", "rw"),
+					resource.TestCheckResourceAttr(resourceName, "root_volume_configuration.0.nfs_exports.0.client_configurations.0.options.1", "crossmnt"),
+					resource.TestCheckResourceAttr(resourceName, "root_volume_configuration.0.read_only", "false"),
+					resource.TestCheckResourceAttr(resourceName, "root_volume_configuration.0.record_size_kib", "128"),
+					resource.TestCheckResourceAttr(resourceName, "root_volume_configuration.0.user_and_group_quotas.#", "2"),
+					resource.TestCheckResourceAttrSet(resourceName, "root_volume_id"),
+					resource.TestCheckResourceAttr(resourceName, "route_table_ids.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "security_group_ids.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "storage_capacity", "64"),
+					resource.TestCheckResourceAttr(resourceName, "storage_type", fsx.StorageTypeSsd),
+					resource.TestCheckResourceAttr(resourceName, "subnet_ids.#", "2"),
+					resource.TestCheckTypeSetElemAttrPair(resourceName, "subnet_ids.*", "aws_subnet.test.0", "id"),
+					resource.TestCheckTypeSetElemAttrPair(resourceName, "subnet_ids.*", "aws_subnet.test.1", "id"),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.Name", rName),
+					resource.TestCheckResourceAttr(resourceName, "throughput_capacity", "160"),
+					resource.TestCheckResourceAttrPair(resourceName, "vpc_id", "aws_vpc.test", "id"),
+					resource.TestMatchResourceAttr(resourceName, "weekly_maintenance_start_time", regexache.MustCompile(`^\d:\d\d:\d\d$`)),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
+func TestAccFSxOpenZFSFileSystem_routeTableIDs(t *testing.T) {
+	ctx := acctest.Context(t)
+	var filesystem fsx.FileSystem
+	resourceName := "aws_fsx_openzfs_file_system.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
+		ErrorCheck:               acctest.ErrorCheck(t, fsx.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckOpenZFSFileSystemDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccOpenZFSFileSystemConfig_routeTableIDs(rName, 1),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckOpenZFSFileSystemExists(ctx, resourceName, &filesystem),
+					resource.TestCheckResourceAttr(resourceName, "route_table_ids.#", "1"),
+					resource.TestCheckTypeSetElemAttrPair(resourceName, "route_table_ids.*", "aws_route_table.test.0", "id"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				Config: testAccOpenZFSFileSystemConfig_routeTableIDs(rName, 2),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckOpenZFSFileSystemExists(ctx, resourceName, &filesystem),
+					resource.TestCheckResourceAttr(resourceName, "route_table_ids.#", "2"),
+					resource.TestCheckTypeSetElemAttrPair(resourceName, "route_table_ids.*", "aws_route_table.test.0", "id"),
+					resource.TestCheckTypeSetElemAttrPair(resourceName, "route_table_ids.*", "aws_route_table.test.1", "id"),
+				),
+			},
+			{
+				Config: testAccOpenZFSFileSystemConfig_routeTableIDs(rName, 1),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckOpenZFSFileSystemExists(ctx, resourceName, &filesystem),
+					resource.TestCheckResourceAttr(resourceName, "route_table_ids.#", "1"),
+					resource.TestCheckTypeSetElemAttrPair(resourceName, "route_table_ids.*", "aws_route_table.test.0", "id"),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckOpenZFSFileSystemExists(ctx context.Context, n string, v *fsx.FileSystem) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		rs, ok := s.RootModule().Resources[resourceName]
+		rs, ok := s.RootModule().Resources[n]
 		if !ok {
-			return fmt.Errorf("Not found: %s", resourceName)
+			return fmt.Errorf("Not found: %s", n)
 		}
 
 		conn := acctest.Provider.Meta().(*conns.AWSClient).FSxConn(ctx)
 
-		filesystem, err := tffsx.FindFileSystemByID(ctx, conn, rs.Primary.ID)
+		output, err := tffsx.FindOpenZFSFileSystemByID(ctx, conn, rs.Primary.ID)
+
 		if err != nil {
 			return err
 		}
 
-		if filesystem == nil {
-			return fmt.Errorf("FSx Openzfs File System (%s) not found", rs.Primary.ID)
-		}
-
-		*fs = *filesystem
+		*v = *output
 
 		return nil
 	}
 }
 
-func testAccCheckOpenzfsFileSystemNotRecreated(i, j *fsx.FileSystem) resource.TestCheckFunc {
+func testAccCheckOpenZFSFileSystemDestroy(ctx context.Context) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		if aws.StringValue(i.FileSystemId) != aws.StringValue(j.FileSystemId) {
-			return fmt.Errorf("FSx OpenZFS File System (%s) recreated", aws.StringValue(i.FileSystemId))
+		conn := acctest.Provider.Meta().(*conns.AWSClient).FSxConn(ctx)
+
+		for _, rs := range s.RootModule().Resources {
+			if rs.Type != "aws_fsx_openzfs_file_system" {
+				continue
+			}
+
+			_, err := tffsx.FindOpenZFSFileSystemByID(ctx, conn, rs.Primary.ID)
+
+			if tfresource.NotFound(err) {
+				continue
+			}
+
+			if err != nil {
+				return err
+			}
+
+			return fmt.Errorf("FSx for OpenZFS File System %s still exists", rs.Primary.ID)
 		}
 
 		return nil
 	}
 }
 
-func testAccCheckOpenzfsFileSystemRecreated(i, j *fsx.FileSystem) resource.TestCheckFunc {
+func testAccCheckOpenZFSFileSystemNotRecreated(i, j *fsx.FileSystem) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		if aws.StringValue(i.FileSystemId) == aws.StringValue(j.FileSystemId) {
-			return fmt.Errorf("FSx OpenZFS File System (%s) not recreated", aws.StringValue(i.FileSystemId))
+		if aws.StringValue(i.FileSystemId) != aws.StringValue(j.FileSystemId) {
+			return fmt.Errorf("FSx for OpenZFS File System (%s) recreated", aws.StringValue(i.FileSystemId))
 		}
 
 		return nil
 	}
 }
 
-func testAccCheckOpenzfsFileSystemDestroy(ctx context.Context) resource.TestCheckFunc {
+func testAccCheckOpenZFSFileSystemRecreated(i, j *fsx.FileSystem) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		conn := acctest.Provider.Meta().(*conns.AWSClient).FSxConn(ctx)
-
-		for _, rs := range s.RootModule().Resources {
-			if rs.Type != "aws_fsx_openzfs_file_system" {
-				continue
-			}
-
-			filesystem, err := tffsx.FindFileSystemByID(ctx, conn, rs.Primary.ID)
-			if tfresource.NotFound(err) {
-				continue
-			}
-
-			if filesystem != nil {
-				return fmt.Errorf("FSx OpenZFS File System (%s) still exists", rs.Primary.ID)
-			}
+		if aws.StringValue(i.FileSystemId) == aws.StringValue(j.FileSystemId) {
+			return fmt.Errorf("FSx for OpenZFS File System (%s) not recreated", aws.StringValue(i.FileSystemId))
 		}
+
 		return nil
 	}
 }
 
-func testAccOpenzfsFileSystemConfig_base(rName string) string {
+func testAccOpenZFSFileSystemConfig_baseSingleAZ(rName string) string {
 	return acctest.ConfigVPCWithSubnets(rName, 1)
 }
 
+func testAccOpenZFSFileSystemConfig_baseMultiAZ(rName string) string {
+	return acctest.ConfigVPCWithSubnets(rName, 2)
+}
+
 func testAccOpenZFSFileSystemConfig_basic(rName string) string {
-	return acctest.ConfigCompose(testAccOpenzfsFileSystemConfig_base(rName), `
+	return acctest.ConfigCompose(testAccOpenZFSFileSystemConfig_baseSingleAZ(rName), `
 resource "aws_fsx_openzfs_file_system" "test" {
   storage_capacity    = 64
   subnet_ids          = aws_subnet.test[*].id
@@ -828,7 +996,7 @@ resource "aws_fsx_openzfs_file_system" "test" {
 }
 
 func testAccOpenZFSFileSystemConfig_diskIOPSConfiguration(rName string, iops int) string {
-	return acctest.ConfigCompose(testAccOpenzfsFileSystemConfig_base(rName), fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccOpenZFSFileSystemConfig_baseSingleAZ(rName), fmt.Sprintf(`
 resource "aws_fsx_openzfs_file_system" "test" {
   storage_capacity    = 64
   storage_type        = "SSD"
@@ -848,10 +1016,10 @@ resource "aws_fsx_openzfs_file_system" "test" {
 }
 
 func testAccOpenZFSFileSystemConfig_securityGroupIDs1(rName string) string {
-	return acctest.ConfigCompose(testAccOpenzfsFileSystemConfig_base(rName), fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccOpenZFSFileSystemConfig_baseSingleAZ(rName), fmt.Sprintf(`
 resource "aws_security_group" "test1" {
-  description = "security group for FSx testing"
-  vpc_id      = aws_vpc.test.id
+  name   = "%[1]s-1"
+  vpc_id = aws_vpc.test.id
 
   ingress {
     cidr_blocks = [aws_vpc.test.cidr_block]
@@ -888,10 +1056,10 @@ resource "aws_fsx_openzfs_file_system" "test" {
 }
 
 func testAccOpenZFSFileSystemConfig_securityGroupIDs2(rName string) string {
-	return acctest.ConfigCompose(testAccOpenzfsFileSystemConfig_base(rName), fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccOpenZFSFileSystemConfig_baseSingleAZ(rName), fmt.Sprintf(`
 resource "aws_security_group" "test1" {
-  description = "security group for FSx testing"
-  vpc_id      = aws_vpc.test.id
+  name   = "%[1]s-1"
+  vpc_id = aws_vpc.test.id
 
   ingress {
     cidr_blocks = [aws_vpc.test.cidr_block]
@@ -913,8 +1081,8 @@ resource "aws_security_group" "test1" {
 }
 
 resource "aws_security_group" "test2" {
-  description = "security group for FSx testing"
-  vpc_id      = aws_vpc.test.id
+  name   = "%[1]s-2"
+  vpc_id = aws_vpc.test.id
 
   ingress {
     cidr_blocks = [aws_vpc.test.cidr_block]
@@ -951,7 +1119,7 @@ resource "aws_fsx_openzfs_file_system" "test" {
 }
 
 func testAccOpenZFSFileSystemConfig_tags1(rName, tagKey1, tagValue1 string) string {
-	return acctest.ConfigCompose(testAccOpenzfsFileSystemConfig_base(rName), fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccOpenZFSFileSystemConfig_baseSingleAZ(rName), fmt.Sprintf(`
 resource "aws_fsx_openzfs_file_system" "test" {
   storage_capacity    = 64
   subnet_ids          = aws_subnet.test[*].id
@@ -967,7 +1135,7 @@ resource "aws_fsx_openzfs_file_system" "test" {
 }
 
 func testAccOpenZFSFileSystemConfig_tags2(rName, tagKey1, tagValue1, tagKey2, tagValue2 string) string {
-	return acctest.ConfigCompose(testAccOpenzfsFileSystemConfig_base(rName), fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccOpenZFSFileSystemConfig_baseSingleAZ(rName), fmt.Sprintf(`
 resource "aws_fsx_openzfs_file_system" "test" {
   storage_capacity    = 64
   subnet_ids          = aws_subnet.test[*].id
@@ -984,7 +1152,7 @@ resource "aws_fsx_openzfs_file_system" "test" {
 }
 
 func testAccOpenZFSFileSystemConfig_copyTags(rName, tagKey1, tagValue1, copyTags string) string {
-	return acctest.ConfigCompose(testAccOpenzfsFileSystemConfig_base(rName), fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccOpenZFSFileSystemConfig_baseSingleAZ(rName), fmt.Sprintf(`
 resource "aws_fsx_openzfs_file_system" "test" {
   storage_capacity     = 64
   subnet_ids           = aws_subnet.test[*].id
@@ -1002,7 +1170,7 @@ resource "aws_fsx_openzfs_file_system" "test" {
 }
 
 func testAccOpenZFSFileSystemConfig_weeklyMaintenanceStartTime(rName, weeklyMaintenanceStartTime string) string {
-	return acctest.ConfigCompose(testAccOpenzfsFileSystemConfig_base(rName), fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccOpenZFSFileSystemConfig_baseSingleAZ(rName), fmt.Sprintf(`
 resource "aws_fsx_openzfs_file_system" "test" {
   storage_capacity              = 64
   subnet_ids                    = aws_subnet.test[*].id
@@ -1019,7 +1187,7 @@ resource "aws_fsx_openzfs_file_system" "test" {
 }
 
 func testAccOpenZFSFileSystemConfig_dailyAutomaticBackupStartTime(rName, dailyAutomaticBackupStartTime string) string {
-	return acctest.ConfigCompose(testAccOpenzfsFileSystemConfig_base(rName), fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccOpenZFSFileSystemConfig_baseSingleAZ(rName), fmt.Sprintf(`
 resource "aws_fsx_openzfs_file_system" "test" {
   storage_capacity                  = 64
   subnet_ids                        = aws_subnet.test[*].id
@@ -1037,7 +1205,7 @@ resource "aws_fsx_openzfs_file_system" "test" {
 }
 
 func testAccOpenZFSFileSystemConfig_automaticBackupRetentionDays(rName string, retention int) string {
-	return acctest.ConfigCompose(testAccOpenzfsFileSystemConfig_base(rName), fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccOpenZFSFileSystemConfig_baseSingleAZ(rName), fmt.Sprintf(`
 resource "aws_fsx_openzfs_file_system" "test" {
   storage_capacity                = 64
   subnet_ids                      = aws_subnet.test[*].id
@@ -1054,7 +1222,7 @@ resource "aws_fsx_openzfs_file_system" "test" {
 }
 
 func testAccOpenZFSFileSystemConfig_kmsKeyID(rName string) string {
-	return acctest.ConfigCompose(testAccOpenzfsFileSystemConfig_base(rName), fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccOpenZFSFileSystemConfig_baseSingleAZ(rName), fmt.Sprintf(`
 resource "aws_kms_key" "test" {
   description             = %[1]q
   deletion_window_in_days = 7
@@ -1076,7 +1244,7 @@ resource "aws_fsx_openzfs_file_system" "test" {
 }
 
 func testAccOpenZFSFileSystemConfig_throughput(rName string, throughput int) string {
-	return acctest.ConfigCompose(testAccOpenzfsFileSystemConfig_base(rName), fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccOpenZFSFileSystemConfig_baseSingleAZ(rName), fmt.Sprintf(`
 resource "aws_fsx_openzfs_file_system" "test" {
   storage_capacity    = 64
   subnet_ids          = aws_subnet.test[*].id
@@ -1091,7 +1259,7 @@ resource "aws_fsx_openzfs_file_system" "test" {
 }
 
 func testAccOpenZFSFileSystemConfig_storageType(rName, storageType string) string {
-	return acctest.ConfigCompose(testAccOpenzfsFileSystemConfig_base(rName), fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccOpenZFSFileSystemConfig_baseSingleAZ(rName), fmt.Sprintf(`
 resource "aws_fsx_openzfs_file_system" "test" {
   storage_capacity    = 64
   subnet_ids          = aws_subnet.test[*].id
@@ -1107,27 +1275,41 @@ resource "aws_fsx_openzfs_file_system" "test" {
 }
 
 func testAccOpenZFSFileSystemConfig_rootVolume1(rName, dataCompression, readOnly string, quotaSize int) string {
-	return acctest.ConfigCompose(testAccOpenzfsFileSystemConfig_base(rName), fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccOpenZFSFileSystemConfig_baseSingleAZ(rName), fmt.Sprintf(`
 resource "aws_fsx_openzfs_file_system" "test" {
   storage_capacity    = 64
   subnet_ids          = aws_subnet.test[*].id
   deployment_type     = "SINGLE_AZ_1"
   throughput_capacity = 64
+
   root_volume_configuration {
     copy_tags_to_snapshots = true
     data_compression_type  = %[2]q
+
     nfs_exports {
       client_configurations {
         clients = "10.0.1.0/24"
         options = ["sync", "rw"]
       }
     }
+
     read_only = %[3]s
+
     user_and_group_quotas {
       id                         = 10
       storage_capacity_quota_gib = %[4]d
       type                       = "USER"
     }
+    user_and_group_quotas {
+      id                         = 0
+      storage_capacity_quota_gib = 0
+      type                       = "USER"
+    }
+    user_and_group_quotas {
+      id                         = 0
+      storage_capacity_quota_gib = 0
+      type                       = "GROUP"
+    }
   }
 
   tags = {
@@ -1138,7 +1320,7 @@ resource "aws_fsx_openzfs_file_system" "test" {
 }
 
 func testAccOpenZFSFileSystemConfig_rootVolume2(rName, dataCompression, readOnly string, quotaSize, recordSizeKiB int) string {
-	return acctest.ConfigCompose(testAccOpenzfsFileSystemConfig_base(rName), fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccOpenZFSFileSystemConfig_baseSingleAZ(rName), fmt.Sprintf(`
 resource "aws_fsx_openzfs_file_system" "test" {
   storage_capacity    = 64
   subnet_ids          = aws_subnet.test[*].id
@@ -1148,6 +1330,7 @@ resource "aws_fsx_openzfs_file_system" "test" {
   root_volume_configuration {
     copy_tags_to_snapshots = true
     data_compression_type  = %[2]q
+
     nfs_exports {
       client_configurations {
         clients = "10.0.1.0/24"
@@ -1163,6 +1346,16 @@ resource "aws_fsx_openzfs_file_system" "test" {
       storage_capacity_quota_gib = %[4]d
       type                       = "USER"
     }
+    user_and_group_quotas {
+      id                         = 0
+      storage_capacity_quota_gib = 0
+      type                       = "USER"
+    }
+    user_and_group_quotas {
+      id                         = 0
+      storage_capacity_quota_gib = 0
+      type                       = "GROUP"
+    }
   }
 
   tags = {
@@ -1173,7 +1366,7 @@ resource "aws_fsx_openzfs_file_system" "test" {
 }
 
 func testAccOpenZFSFileSystemConfig_rootVolume3Client(rName, dataCompression, readOnly string, userQuota, groupQuota, recordSizeKiB int) string {
-	return acctest.ConfigCompose(testAccOpenzfsFileSystemConfig_base(rName), fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccOpenZFSFileSystemConfig_baseSingleAZ(rName), fmt.Sprintf(`
 resource "aws_fsx_openzfs_file_system" "test" {
   storage_capacity    = 64
   subnet_ids          = aws_subnet.test[*].id
@@ -1183,6 +1376,7 @@ resource "aws_fsx_openzfs_file_system" "test" {
   root_volume_configuration {
     copy_tags_to_snapshots = true
     data_compression_type  = %[2]q
+
     nfs_exports {
       client_configurations {
         clients = "10.0.1.0/24"
@@ -1217,6 +1411,16 @@ resource "aws_fsx_openzfs_file_system" "test" {
       storage_capacity_quota_gib = %[4]d
       type                       = "USER"
     }
+    user_and_group_quotas {
+      id                         = 0
+      storage_capacity_quota_gib = 0
+      type                       = "USER"
+    }
+    user_and_group_quotas {
+      id                         = 0
+      storage_capacity_quota_gib = 0
+      type                       = "GROUP"
+    }
   }
 
   tags = {
@@ -1227,12 +1431,13 @@ resource "aws_fsx_openzfs_file_system" "test" {
 }
 
 func testAccOpenZFSFileSystemConfig_rootVolume4(rName, dataCompression, readOnly string, userQuota, groupQuota int) string {
-	return acctest.ConfigCompose(testAccOpenzfsFileSystemConfig_base(rName), fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccOpenZFSFileSystemConfig_baseSingleAZ(rName), fmt.Sprintf(`
 resource "aws_fsx_openzfs_file_system" "test" {
   storage_capacity    = 64
   subnet_ids          = aws_subnet.test[*].id
   deployment_type     = "SINGLE_AZ_1"
   throughput_capacity = 64
+
   root_volume_configuration {
     copy_tags_to_snapshots = true
     data_compression_type  = %[2]q
@@ -1257,6 +1462,16 @@ resource "aws_fsx_openzfs_file_system" "test" {
       storage_capacity_quota_gib = %[4]d
       type                       = "USER"
     }
+    user_and_group_quotas {
+      id                         = 0
+      storage_capacity_quota_gib = 0
+      type                       = "USER"
+    }
+    user_and_group_quotas {
+      id                         = 0
+      storage_capacity_quota_gib = 0
+      type                       = "GROUP"
+    }
   }
 
   tags = {
@@ -1266,8 +1481,8 @@ resource "aws_fsx_openzfs_file_system" "test" {
 `, rName, dataCompression, readOnly, userQuota, groupQuota))
 }
 
-func testAccOpenzfsFileSystemConfig_throughputCapacity(rName string) string {
-	return acctest.ConfigCompose(testAccOpenzfsFileSystemConfig_base(rName), fmt.Sprintf(`
+func testAccOpenZFSFileSystemConfig_throughputCapacity(rName string) string {
+	return acctest.ConfigCompose(testAccOpenZFSFileSystemConfig_baseSingleAZ(rName), fmt.Sprintf(`
 resource "aws_fsx_openzfs_file_system" "test" {
   storage_capacity    = 64
   subnet_ids          = aws_subnet.test[*].id
@@ -1281,8 +1496,8 @@ resource "aws_fsx_openzfs_file_system" "test" {
 `, rName))
 }
 
-func testAccOpenzfsFileSystemConfig_storageCapacity(rName string) string {
-	return acctest.ConfigCompose(testAccOpenzfsFileSystemConfig_base(rName), fmt.Sprintf(`
+func testAccOpenZFSFileSystemConfig_storageCapacity(rName string) string {
+	return acctest.ConfigCompose(testAccOpenZFSFileSystemConfig_baseSingleAZ(rName), fmt.Sprintf(`
 resource "aws_fsx_openzfs_file_system" "test" {
   storage_capacity    = 75
   subnet_ids          = aws_subnet.test[*].id
@@ -1296,8 +1511,8 @@ resource "aws_fsx_openzfs_file_system" "test" {
 `, rName))
 }
 
-func testAccOpenzfsFileSystemConfig_deploymentType(rName, deploymentType string, throughput int) string {
-	return acctest.ConfigCompose(testAccOpenzfsFileSystemConfig_base(rName), fmt.Sprintf(`
+func testAccOpenZFSFileSystemConfig_deploymentType(rName, deploymentType string, throughput int) string {
+	return acctest.ConfigCompose(testAccOpenZFSFileSystemConfig_baseSingleAZ(rName), fmt.Sprintf(`
 resource "aws_fsx_openzfs_file_system" "test" {
   storage_capacity    = 64
   subnet_ids          = aws_subnet.test[*].id
@@ -1310,3 +1525,59 @@ resource "aws_fsx_openzfs_file_system" "test" {
 }
 `, rName, deploymentType, throughput))
 }
+
+func testAccOpenZFSFileSystemConfig_multiAZ(rName string) string {
+	return acctest.ConfigCompose(testAccOpenZFSFileSystemConfig_baseMultiAZ(rName), fmt.Sprintf(`
+resource "aws_fsx_openzfs_file_system" "test" {
+  storage_capacity    = 64
+  subnet_ids          = aws_subnet.test[*].id
+  preferred_subnet_id = aws_subnet.test[0].id
+  deployment_type     = "MULTI_AZ_1"
+  throughput_capacity = 160
+
+  tags = {
+    Name = %[1]q
+  }
+}
+`, rName))
+}
+
+func testAccOpenZFSFileSystemConfig_routeTableIDs(rName string, n int) string {
+	return acctest.ConfigCompose(testAccOpenZFSFileSystemConfig_baseMultiAZ(rName), fmt.Sprintf(`
+resource "aws_internet_gateway" "test" {
+  vpc_id = aws_vpc.test.id
+
+  tags = {
+    Name = %[1]q
+  }
+}
+
+resource "aws_route_table" "test" {
+  count = %[2]d
+
+  vpc_id = aws_vpc.test.id
+
+  route {
+    cidr_block = "0.0.0.0/0"
+    gateway_id = aws_internet_gateway.test.id
+  }
+
+  tags = {
+    Name = %[1]q
+  }
+}
+
+resource "aws_fsx_openzfs_file_system" "test" {
+  storage_capacity    = 64
+  subnet_ids          = aws_subnet.test[*].id
+  preferred_subnet_id = aws_subnet.test[0].id
+  deployment_type     = "MULTI_AZ_1"
+  throughput_capacity = 160
+  route_table_ids     = aws_route_table.test[*].id
+
+  tags = {
+    Name = %[1]q
+  }
+}
+`, rName, n))
+}
diff --git a/internal/service/fsx/openzfs_snapshot.go b/internal/service/fsx/openzfs_snapshot.go
index 31046e3099a..d300865ccd8 100644
--- a/internal/service/fsx/openzfs_snapshot.go
+++ b/internal/service/fsx/openzfs_snapshot.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package fsx
 
 import (
diff --git a/internal/service/fsx/openzfs_snapshot_data_source.go b/internal/service/fsx/openzfs_snapshot_data_source.go
index e9252b01e39..508c142e9cb 100644
--- a/internal/service/fsx/openzfs_snapshot_data_source.go
+++ b/internal/service/fsx/openzfs_snapshot_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package fsx
 
 import (
diff --git a/internal/service/fsx/openzfs_snapshot_data_source_test.go b/internal/service/fsx/openzfs_snapshot_data_source_test.go
index d4cdb668e24..9d786a44826 100644
--- a/internal/service/fsx/openzfs_snapshot_data_source_test.go
+++ b/internal/service/fsx/openzfs_snapshot_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package fsx_test
 
 import (
diff --git a/internal/service/fsx/openzfs_snapshot_test.go b/internal/service/fsx/openzfs_snapshot_test.go
index 139c052a655..c3508c7088a 100644
--- a/internal/service/fsx/openzfs_snapshot_test.go
+++ b/internal/service/fsx/openzfs_snapshot_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package fsx_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/fsx"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -33,7 +36,7 @@ func TestAccFSxOpenzfsSnapshot_basic(t *testing.T) {
 				Config: testAccOpenZFSSnapshotConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckOpenzfsSnapshotExists(ctx, resourceName, &snapshot),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "fsx", regexp.MustCompile(`snapshot/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "fsx", regexache.MustCompile(`snapshot/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttrSet(resourceName, "volume_id"),
 					resource.TestCheckResourceAttrSet(resourceName, "creation_time"),
@@ -172,7 +175,7 @@ func TestAccFSxOpenzfsSnapshot_childVolume(t *testing.T) {
 				Config: testAccOpenZFSSnapshotConfig_childVolume(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckOpenzfsSnapshotExists(ctx, resourceName, &snapshot),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "fsx", regexp.MustCompile(`snapshot/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "fsx", regexache.MustCompile(`snapshot/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 				),
diff --git a/internal/service/fsx/openzfs_volume.go b/internal/service/fsx/openzfs_volume.go
index ee70b974612..e71216f4390 100644
--- a/internal/service/fsx/openzfs_volume.go
+++ b/internal/service/fsx/openzfs_volume.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package fsx
 
 import (
 	"context"
 	"log"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/fsx"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -24,14 +27,19 @@ import (
 
 // @SDKResource("aws_fsx_openzfs_volume", name="OpenZFS Volume")
 // @Tags(identifierAttribute="arn")
-func ResourceOpenzfsVolume() *schema.Resource {
+func ResourceOpenZFSVolume() *schema.Resource {
 	return &schema.Resource{
-		CreateWithoutTimeout: resourceOpenzfsVolumeCreate,
-		ReadWithoutTimeout:   resourceOpenzfsVolumeRead,
-		UpdateWithoutTimeout: resourceOpenzfsVolumeUpdate,
-		DeleteWithoutTimeout: resourceOpenzfsVolumeDelete,
+		CreateWithoutTimeout: resourceOpenZFSVolumeCreate,
+		ReadWithoutTimeout:   resourceOpenZFSVolumeRead,
+		UpdateWithoutTimeout: resourceOpenZFSVolumeUpdate,
+		DeleteWithoutTimeout: resourceOpenZFSVolumeDelete,
+
 		Importer: &schema.ResourceImporter{
-			StateContext: schema.ImportStatePassthroughContext,
+			StateContext: func(ctx context.Context, d *schema.ResourceData, meta interface{}) ([]*schema.ResourceData, error) {
+				d.Set("delete_volume_options", nil)
+
+				return []*schema.ResourceData{d}, nil
+			},
 		},
 
 		Timeouts: &schema.ResourceTimeout{
@@ -56,6 +64,15 @@ func ResourceOpenzfsVolume() *schema.Resource {
 				Default:      "NONE",
 				ValidateFunc: validation.StringInSlice(fsx.OpenZFSDataCompressionType_Values(), false),
 			},
+			"delete_volume_options": {
+				Type:     schema.TypeList,
+				Optional: true,
+				MaxItems: 1,
+				Elem: &schema.Schema{
+					Type:         schema.TypeString,
+					ValidateFunc: validation.StringInSlice(fsx.DeleteFileSystemOpenZFSOption_Values(), false),
+				},
+			},
 			"name": {
 				Type:         schema.TypeString,
 				Required:     true,
@@ -79,7 +96,7 @@ func ResourceOpenzfsVolume() *schema.Resource {
 										Required: true,
 										ValidateFunc: validation.All(
 											validation.StringLenBetween(1, 128),
-											validation.StringMatch(regexp.MustCompile(`^[ -~]{1,128}$`), "must be either IP Address or CIDR"),
+											validation.StringMatch(regexache.MustCompile(`^[ -~]{1,128}$`), "must be either IP Address or CIDR"),
 										),
 									},
 									"options": {
@@ -114,7 +131,7 @@ func ResourceOpenzfsVolume() *schema.Resource {
 							Required: true,
 							ValidateFunc: validation.All(
 								validation.StringLenBetween(8, 512),
-								validation.StringMatch(regexp.MustCompile(`^arn:.*`), "must specify the full ARN of the snapshot"),
+								validation.StringMatch(regexache.MustCompile(`^arn:.*`), "must specify the full ARN of the snapshot"),
 							),
 						},
 					},
@@ -125,7 +142,7 @@ func ResourceOpenzfsVolume() *schema.Resource {
 				Required: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(23, 23),
-					validation.StringMatch(regexp.MustCompile(`^(fsvol-[0-9a-f]{17,})$`), "must specify a filesystem id i.e. fs-12345678"),
+					validation.StringMatch(regexache.MustCompile(`^(fsvol-[0-9a-f]{17,})$`), "must specify a filesystem id i.e. fs-12345678"),
 				),
 			},
 			"read_only": {
@@ -182,6 +199,7 @@ func ResourceOpenzfsVolume() *schema.Resource {
 				Type:         schema.TypeString,
 				Default:      fsx.VolumeTypeOpenzfs,
 				Optional:     true,
+				ForceNew:     true,
 				ValidateFunc: validation.StringInSlice(fsx.VolumeType_Values(), false),
 			},
 		},
@@ -190,218 +208,216 @@ func ResourceOpenzfsVolume() *schema.Resource {
 	}
 }
 
-func resourceOpenzfsVolumeCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+func resourceOpenZFSVolumeCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).FSxConn(ctx)
 
-	input := &fsx.CreateVolumeInput{
-		ClientRequestToken: aws.String(id.UniqueId()),
-		Name:               aws.String(d.Get("name").(string)),
-		VolumeType:         aws.String(d.Get("volume_type").(string)),
-		OpenZFSConfiguration: &fsx.CreateOpenZFSVolumeConfiguration{
-			ParentVolumeId: aws.String(d.Get("parent_volume_id").(string)),
-		},
-		Tags: getTagsIn(ctx),
+	openzfsConfig := &fsx.CreateOpenZFSVolumeConfiguration{
+		ParentVolumeId: aws.String(d.Get("parent_volume_id").(string)),
 	}
 
 	if v, ok := d.GetOk("copy_tags_to_snapshots"); ok {
-		input.OpenZFSConfiguration.CopyTagsToSnapshots = aws.Bool(v.(bool))
+		openzfsConfig.CopyTagsToSnapshots = aws.Bool(v.(bool))
 	}
 
 	if v, ok := d.GetOk("data_compression_type"); ok {
-		input.OpenZFSConfiguration.DataCompressionType = aws.String(v.(string))
+		openzfsConfig.DataCompressionType = aws.String(v.(string))
 	}
 
 	if v, ok := d.GetOk("nfs_exports"); ok {
-		input.OpenZFSConfiguration.NfsExports = expandOpenzfsVolumeNFSExports(v.([]interface{}))
+		openzfsConfig.NfsExports = expandOpenZFSNfsExports(v.([]interface{}))
+	}
+
+	if v, ok := d.GetOk("origin_snapshot"); ok {
+		openzfsConfig.OriginSnapshot = expandCreateOpenZFSOriginSnapshotConfiguration(v.([]interface{}))
 	}
 
 	if v, ok := d.GetOk("read_only"); ok {
-		input.OpenZFSConfiguration.ReadOnly = aws.Bool(v.(bool))
+		openzfsConfig.ReadOnly = aws.Bool(v.(bool))
 	}
 
 	if v, ok := d.GetOk("record_size_kib"); ok {
-		input.OpenZFSConfiguration.RecordSizeKiB = aws.Int64(int64(v.(int)))
+		openzfsConfig.RecordSizeKiB = aws.Int64(int64(v.(int)))
 	}
 
 	if v, ok := d.GetOk("storage_capacity_quota_gib"); ok {
-		input.OpenZFSConfiguration.StorageCapacityQuotaGiB = aws.Int64(int64(v.(int)))
+		openzfsConfig.StorageCapacityQuotaGiB = aws.Int64(int64(v.(int)))
 	}
 
 	if v, ok := d.GetOk("storage_capacity_reservation_gib"); ok {
-		input.OpenZFSConfiguration.StorageCapacityReservationGiB = aws.Int64(int64(v.(int)))
+		openzfsConfig.StorageCapacityReservationGiB = aws.Int64(int64(v.(int)))
 	}
 
 	if v, ok := d.GetOk("user_and_group_quotas"); ok {
-		input.OpenZFSConfiguration.UserAndGroupQuotas = expandOpenzfsVolumeUserAndGroupQuotas(v.(*schema.Set).List())
+		openzfsConfig.UserAndGroupQuotas = expandOpenZFSUserOrGroupQuotas(v.(*schema.Set).List())
 	}
 
-	if v, ok := d.GetOk("origin_snapshot"); ok {
-		input.OpenZFSConfiguration.OriginSnapshot = expandOpenzfsCreateVolumeOriginSnapshot(v.([]interface{}))
-
-		log.Printf("[DEBUG] Creating FSx OpenZFS Volume: %s", input)
-		result, err := conn.CreateVolumeWithContext(ctx, input)
-
-		if err != nil {
-			return sdkdiag.AppendErrorf(diags, "creating FSx OpenZFS Volume from snapshot: %s", err)
-		}
-
-		d.SetId(aws.StringValue(result.Volume.VolumeId))
-	} else {
-		log.Printf("[DEBUG] Creating FSx OpenZFS Volume: %s", input)
-		result, err := conn.CreateVolumeWithContext(ctx, input)
+	name := d.Get("name").(string)
+	input := &fsx.CreateVolumeInput{
+		ClientRequestToken:   aws.String(id.UniqueId()),
+		Name:                 aws.String(name),
+		OpenZFSConfiguration: openzfsConfig,
+		Tags:                 getTagsIn(ctx),
+		VolumeType:           aws.String(d.Get("volume_type").(string)),
+	}
 
-		if err != nil {
-			return sdkdiag.AppendErrorf(diags, "creating FSx OpenZFS Volume: %s", err)
-		}
+	output, err := conn.CreateVolumeWithContext(ctx, input)
 
-		d.SetId(aws.StringValue(result.Volume.VolumeId))
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "creating FSx for OpenZFS Volume (%s): %s", name, err)
 	}
 
+	d.SetId(aws.StringValue(output.Volume.VolumeId))
+
 	if _, err := waitVolumeCreated(ctx, conn, d.Id(), d.Timeout(schema.TimeoutCreate)); err != nil {
-		return sdkdiag.AppendErrorf(diags, "waiting for FSx OpenZFS Volume(%s) create: %s", d.Id(), err)
+		return sdkdiag.AppendErrorf(diags, "waiting for FSx for OpenZFS Volume (%s) create: %s", d.Id(), err)
 	}
 
-	return append(diags, resourceOpenzfsVolumeRead(ctx, d, meta)...)
+	return append(diags, resourceOpenZFSVolumeRead(ctx, d, meta)...)
 }
 
-func resourceOpenzfsVolumeRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+func resourceOpenZFSVolumeRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).FSxConn(ctx)
 
-	volume, err := FindVolumeByID(ctx, conn, d.Id())
+	volume, err := FindOpenZFSVolumeByID(ctx, conn, d.Id())
+
 	if !d.IsNewResource() && tfresource.NotFound(err) {
-		log.Printf("[WARN] FSx OpenZFS volume (%s) not found, removing from state", d.Id())
+		log.Printf("[WARN] FSx for OpenZFS Volume (%s) not found, removing from state", d.Id())
 		d.SetId("")
 		return diags
 	}
 
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "reading FSx OpenZFS Volume (%s): %s", d.Id(), err)
+		return sdkdiag.AppendErrorf(diags, "reading FSx for OpenZFS Volume (%s): %s", d.Id(), err)
 	}
 
 	openzfsConfig := volume.OpenZFSConfiguration
 
-	if volume.OntapConfiguration != nil {
-		return sdkdiag.AppendErrorf(diags, "expected FSx OpeZFS Volume, found FSx ONTAP Volume: %s", d.Id())
-	}
-
-	if openzfsConfig == nil {
-		return sdkdiag.AppendErrorf(diags, "describing FSx OpenZFS Volume (%s): empty Openzfs configuration", d.Id())
-	}
-
 	d.Set("arn", volume.ResourceARN)
 	d.Set("copy_tags_to_snapshots", openzfsConfig.CopyTagsToSnapshots)
 	d.Set("data_compression_type", openzfsConfig.DataCompressionType)
 	d.Set("name", volume.Name)
+	if err := d.Set("nfs_exports", flattenOpenZFSNfsExports(openzfsConfig.NfsExports)); err != nil {
+		return sdkdiag.AppendErrorf(diags, "setting nfs_exports: %s", err)
+	}
+	if err := d.Set("origin_snapshot", flattenOpenZFSOriginSnapshotConfiguration(openzfsConfig.OriginSnapshot)); err != nil {
+		return sdkdiag.AppendErrorf(diags, "setting nfs_exports: %s", err)
+	}
 	d.Set("parent_volume_id", openzfsConfig.ParentVolumeId)
 	d.Set("read_only", openzfsConfig.ReadOnly)
 	d.Set("record_size_kib", openzfsConfig.RecordSizeKiB)
 	d.Set("storage_capacity_quota_gib", openzfsConfig.StorageCapacityQuotaGiB)
 	d.Set("storage_capacity_reservation_gib", openzfsConfig.StorageCapacityReservationGiB)
-	d.Set("volume_type", volume.VolumeType)
-
-	if err := d.Set("origin_snapshot", flattenOpenzfsVolumeOriginSnapshot(openzfsConfig.OriginSnapshot)); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting nfs_exports: %s", err)
-	}
-
-	if err := d.Set("nfs_exports", flattenOpenzfsVolumeNFSExports(openzfsConfig.NfsExports)); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting nfs_exports: %s", err)
-	}
-
-	if err := d.Set("user_and_group_quotas", flattenOpenzfsVolumeUserAndGroupQuotas(openzfsConfig.UserAndGroupQuotas)); err != nil {
+	if err := d.Set("user_and_group_quotas", flattenOpenZFSUserOrGroupQuotas(openzfsConfig.UserAndGroupQuotas)); err != nil {
 		return sdkdiag.AppendErrorf(diags, "setting user_and_group_quotas: %s", err)
 	}
+	d.Set("volume_type", volume.VolumeType)
 
 	return diags
 }
 
-func resourceOpenzfsVolumeUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+func resourceOpenZFSVolumeUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).FSxConn(ctx)
 
-	if d.HasChangesExcept("tags_all", "tags") {
-		input := &fsx.UpdateVolumeInput{
-			ClientRequestToken:   aws.String(id.UniqueId()),
-			VolumeId:             aws.String(d.Id()),
-			OpenZFSConfiguration: &fsx.UpdateOpenZFSVolumeConfiguration{},
-		}
+	if d.HasChangesExcept("tags", "tags_all") {
+		openzfsConfig := &fsx.UpdateOpenZFSVolumeConfiguration{}
 
 		if d.HasChange("data_compression_type") {
-			input.OpenZFSConfiguration.DataCompressionType = aws.String(d.Get("data_compression_type").(string))
-		}
-
-		if d.HasChange("name") {
-			input.Name = aws.String(d.Get("name").(string))
+			openzfsConfig.DataCompressionType = aws.String(d.Get("data_compression_type").(string))
 		}
 
 		if d.HasChange("nfs_exports") {
-			input.OpenZFSConfiguration.NfsExports = expandOpenzfsVolumeNFSExports(d.Get("nfs_exports").([]interface{}))
+			openzfsConfig.NfsExports = expandOpenZFSNfsExports(d.Get("nfs_exports").([]interface{}))
 		}
 
 		if d.HasChange("read_only") {
-			input.OpenZFSConfiguration.ReadOnly = aws.Bool(d.Get("read_only").(bool))
+			openzfsConfig.ReadOnly = aws.Bool(d.Get("read_only").(bool))
 		}
 
 		if d.HasChange("record_size_kib") {
-			input.OpenZFSConfiguration.RecordSizeKiB = aws.Int64(int64(d.Get("record_size_kib").(int)))
+			openzfsConfig.RecordSizeKiB = aws.Int64(int64(d.Get("record_size_kib").(int)))
 		}
 
 		if d.HasChange("storage_capacity_quota_gib") {
-			input.OpenZFSConfiguration.StorageCapacityQuotaGiB = aws.Int64(int64(d.Get("storage_capacity_quota_gib").(int)))
+			openzfsConfig.StorageCapacityQuotaGiB = aws.Int64(int64(d.Get("storage_capacity_quota_gib").(int)))
 		}
 
 		if d.HasChange("storage_capacity_reservation_gib") {
-			input.OpenZFSConfiguration.StorageCapacityReservationGiB = aws.Int64(int64(d.Get("storage_capacity_reservation_gib").(int)))
+			openzfsConfig.StorageCapacityReservationGiB = aws.Int64(int64(d.Get("storage_capacity_reservation_gib").(int)))
 		}
 
 		if d.HasChange("user_and_group_quotas") {
-			input.OpenZFSConfiguration.UserAndGroupQuotas = expandOpenzfsVolumeUserAndGroupQuotas(d.Get("user_and_group_quotas").(*schema.Set).List())
+			openzfsConfig.UserAndGroupQuotas = expandOpenZFSUserOrGroupQuotas(d.Get("user_and_group_quotas").(*schema.Set).List())
+		}
+
+		input := &fsx.UpdateVolumeInput{
+			ClientRequestToken:   aws.String(id.UniqueId()),
+			OpenZFSConfiguration: openzfsConfig,
+			VolumeId:             aws.String(d.Id()),
 		}
 
+		if d.HasChange("name") {
+			input.Name = aws.String(d.Get("name").(string))
+		}
+
+		startTime := time.Now()
 		_, err := conn.UpdateVolumeWithContext(ctx, input)
 
 		if err != nil {
-			return sdkdiag.AppendErrorf(diags, "updating FSx OpenZFS Volume (%s): %s", d.Id(), err)
+			return sdkdiag.AppendErrorf(diags, "updating FSx for OpenZFS Volume (%s): %s", d.Id(), err)
+		}
+
+		if _, err := waitVolumeUpdated(ctx, conn, d.Id(), startTime, d.Timeout(schema.TimeoutUpdate)); err != nil {
+			return sdkdiag.AppendErrorf(diags, "waiting for FSx for OpenZFS Volume (%s) update: %s", d.Id(), err)
 		}
 
-		if _, err := waitVolumeUpdated(ctx, conn, d.Id(), d.Timeout(schema.TimeoutUpdate)); err != nil {
-			return sdkdiag.AppendErrorf(diags, "waiting for FSx OpenZFS Volume (%s) update: %s", d.Id(), err)
+		if _, err := waitVolumeAdministrativeActionCompleted(ctx, conn, d.Id(), fsx.AdministrativeActionTypeVolumeUpdate, d.Timeout(schema.TimeoutUpdate)); err != nil {
+			return sdkdiag.AppendErrorf(diags, "waiting for FSx for OpenZFS Volume (%s) administrative action (%s) complete: %s", d.Id(), fsx.AdministrativeActionTypeVolumeUpdate, err)
 		}
 	}
 
-	return append(diags, resourceOpenzfsVolumeRead(ctx, d, meta)...)
+	return append(diags, resourceOpenZFSVolumeRead(ctx, d, meta)...)
 }
 
-func resourceOpenzfsVolumeDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+func resourceOpenZFSVolumeDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).FSxConn(ctx)
 
-	log.Printf("[DEBUG] Deleting FSx OpenZFS Volume: %s", d.Id())
-	_, err := conn.DeleteVolumeWithContext(ctx, &fsx.DeleteVolumeInput{
+	input := &fsx.DeleteVolumeInput{
 		VolumeId: aws.String(d.Id()),
-	})
+	}
+
+	if v, ok := d.GetOk("delete_volume_options"); ok && len(v.([]interface{})) > 0 {
+		input.OpenZFSConfiguration = &fsx.DeleteVolumeOpenZFSConfiguration{
+			Options: flex.ExpandStringList(v.([]interface{})),
+		}
+	}
+
+	log.Printf("[DEBUG] Deleting FSx for OpenZFS Volume: %s", d.Id())
+	_, err := conn.DeleteVolumeWithContext(ctx, input)
 
 	if tfawserr.ErrCodeEquals(err, fsx.ErrCodeVolumeNotFound) {
 		return diags
 	}
 
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "deleting FSx OpenZFS Volume (%s): %s", d.Id(), err)
+		return sdkdiag.AppendErrorf(diags, "deleting FSx for OpenZFS Volume (%s): %s", d.Id(), err)
 	}
 
 	if _, err := waitVolumeDeleted(ctx, conn, d.Id(), d.Timeout(schema.TimeoutDelete)); err != nil {
-		return sdkdiag.AppendErrorf(diags, "waiting for FSx OpenZFS Volume (%s) delete: %s", d.Id(), err)
+		return sdkdiag.AppendErrorf(diags, "waiting for FSx for OpenZFS Volume (%s) delete: %s", d.Id(), err)
 	}
 
 	return diags
 }
 
-func expandOpenzfsVolumeUserAndGroupQuotas(cfg []interface{}) []*fsx.OpenZFSUserOrGroupQuota {
+func expandOpenZFSUserOrGroupQuotas(cfg []interface{}) []*fsx.OpenZFSUserOrGroupQuota {
 	quotas := []*fsx.OpenZFSUserOrGroupQuota{}
 
 	for _, quota := range cfg {
-		expandedQuota := expandOpenzfsVolumeUserAndGroupQuota(quota.(map[string]interface{}))
+		expandedQuota := expandOpenZFSUserOrGroupQuota(quota.(map[string]interface{}))
 		if expandedQuota != nil {
 			quotas = append(quotas, expandedQuota)
 		}
@@ -410,7 +426,7 @@ func expandOpenzfsVolumeUserAndGroupQuotas(cfg []interface{}) []*fsx.OpenZFSUser
 	return quotas
 }
 
-func expandOpenzfsVolumeUserAndGroupQuota(conf map[string]interface{}) *fsx.OpenZFSUserOrGroupQuota {
+func expandOpenZFSUserOrGroupQuota(conf map[string]interface{}) *fsx.OpenZFSUserOrGroupQuota {
 	if len(conf) < 1 {
 		return nil
 	}
@@ -432,11 +448,11 @@ func expandOpenzfsVolumeUserAndGroupQuota(conf map[string]interface{}) *fsx.Open
 	return &out
 }
 
-func expandOpenzfsVolumeNFSExports(cfg []interface{}) []*fsx.OpenZFSNfsExport {
+func expandOpenZFSNfsExports(cfg []interface{}) []*fsx.OpenZFSNfsExport { // nosemgrep:ci.caps4-in-func-name
 	exports := []*fsx.OpenZFSNfsExport{}
 
 	for _, export := range cfg {
-		expandedExport := expandOpenzfsVolumeNFSExport(export.(map[string]interface{}))
+		expandedExport := expandOpenZFSNfsExport(export.(map[string]interface{}))
 		if expandedExport != nil {
 			exports = append(exports, expandedExport)
 		}
@@ -445,21 +461,21 @@ func expandOpenzfsVolumeNFSExports(cfg []interface{}) []*fsx.OpenZFSNfsExport {
 	return exports
 }
 
-func expandOpenzfsVolumeNFSExport(cfg map[string]interface{}) *fsx.OpenZFSNfsExport {
+func expandOpenZFSNfsExport(cfg map[string]interface{}) *fsx.OpenZFSNfsExport { // nosemgrep:ci.caps4-in-func-name
 	out := fsx.OpenZFSNfsExport{}
 
 	if v, ok := cfg["client_configurations"]; ok {
-		out.ClientConfigurations = expandOpenzfsVolumeClinetConfigurations(v.(*schema.Set).List())
+		out.ClientConfigurations = expandOpenZFSClientConfigurations(v.(*schema.Set).List())
 	}
 
 	return &out
 }
 
-func expandOpenzfsVolumeClinetConfigurations(cfg []interface{}) []*fsx.OpenZFSClientConfiguration {
+func expandOpenZFSClientConfigurations(cfg []interface{}) []*fsx.OpenZFSClientConfiguration {
 	configurations := []*fsx.OpenZFSClientConfiguration{}
 
 	for _, configuration := range cfg {
-		expandedConfiguration := expandOpenzfsVolumeClientConfiguration(configuration.(map[string]interface{}))
+		expandedConfiguration := expandOpenZFSClientConfiguration(configuration.(map[string]interface{}))
 		if expandedConfiguration != nil {
 			configurations = append(configurations, expandedConfiguration)
 		}
@@ -468,7 +484,7 @@ func expandOpenzfsVolumeClinetConfigurations(cfg []interface{}) []*fsx.OpenZFSCl
 	return configurations
 }
 
-func expandOpenzfsVolumeClientConfiguration(conf map[string]interface{}) *fsx.OpenZFSClientConfiguration {
+func expandOpenZFSClientConfiguration(conf map[string]interface{}) *fsx.OpenZFSClientConfiguration {
 	out := fsx.OpenZFSClientConfiguration{}
 
 	if v, ok := conf["clients"].(string); ok && len(v) > 0 {
@@ -482,7 +498,7 @@ func expandOpenzfsVolumeClientConfiguration(conf map[string]interface{}) *fsx.Op
 	return &out
 }
 
-func expandOpenzfsCreateVolumeOriginSnapshot(cfg []interface{}) *fsx.CreateOpenZFSOriginSnapshotConfiguration {
+func expandCreateOpenZFSOriginSnapshotConfiguration(cfg []interface{}) *fsx.CreateOpenZFSOriginSnapshotConfiguration {
 	if len(cfg) < 1 {
 		return nil
 	}
@@ -502,13 +518,13 @@ func expandOpenzfsCreateVolumeOriginSnapshot(cfg []interface{}) *fsx.CreateOpenZ
 	return &out
 }
 
-func flattenOpenzfsVolumeNFSExports(rs []*fsx.OpenZFSNfsExport) []map[string]interface{} {
+func flattenOpenZFSNfsExports(rs []*fsx.OpenZFSNfsExport) []map[string]interface{} { // nosemgrep:ci.caps4-in-func-name
 	exports := make([]map[string]interface{}, 0)
 
 	for _, export := range rs {
 		if export != nil {
 			cfg := make(map[string]interface{})
-			cfg["client_configurations"] = flattenOpenzfsVolumeClientConfigurations(export.ClientConfigurations)
+			cfg["client_configurations"] = flattenOpenZFSClientConfigurations(export.ClientConfigurations)
 			exports = append(exports, cfg)
 		}
 	}
@@ -520,7 +536,7 @@ func flattenOpenzfsVolumeNFSExports(rs []*fsx.OpenZFSNfsExport) []map[string]int
 	return nil
 }
 
-func flattenOpenzfsVolumeClientConfigurations(rs []*fsx.OpenZFSClientConfiguration) []map[string]interface{} {
+func flattenOpenZFSClientConfigurations(rs []*fsx.OpenZFSClientConfiguration) []map[string]interface{} {
 	configurations := make([]map[string]interface{}, 0)
 
 	for _, configuration := range rs {
@@ -539,7 +555,7 @@ func flattenOpenzfsVolumeClientConfigurations(rs []*fsx.OpenZFSClientConfigurati
 	return nil
 }
 
-func flattenOpenzfsVolumeUserAndGroupQuotas(rs []*fsx.OpenZFSUserOrGroupQuota) []map[string]interface{} {
+func flattenOpenZFSUserOrGroupQuotas(rs []*fsx.OpenZFSUserOrGroupQuota) []map[string]interface{} {
 	quotas := make([]map[string]interface{}, 0)
 
 	for _, quota := range rs {
@@ -559,7 +575,7 @@ func flattenOpenzfsVolumeUserAndGroupQuotas(rs []*fsx.OpenZFSUserOrGroupQuota) [
 	return nil
 }
 
-func flattenOpenzfsVolumeOriginSnapshot(rs *fsx.OpenZFSOriginSnapshotConfiguration) []interface{} {
+func flattenOpenZFSOriginSnapshotConfiguration(rs *fsx.OpenZFSOriginSnapshotConfiguration) []interface{} {
 	if rs == nil {
 		return []interface{}{}
 	}
@@ -574,3 +590,17 @@ func flattenOpenzfsVolumeOriginSnapshot(rs *fsx.OpenZFSOriginSnapshotConfigurati
 
 	return []interface{}{m}
 }
+
+func FindOpenZFSVolumeByID(ctx context.Context, conn *fsx.FSx, id string) (*fsx.Volume, error) {
+	output, err := findVolumeByIDAndType(ctx, conn, id, fsx.VolumeTypeOpenzfs)
+
+	if err != nil {
+		return nil, err
+	}
+
+	if output.OpenZFSConfiguration == nil {
+		return nil, tfresource.NewEmptyResultError(nil)
+	}
+
+	return output, nil
+}
diff --git a/internal/service/fsx/openzfs_volume_test.go b/internal/service/fsx/openzfs_volume_test.go
index 5439e716af7..cce5ec5cf00 100644
--- a/internal/service/fsx/openzfs_volume_test.go
+++ b/internal/service/fsx/openzfs_volume_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package fsx_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/fsx"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -17,7 +20,7 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
-func TestAccFSxOpenzfsVolume_basic(t *testing.T) {
+func TestAccFSxOpenZFSVolume_basic(t *testing.T) {
 	ctx := acctest.Context(t)
 	var volume fsx.Volume
 	resourceName := "aws_fsx_openzfs_volume.test"
@@ -27,15 +30,16 @@ func TestAccFSxOpenzfsVolume_basic(t *testing.T) {
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
 		ErrorCheck:               acctest.ErrorCheck(t, fsx.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckOpenzfsVolumeDestroy(ctx),
+		CheckDestroy:             testAccCheckOpenZFSVolumeDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccOpenZFSVolumeConfig_basic(rName),
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOpenzfsVolumeExists(ctx, resourceName, &volume),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "fsx", regexp.MustCompile(`volume/fs-.+/fsvol-.+`)),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckOpenZFSVolumeExists(ctx, resourceName, &volume),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "fsx", regexache.MustCompile(`volume/fs-.+/fsvol-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "copy_tags_to_snapshots", "false"),
 					resource.TestCheckResourceAttr(resourceName, "data_compression_type", "NONE"),
+					resource.TestCheckResourceAttr(resourceName, "delete_volume_options.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "nfs_exports.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "nfs_exports.0.client_configurations.#", "1"),
@@ -57,10 +61,33 @@ func TestAccFSxOpenzfsVolume_basic(t *testing.T) {
 	})
 }
 
-func TestAccFSxOpenzfsVolume_parentVolume(t *testing.T) {
+func TestAccFSxOpenZFSVolume_disappears(t *testing.T) {
+	ctx := acctest.Context(t)
+	var volume fsx.Volume
+	resourceName := "aws_fsx_openzfs_volume.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
+		ErrorCheck:               acctest.ErrorCheck(t, fsx.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckOpenZFSVolumeDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccOpenZFSVolumeConfig_basic(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckOpenZFSVolumeExists(ctx, resourceName, &volume),
+					acctest.CheckResourceDisappears(ctx, acctest.Provider, tffsx.ResourceOpenZFSVolume(), resourceName),
+				),
+				ExpectNonEmptyPlan: true,
+			},
+		},
+	})
+}
+
+func TestAccFSxOpenZFSVolume_parentVolume(t *testing.T) {
 	ctx := acctest.Context(t)
 	var volume, volume2 fsx.Volume
-	var volumeId string
 	resourceName := "aws_fsx_openzfs_volume.test"
 	resourceName2 := "aws_fsx_openzfs_volume.test2"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
@@ -70,17 +97,16 @@ func TestAccFSxOpenzfsVolume_parentVolume(t *testing.T) {
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
 		ErrorCheck:               acctest.ErrorCheck(t, fsx.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckOpenzfsVolumeDestroy(ctx),
+		CheckDestroy:             testAccCheckOpenZFSVolumeDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccOpenZFSVolumeConfig_parent(rName, rName2),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOpenzfsVolumeExists(ctx, resourceName, &volume),
-					testAccCheckOpenzfsVolumeExists(ctx, resourceName2, &volume2),
-					testAccCheckOpenzfsVolumeGetID(resourceName, &volumeId),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "fsx", regexp.MustCompile(`volume/fs-.+/fsvol-.+`)),
-					acctest.MatchResourceAttrRegionalARN(resourceName2, "arn", "fsx", regexp.MustCompile(`volume/fs-.+/fsvol-.+`)),
-					resource.TestCheckResourceAttrPtr(resourceName2, "parent_volume_id", &volumeId),
+					testAccCheckOpenZFSVolumeExists(ctx, resourceName, &volume),
+					testAccCheckOpenZFSVolumeExists(ctx, resourceName2, &volume2),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "fsx", regexache.MustCompile(`volume/fs-.+/fsvol-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName2, "arn", "fsx", regexache.MustCompile(`volume/fs-.+/fsvol-.+`)),
+					resource.TestCheckResourceAttrPair(resourceName2, "parent_volume_id", resourceName, "id"),
 				),
 			},
 			{
@@ -92,7 +118,7 @@ func TestAccFSxOpenzfsVolume_parentVolume(t *testing.T) {
 	})
 }
 
-func TestAccFSxOpenzfsVolume_tags(t *testing.T) {
+func TestAccFSxOpenZFSVolume_tags(t *testing.T) {
 	ctx := acctest.Context(t)
 	var volume1, volume2, volume3 fsx.Volume
 	resourceName := "aws_fsx_openzfs_volume.test"
@@ -102,12 +128,12 @@ func TestAccFSxOpenzfsVolume_tags(t *testing.T) {
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
 		ErrorCheck:               acctest.ErrorCheck(t, fsx.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckOpenzfsVolumeDestroy(ctx),
+		CheckDestroy:             testAccCheckOpenZFSVolumeDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccOpenZFSVolumeConfig_tags1(rName, "key1", "value1"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOpenzfsVolumeExists(ctx, resourceName, &volume1),
+					testAccCheckOpenZFSVolumeExists(ctx, resourceName, &volume1),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
 				),
@@ -120,8 +146,8 @@ func TestAccFSxOpenzfsVolume_tags(t *testing.T) {
 			{
 				Config: testAccOpenZFSVolumeConfig_tags2(rName, "key1", "value1updated", "key2", "value2"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOpenzfsVolumeExists(ctx, resourceName, &volume2),
-					testAccCheckOpenzfsVolumeNotRecreated(&volume1, &volume2),
+					testAccCheckOpenZFSVolumeExists(ctx, resourceName, &volume2),
+					testAccCheckOpenZFSVolumeNotRecreated(&volume1, &volume2),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1updated"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
@@ -130,8 +156,8 @@ func TestAccFSxOpenzfsVolume_tags(t *testing.T) {
 			{
 				Config: testAccOpenZFSVolumeConfig_tags1(rName, "key2", "value2"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOpenzfsVolumeExists(ctx, resourceName, &volume3),
-					testAccCheckOpenzfsVolumeNotRecreated(&volume2, &volume3),
+					testAccCheckOpenZFSVolumeExists(ctx, resourceName, &volume3),
+					testAccCheckOpenZFSVolumeNotRecreated(&volume2, &volume3),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
 				),
@@ -140,7 +166,7 @@ func TestAccFSxOpenzfsVolume_tags(t *testing.T) {
 	})
 }
 
-func TestAccFSxOpenzfsVolume_copyTags(t *testing.T) {
+func TestAccFSxOpenZFSVolume_copyTags(t *testing.T) {
 	ctx := acctest.Context(t)
 	var volume1, volume2 fsx.Volume
 	resourceName := "aws_fsx_openzfs_volume.test"
@@ -150,36 +176,44 @@ func TestAccFSxOpenzfsVolume_copyTags(t *testing.T) {
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
 		ErrorCheck:               acctest.ErrorCheck(t, fsx.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckOpenzfsVolumeDestroy(ctx),
+		CheckDestroy:             testAccCheckOpenZFSVolumeDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccOpenZFSVolumeConfig_copyTags(rName, "key1", "value1", "true"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOpenzfsVolumeExists(ctx, resourceName, &volume1),
+					testAccCheckOpenZFSVolumeExists(ctx, resourceName, &volume1),
+					resource.TestCheckResourceAttr(resourceName, "copy_tags_to_snapshots", "true"),
+					resource.TestCheckResourceAttr(resourceName, "delete_volume_options.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "delete_volume_options.0", "DELETE_CHILD_VOLUMES_AND_SNAPSHOTS"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
-					resource.TestCheckResourceAttr(resourceName, "copy_tags_to_snapshots", "true"),
 				),
 			},
 			{
 				ResourceName:      resourceName,
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{
+					"delete_volume_options",
+				},
 			},
 			{
 				Config: testAccOpenZFSVolumeConfig_copyTags(rName, "key1", "value1", "false"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOpenzfsVolumeExists(ctx, resourceName, &volume2),
-					testAccCheckOpenzfsVolumeRecreated(&volume1, &volume2),
-					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
+					testAccCheckOpenZFSVolumeExists(ctx, resourceName, &volume2),
+					testAccCheckOpenZFSVolumeRecreated(&volume1, &volume2),
 					resource.TestCheckResourceAttr(resourceName, "copy_tags_to_snapshots", "false"),
+					resource.TestCheckResourceAttr(resourceName, "delete_volume_options.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "delete_volume_options.0", "DELETE_CHILD_VOLUMES_AND_SNAPSHOTS"),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
 				),
 			},
 		},
 	})
 }
 
-func TestAccFSxOpenzfsVolume_name(t *testing.T) {
+func TestAccFSxOpenZFSVolume_name(t *testing.T) {
 	ctx := acctest.Context(t)
 	var volume1, volume2 fsx.Volume
 	resourceName := "aws_fsx_openzfs_volume.test"
@@ -190,12 +224,12 @@ func TestAccFSxOpenzfsVolume_name(t *testing.T) {
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
 		ErrorCheck:               acctest.ErrorCheck(t, fsx.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckOpenzfsVolumeDestroy(ctx),
+		CheckDestroy:             testAccCheckOpenZFSVolumeDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccOpenZFSVolumeConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOpenzfsVolumeExists(ctx, resourceName, &volume1),
+					testAccCheckOpenZFSVolumeExists(ctx, resourceName, &volume1),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 				),
 			},
@@ -207,8 +241,8 @@ func TestAccFSxOpenzfsVolume_name(t *testing.T) {
 			{
 				Config: testAccOpenZFSVolumeConfig_basic(rName2),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOpenzfsVolumeExists(ctx, resourceName, &volume2),
-					testAccCheckOpenzfsVolumeNotRecreated(&volume1, &volume2),
+					testAccCheckOpenZFSVolumeExists(ctx, resourceName, &volume2),
+					testAccCheckOpenZFSVolumeNotRecreated(&volume1, &volume2),
 					resource.TestCheckResourceAttr(resourceName, "name", rName2),
 				),
 			},
@@ -216,7 +250,7 @@ func TestAccFSxOpenzfsVolume_name(t *testing.T) {
 	})
 }
 
-func TestAccFSxOpenzfsVolume_dataCompressionType(t *testing.T) {
+func TestAccFSxOpenZFSVolume_dataCompressionType(t *testing.T) {
 	ctx := acctest.Context(t)
 	var volume1, volume2 fsx.Volume
 	resourceName := "aws_fsx_openzfs_volume.test"
@@ -226,12 +260,12 @@ func TestAccFSxOpenzfsVolume_dataCompressionType(t *testing.T) {
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
 		ErrorCheck:               acctest.ErrorCheck(t, fsx.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckOpenzfsVolumeDestroy(ctx),
+		CheckDestroy:             testAccCheckOpenZFSVolumeDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccOpenZFSVolumeConfig_dataCompression(rName, "ZSTD"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOpenzfsVolumeExists(ctx, resourceName, &volume1),
+					testAccCheckOpenZFSVolumeExists(ctx, resourceName, &volume1),
 					resource.TestCheckResourceAttr(resourceName, "data_compression_type", "ZSTD"),
 				),
 			},
@@ -243,8 +277,8 @@ func TestAccFSxOpenzfsVolume_dataCompressionType(t *testing.T) {
 			{
 				Config: testAccOpenZFSVolumeConfig_dataCompression(rName, "NONE"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOpenzfsVolumeExists(ctx, resourceName, &volume2),
-					testAccCheckOpenzfsVolumeNotRecreated(&volume1, &volume2),
+					testAccCheckOpenZFSVolumeExists(ctx, resourceName, &volume2),
+					testAccCheckOpenZFSVolumeNotRecreated(&volume1, &volume2),
 					resource.TestCheckResourceAttr(resourceName, "data_compression_type", "NONE"),
 				),
 			},
@@ -252,7 +286,7 @@ func TestAccFSxOpenzfsVolume_dataCompressionType(t *testing.T) {
 	})
 }
 
-func TestAccFSxOpenzfsVolume_readOnly(t *testing.T) {
+func TestAccFSxOpenZFSVolume_readOnly(t *testing.T) {
 	ctx := acctest.Context(t)
 	var volume1, volume2 fsx.Volume
 	resourceName := "aws_fsx_openzfs_volume.test"
@@ -262,12 +296,12 @@ func TestAccFSxOpenzfsVolume_readOnly(t *testing.T) {
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
 		ErrorCheck:               acctest.ErrorCheck(t, fsx.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckOpenzfsVolumeDestroy(ctx),
+		CheckDestroy:             testAccCheckOpenZFSVolumeDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccOpenZFSVolumeConfig_readOnly(rName, "false"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOpenzfsVolumeExists(ctx, resourceName, &volume1),
+					testAccCheckOpenZFSVolumeExists(ctx, resourceName, &volume1),
 					resource.TestCheckResourceAttr(resourceName, "read_only", "false"),
 				),
 			},
@@ -279,8 +313,8 @@ func TestAccFSxOpenzfsVolume_readOnly(t *testing.T) {
 			{
 				Config: testAccOpenZFSVolumeConfig_readOnly(rName, "true"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOpenzfsVolumeExists(ctx, resourceName, &volume2),
-					testAccCheckOpenzfsVolumeNotRecreated(&volume1, &volume2),
+					testAccCheckOpenZFSVolumeExists(ctx, resourceName, &volume2),
+					testAccCheckOpenZFSVolumeNotRecreated(&volume1, &volume2),
 					resource.TestCheckResourceAttr(resourceName, "read_only", "true"),
 				),
 			},
@@ -288,7 +322,7 @@ func TestAccFSxOpenzfsVolume_readOnly(t *testing.T) {
 	})
 }
 
-func TestAccFSxOpenzfsVolume_recordSizeKib(t *testing.T) {
+func TestAccFSxOpenZFSVolume_recordSizeKib(t *testing.T) {
 	ctx := acctest.Context(t)
 	var volume1, volume2 fsx.Volume
 	resourceName := "aws_fsx_openzfs_volume.test"
@@ -298,12 +332,12 @@ func TestAccFSxOpenzfsVolume_recordSizeKib(t *testing.T) {
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
 		ErrorCheck:               acctest.ErrorCheck(t, fsx.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckOpenzfsVolumeDestroy(ctx),
+		CheckDestroy:             testAccCheckOpenZFSVolumeDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccOpenZFSVolumeConfig_recordSizeKib(rName, 8),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOpenzfsVolumeExists(ctx, resourceName, &volume1),
+					testAccCheckOpenZFSVolumeExists(ctx, resourceName, &volume1),
 					resource.TestCheckResourceAttr(resourceName, "record_size_kib", "8"),
 				),
 			},
@@ -315,8 +349,8 @@ func TestAccFSxOpenzfsVolume_recordSizeKib(t *testing.T) {
 			{
 				Config: testAccOpenZFSVolumeConfig_recordSizeKib(rName, 1024),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOpenzfsVolumeExists(ctx, resourceName, &volume2),
-					testAccCheckOpenzfsVolumeNotRecreated(&volume1, &volume2),
+					testAccCheckOpenZFSVolumeExists(ctx, resourceName, &volume2),
+					testAccCheckOpenZFSVolumeNotRecreated(&volume1, &volume2),
 					resource.TestCheckResourceAttr(resourceName, "record_size_kib", "1024"),
 				),
 			},
@@ -324,7 +358,7 @@ func TestAccFSxOpenzfsVolume_recordSizeKib(t *testing.T) {
 	})
 }
 
-func TestAccFSxOpenzfsVolume_storageCapacity(t *testing.T) {
+func TestAccFSxOpenZFSVolume_storageCapacity(t *testing.T) {
 	ctx := acctest.Context(t)
 	var volume1, volume2 fsx.Volume
 	resourceName := "aws_fsx_openzfs_volume.test"
@@ -334,12 +368,12 @@ func TestAccFSxOpenzfsVolume_storageCapacity(t *testing.T) {
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
 		ErrorCheck:               acctest.ErrorCheck(t, fsx.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckOpenzfsVolumeDestroy(ctx),
+		CheckDestroy:             testAccCheckOpenZFSVolumeDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccOpenZFSVolumeConfig_storageCapacity(rName, 30, 20),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOpenzfsVolumeExists(ctx, resourceName, &volume1),
+					testAccCheckOpenZFSVolumeExists(ctx, resourceName, &volume1),
 					resource.TestCheckResourceAttr(resourceName, "storage_capacity_quota_gib", "30"),
 					resource.TestCheckResourceAttr(resourceName, "storage_capacity_reservation_gib", "20"),
 				),
@@ -352,8 +386,8 @@ func TestAccFSxOpenzfsVolume_storageCapacity(t *testing.T) {
 			{
 				Config: testAccOpenZFSVolumeConfig_storageCapacity(rName, 40, 30),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOpenzfsVolumeExists(ctx, resourceName, &volume2),
-					testAccCheckOpenzfsVolumeNotRecreated(&volume1, &volume2),
+					testAccCheckOpenZFSVolumeExists(ctx, resourceName, &volume2),
+					testAccCheckOpenZFSVolumeNotRecreated(&volume1, &volume2),
 					resource.TestCheckResourceAttr(resourceName, "storage_capacity_quota_gib", "40"),
 					resource.TestCheckResourceAttr(resourceName, "storage_capacity_reservation_gib", "30"),
 				),
@@ -362,7 +396,7 @@ func TestAccFSxOpenzfsVolume_storageCapacity(t *testing.T) {
 	})
 }
 
-func TestAccFSxOpenzfsVolume_nfsExports(t *testing.T) {
+func TestAccFSxOpenZFSVolume_nfsExports(t *testing.T) {
 	ctx := acctest.Context(t)
 	var volume1, volume2 fsx.Volume
 	resourceName := "aws_fsx_openzfs_volume.test"
@@ -372,12 +406,12 @@ func TestAccFSxOpenzfsVolume_nfsExports(t *testing.T) {
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
 		ErrorCheck:               acctest.ErrorCheck(t, fsx.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckOpenzfsVolumeDestroy(ctx),
+		CheckDestroy:             testAccCheckOpenZFSVolumeDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccOpenZFSVolumeConfig_nfsExports1(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOpenzfsVolumeExists(ctx, resourceName, &volume1),
+					testAccCheckOpenZFSVolumeExists(ctx, resourceName, &volume1),
 					resource.TestCheckResourceAttr(resourceName, "nfs_exports.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "nfs_exports.0.client_configurations.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "nfs_exports.0.client_configurations.0.clients", "10.0.1.0/24"),
@@ -394,8 +428,8 @@ func TestAccFSxOpenzfsVolume_nfsExports(t *testing.T) {
 			{
 				Config: testAccOpenZFSVolumeConfig_nfsExports2(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOpenzfsVolumeExists(ctx, resourceName, &volume2),
-					testAccCheckOpenzfsVolumeNotRecreated(&volume1, &volume2),
+					testAccCheckOpenZFSVolumeExists(ctx, resourceName, &volume2),
+					testAccCheckOpenZFSVolumeNotRecreated(&volume1, &volume2),
 					resource.TestCheckResourceAttr(resourceName, "nfs_exports.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "nfs_exports.0.client_configurations.#", "2"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "nfs_exports.0.client_configurations.*", map[string]string{
@@ -414,7 +448,7 @@ func TestAccFSxOpenzfsVolume_nfsExports(t *testing.T) {
 	})
 }
 
-func TestAccFSxOpenzfsVolume_userAndGroupQuotas(t *testing.T) {
+func TestAccFSxOpenZFSVolume_userAndGroupQuotas(t *testing.T) {
 	ctx := acctest.Context(t)
 	var volume1, volume2 fsx.Volume
 	resourceName := "aws_fsx_openzfs_volume.test"
@@ -424,12 +458,12 @@ func TestAccFSxOpenzfsVolume_userAndGroupQuotas(t *testing.T) {
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
 		ErrorCheck:               acctest.ErrorCheck(t, fsx.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckOpenzfsVolumeDestroy(ctx),
+		CheckDestroy:             testAccCheckOpenZFSVolumeDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccOpenZFSVolumeConfig_userAndGroupQuotas1(rName, 256),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOpenzfsVolumeExists(ctx, resourceName, &volume1),
+					testAccCheckOpenZFSVolumeExists(ctx, resourceName, &volume1),
 					resource.TestCheckResourceAttr(resourceName, "user_and_group_quotas.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "user_and_group_quotas.*", map[string]string{
 						"id":                         "10",
@@ -446,8 +480,8 @@ func TestAccFSxOpenzfsVolume_userAndGroupQuotas(t *testing.T) {
 			{
 				Config: testAccOpenZFSVolumeConfig_userAndGroupQuotas2(rName, 128, 1024),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOpenzfsVolumeExists(ctx, resourceName, &volume2),
-					testAccCheckOpenzfsVolumeNotRecreated(&volume1, &volume2),
+					testAccCheckOpenZFSVolumeExists(ctx, resourceName, &volume2),
+					testAccCheckOpenZFSVolumeNotRecreated(&volume1, &volume2),
 					resource.TestCheckResourceAttr(resourceName, "user_and_group_quotas.#", "4"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "user_and_group_quotas.*", map[string]string{
 						"id":                         "10",
@@ -475,31 +509,28 @@ func TestAccFSxOpenzfsVolume_userAndGroupQuotas(t *testing.T) {
 	})
 }
 
-func testAccCheckOpenzfsVolumeExists(ctx context.Context, resourceName string, volume *fsx.Volume) resource.TestCheckFunc {
+func testAccCheckOpenZFSVolumeExists(ctx context.Context, n string, v *fsx.Volume) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		rs, ok := s.RootModule().Resources[resourceName]
+		rs, ok := s.RootModule().Resources[n]
 		if !ok {
-			return fmt.Errorf("Not found: %s", resourceName)
+			return fmt.Errorf("Not found: %s", n)
 		}
 
 		conn := acctest.Provider.Meta().(*conns.AWSClient).FSxConn(ctx)
 
-		volume1, err := tffsx.FindVolumeByID(ctx, conn, rs.Primary.ID)
+		output, err := tffsx.FindOpenZFSVolumeByID(ctx, conn, rs.Primary.ID)
+
 		if err != nil {
 			return err
 		}
 
-		if volume == nil {
-			return fmt.Errorf("FSx OpenZFS Volume (%s) not found", rs.Primary.ID)
-		}
-
-		*volume = *volume1
+		*v = *output
 
 		return nil
 	}
 }
 
-func testAccCheckOpenzfsVolumeDestroy(ctx context.Context) resource.TestCheckFunc {
+func testAccCheckOpenZFSVolumeDestroy(ctx context.Context) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		conn := acctest.Provider.Meta().(*conns.AWSClient).FSxConn(ctx)
 
@@ -508,85 +539,59 @@ func testAccCheckOpenzfsVolumeDestroy(ctx context.Context) resource.TestCheckFun
 				continue
 			}
 
-			volume, err := tffsx.FindVolumeByID(ctx, conn, rs.Primary.ID)
+			_, err := tffsx.FindOpenZFSVolumeByID(ctx, conn, rs.Primary.ID)
+
 			if tfresource.NotFound(err) {
 				continue
 			}
 
-			if volume != nil {
-				return fmt.Errorf("FSx OpenZFS Volume (%s) still exists", rs.Primary.ID)
+			if err != nil {
+				return err
 			}
-		}
-		return nil
-	}
-}
 
-func testAccCheckOpenzfsVolumeGetID(resourceName string, volumeId *string) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		rs, ok := s.RootModule().Resources[resourceName]
-		if !ok {
-			return fmt.Errorf("Not found: %s", resourceName)
+			return fmt.Errorf("FSx for OpenZFS Volume %s still exists", rs.Primary.ID)
 		}
-
-		*volumeId = rs.Primary.ID
-
 		return nil
 	}
 }
 
-func testAccCheckOpenzfsVolumeNotRecreated(i, j *fsx.Volume) resource.TestCheckFunc {
+func testAccCheckOpenZFSVolumeNotRecreated(i, j *fsx.Volume) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		if aws.StringValue(i.VolumeId) != aws.StringValue(j.VolumeId) {
-			return fmt.Errorf("FSx OpenZFS Volume (%s) recreated", aws.StringValue(i.VolumeId))
+			return fmt.Errorf("FSx for OpenZFS Volume (%s) recreated", aws.StringValue(i.VolumeId))
 		}
 
 		return nil
 	}
 }
 
-func testAccCheckOpenzfsVolumeRecreated(i, j *fsx.Volume) resource.TestCheckFunc {
+func testAccCheckOpenZFSVolumeRecreated(i, j *fsx.Volume) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		if aws.StringValue(i.VolumeId) == aws.StringValue(j.VolumeId) {
-			return fmt.Errorf("FSx OpenZFS Volume (%s) not recreated", aws.StringValue(i.VolumeId))
+			return fmt.Errorf("FSx for OpenZFS Volume (%s) not recreated", aws.StringValue(i.VolumeId))
 		}
 
 		return nil
 	}
 }
 
-func testAccOpenzfsVolumeBaseConfig(rName string) string {
-	return acctest.ConfigCompose(acctest.ConfigAvailableAZsNoOptIn(), fmt.Sprintf(`
-data "aws_partition" "current" {}
-
-resource "aws_vpc" "test" {
-  cidr_block = "10.0.0.0/16"
-
-  tags = {
-    Name = %[1]q
-  }
-}
-
-resource "aws_subnet" "test1" {
-  vpc_id            = aws_vpc.test.id
-  cidr_block        = "10.0.1.0/24"
-  availability_zone = data.aws_availability_zones.available.names[0]
-
-  tags = {
-    Name = %[1]q
-  }
-}
-
+func testAccOpenZFSVolumeConfig_base(rName string) string {
+	return acctest.ConfigCompose(acctest.ConfigVPCWithSubnets(rName, 1), fmt.Sprintf(`
 resource "aws_fsx_openzfs_file_system" "test" {
   storage_capacity    = 64
-  subnet_ids          = [aws_subnet.test1.id]
+  subnet_ids          = aws_subnet.test[*].id
   deployment_type     = "SINGLE_AZ_1"
   throughput_capacity = 64
+
+  tags = {
+    Name = %[1]q
+  }
 }
 `, rName))
 }
 
 func testAccOpenZFSVolumeConfig_basic(rName string) string {
-	return acctest.ConfigCompose(testAccOpenzfsVolumeBaseConfig(rName), fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccOpenZFSVolumeConfig_base(rName), fmt.Sprintf(`
 resource "aws_fsx_openzfs_volume" "test" {
   name             = %[1]q
   parent_volume_id = aws_fsx_openzfs_file_system.test.root_volume_id
@@ -595,7 +600,7 @@ resource "aws_fsx_openzfs_volume" "test" {
 }
 
 func testAccOpenZFSVolumeConfig_parent(rName, rName2 string) string {
-	return acctest.ConfigCompose(testAccOpenzfsVolumeBaseConfig(rName), fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccOpenZFSVolumeConfig_base(rName), fmt.Sprintf(`
 resource "aws_fsx_openzfs_volume" "test" {
   name             = %[1]q
   parent_volume_id = aws_fsx_openzfs_file_system.test.root_volume_id
@@ -609,7 +614,7 @@ resource "aws_fsx_openzfs_volume" "test2" {
 }
 
 func testAccOpenZFSVolumeConfig_tags1(rName, tagKey1, tagValue1 string) string {
-	return acctest.ConfigCompose(testAccOpenzfsVolumeBaseConfig(rName), fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccOpenZFSVolumeConfig_base(rName), fmt.Sprintf(`
 resource "aws_fsx_openzfs_volume" "test" {
   name             = %[1]q
   parent_volume_id = aws_fsx_openzfs_file_system.test.root_volume_id
@@ -622,7 +627,7 @@ resource "aws_fsx_openzfs_volume" "test" {
 }
 
 func testAccOpenZFSVolumeConfig_tags2(rName, tagKey1, tagValue1, tagKey2, tagValue2 string) string {
-	return acctest.ConfigCompose(testAccOpenzfsVolumeBaseConfig(rName), fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccOpenZFSVolumeConfig_base(rName), fmt.Sprintf(`
 resource "aws_fsx_openzfs_volume" "test" {
   name             = %[1]q
   parent_volume_id = aws_fsx_openzfs_file_system.test.root_volume_id
@@ -637,7 +642,7 @@ resource "aws_fsx_openzfs_volume" "test" {
 }
 
 func testAccOpenZFSVolumeConfig_copyTags(rName, tagKey1, tagValue1, copyTags string) string {
-	return acctest.ConfigCompose(testAccOpenzfsVolumeBaseConfig(rName), fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccOpenZFSVolumeConfig_base(rName), fmt.Sprintf(`
 resource "aws_fsx_openzfs_volume" "test" {
   name                   = %[1]q
   parent_volume_id       = aws_fsx_openzfs_file_system.test.root_volume_id
@@ -646,12 +651,14 @@ resource "aws_fsx_openzfs_volume" "test" {
   tags = {
     %[2]q = %[3]q
   }
+
+  delete_volume_options = ["DELETE_CHILD_VOLUMES_AND_SNAPSHOTS"]
 }
 `, rName, tagKey1, tagValue1, copyTags))
 }
 
 func testAccOpenZFSVolumeConfig_dataCompression(rName, dType string) string {
-	return acctest.ConfigCompose(testAccOpenzfsVolumeBaseConfig(rName), fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccOpenZFSVolumeConfig_base(rName), fmt.Sprintf(`
 resource "aws_fsx_openzfs_volume" "test" {
   name                  = %[1]q
   parent_volume_id      = aws_fsx_openzfs_file_system.test.root_volume_id
@@ -661,7 +668,7 @@ resource "aws_fsx_openzfs_volume" "test" {
 }
 
 func testAccOpenZFSVolumeConfig_readOnly(rName, readOnly string) string {
-	return acctest.ConfigCompose(testAccOpenzfsVolumeBaseConfig(rName), fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccOpenZFSVolumeConfig_base(rName), fmt.Sprintf(`
 resource "aws_fsx_openzfs_volume" "test" {
   name             = %[1]q
   parent_volume_id = aws_fsx_openzfs_file_system.test.root_volume_id
@@ -671,7 +678,7 @@ resource "aws_fsx_openzfs_volume" "test" {
 }
 
 func testAccOpenZFSVolumeConfig_recordSizeKib(rName string, recordSizeKib int) string {
-	return acctest.ConfigCompose(testAccOpenzfsVolumeBaseConfig(rName), fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccOpenZFSVolumeConfig_base(rName), fmt.Sprintf(`
 resource "aws_fsx_openzfs_volume" "test" {
   name             = %[1]q
   parent_volume_id = aws_fsx_openzfs_file_system.test.root_volume_id
@@ -681,7 +688,7 @@ resource "aws_fsx_openzfs_volume" "test" {
 }
 
 func testAccOpenZFSVolumeConfig_storageCapacity(rName string, storageQuota, storageReservation int) string {
-	return acctest.ConfigCompose(testAccOpenzfsVolumeBaseConfig(rName), fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccOpenZFSVolumeConfig_base(rName), fmt.Sprintf(`
 resource "aws_fsx_openzfs_volume" "test" {
   name                             = %[1]q
   parent_volume_id                 = aws_fsx_openzfs_file_system.test.root_volume_id
@@ -692,7 +699,7 @@ resource "aws_fsx_openzfs_volume" "test" {
 }
 
 func testAccOpenZFSVolumeConfig_nfsExports1(rName string) string {
-	return acctest.ConfigCompose(testAccOpenzfsVolumeBaseConfig(rName), fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccOpenZFSVolumeConfig_base(rName), fmt.Sprintf(`
 resource "aws_fsx_openzfs_volume" "test" {
   name             = %[1]q
   parent_volume_id = aws_fsx_openzfs_file_system.test.root_volume_id
@@ -708,7 +715,7 @@ resource "aws_fsx_openzfs_volume" "test" {
 }
 
 func testAccOpenZFSVolumeConfig_nfsExports2(rName string) string {
-	return acctest.ConfigCompose(testAccOpenzfsVolumeBaseConfig(rName), fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccOpenZFSVolumeConfig_base(rName), fmt.Sprintf(`
 resource "aws_fsx_openzfs_volume" "test" {
   name             = %[1]q
   parent_volume_id = aws_fsx_openzfs_file_system.test.root_volume_id
@@ -727,7 +734,7 @@ resource "aws_fsx_openzfs_volume" "test" {
 }
 
 func testAccOpenZFSVolumeConfig_userAndGroupQuotas1(rName string, quotaSize int) string {
-	return acctest.ConfigCompose(testAccOpenzfsVolumeBaseConfig(rName), fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccOpenZFSVolumeConfig_base(rName), fmt.Sprintf(`
 resource "aws_fsx_openzfs_volume" "test" {
   name             = %[1]q
   parent_volume_id = aws_fsx_openzfs_file_system.test.root_volume_id
@@ -741,7 +748,7 @@ resource "aws_fsx_openzfs_volume" "test" {
 }
 
 func testAccOpenZFSVolumeConfig_userAndGroupQuotas2(rName string, userQuota, groupQuota int) string {
-	return acctest.ConfigCompose(testAccOpenzfsVolumeBaseConfig(rName), fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccOpenZFSVolumeConfig_base(rName), fmt.Sprintf(`
 resource "aws_fsx_openzfs_volume" "test" {
   name             = %[1]q
   parent_volume_id = aws_fsx_openzfs_file_system.test.root_volume_id
diff --git a/internal/service/fsx/service_package_gen.go b/internal/service/fsx/service_package_gen.go
index a4ec1aac224..a3a7ca036b9 100644
--- a/internal/service/fsx/service_package_gen.go
+++ b/internal/service/fsx/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	fsx_sdkv1 "github.com/aws/aws-sdk-go/service/fsx"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -24,6 +25,21 @@ func (p *servicePackage) FrameworkResources(ctx context.Context) []*types.Servic
 
 func (p *servicePackage) SDKDataSources(ctx context.Context) []*types.ServicePackageSDKDataSource {
 	return []*types.ServicePackageSDKDataSource{
+		{
+			Factory:  DataSourceONTAPFileSystem,
+			TypeName: "aws_fsx_ontap_file_system",
+			Name:     "Ontap File System",
+		},
+		{
+			Factory:  DataSourceONTAPStorageVirtualMachine,
+			TypeName: "aws_fsx_ontap_storage_virtual_machine",
+			Name:     "ONTAP Storage Virtual Machine",
+		},
+		{
+			Factory:  DataSourceONTAPStorageVirtualMachines,
+			TypeName: "aws_fsx_ontap_storage_virtual_machines",
+			Name:     "ONTAP Storage Virtual Machines",
+		},
 		{
 			Factory:  DataSourceOpenzfsSnapshot,
 			TypeName: "aws_fsx_openzfs_snapshot",
@@ -70,7 +86,7 @@ func (p *servicePackage) SDKResources(ctx context.Context) []*types.ServicePacka
 			},
 		},
 		{
-			Factory:  ResourceOntapFileSystem,
+			Factory:  ResourceONTAPFileSystem,
 			TypeName: "aws_fsx_ontap_file_system",
 			Name:     "ONTAP File System",
 			Tags: &types.ServicePackageResourceTags{
@@ -78,7 +94,7 @@ func (p *servicePackage) SDKResources(ctx context.Context) []*types.ServicePacka
 			},
 		},
 		{
-			Factory:  ResourceOntapStorageVirtualMachine,
+			Factory:  ResourceONTAPStorageVirtualMachine,
 			TypeName: "aws_fsx_ontap_storage_virtual_machine",
 			Name:     "ONTAP Storage Virtual Machine",
 			Tags: &types.ServicePackageResourceTags{
@@ -86,7 +102,7 @@ func (p *servicePackage) SDKResources(ctx context.Context) []*types.ServicePacka
 			},
 		},
 		{
-			Factory:  ResourceOntapVolume,
+			Factory:  ResourceONTAPVolume,
 			TypeName: "aws_fsx_ontap_volume",
 			Name:     "ONTAP Volume",
 			Tags: &types.ServicePackageResourceTags{
@@ -94,7 +110,7 @@ func (p *servicePackage) SDKResources(ctx context.Context) []*types.ServicePacka
 			},
 		},
 		{
-			Factory:  ResourceOpenzfsFileSystem,
+			Factory:  ResourceOpenZFSFileSystem,
 			TypeName: "aws_fsx_openzfs_file_system",
 			Name:     "OpenZFS File System",
 			Tags: &types.ServicePackageResourceTags{
@@ -110,7 +126,7 @@ func (p *servicePackage) SDKResources(ctx context.Context) []*types.ServicePacka
 			},
 		},
 		{
-			Factory:  ResourceOpenzfsVolume,
+			Factory:  ResourceOpenZFSVolume,
 			TypeName: "aws_fsx_openzfs_volume",
 			Name:     "OpenZFS Volume",
 			Tags: &types.ServicePackageResourceTags{
@@ -139,4 +155,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*f
 	return fsx_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/fsx/status.go b/internal/service/fsx/status.go
index 44d1fda90da..84848f7cb96 100644
--- a/internal/service/fsx/status.go
+++ b/internal/service/fsx/status.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package fsx
 
 import (
@@ -9,22 +12,6 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
-func statusAdministrativeAction(ctx context.Context, conn *fsx.FSx, fsID, actionType string) retry.StateRefreshFunc {
-	return func() (interface{}, string, error) {
-		output, err := FindAdministrativeActionByFileSystemIDAndActionType(ctx, conn, fsID, actionType)
-
-		if tfresource.NotFound(err) {
-			return nil, "", nil
-		}
-
-		if err != nil {
-			return nil, "", err
-		}
-
-		return output, aws.StringValue(output.Status), nil
-	}
-}
-
 func statusBackup(ctx context.Context, conn *fsx.FSx, id string) retry.StateRefreshFunc {
 	return func() (interface{}, string, error) {
 		output, err := FindBackupByID(ctx, conn, id)
@@ -56,70 +43,6 @@ func statusFileCache(ctx context.Context, conn *fsx.FSx, id string) retry.StateR
 	}
 }
 
-func statusFileSystem(ctx context.Context, conn *fsx.FSx, id string) retry.StateRefreshFunc {
-	return func() (interface{}, string, error) {
-		output, err := FindFileSystemByID(ctx, conn, id)
-
-		if tfresource.NotFound(err) {
-			return nil, "", nil
-		}
-
-		if err != nil {
-			return nil, "", err
-		}
-
-		return output, aws.StringValue(output.Lifecycle), nil
-	}
-}
-
-func statusDataRepositoryAssociation(ctx context.Context, conn *fsx.FSx, id string) retry.StateRefreshFunc {
-	return func() (interface{}, string, error) {
-		output, err := FindDataRepositoryAssociationByID(ctx, conn, id)
-
-		if tfresource.NotFound(err) {
-			return nil, "", nil
-		}
-
-		if err != nil {
-			return nil, "", err
-		}
-
-		return output, aws.StringValue(output.Lifecycle), nil
-	}
-}
-
-func statusStorageVirtualMachine(ctx context.Context, conn *fsx.FSx, id string) retry.StateRefreshFunc {
-	return func() (interface{}, string, error) {
-		output, err := FindStorageVirtualMachineByID(ctx, conn, id)
-
-		if tfresource.NotFound(err) {
-			return nil, "", nil
-		}
-
-		if err != nil {
-			return nil, "", err
-		}
-
-		return output, aws.StringValue(output.Lifecycle), nil
-	}
-}
-
-func statusVolume(ctx context.Context, conn *fsx.FSx, id string) retry.StateRefreshFunc {
-	return func() (interface{}, string, error) {
-		output, err := FindVolumeByID(ctx, conn, id)
-
-		if tfresource.NotFound(err) {
-			return nil, "", nil
-		}
-
-		if err != nil {
-			return nil, "", err
-		}
-
-		return output, aws.StringValue(output.Lifecycle), nil
-	}
-}
-
 func statusSnapshot(ctx context.Context, conn *fsx.FSx, id string) retry.StateRefreshFunc {
 	return func() (interface{}, string, error) {
 		output, err := FindSnapshotByID(ctx, conn, id)
diff --git a/internal/service/fsx/sweep.go b/internal/service/fsx/sweep.go
index 9a8cd5c7a23..ea84d75ea36 100644
--- a/internal/service/fsx/sweep.go
+++ b/internal/service/fsx/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package fsx
 
@@ -12,9 +12,10 @@ import (
 	"github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_fsx_backup", &resource.Sweeper{
 		Name: "aws_fsx_backup",
 		F:    sweepBackups,
@@ -23,28 +24,40 @@ func init() {
 	resource.AddTestSweepers("aws_fsx_lustre_file_system", &resource.Sweeper{
 		Name: "aws_fsx_lustre_file_system",
 		F:    sweepLustreFileSystems,
+		Dependencies: []string{
+			"aws_datasync_location",
+		},
 	})
 
 	resource.AddTestSweepers("aws_fsx_ontap_file_system", &resource.Sweeper{
-		Name:         "aws_fsx_ontap_file_system",
-		F:            sweepOntapFileSystems,
-		Dependencies: []string{"aws_fsx_ontap_storage_virtual_machine"},
+		Name: "aws_fsx_ontap_file_system",
+		F:    sweepONTAPFileSystems,
+		Dependencies: []string{
+			"aws_datasync_location",
+			"aws_fsx_ontap_storage_virtual_machine",
+		},
 	})
 
 	resource.AddTestSweepers("aws_fsx_ontap_storage_virtual_machine", &resource.Sweeper{
-		Name:         "aws_fsx_ontap_storage_virtual_machine",
-		F:            sweepOntapStorageVirtualMachine,
-		Dependencies: []string{"aws_fsx_ontap_volume"},
+		Name: "aws_fsx_ontap_storage_virtual_machine",
+		F:    sweepONTAPStorageVirtualMachine,
+		Dependencies: []string{
+			"aws_fsx_ontap_volume",
+		},
 	})
 
 	resource.AddTestSweepers("aws_fsx_ontap_volume", &resource.Sweeper{
 		Name: "aws_fsx_ontap_volume",
-		F:    sweepOntapVolume,
+		F:    sweepONTAPVolumes,
 	})
 
 	resource.AddTestSweepers("aws_fsx_openzfs_file_system", &resource.Sweeper{
 		Name: "aws_fsx_openzfs_file_system",
 		F:    sweepOpenZFSFileSystems,
+		Dependencies: []string{
+			"aws_datasync_location",
+			"aws_fsx_openzfs_volume",
+		},
 	})
 
 	resource.AddTestSweepers("aws_fsx_openzfs_volume", &resource.Sweeper{
@@ -56,6 +69,7 @@ func init() {
 		Name: "aws_fsx_windows_file_system",
 		F:    sweepWindowsFileSystems,
 		Dependencies: []string{
+			"aws_datasync_location",
 			"aws_storagegateway_file_system_association",
 		},
 	})
@@ -63,7 +77,7 @@ func init() {
 
 func sweepBackups(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
@@ -94,11 +108,11 @@ func sweepBackups(region string) error {
 		errs = multierror.Append(errs, fmt.Errorf("error listing FSx Backups for %s: %w", region, err))
 	}
 
-	if err = sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err = sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("error sweeping FSx Backups for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
+	if awsv1.SkipSweepError(errs.ErrorOrNil()) {
 		log.Printf("[WARN] Skipping FSx Backups sweep for %s: %s", region, errs)
 		return nil
 	}
@@ -108,7 +122,7 @@ func sweepBackups(region string) error {
 
 func sweepLustreFileSystems(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
@@ -143,11 +157,11 @@ func sweepLustreFileSystems(region string) error {
 		errs = multierror.Append(errs, fmt.Errorf("error listing FSx Lustre File Systems for %s: %w", region, err))
 	}
 
-	if err = sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err = sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("error sweeping FSx Lustre File Systems for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
+	if awsv1.SkipSweepError(errs.ErrorOrNil()) {
 		log.Printf("[WARN] Skipping FSx Lustre File System sweep for %s: %s", region, errs)
 		return nil
 	}
@@ -155,9 +169,9 @@ func sweepLustreFileSystems(region string) error {
 	return errs.ErrorOrNil()
 }
 
-func sweepOntapFileSystems(region string) error {
+func sweepONTAPFileSystems(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
@@ -178,7 +192,7 @@ func sweepOntapFileSystems(region string) error {
 				continue
 			}
 
-			r := ResourceOntapFileSystem()
+			r := ResourceONTAPFileSystem()
 			d := r.Data(nil)
 			d.SetId(aws.StringValue(fs.FileSystemId))
 
@@ -192,11 +206,11 @@ func sweepOntapFileSystems(region string) error {
 		errs = multierror.Append(errs, fmt.Errorf("error listing FSx ONTAP File Systems for %s: %w", region, err))
 	}
 
-	if err = sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err = sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("error sweeping FSx ONTAP File Systems for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
+	if awsv1.SkipSweepError(errs.ErrorOrNil()) {
 		log.Printf("[WARN] Skipping FSx ONTAP File System sweep for %s: %s", region, errs)
 		return nil
 	}
@@ -204,9 +218,9 @@ func sweepOntapFileSystems(region string) error {
 	return errs.ErrorOrNil()
 }
 
-func sweepOntapStorageVirtualMachine(region string) error {
+func sweepONTAPStorageVirtualMachine(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
@@ -223,7 +237,7 @@ func sweepOntapStorageVirtualMachine(region string) error {
 		}
 
 		for _, vm := range page.StorageVirtualMachines {
-			r := ResourceOntapStorageVirtualMachine()
+			r := ResourceONTAPStorageVirtualMachine()
 			d := r.Data(nil)
 			d.SetId(aws.StringValue(vm.StorageVirtualMachineId))
 
@@ -237,11 +251,11 @@ func sweepOntapStorageVirtualMachine(region string) error {
 		errs = multierror.Append(errs, fmt.Errorf("error listing FSx ONTAP Storage Virtual Machine for %s: %w", region, err))
 	}
 
-	if err = sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err = sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("error sweeping FSx ONTAP Storage Virtual Machine for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
+	if awsv1.SkipSweepError(errs.ErrorOrNil()) {
 		log.Printf("[WARN] Skipping FSx ONTAP Storage Virtual Machine sweep for %s: %s", region, errs)
 		return nil
 	}
@@ -249,9 +263,9 @@ func sweepOntapStorageVirtualMachine(region string) error {
 	return errs.ErrorOrNil()
 }
 
-func sweepOntapVolume(region string) error {
+func sweepONTAPVolumes(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
@@ -275,9 +289,11 @@ func sweepOntapVolume(region string) error {
 				continue
 			}
 
-			r := ResourceOntapVolume()
+			r := ResourceONTAPVolume()
 			d := r.Data(nil)
 			d.SetId(aws.StringValue(v.VolumeId))
+			d.Set("bypass_snaplock_enterprise_retention", true)
+			d.Set("skip_final_backup", true)
 
 			sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
 		}
@@ -289,11 +305,11 @@ func sweepOntapVolume(region string) error {
 		errs = multierror.Append(errs, fmt.Errorf("error listing FSx ONTAP Volume for %s: %w", region, err))
 	}
 
-	if err = sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err = sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("error sweeping FSx ONTAP Volume for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
+	if awsv1.SkipSweepError(errs.ErrorOrNil()) {
 		log.Printf("[WARN] Skipping FSx ONTAP Volume sweep for %s: %s", region, errs)
 		return nil
 	}
@@ -303,7 +319,7 @@ func sweepOntapVolume(region string) error {
 
 func sweepOpenZFSFileSystems(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
@@ -324,7 +340,7 @@ func sweepOpenZFSFileSystems(region string) error {
 				continue
 			}
 
-			r := ResourceOpenzfsFileSystem()
+			r := ResourceOpenZFSFileSystem()
 			d := r.Data(nil)
 			d.SetId(aws.StringValue(fs.FileSystemId))
 
@@ -338,11 +354,11 @@ func sweepOpenZFSFileSystems(region string) error {
 		errs = multierror.Append(errs, fmt.Errorf("error listing FSx OpenZFS File Systems for %s: %w", region, err))
 	}
 
-	if err = sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err = sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("error sweeping FSx OpenZFS File Systems for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
+	if awsv1.SkipSweepError(errs.ErrorOrNil()) {
 		log.Printf("[WARN] Skipping FSx OpenZFS File System sweep for %s: %s", region, errs)
 		return nil
 	}
@@ -352,7 +368,7 @@ func sweepOpenZFSFileSystems(region string) error {
 
 func sweepOpenZFSVolume(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
@@ -376,7 +392,7 @@ func sweepOpenZFSVolume(region string) error {
 				continue
 			}
 
-			r := ResourceOpenzfsVolume()
+			r := ResourceOpenZFSVolume()
 			d := r.Data(nil)
 			d.SetId(aws.StringValue(v.VolumeId))
 
@@ -390,11 +406,11 @@ func sweepOpenZFSVolume(region string) error {
 		errs = multierror.Append(errs, fmt.Errorf("error listing FSx OpenZFS Volume for %s: %w", region, err))
 	}
 
-	if err = sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err = sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("error sweeping FSx OpenZFS Volume for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
+	if awsv1.SkipSweepError(errs.ErrorOrNil()) {
 		log.Printf("[WARN] Skipping FSx OpenZFS Volume sweep for %s: %s", region, errs)
 		return nil
 	}
@@ -404,7 +420,7 @@ func sweepOpenZFSVolume(region string) error {
 
 func sweepWindowsFileSystems(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
@@ -440,11 +456,11 @@ func sweepWindowsFileSystems(region string) error {
 		errs = multierror.Append(errs, fmt.Errorf("error listing FSx Windows File Systems for %s: %w", region, err))
 	}
 
-	if err = sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err = sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("error sweeping FSx Windows File Systems for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
+	if awsv1.SkipSweepError(errs.ErrorOrNil()) {
 		log.Printf("[WARN] Skipping FSx Windows File System sweep for %s: %s", region, errs)
 		return nil
 	}
diff --git a/internal/service/fsx/tags_gen.go b/internal/service/fsx/tags_gen.go
index 4547bab7c87..0e1d9cdfe31 100644
--- a/internal/service/fsx/tags_gen.go
+++ b/internal/service/fsx/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/fsx"
 	"github.com/aws/aws-sdk-go/service/fsx/fsxiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -102,6 +104,8 @@ func updateTags(ctx context.Context, conn fsxiface.FSxAPI, identifier string, ol
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.FSx)
 	if len(removedTags) > 0 {
diff --git a/internal/service/fsx/wait.go b/internal/service/fsx/wait.go
index a6f45301431..69a98e51658 100644
--- a/internal/service/fsx/wait.go
+++ b/internal/service/fsx/wait.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package fsx
 
 import (
@@ -16,28 +19,6 @@ const (
 	backupDeletedTimeout   = 10 * time.Minute
 )
 
-func waitAdministrativeActionCompleted(ctx context.Context, conn *fsx.FSx, fsID, actionType string, timeout time.Duration) (*fsx.AdministrativeAction, error) { //nolint:unparam
-	stateConf := &retry.StateChangeConf{
-		Pending: []string{fsx.StatusInProgress, fsx.StatusPending},
-		Target:  []string{fsx.StatusCompleted, fsx.StatusUpdatedOptimizing},
-		Refresh: statusAdministrativeAction(ctx, conn, fsID, actionType),
-		Timeout: timeout,
-		Delay:   30 * time.Second,
-	}
-
-	outputRaw, err := stateConf.WaitForStateContext(ctx)
-
-	if output, ok := outputRaw.(*fsx.AdministrativeAction); ok {
-		if status, details := aws.StringValue(output.Status), output.FailureDetails; status == fsx.StatusFailed && details != nil {
-			tfresource.SetLastError(err, errors.New(aws.StringValue(output.FailureDetails.Message)))
-		}
-
-		return output, err
-	}
-
-	return nil, err
-}
-
 func waitBackupAvailable(ctx context.Context, conn *fsx.FSx, id string) (*fsx.Backup, error) {
 	stateConf := &retry.StateChangeConf{
 		Pending: []string{fsx.BackupLifecycleCreating, fsx.BackupLifecyclePending, fsx.BackupLifecycleTransferring},
@@ -134,270 +115,6 @@ func waitFileCacheDeleted(ctx context.Context, conn *fsx.FSx, id string, timeout
 	return nil, err
 }
 
-func waitFileSystemCreated(ctx context.Context, conn *fsx.FSx, id string, timeout time.Duration) (*fsx.FileSystem, error) { //nolint:unparam
-	stateConf := &retry.StateChangeConf{
-		Pending: []string{fsx.FileSystemLifecycleCreating},
-		Target:  []string{fsx.FileSystemLifecycleAvailable},
-		Refresh: statusFileSystem(ctx, conn, id),
-		Timeout: timeout,
-		Delay:   30 * time.Second,
-	}
-
-	outputRaw, err := stateConf.WaitForStateContext(ctx)
-
-	if output, ok := outputRaw.(*fsx.FileSystem); ok {
-		if status, details := aws.StringValue(output.Lifecycle), output.FailureDetails; status == fsx.FileSystemLifecycleFailed && details != nil {
-			tfresource.SetLastError(err, errors.New(aws.StringValue(output.FailureDetails.Message)))
-		}
-
-		return output, err
-	}
-
-	return nil, err
-}
-
-func waitFileSystemUpdated(ctx context.Context, conn *fsx.FSx, id string, timeout time.Duration) (*fsx.FileSystem, error) { //nolint:unparam
-	stateConf := &retry.StateChangeConf{
-		Pending: []string{fsx.FileSystemLifecycleUpdating},
-		Target:  []string{fsx.FileSystemLifecycleAvailable},
-		Refresh: statusFileSystem(ctx, conn, id),
-		Timeout: timeout,
-		Delay:   30 * time.Second,
-	}
-
-	outputRaw, err := stateConf.WaitForStateContext(ctx)
-
-	if output, ok := outputRaw.(*fsx.FileSystem); ok {
-		if status, details := aws.StringValue(output.Lifecycle), output.FailureDetails; status == fsx.FileSystemLifecycleFailed && details != nil {
-			tfresource.SetLastError(err, errors.New(aws.StringValue(output.FailureDetails.Message)))
-		}
-
-		return output, err
-	}
-
-	return nil, err
-}
-
-func waitFileSystemDeleted(ctx context.Context, conn *fsx.FSx, id string, timeout time.Duration) (*fsx.FileSystem, error) { //nolint:unparam
-	stateConf := &retry.StateChangeConf{
-		Pending: []string{fsx.FileSystemLifecycleAvailable, fsx.FileSystemLifecycleDeleting},
-		Target:  []string{},
-		Refresh: statusFileSystem(ctx, conn, id),
-		Timeout: timeout,
-		Delay:   30 * time.Second,
-	}
-
-	outputRaw, err := stateConf.WaitForStateContext(ctx)
-
-	if output, ok := outputRaw.(*fsx.FileSystem); ok {
-		if status, details := aws.StringValue(output.Lifecycle), output.FailureDetails; status == fsx.FileSystemLifecycleFailed && details != nil {
-			tfresource.SetLastError(err, errors.New(aws.StringValue(output.FailureDetails.Message)))
-		}
-
-		return output, err
-	}
-
-	return nil, err
-}
-
-func waitDataRepositoryAssociationCreated(ctx context.Context, conn *fsx.FSx, id string, timeout time.Duration) (*fsx.DataRepositoryAssociation, error) {
-	stateConf := &retry.StateChangeConf{
-		Pending: []string{fsx.DataRepositoryLifecycleCreating},
-		Target:  []string{fsx.DataRepositoryLifecycleAvailable},
-		Refresh: statusDataRepositoryAssociation(ctx, conn, id),
-		Timeout: timeout,
-		Delay:   30 * time.Second,
-	}
-
-	outputRaw, err := stateConf.WaitForStateContext(ctx)
-
-	if output, ok := outputRaw.(*fsx.DataRepositoryAssociation); ok {
-		if status, details := aws.StringValue(output.Lifecycle), output.FailureDetails; status == fsx.DataRepositoryLifecycleFailed && details != nil {
-			tfresource.SetLastError(err, errors.New(aws.StringValue(output.FailureDetails.Message)))
-		}
-
-		return output, err
-	}
-
-	return nil, err
-}
-
-func waitDataRepositoryAssociationUpdated(ctx context.Context, conn *fsx.FSx, id string, timeout time.Duration) (*fsx.DataRepositoryAssociation, error) {
-	stateConf := &retry.StateChangeConf{
-		Pending: []string{fsx.DataRepositoryLifecycleUpdating},
-		Target:  []string{fsx.DataRepositoryLifecycleAvailable},
-		Refresh: statusDataRepositoryAssociation(ctx, conn, id),
-		Timeout: timeout,
-		Delay:   30 * time.Second,
-	}
-
-	outputRaw, err := stateConf.WaitForStateContext(ctx)
-
-	if output, ok := outputRaw.(*fsx.DataRepositoryAssociation); ok {
-		if status, details := aws.StringValue(output.Lifecycle), output.FailureDetails; status == fsx.DataRepositoryLifecycleFailed && details != nil {
-			tfresource.SetLastError(err, errors.New(aws.StringValue(output.FailureDetails.Message)))
-		}
-
-		return output, err
-	}
-
-	return nil, err
-}
-
-func waitDataRepositoryAssociationDeleted(ctx context.Context, conn *fsx.FSx, id string, timeout time.Duration) (*fsx.DataRepositoryAssociation, error) {
-	stateConf := &retry.StateChangeConf{
-		Pending: []string{fsx.DataRepositoryLifecycleAvailable, fsx.DataRepositoryLifecycleDeleting},
-		Target:  []string{},
-		Refresh: statusDataRepositoryAssociation(ctx, conn, id),
-		Timeout: timeout,
-		Delay:   30 * time.Second,
-	}
-
-	outputRaw, err := stateConf.WaitForStateContext(ctx)
-
-	if output, ok := outputRaw.(*fsx.DataRepositoryAssociation); ok {
-		if status, details := aws.StringValue(output.Lifecycle), output.FailureDetails; status == fsx.DataRepositoryLifecycleFailed && details != nil {
-			tfresource.SetLastError(err, errors.New(aws.StringValue(output.FailureDetails.Message)))
-		}
-
-		return output, err
-	}
-
-	return nil, err
-}
-
-func waitStorageVirtualMachineCreated(ctx context.Context, conn *fsx.FSx, id string, timeout time.Duration) (*fsx.StorageVirtualMachine, error) {
-	stateConf := &retry.StateChangeConf{
-		Pending: []string{fsx.StorageVirtualMachineLifecycleCreating, fsx.StorageVirtualMachineLifecyclePending},
-		Target:  []string{fsx.StorageVirtualMachineLifecycleCreated, fsx.StorageVirtualMachineLifecycleMisconfigured},
-		Refresh: statusStorageVirtualMachine(ctx, conn, id),
-		Timeout: timeout,
-		Delay:   30 * time.Second,
-	}
-
-	outputRaw, err := stateConf.WaitForStateContext(ctx)
-
-	if output, ok := outputRaw.(*fsx.StorageVirtualMachine); ok {
-		if status, details := aws.StringValue(output.Lifecycle), output.LifecycleTransitionReason; status == fsx.FileSystemLifecycleFailed && details != nil {
-			tfresource.SetLastError(err, errors.New(aws.StringValue(output.LifecycleTransitionReason.Message)))
-		}
-
-		return output, err
-	}
-
-	return nil, err
-}
-
-func waitStorageVirtualMachineUpdated(ctx context.Context, conn *fsx.FSx, id string, timeout time.Duration) (*fsx.StorageVirtualMachine, error) {
-	stateConf := &retry.StateChangeConf{
-		Pending: []string{fsx.StorageVirtualMachineLifecyclePending},
-		Target:  []string{fsx.StorageVirtualMachineLifecycleCreated, fsx.StorageVirtualMachineLifecycleMisconfigured},
-		Refresh: statusStorageVirtualMachine(ctx, conn, id),
-		Timeout: timeout,
-		Delay:   30 * time.Second,
-	}
-
-	outputRaw, err := stateConf.WaitForStateContext(ctx)
-
-	if output, ok := outputRaw.(*fsx.StorageVirtualMachine); ok {
-		if status, details := aws.StringValue(output.Lifecycle), output.LifecycleTransitionReason; status == fsx.FileSystemLifecycleFailed && details != nil {
-			tfresource.SetLastError(err, errors.New(aws.StringValue(output.LifecycleTransitionReason.Message)))
-		}
-
-		return output, err
-	}
-
-	return nil, err
-}
-
-func waitStorageVirtualMachineDeleted(ctx context.Context, conn *fsx.FSx, id string, timeout time.Duration) (*fsx.StorageVirtualMachine, error) {
-	stateConf := &retry.StateChangeConf{
-		Pending: []string{fsx.StorageVirtualMachineLifecycleCreated, fsx.StorageVirtualMachineLifecycleDeleting},
-		Target:  []string{},
-		Refresh: statusStorageVirtualMachine(ctx, conn, id),
-		Timeout: timeout,
-		Delay:   30 * time.Second,
-	}
-
-	outputRaw, err := stateConf.WaitForStateContext(ctx)
-
-	if output, ok := outputRaw.(*fsx.StorageVirtualMachine); ok {
-		if status, details := aws.StringValue(output.Lifecycle), output.LifecycleTransitionReason; status == fsx.StorageVirtualMachineLifecycleFailed && details != nil {
-			tfresource.SetLastError(err, errors.New(aws.StringValue(output.LifecycleTransitionReason.Message)))
-		}
-
-		return output, err
-	}
-
-	return nil, err
-}
-
-func waitVolumeCreated(ctx context.Context, conn *fsx.FSx, id string, timeout time.Duration) (*fsx.Volume, error) { //nolint:unparam
-	stateConf := &retry.StateChangeConf{
-		Pending: []string{fsx.VolumeLifecycleCreating, fsx.VolumeLifecyclePending},
-		Target:  []string{fsx.VolumeLifecycleCreated, fsx.VolumeLifecycleMisconfigured, fsx.VolumeLifecycleAvailable},
-		Refresh: statusVolume(ctx, conn, id),
-		Timeout: timeout,
-		Delay:   30 * time.Second,
-	}
-
-	outputRaw, err := stateConf.WaitForStateContext(ctx)
-
-	if output, ok := outputRaw.(*fsx.Volume); ok {
-		if status, details := aws.StringValue(output.Lifecycle), output.LifecycleTransitionReason; status == fsx.VolumeLifecycleFailed && details != nil {
-			tfresource.SetLastError(err, errors.New(aws.StringValue(output.LifecycleTransitionReason.Message)))
-		}
-
-		return output, err
-	}
-
-	return nil, err
-}
-
-func waitVolumeUpdated(ctx context.Context, conn *fsx.FSx, id string, timeout time.Duration) (*fsx.Volume, error) { //nolint:unparam
-	stateConf := &retry.StateChangeConf{
-		Pending: []string{fsx.VolumeLifecyclePending},
-		Target:  []string{fsx.VolumeLifecycleCreated, fsx.VolumeLifecycleMisconfigured, fsx.VolumeLifecycleAvailable},
-		Refresh: statusVolume(ctx, conn, id),
-		Timeout: timeout,
-		Delay:   150 * time.Second,
-	}
-
-	outputRaw, err := stateConf.WaitForStateContext(ctx)
-
-	if output, ok := outputRaw.(*fsx.Volume); ok {
-		if status, details := aws.StringValue(output.Lifecycle), output.LifecycleTransitionReason; status == fsx.VolumeLifecycleFailed && details != nil {
-			tfresource.SetLastError(err, errors.New(aws.StringValue(output.LifecycleTransitionReason.Message)))
-		}
-
-		return output, err
-	}
-
-	return nil, err
-}
-
-func waitVolumeDeleted(ctx context.Context, conn *fsx.FSx, id string, timeout time.Duration) (*fsx.Volume, error) { //nolint:unparam
-	stateConf := &retry.StateChangeConf{
-		Pending: []string{fsx.VolumeLifecycleCreated, fsx.VolumeLifecycleMisconfigured, fsx.VolumeLifecycleAvailable, fsx.VolumeLifecycleDeleting},
-		Target:  []string{},
-		Refresh: statusVolume(ctx, conn, id),
-		Timeout: timeout,
-		Delay:   30 * time.Second,
-	}
-
-	outputRaw, err := stateConf.WaitForStateContext(ctx)
-
-	if output, ok := outputRaw.(*fsx.Volume); ok {
-		if status, details := aws.StringValue(output.Lifecycle), output.LifecycleTransitionReason; status == fsx.VolumeLifecycleFailed && details != nil {
-			tfresource.SetLastError(err, errors.New(aws.StringValue(output.LifecycleTransitionReason.Message)))
-		}
-
-		return output, err
-	}
-
-	return nil, err
-}
-
 func waitSnapshotCreated(ctx context.Context, conn *fsx.FSx, id string, timeout time.Duration) (*fsx.Snapshot, error) {
 	stateConf := &retry.StateChangeConf{
 		Pending: []string{fsx.SnapshotLifecycleCreating, fsx.SnapshotLifecyclePending},
diff --git a/internal/service/fsx/windows_file_system.go b/internal/service/fsx/windows_file_system.go
index e09326fad5c..5151a304ba8 100644
--- a/internal/service/fsx/windows_file_system.go
+++ b/internal/service/fsx/windows_file_system.go
@@ -1,13 +1,16 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package fsx
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"strings"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/aws/aws-sdk-go/service/fsx"
@@ -63,7 +66,7 @@ func ResourceWindowsFileSystem() *schema.Resource {
 					Type: schema.TypeString,
 					ValidateFunc: validation.All(
 						validation.StringLenBetween(4, 253),
-						// validation.StringMatch(regexp.MustCompile(`^[A-Za-z0-9]([.][A-Za-z0-9][A-Za-z0-9-]*[A-Za-z0-9])+$`), "must be in the fqdn format hostname.domain"),
+						// validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z]([.][0-9A-Za-z][0-9A-Za-z-]*[0-9A-Za-z])+$`), "must be in the fqdn format hostname.domain"),
 					),
 				},
 			},
@@ -126,7 +129,7 @@ func ResourceWindowsFileSystem() *schema.Resource {
 				Computed: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(5, 5),
-					validation.StringMatch(regexp.MustCompile(`^([01]\d|2[0-3]):?([0-5]\d)$`), "must be in the format HH:MM"),
+					validation.StringMatch(regexache.MustCompile(`^([01]\d|2[0-3]):?([0-5]\d)$`), "must be in the format HH:MM"),
 				),
 			},
 			"deployment_type": {
@@ -136,6 +139,28 @@ func ResourceWindowsFileSystem() *schema.Resource {
 				Default:      fsx.WindowsDeploymentTypeSingleAz1,
 				ValidateFunc: validation.StringInSlice(fsx.WindowsDeploymentType_Values(), false),
 			},
+			"disk_iops_configuration": {
+				Type:     schema.TypeList,
+				Optional: true,
+				Computed: true,
+				MaxItems: 1,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"iops": {
+							Type:         schema.TypeInt,
+							Optional:     true,
+							Computed:     true,
+							ValidateFunc: validation.IntBetween(0, 350000),
+						},
+						"mode": {
+							Type:         schema.TypeString,
+							Optional:     true,
+							Default:      fsx.DiskIopsConfigurationModeAutomatic,
+							ValidateFunc: validation.StringInSlice(fsx.DiskIopsConfigurationMode_Values(), false),
+						},
+					},
+				},
+			},
 			"dns_name": {
 				Type:     schema.TypeString,
 				Computed: true,
@@ -265,7 +290,7 @@ func ResourceWindowsFileSystem() *schema.Resource {
 				Computed: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(7, 7),
-					validation.StringMatch(regexp.MustCompile(`^[1-7]:([01]\d|2[0-3]):?([0-5]\d)$`), "must be in the format d:HH:MM"),
+					validation.StringMatch(regexache.MustCompile(`^[1-7]:([01]\d|2[0-3]):?([0-5]\d)$`), "must be in the format d:HH:MM"),
 				),
 			},
 		},
@@ -278,7 +303,7 @@ func resourceWindowsFileSystemCreate(ctx context.Context, d *schema.ResourceData
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).FSxConn(ctx)
 
-	input := &fsx.CreateFileSystemInput{
+	inputC := &fsx.CreateFileSystemInput{
 		ClientRequestToken: aws.String(id.UniqueId()),
 		FileSystemType:     aws.String(fsx.FileSystemTypeWindows),
 		StorageCapacity:    aws.Int64(int64(d.Get("storage_capacity").(int))),
@@ -290,8 +315,7 @@ func resourceWindowsFileSystemCreate(ctx context.Context, d *schema.ResourceData
 			ThroughputCapacity:           aws.Int64(int64(d.Get("throughput_capacity").(int))),
 		},
 	}
-
-	backupInput := &fsx.CreateFileSystemFromBackupInput{
+	inputB := &fsx.CreateFileSystemFromBackupInput{
 		ClientRequestToken: aws.String(id.UniqueId()),
 		SubnetIds:          flex.ExpandStringList(d.Get("subnet_ids").([]interface{})),
 		Tags:               getTagsIn(ctx),
@@ -303,82 +327,88 @@ func resourceWindowsFileSystemCreate(ctx context.Context, d *schema.ResourceData
 	}
 
 	if v, ok := d.GetOk("active_directory_id"); ok {
-		input.WindowsConfiguration.ActiveDirectoryId = aws.String(v.(string))
-		backupInput.WindowsConfiguration.ActiveDirectoryId = aws.String(v.(string))
+		inputC.WindowsConfiguration.ActiveDirectoryId = aws.String(v.(string))
+		inputB.WindowsConfiguration.ActiveDirectoryId = aws.String(v.(string))
 	}
 
 	if v, ok := d.GetOk("aliases"); ok {
-		input.WindowsConfiguration.Aliases = flex.ExpandStringSet(v.(*schema.Set))
-		backupInput.WindowsConfiguration.Aliases = flex.ExpandStringSet(v.(*schema.Set))
+		inputC.WindowsConfiguration.Aliases = flex.ExpandStringSet(v.(*schema.Set))
+		inputB.WindowsConfiguration.Aliases = flex.ExpandStringSet(v.(*schema.Set))
 	}
 
 	if v, ok := d.GetOk("audit_log_configuration"); ok && len(v.([]interface{})) > 0 {
-		input.WindowsConfiguration.AuditLogConfiguration = expandWindowsAuditLogCreateConfiguration(v.([]interface{}))
-		backupInput.WindowsConfiguration.AuditLogConfiguration = expandWindowsAuditLogCreateConfiguration(v.([]interface{}))
+		inputC.WindowsConfiguration.AuditLogConfiguration = expandWindowsAuditLogCreateConfiguration(v.([]interface{}))
+		inputB.WindowsConfiguration.AuditLogConfiguration = expandWindowsAuditLogCreateConfiguration(v.([]interface{}))
 	}
 
 	if v, ok := d.GetOk("daily_automatic_backup_start_time"); ok {
-		input.WindowsConfiguration.DailyAutomaticBackupStartTime = aws.String(v.(string))
-		backupInput.WindowsConfiguration.DailyAutomaticBackupStartTime = aws.String(v.(string))
+		inputC.WindowsConfiguration.DailyAutomaticBackupStartTime = aws.String(v.(string))
+		inputB.WindowsConfiguration.DailyAutomaticBackupStartTime = aws.String(v.(string))
+	}
+
+	if v, ok := d.GetOk("disk_iops_configuration"); ok && len(v.([]interface{})) > 0 {
+		inputC.WindowsConfiguration.DiskIopsConfiguration = expandWindowsDiskIopsConfiguration(v.([]interface{}))
+		inputB.WindowsConfiguration.DiskIopsConfiguration = expandWindowsDiskIopsConfiguration(v.([]interface{}))
 	}
 
 	if v, ok := d.GetOk("deployment_type"); ok {
-		input.WindowsConfiguration.DeploymentType = aws.String(v.(string))
-		backupInput.WindowsConfiguration.DeploymentType = aws.String(v.(string))
+		inputC.WindowsConfiguration.DeploymentType = aws.String(v.(string))
+		inputB.WindowsConfiguration.DeploymentType = aws.String(v.(string))
 	}
 
 	if v, ok := d.GetOk("kms_key_id"); ok {
-		input.KmsKeyId = aws.String(v.(string))
-		backupInput.KmsKeyId = aws.String(v.(string))
+		inputC.KmsKeyId = aws.String(v.(string))
+		inputB.KmsKeyId = aws.String(v.(string))
 	}
 
 	if v, ok := d.GetOk("preferred_subnet_id"); ok {
-		input.WindowsConfiguration.PreferredSubnetId = aws.String(v.(string))
-		backupInput.WindowsConfiguration.PreferredSubnetId = aws.String(v.(string))
+		inputC.WindowsConfiguration.PreferredSubnetId = aws.String(v.(string))
+		inputB.WindowsConfiguration.PreferredSubnetId = aws.String(v.(string))
 	}
 
 	if v, ok := d.GetOk("security_group_ids"); ok {
-		input.SecurityGroupIds = flex.ExpandStringSet(v.(*schema.Set))
-		backupInput.SecurityGroupIds = flex.ExpandStringSet(v.(*schema.Set))
+		inputC.SecurityGroupIds = flex.ExpandStringSet(v.(*schema.Set))
+		inputB.SecurityGroupIds = flex.ExpandStringSet(v.(*schema.Set))
 	}
 
 	if v, ok := d.GetOk("self_managed_active_directory"); ok {
-		input.WindowsConfiguration.SelfManagedActiveDirectoryConfiguration = expandSelfManagedActiveDirectoryConfigurationCreate(v.([]interface{}))
-		backupInput.WindowsConfiguration.SelfManagedActiveDirectoryConfiguration = expandSelfManagedActiveDirectoryConfigurationCreate(v.([]interface{}))
+		inputC.WindowsConfiguration.SelfManagedActiveDirectoryConfiguration = expandSelfManagedActiveDirectoryConfigurationCreate(v.([]interface{}))
+		inputB.WindowsConfiguration.SelfManagedActiveDirectoryConfiguration = expandSelfManagedActiveDirectoryConfigurationCreate(v.([]interface{}))
 	}
 
 	if v, ok := d.GetOk("storage_type"); ok {
-		input.StorageType = aws.String(v.(string))
-		backupInput.StorageType = aws.String(v.(string))
+		inputC.StorageType = aws.String(v.(string))
+		inputB.StorageType = aws.String(v.(string))
 	}
 
 	if v, ok := d.GetOk("weekly_maintenance_start_time"); ok {
-		input.WindowsConfiguration.WeeklyMaintenanceStartTime = aws.String(v.(string))
-		backupInput.WindowsConfiguration.WeeklyMaintenanceStartTime = aws.String(v.(string))
+		inputC.WindowsConfiguration.WeeklyMaintenanceStartTime = aws.String(v.(string))
+		inputB.WindowsConfiguration.WeeklyMaintenanceStartTime = aws.String(v.(string))
 	}
 
 	if v, ok := d.GetOk("backup_id"); ok {
-		backupInput.BackupId = aws.String(v.(string))
+		backupID := v.(string)
+		inputB.BackupId = aws.String(backupID)
 
-		output, err := conn.CreateFileSystemFromBackupWithContext(ctx, backupInput)
+		output, err := conn.CreateFileSystemFromBackupWithContext(ctx, inputB)
 
 		if err != nil {
-			return sdkdiag.AppendErrorf(diags, "creating FSx Windows File System from backup: %s", err)
+			return sdkdiag.AppendErrorf(diags, "creating FSx for Windows File Server File System from backup (%s): %s", backupID, err)
 		}
 
 		d.SetId(aws.StringValue(output.FileSystem.FileSystemId))
 	} else {
-		output, err := conn.CreateFileSystemWithContext(ctx, input)
+		output, err := conn.CreateFileSystemWithContext(ctx, inputC)
 
 		if err != nil {
-			return sdkdiag.AppendErrorf(diags, "creating FSx Windows File System: %s", err)
+			return sdkdiag.AppendErrorf(diags, "creating FSx for Windows File Server File System: %s", err)
 		}
 
 		d.SetId(aws.StringValue(output.FileSystem.FileSystemId))
 	}
 
 	if _, err := waitFileSystemCreated(ctx, conn, d.Id(), d.Timeout(schema.TimeoutCreate)); err != nil {
-		return sdkdiag.AppendErrorf(diags, "waiting for FSx Windows File System (%s) create: %s", d.Id(), err)
+		return sdkdiag.AppendErrorf(diags, "waiting for FSx for Windows File Server File System (%s) create: %s", d.Id(), err)
 	}
 
 	return append(diags, resourceWindowsFileSystemRead(ctx, d, meta)...)
@@ -388,52 +418,49 @@ func resourceWindowsFileSystemRead(ctx context.Context, d *schema.ResourceData,
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).FSxConn(ctx)
 
-	filesystem, err := FindFileSystemByID(ctx, conn, d.Id())
+	filesystem, err := FindWindowsFileSystemByID(ctx, conn, d.Id())
 
 	if !d.IsNewResource() && tfresource.NotFound(err) {
-		log.Printf("[WARN] FSx Windows File System (%s) not found, removing from state", d.Id())
+		log.Printf("[WARN] FSx for Windows File Server File System (%s) not found, removing from state", d.Id())
 		d.SetId("")
 		return diags
 	}
 
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "reading FSx Windows File System (%s): %s", d.Id(), err)
+		return sdkdiag.AppendErrorf(diags, "reading FSx for Windows File Server File System (%s): %s", d.Id(), err)
 	}
 
-	if filesystem.LustreConfiguration != nil {
-		return sdkdiag.AppendErrorf(diags, "expected FSx Windows File System, found FSx Lustre File System: %s", d.Id())
-	}
+	windowsConfig := filesystem.WindowsConfiguration
 
-	if filesystem.WindowsConfiguration == nil {
-		return sdkdiag.AppendErrorf(diags, "reading FSx Windows File System (%s): empty WindowsConfiguration", d.Id())
-	}
-
-	d.Set("active_directory_id", filesystem.WindowsConfiguration.ActiveDirectoryId)
-	d.Set("aliases", aws.StringValueSlice(expandAliasValues(filesystem.WindowsConfiguration.Aliases)))
+	d.Set("active_directory_id", windowsConfig.ActiveDirectoryId)
+	d.Set("aliases", aws.StringValueSlice(expandAliasValues(windowsConfig.Aliases)))
 	d.Set("arn", filesystem.ResourceARN)
-	if err := d.Set("audit_log_configuration", flattenWindowsAuditLogConfiguration(filesystem.WindowsConfiguration.AuditLogConfiguration)); err != nil {
+	if err := d.Set("audit_log_configuration", flattenWindowsAuditLogConfiguration(windowsConfig.AuditLogConfiguration)); err != nil {
 		return sdkdiag.AppendErrorf(diags, "setting audit_log_configuration: %s", err)
 	}
-	d.Set("automatic_backup_retention_days", filesystem.WindowsConfiguration.AutomaticBackupRetentionDays)
-	d.Set("copy_tags_to_backups", filesystem.WindowsConfiguration.CopyTagsToBackups)
-	d.Set("daily_automatic_backup_start_time", filesystem.WindowsConfiguration.DailyAutomaticBackupStartTime)
-	d.Set("deployment_type", filesystem.WindowsConfiguration.DeploymentType)
+	d.Set("automatic_backup_retention_days", windowsConfig.AutomaticBackupRetentionDays)
+	d.Set("copy_tags_to_backups", windowsConfig.CopyTagsToBackups)
+	d.Set("daily_automatic_backup_start_time", windowsConfig.DailyAutomaticBackupStartTime)
+	d.Set("deployment_type", windowsConfig.DeploymentType)
+	if err := d.Set("disk_iops_configuration", flattenWindowsDiskIopsConfiguration(windowsConfig.DiskIopsConfiguration)); err != nil {
+		return sdkdiag.AppendErrorf(diags, "setting disk_iops_configuration: %s", err)
+	}
 	d.Set("dns_name", filesystem.DNSName)
 	d.Set("kms_key_id", filesystem.KmsKeyId)
 	d.Set("network_interface_ids", aws.StringValueSlice(filesystem.NetworkInterfaceIds))
 	d.Set("owner_id", filesystem.OwnerId)
-	d.Set("preferred_subnet_id", filesystem.WindowsConfiguration.PreferredSubnetId)
-	d.Set("preferred_file_server_ip", filesystem.WindowsConfiguration.PreferredFileServerIp)
-	d.Set("remote_administration_endpoint", filesystem.WindowsConfiguration.RemoteAdministrationEndpoint)
-	if err := d.Set("self_managed_active_directory", flattenSelfManagedActiveDirectoryConfiguration(d, filesystem.WindowsConfiguration.SelfManagedActiveDirectoryConfiguration)); err != nil {
+	d.Set("preferred_file_server_ip", windowsConfig.PreferredFileServerIp)
+	d.Set("preferred_subnet_id", windowsConfig.PreferredSubnetId)
+	d.Set("remote_administration_endpoint", windowsConfig.RemoteAdministrationEndpoint)
+	if err := d.Set("self_managed_active_directory", flattenSelfManagedActiveDirectoryConfiguration(d, windowsConfig.SelfManagedActiveDirectoryConfiguration)); err != nil {
 		return sdkdiag.AppendErrorf(diags, "setting self_managed_active_directory: %s", err)
 	}
 	d.Set("storage_capacity", filesystem.StorageCapacity)
 	d.Set("storage_type", filesystem.StorageType)
 	d.Set("subnet_ids", aws.StringValueSlice(filesystem.SubnetIds))
-	d.Set("throughput_capacity", filesystem.WindowsConfiguration.ThroughputCapacity)
+	d.Set("throughput_capacity", windowsConfig.ThroughputCapacity)
 	d.Set("vpc_id", filesystem.VpcId)
-	d.Set("weekly_maintenance_start_time", filesystem.WindowsConfiguration.WeeklyMaintenanceStartTime)
+	d.Set("weekly_maintenance_start_time", windowsConfig.WeeklyMaintenanceStartTime)
 
 	setTagsOut(ctx, filesystem.Tags)
 
@@ -446,9 +473,41 @@ func resourceWindowsFileSystemUpdate(ctx context.Context, d *schema.ResourceData
 
 	if d.HasChange("aliases") {
 		o, n := d.GetChange("aliases")
+		os, ns := o.(*schema.Set), n.(*schema.Set)
+		add, del := flex.ExpandStringValueSet(ns.Difference(os)), flex.ExpandStringValueSet(os.Difference(ns))
+
+		if len(add) > 0 {
+			input := &fsx.AssociateFileSystemAliasesInput{
+				Aliases:      aws.StringSlice(add),
+				FileSystemId: aws.String(d.Id()),
+			}
 
-		if err := updateAliases(ctx, conn, d.Id(), o.(*schema.Set), n.(*schema.Set), d.Timeout(schema.TimeoutUpdate)); err != nil {
-			return sdkdiag.AppendErrorf(diags, "updating FSx Windows File System (%s) aliases: %s", d.Id(), err)
+			_, err := conn.AssociateFileSystemAliasesWithContext(ctx, input)
+
+			if err != nil {
+				return sdkdiag.AppendErrorf(diags, "associating FSx for Windows File Server File System (%s) aliases: %s", d.Id(), err)
+			}
+
+			if _, err := waitFileSystemAdministrativeActionCompleted(ctx, conn, d.Id(), fsx.AdministrativeActionTypeFileSystemAliasAssociation, d.Timeout(schema.TimeoutUpdate)); err != nil {
+				return sdkdiag.AppendErrorf(diags, "waiting for FSx for Windows File Server File System (%s) administrative action (%s) complete: %s", d.Id(), fsx.AdministrativeActionTypeFileSystemAliasAssociation, err)
+			}
+		}
+
+		if len(del) > 0 {
+			input := &fsx.DisassociateFileSystemAliasesInput{
+				Aliases:      aws.StringSlice(del),
+				FileSystemId: aws.String(d.Id()),
+			}
+
+			_, err := conn.DisassociateFileSystemAliasesWithContext(ctx, input)
+
+			if err != nil {
+				return sdkdiag.AppendErrorf(diags, "disassociating FSx for Windows File Server File System (%s) aliases: %s", d.Id(), err)
+			}
+
+			if _, err := waitFileSystemAdministrativeActionCompleted(ctx, conn, d.Id(), fsx.AdministrativeActionTypeFileSystemAliasDisassociation, d.Timeout(schema.TimeoutUpdate)); err != nil {
+				return sdkdiag.AppendErrorf(diags, "waiting for FSx for Windows File Server File System (%s) administrative action (%s) complete: %s", d.Id(), fsx.AdministrativeActionTypeFileSystemAliasDisassociation, err)
+			}
 		}
 	}
 
@@ -465,14 +524,19 @@ func resourceWindowsFileSystemUpdate(ctx context.Context, d *schema.ResourceData
 				},
 			}
 
+			startTime := time.Now()
 			_, err := conn.UpdateFileSystemWithContext(ctx, input)
 
 			if err != nil {
-				return sdkdiag.AppendErrorf(diags, "updating FSx Windows File System (%s) ThroughputCapacity: %s", d.Id(), err)
+				return sdkdiag.AppendErrorf(diags, "updating FSx for Windows File Server File System (%s) ThroughputCapacity: %s", d.Id(), err)
 			}
 
-			if _, err := waitAdministrativeActionCompleted(ctx, conn, d.Id(), fsx.AdministrativeActionTypeFileSystemUpdate, d.Timeout(schema.TimeoutUpdate)); err != nil {
-				return sdkdiag.AppendErrorf(diags, "waiting for FSx Windows File System (%s) update: %s", d.Id(), err)
+			if _, err := waitFileSystemUpdated(ctx, conn, d.Id(), startTime, d.Timeout(schema.TimeoutUpdate)); err != nil {
+				return sdkdiag.AppendErrorf(diags, "waiting for FSx Windows File Server File System (%s) update: %s", d.Id(), err)
+			}
+
+			if _, err := waitFileSystemAdministrativeActionCompleted(ctx, conn, d.Id(), fsx.AdministrativeActionTypeFileSystemUpdate, d.Timeout(schema.TimeoutUpdate)); err != nil {
+				return sdkdiag.AppendErrorf(diags, "waiting for FSx Windows File Server File System (%s) administrative action (%s) complete: %s", d.Id(), fsx.AdministrativeActionTypeFileSystemUpdate, err)
 			}
 		}
 	}
@@ -496,6 +560,10 @@ func resourceWindowsFileSystemUpdate(ctx context.Context, d *schema.ResourceData
 			input.WindowsConfiguration.DailyAutomaticBackupStartTime = aws.String(d.Get("daily_automatic_backup_start_time").(string))
 		}
 
+		if d.HasChange("disk_iops_configuration") {
+			input.WindowsConfiguration.DiskIopsConfiguration = expandWindowsDiskIopsConfiguration(d.Get("disk_iops_configuration").([]interface{}))
+		}
+
 		if d.HasChange("self_managed_active_directory") {
 			input.WindowsConfiguration.SelfManagedActiveDirectoryConfiguration = expandSelfManagedActiveDirectoryConfigurationUpdate(d.Get("self_managed_active_directory").([]interface{}))
 		}
@@ -512,14 +580,19 @@ func resourceWindowsFileSystemUpdate(ctx context.Context, d *schema.ResourceData
 			input.WindowsConfiguration.WeeklyMaintenanceStartTime = aws.String(d.Get("weekly_maintenance_start_time").(string))
 		}
 
+		startTime := time.Now()
 		_, err := conn.UpdateFileSystemWithContext(ctx, input)
 
 		if err != nil {
-			return sdkdiag.AppendErrorf(diags, "updating FSx Windows File System (%s): %s", d.Id(), err)
+			return sdkdiag.AppendErrorf(diags, "updating FSx for Windows File Server File System (%s): %s", d.Id(), err)
+		}
+
+		if _, err := waitFileSystemUpdated(ctx, conn, d.Id(), startTime, d.Timeout(schema.TimeoutUpdate)); err != nil {
+			return sdkdiag.AppendErrorf(diags, "waiting for FSx Windows File Server File System (%s) update: %s", d.Id(), err)
 		}
 
-		if _, err := waitAdministrativeActionCompleted(ctx, conn, d.Id(), fsx.AdministrativeActionTypeFileSystemUpdate, d.Timeout(schema.TimeoutUpdate)); err != nil {
-			return sdkdiag.AppendErrorf(diags, "waiting for FSx Windows File System (%s) update: %s", d.Id(), err)
+		if _, err := waitFileSystemAdministrativeActionCompleted(ctx, conn, d.Id(), fsx.AdministrativeActionTypeFileSystemUpdate, d.Timeout(schema.TimeoutUpdate)); err != nil {
+			return sdkdiag.AppendErrorf(diags, "waiting for FSx Windows File Server File System (%s) administrative action (%s) complete: %s", d.Id(), fsx.AdministrativeActionTypeFileSystemUpdate, err)
 		}
 	}
 
@@ -538,7 +611,7 @@ func resourceWindowsFileSystemDelete(ctx context.Context, d *schema.ResourceData
 		},
 	}
 
-	log.Printf("[DEBUG] Deleting FSx Windows File System: %s", d.Id())
+	log.Printf("[DEBUG] Deleting FSx for Windows File Server File System: %s", d.Id())
 	_, err := conn.DeleteFileSystemWithContext(ctx, input)
 
 	if tfawserr.ErrCodeEquals(err, fsx.ErrCodeFileSystemNotFound) {
@@ -546,11 +619,11 @@ func resourceWindowsFileSystemDelete(ctx context.Context, d *schema.ResourceData
 	}
 
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "deleting FSx Windows File System (%s): %s", d.Id(), err)
+		return sdkdiag.AppendErrorf(diags, "deleting FSx for Windows File Server File System (%s): %s", d.Id(), err)
 	}
 
 	if _, err := waitFileSystemDeleted(ctx, conn, d.Id(), d.Timeout(schema.TimeoutDelete)); err != nil {
-		return sdkdiag.AppendErrorf(diags, "waiting for FSx Windows File System (%s) delete: %s", d.Id(), err)
+		return sdkdiag.AppendErrorf(diags, "waiting for FSx for Windows File Server File System (%s) delete: %s", d.Id(), err)
 	}
 
 	return diags
@@ -567,48 +640,6 @@ func expandAliasValues(aliases []*fsx.Alias) []*string {
 	return alternateDNSNames
 }
 
-func updateAliases(ctx context.Context, conn *fsx.FSx, identifier string, oldSet *schema.Set, newSet *schema.Set, timeout time.Duration) error {
-	if newSet.Len() > 0 {
-		if newAliases := newSet.Difference(oldSet); newAliases.Len() > 0 {
-			input := &fsx.AssociateFileSystemAliasesInput{
-				FileSystemId: aws.String(identifier),
-				Aliases:      flex.ExpandStringSet(newAliases),
-			}
-
-			_, err := conn.AssociateFileSystemAliasesWithContext(ctx, input)
-
-			if err != nil {
-				return fmt.Errorf("associating aliases to FSx file system (%s): %w", identifier, err)
-			}
-
-			if _, err := waitAdministrativeActionCompleted(ctx, conn, identifier, fsx.AdministrativeActionTypeFileSystemAliasAssociation, timeout); err != nil {
-				return fmt.Errorf("waiting for FSx Windows File System (%s) alias to be associated: %w", identifier, err)
-			}
-		}
-	}
-
-	if oldSet.Len() > 0 {
-		if oldAliases := oldSet.Difference(newSet); oldAliases.Len() > 0 {
-			input := &fsx.DisassociateFileSystemAliasesInput{
-				FileSystemId: aws.String(identifier),
-				Aliases:      flex.ExpandStringSet(oldAliases),
-			}
-
-			_, err := conn.DisassociateFileSystemAliasesWithContext(ctx, input)
-
-			if err != nil {
-				return fmt.Errorf("disassociating aliases from FSx file system (%s): %w", identifier, err)
-			}
-
-			if _, err := waitAdministrativeActionCompleted(ctx, conn, identifier, fsx.AdministrativeActionTypeFileSystemAliasDisassociation, timeout); err != nil {
-				return fmt.Errorf("waiting for FSx Windows File System (%s) alias to be disassociated: %w", identifier, err)
-			}
-		}
-	}
-
-	return nil
-}
-
 func expandSelfManagedActiveDirectoryConfigurationCreate(l []interface{}) *fsx.SelfManagedActiveDirectoryConfiguration {
 	if len(l) == 0 || l[0] == nil {
 		return nil
@@ -714,6 +745,42 @@ func flattenWindowsAuditLogConfiguration(adopts *fsx.WindowsAuditLogConfiguratio
 	return []map[string]interface{}{m}
 }
 
+func expandWindowsDiskIopsConfiguration(l []interface{}) *fsx.DiskIopsConfiguration {
+	if len(l) == 0 || l[0] == nil {
+		return nil
+	}
+
+	data := l[0].(map[string]interface{})
+	req := &fsx.DiskIopsConfiguration{}
+
+	if v, ok := data["iops"].(int); ok {
+		req.Iops = aws.Int64(int64(v))
+	}
+
+	if v, ok := data["mode"].(string); ok && v != "" {
+		req.Mode = aws.String(v)
+	}
+
+	return req
+}
+
+func flattenWindowsDiskIopsConfiguration(rs *fsx.DiskIopsConfiguration) []interface{} {
+	if rs == nil {
+		return []interface{}{}
+	}
+
+	m := map[string]interface{}{}
+
+	if rs.Iops != nil {
+		m["iops"] = aws.Int64Value(rs.Iops)
+	}
+	if rs.Mode != nil {
+		m["mode"] = aws.StringValue(rs.Mode)
+	}
+
+	return []interface{}{m}
+}
+
 func windowsAuditLogStateFunc(v interface{}) string {
 	value := v.(string)
 	// API returns the specific log stream arn instead of provided log group
@@ -728,3 +795,17 @@ func windowsAuditLogStateFunc(v interface{}) string {
 	}
 	return value
 }
+
+func FindWindowsFileSystemByID(ctx context.Context, conn *fsx.FSx, id string) (*fsx.FileSystem, error) {
+	output, err := findFileSystemByIDAndType(ctx, conn, id, fsx.FileSystemTypeWindows)
+
+	if err != nil {
+		return nil, err
+	}
+
+	if output.WindowsConfiguration == nil {
+		return nil, tfresource.NewEmptyResultError(nil)
+	}
+
+	return output, nil
+}
diff --git a/internal/service/fsx/windows_file_system_data_source.go b/internal/service/fsx/windows_file_system_data_source.go
index 7c6e9f98d22..6a558d09e1c 100644
--- a/internal/service/fsx/windows_file_system_data_source.go
+++ b/internal/service/fsx/windows_file_system_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package fsx
 
 import (
@@ -72,6 +75,22 @@ func DataSourceWindowsFileSystem() *schema.Resource {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
+			"disk_iops_configuration": {
+				Type:     schema.TypeList,
+				Computed: true,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"iops": {
+							Type:     schema.TypeInt,
+							Computed: true,
+						},
+						"mode": {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+					},
+				},
+			},
 			"dns_name": {
 				Type:     schema.TypeString,
 				Computed: true,
@@ -154,44 +173,41 @@ func dataSourceWindowsFileSystemRead(ctx context.Context, d *schema.ResourceData
 	ignoreTagsConfig := meta.(*conns.AWSClient).IgnoreTagsConfig
 
 	id := d.Get("id").(string)
-	filesystem, err := FindFileSystemByID(ctx, conn, id)
+	filesystem, err := FindWindowsFileSystemByID(ctx, conn, id)
 
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "reading FSx Windows File System (%s): %s", d.Id(), err)
+		return sdkdiag.AppendErrorf(diags, "reading FSx for Windows File Server File System (%s): %s", id, err)
 	}
 
-	if filesystem.LustreConfiguration != nil {
-		return sdkdiag.AppendErrorf(diags, "expected FSx Windows File System, found FSx Lustre File System: %s", d.Id())
-	}
-
-	if filesystem.WindowsConfiguration == nil {
-		return sdkdiag.AppendErrorf(diags, "reading FSx Windows File System (%s): empty WindowsConfiguration", d.Id())
-	}
+	windowsConfig := filesystem.WindowsConfiguration
 
 	d.SetId(aws.StringValue(filesystem.FileSystemId))
-	d.Set("active_directory_id", filesystem.WindowsConfiguration.ActiveDirectoryId)
-	d.Set("aliases", aws.StringValueSlice(expandAliasValues(filesystem.WindowsConfiguration.Aliases)))
+	d.Set("active_directory_id", windowsConfig.ActiveDirectoryId)
+	d.Set("aliases", aws.StringValueSlice(expandAliasValues(windowsConfig.Aliases)))
 	d.Set("arn", filesystem.ResourceARN)
-	if err := d.Set("audit_log_configuration", flattenWindowsAuditLogConfiguration(filesystem.WindowsConfiguration.AuditLogConfiguration)); err != nil {
+	if err := d.Set("audit_log_configuration", flattenWindowsAuditLogConfiguration(windowsConfig.AuditLogConfiguration)); err != nil {
 		return sdkdiag.AppendErrorf(diags, "setting audit_log_configuration: %s", err)
 	}
-	d.Set("automatic_backup_retention_days", filesystem.WindowsConfiguration.AutomaticBackupRetentionDays)
-	d.Set("copy_tags_to_backups", filesystem.WindowsConfiguration.CopyTagsToBackups)
-	d.Set("daily_automatic_backup_start_time", filesystem.WindowsConfiguration.DailyAutomaticBackupStartTime)
-	d.Set("deployment_type", filesystem.WindowsConfiguration.DeploymentType)
+	d.Set("automatic_backup_retention_days", windowsConfig.AutomaticBackupRetentionDays)
+	d.Set("copy_tags_to_backups", windowsConfig.CopyTagsToBackups)
+	d.Set("daily_automatic_backup_start_time", windowsConfig.DailyAutomaticBackupStartTime)
+	d.Set("deployment_type", windowsConfig.DeploymentType)
+	if err := d.Set("disk_iops_configuration", flattenWindowsDiskIopsConfiguration(windowsConfig.DiskIopsConfiguration)); err != nil {
+		return sdkdiag.AppendErrorf(diags, "setting disk_iops_configuration: %s", err)
+	}
 	d.Set("dns_name", filesystem.DNSName)
 	d.Set("id", filesystem.FileSystemId)
 	d.Set("kms_key_id", filesystem.KmsKeyId)
 	d.Set("network_interface_ids", aws.StringValueSlice(filesystem.NetworkInterfaceIds))
 	d.Set("owner_id", filesystem.OwnerId)
-	d.Set("preferred_subnet_id", filesystem.WindowsConfiguration.PreferredSubnetId)
-	d.Set("preferred_file_server_ip", filesystem.WindowsConfiguration.PreferredFileServerIp)
+	d.Set("preferred_file_server_ip", windowsConfig.PreferredFileServerIp)
+	d.Set("preferred_subnet_id", windowsConfig.PreferredSubnetId)
 	d.Set("storage_capacity", filesystem.StorageCapacity)
 	d.Set("storage_type", filesystem.StorageType)
 	d.Set("subnet_ids", aws.StringValueSlice(filesystem.SubnetIds))
-	d.Set("throughput_capacity", filesystem.WindowsConfiguration.ThroughputCapacity)
+	d.Set("throughput_capacity", windowsConfig.ThroughputCapacity)
 	d.Set("vpc_id", filesystem.VpcId)
-	d.Set("weekly_maintenance_start_time", filesystem.WindowsConfiguration.WeeklyMaintenanceStartTime)
+	d.Set("weekly_maintenance_start_time", windowsConfig.WeeklyMaintenanceStartTime)
 
 	tags := KeyValueTags(ctx, filesystem.Tags).IgnoreAWS().IgnoreConfig(ignoreTagsConfig)
 
diff --git a/internal/service/fsx/windows_file_system_data_source_test.go b/internal/service/fsx/windows_file_system_data_source_test.go
index cab7eccca8e..3fe5cdc517e 100644
--- a/internal/service/fsx/windows_file_system_data_source_test.go
+++ b/internal/service/fsx/windows_file_system_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package fsx_test
 
 import (
@@ -28,21 +31,29 @@ func TestAccFSxWindowsFileSystemDataSource_basic(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config: testAccWindowsFileSystemDataSourceConfig_basic(rName, domainName),
-				Check: resource.ComposeTestCheckFunc(
+				Check: resource.ComposeAggregateTestCheckFunc(
 					resource.TestCheckResourceAttrPair(datasourceName, "active_directory_id", resourceName, "active_directory_id"),
 					resource.TestCheckResourceAttrPair(datasourceName, "arn", resourceName, "arn"),
+					resource.TestCheckResourceAttrPair(datasourceName, "audit_log_configuration.#", resourceName, "audit_log_configuration.#"),
 					resource.TestCheckResourceAttrPair(datasourceName, "automatic_backup_retention_days", resourceName, "automatic_backup_retention_days"),
+					resource.TestCheckResourceAttrPair(datasourceName, "copy_tags_to_backups", resourceName, "copy_tags_to_backups"),
 					resource.TestCheckResourceAttrPair(datasourceName, "daily_automatic_backup_start_time", resourceName, "daily_automatic_backup_start_time"),
 					resource.TestCheckResourceAttrPair(datasourceName, "deployment_type", resourceName, "deployment_type"),
+					resource.TestCheckResourceAttrPair(datasourceName, "disk_iops_configuration.#", resourceName, "disk_iops_configuration.#"),
 					resource.TestCheckResourceAttrPair(datasourceName, "dns_name", resourceName, "dns_name"),
 					resource.TestCheckResourceAttrPair(datasourceName, "id", resourceName, "id"),
 					resource.TestCheckResourceAttrPair(datasourceName, "kms_key_id", resourceName, "kms_key_id"),
+					resource.TestCheckResourceAttrPair(datasourceName, "network_interface_ids.#", resourceName, "network_interface_ids.#"),
 					resource.TestCheckResourceAttrPair(datasourceName, "owner_id", resourceName, "owner_id"),
+					resource.TestCheckResourceAttrPair(datasourceName, "preferred_file_server_ip", resourceName, "preferred_file_server_ip"),
+					resource.TestCheckResourceAttrPair(datasourceName, "preferred_subnet_id", resourceName, "preferred_subnet_id"),
 					resource.TestCheckResourceAttrPair(datasourceName, "storage_capacity", resourceName, "storage_capacity"),
 					resource.TestCheckResourceAttrPair(datasourceName, "storage_type", resourceName, "storage_type"),
 					resource.TestCheckResourceAttrPair(datasourceName, "subnet_ids.#", resourceName, "subnet_ids.#"),
+					resource.TestCheckResourceAttrPair(datasourceName, "tags.%", resourceName, "tags.%"),
 					resource.TestCheckResourceAttrPair(datasourceName, "throughput_capacity", resourceName, "throughput_capacity"),
 					resource.TestCheckResourceAttrPair(datasourceName, "vpc_id", resourceName, "vpc_id"),
+					resource.TestCheckResourceAttrPair(datasourceName, "weekly_maintenance_start_time", resourceName, "weekly_maintenance_start_time"),
 				),
 			},
 		},
@@ -50,7 +61,7 @@ func TestAccFSxWindowsFileSystemDataSource_basic(t *testing.T) {
 }
 
 func testAccWindowsFileSystemDataSourceConfig_basic(rName, domain string) string {
-	return acctest.ConfigCompose(testAccWindowsFileSystemConfig_subnetIDs1(rName, domain), `
+	return acctest.ConfigCompose(testAccWindowsFileSystemConfig_basic(rName, domain), `
 data "aws_fsx_windows_file_system" "test" {
   id = aws_fsx_windows_file_system.test.id
 }
diff --git a/internal/service/fsx/windows_file_system_test.go b/internal/service/fsx/windows_file_system_test.go
index f2b37dca285..3f92c89a730 100644
--- a/internal/service/fsx/windows_file_system_test.go
+++ b/internal/service/fsx/windows_file_system_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package fsx_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/fsx"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -31,32 +34,35 @@ func TestAccFSxWindowsFileSystem_basic(t *testing.T) {
 		CheckDestroy:             testAccCheckWindowsFileSystemDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccWindowsFileSystemConfig_subnetIDs1(rName, domainName),
-				Check: resource.ComposeTestCheckFunc(
+				Config: testAccWindowsFileSystemConfig_basic(rName, domainName),
+				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckWindowsFileSystemExists(ctx, resourceName, &filesystem),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "fsx", regexp.MustCompile(`file-system/fs-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "fsx", regexache.MustCompile(`file-system/fs-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "aliases.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "audit_log_configuration.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "audit_log_configuration.0.file_access_audit_log_level", "DISABLED"),
+					resource.TestCheckResourceAttr(resourceName, "audit_log_configuration.0.file_share_access_audit_log_level", "DISABLED"),
 					resource.TestCheckResourceAttr(resourceName, "automatic_backup_retention_days", "7"),
 					resource.TestCheckResourceAttr(resourceName, "copy_tags_to_backups", "false"),
-					resource.TestMatchResourceAttr(resourceName, "daily_automatic_backup_start_time", regexp.MustCompile(`^\d\d:\d\d$`)),
-					resource.TestMatchResourceAttr(resourceName, "dns_name", regexp.MustCompile(`fs-.+\..+`)),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "kms_key_id", "kms", regexp.MustCompile(`key/.+`)),
+					resource.TestMatchResourceAttr(resourceName, "daily_automatic_backup_start_time", regexache.MustCompile(`^\d\d:\d\d$`)),
+					resource.TestCheckResourceAttr(resourceName, "deployment_type", "SINGLE_AZ_1"),
+					resource.TestCheckResourceAttr(resourceName, "disk_iops_configuration.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "disk_iops_configuration.0.iops", "96"),
+					resource.TestCheckResourceAttr(resourceName, "disk_iops_configuration.0.mode", "AUTOMATIC"),
+					resource.TestMatchResourceAttr(resourceName, "dns_name", regexache.MustCompile(`fs-.+\..+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "kms_key_id", "kms", regexache.MustCompile(`key/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "network_interface_ids.#", "1"),
 					acctest.CheckResourceAttrAccountID(resourceName, "owner_id"),
 					resource.TestCheckResourceAttr(resourceName, "security_group_ids.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "self_managed_active_directory.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "skip_final_backup", "true"),
 					resource.TestCheckResourceAttr(resourceName, "storage_capacity", "32"),
+					resource.TestCheckResourceAttr(resourceName, "storage_type", "SSD"),
 					resource.TestCheckResourceAttr(resourceName, "subnet_ids.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 					resource.TestCheckResourceAttr(resourceName, "throughput_capacity", "8"),
 					resource.TestCheckResourceAttrPair(resourceName, "vpc_id", "aws_vpc.test", "id"),
-					resource.TestMatchResourceAttr(resourceName, "weekly_maintenance_start_time", regexp.MustCompile(`^\d:\d\d:\d\d$`)),
-					resource.TestCheckResourceAttr(resourceName, "deployment_type", "SINGLE_AZ_1"),
-					resource.TestCheckResourceAttr(resourceName, "storage_type", "SSD"),
-					resource.TestCheckResourceAttr(resourceName, "audit_log_configuration.#", "1"),
-					resource.TestCheckResourceAttr(resourceName, "audit_log_configuration.0.file_access_audit_log_level", "DISABLED"),
-					resource.TestCheckResourceAttr(resourceName, "audit_log_configuration.0.file_share_access_audit_log_level", "DISABLED"),
+					resource.TestMatchResourceAttr(resourceName, "weekly_maintenance_start_time", regexache.MustCompile(`^\d:\d\d:\d\d$`)),
 				),
 			},
 			{
@@ -68,10 +74,6 @@ func TestAccFSxWindowsFileSystem_basic(t *testing.T) {
 					"skip_final_backup",
 				},
 			},
-			{
-				Config:   testAccWindowsFileSystemConfig_subnetIDs1SingleType(rName, domainName, "SINGLE_AZ_1"),
-				PlanOnly: true,
-			},
 		},
 	})
 }
@@ -90,7 +92,7 @@ func TestAccFSxWindowsFileSystem_disappears(t *testing.T) {
 		CheckDestroy:             testAccCheckWindowsFileSystemDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccWindowsFileSystemConfig_subnetIDs1(rName, domainName),
+				Config: testAccWindowsFileSystemConfig_basic(rName, domainName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckWindowsFileSystemExists(ctx, resourceName, &filesystem),
 					acctest.CheckResourceDisappears(ctx, acctest.Provider, tffsx.ResourceWindowsFileSystem(), resourceName),
@@ -118,26 +120,25 @@ func TestAccFSxWindowsFileSystem_singleAz2(t *testing.T) {
 				Config: testAccWindowsFileSystemConfig_subnetIDs1SingleType(rName, domainName, "SINGLE_AZ_2"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckWindowsFileSystemExists(ctx, resourceName, &filesystem),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "fsx", regexp.MustCompile(`file-system/fs-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "fsx", regexache.MustCompile(`file-system/fs-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "aliases.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "automatic_backup_retention_days", "7"),
 					resource.TestCheckResourceAttr(resourceName, "copy_tags_to_backups", "false"),
-					resource.TestMatchResourceAttr(resourceName, "daily_automatic_backup_start_time", regexp.MustCompile(`^\d\d:\d\d$`)),
-					resource.TestMatchResourceAttr(resourceName, "dns_name", regexp.MustCompile(`^amznfsx\w{8}\.corp\.notexample\.com$`)),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "kms_key_id", "kms", regexp.MustCompile(`key/.+`)),
+					resource.TestMatchResourceAttr(resourceName, "daily_automatic_backup_start_time", regexache.MustCompile(`^\d\d:\d\d$`)),
+					resource.TestCheckResourceAttr(resourceName, "deployment_type", "SINGLE_AZ_2"),
+					resource.TestMatchResourceAttr(resourceName, "dns_name", regexache.MustCompile(`^amznfsx\w{8}\.\w{8}\.test$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "kms_key_id", "kms", regexache.MustCompile(`key/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "network_interface_ids.#", "1"),
 					acctest.CheckResourceAttrAccountID(resourceName, "owner_id"),
 					resource.TestCheckResourceAttr(resourceName, "security_group_ids.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "self_managed_active_directory.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "skip_final_backup", "true"),
 					resource.TestCheckResourceAttr(resourceName, "storage_capacity", "32"),
+					resource.TestCheckResourceAttr(resourceName, "storage_type", "SSD"),
 					resource.TestCheckResourceAttr(resourceName, "subnet_ids.#", "1"),
-					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 					resource.TestCheckResourceAttr(resourceName, "throughput_capacity", "8"),
 					resource.TestCheckResourceAttrPair(resourceName, "vpc_id", "aws_vpc.test", "id"),
-					resource.TestMatchResourceAttr(resourceName, "weekly_maintenance_start_time", regexp.MustCompile(`^\d:\d\d:\d\d$`)),
-					resource.TestCheckResourceAttr(resourceName, "deployment_type", "SINGLE_AZ_2"),
-					resource.TestCheckResourceAttr(resourceName, "storage_type", "SSD"),
+					resource.TestMatchResourceAttr(resourceName, "weekly_maintenance_start_time", regexache.MustCompile(`^\d:\d\d:\d\d$`)),
 				),
 			},
 			{
@@ -204,25 +205,24 @@ func TestAccFSxWindowsFileSystem_multiAz(t *testing.T) {
 				Config: testAccWindowsFileSystemConfig_subnetIDs2(rName, domainName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckWindowsFileSystemExists(ctx, resourceName, &filesystem),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "fsx", regexp.MustCompile(`file-system/fs-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "fsx", regexache.MustCompile(`file-system/fs-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "aliases.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "automatic_backup_retention_days", "7"),
 					resource.TestCheckResourceAttr(resourceName, "copy_tags_to_backups", "false"),
-					resource.TestMatchResourceAttr(resourceName, "daily_automatic_backup_start_time", regexp.MustCompile(`^\d\d:\d\d$`)),
-					resource.TestMatchResourceAttr(resourceName, "dns_name", regexp.MustCompile(`^amznfsx\w{8}\.corp\.notexample\.com$`)),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "kms_key_id", "kms", regexp.MustCompile(`key/.+`)),
+					resource.TestMatchResourceAttr(resourceName, "daily_automatic_backup_start_time", regexache.MustCompile(`^\d\d:\d\d$`)),
+					resource.TestCheckResourceAttr(resourceName, "deployment_type", "MULTI_AZ_1"),
+					resource.TestMatchResourceAttr(resourceName, "dns_name", regexache.MustCompile(`^amznfsx\w{8}\.\w{8}\.test$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "kms_key_id", "kms", regexache.MustCompile(`key/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "network_interface_ids.#", "2"),
 					acctest.CheckResourceAttrAccountID(resourceName, "owner_id"),
 					resource.TestCheckResourceAttr(resourceName, "self_managed_active_directory.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "skip_final_backup", "true"),
 					resource.TestCheckResourceAttr(resourceName, "storage_capacity", "32"),
+					resource.TestCheckResourceAttr(resourceName, "storage_type", "SSD"),
 					resource.TestCheckResourceAttr(resourceName, "subnet_ids.#", "2"),
-					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 					resource.TestCheckResourceAttr(resourceName, "throughput_capacity", "8"),
 					resource.TestCheckResourceAttrPair(resourceName, "vpc_id", "aws_vpc.test", "id"),
-					resource.TestMatchResourceAttr(resourceName, "weekly_maintenance_start_time", regexp.MustCompile(`^\d:\d\d:\d\d$`)),
-					resource.TestCheckResourceAttr(resourceName, "deployment_type", "MULTI_AZ_1"),
-					resource.TestCheckResourceAttr(resourceName, "storage_type", "SSD"),
+					resource.TestMatchResourceAttr(resourceName, "weekly_maintenance_start_time", regexache.MustCompile(`^\d:\d\d:\d\d$`)),
 				),
 			},
 			{
@@ -540,47 +540,6 @@ func TestAccFSxWindowsFileSystem_selfManagedActiveDirectory(t *testing.T) {
 	})
 }
 
-func TestAccFSxWindowsFileSystem_SelfManagedActiveDirectory_username(t *testing.T) {
-	ctx := acctest.Context(t)
-	var filesystem fsx.FileSystem
-	resourceName := "aws_fsx_windows_file_system.test"
-	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
-	domainName := acctest.RandomDomainName()
-
-	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
-		ErrorCheck:               acctest.ErrorCheck(t, fsx.EndpointsID),
-		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckWindowsFileSystemDestroy(ctx),
-		Steps: []resource.TestStep{
-			{
-				Config: testAccWindowsFileSystemConfig_selfManagedActiveDirectoryUsername(rName, domainName, "Admin"),
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckWindowsFileSystemExists(ctx, resourceName, &filesystem),
-					resource.TestCheckResourceAttr(resourceName, "self_managed_active_directory.#", "1"),
-				),
-			},
-			{
-				ResourceName:      resourceName,
-				ImportState:       true,
-				ImportStateVerify: true,
-				ImportStateVerifyIgnore: []string{
-					"security_group_ids",
-					"self_managed_active_directory",
-					"skip_final_backup",
-				},
-			},
-			{
-				Config: testAccWindowsFileSystemConfig_selfManagedActiveDirectoryUsername(rName, domainName, "Administrator"),
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckWindowsFileSystemExists(ctx, resourceName, &filesystem),
-					resource.TestCheckResourceAttr(resourceName, "self_managed_active_directory.#", "1"),
-				),
-			},
-		},
-	})
-}
-
 func TestAccFSxWindowsFileSystem_storageCapacity(t *testing.T) {
 	ctx := acctest.Context(t)
 	var filesystem1, filesystem2 fsx.FileSystem
@@ -839,6 +798,51 @@ func TestAccFSxWindowsFileSystem_audit(t *testing.T) {
 	})
 }
 
+func TestAccFSxWindowsFileSystem_diskIops(t *testing.T) {
+	ctx := acctest.Context(t)
+	var filesystem1, filesystem2 fsx.FileSystem
+	resourceName := "aws_fsx_windows_file_system.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	domainName := acctest.RandomDomainName()
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, fsx.EndpointsID) },
+		ErrorCheck:               acctest.ErrorCheck(t, fsx.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckWindowsFileSystemDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccWindowsFileSystemConfig_diskIOPSConfiguration(rName, domainName, 192),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckWindowsFileSystemExists(ctx, resourceName, &filesystem1),
+					resource.TestCheckResourceAttr(resourceName, "disk_iops_configuration.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "disk_iops_configuration.0.mode", "USER_PROVISIONED"),
+					resource.TestCheckResourceAttr(resourceName, "disk_iops_configuration.0.iops", "192"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{
+					"security_group_ids",
+					"skip_final_backup",
+				},
+			},
+			{
+				Config: testAccWindowsFileSystemConfig_diskIOPSConfiguration(rName, domainName, 256),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckWindowsFileSystemExists(ctx, resourceName, &filesystem2),
+					testAccCheckWindowsFileSystemNotRecreated(&filesystem1, &filesystem2),
+					resource.TestCheckResourceAttr(resourceName, "disk_iops_configuration.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "disk_iops_configuration.0.mode", "USER_PROVISIONED"),
+					resource.TestCheckResourceAttr(resourceName, "disk_iops_configuration.0.iops", "256"),
+				),
+			},
+		},
+	})
+}
+
 func testAccCheckWindowsFileSystemExists(ctx context.Context, n string, v *fsx.FileSystem) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		rs, ok := s.RootModule().Resources[n]
@@ -848,7 +852,7 @@ func testAccCheckWindowsFileSystemExists(ctx context.Context, n string, v *fsx.F
 
 		conn := acctest.Provider.Meta().(*conns.AWSClient).FSxConn(ctx)
 
-		output, err := tffsx.FindFileSystemByID(ctx, conn, rs.Primary.ID)
+		output, err := tffsx.FindWindowsFileSystemByID(ctx, conn, rs.Primary.ID)
 
 		if err != nil {
 			return err
@@ -869,7 +873,7 @@ func testAccCheckWindowsFileSystemDestroy(ctx context.Context) resource.TestChec
 				continue
 			}
 
-			_, err := tffsx.FindFileSystemByID(ctx, conn, rs.Primary.ID)
+			_, err := tffsx.FindWindowsFileSystemByID(ctx, conn, rs.Primary.ID)
 
 			if tfresource.NotFound(err) {
 				continue
@@ -879,8 +883,9 @@ func testAccCheckWindowsFileSystemDestroy(ctx context.Context) resource.TestChec
 				return err
 			}
 
-			return fmt.Errorf("FSx Windows File System (%s) still exists", rs.Primary.ID)
+			return fmt.Errorf("FSx for Windows File Server File System (%s) still exists", rs.Primary.ID)
 		}
+
 		return nil
 	}
 }
@@ -888,7 +893,7 @@ func testAccCheckWindowsFileSystemDestroy(ctx context.Context) resource.TestChec
 func testAccCheckWindowsFileSystemNotRecreated(i, j *fsx.FileSystem) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		if aws.StringValue(i.FileSystemId) != aws.StringValue(j.FileSystemId) {
-			return fmt.Errorf("FSx File System (%s) recreated", aws.StringValue(i.FileSystemId))
+			return fmt.Errorf("FSx for Windows File Server File System (%s) recreated", aws.StringValue(i.FileSystemId))
 		}
 
 		return nil
@@ -898,7 +903,7 @@ func testAccCheckWindowsFileSystemNotRecreated(i, j *fsx.FileSystem) resource.Te
 func testAccCheckWindowsFileSystemRecreated(i, j *fsx.FileSystem) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		if aws.StringValue(i.FileSystemId) == aws.StringValue(j.FileSystemId) {
-			return fmt.Errorf("FSx File System (%s) not recreated", aws.StringValue(i.FileSystemId))
+			return fmt.Errorf("FSx for Windows File Server File System (%s) not recreated", aws.StringValue(i.FileSystemId))
 		}
 
 		return nil
@@ -921,6 +926,18 @@ resource "aws_directory_service_directory" "test" {
 `, domain))
 }
 
+func testAccWindowsFileSystemConfig_basic(rName, domain string) string {
+	return acctest.ConfigCompose(testAccWindowsFileSystemConfig_base(rName, domain), `
+resource "aws_fsx_windows_file_system" "test" {
+  active_directory_id = aws_directory_service_directory.test.id
+  skip_final_backup   = true
+  storage_capacity    = 32
+  subnet_ids          = [aws_subnet.test[0].id]
+  throughput_capacity = 8
+}
+`)
+}
+
 func testAccWindowsFileSystemConfig_aliases1(rName, domain, alias1 string) string {
 	return acctest.ConfigCompose(testAccWindowsFileSystemConfig_base(rName, domain), fmt.Sprintf(`
 resource "aws_fsx_windows_file_system" "test" {
@@ -930,9 +947,13 @@ resource "aws_fsx_windows_file_system" "test" {
   subnet_ids          = [aws_subnet.test[0].id]
   throughput_capacity = 8
 
-  aliases = [%[1]q]
+  aliases = [%[2]q]
+
+  tags = {
+    Name = %[1]q
+  }
 }
-`, alias1))
+`, rName, alias1))
 }
 
 func testAccWindowsFileSystemConfig_aliases2(rName, domain, alias1, alias2 string) string {
@@ -944,48 +965,64 @@ resource "aws_fsx_windows_file_system" "test" {
   subnet_ids          = [aws_subnet.test[0].id]
   throughput_capacity = 8
 
-  aliases = [%[1]q, %[2]q]
+  aliases = [%[2]q, %[3]q]
+
+  tags = {
+    Name = %[1]q
+  }
 }
-`, alias1, alias2))
+`, rName, alias1, alias2))
 }
 
 func testAccWindowsFileSystemConfig_automaticBackupRetentionDays(rName, domain string, automaticBackupRetentionDays int) string {
 	return acctest.ConfigCompose(testAccWindowsFileSystemConfig_base(rName, domain), fmt.Sprintf(`
 resource "aws_fsx_windows_file_system" "test" {
   active_directory_id             = aws_directory_service_directory.test.id
-  automatic_backup_retention_days = %[1]d
+  automatic_backup_retention_days = %[2]d
   skip_final_backup               = true
   storage_capacity                = 32
   subnet_ids                      = [aws_subnet.test[0].id]
   throughput_capacity             = 8
+
+  tags = {
+    Name = %[1]q
+  }
 }
-`, automaticBackupRetentionDays))
+`, rName, automaticBackupRetentionDays))
 }
 
 func testAccWindowsFileSystemConfig_copyTagsToBackups(rName, domain string, copyTagsToBackups bool) string {
 	return acctest.ConfigCompose(testAccWindowsFileSystemConfig_base(rName, domain), fmt.Sprintf(`
 resource "aws_fsx_windows_file_system" "test" {
   active_directory_id  = aws_directory_service_directory.test.id
-  copy_tags_to_backups = %[1]t
+  copy_tags_to_backups = %[2]t
   skip_final_backup    = true
   storage_capacity     = 32
   subnet_ids           = [aws_subnet.test[0].id]
   throughput_capacity  = 8
+
+  tags = {
+    Name = %[1]q
+  }
 }
-`, copyTagsToBackups))
+`, rName, copyTagsToBackups))
 }
 
 func testAccWindowsFileSystemConfig_dailyAutomaticBackupStartTime(rName, domain, dailyAutomaticBackupStartTime string) string {
 	return acctest.ConfigCompose(testAccWindowsFileSystemConfig_base(rName, domain), fmt.Sprintf(`
 resource "aws_fsx_windows_file_system" "test" {
   active_directory_id               = aws_directory_service_directory.test.id
-  daily_automatic_backup_start_time = %[1]q
+  daily_automatic_backup_start_time = %[2]q
   skip_final_backup                 = true
   storage_capacity                  = 32
   subnet_ids                        = [aws_subnet.test[0].id]
   throughput_capacity               = 8
+
+  tags = {
+    Name = %[1]q
+  }
 }
-`, dailyAutomaticBackupStartTime))
+`, rName, dailyAutomaticBackupStartTime))
 }
 
 func testAccWindowsFileSystemConfig_kmsKeyID1(rName, domain string) string {
@@ -1002,6 +1039,10 @@ resource "aws_fsx_windows_file_system" "test" {
   storage_capacity    = 32
   subnet_ids          = [aws_subnet.test[0].id]
   throughput_capacity = 8
+
+  tags = {
+    Name = %[1]q
+  }
 }
 `, rName))
 }
@@ -1020,6 +1061,10 @@ resource "aws_fsx_windows_file_system" "test" {
   storage_capacity    = 32
   subnet_ids          = [aws_subnet.test[0].id]
   throughput_capacity = 8
+
+  tags = {
+    Name = %[1]q
+  }
 }
 `, rName))
 }
@@ -1056,6 +1101,10 @@ resource "aws_fsx_windows_file_system" "test" {
   storage_capacity    = 32
   subnet_ids          = [aws_subnet.test[0].id]
   throughput_capacity = 8
+
+  tags = {
+    Name = %[1]q
+  }
 }
 `, rName))
 }
@@ -1115,12 +1164,16 @@ resource "aws_fsx_windows_file_system" "test" {
   storage_capacity    = 32
   subnet_ids          = [aws_subnet.test[0].id]
   throughput_capacity = 8
+
+  tags = {
+    Name = %[1]q
+  }
 }
 `, rName))
 }
 
 func testAccWindowsFileSystemConfig_selfManagedActiveDirectory(rName, domain string) string {
-	return acctest.ConfigCompose(testAccWindowsFileSystemConfig_base(rName, domain), `
+	return acctest.ConfigCompose(testAccWindowsFileSystemConfig_base(rName, domain), fmt.Sprintf(`
 resource "aws_fsx_windows_file_system" "test" {
   skip_final_backup   = true
   storage_capacity    = 32
@@ -1133,26 +1186,12 @@ resource "aws_fsx_windows_file_system" "test" {
     password    = aws_directory_service_directory.test.password
     username    = "Admin"
   }
-}
-`)
-}
-
-func testAccWindowsFileSystemConfig_selfManagedActiveDirectoryUsername(rName, domain, username string) string {
-	return acctest.ConfigCompose(testAccWindowsFileSystemConfig_base(rName, domain), fmt.Sprintf(`
-resource "aws_fsx_windows_file_system" "test" {
-  skip_final_backup   = true
-  storage_capacity    = 32
-  subnet_ids          = [aws_subnet.test[0].id]
-  throughput_capacity = 8
 
-  self_managed_active_directory {
-    dns_ips     = aws_directory_service_directory.test.dns_ip_addresses
-    domain_name = aws_directory_service_directory.test.name
-    password    = aws_directory_service_directory.test.password
-    username    = %[1]q
+  tags = {
+    Name = %[1]q
   }
 }
-`, username))
+`, rName))
 }
 
 func testAccWindowsFileSystemConfig_storageCapacity(rName, domain string, storageCapacity, throughputCapacity int) string {
@@ -1160,23 +1199,15 @@ func testAccWindowsFileSystemConfig_storageCapacity(rName, domain string, storag
 resource "aws_fsx_windows_file_system" "test" {
   active_directory_id = aws_directory_service_directory.test.id
   skip_final_backup   = true
-  storage_capacity    = %[1]d
+  storage_capacity    = %[2]d
   subnet_ids          = [aws_subnet.test[0].id]
-  throughput_capacity = %[2]d
-}
-`, storageCapacity, throughputCapacity))
-}
+  throughput_capacity = %[3]d
 
-func testAccWindowsFileSystemConfig_subnetIDs1(rName, domain string) string {
-	return acctest.ConfigCompose(testAccWindowsFileSystemConfig_base(rName, domain), `
-resource "aws_fsx_windows_file_system" "test" {
-  active_directory_id = aws_directory_service_directory.test.id
-  skip_final_backup   = true
-  storage_capacity    = 32
-  subnet_ids          = [aws_subnet.test[0].id]
-  throughput_capacity = 8
+  tags = {
+    Name = %[1]q
+  }
 }
-`)
+`, rName, storageCapacity, throughputCapacity))
 }
 
 func testAccWindowsFileSystemConfig_subnetIDs1SingleType(rName, domain, azType string) string {
@@ -1185,11 +1216,15 @@ resource "aws_fsx_windows_file_system" "test" {
   active_directory_id = aws_directory_service_directory.test.id
   skip_final_backup   = true
   storage_capacity    = 32
-  deployment_type     = %[1]q
+  deployment_type     = %[2]q
   subnet_ids          = [aws_subnet.test[0].id]
   throughput_capacity = 8
+
+  tags = {
+    Name = %[1]q
+  }
 }
-`, azType))
+`, rName, azType))
 }
 
 func testAccWindowsFileSystemConfig_subnetIDs1StorageType(rName, domain, azType, storageType string) string {
@@ -1198,16 +1233,20 @@ resource "aws_fsx_windows_file_system" "test" {
   active_directory_id = aws_directory_service_directory.test.id
   skip_final_backup   = true
   storage_capacity    = 2000
-  deployment_type     = %[1]q
+  deployment_type     = %[2]q
   subnet_ids          = [aws_subnet.test[0].id]
   throughput_capacity = 8
-  storage_type        = %[2]q
+  storage_type        = %[3]q
+
+  tags = {
+    Name = %[1]q
+  }
 }
-`, azType, storageType))
+`, rName, azType, storageType))
 }
 
 func testAccWindowsFileSystemConfig_subnetIDs2(rName, domain string) string {
-	return acctest.ConfigCompose(testAccWindowsFileSystemConfig_base(rName, domain), `
+	return acctest.ConfigCompose(testAccWindowsFileSystemConfig_base(rName, domain), fmt.Sprintf(`
 resource "aws_fsx_windows_file_system" "test" {
   active_directory_id = aws_directory_service_directory.test.id
   skip_final_backup   = true
@@ -1216,22 +1255,34 @@ resource "aws_fsx_windows_file_system" "test" {
   subnet_ids          = [aws_subnet.test[0].id, aws_subnet.test[1].id]
   preferred_subnet_id = aws_subnet.test[0].id
   throughput_capacity = 8
+
+  tags = {
+    Name = %[1]q
+  }
 }
-`)
+`, rName))
 }
 
 func testAccWindowsFileSystemConfig_fromBackup(rName, domain string) string {
-	return acctest.ConfigCompose(testAccWindowsFileSystemConfig_base(rName, domain), `
+	return acctest.ConfigCompose(testAccWindowsFileSystemConfig_base(rName, domain), fmt.Sprintf(`
 resource "aws_fsx_windows_file_system" "base" {
   active_directory_id = aws_directory_service_directory.test.id
   skip_final_backup   = true
   storage_capacity    = 32
   subnet_ids          = [aws_subnet.test[0].id]
   throughput_capacity = 8
+
+  tags = {
+    Name = %[1]q
+  }
 }
 
 resource "aws_fsx_backup" "test" {
   file_system_id = aws_fsx_windows_file_system.base.id
+
+  tags = {
+    Name = %[1]q
+  }
 }
 
 resource "aws_fsx_windows_file_system" "test" {
@@ -1240,8 +1291,12 @@ resource "aws_fsx_windows_file_system" "test" {
   skip_final_backup   = true
   subnet_ids          = [aws_subnet.test[0].id]
   throughput_capacity = 8
+
+  tags = {
+    Name = %[1]q
+  }
 }
-`)
+`, rName))
 }
 
 func testAccWindowsFileSystemConfig_tags1(rName, domain, tagKey1, tagValue1 string) string {
@@ -1284,9 +1339,13 @@ resource "aws_fsx_windows_file_system" "test" {
   skip_final_backup   = true
   storage_capacity    = 32
   subnet_ids          = [aws_subnet.test[0].id]
-  throughput_capacity = %[1]d
+  throughput_capacity = %[2]d
+
+  tags = {
+    Name = %[1]q
+  }
 }
-`, throughputCapacity))
+`, rName, throughputCapacity))
 }
 
 func testAccWindowsFileSystemConfig_weeklyMaintenanceStartTime(rName, domain, weeklyMaintenanceStartTime string) string {
@@ -1297,9 +1356,13 @@ resource "aws_fsx_windows_file_system" "test" {
   storage_capacity              = 32
   subnet_ids                    = [aws_subnet.test[0].id]
   throughput_capacity           = 8
-  weekly_maintenance_start_time = %[1]q
+  weekly_maintenance_start_time = %[2]q
+
+  tags = {
+    Name = %[1]q
+  }
 }
-`, weeklyMaintenanceStartTime))
+`, rName, weeklyMaintenanceStartTime))
 }
 
 func testAccWindowsFileSystemConfig_audit(rName, domain, status string) string {
@@ -1320,6 +1383,32 @@ resource "aws_fsx_windows_file_system" "test" {
     file_access_audit_log_level       = %[2]q
     file_share_access_audit_log_level = %[2]q
   }
+
+  tags = {
+    Name = %[1]q
+  }
 }
 `, rName, status))
 }
+
+func testAccWindowsFileSystemConfig_diskIOPSConfiguration(rName, domain string, iops int) string {
+	return acctest.ConfigCompose(testAccWindowsFileSystemConfig_base(rName, domain), fmt.Sprintf(`
+resource "aws_fsx_windows_file_system" "test" {
+  active_directory_id = aws_directory_service_directory.test.id
+  skip_final_backup   = true
+  storage_capacity    = 64
+  storage_type        = "SSD"
+  subnet_ids          = [aws_subnet.test[0].id]
+  throughput_capacity = 8
+
+  disk_iops_configuration {
+    mode = "USER_PROVISIONED"
+    iops = %[2]d
+  }
+
+  tags = {
+    Name = %[1]q
+  }
+}
+`, rName, iops))
+}
diff --git a/internal/service/gamelift/alias.go b/internal/service/gamelift/alias.go
index decb4d1cdc4..8b51f8015f6 100644
--- a/internal/service/gamelift/alias.go
+++ b/internal/service/gamelift/alias.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package gamelift
 
 import (
diff --git a/internal/service/gamelift/alias_test.go b/internal/service/gamelift/alias_test.go
index 68866645f96..89a4a6fa713 100644
--- a/internal/service/gamelift/alias_test.go
+++ b/internal/service/gamelift/alias_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package gamelift_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/gamelift"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -46,7 +49,7 @@ func TestAccGameLiftAlias_basic(t *testing.T) {
 				Config: testAccAliasConfig_basic(aliasName, description, message),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckAliasExists(ctx, resourceName, &conf),
-					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "gamelift", regexp.MustCompile(`alias/alias-.+`)),
+					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "gamelift", regexache.MustCompile(`alias/alias-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "routing_strategy.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "routing_strategy.0.message", message),
 					resource.TestCheckResourceAttr(resourceName, "routing_strategy.0.type", "TERMINAL"),
@@ -64,7 +67,7 @@ func TestAccGameLiftAlias_basic(t *testing.T) {
 				Config: testAccAliasConfig_basic(uAliasName, uDescription, uMessage),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckAliasExists(ctx, resourceName, &conf),
-					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "gamelift", regexp.MustCompile(`alias/.+`)),
+					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "gamelift", regexache.MustCompile(`alias/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "routing_strategy.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "routing_strategy.0.message", uMessage),
 					resource.TestCheckResourceAttr(resourceName, "routing_strategy.0.type", "TERMINAL"),
@@ -177,7 +180,7 @@ func TestAccGameLiftAlias_fleetRouting(t *testing.T) {
 					fleetName, launchPath, params, bucketName, key, roleArn),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckAliasExists(ctx, resourceName, &conf),
-					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "gamelift", regexp.MustCompile(`alias/alias-.+`)),
+					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "arn", "gamelift", regexache.MustCompile(`alias/alias-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "routing_strategy.#", "1"),
 					resource.TestCheckResourceAttrSet(resourceName, "routing_strategy.0.fleet_id"),
 					resource.TestCheckResourceAttr(resourceName, "routing_strategy.0.type", "SIMPLE"),
diff --git a/internal/service/gamelift/build.go b/internal/service/gamelift/build.go
index e0aba84bb24..42c514302c6 100644
--- a/internal/service/gamelift/build.go
+++ b/internal/service/gamelift/build.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package gamelift
 
 import (
diff --git a/internal/service/gamelift/build_test.go b/internal/service/gamelift/build_test.go
index 5925d307ec6..ce075d47fb1 100644
--- a/internal/service/gamelift/build_test.go
+++ b/internal/service/gamelift/build_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package gamelift_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/gamelift"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -56,7 +59,7 @@ func TestAccGameLiftBuild_basic(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBuildExists(ctx, resourceName, &conf),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "gamelift", regexp.MustCompile(`build/build-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "gamelift", regexache.MustCompile(`build/build-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "operating_system", "WINDOWS_2012"),
 					resource.TestCheckResourceAttr(resourceName, "storage_location.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "storage_location.0.bucket", bucketName),
@@ -76,7 +79,7 @@ func TestAccGameLiftBuild_basic(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBuildExists(ctx, resourceName, &conf),
 					resource.TestCheckResourceAttr(resourceName, "name", rNameUpdated),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "gamelift", regexp.MustCompile(`build/build-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "gamelift", regexache.MustCompile(`build/build-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "operating_system", "WINDOWS_2012"),
 					resource.TestCheckResourceAttr(resourceName, "storage_location.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "storage_location.0.bucket", bucketName),
diff --git a/internal/service/gamelift/consts.go b/internal/service/gamelift/consts.go
index 0b04d493663..e82ca2aa6e6 100644
--- a/internal/service/gamelift/consts.go
+++ b/internal/service/gamelift/consts.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package gamelift
 
 import (
diff --git a/internal/service/gamelift/find.go b/internal/service/gamelift/find.go
index 68875c66200..0dd5ca38959 100644
--- a/internal/service/gamelift/find.go
+++ b/internal/service/gamelift/find.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package gamelift
 
 import (
diff --git a/internal/service/gamelift/fleet.go b/internal/service/gamelift/fleet.go
index 6fccd35f1c1..aaef4e4584e 100644
--- a/internal/service/gamelift/fleet.go
+++ b/internal/service/gamelift/fleet.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package gamelift
 
 import (
diff --git a/internal/service/gamelift/fleet_test.go b/internal/service/gamelift/fleet_test.go
index 07c502e0185..378bb421c69 100644
--- a/internal/service/gamelift/fleet_test.go
+++ b/internal/service/gamelift/fleet_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package gamelift_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/gamelift"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -198,7 +201,7 @@ func TestAccGameLiftFleet_basic(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckFleetExists(ctx, resourceName, &conf),
 					resource.TestCheckResourceAttrPair(resourceName, "build_id", "aws_gamelift_build.test", "id"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "gamelift", regexp.MustCompile(`fleet/fleet-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "gamelift", regexache.MustCompile(`fleet/fleet-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "certificate_configuration.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "certificate_configuration.0.certificate_type", "DISABLED"),
 					resource.TestCheckResourceAttr(resourceName, "ec2_instance_type", "c4.large"),
@@ -226,7 +229,7 @@ func TestAccGameLiftFleet_basic(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckFleetExists(ctx, resourceName, &conf),
 					resource.TestCheckResourceAttrPair(resourceName, "build_id", "aws_gamelift_build.test", "id"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "gamelift", regexp.MustCompile(`fleet/fleet-.+`)), resource.TestCheckResourceAttr(resourceName, "ec2_instance_type", "c4.large"),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "gamelift", regexache.MustCompile(`fleet/fleet-.+`)), resource.TestCheckResourceAttr(resourceName, "ec2_instance_type", "c4.large"),
 					resource.TestCheckResourceAttr(resourceName, "log_paths.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "name", rNameUpdated),
 					resource.TestCheckResourceAttr(resourceName, "description", rNameUpdated),
@@ -373,7 +376,7 @@ func TestAccGameLiftFleet_allFields(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckFleetExists(ctx, resourceName, &conf),
 					resource.TestCheckResourceAttrPair(resourceName, "build_id", "aws_gamelift_build.test", "id"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "gamelift", regexp.MustCompile(`fleet/fleet-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "gamelift", regexache.MustCompile(`fleet/fleet-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "ec2_instance_type", "c4.large"),
 					resource.TestCheckResourceAttr(resourceName, "fleet_type", "ON_DEMAND"),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
@@ -425,7 +428,7 @@ func TestAccGameLiftFleet_allFields(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckFleetExists(ctx, resourceName, &conf),
 					resource.TestCheckResourceAttrPair(resourceName, "build_id", "aws_gamelift_build.test", "id"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "gamelift", regexp.MustCompile(`fleet/fleet-.+`)), resource.TestCheckResourceAttr(resourceName, "ec2_instance_type", "c4.large"),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "gamelift", regexache.MustCompile(`fleet/fleet-.+`)), resource.TestCheckResourceAttr(resourceName, "ec2_instance_type", "c4.large"),
 					resource.TestCheckResourceAttr(resourceName, "fleet_type", "ON_DEMAND"),
 					resource.TestCheckResourceAttr(resourceName, "name", rNameUpdated),
 					resource.TestCheckResourceAttr(resourceName, "description", desc),
@@ -554,7 +557,7 @@ func TestAccGameLiftFleet_script(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckFleetExists(ctx, resourceName, &conf),
 					resource.TestCheckResourceAttrPair(resourceName, "script_id", "aws_gamelift_script.test", "id"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "gamelift", regexp.MustCompile(`fleet/fleet-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "gamelift", regexache.MustCompile(`fleet/fleet-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "certificate_configuration.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "certificate_configuration.0.certificate_type", "DISABLED"),
 					resource.TestCheckResourceAttr(resourceName, "ec2_instance_type", "t2.micro"),
diff --git a/internal/service/gamelift/game_server_group.go b/internal/service/gamelift/game_server_group.go
index 1a536819ff9..fc0ae888022 100644
--- a/internal/service/gamelift/game_server_group.go
+++ b/internal/service/gamelift/game_server_group.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package gamelift
 
 import ( // nosemgrep:ci.semgrep.aws.multiple-service-imports
diff --git a/internal/service/gamelift/game_server_group_test.go b/internal/service/gamelift/game_server_group_test.go
index a9feb54d308..a4b4e429942 100644
--- a/internal/service/gamelift/game_server_group_test.go
+++ b/internal/service/gamelift/game_server_group_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package gamelift_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/gamelift"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -35,8 +38,8 @@ func TestAccGameLiftGameServerGroup_basic(t *testing.T) {
 				Config: testAccGameServerGroupConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckGameServerGroupExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "gamelift", regexp.MustCompile(`gameservergroup/.+`)),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "auto_scaling_group_arn", "autoscaling", regexp.MustCompile(`autoScalingGroup:.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "gamelift", regexache.MustCompile(`gameservergroup/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "auto_scaling_group_arn", "autoscaling", regexache.MustCompile(`autoScalingGroup:.+`)),
 					resource.TestCheckResourceAttr(resourceName, "auto_scaling_policy.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "balancing_strategy", gamelift.BalancingStrategySpotPreferred),
 					resource.TestCheckResourceAttr(resourceName, "game_server_protection_policy", gamelift.GameServerProtectionPolicyNoProtection),
diff --git a/internal/service/gamelift/game_session_queue.go b/internal/service/gamelift/game_session_queue.go
index fa812a9d7cd..50faea75726 100644
--- a/internal/service/gamelift/game_session_queue.go
+++ b/internal/service/gamelift/game_session_queue.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package gamelift
 
 import (
diff --git a/internal/service/gamelift/game_session_queue_test.go b/internal/service/gamelift/game_session_queue_test.go
index b606d1b0862..64b0b98da61 100644
--- a/internal/service/gamelift/game_session_queue_test.go
+++ b/internal/service/gamelift/game_session_queue_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package gamelift_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/gamelift"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -65,7 +68,7 @@ func TestAccGameLiftGameSessionQueue_basic(t *testing.T) {
 					playerLatencyPolicies, timeoutInSeconds, "Custom Event Data"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckGameSessionQueueExists(ctx, resourceName, &conf),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "gamelift", regexp.MustCompile(`gamesessionqueue/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "gamelift", regexache.MustCompile(`gamesessionqueue/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "name", queueName),
 					resource.TestCheckResourceAttr(resourceName, "destinations.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "notification_target", ""),
@@ -86,7 +89,7 @@ func TestAccGameLiftGameSessionQueue_basic(t *testing.T) {
 				Config: testAccGameSessionQueueConfig_basic(uQueueName, uPlayerLatencyPolicies, uTimeoutInSeconds, "Custom Event Data"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckGameSessionQueueExists(ctx, resourceName, &conf),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "gamelift", regexp.MustCompile(`gamesessionqueue/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "gamelift", regexache.MustCompile(`gamesessionqueue/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "name", uQueueName),
 					resource.TestCheckResourceAttr(resourceName, "destinations.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "notification_target", ""),
diff --git a/internal/service/gamelift/gamelift_test.go b/internal/service/gamelift/gamelift_test.go
index 1fb42a18168..46ba26d21c1 100644
--- a/internal/service/gamelift/gamelift_test.go
+++ b/internal/service/gamelift/gamelift_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package gamelift_test
 
 import (
diff --git a/internal/service/gamelift/generate.go b/internal/service/gamelift/generate.go
index 706ad437a76..86e19c258e9 100644
--- a/internal/service/gamelift/generate.go
+++ b/internal/service/gamelift/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTags -ListTagsInIDElem=ResourceARN -ServiceTagsSlice -TagInIDElem=ResourceARN -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/gamelift/script.go b/internal/service/gamelift/script.go
index 59b850608c0..93c9ea9d0d4 100644
--- a/internal/service/gamelift/script.go
+++ b/internal/service/gamelift/script.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package gamelift
 
 import (
diff --git a/internal/service/gamelift/script_test.go b/internal/service/gamelift/script_test.go
index c16e038d77b..09677d65054 100644
--- a/internal/service/gamelift/script_test.go
+++ b/internal/service/gamelift/script_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package gamelift_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/gamelift"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -41,7 +44,7 @@ func TestAccGameLiftScript_basic(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckScriptExists(ctx, resourceName, &conf),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "gamelift", regexp.MustCompile(`script/script-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "gamelift", regexache.MustCompile(`script/script-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "storage_location.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "storage_location.0.bucket", fmt.Sprintf("prod-gamescale-scripts-%s", region)),
 					resource.TestCheckResourceAttrSet(resourceName, "storage_location.0.key"),
@@ -59,7 +62,7 @@ func TestAccGameLiftScript_basic(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckScriptExists(ctx, resourceName, &conf),
 					resource.TestCheckResourceAttr(resourceName, "name", rNameUpdated),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "gamelift", regexp.MustCompile(`script/script-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "gamelift", regexache.MustCompile(`script/script-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "storage_location.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 				),
diff --git a/internal/service/gamelift/service_package_gen.go b/internal/service/gamelift/service_package_gen.go
index ecd791e3fde..dee7fa2a2c9 100644
--- a/internal/service/gamelift/service_package_gen.go
+++ b/internal/service/gamelift/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	gamelift_sdkv1 "github.com/aws/aws-sdk-go/service/gamelift"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -90,4 +91,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*g
 	return gamelift_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/gamelift/status.go b/internal/service/gamelift/status.go
index f0c0518feb0..d320fa516e1 100644
--- a/internal/service/gamelift/status.go
+++ b/internal/service/gamelift/status.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package gamelift
 
 import (
diff --git a/internal/service/gamelift/sweep.go b/internal/service/gamelift/sweep.go
index a328cbf3149..8e737e8a680 100644
--- a/internal/service/gamelift/sweep.go
+++ b/internal/service/gamelift/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package gamelift
 
@@ -13,9 +13,10 @@ import (
 	"github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_gamelift_alias", &resource.Sweeper{
 		Name: "aws_gamelift_alias",
 		Dependencies: []string{
@@ -55,7 +56,7 @@ func init() {
 
 func sweepAliases(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("getting client: %s", err)
 	}
@@ -82,7 +83,7 @@ func sweepAliases(region string) error {
 		return nil
 	})
 	if err != nil {
-		if sweep.SkipSweepError(err) {
+		if awsv1.SkipSweepError(err) {
 			log.Printf("[WARN] Skipping GameLift Alias sweep for %s: %s", region, err)
 			return nil
 		}
@@ -94,7 +95,7 @@ func sweepAliases(region string) error {
 
 func sweepBuilds(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("getting client: %s", err)
 	}
@@ -102,7 +103,7 @@ func sweepBuilds(region string) error {
 
 	resp, err := conn.ListBuildsWithContext(ctx, &gamelift.ListBuildsInput{})
 	if err != nil {
-		if sweep.SkipSweepError(err) {
+		if awsv1.SkipSweepError(err) {
 			log.Printf("[WARN] Skipping Gamelife Build sweep for %s: %s", region, err)
 			return nil
 		}
@@ -132,7 +133,7 @@ func sweepBuilds(region string) error {
 
 func sweepScripts(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("getting client: %s", err)
 	}
@@ -140,7 +141,7 @@ func sweepScripts(region string) error {
 
 	resp, err := conn.ListScriptsWithContext(ctx, &gamelift.ListScriptsInput{})
 	if err != nil {
-		if sweep.SkipSweepError(err) {
+		if awsv1.SkipSweepError(err) {
 			log.Printf("[WARN] Skipping Gamelife Script sweep for %s: %s", region, err)
 			return nil
 		}
@@ -170,7 +171,7 @@ func sweepScripts(region string) error {
 
 func sweepFleets(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("getting client: %s", err)
 	}
@@ -211,11 +212,11 @@ func sweepFleets(region string) error {
 		errs = multierror.Append(errs, fmt.Errorf("listing GameLift Fleet for %s: %w", region, err))
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("sweeping GameLift Fleet for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping GameLift Fleet sweep for %s: %s", region, errs)
 		return nil
 	}
@@ -225,7 +226,7 @@ func sweepFleets(region string) error {
 
 func sweepGameServerGroups(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("getting client: %s", err)
 	}
@@ -266,11 +267,11 @@ func sweepGameServerGroups(region string) error {
 		errs = multierror.Append(errs, fmt.Errorf("listing GameLift Game Server Group for %s: %w", region, err))
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("sweeping GameLift Game Server Group for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping GameLift Game Server Group sweep for %s: %s", region, errs)
 		return nil
 	}
@@ -280,7 +281,7 @@ func sweepGameServerGroups(region string) error {
 
 func sweepGameSessionQueue(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("getting client: %s", err)
 	}
@@ -288,7 +289,7 @@ func sweepGameSessionQueue(region string) error {
 
 	out, err := conn.DescribeGameSessionQueuesWithContext(ctx, &gamelift.DescribeGameSessionQueuesInput{})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Gamelife Queue sweep for %s: %s", region, err)
 		return nil
 	}
diff --git a/internal/service/gamelift/tags_gen.go b/internal/service/gamelift/tags_gen.go
index 2f00ebe11db..a4a49ffb078 100644
--- a/internal/service/gamelift/tags_gen.go
+++ b/internal/service/gamelift/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/gamelift"
 	"github.com/aws/aws-sdk-go/service/gamelift/gameliftiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -102,6 +104,8 @@ func updateTags(ctx context.Context, conn gameliftiface.GameLiftAPI, identifier
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.GameLift)
 	if len(removedTags) > 0 {
diff --git a/internal/service/gamelift/wait.go b/internal/service/gamelift/wait.go
index 17debeb6582..7fd9bc74163 100644
--- a/internal/service/gamelift/wait.go
+++ b/internal/service/gamelift/wait.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package gamelift
 
 import (
diff --git a/internal/service/glacier/exports_test.go b/internal/service/glacier/exports_test.go
index 43675c93682..3696926484c 100644
--- a/internal/service/glacier/exports_test.go
+++ b/internal/service/glacier/exports_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package glacier
 
 // Exports for use in tests only.
diff --git a/internal/service/glacier/generate.go b/internal/service/glacier/generate.go
index 44e42af2cae..42c5002c468 100644
--- a/internal/service/glacier/generate.go
+++ b/internal/service/glacier/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -AWSSDKVersion=2 -ListTags -ListTagsOp=ListTagsForVault -ListTagsInIDElem=VaultName -ServiceTagsMap -KVTValues -TagOp=AddTagsToVault -TagInIDElem=VaultName -UntagOp=RemoveTagsFromVault -UpdateTags -CreateTags -SkipTypesImp
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/glacier/service_package_gen.go b/internal/service/glacier/service_package_gen.go
index 480c97e2abe..373cb848a02 100644
--- a/internal/service/glacier/service_package_gen.go
+++ b/internal/service/glacier/service_package_gen.go
@@ -7,6 +7,7 @@ import (
 
 	aws_sdkv2 "github.com/aws/aws-sdk-go-v2/aws"
 	glacier_sdkv2 "github.com/aws/aws-sdk-go-v2/service/glacier"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -52,9 +53,11 @@ func (p *servicePackage) NewClient(ctx context.Context, config map[string]any) (
 
 	return glacier_sdkv2.NewFromConfig(cfg, func(o *glacier_sdkv2.Options) {
 		if endpoint := config["endpoint"].(string); endpoint != "" {
-			o.EndpointResolver = glacier_sdkv2.EndpointResolverFromURL(endpoint)
+			o.BaseEndpoint = aws_sdkv2.String(endpoint)
 		}
 	}), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/glacier/sweep.go b/internal/service/glacier/sweep.go
index 8ee501732c2..35789d9d88b 100644
--- a/internal/service/glacier/sweep.go
+++ b/internal/service/glacier/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package glacier
 
@@ -11,9 +11,10 @@ import (
 	"github.com/aws/aws-sdk-go-v2/service/glacier"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv2"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_glacier_vault", &resource.Sweeper{
 		Name: "aws_glacier_vault",
 		F:    sweepVaults,
@@ -22,7 +23,7 @@ func init() {
 
 func sweepVaults(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
@@ -34,7 +35,7 @@ func sweepVaults(region string) error {
 	for pages.HasMorePages() {
 		page, err := pages.NextPage(ctx)
 
-		if sweep.SkipSweepError(err) {
+		if awsv2.SkipSweepError(err) {
 			log.Printf("[WARN] Skipping Glacier Vault sweep for %s: %s", region, err)
 			return nil
 		}
@@ -52,7 +53,7 @@ func sweepVaults(region string) error {
 		}
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping Glacier Vaults (%s): %w", region, err)
diff --git a/internal/service/glacier/tags_gen.go b/internal/service/glacier/tags_gen.go
index 810838fb9fb..5720d3d4ad5 100644
--- a/internal/service/glacier/tags_gen.go
+++ b/internal/service/glacier/tags_gen.go
@@ -7,7 +7,9 @@ import (
 
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/glacier"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -53,7 +55,7 @@ func Tags(tags tftags.KeyValueTags) map[string]string {
 	return tags.Map()
 }
 
-// KeyValueTags creates KeyValueTags from glacier service tags.
+// KeyValueTags creates tftags.KeyValueTags from glacier service tags.
 func KeyValueTags(ctx context.Context, tags map[string]string) tftags.KeyValueTags {
 	return tftags.New(ctx, tags)
 }
@@ -93,6 +95,8 @@ func updateTags(ctx context.Context, conn *glacier.Client, identifier string, ol
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.Glacier)
 	if len(removedTags) > 0 {
diff --git a/internal/service/glacier/vault.go b/internal/service/glacier/vault.go
index 720186d427c..e9f1ab6e989 100644
--- a/internal/service/glacier/vault.go
+++ b/internal/service/glacier/vault.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package glacier
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/glacier"
 	"github.com/aws/aws-sdk-go-v2/service/glacier/types"
@@ -63,7 +66,7 @@ func resourceVault() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 255),
-					validation.StringMatch(regexp.MustCompile(`^[.0-9A-Za-z-_]+$`),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_.-]+$`),
 						"only alphanumeric characters, hyphens, underscores, and periods are allowed"),
 				),
 			},
diff --git a/internal/service/glacier/vault_lock.go b/internal/service/glacier/vault_lock.go
index 432272caeeb..b71ba480064 100644
--- a/internal/service/glacier/vault_lock.go
+++ b/internal/service/glacier/vault_lock.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package glacier
 
 import (
diff --git a/internal/service/glacier/vault_lock_test.go b/internal/service/glacier/vault_lock_test.go
index cbab9b11290..df8fbea980a 100644
--- a/internal/service/glacier/vault_lock_test.go
+++ b/internal/service/glacier/vault_lock_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package glacier_test
 
 import (
diff --git a/internal/service/glacier/vault_test.go b/internal/service/glacier/vault_test.go
index 26768cc3e7c..a5d56e58f51 100644
--- a/internal/service/glacier/vault_test.go
+++ b/internal/service/glacier/vault_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package glacier_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/service/glacier"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -35,7 +38,7 @@ func TestAccGlacierVault_basic(t *testing.T) {
 					testAccCheckVaultExists(ctx, resourceName, &vault),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "glacier", regexp.MustCompile(`vaults/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "glacier", regexache.MustCompile(`vaults/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "notification.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "access_policy", ""),
 				),
@@ -113,7 +116,7 @@ func TestAccGlacierVault_policy(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckVaultExists(ctx, resourceName, &vault),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
-					resource.TestMatchResourceAttr(resourceName, "access_policy", regexp.MustCompile(`"Sid":"cross-account-upload".+`)),
+					resource.TestMatchResourceAttr(resourceName, "access_policy", regexache.MustCompile(`"Sid":"cross-account-upload".+`)),
 				),
 			},
 			{
@@ -126,7 +129,7 @@ func TestAccGlacierVault_policy(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckVaultExists(ctx, resourceName, &vault),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
-					resource.TestMatchResourceAttr(resourceName, "access_policy", regexp.MustCompile(`"Sid":"cross-account-upload1".+`)),
+					resource.TestMatchResourceAttr(resourceName, "access_policy", regexache.MustCompile(`"Sid":"cross-account-upload1".+`)),
 				),
 			},
 			{
@@ -228,9 +231,9 @@ func TestAccGlacierVault_ignoreEquivalent(t *testing.T) {
 					testAccCheckVaultExists(ctx, resourceName, &vault),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "glacier", regexp.MustCompile(`vaults/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "glacier", regexache.MustCompile(`vaults/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "notification.#", "0"),
-					resource.TestMatchResourceAttr(resourceName, "access_policy", regexp.MustCompile(fmt.Sprintf(`"Sid":"%s"`, rName))),
+					resource.TestMatchResourceAttr(resourceName, "access_policy", regexache.MustCompile(fmt.Sprintf(`"Sid":"%s"`, rName))),
 				),
 			},
 			{
diff --git a/internal/service/globalaccelerator/accelerator.go b/internal/service/globalaccelerator/accelerator.go
index 0b6bb8d678e..07fd750ea3b 100644
--- a/internal/service/globalaccelerator/accelerator.go
+++ b/internal/service/globalaccelerator/accelerator.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package globalaccelerator
 
 import (
 	"context"
 	"log"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/globalaccelerator"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -117,9 +120,9 @@ func ResourceAccelerator() *schema.Resource {
 				Required: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 255),
-					validation.StringMatch(regexp.MustCompile(`^[0-9A-Za-z-]+$`), "only alphanumeric characters and hyphens are allowed"),
-					validation.StringDoesNotMatch(regexp.MustCompile(`^-`), "cannot start with a hyphen"),
-					validation.StringDoesNotMatch(regexp.MustCompile(`-$`), "cannot end with a hyphen"),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z-]+$`), "only alphanumeric characters and hyphens are allowed"),
+					validation.StringDoesNotMatch(regexache.MustCompile(`^-`), "cannot start with a hyphen"),
+					validation.StringDoesNotMatch(regexache.MustCompile(`-$`), "cannot end with a hyphen"),
 				),
 			},
 			names.AttrTags:    tftags.TagsSchema(),
diff --git a/internal/service/globalaccelerator/accelerator_data_source.go b/internal/service/globalaccelerator/accelerator_data_source.go
index 89f09cfc5d6..171e51919a8 100644
--- a/internal/service/globalaccelerator/accelerator_data_source.go
+++ b/internal/service/globalaccelerator/accelerator_data_source.go
@@ -1,17 +1,19 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package globalaccelerator
 
 import (
 	"context"
 
-	"github.com/aws/aws-sdk-go-v2/aws/arn"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/globalaccelerator"
 	"github.com/hashicorp/terraform-plugin-framework/attr"
 	"github.com/hashicorp/terraform-plugin-framework/datasource"
 	"github.com/hashicorp/terraform-plugin-framework/datasource/schema"
 	"github.com/hashicorp/terraform-plugin-framework/types"
-	"github.com/hashicorp/terraform-provider-aws/internal/flex"
 	"github.com/hashicorp/terraform-provider-aws/internal/framework"
+	"github.com/hashicorp/terraform-provider-aws/internal/framework/flex"
 	fwtypes "github.com/hashicorp/terraform-provider-aws/internal/framework/types"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 )
@@ -147,11 +149,7 @@ func (d *dataSourceAccelerator) Read(ctx context.Context, request datasource.Rea
 
 	accelerator := results[0]
 	acceleratorARN := aws.StringValue(accelerator.AcceleratorArn)
-	if v, err := arn.Parse(acceleratorARN); err != nil {
-		response.Diagnostics.AddError("parsing ARN", err.Error())
-	} else {
-		data.ARN = fwtypes.ARNValue(v)
-	}
+	data.ARN = flex.StringToFrameworkARN(ctx, accelerator.AcceleratorArn, nil)
 	data.DnsName = flex.StringToFrameworkLegacy(ctx, accelerator.DnsName)
 	data.DualStackDNSName = flex.StringToFrameworkLegacy(ctx, accelerator.DualStackDnsName)
 	data.Enabled = flex.BoolToFrameworkLegacy(ctx, accelerator.Enabled)
diff --git a/internal/service/globalaccelerator/accelerator_data_source_test.go b/internal/service/globalaccelerator/accelerator_data_source_test.go
index dbeae83d46b..4e7c94bfbb8 100644
--- a/internal/service/globalaccelerator/accelerator_data_source_test.go
+++ b/internal/service/globalaccelerator/accelerator_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package globalaccelerator_test
 
 import (
diff --git a/internal/service/globalaccelerator/accelerator_test.go b/internal/service/globalaccelerator/accelerator_test.go
index 184e3cf76b3..679252925b7 100644
--- a/internal/service/globalaccelerator/accelerator_test.go
+++ b/internal/service/globalaccelerator/accelerator_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package globalaccelerator_test
 
 import (
@@ -5,9 +8,9 @@ import (
 	"fmt"
 	"net"
 	"os"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/globalaccelerator"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -22,8 +25,8 @@ func TestAccGlobalAcceleratorAccelerator_basic(t *testing.T) {
 	ctx := acctest.Context(t)
 	resourceName := "aws_globalaccelerator_accelerator.test"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
-	ipRegex := regexp.MustCompile(`\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}`)
-	dnsNameRegex := regexp.MustCompile(`^a[a-f0-9]{16}\.awsglobalaccelerator\.com$`)
+	ipRegex := regexache.MustCompile(`\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}`)
+	dnsNameRegex := regexache.MustCompile(`^a[0-9a-f]{16}\.awsglobalaccelerator\.com$`)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheck(ctx, t) },
@@ -66,7 +69,7 @@ func TestAccGlobalAcceleratorAccelerator_ipAddressType_dualStack(t *testing.T) {
 	ctx := acctest.Context(t)
 	resourceName := "aws_globalaccelerator_accelerator.test"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
-	dualStackDNSNameRegex := regexp.MustCompile(`^a[a-f0-9]{16}\.dualstack\.awsglobalaccelerator\.com$`)
+	dualStackDNSNameRegex := regexache.MustCompile(`^a[0-9a-f]{16}\.dualstack\.awsglobalaccelerator\.com$`)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheck(ctx, t) },
diff --git a/internal/service/globalaccelerator/arn.go b/internal/service/globalaccelerator/arn.go
index 316265c689e..e02a0830622 100644
--- a/internal/service/globalaccelerator/arn.go
+++ b/internal/service/globalaccelerator/arn.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package globalaccelerator
 
 import (
diff --git a/internal/service/globalaccelerator/arn_test.go b/internal/service/globalaccelerator/arn_test.go
index 4844644e64a..567bdd92a29 100644
--- a/internal/service/globalaccelerator/arn_test.go
+++ b/internal/service/globalaccelerator/arn_test.go
@@ -1,9 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package globalaccelerator_test
 
 import (
 	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	tfglobalaccelerator "github.com/hashicorp/terraform-provider-aws/internal/service/globalaccelerator"
 )
 
@@ -19,22 +23,22 @@ func TestEndpointGroupARNToListenerARN(t *testing.T) {
 		{
 			TestName:      "empty ARN",
 			InputARN:      "",
-			ExpectedError: regexp.MustCompile(`parsing ARN`),
+			ExpectedError: regexache.MustCompile(`parsing ARN`),
 		},
 		{
 			TestName:      "unparsable ARN",
 			InputARN:      "test",
-			ExpectedError: regexp.MustCompile(`parsing ARN`),
+			ExpectedError: regexache.MustCompile(`parsing ARN`),
 		},
 		{
 			TestName:      "invalid ARN service",
 			InputARN:      "arn:aws:ec2::123456789012:accelerator/a-123/listener/l-456/endpoint-group/eg-789", //lintignore:AWSAT005
-			ExpectedError: regexp.MustCompile(`expected service globalaccelerator`),
+			ExpectedError: regexache.MustCompile(`expected service globalaccelerator`),
 		},
 		{
 			TestName:      "invalid ARN resource parts",
 			InputARN:      "arn:aws:globalaccelerator::123456789012:accelerator/a-123/listener/l-456", //lintignore:AWSAT005
-			ExpectedError: regexp.MustCompile(`expected at least 6 resource parts`),
+			ExpectedError: regexache.MustCompile(`expected at least 6 resource parts`),
 		},
 		{
 			TestName:    "valid ARN",
@@ -81,22 +85,22 @@ func TestListenerOrEndpointGroupARNToAcceleratorARN(t *testing.T) {
 		{
 			TestName:      "empty ARN",
 			InputARN:      "",
-			ExpectedError: regexp.MustCompile(`parsing ARN`),
+			ExpectedError: regexache.MustCompile(`parsing ARN`),
 		},
 		{
 			TestName:      "unparsable ARN",
 			InputARN:      "test",
-			ExpectedError: regexp.MustCompile(`parsing ARN`),
+			ExpectedError: regexache.MustCompile(`parsing ARN`),
 		},
 		{
 			TestName:      "invalid ARN service",
 			InputARN:      "arn:aws:ec2::123456789012:accelerator/a-123/listener/l-456", //lintignore:AWSAT005
-			ExpectedError: regexp.MustCompile(`expected service globalaccelerator`),
+			ExpectedError: regexache.MustCompile(`expected service globalaccelerator`),
 		},
 		{
 			TestName:      "invalid ARN resource parts",
 			InputARN:      "arn:aws:globalaccelerator::123456789012:accelerator/a-123", //lintignore:AWSAT005
-			ExpectedError: regexp.MustCompile(`expected at least 4 resource parts`),
+			ExpectedError: regexache.MustCompile(`expected at least 4 resource parts`),
 		},
 		{
 			TestName:    "valid listener ARN",
diff --git a/internal/service/globalaccelerator/custom_routing_accelerator.go b/internal/service/globalaccelerator/custom_routing_accelerator.go
index 072afc7d75a..aae4d10144b 100644
--- a/internal/service/globalaccelerator/custom_routing_accelerator.go
+++ b/internal/service/globalaccelerator/custom_routing_accelerator.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package globalaccelerator
 
 import (
 	"context"
 	"log"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/globalaccelerator"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -114,9 +117,9 @@ func ResourceCustomRoutingAccelerator() *schema.Resource {
 				Required: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 255),
-					validation.StringMatch(regexp.MustCompile(`^[0-9A-Za-z-]+$`), "only alphanumeric characters and hyphens are allowed"),
-					validation.StringDoesNotMatch(regexp.MustCompile(`^-`), "cannot start with a hyphen"),
-					validation.StringDoesNotMatch(regexp.MustCompile(`-$`), "cannot end with a hyphen"),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z-]+$`), "only alphanumeric characters and hyphens are allowed"),
+					validation.StringDoesNotMatch(regexache.MustCompile(`^-`), "cannot start with a hyphen"),
+					validation.StringDoesNotMatch(regexache.MustCompile(`-$`), "cannot end with a hyphen"),
 				),
 			},
 			names.AttrTags:    tftags.TagsSchema(),
diff --git a/internal/service/globalaccelerator/custom_routing_accelerator_data_source.go b/internal/service/globalaccelerator/custom_routing_accelerator_data_source.go
index e0a8dad7fbc..384c2979933 100644
--- a/internal/service/globalaccelerator/custom_routing_accelerator_data_source.go
+++ b/internal/service/globalaccelerator/custom_routing_accelerator_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package globalaccelerator
 
 import (
diff --git a/internal/service/globalaccelerator/custom_routing_accelerator_data_source_test.go b/internal/service/globalaccelerator/custom_routing_accelerator_data_source_test.go
index deaabe9cc41..576ef8656f8 100644
--- a/internal/service/globalaccelerator/custom_routing_accelerator_data_source_test.go
+++ b/internal/service/globalaccelerator/custom_routing_accelerator_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package globalaccelerator_test
 
 import (
diff --git a/internal/service/globalaccelerator/custom_routing_accelerator_test.go b/internal/service/globalaccelerator/custom_routing_accelerator_test.go
index 3acf9dafda6..46c9f72c10f 100644
--- a/internal/service/globalaccelerator/custom_routing_accelerator_test.go
+++ b/internal/service/globalaccelerator/custom_routing_accelerator_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package globalaccelerator_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/globalaccelerator"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -20,8 +23,8 @@ func TestAccGlobalAcceleratorCustomRoutingAccelerator_basic(t *testing.T) {
 	ctx := acctest.Context(t)
 	resourceName := "aws_globalaccelerator_custom_routing_accelerator.test"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
-	ipRegex := regexp.MustCompile(`\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}`)
-	dnsNameRegex := regexp.MustCompile(`^a[a-f0-9]{16}\.awsglobalaccelerator\.com$`)
+	ipRegex := regexache.MustCompile(`\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}`)
+	dnsNameRegex := regexache.MustCompile(`^a[0-9a-f]{16}\.awsglobalaccelerator\.com$`)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheck(ctx, t) },
diff --git a/internal/service/globalaccelerator/custom_routing_endpoint_group.go b/internal/service/globalaccelerator/custom_routing_endpoint_group.go
index 148871d5e91..97433867e0e 100644
--- a/internal/service/globalaccelerator/custom_routing_endpoint_group.go
+++ b/internal/service/globalaccelerator/custom_routing_endpoint_group.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package globalaccelerator
 
 import (
@@ -87,7 +90,7 @@ func ResourceCustomRoutingEndpointGroup() *schema.Resource {
 				Optional:     true,
 				Computed:     true,
 				ForceNew:     true,
-				ValidateFunc: validation.StringLenBetween(1, 255),
+				ValidateFunc: verify.ValidRegionName,
 			},
 			"listener_arn": {
 				Type:         schema.TypeString,
@@ -102,15 +105,18 @@ func ResourceCustomRoutingEndpointGroup() *schema.Resource {
 func resourceCustomRoutingEndpointGroupCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).GlobalAcceleratorConn(ctx)
-	region := meta.(*conns.AWSClient).Region
 
 	input := &globalaccelerator.CreateCustomRoutingEndpointGroupInput{
 		DestinationConfigurations: expandCustomRoutingDestinationConfigurations(d.Get("destination_configuration").(*schema.Set).List()),
-		EndpointGroupRegion:       aws.String(region),
+		EndpointGroupRegion:       aws.String(meta.(*conns.AWSClient).Region),
 		IdempotencyToken:          aws.String(id.UniqueId()),
 		ListenerArn:               aws.String(d.Get("listener_arn").(string)),
 	}
 
+	if v, ok := d.GetOk("endpoint_group_region"); ok {
+		input.EndpointGroupRegion = aws.String(v.(string))
+	}
+
 	output, err := conn.CreateCustomRoutingEndpointGroupWithContext(ctx, input)
 
 	if err != nil {
diff --git a/internal/service/globalaccelerator/custom_routing_endpoint_group_test.go b/internal/service/globalaccelerator/custom_routing_endpoint_group_test.go
index 581c6eda2fd..add9cdcd57e 100644
--- a/internal/service/globalaccelerator/custom_routing_endpoint_group_test.go
+++ b/internal/service/globalaccelerator/custom_routing_endpoint_group_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package globalaccelerator_test
 
 import (
@@ -38,7 +41,7 @@ func TestAccGlobalAcceleratorCustomRoutingEndpointGroup_basic(t *testing.T) {
 					resource.TestCheckTypeSetElemAttr(resourceName, "destination_configuration.0.protocols.*", "TCP"),
 					resource.TestCheckResourceAttr(resourceName, "destination_configuration.0.to_port", "8443"),
 					resource.TestCheckResourceAttr(resourceName, "endpoint_configuration.#", "0"),
-					resource.TestCheckResourceAttrSet(resourceName, "endpoint_group_region"),
+					resource.TestCheckResourceAttr(resourceName, "endpoint_group_region", acctest.Region()),
 				),
 			},
 			{
@@ -110,6 +113,41 @@ func TestAccGlobalAcceleratorCustomRoutingEndpointGroup_endpointConfiguration(t
 	})
 }
 
+func TestAccGlobalAcceleratorCustomRoutingEndpointGroup_endpointGroupRegion(t *testing.T) {
+	ctx := acctest.Context(t)
+	var v globalaccelerator.CustomRoutingEndpointGroup
+	resourceName := "aws_globalaccelerator_custom_routing_endpoint_group.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, globalaccelerator.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckCustomRoutingEndpointGroupDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccCustomRoutingEndpointGroupConfig_endpointGroupRegion(rName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckCustomRoutingEndpointGroupExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttrSet(resourceName, "arn"),
+					resource.TestCheckResourceAttr(resourceName, "destination_configuration.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "destination_configuration.0.from_port", "443"),
+					resource.TestCheckResourceAttr(resourceName, "destination_configuration.0.protocols.#", "1"),
+					resource.TestCheckTypeSetElemAttr(resourceName, "destination_configuration.0.protocols.*", "TCP"),
+					resource.TestCheckResourceAttr(resourceName, "destination_configuration.0.to_port", "8443"),
+					resource.TestCheckResourceAttr(resourceName, "endpoint_configuration.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "endpoint_group_region", acctest.AlternateRegion()),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
 func testAccCheckCustomRoutingEndpointGroupExists(ctx context.Context, n string, v *globalaccelerator.CustomRoutingEndpointGroup) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		conn := acctest.Provider.Meta().(*conns.AWSClient).GlobalAcceleratorConn(ctx)
@@ -245,3 +283,32 @@ resource "aws_internet_gateway" "test" {
 }
 `, rName))
 }
+
+func testAccCustomRoutingEndpointGroupConfig_endpointGroupRegion(rName string) string {
+	return fmt.Sprintf(`
+resource "aws_globalaccelerator_custom_routing_accelerator" "test" {
+  name = %[1]q
+}
+
+resource "aws_globalaccelerator_custom_routing_listener" "test" {
+  accelerator_arn = aws_globalaccelerator_custom_routing_accelerator.test.id
+
+  port_range {
+    from_port = 443
+    to_port   = 443
+  }
+}
+
+resource "aws_globalaccelerator_custom_routing_endpoint_group" "test" {
+  listener_arn = aws_globalaccelerator_custom_routing_listener.test.id
+
+  destination_configuration {
+    from_port = 443
+    to_port   = 8443
+    protocols = ["TCP"]
+  }
+
+  endpoint_group_region = %[2]q
+}
+`, rName, acctest.AlternateRegion())
+}
diff --git a/internal/service/globalaccelerator/custom_routing_listener.go b/internal/service/globalaccelerator/custom_routing_listener.go
index dff9b583503..0f8324bdf6c 100644
--- a/internal/service/globalaccelerator/custom_routing_listener.go
+++ b/internal/service/globalaccelerator/custom_routing_listener.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package globalaccelerator
 
 import (
diff --git a/internal/service/globalaccelerator/custom_routing_listener_test.go b/internal/service/globalaccelerator/custom_routing_listener_test.go
index 1c179b296bf..93028d2f4cf 100644
--- a/internal/service/globalaccelerator/custom_routing_listener_test.go
+++ b/internal/service/globalaccelerator/custom_routing_listener_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package globalaccelerator_test
 
 import (
diff --git a/internal/service/globalaccelerator/endpoint_group.go b/internal/service/globalaccelerator/endpoint_group.go
index 52e14ea3ad4..7a82cbfff13 100644
--- a/internal/service/globalaccelerator/endpoint_group.go
+++ b/internal/service/globalaccelerator/endpoint_group.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package globalaccelerator
 
 import (
diff --git a/internal/service/globalaccelerator/endpoint_group_test.go b/internal/service/globalaccelerator/endpoint_group_test.go
index 2ae4645c2a6..a0fc16c0bbf 100644
--- a/internal/service/globalaccelerator/endpoint_group_test.go
+++ b/internal/service/globalaccelerator/endpoint_group_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package globalaccelerator_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/aws/aws-sdk-go/service/globalaccelerator"
@@ -35,14 +38,14 @@ func TestAccGlobalAcceleratorEndpointGroup_basic(t *testing.T) {
 				Config: testAccEndpointGroupConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckEndpointGroupExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "globalaccelerator", regexp.MustCompile(`accelerator/[^/]+/listener/[^/]+/endpoint-group/[^/]+`)),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "globalaccelerator", regexache.MustCompile(`accelerator/[^/]+/listener/[^/]+/endpoint-group/[^/]+`)),
 					resource.TestCheckResourceAttr(resourceName, "endpoint_configuration.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "endpoint_group_region", acctest.Region()),
 					resource.TestCheckResourceAttr(resourceName, "health_check_interval_seconds", "30"),
 					resource.TestCheckResourceAttr(resourceName, "health_check_path", ""),
 					resource.TestCheckResourceAttr(resourceName, "health_check_port", "80"),
 					resource.TestCheckResourceAttr(resourceName, "health_check_protocol", "TCP"),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "listener_arn", "globalaccelerator", regexp.MustCompile(`accelerator/[^/]+/listener/[^/]+`)),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "listener_arn", "globalaccelerator", regexache.MustCompile(`accelerator/[^/]+/listener/[^/]+`)),
 					resource.TestCheckResourceAttr(resourceName, "port_override.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "threshold_count", "3"),
 					resource.TestCheckResourceAttr(resourceName, "traffic_dial_percentage", "100"),
@@ -100,7 +103,7 @@ func TestAccGlobalAcceleratorEndpointGroup_ALBEndpoint_clientIP(t *testing.T) {
 				Config: testAccEndpointGroupConfig_albClientIP(rName, false, 20),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckEndpointGroupExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "globalaccelerator", regexp.MustCompile(`accelerator/[^/]+/listener/[^/]+/endpoint-group/[^/]+`)),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "globalaccelerator", regexache.MustCompile(`accelerator/[^/]+/listener/[^/]+/endpoint-group/[^/]+`)),
 					resource.TestCheckResourceAttr(resourceName, "endpoint_configuration.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "endpoint_configuration.*", map[string]string{
 						"client_ip_preservation_enabled": "false",
@@ -112,7 +115,7 @@ func TestAccGlobalAcceleratorEndpointGroup_ALBEndpoint_clientIP(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "health_check_path", "/"),
 					resource.TestCheckResourceAttr(resourceName, "health_check_port", "80"),
 					resource.TestCheckResourceAttr(resourceName, "health_check_protocol", "HTTP"),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "listener_arn", "globalaccelerator", regexp.MustCompile(`accelerator/[^/]+/listener/[^/]+`)),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "listener_arn", "globalaccelerator", regexache.MustCompile(`accelerator/[^/]+/listener/[^/]+`)),
 					resource.TestCheckResourceAttr(resourceName, "port_override.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "threshold_count", "3"),
 					resource.TestCheckResourceAttr(resourceName, "traffic_dial_percentage", "100"),
@@ -127,7 +130,7 @@ func TestAccGlobalAcceleratorEndpointGroup_ALBEndpoint_clientIP(t *testing.T) {
 				Config: testAccEndpointGroupConfig_albClientIP(rName, true, 0),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckEndpointGroupExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "globalaccelerator", regexp.MustCompile(`accelerator/[^/]+/listener/[^/]+/endpoint-group/[^/]+`)),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "globalaccelerator", regexache.MustCompile(`accelerator/[^/]+/listener/[^/]+/endpoint-group/[^/]+`)),
 					resource.TestCheckResourceAttr(resourceName, "endpoint_configuration.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "endpoint_configuration.*", map[string]string{
 						"client_ip_preservation_enabled": "true",
@@ -139,7 +142,7 @@ func TestAccGlobalAcceleratorEndpointGroup_ALBEndpoint_clientIP(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "health_check_path", "/"),
 					resource.TestCheckResourceAttr(resourceName, "health_check_port", "80"),
 					resource.TestCheckResourceAttr(resourceName, "health_check_protocol", "HTTP"),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "listener_arn", "globalaccelerator", regexp.MustCompile(`accelerator/[^/]+/listener/[^/]+`)),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "listener_arn", "globalaccelerator", regexache.MustCompile(`accelerator/[^/]+/listener/[^/]+`)),
 					resource.TestCheckResourceAttr(resourceName, "port_override.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "threshold_count", "3"),
 					resource.TestCheckResourceAttr(resourceName, "traffic_dial_percentage", "100"),
@@ -175,7 +178,7 @@ func TestAccGlobalAcceleratorEndpointGroup_instanceEndpoint(t *testing.T) {
 				Config: testAccEndpointGroupConfig_instance(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckEndpointGroupExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "globalaccelerator", regexp.MustCompile(`accelerator/[^/]+/listener/[^/]+/endpoint-group/[^/]+`)),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "globalaccelerator", regexache.MustCompile(`accelerator/[^/]+/listener/[^/]+/endpoint-group/[^/]+`)),
 					resource.TestCheckResourceAttr(resourceName, "endpoint_configuration.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "endpoint_configuration.*", map[string]string{
 						"client_ip_preservation_enabled": "true",
@@ -187,7 +190,7 @@ func TestAccGlobalAcceleratorEndpointGroup_instanceEndpoint(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "health_check_path", "/"),
 					resource.TestCheckResourceAttr(resourceName, "health_check_port", "80"),
 					resource.TestCheckResourceAttr(resourceName, "health_check_protocol", "HTTP"),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "listener_arn", "globalaccelerator", regexp.MustCompile(`accelerator/[^/]+/listener/[^/]+`)),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "listener_arn", "globalaccelerator", regexache.MustCompile(`accelerator/[^/]+/listener/[^/]+`)),
 					resource.TestCheckResourceAttr(resourceName, "port_override.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "threshold_count", "3"),
 					resource.TestCheckResourceAttr(resourceName, "traffic_dial_percentage", "100"),
@@ -226,7 +229,7 @@ func TestAccGlobalAcceleratorEndpointGroup_multiRegion(t *testing.T) {
 				Config: testAccEndpointGroupConfig_multiRegion(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckEndpointGroupExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "globalaccelerator", regexp.MustCompile(`accelerator/[^/]+/listener/[^/]+/endpoint-group/[^/]+`)),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "globalaccelerator", regexache.MustCompile(`accelerator/[^/]+/listener/[^/]+/endpoint-group/[^/]+`)),
 					resource.TestCheckResourceAttr(resourceName, "endpoint_configuration.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "endpoint_configuration.*", map[string]string{
 						"client_ip_preservation_enabled": "false",
@@ -238,7 +241,7 @@ func TestAccGlobalAcceleratorEndpointGroup_multiRegion(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "health_check_path", "/foo"),
 					resource.TestCheckResourceAttr(resourceName, "health_check_port", "8080"),
 					resource.TestCheckResourceAttr(resourceName, "health_check_protocol", "HTTPS"),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "listener_arn", "globalaccelerator", regexp.MustCompile(`accelerator/[^/]+/listener/[^/]+`)),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "listener_arn", "globalaccelerator", regexache.MustCompile(`accelerator/[^/]+/listener/[^/]+`)),
 					resource.TestCheckResourceAttr(resourceName, "port_override.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "threshold_count", "1"),
 					resource.TestCheckResourceAttr(resourceName, "traffic_dial_percentage", "0"),
@@ -269,14 +272,14 @@ func TestAccGlobalAcceleratorEndpointGroup_portOverrides(t *testing.T) {
 				Config: testAccEndpointGroupConfig_portOverrides(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckEndpointGroupExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "globalaccelerator", regexp.MustCompile(`accelerator/[^/]+/listener/[^/]+/endpoint-group/[^/]+`)),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "globalaccelerator", regexache.MustCompile(`accelerator/[^/]+/listener/[^/]+/endpoint-group/[^/]+`)),
 					resource.TestCheckResourceAttr(resourceName, "endpoint_configuration.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "endpoint_group_region", acctest.Region()),
 					resource.TestCheckResourceAttr(resourceName, "health_check_interval_seconds", "30"),
 					resource.TestCheckResourceAttr(resourceName, "health_check_path", ""),
 					resource.TestCheckResourceAttr(resourceName, "health_check_port", "80"),
 					resource.TestCheckResourceAttr(resourceName, "health_check_protocol", "TCP"),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "listener_arn", "globalaccelerator", regexp.MustCompile(`accelerator/[^/]+/listener/[^/]+`)),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "listener_arn", "globalaccelerator", regexache.MustCompile(`accelerator/[^/]+/listener/[^/]+`)),
 					resource.TestCheckResourceAttr(resourceName, "port_override.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "port_override.*", map[string]string{
 						"endpoint_port": "8081",
@@ -290,14 +293,14 @@ func TestAccGlobalAcceleratorEndpointGroup_portOverrides(t *testing.T) {
 				Config: testAccEndpointGroupConfig_portOverridesUpdated(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckEndpointGroupExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "globalaccelerator", regexp.MustCompile(`accelerator/[^/]+/listener/[^/]+/endpoint-group/[^/]+`)),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "globalaccelerator", regexache.MustCompile(`accelerator/[^/]+/listener/[^/]+/endpoint-group/[^/]+`)),
 					resource.TestCheckResourceAttr(resourceName, "endpoint_configuration.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "endpoint_group_region", acctest.Region()),
 					resource.TestCheckResourceAttr(resourceName, "health_check_interval_seconds", "30"),
 					resource.TestCheckResourceAttr(resourceName, "health_check_path", ""),
 					resource.TestCheckResourceAttr(resourceName, "health_check_port", "80"),
 					resource.TestCheckResourceAttr(resourceName, "health_check_protocol", "TCP"),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "listener_arn", "globalaccelerator", regexp.MustCompile(`accelerator/[^/]+/listener/[^/]+`)),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "listener_arn", "globalaccelerator", regexache.MustCompile(`accelerator/[^/]+/listener/[^/]+`)),
 					resource.TestCheckResourceAttr(resourceName, "port_override.#", "2"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "port_override.*", map[string]string{
 						"endpoint_port": "8081",
@@ -337,7 +340,7 @@ func TestAccGlobalAcceleratorEndpointGroup_tcpHealthCheckProtocol(t *testing.T)
 				Config: testAccEndpointGroupConfig_tcpHealthCheckProtocol(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckEndpointGroupExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "globalaccelerator", regexp.MustCompile(`accelerator/[^/]+/listener/[^/]+/endpoint-group/[^/]+`)),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "globalaccelerator", regexache.MustCompile(`accelerator/[^/]+/listener/[^/]+/endpoint-group/[^/]+`)),
 					resource.TestCheckResourceAttr(resourceName, "endpoint_configuration.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "endpoint_configuration.*", map[string]string{
 						"client_ip_preservation_enabled": "false",
@@ -349,7 +352,7 @@ func TestAccGlobalAcceleratorEndpointGroup_tcpHealthCheckProtocol(t *testing.T)
 					resource.TestCheckResourceAttr(resourceName, "health_check_interval_seconds", "30"),
 					resource.TestCheckResourceAttr(resourceName, "health_check_port", "1234"),
 					resource.TestCheckResourceAttr(resourceName, "health_check_protocol", "TCP"),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "listener_arn", "globalaccelerator", regexp.MustCompile(`accelerator/[^/]+/listener/[^/]+`)),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "listener_arn", "globalaccelerator", regexache.MustCompile(`accelerator/[^/]+/listener/[^/]+`)),
 					resource.TestCheckResourceAttr(resourceName, "port_override.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "threshold_count", "3"),
 					resource.TestCheckResourceAttr(resourceName, "traffic_dial_percentage", "100"),
@@ -381,14 +384,14 @@ func TestAccGlobalAcceleratorEndpointGroup_update(t *testing.T) {
 				Config: testAccEndpointGroupConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckEndpointGroupExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "globalaccelerator", regexp.MustCompile(`accelerator/[^/]+/listener/[^/]+/endpoint-group/[^/]+`)),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "globalaccelerator", regexache.MustCompile(`accelerator/[^/]+/listener/[^/]+/endpoint-group/[^/]+`)),
 					resource.TestCheckResourceAttr(resourceName, "endpoint_configuration.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "endpoint_group_region", acctest.Region()),
 					resource.TestCheckResourceAttr(resourceName, "health_check_interval_seconds", "30"),
 					resource.TestCheckResourceAttr(resourceName, "health_check_path", ""),
 					resource.TestCheckResourceAttr(resourceName, "health_check_port", "80"),
 					resource.TestCheckResourceAttr(resourceName, "health_check_protocol", "TCP"),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "listener_arn", "globalaccelerator", regexp.MustCompile(`accelerator/[^/]+/listener/[^/]+`)),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "listener_arn", "globalaccelerator", regexache.MustCompile(`accelerator/[^/]+/listener/[^/]+`)),
 					resource.TestCheckResourceAttr(resourceName, "port_override.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "threshold_count", "3"),
 					resource.TestCheckResourceAttr(resourceName, "traffic_dial_percentage", "100"),
@@ -398,7 +401,7 @@ func TestAccGlobalAcceleratorEndpointGroup_update(t *testing.T) {
 				Config: testAccEndpointGroupConfig_updated(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckEndpointGroupExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "globalaccelerator", regexp.MustCompile(`accelerator/[^/]+/listener/[^/]+/endpoint-group/[^/]+`)),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "globalaccelerator", regexache.MustCompile(`accelerator/[^/]+/listener/[^/]+/endpoint-group/[^/]+`)),
 					resource.TestCheckResourceAttr(resourceName, "endpoint_configuration.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "endpoint_configuration.*", map[string]string{
 						"client_ip_preservation_enabled": "false",
@@ -410,7 +413,7 @@ func TestAccGlobalAcceleratorEndpointGroup_update(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "health_check_path", "/foo"),
 					resource.TestCheckResourceAttr(resourceName, "health_check_port", "8080"),
 					resource.TestCheckResourceAttr(resourceName, "health_check_protocol", "HTTPS"),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "listener_arn", "globalaccelerator", regexp.MustCompile(`accelerator/[^/]+/listener/[^/]+`)),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "listener_arn", "globalaccelerator", regexache.MustCompile(`accelerator/[^/]+/listener/[^/]+`)),
 					resource.TestCheckResourceAttr(resourceName, "port_override.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "threshold_count", "1"),
 					resource.TestCheckResourceAttr(resourceName, "traffic_dial_percentage", "0"),
diff --git a/internal/service/globalaccelerator/generate.go b/internal/service/globalaccelerator/generate.go
index 30543ae76de..e3f90ea20bd 100644
--- a/internal/service/globalaccelerator/generate.go
+++ b/internal/service/globalaccelerator/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTags -ServiceTagsSlice -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/globalaccelerator/listener.go b/internal/service/globalaccelerator/listener.go
index e918c784e6b..e40aff79b5e 100644
--- a/internal/service/globalaccelerator/listener.go
+++ b/internal/service/globalaccelerator/listener.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package globalaccelerator
 
 import (
diff --git a/internal/service/globalaccelerator/listener_test.go b/internal/service/globalaccelerator/listener_test.go
index 411718ba9bd..d4534469271 100644
--- a/internal/service/globalaccelerator/listener_test.go
+++ b/internal/service/globalaccelerator/listener_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package globalaccelerator_test
 
 import (
diff --git a/internal/service/globalaccelerator/service_package.go b/internal/service/globalaccelerator/service_package.go
index 89d58389baf..4126e265623 100644
--- a/internal/service/globalaccelerator/service_package.go
+++ b/internal/service/globalaccelerator/service_package.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package globalaccelerator
 
 import (
diff --git a/internal/service/globalaccelerator/service_package_gen.go b/internal/service/globalaccelerator/service_package_gen.go
index 4dc8fca71e4..ee841fd98c6 100644
--- a/internal/service/globalaccelerator/service_package_gen.go
+++ b/internal/service/globalaccelerator/service_package_gen.go
@@ -5,6 +5,7 @@ package globalaccelerator
 import (
 	"context"
 
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -73,4 +74,6 @@ func (p *servicePackage) ServicePackageName() string {
 	return names.GlobalAccelerator
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/globalaccelerator/sweep.go b/internal/service/globalaccelerator/sweep.go
index ec00e247ae4..5a82f7406b0 100644
--- a/internal/service/globalaccelerator/sweep.go
+++ b/internal/service/globalaccelerator/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package globalaccelerator
 
@@ -12,9 +12,10 @@ import (
 	multierror "github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_globalaccelerator_accelerator", &resource.Sweeper{
 		Name: "aws_globalaccelerator_accelerator",
 		F:    sweepAccelerators,
@@ -60,7 +61,7 @@ func init() {
 
 func sweepAccelerators(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -84,7 +85,7 @@ func sweepAccelerators(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Global Accelerator Accelerator sweep for %s: %s", region, err)
 		return nil
 	}
@@ -93,7 +94,7 @@ func sweepAccelerators(region string) error {
 		return fmt.Errorf("error listing Global Accelerator Accelerators (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping Global Accelerator Accelerators (%s): %w", region, err)
@@ -104,7 +105,7 @@ func sweepAccelerators(region string) error {
 
 func sweepEndpointGroups(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -149,7 +150,7 @@ func sweepEndpointGroups(region string) error {
 						return !lastPage
 					})
 
-					if sweep.SkipSweepError(err) {
+					if awsv1.SkipSweepError(err) {
 						continue
 					}
 
@@ -161,7 +162,7 @@ func sweepEndpointGroups(region string) error {
 				return !lastPage
 			})
 
-			if sweep.SkipSweepError(err) {
+			if awsv1.SkipSweepError(err) {
 				continue
 			}
 
@@ -173,7 +174,7 @@ func sweepEndpointGroups(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Global Accelerator Endpoint Group sweep for %s: %s", region, err)
 		return sweeperErrs.ErrorOrNil() // In case we have completed some pages, but had errors
 	}
@@ -182,7 +183,7 @@ func sweepEndpointGroups(region string) error {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error listing Global Accelerator Accelerators (%s): %w", region, err))
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error sweeping Global Accelerator Endpoint Groups (%s): %w", region, err))
@@ -193,7 +194,7 @@ func sweepEndpointGroups(region string) error {
 
 func sweepListeners(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -228,7 +229,7 @@ func sweepListeners(region string) error {
 				return !lastPage
 			})
 
-			if sweep.SkipSweepError(err) {
+			if awsv1.SkipSweepError(err) {
 				continue
 			}
 
@@ -240,7 +241,7 @@ func sweepListeners(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Global Accelerator Listener sweep for %s: %s", region, err)
 		return sweeperErrs.ErrorOrNil() // In case we have completed some pages, but had errors
 	}
@@ -249,7 +250,7 @@ func sweepListeners(region string) error {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error listing Global Accelerator Accelerators (%s): %w", region, err))
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error sweeping Global Accelerator Listeners (%s): %w", region, err))
@@ -260,7 +261,7 @@ func sweepListeners(region string) error {
 
 func sweepCustomRoutingAccelerators(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -284,7 +285,7 @@ func sweepCustomRoutingAccelerators(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Global Accelerator Custom Routing Accelerator sweep for %s: %s", region, err)
 		return nil
 	}
@@ -293,7 +294,7 @@ func sweepCustomRoutingAccelerators(region string) error {
 		return fmt.Errorf("error listing Global Accelerator Custom Routing Accelerators (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping Global Accelerator Custom Routing Accelerators (%s): %w", region, err)
@@ -304,7 +305,7 @@ func sweepCustomRoutingAccelerators(region string) error {
 
 func sweepCustomRoutingEndpointGroups(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -349,7 +350,7 @@ func sweepCustomRoutingEndpointGroups(region string) error {
 						return !lastPage
 					})
 
-					if sweep.SkipSweepError(err) {
+					if awsv1.SkipSweepError(err) {
 						continue
 					}
 
@@ -361,7 +362,7 @@ func sweepCustomRoutingEndpointGroups(region string) error {
 				return !lastPage
 			})
 
-			if sweep.SkipSweepError(err) {
+			if awsv1.SkipSweepError(err) {
 				continue
 			}
 
@@ -373,7 +374,7 @@ func sweepCustomRoutingEndpointGroups(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Global AcceleratorCustom Routing Endpoint Group sweep for %s: %s", region, err)
 		return sweeperErrs.ErrorOrNil() // In case we have completed some pages, but had errors
 	}
@@ -382,7 +383,7 @@ func sweepCustomRoutingEndpointGroups(region string) error {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error listing Global Accelerator Custom Routing Accelerators (%s): %w", region, err))
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error sweeping Global Accelerator Custom Routing Endpoint Groups (%s): %w", region, err))
@@ -393,7 +394,7 @@ func sweepCustomRoutingEndpointGroups(region string) error {
 
 func sweepCustomRoutingListeners(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -428,7 +429,7 @@ func sweepCustomRoutingListeners(region string) error {
 				return !lastPage
 			})
 
-			if sweep.SkipSweepError(err) {
+			if awsv1.SkipSweepError(err) {
 				continue
 			}
 
@@ -440,7 +441,7 @@ func sweepCustomRoutingListeners(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Global Accelerator Custom Routing Listener sweep for %s: %s", region, err)
 		return sweeperErrs.ErrorOrNil() // In case we have completed some pages, but had errors
 	}
@@ -449,7 +450,7 @@ func sweepCustomRoutingListeners(region string) error {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error listing Global Accelerator Custom Routing Accelerators (%s): %w", region, err))
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error sweeping Global Accelerator Custom Routing Listeners (%s): %w", region, err))
diff --git a/internal/service/globalaccelerator/tags_gen.go b/internal/service/globalaccelerator/tags_gen.go
index 3bb574c9203..a388d484249 100644
--- a/internal/service/globalaccelerator/tags_gen.go
+++ b/internal/service/globalaccelerator/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/globalaccelerator"
 	"github.com/aws/aws-sdk-go/service/globalaccelerator/globalacceleratoriface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -102,6 +104,8 @@ func updateTags(ctx context.Context, conn globalacceleratoriface.GlobalAccelerat
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.GlobalAccelerator)
 	if len(removedTags) > 0 {
diff --git a/internal/service/glue/catalog_database.go b/internal/service/glue/catalog_database.go
index 44d2e9fd0bd..53c23ba9feb 100644
--- a/internal/service/glue/catalog_database.go
+++ b/internal/service/glue/catalog_database.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package glue
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"strings"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/aws/aws-sdk-go/service/glue"
@@ -52,7 +55,7 @@ func ResourceCatalogDatabase() *schema.Resource {
 				Required: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 255),
-					validation.StringDoesNotMatch(regexp.MustCompile(`[A-Z]`), "uppercase characters cannot be used"),
+					validation.StringDoesNotMatch(regexache.MustCompile(`[A-Z]`), "uppercase characters cannot be used"),
 				),
 			},
 			"create_table_default_permission": {
@@ -118,6 +121,10 @@ func ResourceCatalogDatabase() *schema.Resource {
 							Type:     schema.TypeString,
 							Required: true,
 						},
+						"region": {
+							Type:     schema.TypeString,
+							Optional: true,
+						},
 					},
 				},
 			},
@@ -314,6 +321,10 @@ func expandDatabaseTargetDatabase(tfMap map[string]interface{}) *glue.DatabaseId
 		apiObject.DatabaseName = aws.String(v)
 	}
 
+	if v, ok := tfMap["region"].(string); ok && v != "" {
+		apiObject.Region = aws.String(v)
+	}
+
 	return apiObject
 }
 
@@ -332,6 +343,10 @@ func flattenDatabaseTargetDatabase(apiObject *glue.DatabaseIdentifier) map[strin
 		tfMap["database_name"] = aws.StringValue(v)
 	}
 
+	if v := apiObject.Region; v != nil {
+		tfMap["region"] = aws.StringValue(v)
+	}
+
 	return tfMap
 }
 
diff --git a/internal/service/glue/catalog_database_test.go b/internal/service/glue/catalog_database_test.go
index a678ac50ba8..7a824c17bad 100644
--- a/internal/service/glue/catalog_database_test.go
+++ b/internal/service/glue/catalog_database_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package glue_test
 
 import (
@@ -6,6 +9,7 @@ import (
 	"testing"
 
 	"github.com/aws/aws-sdk-go/service/glue"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
@@ -135,6 +139,7 @@ func TestAccGlueCatalogDatabase_targetDatabase(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "target_database.#", "1"),
 					resource.TestCheckResourceAttrPair(resourceName, "target_database.0.catalog_id", "aws_glue_catalog_database.test2", "catalog_id"),
 					resource.TestCheckResourceAttrPair(resourceName, "target_database.0.database_name", "aws_glue_catalog_database.test2", "name"),
+					resource.TestCheckResourceAttr(resourceName, "target_database.0.region", ""),
 				),
 			},
 			{
@@ -150,8 +155,41 @@ func TestAccGlueCatalogDatabase_targetDatabase(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "target_database.#", "1"),
 					resource.TestCheckResourceAttrPair(resourceName, "target_database.0.catalog_id", "aws_glue_catalog_database.test2", "catalog_id"),
 					resource.TestCheckResourceAttrPair(resourceName, "target_database.0.database_name", "aws_glue_catalog_database.test2", "name"),
+					resource.TestCheckResourceAttr(resourceName, "target_database.0.region", ""),
+				),
+			},
+		},
+	})
+}
+
+func TestAccGlueCatalogDatabase_targetDatabaseWithRegion(t *testing.T) {
+	ctx := acctest.Context(t)
+	var providers []*schema.Provider
+	resourceName := "aws_glue_catalog_database.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckMultipleRegion(t, 2) },
+		ErrorCheck:               acctest.ErrorCheck(t, glue.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5FactoriesPlusProvidersAlternate(ctx, t, &providers),
+		CheckDestroy:             testAccCheckDatabaseDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config:  testAccCatalogDatabaseConfig_targetWithRegion(rName),
+				Destroy: false,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckCatalogDatabaseExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "target_database.#", "1"),
+					resource.TestCheckResourceAttrPair(resourceName, "target_database.0.catalog_id", "aws_glue_catalog_database.test2", "catalog_id"),
+					resource.TestCheckResourceAttrPair(resourceName, "target_database.0.database_name", "aws_glue_catalog_database.test2", "name"),
+					resource.TestCheckResourceAttr(resourceName, "target_database.0.region", acctest.AlternateRegion()),
 				),
 			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
 		},
 	})
 }
@@ -317,6 +355,26 @@ resource "aws_glue_catalog_database" "test2" {
 `, rName)
 }
 
+func testAccCatalogDatabaseConfig_targetWithRegion(rName string) string {
+	return acctest.ConfigCompose(acctest.ConfigAlternateRegionProvider(), fmt.Sprintf(`
+resource "aws_glue_catalog_database" "test" {
+  name = %[1]q
+
+  target_database {
+    catalog_id    = aws_glue_catalog_database.test2.catalog_id
+    database_name = aws_glue_catalog_database.test2.name
+    region        = %[2]q
+  }
+}
+
+resource "aws_glue_catalog_database" "test2" {
+  provider = "awsalternate"
+
+  name = "%[1]s-2"
+}
+`, rName, acctest.AlternateRegion()))
+}
+
 func testAccCatalogDatabaseConfig_permission(rName, permission string) string {
 	return fmt.Sprintf(`
 resource "aws_glue_catalog_database" "test" {
diff --git a/internal/service/glue/catalog_table.go b/internal/service/glue/catalog_table.go
index b43b7ab2d12..7933d91e4f0 100644
--- a/internal/service/glue/catalog_table.go
+++ b/internal/service/glue/catalog_table.go
@@ -1,22 +1,27 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package glue
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"strings"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/aws/aws-sdk-go/service/glue"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
 	"github.com/hashicorp/terraform-provider-aws/internal/flex"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
 )
 
@@ -58,7 +63,7 @@ func ResourceCatalogTable() *schema.Resource {
 				Required: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 255),
-					validation.StringDoesNotMatch(regexp.MustCompile(`[A-Z]`), "uppercase characters cannot be used"),
+					validation.StringDoesNotMatch(regexache.MustCompile(`[A-Z]`), "uppercase characters cannot be used"),
 				),
 			},
 			"owner": {
@@ -290,6 +295,34 @@ func ResourceCatalogTable() *schema.Resource {
 				Type:     schema.TypeString,
 				Optional: true,
 			},
+			"open_table_format_input": {
+				Type:     schema.TypeList,
+				Optional: true,
+				MaxItems: 1,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"iceberg_input": {
+							Type:     schema.TypeList,
+							Required: true,
+							MaxItems: 1,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"metadata_operation": {
+										Type:         schema.TypeString,
+										Required:     true,
+										ValidateFunc: validation.StringInSlice([]string{"CREATE"}, false),
+									},
+									"version": {
+										Type:         schema.TypeString,
+										Optional:     true,
+										ValidateFunc: validation.StringLenBetween(1, 255),
+									},
+								},
+							},
+						},
+					},
+				},
+			},
 			"target_table": {
 				Type:     schema.TypeList,
 				Optional: true,
@@ -368,10 +401,11 @@ func resourceCatalogTableCreate(ctx context.Context, d *schema.ResourceData, met
 	name := d.Get("name").(string)
 
 	input := &glue.CreateTableInput{
-		CatalogId:        aws.String(catalogID),
-		DatabaseName:     aws.String(dbName),
-		TableInput:       expandTableInput(d),
-		PartitionIndexes: expandTablePartitionIndexes(d.Get("partition_index").([]interface{})),
+		CatalogId:            aws.String(catalogID),
+		DatabaseName:         aws.String(dbName),
+		OpenTableFormatInput: expandOpenTableFormat(d),
+		TableInput:           expandTableInput(d),
+		PartitionIndexes:     expandTablePartitionIndexes(d.Get("partition_index").([]interface{})),
 	}
 
 	_, err := conn.CreateTableWithContext(ctx, input)
@@ -390,21 +424,21 @@ func resourceCatalogTableRead(ctx context.Context, d *schema.ResourceData, meta
 
 	catalogID, dbName, name, err := ReadTableID(d.Id())
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "reading Glue Catalog Table (%s): %s", d.Id(), err)
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
-	out, err := FindTableByName(ctx, conn, catalogID, dbName, name)
-	if err != nil {
-		if tfawserr.ErrCodeEquals(err, glue.ErrCodeEntityNotFoundException) {
-			log.Printf("[WARN] Glue Catalog Table (%s) not found, removing from state", d.Id())
-			d.SetId("")
-			return diags
-		}
+	table, err := FindTableByName(ctx, conn, catalogID, dbName, name)
 
+	if !d.IsNewResource() && tfresource.NotFound(err) {
+		log.Printf("[WARN] Glue Catalog Table (%s) not found, removing from state", d.Id())
+		d.SetId("")
+		return diags
+	}
+
+	if err != nil {
 		return sdkdiag.AppendErrorf(diags, "reading Glue Catalog Table (%s): %s", d.Id(), err)
 	}
 
-	table := out.Table
 	tableArn := arn.ARN{
 		Partition: meta.(*conns.AWSClient).Partition,
 		Service:   "glue",
@@ -413,11 +447,10 @@ func resourceCatalogTableRead(ctx context.Context, d *schema.ResourceData, meta
 		Resource:  fmt.Sprintf("table/%s/%s", dbName, aws.StringValue(table.Name)),
 	}.String()
 	d.Set("arn", tableArn)
-
-	d.Set("name", table.Name)
 	d.Set("catalog_id", catalogID)
 	d.Set("database_name", dbName)
 	d.Set("description", table.Description)
+	d.Set("name", table.Name)
 	d.Set("owner", table.Owner)
 	d.Set("retention", table.Retention)
 
@@ -433,7 +466,7 @@ func resourceCatalogTableRead(ctx context.Context, d *schema.ResourceData, meta
 	d.Set("view_expanded_text", table.ViewExpandedText)
 	d.Set("table_type", table.TableType)
 
-	if err := d.Set("parameters", aws.StringValueMap(table.Parameters)); err != nil {
+	if err := d.Set("parameters", flattenNonManagedParameters(table)); err != nil {
 		return sdkdiag.AppendErrorf(diags, "setting parameters: %s", err)
 	}
 
@@ -445,18 +478,20 @@ func resourceCatalogTableRead(ctx context.Context, d *schema.ResourceData, meta
 		d.Set("target_table", nil)
 	}
 
-	partIndexInput := &glue.GetPartitionIndexesInput{
-		CatalogId:    out.Table.CatalogId,
-		TableName:    out.Table.Name,
-		DatabaseName: out.Table.DatabaseName,
+	input := &glue.GetPartitionIndexesInput{
+		CatalogId:    aws.String(catalogID),
+		DatabaseName: aws.String(dbName),
+		TableName:    aws.String(name),
 	}
-	partOut, err := conn.GetPartitionIndexesWithContext(ctx, partIndexInput)
+
+	output, err := conn.GetPartitionIndexesWithContext(ctx, input)
+
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "getting Glue Partition Indexes: %s", err)
+		return sdkdiag.AppendErrorf(diags, "reading Glue Catalog Table (%s) partition indexes: %s", d.Id(), err)
 	}
 
-	if partOut != nil && len(partOut.PartitionIndexDescriptorList) > 0 {
-		if err := d.Set("partition_index", flattenPartitionIndexes(partOut.PartitionIndexDescriptorList)); err != nil {
+	if output != nil && len(output.PartitionIndexDescriptorList) > 0 {
+		if err := d.Set("partition_index", flattenPartitionIndexes(output.PartitionIndexDescriptorList)); err != nil {
 			return sdkdiag.AppendErrorf(diags, "setting partition_index: %s", err)
 		}
 	}
@@ -468,18 +503,38 @@ func resourceCatalogTableUpdate(ctx context.Context, d *schema.ResourceData, met
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).GlueConn(ctx)
 
-	catalogID, dbName, _, err := ReadTableID(d.Id())
+	catalogID, dbName, name, err := ReadTableID(d.Id())
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "updating Glue Catalog Table (%s): %s", d.Id(), err)
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
-	updateTableInput := &glue.UpdateTableInput{
+	input := &glue.UpdateTableInput{
 		CatalogId:    aws.String(catalogID),
 		DatabaseName: aws.String(dbName),
 		TableInput:   expandTableInput(d),
 	}
 
-	if _, err := conn.UpdateTableWithContext(ctx, updateTableInput); err != nil {
+	// Add back any managed parameters. See flattenNonManagedParameters.
+	table, err := FindTableByName(ctx, conn, catalogID, dbName, name)
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "reading Glue Catalog Table (%s): %s", d.Id(), err)
+	}
+
+	if allParameters := aws.StringValueMap(table.Parameters); allParameters["table_type"] == "ICEBERG" {
+		for _, k := range []string{"table_type", "metadata_location"} {
+			if v := allParameters[k]; v != "" {
+				if input.TableInput.Parameters == nil {
+					input.TableInput.Parameters = make(map[string]*string)
+				}
+				input.TableInput.Parameters[k] = aws.String(v)
+			}
+		}
+	}
+
+	_, err = conn.UpdateTableWithContext(ctx, input)
+
+	if err != nil {
 		return sdkdiag.AppendErrorf(diags, "updating Glue Catalog Table (%s): %s", d.Id(), err)
 	}
 
@@ -492,24 +547,54 @@ func resourceCatalogTableDelete(ctx context.Context, d *schema.ResourceData, met
 
 	catalogID, dbName, name, err := ReadTableID(d.Id())
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "deleting Glue Catalog Table (%s): %s", d.Id(), err)
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
-	log.Printf("[DEBUG] Glue Catalog Table: %s:%s:%s", catalogID, dbName, name)
+	log.Printf("[DEBUG] Deleting Glue Catalog Table: %s", d.Id())
 	_, err = conn.DeleteTableWithContext(ctx, &glue.DeleteTableInput{
 		CatalogId:    aws.String(catalogID),
 		Name:         aws.String(name),
 		DatabaseName: aws.String(dbName),
 	})
+
+	if tfawserr.ErrCodeEquals(err, glue.ErrCodeEntityNotFoundException) {
+		return diags
+	}
+
 	if err != nil {
-		if tfawserr.ErrCodeEquals(err, glue.ErrCodeEntityNotFoundException) {
-			return diags
-		}
 		return sdkdiag.AppendErrorf(diags, "deleting Glue Catalog Table (%s): %s", d.Id(), err)
 	}
+
 	return diags
 }
 
+func FindTableByName(ctx context.Context, conn *glue.Glue, catalogID, dbName, name string) (*glue.TableData, error) {
+	input := &glue.GetTableInput{
+		CatalogId:    aws.String(catalogID),
+		DatabaseName: aws.String(dbName),
+		Name:         aws.String(name),
+	}
+
+	output, err := conn.GetTableWithContext(ctx, input)
+
+	if tfawserr.ErrCodeEquals(err, glue.ErrCodeEntityNotFoundException) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	if output == nil || output.Table == nil {
+		return nil, tfresource.NewEmptyResultError(input)
+	}
+
+	return output.Table, nil
+}
+
 func expandTableInput(d *schema.ResourceData) *glue.TableInput {
 	tableInput := &glue.TableInput{
 		Name: aws.String(d.Get("name").(string)),
@@ -533,7 +618,7 @@ func expandTableInput(d *schema.ResourceData) *glue.TableInput {
 
 	if v, ok := d.GetOk("partition_keys"); ok {
 		tableInput.PartitionKeys = expandColumns(v.([]interface{}))
-	} else {
+	} else if _, ok = d.GetOk("open_table_format_input"); !ok {
 		tableInput.PartitionKeys = []*glue.Column{}
 	}
 
@@ -560,6 +645,27 @@ func expandTableInput(d *schema.ResourceData) *glue.TableInput {
 	return tableInput
 }
 
+func expandOpenTableFormat(s *schema.ResourceData) *glue.OpenTableFormatInput_ {
+	if v, ok := s.GetOk("open_table_format_input"); ok {
+		openTableFormatInput := &glue.OpenTableFormatInput_{
+			IcebergInput: expandIcebergInput(v.([]interface{})[0].(map[string]interface{})),
+		}
+		return openTableFormatInput
+	}
+	return nil
+}
+
+func expandIcebergInput(s map[string]interface{}) *glue.IcebergInput_ {
+	var iceberg = s["iceberg_input"].([]interface{})[0].(map[string]interface{})
+	icebergInput := &glue.IcebergInput_{
+		MetadataOperation: aws.String(iceberg["metadata_operation"].(string)),
+	}
+	if v, ok := iceberg["version"].(string); ok && v != "" {
+		icebergInput.Version = aws.String(v)
+	}
+	return icebergInput
+}
+
 func expandTablePartitionIndexes(a []interface{}) []*glue.PartitionIndex {
 	partitionIndexes := make([]*glue.PartitionIndex, 0, len(a))
 
@@ -1037,3 +1143,12 @@ func flattenTableTargetTable(apiObject *glue.TableIdentifier) map[string]interfa
 
 	return tfMap
 }
+
+func flattenNonManagedParameters(table *glue.TableData) map[string]string {
+	allParameters := table.Parameters
+	if aws.StringValue(allParameters["table_type"]) == "ICEBERG" {
+		delete(allParameters, "table_type")
+		delete(allParameters, "metadata_location")
+	}
+	return aws.StringValueMap(allParameters)
+}
diff --git a/internal/service/glue/catalog_table_data_source.go b/internal/service/glue/catalog_table_data_source.go
index b0c7ebbb801..01fb4d29d75 100644
--- a/internal/service/glue/catalog_table_data_source.go
+++ b/internal/service/glue/catalog_table_data_source.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package glue
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/aws/aws-sdk-go/service/glue"
@@ -44,7 +47,7 @@ func DataSourceCatalogTable() *schema.Resource {
 				Required: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 255),
-					validation.StringDoesNotMatch(regexp.MustCompile(`[A-Z]`), "uppercase characters cannot be used"),
+					validation.StringDoesNotMatch(regexache.MustCompile(`[A-Z]`), "uppercase characters cannot be used"),
 				),
 			},
 			"owner": {
diff --git a/internal/service/glue/catalog_table_data_source_test.go b/internal/service/glue/catalog_table_data_source_test.go
index 681af5eaa94..17563394bc6 100644
--- a/internal/service/glue/catalog_table_data_source_test.go
+++ b/internal/service/glue/catalog_table_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package glue_test
 
 import (
diff --git a/internal/service/glue/catalog_table_test.go b/internal/service/glue/catalog_table_test.go
index 88bc7d35532..f6daa12a853 100644
--- a/internal/service/glue/catalog_table_test.go
+++ b/internal/service/glue/catalog_table_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package glue_test
 
 import (
@@ -5,15 +8,14 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/glue"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	tfglue "github.com/hashicorp/terraform-provider-aws/internal/service/glue"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
 func init() {
@@ -679,6 +681,49 @@ func TestAccGlueCatalogTable_disappears(t *testing.T) {
 	})
 }
 
+func TestAccGlueCatalogTable_openTableFormat(t *testing.T) {
+	ctx := acctest.Context(t)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_glue_catalog_table.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, glue.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckTableDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config:  testAccCatalogTableConfig_openTableFormat(rName, "comment1"),
+				Destroy: false,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckCatalogTableExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "open_table_format_input.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "open_table_format_input.0.iceberg_input.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "open_table_format_input.0.iceberg_input.0.metadata_operation", "CREATE"),
+					resource.TestCheckResourceAttr(resourceName, "open_table_format_input.0.iceberg_input.0.version", "2"),
+				),
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"open_table_format_input"},
+			},
+			{
+				Config:  testAccCatalogTableConfig_openTableFormat(rName, "comment2"),
+				Destroy: false,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckCatalogTableExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "open_table_format_input.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "open_table_format_input.0.iceberg_input.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "open_table_format_input.0.iceberg_input.0.metadata_operation", "CREATE"),
+					resource.TestCheckResourceAttr(resourceName, "open_table_format_input.0.iceberg_input.0.version", "2"),
+				),
+			},
+		},
+	})
+}
+
 func testAccCatalogTableConfig_basic(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_glue_catalog_database" "test" {
@@ -1133,57 +1178,45 @@ func testAccCheckTableDestroy(ctx context.Context) resource.TestCheckFunc {
 				continue
 			}
 
-			catalogId, dbName, resourceName, err := tfglue.ReadTableID(rs.Primary.ID)
+			catalogID, dbName, name, err := tfglue.ReadTableID(rs.Primary.ID)
 			if err != nil {
 				return err
 			}
 
-			if _, err := tfglue.FindTableByName(ctx, conn, catalogId, dbName, resourceName); err != nil {
-				//Verify the error is what we want
-				if tfawserr.ErrCodeEquals(err, glue.ErrCodeEntityNotFoundException) {
-					continue
-				}
+			_, err = tfglue.FindTableByName(ctx, conn, catalogID, dbName, name)
 
+			if tfresource.NotFound(err) {
+				continue
+			}
+
+			if err != nil {
 				return err
 			}
-			return fmt.Errorf("still exists")
+
+			return fmt.Errorf("Glue Catalog Table %s still exists", rs.Primary.ID)
 		}
+
 		return nil
 	}
 }
 
-func testAccCheckCatalogTableExists(ctx context.Context, name string) resource.TestCheckFunc {
+func testAccCheckCatalogTableExists(ctx context.Context, n string) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		rs, ok := s.RootModule().Resources[name]
+		rs, ok := s.RootModule().Resources[n]
 		if !ok {
-			return fmt.Errorf("Not found: %s", name)
-		}
-
-		if rs.Primary.ID == "" {
-			return fmt.Errorf("No ID is set")
+			return fmt.Errorf("Not found: %s", n)
 		}
 
-		catalogId, dbName, resourceName, err := tfglue.ReadTableID(rs.Primary.ID)
+		catalogID, dbName, name, err := tfglue.ReadTableID(rs.Primary.ID)
 		if err != nil {
 			return err
 		}
 
 		conn := acctest.Provider.Meta().(*conns.AWSClient).GlueConn(ctx)
-		out, err := tfglue.FindTableByName(ctx, conn, catalogId, dbName, resourceName)
-		if err != nil {
-			return err
-		}
 
-		if out.Table == nil {
-			return fmt.Errorf("No Glue Table Found")
-		}
+		_, err = tfglue.FindTableByName(ctx, conn, catalogID, dbName, name)
 
-		if aws.StringValue(out.Table.Name) != resourceName {
-			return fmt.Errorf("Glue Table Mismatch - existing: %q, state: %q",
-				aws.StringValue(out.Table.Name), resourceName)
-		}
-
-		return nil
+		return err
 	}
 }
 
@@ -1407,3 +1440,45 @@ resource "aws_glue_catalog_table" "test2" {
 }
 `, rName)
 }
+
+func testAccCatalogTableConfig_openTableFormat(rName, columnComment string) string {
+	return fmt.Sprintf(`
+resource "aws_glue_catalog_database" "test" {
+  name = %[1]q
+}
+
+resource "aws_s3_bucket" "bucket" {
+  bucket        = %[1]q
+  force_destroy = true
+}
+
+resource "aws_glue_catalog_table" "test" {
+  database_name = aws_glue_catalog_database.test.name
+  name          = %[1]q
+  table_type    = "EXTERNAL_TABLE"
+
+  open_table_format_input {
+    iceberg_input {
+      metadata_operation = "CREATE"
+      version            = 2
+    }
+  }
+
+  storage_descriptor {
+    location = "s3://%[1]s/files/"
+
+    columns {
+      name    = "my_column_1"
+      type    = "int"
+      comment = %[2]q
+    }
+
+    columns {
+      name    = "my_column_2"
+      type    = "string"
+      comment = %[2]q
+    }
+  }
+}
+`, rName, columnComment)
+}
diff --git a/internal/service/glue/classifier.go b/internal/service/glue/classifier.go
index a5be407efcf..0c501929954 100644
--- a/internal/service/glue/classifier.go
+++ b/internal/service/glue/classifier.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package glue
 
 import (
diff --git a/internal/service/glue/classifier_test.go b/internal/service/glue/classifier_test.go
index 18e9ba47540..e016a079f2e 100644
--- a/internal/service/glue/classifier_test.go
+++ b/internal/service/glue/classifier_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package glue_test
 
 import (
diff --git a/internal/service/glue/connection.go b/internal/service/glue/connection.go
index 244981bd67a..cb934e2511a 100644
--- a/internal/service/glue/connection.go
+++ b/internal/service/glue/connection.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package glue
 
 import (
diff --git a/internal/service/glue/connection_data_source.go b/internal/service/glue/connection_data_source.go
index eca01237dbe..1dfc5264b36 100644
--- a/internal/service/glue/connection_data_source.go
+++ b/internal/service/glue/connection_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package glue
 
 import (
diff --git a/internal/service/glue/connection_data_source_test.go b/internal/service/glue/connection_data_source_test.go
index 6fd42a02586..9664f8b3038 100644
--- a/internal/service/glue/connection_data_source_test.go
+++ b/internal/service/glue/connection_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package glue_test
 
 import (
diff --git a/internal/service/glue/connection_test.go b/internal/service/glue/connection_test.go
index a34a24327a8..c7c1e5b1344 100644
--- a/internal/service/glue/connection_test.go
+++ b/internal/service/glue/connection_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package glue_test
 
 import (
@@ -537,23 +540,34 @@ resource "aws_db_subnet_group" "test" {
   subnet_ids = aws_subnet.test[*].id
 }
 
+data "aws_rds_engine_version" "default" {
+  engine = "aurora-mysql"
+}
+
+data "aws_rds_orderable_db_instance" "test" {
+  engine                     = data.aws_rds_engine_version.default.engine
+  engine_version             = data.aws_rds_engine_version.default.version
+  preferred_instance_classes = ["db.t3.small", "db.t3.medium", "db.t3.large"]
+}
+
 resource "aws_rds_cluster" "test" {
-  cluster_identifier              = "%[1]s"
-  database_name                   = "gluedatabase"
-  db_cluster_parameter_group_name = "default.aurora-mysql5.7"
-  db_subnet_group_name            = aws_db_subnet_group.test.name
-  engine                          = "aurora-mysql"
-  master_password                 = "gluepassword"
-  master_username                 = "glueusername"
-  skip_final_snapshot             = true
-  vpc_security_group_ids          = [aws_security_group.test.id]
+  cluster_identifier     = "%[1]s"
+  database_name          = "gluedatabase"
+  db_subnet_group_name   = aws_db_subnet_group.test.name
+  engine                 = data.aws_rds_orderable_db_instance.test.engine
+  engine_version         = data.aws_rds_orderable_db_instance.test.engine_version
+  master_password        = "gluepassword"
+  master_username        = "glueusername"
+  skip_final_snapshot    = true
+  vpc_security_group_ids = [aws_security_group.test.id]
 }
 
 resource "aws_rds_cluster_instance" "test" {
-  cluster_identifier = aws_rds_cluster.test.id
-  engine             = "aurora-mysql"
   identifier         = "%[1]s"
-  instance_class     = "db.t2.medium"
+  cluster_identifier = aws_rds_cluster.test.id
+  engine             = data.aws_rds_orderable_db_instance.test.engine
+  engine_version     = data.aws_rds_orderable_db_instance.test.engine_version
+  instance_class     = data.aws_rds_orderable_db_instance.test.instance_class
 }
 
 resource "aws_glue_connection" "test" {
diff --git a/internal/service/glue/consts.go b/internal/service/glue/consts.go
index 0e3dcddf53e..d792bce432a 100644
--- a/internal/service/glue/consts.go
+++ b/internal/service/glue/consts.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package glue
 
 import (
diff --git a/internal/service/glue/crawler.go b/internal/service/glue/crawler.go
index fe8ec9e4594..f33409b82bb 100644
--- a/internal/service/glue/crawler.go
+++ b/internal/service/glue/crawler.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package glue
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"strings"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/aws/aws-sdk-go/service/glue"
@@ -26,7 +29,7 @@ import (
 )
 
 func targets() []string {
-	return []string{"s3_target", "dynamodb_target", "mongodb_target", "jdbc_target", "catalog_target", "delta_target"}
+	return []string{"s3_target", "dynamodb_target", "mongodb_target", "jdbc_target", "catalog_target", "delta_target", "iceberg_target", "hudi_target"}
 }
 
 // @SDKResource("aws_glue_crawler", name="Crawler")
@@ -158,6 +161,64 @@ func ResourceCrawler() *schema.Resource {
 					},
 				},
 			},
+			"hudi_target": {
+				Type:         schema.TypeList,
+				Optional:     true,
+				MinItems:     1,
+				AtLeastOneOf: targets(),
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"connection_name": {
+							Type:     schema.TypeString,
+							Optional: true,
+						},
+						"exclusions": {
+							Type:     schema.TypeList,
+							Optional: true,
+							Elem:     &schema.Schema{Type: schema.TypeString},
+						},
+						"maximum_traversal_depth": {
+							Type:         schema.TypeInt,
+							Required:     true,
+							ValidateFunc: validation.IntBetween(1, 20),
+						},
+						"paths": {
+							Type:     schema.TypeSet,
+							Required: true,
+							Elem:     &schema.Schema{Type: schema.TypeString},
+						},
+					},
+				},
+			},
+			"iceberg_target": {
+				Type:         schema.TypeList,
+				Optional:     true,
+				MinItems:     1,
+				AtLeastOneOf: targets(),
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"connection_name": {
+							Type:     schema.TypeString,
+							Optional: true,
+						},
+						"exclusions": {
+							Type:     schema.TypeList,
+							Optional: true,
+							Elem:     &schema.Schema{Type: schema.TypeString},
+						},
+						"maximum_traversal_depth": {
+							Type:         schema.TypeInt,
+							Required:     true,
+							ValidateFunc: validation.IntBetween(1, 20),
+						},
+						"paths": {
+							Type:     schema.TypeSet,
+							Required: true,
+							Elem:     &schema.Schema{Type: schema.TypeString},
+						},
+					},
+				},
+			},
 			"jdbc_target": {
 				Type:         schema.TypeList,
 				Optional:     true,
@@ -254,7 +315,7 @@ func ResourceCrawler() *schema.Resource {
 				Required: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 255),
-					validation.StringMatch(regexp.MustCompile(`[a-zA-Z0-9-_$#\/]+$`), ""),
+					validation.StringMatch(regexache.MustCompile(`[0-9A-Za-z_$#\/-]+$`), ""),
 				),
 			},
 			"recrawl_policy": {
@@ -389,6 +450,11 @@ func resourceCrawlerCreate(ctx context.Context, d *schema.ResourceData, meta int
 				return retry.RetryableError(err)
 			}
 
+			// InvalidInputException: com.amazonaws.services.glue.model.AccessDeniedException: You need to enable AWS Security Token Service for this region. . Please verify the role's TrustPolicy.
+			if tfawserr.ErrMessageContains(err, glue.ErrCodeInvalidInputException, "Please verify the role's TrustPolicy") {
+				return retry.RetryableError(err)
+			}
+
 			// InvalidInputException: Unable to retrieve connection tf-acc-test-8656357591012534997: User: arn:aws:sts::*******:assumed-role/tf-acc-test-8656357591012534997/AWS-Crawler is not authorized to perform: glue:GetConnection on resource: * (Service: AmazonDataCatalog; Status Code: 400; Error Code: AccessDeniedException; Request ID: 4d72b66f-9c75-11e8-9faf-5b526c7be968)
 			if tfawserr.ErrMessageContains(err, glue.ErrCodeInvalidInputException, "is not authorized") {
 				return retry.RetryableError(err)
@@ -482,6 +548,14 @@ func resourceCrawlerRead(ctx context.Context, d *schema.ResourceData, meta inter
 		if err := d.Set("delta_target", flattenDeltaTargets(crawler.Targets.DeltaTargets)); err != nil {
 			return sdkdiag.AppendErrorf(diags, "setting delta_target: %s", err)
 		}
+
+		if err := d.Set("hudi_target", flattenHudiTargets(crawler.Targets.HudiTargets)); err != nil {
+			return sdkdiag.AppendErrorf(diags, "setting hudi_target: %s", err)
+		}
+
+		if err := d.Set("iceberg_target", flattenIcebergTargets(crawler.Targets.IcebergTargets)); err != nil {
+			return sdkdiag.AppendErrorf(diags, "setting iceberg_target: %s", err)
+		}
 	}
 
 	if err := d.Set("lineage_configuration", flattenCrawlerLineageConfiguration(crawler.LineageConfiguration)); err != nil {
@@ -523,6 +597,11 @@ func resourceCrawlerUpdate(ctx context.Context, d *schema.ResourceData, meta int
 					return retry.RetryableError(err)
 				}
 
+				// InvalidInputException: com.amazonaws.services.glue.model.AccessDeniedException: You need to enable AWS Security Token Service for this region. . Please verify the role's TrustPolicy.
+				if tfawserr.ErrMessageContains(err, glue.ErrCodeInvalidInputException, "Please verify the role's TrustPolicy") {
+					return retry.RetryableError(err)
+				}
+
 				// InvalidInputException: Unable to retrieve connection tf-acc-test-8656357591012534997: User: arn:aws:sts::*******:assumed-role/tf-acc-test-8656357591012534997/AWS-Crawler is not authorized to perform: glue:GetConnection on resource: * (Service: AmazonDataCatalog; Status Code: 400; Error Code: AccessDeniedException; Request ID: 4d72b66f-9c75-11e8-9faf-5b526c7be968)
 				if tfawserr.ErrMessageContains(err, glue.ErrCodeInvalidInputException, "is not authorized") {
 					return retry.RetryableError(err)
@@ -726,6 +805,14 @@ func expandCrawlerTargets(d *schema.ResourceData) *glue.CrawlerTargets {
 		crawlerTargets.DeltaTargets = expandDeltaTargets(v.([]interface{}))
 	}
 
+	if v, ok := d.GetOk("hudi_target"); ok {
+		crawlerTargets.HudiTargets = expandHudiTargets(v.([]interface{}))
+	}
+
+	if v, ok := d.GetOk("iceberg_target"); ok {
+		crawlerTargets.IcebergTargets = expandIcebergTargets(v.([]interface{}))
+	}
+
 	return crawlerTargets
 }
 
@@ -816,7 +903,7 @@ func expandJDBCTarget(cfg map[string]interface{}) *glue.JdbcTarget {
 	}
 
 	if v, ok := cfg["enable_additional_metadata"].([]interface{}); ok {
-		target.Exclusions = flex.ExpandStringList(v)
+		target.EnableAdditionalMetadata = flex.ExpandStringList(v)
 	}
 
 	if v, ok := cfg["exclusions"].([]interface{}); ok {
@@ -910,6 +997,66 @@ func expandDeltaTarget(cfg map[string]interface{}) *glue.DeltaTarget {
 	return target
 }
 
+func expandHudiTargets(targets []interface{}) []*glue.HudiTarget {
+	if len(targets) < 1 {
+		return []*glue.HudiTarget{}
+	}
+
+	perms := make([]*glue.HudiTarget, len(targets))
+	for i, rawCfg := range targets {
+		cfg := rawCfg.(map[string]interface{})
+		perms[i] = expandHudiTarget(cfg)
+	}
+	return perms
+}
+
+func expandHudiTarget(cfg map[string]interface{}) *glue.HudiTarget {
+	target := &glue.HudiTarget{
+		Paths:                 flex.ExpandStringSet(cfg["paths"].(*schema.Set)),
+		MaximumTraversalDepth: aws.Int64(int64(cfg["maximum_traversal_depth"].(int))),
+	}
+
+	if v, ok := cfg["exclusions"]; ok {
+		target.Exclusions = flex.ExpandStringList(v.([]interface{}))
+	}
+
+	if v, ok := cfg["connection_name"].(string); ok {
+		target.ConnectionName = aws.String(v)
+	}
+
+	return target
+}
+
+func expandIcebergTargets(targets []interface{}) []*glue.IcebergTarget {
+	if len(targets) < 1 {
+		return []*glue.IcebergTarget{}
+	}
+
+	perms := make([]*glue.IcebergTarget, len(targets))
+	for i, rawCfg := range targets {
+		cfg := rawCfg.(map[string]interface{})
+		perms[i] = expandIcebergTarget(cfg)
+	}
+	return perms
+}
+
+func expandIcebergTarget(cfg map[string]interface{}) *glue.IcebergTarget {
+	target := &glue.IcebergTarget{
+		Paths:                 flex.ExpandStringSet(cfg["paths"].(*schema.Set)),
+		MaximumTraversalDepth: aws.Int64(int64(cfg["maximum_traversal_depth"].(int))),
+	}
+
+	if v, ok := cfg["exclusions"]; ok {
+		target.Exclusions = flex.ExpandStringList(v.([]interface{}))
+	}
+
+	if v, ok := cfg["connection_name"].(string); ok {
+		target.ConnectionName = aws.String(v)
+	}
+
+	return target
+}
+
 func flattenS3Targets(s3Targets []*glue.S3Target) []map[string]interface{} {
 	result := make([]map[string]interface{}, 0)
 
@@ -1005,6 +1152,36 @@ func flattenDeltaTargets(deltaTargets []*glue.DeltaTarget) []map[string]interfac
 	return result
 }
 
+func flattenHudiTargets(hudiTargets []*glue.HudiTarget) []map[string]interface{} {
+	result := make([]map[string]interface{}, 0)
+
+	for _, hudiTarget := range hudiTargets {
+		attrs := make(map[string]interface{})
+		attrs["connection_name"] = aws.StringValue(hudiTarget.ConnectionName)
+		attrs["maximum_traversal_depth"] = aws.Int64Value(hudiTarget.MaximumTraversalDepth)
+		attrs["paths"] = flex.FlattenStringSet(hudiTarget.Paths)
+		attrs["exclusions"] = flex.FlattenStringList(hudiTarget.Exclusions)
+
+		result = append(result, attrs)
+	}
+	return result
+}
+
+func flattenIcebergTargets(icebergTargets []*glue.IcebergTarget) []map[string]interface{} {
+	result := make([]map[string]interface{}, 0)
+
+	for _, icebergTarget := range icebergTargets {
+		attrs := make(map[string]interface{})
+		attrs["connection_name"] = aws.StringValue(icebergTarget.ConnectionName)
+		attrs["maximum_traversal_depth"] = aws.Int64Value(icebergTarget.MaximumTraversalDepth)
+		attrs["paths"] = flex.FlattenStringSet(icebergTarget.Paths)
+		attrs["exclusions"] = flex.FlattenStringList(icebergTarget.Exclusions)
+
+		result = append(result, attrs)
+	}
+	return result
+}
+
 func flattenCrawlerSchemaChangePolicy(cfg *glue.SchemaChangePolicy) []map[string]interface{} {
 	if cfg == nil {
 		return []map[string]interface{}{}
diff --git a/internal/service/glue/crawler_test.go b/internal/service/glue/crawler_test.go
index c0d60c103a6..ca1b364d7da 100644
--- a/internal/service/glue/crawler_test.go
+++ b/internal/service/glue/crawler_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package glue_test
 
 import (
@@ -207,6 +210,7 @@ func TestAccGlueCrawler_jdbcTarget(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "jdbc_target.0.connection_name", rName),
 					resource.TestCheckResourceAttr(resourceName, "jdbc_target.0.exclusions.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "jdbc_target.0.path", "database-name/%"),
+					resource.TestCheckResourceAttr(resourceName, "jdbc_target.0.enable_additional_metadata.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "role", rName),
 					resource.TestCheckResourceAttr(resourceName, "s3_target.#", "0"),
@@ -232,6 +236,7 @@ func TestAccGlueCrawler_jdbcTarget(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "jdbc_target.0.connection_name", rName),
 					resource.TestCheckResourceAttr(resourceName, "jdbc_target.0.exclusions.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "jdbc_target.0.path", "database-name/table-name"),
+					resource.TestCheckResourceAttr(resourceName, "jdbc_target.0.enable_additional_metadata.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "role", rName),
 					resource.TestCheckResourceAttr(resourceName, "s3_target.#", "0"),
@@ -248,6 +253,32 @@ func TestAccGlueCrawler_jdbcTarget(t *testing.T) {
 				ImportState:       true,
 				ImportStateVerify: true,
 			},
+			{
+				Config: testAccCrawlerConfig_jdbcTargetMetadata(rName, jdbcConnectionUrl, "database-name/table-name"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckCrawlerExists(ctx, resourceName, &crawler),
+					acctest.CheckResourceAttrRegionalARN(resourceName, "arn", "glue", fmt.Sprintf("crawler/%s", rName)),
+					resource.TestCheckResourceAttr(resourceName, "classifiers.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "configuration", ""),
+					resource.TestCheckResourceAttr(resourceName, "database_name", rName),
+					resource.TestCheckResourceAttr(resourceName, "description", ""),
+					resource.TestCheckResourceAttr(resourceName, "dynamodb_target.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "jdbc_target.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "jdbc_target.0.connection_name", rName),
+					resource.TestCheckResourceAttr(resourceName, "jdbc_target.0.exclusions.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "jdbc_target.0.path", "database-name/table-name"),
+					resource.TestCheckResourceAttr(resourceName, "jdbc_target.0.enable_additional_metadata.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "name", rName),
+					resource.TestCheckResourceAttr(resourceName, "role", rName),
+					resource.TestCheckResourceAttr(resourceName, "s3_target.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "schedule", ""),
+					resource.TestCheckResourceAttr(resourceName, "schema_change_policy.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "schema_change_policy.0.delete_behavior", "DEPRECATE_IN_DATABASE"),
+					resource.TestCheckResourceAttr(resourceName, "schema_change_policy.0.update_behavior", "UPDATE_IN_DATABASE"),
+					resource.TestCheckResourceAttr(resourceName, "table_prefix", ""),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
+				),
+			},
 		},
 	})
 }
@@ -560,6 +591,96 @@ func TestAccGlueCrawler_deltaTarget(t *testing.T) {
 	})
 }
 
+func TestAccGlueCrawler_hudiTarget(t *testing.T) {
+	ctx := acctest.Context(t)
+	var crawler glue.Crawler
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_glue_crawler.test"
+
+	connectionUrl := fmt.Sprintf("mongodb://%s:27017/testdatabase", acctest.RandomDomainName())
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, glue.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckCrawlerDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccCrawlerConfig_hudiTarget(rName, connectionUrl, "s3://table1", 1),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckCrawlerExists(ctx, resourceName, &crawler),
+					resource.TestCheckResourceAttr(resourceName, "hudi_target.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "hudi_target.0.connection_name", rName),
+					resource.TestCheckResourceAttr(resourceName, "hudi_target.0.maximum_traversal_depth", "1"),
+					resource.TestCheckResourceAttr(resourceName, "hudi_target.0.paths.#", "1"),
+					resource.TestCheckTypeSetElemAttr(resourceName, "hudi_target.0.paths.*", "s3://table1"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				Config: testAccCrawlerConfig_hudiTarget(rName, connectionUrl, "s3://table2", 2),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckCrawlerExists(ctx, resourceName, &crawler),
+					resource.TestCheckResourceAttr(resourceName, "hudi_target.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "hudi_target.0.connection_name", rName),
+					resource.TestCheckResourceAttr(resourceName, "hudi_target.0.maximum_traversal_depth", "2"),
+					resource.TestCheckResourceAttr(resourceName, "hudi_target.0.paths.#", "1"),
+					resource.TestCheckTypeSetElemAttr(resourceName, "hudi_target.0.paths.*", "s3://table2"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccGlueCrawler_icebergTarget(t *testing.T) {
+	ctx := acctest.Context(t)
+	var crawler glue.Crawler
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_glue_crawler.test"
+
+	connectionUrl := fmt.Sprintf("mongodb://%s:27017/testdatabase", acctest.RandomDomainName())
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, glue.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckCrawlerDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccCrawlerConfig_icebergTarget(rName, connectionUrl, "s3://table1", 1),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckCrawlerExists(ctx, resourceName, &crawler),
+					resource.TestCheckResourceAttr(resourceName, "iceberg_target.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "iceberg_target.0.connection_name", rName),
+					resource.TestCheckResourceAttr(resourceName, "iceberg_target.0.maximum_traversal_depth", "1"),
+					resource.TestCheckResourceAttr(resourceName, "iceberg_target.0.paths.#", "1"),
+					resource.TestCheckTypeSetElemAttr(resourceName, "iceberg_target.0.paths.*", "s3://table1"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				Config: testAccCrawlerConfig_icebergTarget(rName, connectionUrl, "s3://table2", 2),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckCrawlerExists(ctx, resourceName, &crawler),
+					resource.TestCheckResourceAttr(resourceName, "iceberg_target.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "iceberg_target.0.connection_name", rName),
+					resource.TestCheckResourceAttr(resourceName, "iceberg_target.0.maximum_traversal_depth", "2"),
+					resource.TestCheckResourceAttr(resourceName, "iceberg_target.0.paths.#", "1"),
+					resource.TestCheckTypeSetElemAttr(resourceName, "iceberg_target.0.paths.*", "s3://table2"),
+				),
+			},
+		},
+	})
+}
+
 func TestAccGlueCrawler_s3Target(t *testing.T) {
 	ctx := acctest.Context(t)
 	var crawler glue.Crawler
@@ -1942,6 +2063,38 @@ resource "aws_glue_crawler" "test" {
 `, rName, jdbcConnectionUrl, path))
 }
 
+func testAccCrawlerConfig_jdbcTargetMetadata(rName, jdbcConnectionUrl, path string) string {
+	return acctest.ConfigCompose(testAccCrawlerConfig_base(rName), fmt.Sprintf(`
+resource "aws_glue_catalog_database" "test" {
+  name = %[1]q
+}
+
+resource "aws_glue_connection" "test" {
+  name = %[1]q
+
+  connection_properties = {
+    JDBC_CONNECTION_URL = %[1]q
+    PASSWORD            = "testpassword"
+    USERNAME            = "testusername"
+  }
+}
+
+resource "aws_glue_crawler" "test" {
+  depends_on = [aws_iam_role_policy_attachment.test-AWSGlueServiceRole]
+
+  database_name = aws_glue_catalog_database.test.name
+  name          = %[1]q
+  role          = aws_iam_role.test.name
+
+  jdbc_target {
+    connection_name            = aws_glue_connection.test.name
+    path                       = %[3]q
+    enable_additional_metadata = ["COMMENTS"]
+  }
+}
+`, rName, jdbcConnectionUrl, path))
+}
+
 func testAccCrawlerConfig_jdbcTargetExclusions1(rName, jdbcConnectionUrl, exclusion1 string) string {
 	return acctest.ConfigCompose(testAccCrawlerConfig_base(rName), fmt.Sprintf(`
 resource "aws_glue_catalog_database" "test" {
@@ -2967,6 +3120,114 @@ resource "aws_glue_crawler" "test" {
 `, rName, connectionUrl, tableName, createNativeDeltaTable))
 }
 
+func testAccCrawlerConfig_hudiTarget(rName, connectionUrl, tableName string, depth int) string {
+	return acctest.ConfigCompose(testAccCrawlerConfig_base(rName), acctest.ConfigVPCWithSubnets(rName, 2), fmt.Sprintf(`
+resource "aws_security_group" "test" {
+  name   = %[1]q
+  vpc_id = aws_vpc.test.id
+
+  ingress {
+    from_port = 1
+    protocol  = "tcp"
+    self      = true
+    to_port   = 65535
+  }
+
+  tags = {
+    Name = %[1]q
+  }
+}
+
+resource "aws_glue_catalog_database" "test" {
+  name = %[1]q
+}
+
+resource "aws_glue_connection" "test" {
+  connection_properties = {
+    JDBC_ENFORCE_SSL = false
+  }
+
+  connection_type = "NETWORK"
+
+  name = %[1]q
+
+  physical_connection_requirements {
+    availability_zone      = aws_subnet.test[0].availability_zone
+    security_group_id_list = [aws_security_group.test.id]
+    subnet_id              = aws_subnet.test[0].id
+  }
+}
+
+resource "aws_glue_crawler" "test" {
+  depends_on = [aws_iam_role_policy_attachment.test-AWSGlueServiceRole]
+
+  database_name = aws_glue_catalog_database.test.name
+  name          = %[1]q
+  role          = aws_iam_role.test.name
+
+  hudi_target {
+    connection_name         = aws_glue_connection.test.name
+    paths                   = [%[3]q]
+    maximum_traversal_depth = %[4]d
+  }
+}
+`, rName, connectionUrl, tableName, depth))
+}
+
+func testAccCrawlerConfig_icebergTarget(rName, connectionUrl, tableName string, depth int) string {
+	return acctest.ConfigCompose(testAccCrawlerConfig_base(rName), acctest.ConfigVPCWithSubnets(rName, 2), fmt.Sprintf(`
+resource "aws_security_group" "test" {
+  name   = %[1]q
+  vpc_id = aws_vpc.test.id
+
+  ingress {
+    from_port = 1
+    protocol  = "tcp"
+    self      = true
+    to_port   = 65535
+  }
+
+  tags = {
+    Name = %[1]q
+  }
+}
+
+resource "aws_glue_catalog_database" "test" {
+  name = %[1]q
+}
+
+resource "aws_glue_connection" "test" {
+  connection_properties = {
+    JDBC_ENFORCE_SSL = false
+  }
+
+  connection_type = "NETWORK"
+
+  name = %[1]q
+
+  physical_connection_requirements {
+    availability_zone      = aws_subnet.test[0].availability_zone
+    security_group_id_list = [aws_security_group.test.id]
+    subnet_id              = aws_subnet.test[0].id
+  }
+}
+
+resource "aws_glue_crawler" "test" {
+  depends_on = [aws_iam_role_policy_attachment.test-AWSGlueServiceRole]
+
+  database_name = aws_glue_catalog_database.test.name
+  name          = %[1]q
+  role          = aws_iam_role.test.name
+
+  iceberg_target {
+    connection_name         = aws_glue_connection.test.name
+    paths                   = [%[3]q]
+    maximum_traversal_depth = %[4]d
+  }
+}
+`, rName, connectionUrl, tableName, depth))
+}
+
 func testAccCrawlerConfig_lakeformation(rName string, use bool) string {
 	return acctest.ConfigCompose(testAccCrawlerConfig_base(rName), fmt.Sprintf(`
 resource "aws_glue_catalog_database" "test" {
diff --git a/internal/service/glue/data_catalog_encryption_settings.go b/internal/service/glue/data_catalog_encryption_settings.go
index 54a831a8041..0713bad6669 100644
--- a/internal/service/glue/data_catalog_encryption_settings.go
+++ b/internal/service/glue/data_catalog_encryption_settings.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package glue
 
 import (
diff --git a/internal/service/glue/data_catalog_encryption_settings_data_source.go b/internal/service/glue/data_catalog_encryption_settings_data_source.go
index e559fddf49c..3b806f8d326 100644
--- a/internal/service/glue/data_catalog_encryption_settings_data_source.go
+++ b/internal/service/glue/data_catalog_encryption_settings_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package glue
 
 import (
diff --git a/internal/service/glue/data_catalog_encryption_settings_data_source_test.go b/internal/service/glue/data_catalog_encryption_settings_data_source_test.go
index 0397f923f32..e99503de8e2 100644
--- a/internal/service/glue/data_catalog_encryption_settings_data_source_test.go
+++ b/internal/service/glue/data_catalog_encryption_settings_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package glue_test
 
 import (
diff --git a/internal/service/glue/data_catalog_encryption_settings_test.go b/internal/service/glue/data_catalog_encryption_settings_test.go
index 718ed01d61c..ad36882afc0 100644
--- a/internal/service/glue/data_catalog_encryption_settings_test.go
+++ b/internal/service/glue/data_catalog_encryption_settings_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package glue_test
 
 import (
diff --git a/internal/service/glue/data_quality_ruleset.go b/internal/service/glue/data_quality_ruleset.go
index b64509a0a98..5f36599e337 100644
--- a/internal/service/glue/data_quality_ruleset.go
+++ b/internal/service/glue/data_quality_ruleset.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package glue
 
 import (
diff --git a/internal/service/glue/data_quality_ruleset_test.go b/internal/service/glue/data_quality_ruleset_test.go
index aff844914a2..63a41b25d06 100644
--- a/internal/service/glue/data_quality_ruleset_test.go
+++ b/internal/service/glue/data_quality_ruleset_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package glue_test
 
 import (
diff --git a/internal/service/glue/dev_endpoint.go b/internal/service/glue/dev_endpoint.go
index 8fc41169d56..499845d86a3 100644
--- a/internal/service/glue/dev_endpoint.go
+++ b/internal/service/glue/dev_endpoint.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package glue
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/aws/aws-sdk-go/service/glue"
@@ -61,7 +64,7 @@ func ResourceDevEndpoint() *schema.Resource {
 				Type:         schema.TypeString,
 				Optional:     true,
 				ForceNew:     true,
-				ValidateFunc: validation.StringMatch(regexp.MustCompile(`^\w+\.\w+$`), "must match version pattern X.X"),
+				ValidateFunc: validation.StringMatch(regexache.MustCompile(`^\w+\.\w+$`), "must match version pattern X.X"),
 			},
 			"name": {
 				Type:         schema.TypeString,
diff --git a/internal/service/glue/dev_endpoint_test.go b/internal/service/glue/dev_endpoint_test.go
index 1e8a301b214..6a166aa0e0b 100644
--- a/internal/service/glue/dev_endpoint_test.go
+++ b/internal/service/glue/dev_endpoint_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package glue_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/glue"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -189,7 +192,7 @@ func TestAccGlueDevEndpoint_glueVersion(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccDevEndpointConfig_version(rName, "1"),
-				ExpectError: regexp.MustCompile(`must match version pattern X.X`),
+				ExpectError: regexache.MustCompile(`must match version pattern X.X`),
 			},
 			{
 				Config: testAccDevEndpointConfig_version(rName, "1.0"),
@@ -229,7 +232,7 @@ func TestAccGlueDevEndpoint_numberOfNodes(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccDevEndpointConfig_numberOfNodes(rName, 1),
-				ExpectError: regexp.MustCompile(`expected number_of_nodes to be at least`),
+				ExpectError: regexache.MustCompile(`expected number_of_nodes to be at least`),
 			},
 			{
 				Config: testAccDevEndpointConfig_numberOfNodes(rName, 2),
@@ -269,7 +272,7 @@ func TestAccGlueDevEndpoint_numberOfWorkers(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccDevEndpointConfig_numberOfWorkers(rName, 1),
-				ExpectError: regexp.MustCompile(`expected number_of_workers to be at least`),
+				ExpectError: regexache.MustCompile(`expected number_of_workers to be at least`),
 			},
 			{
 				Config: testAccDevEndpointConfig_numberOfWorkers(rName, 2),
diff --git a/internal/service/glue/find.go b/internal/service/glue/find.go
index dcae8555e4b..338af5ddca7 100644
--- a/internal/service/glue/find.go
+++ b/internal/service/glue/find.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package glue
 
 import (
@@ -109,22 +112,6 @@ func FindDataQualityRulesetByName(ctx context.Context, conn *glue.Glue, name str
 	return output, nil
 }
 
-// FindTableByName returns the Table corresponding to the specified name.
-func FindTableByName(ctx context.Context, conn *glue.Glue, catalogID, dbName, name string) (*glue.GetTableOutput, error) {
-	input := &glue.GetTableInput{
-		CatalogId:    aws.String(catalogID),
-		DatabaseName: aws.String(dbName),
-		Name:         aws.String(name),
-	}
-
-	output, err := conn.GetTableWithContext(ctx, input)
-	if err != nil {
-		return nil, err
-	}
-
-	return output, nil
-}
-
 // FindTriggerByName returns the Trigger corresponding to the specified name.
 func FindTriggerByName(ctx context.Context, conn *glue.Glue, name string) (*glue.GetTriggerOutput, error) {
 	input := &glue.GetTriggerInput{
diff --git a/internal/service/glue/generate.go b/internal/service/glue/generate.go
index 4ccfb6b7390..6e249ac625f 100644
--- a/internal/service/glue/generate.go
+++ b/internal/service/glue/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTags -ListTagsOp=GetTags -ServiceTagsMap -TagInTagsElem=TagsToAdd -UntagInTagsElem=TagsToRemove -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/glue/glue_test.go b/internal/service/glue/glue_test.go
index 60b68bc3e81..46adaf31e68 100644
--- a/internal/service/glue/glue_test.go
+++ b/internal/service/glue/glue_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package glue_test
 
 import (
diff --git a/internal/service/glue/id.go b/internal/service/glue/id.go
index 24ace1058b9..2bd7a22ffa1 100644
--- a/internal/service/glue/id.go
+++ b/internal/service/glue/id.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package glue
 
 import (
diff --git a/internal/service/glue/job.go b/internal/service/glue/job.go
index 9bbebb32ad8..068f692f38a 100644
--- a/internal/service/glue/job.go
+++ b/internal/service/glue/job.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package glue
 
 import (
@@ -51,16 +54,22 @@ func ResourceJob() *schema.Resource {
 							Optional: true,
 							Default:  "glueetl",
 						},
-						"script_location": {
-							Type:     schema.TypeString,
-							Required: true,
-						},
 						"python_version": {
 							Type:         schema.TypeString,
 							Optional:     true,
 							Computed:     true,
 							ValidateFunc: validation.StringInSlice([]string{"2", "3", "3.9"}, true),
 						},
+						"runtime": {
+							Type:         schema.TypeString,
+							Optional:     true,
+							Computed:     true,
+							ValidateFunc: validation.StringInSlice([]string{"Ray2.4"}, true),
+						},
+						"script_location": {
+							Type:     schema.TypeString,
+							Required: true,
+						},
 					},
 				},
 			},
@@ -78,11 +87,6 @@ func ResourceJob() *schema.Resource {
 				Type:     schema.TypeString,
 				Optional: true,
 			},
-			"glue_version": {
-				Type:     schema.TypeString,
-				Optional: true,
-				Computed: true,
-			},
 			"execution_class": {
 				Type:         schema.TypeString,
 				Optional:     true,
@@ -104,6 +108,11 @@ func ResourceJob() *schema.Resource {
 					},
 				},
 			},
+			"glue_version": {
+				Type:     schema.TypeString,
+				Optional: true,
+				Computed: true,
+			},
 			"max_capacity": {
 				Type:          schema.TypeFloat,
 				Optional:      true,
@@ -244,7 +253,6 @@ func resourceJobCreate(ctx context.Context, d *schema.ResourceData, meta interfa
 		input.WorkerType = aws.String(v.(string))
 	}
 
-	log.Printf("[DEBUG] Creating Glue Job: %s", input)
 	output, err := conn.CreateJobWithContext(ctx, input)
 
 	if err != nil {
@@ -382,7 +390,6 @@ func resourceJobUpdate(ctx context.Context, d *schema.ResourceData, meta interfa
 			JobUpdate: jobUpdate,
 		}
 
-		log.Printf("[DEBUG] Updating Glue Job: %s", input)
 		_, err := conn.UpdateJobWithContext(ctx, input)
 
 		if err != nil {
@@ -435,6 +442,10 @@ func expandJobCommand(l []interface{}) *glue.JobCommand {
 		jobCommand.PythonVersion = aws.String(v)
 	}
 
+	if v, ok := m["runtime"].(string); ok && v != "" {
+		jobCommand.Runtime = aws.String(v)
+	}
+
 	return jobCommand
 }
 
@@ -477,6 +488,7 @@ func flattenJobCommand(jobCommand *glue.JobCommand) []map[string]interface{} {
 		"name":            aws.StringValue(jobCommand.Name),
 		"script_location": aws.StringValue(jobCommand.ScriptLocation),
 		"python_version":  aws.StringValue(jobCommand.PythonVersion),
+		"runtime":         aws.StringValue(jobCommand.Runtime),
 	}
 
 	return []map[string]interface{}{m}
diff --git a/internal/service/glue/job_test.go b/internal/service/glue/job_test.go
index c863a8dd919..3d0f8f823ba 100644
--- a/internal/service/glue/job_test.go
+++ b/internal/service/glue/job_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package glue_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/glue"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -357,7 +360,7 @@ func TestAccGlueJob_executionProperty(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccJobConfig_executionProperty(rName, 0),
-				ExpectError: regexp.MustCompile(`expected execution_property.0.max_concurrent_runs to be at least`),
+				ExpectError: regexache.MustCompile(`expected execution_property.0.max_concurrent_runs to be at least`),
 			},
 			{
 				Config: testAccJobConfig_executionProperty(rName, 1),
@@ -398,7 +401,7 @@ func TestAccGlueJob_maxRetries(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccJobConfig_maxRetries(rName, 11),
-				ExpectError: regexp.MustCompile(`expected max_retries to be in the range`),
+				ExpectError: regexache.MustCompile(`expected max_retries to be in the range`),
 			},
 			{
 				Config: testAccJobConfig_maxRetries(rName, 0),
@@ -437,7 +440,7 @@ func TestAccGlueJob_notificationProperty(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccJobConfig_notificationProperty(rName, 0),
-				ExpectError: regexp.MustCompile(`expected notification_property.0.notify_delay_after to be at least`),
+				ExpectError: regexache.MustCompile(`expected notification_property.0.notify_delay_after to be at least`),
 			},
 			{
 				Config: testAccJobConfig_notificationProperty(rName, 1),
@@ -723,6 +726,34 @@ func TestAccGlueJob_pythonShell(t *testing.T) {
 	})
 }
 
+func TestAccGlueJob_rayJob(t *testing.T) {
+	ctx := acctest.Context(t)
+	var job glue.Job
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_glue_job.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, glue.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckJobDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccJobConfig_rayJob(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckJobExists(ctx, resourceName, &job),
+					resource.TestCheckResourceAttr(resourceName, "command.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "command.0.script_location", "testscriptlocation"),
+					resource.TestCheckResourceAttr(resourceName, "command.0.name", "glueray"),
+					resource.TestCheckResourceAttr(resourceName, "command.0.python_version", "3.9"),
+					resource.TestCheckResourceAttr(resourceName, "command.0.runtime", "Ray2.4"),
+					resource.TestCheckResourceAttr(resourceName, "worker_type", "Z.2X"),
+				),
+			},
+		},
+	})
+}
+
 func TestAccGlueJob_maxCapacity(t *testing.T) {
 	ctx := acctest.Context(t)
 	var job glue.Job
@@ -1195,6 +1226,27 @@ resource "aws_glue_job" "test" {
 `, rName, pythonVersion))
 }
 
+func testAccJobConfig_rayJob(rName string) string {
+	return acctest.ConfigCompose(testAccJobConfig_base(rName), fmt.Sprintf(`
+resource "aws_glue_job" "test" {
+  glue_version      = "4.0"
+  name              = %[1]q
+  role_arn          = aws_iam_role.test.arn
+  worker_type       = "Z.2X"
+  number_of_workers = 10
+
+  command {
+    name            = "glueray"
+    python_version  = "3.9"
+    runtime         = "Ray2.4"
+    script_location = "testscriptlocation"
+  }
+
+  depends_on = [aws_iam_role_policy_attachment.test]
+}
+`, rName))
+}
+
 func testAccJobConfig_maxCapacity(rName string, maxCapacity float64) string {
 	return acctest.ConfigCompose(testAccJobConfig_base(rName), fmt.Sprintf(`
 resource "aws_glue_job" "test" {
diff --git a/internal/service/glue/ml_transform.go b/internal/service/glue/ml_transform.go
index d358d112b86..3fba5b87076 100644
--- a/internal/service/glue/ml_transform.go
+++ b/internal/service/glue/ml_transform.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package glue
 
 import (
diff --git a/internal/service/glue/ml_transform_test.go b/internal/service/glue/ml_transform_test.go
index aae66f999a1..4a6863d8e8c 100644
--- a/internal/service/glue/ml_transform_test.go
+++ b/internal/service/glue/ml_transform_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package glue_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/glue"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -36,7 +39,7 @@ func TestAccGlueMlTransform_basic(t *testing.T) {
 				Config: testAccMLTransformConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckMLTransformExists(ctx, resourceName, &transform),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "glue", regexp.MustCompile(`mlTransform/tfm-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "glue", regexache.MustCompile(`mlTransform/tfm-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttrPair(resourceName, "role_arn", roleResourceName, "arn"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
@@ -216,7 +219,7 @@ func TestAccGlueMlTransform_maxRetries(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccMLTransformConfig_maxRetries(rName, 11),
-				ExpectError: regexp.MustCompile(`expected max_retries to be in the range`),
+				ExpectError: regexache.MustCompile(`expected max_retries to be in the range`),
 			},
 			{
 				Config: testAccMLTransformConfig_maxRetries(rName, 0),
diff --git a/internal/service/glue/partition.go b/internal/service/glue/partition.go
index 1751fd14910..821e839946a 100644
--- a/internal/service/glue/partition.go
+++ b/internal/service/glue/partition.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package glue
 
 import (
diff --git a/internal/service/glue/partition_index.go b/internal/service/glue/partition_index.go
index 3e603a8cf57..d8541bba072 100644
--- a/internal/service/glue/partition_index.go
+++ b/internal/service/glue/partition_index.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package glue
 
 import (
diff --git a/internal/service/glue/partition_index_test.go b/internal/service/glue/partition_index_test.go
index 669ab069e29..18610c58bab 100644
--- a/internal/service/glue/partition_index_test.go
+++ b/internal/service/glue/partition_index_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package glue_test
 
 import (
diff --git a/internal/service/glue/partition_test.go b/internal/service/glue/partition_test.go
index 874c12cf179..3b2f4e53bb1 100644
--- a/internal/service/glue/partition_test.go
+++ b/internal/service/glue/partition_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package glue_test
 
 import (
diff --git a/internal/service/glue/registry.go b/internal/service/glue/registry.go
index 3babe09ab4f..c8b21accf55 100644
--- a/internal/service/glue/registry.go
+++ b/internal/service/glue/registry.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package glue
 
 import (
 	"context"
 	"log"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/glue"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -48,7 +51,7 @@ func ResourceRegistry() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 255),
-					validation.StringMatch(regexp.MustCompile(`[a-zA-Z0-9-_$#]+$`), ""),
+					validation.StringMatch(regexache.MustCompile(`[0-9A-Za-z_$#-]+$`), ""),
 				),
 			},
 			names.AttrTags:    tftags.TagsSchema(),
diff --git a/internal/service/glue/registry_test.go b/internal/service/glue/registry_test.go
index dc59aaa3416..f1e23b76b74 100644
--- a/internal/service/glue/registry_test.go
+++ b/internal/service/glue/registry_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package glue_test
 
 import (
diff --git a/internal/service/glue/resource_policy.go b/internal/service/glue/resource_policy.go
index b320d336875..8f5f5ec3ebe 100644
--- a/internal/service/glue/resource_policy.go
+++ b/internal/service/glue/resource_policy.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package glue
 
 import (
diff --git a/internal/service/glue/resource_policy_test.go b/internal/service/glue/resource_policy_test.go
index d1133ede740..c65bf60464d 100644
--- a/internal/service/glue/resource_policy_test.go
+++ b/internal/service/glue/resource_policy_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package glue_test
 
 import (
diff --git a/internal/service/glue/schema.go b/internal/service/glue/schema.go
index 42b5e245757..e2cc3b66b89 100644
--- a/internal/service/glue/schema.go
+++ b/internal/service/glue/schema.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package glue
 
 import (
 	"context"
 	"log"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/glue"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -79,7 +82,7 @@ func ResourceSchema() *schema.Resource {
 				Required: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 170000),
-					validation.StringMatch(regexp.MustCompile(`.*\S.*`), ""),
+					validation.StringMatch(regexache.MustCompile(`.*\S.*`), ""),
 				),
 			},
 			"schema_name": {
@@ -88,7 +91,7 @@ func ResourceSchema() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 255),
-					validation.StringMatch(regexp.MustCompile(`[a-zA-Z0-9-_$#]+$`), ""),
+					validation.StringMatch(regexache.MustCompile(`[0-9A-Za-z_$#-]+$`), ""),
 				),
 			},
 			names.AttrTags:    tftags.TagsSchema(),
diff --git a/internal/service/glue/schema_test.go b/internal/service/glue/schema_test.go
index 33ae1f463cf..faceb3a989d 100644
--- a/internal/service/glue/schema_test.go
+++ b/internal/service/glue/schema_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package glue_test
 
 import (
diff --git a/internal/service/glue/script_data_source.go b/internal/service/glue/script_data_source.go
index d48b73da9b2..f8209c43f39 100644
--- a/internal/service/glue/script_data_source.go
+++ b/internal/service/glue/script_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package glue
 
 import (
diff --git a/internal/service/glue/script_data_source_test.go b/internal/service/glue/script_data_source_test.go
index 369535c0eb3..62cd931c2d0 100644
--- a/internal/service/glue/script_data_source_test.go
+++ b/internal/service/glue/script_data_source_test.go
@@ -1,9 +1,12 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package glue_test
 
 import (
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/glue"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
@@ -21,7 +24,7 @@ func TestAccGlueScriptDataSource_Language_python(t *testing.T) {
 			{
 				Config: testAccScriptDataSourceConfig_python(),
 				Check: resource.ComposeAggregateTestCheckFunc(
-					resource.TestMatchResourceAttr(dataSourceName, "python_script", regexp.MustCompile(`from awsglue\.job import Job`)),
+					resource.TestMatchResourceAttr(dataSourceName, "python_script", regexache.MustCompile(`from awsglue\.job import Job`)),
 				),
 			},
 		},
@@ -40,7 +43,7 @@ func TestAccGlueScriptDataSource_Language_scala(t *testing.T) {
 			{
 				Config: testAccScriptDataSourceConfig_scala(),
 				Check: resource.ComposeAggregateTestCheckFunc(
-					resource.TestMatchResourceAttr(dataSourceName, "scala_code", regexp.MustCompile(`import com\.amazonaws\.services\.glue\.util\.Job`)),
+					resource.TestMatchResourceAttr(dataSourceName, "scala_code", regexache.MustCompile(`import com\.amazonaws\.services\.glue\.util\.Job`)),
 				),
 			},
 		},
diff --git a/internal/service/glue/security_configuration.go b/internal/service/glue/security_configuration.go
index ce6329d1a62..6979415f167 100644
--- a/internal/service/glue/security_configuration.go
+++ b/internal/service/glue/security_configuration.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package glue
 
 import (
diff --git a/internal/service/glue/security_configuration_test.go b/internal/service/glue/security_configuration_test.go
index a70475256b0..835855708fb 100644
--- a/internal/service/glue/security_configuration_test.go
+++ b/internal/service/glue/security_configuration_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package glue_test
 
 import (
diff --git a/internal/service/glue/service_package_gen.go b/internal/service/glue/service_package_gen.go
index 2d1f82d619f..781259dd492 100644
--- a/internal/service/glue/service_package_gen.go
+++ b/internal/service/glue/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	glue_sdkv1 "github.com/aws/aws-sdk-go/service/glue"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -179,4 +180,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*g
 	return glue_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/glue/status.go b/internal/service/glue/status.go
index 1a7829b8326..00c9a40ba93 100644
--- a/internal/service/glue/status.go
+++ b/internal/service/glue/status.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package glue
 
 import (
diff --git a/internal/service/glue/sweep.go b/internal/service/glue/sweep.go
index 148fd9021b7..e96e6422206 100644
--- a/internal/service/glue/sweep.go
+++ b/internal/service/glue/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package glue
 
@@ -14,9 +14,10 @@ import (
 	"github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_glue_catalog_database", &resource.Sweeper{
 		Name: "aws_glue_catalog_database",
 		F:    sweepCatalogDatabases,
@@ -80,7 +81,7 @@ func init() {
 
 func sweepCatalogDatabases(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -111,14 +112,14 @@ func sweepCatalogDatabases(region string) error {
 		return !lastPage
 	})
 	if err != nil {
-		if sweep.SkipSweepError(err) {
+		if awsv1.SkipSweepError(err) {
 			log.Printf("[WARN] Skipping Glue Catalog Database sweep for %s: %s", region, err)
 			return nil
 		}
 		return fmt.Errorf("Error retrieving Glue Catalog Databases: %s", err)
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error sweeping Glue Catalog Databases: %w", err))
 	}
 
@@ -127,7 +128,7 @@ func sweepCatalogDatabases(region string) error {
 
 func sweepClassifiers(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -168,14 +169,14 @@ func sweepClassifiers(region string) error {
 		return !lastPage
 	})
 	if err != nil {
-		if sweep.SkipSweepError(err) {
+		if awsv1.SkipSweepError(err) {
 			log.Printf("[WARN] Skipping Glue Classifier sweep for %s: %s", region, err)
 			return nil
 		}
 		return fmt.Errorf("Error retrieving Glue Classifiers: %s", err)
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error sweeping Glue Classifiers: %w", err))
 	}
 
@@ -184,7 +185,7 @@ func sweepClassifiers(region string) error {
 
 func sweepConnections(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -215,14 +216,14 @@ func sweepConnections(region string) error {
 		return !lastPage
 	})
 	if err != nil {
-		if sweep.SkipSweepError(err) {
+		if awsv1.SkipSweepError(err) {
 			log.Printf("[WARN] Skipping Glue Connection sweep for %s: %s", region, err)
 			return nil
 		}
 		return fmt.Errorf("Error retrieving Glue Connections: %s", err)
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error sweeping API Gateway VPC Links: %w", err))
 	}
 
@@ -231,7 +232,7 @@ func sweepConnections(region string) error {
 
 func sweepCrawlers(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -258,14 +259,14 @@ func sweepCrawlers(region string) error {
 		return !lastPage
 	})
 	if err != nil {
-		if sweep.SkipSweepError(err) {
+		if awsv1.SkipSweepError(err) {
 			log.Printf("[WARN] Skipping Glue Crawler sweep for %s: %s", region, err)
 			return nil
 		}
 		return fmt.Errorf("Error retrieving Glue Crawlers: %s", err)
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error sweeping API Gateway VPC Links: %w", err))
 	}
 
@@ -274,7 +275,7 @@ func sweepCrawlers(region string) error {
 
 func sweepDevEndpoints(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -304,7 +305,7 @@ func sweepDevEndpoints(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Glue Dev Endpoint sweep for %s: %s", region, err)
 		return nil
 	}
@@ -313,7 +314,7 @@ func sweepDevEndpoints(region string) error {
 		return fmt.Errorf("error listing Glue Dev Endpoints (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping Glue Dev Endpoints (%s): %w", region, err)
@@ -324,7 +325,7 @@ func sweepDevEndpoints(region string) error {
 
 func sweepJobs(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -348,7 +349,7 @@ func sweepJobs(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Glue Job sweep for %s: %s", region, err)
 		return nil
 	}
@@ -357,7 +358,7 @@ func sweepJobs(region string) error {
 		return fmt.Errorf("error listing Glue Jobs (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping Glue Jobs (%s): %w", region, err)
@@ -368,7 +369,7 @@ func sweepJobs(region string) error {
 
 func sweepMLTransforms(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
@@ -395,7 +396,7 @@ func sweepMLTransforms(region string) error {
 		}
 		return !lastPage
 	})
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Glue ML Transforms sweep for %s: %s", region, err)
 		return sweeperErrs.ErrorOrNil() // In case we have completed some pages, but had errors
 	}
@@ -403,7 +404,7 @@ func sweepMLTransforms(region string) error {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error retrieving Glue ML Transforms: %w", err))
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error sweeping Glue ML Transforms: %w", err))
 	}
 
@@ -412,7 +413,7 @@ func sweepMLTransforms(region string) error {
 
 func sweepRegistry(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -424,7 +425,7 @@ func sweepRegistry(region string) error {
 	listOutput, err := conn.ListRegistriesWithContext(ctx, &glue.ListRegistriesInput{})
 	if err != nil {
 		// Some endpoints that do not support Glue Registrys return InternalFailure
-		if sweep.SkipSweepError(err) || tfawserr.ErrCodeEquals(err, "InternalFailure") {
+		if awsv1.SkipSweepError(err) || tfawserr.ErrCodeEquals(err, "InternalFailure") {
 			log.Printf("[WARN] Skipping Glue Registry sweep for %s: %s", region, err)
 			return nil
 		}
@@ -439,7 +440,7 @@ func sweepRegistry(region string) error {
 		sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error sweeping Glue Registry: %w", err))
 	}
 
@@ -448,7 +449,7 @@ func sweepRegistry(region string) error {
 
 func sweepSchema(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -460,7 +461,7 @@ func sweepSchema(region string) error {
 	listOutput, err := conn.ListSchemasWithContext(ctx, &glue.ListSchemasInput{})
 	if err != nil {
 		// Some endpoints that do not support Glue Schemas return InternalFailure
-		if sweep.SkipSweepError(err) || tfawserr.ErrCodeEquals(err, "InternalFailure") {
+		if awsv1.SkipSweepError(err) || tfawserr.ErrCodeEquals(err, "InternalFailure") {
 			log.Printf("[WARN] Skipping Glue Schema sweep for %s: %s", region, err)
 			return nil
 		}
@@ -475,7 +476,7 @@ func sweepSchema(region string) error {
 		sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error sweeping API Gateway VPC Links: %w", err))
 	}
 
@@ -484,7 +485,7 @@ func sweepSchema(region string) error {
 
 func sweepSecurityConfigurations(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -495,7 +496,7 @@ func sweepSecurityConfigurations(region string) error {
 	for {
 		output, err := conn.GetSecurityConfigurationsWithContext(ctx, input)
 
-		if sweep.SkipSweepError(err) {
+		if awsv1.SkipSweepError(err) {
 			log.Printf("[WARN] Skipping Glue Security Configuration sweep for %s: %s", region, err)
 			return nil
 		}
@@ -526,7 +527,7 @@ func sweepSecurityConfigurations(region string) error {
 
 func sweepTriggers(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -554,14 +555,14 @@ func sweepTriggers(region string) error {
 		return !lastPage
 	})
 	if err != nil {
-		if sweep.SkipSweepError(err) {
+		if awsv1.SkipSweepError(err) {
 			log.Printf("[WARN] Skipping Glue Trigger sweep for %s: %s", region, err)
 			return nil
 		}
 		return fmt.Errorf("Error retrieving Glue Triggers: %s", err)
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error sweeping Glue Triggers: %w", err))
 	}
 
@@ -570,7 +571,7 @@ func sweepTriggers(region string) error {
 
 func sweepWorkflow(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -579,7 +580,7 @@ func sweepWorkflow(region string) error {
 	listOutput, err := conn.ListWorkflowsWithContext(ctx, &glue.ListWorkflowsInput{})
 	if err != nil {
 		// Some endpoints that do not support Glue Workflows return InternalFailure
-		if sweep.SkipSweepError(err) || tfawserr.ErrCodeEquals(err, "InternalFailure") {
+		if awsv1.SkipSweepError(err) || tfawserr.ErrCodeEquals(err, "InternalFailure") {
 			log.Printf("[WARN] Skipping Glue Workflow sweep for %s: %s", region, err)
 			return nil
 		}
diff --git a/internal/service/glue/tags_gen.go b/internal/service/glue/tags_gen.go
index 099a687e6d0..6cce2f144e3 100644
--- a/internal/service/glue/tags_gen.go
+++ b/internal/service/glue/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/glue"
 	"github.com/aws/aws-sdk-go/service/glue/glueiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -54,7 +56,7 @@ func Tags(tags tftags.KeyValueTags) map[string]*string {
 	return aws.StringMap(tags.Map())
 }
 
-// KeyValueTags creates KeyValueTags from glue service tags.
+// KeyValueTags creates tftags.KeyValueTags from glue service tags.
 func KeyValueTags(ctx context.Context, tags map[string]*string) tftags.KeyValueTags {
 	return tftags.New(ctx, tags)
 }
@@ -85,6 +87,8 @@ func updateTags(ctx context.Context, conn glueiface.GlueAPI, identifier string,
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.Glue)
 	if len(removedTags) > 0 {
diff --git a/internal/service/glue/trigger.go b/internal/service/glue/trigger.go
index 888faef5ecc..b7da9473eaa 100644
--- a/internal/service/glue/trigger.go
+++ b/internal/service/glue/trigger.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package glue
 
 import (
diff --git a/internal/service/glue/trigger_test.go b/internal/service/glue/trigger_test.go
index 2600d1813bb..3527f6777d6 100644
--- a/internal/service/glue/trigger_test.go
+++ b/internal/service/glue/trigger_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package glue_test
 
 import (
diff --git a/internal/service/glue/user_defined_function.go b/internal/service/glue/user_defined_function.go
index d404b66d7b0..08f63aa40b6 100644
--- a/internal/service/glue/user_defined_function.go
+++ b/internal/service/glue/user_defined_function.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package glue
 
 import (
diff --git a/internal/service/glue/user_defined_function_test.go b/internal/service/glue/user_defined_function_test.go
index f7028aece87..82964f9bcf7 100644
--- a/internal/service/glue/user_defined_function_test.go
+++ b/internal/service/glue/user_defined_function_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package glue_test
 
 import (
diff --git a/internal/service/glue/validate.go b/internal/service/glue/validate.go
index baf20f81978..764ede36143 100644
--- a/internal/service/glue/validate.go
+++ b/internal/service/glue/validate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package glue
 
 import (
diff --git a/internal/service/glue/wait.go b/internal/service/glue/wait.go
index a12ac1604a1..82594efa2a5 100644
--- a/internal/service/glue/wait.go
+++ b/internal/service/glue/wait.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package glue
 
 import (
diff --git a/internal/service/glue/workflow.go b/internal/service/glue/workflow.go
index 47a11150d39..92be05ec924 100644
--- a/internal/service/glue/workflow.go
+++ b/internal/service/glue/workflow.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package glue
 
 import (
diff --git a/internal/service/glue/workflow_test.go b/internal/service/glue/workflow_test.go
index b41e1c609f5..d10eea57fb2 100644
--- a/internal/service/glue/workflow_test.go
+++ b/internal/service/glue/workflow_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package glue_test
 
 import (
diff --git a/internal/service/grafana/find.go b/internal/service/grafana/find.go
index 7e82f83c336..eb997aa21f0 100644
--- a/internal/service/grafana/find.go
+++ b/internal/service/grafana/find.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package grafana
 
 import (
diff --git a/internal/service/grafana/generate.go b/internal/service/grafana/generate.go
index d56a3f57366..488ce62ad19 100644
--- a/internal/service/grafana/generate.go
+++ b/internal/service/grafana/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTags -ServiceTagsMap -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/grafana/license_association.go b/internal/service/grafana/license_association.go
index c949c434fdc..0d6bba4d681 100644
--- a/internal/service/grafana/license_association.go
+++ b/internal/service/grafana/license_association.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package grafana
 
 import (
diff --git a/internal/service/grafana/license_association_test.go b/internal/service/grafana/license_association_test.go
index 3e53da64833..8e37b401097 100644
--- a/internal/service/grafana/license_association_test.go
+++ b/internal/service/grafana/license_association_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package grafana_test
 
 import (
diff --git a/internal/service/grafana/role_association.go b/internal/service/grafana/role_association.go
index b6460e71561..001b4d66280 100644
--- a/internal/service/grafana/role_association.go
+++ b/internal/service/grafana/role_association.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package grafana
 
 import (
diff --git a/internal/service/grafana/role_association_test.go b/internal/service/grafana/role_association_test.go
index 8ef90aba44b..cda6c8b4b83 100644
--- a/internal/service/grafana/role_association_test.go
+++ b/internal/service/grafana/role_association_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package grafana_test
 
 import (
diff --git a/internal/service/grafana/service_package_gen.go b/internal/service/grafana/service_package_gen.go
index 450f52d0b02..1eceaa2c05a 100644
--- a/internal/service/grafana/service_package_gen.go
+++ b/internal/service/grafana/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	managedgrafana_sdkv1 "github.com/aws/aws-sdk-go/service/managedgrafana"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -71,4 +72,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*m
 	return managedgrafana_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/grafana/status.go b/internal/service/grafana/status.go
index 8e21ce7b7eb..1d42b9e430d 100644
--- a/internal/service/grafana/status.go
+++ b/internal/service/grafana/status.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package grafana
 
 import (
diff --git a/internal/service/grafana/sweep.go b/internal/service/grafana/sweep.go
index c4c14133d13..8a6605113a6 100644
--- a/internal/service/grafana/sweep.go
+++ b/internal/service/grafana/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package grafana
 
@@ -12,9 +12,10 @@ import (
 	"github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_grafana_workspace", &resource.Sweeper{
 		Name: "aws_grafana_workspace",
 		F:    sweepWorkSpaces,
@@ -23,7 +24,7 @@ func init() {
 
 func sweepWorkSpaces(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -40,7 +41,6 @@ func sweepWorkSpaces(region string) error {
 			return false
 		}
 		for _, workspace := range page.Workspaces {
-
 			id := aws.StringValue(workspace.Id)
 			log.Printf("[INFO] Deleting Grafana Workspace: %s", id)
 			r := ResourceWorkspace()
@@ -62,11 +62,11 @@ func sweepWorkSpaces(region string) error {
 		errs = multierror.Append(errs, fmt.Errorf("listing Grafana Workspace for %s: %w", region, err))
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("sweeping Grafana Workspace for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Grafana Workspace sweep for %s: %s", region, errs)
 		return nil
 	}
diff --git a/internal/service/grafana/tags_gen.go b/internal/service/grafana/tags_gen.go
index eafde3435d8..28ced98ebb6 100644
--- a/internal/service/grafana/tags_gen.go
+++ b/internal/service/grafana/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/managedgrafana"
 	"github.com/aws/aws-sdk-go/service/managedgrafana/managedgrafanaiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -54,7 +56,7 @@ func Tags(tags tftags.KeyValueTags) map[string]*string {
 	return aws.StringMap(tags.Map())
 }
 
-// KeyValueTags creates KeyValueTags from grafana service tags.
+// KeyValueTags creates tftags.KeyValueTags from grafana service tags.
 func KeyValueTags(ctx context.Context, tags map[string]*string) tftags.KeyValueTags {
 	return tftags.New(ctx, tags)
 }
@@ -85,6 +87,8 @@ func updateTags(ctx context.Context, conn managedgrafanaiface.ManagedGrafanaAPI,
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.Grafana)
 	if len(removedTags) > 0 {
diff --git a/internal/service/grafana/test-fixtures/idp_metadata.xml b/internal/service/grafana/test-fixtures/idp_metadata.xml
index 00fd50a5c2d..0232bb547bf 100644
--- a/internal/service/grafana/test-fixtures/idp_metadata.xml
+++ b/internal/service/grafana/test-fixtures/idp_metadata.xml
@@ -1,4 +1,9 @@
 <?xml version="1.0" encoding="UTF-8"?>
+<!--
+ Copyright (c) HashiCorp, Inc.
+ SPDX-License-Identifier: MPL-2.0
+-->
+
 <md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
                      entityID="https://terraform-dev-ed.my.salesforce.com" validUntil="2025-09-02T18:27:19.710Z">
     <md:IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
diff --git a/internal/service/grafana/wait.go b/internal/service/grafana/wait.go
index 2b5f59091ea..9f0da986e6e 100644
--- a/internal/service/grafana/wait.go
+++ b/internal/service/grafana/wait.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package grafana
 
 import (
@@ -27,7 +30,7 @@ func waitWorkspaceCreated(ctx context.Context, conn *managedgrafana.ManagedGrafa
 
 func waitWorkspaceUpdated(ctx context.Context, conn *managedgrafana.ManagedGrafana, id string, timeout time.Duration) (*managedgrafana.WorkspaceDescription, error) { //nolint:unparam
 	stateConf := &retry.StateChangeConf{
-		Pending: []string{managedgrafana.WorkspaceStatusUpdating},
+		Pending: []string{managedgrafana.WorkspaceStatusUpdating, managedgrafana.WorkspaceStatusVersionUpdating},
 		Target:  []string{managedgrafana.WorkspaceStatusActive},
 		Refresh: statusWorkspaceStatus(ctx, conn, id),
 		Timeout: timeout,
diff --git a/internal/service/grafana/workspace.go b/internal/service/grafana/workspace.go
index b3c070b0754..2d001daf864 100644
--- a/internal/service/grafana/workspace.go
+++ b/internal/service/grafana/workspace.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package grafana
 
 import (
@@ -90,7 +93,6 @@ func ResourceWorkspace() *schema.Resource {
 			},
 			"grafana_version": {
 				Type:     schema.TypeString,
-				ForceNew: true,
 				Optional: true,
 				Computed: true,
 			},
@@ -209,12 +211,16 @@ func resourceWorkspaceCreate(ctx context.Context, d *schema.ResourceData, meta i
 		input.WorkspaceDescription = aws.String(v.(string))
 	}
 
+	if v, ok := d.GetOk("grafana_version"); ok {
+		input.GrafanaVersion = aws.String(v.(string))
+	}
+
 	if v, ok := d.GetOk("name"); ok {
 		input.WorkspaceName = aws.String(v.(string))
 	}
 
-	if v, ok := d.GetOk("grafana_version"); ok {
-		input.GrafanaVersion = aws.String(v.(string))
+	if v, ok := d.GetOk("network_access_control"); ok {
+		input.NetworkAccessControl = expandNetworkAccessControl(v.([]interface{}))
 	}
 
 	if v, ok := d.GetOk("notification_destinations"); ok {
@@ -241,11 +247,6 @@ func resourceWorkspaceCreate(ctx context.Context, d *schema.ResourceData, meta i
 		input.VpcConfiguration = expandVPCConfiguration(v.([]interface{}))
 	}
 
-	if v, ok := d.GetOk("network_access_control"); ok {
-		input.NetworkAccessControl = expandNetworkAccessControl(v.([]interface{}))
-	}
-
-	log.Printf("[DEBUG] Creating Grafana Workspace: %s", input)
 	output, err := conn.CreateWorkspaceWithContext(ctx, input)
 
 	if err != nil {
@@ -293,6 +294,9 @@ func resourceWorkspaceRead(ctx context.Context, d *schema.ResourceData, meta int
 	d.Set("endpoint", workspace.Endpoint)
 	d.Set("grafana_version", workspace.GrafanaVersion)
 	d.Set("name", workspace.Name)
+	if err := d.Set("network_access_control", flattenNetworkAccessControl(workspace.NetworkAccessControl)); err != nil {
+		return sdkdiag.AppendErrorf(diags, "setting network_access_control: %s", err)
+	}
 	d.Set("notification_destinations", workspace.NotificationDestinations)
 	d.Set("organization_role_name", workspace.OrganizationRoleName)
 	d.Set("organizational_units", workspace.OrganizationalUnits)
@@ -300,15 +304,10 @@ func resourceWorkspaceRead(ctx context.Context, d *schema.ResourceData, meta int
 	d.Set("role_arn", workspace.WorkspaceRoleArn)
 	d.Set("saml_configuration_status", workspace.Authentication.SamlConfigurationStatus)
 	d.Set("stack_set_name", workspace.StackSetName)
-
 	if err := d.Set("vpc_configuration", flattenVPCConfiguration(workspace.VpcConfiguration)); err != nil {
 		return sdkdiag.AppendErrorf(diags, "setting vpc_configuration: %s", err)
 	}
 
-	if err := d.Set("network_access_control", flattenNetworkAccessControl(workspace.NetworkAccessControl)); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting network_access_control: %s", err)
-	}
-
 	setTagsOut(ctx, workspace.Tags)
 
 	input := &managedgrafana.DescribeWorkspaceConfigurationInput{
@@ -318,7 +317,7 @@ func resourceWorkspaceRead(ctx context.Context, d *schema.ResourceData, meta int
 	output, err := conn.DescribeWorkspaceConfigurationWithContext(ctx, input)
 
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "reading Grafana Workspace (%s): %s", d.Id(), err)
+		return sdkdiag.AppendErrorf(diags, "reading Grafana Workspace (%s) configuration: %s", d.Id(), err)
 	}
 
 	d.Set("configuration", output.Configuration)
@@ -330,7 +329,7 @@ func resourceWorkspaceUpdate(ctx context.Context, d *schema.ResourceData, meta i
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).GrafanaConn(ctx)
 
-	if d.HasChangesExcept("configuration", "tags", "tags_all") {
+	if d.HasChangesExcept("configuration", "grafana_version", "tags", "tags_all") {
 		input := &managedgrafana.UpdateWorkspaceInput{
 			WorkspaceId: aws.String(d.Id()),
 		}
@@ -351,6 +350,16 @@ func resourceWorkspaceUpdate(ctx context.Context, d *schema.ResourceData, meta i
 			input.WorkspaceName = aws.String(d.Get("name").(string))
 		}
 
+		if d.HasChange("network_access_control") {
+			if v, ok := d.Get("network_access_control").([]interface{}); ok {
+				if len(v) > 0 {
+					input.NetworkAccessControl = expandNetworkAccessControl(v)
+				} else {
+					input.RemoveNetworkAccessConfiguration = aws.Bool(true)
+				}
+			}
+		}
+
 		if d.HasChange("notification_destinations") {
 			input.WorkspaceNotificationDestinations = flex.ExpandStringList(d.Get("notification_destinations").([]interface{}))
 		}
@@ -385,16 +394,6 @@ func resourceWorkspaceUpdate(ctx context.Context, d *schema.ResourceData, meta i
 			}
 		}
 
-		if d.HasChange("network_access_control") {
-			if v, ok := d.Get("network_access_control").([]interface{}); ok {
-				if len(v) > 0 {
-					input.NetworkAccessControl = expandNetworkAccessControl(v)
-				} else {
-					input.RemoveNetworkAccessConfiguration = aws.Bool(true)
-				}
-			}
-		}
-
 		_, err := conn.UpdateWorkspaceWithContext(ctx, input)
 
 		if err != nil {
@@ -406,10 +405,14 @@ func resourceWorkspaceUpdate(ctx context.Context, d *schema.ResourceData, meta i
 		}
 	}
 
-	if d.HasChange("configuration") {
+	if d.HasChanges("configuration", "grafana_version") {
 		input := &managedgrafana.UpdateWorkspaceConfigurationInput{
-			WorkspaceId:   aws.String(d.Id()),
 			Configuration: aws.String(d.Get("configuration").(string)),
+			WorkspaceId:   aws.String(d.Id()),
+		}
+
+		if d.HasChange("grafana_version") {
+			input.GrafanaVersion = aws.String(d.Get("grafana_version").(string))
 		}
 
 		_, err := conn.UpdateWorkspaceConfigurationWithContext(ctx, input)
@@ -419,7 +422,7 @@ func resourceWorkspaceUpdate(ctx context.Context, d *schema.ResourceData, meta i
 		}
 
 		if _, err := waitWorkspaceUpdated(ctx, conn, d.Id(), d.Timeout(schema.TimeoutUpdate)); err != nil {
-			return sdkdiag.AppendErrorf(diags, "updating Grafana Workspace (%s) configuration: waiting for completion: %s", d.Id(), err)
+			return sdkdiag.AppendErrorf(diags, "waiting for Grafana Workspace (%s) configuration update: %s", d.Id(), err)
 		}
 	}
 
diff --git a/internal/service/grafana/workspace_api_key.go b/internal/service/grafana/workspace_api_key.go
index 641c9f3452b..14fc7fa53ec 100644
--- a/internal/service/grafana/workspace_api_key.go
+++ b/internal/service/grafana/workspace_api_key.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package grafana
 
 import (
diff --git a/internal/service/grafana/workspace_api_key_test.go b/internal/service/grafana/workspace_api_key_test.go
index a8eb76a4c50..baf2c137279 100644
--- a/internal/service/grafana/workspace_api_key_test.go
+++ b/internal/service/grafana/workspace_api_key_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package grafana_test
 
 import (
diff --git a/internal/service/grafana/workspace_data_source.go b/internal/service/grafana/workspace_data_source.go
index f79db0a1cb3..637117400f6 100644
--- a/internal/service/grafana/workspace_data_source.go
+++ b/internal/service/grafana/workspace_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package grafana
 
 import (
diff --git a/internal/service/grafana/workspace_data_source_test.go b/internal/service/grafana/workspace_data_source_test.go
index 154778ee8fb..c3c07b2ad26 100644
--- a/internal/service/grafana/workspace_data_source_test.go
+++ b/internal/service/grafana/workspace_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package grafana_test
 
 import (
@@ -24,7 +27,6 @@ func testAccWorkspaceDataSource_basic(t *testing.T) {
 			{
 				Config: testAccWorkspaceDataSourceConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckWorkspaceExists(ctx, dataSourceName),
 					resource.TestCheckResourceAttrPair(resourceName, "account_access_type", dataSourceName, "account_access_type"),
 					resource.TestCheckResourceAttrPair(resourceName, "arn", dataSourceName, "arn"),
 					resource.TestCheckResourceAttrPair(resourceName, "authentication_providers.#", dataSourceName, "authentication_providers.#"),
diff --git a/internal/service/grafana/workspace_saml_configuration.go b/internal/service/grafana/workspace_saml_configuration.go
index d3c24b89a92..bd6d3e89f5d 100644
--- a/internal/service/grafana/workspace_saml_configuration.go
+++ b/internal/service/grafana/workspace_saml_configuration.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package grafana
 
 import (
diff --git a/internal/service/grafana/workspace_saml_configuration_test.go b/internal/service/grafana/workspace_saml_configuration_test.go
index 75952774f63..cde05adee6c 100644
--- a/internal/service/grafana/workspace_saml_configuration_test.go
+++ b/internal/service/grafana/workspace_saml_configuration_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package grafana_test
 
 import (
diff --git a/internal/service/grafana/workspace_test.go b/internal/service/grafana/workspace_test.go
index a492a84fcaf..e987fdc6cae 100644
--- a/internal/service/grafana/workspace_test.go
+++ b/internal/service/grafana/workspace_test.go
@@ -1,11 +1,16 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package grafana_test
 
 import (
 	"context"
+	"errors"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
+	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/managedgrafana"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -63,6 +68,7 @@ func TestAccGrafana_serial(t *testing.T) {
 
 func testAccWorkspace_saml(t *testing.T) {
 	ctx := acctest.Context(t)
+	var v managedgrafana.WorkspaceDescription
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_grafana_workspace.test"
 	iamRoleResourceName := "aws_iam_role.test"
@@ -76,8 +82,8 @@ func testAccWorkspace_saml(t *testing.T) {
 			{
 				Config: testAccWorkspaceConfig_authenticationProvider(rName, "SAML"),
 				Check: resource.ComposeAggregateTestCheckFunc(
-					testAccCheckWorkspaceExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "grafana", regexp.MustCompile(`/workspaces/.+`)),
+					testAccCheckWorkspaceExists(ctx, resourceName, &v),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "grafana", regexache.MustCompile(`/workspaces/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "account_access_type", managedgrafana.AccountAccessTypeCurrentAccount),
 					resource.TestCheckResourceAttr(resourceName, "authentication_providers.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "authentication_providers.0", managedgrafana.AuthenticationProviderTypesSaml),
@@ -109,6 +115,7 @@ func testAccWorkspace_saml(t *testing.T) {
 
 func testAccWorkspace_vpc(t *testing.T) {
 	ctx := acctest.Context(t)
+	var v managedgrafana.WorkspaceDescription
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_grafana_workspace.test"
 
@@ -121,7 +128,7 @@ func testAccWorkspace_vpc(t *testing.T) {
 			{
 				Config: testAccWorkspaceConfig_vpc(rName, 2),
 				Check: resource.ComposeAggregateTestCheckFunc(
-					testAccCheckWorkspaceExists(ctx, resourceName),
+					testAccCheckWorkspaceExists(ctx, resourceName, &v),
 					resource.TestCheckResourceAttr(resourceName, "vpc_configuration.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "vpc_configuration.0.security_group_ids.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "vpc_configuration.0.subnet_ids.#", "2"),
@@ -135,7 +142,7 @@ func testAccWorkspace_vpc(t *testing.T) {
 			{
 				Config: testAccWorkspaceConfig_vpc(rName, 3),
 				Check: resource.ComposeAggregateTestCheckFunc(
-					testAccCheckWorkspaceExists(ctx, resourceName),
+					testAccCheckWorkspaceExists(ctx, resourceName, &v),
 					resource.TestCheckResourceAttr(resourceName, "vpc_configuration.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "vpc_configuration.0.security_group_ids.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "vpc_configuration.0.subnet_ids.#", "3"),
@@ -144,7 +151,7 @@ func testAccWorkspace_vpc(t *testing.T) {
 			{
 				Config: testAccWorkspaceConfig_vpcRemoved(rName, 3),
 				Check: resource.ComposeAggregateTestCheckFunc(
-					testAccCheckWorkspaceExists(ctx, resourceName),
+					testAccCheckWorkspaceExists(ctx, resourceName, &v),
 					resource.TestCheckResourceAttr(resourceName, "vpc_configuration.#", "0"),
 				),
 			},
@@ -154,6 +161,7 @@ func testAccWorkspace_vpc(t *testing.T) {
 
 func testAccWorkspace_sso(t *testing.T) {
 	ctx := acctest.Context(t)
+	var v managedgrafana.WorkspaceDescription
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_grafana_workspace.test"
 	iamRoleResourceName := "aws_iam_role.test"
@@ -171,8 +179,8 @@ func testAccWorkspace_sso(t *testing.T) {
 			{
 				Config: testAccWorkspaceConfig_authenticationProvider(rName, "AWS_SSO"),
 				Check: resource.ComposeAggregateTestCheckFunc(
-					testAccCheckWorkspaceExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "grafana", regexp.MustCompile(`/workspaces/.+`)),
+					testAccCheckWorkspaceExists(ctx, resourceName, &v),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "grafana", regexache.MustCompile(`/workspaces/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "account_access_type", managedgrafana.AccountAccessTypeCurrentAccount),
 					resource.TestCheckResourceAttr(resourceName, "authentication_providers.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "authentication_providers.0", managedgrafana.AuthenticationProviderTypesAwsSso),
@@ -202,6 +210,7 @@ func testAccWorkspace_sso(t *testing.T) {
 
 func testAccWorkspace_disappears(t *testing.T) {
 	ctx := acctest.Context(t)
+	var v managedgrafana.WorkspaceDescription
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_grafana_workspace.test"
 
@@ -214,7 +223,7 @@ func testAccWorkspace_disappears(t *testing.T) {
 			{
 				Config: testAccWorkspaceConfig_authenticationProvider(rName, "SAML"),
 				Check: resource.ComposeAggregateTestCheckFunc(
-					testAccCheckWorkspaceExists(ctx, resourceName),
+					testAccCheckWorkspaceExists(ctx, resourceName, &v),
 					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfgrafana.ResourceWorkspace(), resourceName),
 				),
 				ExpectNonEmptyPlan: true,
@@ -225,6 +234,7 @@ func testAccWorkspace_disappears(t *testing.T) {
 
 func testAccWorkspace_organization(t *testing.T) {
 	ctx := acctest.Context(t)
+	var v managedgrafana.WorkspaceDescription
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_grafana_workspace.test"
 
@@ -242,7 +252,7 @@ func testAccWorkspace_organization(t *testing.T) {
 			{
 				Config: testAccWorkspaceConfig_organization(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckWorkspaceExists(ctx, resourceName),
+					testAccCheckWorkspaceExists(ctx, resourceName, &v),
 					resource.TestCheckResourceAttr(resourceName, "account_access_type", managedgrafana.AccountAccessTypeOrganization),
 					resource.TestCheckResourceAttr(resourceName, "authentication_providers.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "authentication_providers.0", managedgrafana.AuthenticationProviderTypesSaml),
@@ -261,6 +271,7 @@ func testAccWorkspace_organization(t *testing.T) {
 
 func testAccWorkspace_tags(t *testing.T) {
 	ctx := acctest.Context(t)
+	var v managedgrafana.WorkspaceDescription
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_grafana_workspace.test"
 
@@ -273,7 +284,7 @@ func testAccWorkspace_tags(t *testing.T) {
 			{
 				Config: testAccWorkspaceConfig_tags1(rName, "key1", "value1"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckWorkspaceExists(ctx, resourceName),
+					testAccCheckWorkspaceExists(ctx, resourceName, &v),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
 				),
@@ -286,7 +297,7 @@ func testAccWorkspace_tags(t *testing.T) {
 			{
 				Config: testAccWorkspaceConfig_tags2(rName, "key1", "value1updated", "key2", "value2"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckWorkspaceExists(ctx, resourceName),
+					testAccCheckWorkspaceExists(ctx, resourceName, &v),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1updated"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
@@ -295,7 +306,7 @@ func testAccWorkspace_tags(t *testing.T) {
 			{
 				Config: testAccWorkspaceConfig_tags1(rName, "key2", "value2"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckWorkspaceExists(ctx, resourceName),
+					testAccCheckWorkspaceExists(ctx, resourceName, &v),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
 				),
@@ -306,6 +317,7 @@ func testAccWorkspace_tags(t *testing.T) {
 
 func testAccWorkspace_dataSources(t *testing.T) {
 	ctx := acctest.Context(t)
+	var v managedgrafana.WorkspaceDescription
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_grafana_workspace.test"
 	iamRoleResourceName := "aws_iam_role.test"
@@ -319,8 +331,8 @@ func testAccWorkspace_dataSources(t *testing.T) {
 			{
 				Config: testAccWorkspaceConfig_dataSources(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
-					testAccCheckWorkspaceExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "grafana", regexp.MustCompile(`/workspaces/.+`)),
+					testAccCheckWorkspaceExists(ctx, resourceName, &v),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "grafana", regexache.MustCompile(`/workspaces/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "account_access_type", managedgrafana.AccountAccessTypeCurrentAccount),
 					resource.TestCheckResourceAttr(resourceName, "authentication_providers.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "authentication_providers.0", managedgrafana.AuthenticationProviderTypesSaml),
@@ -352,6 +364,7 @@ func testAccWorkspace_dataSources(t *testing.T) {
 
 func testAccWorkspace_permissionType(t *testing.T) {
 	ctx := acctest.Context(t)
+	var v managedgrafana.WorkspaceDescription
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_grafana_workspace.test"
 
@@ -364,7 +377,7 @@ func testAccWorkspace_permissionType(t *testing.T) {
 			{
 				Config: testAccWorkspaceConfig_permissionType(rName, "CUSTOMER_MANAGED"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckWorkspaceExists(ctx, resourceName),
+					testAccCheckWorkspaceExists(ctx, resourceName, &v),
 					resource.TestCheckResourceAttr(resourceName, "permission_type", managedgrafana.PermissionTypeCustomerManaged),
 				),
 			},
@@ -376,7 +389,7 @@ func testAccWorkspace_permissionType(t *testing.T) {
 			{
 				Config: testAccWorkspaceConfig_permissionType(rName, "SERVICE_MANAGED"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckWorkspaceExists(ctx, resourceName),
+					testAccCheckWorkspaceExists(ctx, resourceName, &v),
 					resource.TestCheckResourceAttr(resourceName, "permission_type", managedgrafana.PermissionTypeServiceManaged),
 				),
 			},
@@ -386,6 +399,7 @@ func testAccWorkspace_permissionType(t *testing.T) {
 
 func testAccWorkspace_notificationDestinations(t *testing.T) {
 	ctx := acctest.Context(t)
+	var v managedgrafana.WorkspaceDescription
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_grafana_workspace.test"
 
@@ -398,7 +412,7 @@ func testAccWorkspace_notificationDestinations(t *testing.T) {
 			{
 				Config: testAccWorkspaceConfig_authenticationProvider(rName, "SAML"),
 				Check: resource.ComposeAggregateTestCheckFunc(
-					testAccCheckWorkspaceExists(ctx, resourceName),
+					testAccCheckWorkspaceExists(ctx, resourceName, &v),
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
 					resource.TestCheckResourceAttrSet(resourceName, "name"),
 					resource.TestCheckResourceAttr(resourceName, "notification_destinations.#", "0"),
@@ -407,7 +421,7 @@ func testAccWorkspace_notificationDestinations(t *testing.T) {
 			{
 				Config: testAccWorkspaceConfig_notificationDestinations(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckWorkspaceExists(ctx, resourceName),
+					testAccCheckWorkspaceExists(ctx, resourceName, &v),
 					resource.TestCheckResourceAttr(resourceName, "description", rName),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "notification_destinations.#", "1"),
@@ -425,6 +439,7 @@ func testAccWorkspace_notificationDestinations(t *testing.T) {
 
 func testAccWorkspace_configuration(t *testing.T) {
 	ctx := acctest.Context(t)
+	var v managedgrafana.WorkspaceDescription
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_grafana_workspace.test"
 
@@ -437,7 +452,7 @@ func testAccWorkspace_configuration(t *testing.T) {
 			{
 				Config: testAccWorkspaceConfig_configuration(rName, `{"unifiedAlerting": { "enabled": true }}`),
 				Check: resource.ComposeAggregateTestCheckFunc(
-					testAccCheckWorkspaceExists(ctx, resourceName),
+					testAccCheckWorkspaceExists(ctx, resourceName, &v),
 					resource.TestCheckResourceAttr(resourceName, "configuration", `{"unifiedAlerting":{"enabled":true}}`),
 				),
 			},
@@ -449,7 +464,7 @@ func testAccWorkspace_configuration(t *testing.T) {
 			{
 				Config: testAccWorkspaceConfig_configuration(rName, `{"unifiedAlerting": { "enabled": false }}`),
 				Check: resource.ComposeAggregateTestCheckFunc(
-					testAccCheckWorkspaceExists(ctx, resourceName),
+					testAccCheckWorkspaceExists(ctx, resourceName, &v),
 					resource.TestCheckResourceAttr(resourceName, "configuration", `{"unifiedAlerting":{"enabled":false}}`),
 				),
 			},
@@ -459,6 +474,7 @@ func testAccWorkspace_configuration(t *testing.T) {
 
 func testAccWorkspace_networkAccess(t *testing.T) {
 	ctx := acctest.Context(t)
+	var v managedgrafana.WorkspaceDescription
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_grafana_workspace.test"
 
@@ -471,7 +487,7 @@ func testAccWorkspace_networkAccess(t *testing.T) {
 			{
 				Config: testAccWorkspaceConfig_networkAccess(rName, 1),
 				Check: resource.ComposeAggregateTestCheckFunc(
-					testAccCheckWorkspaceExists(ctx, resourceName),
+					testAccCheckWorkspaceExists(ctx, resourceName, &v),
 					resource.TestCheckResourceAttr(resourceName, "network_access_control.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "network_access_control.0.prefix_list_ids.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "network_access_control.0.vpce_ids.#", "1"),
@@ -485,7 +501,7 @@ func testAccWorkspace_networkAccess(t *testing.T) {
 			{
 				Config: testAccWorkspaceConfig_networkAccess(rName, 2),
 				Check: resource.ComposeAggregateTestCheckFunc(
-					testAccCheckWorkspaceExists(ctx, resourceName),
+					testAccCheckWorkspaceExists(ctx, resourceName, &v),
 					resource.TestCheckResourceAttr(resourceName, "network_access_control.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "network_access_control.0.prefix_list_ids.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "network_access_control.0.vpce_ids.#", "2"),
@@ -494,7 +510,7 @@ func testAccWorkspace_networkAccess(t *testing.T) {
 			{
 				Config: testAccWorkspaceConfig_networkAccessRemoved(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
-					testAccCheckWorkspaceExists(ctx, resourceName),
+					testAccCheckWorkspaceExists(ctx, resourceName, &v),
 					resource.TestCheckResourceAttr(resourceName, "network_access_control.#", "0"),
 				),
 			},
@@ -504,6 +520,7 @@ func testAccWorkspace_networkAccess(t *testing.T) {
 
 func testAccWorkspace_version(t *testing.T) {
 	ctx := acctest.Context(t)
+	var v1, v2 managedgrafana.WorkspaceDescription
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_grafana_workspace.test"
 
@@ -514,10 +531,10 @@ func testAccWorkspace_version(t *testing.T) {
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		Steps: []resource.TestStep{
 			{
-				Config: testAccWorkspaceConfig_version(rName, "9.4"),
+				Config: testAccWorkspaceConfig_version(rName, "8.4"),
 				Check: resource.ComposeAggregateTestCheckFunc(
-					testAccCheckWorkspaceExists(ctx, resourceName),
-					resource.TestCheckResourceAttr(resourceName, "grafana_version", "9.4"),
+					testAccCheckWorkspaceExists(ctx, resourceName, &v1),
+					resource.TestCheckResourceAttr(resourceName, "grafana_version", "8.4"),
 				),
 			},
 			{
@@ -525,15 +542,23 @@ func testAccWorkspace_version(t *testing.T) {
 				ImportState:       true,
 				ImportStateVerify: true,
 			},
+			{
+				Config: testAccWorkspaceConfig_version(rName, "9.4"),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckWorkspaceExists(ctx, resourceName, &v2),
+					resource.TestCheckResourceAttr(resourceName, "grafana_version", "9.4"),
+					testAccCheckWorkspaceNotRecreated(&v2, &v1),
+				),
+			},
 		},
 	})
 }
 
-func testAccCheckWorkspaceExists(ctx context.Context, name string) resource.TestCheckFunc {
+func testAccCheckWorkspaceExists(ctx context.Context, n string, v *managedgrafana.WorkspaceDescription) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		rs, ok := s.RootModule().Resources[name]
+		rs, ok := s.RootModule().Resources[n]
 		if !ok {
-			return fmt.Errorf("Not found: %s", name)
+			return fmt.Errorf("Not found: %s", n)
 		}
 
 		if rs.Primary.ID == "" {
@@ -542,9 +567,15 @@ func testAccCheckWorkspaceExists(ctx context.Context, name string) resource.Test
 
 		conn := acctest.Provider.Meta().(*conns.AWSClient).GrafanaConn(ctx)
 
-		_, err := tfgrafana.FindWorkspaceByID(ctx, conn, rs.Primary.ID)
+		output, err := tfgrafana.FindWorkspaceByID(ctx, conn, rs.Primary.ID)
+
+		if err != nil {
+			return err
+		}
+
+		*v = *output
 
-		return err
+		return nil
 	}
 }
 
@@ -573,6 +604,16 @@ func testAccCheckWorkspaceDestroy(ctx context.Context) resource.TestCheckFunc {
 	}
 }
 
+func testAccCheckWorkspaceNotRecreated(i, j *managedgrafana.WorkspaceDescription) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		if aws.StringValue(i.Id) != aws.StringValue(j.Id) {
+			return errors.New("Grafana Workspace was recreated")
+		}
+
+		return nil
+	}
+}
+
 func testAccWorkspaceConfig_base(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_iam_role" "test" {
diff --git a/internal/service/greengrass/generate.go b/internal/service/greengrass/generate.go
index aba889e1e4f..dc1f07e6d4e 100644
--- a/internal/service/greengrass/generate.go
+++ b/internal/service/greengrass/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTags -ServiceTagsMap -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/greengrass/service_package_gen.go b/internal/service/greengrass/service_package_gen.go
index fb3b2660201..8ed2f760003 100644
--- a/internal/service/greengrass/service_package_gen.go
+++ b/internal/service/greengrass/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	greengrass_sdkv1 "github.com/aws/aws-sdk-go/service/greengrass"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -41,4 +42,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*g
 	return greengrass_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/greengrass/tags_gen.go b/internal/service/greengrass/tags_gen.go
index 306b08538fe..656a2df5a50 100644
--- a/internal/service/greengrass/tags_gen.go
+++ b/internal/service/greengrass/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/greengrass"
 	"github.com/aws/aws-sdk-go/service/greengrass/greengrassiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -54,7 +56,7 @@ func Tags(tags tftags.KeyValueTags) map[string]*string {
 	return aws.StringMap(tags.Map())
 }
 
-// KeyValueTags creates KeyValueTags from greengrass service tags.
+// KeyValueTags creates tftags.KeyValueTags from greengrass service tags.
 func KeyValueTags(ctx context.Context, tags map[string]*string) tftags.KeyValueTags {
 	return tftags.New(ctx, tags)
 }
@@ -85,6 +87,8 @@ func updateTags(ctx context.Context, conn greengrassiface.GreengrassAPI, identif
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.Greengrass)
 	if len(removedTags) > 0 {
diff --git a/internal/service/guardduty/detector.go b/internal/service/guardduty/detector.go
index e2837338920..1e15ae1bd6e 100644
--- a/internal/service/guardduty/detector.go
+++ b/internal/service/guardduty/detector.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package guardduty
 
 import (
@@ -38,12 +41,10 @@ func ResourceDetector() *schema.Resource {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
-
 			"arn": {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
-
 			"datasources": {
 				Type:     schema.TypeList,
 				MaxItems: 1,
@@ -51,20 +52,6 @@ func ResourceDetector() *schema.Resource {
 				Computed: true,
 				Elem: &schema.Resource{
 					Schema: map[string]*schema.Schema{
-						"s3_logs": {
-							Type:     schema.TypeList,
-							Optional: true,
-							Computed: true,
-							MaxItems: 1,
-							Elem: &schema.Resource{
-								Schema: map[string]*schema.Schema{
-									"enable": {
-										Type:     schema.TypeBool,
-										Required: true,
-									},
-								},
-							},
-						},
 						"kubernetes": {
 							Type:     schema.TypeList,
 							Optional: true,
@@ -120,16 +107,28 @@ func ResourceDetector() *schema.Resource {
 								},
 							},
 						},
+						"s3_logs": {
+							Type:     schema.TypeList,
+							Optional: true,
+							Computed: true,
+							MaxItems: 1,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"enable": {
+										Type:     schema.TypeBool,
+										Required: true,
+									},
+								},
+							},
+						},
 					},
 				},
 			},
-
 			"enable": {
 				Type:     schema.TypeBool,
 				Optional: true,
 				Default:  true,
 			},
-
 			// finding_publishing_frequency is marked as Computed:true since
 			// GuardDuty member accounts inherit setting from master account
 			"finding_publishing_frequency": {
@@ -137,7 +136,6 @@ func ResourceDetector() *schema.Resource {
 				Optional: true,
 				Computed: true,
 			},
-
 			names.AttrTags:    tftags.TagsSchema(),
 			names.AttrTagsAll: tftags.TagsSchemaComputed(),
 		},
@@ -150,24 +148,25 @@ func resourceDetectorCreate(ctx context.Context, d *schema.ResourceData, meta in
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).GuardDutyConn(ctx)
 
-	input := guardduty.CreateDetectorInput{
+	input := &guardduty.CreateDetectorInput{
 		Enable: aws.Bool(d.Get("enable").(bool)),
 		Tags:   getTagsIn(ctx),
 	}
 
+	if v, ok := d.GetOk("datasources"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
+		input.DataSources = expandDataSourceConfigurations(v.([]interface{})[0].(map[string]interface{}))
+	}
+
 	if v, ok := d.GetOk("finding_publishing_frequency"); ok {
 		input.FindingPublishingFrequency = aws.String(v.(string))
 	}
 
-	if v, ok := d.GetOk("datasources"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
-		input.DataSources = expandDataSourceConfigurations(v.([]interface{})[0].(map[string]interface{}))
-	}
+	output, err := conn.CreateDetectorWithContext(ctx, input)
 
-	log.Printf("[DEBUG] Creating GuardDuty Detector: %s", input)
-	output, err := conn.CreateDetectorWithContext(ctx, &input)
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "Creating GuardDuty Detector failed: %s", err)
+		return sdkdiag.AppendErrorf(diags, "creating GuardDuty Detector: %s", err)
 	}
+
 	d.SetId(aws.StringValue(output.DetectorId))
 
 	return append(diags, resourceDetectorRead(ctx, d, meta)...)
@@ -177,21 +176,19 @@ func resourceDetectorRead(ctx context.Context, d *schema.ResourceData, meta inte
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).GuardDutyConn(ctx)
 
-	input := guardduty.GetDetectorInput{
-		DetectorId: aws.String(d.Id()),
+	gdo, err := FindDetectorByID(ctx, conn, d.Id())
+
+	if !d.IsNewResource() && tfresource.NotFound(err) {
+		log.Printf("[WARN] GuardDuty Detector (%s) not found, removing from state", d.Id())
+		d.SetId("")
+		return diags
 	}
 
-	log.Printf("[DEBUG] Reading GuardDuty Detector: %s", input)
-	gdo, err := conn.GetDetectorWithContext(ctx, &input)
 	if err != nil {
-		if tfawserr.ErrMessageContains(err, guardduty.ErrCodeBadRequestException, "The request is rejected because the input detectorId is not owned by the current account.") {
-			log.Printf("[WARN] GuardDuty detector %q not found, removing from state", d.Id())
-			d.SetId("")
-			return diags
-		}
-		return sdkdiag.AppendErrorf(diags, "Reading GuardDuty Detector '%s' failed: %s", d.Id(), err)
+		return sdkdiag.AppendErrorf(diags, "reading GuardDuty Detector (%s): %s", d.Id(), err)
 	}
 
+	d.Set("account_id", meta.(*conns.AWSClient).AccountID)
 	arn := arn.ARN{
 		Partition: meta.(*conns.AWSClient).Partition,
 		Region:    meta.(*conns.AWSClient).Region,
@@ -201,8 +198,6 @@ func resourceDetectorRead(ctx context.Context, d *schema.ResourceData, meta inte
 	}.String()
 	d.Set("arn", arn)
 
-	d.Set("account_id", meta.(*conns.AWSClient).AccountID)
-
 	if gdo.DataSources != nil {
 		if err := d.Set("datasources", []interface{}{flattenDataSourceConfigurationsResult(gdo.DataSources)}); err != nil {
 			return sdkdiag.AppendErrorf(diags, "setting datasources: %s", err)
@@ -210,7 +205,6 @@ func resourceDetectorRead(ctx context.Context, d *schema.ResourceData, meta inte
 	} else {
 		d.Set("datasources", nil)
 	}
-
 	d.Set("enable", aws.StringValue(gdo.Status) == guardduty.DetectorStatusEnabled)
 	d.Set("finding_publishing_frequency", gdo.FindingPublishingFrequency)
 
@@ -224,7 +218,7 @@ func resourceDetectorUpdate(ctx context.Context, d *schema.ResourceData, meta in
 	conn := meta.(*conns.AWSClient).GuardDutyConn(ctx)
 
 	if d.HasChangesExcept("tags", "tags_all") {
-		input := guardduty.UpdateDetectorInput{
+		input := &guardduty.UpdateDetectorInput{
 			DetectorId:                 aws.String(d.Id()),
 			Enable:                     aws.Bool(d.Get("enable").(bool)),
 			FindingPublishingFrequency: aws.String(d.Get("finding_publishing_frequency").(string)),
@@ -234,8 +228,8 @@ func resourceDetectorUpdate(ctx context.Context, d *schema.ResourceData, meta in
 			input.DataSources = expandDataSourceConfigurations(d.Get("datasources").([]interface{})[0].(map[string]interface{}))
 		}
 
-		log.Printf("[DEBUG] Update GuardDuty Detector: %s", input)
-		_, err := conn.UpdateDetectorWithContext(ctx, &input)
+		_, err := conn.UpdateDetectorWithContext(ctx, input)
+
 		if err != nil {
 			return sdkdiag.AppendErrorf(diags, "updating GuardDuty Detector (%s): %s", d.Id(), err)
 		}
@@ -248,26 +242,15 @@ func resourceDetectorDelete(ctx context.Context, d *schema.ResourceData, meta in
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).GuardDutyConn(ctx)
 
-	input := &guardduty.DeleteDetectorInput{
-		DetectorId: aws.String(d.Id()),
-	}
-
-	err := retry.RetryContext(ctx, membershipPropagationTimeout, func() *retry.RetryError {
-		_, err := conn.DeleteDetectorWithContext(ctx, input)
-
-		if tfawserr.ErrMessageContains(err, guardduty.ErrCodeBadRequestException, "cannot delete detector while it has invited or associated members") {
-			return retry.RetryableError(err)
-		}
-
-		if err != nil {
-			return retry.NonRetryableError(err)
-		}
-
-		return nil
-	})
+	log.Printf("[DEBUG] Deleting GuardDuty Detector: %s", d.Id())
+	_, err := tfresource.RetryWhenAWSErrMessageContains(ctx, membershipPropagationTimeout, func() (interface{}, error) {
+		return conn.DeleteDetectorWithContext(ctx, &guardduty.DeleteDetectorInput{
+			DetectorId: aws.String(d.Id()),
+		})
+	}, guardduty.ErrCodeBadRequestException, "cannot delete detector while it has invited or associated members")
 
-	if tfresource.TimedOut(err) {
-		_, err = conn.DeleteDetectorWithContext(ctx, input)
+	if tfawserr.ErrMessageContains(err, guardduty.ErrCodeBadRequestException, "The request is rejected because the input detectorId is not owned by the current account.") {
+		return diags
 	}
 
 	if err != nil {
@@ -284,27 +267,16 @@ func expandDataSourceConfigurations(tfMap map[string]interface{}) *guardduty.Dat
 
 	apiObject := &guardduty.DataSourceConfigurations{}
 
-	if v, ok := tfMap["s3_logs"].([]interface{}); ok && len(v) > 0 {
-		apiObject.S3Logs = expandS3LogsConfiguration(v[0].(map[string]interface{}))
-	}
 	if v, ok := tfMap["kubernetes"].([]interface{}); ok && len(v) > 0 {
 		apiObject.Kubernetes = expandKubernetesConfiguration(v[0].(map[string]interface{}))
 	}
+
 	if v, ok := tfMap["malware_protection"].([]interface{}); ok && len(v) > 0 {
 		apiObject.MalwareProtection = expandMalwareProtectionConfiguration(v[0].(map[string]interface{}))
 	}
-	return apiObject
-}
 
-func expandS3LogsConfiguration(tfMap map[string]interface{}) *guardduty.S3LogsConfiguration {
-	if tfMap == nil {
-		return nil
-	}
-
-	apiObject := &guardduty.S3LogsConfiguration{}
-
-	if v, ok := tfMap["enable"].(bool); ok {
-		apiObject.Enable = aws.Bool(v)
+	if v, ok := tfMap["s3_logs"].([]interface{}); ok && len(v) > 0 {
+		apiObject.S3Logs = expandS3LogsConfiguration(v[0].(map[string]interface{}))
 	}
 
 	return apiObject
@@ -360,11 +332,11 @@ func expandMalwareProtectionConfiguration(tfMap map[string]interface{}) *guarddu
 	}
 
 	return &guardduty.MalwareProtectionConfiguration{
-		ScanEc2InstanceWithFindings: expandMalwareProtectionScanEC2InstanceWithFindingsConfiguration(m),
+		ScanEc2InstanceWithFindings: expandScanEc2InstanceWithFindings(m),
 	}
 }
 
-func expandMalwareProtectionScanEC2InstanceWithFindingsConfiguration(tfMap map[string]interface{}) *guardduty.ScanEc2InstanceWithFindings {
+func expandScanEc2InstanceWithFindings(tfMap map[string]interface{}) *guardduty.ScanEc2InstanceWithFindings { // nosemgrep:ci.caps3-in-func-name
 	if tfMap == nil {
 		return nil
 	}
@@ -382,6 +354,7 @@ func expandMalwareProtectionScanEC2InstanceWithFindingsConfiguration(tfMap map[s
 	apiObject := &guardduty.ScanEc2InstanceWithFindings{
 		EbsVolumes: expandMalwareProtectionEBSVolumesConfiguration(m),
 	}
+
 	return apiObject
 }
 
@@ -399,6 +372,20 @@ func expandMalwareProtectionEBSVolumesConfiguration(tfMap map[string]interface{}
 	return apiObject
 }
 
+func expandS3LogsConfiguration(tfMap map[string]interface{}) *guardduty.S3LogsConfiguration {
+	if tfMap == nil {
+		return nil
+	}
+
+	apiObject := &guardduty.S3LogsConfiguration{}
+
+	if v, ok := tfMap["enable"].(bool); ok {
+		apiObject.Enable = aws.Bool(v)
+	}
+
+	return apiObject
+}
+
 func flattenDataSourceConfigurationsResult(apiObject *guardduty.DataSourceConfigurationsResult) map[string]interface{} {
 	if apiObject == nil {
 		return nil
@@ -406,10 +393,6 @@ func flattenDataSourceConfigurationsResult(apiObject *guardduty.DataSourceConfig
 
 	tfMap := map[string]interface{}{}
 
-	if v := apiObject.S3Logs; v != nil {
-		tfMap["s3_logs"] = []interface{}{flattenS3LogsConfigurationResult(v)}
-	}
-
 	if v := apiObject.Kubernetes; v != nil {
 		tfMap["kubernetes"] = []interface{}{flattenKubernetesConfiguration(v)}
 	}
@@ -418,18 +401,8 @@ func flattenDataSourceConfigurationsResult(apiObject *guardduty.DataSourceConfig
 		tfMap["malware_protection"] = []interface{}{flattenMalwareProtectionConfiguration(v)}
 	}
 
-	return tfMap
-}
-
-func flattenS3LogsConfigurationResult(apiObject *guardduty.S3LogsConfigurationResult) map[string]interface{} {
-	if apiObject == nil {
-		return nil
-	}
-
-	tfMap := map[string]interface{}{}
-
-	if v := apiObject.Status; v != nil {
-		tfMap["enable"] = aws.StringValue(v) == guardduty.DataSourceStatusEnabled
+	if v := apiObject.S3Logs; v != nil {
+		tfMap["s3_logs"] = []interface{}{flattenS3LogsConfigurationResult(v)}
 	}
 
 	return tfMap
@@ -471,13 +444,13 @@ func flattenMalwareProtectionConfiguration(apiObject *guardduty.MalwareProtectio
 	tfMap := map[string]interface{}{}
 
 	if v := apiObject.ScanEc2InstanceWithFindings; v != nil {
-		tfMap["scan_ec2_instance_with_findings"] = []interface{}{flattenMalwareProtectionScanEC2InstanceWithFindingsConfigurationResult(v)}
+		tfMap["scan_ec2_instance_with_findings"] = []interface{}{flattenScanEc2InstanceWithFindingsResult(v)}
 	}
 
 	return tfMap
 }
 
-func flattenMalwareProtectionScanEC2InstanceWithFindingsConfigurationResult(apiObject *guardduty.ScanEc2InstanceWithFindingsResult) map[string]interface{} {
+func flattenScanEc2InstanceWithFindingsResult(apiObject *guardduty.ScanEc2InstanceWithFindingsResult) map[string]interface{} { // nosemgrep:ci.caps3-in-func-name
 	if apiObject == nil {
 		return nil
 	}
@@ -485,13 +458,27 @@ func flattenMalwareProtectionScanEC2InstanceWithFindingsConfigurationResult(apiO
 	tfMap := map[string]interface{}{}
 
 	if v := apiObject.EbsVolumes; v != nil {
-		tfMap["ebs_volumes"] = []interface{}{flattenMalwareProtectionEBSVolumesConfigurationResult(v)}
+		tfMap["ebs_volumes"] = []interface{}{flattenEbsVolumesResult(v)}
+	}
+
+	return tfMap
+}
+
+func flattenEbsVolumesResult(apiObject *guardduty.EbsVolumesResult) map[string]interface{} { // nosemgrep:ci.caps3-in-func-name
+	if apiObject == nil {
+		return nil
+	}
+
+	tfMap := map[string]interface{}{}
+
+	if v := apiObject.Status; v != nil {
+		tfMap["enable"] = aws.StringValue(v) == guardduty.DataSourceStatusEnabled
 	}
 
 	return tfMap
 }
 
-func flattenMalwareProtectionEBSVolumesConfigurationResult(apiObject *guardduty.EbsVolumesResult) map[string]interface{} {
+func flattenS3LogsConfigurationResult(apiObject *guardduty.S3LogsConfigurationResult) map[string]interface{} {
 	if apiObject == nil {
 		return nil
 	}
@@ -504,3 +491,60 @@ func flattenMalwareProtectionEBSVolumesConfigurationResult(apiObject *guardduty.
 
 	return tfMap
 }
+
+func FindDetectorByID(ctx context.Context, conn *guardduty.GuardDuty, id string) (*guardduty.GetDetectorOutput, error) {
+	input := &guardduty.GetDetectorInput{
+		DetectorId: aws.String(id),
+	}
+
+	output, err := conn.GetDetectorWithContext(ctx, input)
+
+	if tfawserr.ErrMessageContains(err, guardduty.ErrCodeBadRequestException, "The request is rejected because the input detectorId is not owned by the current account.") {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	if output == nil {
+		return nil, tfresource.NewEmptyResultError(input)
+	}
+
+	return output, nil
+}
+
+// FindDetector returns the ID of the current account's active GuardDuty detector.
+func FindDetector(ctx context.Context, conn *guardduty.GuardDuty) (*string, error) {
+	output, err := findDetectors(ctx, conn)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return tfresource.AssertSinglePtrResult(output)
+}
+
+func findDetectors(ctx context.Context, conn *guardduty.GuardDuty) ([]*string, error) {
+	input := &guardduty.ListDetectorsInput{}
+	var output []*string
+
+	err := conn.ListDetectorsPagesWithContext(ctx, input, func(page *guardduty.ListDetectorsOutput, lastPage bool) bool {
+		if page == nil {
+			return !lastPage
+		}
+
+		output = append(output, page.DetectorIds...)
+
+		return !lastPage
+	})
+
+	if err != nil {
+		return nil, err
+	}
+
+	return output, nil
+}
diff --git a/internal/service/guardduty/detector_data_source.go b/internal/service/guardduty/detector_data_source.go
index e03f4e6db4e..fb83731ef11 100644
--- a/internal/service/guardduty/detector_data_source.go
+++ b/internal/service/guardduty/detector_data_source.go
@@ -1,10 +1,12 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package guardduty
 
 import (
 	"context"
 
 	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/guardduty"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
@@ -17,20 +19,52 @@ func DataSourceDetector() *schema.Resource {
 		ReadWithoutTimeout: dataSourceDetectorRead,
 
 		Schema: map[string]*schema.Schema{
-			"id": {
+			"features": {
+				Type:     schema.TypeList,
+				Computed: true,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"additional_configuration": {
+							Computed: true,
+							Type:     schema.TypeList,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"name": {
+										Type:     schema.TypeString,
+										Computed: true,
+									},
+									"status": {
+										Type:     schema.TypeString,
+										Computed: true,
+									},
+								},
+							},
+						},
+						"name": {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+						"status": {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+					},
+				},
+			},
+			"finding_publishing_frequency": {
 				Type:     schema.TypeString,
-				Optional: true,
 				Computed: true,
 			},
-			"status": {
+			"id": {
 				Type:     schema.TypeString,
+				Optional: true,
 				Computed: true,
 			},
 			"service_role_arn": {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
-			"finding_publishing_frequency": {
+			"status": {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
@@ -42,43 +76,35 @@ func dataSourceDetectorRead(ctx context.Context, d *schema.ResourceData, meta in
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).GuardDutyConn(ctx)
 
-	detectorId := d.Get("id").(string)
+	detectorID := d.Get("id").(string)
 
-	if detectorId == "" {
-		input := &guardduty.ListDetectorsInput{}
+	if detectorID == "" {
+		output, err := FindDetector(ctx, conn)
 
-		resp, err := conn.ListDetectorsWithContext(ctx, input)
 		if err != nil {
-			return sdkdiag.AppendErrorf(diags, "listing GuardDuty Detectors: %s", err)
-		}
-
-		if resp == nil || len(resp.DetectorIds) == 0 {
-			return sdkdiag.AppendErrorf(diags, "no GuardDuty Detectors found")
-		}
-		if len(resp.DetectorIds) > 1 {
-			return sdkdiag.AppendErrorf(diags, "multiple GuardDuty Detectors found; please use the `id` argument to look up a single detector")
+			return sdkdiag.AppendErrorf(diags, "reading this account's single GuardDuty Detector: %s", err)
 		}
 
-		detectorId = aws.StringValue(resp.DetectorIds[0])
+		detectorID = aws.StringValue(output)
 	}
 
-	getInput := &guardduty.GetDetectorInput{
-		DetectorId: aws.String(detectorId),
-	}
+	gdo, err := FindDetectorByID(ctx, conn, detectorID)
 
-	getResp, err := conn.GetDetectorWithContext(ctx, getInput)
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "reading GuardDuty Detector (%s): %s", detectorId, err)
+		return sdkdiag.AppendErrorf(diags, "reading GuardDuty Detector (%s): %s", detectorID, err)
 	}
 
-	if getResp == nil {
-		return sdkdiag.AppendErrorf(diags, "reading GuardDuty Detector (%s): empty result", detectorId)
+	d.SetId(detectorID)
+	if gdo.Features != nil {
+		if err := d.Set("features", flattenDetectorFeatureConfigurationResults(gdo.Features)); err != nil {
+			return sdkdiag.AppendErrorf(diags, "setting features: %s", err)
+		}
+	} else {
+		d.Set("features", nil)
 	}
-
-	d.SetId(detectorId)
-	d.Set("status", getResp.Status)
-	d.Set("service_role_arn", getResp.ServiceRole)
-	d.Set("finding_publishing_frequency", getResp.FindingPublishingFrequency)
+	d.Set("finding_publishing_frequency", gdo.FindingPublishingFrequency)
+	d.Set("service_role_arn", gdo.ServiceRole)
+	d.Set("status", gdo.Status)
 
 	return diags
 }
diff --git a/internal/service/guardduty/detector_data_source_test.go b/internal/service/guardduty/detector_data_source_test.go
index 1d158ea2e54..0b20056ef19 100644
--- a/internal/service/guardduty/detector_data_source_test.go
+++ b/internal/service/guardduty/detector_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package guardduty_test
 
 import (
@@ -10,23 +13,26 @@ import (
 
 func testAccDetectorDataSource_basic(t *testing.T) {
 	ctx := acctest.Context(t)
+	datasourceName := "data.aws_guardduty_detector.test"
+	resourceName := "aws_guardduty_detector.test"
+
 	resource.Test(t, resource.TestCase{
-		PreCheck:                  func() { acctest.PreCheck(ctx, t) },
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			testAccPreCheckDetectorNotExists(ctx, t)
+		},
 		ErrorCheck:                acctest.ErrorCheck(t, guardduty.EndpointsID),
 		ProtoV5ProviderFactories:  acctest.ProtoV5ProviderFactories,
 		PreventPostDestroyRefresh: true,
 		Steps: []resource.TestStep{
 			{
-				Config: testAccDetectorDataSourceConfig_basicResource(),
-				Check:  resource.ComposeTestCheckFunc(),
-			},
-			{
-				Config: testAccDetectorDataSourceConfig_basicResource2(),
-				Check: resource.ComposeTestCheckFunc(
-					resource.TestCheckResourceAttrPair("data.aws_guardduty_detector.test", "id", "aws_guardduty_detector.test", "id"),
-					resource.TestCheckResourceAttr("data.aws_guardduty_detector.test", "status", "ENABLED"),
-					acctest.CheckResourceAttrGlobalARN("data.aws_guardduty_detector.test", "service_role_arn", "iam", "role/aws-service-role/guardduty.amazonaws.com/AWSServiceRoleForAmazonGuardDuty"),
-					resource.TestCheckResourceAttrPair("data.aws_guardduty_detector.test", "finding_publishing_frequency", "aws_guardduty_detector.test", "finding_publishing_frequency"),
+				Config: testAccDetectorDataSourceConfig_basic,
+				Check: resource.ComposeAggregateTestCheckFunc(
+					acctest.CheckResourceAttrGreaterThanValue(datasourceName, "features.#", 0),
+					resource.TestCheckResourceAttrPair(datasourceName, "finding_publishing_frequency", resourceName, "finding_publishing_frequency"),
+					resource.TestCheckResourceAttrPair(datasourceName, "id", resourceName, "id"),
+					acctest.CheckResourceAttrGlobalARN(datasourceName, "service_role_arn", "iam", "role/aws-service-role/guardduty.amazonaws.com/AWSServiceRoleForAmazonGuardDuty"),
+					resource.TestCheckResourceAttr(datasourceName, "status", "ENABLED"),
 				),
 			},
 		},
@@ -35,44 +41,43 @@ func testAccDetectorDataSource_basic(t *testing.T) {
 
 func testAccDetectorDataSource_ID(t *testing.T) {
 	ctx := acctest.Context(t)
+	datasourceName := "data.aws_guardduty_detector.test"
+	resourceName := "aws_guardduty_detector.test"
+
 	resource.Test(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			testAccPreCheckDetectorNotExists(ctx, t)
+		},
 		ErrorCheck:               acctest.ErrorCheck(t, guardduty.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		Steps: []resource.TestStep{
 			{
-				Config: testAccDetectorDataSourceConfig_explicit(),
-				Check: resource.ComposeTestCheckFunc(
-					resource.TestCheckResourceAttrPair("data.aws_guardduty_detector.test", "id", "aws_guardduty_detector.test", "id"),
-					resource.TestCheckResourceAttr("data.aws_guardduty_detector.test", "status", "ENABLED"),
-					acctest.CheckResourceAttrGlobalARN("data.aws_guardduty_detector.test", "service_role_arn", "iam", "role/aws-service-role/guardduty.amazonaws.com/AWSServiceRoleForAmazonGuardDuty"),
-					resource.TestCheckResourceAttrPair("data.aws_guardduty_detector.test", "finding_publishing_frequency", "aws_guardduty_detector.test", "finding_publishing_frequency"),
+				Config: testAccDetectorDataSourceConfig_id,
+				Check: resource.ComposeAggregateTestCheckFunc(
+					acctest.CheckResourceAttrGreaterThanValue(datasourceName, "features.#", 0),
+					resource.TestCheckResourceAttrPair(datasourceName, "finding_publishing_frequency", resourceName, "finding_publishing_frequency"),
+					resource.TestCheckResourceAttrPair(datasourceName, "id", resourceName, "id"),
+					acctest.CheckResourceAttrGlobalARN(datasourceName, "service_role_arn", "iam", "role/aws-service-role/guardduty.amazonaws.com/AWSServiceRoleForAmazonGuardDuty"),
+					resource.TestCheckResourceAttr(datasourceName, "status", "ENABLED"),
 				),
 			},
 		},
 	})
 }
 
-func testAccDetectorDataSourceConfig_basicResource() string {
-	return `
-resource "aws_guardduty_detector" "test" {}
-`
-}
-
-func testAccDetectorDataSourceConfig_basicResource2() string {
-	return `
+const testAccDetectorDataSourceConfig_basic = `
 resource "aws_guardduty_detector" "test" {}
 
-data "aws_guardduty_detector" "test" {}
-`
+data "aws_guardduty_detector" "test" {
+  depends_on = [aws_guardduty_detector.test]
 }
+`
 
-func testAccDetectorDataSourceConfig_explicit() string {
-	return `
+const testAccDetectorDataSourceConfig_id = `
 resource "aws_guardduty_detector" "test" {}
 
 data "aws_guardduty_detector" "test" {
   id = aws_guardduty_detector.test.id
 }
 `
-}
diff --git a/internal/service/guardduty/detector_feature.go b/internal/service/guardduty/detector_feature.go
new file mode 100644
index 00000000000..b69ec950975
--- /dev/null
+++ b/internal/service/guardduty/detector_feature.go
@@ -0,0 +1,284 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package guardduty
+
+import (
+	"context"
+	"fmt"
+	"log"
+	"strings"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/guardduty"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
+	tfslices "github.com/hashicorp/terraform-provider-aws/internal/slices"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+)
+
+// @SDKResource("aws_guardduty_detector_feature", name="Detector Feature")
+func ResourceDetectorFeature() *schema.Resource {
+	return &schema.Resource{
+		CreateWithoutTimeout: resourceDetectorFeaturePut,
+		ReadWithoutTimeout:   resourceDetectorFeatureRead,
+		UpdateWithoutTimeout: resourceDetectorFeaturePut,
+		DeleteWithoutTimeout: schema.NoopContext,
+
+		Schema: map[string]*schema.Schema{
+			"additional_configuration": {
+				Optional: true,
+				ForceNew: true,
+				Type:     schema.TypeList,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"name": {
+							Type:         schema.TypeString,
+							Required:     true,
+							ForceNew:     true,
+							ValidateFunc: validation.StringInSlice(guardduty.FeatureAdditionalConfiguration_Values(), false),
+						},
+						"status": {
+							Type:         schema.TypeString,
+							Required:     true,
+							ValidateFunc: validation.StringInSlice(guardduty.FeatureStatus_Values(), false),
+						},
+					},
+				},
+			},
+			"detector_id": {
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+			"name": {
+				Type:         schema.TypeString,
+				Required:     true,
+				ForceNew:     true,
+				ValidateFunc: validation.StringInSlice(guardduty.DetectorFeature_Values(), false),
+			},
+			"status": {
+				Type:         schema.TypeString,
+				Required:     true,
+				ValidateFunc: validation.StringInSlice(guardduty.FeatureStatus_Values(), false),
+			},
+		},
+	}
+}
+
+func resourceDetectorFeaturePut(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).GuardDutyConn(ctx)
+
+	detectorID, name := d.Get("detector_id").(string), d.Get("name").(string)
+	feature := &guardduty.DetectorFeatureConfiguration{
+		Name:   aws.String(name),
+		Status: aws.String(d.Get("status").(string)),
+	}
+
+	if v, ok := d.GetOk("additional_configuration"); ok && len(v.([]interface{})) > 0 {
+		feature.AdditionalConfiguration = expandDetectorAdditionalConfigurations(v.([]interface{}))
+	}
+
+	input := &guardduty.UpdateDetectorInput{
+		DetectorId: aws.String(detectorID),
+		Features:   []*guardduty.DetectorFeatureConfiguration{feature},
+	}
+
+	_, err := conn.UpdateDetectorWithContext(ctx, input)
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "updating GuardDuty Detector (%s) Feature (%s): %s", detectorID, name, err)
+	}
+
+	if d.IsNewResource() {
+		d.SetId(detectorFeatureCreateResourceID(detectorID, name))
+	}
+
+	return append(diags, resourceDetectorFeatureRead(ctx, d, meta)...)
+}
+
+func resourceDetectorFeatureRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).GuardDutyConn(ctx)
+
+	detectorID, name, err := detectorFeatureParseResourceID(d.Id())
+	if err != nil {
+		return sdkdiag.AppendFromErr(diags, err)
+	}
+
+	feature, err := FindDetectorFeatureByTwoPartKey(ctx, conn, detectorID, name)
+
+	if !d.IsNewResource() && tfresource.NotFound(err) {
+		log.Printf("[WARN] GuardDuty Detector Feature (%s) not found, removing from state", d.Id())
+		d.SetId("")
+		return diags
+	}
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "reading GuardDuty Detector Feature (%s): %s", d.Id(), err)
+	}
+
+	if err := d.Set("additional_configuration", flattenDetectorAdditionalConfigurationResults(feature.AdditionalConfiguration)); err != nil {
+		return sdkdiag.AppendErrorf(diags, "setting additional_configuration: %s", err)
+	}
+	d.Set("detector_id", detectorID)
+	d.Set("name", feature.Name)
+	d.Set("status", feature.Status)
+
+	return diags
+}
+
+const detectorFeatureResourceIDSeparator = "/"
+
+func detectorFeatureCreateResourceID(detectorID, name string) string {
+	parts := []string{detectorID, name}
+	id := strings.Join(parts, detectorFeatureResourceIDSeparator)
+
+	return id
+}
+
+func detectorFeatureParseResourceID(id string) (string, string, error) {
+	parts := strings.Split(id, detectorFeatureResourceIDSeparator)
+
+	if len(parts) == 2 && parts[0] != "" && parts[1] != "" {
+		return parts[0], parts[1], nil
+	}
+
+	return "", "", fmt.Errorf("unexpected format for ID (%[1]s), expected DETECTORID%[2]sFEATURENAME", id, detectorFeatureResourceIDSeparator)
+}
+
+func FindDetectorFeatureByTwoPartKey(ctx context.Context, conn *guardduty.GuardDuty, detectorID, name string) (*guardduty.DetectorFeatureConfigurationResult, error) {
+	output, err := FindDetectorByID(ctx, conn, detectorID)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return tfresource.AssertSinglePtrResult(tfslices.Filter(output.Features, func(v *guardduty.DetectorFeatureConfigurationResult) bool {
+		return aws.StringValue(v.Name) == name
+	}))
+}
+
+func expandDetectorAdditionalConfiguration(tfMap map[string]interface{}) *guardduty.DetectorAdditionalConfiguration {
+	if tfMap == nil {
+		return nil
+	}
+
+	apiObject := &guardduty.DetectorAdditionalConfiguration{}
+
+	if v, ok := tfMap["name"].(string); ok && v != "" {
+		apiObject.Name = aws.String(v)
+	}
+
+	if v, ok := tfMap["status"].(string); ok && v != "" {
+		apiObject.Status = aws.String(v)
+	}
+
+	return apiObject
+}
+
+func expandDetectorAdditionalConfigurations(tfList []interface{}) []*guardduty.DetectorAdditionalConfiguration {
+	if len(tfList) == 0 {
+		return nil
+	}
+
+	var apiObjects []*guardduty.DetectorAdditionalConfiguration
+
+	for _, tfMapRaw := range tfList {
+		tfMap, ok := tfMapRaw.(map[string]interface{})
+
+		if !ok {
+			continue
+		}
+
+		apiObject := expandDetectorAdditionalConfiguration(tfMap)
+
+		if apiObject == nil {
+			continue
+		}
+
+		apiObjects = append(apiObjects, apiObject)
+	}
+
+	return apiObjects
+}
+
+func flattenDetectorFeatureConfigurationResult(apiObject *guardduty.DetectorFeatureConfigurationResult) map[string]interface{} {
+	if apiObject == nil {
+		return nil
+	}
+
+	tfMap := map[string]interface{}{}
+
+	if v := apiObject.AdditionalConfiguration; v != nil {
+		tfMap["additional_configuration"] = flattenDetectorAdditionalConfigurationResults(v)
+	}
+
+	if v := apiObject.Name; v != nil {
+		tfMap["name"] = aws.StringValue(v)
+	}
+
+	if v := apiObject.Status; v != nil {
+		tfMap["status"] = aws.StringValue(v)
+	}
+
+	return tfMap
+}
+
+func flattenDetectorFeatureConfigurationResults(apiObjects []*guardduty.DetectorFeatureConfigurationResult) []interface{} {
+	if len(apiObjects) == 0 {
+		return nil
+	}
+
+	var tfList []interface{}
+
+	for _, apiObject := range apiObjects {
+		if apiObject == nil {
+			continue
+		}
+
+		tfList = append(tfList, flattenDetectorFeatureConfigurationResult(apiObject))
+	}
+
+	return tfList
+}
+
+func flattenDetectorAdditionalConfigurationResult(apiObject *guardduty.DetectorAdditionalConfigurationResult) map[string]interface{} {
+	if apiObject == nil {
+		return nil
+	}
+
+	tfMap := map[string]interface{}{}
+
+	if v := apiObject.Name; v != nil {
+		tfMap["name"] = aws.StringValue(v)
+	}
+
+	if v := apiObject.Status; v != nil {
+		tfMap["status"] = aws.StringValue(v)
+	}
+
+	return tfMap
+}
+
+func flattenDetectorAdditionalConfigurationResults(apiObjects []*guardduty.DetectorAdditionalConfigurationResult) []interface{} {
+	if len(apiObjects) == 0 {
+		return nil
+	}
+
+	var tfList []interface{}
+
+	for _, apiObject := range apiObjects {
+		if apiObject == nil {
+			continue
+		}
+
+		tfList = append(tfList, flattenDetectorAdditionalConfigurationResult(apiObject))
+	}
+
+	return tfList
+}
diff --git a/internal/service/guardduty/detector_feature_test.go b/internal/service/guardduty/detector_feature_test.go
new file mode 100644
index 00000000000..43e5d626489
--- /dev/null
+++ b/internal/service/guardduty/detector_feature_test.go
@@ -0,0 +1,238 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package guardduty_test
+
+import (
+	"context"
+	"fmt"
+	"testing"
+
+	"github.com/aws/aws-sdk-go/service/guardduty"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
+	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	tfguardduty "github.com/hashicorp/terraform-provider-aws/internal/service/guardduty"
+)
+
+func testAccDetectorFeature_basic(t *testing.T) {
+	ctx := acctest.Context(t)
+	resourceName := "aws_guardduty_detector_feature.test"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			testAccPreCheckDetectorNotExists(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, guardduty.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             acctest.CheckDestroyNoop,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccDetectorFeatureConfig_basic("RDS_LOGIN_EVENTS", "ENABLED"),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckDetectorFeatureExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "additional_configuration.#", "0"),
+					resource.TestCheckResourceAttrSet(resourceName, "detector_id"),
+					resource.TestCheckResourceAttr(resourceName, "name", "RDS_LOGIN_EVENTS"),
+					resource.TestCheckResourceAttr(resourceName, "status", "ENABLED"),
+				),
+			},
+		},
+	})
+}
+
+func testAccDetectorFeature_additionalConfiguration(t *testing.T) {
+	ctx := acctest.Context(t)
+	resourceName := "aws_guardduty_detector_feature.test"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			testAccPreCheckDetectorNotExists(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, guardduty.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             acctest.CheckDestroyNoop,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccDetectorFeatureConfig_additionalConfiguration("ENABLED", "ENABLED"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckDetectorFeatureExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "additional_configuration.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "additional_configuration.0.name", "EKS_ADDON_MANAGEMENT"),
+					resource.TestCheckResourceAttr(resourceName, "additional_configuration.0.status", "ENABLED"),
+					resource.TestCheckResourceAttr(resourceName, "name", "EKS_RUNTIME_MONITORING"),
+					resource.TestCheckResourceAttr(resourceName, "status", "ENABLED"),
+				),
+			},
+			{
+				Config: testAccDetectorFeatureConfig_additionalConfiguration("DISABLED", "DISABLED"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckDetectorFeatureExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "additional_configuration.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "additional_configuration.0.name", "EKS_ADDON_MANAGEMENT"),
+					resource.TestCheckResourceAttr(resourceName, "additional_configuration.0.status", "DISABLED"),
+					resource.TestCheckResourceAttr(resourceName, "name", "EKS_RUNTIME_MONITORING"),
+					resource.TestCheckResourceAttr(resourceName, "status", "DISABLED"),
+				),
+			},
+			{
+				Config: testAccDetectorFeatureConfig_additionalConfiguration("ENABLED", "DISABLED"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckDetectorFeatureExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "additional_configuration.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "additional_configuration.0.name", "EKS_ADDON_MANAGEMENT"),
+					resource.TestCheckResourceAttr(resourceName, "additional_configuration.0.status", "DISABLED"),
+					resource.TestCheckResourceAttr(resourceName, "name", "EKS_RUNTIME_MONITORING"),
+					resource.TestCheckResourceAttr(resourceName, "status", "ENABLED"),
+				),
+			},
+		},
+	})
+}
+
+func testAccDetectorFeature_multiple(t *testing.T) {
+	ctx := acctest.Context(t)
+	resource1Name := "aws_guardduty_detector_feature.test1"
+	resource2Name := "aws_guardduty_detector_feature.test2"
+	resource3Name := "aws_guardduty_detector_feature.test3"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			testAccPreCheckDetectorNotExists(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, guardduty.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             acctest.CheckDestroyNoop,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccDetectorFeatureConfig_multiple("ENABLED", "DISABLED", "ENABLED"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckDetectorFeatureExists(ctx, resource1Name),
+					testAccCheckDetectorFeatureExists(ctx, resource2Name),
+					testAccCheckDetectorFeatureExists(ctx, resource3Name),
+					resource.TestCheckResourceAttr(resource1Name, "additional_configuration.#", "0"),
+					resource.TestCheckResourceAttr(resource1Name, "name", "EBS_MALWARE_PROTECTION"),
+					resource.TestCheckResourceAttr(resource1Name, "status", "ENABLED"),
+					resource.TestCheckResourceAttr(resource2Name, "additional_configuration.#", "0"),
+					resource.TestCheckResourceAttr(resource2Name, "name", "LAMBDA_NETWORK_LOGS"),
+					resource.TestCheckResourceAttr(resource2Name, "status", "DISABLED"),
+					resource.TestCheckResourceAttr(resource3Name, "additional_configuration.#", "0"),
+					resource.TestCheckResourceAttr(resource3Name, "name", "S3_DATA_EVENTS"),
+					resource.TestCheckResourceAttr(resource3Name, "status", "ENABLED"),
+				),
+			},
+			{
+				Config: testAccDetectorFeatureConfig_multiple("DISABLED", "ENABLED", "ENABLED"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckDetectorFeatureExists(ctx, resource1Name),
+					testAccCheckDetectorFeatureExists(ctx, resource2Name),
+					testAccCheckDetectorFeatureExists(ctx, resource3Name),
+					resource.TestCheckResourceAttr(resource1Name, "additional_configuration.#", "0"),
+					resource.TestCheckResourceAttr(resource1Name, "name", "EBS_MALWARE_PROTECTION"),
+					resource.TestCheckResourceAttr(resource1Name, "status", "DISABLED"),
+					resource.TestCheckResourceAttr(resource2Name, "additional_configuration.#", "0"),
+					resource.TestCheckResourceAttr(resource2Name, "name", "LAMBDA_NETWORK_LOGS"),
+					resource.TestCheckResourceAttr(resource2Name, "status", "ENABLED"),
+					resource.TestCheckResourceAttr(resource3Name, "additional_configuration.#", "0"),
+					resource.TestCheckResourceAttr(resource3Name, "name", "S3_DATA_EVENTS"),
+					resource.TestCheckResourceAttr(resource3Name, "status", "ENABLED"),
+				),
+			},
+			{
+				Config: testAccDetectorFeatureConfig_multiple("DISABLED", "DISABLED", "DISABLED"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckDetectorFeatureExists(ctx, resource1Name),
+					testAccCheckDetectorFeatureExists(ctx, resource2Name),
+					testAccCheckDetectorFeatureExists(ctx, resource3Name),
+					resource.TestCheckResourceAttr(resource1Name, "additional_configuration.#", "0"),
+					resource.TestCheckResourceAttr(resource1Name, "name", "EBS_MALWARE_PROTECTION"),
+					resource.TestCheckResourceAttr(resource1Name, "status", "DISABLED"),
+					resource.TestCheckResourceAttr(resource2Name, "additional_configuration.#", "0"),
+					resource.TestCheckResourceAttr(resource2Name, "name", "LAMBDA_NETWORK_LOGS"),
+					resource.TestCheckResourceAttr(resource2Name, "status", "DISABLED"),
+					resource.TestCheckResourceAttr(resource3Name, "additional_configuration.#", "0"),
+					resource.TestCheckResourceAttr(resource3Name, "name", "S3_DATA_EVENTS"),
+					resource.TestCheckResourceAttr(resource3Name, "status", "DISABLED"),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckDetectorFeatureExists(ctx context.Context, n string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		conn := acctest.Provider.Meta().(*conns.AWSClient).GuardDutyConn(ctx)
+
+		_, err := tfguardduty.FindDetectorFeatureByTwoPartKey(ctx, conn, rs.Primary.Attributes["detector_id"], rs.Primary.Attributes["name"])
+
+		return err
+	}
+}
+
+func testAccDetectorFeatureConfig_basic(name, status string) string {
+	return fmt.Sprintf(`
+resource "aws_guardduty_detector" "test" {
+  enable = true
+}
+
+resource "aws_guardduty_detector_feature" "test" {
+  detector_id = aws_guardduty_detector.test.id
+  name        = %[1]q
+  status      = %[2]q
+}
+`, name, status)
+}
+
+func testAccDetectorFeatureConfig_additionalConfiguration(featureStatus, additionalConfigurationStatus string) string {
+	return fmt.Sprintf(`
+resource "aws_guardduty_detector" "test" {
+  enable = true
+}
+
+resource "aws_guardduty_detector_feature" "test" {
+  detector_id = aws_guardduty_detector.test.id
+  name        = "EKS_RUNTIME_MONITORING"
+  status      = %[1]q
+
+  additional_configuration {
+    name   = "EKS_ADDON_MANAGEMENT"
+    status = %[2]q
+  }
+}
+`, featureStatus, additionalConfigurationStatus)
+}
+
+func testAccDetectorFeatureConfig_multiple(status1, status2, status3 string) string {
+	return fmt.Sprintf(`
+resource "aws_guardduty_detector" "test" {
+  enable = true
+}
+
+resource "aws_guardduty_detector_feature" "test1" {
+  detector_id = aws_guardduty_detector.test.id
+  name        = "EBS_MALWARE_PROTECTION"
+  status      = %[1]q
+}
+
+resource "aws_guardduty_detector_feature" "test2" {
+  detector_id = aws_guardduty_detector.test.id
+  name        = "LAMBDA_NETWORK_LOGS"
+  status      = %[2]q
+}
+
+resource "aws_guardduty_detector_feature" "test3" {
+  detector_id = aws_guardduty_detector.test.id
+  name        = "S3_DATA_EVENTS"
+  status      = %[3]q
+}
+`, status1, status2, status3)
+}
diff --git a/internal/service/guardduty/detector_test.go b/internal/service/guardduty/detector_test.go
index 98b4cc79e46..b2a667e013e 100644
--- a/internal/service/guardduty/detector_test.go
+++ b/internal/service/guardduty/detector_test.go
@@ -1,18 +1,21 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package guardduty_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/aws"
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/guardduty"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	tfguardduty "github.com/hashicorp/terraform-provider-aws/internal/service/guardduty"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
 func testAccDetector_basic(t *testing.T) {
@@ -20,7 +23,10 @@ func testAccDetector_basic(t *testing.T) {
 	resourceName := "aws_guardduty_detector.test"
 
 	resource.Test(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			testAccPreCheckDetectorNotExists(ctx, t)
+		},
 		ErrorCheck:               acctest.ErrorCheck(t, guardduty.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckDetectorDestroy(ctx),
@@ -30,7 +36,7 @@ func testAccDetector_basic(t *testing.T) {
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckDetectorExists(ctx, resourceName),
 					resource.TestCheckResourceAttrSet(resourceName, "account_id"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "guardduty", regexp.MustCompile("detector/.+$")),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "guardduty", regexache.MustCompile("detector/.+$")),
 					resource.TestCheckResourceAttr(resourceName, "enable", "true"),
 					resource.TestCheckResourceAttr(resourceName, "datasources.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "datasources.0.s3_logs.0.enable", "true"),
@@ -74,7 +80,10 @@ func testAccDetector_tags(t *testing.T) {
 	resourceName := "aws_guardduty_detector.test"
 
 	resource.Test(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			testAccPreCheckDetectorNotExists(ctx, t)
+		},
 		ErrorCheck:               acctest.ErrorCheck(t, guardduty.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckDetectorDestroy(ctx),
@@ -118,7 +127,10 @@ func testAccDetector_datasources_s3logs(t *testing.T) {
 	resourceName := "aws_guardduty_detector.test"
 
 	resource.Test(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			testAccPreCheckDetectorNotExists(ctx, t)
+		},
 		ErrorCheck:               acctest.ErrorCheck(t, guardduty.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckDetectorDestroy(ctx),
@@ -155,7 +167,10 @@ func testAccDetector_datasources_kubernetes_audit_logs(t *testing.T) {
 	resourceName := "aws_guardduty_detector.test"
 
 	resource.Test(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			testAccPreCheckDetectorNotExists(ctx, t)
+		},
 		ErrorCheck:               acctest.ErrorCheck(t, guardduty.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckDetectorDestroy(ctx),
@@ -192,7 +207,10 @@ func testAccDetector_datasources_malware_protection(t *testing.T) {
 	resourceName := "aws_guardduty_detector.test"
 
 	resource.Test(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			testAccPreCheckDetectorNotExists(ctx, t)
+		},
 		ErrorCheck:               acctest.ErrorCheck(t, guardduty.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckDetectorDestroy(ctx),
@@ -232,7 +250,10 @@ func testAccDetector_datasources_all(t *testing.T) {
 	resourceName := "aws_guardduty_detector.test"
 
 	resource.Test(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			testAccPreCheckDetectorNotExists(ctx, t)
+		},
 		ErrorCheck:               acctest.ErrorCheck(t, guardduty.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckDetectorDestroy(ctx),
@@ -307,51 +328,35 @@ func testAccCheckDetectorDestroy(ctx context.Context) resource.TestCheckFunc {
 				continue
 			}
 
-			input := &guardduty.GetDetectorInput{
-				DetectorId: aws.String(rs.Primary.ID),
+			_, err := tfguardduty.FindDetectorByID(ctx, conn, rs.Primary.ID)
+
+			if tfresource.NotFound(err) {
+				continue
 			}
 
-			_, err := conn.GetDetectorWithContext(ctx, input)
 			if err != nil {
-				if tfawserr.ErrMessageContains(err, guardduty.ErrCodeBadRequestException, "The request is rejected because the input detectorId is not owned by the current account.") {
-					return nil
-				}
 				return err
 			}
 
-			return fmt.Errorf("Expected GuardDuty Detector to be destroyed, %s found", rs.Primary.ID)
+			return fmt.Errorf("GuardDuty Detector %s still exists", rs.Primary.ID)
 		}
 
 		return nil
 	}
 }
 
-func testAccCheckDetectorExists(ctx context.Context, name string) resource.TestCheckFunc {
+func testAccCheckDetectorExists(ctx context.Context, n string) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		rs, ok := s.RootModule().Resources[name]
+		rs, ok := s.RootModule().Resources[n]
 		if !ok {
-			return fmt.Errorf("Not found: %s", name)
-		}
-
-		if rs.Primary.ID == "" {
-			return fmt.Errorf("Resource (%s) has empty ID", name)
+			return fmt.Errorf("Not found: %s", n)
 		}
 
 		conn := acctest.Provider.Meta().(*conns.AWSClient).GuardDutyConn(ctx)
 
-		output, err := conn.GetDetectorWithContext(ctx, &guardduty.GetDetectorInput{
-			DetectorId: aws.String(rs.Primary.ID),
-		})
-
-		if err != nil {
-			return err
-		}
-
-		if output == nil {
-			return fmt.Errorf("GuardDuty Detector not found: %s", name)
-		}
+		_, err := tfguardduty.FindDetectorByID(ctx, conn, rs.Primary.ID)
 
-		return nil
+		return err
 	}
 }
 
diff --git a/internal/service/guardduty/filter.go b/internal/service/guardduty/filter.go
index 3151101603b..e773dc93ae3 100644
--- a/internal/service/guardduty/filter.go
+++ b/internal/service/guardduty/filter.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package guardduty
 
 import (
@@ -8,6 +11,7 @@ import (
 	"strings"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/aws/aws-sdk-go/service/guardduty"
@@ -34,29 +38,27 @@ func ResourceFilter() *schema.Resource {
 		Importer: &schema.ResourceImporter{
 			StateContext: schema.ImportStatePassthroughContext,
 		},
+
 		Schema: map[string]*schema.Schema{
+			"action": {
+				Type:         schema.TypeString,
+				Required:     true,
+				ValidateFunc: validation.StringInSlice(guardduty.FilterAction_Values(), false),
+			},
 			"arn": {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
-			"detector_id": {
-				Type:     schema.TypeString,
-				Required: true,
-				ForceNew: true,
-			},
-			"name": {
-				Type:         schema.TypeString,
-				Required:     true,
-				ForceNew:     true,
-				ValidateFunc: validation.StringLenBetween(3, 64),
-			},
 			"description": {
 				Type:         schema.TypeString,
 				Optional:     true,
 				ValidateFunc: validation.StringLenBetween(0, 512),
 			},
-			names.AttrTags:    tftags.TagsSchema(),
-			names.AttrTagsAll: tftags.TagsSchemaComputed(),
+			"detector_id": {
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
 			"finding_criteria": {
 				Type:     schema.TypeList,
 				MaxItems: 1,
@@ -69,21 +71,15 @@ func ResourceFilter() *schema.Resource {
 							Required: true,
 							Elem: &schema.Resource{
 								Schema: map[string]*schema.Schema{
-									"field": {
-										Type:     schema.TypeString,
-										Required: true,
-									},
 									"equals": {
 										Type:     schema.TypeList,
 										Optional: true,
 										MinItems: 1,
 										Elem:     &schema.Schema{Type: schema.TypeString},
 									},
-									"not_equals": {
-										Type:     schema.TypeList,
-										Optional: true,
-										MinItems: 1,
-										Elem:     &schema.Schema{Type: schema.TypeString},
+									"field": {
+										Type:     schema.TypeString,
+										Required: true,
 									},
 									"greater_than": {
 										Type:         schema.TypeString,
@@ -105,24 +101,34 @@ func ResourceFilter() *schema.Resource {
 										Optional:     true,
 										ValidateFunc: verify.ValidStringDateOrPositiveInt,
 									},
+									"not_equals": {
+										Type:     schema.TypeList,
+										Optional: true,
+										MinItems: 1,
+										Elem:     &schema.Schema{Type: schema.TypeString},
+									},
 								},
 							},
 						},
 					},
 				},
 			},
-			"action": {
+			"name": {
 				Type:     schema.TypeString,
 				Required: true,
-				ValidateFunc: validation.StringInSlice([]string{
-					guardduty.FilterActionNoop,
-					guardduty.FilterActionArchive,
-				}, false),
+				ForceNew: true,
+				ValidateFunc: validation.All(
+					validation.StringLenBetween(3, 64),
+					validation.StringMatch(regexache.MustCompile(`^[a-zA-Z0-9_.-]+$`),
+						"only alphanumeric characters, hyphens, underscores, and periods are allowed"),
+				),
 			},
 			"rank": {
 				Type:     schema.TypeInt,
 				Required: true,
 			},
+			names.AttrTags:    tftags.TagsSchema(),
+			names.AttrTagsAll: tftags.TagsSchemaComputed(),
 		},
 
 		CustomizeDiff: verify.SetTagsDiff,
diff --git a/internal/service/guardduty/filter_test.go b/internal/service/guardduty/filter_test.go
index 9938a0a45b0..6a90cf9c387 100644
--- a/internal/service/guardduty/filter_test.go
+++ b/internal/service/guardduty/filter_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package guardduty_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/acmpca"
 	"github.com/aws/aws-sdk-go/service/guardduty"
@@ -27,7 +30,10 @@ func testAccFilter_basic(t *testing.T) {
 	endDate := "2020-02-01T00:00:00Z"
 
 	resource.Test(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			testAccPreCheckDetectorNotExists(ctx, t)
+		},
 		ErrorCheck:               acctest.ErrorCheck(t, guardduty.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckFilterDestroy(ctx),
@@ -41,7 +47,7 @@ func testAccFilter_basic(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "action", "ARCHIVE"),
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
 					resource.TestCheckResourceAttr(resourceName, "rank", "1"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "guardduty", regexp.MustCompile("detector/[a-z0-9]{32}/filter/test-filter$")),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "guardduty", regexache.MustCompile("detector/[0-9a-z]{32}/filter/test-filter$")),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 					resource.TestCheckResourceAttr(resourceName, "finding_criteria.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "finding_criteria.0.criterion.#", "3"),
@@ -94,7 +100,10 @@ func testAccFilter_update(t *testing.T) {
 	endDate := "2020-02-01T00:00:00Z"
 
 	resource.Test(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			testAccPreCheckDetectorNotExists(ctx, t)
+		},
 		ErrorCheck:               acctest.ErrorCheck(t, guardduty.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckFilterDestroy(ctx),
@@ -139,7 +148,10 @@ func testAccFilter_tags(t *testing.T) {
 	endDate := "2020-02-01T00:00:00Z"
 
 	resource.Test(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			testAccPreCheckDetectorNotExists(ctx, t)
+		},
 		ErrorCheck:               acctest.ErrorCheck(t, guardduty.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckFilterDestroy(ctx),
@@ -181,7 +193,10 @@ func testAccFilter_disappears(t *testing.T) {
 	endDate := "2020-02-01T00:00:00Z"
 
 	resource.Test(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			testAccPreCheckDetectorNotExists(ctx, t)
+		},
 		ErrorCheck:               acctest.ErrorCheck(t, guardduty.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckACMPCACertificateAuthorityDestroy(ctx),
diff --git a/internal/service/guardduty/finding_ids_data_source.go b/internal/service/guardduty/finding_ids_data_source.go
index dae06c2aefc..762d6e84602 100644
--- a/internal/service/guardduty/finding_ids_data_source.go
+++ b/internal/service/guardduty/finding_ids_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package guardduty
 
 import (
@@ -11,8 +14,8 @@ import (
 	"github.com/hashicorp/terraform-plugin-framework/types"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-provider-aws/internal/create"
-	"github.com/hashicorp/terraform-provider-aws/internal/flex"
 	"github.com/hashicorp/terraform-provider-aws/internal/framework"
+	"github.com/hashicorp/terraform-provider-aws/internal/framework/flex"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
diff --git a/internal/service/guardduty/finding_ids_data_source_test.go b/internal/service/guardduty/finding_ids_data_source_test.go
index ff67c7d2b4f..2c6c5fb0f2e 100644
--- a/internal/service/guardduty/finding_ids_data_source_test.go
+++ b/internal/service/guardduty/finding_ids_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package guardduty_test
 
 import (
@@ -8,12 +11,12 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
 )
 
-func TestAccGuardDutyFindingIdsDataSource_basic(t *testing.T) {
+func testAccFindingIDsDataSource_basic(t *testing.T) {
 	ctx := acctest.Context(t)
 	dataSourceName := "data.aws_guardduty_finding_ids.test"
 	detectorDataSourceName := "data.aws_guardduty_detector.test"
 
-	resource.ParallelTest(t, resource.TestCase{
+	resource.Test(t, resource.TestCase{
 		PreCheck: func() {
 			acctest.PreCheck(ctx, t)
 			testAccPreCheckDetectorExists(ctx, t)
@@ -22,7 +25,7 @@ func TestAccGuardDutyFindingIdsDataSource_basic(t *testing.T) {
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		Steps: []resource.TestStep{
 			{
-				Config: testAccFindingIdsDataSourceConfig_basic(),
+				Config: testAccFindingIDsDataSourceConfig_basic(),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttrPair(dataSourceName, "detector_id", detectorDataSourceName, "id"),
 					resource.TestCheckResourceAttrSet(dataSourceName, "has_findings"),
@@ -33,7 +36,7 @@ func TestAccGuardDutyFindingIdsDataSource_basic(t *testing.T) {
 	})
 }
 
-func testAccFindingIdsDataSourceConfig_basic() string {
+func testAccFindingIDsDataSourceConfig_basic() string {
 	return `
 data "aws_guardduty_detector" "test" {}
 
diff --git a/internal/service/guardduty/generate.go b/internal/service/guardduty/generate.go
index 6f2298a3079..9ca05391d7b 100644
--- a/internal/service/guardduty/generate.go
+++ b/internal/service/guardduty/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTags -ServiceTagsMap -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/guardduty/guardduty_test.go b/internal/service/guardduty/guardduty_test.go
index aa791d31480..fa0ccf8b32b 100644
--- a/internal/service/guardduty/guardduty_test.go
+++ b/internal/service/guardduty/guardduty_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package guardduty_test
 
 import (
@@ -5,9 +8,10 @@ import (
 	"os"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/service/guardduty"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	tfguardduty "github.com/hashicorp/terraform-provider-aws/internal/service/guardduty"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
 func TestAccGuardDuty_serial(t *testing.T) {
@@ -24,12 +28,20 @@ func TestAccGuardDuty_serial(t *testing.T) {
 			"datasource_basic":                  testAccDetectorDataSource_basic,
 			"datasource_id":                     testAccDetectorDataSource_ID,
 		},
+		"DetectorFeature": {
+			"basic":                    testAccDetectorFeature_basic,
+			"additional_configuration": testAccDetectorFeature_additionalConfiguration,
+			"multiple":                 testAccDetectorFeature_multiple,
+		},
 		"Filter": {
 			"basic":      testAccFilter_basic,
 			"update":     testAccFilter_update,
 			"tags":       testAccFilter_tags,
 			"disappears": testAccFilter_disappears,
 		},
+		"FindingIDs": {
+			"datasource_basic": testAccFindingIDsDataSource_basic,
+		},
 		"InviteAccepter": {
 			"basic": testAccInviteAccepter_basic,
 		},
@@ -47,6 +59,11 @@ func TestAccGuardDuty_serial(t *testing.T) {
 			"kubernetes":                    testAccOrganizationConfiguration_kubernetes,
 			"malwareProtection":             testAccOrganizationConfiguration_malwareprotection,
 		},
+		"OrganizationConfigurationFeature": {
+			"basic":                    testAccOrganizationConfigurationFeature_basic,
+			"additional_configuration": testAccOrganizationConfigurationFeature_additionalConfiguration,
+			"multiple":                 testAccOrganizationConfigurationFeature_multiple,
+		},
 		"ThreatIntelSet": {
 			"basic": testAccThreatIntelSet_basic,
 			"tags":  testAccThreatIntelSet_tags,
@@ -84,20 +101,34 @@ func testAccMemberFromEnv(t *testing.T) (string, string) {
 	return accountID, email
 }
 
-// testAccPreCheckDetectorExists verifies the current account has a single active
-// GuardDuty detector configured.
+// testAccPreCheckDetectorExists verifies the current account has a single active GuardDuty detector configured.
 func testAccPreCheckDetectorExists(ctx context.Context, t *testing.T) {
 	conn := acctest.Provider.Meta().(*conns.AWSClient).GuardDutyConn(ctx)
 
-	out, err := conn.ListDetectorsWithContext(ctx, &guardduty.ListDetectorsInput{})
-	if out == nil || len(out.DetectorIds) == 0 {
-		t.Skip("this AWS account must have an existing GuardDuty detector configured")
+	_, err := tfguardduty.FindDetector(ctx, conn)
+
+	if tfresource.NotFound(err) {
+		t.Skipf("reading this AWS account's single GuardDuty Detector: %s", err)
 	}
-	if len(out.DetectorIds) > 1 {
-		t.Skipf("this AWS account must have a single existing GuardDuty detector configured. Found %d.", len(out.DetectorIds))
+
+	if err != nil {
+		t.Fatalf("listing GuardDuty Detectors: %s", err)
+	}
+}
+
+// testAccPreCheckDetectorNotExists verifies the current account has no active GuardDuty detector configured.
+func testAccPreCheckDetectorNotExists(ctx context.Context, t *testing.T) {
+	conn := acctest.Provider.Meta().(*conns.AWSClient).GuardDutyConn(ctx)
+
+	_, err := tfguardduty.FindDetector(ctx, conn)
+
+	if tfresource.NotFound(err) {
+		return
 	}
 
 	if err != nil {
 		t.Fatalf("listing GuardDuty Detectors: %s", err)
 	}
+
+	t.Skip("this AWS account has a GuardDuty Detector")
 }
diff --git a/internal/service/guardduty/invite_accepter.go b/internal/service/guardduty/invite_accepter.go
index 214b834c15a..e34966ad1ac 100644
--- a/internal/service/guardduty/invite_accepter.go
+++ b/internal/service/guardduty/invite_accepter.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package guardduty
 
 import (
diff --git a/internal/service/guardduty/invite_accepter_test.go b/internal/service/guardduty/invite_accepter_test.go
index 3cc7a3b9cd9..c9bab1c33d5 100644
--- a/internal/service/guardduty/invite_accepter_test.go
+++ b/internal/service/guardduty/invite_accepter_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package guardduty_test
 
 import (
@@ -25,6 +28,7 @@ func testAccInviteAccepter_basic(t *testing.T) {
 		PreCheck: func() {
 			acctest.PreCheck(ctx, t)
 			acctest.PreCheckAlternateAccount(t)
+			testAccPreCheckDetectorNotExists(ctx, t)
 		},
 		ErrorCheck:               acctest.ErrorCheck(t, guardduty.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5FactoriesAlternate(ctx, t),
diff --git a/internal/service/guardduty/ipset.go b/internal/service/guardduty/ipset.go
index 68a9d84234c..d3763e6ec25 100644
--- a/internal/service/guardduty/ipset.go
+++ b/internal/service/guardduty/ipset.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package guardduty
 
 import (
diff --git a/internal/service/guardduty/ipset_test.go b/internal/service/guardduty/ipset_test.go
index 48babc351e0..ac859203d1f 100644
--- a/internal/service/guardduty/ipset_test.go
+++ b/internal/service/guardduty/ipset_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package guardduty_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/guardduty"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -27,7 +30,10 @@ func testAccIPSet_basic(t *testing.T) {
 	resourceName := "aws_guardduty_ipset.test"
 
 	resource.Test(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			testAccPreCheckDetectorNotExists(ctx, t)
+		},
 		ErrorCheck:               acctest.ErrorCheck(t, guardduty.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckIPSetDestroy(ctx),
@@ -36,10 +42,10 @@ func testAccIPSet_basic(t *testing.T) {
 				Config: testAccIPSetConfig_basic(bucketName, keyName1, ipsetName1, true),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckIPSetExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "guardduty", regexp.MustCompile("detector/.+/ipset/.+$")),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "guardduty", regexache.MustCompile("detector/.+/ipset/.+$")),
 					resource.TestCheckResourceAttr(resourceName, "name", ipsetName1),
 					resource.TestCheckResourceAttr(resourceName, "activate", "true"),
-					resource.TestMatchResourceAttr(resourceName, "location", regexp.MustCompile(fmt.Sprintf("%s/%s$", bucketName, keyName1))),
+					resource.TestMatchResourceAttr(resourceName, "location", regexache.MustCompile(fmt.Sprintf("%s/%s$", bucketName, keyName1))),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 				),
 			},
@@ -54,7 +60,7 @@ func testAccIPSet_basic(t *testing.T) {
 					testAccCheckIPSetExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "name", ipsetName2),
 					resource.TestCheckResourceAttr(resourceName, "activate", "false"),
-					resource.TestMatchResourceAttr(resourceName, "location", regexp.MustCompile(fmt.Sprintf("%s/%s$", bucketName, keyName2))),
+					resource.TestMatchResourceAttr(resourceName, "location", regexache.MustCompile(fmt.Sprintf("%s/%s$", bucketName, keyName2))),
 				),
 			},
 		},
@@ -67,7 +73,10 @@ func testAccIPSet_tags(t *testing.T) {
 	resourceName := "aws_guardduty_ipset.test"
 
 	resource.Test(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			testAccPreCheckDetectorNotExists(ctx, t)
+		},
 		ErrorCheck:               acctest.ErrorCheck(t, guardduty.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckIPSetDestroy(ctx),
@@ -175,11 +184,6 @@ resource "aws_s3_bucket" "test" {
   force_destroy = true
 }
 
-resource "aws_s3_bucket_acl" "test" {
-  bucket = aws_s3_bucket.test.id
-  acl    = "private"
-}
-
 resource "aws_s3_object" "test" {
   acl     = "public-read"
   content = "10.0.0.0/8\n"
@@ -206,11 +210,6 @@ resource "aws_s3_bucket" "test" {
   force_destroy = true
 }
 
-resource "aws_s3_bucket_acl" "test" {
-  bucket = aws_s3_bucket.test.id
-  acl    = "private"
-}
-
 resource "aws_s3_object" "test" {
   acl     = "public-read"
   content = "10.0.0.0/8\n"
@@ -241,11 +240,6 @@ resource "aws_s3_bucket" "test" {
   force_destroy = true
 }
 
-resource "aws_s3_bucket_acl" "test" {
-  bucket = aws_s3_bucket.test.id
-  acl    = "private"
-}
-
 resource "aws_s3_object" "test" {
   acl     = "public-read"
   content = "10.0.0.0/8\n"
diff --git a/internal/service/guardduty/member.go b/internal/service/guardduty/member.go
index c6523f65a73..0750497d46d 100644
--- a/internal/service/guardduty/member.go
+++ b/internal/service/guardduty/member.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package guardduty
 
 import (
diff --git a/internal/service/guardduty/member_test.go b/internal/service/guardduty/member_test.go
index d9f9fafade4..c5eb68e86ba 100644
--- a/internal/service/guardduty/member_test.go
+++ b/internal/service/guardduty/member_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package guardduty_test
 
 import (
@@ -21,7 +24,10 @@ func testAccMember_basic(t *testing.T) {
 	accountID := "111111111111"
 
 	resource.Test(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			testAccPreCheckDetectorNotExists(ctx, t)
+		},
 		ErrorCheck:               acctest.ErrorCheck(t, guardduty.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckMemberDestroy(ctx),
@@ -51,7 +57,10 @@ func testAccMember_invite_disassociate(t *testing.T) {
 	accountID, email := testAccMemberFromEnv(t)
 
 	resource.Test(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			testAccPreCheckDetectorNotExists(ctx, t)
+		},
 		ErrorCheck:               acctest.ErrorCheck(t, guardduty.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckMemberDestroy(ctx),
@@ -91,7 +100,10 @@ func testAccMember_invite_onUpdate(t *testing.T) {
 	accountID, email := testAccMemberFromEnv(t)
 
 	resource.Test(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			testAccPreCheckDetectorNotExists(ctx, t)
+		},
 		ErrorCheck:               acctest.ErrorCheck(t, guardduty.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckMemberDestroy(ctx),
@@ -132,7 +144,10 @@ func testAccMember_invitationMessage(t *testing.T) {
 	invitationMessage := "inviting"
 
 	resource.Test(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			testAccPreCheckDetectorNotExists(ctx, t)
+		},
 		ErrorCheck:               acctest.ErrorCheck(t, guardduty.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckMemberDestroy(ctx),
diff --git a/internal/service/guardduty/organization_admin_account.go b/internal/service/guardduty/organization_admin_account.go
index 1f4d315ec20..c24899ec64f 100644
--- a/internal/service/guardduty/organization_admin_account.go
+++ b/internal/service/guardduty/organization_admin_account.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package guardduty
 
 import (
diff --git a/internal/service/guardduty/organization_admin_account_test.go b/internal/service/guardduty/organization_admin_account_test.go
index 39b4c1cb1a4..ff05880d3fd 100644
--- a/internal/service/guardduty/organization_admin_account_test.go
+++ b/internal/service/guardduty/organization_admin_account_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package guardduty_test
 
 import (
@@ -22,6 +25,7 @@ func testAccOrganizationAdminAccount_basic(t *testing.T) {
 		PreCheck: func() {
 			acctest.PreCheck(ctx, t)
 			acctest.PreCheckOrganizationsAccount(ctx, t)
+			testAccPreCheckDetectorNotExists(ctx, t)
 		},
 		ErrorCheck:               acctest.ErrorCheck(t, guardduty.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
diff --git a/internal/service/guardduty/organization_configuration.go b/internal/service/guardduty/organization_configuration.go
index b30c7481886..676d497b1ab 100644
--- a/internal/service/guardduty/organization_configuration.go
+++ b/internal/service/guardduty/organization_configuration.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package guardduty
 
 import (
@@ -9,18 +12,20 @@ import (
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/customdiff"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
-// @SDKResource("aws_guardduty_organization_configuration")
+// @SDKResource("aws_guardduty_organization_configuration", name="Organization Configuration")
 func ResourceOrganizationConfiguration() *schema.Resource {
 	return &schema.Resource{
-		CreateWithoutTimeout: resourceOrganizationConfigurationUpdate,
+		CreateWithoutTimeout: resourceOrganizationConfigurationPut,
 		ReadWithoutTimeout:   resourceOrganizationConfigurationRead,
-		UpdateWithoutTimeout: resourceOrganizationConfigurationUpdate,
+		UpdateWithoutTimeout: resourceOrganizationConfigurationPut,
 		DeleteWithoutTimeout: schema.NoopContext,
 
 		Importer: &schema.ResourceImporter{
@@ -35,7 +40,6 @@ func ResourceOrganizationConfiguration() *schema.Resource {
 				ExactlyOneOf: []string{"auto_enable", "auto_enable_organization_members"},
 				Deprecated:   "Use auto_enable_organization_members instead",
 			},
-
 			"auto_enable_organization_members": {
 				Type:         schema.TypeString,
 				Optional:     true,
@@ -43,7 +47,6 @@ func ResourceOrganizationConfiguration() *schema.Resource {
 				ExactlyOneOf: []string{"auto_enable", "auto_enable_organization_members"},
 				ValidateFunc: validation.StringInSlice(guardduty.AutoEnableMembers_Values(), false),
 			},
-
 			"datasources": {
 				Type:     schema.TypeList,
 				Optional: true,
@@ -51,20 +54,6 @@ func ResourceOrganizationConfiguration() *schema.Resource {
 				MaxItems: 1,
 				Elem: &schema.Resource{
 					Schema: map[string]*schema.Schema{
-						"s3_logs": {
-							Type:     schema.TypeList,
-							Optional: true,
-							Computed: true,
-							MaxItems: 1,
-							Elem: &schema.Resource{
-								Schema: map[string]*schema.Schema{
-									"auto_enable": {
-										Type:     schema.TypeBool,
-										Required: true,
-									},
-								},
-							},
-						},
 						"kubernetes": {
 							Type:     schema.TypeList,
 							Optional: true,
@@ -120,10 +109,23 @@ func ResourceOrganizationConfiguration() *schema.Resource {
 								},
 							},
 						},
+						"s3_logs": {
+							Type:     schema.TypeList,
+							Optional: true,
+							Computed: true,
+							MaxItems: 1,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"auto_enable": {
+										Type:     schema.TypeBool,
+										Required: true,
+									},
+								},
+							},
+						},
 					},
 				},
 			},
-
 			"detector_id": {
 				Type:         schema.TypeString,
 				Required:     true,
@@ -163,12 +165,11 @@ func ResourceOrganizationConfiguration() *schema.Resource {
 	}
 }
 
-func resourceOrganizationConfigurationUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+func resourceOrganizationConfigurationPut(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).GuardDutyConn(ctx)
 
 	detectorID := d.Get("detector_id").(string)
-
 	input := &guardduty.UpdateOrganizationConfigurationInput{
 		AutoEnableOrganizationMembers: aws.String(d.Get("auto_enable_organization_members").(string)),
 		DetectorId:                    aws.String(detectorID),
@@ -178,13 +179,20 @@ func resourceOrganizationConfigurationUpdate(ctx context.Context, d *schema.Reso
 		input.DataSources = expandOrganizationDataSourceConfigurations(v.([]interface{})[0].(map[string]interface{}))
 	}
 
+	// We have seen occasional acceptance test failures when updating multiple features on the same detector concurrently,
+	// so use a mutex to ensure that multiple features being updated concurrently don't trample on each other.
+	conns.GlobalMutexKV.Lock(detectorID)
+	defer conns.GlobalMutexKV.Unlock(detectorID)
+
 	_, err := conn.UpdateOrganizationConfigurationWithContext(ctx, input)
 
 	if err != nil {
 		return sdkdiag.AppendErrorf(diags, "updating GuardDuty Organization Configuration (%s): %s", detectorID, err)
 	}
 
-	d.SetId(detectorID)
+	if d.IsNewResource() {
+		d.SetId(detectorID)
+	}
 
 	return append(diags, resourceOrganizationConfigurationRead(ctx, d, meta)...)
 }
@@ -193,13 +201,9 @@ func resourceOrganizationConfigurationRead(ctx context.Context, d *schema.Resour
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).GuardDutyConn(ctx)
 
-	input := &guardduty.DescribeOrganizationConfigurationInput{
-		DetectorId: aws.String(d.Id()),
-	}
-
-	output, err := conn.DescribeOrganizationConfigurationWithContext(ctx, input)
+	output, err := FindOrganizationConfigurationByID(ctx, conn, d.Id())
 
-	if tfawserr.ErrMessageContains(err, guardduty.ErrCodeBadRequestException, "The request is rejected because the input detectorId is not owned by the current account.") {
+	if !d.IsNewResource() && tfresource.NotFound(err) {
 		log.Printf("[WARN] GuardDuty Organization Configuration (%s) not found, removing from state", d.Id())
 		d.SetId("")
 		return diags
@@ -215,7 +219,6 @@ func resourceOrganizationConfigurationRead(ctx context.Context, d *schema.Resour
 
 	d.Set("auto_enable", output.AutoEnable)
 	d.Set("auto_enable_organization_members", output.AutoEnableOrganizationMembers)
-
 	if output.DataSources != nil {
 		if err := d.Set("datasources", []interface{}{flattenOrganizationDataSourceConfigurationsResult(output.DataSources)}); err != nil {
 			return sdkdiag.AppendErrorf(diags, "setting datasources: %s", err)
@@ -223,7 +226,6 @@ func resourceOrganizationConfigurationRead(ctx context.Context, d *schema.Resour
 	} else {
 		d.Set("datasources", nil)
 	}
-
 	d.Set("detector_id", d.Id())
 
 	return diags
@@ -236,10 +238,6 @@ func expandOrganizationDataSourceConfigurations(tfMap map[string]interface{}) *g
 
 	apiObject := &guardduty.OrganizationDataSourceConfigurations{}
 
-	if v, ok := tfMap["s3_logs"].([]interface{}); ok && len(v) > 0 {
-		apiObject.S3Logs = expandOrganizationS3LogsConfiguration(v[0].(map[string]interface{}))
-	}
-
 	if v, ok := tfMap["kubernetes"].([]interface{}); ok && len(v) > 0 {
 		apiObject.Kubernetes = expandOrganizationKubernetesConfiguration(v[0].(map[string]interface{}))
 	}
@@ -248,6 +246,10 @@ func expandOrganizationDataSourceConfigurations(tfMap map[string]interface{}) *g
 		apiObject.MalwareProtection = expandOrganizationMalwareProtectionConfiguration(v[0].(map[string]interface{}))
 	}
 
+	if v, ok := tfMap["s3_logs"].([]interface{}); ok && len(v) > 0 {
+		apiObject.S3Logs = expandOrganizationS3LogsConfiguration(v[0].(map[string]interface{}))
+	}
+
 	return apiObject
 }
 
@@ -301,11 +303,11 @@ func expandOrganizationMalwareProtectionConfiguration(tfMap map[string]interface
 	}
 
 	return &guardduty.OrganizationMalwareProtectionConfiguration{
-		ScanEc2InstanceWithFindings: expandOrganizationScanEC2InstanceWithFindingsConfiguration(m),
+		ScanEc2InstanceWithFindings: expandOrganizationScanEc2InstanceWithFindings(m),
 	}
 }
 
-func expandOrganizationScanEC2InstanceWithFindingsConfiguration(tfMap map[string]interface{}) *guardduty.OrganizationScanEc2InstanceWithFindings {
+func expandOrganizationScanEc2InstanceWithFindings(tfMap map[string]interface{}) *guardduty.OrganizationScanEc2InstanceWithFindings { // nosemgrep:ci.caps3-in-func-name
 	if tfMap == nil {
 		return nil
 	}
@@ -321,11 +323,11 @@ func expandOrganizationScanEC2InstanceWithFindingsConfiguration(tfMap map[string
 	}
 
 	return &guardduty.OrganizationScanEc2InstanceWithFindings{
-		EbsVolumes: expandOrganizationEBSVolumesConfiguration(m),
+		EbsVolumes: expandOrganizationEbsVolumes(m),
 	}
 }
 
-func expandOrganizationEBSVolumesConfiguration(tfMap map[string]interface{}) *guardduty.OrganizationEbsVolumes {
+func expandOrganizationEbsVolumes(tfMap map[string]interface{}) *guardduty.OrganizationEbsVolumes { // nosemgrep:ci.caps3-in-func-name
 	if tfMap == nil {
 		return nil
 	}
@@ -394,13 +396,13 @@ func flattenOrganizationKubernetesConfigurationResult(apiObject *guardduty.Organ
 	tfMap := map[string]interface{}{}
 
 	if v := apiObject.AuditLogs; v != nil {
-		tfMap["audit_logs"] = []interface{}{flattenOrganizationKubernetesAuditLogsConfiguration(v)}
+		tfMap["audit_logs"] = []interface{}{flattenOrganizationKubernetesAuditLogsConfigurationResult(v)}
 	}
 
 	return tfMap
 }
 
-func flattenOrganizationKubernetesAuditLogsConfiguration(apiObject *guardduty.OrganizationKubernetesAuditLogsConfigurationResult) map[string]interface{} {
+func flattenOrganizationKubernetesAuditLogsConfigurationResult(apiObject *guardduty.OrganizationKubernetesAuditLogsConfigurationResult) map[string]interface{} {
 	if apiObject == nil {
 		return nil
 	}
@@ -422,13 +424,13 @@ func flattenOrganizationMalwareProtectionConfigurationResult(apiObject *guarddut
 	tfMap := map[string]interface{}{}
 
 	if v := apiObject.ScanEc2InstanceWithFindings; v != nil {
-		tfMap["scan_ec2_instance_with_findings"] = []interface{}{flattenOrganizationMalwareProtectionScanEC2InstanceWithFindingsResult(v)}
+		tfMap["scan_ec2_instance_with_findings"] = []interface{}{flattenOrganizationScanEc2InstanceWithFindingsResult(v)}
 	}
 
 	return tfMap
 }
 
-func flattenOrganizationMalwareProtectionScanEC2InstanceWithFindingsResult(apiObject *guardduty.OrganizationScanEc2InstanceWithFindingsResult) map[string]interface{} {
+func flattenOrganizationScanEc2InstanceWithFindingsResult(apiObject *guardduty.OrganizationScanEc2InstanceWithFindingsResult) map[string]interface{} { // nosemgrep:ci.caps3-in-func-name
 	if apiObject == nil {
 		return nil
 	}
@@ -436,13 +438,13 @@ func flattenOrganizationMalwareProtectionScanEC2InstanceWithFindingsResult(apiOb
 	tfMap := map[string]interface{}{}
 
 	if v := apiObject.EbsVolumes; v != nil {
-		tfMap["ebs_volumes"] = []interface{}{flattenOrganizationMalwareProtectionEBSVolumesResult(v)}
+		tfMap["ebs_volumes"] = []interface{}{flattenOrganizationEbsVolumesResult(v)}
 	}
 
 	return tfMap
 }
 
-func flattenOrganizationMalwareProtectionEBSVolumesResult(apiObject *guardduty.OrganizationEbsVolumesResult) map[string]interface{} {
+func flattenOrganizationEbsVolumesResult(apiObject *guardduty.OrganizationEbsVolumesResult) map[string]interface{} { // nosemgrep:ci.caps3-in-func-name
 	if apiObject == nil {
 		return nil
 	}
@@ -455,3 +457,28 @@ func flattenOrganizationMalwareProtectionEBSVolumesResult(apiObject *guardduty.O
 
 	return tfMap
 }
+
+func FindOrganizationConfigurationByID(ctx context.Context, conn *guardduty.GuardDuty, id string) (*guardduty.DescribeOrganizationConfigurationOutput, error) {
+	input := &guardduty.DescribeOrganizationConfigurationInput{
+		DetectorId: aws.String(id),
+	}
+
+	output, err := conn.DescribeOrganizationConfigurationWithContext(ctx, input)
+
+	if tfawserr.ErrMessageContains(err, guardduty.ErrCodeBadRequestException, "The request is rejected because the input detectorId is not owned by the current account.") {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	if output == nil {
+		return nil, tfresource.NewEmptyResultError(input)
+	}
+
+	return output, nil
+}
diff --git a/internal/service/guardduty/organization_configuration_feature.go b/internal/service/guardduty/organization_configuration_feature.go
new file mode 100644
index 00000000000..c3ec6809440
--- /dev/null
+++ b/internal/service/guardduty/organization_configuration_feature.go
@@ -0,0 +1,258 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package guardduty
+
+import (
+	"context"
+	"fmt"
+	"log"
+	"strings"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/guardduty"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
+	tfslices "github.com/hashicorp/terraform-provider-aws/internal/slices"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+)
+
+// @SDKResource("aws_guardduty_organization_configuration_feature", name="Organization Configuration Feature")
+func ResourceOrganizationConfigurationFeature() *schema.Resource {
+	return &schema.Resource{
+		CreateWithoutTimeout: resourceOrganizationConfigurationFeaturePut,
+		ReadWithoutTimeout:   resourceOrganizationConfigurationFeatureRead,
+		UpdateWithoutTimeout: resourceOrganizationConfigurationFeaturePut,
+		DeleteWithoutTimeout: schema.NoopContext,
+
+		Schema: map[string]*schema.Schema{
+			"additional_configuration": {
+				Optional: true,
+				ForceNew: true,
+				Type:     schema.TypeList,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"auto_enable": {
+							Type:         schema.TypeString,
+							Required:     true,
+							ValidateFunc: validation.StringInSlice(guardduty.OrgFeatureStatus_Values(), false),
+						},
+						"name": {
+							Type:         schema.TypeString,
+							Required:     true,
+							ForceNew:     true,
+							ValidateFunc: validation.StringInSlice(guardduty.OrgFeatureAdditionalConfiguration_Values(), false),
+						},
+					},
+				},
+			},
+			"auto_enable": {
+				Type:         schema.TypeString,
+				Required:     true,
+				ValidateFunc: validation.StringInSlice(guardduty.OrgFeatureStatus_Values(), false),
+			},
+			"detector_id": {
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+			"name": {
+				Type:         schema.TypeString,
+				Required:     true,
+				ForceNew:     true,
+				ValidateFunc: validation.StringInSlice(guardduty.OrgFeature_Values(), false),
+			},
+		},
+	}
+}
+
+func resourceOrganizationConfigurationFeaturePut(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).GuardDutyConn(ctx)
+
+	detectorID := d.Get("detector_id").(string)
+
+	// We have seen occasional acceptance test failures when updating multiple features on the same detector concurrently,
+	// so use a mutex to ensure that multiple features being updated concurrently don't trample on each other.
+	conns.GlobalMutexKV.Lock(detectorID)
+	defer conns.GlobalMutexKV.Unlock(detectorID)
+
+	output, err := FindOrganizationConfigurationByID(ctx, conn, detectorID)
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "reading GuardDuty Organization Configuration (%s): %s", detectorID, err)
+	}
+
+	name := d.Get("name").(string)
+	feature := &guardduty.OrganizationFeatureConfiguration{
+		AutoEnable: aws.String(d.Get("auto_enable").(string)),
+		Name:       aws.String(name),
+	}
+
+	if v, ok := d.GetOk("additional_configuration"); ok && len(v.([]interface{})) > 0 {
+		feature.AdditionalConfiguration = expandOrganizationAdditionalConfigurations(v.([]interface{}))
+	}
+
+	input := &guardduty.UpdateOrganizationConfigurationInput{
+		AutoEnableOrganizationMembers: output.AutoEnableOrganizationMembers,
+		DetectorId:                    aws.String(detectorID),
+		Features:                      []*guardduty.OrganizationFeatureConfiguration{feature},
+	}
+
+	_, err = conn.UpdateOrganizationConfigurationWithContext(ctx, input)
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "updating GuardDuty Organization Configuration (%s) Feature (%s): %s", detectorID, name, err)
+	}
+
+	if d.IsNewResource() {
+		d.SetId(organizationConfigurationFeatureCreateResourceID(detectorID, name))
+	}
+
+	return append(diags, resourceOrganizationConfigurationFeatureRead(ctx, d, meta)...)
+}
+
+func resourceOrganizationConfigurationFeatureRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).GuardDutyConn(ctx)
+
+	detectorID, name, err := organizationConfigurationFeatureParseResourceID(d.Id())
+	if err != nil {
+		return sdkdiag.AppendFromErr(diags, err)
+	}
+
+	feature, err := FindOrganizationConfigurationFeatureByTwoPartKey(ctx, conn, detectorID, name)
+
+	if !d.IsNewResource() && tfresource.NotFound(err) {
+		log.Printf("[WARN] GuardDuty Organization Configuration Feature (%s) not found, removing from state", d.Id())
+		d.SetId("")
+		return diags
+	}
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "reading GuardDuty Organization Configuration Feature (%s): %s", d.Id(), err)
+	}
+
+	if err := d.Set("additional_configuration", flattenOrganizationAdditionalConfigurationResults(feature.AdditionalConfiguration)); err != nil {
+		return sdkdiag.AppendErrorf(diags, "setting additional_configuration: %s", err)
+	}
+	d.Set("auto_enable", feature.AutoEnable)
+	d.Set("detector_id", detectorID)
+	d.Set("name", feature.Name)
+
+	return diags
+}
+
+const organizationConfigurationFeatureResourceIDSeparator = "/"
+
+func organizationConfigurationFeatureCreateResourceID(detectorID, name string) string {
+	parts := []string{detectorID, name}
+	id := strings.Join(parts, organizationConfigurationFeatureResourceIDSeparator)
+
+	return id
+}
+
+func organizationConfigurationFeatureParseResourceID(id string) (string, string, error) {
+	parts := strings.Split(id, organizationConfigurationFeatureResourceIDSeparator)
+
+	if len(parts) == 2 && parts[0] != "" && parts[1] != "" {
+		return parts[0], parts[1], nil
+	}
+
+	return "", "", fmt.Errorf("unexpected format for ID (%[1]s), expected DETECTORID%[2]sFEATURENAME", id, organizationConfigurationFeatureResourceIDSeparator)
+}
+
+func FindOrganizationConfigurationFeatureByTwoPartKey(ctx context.Context, conn *guardduty.GuardDuty, detectorID, name string) (*guardduty.OrganizationFeatureConfigurationResult, error) {
+	output, err := FindOrganizationConfigurationByID(ctx, conn, detectorID)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return tfresource.AssertSinglePtrResult(tfslices.Filter(output.Features, func(v *guardduty.OrganizationFeatureConfigurationResult) bool {
+		return aws.StringValue(v.Name) == name
+	}))
+}
+
+func expandOrganizationAdditionalConfiguration(tfMap map[string]interface{}) *guardduty.OrganizationAdditionalConfiguration {
+	if tfMap == nil {
+		return nil
+	}
+
+	apiObject := &guardduty.OrganizationAdditionalConfiguration{}
+
+	if v, ok := tfMap["auto_enable"].(string); ok && v != "" {
+		apiObject.AutoEnable = aws.String(v)
+	}
+
+	if v, ok := tfMap["name"].(string); ok && v != "" {
+		apiObject.Name = aws.String(v)
+	}
+
+	return apiObject
+}
+
+func expandOrganizationAdditionalConfigurations(tfList []interface{}) []*guardduty.OrganizationAdditionalConfiguration {
+	if len(tfList) == 0 {
+		return nil
+	}
+
+	var apiObjects []*guardduty.OrganizationAdditionalConfiguration
+
+	for _, tfMapRaw := range tfList {
+		tfMap, ok := tfMapRaw.(map[string]interface{})
+
+		if !ok {
+			continue
+		}
+
+		apiObject := expandOrganizationAdditionalConfiguration(tfMap)
+
+		if apiObject == nil {
+			continue
+		}
+
+		apiObjects = append(apiObjects, apiObject)
+	}
+
+	return apiObjects
+}
+
+func flattenOrganizationAdditionalConfigurationResult(apiObject *guardduty.OrganizationAdditionalConfigurationResult) map[string]interface{} {
+	if apiObject == nil {
+		return nil
+	}
+
+	tfMap := map[string]interface{}{}
+
+	if v := apiObject.AutoEnable; v != nil {
+		tfMap["auto_enable"] = aws.StringValue(v)
+	}
+
+	if v := apiObject.Name; v != nil {
+		tfMap["name"] = aws.StringValue(v)
+	}
+
+	return tfMap
+}
+
+func flattenOrganizationAdditionalConfigurationResults(apiObjects []*guardduty.OrganizationAdditionalConfigurationResult) []interface{} {
+	if len(apiObjects) == 0 {
+		return nil
+	}
+
+	var tfList []interface{}
+
+	for _, apiObject := range apiObjects {
+		if apiObject == nil {
+			continue
+		}
+
+		tfList = append(tfList, flattenOrganizationAdditionalConfigurationResult(apiObject))
+	}
+
+	return tfList
+}
diff --git a/internal/service/guardduty/organization_configuration_feature_test.go b/internal/service/guardduty/organization_configuration_feature_test.go
new file mode 100644
index 00000000000..282b57c7853
--- /dev/null
+++ b/internal/service/guardduty/organization_configuration_feature_test.go
@@ -0,0 +1,237 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package guardduty_test
+
+import (
+	"context"
+	"fmt"
+	"testing"
+
+	"github.com/aws/aws-sdk-go/service/guardduty"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
+	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	tfguardduty "github.com/hashicorp/terraform-provider-aws/internal/service/guardduty"
+)
+
+func testAccOrganizationConfigurationFeature_basic(t *testing.T) {
+	ctx := acctest.Context(t)
+	resourceName := "aws_guardduty_organization_configuration_feature.test"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckOrganizationsAccount(ctx, t)
+			testAccPreCheckDetectorNotExists(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, guardduty.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             acctest.CheckDestroyNoop,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccOrganizationConfigurationFeatureConfig_basic("RDS_LOGIN_EVENTS", "ALL"),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccOrganizationConfigurationFeatureExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "additional_configuration.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "auto_enable", "ALL"),
+					resource.TestCheckResourceAttrSet(resourceName, "detector_id"),
+					resource.TestCheckResourceAttr(resourceName, "name", "RDS_LOGIN_EVENTS"),
+				),
+			},
+		},
+	})
+}
+
+func testAccOrganizationConfigurationFeature_additionalConfiguration(t *testing.T) {
+	ctx := acctest.Context(t)
+	resourceName := "aws_guardduty_organization_configuration_feature.test"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckOrganizationsAccount(ctx, t)
+			testAccPreCheckDetectorNotExists(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, guardduty.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             acctest.CheckDestroyNoop,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccOrganizationConfigurationFeatureConfig_additionalConfiguration("NEW", "NONE"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccOrganizationConfigurationFeatureExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "auto_enable", "NEW"),
+					resource.TestCheckResourceAttr(resourceName, "additional_configuration.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "additional_configuration.0.auto_enable", "NONE"),
+					resource.TestCheckResourceAttr(resourceName, "additional_configuration.0.name", "EKS_ADDON_MANAGEMENT"),
+					resource.TestCheckResourceAttr(resourceName, "name", "EKS_RUNTIME_MONITORING"),
+				),
+			},
+			{
+				Config: testAccOrganizationConfigurationFeatureConfig_additionalConfiguration("ALL", "ALL"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccOrganizationConfigurationFeatureExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "auto_enable", "ALL"),
+					resource.TestCheckResourceAttr(resourceName, "additional_configuration.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "additional_configuration.0.auto_enable", "ALL"),
+					resource.TestCheckResourceAttr(resourceName, "additional_configuration.0.name", "EKS_ADDON_MANAGEMENT"),
+					resource.TestCheckResourceAttr(resourceName, "name", "EKS_RUNTIME_MONITORING"),
+				),
+			},
+		},
+	})
+}
+
+func testAccOrganizationConfigurationFeature_multiple(t *testing.T) {
+	ctx := acctest.Context(t)
+	resource1Name := "aws_guardduty_organization_configuration_feature.test1"
+	resource2Name := "aws_guardduty_organization_configuration_feature.test2"
+	resource3Name := "aws_guardduty_organization_configuration_feature.test3"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckOrganizationsAccount(ctx, t)
+			testAccPreCheckDetectorNotExists(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, guardduty.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             acctest.CheckDestroyNoop,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccOrganizationConfigurationFeatureConfig_multiple("ALL", "NEW", "NONE"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccOrganizationConfigurationFeatureExists(ctx, resource1Name),
+					testAccOrganizationConfigurationFeatureExists(ctx, resource2Name),
+					testAccOrganizationConfigurationFeatureExists(ctx, resource3Name),
+					resource.TestCheckResourceAttr(resource1Name, "additional_configuration.#", "0"),
+					resource.TestCheckResourceAttr(resource1Name, "auto_enable", "ALL"),
+					resource.TestCheckResourceAttr(resource1Name, "name", "EBS_MALWARE_PROTECTION"),
+					resource.TestCheckResourceAttr(resource2Name, "additional_configuration.#", "0"),
+					resource.TestCheckResourceAttr(resource2Name, "auto_enable", "NEW"),
+					resource.TestCheckResourceAttr(resource2Name, "name", "LAMBDA_NETWORK_LOGS"),
+					resource.TestCheckResourceAttr(resource3Name, "additional_configuration.#", "0"),
+					resource.TestCheckResourceAttr(resource3Name, "auto_enable", "NONE"),
+					resource.TestCheckResourceAttr(resource3Name, "name", "S3_DATA_EVENTS"),
+				),
+			},
+			{
+				Config: testAccOrganizationConfigurationFeatureConfig_multiple("NEW", "ALL", "ALL"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccOrganizationConfigurationFeatureExists(ctx, resource1Name),
+					testAccOrganizationConfigurationFeatureExists(ctx, resource2Name),
+					testAccOrganizationConfigurationFeatureExists(ctx, resource3Name),
+					resource.TestCheckResourceAttr(resource1Name, "additional_configuration.#", "0"),
+					resource.TestCheckResourceAttr(resource1Name, "auto_enable", "NEW"),
+					resource.TestCheckResourceAttr(resource1Name, "name", "EBS_MALWARE_PROTECTION"),
+					resource.TestCheckResourceAttr(resource2Name, "additional_configuration.#", "0"),
+					resource.TestCheckResourceAttr(resource2Name, "auto_enable", "ALL"),
+					resource.TestCheckResourceAttr(resource2Name, "name", "LAMBDA_NETWORK_LOGS"),
+					resource.TestCheckResourceAttr(resource3Name, "additional_configuration.#", "0"),
+					resource.TestCheckResourceAttr(resource3Name, "auto_enable", "ALL"),
+					resource.TestCheckResourceAttr(resource3Name, "name", "S3_DATA_EVENTS"),
+				),
+			},
+			{
+				Config: testAccOrganizationConfigurationFeatureConfig_multiple("NONE", "NONE", "NONE"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccOrganizationConfigurationFeatureExists(ctx, resource1Name),
+					testAccOrganizationConfigurationFeatureExists(ctx, resource2Name),
+					testAccOrganizationConfigurationFeatureExists(ctx, resource3Name),
+					resource.TestCheckResourceAttr(resource1Name, "additional_configuration.#", "0"),
+					resource.TestCheckResourceAttr(resource1Name, "auto_enable", "NONE"),
+					resource.TestCheckResourceAttr(resource1Name, "name", "EBS_MALWARE_PROTECTION"),
+					resource.TestCheckResourceAttr(resource2Name, "additional_configuration.#", "0"),
+					resource.TestCheckResourceAttr(resource2Name, "auto_enable", "NONE"),
+					resource.TestCheckResourceAttr(resource2Name, "name", "LAMBDA_NETWORK_LOGS"),
+					resource.TestCheckResourceAttr(resource3Name, "additional_configuration.#", "0"),
+					resource.TestCheckResourceAttr(resource3Name, "auto_enable", "NONE"),
+					resource.TestCheckResourceAttr(resource3Name, "name", "S3_DATA_EVENTS"),
+				),
+			},
+		},
+	})
+}
+
+func testAccOrganizationConfigurationFeatureExists(ctx context.Context, n string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		conn := acctest.Provider.Meta().(*conns.AWSClient).GuardDutyConn(ctx)
+
+		_, err := tfguardduty.FindOrganizationConfigurationFeatureByTwoPartKey(ctx, conn, rs.Primary.Attributes["detector_id"], rs.Primary.Attributes["name"])
+
+		return err
+	}
+}
+
+var testAccOrganizationConfigurationFeatureConfig_base = acctest.ConfigCompose(testAccOrganizationConfigurationConfig_base, `
+resource "aws_guardduty_organization_configuration" "test" {
+  depends_on = [aws_guardduty_organization_admin_account.test]
+
+  auto_enable_organization_members = "ALL"
+  detector_id                      = aws_guardduty_detector.test.id
+}
+`)
+
+func testAccOrganizationConfigurationFeatureConfig_basic(name, autoEnable string) string {
+	return acctest.ConfigCompose(testAccOrganizationConfigurationFeatureConfig_base, fmt.Sprintf(`
+resource "aws_guardduty_organization_configuration_feature" "test" {
+  depends_on = [aws_guardduty_organization_configuration.test]
+
+  detector_id = aws_guardduty_detector.test.id
+  name        = %[1]q
+  auto_enable = %[2]q
+}
+`, name, autoEnable))
+}
+
+func testAccOrganizationConfigurationFeatureConfig_additionalConfiguration(featureAutoEnable, additionalConfigurationAutoEnable string) string {
+	return acctest.ConfigCompose(testAccOrganizationConfigurationFeatureConfig_base, fmt.Sprintf(`
+resource "aws_guardduty_organization_configuration_feature" "test" {
+  depends_on = [aws_guardduty_organization_configuration.test]
+
+  detector_id = aws_guardduty_detector.test.id
+  name        = "EKS_RUNTIME_MONITORING"
+  auto_enable = %[1]q
+
+  additional_configuration {
+    name        = "EKS_ADDON_MANAGEMENT"
+    auto_enable = %[2]q
+  }
+}
+`, featureAutoEnable, additionalConfigurationAutoEnable))
+}
+
+func testAccOrganizationConfigurationFeatureConfig_multiple(autoEnable1, autoEnable2, autoEnable3 string) string {
+	return acctest.ConfigCompose(testAccOrganizationConfigurationFeatureConfig_base, fmt.Sprintf(`
+resource "aws_guardduty_organization_configuration_feature" "test1" {
+  depends_on = [aws_guardduty_organization_configuration.test]
+
+  detector_id = aws_guardduty_detector.test.id
+  name        = "EBS_MALWARE_PROTECTION"
+  auto_enable = %[1]q
+}
+
+resource "aws_guardduty_organization_configuration_feature" "test2" {
+  depends_on = [aws_guardduty_organization_configuration.test]
+
+  detector_id = aws_guardduty_detector.test.id
+  name        = "LAMBDA_NETWORK_LOGS"
+  auto_enable = %[2]q
+}
+
+resource "aws_guardduty_organization_configuration_feature" "test3" {
+  depends_on = [aws_guardduty_organization_configuration.test]
+
+  detector_id = aws_guardduty_detector.test.id
+  name        = "S3_DATA_EVENTS"
+  auto_enable = %[3]q
+}
+`, autoEnable1, autoEnable2, autoEnable3))
+}
diff --git a/internal/service/guardduty/organization_configuration_test.go b/internal/service/guardduty/organization_configuration_test.go
index ad150269b14..83e6c21f905 100644
--- a/internal/service/guardduty/organization_configuration_test.go
+++ b/internal/service/guardduty/organization_configuration_test.go
@@ -1,12 +1,19 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package guardduty_test
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
 	"github.com/aws/aws-sdk-go/service/guardduty"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	tfguardduty "github.com/hashicorp/terraform-provider-aws/internal/service/guardduty"
 )
 
 func testAccOrganizationConfiguration_basic(t *testing.T) {
@@ -18,16 +25,16 @@ func testAccOrganizationConfiguration_basic(t *testing.T) {
 		PreCheck: func() {
 			acctest.PreCheck(ctx, t)
 			acctest.PreCheckOrganizationsAccount(ctx, t)
+			testAccPreCheckDetectorNotExists(ctx, t)
 		},
 		ErrorCheck:               acctest.ErrorCheck(t, guardduty.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		// GuardDuty Organization Configuration cannot be deleted separately.
-		// Ensure parent resource is destroyed instead.
-		CheckDestroy: testAccCheckDetectorDestroy(ctx),
+		CheckDestroy:             acctest.CheckDestroyNoop,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccOrganizationConfigurationConfig_autoEnable(true),
 				Check: resource.ComposeTestCheckFunc(
+					testAccCheckOrganizationConfigurationExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "auto_enable", "true"),
 					resource.TestCheckResourceAttr(resourceName, "auto_enable_organization_members", "NEW"),
 					resource.TestCheckResourceAttrPair(resourceName, "detector_id", detectorResourceName, "id"),
@@ -41,6 +48,7 @@ func testAccOrganizationConfiguration_basic(t *testing.T) {
 			{
 				Config: testAccOrganizationConfigurationConfig_autoEnable(false),
 				Check: resource.ComposeTestCheckFunc(
+					testAccCheckOrganizationConfigurationExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "auto_enable", "false"),
 					resource.TestCheckResourceAttr(resourceName, "auto_enable_organization_members", "NONE"),
 					resource.TestCheckResourceAttrPair(resourceName, "detector_id", detectorResourceName, "id"),
@@ -59,16 +67,16 @@ func testAccOrganizationConfiguration_autoEnableOrganizationMembers(t *testing.T
 		PreCheck: func() {
 			acctest.PreCheck(ctx, t)
 			acctest.PreCheckOrganizationsAccount(ctx, t)
+			testAccPreCheckDetectorNotExists(ctx, t)
 		},
 		ErrorCheck:               acctest.ErrorCheck(t, guardduty.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		// GuardDuty Organization Configuration cannot be deleted separately.
-		// Ensure parent resource is destroyed instead.
-		CheckDestroy: testAccCheckDetectorDestroy(ctx),
+		CheckDestroy:             acctest.CheckDestroyNoop,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccOrganizationConfigurationConfig_autoEnableOrganizationMembers("ALL"),
 				Check: resource.ComposeTestCheckFunc(
+					testAccCheckOrganizationConfigurationExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "auto_enable_organization_members", "ALL"),
 					resource.TestCheckResourceAttr(resourceName, "auto_enable", "true"),
 					resource.TestCheckResourceAttrPair(resourceName, "detector_id", detectorResourceName, "id"),
@@ -82,68 +90,48 @@ func testAccOrganizationConfiguration_autoEnableOrganizationMembers(t *testing.T
 			{
 				Config: testAccOrganizationConfigurationConfig_autoEnableOrganizationMembers("NONE"),
 				Check: resource.ComposeTestCheckFunc(
+					testAccCheckOrganizationConfigurationExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "auto_enable_organization_members", "NONE"),
 					resource.TestCheckResourceAttr(resourceName, "auto_enable", "false"),
 					resource.TestCheckResourceAttrPair(resourceName, "detector_id", detectorResourceName, "id"),
 				),
 			},
-			{
-				ResourceName:      resourceName,
-				ImportState:       true,
-				ImportStateVerify: true,
-			},
 			{
 				Config: testAccOrganizationConfigurationConfig_autoEnableOrganizationMembers("ALL"),
 				Check: resource.ComposeTestCheckFunc(
+					testAccCheckOrganizationConfigurationExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "auto_enable_organization_members", "ALL"),
 					resource.TestCheckResourceAttr(resourceName, "auto_enable", "true"),
 					resource.TestCheckResourceAttrPair(resourceName, "detector_id", detectorResourceName, "id"),
 				),
 			},
-			{
-				ResourceName:      resourceName,
-				ImportState:       true,
-				ImportStateVerify: true,
-			},
 			{
 				Config: testAccOrganizationConfigurationConfig_autoEnable(true),
 				Check: resource.ComposeTestCheckFunc(
+					testAccCheckOrganizationConfigurationExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "auto_enable_organization_members", "NEW"),
 					resource.TestCheckResourceAttr(resourceName, "auto_enable", "true"),
 					resource.TestCheckResourceAttrPair(resourceName, "detector_id", detectorResourceName, "id"),
 				),
 			},
-			{
-				ResourceName:      resourceName,
-				ImportState:       true,
-				ImportStateVerify: true,
-			},
 			{
 				Config: testAccOrganizationConfigurationConfig_autoEnableOrganizationMembers("NONE"),
 				Check: resource.ComposeTestCheckFunc(
+					testAccCheckOrganizationConfigurationExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "auto_enable_organization_members", "NONE"),
 					resource.TestCheckResourceAttr(resourceName, "auto_enable", "false"),
 					resource.TestCheckResourceAttrPair(resourceName, "detector_id", detectorResourceName, "id"),
 				),
 			},
-			{
-				ResourceName:      resourceName,
-				ImportState:       true,
-				ImportStateVerify: true,
-			},
 			{
 				Config: testAccOrganizationConfigurationConfig_autoEnable(false),
 				Check: resource.ComposeTestCheckFunc(
+					testAccCheckOrganizationConfigurationExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "auto_enable_organization_members", "NONE"),
 					resource.TestCheckResourceAttr(resourceName, "auto_enable", "false"),
 					resource.TestCheckResourceAttrPair(resourceName, "detector_id", detectorResourceName, "id"),
 				),
 			},
-			{
-				ResourceName:      resourceName,
-				ImportState:       true,
-				ImportStateVerify: true,
-			},
 		},
 	})
 }
@@ -157,14 +145,16 @@ func testAccOrganizationConfiguration_s3logs(t *testing.T) {
 		PreCheck: func() {
 			acctest.PreCheck(ctx, t)
 			acctest.PreCheckOrganizationsAccount(ctx, t)
+			testAccPreCheckDetectorNotExists(ctx, t)
 		},
 		ErrorCheck:               acctest.ErrorCheck(t, guardduty.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckDetectorDestroy(ctx),
+		CheckDestroy:             acctest.CheckDestroyNoop,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccOrganizationConfigurationConfig_s3Logs(true),
 				Check: resource.ComposeTestCheckFunc(
+					testAccCheckOrganizationConfigurationExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "auto_enable", "true"),
 					resource.TestCheckResourceAttr(resourceName, "datasources.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "datasources.0.s3_logs.#", "1"),
@@ -180,6 +170,7 @@ func testAccOrganizationConfiguration_s3logs(t *testing.T) {
 			{
 				Config: testAccOrganizationConfigurationConfig_s3Logs(false),
 				Check: resource.ComposeTestCheckFunc(
+					testAccCheckOrganizationConfigurationExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "auto_enable", "true"),
 					resource.TestCheckResourceAttr(resourceName, "datasources.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "datasources.0.s3_logs.#", "1"),
@@ -200,14 +191,16 @@ func testAccOrganizationConfiguration_kubernetes(t *testing.T) {
 		PreCheck: func() {
 			acctest.PreCheck(ctx, t)
 			acctest.PreCheckOrganizationsAccount(ctx, t)
+			testAccPreCheckDetectorNotExists(ctx, t)
 		},
 		ErrorCheck:               acctest.ErrorCheck(t, guardduty.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckDetectorDestroy(ctx),
+		CheckDestroy:             acctest.CheckDestroyNoop,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccOrganizationConfigurationConfig_kubernetes(true),
 				Check: resource.ComposeTestCheckFunc(
+					testAccCheckOrganizationConfigurationExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "auto_enable", "true"),
 					resource.TestCheckResourceAttr(resourceName, "datasources.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "datasources.0.kubernetes.#", "1"),
@@ -224,6 +217,7 @@ func testAccOrganizationConfiguration_kubernetes(t *testing.T) {
 			{
 				Config: testAccOrganizationConfigurationConfig_kubernetes(false),
 				Check: resource.ComposeTestCheckFunc(
+					testAccCheckOrganizationConfigurationExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "auto_enable", "true"),
 					resource.TestCheckResourceAttr(resourceName, "datasources.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "datasources.0.kubernetes.#", "1"),
@@ -245,14 +239,16 @@ func testAccOrganizationConfiguration_malwareprotection(t *testing.T) {
 		PreCheck: func() {
 			acctest.PreCheck(ctx, t)
 			acctest.PreCheckOrganizationsAccount(ctx, t)
+			testAccPreCheckDetectorNotExists(ctx, t)
 		},
 		ErrorCheck:               acctest.ErrorCheck(t, guardduty.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckDetectorDestroy(ctx),
+		CheckDestroy:             acctest.CheckDestroyNoop,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccOrganizationConfigurationConfig_malwareprotection(true),
 				Check: resource.ComposeTestCheckFunc(
+					testAccCheckOrganizationConfigurationExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "auto_enable", "true"),
 					resource.TestCheckResourceAttr(resourceName, "datasources.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "datasources.0.malware_protection.#", "1"),
@@ -270,6 +266,7 @@ func testAccOrganizationConfiguration_malwareprotection(t *testing.T) {
 			{
 				Config: testAccOrganizationConfigurationConfig_malwareprotection(false),
 				Check: resource.ComposeTestCheckFunc(
+					testAccCheckOrganizationConfigurationExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "auto_enable", "true"),
 					resource.TestCheckResourceAttr(resourceName, "datasources.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "datasources.0.malware_protection.#", "1"),
@@ -283,7 +280,22 @@ func testAccOrganizationConfiguration_malwareprotection(t *testing.T) {
 	})
 }
 
-const testAccOrganizationConfigurationConfigBase = `
+func testAccCheckOrganizationConfigurationExists(ctx context.Context, n string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		conn := acctest.Provider.Meta().(*conns.AWSClient).GuardDutyConn(ctx)
+
+		_, err := tfguardduty.FindOrganizationConfigurationByID(ctx, conn, rs.Primary.ID)
+
+		return err
+	}
+}
+
+const testAccOrganizationConfigurationConfig_base = `
 data "aws_caller_identity" "current" {}
 
 data "aws_partition" "current" {}
@@ -307,9 +319,7 @@ resource "aws_guardduty_organization_admin_account" "test" {
 `
 
 func testAccOrganizationConfigurationConfig_autoEnable(autoEnable bool) string {
-	return acctest.ConfigCompose(
-		testAccOrganizationConfigurationConfigBase,
-		fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccOrganizationConfigurationConfig_base, fmt.Sprintf(`
 resource "aws_guardduty_organization_configuration" "test" {
   depends_on = [aws_guardduty_organization_admin_account.test]
 
@@ -320,9 +330,7 @@ resource "aws_guardduty_organization_configuration" "test" {
 }
 
 func testAccOrganizationConfigurationConfig_autoEnableOrganizationMembers(value string) string {
-	return acctest.ConfigCompose(
-		testAccOrganizationConfigurationConfigBase,
-		fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccOrganizationConfigurationConfig_base, fmt.Sprintf(`
 resource "aws_guardduty_organization_configuration" "test" {
   depends_on = [aws_guardduty_organization_admin_account.test]
 
@@ -333,9 +341,7 @@ resource "aws_guardduty_organization_configuration" "test" {
 }
 
 func testAccOrganizationConfigurationConfig_s3Logs(autoEnable bool) string {
-	return acctest.ConfigCompose(
-		testAccOrganizationConfigurationConfigBase,
-		fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccOrganizationConfigurationConfig_base, fmt.Sprintf(`
 resource "aws_guardduty_organization_configuration" "test" {
   depends_on = [aws_guardduty_organization_admin_account.test]
 
@@ -352,9 +358,7 @@ resource "aws_guardduty_organization_configuration" "test" {
 }
 
 func testAccOrganizationConfigurationConfig_kubernetes(autoEnable bool) string {
-	return acctest.ConfigCompose(
-		testAccOrganizationConfigurationConfigBase,
-		fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccOrganizationConfigurationConfig_base, fmt.Sprintf(`
 resource "aws_guardduty_organization_configuration" "test" {
   depends_on = [aws_guardduty_organization_admin_account.test]
 
@@ -373,9 +377,7 @@ resource "aws_guardduty_organization_configuration" "test" {
 }
 
 func testAccOrganizationConfigurationConfig_malwareprotection(autoEnable bool) string {
-	return acctest.ConfigCompose(
-		testAccOrganizationConfigurationConfigBase,
-		fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccOrganizationConfigurationConfig_base, fmt.Sprintf(`
 resource "aws_guardduty_organization_configuration" "test" {
   depends_on = [aws_guardduty_organization_admin_account.test]
 
diff --git a/internal/service/guardduty/publishing_destination.go b/internal/service/guardduty/publishing_destination.go
index 0a646909bbe..8d8a8a31a49 100644
--- a/internal/service/guardduty/publishing_destination.go
+++ b/internal/service/guardduty/publishing_destination.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package guardduty
 
 import (
diff --git a/internal/service/guardduty/publishing_destination_test.go b/internal/service/guardduty/publishing_destination_test.go
index e7659c17118..8967fe67ff1 100644
--- a/internal/service/guardduty/publishing_destination_test.go
+++ b/internal/service/guardduty/publishing_destination_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package guardduty_test
 
 import (
@@ -24,7 +27,10 @@ func testAccPublishingDestination_basic(t *testing.T) {
 	kmsKeyResourceName := "aws_kms_key.gd_key"
 
 	resource.Test(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			testAccPreCheckDetectorNotExists(ctx, t)
+		},
 		ErrorCheck:               acctest.ErrorCheck(t, guardduty.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckPublishingDestinationDestroy(ctx),
@@ -53,7 +59,10 @@ func testAccPublishingDestination_disappears(t *testing.T) {
 	bucketName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.Test(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			testAccPreCheckDetectorNotExists(ctx, t)
+		},
 		ErrorCheck:               acctest.ErrorCheck(t, guardduty.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckPublishingDestinationDestroy(ctx),
@@ -158,11 +167,6 @@ resource "aws_s3_bucket" "gd_bucket" {
   force_destroy = true
 }
 
-resource "aws_s3_bucket_acl" "gd_bucket_acl" {
-  bucket = aws_s3_bucket.gd_bucket.id
-  acl    = "private"
-}
-
 resource "aws_s3_bucket_policy" "gd_bucket_policy" {
   bucket = aws_s3_bucket.gd_bucket.id
   policy = data.aws_iam_policy_document.bucket_pol.json
diff --git a/internal/service/guardduty/service_package_gen.go b/internal/service/guardduty/service_package_gen.go
index 94430415ed6..034bfff562b 100644
--- a/internal/service/guardduty/service_package_gen.go
+++ b/internal/service/guardduty/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	guardduty_sdkv1 "github.com/aws/aws-sdk-go/service/guardduty"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -46,6 +47,11 @@ func (p *servicePackage) SDKResources(ctx context.Context) []*types.ServicePacka
 				IdentifierAttribute: "arn",
 			},
 		},
+		{
+			Factory:  ResourceDetectorFeature,
+			TypeName: "aws_guardduty_detector_feature",
+			Name:     "Detector Feature",
+		},
 		{
 			Factory:  ResourceFilter,
 			TypeName: "aws_guardduty_filter",
@@ -77,6 +83,12 @@ func (p *servicePackage) SDKResources(ctx context.Context) []*types.ServicePacka
 		{
 			Factory:  ResourceOrganizationConfiguration,
 			TypeName: "aws_guardduty_organization_configuration",
+			Name:     "Organization Configuration",
+		},
+		{
+			Factory:  ResourceOrganizationConfigurationFeature,
+			TypeName: "aws_guardduty_organization_configuration_feature",
+			Name:     "Organization Configuration Feature",
 		},
 		{
 			Factory:  ResourcePublishingDestination,
@@ -104,4 +116,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*g
 	return guardduty_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/guardduty/status.go b/internal/service/guardduty/status.go
index 06a3e9c2eab..8f2954d23db 100644
--- a/internal/service/guardduty/status.go
+++ b/internal/service/guardduty/status.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package guardduty
 
 import (
diff --git a/internal/service/guardduty/sweep.go b/internal/service/guardduty/sweep.go
index 88b49df6c8d..e0f7190271b 100644
--- a/internal/service/guardduty/sweep.go
+++ b/internal/service/guardduty/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package guardduty
 
@@ -13,9 +13,10 @@ import (
 	"github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_guardduty_detector", &resource.Sweeper{
 		Name:         "aws_guardduty_detector",
 		F:            sweepDetectors,
@@ -30,7 +31,7 @@ func init() {
 
 func sweepDetectors(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
@@ -63,7 +64,7 @@ func sweepDetectors(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping GuardDuty Detector sweep for %s: %s", region, err)
 		return nil
 	}
@@ -77,7 +78,7 @@ func sweepDetectors(region string) error {
 
 func sweepPublishingDestinations(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
@@ -122,7 +123,7 @@ func sweepPublishingDestinations(region string) error {
 		sweeperErrs = multierror.Append(sweeperErrs, sweeperErr)
 	}
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping GuardDuty Publishing Destination sweep for %s: %s", region, err)
 		return nil
 	}
diff --git a/internal/service/guardduty/tags_gen.go b/internal/service/guardduty/tags_gen.go
index 5c231ecd955..5688c67eb2d 100644
--- a/internal/service/guardduty/tags_gen.go
+++ b/internal/service/guardduty/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/guardduty"
 	"github.com/aws/aws-sdk-go/service/guardduty/guarddutyiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -54,7 +56,7 @@ func Tags(tags tftags.KeyValueTags) map[string]*string {
 	return aws.StringMap(tags.Map())
 }
 
-// KeyValueTags creates KeyValueTags from guardduty service tags.
+// KeyValueTags creates tftags.KeyValueTags from guardduty service tags.
 func KeyValueTags(ctx context.Context, tags map[string]*string) tftags.KeyValueTags {
 	return tftags.New(ctx, tags)
 }
@@ -85,6 +87,8 @@ func updateTags(ctx context.Context, conn guarddutyiface.GuardDutyAPI, identifie
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.GuardDuty)
 	if len(removedTags) > 0 {
diff --git a/internal/service/guardduty/threatintelset.go b/internal/service/guardduty/threatintelset.go
index 101cdbd69d1..85397c05a9e 100644
--- a/internal/service/guardduty/threatintelset.go
+++ b/internal/service/guardduty/threatintelset.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package guardduty
 
 import (
diff --git a/internal/service/guardduty/threatintelset_test.go b/internal/service/guardduty/threatintelset_test.go
index 0d599337f02..985c0ea9646 100644
--- a/internal/service/guardduty/threatintelset_test.go
+++ b/internal/service/guardduty/threatintelset_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package guardduty_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/guardduty"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -27,7 +30,10 @@ func testAccThreatIntelSet_basic(t *testing.T) {
 	resourceName := "aws_guardduty_threatintelset.test"
 
 	resource.Test(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			testAccPreCheckDetectorNotExists(ctx, t)
+		},
 		ErrorCheck:               acctest.ErrorCheck(t, guardduty.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckThreatIntelSetDestroy(ctx),
@@ -36,10 +42,10 @@ func testAccThreatIntelSet_basic(t *testing.T) {
 				Config: testAccThreatIntelSetConfig_basic(bucketName, keyName1, threatintelsetName1, true),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckThreatIntelSetExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "guardduty", regexp.MustCompile("detector/.+/threatintelset/.+$")),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "guardduty", regexache.MustCompile("detector/.+/threatintelset/.+$")),
 					resource.TestCheckResourceAttr(resourceName, "name", threatintelsetName1),
 					resource.TestCheckResourceAttr(resourceName, "activate", "true"),
-					resource.TestMatchResourceAttr(resourceName, "location", regexp.MustCompile(fmt.Sprintf("%s/%s$", bucketName, keyName1))),
+					resource.TestMatchResourceAttr(resourceName, "location", regexache.MustCompile(fmt.Sprintf("%s/%s$", bucketName, keyName1))),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 				),
 			},
@@ -54,7 +60,7 @@ func testAccThreatIntelSet_basic(t *testing.T) {
 					testAccCheckThreatIntelSetExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "name", threatintelsetName2),
 					resource.TestCheckResourceAttr(resourceName, "activate", "false"),
-					resource.TestMatchResourceAttr(resourceName, "location", regexp.MustCompile(fmt.Sprintf("%s/%s$", bucketName, keyName2))),
+					resource.TestMatchResourceAttr(resourceName, "location", regexache.MustCompile(fmt.Sprintf("%s/%s$", bucketName, keyName2))),
 				),
 			},
 		},
@@ -67,7 +73,10 @@ func testAccThreatIntelSet_tags(t *testing.T) {
 	resourceName := "aws_guardduty_threatintelset.test"
 
 	resource.Test(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			testAccPreCheckDetectorNotExists(ctx, t)
+		},
 		ErrorCheck:               acctest.ErrorCheck(t, guardduty.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckThreatIntelSetDestroy(ctx),
@@ -175,11 +184,6 @@ resource "aws_s3_bucket" "test" {
   force_destroy = true
 }
 
-resource "aws_s3_bucket_acl" "test" {
-  bucket = aws_s3_bucket.test.id
-  acl    = "private"
-}
-
 resource "aws_s3_object" "test" {
   acl     = "public-read"
   content = "10.0.0.0/8\n"
@@ -206,11 +210,6 @@ resource "aws_s3_bucket" "test" {
   force_destroy = true
 }
 
-resource "aws_s3_bucket_acl" "test" {
-  bucket = aws_s3_bucket.test.id
-  acl    = "private"
-}
-
 resource "aws_s3_object" "test" {
   acl     = "public-read"
   content = "10.0.0.0/8\n"
@@ -241,11 +240,6 @@ resource "aws_s3_bucket" "test" {
   force_destroy = true
 }
 
-resource "aws_s3_bucket_acl" "test" {
-  bucket = aws_s3_bucket.test.id
-  acl    = "private"
-}
-
 resource "aws_s3_object" "test" {
   acl     = "public-read"
   content = "10.0.0.0/8\n"
diff --git a/internal/service/guardduty/wait.go b/internal/service/guardduty/wait.go
index 173104cb94f..03d546e35d8 100644
--- a/internal/service/guardduty/wait.go
+++ b/internal/service/guardduty/wait.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package guardduty
 
 import (
diff --git a/internal/service/healthlake/generate.go b/internal/service/healthlake/generate.go
index 9691a541606..07ce5ab38f3 100644
--- a/internal/service/healthlake/generate.go
+++ b/internal/service/healthlake/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -AWSSDKVersion=2 -KVTValues=true -SkipTypesImp=false -TagInIDElem=ResourceARN -ListTagsInIDElem=ResourceARN -ListTags -ServiceTagsSlice -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/healthlake/service_package_gen.go b/internal/service/healthlake/service_package_gen.go
index a2004b1f0e8..670cb6de735 100644
--- a/internal/service/healthlake/service_package_gen.go
+++ b/internal/service/healthlake/service_package_gen.go
@@ -7,6 +7,7 @@ import (
 
 	aws_sdkv2 "github.com/aws/aws-sdk-go-v2/aws"
 	healthlake_sdkv2 "github.com/aws/aws-sdk-go-v2/service/healthlake"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -39,9 +40,11 @@ func (p *servicePackage) NewClient(ctx context.Context, config map[string]any) (
 
 	return healthlake_sdkv2.NewFromConfig(cfg, func(o *healthlake_sdkv2.Options) {
 		if endpoint := config["endpoint"].(string); endpoint != "" {
-			o.EndpointResolver = healthlake_sdkv2.EndpointResolverFromURL(endpoint)
+			o.BaseEndpoint = aws_sdkv2.String(endpoint)
 		}
 	}), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/healthlake/sweep.go b/internal/service/healthlake/sweep.go
deleted file mode 100644
index 710a4fd201c..00000000000
--- a/internal/service/healthlake/sweep.go
+++ /dev/null
@@ -1,4 +0,0 @@
-//go:build sweep
-// +build sweep
-
-package healthlake
diff --git a/internal/service/healthlake/tags_gen.go b/internal/service/healthlake/tags_gen.go
index 4a392fa7b05..2605e5d2b3b 100644
--- a/internal/service/healthlake/tags_gen.go
+++ b/internal/service/healthlake/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/healthlake"
 	awstypes "github.com/aws/aws-sdk-go-v2/service/healthlake/types"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -102,6 +104,8 @@ func updateTags(ctx context.Context, conn *healthlake.Client, identifier string,
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.HealthLake)
 	if len(removedTags) > 0 {
diff --git a/internal/service/iam/acc_test.go b/internal/service/iam/acc_test.go
index 231a75f6795..94f6fbd9d8d 100644
--- a/internal/service/iam/acc_test.go
+++ b/internal/service/iam/acc_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam_test
 
 import (
@@ -8,7 +11,11 @@ import (
 	"encoding/pem"
 	"fmt"
 	"strings"
+	"testing"
 
+	"github.com/aws/aws-sdk-go/service/iam"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
 	"golang.org/x/crypto/ssh"
 )
 
@@ -53,3 +60,13 @@ func pemEncode(b []byte, block string) (string, error) {
 
 	return buf.String(), nil
 }
+
+func init() {
+	acctest.RegisterServiceErrorCheckFunc(iam.EndpointsID, testAccErrorCheckSkip)
+}
+
+func testAccErrorCheckSkip(t *testing.T) resource.ErrorCheckFunc {
+	return acctest.ErrorCheckSkipMessagesContaining(t,
+		"no identity-based policy allows the iam:SetSecurityTokenServicePreferences action",
+	)
+}
diff --git a/internal/service/iam/access_key.go b/internal/service/iam/access_key.go
index ec643cd5b36..d79ef18dac6 100644
--- a/internal/service/iam/access_key.go
+++ b/internal/service/iam/access_key.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam
 
 import (
diff --git a/internal/service/iam/access_key_test.go b/internal/service/iam/access_key_test.go
index 05fa71e5dbf..e9ee83aaf8f 100644
--- a/internal/service/iam/access_key_test.go
+++ b/internal/service/iam/access_key_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam_test
 
 import (
diff --git a/internal/service/iam/access_keys_data_source.go b/internal/service/iam/access_keys_data_source.go
index 99073331a30..3b7fc8d4868 100644
--- a/internal/service/iam/access_keys_data_source.go
+++ b/internal/service/iam/access_keys_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam
 
 import (
diff --git a/internal/service/iam/access_keys_data_source_test.go b/internal/service/iam/access_keys_data_source_test.go
index e3f4a5b1d46..41e731ef22c 100644
--- a/internal/service/iam/access_keys_data_source_test.go
+++ b/internal/service/iam/access_keys_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam_test
 
 import (
diff --git a/internal/service/iam/account_alias.go b/internal/service/iam/account_alias.go
index 7e1889ef2c8..de591236fa6 100644
--- a/internal/service/iam/account_alias.go
+++ b/internal/service/iam/account_alias.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam
 
 import (
diff --git a/internal/service/iam/account_alias_data_source.go b/internal/service/iam/account_alias_data_source.go
index 49147715880..413079f0491 100644
--- a/internal/service/iam/account_alias_data_source.go
+++ b/internal/service/iam/account_alias_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam
 
 import (
diff --git a/internal/service/iam/account_alias_data_source_test.go b/internal/service/iam/account_alias_data_source_test.go
index cb9ef64ee6d..c1d2ef921a2 100644
--- a/internal/service/iam/account_alias_data_source_test.go
+++ b/internal/service/iam/account_alias_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam_test
 
 import (
diff --git a/internal/service/iam/account_alias_test.go b/internal/service/iam/account_alias_test.go
index b5c89186faa..b5d85841b48 100644
--- a/internal/service/iam/account_alias_test.go
+++ b/internal/service/iam/account_alias_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam_test
 
 import (
diff --git a/internal/service/iam/account_password_policy.go b/internal/service/iam/account_password_policy.go
index 33dc87b4d3e..2bce87935d5 100644
--- a/internal/service/iam/account_password_policy.go
+++ b/internal/service/iam/account_password_policy.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam
 
 import (
diff --git a/internal/service/iam/account_password_policy_test.go b/internal/service/iam/account_password_policy_test.go
index e9372e71138..0ad3b7ce721 100644
--- a/internal/service/iam/account_password_policy_test.go
+++ b/internal/service/iam/account_password_policy_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam_test
 
 import (
diff --git a/internal/service/iam/arn.go b/internal/service/iam/arn.go
index 5d6bfa76e21..1abf14baf02 100644
--- a/internal/service/iam/arn.go
+++ b/internal/service/iam/arn.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam
 
 import (
diff --git a/internal/service/iam/arn_test.go b/internal/service/iam/arn_test.go
index ddc5ede4ca5..ba07c02b7c2 100644
--- a/internal/service/iam/arn_test.go
+++ b/internal/service/iam/arn_test.go
@@ -1,9 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam_test
 
 import (
 	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	tfiam "github.com/hashicorp/terraform-provider-aws/internal/service/iam"
 )
 
@@ -19,27 +23,27 @@ func TestInstanceProfileARNToName(t *testing.T) {
 		{
 			TestName:      "empty ARN",
 			InputARN:      "",
-			ExpectedError: regexp.MustCompile(`parsing ARN`),
+			ExpectedError: regexache.MustCompile(`parsing ARN`),
 		},
 		{
 			TestName:      "unparsable ARN",
 			InputARN:      "test",
-			ExpectedError: regexp.MustCompile(`parsing ARN`),
+			ExpectedError: regexache.MustCompile(`parsing ARN`),
 		},
 		{
 			TestName:      "invalid ARN service",
 			InputARN:      "arn:aws:ec2:us-east-1:123456789012:instance/i-12345678", //lintignore:AWSAT003,AWSAT005
-			ExpectedError: regexp.MustCompile(`expected service iam`),
+			ExpectedError: regexache.MustCompile(`expected service iam`),
 		},
 		{
 			TestName:      "invalid ARN resource parts",
 			InputARN:      "arn:aws:iam:us-east-1:123456789012:name", //lintignore:AWSAT003,AWSAT005
-			ExpectedError: regexp.MustCompile(`expected at least 2 resource parts`),
+			ExpectedError: regexache.MustCompile(`expected at least 2 resource parts`),
 		},
 		{
 			TestName:      "invalid ARN resource prefix",
 			InputARN:      "arn:aws:iam:us-east-1:123456789012:role/name", //lintignore:AWSAT003,AWSAT005
-			ExpectedError: regexp.MustCompile(`expected resource prefix instance-profile`),
+			ExpectedError: regexache.MustCompile(`expected resource prefix instance-profile`),
 		},
 		{
 			TestName:     "valid ARN",
diff --git a/internal/service/iam/diff.go b/internal/service/iam/diff.go
index 2b305a1bd71..91348b726f4 100644
--- a/internal/service/iam/diff.go
+++ b/internal/service/iam/diff.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam
 
 import (
diff --git a/internal/service/iam/encryption.go b/internal/service/iam/encryption.go
index 0dc89cd2194..eb3cca3b725 100644
--- a/internal/service/iam/encryption.go
+++ b/internal/service/iam/encryption.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam
 
 import (
diff --git a/internal/service/iam/find.go b/internal/service/iam/find.go
index 43f1258a770..b9533f6da35 100644
--- a/internal/service/iam/find.go
+++ b/internal/service/iam/find.go
@@ -1,9 +1,12 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam
 
 import (
 	"context"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/iam"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -98,7 +101,7 @@ func FindUsers(ctx context.Context, conn *iam.IAM, nameRegex, pathPrefix string)
 				continue
 			}
 
-			if nameRegex != "" && !regexp.MustCompile(nameRegex).MatchString(aws.StringValue(user.UserName)) {
+			if nameRegex != "" && !regexache.MustCompile(nameRegex).MatchString(aws.StringValue(user.UserName)) {
 				continue
 			}
 
diff --git a/internal/service/iam/flex.go b/internal/service/iam/flex.go
index 86ee62993e4..ecb766fed2e 100644
--- a/internal/service/iam/flex.go
+++ b/internal/service/iam/flex.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam
 
 import (
diff --git a/internal/service/iam/generate.go b/internal/service/iam/generate.go
index a91a758bab2..81f5563089a 100644
--- a/internal/service/iam/generate.go
+++ b/internal/service/iam/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ServiceTagsSlice
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/iam/group.go b/internal/service/iam/group.go
index f482948d3d3..b57680c39c9 100644
--- a/internal/service/iam/group.go
+++ b/internal/service/iam/group.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/iam"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -39,7 +42,7 @@ func ResourceGroup() *schema.Resource {
 				Type:     schema.TypeString,
 				Required: true,
 				ValidateFunc: validation.StringMatch(
-					regexp.MustCompile(`^[0-9A-Za-z=,.@\-_+]+$`),
+					regexache.MustCompile(`^[0-9A-Za-z=,.@\-_+]+$`),
 					"must only contain alphanumeric characters, hyphens, underscores, commas, periods, @ symbols, plus and equals signs",
 				),
 			},
diff --git a/internal/service/iam/group_data_source.go b/internal/service/iam/group_data_source.go
index 87b6d9aa76c..c1f3d94bb06 100644
--- a/internal/service/iam/group_data_source.go
+++ b/internal/service/iam/group_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam
 
 import (
diff --git a/internal/service/iam/group_data_source_test.go b/internal/service/iam/group_data_source_test.go
index 2e51da446a6..a428dd2ff19 100644
--- a/internal/service/iam/group_data_source_test.go
+++ b/internal/service/iam/group_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam_test
 
 import (
diff --git a/internal/service/iam/group_membership.go b/internal/service/iam/group_membership.go
index 273fef748b5..64c52ea2178 100644
--- a/internal/service/iam/group_membership.go
+++ b/internal/service/iam/group_membership.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam
 
 import (
diff --git a/internal/service/iam/group_membership_test.go b/internal/service/iam/group_membership_test.go
index a892f5cefe2..d3339a9e823 100644
--- a/internal/service/iam/group_membership_test.go
+++ b/internal/service/iam/group_membership_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam_test
 
 import (
diff --git a/internal/service/iam/group_policy.go b/internal/service/iam/group_policy.go
index 5d47143ff4f..4e31f9ab7bd 100644
--- a/internal/service/iam/group_policy.go
+++ b/internal/service/iam/group_policy.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam
 
 import (
@@ -11,10 +14,10 @@ import (
 	"github.com/aws/aws-sdk-go/service/iam"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/create"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
@@ -23,11 +26,9 @@ import (
 // @SDKResource("aws_iam_group_policy")
 func ResourceGroupPolicy() *schema.Resource {
 	return &schema.Resource{
-		// PutGroupPolicy API is idempotent, so these can be the same.
 		CreateWithoutTimeout: resourceGroupPolicyPut,
-		UpdateWithoutTimeout: resourceGroupPolicyPut,
-
 		ReadWithoutTimeout:   resourceGroupPolicyRead,
+		UpdateWithoutTimeout: resourceGroupPolicyPut,
 		DeleteWithoutTimeout: resourceGroupPolicyDelete,
 
 		Importer: &schema.ResourceImporter{
@@ -35,16 +36,10 @@ func ResourceGroupPolicy() *schema.Resource {
 		},
 
 		Schema: map[string]*schema.Schema{
-			"policy": {
-				Type:                  schema.TypeString,
-				Required:              true,
-				ValidateFunc:          verify.ValidIAMPolicyJSON,
-				DiffSuppressFunc:      verify.SuppressEquivalentPolicyDiffs,
-				DiffSuppressOnRefresh: true,
-				StateFunc: func(v interface{}) string {
-					json, _ := verify.LegacyPolicyNormalize(v)
-					return json
-				},
+			"group": {
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
 			},
 			"name": {
 				Type:          schema.TypeString,
@@ -56,13 +51,20 @@ func ResourceGroupPolicy() *schema.Resource {
 			"name_prefix": {
 				Type:          schema.TypeString,
 				Optional:      true,
+				Computed:      true,
 				ForceNew:      true,
 				ConflictsWith: []string{"name"},
 			},
-			"group": {
-				Type:     schema.TypeString,
-				Required: true,
-				ForceNew: true,
+			"policy": {
+				Type:                  schema.TypeString,
+				Required:              true,
+				ValidateFunc:          verify.ValidIAMPolicyJSON,
+				DiffSuppressFunc:      verify.SuppressEquivalentPolicyDiffs,
+				DiffSuppressOnRefresh: true,
+				StateFunc: func(v interface{}) string {
+					json, _ := verify.LegacyPolicyNormalize(v)
+					return json
+				},
 			},
 		},
 	}
@@ -74,70 +76,51 @@ func resourceGroupPolicyPut(ctx context.Context, d *schema.ResourceData, meta in
 
 	policyDoc, err := verify.LegacyPolicyNormalize(d.Get("policy").(string))
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "policy (%s) is invalid JSON: %s", policyDoc, err)
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
+	groupName := d.Get("group").(string)
+	policyName := create.Name(d.Get("name").(string), d.Get("name_prefix").(string))
 	request := &iam.PutGroupPolicyInput{
-		GroupName:      aws.String(d.Get("group").(string)),
+		GroupName:      aws.String(groupName),
 		PolicyDocument: aws.String(policyDoc),
+		PolicyName:     aws.String(policyName),
 	}
 
-	var policyName string
-	if v, ok := d.GetOk("name"); ok {
-		policyName = v.(string)
-	} else if v, ok := d.GetOk("name_prefix"); ok {
-		policyName = id.PrefixedUniqueId(v.(string))
-	} else {
-		policyName = id.UniqueId()
+	_, err = conn.PutGroupPolicyWithContext(ctx, request)
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "putting IAM Group (%s) Policy (%s): %s", groupName, policyName, err)
 	}
-	request.PolicyName = aws.String(policyName)
 
-	if _, err := conn.PutGroupPolicyWithContext(ctx, request); err != nil {
-		return sdkdiag.AppendErrorf(diags, "putting IAM group policy %s: %s", *request.PolicyName, err)
+	if d.IsNewResource() {
+		d.SetId(fmt.Sprintf("%s:%s", groupName, policyName))
+
+		_, err := tfresource.RetryWhenNotFound(ctx, propagationTimeout, func() (interface{}, error) {
+			return FindGroupPolicyByTwoPartKey(ctx, conn, groupName, policyName)
+		})
+
+		if err != nil {
+			return sdkdiag.AppendErrorf(diags, "waiting for IAM Group Policy (%s) create: %s", d.Id(), err)
+		}
 	}
 
-	d.SetId(fmt.Sprintf("%s:%s", *request.GroupName, *request.PolicyName))
-	return diags
+	return append(diags, resourceGroupPolicyRead(ctx, d, meta)...)
 }
 
 func resourceGroupPolicyRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).IAMConn(ctx)
 
-	group, name, err := GroupPolicyParseID(d.Id())
+	groupName, policyName, err := GroupPolicyParseID(d.Id())
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "reading IAM Group Policy (%s): %s", d.Id(), err)
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
-	request := &iam.GetGroupPolicyInput{
-		PolicyName: aws.String(name),
-		GroupName:  aws.String(group),
-	}
-
-	var getResp *iam.GetGroupPolicyOutput
-
-	err = retry.RetryContext(ctx, propagationTimeout, func() *retry.RetryError {
-		var err error
-
-		getResp, err = conn.GetGroupPolicyWithContext(ctx, request)
-
-		if d.IsNewResource() && tfawserr.ErrCodeEquals(err, iam.ErrCodeNoSuchEntityException) {
-			return retry.RetryableError(err)
-		}
-
-		if err != nil {
-			return retry.NonRetryableError(err)
-		}
-
-		return nil
-	})
-
-	if tfresource.TimedOut(err) {
-		getResp, err = conn.GetGroupPolicyWithContext(ctx, request)
-	}
+	policyDocument, err := FindGroupPolicyByTwoPartKey(ctx, conn, groupName, policyName)
 
-	if !d.IsNewResource() && tfawserr.ErrCodeEquals(err, iam.ErrCodeNoSuchEntityException) {
-		log.Printf("[WARN] IAM Group Policy (%s) not found, removing from state", d.Id())
+	if !d.IsNewResource() && tfresource.NotFound(err) {
+		log.Printf("[WARN] IAM Group Policy %s not found, removing from state", d.Id())
 		d.SetId("")
 		return diags
 	}
@@ -146,30 +129,21 @@ func resourceGroupPolicyRead(ctx context.Context, d *schema.ResourceData, meta i
 		return sdkdiag.AppendErrorf(diags, "reading IAM Group Policy (%s): %s", d.Id(), err)
 	}
 
-	if getResp == nil || getResp.PolicyDocument == nil {
-		return sdkdiag.AppendErrorf(diags, "reading IAM Group Policy (%s): empty response", d.Id())
-	}
-
-	policy, err := url.QueryUnescape(*getResp.PolicyDocument)
+	policy, err := url.QueryUnescape(policyDocument)
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "reading IAM Group Policy (%s): %s", d.Id(), err)
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
 	policyToSet, err := verify.LegacyPolicyToSet(d.Get("policy").(string), policy)
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "reading IAM Group Policy (%s): setting policy: %s", d.Id(), err)
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
+	d.Set("group", groupName)
+	d.Set("name", policyName)
+	d.Set("name_prefix", create.NamePrefixFromName(policyName))
 	d.Set("policy", policyToSet)
 
-	if err := d.Set("name", name); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting name: %s", err)
-	}
-
-	if err := d.Set("group", group); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting group: %s", err)
-	}
-
 	return diags
 }
 
@@ -177,25 +151,54 @@ func resourceGroupPolicyDelete(ctx context.Context, d *schema.ResourceData, meta
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).IAMConn(ctx)
 
-	group, name, err := GroupPolicyParseID(d.Id())
+	groupName, policyName, err := GroupPolicyParseID(d.Id())
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "deleting IAM Group Policy (%s): %s", d.Id(), err)
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
-	request := &iam.DeleteGroupPolicyInput{
-		PolicyName: aws.String(name),
-		GroupName:  aws.String(group),
+	log.Printf("[INFO] Deleting IAM Group Policy: %s", d.Id())
+	_, err = conn.DeleteGroupPolicyWithContext(ctx, &iam.DeleteGroupPolicyInput{
+		GroupName:  aws.String(groupName),
+		PolicyName: aws.String(policyName),
+	})
+
+	if tfawserr.ErrCodeEquals(err, iam.ErrCodeNoSuchEntityException) {
+		return diags
 	}
 
-	if _, err := conn.DeleteGroupPolicyWithContext(ctx, request); err != nil {
-		if tfawserr.ErrCodeEquals(err, iam.ErrCodeNoSuchEntityException) {
-			return diags
-		}
+	if err != nil {
 		return sdkdiag.AppendErrorf(diags, "deleting IAM Group Policy (%s): %s", d.Id(), err)
 	}
+
 	return diags
 }
 
+func FindGroupPolicyByTwoPartKey(ctx context.Context, conn *iam.IAM, groupName, policyName string) (string, error) {
+	input := &iam.GetGroupPolicyInput{
+		GroupName:  aws.String(groupName),
+		PolicyName: aws.String(policyName),
+	}
+
+	output, err := conn.GetGroupPolicyWithContext(ctx, input)
+
+	if tfawserr.ErrCodeEquals(err, iam.ErrCodeNoSuchEntityException) {
+		return "", &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+
+	if err != nil {
+		return "", err
+	}
+
+	if output == nil || output.PolicyDocument == nil {
+		return "", tfresource.NewEmptyResultError(input)
+	}
+
+	return aws.StringValue(output.PolicyDocument), nil
+}
+
 func GroupPolicyParseID(id string) (groupName, policyName string, err error) {
 	parts := strings.SplitN(id, ":", 2)
 	if len(parts) != 2 || parts[0] == "" || parts[1] == "" {
diff --git a/internal/service/iam/group_policy_attachment.go b/internal/service/iam/group_policy_attachment.go
index 189b8e9a8d3..4686bb34238 100644
--- a/internal/service/iam/group_policy_attachment.go
+++ b/internal/service/iam/group_policy_attachment.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam
 
 import (
diff --git a/internal/service/iam/group_policy_attachment_test.go b/internal/service/iam/group_policy_attachment_test.go
index 03394a03918..f6a7f9e12c7 100644
--- a/internal/service/iam/group_policy_attachment_test.go
+++ b/internal/service/iam/group_policy_attachment_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam_test
 
 import (
diff --git a/internal/service/iam/group_policy_test.go b/internal/service/iam/group_policy_test.go
index f6b4a458b37..cd4abdf4b25 100644
--- a/internal/service/iam/group_policy_test.go
+++ b/internal/service/iam/group_policy_test.go
@@ -1,26 +1,29 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam_test
 
 import (
 	"context"
-	"errors"
 	"fmt"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/iam"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	tfiam "github.com/hashicorp/terraform-provider-aws/internal/service/iam"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
 func TestAccIAMGroupPolicy_basic(t *testing.T) {
 	ctx := acctest.Context(t)
-	var groupPolicy1, groupPolicy2 iam.GetGroupPolicyOutput
+	var groupPolicy string
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_iam_group_policy.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
@@ -29,31 +32,15 @@ func TestAccIAMGroupPolicy_basic(t *testing.T) {
 		CheckDestroy:             testAccCheckGroupPolicyDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccGroupPolicyConfig_basic(rName),
+				Config: testAccGroupPolicyConfig_basic(rName, "*"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckGroupPolicyExists(ctx, "aws_iam_group.group",
-						"aws_iam_group_policy.foo",
-						&groupPolicy1,
-					),
-				),
-			},
-			{
-				ResourceName:      "aws_iam_group_policy.foo",
-				ImportState:       true,
-				ImportStateVerify: true,
-			},
-			{
-				Config: testAccGroupPolicyConfig_update(rName),
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckGroupPolicyExists(ctx, "aws_iam_group.group",
-						"aws_iam_group_policy.bar",
-						&groupPolicy2,
-					),
-					testAccCheckGroupPolicyNameChanged(&groupPolicy1, &groupPolicy2),
+					testAccCheckGroupPolicyExists(ctx, resourceName, &groupPolicy),
+					resource.TestCheckResourceAttr(resourceName, "name", rName),
+					resource.TestCheckResourceAttr(resourceName, "name_prefix", ""),
 				),
 			},
 			{
-				ResourceName:      "aws_iam_group_policy.bar",
+				ResourceName:      resourceName,
 				ImportState:       true,
 				ImportStateVerify: true,
 			},
@@ -63,8 +50,9 @@ func TestAccIAMGroupPolicy_basic(t *testing.T) {
 
 func TestAccIAMGroupPolicy_disappears(t *testing.T) {
 	ctx := acctest.Context(t)
-	var out iam.GetGroupPolicyOutput
+	var groupPolicy string
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_iam_group_policy.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
@@ -73,13 +61,10 @@ func TestAccIAMGroupPolicy_disappears(t *testing.T) {
 		CheckDestroy:             testAccCheckGroupPolicyDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccGroupPolicyConfig_basic(rName),
+				Config: testAccGroupPolicyConfig_basic(rName, "*"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckGroupPolicyExists(ctx, "aws_iam_group.group",
-						"aws_iam_group_policy.foo",
-						&out,
-					),
-					testAccCheckGroupPolicyDisappears(ctx, &out),
+					testAccCheckGroupPolicyExists(ctx, resourceName, &groupPolicy),
+					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfiam.ResourceGroupPolicy(), resourceName),
 				),
 				ExpectNonEmptyPlan: true,
 			},
@@ -87,10 +72,11 @@ func TestAccIAMGroupPolicy_disappears(t *testing.T) {
 	})
 }
 
-func TestAccIAMGroupPolicy_namePrefix(t *testing.T) {
+func TestAccIAMGroupPolicy_nameGenerated(t *testing.T) {
 	ctx := acctest.Context(t)
-	var groupPolicy1, groupPolicy2 iam.GetGroupPolicyOutput
+	var groupPolicy string
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_iam_group_policy.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
@@ -99,38 +85,27 @@ func TestAccIAMGroupPolicy_namePrefix(t *testing.T) {
 		CheckDestroy:             testAccCheckGroupPolicyDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccGroupPolicyConfig_namePrefix(rName, "*"),
+				Config: testAccGroupPolicyConfig_nameGenerated(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckGroupPolicyExists(ctx, "aws_iam_group.test",
-						"aws_iam_group_policy.test",
-						&groupPolicy1,
-					),
+					testAccCheckGroupPolicyExists(ctx, resourceName, &groupPolicy),
+					acctest.CheckResourceAttrNameGenerated(resourceName, "name"),
+					resource.TestCheckResourceAttr(resourceName, "name_prefix", id.UniqueIdPrefix),
 				),
 			},
 			{
-				Config: testAccGroupPolicyConfig_namePrefix(rName, "ec2:*"),
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckGroupPolicyExists(ctx, "aws_iam_group.test",
-						"aws_iam_group_policy.test",
-						&groupPolicy2,
-					),
-					testAccCheckGroupPolicyNameMatches(&groupPolicy1, &groupPolicy2),
-				),
-			},
-			{
-				ResourceName:            "aws_iam_group_policy.test",
-				ImportState:             true,
-				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"name_prefix"},
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
 			},
 		},
 	})
 }
 
-func TestAccIAMGroupPolicy_generatedName(t *testing.T) {
+func TestAccIAMGroupPolicy_namePrefix(t *testing.T) {
 	ctx := acctest.Context(t)
-	var groupPolicy1, groupPolicy2 iam.GetGroupPolicyOutput
+	var groupPolicy string
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_iam_group_policy.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
@@ -139,26 +114,15 @@ func TestAccIAMGroupPolicy_generatedName(t *testing.T) {
 		CheckDestroy:             testAccCheckGroupPolicyDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccGroupPolicyConfig_generatedName(rName, "*"),
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckGroupPolicyExists(ctx, "aws_iam_group.test",
-						"aws_iam_group_policy.test",
-						&groupPolicy1,
-					),
-				),
-			},
-			{
-				Config: testAccGroupPolicyConfig_generatedName(rName, "ec2:*"),
+				Config: testAccGroupPolicyConfig_namePrefix(rName, "tf-acc-test-prefix-"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckGroupPolicyExists(ctx, "aws_iam_group.test",
-						"aws_iam_group_policy.test",
-						&groupPolicy2,
-					),
-					testAccCheckGroupPolicyNameMatches(&groupPolicy1, &groupPolicy2),
+					testAccCheckGroupPolicyExists(ctx, resourceName, &groupPolicy),
+					acctest.CheckResourceAttrNameFromPrefix(resourceName, "name", "tf-acc-test-prefix-"),
+					resource.TestCheckResourceAttr(resourceName, "name_prefix", "tf-acc-test-prefix-"),
 				),
 			},
 			{
-				ResourceName:      "aws_iam_group_policy.test",
+				ResourceName:      resourceName,
 				ImportState:       true,
 				ImportStateVerify: true,
 			},
@@ -173,10 +137,9 @@ func TestAccIAMGroupPolicy_generatedName(t *testing.T) {
 // during that step.
 func TestAccIAMGroupPolicy_unknownsInPolicy(t *testing.T) {
 	ctx := acctest.Context(t)
-	var gp iam.GetGroupPolicyOutput
+	var groupPolicy string
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_iam_group_policy.test"
-	groupName := "aws_iam_group.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
@@ -187,8 +150,40 @@ func TestAccIAMGroupPolicy_unknownsInPolicy(t *testing.T) {
 			{
 				Config: testAccGroupPolicyConfig_unknowns(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckGroupPolicyExists(ctx, groupName, resourceName, &gp),
+					testAccCheckGroupPolicyExists(ctx, resourceName, &groupPolicy),
+					resource.TestCheckResourceAttr(resourceName, "name", rName),
+				),
+			},
+		},
+	})
+}
+
+func TestAccIAMGroupPolicy_update(t *testing.T) {
+	ctx := acctest.Context(t)
+	var groupPolicy string
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_iam_group_policy.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, iam.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckGroupPolicyDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccGroupPolicyConfig_basic(rName, "*"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckGroupPolicyExists(ctx, resourceName, &groupPolicy),
+					resource.TestCheckResourceAttr(resourceName, "name", rName),
+					resource.TestCheckResourceAttr(resourceName, "name_prefix", ""),
+				),
+			},
+			{
+				Config: testAccGroupPolicyConfig_basic(rName, "ec2:*"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckGroupPolicyExists(ctx, resourceName, &groupPolicy),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
+					resource.TestCheckResourceAttr(resourceName, "name_prefix", ""),
 				),
 			},
 		},
@@ -204,134 +199,55 @@ func testAccCheckGroupPolicyDestroy(ctx context.Context) resource.TestCheckFunc
 				continue
 			}
 
-			group, name, err := tfiam.GroupPolicyParseID(rs.Primary.ID)
+			groupName, policyName, err := tfiam.GroupPolicyParseID(rs.Primary.ID)
 			if err != nil {
 				return err
 			}
 
-			request := &iam.GetGroupPolicyInput{
-				PolicyName: aws.String(name),
-				GroupName:  aws.String(group),
+			_, err = tfiam.FindGroupPolicyByTwoPartKey(ctx, conn, groupName, policyName)
+
+			if tfresource.NotFound(err) {
+				continue
 			}
 
-			getResp, err := conn.GetGroupPolicyWithContext(ctx, request)
 			if err != nil {
-				if tfawserr.ErrCodeEquals(err, iam.ErrCodeNoSuchEntityException) {
-					// none found, that's good
-					continue
-				}
-				return fmt.Errorf("Error reading IAM policy %s from group %s: %s", name, group, err)
+				return err
 			}
 
-			if getResp != nil {
-				return fmt.Errorf("Found IAM group policy, expected none: %s", getResp)
-			}
+			return fmt.Errorf("IAM Group Policy %s still exists", rs.Primary.ID)
 		}
 
 		return nil
 	}
 }
 
-func testAccCheckGroupPolicyDisappears(ctx context.Context, out *iam.GetGroupPolicyOutput) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		conn := acctest.Provider.Meta().(*conns.AWSClient).IAMConn(ctx)
-
-		params := &iam.DeleteGroupPolicyInput{
-			PolicyName: out.PolicyName,
-			GroupName:  out.GroupName,
-		}
-
-		_, err := conn.DeleteGroupPolicyWithContext(ctx, params)
-		return err
-	}
-}
-
-func testAccCheckGroupPolicyExists(ctx context.Context,
-	iamGroupResource string,
-	iamGroupPolicyResource string,
-	groupPolicy *iam.GetGroupPolicyOutput) resource.TestCheckFunc {
+func testAccCheckGroupPolicyExists(ctx context.Context, n string, v *string) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		rs, ok := s.RootModule().Resources[iamGroupResource]
-		if !ok {
-			return fmt.Errorf("Not Found: %s", iamGroupResource)
-		}
-
-		if rs.Primary.ID == "" {
-			return fmt.Errorf("No ID is set")
-		}
-
-		policy, ok := s.RootModule().Resources[iamGroupPolicyResource]
+		rs, ok := s.RootModule().Resources[n]
 		if !ok {
-			return fmt.Errorf("Not Found: %s", iamGroupPolicyResource)
+			return fmt.Errorf("Not Found: %s", n)
 		}
 
-		conn := acctest.Provider.Meta().(*conns.AWSClient).IAMConn(ctx)
-		group, name, err := tfiam.GroupPolicyParseID(policy.Primary.ID)
+		groupName, policyName, err := tfiam.GroupPolicyParseID(rs.Primary.ID)
 		if err != nil {
 			return err
 		}
 
-		output, err := conn.GetGroupPolicyWithContext(ctx, &iam.GetGroupPolicyInput{
-			GroupName:  aws.String(group),
-			PolicyName: aws.String(name),
-		})
+		conn := acctest.Provider.Meta().(*conns.AWSClient).IAMConn(ctx)
+
+		output, err := tfiam.FindGroupPolicyByTwoPartKey(ctx, conn, groupName, policyName)
 
 		if err != nil {
 			return err
 		}
 
-		*groupPolicy = *output
+		*v = output
 
 		return nil
 	}
 }
 
-func testAccCheckGroupPolicyNameChanged(i, j *iam.GetGroupPolicyOutput) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		if aws.StringValue(i.PolicyName) == aws.StringValue(j.PolicyName) {
-			return errors.New("IAM Group Policy name did not change")
-		}
-
-		return nil
-	}
-}
-
-func testAccCheckGroupPolicyNameMatches(i, j *iam.GetGroupPolicyOutput) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		if aws.StringValue(i.PolicyName) != aws.StringValue(j.PolicyName) {
-			return errors.New("IAM Group Policy name did not match")
-		}
-
-		return nil
-	}
-}
-
-func testAccGroupPolicyConfig_basic(rName string) string {
-	return fmt.Sprintf(`
-resource "aws_iam_group" "group" {
-  name = %[1]q
-  path = "/"
-}
-
-resource "aws_iam_group_policy" "foo" {
-  name  = %[1]q
-  group = aws_iam_group.group.name
-
-  policy = <<EOF
-{
-  "Version": "2012-10-17",
-  "Statement": {
-    "Effect": "Allow",
-    "Action": "*",
-    "Resource": "*"
-  }
-}
-EOF
-}
-`, rName)
-}
-
-func testAccGroupPolicyConfig_namePrefix(rName, policyAction string) string {
+func testAccGroupPolicyConfig_basic(rName, action string) string {
 	return fmt.Sprintf(`
 resource "aws_iam_group" "test" {
   name = %[1]q
@@ -339,8 +255,8 @@ resource "aws_iam_group" "test" {
 }
 
 resource "aws_iam_group_policy" "test" {
-  name_prefix = %[1]q
-  group       = aws_iam_group.test.name
+  name  = %[1]q
+  group = aws_iam_group.test.name
 
   policy = <<EOF
 {
@@ -353,10 +269,10 @@ resource "aws_iam_group_policy" "test" {
 }
 EOF
 }
-`, rName, policyAction)
+`, rName, action)
 }
 
-func testAccGroupPolicyConfig_generatedName(rName, policyAction string) string {
+func testAccGroupPolicyConfig_nameGenerated(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_iam_group" "test" {
   name = %[1]q
@@ -370,42 +286,26 @@ resource "aws_iam_group_policy" "test" {
 {
   "Statement": {
     "Effect": "Allow",
-    "Action": %[2]q,
+    "Action": "*",
     "Resource": "*"
   },
   "Version": "2012-10-17"
 }
 EOF
 }
-`, rName, policyAction)
+`, rName)
 }
 
-func testAccGroupPolicyConfig_update(rName string) string {
+func testAccGroupPolicyConfig_namePrefix(rName, namePrefix string) string {
 	return fmt.Sprintf(`
-resource "aws_iam_group" "group" {
+resource "aws_iam_group" "test" {
   name = %[1]q
   path = "/"
 }
 
-resource "aws_iam_group_policy" "foo" {
-  name  = %[1]q
-  group = aws_iam_group.group.name
-
-  policy = <<EOF
-{
-  "Version": "2012-10-17",
-  "Statement": {
-    "Effect": "Allow",
-    "Action": "*",
-    "Resource": "*"
-  }
-}
-EOF
-}
-
-resource "aws_iam_group_policy" "bar" {
-  name  = "%[1]s-2"
-  group = aws_iam_group.group.name
+resource "aws_iam_group_policy" "test" {
+  name_prefix = %[2]q
+  group       = aws_iam_group.test.name
 
   policy = <<EOF
 {
@@ -418,13 +318,12 @@ resource "aws_iam_group_policy" "bar" {
 }
 EOF
 }
-`, rName)
+`, rName, namePrefix)
 }
 
 func testAccGroupPolicyConfig_unknowns(rName string) string {
 	return fmt.Sprintf(`
 data "aws_caller_identity" "current" {}
-
 data "aws_partition" "current" {}
 
 resource "aws_iam_group" "test" {
@@ -436,11 +335,6 @@ resource "aws_s3_bucket" "test" {
   bucket = %[1]q
 }
 
-resource "aws_s3_bucket_acl" "test" {
-  bucket = aws_s3_bucket.test.id
-  acl    = "private"
-}
-
 resource "aws_iam_group_policy" "test" {
   name  = %[1]q
   group = aws_iam_group.test.id
diff --git a/internal/service/iam/group_test.go b/internal/service/iam/group_test.go
index edd719a9896..d5e24d9bef2 100644
--- a/internal/service/iam/group_test.go
+++ b/internal/service/iam/group_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam_test
 
 import (
diff --git a/internal/service/iam/instance_profile.go b/internal/service/iam/instance_profile.go
index 8ea476d09d0..7f3a3fdb9f9 100644
--- a/internal/service/iam/instance_profile.go
+++ b/internal/service/iam/instance_profile.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam
 
 import (
diff --git a/internal/service/iam/instance_profile_data_source.go b/internal/service/iam/instance_profile_data_source.go
index 9edaa8609d8..5151dd20c3a 100644
--- a/internal/service/iam/instance_profile_data_source.go
+++ b/internal/service/iam/instance_profile_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam
 
 import (
diff --git a/internal/service/iam/instance_profile_data_source_test.go b/internal/service/iam/instance_profile_data_source_test.go
index bb5bcf9cdee..f1715cb2d60 100644
--- a/internal/service/iam/instance_profile_data_source_test.go
+++ b/internal/service/iam/instance_profile_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam_test
 
 import (
diff --git a/internal/service/iam/instance_profile_test.go b/internal/service/iam/instance_profile_test.go
index 2616222a580..073833c365c 100644
--- a/internal/service/iam/instance_profile_test.go
+++ b/internal/service/iam/instance_profile_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam_test
 
 import (
diff --git a/internal/service/iam/instance_profiles_data_source.go b/internal/service/iam/instance_profiles_data_source.go
index e09a0bb05c7..e87eaf02c8b 100644
--- a/internal/service/iam/instance_profiles_data_source.go
+++ b/internal/service/iam/instance_profiles_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam
 
 import (
@@ -5,7 +8,9 @@ import (
 
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/iam"
+	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 )
@@ -44,10 +49,33 @@ func dataSourceInstanceProfilesRead(ctx context.Context, d *schema.ResourceData,
 	conn := meta.(*conns.AWSClient).IAMConn(ctx)
 
 	roleName := d.Get("role_name").(string)
+	instanceProfiles, err := findInstanceProfilesForRole(ctx, conn, roleName)
+
+	if err != nil {
+		return diag.Errorf("reading IAM Instance Profiles for Role (%s): %s", roleName, err)
+	}
+
+	var arns, names, paths []string
+
+	for _, v := range instanceProfiles {
+		arns = append(arns, aws.StringValue(v.Arn))
+		names = append(names, aws.StringValue(v.InstanceProfileName))
+		paths = append(paths, aws.StringValue(v.Path))
+	}
+
+	d.SetId(roleName)
+	d.Set("arns", arns)
+	d.Set("names", names)
+	d.Set("paths", paths)
+
+	return nil
+}
+
+func findInstanceProfilesForRole(ctx context.Context, conn *iam.IAM, roleName string) ([]*iam.InstanceProfile, error) {
 	input := &iam.ListInstanceProfilesForRoleInput{
 		RoleName: aws.String(roleName),
 	}
-	var arns, names, paths []string
+	var output []*iam.InstanceProfile
 
 	err := conn.ListInstanceProfilesForRolePagesWithContext(ctx, input, func(page *iam.ListInstanceProfilesForRoleOutput, lastPage bool) bool {
 		if page == nil {
@@ -55,22 +83,24 @@ func dataSourceInstanceProfilesRead(ctx context.Context, d *schema.ResourceData,
 		}
 
 		for _, v := range page.InstanceProfiles {
-			arns = append(arns, aws.StringValue(v.Arn))
-			names = append(names, aws.StringValue(v.InstanceProfileName))
-			paths = append(paths, aws.StringValue(v.Path))
+			if v != nil {
+				output = append(output, v)
+			}
 		}
 
 		return !lastPage
 	})
 
-	if err != nil {
-		return diag.Errorf("listing IAM Instance Profiles for Role (%s): %s", roleName, err)
+	if tfawserr.ErrCodeEquals(err, iam.ErrCodeNoSuchEntityException) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
 	}
 
-	d.SetId(roleName)
-	d.Set("arns", arns)
-	d.Set("names", names)
-	d.Set("paths", paths)
+	if err != nil {
+		return nil, err
+	}
 
-	return nil
+	return output, nil
 }
diff --git a/internal/service/iam/instance_profiles_data_source_test.go b/internal/service/iam/instance_profiles_data_source_test.go
index 46f23f01cd7..4a3c6403f66 100644
--- a/internal/service/iam/instance_profiles_data_source_test.go
+++ b/internal/service/iam/instance_profiles_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam_test
 
 import (
diff --git a/internal/service/iam/openid_connect_provider.go b/internal/service/iam/openid_connect_provider.go
index 6d62305d55f..b0db1ce5a6d 100644
--- a/internal/service/iam/openid_connect_provider.go
+++ b/internal/service/iam/openid_connect_provider.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam
 
 import (
diff --git a/internal/service/iam/openid_connect_provider_data_source.go b/internal/service/iam/openid_connect_provider_data_source.go
index a8c2994fdbf..0d567cb4548 100644
--- a/internal/service/iam/openid_connect_provider_data_source.go
+++ b/internal/service/iam/openid_connect_provider_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam
 
 import (
diff --git a/internal/service/iam/openid_connect_provider_data_source_test.go b/internal/service/iam/openid_connect_provider_data_source_test.go
index 90c8e8a3691..269289a3e2c 100644
--- a/internal/service/iam/openid_connect_provider_data_source_test.go
+++ b/internal/service/iam/openid_connect_provider_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam_test
 
 import (
@@ -92,52 +95,52 @@ func TestAccIAMOpenidConnectProviderDataSource_tags(t *testing.T) {
 	})
 }
 
-func testAccOpenIDConnectProviderDataSourceConfig_basic(rString string) string {
+func testAccOpenIDConnectProviderDataSourceConfig_basic(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_iam_openid_connect_provider" "test" {
-  url = "https://accounts.testle.com/%s"
+  url = "https://accounts.testle.com/%[1]s"
 
   client_id_list = [
     "266362248691-re108qaeld573ia0l6clj2i5ac7r7291.apps.testleusercontent.com",
   ]
 
-  thumbprint_list = []
+  thumbprint_list = ["cf23df2207d99a74fbe169e3eba035e633b65d94"]
 }
 
 data "aws_iam_openid_connect_provider" "test" {
   arn = aws_iam_openid_connect_provider.test.arn
 }
-`, rString)
+`, rName)
 }
 
-func testAccOpenIDConnectProviderDataSourceConfig_url(rString string) string {
+func testAccOpenIDConnectProviderDataSourceConfig_url(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_iam_openid_connect_provider" "test" {
-  url = "https://accounts.testle.com/%s"
+  url = "https://accounts.testle.com/%[1]s"
 
   client_id_list = [
     "266362248691-re108qaeld573ia0l6clj2i5ac7r7291.apps.testleusercontent.com",
   ]
 
-  thumbprint_list = []
+  thumbprint_list = ["cf23df2207d99a74fbe169e3eba035e633b65d94"]
 }
 
 data "aws_iam_openid_connect_provider" "test" {
   url = "https://${aws_iam_openid_connect_provider.test.url}"
 }
-`, rString)
+`, rName)
 }
 
-func testAccOpenIDConnectProviderDataSourceConfig_tags(rString string) string {
+func testAccOpenIDConnectProviderDataSourceConfig_tags(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_iam_openid_connect_provider" "test" {
-  url = "https://accounts.testle.com/%s"
+  url = "https://accounts.testle.com/%[1]s"
 
   client_id_list = [
     "266362248691-re108qaeld573ia0l6clj2i5ac7r7291.apps.testleusercontent.com",
   ]
 
-  thumbprint_list = []
+  thumbprint_list = ["cf23df2207d99a74fbe169e3eba035e633b65d94"]
 
   tags = {
     tag1 = "test-value1"
@@ -148,5 +151,5 @@ resource "aws_iam_openid_connect_provider" "test" {
 data "aws_iam_openid_connect_provider" "test" {
   arn = aws_iam_openid_connect_provider.test.arn
 }
-`, rString)
+`, rName)
 }
diff --git a/internal/service/iam/openid_connect_provider_test.go b/internal/service/iam/openid_connect_provider_test.go
index 33e4bd7da29..4d4f5531da7 100644
--- a/internal/service/iam/openid_connect_provider_test.go
+++ b/internal/service/iam/openid_connect_provider_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam_test
 
 import (
@@ -83,10 +86,9 @@ func TestAccIAMOpenIDConnectProvider_tags(t *testing.T) {
 				),
 			},
 			{
-				ResourceName:            resourceName,
-				ImportState:             true,
-				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"name_prefix"},
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
 			},
 			{
 				Config: testAccOpenIDConnectProviderConfig_tags2(rString, "key1", "value1updated", "key2", "value2"),
diff --git a/internal/service/iam/policy.go b/internal/service/iam/policy.go
index bdcc357a8aa..68302a637f6 100644
--- a/internal/service/iam/policy.go
+++ b/internal/service/iam/policy.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam
 
 import (
diff --git a/internal/service/iam/policy_attachment.go b/internal/service/iam/policy_attachment.go
index 988eb32e33a..5cab1ff5ca1 100644
--- a/internal/service/iam/policy_attachment.go
+++ b/internal/service/iam/policy_attachment.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam
 
 import (
diff --git a/internal/service/iam/policy_attachment_test.go b/internal/service/iam/policy_attachment_test.go
index d9e712716e0..ff5394a586a 100644
--- a/internal/service/iam/policy_attachment_test.go
+++ b/internal/service/iam/policy_attachment_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam_test
 
 import (
diff --git a/internal/service/iam/policy_data_source.go b/internal/service/iam/policy_data_source.go
index ce8a336a9b1..9e3696bee1a 100644
--- a/internal/service/iam/policy_data_source.go
+++ b/internal/service/iam/policy_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam
 
 import (
diff --git a/internal/service/iam/policy_data_source_test.go b/internal/service/iam/policy_data_source_test.go
index 761727477c2..3ecc7cb9451 100644
--- a/internal/service/iam/policy_data_source_test.go
+++ b/internal/service/iam/policy_data_source_test.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam_test
 
 import (
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/iam"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -192,7 +195,7 @@ func TestAccIAMPolicyDataSource_nonExistent(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccPolicyDataSourceConfig_nonExistent(policyName, policyPath),
-				ExpectError: regexp.MustCompile(`no matching IAM Policy found`),
+				ExpectError: regexache.MustCompile(`no matching IAM Policy found`),
 			},
 		},
 	})
diff --git a/internal/service/iam/policy_document_data_source.go b/internal/service/iam/policy_document_data_source.go
index 52ed861e4dc..0797c79fc2b 100644
--- a/internal/service/iam/policy_document_data_source.go
+++ b/internal/service/iam/policy_document_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam
 
 import (
diff --git a/internal/service/iam/policy_document_data_source_test.go b/internal/service/iam/policy_document_data_source_test.go
index c0148520fa2..85d71bbddad 100644
--- a/internal/service/iam/policy_document_data_source_test.go
+++ b/internal/service/iam/policy_document_data_source_test.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam_test
 
 import (
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws/endpoints"
 	"github.com/aws/aws-sdk-go/service/iam"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -71,6 +74,25 @@ func TestAccIAMPolicyDocumentDataSource_multipleConditionKeys(t *testing.T) {
 	})
 }
 
+func TestAccIAMPolicyDocumentDataSource_duplicateConditionKeys(t *testing.T) {
+	ctx := acctest.Context(t)
+	dataSourceName := "data.aws_iam_policy_document.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, iam.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccPolicyDocumentDataSourceConfig_duplicateConditionKeys,
+				Check: resource.ComposeTestCheckFunc(
+					acctest.CheckResourceAttrEquivalentJSON(dataSourceName, "json", testAccPolicyDocumentConfig_duplicateConditionKeys_ExpectedJSON),
+				),
+			},
+		},
+	})
+}
+
 func TestAccIAMPolicyDocumentDataSource_conditionWithBoolValue(t *testing.T) {
 	ctx := acctest.Context(t)
 	resource.ParallelTest(t, resource.TestCase{
@@ -167,7 +189,7 @@ func TestAccIAMPolicyDocumentDataSource_sourceListConflicting(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccPolicyDocumentDataSourceConfig_listConflicting,
-				ExpectError: regexp.MustCompile(`duplicate Sid (.*?)`),
+				ExpectError: regexache.MustCompile(`duplicate Sid (.*?)`),
 			},
 		},
 	})
@@ -258,7 +280,7 @@ func TestAccIAMPolicyDocumentDataSource_duplicateSid(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccPolicyDocumentDataSourceConfig_duplicateSid,
-				ExpectError: regexp.MustCompile(`duplicate Sid`),
+				ExpectError: regexache.MustCompile(`duplicate Sid`),
 			},
 			{
 				Config: testAccPolicyDocumentDataSourceConfig_duplicateBlankSid,
@@ -281,7 +303,7 @@ func TestAccIAMPolicyDocumentDataSource_sourcePolicyValidJSON(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccPolicyDocumentDataSourceConfig_invalidJSON,
-				ExpectError: regexp.MustCompile(`"source_policy_documents.0" contains an invalid JSON: unexpected end of JSON input`),
+				ExpectError: regexache.MustCompile(`"source_policy_documents.0" contains an invalid JSON: unexpected end of JSON input`),
 			},
 			{
 				Config: testAccPolicyDocumentDataSourceConfig_emptyString,
@@ -304,7 +326,7 @@ func TestAccIAMPolicyDocumentDataSource_overridePolicyDocumentValidJSON(t *testi
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccPolicyDocumentDataSourceConfig_overridePolicyDocument_invalidJSON,
-				ExpectError: regexp.MustCompile(`"override_policy_documents.0" contains an invalid JSON: unexpected end of JSON input`),
+				ExpectError: regexache.MustCompile(`"override_policy_documents.0" contains an invalid JSON: unexpected end of JSON input`),
 			},
 			{
 				Config: testAccPolicyDocumentDataSourceConfig_overridePolicyDocument_emptyString,
@@ -386,23 +408,23 @@ func TestAccIAMPolicyDocumentDataSource_version20081017(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccPolicyDocumentDataSourceConfig_version20081017ConversionCondition,
-				ExpectError: regexp.MustCompile(`found \&\{ sequence in \(.+\), which is not supported in document version 2008-10-17`),
+				ExpectError: regexache.MustCompile(`found \&\{ sequence in \(.+\), which is not supported in document version 2008-10-17`),
 			},
 			{
 				Config:      testAccPolicyDocumentDataSourceConfig_version20081017ConversionNotPrincipals,
-				ExpectError: regexp.MustCompile(`found \&\{ sequence in \(.+\), which is not supported in document version 2008-10-17`),
+				ExpectError: regexache.MustCompile(`found \&\{ sequence in \(.+\), which is not supported in document version 2008-10-17`),
 			},
 			{
 				Config:      testAccPolicyDocumentDataSourceConfig_version20081017ConversionNotRe,
-				ExpectError: regexp.MustCompile(`found \&\{ sequence in \(.+\), which is not supported in document version 2008-10-17`),
+				ExpectError: regexache.MustCompile(`found \&\{ sequence in \(.+\), which is not supported in document version 2008-10-17`),
 			},
 			{
 				Config:      testAccPolicyDocumentDataSourceConfig_version20081017ConversionPrincipal,
-				ExpectError: regexp.MustCompile(`found \&\{ sequence in \(.+\), which is not supported in document version 2008-10-17`),
+				ExpectError: regexache.MustCompile(`found \&\{ sequence in \(.+\), which is not supported in document version 2008-10-17`),
 			},
 			{
 				Config:      testAccPolicyDocumentDataSourceConfig_version20081017ConversionRe,
-				ExpectError: regexp.MustCompile(`found \&\{ sequence in \(.+\), which is not supported in document version 2008-10-17`),
+				ExpectError: regexache.MustCompile(`found \&\{ sequence in \(.+\), which is not supported in document version 2008-10-17`),
 			},
 			{
 				Config: testAccPolicyDocumentDataSourceConfig_version20081017,
@@ -659,6 +681,57 @@ var testAccPolicyDocumentConfig_multipleConditionKeys_ExpectedJSON = `{
 }
 `
 
+const testAccPolicyDocumentDataSourceConfig_duplicateConditionKeys = `
+data "aws_iam_policy_document" "test" {
+  statement {
+    sid = "DuplicateConditionTest"
+
+    effect = "Allow"
+
+    principals {
+      type        = "Service"
+      identifiers = ["cloudtrail.amazonaws.com"]
+    }
+
+    actions = ["s3:PutObject"]
+
+    resources = ["*"]
+
+    condition {
+      test     = "StringEquals"
+      variable = "s3:prefix"
+      values   = ["one/", "two/"]
+    }
+    condition {
+      test     = "StringEquals"
+      variable = "s3:prefix"
+      values   = ["three/"]
+    }
+  }
+}
+`
+
+const testAccPolicyDocumentConfig_duplicateConditionKeys_ExpectedJSON = `{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Sid": "DuplicateConditionTest",
+      "Effect": "Allow",
+      "Action": "s3:PutObject",
+      "Resource": "*",
+      "Principal": {
+        "Service": "cloudtrail.amazonaws.com"
+      },
+      "Condition": {
+        "StringEquals": {
+          "s3:prefix": ["one/", "two/", "three/"]
+        }
+      }
+    }
+  ]
+}
+`
+
 var testAccPolicyDocumentDataSourceConfig_deprecated = `
 data "aws_partition" "current" {}
 
@@ -1406,12 +1479,8 @@ func testAccPolicyDocumentConditionWithBoolValueExpectedJSON() string {
                     "aws:ResourceTag/SpecialTag": "false"
                 },
                 "StringLike": {
-                    "aws:ResourceAccount": [
-                        "123456"
-                    ],
-                    "aws:PrincipalArn": [
-						"arn:%[1]s:iam::*:role/AWSAFTExecution"
-					]
+                    "aws:ResourceAccount": "123456",
+                    "aws:PrincipalArn": "arn:%[1]s:iam::*:role/AWSAFTExecution"
                 }
             }
         }
diff --git a/internal/service/iam/policy_model.go b/internal/service/iam/policy_model.go
index 6c9edd7b184..6a086aa7074 100644
--- a/internal/service/iam/policy_model.go
+++ b/internal/service/iam/policy_model.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam
 
 import (
 	"encoding/json"
 	"fmt"
-	"regexp"
 	"sort"
 	"strconv"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/jmespath/go-jmespath"
 )
@@ -174,20 +177,30 @@ func (cs IAMPolicyStatementConditionSet) MarshalJSON() ([]byte, error) {
 		if _, ok := raw[c.Test]; !ok {
 			raw[c.Test] = map[string]interface{}{}
 		}
+		if _, ok := raw[c.Test][c.Variable]; !ok {
+			raw[c.Test][c.Variable] = []string{}
+		}
 		switch i := c.Values.(type) {
 		case []string:
-			if _, ok := raw[c.Test][c.Variable]; !ok {
-				raw[c.Test][c.Variable] = make([]string, 0, len(i))
-			}
 			// order matters with values so not sorting here
 			raw[c.Test][c.Variable] = append(raw[c.Test][c.Variable].([]string), i...)
 		case string:
-			raw[c.Test][c.Variable] = i
+			raw[c.Test][c.Variable] = append(raw[c.Test][c.Variable].([]string), i)
 		default:
 			return nil, fmt.Errorf("Unsupported data type for IAMPolicyStatementConditionSet: %s", i)
 		}
 	}
 
+	// flatten entries with a single item to match AWS IAM syntax
+	for k1 := range raw {
+		for k2 := range raw[k1] {
+			items := raw[k1][k2].([]string)
+			if len(items) == 1 {
+				raw[k1][k2] = items[0]
+			}
+		}
+	}
+
 	return json.Marshal(&raw)
 }
 
@@ -280,7 +293,7 @@ func isValidPolicyAWSPrincipal(principal string) bool { // nosemgrep:ci.aws-in-f
 	if arn.IsARN(principal) {
 		return true
 	}
-	if regexp.MustCompile(`^\d{12}$`).MatchString(principal) {
+	if regexache.MustCompile(`^\d{12}$`).MatchString(principal) {
 		return true
 	}
 	return false
diff --git a/internal/service/iam/policy_model_test.go b/internal/service/iam/policy_model_test.go
index b7211dc482a..7b91f369fbd 100644
--- a/internal/service/iam/policy_model_test.go
+++ b/internal/service/iam/policy_model_test.go
@@ -1,7 +1,11 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam
 
 import (
 	"encoding/json"
+	"reflect"
 	"testing"
 
 	"github.com/hashicorp/terraform-provider-aws/internal/errs"
@@ -262,3 +266,127 @@ func TestIsValidAWSPrincipal(t *testing.T) { // nosemgrep:ci.aws-in-func-name
 		})
 	}
 }
+
+func TestIAMPolicyStatementConditionSet_MarshalJSON(t *testing.T) { // nosemgrep:ci.iam-in-func-name
+	t.Parallel()
+
+	testcases := map[string]struct {
+		cs      IAMPolicyStatementConditionSet
+		want    []byte
+		wantErr bool
+	}{
+		"invalid value type": {
+			cs: IAMPolicyStatementConditionSet{
+				{Test: "StringLike", Variable: "s3:prefix", Values: 1},
+			},
+			wantErr: true,
+		},
+		"single condition single value": {
+			cs: IAMPolicyStatementConditionSet{
+				{Test: "StringLike", Variable: "s3:prefix", Values: "one/"},
+			},
+			want: []byte(`{"StringLike":{"s3:prefix":"one/"}}`),
+		},
+		"single condition multiple values": {
+			cs: IAMPolicyStatementConditionSet{
+				{Test: "StringLike", Variable: "s3:prefix", Values: []string{"one/", "two/"}},
+			},
+			want: []byte(`{"StringLike":{"s3:prefix":["one/","two/"]}}`),
+		},
+		// Multiple distinct conditions
+		"multiple condition single value": {
+			cs: IAMPolicyStatementConditionSet{
+				{Test: "ArnNotLike", Variable: "aws:PrincipalArn", Values: "1"},
+				{Test: "StringLike", Variable: "s3:prefix", Values: "one/"},
+			},
+			want: []byte(`{"ArnNotLike":{"aws:PrincipalArn":"1"},"StringLike":{"s3:prefix":"one/"}}`),
+		},
+		"multiple condition multiple values": {
+			cs: IAMPolicyStatementConditionSet{
+				{Test: "ArnNotLike", Variable: "aws:PrincipalArn", Values: []string{"1", "2"}},
+				{Test: "StringLike", Variable: "s3:prefix", Values: []string{"one/", "two/"}},
+			},
+			want: []byte(`{"ArnNotLike":{"aws:PrincipalArn":["1","2"]},"StringLike":{"s3:prefix":["one/","two/"]}}`),
+		},
+		"multiple condition mixed value lengths": {
+			cs: IAMPolicyStatementConditionSet{
+				{Test: "ArnNotLike", Variable: "aws:PrincipalArn", Values: "1"},
+				{Test: "StringLike", Variable: "s3:prefix", Values: []string{"one/", "two/"}},
+			},
+			want: []byte(`{"ArnNotLike":{"aws:PrincipalArn":"1"},"StringLike":{"s3:prefix":["one/","two/"]}}`),
+		},
+		// Multiple conditions with duplicated `test` arguments
+		"duplicate condition test single value": {
+			cs: IAMPolicyStatementConditionSet{
+				{Test: "StringLike", Variable: "s3:prefix", Values: "one/"},
+				{Test: "StringLike", Variable: "s3:versionid", Values: "abc123"},
+			},
+			want: []byte(`{"StringLike":{"s3:prefix":"one/","s3:versionid":"abc123"}}`),
+		},
+		"duplicate condition test multiple values": {
+			cs: IAMPolicyStatementConditionSet{
+				{Test: "StringLike", Variable: "s3:prefix", Values: []string{"one/", "two/"}},
+				{Test: "StringLike", Variable: "s3:versionid", Values: []string{"abc123", "def456"}},
+			},
+			want: []byte(`{"StringLike":{"s3:prefix":["one/","two/"],"s3:versionid":["abc123","def456"]}}`),
+		},
+		"duplicate condition test mixed value lengths": {
+			cs: IAMPolicyStatementConditionSet{
+				{Test: "StringLike", Variable: "s3:prefix", Values: "one/"},
+				{Test: "StringLike", Variable: "s3:versionid", Values: []string{"abc123", "def456"}},
+			},
+			want: []byte(`{"StringLike":{"s3:prefix":"one/","s3:versionid":["abc123","def456"]}}`),
+		},
+		"duplicate condition test mixed value lengths reversed": {
+			cs: IAMPolicyStatementConditionSet{
+				{Test: "StringLike", Variable: "s3:prefix", Values: []string{"one/", "two/"}},
+				{Test: "StringLike", Variable: "s3:versionid", Values: "abc123"},
+			},
+			want: []byte(`{"StringLike":{"s3:prefix":["one/","two/"],"s3:versionid":"abc123"}}`),
+		},
+		// Multiple conditions with duplicated `test` and `variable` arguments
+		"duplicate condition test and variable single value": {
+			cs: IAMPolicyStatementConditionSet{
+				{Test: "StringLike", Variable: "s3:prefix", Values: "one/"},
+				{Test: "StringLike", Variable: "s3:prefix", Values: "two/"},
+			},
+			want: []byte(`{"StringLike":{"s3:prefix":["one/","two/"]}}`),
+		},
+		"duplicate condition test and variable multiple values": {
+			cs: IAMPolicyStatementConditionSet{
+				{Test: "StringLike", Variable: "s3:prefix", Values: []string{"one/", "two/"}},
+				{Test: "StringLike", Variable: "s3:prefix", Values: []string{"three/", "four/"}},
+			},
+			want: []byte(`{"StringLike":{"s3:prefix":["one/","two/","three/","four/"]}}`),
+		},
+		"duplicate condition test and variable mixed value lengths": {
+			cs: IAMPolicyStatementConditionSet{
+				{Test: "StringLike", Variable: "s3:prefix", Values: "one/"},
+				{Test: "StringLike", Variable: "s3:prefix", Values: []string{"three/", "four/"}},
+			},
+			want: []byte(`{"StringLike":{"s3:prefix":["one/","three/","four/"]}}`),
+		},
+		"duplicate condition test and variable mixed value lengths reversed": {
+			cs: IAMPolicyStatementConditionSet{
+				{Test: "StringLike", Variable: "s3:prefix", Values: []string{"one/", "two/"}},
+				{Test: "StringLike", Variable: "s3:prefix", Values: "three/"},
+			},
+			want: []byte(`{"StringLike":{"s3:prefix":["one/","two/","three/"]}}`),
+		},
+	}
+	for name, tc := range testcases {
+		tc := tc
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			got, err := tc.cs.MarshalJSON()
+			if (err != nil) != tc.wantErr {
+				t.Errorf("IAMPolicyStatementConditionSet.MarshalJSON() error = %v, wantErr %v", err, tc.wantErr)
+				return
+			}
+			if !reflect.DeepEqual(got, tc.want) {
+				t.Errorf("IAMPolicyStatementConditionSet.MarshalJSON() = %v, want %v", string(got), string(tc.want))
+			}
+		})
+	}
+}
diff --git a/internal/service/iam/policy_test.go b/internal/service/iam/policy_test.go
index ac113ca9771..ac7b4f17cc6 100644
--- a/internal/service/iam/policy_test.go
+++ b/internal/service/iam/policy_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/iam"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -164,14 +167,13 @@ func TestAccIAMPolicy_namePrefix(t *testing.T) {
 				Config: testAccPolicyConfig_namePrefix(acctest.ResourcePrefix),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckPolicyExists(ctx, resourceName, &out),
-					resource.TestMatchResourceAttr(resourceName, "name", regexp.MustCompile(fmt.Sprintf("^%s", acctest.ResourcePrefix))),
+					resource.TestMatchResourceAttr(resourceName, "name", regexache.MustCompile(fmt.Sprintf("^%s", acctest.ResourcePrefix))),
 				),
 			},
 			{
-				ResourceName:            resourceName,
-				ImportState:             true,
-				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"name_prefix"},
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
 			},
 		},
 	})
@@ -221,7 +223,7 @@ func TestAccIAMPolicy_policy(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccPolicyConfig_basic(rName, "not-json"),
-				ExpectError: regexp.MustCompile("invalid JSON"),
+				ExpectError: regexache.MustCompile("invalid JSON"),
 			},
 			{
 				Config: testAccPolicyConfig_basic(rName, policy1),
@@ -335,6 +337,24 @@ func TestAccIAMPolicy_diffs(t *testing.T) {
 	})
 }
 
+func TestAccIAMPolicy_policyDuplicateKeys(t *testing.T) {
+	ctx := acctest.Context(t)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, iam.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckPolicyDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config:      testAccPolicyConfig_policyDuplicateKeys(rName),
+				ExpectError: regexache.MustCompile(`"policy" contains duplicate JSON keys: duplicate key "Statement.0.Condition.StringEquals"`),
+			},
+		},
+	})
+}
+
 func testAccCheckPolicyExists(ctx context.Context, n string, v *iam.Policy) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		rs, ok := s.RootModule().Resources[n]
@@ -613,3 +633,32 @@ resource "aws_iam_policy" "test" {
 }
 `, rName, tags)
 }
+
+func testAccPolicyConfig_policyDuplicateKeys(rName string) string {
+	return fmt.Sprintf(`
+resource "aws_iam_policy" "test" {
+  name = %q
+
+  policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Action": "s3:PutObject",
+      "Resource": "*",
+      "Condition": {
+        "StringEquals": {
+          "s3:prefix": ["one/", "two/"]
+        },
+        "StringEquals": {
+          "s3:versionid": "abc123"
+        }
+      }
+    }
+  ]
+}
+EOF
+}
+`, rName)
+}
diff --git a/internal/service/iam/principal_policy_simulation_data_source.go b/internal/service/iam/principal_policy_simulation_data_source.go
index de8c30f8dcb..dbdd14d958f 100644
--- a/internal/service/iam/principal_policy_simulation_data_source.go
+++ b/internal/service/iam/principal_policy_simulation_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam
 
 import (
diff --git a/internal/service/iam/principal_policy_simulation_data_source_test.go b/internal/service/iam/principal_policy_simulation_data_source_test.go
index 10ecddf7e2f..bc3a1c35174 100644
--- a/internal/service/iam/principal_policy_simulation_data_source_test.go
+++ b/internal/service/iam/principal_policy_simulation_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam_test
 
 import (
diff --git a/internal/service/iam/role.go b/internal/service/iam/role.go
index 964636c32a5..4ca2bc1c435 100644
--- a/internal/service/iam/role.go
+++ b/internal/service/iam/role.go
@@ -1,13 +1,17 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"log"
 	"net/url"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/iam"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -56,7 +60,7 @@ func ResourceRole() *schema.Resource {
 			"assume_role_policy": {
 				Type:                  schema.TypeString,
 				Required:              true,
-				ValidateFunc:          validation.StringIsJSON,
+				ValidateFunc:          verify.ValidIAMPolicyJSON,
 				DiffSuppressFunc:      verify.SuppressEquivalentPolicyDiffs,
 				DiffSuppressOnRefresh: true,
 				StateFunc: func(v interface{}) string {
@@ -73,8 +77,8 @@ func ResourceRole() *schema.Resource {
 				Optional: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(0, 1000),
-					validation.StringDoesNotMatch(regexp.MustCompile("[“‘]"), "cannot contain specially formatted single or double quotes: [“‘]"),
-					validation.StringMatch(regexp.MustCompile(`[\p{L}\p{M}\p{Z}\p{S}\p{N}\p{P}]*`), `must satisfy regular expression pattern: [\p{L}\p{M}\p{Z}\p{S}\p{N}\p{P}]*)`),
+					validation.StringDoesNotMatch(regexache.MustCompile("[“‘]"), "cannot contain specially formatted single or double quotes: [“‘]"),
+					validation.StringMatch(regexache.MustCompile(`[\p{L}\p{M}\p{Z}\p{S}\p{N}\p{P}]*`), `must satisfy regular expression pattern: [\p{L}\p{M}\p{Z}\p{S}\p{N}\p{P}]*)`),
 				),
 			},
 			"force_detach_policies": {
@@ -288,17 +292,19 @@ func resourceRoleRead(ctx context.Context, d *schema.ResourceData, meta interfac
 	d.Set("path", role.Path)
 	if role.PermissionsBoundary != nil {
 		d.Set("permissions_boundary", role.PermissionsBoundary.PermissionsBoundaryArn)
+	} else {
+		d.Set("permissions_boundary", nil)
 	}
 	d.Set("unique_id", role.RoleId)
 
 	assumeRolePolicy, err := url.QueryUnescape(aws.StringValue(role.AssumeRolePolicyDocument))
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "reading IAM Role (%s): %s", d.Id(), err)
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
 	policyToSet, err := verify.PolicyToSet(d.Get("assume_role_policy").(string), assumeRolePolicy)
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "reading IAM Role (%s): %s", d.Id(), err)
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
 	d.Set("assume_role_policy", policyToSet)
@@ -319,11 +325,11 @@ func resourceRoleRead(ctx context.Context, d *schema.ResourceData, meta interfac
 		}
 	}
 
-	managedPolicies, err := readRolePolicyAttachments(ctx, conn, aws.StringValue(role.RoleName))
+	policyARNs, err := findRoleAttachedPolicies(ctx, conn, d.Id())
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "reading managed policies for IAM role %s, error: %s", d.Id(), err)
+		return sdkdiag.AppendErrorf(diags, "reading IAM Policies attached to Role (%s): %s", d.Id(), err)
 	}
-	d.Set("managed_policy_arns", managedPolicies)
+	d.Set("managed_policy_arns", policyARNs)
 
 	setTagsOut(ctx, role.Tags)
 
@@ -434,7 +440,7 @@ func resourceRoleUpdate(ctx context.Context, d *schema.ResourceData, meta interf
 		remove := os.Difference(ns).List()
 		add := ns.Difference(os).List()
 
-		var policyNames []*string
+		var policyNames []string
 		for _, policy := range remove {
 			tfMap, ok := policy.(map[string]interface{})
 
@@ -443,7 +449,7 @@ func resourceRoleUpdate(ctx context.Context, d *schema.ResourceData, meta interf
 			}
 
 			if v, ok := tfMap["name"].(string); ok && v != "" {
-				policyNames = append(policyNames, aws.String(tfMap["name"].(string)))
+				policyNames = append(policyNames, tfMap["name"].(string))
 			}
 		}
 		if err := deleteRoleInlinePolicies(ctx, conn, roleName, policyNames); err != nil {
@@ -457,26 +463,15 @@ func resourceRoleUpdate(ctx context.Context, d *schema.ResourceData, meta interf
 	}
 
 	if d.HasChange("managed_policy_arns") {
-		roleName := d.Get("name").(string)
-
 		o, n := d.GetChange("managed_policy_arns")
-		if o == nil {
-			o = new(schema.Set)
-		}
-		if n == nil {
-			n = new(schema.Set)
-		}
-
-		os := o.(*schema.Set)
-		ns := n.(*schema.Set)
-		remove := flex.ExpandStringSet(os.Difference(ns))
-		add := flex.ExpandStringSet(ns.Difference(os))
+		os, ns := o.(*schema.Set), n.(*schema.Set)
+		add, del := flex.ExpandStringSet(ns.Difference(os)), flex.ExpandStringValueSet(os.Difference(ns))
 
-		if err := deleteRolePolicyAttachments(ctx, conn, roleName, remove); err != nil {
+		if err := deleteRolePolicyAttachments(ctx, conn, d.Id(), del); err != nil {
 			return sdkdiag.AppendErrorf(diags, "updating IAM Role (%s): %s", d.Id(), err)
 		}
 
-		if err := addRoleManagedPolicies(ctx, roleName, add, meta); err != nil {
+		if err := addRoleManagedPolicies(ctx, d.Id(), add, meta); err != nil {
 			return sdkdiag.AppendErrorf(diags, "updating IAM Role (%s): %s", d.Id(), err)
 		}
 	}
@@ -515,10 +510,6 @@ func resourceRoleDelete(ctx context.Context, d *schema.ResourceData, meta interf
 
 	err := DeleteRole(ctx, conn, d.Id(), d.Get("force_detach_policies").(bool), hasInline, hasManaged)
 
-	if tfawserr.ErrCodeEquals(err, iam.ErrCodeNoSuchEntityException) {
-		return diags
-	}
-
 	if err != nil {
 		return sdkdiag.AppendErrorf(diags, "deleting IAM Role (%s): %s", d.Id(), err)
 	}
@@ -528,80 +519,79 @@ func resourceRoleDelete(ctx context.Context, d *schema.ResourceData, meta interf
 
 func DeleteRole(ctx context.Context, conn *iam.IAM, roleName string, forceDetach, hasInline, hasManaged bool) error {
 	if err := deleteRoleInstanceProfiles(ctx, conn, roleName); err != nil {
-		return fmt.Errorf("unable to detach instance profiles: %w", err)
+		return err
 	}
 
 	if forceDetach || hasManaged {
-		managedPolicies, err := readRolePolicyAttachments(ctx, conn, roleName)
+		policyARNs, err := findRoleAttachedPolicies(ctx, conn, roleName)
+
 		if err != nil {
-			return err
+			return fmt.Errorf("reading IAM Policies attached to Role (%s): %w", roleName, err)
 		}
 
-		if err := deleteRolePolicyAttachments(ctx, conn, roleName, managedPolicies); err != nil {
-			return fmt.Errorf("unable to detach policies: %w", err)
+		if err := deleteRolePolicyAttachments(ctx, conn, roleName, policyARNs); err != nil {
+			return err
 		}
 	}
 
 	if forceDetach || hasInline {
-		inlinePolicies, err := readRolePolicyNames(ctx, conn, roleName)
+		inlinePolicies, err := findRolePolicyNames(ctx, conn, roleName)
+
 		if err != nil {
-			return err
+			return fmt.Errorf("reading IAM Role (%s) inline policies: %w", roleName, err)
 		}
 
 		if err := deleteRoleInlinePolicies(ctx, conn, roleName, inlinePolicies); err != nil {
-			return fmt.Errorf("unable to delete inline policies: %w", err)
+			return err
 		}
 	}
 
-	deleteRoleInput := &iam.DeleteRoleInput{
+	input := &iam.DeleteRoleInput{
 		RoleName: aws.String(roleName),
 	}
-	err := retry.RetryContext(ctx, propagationTimeout, func() *retry.RetryError {
-		_, err := conn.DeleteRoleWithContext(ctx, deleteRoleInput)
-		if err != nil {
-			if tfawserr.ErrCodeEquals(err, iam.ErrCodeDeleteConflictException) {
-				return retry.RetryableError(err)
-			}
+	_, err := tfresource.RetryWhenAWSErrCodeEquals(ctx, propagationTimeout, func() (interface{}, error) {
+		return conn.DeleteRoleWithContext(ctx, input)
+	}, iam.ErrCodeDeleteConflictException)
 
-			return retry.NonRetryableError(err)
-		}
+	if tfawserr.ErrCodeEquals(err, iam.ErrCodeNoSuchEntityException) {
 		return nil
-	})
-	if tfresource.TimedOut(err) {
-		_, err = conn.DeleteRoleWithContext(ctx, deleteRoleInput)
 	}
 
 	return err
 }
 
 func deleteRoleInstanceProfiles(ctx context.Context, conn *iam.IAM, roleName string) error {
-	resp, err := conn.ListInstanceProfilesForRoleWithContext(ctx, &iam.ListInstanceProfilesForRoleInput{
-		RoleName: aws.String(roleName),
-	})
-	if tfawserr.ErrCodeEquals(err, iam.ErrCodeNoSuchEntityException) {
+	instanceProfiles, err := findInstanceProfilesForRole(ctx, conn, roleName)
+
+	if tfresource.NotFound(err) {
 		return nil
 	}
+
 	if err != nil {
-		return err
+		return fmt.Errorf("reading IAM Instance Profiles for Role (%s): %w", roleName, err)
 	}
 
-	// Loop and remove this Role from any Profiles
-	for _, i := range resp.InstanceProfiles {
+	var errs []error
+
+	for _, instanceProfile := range instanceProfiles {
+		instanceProfileName := aws.StringValue(instanceProfile.InstanceProfileName)
 		input := &iam.RemoveRoleFromInstanceProfileInput{
-			InstanceProfileName: i.InstanceProfileName,
+			InstanceProfileName: aws.String(instanceProfileName),
 			RoleName:            aws.String(roleName),
 		}
 
 		_, err := conn.RemoveRoleFromInstanceProfileWithContext(ctx, input)
+
 		if tfawserr.ErrCodeEquals(err, iam.ErrCodeNoSuchEntityException) {
 			continue
 		}
+
 		if err != nil {
-			return err
+			errs = append(errs, fmt.Errorf("removing IAM Role (%s) from Instance Profile (%s): %w", roleName, instanceProfileName, err))
 		}
 	}
 
-	return nil
+	return errors.Join(errs...)
 }
 
 func retryCreateRole(ctx context.Context, conn *iam.IAM, input *iam.CreateRoleInput) (*iam.CreateRoleOutput, error) {
@@ -635,6 +625,10 @@ func FindRoleByName(ctx context.Context, conn *iam.IAM, name string) (*iam.Role,
 		RoleName: aws.String(name),
 	}
 
+	return findRole(ctx, conn, input)
+}
+
+func findRole(ctx context.Context, conn *iam.IAM, input *iam.GetRoleInput) (*iam.Role, error) {
 	output, err := conn.GetRoleWithContext(ctx, input)
 
 	if tfawserr.ErrCodeEquals(err, iam.ErrCodeNoSuchEntityException) {
@@ -655,83 +649,122 @@ func FindRoleByName(ctx context.Context, conn *iam.IAM, name string) (*iam.Role,
 	return output.Role, nil
 }
 
-func readRolePolicyAttachments(ctx context.Context, conn *iam.IAM, roleName string) ([]*string, error) {
-	managedPolicies := make([]*string, 0)
+func findRoleAttachedPolicies(ctx context.Context, conn *iam.IAM, roleName string) ([]string, error) {
 	input := &iam.ListAttachedRolePoliciesInput{
 		RoleName: aws.String(roleName),
 	}
+	var output []string
 
 	err := conn.ListAttachedRolePoliciesPagesWithContext(ctx, input, func(page *iam.ListAttachedRolePoliciesOutput, lastPage bool) bool {
+		if page == nil {
+			return !lastPage
+		}
+
 		for _, v := range page.AttachedPolicies {
-			managedPolicies = append(managedPolicies, v.PolicyArn)
+			if v != nil {
+				output = append(output, aws.StringValue(v.PolicyArn))
+			}
 		}
+
 		return !lastPage
 	})
-	if err != nil && !tfawserr.ErrCodeEquals(err, iam.ErrCodeNoSuchEntityException) {
-		return nil, err
-	}
 
-	return managedPolicies, nil
-}
-
-func deleteRolePolicyAttachments(ctx context.Context, conn *iam.IAM, roleName string, managedPolicies []*string) error {
-	for _, arn := range managedPolicies {
-		input := &iam.DetachRolePolicyInput{
-			PolicyArn: arn,
-			RoleName:  aws.String(roleName),
+	if tfawserr.ErrCodeEquals(err, iam.ErrCodeNoSuchEntityException) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
 		}
+	}
 
-		_, err := conn.DetachRolePolicyWithContext(ctx, input)
-		if tfawserr.ErrCodeEquals(err, iam.ErrCodeNoSuchEntityException) {
-			continue
-		}
-		if err != nil {
-			return fmt.Errorf("detaching managed policy (%s): %w", aws.StringValue(arn), err)
-		}
+	if err != nil {
+		return nil, err
 	}
 
-	return nil
+	return output, nil
 }
 
-func readRolePolicyNames(ctx context.Context, conn *iam.IAM, roleName string) ([]*string, error) {
-	inlinePolicies := make([]*string, 0)
+func findRolePolicyNames(ctx context.Context, conn *iam.IAM, roleName string) ([]string, error) {
 	input := &iam.ListRolePoliciesInput{
 		RoleName: aws.String(roleName),
 	}
+	var output []string
 
 	err := conn.ListRolePoliciesPagesWithContext(ctx, input, func(page *iam.ListRolePoliciesOutput, lastPage bool) bool {
-		inlinePolicies = append(inlinePolicies, page.PolicyNames...)
+		if page == nil {
+			return !lastPage
+		}
+
+		for _, v := range page.PolicyNames {
+			if v != nil {
+				output = append(output, aws.StringValue(v))
+			}
+		}
+
 		return !lastPage
 	})
 
-	if err != nil && !tfawserr.ErrCodeEquals(err, iam.ErrCodeNoSuchEntityException) {
+	if tfawserr.ErrCodeEquals(err, iam.ErrCodeNoSuchEntityException) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+
+	if err != nil {
 		return nil, err
 	}
 
-	return inlinePolicies, nil
+	return output, nil
 }
 
-func deleteRoleInlinePolicies(ctx context.Context, conn *iam.IAM, roleName string, policyNames []*string) error {
-	for _, name := range policyNames {
-		if len(aws.StringValue(name)) == 0 {
+func deleteRolePolicyAttachments(ctx context.Context, conn *iam.IAM, roleName string, policyARNs []string) error {
+	var errs []error
+
+	for _, policyARN := range policyARNs {
+		input := &iam.DetachRolePolicyInput{
+			PolicyArn: aws.String(policyARN),
+			RoleName:  aws.String(roleName),
+		}
+
+		_, err := conn.DetachRolePolicyWithContext(ctx, input)
+
+		if tfawserr.ErrCodeEquals(err, iam.ErrCodeNoSuchEntityException) {
+			continue
+		}
+
+		if err != nil {
+			errs = append(errs, fmt.Errorf("detaching IAM Policy (%s) from Role (%s): %w", policyARN, roleName, err))
+		}
+	}
+
+	return errors.Join(errs...)
+}
+
+func deleteRoleInlinePolicies(ctx context.Context, conn *iam.IAM, roleName string, policyNames []string) error {
+	var errs []error
+
+	for _, policyName := range policyNames {
+		if len(policyName) == 0 {
 			continue
 		}
 
 		input := &iam.DeleteRolePolicyInput{
-			PolicyName: name,
+			PolicyName: aws.String(policyName),
 			RoleName:   aws.String(roleName),
 		}
 
 		_, err := conn.DeleteRolePolicyWithContext(ctx, input)
+
 		if tfawserr.ErrCodeEquals(err, iam.ErrCodeNoSuchEntityException) {
-			return nil
+			continue
 		}
+
 		if err != nil {
-			return fmt.Errorf("removing inline policy (%s): %w", aws.StringValue(name), err)
+			errs = append(errs, fmt.Errorf("deleting IAM Role (%s) policy (%s): %w", roleName, policyName, err))
 		}
 	}
 
-	return nil
+	return errors.Join(errs...)
 }
 
 func flattenRoleInlinePolicy(apiObject *iam.PutRolePolicyInput) map[string]interface{} {
@@ -852,22 +885,24 @@ func addRoleManagedPolicies(ctx context.Context, roleName string, policies []*st
 func readRoleInlinePolicies(ctx context.Context, roleName string, meta interface{}) ([]*iam.PutRolePolicyInput, error) {
 	conn := meta.(*conns.AWSClient).IAMConn(ctx)
 
-	policyNames, err := readRolePolicyNames(ctx, conn, roleName)
+	policyNames, err := findRolePolicyNames(ctx, conn, roleName)
+
 	if err != nil {
 		return nil, err
 	}
 
 	var apiObjects []*iam.PutRolePolicyInput
 	for _, policyName := range policyNames {
-		policyResp, err := conn.GetRolePolicyWithContext(ctx, &iam.GetRolePolicyInput{
+		output, err := conn.GetRolePolicyWithContext(ctx, &iam.GetRolePolicyInput{
 			RoleName:   aws.String(roleName),
-			PolicyName: policyName,
+			PolicyName: aws.String(policyName),
 		})
+
 		if err != nil {
 			return nil, err
 		}
 
-		policy, err := url.QueryUnescape(*policyResp.PolicyDocument)
+		policy, err := url.QueryUnescape(aws.StringValue(output.PolicyDocument))
 		if err != nil {
 			return nil, err
 		}
@@ -880,7 +915,7 @@ func readRoleInlinePolicies(ctx context.Context, roleName string, meta interface
 		apiObject := &iam.PutRolePolicyInput{
 			RoleName:       aws.String(roleName),
 			PolicyDocument: aws.String(p),
-			PolicyName:     policyName,
+			PolicyName:     aws.String(policyName),
 		}
 
 		apiObjects = append(apiObjects, apiObject)
diff --git a/internal/service/iam/role_data_source.go b/internal/service/iam/role_data_source.go
index 8ef9bf293dd..721f46e6a96 100644
--- a/internal/service/iam/role_data_source.go
+++ b/internal/service/iam/role_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam
 
 import (
@@ -83,52 +86,42 @@ func dataSourceRoleRead(ctx context.Context, d *schema.ResourceData, meta interf
 	ignoreTagsConfig := meta.(*conns.AWSClient).IgnoreTagsConfig
 
 	name := d.Get("name").(string)
+	role, err := FindRoleByName(ctx, conn, name)
 
-	input := &iam.GetRoleInput{
-		RoleName: aws.String(name),
-	}
-
-	output, err := conn.GetRoleWithContext(ctx, input)
 	if err != nil {
 		return sdkdiag.AppendErrorf(diags, "reading IAM Role (%s): %s", name, err)
 	}
 
-	d.Set("arn", output.Role.Arn)
-	if err := d.Set("create_date", output.Role.CreateDate.Format(time.RFC3339)); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting create_date: %s", err)
+	d.SetId(name)
+	d.Set("arn", role.Arn)
+	d.Set("create_date", role.CreateDate.Format(time.RFC3339))
+	d.Set("description", role.Description)
+	d.Set("max_session_duration", role.MaxSessionDuration)
+	d.Set("name", role.RoleName)
+	d.Set("path", role.Path)
+	if role.PermissionsBoundary != nil {
+		d.Set("permissions_boundary", role.PermissionsBoundary.PermissionsBoundaryArn)
+	} else {
+		d.Set("permissions_boundary", nil)
 	}
-
-	if err := d.Set("role_last_used", flattenRoleLastUsed(output.Role.RoleLastUsed)); err != nil {
+	if err := d.Set("role_last_used", flattenRoleLastUsed(role.RoleLastUsed)); err != nil {
 		return sdkdiag.AppendErrorf(diags, "setting role_last_used: %s", err)
 	}
+	d.Set("unique_id", role.RoleId)
 
-	d.Set("description", output.Role.Description)
-	d.Set("max_session_duration", output.Role.MaxSessionDuration)
-	d.Set("name", output.Role.RoleName)
-	d.Set("path", output.Role.Path)
-	d.Set("permissions_boundary", "")
-	if output.Role.PermissionsBoundary != nil {
-		d.Set("permissions_boundary", output.Role.PermissionsBoundary.PermissionsBoundaryArn)
-	}
-	d.Set("unique_id", output.Role.RoleId)
-
-	assumRolePolicy, err := url.QueryUnescape(aws.StringValue(output.Role.AssumeRolePolicyDocument))
+	assumeRolePolicy, err := url.QueryUnescape(aws.StringValue(role.AssumeRolePolicyDocument))
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "parsing assume role policy document: %s", err)
-	}
-	if err := d.Set("assume_role_policy", assumRolePolicy); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting assume_role_policy: %s", err)
+		return sdkdiag.AppendFromErr(diags, err)
 	}
+	d.Set("assume_role_policy", assumeRolePolicy)
 
-	tags := KeyValueTags(ctx, output.Role.Tags).IgnoreAWS().IgnoreConfig(ignoreTagsConfig)
+	tags := KeyValueTags(ctx, role.Tags).IgnoreAWS().IgnoreConfig(ignoreTagsConfig)
 
 	//lintignore:AWSR002
 	if err := d.Set("tags", tags.Map()); err != nil {
 		return sdkdiag.AppendErrorf(diags, "setting tags: %s", err)
 	}
 
-	d.SetId(name)
-
 	return diags
 }
 
diff --git a/internal/service/iam/role_data_source_test.go b/internal/service/iam/role_data_source_test.go
index a5b43c048c7..f39d538a836 100644
--- a/internal/service/iam/role_data_source_test.go
+++ b/internal/service/iam/role_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam_test
 
 import (
diff --git a/internal/service/iam/role_policy.go b/internal/service/iam/role_policy.go
index 07ed71d279c..42673b28e92 100644
--- a/internal/service/iam/role_policy.go
+++ b/internal/service/iam/role_policy.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam
 
 import (
@@ -15,6 +18,7 @@ import (
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/create"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
@@ -28,28 +32,16 @@ const (
 // @SDKResource("aws_iam_role_policy")
 func ResourceRolePolicy() *schema.Resource {
 	return &schema.Resource{
-		// PutRolePolicy API is idempotent, so these can be the same.
 		CreateWithoutTimeout: resourceRolePolicyPut,
-		UpdateWithoutTimeout: resourceRolePolicyPut,
-
 		ReadWithoutTimeout:   resourceRolePolicyRead,
+		UpdateWithoutTimeout: resourceRolePolicyPut,
 		DeleteWithoutTimeout: resourceRolePolicyDelete,
+
 		Importer: &schema.ResourceImporter{
 			StateContext: schema.ImportStatePassthroughContext,
 		},
 
 		Schema: map[string]*schema.Schema{
-			"policy": {
-				Type:                  schema.TypeString,
-				Required:              true,
-				ValidateFunc:          verify.ValidIAMPolicyJSON,
-				DiffSuppressFunc:      verify.SuppressEquivalentPolicyDiffs,
-				DiffSuppressOnRefresh: true,
-				StateFunc: func(v interface{}) string {
-					json, _ := verify.LegacyPolicyNormalize(v)
-					return json
-				},
-			},
 			"name": {
 				Type:          schema.TypeString,
 				Optional:      true,
@@ -61,10 +53,22 @@ func ResourceRolePolicy() *schema.Resource {
 			"name_prefix": {
 				Type:          schema.TypeString,
 				Optional:      true,
+				Computed:      true,
 				ForceNew:      true,
 				ConflictsWith: []string{"name"},
 				ValidateFunc:  validResourceName(rolePolicyNamePrefixMaxLen),
 			},
+			"policy": {
+				Type:                  schema.TypeString,
+				Required:              true,
+				ValidateFunc:          verify.ValidIAMPolicyJSON,
+				DiffSuppressFunc:      verify.SuppressEquivalentPolicyDiffs,
+				DiffSuppressOnRefresh: true,
+				StateFunc: func(v interface{}) string {
+					json, _ := verify.LegacyPolicyNormalize(v)
+					return json
+				},
+			},
 			"role": {
 				Type:         schema.TypeString,
 				Required:     true,
@@ -81,29 +85,35 @@ func resourceRolePolicyPut(ctx context.Context, d *schema.ResourceData, meta int
 
 	policy, err := verify.LegacyPolicyNormalize(d.Get("policy").(string))
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "policy (%s) is invalid JSON: %s", policy, err)
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
-	request := &iam.PutRolePolicyInput{
-		RoleName:       aws.String(d.Get("role").(string)),
+	policyName := create.Name(d.Get("name").(string), d.Get("name_prefix").(string))
+	roleName := d.Get("role").(string)
+	input := &iam.PutRolePolicyInput{
 		PolicyDocument: aws.String(policy),
+		PolicyName:     aws.String(policyName),
+		RoleName:       aws.String(roleName),
 	}
 
-	var policyName string
-	if v, ok := d.GetOk("name"); ok {
-		policyName = v.(string)
-	} else if v, ok := d.GetOk("name_prefix"); ok {
-		policyName = id.PrefixedUniqueId(v.(string))
-	} else {
-		policyName = id.UniqueId()
+	_, err = conn.PutRolePolicyWithContext(ctx, input)
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "putting IAM Role (%s) Policy (%s): %s", roleName, policyName, err)
 	}
-	request.PolicyName = aws.String(policyName)
 
-	if _, err := conn.PutRolePolicyWithContext(ctx, request); err != nil {
-		return sdkdiag.AppendErrorf(diags, "putting IAM role policy %s: %s", *request.PolicyName, err)
+	if d.IsNewResource() {
+		d.SetId(fmt.Sprintf("%s:%s", roleName, policyName))
+
+		_, err := tfresource.RetryWhenNotFound(ctx, propagationTimeout, func() (interface{}, error) {
+			return FindRolePolicyByTwoPartKey(ctx, conn, roleName, policyName)
+		})
+
+		if err != nil {
+			return sdkdiag.AppendErrorf(diags, "waiting for IAM Role Policy (%s) create: %s", d.Id(), err)
+		}
 	}
 
-	d.SetId(fmt.Sprintf("%s:%s", *request.RoleName, *request.PolicyName))
 	return append(diags, resourceRolePolicyRead(ctx, d, meta)...)
 }
 
@@ -111,40 +121,15 @@ func resourceRolePolicyRead(ctx context.Context, d *schema.ResourceData, meta in
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).IAMConn(ctx)
 
-	role, name, err := RolePolicyParseID(d.Id())
+	roleName, policyName, err := RolePolicyParseID(d.Id())
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "reading IAM Role Policy (%s): %s", d.Id(), err)
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
-	request := &iam.GetRolePolicyInput{
-		PolicyName: aws.String(name),
-		RoleName:   aws.String(role),
-	}
+	policyDocument, err := FindRolePolicyByTwoPartKey(ctx, conn, roleName, policyName)
 
-	var getResp *iam.GetRolePolicyOutput
-
-	err = retry.RetryContext(ctx, propagationTimeout, func() *retry.RetryError {
-		var err error
-
-		getResp, err = conn.GetRolePolicyWithContext(ctx, request)
-
-		if d.IsNewResource() && tfawserr.ErrCodeEquals(err, iam.ErrCodeNoSuchEntityException) {
-			return retry.RetryableError(err)
-		}
-
-		if err != nil {
-			return retry.NonRetryableError(err)
-		}
-
-		return nil
-	})
-
-	if tfresource.TimedOut(err) {
-		getResp, err = conn.GetRolePolicyWithContext(ctx, request)
-	}
-
-	if !d.IsNewResource() && tfawserr.ErrCodeEquals(err, iam.ErrCodeNoSuchEntityException) {
-		log.Printf("[WARN] IAM Role Policy (%s) not found, removing from state", d.Id())
+	if !d.IsNewResource() && tfresource.NotFound(err) {
+		log.Printf("[WARN] IAM Role Policy %s not found, removing from state", d.Id())
 		d.SetId("")
 		return diags
 	}
@@ -153,24 +138,20 @@ func resourceRolePolicyRead(ctx context.Context, d *schema.ResourceData, meta in
 		return sdkdiag.AppendErrorf(diags, "reading IAM Role Policy (%s): %s", d.Id(), err)
 	}
 
-	if getResp == nil || getResp.PolicyDocument == nil {
-		return sdkdiag.AppendErrorf(diags, "reading IAM Role Policy (%s): empty response", d.Id())
-	}
-
-	policy, err := url.QueryUnescape(*getResp.PolicyDocument)
+	policy, err := url.QueryUnescape(policyDocument)
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "reading IAM Role Policy (%s): %s", d.Id(), err)
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
 	policyToSet, err := verify.LegacyPolicyToSet(d.Get("policy").(string), policy)
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "reading IAM Role Policy (%s): setting policy: %s", d.Id(), err)
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
+	d.Set("name", policyName)
+	d.Set("name_prefix", create.NamePrefixFromName(policyName))
 	d.Set("policy", policyToSet)
-
-	d.Set("name", name)
-	d.Set("role", role)
+	d.Set("role", roleName)
 
 	return diags
 }
@@ -179,25 +160,54 @@ func resourceRolePolicyDelete(ctx context.Context, d *schema.ResourceData, meta
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).IAMConn(ctx)
 
-	role, name, err := RolePolicyParseID(d.Id())
+	roleName, policyName, err := RolePolicyParseID(d.Id())
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "deleting IAM role policy (%s): %s", d.Id(), err)
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
-	request := &iam.DeleteRolePolicyInput{
-		PolicyName: aws.String(name),
-		RoleName:   aws.String(role),
+	log.Printf("[INFO] Deleting IAM Role Policy: %s", d.Id())
+	_, err = conn.DeleteRolePolicyWithContext(ctx, &iam.DeleteRolePolicyInput{
+		PolicyName: aws.String(policyName),
+		RoleName:   aws.String(roleName),
+	})
+
+	if tfawserr.ErrCodeEquals(err, iam.ErrCodeNoSuchEntityException) {
+		return diags
 	}
 
-	if _, err := conn.DeleteRolePolicyWithContext(ctx, request); err != nil {
-		if tfawserr.ErrCodeEquals(err, iam.ErrCodeNoSuchEntityException) {
-			return diags
-		}
-		return sdkdiag.AppendErrorf(diags, "deleting IAM role policy (%s): %s", d.Id(), err)
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "deleting IAM Role Policy (%s): %s", d.Id(), err)
 	}
+
 	return diags
 }
 
+func FindRolePolicyByTwoPartKey(ctx context.Context, conn *iam.IAM, roleName, policyName string) (string, error) {
+	input := &iam.GetRolePolicyInput{
+		PolicyName: aws.String(policyName),
+		RoleName:   aws.String(roleName),
+	}
+
+	output, err := conn.GetRolePolicyWithContext(ctx, input)
+
+	if tfawserr.ErrCodeEquals(err, iam.ErrCodeNoSuchEntityException) {
+		return "", &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+
+	if err != nil {
+		return "", err
+	}
+
+	if output == nil || output.PolicyDocument == nil {
+		return "", tfresource.NewEmptyResultError(input)
+	}
+
+	return aws.StringValue(output.PolicyDocument), nil
+}
+
 func RolePolicyParseID(id string) (roleName, policyName string, err error) {
 	parts := strings.SplitN(id, ":", 2)
 	if len(parts) != 2 {
diff --git a/internal/service/iam/role_policy_attachment.go b/internal/service/iam/role_policy_attachment.go
index 12671fe29b8..92835771597 100644
--- a/internal/service/iam/role_policy_attachment.go
+++ b/internal/service/iam/role_policy_attachment.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam
 
 import (
diff --git a/internal/service/iam/role_policy_attachment_test.go b/internal/service/iam/role_policy_attachment_test.go
index c20d9676462..13bada1cbd2 100644
--- a/internal/service/iam/role_policy_attachment_test.go
+++ b/internal/service/iam/role_policy_attachment_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam_test
 
 import (
diff --git a/internal/service/iam/role_policy_test.go b/internal/service/iam/role_policy_test.go
index 5eee14ee537..6e5f42a01de 100644
--- a/internal/service/iam/role_policy_test.go
+++ b/internal/service/iam/role_policy_test.go
@@ -1,30 +1,30 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam_test
 
 import (
 	"context"
-	"errors"
 	"fmt"
-	"regexp"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/aws"
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/iam"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	tfiam "github.com/hashicorp/terraform-provider-aws/internal/service/iam"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
 func TestAccIAMRolePolicy_basic(t *testing.T) {
 	ctx := acctest.Context(t)
-	var rolePolicy1, rolePolicy2, rolePolicy3 iam.GetRolePolicyOutput
+	var rolePolicy string
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_iam_role_policy.test"
-	resourceName2 := "aws_iam_role_policy.test2"
-	roleName := "aws_iam_role.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
@@ -35,10 +35,9 @@ func TestAccIAMRolePolicy_basic(t *testing.T) {
 			{
 				Config: testAccRolePolicyConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckRolePolicyExists(ctx, roleName,
-						resourceName,
-						&rolePolicy1,
-					),
+					testAccCheckRolePolicyExists(ctx, resourceName, &rolePolicy),
+					resource.TestCheckResourceAttr(resourceName, "name", rName),
+					resource.TestCheckResourceAttr(resourceName, "name_prefix", ""),
 				),
 			},
 			{
@@ -46,31 +45,15 @@ func TestAccIAMRolePolicy_basic(t *testing.T) {
 				ImportState:       true,
 				ImportStateVerify: true,
 			},
-			{
-				Config: testAccRolePolicyConfig_update(rName),
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckRolePolicyExists(ctx, roleName,
-						resourceName,
-						&rolePolicy2,
-					),
-					testAccCheckRolePolicyExists(ctx, roleName,
-						resourceName2,
-						&rolePolicy3,
-					),
-					testAccCheckRolePolicyNameMatches(&rolePolicy1, &rolePolicy2),
-					testAccCheckRolePolicyNameChanged(&rolePolicy1, &rolePolicy3),
-				),
-			},
 		},
 	})
 }
 
 func TestAccIAMRolePolicy_disappears(t *testing.T) {
 	ctx := acctest.Context(t)
-	var out iam.GetRolePolicyOutput
+	var rolePolicy string
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
-	roleResourceName := "aws_iam_role.test"
-	rolePolicyResourceName := "aws_iam_role_policy.test"
+	resourceName := "aws_iam_role_policy.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
@@ -81,11 +64,8 @@ func TestAccIAMRolePolicy_disappears(t *testing.T) {
 			{
 				Config: testAccRolePolicyConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckRolePolicyExists(ctx, roleResourceName,
-						rolePolicyResourceName,
-						&out,
-					),
-					testAccCheckRolePolicyDisappears(ctx, &out),
+					testAccCheckRolePolicyExists(ctx, resourceName, &rolePolicy),
+					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfiam.ResourceRolePolicy(), resourceName),
 				),
 				ExpectNonEmptyPlan: true,
 			},
@@ -93,12 +73,11 @@ func TestAccIAMRolePolicy_disappears(t *testing.T) {
 	})
 }
 
-func TestAccIAMRolePolicy_policyOrder(t *testing.T) {
+func TestAccIAMRolePolicy_nameGenerated(t *testing.T) {
 	ctx := acctest.Context(t)
-	var rolePolicy1 iam.GetRolePolicyOutput
+	var rolePolicy string
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_iam_role_policy.test"
-	roleName := "aws_iam_role.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
@@ -107,17 +86,17 @@ func TestAccIAMRolePolicy_policyOrder(t *testing.T) {
 		CheckDestroy:             testAccCheckRolePolicyDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccRolePolicyConfig_order(rName),
+				Config: testAccRolePolicyConfig_nameGenerated(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckRolePolicyExists(ctx, roleName,
-						resourceName,
-						&rolePolicy1,
-					),
+					testAccCheckRolePolicyExists(ctx, resourceName, &rolePolicy),
+					acctest.CheckResourceAttrNameGenerated(resourceName, "name"),
+					resource.TestCheckResourceAttr(resourceName, "name_prefix", id.UniqueIdPrefix),
 				),
 			},
 			{
-				Config:   testAccRolePolicyConfig_newOrder(rName),
-				PlanOnly: true,
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
 			},
 		},
 	})
@@ -125,10 +104,9 @@ func TestAccIAMRolePolicy_policyOrder(t *testing.T) {
 
 func TestAccIAMRolePolicy_namePrefix(t *testing.T) {
 	ctx := acctest.Context(t)
-	var rolePolicy1, rolePolicy2 iam.GetRolePolicyOutput
+	var rolePolicy string
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_iam_role_policy.test"
-	roleName := "aws_iam_role.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
@@ -137,42 +115,27 @@ func TestAccIAMRolePolicy_namePrefix(t *testing.T) {
 		CheckDestroy:             testAccCheckRolePolicyDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccRolePolicyConfig_namePrefix(rName, "*"),
+				Config: testAccRolePolicyConfig_namePrefix(rName, "tf-acc-test-prefix-"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckRolePolicyExists(ctx, roleName,
-						resourceName,
-						&rolePolicy1,
-					),
-					resource.TestCheckResourceAttrSet(resourceName, "name"),
+					testAccCheckRolePolicyExists(ctx, resourceName, &rolePolicy),
+					acctest.CheckResourceAttrNameFromPrefix(resourceName, "name", "tf-acc-test-prefix-"),
+					resource.TestCheckResourceAttr(resourceName, "name_prefix", "tf-acc-test-prefix-"),
 				),
 			},
 			{
-				ResourceName:            resourceName,
-				ImportState:             true,
-				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"name_prefix"},
-			},
-			{
-				Config: testAccRolePolicyConfig_namePrefix(rName, "ec2:*"),
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckRolePolicyExists(ctx, roleName,
-						resourceName,
-						&rolePolicy2,
-					),
-					testAccCheckRolePolicyNameMatches(&rolePolicy1, &rolePolicy2),
-					resource.TestCheckResourceAttrSet(resourceName, "name"),
-				),
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
 			},
 		},
 	})
 }
 
-func TestAccIAMRolePolicy_generatedName(t *testing.T) {
+func TestAccIAMRolePolicy_policyOrder(t *testing.T) {
 	ctx := acctest.Context(t)
-	var rolePolicy1, rolePolicy2 iam.GetRolePolicyOutput
+	var rolePolicy string
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_iam_role_policy.test"
-	roleName := "aws_iam_role.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
@@ -181,30 +144,14 @@ func TestAccIAMRolePolicy_generatedName(t *testing.T) {
 		CheckDestroy:             testAccCheckRolePolicyDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccRolePolicyConfig_generatedName(rName, "*"),
+				Config: testAccRolePolicyConfig_order(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckRolePolicyExists(ctx, roleName,
-						resourceName,
-						&rolePolicy1,
-					),
-					resource.TestCheckResourceAttrSet(resourceName, "name"),
+					testAccCheckRolePolicyExists(ctx, resourceName, &rolePolicy),
 				),
 			},
 			{
-				ResourceName:      resourceName,
-				ImportState:       true,
-				ImportStateVerify: true,
-			},
-			{
-				Config: testAccRolePolicyConfig_generatedName(rName, "ec2:*"),
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckRolePolicyExists(ctx, roleName,
-						resourceName,
-						&rolePolicy2,
-					),
-					testAccCheckRolePolicyNameMatches(&rolePolicy1, &rolePolicy2),
-					resource.TestCheckResourceAttrSet(resourceName, "name"),
-				),
+				Config:   testAccRolePolicyConfig_newOrder(rName),
+				PlanOnly: true,
 			},
 		},
 	})
@@ -222,7 +169,7 @@ func TestAccIAMRolePolicy_invalidJSON(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccRolePolicyConfig_invalidJSON(rName),
-				ExpectError: regexp.MustCompile("invalid JSON"),
+				ExpectError: regexache.MustCompile("invalid JSON"),
 			},
 		},
 	})
@@ -240,7 +187,7 @@ func TestAccIAMRolePolicy_Policy_invalidResource(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccRolePolicyConfig_invalidResource(rName),
-				ExpectError: regexp.MustCompile("MalformedPolicyDocument"),
+				ExpectError: regexache.MustCompile("MalformedPolicyDocument"),
 			},
 		},
 	})
@@ -253,10 +200,9 @@ func TestAccIAMRolePolicy_Policy_invalidResource(t *testing.T) {
 // during that step.
 func TestAccIAMRolePolicy_unknownsInPolicy(t *testing.T) {
 	ctx := acctest.Context(t)
-	var rolePolicy1 iam.GetRolePolicyOutput
+	var rolePolicy string
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_iam_role_policy.test"
-	roleName := "aws_iam_role.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
@@ -267,8 +213,7 @@ func TestAccIAMRolePolicy_unknownsInPolicy(t *testing.T) {
 			{
 				Config: testAccRolePolicyConfig_unknowns(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckRolePolicyExists(ctx, roleName, resourceName, &rolePolicy1),
-					resource.TestCheckResourceAttr(resourceName, "name", rName),
+					testAccCheckRolePolicyExists(ctx, resourceName, &rolePolicy),
 				),
 			},
 		},
@@ -284,103 +229,49 @@ func testAccCheckRolePolicyDestroy(ctx context.Context) resource.TestCheckFunc {
 				continue
 			}
 
-			role, name, err := tfiam.RolePolicyParseID(rs.Primary.ID)
+			roleName, policyName, err := tfiam.RolePolicyParseID(rs.Primary.ID)
 			if err != nil {
 				return err
 			}
 
-			request := &iam.GetRolePolicyInput{
-				PolicyName: aws.String(name),
-				RoleName:   aws.String(role),
-			}
-
-			getResp, err := conn.GetRolePolicyWithContext(ctx, request)
+			_, err = tfiam.FindRolePolicyByTwoPartKey(ctx, conn, roleName, policyName)
 
-			if tfawserr.ErrCodeEquals(err, iam.ErrCodeNoSuchEntityException) {
+			if tfresource.NotFound(err) {
 				continue
 			}
 
 			if err != nil {
-				return fmt.Errorf("Error reading IAM policy %s from role %s: %s", name, role, err)
+				return err
 			}
 
-			if getResp != nil {
-				return fmt.Errorf("Found IAM Role, expected none: %s", getResp)
-			}
+			return fmt.Errorf("IAM Role Policy %s still exists", rs.Primary.ID)
 		}
 
 		return nil
 	}
 }
 
-func testAccCheckRolePolicyDisappears(ctx context.Context, out *iam.GetRolePolicyOutput) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		conn := acctest.Provider.Meta().(*conns.AWSClient).IAMConn(ctx)
-
-		params := &iam.DeleteRolePolicyInput{
-			PolicyName: out.PolicyName,
-			RoleName:   out.RoleName,
-		}
-
-		_, err := conn.DeleteRolePolicyWithContext(ctx, params)
-		return err
-	}
-}
-
-func testAccCheckRolePolicyExists(ctx context.Context,
-	iamRoleResource string,
-	iamRolePolicyResource string,
-	rolePolicy *iam.GetRolePolicyOutput) resource.TestCheckFunc {
+func testAccCheckRolePolicyExists(ctx context.Context, n string, v *string) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		rs, ok := s.RootModule().Resources[iamRoleResource]
+		rs, ok := s.RootModule().Resources[n]
 		if !ok {
-			return fmt.Errorf("Not Found: %s", iamRoleResource)
-		}
-
-		if rs.Primary.ID == "" {
-			return fmt.Errorf("No ID is set")
+			return fmt.Errorf("Not Found: %s", n)
 		}
 
-		policy, ok := s.RootModule().Resources[iamRolePolicyResource]
-		if !ok {
-			return fmt.Errorf("Not Found: %s", iamRolePolicyResource)
-		}
-
-		conn := acctest.Provider.Meta().(*conns.AWSClient).IAMConn(ctx)
-		role, name, err := tfiam.RolePolicyParseID(policy.Primary.ID)
+		roleName, policyName, err := tfiam.RolePolicyParseID(rs.Primary.ID)
 		if err != nil {
 			return err
 		}
 
-		output, err := conn.GetRolePolicyWithContext(ctx, &iam.GetRolePolicyInput{
-			RoleName:   aws.String(role),
-			PolicyName: aws.String(name),
-		})
-		if err != nil {
-			return err
-		}
+		conn := acctest.Provider.Meta().(*conns.AWSClient).IAMConn(ctx)
 
-		*rolePolicy = *output
+		output, err := tfiam.FindRolePolicyByTwoPartKey(ctx, conn, roleName, policyName)
 
-		return nil
-	}
-}
-
-func testAccCheckRolePolicyNameChanged(i, j *iam.GetRolePolicyOutput) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		if aws.StringValue(i.PolicyName) == aws.StringValue(j.PolicyName) {
-			return errors.New("IAM Role Policy name did not change")
+		if err != nil {
+			return err
 		}
 
-		return nil
-	}
-}
-
-func testAccCheckRolePolicyNameMatches(i, j *iam.GetRolePolicyOutput) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		if aws.StringValue(i.PolicyName) != aws.StringValue(j.PolicyName) {
-			return errors.New("IAM Role Policy name did not match")
-		}
+		*v = output
 
 		return nil
 	}
@@ -427,48 +318,7 @@ EOF
 `, rName)
 }
 
-func testAccRolePolicyConfig_namePrefix(rName, action string) string {
-	return fmt.Sprintf(`
-resource "aws_iam_role" "test" {
-  name = %[1]q
-  path = "/"
-
-  assume_role_policy = <<EOF
-{
-  "Version": "2012-10-17",
-  "Statement": [
-    {
-      "Action": "sts:AssumeRole",
-      "Principal": {
-        "Service": "ec2.amazonaws.com"
-      },
-      "Effect": "Allow",
-      "Sid": ""
-    }
-  ]
-}
-EOF
-}
-
-resource "aws_iam_role_policy" "test" {
-  name_prefix = "tf_test_policy_"
-  role        = aws_iam_role.test.name
-
-  policy = <<EOF
-{
-  "Version": "2012-10-17",
-  "Statement": {
-    "Effect": "Allow",
-    "Action": %[2]q,
-    "Resource": "*"
-  }
-}
-EOF
-}
-`, rName, action)
-}
-
-func testAccRolePolicyConfig_generatedName(rName, policyAction string) string {
+func testAccRolePolicyConfig_nameGenerated(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_iam_role" "test" {
   name = %[1]q
@@ -499,16 +349,16 @@ resource "aws_iam_role_policy" "test" {
   "Version": "2012-10-17",
   "Statement": {
     "Effect": "Allow",
-    "Action": %[2]q,
+    "Action": "*",
     "Resource": "*"
   }
 }
 EOF
 }
-`, rName, policyAction)
+`, rName)
 }
 
-func testAccRolePolicyConfig_update(rName string) string {
+func testAccRolePolicyConfig_namePrefix(rName, namePrefix string) string {
 	return fmt.Sprintf(`
 resource "aws_iam_role" "test" {
   name = %[1]q
@@ -532,24 +382,8 @@ EOF
 }
 
 resource "aws_iam_role_policy" "test" {
-  name = %[1]q
-  role = aws_iam_role.test.name
-
-  policy = <<EOF
-{
-  "Version": "2012-10-17",
-  "Statement": {
-    "Effect": "Allow",
-    "Action": "*",
-    "Resource": "*"
-  }
-}
-EOF
-}
-
-resource "aws_iam_role_policy" "test2" {
-  name = "%[1]s-2"
-  role = aws_iam_role.test.name
+  name_prefix = %[2]q
+  role        = aws_iam_role.test.name
 
   policy = <<EOF
 {
@@ -562,7 +396,7 @@ resource "aws_iam_role_policy" "test2" {
 }
 EOF
 }
-`, rName)
+`, rName, namePrefix)
 }
 
 func testAccRolePolicyConfig_invalidJSON(rName string) string {
@@ -738,7 +572,6 @@ EOF
 func testAccRolePolicyConfig_unknowns(rName string) string {
 	return fmt.Sprintf(`
 data "aws_caller_identity" "current" {}
-
 data "aws_partition" "current" {}
 
 resource "aws_iam_role" "test" {
diff --git a/internal/service/iam/role_test.go b/internal/service/iam/role_test.go
index dc82eaceac8..f7b97e5ebb1 100644
--- a/internal/service/iam/role_test.go
+++ b/internal/service/iam/role_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/iam"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -379,7 +382,7 @@ func TestAccIAMRole_badJSON(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccRoleConfig_badJSON(rName),
-				ExpectError: regexp.MustCompile(`.*contains an invalid JSON:.*`),
+				ExpectError: regexache.MustCompile(`.*contains an invalid JSON policy:.*`),
 			},
 		},
 	})
@@ -453,11 +456,11 @@ func TestAccIAMRole_maxSessionDuration(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccRoleConfig_maxSessionDuration(rName, 3599),
-				ExpectError: regexp.MustCompile(`expected max_session_duration to be in the range`),
+				ExpectError: regexache.MustCompile(`expected max_session_duration to be in the range`),
 			},
 			{
 				Config:      testAccRoleConfig_maxSessionDuration(rName, 43201),
-				ExpectError: regexp.MustCompile(`expected max_session_duration to be in the range`),
+				ExpectError: regexache.MustCompile(`expected max_session_duration to be in the range`),
 			},
 			{
 				Config: testAccRoleConfig_maxSessionDuration(rName, 3700),
@@ -548,6 +551,27 @@ func TestAccIAMRole_permissionsBoundary(t *testing.T) {
 					testAccCheckRolePermissionsBoundary(&role, permissionsBoundary1),
 				),
 			},
+			// Test drift detection
+			{
+				PreConfig: func() {
+					// delete the boundary manually
+					conn := acctest.Provider.Meta().(*conns.AWSClient).IAMConn(ctx)
+					input := &iam.DeleteRolePermissionsBoundaryInput{
+						RoleName: role.RoleName,
+					}
+					_, err := conn.DeleteRolePermissionsBoundaryWithContext(ctx, input)
+					if err != nil {
+						t.Fatalf("Failed to delete permission_boundary from role (%s): %s", aws.StringValue(role.RoleName), err)
+					}
+				},
+				Config: testAccRoleConfig_permissionsBoundary(rName, permissionsBoundary1),
+				// check the boundary was restored
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckRoleExists(ctx, resourceName, &role),
+					resource.TestCheckResourceAttr(resourceName, "permissions_boundary", permissionsBoundary1),
+					testAccCheckRolePermissionsBoundary(&role, permissionsBoundary1),
+				),
+			},
 			// Test empty value
 			{
 				Config: testAccRoleConfig_permissionsBoundary(rName, ""),
diff --git a/internal/service/iam/roles_data_source.go b/internal/service/iam/roles_data_source.go
index 60a1066cc4c..a8e08a8c623 100644
--- a/internal/service/iam/roles_data_source.go
+++ b/internal/service/iam/roles_data_source.go
@@ -1,9 +1,12 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam
 
 import (
 	"context"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/iam"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
@@ -64,7 +67,7 @@ func dataSourceRolesRead(ctx context.Context, d *schema.ResourceData, meta inter
 				continue
 			}
 
-			if v, ok := d.GetOk("name_regex"); ok && !regexp.MustCompile(v.(string)).MatchString(aws.StringValue(role.RoleName)) {
+			if v, ok := d.GetOk("name_regex"); ok && !regexache.MustCompile(v.(string)).MatchString(aws.StringValue(role.RoleName)) {
 				continue
 			}
 
diff --git a/internal/service/iam/roles_data_source_test.go b/internal/service/iam/roles_data_source_test.go
index ad0e2a52c6e..ea5f042eef9 100644
--- a/internal/service/iam/roles_data_source_test.go
+++ b/internal/service/iam/roles_data_source_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam_test
 
 import (
 	"fmt"
-	"regexp"
 	"strconv"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/iam"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -24,7 +27,7 @@ func TestAccIAMRolesDataSource_basic(t *testing.T) {
 			{
 				Config: testAccRolesDataSourceConfig_basic,
 				Check: resource.ComposeTestCheckFunc(
-					resource.TestMatchResourceAttr(dataSourceName, "names.#", regexp.MustCompile("[^0].*$")),
+					resource.TestMatchResourceAttr(dataSourceName, "names.#", regexache.MustCompile("[^0].*$")),
 				),
 			},
 		},
diff --git a/internal/service/iam/saml_provider.go b/internal/service/iam/saml_provider.go
index ff863f3010d..a0ecba645e8 100644
--- a/internal/service/iam/saml_provider.go
+++ b/internal/service/iam/saml_provider.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam
 
 import (
diff --git a/internal/service/iam/saml_provider_data_source.go b/internal/service/iam/saml_provider_data_source.go
index 3d6f7a3eaab..060404c73c6 100644
--- a/internal/service/iam/saml_provider_data_source.go
+++ b/internal/service/iam/saml_provider_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam
 
 import (
diff --git a/internal/service/iam/saml_provider_data_source_test.go b/internal/service/iam/saml_provider_data_source_test.go
index 49c638ad064..76c20213e23 100644
--- a/internal/service/iam/saml_provider_data_source_test.go
+++ b/internal/service/iam/saml_provider_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam_test
 
 import (
diff --git a/internal/service/iam/saml_provider_test.go b/internal/service/iam/saml_provider_test.go
index 08bb096b82b..6bb82b6cd93 100644
--- a/internal/service/iam/saml_provider_test.go
+++ b/internal/service/iam/saml_provider_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam_test
 
 import (
diff --git a/internal/service/iam/security_token_service_preferences.go b/internal/service/iam/security_token_service_preferences.go
new file mode 100644
index 00000000000..ec93e81ab1d
--- /dev/null
+++ b/internal/service/iam/security_token_service_preferences.go
@@ -0,0 +1,71 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package iam
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/iam"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
+)
+
+// @SDKResource("aws_iam_security_token_service_preferences", name="Security Token Service Preferences")
+func ResourceSecurityTokenServicePreferences() *schema.Resource {
+	return &schema.Resource{
+		CreateWithoutTimeout: resourceSecurityTokenServicePreferencesUpsert,
+		ReadWithoutTimeout:   resourceSecurityTokenServicePreferencesRead,
+		UpdateWithoutTimeout: resourceSecurityTokenServicePreferencesUpsert,
+		DeleteWithoutTimeout: schema.NoopContext,
+
+		Schema: map[string]*schema.Schema{
+			"global_endpoint_token_version": {
+				Type:         schema.TypeString,
+				Required:     true,
+				ValidateFunc: validation.StringInSlice(iam.GlobalEndpointTokenVersion_Values(), false),
+			},
+		},
+	}
+}
+
+func resourceSecurityTokenServicePreferencesUpsert(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).IAMConn(ctx)
+
+	input := &iam.SetSecurityTokenServicePreferencesInput{
+		GlobalEndpointTokenVersion: aws.String(d.Get("global_endpoint_token_version").(string)),
+	}
+
+	_, err := conn.SetSecurityTokenServicePreferencesWithContext(ctx, input)
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "setting IAM Security Token Service Preferences: %s", err)
+	}
+
+	if d.IsNewResource() {
+		d.SetId(meta.(*conns.AWSClient).AccountID)
+	}
+
+	return append(diags, resourceSecurityTokenServicePreferencesRead(ctx, d, meta)...)
+}
+
+func resourceSecurityTokenServicePreferencesRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).IAMConn(ctx)
+
+	output, err := conn.GetAccountSummaryWithContext(ctx, &iam.GetAccountSummaryInput{})
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "reading IAM Account Summary: %s", err)
+	}
+
+	d.Set("global_endpoint_token_version", fmt.Sprintf("v%dToken", aws.Int64Value(output.SummaryMap[iam.SummaryKeyTypeGlobalEndpointTokenVersion])))
+
+	return diags
+}
diff --git a/internal/service/iam/security_token_service_preferences_test.go b/internal/service/iam/security_token_service_preferences_test.go
new file mode 100644
index 00000000000..65596fd892c
--- /dev/null
+++ b/internal/service/iam/security_token_service_preferences_test.go
@@ -0,0 +1,38 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package iam_test
+
+import (
+	"testing"
+
+	"github.com/aws/aws-sdk-go/service/iam"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
+)
+
+func TestAccIAMSecurityTokenServicePreferences_basic(t *testing.T) {
+	ctx := acctest.Context(t)
+	resourceName := "aws_iam_security_token_service_preferences.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, iam.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             acctest.CheckDestroyNoop,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccSecurityTokenServicePreferencesConfig_basic,
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(resourceName, "global_endpoint_token_version", "v2Token"),
+				),
+			},
+		},
+	})
+}
+
+const testAccSecurityTokenServicePreferencesConfig_basic = `
+resource "aws_iam_security_token_service_preferences" "test" {
+  global_endpoint_token_version = "v2Token"
+}
+`
diff --git a/internal/service/iam/server_certificate.go b/internal/service/iam/server_certificate.go
index ebee7ca9e12..65d7305aef5 100644
--- a/internal/service/iam/server_certificate.go
+++ b/internal/service/iam/server_certificate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam
 
 import (
diff --git a/internal/service/iam/server_certificate_data_source.go b/internal/service/iam/server_certificate_data_source.go
index 032ab33dcce..1387821a64f 100644
--- a/internal/service/iam/server_certificate_data_source.go
+++ b/internal/service/iam/server_certificate_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam
 
 import (
diff --git a/internal/service/iam/server_certificate_data_source_test.go b/internal/service/iam/server_certificate_data_source_test.go
index 1285e4ae342..844eee400ee 100644
--- a/internal/service/iam/server_certificate_data_source_test.go
+++ b/internal/service/iam/server_certificate_data_source_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam_test
 
 import (
 	"fmt"
-	"regexp"
 	"sort"
 	"testing"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/iam"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -61,7 +64,7 @@ func TestAccIAMServerCertificateDataSource_basic(t *testing.T) {
 					resource.TestCheckResourceAttrSet("data.aws_iam_server_certificate.test", "path"),
 					resource.TestCheckResourceAttrSet("data.aws_iam_server_certificate.test", "upload_date"),
 					resource.TestCheckResourceAttr("data.aws_iam_server_certificate.test", "certificate_chain", ""),
-					resource.TestMatchResourceAttr("data.aws_iam_server_certificate.test", "certificate_body", regexp.MustCompile("^-----BEGIN CERTIFICATE-----")),
+					resource.TestMatchResourceAttr("data.aws_iam_server_certificate.test", "certificate_body", regexache.MustCompile("^-----BEGIN CERTIFICATE-----")),
 				),
 			},
 		},
@@ -78,7 +81,7 @@ func TestAccIAMServerCertificateDataSource_matchNamePrefix(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccServerCertificateDataSourceConfig_certMatchNamePrefix,
-				ExpectError: regexp.MustCompile(`Search for AWS IAM server certificate returned no results`),
+				ExpectError: regexache.MustCompile(`Search for AWS IAM server certificate returned no results`),
 			},
 		},
 	})
diff --git a/internal/service/iam/server_certificate_test.go b/internal/service/iam/server_certificate_test.go
index f010a8a3a71..4fa8e8a2280 100644
--- a/internal/service/iam/server_certificate_test.go
+++ b/internal/service/iam/server_certificate_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam_test
 
 import (
diff --git a/internal/service/iam/service_linked_role.go b/internal/service/iam/service_linked_role.go
index 4dbe6434c7b..fa386f5778b 100644
--- a/internal/service/iam/service_linked_role.go
+++ b/internal/service/iam/service_linked_role.go
@@ -1,18 +1,21 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"log"
-	"regexp"
 	"strings"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/aws/aws-sdk-go/service/iam"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
-	multierror "github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
@@ -48,7 +51,7 @@ func ResourceServiceLinkedRole() *schema.Resource {
 				Type:         schema.TypeString,
 				Required:     true,
 				ForceNew:     true,
-				ValidateFunc: validation.StringMatch(regexp.MustCompile(`\.`), "must be a full service hostname e.g. elasticbeanstalk.amazonaws.com"),
+				ValidateFunc: validation.StringMatch(regexache.MustCompile(`\.`), "must be a full service hostname e.g. elasticbeanstalk.amazonaws.com"),
 			},
 			"create_date": {
 				Type:     schema.TypeString,
@@ -227,29 +230,40 @@ func resourceServiceLinkedRoleDelete(ctx context.Context, d *schema.ResourceData
 	}
 
 	log.Printf("[DEBUG] Deleting IAM Service Linked Role: %s", d.Id())
-	output, err := conn.DeleteServiceLinkedRoleWithContext(ctx, &iam.DeleteServiceLinkedRoleInput{
+	if err := DeleteServiceLinkedRole(ctx, conn, roleName); err != nil {
+		return sdkdiag.AppendFromErr(diags, err)
+	}
+
+	return diags
+}
+
+// DeleteServiceLinkedRole is called from the service/ram package.
+func DeleteServiceLinkedRole(ctx context.Context, conn *iam.IAM, roleName string) error {
+	input := &iam.DeleteServiceLinkedRoleInput{
 		RoleName: aws.String(roleName),
-	})
+	}
+
+	output, err := conn.DeleteServiceLinkedRoleWithContext(ctx, input)
 
 	if tfawserr.ErrCodeEquals(err, iam.ErrCodeNoSuchEntityException) {
-		return diags
+		return nil
 	}
 
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "deleting IAM Service Linked Role (%s): %s", d.Id(), err)
+		return fmt.Errorf("deleting IAM Service Linked Role (%s): %w", roleName, err)
 	}
 
 	deletionTaskID := aws.StringValue(output.DeletionTaskId)
 
 	if deletionTaskID == "" {
-		return diags
+		return nil
 	}
 
 	if err := waitServiceLinkedRoleDeleted(ctx, conn, deletionTaskID); err != nil {
-		return sdkdiag.AppendErrorf(diags, "waiting for IAM Service Linked Role (%s) delete: %s", d.Id(), err)
+		return fmt.Errorf("waiting for IAM Service Linked Role (%s) delete: %w", roleName, err)
 	}
 
-	return diags
+	return nil
 }
 
 func waitServiceLinkedRoleDeleted(ctx context.Context, conn *iam.IAM, id string) error {
@@ -265,13 +279,13 @@ func waitServiceLinkedRoleDeleted(ctx context.Context, conn *iam.IAM, id string)
 
 	if output, ok := outputRaw.(*iam.GetServiceLinkedRoleDeletionStatusOutput); ok {
 		if reason := output.Reason; reason != nil {
-			var errs *multierror.Error
+			var errs []error
 
 			for _, v := range reason.RoleUsageList {
-				errs = multierror.Append(errs, fmt.Errorf("%s: %s", aws.StringValue(v.Region), strings.Join(aws.StringValueSlice(v.Resources), ", ")))
+				errs = append(errs, fmt.Errorf("%s: %s", aws.StringValue(v.Region), strings.Join(aws.StringValueSlice(v.Resources), ", ")))
 			}
 
-			tfresource.SetLastError(err, fmt.Errorf("%s: %w", aws.StringValue(reason.Reason), errs.ErrorOrNil()))
+			tfresource.SetLastError(err, fmt.Errorf("%s: %w", aws.StringValue(reason.Reason), errors.Join(errs...)))
 		}
 
 		return err
diff --git a/internal/service/iam/service_linked_role_test.go b/internal/service/iam/service_linked_role_test.go
index c3453ae5eea..1028d089baf 100644
--- a/internal/service/iam/service_linked_role_test.go
+++ b/internal/service/iam/service_linked_role_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam_test
 
 import (
diff --git a/internal/service/iam/service_package_gen.go b/internal/service/iam/service_package_gen.go
index 453874dda85..6d2303a2c66 100644
--- a/internal/service/iam/service_package_gen.go
+++ b/internal/service/iam/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	iam_sdkv1 "github.com/aws/aws-sdk-go/service/iam"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -167,6 +168,11 @@ func (p *servicePackage) SDKResources(ctx context.Context) []*types.ServicePacka
 			Name:     "SAML Provider",
 			Tags:     &types.ServicePackageResourceTags{},
 		},
+		{
+			Factory:  ResourceSecurityTokenServicePreferences,
+			TypeName: "aws_iam_security_token_service_preferences",
+			Name:     "Security Token Service Preferences",
+		},
 		{
 			Factory:  ResourceServerCertificate,
 			TypeName: "aws_iam_server_certificate",
@@ -233,4 +239,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*i
 	return iam_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/iam/service_specific_credential.go b/internal/service/iam/service_specific_credential.go
index 2adeeb42984..0ef9533bf62 100644
--- a/internal/service/iam/service_specific_credential.go
+++ b/internal/service/iam/service_specific_credential.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam
 
 import (
diff --git a/internal/service/iam/service_specific_credential_test.go b/internal/service/iam/service_specific_credential_test.go
index b4a8e93e706..2d5137cda57 100644
--- a/internal/service/iam/service_specific_credential_test.go
+++ b/internal/service/iam/service_specific_credential_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam_test
 
 import (
diff --git a/internal/service/iam/session_context_data_source.go b/internal/service/iam/session_context_data_source.go
index 2f460a7bf11..51cfc261fa1 100644
--- a/internal/service/iam/session_context_data_source.go
+++ b/internal/service/iam/session_context_data_source.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam
 
 import (
 	"context"
-	"regexp"
 	"strings"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/aws/aws-sdk-go/service/iam"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
@@ -115,7 +118,7 @@ func RoleNameSessionFromARN(rawARN string) (string, string) {
 		return "", ""
 	}
 
-	reAssume := regexp.MustCompile(`^assumed-role/.{1,}/.{2,}`)
+	reAssume := regexache.MustCompile(`^assumed-role/.{1,}/.{2,}`)
 
 	if !reAssume.MatchString(parsedARN.Resource) || parsedARN.Service != "sts" {
 		return "", ""
diff --git a/internal/service/iam/session_context_data_source_test.go b/internal/service/iam/session_context_data_source_test.go
index 710a92faa20..1f0a82ac0a2 100644
--- a/internal/service/iam/session_context_data_source_test.go
+++ b/internal/service/iam/session_context_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam_test
 
 import (
diff --git a/internal/service/iam/signing_certificate.go b/internal/service/iam/signing_certificate.go
index 5657d57b889..ee0c0a7b950 100644
--- a/internal/service/iam/signing_certificate.go
+++ b/internal/service/iam/signing_certificate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam
 
 import ( // nosemgrep:ci.semgrep.aws.multiple-service-imports
diff --git a/internal/service/iam/signing_certificate_test.go b/internal/service/iam/signing_certificate_test.go
index 584a00d50f1..d8771640efd 100644
--- a/internal/service/iam/signing_certificate_test.go
+++ b/internal/service/iam/signing_certificate_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam_test
 
 import (
diff --git a/internal/service/iam/state_funcs.go b/internal/service/iam/state_funcs.go
index 9f1df2a15c8..efe0fc52658 100644
--- a/internal/service/iam/state_funcs.go
+++ b/internal/service/iam/state_funcs.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam
 
 import (
diff --git a/internal/service/iam/sweep.go b/internal/service/iam/sweep.go
index 0c7e29b443e..ebfe9961bb1 100644
--- a/internal/service/iam/sweep.go
+++ b/internal/service/iam/sweep.go
@@ -1,24 +1,31 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package iam
 
 import (
+	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"strings"
+	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/iam"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	"github.com/hashicorp/go-multierror"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep/sdk"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_iam_group", &resource.Sweeper{
 		Name: "aws_iam_group",
 		F:    sweepGroups,
@@ -27,16 +34,11 @@ func init() {
 		},
 	})
 
-	resource.AddTestSweepers("aws_iam_instance_profile", &resource.Sweeper{
-		Name:         "aws_iam_instance_profile",
-		F:            sweepInstanceProfile,
-		Dependencies: []string{"aws_iam_role"},
-	})
+	sweep.Register("aws_iam_instance_profile", sweepInstanceProfile,
+		"aws_iam_role",
+	)
 
-	resource.AddTestSweepers("aws_iam_openid_connect_provider", &resource.Sweeper{
-		Name: "aws_iam_openid_connect_provider",
-		F:    sweepOpenIDConnectProvider,
-	})
+	sweep.Register("aws_iam_openid_connect_provider", sweepOpenIDConnectProvider)
 
 	resource.AddTestSweepers("aws_iam_policy", &resource.Sweeper{
 		Name: "aws_iam_policy",
@@ -45,6 +47,8 @@ func init() {
 			"aws_iam_group",
 			"aws_iam_role",
 			"aws_iam_user",
+			"aws_quicksight_group",
+			"aws_quicksight_user",
 		},
 	})
 
@@ -56,7 +60,7 @@ func init() {
 			"aws_cognito_user_pool",
 			"aws_config_configuration_aggregator",
 			"aws_config_configuration_recorder",
-			"aws_datasync_location_s3",
+			"aws_datasync_location",
 			"aws_dax_cluster",
 			"aws_db_instance",
 			"aws_db_option_group",
@@ -74,34 +78,23 @@ func init() {
 			"aws_redshift_cluster",
 			"aws_redshift_scheduled_action",
 			"aws_spot_fleet_request",
+			"aws_vpc",
 		},
 		F: sweepRoles,
 	})
 
-	resource.AddTestSweepers("aws_iam_saml_provider", &resource.Sweeper{
-		Name: "aws_iam_saml_provider",
-		F:    sweepSAMLProvider,
-	})
+	sweep.Register("aws_iam_saml_provider", sweepSAMLProvider)
 
-	resource.AddTestSweepers("aws_iam_service_specific_credential", &resource.Sweeper{
-		Name: "aws_iam_service_specific_credential",
-		F:    sweepServiceSpecificCredentials,
-	})
+	sweep.Register("aws_iam_service_specific_credential", sweepServiceSpecificCredentials)
 
-	resource.AddTestSweepers("aws_iam_signing_certificate", &resource.Sweeper{
-		Name: "aws_iam_signing_certificate",
-		F:    sweepSigningCertificates,
-	})
+	sweep.Register("aws_iam_signing_certificate", sweepSigningCertificates)
 
 	resource.AddTestSweepers("aws_iam_server_certificate", &resource.Sweeper{
 		Name: "aws_iam_server_certificate",
 		F:    sweepServerCertificates,
 	})
 
-	resource.AddTestSweepers("aws_iam_service_linked_role", &resource.Sweeper{
-		Name: "aws_iam_service_linked_role",
-		F:    sweepServiceLinkedRoles,
-	})
+	sweep.Register("aws_iam_service_linked_role", sweepServiceLinkedRoles)
 
 	resource.AddTestSweepers("aws_iam_user", &resource.Sweeper{
 		Name: "aws_iam_user",
@@ -114,15 +107,12 @@ func init() {
 		},
 	})
 
-	resource.AddTestSweepers("aws_iam_virtual_mfa_device", &resource.Sweeper{
-		Name: "aws_iam_virtual_mfa_device",
-		F:    sweepVirtualMFADevice,
-	})
+	sweep.Register("aws_iam_virtual_mfa_device", sweepVirtualMFADevice)
 }
 
 func sweepGroups(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
@@ -224,7 +214,7 @@ func sweepGroups(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping IAM Group sweep for %s: %s", region, err)
 		return sweeperErrs.ErrorOrNil()
 	}
@@ -236,17 +226,13 @@ func sweepGroups(region string) error {
 	return sweeperErrs.ErrorOrNil()
 }
 
-func sweepInstanceProfile(region string) error {
-	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
-	if err != nil {
-		return fmt.Errorf("error getting client: %w", err)
-	}
+func sweepInstanceProfile(ctx context.Context, client *conns.AWSClient) ([]sweep.Sweepable, error) {
 	conn := client.IAMConn(ctx)
 
+	var sweepResources []sweep.Sweepable
 	var sweeperErrs *multierror.Error
 
-	err = conn.ListInstanceProfilesPagesWithContext(ctx, &iam.ListInstanceProfilesInput{}, func(page *iam.ListInstanceProfilesOutput, lastPage bool) bool {
+	err := conn.ListInstanceProfilesPagesWithContext(ctx, &iam.ListInstanceProfilesInput{}, func(page *iam.ListInstanceProfilesOutput, lastPage bool) bool {
 		if page == nil {
 			return !lastPage
 		}
@@ -255,7 +241,10 @@ func sweepInstanceProfile(region string) error {
 			name := aws.StringValue(instanceProfile.InstanceProfileName)
 
 			if !roleNameFilter(name) {
-				log.Printf("[INFO] Skipping IAM Instance Profile (%s): no match on allow-list", name)
+				tflog.Warn(ctx, "Skipping resource", map[string]any{
+					"skip_reason":           "no match on allow-list",
+					"instance_profile_name": name,
+				})
 				continue
 			}
 
@@ -270,41 +259,24 @@ func sweepInstanceProfile(region string) error {
 				d.Set("role", roles[0].RoleName)
 			}
 
-			log.Printf("[INFO] Sweeping IAM Instance Profile %q", name)
-			err := sdk.DeleteResource(ctx, r, d, client)
-
-			if err != nil {
-				sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error deleting IAM Instance Profile (%s): %w", name, err))
-				continue
-			}
+			sweepResources = append(sweepResources, sdk.NewSweepResource(r, d, client))
 		}
 
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
-		log.Printf("[WARN] Skipping IAM Instance Profile sweep for %q: %s", region, err)
-		return sweeperErrs.ErrorOrNil() // In case we have completed some pages, but had errors
-	}
-
-	if err != nil {
-		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error listing IAM Instance Profiles: %w", err))
-	}
-
-	return sweeperErrs.ErrorOrNil()
+	return sweepResources, multierror.Append(err, sweeperErrs).ErrorOrNil()
 }
 
-func sweepOpenIDConnectProvider(region string) error {
-	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
-	if err != nil {
-		return fmt.Errorf("error getting client: %w", err)
-	}
+func sweepOpenIDConnectProvider(ctx context.Context, client *conns.AWSClient) ([]sweep.Sweepable, error) {
 	conn := client.IAMConn(ctx)
 
-	var sweeperErrs *multierror.Error
+	var sweepResources []sweep.Sweepable
 
 	out, err := conn.ListOpenIDConnectProvidersWithContext(ctx, &iam.ListOpenIDConnectProvidersInput{})
+	if err != nil {
+		return sweepResources, err
+	}
 
 	for _, oidcProvider := range out.OpenIDConnectProviderList {
 		arn := aws.StringValue(oidcProvider.Arn)
@@ -312,38 +284,16 @@ func sweepOpenIDConnectProvider(region string) error {
 		r := ResourceOpenIDConnectProvider()
 		d := r.Data(nil)
 		d.SetId(arn)
-		err := sdk.DeleteResource(ctx, r, d, client)
-
-		if err != nil {
-			sweeperErr := fmt.Errorf("error deleting IAM OIDC Provider (%s): %w", arn, err)
-			log.Printf("[ERROR] %s", sweeperErr)
-			sweeperErrs = multierror.Append(sweeperErrs, sweeperErr)
-			continue
-		}
-	}
-
-	if sweep.SkipSweepError(err) {
-		log.Printf("[WARN] Skipping IAM OIDC Provider sweep for %s: %s", region, err)
-		return sweeperErrs.ErrorOrNil() // In case we have completed some pages, but had errors
-	}
 
-	if err != nil {
-		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error describing IAM OIDC Providers: %w", err))
+		sweepResources = append(sweepResources, sdk.NewSweepResource(r, d, client))
 	}
 
-	return sweeperErrs.ErrorOrNil()
+	return sweepResources, err
 }
 
-func sweepServiceSpecificCredentials(region string) error {
-	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
-	if err != nil {
-		return fmt.Errorf("error getting client: %w", err)
-	}
+func sweepServiceSpecificCredentials(ctx context.Context, client *conns.AWSClient) ([]sweep.Sweepable, error) {
 	conn := client.IAMConn(ctx)
 
-	var sweeperErrs *multierror.Error
-
 	prefixes := []string{
 		"test-user",
 		"test_user",
@@ -351,9 +301,9 @@ func sweepServiceSpecificCredentials(region string) error {
 		"tf_acc",
 	}
 
-	users := make([]*iam.User, 0)
+	var users []*iam.User
 
-	err = conn.ListUsersPagesWithContext(ctx, &iam.ListUsersInput{}, func(page *iam.ListUsersOutput, lastPage bool) bool {
+	err := conn.ListUsersPagesWithContext(ctx, &iam.ListUsersInput{}, func(page *iam.ListUsersOutput, lastPage bool) bool {
 		for _, user := range page.Users {
 			for _, prefix := range prefixes {
 				if strings.HasPrefix(aws.StringValue(user.UserName), prefix) {
@@ -365,53 +315,51 @@ func sweepServiceSpecificCredentials(region string) error {
 
 		return !lastPage
 	})
+	if err != nil {
+		return nil, err
+	}
+
+	var sweepResources []sweep.Sweepable
 
 	for _, user := range users {
 		out, err := conn.ListServiceSpecificCredentialsWithContext(ctx, &iam.ListServiceSpecificCredentialsInput{
 			UserName: user.UserName,
 		})
+		if err != nil {
+			tflog.Warn(ctx, "Skipping resource", map[string]any{
+				"error":     err.Error(),
+				"user_name": user.UserName,
+			})
+			continue
+		}
 
 		for _, cred := range out.ServiceSpecificCredentials {
-
 			id := fmt.Sprintf("%s:%s:%s", aws.StringValue(cred.ServiceName), aws.StringValue(cred.UserName), aws.StringValue(cred.ServiceSpecificCredentialId))
 
 			r := ResourceServiceSpecificCredential()
 			d := r.Data(nil)
 			d.SetId(id)
-			err := sdk.DeleteResource(ctx, r, d, client)
-
-			if err != nil {
-				sweeperErr := fmt.Errorf("error deleting IAM Service Specific Credential (%s): %w", id, err)
-				log.Printf("[ERROR] %s", sweeperErr)
-				sweeperErrs = multierror.Append(sweeperErrs, sweeperErr)
-				continue
-			}
-		}
 
-		if sweep.SkipSweepError(err) {
-			log.Printf("[WARN] Skipping IAM Service Specific Credential sweep for %s: %s", region, err)
-			return sweeperErrs.ErrorOrNil() // In case we have completed some pages, but had errors
-		}
-
-		if err != nil {
-			sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error describing IAM Service Specific Credentials: %w", err))
+			sweepResources = append(sweepResources, sdk.NewSweepResource(r, d, client))
 		}
 	}
 
-	return sweeperErrs.ErrorOrNil()
+	return sweepResources, err
 }
 
 func sweepPolicies(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
+
 	conn := client.IAMConn(ctx)
 	input := &iam.ListPoliciesInput{
 		Scope: aws.String(iam.PolicyScopeTypeLocal),
 	}
-	var sweeperErrs *multierror.Error
+
+	var sweepResources []sweep.Sweepable
 
 	err = conn.ListPoliciesPagesWithContext(ctx, input, func(page *iam.ListPoliciesOutput, lastPage bool) bool {
 		if page == nil {
@@ -420,49 +368,66 @@ func sweepPolicies(region string) error {
 
 		for _, v := range page.Policies {
 			arn := aws.StringValue(v.Arn)
-			r := ResourcePolicy()
-			d := r.Data(nil)
-			d.SetId(arn)
-
-			err := sweep.NewSweepResource(r, d, client).Delete(ctx, sweep.ThrottlingRetryTimeout) // nosemgrep:ci.semgrep.migrate.direct-CRUD-calls
 
-			// Treat this sweeper as best effort for now. There are a lot of edge cases
-			// with lingering aws_iam_role resources in the HashiCorp testing accounts.
-			if tfawserr.ErrCodeEquals(err, iam.ErrCodeDeleteConflictException) {
-				log.Printf("[WARN] Ignoring IAM Policy (%s) deletion error: %s", arn, err)
+			if n := aws.Int64Value(v.AttachmentCount); n > 0 {
+				log.Printf("[INFO] Skipping IAM Policy %s: AttachmentCount=%d", arn, n)
 				continue
 			}
 
-			if tfawserr.ErrMessageContains(err, "AccessDenied", "with an explicit deny") {
-				continue
-			}
+			r := ResourcePolicy()
+			d := r.Data(nil)
+			d.SetId(arn)
 
-			if err != nil {
-				sweeperErr := fmt.Errorf("error deleting IAM Policy (%s): %w", arn, err)
-				log.Printf("[ERROR] %s", sweeperErr)
-				sweeperErrs = multierror.Append(sweeperErrs, sweeperErr)
-				continue
-			}
+			sweepResources = append(sweepResources, newPolicySweeper(r, d, client))
 		}
 
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping IAM Policy sweep for %s: %s", region, err)
-		return sweeperErrs.ErrorOrNil()
+		return nil
 	}
 
 	if err != nil {
-		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error retrieving IAM Policies: %w", err))
+		return fmt.Errorf("retrieving IAM Policies: %w", err)
 	}
 
-	return sweeperErrs.ErrorOrNil()
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
+	if err != nil {
+		return fmt.Errorf("sweeping IAM Policies (%s): %w", region, err)
+	}
+
+	return nil
+}
+
+type policySweeper struct {
+	d         *schema.ResourceData
+	sweepable sweep.Sweepable
+}
+
+func newPolicySweeper(resource *schema.Resource, d *schema.ResourceData, client *conns.AWSClient) *policySweeper {
+	return &policySweeper{
+		d:         d,
+		sweepable: sdk.NewSweepResource(resource, d, client),
+	}
+}
+
+func (ps policySweeper) Delete(ctx context.Context, timeout time.Duration, optFns ...tfresource.OptionsFunc) error {
+	if err := ps.sweepable.Delete(ctx, timeout, optFns...); err != nil {
+		accessDenied := regexache.MustCompile(`AccessDenied: .+ with an explicit deny`)
+		if accessDenied.MatchString(err.Error()) {
+			log.Printf("[DEBUG] Skipping IAM Policy (%s): %s", ps.d.Id(), err)
+			return nil
+		}
+		return err
+	}
+	return nil
 }
 
 func sweepRoles(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
@@ -482,7 +447,7 @@ func sweepRoles(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping IAM Role sweep for %s: %s", region, err)
 		return nil
 	}
@@ -502,9 +467,7 @@ func sweepRoles(region string) error {
 		log.Printf("[DEBUG] Deleting IAM Role (%s)", roleName)
 
 		err := DeleteRole(ctx, conn, roleName, true, true, true)
-		if tfawserr.ErrCodeEquals(err, iam.ErrCodeNoSuchEntityException) {
-			continue
-		}
+
 		if tfawserr.ErrCodeContains(err, "AccessDenied") {
 			log.Printf("[WARN] Skipping IAM Role (%s): %s", roleName, err)
 			continue
@@ -520,17 +483,15 @@ func sweepRoles(region string) error {
 	return sweeperErrs.ErrorOrNil()
 }
 
-func sweepSAMLProvider(region string) error {
-	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
-	if err != nil {
-		return fmt.Errorf("error getting client: %w", err)
-	}
+func sweepSAMLProvider(ctx context.Context, client *conns.AWSClient) ([]sweep.Sweepable, error) {
 	conn := client.IAMConn(ctx)
 
-	var sweeperErrs *multierror.Error
+	var sweepResources []sweep.Sweepable
 
 	out, err := conn.ListSAMLProvidersWithContext(ctx, &iam.ListSAMLProvidersInput{})
+	if err != nil {
+		return sweepResources, err
+	}
 
 	for _, sampProvider := range out.SAMLProviderList {
 		arn := aws.StringValue(sampProvider.Arn)
@@ -538,31 +499,16 @@ func sweepSAMLProvider(region string) error {
 		r := ResourceSAMLProvider()
 		d := r.Data(nil)
 		d.SetId(arn)
-		err := sdk.DeleteResource(ctx, r, d, client)
-
-		if err != nil {
-			sweeperErr := fmt.Errorf("error deleting IAM SAML Provider (%s): %w", arn, err)
-			log.Printf("[ERROR] %s", sweeperErr)
-			sweeperErrs = multierror.Append(sweeperErrs, sweeperErr)
-			continue
-		}
-	}
-
-	if sweep.SkipSweepError(err) {
-		log.Printf("[WARN] Skipping IAM SAML Provider sweep for %s: %s", region, err)
-		return sweeperErrs.ErrorOrNil() // In case we have completed some pages, but had errors
-	}
 
-	if err != nil {
-		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error describing IAM SAML Providers: %w", err))
+		sweepResources = append(sweepResources, sdk.NewSweepResource(r, d, client))
 	}
 
-	return sweeperErrs.ErrorOrNil()
+	return sweepResources, err
 }
 
 func sweepServerCertificates(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -584,7 +530,7 @@ func sweepServerCertificates(region string) error {
 		return !lastPage
 	})
 	if err != nil {
-		if sweep.SkipSweepError(err) {
+		if awsv1.SkipSweepError(err) {
 			log.Printf("[WARN] Skipping IAM Server Certificate sweep for %s: %s", region, err)
 			return nil
 		}
@@ -594,14 +540,11 @@ func sweepServerCertificates(region string) error {
 	return nil
 }
 
-func sweepServiceLinkedRoles(region string) error {
-	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
-	if err != nil {
-		return fmt.Errorf("error getting client: %s", err)
-	}
+func sweepServiceLinkedRoles(ctx context.Context, client *conns.AWSClient) ([]sweep.Sweepable, error) {
 	conn := client.IAMConn(ctx)
-	var sweeperErrs *multierror.Error
+
+	var sweepResources []sweep.Sweepable
+
 	input := &iam.ListRolesInput{
 		PathPrefix: aws.String("/aws-service-role/"),
 	}
@@ -609,49 +552,39 @@ func sweepServiceLinkedRoles(region string) error {
 	// include generic service role names created by:
 	// TestAccIAMServiceLinkedRole_basic
 	// TestAccIAMServiceLinkedRole_CustomSuffix_diffSuppressFunc
-	customSuffixRegex := regexp.MustCompile(`_?(tf-acc-test-\d+|ServiceRoleFor(ApplicationAutoScaling_CustomResource|ElasticBeanstalk))$`)
-	err = conn.ListRolesPagesWithContext(ctx, input, func(page *iam.ListRolesOutput, lastPage bool) bool {
-		if len(page.Roles) == 0 {
-			log.Printf("[INFO] No IAM Service Roles to sweep")
-			return true
+	customSuffixRegex := regexache.MustCompile(`_?(tf-acc-test-\d+|ServiceRoleFor(ApplicationAutoScaling_CustomResource|ElasticBeanstalk))$`)
+	err := conn.ListRolesPagesWithContext(ctx, input, func(page *iam.ListRolesOutput, lastPage bool) bool {
+		if page == nil {
+			return !lastPage
 		}
+
 		for _, role := range page.Roles {
 			roleName := aws.StringValue(role.RoleName)
 
 			if !customSuffixRegex.MatchString(roleName) {
-				log.Printf("[INFO] Skipping IAM Service Role: %s", roleName)
+				tflog.Warn(ctx, "Skipping resource", map[string]any{
+					"skip_reason": "no match",
+					"role_name":   roleName,
+				})
 				continue
 			}
 
 			r := ResourceServiceLinkedRole()
 			d := r.Data(nil)
 			d.SetId(aws.StringValue(role.Arn))
-			err := sdk.DeleteResource(ctx, r, d, client)
-			if err != nil {
-				sweeperErr := fmt.Errorf("error deleting IAM Service Linked Role (%s): %w", roleName, err)
-				log.Printf("[ERROR] %s", sweeperErr)
-				sweeperErrs = multierror.Append(sweeperErrs, sweeperErr)
-				continue
-			}
+
+			sweepResources = append(sweepResources, sdk.NewSweepResource(r, d, client))
 		}
+
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
-		log.Printf("[WARN] Skipping IAM Service Role sweep for %s: %s", region, err)
-		return sweeperErrs.ErrorOrNil() // In case we have completed some pages, but had errors
-	}
-
-	if err != nil {
-		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error describing IAM Service Roles: %w", err))
-	}
-
-	return sweeperErrs.ErrorOrNil()
+	return sweepResources, err
 }
 
 func sweepUsers(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -677,7 +610,7 @@ func sweepUsers(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping IAM User sweep for %s: %s", region, err)
 		return nil
 	}
@@ -825,19 +758,19 @@ func roleNameFilter(name string) bool {
 	// Some roles automatically generated by AWS will add a prefix to the associated resource name, so look for
 	// this pattern anywhere in the name, not just as a prefix.
 	// Some names use "tf_acc_test" instead, so catch those, too.
-	standardNameRegexp := regexp.MustCompile(`tf[-_]acc[-_]test`)
+	standardNameRegexp := regexache.MustCompile(`tf[-_]acc[-_]test`)
 	if standardNameRegexp.MatchString(name) {
 		return true
 	}
 
 	// Some acceptance tests use sdkacctest.RandString(10) rather than sdkacctest.RandomWithPrefix()
 	// Others use other lengths, e.g. sdkacctest.RandString(8), but this one is risky enough, so leave it as-is
-	randString10 := regexp.MustCompile(`^[a-zA-Z0-9]{10}$`)
+	randString10 := regexache.MustCompile(`^[0-9A-Za-z]{10}$`)
 	if randString10.MatchString(name) {
 		return true
 	}
 
-	randTF := regexp.MustCompile(`^tf-[0-9]{16}`)
+	randTF := regexache.MustCompile(`^tf-[0-9]{16}`)
 	if randTF.MatchString(name) {
 		return true
 	}
@@ -846,9 +779,11 @@ func roleNameFilter(name string) bool {
 	// exhaustive list.
 	prefixes := []string{
 		"another_rds",
+		"AmazonComprehendServiceRole-",
 		"aws_batch_service_role",
 		"aws_elastictranscoder_pipeline_tf_test",
 		"batch_tf_batch_target-",
+		"codebuild-",
 		"codepipeline-",
 		"cognito_authenticated_",
 		"cognito_unauthenticated_",
@@ -887,65 +822,42 @@ func roleNameFilter(name string) bool {
 	return false
 }
 
-func sweepVirtualMFADevice(region string) error {
-	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
-	if err != nil {
-		return fmt.Errorf("error getting client: %s", err)
-	}
+func sweepVirtualMFADevice(ctx context.Context, client *conns.AWSClient) ([]sweep.Sweepable, error) {
 	conn := client.IAMConn(ctx)
-	var sweeperErrs *multierror.Error
+	var sweepResources []sweep.Sweepable
+
 	input := &iam.ListVirtualMFADevicesInput{}
 
-	err = conn.ListVirtualMFADevicesPagesWithContext(ctx, input, func(page *iam.ListVirtualMFADevicesOutput, lastPage bool) bool {
-		if len(page.VirtualMFADevices) == 0 {
-			log.Printf("[INFO] No IAM Virtual MFA Devices to sweep")
-			return true
+	err := conn.ListVirtualMFADevicesPagesWithContext(ctx, input, func(page *iam.ListVirtualMFADevicesOutput, lastPage bool) bool {
+		if page == nil {
+			return !lastPage
 		}
+
 		for _, device := range page.VirtualMFADevices {
 			serialNum := aws.StringValue(device.SerialNumber)
 
 			if strings.Contains(serialNum, "root-account-mfa-device") {
-				log.Printf("[INFO] Skipping IAM Root Virtual MFA Device: %s", device)
+				tflog.Warn(ctx, "Skipping: IAM Root Virtual MFA Device", map[string]any{
+					"serial_number": device,
+				})
 				continue
 			}
 
 			r := ResourceVirtualMFADevice()
 			d := r.Data(nil)
 			d.SetId(serialNum)
-			err := sdk.DeleteResource(ctx, r, d, client)
-			if err != nil {
-				sweeperErr := fmt.Errorf("error deleting IAM Virtual MFA Device (%s): %w", device, err)
-				log.Printf("[ERROR] %s", sweeperErr)
-				sweeperErrs = multierror.Append(sweeperErrs, sweeperErr)
-				continue
-			}
+
+			sweepResources = append(sweepResources, sdk.NewSweepResource(r, d, client))
 		}
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
-		log.Printf("[WARN] Skipping IAM Virtual MFA Device sweep for %s: %s", region, err)
-		return sweeperErrs.ErrorOrNil() // In case we have completed some pages, but had errors
-	}
-
-	if err != nil {
-		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error describing IAM Virtual MFA Devices: %w", err))
-	}
-
-	return sweeperErrs.ErrorOrNil()
+	return sweepResources, err
 }
 
-func sweepSigningCertificates(region string) error {
-	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
-	if err != nil {
-		return fmt.Errorf("error getting client: %w", err)
-	}
+func sweepSigningCertificates(ctx context.Context, client *conns.AWSClient) ([]sweep.Sweepable, error) {
 	conn := client.IAMConn(ctx)
 
-	var sweeperErrs *multierror.Error
-
 	prefixes := []string{
 		"test-user",
 		"test_user",
@@ -953,9 +865,9 @@ func sweepSigningCertificates(region string) error {
 		"tf_acc",
 	}
 
-	users := make([]*iam.User, 0)
+	var users []*iam.User
 
-	err = conn.ListUsersPagesWithContext(ctx, &iam.ListUsersInput{}, func(page *iam.ListUsersOutput, lastPage bool) bool {
+	err := conn.ListUsersPagesWithContext(ctx, &iam.ListUsersInput{}, func(page *iam.ListUsersOutput, lastPage bool) bool {
 		for _, user := range page.Users {
 			for _, prefix := range prefixes {
 				if strings.HasPrefix(aws.StringValue(user.UserName), prefix) {
@@ -967,38 +879,34 @@ func sweepSigningCertificates(region string) error {
 
 		return !lastPage
 	})
+	if err != nil {
+		return nil, err
+	}
+
+	var sweepResources []sweep.Sweepable
 
 	for _, user := range users {
 		out, err := conn.ListSigningCertificatesWithContext(ctx, &iam.ListSigningCertificatesInput{
 			UserName: user.UserName,
 		})
+		if err != nil {
+			tflog.Warn(ctx, "Skipping resource", map[string]any{
+				"error":     err.Error(),
+				"user_name": user.UserName,
+			})
+			continue
+		}
 
 		for _, cert := range out.Certificates {
-
 			id := fmt.Sprintf("%s:%s", aws.StringValue(cert.CertificateId), aws.StringValue(cert.UserName))
 
 			r := ResourceSigningCertificate()
 			d := r.Data(nil)
 			d.SetId(id)
-			err := sdk.DeleteResource(ctx, r, d, client)
-
-			if err != nil {
-				sweeperErr := fmt.Errorf("error deleting IAM Signing Certificate (%s): %w", id, err)
-				log.Printf("[ERROR] %s", sweeperErr)
-				sweeperErrs = multierror.Append(sweeperErrs, sweeperErr)
-				continue
-			}
-		}
-
-		if sweep.SkipSweepError(err) {
-			log.Printf("[WARN] Skipping IAM Signing Certificate sweep for %s: %s", region, err)
-			return sweeperErrs.ErrorOrNil() // In case we have completed some pages, but had errors
-		}
 
-		if err != nil {
-			sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error describing IAM Signing Certificates: %w", err))
+			sweepResources = append(sweepResources, sdk.NewSweepResource(r, d, client))
 		}
 	}
 
-	return sweeperErrs.ErrorOrNil()
+	return sweepResources, err
 }
diff --git a/internal/service/iam/tags.go b/internal/service/iam/tags.go
index a213d1f1cf4..fef0ebb1047 100644
--- a/internal/service/iam/tags.go
+++ b/internal/service/iam/tags.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:build !generate
 // +build !generate
 
diff --git a/internal/service/iam/user.go b/internal/service/iam/user.go
index fd2fc7d492e..27696efbd3f 100644
--- a/internal/service/iam/user.go
+++ b/internal/service/iam/user.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/iam"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -51,7 +54,7 @@ func ResourceUser() *schema.Resource {
 				Type:     schema.TypeString,
 				Required: true,
 				ValidateFunc: validation.StringMatch(
-					regexp.MustCompile(`^[0-9A-Za-z=,.@\-_+]+$`),
+					regexache.MustCompile(`^[0-9A-Za-z=,.@\-_+]+$`),
 					"must only contain alphanumeric characters, hyphens, underscores, commas, periods, @ symbols, plus and equals signs",
 				),
 			},
@@ -158,6 +161,8 @@ func resourceUserRead(ctx context.Context, d *schema.ResourceData, meta interfac
 	d.Set("path", user.Path)
 	if user.PermissionsBoundary != nil {
 		d.Set("permissions_boundary", user.PermissionsBoundary.PermissionsBoundaryArn)
+	} else {
+		d.Set("permissions_boundary", nil)
 	}
 	d.Set("unique_id", user.UserId)
 
diff --git a/internal/service/iam/user_data_source.go b/internal/service/iam/user_data_source.go
index 5c33064a9a2..91f5820e42d 100644
--- a/internal/service/iam/user_data_source.go
+++ b/internal/service/iam/user_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam
 
 import (
diff --git a/internal/service/iam/user_data_source_test.go b/internal/service/iam/user_data_source_test.go
index 9fa7500c0bd..d180c759746 100644
--- a/internal/service/iam/user_data_source_test.go
+++ b/internal/service/iam/user_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam_test
 
 import (
diff --git a/internal/service/iam/user_group_membership.go b/internal/service/iam/user_group_membership.go
index 176bf5fb123..7e5e8e2ca51 100644
--- a/internal/service/iam/user_group_membership.go
+++ b/internal/service/iam/user_group_membership.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam
 
 import (
diff --git a/internal/service/iam/user_group_membership_test.go b/internal/service/iam/user_group_membership_test.go
index 4919da7858e..5e18f0c535d 100644
--- a/internal/service/iam/user_group_membership_test.go
+++ b/internal/service/iam/user_group_membership_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam_test
 
 import (
diff --git a/internal/service/iam/user_login_profile.go b/internal/service/iam/user_login_profile.go
index fd0db9220ed..0baa88f8a64 100644
--- a/internal/service/iam/user_login_profile.go
+++ b/internal/service/iam/user_login_profile.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam
 
 import (
diff --git a/internal/service/iam/user_login_profile_test.go b/internal/service/iam/user_login_profile_test.go
index e4eb221fcd8..45399892b7a 100644
--- a/internal/service/iam/user_login_profile_test.go
+++ b/internal/service/iam/user_login_profile_test.go
@@ -1,13 +1,16 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam_test
 
 import (
 	"context"
 	"errors"
 	"fmt"
-	"regexp"
 	"testing"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/credentials"
 	"github.com/aws/aws-sdk-go/aws/session"
@@ -125,13 +128,13 @@ func TestAccIAMUserLoginProfile_keybase(t *testing.T) {
 		CheckDestroy:             testAccCheckUserLoginProfileDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccUserLoginProfileConfig_required(rName, "keybase:terraformacctest"),
+				Config: testAccUserLoginProfileConfig_keybase(rName, "keybase:terraformacctest"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckUserLoginProfileExists(ctx, resourceName, &conf),
 					resource.TestCheckResourceAttrSet(resourceName, "encrypted_password"),
 					resource.TestCheckResourceAttrSet(resourceName, "key_fingerprint"),
 					resource.TestCheckResourceAttr(resourceName, "password_length", "20"),
-					resource.TestCheckResourceAttr(resourceName, "pgp_key", "keybase:terraformacctest\n"),
+					resource.TestCheckResourceAttr(resourceName, "pgp_key", "keybase:terraformacctest"),
 				),
 			},
 			{
@@ -161,8 +164,8 @@ func TestAccIAMUserLoginProfile_keybaseDoesntExist(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				// We own this account but it doesn't have any key associated with it
-				Config:      testAccUserLoginProfileConfig_required(rName, "keybase:terraform_nope"),
-				ExpectError: regexp.MustCompile(`retrieving Public Key`),
+				Config:      testAccUserLoginProfileConfig_keybase(rName, "keybase:terraform_nope"),
+				ExpectError: regexache.MustCompile(`retrieving Public Key`),
 			},
 		},
 	})
@@ -181,7 +184,7 @@ func TestAccIAMUserLoginProfile_notAKey(t *testing.T) {
 			{
 				// We own this account but it doesn't have any key associated with it
 				Config:      testAccUserLoginProfileConfig_required(rName, "lolimnotakey"),
-				ExpectError: regexp.MustCompile(`encrypting Password`),
+				ExpectError: regexache.MustCompile(`encrypting Password`),
 			},
 		},
 	})
@@ -461,6 +464,16 @@ EOF
 `, pgpKey))
 }
 
+func testAccUserLoginProfileConfig_keybase(rName, keyname string) string {
+	return acctest.ConfigCompose(testAccUserLoginProfileConfig_base(rName), fmt.Sprintf(`
+resource "aws_iam_user_login_profile" "test" {
+  user = aws_iam_user.test.name
+
+  pgp_key = %[1]q
+}
+`, keyname))
+}
+
 func testAccUserLoginProfileConfig_noGPG(rName string) string {
 	return acctest.ConfigCompose(testAccUserLoginProfileConfig_base(rName), `
 resource "aws_iam_user_login_profile" "test" {
diff --git a/internal/service/iam/user_policy.go b/internal/service/iam/user_policy.go
index 931425cef49..47c2f6ff235 100644
--- a/internal/service/iam/user_policy.go
+++ b/internal/service/iam/user_policy.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam
 
 import (
@@ -11,10 +14,10 @@ import (
 	"github.com/aws/aws-sdk-go/service/iam"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/create"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
@@ -23,7 +26,6 @@ import (
 // @SDKResource("aws_iam_user_policy")
 func ResourceUserPolicy() *schema.Resource {
 	return &schema.Resource{
-		// PutUserPolicy API is idempotent, so these can be the same.
 		CreateWithoutTimeout: resourceUserPolicyPut,
 		ReadWithoutTimeout:   resourceUserPolicyRead,
 		UpdateWithoutTimeout: resourceUserPolicyPut,
@@ -34,17 +36,6 @@ func ResourceUserPolicy() *schema.Resource {
 		},
 
 		Schema: map[string]*schema.Schema{
-			"policy": {
-				Type:                  schema.TypeString,
-				Required:              true,
-				ValidateFunc:          verify.ValidIAMPolicyJSON,
-				DiffSuppressFunc:      verify.SuppressEquivalentPolicyDiffs,
-				DiffSuppressOnRefresh: true,
-				StateFunc: func(v interface{}) string {
-					json, _ := verify.LegacyPolicyNormalize(v)
-					return json
-				},
-			},
 			"name": {
 				Type:          schema.TypeString,
 				Optional:      true,
@@ -55,9 +46,21 @@ func ResourceUserPolicy() *schema.Resource {
 			"name_prefix": {
 				Type:          schema.TypeString,
 				Optional:      true,
+				Computed:      true,
 				ForceNew:      true,
 				ConflictsWith: []string{"name"},
 			},
+			"policy": {
+				Type:                  schema.TypeString,
+				Required:              true,
+				ValidateFunc:          verify.ValidIAMPolicyJSON,
+				DiffSuppressFunc:      verify.SuppressEquivalentPolicyDiffs,
+				DiffSuppressOnRefresh: true,
+				StateFunc: func(v interface{}) string {
+					json, _ := verify.LegacyPolicyNormalize(v)
+					return json
+				},
+			},
 			"user": {
 				Type:     schema.TypeString,
 				Required: true,
@@ -71,77 +74,53 @@ func resourceUserPolicyPut(ctx context.Context, d *schema.ResourceData, meta int
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).IAMConn(ctx)
 
-	p, err := verify.LegacyPolicyNormalize(d.Get("policy").(string))
+	policyDoc, err := verify.LegacyPolicyNormalize(d.Get("policy").(string))
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "policy (%s) is invalid JSON: %s", p, err)
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
-	request := &iam.PutUserPolicyInput{
-		UserName:       aws.String(d.Get("user").(string)),
-		PolicyDocument: aws.String(p),
+	userName := d.Get("user").(string)
+	policyName := create.Name(d.Get("name").(string), d.Get("name_prefix").(string))
+	input := &iam.PutUserPolicyInput{
+		PolicyDocument: aws.String(policyDoc),
+		PolicyName:     aws.String(policyName),
+		UserName:       aws.String(userName),
 	}
 
-	var policyName string
-	if !d.IsNewResource() {
-		_, policyName, err = UserPolicyParseID(d.Id())
-		if err != nil {
-			return sdkdiag.AppendErrorf(diags, "putting IAM User Policy %s: %s", d.Id(), err)
-		}
-	} else if v, ok := d.GetOk("name"); ok {
-		policyName = v.(string)
-	} else if v, ok := d.GetOk("name_prefix"); ok {
-		policyName = id.PrefixedUniqueId(v.(string))
-	} else {
-		policyName = id.UniqueId()
+	_, err = conn.PutUserPolicyWithContext(ctx, input)
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "putting IAM User (%s) Policy (%s): %s", userName, policyName, err)
 	}
-	request.PolicyName = aws.String(policyName)
 
-	if _, err := conn.PutUserPolicyWithContext(ctx, request); err != nil {
-		return sdkdiag.AppendErrorf(diags, "putting IAM User Policy %s: %s", aws.StringValue(request.PolicyName), err)
+	if d.IsNewResource() {
+		d.SetId(fmt.Sprintf("%s:%s", userName, policyName))
+
+		_, err := tfresource.RetryWhenNotFound(ctx, propagationTimeout, func() (interface{}, error) {
+			return FindUserPolicyByTwoPartKey(ctx, conn, userName, policyName)
+		})
+
+		if err != nil {
+			return sdkdiag.AppendErrorf(diags, "waiting for IAM User Policy (%s) create: %s", d.Id(), err)
+		}
 	}
 
-	d.SetId(fmt.Sprintf("%s:%s", aws.StringValue(request.UserName), aws.StringValue(request.PolicyName)))
-	return diags
+	return append(diags, resourceUserPolicyRead(ctx, d, meta)...)
 }
 
 func resourceUserPolicyRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).IAMConn(ctx)
 
-	user, name, err := UserPolicyParseID(d.Id())
+	userName, policyName, err := UserPolicyParseID(d.Id())
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "reading IAM User Policy (%s): %s", d.Id(), err)
-	}
-
-	request := &iam.GetUserPolicyInput{
-		PolicyName: aws.String(name),
-		UserName:   aws.String(user),
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
-	var getResp *iam.GetUserPolicyOutput
-
-	err = retry.RetryContext(ctx, propagationTimeout, func() *retry.RetryError {
-		var err error
-
-		getResp, err = conn.GetUserPolicyWithContext(ctx, request)
-
-		if d.IsNewResource() && tfawserr.ErrCodeEquals(err, iam.ErrCodeNoSuchEntityException) {
-			return retry.RetryableError(err)
-		}
-
-		if err != nil {
-			return retry.NonRetryableError(err)
-		}
-
-		return nil
-	})
-
-	if tfresource.TimedOut(err) {
-		getResp, err = conn.GetUserPolicyWithContext(ctx, request)
-	}
+	policyDocument, err := FindUserPolicyByTwoPartKey(ctx, conn, userName, policyName)
 
-	if !d.IsNewResource() && tfawserr.ErrCodeEquals(err, iam.ErrCodeNoSuchEntityException) {
-		log.Printf("[WARN] IAM User Policy (%s) not found, removing from state", d.Id())
+	if !d.IsNewResource() && tfresource.NotFound(err) {
+		log.Printf("[WARN] IAM User Policy %s not found, removing from state", d.Id())
 		d.SetId("")
 		return diags
 	}
@@ -150,24 +129,20 @@ func resourceUserPolicyRead(ctx context.Context, d *schema.ResourceData, meta in
 		return sdkdiag.AppendErrorf(diags, "reading IAM User Policy (%s): %s", d.Id(), err)
 	}
 
-	if getResp == nil || getResp.PolicyDocument == nil {
-		return sdkdiag.AppendErrorf(diags, "reading IAM User Policy (%s): empty response", d.Id())
-	}
-
-	policy, err := url.QueryUnescape(*getResp.PolicyDocument)
+	policy, err := url.QueryUnescape(policyDocument)
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "reading IAM User Policy (%s): %s", d.Id(), err)
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
 	policyToSet, err := verify.LegacyPolicyToSet(d.Get("policy").(string), policy)
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "reading IAM User Policy (%s): setting policy: %s", d.Id(), err)
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
+	d.Set("name", policyName)
+	d.Set("name_prefix", create.NamePrefixFromName(policyName))
 	d.Set("policy", policyToSet)
-
-	d.Set("name", name)
-	d.Set("user", user)
+	d.Set("user", userName)
 
 	return diags
 }
@@ -176,25 +151,54 @@ func resourceUserPolicyDelete(ctx context.Context, d *schema.ResourceData, meta
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).IAMConn(ctx)
 
-	user, name, err := UserPolicyParseID(d.Id())
+	userName, policyName, err := UserPolicyParseID(d.Id())
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "deleting IAM User Policy %s: %s", d.Id(), err)
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
-	request := &iam.DeleteUserPolicyInput{
-		PolicyName: aws.String(name),
-		UserName:   aws.String(user),
+	log.Printf("[INFO] Deleting IAM User Policy: %s", d.Id())
+	_, err = conn.DeleteUserPolicyWithContext(ctx, &iam.DeleteUserPolicyInput{
+		PolicyName: aws.String(policyName),
+		UserName:   aws.String(userName),
+	})
+
+	if tfawserr.ErrCodeEquals(err, iam.ErrCodeNoSuchEntityException) {
+		return diags
 	}
 
-	if _, err := conn.DeleteUserPolicyWithContext(ctx, request); err != nil {
-		if tfawserr.ErrCodeEquals(err, iam.ErrCodeNoSuchEntityException) {
-			return diags
-		}
-		return sdkdiag.AppendErrorf(diags, "deleting IAM User Policy %s: %s", d.Id(), err)
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "deleting IAM User Policy (%s): %s", d.Id(), err)
 	}
+
 	return diags
 }
 
+func FindUserPolicyByTwoPartKey(ctx context.Context, conn *iam.IAM, userName, policyName string) (string, error) {
+	input := &iam.GetUserPolicyInput{
+		PolicyName: aws.String(policyName),
+		UserName:   aws.String(userName),
+	}
+
+	output, err := conn.GetUserPolicyWithContext(ctx, input)
+
+	if tfawserr.ErrCodeEquals(err, iam.ErrCodeNoSuchEntityException) {
+		return "", &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+
+	if err != nil {
+		return "", err
+	}
+
+	if output == nil || output.PolicyDocument == nil {
+		return "", tfresource.NewEmptyResultError(input)
+	}
+
+	return aws.StringValue(output.PolicyDocument), nil
+}
+
 func UserPolicyParseID(id string) (userName, policyName string, err error) {
 	parts := strings.SplitN(id, ":", 2)
 	if len(parts) != 2 {
diff --git a/internal/service/iam/user_policy_attachment.go b/internal/service/iam/user_policy_attachment.go
index 1055812534a..13f642d5498 100644
--- a/internal/service/iam/user_policy_attachment.go
+++ b/internal/service/iam/user_policy_attachment.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam
 
 import (
diff --git a/internal/service/iam/user_policy_attachment_test.go b/internal/service/iam/user_policy_attachment_test.go
index 9cc0628b5ea..ff0359ff3b7 100644
--- a/internal/service/iam/user_policy_attachment_test.go
+++ b/internal/service/iam/user_policy_attachment_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam_test
 
 import (
diff --git a/internal/service/iam/user_policy_test.go b/internal/service/iam/user_policy_test.go
index b14ea11e2d9..fcf4e29c0a6 100644
--- a/internal/service/iam/user_policy_test.go
+++ b/internal/service/iam/user_policy_test.go
@@ -1,29 +1,34 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"strconv"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/iam"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	tfiam "github.com/hashicorp/terraform-provider-aws/internal/service/iam"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
 func TestAccIAMUserPolicy_basic(t *testing.T) {
 	ctx := acctest.Context(t)
+	var userPolicy string
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	policy1 := `{"Version":"2012-10-17","Statement":{"Action":"*","Effect":"Allow","Resource":"*"}}`
 	policy2 := `{"Version":"2012-10-17","Statement":{"Action":"iam:*","Effect":"Allow","Resource":"*"}}`
-	policyResourceName := "aws_iam_user_policy.test"
+	resourceName := "aws_iam_user_policy.test"
 	userResourceName := "aws_iam_user.test"
 
 	resource.ParallelTest(t, resource.TestCase{
@@ -33,31 +38,31 @@ func TestAccIAMUserPolicy_basic(t *testing.T) {
 		CheckDestroy:             testAccCheckUserPolicyDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config:      testAccUserPolicyConfig_name(rName, strconv.Quote("NonJSONString")),
-				ExpectError: regexp.MustCompile("invalid JSON"),
+				Config:      testAccUserPolicyConfig_basic(rName, strconv.Quote("NonJSONString")),
+				ExpectError: regexache.MustCompile("invalid JSON"),
 			},
 			{
-				Config: testAccUserPolicyConfig_name(rName, strconv.Quote(policy1)),
+				Config: testAccUserPolicyConfig_basic(rName, strconv.Quote(policy1)),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckUserPolicy(ctx, userResourceName, policyResourceName),
+					testAccCheckUserPolicyExists(ctx, resourceName, &userPolicy),
 					testAccCheckUserPolicyExpectedPolicies(ctx, userResourceName, 1),
-					resource.TestMatchResourceAttr(policyResourceName, "id", regexp.MustCompile(fmt.Sprintf("^%[1]s:%[1]s$", rName))),
-					resource.TestCheckResourceAttr(policyResourceName, "name", rName),
-					resource.TestCheckResourceAttr(policyResourceName, "policy", policy1),
-					resource.TestCheckResourceAttr(policyResourceName, "user", rName),
+					resource.TestCheckResourceAttr(resourceName, "name", rName),
+					resource.TestCheckResourceAttr(resourceName, "name_prefix", ""),
+					resource.TestCheckResourceAttr(resourceName, "policy", policy1),
+					resource.TestCheckResourceAttr(resourceName, "user", rName),
 				),
 			},
 			{
-				ResourceName:      policyResourceName,
+				ResourceName:      resourceName,
 				ImportState:       true,
 				ImportStateVerify: true,
 			},
 			{
-				Config: testAccUserPolicyConfig_name(rName, strconv.Quote(policy2)),
+				Config: testAccUserPolicyConfig_basic(rName, strconv.Quote(policy2)),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckUserPolicy(ctx, userResourceName, policyResourceName),
+					testAccCheckUserPolicyExists(ctx, resourceName, &userPolicy),
 					testAccCheckUserPolicyExpectedPolicies(ctx, userResourceName, 1),
-					resource.TestCheckResourceAttr(policyResourceName, "policy", policy2),
+					resource.TestCheckResourceAttr(resourceName, "policy", policy2),
 				),
 			},
 		},
@@ -66,8 +71,9 @@ func TestAccIAMUserPolicy_basic(t *testing.T) {
 
 func TestAccIAMUserPolicy_disappears(t *testing.T) {
 	ctx := acctest.Context(t)
-	var out iam.GetUserPolicyOutput
+	var userPolicy string
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	policy := `{"Version":"2012-10-17","Statement":{"Action":"*","Effect":"Allow","Resource":"*"}}`
 	resourceName := "aws_iam_user_policy.test"
 
 	resource.ParallelTest(t, resource.TestCase{
@@ -77,10 +83,10 @@ func TestAccIAMUserPolicy_disappears(t *testing.T) {
 		CheckDestroy:             testAccCheckUserPolicyDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccUserPolicyConfig_basic(rName),
+				Config: testAccUserPolicyConfig_basic(rName, strconv.Quote(policy)),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckUserPolicyExists(ctx, resourceName, &out),
-					testAccCheckUserPolicyDisappears(ctx, &out),
+					testAccCheckUserPolicyExists(ctx, resourceName, &userPolicy),
+					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfiam.ResourceUserPolicy(), resourceName),
 				),
 				ExpectNonEmptyPlan: true,
 			},
@@ -88,12 +94,12 @@ func TestAccIAMUserPolicy_disappears(t *testing.T) {
 	})
 }
 
-func TestAccIAMUserPolicy_namePrefix(t *testing.T) {
+func TestAccIAMUserPolicy_nameGenerated(t *testing.T) {
 	ctx := acctest.Context(t)
+	var userPolicy string
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
-	policy1 := `{"Version":"2012-10-17","Statement":{"Action":"*","Effect":"Allow","Resource":"*"}}`
-	policy2 := `{"Version":"2012-10-17","Statement":{"Action":"iam:*","Effect":"Allow","Resource":"*"}}`
-	policyResourceName := "aws_iam_user_policy.test"
+	policy := `{"Version":"2012-10-17","Statement":{"Action":"*","Effect":"Allow","Resource":"*"}}`
+	resourceName := "aws_iam_user_policy.test"
 	userResourceName := "aws_iam_user.test"
 
 	resource.ParallelTest(t, resource.TestCase{
@@ -103,39 +109,29 @@ func TestAccIAMUserPolicy_namePrefix(t *testing.T) {
 		CheckDestroy:             testAccCheckUserPolicyDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccUserPolicyConfig_namePrefix(rName, acctest.ResourcePrefix, strconv.Quote(policy1)),
+				Config: testAccUserPolicyConfig_nameGenerated(rName, strconv.Quote(policy)),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckUserPolicy(ctx, userResourceName, policyResourceName),
+					testAccCheckUserPolicyExists(ctx, resourceName, &userPolicy),
 					testAccCheckUserPolicyExpectedPolicies(ctx, userResourceName, 1),
-					resource.TestMatchResourceAttr(policyResourceName, "id", regexp.MustCompile(fmt.Sprintf("^%s:%s.+$", rName, acctest.ResourcePrefix))),
-					resource.TestCheckResourceAttr(policyResourceName, "name_prefix", acctest.ResourcePrefix),
-					resource.TestCheckResourceAttr(policyResourceName, "policy", policy1),
+					acctest.CheckResourceAttrNameGenerated(resourceName, "name"),
+					resource.TestCheckResourceAttr(resourceName, "name_prefix", id.UniqueIdPrefix),
 				),
 			},
 			{
-				ResourceName:            policyResourceName,
-				ImportState:             true,
-				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"name_prefix"},
-			},
-			{
-				Config: testAccUserPolicyConfig_namePrefix(rName, acctest.ResourcePrefix, strconv.Quote(policy2)),
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckUserPolicy(ctx, userResourceName, policyResourceName),
-					testAccCheckUserPolicyExpectedPolicies(ctx, userResourceName, 1),
-					resource.TestCheckResourceAttr(policyResourceName, "policy", policy2),
-				),
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
 			},
 		},
 	})
 }
 
-func TestAccIAMUserPolicy_generatedName(t *testing.T) {
+func TestAccIAMUserPolicy_namePrefix(t *testing.T) {
 	ctx := acctest.Context(t)
+	var userPolicy string
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
-	policy1 := `{"Version":"2012-10-17","Statement":{"Action":"*","Effect":"Allow","Resource":"*"}}`
-	policy2 := `{"Version":"2012-10-17","Statement":{"Action":"iam:*","Effect":"Allow","Resource":"*"}}`
-	policyResourceName := "aws_iam_user_policy.test"
+	policy := `{"Version":"2012-10-17","Statement":{"Action":"*","Effect":"Allow","Resource":"*"}}`
+	resourceName := "aws_iam_user_policy.test"
 	userResourceName := "aws_iam_user.test"
 
 	resource.ParallelTest(t, resource.TestCase{
@@ -145,38 +141,31 @@ func TestAccIAMUserPolicy_generatedName(t *testing.T) {
 		CheckDestroy:             testAccCheckUserPolicyDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccUserPolicyConfig_generatedName(rName, strconv.Quote(policy1)),
+				Config: testAccUserPolicyConfig_namePrefix(rName, "tf-acc-test-prefix-", strconv.Quote(policy)),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckUserPolicy(ctx, userResourceName, policyResourceName),
+					testAccCheckUserPolicyExists(ctx, resourceName, &userPolicy),
 					testAccCheckUserPolicyExpectedPolicies(ctx, userResourceName, 1),
-					resource.TestMatchResourceAttr(policyResourceName, "id", regexp.MustCompile(fmt.Sprintf("^%s:.+$", rName))),
-					resource.TestCheckResourceAttr(policyResourceName, "policy", policy1),
+					acctest.CheckResourceAttrNameFromPrefix(resourceName, "name", "tf-acc-test-prefix-"),
+					resource.TestCheckResourceAttr(resourceName, "name_prefix", "tf-acc-test-prefix-"),
 				),
 			},
 			{
-				ResourceName:      policyResourceName,
+				ResourceName:      resourceName,
 				ImportState:       true,
 				ImportStateVerify: true,
 			},
-			{
-				Config: testAccUserPolicyConfig_generatedName(rName, strconv.Quote(policy2)),
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckUserPolicy(ctx, userResourceName, policyResourceName),
-					testAccCheckUserPolicyExpectedPolicies(ctx, userResourceName, 1),
-					resource.TestCheckResourceAttr(policyResourceName, "policy", policy2),
-				),
-			},
 		},
 	})
 }
 
 func TestAccIAMUserPolicy_multiplePolicies(t *testing.T) {
 	ctx := acctest.Context(t)
+	var userPolicy string
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	policy1 := `{"Version":"2012-10-17","Statement":{"Action":"*","Effect":"Allow","Resource":"*"}}`
 	policy2 := `{"Version":"2012-10-17","Statement":{"Action":"iam:*","Effect":"Allow","Resource":"*"}}`
-	policyResourceName1 := "aws_iam_user_policy.test"
-	policyResourceName2 := "aws_iam_user_policy.test2"
+	resourceName1 := "aws_iam_user_policy.test1"
+	resourceName2 := "aws_iam_user_policy.test2"
 	userResourceName := "aws_iam_user.test"
 
 	resource.ParallelTest(t, resource.TestCase{
@@ -185,45 +174,24 @@ func TestAccIAMUserPolicy_multiplePolicies(t *testing.T) {
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckUserPolicyDestroy(ctx),
 		Steps: []resource.TestStep{
-			{
-				Config: testAccUserPolicyConfig_name(rName, strconv.Quote(policy1)),
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckUserPolicy(ctx, userResourceName, policyResourceName1),
-					testAccCheckUserPolicyExpectedPolicies(ctx, userResourceName, 1),
-					resource.TestCheckResourceAttr(policyResourceName1, "name", rName),
-					resource.TestCheckResourceAttr(policyResourceName1, "policy", policy1),
-				),
-			},
-			{
-				ResourceName:      policyResourceName1,
-				ImportState:       true,
-				ImportStateVerify: true,
-			},
 			{
 				Config: testAccUserPolicyConfig_multiplePolicies(rName, strconv.Quote(policy1), strconv.Quote(policy2)),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckUserPolicy(ctx, userResourceName, policyResourceName1),
-					testAccCheckUserPolicy(ctx, userResourceName, policyResourceName2),
+					testAccCheckUserPolicyExists(ctx, resourceName1, &userPolicy),
+					testAccCheckUserPolicyExists(ctx, resourceName2, &userPolicy),
 					testAccCheckUserPolicyExpectedPolicies(ctx, userResourceName, 2),
-					resource.TestCheckResourceAttr(policyResourceName1, "policy", policy1),
-					resource.TestCheckResourceAttr(policyResourceName2, "name", fmt.Sprintf("%s-2", rName)),
-					resource.TestCheckResourceAttr(policyResourceName2, "policy", policy2),
+					resource.TestCheckResourceAttr(resourceName1, "policy", policy1),
+					resource.TestCheckResourceAttr(resourceName2, "policy", policy2),
 				),
 			},
 			{
 				Config: testAccUserPolicyConfig_multiplePolicies(rName, strconv.Quote(policy2), strconv.Quote(policy2)),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckUserPolicy(ctx, userResourceName, policyResourceName1),
-					testAccCheckUserPolicy(ctx, userResourceName, policyResourceName2),
+					testAccCheckUserPolicyExists(ctx, resourceName1, &userPolicy),
+					testAccCheckUserPolicyExists(ctx, resourceName2, &userPolicy),
 					testAccCheckUserPolicyExpectedPolicies(ctx, userResourceName, 2),
-					resource.TestCheckResourceAttr(policyResourceName1, "policy", policy2),
-				),
-			},
-			{
-				Config: testAccUserPolicyConfig_name(rName, strconv.Quote(policy2)),
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckUserPolicy(ctx, userResourceName, policyResourceName1),
-					testAccCheckUserPolicyExpectedPolicies(ctx, userResourceName, 1),
+					resource.TestCheckResourceAttr(resourceName1, "policy", policy2),
+					resource.TestCheckResourceAttr(resourceName2, "policy", policy2),
 				),
 			},
 		},
@@ -232,8 +200,9 @@ func TestAccIAMUserPolicy_multiplePolicies(t *testing.T) {
 
 func TestAccIAMUserPolicy_policyOrder(t *testing.T) {
 	ctx := acctest.Context(t)
+	var userPolicy string
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
-	policyResourceName := "aws_iam_user_policy.test"
+	resourceName := "aws_iam_user_policy.test"
 	userResourceName := "aws_iam_user.test"
 
 	resource.ParallelTest(t, resource.TestCase{
@@ -245,7 +214,7 @@ func TestAccIAMUserPolicy_policyOrder(t *testing.T) {
 			{
 				Config: testAccUserPolicyConfig_order(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckUserPolicy(ctx, userResourceName, policyResourceName),
+					testAccCheckUserPolicyExists(ctx, resourceName, &userPolicy),
 					testAccCheckUserPolicyExpectedPolicies(ctx, userResourceName, 1),
 				),
 			},
@@ -257,33 +226,27 @@ func TestAccIAMUserPolicy_policyOrder(t *testing.T) {
 	})
 }
 
-func testAccCheckUserPolicyExists(ctx context.Context, resource string, res *iam.GetUserPolicyOutput) resource.TestCheckFunc {
+func testAccCheckUserPolicyExists(ctx context.Context, n string, v *string) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		rs, ok := s.RootModule().Resources[resource]
+		rs, ok := s.RootModule().Resources[n]
 		if !ok {
-			return fmt.Errorf("Not found: %s", resource)
-		}
-
-		if rs.Primary.ID == "" {
-			return fmt.Errorf("No Policy name is set")
+			return fmt.Errorf("Not found: %s", n)
 		}
 
-		user, name, err := tfiam.UserPolicyParseID(rs.Primary.ID)
+		userName, policyName, err := tfiam.UserPolicyParseID(rs.Primary.ID)
 		if err != nil {
 			return err
 		}
 
 		conn := acctest.Provider.Meta().(*conns.AWSClient).IAMConn(ctx)
 
-		resp, err := conn.GetUserPolicyWithContext(ctx, &iam.GetUserPolicyInput{
-			PolicyName: aws.String(name),
-			UserName:   aws.String(user),
-		})
+		output, err := tfiam.FindUserPolicyByTwoPartKey(ctx, conn, userName, policyName)
+
 		if err != nil {
 			return err
 		}
 
-		*res = *resp
+		*v = output
 
 		return nil
 	}
@@ -298,111 +261,65 @@ func testAccCheckUserPolicyDestroy(ctx context.Context) resource.TestCheckFunc {
 				continue
 			}
 
-			user, name, err := tfiam.UserPolicyParseID(rs.Primary.ID)
+			userName, policyName, err := tfiam.UserPolicyParseID(rs.Primary.ID)
 			if err != nil {
 				return err
 			}
 
-			request := &iam.GetUserPolicyInput{
-				PolicyName: aws.String(name),
-				UserName:   aws.String(user),
-			}
-
-			getResp, err := conn.GetUserPolicyWithContext(ctx, request)
+			_, err = tfiam.FindUserPolicyByTwoPartKey(ctx, conn, userName, policyName)
 
-			if tfawserr.ErrCodeEquals(err, iam.ErrCodeNoSuchEntityException) {
+			if tfresource.NotFound(err) {
 				continue
 			}
 
 			if err != nil {
-				return fmt.Errorf("Error reading IAM policy %s from user %s: %s", name, user, err)
+				return err
 			}
 
-			if getResp != nil {
-				return fmt.Errorf("Found IAM user policy, expected none: %s", getResp)
-			}
+			return fmt.Errorf("IAM User Policy %s still exists", rs.Primary.ID)
 		}
 
 		return nil
 	}
 }
 
-func testAccCheckUserPolicyDisappears(ctx context.Context, out *iam.GetUserPolicyOutput) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		conn := acctest.Provider.Meta().(*conns.AWSClient).IAMConn(ctx)
-
-		params := &iam.DeleteUserPolicyInput{
-			PolicyName: out.PolicyName,
-			UserName:   out.UserName,
-		}
-
-		_, err := conn.DeleteUserPolicyWithContext(ctx, params)
-		return err
-	}
-}
-
-func testAccCheckUserPolicy(ctx context.Context,
-	iamUserResource string,
-	iamUserPolicyResource string) resource.TestCheckFunc {
+func testAccCheckUserPolicyExpectedPolicies(ctx context.Context, n string, want int) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		rs, ok := s.RootModule().Resources[iamUserResource]
-		if !ok {
-			return fmt.Errorf("Not Found: %s", iamUserResource)
-		}
-
-		if rs.Primary.ID == "" {
-			return fmt.Errorf("No ID is set")
-		}
-
-		policy, ok := s.RootModule().Resources[iamUserPolicyResource]
+		rs, ok := s.RootModule().Resources[n]
 		if !ok {
-			return fmt.Errorf("Not Found: %s", iamUserPolicyResource)
+			return fmt.Errorf("Not found: %s", n)
 		}
 
 		conn := acctest.Provider.Meta().(*conns.AWSClient).IAMConn(ctx)
-		username, name, err := tfiam.UserPolicyParseID(policy.Primary.ID)
-		if err != nil {
-			return err
-		}
 
-		_, err = conn.GetUserPolicyWithContext(ctx, &iam.GetUserPolicyInput{
-			UserName:   aws.String(username),
-			PolicyName: aws.String(name),
-		})
-
-		return err
-	}
-}
+		var got int
 
-func testAccCheckUserPolicyExpectedPolicies(ctx context.Context, iamUserResource string, expected int) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		rs, ok := s.RootModule().Resources[iamUserResource]
-		if !ok {
-			return fmt.Errorf("Not Found: %s", iamUserResource)
+		input := &iam.ListUserPoliciesInput{
+			UserName: aws.String(rs.Primary.ID),
 		}
+		err := conn.ListUserPoliciesPagesWithContext(ctx, input, func(page *iam.ListUserPoliciesOutput, lastPage bool) bool {
+			if page == nil {
+				return !lastPage
+			}
 
-		if rs.Primary.ID == "" {
-			return fmt.Errorf("No ID is set")
-		}
+			got += len(page.PolicyNames)
 
-		conn := acctest.Provider.Meta().(*conns.AWSClient).IAMConn(ctx)
-		userPolicies, err := conn.ListUserPoliciesWithContext(ctx, &iam.ListUserPoliciesInput{
-			UserName: aws.String(rs.Primary.ID),
+			return !lastPage
 		})
 
 		if err != nil {
 			return err
 		}
 
-		if len(userPolicies.PolicyNames) != expected {
-			return fmt.Errorf("Expected (%d) IAM user policies for user (%s), found: %d", expected, rs.Primary.ID, len(userPolicies.PolicyNames))
+		if got != want {
+			return fmt.Errorf("Got %d IAM User Policies for %s, want %v", got, rs.Primary.ID, want)
 		}
 
 		return nil
 	}
 }
 
-func testAccUserPolicyUserBaseConfig(rName, path string) string {
+func testAccUserPolicyUserConfig_base(rName, path string) string {
 	return fmt.Sprintf(`
 resource "aws_iam_user" "test" {
   name = %[1]q
@@ -411,32 +328,8 @@ resource "aws_iam_user" "test" {
 `, rName, path)
 }
 
-func testAccUserPolicyConfig_basic(rName string) string {
-	return acctest.ConfigCompose(
-		testAccUserPolicyUserBaseConfig(rName, "/"),
-		fmt.Sprintf(`
-resource "aws_iam_user_policy" "test" {
-  name = %[1]q
-  user = aws_iam_user.test.name
-
-  policy = <<EOF
-{
-  "Version": "2012-10-17",
-  "Statement": {
-    "Effect": "Allow",
-    "Action": "*",
-    "Resource": "*"
-  }
-}
-EOF
-}
-`, rName))
-}
-
-func testAccUserPolicyConfig_name(rName, policy string) string {
-	return acctest.ConfigCompose(
-		testAccUserPolicyUserBaseConfig(rName, "/"),
-		fmt.Sprintf(`
+func testAccUserPolicyConfig_basic(rName, policy string) string {
+	return acctest.ConfigCompose(testAccUserPolicyUserConfig_base(rName, "/"), fmt.Sprintf(`
 resource "aws_iam_user_policy" "test" {
   name   = %[1]q
   user   = aws_iam_user.test.name
@@ -445,34 +338,28 @@ resource "aws_iam_user_policy" "test" {
 `, rName, policy))
 }
 
-func testAccUserPolicyConfig_namePrefix(rName, prefix, policy string) string {
-	return acctest.ConfigCompose(
-		testAccUserPolicyUserBaseConfig(rName, "/"),
-		fmt.Sprintf(`
+func testAccUserPolicyConfig_nameGenerated(rName, policy string) string {
+	return acctest.ConfigCompose(testAccUserPolicyUserConfig_base(rName, "/"), fmt.Sprintf(`
 resource "aws_iam_user_policy" "test" {
-  name_prefix = %[1]q
-  user        = aws_iam_user.test.name
-  policy      = %[2]s
+  user   = aws_iam_user.test.name
+  policy = %[1]s
 }
-`, prefix, policy))
+`, policy))
 }
 
-func testAccUserPolicyConfig_generatedName(rName, policy string) string {
-	return acctest.ConfigCompose(
-		testAccUserPolicyUserBaseConfig(rName, "/"),
-		fmt.Sprintf(`
+func testAccUserPolicyConfig_namePrefix(rName, namePrefix, policy string) string {
+	return acctest.ConfigCompose(testAccUserPolicyUserConfig_base(rName, "/"), fmt.Sprintf(`
 resource "aws_iam_user_policy" "test" {
-  user   = aws_iam_user.test.name
-  policy = %[1]s
+  name_prefix = %[1]q
+  user        = aws_iam_user.test.name
+  policy      = %[2]s
 }
-`, policy))
+`, namePrefix, policy))
 }
 
 func testAccUserPolicyConfig_multiplePolicies(rName, policy1, policy2 string) string {
-	return acctest.ConfigCompose(
-		testAccUserPolicyUserBaseConfig(rName, "/"),
-		fmt.Sprintf(`
-resource "aws_iam_user_policy" "test" {
+	return acctest.ConfigCompose(testAccUserPolicyUserConfig_base(rName, "/"), fmt.Sprintf(`
+resource "aws_iam_user_policy" "test1" {
   name   = %[1]q
   user   = aws_iam_user.test.name
   policy = %[2]s
@@ -487,9 +374,7 @@ resource "aws_iam_user_policy" "test2" {
 }
 
 func testAccUserPolicyConfig_order(rName string) string {
-	return acctest.ConfigCompose(
-		testAccUserPolicyUserBaseConfig(rName, "/"),
-		fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccUserPolicyUserConfig_base(rName, "/"), fmt.Sprintf(`
 resource "aws_iam_user_policy" "test" {
   name = %[1]q
   user = aws_iam_user.test.name
@@ -514,9 +399,7 @@ EOF
 }
 
 func testAccUserPolicyConfig_newOrder(rName string) string {
-	return acctest.ConfigCompose(
-		testAccUserPolicyUserBaseConfig(rName, "/"),
-		fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccUserPolicyUserConfig_base(rName, "/"), fmt.Sprintf(`
 resource "aws_iam_user_policy" "test" {
   name = %[1]q
   user = aws_iam_user.test.name
diff --git a/internal/service/iam/user_ssh_key.go b/internal/service/iam/user_ssh_key.go
index e7d048e61fd..0ba97c3f985 100644
--- a/internal/service/iam/user_ssh_key.go
+++ b/internal/service/iam/user_ssh_key.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam
 
 import (
diff --git a/internal/service/iam/user_ssh_key_data_source.go b/internal/service/iam/user_ssh_key_data_source.go
index 833d9296d75..64e4ece8bc2 100644
--- a/internal/service/iam/user_ssh_key_data_source.go
+++ b/internal/service/iam/user_ssh_key_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam
 
 import (
diff --git a/internal/service/iam/user_ssh_key_data_source_test.go b/internal/service/iam/user_ssh_key_data_source_test.go
index bfac60fcc82..4085a383d96 100644
--- a/internal/service/iam/user_ssh_key_data_source_test.go
+++ b/internal/service/iam/user_ssh_key_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam_test
 
 import (
diff --git a/internal/service/iam/user_ssh_key_test.go b/internal/service/iam/user_ssh_key_test.go
index 5a31efb30eb..06787153c84 100644
--- a/internal/service/iam/user_ssh_key_test.go
+++ b/internal/service/iam/user_ssh_key_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam_test
 
 import (
diff --git a/internal/service/iam/user_test.go b/internal/service/iam/user_test.go
index f7376935225..0432be516ae 100644
--- a/internal/service/iam/user_test.go
+++ b/internal/service/iam/user_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam_test
 
 import (
@@ -410,6 +413,27 @@ func TestAccIAMUser_permissionsBoundary(t *testing.T) {
 					testAccCheckUserPermissionsBoundary(&user, permissionsBoundary1),
 				),
 			},
+			// Test drift detection
+			{
+				PreConfig: func() {
+					// delete the boundary manually
+					conn := acctest.Provider.Meta().(*conns.AWSClient).IAMConn(ctx)
+					input := &iam.DeleteUserPermissionsBoundaryInput{
+						UserName: user.UserName,
+					}
+					_, err := conn.DeleteUserPermissionsBoundaryWithContext(ctx, input)
+					if err != nil {
+						t.Fatalf("Failed to delete permission_boundary from user (%s): %s", aws.StringValue(user.UserName), err)
+					}
+				},
+				Config: testAccUserConfig_permissionsBoundary(rName, permissionsBoundary1),
+				// check the boundary was restored
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckUserExists(ctx, resourceName, &user),
+					resource.TestCheckResourceAttr(resourceName, "permissions_boundary", permissionsBoundary1),
+					testAccCheckUserPermissionsBoundary(&user, permissionsBoundary1),
+				),
+			},
 			// Test empty value
 			{
 				Config: testAccUserConfig_permissionsBoundary(rName, ""),
diff --git a/internal/service/iam/users_data_source.go b/internal/service/iam/users_data_source.go
index af83006ce74..4b29191fbed 100644
--- a/internal/service/iam/users_data_source.go
+++ b/internal/service/iam/users_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam
 
 import (
diff --git a/internal/service/iam/users_data_source_test.go b/internal/service/iam/users_data_source_test.go
index 85dbe7b12fa..a92d94aa936 100644
--- a/internal/service/iam/users_data_source_test.go
+++ b/internal/service/iam/users_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam_test
 
 import (
diff --git a/internal/service/iam/validate.go b/internal/service/iam/validate.go
index c34cebc7c93..a8fecc91487 100644
--- a/internal/service/iam/validate.go
+++ b/internal/service/iam/validate.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam
 
 import (
 	"fmt"
 	"net/url"
-	"regexp"
 	"strings"
 
+	"github.com/YakDriver/regexache"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
@@ -16,13 +19,13 @@ var validRolePolicyName = validResourceName(rolePolicyNameMaxLen)
 func validResourceName(max int) schema.SchemaValidateFunc {
 	return validation.All(
 		validation.StringLenBetween(1, max),
-		validation.StringMatch(regexp.MustCompile(`^[\w+=,.@-]*$`), "must match [\\w+=,.@-]"),
+		validation.StringMatch(regexache.MustCompile(`^[\w+=,.@-]*$`), "must match [\\w+=,.@-]"),
 	)
 }
 
 var validAccountAlias = validation.All(
 	validation.StringLenBetween(3, 63),
-	validation.StringMatch(regexp.MustCompile(`^[a-z0-9][a-z0-9-]+$`), "must start with an alphanumeric character and only contain lowercase alphanumeric characters and hyphens"),
+	validation.StringMatch(regexache.MustCompile(`^[0-9a-z][0-9a-z-]+$`), "must start with an alphanumeric character and only contain lowercase alphanumeric characters and hyphens"),
 	func(v interface{}, k string) (ws []string, es []error) {
 		val := v.(string)
 		if strings.Contains(val, "--") {
@@ -53,7 +56,7 @@ var validOpenIDURL = validation.All(
 
 var validRolePolicyRole = validation.All(
 	validation.StringLenBetween(1, 128),
-	validation.StringMatch(regexp.MustCompile(`[\w+=,.@-]+`), ""),
+	validation.StringMatch(regexache.MustCompile(`[\w+=,.@-]+`), ""),
 	func(v interface{}, k string) (ws []string, es []error) {
 		if _, errs := verify.ValidARN(v, k); len(errs) == 0 {
 			es = append(es, fmt.Errorf("%q must be the role's name not its ARN", k))
diff --git a/internal/service/iam/validate_test.go b/internal/service/iam/validate_test.go
index 8c7a9849c28..fd0638596ca 100644
--- a/internal/service/iam/validate_test.go
+++ b/internal/service/iam/validate_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam
 
 import (
diff --git a/internal/service/iam/virtual_mfa_device.go b/internal/service/iam/virtual_mfa_device.go
index 0080e68970f..71ba9e67244 100644
--- a/internal/service/iam/virtual_mfa_device.go
+++ b/internal/service/iam/virtual_mfa_device.go
@@ -1,11 +1,17 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam
 
 import (
 	"context"
+	"fmt"
 	"log"
-	"regexp"
+	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/aws/aws-sdk-go/service/iam"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
@@ -43,6 +49,10 @@ func ResourceVirtualMFADevice() *schema.Resource {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
+			"enable_date": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
 			"path": {
 				Type:         schema.TypeString,
 				Optional:     true,
@@ -56,12 +66,16 @@ func ResourceVirtualMFADevice() *schema.Resource {
 			},
 			names.AttrTags:    tftags.TagsSchema(),
 			names.AttrTagsAll: tftags.TagsSchemaComputed(),
+			"user_name": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
 			"virtual_mfa_device_name": {
 				Type:     schema.TypeString,
 				Required: true,
 				ForceNew: true,
 				ValidateFunc: validation.StringMatch(
-					regexp.MustCompile(`[\w+=,.@-]+`),
+					regexache.MustCompile(`[\w+=,.@-]+`),
 					"must consist of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-",
 				),
 			},
@@ -98,6 +112,7 @@ func resourceVirtualMFADeviceCreate(ctx context.Context, d *schema.ResourceData,
 	vMFA := output.VirtualMFADevice
 	d.SetId(aws.StringValue(vMFA.SerialNumber))
 
+	// Base32StringSeed and QRCodePNG must be read here, because they are not available via ListVirtualMFADevices
 	d.Set("base_32_string_seed", string(vMFA.Base32StringSeed))
 	d.Set("qr_code_png", string(vMFA.QRCodePNG))
 
@@ -136,6 +151,22 @@ func resourceVirtualMFADeviceRead(ctx context.Context, d *schema.ResourceData, m
 
 	d.Set("arn", vMFA.SerialNumber)
 
+	path, name, err := parseVirtualMFADeviceARN(aws.StringValue(vMFA.SerialNumber))
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "reading IAM Virtual MFA Device (%s): %s", d.Id(), err)
+	}
+
+	d.Set("path", path)
+	d.Set("virtual_mfa_device_name", name)
+
+	if v := vMFA.EnableDate; v != nil {
+		d.Set("enable_date", aws.TimeValue(v).Format(time.RFC3339))
+	}
+
+	if u := vMFA.User; u != nil {
+		d.Set("user_name", u.UserName)
+	}
+
 	// The call above returns empty tags.
 	output, err := conn.ListMFADeviceTagsWithContext(ctx, &iam.ListMFADeviceTagsInput{
 		SerialNumber: aws.String(d.Id()),
@@ -174,6 +205,19 @@ func resourceVirtualMFADeviceDelete(ctx context.Context, d *schema.ResourceData,
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).IAMConn(ctx)
 
+	if v := d.Get("user_name"); v != "" {
+		_, err := conn.DeactivateMFADeviceWithContext(ctx, &iam.DeactivateMFADeviceInput{
+			UserName:     aws.String(v.(string)),
+			SerialNumber: aws.String(d.Id()),
+		})
+		if tfawserr.ErrCodeEquals(err, iam.ErrCodeNoSuchEntityException) {
+			return diags
+		}
+		if err != nil {
+			return sdkdiag.AppendErrorf(diags, "deactivating IAM Virtual MFA Device (%s): %s", d.Id(), err)
+		}
+	}
+
 	log.Printf("[INFO] Deleting IAM Virtual MFA Device: %s", d.Id())
 	_, err := conn.DeleteVirtualMFADeviceWithContext(ctx, &iam.DeleteVirtualMFADeviceInput{
 		SerialNumber: aws.String(d.Id()),
@@ -219,3 +263,18 @@ func FindVirtualMFADeviceBySerialNumber(ctx context.Context, conn *iam.IAM, seri
 
 	return output, nil
 }
+
+func parseVirtualMFADeviceARN(s string) (path, name string, err error) {
+	arn, err := arn.Parse(s)
+	if err != nil {
+		return "", "", err
+	}
+
+	re := regexache.MustCompile(`^mfa(/|/[\x{0021}-\x{007E}]+/)([0-9A-Za-z_+=,.@-]+)$`)
+	matches := re.FindStringSubmatch(arn.Resource)
+	if len(matches) != 3 {
+		return "", "", fmt.Errorf("IAM Virtual MFA Device ARN: invalid resource section (%s)", arn.Resource)
+	}
+
+	return matches[1], matches[2], nil
+}
diff --git a/internal/service/iam/virtual_mfa_device_test.go b/internal/service/iam/virtual_mfa_device_test.go
index c6daf98f852..ec6f4f20892 100644
--- a/internal/service/iam/virtual_mfa_device_test.go
+++ b/internal/service/iam/virtual_mfa_device_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam_test
 
 import (
@@ -31,18 +34,60 @@ func TestAccIAMVirtualMFADevice_basic(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config: testAccVirtualMFADeviceConfig_basic(rName),
-				Check: resource.ComposeTestCheckFunc(
+				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckVirtualMFADeviceExists(ctx, resourceName, &conf),
 					acctest.CheckResourceAttrGlobalARN(resourceName, "arn", "iam", fmt.Sprintf("mfa/%s", rName)),
 					resource.TestCheckResourceAttrSet(resourceName, "base_32_string_seed"),
+					resource.TestCheckNoResourceAttr(resourceName, "enable_date"),
+					resource.TestCheckResourceAttr(resourceName, "path", "/"),
 					resource.TestCheckResourceAttrSet(resourceName, "qr_code_png"),
+					resource.TestCheckNoResourceAttr(resourceName, "user_name"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{
+					"base_32_string_seed",
+					"qr_code_png",
+				},
+			},
+		},
+	})
+}
+
+func TestAccIAMVirtualMFADevice_path(t *testing.T) {
+	ctx := acctest.Context(t)
+	var conf iam.VirtualMFADevice
+	resourceName := "aws_iam_virtual_mfa_device.test"
+
+	path := "/path/"
+
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, iam.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckVirtualMFADeviceDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccVirtualMFADeviceConfig_path(rName, path),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckVirtualMFADeviceExists(ctx, resourceName, &conf),
+					acctest.CheckResourceAttrGlobalARN(resourceName, "arn", "iam", fmt.Sprintf("mfa%s%s", path, rName)),
+					resource.TestCheckResourceAttr(resourceName, "path", path),
 				),
 			},
 			{
-				ResourceName:            resourceName,
-				ImportState:             true,
-				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"path", "virtual_mfa_device_name", "base_32_string_seed", "qr_code_png"},
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{
+					"base_32_string_seed",
+					"qr_code_png",
+				},
 			},
 		},
 	})
@@ -63,21 +108,24 @@ func TestAccIAMVirtualMFADevice_tags(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config: testAccVirtualMFADeviceConfig_tags1(rName, "key1", "value1"),
-				Check: resource.ComposeTestCheckFunc(
+				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckVirtualMFADeviceExists(ctx, resourceName, &conf),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
 				),
 			},
 			{
-				ResourceName:            resourceName,
-				ImportState:             true,
-				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"path", "virtual_mfa_device_name", "base_32_string_seed", "qr_code_png"},
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{
+					"base_32_string_seed",
+					"qr_code_png",
+				},
 			},
 			{
 				Config: testAccVirtualMFADeviceConfig_tags2(rName, "key1", "value1updated", "key2", "value2"),
-				Check: resource.ComposeTestCheckFunc(
+				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckVirtualMFADeviceExists(ctx, resourceName, &conf),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1updated"),
@@ -86,7 +134,7 @@ func TestAccIAMVirtualMFADevice_tags(t *testing.T) {
 			},
 			{
 				Config: testAccVirtualMFADeviceConfig_tags1(rName, "key2", "value2"),
-				Check: resource.ComposeTestCheckFunc(
+				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckVirtualMFADeviceExists(ctx, resourceName, &conf),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
@@ -111,10 +159,9 @@ func TestAccIAMVirtualMFADevice_disappears(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config: testAccVirtualMFADeviceConfig_basic(rName),
-				Check: resource.ComposeTestCheckFunc(
+				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckVirtualMFADeviceExists(ctx, resourceName, &conf),
 					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfiam.ResourceVirtualMFADevice(), resourceName),
-					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfiam.ResourceVirtualMFADevice(), resourceName),
 				),
 				ExpectNonEmptyPlan: true,
 			},
@@ -179,6 +226,16 @@ resource "aws_iam_virtual_mfa_device" "test" {
 `, rName)
 }
 
+func testAccVirtualMFADeviceConfig_path(rName, path string) string {
+	return fmt.Sprintf(`
+resource "aws_iam_virtual_mfa_device" "test" {
+  virtual_mfa_device_name = %[1]q
+
+  path = %[2]q
+}
+`, rName, path)
+}
+
 func testAccVirtualMFADeviceConfig_tags1(rName, tagKey1, tagValue1 string) string {
 	return fmt.Sprintf(`
 resource "aws_iam_virtual_mfa_device" "test" {
diff --git a/internal/service/iam/wait.go b/internal/service/iam/wait.go
index 51f8acf6abc..3d1c542aa27 100644
--- a/internal/service/iam/wait.go
+++ b/internal/service/iam/wait.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iam
 
 import (
diff --git a/internal/service/identitystore/flex.go b/internal/service/identitystore/flex.go
index de99b6b63b8..02c662856a4 100644
--- a/internal/service/identitystore/flex.go
+++ b/internal/service/identitystore/flex.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package identitystore
 
 import (
diff --git a/internal/service/identitystore/generate.go b/internal/service/identitystore/generate.go
index 9f9e538248c..1ab0b7b333e 100644
--- a/internal/service/identitystore/generate.go
+++ b/internal/service/identitystore/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
 
diff --git a/internal/service/identitystore/group.go b/internal/service/identitystore/group.go
index 4d9be192baf..8051dc53804 100644
--- a/internal/service/identitystore/group.go
+++ b/internal/service/identitystore/group.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package identitystore
 
 import (
@@ -97,7 +100,6 @@ func resourceGroupCreate(ctx context.Context, d *schema.ResourceData, meta inter
 	}
 
 	out, err := conn.CreateGroup(ctx, input)
-
 	if err != nil {
 		return create.DiagError(names.IdentityStore, create.ErrActionCreating, ResNameGroup, d.Get("identity_store_id").(string), err)
 	}
@@ -115,7 +117,6 @@ func resourceGroupRead(ctx context.Context, d *schema.ResourceData, meta interfa
 	conn := meta.(*conns.AWSClient).IdentityStoreClient(ctx)
 
 	identityStoreId, groupId, err := resourceGroupParseID(d.Id())
-
 	if err != nil {
 		return create.DiagError(names.IdentityStore, create.ErrActionReading, ResNameGroup, d.Id(), err)
 	}
@@ -132,14 +133,13 @@ func resourceGroupRead(ctx context.Context, d *schema.ResourceData, meta interfa
 		return create.DiagError(names.IdentityStore, create.ErrActionReading, ResNameGroup, d.Id(), err)
 	}
 
-	d.Set("group_id", out.GroupId)
-	d.Set("identity_store_id", out.IdentityStoreId)
 	d.Set("description", out.Description)
 	d.Set("display_name", out.DisplayName)
-
 	if err := d.Set("external_ids", flattenExternalIds(out.ExternalIds)); err != nil {
 		return create.DiagError(names.IdentityStore, create.ErrActionSetting, ResNameGroup, d.Id(), err)
 	}
+	d.Set("group_id", out.GroupId)
+	d.Set("identity_store_id", out.IdentityStoreId)
 
 	return nil
 }
@@ -153,6 +153,13 @@ func resourceGroupUpdate(ctx context.Context, d *schema.ResourceData, meta inter
 		Operations:      nil,
 	}
 
+	if d.HasChange("description") {
+		in.Operations = append(in.Operations, types.AttributeOperation{
+			AttributePath:  aws.String("description"),
+			AttributeValue: document.NewLazyDocument(d.Get("description").(string)),
+		})
+	}
+
 	if d.HasChange("display_name") {
 		in.Operations = append(in.Operations, types.AttributeOperation{
 			AttributePath:  aws.String("displayName"),
@@ -160,12 +167,10 @@ func resourceGroupUpdate(ctx context.Context, d *schema.ResourceData, meta inter
 		})
 	}
 
-	if len(in.Operations) > 0 {
-		log.Printf("[DEBUG] Updating IdentityStore Group (%s): %#v", d.Id(), in)
-		_, err := conn.UpdateGroup(ctx, in)
-		if err != nil {
-			return create.DiagError(names.IdentityStore, create.ErrActionUpdating, ResNameGroup, d.Id(), err)
-		}
+	_, err := conn.UpdateGroup(ctx, in)
+
+	if err != nil {
+		return create.DiagError(names.IdentityStore, create.ErrActionUpdating, ResNameGroup, d.Id(), err)
 	}
 
 	return resourceGroupRead(ctx, d, meta)
diff --git a/internal/service/identitystore/group_data_source.go b/internal/service/identitystore/group_data_source.go
index 2c2ff4260d1..8dd1852e2a8 100644
--- a/internal/service/identitystore/group_data_source.go
+++ b/internal/service/identitystore/group_data_source.go
@@ -1,11 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package identitystore
 
 import (
 	"context"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/identitystore"
+	"github.com/aws/aws-sdk-go-v2/service/identitystore/types"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
@@ -65,7 +69,7 @@ func DataSourceGroup() *schema.Resource {
 						},
 					},
 				},
-				ExactlyOneOf: []string{"alternate_identifier", "group_id"},
+				ConflictsWith: []string{"filter", "group_id"},
 			},
 			"description": {
 				Type:     schema.TypeString,
@@ -91,22 +95,43 @@ func DataSourceGroup() *schema.Resource {
 					},
 				},
 			},
+			"filter": {
+				Deprecated:    "Use the alternate_identifier attribute instead.",
+				Type:          schema.TypeList,
+				Optional:      true,
+				MaxItems:      1,
+				AtLeastOneOf:  []string{"alternate_identifier", "filter", "group_id"},
+				ConflictsWith: []string{"alternate_identifier"},
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"attribute_path": {
+							Type:     schema.TypeString,
+							Required: true,
+						},
+						"attribute_value": {
+							Type:     schema.TypeString,
+							Required: true,
+						},
+					},
+				},
+			},
 			"group_id": {
 				Type:     schema.TypeString,
 				Optional: true,
 				Computed: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 47),
-					validation.StringMatch(regexp.MustCompile(`^([0-9a-f]{10}-|)[A-Fa-f0-9]{8}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{12}$`), "must match ([0-9a-f]{10}-|)[A-Fa-f0-9]{8}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{12}"),
+					validation.StringMatch(regexache.MustCompile(`^([0-9a-f]{10}-|)[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}$`), "must match ([0-9a-f]{10}-|)[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}"),
 				),
-				ExactlyOneOf: []string{"alternate_identifier", "group_id"},
+				AtLeastOneOf:  []string{"alternate_identifier", "filter", "group_id"},
+				ConflictsWith: []string{"alternate_identifier"},
 			},
 			"identity_store_id": {
 				Type:     schema.TypeString,
 				Required: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 64),
-					validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9-]*$`), "must match [a-zA-Z0-9-]"),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z-]*$`), "must match [0-9A-Za-z-]"),
 				),
 			},
 		},
@@ -122,6 +147,53 @@ func dataSourceGroupRead(ctx context.Context, d *schema.ResourceData, meta inter
 
 	identityStoreID := d.Get("identity_store_id").(string)
 
+	if v, ok := d.GetOk("filter"); ok && len(v.([]interface{})) > 0 {
+		// Use ListGroups for backwards compat.
+		input := &identitystore.ListGroupsInput{
+			IdentityStoreId: aws.String(identityStoreID),
+			Filters:         expandFilters(d.Get("filter").([]interface{})),
+		}
+		paginator := identitystore.NewListGroupsPaginator(conn, input)
+		var results []types.Group
+
+		for paginator.HasMorePages() {
+			page, err := paginator.NextPage(ctx)
+
+			if err != nil {
+				return create.DiagError(names.IdentityStore, create.ErrActionReading, DSNameGroup, identityStoreID, err)
+			}
+
+			for _, group := range page.Groups {
+				if v, ok := d.GetOk("group_id"); ok && v.(string) != aws.ToString(group.GroupId) {
+					continue
+				}
+
+				results = append(results, group)
+			}
+		}
+
+		if len(results) == 0 {
+			return diag.Errorf("no Identity Store Group found matching criteria\n%v; try different search", input.Filters)
+		}
+
+		if len(results) > 1 {
+			return diag.Errorf("multiple Identity Store Groups found matching criteria\n%v; try different search", input.Filters)
+		}
+
+		group := results[0]
+
+		d.SetId(aws.ToString(group.GroupId))
+		d.Set("description", group.Description)
+		d.Set("display_name", group.DisplayName)
+		d.Set("group_id", group.GroupId)
+
+		if err := d.Set("external_ids", flattenExternalIds(group.ExternalIds)); err != nil {
+			return create.DiagError(names.IdentityStore, create.ErrActionSetting, DSNameGroup, d.Id(), err)
+		}
+
+		return nil
+	}
+
 	var groupID string
 
 	if v, ok := d.GetOk("alternate_identifier"); ok && len(v.([]interface{})) > 0 {
@@ -170,3 +242,31 @@ func dataSourceGroupRead(ctx context.Context, d *schema.ResourceData, meta inter
 
 	return nil
 }
+
+func expandFilters(l []interface{}) []types.Filter {
+	if len(l) == 0 || l[0] == nil {
+		return nil
+	}
+
+	filters := make([]types.Filter, 0, len(l))
+	for _, v := range l {
+		tfMap, ok := v.(map[string]interface{})
+		if !ok {
+			continue
+		}
+
+		filter := types.Filter{}
+
+		if v, ok := tfMap["attribute_path"].(string); ok && v != "" {
+			filter.AttributePath = aws.String(v)
+		}
+
+		if v, ok := tfMap["attribute_value"].(string); ok && v != "" {
+			filter.AttributeValue = aws.String(v)
+		}
+
+		filters = append(filters, filter)
+	}
+
+	return filters
+}
diff --git a/internal/service/identitystore/group_data_source_test.go b/internal/service/identitystore/group_data_source_test.go
index d49361329f3..e18a683f52f 100644
--- a/internal/service/identitystore/group_data_source_test.go
+++ b/internal/service/identitystore/group_data_source_test.go
@@ -1,9 +1,11 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package identitystore_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
 	"github.com/aws/aws-sdk-go/service/identitystore"
@@ -14,7 +16,7 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 )
 
-func TestAccIdentityStoreGroupDataSource_uniqueAttributeDisplayName(t *testing.T) {
+func TestAccIdentityStoreGroupDataSource_filterDisplayName(t *testing.T) {
 	ctx := acctest.Context(t)
 	resourceName := "aws_identitystore_group.test"
 	dataSourceName := "data.aws_identitystore_group.test"
@@ -30,7 +32,7 @@ func TestAccIdentityStoreGroupDataSource_uniqueAttributeDisplayName(t *testing.T
 		CheckDestroy:             testAccCheckGroupDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccGroupDataSourceConfig_uniqueAttributeDisplayName(name),
+				Config: testAccGroupDataSourceConfig_filterDisplayName(name),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttrPair(dataSourceName, "description", resourceName, "description"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "display_name", resourceName, "display_name"),
@@ -42,8 +44,12 @@ func TestAccIdentityStoreGroupDataSource_uniqueAttributeDisplayName(t *testing.T
 	})
 }
 
-func TestAccIdentityStoreGroupDataSource_externalIDConflictsWithUniqueAttribute(t *testing.T) {
+func TestAccIdentityStoreGroupDataSource_uniqueAttributeDisplayName(t *testing.T) {
 	ctx := acctest.Context(t)
+	resourceName := "aws_identitystore_group.test"
+	dataSourceName := "data.aws_identitystore_group.test"
+	name := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck: func() {
 			acctest.PreCheck(ctx, t)
@@ -54,15 +60,22 @@ func TestAccIdentityStoreGroupDataSource_externalIDConflictsWithUniqueAttribute(
 		CheckDestroy:             testAccCheckGroupDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config:      testAccGroupDataSourceConfig_externalIDConflictsWithUniqueAttribute,
-				ExpectError: regexp.MustCompile(`Invalid combination of arguments`),
+				Config: testAccGroupDataSourceConfig_uniqueAttributeDisplayName(name),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttrPair(dataSourceName, "description", resourceName, "description"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "display_name", resourceName, "display_name"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "group_id", resourceName, "group_id"),
+					resource.TestCheckResourceAttr(dataSourceName, "external_ids.#", "0"),
+				),
 			},
 		},
 	})
 }
 
-func TestAccIdentityStoreGroupDataSource_groupIDConflictsWithUniqueAttribute(t *testing.T) {
+func TestAccIdentityStoreGroupDataSource_filterDisplayNameAndGroupID(t *testing.T) {
 	ctx := acctest.Context(t)
+	resourceName := "aws_identitystore_group.test"
+	dataSourceName := "data.aws_identitystore_group.test"
 	name := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
@@ -75,32 +88,43 @@ func TestAccIdentityStoreGroupDataSource_groupIDConflictsWithUniqueAttribute(t *
 		CheckDestroy:             testAccCheckGroupDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config:      testAccGroupDataSourceConfig_groupIDConflictsWithUniqueAttribute(name),
-				ExpectError: regexp.MustCompile(`Invalid combination of arguments`),
+				Config: testAccGroupDataSourceConfig_filterDisplayNameAndGroupID(name),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttrPair(dataSourceName, "description", resourceName, "description"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "display_name", resourceName, "display_name"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "group_id", resourceName, "group_id"),
+					resource.TestCheckResourceAttr(dataSourceName, "external_ids.#", "0"),
+				),
 			},
 		},
 	})
 }
 
-func TestAccIdentityStoreGroupDataSource_groupIDConflictsWithExternalID(t *testing.T) {
-	ctx := acctest.Context(t)
-	name := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+func testAccPreCheckSSOAdminInstances(ctx context.Context, t *testing.T) {
+	conn := acctest.Provider.Meta().(*conns.AWSClient).SSOAdminConn(ctx)
 
-	resource.ParallelTest(t, resource.TestCase{
-		PreCheck: func() {
-			acctest.PreCheck(ctx, t)
-			testAccPreCheckSSOAdminInstances(ctx, t)
-		},
-		ErrorCheck:               acctest.ErrorCheck(t, identitystore.EndpointsID),
-		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckGroupDestroy(ctx),
-		Steps: []resource.TestStep{
-			{
-				Config:      testAccGroupDataSourceConfig_groupIDConflictsWithExternalID(name),
-				ExpectError: regexp.MustCompile(`Invalid combination of arguments`),
-			},
-		},
+	var instances []*ssoadmin.InstanceMetadata
+	err := conn.ListInstancesPagesWithContext(ctx, &ssoadmin.ListInstancesInput{}, func(page *ssoadmin.ListInstancesOutput, lastPage bool) bool {
+		if page == nil {
+			return !lastPage
+		}
+
+		instances = append(instances, page.Instances...)
+
+		return !lastPage
 	})
+
+	if acctest.PreCheckSkipError(err) {
+		t.Skipf("skipping acceptance testing: %s", err)
+	}
+
+	if len(instances) == 0 {
+		t.Skip("skipping acceptance testing: No SSO Instance found.")
+	}
+
+	if err != nil {
+		t.Fatalf("unexpected PreCheck error: %s", err)
+	}
 }
 
 func testAccGroupDataSourceConfig_base(name string) string {
@@ -115,51 +139,22 @@ resource "aws_identitystore_group" "test" {
 `, name)
 }
 
-func testAccGroupDataSourceConfig_uniqueAttributeDisplayName(name string) string {
-	return acctest.ConfigCompose(
-		testAccGroupDataSourceConfig_base(name),
-		`
+func testAccGroupDataSourceConfig_filterDisplayName(name string) string {
+	return acctest.ConfigCompose(testAccGroupDataSourceConfig_base(name), `
 data "aws_identitystore_group" "test" {
-  alternate_identifier {
-    unique_attribute {
-      attribute_path  = "DisplayName"
-      attribute_value = aws_identitystore_group.test.display_name
-    }
+  filter {
+    attribute_path  = "DisplayName"
+    attribute_value = aws_identitystore_group.test.display_name
   }
 
   identity_store_id = tolist(data.aws_ssoadmin_instances.test.identity_store_ids)[0]
 }
-`,
-	)
+`)
 }
 
-const testAccGroupDataSourceConfig_externalIDConflictsWithUniqueAttribute = `
-data "aws_ssoadmin_instances" "test" {}
-
-data "aws_identitystore_group" "test" {
-  identity_store_id = tolist(data.aws_ssoadmin_instances.test.identity_store_ids)[0]
-
-  alternate_identifier {
-    external_id {
-      id     = "test"
-      issuer = "test"
-    }
-
-    unique_attribute {
-      attribute_path  = "DisplayName"
-      attribute_value = "does-not-exist"
-    }
-  }
-}
-`
-
-func testAccGroupDataSourceConfig_groupIDConflictsWithUniqueAttribute(name string) string {
-	return acctest.ConfigCompose(
-		testAccGroupDataSourceConfig_base(name),
-		`
+func testAccGroupDataSourceConfig_uniqueAttributeDisplayName(name string) string {
+	return acctest.ConfigCompose(testAccGroupDataSourceConfig_base(name), `
 data "aws_identitystore_group" "test" {
-  identity_store_id = tolist(data.aws_ssoadmin_instances.test.identity_store_ids)[0]
-
   alternate_identifier {
     unique_attribute {
       attribute_path  = "DisplayName"
@@ -167,55 +162,21 @@ data "aws_identitystore_group" "test" {
     }
   }
 
-  group_id = aws_identitystore_group.test.group_id
+  identity_store_id = tolist(data.aws_ssoadmin_instances.test.identity_store_ids)[0]
 }
-`,
-	)
+`)
 }
 
-func testAccGroupDataSourceConfig_groupIDConflictsWithExternalID(name string) string {
-	return acctest.ConfigCompose(
-		testAccGroupDataSourceConfig_base(name),
-		`
+func testAccGroupDataSourceConfig_filterDisplayNameAndGroupID(name string) string {
+	return acctest.ConfigCompose(testAccGroupDataSourceConfig_base(name), `
 data "aws_identitystore_group" "test" {
-  identity_store_id = tolist(data.aws_ssoadmin_instances.test.identity_store_ids)[0]
-
-  alternate_identifier {
-    external_id {
-      id     = "test"
-      issuer = "test"
-    }
+  filter {
+    attribute_path  = "DisplayName"
+    attribute_value = aws_identitystore_group.test.display_name
   }
 
-  group_id = aws_identitystore_group.test.group_id
-}
-`,
-	)
+  group_id          = aws_identitystore_group.test.group_id
+  identity_store_id = tolist(data.aws_ssoadmin_instances.test.identity_store_ids)[0]
 }
-
-func testAccPreCheckSSOAdminInstances(ctx context.Context, t *testing.T) {
-	conn := acctest.Provider.Meta().(*conns.AWSClient).SSOAdminConn(ctx)
-
-	var instances []*ssoadmin.InstanceMetadata
-	err := conn.ListInstancesPagesWithContext(ctx, &ssoadmin.ListInstancesInput{}, func(page *ssoadmin.ListInstancesOutput, lastPage bool) bool {
-		if page == nil {
-			return !lastPage
-		}
-
-		instances = append(instances, page.Instances...)
-
-		return !lastPage
-	})
-
-	if acctest.PreCheckSkipError(err) {
-		t.Skipf("skipping acceptance testing: %s", err)
-	}
-
-	if len(instances) == 0 {
-		t.Skip("skipping acceptance testing: No SSO Instance found.")
-	}
-
-	if err != nil {
-		t.Fatalf("unexpected PreCheck error: %s", err)
-	}
+`)
 }
diff --git a/internal/service/identitystore/group_membership.go b/internal/service/identitystore/group_membership.go
index c0cb1f6f00f..b1e50dc2a43 100644
--- a/internal/service/identitystore/group_membership.go
+++ b/internal/service/identitystore/group_membership.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package identitystore
 
 import (
diff --git a/internal/service/identitystore/group_membership_test.go b/internal/service/identitystore/group_membership_test.go
index ee7940594b2..ccb7176e340 100644
--- a/internal/service/identitystore/group_membership_test.go
+++ b/internal/service/identitystore/group_membership_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package identitystore_test
 
 import (
diff --git a/internal/service/identitystore/group_test.go b/internal/service/identitystore/group_test.go
index b08cf7e2648..019928c38ed 100644
--- a/internal/service/identitystore/group_test.go
+++ b/internal/service/identitystore/group_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package identitystore_test
 
 import (
@@ -80,6 +83,42 @@ func TestAccIdentityStoreGroup_disappears(t *testing.T) {
 	})
 }
 
+func TestAccIdentityStoreGroup_descriptionChange(t *testing.T) {
+	ctx := acctest.Context(t)
+	var group identitystore.DescribeGroupOutput
+	description1 := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	description2 := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_identitystore_group.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, names.IdentityStoreEndpointID)
+			testAccPreCheckSSOAdminInstances(ctx, t)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, names.IdentityStoreEndpointID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckGroupDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccGroupConfig_description(description1),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckGroupExists(ctx, resourceName, &group),
+					resource.TestCheckResourceAttr(resourceName, "description", description1),
+				),
+			},
+			{
+				Config: testAccGroupConfig_description(description2),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckGroupExists(ctx, resourceName, &group),
+					resource.TestCheckResourceAttr(resourceName, "description", description2),
+				),
+			},
+		},
+	})
+}
+
 func testAccCheckGroupDestroy(ctx context.Context) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		conn := acctest.Provider.Meta().(*conns.AWSClient).IdentityStoreClient(ctx)
@@ -119,7 +158,6 @@ func testAccCheckGroupExists(ctx context.Context, n string, v *identitystore.Des
 		conn := acctest.Provider.Meta().(*conns.AWSClient).IdentityStoreClient(ctx)
 
 		output, err := tfidentitystore.FindGroupByTwoPartKey(ctx, conn, rs.Primary.Attributes["identity_store_id"], rs.Primary.Attributes["group_id"])
-
 		if err != nil {
 			return err
 		}
@@ -140,3 +178,14 @@ resource "aws_identitystore_group" "test" {
 }
 `, displayName)
 }
+
+func testAccGroupConfig_description(description string) string {
+	return fmt.Sprintf(`
+data "aws_ssoadmin_instances" "test" {}
+resource "aws_identitystore_group" "test" {
+  identity_store_id = tolist(data.aws_ssoadmin_instances.test.identity_store_ids)[0]
+  display_name      = "Test display name"
+  description       = %[1]q
+}
+`, description)
+}
diff --git a/internal/service/identitystore/service_package_gen.go b/internal/service/identitystore/service_package_gen.go
index 5dd6c292a4a..92f86011ba3 100644
--- a/internal/service/identitystore/service_package_gen.go
+++ b/internal/service/identitystore/service_package_gen.go
@@ -7,6 +7,7 @@ import (
 
 	aws_sdkv2 "github.com/aws/aws-sdk-go-v2/aws"
 	identitystore_sdkv2 "github.com/aws/aws-sdk-go-v2/service/identitystore"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -61,9 +62,11 @@ func (p *servicePackage) NewClient(ctx context.Context, config map[string]any) (
 
 	return identitystore_sdkv2.NewFromConfig(cfg, func(o *identitystore_sdkv2.Options) {
 		if endpoint := config["endpoint"].(string); endpoint != "" {
-			o.EndpointResolver = identitystore_sdkv2.EndpointResolverFromURL(endpoint)
+			o.BaseEndpoint = aws_sdkv2.String(endpoint)
 		}
 	}), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/identitystore/user.go b/internal/service/identitystore/user.go
index 583f015d49c..e0020cea9e5 100644
--- a/internal/service/identitystore/user.go
+++ b/internal/service/identitystore/user.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package identitystore
 
 import (
diff --git a/internal/service/identitystore/user_data_source.go b/internal/service/identitystore/user_data_source.go
index 61f8ba01272..6f998094cad 100644
--- a/internal/service/identitystore/user_data_source.go
+++ b/internal/service/identitystore/user_data_source.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package identitystore
 
 import (
 	"context"
 	"errors"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/identitystore"
 	"github.com/aws/aws-sdk-go-v2/service/identitystore/types"
@@ -107,7 +110,7 @@ func DataSourceUser() *schema.Resource {
 						},
 					},
 				},
-				ExactlyOneOf: []string{"alternate_identifier", "user_id"},
+				ConflictsWith: []string{"filter", "user_id"},
 			},
 			"display_name": {
 				Type:     schema.TypeString,
@@ -149,12 +152,32 @@ func DataSourceUser() *schema.Resource {
 					},
 				},
 			},
+			"filter": {
+				Deprecated:    "Use the alternate_identifier attribute instead.",
+				Type:          schema.TypeList,
+				Optional:      true,
+				MaxItems:      1,
+				AtLeastOneOf:  []string{"alternate_identifier", "filter", "user_id"},
+				ConflictsWith: []string{"alternate_identifier"},
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"attribute_path": {
+							Type:     schema.TypeString,
+							Required: true,
+						},
+						"attribute_value": {
+							Type:     schema.TypeString,
+							Required: true,
+						},
+					},
+				},
+			},
 			"identity_store_id": {
 				Type:     schema.TypeString,
 				Required: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 64),
-					validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9-]*$`), "must match [a-zA-Z0-9-]"),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z-]*$`), "must match [0-9A-Za-z-]"),
 				),
 			},
 			"locale": {
@@ -239,9 +262,10 @@ func DataSourceUser() *schema.Resource {
 				Computed: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 47),
-					validation.StringMatch(regexp.MustCompile(`^([0-9a-f]{10}-|)[A-Fa-f0-9]{8}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{12}$`), "must match ([0-9a-f]{10}-|)[A-Fa-f0-9]{8}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{12}"),
+					validation.StringMatch(regexache.MustCompile(`^([0-9a-f]{10}-|)[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}$`), "must match ([0-9a-f]{10}-|)[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}"),
 				),
-				ExactlyOneOf: []string{"alternate_identifier", "user_id"},
+				AtLeastOneOf:  []string{"alternate_identifier", "filter", "user_id"},
+				ConflictsWith: []string{"alternate_identifier"},
 			},
 			"user_name": {
 				Type:     schema.TypeString,
@@ -264,6 +288,77 @@ func dataSourceUserRead(ctx context.Context, d *schema.ResourceData, meta interf
 
 	identityStoreID := d.Get("identity_store_id").(string)
 
+	if v, ok := d.GetOk("filter"); ok && len(v.([]interface{})) > 0 {
+		// Use ListUsers for backwards compat.
+		input := &identitystore.ListUsersInput{
+			Filters:         expandFilters(d.Get("filter").([]interface{})),
+			IdentityStoreId: aws.String(identityStoreID),
+		}
+		paginator := identitystore.NewListUsersPaginator(conn, input)
+		var results []types.User
+
+		for paginator.HasMorePages() {
+			page, err := paginator.NextPage(ctx)
+
+			if err != nil {
+				return create.DiagError(names.IdentityStore, create.ErrActionReading, DSNameUser, identityStoreID, err)
+			}
+
+			for _, user := range page.Users {
+				if v, ok := d.GetOk("user_id"); ok && v.(string) != aws.ToString(user.UserId) {
+					continue
+				}
+
+				results = append(results, user)
+			}
+		}
+
+		if len(results) == 0 {
+			return diag.Errorf("no Identity Store User found matching criteria\n%v; try different search", input.Filters)
+		}
+
+		if len(results) > 1 {
+			return diag.Errorf("multiple Identity Store Users found matching criteria\n%v; try different search", input.Filters)
+		}
+
+		user := results[0]
+
+		d.SetId(aws.ToString(user.UserId))
+		d.Set("display_name", user.DisplayName)
+		d.Set("identity_store_id", user.IdentityStoreId)
+		d.Set("locale", user.Locale)
+		d.Set("nickname", user.NickName)
+		d.Set("preferred_language", user.PreferredLanguage)
+		d.Set("profile_url", user.ProfileUrl)
+		d.Set("timezone", user.Timezone)
+		d.Set("title", user.Title)
+		d.Set("user_id", user.UserId)
+		d.Set("user_name", user.UserName)
+		d.Set("user_type", user.UserType)
+
+		if err := d.Set("addresses", flattenAddresses(user.Addresses)); err != nil {
+			return create.DiagError(names.IdentityStore, create.ErrActionSetting, DSNameUser, d.Id(), err)
+		}
+
+		if err := d.Set("emails", flattenEmails(user.Emails)); err != nil {
+			return create.DiagError(names.IdentityStore, create.ErrActionSetting, DSNameUser, d.Id(), err)
+		}
+
+		if err := d.Set("external_ids", flattenExternalIds(user.ExternalIds)); err != nil {
+			return create.DiagError(names.IdentityStore, create.ErrActionSetting, DSNameUser, d.Id(), err)
+		}
+
+		if err := d.Set("name", []interface{}{flattenName(user.Name)}); err != nil {
+			return create.DiagError(names.IdentityStore, create.ErrActionSetting, DSNameUser, d.Id(), err)
+		}
+
+		if err := d.Set("phone_numbers", flattenPhoneNumbers(user.PhoneNumbers)); err != nil {
+			return create.DiagError(names.IdentityStore, create.ErrActionSetting, DSNameUser, d.Id(), err)
+		}
+
+		return nil
+	}
+
 	var userID string
 
 	if v, ok := d.GetOk("alternate_identifier"); ok && len(v.([]interface{})) > 0 {
diff --git a/internal/service/identitystore/user_data_source_test.go b/internal/service/identitystore/user_data_source_test.go
index 7e7e9de98eb..833f8acc3be 100644
--- a/internal/service/identitystore/user_data_source_test.go
+++ b/internal/service/identitystore/user_data_source_test.go
@@ -1,8 +1,10 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package identitystore_test
 
 import (
 	"fmt"
-	"regexp"
 	"testing"
 
 	"github.com/aws/aws-sdk-go/service/identitystore"
@@ -53,7 +55,7 @@ func TestAccIdentityStoreUserDataSource_basic(t *testing.T) {
 	})
 }
 
-func TestAccIdentityStoreUserDataSource_uniqueAttributeUserName(t *testing.T) {
+func TestAccIdentityStoreUserDataSource_filterUserName(t *testing.T) {
 	ctx := acctest.Context(t)
 	dataSourceName := "data.aws_identitystore_user.test"
 	resourceName := "aws_identitystore_user.test"
@@ -70,7 +72,7 @@ func TestAccIdentityStoreUserDataSource_uniqueAttributeUserName(t *testing.T) {
 		CheckDestroy:             testAccCheckUserDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccUserDataSourceConfig_uniqueAttributeUserName(name, email),
+				Config: testAccUserDataSourceConfig_filterUserName(name, email),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttrPair(dataSourceName, "user_id", resourceName, "user_id"),
 					resource.TestCheckResourceAttr(dataSourceName, "user_name", name),
@@ -80,7 +82,7 @@ func TestAccIdentityStoreUserDataSource_uniqueAttributeUserName(t *testing.T) {
 	})
 }
 
-func TestAccIdentityStoreUserDataSource_email(t *testing.T) {
+func TestAccIdentityStoreUserDataSource_uniqueAttributeUserName(t *testing.T) {
 	ctx := acctest.Context(t)
 	dataSourceName := "data.aws_identitystore_user.test"
 	resourceName := "aws_identitystore_user.test"
@@ -97,7 +99,7 @@ func TestAccIdentityStoreUserDataSource_email(t *testing.T) {
 		CheckDestroy:             testAccCheckUserDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccUserDataSourceConfig_email(name, email),
+				Config: testAccUserDataSourceConfig_uniqueAttributeUserName(name, email),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttrPair(dataSourceName, "user_id", resourceName, "user_id"),
 					resource.TestCheckResourceAttr(dataSourceName, "user_name", name),
@@ -107,52 +109,55 @@ func TestAccIdentityStoreUserDataSource_email(t *testing.T) {
 	})
 }
 
-func TestAccIdentityStoreUserDataSource_nonExistent(t *testing.T) {
+func TestAccIdentityStoreUserDataSource_email(t *testing.T) {
 	ctx := acctest.Context(t)
-	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheckSSOAdminInstances(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, identitystore.EndpointsID),
-		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckUserDestroy(ctx),
-		Steps: []resource.TestStep{
-			{
-				Config:      testAccUserDataSourceConfig_nonExistent,
-				ExpectError: regexp.MustCompile(`no Identity Store User found matching criteria`),
-			},
-		},
-	})
-}
+	dataSourceName := "data.aws_identitystore_user.test"
+	resourceName := "aws_identitystore_user.test"
+	name := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	email := acctest.RandomEmailAddress(acctest.RandomDomainName())
 
-func TestAccIdentityStoreUserDataSource_externalIDConflictsWithUniqueAttribute(t *testing.T) {
-	ctx := acctest.Context(t)
 	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheckSSOAdminInstances(ctx, t) },
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			testAccPreCheckSSOAdminInstances(ctx, t)
+		},
 		ErrorCheck:               acctest.ErrorCheck(t, identitystore.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckUserDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config:      testAccUserDataSourceConfig_externalIDConflictsWithUniqueAttribute,
-				ExpectError: regexp.MustCompile(`Invalid combination of arguments`),
+				Config: testAccUserDataSourceConfig_email(name, email),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttrPair(dataSourceName, "user_id", resourceName, "user_id"),
+					resource.TestCheckResourceAttr(dataSourceName, "user_name", name),
+				),
 			},
 		},
 	})
 }
 
-func TestAccIdentityStoreUserDataSource_userIDConflictsWithExternalID(t *testing.T) {
+func TestAccIdentityStoreUserDataSource_userID(t *testing.T) {
 	ctx := acctest.Context(t)
+	dataSourceName := "data.aws_identitystore_user.test"
+	resourceName := "aws_identitystore_user.test"
 	name := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	email := acctest.RandomEmailAddress(acctest.RandomDomainName())
 
 	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheckSSOAdminInstances(ctx, t) },
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			testAccPreCheckSSOAdminInstances(ctx, t)
+		},
 		ErrorCheck:               acctest.ErrorCheck(t, identitystore.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckUserDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config:      testAccUserDataSourceConfig_userIDConflictsWithUniqueAttribute(name, email),
-				ExpectError: regexp.MustCompile(`Invalid combination of arguments`),
+				Config: testAccUserDataSourceConfig_id(name, email),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttrPair(dataSourceName, "user_id", resourceName, "user_id"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "user_name", resourceName, "user_name"),
+				),
 			},
 		},
 	})
@@ -238,89 +243,57 @@ data "aws_identitystore_user" "test" {
 `, name, email)
 }
 
-func testAccUserDataSourceConfig_uniqueAttributeUserName(name, email string) string {
-	return acctest.ConfigCompose(
-		testAccUserDataSourceConfig_base(name, email),
-		`
+func testAccUserDataSourceConfig_filterUserName(name, email string) string {
+	return acctest.ConfigCompose(testAccUserDataSourceConfig_base(name, email), `
 data "aws_identitystore_user" "test" {
   identity_store_id = tolist(data.aws_ssoadmin_instances.test.identity_store_ids)[0]
 
-  alternate_identifier {
-    unique_attribute {
-      attribute_path  = "UserName"
-      attribute_value = aws_identitystore_user.test.user_name
-    }
+  filter {
+    attribute_path  = "UserName"
+    attribute_value = aws_identitystore_user.test.user_name
   }
 }
-`,
-	)
+`)
 }
 
-func testAccUserDataSourceConfig_email(name, email string) string {
-	return acctest.ConfigCompose(
-		testAccUserDataSourceConfig_base(name, email),
-		`
+func testAccUserDataSourceConfig_uniqueAttributeUserName(name, email string) string {
+	return acctest.ConfigCompose(testAccUserDataSourceConfig_base(name, email), `
 data "aws_identitystore_user" "test" {
   identity_store_id = tolist(data.aws_ssoadmin_instances.test.identity_store_ids)[0]
 
   alternate_identifier {
     unique_attribute {
-      attribute_path  = "Emails.Value"
-      attribute_value = aws_identitystore_user.test.emails[0].value
+      attribute_path  = "UserName"
+      attribute_value = aws_identitystore_user.test.user_name
     }
   }
 }
-`,
-	)
+`)
 }
 
-const testAccUserDataSourceConfig_nonExistent = `
-data "aws_ssoadmin_instances" "test" {}
-
+func testAccUserDataSourceConfig_email(name, email string) string {
+	return acctest.ConfigCompose(testAccUserDataSourceConfig_base(name, email), `
 data "aws_identitystore_user" "test" {
-  alternate_identifier {
-    unique_attribute {
-      attribute_path  = "UserName"
-      attribute_value = "does-not-exist"
-    }
-  }
-
   identity_store_id = tolist(data.aws_ssoadmin_instances.test.identity_store_ids)[0]
-}
-`
-
-const testAccUserDataSourceConfig_externalIDConflictsWithUniqueAttribute = `
-data "aws_ssoadmin_instances" "test" {}
 
-data "aws_identitystore_user" "test" {
   alternate_identifier {
-    external_id {
-      id     = "test"
-      issuer = "test"
-    }
-
     unique_attribute {
-      attribute_path  = "UserName"
-      attribute_value = "does-not-exist"
+      attribute_path  = "Emails.Value"
+      attribute_value = aws_identitystore_user.test.emails[0].value
     }
   }
-
-  identity_store_id = tolist(data.aws_ssoadmin_instances.test.identity_store_ids)[0]
 }
-`
+`)
+}
 
-func testAccUserDataSourceConfig_userIDConflictsWithUniqueAttribute(name, email string) string {
-	return acctest.ConfigCompose(
-		testAccUserDataSourceConfig_base(name, email),
-		`
+func testAccUserDataSourceConfig_id(name, email string) string {
+	return acctest.ConfigCompose(testAccUserDataSourceConfig_base(name, email), `
 data "aws_identitystore_user" "test" {
   identity_store_id = tolist(data.aws_ssoadmin_instances.test.identity_store_ids)[0]
 
-  alternate_identifier {
-    unique_attribute {
-      attribute_path  = "UserName"
-      attribute_value = aws_identitystore_user.test.user_name
-    }
+  filter {
+    attribute_path  = "UserName"
+    attribute_value = aws_identitystore_user.test.user_name
   }
 
   user_id = aws_identitystore_user.test.user_id
diff --git a/internal/service/identitystore/user_test.go b/internal/service/identitystore/user_test.go
index 80dc79c8598..6560b3933f5 100644
--- a/internal/service/identitystore/user_test.go
+++ b/internal/service/identitystore/user_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package identitystore_test
 
 import (
diff --git a/internal/service/imagebuilder/component.go b/internal/service/imagebuilder/component.go
index 9beeb1a12aa..1ca488a41cf 100644
--- a/internal/service/imagebuilder/component.go
+++ b/internal/service/imagebuilder/component.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package imagebuilder
 
 import (
diff --git a/internal/service/imagebuilder/component_data_source.go b/internal/service/imagebuilder/component_data_source.go
index 1a876bac533..4ecf3bfd050 100644
--- a/internal/service/imagebuilder/component_data_source.go
+++ b/internal/service/imagebuilder/component_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package imagebuilder
 
 import (
diff --git a/internal/service/imagebuilder/component_data_source_test.go b/internal/service/imagebuilder/component_data_source_test.go
index 41bb456d100..79f5f8696ef 100644
--- a/internal/service/imagebuilder/component_data_source_test.go
+++ b/internal/service/imagebuilder/component_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package imagebuilder_test
 
 import (
diff --git a/internal/service/imagebuilder/component_test.go b/internal/service/imagebuilder/component_test.go
index 3fec02eb901..40e67fd160d 100644
--- a/internal/service/imagebuilder/component_test.go
+++ b/internal/service/imagebuilder/component_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package imagebuilder_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/imagebuilder"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -32,9 +35,9 @@ func TestAccImageBuilderComponent_basic(t *testing.T) {
 				Config: testAccComponentConfig_name(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckComponentExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "imagebuilder", regexp.MustCompile(fmt.Sprintf("component/%s/1.0.0/[1-9][0-9]*", rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "imagebuilder", regexache.MustCompile(fmt.Sprintf("component/%s/1.0.0/[1-9][0-9]*", rName))),
 					resource.TestCheckResourceAttr(resourceName, "change_description", ""),
-					resource.TestMatchResourceAttr(resourceName, "data", regexp.MustCompile(`schemaVersion`)),
+					resource.TestMatchResourceAttr(resourceName, "data", regexache.MustCompile(`schemaVersion`)),
 					acctest.CheckResourceAttrRFC3339(resourceName, "date_created"),
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
 					resource.TestCheckResourceAttr(resourceName, "encrypted", "true"),
diff --git a/internal/service/imagebuilder/components_data_source.go b/internal/service/imagebuilder/components_data_source.go
index a61822e2068..576d9c02ae9 100644
--- a/internal/service/imagebuilder/components_data_source.go
+++ b/internal/service/imagebuilder/components_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package imagebuilder
 
 import (
diff --git a/internal/service/imagebuilder/components_data_source_test.go b/internal/service/imagebuilder/components_data_source_test.go
index 88fb013e37b..19777171587 100644
--- a/internal/service/imagebuilder/components_data_source_test.go
+++ b/internal/service/imagebuilder/components_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package imagebuilder_test
 
 import (
diff --git a/internal/service/imagebuilder/consts.go b/internal/service/imagebuilder/consts.go
index a67d3a883ed..1d85561bd79 100644
--- a/internal/service/imagebuilder/consts.go
+++ b/internal/service/imagebuilder/consts.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package imagebuilder
 
 import (
diff --git a/internal/service/imagebuilder/container_recipe.go b/internal/service/imagebuilder/container_recipe.go
index 3fbb13dd8f3..b459bf6b1ed 100644
--- a/internal/service/imagebuilder/container_recipe.go
+++ b/internal/service/imagebuilder/container_recipe.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package imagebuilder
 
 import (
 	"context"
 	"log"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/imagebuilder"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -14,8 +17,8 @@ import (
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
-	"github.com/hashicorp/terraform-provider-aws/internal/experimental/nullable"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
+	"github.com/hashicorp/terraform-provider-aws/internal/types/nullable"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -99,7 +102,7 @@ func ResourceContainerRecipe() *schema.Resource {
 				Optional:     true,
 				ForceNew:     true,
 				ExactlyOneOf: []string{"dockerfile_template_data", "dockerfile_template_uri"},
-				ValidateFunc: validation.StringMatch(regexp.MustCompile(`^s3://`), "must begin with s3://"),
+				ValidateFunc: validation.StringMatch(regexache.MustCompile(`^s3://`), "must begin with s3://"),
 			},
 			"encrypted": {
 				Type:     schema.TypeBool,
diff --git a/internal/service/imagebuilder/container_recipe_data_source.go b/internal/service/imagebuilder/container_recipe_data_source.go
index 4dc6c638f6d..1b57940251a 100644
--- a/internal/service/imagebuilder/container_recipe_data_source.go
+++ b/internal/service/imagebuilder/container_recipe_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package imagebuilder
 
 import (
diff --git a/internal/service/imagebuilder/container_recipe_data_source_test.go b/internal/service/imagebuilder/container_recipe_data_source_test.go
index 5c4398016d5..e514e2fb102 100644
--- a/internal/service/imagebuilder/container_recipe_data_source_test.go
+++ b/internal/service/imagebuilder/container_recipe_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package imagebuilder_test
 
 import (
diff --git a/internal/service/imagebuilder/container_recipe_test.go b/internal/service/imagebuilder/container_recipe_test.go
index 039321c115b..d16caaa8c38 100644
--- a/internal/service/imagebuilder/container_recipe_test.go
+++ b/internal/service/imagebuilder/container_recipe_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package imagebuilder_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/imagebuilder"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -32,7 +35,7 @@ func TestAccImageBuilderContainerRecipe_basic(t *testing.T) {
 				Config: testAccContainerRecipeConfig_name(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckContainerRecipeExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "imagebuilder", regexp.MustCompile(fmt.Sprintf("container-recipe/%s/1.0.0", rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "imagebuilder", regexache.MustCompile(fmt.Sprintf("container-recipe/%s/1.0.0", rName))),
 					resource.TestCheckResourceAttr(resourceName, "component.#", "1"),
 					acctest.CheckResourceAttrRegionalARNAccountID(resourceName, "component.0.component_arn", "imagebuilder", "aws", "component/update-linux/x.x.x"),
 					resource.TestCheckResourceAttr(resourceName, "component.0.parameter.#", "0"),
diff --git a/internal/service/imagebuilder/container_recipes_data_source.go b/internal/service/imagebuilder/container_recipes_data_source.go
index a4dd2849121..4714349763e 100644
--- a/internal/service/imagebuilder/container_recipes_data_source.go
+++ b/internal/service/imagebuilder/container_recipes_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package imagebuilder
 
 import (
diff --git a/internal/service/imagebuilder/container_recipes_data_source_test.go b/internal/service/imagebuilder/container_recipes_data_source_test.go
index bee526a3e7d..cf3a1e8d3f6 100644
--- a/internal/service/imagebuilder/container_recipes_data_source_test.go
+++ b/internal/service/imagebuilder/container_recipes_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package imagebuilder_test
 
 import (
diff --git a/internal/service/imagebuilder/distribution_configuration.go b/internal/service/imagebuilder/distribution_configuration.go
index 7c3aabeb889..58d1014af05 100644
--- a/internal/service/imagebuilder/distribution_configuration.go
+++ b/internal/service/imagebuilder/distribution_configuration.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package imagebuilder
 
 import (
 	"context"
 	"log"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/imagebuilder"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -118,7 +121,7 @@ func ResourceDistributionConfiguration() *schema.Resource {
 										Optional: true,
 										ValidateFunc: validation.All(
 											validation.StringLenBetween(0, 127),
-											validation.StringMatch(regexp.MustCompile(`^[-_A-Za-z0-9{][-_A-Za-z0-9\s:{}]+[-_A-Za-z0-9}]$`), "must contain only alphanumeric characters, underscores, and hyphens"),
+											validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_{-][0-9A-Za-z_\s:{}-]+[0-9A-Za-z_}-]$`), "must contain only alphanumeric characters, underscores, and hyphens"),
 										),
 									},
 									"target_account_ids": {
diff --git a/internal/service/imagebuilder/distribution_configuration_data_source.go b/internal/service/imagebuilder/distribution_configuration_data_source.go
index 734248efacb..75a2f1f3b28 100644
--- a/internal/service/imagebuilder/distribution_configuration_data_source.go
+++ b/internal/service/imagebuilder/distribution_configuration_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package imagebuilder
 
 import (
diff --git a/internal/service/imagebuilder/distribution_configuration_data_source_test.go b/internal/service/imagebuilder/distribution_configuration_data_source_test.go
index c021d831d47..f1236c9956b 100644
--- a/internal/service/imagebuilder/distribution_configuration_data_source_test.go
+++ b/internal/service/imagebuilder/distribution_configuration_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package imagebuilder_test
 
 import (
@@ -99,7 +102,7 @@ resource "aws_imagebuilder_distribution_configuration" "test" {
         launch_template_version = "1"
       }
 
-      max_parallel_launches = 1
+      max_parallel_launches = 6
 
       snapshot_configuration {
         target_resource_count = 1
diff --git a/internal/service/imagebuilder/distribution_configuration_test.go b/internal/service/imagebuilder/distribution_configuration_test.go
index 8c83b73f18c..c8631ad758a 100644
--- a/internal/service/imagebuilder/distribution_configuration_test.go
+++ b/internal/service/imagebuilder/distribution_configuration_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package imagebuilder_test
 
 import (
@@ -23,6 +26,7 @@ func init() {
 func testAccErrorCheckSkip(t *testing.T) resource.ErrorCheckFunc {
 	return acctest.ErrorCheckSkipMessagesContaining(t,
 		"You have reached the maximum allowed number of license configurations created in one day",
+		"Amazon Inspector is not enabled",
 	)
 }
 
@@ -700,12 +704,12 @@ func TestAccImageBuilderDistributionConfiguration_DistributionFastLaunchConfigur
 		CheckDestroy:             testAccCheckDistributionConfigurationDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccDistributionConfigurationConfig_fastLaunchMaxParallelLaunches(rName, 5),
+				Config: testAccDistributionConfigurationConfig_fastLaunchMaxParallelLaunches(rName, 7),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDistributionConfigurationExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "distribution.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "distribution.0.fast_launch_configuration.#", "1"),
-					resource.TestCheckResourceAttr(resourceName, "distribution.0.fast_launch_configuration.0.max_parallel_launches", "5"),
+					resource.TestCheckResourceAttr(resourceName, "distribution.0.fast_launch_configuration.0.max_parallel_launches", "7"),
 				),
 			},
 			{
diff --git a/internal/service/imagebuilder/distribution_configurations_data_source.go b/internal/service/imagebuilder/distribution_configurations_data_source.go
index 61a2737e465..297b019d0d8 100644
--- a/internal/service/imagebuilder/distribution_configurations_data_source.go
+++ b/internal/service/imagebuilder/distribution_configurations_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package imagebuilder
 
 import (
diff --git a/internal/service/imagebuilder/distribution_configurations_data_source_test.go b/internal/service/imagebuilder/distribution_configurations_data_source_test.go
index d9656261cd0..a0ce4262c63 100644
--- a/internal/service/imagebuilder/distribution_configurations_data_source_test.go
+++ b/internal/service/imagebuilder/distribution_configurations_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package imagebuilder_test
 
 import (
diff --git a/internal/service/imagebuilder/generate.go b/internal/service/imagebuilder/generate.go
index b3bf2de0bf7..2dcc8a60a9c 100644
--- a/internal/service/imagebuilder/generate.go
+++ b/internal/service/imagebuilder/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTags -ServiceTagsMap -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/imagebuilder/id.go b/internal/service/imagebuilder/id.go
index 385aff8d0d3..7941a7dd559 100644
--- a/internal/service/imagebuilder/id.go
+++ b/internal/service/imagebuilder/id.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package imagebuilder
 
 const (
diff --git a/internal/service/imagebuilder/image.go b/internal/service/imagebuilder/image.go
index f63bcebe28b..51a3d98b7e6 100644
--- a/internal/service/imagebuilder/image.go
+++ b/internal/service/imagebuilder/image.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package imagebuilder
 
 import (
 	"context"
 	"log"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/imagebuilder"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -28,9 +31,11 @@ func ResourceImage() *schema.Resource {
 		ReadWithoutTimeout:   resourceImageRead,
 		UpdateWithoutTimeout: resourceImageUpdate,
 		DeleteWithoutTimeout: resourceImageDelete,
+
 		Importer: &schema.ResourceImporter{
 			StateContext: schema.ImportStatePassthroughContext,
 		},
+
 		Timeouts: &schema.ResourceTimeout{
 			Create: schema.DefaultTimeout(60 * time.Minute),
 		},
@@ -40,22 +45,22 @@ func ResourceImage() *schema.Resource {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
-			"date_created": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
 			"container_recipe_arn": {
 				Type:         schema.TypeString,
 				Optional:     true,
 				ForceNew:     true,
-				ValidateFunc: validation.StringMatch(regexp.MustCompile(`^arn:aws[^:]*:imagebuilder:[^:]+:(?:\d{12}|aws):container-recipe/[a-z0-9-_]+/\d+\.\d+\.\d+$`), "valid container recipe ARN must be provided"),
+				ValidateFunc: validation.StringMatch(regexache.MustCompile(`^arn:aws[^:]*:imagebuilder:[^:]+:(?:\d{12}|aws):container-recipe/[0-9a-z_-]+/\d+\.\d+\.\d+$`), "valid container recipe ARN must be provided"),
 				ExactlyOneOf: []string{"container_recipe_arn", "image_recipe_arn"},
 			},
+			"date_created": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
 			"distribution_configuration_arn": {
 				Type:         schema.TypeString,
 				Optional:     true,
 				ForceNew:     true,
-				ValidateFunc: validation.StringMatch(regexp.MustCompile(`^arn:aws[^:]*:imagebuilder:[^:]+:(?:\d{12}|aws):distribution-configuration/[a-z0-9-_]+$`), "valid distribution configuration ARN must be provided"),
+				ValidateFunc: validation.StringMatch(regexache.MustCompile(`^arn:aws[^:]*:imagebuilder:[^:]+:(?:\d{12}|aws):distribution-configuration/[0-9a-z_-]+$`), "valid distribution configuration ARN must be provided"),
 			},
 			"enhanced_image_metadata_enabled": {
 				Type:     schema.TypeBool,
@@ -67,9 +72,45 @@ func ResourceImage() *schema.Resource {
 				Type:         schema.TypeString,
 				Optional:     true,
 				ForceNew:     true,
-				ValidateFunc: validation.StringMatch(regexp.MustCompile(`^arn:aws[^:]*:imagebuilder:[^:]+:(?:\d{12}|aws):image-recipe/[a-z0-9-_]+/\d+\.\d+\.\d+$`), "valid image recipe ARN must be provided"),
+				ValidateFunc: validation.StringMatch(regexache.MustCompile(`^arn:aws[^:]*:imagebuilder:[^:]+:(?:\d{12}|aws):image-recipe/[0-9a-z_-]+/\d+\.\d+\.\d+$`), "valid image recipe ARN must be provided"),
 				ExactlyOneOf: []string{"container_recipe_arn", "image_recipe_arn"},
 			},
+			"image_scanning_configuration": {
+				Type:     schema.TypeList,
+				MaxItems: 1,
+				Optional: true,
+				Computed: true,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"ecr_configuration": {
+							Type:     schema.TypeList,
+							MaxItems: 1,
+							Optional: true,
+							Computed: true,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"container_tags": {
+										Type:     schema.TypeSet,
+										Optional: true,
+										Elem: &schema.Schema{
+											Type: schema.TypeString,
+										},
+									},
+									"repository_name": {
+										Type:     schema.TypeString,
+										Optional: true,
+									},
+								},
+							},
+						},
+						"image_scanning_enabled": {
+							Type:     schema.TypeBool,
+							Optional: true,
+							Default:  false,
+						},
+					},
+				},
+			},
 			"image_tests_configuration": {
 				Type:     schema.TypeList,
 				Optional: true,
@@ -98,7 +139,7 @@ func ResourceImage() *schema.Resource {
 				Type:         schema.TypeString,
 				Required:     true,
 				ForceNew:     true,
-				ValidateFunc: validation.StringMatch(regexp.MustCompile(`^arn:aws[^:]*:imagebuilder:[^:]+:(?:\d{12}|aws):infrastructure-configuration/[a-z0-9-_]+$`), "valid infrastructure configuration ARN must be provided"),
+				ValidateFunc: validation.StringMatch(regexache.MustCompile(`^arn:aws[^:]*:imagebuilder:[^:]+:(?:\d{12}|aws):infrastructure-configuration/[0-9a-z_-]+$`), "valid infrastructure configuration ARN must be provided"),
 			},
 			"name": {
 				Type:     schema.TypeString,
@@ -199,6 +240,10 @@ func resourceImageCreate(ctx context.Context, d *schema.ResourceData, meta inter
 		input.ImageRecipeArn = aws.String(v.(string))
 	}
 
+	if v, ok := d.GetOk("image_scanning_configuration"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
+		input.ImageScanningConfiguration = expandImageScanningConfiguration(v.([]interface{})[0].(map[string]interface{}))
+	}
+
 	if v, ok := d.GetOk("image_tests_configuration"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
 		input.ImageTestsConfiguration = expandImageTestConfiguration(v.([]interface{})[0].(map[string]interface{}))
 	}
@@ -269,6 +314,12 @@ func resourceImageRead(ctx context.Context, d *schema.ResourceData, meta interfa
 		d.Set("image_recipe_arn", image.ImageRecipe.Arn)
 	}
 
+	if image.ImageScanningConfiguration != nil {
+		d.Set("image_scanning_configuration", []interface{}{flattenImageScanningConfiguration(image.ImageScanningConfiguration)})
+	} else {
+		d.Set("image_scanning_configuration", nil)
+	}
+
 	if image.ImageTestsConfiguration != nil {
 		d.Set("image_tests_configuration", []interface{}{flattenImageTestsConfiguration(image.ImageTestsConfiguration)})
 	} else {
diff --git a/internal/service/imagebuilder/image_data_source.go b/internal/service/imagebuilder/image_data_source.go
index 1b8538ec216..c9118fe1471 100644
--- a/internal/service/imagebuilder/image_data_source.go
+++ b/internal/service/imagebuilder/image_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package imagebuilder
 
 import (
@@ -48,6 +51,37 @@ func DataSourceImage() *schema.Resource {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
+			"image_scanning_configuration": {
+				Type:     schema.TypeList,
+				Computed: true,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"ecr_configuration": {
+							Type:     schema.TypeList,
+							Computed: true,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"container_tags": {
+										Type:     schema.TypeSet,
+										Computed: true,
+										Elem: &schema.Schema{
+											Type: schema.TypeString,
+										},
+									},
+									"repository_name": {
+										Type:     schema.TypeString,
+										Computed: true,
+									},
+								},
+							},
+						},
+						"image_scanning_enabled": {
+							Type:     schema.TypeBool,
+							Computed: true,
+						},
+					},
+				},
+			},
 			"image_tests_configuration": {
 				Type:     schema.TypeList,
 				Computed: true,
@@ -190,6 +224,12 @@ func dataSourceImageRead(ctx context.Context, d *schema.ResourceData, meta inter
 		d.Set("image_recipe_arn", image.ImageRecipe.Arn)
 	}
 
+	if image.ImageScanningConfiguration != nil {
+		d.Set("image_scanning_configuration", []interface{}{flattenImageScanningConfiguration(image.ImageScanningConfiguration)})
+	} else {
+		d.Set("image_scanning_configuration", nil)
+	}
+
 	if image.ImageTestsConfiguration != nil {
 		d.Set("image_tests_configuration", []interface{}{flattenImageTestsConfiguration(image.ImageTestsConfiguration)})
 	} else {
diff --git a/internal/service/imagebuilder/image_data_source_test.go b/internal/service/imagebuilder/image_data_source_test.go
index 9ec894e444f..bc2aa227058 100644
--- a/internal/service/imagebuilder/image_data_source_test.go
+++ b/internal/service/imagebuilder/image_data_source_test.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package imagebuilder_test
 
 import (
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/imagebuilder"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -24,12 +27,13 @@ func TestAccImageBuilderImageDataSource_ARN_aws(t *testing.T) { // nosemgrep:ci.
 			{
 				Config: testAccImageDataSourceConfig_arn(),
 				Check: resource.ComposeTestCheckFunc(
-					acctest.MatchResourceAttrRegionalARNAccountID(dataSourceName, "arn", "imagebuilder", "aws", regexp.MustCompile(`image/amazon-linux-2-x86/x.x.x`)),
-					acctest.MatchResourceAttrRegionalARNAccountID(dataSourceName, "build_version_arn", "imagebuilder", "aws", regexp.MustCompile(`image/amazon-linux-2-x86/\d+\.\d+\.\d+/\d+`)),
+					acctest.MatchResourceAttrRegionalARNAccountID(dataSourceName, "arn", "imagebuilder", "aws", regexache.MustCompile(`image/amazon-linux-2-x86/x.x.x`)),
+					acctest.MatchResourceAttrRegionalARNAccountID(dataSourceName, "build_version_arn", "imagebuilder", "aws", regexache.MustCompile(`image/amazon-linux-2-x86/\d+\.\d+\.\d+/\d+`)),
 					acctest.CheckResourceAttrRFC3339(dataSourceName, "date_created"),
 					resource.TestCheckNoResourceAttr(dataSourceName, "distribution_configuration_arn"),
 					resource.TestCheckResourceAttr(dataSourceName, "enhanced_image_metadata_enabled", "false"),
 					resource.TestCheckNoResourceAttr(dataSourceName, "image_recipe_arn"),
+					resource.TestCheckResourceAttr(dataSourceName, "image_scanning_configuration.#", "0"),
 					resource.TestCheckResourceAttr(dataSourceName, "image_tests_configuration.#", "0"),
 					resource.TestCheckNoResourceAttr(dataSourceName, "infrastructure_configuration_arn"),
 					resource.TestCheckResourceAttr(dataSourceName, "name", "Amazon Linux 2 x86"),
@@ -37,7 +41,7 @@ func TestAccImageBuilderImageDataSource_ARN_aws(t *testing.T) { // nosemgrep:ci.
 					resource.TestCheckResourceAttr(dataSourceName, "output_resources.#", "1"),
 					resource.TestCheckResourceAttr(dataSourceName, "platform", imagebuilder.PlatformLinux),
 					resource.TestCheckResourceAttr(dataSourceName, "tags.%", "0"),
-					resource.TestMatchResourceAttr(dataSourceName, "version", regexp.MustCompile(`\d+\.\d+\.\d+/\d+`)),
+					resource.TestMatchResourceAttr(dataSourceName, "version", regexache.MustCompile(`\d+\.\d+\.\d+/\d+`)),
 				),
 			},
 		},
@@ -66,6 +70,7 @@ func TestAccImageBuilderImageDataSource_ARN_self(t *testing.T) {
 					resource.TestCheckResourceAttrPair(dataSourceName, "distribution_configuration_arn", resourceName, "distribution_configuration_arn"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "enhanced_image_metadata_enabled", resourceName, "enhanced_image_metadata_enabled"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "image_recipe_arn", resourceName, "image_recipe_arn"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "image_scanning_configuration.#", resourceName, "image_scanning_configuration.#"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "image_tests_configuration.#", resourceName, "image_tests_configuration.#"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "infrastructure_configuration_arn", resourceName, "infrastructure_configuration_arn"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "name", resourceName, "name"),
@@ -97,6 +102,7 @@ func TestAccImageBuilderImageDataSource_ARN_containerRecipe(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttrPair(dataSourceName, "arn", resourceName, "arn"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "container_recipe_arn", resourceName, "container_recipe_arn"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "image_scanning_configuration.#", resourceName, "image_scanning_configuration.#"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "output_resources.#", resourceName, "output_resources.#"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "output_resources.0.containers.#", resourceName, "output_resources.0.containers.#"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "output_resources.0.containers.0.image_uris.#", resourceName, "output_resources.0.containers.0.image_uris.#"),
@@ -359,6 +365,15 @@ resource "aws_imagebuilder_infrastructure_configuration" "test" {
 resource "aws_imagebuilder_image" "test" {
   container_recipe_arn             = aws_imagebuilder_container_recipe.test.arn
   infrastructure_configuration_arn = aws_imagebuilder_infrastructure_configuration.test.arn
+
+  image_scanning_configuration {
+    image_scanning_enabled = true
+
+    ecr_configuration {
+      repository_name = aws_ecr_repository.test.name
+      container_tags  = ["foo", "bar"]
+    }
+  }
 }
 
 data "aws_imagebuilder_image" "test" {
diff --git a/internal/service/imagebuilder/image_pipeline.go b/internal/service/imagebuilder/image_pipeline.go
index ddb0eca42e7..ca1084d66e3 100644
--- a/internal/service/imagebuilder/image_pipeline.go
+++ b/internal/service/imagebuilder/image_pipeline.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package imagebuilder
 
 import (
 	"context"
 	"log"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/imagebuilder"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -14,6 +17,7 @@ import (
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
+	"github.com/hashicorp/terraform-provider-aws/internal/flex"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -40,7 +44,7 @@ func ResourceImagePipeline() *schema.Resource {
 				Type:         schema.TypeString,
 				Optional:     true,
 				ForceNew:     true,
-				ValidateFunc: validation.StringMatch(regexp.MustCompile(`^arn:aws[^:]*:imagebuilder:[^:]+:(?:\d{12}|aws):container-recipe/[a-z0-9-_]+/\d+\.\d+\.\d+$`), "valid container recipe ARN must be provided"),
+				ValidateFunc: validation.StringMatch(regexache.MustCompile(`^arn:aws[^:]*:imagebuilder:[^:]+:(?:\d{12}|aws):container-recipe/[0-9a-z_-]+/\d+\.\d+\.\d+$`), "valid container recipe ARN must be provided"),
 				ExactlyOneOf: []string{"container_recipe_arn", "image_recipe_arn"},
 			},
 			"date_created": {
@@ -67,7 +71,7 @@ func ResourceImagePipeline() *schema.Resource {
 			"distribution_configuration_arn": {
 				Type:         schema.TypeString,
 				Optional:     true,
-				ValidateFunc: validation.StringMatch(regexp.MustCompile(`^arn:aws[^:]*:imagebuilder:[^:]+:(?:\d{12}|aws):distribution-configuration/[a-z0-9-_]+$`), "valid distribution configuration ARN must be provided"),
+				ValidateFunc: validation.StringMatch(regexache.MustCompile(`^arn:aws[^:]*:imagebuilder:[^:]+:(?:\d{12}|aws):distribution-configuration/[0-9a-z_-]+$`), "valid distribution configuration ARN must be provided"),
 			},
 			"enhanced_image_metadata_enabled": {
 				Type:     schema.TypeBool,
@@ -78,9 +82,45 @@ func ResourceImagePipeline() *schema.Resource {
 				Type:         schema.TypeString,
 				Optional:     true,
 				ForceNew:     true,
-				ValidateFunc: validation.StringMatch(regexp.MustCompile(`^arn:aws[^:]*:imagebuilder:[^:]+:(?:\d{12}|aws):image-recipe/[a-z0-9-_]+/\d+\.\d+\.\d+$`), "valid image recipe ARN must be provided"),
+				ValidateFunc: validation.StringMatch(regexache.MustCompile(`^arn:aws[^:]*:imagebuilder:[^:]+:(?:\d{12}|aws):image-recipe/[0-9a-z_-]+/\d+\.\d+\.\d+$`), "valid image recipe ARN must be provided"),
 				ExactlyOneOf: []string{"container_recipe_arn", "image_recipe_arn"},
 			},
+			"image_scanning_configuration": {
+				Type:     schema.TypeList,
+				Optional: true,
+				Computed: true,
+				MaxItems: 1,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"ecr_configuration": {
+							Type:     schema.TypeList,
+							Optional: true,
+							Computed: true,
+							MaxItems: 1,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"container_tags": {
+										Type:     schema.TypeSet,
+										Optional: true,
+										Elem: &schema.Schema{
+											Type: schema.TypeString,
+										},
+									},
+									"repository_name": {
+										Type:     schema.TypeString,
+										Optional: true,
+									},
+								},
+							},
+						},
+						"image_scanning_enabled": {
+							Type:     schema.TypeBool,
+							Optional: true,
+							Default:  false,
+						},
+					},
+				},
+			},
 			"image_tests_configuration": {
 				Type:     schema.TypeList,
 				Optional: true,
@@ -105,13 +145,13 @@ func ResourceImagePipeline() *schema.Resource {
 			"infrastructure_configuration_arn": {
 				Type:         schema.TypeString,
 				Required:     true,
-				ValidateFunc: validation.StringMatch(regexp.MustCompile(`^arn:aws[^:]*:imagebuilder:[^:]+:(?:\d{12}|aws):infrastructure-configuration/[a-z0-9-_]+$`), "valid infrastructure configuration ARN must be provided"),
+				ValidateFunc: validation.StringMatch(regexache.MustCompile(`^arn:aws[^:]*:imagebuilder:[^:]+:(?:\d{12}|aws):infrastructure-configuration/[0-9a-z_-]+$`), "valid infrastructure configuration ARN must be provided"),
 			},
 			"name": {
 				Type:         schema.TypeString,
 				Required:     true,
 				ForceNew:     true,
-				ValidateFunc: validation.StringMatch(regexp.MustCompile("^[-_A-Za-z-0-9][-_A-Za-z0-9 ]{1,126}[-_A-Za-z-0-9]$"), "valid name must be provided"),
+				ValidateFunc: validation.StringMatch(regexache.MustCompile("^[0-9A-Za-z_-][0-9A-Za-z_ -]{1,126}[0-9A-Za-z_-]$"), "valid name must be provided"),
 			},
 			"platform": {
 				Type:     schema.TypeString,
@@ -140,7 +180,7 @@ func ResourceImagePipeline() *schema.Resource {
 							Computed: true,
 							ValidateFunc: validation.All(
 								validation.StringLenBetween(3, 100),
-								validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9]{2,}(?:\/[a-zA-z0-9-_+]+)*`), "")),
+								validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z]{2,}(?:\/[0-9a-zA-z_+-]+)*`), "")),
 						},
 					},
 				},
@@ -185,6 +225,10 @@ func resourceImagePipelineCreate(ctx context.Context, d *schema.ResourceData, me
 		input.ImageRecipeArn = aws.String(v.(string))
 	}
 
+	if v, ok := d.GetOk("image_scanning_configuration"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
+		input.ImageScanningConfiguration = expandImageScanningConfiguration(v.([]interface{})[0].(map[string]interface{}))
+	}
+
 	if v, ok := d.GetOk("image_tests_configuration"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
 		input.ImageTestsConfiguration = expandImageTestConfiguration(v.([]interface{})[0].(map[string]interface{}))
 	}
@@ -256,23 +300,24 @@ func resourceImagePipelineRead(ctx context.Context, d *schema.ResourceData, meta
 	d.Set("distribution_configuration_arn", imagePipeline.DistributionConfigurationArn)
 	d.Set("enhanced_image_metadata_enabled", imagePipeline.EnhancedImageMetadataEnabled)
 	d.Set("image_recipe_arn", imagePipeline.ImageRecipeArn)
-
+	if imagePipeline.ImageScanningConfiguration != nil {
+		d.Set("image_scanning_configuration", []interface{}{flattenImageScanningConfiguration(imagePipeline.ImageScanningConfiguration)})
+	} else {
+		d.Set("image_scanning_configuration", nil)
+	}
 	if imagePipeline.ImageTestsConfiguration != nil {
 		d.Set("image_tests_configuration", []interface{}{flattenImageTestsConfiguration(imagePipeline.ImageTestsConfiguration)})
 	} else {
 		d.Set("image_tests_configuration", nil)
 	}
-
 	d.Set("infrastructure_configuration_arn", imagePipeline.InfrastructureConfigurationArn)
 	d.Set("name", imagePipeline.Name)
 	d.Set("platform", imagePipeline.Platform)
-
 	if imagePipeline.Schedule != nil {
 		d.Set("schedule", []interface{}{flattenSchedule(imagePipeline.Schedule)})
 	} else {
 		d.Set("schedule", nil)
 	}
-
 	d.Set("status", imagePipeline.Status)
 
 	setTagsOut(ctx, imagePipeline.Tags)
@@ -288,6 +333,7 @@ func resourceImagePipelineUpdate(ctx context.Context, d *schema.ResourceData, me
 		"description",
 		"distribution_configuration_arn",
 		"enhanced_image_metadata_enabled",
+		"image_scanning_configuration",
 		"image_tests_configuration",
 		"infrastructure_configuration_arn",
 		"schedule",
@@ -315,6 +361,10 @@ func resourceImagePipelineUpdate(ctx context.Context, d *schema.ResourceData, me
 			input.ImageRecipeArn = aws.String(v.(string))
 		}
 
+		if v, ok := d.GetOk("image_scanning_configuration"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
+			input.ImageScanningConfiguration = expandImageScanningConfiguration(v.([]interface{})[0].(map[string]interface{}))
+		}
+
 		if v, ok := d.GetOk("image_tests_configuration"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
 			input.ImageTestsConfiguration = expandImageTestConfiguration(v.([]interface{})[0].(map[string]interface{}))
 		}
@@ -362,6 +412,42 @@ func resourceImagePipelineDelete(ctx context.Context, d *schema.ResourceData, me
 	return diags
 }
 
+func expandImageScanningConfiguration(tfMap map[string]interface{}) *imagebuilder.ImageScanningConfiguration {
+	if tfMap == nil {
+		return nil
+	}
+
+	apiObject := &imagebuilder.ImageScanningConfiguration{}
+
+	if v, ok := tfMap["image_scanning_enabled"].(bool); ok {
+		apiObject.ImageScanningEnabled = aws.Bool(v)
+	}
+
+	if v, ok := tfMap["ecr_configuration"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
+		apiObject.EcrConfiguration = expandECRConfiguration(v[0].(map[string]interface{}))
+	}
+
+	return apiObject
+}
+
+func expandECRConfiguration(tfMap map[string]interface{}) *imagebuilder.EcrConfiguration {
+	if tfMap == nil {
+		return nil
+	}
+
+	apiObject := &imagebuilder.EcrConfiguration{}
+
+	if v, ok := tfMap["container_tags"].(*schema.Set); ok {
+		apiObject.ContainerTags = flex.ExpandStringSet(v)
+	}
+
+	if v, ok := tfMap["repository_name"].(string); ok {
+		apiObject.RepositoryName = aws.String(v)
+	}
+
+	return apiObject
+}
+
 func expandImageTestConfiguration(tfMap map[string]interface{}) *imagebuilder.ImageTestsConfiguration {
 	if tfMap == nil {
 		return nil
@@ -402,6 +488,42 @@ func expandPipelineSchedule(tfMap map[string]interface{}) *imagebuilder.Schedule
 	return apiObject
 }
 
+func flattenImageScanningConfiguration(apiObject *imagebuilder.ImageScanningConfiguration) map[string]interface{} {
+	if apiObject == nil {
+		return nil
+	}
+
+	tfMap := map[string]interface{}{}
+
+	if v := apiObject.ImageScanningEnabled; v != nil {
+		tfMap["image_scanning_enabled"] = aws.BoolValue(v)
+	}
+
+	if v := apiObject.EcrConfiguration; v != nil {
+		tfMap["ecr_configuration"] = []interface{}{flattenECRConfiguration(v)}
+	}
+
+	return tfMap
+}
+
+func flattenECRConfiguration(apiObject *imagebuilder.EcrConfiguration) map[string]interface{} {
+	if apiObject == nil {
+		return nil
+	}
+
+	tfMap := map[string]interface{}{}
+
+	if v := apiObject.RepositoryName; v != nil {
+		tfMap["repository_name"] = aws.StringValue(v)
+	}
+
+	if v := apiObject.ContainerTags; v != nil {
+		tfMap["container_tags"] = aws.StringValueSlice(v)
+	}
+
+	return tfMap
+}
+
 func flattenImageTestsConfiguration(apiObject *imagebuilder.ImageTestsConfiguration) map[string]interface{} {
 	if apiObject == nil {
 		return nil
diff --git a/internal/service/imagebuilder/image_pipeline_data_source.go b/internal/service/imagebuilder/image_pipeline_data_source.go
index b37b2a4d8ea..04b380cd567 100644
--- a/internal/service/imagebuilder/image_pipeline_data_source.go
+++ b/internal/service/imagebuilder/image_pipeline_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package imagebuilder
 
 import (
@@ -60,6 +63,37 @@ func DataSourceImagePipeline() *schema.Resource {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
+			"image_scanning_configuration": {
+				Type:     schema.TypeList,
+				Computed: true,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"ecr_configuration": {
+							Type:     schema.TypeList,
+							Computed: true,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"container_tags": {
+										Type:     schema.TypeSet,
+										Computed: true,
+										Elem: &schema.Schema{
+											Type: schema.TypeString,
+										},
+									},
+									"repository_name": {
+										Type:     schema.TypeString,
+										Computed: true,
+									},
+								},
+							},
+						},
+						"image_scanning_enabled": {
+							Type:     schema.TypeBool,
+							Computed: true,
+						},
+					},
+				},
+			},
 			"image_tests_configuration": {
 				Type:     schema.TypeList,
 				Computed: true,
@@ -146,17 +180,19 @@ func dataSourceImagePipelineRead(ctx context.Context, d *schema.ResourceData, me
 	d.Set("distribution_configuration_arn", imagePipeline.DistributionConfigurationArn)
 	d.Set("enhanced_image_metadata_enabled", imagePipeline.EnhancedImageMetadataEnabled)
 	d.Set("image_recipe_arn", imagePipeline.ImageRecipeArn)
-
+	if imagePipeline.ImageScanningConfiguration != nil {
+		d.Set("image_scanning_configuration", []interface{}{flattenImageScanningConfiguration(imagePipeline.ImageScanningConfiguration)})
+	} else {
+		d.Set("image_scanning_configuration", nil)
+	}
 	if imagePipeline.ImageTestsConfiguration != nil {
 		d.Set("image_tests_configuration", []interface{}{flattenImageTestsConfiguration(imagePipeline.ImageTestsConfiguration)})
 	} else {
 		d.Set("image_tests_configuration", nil)
 	}
-
 	d.Set("infrastructure_configuration_arn", imagePipeline.InfrastructureConfigurationArn)
 	d.Set("name", imagePipeline.Name)
 	d.Set("platform", imagePipeline.Platform)
-
 	if imagePipeline.Schedule != nil {
 		d.Set("schedule", []interface{}{flattenSchedule(imagePipeline.Schedule)})
 	} else {
diff --git a/internal/service/imagebuilder/image_pipeline_data_source_test.go b/internal/service/imagebuilder/image_pipeline_data_source_test.go
index 203d4cbfe5c..c6370be518f 100644
--- a/internal/service/imagebuilder/image_pipeline_data_source_test.go
+++ b/internal/service/imagebuilder/image_pipeline_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package imagebuilder_test
 
 import (
@@ -24,7 +27,7 @@ func TestAccImageBuilderImagePipelineDataSource_arn(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config: testAccImagePipelineDataSourceConfig_arn(rName),
-				Check: resource.ComposeTestCheckFunc(
+				Check: resource.ComposeAggregateTestCheckFunc(
 					resource.TestCheckResourceAttrPair(dataSourceName, "arn", resourceName, "arn"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "container_recipe_arn", resourceName, "container_recipe_arn"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "date_created", resourceName, "date_created"),
@@ -35,6 +38,7 @@ func TestAccImageBuilderImagePipelineDataSource_arn(t *testing.T) {
 					resource.TestCheckResourceAttrPair(dataSourceName, "distribution_configuration_arn", resourceName, "distribution_configuration_arn"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "enhanced_image_metadata_enabled", resourceName, "enhanced_image_metadata_enabled"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "image_recipe_arn", resourceName, "image_recipe_arn"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "image_scanning_configuration.#", resourceName, "image_scanning_configuration.#"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "image_tests_configuration.#", resourceName, "image_tests_configuration.#"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "infrastructure_configuration_arn", resourceName, "infrastructure_configuration_arn"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "name", resourceName, "name"),
@@ -62,16 +66,17 @@ func TestAccImageBuilderImagePipelineDataSource_containerRecipeARN(t *testing.T)
 		Steps: []resource.TestStep{
 			{
 				Config: testAccImagePipelineDataSourceConfig_containerRecipeARN(rName),
-				Check: resource.ComposeTestCheckFunc(
+				Check: resource.ComposeAggregateTestCheckFunc(
 					resource.TestCheckResourceAttrPair(dataSourceName, "arn", resourceName, "arn"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "container_recipe_arn", resourceName, "container_recipe_arn"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "image_scanning_configuration.#", resourceName, "image_scanning_configuration.#"),
 				),
 			},
 		},
 	})
 }
 
-func testAccImagePipelineBaseDataSourceConfig(rName string) string {
+func testAccImagePipelineDataSourceConfig_base(rName string) string {
 	return fmt.Sprintf(`
 data "aws_region" "current" {}
 
@@ -125,9 +130,7 @@ resource "aws_imagebuilder_infrastructure_configuration" "test" {
 }
 
 func testAccImagePipelineDataSourceConfig_arn(rName string) string {
-	return acctest.ConfigCompose(
-		testAccImagePipelineBaseDataSourceConfig(rName),
-		fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccImagePipelineDataSourceConfig_base(rName), fmt.Sprintf(`
 resource "aws_imagebuilder_image_recipe" "test" {
   component {
     component_arn = aws_imagebuilder_component.test.arn
@@ -151,9 +154,7 @@ data "aws_imagebuilder_image_pipeline" "test" {
 }
 
 func testAccImagePipelineDataSourceConfig_containerRecipeARN(rName string) string {
-	return acctest.ConfigCompose(
-		testAccImagePipelineBaseDataSourceConfig(rName),
-		fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccImagePipelineDataSourceConfig_base(rName), fmt.Sprintf(`
 resource "aws_ecr_repository" "test" {
   name = %[1]q
 }
@@ -184,6 +185,15 @@ resource "aws_imagebuilder_image_pipeline" "test" {
   container_recipe_arn             = aws_imagebuilder_container_recipe.test.arn
   infrastructure_configuration_arn = aws_imagebuilder_infrastructure_configuration.test.arn
   name                             = %[1]q
+
+  image_scanning_configuration {
+    image_scanning_enabled = true
+
+    ecr_configuration {
+      container_tags  = ["a", "b"]
+      repository_name = aws_ecr_repository.test.name
+    }
+  }
 }
 
 data "aws_imagebuilder_image_pipeline" "test" {
diff --git a/internal/service/imagebuilder/image_pipeline_test.go b/internal/service/imagebuilder/image_pipeline_test.go
index 9cd863b3987..f2b955222ae 100644
--- a/internal/service/imagebuilder/image_pipeline_test.go
+++ b/internal/service/imagebuilder/image_pipeline_test.go
@@ -1,8 +1,12 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package imagebuilder_test
 
 import (
 	"context"
 	"fmt"
+	"strings"
 	"testing"
 
 	"github.com/aws/aws-sdk-go/aws"
@@ -31,7 +35,7 @@ func TestAccImageBuilderImagePipeline_basic(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config: testAccImagePipelineConfig_name(rName),
-				Check: resource.ComposeTestCheckFunc(
+				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckImagePipelineExists(ctx, resourceName),
 					acctest.CheckResourceAttrRegionalARN(resourceName, "arn", "imagebuilder", fmt.Sprintf("image-pipeline/%s", rName)),
 					acctest.CheckResourceAttrRFC3339(resourceName, "date_created"),
@@ -42,6 +46,7 @@ func TestAccImageBuilderImagePipeline_basic(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "distribution_configuration_arn", ""),
 					resource.TestCheckResourceAttr(resourceName, "enhanced_image_metadata_enabled", "true"),
 					resource.TestCheckResourceAttrPair(resourceName, "image_recipe_arn", imageRecipeResourceName, "arn"),
+					resource.TestCheckResourceAttr(resourceName, "image_scanning_configuration.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "image_tests_configuration.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "image_tests_configuration.0.image_tests_enabled", "true"),
 					resource.TestCheckResourceAttr(resourceName, "image_tests_configuration.0.timeout_minutes", "720"),
@@ -260,6 +265,84 @@ func TestAccImageBuilderImagePipeline_containerRecipeARN(t *testing.T) {
 	})
 }
 
+func TestAccImageBuilderImagePipeline_ImageScanning_imageScanningEnabled(t *testing.T) {
+	ctx := acctest.Context(t)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_imagebuilder_image_pipeline.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, imagebuilder.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckImagePipelineDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccImagePipelineConfig_testsConfigurationScanningEnabled(rName, false),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckImagePipelineExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "image_scanning_configuration.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "image_scanning_configuration.0.image_scanning_enabled", "false"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				Config: testAccImagePipelineConfig_testsConfigurationScanningEnabled(rName, true),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckImagePipelineExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "image_scanning_configuration.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "image_scanning_configuration.0.image_scanning_enabled", "true"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccImageBuilderImagePipeline_ImageScanning_imageScanningEnabledAdvanced(t *testing.T) {
+	ctx := acctest.Context(t)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_imagebuilder_image_pipeline.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, imagebuilder.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckImagePipelineDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccImagePipelineConfig_testsConfigurationScanningEnabledAdvanced(rName, []string{"a", "b"}),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckImagePipelineExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "image_scanning_configuration.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "image_scanning_configuration.0.image_scanning_enabled", "true"),
+					resource.TestCheckResourceAttr(resourceName, "image_scanning_configuration.0.ecr_configuration.0.repository_name", rName),
+					resource.TestCheckTypeSetElemAttr(resourceName, "image_scanning_configuration.0.ecr_configuration.0.container_tags.*", "b"),
+					resource.TestCheckTypeSetElemAttr(resourceName, "image_scanning_configuration.0.ecr_configuration.0.container_tags.*", "a"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				Config: testAccImagePipelineConfig_testsConfigurationScanningEnabledAdvanced(rName, []string{"a", "c"}),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckImagePipelineExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "image_scanning_configuration.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "image_scanning_configuration.0.image_scanning_enabled", "true"),
+					resource.TestCheckResourceAttr(resourceName, "image_scanning_configuration.0.ecr_configuration.0.repository_name", rName),
+					resource.TestCheckTypeSetElemAttr(resourceName, "image_scanning_configuration.0.ecr_configuration.0.container_tags.*", "c"),
+					resource.TestCheckTypeSetElemAttr(resourceName, "image_scanning_configuration.0.ecr_configuration.0.container_tags.*", "a"),
+				),
+			},
+		},
+	})
+}
+
 func TestAccImageBuilderImagePipeline_ImageTests_imageTestsEnabled(t *testing.T) {
 	ctx := acctest.Context(t)
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
@@ -388,9 +471,10 @@ func TestAccImageBuilderImagePipeline_Schedule_pipelineExecutionStartCondition(t
 				),
 			},
 			{
-				ResourceName:      resourceName,
-				ImportState:       true,
-				ImportStateVerify: true,
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"date_next_run"},
 			},
 			{
 				Config: testAccImagePipelineConfig_scheduleExecutionStartCondition(rName, imagebuilder.PipelineExecutionStartConditionExpressionMatchOnly),
@@ -424,9 +508,10 @@ func TestAccImageBuilderImagePipeline_Schedule_scheduleExpression(t *testing.T)
 				),
 			},
 			{
-				ResourceName:      resourceName,
-				ImportState:       true,
-				ImportStateVerify: true,
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"date_next_run"},
 			},
 			{
 				Config: testAccImagePipelineConfig_scheduleExpression(rName, "cron(2 0 * * ? *)"),
@@ -461,9 +546,10 @@ func TestAccImageBuilderImagePipeline_Schedule_timezone(t *testing.T) {
 				),
 			},
 			{
-				ResourceName:      resourceName,
-				ImportState:       true,
-				ImportStateVerify: true,
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"date_next_run"},
 			},
 			{
 				Config: testAccImagePipelineConfig_scheduleTimezone(rName, "cron(1 0 * * ? *)", "America/Los_Angeles"),
@@ -612,7 +698,7 @@ func testAccCheckImagePipelineExists(ctx context.Context, resourceName string) r
 	}
 }
 
-func testAccImagePipelineBaseConfig(rName string) string {
+func testAccImagePipelineConfig_base(rName string) string {
 	return fmt.Sprintf(`
 data "aws_region" "current" {}
 
@@ -668,6 +754,38 @@ resource "aws_imagebuilder_image_recipe" "test" {
   version      = "1.0.0"
 }
 
+resource "aws_ecr_repository" "test" {
+  name                 = %[1]q
+  image_tag_mutability = "MUTABLE"
+
+  image_scanning_configuration {
+    scan_on_push = false
+  }
+}
+
+resource "aws_imagebuilder_container_recipe" "test" {
+  component {
+    component_arn = aws_imagebuilder_component.test.arn
+  }
+
+  target_repository {
+    repository_name = aws_ecr_repository.test.name
+    service         = "ECR"
+  }
+
+  dockerfile_template_data = <<EOF
+  FROM {{{ imagebuilder:parentImage }}}
+  {{{ imagebuilder:environments }}}
+  {{{ imagebuilder:components }}}
+  EOF
+
+  container_type    = "DOCKER"
+  name              = %[1]q
+  parent_image      = "amazonlinux:latest"
+  working_directory = "/tmp"
+  version           = "1.0.0"
+}
+
 resource "aws_imagebuilder_infrastructure_configuration" "test" {
   instance_profile_name = aws_iam_instance_profile.test.name
   name                  = %[1]q
@@ -676,9 +794,7 @@ resource "aws_imagebuilder_infrastructure_configuration" "test" {
 }
 
 func testAccImagePipelineConfig_description(rName string, description string) string {
-	return acctest.ConfigCompose(
-		testAccImagePipelineBaseConfig(rName),
-		fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccImagePipelineConfig_base(rName), fmt.Sprintf(`
 resource "aws_imagebuilder_image_pipeline" "test" {
   description                      = %[2]q
   image_recipe_arn                 = aws_imagebuilder_image_recipe.test.arn
@@ -689,9 +805,7 @@ resource "aws_imagebuilder_image_pipeline" "test" {
 }
 
 func testAccImagePipelineConfig_distributionConfigurationARN1(rName string) string {
-	return acctest.ConfigCompose(
-		testAccImagePipelineBaseConfig(rName),
-		fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccImagePipelineConfig_base(rName), fmt.Sprintf(`
 resource "aws_imagebuilder_distribution_configuration" "test" {
   name = "%[1]s-1"
 
@@ -718,9 +832,7 @@ resource "aws_imagebuilder_image_pipeline" "test" {
 }
 
 func testAccImagePipelineConfig_distributionConfigurationARN2(rName string) string {
-	return acctest.ConfigCompose(
-		testAccImagePipelineBaseConfig(rName),
-		fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccImagePipelineConfig_base(rName), fmt.Sprintf(`
 resource "aws_imagebuilder_distribution_configuration" "test" {
   name = "%[1]s-2"
 
@@ -747,9 +859,7 @@ resource "aws_imagebuilder_image_pipeline" "test" {
 }
 
 func testAccImagePipelineConfig_enhancedMetadataEnabled(rName string, enhancedImageMetadataEnabled bool) string {
-	return acctest.ConfigCompose(
-		testAccImagePipelineBaseConfig(rName),
-		fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccImagePipelineConfig_base(rName), fmt.Sprintf(`
 resource "aws_imagebuilder_image_pipeline" "test" {
   enhanced_image_metadata_enabled  = %[2]t
   image_recipe_arn                 = aws_imagebuilder_image_recipe.test.arn
@@ -760,9 +870,7 @@ resource "aws_imagebuilder_image_pipeline" "test" {
 }
 
 func testAccImagePipelineConfig_recipeARN2(rName string) string {
-	return acctest.ConfigCompose(
-		testAccImagePipelineBaseConfig(rName),
-		fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccImagePipelineConfig_base(rName), fmt.Sprintf(`
 resource "aws_imagebuilder_image_recipe" "test2" {
   component {
     component_arn = aws_imagebuilder_component.test.arn
@@ -782,35 +890,7 @@ resource "aws_imagebuilder_image_pipeline" "test" {
 }
 
 func testAccImagePipelineConfig_containerRecipeARN1(rName string) string {
-	return acctest.ConfigCompose(
-		testAccImagePipelineBaseConfig(rName),
-		fmt.Sprintf(`
-resource "aws_ecr_repository" "test" {
-  name = %[1]q
-}
-
-resource "aws_imagebuilder_container_recipe" "test" {
-  component {
-    component_arn = aws_imagebuilder_component.test.arn
-  }
-
-  dockerfile_template_data = <<EOF
-FROM {{{ imagebuilder:parentImage }}}
-{{{ imagebuilder:environments }}}
-{{{ imagebuilder:components }}}
-EOF
-
-  name           = %[1]q
-  container_type = "DOCKER"
-  parent_image   = "arn:${data.aws_partition.current.partition}:imagebuilder:${data.aws_region.current.name}:aws:image/amazon-linux-x86-latest/x.x.x"
-  version        = "1.0.0"
-
-  target_repository {
-    repository_name = aws_ecr_repository.test.name
-    service         = "ECR"
-  }
-}
-
+	return acctest.ConfigCompose(testAccImagePipelineConfig_base(rName), fmt.Sprintf(`
 resource "aws_imagebuilder_image_pipeline" "test" {
   container_recipe_arn             = aws_imagebuilder_container_recipe.test.arn
   infrastructure_configuration_arn = aws_imagebuilder_infrastructure_configuration.test.arn
@@ -820,13 +900,7 @@ resource "aws_imagebuilder_image_pipeline" "test" {
 }
 
 func testAccImagePipelineConfig_containerRecipeARN2(rName string) string {
-	return acctest.ConfigCompose(
-		testAccImagePipelineBaseConfig(rName),
-		fmt.Sprintf(`
-resource "aws_ecr_repository" "test" {
-  name = %[1]q
-}
-
+	return acctest.ConfigCompose(testAccImagePipelineConfig_base(rName), fmt.Sprintf(`
 resource "aws_imagebuilder_container_recipe" "test2" {
   component {
     component_arn = aws_imagebuilder_component.test.arn
@@ -857,10 +931,46 @@ resource "aws_imagebuilder_image_pipeline" "test" {
 `, rName))
 }
 
+func testAccImagePipelineConfig_testsConfigurationScanningEnabled(rName string, imageScanningEnabled bool) string {
+	return acctest.ConfigCompose(testAccImagePipelineConfig_base(rName), fmt.Sprintf(`
+resource "aws_imagebuilder_image_pipeline" "test" {
+  image_recipe_arn                 = aws_imagebuilder_image_recipe.test.arn
+  infrastructure_configuration_arn = aws_imagebuilder_infrastructure_configuration.test.arn
+  name                             = %[1]q
+
+  image_scanning_configuration {
+    image_scanning_enabled = %[2]t
+  }
+}
+`, rName, imageScanningEnabled))
+}
+
+func testAccImagePipelineConfig_testsConfigurationScanningEnabledAdvanced(rName string, imageTags []string) string {
+	commaSepImageTags := ""
+	if len(imageTags) > 0 {
+		commaSepImageTags = "\"" + strings.Join(imageTags, "\", \"") + "\""
+	}
+
+	return acctest.ConfigCompose(testAccImagePipelineConfig_base(rName), fmt.Sprintf(`
+resource "aws_imagebuilder_image_pipeline" "test" {
+  container_recipe_arn             = aws_imagebuilder_container_recipe.test.arn
+  infrastructure_configuration_arn = aws_imagebuilder_infrastructure_configuration.test.arn
+  name                             = %[1]q
+
+  image_scanning_configuration {
+    image_scanning_enabled = true
+
+    ecr_configuration {
+      container_tags  = [%[2]s]
+      repository_name = aws_ecr_repository.test.name
+    }
+  }
+}
+`, rName, commaSepImageTags))
+}
+
 func testAccImagePipelineConfig_testsConfigurationTestsEnabled(rName string, imageTestsEnabled bool) string {
-	return acctest.ConfigCompose(
-		testAccImagePipelineBaseConfig(rName),
-		fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccImagePipelineConfig_base(rName), fmt.Sprintf(`
 resource "aws_imagebuilder_image_pipeline" "test" {
   image_recipe_arn                 = aws_imagebuilder_image_recipe.test.arn
   infrastructure_configuration_arn = aws_imagebuilder_infrastructure_configuration.test.arn
@@ -874,9 +984,7 @@ resource "aws_imagebuilder_image_pipeline" "test" {
 }
 
 func testAccImagePipelineConfig_testsConfigurationTimeoutMinutes(rName string, timeoutMinutes int) string {
-	return acctest.ConfigCompose(
-		testAccImagePipelineBaseConfig(rName),
-		fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccImagePipelineConfig_base(rName), fmt.Sprintf(`
 resource "aws_imagebuilder_image_pipeline" "test" {
   image_recipe_arn                 = aws_imagebuilder_image_recipe.test.arn
   infrastructure_configuration_arn = aws_imagebuilder_infrastructure_configuration.test.arn
@@ -890,9 +998,7 @@ resource "aws_imagebuilder_image_pipeline" "test" {
 }
 
 func testAccImagePipelineConfig_infrastructureConfigurationARN2(rName string) string {
-	return acctest.ConfigCompose(
-		testAccImagePipelineBaseConfig(rName),
-		fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccImagePipelineConfig_base(rName), fmt.Sprintf(`
 resource "aws_imagebuilder_infrastructure_configuration" "test2" {
   instance_profile_name = aws_iam_instance_profile.test.name
   name                  = "%[1]s-2"
@@ -907,9 +1013,7 @@ resource "aws_imagebuilder_image_pipeline" "test" {
 }
 
 func testAccImagePipelineConfig_name(rName string) string {
-	return acctest.ConfigCompose(
-		testAccImagePipelineBaseConfig(rName),
-		fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccImagePipelineConfig_base(rName), fmt.Sprintf(`
 resource "aws_imagebuilder_image_pipeline" "test" {
   image_recipe_arn                 = aws_imagebuilder_image_recipe.test.arn
   infrastructure_configuration_arn = aws_imagebuilder_infrastructure_configuration.test.arn
@@ -919,9 +1023,7 @@ resource "aws_imagebuilder_image_pipeline" "test" {
 }
 
 func testAccImagePipelineConfig_scheduleExecutionStartCondition(rName string, pipelineExecutionStartCondition string) string {
-	return acctest.ConfigCompose(
-		testAccImagePipelineBaseConfig(rName),
-		fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccImagePipelineConfig_base(rName), fmt.Sprintf(`
 resource "aws_imagebuilder_image_pipeline" "test" {
   image_recipe_arn                 = aws_imagebuilder_image_recipe.test.arn
   infrastructure_configuration_arn = aws_imagebuilder_infrastructure_configuration.test.arn
@@ -936,9 +1038,7 @@ resource "aws_imagebuilder_image_pipeline" "test" {
 }
 
 func testAccImagePipelineConfig_scheduleExpression(rName string, scheduleExpression string) string {
-	return acctest.ConfigCompose(
-		testAccImagePipelineBaseConfig(rName),
-		fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccImagePipelineConfig_base(rName), fmt.Sprintf(`
 resource "aws_imagebuilder_image_pipeline" "test" {
   image_recipe_arn                 = aws_imagebuilder_image_recipe.test.arn
   infrastructure_configuration_arn = aws_imagebuilder_infrastructure_configuration.test.arn
@@ -952,9 +1052,7 @@ resource "aws_imagebuilder_image_pipeline" "test" {
 }
 
 func testAccImagePipelineConfig_scheduleTimezone(rName string, scheduleExpression string, timezone string) string {
-	return acctest.ConfigCompose(
-		testAccImagePipelineBaseConfig(rName),
-		fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccImagePipelineConfig_base(rName), fmt.Sprintf(`
 resource "aws_imagebuilder_image_pipeline" "test" {
   image_recipe_arn                 = aws_imagebuilder_image_recipe.test.arn
   infrastructure_configuration_arn = aws_imagebuilder_infrastructure_configuration.test.arn
@@ -968,9 +1066,7 @@ resource "aws_imagebuilder_image_pipeline" "test" {
 `, rName, scheduleExpression, timezone))
 }
 func testAccImagePipelineConfig_status(rName string, status string) string {
-	return acctest.ConfigCompose(
-		testAccImagePipelineBaseConfig(rName),
-		fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccImagePipelineConfig_base(rName), fmt.Sprintf(`
 resource "aws_imagebuilder_image_pipeline" "test" {
   image_recipe_arn                 = aws_imagebuilder_image_recipe.test.arn
   infrastructure_configuration_arn = aws_imagebuilder_infrastructure_configuration.test.arn
@@ -981,9 +1077,7 @@ resource "aws_imagebuilder_image_pipeline" "test" {
 }
 
 func testAccImagePipelineConfig_tags1(rName string, tagKey1 string, tagValue1 string) string {
-	return acctest.ConfigCompose(
-		testAccImagePipelineBaseConfig(rName),
-		fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccImagePipelineConfig_base(rName), fmt.Sprintf(`
 resource "aws_imagebuilder_image_pipeline" "test" {
   image_recipe_arn                 = aws_imagebuilder_image_recipe.test.arn
   infrastructure_configuration_arn = aws_imagebuilder_infrastructure_configuration.test.arn
@@ -997,9 +1091,7 @@ resource "aws_imagebuilder_image_pipeline" "test" {
 }
 
 func testAccImagePipelineConfig_tags2(rName string, tagKey1 string, tagValue1 string, tagKey2 string, tagValue2 string) string {
-	return acctest.ConfigCompose(
-		testAccImagePipelineBaseConfig(rName),
-		fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccImagePipelineConfig_base(rName), fmt.Sprintf(`
 resource "aws_imagebuilder_image_pipeline" "test" {
   image_recipe_arn                 = aws_imagebuilder_image_recipe.test.arn
   infrastructure_configuration_arn = aws_imagebuilder_infrastructure_configuration.test.arn
diff --git a/internal/service/imagebuilder/image_pipelines_data_source.go b/internal/service/imagebuilder/image_pipelines_data_source.go
index f241a742ce1..e47d46ae286 100644
--- a/internal/service/imagebuilder/image_pipelines_data_source.go
+++ b/internal/service/imagebuilder/image_pipelines_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package imagebuilder
 
 import (
diff --git a/internal/service/imagebuilder/image_pipelines_data_source_test.go b/internal/service/imagebuilder/image_pipelines_data_source_test.go
index 1f59dc6b542..6459fc400b2 100644
--- a/internal/service/imagebuilder/image_pipelines_data_source_test.go
+++ b/internal/service/imagebuilder/image_pipelines_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package imagebuilder_test
 
 import (
diff --git a/internal/service/imagebuilder/image_recipe.go b/internal/service/imagebuilder/image_recipe.go
index 4c7dabb2a26..fce38e8a381 100644
--- a/internal/service/imagebuilder/image_recipe.go
+++ b/internal/service/imagebuilder/image_recipe.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package imagebuilder
 
 import (
@@ -15,8 +18,8 @@ import (
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
-	"github.com/hashicorp/terraform-provider-aws/internal/experimental/nullable"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
+	"github.com/hashicorp/terraform-provider-aws/internal/types/nullable"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
diff --git a/internal/service/imagebuilder/image_recipe_data_source.go b/internal/service/imagebuilder/image_recipe_data_source.go
index 7d2bdb101f3..4d9aaa3c2fa 100644
--- a/internal/service/imagebuilder/image_recipe_data_source.go
+++ b/internal/service/imagebuilder/image_recipe_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package imagebuilder
 
 import (
diff --git a/internal/service/imagebuilder/image_recipe_data_source_test.go b/internal/service/imagebuilder/image_recipe_data_source_test.go
index 5c855807a25..3447778b188 100644
--- a/internal/service/imagebuilder/image_recipe_data_source_test.go
+++ b/internal/service/imagebuilder/image_recipe_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package imagebuilder_test
 
 import (
diff --git a/internal/service/imagebuilder/image_recipe_test.go b/internal/service/imagebuilder/image_recipe_test.go
index b8cb012537a..a44575b7b31 100644
--- a/internal/service/imagebuilder/image_recipe_test.go
+++ b/internal/service/imagebuilder/image_recipe_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package imagebuilder_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/imagebuilder"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -33,7 +36,7 @@ func TestAccImageBuilderImageRecipe_basic(t *testing.T) {
 				Config: testAccImageRecipeConfig_name(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckImageRecipeExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "imagebuilder", regexp.MustCompile(fmt.Sprintf("image-recipe/%s/1.0.0", rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "imagebuilder", regexache.MustCompile(fmt.Sprintf("image-recipe/%s/1.0.0", rName))),
 					resource.TestCheckResourceAttr(resourceName, "block_device_mapping.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "component.#", "1"),
 					acctest.CheckResourceAttrRFC3339(resourceName, "date_created"),
diff --git a/internal/service/imagebuilder/image_recipes_data_source.go b/internal/service/imagebuilder/image_recipes_data_source.go
index f959f93f92e..a0b09730498 100644
--- a/internal/service/imagebuilder/image_recipes_data_source.go
+++ b/internal/service/imagebuilder/image_recipes_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package imagebuilder
 
 import (
diff --git a/internal/service/imagebuilder/image_recipes_data_source_test.go b/internal/service/imagebuilder/image_recipes_data_source_test.go
index 514977dd250..f3bcba379d3 100644
--- a/internal/service/imagebuilder/image_recipes_data_source_test.go
+++ b/internal/service/imagebuilder/image_recipes_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package imagebuilder_test
 
 import (
@@ -15,11 +18,8 @@ func TestAccImageBuilderImageRecipesDataSource_owner(t *testing.T) {
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	dataSourceNameOwnerAmazon := "data.aws_imagebuilder_image_recipes.amazon"
 	dataSourceNameOwnerSelf := "data.aws_imagebuilder_image_recipes.self"
-	resourceName := "aws_imagebuilder_image_recipe.test"
 
-	// Not a good test since it is susceptible to fail with parallel tests or if anything else
-	// ImageBuilder is going on in the account
-	resource.Test(t, resource.TestCase{
+	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
 		ErrorCheck:               acctest.ErrorCheck(t, imagebuilder.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
@@ -27,13 +27,11 @@ func TestAccImageBuilderImageRecipesDataSource_owner(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config: testAccImageRecipesDataSourceConfig_owner(rName),
-				Check: resource.ComposeTestCheckFunc(
+				Check: resource.ComposeAggregateTestCheckFunc(
 					resource.TestCheckResourceAttr(dataSourceNameOwnerAmazon, "arns.#", "0"),
 					resource.TestCheckResourceAttr(dataSourceNameOwnerAmazon, "names.#", "0"),
-					resource.TestCheckResourceAttr(dataSourceNameOwnerSelf, "arns.#", "1"),
-					resource.TestCheckResourceAttr(dataSourceNameOwnerSelf, "names.#", "1"),
-					resource.TestCheckResourceAttrPair(dataSourceNameOwnerSelf, "arns.0", resourceName, "arn"),
-					resource.TestCheckResourceAttrPair(dataSourceNameOwnerSelf, "names.0", resourceName, "name"),
+					acctest.CheckResourceAttrGreaterThanOrEqualValue(dataSourceNameOwnerSelf, "arns.#", 1),
+					acctest.CheckResourceAttrGreaterThanOrEqualValue(dataSourceNameOwnerSelf, "names.#", 1),
 				),
 			},
 		},
@@ -63,7 +61,7 @@ func TestAccImageBuilderImageRecipesDataSource_filter(t *testing.T) {
 	})
 }
 
-func testAccImageRecipeDataSourceBaseConfig(rName string) string {
+func testAccImageRecipeDataSourceConfig_base(rName string) string {
 	return fmt.Sprintf(`
 data "aws_region" "current" {}
 
@@ -92,9 +90,7 @@ resource "aws_imagebuilder_component" "test" {
 }
 
 func testAccImageRecipesDataSourceConfig_owner(rName string) string {
-	return acctest.ConfigCompose(
-		testAccImageRecipeDataSourceBaseConfig(rName),
-		fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccImageRecipeDataSourceConfig_base(rName), fmt.Sprintf(`
 resource "aws_imagebuilder_image_recipe" "test" {
   component {
     component_arn = aws_imagebuilder_component.test.arn
@@ -124,9 +120,7 @@ data "aws_imagebuilder_image_recipes" "self" {
 }
 
 func testAccImageRecipesDataSourceConfig_filter(rName string) string {
-	return acctest.ConfigCompose(
-		testAccImageRecipeDataSourceBaseConfig(rName),
-		fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccImageRecipeDataSourceConfig_base(rName), fmt.Sprintf(`
 resource "aws_imagebuilder_image_recipe" "test" {
   component {
     component_arn = aws_imagebuilder_component.test.arn
diff --git a/internal/service/imagebuilder/image_test.go b/internal/service/imagebuilder/image_test.go
index e1110fa6cc6..3f3cfd7265f 100644
--- a/internal/service/imagebuilder/image_test.go
+++ b/internal/service/imagebuilder/image_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package imagebuilder_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/imagebuilder"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -15,6 +18,7 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	tfimagebuilder "github.com/hashicorp/terraform-provider-aws/internal/service/imagebuilder"
+	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
 func TestAccImageBuilderImage_basic(t *testing.T) {
@@ -34,7 +38,7 @@ func TestAccImageBuilderImage_basic(t *testing.T) {
 				Config: testAccImageConfig_required(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckImageExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "imagebuilder", regexp.MustCompile(fmt.Sprintf("image/%s/1.0.0/[1-9][0-9]*", rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "imagebuilder", regexache.MustCompile(fmt.Sprintf("image/%s/1.0.0/[1-9][0-9]*", rName))),
 					resource.TestCheckNoResourceAttr(resourceName, "container_recipe_arn"),
 					acctest.CheckResourceAttrRFC3339(resourceName, "date_created"),
 					resource.TestCheckNoResourceAttr(resourceName, "distribution_configuration_arn"),
@@ -49,7 +53,7 @@ func TestAccImageBuilderImage_basic(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "os_version", "Amazon Linux 2"),
 					resource.TestCheckResourceAttr(resourceName, "output_resources.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
-					resource.TestMatchResourceAttr(resourceName, "version", regexp.MustCompile(`1.0.0/[1-9][0-9]*`)),
+					resource.TestMatchResourceAttr(resourceName, "version", regexache.MustCompile(`1.0.0/[1-9][0-9]*`)),
 				),
 			},
 			{
@@ -263,6 +267,33 @@ func TestAccImageBuilderImage_containerRecipeARN(t *testing.T) {
 	})
 }
 
+func TestAccImageBuilderImage_imageScanningConfiguration(t *testing.T) {
+	ctx := acctest.Context(t)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_imagebuilder_image.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, names.Inspector2EndpointID)
+			acctest.PreCheckInspector2(ctx, t)
+			acctest.PreCheckOrganizationManagementAccount(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, imagebuilder.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckImageDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccImageConfig_imageScanningConfigurationEnabled(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckImageExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "image_scanning_configuration.#", "1"),
+				),
+			},
+		},
+	})
+}
+
 func TestAccImageBuilderImage_outputResources_containers(t *testing.T) {
 	ctx := acctest.Context(t)
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
@@ -559,7 +590,7 @@ resource "aws_imagebuilder_image" "test" {
 `, tagKey1, tagValue1, tagKey2, tagValue2))
 }
 
-func testAccImageConfig_containerRecipe(rName string) string {
+func testAccImageConfig_containerRecipeBase(rName string) string {
 	return fmt.Sprintf(`
 data "aws_region" "current" {}
 
@@ -567,6 +598,10 @@ data "aws_partition" "current" {}
 
 resource "aws_vpc" "test" {
   cidr_block = "10.0.0.0/16"
+
+  tags = {
+    Name = %[1]q
+  }
 }
 
 resource "aws_default_route_table" "test" {
@@ -598,12 +633,20 @@ resource "aws_default_security_group" "test" {
 
 resource "aws_internet_gateway" "test" {
   vpc_id = aws_vpc.test.id
+
+  tags = {
+    Name = %[1]q
+  }
 }
 
 resource "aws_subnet" "test" {
   cidr_block              = cidrsubnet(aws_vpc.test.cidr_block, 8, 0)
   map_public_ip_on_launch = true
   vpc_id                  = aws_vpc.test.id
+
+  tags = {
+    Name = %[1]q
+  }
 }
 
 resource "aws_iam_role" "test" {
@@ -679,10 +722,45 @@ resource "aws_imagebuilder_infrastructure_configuration" "test" {
 
   depends_on = [aws_default_route_table.test]
 }
+	`, rName)
+}
 
+func testAccImageConfig_containerRecipe(rName string) string {
+	return acctest.ConfigCompose(
+		testAccImageConfig_containerRecipeBase(rName),
+		`
 resource "aws_imagebuilder_image" "test" {
   container_recipe_arn             = aws_imagebuilder_container_recipe.test.arn
   infrastructure_configuration_arn = aws_imagebuilder_infrastructure_configuration.test.arn
 }
-`, rName)
+`)
+}
+
+func testAccImageConfig_imageScanningConfigurationEnabled(rName string) string {
+	return acctest.ConfigCompose(
+		testAccImageConfig_containerRecipeBase(rName),
+		`
+data "aws_caller_identity" "current" {}
+
+resource "aws_inspector2_enabler" "test" {
+  account_ids    = [data.aws_caller_identity.current.account_id]
+  resource_types = ["ECR"]
+}
+
+resource "aws_imagebuilder_image" "test" {
+  container_recipe_arn             = aws_imagebuilder_container_recipe.test.arn
+  infrastructure_configuration_arn = aws_imagebuilder_infrastructure_configuration.test.arn
+
+  image_scanning_configuration {
+    image_scanning_enabled = true
+
+    ecr_configuration {
+      repository_name = aws_ecr_repository.test.name
+      container_tags  = ["foo", "bar"]
+    }
+  }
+
+  depends_on = [aws_inspector2_enabler.test]
+}
+`)
 }
diff --git a/internal/service/imagebuilder/infrastructure_configuration.go b/internal/service/imagebuilder/infrastructure_configuration.go
index 12de6cd3a74..845f4184c78 100644
--- a/internal/service/imagebuilder/infrastructure_configuration.go
+++ b/internal/service/imagebuilder/infrastructure_configuration.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package imagebuilder
 
 import (
diff --git a/internal/service/imagebuilder/infrastructure_configuration_data_source.go b/internal/service/imagebuilder/infrastructure_configuration_data_source.go
index b12b0ab0f83..40bda575f19 100644
--- a/internal/service/imagebuilder/infrastructure_configuration_data_source.go
+++ b/internal/service/imagebuilder/infrastructure_configuration_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package imagebuilder
 
 import (
diff --git a/internal/service/imagebuilder/infrastructure_configuration_data_source_test.go b/internal/service/imagebuilder/infrastructure_configuration_data_source_test.go
index 0d325f7f4ad..494502ff12e 100644
--- a/internal/service/imagebuilder/infrastructure_configuration_data_source_test.go
+++ b/internal/service/imagebuilder/infrastructure_configuration_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package imagebuilder_test
 
 import (
diff --git a/internal/service/imagebuilder/infrastructure_configuration_test.go b/internal/service/imagebuilder/infrastructure_configuration_test.go
index 1a653d0da04..fad60578ef5 100644
--- a/internal/service/imagebuilder/infrastructure_configuration_test.go
+++ b/internal/service/imagebuilder/infrastructure_configuration_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package imagebuilder_test
 
 import (
diff --git a/internal/service/imagebuilder/infrastructure_configurations_data_source.go b/internal/service/imagebuilder/infrastructure_configurations_data_source.go
index f239e38a894..399c39f12a9 100644
--- a/internal/service/imagebuilder/infrastructure_configurations_data_source.go
+++ b/internal/service/imagebuilder/infrastructure_configurations_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package imagebuilder
 
 import (
diff --git a/internal/service/imagebuilder/infrastructure_configurations_data_source_test.go b/internal/service/imagebuilder/infrastructure_configurations_data_source_test.go
index a5eb0c6fee9..54161eac8f7 100644
--- a/internal/service/imagebuilder/infrastructure_configurations_data_source_test.go
+++ b/internal/service/imagebuilder/infrastructure_configurations_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package imagebuilder_test
 
 import (
diff --git a/internal/service/imagebuilder/service_package_gen.go b/internal/service/imagebuilder/service_package_gen.go
index 4958c775d9c..353f7600a04 100644
--- a/internal/service/imagebuilder/service_package_gen.go
+++ b/internal/service/imagebuilder/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	imagebuilder_sdkv1 "github.com/aws/aws-sdk-go/service/imagebuilder"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -151,4 +152,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*i
 	return imagebuilder_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/imagebuilder/status.go b/internal/service/imagebuilder/status.go
index 1444168559a..225838f1025 100644
--- a/internal/service/imagebuilder/status.go
+++ b/internal/service/imagebuilder/status.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package imagebuilder
 
 import (
diff --git a/internal/service/imagebuilder/sweep.go b/internal/service/imagebuilder/sweep.go
index 7bdcae307eb..76ce60ad7e4 100644
--- a/internal/service/imagebuilder/sweep.go
+++ b/internal/service/imagebuilder/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package imagebuilder
 
@@ -12,9 +12,10 @@ import (
 	"github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_imagebuilder_component", &resource.Sweeper{
 		Name: "aws_imagebuilder_component",
 		F:    sweepComponents,
@@ -53,7 +54,7 @@ func init() {
 
 func sweepComponents(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -113,7 +114,7 @@ func sweepComponents(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Image Builder Component sweep for %s: %s", region, err)
 		return sweeperErrs.ErrorOrNil() // In case we have completed some pages, but had errors
 	}
@@ -121,7 +122,7 @@ func sweepComponents(region string) error {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error listing Image Builder Components: %w", err))
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error sweeping Image Builder Components: %w", err))
 	}
 
@@ -130,7 +131,7 @@ func sweepComponents(region string) error {
 
 func sweepDistributionConfigurations(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -162,7 +163,7 @@ func sweepDistributionConfigurations(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Image Builder Distribution Configuration sweep for %s: %s", region, err)
 		return sweeperErrs.ErrorOrNil() // In case we have completed some pages, but had errors
 	}
@@ -170,7 +171,7 @@ func sweepDistributionConfigurations(region string) error {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error listing Image Builder Distribution Configurations: %w", err))
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error sweeping Image Builder Distribution Configurations: %w", err))
 	}
 
@@ -179,7 +180,7 @@ func sweepDistributionConfigurations(region string) error {
 
 func sweepImagePipelines(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
@@ -211,7 +212,7 @@ func sweepImagePipelines(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Image Builder Image Pipeline sweep for %s: %s", region, err)
 		return sweeperErrs.ErrorOrNil() // In case we have completed some pages, but had errors
 	}
@@ -219,7 +220,7 @@ func sweepImagePipelines(region string) error {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error listing Image Builder Image Pipelines: %w", err))
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error sweeping Image Builder Image Pipelines: %w", err))
 	}
 
@@ -228,7 +229,7 @@ func sweepImagePipelines(region string) error {
 
 func sweepImageRecipes(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
@@ -262,7 +263,7 @@ func sweepImageRecipes(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Image Builder Image Recipe sweep for %s: %s", region, err)
 		return sweeperErrs.ErrorOrNil() // In case we have completed some pages, but had errors
 	}
@@ -270,7 +271,7 @@ func sweepImageRecipes(region string) error {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error listing Image Builder Image Recipes: %w", err))
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error sweeping Image Builder Image Recipes: %w", err))
 	}
 
@@ -279,7 +280,7 @@ func sweepImageRecipes(region string) error {
 
 func sweepContainerRecipes(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
@@ -313,7 +314,7 @@ func sweepContainerRecipes(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Image Builder Container Recipe sweep for %s: %s", region, err)
 		return sweeperErrs.ErrorOrNil() // In case we have completed some pages, but had errors
 	}
@@ -321,7 +322,7 @@ func sweepContainerRecipes(region string) error {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error listing Image Builder Container Recipes: %w", err))
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error sweeping Image Builder Container Recipes: %w", err))
 	}
 
@@ -330,7 +331,7 @@ func sweepContainerRecipes(region string) error {
 
 func sweepImages(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
@@ -397,11 +398,11 @@ func sweepImages(region string) error {
 		errs = multierror.Append(errs, fmt.Errorf("error listing Image Builder Images for %s: %w", region, err))
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("error sweeping Image Builder Images for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Image Builder Image sweep for %s: %s", region, err)
 		return nil
 	}
@@ -411,7 +412,7 @@ func sweepImages(region string) error {
 
 func sweepInfrastructureConfigurations(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -444,7 +445,7 @@ func sweepInfrastructureConfigurations(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Image Builder Infrastructure Configuration sweep for %s: %s", region, err)
 		return sweeperErrs.ErrorOrNil() // In case we have completed some pages, but had errors
 	}
@@ -452,7 +453,7 @@ func sweepInfrastructureConfigurations(region string) error {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error listing Image Builder Infrastructure Configurations: %w", err))
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error sweeping Image Builder Infrastructure Configurations: %w", err))
 	}
 
diff --git a/internal/service/imagebuilder/tags_gen.go b/internal/service/imagebuilder/tags_gen.go
index b80274a8db9..4e8b539e48b 100644
--- a/internal/service/imagebuilder/tags_gen.go
+++ b/internal/service/imagebuilder/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/imagebuilder"
 	"github.com/aws/aws-sdk-go/service/imagebuilder/imagebuilderiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -54,7 +56,7 @@ func Tags(tags tftags.KeyValueTags) map[string]*string {
 	return aws.StringMap(tags.Map())
 }
 
-// KeyValueTags creates KeyValueTags from imagebuilder service tags.
+// KeyValueTags creates tftags.KeyValueTags from imagebuilder service tags.
 func KeyValueTags(ctx context.Context, tags map[string]*string) tftags.KeyValueTags {
 	return tftags.New(ctx, tags)
 }
@@ -85,6 +87,8 @@ func updateTags(ctx context.Context, conn imagebuilderiface.ImagebuilderAPI, ide
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.ImageBuilder)
 	if len(removedTags) > 0 {
diff --git a/internal/service/imagebuilder/wait.go b/internal/service/imagebuilder/wait.go
index 413daaa2682..ac4b4d2aa76 100644
--- a/internal/service/imagebuilder/wait.go
+++ b/internal/service/imagebuilder/wait.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package imagebuilder
 
 import (
diff --git a/internal/service/inspector/assessment_target.go b/internal/service/inspector/assessment_target.go
index afe667e8083..49e5e55ae9d 100644
--- a/internal/service/inspector/assessment_target.go
+++ b/internal/service/inspector/assessment_target.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package inspector
 
 import (
diff --git a/internal/service/inspector/assessment_target_test.go b/internal/service/inspector/assessment_target_test.go
index 4897874903d..e56058abd2e 100644
--- a/internal/service/inspector/assessment_target_test.go
+++ b/internal/service/inspector/assessment_target_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package inspector_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/inspector"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -31,7 +34,7 @@ func TestAccInspectorAssessmentTarget_basic(t *testing.T) {
 				Config: testAccAssessmentTargetConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckTargetExists(ctx, resourceName, &assessmentTarget1),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "inspector", regexp.MustCompile(`target/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "inspector", regexache.MustCompile(`target/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "resource_group_arn", ""),
 				),
diff --git a/internal/service/inspector/assessment_template.go b/internal/service/inspector/assessment_template.go
index 917cd555f86..f0d0d7dcb14 100644
--- a/internal/service/inspector/assessment_template.go
+++ b/internal/service/inspector/assessment_template.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package inspector
 
 import (
diff --git a/internal/service/inspector/assessment_template_test.go b/internal/service/inspector/assessment_template_test.go
index 5fbf35a803b..e895b7c0867 100644
--- a/internal/service/inspector/assessment_template_test.go
+++ b/internal/service/inspector/assessment_template_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package inspector_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/inspector"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -32,7 +35,7 @@ func TestAccInspectorAssessmentTemplate_basic(t *testing.T) {
 				Config: testAccAssessmentTemplateConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckTemplateExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "inspector", regexp.MustCompile(`target/.+/template/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "inspector", regexache.MustCompile(`target/.+/template/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "duration", "3600"),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttrPair(resourceName, "rules_package_arns.#", "data.aws_inspector_rules_packages.available", "arns.#"),
diff --git a/internal/service/inspector/find.go b/internal/service/inspector/find.go
index dfcc3dbe876..8f5565fe1a5 100644
--- a/internal/service/inspector/find.go
+++ b/internal/service/inspector/find.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package inspector
 
 import (
diff --git a/internal/service/inspector/generate.go b/internal/service/inspector/generate.go
index 4a41440c12a..9d8fab53ce5 100644
--- a/internal/service/inspector/generate.go
+++ b/internal/service/inspector/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTags -ServiceTagsSlice
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/inspector/resource_group.go b/internal/service/inspector/resource_group.go
index 2fdde2619cf..63ef0a37d91 100644
--- a/internal/service/inspector/resource_group.go
+++ b/internal/service/inspector/resource_group.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package inspector
 
 import (
diff --git a/internal/service/inspector/resource_group_test.go b/internal/service/inspector/resource_group_test.go
index c69638ae84f..be7b7b58824 100644
--- a/internal/service/inspector/resource_group_test.go
+++ b/internal/service/inspector/resource_group_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package inspector_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/inspector"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -29,7 +32,7 @@ func TestAccInspectorResourceGroup_basic(t *testing.T) {
 				Config: testAccResourceGroupConfig_basic,
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckResourceGroupExists(ctx, resourceName, &v1),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "inspector", regexp.MustCompile(`resourcegroup/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "inspector", regexache.MustCompile(`resourcegroup/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "tags.Name", "foo"),
 				),
 			},
@@ -37,7 +40,7 @@ func TestAccInspectorResourceGroup_basic(t *testing.T) {
 				Config: testAccResourceGroupConfig_modified,
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckResourceGroupExists(ctx, resourceName, &v2),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "inspector", regexp.MustCompile(`resourcegroup/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "inspector", regexache.MustCompile(`resourcegroup/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "tags.Name", "bar"),
 					testAccCheckResourceGroupRecreated(&v1, &v2),
 				),
diff --git a/internal/service/inspector/rules_packages_data_source.go b/internal/service/inspector/rules_packages_data_source.go
index fa0f54c6381..0007c58d381 100644
--- a/internal/service/inspector/rules_packages_data_source.go
+++ b/internal/service/inspector/rules_packages_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package inspector
 
 import (
diff --git a/internal/service/inspector/rules_packages_data_source_test.go b/internal/service/inspector/rules_packages_data_source_test.go
index a5cf95e9f7d..e0432e82d25 100644
--- a/internal/service/inspector/rules_packages_data_source_test.go
+++ b/internal/service/inspector/rules_packages_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package inspector_test
 
 import (
diff --git a/internal/service/inspector/service_package_gen.go b/internal/service/inspector/service_package_gen.go
index d17a199b209..ff84ea15222 100644
--- a/internal/service/inspector/service_package_gen.go
+++ b/internal/service/inspector/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	inspector_sdkv1 "github.com/aws/aws-sdk-go/service/inspector"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -63,4 +64,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*i
 	return inspector_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/inspector/tags.go b/internal/service/inspector/tags.go
index c999894e4bb..a0d5b4d86da 100644
--- a/internal/service/inspector/tags.go
+++ b/internal/service/inspector/tags.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:build !generate
 // +build !generate
 
diff --git a/internal/service/inspector2/acc_test.go b/internal/service/inspector2/acc_test.go
deleted file mode 100644
index ae438f39eff..00000000000
--- a/internal/service/inspector2/acc_test.go
+++ /dev/null
@@ -1,26 +0,0 @@
-package inspector2_test
-
-import (
-	"context"
-	"testing"
-
-	"github.com/aws/aws-sdk-go-v2/service/inspector2"
-	"github.com/aws/aws-sdk-go-v2/service/inspector2/types"
-	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
-	"github.com/hashicorp/terraform-provider-aws/internal/conns"
-	"github.com/hashicorp/terraform-provider-aws/internal/errs"
-)
-
-func testAccPreCheck(ctx context.Context, t *testing.T) {
-	conn := acctest.Provider.Meta().(*conns.AWSClient).Inspector2Client(ctx)
-
-	_, err := conn.ListDelegatedAdminAccounts(ctx, &inspector2.ListDelegatedAdminAccountsInput{})
-
-	if errs.IsA[*types.AccessDeniedException](err) {
-		t.Skipf("skipping acceptance testing: %s", err)
-	}
-
-	if err != nil {
-		t.Fatalf("unexpected PreCheck error: %s", err)
-	}
-}
diff --git a/internal/service/inspector2/delegated_admin_account.go b/internal/service/inspector2/delegated_admin_account.go
index a501b212ad2..0c7fe6c934c 100644
--- a/internal/service/inspector2/delegated_admin_account.go
+++ b/internal/service/inspector2/delegated_admin_account.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package inspector2
 
 import (
diff --git a/internal/service/inspector2/delegated_admin_account_test.go b/internal/service/inspector2/delegated_admin_account_test.go
index 5e58564b4ee..9cfdb5f905b 100644
--- a/internal/service/inspector2/delegated_admin_account_test.go
+++ b/internal/service/inspector2/delegated_admin_account_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package inspector2_test
 
 import (
@@ -25,7 +28,7 @@ func testAccDelegatedAdminAccount_basic(t *testing.T) {
 		PreCheck: func() {
 			acctest.PreCheck(ctx, t)
 			acctest.PreCheckPartitionHasService(t, names.Inspector2EndpointID)
-			testAccPreCheck(ctx, t)
+			acctest.PreCheckInspector2(ctx, t)
 			acctest.PreCheckOrganizationManagementAccount(ctx, t)
 		},
 		ErrorCheck:               acctest.ErrorCheck(t, names.Inspector2EndpointID),
@@ -76,7 +79,7 @@ func testAccDelegatedAdminAccount_disappears(t *testing.T) {
 		PreCheck: func() {
 			acctest.PreCheck(ctx, t)
 			acctest.PreCheckPartitionHasService(t, names.Inspector2EndpointID)
-			testAccPreCheck(ctx, t)
+			acctest.PreCheckInspector2(ctx, t)
 			acctest.PreCheckOrganizationManagementAccount(ctx, t)
 		},
 		ErrorCheck:               acctest.ErrorCheck(t, names.Inspector2EndpointID),
diff --git a/internal/service/inspector2/enabler.go b/internal/service/inspector2/enabler.go
index 5ca18829f8d..72bfea2fb38 100644
--- a/internal/service/inspector2/enabler.go
+++ b/internal/service/inspector2/enabler.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package inspector2
 
 import (
@@ -468,7 +471,7 @@ func statusEnablerAccountAndResourceTypes(ctx context.Context, conn *inspector2.
 			}) {
 				return true
 			}
-			if v.Status == types.StatusEnabled && tfslices.All(maps.Values(v.ResourceStatuses), tfslices.FilterEquals(types.StatusDisabled)) {
+			if v.Status == types.StatusEnabled && tfslices.All(maps.Values(v.ResourceStatuses), tfslices.PredicateEquals(types.StatusDisabled)) {
 				return true
 			}
 			return false
@@ -536,6 +539,9 @@ func AccountStatuses(ctx context.Context, conn *inspector2.Client, accountIDs []
 			continue
 		}
 		for k, v := range m {
+			if k == "LambdaCode" {
+				k = "LAMBDA_CODE"
+			}
 			status.ResourceStatuses[types.ResourceScanType(strings.ToUpper(k))] = v.Status
 		}
 		results[aws.ToString(a.AccountId)] = status
diff --git a/internal/service/inspector2/enabler_test.go b/internal/service/inspector2/enabler_test.go
index 04b2b4d0672..e16da5d37e4 100644
--- a/internal/service/inspector2/enabler_test.go
+++ b/internal/service/inspector2/enabler_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package inspector2_test
 
 import (
@@ -32,7 +35,7 @@ func testAccEnabler_basic(t *testing.T) {
 		PreCheck: func() {
 			acctest.PreCheck(ctx, t)
 			acctest.PreCheckPartitionHasService(t, names.Inspector2EndpointID)
-			testAccPreCheck(ctx, t)
+			acctest.PreCheckInspector2(ctx, t)
 			acctest.PreCheckOrganizationManagementAccount(ctx, t)
 		},
 		ErrorCheck:               acctest.ErrorCheck(t, names.Inspector2EndpointID),
@@ -64,7 +67,7 @@ func testAccEnabler_accountID(t *testing.T) {
 		PreCheck: func() {
 			acctest.PreCheck(ctx, t)
 			acctest.PreCheckPartitionHasService(t, names.Inspector2EndpointID)
-			testAccPreCheck(ctx, t)
+			acctest.PreCheckInspector2(ctx, t)
 			acctest.PreCheckOrganizationManagementAccount(ctx, t)
 		},
 		ErrorCheck:               acctest.ErrorCheck(t, names.Inspector2EndpointID),
@@ -97,7 +100,7 @@ func testAccEnabler_disappears(t *testing.T) {
 		PreCheck: func() {
 			acctest.PreCheck(ctx, t)
 			acctest.PreCheckPartitionHasService(t, names.Inspector2EndpointID)
-			testAccPreCheck(ctx, t)
+			acctest.PreCheckInspector2(ctx, t)
 			acctest.PreCheckOrganizationManagementAccount(ctx, t)
 		},
 		ErrorCheck:               acctest.ErrorCheck(t, names.Inspector2EndpointID),
@@ -128,7 +131,7 @@ func testAccEnabler_updateResourceTypes(t *testing.T) {
 		PreCheck: func() {
 			acctest.PreCheck(ctx, t)
 			acctest.PreCheckPartitionHasService(t, names.Inspector2EndpointID)
-			testAccPreCheck(ctx, t)
+			acctest.PreCheckInspector2(ctx, t)
 			acctest.PreCheckOrganizationManagementAccount(ctx, t)
 		},
 		ErrorCheck:               acctest.ErrorCheck(t, names.Inspector2EndpointID),
@@ -184,7 +187,7 @@ func testAccEnabler_updateResourceTypes_disjoint(t *testing.T) {
 		PreCheck: func() {
 			acctest.PreCheck(ctx, t)
 			acctest.PreCheckPartitionHasService(t, names.Inspector2EndpointID)
-			testAccPreCheck(ctx, t)
+			acctest.PreCheckInspector2(ctx, t)
 			acctest.PreCheckOrganizationManagementAccount(ctx, t)
 		},
 		ErrorCheck:               acctest.ErrorCheck(t, names.Inspector2EndpointID),
@@ -227,7 +230,7 @@ func testAccEnabler_lambda(t *testing.T) {
 		PreCheck: func() {
 			acctest.PreCheck(ctx, t)
 			acctest.PreCheckPartitionHasService(t, names.Inspector2EndpointID)
-			testAccPreCheck(ctx, t)
+			acctest.PreCheckInspector2(ctx, t)
 			acctest.PreCheckOrganizationManagementAccount(ctx, t)
 		},
 		ErrorCheck:               acctest.ErrorCheck(t, names.Inspector2EndpointID),
@@ -261,7 +264,7 @@ func testAccEnabler_memberAccount_basic(t *testing.T) {
 		PreCheck: func() {
 			acctest.PreCheck(ctx, t)
 			acctest.PreCheckPartitionHasService(t, names.Inspector2EndpointID)
-			testAccPreCheck(ctx, t)
+			acctest.PreCheckInspector2(ctx, t)
 			acctest.PreCheckOrganizationManagementAccount(ctx, t)
 			acctest.PreCheckAlternateAccount(t)
 		},
@@ -296,7 +299,7 @@ func testAccEnabler_memberAccount_disappearsMemberAssociation(t *testing.T) {
 		PreCheck: func() {
 			acctest.PreCheck(ctx, t)
 			acctest.PreCheckPartitionHasService(t, names.Inspector2EndpointID)
-			testAccPreCheck(ctx, t)
+			acctest.PreCheckInspector2(ctx, t)
 			acctest.PreCheckOrganizationManagementAccount(ctx, t)
 			acctest.PreCheckAlternateAccount(t)
 		},
@@ -328,7 +331,7 @@ func testAccEnabler_memberAccount_multiple(t *testing.T) {
 		PreCheck: func() {
 			acctest.PreCheck(ctx, t)
 			acctest.PreCheckPartitionHasService(t, names.Inspector2EndpointID)
-			testAccPreCheck(ctx, t)
+			acctest.PreCheckInspector2(ctx, t)
 			acctest.PreCheckOrganizationManagementAccount(ctx, t)
 			acctest.PreCheckAlternateAccount(t)
 			acctest.PreCheckThirdAccount(t)
@@ -368,7 +371,7 @@ func testAccEnabler_memberAccount_updateMemberAccounts(t *testing.T) {
 		PreCheck: func() {
 			acctest.PreCheck(ctx, t)
 			acctest.PreCheckPartitionHasService(t, names.Inspector2EndpointID)
-			testAccPreCheck(ctx, t)
+			acctest.PreCheckInspector2(ctx, t)
 			acctest.PreCheckOrganizationManagementAccount(ctx, t)
 			acctest.PreCheckAlternateAccount(t)
 			acctest.PreCheckThirdAccount(t)
@@ -436,7 +439,7 @@ func testAccEnabler_memberAccount_updateMemberAccountsAndScanTypes(t *testing.T)
 		PreCheck: func() {
 			acctest.PreCheck(ctx, t)
 			acctest.PreCheckPartitionHasService(t, names.Inspector2EndpointID)
-			testAccPreCheck(ctx, t)
+			acctest.PreCheckInspector2(ctx, t)
 			acctest.PreCheckOrganizationManagementAccount(ctx, t)
 			acctest.PreCheckAlternateAccount(t)
 			acctest.PreCheckThirdAccount(t)
diff --git a/internal/service/inspector2/exports_test.go b/internal/service/inspector2/exports_test.go
index 8b94cc7ab5f..5ffd77545a6 100644
--- a/internal/service/inspector2/exports_test.go
+++ b/internal/service/inspector2/exports_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package inspector2
 
 // Exports for use in tests only.
diff --git a/internal/service/inspector2/generate.go b/internal/service/inspector2/generate.go
index 8d38ff5d680..9a7bcf751c3 100644
--- a/internal/service/inspector2/generate.go
+++ b/internal/service/inspector2/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
 
diff --git a/internal/service/inspector2/inspector2_test.go b/internal/service/inspector2/inspector2_test.go
index a43a7718ef7..272f4e044a9 100644
--- a/internal/service/inspector2/inspector2_test.go
+++ b/internal/service/inspector2/inspector2_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package inspector2_test
 
 import (
diff --git a/internal/service/inspector2/member_association.go b/internal/service/inspector2/member_association.go
index ee0a10ab1b9..e5bdc2bae61 100644
--- a/internal/service/inspector2/member_association.go
+++ b/internal/service/inspector2/member_association.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package inspector2
 
 import (
diff --git a/internal/service/inspector2/member_association_test.go b/internal/service/inspector2/member_association_test.go
index 5ba24d07976..320d4b384fc 100644
--- a/internal/service/inspector2/member_association_test.go
+++ b/internal/service/inspector2/member_association_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package inspector2_test
 
 import (
@@ -23,7 +26,7 @@ func testAccMemberAssociation_basic(t *testing.T) {
 		PreCheck: func() {
 			acctest.PreCheck(ctx, t)
 			acctest.PreCheckPartitionHasService(t, names.Inspector2EndpointID)
-			testAccPreCheck(ctx, t)
+			acctest.PreCheckInspector2(ctx, t)
 			acctest.PreCheckOrganizationManagementAccount(ctx, t)
 			acctest.PreCheckAlternateAccount(t)
 		},
@@ -58,7 +61,7 @@ func testAccMemberAssociation_disappears(t *testing.T) {
 		PreCheck: func() {
 			acctest.PreCheck(ctx, t)
 			acctest.PreCheckPartitionHasService(t, names.Inspector2EndpointID)
-			testAccPreCheck(ctx, t)
+			acctest.PreCheckInspector2(ctx, t)
 			acctest.PreCheckOrganizationManagementAccount(ctx, t)
 			acctest.PreCheckAlternateAccount(t)
 		},
diff --git a/internal/service/inspector2/organization_configuration.go b/internal/service/inspector2/organization_configuration.go
index b7973ec03de..9e67587d079 100644
--- a/internal/service/inspector2/organization_configuration.go
+++ b/internal/service/inspector2/organization_configuration.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package inspector2
 
 import (
diff --git a/internal/service/inspector2/organization_configuration_test.go b/internal/service/inspector2/organization_configuration_test.go
index 069afa14f44..ce25b150978 100644
--- a/internal/service/inspector2/organization_configuration_test.go
+++ b/internal/service/inspector2/organization_configuration_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package inspector2_test
 
 import (
@@ -27,7 +30,7 @@ func testAccOrganizationConfiguration_basic(t *testing.T) {
 		PreCheck: func() {
 			acctest.PreCheck(ctx, t)
 			acctest.PreCheckPartitionHasService(t, names.Inspector2EndpointID)
-			testAccPreCheck(ctx, t)
+			acctest.PreCheckInspector2(ctx, t)
 			acctest.PreCheckOrganizationManagementAccount(ctx, t)
 		},
 		ErrorCheck:               acctest.ErrorCheck(t, names.Inspector2EndpointID),
@@ -54,7 +57,7 @@ func testAccOrganizationConfiguration_disappears(t *testing.T) {
 		PreCheck: func() {
 			acctest.PreCheck(ctx, t)
 			acctest.PreCheckPartitionHasService(t, names.Inspector2EndpointID)
-			testAccPreCheck(ctx, t)
+			acctest.PreCheckInspector2(ctx, t)
 			acctest.PreCheckOrganizationManagementAccount(ctx, t)
 		},
 		ErrorCheck:               acctest.ErrorCheck(t, names.Inspector2EndpointID),
@@ -81,7 +84,7 @@ func testAccOrganizationConfiguration_ec2ECR(t *testing.T) {
 		PreCheck: func() {
 			acctest.PreCheck(ctx, t)
 			acctest.PreCheckPartitionHasService(t, names.Inspector2EndpointID)
-			testAccPreCheck(ctx, t)
+			acctest.PreCheckInspector2(ctx, t)
 			acctest.PreCheckOrganizationManagementAccount(ctx, t)
 		},
 		ErrorCheck:               acctest.ErrorCheck(t, names.Inspector2EndpointID),
@@ -108,7 +111,7 @@ func testAccOrganizationConfiguration_lambda(t *testing.T) {
 		PreCheck: func() {
 			acctest.PreCheck(ctx, t)
 			acctest.PreCheckPartitionHasService(t, names.Inspector2EndpointID)
-			testAccPreCheck(ctx, t)
+			acctest.PreCheckInspector2(ctx, t)
 			acctest.PreCheckOrganizationManagementAccount(ctx, t)
 		},
 		ErrorCheck:               acctest.ErrorCheck(t, names.Inspector2EndpointID),
diff --git a/internal/service/inspector2/service_package_gen.go b/internal/service/inspector2/service_package_gen.go
index 3b4e16d6814..842cf5c7e94 100644
--- a/internal/service/inspector2/service_package_gen.go
+++ b/internal/service/inspector2/service_package_gen.go
@@ -7,6 +7,7 @@ import (
 
 	aws_sdkv2 "github.com/aws/aws-sdk-go-v2/aws"
 	inspector2_sdkv2 "github.com/aws/aws-sdk-go-v2/service/inspector2"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -56,9 +57,11 @@ func (p *servicePackage) NewClient(ctx context.Context, config map[string]any) (
 
 	return inspector2_sdkv2.NewFromConfig(cfg, func(o *inspector2_sdkv2.Options) {
 		if endpoint := config["endpoint"].(string); endpoint != "" {
-			o.EndpointResolver = inspector2_sdkv2.EndpointResolverFromURL(endpoint)
+			o.BaseEndpoint = aws_sdkv2.String(endpoint)
 		}
 	}), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/internetmonitor/exports_test.go b/internal/service/internetmonitor/exports_test.go
new file mode 100644
index 00000000000..ca0f4428e40
--- /dev/null
+++ b/internal/service/internetmonitor/exports_test.go
@@ -0,0 +1,11 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package internetmonitor
+
+// Exports for use in tests only.
+var (
+	ResourceMonitor = resourceMonitor
+
+	FindMonitorByName = findMonitorByName
+)
diff --git a/internal/service/internetmonitor/find.go b/internal/service/internetmonitor/find.go
deleted file mode 100644
index acf379526a4..00000000000
--- a/internal/service/internetmonitor/find.go
+++ /dev/null
@@ -1,31 +0,0 @@
-package internetmonitor
-
-import (
-	"context"
-
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/internetmonitor"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
-)
-
-func FindMonitor(ctx context.Context, conn *internetmonitor.InternetMonitor, name string) (*internetmonitor.GetMonitorOutput, error) {
-	input := &internetmonitor.GetMonitorInput{
-		MonitorName: aws.String(name),
-	}
-
-	output, err := conn.GetMonitorWithContext(ctx, input)
-
-	if tfawserr.ErrCodeEquals(err, internetmonitor.ErrCodeResourceNotFoundException) {
-		return nil, &retry.NotFoundError{
-			LastError:   err,
-			LastRequest: input,
-		}
-	}
-
-	if err != nil {
-		return nil, err
-	}
-
-	return output, nil
-}
diff --git a/internal/service/internetmonitor/generate.go b/internal/service/internetmonitor/generate.go
index 143d8950d84..da87a69a432 100644
--- a/internal/service/internetmonitor/generate.go
+++ b/internal/service/internetmonitor/generate.go
@@ -1,4 +1,7 @@
-//go:generate go run ../../generate/tags/main.go -ListTags -ListTagsInIDElem=ResourceArn -ServiceTagsMap -TagInIDElem=ResourceArn -UpdateTags
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+//go:generate go run ../../generate/tags/main.go -AWSSDKVersion=2 -ListTags -ListTagsInIDElem=ResourceArn -ServiceTagsMap -KVTValues -TagInIDElem=ResourceArn -UpdateTags -SkipTypesImp
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
 
diff --git a/internal/service/internetmonitor/monitor.go b/internal/service/internetmonitor/monitor.go
index a6b3720807f..ff372886916 100644
--- a/internal/service/internetmonitor/monitor.go
+++ b/internal/service/internetmonitor/monitor.go
@@ -1,17 +1,25 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package internetmonitor
 
 import (
 	"context"
+	"errors"
 	"log"
+	"time"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/internetmonitor"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/internetmonitor"
+	"github.com/aws/aws-sdk-go-v2/service/internetmonitor/types"
+	"github.com/hashicorp/aws-sdk-go-base/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/enum"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
 	"github.com/hashicorp/terraform-provider-aws/internal/flex"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
@@ -22,12 +30,13 @@ import (
 
 // @SDKResource("aws_internetmonitor_monitor", name="Monitor")
 // @Tags(identifierAttribute="arn")
-func ResourceMonitor() *schema.Resource {
+func resourceMonitor() *schema.Resource {
 	return &schema.Resource{
 		CreateWithoutTimeout: resourceMonitorCreate,
 		ReadWithoutTimeout:   resourceMonitorRead,
 		UpdateWithoutTimeout: resourceMonitorUpdate,
 		DeleteWithoutTimeout: resourceMonitorDelete,
+
 		Importer: &schema.ResourceImporter{
 			StateContext: schema.ImportStatePassthroughContext,
 		},
@@ -37,6 +46,25 @@ func ResourceMonitor() *schema.Resource {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
+			"health_events_config": {
+				Type:     schema.TypeList,
+				Optional: true,
+				MaxItems: 1,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"availability_score_threshold": {
+							Type:     schema.TypeFloat,
+							Optional: true,
+							Default:  95.0,
+						},
+						"performance_score_threshold": {
+							Type:     schema.TypeFloat,
+							Optional: true,
+							Default:  95.0,
+						},
+					},
+				},
+			},
 			"internet_measurements_log_delivery": {
 				Type:             schema.TypeList,
 				Optional:         true,
@@ -59,10 +87,10 @@ func ResourceMonitor() *schema.Resource {
 										Optional: true,
 									},
 									"log_delivery_status": {
-										Type:         schema.TypeString,
-										Optional:     true,
-										Default:      internetmonitor.LogDeliveryStatusEnabled,
-										ValidateFunc: validation.StringInSlice(internetmonitor.LogDeliveryStatus_Values(), false),
+										Type:             schema.TypeString,
+										Optional:         true,
+										Default:          types.LogDeliveryStatusEnabled,
+										ValidateDiagFunc: enum.Validate[types.LogDeliveryStatus](),
 									},
 								},
 							},
@@ -93,11 +121,11 @@ func ResourceMonitor() *schema.Resource {
 			"status": {
 				Type:     schema.TypeString,
 				Optional: true,
-				Default:  internetmonitor.MonitorConfigStateActive,
-				ValidateFunc: validation.StringInSlice([]string{
-					internetmonitor.MonitorConfigStateActive,
-					internetmonitor.MonitorConfigStateInactive,
-				}, false),
+				Default:  types.MonitorConfigStateActive,
+				ValidateFunc: validation.StringInSlice(enum.Slice(
+					types.MonitorConfigStateActive,
+					types.MonitorConfigStateInactive,
+				), false),
 			},
 			names.AttrTags:    tftags.TagsSchema(),
 			names.AttrTagsAll: tftags.TagsSchemaComputed(),
@@ -112,57 +140,70 @@ func ResourceMonitor() *schema.Resource {
 	}
 }
 
+const (
+	errCodeResourceNotFoundException = "ResourceNotFoundException"
+)
+
 func resourceMonitorCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).InternetMonitorConn(ctx)
+	conn := meta.(*conns.AWSClient).InternetMonitorClient(ctx)
 
-	monitorName := d.Get("monitor_name").(string)
+	name := d.Get("monitor_name").(string)
 	input := &internetmonitor.CreateMonitorInput{
 		ClientToken: aws.String(id.UniqueId()),
-		MonitorName: aws.String(monitorName),
+		MonitorName: aws.String(name),
 		Tags:        getTagsIn(ctx),
 	}
 
-	if v, ok := d.GetOk("max_city_networks_to_monitor"); ok {
-		input.MaxCityNetworksToMonitor = aws.Int64(int64(v.(int)))
-	}
-
-	if v, ok := d.GetOk("traffic_percentage_to_monitor"); ok {
-		input.TrafficPercentageToMonitor = aws.Int64(int64(v.(int)))
+	if v, ok := d.GetOk("health_events_config"); ok {
+		input.HealthEventsConfig = expandHealthEventsConfig(v.([]interface{}))
 	}
 
 	if v, ok := d.GetOk("internet_measurements_log_delivery"); ok {
 		input.InternetMeasurementsLogDelivery = expandInternetMeasurementsLogDelivery(v.([]interface{}))
 	}
 
+	if v, ok := d.GetOk("max_city_networks_to_monitor"); ok {
+		input.MaxCityNetworksToMonitor = int32(v.(int))
+	}
+
 	if v, ok := d.GetOk("resources"); ok && v.(*schema.Set).Len() > 0 {
-		input.Resources = flex.ExpandStringSet(v.(*schema.Set))
+		input.Resources = flex.ExpandStringValueSet(v.(*schema.Set))
 	}
 
-	log.Printf("[DEBUG] Creating Internet Monitor Monitor: %s", input)
-	_, err := conn.CreateMonitorWithContext(ctx, input)
+	if v, ok := d.GetOk("traffic_percentage_to_monitor"); ok {
+		input.TrafficPercentageToMonitor = int32(v.(int))
+	}
+
+	_, err := conn.CreateMonitor(ctx, input)
 
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "creating Internet Monitor Monitor (%s): %s", monitorName, err)
+		return sdkdiag.AppendErrorf(diags, "creating Internet Monitor Monitor (%s): %s", name, err)
 	}
 
-	d.SetId(monitorName)
+	d.SetId(name)
 
-	if err := waitMonitor(ctx, conn, monitorName, internetmonitor.MonitorConfigStateActive); err != nil {
+	if err := waitMonitor(ctx, conn, d.Id(), types.MonitorConfigStateActive); err != nil {
 		return sdkdiag.AppendErrorf(diags, "waiting for Internet Monitor Monitor (%s) create: %s", d.Id(), err)
 	}
 
-	if v, ok := d.GetOk("status"); ok && v.(string) != internetmonitor.MonitorConfigStateActive {
-		input := &internetmonitor.UpdateMonitorInput{
-			ClientToken: aws.String(id.UniqueId()),
-			MonitorName: aws.String(d.Id()),
-			Status:      aws.String(v.(string)),
-		}
+	if v, ok := d.GetOk("status"); ok {
+		if v := types.MonitorConfigState(v.(string)); v != types.MonitorConfigStateActive {
+			input := &internetmonitor.UpdateMonitorInput{
+				ClientToken: aws.String(id.UniqueId()),
+				MonitorName: aws.String(d.Id()),
+				Status:      v,
+			}
 
-		_, err := conn.UpdateMonitorWithContext(ctx, input)
+			_, err := conn.UpdateMonitor(ctx, input)
 
-		if err != nil {
-			return sdkdiag.AppendErrorf(diags, "updating Internet Monitor Monitor (%s) to inactive at creation: %s", d.Id(), err)
+			if err != nil {
+				return sdkdiag.AppendErrorf(diags, "updating Internet Monitor Monitor (%s): %s", d.Id(), err)
+			}
+
+			if err := waitMonitor(ctx, conn, d.Id(), v); err != nil {
+				return sdkdiag.AppendErrorf(diags, "waiting for Internet Monitor Monitor (%s) INACTIVE: %s", d.Id(), err)
+			}
 		}
 	}
 
@@ -171,9 +212,9 @@ func resourceMonitorCreate(ctx context.Context, d *schema.ResourceData, meta int
 
 func resourceMonitorRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).InternetMonitorConn(ctx)
+	conn := meta.(*conns.AWSClient).InternetMonitorClient(ctx)
 
-	monitor, err := FindMonitor(ctx, conn, d.Id())
+	monitor, err := findMonitorByName(ctx, conn, d.Id())
 
 	if !d.IsNewResource() && tfresource.NotFound(err) {
 		log.Printf("[WARN] Internet Monitor Monitor (%s) not found, removing from state", d.Id())
@@ -185,17 +226,18 @@ func resourceMonitorRead(ctx context.Context, d *schema.ResourceData, meta inter
 		return sdkdiag.AppendErrorf(diags, "reading Internet Monitor Monitor (%s): %s", d.Id(), err)
 	}
 
-	err = d.Set("internet_measurements_log_delivery", flattenInternetMeasurementsLogDelivery(monitor.InternetMeasurementsLogDelivery))
-	if err != nil {
+	d.Set("arn", monitor.MonitorArn)
+	if err := d.Set("health_events_config", flattenHealthEventsConfig(monitor.HealthEventsConfig)); err != nil {
+		return sdkdiag.AppendErrorf(diags, "setting health_events_config: %s", err)
+	}
+	if err := d.Set("internet_measurements_log_delivery", flattenInternetMeasurementsLogDelivery(monitor.InternetMeasurementsLogDelivery)); err != nil {
 		return sdkdiag.AppendErrorf(diags, "setting internet_measurements_log_delivery: %s", err)
 	}
-
-	d.Set("arn", monitor.MonitorArn)
 	d.Set("monitor_name", monitor.MonitorName)
 	d.Set("max_city_networks_to_monitor", monitor.MaxCityNetworksToMonitor)
-	d.Set("traffic_percentage_to_monitor", monitor.TrafficPercentageToMonitor)
+	d.Set("resources", flex.FlattenStringValueSet(monitor.Resources))
 	d.Set("status", monitor.Status)
-	d.Set("resources", flex.FlattenStringSet(monitor.Resources))
+	d.Set("traffic_percentage_to_monitor", monitor.TrafficPercentageToMonitor)
 
 	setTagsOut(ctx, monitor.Tags)
 
@@ -204,7 +246,7 @@ func resourceMonitorRead(ctx context.Context, d *schema.ResourceData, meta inter
 
 func resourceMonitorUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).InternetMonitorConn(ctx)
+	conn := meta.(*conns.AWSClient).InternetMonitorClient(ctx)
 
 	if d.HasChangesExcept("tags", "tags_all") {
 		input := &internetmonitor.UpdateMonitorInput{
@@ -212,46 +254,46 @@ func resourceMonitorUpdate(ctx context.Context, d *schema.ResourceData, meta int
 			MonitorName: aws.String(d.Id()),
 		}
 
-		if d.HasChange("max_city_networks_to_monitor") {
-			input.MaxCityNetworksToMonitor = aws.Int64(int64(d.Get("max_city_networks_to_monitor").(int)))
-		}
-
-		if d.HasChange("traffic_percentage_to_monitor") {
-			input.TrafficPercentageToMonitor = aws.Int64(int64(d.Get("traffic_percentage_to_monitor").(int)))
-		}
-
-		if d.HasChange("status") {
-			input.Status = aws.String(d.Get("status").(string))
+		if d.HasChange("health_events_config") {
+			input.HealthEventsConfig = expandHealthEventsConfig(d.Get("health_events_config").([]interface{}))
 		}
 
 		if d.HasChange("internet_measurements_log_delivery") {
 			input.InternetMeasurementsLogDelivery = expandInternetMeasurementsLogDelivery(d.Get("internet_measurements_log_delivery").([]interface{}))
 		}
 
+		if d.HasChange("max_city_networks_to_monitor") {
+			input.MaxCityNetworksToMonitor = int32(d.Get("max_city_networks_to_monitor").(int))
+		}
+
 		if d.HasChange("resources") {
 			o, n := d.GetChange("resources")
 			os, ns := o.(*schema.Set), n.(*schema.Set)
-			remove := flex.ExpandStringValueSet(os.Difference(ns))
-			add := flex.ExpandStringValueSet(ns.Difference(os))
-
-			if len(add) > 0 {
-				input.ResourcesToAdd = aws.StringSlice(add)
+			if add := flex.ExpandStringValueSet(ns.Difference(os)); len(add) > 0 {
+				input.ResourcesToAdd = add
 			}
-
-			if len(remove) > 0 {
-				input.ResourcesToRemove = aws.StringSlice(remove)
+			if remove := flex.ExpandStringValueSet(os.Difference(ns)); len(remove) > 0 {
+				input.ResourcesToRemove = remove
 			}
 		}
 
-		log.Printf("[DEBUG] Updating Internet Monitor Monitor: %s", input)
-		_, err := conn.UpdateMonitorWithContext(ctx, input)
+		status := types.MonitorConfigState(d.Get("status").(string))
+		if d.HasChange("status") {
+			input.Status = status
+		}
+
+		if d.HasChange("traffic_percentage_to_monitor") {
+			input.TrafficPercentageToMonitor = int32(d.Get("traffic_percentage_to_monitor").(int))
+		}
+
+		_, err := conn.UpdateMonitor(ctx, input)
 
 		if err != nil {
 			return sdkdiag.AppendErrorf(diags, "updating Internet Monitor Monitor (%s): %s", d.Id(), err)
 		}
 
-		if err := waitMonitor(ctx, conn, d.Id(), d.Get("status").(string)); err != nil {
-			return sdkdiag.AppendErrorf(diags, "waiting for Internet Monitor Monitor (%s) update: %s", d.Id(), err)
+		if err := waitMonitor(ctx, conn, d.Id(), status); err != nil {
+			return sdkdiag.AppendErrorf(diags, "waiting for Internet Monitor Monitor (%s) %s: %s", d.Id(), status, err)
 		}
 	}
 
@@ -260,30 +302,36 @@ func resourceMonitorUpdate(ctx context.Context, d *schema.ResourceData, meta int
 
 func resourceMonitorDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).InternetMonitorConn(ctx)
+	conn := meta.(*conns.AWSClient).InternetMonitorClient(ctx)
 
 	input := &internetmonitor.UpdateMonitorInput{
 		ClientToken: aws.String(id.UniqueId()),
 		MonitorName: aws.String(d.Id()),
-		Status:      aws.String(internetmonitor.MonitorConfigStateInactive),
+		Status:      types.MonitorConfigStateInactive,
 	}
 
-	_, err := conn.UpdateMonitorWithContext(ctx, input)
+	_, err := conn.UpdateMonitor(ctx, input)
+
+	// if errs.IsA[*types.ResourceNotFoundException](err) {
+	if tfawserr.ErrCodeEquals(err, errCodeResourceNotFoundException) {
+		return diags
+	}
 
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "updating Internet Monitor Monitor (%s) to inactive before deletion: %s", d.Id(), err)
+		return sdkdiag.AppendErrorf(diags, "updating Internet Monitor Monitor (%s): %s", d.Id(), err)
 	}
 
-	if err := waitMonitor(ctx, conn, d.Id(), internetmonitor.MonitorConfigStateInactive); err != nil {
-		return sdkdiag.AppendErrorf(diags, "waiting for Internet Monitor Monitor (%s) to be inactive before deletion: %s", d.Id(), err)
+	if err := waitMonitor(ctx, conn, d.Id(), types.MonitorConfigStateInactive); err != nil {
+		return sdkdiag.AppendErrorf(diags, "waiting for Internet Monitor Monitor (%s) INACTIVE: %s", d.Id(), err)
 	}
 
 	log.Printf("[DEBUG] Deleting Internet Monitor Monitor: %s", d.Id())
-	_, err = conn.DeleteMonitorWithContext(ctx, &internetmonitor.DeleteMonitorInput{
+	_, err = conn.DeleteMonitor(ctx, &internetmonitor.DeleteMonitorInput{
 		MonitorName: aws.String(d.Id()),
 	})
 
-	if tfawserr.ErrCodeEquals(err, internetmonitor.ErrCodeNotFoundException) {
+	// if errs.IsA[*types.ResourceNotFoundException](err) {
+	if tfawserr.ErrCodeEquals(err, errCodeResourceNotFoundException) {
 		return diags
 	}
 
@@ -294,72 +342,168 @@ func resourceMonitorDelete(ctx context.Context, d *schema.ResourceData, meta int
 	return diags
 }
 
-func expandInternetMeasurementsLogDelivery(vInternetMeasurementsLogDelivery []interface{}) *internetmonitor.InternetMeasurementsLogDelivery {
-	if len(vInternetMeasurementsLogDelivery) == 0 || vInternetMeasurementsLogDelivery[0] == nil {
+func findMonitorByName(ctx context.Context, conn *internetmonitor.Client, name string) (*internetmonitor.GetMonitorOutput, error) {
+	input := &internetmonitor.GetMonitorInput{
+		MonitorName: aws.String(name),
+	}
+
+	output, err := conn.GetMonitor(ctx, input)
+
+	// if errs.IsA[*types.ResourceNotFoundException](err) {
+	if tfawserr.ErrCodeEquals(err, errCodeResourceNotFoundException) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	if output == nil {
+		return nil, tfresource.NewEmptyResultError(input)
+	}
+
+	return output, nil
+}
+
+func statusMonitor(ctx context.Context, conn *internetmonitor.Client, name string) retry.StateRefreshFunc {
+	return func() (interface{}, string, error) {
+		monitor, err := findMonitorByName(ctx, conn, name)
+
+		if tfresource.NotFound(err) {
+			return nil, "", nil
+		}
+
+		if err != nil {
+			return nil, "", err
+		}
+
+		return monitor, string(monitor.Status), nil
+	}
+}
+
+func waitMonitor(ctx context.Context, conn *internetmonitor.Client, name string, targetState types.MonitorConfigState) error {
+	const (
+		timeout = 5 * time.Minute
+	)
+	stateConf := &retry.StateChangeConf{
+		Pending: enum.Slice(types.MonitorConfigStatePending),
+		Target:  enum.Slice(targetState),
+		Refresh: statusMonitor(ctx, conn, name),
+		Timeout: timeout,
+		Delay:   10 * time.Second,
+	}
+
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+
+	if output, ok := outputRaw.(*internetmonitor.GetMonitorOutput); ok {
+		if status := output.Status; status == types.MonitorConfigStateError {
+			tfresource.SetLastError(err, errors.New(aws.ToString(output.ProcessingStatusInfo)))
+		}
+
+		return err
+	}
+
+	return err
+}
+
+func expandHealthEventsConfig(tfList []interface{}) *types.HealthEventsConfig {
+	if len(tfList) == 0 || tfList[0] == nil {
+		return nil
+	}
+
+	tfMap := tfList[0].(map[string]interface{})
+	apiObject := &types.HealthEventsConfig{}
+
+	if v, ok := tfMap["availability_score_threshold"].(float64); ok && v != 0.0 {
+		apiObject.AvailabilityScoreThreshold = v
+	}
+
+	if v, ok := tfMap["performance_score_threshold"].(float64); ok && v != 0.0 {
+		apiObject.PerformanceScoreThreshold = v
+	}
+
+	return apiObject
+}
+
+func expandInternetMeasurementsLogDelivery(tfList []interface{}) *types.InternetMeasurementsLogDelivery {
+	if len(tfList) == 0 || tfList[0] == nil {
 		return nil
 	}
-	mInternetMeasurementsLogDelivery := vInternetMeasurementsLogDelivery[0].(map[string]interface{})
 
-	logDelivery := &internetmonitor.InternetMeasurementsLogDelivery{}
+	tfMap := tfList[0].(map[string]interface{})
+	apiObject := &types.InternetMeasurementsLogDelivery{}
 
-	if v, ok := mInternetMeasurementsLogDelivery["s3_config"].([]interface{}); ok {
-		logDelivery.S3Config = expandS3Config(v)
+	if v, ok := tfMap["s3_config"].([]interface{}); ok {
+		apiObject.S3Config = expandS3Config(v)
 	}
 
-	return logDelivery
+	return apiObject
 }
 
-func expandS3Config(vS3Config []interface{}) *internetmonitor.S3Config {
-	if len(vS3Config) == 0 || vS3Config[0] == nil {
+func expandS3Config(tfList []interface{}) *types.S3Config {
+	if len(tfList) == 0 || tfList[0] == nil {
 		return nil
 	}
-	mS3Config := vS3Config[0].(map[string]interface{})
 
-	s3Config := &internetmonitor.S3Config{}
+	tfMap := tfList[0].(map[string]interface{})
+	apiObject := &types.S3Config{}
 
-	if v, ok := mS3Config["bucket_name"].(string); ok && v != "" {
-		s3Config.BucketName = aws.String(v)
+	if v, ok := tfMap["bucket_name"].(string); ok && v != "" {
+		apiObject.BucketName = aws.String(v)
 	}
 
-	if v, ok := mS3Config["bucket_prefix"].(string); ok && v != "" {
-		s3Config.BucketPrefix = aws.String(v)
+	if v, ok := tfMap["bucket_prefix"].(string); ok && v != "" {
+		apiObject.BucketPrefix = aws.String(v)
 	}
 
-	if v, ok := mS3Config["log_delivery_status"].(string); ok && v != "" {
-		s3Config.LogDeliveryStatus = aws.String(v)
+	if v, ok := tfMap["log_delivery_status"].(string); ok && v != "" {
+		apiObject.LogDeliveryStatus = types.LogDeliveryStatus(v)
 	}
 
-	return s3Config
+	return apiObject
 }
 
-func flattenInternetMeasurementsLogDelivery(internetMeasurementsLogDelivery *internetmonitor.InternetMeasurementsLogDelivery) []interface{} {
-	if internetMeasurementsLogDelivery == nil {
+func flattenHealthEventsConfig(apiObject *types.HealthEventsConfig) []interface{} {
+	if apiObject == nil {
 		return []interface{}{}
 	}
 
-	mInternetMeasurementsLogDelivery := map[string]interface{}{
-		"s3_config": flattenS3Config(internetMeasurementsLogDelivery.S3Config),
+	tfMap := map[string]interface{}{
+		"availability_score_threshold": apiObject.AvailabilityScoreThreshold,
+		"performance_score_threshold":  apiObject.PerformanceScoreThreshold,
 	}
 
-	return []interface{}{mInternetMeasurementsLogDelivery}
+	return []interface{}{tfMap}
 }
 
-func flattenS3Config(s3Config *internetmonitor.S3Config) []interface{} {
-	if s3Config == nil {
+func flattenInternetMeasurementsLogDelivery(apiObject *types.InternetMeasurementsLogDelivery) []interface{} {
+	if apiObject == nil {
 		return []interface{}{}
 	}
 
-	mS3Config := map[string]interface{}{
-		"bucket_name": aws.StringValue(s3Config.BucketName),
+	tfMap := map[string]interface{}{
+		"s3_config": flattenS3Config(apiObject.S3Config),
+	}
+
+	return []interface{}{tfMap}
+}
+
+func flattenS3Config(apiObject *types.S3Config) []interface{} {
+	if apiObject == nil {
+		return []interface{}{}
 	}
 
-	if s3Config.BucketPrefix != nil {
-		mS3Config["bucket_prefix"] = aws.StringValue(s3Config.BucketPrefix)
+	tfMap := map[string]interface{}{
+		"bucket_name":         aws.ToString(apiObject.BucketName),
+		"log_delivery_status": string(apiObject.LogDeliveryStatus),
 	}
 
-	if s3Config.LogDeliveryStatus != nil {
-		mS3Config["log_delivery_status"] = aws.StringValue(s3Config.LogDeliveryStatus)
+	if apiObject.BucketPrefix != nil {
+		tfMap["bucket_prefix"] = aws.ToString(apiObject.BucketPrefix)
 	}
 
-	return []interface{}{mS3Config}
+	return []interface{}{tfMap}
 }
diff --git a/internal/service/internetmonitor/monitor_test.go b/internal/service/internetmonitor/monitor_test.go
index 51f91886ac3..b9a37275ba7 100644
--- a/internal/service/internetmonitor/monitor_test.go
+++ b/internal/service/internetmonitor/monitor_test.go
@@ -1,12 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package internetmonitor_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/service/internetmonitor"
+	"github.com/YakDriver/regexache"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
@@ -14,6 +16,7 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	tfinternetmonitor "github.com/hashicorp/terraform-provider-aws/internal/service/internetmonitor"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
 func TestAccInternetMonitorMonitor_basic(t *testing.T) {
@@ -23,19 +26,23 @@ func TestAccInternetMonitorMonitor_basic(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, internetmonitor.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.InternetMonitorEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckMonitorDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccMonitorConfig_basic(rName),
-				Check: resource.ComposeTestCheckFunc(
+				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckMonitorExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "internetmonitor", regexp.MustCompile(`monitor/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "internetmonitor", regexache.MustCompile(`monitor/.+$`)),
+					resource.TestCheckResourceAttr(resourceName, "health_events_config.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "internet_measurements_log_delivery.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "max_city_networks_to_monitor", "0"),
 					resource.TestCheckResourceAttr(resourceName, "monitor_name", rName),
-					resource.TestCheckResourceAttr(resourceName, "traffic_percentage_to_monitor", "1"),
+					resource.TestCheckResourceAttr(resourceName, "resources.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "status", "ACTIVE"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
+					resource.TestCheckResourceAttr(resourceName, "traffic_percentage_to_monitor", "1"),
 				),
 			},
 			{
@@ -54,75 +61,92 @@ func TestAccInternetMonitorMonitor_basic(t *testing.T) {
 	})
 }
 
-func TestAccInternetMonitorMonitor_log(t *testing.T) {
+func TestAccInternetMonitorMonitor_disappears(t *testing.T) {
 	ctx := acctest.Context(t)
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_internetmonitor_monitor.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, internetmonitor.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.InternetMonitorEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckMonitorDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccMonitorConfig_log(rName),
+				Config: testAccMonitorConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckMonitorExists(ctx, resourceName),
-					resource.TestCheckResourceAttr(resourceName, "internet_measurements_log_delivery.#", "1"),
-					resource.TestCheckResourceAttr(resourceName, "internet_measurements_log_delivery.0.s3_config.#", "1"),
-					resource.TestCheckResourceAttr(resourceName, "internet_measurements_log_delivery.0.s3_config.0.bucket_name", rName),
+					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfinternetmonitor.ResourceMonitor(), resourceName),
 				),
-			},
-			{
-				ResourceName:      resourceName,
-				ImportState:       true,
-				ImportStateVerify: true,
+				ExpectNonEmptyPlan: true,
 			},
 		},
 	})
 }
 
-func TestAccInternetMonitorMonitor_disappears(t *testing.T) {
+func TestAccInternetMonitorMonitor_tags(t *testing.T) {
 	ctx := acctest.Context(t)
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_internetmonitor_monitor.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, internetmonitor.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.InternetMonitorEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckMonitorDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccMonitorConfig_basic(rName),
+				Config: testAccMonitorConfig_tags1(rName, "key1", "value1"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckMonitorExists(ctx, resourceName),
-					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfinternetmonitor.ResourceMonitor(), resourceName),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				Config: testAccMonitorConfig_tags2(rName, "key1", "value1updated", "key2", "value2"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckMonitorExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1updated"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
+				),
+			},
+			{
+				Config: testAccMonitorConfig_tags1(rName, "key2", "value2"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckMonitorExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
 				),
-				ExpectNonEmptyPlan: true,
 			},
 		},
 	})
 }
 
-func TestAccInternetMonitorMonitor_tags(t *testing.T) {
+func TestAccInternetMonitorMonitor_healthEventsConfig(t *testing.T) {
 	ctx := acctest.Context(t)
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_internetmonitor_monitor.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, internetmonitor.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.InternetMonitorEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckMonitorDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccMonitorConfig_tags1(rName, "key1", "value1"),
+				Config: testAccMonitorConfig_healthEventsConfig(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckMonitorExists(ctx, resourceName),
-					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
-					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
+					resource.TestCheckResourceAttr(resourceName, "health_events_config.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "health_events_config.0.availability_score_threshold", "50"),
+					resource.TestCheckResourceAttr(resourceName, "health_events_config.0.performance_score_threshold", "95"),
 				),
 			},
 			{
@@ -131,36 +155,57 @@ func TestAccInternetMonitorMonitor_tags(t *testing.T) {
 				ImportStateVerify: true,
 			},
 			{
-				Config: testAccMonitorConfig_tags2(rName, "key1", "value1updated", "key2", "value2"),
+				Config: testAccMonitorConfig_healthEventsConfigUpdated(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckMonitorExists(ctx, resourceName),
-					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
-					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1updated"),
-					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
+					resource.TestCheckResourceAttr(resourceName, "health_events_config.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "health_events_config.0.availability_score_threshold", "75"),
+					resource.TestCheckResourceAttr(resourceName, "health_events_config.0.performance_score_threshold", "85"),
 				),
 			},
+		},
+	})
+}
+
+func TestAccInternetMonitorMonitor_log(t *testing.T) {
+	ctx := acctest.Context(t)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_internetmonitor_monitor.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, names.InternetMonitorEndpointID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckMonitorDestroy(ctx),
+		Steps: []resource.TestStep{
 			{
-				Config: testAccMonitorConfig_tags1(rName, "key2", "value2"),
+				Config: testAccMonitorConfig_log(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckMonitorExists(ctx, resourceName),
-					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
-					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
+					resource.TestCheckResourceAttr(resourceName, "internet_measurements_log_delivery.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "internet_measurements_log_delivery.0.s3_config.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "internet_measurements_log_delivery.0.s3_config.0.bucket_name", rName),
 				),
 			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
 		},
 	})
 }
 
 func testAccCheckMonitorDestroy(ctx context.Context) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		conn := acctest.Provider.Meta().(*conns.AWSClient).InternetMonitorConn(ctx)
+		conn := acctest.Provider.Meta().(*conns.AWSClient).InternetMonitorClient(ctx)
 
 		for _, rs := range s.RootModule().Resources {
 			if rs.Type != "aws_internetmonitor_monitor" {
 				continue
 			}
 
-			_, err := tfinternetmonitor.FindMonitor(ctx, conn, rs.Primary.ID)
+			_, err := tfinternetmonitor.FindMonitorByName(ctx, conn, rs.Primary.ID)
 
 			if tfresource.NotFound(err) {
 				continue
@@ -170,27 +215,23 @@ func testAccCheckMonitorDestroy(ctx context.Context) resource.TestCheckFunc {
 				return err
 			}
 
-			return fmt.Errorf("InternetMonitor Monitor %s still exists", rs.Primary.ID)
+			return fmt.Errorf("Internet Monitor Monitor %s still exists", rs.Primary.ID)
 		}
 
 		return nil
 	}
 }
 
-func testAccCheckMonitorExists(ctx context.Context, resourceName string) resource.TestCheckFunc {
+func testAccCheckMonitorExists(ctx context.Context, n string) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		rs, ok := s.RootModule().Resources[resourceName]
+		rs, ok := s.RootModule().Resources[n]
 		if !ok {
-			return fmt.Errorf("Not found: %s", resourceName)
+			return fmt.Errorf("Not found: %s", n)
 		}
 
-		if rs.Primary.ID == "" {
-			return fmt.Errorf("No InternetMonitor Monitor ID is set")
-		}
-
-		conn := acctest.Provider.Meta().(*conns.AWSClient).InternetMonitorConn(ctx)
+		conn := acctest.Provider.Meta().(*conns.AWSClient).InternetMonitorClient(ctx)
 
-		_, err := tfinternetmonitor.FindMonitor(ctx, conn, rs.Primary.ID)
+		_, err := tfinternetmonitor.FindMonitorByName(ctx, conn, rs.Primary.ID)
 
 		return err
 	}
@@ -215,6 +256,33 @@ resource "aws_internetmonitor_monitor" "test" {
 `, rName, status)
 }
 
+func testAccMonitorConfig_healthEventsConfig(rName string) string {
+	return fmt.Sprintf(`
+resource "aws_internetmonitor_monitor" "test" {
+  monitor_name                 = %[1]q
+  max_city_networks_to_monitor = 2
+
+  health_events_config {
+    availability_score_threshold = 50
+  }
+}
+`, rName)
+}
+
+func testAccMonitorConfig_healthEventsConfigUpdated(rName string) string {
+	return fmt.Sprintf(`
+resource "aws_internetmonitor_monitor" "test" {
+  monitor_name                 = %[1]q
+  max_city_networks_to_monitor = 2
+
+  health_events_config {
+    availability_score_threshold = 75
+    performance_score_threshold  = 85
+  }
+}
+`, rName)
+}
+
 func testAccMonitorConfig_log(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_s3_bucket" "test" {
diff --git a/internal/service/internetmonitor/service_package_gen.go b/internal/service/internetmonitor/service_package_gen.go
index 00a914b158c..1986a01bd79 100644
--- a/internal/service/internetmonitor/service_package_gen.go
+++ b/internal/service/internetmonitor/service_package_gen.go
@@ -5,9 +5,9 @@ package internetmonitor
 import (
 	"context"
 
-	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
-	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
-	internetmonitor_sdkv1 "github.com/aws/aws-sdk-go/service/internetmonitor"
+	aws_sdkv2 "github.com/aws/aws-sdk-go-v2/aws"
+	internetmonitor_sdkv2 "github.com/aws/aws-sdk-go-v2/service/internetmonitor"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -29,7 +29,7 @@ func (p *servicePackage) SDKDataSources(ctx context.Context) []*types.ServicePac
 func (p *servicePackage) SDKResources(ctx context.Context) []*types.ServicePackageSDKResource {
 	return []*types.ServicePackageSDKResource{
 		{
-			Factory:  ResourceMonitor,
+			Factory:  resourceMonitor,
 			TypeName: "aws_internetmonitor_monitor",
 			Name:     "Monitor",
 			Tags: &types.ServicePackageResourceTags{
@@ -43,11 +43,17 @@ func (p *servicePackage) ServicePackageName() string {
 	return names.InternetMonitor
 }
 
-// NewConn returns a new AWS SDK for Go v1 client for this service package's AWS API.
-func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*internetmonitor_sdkv1.InternetMonitor, error) {
-	sess := config["session"].(*session_sdkv1.Session)
+// NewClient returns a new AWS SDK for Go v2 client for this service package's AWS API.
+func (p *servicePackage) NewClient(ctx context.Context, config map[string]any) (*internetmonitor_sdkv2.Client, error) {
+	cfg := *(config["aws_sdkv2_config"].(*aws_sdkv2.Config))
 
-	return internetmonitor_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
+	return internetmonitor_sdkv2.NewFromConfig(cfg, func(o *internetmonitor_sdkv2.Options) {
+		if endpoint := config["endpoint"].(string); endpoint != "" {
+			o.BaseEndpoint = aws_sdkv2.String(endpoint)
+		}
+	}), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/internetmonitor/status.go b/internal/service/internetmonitor/status.go
deleted file mode 100644
index 9ec04517248..00000000000
--- a/internal/service/internetmonitor/status.go
+++ /dev/null
@@ -1,26 +0,0 @@
-package internetmonitor
-
-import (
-	"context"
-
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/internetmonitor"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
-	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
-)
-
-func statusMonitor(ctx context.Context, conn *internetmonitor.InternetMonitor, name string) retry.StateRefreshFunc {
-	return func() (interface{}, string, error) {
-		monitor, err := FindMonitor(ctx, conn, name)
-
-		if tfresource.NotFound(err) {
-			return nil, "", nil
-		}
-
-		if err != nil {
-			return nil, "", err
-		}
-
-		return monitor, aws.StringValue(monitor.Status), nil
-	}
-}
diff --git a/internal/service/internetmonitor/sweep.go b/internal/service/internetmonitor/sweep.go
index 7b1f7456b16..19dcc1fa4b6 100644
--- a/internal/service/internetmonitor/sweep.go
+++ b/internal/service/internetmonitor/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package internetmonitor
 
@@ -7,14 +7,14 @@ import (
 	"fmt"
 	"log"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/internetmonitor"
-	"github.com/hashicorp/go-multierror"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/internetmonitor"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv2"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_internetmonitor_monitor", &resource.Sweeper{
 		Name: "aws_internetmonitor_monitor",
 		F:    sweepMonitors,
@@ -23,46 +23,41 @@ func init() {
 
 func sweepMonitors(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
-
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
-
-	conn := client.InternetMonitorConn(ctx)
+	input := &internetmonitor.ListMonitorsInput{}
+	conn := client.InternetMonitorClient(ctx)
 	sweepResources := make([]sweep.Sweepable, 0)
-	var errs *multierror.Error
 
-	err = conn.ListMonitorsPagesWithContext(ctx, &internetmonitor.ListMonitorsInput{}, func(resp *internetmonitor.ListMonitorsOutput, lastPage bool) bool {
-		if len(resp.Monitors) == 0 {
-			log.Print("[DEBUG] No InternetMonitor Monitors to sweep")
-			return !lastPage
+	pages := internetmonitor.NewListMonitorsPaginator(conn, input)
+	for pages.HasMorePages() {
+		page, err := pages.NextPage(ctx)
+
+		if awsv2.SkipSweepError(err) {
+			log.Printf("[WARN] Skipping Internet Monitor Monitor sweep for %s: %s", region, err)
+			return nil
 		}
 
-		for _, c := range resp.Monitors {
-			r := ResourceMonitor()
+		if err != nil {
+			return fmt.Errorf("error listing Internet Monitor Monitors (%s): %w", region, err)
+		}
+
+		for _, v := range page.Monitors {
+			r := resourceMonitor()
 			d := r.Data(nil)
-			d.SetId(aws.StringValue(c.MonitorName))
+			d.SetId(aws.ToString(v.MonitorName))
 
 			sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
 		}
-
-		return !lastPage
-	})
-
-	if err != nil {
-		errs = multierror.Append(errs, fmt.Errorf("error describing InternetMonitor Monitors: %w", err))
-		// in case work can be done, don't jump out yet
 	}
 
-	if err = sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
-		errs = multierror.Append(errs, fmt.Errorf("error sweeping InternetMonitor Monitors for %s: %w", region, err))
-	}
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
-		log.Printf("[WARN] Skipping InternetMonitor Monitor sweep for %s: %s", region, err)
-		return nil
+	if err != nil {
+		return fmt.Errorf("error sweeping Internet Monitor Monitors (%s): %w", region, err)
 	}
 
-	return errs.ErrorOrNil()
+	return nil
 }
diff --git a/internal/service/internetmonitor/tags_gen.go b/internal/service/internetmonitor/tags_gen.go
index fa5ba7c3465..5842f249c4c 100644
--- a/internal/service/internetmonitor/tags_gen.go
+++ b/internal/service/internetmonitor/tags_gen.go
@@ -5,10 +5,11 @@ import (
 	"context"
 	"fmt"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/internetmonitor"
-	"github.com/aws/aws-sdk-go/service/internetmonitor/internetmonitoriface"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/internetmonitor"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -17,12 +18,12 @@ import (
 // listTags lists internetmonitor service tags.
 // The identifier is typically the Amazon Resource Name (ARN), although
 // it may also be a different identifier depending on the service.
-func listTags(ctx context.Context, conn internetmonitoriface.InternetMonitorAPI, identifier string) (tftags.KeyValueTags, error) {
+func listTags(ctx context.Context, conn *internetmonitor.Client, identifier string) (tftags.KeyValueTags, error) {
 	input := &internetmonitor.ListTagsForResourceInput{
 		ResourceArn: aws.String(identifier),
 	}
 
-	output, err := conn.ListTagsForResourceWithContext(ctx, input)
+	output, err := conn.ListTagsForResource(ctx, input)
 
 	if err != nil {
 		return tftags.New(ctx, nil), err
@@ -34,7 +35,7 @@ func listTags(ctx context.Context, conn internetmonitoriface.InternetMonitorAPI,
 // ListTags lists internetmonitor service tags and set them in Context.
 // It is called from outside this package.
 func (p *servicePackage) ListTags(ctx context.Context, meta any, identifier string) error {
-	tags, err := listTags(ctx, meta.(*conns.AWSClient).InternetMonitorConn(ctx), identifier)
+	tags, err := listTags(ctx, meta.(*conns.AWSClient).InternetMonitorClient(ctx), identifier)
 
 	if err != nil {
 		return err
@@ -47,21 +48,21 @@ func (p *servicePackage) ListTags(ctx context.Context, meta any, identifier stri
 	return nil
 }
 
-// map[string]*string handling
+// map[string]string handling
 
 // Tags returns internetmonitor service tags.
-func Tags(tags tftags.KeyValueTags) map[string]*string {
-	return aws.StringMap(tags.Map())
+func Tags(tags tftags.KeyValueTags) map[string]string {
+	return tags.Map()
 }
 
-// KeyValueTags creates KeyValueTags from internetmonitor service tags.
-func KeyValueTags(ctx context.Context, tags map[string]*string) tftags.KeyValueTags {
+// KeyValueTags creates tftags.KeyValueTags from internetmonitor service tags.
+func KeyValueTags(ctx context.Context, tags map[string]string) tftags.KeyValueTags {
 	return tftags.New(ctx, tags)
 }
 
 // getTagsIn returns internetmonitor service tags from Context.
 // nil is returned if there are no input tags.
-func getTagsIn(ctx context.Context) map[string]*string {
+func getTagsIn(ctx context.Context) map[string]string {
 	if inContext, ok := tftags.FromContext(ctx); ok {
 		if tags := Tags(inContext.TagsIn.UnwrapOrDefault()); len(tags) > 0 {
 			return tags
@@ -72,7 +73,7 @@ func getTagsIn(ctx context.Context) map[string]*string {
 }
 
 // setTagsOut sets internetmonitor service tags in Context.
-func setTagsOut(ctx context.Context, tags map[string]*string) {
+func setTagsOut(ctx context.Context, tags map[string]string) {
 	if inContext, ok := tftags.FromContext(ctx); ok {
 		inContext.TagsOut = types.Some(KeyValueTags(ctx, tags))
 	}
@@ -81,19 +82,21 @@ func setTagsOut(ctx context.Context, tags map[string]*string) {
 // updateTags updates internetmonitor service tags.
 // The identifier is typically the Amazon Resource Name (ARN), although
 // it may also be a different identifier depending on the service.
-func updateTags(ctx context.Context, conn internetmonitoriface.InternetMonitorAPI, identifier string, oldTagsMap, newTagsMap any) error {
+func updateTags(ctx context.Context, conn *internetmonitor.Client, identifier string, oldTagsMap, newTagsMap any) error {
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.InternetMonitor)
 	if len(removedTags) > 0 {
 		input := &internetmonitor.UntagResourceInput{
 			ResourceArn: aws.String(identifier),
-			TagKeys:     aws.StringSlice(removedTags.Keys()),
+			TagKeys:     removedTags.Keys(),
 		}
 
-		_, err := conn.UntagResourceWithContext(ctx, input)
+		_, err := conn.UntagResource(ctx, input)
 
 		if err != nil {
 			return fmt.Errorf("untagging resource (%s): %w", identifier, err)
@@ -108,7 +111,7 @@ func updateTags(ctx context.Context, conn internetmonitoriface.InternetMonitorAP
 			Tags:        Tags(updatedTags),
 		}
 
-		_, err := conn.TagResourceWithContext(ctx, input)
+		_, err := conn.TagResource(ctx, input)
 
 		if err != nil {
 			return fmt.Errorf("tagging resource (%s): %w", identifier, err)
@@ -121,5 +124,5 @@ func updateTags(ctx context.Context, conn internetmonitoriface.InternetMonitorAP
 // UpdateTags updates internetmonitor service tags.
 // It is called from outside this package.
 func (p *servicePackage) UpdateTags(ctx context.Context, meta any, identifier string, oldTags, newTags any) error {
-	return updateTags(ctx, meta.(*conns.AWSClient).InternetMonitorConn(ctx), identifier, oldTags, newTags)
+	return updateTags(ctx, meta.(*conns.AWSClient).InternetMonitorClient(ctx), identifier, oldTags, newTags)
 }
diff --git a/internal/service/internetmonitor/wait.go b/internal/service/internetmonitor/wait.go
deleted file mode 100644
index cc4a7d77006..00000000000
--- a/internal/service/internetmonitor/wait.go
+++ /dev/null
@@ -1,38 +0,0 @@
-package internetmonitor
-
-import (
-	"context"
-	"errors"
-	"time"
-
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/internetmonitor"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
-	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
-)
-
-const (
-	monitorCreatedTimeout = 5 * time.Minute
-)
-
-func waitMonitor(ctx context.Context, conn *internetmonitor.InternetMonitor, name, target string) error {
-	stateConf := &retry.StateChangeConf{
-		Pending: []string{internetmonitor.MonitorConfigStatePending},
-		Target:  []string{target},
-		Refresh: statusMonitor(ctx, conn, name),
-		Timeout: monitorCreatedTimeout,
-		Delay:   10 * time.Second,
-	}
-
-	outputRaw, err := stateConf.WaitForStateContext(ctx)
-
-	if output, ok := outputRaw.(*internetmonitor.GetMonitorOutput); ok {
-		if statusCode := aws.StringValue(output.Status); statusCode == internetmonitor.MonitorConfigStateError {
-			tfresource.SetLastError(err, errors.New(aws.StringValue(output.ProcessingStatusInfo)))
-		}
-
-		return err
-	}
-
-	return err
-}
diff --git a/internal/service/iot/authorizer.go b/internal/service/iot/authorizer.go
index ed2cda43f9b..41fa7adbbe1 100644
--- a/internal/service/iot/authorizer.go
+++ b/internal/service/iot/authorizer.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iot
 
 import (
 	"context"
 	"errors"
 	"log"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/iot"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -53,7 +56,7 @@ func ResourceAuthorizer() *schema.Resource {
 				Required: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 128),
-					validation.StringMatch(regexp.MustCompile(`^[\w=,@-]+`), "must contain only alphanumeric characters, underscores, and hyphens"),
+					validation.StringMatch(regexache.MustCompile(`^[\w=,@-]+`), "must contain only alphanumeric characters, underscores, and hyphens"),
 				),
 			},
 			"signing_disabled": {
@@ -72,7 +75,7 @@ func ResourceAuthorizer() *schema.Resource {
 				Optional: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 128),
-					validation.StringMatch(regexp.MustCompile(`^[A-Za-z0-9_-]+`), "must contain only alphanumeric characters, underscores, and hyphens"),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_-]+`), "must contain only alphanumeric characters, underscores, and hyphens"),
 				),
 			},
 			"token_signing_public_keys": {
diff --git a/internal/service/iot/authorizer_test.go b/internal/service/iot/authorizer_test.go
index e0fcd05ddf5..bc0781043b0 100644
--- a/internal/service/iot/authorizer_test.go
+++ b/internal/service/iot/authorizer_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iot_test
 
 import (
@@ -203,7 +206,7 @@ func testAccCheckAuthorizerDestroy(ctx context.Context) resource.TestCheckFunc {
 	}
 }
 
-func testAccAuthorizerBaseConfig(rName string) string {
+func testAccAuthorizerConfig_base(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_iam_role" "test" {
   name = %[1]q
@@ -237,7 +240,7 @@ resource "aws_lambda_function" "test" {
 }
 
 func testAccAuthorizerConfig_basic(rName string) string {
-	return acctest.ConfigCompose(testAccAuthorizerBaseConfig(rName), fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccAuthorizerConfig_base(rName), fmt.Sprintf(`
 resource "aws_iot_authorizer" "test" {
   name                    = %[1]q
   authorizer_function_arn = aws_lambda_function.test.arn
@@ -251,7 +254,7 @@ resource "aws_iot_authorizer" "test" {
 }
 
 func testAccAuthorizerConfig_updated(rName string) string {
-	return acctest.ConfigCompose(testAccAuthorizerBaseConfig(rName), fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccAuthorizerConfig_base(rName), fmt.Sprintf(`
 resource "aws_iot_authorizer" "test" {
   name                    = %[1]q
   authorizer_function_arn = aws_lambda_function.test.arn
@@ -269,7 +272,7 @@ resource "aws_iot_authorizer" "test" {
 }
 
 func testAccAuthorizerConfig_signingDisabled(rName string) string {
-	return acctest.ConfigCompose(testAccAuthorizerBaseConfig(rName), fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccAuthorizerConfig_base(rName), fmt.Sprintf(`
 resource "aws_iot_authorizer" "test" {
   name                    = %[1]q
   authorizer_function_arn = aws_lambda_function.test.arn
diff --git a/internal/service/iot/certificate.go b/internal/service/iot/certificate.go
index 46cc94bcd2e..9ba99b81fda 100644
--- a/internal/service/iot/certificate.go
+++ b/internal/service/iot/certificate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iot
 
 import (
diff --git a/internal/service/iot/certificate_test.go b/internal/service/iot/certificate_test.go
index 05ea0f9a396..8b6489a3c46 100644
--- a/internal/service/iot/certificate_test.go
+++ b/internal/service/iot/certificate_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iot_test
 
 import (
diff --git a/internal/service/iot/consts.go b/internal/service/iot/consts.go
index 6e573097288..57bbf5672b7 100644
--- a/internal/service/iot/consts.go
+++ b/internal/service/iot/consts.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iot
 
 import (
diff --git a/internal/service/iot/domain_configuration.go b/internal/service/iot/domain_configuration.go
new file mode 100644
index 00000000000..6d9ffa0fd5a
--- /dev/null
+++ b/internal/service/iot/domain_configuration.go
@@ -0,0 +1,368 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package iot
+
+import (
+	"context"
+	"log"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/iot"
+	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
+	"github.com/hashicorp/terraform-provider-aws/internal/flex"
+	tfslices "github.com/hashicorp/terraform-provider-aws/internal/slices"
+	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/internal/verify"
+	"github.com/hashicorp/terraform-provider-aws/names"
+)
+
+// @SDKResource("aws_iot_domain_configuration", name="Domain Configuration")
+// @Tags(identifierAttribute="arn")
+func ResourceDomainConfiguration() *schema.Resource {
+	return &schema.Resource{
+		CreateWithoutTimeout: resourceDomainConfigurationCreate,
+		ReadWithoutTimeout:   resourceDomainConfigurationRead,
+		UpdateWithoutTimeout: resourceDomainConfigurationUpdate,
+		DeleteWithoutTimeout: resourceDomainConfigurationDelete,
+
+		Importer: &schema.ResourceImporter{
+			StateContext: schema.ImportStatePassthroughContext,
+		},
+
+		CustomizeDiff: verify.SetTagsDiff,
+
+		Schema: map[string]*schema.Schema{
+			"arn": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"authorizer_config": {
+				Type:     schema.TypeList,
+				Optional: true,
+				MaxItems: 1,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"allow_authorizer_override": {
+							Type:     schema.TypeBool,
+							Optional: true,
+						},
+						"default_authorizer_name": {
+							Type:     schema.TypeString,
+							Optional: true,
+						},
+					},
+				},
+			},
+			"domain_name": {
+				Type:     schema.TypeString,
+				Optional: true,
+				ForceNew: true,
+			},
+			"domain_type": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"name": {
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+			"server_certificate_arns": {
+				Type:     schema.TypeSet,
+				Optional: true,
+				ForceNew: true,
+				Elem: &schema.Schema{
+					Type:         schema.TypeString,
+					ValidateFunc: verify.ValidARN,
+				},
+			},
+			"service_type": {
+				Type:         schema.TypeString,
+				Optional:     true,
+				ForceNew:     true,
+				Default:      iot.ServiceTypeData,
+				ValidateFunc: validation.StringInSlice(iot.ServiceType_Values(), false),
+			},
+			"status": {
+				Type:         schema.TypeString,
+				Optional:     true,
+				Default:      iot.DomainConfigurationStatusEnabled,
+				ValidateFunc: validation.StringInSlice(iot.DomainConfigurationStatus_Values(), false),
+			},
+			names.AttrTags:    tftags.TagsSchema(),
+			names.AttrTagsAll: tftags.TagsSchemaComputed(),
+			"tls_config": {
+				Type:     schema.TypeList,
+				Optional: true,
+				Computed: true,
+				MaxItems: 1,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"security_policy": {
+							Type:     schema.TypeString,
+							Optional: true,
+							Computed: true,
+						},
+					},
+				},
+			},
+			"validation_certificate_arn": {
+				Type:         schema.TypeString,
+				Optional:     true,
+				ForceNew:     true,
+				ValidateFunc: verify.ValidARN,
+			},
+		},
+	}
+}
+
+func resourceDomainConfigurationCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).IoTConn(ctx)
+
+	name := d.Get("name").(string)
+	input := &iot.CreateDomainConfigurationInput{
+		DomainConfigurationName: aws.String(name),
+		Tags:                    getTagsIn(ctx),
+	}
+
+	if v, ok := d.GetOk("authorizer_config"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
+		input.AuthorizerConfig = expandAuthorizerConfig(v.([]interface{})[0].(map[string]interface{}))
+	}
+
+	if v, ok := d.GetOk("domain_name"); ok {
+		input.DomainName = aws.String(v.(string))
+	}
+
+	if v, ok := d.GetOk("server_certificate_arns"); ok && v.(*schema.Set).Len() > 0 {
+		input.ServerCertificateArns = flex.ExpandStringSet(v.(*schema.Set))
+	}
+
+	if v, ok := d.GetOk("service_type"); ok {
+		input.ServiceType = aws.String(v.(string))
+	}
+
+	if v, ok := d.GetOk("tls_config"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
+		input.TlsConfig = expandTlsConfig(v.([]interface{})[0].(map[string]interface{}))
+	}
+
+	if v, ok := d.GetOk("validation_certificate_arn"); ok {
+		input.ValidationCertificateArn = aws.String(v.(string))
+	}
+
+	output, err := conn.CreateDomainConfigurationWithContext(ctx, input)
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "creating IoT Domain Configuration (%s): %s", name, err)
+	}
+
+	d.SetId(aws.StringValue(output.DomainConfigurationName))
+
+	return append(diags, resourceDomainConfigurationRead(ctx, d, meta)...)
+}
+
+func resourceDomainConfigurationRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).IoTConn(ctx)
+
+	output, err := FindDomainConfigurationByName(ctx, conn, d.Id())
+
+	if !d.IsNewResource() && tfresource.NotFound(err) {
+		log.Printf("[WARN] IoT Domain Configuration (%s) not found, removing from state", d.Id())
+		d.SetId("")
+		return diags
+	}
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "reading IoT Domain Configuration (%s): %s", d.Id(), err)
+	}
+
+	d.Set("arn", output.DomainConfigurationArn)
+	if output.AuthorizerConfig != nil {
+		if err := d.Set("authorizer_config", []interface{}{flattenAuthorizerConfig(output.AuthorizerConfig)}); err != nil {
+			return diag.Errorf("setting authorizer_config: %s", err)
+		}
+	} else {
+		d.Set("authorizer_config", nil)
+	}
+	d.Set("domain_name", output.DomainName)
+	d.Set("domain_type", output.DomainType)
+	d.Set("name", output.DomainConfigurationName)
+	d.Set("server_certificate_arns", tfslices.ApplyToAll(output.ServerCertificates, func(v *iot.ServerCertificateSummary) string {
+		return aws.StringValue(v.ServerCertificateArn)
+	}))
+	d.Set("service_type", output.ServiceType)
+	d.Set("status", output.DomainConfigurationStatus)
+	if output.TlsConfig != nil {
+		if err := d.Set("tls_config", []interface{}{flattenTlsConfig(output.TlsConfig)}); err != nil {
+			return diag.Errorf("setting tls_config: %s", err)
+		}
+	} else {
+		d.Set("tls_config", nil)
+	}
+	d.Set("validation_certificate_arn", d.Get("validation_certificate_arn"))
+
+	return nil
+}
+
+func resourceDomainConfigurationUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).IoTConn(ctx)
+
+	if d.HasChangesExcept("tags", "tags_all") {
+		input := &iot.UpdateDomainConfigurationInput{
+			DomainConfigurationName: aws.String(d.Id()),
+		}
+
+		if d.HasChange("authorizer_config") {
+			if v, ok := d.GetOk("authorizer_config"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
+				input.AuthorizerConfig = expandAuthorizerConfig(v.([]interface{})[0].(map[string]interface{}))
+			} else {
+				input.RemoveAuthorizerConfig = aws.Bool(true)
+			}
+		}
+
+		if d.HasChange("status") {
+			input.DomainConfigurationStatus = aws.String(d.Get("status").(string))
+		}
+
+		if d.HasChange("tls_config") {
+			if v, ok := d.GetOk("tls_config"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
+				input.TlsConfig = expandTlsConfig(v.([]interface{})[0].(map[string]interface{}))
+			}
+		}
+
+		_, err := conn.UpdateDomainConfigurationWithContext(ctx, input)
+
+		if err != nil {
+			return sdkdiag.AppendErrorf(diags, "updating IoT Domain Configuration (%s): %s", d.Id(), err)
+		}
+	}
+
+	return append(diags, resourceDomainConfigurationRead(ctx, d, meta)...)
+}
+
+func resourceDomainConfigurationDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).IoTConn(ctx)
+
+	if d.Get("status").(string) == iot.DomainConfigurationStatusEnabled {
+		log.Printf("[DEBUG] Disabling IoT Domain Configuration: %s", d.Id())
+		_, err := conn.UpdateDomainConfigurationWithContext(ctx, &iot.UpdateDomainConfigurationInput{
+			DomainConfigurationName:   aws.String(d.Id()),
+			DomainConfigurationStatus: aws.String(iot.DomainConfigurationStatusDisabled),
+		})
+
+		if err != nil {
+			return sdkdiag.AppendErrorf(diags, "disabling IoT Domain Configuration (%s): %s", d.Id(), err)
+		}
+	}
+
+	log.Printf("[DEBUG] Deleting IoT Domain Configuration: %s", d.Id())
+	_, err := conn.DeleteDomainConfigurationWithContext(ctx, &iot.DeleteDomainConfigurationInput{
+		DomainConfigurationName: aws.String(d.Id()),
+	})
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "deleting IoT Domain Configuration (%s): %s", d.Id(), err)
+	}
+
+	return diags
+}
+
+func FindDomainConfigurationByName(ctx context.Context, conn *iot.IoT, name string) (*iot.DescribeDomainConfigurationOutput, error) {
+	input := &iot.DescribeDomainConfigurationInput{
+		DomainConfigurationName: aws.String(name),
+	}
+
+	output, err := conn.DescribeDomainConfigurationWithContext(ctx, input)
+
+	if tfawserr.ErrCodeEquals(err, iot.ErrCodeResourceNotFoundException) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	if output == nil {
+		return nil, tfresource.NewEmptyResultError(input)
+	}
+
+	return output, nil
+}
+
+func expandAuthorizerConfig(tfMap map[string]interface{}) *iot.AuthorizerConfig {
+	if tfMap == nil {
+		return nil
+	}
+
+	apiObject := &iot.AuthorizerConfig{}
+
+	if v, ok := tfMap["allow_authorizer_override"].(bool); ok {
+		apiObject.AllowAuthorizerOverride = aws.Bool(v)
+	}
+
+	if v, ok := tfMap["default_authorizer_name"].(string); ok && v != "" {
+		apiObject.DefaultAuthorizerName = aws.String(v)
+	}
+
+	return apiObject
+}
+
+func expandTlsConfig(tfMap map[string]interface{}) *iot.TlsConfig { // nosemgrep:ci.caps5-in-func-name
+	if tfMap == nil {
+		return nil
+	}
+
+	apiObject := &iot.TlsConfig{}
+
+	if v, ok := tfMap["security_policy"].(string); ok && v != "" {
+		apiObject.SecurityPolicy = aws.String(v)
+	}
+
+	return apiObject
+}
+
+func flattenAuthorizerConfig(apiObject *iot.AuthorizerConfig) map[string]interface{} {
+	if apiObject == nil {
+		return nil
+	}
+
+	tfMap := map[string]interface{}{}
+
+	if v := apiObject.AllowAuthorizerOverride; v != nil {
+		tfMap["allow_authorizer_override"] = aws.BoolValue(v)
+	}
+
+	if v := apiObject.DefaultAuthorizerName; v != nil {
+		tfMap["default_authorizer_name"] = aws.StringValue(v)
+	}
+
+	return tfMap
+}
+
+func flattenTlsConfig(apiObject *iot.TlsConfig) map[string]interface{} { // nosemgrep:ci.caps5-in-func-name
+	if apiObject == nil {
+		return nil
+	}
+
+	tfMap := map[string]interface{}{}
+
+	if v := apiObject.SecurityPolicy; v != nil {
+		tfMap["security_policy"] = aws.StringValue(v)
+	}
+
+	return tfMap
+}
diff --git a/internal/service/iot/domain_configuration_test.go b/internal/service/iot/domain_configuration_test.go
new file mode 100644
index 00000000000..bc0b1754316
--- /dev/null
+++ b/internal/service/iot/domain_configuration_test.go
@@ -0,0 +1,353 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package iot_test
+
+import (
+	"context"
+	"fmt"
+	"testing"
+
+	"github.com/aws/aws-sdk-go/service/iot"
+	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
+	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	tfiot "github.com/hashicorp/terraform-provider-aws/internal/service/iot"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+)
+
+func TestAccIoTDomainConfiguration_basic(t *testing.T) {
+	ctx := acctest.Context(t)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	rootDomain := acctest.ACMCertificateDomainFromEnv(t)
+	domain := acctest.ACMCertificateRandomSubDomain(rootDomain)
+	resourceName := "aws_iot_domain_configuration.test"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, iot.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckDomainConfigurationDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccDomainConfigurationConfig_basic(rName, rootDomain, domain),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckDomainConfigurationExists(ctx, resourceName),
+					resource.TestCheckResourceAttrSet(resourceName, "arn"),
+					resource.TestCheckResourceAttr(resourceName, "authorizer_config.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "domain_name", domain),
+					resource.TestCheckResourceAttr(resourceName, "domain_type", "CUSTOMER_MANAGED"),
+					resource.TestCheckResourceAttr(resourceName, "name", rName),
+					resource.TestCheckResourceAttr(resourceName, "server_certificate_arns.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "service_type", "DATA"),
+					resource.TestCheckResourceAttr(resourceName, "status", "ENABLED"),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
+					resource.TestCheckResourceAttr(resourceName, "tls_config.#", "1"),
+					resource.TestCheckResourceAttrSet(resourceName, "tls_config.0.security_policy"),
+					resource.TestCheckResourceAttr(resourceName, "validation_certificate_arn", ""),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
+func TestAccIoTDomainConfiguration_disappears(t *testing.T) {
+	ctx := acctest.Context(t)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	rootDomain := acctest.ACMCertificateDomainFromEnv(t)
+	domain := acctest.ACMCertificateRandomSubDomain(rootDomain)
+	resourceName := "aws_iot_domain_configuration.test"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, iot.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckDomainConfigurationDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccDomainConfigurationConfig_basic(rName, rootDomain, domain),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckDomainConfigurationExists(ctx, resourceName),
+					resource.TestCheckResourceAttrSet(resourceName, "arn"),
+					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfiot.ResourceDomainConfiguration(), resourceName),
+				),
+				ExpectNonEmptyPlan: true,
+			},
+		},
+	})
+}
+
+func TestAccIoTDomainConfiguration_tags(t *testing.T) {
+	ctx := acctest.Context(t)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	rootDomain := acctest.ACMCertificateDomainFromEnv(t)
+	domain := acctest.ACMCertificateRandomSubDomain(rootDomain)
+	resourceName := "aws_iot_domain_configuration.test"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, iot.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckDomainConfigurationDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccDomainConfigurationConfig_tags1(rName, rootDomain, domain, "key1", "value1"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckDomainConfigurationExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				Config: testAccDomainConfigurationConfig_tags2(rName, rootDomain, domain, "key1", "value1updated", "key2", "value2"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckDomainConfigurationExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1updated"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
+				),
+			},
+			{
+				Config: testAccDomainConfigurationConfig_tags1(rName, rootDomain, domain, "key2", "value2"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckDomainConfigurationExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccIoTDomainConfiguration_update(t *testing.T) {
+	ctx := acctest.Context(t)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	rootDomain := acctest.ACMCertificateDomainFromEnv(t)
+	domain := acctest.ACMCertificateRandomSubDomain(rootDomain)
+	resourceName := "aws_iot_domain_configuration.test"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, iot.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckDomainConfigurationDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccDomainConfigurationConfig_securityPolicy(rName, rootDomain, domain, "IoTSecurityPolicy_TLS13_1_3_2022_10", true),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckDomainConfigurationExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "authorizer_config.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "authorizer_config.0.allow_authorizer_override", "true"),
+					resource.TestCheckResourceAttr(resourceName, "tls_config.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tls_config.0.security_policy", "IoTSecurityPolicy_TLS13_1_3_2022_10"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				Config: testAccDomainConfigurationConfig_securityPolicy(rName, rootDomain, domain, "IoTSecurityPolicy_TLS13_1_2_2022_10", false),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckDomainConfigurationExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "authorizer_config.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "authorizer_config.0.allow_authorizer_override", "false"),
+					resource.TestCheckResourceAttr(resourceName, "tls_config.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tls_config.0.security_policy", "IoTSecurityPolicy_TLS13_1_2_2022_10"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccIoTDomainConfiguration_awsManaged(t *testing.T) { // nosemgrep:ci.aws-in-func-name
+	ctx := acctest.Context(t)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_iot_domain_configuration.test"
+
+	acctest.SkipIfEnvVarNotSet(t, "IOT_DOMAIN_CONFIGURATION_TEST_AWS_MANAGED")
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, iot.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             acctest.CheckDestroyNoop,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccDomainConfigurationConfig_awsManaged(rName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckDomainConfigurationExists(ctx, resourceName),
+					resource.TestCheckResourceAttrSet(resourceName, "arn"),
+					resource.TestCheckResourceAttr(resourceName, "authorizer_config.#", "0"),
+					resource.TestCheckResourceAttrSet(resourceName, "domain_name"),
+					resource.TestCheckResourceAttr(resourceName, "domain_type", "AWS_MANAGED"),
+					resource.TestCheckResourceAttr(resourceName, "name", rName),
+					resource.TestCheckResourceAttr(resourceName, "server_certificate_arns.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "service_type", "DATA"),
+					resource.TestCheckResourceAttr(resourceName, "status", "ENABLED"),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
+					resource.TestCheckResourceAttr(resourceName, "tls_config.#", "1"),
+					resource.TestCheckResourceAttrSet(resourceName, "tls_config.0.security_policy"),
+					resource.TestCheckResourceAttr(resourceName, "validation_certificate_arn", ""),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckDomainConfigurationExists(ctx context.Context, n string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		conn := acctest.Provider.Meta().(*conns.AWSClient).IoTConn(ctx)
+
+		_, err := tfiot.FindDomainConfigurationByName(ctx, conn, rs.Primary.ID)
+
+		return err
+	}
+}
+
+func testAccCheckDomainConfigurationDestroy(ctx context.Context) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		conn := acctest.Provider.Meta().(*conns.AWSClient).IoTConn(ctx)
+
+		for _, rs := range s.RootModule().Resources {
+			if rs.Type != "aws_iot_domain_configuration" {
+				continue
+			}
+
+			_, err := tfiot.FindDomainConfigurationByName(ctx, conn, rs.Primary.ID)
+
+			if tfresource.NotFound(err) {
+				continue
+			}
+
+			if err != nil {
+				return err
+			}
+
+			return fmt.Errorf("IoT Domain Configuration %s still exists", rs.Primary.ID)
+		}
+
+		return nil
+	}
+}
+
+func testAccDomainConfigurationConfig_base(rootDomain, domain string) string {
+	return fmt.Sprintf(`
+resource "aws_acm_certificate" "test" {
+  domain_name       = %[2]q
+  validation_method = "DNS"
+}
+
+data "aws_route53_zone" "test" {
+  name         = %[1]q
+  private_zone = false
+}
+
+resource "aws_route53_record" "test" {
+  allow_overwrite = true
+  name            = tolist(aws_acm_certificate.test.domain_validation_options)[0].resource_record_name
+  records         = [tolist(aws_acm_certificate.test.domain_validation_options)[0].resource_record_value]
+  ttl             = 60
+  type            = tolist(aws_acm_certificate.test.domain_validation_options)[0].resource_record_type
+  zone_id         = data.aws_route53_zone.test.zone_id
+}
+
+resource "aws_acm_certificate_validation" "test" {
+  depends_on = [aws_route53_record.test]
+
+  certificate_arn = aws_acm_certificate.test.arn
+}
+`, rootDomain, domain)
+}
+
+func testAccDomainConfigurationConfig_basic(rName, rootDomain, domain string) string {
+	return acctest.ConfigCompose(testAccDomainConfigurationConfig_base(rootDomain, domain), fmt.Sprintf(`
+resource "aws_iot_domain_configuration" "test" {
+  depends_on = [aws_acm_certificate_validation.test]
+
+  name                    = %[1]q
+  domain_name             = %[2]q
+  server_certificate_arns = [aws_acm_certificate.test.arn]
+}
+`, rName, domain))
+}
+
+func testAccDomainConfigurationConfig_tags1(rName, rootDomain, domain, tagKey1, tagValue1 string) string {
+	return acctest.ConfigCompose(testAccDomainConfigurationConfig_base(rootDomain, domain), fmt.Sprintf(`
+resource "aws_iot_domain_configuration" "test" {
+  depends_on = [aws_acm_certificate_validation.test]
+
+  name                    = %[1]q
+  domain_name             = %[2]q
+  server_certificate_arns = [aws_acm_certificate.test.arn]
+
+  tags = {
+    %[3]q = %[4]q
+  }
+}
+`, rName, domain, tagKey1, tagValue1))
+}
+
+func testAccDomainConfigurationConfig_tags2(rName, rootDomain, domain, tagKey1, tagValue1, tagKey2, tagValue2 string) string {
+	return acctest.ConfigCompose(testAccDomainConfigurationConfig_base(rootDomain, domain), fmt.Sprintf(`
+resource "aws_iot_domain_configuration" "test" {
+  depends_on = [aws_acm_certificate_validation.test]
+
+  name                    = %[1]q
+  domain_name             = %[2]q
+  server_certificate_arns = [aws_acm_certificate.test.arn]
+
+  tags = {
+    %[3]q = %[4]q
+    %[5]q = %[6]q
+  }
+}
+`, rName, domain, tagKey1, tagValue1, tagKey2, tagValue2))
+}
+
+func testAccDomainConfigurationConfig_securityPolicy(rName, rootDomain, domain, securityPolicy string, allowAuthorizerOverride bool) string {
+	return acctest.ConfigCompose(testAccAuthorizerConfig_basic(rName), testAccDomainConfigurationConfig_base(rootDomain, domain), fmt.Sprintf(`
+resource "aws_iot_domain_configuration" "test" {
+  depends_on = [aws_acm_certificate_validation.test]
+
+  authorizer_config {
+    allow_authorizer_override = %[4]t
+    default_authorizer_name   = aws_iot_authorizer.test.name
+  }
+
+  name                    = %[1]q
+  domain_name             = %[2]q
+  server_certificate_arns = [aws_acm_certificate.test.arn]
+
+  tls_config {
+    security_policy = %[3]q
+  }
+}
+`, rName, domain, securityPolicy, allowAuthorizerOverride))
+}
+
+func testAccDomainConfigurationConfig_awsManaged(rName string) string { // nosemgrep:ci.aws-in-func-name
+	return fmt.Sprintf(`
+resource "aws_iot_domain_configuration" "test" {
+  name = %[1]q
+}
+`, rName)
+}
diff --git a/internal/service/iot/endpoint_data_source.go b/internal/service/iot/endpoint_data_source.go
index 19cf0ea3585..a8299445e76 100644
--- a/internal/service/iot/endpoint_data_source.go
+++ b/internal/service/iot/endpoint_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iot
 
 import (
diff --git a/internal/service/iot/endpoint_data_source_test.go b/internal/service/iot/endpoint_data_source_test.go
index e2872269bde..6f7690b41a2 100644
--- a/internal/service/iot/endpoint_data_source_test.go
+++ b/internal/service/iot/endpoint_data_source_test.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iot_test
 
 import (
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/iot"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
@@ -22,7 +25,7 @@ func TestAccIoTEndpointDataSource_basic(t *testing.T) {
 			{
 				Config: testAccEndpointDataSourceConfig_basic,
 				Check: resource.ComposeTestCheckFunc(
-					resource.TestMatchResourceAttr(dataSourceName, "endpoint_address", regexp.MustCompile(fmt.Sprintf("^[a-z0-9]+(-ats)?.iot.%s.amazonaws.com$", acctest.Region()))),
+					resource.TestMatchResourceAttr(dataSourceName, "endpoint_address", regexache.MustCompile(fmt.Sprintf("^[0-9a-z]+(-ats)?.iot.%s.amazonaws.com$", acctest.Region()))),
 				),
 			},
 		},
@@ -41,7 +44,7 @@ func TestAccIoTEndpointDataSource_EndpointType_iotCredentialProvider(t *testing.
 			{
 				Config: testAccEndpointDataSourceConfig_type("iot:CredentialProvider"),
 				Check: resource.ComposeTestCheckFunc(
-					resource.TestMatchResourceAttr(dataSourceName, "endpoint_address", regexp.MustCompile(fmt.Sprintf("^[a-z0-9]+.credentials.iot.%s.amazonaws.com$", acctest.Region()))),
+					resource.TestMatchResourceAttr(dataSourceName, "endpoint_address", regexache.MustCompile(fmt.Sprintf("^[0-9a-z]+.credentials.iot.%s.amazonaws.com$", acctest.Region()))),
 				),
 			},
 		},
@@ -60,7 +63,7 @@ func TestAccIoTEndpointDataSource_EndpointType_iotData(t *testing.T) {
 			{
 				Config: testAccEndpointDataSourceConfig_type("iot:Data"),
 				Check: resource.ComposeTestCheckFunc(
-					resource.TestMatchResourceAttr(dataSourceName, "endpoint_address", regexp.MustCompile(fmt.Sprintf("^[a-z0-9]+.iot.%s.amazonaws.com$", acctest.Region()))),
+					resource.TestMatchResourceAttr(dataSourceName, "endpoint_address", regexache.MustCompile(fmt.Sprintf("^[0-9a-z]+.iot.%s.amazonaws.com$", acctest.Region()))),
 				),
 			},
 		},
@@ -79,7 +82,7 @@ func TestAccIoTEndpointDataSource_EndpointType_iotDataATS(t *testing.T) {
 			{
 				Config: testAccEndpointDataSourceConfig_type("iot:Data-ATS"),
 				Check: resource.ComposeTestCheckFunc(
-					resource.TestMatchResourceAttr(dataSourceName, "endpoint_address", regexp.MustCompile(fmt.Sprintf("^[a-z0-9]+-ats.iot.%s.amazonaws.com$", acctest.Region()))),
+					resource.TestMatchResourceAttr(dataSourceName, "endpoint_address", regexache.MustCompile(fmt.Sprintf("^[0-9a-z]+-ats.iot.%s.amazonaws.com$", acctest.Region()))),
 				),
 			},
 		},
@@ -98,7 +101,7 @@ func TestAccIoTEndpointDataSource_EndpointType_iotJobs(t *testing.T) {
 			{
 				Config: testAccEndpointDataSourceConfig_type("iot:Jobs"),
 				Check: resource.ComposeTestCheckFunc(
-					resource.TestMatchResourceAttr(dataSourceName, "endpoint_address", regexp.MustCompile(fmt.Sprintf("^[a-z0-9]+.jobs.iot.%s.amazonaws.com$", acctest.Region()))),
+					resource.TestMatchResourceAttr(dataSourceName, "endpoint_address", regexache.MustCompile(fmt.Sprintf("^[0-9a-z]+.jobs.iot.%s.amazonaws.com$", acctest.Region()))),
 				),
 			},
 		},
diff --git a/internal/service/iot/find.go b/internal/service/iot/find.go
index 9a274bade0c..ecfdbea6eec 100644
--- a/internal/service/iot/find.go
+++ b/internal/service/iot/find.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iot
 
 import (
diff --git a/internal/service/iot/flex.go b/internal/service/iot/flex.go
index 28bdf811dc7..0cb947a8f56 100644
--- a/internal/service/iot/flex.go
+++ b/internal/service/iot/flex.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iot
 
 import (
diff --git a/internal/service/iot/generate.go b/internal/service/iot/generate.go
index 9687a2e1515..d93df36bc39 100644
--- a/internal/service/iot/generate.go
+++ b/internal/service/iot/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTags -ServiceTagsSlice -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/iot/indexing_configuration.go b/internal/service/iot/indexing_configuration.go
index b7a8f3b641f..070bb3e832b 100644
--- a/internal/service/iot/indexing_configuration.go
+++ b/internal/service/iot/indexing_configuration.go
@@ -1,15 +1,19 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iot
 
 import (
 	"context"
-	"log"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/iot"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/flex"
 )
 
 // @SDKResource("aws_iot_indexing_configuration")
@@ -106,6 +110,28 @@ func ResourceIndexingConfiguration() *schema.Resource {
 							Default:      iot.DeviceDefenderIndexingModeOff,
 							ValidateFunc: validation.StringInSlice(iot.DeviceDefenderIndexingMode_Values(), false),
 						},
+						"filter": {
+							Type:     schema.TypeList,
+							Optional: true,
+							Computed: true,
+							MaxItems: 1,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"named_shadow_names": {
+										Type:     schema.TypeSet,
+										Optional: true,
+										MinItems: 1,
+										Elem: &schema.Schema{
+											Type: schema.TypeString,
+											ValidateFunc: validation.All(
+												validation.StringLenBetween(1, 64),
+												validation.StringMatch(regexache.MustCompile(`^[a-zA-Z0-9:_-]+`), "must contain only alphanumeric characters, underscores, colons, and hyphens"),
+											),
+										},
+									},
+								},
+							},
+						},
 						"managed_field": {
 							Type:     schema.TypeSet,
 							Optional: true,
@@ -162,7 +188,6 @@ func resourceIndexingConfigurationPut(ctx context.Context, d *schema.ResourceDat
 		input.ThingIndexingConfiguration = expandThingIndexingConfiguration(v.([]interface{})[0].(map[string]interface{}))
 	}
 
-	log.Printf("[DEBUG] Updating IoT Indexing Configuration: %s", input)
 	_, err := conn.UpdateIndexingConfigurationWithContext(ctx, input)
 
 	if err != nil {
@@ -238,6 +263,10 @@ func flattenThingIndexingConfiguration(apiObject *iot.ThingIndexingConfiguration
 		tfMap["device_defender_indexing_mode"] = aws.StringValue(v)
 	}
 
+	if v := apiObject.Filter; v != nil {
+		tfMap["filter"] = []interface{}{flattenIndexingFilter(v)}
+	}
+
 	if v := apiObject.ManagedFields; v != nil {
 		tfMap["managed_field"] = flattenFields(v)
 	}
@@ -257,6 +286,20 @@ func flattenThingIndexingConfiguration(apiObject *iot.ThingIndexingConfiguration
 	return tfMap
 }
 
+func flattenIndexingFilter(apiObject *iot.IndexingFilter) map[string]interface{} {
+	if apiObject == nil {
+		return nil
+	}
+
+	tfMap := map[string]interface{}{}
+
+	if v := apiObject.NamedShadowNames; v != nil {
+		tfMap["named_shadow_names"] = aws.StringValueSlice(v)
+	}
+
+	return tfMap
+}
+
 func flattenField(apiObject *iot.Field) map[string]interface{} {
 	if apiObject == nil {
 		return nil
@@ -330,6 +373,10 @@ func expandThingIndexingConfiguration(tfMap map[string]interface{}) *iot.ThingIn
 		apiObject.DeviceDefenderIndexingMode = aws.String(v)
 	}
 
+	if v, ok := tfMap["filter"]; ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
+		apiObject.Filter = expandIndexingFilter(v.([]interface{})[0].(map[string]interface{}))
+	}
+
 	if v, ok := tfMap["managed_field"].(*schema.Set); ok && v.Len() > 0 {
 		apiObject.ManagedFields = expandFields(v.List())
 	}
@@ -349,6 +396,20 @@ func expandThingIndexingConfiguration(tfMap map[string]interface{}) *iot.ThingIn
 	return apiObject
 }
 
+func expandIndexingFilter(tfMap map[string]interface{}) *iot.IndexingFilter {
+	if tfMap == nil {
+		return nil
+	}
+
+	apiObject := &iot.IndexingFilter{}
+
+	if v, ok := tfMap["named_shadow_names"].(*schema.Set); ok && v.Len() > 0 {
+		apiObject.NamedShadowNames = flex.ExpandStringSet(v)
+	}
+
+	return apiObject
+}
+
 func expandField(tfMap map[string]interface{}) *iot.Field {
 	if tfMap == nil {
 		return nil
diff --git a/internal/service/iot/indexing_configuration_test.go b/internal/service/iot/indexing_configuration_test.go
index ff034be7782..7c2fa12e89c 100644
--- a/internal/service/iot/indexing_configuration_test.go
+++ b/internal/service/iot/indexing_configuration_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iot_test
 
 import (
@@ -90,6 +93,8 @@ func testAccIndexingConfiguration_allAttributes(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "thing_indexing_configuration.0.named_shadow_indexing_mode", "ON"),
 					resource.TestCheckResourceAttr(resourceName, "thing_indexing_configuration.0.thing_connectivity_indexing_mode", "STATUS"),
 					resource.TestCheckResourceAttr(resourceName, "thing_indexing_configuration.0.thing_indexing_mode", "REGISTRY_AND_SHADOW"),
+					resource.TestCheckResourceAttr(resourceName, "thing_indexing_configuration.0.filter.0.named_shadow_names.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "thing_indexing_configuration.0.filter.0.named_shadow_names.0", "thing1shadow"),
 				),
 			},
 			{
@@ -125,6 +130,10 @@ resource "aws_iot_indexing_configuration" "test" {
     device_defender_indexing_mode    = "VIOLATIONS"
     named_shadow_indexing_mode       = "ON"
 
+    filter {
+      named_shadow_names = ["thing1shadow"]
+    }
+
     custom_field {
       name = "attributes.version"
       type = "Number"
diff --git a/internal/service/iot/logging_options.go b/internal/service/iot/logging_options.go
index 397db8459c7..7169d9db77f 100644
--- a/internal/service/iot/logging_options.go
+++ b/internal/service/iot/logging_options.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iot
 
 import (
diff --git a/internal/service/iot/logging_options_test.go b/internal/service/iot/logging_options_test.go
index fd87b2f5ee6..b2db821362e 100644
--- a/internal/service/iot/logging_options_test.go
+++ b/internal/service/iot/logging_options_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iot_test
 
 import (
diff --git a/internal/service/iot/policy.go b/internal/service/iot/policy.go
index 8b773b6e00d..e9df2ab5d0b 100644
--- a/internal/service/iot/policy.go
+++ b/internal/service/iot/policy.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iot
 
 import (
diff --git a/internal/service/iot/policy_attachment.go b/internal/service/iot/policy_attachment.go
index 3918f00d3d7..73211319818 100644
--- a/internal/service/iot/policy_attachment.go
+++ b/internal/service/iot/policy_attachment.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iot
 
 import (
diff --git a/internal/service/iot/policy_attachment_test.go b/internal/service/iot/policy_attachment_test.go
index 0212eee9035..8c8713074a5 100644
--- a/internal/service/iot/policy_attachment_test.go
+++ b/internal/service/iot/policy_attachment_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iot_test
 
 import (
diff --git a/internal/service/iot/policy_test.go b/internal/service/iot/policy_test.go
index 1a5665a10a1..531a0b52360 100644
--- a/internal/service/iot/policy_test.go
+++ b/internal/service/iot/policy_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iot_test
 
 import (
diff --git a/internal/service/iot/provisioning_template.go b/internal/service/iot/provisioning_template.go
index 5aa31ec6ff4..05fce80d7ce 100644
--- a/internal/service/iot/provisioning_template.go
+++ b/internal/service/iot/provisioning_template.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iot
 
 import (
 	"context"
 	"log"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/iot"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -67,7 +70,7 @@ func ResourceProvisioningTemplate() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 36),
-					validation.StringMatch(regexp.MustCompile(`^[0-9A-Za-z_-]+$`), "must contain only alphanumeric characters and/or the following: _-"),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_-]+$`), "must contain only alphanumeric characters and/or the following: _-"),
 				),
 			},
 			"pre_provisioning_hook": {
@@ -105,6 +108,13 @@ func ResourceProvisioningTemplate() *schema.Resource {
 					validation.StringLenBetween(0, 10240),
 				),
 			},
+			"type": {
+				Type:         schema.TypeString,
+				Optional:     true,
+				Computed:     true,
+				ForceNew:     true,
+				ValidateFunc: validation.StringInSlice(iot.TemplateType_Values(), false),
+			},
 		},
 
 		CustomizeDiff: verify.SetTagsDiff,
@@ -137,6 +147,10 @@ func resourceProvisioningTemplateCreate(ctx context.Context, d *schema.ResourceD
 		input.TemplateBody = aws.String(v.(string))
 	}
 
+	if v, ok := d.Get("type").(string); ok && v != "" {
+		input.Type = aws.String(v)
+	}
+
 	outputRaw, err := tfresource.RetryWhenAWSErrMessageContains(ctx, propagationTimeout,
 		func() (interface{}, error) {
 			return conn.CreateProvisioningTemplateWithContext(ctx, input)
@@ -181,6 +195,7 @@ func resourceProvisioningTemplateRead(ctx context.Context, d *schema.ResourceDat
 	}
 	d.Set("provisioning_role_arn", output.ProvisioningRoleArn)
 	d.Set("template_body", output.TemplateBody)
+	d.Set("type", output.Type)
 
 	return nil
 }
diff --git a/internal/service/iot/provisioning_template_test.go b/internal/service/iot/provisioning_template_test.go
index 0db14feceb5..ca2c4592c7e 100644
--- a/internal/service/iot/provisioning_template_test.go
+++ b/internal/service/iot/provisioning_template_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iot_test
 
 import (
@@ -40,6 +43,7 @@ func TestAccIoTProvisioningTemplate_basic(t *testing.T) {
 					resource.TestCheckResourceAttrSet(resourceName, "provisioning_role_arn"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 					resource.TestCheckResourceAttrSet(resourceName, "template_body"),
+					resource.TestCheckResourceAttr(resourceName, "type", "FLEET_PROVISIONING"),
 				),
 			},
 			{
diff --git a/internal/service/iot/role_alias.go b/internal/service/iot/role_alias.go
index 69ab6b09690..3430b5c17fd 100644
--- a/internal/service/iot/role_alias.go
+++ b/internal/service/iot/role_alias.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iot
 
 import (
diff --git a/internal/service/iot/role_alias_test.go b/internal/service/iot/role_alias_test.go
index c43de06329d..ce25ad76de8 100644
--- a/internal/service/iot/role_alias_test.go
+++ b/internal/service/iot/role_alias_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iot_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/iot"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -56,7 +59,7 @@ func TestAccIoTRoleAlias_basic(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRoleAliasExists(ctx, resourceName2),
 				),
-				ExpectError: regexp.MustCompile("Role alias .+? already exists for this account"),
+				ExpectError: regexache.MustCompile("Role alias .+? already exists for this account"),
 			},
 			{
 				Config: testAccRoleAliasConfig_update4(alias2),
@@ -68,7 +71,7 @@ func TestAccIoTRoleAlias_basic(t *testing.T) {
 				Config: testAccRoleAliasConfig_update5(alias2),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRoleAliasExists(ctx, resourceName2),
-					acctest.MatchResourceAttrGlobalARN(resourceName2, "role_arn", "iam", regexp.MustCompile("role/rolebogus")),
+					acctest.MatchResourceAttrGlobalARN(resourceName2, "role_arn", "iam", regexache.MustCompile("role/rolebogus")),
 				),
 			},
 			{
diff --git a/internal/service/iot/service_package_gen.go b/internal/service/iot/service_package_gen.go
index f6c88a06569..a8613b1ab5e 100644
--- a/internal/service/iot/service_package_gen.go
+++ b/internal/service/iot/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	iot_sdkv1 "github.com/aws/aws-sdk-go/service/iot"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -41,6 +42,14 @@ func (p *servicePackage) SDKResources(ctx context.Context) []*types.ServicePacka
 			Factory:  ResourceCertificate,
 			TypeName: "aws_iot_certificate",
 		},
+		{
+			Factory:  ResourceDomainConfiguration,
+			TypeName: "aws_iot_domain_configuration",
+			Name:     "Domain Configuration",
+			Tags: &types.ServicePackageResourceTags{
+				IdentifierAttribute: "arn",
+			},
+		},
 		{
 			Factory:  ResourceIndexingConfiguration,
 			TypeName: "aws_iot_indexing_configuration",
@@ -123,4 +132,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*i
 	return iot_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/iot/sweep.go b/internal/service/iot/sweep.go
index 8919f0b1599..5fe51dedf78 100644
--- a/internal/service/iot/sweep.go
+++ b/internal/service/iot/sweep.go
@@ -1,24 +1,26 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package iot
 
 import (
 	"fmt"
 	"log"
+	"strings"
+	"time"
 
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/iot"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	"github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_iot_certificate", &resource.Sweeper{
 		Name: "aws_iot_certificate",
-		F:    sweepCertifcates,
+		F:    sweepCertificates,
 		Dependencies: []string{
 			"aws_iot_policy_attachment",
 			"aws_iot_thing_principal_attachment",
@@ -75,32 +77,38 @@ func init() {
 		Name: "aws_iot_topic_rule_destination",
 		F:    sweepTopicRuleDestinations,
 	})
+
+	resource.AddTestSweepers("aws_iot_authorizer", &resource.Sweeper{
+		Name:         "aws_iot_authorizer",
+		F:            sweepAuthorizers,
+		Dependencies: []string{"aws_iot_domain_configuration"},
+	})
+
+	resource.AddTestSweepers("aws_iot_domain_configuration", &resource.Sweeper{
+		Name: "aws_iot_domain_configuration",
+		F:    sweepDomainConfigurations,
+	})
 }
 
-func sweepCertifcates(region string) error {
+func sweepCertificates(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
-
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
-
 	conn := client.IoTConn(ctx)
-	sweepResources := make([]sweep.Sweepable, 0)
-	var errs *multierror.Error
-
 	input := &iot.ListCertificatesInput{}
+	sweepResources := make([]sweep.Sweepable, 0)
 
 	err = conn.ListCertificatesPagesWithContext(ctx, input, func(page *iot.ListCertificatesOutput, lastPage bool) bool {
 		if page == nil {
 			return !lastPage
 		}
 
-		for _, certificate := range page.Certificates {
+		for _, v := range page.Certificates {
 			r := ResourceCertificate()
 			d := r.Data(nil)
-
-			d.SetId(aws.StringValue(certificate.CertificateId))
+			d.SetId(aws.StringValue(v.CertificateId))
 
 			sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
 		}
@@ -108,44 +116,44 @@ func sweepCertifcates(region string) error {
 		return !lastPage
 	})
 
-	if err != nil {
-		errs = multierror.Append(errs, fmt.Errorf("error listing IoT Certificate for %s: %w", region, err))
+	if awsv1.SkipSweepError(err) {
+		log.Printf("[WARN] Skipping IoT Certificate sweep for %s: %s", region, err)
+		return nil
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
-		errs = multierror.Append(errs, fmt.Errorf("error sweeping IoT Certificate for %s: %w", region, err))
+	if err != nil {
+		return fmt.Errorf("error listing IoT Certificates (%s): %w", region, err)
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
-		log.Printf("[WARN] Skipping IoT Certificate sweep for %s: %s", region, errs)
-		return nil
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
+
+	if err != nil {
+		return fmt.Errorf("error sweeping IoT Certificates (%s): %w", region, err)
 	}
 
-	return errs.ErrorOrNil()
+	return nil
 }
 
 func sweepPolicyAttachments(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
-
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
-
 	conn := client.IoTConn(ctx)
-	sweepResources := make([]sweep.Sweepable, 0)
-	var errs *multierror.Error
-
 	input := &iot.ListPoliciesInput{}
+	sweepResources := make([]sweep.Sweepable, 0)
+	var sweeperErrs *multierror.Error
 
 	err = conn.ListPoliciesPagesWithContext(ctx, input, func(page *iot.ListPoliciesOutput, lastPage bool) bool {
 		if page == nil {
 			return !lastPage
 		}
 
-		for _, policy := range page.Policies {
+		for _, v := range page.Policies {
+			policyName := aws.StringValue(v.PolicyName)
 			input := &iot.ListTargetsForPolicyInput{
-				PolicyName: policy.PolicyName,
+				PolicyName: aws.String(policyName),
 			}
 
 			err := conn.ListTargetsForPolicyPagesWithContext(ctx, input, func(page *iot.ListTargetsForPolicyOutput, lastPage bool) bool {
@@ -153,13 +161,12 @@ func sweepPolicyAttachments(region string) error {
 					return !lastPage
 				}
 
-				for _, target := range page.Targets {
+				for _, v := range page.Targets {
 					r := ResourcePolicyAttachment()
 					d := r.Data(nil)
-
-					d.SetId(fmt.Sprintf("%s|%s", aws.StringValue(policy.PolicyName), aws.StringValue(target)))
-					d.Set("policy", policy.PolicyName)
-					d.Set("target", target)
+					d.SetId(fmt.Sprintf("%s|%s", policyName, aws.StringValue(v)))
+					d.Set("policy", policyName)
+					d.Set("target", v)
 
 					sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
 				}
@@ -167,54 +174,55 @@ func sweepPolicyAttachments(region string) error {
 				return !lastPage
 			})
 
+			if awsv1.SkipSweepError(err) {
+				continue
+			}
+
 			if err != nil {
-				errs = multierror.Append(errs, fmt.Errorf("error listing IoT Policy Attachment for %s: %w", region, err))
+				sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error listing IoT Targets For Policy (%s): %w", region, err))
 			}
 		}
 
 		return !lastPage
 	})
 
-	if err != nil {
-		errs = multierror.Append(errs, fmt.Errorf("error listing IoT Policy Attachment for %s: %w", region, err))
+	if awsv1.SkipSweepError(err) {
+		log.Printf("[WARN] Skipping IoT Policy Attachment sweep for %s: %s", region, err)
+		return sweeperErrs.ErrorOrNil() // In case we have completed some pages, but had errors
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
-		errs = multierror.Append(errs, fmt.Errorf("error sweeping IoT Policy Attachment for %s: %w", region, err))
+	if err != nil {
+		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error listing IoT Policies (%s): %w", region, err))
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
-		log.Printf("[WARN] Skipping IoT Policy Attachment sweep for %s: %s", region, errs)
-		return nil
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
+
+	if err != nil {
+		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error sweeping IoT Policy Attachments (%s): %w", region, err))
 	}
 
-	return errs.ErrorOrNil()
+	return sweeperErrs.ErrorOrNil()
 }
 
 func sweepPolicies(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
-
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
-
 	conn := client.IoTConn(ctx)
-	sweepResources := make([]sweep.Sweepable, 0)
-	var errs *multierror.Error
-
 	input := &iot.ListPoliciesInput{}
+	sweepResources := make([]sweep.Sweepable, 0)
 
 	err = conn.ListPoliciesPagesWithContext(ctx, input, func(page *iot.ListPoliciesOutput, lastPage bool) bool {
 		if page == nil {
 			return !lastPage
 		}
 
-		for _, policy := range page.Policies {
+		for _, v := range page.Policies {
 			r := ResourcePolicy()
 			d := r.Data(nil)
-
-			d.SetId(aws.StringValue(policy.PolicyName))
+			d.SetId(aws.StringValue(v.PolicyName))
 
 			sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
 		}
@@ -222,46 +230,43 @@ func sweepPolicies(region string) error {
 		return !lastPage
 	})
 
-	if err != nil {
-		errs = multierror.Append(errs, fmt.Errorf("error listing IoT Policy for %s: %w", region, err))
+	if awsv1.SkipSweepError(err) {
+		log.Printf("[WARN] Skipping IoT Policy sweep for %s: %s", region, err)
+		return nil
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
-		errs = multierror.Append(errs, fmt.Errorf("error sweeping IoT Policy for %s: %w", region, err))
+	if err != nil {
+		return fmt.Errorf("error listing IoT Policies (%s): %w", region, err)
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
-		log.Printf("[WARN] Skipping IoT Policy sweep for %s: %s", region, errs)
-		return nil
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
+
+	if err != nil {
+		return fmt.Errorf("error sweeping IoT Policies (%s): %w", region, err)
 	}
 
-	return errs.ErrorOrNil()
+	return nil
 }
 
 func sweepRoleAliases(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
-
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
-
 	conn := client.IoTConn(ctx)
-	sweepResources := make([]sweep.Sweepable, 0)
-	var errs *multierror.Error
-
 	input := &iot.ListRoleAliasesInput{}
+	sweepResources := make([]sweep.Sweepable, 0)
 
 	err = conn.ListRoleAliasesPagesWithContext(ctx, input, func(page *iot.ListRoleAliasesOutput, lastPage bool) bool {
 		if page == nil {
 			return !lastPage
 		}
 
-		for _, roleAlias := range page.RoleAliases {
+		for _, v := range page.RoleAliases {
 			r := ResourceRoleAlias()
 			d := r.Data(nil)
-
-			d.SetId(aws.StringValue(roleAlias))
+			d.SetId(aws.StringValue(v))
 
 			sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
 		}
@@ -269,44 +274,44 @@ func sweepRoleAliases(region string) error {
 		return !lastPage
 	})
 
-	if err != nil {
-		errs = multierror.Append(errs, fmt.Errorf("error listing IoT Role Alias for %s: %w", region, err))
+	if awsv1.SkipSweepError(err) {
+		log.Printf("[WARN] Skipping Role Alias sweep for %s: %s", region, err)
+		return nil
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
-		errs = multierror.Append(errs, fmt.Errorf("error sweeping IoT Role Alias for %s: %w", region, err))
+	if err != nil {
+		return fmt.Errorf("error listing Role Aliases (%s): %w", region, err)
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
-		log.Printf("[WARN] Skipping IoT Role Alias sweep for %s: %s", region, errs)
-		return nil
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
+
+	if err != nil {
+		return fmt.Errorf("error sweeping IoT Role Aliases (%s): %w", region, err)
 	}
 
-	return errs.ErrorOrNil()
+	return nil
 }
 
 func sweepThingPrincipalAttachments(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
-
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
-
 	conn := client.IoTConn(ctx)
-	sweepResources := make([]sweep.Sweepable, 0)
-	var errs *multierror.Error
-
 	input := &iot.ListThingsInput{}
+	sweepResources := make([]sweep.Sweepable, 0)
+	var sweeperErrs *multierror.Error
 
 	err = conn.ListThingsPagesWithContext(ctx, input, func(page *iot.ListThingsOutput, lastPage bool) bool {
 		if page == nil {
 			return !lastPage
 		}
 
-		for _, thing := range page.Things {
+		for _, v := range page.Things {
+			thingName := aws.StringValue(v.ThingName)
 			input := &iot.ListThingPrincipalsInput{
-				ThingName: thing.ThingName,
+				ThingName: aws.String(thingName),
 			}
 
 			err := conn.ListThingPrincipalsPagesWithContext(ctx, input, func(page *iot.ListThingPrincipalsOutput, lastPage bool) bool {
@@ -314,13 +319,12 @@ func sweepThingPrincipalAttachments(region string) error {
 					return !lastPage
 				}
 
-				for _, principal := range page.Principals {
+				for _, v := range page.Principals {
 					r := ResourceThingPrincipalAttachment()
 					d := r.Data(nil)
-
-					d.SetId(fmt.Sprintf("%s|%s", aws.StringValue(thing.ThingName), aws.StringValue(principal)))
-					d.Set("principal", principal)
-					d.Set("thing", thing.ThingName)
+					d.SetId(fmt.Sprintf("%s|%s", thingName, aws.StringValue(v)))
+					d.Set("principal", v)
+					d.Set("thing", thingName)
 
 					sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
 				}
@@ -328,54 +332,55 @@ func sweepThingPrincipalAttachments(region string) error {
 				return !lastPage
 			})
 
+			if awsv1.SkipSweepError(err) {
+				continue
+			}
+
 			if err != nil {
-				errs = multierror.Append(errs, fmt.Errorf("error listing IoT Thing Principal Attachment for %s: %w", region, err))
+				sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error listing IoT Thing Principals (%s): %w", region, err))
 			}
 		}
 
 		return !lastPage
 	})
 
-	if err != nil {
-		errs = multierror.Append(errs, fmt.Errorf("error listing IoT Thing Principal Attachment for %s: %w", region, err))
+	if awsv1.SkipSweepError(err) {
+		log.Printf("[WARN] Skipping IoT Thing Principal Attachment sweep for %s: %s", region, err)
+		return sweeperErrs.ErrorOrNil() // In case we have completed some pages, but had errors
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
-		errs = multierror.Append(errs, fmt.Errorf("error sweeping IoT Thing Principal Attachment for %s: %w", region, err))
+	if err != nil {
+		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error listing IoT Things (%s): %w", region, err))
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
-		log.Printf("[WARN] Skipping IoT Thing Principal Attachment sweep for %s: %s", region, errs)
-		return nil
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
+
+	if err != nil {
+		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error sweeping IoT Thing Principal Attachments (%s): %w", region, err))
 	}
 
-	return errs.ErrorOrNil()
+	return sweeperErrs.ErrorOrNil()
 }
 
 func sweepThings(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
-
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
-
 	conn := client.IoTConn(ctx)
-	sweepResources := make([]sweep.Sweepable, 0)
-	var errs *multierror.Error
-
 	input := &iot.ListThingsInput{}
+	sweepResources := make([]sweep.Sweepable, 0)
 
 	err = conn.ListThingsPagesWithContext(ctx, input, func(page *iot.ListThingsOutput, lastPage bool) bool {
 		if page == nil {
 			return !lastPage
 		}
 
-		for _, thing := range page.Things {
+		for _, v := range page.Things {
 			r := ResourceThing()
 			d := r.Data(nil)
-
-			d.SetId(aws.StringValue(thing.ThingName))
+			d.SetId(aws.StringValue(v.ThingName))
 
 			sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
 		}
@@ -383,46 +388,43 @@ func sweepThings(region string) error {
 		return !lastPage
 	})
 
-	if err != nil {
-		errs = multierror.Append(errs, fmt.Errorf("error listing IoT Thing for %s: %w", region, err))
+	if awsv1.SkipSweepError(err) {
+		log.Printf("[WARN] Skipping IoT Thing sweep for %s: %s", region, err)
+		return nil
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
-		errs = multierror.Append(errs, fmt.Errorf("error sweeping IoT Thing for %s: %w", region, err))
+	if err != nil {
+		return fmt.Errorf("error listing IoT Things (%s): %w", region, err)
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
-		log.Printf("[WARN] Skipping IoT Thing sweep for %s: %s", region, errs)
-		return nil
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
+
+	if err != nil {
+		return fmt.Errorf("error sweeping IoT Things (%s): %w", region, err)
 	}
 
-	return errs.ErrorOrNil()
+	return nil
 }
 
 func sweepThingTypes(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
-
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
-
 	conn := client.IoTConn(ctx)
-	sweepResources := make([]sweep.Sweepable, 0)
-	var errs *multierror.Error
-
 	input := &iot.ListThingTypesInput{}
+	sweepResources := make([]sweep.Sweepable, 0)
 
 	err = conn.ListThingTypesPagesWithContext(ctx, input, func(page *iot.ListThingTypesOutput, lastPage bool) bool {
 		if page == nil {
 			return !lastPage
 		}
 
-		for _, thingTypes := range page.ThingTypes {
+		for _, v := range page.ThingTypes {
 			r := ResourceThingType()
 			d := r.Data(nil)
-
-			d.SetId(aws.StringValue(thingTypes.ThingTypeName))
+			d.SetId(aws.StringValue(v.ThingTypeName))
 
 			sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
 		}
@@ -430,73 +432,71 @@ func sweepThingTypes(region string) error {
 		return !lastPage
 	})
 
-	if err != nil {
-		errs = multierror.Append(errs, fmt.Errorf("error listing IoT Thing Type for %s: %w", region, err))
+	if awsv1.SkipSweepError(err) {
+		log.Printf("[WARN] Skipping IoT Thing Type sweep for %s: %s", region, err)
+		return nil
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
-		errs = multierror.Append(errs, fmt.Errorf("error sweeping IoT Thing Type for %s: %w", region, err))
+	if err != nil {
+		return fmt.Errorf("error listing IoT Thing Types (%s): %w", region, err)
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
-		log.Printf("[WARN] Skipping IoT Thing Type sweep for %s: %s", region, errs)
-		return nil
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
+
+	if err != nil {
+		return fmt.Errorf("error sweeping IoT Thing Types (%s): %w", region, err)
 	}
 
-	return errs.ErrorOrNil()
+	return nil
 }
 
 func sweepTopicRules(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
 	conn := client.IoTConn(ctx)
 	input := &iot.ListTopicRulesInput{}
-	var sweeperErrs *multierror.Error
+	sweepResources := make([]sweep.Sweepable, 0)
 
-	for {
-		output, err := conn.ListTopicRulesWithContext(ctx, input)
-		if sweep.SkipSweepError(err) {
-			log.Printf("[WARN] Skipping IoT Topic Rules sweep for %s: %s", region, err)
-			return sweeperErrs.ErrorOrNil() // In case we have completed some pages, but had errors
-		}
-		if err != nil {
-			sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error retrieving IoT Topic Rules: %w", err))
-			return sweeperErrs
+	err = conn.ListTopicRulesPagesWithContext(ctx, input, func(page *iot.ListTopicRulesOutput, lastPage bool) bool {
+		if page == nil {
+			return !lastPage
 		}
 
-		for _, rule := range output.Rules {
-			name := aws.StringValue(rule.RuleName)
+		for _, v := range page.Rules {
+			r := ResourceTopicRule()
+			d := r.Data(nil)
+			d.SetId(aws.StringValue(v.RuleName))
 
-			log.Printf("[INFO] Deleting IoT Topic Rule: %s", name)
-			_, err := conn.DeleteTopicRuleWithContext(ctx, &iot.DeleteTopicRuleInput{
-				RuleName: aws.String(name),
-			})
-			if tfawserr.ErrCodeEquals(err, iot.ErrCodeUnauthorizedException) {
-				continue
-			}
-			if err != nil {
-				sweeperErr := fmt.Errorf("error deleting IoT Topic Rule (%s): %w", name, err)
-				log.Printf("[ERROR] %s", sweeperErr)
-				sweeperErrs = multierror.Append(sweeperErrs, sweeperErr)
-				continue
-			}
+			sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
 		}
 
-		if aws.StringValue(output.NextToken) == "" {
-			break
-		}
-		input.NextToken = output.NextToken
+		return !lastPage
+	})
+
+	if awsv1.SkipSweepError(err) {
+		log.Printf("[WARN] Skipping IoT Topic Rule sweep for %s: %s", region, err)
+		return nil
 	}
 
-	return sweeperErrs.ErrorOrNil()
+	if err != nil {
+		return fmt.Errorf("error listing IoT Topic Rules (%s): %w", region, err)
+	}
+
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
+
+	if err != nil {
+		return fmt.Errorf("error sweeping IoT Topic Rules (%s): %w", region, err)
+	}
+
+	return nil
 }
 
 func sweepThingGroups(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -509,10 +509,10 @@ func sweepThingGroups(region string) error {
 			return !lastPage
 		}
 
-		for _, group := range page.ThingGroups {
+		for _, v := range page.ThingGroups {
 			r := ResourceThingGroup()
 			d := r.Data(nil)
-			d.SetId(aws.StringValue(group.GroupName))
+			d.SetId(aws.StringValue(v.GroupName))
 
 			sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
 		}
@@ -520,7 +520,7 @@ func sweepThingGroups(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping IoT Thing Group sweep for %s: %s", region, err)
 		return nil
 	}
@@ -529,7 +529,7 @@ func sweepThingGroups(region string) error {
 		return fmt.Errorf("error listing IoT Thing Groups (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping IoT Thing Groups (%s): %w", region, err)
@@ -540,7 +540,7 @@ func sweepThingGroups(region string) error {
 
 func sweepTopicRuleDestinations(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
@@ -564,7 +564,7 @@ func sweepTopicRuleDestinations(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping IoT Topic Rule Destination sweep for %s: %s", region, err)
 		return nil
 	}
@@ -573,7 +573,7 @@ func sweepTopicRuleDestinations(region string) error {
 		return fmt.Errorf("error listing IoT Topic Rule Destinations (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping IoT Topic Rule Destinations (%s): %w", region, err)
@@ -581,3 +581,115 @@ func sweepTopicRuleDestinations(region string) error {
 
 	return nil
 }
+
+func sweepAuthorizers(region string) error {
+	ctx := sweep.Context(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
+	if err != nil {
+		return fmt.Errorf("error getting client: %w", err)
+	}
+	conn := client.IoTConn(ctx)
+	input := &iot.ListAuthorizersInput{}
+	sweepResources := make([]sweep.Sweepable, 0)
+
+	err = conn.ListAuthorizersPagesWithContext(ctx, input, func(page *iot.ListAuthorizersOutput, lastPage bool) bool {
+		if page == nil {
+			return !lastPage
+		}
+
+		for _, v := range page.Authorizers {
+			r := ResourceAuthorizer()
+			d := r.Data(nil)
+			d.SetId(aws.StringValue(v.AuthorizerName))
+			d.Set("status", iot.AuthorizerStatusActive)
+
+			sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
+		}
+
+		return !lastPage
+	})
+
+	if awsv1.SkipSweepError(err) {
+		log.Printf("[WARN] Skipping IoT Authorizer sweep for %s: %s", region, err)
+		return nil
+	}
+
+	if err != nil {
+		return fmt.Errorf("error listing IoT Authorizers (%s): %w", region, err)
+	}
+
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
+
+	if err != nil {
+		return fmt.Errorf("error sweeping IoT Authorizers (%s): %w", region, err)
+	}
+
+	return nil
+}
+
+func sweepDomainConfigurations(region string) error {
+	ctx := sweep.Context(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
+	if err != nil {
+		return fmt.Errorf("error getting client: %w", err)
+	}
+	conn := client.IoTConn(ctx)
+	input := &iot.ListDomainConfigurationsInput{}
+	sweepResources := make([]sweep.Sweepable, 0)
+
+	err = conn.ListDomainConfigurationsPagesWithContext(ctx, input, func(page *iot.ListDomainConfigurationsOutput, lastPage bool) bool {
+		if page == nil {
+			return !lastPage
+		}
+
+		for _, v := range page.DomainConfigurations {
+			name := aws.StringValue(v.DomainConfigurationName)
+
+			if strings.HasPrefix(name, "iot:") {
+				log.Printf("[INFO] Skipping IoT Domain Configuration %s", name)
+				continue
+			}
+
+			output, err := FindDomainConfigurationByName(ctx, conn, name)
+
+			if err != nil {
+				log.Printf("[WARN] IoT Domain Configuration (%s): %s", name, err)
+				continue
+			}
+
+			if aws.StringValue(output.DomainType) == iot.DomainTypeAwsManaged && aws.StringValue(output.DomainConfigurationStatus) == iot.DomainConfigurationStatusDisabled {
+				// AWS Managed Domain Configuration must be disabled for at least 7 days before it can be deleted.
+				if output.LastStatusChangeDate.After(time.Now().AddDate(0, 0, -7)) {
+					log.Printf("[INFO] Skipping IoT Domain Configuration %s", name)
+					continue
+				}
+			}
+
+			r := ResourceDomainConfiguration()
+			d := r.Data(nil)
+			d.SetId(name)
+			d.Set("status", output.DomainConfigurationStatus)
+
+			sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
+		}
+
+		return !lastPage
+	})
+
+	if awsv1.SkipSweepError(err) {
+		log.Printf("[WARN] Skipping IoT Domain Configuration sweep for %s: %s", region, err)
+		return nil
+	}
+
+	if err != nil {
+		return fmt.Errorf("error listing IoT Domain Configurations (%s): %w", region, err)
+	}
+
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
+
+	if err != nil {
+		return fmt.Errorf("error sweeping IoT Domain Configurations (%s): %w", region, err)
+	}
+
+	return nil
+}
diff --git a/internal/service/iot/tags_gen.go b/internal/service/iot/tags_gen.go
index 15e813f9ce7..ce6faf2d8fa 100644
--- a/internal/service/iot/tags_gen.go
+++ b/internal/service/iot/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/iot"
 	"github.com/aws/aws-sdk-go/service/iot/iotiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -102,6 +104,8 @@ func updateTags(ctx context.Context, conn iotiface.IoTAPI, identifier string, ol
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.IoT)
 	if len(removedTags) > 0 {
diff --git a/internal/service/iot/thing.go b/internal/service/iot/thing.go
index 5fdb9ae4c8b..101ee701d70 100644
--- a/internal/service/iot/thing.go
+++ b/internal/service/iot/thing.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iot
 
 import (
diff --git a/internal/service/iot/thing_group.go b/internal/service/iot/thing_group.go
index be01c49ae96..d1505a5b2b6 100644
--- a/internal/service/iot/thing_group.go
+++ b/internal/service/iot/thing_group.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iot
 
 import (
diff --git a/internal/service/iot/thing_group_membership.go b/internal/service/iot/thing_group_membership.go
index 8fc45230f8a..df611d6e663 100644
--- a/internal/service/iot/thing_group_membership.go
+++ b/internal/service/iot/thing_group_membership.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iot
 
 import (
diff --git a/internal/service/iot/thing_group_membership_test.go b/internal/service/iot/thing_group_membership_test.go
index 07f395dd0cc..63f85637656 100644
--- a/internal/service/iot/thing_group_membership_test.go
+++ b/internal/service/iot/thing_group_membership_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iot_test
 
 import (
diff --git a/internal/service/iot/thing_group_test.go b/internal/service/iot/thing_group_test.go
index b7560c90c96..536a990779e 100644
--- a/internal/service/iot/thing_group_test.go
+++ b/internal/service/iot/thing_group_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iot_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/iot"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -32,7 +35,7 @@ func TestAccIoTThingGroup_basic(t *testing.T) {
 				Config: testAccThingGroupConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckThingGroupExists(ctx, resourceName, &thingGroup),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "iot", regexp.MustCompile(fmt.Sprintf("thinggroup/%s$", rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "iot", regexache.MustCompile(fmt.Sprintf("thinggroup/%s$", rName))),
 					resource.TestCheckResourceAttr(resourceName, "metadata.#", "1"),
 					resource.TestCheckResourceAttrSet(resourceName, "metadata.0.creation_date"),
 					resource.TestCheckResourceAttr(resourceName, "metadata.0.parent_group_name", ""),
diff --git a/internal/service/iot/thing_principal_attachment.go b/internal/service/iot/thing_principal_attachment.go
index 429c2288146..b8265a3c991 100644
--- a/internal/service/iot/thing_principal_attachment.go
+++ b/internal/service/iot/thing_principal_attachment.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iot
 
 import (
diff --git a/internal/service/iot/thing_principal_attachment_test.go b/internal/service/iot/thing_principal_attachment_test.go
index dcb1e84d3ba..bf6e1bd0e32 100644
--- a/internal/service/iot/thing_principal_attachment_test.go
+++ b/internal/service/iot/thing_principal_attachment_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iot_test
 
 import (
diff --git a/internal/service/iot/thing_test.go b/internal/service/iot/thing_test.go
index b23c562a3fb..01e228d8c51 100644
--- a/internal/service/iot/thing_test.go
+++ b/internal/service/iot/thing_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iot_test
 
 import (
diff --git a/internal/service/iot/thing_type.go b/internal/service/iot/thing_type.go
index f9039328136..eb7eca6fd62 100644
--- a/internal/service/iot/thing_type.go
+++ b/internal/service/iot/thing_type.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iot
 
 import (
@@ -36,6 +39,15 @@ func ResourceThingType() *schema.Resource {
 		},
 
 		Schema: map[string]*schema.Schema{
+			"arn": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"deprecated": {
+				Type:     schema.TypeBool,
+				Optional: true,
+				Default:  false,
+			},
 			"name": {
 				Type:         schema.TypeString,
 				Required:     true,
@@ -69,17 +81,8 @@ func ResourceThingType() *schema.Resource {
 					},
 				},
 			},
-			"deprecated": {
-				Type:     schema.TypeBool,
-				Optional: true,
-				Default:  false,
-			},
 			names.AttrTags:    tftags.TagsSchema(),
 			names.AttrTagsAll: tftags.TagsSchemaComputed(),
-			"arn": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
 		},
 
 		CustomizeDiff: verify.SetTagsDiff,
@@ -90,16 +93,15 @@ func resourceThingTypeCreate(ctx context.Context, d *schema.ResourceData, meta i
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).IoTConn(ctx)
 
+	name := d.Get("name").(string)
 	input := &iot.CreateThingTypeInput{
 		Tags:          getTagsIn(ctx),
-		ThingTypeName: aws.String(d.Get("name").(string)),
+		ThingTypeName: aws.String(name),
 	}
 
 	if v, ok := d.GetOk("properties"); ok {
 		configs := v.([]interface{})
-		config, ok := configs[0].(map[string]interface{})
-
-		if ok && config != nil {
+		if config, ok := configs[0].(map[string]interface{}); ok && config != nil {
 			input.ThingTypeProperties = expandThingTypeProperties(config)
 		}
 	}
@@ -107,21 +109,21 @@ func resourceThingTypeCreate(ctx context.Context, d *schema.ResourceData, meta i
 	out, err := conn.CreateThingTypeWithContext(ctx, input)
 
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "creating IoT Thing Type (%s): %s", d.Get("name").(string), err)
+		return sdkdiag.AppendErrorf(diags, "creating IoT Thing Type (%s): %s", name, err)
 	}
 
 	d.SetId(aws.StringValue(out.ThingTypeName))
 
 	if v := d.Get("deprecated").(bool); v {
-		params := &iot.DeprecateThingTypeInput{
+		input := &iot.DeprecateThingTypeInput{
 			ThingTypeName: aws.String(d.Id()),
 			UndoDeprecate: aws.Bool(false),
 		}
 
-		_, err := conn.DeprecateThingTypeWithContext(ctx, params)
+		_, err := conn.DeprecateThingTypeWithContext(ctx, input)
 
 		if err != nil {
-			return sdkdiag.AppendErrorf(diags, "creating IoT Thing Type (%s): deprecating Thing Type: %s", d.Get("name").(string), err)
+			return sdkdiag.AppendErrorf(diags, "deprecating IoT Thing Type (%s): %s", d.Id(), err)
 		}
 	}
 
@@ -132,30 +134,26 @@ func resourceThingTypeRead(ctx context.Context, d *schema.ResourceData, meta int
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).IoTConn(ctx)
 
-	params := &iot.DescribeThingTypeInput{
-		ThingTypeName: aws.String(d.Id()),
+	output, err := FindThingTypeByName(ctx, conn, d.Id())
+
+	if !d.IsNewResource() && tfresource.NotFound(err) {
+		log.Printf("[WARN] IoT Thing Type (%s) not found, removing from state", d.Id())
+		d.SetId("")
+		return diags
 	}
-	log.Printf("[DEBUG] Reading IoT Thing Type: %s", params)
-	out, err := conn.DescribeThingTypeWithContext(ctx, params)
 
 	if err != nil {
-		if tfawserr.ErrCodeEquals(err, iot.ErrCodeResourceNotFoundException) {
-			log.Printf("[WARN] IoT Thing Type (%s) not found, removing from state", d.Id())
-			d.SetId("")
-		}
-		return sdkdiag.AppendErrorf(diags, "reading IoT Thing Type (%s): %s", d.Id(), err)
+		return diag.Errorf("reading IoT Thing Type (%s): %s", d.Id(), err)
 	}
 
-	if out.ThingTypeMetadata != nil {
-		d.Set("deprecated", out.ThingTypeMetadata.Deprecated)
+	d.Set("arn", output.ThingTypeArn)
+	if output.ThingTypeMetadata != nil {
+		d.Set("deprecated", output.ThingTypeMetadata.Deprecated)
 	}
-
-	if err := d.Set("properties", flattenThingTypeProperties(out.ThingTypeProperties)); err != nil {
+	if err := d.Set("properties", flattenThingTypeProperties(output.ThingTypeProperties)); err != nil {
 		return sdkdiag.AppendErrorf(diags, "setting properties: %s", err)
 	}
 
-	d.Set("arn", out.ThingTypeArn)
-
 	return diags
 }
 
@@ -164,16 +162,15 @@ func resourceThingTypeUpdate(ctx context.Context, d *schema.ResourceData, meta i
 	conn := meta.(*conns.AWSClient).IoTConn(ctx)
 
 	if d.HasChange("deprecated") {
-		params := &iot.DeprecateThingTypeInput{
+		input := &iot.DeprecateThingTypeInput{
 			ThingTypeName: aws.String(d.Id()),
 			UndoDeprecate: aws.Bool(!d.Get("deprecated").(bool)),
 		}
 
-		log.Printf("[DEBUG] Updating IoT Thing Type: %s", params)
-		_, err := conn.DeprecateThingTypeWithContext(ctx, params)
+		_, err := conn.DeprecateThingTypeWithContext(ctx, input)
 
 		if err != nil {
-			return sdkdiag.AppendErrorf(diags, "updating IoT Thing Type (%s): deprecating Thing Type: %s", d.Id(), err)
+			return sdkdiag.AppendErrorf(diags, "deprecating IoT Thing Type (%s): %s", d.Id(), err)
 		}
 	}
 
@@ -184,49 +181,58 @@ func resourceThingTypeDelete(ctx context.Context, d *schema.ResourceData, meta i
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).IoTConn(ctx)
 
-	// In order to delete an IoT Thing Type, you must deprecate it first and wait
-	// at least 5 minutes.
-	deprecateParams := &iot.DeprecateThingTypeInput{
+	// In order to delete an IoT Thing Type, you must deprecate it first and wait at least 5 minutes.
+	_, err := conn.DeprecateThingTypeWithContext(ctx, &iot.DeprecateThingTypeInput{
 		ThingTypeName: aws.String(d.Id()),
+	})
+
+	if tfawserr.ErrCodeEquals(err, iot.ErrCodeResourceNotFoundException) {
+		return nil
 	}
-	log.Printf("[DEBUG] Deprecating IoT Thing Type: %s", deprecateParams)
-	_, err := conn.DeprecateThingTypeWithContext(ctx, deprecateParams)
 
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "deleting IoT Thing Type (%s): deprecating Thing Type: %s", d.Id(), err)
+		return sdkdiag.AppendErrorf(diags, "deprecating IoT Thing Type (%s): %s", d.Id(), err)
 	}
 
-	deleteParams := &iot.DeleteThingTypeInput{
-		ThingTypeName: aws.String(d.Id()),
+	log.Printf("[DEBUG] Deleting IoT Thing Type: %s", d.Id())
+	_, err = tfresource.RetryWhenAWSErrMessageContains(ctx, 6*time.Minute, func() (interface{}, error) {
+		return conn.DeleteThingTypeWithContext(ctx, &iot.DeleteThingTypeInput{
+			ThingTypeName: aws.String(d.Id()),
+		})
+	}, iot.ErrCodeInvalidRequestException, "Please wait for 5 minutes after deprecation and then retry")
+
+	if tfawserr.ErrCodeEquals(err, iot.ErrCodeResourceNotFoundException) {
+		return nil
 	}
 
-	err = retry.RetryContext(ctx, 6*time.Minute, func() *retry.RetryError {
-		_, err := conn.DeleteThingTypeWithContext(ctx, deleteParams)
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "deleting IoT Thing Type (%s): %s", d.Id(), err)
+	}
 
-		if err != nil {
-			if tfawserr.ErrMessageContains(err, iot.ErrCodeInvalidRequestException, "Please wait for 5 minutes after deprecation and then retry") {
-				return retry.RetryableError(err)
-			}
+	return diags
+}
 
-			// As the delay post-deprecation is about 5 minutes, it may have been
-			// deleted in between, thus getting a Not Found Exception.
-			if tfawserr.ErrCodeEquals(err, iot.ErrCodeResourceNotFoundException) {
-				return nil
-			}
+func FindThingTypeByName(ctx context.Context, conn *iot.IoT, name string) (*iot.DescribeThingTypeOutput, error) {
+	input := &iot.DescribeThingTypeInput{
+		ThingTypeName: aws.String(name),
+	}
 
-			return retry.NonRetryableError(err)
-		}
+	output, err := conn.DescribeThingTypeWithContext(ctx, input)
 
-		return nil
-	})
-	if tfresource.TimedOut(err) {
-		_, err = conn.DeleteThingTypeWithContext(ctx, deleteParams)
-		if tfawserr.ErrCodeEquals(err, iot.ErrCodeResourceNotFoundException) {
-			return diags
+	if tfawserr.ErrCodeEquals(err, iot.ErrCodeResourceNotFoundException) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
 		}
 	}
+
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "deleting IoT Thing Type (%s): %s", d.Id(), err)
+		return nil, err
 	}
-	return diags
+
+	if output == nil {
+		return nil, tfresource.NewEmptyResultError(input)
+	}
+
+	return output, nil
 }
diff --git a/internal/service/iot/thing_type_test.go b/internal/service/iot/thing_type_test.go
index 64192bf1630..16dccd9eaac 100644
--- a/internal/service/iot/thing_type_test.go
+++ b/internal/service/iot/thing_type_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iot_test
 
 import (
@@ -5,18 +8,20 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/iot"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	tfiot "github.com/hashicorp/terraform-provider-aws/internal/service/iot"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
 func TestAccIoTThingType_basic(t *testing.T) {
 	ctx := acctest.Context(t)
-	rInt := sdkacctest.RandInt()
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_iot_thing_type.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
@@ -25,17 +30,17 @@ func TestAccIoTThingType_basic(t *testing.T) {
 		CheckDestroy:             testAccCheckThingTypeDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccThingTypeConfig_basic(rInt),
+				Config: testAccThingTypeConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckThingTypeExists(ctx, "aws_iot_thing_type.foo"),
-					resource.TestCheckResourceAttrSet("aws_iot_thing_type.foo", "arn"),
-					resource.TestCheckResourceAttr("aws_iot_thing_type.foo", "name", fmt.Sprintf("tf_acc_iot_thing_type_%d", rInt)),
-					resource.TestCheckResourceAttr("aws_iot_thing_type.foo", "tags.%", "0"),
-					resource.TestCheckResourceAttr("aws_iot_thing_type.foo", "tags_all.%", "0"),
+					testAccCheckThingTypeExists(ctx, resourceName),
+					resource.TestCheckResourceAttrSet(resourceName, "arn"),
+					resource.TestCheckResourceAttr(resourceName, "deprecated", "false"),
+					resource.TestCheckResourceAttr(resourceName, "name", rName),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 				),
 			},
 			{
-				ResourceName:      "aws_iot_thing_type.foo",
+				ResourceName:      resourceName,
 				ImportState:       true,
 				ImportStateVerify: true,
 			},
@@ -43,9 +48,33 @@ func TestAccIoTThingType_basic(t *testing.T) {
 	})
 }
 
+func TestAccIoTThingType_disappears(t *testing.T) {
+	ctx := acctest.Context(t)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_iot_thing_type.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, iot.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckThingTypeDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccThingTypeConfig_basic(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckThingTypeExists(ctx, resourceName),
+					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfiot.ResourceThingType(), resourceName),
+				),
+				ExpectNonEmptyPlan: true,
+			},
+		},
+	})
+}
+
 func TestAccIoTThingType_full(t *testing.T) {
 	ctx := acctest.Context(t)
-	rInt := sdkacctest.RandInt()
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_iot_thing_type.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
@@ -54,26 +83,27 @@ func TestAccIoTThingType_full(t *testing.T) {
 		CheckDestroy:             testAccCheckThingTypeDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccThingTypeConfig_full(rInt),
+				Config: testAccThingTypeConfig_full(rName, true),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckThingTypeExists(ctx, "aws_iot_thing_type.foo"),
-					resource.TestCheckResourceAttrSet("aws_iot_thing_type.foo", "arn"),
-					resource.TestCheckResourceAttr("aws_iot_thing_type.foo", "properties.0.description", "MyDescription"),
-					resource.TestCheckResourceAttr("aws_iot_thing_type.foo", "properties.0.searchable_attributes.#", "3"),
-					resource.TestCheckResourceAttr("aws_iot_thing_type.foo", "deprecated", "true"),
-					resource.TestCheckResourceAttr("aws_iot_thing_type.foo", "tags.%", "1"),
-					resource.TestCheckResourceAttr("aws_iot_thing_type.foo", "tags_all.%", "1"),
+					testAccCheckThingTypeExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "deprecated", "true"),
+					resource.TestCheckResourceAttr(resourceName, "properties.0.description", "MyDescription"),
+					resource.TestCheckResourceAttr(resourceName, "properties.0.searchable_attributes.#", "3"),
+					resource.TestCheckTypeSetElemAttr(resourceName, "properties.0.searchable_attributes.*", "foo"),
+					resource.TestCheckTypeSetElemAttr(resourceName, "properties.0.searchable_attributes.*", "bar"),
+					resource.TestCheckTypeSetElemAttr(resourceName, "properties.0.searchable_attributes.*", "baz"),
 				),
 			},
 			{
-				ResourceName:      "aws_iot_thing_type.foo",
+				ResourceName:      resourceName,
 				ImportState:       true,
 				ImportStateVerify: true,
 			},
 			{
-				Config: testAccThingTypeConfig_fullUpdated(rInt),
+				Config: testAccThingTypeConfig_full(rName, false),
 				Check: resource.ComposeTestCheckFunc(
-					resource.TestCheckResourceAttr("aws_iot_thing_type.foo", "deprecated", "false"),
+					testAccCheckThingTypeExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "deprecated", "false"),
 				),
 			},
 		},
@@ -82,8 +112,8 @@ func TestAccIoTThingType_full(t *testing.T) {
 
 func TestAccIoTThingType_tags(t *testing.T) {
 	ctx := acctest.Context(t)
-	rName := sdkacctest.RandString(5)
-	resourceName := "aws_iot_thing_type.foo"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_iot_thing_type.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
@@ -92,11 +122,11 @@ func TestAccIoTThingType_tags(t *testing.T) {
 		CheckDestroy:             testAccCheckThingTypeDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccThingTypeConfig_tags1(rName, "key1", "user@example"),
+				Config: testAccThingTypeConfig_tags1(rName, "key1", "value1"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckThingTypeExists(ctx, "aws_iot_thing_type.foo"),
+					testAccCheckThingTypeExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
-					resource.TestCheckResourceAttr(resourceName, "tags.key1", "user@example"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
 				),
 			},
 			{
@@ -105,18 +135,18 @@ func TestAccIoTThingType_tags(t *testing.T) {
 				ImportStateVerify: true,
 			},
 			{
-				Config: testAccThingTypeConfig_tags2(rName, "key1", "user@example", "key2", "value2"),
+				Config: testAccThingTypeConfig_tags2(rName, "key1", "value1updated", "key2", "value2"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckThingTypeExists(ctx, "aws_iot_thing_type.foo"),
+					testAccCheckThingTypeExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
-					resource.TestCheckResourceAttr(resourceName, "tags.key1", "user@example"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1updated"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
 				),
 			},
 			{
 				Config: testAccThingTypeConfig_tags1(rName, "key2", "value2"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckThingTypeExists(ctx, "aws_iot_thing_type.foo"),
+					testAccCheckThingTypeExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
 				),
@@ -125,29 +155,18 @@ func TestAccIoTThingType_tags(t *testing.T) {
 	})
 }
 
-func testAccCheckThingTypeExists(ctx context.Context, name string) resource.TestCheckFunc {
+func testAccCheckThingTypeExists(ctx context.Context, n string) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		rs, ok := s.RootModule().Resources[name]
+		rs, ok := s.RootModule().Resources[n]
 		if !ok {
-			return fmt.Errorf("Not found: %s", name)
+			return fmt.Errorf("Not found: %s", n)
 		}
 
 		conn := acctest.Provider.Meta().(*conns.AWSClient).IoTConn(ctx)
-		input := &iot.ListThingTypesInput{}
-
-		output, err := conn.ListThingTypesWithContext(ctx, input)
 
-		if err != nil {
-			return err
-		}
+		_, err := tfiot.FindThingTypeByName(ctx, conn, rs.Primary.ID)
 
-		for _, rule := range output.ThingTypes {
-			if aws.StringValue(rule.ThingTypeName) == rs.Primary.ID {
-				return nil
-			}
-		}
-
-		return fmt.Errorf("IoT Topic Rule (%s) not found", rs.Primary.ID)
+		return err
 	}
 }
 
@@ -160,68 +179,49 @@ func testAccCheckThingTypeDestroy(ctx context.Context) resource.TestCheckFunc {
 				continue
 			}
 
-			params := &iot.DescribeThingTypeInput{
-				ThingTypeName: aws.String(rs.Primary.ID),
+			_, err := tfiot.FindThingTypeByName(ctx, conn, rs.Primary.ID)
+
+			if tfresource.NotFound(err) {
+				continue
 			}
 
-			_, err := conn.DescribeThingTypeWithContext(ctx, params)
-			if err == nil {
-				return fmt.Errorf("Expected IoT Thing Type to be destroyed, %s found", rs.Primary.ID)
+			if err != nil {
+				return err
 			}
+
+			return fmt.Errorf("IoT Thing Type %s still exists", rs.Primary.ID)
 		}
 
 		return nil
 	}
 }
 
-func testAccThingTypeConfig_basic(rName int) string {
+func testAccThingTypeConfig_basic(rName string) string {
 	return fmt.Sprintf(`
-resource "aws_iot_thing_type" "foo" {
-  name = "tf_acc_iot_thing_type_%d"
-}
-`, rName)
-}
-
-func testAccThingTypeConfig_full(rName int) string {
-	return fmt.Sprintf(`
-resource "aws_iot_thing_type" "foo" {
-  name       = "tf_acc_iot_thing_type_%d"
-  deprecated = true
-
-  properties {
-    description           = "MyDescription"
-    searchable_attributes = ["foo", "bar", "baz"]
-  }
-
-  tags = {
-    testtag = "MyTagValue"
-  }
+resource "aws_iot_thing_type" "test" {
+  name = %[1]q
 }
 `, rName)
 }
 
-func testAccThingTypeConfig_fullUpdated(rName int) string {
+func testAccThingTypeConfig_full(rName string, deprecated bool) string {
 	return fmt.Sprintf(`
-resource "aws_iot_thing_type" "foo" {
-  name       = "tf_acc_iot_thing_type_%d"
-  deprecated = false
+resource "aws_iot_thing_type" "test" {
+  name       = %[1]q
+  deprecated = %[2]t
 
   properties {
     description           = "MyDescription"
     searchable_attributes = ["foo", "bar", "baz"]
   }
-
-  tags = {
-    testtag = "MyTagValue"
-  }
 }
-`, rName)
+`, rName, deprecated)
 }
 
 func testAccThingTypeConfig_tags1(rName, tagKey1, tagValue1 string) string {
 	return fmt.Sprintf(`
-resource "aws_iot_thing_type" "foo" {
-  name       = "tf_acc_iot_thing_type_%[1]s"
+resource "aws_iot_thing_type" "test" {
+  name       = %[1]q
   deprecated = false
 
   tags = {
@@ -233,8 +233,8 @@ resource "aws_iot_thing_type" "foo" {
 
 func testAccThingTypeConfig_tags2(rName, tagKey1, tagValue1, tagKey2, tagValue2 string) string {
 	return fmt.Sprintf(`
-resource "aws_iot_thing_type" "foo" {
-  name       = "tf_acc_iot_thing_type_%[1]s"
+resource "aws_iot_thing_type" "test" {
+  name       = %[1]q
   deprecated = false
 
   tags = {
diff --git a/internal/service/iot/topic_rule.go b/internal/service/iot/topic_rule.go
index 0135aa0fb6e..f32d81c9287 100644
--- a/internal/service/iot/topic_rule.go
+++ b/internal/service/iot/topic_rule.go
@@ -1,8 +1,12 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iot
 
 import (
 	"context"
 	"log"
+	"reflect"
 
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/iot"
@@ -1700,6 +1704,10 @@ func expandKafkaAction(tfList []interface{}) *iot.KafkaAction {
 		apiObject.Topic = aws.String(v)
 	}
 
+	if reflect.DeepEqual(&iot.KafkaAction{}, apiObject) {
+		return nil
+	}
+
 	return apiObject
 }
 
diff --git a/internal/service/iot/topic_rule_destination.go b/internal/service/iot/topic_rule_destination.go
index fd443beb4be..1fbd529c34a 100644
--- a/internal/service/iot/topic_rule_destination.go
+++ b/internal/service/iot/topic_rule_destination.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iot
 
 import (
diff --git a/internal/service/iot/topic_rule_destination_test.go b/internal/service/iot/topic_rule_destination_test.go
index 739ee96fc31..9cbdacbed19 100644
--- a/internal/service/iot/topic_rule_destination_test.go
+++ b/internal/service/iot/topic_rule_destination_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iot_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/iot"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -31,7 +34,7 @@ func TestAccIoTTopicRuleDestination_basic(t *testing.T) {
 				Config: testAccTopicRuleDestinationConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckTopicRuleDestinationExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "iot", regexp.MustCompile(`ruledestination/vpc/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "iot", regexache.MustCompile(`ruledestination/vpc/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "enabled", "true"),
 					resource.TestCheckResourceAttr(resourceName, "vpc_configuration.#", "1"),
 					resource.TestCheckResourceAttrSet(resourceName, "vpc_configuration.0.role_arn"),
diff --git a/internal/service/iot/topic_rule_test.go b/internal/service/iot/topic_rule_test.go
index ba7b6f30dd1..e7ca47e5bbf 100644
--- a/internal/service/iot/topic_rule_test.go
+++ b/internal/service/iot/topic_rule_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iot_test
 
 import (
@@ -158,7 +161,7 @@ func TestAccIoTTopicRule_cloudWatchAlarm(t *testing.T) {
 		CheckDestroy:             testAccCheckTopicRuleDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccTopicRuleConfig_cloudWatchAlarm(rName),
+				Config: testAccTopicRuleConfig_cloudWatchAlarm(rName, "myalarm"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckTopicRuleExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "cloudwatch_alarm.#", "1"),
@@ -194,6 +197,38 @@ func TestAccIoTTopicRule_cloudWatchAlarm(t *testing.T) {
 				ImportState:       true,
 				ImportStateVerify: true,
 			},
+			{
+				Config: testAccTopicRuleConfig_cloudWatchAlarm(rName, "differentName"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckTopicRuleExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "cloudwatch_alarm.#", "1"),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "cloudwatch_alarm.*", map[string]string{
+						"alarm_name":   "differentName",
+						"state_reason": "test",
+						"state_value":  "OK",
+					}),
+					resource.TestCheckResourceAttr(resourceName, "cloudwatch_logs.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "cloudwatch_metric.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "description", "Example rule"),
+					resource.TestCheckResourceAttr(resourceName, "dynamodb.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "dynamodbv2.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "elasticsearch.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "error_action.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "firehose.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "http.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "iot_analytics.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "iot_events.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "kafka.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "kinesis.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "lambda.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "republish.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "s3.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "sns.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "sqs.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "step_functions.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "timestream.#", "0"),
+				),
+			},
 		},
 	})
 }
@@ -210,7 +245,7 @@ func TestAccIoTTopicRule_cloudWatchLogs(t *testing.T) {
 		CheckDestroy:             testAccCheckTopicRuleDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccTopicRuleConfig_cloudWatchLogs(rName),
+				Config: testAccTopicRuleConfig_cloudWatchLogs(rName, "mylogs1"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckTopicRuleExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "cloudwatch_alarm.#", "0"),
@@ -247,6 +282,39 @@ func TestAccIoTTopicRule_cloudWatchLogs(t *testing.T) {
 				ImportState:       true,
 				ImportStateVerify: true,
 			},
+			{
+				Config: testAccTopicRuleConfig_cloudWatchLogs(rName, "updatedlogs1"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckTopicRuleExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "cloudwatch_alarm.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "cloudwatch_logs.#", "2"),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "cloudwatch_logs.*", map[string]string{
+						"log_group_name": "updatedlogs1",
+					}),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "cloudwatch_logs.*", map[string]string{
+						"log_group_name": "mylogs2",
+					}),
+					resource.TestCheckResourceAttr(resourceName, "cloudwatch_metric.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "dynamodb.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "dynamodbv2.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "elasticsearch.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "enabled", "false"),
+					resource.TestCheckResourceAttr(resourceName, "error_action.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "firehose.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "http.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "iot_analytics.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "iot_events.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "kafka.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "kinesis.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "lambda.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "republish.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "s3.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "sns.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "sqs.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "step_functions.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "timestream.#", "0"),
+				),
+			},
 		},
 	})
 }
@@ -263,7 +331,7 @@ func TestAccIoTTopicRule_cloudWatchMetric(t *testing.T) {
 		CheckDestroy:             testAccCheckTopicRuleDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccTopicRuleConfig_cloudWatchMetric(rName),
+				Config: testAccTopicRuleConfig_cloudWatchMetric(rName, "TestName"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckTopicRuleExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "cloudwatch_alarm.#", "0"),
@@ -294,6 +362,38 @@ func TestAccIoTTopicRule_cloudWatchMetric(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "timestream.#", "0"),
 				),
 			},
+			{
+				Config: testAccTopicRuleConfig_cloudWatchMetric(rName, "OtherName"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckTopicRuleExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "cloudwatch_alarm.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "cloudwatch_logs.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "cloudwatch_metric.#", "1"),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "cloudwatch_metric.*", map[string]string{
+						"metric_name":      "OtherName",
+						"metric_namespace": "TestNS",
+						"metric_unit":      "s",
+						"metric_value":     "10",
+					}),
+					resource.TestCheckResourceAttr(resourceName, "dynamodb.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "dynamodbv2.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "elasticsearch.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "error_action.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "firehose.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "http.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "iot_analytics.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "iot_events.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "kafka.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "kinesis.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "lambda.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "republish.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "s3.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "sns.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "sqs.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "step_functions.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "timestream.#", "0"),
+				),
+			},
 			{
 				ResourceName:      resourceName,
 				ImportState:       true,
@@ -315,7 +415,7 @@ func TestAccIoTTopicRule_dynamoDB(t *testing.T) {
 		CheckDestroy:             testAccCheckTopicRuleDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccTopicRuleConfig_dynamoDB(rName),
+				Config: testAccTopicRuleConfig_dynamoDB(rName, "tn"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckTopicRuleExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "cloudwatch_alarm.#", "0"),
@@ -353,7 +453,7 @@ func TestAccIoTTopicRule_dynamoDB(t *testing.T) {
 				ImportStateVerify: true,
 			},
 			{
-				Config: testAccTopicRuleConfig_dynamoDBRangeKey(rName),
+				Config: testAccTopicRuleConfig_dynamoDBRangeKey(rName, "tn"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckTopicRuleExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "cloudwatch_alarm.#", "0"),
@@ -405,7 +505,7 @@ func TestAccIoTTopicRule_dynamoDBv2(t *testing.T) {
 		CheckDestroy:             testAccCheckTopicRuleDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccTopicRuleConfig_dynamoDBv2(rName),
+				Config: testAccTopicRuleConfig_dynamoDBv2(rName, "test"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckTopicRuleExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "cloudwatch_alarm.#", "0"),
@@ -434,6 +534,36 @@ func TestAccIoTTopicRule_dynamoDBv2(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "timestream.#", "0"),
 				),
 			},
+			{
+				Config: testAccTopicRuleConfig_dynamoDBv2(rName, "updated"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckTopicRuleExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "cloudwatch_alarm.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "cloudwatch_logs.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "cloudwatch_metric.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "dynamodb.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "dynamodbv2.#", "1"),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "dynamodbv2.*", map[string]string{
+						"put_item.#":            "1",
+						"put_item.0.table_name": "updated",
+					}),
+					resource.TestCheckResourceAttr(resourceName, "elasticsearch.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "error_action.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "firehose.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "http.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "iot_analytics.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "iot_events.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "kafka.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "kinesis.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "lambda.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "republish.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "s3.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "sns.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "sqs.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "step_functions.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "timestream.#", "0"),
+				),
+			},
 		},
 	})
 }
@@ -450,7 +580,7 @@ func TestAccIoTTopicRule_elasticSearch(t *testing.T) {
 		CheckDestroy:             testAccCheckTopicRuleDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccTopicRuleConfig_elasticSearch(rName),
+				Config: testAccTopicRuleConfig_elasticSearch(rName, "myindex"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckTopicRuleExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "cloudwatch_alarm.#", "0"),
@@ -485,6 +615,37 @@ func TestAccIoTTopicRule_elasticSearch(t *testing.T) {
 				ImportState:       true,
 				ImportStateVerify: true,
 			},
+			{
+				Config: testAccTopicRuleConfig_elasticSearch(rName, "updatedindex"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckTopicRuleExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "cloudwatch_alarm.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "cloudwatch_logs.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "cloudwatch_metric.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "dynamodb.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "dynamodbv2.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "elasticsearch.#", "1"),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "elasticsearch.*", map[string]string{
+						"id":    "myIdentifier",
+						"index": "updatedindex",
+						"type":  "mydocument",
+					}),
+					resource.TestCheckResourceAttr(resourceName, "error_action.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "firehose.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "http.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "iot_analytics.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "iot_events.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "kafka.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "kinesis.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "lambda.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "republish.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "s3.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "sns.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "sqs.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "step_functions.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "timestream.#", "0"),
+				),
+			},
 		},
 	})
 }
@@ -501,7 +662,7 @@ func TestAccIoTTopicRule_firehose(t *testing.T) {
 		CheckDestroy:             testAccCheckTopicRuleDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccTopicRuleConfig_firehose(rName),
+				Config: testAccTopicRuleConfig_firehose(rName, "mystream1"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckTopicRuleExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "cloudwatch_alarm.#", "0"),
@@ -540,6 +701,41 @@ func TestAccIoTTopicRule_firehose(t *testing.T) {
 				ImportState:       true,
 				ImportStateVerify: true,
 			},
+			{
+				Config: testAccTopicRuleConfig_firehose(rName, "updatedstream1"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckTopicRuleExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "cloudwatch_alarm.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "cloudwatch_logs.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "cloudwatch_metric.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "dynamodb.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "dynamodbv2.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "elasticsearch.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "error_action.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "firehose.#", "3"),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "firehose.*", map[string]string{
+						"delivery_stream_name": "updatedstream1",
+					}),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "firehose.*", map[string]string{
+						"delivery_stream_name": "mystream2",
+					}),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "firehose.*", map[string]string{
+						"delivery_stream_name": "mystream3",
+					}),
+					resource.TestCheckResourceAttr(resourceName, "http.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "iot_analytics.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "iot_events.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "kafka.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "kinesis.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "lambda.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "republish.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "s3.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "sns.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "sqs.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "step_functions.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "timestream.#", "0"),
+				),
+			},
 		},
 	})
 }
@@ -884,7 +1080,7 @@ func TestAccIoTTopicRule_IoT_analytics(t *testing.T) {
 		CheckDestroy:             testAccCheckTopicRuleDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccTopicRuleConfig_analytics(rName),
+				Config: testAccTopicRuleConfig_analytics(rName, "fakedata"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckTopicRuleExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "cloudwatch_alarm.#", "0"),
@@ -912,6 +1108,35 @@ func TestAccIoTTopicRule_IoT_analytics(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "timestream.#", "0"),
 				),
 			},
+			{
+				Config: testAccTopicRuleConfig_analytics(rName, "differentdata"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckTopicRuleExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "cloudwatch_alarm.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "cloudwatch_logs.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "cloudwatch_metric.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "dynamodb.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "dynamodbv2.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "elasticsearch.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "error_action.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "firehose.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "http.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "iot_analytics.#", "1"),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "iot_analytics.*", map[string]string{
+						"channel_name": "differentdata",
+					}),
+					resource.TestCheckResourceAttr(resourceName, "iot_events.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "kafka.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "kinesis.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "lambda.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "republish.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "s3.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "sns.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "sqs.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "step_functions.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "timestream.#", "0"),
+				),
+			},
 		},
 	})
 }
@@ -928,7 +1153,7 @@ func TestAccIoTTopicRule_IoT_analytics_batch_mode(t *testing.T) {
 		CheckDestroy:             testAccCheckTopicRuleDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccTopicRuleConfig_analytics(rName),
+				Config: testAccTopicRuleConfig_analytics(rName, "fakedata"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckTopicRuleExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "cloudwatch_alarm.#", "0"),
@@ -1115,9 +1340,6 @@ func TestAccIoTTopicRule_IoT_events_batch_mode(t *testing.T) {
 
 func TestAccIoTTopicRule_kafka(t *testing.T) {
 	ctx := acctest.Context(t)
-	if testing.Short() {
-		t.Skip("skipping long-running test in short mode")
-	}
 
 	rName := testAccTopicRuleName()
 	resourceName := "aws_iot_topic_rule.test"
@@ -1129,7 +1351,7 @@ func TestAccIoTTopicRule_kafka(t *testing.T) {
 		CheckDestroy:             testAccCheckTopicRuleDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccTopicRuleConfig_kafka(rName),
+				Config: testAccTopicRuleConfig_kafka(rName, "fake_topic", "b-1.localhost:9094"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckTopicRuleExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "cloudwatch_alarm.#", "0"),
@@ -1165,6 +1387,81 @@ func TestAccIoTTopicRule_kafka(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "timestream.#", "0"),
 				),
 			},
+			{
+				Config: testAccTopicRuleConfig_kafka(rName, "different_topic", "b-2.localhost:9094"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckTopicRuleExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "cloudwatch_alarm.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "cloudwatch_logs.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "cloudwatch_metric.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "dynamodb.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "dynamodbv2.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "elasticsearch.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "error_action.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "firehose.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "iot_analytics.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "iot_events.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "http.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "kafka.#", "1"),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "kafka.*", map[string]string{
+						"client_properties.%":                     "8",
+						"client_properties.acks":                  "1",
+						"client_properties.bootstrap.servers":     "b-2.localhost:9094",
+						"client_properties.compression.type":      "none",
+						"client_properties.key.serializer":        "org.apache.kafka.common.serialization.StringSerializer",
+						"client_properties.security.protocol":     "SSL",
+						"client_properties.ssl.keystore.password": "password",
+						"client_properties.value.serializer":      "org.apache.kafka.common.serialization.ByteBufferSerializer",
+						"topic":                                   "different_topic",
+					}),
+					resource.TestCheckResourceAttr(resourceName, "kinesis.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "lambda.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "republish.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "s3.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "sns.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "sqs.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "step_functions.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "timestream.#", "0"),
+				),
+			},
+			// Validate that updates only to a value inside the schema-less client_properties also works
+			{
+				Config: testAccTopicRuleConfig_kafka(rName, "different_topic", "b-3.localhost:9094"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckTopicRuleExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "cloudwatch_alarm.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "cloudwatch_logs.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "cloudwatch_metric.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "dynamodb.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "dynamodbv2.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "elasticsearch.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "error_action.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "firehose.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "iot_analytics.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "iot_events.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "http.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "kafka.#", "1"),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "kafka.*", map[string]string{
+						"client_properties.%":                     "8",
+						"client_properties.acks":                  "1",
+						"client_properties.bootstrap.servers":     "b-3.localhost:9094",
+						"client_properties.compression.type":      "none",
+						"client_properties.key.serializer":        "org.apache.kafka.common.serialization.StringSerializer",
+						"client_properties.security.protocol":     "SSL",
+						"client_properties.ssl.keystore.password": "password",
+						"client_properties.value.serializer":      "org.apache.kafka.common.serialization.ByteBufferSerializer",
+						"topic":                                   "different_topic",
+					}),
+					resource.TestCheckResourceAttr(resourceName, "kinesis.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "lambda.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "republish.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "s3.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "sns.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "sqs.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "step_functions.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "timestream.#", "0"),
+				),
+			},
 			{
 				ResourceName:      resourceName,
 				ImportState:       true,
@@ -1190,7 +1487,7 @@ func TestAccIoTTopicRule_kinesis(t *testing.T) {
 		CheckDestroy:             testAccCheckTopicRuleDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccTopicRuleConfig_kinesis(rName),
+				Config: testAccTopicRuleConfig_kinesis(rName, "mystream"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckTopicRuleExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "cloudwatch_alarm.#", "0"),
@@ -1218,6 +1515,35 @@ func TestAccIoTTopicRule_kinesis(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "timestream.#", "0"),
 				),
 			},
+			{
+				Config: testAccTopicRuleConfig_kinesis(rName, "otherstream"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckTopicRuleExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "cloudwatch_alarm.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "cloudwatch_logs.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "cloudwatch_metric.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "dynamodb.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "dynamodbv2.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "elasticsearch.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "error_action.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "firehose.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "http.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "iot_analytics.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "iot_events.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "kafka.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "kinesis.#", "1"),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "kinesis.*", map[string]string{
+						"stream_name": "otherstream",
+					}),
+					resource.TestCheckResourceAttr(resourceName, "lambda.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "republish.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "s3.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "sns.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "sqs.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "step_functions.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "timestream.#", "0"),
+				),
+			},
 			{
 				ResourceName:      resourceName,
 				ImportState:       true,
@@ -1285,7 +1611,7 @@ func TestAccIoTTopicRule_republish(t *testing.T) {
 		CheckDestroy:             testAccCheckTopicRuleDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccTopicRuleConfig_republish(rName),
+				Config: testAccTopicRuleConfig_republish(rName, "mytopic"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckTopicRuleExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "cloudwatch_alarm.#", "0"),
@@ -1319,6 +1645,36 @@ func TestAccIoTTopicRule_republish(t *testing.T) {
 				ImportState:       true,
 				ImportStateVerify: true,
 			},
+			{
+				Config: testAccTopicRuleConfig_republish(rName, "othertopic"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckTopicRuleExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "cloudwatch_alarm.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "cloudwatch_logs.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "cloudwatch_metric.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "dynamodb.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "dynamodbv2.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "elasticsearch.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "error_action.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "firehose.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "http.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "iot_analytics.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "iot_events.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "kafka.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "kinesis.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "lambda.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "republish.#", "1"),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "republish.*", map[string]string{
+						"qos":   "0",
+						"topic": "othertopic",
+					}),
+					resource.TestCheckResourceAttr(resourceName, "s3.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "sns.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "sqs.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "step_functions.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "timestream.#", "0"),
+				),
+			},
 		},
 	})
 }
@@ -1385,7 +1741,7 @@ func TestAccIoTTopicRule_s3(t *testing.T) {
 		CheckDestroy:             testAccCheckTopicRuleDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccTopicRuleConfig_s3(rName),
+				Config: testAccTopicRuleConfig_s3(rName, "mybucket"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckTopicRuleExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "cloudwatch_alarm.#", "0"),
@@ -1415,6 +1771,37 @@ func TestAccIoTTopicRule_s3(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "timestream.#", "0"),
 				),
 			},
+			{
+				Config: testAccTopicRuleConfig_s3(rName, "yourbucket"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckTopicRuleExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "cloudwatch_alarm.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "cloudwatch_logs.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "cloudwatch_metric.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "dynamodb.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "dynamodbv2.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "elasticsearch.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "error_action.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "firehose.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "http.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "iot_analytics.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "iot_events.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "kafka.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "kinesis.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "lambda.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "republish.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "s3.#", "1"),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "s3.*", map[string]string{
+						"bucket_name": "yourbucket",
+						"canned_acl":  "private",
+						"key":         "mykey",
+					}),
+					resource.TestCheckResourceAttr(resourceName, "sns.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "sqs.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "step_functions.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "timestream.#", "0"),
+				),
+			},
 			{
 				ResourceName:      resourceName,
 				ImportState:       true,
@@ -1436,7 +1823,36 @@ func TestAccIoTTopicRule_sns(t *testing.T) {
 		CheckDestroy:             testAccCheckTopicRuleDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccTopicRuleConfig_sns(rName),
+				Config: testAccTopicRuleConfig_sns(rName, "RAW"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckTopicRuleExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "cloudwatch_alarm.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "cloudwatch_logs.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "cloudwatch_metric.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "dynamodb.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "dynamodbv2.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "elasticsearch.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "error_action.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "firehose.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "http.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "iot_analytics.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "iot_events.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "kafka.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "kinesis.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "lambda.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "republish.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "s3.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "sns.#", "1"),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "sns.*", map[string]string{
+						"message_format": "RAW",
+					}),
+					resource.TestCheckResourceAttr(resourceName, "sqs.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "step_functions.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "timestream.#", "0"),
+				),
+			},
+			{
+				Config: testAccTopicRuleConfig_sns(rName, "JSON"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckTopicRuleExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "cloudwatch_alarm.#", "0"),
@@ -1456,6 +1872,9 @@ func TestAccIoTTopicRule_sns(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "republish.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "s3.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "sns.#", "1"),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "sns.*", map[string]string{
+						"message_format": "JSON",
+					}),
 					resource.TestCheckResourceAttr(resourceName, "sqs.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "step_functions.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "timestream.#", "0"),
@@ -1482,7 +1901,7 @@ func TestAccIoTTopicRule_sqs(t *testing.T) {
 		CheckDestroy:             testAccCheckTopicRuleDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccTopicRuleConfig_sqs(rName),
+				Config: testAccTopicRuleConfig_sqs(rName, "fakedata"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckTopicRuleExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "cloudwatch_alarm.#", "0"),
@@ -1511,6 +1930,36 @@ func TestAccIoTTopicRule_sqs(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "timestream.#", "0"),
 				),
 			},
+			{
+				Config: testAccTopicRuleConfig_sqs(rName, "yourdata"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckTopicRuleExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "cloudwatch_alarm.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "cloudwatch_logs.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "cloudwatch_metric.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "dynamodb.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "dynamodbv2.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "elasticsearch.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "error_action.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "firehose.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "http.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "iot_analytics.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "iot_events.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "kafka.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "kinesis.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "lambda.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "republish.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "s3.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "sns.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "sqs.#", "1"),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "sqs.*", map[string]string{
+						"queue_url":  "yourdata",
+						"use_base64": "false",
+					}),
+					resource.TestCheckResourceAttr(resourceName, "step_functions.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "timestream.#", "0"),
+				),
+			},
 			{
 				ResourceName:      resourceName,
 				ImportState:       true,
@@ -1532,7 +1981,7 @@ func TestAccIoTTopicRule_Step_functions(t *testing.T) {
 		CheckDestroy:             testAccCheckTopicRuleDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccTopicRuleConfig_stepFunctions(rName),
+				Config: testAccTopicRuleConfig_stepFunctions(rName, "mystatemachine"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckTopicRuleExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "cloudwatch_alarm.#", "0"),
@@ -1561,6 +2010,36 @@ func TestAccIoTTopicRule_Step_functions(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "timestream.#", "0"),
 				),
 			},
+			{
+				Config: testAccTopicRuleConfig_stepFunctions(rName, "yourstatemachine"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckTopicRuleExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "cloudwatch_alarm.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "cloudwatch_logs.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "cloudwatch_metric.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "dynamodb.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "dynamodbv2.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "elasticsearch.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "error_action.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "firehose.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "http.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "iot_analytics.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "iot_events.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "kafka.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "kinesis.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "lambda.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "republish.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "s3.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "sns.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "sqs.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "step_functions.#", "1"),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "step_functions.*", map[string]string{
+						"execution_name_prefix": "myprefix",
+						"state_machine_name":    "yourstatemachine",
+					}),
+					resource.TestCheckResourceAttr(resourceName, "timestream.#", "0"),
+				),
+			},
 			{
 				ResourceName:      resourceName,
 				ImportState:       true,
@@ -1582,7 +2061,7 @@ func TestAccIoTTopicRule_Timestream(t *testing.T) {
 		CheckDestroy:             testAccCheckTopicRuleDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccTopicRuleConfig_timestream(rName),
+				Config: testAccTopicRuleConfig_timestream(rName, "dim1"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckTopicRuleExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "cloudwatch_alarm.#", "0"),
@@ -1607,15 +2086,61 @@ func TestAccIoTTopicRule_Timestream(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "timestream.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "timestream.*", map[string]string{
 						"database_name":     "TestDB",
-						"dimension.#":       "1",
+						"dimension.#":       "2",
 						"table_name":        "test_table",
 						"timestamp.#":       "1",
 						"timestamp.0.unit":  "MILLISECONDS",
 						"timestamp.0.value": "${time}",
 					}),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "timestream.*.dimension.*", map[string]string{
-						"name":  "dim",
-						"value": "${dim}",
+						"name":  "dim1",
+						"value": "${dim1}",
+					}),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "timestream.*.dimension.*", map[string]string{
+						"name":  "dim2",
+						"value": "${dim2}",
+					}),
+				),
+			},
+			{
+				Config: testAccTopicRuleConfig_timestream(rName, "dim3"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckTopicRuleExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "cloudwatch_alarm.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "cloudwatch_logs.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "cloudwatch_metric.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "dynamodb.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "dynamodbv2.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "elasticsearch.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "error_action.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "firehose.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "http.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "iot_analytics.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "iot_events.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "kafka.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "kinesis.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "lambda.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "republish.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "s3.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "sns.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "sqs.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "step_functions.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "timestream.#", "1"),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "timestream.*", map[string]string{
+						"database_name":     "TestDB",
+						"dimension.#":       "2",
+						"table_name":        "test_table",
+						"timestamp.#":       "1",
+						"timestamp.0.unit":  "MILLISECONDS",
+						"timestamp.0.value": "${time}",
+					}),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "timestream.*.dimension.*", map[string]string{
+						"name":  "dim3",
+						"value": "${dim3}",
+					}),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "timestream.*.dimension.*", map[string]string{
+						"name":  "dim2",
+						"value": "${dim2}",
 					}),
 				),
 			},
@@ -1640,7 +2165,7 @@ func TestAccIoTTopicRule_errorAction(t *testing.T) {
 		CheckDestroy:             testAccCheckTopicRuleDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccTopicRuleConfig_errorAction(rName),
+				Config: testAccTopicRuleConfig_kinesisErrorAction(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckTopicRuleExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "cloudwatch_alarm.#", "0"),
@@ -1710,7 +2235,7 @@ func TestAccIoTTopicRule_updateKinesisErrorAction(t *testing.T) {
 		CheckDestroy:             testAccCheckTopicRuleDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccTopicRuleConfig_kinesis(rName),
+				Config: testAccTopicRuleConfig_kinesis(rName, "mystream"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckTopicRuleExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "cloudwatch_alarm.#", "0"),
@@ -1739,7 +2264,7 @@ func TestAccIoTTopicRule_updateKinesisErrorAction(t *testing.T) {
 				),
 			},
 			{
-				Config: testAccTopicRuleConfig_errorAction(rName),
+				Config: testAccTopicRuleConfig_kinesisErrorAction(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckTopicRuleExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "cloudwatch_alarm.#", "0"),
@@ -1933,7 +2458,7 @@ resource "aws_iot_topic_rule" "test" {
 `, rName, tagKey1, tagValue1, tagKey2, tagValue2)
 }
 
-func testAccTopicRuleConfig_cloudWatchAlarm(rName string) string {
+func testAccTopicRuleConfig_cloudWatchAlarm(rName string, alarmName string) string {
 	return acctest.ConfigCompose(
 		testAccTopicRuleConfig_destinationRole(rName),
 		fmt.Sprintf(`
@@ -1945,16 +2470,16 @@ resource "aws_iot_topic_rule" "test" {
   sql_version = "2015-10-08"
 
   cloudwatch_alarm {
-    alarm_name   = "myalarm"
+    alarm_name   = %[2]q
     role_arn     = aws_iam_role.test.arn
     state_reason = "test"
     state_value  = "OK"
   }
 }
-`, rName))
+`, rName, alarmName))
 }
 
-func testAccTopicRuleConfig_cloudWatchLogs(rName string) string {
+func testAccTopicRuleConfig_cloudWatchLogs(rName string, logGroupName string) string {
 	return acctest.ConfigCompose(
 		testAccTopicRuleConfig_destinationRole(rName),
 		fmt.Sprintf(`
@@ -1965,7 +2490,7 @@ resource "aws_iot_topic_rule" "test" {
   sql_version = "2015-10-08"
 
   cloudwatch_logs {
-    log_group_name = "mylogs1"
+    log_group_name = %[2]q
     role_arn       = aws_iam_role.test.arn
   }
 
@@ -1974,10 +2499,10 @@ resource "aws_iot_topic_rule" "test" {
     role_arn       = aws_iam_role.test.arn
   }
 }
-`, rName))
+`, rName, logGroupName))
 }
 
-func testAccTopicRuleConfig_cloudWatchMetric(rName string) string {
+func testAccTopicRuleConfig_cloudWatchMetric(rName string, metricName string) string {
 	return acctest.ConfigCompose(
 		testAccTopicRuleConfig_destinationRole(rName),
 		fmt.Sprintf(`
@@ -1988,17 +2513,17 @@ resource "aws_iot_topic_rule" "test" {
   sql_version = "2015-10-08"
 
   cloudwatch_metric {
-    metric_name      = "TestName"
+    metric_name      = %[2]q
     metric_namespace = "TestNS"
     metric_value     = "10"
     metric_unit      = "s"
     role_arn         = aws_iam_role.test.arn
   }
 }
-`, rName))
+`, rName, metricName))
 }
 
-func testAccTopicRuleConfig_dynamoDB(rName string) string {
+func testAccTopicRuleConfig_dynamoDB(rName string, tableName string) string {
 	return acctest.ConfigCompose(
 		testAccTopicRuleConfig_destinationRole(rName),
 		fmt.Sprintf(`
@@ -2014,13 +2539,13 @@ resource "aws_iot_topic_rule" "test" {
     hash_key_value = "hkv"
     payload_field  = "pf"
     role_arn       = aws_iam_role.test.arn
-    table_name     = "tn"
+    table_name     = %[2]q
   }
 }
-`, rName))
+`, rName, tableName))
 }
 
-func testAccTopicRuleConfig_dynamoDBRangeKey(rName string) string {
+func testAccTopicRuleConfig_dynamoDBRangeKey(rName string, tableName string) string {
 	return acctest.ConfigCompose(
 		testAccTopicRuleConfig_destinationRole(rName),
 		fmt.Sprintf(`
@@ -2039,14 +2564,14 @@ resource "aws_iot_topic_rule" "test" {
     range_key_value = "rkv"
     range_key_type  = "STRING"
     role_arn        = aws_iam_role.test.arn
-    table_name      = "tn"
+    table_name      = %[2]q
     operation       = "INSERT"
   }
 }
-`, rName))
+`, rName, tableName))
 }
 
-func testAccTopicRuleConfig_dynamoDBv2(rName string) string {
+func testAccTopicRuleConfig_dynamoDBv2(rName string, tableName string) string {
 	return acctest.ConfigCompose(
 		testAccTopicRuleConfig_destinationRole(rName),
 		fmt.Sprintf(`
@@ -2058,16 +2583,16 @@ resource "aws_iot_topic_rule" "test" {
 
   dynamodbv2 {
     put_item {
-      table_name = "test"
+      table_name = %[2]q
     }
 
     role_arn = aws_iam_role.test.arn
   }
 }
-`, rName))
+`, rName, tableName))
 }
 
-func testAccTopicRuleConfig_elasticSearch(rName string) string {
+func testAccTopicRuleConfig_elasticSearch(rName string, index string) string {
 	return acctest.ConfigCompose(
 		testAccTopicRuleConfig_destinationRole(rName),
 		fmt.Sprintf(`
@@ -2082,15 +2607,15 @@ resource "aws_iot_topic_rule" "test" {
   elasticsearch {
     endpoint = "https://domain.${data.aws_region.current.name}.es.${data.aws_partition.current.dns_suffix}"
     id       = "myIdentifier"
-    index    = "myindex"
+    index    = %[2]q
     type     = "mydocument"
     role_arn = aws_iam_role.test.arn
   }
 }
-`, rName))
+`, rName, index))
 }
 
-func testAccTopicRuleConfig_firehose(rName string) string {
+func testAccTopicRuleConfig_firehose(rName string, streamName string) string {
 	return acctest.ConfigCompose(
 		testAccTopicRuleConfig_destinationRole(rName),
 		fmt.Sprintf(`
@@ -2101,7 +2626,7 @@ resource "aws_iot_topic_rule" "test" {
   sql_version = "2015-10-08"
 
   firehose {
-    delivery_stream_name = "mystream1"
+    delivery_stream_name = %[2]q
     role_arn             = aws_iam_role.test.arn
   }
 
@@ -2115,7 +2640,7 @@ resource "aws_iot_topic_rule" "test" {
     role_arn             = aws_iam_role.test.arn
   }
 }
-`, rName))
+`, rName, streamName))
 }
 
 func testAccTopicRuleConfig_firehoseSeparator(rName, separator string) string {
@@ -2235,7 +2760,7 @@ resource "aws_iot_topic_rule" "test" {
 `, rName)
 }
 
-func testAccTopicRuleConfig_analytics(rName string) string {
+func testAccTopicRuleConfig_analytics(rName string, channelName string) string {
 	return acctest.ConfigCompose(
 		testAccTopicRuleConfig_destinationRole(rName),
 		fmt.Sprintf(`
@@ -2246,11 +2771,11 @@ resource "aws_iot_topic_rule" "test" {
   sql_version = "2015-10-08"
 
   iot_analytics {
-    channel_name = "fakedata"
+    channel_name = %[2]q
     role_arn     = aws_iam_role.test.arn
   }
 }
-`, rName))
+`, rName, channelName))
 }
 
 func testAccTopicRuleConfig_analyticsBatchMode(rName string, batchMode bool) string {
@@ -2311,11 +2836,14 @@ resource "aws_iot_topic_rule" "test" {
 `, rName, batchMode))
 }
 
-func testAccTopicRuleConfig_kafka(rName string) string {
+func testAccTopicRuleConfig_kafka(rName string, topic string, broker string) string {
+	// Making a topic rule destination takes several minutes, as it requires creating many networking resources.
+	// It's far faster to simply use a properly-formatted but nonexistent ARN for the destination.
 	return acctest.ConfigCompose(
-		testAccTopicRuleDestinationConfig_basic(rName),
+		testAccTopicRuleConfig_destinationRole(rName),
 		fmt.Sprintf(`
 data "aws_region" "current" {}
+data "aws_caller_identity" "current" {}
 
 resource "aws_iot_topic_rule" "test" {
   name        = %[1]q
@@ -2324,12 +2852,12 @@ resource "aws_iot_topic_rule" "test" {
   sql_version = "2015-10-08"
 
   kafka {
-    destination_arn = aws_iot_topic_rule_destination.test.arn
-    topic           = "fake_topic"
+    destination_arn = "arn:${data.aws_partition.current.partition}:iot:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:ruledestination/vpc/pretend-this-is-a-uuid"
+    topic           = %[2]q
 
     client_properties = {
       "acks"                  = "1"
-      "bootstrap.servers"     = "b-1.localhost:9094"
+      "bootstrap.servers"     = %[3]q
       "compression.type"      = "none"
       "key.serializer"        = "org.apache.kafka.common.serialization.StringSerializer"
       "security.protocol"     = "SSL"
@@ -2339,10 +2867,10 @@ resource "aws_iot_topic_rule" "test" {
     }
   }
 }
-`, rName))
+`, rName, topic, broker))
 }
 
-func testAccTopicRuleConfig_kinesis(rName string) string {
+func testAccTopicRuleConfig_kinesis(rName string, streamName string) string {
 	return acctest.ConfigCompose(
 		testAccTopicRuleConfig_destinationRole(rName),
 		fmt.Sprintf(`
@@ -2353,11 +2881,11 @@ resource "aws_iot_topic_rule" "test" {
   sql_version = "2015-10-08"
 
   kinesis {
-    stream_name = "mystream"
+    stream_name = %[2]q
     role_arn    = aws_iam_role.test.arn
   }
 }
-`, rName))
+`, rName, streamName))
 }
 
 func testAccTopicRuleConfig_lambda(rName string) string {
@@ -2379,7 +2907,7 @@ resource "aws_iot_topic_rule" "test" {
 `, rName)
 }
 
-func testAccTopicRuleConfig_republish(rName string) string {
+func testAccTopicRuleConfig_republish(rName string, topic string) string {
 	return acctest.ConfigCompose(
 		testAccTopicRuleConfig_destinationRole(rName),
 		fmt.Sprintf(`
@@ -2391,10 +2919,10 @@ resource "aws_iot_topic_rule" "test" {
 
   republish {
     role_arn = aws_iam_role.test.arn
-    topic    = "mytopic"
+    topic    = %[2]q
   }
 }
-`, rName))
+`, rName, topic))
 }
 
 func testAccTopicRuleConfig_republishQoS(rName string) string {
@@ -2416,7 +2944,7 @@ resource "aws_iot_topic_rule" "test" {
 `, rName))
 }
 
-func testAccTopicRuleConfig_s3(rName string) string {
+func testAccTopicRuleConfig_s3(rName string, bucketName string) string {
 	return acctest.ConfigCompose(
 		testAccTopicRuleConfig_destinationRole(rName),
 		fmt.Sprintf(`
@@ -2427,16 +2955,16 @@ resource "aws_iot_topic_rule" "test" {
   sql_version = "2015-10-08"
 
   s3 {
-    bucket_name = "mybucket"
+    bucket_name = %[2]q
     canned_acl  = "private"
     key         = "mykey"
     role_arn    = aws_iam_role.test.arn
   }
 }
-`, rName))
+`, rName, bucketName))
 }
 
-func testAccTopicRuleConfig_sns(rName string) string {
+func testAccTopicRuleConfig_sns(rName string, messageFormat string) string {
 	return acctest.ConfigCompose(
 		testAccTopicRuleConfig_destinationRole(rName),
 		fmt.Sprintf(`
@@ -2449,14 +2977,15 @@ resource "aws_iot_topic_rule" "test" {
   sql_version = "2015-10-08"
 
   sns {
-    role_arn   = aws_iam_role.test.arn
-    target_arn = "arn:${data.aws_partition.current.partition}:sns:${data.aws_region.current.name}:123456789012:my_corporate_topic"
+    message_format = %[2]q
+    role_arn       = aws_iam_role.test.arn
+    target_arn     = "arn:${data.aws_partition.current.partition}:sns:${data.aws_region.current.name}:123456789012:my_corporate_topic"
   }
 }
-`, rName))
+`, rName, messageFormat))
 }
 
-func testAccTopicRuleConfig_sqs(rName string) string {
+func testAccTopicRuleConfig_sqs(rName string, queueUrl string) string {
 	return acctest.ConfigCompose(
 		testAccTopicRuleConfig_destinationRole(rName),
 		fmt.Sprintf(`
@@ -2467,15 +2996,15 @@ resource "aws_iot_topic_rule" "test" {
   sql_version = "2015-10-08"
 
   sqs {
-    queue_url  = "fakedata"
+    queue_url  = %[2]q
     role_arn   = aws_iam_role.test.arn
     use_base64 = false
   }
 }
-`, rName))
+`, rName, queueUrl))
 }
 
-func testAccTopicRuleConfig_stepFunctions(rName string) string {
+func testAccTopicRuleConfig_stepFunctions(rName string, smName string) string {
 	return acctest.ConfigCompose(
 		testAccTopicRuleConfig_destinationRole(rName),
 		fmt.Sprintf(`
@@ -2487,14 +3016,14 @@ resource "aws_iot_topic_rule" "test" {
 
   step_functions {
     execution_name_prefix = "myprefix"
-    state_machine_name    = "mystatemachine"
+    state_machine_name    = %[2]q
     role_arn              = aws_iam_role.test.arn
   }
 }
-`, rName))
+`, rName, smName))
 }
 
-func testAccTopicRuleConfig_timestream(rName string) string {
+func testAccTopicRuleConfig_timestream(rName string, dimName string) string {
 	return acctest.ConfigCompose(
 		testAccTopicRuleConfig_destinationRole(rName),
 		fmt.Sprintf(`
@@ -2510,8 +3039,13 @@ resource "aws_iot_topic_rule" "test" {
     table_name    = "test_table"
 
     dimension {
-      name  = "dim"
-      value = "$${dim}"
+      name  = %[2]q
+      value = "$${%[2]s}"
+    }
+
+    dimension {
+      name  = "dim2"
+      value = "$${dim2}"
     }
 
     timestamp {
@@ -2520,10 +3054,10 @@ resource "aws_iot_topic_rule" "test" {
     }
   }
 }
-`, rName))
+`, rName, dimName))
 }
 
-func testAccTopicRuleConfig_errorAction(rName string) string {
+func testAccTopicRuleConfig_kinesisErrorAction(rName string) string {
 	return acctest.ConfigCompose(
 		testAccTopicRuleConfig_destinationRole(rName),
 		fmt.Sprintf(`
diff --git a/internal/service/iot/validate.go b/internal/service/iot/validate.go
index 34b69091033..22b77c93e90 100644
--- a/internal/service/iot/validate.go
+++ b/internal/service/iot/validate.go
@@ -1,9 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package iot
 
 import (
 	"fmt"
 	"regexp"
 	"strings"
+
+	"github.com/YakDriver/regexache"
 )
 
 func validThingTypeDescription(v interface{}, k string) (ws []string, errors []error) {
@@ -12,7 +17,7 @@ func validThingTypeDescription(v interface{}, k string) (ws []string, errors []e
 		errors = append(errors, fmt.Errorf(
 			"%q cannot be longer than 2028 characters", k))
 	}
-	if !regexp.MustCompile(`[\\p{Graph}\\x20]*`).MatchString(value) {
+	if !regexache.MustCompile(`[\\p{Graph}\\x20]*`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			`%q must match pattern [\p{Graph}\x20]*`, k))
 	}
@@ -21,7 +26,7 @@ func validThingTypeDescription(v interface{}, k string) (ws []string, errors []e
 
 func validThingTypeName(v interface{}, k string) (ws []string, errors []error) {
 	value := v.(string)
-	if !regexp.MustCompile(`[a-zA-Z0-9:_-]+`).MatchString(value) {
+	if !regexache.MustCompile(`[0-9A-Za-z_:-]+`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"only alphanumeric characters, colons, underscores and hyphens allowed in %q", k))
 	}
@@ -34,7 +39,7 @@ func validThingTypeSearchableAttribute(v interface{}, k string) (ws []string, er
 		errors = append(errors, fmt.Errorf(
 			"%q cannot be longer than 128 characters", k))
 	}
-	if !regexp.MustCompile(`[a-zA-Z0-9_.,@/:#-]+`).MatchString(value) {
+	if !regexache.MustCompile(`[0-9A-Za-z_.,@/:#-]+`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"only alphanumeric characters, underscores, dots, commas, arobases, slashes, colons, hashes and hyphens allowed in %q", k))
 	}
@@ -57,7 +62,7 @@ func validTopicRuleElasticsearchEndpoint(v interface{}, k string) (ws []string,
 	value := v.(string)
 
 	// https://docs.aws.amazon.com/iot/latest/apireference/API_ElasticsearchAction.html
-	if !regexp.MustCompile(`https?://.*`).MatchString(value) {
+	if !regexache.MustCompile(`https?://.*`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"%q should be an URL: %q",
 			k, value))
@@ -84,14 +89,14 @@ func validTopicRuleName(v interface{}, s string) ([]string, []error) {
 		return nil, []error{fmt.Errorf("Name must between 1 and 128 characters long")}
 	}
 
-	matched, err := regexp.MatchReader("^[a-zA-Z0-9_]+$", strings.NewReader(name))
+	matched, err := regexp.MatchReader("^[0-9A-Za-z_]+$", strings.NewReader(name))
 
 	if err != nil {
 		return nil, []error{err}
 	}
 
 	if !matched {
-		return nil, []error{fmt.Errorf("Name must match the pattern ^[a-zA-Z0-9_]+$")}
+		return nil, []error{fmt.Errorf("Name must match the pattern ^[0-9A-Za-z_]+$")}
 	}
 
 	return nil, nil
diff --git a/internal/service/iotanalytics/generate.go b/internal/service/iotanalytics/generate.go
index 91959a7308c..00e14896279 100644
--- a/internal/service/iotanalytics/generate.go
+++ b/internal/service/iotanalytics/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTags -ServiceTagsSlice -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/iotanalytics/service_package_gen.go b/internal/service/iotanalytics/service_package_gen.go
index a305077f876..6ef6bc9a53e 100644
--- a/internal/service/iotanalytics/service_package_gen.go
+++ b/internal/service/iotanalytics/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	iotanalytics_sdkv1 "github.com/aws/aws-sdk-go/service/iotanalytics"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -41,4 +42,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*i
 	return iotanalytics_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/iotanalytics/tags_gen.go b/internal/service/iotanalytics/tags_gen.go
index 5d7b44ffd5e..e501838950a 100644
--- a/internal/service/iotanalytics/tags_gen.go
+++ b/internal/service/iotanalytics/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/iotanalytics"
 	"github.com/aws/aws-sdk-go/service/iotanalytics/iotanalyticsiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -102,6 +104,8 @@ func updateTags(ctx context.Context, conn iotanalyticsiface.IoTAnalyticsAPI, ide
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.IoTAnalytics)
 	if len(removedTags) > 0 {
diff --git a/internal/service/iotevents/generate.go b/internal/service/iotevents/generate.go
index ec35121c77e..0cb770c5da9 100644
--- a/internal/service/iotevents/generate.go
+++ b/internal/service/iotevents/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTags -ServiceTagsSlice -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/iotevents/service_package_gen.go b/internal/service/iotevents/service_package_gen.go
index b8f1cc6f8e2..5586b9e6aee 100644
--- a/internal/service/iotevents/service_package_gen.go
+++ b/internal/service/iotevents/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	iotevents_sdkv1 "github.com/aws/aws-sdk-go/service/iotevents"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -41,4 +42,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*i
 	return iotevents_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/iotevents/tags_gen.go b/internal/service/iotevents/tags_gen.go
index fdaaf6a1938..2963909ed2e 100644
--- a/internal/service/iotevents/tags_gen.go
+++ b/internal/service/iotevents/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/iotevents"
 	"github.com/aws/aws-sdk-go/service/iotevents/ioteventsiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -102,6 +104,8 @@ func updateTags(ctx context.Context, conn ioteventsiface.IoTEventsAPI, identifie
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.IoTEvents)
 	if len(removedTags) > 0 {
diff --git a/internal/service/ivs/channel.go b/internal/service/ivs/channel.go
index 1a0b47bfed0..51f36a00342 100644
--- a/internal/service/ivs/channel.go
+++ b/internal/service/ivs/channel.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ivs
 
 import (
 	"context"
 	"errors"
 	"log"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ivs"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -64,7 +67,7 @@ func ResourceChannel() *schema.Resource {
 				Type:         schema.TypeString,
 				Optional:     true,
 				Computed:     true,
-				ValidateFunc: validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9-_]{0,128}$`), "must contain only alphanumeric characters, hyphen, or underscore and at most 128 characters"),
+				ValidateFunc: validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_-]{0,128}$`), "must contain only alphanumeric characters, hyphen, or underscore and at most 128 characters"),
 			},
 			"playback_url": {
 				Type:     schema.TypeString,
diff --git a/internal/service/ivs/channel_test.go b/internal/service/ivs/channel_test.go
index 46b81746c14..683f03ba07b 100644
--- a/internal/service/ivs/channel_test.go
+++ b/internal/service/ivs/channel_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ivs_test
 
 import (
 	"context"
 	"errors"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ivs"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -44,7 +47,7 @@ func TestAccIVSChannel_basic(t *testing.T) {
 					resource.TestCheckResourceAttrSet(resourceName, "playback_url"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 					resource.TestCheckResourceAttr(resourceName, "tags_all.%", "0"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ivs", regexp.MustCompile(`channel/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ivs", regexache.MustCompile(`channel/.+`)),
 				),
 			},
 			{
diff --git a/internal/service/ivs/find.go b/internal/service/ivs/find.go
index 2bc671b4a24..d427a3c4219 100644
--- a/internal/service/ivs/find.go
+++ b/internal/service/ivs/find.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ivs
 
 import (
diff --git a/internal/service/ivs/generate.go b/internal/service/ivs/generate.go
index 3bab784f816..5d9cc8ade7f 100644
--- a/internal/service/ivs/generate.go
+++ b/internal/service/ivs/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTags -ServiceTagsMap -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/ivs/ivs_test.go b/internal/service/ivs/ivs_test.go
index e1df85ceaca..cb4bd480e49 100644
--- a/internal/service/ivs/ivs_test.go
+++ b/internal/service/ivs/ivs_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ivs_test
 
 import (
diff --git a/internal/service/ivs/playback_key_pair.go b/internal/service/ivs/playback_key_pair.go
index d788dd361c2..8c2a2c33d2d 100644
--- a/internal/service/ivs/playback_key_pair.go
+++ b/internal/service/ivs/playback_key_pair.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ivs
 
 import (
diff --git a/internal/service/ivs/playback_key_pair_test.go b/internal/service/ivs/playback_key_pair_test.go
index 8bc802f72a2..42850fa276f 100644
--- a/internal/service/ivs/playback_key_pair_test.go
+++ b/internal/service/ivs/playback_key_pair_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ivs_test
 
 import (
 	"context"
 	"errors"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ivs"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -50,7 +53,7 @@ func testAccPlaybackKeyPair_basic(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "fingerprint", fingerprint),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 					resource.TestCheckResourceAttr(resourceName, "tags_all.%", "0"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ivs", regexp.MustCompile(`playback-key/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ivs", regexache.MustCompile(`playback-key/.+`)),
 				),
 			},
 			{
diff --git a/internal/service/ivs/recording_configuration.go b/internal/service/ivs/recording_configuration.go
index e03b8ee2a37..5dac41a52c1 100644
--- a/internal/service/ivs/recording_configuration.go
+++ b/internal/service/ivs/recording_configuration.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ivs
 
 import (
 	"context"
 	"errors"
 	"log"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ivs"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -59,7 +62,7 @@ func ResourceRecordingConfiguration() *schema.Resource {
 									"bucket_name": {
 										Type:         schema.TypeString,
 										Required:     true,
-										ValidateFunc: validation.StringMatch(regexp.MustCompile(`^[a-z0-9-.]{3,63}$`), "must contain only lowercase alphanumeric characters, hyphen, or dot, and between 3 and 63 characters"),
+										ValidateFunc: validation.StringMatch(regexache.MustCompile(`^[0-9a-z.-]{3,63}$`), "must contain only lowercase alphanumeric characters, hyphen, or dot, and between 3 and 63 characters"),
 									},
 								},
 							},
@@ -72,7 +75,7 @@ func ResourceRecordingConfiguration() *schema.Resource {
 				Optional:     true,
 				Computed:     true,
 				ForceNew:     true,
-				ValidateFunc: validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9-_]{0,128}$`), "must contain only alphanumeric characters, hyphen, or underscore, and at most 128 characters"),
+				ValidateFunc: validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_-]{0,128}$`), "must contain only alphanumeric characters, hyphen, or underscore, and at most 128 characters"),
 			},
 			"recording_reconnect_window_seconds": {
 				Type:         schema.TypeInt,
diff --git a/internal/service/ivs/recording_configuration_test.go b/internal/service/ivs/recording_configuration_test.go
index 65eedc44b38..67817dcf273 100644
--- a/internal/service/ivs/recording_configuration_test.go
+++ b/internal/service/ivs/recording_configuration_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ivs_test
 
 import (
 	"context"
 	"errors"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ivs"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -45,7 +48,7 @@ func TestAccIVSRecordingConfiguration_basic(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "destination_configuration.0.s3.0.bucket_name", bucketName),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 					resource.TestCheckResourceAttr(resourceName, "tags_all.%", "0"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ivs", regexp.MustCompile(`recording-configuration/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ivs", regexache.MustCompile(`recording-configuration/.+`)),
 				),
 			},
 			{
diff --git a/internal/service/ivs/service_package_gen.go b/internal/service/ivs/service_package_gen.go
index f29d93c3f4b..8269a7e1e1b 100644
--- a/internal/service/ivs/service_package_gen.go
+++ b/internal/service/ivs/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	ivs_sdkv1 "github.com/aws/aws-sdk-go/service/ivs"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -71,4 +72,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*i
 	return ivs_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/ivs/status.go b/internal/service/ivs/status.go
index 184906da41d..7e3b85b9650 100644
--- a/internal/service/ivs/status.go
+++ b/internal/service/ivs/status.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ivs
 
 import (
diff --git a/internal/service/ivs/stream_key_data_source.go b/internal/service/ivs/stream_key_data_source.go
index a3af79c6b22..7701f7527ec 100644
--- a/internal/service/ivs/stream_key_data_source.go
+++ b/internal/service/ivs/stream_key_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ivs
 
 import (
diff --git a/internal/service/ivs/stream_key_data_source_test.go b/internal/service/ivs/stream_key_data_source_test.go
index 6b1b1aa16b7..b3e902f0269 100644
--- a/internal/service/ivs/stream_key_data_source_test.go
+++ b/internal/service/ivs/stream_key_data_source_test.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ivs_test
 
 import (
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/ivs"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
@@ -27,7 +30,7 @@ func TestAccIVSStreamKeyDataSource_basic(t *testing.T) {
 					testAccCheckStreamKeyDataSource(dataSourceName),
 					resource.TestCheckResourceAttrPair(dataSourceName, "channel_arn", channelResourceName, "id"),
 					resource.TestCheckResourceAttrSet(dataSourceName, "value"),
-					acctest.MatchResourceAttrRegionalARN(dataSourceName, "arn", "ivs", regexp.MustCompile(`stream-key/.+`)),
+					acctest.MatchResourceAttrRegionalARN(dataSourceName, "arn", "ivs", regexache.MustCompile(`stream-key/.+`)),
 				),
 			},
 		},
diff --git a/internal/service/ivs/tags_gen.go b/internal/service/ivs/tags_gen.go
index c993261e806..257f99aab98 100644
--- a/internal/service/ivs/tags_gen.go
+++ b/internal/service/ivs/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ivs"
 	"github.com/aws/aws-sdk-go/service/ivs/ivsiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -54,7 +56,7 @@ func Tags(tags tftags.KeyValueTags) map[string]*string {
 	return aws.StringMap(tags.Map())
 }
 
-// KeyValueTags creates KeyValueTags from ivs service tags.
+// KeyValueTags creates tftags.KeyValueTags from ivs service tags.
 func KeyValueTags(ctx context.Context, tags map[string]*string) tftags.KeyValueTags {
 	return tftags.New(ctx, tags)
 }
@@ -85,6 +87,8 @@ func updateTags(ctx context.Context, conn ivsiface.IVSAPI, identifier string, ol
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.IVS)
 	if len(removedTags) > 0 {
diff --git a/internal/service/ivs/wait.go b/internal/service/ivs/wait.go
index 84b5e46f650..4279c735999 100644
--- a/internal/service/ivs/wait.go
+++ b/internal/service/ivs/wait.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ivs
 
 import (
diff --git a/internal/service/ivschat/find.go b/internal/service/ivschat/find.go
index 596293f0825..6953a3f812a 100644
--- a/internal/service/ivschat/find.go
+++ b/internal/service/ivschat/find.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ivschat
 
 import (
diff --git a/internal/service/ivschat/generate.go b/internal/service/ivschat/generate.go
index f50a6b29ea7..4ba5eaa332b 100644
--- a/internal/service/ivschat/generate.go
+++ b/internal/service/ivschat/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -AWSSDKVersion=2 -ListTags -ServiceTagsMap -UpdateTags -KVTValues -SkipTypesImp
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/ivschat/logging_configuration.go b/internal/service/ivschat/logging_configuration.go
index d8f3729923b..ab3e98e8cf1 100644
--- a/internal/service/ivschat/logging_configuration.go
+++ b/internal/service/ivschat/logging_configuration.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ivschat
 
 import (
 	"context"
 	"errors"
 	"log"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/ivschat"
 	"github.com/aws/aws-sdk-go-v2/service/ivschat/types"
@@ -70,7 +73,7 @@ func ResourceLoggingConfiguration() *schema.Resource {
 									"log_group_name": {
 										Type:         schema.TypeString,
 										Required:     true,
-										ValidateFunc: validation.StringMatch(regexp.MustCompile(`^[\.\-_/#A-Za-z0-9]{1,512}$`), "must contain only lowercase alphanumeric characters, hyphen, dot, underscore, forward slash, or hash sign, and between 1 and 512 characters"),
+										ValidateFunc: validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_./#-]{1,512}$`), "must contain only lowercase alphanumeric characters, hyphen, dot, underscore, forward slash, or hash sign, and between 1 and 512 characters"),
 									},
 								},
 							},
@@ -93,7 +96,7 @@ func ResourceLoggingConfiguration() *schema.Resource {
 									"delivery_stream_name": {
 										Type:         schema.TypeString,
 										Required:     true,
-										ValidateFunc: validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9_.-]{1,64}$`), "must contain only lowercase alphanumeric characters, hyphen, dot, or underscore, and between 1 and 64 characters"),
+										ValidateFunc: validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_.-]{1,64}$`), "must contain only lowercase alphanumeric characters, hyphen, dot, or underscore, and between 1 and 64 characters"),
 									},
 								},
 							},
@@ -116,7 +119,7 @@ func ResourceLoggingConfiguration() *schema.Resource {
 									"bucket_name": {
 										Type:         schema.TypeString,
 										Required:     true,
-										ValidateFunc: validation.StringMatch(regexp.MustCompile(`^[a-z0-9-.]{3,63}$`), "must contain only lowercase alphanumeric characters, hyphen, or dot, and between 3 and 63 characters"),
+										ValidateFunc: validation.StringMatch(regexache.MustCompile(`^[0-9a-z.-]{3,63}$`), "must contain only lowercase alphanumeric characters, hyphen, or dot, and between 3 and 63 characters"),
 									},
 								},
 							},
diff --git a/internal/service/ivschat/logging_configuration_test.go b/internal/service/ivschat/logging_configuration_test.go
index 86a9214f510..fe658271672 100644
--- a/internal/service/ivschat/logging_configuration_test.go
+++ b/internal/service/ivschat/logging_configuration_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ivschat_test
 
 import (
 	"context"
 	"errors"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/ivschat"
 	"github.com/aws/aws-sdk-go-v2/service/ivschat/types"
@@ -42,7 +45,7 @@ func TestAccIVSChatLoggingConfiguration_basic_cloudwatch(t *testing.T) {
 					resource.TestCheckResourceAttrPair(resourceName, "destination_configuration.0.cloudwatch_logs.0.log_group_name", "aws_cloudwatch_log_group.test", "name"),
 					resource.TestCheckResourceAttr(resourceName, "state", "ACTIVE"),
 					resource.TestCheckResourceAttrSet(resourceName, "id"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ivschat", regexp.MustCompile(`logging-configuration/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ivschat", regexache.MustCompile(`logging-configuration/.+`)),
 				),
 			},
 			{
@@ -81,7 +84,7 @@ func TestAccIVSChatLoggingConfiguration_basic_firehose(t *testing.T) {
 					resource.TestCheckResourceAttrPair(resourceName, "destination_configuration.0.firehose.0.delivery_stream_name", "aws_kinesis_firehose_delivery_stream.test", "name"),
 					resource.TestCheckResourceAttr(resourceName, "state", "ACTIVE"),
 					resource.TestCheckResourceAttrSet(resourceName, "id"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ivschat", regexp.MustCompile(`logging-configuration/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ivschat", regexache.MustCompile(`logging-configuration/.+`)),
 				),
 			},
 			{
@@ -116,7 +119,7 @@ func TestAccIVSChatLoggingConfiguration_basic_s3(t *testing.T) {
 					resource.TestCheckResourceAttrPair(resourceName, "destination_configuration.0.s3.0.bucket_name", "aws_s3_bucket.test", "id"),
 					resource.TestCheckResourceAttr(resourceName, "state", "ACTIVE"),
 					resource.TestCheckResourceAttrSet(resourceName, "id"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ivschat", regexp.MustCompile(`logging-configuration/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ivschat", regexache.MustCompile(`logging-configuration/.+`)),
 				),
 			},
 			{
@@ -233,23 +236,23 @@ func TestAccIVSChatLoggingConfiguration_failure_invalidDestination(t *testing.T)
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccLoggingConfigurationConfig_failure_cloudwatch_s3(),
-				ExpectError: regexp.MustCompile(`Invalid combination of arguments`),
+				ExpectError: regexache.MustCompile(`Invalid combination of arguments`),
 			},
 			{
 				Config:      testAccLoggingConfigurationConfig_failure_firehose_s3(),
-				ExpectError: regexp.MustCompile(`Invalid combination of arguments`),
+				ExpectError: regexache.MustCompile(`Invalid combination of arguments`),
 			},
 			{
 				Config:      testAccLoggingConfigurationConfig_failure_cloudwatch_firehose(),
-				ExpectError: regexp.MustCompile(`Invalid combination of arguments`),
+				ExpectError: regexache.MustCompile(`Invalid combination of arguments`),
 			},
 			{
 				Config:      testAccLoggingConfigurationConfig_failure_cloudwatch_firehose_s3(),
-				ExpectError: regexp.MustCompile(`Invalid combination of arguments`),
+				ExpectError: regexache.MustCompile(`Invalid combination of arguments`),
 			},
 			{
 				Config:      testAccLoggingConfigurationConfig_failure_noDestination(),
-				ExpectError: regexp.MustCompile(`Invalid combination of arguments`),
+				ExpectError: regexache.MustCompile(`Invalid combination of arguments`),
 			},
 		},
 	})
@@ -401,11 +404,6 @@ resource "aws_s3_bucket" "test" {
   bucket_prefix = %[1]q
 }
 
-resource "aws_s3_bucket_acl" "test" {
-  bucket = aws_s3_bucket.test.id
-  acl    = "private"
-}
-
 resource "aws_iam_role" "test" {
   name = %[1]q
 
diff --git a/internal/service/ivschat/room.go b/internal/service/ivschat/room.go
index 8593ec3aad1..6c573d66ec6 100644
--- a/internal/service/ivschat/room.go
+++ b/internal/service/ivschat/room.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ivschat
 
 import (
 	"context"
 	"errors"
 	"log"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/ivschat"
 	"github.com/aws/aws-sdk-go-v2/service/ivschat/types"
@@ -89,7 +92,7 @@ func ResourceRoom() *schema.Resource {
 			"name": {
 				Type:         schema.TypeString,
 				Optional:     true,
-				ValidateFunc: validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9-_]{0,128}$`), "must contain only alphanumeric, hyphen, and underscore characters, with max length of 128 characters"),
+				ValidateFunc: validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_-]{0,128}$`), "must contain only alphanumeric, hyphen, and underscore characters, with max length of 128 characters"),
 			},
 			names.AttrTags:    tftags.TagsSchema(),
 			names.AttrTagsAll: tftags.TagsSchemaComputed(),
diff --git a/internal/service/ivschat/room_test.go b/internal/service/ivschat/room_test.go
index e5864416932..e0969a0d814 100644
--- a/internal/service/ivschat/room_test.go
+++ b/internal/service/ivschat/room_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ivschat_test
 
 import (
 	"context"
 	"errors"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/ivschat"
 	"github.com/aws/aws-sdk-go-v2/service/ivschat/types"
@@ -42,7 +45,7 @@ func TestAccIVSChatRoom_basic(t *testing.T) {
 					resource.TestCheckResourceAttrSet(resourceName, "id"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 					resource.TestCheckResourceAttr(resourceName, "tags_all.%", "0"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ivschat", regexp.MustCompile(`room/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ivschat", regexache.MustCompile(`room/.+`)),
 				),
 			},
 			{
diff --git a/internal/service/ivschat/service_package_gen.go b/internal/service/ivschat/service_package_gen.go
index b7e3a56eeba..5324e2d8689 100644
--- a/internal/service/ivschat/service_package_gen.go
+++ b/internal/service/ivschat/service_package_gen.go
@@ -7,6 +7,7 @@ import (
 
 	aws_sdkv2 "github.com/aws/aws-sdk-go-v2/aws"
 	ivschat_sdkv2 "github.com/aws/aws-sdk-go-v2/service/ivschat"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -56,9 +57,11 @@ func (p *servicePackage) NewClient(ctx context.Context, config map[string]any) (
 
 	return ivschat_sdkv2.NewFromConfig(cfg, func(o *ivschat_sdkv2.Options) {
 		if endpoint := config["endpoint"].(string); endpoint != "" {
-			o.EndpointResolver = ivschat_sdkv2.EndpointResolverFromURL(endpoint)
+			o.BaseEndpoint = aws_sdkv2.String(endpoint)
 		}
 	}), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/ivschat/status.go b/internal/service/ivschat/status.go
index 2f0339e6be6..ae5d46bad19 100644
--- a/internal/service/ivschat/status.go
+++ b/internal/service/ivschat/status.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ivschat
 
 import (
diff --git a/internal/service/ivschat/tags_gen.go b/internal/service/ivschat/tags_gen.go
index e2fa77d86fd..16d09fb6600 100644
--- a/internal/service/ivschat/tags_gen.go
+++ b/internal/service/ivschat/tags_gen.go
@@ -7,7 +7,9 @@ import (
 
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/ivschat"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -53,7 +55,7 @@ func Tags(tags tftags.KeyValueTags) map[string]string {
 	return tags.Map()
 }
 
-// KeyValueTags creates KeyValueTags from ivschat service tags.
+// KeyValueTags creates tftags.KeyValueTags from ivschat service tags.
 func KeyValueTags(ctx context.Context, tags map[string]string) tftags.KeyValueTags {
 	return tftags.New(ctx, tags)
 }
@@ -84,6 +86,8 @@ func updateTags(ctx context.Context, conn *ivschat.Client, identifier string, ol
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.IVSChat)
 	if len(removedTags) > 0 {
diff --git a/internal/service/ivschat/wait.go b/internal/service/ivschat/wait.go
index 48259da7845..82bb88a4d90 100644
--- a/internal/service/ivschat/wait.go
+++ b/internal/service/ivschat/wait.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ivschat
 
 import (
diff --git a/internal/service/kafka/broker_nodes_data_source.go b/internal/service/kafka/broker_nodes_data_source.go
index 7355824bc06..714ba400727 100644
--- a/internal/service/kafka/broker_nodes_data_source.go
+++ b/internal/service/kafka/broker_nodes_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kafka
 
 import (
diff --git a/internal/service/kafka/broker_nodes_data_source_test.go b/internal/service/kafka/broker_nodes_data_source_test.go
index 0899333e850..8d371cf5775 100644
--- a/internal/service/kafka/broker_nodes_data_source_test.go
+++ b/internal/service/kafka/broker_nodes_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kafka_test
 
 import (
@@ -40,7 +43,7 @@ func testAccBrokerNodesDataSourceConfig_basic(rName string) string {
 	return acctest.ConfigCompose(testAccClusterConfig_base(rName), fmt.Sprintf(`
 resource "aws_msk_cluster" "test" {
   cluster_name           = %[1]q
-  kafka_version          = "2.2.1"
+  kafka_version          = "2.8.1"
   number_of_broker_nodes = 3
 
   broker_node_group_info {
diff --git a/internal/service/kafka/cluster.go b/internal/service/kafka/cluster.go
index a8fac84593c..2dd2565d960 100644
--- a/internal/service/kafka/cluster.go
+++ b/internal/service/kafka/cluster.go
@@ -1,12 +1,17 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kafka
 
 import (
 	"context"
 	"fmt"
 	"log"
+	"strings"
 	"time"
 
 	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/aws/aws-sdk-go/service/kafka"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
@@ -80,6 +85,18 @@ func ResourceCluster() *schema.Resource {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
+			"bootstrap_brokers_vpc_connectivity_sasl_iam": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"bootstrap_brokers_vpc_connectivity_sasl_scram": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"bootstrap_brokers_vpc_connectivity_tls": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
 			"broker_node_group_info": {
 				Type:     schema.TypeList,
 				Required: true,
@@ -109,6 +126,51 @@ func ResourceCluster() *schema.Resource {
 							MaxItems: 1,
 							Elem: &schema.Resource{
 								Schema: map[string]*schema.Schema{
+									"vpc_connectivity": {
+										Type:     schema.TypeList,
+										Optional: true,
+										Computed: true,
+										MaxItems: 1,
+										Elem: &schema.Resource{
+											Schema: map[string]*schema.Schema{
+												"client_authentication": {
+													Type:     schema.TypeList,
+													Optional: true,
+													Computed: true,
+													MaxItems: 1,
+													Elem: &schema.Resource{
+														Schema: map[string]*schema.Schema{
+															"sasl": {
+																Type:     schema.TypeList,
+																Optional: true,
+																Computed: true,
+																MaxItems: 1,
+																Elem: &schema.Resource{
+																	Schema: map[string]*schema.Schema{
+																		"iam": {
+																			Type:     schema.TypeBool,
+																			Optional: true,
+																			Computed: true,
+																		},
+																		"scram": {
+																			Type:     schema.TypeBool,
+																			Optional: true,
+																			Computed: true,
+																		},
+																	},
+																},
+															},
+															"tls": {
+																Type:     schema.TypeBool,
+																Optional: true,
+																Computed: true,
+															},
+														},
+													},
+												},
+											},
+										},
+									},
 									"public_access": {
 										Type:     schema.TypeList,
 										Optional: true,
@@ -244,6 +306,10 @@ func ResourceCluster() *schema.Resource {
 				ForceNew:     true,
 				ValidateFunc: validation.StringLenBetween(1, 64),
 			},
+			"cluster_uuid": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
 			"configuration_info": {
 				Type:             schema.TypeList,
 				Optional:         true,
@@ -478,8 +544,14 @@ func resourceClusterCreate(ctx context.Context, d *schema.ResourceData, meta int
 		Tags:                getTagsIn(ctx),
 	}
 
+	var vpcConnectivity *kafka.VpcConnectivity
 	if v, ok := d.GetOk("broker_node_group_info"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
 		input.BrokerNodeGroupInfo = expandBrokerNodeGroupInfo(v.([]interface{})[0].(map[string]interface{}))
+		// "BadRequestException: When creating a cluster, all vpcConnectivity auth schemes must be disabled (‘enabled’ : false). You can enable auth schemes after the cluster is created"
+		if input.BrokerNodeGroupInfo != nil && input.BrokerNodeGroupInfo.ConnectivityInfo != nil {
+			vpcConnectivity = input.BrokerNodeGroupInfo.ConnectivityInfo.VpcConnectivity
+			input.BrokerNodeGroupInfo.ConnectivityInfo.VpcConnectivity = nil
+		}
 	}
 
 	if v, ok := d.GetOk("client_authentication"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
@@ -518,12 +590,34 @@ func resourceClusterCreate(ctx context.Context, d *schema.ResourceData, meta int
 
 	d.SetId(aws.StringValue(output.ClusterArn))
 
-	_, err = waitClusterCreated(ctx, conn, d.Id(), d.Timeout(schema.TimeoutCreate))
+	cluster, err := waitClusterCreated(ctx, conn, d.Id(), d.Timeout(schema.TimeoutCreate))
 
 	if err != nil {
 		return diag.Errorf("waiting for MSK Cluster (%s) create: %s", d.Id(), err)
 	}
 
+	if vpcConnectivity != nil {
+		input := &kafka.UpdateConnectivityInput{
+			ClusterArn: aws.String(d.Id()),
+			ConnectivityInfo: &kafka.ConnectivityInfo{
+				VpcConnectivity: vpcConnectivity,
+			},
+			CurrentVersion: cluster.CurrentVersion,
+		}
+
+		output, err := conn.UpdateConnectivityWithContext(ctx, input)
+
+		if err != nil {
+			return diag.Errorf("updating MSK Cluster (%s) broker connectivity: %s", d.Id(), err)
+		}
+
+		clusterOperationARN := aws.StringValue(output.ClusterOperationArn)
+
+		if _, err := waitClusterOperationCompleted(ctx, conn, clusterOperationARN, d.Timeout(schema.TimeoutCreate)); err != nil {
+			return diag.Errorf("waiting for MSK Cluster (%s) operation (%s) complete: %s", d.Id(), clusterOperationARN, err)
+		}
+	}
+
 	return resourceClusterRead(ctx, d, meta)
 }
 
@@ -550,7 +644,8 @@ func resourceClusterRead(ctx context.Context, d *schema.ResourceData, meta inter
 		return diag.Errorf("reading MSK Cluster (%s) bootstrap brokers: %s", d.Id(), err)
 	}
 
-	d.Set("arn", cluster.ClusterArn)
+	clusterARN := aws.StringValue(cluster.ClusterArn)
+	d.Set("arn", clusterARN)
 	d.Set("bootstrap_brokers", SortEndpointsString(aws.StringValue(output.BootstrapBrokerString)))
 	d.Set("bootstrap_brokers_public_sasl_iam", SortEndpointsString(aws.StringValue(output.BootstrapBrokerStringPublicSaslIam)))
 	d.Set("bootstrap_brokers_public_sasl_scram", SortEndpointsString(aws.StringValue(output.BootstrapBrokerStringPublicSaslScram)))
@@ -558,7 +653,9 @@ func resourceClusterRead(ctx context.Context, d *schema.ResourceData, meta inter
 	d.Set("bootstrap_brokers_sasl_iam", SortEndpointsString(aws.StringValue(output.BootstrapBrokerStringSaslIam)))
 	d.Set("bootstrap_brokers_sasl_scram", SortEndpointsString(aws.StringValue(output.BootstrapBrokerStringSaslScram)))
 	d.Set("bootstrap_brokers_tls", SortEndpointsString(aws.StringValue(output.BootstrapBrokerStringTls)))
-
+	d.Set("bootstrap_brokers_vpc_connectivity_sasl_iam", SortEndpointsString(aws.StringValue(output.BootstrapBrokerStringVpcConnectivitySaslIam)))
+	d.Set("bootstrap_brokers_vpc_connectivity_sasl_scram", SortEndpointsString(aws.StringValue(output.BootstrapBrokerStringVpcConnectivitySaslScram)))
+	d.Set("bootstrap_brokers_vpc_connectivity_tls", SortEndpointsString(aws.StringValue(output.BootstrapBrokerStringVpcConnectivityTls)))
 	if cluster.BrokerNodeGroupInfo != nil {
 		if err := d.Set("broker_node_group_info", []interface{}{flattenBrokerNodeGroupInfo(cluster.BrokerNodeGroupInfo)}); err != nil {
 			return diag.Errorf("setting broker_node_group_info: %s", err)
@@ -566,7 +663,6 @@ func resourceClusterRead(ctx context.Context, d *schema.ResourceData, meta inter
 	} else {
 		d.Set("broker_node_group_info", nil)
 	}
-
 	if cluster.ClientAuthentication != nil {
 		if err := d.Set("client_authentication", []interface{}{flattenClientAuthentication(cluster.ClientAuthentication)}); err != nil {
 			return diag.Errorf("setting client_authentication: %s", err)
@@ -574,9 +670,9 @@ func resourceClusterRead(ctx context.Context, d *schema.ResourceData, meta inter
 	} else {
 		d.Set("client_authentication", nil)
 	}
-
 	d.Set("cluster_name", cluster.ClusterName)
-
+	clusterUUID, _ := clusterUUIDFromARN(clusterARN)
+	d.Set("cluster_uuid", clusterUUID)
 	if cluster.CurrentBrokerSoftwareInfo != nil {
 		if err := d.Set("configuration_info", []interface{}{flattenBrokerSoftwareInfo(cluster.CurrentBrokerSoftwareInfo)}); err != nil {
 			return diag.Errorf("setting configuration_info: %s", err)
@@ -584,10 +680,8 @@ func resourceClusterRead(ctx context.Context, d *schema.ResourceData, meta inter
 	} else {
 		d.Set("configuration_info", nil)
 	}
-
 	d.Set("current_version", cluster.CurrentVersion)
 	d.Set("enhanced_monitoring", cluster.EnhancedMonitoring)
-
 	if cluster.EncryptionInfo != nil {
 		if err := d.Set("encryption_info", []interface{}{flattenEncryptionInfo(cluster.EncryptionInfo)}); err != nil {
 			return diag.Errorf("setting encryption_info: %s", err)
@@ -595,9 +689,7 @@ func resourceClusterRead(ctx context.Context, d *schema.ResourceData, meta inter
 	} else {
 		d.Set("encryption_info", nil)
 	}
-
 	d.Set("kafka_version", cluster.CurrentBrokerSoftwareInfo.KafkaVersion)
-
 	if cluster.LoggingInfo != nil {
 		if err := d.Set("logging_info", []interface{}{flattenLoggingInfo(cluster.LoggingInfo)}); err != nil {
 			return diag.Errorf("setting logging_info: %s", err)
@@ -605,9 +697,7 @@ func resourceClusterRead(ctx context.Context, d *schema.ResourceData, meta inter
 	} else {
 		d.Set("logging_info", nil)
 	}
-
 	d.Set("number_of_broker_nodes", cluster.NumberOfBrokerNodes)
-
 	if cluster.OpenMonitoring != nil {
 		if err := d.Set("open_monitoring", []interface{}{flattenOpenMonitoring(cluster.OpenMonitoring)}); err != nil {
 			return diag.Errorf("setting open_monitoring: %s", err)
@@ -615,9 +705,7 @@ func resourceClusterRead(ctx context.Context, d *schema.ResourceData, meta inter
 	} else {
 		d.Set("open_monitoring", nil)
 	}
-
 	d.Set("storage_mode", cluster.StorageMode)
-
 	d.Set("zookeeper_connect_string", SortEndpointsString(aws.StringValue(cluster.ZookeeperConnectString)))
 	d.Set("zookeeper_connect_string_tls", SortEndpointsString(aws.StringValue(cluster.ZookeeperConnectStringTls)))
 
@@ -629,6 +717,34 @@ func resourceClusterRead(ctx context.Context, d *schema.ResourceData, meta inter
 func resourceClusterUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	conn := meta.(*conns.AWSClient).KafkaConn(ctx)
 
+	if d.HasChange("broker_node_group_info.0.connectivity_info") {
+		input := &kafka.UpdateConnectivityInput{
+			ClusterArn:     aws.String(d.Id()),
+			CurrentVersion: aws.String(d.Get("current_version").(string)),
+		}
+
+		if v, ok := d.GetOk("broker_node_group_info.0.connectivity_info"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
+			input.ConnectivityInfo = expandConnectivityInfo(v.([]interface{})[0].(map[string]interface{}))
+		}
+
+		output, err := conn.UpdateConnectivityWithContext(ctx, input)
+
+		if err != nil {
+			return diag.Errorf("updating MSK Cluster (%s) broker connectivity: %s", d.Id(), err)
+		}
+
+		clusterOperationARN := aws.StringValue(output.ClusterOperationArn)
+
+		if _, err := waitClusterOperationCompleted(ctx, conn, clusterOperationARN, d.Timeout(schema.TimeoutUpdate)); err != nil {
+			return diag.Errorf("waiting for MSK Cluster (%s) operation (%s) complete: %s", d.Id(), clusterOperationARN, err)
+		}
+
+		// refresh the current_version attribute after each update
+		if err := refreshClusterVersion(ctx, d, meta); err != nil {
+			return diag.FromErr(err)
+		}
+	}
+
 	if d.HasChange("broker_node_group_info.0.instance_type") {
 		input := &kafka.UpdateBrokerTypeInput{
 			ClusterArn:         aws.String(d.Id()),
@@ -644,10 +760,8 @@ func resourceClusterUpdate(ctx context.Context, d *schema.ResourceData, meta int
 
 		clusterOperationARN := aws.StringValue(output.ClusterOperationArn)
 
-		_, err = waitClusterOperationCompleted(ctx, conn, clusterOperationARN, d.Timeout(schema.TimeoutUpdate))
-
-		if err != nil {
-			return diag.Errorf("waiting for MSK Cluster (%s) operation (%s): %s", d.Id(), clusterOperationARN, err)
+		if _, err := waitClusterOperationCompleted(ctx, conn, clusterOperationARN, d.Timeout(schema.TimeoutUpdate)); err != nil {
+			return diag.Errorf("waiting for MSK Cluster (%s) operation (%s) complete: %s", d.Id(), clusterOperationARN, err)
 		}
 
 		// refresh the current_version attribute after each update
@@ -678,40 +792,8 @@ func resourceClusterUpdate(ctx context.Context, d *schema.ResourceData, meta int
 
 		clusterOperationARN := aws.StringValue(output.ClusterOperationArn)
 
-		_, err = waitClusterOperationCompleted(ctx, conn, clusterOperationARN, d.Timeout(schema.TimeoutUpdate))
-
-		if err != nil {
-			return diag.Errorf("waiting for MSK Cluster (%s) operation (%s): %s", d.Id(), clusterOperationARN, err)
-		}
-
-		// refresh the current_version attribute after each update
-		if err := refreshClusterVersion(ctx, d, meta); err != nil {
-			return diag.FromErr(err)
-		}
-	}
-
-	if d.HasChange("broker_node_group_info.0.connectivity_info") {
-		input := &kafka.UpdateConnectivityInput{
-			ClusterArn:     aws.String(d.Id()),
-			CurrentVersion: aws.String(d.Get("current_version").(string)),
-		}
-
-		if v, ok := d.GetOk("broker_node_group_info.0.connectivity_info"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
-			input.ConnectivityInfo = expandConnectivityInfo(v.([]interface{})[0].(map[string]interface{}))
-		}
-
-		output, err := conn.UpdateConnectivityWithContext(ctx, input)
-
-		if err != nil {
-			return diag.Errorf("updating MSK Cluster (%s) broker connectivity: %s", d.Id(), err)
-		}
-
-		clusterOperationARN := aws.StringValue(output.ClusterOperationArn)
-
-		_, err = waitClusterOperationCompleted(ctx, conn, clusterOperationARN, d.Timeout(schema.TimeoutUpdate))
-
-		if err != nil {
-			return diag.Errorf("waiting for MSK Cluster (%s) operation (%s): %s", d.Id(), clusterOperationARN, err)
+		if _, err := waitClusterOperationCompleted(ctx, conn, clusterOperationARN, d.Timeout(schema.TimeoutUpdate)); err != nil {
+			return diag.Errorf("waiting for MSK Cluster (%s) operation (%s) complete: %s", d.Id(), clusterOperationARN, err)
 		}
 
 		// refresh the current_version attribute after each update
@@ -735,10 +817,8 @@ func resourceClusterUpdate(ctx context.Context, d *schema.ResourceData, meta int
 
 		clusterOperationARN := aws.StringValue(output.ClusterOperationArn)
 
-		_, err = waitClusterOperationCompleted(ctx, conn, clusterOperationARN, d.Timeout(schema.TimeoutUpdate))
-
-		if err != nil {
-			return diag.Errorf("waiting for MSK Cluster (%s) operation (%s): %s", d.Id(), clusterOperationARN, err)
+		if _, err := waitClusterOperationCompleted(ctx, conn, clusterOperationARN, d.Timeout(schema.TimeoutUpdate)); err != nil {
+			return diag.Errorf("waiting for MSK Cluster (%s) operation (%s) complete: %s", d.Id(), clusterOperationARN, err)
 		}
 
 		// refresh the current_version attribute after each update
@@ -770,10 +850,8 @@ func resourceClusterUpdate(ctx context.Context, d *schema.ResourceData, meta int
 
 		clusterOperationARN := aws.StringValue(output.ClusterOperationArn)
 
-		_, err = waitClusterOperationCompleted(ctx, conn, clusterOperationARN, d.Timeout(schema.TimeoutUpdate))
-
-		if err != nil {
-			return diag.Errorf("waiting for MSK Cluster (%s) operation (%s): %s", d.Id(), clusterOperationARN, err)
+		if _, err := waitClusterOperationCompleted(ctx, conn, clusterOperationARN, d.Timeout(schema.TimeoutUpdate)); err != nil {
+			return diag.Errorf("waiting for MSK Cluster (%s) operation (%s) complete: %s", d.Id(), clusterOperationARN, err)
 		}
 
 		// refresh the current_version attribute after each update
@@ -800,10 +878,8 @@ func resourceClusterUpdate(ctx context.Context, d *schema.ResourceData, meta int
 
 		clusterOperationARN := aws.StringValue(output.ClusterOperationArn)
 
-		_, err = waitClusterOperationCompleted(ctx, conn, clusterOperationARN, d.Timeout(schema.TimeoutUpdate))
-
-		if err != nil {
-			return diag.Errorf("waiting for MSK Cluster (%s) operation (%s): %s", d.Id(), clusterOperationARN, err)
+		if _, err := waitClusterOperationCompleted(ctx, conn, clusterOperationARN, d.Timeout(schema.TimeoutUpdate)); err != nil {
+			return diag.Errorf("waiting for MSK Cluster (%s) operation (%s) complete: %s", d.Id(), clusterOperationARN, err)
 		}
 
 		// refresh the current_version attribute after each update
@@ -833,9 +909,7 @@ func resourceClusterUpdate(ctx context.Context, d *schema.ResourceData, meta int
 
 		clusterOperationARN := aws.StringValue(output.ClusterOperationArn)
 
-		_, err = waitClusterOperationCompleted(ctx, conn, clusterOperationARN, d.Timeout(schema.TimeoutUpdate))
-
-		if err != nil {
+		if _, err := waitClusterOperationCompleted(ctx, conn, clusterOperationARN, d.Timeout(schema.TimeoutUpdate)); err != nil {
 			return diag.Errorf("waiting for MSK Cluster (%s) operation (%s): %s", d.Id(), clusterOperationARN, err)
 		}
 
@@ -877,9 +951,7 @@ func resourceClusterUpdate(ctx context.Context, d *schema.ResourceData, meta int
 
 		clusterOperationARN := aws.StringValue(output.ClusterOperationArn)
 
-		_, err = waitClusterOperationCompleted(ctx, conn, clusterOperationARN, d.Timeout(schema.TimeoutUpdate))
-
-		if err != nil {
+		if _, err := waitClusterOperationCompleted(ctx, conn, clusterOperationARN, d.Timeout(schema.TimeoutUpdate)); err != nil {
 			return diag.Errorf("waiting for MSK Cluster (%s) operation (%s): %s", d.Id(), clusterOperationARN, err)
 		}
 
@@ -908,9 +980,7 @@ func resourceClusterDelete(ctx context.Context, d *schema.ResourceData, meta int
 		return diag.Errorf("deleting MSK Cluster (%s): %s", d.Id(), err)
 	}
 
-	_, err = waitClusterDeleted(ctx, conn, d.Id(), d.Timeout(schema.TimeoutDelete))
-
-	if err != nil {
+	if _, err := waitClusterDeleted(ctx, conn, d.Id(), d.Timeout(schema.TimeoutDelete)); err != nil {
 		return diag.Errorf("waiting for MSK Cluster (%s) delete: %s", d.Id(), err)
 	}
 
@@ -962,6 +1032,10 @@ func expandConnectivityInfo(tfMap map[string]interface{}) *kafka.ConnectivityInf
 		apiObject.PublicAccess = expandPublicAccess(v[0].(map[string]interface{}))
 	}
 
+	if v, ok := tfMap["vpc_connectivity"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
+		apiObject.VpcConnectivity = expandVPCConnectivity(v[0].(map[string]interface{}))
+	}
+
 	return apiObject
 }
 
@@ -1029,6 +1103,62 @@ func expandPublicAccess(tfMap map[string]interface{}) *kafka.PublicAccess {
 	return apiObject
 }
 
+func expandVPCConnectivity(tfMap map[string]interface{}) *kafka.VpcConnectivity {
+	if tfMap == nil {
+		return nil
+	}
+
+	apiObject := &kafka.VpcConnectivity{}
+
+	if v, ok := tfMap["client_authentication"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
+		apiObject.ClientAuthentication = expandVPCConnectivityClientAuthentication(v[0].(map[string]interface{}))
+	}
+
+	return apiObject
+}
+
+func expandVPCConnectivityClientAuthentication(tfMap map[string]interface{}) *kafka.VpcConnectivityClientAuthentication {
+	if tfMap == nil {
+		return nil
+	}
+
+	apiObject := &kafka.VpcConnectivityClientAuthentication{}
+
+	if v, ok := tfMap["sasl"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
+		apiObject.Sasl = expandVPCConnectivitySASL(v[0].(map[string]interface{}))
+	}
+
+	if v, ok := tfMap["tls"].(bool); ok {
+		apiObject.Tls = &kafka.VpcConnectivityTls{
+			Enabled: aws.Bool(v),
+		}
+	}
+
+	return apiObject
+}
+
+func expandVPCConnectivitySASL(tfMap map[string]interface{}) *kafka.VpcConnectivitySasl {
+	if tfMap == nil {
+		return nil
+	}
+
+	apiObject := &kafka.VpcConnectivitySasl{}
+
+	if v, ok := tfMap["iam"].(bool); ok {
+		apiObject.Iam = &kafka.VpcConnectivityIam{
+			Enabled: aws.Bool(v),
+		}
+	}
+
+	if v, ok := tfMap["scram"].(bool); ok {
+		apiObject.Scram = &kafka.VpcConnectivityScram{
+			Enabled: aws.Bool(v),
+		}
+	}
+
+	return apiObject
+}
+
 func expandClientAuthentication(tfMap map[string]interface{}) *kafka.ClientAuthentication {
 	if tfMap == nil {
 		return nil
@@ -1347,6 +1477,10 @@ func flattenConnectivityInfo(apiObject *kafka.ConnectivityInfo) map[string]inter
 		tfMap["public_access"] = []interface{}{flattenPublicAccess(v)}
 	}
 
+	if v := apiObject.VpcConnectivity; v != nil {
+		tfMap["vpc_connectivity"] = []interface{}{flattenVPCConnectivity(v)}
+	}
+
 	return tfMap
 }
 
@@ -1414,6 +1548,61 @@ func flattenPublicAccess(apiObject *kafka.PublicAccess) map[string]interface{} {
 	return tfMap
 }
 
+func flattenVPCConnectivity(apiObject *kafka.VpcConnectivity) map[string]interface{} {
+	if apiObject == nil {
+		return nil
+	}
+
+	tfMap := map[string]interface{}{}
+	if v := apiObject.ClientAuthentication; v != nil {
+		tfMap["client_authentication"] = []interface{}{flattenVPCConnectivityClientAuthentication(v)}
+	}
+
+	return tfMap
+}
+
+func flattenVPCConnectivityClientAuthentication(apiObject *kafka.VpcConnectivityClientAuthentication) map[string]interface{} {
+	if apiObject == nil {
+		return nil
+	}
+
+	tfMap := map[string]interface{}{}
+
+	if v := apiObject.Sasl; v != nil {
+		tfMap["sasl"] = []interface{}{(flattenVPCConnectivitySASL(v))}
+	}
+
+	if v := apiObject.Tls; v != nil {
+		if v := v.Enabled; v != nil {
+			tfMap["tls"] = aws.BoolValue(v)
+		}
+	}
+
+	return tfMap
+}
+
+func flattenVPCConnectivitySASL(apiObject *kafka.VpcConnectivitySasl) map[string]interface{} {
+	if apiObject == nil {
+		return nil
+	}
+
+	tfMap := map[string]interface{}{}
+
+	if v := apiObject.Iam; v != nil {
+		if v := v.Enabled; v != nil {
+			tfMap["iam"] = aws.BoolValue(v)
+		}
+	}
+
+	if v := apiObject.Scram; v != nil {
+		if v := v.Enabled; v != nil {
+			tfMap["scram"] = aws.BoolValue(v)
+		}
+	}
+
+	return tfMap
+}
+
 func flattenClientAuthentication(apiObject *kafka.ClientAuthentication) map[string]interface{} {
 	if apiObject == nil {
 		return nil
@@ -1697,3 +1886,17 @@ func refreshClusterVersion(ctx context.Context, d *schema.ResourceData, meta int
 
 	return nil
 }
+
+func clusterUUIDFromARN(clusterARN string) (string, error) {
+	parsedARN, err := arn.Parse(clusterARN)
+	if err != nil {
+		return "", err
+	}
+
+	// arn:${Partition}:kafka:${Region}:${Account}:cluster/${ClusterName}/${Uuid}
+	parts := strings.Split(parsedARN.Resource, "/")
+	if len(parts) != 3 || parts[0] != "cluster" || parts[1] == "" || parts[2] == "" {
+		return "", fmt.Errorf("invalid MSK Cluster ARN (%s)", clusterARN)
+	}
+	return parts[2], nil
+}
diff --git a/internal/service/kafka/cluster_data_source.go b/internal/service/kafka/cluster_data_source.go
index e0138f47841..bbb43cb8d73 100644
--- a/internal/service/kafka/cluster_data_source.go
+++ b/internal/service/kafka/cluster_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kafka
 
 import (
@@ -56,6 +59,10 @@ func DataSourceCluster() *schema.Resource {
 				Required:     true,
 				ValidateFunc: validation.StringLenBetween(1, 64),
 			},
+			"cluster_uuid": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
 			"kafka_version": {
 				Type:     schema.TypeString,
 				Computed: true,
@@ -122,7 +129,8 @@ func dataSourceClusterRead(ctx context.Context, d *schema.ResourceData, meta int
 		return sdkdiag.AppendErrorf(diags, "reading MSK Cluster (%s) bootstrap brokers: %s", aws.StringValue(cluster.ClusterArn), err)
 	}
 
-	d.Set("arn", cluster.ClusterArn)
+	clusterARN := aws.StringValue(cluster.ClusterArn)
+	d.Set("arn", clusterARN)
 	d.Set("bootstrap_brokers", SortEndpointsString(aws.StringValue(bootstrapBrokersOutput.BootstrapBrokerString)))
 	d.Set("bootstrap_brokers_public_sasl_iam", SortEndpointsString(aws.StringValue(bootstrapBrokersOutput.BootstrapBrokerStringPublicSaslIam)))
 	d.Set("bootstrap_brokers_public_sasl_scram", SortEndpointsString(aws.StringValue(bootstrapBrokersOutput.BootstrapBrokerStringPublicSaslScram)))
@@ -131,6 +139,8 @@ func dataSourceClusterRead(ctx context.Context, d *schema.ResourceData, meta int
 	d.Set("bootstrap_brokers_sasl_scram", SortEndpointsString(aws.StringValue(bootstrapBrokersOutput.BootstrapBrokerStringSaslScram)))
 	d.Set("bootstrap_brokers_tls", SortEndpointsString(aws.StringValue(bootstrapBrokersOutput.BootstrapBrokerStringTls)))
 	d.Set("cluster_name", cluster.ClusterName)
+	clusterUUID, _ := clusterUUIDFromARN(clusterARN)
+	d.Set("cluster_uuid", clusterUUID)
 	d.Set("kafka_version", cluster.CurrentBrokerSoftwareInfo.KafkaVersion)
 	d.Set("number_of_broker_nodes", cluster.NumberOfBrokerNodes)
 
diff --git a/internal/service/kafka/cluster_data_source_test.go b/internal/service/kafka/cluster_data_source_test.go
index 455d86d8dfd..9126cf01d06 100644
--- a/internal/service/kafka/cluster_data_source_test.go
+++ b/internal/service/kafka/cluster_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kafka_test
 
 import (
@@ -34,6 +37,7 @@ func TestAccKafkaClusterDataSource_basic(t *testing.T) {
 					resource.TestCheckResourceAttrPair(dataSourceName, "bootstrap_brokers_sasl_scram", resourceName, "bootstrap_brokers_sasl_scram"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "bootstrap_brokers_tls", resourceName, "bootstrap_brokers_tls"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "cluster_name", resourceName, "cluster_name"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "cluster_uuid", resourceName, "cluster_uuid"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "kafka_version", resourceName, "kafka_version"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "number_of_broker_nodes", resourceName, "number_of_broker_nodes"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "tags.%", resourceName, "tags.%"),
@@ -49,12 +53,12 @@ func testAccClusterDataSourceConfig_basic(rName string) string {
 	return acctest.ConfigCompose(testAccClusterConfig_base(rName), fmt.Sprintf(`
 resource "aws_msk_cluster" "test" {
   cluster_name           = %[1]q
-  kafka_version          = "2.2.1"
+  kafka_version          = "2.8.1"
   number_of_broker_nodes = 3
 
   broker_node_group_info {
     client_subnets  = aws_subnet.test[*].id
-    instance_type   = "kafka.m5.large"
+    instance_type   = "kafka.t3.small"
     security_groups = [aws_security_group.test.id]
 
     storage_info {
@@ -65,7 +69,7 @@ resource "aws_msk_cluster" "test" {
   }
 
   tags = {
-    key1 = "value1"
+    Name = %[1]q
   }
 }
 
diff --git a/internal/service/kafka/cluster_policy.go b/internal/service/kafka/cluster_policy.go
new file mode 100644
index 00000000000..001522f4c42
--- /dev/null
+++ b/internal/service/kafka/cluster_policy.go
@@ -0,0 +1,168 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package kafka
+
+import (
+	"context"
+	"log"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/kafka"
+	"github.com/aws/aws-sdk-go-v2/service/kafka/types"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/structure"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/internal/verify"
+)
+
+// @SDKResource("aws_msk_cluster_policy", name="Cluster Policy")
+func ResourceClusterPolicy() *schema.Resource {
+	return &schema.Resource{
+		CreateWithoutTimeout: resourceClusterPolicyPut,
+		ReadWithoutTimeout:   resourceClusterPolicyRead,
+		UpdateWithoutTimeout: resourceClusterPolicyPut,
+		DeleteWithoutTimeout: resourceClusterPolicyDelete,
+
+		Importer: &schema.ResourceImporter{
+			StateContext: schema.ImportStatePassthroughContext,
+		},
+
+		Schema: map[string]*schema.Schema{
+			"cluster_arn": {
+				Type:     schema.TypeString,
+				Required: true,
+			},
+			"current_version": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"policy": {
+				Type:                  schema.TypeString,
+				Required:              true,
+				ValidateFunc:          validation.StringIsJSON,
+				DiffSuppressFunc:      verify.SuppressEquivalentPolicyDiffs,
+				DiffSuppressOnRefresh: true,
+				StateFunc: func(v interface{}) string {
+					json, _ := structure.NormalizeJsonString(v)
+					return json
+				},
+			},
+		},
+	}
+}
+
+func resourceClusterPolicyPut(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).KafkaClient(ctx)
+
+	policy, err := structure.NormalizeJsonString(d.Get("policy").(string))
+	if err != nil {
+		return sdkdiag.AppendFromErr(diags, err)
+	}
+
+	clusterARN := d.Get("cluster_arn").(string)
+	input := &kafka.PutClusterPolicyInput{
+		ClusterArn: aws.String(clusterARN),
+		Policy:     aws.String(policy),
+	}
+
+	if !d.IsNewResource() {
+		input.CurrentVersion = aws.String(d.Get("current_version").(string))
+	}
+
+	_, err = conn.PutClusterPolicy(ctx, input)
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "setting MSK Cluster Policy (%s): %s", clusterARN, err)
+	}
+
+	if d.IsNewResource() {
+		d.SetId(clusterARN)
+	}
+
+	return append(diags, resourceClusterPolicyRead(ctx, d, meta)...)
+}
+
+func resourceClusterPolicyRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).KafkaClient(ctx)
+
+	output, err := FindClusterPolicyByARN(ctx, conn, d.Id())
+
+	if !d.IsNewResource() && tfresource.NotFound(err) {
+		log.Printf("[WARN] MSK Cluster Policy (%s) not found, removing from state", d.Id())
+		d.SetId("")
+		return diags
+	}
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "reading MSK Cluster Policy (%s): %s", d.Id(), err)
+	}
+
+	d.Set("cluster_arn", d.Id())
+	d.Set("current_version", output.CurrentVersion)
+	if output.Policy != nil {
+		policyToSet, err := verify.PolicyToSet(d.Get("policy").(string), aws.ToString(output.Policy))
+		if err != nil {
+			return sdkdiag.AppendFromErr(diags, err)
+		}
+
+		d.Set("policy", policyToSet)
+	} else {
+		d.Set("policy", nil)
+	}
+
+	return diags
+}
+
+func resourceClusterPolicyDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).KafkaClient(ctx)
+
+	log.Printf("[INFO] Deleting MSK Cluster Policy: %s", d.Id())
+	_, err := conn.DeleteClusterPolicy(ctx, &kafka.DeleteClusterPolicyInput{
+		ClusterArn: aws.String(d.Id()),
+	})
+
+	if errs.IsA[*types.NotFoundException](err) {
+		return diags
+	}
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "deleting MSK Cluster Policy (%s): %s", d.Id(), err)
+	}
+
+	return diags
+}
+
+func FindClusterPolicyByARN(ctx context.Context, conn *kafka.Client, id string) (*kafka.GetClusterPolicyOutput, error) {
+	in := &kafka.GetClusterPolicyInput{
+		ClusterArn: aws.String(id),
+	}
+
+	out, err := conn.GetClusterPolicy(ctx, in)
+
+	if errs.IsA[*types.NotFoundException](err) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: in,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	if out == nil {
+		return nil, tfresource.NewEmptyResultError(in)
+	}
+
+	return out, nil
+}
diff --git a/internal/service/kafka/cluster_policy_test.go b/internal/service/kafka/cluster_policy_test.go
new file mode 100644
index 00000000000..26dc1c4ef04
--- /dev/null
+++ b/internal/service/kafka/cluster_policy_test.go
@@ -0,0 +1,226 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package kafka_test
+
+import (
+	"context"
+	"fmt"
+	"testing"
+
+	"github.com/YakDriver/regexache"
+	"github.com/aws/aws-sdk-go-v2/service/kafka"
+	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
+	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	tfkafka "github.com/hashicorp/terraform-provider-aws/internal/service/kafka"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/names"
+)
+
+func TestAccKafkaClusterPolicy_basic(t *testing.T) {
+	ctx := acctest.Context(t)
+	var clusterpolicy kafka.GetClusterPolicyOutput
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_msk_cluster_policy.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, names.Kafka)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, names.Kafka),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckClusterPolicyDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccClusterPolicyConfig_basic(rName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckClusterPolicyExists(ctx, resourceName, &clusterpolicy),
+					resource.TestCheckResourceAttrSet(resourceName, "current_version"),
+					resource.TestMatchResourceAttr(resourceName, "policy", regexache.MustCompile(`"kafka:Get\*","kafka:CreateVpcConnection"`)),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
+func TestAccKafkaClusterPolicy_disappears(t *testing.T) {
+	ctx := acctest.Context(t)
+	var clusterpolicy kafka.GetClusterPolicyOutput
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_msk_cluster_policy.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, names.Kafka)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, names.Kafka),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckClusterPolicyDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccClusterPolicyConfig_basic(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckClusterPolicyExists(ctx, resourceName, &clusterpolicy),
+					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfkafka.ResourceClusterPolicy(), resourceName),
+				),
+				ExpectNonEmptyPlan: true,
+			},
+		},
+	})
+}
+
+func TestAccKafkaClusterPolicy_update(t *testing.T) {
+	ctx := acctest.Context(t)
+	var clusterpolicy kafka.GetClusterPolicyOutput
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_msk_cluster_policy.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, names.Kafka)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, names.Kafka),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckClusterPolicyDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccClusterPolicyConfig_basic(rName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckClusterPolicyExists(ctx, resourceName, &clusterpolicy),
+					resource.TestCheckResourceAttrSet(resourceName, "current_version"),
+					resource.TestMatchResourceAttr(resourceName, "policy", regexache.MustCompile(`"kafka:Get\*","kafka:CreateVpcConnection"`)),
+				),
+			},
+			{
+				Config: testAccClusterPolicyConfig_updated(rName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckClusterPolicyExists(ctx, resourceName, &clusterpolicy),
+					resource.TestCheckResourceAttrSet(resourceName, "current_version"),
+					resource.TestMatchResourceAttr(resourceName, "policy", regexache.MustCompile(`"kafka:DescribeCluster","kafka:DescribeClusterV2"`)),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckClusterPolicyDestroy(ctx context.Context) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		conn := acctest.Provider.Meta().(*conns.AWSClient).KafkaClient(ctx)
+
+		for _, rs := range s.RootModule().Resources {
+			if rs.Type != "aws_msk_cluster_policy" {
+				continue
+			}
+
+			_, err := tfkafka.FindClusterPolicyByARN(ctx, conn, rs.Primary.ID)
+
+			if tfresource.NotFound(err) {
+				continue
+			}
+
+			if err != nil {
+				return err
+			}
+
+			return fmt.Errorf("MSK Cluster Policy %s still exists", rs.Primary.ID)
+		}
+
+		return nil
+	}
+}
+
+func testAccCheckClusterPolicyExists(ctx context.Context, n string, v *kafka.GetClusterPolicyOutput) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		conn := acctest.Provider.Meta().(*conns.AWSClient).KafkaClient(ctx)
+
+		output, err := tfkafka.FindClusterPolicyByARN(ctx, conn, rs.Primary.ID)
+
+		if err != nil {
+			return err
+		}
+
+		*v = *output
+
+		return nil
+	}
+}
+
+func testAccClusterPolicyConfig_basic(rName string) string {
+	return acctest.ConfigCompose(testAccVPCConnectionConfig_basic(rName), `
+data "aws_caller_identity" "current" {}
+data "aws_partition" "current" {}
+
+resource "aws_msk_cluster_policy" "test" {
+  cluster_arn = aws_msk_cluster.test.arn
+
+  policy = jsonencode({
+    Version = "2012-10-17",
+    Statement = [{
+      Sid    = "testMskClusterPolicy"
+      Effect = "Allow"
+      Principal = {
+        "AWS" = "arn:${data.aws_partition.current.partition}:iam::${data.aws_caller_identity.current.account_id}:root"
+      }
+      Action = [
+        "kafka:Describe*",
+        "kafka:Get*",
+        "kafka:CreateVpcConnection",
+      ]
+      Resource = aws_msk_cluster.test.arn
+    }]
+  })
+
+  depends_on = [aws_msk_vpc_connection.test]
+}
+`)
+}
+
+func testAccClusterPolicyConfig_updated(rName string) string {
+	return acctest.ConfigCompose(testAccVPCConnectionConfig_basic(rName), `
+data "aws_caller_identity" "current" {}
+data "aws_partition" "current" {}
+
+resource "aws_msk_cluster_policy" "test" {
+  cluster_arn = aws_msk_cluster.test.arn
+
+  policy = jsonencode({
+    Version = "2012-10-17",
+    Statement = [{
+      Sid    = "testMskClusterPolicy"
+      Effect = "Allow"
+      Principal = {
+        "AWS" = "arn:${data.aws_partition.current.partition}:iam::${data.aws_caller_identity.current.account_id}:root"
+      }
+      Action = [
+        "kafka:CreateVpcConnection",
+        "kafka:GetBootstrapBrokers",
+        "kafka:DescribeCluster",
+        "kafka:DescribeClusterV2",
+      ]
+      Resource = aws_msk_cluster.test.arn
+    }]
+  })
+
+  depends_on = [aws_msk_vpc_connection.test]
+}
+`)
+}
diff --git a/internal/service/kafka/cluster_test.go b/internal/service/kafka/cluster_test.go
index 9272fa16669..d59e4ea5452 100644
--- a/internal/service/kafka/cluster_test.go
+++ b/internal/service/kafka/cluster_test.go
@@ -1,14 +1,17 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kafka_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"sort"
 	"strconv"
 	"strings"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/acmpca"
 	"github.com/aws/aws-sdk-go/service/kafka"
@@ -36,13 +39,13 @@ const (
 )
 
 var (
-	clusterBoostrapBrokersRegexp              = regexp.MustCompile(fmt.Sprintf(clusterBrokerRegexpFormat, clusterPortPlaintext))
-	clusterBoostrapBrokersSASLIAMRegexp       = regexp.MustCompile(fmt.Sprintf(clusterBrokerRegexpFormat, clusterPortSASLIAM))
-	clusterBoostrapBrokersSASLIAMPublicRegexp = regexp.MustCompile(fmt.Sprintf(clusterBrokerRegexpFormat, clusterPortSASLIAMPublic))
-	clusterBoostrapBrokersSASLScramRegexp     = regexp.MustCompile(fmt.Sprintf(clusterBrokerRegexpFormat, clusterPortSASLScram))
-	clusterBoostrapBrokersTLSRegexp           = regexp.MustCompile(fmt.Sprintf(clusterBrokerRegexpFormat, clusterPortTLS))
+	clusterBoostrapBrokersRegexp              = regexache.MustCompile(fmt.Sprintf(clusterBrokerRegexpFormat, clusterPortPlaintext))
+	clusterBoostrapBrokersSASLIAMRegexp       = regexache.MustCompile(fmt.Sprintf(clusterBrokerRegexpFormat, clusterPortSASLIAM))
+	clusterBoostrapBrokersSASLIAMPublicRegexp = regexache.MustCompile(fmt.Sprintf(clusterBrokerRegexpFormat, clusterPortSASLIAMPublic))
+	clusterBoostrapBrokersSASLScramRegexp     = regexache.MustCompile(fmt.Sprintf(clusterBrokerRegexpFormat, clusterPortSASLScram))
+	clusterBoostrapBrokersTLSRegexp           = regexache.MustCompile(fmt.Sprintf(clusterBrokerRegexpFormat, clusterPortTLS))
 
-	clusterZookeeperConnectStringRegexp = regexp.MustCompile(fmt.Sprintf(clusterBrokerRegexpFormat, clusterPortZookeeper))
+	clusterZookeeperConnectStringRegexp = regexache.MustCompile(fmt.Sprintf(clusterBrokerRegexpFormat, clusterPortZookeeper))
 )
 
 func TestAccKafkaCluster_basic(t *testing.T) {
@@ -61,7 +64,7 @@ func TestAccKafkaCluster_basic(t *testing.T) {
 				Config: testAccClusterConfig_basic(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckClusterExists(ctx, resourceName, &cluster),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "kafka", regexp.MustCompile(`cluster/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "kafka", regexache.MustCompile(`cluster/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "bootstrap_brokers", ""),
 					resource.TestCheckResourceAttr(resourceName, "bootstrap_brokers_public_sasl_iam", ""),
 					resource.TestCheckResourceAttr(resourceName, "bootstrap_brokers_public_sasl_scram", ""),
@@ -69,6 +72,9 @@ func TestAccKafkaCluster_basic(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "bootstrap_brokers_sasl_scram", ""),
 					resource.TestMatchResourceAttr(resourceName, "bootstrap_brokers_tls", clusterBoostrapBrokersTLSRegexp),
 					testAccCheckResourceAttrIsSortedCSV(resourceName, "bootstrap_brokers_tls"),
+					resource.TestCheckResourceAttr(resourceName, "bootstrap_brokers_vpc_connectivity_sasl_iam", ""),
+					resource.TestCheckResourceAttr(resourceName, "bootstrap_brokers_vpc_connectivity_sasl_scram", ""),
+					resource.TestCheckResourceAttr(resourceName, "bootstrap_brokers_vpc_connectivity_tls", ""),
 					resource.TestCheckResourceAttr(resourceName, "broker_node_group_info.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "broker_node_group_info.0.az_distribution", kafka.BrokerAZDistributionDefault),
 					resource.TestCheckResourceAttr(resourceName, "broker_node_group_info.0.client_subnets.#", "3"),
@@ -78,7 +84,13 @@ func TestAccKafkaCluster_basic(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "broker_node_group_info.0.connectivity_info.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "broker_node_group_info.0.connectivity_info.0.public_access.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "broker_node_group_info.0.connectivity_info.0.public_access.0.type", "DISABLED"),
-					resource.TestCheckResourceAttr(resourceName, "broker_node_group_info.0.instance_type", "kafka.m5.large"),
+					resource.TestCheckResourceAttr(resourceName, "broker_node_group_info.0.connectivity_info.0.vpc_connectivity.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "broker_node_group_info.0.connectivity_info.0.vpc_connectivity.0.client_authentication.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "broker_node_group_info.0.connectivity_info.0.vpc_connectivity.0.client_authentication.0.sasl.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "broker_node_group_info.0.connectivity_info.0.vpc_connectivity.0.client_authentication.0.sasl.0.iam", "false"),
+					resource.TestCheckResourceAttr(resourceName, "broker_node_group_info.0.connectivity_info.0.vpc_connectivity.0.client_authentication.0.sasl.0.scram", "false"),
+					resource.TestCheckResourceAttr(resourceName, "broker_node_group_info.0.connectivity_info.0.vpc_connectivity.0.client_authentication.0.tls", "false"),
+					resource.TestCheckResourceAttr(resourceName, "broker_node_group_info.0.instance_type", "kafka.t3.small"),
 					resource.TestCheckResourceAttr(resourceName, "broker_node_group_info.0.security_groups.#", "1"),
 					resource.TestCheckTypeSetElemAttrPair(resourceName, "broker_node_group_info.0.security_groups.*", "aws_security_group.test", "id"),
 					resource.TestCheckResourceAttr(resourceName, "broker_node_group_info.#", "1"),
@@ -88,14 +100,15 @@ func TestAccKafkaCluster_basic(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "broker_node_group_info.0.storage_info.0.ebs_storage_info.0.provisioned_throughput.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "client_authentication.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "cluster_name", rName),
+					resource.TestCheckResourceAttrSet(resourceName, "cluster_uuid"),
 					resource.TestCheckResourceAttr(resourceName, "configuration_info.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "encryption_info.#", "1"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "encryption_info.0.encryption_at_rest_kms_key_arn", "kms", regexp.MustCompile(`key/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "encryption_info.0.encryption_at_rest_kms_key_arn", "kms", regexache.MustCompile(`key/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "encryption_info.0.encryption_in_transit.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "encryption_info.0.encryption_in_transit.0.client_broker", "TLS"),
 					resource.TestCheckResourceAttr(resourceName, "encryption_info.0.encryption_in_transit.0.in_cluster", "true"),
 					resource.TestCheckResourceAttr(resourceName, "enhanced_monitoring", kafka.EnhancedMonitoringDefault),
-					resource.TestCheckResourceAttr(resourceName, "kafka_version", "2.7.1"),
+					resource.TestCheckResourceAttr(resourceName, "kafka_version", "2.8.1"),
 					resource.TestCheckResourceAttr(resourceName, "number_of_broker_nodes", "3"),
 					resource.TestCheckResourceAttrSet(resourceName, "storage_mode"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
@@ -312,6 +325,12 @@ func TestAccKafkaCluster_BrokerNodeGroupInfo_publicAccessSASLIAM(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "broker_node_group_info.0.connectivity_info.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "broker_node_group_info.0.connectivity_info.0.public_access.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "broker_node_group_info.0.connectivity_info.0.public_access.0.type", "DISABLED"),
+					resource.TestCheckResourceAttr(resourceName, "broker_node_group_info.0.connectivity_info.0.vpc_connectivity.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "broker_node_group_info.0.connectivity_info.0.vpc_connectivity.0.client_authentication.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "broker_node_group_info.0.connectivity_info.0.vpc_connectivity.0.client_authentication.0.sasl.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "broker_node_group_info.0.connectivity_info.0.vpc_connectivity.0.client_authentication.0.sasl.0.iam", "false"),
+					resource.TestCheckResourceAttr(resourceName, "broker_node_group_info.0.connectivity_info.0.vpc_connectivity.0.client_authentication.0.sasl.0.scram", "false"),
+					resource.TestCheckResourceAttr(resourceName, "broker_node_group_info.0.connectivity_info.0.vpc_connectivity.0.client_authentication.0.tls", "false"),
 					resource.TestCheckResourceAttr(resourceName, "client_authentication.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "client_authentication.0.sasl.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "client_authentication.0.sasl.0.iam", "true"),
@@ -332,6 +351,12 @@ func TestAccKafkaCluster_BrokerNodeGroupInfo_publicAccessSASLIAM(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "broker_node_group_info.0.connectivity_info.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "broker_node_group_info.0.connectivity_info.0.public_access.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "broker_node_group_info.0.connectivity_info.0.public_access.0.type", "SERVICE_PROVIDED_EIPS"),
+					resource.TestCheckResourceAttr(resourceName, "broker_node_group_info.0.connectivity_info.0.vpc_connectivity.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "broker_node_group_info.0.connectivity_info.0.vpc_connectivity.0.client_authentication.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "broker_node_group_info.0.connectivity_info.0.vpc_connectivity.0.client_authentication.0.sasl.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "broker_node_group_info.0.connectivity_info.0.vpc_connectivity.0.client_authentication.0.sasl.0.iam", "false"),
+					resource.TestCheckResourceAttr(resourceName, "broker_node_group_info.0.connectivity_info.0.vpc_connectivity.0.client_authentication.0.sasl.0.scram", "false"),
+					resource.TestCheckResourceAttr(resourceName, "broker_node_group_info.0.connectivity_info.0.vpc_connectivity.0.client_authentication.0.tls", "false"),
 				),
 			},
 			{
@@ -349,6 +374,47 @@ func TestAccKafkaCluster_BrokerNodeGroupInfo_publicAccessSASLIAM(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "broker_node_group_info.0.connectivity_info.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "broker_node_group_info.0.connectivity_info.0.public_access.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "broker_node_group_info.0.connectivity_info.0.public_access.0.type", "DISABLED"),
+					resource.TestCheckResourceAttr(resourceName, "broker_node_group_info.0.connectivity_info.0.vpc_connectivity.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "broker_node_group_info.0.connectivity_info.0.vpc_connectivity.0.client_authentication.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "broker_node_group_info.0.connectivity_info.0.vpc_connectivity.0.client_authentication.0.sasl.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "broker_node_group_info.0.connectivity_info.0.vpc_connectivity.0.client_authentication.0.sasl.0.iam", "false"),
+					resource.TestCheckResourceAttr(resourceName, "broker_node_group_info.0.connectivity_info.0.vpc_connectivity.0.client_authentication.0.sasl.0.scram", "false"),
+					resource.TestCheckResourceAttr(resourceName, "broker_node_group_info.0.connectivity_info.0.vpc_connectivity.0.client_authentication.0.tls", "false"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccKafkaCluster_BrokerNodeGroupInfo_vpcConnectivity(t *testing.T) {
+	ctx := acctest.Context(t)
+	var cluster1 kafka.ClusterInfo
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_msk_cluster.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, kafka.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckClusterDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccClusterConfig_brokerNodeGroupInfoVPCConnectivitySASLIAM(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckClusterExists(ctx, resourceName, &cluster1),
+					resource.TestCheckResourceAttr(resourceName, "broker_node_group_info.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "broker_node_group_info.0.connectivity_info.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "broker_node_group_info.0.connectivity_info.0.public_access.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "broker_node_group_info.0.connectivity_info.0.public_access.0.type", "DISABLED"),
+					resource.TestCheckResourceAttr(resourceName, "broker_node_group_info.0.connectivity_info.0.vpc_connectivity.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "broker_node_group_info.0.connectivity_info.0.vpc_connectivity.0.client_authentication.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "broker_node_group_info.0.connectivity_info.0.vpc_connectivity.0.client_authentication.0.sasl.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "broker_node_group_info.0.connectivity_info.0.vpc_connectivity.0.client_authentication.0.sasl.0.iam", "true"),
+					resource.TestCheckResourceAttr(resourceName, "broker_node_group_info.0.connectivity_info.0.vpc_connectivity.0.client_authentication.0.sasl.0.scram", "false"),
+					resource.TestCheckResourceAttr(resourceName, "broker_node_group_info.0.connectivity_info.0.vpc_connectivity.0.client_authentication.0.tls", "false"),
+					resource.TestCheckResourceAttr(resourceName, "client_authentication.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "client_authentication.0.sasl.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "client_authentication.0.sasl.0.iam", "true"),
 				),
 			},
 		},
@@ -926,7 +992,7 @@ func TestAccKafkaCluster_storageMode(t *testing.T) {
 				Config: testAccClusterConfig_storageMode(rName, "TIERED", "2.8.2.tiered"),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckClusterExists(ctx, resourceName, &cluster),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "kafka", regexp.MustCompile(`cluster/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "kafka", regexache.MustCompile(`cluster/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "storage_mode", "TIERED"),
 				),
 			},
@@ -1309,12 +1375,12 @@ func testAccClusterConfig_basic(rName string) string {
 	return acctest.ConfigCompose(testAccClusterConfig_base(rName), fmt.Sprintf(`
 resource "aws_msk_cluster" "test" {
   cluster_name           = %[1]q
-  kafka_version          = "2.7.1"
+  kafka_version          = "2.8.1"
   number_of_broker_nodes = 3
 
   broker_node_group_info {
     client_subnets  = aws_subnet.test[*].id
-    instance_type   = "kafka.m5.large"
+    instance_type   = "kafka.t3.small"
     security_groups = [aws_security_group.test.id]
 
     storage_info {
@@ -1331,7 +1397,7 @@ func testAccClusterConfig_brokerNodeGroupInfoStorageInfoVolumeSizeSetAndProvThro
 	return acctest.ConfigCompose(testAccClusterConfig_base(rName), fmt.Sprintf(`
 resource "aws_msk_cluster" "test" {
   cluster_name           = %[1]q
-  kafka_version          = "2.7.1"
+  kafka_version          = "2.8.1"
   number_of_broker_nodes = 3
 
   broker_node_group_info {
@@ -1355,7 +1421,7 @@ func testAccClusterConfig_brokerNodeGroupInfoStorageInfoVolumeSizeSetAndProvThro
 	return acctest.ConfigCompose(testAccClusterConfig_base(rName), fmt.Sprintf(`
 resource "aws_msk_cluster" "test" {
   cluster_name           = %[1]q
-  kafka_version          = "2.7.1"
+  kafka_version          = "2.8.1"
   number_of_broker_nodes = 3
 
   broker_node_group_info {
@@ -1380,7 +1446,7 @@ func testAccClusterConfig_brokerNodeGroupInfoInstanceType(rName string, t string
 	return acctest.ConfigCompose(testAccClusterConfig_base(rName), fmt.Sprintf(`
 resource "aws_msk_cluster" "test" {
   cluster_name           = %[1]q
-  kafka_version          = "2.7.1"
+  kafka_version          = "2.8.1"
   number_of_broker_nodes = 3
 
   broker_node_group_info {
@@ -1401,7 +1467,7 @@ resource "aws_msk_cluster" "test" {
 func testAccClusterConfig_allowEveryoneNoACLFoundFalse(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_msk_configuration" "test" {
-  kafka_versions = ["2.7.1"]
+  kafka_versions = ["2.8.1"]
   name           = %[1]q
 
   server_properties = <<-PROPERTIES
@@ -1417,12 +1483,12 @@ func testAccClusterConfig_brokerNodeGroupInfoNoPublicAccessSASLIAM(rName string)
 		fmt.Sprintf(`
 resource "aws_msk_cluster" "test" {
   cluster_name           = %[1]q
-  kafka_version          = "2.7.1"
+  kafka_version          = "2.8.1"
   number_of_broker_nodes = 3
 
   broker_node_group_info {
     client_subnets  = aws_subnet.test[*].id
-    instance_type   = "kafka.m5.large"
+    instance_type   = "kafka.t3.small"
     security_groups = [aws_security_group.test.id]
 
     storage_info {
@@ -1453,12 +1519,12 @@ func testAccClusterConfig_brokerNodeGroupInfoPublicAccessSASLIAM(rName string, p
 		fmt.Sprintf(`
 resource "aws_msk_cluster" "test" {
   cluster_name           = %[1]q
-  kafka_version          = "2.7.1"
+  kafka_version          = "2.8.1"
   number_of_broker_nodes = 3
 
   broker_node_group_info {
     client_subnets  = aws_subnet.test[*].id
-    instance_type   = "kafka.m5.large"
+    instance_type   = "kafka.t3.small"
     security_groups = [aws_security_group.test.id]
 
     storage_info {
@@ -1488,6 +1554,52 @@ resource "aws_msk_cluster" "test" {
 `, rName, pa))
 }
 
+func testAccClusterConfig_brokerNodeGroupInfoVPCConnectivitySASLIAM(rName string) string {
+	return acctest.ConfigCompose(
+		testAccClusterConfig_base(rName),
+		testAccClusterConfig_allowEveryoneNoACLFoundFalse(rName),
+		fmt.Sprintf(`
+resource "aws_msk_cluster" "test" {
+  cluster_name           = %[1]q
+  kafka_version          = "2.8.1"
+  number_of_broker_nodes = 3
+
+  broker_node_group_info {
+    client_subnets  = aws_subnet.test[*].id
+    instance_type   = "kafka.m5.large"
+    security_groups = [aws_security_group.test.id]
+
+    connectivity_info {
+      vpc_connectivity {
+        client_authentication {
+          sasl {
+            iam = true
+          }
+        }
+      }
+    }
+
+    storage_info {
+      ebs_storage_info {
+        volume_size = 10
+      }
+    }
+  }
+
+  configuration_info {
+    arn      = aws_msk_configuration.test.arn
+    revision = aws_msk_configuration.test.latest_revision
+  }
+
+  client_authentication {
+    sasl {
+      iam = true
+    }
+  }
+}
+`, rName))
+}
+
 func testAccClusterConfig_rootCA(commonName string) string {
 	return fmt.Sprintf(`
 resource "aws_acmpca_certificate_authority" "test" {
@@ -1513,12 +1625,12 @@ func testAccClusterConfig_clientAuthenticationTLSCertificateAuthorityARNs(rName,
 		fmt.Sprintf(`
 resource "aws_msk_cluster" "test" {
   cluster_name           = %[1]q
-  kafka_version          = "2.7.1"
+  kafka_version          = "2.8.1"
   number_of_broker_nodes = 3
 
   broker_node_group_info {
     client_subnets  = aws_subnet.test[*].id
-    instance_type   = "kafka.m5.large"
+    instance_type   = "kafka.t3.small"
     security_groups = [aws_security_group.test.id]
 
     storage_info {
@@ -1555,12 +1667,12 @@ func testAccClusterConfig_rootCANoClientAuthentication(rName, commonName string)
 		fmt.Sprintf(`
 resource "aws_msk_cluster" "test" {
   cluster_name           = %[1]q
-  kafka_version          = "2.7.1"
+  kafka_version          = "2.8.1"
   number_of_broker_nodes = 3
 
   broker_node_group_info {
     client_subnets  = aws_subnet.test[*].id
-    instance_type   = "kafka.m5.large"
+    instance_type   = "kafka.t3.small"
     security_groups = [aws_security_group.test.id]
 
     storage_info {
@@ -1584,12 +1696,12 @@ func testAccClusterConfig_clientAuthenticationSASLScram(rName string, scramEnabl
 	return acctest.ConfigCompose(testAccClusterConfig_base(rName), fmt.Sprintf(`
 resource "aws_msk_cluster" "test" {
   cluster_name           = %[1]q
-  kafka_version          = "2.7.1"
+  kafka_version          = "2.8.1"
   number_of_broker_nodes = 3
 
   broker_node_group_info {
     client_subnets  = aws_subnet.test[*].id
-    instance_type   = "kafka.m5.large"
+    instance_type   = "kafka.t3.small"
     security_groups = [aws_security_group.test.id]
 
     storage_info {
@@ -1614,12 +1726,12 @@ func testAccClusterConfig_clientAuthenticationSASLIAM(rName string, saslEnabled
 	return acctest.ConfigCompose(testAccClusterConfig_base(rName), fmt.Sprintf(`
 resource "aws_msk_cluster" "test" {
   cluster_name           = %[1]q
-  kafka_version          = "2.7.1"
+  kafka_version          = "2.8.1"
   number_of_broker_nodes = 3
 
   broker_node_group_info {
     client_subnets  = aws_subnet.test[*].id
-    instance_type   = "kafka.m5.large"
+    instance_type   = "kafka.t3.small"
     security_groups = [aws_security_group.test.id]
 
     storage_info {
@@ -1643,7 +1755,7 @@ resource "aws_msk_cluster" "test" {
 func testAccClusterConfig_configurationInfoRevision1(rName string) string {
 	return acctest.ConfigCompose(testAccClusterConfig_base(rName), fmt.Sprintf(`
 resource "aws_msk_configuration" "test1" {
-  kafka_versions = ["2.7.1"]
+  kafka_versions = ["2.8.1"]
   name           = "%[1]s-1"
 
   server_properties = <<PROPERTIES
@@ -1653,12 +1765,12 @@ PROPERTIES
 
 resource "aws_msk_cluster" "test" {
   cluster_name           = %[1]q
-  kafka_version          = "2.7.1"
+  kafka_version          = "2.8.1"
   number_of_broker_nodes = 3
 
   broker_node_group_info {
     client_subnets  = aws_subnet.test[*].id
-    instance_type   = "kafka.m5.large"
+    instance_type   = "kafka.t3.small"
     security_groups = [aws_security_group.test.id]
 
     storage_info {
@@ -1679,7 +1791,7 @@ resource "aws_msk_cluster" "test" {
 func testAccClusterConfig_configurationInfoRevision2(rName string) string {
 	return acctest.ConfigCompose(testAccClusterConfig_base(rName), fmt.Sprintf(`
 resource "aws_msk_configuration" "test1" {
-  kafka_versions = ["2.7.1"]
+  kafka_versions = ["2.8.1"]
   name           = "%[1]s-1"
 
   server_properties = <<PROPERTIES
@@ -1688,7 +1800,7 @@ PROPERTIES
 }
 
 resource "aws_msk_configuration" "test2" {
-  kafka_versions = ["2.7.1"]
+  kafka_versions = ["2.8.1"]
   name           = "%[1]s-2"
 
   server_properties = <<PROPERTIES
@@ -1698,12 +1810,12 @@ PROPERTIES
 
 resource "aws_msk_cluster" "test" {
   cluster_name           = %[1]q
-  kafka_version          = "2.7.1"
+  kafka_version          = "2.8.1"
   number_of_broker_nodes = 3
 
   broker_node_group_info {
     client_subnets  = aws_subnet.test[*].id
-    instance_type   = "kafka.m5.large"
+    instance_type   = "kafka.t3.small"
     security_groups = [aws_security_group.test.id]
 
     storage_info {
@@ -1733,12 +1845,12 @@ resource "aws_kms_key" "example_key" {
 
 resource "aws_msk_cluster" "test" {
   cluster_name           = %[1]q
-  kafka_version          = "2.7.1"
+  kafka_version          = "2.8.1"
   number_of_broker_nodes = 3
 
   broker_node_group_info {
     client_subnets  = aws_subnet.test[*].id
-    instance_type   = "kafka.m5.large"
+    instance_type   = "kafka.t3.small"
     security_groups = [aws_security_group.test.id]
 
     storage_info {
@@ -1759,12 +1871,12 @@ func testAccClusterConfig_encryptionInfoEncryptionInTransitClientBroker(rName, c
 	return acctest.ConfigCompose(testAccClusterConfig_base(rName), fmt.Sprintf(`
 resource "aws_msk_cluster" "test" {
   cluster_name           = %[1]q
-  kafka_version          = "2.7.1"
+  kafka_version          = "2.8.1"
   number_of_broker_nodes = 3
 
   broker_node_group_info {
     client_subnets  = aws_subnet.test[*].id
-    instance_type   = "kafka.m5.large"
+    instance_type   = "kafka.t3.small"
     security_groups = [aws_security_group.test.id]
 
     storage_info {
@@ -1787,12 +1899,12 @@ func testAccClusterConfig_encryptionInfoEncryptionInTransitIn(rName string, inCl
 	return acctest.ConfigCompose(testAccClusterConfig_base(rName), fmt.Sprintf(`
 resource "aws_msk_cluster" "test" {
   cluster_name           = %[1]q
-  kafka_version          = "2.7.1"
+  kafka_version          = "2.8.1"
   number_of_broker_nodes = 3
 
   broker_node_group_info {
     client_subnets  = aws_subnet.test[*].id
-    instance_type   = "kafka.m5.large"
+    instance_type   = "kafka.t3.small"
     security_groups = [aws_security_group.test.id]
 
     storage_info {
@@ -1816,12 +1928,12 @@ func testAccClusterConfig_enhancedMonitoring(rName, enhancedMonitoring string) s
 resource "aws_msk_cluster" "test" {
   cluster_name           = %[1]q
   enhanced_monitoring    = %[2]q
-  kafka_version          = "2.7.1"
+  kafka_version          = "2.8.1"
   number_of_broker_nodes = 3
 
   broker_node_group_info {
     client_subnets  = aws_subnet.test[*].id
-    instance_type   = "kafka.m5.large"
+    instance_type   = "kafka.t3.small"
     security_groups = [aws_security_group.test.id]
 
     storage_info {
@@ -1861,12 +1973,12 @@ func testAccClusterConfig_numberOfBrokerNodes(rName string, brokerCount int) str
 	return acctest.ConfigCompose(testAccClusterConfig_base(rName), fmt.Sprintf(`
 resource "aws_msk_cluster" "test" {
   cluster_name           = %[1]q
-  kafka_version          = "2.7.1"
+  kafka_version          = "2.8.1"
   number_of_broker_nodes = %[2]d
 
   broker_node_group_info {
     client_subnets  = aws_subnet.test[*].id
-    instance_type   = "kafka.m5.large"
+    instance_type   = "kafka.t3.small"
     security_groups = [aws_security_group.test.id]
 
     storage_info {
@@ -1883,12 +1995,12 @@ func testAccClusterConfig_openMonitoring(rName string, jmxExporterEnabled bool,
 	return acctest.ConfigCompose(testAccClusterConfig_base(rName), fmt.Sprintf(`
 resource "aws_msk_cluster" "test" {
   cluster_name           = %[1]q
-  kafka_version          = "2.7.1"
+  kafka_version          = "2.8.1"
   number_of_broker_nodes = 3
 
   broker_node_group_info {
     client_subnets  = aws_subnet.test[*].id
-    instance_type   = "kafka.m5.large"
+    instance_type   = "kafka.t3.small"
     security_groups = [aws_security_group.test.id]
 
     storage_info {
@@ -1981,12 +2093,12 @@ resource "aws_kinesis_firehose_delivery_stream" "test" {
 
 resource "aws_msk_cluster" "test" {
   cluster_name           = %[1]q
-  kafka_version          = "2.7.1"
+  kafka_version          = "2.8.1"
   number_of_broker_nodes = 3
 
   broker_node_group_info {
     client_subnets  = aws_subnet.test[*].id
-    instance_type   = "kafka.m5.large"
+    instance_type   = "kafka.t3.small"
     security_groups = [aws_security_group.test.id]
 
     storage_info {
@@ -2034,7 +2146,7 @@ resource "aws_msk_cluster" "test" {
 
   broker_node_group_info {
     client_subnets  = aws_subnet.test[*].id
-    instance_type   = "kafka.m5.large"
+    instance_type   = "kafka.t3.small"
     security_groups = [aws_security_group.test.id]
 
     storage_info {
@@ -2078,7 +2190,7 @@ resource "aws_msk_cluster" "test" {
 
   broker_node_group_info {
     client_subnets  = aws_subnet.test[*].id
-    instance_type   = "kafka.m5.large"
+    instance_type   = "kafka.t3.small"
     security_groups = [aws_security_group.test.id]
 
     storage_info {
@@ -2100,12 +2212,12 @@ func testAccClusterConfig_tags1(rName, tagKey1, tagValue1 string) string {
 	return acctest.ConfigCompose(testAccClusterConfig_base(rName), fmt.Sprintf(`
 resource "aws_msk_cluster" "test" {
   cluster_name           = %[1]q
-  kafka_version          = "2.7.1"
+  kafka_version          = "2.8.1"
   number_of_broker_nodes = 3
 
   broker_node_group_info {
     client_subnets  = aws_subnet.test[*].id
-    instance_type   = "kafka.m5.large"
+    instance_type   = "kafka.t3.small"
     security_groups = [aws_security_group.test.id]
 
     storage_info {
@@ -2126,12 +2238,12 @@ func testAccClusterConfig_tags2(rName, tagKey1, tagValue1, tagKey2, tagValue2 st
 	return acctest.ConfigCompose(testAccClusterConfig_base(rName), fmt.Sprintf(`
 resource "aws_msk_cluster" "test" {
   cluster_name           = %[1]q
-  kafka_version          = "2.7.1"
+  kafka_version          = "2.8.1"
   number_of_broker_nodes = 3
 
   broker_node_group_info {
     client_subnets  = aws_subnet.test[*].id
-    instance_type   = "kafka.m5.large"
+    instance_type   = "kafka.t3.small"
     security_groups = [aws_security_group.test.id]
 
     storage_info {
diff --git a/internal/service/kafka/configuration.go b/internal/service/kafka/configuration.go
index 05ebcd97ab2..a5d03fbe211 100644
--- a/internal/service/kafka/configuration.go
+++ b/internal/service/kafka/configuration.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kafka
 
 import (
diff --git a/internal/service/kafka/configuration_data_source.go b/internal/service/kafka/configuration_data_source.go
index 1c010625a0e..1107a09bcad 100644
--- a/internal/service/kafka/configuration_data_source.go
+++ b/internal/service/kafka/configuration_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kafka
 
 import (
diff --git a/internal/service/kafka/configuration_data_source_test.go b/internal/service/kafka/configuration_data_source_test.go
index 3c26d69114f..53cdf439047 100644
--- a/internal/service/kafka/configuration_data_source_test.go
+++ b/internal/service/kafka/configuration_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kafka_test
 
 import (
diff --git a/internal/service/kafka/configuration_test.go b/internal/service/kafka/configuration_test.go
index c89a10ff231..dfb4c816a2a 100644
--- a/internal/service/kafka/configuration_test.go
+++ b/internal/service/kafka/configuration_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kafka_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/kafka"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -33,12 +36,12 @@ func TestAccKafkaConfiguration_basic(t *testing.T) {
 				Config: testAccConfigurationConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckConfigurationExists(ctx, resourceName, &configuration1),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "kafka", regexp.MustCompile(`configuration/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "kafka", regexache.MustCompile(`configuration/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
 					resource.TestCheckResourceAttr(resourceName, "kafka_versions.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "latest_revision", "1"),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
-					resource.TestMatchResourceAttr(resourceName, "server_properties", regexp.MustCompile(`auto.create.topics.enable = true`)),
+					resource.TestMatchResourceAttr(resourceName, "server_properties", regexache.MustCompile(`auto.create.topics.enable = true`)),
 				),
 			},
 			{
@@ -158,7 +161,7 @@ func TestAccKafkaConfiguration_serverProperties(t *testing.T) {
 				Config: testAccConfigurationConfig_serverProperties(rName, serverProperty1),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckConfigurationExists(ctx, resourceName, &configuration1),
-					resource.TestMatchResourceAttr(resourceName, "server_properties", regexp.MustCompile(serverProperty1)),
+					resource.TestMatchResourceAttr(resourceName, "server_properties", regexache.MustCompile(serverProperty1)),
 				),
 			},
 			{
@@ -171,7 +174,7 @@ func TestAccKafkaConfiguration_serverProperties(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckConfigurationExists(ctx, resourceName, &configuration2),
 					resource.TestCheckResourceAttr(resourceName, "latest_revision", "2"),
-					resource.TestMatchResourceAttr(resourceName, "server_properties", regexp.MustCompile(serverProperty2)),
+					resource.TestMatchResourceAttr(resourceName, "server_properties", regexache.MustCompile(serverProperty2)),
 				),
 			},
 		},
diff --git a/internal/service/kafka/enum.go b/internal/service/kafka/enum.go
index d8b70b8bf07..0f9b48dd8b1 100644
--- a/internal/service/kafka/enum.go
+++ b/internal/service/kafka/enum.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kafka
 
 const (
diff --git a/internal/service/kafka/find.go b/internal/service/kafka/find.go
index b8c56adc4dc..747d9493940 100644
--- a/internal/service/kafka/find.go
+++ b/internal/service/kafka/find.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kafka
 
 import (
diff --git a/internal/service/kafka/generate.go b/internal/service/kafka/generate.go
index f5ed39e86cf..1ea2f12076f 100644
--- a/internal/service/kafka/generate.go
+++ b/internal/service/kafka/generate.go
@@ -1,4 +1,8 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ServiceTagsMap -UpdateTags
+//go:generate go run ../../generate/tags/main.go -AWSSDKVersion=2 -TagsFunc=TagsV2 -KeyValueTagsFunc=keyValueTagsV2 -GetTagsInFunc=getTagsInV2 -SetTagsOutFunc=setTagsOutV2 -ServiceTagsMap -KVTValues -SkipAWSImp -SkipTypesImp -- tagsv2_gen.go
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
 
diff --git a/internal/service/kafka/kafka_version_data_source.go b/internal/service/kafka/kafka_version_data_source.go
index 391642a7b32..ce764f55e7a 100644
--- a/internal/service/kafka/kafka_version_data_source.go
+++ b/internal/service/kafka/kafka_version_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kafka
 
 import (
diff --git a/internal/service/kafka/kafka_version_data_source_test.go b/internal/service/kafka/kafka_version_data_source_test.go
index 6ce66ef6f51..3020c1fba75 100644
--- a/internal/service/kafka/kafka_version_data_source_test.go
+++ b/internal/service/kafka/kafka_version_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kafka_test
 
 import (
diff --git a/internal/service/kafka/replicator.go b/internal/service/kafka/replicator.go
new file mode 100644
index 00000000000..84ed9edb432
--- /dev/null
+++ b/internal/service/kafka/replicator.go
@@ -0,0 +1,832 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package kafka
+
+import (
+	"context"
+	"errors"
+	"log"
+	"time"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/kafka"
+	"github.com/aws/aws-sdk-go-v2/service/kafka/types"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/create"
+	"github.com/hashicorp/terraform-provider-aws/internal/enum"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs"
+	"github.com/hashicorp/terraform-provider-aws/internal/flex"
+	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/internal/verify"
+	"github.com/hashicorp/terraform-provider-aws/names"
+)
+
+// @SDKResource("aws_msk_replicator", name="Replicator")
+// @Tags(identifierAttribute="id")
+func ResourceReplicator() *schema.Resource {
+	return &schema.Resource{
+		CreateWithoutTimeout: resourceReplicatorCreate,
+		ReadWithoutTimeout:   resourceReplicatorRead,
+		UpdateWithoutTimeout: resourceReplicatorUpdate,
+		DeleteWithoutTimeout: resourceReplicatorDelete,
+
+		Importer: &schema.ResourceImporter{
+			StateContext: schema.ImportStatePassthroughContext,
+		},
+
+		Timeouts: &schema.ResourceTimeout{
+			Create: schema.DefaultTimeout(30 * time.Minute),
+			Update: schema.DefaultTimeout(30 * time.Minute),
+			Delete: schema.DefaultTimeout(30 * time.Minute),
+		},
+
+		Schema: map[string]*schema.Schema{
+			"arn": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"current_version": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"description": {
+				Type:     schema.TypeString,
+				Optional: true,
+			},
+			"kafka_cluster": {
+				Type:     schema.TypeList,
+				Required: true,
+				ForceNew: true,
+				MinItems: 2,
+				MaxItems: 2,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"amazon_msk_cluster": {
+							Type:     schema.TypeList,
+							Required: true,
+							MaxItems: 1,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"msk_cluster_arn": {
+										Type:         schema.TypeString,
+										Required:     true,
+										ValidateFunc: verify.ValidARN,
+									},
+								},
+							},
+						},
+						"vpc_config": {
+							Type:     schema.TypeList,
+							Required: true,
+							MaxItems: 1,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"security_groups_ids": {
+										Type:     schema.TypeSet,
+										Optional: true,
+										Elem: &schema.Schema{
+											Type: schema.TypeString,
+										},
+									},
+									"subnet_ids": {
+										Type:     schema.TypeSet,
+										Required: true,
+										ForceNew: true,
+										Elem: &schema.Schema{
+											Type: schema.TypeString,
+										},
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+			"replication_info_list": {
+				Type:     schema.TypeList,
+				Required: true,
+				ForceNew: true,
+				MaxItems: 1,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"source_kafka_cluster_alias": {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+						"source_kafka_cluster_arn": {
+							Type:         schema.TypeString,
+							Required:     true,
+							ForceNew:     true,
+							ValidateFunc: verify.ValidARN,
+						},
+						"target_compression_type": {
+							Type:     schema.TypeString,
+							Required: true,
+							ForceNew: true,
+						},
+						"target_kafka_cluster_alias": {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+						"target_kafka_cluster_arn": {
+							Type:         schema.TypeString,
+							Required:     true,
+							ForceNew:     true,
+							ValidateFunc: verify.ValidARN,
+						},
+						"topic_replication": {
+							Type:     schema.TypeList,
+							Required: true,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"copy_access_control_lists_for_topics": {
+										Type:     schema.TypeBool,
+										Optional: true,
+										Default:  true,
+									},
+									"copy_topic_configurations": {
+										Type:     schema.TypeBool,
+										Optional: true,
+										Default:  true,
+									},
+									"detect_and_copy_new_topics": {
+										Type:     schema.TypeBool,
+										Optional: true,
+										Default:  true,
+									},
+									"topics_to_exclude": {
+										Type:     schema.TypeSet,
+										Optional: true,
+										Elem: &schema.Schema{
+											Type: schema.TypeString,
+										},
+									},
+									"topics_to_replicate": {
+										Type:     schema.TypeSet,
+										Required: true,
+										Elem: &schema.Schema{
+											Type: schema.TypeString,
+										},
+									},
+								},
+							},
+						},
+						"consumer_group_replication": {
+							Type:     schema.TypeList,
+							Required: true,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"consumer_groups_to_exclude": {
+										Type:     schema.TypeSet,
+										Optional: true,
+										Elem: &schema.Schema{
+											Type: schema.TypeString,
+										},
+									},
+									"consumer_groups_to_replicate": {
+										Type:     schema.TypeSet,
+										Required: true,
+										Elem: &schema.Schema{
+											Type: schema.TypeString,
+										},
+									},
+									"detect_and_copy_new_consumer_groups": {
+										Type:     schema.TypeBool,
+										Optional: true,
+										Default:  true,
+									},
+									"synchronise_consumer_group_offsets": {
+										Type:     schema.TypeBool,
+										Optional: true,
+										Default:  true,
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+			"replicator_name": {
+				Type:     schema.TypeString,
+				Required: true,
+			},
+			"service_execution_role_arn": {
+				Type:         schema.TypeString,
+				ValidateFunc: verify.ValidARN,
+				Required:     true,
+			},
+			names.AttrTags:    tftags.TagsSchema(),
+			names.AttrTagsAll: tftags.TagsSchemaComputed(),
+		},
+
+		CustomizeDiff: verify.SetTagsDiff,
+	}
+}
+
+const (
+	ResNameReplicator = "Replicator"
+)
+
+func resourceReplicatorCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).KafkaClient(ctx)
+
+	in := &kafka.CreateReplicatorInput{
+		KafkaClusters:           expandClusters(d.Get("kafka_cluster").([]interface{})),
+		ReplicationInfoList:     expandReplicationInfoList(d.Get("replication_info_list").([]interface{})),
+		ReplicatorName:          aws.String(d.Get("replicator_name").(string)),
+		ServiceExecutionRoleArn: aws.String(d.Get("service_execution_role_arn").(string)),
+		Tags:                    getTagsInV2(ctx),
+	}
+
+	if v, ok := d.GetOk("description"); ok {
+		in.Description = aws.String(v.(string))
+	}
+
+	out, err := conn.CreateReplicator(ctx, in)
+	if err != nil {
+		return append(diags, create.DiagError(names.Kafka, create.ErrActionCreating, ResNameReplicator, d.Get("replicator_name").(string), err)...)
+	}
+
+	if out == nil {
+		return append(diags, create.DiagError(names.Kafka, create.ErrActionCreating, ResNameReplicator, d.Get("replicator_name").(string), errors.New("empty output"))...)
+	}
+
+	d.SetId(aws.ToString(out.ReplicatorArn))
+
+	if _, err := waitReplicatorCreated(ctx, conn, d.Id(), d.Timeout(schema.TimeoutCreate)); err != nil {
+		return append(diags, create.DiagError(names.Kafka, create.ErrActionWaitingForCreation, ResNameReplicator, d.Id(), err)...)
+	}
+
+	return append(diags, resourceReplicatorRead(ctx, d, meta)...)
+}
+
+func resourceReplicatorRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+
+	conn := meta.(*conns.AWSClient).KafkaClient(ctx)
+
+	out, err := findReplicatorByARN(ctx, conn, d.Id())
+
+	if !d.IsNewResource() && tfresource.NotFound(err) {
+		log.Printf("[WARN] Kafka Replicator (%s) not found, removing from state", d.Id())
+		d.SetId("")
+		return diags
+	}
+
+	if err != nil {
+		return append(diags, create.DiagError(names.Kafka, create.ErrActionReading, ResNameReplicator, d.Id(), err)...)
+	}
+
+	sourceAlias := out.ReplicationInfoList[0].SourceKafkaClusterAlias
+	targetAlias := out.ReplicationInfoList[0].TargetKafkaClusterAlias
+	clustersArn := out.KafkaClusters
+
+	var sourceARN *string
+	var targetARN *string
+
+	for _, arn := range clustersArn {
+		clusterAlias := aws.ToString(arn.KafkaClusterAlias)
+		if clusterAlias == aws.ToString(sourceAlias) {
+			sourceARN = arn.AmazonMskCluster.MskClusterArn
+		} else if clusterAlias == aws.ToString(targetAlias) {
+			targetARN = arn.AmazonMskCluster.MskClusterArn
+		}
+	}
+
+	d.Set("arn", out.ReplicatorArn)
+	d.Set("current_version", out.CurrentVersion)
+	d.Set("replicator_name", out.ReplicatorName)
+	d.Set("description", out.ReplicatorDescription)
+	d.Set("service_execution_role_arn", out.ServiceExecutionRoleArn)
+	d.Set("kafka_cluster", flattenClusters(out.KafkaClusters))
+	d.Set("replication_info_list", flattenReplicationInfoList(out.ReplicationInfoList, sourceARN, targetARN))
+
+	setTagsOutV2(ctx, out.Tags)
+
+	return diags
+}
+
+func resourceReplicatorUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+
+	conn := meta.(*conns.AWSClient).KafkaClient(ctx)
+
+	if d.HasChangesExcept("tags", "tags_all") {
+		in := &kafka.UpdateReplicationInfoInput{
+			ReplicatorArn:         aws.String(d.Id()),
+			CurrentVersion:        aws.String(d.Get("current_version").(string)),
+			SourceKafkaClusterArn: aws.String(d.Get("replication_info_list.0.source_kafka_cluster_arn").(string)),
+			TargetKafkaClusterArn: aws.String(d.Get("replication_info_list.0.target_kafka_cluster_arn").(string)),
+		}
+
+		if d.HasChanges("replication_info_list.0.consumer_group_replication") {
+			if v, ok := d.GetOk("replication_info_list.0.consumer_group_replication"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
+				in.ConsumerGroupReplication = expandConsumerGroupReplicationUpdate(v.([]interface{})[0].(map[string]interface{}))
+			}
+		}
+
+		if d.HasChanges("replication_info_list.0.topic_replication") {
+			if v, ok := d.GetOk("replication_info_list.0.topic_replication"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
+				in.TopicReplication = expandTopicReplicationUpdate(v.([]interface{})[0].(map[string]interface{}))
+			}
+		}
+
+		log.Printf("[DEBUG] Updating Kafka Replicator (%s): %#v", d.Id(), in)
+
+		out, err := conn.UpdateReplicationInfo(ctx, in)
+
+		if err != nil {
+			return append(diags, create.DiagError(names.Kafka, create.ErrActionUpdating, ResNameReplicator, d.Id(), err)...)
+		}
+
+		if _, err := waitReplicatorUpdated(ctx, conn, aws.ToString(out.ReplicatorArn), d.Timeout(schema.TimeoutUpdate)); err != nil {
+			return append(diags, create.DiagError(names.Kafka, create.ErrActionWaitingForUpdate, ResNameReplicator, d.Id(), err)...)
+		}
+	}
+
+	return append(diags, resourceReplicatorRead(ctx, d, meta)...)
+}
+
+func resourceReplicatorDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).KafkaClient(ctx)
+
+	log.Printf("[INFO] Deleting Kafka Replicator %s", d.Id())
+
+	_, err := conn.DeleteReplicator(ctx, &kafka.DeleteReplicatorInput{
+		ReplicatorArn: aws.String(d.Id()),
+	})
+
+	if errs.IsA[*types.NotFoundException](err) {
+		return diags
+	}
+	if err != nil {
+		return append(diags, create.DiagError(names.Kafka, create.ErrActionDeleting, ResNameReplicator, d.Id(), err)...)
+	}
+
+	if _, err := waitReplicatorDeleted(ctx, conn, d.Id(), d.Timeout(schema.TimeoutDelete)); err != nil {
+		return append(diags, create.DiagError(names.Kafka, create.ErrActionWaitingForDeletion, ResNameReplicator, d.Id(), err)...)
+	}
+
+	return diags
+}
+
+func waitReplicatorCreated(ctx context.Context, conn *kafka.Client, arn string, timeout time.Duration) (*kafka.DescribeReplicatorOutput, error) {
+	stateConf := &retry.StateChangeConf{
+		Pending: enum.Slice(types.ReplicatorStateCreating),
+		Target:  enum.Slice(types.ReplicatorStateRunning),
+		Refresh: statusReplicator(ctx, conn, arn),
+		Timeout: timeout,
+	}
+
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+	if out, ok := outputRaw.(*kafka.DescribeReplicatorOutput); ok {
+		return out, err
+	}
+
+	return nil, err
+}
+
+func waitReplicatorUpdated(ctx context.Context, conn *kafka.Client, arn string, timeout time.Duration) (*kafka.DescribeReplicatorOutput, error) {
+	stateConf := &retry.StateChangeConf{
+		Pending: enum.Slice(types.ReplicatorStateUpdating),
+		Target:  enum.Slice(types.ReplicatorStateRunning),
+		Refresh: statusReplicator(ctx, conn, arn),
+		Timeout: timeout,
+	}
+
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+	if out, ok := outputRaw.(*kafka.DescribeReplicatorOutput); ok {
+		return out, err
+	}
+
+	return nil, err
+}
+
+func waitReplicatorDeleted(ctx context.Context, conn *kafka.Client, arn string, timeout time.Duration) (*kafka.DescribeReplicatorOutput, error) {
+	stateConf := &retry.StateChangeConf{
+		Pending: enum.Slice(types.ReplicatorStateRunning, types.ReplicatorStateDeleting),
+		Target:  []string{},
+		Refresh: statusReplicator(ctx, conn, arn),
+		Timeout: timeout,
+	}
+
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+	if out, ok := outputRaw.(*kafka.DescribeReplicatorOutput); ok {
+		return out, err
+	}
+
+	return nil, err
+}
+
+func statusReplicator(ctx context.Context, conn *kafka.Client, arn string) retry.StateRefreshFunc {
+	return func() (interface{}, string, error) {
+		out, err := findReplicatorByARN(ctx, conn, arn)
+		if tfresource.NotFound(err) {
+			return nil, "", nil
+		}
+
+		if err != nil {
+			return nil, "", err
+		}
+
+		return out, string(out.ReplicatorState), nil
+	}
+}
+
+func findReplicatorByARN(ctx context.Context, conn *kafka.Client, arn string) (*kafka.DescribeReplicatorOutput, error) {
+	in := &kafka.DescribeReplicatorInput{
+		ReplicatorArn: aws.String(arn),
+	}
+
+	out, err := conn.DescribeReplicator(ctx, in)
+
+	if errs.IsA[*types.NotFoundException](err) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: in,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	if out == nil {
+		return nil, tfresource.NewEmptyResultError(in)
+	}
+
+	return out, nil
+}
+
+func flattenReplicationInfoList(apiObjects []types.ReplicationInfoDescription, sourceCluster, targetCluster *string) []interface{} {
+	if len(apiObjects) == 0 {
+		return nil
+	}
+
+	var tfList []interface{}
+
+	for _, apiObject := range apiObjects {
+		tfList = append(tfList, flattenReplicationInfo(apiObject, sourceCluster, targetCluster))
+	}
+
+	return tfList
+}
+
+func flattenReplicationInfo(apiObject types.ReplicationInfoDescription, sourceCluster, targetCluster *string) map[string]interface{} {
+	tfMap := map[string]interface{}{}
+
+	if v := sourceCluster; v != nil {
+		tfMap["source_kafka_cluster_arn"] = aws.ToString(v)
+	}
+
+	if v := targetCluster; v != nil {
+		tfMap["target_kafka_cluster_arn"] = aws.ToString(v)
+	}
+
+	if v := apiObject.SourceKafkaClusterAlias; v != nil {
+		tfMap["source_kafka_cluster_alias"] = aws.ToString(v)
+	}
+
+	if v := apiObject.TargetKafkaClusterAlias; v != nil {
+		tfMap["target_kafka_cluster_alias"] = aws.ToString(v)
+	}
+
+	if v := apiObject.TargetCompressionType; v != "" {
+		tfMap["target_compression_type"] = v
+	}
+
+	if v := apiObject.TopicReplication; v != nil {
+		tfMap["topic_replication"] = []interface{}{flattenTopicReplication(v)}
+	}
+
+	if v := apiObject.ConsumerGroupReplication; v != nil {
+		tfMap["consumer_group_replication"] = []interface{}{flattenConsumerGroupReplication(v)}
+	}
+
+	return tfMap
+}
+
+func flattenConsumerGroupReplication(apiObject *types.ConsumerGroupReplication) map[string]interface{} {
+	if apiObject == nil {
+		return nil
+	}
+
+	tfMap := map[string]interface{}{}
+
+	if v := apiObject.ConsumerGroupsToReplicate; v != nil {
+		tfMap["consumer_groups_to_replicate"] = flex.FlattenStringValueSet(v)
+	}
+
+	if v := apiObject.ConsumerGroupsToExclude; v != nil {
+		tfMap["consumer_groups_to_exclude"] = flex.FlattenStringValueSet(v)
+	}
+
+	if aws.ToBool(apiObject.SynchroniseConsumerGroupOffsets) {
+		tfMap["synchronise_consumer_group_offsets"] = apiObject.SynchroniseConsumerGroupOffsets
+	}
+
+	if aws.ToBool(apiObject.DetectAndCopyNewConsumerGroups) {
+		tfMap["detect_and_copy_new_consumer_groups"] = apiObject.DetectAndCopyNewConsumerGroups
+	}
+
+	return tfMap
+}
+
+func flattenTopicReplication(apiObject *types.TopicReplication) map[string]interface{} {
+	if apiObject == nil {
+		return nil
+	}
+
+	tfMap := map[string]interface{}{}
+
+	if v := apiObject.TopicsToReplicate; v != nil {
+		tfMap["topics_to_replicate"] = flex.FlattenStringValueSet(v)
+	}
+
+	if v := apiObject.TopicsToExclude; v != nil {
+		tfMap["topics_to_exclude"] = flex.FlattenStringValueSet(v)
+	}
+
+	if aws.ToBool(apiObject.CopyTopicConfigurations) {
+		tfMap["copy_topic_configurations"] = apiObject.CopyTopicConfigurations
+	}
+
+	if aws.ToBool(apiObject.CopyAccessControlListsForTopics) {
+		tfMap["copy_access_control_lists_for_topics"] = apiObject.CopyAccessControlListsForTopics
+	}
+
+	if aws.ToBool(apiObject.DetectAndCopyNewTopics) {
+		tfMap["detect_and_copy_new_topics"] = apiObject.CopyAccessControlListsForTopics
+	}
+
+	return tfMap
+}
+
+func flattenClusters(apiObjects []types.KafkaClusterDescription) []interface{} {
+	if len(apiObjects) == 0 {
+		return nil
+	}
+
+	var tfList []interface{}
+
+	for _, apiObject := range apiObjects {
+		tfList = append(tfList, flattenCluster(apiObject))
+	}
+
+	return tfList
+}
+
+func flattenCluster(apiObject types.KafkaClusterDescription) map[string]interface{} {
+	tfMap := map[string]interface{}{}
+
+	if v := apiObject.AmazonMskCluster; v != nil {
+		tfMap["amazon_msk_cluster"] = []interface{}{flattenAmazonCluster(v)}
+	}
+
+	if v := apiObject.VpcConfig; v != nil {
+		tfMap["vpc_config"] = []interface{}{flattenClusterClientVPCConfig(v)}
+	}
+
+	return tfMap
+}
+
+func flattenClusterClientVPCConfig(apiObject *types.KafkaClusterClientVpcConfig) map[string]interface{} {
+	if apiObject == nil {
+		return nil
+	}
+
+	tfMap := map[string]interface{}{}
+
+	if v := apiObject.SecurityGroupIds; v != nil {
+		tfMap["security_groups_ids"] = flex.FlattenStringValueSet(v)
+	}
+
+	if v := apiObject.SubnetIds; v != nil {
+		tfMap["subnet_ids"] = flex.FlattenStringValueSet(v)
+	}
+
+	return tfMap
+}
+
+func flattenAmazonCluster(apiObject *types.AmazonMskCluster) map[string]interface{} {
+	if apiObject == nil {
+		return nil
+	}
+
+	tfMap := map[string]interface{}{
+		"msk_cluster_arn": apiObject.MskClusterArn,
+	}
+
+	return tfMap
+}
+
+func expandConsumerGroupReplicationUpdate(tfMap map[string]interface{}) *types.ConsumerGroupReplicationUpdate {
+	apiObject := &types.ConsumerGroupReplicationUpdate{}
+
+	if v, ok := tfMap["consumer_groups_to_replicate"].(*schema.Set); ok {
+		apiObject.ConsumerGroupsToReplicate = flex.ExpandStringValueSet(v)
+	}
+
+	if v, ok := tfMap["consumer_groups_to_exclude"].(*schema.Set); ok {
+		apiObject.ConsumerGroupsToExclude = flex.ExpandStringValueSet(v)
+	}
+
+	if v, ok := tfMap["synchronise_consumer_group_offsets"].(bool); ok {
+		apiObject.SynchroniseConsumerGroupOffsets = aws.Bool(v)
+	}
+
+	if v, ok := tfMap["detect_and_copy_new_consumer_groups"].(bool); ok {
+		apiObject.DetectAndCopyNewConsumerGroups = aws.Bool(v)
+	}
+
+	return apiObject
+}
+
+func expandTopicReplicationUpdate(tfMap map[string]interface{}) *types.TopicReplicationUpdate {
+	apiObject := &types.TopicReplicationUpdate{}
+
+	if v, ok := tfMap["topics_to_replicate"].(*schema.Set); ok {
+		apiObject.TopicsToReplicate = flex.ExpandStringValueSet(v)
+	}
+
+	if v, ok := tfMap["topics_to_exclude"].(*schema.Set); ok {
+		apiObject.TopicsToExclude = flex.ExpandStringValueSet(v)
+	}
+
+	if v, ok := tfMap["copy_topic_configurations"].(bool); ok {
+		apiObject.CopyTopicConfigurations = aws.Bool(v)
+	}
+
+	if v, ok := tfMap["copy_access_control_lists_for_topics"].(bool); ok {
+		apiObject.CopyAccessControlListsForTopics = aws.Bool(v)
+	}
+
+	if v, ok := tfMap["detect_and_copy_new_topics"].(bool); ok {
+		apiObject.DetectAndCopyNewTopics = aws.Bool(v)
+	}
+
+	return apiObject
+}
+
+func expandReplicationInfoList(tfList []interface{}) []types.ReplicationInfo {
+	if len(tfList) == 0 {
+		return nil
+	}
+
+	var apiObjects []types.ReplicationInfo
+
+	for _, tfMapRaw := range tfList {
+		tfMap, ok := tfMapRaw.(map[string]interface{})
+
+		if !ok {
+			continue
+		}
+
+		apiObject := expandReplicationInfo(tfMap)
+
+		apiObjects = append(apiObjects, apiObject)
+	}
+
+	return apiObjects
+}
+
+func expandReplicationInfo(tfMap map[string]interface{}) types.ReplicationInfo {
+	apiObject := types.ReplicationInfo{}
+
+	if v, ok := tfMap["source_kafka_cluster_arn"].(string); ok {
+		apiObject.SourceKafkaClusterArn = aws.String(v)
+	}
+
+	if v, ok := tfMap["target_kafka_cluster_arn"].(string); ok {
+		apiObject.TargetKafkaClusterArn = aws.String(v)
+	}
+
+	if v, ok := tfMap["target_compression_type"].(string); ok {
+		apiObject.TargetCompressionType = types.TargetCompressionType(v)
+	}
+
+	if v, ok := tfMap["topic_replication"].([]interface{}); ok {
+		apiObject.TopicReplication = expandTopicReplication(v[0].(map[string]interface{}))
+	}
+
+	if v, ok := tfMap["consumer_group_replication"].([]interface{}); ok {
+		apiObject.ConsumerGroupReplication = expandConsumerGroupReplication(v[0].(map[string]interface{}))
+	}
+
+	return apiObject
+}
+
+func expandConsumerGroupReplication(tfMap map[string]interface{}) *types.ConsumerGroupReplication {
+	apiObject := &types.ConsumerGroupReplication{}
+
+	if v, ok := tfMap["consumer_groups_to_replicate"].(*schema.Set); ok && v.Len() > 0 {
+		apiObject.ConsumerGroupsToReplicate = flex.ExpandStringValueSet(v)
+	}
+
+	if v, ok := tfMap["consumer_groups_to_exclude"].(*schema.Set); ok && v.Len() > 0 {
+		apiObject.ConsumerGroupsToExclude = flex.ExpandStringValueSet(v)
+	}
+
+	if v, ok := tfMap["synchronise_consumer_group_offsets"].(bool); ok {
+		apiObject.SynchroniseConsumerGroupOffsets = aws.Bool(v)
+	}
+
+	if v, ok := tfMap["detect_and_copy_new_consumer_groups"].(bool); ok {
+		apiObject.DetectAndCopyNewConsumerGroups = aws.Bool(v)
+	}
+
+	return apiObject
+}
+
+func expandTopicReplication(tfMap map[string]interface{}) *types.TopicReplication {
+	apiObject := &types.TopicReplication{}
+
+	if v, ok := tfMap["topics_to_replicate"].(*schema.Set); ok && v.Len() > 0 {
+		apiObject.TopicsToReplicate = flex.ExpandStringValueSet(v)
+	}
+
+	if v, ok := tfMap["topics_to_exclude"].(*schema.Set); ok && v.Len() > 0 {
+		apiObject.TopicsToExclude = flex.ExpandStringValueSet(v)
+	}
+
+	if v, ok := tfMap["copy_topic_configurations"].(bool); ok {
+		apiObject.CopyTopicConfigurations = aws.Bool(v)
+	}
+
+	if v, ok := tfMap["copy_access_control_lists_for_topics"].(bool); ok {
+		apiObject.CopyAccessControlListsForTopics = aws.Bool(v)
+	}
+
+	if v, ok := tfMap["detect_and_copy_new_topics"].(bool); ok {
+		apiObject.DetectAndCopyNewTopics = aws.Bool(v)
+	}
+
+	return apiObject
+}
+
+func expandClusters(tfList []interface{}) []types.KafkaCluster {
+	if len(tfList) == 0 {
+		return nil
+	}
+
+	var apiObjects []types.KafkaCluster
+
+	for _, tfMapRaw := range tfList {
+		tfMap, ok := tfMapRaw.(map[string]interface{})
+
+		if !ok {
+			continue
+		}
+
+		apiObject := expandCluster(tfMap)
+
+		apiObjects = append(apiObjects, apiObject)
+	}
+
+	return apiObjects
+}
+
+func expandCluster(tfMap map[string]interface{}) types.KafkaCluster {
+	apiObject := types.KafkaCluster{}
+
+	if v, ok := tfMap["vpc_config"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
+		apiObject.VpcConfig = expandClusterClientVPCConfig(v[0].(map[string]interface{}))
+	}
+
+	if v, ok := tfMap["amazon_msk_cluster"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
+		apiObject.AmazonMskCluster = expandAmazonCluster(v[0].(map[string]interface{}))
+	}
+
+	return apiObject
+}
+
+func expandClusterClientVPCConfig(tfMap map[string]interface{}) *types.KafkaClusterClientVpcConfig {
+	apiObject := &types.KafkaClusterClientVpcConfig{}
+
+	if v, ok := tfMap["security_groups_ids"].(*schema.Set); ok && v.Len() > 0 {
+		apiObject.SecurityGroupIds = flex.ExpandStringValueSet(v)
+	}
+
+	if v, ok := tfMap["subnet_ids"].(*schema.Set); ok && v.Len() > 0 {
+		apiObject.SubnetIds = flex.ExpandStringValueSet(v)
+	}
+
+	return apiObject
+}
+
+func expandAmazonCluster(tfMap map[string]interface{}) *types.AmazonMskCluster {
+	apiObject := &types.AmazonMskCluster{}
+
+	if v, ok := tfMap["msk_cluster_arn"].(string); ok && v != "" {
+		apiObject.MskClusterArn = aws.String(v)
+	}
+
+	return apiObject
+}
diff --git a/internal/service/kafka/replicator_test.go b/internal/service/kafka/replicator_test.go
new file mode 100644
index 00000000000..00118727617
--- /dev/null
+++ b/internal/service/kafka/replicator_test.go
@@ -0,0 +1,753 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package kafka_test
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"testing"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/kafka"
+	"github.com/aws/aws-sdk-go-v2/service/kafka/types"
+	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
+	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/create"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs"
+	tfkafka "github.com/hashicorp/terraform-provider-aws/internal/service/kafka"
+	"github.com/hashicorp/terraform-provider-aws/names"
+)
+
+func TestAccKafkaReplicator_basic(t *testing.T) {
+	ctx := acctest.Context(t)
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
+	var replicator kafka.DescribeReplicatorOutput
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	sourceCluster := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	targetCluster := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_msk_replicator.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, names.Kafka)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, names.Kafka),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckReplicatorDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccReplicatorConfig_basic(rName, sourceCluster, targetCluster),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckReplicatorExists(ctx, resourceName, &replicator),
+					resource.TestCheckResourceAttrSet(resourceName, "arn"),
+					resource.TestCheckResourceAttr(resourceName, "replicator_name", rName),
+					resource.TestCheckResourceAttr(resourceName, "description", "test-description"),
+					resource.TestCheckResourceAttr(resourceName, "kafka_cluster.#", "2"),
+					resource.TestCheckResourceAttr(resourceName, "kafka_cluster.0.vpc_config.0.subnet_ids.#", "3"),
+					resource.TestCheckResourceAttr(resourceName, "kafka_cluster.0.vpc_config.0.security_groups_ids.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "kafka_cluster.1.vpc_config.0.subnet_ids.#", "3"),
+					resource.TestCheckResourceAttr(resourceName, "kafka_cluster.1.vpc_config.0.security_groups_ids.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "replication_info_list.0.target_compression_type", "NONE"),
+					resource.TestCheckResourceAttr(resourceName, "replication_info_list.0.topic_replication.0.topics_to_replicate.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "replication_info_list.0.consumer_group_replication.0.consumer_groups_to_replicate.#", "1"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+func TestAccKafkaReplicator_update(t *testing.T) {
+	ctx := acctest.Context(t)
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
+	var replicator kafka.DescribeReplicatorOutput
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	sourceCluster := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	targetCluster := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_msk_replicator.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, names.Kafka)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, names.Kafka),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckReplicatorDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccReplicatorConfig_basic(rName, sourceCluster, targetCluster),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckReplicatorExists(ctx, resourceName, &replicator),
+					resource.TestCheckResourceAttrSet(resourceName, "arn"),
+					resource.TestCheckResourceAttr(resourceName, "replicator_name", rName),
+					resource.TestCheckResourceAttr(resourceName, "description", "test-description"),
+					resource.TestCheckResourceAttr(resourceName, "kafka_cluster.#", "2"),
+					resource.TestCheckResourceAttr(resourceName, "kafka_cluster.0.vpc_config.0.subnet_ids.#", "3"),
+					resource.TestCheckResourceAttr(resourceName, "kafka_cluster.0.vpc_config.0.security_groups_ids.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "kafka_cluster.1.vpc_config.0.subnet_ids.#", "3"),
+					resource.TestCheckResourceAttr(resourceName, "kafka_cluster.1.vpc_config.0.security_groups_ids.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "replication_info_list.0.target_compression_type", "NONE"),
+					resource.TestCheckResourceAttr(resourceName, "replication_info_list.0.topic_replication.0.topics_to_replicate.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "replication_info_list.0.consumer_group_replication.0.consumer_groups_to_replicate.#", "1"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				Config: testAccReplicatorConfig_update(rName, sourceCluster, targetCluster),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckReplicatorExists(ctx, resourceName, &replicator),
+					resource.TestCheckResourceAttrSet(resourceName, "arn"),
+					resource.TestCheckResourceAttr(resourceName, "replicator_name", rName),
+					resource.TestCheckResourceAttr(resourceName, "description", "test-description"),
+					resource.TestCheckResourceAttr(resourceName, "kafka_cluster.#", "2"),
+					resource.TestCheckResourceAttr(resourceName, "kafka_cluster.0.vpc_config.0.subnet_ids.#", "3"),
+					resource.TestCheckResourceAttr(resourceName, "kafka_cluster.0.vpc_config.0.security_groups_ids.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "kafka_cluster.1.vpc_config.0.subnet_ids.#", "3"),
+					resource.TestCheckResourceAttr(resourceName, "kafka_cluster.1.vpc_config.0.security_groups_ids.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "replication_info_list.0.target_compression_type", "NONE"),
+					resource.TestCheckResourceAttr(resourceName, "replication_info_list.0.topic_replication.0.topics_to_replicate.#", "3"),
+					resource.TestCheckResourceAttr(resourceName, "replication_info_list.0.topic_replication.0.topics_to_exclude.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "replication_info_list.0.topic_replication.0.copy_topic_configurations", "false"),
+					resource.TestCheckResourceAttr(resourceName, "replication_info_list.0.topic_replication.0.copy_access_control_lists_for_topics", "false"),
+					resource.TestCheckResourceAttr(resourceName, "replication_info_list.0.topic_replication.0.detect_and_copy_new_topics", "false"),
+					resource.TestCheckResourceAttr(resourceName, "replication_info_list.0.consumer_group_replication.0.consumer_groups_to_replicate.#", "3"),
+					resource.TestCheckResourceAttr(resourceName, "replication_info_list.0.consumer_group_replication.0.consumer_groups_to_exclude.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "replication_info_list.0.consumer_group_replication.0.synchronise_consumer_group_offsets", "false"),
+					resource.TestCheckResourceAttr(resourceName, "replication_info_list.0.consumer_group_replication.0.detect_and_copy_new_consumer_groups", "false"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
+func TestAccKafkaReplicator_tags(t *testing.T) {
+	ctx := acctest.Context(t)
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
+	var replicator kafka.DescribeReplicatorOutput
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	sourceCluster := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	targetCluster := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_msk_replicator.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, names.Kafka)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, names.Kafka),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckReplicatorDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccReplicatorConfig_tags1(rName, "key1", "value1", sourceCluster, targetCluster),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckReplicatorExists(ctx, resourceName, &replicator),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				Config: testAccReplicatorConfig_tags2(rName, "key1", "value1updated", "key2", "value2", sourceCluster, targetCluster),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckReplicatorExists(ctx, resourceName, &replicator),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1updated"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
+				),
+			},
+			{
+				Config: testAccReplicatorConfig_tags1(rName, "key2", "value2", sourceCluster, targetCluster),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckReplicatorExists(ctx, resourceName, &replicator),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccKafkaReplicator_disappears(t *testing.T) {
+	ctx := acctest.Context(t)
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
+	var replicator kafka.DescribeReplicatorOutput
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	sourceCluster := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	targetCluster := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_msk_replicator.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, names.Kafka)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, names.Kafka),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckReplicatorDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccReplicatorConfig_basic(rName, sourceCluster, targetCluster),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckReplicatorExists(ctx, resourceName, &replicator),
+					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfkafka.ResourceReplicator(), resourceName),
+				),
+				ExpectNonEmptyPlan: true,
+			},
+		},
+	})
+}
+
+func testAccCheckReplicatorDestroy(ctx context.Context) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		conn := acctest.Provider.Meta().(*conns.AWSClient).KafkaClient(ctx)
+
+		for _, rs := range s.RootModule().Resources {
+			if rs.Type != "aws_msk_replicator" {
+				continue
+			}
+
+			_, err := conn.DescribeReplicator(ctx, &kafka.DescribeReplicatorInput{
+				ReplicatorArn: aws.String(rs.Primary.ID),
+			})
+			if errs.IsA[*types.NotFoundException](err) {
+				continue
+			}
+			if err != nil {
+				return err
+			}
+
+			return create.Error(names.Kafka, create.ErrActionCheckingDestroyed, tfkafka.ResNameReplicator, rs.Primary.ID, errors.New("not destroyed"))
+		}
+
+		return nil
+	}
+}
+
+func testAccCheckReplicatorExists(ctx context.Context, name string, replicator *kafka.DescribeReplicatorOutput) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[name]
+		if !ok {
+			return create.Error(names.Kafka, create.ErrActionCheckingExistence, tfkafka.ResNameReplicator, name, errors.New("not found"))
+		}
+
+		if rs.Primary.ID == "" {
+			return create.Error(names.Kafka, create.ErrActionCheckingExistence, tfkafka.ResNameReplicator, name, errors.New("not set"))
+		}
+
+		conn := acctest.Provider.Meta().(*conns.AWSClient).KafkaClient(ctx)
+		resp, err := conn.DescribeReplicator(ctx, &kafka.DescribeReplicatorInput{
+			ReplicatorArn: aws.String(rs.Primary.ID),
+		})
+
+		if err != nil {
+			return create.Error(names.Kafka, create.ErrActionCheckingExistence, tfkafka.ResNameReplicator, rs.Primary.ID, err)
+		}
+
+		*replicator = *resp
+
+		return nil
+	}
+}
+
+func testAccReplicatorConfig_source(rName string) string {
+	return acctest.ConfigCompose(
+		testAccClusterConfig_allowEveryoneNoACLFoundFalse(rName),
+		acctest.ConfigAvailableAZsNoOptIn(),
+		fmt.Sprintf(`
+data "aws_caller_identity" "current" {}
+
+resource "aws_msk_cluster" "source" {
+  cluster_name           = %[1]q
+  kafka_version          = "2.8.1"
+  number_of_broker_nodes = 3
+
+  broker_node_group_info {
+    client_subnets  = aws_subnet.source[*].id
+    instance_type   = "kafka.m5.large"
+    security_groups = [aws_security_group.source.id]
+
+    connectivity_info {
+      vpc_connectivity {
+        client_authentication {
+          sasl {
+            iam = true
+          }
+        }
+      }
+    }
+
+    storage_info {
+      ebs_storage_info {
+        volume_size = 10
+      }
+    }
+  }
+
+  configuration_info {
+    arn      = aws_msk_configuration.test.arn
+    revision = aws_msk_configuration.test.latest_revision
+  }
+
+  client_authentication {
+    sasl {
+      iam = true
+    }
+  }
+}
+
+resource "aws_msk_cluster_policy" "source" {
+  cluster_arn = aws_msk_cluster.source.arn
+
+  policy = jsonencode({
+    Version = "2012-10-17",
+    Statement = [{
+      Sid    = "testMskClusterPolicy"
+      Effect = "Allow"
+      Principal = {
+        "Service" = "kafka.amazonaws.com"
+      }
+      Action = [
+        "kafka:CreateVpcConnection",
+        "kafka:GetBootstrapBrokers",
+        "kafka:DescribeCluster",
+        "kafka:DescribeClusterV2"
+      ]
+      Resource = aws_msk_cluster.source.arn
+    }]
+  })
+
+  depends_on = [aws_msk_cluster.source]
+}
+
+resource "aws_iam_role" "source" {
+  name = "%[1]s"
+
+  assume_role_policy = jsonencode({
+    "Version" : "2012-10-17",
+    "Statement" : [
+      {
+        "Effect" : "Allow",
+        "Principal" : {
+          "Service" : "kafka.amazonaws.com"
+        },
+        "Action" : "sts:AssumeRole",
+        "Condition" : {
+          "StringEquals" : {
+            "aws:SourceAccount" : "${data.aws_caller_identity.current.account_id}"
+          }
+        }
+      }
+    ]
+  })
+}
+
+resource "aws_iam_role_policy" "source" {
+  name = %[1]q
+  role = aws_iam_role.source.name
+
+  policy = jsonencode({
+    "Version" : "2012-10-17",
+    "Statement" : [
+      {
+        "Effect" : "Allow",
+        "Resource" : "*",
+        "Action" : [
+          "kafka-cluster:Connect",
+          "kafka-cluster:DescribeCluster",
+          "kafka-cluster:AlterCluster",
+          "kafka-cluster:ReadData",
+          "kafka-cluster:WriteData",
+          "kafka-cluster:DescribeTopic",
+          "kafka-cluster:CreateTopic",
+          "kafka-cluster:AlterTopic",
+          "kafka-cluster:AlterGroup",
+          "kafka-cluster:DescribeGroup",
+          "kafka-cluster:DescribeTopicDynamicConfiguration",
+          "kafka-cluster:AlterTopicDynamicConfiguration"
+        ]
+      }
+    ]
+  })
+}
+
+resource "aws_security_group" "source" {
+  name   = %[1]q
+  vpc_id = aws_vpc.source.id
+
+  ingress {
+    from_port = 0
+    to_port   = 0
+    protocol  = -1
+    self      = true
+  }
+
+  egress {
+    from_port   = 0
+    to_port     = 0
+    protocol    = "-1"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+
+  tags = {
+    Name = %[1]q
+  }
+}
+resource "aws_vpc" "source" {
+  cidr_block = "10.0.0.0/16"
+
+  enable_dns_support   = true
+  enable_dns_hostnames = true
+
+  tags = {
+    Name = %[1]q
+  }
+}
+
+resource "aws_subnet" "source" {
+  count = 3
+
+  vpc_id            = aws_vpc.source.id
+  availability_zone = data.aws_availability_zones.available.names[count.index]
+  cidr_block        = cidrsubnet(aws_vpc.source.cidr_block, 8, count.index)
+
+  tags = {
+    Name = %[1]q
+  }
+}
+`, rName))
+}
+
+func testAccReplicatorConfig_target(rName string) string {
+	return acctest.ConfigCompose(
+		fmt.Sprintf(`
+resource "aws_msk_cluster" "target" {
+  cluster_name           = %[1]q
+  kafka_version          = "2.8.1"
+  number_of_broker_nodes = 3
+
+  broker_node_group_info {
+    client_subnets  = aws_subnet.target[*].id
+    instance_type   = "kafka.m5.large"
+    security_groups = [aws_security_group.target.id]
+
+    storage_info {
+      ebs_storage_info {
+        volume_size = 10
+      }
+    }
+  }
+  configuration_info {
+    arn      = aws_msk_configuration.test.arn
+    revision = aws_msk_configuration.test.latest_revision
+  }
+
+  client_authentication {
+    sasl {
+      iam = true
+    }
+  }
+}
+
+resource "aws_security_group" "target" {
+  name   = %[1]q
+  vpc_id = aws_vpc.target.id
+
+  ingress {
+    from_port = 0
+    to_port   = 0
+    protocol  = -1
+    self      = true
+  }
+
+  egress {
+    from_port   = 0
+    to_port     = 0
+    protocol    = "-1"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+
+  tags = {
+    Name = %[1]q
+  }
+}
+
+resource "aws_vpc" "target" {
+  cidr_block = "10.1.0.0/16"
+
+  enable_dns_support   = true
+  enable_dns_hostnames = true
+
+  tags = {
+    Name = %[1]q
+  }
+}
+
+resource "aws_subnet" "target" {
+  count = 3
+
+  vpc_id            = aws_vpc.target.id
+  availability_zone = data.aws_availability_zones.available.names[count.index]
+  cidr_block        = cidrsubnet(aws_vpc.target.cidr_block, 8, count.index)
+
+  tags = {
+    Name = %[1]q
+  }
+}
+`, rName))
+}
+
+func testAccReplicatorConfig_basic(rName, sourceCluster, targetCluster string) string {
+	return acctest.ConfigCompose(
+		testAccReplicatorConfig_source(sourceCluster),
+		testAccReplicatorConfig_target(targetCluster),
+		fmt.Sprintf(`
+resource "aws_msk_replicator" "test" {
+  replicator_name            = %[1]q
+  description                = "test-description"
+  service_execution_role_arn = aws_iam_role.source.arn
+
+  kafka_cluster {
+    amazon_msk_cluster {
+      msk_cluster_arn = aws_msk_cluster.source.arn
+    }
+
+    vpc_config {
+      subnet_ids          = aws_subnet.source[*].id
+      security_groups_ids = [aws_security_group.source.id]
+    }
+  }
+
+  kafka_cluster {
+    amazon_msk_cluster {
+      msk_cluster_arn = aws_msk_cluster.target.arn
+    }
+
+    vpc_config {
+      subnet_ids          = aws_subnet.target[*].id
+      security_groups_ids = [aws_security_group.target.id]
+    }
+  }
+
+  replication_info_list {
+    source_kafka_cluster_arn = aws_msk_cluster.source.arn
+    target_kafka_cluster_arn = aws_msk_cluster.target.arn
+    target_compression_type  = "NONE"
+
+
+    topic_replication {
+      topics_to_replicate = [".*"]
+    }
+
+    consumer_group_replication {
+      consumer_groups_to_replicate = [".*"]
+    }
+  }
+}
+`, rName, sourceCluster, targetCluster))
+}
+
+func testAccReplicatorConfig_update(rName, sourceCluster, targetCluster string) string {
+	return acctest.ConfigCompose(
+		testAccReplicatorConfig_source(sourceCluster),
+		testAccReplicatorConfig_target(targetCluster),
+		fmt.Sprintf(`
+resource "aws_msk_replicator" "test" {
+  replicator_name            = %[1]q
+  description                = "test-description"
+  service_execution_role_arn = aws_iam_role.source.arn
+
+  kafka_cluster {
+    amazon_msk_cluster {
+      msk_cluster_arn = aws_msk_cluster.source.arn
+    }
+
+    vpc_config {
+      subnet_ids          = aws_subnet.source[*].id
+      security_groups_ids = [aws_security_group.source.id]
+    }
+  }
+
+  kafka_cluster {
+    amazon_msk_cluster {
+      msk_cluster_arn = aws_msk_cluster.target.arn
+    }
+
+    vpc_config {
+      subnet_ids          = aws_subnet.target[*].id
+      security_groups_ids = [aws_security_group.target.id]
+    }
+  }
+
+  replication_info_list {
+    source_kafka_cluster_arn = aws_msk_cluster.source.arn
+    target_kafka_cluster_arn = aws_msk_cluster.target.arn
+    target_compression_type  = "NONE"
+
+    topic_replication {
+      detect_and_copy_new_topics           = false
+      copy_access_control_lists_for_topics = false
+      copy_topic_configurations            = false
+      topics_to_replicate                  = ["topic1", "topic2", "topic3"]
+      topics_to_exclude                    = ["topic-4"]
+    }
+
+    consumer_group_replication {
+      synchronise_consumer_group_offsets  = false
+      detect_and_copy_new_consumer_groups = false
+      consumer_groups_to_replicate        = ["group1", "group2", "group3"]
+      consumer_groups_to_exclude          = ["group-4"]
+    }
+  }
+}
+`, rName, sourceCluster, targetCluster))
+}
+
+func testAccReplicatorConfig_tags1(rName, tagKey1, tagValue1, sourceCluster, targetCluster string) string {
+	return acctest.ConfigCompose(
+		testAccReplicatorConfig_source(sourceCluster),
+		testAccReplicatorConfig_target(targetCluster),
+		fmt.Sprintf(`
+
+resource "aws_msk_replicator" "test" {
+  replicator_name            = %[1]q
+  description                = "test-description"
+  service_execution_role_arn = aws_iam_role.source.arn
+
+  kafka_cluster {
+    amazon_msk_cluster {
+      msk_cluster_arn = aws_msk_cluster.source.arn
+    }
+
+    vpc_config {
+      subnet_ids          = aws_subnet.source[*].id
+      security_groups_ids = [aws_security_group.source.id]
+    }
+  }
+
+  kafka_cluster {
+    amazon_msk_cluster {
+      msk_cluster_arn = aws_msk_cluster.target.arn
+    }
+
+    vpc_config {
+      subnet_ids          = aws_subnet.target[*].id
+      security_groups_ids = [aws_security_group.target.id]
+    }
+  }
+
+  replication_info_list {
+    source_kafka_cluster_arn = aws_msk_cluster.source.arn
+    target_kafka_cluster_arn = aws_msk_cluster.target.arn
+    target_compression_type  = "NONE"
+
+
+    topic_replication {
+      topics_to_replicate = [".*"]
+    }
+
+    consumer_group_replication {
+      consumer_groups_to_replicate = [".*"]
+    }
+  }
+
+  tags = {
+    %[2]q = %[3]q
+  }
+}
+`, rName, tagKey1, tagValue1, sourceCluster, targetCluster))
+}
+
+func testAccReplicatorConfig_tags2(rName, tagKey1, tagValue1, tagKey2, tagValue2, sourceCluster, targetCluster string) string {
+	return acctest.ConfigCompose(
+		testAccReplicatorConfig_source(sourceCluster),
+		testAccReplicatorConfig_target(targetCluster),
+		fmt.Sprintf(`
+resource "aws_msk_replicator" "test" {
+  replicator_name            = %[1]q
+  description                = "test-description"
+  service_execution_role_arn = aws_iam_role.source.arn
+
+  kafka_cluster {
+    amazon_msk_cluster {
+      msk_cluster_arn = aws_msk_cluster.source.arn
+    }
+
+    vpc_config {
+      subnet_ids          = aws_subnet.source[*].id
+      security_groups_ids = [aws_security_group.source.id]
+    }
+  }
+
+  kafka_cluster {
+    amazon_msk_cluster {
+      msk_cluster_arn = aws_msk_cluster.target.arn
+    }
+
+    vpc_config {
+      subnet_ids          = aws_subnet.target[*].id
+      security_groups_ids = [aws_security_group.target.id]
+    }
+  }
+
+  replication_info_list {
+    source_kafka_cluster_arn = aws_msk_cluster.source.arn
+    target_kafka_cluster_arn = aws_msk_cluster.target.arn
+    target_compression_type  = "NONE"
+
+
+    topic_replication {
+      topics_to_replicate = [".*"]
+    }
+
+    consumer_group_replication {
+      consumer_groups_to_replicate = [".*"]
+    }
+  }
+
+  tags = {
+    %[2]q = %[3]q
+    %[4]q = %[5]q
+  }
+}
+`, rName, tagKey1, tagValue1, tagKey2, tagValue2, sourceCluster, targetCluster))
+}
diff --git a/internal/service/kafka/scram_secret_association.go b/internal/service/kafka/scram_secret_association.go
index 32473402e58..537659bd16e 100644
--- a/internal/service/kafka/scram_secret_association.go
+++ b/internal/service/kafka/scram_secret_association.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kafka
 
 import (
diff --git a/internal/service/kafka/scram_secret_association_test.go b/internal/service/kafka/scram_secret_association_test.go
index e13e0dc07c8..620b219bc3c 100644
--- a/internal/service/kafka/scram_secret_association_test.go
+++ b/internal/service/kafka/scram_secret_association_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kafka_test
 
 import (
@@ -190,7 +193,7 @@ data "aws_partition" "current" {}
 
 resource "aws_msk_cluster" "test" {
   cluster_name           = %[1]q
-  kafka_version          = "2.5.1"
+  kafka_version          = "2.8.1"
   number_of_broker_nodes = 3
 
   broker_node_group_info {
diff --git a/internal/service/kafka/serverless_cluster.go b/internal/service/kafka/serverless_cluster.go
index d09509a8856..51f1dc56fe0 100644
--- a/internal/service/kafka/serverless_cluster.go
+++ b/internal/service/kafka/serverless_cluster.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kafka
 
 import (
@@ -84,6 +87,10 @@ func ResourceServerlessCluster() *schema.Resource {
 				ForceNew:     true,
 				ValidateFunc: validation.StringLenBetween(1, 64),
 			},
+			"cluster_uuid": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
 			names.AttrTags:    tftags.TagsSchema(),
 			names.AttrTagsAll: tftags.TagsSchemaComputed(),
 			"vpc_config": {
@@ -130,7 +137,6 @@ func resourceServerlessClusterCreate(ctx context.Context, d *schema.ResourceData
 		Tags: getTagsIn(ctx),
 	}
 
-	log.Printf("[DEBUG] Creating MSK Serverless Cluster: %s", input)
 	output, err := conn.CreateClusterV2WithContext(ctx, input)
 
 	if err != nil {
@@ -139,9 +145,7 @@ func resourceServerlessClusterCreate(ctx context.Context, d *schema.ResourceData
 
 	d.SetId(aws.StringValue(output.ClusterArn))
 
-	_, err = waitClusterCreated(ctx, conn, d.Id(), d.Timeout(schema.TimeoutCreate))
-
-	if err != nil {
+	if _, err := waitClusterCreated(ctx, conn, d.Id(), d.Timeout(schema.TimeoutCreate)); err != nil {
 		return diag.Errorf("waiting for MSK Serverless Cluster (%s) create: %s", d.Id(), err)
 	}
 
@@ -163,7 +167,8 @@ func resourceServerlessClusterRead(ctx context.Context, d *schema.ResourceData,
 		return diag.Errorf("reading MSK Serverless Cluster (%s): %s", d.Id(), err)
 	}
 
-	d.Set("arn", cluster.ClusterArn)
+	clusterARN := aws.StringValue(cluster.ClusterArn)
+	d.Set("arn", clusterARN)
 	if cluster.Serverless.ClientAuthentication != nil {
 		if err := d.Set("client_authentication", []interface{}{flattenServerlessClientAuthentication(cluster.Serverless.ClientAuthentication)}); err != nil {
 			return diag.Errorf("setting client_authentication: %s", err)
@@ -172,6 +177,8 @@ func resourceServerlessClusterRead(ctx context.Context, d *schema.ResourceData,
 		d.Set("client_authentication", nil)
 	}
 	d.Set("cluster_name", cluster.ClusterName)
+	clusterUUID, _ := clusterUUIDFromARN(clusterARN)
+	d.Set("cluster_uuid", clusterUUID)
 	if err := d.Set("vpc_config", flattenVpcConfigs(cluster.Serverless.VpcConfigs)); err != nil {
 		return diag.Errorf("setting vpc_config: %s", err)
 	}
diff --git a/internal/service/kafka/serverless_cluster_test.go b/internal/service/kafka/serverless_cluster_test.go
index 0dca49a1bcf..bb4cea74402 100644
--- a/internal/service/kafka/serverless_cluster_test.go
+++ b/internal/service/kafka/serverless_cluster_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kafka_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/kafka"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -32,12 +35,13 @@ func TestAccKafkaServerlessCluster_basic(t *testing.T) {
 				Config: testAccServerlessClusterConfig_basic(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckServerlessClusterExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "kafka", regexp.MustCompile(`cluster/.+$`)),
-					resource.TestCheckResourceAttr(resourceName, "cluster_name", rName),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "kafka", regexache.MustCompile(`cluster/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "client_authentication.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "client_authentication.0.sasl.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "client_authentication.0.sasl.0.iam.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "client_authentication.0.sasl.0.iam.0.enabled", "true"),
+					resource.TestCheckResourceAttr(resourceName, "cluster_name", rName),
+					resource.TestCheckResourceAttrSet(resourceName, "cluster_uuid"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 					resource.TestCheckResourceAttr(resourceName, "vpc_config.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "vpc_config.0.security_group_ids.#", "1"),
diff --git a/internal/service/kafka/service_package.go b/internal/service/kafka/service_package.go
index 0932e2d8e9e..651653a72a5 100644
--- a/internal/service/kafka/service_package.go
+++ b/internal/service/kafka/service_package.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kafka
 
 import (
diff --git a/internal/service/kafka/service_package_gen.go b/internal/service/kafka/service_package_gen.go
index 5be97a44da5..ab6c64e0ac5 100644
--- a/internal/service/kafka/service_package_gen.go
+++ b/internal/service/kafka/service_package_gen.go
@@ -5,9 +5,12 @@ package kafka
 import (
 	"context"
 
+	aws_sdkv2 "github.com/aws/aws-sdk-go-v2/aws"
+	kafka_sdkv2 "github.com/aws/aws-sdk-go-v2/service/kafka"
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	kafka_sdkv1 "github.com/aws/aws-sdk-go/service/kafka"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -40,6 +43,12 @@ func (p *servicePackage) SDKDataSources(ctx context.Context) []*types.ServicePac
 			Factory:  DataSourceVersion,
 			TypeName: "aws_msk_kafka_version",
 		},
+		{
+			Factory:  DataSourceVPCConnection,
+			TypeName: "aws_msk_vpc_connection",
+			Name:     "VPC Connection",
+			Tags:     &types.ServicePackageResourceTags{},
+		},
 	}
 }
 
@@ -53,10 +62,23 @@ func (p *servicePackage) SDKResources(ctx context.Context) []*types.ServicePacka
 				IdentifierAttribute: "id",
 			},
 		},
+		{
+			Factory:  ResourceClusterPolicy,
+			TypeName: "aws_msk_cluster_policy",
+			Name:     "Cluster Policy",
+		},
 		{
 			Factory:  ResourceConfiguration,
 			TypeName: "aws_msk_configuration",
 		},
+		{
+			Factory:  ResourceReplicator,
+			TypeName: "aws_msk_replicator",
+			Name:     "Replicator",
+			Tags: &types.ServicePackageResourceTags{
+				IdentifierAttribute: "id",
+			},
+		},
 		{
 			Factory:  ResourceScramSecretAssociation,
 			TypeName: "aws_msk_scram_secret_association",
@@ -69,6 +91,14 @@ func (p *servicePackage) SDKResources(ctx context.Context) []*types.ServicePacka
 				IdentifierAttribute: "id",
 			},
 		},
+		{
+			Factory:  ResourceVPCConnection,
+			TypeName: "aws_msk_vpc_connection",
+			Name:     "VPC Connection",
+			Tags: &types.ServicePackageResourceTags{
+				IdentifierAttribute: "id",
+			},
+		},
 	}
 }
 
@@ -83,4 +113,17 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*k
 	return kafka_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+// NewClient returns a new AWS SDK for Go v2 client for this service package's AWS API.
+func (p *servicePackage) NewClient(ctx context.Context, config map[string]any) (*kafka_sdkv2.Client, error) {
+	cfg := *(config["aws_sdkv2_config"].(*aws_sdkv2.Config))
+
+	return kafka_sdkv2.NewFromConfig(cfg, func(o *kafka_sdkv2.Options) {
+		if endpoint := config["endpoint"].(string); endpoint != "" {
+			o.BaseEndpoint = aws_sdkv2.String(endpoint)
+		}
+	}), nil
+}
+
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/kafka/sort.go b/internal/service/kafka/sort.go
index 90ac9d9158d..13c58ff41ab 100644
--- a/internal/service/kafka/sort.go
+++ b/internal/service/kafka/sort.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kafka
 
 import (
diff --git a/internal/service/kafka/sort_test.go b/internal/service/kafka/sort_test.go
index 19157a55c40..77040bd726a 100644
--- a/internal/service/kafka/sort_test.go
+++ b/internal/service/kafka/sort_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kafka_test
 
 import (
diff --git a/internal/service/kafka/status.go b/internal/service/kafka/status.go
index aa64974232d..63bc4548ba8 100644
--- a/internal/service/kafka/status.go
+++ b/internal/service/kafka/status.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kafka
 
 import (
diff --git a/internal/service/kafka/sweep.go b/internal/service/kafka/sweep.go
index d6ada6169e7..bf73e6ffb85 100644
--- a/internal/service/kafka/sweep.go
+++ b/internal/service/kafka/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package kafka
 
@@ -11,9 +11,10 @@ import (
 	"github.com/aws/aws-sdk-go/service/kafka"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_msk_cluster", &resource.Sweeper{
 		Name: "aws_msk_cluster",
 		F:    sweepClusters,
@@ -33,7 +34,7 @@ func init() {
 
 func sweepClusters(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -47,9 +48,16 @@ func sweepClusters(region string) error {
 		}
 
 		for _, v := range page.ClusterInfoList {
+			arn := aws.StringValue(v.ClusterArn)
+
+			if state := aws.StringValue(v.State); state == kafka.ClusterStateDeleting {
+				log.Printf("[INFO] Skipping MSK Cluster %s: State=%s", arn, state)
+				continue
+			}
+
 			r := ResourceCluster()
 			d := r.Data(nil)
-			d.SetId(aws.StringValue(v.ClusterArn))
+			d.SetId(arn)
 
 			sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
 		}
@@ -57,7 +65,7 @@ func sweepClusters(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping MSK Cluster sweep for %s: %s", region, err)
 		return nil
 	}
@@ -66,7 +74,7 @@ func sweepClusters(region string) error {
 		return fmt.Errorf("error listing MSK Clusters (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping MSK Clusters (%s): %w", region, err)
@@ -77,24 +85,30 @@ func sweepClusters(region string) error {
 
 func sweepConfigurations(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
 	conn := client.KafkaConn(ctx)
-
+	input := &kafka.ListConfigurationsInput{}
 	sweepResources := make([]sweep.Sweepable, 0)
 
-	input := &kafka.ListConfigurationsInput{}
 	err = conn.ListConfigurationsPagesWithContext(ctx, input, func(page *kafka.ListConfigurationsOutput, lastPage bool) bool {
 		if page == nil {
 			return !lastPage
 		}
 
 		for _, v := range page.Configurations {
+			arn := aws.StringValue(v.Arn)
+
+			if state := aws.StringValue(v.State); state == kafka.ConfigurationStateDeleting {
+				log.Printf("[INFO] Skipping MSK Configuration %s: State=%s", arn, state)
+				continue
+			}
+
 			r := ResourceConfiguration()
 			d := r.Data(nil)
-			d.SetId(aws.StringValue(v.Arn))
+			d.SetId(arn)
 
 			sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
 		}
@@ -102,7 +116,7 @@ func sweepConfigurations(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping MSK Configuration sweep for %s: %s", region, err)
 		return nil
 	}
@@ -110,7 +124,7 @@ func sweepConfigurations(region string) error {
 		return fmt.Errorf("error listing MSK Configurations (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping MSK Configurations (%s): %w", region, err)
diff --git a/internal/service/kafka/tags_gen.go b/internal/service/kafka/tags_gen.go
index 51dfb9dee76..e9f1e24be20 100644
--- a/internal/service/kafka/tags_gen.go
+++ b/internal/service/kafka/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/kafka"
 	"github.com/aws/aws-sdk-go/service/kafka/kafkaiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -21,7 +23,7 @@ func Tags(tags tftags.KeyValueTags) map[string]*string {
 	return aws.StringMap(tags.Map())
 }
 
-// KeyValueTags creates KeyValueTags from kafka service tags.
+// KeyValueTags creates tftags.KeyValueTags from kafka service tags.
 func KeyValueTags(ctx context.Context, tags map[string]*string) tftags.KeyValueTags {
 	return tftags.New(ctx, tags)
 }
@@ -52,6 +54,8 @@ func updateTags(ctx context.Context, conn kafkaiface.KafkaAPI, identifier string
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.Kafka)
 	if len(removedTags) > 0 {
diff --git a/internal/service/kafka/tagsv2_gen.go b/internal/service/kafka/tagsv2_gen.go
new file mode 100644
index 00000000000..58b43137e13
--- /dev/null
+++ b/internal/service/kafka/tagsv2_gen.go
@@ -0,0 +1,40 @@
+// Code generated by internal/generate/tags/main.go; DO NOT EDIT.
+package kafka
+
+import (
+	"context"
+
+	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
+	"github.com/hashicorp/terraform-provider-aws/internal/types"
+)
+
+// map[string]string handling
+
+// TagsV2 returns kafka service tags.
+func TagsV2(tags tftags.KeyValueTags) map[string]string {
+	return tags.Map()
+}
+
+// keyValueTagsV2 creates tftags.KeyValueTags from kafka service tags.
+func keyValueTagsV2(ctx context.Context, tags map[string]string) tftags.KeyValueTags {
+	return tftags.New(ctx, tags)
+}
+
+// getTagsInV2 returns kafka service tags from Context.
+// nil is returned if there are no input tags.
+func getTagsInV2(ctx context.Context) map[string]string {
+	if inContext, ok := tftags.FromContext(ctx); ok {
+		if tags := TagsV2(inContext.TagsIn.UnwrapOrDefault()); len(tags) > 0 {
+			return tags
+		}
+	}
+
+	return nil
+}
+
+// setTagsOutV2 sets kafka service tags in Context.
+func setTagsOutV2(ctx context.Context, tags map[string]string) {
+	if inContext, ok := tftags.FromContext(ctx); ok {
+		inContext.TagsOut = types.Some(keyValueTagsV2(ctx, tags))
+	}
+}
diff --git a/internal/service/kafka/vpc_connection.go b/internal/service/kafka/vpc_connection.go
new file mode 100644
index 00000000000..f581d63e6e6
--- /dev/null
+++ b/internal/service/kafka/vpc_connection.go
@@ -0,0 +1,240 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package kafka
+
+import (
+	"context"
+	"log"
+	"time"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/kafka"
+	"github.com/aws/aws-sdk-go-v2/service/kafka/types"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/enum"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
+	"github.com/hashicorp/terraform-provider-aws/internal/flex"
+	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/internal/verify"
+	"github.com/hashicorp/terraform-provider-aws/names"
+)
+
+// @SDKResource("aws_msk_vpc_connection", name="VPC Connection")
+// @Tags(identifierAttribute="id")
+func ResourceVPCConnection() *schema.Resource {
+	return &schema.Resource{
+		CreateWithoutTimeout: resourceVPCConnectionCreate,
+		ReadWithoutTimeout:   resourceVPCConnectionRead,
+		UpdateWithoutTimeout: resourceVPCConnectionUpdate,
+		DeleteWithoutTimeout: resourceVPCConnectionDelete,
+
+		Importer: &schema.ResourceImporter{
+			StateContext: schema.ImportStatePassthroughContext,
+		},
+
+		Schema: map[string]*schema.Schema{
+			"arn": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"authentication": {
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+			"client_subnets": {
+				Type:     schema.TypeSet,
+				Required: true,
+				ForceNew: true,
+				Elem:     &schema.Schema{Type: schema.TypeString},
+			},
+			"security_groups": {
+				Type:     schema.TypeSet,
+				Required: true,
+				ForceNew: true,
+				Elem:     &schema.Schema{Type: schema.TypeString},
+			},
+			names.AttrTags:    tftags.TagsSchema(),
+			names.AttrTagsAll: tftags.TagsSchemaComputed(),
+			"target_cluster_arn": {
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+			"vpc_id": {
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+		},
+
+		CustomizeDiff: verify.SetTagsDiff,
+	}
+}
+
+func resourceVPCConnectionCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).KafkaClient(ctx)
+
+	in := &kafka.CreateVpcConnectionInput{
+		Authentication:   aws.String(d.Get("authentication").(string)),
+		ClientSubnets:    flex.ExpandStringValueSet(d.Get("client_subnets").(*schema.Set)),
+		SecurityGroups:   flex.ExpandStringValueSet(d.Get("security_groups").(*schema.Set)),
+		Tags:             getTagsInV2(ctx),
+		TargetClusterArn: aws.String(d.Get("target_cluster_arn").(string)),
+		VpcId:            aws.String(d.Get("vpc_id").(string)),
+	}
+
+	out, err := conn.CreateVpcConnection(ctx, in)
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "creating MSK VPC Connection: %s", err)
+	}
+
+	d.SetId(aws.ToString(out.VpcConnectionArn))
+
+	if _, err := waitVPCConnectionCreated(ctx, conn, d.Id(), d.Timeout(schema.TimeoutCreate)); err != nil {
+		return sdkdiag.AppendErrorf(diags, "waiting for MSK VPC Connection (%s) create: %s", d.Id(), err)
+	}
+
+	return append(diags, resourceVPCConnectionRead(ctx, d, meta)...)
+}
+
+func resourceVPCConnectionRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).KafkaClient(ctx)
+
+	out, err := FindVPCConnectionByARN(ctx, conn, d.Id())
+
+	if !d.IsNewResource() && tfresource.NotFound(err) {
+		log.Printf("[WARN] MSK VPC Connection (%s) not found, removing from state", d.Id())
+		d.SetId("")
+		return diags
+	}
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "reading MSK VPC Connection (%s): %s", d.Id(), err)
+	}
+
+	d.Set("arn", out.VpcConnectionArn)
+	d.Set("authentication", out.Authentication)
+	d.Set("client_subnets", flex.FlattenStringValueSet(out.Subnets))
+	d.Set("security_groups", flex.FlattenStringValueSet(out.SecurityGroups))
+	d.Set("target_cluster_arn", out.TargetClusterArn)
+	d.Set("vpc_id", out.VpcId)
+
+	setTagsOutV2(ctx, out.Tags)
+
+	return diags
+}
+
+func resourceVPCConnectionUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	// Tags only.
+	return append(diags, resourceVPCConnectionRead(ctx, d, meta)...)
+}
+
+func resourceVPCConnectionDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).KafkaClient(ctx)
+
+	log.Printf("[INFO] Deleting MSK VPC Connection: %s", d.Id())
+	_, err := conn.DeleteVpcConnection(ctx, &kafka.DeleteVpcConnectionInput{
+		Arn: aws.String(d.Id()),
+	})
+
+	if errs.IsA[*types.NotFoundException](err) {
+		return diags
+	}
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "deleting MSK VPC Connection (%s): %s", d.Id(), err)
+	}
+
+	if _, err := waitVPCConnectionDeleted(ctx, conn, d.Id(), d.Timeout(schema.TimeoutDelete)); err != nil {
+		return sdkdiag.AppendErrorf(diags, "waiting for MSK VPC Connection (%s) delete: %s", d.Id(), err)
+	}
+
+	return diags
+}
+
+func waitVPCConnectionCreated(ctx context.Context, conn *kafka.Client, id string, timeout time.Duration) (*kafka.DescribeVpcConnectionOutput, error) {
+	stateConf := &retry.StateChangeConf{
+		Pending:                   enum.Slice(types.VpcConnectionStateCreating),
+		Target:                    enum.Slice(types.VpcConnectionStateAvailable),
+		Refresh:                   statusVPCConnection(ctx, conn, id),
+		Timeout:                   timeout,
+		NotFoundChecks:            20,
+		ContinuousTargetOccurence: 2,
+	}
+
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+	if out, ok := outputRaw.(*kafka.DescribeVpcConnectionOutput); ok {
+		return out, err
+	}
+
+	return nil, err
+}
+
+func waitVPCConnectionDeleted(ctx context.Context, conn *kafka.Client, arn string, timeout time.Duration) (*kafka.DescribeVpcConnectionOutput, error) {
+	stateConf := &retry.StateChangeConf{
+		Pending: enum.Slice(types.VpcConnectionStateAvailable, types.VpcConnectionStateInactive, types.VpcConnectionStateDeactivating, types.VpcConnectionStateDeleting),
+		Target:  []string{},
+		Refresh: statusVPCConnection(ctx, conn, arn),
+		Timeout: timeout,
+	}
+
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+	if out, ok := outputRaw.(*kafka.DescribeVpcConnectionOutput); ok {
+		return out, err
+	}
+
+	return nil, err
+}
+
+func statusVPCConnection(ctx context.Context, conn *kafka.Client, arn string) retry.StateRefreshFunc {
+	return func() (interface{}, string, error) {
+		out, err := FindVPCConnectionByARN(ctx, conn, arn)
+
+		if tfresource.NotFound(err) {
+			return nil, "", nil
+		}
+
+		if err != nil {
+			return nil, "", err
+		}
+
+		return out, string(out.State), nil
+	}
+}
+
+func FindVPCConnectionByARN(ctx context.Context, conn *kafka.Client, arn string) (*kafka.DescribeVpcConnectionOutput, error) {
+	in := &kafka.DescribeVpcConnectionInput{
+		Arn: aws.String(arn),
+	}
+
+	out, err := conn.DescribeVpcConnection(ctx, in)
+
+	if errs.IsA[*types.NotFoundException](err) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: in,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	if out == nil {
+		return nil, tfresource.NewEmptyResultError(in)
+	}
+
+	return out, nil
+}
diff --git a/internal/service/kafka/vpc_connection_data_source.go b/internal/service/kafka/vpc_connection_data_source.go
new file mode 100644
index 00000000000..5c803e21959
--- /dev/null
+++ b/internal/service/kafka/vpc_connection_data_source.go
@@ -0,0 +1,79 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package kafka
+
+import (
+	"context"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
+	"github.com/hashicorp/terraform-provider-aws/internal/flex"
+	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
+	"github.com/hashicorp/terraform-provider-aws/names"
+)
+
+// @SDKDataSource("aws_msk_vpc_connection", name="VPC Connection")
+// @Tags
+func DataSourceVPCConnection() *schema.Resource {
+	return &schema.Resource{
+		ReadWithoutTimeout: dataSourceVPCConnectionRead,
+
+		Schema: map[string]*schema.Schema{
+			"arn": {
+				Type:     schema.TypeString,
+				Required: true,
+			},
+			"authentication": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"client_subnets": {
+				Type:     schema.TypeSet,
+				Computed: true,
+				Elem:     &schema.Schema{Type: schema.TypeString},
+			},
+			"security_groups": {
+				Type:     schema.TypeSet,
+				Computed: true,
+				Elem:     &schema.Schema{Type: schema.TypeString},
+			},
+			names.AttrTags: tftags.TagsSchemaComputed(),
+			"target_cluster_arn": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"vpc_id": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+		},
+	}
+}
+
+func dataSourceVPCConnectionRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).KafkaClient(ctx)
+
+	arn := d.Get("arn").(string)
+	out, err := FindVPCConnectionByARN(ctx, conn, arn)
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "reading MSK VPC Connection (%s): %s", arn, err)
+	}
+
+	d.SetId(aws.ToString(out.VpcConnectionArn))
+	d.Set("arn", out.VpcConnectionArn)
+	d.Set("authentication", out.Authentication)
+	d.Set("client_subnets", flex.FlattenStringValueSet(out.Subnets))
+	d.Set("security_groups", flex.FlattenStringValueSet(out.SecurityGroups))
+	d.Set("target_cluster_arn", out.TargetClusterArn)
+	d.Set("vpc_id", out.VpcId)
+
+	setTagsOutV2(ctx, out.Tags)
+
+	return diags
+}
diff --git a/internal/service/kafka/vpc_connection_data_source_test.go b/internal/service/kafka/vpc_connection_data_source_test.go
new file mode 100644
index 00000000000..1cb4efc1924
--- /dev/null
+++ b/internal/service/kafka/vpc_connection_data_source_test.go
@@ -0,0 +1,52 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package kafka_test
+
+import (
+	"testing"
+
+	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
+	"github.com/hashicorp/terraform-provider-aws/names"
+)
+
+func TestAccKafkaVPCConnectionDataSource_basic(t *testing.T) {
+	ctx := acctest.Context(t)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	dataSourceName := "data.aws_msk_vpc_connection.test"
+	resourceName := "aws_msk_vpc_connection.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, names.Kafka)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, names.Kafka),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccVPCConnectionDataSourceConfig_basic(rName),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttrPair(dataSourceName, "arn", resourceName, "arn"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "authentication", resourceName, "authentication"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "client_subnets.#", resourceName, "client_subnets.#"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "security_groups.#", resourceName, "security_groups.#"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "tags.% ", resourceName, "tags.%"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "target_cluster_arn", resourceName, "target_cluster_arn"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "vpc_id", resourceName, "vpc_id"),
+				),
+			},
+		},
+	})
+}
+
+func testAccVPCConnectionDataSourceConfig_basic(rName string) string {
+	return acctest.ConfigCompose(testAccVPCConnectionConfig_basic(rName), `
+data "aws_msk_vpc_connection" "test" {
+  arn = aws_msk_vpc_connection.test.arn
+}
+`)
+}
diff --git a/internal/service/kafka/vpc_connection_test.go b/internal/service/kafka/vpc_connection_test.go
new file mode 100644
index 00000000000..110a89af141
--- /dev/null
+++ b/internal/service/kafka/vpc_connection_test.go
@@ -0,0 +1,315 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package kafka_test
+
+import (
+	"context"
+	"fmt"
+	"testing"
+
+	"github.com/aws/aws-sdk-go-v2/service/kafka"
+	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
+	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	tfkafka "github.com/hashicorp/terraform-provider-aws/internal/service/kafka"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/names"
+)
+
+func TestAccKafkaVPCConnection_basic(t *testing.T) {
+	ctx := acctest.Context(t)
+	var v kafka.DescribeVpcConnectionOutput
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_msk_vpc_connection.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, names.Kafka),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckVPCConnectionDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccVPCConnectionConfig_basic(rName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckVPCConnectionExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttrSet(resourceName, "arn"),
+					resource.TestCheckResourceAttr(resourceName, "authentication", "SASL_IAM"),
+					resource.TestCheckResourceAttr(resourceName, "client_subnets.#", "3"),
+					resource.TestCheckResourceAttr(resourceName, "security_groups.#", "2"),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
+func TestAccKafkaVPCConnection_tags(t *testing.T) {
+	ctx := acctest.Context(t)
+	var v kafka.DescribeVpcConnectionOutput
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_msk_vpc_connection.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, names.Kafka),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckVPCConnectionDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccVPCConnectionConfig_tags1(rName, "key1", "value1"),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckVPCConnectionExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				Config: testAccVPCConnectionConfig_tags2(rName, "key1", "value1updated", "key2", "value2"),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckVPCConnectionExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1updated"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
+				),
+			},
+			{
+				Config: testAccVPCConnectionConfig_tags1(rName, "key2", "value2"),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckVPCConnectionExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccKafkaVPCConnection_disappears(t *testing.T) {
+	ctx := acctest.Context(t)
+	var v kafka.DescribeVpcConnectionOutput
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_msk_vpc_connection.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, names.Kafka),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckConfigurationDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccVPCConnectionConfig_basic(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckVPCConnectionExists(ctx, resourceName, &v),
+					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfkafka.ResourceVPCConnection(), resourceName),
+				),
+				ExpectNonEmptyPlan: true,
+			},
+		},
+	})
+}
+
+func testAccCheckVPCConnectionDestroy(ctx context.Context) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		conn := acctest.Provider.Meta().(*conns.AWSClient).KafkaClient(ctx)
+
+		for _, rs := range s.RootModule().Resources {
+			if rs.Type != "aws_msk_vpc_connection" {
+				continue
+			}
+
+			_, err := tfkafka.FindVPCConnectionByARN(ctx, conn, rs.Primary.ID)
+
+			if tfresource.NotFound(err) {
+				continue
+			}
+
+			if err != nil {
+				return err
+			}
+
+			return fmt.Errorf("MSK VPC Connection %s still exists", rs.Primary.ID)
+		}
+
+		return nil
+	}
+}
+func testAccCheckVPCConnectionExists(ctx context.Context, n string, v *kafka.DescribeVpcConnectionOutput) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		conn := acctest.Provider.Meta().(*conns.AWSClient).KafkaClient(ctx)
+
+		output, err := tfkafka.FindVPCConnectionByARN(ctx, conn, rs.Primary.ID)
+
+		if err != nil {
+			return err
+		}
+
+		*v = *output
+
+		return nil
+	}
+}
+
+func testAccVPCConnectionConfig_base(rName string) string {
+	return acctest.ConfigCompose(
+		testAccClusterConfig_base(rName),
+		testAccClusterConfig_allowEveryoneNoACLFoundFalse(rName),
+		fmt.Sprintf(`
+resource "aws_msk_cluster" "test" {
+  cluster_name           = %[1]q
+  kafka_version          = "2.8.1"
+  number_of_broker_nodes = 3
+
+  broker_node_group_info {
+    client_subnets  = aws_subnet.test[*].id
+    instance_type   = "kafka.m5.large"
+    security_groups = [aws_security_group.test.id]
+
+    connectivity_info {
+      vpc_connectivity {
+        client_authentication {
+          sasl {
+            iam = true
+          }
+        }
+      }
+    }
+
+    storage_info {
+      ebs_storage_info {
+        volume_size = 10
+      }
+    }
+  }
+
+  configuration_info {
+    arn      = aws_msk_configuration.test.arn
+    revision = aws_msk_configuration.test.latest_revision
+  }
+
+  client_authentication {
+    sasl {
+      iam = true
+    }
+  }
+}
+
+resource "aws_vpc" "client" {
+  cidr_block = "10.0.0.0/16"
+
+  enable_dns_support   = true
+  enable_dns_hostnames = true
+
+  tags = {
+    Name = %[1]q
+  }
+}
+
+resource "aws_subnet" "client" {
+  count = 3
+
+  vpc_id            = aws_vpc.client.id
+  availability_zone = data.aws_availability_zones.available.names[count.index]
+  cidr_block        = cidrsubnet(aws_vpc.client.cidr_block, 8, count.index)
+
+  tags = {
+    Name = %[1]q
+  }
+}
+`, rName))
+}
+
+func testAccVPCConnectionConfig_basic(rName string) string {
+	return acctest.ConfigCompose(testAccVPCConnectionConfig_base(rName), fmt.Sprintf(`
+resource "aws_security_group" "client" {
+  count = 2
+
+  name   = "%[1]s-${count.index}"
+  vpc_id = aws_vpc.client.id
+
+  tags = {
+    Name = %[1]q
+  }
+}
+
+resource "aws_msk_vpc_connection" "test" {
+  authentication     = "SASL_IAM"
+  target_cluster_arn = aws_msk_cluster.test.arn
+  vpc_id             = aws_vpc.client.id
+  client_subnets     = aws_subnet.client[*].id
+  security_groups    = aws_security_group.client[*].id
+}
+`, rName))
+}
+
+func testAccVPCConnectionConfig_tags1(rName, tagKey1, tagValue1 string) string {
+	return acctest.ConfigCompose(testAccVPCConnectionConfig_base(rName), fmt.Sprintf(`
+resource "aws_security_group" "client" {
+  count = 2
+
+  name   = "%[1]s-${count.index}"
+  vpc_id = aws_vpc.client.id
+
+  tags = {
+    Name = %[1]q
+  }
+}
+
+resource "aws_msk_vpc_connection" "test" {
+  authentication     = "SASL_IAM"
+  target_cluster_arn = aws_msk_cluster.test.arn
+  vpc_id             = aws_vpc.client.id
+  client_subnets     = aws_subnet.client[*].id
+  security_groups    = aws_security_group.client[*].id
+
+  tags = {
+    %[2]q = %[3]q
+  }
+}
+`, rName, tagKey1, tagValue1))
+}
+
+func testAccVPCConnectionConfig_tags2(rName, tagKey1, tagValue1, tagKey2, tagValue2 string) string {
+	return acctest.ConfigCompose(testAccVPCConnectionConfig_base(rName), fmt.Sprintf(`
+resource "aws_security_group" "client" {
+  count = 2
+
+  name   = "%[1]s-${count.index}"
+  vpc_id = aws_vpc.client.id
+
+  tags = {
+    Name = %[1]q
+  }
+}
+
+resource "aws_msk_vpc_connection" "test" {
+  authentication     = "SASL_IAM"
+  target_cluster_arn = aws_msk_cluster.test.arn
+  vpc_id             = aws_vpc.client.id
+  client_subnets     = aws_subnet.client[*].id
+  security_groups    = aws_security_group.client[*].id
+
+  tags = {
+    %[2]q = %[3]q
+    %[4]q = %[5]q
+  }
+}
+`, rName, tagKey1, tagValue1, tagKey2, tagValue2))
+}
diff --git a/internal/service/kafka/wait.go b/internal/service/kafka/wait.go
index 7dd881a38ce..350db152a3e 100644
--- a/internal/service/kafka/wait.go
+++ b/internal/service/kafka/wait.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kafka
 
 import (
@@ -15,7 +18,7 @@ const (
 	configurationDeletedTimeout = 5 * time.Minute
 )
 
-func waitClusterCreated(ctx context.Context, conn *kafka.Kafka, arn string, timeout time.Duration) (*kafka.ClusterInfo, error) { //nolint:unparam
+func waitClusterCreated(ctx context.Context, conn *kafka.Kafka, arn string, timeout time.Duration) (*kafka.Cluster, error) {
 	stateConf := &retry.StateChangeConf{
 		Pending: []string{kafka.ClusterStateCreating},
 		Target:  []string{kafka.ClusterStateActive},
@@ -25,7 +28,7 @@ func waitClusterCreated(ctx context.Context, conn *kafka.Kafka, arn string, time
 
 	outputRaw, err := stateConf.WaitForStateContext(ctx)
 
-	if output, ok := outputRaw.(*kafka.ClusterInfo); ok {
+	if output, ok := outputRaw.(*kafka.Cluster); ok {
 		if state, stateInfo := aws.StringValue(output.State), output.StateInfo; state == kafka.ClusterStateFailed && stateInfo != nil {
 			tfresource.SetLastError(err, fmt.Errorf("%s: %s", aws.StringValue(stateInfo.Code), aws.StringValue(stateInfo.Message)))
 		}
@@ -36,7 +39,7 @@ func waitClusterCreated(ctx context.Context, conn *kafka.Kafka, arn string, time
 	return nil, err
 }
 
-func waitClusterDeleted(ctx context.Context, conn *kafka.Kafka, arn string, timeout time.Duration) (*kafka.ClusterInfo, error) {
+func waitClusterDeleted(ctx context.Context, conn *kafka.Kafka, arn string, timeout time.Duration) (*kafka.Cluster, error) {
 	stateConf := &retry.StateChangeConf{
 		Pending: []string{kafka.ClusterStateDeleting},
 		Target:  []string{},
@@ -46,7 +49,7 @@ func waitClusterDeleted(ctx context.Context, conn *kafka.Kafka, arn string, time
 
 	outputRaw, err := stateConf.WaitForStateContext(ctx)
 
-	if output, ok := outputRaw.(*kafka.ClusterInfo); ok {
+	if output, ok := outputRaw.(*kafka.Cluster); ok {
 		if state, stateInfo := aws.StringValue(output.State), output.StateInfo; state == kafka.ClusterStateFailed && stateInfo != nil {
 			tfresource.SetLastError(err, fmt.Errorf("%s: %s", aws.StringValue(stateInfo.Code), aws.StringValue(stateInfo.Message)))
 		}
diff --git a/internal/service/kafkaconnect/connector.go b/internal/service/kafkaconnect/connector.go
index 6e31889b243..d89f27af858 100644
--- a/internal/service/kafkaconnect/connector.go
+++ b/internal/service/kafkaconnect/connector.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kafkaconnect
 
 import (
diff --git a/internal/service/kafkaconnect/connector_data_source.go b/internal/service/kafkaconnect/connector_data_source.go
index 369343fff0d..1fc0119027a 100644
--- a/internal/service/kafkaconnect/connector_data_source.go
+++ b/internal/service/kafkaconnect/connector_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kafkaconnect
 
 import (
diff --git a/internal/service/kafkaconnect/connector_data_source_test.go b/internal/service/kafkaconnect/connector_data_source_test.go
index 27b71c45d62..8735be1a9fd 100644
--- a/internal/service/kafkaconnect/connector_data_source_test.go
+++ b/internal/service/kafkaconnect/connector_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kafkaconnect_test
 
 import (
diff --git a/internal/service/kafkaconnect/connector_test.go b/internal/service/kafkaconnect/connector_test.go
index eb77580a9f0..d129cfb683c 100644
--- a/internal/service/kafkaconnect/connector_test.go
+++ b/internal/service/kafkaconnect/connector_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kafkaconnect_test
 
 import (
diff --git a/internal/service/kafkaconnect/custom_plugin.go b/internal/service/kafkaconnect/custom_plugin.go
index 964386d2772..3a9bde28808 100644
--- a/internal/service/kafkaconnect/custom_plugin.go
+++ b/internal/service/kafkaconnect/custom_plugin.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kafkaconnect
 
 import (
diff --git a/internal/service/kafkaconnect/custom_plugin_data_source.go b/internal/service/kafkaconnect/custom_plugin_data_source.go
index c3f04ccfc0f..6adf69b76b6 100644
--- a/internal/service/kafkaconnect/custom_plugin_data_source.go
+++ b/internal/service/kafkaconnect/custom_plugin_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kafkaconnect
 
 import (
diff --git a/internal/service/kafkaconnect/custom_plugin_data_source_test.go b/internal/service/kafkaconnect/custom_plugin_data_source_test.go
index 04bf587ef07..a1d7b98ee99 100644
--- a/internal/service/kafkaconnect/custom_plugin_data_source_test.go
+++ b/internal/service/kafkaconnect/custom_plugin_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kafkaconnect_test
 
 import (
diff --git a/internal/service/kafkaconnect/custom_plugin_test.go b/internal/service/kafkaconnect/custom_plugin_test.go
index f91cf2558db..df012cbe2f6 100644
--- a/internal/service/kafkaconnect/custom_plugin_test.go
+++ b/internal/service/kafkaconnect/custom_plugin_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kafkaconnect_test
 
 import (
@@ -181,13 +184,8 @@ resource "aws_s3_bucket" "test" {
   force_destroy = true
 }
 
-resource "aws_s3_bucket_acl" "test" {
-  bucket = aws_s3_bucket.test.id
-  acl    = "private"
-}
-
 resource "aws_s3_bucket_versioning" "test" {
-  bucket = aws_s3_bucket_acl.test.bucket
+  bucket = aws_s3_bucket.test.bucket
 
   versioning_configuration {
     status = %[2]t ? "Enabled" : "Suspended"
diff --git a/internal/service/kafkaconnect/find.go b/internal/service/kafkaconnect/find.go
index 42dfbe39497..52cab9333a0 100644
--- a/internal/service/kafkaconnect/find.go
+++ b/internal/service/kafkaconnect/find.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kafkaconnect
 
 import (
diff --git a/internal/service/kafkaconnect/generate.go b/internal/service/kafkaconnect/generate.go
index 39c7bf64a0e..aeb7bedb679 100644
--- a/internal/service/kafkaconnect/generate.go
+++ b/internal/service/kafkaconnect/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
 
diff --git a/internal/service/kafkaconnect/service_package_gen.go b/internal/service/kafkaconnect/service_package_gen.go
index 327b05a6e65..43e36b2f4e1 100644
--- a/internal/service/kafkaconnect/service_package_gen.go
+++ b/internal/service/kafkaconnect/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	kafkaconnect_sdkv1 "github.com/aws/aws-sdk-go/service/kafkaconnect"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -67,4 +68,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*k
 	return kafkaconnect_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/kafkaconnect/status.go b/internal/service/kafkaconnect/status.go
index de025fa1b3f..acb2f5e6596 100644
--- a/internal/service/kafkaconnect/status.go
+++ b/internal/service/kafkaconnect/status.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kafkaconnect
 
 import (
diff --git a/internal/service/kafkaconnect/sweep.go b/internal/service/kafkaconnect/sweep.go
index 90acf2b4e32..37214bf32cc 100644
--- a/internal/service/kafkaconnect/sweep.go
+++ b/internal/service/kafkaconnect/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package kafkaconnect
 
@@ -11,9 +11,10 @@ import (
 	"github.com/aws/aws-sdk-go/service/kafkaconnect"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_mskconnect_connector", &resource.Sweeper{
 		Name: "aws_mskconnect_connector",
 		F:    sweepConnectors,
@@ -30,7 +31,7 @@ func init() {
 
 func sweepConnectors(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -54,7 +55,7 @@ func sweepConnectors(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping MSK Connect Connector sweep for %s: %s", region, err)
 		return nil
 	}
@@ -63,7 +64,7 @@ func sweepConnectors(region string) error {
 		return fmt.Errorf("error listing MSK Connect Connectors (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping MSK Connect Connectors (%s): %w", region, err)
@@ -74,7 +75,7 @@ func sweepConnectors(region string) error {
 
 func sweepCustomPlugins(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -98,7 +99,7 @@ func sweepCustomPlugins(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping MSK Connect Custom Plugin sweep for %s: %s", region, err)
 		return nil
 	}
@@ -107,7 +108,7 @@ func sweepCustomPlugins(region string) error {
 		return fmt.Errorf("error listing MSK Connect Custom Plugins (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping MSK Connect Custom Plugins (%s): %w", region, err)
diff --git a/internal/service/kafkaconnect/wait.go b/internal/service/kafkaconnect/wait.go
index 6e843d77327..944a30c5c44 100644
--- a/internal/service/kafkaconnect/wait.go
+++ b/internal/service/kafkaconnect/wait.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kafkaconnect
 
 import (
diff --git a/internal/service/kafkaconnect/worker_configuration.go b/internal/service/kafkaconnect/worker_configuration.go
index 1cd3683dbc9..6cd3b4abc65 100644
--- a/internal/service/kafkaconnect/worker_configuration.go
+++ b/internal/service/kafkaconnect/worker_configuration.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kafkaconnect
 
 import (
diff --git a/internal/service/kafkaconnect/worker_configuration_data_source.go b/internal/service/kafkaconnect/worker_configuration_data_source.go
index cf3ea792bd8..c12ed01a76c 100644
--- a/internal/service/kafkaconnect/worker_configuration_data_source.go
+++ b/internal/service/kafkaconnect/worker_configuration_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kafkaconnect
 
 import (
diff --git a/internal/service/kafkaconnect/worker_configuration_data_source_test.go b/internal/service/kafkaconnect/worker_configuration_data_source_test.go
index d40dc97c459..4d015d8fa58 100644
--- a/internal/service/kafkaconnect/worker_configuration_data_source_test.go
+++ b/internal/service/kafkaconnect/worker_configuration_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kafkaconnect_test
 
 import (
diff --git a/internal/service/kafkaconnect/worker_configuration_test.go b/internal/service/kafkaconnect/worker_configuration_test.go
index e9069a1b2e1..69a95721ec5 100644
--- a/internal/service/kafkaconnect/worker_configuration_test.go
+++ b/internal/service/kafkaconnect/worker_configuration_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kafkaconnect_test
 
 import (
diff --git a/internal/service/kendra/data_source.go b/internal/service/kendra/data_source.go
index fd9ba14223b..70a98fad700 100644
--- a/internal/service/kendra/data_source.go
+++ b/internal/service/kendra/data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kendra
 
 import (
@@ -5,10 +8,10 @@ import (
 	"errors"
 	"fmt"
 	"log"
-	"regexp"
 	"strings"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/aws/arn"
 	"github.com/aws/aws-sdk-go-v2/service/kendra"
@@ -106,7 +109,7 @@ func ResourceDataSource() *schema.Resource {
 										ValidateFunc: validation.All(
 											validation.StringLenBetween(3, 63),
 											validation.StringMatch(
-												regexp.MustCompile(`[a-z0-9][\.\-a-z0-9]{1,61}[a-z0-9]`),
+												regexache.MustCompile(`[0-9a-z][0-9a-z.-]{1,61}[0-9a-z]`),
 												"Must be a valid bucket name",
 											),
 										),
@@ -287,7 +290,7 @@ func ResourceDataSource() *schema.Resource {
 																	Type: schema.TypeString,
 																	ValidateFunc: validation.All(
 																		validation.StringLenBetween(1, 2048),
-																		validation.StringMatch(regexp.MustCompile(`^(https?):\/\/([^\s]*)`), "must provide a valid url"),
+																		validation.StringMatch(regexache.MustCompile(`^(https?):\/\/([^\s]*)`), "must provide a valid url"),
 																	),
 																},
 															},
@@ -314,7 +317,7 @@ func ResourceDataSource() *schema.Resource {
 																	Type: schema.TypeString,
 																	ValidateFunc: validation.All(
 																		validation.StringLenBetween(1, 2048),
-																		validation.StringMatch(regexp.MustCompile(`^(https?):\/\/([^\s]*)`), "must provide a valid url"),
+																		validation.StringMatch(regexache.MustCompile(`^(https?):\/\/([^\s]*)`), "must provide a valid url"),
 																	),
 																},
 															},
@@ -363,7 +366,7 @@ func ResourceDataSource() *schema.Resource {
 													ValidateFunc: validation.All(
 														validation.StringLenBetween(1, 200),
 														validation.StringMatch(
-															regexp.MustCompile(`[a-zA-Z0-9_][a-zA-Z0-9_-]*`),
+															regexache.MustCompile(`[0-9A-Za-z_][0-9A-Za-z_-]*`),
 															"Starts with an alphanumeric character or underscore. Subsequently, can contain alphanumeric characters, underscores and hyphens.",
 														),
 													),
@@ -420,7 +423,7 @@ func ResourceDataSource() *schema.Resource {
 				Required: true,
 				ForceNew: true,
 				ValidateFunc: validation.StringMatch(
-					regexp.MustCompile(`[a-zA-Z0-9][a-zA-Z0-9-]{35}`),
+					regexache.MustCompile(`[0-9A-Za-z][0-9A-Za-z-]{35}`),
 					"Starts with an alphanumeric character. Subsequently, can contain alphanumeric characters and hyphens. Fixed length of 36.",
 				),
 			},
@@ -431,7 +434,7 @@ func ResourceDataSource() *schema.Resource {
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(2, 10),
 					validation.StringMatch(
-						regexp.MustCompile(`[a-zA-Z-]*`),
+						regexache.MustCompile(`[A-Za-z-]*`),
 						"Must have alphanumeric characters or hyphens.",
 					),
 				),
@@ -442,7 +445,7 @@ func ResourceDataSource() *schema.Resource {
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 1000),
 					validation.StringMatch(
-						regexp.MustCompile(`[a-zA-Z0-9][a-zA-Z0-9_-]*`),
+						regexache.MustCompile(`[0-9A-Za-z][0-9A-Za-z_-]*`),
 						"Starts with an alphanumeric character. Subsequently, the name must consist of alphanumerics, hyphens or underscores.",
 					),
 				),
@@ -499,7 +502,7 @@ func hookConfigurationSchema() *schema.Schema {
 					ValidateFunc: validation.All(
 						validation.StringLenBetween(3, 63),
 						validation.StringMatch(
-							regexp.MustCompile(`[a-z0-9][\.\-a-z0-9]{1,61}[a-z0-9]`),
+							regexache.MustCompile(`[0-9a-z][0-9a-z.-]{1,61}[0-9a-z]`),
 							"Must be a valid bucket name",
 						),
 					),
@@ -522,7 +525,7 @@ func documentAttributeConditionSchema() *schema.Schema {
 					ValidateFunc: validation.All(
 						validation.StringLenBetween(1, 200),
 						validation.StringMatch(
-							regexp.MustCompile(`[a-zA-Z0-9_][a-zA-Z0-9_-]*`),
+							regexache.MustCompile(`[0-9A-Za-z_][0-9A-Za-z_-]*`),
 							"Starts with an alphanumeric character or underscore. Subsequently, can contain alphanumeric characters, underscores and hyphens.",
 						),
 					),
diff --git a/internal/service/kendra/data_source_test.go b/internal/service/kendra/data_source_test.go
index 7b3b0e8507c..de146c6c73f 100644
--- a/internal/service/kendra/data_source_test.go
+++ b/internal/service/kendra/data_source_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kendra_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"strconv"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/service/kendra/types"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -40,7 +43,7 @@ func TestAccKendraDataSource_basic(t *testing.T) {
 				Config: testAccDataSourceConfig_basic(rName, rName2, rName3, rName4),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDataSourceExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "kendra", regexp.MustCompile(`index/.+/data-source/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "kendra", regexache.MustCompile(`index/.+/data-source/.+$`)),
 					resource.TestCheckResourceAttrSet(resourceName, "created_at"),
 					resource.TestCheckResourceAttrPair(resourceName, "index_id", "aws_kendra_index.test", "id"),
 					resource.TestCheckResourceAttr(resourceName, "language_code", "en"),
@@ -155,7 +158,7 @@ func TestAccKendraDataSource_description(t *testing.T) {
 				Config: testAccDataSourceConfig_description(rName, rName2, rName3, rName4, originalDescription),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDataSourceExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "kendra", regexp.MustCompile(`index/.+/data-source/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "kendra", regexache.MustCompile(`index/.+/data-source/.+$`)),
 					resource.TestCheckResourceAttrSet(resourceName, "created_at"),
 					resource.TestCheckResourceAttr(resourceName, "description", originalDescription),
 					resource.TestCheckResourceAttrPair(resourceName, "index_id", "aws_kendra_index.test", "id"),
@@ -175,7 +178,7 @@ func TestAccKendraDataSource_description(t *testing.T) {
 				Config: testAccDataSourceConfig_description(rName, rName2, rName3, rName4, updatedDescription),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDataSourceExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "kendra", regexp.MustCompile(`index/.+/data-source/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "kendra", regexache.MustCompile(`index/.+/data-source/.+$`)),
 					resource.TestCheckResourceAttrSet(resourceName, "created_at"),
 					resource.TestCheckResourceAttr(resourceName, "description", updatedDescription),
 					resource.TestCheckResourceAttrPair(resourceName, "index_id", "aws_kendra_index.test", "id"),
@@ -398,15 +401,15 @@ func TestAccKendraDataSource_typeCustomCustomizeDiff(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccDataSourceConfig_typeCustomConflictRoleARN(rName, rName2, rName3, rName4, rName5),
-				ExpectError: regexp.MustCompile(`role_arn must not be set when type is CUSTOM`),
+				ExpectError: regexache.MustCompile(`role_arn must not be set when type is CUSTOM`),
 			},
 			{
 				Config:      testAccDataSourceConfig_typeCustomConflictConfiguration(rName, rName2, rName3, rName4, rName5),
-				ExpectError: regexp.MustCompile(`configuration must not be set when type is CUSTOM`),
+				ExpectError: regexache.MustCompile(`configuration must not be set when type is CUSTOM`),
 			},
 			{
 				Config:      testAccDataSourceConfig_typeCustomConflictSchedule(rName, rName2, rName3, rName4, rName5),
-				ExpectError: regexp.MustCompile(`schedule must not be set when type is CUSTOM`),
+				ExpectError: regexache.MustCompile(`schedule must not be set when type is CUSTOM`),
 			},
 		},
 	})
diff --git a/internal/service/kendra/experience.go b/internal/service/kendra/experience.go
index c2b4e2f6d7c..9cd77086686 100644
--- a/internal/service/kendra/experience.go
+++ b/internal/service/kendra/experience.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kendra
 
 import (
@@ -5,9 +8,9 @@ import (
 	"errors"
 	"fmt"
 	"log"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/aws/arn"
 	"github.com/aws/aws-sdk-go-v2/service/kendra"
@@ -72,7 +75,7 @@ func ResourceExperience() *schema.Resource {
 										MaxItems: 100,
 										Elem: &schema.Schema{
 											Type:         schema.TypeString,
-											ValidateFunc: validation.StringMatch(regexp.MustCompile(`[a-zA-Z0-9][a-zA-Z0-9_\-]*`), ""),
+											ValidateFunc: validation.StringMatch(regexache.MustCompile(`[0-9A-Za-z][0-9A-Za-z_-]*`), ""),
 										},
 									},
 									"direct_put_content": {
@@ -87,7 +90,7 @@ func ResourceExperience() *schema.Resource {
 										MaxItems: 100,
 										Elem: &schema.Schema{
 											Type:         schema.TypeString,
-											ValidateFunc: validation.StringMatch(regexp.MustCompile(`[a-zA-Z0-9][a-zA-Z0-9_\-]*`), ""),
+											ValidateFunc: validation.StringMatch(regexache.MustCompile(`[0-9A-Za-z][0-9A-Za-z_-]*`), ""),
 										},
 									},
 								},
@@ -106,7 +109,7 @@ func ResourceExperience() *schema.Resource {
 									"identity_attribute_name": {
 										Type:         schema.TypeString,
 										Required:     true,
-										ValidateFunc: validation.StringMatch(regexp.MustCompile(`[a-zA-Z0-9][a-zA-Z0-9_\-]*`), ""),
+										ValidateFunc: validation.StringMatch(regexache.MustCompile(`[0-9A-Za-z][0-9A-Za-z_-]*`), ""),
 									},
 								},
 							},
@@ -143,14 +146,14 @@ func ResourceExperience() *schema.Resource {
 				Type:         schema.TypeString,
 				Required:     true,
 				ForceNew:     true,
-				ValidateFunc: validation.StringMatch(regexp.MustCompile(`[a-zA-Z0-9][a-zA-Z0-9-]*`), ""),
+				ValidateFunc: validation.StringMatch(regexache.MustCompile(`[0-9A-Za-z][0-9A-Za-z-]*`), ""),
 			},
 			"name": {
 				Type:     schema.TypeString,
 				Required: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 1000),
-					validation.StringMatch(regexp.MustCompile(`[a-zA-Z0-9][a-zA-Z0-9_\-]*`), ""),
+					validation.StringMatch(regexache.MustCompile(`[0-9A-Za-z][0-9A-Za-z_-]*`), ""),
 				),
 			},
 			"role_arn": {
diff --git a/internal/service/kendra/experience_data_source.go b/internal/service/kendra/experience_data_source.go
index 217d75486dc..31e6db877a6 100644
--- a/internal/service/kendra/experience_data_source.go
+++ b/internal/service/kendra/experience_data_source.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kendra
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/aws/arn"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
@@ -103,7 +106,7 @@ func DataSourceExperience() *schema.Resource {
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 36),
 					validation.StringMatch(
-						regexp.MustCompile(`[a-zA-Z0-9][a-zA-Z0-9_-]*`),
+						regexache.MustCompile(`[0-9A-Za-z][0-9A-Za-z_-]*`),
 						"Starts with an alphanumeric character. Subsequently, can contain alphanumeric characters and hyphens.",
 					),
 				),
@@ -112,7 +115,7 @@ func DataSourceExperience() *schema.Resource {
 				Type:     schema.TypeString,
 				Required: true,
 				ValidateFunc: validation.StringMatch(
-					regexp.MustCompile(`[a-zA-Z0-9][a-zA-Z0-9-]{35}`),
+					regexache.MustCompile(`[0-9A-Za-z][0-9A-Za-z-]{35}`),
 					"Starts with an alphanumeric character. Subsequently, can contain alphanumeric characters and hyphens. Fixed length of 36.",
 				),
 			},
diff --git a/internal/service/kendra/experience_data_source_test.go b/internal/service/kendra/experience_data_source_test.go
index dca2779fe88..a89e039bbdd 100644
--- a/internal/service/kendra/experience_data_source_test.go
+++ b/internal/service/kendra/experience_data_source_test.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kendra_test
 
 import (
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/backup"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -33,7 +36,7 @@ func TestAccKendraExperienceDataSource_basic(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccExperienceDataSourceConfig_nonExistent,
-				ExpectError: regexp.MustCompile(`reading Kendra Experience`),
+				ExpectError: regexache.MustCompile(`reading Kendra Experience`),
 			},
 			{
 				Config: testAccExperienceDataSourceConfig_basic(rName, rName2),
diff --git a/internal/service/kendra/experience_test.go b/internal/service/kendra/experience_test.go
index 086b0e4b636..2efb03f92c9 100644
--- a/internal/service/kendra/experience_test.go
+++ b/internal/service/kendra/experience_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kendra_test
 
 import (
 	"context"
 	"fmt"
 	"os"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
@@ -40,7 +43,7 @@ func TestAccKendraExperience_basic(t *testing.T) {
 				Config: testAccExperienceConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckExperienceExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "kendra", regexp.MustCompile(`index/.+/experience/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "kendra", regexache.MustCompile(`index/.+/experience/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "configuration.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "endpoints.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
diff --git a/internal/service/kendra/faq.go b/internal/service/kendra/faq.go
index 9e1c6c964d7..1166ad3e20d 100644
--- a/internal/service/kendra/faq.go
+++ b/internal/service/kendra/faq.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kendra
 
 import (
@@ -5,10 +8,10 @@ import (
 	"errors"
 	"fmt"
 	"log"
-	"regexp"
 	"strings"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/aws/arn"
 	"github.com/aws/aws-sdk-go-v2/service/kendra"
@@ -76,7 +79,7 @@ func ResourceFaq() *schema.Resource {
 				Required: true,
 				ForceNew: true,
 				ValidateFunc: validation.StringMatch(
-					regexp.MustCompile(`[a-zA-Z0-9][a-zA-Z0-9-]{35}`),
+					regexache.MustCompile(`[0-9A-Za-z][0-9A-Za-z-]{35}`),
 					"Starts with an alphanumeric character. Subsequently, can contain alphanumeric characters and hyphens. Fixed length of 36.",
 				),
 			},
@@ -88,7 +91,7 @@ func ResourceFaq() *schema.Resource {
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(2, 10),
 					validation.StringMatch(
-						regexp.MustCompile(`[a-zA-Z-]*`),
+						regexache.MustCompile(`[A-Za-z-]*`),
 						"Must have alphanumeric characters or hyphens.",
 					),
 				),
@@ -100,7 +103,7 @@ func ResourceFaq() *schema.Resource {
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 100),
 					validation.StringMatch(
-						regexp.MustCompile(`[a-zA-Z0-9][a-zA-Z0-9_-]*`),
+						regexache.MustCompile(`[0-9A-Za-z][0-9A-Za-z_-]*`),
 						"Starts with an alphanumeric character. Subsequently, the name must consist of alphanumerics, hyphens or underscores.",
 					),
 				),
diff --git a/internal/service/kendra/faq_data_source.go b/internal/service/kendra/faq_data_source.go
index 2397a2989fc..e59882e1ce6 100644
--- a/internal/service/kendra/faq_data_source.go
+++ b/internal/service/kendra/faq_data_source.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kendra
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/aws/arn"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
@@ -42,7 +45,7 @@ func DataSourceFaq() *schema.Resource {
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 100),
 					validation.StringMatch(
-						regexp.MustCompile(`[a-zA-Z0-9][a-zA-Z0-9_-]*`),
+						regexache.MustCompile(`[0-9A-Za-z][0-9A-Za-z_-]*`),
 						"Starts with an alphanumeric character. Subsequently, can contain alphanumeric characters and hyphens.",
 					),
 				),
@@ -55,7 +58,7 @@ func DataSourceFaq() *schema.Resource {
 				Type:     schema.TypeString,
 				Required: true,
 				ValidateFunc: validation.StringMatch(
-					regexp.MustCompile(`[a-zA-Z0-9][a-zA-Z0-9-]{35}`),
+					regexache.MustCompile(`[0-9A-Za-z][0-9A-Za-z-]{35}`),
 					"Starts with an alphanumeric character. Subsequently, can contain alphanumeric characters and hyphens. Fixed length of 36.",
 				),
 			},
diff --git a/internal/service/kendra/faq_data_source_test.go b/internal/service/kendra/faq_data_source_test.go
index 5767378ff90..9ec5ec50aaa 100644
--- a/internal/service/kendra/faq_data_source_test.go
+++ b/internal/service/kendra/faq_data_source_test.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kendra_test
 
 import (
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/backup"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -28,7 +31,7 @@ func TestAccKendraFaqDataSource_basic(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccFaqDataSourceConfig_nonExistent,
-				ExpectError: regexp.MustCompile(`getting Kendra Faq`),
+				ExpectError: regexache.MustCompile(`getting Kendra Faq`),
 			},
 			{
 				Config: testAccFaqDataSourceConfig_basic(rName, rName2, rName3, rName4, rName5),
diff --git a/internal/service/kendra/faq_test.go b/internal/service/kendra/faq_test.go
index 47e71740928..66b0b749814 100644
--- a/internal/service/kendra/faq_test.go
+++ b/internal/service/kendra/faq_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kendra_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/service/kendra/types"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -40,7 +43,7 @@ func TestAccKendraFaq_basic(t *testing.T) {
 				Config: testAccFaqConfig_basic(rName, rName2, rName3, rName4, rName5),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckFaqExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "kendra", regexp.MustCompile(`index/.+/faq/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "kendra", regexache.MustCompile(`index/.+/faq/.+$`)),
 					resource.TestCheckResourceAttrSet(resourceName, "created_at"),
 					resource.TestCheckResourceAttrSet(resourceName, "faq_id"),
 					resource.TestCheckResourceAttrPair(resourceName, "index_id", "aws_kendra_index.test", "id"),
diff --git a/internal/service/kendra/find.go b/internal/service/kendra/find.go
index 02623777198..94dbefd9aa5 100644
--- a/internal/service/kendra/find.go
+++ b/internal/service/kendra/find.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kendra
 
 import (
diff --git a/internal/service/kendra/flex.go b/internal/service/kendra/flex.go
index 7e80eb972e7..c1ad37351a2 100644
--- a/internal/service/kendra/flex.go
+++ b/internal/service/kendra/flex.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kendra
 
 import (
diff --git a/internal/service/kendra/generate.go b/internal/service/kendra/generate.go
index 36a0dc7bf98..19746cb941e 100644
--- a/internal/service/kendra/generate.go
+++ b/internal/service/kendra/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -AWSSDKVersion=2 -TagInIDElem=ResourceARN -ListTags -ListTagsInIDElem=ResourceARN -ServiceTagsSlice -UpdateTags -UntagInTagsElem=TagKeys
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/kendra/id.go b/internal/service/kendra/id.go
index e6dafb9e064..abbbbcf9dbc 100644
--- a/internal/service/kendra/id.go
+++ b/internal/service/kendra/id.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kendra
 
 import (
diff --git a/internal/service/kendra/id_test.go b/internal/service/kendra/id_test.go
index 1e99c2c2ded..d2c002bc3ad 100644
--- a/internal/service/kendra/id_test.go
+++ b/internal/service/kendra/id_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kendra_test
 
 import (
diff --git a/internal/service/kendra/index.go b/internal/service/kendra/index.go
index 93c1e42c80b..b00a93da708 100644
--- a/internal/service/kendra/index.go
+++ b/internal/service/kendra/index.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kendra
 
 import (
@@ -5,10 +8,10 @@ import (
 	"errors"
 	"fmt"
 	"log"
-	"regexp"
 	"strings"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/aws/arn"
 	"github.com/aws/aws-sdk-go-v2/service/kendra"
@@ -115,7 +118,7 @@ func ResourceIndex() *schema.Resource {
 										ValidateFunc: validation.All(
 											validation.StringLenBetween(1, 10),
 											validation.StringMatch(
-												regexp.MustCompile(`[0-9]+[s]`),
+												regexache.MustCompile(`[0-9]+[s]`),
 												"numeric string followed by the character \"s\"",
 											),
 										),
@@ -237,7 +240,7 @@ func ResourceIndex() *schema.Resource {
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 1000),
 					validation.StringMatch(
-						regexp.MustCompile(`[a-zA-Z0-9][a-zA-Z0-9_-]*`),
+						regexache.MustCompile(`[0-9A-Za-z][0-9A-Za-z_-]*`),
 						"The name must consist of alphanumerics, hyphens or underscores.",
 					),
 				),
@@ -353,7 +356,7 @@ func ResourceIndex() *schema.Resource {
 										ValidateFunc: validation.All(
 											validation.StringLenBetween(1, 2048),
 											validation.StringMatch(
-												regexp.MustCompile(`^(https?|ftp|file):\/\/([^\s]*)`),
+												regexache.MustCompile(`^(https?|ftp|file):\/\/([^\s]*)`),
 												"Must be valid URL",
 											),
 										),
diff --git a/internal/service/kendra/index_data_source.go b/internal/service/kendra/index_data_source.go
index f5d066254dd..0f352da15a0 100644
--- a/internal/service/kendra/index_data_source.go
+++ b/internal/service/kendra/index_data_source.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kendra
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/aws/arn"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
@@ -129,7 +132,7 @@ func DataSourceIndex() *schema.Resource {
 				Type:     schema.TypeString,
 				Required: true,
 				ValidateFunc: validation.StringMatch(
-					regexp.MustCompile(`[a-zA-Z0-9][a-zA-Z0-9-]{35}`),
+					regexache.MustCompile(`[0-9A-Za-z][0-9A-Za-z-]{35}`),
 					"Starts with an alphanumeric character. Subsequently, can contain alphanumeric characters and hyphens. Fixed length of 36.",
 				),
 			},
diff --git a/internal/service/kendra/index_data_source_test.go b/internal/service/kendra/index_data_source_test.go
index b37c16d09fe..1d215cbf8a3 100644
--- a/internal/service/kendra/index_data_source_test.go
+++ b/internal/service/kendra/index_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kendra_test
 
 import (
diff --git a/internal/service/kendra/index_test.go b/internal/service/kendra/index_test.go
index db0829cf9d8..4f4271fdb2a 100644
--- a/internal/service/kendra/index_test.go
+++ b/internal/service/kendra/index_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kendra_test
 
 import (
diff --git a/internal/service/kendra/query_suggestions_block_list.go b/internal/service/kendra/query_suggestions_block_list.go
index 3abe6b05f54..1635c5cec1f 100644
--- a/internal/service/kendra/query_suggestions_block_list.go
+++ b/internal/service/kendra/query_suggestions_block_list.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kendra
 
 import (
diff --git a/internal/service/kendra/query_suggestions_block_list_data_source.go b/internal/service/kendra/query_suggestions_block_list_data_source.go
index e26f623da70..0ab26d3cba9 100644
--- a/internal/service/kendra/query_suggestions_block_list_data_source.go
+++ b/internal/service/kendra/query_suggestions_block_list_data_source.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kendra
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/aws/arn"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
@@ -44,7 +47,7 @@ func DataSourceQuerySuggestionsBlockList() *schema.Resource {
 				Type:     schema.TypeString,
 				Required: true,
 				ValidateFunc: validation.StringMatch(
-					regexp.MustCompile(`[a-zA-Z0-9][a-zA-Z0-9-]{35}`),
+					regexache.MustCompile(`[0-9A-Za-z][0-9A-Za-z-]{35}`),
 					"Starts with an alphanumeric character. Subsequently, can contain alphanumeric characters and hyphens. Fixed length of 36.",
 				),
 			},
@@ -60,7 +63,7 @@ func DataSourceQuerySuggestionsBlockList() *schema.Resource {
 				Type:     schema.TypeString,
 				Required: true,
 				ValidateFunc: validation.StringMatch(
-					regexp.MustCompile(`[a-zA-Z0-9][a-zA-Z0-9-]{35}`),
+					regexache.MustCompile(`[0-9A-Za-z][0-9A-Za-z-]{35}`),
 					"Starts with an alphanumeric character. Subsequently, can contain alphanumeric characters and hyphens. Fixed length of 36.",
 				),
 			},
diff --git a/internal/service/kendra/query_suggestions_block_list_data_source_test.go b/internal/service/kendra/query_suggestions_block_list_data_source_test.go
index d1e920e2468..bb0fd278b6d 100644
--- a/internal/service/kendra/query_suggestions_block_list_data_source_test.go
+++ b/internal/service/kendra/query_suggestions_block_list_data_source_test.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kendra_test
 
 import (
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/backup"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -29,7 +32,7 @@ func TestAccKendraQuerySuggestionsBlockListDataSource_basic(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccQuerySuggestionsBlockListDataSourceConfig_nonExistent,
-				ExpectError: regexp.MustCompile(`reading Kendra QuerySuggestionsBlockList`),
+				ExpectError: regexache.MustCompile(`reading Kendra QuerySuggestionsBlockList`),
 			},
 			{
 				Config: testAccQuerySuggestionsBlockListDataSourceConfig_basic(rName, rName2),
diff --git a/internal/service/kendra/query_suggestions_block_list_test.go b/internal/service/kendra/query_suggestions_block_list_test.go
index 2f0c6c434b1..342f1d29cf0 100644
--- a/internal/service/kendra/query_suggestions_block_list_test.go
+++ b/internal/service/kendra/query_suggestions_block_list_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kendra_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
@@ -46,7 +49,7 @@ func TestAccKendraQuerySuggestionsBlockList_basic(t *testing.T) {
 					resource.TestCheckResourceAttrPair(resourceName, "source_s3_path.0.bucket", "aws_s3_bucket.test", "id"),
 					resource.TestCheckResourceAttrPair(resourceName, "source_s3_path.0.key", "aws_s3_object.test", "key"),
 					resource.TestCheckResourceAttrSet(resourceName, "status"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "kendra", regexp.MustCompile(`index/.+/query-suggestions-block-list/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "kendra", regexache.MustCompile(`index/.+/query-suggestions-block-list/.+$`)),
 				),
 			},
 			{
diff --git a/internal/service/kendra/service_package_gen.go b/internal/service/kendra/service_package_gen.go
index c0d7e9fd010..a698a194c76 100644
--- a/internal/service/kendra/service_package_gen.go
+++ b/internal/service/kendra/service_package_gen.go
@@ -7,6 +7,7 @@ import (
 
 	aws_sdkv2 "github.com/aws/aws-sdk-go-v2/aws"
 	kendra_sdkv2 "github.com/aws/aws-sdk-go-v2/service/kendra"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -105,9 +106,11 @@ func (p *servicePackage) NewClient(ctx context.Context, config map[string]any) (
 
 	return kendra_sdkv2.NewFromConfig(cfg, func(o *kendra_sdkv2.Options) {
 		if endpoint := config["endpoint"].(string); endpoint != "" {
-			o.EndpointResolver = kendra_sdkv2.EndpointResolverFromURL(endpoint)
+			o.BaseEndpoint = aws_sdkv2.String(endpoint)
 		}
 	}), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/kendra/sweep.go b/internal/service/kendra/sweep.go
index e52854bec11..f4a3d04627a 100644
--- a/internal/service/kendra/sweep.go
+++ b/internal/service/kendra/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package kendra
 
@@ -12,9 +12,10 @@ import (
 	"github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv2"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_kendra_index", &resource.Sweeper{
 		Name: "aws_kendra_index",
 		F:    sweepIndex,
@@ -23,7 +24,7 @@ func init() {
 
 func sweepIndex(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("getting client: %w", err)
 	}
@@ -38,7 +39,7 @@ func sweepIndex(region string) error {
 	for pages.HasMorePages() {
 		page, err := pages.NextPage(ctx)
 
-		if sweep.SkipSweepError(err) {
+		if awsv2.SkipSweepError(err) {
 			log.Printf("[WARN] Skipping Kendra Indices sweep for %s: %s", region, err)
 			return errs.ErrorOrNil()
 		}
@@ -56,7 +57,7 @@ func sweepIndex(region string) error {
 		}
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("sweeping Kendra Indices for %s: %w", region, err))
 	}
 
diff --git a/internal/service/kendra/tags_gen.go b/internal/service/kendra/tags_gen.go
index 9890eca351a..3a8ac94ff07 100644
--- a/internal/service/kendra/tags_gen.go
+++ b/internal/service/kendra/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/kendra"
 	awstypes "github.com/aws/aws-sdk-go-v2/service/kendra/types"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -102,6 +104,8 @@ func updateTags(ctx context.Context, conn *kendra.Client, identifier string, old
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.Kendra)
 	if len(removedTags) > 0 {
diff --git a/internal/service/kendra/thesaurus.go b/internal/service/kendra/thesaurus.go
index e24e281abe5..a0aabe18751 100644
--- a/internal/service/kendra/thesaurus.go
+++ b/internal/service/kendra/thesaurus.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kendra
 
 import (
diff --git a/internal/service/kendra/thesaurus_data_source.go b/internal/service/kendra/thesaurus_data_source.go
index 9f9418ebff8..430b4fab685 100644
--- a/internal/service/kendra/thesaurus_data_source.go
+++ b/internal/service/kendra/thesaurus_data_source.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kendra
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/aws/arn"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
@@ -44,7 +47,7 @@ func DataSourceThesaurus() *schema.Resource {
 				Type:     schema.TypeString,
 				Required: true,
 				ValidateFunc: validation.StringMatch(
-					regexp.MustCompile(`[a-zA-Z0-9][a-zA-Z0-9-]{35}`),
+					regexache.MustCompile(`[0-9A-Za-z][0-9A-Za-z-]{35}`),
 					"Starts with an alphanumeric character. Subsequently, can contain alphanumeric characters and hyphens. Fixed length of 36.",
 				),
 			},
@@ -91,7 +94,7 @@ func DataSourceThesaurus() *schema.Resource {
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 100),
 					validation.StringMatch(
-						regexp.MustCompile(`[a-zA-Z0-9][a-zA-Z0-9_-]*`),
+						regexache.MustCompile(`[0-9A-Za-z][0-9A-Za-z_-]*`),
 						"Starts with an alphanumeric character. Subsequently, can contain alphanumeric characters and hyphens.",
 					),
 				),
diff --git a/internal/service/kendra/thesaurus_data_source_test.go b/internal/service/kendra/thesaurus_data_source_test.go
index 6e22abd2386..ed9e606ec02 100644
--- a/internal/service/kendra/thesaurus_data_source_test.go
+++ b/internal/service/kendra/thesaurus_data_source_test.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kendra_test
 
 import (
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/backup"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -29,7 +32,7 @@ func TestAccKendraThesaurusDataSource_basic(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccThesaurusDataSourceConfig_nonExistent,
-				ExpectError: regexp.MustCompile(`reading Kendra Thesaurus`),
+				ExpectError: regexache.MustCompile(`reading Kendra Thesaurus`),
 			},
 			{
 				Config: testAccThesaurusDataSourceConfig_basic(rName, rName2),
diff --git a/internal/service/kendra/thesaurus_test.go b/internal/service/kendra/thesaurus_test.go
index c23500057ce..1e8cf67aaf8 100644
--- a/internal/service/kendra/thesaurus_test.go
+++ b/internal/service/kendra/thesaurus_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kendra_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
@@ -47,7 +50,7 @@ func TestAccKendraThesaurus_basic(t *testing.T) {
 					resource.TestCheckResourceAttrPair(resourceName, "source_s3_path.0.key", "aws_s3_object.test", "key"),
 					resource.TestCheckResourceAttrSet(resourceName, "status"),
 					resource.TestCheckResourceAttrSet(resourceName, "thesaurus_id"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "kendra", regexp.MustCompile(`index/.+/thesaurus/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "kendra", regexache.MustCompile(`index/.+/thesaurus/.+$`)),
 				),
 			},
 			{
diff --git a/internal/service/keyspaces/exports_test.go b/internal/service/keyspaces/exports_test.go
new file mode 100644
index 00000000000..5c5e2704f9d
--- /dev/null
+++ b/internal/service/keyspaces/exports_test.go
@@ -0,0 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package keyspaces
+
+// Exports for use in tests only.
+var (
+	ResourceKeyspace = resourceKeyspace
+	ResourceTable    = resourceTable
+
+	FindKeyspaceByName    = findKeyspaceByName
+	FindTableByTwoPartKey = findTableByTwoPartKey
+
+	TableParseResourceID = tableParseResourceID
+)
diff --git a/internal/service/keyspaces/find.go b/internal/service/keyspaces/find.go
deleted file mode 100644
index c22dcee84ea..00000000000
--- a/internal/service/keyspaces/find.go
+++ /dev/null
@@ -1,69 +0,0 @@
-package keyspaces
-
-import (
-	"context"
-
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/keyspaces"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
-	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
-)
-
-func FindKeyspaceByName(ctx context.Context, conn *keyspaces.Keyspaces, name string) (*keyspaces.GetKeyspaceOutput, error) {
-	input := keyspaces.GetKeyspaceInput{
-		KeyspaceName: aws.String(name),
-	}
-
-	output, err := conn.GetKeyspaceWithContext(ctx, &input)
-
-	if tfawserr.ErrCodeEquals(err, keyspaces.ErrCodeResourceNotFoundException) {
-		return nil, &retry.NotFoundError{
-			LastError:   err,
-			LastRequest: input,
-		}
-	}
-
-	if err != nil {
-		return nil, err
-	}
-
-	if output == nil {
-		return nil, tfresource.NewEmptyResultError(input)
-	}
-
-	return output, nil
-}
-
-func FindTableByTwoPartKey(ctx context.Context, conn *keyspaces.Keyspaces, keyspaceName, tableName string) (*keyspaces.GetTableOutput, error) {
-	input := keyspaces.GetTableInput{
-		KeyspaceName: aws.String(keyspaceName),
-		TableName:    aws.String(tableName),
-	}
-
-	output, err := conn.GetTableWithContext(ctx, &input)
-
-	if tfawserr.ErrCodeEquals(err, keyspaces.ErrCodeResourceNotFoundException) {
-		return nil, &retry.NotFoundError{
-			LastError:   err,
-			LastRequest: input,
-		}
-	}
-
-	if err != nil {
-		return nil, err
-	}
-
-	if output == nil {
-		return nil, tfresource.NewEmptyResultError(input)
-	}
-
-	if status := aws.StringValue(output.Status); status == keyspaces.TableStatusDeleted {
-		return nil, &retry.NotFoundError{
-			Message:     status,
-			LastRequest: input,
-		}
-	}
-
-	return output, nil
-}
diff --git a/internal/service/keyspaces/generate.go b/internal/service/keyspaces/generate.go
index 1f32f30768b..6bec69cd0cd 100644
--- a/internal/service/keyspaces/generate.go
+++ b/internal/service/keyspaces/generate.go
@@ -1,4 +1,7 @@
-//go:generate go run ../../generate/tags/main.go -ListTags -ServiceTagsSlice -UpdateTags -UntagInTagsElem=Tags -UntagInNeedTagType
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+//go:generate go run ../../generate/tags/main.go -AWSSDKVersion=2 -ListTags -ServiceTagsSlice -UpdateTags -UntagInTagsElem=Tags -UntagInNeedTagType
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
 
diff --git a/internal/service/keyspaces/keyspace.go b/internal/service/keyspaces/keyspace.go
index 5391de6b2b4..22fb0adb07b 100644
--- a/internal/service/keyspaces/keyspace.go
+++ b/internal/service/keyspaces/keyspace.go
@@ -1,18 +1,23 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package keyspaces
 
 import (
 	"context"
 	"log"
-	"regexp"
 	"time"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/keyspaces"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/YakDriver/regexache"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/keyspaces"
+	"github.com/aws/aws-sdk-go-v2/service/keyspaces/types"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
@@ -21,7 +26,7 @@ import (
 
 // @SDKResource("aws_keyspaces_keyspace", name="Keyspace")
 // @Tags(identifierAttribute="arn")
-func ResourceKeyspace() *schema.Resource {
+func resourceKeyspace() *schema.Resource {
 	return &schema.Resource{
 		CreateWithoutTimeout: resourceKeyspaceCreate,
 		ReadWithoutTimeout:   resourceKeyspaceRead,
@@ -49,7 +54,7 @@ func ResourceKeyspace() *schema.Resource {
 				ForceNew: true,
 				Required: true,
 				ValidateFunc: validation.StringMatch(
-					regexp.MustCompile(`^[a-zA-Z0-9][a-zA-Z0-9_]{0,47}$`),
+					regexache.MustCompile(`^[0-9A-Za-z][0-9A-Za-z_]{0,47}$`),
 					"The name can have up to 48 characters. It must begin with an alpha-numeric character and can only contain alpha-numeric characters and underscores.",
 				),
 			},
@@ -60,7 +65,7 @@ func ResourceKeyspace() *schema.Resource {
 }
 
 func resourceKeyspaceCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).KeyspacesConn(ctx)
+	conn := meta.(*conns.AWSClient).KeyspacesClient(ctx)
 
 	name := d.Get("name").(string)
 	input := &keyspaces.CreateKeyspaceInput{
@@ -68,7 +73,7 @@ func resourceKeyspaceCreate(ctx context.Context, d *schema.ResourceData, meta in
 		Tags:         getTagsIn(ctx),
 	}
 
-	_, err := conn.CreateKeyspaceWithContext(ctx, input)
+	_, err := conn.CreateKeyspace(ctx, input)
 
 	if err != nil {
 		return diag.Errorf("creating Keyspaces Keyspace (%s): %s", name, err)
@@ -77,7 +82,7 @@ func resourceKeyspaceCreate(ctx context.Context, d *schema.ResourceData, meta in
 	d.SetId(name)
 
 	_, err = tfresource.RetryWhenNotFound(ctx, d.Timeout(schema.TimeoutCreate), func() (interface{}, error) {
-		return FindKeyspaceByName(ctx, conn, d.Id())
+		return findKeyspaceByName(ctx, conn, d.Id())
 	})
 
 	if err != nil {
@@ -88,9 +93,9 @@ func resourceKeyspaceCreate(ctx context.Context, d *schema.ResourceData, meta in
 }
 
 func resourceKeyspaceRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).KeyspacesConn(ctx)
+	conn := meta.(*conns.AWSClient).KeyspacesClient(ctx)
 
-	keyspace, err := FindKeyspaceByName(ctx, conn, d.Id())
+	keyspace, err := findKeyspaceByName(ctx, conn, d.Id())
 
 	if !d.IsNewResource() && tfresource.NotFound(err) {
 		log.Printf("[WARN] Keyspaces Keyspace (%s) not found, removing from state", d.Id())
@@ -114,18 +119,18 @@ func resourceKeyspaceUpdate(ctx context.Context, d *schema.ResourceData, meta in
 }
 
 func resourceKeyspaceDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).KeyspacesConn(ctx)
+	conn := meta.(*conns.AWSClient).KeyspacesClient(ctx)
 
 	log.Printf("[DEBUG] Deleting Keyspaces Keyspace: (%s)", d.Id())
-	_, err := tfresource.RetryWhenAWSErrMessageContains(ctx, d.Timeout(schema.TimeoutDelete),
+	_, err := tfresource.RetryWhenIsAErrorMessageContains[*types.ConflictException](ctx, d.Timeout(schema.TimeoutDelete),
 		func() (interface{}, error) {
-			return conn.DeleteKeyspaceWithContext(ctx, &keyspaces.DeleteKeyspaceInput{
+			return conn.DeleteKeyspace(ctx, &keyspaces.DeleteKeyspaceInput{
 				KeyspaceName: aws.String(d.Id()),
 			})
 		},
-		keyspaces.ErrCodeConflictException, "a table under it is currently being created or deleted")
+		"a table under it is currently being created or deleted")
 
-	if tfawserr.ErrCodeEquals(err, keyspaces.ErrCodeResourceNotFoundException) {
+	if errs.IsA[*types.ResourceNotFoundException](err) {
 		return nil
 	}
 
@@ -134,7 +139,7 @@ func resourceKeyspaceDelete(ctx context.Context, d *schema.ResourceData, meta in
 	}
 
 	_, err = tfresource.RetryUntilNotFound(ctx, d.Timeout(schema.TimeoutDelete), func() (interface{}, error) {
-		return FindKeyspaceByName(ctx, conn, d.Id())
+		return findKeyspaceByName(ctx, conn, d.Id())
 	})
 
 	if err != nil {
@@ -143,3 +148,28 @@ func resourceKeyspaceDelete(ctx context.Context, d *schema.ResourceData, meta in
 
 	return nil
 }
+
+func findKeyspaceByName(ctx context.Context, conn *keyspaces.Client, name string) (*keyspaces.GetKeyspaceOutput, error) {
+	input := keyspaces.GetKeyspaceInput{
+		KeyspaceName: aws.String(name),
+	}
+
+	output, err := conn.GetKeyspace(ctx, &input)
+
+	if errs.IsA[*types.ResourceNotFoundException](err) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	if output == nil {
+		return nil, tfresource.NewEmptyResultError(input)
+	}
+
+	return output, nil
+}
diff --git a/internal/service/keyspaces/keyspace_test.go b/internal/service/keyspaces/keyspace_test.go
index 24130306b63..fc283cd9c16 100644
--- a/internal/service/keyspaces/keyspace_test.go
+++ b/internal/service/keyspaces/keyspace_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package keyspaces_test
 
 import (
@@ -6,7 +9,6 @@ import (
 	"testing"
 
 	"github.com/aws/aws-sdk-go/aws/endpoints"
-	"github.com/aws/aws-sdk-go/service/keyspaces"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
@@ -14,6 +16,7 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	tfkeyspaces "github.com/hashicorp/terraform-provider-aws/internal/service/keyspaces"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
 func testAccPreCheck(t *testing.T) {
@@ -27,7 +30,7 @@ func TestAccKeyspacesKeyspace_basic(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheck(t) },
-		ErrorCheck:               acctest.ErrorCheck(t, keyspaces.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.KeyspacesEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckKeyspaceDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -56,7 +59,7 @@ func TestAccKeyspacesKeyspace_disappears(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheck(t) },
-		ErrorCheck:               acctest.ErrorCheck(t, keyspaces.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.KeyspacesEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckKeyspaceDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -79,7 +82,7 @@ func TestAccKeyspacesKeyspace_tags(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheck(t) },
-		ErrorCheck:               acctest.ErrorCheck(t, keyspaces.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.KeyspacesEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckKeyspaceDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -119,7 +122,7 @@ func TestAccKeyspacesKeyspace_tags(t *testing.T) {
 
 func testAccCheckKeyspaceDestroy(ctx context.Context) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		conn := acctest.Provider.Meta().(*conns.AWSClient).KeyspacesConn(ctx)
+		conn := acctest.Provider.Meta().(*conns.AWSClient).KeyspacesClient(ctx)
 
 		for _, rs := range s.RootModule().Resources {
 			if rs.Type != "aws_keyspaces_keyspace" {
@@ -154,7 +157,7 @@ func testAccCheckKeyspaceExists(ctx context.Context, n string) resource.TestChec
 			return fmt.Errorf("No Keyspaces Keyspace ID is set")
 		}
 
-		conn := acctest.Provider.Meta().(*conns.AWSClient).KeyspacesConn(ctx)
+		conn := acctest.Provider.Meta().(*conns.AWSClient).KeyspacesClient(ctx)
 
 		_, err := tfkeyspaces.FindKeyspaceByName(ctx, conn, rs.Primary.Attributes["name"])
 
diff --git a/internal/service/keyspaces/service_package_gen.go b/internal/service/keyspaces/service_package_gen.go
index 2aef7d7cb69..a61b4284b52 100644
--- a/internal/service/keyspaces/service_package_gen.go
+++ b/internal/service/keyspaces/service_package_gen.go
@@ -5,9 +5,9 @@ package keyspaces
 import (
 	"context"
 
-	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
-	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
-	keyspaces_sdkv1 "github.com/aws/aws-sdk-go/service/keyspaces"
+	aws_sdkv2 "github.com/aws/aws-sdk-go-v2/aws"
+	keyspaces_sdkv2 "github.com/aws/aws-sdk-go-v2/service/keyspaces"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -29,7 +29,7 @@ func (p *servicePackage) SDKDataSources(ctx context.Context) []*types.ServicePac
 func (p *servicePackage) SDKResources(ctx context.Context) []*types.ServicePackageSDKResource {
 	return []*types.ServicePackageSDKResource{
 		{
-			Factory:  ResourceKeyspace,
+			Factory:  resourceKeyspace,
 			TypeName: "aws_keyspaces_keyspace",
 			Name:     "Keyspace",
 			Tags: &types.ServicePackageResourceTags{
@@ -37,7 +37,7 @@ func (p *servicePackage) SDKResources(ctx context.Context) []*types.ServicePacka
 			},
 		},
 		{
-			Factory:  ResourceTable,
+			Factory:  resourceTable,
 			TypeName: "aws_keyspaces_table",
 			Name:     "Table",
 			Tags: &types.ServicePackageResourceTags{
@@ -51,11 +51,17 @@ func (p *servicePackage) ServicePackageName() string {
 	return names.Keyspaces
 }
 
-// NewConn returns a new AWS SDK for Go v1 client for this service package's AWS API.
-func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*keyspaces_sdkv1.Keyspaces, error) {
-	sess := config["session"].(*session_sdkv1.Session)
+// NewClient returns a new AWS SDK for Go v2 client for this service package's AWS API.
+func (p *servicePackage) NewClient(ctx context.Context, config map[string]any) (*keyspaces_sdkv2.Client, error) {
+	cfg := *(config["aws_sdkv2_config"].(*aws_sdkv2.Config))
 
-	return keyspaces_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
+	return keyspaces_sdkv2.NewFromConfig(cfg, func(o *keyspaces_sdkv2.Options) {
+		if endpoint := config["endpoint"].(string); endpoint != "" {
+			o.BaseEndpoint = aws_sdkv2.String(endpoint)
+		}
+	}), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/keyspaces/sweep.go b/internal/service/keyspaces/sweep.go
index 94b42bda14d..ea122fc22c9 100644
--- a/internal/service/keyspaces/sweep.go
+++ b/internal/service/keyspaces/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package keyspaces
 
@@ -7,13 +7,14 @@ import (
 	"fmt"
 	"log"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/keyspaces"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/keyspaces"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv2"
 )
 
-func init() {
+func RegisterSweepers() {
 	// No need to have separate sweeper for table as would be destroyed as part of keyspace
 	resource.AddTestSweepers("aws_keyspaces_keyspace", &resource.Sweeper{
 		Name: "aws_keyspaces_keyspace",
@@ -23,21 +24,29 @@ func init() {
 
 func sweepKeyspaces(region string) error { // nosemgrep:ci.keyspaces-in-func-name
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
-	conn := client.KeyspacesConn(ctx)
+	conn := client.KeyspacesClient(ctx)
 	input := &keyspaces.ListKeyspacesInput{}
 	sweepResources := make([]sweep.Sweepable, 0)
 
-	err = conn.ListKeyspacesPagesWithContext(ctx, input, func(page *keyspaces.ListKeyspacesOutput, lastPage bool) bool {
-		if page == nil {
-			return !lastPage
+	pages := keyspaces.NewListKeyspacesPaginator(conn, input)
+	for pages.HasMorePages() {
+		page, err := pages.NextPage(ctx)
+
+		if awsv2.SkipSweepError(err) {
+			log.Printf("[WARN] Skipping Keyspaces Keyspace sweep for %s: %s", region, err)
+			return nil
+		}
+
+		if err != nil {
+			return fmt.Errorf("error listing Keyspaces Keyspaces (%s): %w", region, err)
 		}
 
 		for _, v := range page.Keyspaces {
-			id := aws.StringValue(v.KeyspaceName)
+			id := aws.ToString(v.KeyspaceName)
 
 			switch id {
 			case "system_schema", "system_schema_mcs", "system", "system_multiregion_info":
@@ -45,26 +54,15 @@ func sweepKeyspaces(region string) error { // nosemgrep:ci.keyspaces-in-func-nam
 				continue
 			}
 
-			r := ResourceKeyspace()
+			r := resourceKeyspace()
 			d := r.Data(nil)
 			d.SetId(id)
 
 			sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
 		}
-
-		return !lastPage
-	})
-
-	if sweep.SkipSweepError(err) {
-		log.Printf("[WARN] Skipping Keyspaces Keyspace sweep for %s: %s", region, err)
-		return nil
-	}
-
-	if err != nil {
-		return fmt.Errorf("error listing Keyspaces Keyspaces (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping Keyspaces Keyspaces (%s): %w", region, err)
diff --git a/internal/service/keyspaces/table.go b/internal/service/keyspaces/table.go
index 0e72e08f066..3c67d639f8a 100644
--- a/internal/service/keyspaces/table.go
+++ b/internal/service/keyspaces/table.go
@@ -1,22 +1,27 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package keyspaces
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"strings"
 	"time"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/keyspaces"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/YakDriver/regexache"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/keyspaces"
+	"github.com/aws/aws-sdk-go-v2/service/keyspaces/types"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/customdiff"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/enum"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
@@ -25,7 +30,7 @@ import (
 
 // @SDKResource("aws_keyspaces_table", name="Table")
 // @Tags(identifierAttribute="arn")
-func ResourceTable() *schema.Resource {
+func resourceTable() *schema.Resource {
 	return &schema.Resource{
 		CreateWithoutTimeout: resourceTableCreate,
 		ReadWithoutTimeout:   resourceTableRead,
@@ -43,10 +48,14 @@ func ResourceTable() *schema.Resource {
 		},
 
 		CustomizeDiff: customdiff.Sequence(
-			customdiff.ForceNewIfChange("schema_definition.0.column", func(_ context.Context, o, n, meta interface{}) bool {
+			customdiff.ForceNewIfChange("client_side_timestamps", func(_ context.Context, old, new, meta interface{}) bool {
+				// Client-side timestamps cannot be disabled.
+				return len(old.([]interface{})) == 1 && len(new.([]interface{})) == 0
+			}),
+			customdiff.ForceNewIfChange("schema_definition.0.column", func(_ context.Context, old, new, meta interface{}) bool {
 				// Columns can only be added.
-				if os, ok := o.(*schema.Set); ok {
-					if ns, ok := n.(*schema.Set); ok {
+				if os, ok := old.(*schema.Set); ok {
+					if ns, ok := new.(*schema.Set); ok {
 						if del := os.Difference(ns); del.Len() > 0 {
 							return true
 						}
@@ -76,10 +85,10 @@ func ResourceTable() *schema.Resource {
 							ValidateFunc: validation.IntAtLeast(1),
 						},
 						"throughput_mode": {
-							Type:         schema.TypeString,
-							Optional:     true,
-							Computed:     true,
-							ValidateFunc: validation.StringInSlice(keyspaces.ThroughputMode_Values(), false),
+							Type:             schema.TypeString,
+							Optional:         true,
+							Computed:         true,
+							ValidateDiagFunc: enum.Validate[types.ThroughputMode](),
 						},
 						"write_capacity_units": {
 							Type:         schema.TypeInt,
@@ -89,6 +98,20 @@ func ResourceTable() *schema.Resource {
 					},
 				},
 			},
+			"client_side_timestamps": {
+				Type:     schema.TypeList,
+				Optional: true,
+				MaxItems: 1,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"status": {
+							Type:             schema.TypeString,
+							Required:         true,
+							ValidateDiagFunc: enum.Validate[types.ClientSideTimestampsStatus](),
+						},
+					},
+				},
+			},
 			"comment": {
 				Type:     schema.TypeList,
 				Optional: true,
@@ -124,10 +147,10 @@ func ResourceTable() *schema.Resource {
 							ValidateFunc: verify.ValidARN,
 						},
 						"type": {
-							Type:         schema.TypeString,
-							Optional:     true,
-							Computed:     true,
-							ValidateFunc: validation.StringInSlice(keyspaces.EncryptionType_Values(), false),
+							Type:             schema.TypeString,
+							Optional:         true,
+							Computed:         true,
+							ValidateDiagFunc: enum.Validate[types.EncryptionType](),
 						},
 					},
 				},
@@ -137,7 +160,7 @@ func ResourceTable() *schema.Resource {
 				ForceNew: true,
 				Required: true,
 				ValidateFunc: validation.StringMatch(
-					regexp.MustCompile(`^[a-zA-Z0-9][a-zA-Z0-9_]{0,47}$`),
+					regexache.MustCompile(`^[0-9A-Za-z][0-9A-Za-z_]{0,47}$`),
 					"The keyspace name can have up to 48 characters. It must begin with an alpha-numeric character and can only contain alpha-numeric characters and underscores.",
 				),
 			},
@@ -149,10 +172,10 @@ func ResourceTable() *schema.Resource {
 				Elem: &schema.Resource{
 					Schema: map[string]*schema.Schema{
 						"status": {
-							Type:         schema.TypeString,
-							Optional:     true,
-							Computed:     true,
-							ValidateFunc: validation.StringInSlice(keyspaces.PointInTimeRecoveryStatus_Values(), false),
+							Type:             schema.TypeString,
+							Optional:         true,
+							Computed:         true,
+							ValidateDiagFunc: enum.Validate[types.PointInTimeRecoveryStatus](),
 						},
 					},
 				},
@@ -174,15 +197,15 @@ func ResourceTable() *schema.Resource {
 										Required: true,
 										ForceNew: true,
 										ValidateFunc: validation.StringMatch(
-											regexp.MustCompile(`^[a-z0-9_]{1,48}$`),
+											regexache.MustCompile(`^[0-9a-z_]{1,48}$`),
 											"The column name can have up to 48 characters. It can only contain lowercase alpha-numeric characters and underscores.",
 										),
 									},
 									"order_by": {
-										Type:         schema.TypeString,
-										Required:     true,
-										ForceNew:     true,
-										ValidateFunc: validation.StringInSlice(keyspaces.SortOrder_Values(), false),
+										Type:             schema.TypeString,
+										Required:         true,
+										ForceNew:         true,
+										ValidateDiagFunc: enum.Validate[types.SortOrder](),
 									},
 								},
 							},
@@ -196,7 +219,7 @@ func ResourceTable() *schema.Resource {
 										Type:     schema.TypeString,
 										Required: true,
 										ValidateFunc: validation.StringMatch(
-											regexp.MustCompile(`^[a-z0-9_]{1,48}$`),
+											regexache.MustCompile(`^[0-9a-z_]{1,48}$`),
 											"The column name can have up to 48 characters. It can only contain lowercase alpha-numeric characters and underscores.",
 										),
 									},
@@ -204,7 +227,7 @@ func ResourceTable() *schema.Resource {
 										Type:     schema.TypeString,
 										Required: true,
 										ValidateFunc: validation.StringMatch(
-											regexp.MustCompile(`^[a-z0-9]+(\<[a-z0-9]+(, *[a-z0-9]+){0,1}\>)?$`),
+											regexache.MustCompile(`^[0-9a-z]+(\<[0-9a-z]+(, *[0-9a-z]+){0,1}\>)?$`),
 											"The type must consist of lower case alphanumerics and an optional list of upto two lower case alphanumerics enclosed in angle brackets '<>'.",
 										),
 									},
@@ -222,7 +245,7 @@ func ResourceTable() *schema.Resource {
 										Required: true,
 										ForceNew: true,
 										ValidateFunc: validation.StringMatch(
-											regexp.MustCompile(`^[a-z0-9_]{1,48}$`),
+											regexache.MustCompile(`^[0-9a-z_]{1,48}$`),
 											"The column name can have up to 48 characters. It can only contain lowercase alpha-numeric characters and underscores.",
 										),
 									},
@@ -240,7 +263,7 @@ func ResourceTable() *schema.Resource {
 										Required: true,
 										ForceNew: true,
 										ValidateFunc: validation.StringMatch(
-											regexp.MustCompile(`^[a-z0-9_]{1,48}$`),
+											regexache.MustCompile(`^[0-9a-z_]{1,48}$`),
 											"The column name can have up to 48 characters. It can only contain lowercase alpha-numeric characters and underscores.",
 										),
 									},
@@ -255,7 +278,7 @@ func ResourceTable() *schema.Resource {
 				ForceNew: true,
 				Required: true,
 				ValidateFunc: validation.StringMatch(
-					regexp.MustCompile(`^[a-zA-Z0-9_]{1,48}$`),
+					regexache.MustCompile(`^[0-9A-Za-z_]{1,48}$`),
 					"The table name can have up to 48 characters. It can only contain alpha-numeric characters and underscores.",
 				),
 			},
@@ -268,9 +291,9 @@ func ResourceTable() *schema.Resource {
 				Elem: &schema.Resource{
 					Schema: map[string]*schema.Schema{
 						"status": {
-							Type:         schema.TypeString,
-							Required:     true,
-							ValidateFunc: validation.StringInSlice(keyspaces.TimeToLiveStatus_Values(), false),
+							Type:             schema.TypeString,
+							Required:         true,
+							ValidateDiagFunc: enum.Validate[types.TimeToLiveStatus](),
 						},
 					},
 				},
@@ -280,11 +303,11 @@ func ResourceTable() *schema.Resource {
 }
 
 func resourceTableCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).KeyspacesConn(ctx)
+	conn := meta.(*conns.AWSClient).KeyspacesClient(ctx)
 
 	keyspaceName := d.Get("keyspace_name").(string)
 	tableName := d.Get("table_name").(string)
-	id := TableCreateResourceID(keyspaceName, tableName)
+	id := tableCreateResourceID(keyspaceName, tableName)
 	input := &keyspaces.CreateTableInput{
 		KeyspaceName: aws.String(keyspaceName),
 		TableName:    aws.String(tableName),
@@ -295,12 +318,16 @@ func resourceTableCreate(ctx context.Context, d *schema.ResourceData, meta inter
 		input.CapacitySpecification = expandCapacitySpecification(v.([]interface{})[0].(map[string]interface{}))
 	}
 
+	if v, ok := d.GetOk("client_side_timestamps"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
+		input.ClientSideTimestamps = expandClientSideTimestamps(v.([]interface{})[0].(map[string]interface{}))
+	}
+
 	if v, ok := d.GetOk("comment"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
 		input.Comment = expandComment(v.([]interface{})[0].(map[string]interface{}))
 	}
 
 	if v, ok := d.GetOk("default_time_to_live"); ok {
-		input.DefaultTimeToLive = aws.Int64(int64(v.(int)))
+		input.DefaultTimeToLive = aws.Int32(int32(v.(int)))
 	}
 
 	if v, ok := d.GetOk("encryption_specification"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
@@ -319,7 +346,7 @@ func resourceTableCreate(ctx context.Context, d *schema.ResourceData, meta inter
 		input.Ttl = expandTimeToLive(v.([]interface{})[0].(map[string]interface{}))
 	}
 
-	_, err := conn.CreateTableWithContext(ctx, input)
+	_, err := conn.CreateTable(ctx, input)
 
 	if err != nil {
 		return diag.Errorf("creating Keyspaces Table (%s): %s", id, err)
@@ -335,15 +362,15 @@ func resourceTableCreate(ctx context.Context, d *schema.ResourceData, meta inter
 }
 
 func resourceTableRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).KeyspacesConn(ctx)
+	conn := meta.(*conns.AWSClient).KeyspacesClient(ctx)
 
-	keyspaceName, tableName, err := TableParseResourceID(d.Id())
+	keyspaceName, tableName, err := tableParseResourceID(d.Id())
 
 	if err != nil {
 		return diag.FromErr(err)
 	}
 
-	table, err := FindTableByTwoPartKey(ctx, conn, keyspaceName, tableName)
+	table, err := findTableByTwoPartKey(ctx, conn, keyspaceName, tableName)
 
 	if !d.IsNewResource() && tfresource.NotFound(err) {
 		log.Printf("[WARN] Keyspaces Table (%s) not found, removing from state", d.Id())
@@ -363,6 +390,13 @@ func resourceTableRead(ctx context.Context, d *schema.ResourceData, meta interfa
 	} else {
 		d.Set("capacity_specification", nil)
 	}
+	if table.ClientSideTimestamps != nil {
+		if err := d.Set("client_side_timestamps", []interface{}{flattenClientSideTimestamps(table.ClientSideTimestamps)}); err != nil {
+			return diag.Errorf("setting client_side_timestamps: %s", err)
+		}
+	} else {
+		d.Set("client_side_timestamps", nil)
+	}
 	if table.Comment != nil {
 		if err := d.Set("comment", []interface{}{flattenComment(table.Comment)}); err != nil {
 			return diag.Errorf("setting comment: %s", err)
@@ -406,9 +440,9 @@ func resourceTableRead(ctx context.Context, d *schema.ResourceData, meta interfa
 }
 
 func resourceTableUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).KeyspacesConn(ctx)
+	conn := meta.(*conns.AWSClient).KeyspacesClient(ctx)
 
-	keyspaceName, tableName, err := TableParseResourceID(d.Id())
+	keyspaceName, tableName, err := tableParseResourceID(d.Id())
 
 	if err != nil {
 		return diag.FromErr(err)
@@ -425,8 +459,7 @@ func resourceTableUpdate(ctx context.Context, d *schema.ResourceData, meta inter
 					TableName:             aws.String(tableName),
 				}
 
-				log.Printf("[DEBUG] Updating Keyspaces Table: %s", input)
-				_, err := conn.UpdateTableWithContext(ctx, input)
+				_, err := conn.UpdateTable(ctx, input)
 
 				if err != nil {
 					return diag.Errorf("updating Keyspaces Table (%s) CapacitySpecification: %s", d.Id(), err)
@@ -438,15 +471,34 @@ func resourceTableUpdate(ctx context.Context, d *schema.ResourceData, meta inter
 			}
 		}
 
+		if d.HasChange("client_side_timestamps") {
+			if v, ok := d.GetOk("client_side_timestamps"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
+				input := &keyspaces.UpdateTableInput{
+					ClientSideTimestamps: expandClientSideTimestamps(v.([]interface{})[0].(map[string]interface{})),
+					KeyspaceName:         aws.String(keyspaceName),
+					TableName:            aws.String(tableName),
+				}
+
+				_, err := conn.UpdateTable(ctx, input)
+
+				if err != nil {
+					return diag.Errorf("updating Keyspaces Table (%s) ClientSideTimestamps: %s", d.Id(), err)
+				}
+
+				if _, err := waitTableUpdated(ctx, conn, keyspaceName, tableName, d.Timeout(schema.TimeoutUpdate)); err != nil {
+					return diag.Errorf("waiting for Keyspaces Table (%s) ClientSideTimestamps update: %s", d.Id(), err)
+				}
+			}
+		}
+
 		if d.HasChange("default_time_to_live") {
 			input := &keyspaces.UpdateTableInput{
-				DefaultTimeToLive: aws.Int64(int64(d.Get("default_time_to_live").(int))),
+				DefaultTimeToLive: aws.Int32(int32(d.Get("default_time_to_live").(int))),
 				KeyspaceName:      aws.String(keyspaceName),
 				TableName:         aws.String(tableName),
 			}
 
-			log.Printf("[DEBUG] Updating Keyspaces Table: %s", input)
-			_, err := conn.UpdateTableWithContext(ctx, input)
+			_, err := conn.UpdateTable(ctx, input)
 
 			if err != nil {
 				return diag.Errorf("updating Keyspaces Table (%s) DefaultTimeToLive: %s", d.Id(), err)
@@ -465,8 +517,7 @@ func resourceTableUpdate(ctx context.Context, d *schema.ResourceData, meta inter
 					TableName:               aws.String(tableName),
 				}
 
-				log.Printf("[DEBUG] Updating Keyspaces Table: %s", input)
-				_, err := conn.UpdateTableWithContext(ctx, input)
+				_, err := conn.UpdateTable(ctx, input)
 
 				if err != nil {
 					return diag.Errorf("updating Keyspaces Table (%s) EncryptionSpecification: %s", d.Id(), err)
@@ -486,8 +537,7 @@ func resourceTableUpdate(ctx context.Context, d *schema.ResourceData, meta inter
 					TableName:           aws.String(tableName),
 				}
 
-				log.Printf("[DEBUG] Updating Keyspaces Table: %s", input)
-				_, err := conn.UpdateTableWithContext(ctx, input)
+				_, err := conn.UpdateTable(ctx, input)
 
 				if err != nil {
 					return diag.Errorf("updating Keyspaces Table (%s) PointInTimeRecovery: %s", d.Id(), err)
@@ -507,8 +557,7 @@ func resourceTableUpdate(ctx context.Context, d *schema.ResourceData, meta inter
 					Ttl:          expandTimeToLive(v.([]interface{})[0].(map[string]interface{})),
 				}
 
-				log.Printf("[DEBUG] Updating Keyspaces Table: %s", input)
-				_, err := conn.UpdateTableWithContext(ctx, input)
+				_, err := conn.UpdateTable(ctx, input)
 
 				if err != nil {
 					return diag.Errorf("updating Keyspaces Table (%s) Ttl: %s", d.Id(), err)
@@ -543,8 +592,7 @@ func resourceTableUpdate(ctx context.Context, d *schema.ResourceData, meta inter
 						TableName:    aws.String(tableName),
 					}
 
-					log.Printf("[DEBUG] Updating Keyspaces Table: %s", input)
-					_, err := conn.UpdateTableWithContext(ctx, input)
+					_, err := conn.UpdateTable(ctx, input)
 
 					if err != nil {
 						return diag.Errorf("updating Keyspaces Table (%s) AddColumns: %s", d.Id(), err)
@@ -562,21 +610,21 @@ func resourceTableUpdate(ctx context.Context, d *schema.ResourceData, meta inter
 }
 
 func resourceTableDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).KeyspacesConn(ctx)
+	conn := meta.(*conns.AWSClient).KeyspacesClient(ctx)
 
-	keyspaceName, tableName, err := TableParseResourceID(d.Id())
+	keyspaceName, tableName, err := tableParseResourceID(d.Id())
 
 	if err != nil {
 		return diag.FromErr(err)
 	}
 
 	log.Printf("[DEBUG] Deleting Keyspaces Table: (%s)", d.Id())
-	_, err = conn.DeleteTableWithContext(ctx, &keyspaces.DeleteTableInput{
+	_, err = conn.DeleteTable(ctx, &keyspaces.DeleteTableInput{
 		KeyspaceName: aws.String(keyspaceName),
 		TableName:    aws.String(tableName),
 	})
 
-	if tfawserr.ErrCodeEquals(err, keyspaces.ErrCodeResourceNotFoundException) {
+	if errs.IsA[*types.ResourceNotFoundException](err) {
 		return nil
 	}
 
@@ -593,14 +641,14 @@ func resourceTableDelete(ctx context.Context, d *schema.ResourceData, meta inter
 
 const tableIDSeparator = "/"
 
-func TableCreateResourceID(keyspaceName, tableName string) string {
+func tableCreateResourceID(keyspaceName, tableName string) string {
 	parts := []string{keyspaceName, tableName}
 	id := strings.Join(parts, tableIDSeparator)
 
 	return id
 }
 
-func TableParseResourceID(id string) (string, string, error) {
+func tableParseResourceID(id string) (string, string, error) {
 	parts := strings.Split(id, tableIDSeparator)
 
 	if len(parts) == 2 && parts[0] != "" && parts[1] != "" {
@@ -610,9 +658,42 @@ func TableParseResourceID(id string) (string, string, error) {
 	return "", "", fmt.Errorf("unexpected format for ID (%[1]s), expected KEYSPACE-NAME%[2]sTABLE-NAME", id, tableIDSeparator)
 }
 
-func statusTable(ctx context.Context, conn *keyspaces.Keyspaces, keyspaceName, tableName string) retry.StateRefreshFunc {
+func findTableByTwoPartKey(ctx context.Context, conn *keyspaces.Client, keyspaceName, tableName string) (*keyspaces.GetTableOutput, error) {
+	input := keyspaces.GetTableInput{
+		KeyspaceName: aws.String(keyspaceName),
+		TableName:    aws.String(tableName),
+	}
+
+	output, err := conn.GetTable(ctx, &input)
+
+	if errs.IsA[*types.ResourceNotFoundException](err) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	if output == nil {
+		return nil, tfresource.NewEmptyResultError(input)
+	}
+
+	if status := output.Status; status == types.TableStatusDeleted {
+		return nil, &retry.NotFoundError{
+			Message:     string(status),
+			LastRequest: input,
+		}
+	}
+
+	return output, nil
+}
+
+func statusTable(ctx context.Context, conn *keyspaces.Client, keyspaceName, tableName string) retry.StateRefreshFunc {
 	return func() (interface{}, string, error) {
-		output, err := FindTableByTwoPartKey(ctx, conn, keyspaceName, tableName)
+		output, err := findTableByTwoPartKey(ctx, conn, keyspaceName, tableName)
 
 		if tfresource.NotFound(err) {
 			return nil, "", nil
@@ -622,14 +703,14 @@ func statusTable(ctx context.Context, conn *keyspaces.Keyspaces, keyspaceName, t
 			return nil, "", err
 		}
 
-		return output, aws.StringValue(output.Status), nil
+		return output, string(output.Status), nil
 	}
 }
 
-func waitTableCreated(ctx context.Context, conn *keyspaces.Keyspaces, keyspaceName, tableName string, timeout time.Duration) (*keyspaces.GetTableOutput, error) {
+func waitTableCreated(ctx context.Context, conn *keyspaces.Client, keyspaceName, tableName string, timeout time.Duration) (*keyspaces.GetTableOutput, error) {
 	stateConf := &retry.StateChangeConf{
-		Pending: []string{keyspaces.TableStatusCreating},
-		Target:  []string{keyspaces.TableStatusActive},
+		Pending: enum.Slice(types.TableStatusCreating),
+		Target:  enum.Slice(types.TableStatusActive),
 		Refresh: statusTable(ctx, conn, keyspaceName, tableName),
 		Timeout: timeout,
 	}
@@ -643,9 +724,9 @@ func waitTableCreated(ctx context.Context, conn *keyspaces.Keyspaces, keyspaceNa
 	return nil, err
 }
 
-func waitTableDeleted(ctx context.Context, conn *keyspaces.Keyspaces, keyspaceName, tableName string, timeout time.Duration) (*keyspaces.GetTableOutput, error) {
+func waitTableDeleted(ctx context.Context, conn *keyspaces.Client, keyspaceName, tableName string, timeout time.Duration) (*keyspaces.GetTableOutput, error) {
 	stateConf := &retry.StateChangeConf{
-		Pending: []string{keyspaces.TableStatusActive, keyspaces.TableStatusDeleting},
+		Pending: enum.Slice(types.TableStatusActive, types.TableStatusDeleting),
 		Target:  []string{},
 		Refresh: statusTable(ctx, conn, keyspaceName, tableName),
 		Timeout: timeout,
@@ -660,10 +741,10 @@ func waitTableDeleted(ctx context.Context, conn *keyspaces.Keyspaces, keyspaceNa
 	return nil, err
 }
 
-func waitTableUpdated(ctx context.Context, conn *keyspaces.Keyspaces, keyspaceName, tableName string, timeout time.Duration) (*keyspaces.GetTableOutput, error) { //nolint:unparam
+func waitTableUpdated(ctx context.Context, conn *keyspaces.Client, keyspaceName, tableName string, timeout time.Duration) (*keyspaces.GetTableOutput, error) { //nolint:unparam
 	stateConf := &retry.StateChangeConf{
-		Pending: []string{keyspaces.TableStatusUpdating},
-		Target:  []string{keyspaces.TableStatusActive},
+		Pending: enum.Slice(types.TableStatusUpdating),
+		Target:  enum.Slice(types.TableStatusActive),
 		Refresh: statusTable(ctx, conn, keyspaceName, tableName),
 		Timeout: timeout,
 		Delay:   10 * time.Second,
@@ -678,19 +759,19 @@ func waitTableUpdated(ctx context.Context, conn *keyspaces.Keyspaces, keyspaceNa
 	return nil, err
 }
 
-func expandCapacitySpecification(tfMap map[string]interface{}) *keyspaces.CapacitySpecification {
+func expandCapacitySpecification(tfMap map[string]interface{}) *types.CapacitySpecification {
 	if tfMap == nil {
 		return nil
 	}
 
-	apiObject := &keyspaces.CapacitySpecification{}
+	apiObject := &types.CapacitySpecification{}
 
 	if v, ok := tfMap["read_capacity_units"].(int); ok && v != 0 {
 		apiObject.ReadCapacityUnits = aws.Int64(int64(v))
 	}
 
 	if v, ok := tfMap["throughput_mode"].(string); ok && v != "" {
-		apiObject.ThroughputMode = aws.String(v)
+		apiObject.ThroughputMode = types.ThroughputMode(v)
 	}
 
 	if v, ok := tfMap["write_capacity_units"].(int); ok && v != 0 {
@@ -700,12 +781,26 @@ func expandCapacitySpecification(tfMap map[string]interface{}) *keyspaces.Capaci
 	return apiObject
 }
 
-func expandComment(tfMap map[string]interface{}) *keyspaces.Comment {
+func expandClientSideTimestamps(tfMap map[string]interface{}) *types.ClientSideTimestamps {
+	if tfMap == nil {
+		return nil
+	}
+
+	apiObject := &types.ClientSideTimestamps{}
+
+	if v, ok := tfMap["status"].(string); ok && v != "" {
+		apiObject.Status = types.ClientSideTimestampsStatus(v)
+	}
+
+	return apiObject
+}
+
+func expandComment(tfMap map[string]interface{}) *types.Comment {
 	if tfMap == nil {
 		return nil
 	}
 
-	apiObject := &keyspaces.Comment{}
+	apiObject := &types.Comment{}
 
 	if v, ok := tfMap["message"].(string); ok && v != "" {
 		apiObject.Message = aws.String(v)
@@ -714,44 +809,44 @@ func expandComment(tfMap map[string]interface{}) *keyspaces.Comment {
 	return apiObject
 }
 
-func expandEncryptionSpecification(tfMap map[string]interface{}) *keyspaces.EncryptionSpecification {
+func expandEncryptionSpecification(tfMap map[string]interface{}) *types.EncryptionSpecification {
 	if tfMap == nil {
 		return nil
 	}
 
-	apiObject := &keyspaces.EncryptionSpecification{}
+	apiObject := &types.EncryptionSpecification{}
 
 	if v, ok := tfMap["kms_key_identifier"].(string); ok && v != "" {
 		apiObject.KmsKeyIdentifier = aws.String(v)
 	}
 
 	if v, ok := tfMap["type"].(string); ok && v != "" {
-		apiObject.Type = aws.String(v)
+		apiObject.Type = types.EncryptionType(v)
 	}
 
 	return apiObject
 }
 
-func expandPointInTimeRecovery(tfMap map[string]interface{}) *keyspaces.PointInTimeRecovery {
+func expandPointInTimeRecovery(tfMap map[string]interface{}) *types.PointInTimeRecovery {
 	if tfMap == nil {
 		return nil
 	}
 
-	apiObject := &keyspaces.PointInTimeRecovery{}
+	apiObject := &types.PointInTimeRecovery{}
 
 	if v, ok := tfMap["status"].(string); ok && v != "" {
-		apiObject.Status = aws.String(v)
+		apiObject.Status = types.PointInTimeRecoveryStatus(v)
 	}
 
 	return apiObject
 }
 
-func expandSchemaDefinition(tfMap map[string]interface{}) *keyspaces.SchemaDefinition {
+func expandSchemaDefinition(tfMap map[string]interface{}) *types.SchemaDefinition {
 	if tfMap == nil {
 		return nil
 	}
 
-	apiObject := &keyspaces.SchemaDefinition{}
+	apiObject := &types.SchemaDefinition{}
 
 	if v, ok := tfMap["clustering_key"].([]interface{}); ok && len(v) > 0 {
 		apiObject.ClusteringKeys = expandClusteringKeys(v)
@@ -772,26 +867,26 @@ func expandSchemaDefinition(tfMap map[string]interface{}) *keyspaces.SchemaDefin
 	return apiObject
 }
 
-func expandTimeToLive(tfMap map[string]interface{}) *keyspaces.TimeToLive {
+func expandTimeToLive(tfMap map[string]interface{}) *types.TimeToLive {
 	if tfMap == nil {
 		return nil
 	}
 
-	apiObject := &keyspaces.TimeToLive{}
+	apiObject := &types.TimeToLive{}
 
 	if v, ok := tfMap["status"].(string); ok && v != "" {
-		apiObject.Status = aws.String(v)
+		apiObject.Status = types.TimeToLiveStatus(v)
 	}
 
 	return apiObject
 }
 
-func expandColumnDefinition(tfMap map[string]interface{}) *keyspaces.ColumnDefinition {
+func expandColumnDefinition(tfMap map[string]interface{}) *types.ColumnDefinition {
 	if tfMap == nil {
 		return nil
 	}
 
-	apiObject := &keyspaces.ColumnDefinition{}
+	apiObject := &types.ColumnDefinition{}
 
 	if v, ok := tfMap["name"].(string); ok && v != "" {
 		apiObject.Name = aws.String(v)
@@ -804,12 +899,12 @@ func expandColumnDefinition(tfMap map[string]interface{}) *keyspaces.ColumnDefin
 	return apiObject
 }
 
-func expandColumnDefinitions(tfList []interface{}) []*keyspaces.ColumnDefinition {
+func expandColumnDefinitions(tfList []interface{}) []types.ColumnDefinition {
 	if len(tfList) == 0 {
 		return nil
 	}
 
-	var apiObjects []*keyspaces.ColumnDefinition
+	var apiObjects []types.ColumnDefinition
 
 	for _, tfMapRaw := range tfList {
 		tfMap, ok := tfMapRaw.(map[string]interface{})
@@ -824,36 +919,36 @@ func expandColumnDefinitions(tfList []interface{}) []*keyspaces.ColumnDefinition
 			continue
 		}
 
-		apiObjects = append(apiObjects, apiObject)
+		apiObjects = append(apiObjects, *apiObject)
 	}
 
 	return apiObjects
 }
 
-func expandClusteringKey(tfMap map[string]interface{}) *keyspaces.ClusteringKey {
+func expandClusteringKey(tfMap map[string]interface{}) *types.ClusteringKey {
 	if tfMap == nil {
 		return nil
 	}
 
-	apiObject := &keyspaces.ClusteringKey{}
+	apiObject := &types.ClusteringKey{}
 
 	if v, ok := tfMap["name"].(string); ok && v != "" {
 		apiObject.Name = aws.String(v)
 	}
 
 	if v, ok := tfMap["order_by"].(string); ok && v != "" {
-		apiObject.OrderBy = aws.String(v)
+		apiObject.OrderBy = types.SortOrder(v)
 	}
 
 	return apiObject
 }
 
-func expandClusteringKeys(tfList []interface{}) []*keyspaces.ClusteringKey {
+func expandClusteringKeys(tfList []interface{}) []types.ClusteringKey {
 	if len(tfList) == 0 {
 		return nil
 	}
 
-	var apiObjects []*keyspaces.ClusteringKey
+	var apiObjects []types.ClusteringKey
 
 	for _, tfMapRaw := range tfList {
 		tfMap, ok := tfMapRaw.(map[string]interface{})
@@ -868,18 +963,18 @@ func expandClusteringKeys(tfList []interface{}) []*keyspaces.ClusteringKey {
 			continue
 		}
 
-		apiObjects = append(apiObjects, apiObject)
+		apiObjects = append(apiObjects, *apiObject)
 	}
 
 	return apiObjects
 }
 
-func expandPartitionKey(tfMap map[string]interface{}) *keyspaces.PartitionKey {
+func expandPartitionKey(tfMap map[string]interface{}) *types.PartitionKey {
 	if tfMap == nil {
 		return nil
 	}
 
-	apiObject := &keyspaces.PartitionKey{}
+	apiObject := &types.PartitionKey{}
 
 	if v, ok := tfMap["name"].(string); ok && v != "" {
 		apiObject.Name = aws.String(v)
@@ -888,12 +983,12 @@ func expandPartitionKey(tfMap map[string]interface{}) *keyspaces.PartitionKey {
 	return apiObject
 }
 
-func expandPartitionKeys(tfList []interface{}) []*keyspaces.PartitionKey {
+func expandPartitionKeys(tfList []interface{}) []types.PartitionKey {
 	if len(tfList) == 0 {
 		return nil
 	}
 
-	var apiObjects []*keyspaces.PartitionKey
+	var apiObjects []types.PartitionKey
 
 	for _, tfMapRaw := range tfList {
 		tfMap, ok := tfMapRaw.(map[string]interface{})
@@ -908,18 +1003,18 @@ func expandPartitionKeys(tfList []interface{}) []*keyspaces.PartitionKey {
 			continue
 		}
 
-		apiObjects = append(apiObjects, apiObject)
+		apiObjects = append(apiObjects, *apiObject)
 	}
 
 	return apiObjects
 }
 
-func expandStaticColumn(tfMap map[string]interface{}) *keyspaces.StaticColumn {
+func expandStaticColumn(tfMap map[string]interface{}) *types.StaticColumn {
 	if tfMap == nil {
 		return nil
 	}
 
-	apiObject := &keyspaces.StaticColumn{}
+	apiObject := &types.StaticColumn{}
 
 	if v, ok := tfMap["name"].(string); ok && v != "" {
 		apiObject.Name = aws.String(v)
@@ -928,12 +1023,12 @@ func expandStaticColumn(tfMap map[string]interface{}) *keyspaces.StaticColumn {
 	return apiObject
 }
 
-func expandStaticColumns(tfList []interface{}) []*keyspaces.StaticColumn {
+func expandStaticColumns(tfList []interface{}) []types.StaticColumn {
 	if len(tfList) == 0 {
 		return nil
 	}
 
-	var apiObjects []*keyspaces.StaticColumn
+	var apiObjects []types.StaticColumn
 
 	for _, tfMapRaw := range tfList {
 		tfMap, ok := tfMapRaw.(map[string]interface{})
@@ -948,35 +1043,45 @@ func expandStaticColumns(tfList []interface{}) []*keyspaces.StaticColumn {
 			continue
 		}
 
-		apiObjects = append(apiObjects, apiObject)
+		apiObjects = append(apiObjects, *apiObject)
 	}
 
 	return apiObjects
 }
 
-func flattenCapacitySpecificationSummary(apiObject *keyspaces.CapacitySpecificationSummary) map[string]interface{} {
+func flattenCapacitySpecificationSummary(apiObject *types.CapacitySpecificationSummary) map[string]interface{} {
 	if apiObject == nil {
 		return nil
 	}
 
-	tfMap := map[string]interface{}{}
+	tfMap := map[string]interface{}{
+		"throughput_mode": apiObject.ThroughputMode,
+	}
 
 	if v := apiObject.ReadCapacityUnits; v != nil {
-		tfMap["read_capacity_units"] = aws.Int64Value(v)
+		tfMap["read_capacity_units"] = aws.ToInt64(v)
 	}
 
-	if v := apiObject.ThroughputMode; v != nil {
-		tfMap["throughput_mode"] = aws.StringValue(v)
+	if v := apiObject.WriteCapacityUnits; v != nil {
+		tfMap["write_capacity_units"] = aws.ToInt64(v)
 	}
 
-	if v := apiObject.WriteCapacityUnits; v != nil {
-		tfMap["write_capacity_units"] = aws.Int64Value(v)
+	return tfMap
+}
+
+func flattenClientSideTimestamps(apiObject *types.ClientSideTimestamps) map[string]interface{} {
+	if apiObject == nil {
+		return nil
+	}
+
+	tfMap := map[string]interface{}{
+		"status": apiObject.Status,
 	}
 
 	return tfMap
 }
 
-func flattenComment(apiObject *keyspaces.Comment) map[string]interface{} {
+func flattenComment(apiObject *types.Comment) map[string]interface{} {
 	if apiObject == nil {
 		return nil
 	}
@@ -984,45 +1089,41 @@ func flattenComment(apiObject *keyspaces.Comment) map[string]interface{} {
 	tfMap := map[string]interface{}{}
 
 	if v := apiObject.Message; v != nil {
-		tfMap["message"] = aws.StringValue(v)
+		tfMap["message"] = aws.ToString(v)
 	}
 
 	return tfMap
 }
 
-func flattenEncryptionSpecification(apiObject *keyspaces.EncryptionSpecification) map[string]interface{} {
+func flattenEncryptionSpecification(apiObject *types.EncryptionSpecification) map[string]interface{} {
 	if apiObject == nil {
 		return nil
 	}
 
-	tfMap := map[string]interface{}{}
-
-	if v := apiObject.KmsKeyIdentifier; v != nil {
-		tfMap["kms_key_identifier"] = aws.StringValue(v)
+	tfMap := map[string]interface{}{
+		"type": apiObject.Type,
 	}
 
-	if v := apiObject.Type; v != nil {
-		tfMap["type"] = aws.StringValue(v)
+	if v := apiObject.KmsKeyIdentifier; v != nil {
+		tfMap["kms_key_identifier"] = aws.ToString(v)
 	}
 
 	return tfMap
 }
 
-func flattenPointInTimeRecoverySummary(apiObject *keyspaces.PointInTimeRecoverySummary) map[string]interface{} {
+func flattenPointInTimeRecoverySummary(apiObject *types.PointInTimeRecoverySummary) map[string]interface{} {
 	if apiObject == nil {
 		return nil
 	}
 
-	tfMap := map[string]interface{}{}
-
-	if v := apiObject.Status; v != nil {
-		tfMap["status"] = aws.StringValue(v)
+	tfMap := map[string]interface{}{
+		"status": apiObject.Status,
 	}
 
 	return tfMap
 }
 
-func flattenSchemaDefinition(apiObject *keyspaces.SchemaDefinition) map[string]interface{} {
+func flattenSchemaDefinition(apiObject *types.SchemaDefinition) map[string]interface{} {
 	if apiObject == nil {
 		return nil
 	}
@@ -1048,21 +1149,19 @@ func flattenSchemaDefinition(apiObject *keyspaces.SchemaDefinition) map[string]i
 	return tfMap
 }
 
-func flattenTimeToLive(apiObject *keyspaces.TimeToLive) map[string]interface{} {
+func flattenTimeToLive(apiObject *types.TimeToLive) map[string]interface{} {
 	if apiObject == nil {
 		return nil
 	}
 
-	tfMap := map[string]interface{}{}
-
-	if v := apiObject.Status; v != nil {
-		tfMap["status"] = aws.StringValue(v)
+	tfMap := map[string]interface{}{
+		"status": apiObject.Status,
 	}
 
 	return tfMap
 }
 
-func flattenColumnDefinition(apiObject *keyspaces.ColumnDefinition) map[string]interface{} {
+func flattenColumnDefinition(apiObject *types.ColumnDefinition) map[string]interface{} {
 	if apiObject == nil {
 		return nil
 	}
@@ -1070,17 +1169,17 @@ func flattenColumnDefinition(apiObject *keyspaces.ColumnDefinition) map[string]i
 	tfMap := map[string]interface{}{}
 
 	if v := apiObject.Name; v != nil {
-		tfMap["name"] = aws.StringValue(v)
+		tfMap["name"] = aws.ToString(v)
 	}
 
 	if v := apiObject.Type; v != nil {
-		tfMap["type"] = aws.StringValue(v)
+		tfMap["type"] = aws.ToString(v)
 	}
 
 	return tfMap
 }
 
-func flattenColumnDefinitions(apiObjects []*keyspaces.ColumnDefinition) []interface{} {
+func flattenColumnDefinitions(apiObjects []types.ColumnDefinition) []interface{} {
 	if len(apiObjects) == 0 {
 		return nil
 	}
@@ -1088,35 +1187,29 @@ func flattenColumnDefinitions(apiObjects []*keyspaces.ColumnDefinition) []interf
 	var tfList []interface{}
 
 	for _, apiObject := range apiObjects {
-		if apiObject == nil {
-			continue
-		}
-
-		tfList = append(tfList, flattenColumnDefinition(apiObject))
+		tfList = append(tfList, flattenColumnDefinition(&apiObject))
 	}
 
 	return tfList
 }
 
-func flattenClusteringKey(apiObject *keyspaces.ClusteringKey) map[string]interface{} {
+func flattenClusteringKey(apiObject *types.ClusteringKey) map[string]interface{} {
 	if apiObject == nil {
 		return nil
 	}
 
-	tfMap := map[string]interface{}{}
-
-	if v := apiObject.Name; v != nil {
-		tfMap["name"] = aws.StringValue(v)
+	tfMap := map[string]interface{}{
+		"order_by": apiObject.OrderBy,
 	}
 
-	if v := apiObject.OrderBy; v != nil {
-		tfMap["order_by"] = aws.StringValue(v)
+	if v := apiObject.Name; v != nil {
+		tfMap["name"] = aws.ToString(v)
 	}
 
 	return tfMap
 }
 
-func flattenClusteringKeys(apiObjects []*keyspaces.ClusteringKey) []interface{} {
+func flattenClusteringKeys(apiObjects []types.ClusteringKey) []interface{} {
 	if len(apiObjects) == 0 {
 		return nil
 	}
@@ -1124,17 +1217,13 @@ func flattenClusteringKeys(apiObjects []*keyspaces.ClusteringKey) []interface{}
 	var tfList []interface{}
 
 	for _, apiObject := range apiObjects {
-		if apiObject == nil {
-			continue
-		}
-
-		tfList = append(tfList, flattenClusteringKey(apiObject))
+		tfList = append(tfList, flattenClusteringKey(&apiObject))
 	}
 
 	return tfList
 }
 
-func flattenPartitionKey(apiObject *keyspaces.PartitionKey) map[string]interface{} {
+func flattenPartitionKey(apiObject *types.PartitionKey) map[string]interface{} {
 	if apiObject == nil {
 		return nil
 	}
@@ -1142,13 +1231,13 @@ func flattenPartitionKey(apiObject *keyspaces.PartitionKey) map[string]interface
 	tfMap := map[string]interface{}{}
 
 	if v := apiObject.Name; v != nil {
-		tfMap["name"] = aws.StringValue(v)
+		tfMap["name"] = aws.ToString(v)
 	}
 
 	return tfMap
 }
 
-func flattenPartitionKeys(apiObjects []*keyspaces.PartitionKey) []interface{} {
+func flattenPartitionKeys(apiObjects []types.PartitionKey) []interface{} {
 	if len(apiObjects) == 0 {
 		return nil
 	}
@@ -1156,17 +1245,13 @@ func flattenPartitionKeys(apiObjects []*keyspaces.PartitionKey) []interface{} {
 	var tfList []interface{}
 
 	for _, apiObject := range apiObjects {
-		if apiObject == nil {
-			continue
-		}
-
-		tfList = append(tfList, flattenPartitionKey(apiObject))
+		tfList = append(tfList, flattenPartitionKey(&apiObject))
 	}
 
 	return tfList
 }
 
-func flattenStaticColumn(apiObject *keyspaces.StaticColumn) map[string]interface{} {
+func flattenStaticColumn(apiObject *types.StaticColumn) map[string]interface{} {
 	if apiObject == nil {
 		return nil
 	}
@@ -1174,13 +1259,13 @@ func flattenStaticColumn(apiObject *keyspaces.StaticColumn) map[string]interface
 	tfMap := map[string]interface{}{}
 
 	if v := apiObject.Name; v != nil {
-		tfMap["name"] = aws.StringValue(v)
+		tfMap["name"] = aws.ToString(v)
 	}
 
 	return tfMap
 }
 
-func flattenStaticColumns(apiObjects []*keyspaces.StaticColumn) []interface{} {
+func flattenStaticColumns(apiObjects []types.StaticColumn) []interface{} {
 	if len(apiObjects) == 0 {
 		return nil
 	}
@@ -1188,11 +1273,7 @@ func flattenStaticColumns(apiObjects []*keyspaces.StaticColumn) []interface{} {
 	var tfList []interface{}
 
 	for _, apiObject := range apiObjects {
-		if apiObject == nil {
-			continue
-		}
-
-		tfList = append(tfList, flattenStaticColumn(apiObject))
+		tfList = append(tfList, flattenStaticColumn(&apiObject))
 	}
 
 	return tfList
diff --git a/internal/service/keyspaces/table_test.go b/internal/service/keyspaces/table_test.go
index 7034e919224..dd4e415a650 100644
--- a/internal/service/keyspaces/table_test.go
+++ b/internal/service/keyspaces/table_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package keyspaces_test
 
 import (
@@ -6,8 +9,8 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/keyspaces"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/keyspaces"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
@@ -15,6 +18,7 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	tfkeyspaces "github.com/hashicorp/terraform-provider-aws/internal/service/keyspaces"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
 func TestAccKeyspacesTable_basic(t *testing.T) {
@@ -26,7 +30,7 @@ func TestAccKeyspacesTable_basic(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheck(t) },
-		ErrorCheck:               acctest.ErrorCheck(t, keyspaces.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.KeyspacesEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckTableDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -37,6 +41,7 @@ func TestAccKeyspacesTable_basic(t *testing.T) {
 					acctest.CheckResourceAttrRegionalARN(resourceName, "arn", "cassandra", fmt.Sprintf("/keyspace/%s/table/%s", rName1, rName2)),
 					resource.TestCheckResourceAttr(resourceName, "capacity_specification.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "capacity_specification.0.throughput_mode", "PAY_PER_REQUEST"),
+					resource.TestCheckResourceAttr(resourceName, "client_side_timestamps.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "comment.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "comment.0.message", ""),
 					resource.TestCheckResourceAttr(resourceName, "default_time_to_live", "0"),
@@ -80,7 +85,7 @@ func TestAccKeyspacesTable_disappears(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheck(t) },
-		ErrorCheck:               acctest.ErrorCheck(t, keyspaces.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.KeyspacesEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckTableDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -105,7 +110,7 @@ func TestAccKeyspacesTable_tags(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheck(t) },
-		ErrorCheck:               acctest.ErrorCheck(t, keyspaces.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.KeyspacesEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckTableDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -143,6 +148,36 @@ func TestAccKeyspacesTable_tags(t *testing.T) {
 	})
 }
 
+func TestAccKeyspacesTable_clientSideTimestamps(t *testing.T) {
+	ctx := acctest.Context(t)
+	var v keyspaces.GetTableOutput
+	rName1 := "tf_acc_test_" + sdkacctest.RandString(20)
+	rName2 := "tf_acc_test_" + sdkacctest.RandString(20)
+	resourceName := "aws_keyspaces_table.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheck(t) },
+		ErrorCheck:               acctest.ErrorCheck(t, names.KeyspacesEndpointID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckTableDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccTableConfig_clientSideTimestamps(rName1, rName2),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckTableExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "client_side_timestamps.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "client_side_timestamps.0.status", "ENABLED"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
 func TestAccKeyspacesTable_multipleColumns(t *testing.T) {
 	ctx := acctest.Context(t)
 	var v keyspaces.GetTableOutput
@@ -152,7 +187,7 @@ func TestAccKeyspacesTable_multipleColumns(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheck(t) },
-		ErrorCheck:               acctest.ErrorCheck(t, keyspaces.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.KeyspacesEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckTableDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -247,7 +282,7 @@ func TestAccKeyspacesTable_update(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheck(t) },
-		ErrorCheck:               acctest.ErrorCheck(t, keyspaces.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.KeyspacesEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckTableDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -320,7 +355,7 @@ func TestAccKeyspacesTable_addColumns(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheck(t) },
-		ErrorCheck:               acctest.ErrorCheck(t, keyspaces.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.KeyspacesEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckTableDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -387,7 +422,7 @@ func TestAccKeyspacesTable_delColumns(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheck(t) },
-		ErrorCheck:               acctest.ErrorCheck(t, keyspaces.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.KeyspacesEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckTableDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -447,7 +482,7 @@ func TestAccKeyspacesTable_delColumns(t *testing.T) {
 
 func testAccCheckTableDestroy(ctx context.Context) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		conn := acctest.Provider.Meta().(*conns.AWSClient).KeyspacesConn(ctx)
+		conn := acctest.Provider.Meta().(*conns.AWSClient).KeyspacesClient(ctx)
 
 		for _, rs := range s.RootModule().Resources {
 			if rs.Type != "aws_keyspaces_table" {
@@ -488,7 +523,7 @@ func testAccCheckTableExists(ctx context.Context, n string, v *keyspaces.GetTabl
 			return fmt.Errorf("No Keyspaces Table ID is set")
 		}
 
-		conn := acctest.Provider.Meta().(*conns.AWSClient).KeyspacesConn(ctx)
+		conn := acctest.Provider.Meta().(*conns.AWSClient).KeyspacesClient(ctx)
 
 		keyspaceName, tableName, err := tfkeyspaces.TableParseResourceID(rs.Primary.ID)
 
@@ -510,7 +545,7 @@ func testAccCheckTableExists(ctx context.Context, n string, v *keyspaces.GetTabl
 
 func testAccCheckTableNotRecreated(i, j *keyspaces.GetTableOutput) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		if !aws.TimeValue(i.CreationTimestamp).Equal(aws.TimeValue(j.CreationTimestamp)) {
+		if !aws.ToTime(i.CreationTimestamp).Equal(aws.ToTime(j.CreationTimestamp)) {
 			return errors.New("Keyspaces Table was recreated")
 		}
 
@@ -520,7 +555,7 @@ func testAccCheckTableNotRecreated(i, j *keyspaces.GetTableOutput) resource.Test
 
 func testAccCheckTableRecreated(i, j *keyspaces.GetTableOutput) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		if aws.TimeValue(i.CreationTimestamp).Equal(aws.TimeValue(j.CreationTimestamp)) {
+		if aws.ToTime(i.CreationTimestamp).Equal(aws.ToTime(j.CreationTimestamp)) {
 			return errors.New("Keyspaces Table was not recreated")
 		}
 
@@ -609,6 +644,34 @@ resource "aws_keyspaces_table" "test" {
 `, rName1, rName2, tagKey1, tagValue1, tagKey2, tagValue2)
 }
 
+func testAccTableConfig_clientSideTimestamps(rName1, rName2 string) string {
+	return fmt.Sprintf(`
+resource "aws_keyspaces_keyspace" "test" {
+  name = %[1]q
+}
+
+resource "aws_keyspaces_table" "test" {
+  keyspace_name = aws_keyspaces_keyspace.test.name
+  table_name    = %[2]q
+
+  schema_definition {
+    column {
+      name = "message"
+      type = "ascii"
+    }
+
+    partition_key {
+      name = "message"
+    }
+  }
+
+  client_side_timestamps {
+    status = "ENABLED"
+  }
+}
+`, rName1, rName2)
+}
+
 func testAccTableConfig_multipleColumns(rName1, rName2 string) string {
 	return fmt.Sprintf(`
 resource "aws_keyspaces_keyspace" "test" {
diff --git a/internal/service/keyspaces/tags_gen.go b/internal/service/keyspaces/tags_gen.go
index d4d03a5f2ba..f6bdc93bd36 100644
--- a/internal/service/keyspaces/tags_gen.go
+++ b/internal/service/keyspaces/tags_gen.go
@@ -5,10 +5,12 @@ import (
 	"context"
 	"fmt"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/keyspaces"
-	"github.com/aws/aws-sdk-go/service/keyspaces/keyspacesiface"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/keyspaces"
+	awstypes "github.com/aws/aws-sdk-go-v2/service/keyspaces/types"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -17,12 +19,12 @@ import (
 // listTags lists keyspaces service tags.
 // The identifier is typically the Amazon Resource Name (ARN), although
 // it may also be a different identifier depending on the service.
-func listTags(ctx context.Context, conn keyspacesiface.KeyspacesAPI, identifier string) (tftags.KeyValueTags, error) {
+func listTags(ctx context.Context, conn *keyspaces.Client, identifier string) (tftags.KeyValueTags, error) {
 	input := &keyspaces.ListTagsForResourceInput{
 		ResourceArn: aws.String(identifier),
 	}
 
-	output, err := conn.ListTagsForResourceWithContext(ctx, input)
+	output, err := conn.ListTagsForResource(ctx, input)
 
 	if err != nil {
 		return tftags.New(ctx, nil), err
@@ -34,7 +36,7 @@ func listTags(ctx context.Context, conn keyspacesiface.KeyspacesAPI, identifier
 // ListTags lists keyspaces service tags and set them in Context.
 // It is called from outside this package.
 func (p *servicePackage) ListTags(ctx context.Context, meta any, identifier string) error {
-	tags, err := listTags(ctx, meta.(*conns.AWSClient).KeyspacesConn(ctx), identifier)
+	tags, err := listTags(ctx, meta.(*conns.AWSClient).KeyspacesClient(ctx), identifier)
 
 	if err != nil {
 		return err
@@ -50,11 +52,11 @@ func (p *servicePackage) ListTags(ctx context.Context, meta any, identifier stri
 // []*SERVICE.Tag handling
 
 // Tags returns keyspaces service tags.
-func Tags(tags tftags.KeyValueTags) []*keyspaces.Tag {
-	result := make([]*keyspaces.Tag, 0, len(tags))
+func Tags(tags tftags.KeyValueTags) []awstypes.Tag {
+	result := make([]awstypes.Tag, 0, len(tags))
 
 	for k, v := range tags.Map() {
-		tag := &keyspaces.Tag{
+		tag := awstypes.Tag{
 			Key:   aws.String(k),
 			Value: aws.String(v),
 		}
@@ -66,11 +68,11 @@ func Tags(tags tftags.KeyValueTags) []*keyspaces.Tag {
 }
 
 // KeyValueTags creates tftags.KeyValueTags from keyspaces service tags.
-func KeyValueTags(ctx context.Context, tags []*keyspaces.Tag) tftags.KeyValueTags {
+func KeyValueTags(ctx context.Context, tags []awstypes.Tag) tftags.KeyValueTags {
 	m := make(map[string]*string, len(tags))
 
 	for _, tag := range tags {
-		m[aws.StringValue(tag.Key)] = tag.Value
+		m[aws.ToString(tag.Key)] = tag.Value
 	}
 
 	return tftags.New(ctx, m)
@@ -78,7 +80,7 @@ func KeyValueTags(ctx context.Context, tags []*keyspaces.Tag) tftags.KeyValueTag
 
 // getTagsIn returns keyspaces service tags from Context.
 // nil is returned if there are no input tags.
-func getTagsIn(ctx context.Context) []*keyspaces.Tag {
+func getTagsIn(ctx context.Context) []awstypes.Tag {
 	if inContext, ok := tftags.FromContext(ctx); ok {
 		if tags := Tags(inContext.TagsIn.UnwrapOrDefault()); len(tags) > 0 {
 			return tags
@@ -89,7 +91,7 @@ func getTagsIn(ctx context.Context) []*keyspaces.Tag {
 }
 
 // setTagsOut sets keyspaces service tags in Context.
-func setTagsOut(ctx context.Context, tags []*keyspaces.Tag) {
+func setTagsOut(ctx context.Context, tags []awstypes.Tag) {
 	if inContext, ok := tftags.FromContext(ctx); ok {
 		inContext.TagsOut = types.Some(KeyValueTags(ctx, tags))
 	}
@@ -98,10 +100,12 @@ func setTagsOut(ctx context.Context, tags []*keyspaces.Tag) {
 // updateTags updates keyspaces service tags.
 // The identifier is typically the Amazon Resource Name (ARN), although
 // it may also be a different identifier depending on the service.
-func updateTags(ctx context.Context, conn keyspacesiface.KeyspacesAPI, identifier string, oldTagsMap, newTagsMap any) error {
+func updateTags(ctx context.Context, conn *keyspaces.Client, identifier string, oldTagsMap, newTagsMap any) error {
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.Keyspaces)
 	if len(removedTags) > 0 {
@@ -110,7 +114,7 @@ func updateTags(ctx context.Context, conn keyspacesiface.KeyspacesAPI, identifie
 			Tags:        Tags(removedTags),
 		}
 
-		_, err := conn.UntagResourceWithContext(ctx, input)
+		_, err := conn.UntagResource(ctx, input)
 
 		if err != nil {
 			return fmt.Errorf("untagging resource (%s): %w", identifier, err)
@@ -125,7 +129,7 @@ func updateTags(ctx context.Context, conn keyspacesiface.KeyspacesAPI, identifie
 			Tags:        Tags(updatedTags),
 		}
 
-		_, err := conn.TagResourceWithContext(ctx, input)
+		_, err := conn.TagResource(ctx, input)
 
 		if err != nil {
 			return fmt.Errorf("tagging resource (%s): %w", identifier, err)
@@ -138,5 +142,5 @@ func updateTags(ctx context.Context, conn keyspacesiface.KeyspacesAPI, identifie
 // UpdateTags updates keyspaces service tags.
 // It is called from outside this package.
 func (p *servicePackage) UpdateTags(ctx context.Context, meta any, identifier string, oldTags, newTags any) error {
-	return updateTags(ctx, meta.(*conns.AWSClient).KeyspacesConn(ctx), identifier, oldTags, newTags)
+	return updateTags(ctx, meta.(*conns.AWSClient).KeyspacesClient(ctx), identifier, oldTags, newTags)
 }
diff --git a/internal/service/kinesis/flex.go b/internal/service/kinesis/flex.go
index 097a470fae3..c6a83295f5b 100644
--- a/internal/service/kinesis/flex.go
+++ b/internal/service/kinesis/flex.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kinesis
 
 import (
diff --git a/internal/service/kinesis/flex_test.go b/internal/service/kinesis/flex_test.go
index 6a662befb76..f340759d2e1 100644
--- a/internal/service/kinesis/flex_test.go
+++ b/internal/service/kinesis/flex_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kinesis
 
 import (
diff --git a/internal/service/kinesis/generate.go b/internal/service/kinesis/generate.go
index d6026bb1919..c51605fd39a 100644
--- a/internal/service/kinesis/generate.go
+++ b/internal/service/kinesis/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTags -ListTagsOp=ListTagsForStream -ListTagsInIDElem=StreamName -ServiceTagsSlice -TagOp=AddTagsToStream -TagOpBatchSize=10 -TagInCustomVal=aws.StringMap(updatedTags.IgnoreAWS().Map()) -TagInIDElem=StreamName -UntagOp=RemoveTagsFromStream -UpdateTags -CreateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/kinesis/migrate.go b/internal/service/kinesis/migrate.go
index a7748bfd7b3..5b2267062d2 100644
--- a/internal/service/kinesis/migrate.go
+++ b/internal/service/kinesis/migrate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kinesis
 
 import (
diff --git a/internal/service/kinesis/migrate_test.go b/internal/service/kinesis/migrate_test.go
index c371418fb92..d2fe434ee3f 100644
--- a/internal/service/kinesis/migrate_test.go
+++ b/internal/service/kinesis/migrate_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kinesis_test
 
 import (
diff --git a/internal/service/kinesis/service_package.go b/internal/service/kinesis/service_package.go
index aee924ad97e..d75e4b7e503 100644
--- a/internal/service/kinesis/service_package.go
+++ b/internal/service/kinesis/service_package.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kinesis
 
 import (
diff --git a/internal/service/kinesis/service_package_gen.go b/internal/service/kinesis/service_package_gen.go
index bec5ce1a39d..e06dde0bcba 100644
--- a/internal/service/kinesis/service_package_gen.go
+++ b/internal/service/kinesis/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	kinesis_sdkv1 "github.com/aws/aws-sdk-go/service/kinesis"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -63,4 +64,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*k
 	return kinesis_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/kinesis/stream.go b/internal/service/kinesis/stream.go
index fbe946f5563..3e9ec20a611 100644
--- a/internal/service/kinesis/stream.go
+++ b/internal/service/kinesis/stream.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kinesis
 
 import (
diff --git a/internal/service/kinesis/stream_consumer.go b/internal/service/kinesis/stream_consumer.go
index 4e697761118..19535fee53e 100644
--- a/internal/service/kinesis/stream_consumer.go
+++ b/internal/service/kinesis/stream_consumer.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kinesis
 
 import (
diff --git a/internal/service/kinesis/stream_consumer_data_source.go b/internal/service/kinesis/stream_consumer_data_source.go
index bfa5249d4f5..d8e82285a09 100644
--- a/internal/service/kinesis/stream_consumer_data_source.go
+++ b/internal/service/kinesis/stream_consumer_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kinesis
 
 import (
diff --git a/internal/service/kinesis/stream_consumer_data_source_test.go b/internal/service/kinesis/stream_consumer_data_source_test.go
index 9f3f3e58b03..4fba8bcd902 100644
--- a/internal/service/kinesis/stream_consumer_data_source_test.go
+++ b/internal/service/kinesis/stream_consumer_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kinesis_test
 
 import (
diff --git a/internal/service/kinesis/stream_consumer_test.go b/internal/service/kinesis/stream_consumer_test.go
index 86df58d1163..906d6145cf1 100644
--- a/internal/service/kinesis/stream_consumer_test.go
+++ b/internal/service/kinesis/stream_consumer_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kinesis_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/kinesis"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -32,7 +35,7 @@ func TestAccKinesisStreamConsumer_basic(t *testing.T) {
 				Config: testAccStreamConsumerConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccStreamConsumerExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "kinesis", regexp.MustCompile(fmt.Sprintf("stream/%[1]s/consumer/%[1]s", rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "kinesis", regexache.MustCompile(fmt.Sprintf("stream/%[1]s/consumer/%[1]s", rName))),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttrPair(resourceName, "stream_arn", streamName, "arn"),
 					resource.TestCheckResourceAttrSet(resourceName, "creation_timestamp"),
diff --git a/internal/service/kinesis/stream_data_source.go b/internal/service/kinesis/stream_data_source.go
index 0691134d16a..df46e8ced18 100644
--- a/internal/service/kinesis/stream_data_source.go
+++ b/internal/service/kinesis/stream_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kinesis
 
 import (
diff --git a/internal/service/kinesis/stream_data_source_test.go b/internal/service/kinesis/stream_data_source_test.go
index a9a48c86a7f..079ebb969ce 100644
--- a/internal/service/kinesis/stream_data_source_test.go
+++ b/internal/service/kinesis/stream_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kinesis_test
 
 import (
diff --git a/internal/service/kinesis/stream_test.go b/internal/service/kinesis/stream_test.go
index 8ada7a24d59..ed8a8cef506 100644
--- a/internal/service/kinesis/stream_test.go
+++ b/internal/service/kinesis/stream_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kinesis_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/kinesis"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -141,7 +144,7 @@ func TestAccKinesisStream_encryptionWithoutKMSKeyThrowsError(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccStreamConfig_encryptionAndNoKMSKey(rName),
-				ExpectError: regexp.MustCompile("KMS Key Id required when setting encryption_type is not set as NONE"),
+				ExpectError: regexache.MustCompile("KMS Key Id required when setting encryption_type is not set as NONE"),
 			},
 		},
 	})
@@ -568,12 +571,12 @@ func TestAccKinesisStream_failOnBadStreamCountAndStreamModeCombination(t *testin
 			// Check that we can't create an invalid combination
 			{
 				Config:      testAccStreamConfig_failOnBadCountAndModeCombinationNothingSet(rName),
-				ExpectError: regexp.MustCompile(`shard_count must be at least 1 when stream_mode is PROVISIONED`),
+				ExpectError: regexache.MustCompile(`shard_count must be at least 1 when stream_mode is PROVISIONED`),
 			},
 			// Check that we can't create an invalid combination
 			{
 				Config:      testAccStreamConfig_failOnBadCountAndModeCombinationShardCountWhenOnDemand(rName),
-				ExpectError: regexp.MustCompile(`shard_count must not be set when stream_mode is ON_DEMAND`),
+				ExpectError: regexache.MustCompile(`shard_count must not be set when stream_mode is ON_DEMAND`),
 			},
 			// Prepare for updates...
 			{
@@ -587,12 +590,12 @@ func TestAccKinesisStream_failOnBadStreamCountAndStreamModeCombination(t *testin
 			// Check that we can't update to an invalid combination
 			{
 				Config:      testAccStreamConfig_failOnBadCountAndModeCombinationNothingSet(rName),
-				ExpectError: regexp.MustCompile(`shard_count must be at least 1 when stream_mode is PROVISIONED`),
+				ExpectError: regexache.MustCompile(`shard_count must be at least 1 when stream_mode is PROVISIONED`),
 			},
 			// Check that we can't update to an invalid combination
 			{
 				Config:      testAccStreamConfig_failOnBadCountAndModeCombinationShardCountWhenOnDemand(rName),
-				ExpectError: regexp.MustCompile(`shard_count must not be set when stream_mode is ON_DEMAND`),
+				ExpectError: regexache.MustCompile(`shard_count must not be set when stream_mode is ON_DEMAND`),
 			},
 		},
 	})
diff --git a/internal/service/kinesis/sweep.go b/internal/service/kinesis/sweep.go
index 66cc5e59085..963cbd15f00 100644
--- a/internal/service/kinesis/sweep.go
+++ b/internal/service/kinesis/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package kinesis
 
@@ -11,9 +11,10 @@ import (
 	"github.com/aws/aws-sdk-go/service/kinesis"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_kinesis_stream", &resource.Sweeper{
 		Name: "aws_kinesis_stream",
 		F:    sweepStreams,
@@ -22,7 +23,7 @@ func init() {
 
 func sweepStreams(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -48,7 +49,7 @@ func sweepStreams(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Kinesis Stream sweep for %s: %s", region, err)
 		return nil
 	}
@@ -56,7 +57,7 @@ func sweepStreams(region string) error {
 		return fmt.Errorf("error listing Kinesis Streams (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping Kinesis Streams (%s): %w", region, err)
diff --git a/internal/service/kinesis/tags_gen.go b/internal/service/kinesis/tags_gen.go
index c49c1c40243..d9731b3c5bd 100644
--- a/internal/service/kinesis/tags_gen.go
+++ b/internal/service/kinesis/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/kinesis"
 	"github.com/aws/aws-sdk-go/service/kinesis/kinesisiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -111,6 +113,8 @@ func updateTags(ctx context.Context, conn kinesisiface.KinesisAPI, identifier st
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.Kinesis)
 	if len(removedTags) > 0 {
diff --git a/internal/service/kinesisanalytics/application.go b/internal/service/kinesisanalytics/application.go
index a6b3636d77a..2a831942c2d 100644
--- a/internal/service/kinesisanalytics/application.go
+++ b/internal/service/kinesisanalytics/application.go
@@ -1,13 +1,16 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kinesisanalytics
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"strings"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/aws/aws-sdk-go/service/kinesisanalytics"
@@ -107,7 +110,7 @@ func ResourceApplication() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 128),
-					validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9_.-]+$`), "must only include alphanumeric, underscore, period, or hyphen characters"),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_.-]+$`), "must only include alphanumeric, underscore, period, or hyphen characters"),
 				),
 			},
 
@@ -169,7 +172,7 @@ func ResourceApplication() *schema.Resource {
 							Required: true,
 							ValidateFunc: validation.All(
 								validation.StringLenBetween(1, 32),
-								validation.StringMatch(regexp.MustCompile(`^[^-\s<>&]+$`), "must not include hyphen, whitespace, angle bracket, or ampersand characters"),
+								validation.StringMatch(regexache.MustCompile(`^[^-\s<>&]+$`), "must not include hyphen, whitespace, angle bracket, or ampersand characters"),
 							),
 						},
 
@@ -240,7 +243,7 @@ func ResourceApplication() *schema.Resource {
 												"name": {
 													Type:         schema.TypeString,
 													Required:     true,
-													ValidateFunc: validation.StringMatch(regexp.MustCompile(`^[^-\s<>&]+$`), "must not include hyphen, whitespace, angle bracket, or ampersand characters"),
+													ValidateFunc: validation.StringMatch(regexache.MustCompile(`^[^-\s<>&]+$`), "must not include hyphen, whitespace, angle bracket, or ampersand characters"),
 												},
 
 												"sql_type": {
@@ -427,7 +430,7 @@ func ResourceApplication() *schema.Resource {
 							Required: true,
 							ValidateFunc: validation.All(
 								validation.StringLenBetween(1, 32),
-								validation.StringMatch(regexp.MustCompile(`^[^-\s<>&]+$`), "must not include hyphen, whitespace, angle bracket, or ampersand characters"),
+								validation.StringMatch(regexache.MustCompile(`^[^-\s<>&]+$`), "must not include hyphen, whitespace, angle bracket, or ampersand characters"),
 							),
 						},
 
@@ -506,7 +509,7 @@ func ResourceApplication() *schema.Resource {
 												"name": {
 													Type:         schema.TypeString,
 													Required:     true,
-													ValidateFunc: validation.StringMatch(regexp.MustCompile(`^[^-\s<>&]+$`), "must not include hyphen, whitespace, angle bracket, or ampersand characters"),
+													ValidateFunc: validation.StringMatch(regexache.MustCompile(`^[^-\s<>&]+$`), "must not include hyphen, whitespace, angle bracket, or ampersand characters"),
 												},
 
 												"sql_type": {
diff --git a/internal/service/kinesisanalytics/application_test.go b/internal/service/kinesisanalytics/application_test.go
index 2b3b39b7d3f..015619a8153 100644
--- a/internal/service/kinesisanalytics/application_test.go
+++ b/internal/service/kinesisanalytics/application_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kinesisanalytics_test
 
 import (
diff --git a/internal/service/kinesisanalytics/consts.go b/internal/service/kinesisanalytics/consts.go
index 55b48ccb358..71c379598d0 100644
--- a/internal/service/kinesisanalytics/consts.go
+++ b/internal/service/kinesisanalytics/consts.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kinesisanalytics
 
 import (
diff --git a/internal/service/kinesisanalytics/find.go b/internal/service/kinesisanalytics/find.go
index 67ff78f8210..538970589a8 100644
--- a/internal/service/kinesisanalytics/find.go
+++ b/internal/service/kinesisanalytics/find.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kinesisanalytics
 
 import (
diff --git a/internal/service/kinesisanalytics/generate.go b/internal/service/kinesisanalytics/generate.go
index 2802b0240ae..5d5d28bb4ff 100644
--- a/internal/service/kinesisanalytics/generate.go
+++ b/internal/service/kinesisanalytics/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTags -ListTagsInIDElem=ResourceARN -ServiceTagsSlice -TagInIDElem=ResourceARN -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/kinesisanalytics/list.go b/internal/service/kinesisanalytics/list.go
index 5fdd5e67341..43d8984be93 100644
--- a/internal/service/kinesisanalytics/list.go
+++ b/internal/service/kinesisanalytics/list.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kinesisanalytics
 
 import (
diff --git a/internal/service/kinesisanalytics/service_package_gen.go b/internal/service/kinesisanalytics/service_package_gen.go
index 8840ca5dac4..87507d228f3 100644
--- a/internal/service/kinesisanalytics/service_package_gen.go
+++ b/internal/service/kinesisanalytics/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	kinesisanalytics_sdkv1 "github.com/aws/aws-sdk-go/service/kinesisanalytics"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -50,4 +51,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*k
 	return kinesisanalytics_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/kinesisanalytics/status.go b/internal/service/kinesisanalytics/status.go
index a8d012d9917..4c2dc4cb0b0 100644
--- a/internal/service/kinesisanalytics/status.go
+++ b/internal/service/kinesisanalytics/status.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kinesisanalytics
 
 import (
diff --git a/internal/service/kinesisanalytics/sweep.go b/internal/service/kinesisanalytics/sweep.go
index d229746ebe5..6b63e1b08a8 100644
--- a/internal/service/kinesisanalytics/sweep.go
+++ b/internal/service/kinesisanalytics/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package kinesisanalytics
 
@@ -14,9 +14,10 @@ import (
 	"github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_kinesis_analytics_application", &resource.Sweeper{
 		Name: "aws_kinesis_analytics_application",
 		F:    sweepApplications,
@@ -25,7 +26,7 @@ func init() {
 
 func sweepApplications(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
@@ -69,7 +70,7 @@ func sweepApplications(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Kinesis Analytics Application sweep for %s: %s", region, err)
 		return sweeperErrs.ErrorOrNil() // In case we have completed some pages, but had errors
 	}
@@ -77,7 +78,7 @@ func sweepApplications(region string) error {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error listing Kinesis Analytics Applications: %w", err))
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error sweeping Kinesis Analytics Applications: %w", err))
 	}
 
diff --git a/internal/service/kinesisanalytics/tags_gen.go b/internal/service/kinesisanalytics/tags_gen.go
index 0d6411bc89b..74ad87f7168 100644
--- a/internal/service/kinesisanalytics/tags_gen.go
+++ b/internal/service/kinesisanalytics/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/kinesisanalytics"
 	"github.com/aws/aws-sdk-go/service/kinesisanalytics/kinesisanalyticsiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -102,6 +104,8 @@ func updateTags(ctx context.Context, conn kinesisanalyticsiface.KinesisAnalytics
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.KinesisAnalytics)
 	if len(removedTags) > 0 {
diff --git a/internal/service/kinesisanalytics/wait.go b/internal/service/kinesisanalytics/wait.go
index 7c954745274..56a9b65c577 100644
--- a/internal/service/kinesisanalytics/wait.go
+++ b/internal/service/kinesisanalytics/wait.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kinesisanalytics
 
 import (
diff --git a/internal/service/kinesisanalyticsv2/application.go b/internal/service/kinesisanalyticsv2/application.go
index 53505e96c4c..9a3e1d2872e 100644
--- a/internal/service/kinesisanalyticsv2/application.go
+++ b/internal/service/kinesisanalyticsv2/application.go
@@ -1,13 +1,16 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kinesisanalyticsv2
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"strings"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/aws/aws-sdk-go/service/kinesisanalyticsv2"
@@ -151,7 +154,7 @@ func ResourceApplication() *schema.Resource {
 													Required: true,
 													ValidateFunc: validation.All(
 														validation.StringLenBetween(1, 50),
-														validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9_.-]+$`), "must only include alphanumeric, underscore, period, or hyphen characters"),
+														validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_.-]+$`), "must only include alphanumeric, underscore, period, or hyphen characters"),
 													),
 												},
 
@@ -414,7 +417,7 @@ func ResourceApplication() *schema.Resource {
 																		"name": {
 																			Type:         schema.TypeString,
 																			Required:     true,
-																			ValidateFunc: validation.StringMatch(regexp.MustCompile(`^[^-\s<>&]+$`), "must not include hyphen, whitespace, angle bracket, or ampersand characters"),
+																			ValidateFunc: validation.StringMatch(regexache.MustCompile(`^[^-\s<>&]+$`), "must not include hyphen, whitespace, angle bracket, or ampersand characters"),
 																		},
 
 																		"sql_type": {
@@ -557,7 +560,7 @@ func ResourceApplication() *schema.Resource {
 													Required: true,
 													ValidateFunc: validation.All(
 														validation.StringLenBetween(1, 32),
-														validation.StringMatch(regexp.MustCompile(`^[^-\s<>&]+$`), "must not include hyphen, whitespace, angle bracket, or ampersand characters"),
+														validation.StringMatch(regexache.MustCompile(`^[^-\s<>&]+$`), "must not include hyphen, whitespace, angle bracket, or ampersand characters"),
 													),
 												},
 											},
@@ -635,7 +638,7 @@ func ResourceApplication() *schema.Resource {
 													Required: true,
 													ValidateFunc: validation.All(
 														validation.StringLenBetween(1, 32),
-														validation.StringMatch(regexp.MustCompile(`^[^-\s<>&]+$`), "must not include hyphen, whitespace, angle bracket, or ampersand characters"),
+														validation.StringMatch(regexache.MustCompile(`^[^-\s<>&]+$`), "must not include hyphen, whitespace, angle bracket, or ampersand characters"),
 													),
 												},
 
@@ -678,7 +681,7 @@ func ResourceApplication() *schema.Resource {
 																		"name": {
 																			Type:         schema.TypeString,
 																			Required:     true,
-																			ValidateFunc: validation.StringMatch(regexp.MustCompile(`^[^-\s<>&]+$`), "must not include hyphen, whitespace, angle bracket, or ampersand characters"),
+																			ValidateFunc: validation.StringMatch(regexache.MustCompile(`^[^-\s<>&]+$`), "must not include hyphen, whitespace, angle bracket, or ampersand characters"),
 																		},
 
 																		"sql_type": {
@@ -893,7 +896,7 @@ func ResourceApplication() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 128),
-					validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9_.-]+$`), "must only include alphanumeric, underscore, period, or hyphen characters"),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_.-]+$`), "must only include alphanumeric, underscore, period, or hyphen characters"),
 				),
 			},
 
diff --git a/internal/service/kinesisanalyticsv2/application_snapshot.go b/internal/service/kinesisanalyticsv2/application_snapshot.go
index 419cba3c53e..8975b862fee 100644
--- a/internal/service/kinesisanalyticsv2/application_snapshot.go
+++ b/internal/service/kinesisanalyticsv2/application_snapshot.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kinesisanalyticsv2
 
 import (
 	"context"
 	"log"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/kinesisanalyticsv2"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -40,7 +43,7 @@ func ResourceApplicationSnapshot() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 128),
-					validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9_.-]+$`), "must only include alphanumeric, underscore, period, or hyphen characters"),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_.-]+$`), "must only include alphanumeric, underscore, period, or hyphen characters"),
 				),
 			},
 
@@ -60,7 +63,7 @@ func ResourceApplicationSnapshot() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 256),
-					validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9_.-]+$`), "must only include alphanumeric, underscore, period, or hyphen characters"),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_.-]+$`), "must only include alphanumeric, underscore, period, or hyphen characters"),
 				),
 			},
 		},
diff --git a/internal/service/kinesisanalyticsv2/application_snapshot_test.go b/internal/service/kinesisanalyticsv2/application_snapshot_test.go
index a5d0ccd1706..43c335bcda4 100644
--- a/internal/service/kinesisanalyticsv2/application_snapshot_test.go
+++ b/internal/service/kinesisanalyticsv2/application_snapshot_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kinesisanalyticsv2_test
 
 import (
diff --git a/internal/service/kinesisanalyticsv2/application_test.go b/internal/service/kinesisanalyticsv2/application_test.go
index c26a252a1f1..a9257e71089 100644
--- a/internal/service/kinesisanalyticsv2/application_test.go
+++ b/internal/service/kinesisanalyticsv2/application_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kinesisanalyticsv2_test
 
 import (
diff --git a/internal/service/kinesisanalyticsv2/consts.go b/internal/service/kinesisanalyticsv2/consts.go
index 34c30b793b6..d34a57f1043 100644
--- a/internal/service/kinesisanalyticsv2/consts.go
+++ b/internal/service/kinesisanalyticsv2/consts.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kinesisanalyticsv2
 
 import (
diff --git a/internal/service/kinesisanalyticsv2/find.go b/internal/service/kinesisanalyticsv2/find.go
index 4ee50a2e121..dbbe76000aa 100644
--- a/internal/service/kinesisanalyticsv2/find.go
+++ b/internal/service/kinesisanalyticsv2/find.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kinesisanalyticsv2
 
 import (
diff --git a/internal/service/kinesisanalyticsv2/generate.go b/internal/service/kinesisanalyticsv2/generate.go
index 4f5b0ca4486..cb0ee2be62f 100644
--- a/internal/service/kinesisanalyticsv2/generate.go
+++ b/internal/service/kinesisanalyticsv2/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/listpages/main.go -ListOps=ListApplications
 //go:generate go run ../../generate/tags/main.go -ListTags -ListTagsInIDElem=ResourceARN -ServiceTagsSlice -TagInIDElem=ResourceARN -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
diff --git a/internal/service/kinesisanalyticsv2/id.go b/internal/service/kinesisanalyticsv2/id.go
index 48d2d477842..8f4c1b59624 100644
--- a/internal/service/kinesisanalyticsv2/id.go
+++ b/internal/service/kinesisanalyticsv2/id.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kinesisanalyticsv2
 
 import (
diff --git a/internal/service/kinesisanalyticsv2/service_package_gen.go b/internal/service/kinesisanalyticsv2/service_package_gen.go
index 9addf5c2324..c023ff61869 100644
--- a/internal/service/kinesisanalyticsv2/service_package_gen.go
+++ b/internal/service/kinesisanalyticsv2/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	kinesisanalyticsv2_sdkv1 "github.com/aws/aws-sdk-go/service/kinesisanalyticsv2"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -54,4 +55,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*k
 	return kinesisanalyticsv2_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/kinesisanalyticsv2/status.go b/internal/service/kinesisanalyticsv2/status.go
index c418e5bb251..0835682e71d 100644
--- a/internal/service/kinesisanalyticsv2/status.go
+++ b/internal/service/kinesisanalyticsv2/status.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kinesisanalyticsv2
 
 import (
diff --git a/internal/service/kinesisanalyticsv2/sweep.go b/internal/service/kinesisanalyticsv2/sweep.go
index 2c4af2707cb..8d2cd27fb8c 100644
--- a/internal/service/kinesisanalyticsv2/sweep.go
+++ b/internal/service/kinesisanalyticsv2/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package kinesisanalyticsv2
 
@@ -13,9 +13,10 @@ import (
 	"github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_kinesisanalyticsv2_application", &resource.Sweeper{
 		Name: "aws_kinesisanalyticsv2_application",
 		F:    sweepApplication,
@@ -24,7 +25,7 @@ func init() {
 
 func sweepApplication(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -64,7 +65,7 @@ func sweepApplication(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Kinesis Analytics v2 Application sweep for %s: %s", region, err)
 		return sweeperErrs.ErrorOrNil() // In case we have completed some pages, but had errors
 	}
@@ -72,7 +73,7 @@ func sweepApplication(region string) error {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error listing Kinesis Analytics v2 Applications: %w", err))
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error sweeping Kinesis Analytics v2 Applications: %w", err))
 	}
 
diff --git a/internal/service/kinesisanalyticsv2/tags_gen.go b/internal/service/kinesisanalyticsv2/tags_gen.go
index 2df786ef0d1..cdd12fd9809 100644
--- a/internal/service/kinesisanalyticsv2/tags_gen.go
+++ b/internal/service/kinesisanalyticsv2/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/kinesisanalyticsv2"
 	"github.com/aws/aws-sdk-go/service/kinesisanalyticsv2/kinesisanalyticsv2iface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -102,6 +104,8 @@ func updateTags(ctx context.Context, conn kinesisanalyticsv2iface.KinesisAnalyti
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.KinesisAnalyticsV2)
 	if len(removedTags) > 0 {
diff --git a/internal/service/kinesisanalyticsv2/wait.go b/internal/service/kinesisanalyticsv2/wait.go
index 11cc51cd84a..76ee1be56f1 100644
--- a/internal/service/kinesisanalyticsv2/wait.go
+++ b/internal/service/kinesisanalyticsv2/wait.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kinesisanalyticsv2
 
 import (
diff --git a/internal/service/kinesisvideo/generate.go b/internal/service/kinesisvideo/generate.go
index 529f3748692..2d9dcbaed11 100644
--- a/internal/service/kinesisvideo/generate.go
+++ b/internal/service/kinesisvideo/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTags -ListTagsOp=ListTagsForStream -ListTagsInIDElem=StreamARN -ServiceTagsMap -TagOp=TagStream -TagInIDElem=StreamARN -UntagOp=UntagStream -UntagInTagsElem=TagKeyList -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/kinesisvideo/service_package_gen.go b/internal/service/kinesisvideo/service_package_gen.go
index 2416aab82c5..43426de01a1 100644
--- a/internal/service/kinesisvideo/service_package_gen.go
+++ b/internal/service/kinesisvideo/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	kinesisvideo_sdkv1 "github.com/aws/aws-sdk-go/service/kinesisvideo"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -50,4 +51,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*k
 	return kinesisvideo_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/kinesisvideo/stream.go b/internal/service/kinesisvideo/stream.go
index b5d1113e7b3..60b560cb1d5 100644
--- a/internal/service/kinesisvideo/stream.go
+++ b/internal/service/kinesisvideo/stream.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kinesisvideo
 
 import (
 	"context"
 	"log"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/kinesisvideo"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -64,7 +67,7 @@ func ResourceStream() *schema.Resource {
 				Optional: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(0, 128),
-					validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9_.-]+$`), "must only include alphanumeric, underscore, period, or hyphen characters"),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_.-]+$`), "must only include alphanumeric, underscore, period, or hyphen characters"),
 				),
 			},
 
diff --git a/internal/service/kinesisvideo/stream_test.go b/internal/service/kinesisvideo/stream_test.go
index 74e080115f4..bc0fed11387 100644
--- a/internal/service/kinesisvideo/stream_test.go
+++ b/internal/service/kinesisvideo/stream_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kinesisvideo_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/kinesisvideo"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
@@ -37,7 +40,7 @@ func TestAccKinesisVideoStream_basic(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckStreamExists(ctx, resourceName, &stream),
 					resource.TestCheckResourceAttr(resourceName, "name", fmt.Sprintf("terraform-kinesis-video-stream-test-%d", rInt1)),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "kinesisvideo", regexp.MustCompile(fmt.Sprintf("stream/terraform-kinesis-video-stream-test-%d/.+", rInt1))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "kinesisvideo", regexache.MustCompile(fmt.Sprintf("stream/terraform-kinesis-video-stream-test-%d/.+", rInt1))),
 					resource.TestCheckResourceAttrSet(resourceName, "creation_time"),
 					resource.TestCheckResourceAttrSet(resourceName, "version"),
 				),
@@ -52,7 +55,7 @@ func TestAccKinesisVideoStream_basic(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckStreamExists(ctx, resourceName, &stream),
 					resource.TestCheckResourceAttr(resourceName, "name", fmt.Sprintf("terraform-kinesis-video-stream-test-%d", rInt2)),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "kinesisvideo", regexp.MustCompile(fmt.Sprintf("stream/terraform-kinesis-video-stream-test-%d/.+", rInt2))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "kinesisvideo", regexache.MustCompile(fmt.Sprintf("stream/terraform-kinesis-video-stream-test-%d/.+", rInt2))),
 				),
 			},
 		},
@@ -79,7 +82,7 @@ func TestAccKinesisVideoStream_options(t *testing.T) {
 				Config: testAccStreamConfig_options(rInt, rName1, "video/h264"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckStreamExists(ctx, resourceName, &stream),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "kinesisvideo", regexp.MustCompile(fmt.Sprintf("stream/terraform-kinesis-video-stream-test-%d/.+", rInt))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "kinesisvideo", regexache.MustCompile(fmt.Sprintf("stream/terraform-kinesis-video-stream-test-%d/.+", rInt))),
 					resource.TestCheckResourceAttr(resourceName, "data_retention_in_hours", "1"),
 					resource.TestCheckResourceAttr(resourceName, "media_type", "video/h264"),
 					resource.TestCheckResourceAttr(resourceName, "device_name", fmt.Sprintf("kinesis-video-device-name-%s", rName1)),
diff --git a/internal/service/kinesisvideo/tags_gen.go b/internal/service/kinesisvideo/tags_gen.go
index 6b1e963f914..1b9a12679f9 100644
--- a/internal/service/kinesisvideo/tags_gen.go
+++ b/internal/service/kinesisvideo/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/kinesisvideo"
 	"github.com/aws/aws-sdk-go/service/kinesisvideo/kinesisvideoiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -54,7 +56,7 @@ func Tags(tags tftags.KeyValueTags) map[string]*string {
 	return aws.StringMap(tags.Map())
 }
 
-// KeyValueTags creates KeyValueTags from kinesisvideo service tags.
+// KeyValueTags creates tftags.KeyValueTags from kinesisvideo service tags.
 func KeyValueTags(ctx context.Context, tags map[string]*string) tftags.KeyValueTags {
 	return tftags.New(ctx, tags)
 }
@@ -85,6 +87,8 @@ func updateTags(ctx context.Context, conn kinesisvideoiface.KinesisVideoAPI, ide
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.KinesisVideo)
 	if len(removedTags) > 0 {
diff --git a/internal/service/kms/alias.go b/internal/service/kms/alias.go
index 5f01d48cf5f..bec4e842d25 100644
--- a/internal/service/kms/alias.go
+++ b/internal/service/kms/alias.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kms
 
 import (
diff --git a/internal/service/kms/alias_data_source.go b/internal/service/kms/alias_data_source.go
index 609bf3e8e98..a1c89de5ba9 100644
--- a/internal/service/kms/alias_data_source.go
+++ b/internal/service/kms/alias_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kms
 
 import (
diff --git a/internal/service/kms/alias_data_source_test.go b/internal/service/kms/alias_data_source_test.go
index baaf62aa7ca..e914f0fc0ef 100644
--- a/internal/service/kms/alias_data_source_test.go
+++ b/internal/service/kms/alias_data_source_test.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kms_test
 
 import (
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/kms"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -26,8 +29,8 @@ func TestAccKMSAliasDataSource_service(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					acctest.CheckResourceAttrRegionalARN(resourceName, "arn", "kms", rName),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "target_key_arn", "kms", regexp.MustCompile(`key/[a-z0-9]{8}-([a-z0-9]{4}-){3}[a-z0-9]{12}`)),
-					resource.TestMatchResourceAttr(resourceName, "target_key_id", regexp.MustCompile("^[a-z0-9]{8}-([a-z0-9]{4}-){3}[a-z0-9]{12}$")),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "target_key_arn", "kms", regexache.MustCompile(`key/[0-9a-z]{8}-([0-9a-z]{4}-){3}[0-9a-z]{12}`)),
+					resource.TestMatchResourceAttr(resourceName, "target_key_id", regexache.MustCompile("^[0-9a-z]{8}-([0-9a-z]{4}-){3}[0-9a-z]{12}$")),
 				),
 			},
 		},
diff --git a/internal/service/kms/alias_test.go b/internal/service/kms/alias_test.go
index a8016b19037..a6132cee96b 100644
--- a/internal/service/kms/alias_test.go
+++ b/internal/service/kms/alias_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kms_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/kms"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -34,7 +37,7 @@ func TestAccKMSAlias_basic(t *testing.T) {
 				Config: testAccAliasConfig_name(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckAliasExists(ctx, resourceName, &alias),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "kms", regexp.MustCompile(`alias/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "kms", regexache.MustCompile(`alias/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "name", tfkms.AliasNamePrefix+rName),
 					resource.TestCheckResourceAttrPair(resourceName, "target_key_arn", keyResourceName, "arn"),
 					resource.TestCheckResourceAttrPair(resourceName, "target_key_id", keyResourceName, "id"),
@@ -89,7 +92,7 @@ func TestAccKMSAlias_Name_generated(t *testing.T) {
 				Config: testAccAliasConfig_nameGenerated(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckAliasExists(ctx, resourceName, &alias),
-					resource.TestMatchResourceAttr(resourceName, "name", regexp.MustCompile(fmt.Sprintf("%s[[:xdigit:]]{%d}", tfkms.AliasNamePrefix, id.UniqueIDSuffixLength))),
+					resource.TestMatchResourceAttr(resourceName, "name", regexache.MustCompile(fmt.Sprintf("%s[[:xdigit:]]{%d}", tfkms.AliasNamePrefix, id.UniqueIDSuffixLength))),
 					resource.TestCheckResourceAttr(resourceName, "name_prefix", tfkms.AliasNamePrefix),
 				),
 			},
diff --git a/internal/service/kms/arn.go b/internal/service/kms/arn.go
index 9024709d734..078f24f72ee 100644
--- a/internal/service/kms/arn.go
+++ b/internal/service/kms/arn.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kms
 
 import (
diff --git a/internal/service/kms/arn_test.go b/internal/service/kms/arn_test.go
index cc5d7c6705e..77740fb962d 100644
--- a/internal/service/kms/arn_test.go
+++ b/internal/service/kms/arn_test.go
@@ -1,9 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kms_test
 
 import (
 	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	tfkms "github.com/hashicorp/terraform-provider-aws/internal/service/kms"
 )
 
@@ -19,17 +23,17 @@ func TestAliasARNToKeyARN(t *testing.T) {
 		{
 			TestName:      "empty ARN",
 			InputARN:      "",
-			ExpectedError: regexp.MustCompile(`parsing ARN`),
+			ExpectedError: regexache.MustCompile(`parsing ARN`),
 		},
 		{
 			TestName:      "unparsable ARN",
 			InputARN:      "test",
-			ExpectedError: regexp.MustCompile(`parsing ARN`),
+			ExpectedError: regexache.MustCompile(`parsing ARN`),
 		},
 		{
 			TestName:      "invalid ARN service",
 			InputARN:      "arn:aws:ec2:us-west-2:123456789012:alias/test-alias", //lintignore:AWSAT003,AWSAT005
-			ExpectedError: regexp.MustCompile(`expected service kms`),
+			ExpectedError: regexache.MustCompile(`expected service kms`),
 		},
 		{
 			TestName:    "valid ARN",
diff --git a/internal/service/kms/ciphertext.go b/internal/service/kms/ciphertext.go
index f8026832a17..1936e75c306 100644
--- a/internal/service/kms/ciphertext.go
+++ b/internal/service/kms/ciphertext.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kms
 
 import (
diff --git a/internal/service/kms/ciphertext_data_source.go b/internal/service/kms/ciphertext_data_source.go
index b405d8ceb4c..facd994d0de 100644
--- a/internal/service/kms/ciphertext_data_source.go
+++ b/internal/service/kms/ciphertext_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kms
 
 import (
diff --git a/internal/service/kms/ciphertext_data_source_test.go b/internal/service/kms/ciphertext_data_source_test.go
index 0fb83f542ea..e1baf508c78 100644
--- a/internal/service/kms/ciphertext_data_source_test.go
+++ b/internal/service/kms/ciphertext_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kms_test
 
 import (
diff --git a/internal/service/kms/ciphertext_test.go b/internal/service/kms/ciphertext_test.go
index 3cc8b2dfd37..b6804953181 100644
--- a/internal/service/kms/ciphertext_test.go
+++ b/internal/service/kms/ciphertext_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kms_test
 
 import (
diff --git a/internal/service/kms/consts.go b/internal/service/kms/consts.go
index cec87d40e0a..e4074fbacf2 100644
--- a/internal/service/kms/consts.go
+++ b/internal/service/kms/consts.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kms
 
 import (
diff --git a/internal/service/kms/custom_key_store.go b/internal/service/kms/custom_key_store.go
index 94c58ef4c39..651d6f61b9a 100644
--- a/internal/service/kms/custom_key_store.go
+++ b/internal/service/kms/custom_key_store.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kms
 
 import (
diff --git a/internal/service/kms/custom_key_store_data_source.go b/internal/service/kms/custom_key_store_data_source.go
index aad87132a3a..4194f22c37c 100644
--- a/internal/service/kms/custom_key_store_data_source.go
+++ b/internal/service/kms/custom_key_store_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kms
 
 import (
diff --git a/internal/service/kms/custom_key_store_data_source_test.go b/internal/service/kms/custom_key_store_data_source_test.go
index e6edd975ebd..bfc3fdc688f 100644
--- a/internal/service/kms/custom_key_store_data_source_test.go
+++ b/internal/service/kms/custom_key_store_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kms_test
 
 import (
diff --git a/internal/service/kms/custom_key_store_test.go b/internal/service/kms/custom_key_store_test.go
index 55b1afc8e1c..2c681279f9b 100644
--- a/internal/service/kms/custom_key_store_test.go
+++ b/internal/service/kms/custom_key_store_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kms_test
 
 import (
diff --git a/internal/service/kms/diff.go b/internal/service/kms/diff.go
index 1f1e97b3951..087d226b4e5 100644
--- a/internal/service/kms/diff.go
+++ b/internal/service/kms/diff.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kms
 
 import (
diff --git a/internal/service/kms/diff_test.go b/internal/service/kms/diff_test.go
index c7ac7a5b3c2..91ad22e6150 100644
--- a/internal/service/kms/diff_test.go
+++ b/internal/service/kms/diff_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kms
 
 import (
diff --git a/internal/service/kms/external_key.go b/internal/service/kms/external_key.go
index 26ae539df67..f1b0d8ede02 100644
--- a/internal/service/kms/external_key.go
+++ b/internal/service/kms/external_key.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kms
 
 import (
@@ -14,12 +17,14 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/kms"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/structure"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
@@ -150,7 +155,7 @@ func resourceExternalKeyCreate(ctx context.Context, d *schema.ResourceData, meta
 	// KMS will report this error until it can validate the policy itself.
 	// They acknowledge this here:
 	// http://docs.aws.amazon.com/kms/latest/APIReference/API_CreateKey.html
-	output, err := WaitIAMPropagation(ctx, func() (*kms.CreateKeyOutput, error) {
+	output, err := WaitIAMPropagation(ctx, propagationTimeout, func() (*kms.CreateKeyOutput, error) {
 		return conn.CreateKeyWithContext(ctx, input)
 	})
 
@@ -160,6 +165,8 @@ func resourceExternalKeyCreate(ctx context.Context, d *schema.ResourceData, meta
 
 	d.SetId(aws.StringValue(output.KeyMetadata.KeyId))
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, d.Id())
+
 	if v, ok := d.GetOk("key_material_base64"); ok {
 		validTo := d.Get("valid_to").(string)
 
@@ -192,7 +199,7 @@ func resourceExternalKeyCreate(ctx context.Context, d *schema.ResourceData, meta
 	}
 
 	if tags := KeyValueTags(ctx, getTagsIn(ctx)); len(tags) > 0 {
-		if err := WaitTagsPropagated(ctx, conn, d.Id(), tags); err != nil {
+		if err := waitTagsPropagated(ctx, conn, d.Id(), tags); err != nil {
 			return sdkdiag.AppendErrorf(diags, "waiting for KMS External Key (%s) tag propagation: %s", d.Id(), err)
 		}
 	}
@@ -204,6 +211,8 @@ func resourceExternalKeyRead(ctx context.Context, d *schema.ResourceData, meta i
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).KMSConn(ctx)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, d.Id())
+
 	key, err := findKey(ctx, conn, d.Id(), d.IsNewResource())
 
 	if !d.IsNewResource() && tfresource.NotFound(err) {
@@ -259,6 +268,8 @@ func resourceExternalKeyUpdate(ctx context.Context, d *schema.ResourceData, meta
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).KMSConn(ctx)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, d.Id())
+
 	if hasChange, enabled, state := d.HasChange("enabled"), d.Get("enabled").(bool), d.Get("key_state").(string); hasChange && enabled && state != kms.KeyStatePendingImport {
 		// Enable before any attributes are modified.
 		if err := updateKeyEnabled(ctx, conn, d.Id(), enabled); err != nil {
@@ -301,12 +312,6 @@ func resourceExternalKeyUpdate(ctx context.Context, d *schema.ResourceData, meta
 		}
 	}
 
-	if d.HasChange("tags_all") {
-		if err := WaitTagsPropagated(ctx, conn, d.Id(), tftags.New(ctx, d.Get("tags_all").(map[string]interface{}))); err != nil {
-			return sdkdiag.AppendErrorf(diags, "waiting for KMS External Key (%s) tag propagation: %s", d.Id(), err)
-		}
-	}
-
 	return append(diags, resourceExternalKeyRead(ctx, d, meta)...)
 }
 
@@ -314,6 +319,8 @@ func resourceExternalKeyDelete(ctx context.Context, d *schema.ResourceData, meta
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).KMSConn(ctx)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, d.Id())
+
 	input := &kms.ScheduleKeyDeletionInput{
 		KeyId: aws.String(d.Id()),
 	}
diff --git a/internal/service/kms/external_key_test.go b/internal/service/kms/external_key_test.go
index 32d69b965f1..d20b25afd6a 100644
--- a/internal/service/kms/external_key_test.go
+++ b/internal/service/kms/external_key_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kms_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/kms"
 	awspolicy "github.com/hashicorp/awspolicyequivalence"
@@ -34,7 +37,7 @@ func TestAccKMSExternalKey_basic(t *testing.T) {
 				Config: testAccExternalKeyConfig_basic(),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckExternalKeyExists(ctx, resourceName, &key),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "kms", regexp.MustCompile(`key/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "kms", regexache.MustCompile(`key/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "bypass_policy_lockout_safety_check", "false"),
 					resource.TestCheckResourceAttr(resourceName, "deletion_window_in_days", "30"),
 					resource.TestCheckResourceAttr(resourceName, "enabled", "false"),
@@ -43,7 +46,7 @@ func TestAccKMSExternalKey_basic(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "key_state", "PendingImport"),
 					resource.TestCheckResourceAttr(resourceName, "key_usage", "ENCRYPT_DECRYPT"),
 					resource.TestCheckResourceAttr(resourceName, "multi_region", "false"),
-					resource.TestMatchResourceAttr(resourceName, "policy", regexp.MustCompile(`Enable IAM User Permissions`)),
+					resource.TestMatchResourceAttr(resourceName, "policy", regexache.MustCompile(`Enable IAM User Permissions`)),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 					resource.TestCheckResourceAttr(resourceName, "valid_to", ""),
 				),
@@ -55,7 +58,6 @@ func TestAccKMSExternalKey_basic(t *testing.T) {
 				ImportStateVerifyIgnore: []string{
 					"bypass_policy_lockout_safety_check",
 					"deletion_window_in_days",
-					"key_material_base64",
 				},
 			},
 		},
@@ -111,7 +113,6 @@ func TestAccKMSExternalKey_multiRegion(t *testing.T) {
 				ImportStateVerifyIgnore: []string{
 					"bypass_policy_lockout_safety_check",
 					"deletion_window_in_days",
-					"key_material_base64",
 				},
 			},
 		},
@@ -144,7 +145,6 @@ func TestAccKMSExternalKey_deletionWindowInDays(t *testing.T) {
 				ImportStateVerifyIgnore: []string{
 					"bypass_policy_lockout_safety_check",
 					"deletion_window_in_days",
-					"key_material_base64",
 				},
 			},
 			{
@@ -185,7 +185,6 @@ func TestAccKMSExternalKey_description(t *testing.T) {
 				ImportStateVerifyIgnore: []string{
 					"bypass_policy_lockout_safety_check",
 					"deletion_window_in_days",
-					"key_material_base64",
 				},
 			},
 			{
@@ -226,7 +225,6 @@ func TestAccKMSExternalKey_enabled(t *testing.T) {
 				ImportStateVerifyIgnore: []string{
 					"bypass_policy_lockout_safety_check",
 					"deletion_window_in_days",
-					"key_material_base64",
 				},
 			},
 			{
@@ -276,7 +274,6 @@ func TestAccKMSExternalKey_keyMaterialBase64(t *testing.T) {
 				ImportStateVerifyIgnore: []string{
 					"bypass_policy_lockout_safety_check",
 					"deletion_window_in_days",
-					"key_material_base64",
 				},
 			},
 			{
@@ -320,7 +317,6 @@ func TestAccKMSExternalKey_policy(t *testing.T) {
 				ImportStateVerifyIgnore: []string{
 					"bypass_policy_lockout_safety_check",
 					"deletion_window_in_days",
-					"key_material_base64",
 				},
 			},
 			{
@@ -363,7 +359,6 @@ func TestAccKMSExternalKey_policyBypass(t *testing.T) {
 				ImportStateVerifyIgnore: []string{
 					"bypass_policy_lockout_safety_check",
 					"deletion_window_in_days",
-					"key_material_base64",
 				},
 			},
 		},
@@ -397,7 +392,6 @@ func TestAccKMSExternalKey_tags(t *testing.T) {
 				ImportStateVerifyIgnore: []string{
 					"bypass_policy_lockout_safety_check",
 					"deletion_window_in_days",
-					"key_material_base64",
 				},
 			},
 			{
@@ -419,6 +413,23 @@ func TestAccKMSExternalKey_tags(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
 				),
 			},
+			{
+				Config: testAccExternalKeyConfig_tags0(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckExternalKeyExists(ctx, resourceName, &key3),
+					testAccCheckExternalKeyNotRecreated(&key2, &key3),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{
+					"bypass_policy_lockout_safety_check",
+					"deletion_window_in_days",
+				},
+			},
 		},
 	})
 }
@@ -452,7 +463,6 @@ func TestAccKMSExternalKey_validTo(t *testing.T) {
 				ImportStateVerifyIgnore: []string{
 					"bypass_policy_lockout_safety_check",
 					"deletion_window_in_days",
-					"key_material_base64",
 				},
 			},
 			{
@@ -701,6 +711,15 @@ resource "aws_kms_external_key" "test" {
 `, rName, tagKey1, tagValue1, tagKey2, tagValue2)
 }
 
+func testAccExternalKeyConfig_tags0(rName string) string {
+	return fmt.Sprintf(`
+resource "aws_kms_external_key" "test" {
+  description             = %[1]q
+  deletion_window_in_days = 7
+}
+`, rName)
+}
+
 func testAccExternalKeyConfig_validTo(rName, validTo string) string {
 	return fmt.Sprintf(`
 # ACCEPTANCE TESTING ONLY -- NEVER EXPOSE YOUR KEY MATERIAL
diff --git a/internal/service/kms/find.go b/internal/service/kms/find.go
index 43283af291b..e7045b4456c 100644
--- a/internal/service/kms/find.go
+++ b/internal/service/kms/find.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kms
 
 import (
diff --git a/internal/service/kms/generate.go b/internal/service/kms/generate.go
index 1fe6b2ffc4b..9f3fb0d87fb 100644
--- a/internal/service/kms/generate.go
+++ b/internal/service/kms/generate.go
@@ -1,4 +1,7 @@
-//go:generate go run ../../generate/tags/main.go -ListTags -ListTagsOp=ListResourceTags -ListTagsInIDElem=KeyId -ServiceTagsSlice -TagInIDElem=KeyId -TagTypeKeyElem=TagKey -TagTypeValElem=TagValue -UpdateTags
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+//go:generate go run ../../generate/tags/main.go -ListTags -ListTagsOp=ListResourceTags -ListTagsOpPaginated -ListTagsInIDElem=KeyId -ServiceTagsSlice -TagInIDElem=KeyId -TagTypeKeyElem=TagKey -TagTypeValElem=TagValue -UpdateTags -Wait -WaitContinuousOccurence 5 -WaitMinTimeout 1s -WaitTimeout 10m -ParentNotFoundErrCode=NotFoundException
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
 
diff --git a/internal/service/kms/grant.go b/internal/service/kms/grant.go
index 9deff9937fa..1d19522c481 100644
--- a/internal/service/kms/grant.go
+++ b/internal/service/kms/grant.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kms
 
 import (
@@ -87,10 +90,13 @@ func ResourceGrant() *schema.Resource {
 				Computed: true,
 			},
 			"grantee_principal": {
-				Type:         schema.TypeString,
-				Required:     true,
-				ForceNew:     true,
-				ValidateFunc: verify.ValidARN,
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+				ValidateFunc: validation.Any(
+					verify.ValidARN,
+					verify.ValidServicePrincipal,
+				),
 			},
 			"key_id": {
 				Type:     schema.TypeString,
@@ -119,10 +125,13 @@ func ResourceGrant() *schema.Resource {
 				ForceNew: true,
 			},
 			"retiring_principal": {
-				Type:         schema.TypeString,
-				Optional:     true,
-				ForceNew:     true,
-				ValidateFunc: verify.ValidARN,
+				Type:     schema.TypeString,
+				Optional: true,
+				ForceNew: true,
+				ValidateFunc: validation.Any(
+					verify.ValidARN,
+					verify.ValidServicePrincipal,
+				),
 			},
 		},
 	}
@@ -328,13 +337,13 @@ func findGrantByTwoPartKeyWithRetry(ctx context.Context, conn *kms.KMS, keyID, g
 		}
 
 		if principal := aws.StringValue(grant.GranteePrincipal); principal != "" {
-			if !arn.IsARN(principal) {
+			if !arn.IsARN(principal) && !verify.IsServicePrincipal(principal) {
 				return retry.RetryableError(fmt.Errorf("grantee principal (%s) is invalid. Perhaps the principal has been deleted or recreated", principal))
 			}
 		}
 
 		if principal := aws.StringValue(grant.RetiringPrincipal); principal != "" {
-			if !arn.IsARN(principal) {
+			if !arn.IsARN(principal) && !verify.IsServicePrincipal(principal) {
 				return retry.RetryableError(fmt.Errorf("retiring principal (%s) is invalid. Perhaps the principal has been deleted or recreated", principal))
 			}
 		}
diff --git a/internal/service/kms/grant_test.go b/internal/service/kms/grant_test.go
index 7b10bfafc23..a2b77edff8b 100644
--- a/internal/service/kms/grant_test.go
+++ b/internal/service/kms/grant_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kms_test
 
 import (
@@ -274,6 +277,41 @@ func TestAccKMSGrant_crossAccountARN(t *testing.T) {
 	})
 }
 
+func TestAccKMSGrant_service(t *testing.T) {
+	ctx := acctest.Context(t)
+	resourceName := "aws_kms_grant.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	servicePrincipal := "dynamodb.us-west-1.amazonaws.com" //lintignore:AWSAT003
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, kms.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckGrantDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccGrantConfig_service(rName, "\"Encrypt\", \"Decrypt\"", servicePrincipal),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckGrantExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "name", rName),
+					resource.TestCheckResourceAttr(resourceName, "grantee_principal", servicePrincipal),
+					resource.TestCheckResourceAttr(resourceName, "retiring_principal", servicePrincipal),
+					resource.TestCheckResourceAttr(resourceName, "operations.#", "2"),
+					resource.TestCheckTypeSetElemAttr(resourceName, "operations.*", "Encrypt"),
+					resource.TestCheckTypeSetElemAttr(resourceName, "operations.*", "Decrypt"),
+					resource.TestCheckResourceAttrPair(resourceName, "key_id", "aws_kms_key.test", "key_id"),
+				),
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"grant_token", "retire_on_delete"},
+			},
+		},
+	})
+}
+
 func testAccCheckGrantDestroy(ctx context.Context) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		conn := acctest.Provider.Meta().(*conns.AWSClient).KMSConn(ctx)
@@ -493,3 +531,15 @@ resource "aws_kms_grant" "test" {
 }
 `, rName, operations))
 }
+
+func testAccGrantConfig_service(rName string, operations string, servicePrincipal string) string {
+	return acctest.ConfigCompose(testAccGrantConfig_base(rName), fmt.Sprintf(`
+resource "aws_kms_grant" "test" {
+  name               = %[1]q
+  key_id             = aws_kms_key.test.key_id
+  operations         = [%[2]s]
+  grantee_principal  = %[3]q
+  retiring_principal = %[3]q
+}
+`, rName, operations, servicePrincipal))
+}
diff --git a/internal/service/kms/key.go b/internal/service/kms/key.go
index 2c25346ca04..9934cf3cbe7 100644
--- a/internal/service/kms/key.go
+++ b/internal/service/kms/key.go
@@ -1,13 +1,18 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kms
 
 import (
 	"context"
 	"fmt"
 	"log"
+	"time"
 
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/kms"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
@@ -15,6 +20,7 @@ import (
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
@@ -34,6 +40,10 @@ func ResourceKey() *schema.Resource {
 			StateContext: schema.ImportStatePassthroughContext,
 		},
 
+		Timeouts: &schema.ResourceTimeout{
+			Create: schema.DefaultTimeout(2 * time.Minute),
+		},
+
 		CustomizeDiff: verify.SetTagsDiff,
 
 		Schema: map[string]*schema.Schema{
@@ -152,7 +162,7 @@ func resourceKeyCreate(ctx context.Context, d *schema.ResourceData, meta interfa
 	// The KMS service's awareness of principals is limited by "eventual consistency".
 	// They acknowledge this here:
 	// http://docs.aws.amazon.com/kms/latest/APIReference/API_CreateKey.html
-	output, err := WaitIAMPropagation(ctx, func() (*kms.CreateKeyOutput, error) {
+	output, err := WaitIAMPropagation(ctx, d.Timeout(schema.TimeoutCreate), func() (*kms.CreateKeyOutput, error) {
 		return conn.CreateKeyWithContext(ctx, input)
 	})
 
@@ -162,6 +172,8 @@ func resourceKeyCreate(ctx context.Context, d *schema.ResourceData, meta interfa
 
 	d.SetId(aws.StringValue(output.KeyMetadata.KeyId))
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, d.Id())
+
 	if enableKeyRotation := d.Get("enable_key_rotation").(bool); enableKeyRotation {
 		if err := updateKeyRotationEnabled(ctx, conn, d.Id(), enableKeyRotation); err != nil {
 			return sdkdiag.AppendErrorf(diags, "creating KMS Key (%s): %s", d.Id(), err)
@@ -182,7 +194,7 @@ func resourceKeyCreate(ctx context.Context, d *schema.ResourceData, meta interfa
 	}
 
 	if tags := KeyValueTags(ctx, getTagsIn(ctx)); len(tags) > 0 {
-		if err := WaitTagsPropagated(ctx, conn, d.Id(), tags); err != nil {
+		if err := waitTagsPropagated(ctx, conn, d.Id(), tags); err != nil {
 			return sdkdiag.AppendErrorf(diags, "waiting for KMS Key (%s) tag propagation: %s", d.Id(), err)
 		}
 	}
@@ -194,6 +206,8 @@ func resourceKeyRead(ctx context.Context, d *schema.ResourceData, meta interface
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).KMSConn(ctx)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, d.Id())
+
 	key, err := findKey(ctx, conn, d.Id(), d.IsNewResource())
 
 	if !d.IsNewResource() && tfresource.NotFound(err) {
@@ -236,6 +250,8 @@ func resourceKeyUpdate(ctx context.Context, d *schema.ResourceData, meta interfa
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).KMSConn(ctx)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, d.Id())
+
 	if hasChange, enabled := d.HasChange("is_enabled"), d.Get("is_enabled").(bool); hasChange && enabled {
 		// Enable before any attributes are modified.
 		if err := updateKeyEnabled(ctx, conn, d.Id(), enabled); err != nil {
@@ -268,12 +284,6 @@ func resourceKeyUpdate(ctx context.Context, d *schema.ResourceData, meta interfa
 		}
 	}
 
-	if d.HasChange("tags_all") {
-		if err := WaitTagsPropagated(ctx, conn, d.Id(), tftags.New(ctx, d.Get("tags_all").(map[string]interface{}))); err != nil {
-			return sdkdiag.AppendErrorf(diags, "waiting for KMS Key (%s) tag propagation: %s", d.Id(), err)
-		}
-	}
-
 	return append(diags, resourceKeyRead(ctx, d, meta)...)
 }
 
@@ -281,6 +291,8 @@ func resourceKeyDelete(ctx context.Context, d *schema.ResourceData, meta interfa
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).KMSConn(ctx)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, d.Id())
+
 	input := &kms.ScheduleKeyDeletionInput{
 		KeyId: aws.String(d.Id()),
 	}
diff --git a/internal/service/kms/key_data_source.go b/internal/service/kms/key_data_source.go
index 80dfd774038..f538a51690e 100644
--- a/internal/service/kms/key_data_source.go
+++ b/internal/service/kms/key_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kms
 
 import (
diff --git a/internal/service/kms/key_data_source_test.go b/internal/service/kms/key_data_source_test.go
index 020667f4ec7..c627fefce4b 100644
--- a/internal/service/kms/key_data_source_test.go
+++ b/internal/service/kms/key_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kms_test
 
 import (
diff --git a/internal/service/kms/key_policy.go b/internal/service/kms/key_policy.go
index f8d4e4e04d1..8b3891cadc4 100644
--- a/internal/service/kms/key_policy.go
+++ b/internal/service/kms/key_policy.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kms
 
 import (
diff --git a/internal/service/kms/key_policy_test.go b/internal/service/kms/key_policy_test.go
index 53d8d3f61f6..01e80736144 100644
--- a/internal/service/kms/key_policy_test.go
+++ b/internal/service/kms/key_policy_test.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kms_test
 
 import (
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/kms"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -87,7 +90,7 @@ func TestAccKMSKeyPolicy_bypass(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccKeyPolicyConfig_policyBypass(rName, false),
-				ExpectError: regexp.MustCompile(`The new key policy will not allow you to update the key policy in the future`),
+				ExpectError: regexache.MustCompile(`The new key policy will not allow you to update the key policy in the future`),
 			},
 			{
 				Config: testAccKeyPolicyConfig_policyBypass(rName, true),
diff --git a/internal/service/kms/key_test.go b/internal/service/kms/key_test.go
index b8b39245374..a6699aee0d6 100644
--- a/internal/service/kms/key_test.go
+++ b/internal/service/kms/key_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kms_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/kms"
 	awspolicy "github.com/hashicorp/awspolicyequivalence"
@@ -45,6 +48,13 @@ func TestAccKMSKey_basic(t *testing.T) {
 				ImportStateVerify:       true,
 				ImportStateVerifyIgnore: []string{"deletion_window_in_days", "bypass_policy_lockout_safety_check"},
 			},
+			{
+				// Set deletion window to 7 days
+				Config: testAccKeyConfig_basicDeletionWindow(),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckKeyExists(ctx, resourceName, &key),
+				),
+			},
 		},
 	})
 }
@@ -200,7 +210,7 @@ func TestAccKMSKey_Policy_bypass(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccKeyConfig_policyBypass(rName, false),
-				ExpectError: regexp.MustCompile(`The new key policy will not allow you to update the key policy in the future`),
+				ExpectError: regexache.MustCompile(`The new key policy will not allow you to update the key policy in the future`),
 			},
 			{
 				Config: testAccKeyConfig_policyBypass(rName, true),
@@ -489,6 +499,96 @@ func TestAccKMSKey_tags(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
 				),
 			},
+			{
+				Config: testAccKeyConfig_tags0(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckKeyExists(ctx, resourceName, &key),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
+				),
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"deletion_window_in_days", "bypass_policy_lockout_safety_check"},
+			},
+		},
+	})
+}
+
+// https://github.com/hashicorp/terraform-provider-aws/issues/26174.
+func TestAccKMSKey_ignoreTags(t *testing.T) {
+	ctx := acctest.Context(t)
+	var key kms.KeyMetadata
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_kms_key.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, kms.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckKeyDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccKeyConfig_ignoreTags(rName, "key1", "value1", "key2", "value2"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckKeyExists(ctx, resourceName, &key),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
+				),
+			},
+			// Add an ignored tag.
+			{
+				Config: testAccKeyConfig_ignoreTags(rName, "key1", "value1", "key2", "value2"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckKeyAddTag(ctx, &key, "ignkey1", "ignvalue1"),
+				),
+			},
+			{
+				Config: testAccKeyConfig_ignoreTags(rName, "key1", "value1updated", "key3", "value3"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckKeyExists(ctx, resourceName, &key),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1updated"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key3", "value3"),
+				),
+			},
+		},
+	})
+}
+
+// https://github.com/hashicorp/terraform-provider-aws/issues/33219.
+func TestAccKMSKey_updateTagsEmptyValue(t *testing.T) {
+	ctx := acctest.Context(t)
+	var key kms.KeyMetadata
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_kms_key.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, kms.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckKeyDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccKeyConfig_tags2(rName, "key1", "value1", "key2", "value2"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckKeyExists(ctx, resourceName, &key),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
+				),
+			},
+			{
+				Config: testAccKeyConfig_tags2(rName, "key1", "value1", "key2", ""),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckKeyExists(ctx, resourceName, &key),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key2", ""),
+				),
+			},
 		},
 	})
 }
@@ -582,12 +682,38 @@ func testAccCheckKeyExists(ctx context.Context, name string, key *kms.KeyMetadat
 	}
 }
 
+func testAccCheckKeyAddTag(ctx context.Context, key *kms.KeyMetadata, tagKey, tagValue string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		conn := acctest.Provider.Meta().(*conns.AWSClient).KMSConn(ctx)
+
+		input := &kms.TagResourceInput{
+			KeyId: key.KeyId,
+			Tags: []*kms.Tag{{
+				TagKey:   aws.String(tagKey),
+				TagValue: aws.String(tagValue),
+			}},
+		}
+
+		_, err := conn.TagResourceWithContext(ctx, input)
+
+		return err
+	}
+}
+
 func testAccKeyConfig_basic() string {
 	return `
 resource "aws_kms_key" "test" {}
 `
 }
 
+func testAccKeyConfig_basicDeletionWindow() string {
+	return `
+resource "aws_kms_key" "test" {
+  deletion_window_in_days = 7
+}
+`
+}
+
 func testAccKeyConfig_name(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_kms_key" "test" {
@@ -1028,7 +1154,8 @@ resource "aws_kms_key" "test" {
 func testAccKeyConfig_tags1(rName, tagKey1, tagValue1 string) string {
 	return fmt.Sprintf(`
 resource "aws_kms_key" "test" {
-  description = %[1]q
+  description             = %[1]q
+  deletion_window_in_days = 7
 
   tags = {
     %[2]q = %[3]q
@@ -1040,7 +1167,43 @@ resource "aws_kms_key" "test" {
 func testAccKeyConfig_tags2(rName, tagKey1, tagValue1, tagKey2, tagValue2 string) string {
 	return fmt.Sprintf(`
 resource "aws_kms_key" "test" {
-  description = %[1]q
+  description             = %[1]q
+  deletion_window_in_days = 7
+
+  tags = {
+    %[2]q = %[3]q
+    %[4]q = %[5]q
+  }
+}
+`, rName, tagKey1, tagValue1, tagKey2, tagValue2)
+}
+
+func testAccKeyConfig_tags0(rName string) string {
+	return fmt.Sprintf(`
+resource "aws_kms_key" "test" {
+  description             = %[1]q
+  deletion_window_in_days = 7
+}
+`, rName)
+}
+
+func testAccKeyConfig_ignoreTags(rName, tagKey1, tagValue1, tagKey2, tagValue2 string) string {
+	// lintignore:AT004
+	return fmt.Sprintf(`
+provider "aws" {
+  default_tags {
+    tags = {
+      "defkey1" = "defvalue1"
+    }
+  }
+  ignore_tags {
+    keys = ["ignkey1"]
+  }
+}
+
+resource "aws_kms_key" "test" {
+  description             = %[1]q
+  deletion_window_in_days = 7
 
   tags = {
     %[2]q = %[3]q
diff --git a/internal/service/kms/kms_test.go b/internal/service/kms/kms_test.go
index f6145ed005b..afd6b2eb360 100644
--- a/internal/service/kms/kms_test.go
+++ b/internal/service/kms/kms_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kms_test
 
 import (
diff --git a/internal/service/kms/public_key_data_source.go b/internal/service/kms/public_key_data_source.go
index 39326fd6942..045fd5dd6ac 100644
--- a/internal/service/kms/public_key_data_source.go
+++ b/internal/service/kms/public_key_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kms
 
 import (
diff --git a/internal/service/kms/public_key_data_source_test.go b/internal/service/kms/public_key_data_source_test.go
index 4921c5ac8ce..cf6714eed28 100644
--- a/internal/service/kms/public_key_data_source_test.go
+++ b/internal/service/kms/public_key_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kms_test
 
 import (
diff --git a/internal/service/kms/replica_external_key.go b/internal/service/kms/replica_external_key.go
index 2176fa73561..0a2cfef8c3a 100644
--- a/internal/service/kms/replica_external_key.go
+++ b/internal/service/kms/replica_external_key.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kms
 
 import (
@@ -10,11 +13,13 @@ import (
 	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/aws/aws-sdk-go/service/kms"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
@@ -146,7 +151,7 @@ func resourceReplicaExternalKeyCreate(ctx context.Context, d *schema.ResourceDat
 
 	replicateConn := kms.New(session)
 
-	output, err := WaitIAMPropagation(ctx, func() (*kms.ReplicateKeyOutput, error) {
+	output, err := WaitIAMPropagation(ctx, propagationTimeout, func() (*kms.ReplicateKeyOutput, error) {
 		return replicateConn.ReplicateKeyWithContext(ctx, input)
 	})
 
@@ -156,6 +161,8 @@ func resourceReplicaExternalKeyCreate(ctx context.Context, d *schema.ResourceDat
 
 	d.SetId(aws.StringValue(output.ReplicaKeyMetadata.KeyId))
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, d.Id())
+
 	if _, err := WaitReplicaExternalKeyCreated(ctx, conn, d.Id()); err != nil {
 		return sdkdiag.AppendErrorf(diags, "waiting for KMS Replica External Key (%s) create: %s", d.Id(), err)
 	}
@@ -192,7 +199,7 @@ func resourceReplicaExternalKeyCreate(ctx context.Context, d *schema.ResourceDat
 	}
 
 	if tags := KeyValueTags(ctx, getTagsIn(ctx)); len(tags) > 0 {
-		if err := WaitTagsPropagated(ctx, conn, d.Id(), tags); err != nil {
+		if err := waitTagsPropagated(ctx, conn, d.Id(), tags); err != nil {
 			return sdkdiag.AppendErrorf(diags, "waiting for KMS Replica External Key (%s) tag propagation: %s", d.Id(), err)
 		}
 	}
@@ -204,6 +211,8 @@ func resourceReplicaExternalKeyRead(ctx context.Context, d *schema.ResourceData,
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).KMSConn(ctx)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, d.Id())
+
 	key, err := findKey(ctx, conn, d.Id(), d.IsNewResource())
 
 	if !d.IsNewResource() && tfresource.NotFound(err) {
@@ -260,6 +269,8 @@ func resourceReplicaExternalKeyUpdate(ctx context.Context, d *schema.ResourceDat
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).KMSConn(ctx)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, d.Id())
+
 	if hasChange, enabled, state := d.HasChange("enabled"), d.Get("enabled").(bool), d.Get("key_state").(string); hasChange && enabled && state != kms.KeyStatePendingImport {
 		// Enable before any attributes are modified.
 		if err := updateKeyEnabled(ctx, conn, d.Id(), enabled); err != nil {
@@ -302,12 +313,6 @@ func resourceReplicaExternalKeyUpdate(ctx context.Context, d *schema.ResourceDat
 		}
 	}
 
-	if d.HasChange("tags_all") {
-		if err := WaitTagsPropagated(ctx, conn, d.Id(), tftags.New(ctx, d.Get("tags_all").(map[string]interface{}))); err != nil {
-			return sdkdiag.AppendErrorf(diags, "waiting for KMS Replica External Key (%s) tag propagation: %s", d.Id(), err)
-		}
-	}
-
 	return append(diags, resourceReplicaExternalKeyRead(ctx, d, meta)...)
 }
 
@@ -315,6 +320,8 @@ func resourceReplicaExternalKeyDelete(ctx context.Context, d *schema.ResourceDat
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).KMSConn(ctx)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, d.Id())
+
 	input := &kms.ScheduleKeyDeletionInput{
 		KeyId: aws.String(d.Id()),
 	}
diff --git a/internal/service/kms/replica_external_key_test.go b/internal/service/kms/replica_external_key_test.go
index cc2676081ad..2038bc1761d 100644
--- a/internal/service/kms/replica_external_key_test.go
+++ b/internal/service/kms/replica_external_key_test.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kms_test
 
 import (
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/kms"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -31,7 +34,7 @@ func TestAccKMSReplicaExternalKey_basic(t *testing.T) {
 				Config: testAccReplicaExternalKeyConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckKeyExists(ctx, resourceName, &key),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "kms", regexp.MustCompile(`key/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "kms", regexache.MustCompile(`key/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "bypass_policy_lockout_safety_check", "false"),
 					resource.TestCheckResourceAttr(resourceName, "deletion_window_in_days", "30"),
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
@@ -40,7 +43,7 @@ func TestAccKMSReplicaExternalKey_basic(t *testing.T) {
 					resource.TestCheckNoResourceAttr(resourceName, "key_material_base64"),
 					resource.TestCheckResourceAttr(resourceName, "key_state", "PendingImport"),
 					resource.TestCheckResourceAttr(resourceName, "key_usage", "ENCRYPT_DECRYPT"),
-					resource.TestMatchResourceAttr(resourceName, "policy", regexp.MustCompile(`Enable IAM User Permissions`)),
+					resource.TestMatchResourceAttr(resourceName, "policy", regexache.MustCompile(`Enable IAM User Permissions`)),
 					resource.TestCheckResourceAttrPair(resourceName, "primary_key_arn", primaryKeyResourceName, "arn"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 					resource.TestCheckResourceAttr(resourceName, "valid_to", ""),
@@ -213,6 +216,23 @@ func TestAccKMSReplicaExternalKey_tags(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
 				),
 			},
+			{
+				Config: testAccReplicaExternalKeyConfig_tags0(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckKeyExists(ctx, resourceName, &key),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{
+					"bypass_policy_lockout_safety_check",
+					"deletion_window_in_days",
+					"key_material_base64",
+				},
+			},
 		},
 	})
 }
@@ -314,7 +334,7 @@ resource "aws_kms_external_key" "test" {
 }
 
 resource "aws_kms_replica_external_key" "test" {
-  description     = %[2]q
+  description     = "%[1]s-Replica"
   enabled         = true
   primary_key_arn = aws_kms_external_key.test.arn
 
@@ -349,7 +369,7 @@ resource "aws_kms_external_key" "test" {
 }
 
 resource "aws_kms_replica_external_key" "test" {
-  description     = %[2]q
+  description     = "%[1]s-Replica"
   enabled         = true
   primary_key_arn = aws_kms_external_key.test.arn
 
@@ -364,3 +384,30 @@ resource "aws_kms_replica_external_key" "test" {
 }
 `, rName, tagKey1, tagValue1, tagKey2, tagValue2))
 }
+
+func testAccReplicaExternalKeyConfig_tags0(rName string) string {
+	return acctest.ConfigCompose(acctest.ConfigAlternateRegionProvider(), fmt.Sprintf(`
+# ACCEPTANCE TESTING ONLY -- NEVER EXPOSE YOUR KEY MATERIAL
+resource "aws_kms_external_key" "test" {
+  provider = awsalternate
+
+  description  = %[1]q
+  multi_region = true
+  enabled      = true
+
+  key_material_base64 = "Wblj06fduthWggmsT0cLVoIMOkeLbc2kVfMud77i/JY="
+
+  deletion_window_in_days = 7
+}
+
+resource "aws_kms_replica_external_key" "test" {
+  description     = "%[1]s-Replica"
+  enabled         = true
+  primary_key_arn = aws_kms_external_key.test.arn
+
+  key_material_base64 = "Wblj06fduthWggmsT0cLVoIMOkeLbc2kVfMud77i/JY="
+
+  deletion_window_in_days = 7
+}
+`, rName))
+}
diff --git a/internal/service/kms/replica_key.go b/internal/service/kms/replica_key.go
index f847155dd1c..759bad69a1f 100644
--- a/internal/service/kms/replica_key.go
+++ b/internal/service/kms/replica_key.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kms
 
 import (
@@ -9,11 +12,13 @@ import (
 	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/aws/aws-sdk-go/service/kms"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
@@ -134,7 +139,7 @@ func resourceReplicaKeyCreate(ctx context.Context, d *schema.ResourceData, meta
 
 	replicateConn := kms.New(session)
 
-	output, err := WaitIAMPropagation(ctx, func() (*kms.ReplicateKeyOutput, error) {
+	output, err := WaitIAMPropagation(ctx, propagationTimeout, func() (*kms.ReplicateKeyOutput, error) {
 		return replicateConn.ReplicateKeyWithContext(ctx, input)
 	})
 
@@ -144,6 +149,8 @@ func resourceReplicaKeyCreate(ctx context.Context, d *schema.ResourceData, meta
 
 	d.SetId(aws.StringValue(output.ReplicaKeyMetadata.KeyId))
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, d.Id())
+
 	if _, err := WaitReplicaKeyCreated(ctx, conn, d.Id()); err != nil {
 		return sdkdiag.AppendErrorf(diags, "waiting for KMS Replica Key (%s) create: %s", d.Id(), err)
 	}
@@ -164,7 +171,7 @@ func resourceReplicaKeyCreate(ctx context.Context, d *schema.ResourceData, meta
 	}
 
 	if tags := KeyValueTags(ctx, getTagsIn(ctx)); len(tags) > 0 {
-		if err := WaitTagsPropagated(ctx, conn, d.Id(), tags); err != nil {
+		if err := waitTagsPropagated(ctx, conn, d.Id(), tags); err != nil {
 			return sdkdiag.AppendErrorf(diags, "waiting for KMS Replica Key (%s) tag propagation: %s", d.Id(), err)
 		}
 	}
@@ -176,6 +183,8 @@ func resourceReplicaKeyRead(ctx context.Context, d *schema.ResourceData, meta in
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).KMSConn(ctx)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, d.Id())
+
 	key, err := findKey(ctx, conn, d.Id(), d.IsNewResource())
 
 	if !d.IsNewResource() && tfresource.NotFound(err) {
@@ -226,6 +235,8 @@ func resourceReplicaKeyUpdate(ctx context.Context, d *schema.ResourceData, meta
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).KMSConn(ctx)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, d.Id())
+
 	if hasChange, enabled := d.HasChange("enabled"), d.Get("enabled").(bool); hasChange && enabled {
 		// Enable before any attributes are modified.
 		if err := updateKeyEnabled(ctx, conn, d.Id(), enabled); err != nil {
@@ -252,12 +263,6 @@ func resourceReplicaKeyUpdate(ctx context.Context, d *schema.ResourceData, meta
 		}
 	}
 
-	if d.HasChange("tags_all") {
-		if err := WaitTagsPropagated(ctx, conn, d.Id(), tftags.New(ctx, d.Get("tags_all").(map[string]interface{}))); err != nil {
-			return sdkdiag.AppendErrorf(diags, "waiting for KMS Replica Key (%s) tag propagation: %s", d.Id(), err)
-		}
-	}
-
 	return append(diags, resourceReplicaKeyRead(ctx, d, meta)...)
 }
 
@@ -265,6 +270,8 @@ func resourceReplicaKeyDelete(ctx context.Context, d *schema.ResourceData, meta
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).KMSConn(ctx)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, d.Id())
+
 	input := &kms.ScheduleKeyDeletionInput{
 		KeyId: aws.String(d.Id()),
 	}
diff --git a/internal/service/kms/replica_key_test.go b/internal/service/kms/replica_key_test.go
index 05810e5f6fc..8d84f97e83b 100644
--- a/internal/service/kms/replica_key_test.go
+++ b/internal/service/kms/replica_key_test.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kms_test
 
 import (
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/kms"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -32,14 +35,14 @@ func TestAccKMSReplicaKey_basic(t *testing.T) {
 				Config: testAccReplicaKeyConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckKeyExists(ctx, resourceName, &key),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "kms", regexp.MustCompile(`key/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "kms", regexache.MustCompile(`key/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "bypass_policy_lockout_safety_check", "false"),
 					resource.TestCheckResourceAttr(resourceName, "deletion_window_in_days", "30"),
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
 					resource.TestCheckResourceAttr(resourceName, "enabled", "true"),
 					resource.TestCheckResourceAttr(resourceName, "key_rotation_enabled", "false"),
 					resource.TestCheckResourceAttr(resourceName, "key_spec", "SYMMETRIC_DEFAULT"),
-					resource.TestMatchResourceAttr(resourceName, "policy", regexp.MustCompile(`Enable IAM User Permissions`)),
+					resource.TestMatchResourceAttr(resourceName, "policy", regexache.MustCompile(`Enable IAM User Permissions`)),
 					resource.TestCheckResourceAttrPair(resourceName, "primary_key_arn", primaryKeyResourceName, "arn"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 				),
@@ -200,10 +203,13 @@ func TestAccKMSReplicaKey_tags(t *testing.T) {
 				),
 			},
 			{
-				ResourceName:            resourceName,
-				ImportState:             true,
-				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"deletion_window_in_days", "bypass_policy_lockout_safety_check"},
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{
+					"deletion_window_in_days",
+					"bypass_policy_lockout_safety_check",
+				},
 			},
 			{
 				Config: testAccReplicaKeyConfig_tags2(rName, "key1", "value1updated", "key2", "value2"),
@@ -222,6 +228,22 @@ func TestAccKMSReplicaKey_tags(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
 				),
 			},
+			{
+				Config: testAccReplicaKeyConfig_tags0(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckKeyExists(ctx, resourceName, &key),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{
+					"deletion_window_in_days",
+					"bypass_policy_lockout_safety_check",
+				},
+			},
 		},
 	})
 }
@@ -368,6 +390,26 @@ resource "aws_kms_replica_key" "test" {
 `, rName, tagKey1, tagValue1, tagKey2, tagValue2))
 }
 
+func testAccReplicaKeyConfig_tags0(rName string) string {
+	return acctest.ConfigCompose(acctest.ConfigAlternateRegionProvider(), fmt.Sprintf(`
+resource "aws_kms_key" "test" {
+  provider = awsalternate
+
+  description  = %[1]q
+  multi_region = true
+
+  deletion_window_in_days = 7
+}
+
+resource "aws_kms_replica_key" "test" {
+  description     = %[1]q
+  primary_key_arn = aws_kms_key.test.arn
+
+  deletion_window_in_days = 7
+}
+`, rName))
+}
+
 func testAccReplicaKeyConfig_two(rName string) string {
 	return acctest.ConfigCompose(acctest.ConfigMultipleRegionProvider(3), fmt.Sprintf(`
 resource "aws_kms_key" "test" {
diff --git a/internal/service/kms/secret_data_source.go b/internal/service/kms/secret_data_source.go
index 7b88fd4db5e..8fb9244ad2d 100644
--- a/internal/service/kms/secret_data_source.go
+++ b/internal/service/kms/secret_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kms
 
 import (
diff --git a/internal/service/kms/secret_data_source_test.go b/internal/service/kms/secret_data_source_test.go
index 4aea546e1d2..8cf9817ff3a 100644
--- a/internal/service/kms/secret_data_source_test.go
+++ b/internal/service/kms/secret_data_source_test.go
@@ -1,9 +1,12 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kms_test
 
 import (
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/kms"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
@@ -19,7 +22,7 @@ func TestAccKMSSecretDataSource_removed(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccSecretDataSourceConfig_basic,
-				ExpectError: regexp.MustCompile(tfkms.SecretRemovedMessage),
+				ExpectError: regexache.MustCompile(tfkms.SecretRemovedMessage),
 			},
 		},
 	})
diff --git a/internal/service/kms/secrets_data_source.go b/internal/service/kms/secrets_data_source.go
index 19bcbdb22a0..25ac693d97a 100644
--- a/internal/service/kms/secrets_data_source.go
+++ b/internal/service/kms/secrets_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kms
 
 import (
diff --git a/internal/service/kms/secrets_data_source_test.go b/internal/service/kms/secrets_data_source_test.go
index b5d43dce6c8..8c24865454c 100644
--- a/internal/service/kms/secrets_data_source_test.go
+++ b/internal/service/kms/secrets_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kms_test
 
 import (
diff --git a/internal/service/kms/service_package_gen.go b/internal/service/kms/service_package_gen.go
index 2968b36e8e1..1f126fed777 100644
--- a/internal/service/kms/service_package_gen.go
+++ b/internal/service/kms/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	kms_sdkv1 "github.com/aws/aws-sdk-go/service/kms"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -123,4 +124,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*k
 	return kms_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/kms/status.go b/internal/service/kms/status.go
index a1be8d45496..de6fe0cac44 100644
--- a/internal/service/kms/status.go
+++ b/internal/service/kms/status.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kms
 
 import (
diff --git a/internal/service/kms/sweep.go b/internal/service/kms/sweep.go
index 65b8215c72a..0a1145e8460 100644
--- a/internal/service/kms/sweep.go
+++ b/internal/service/kms/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package kms
 
@@ -9,13 +9,16 @@ import (
 
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/kms"
+	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	"github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/sdk"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_kms_key", &resource.Sweeper{
 		Name: "aws_kms_key",
 		F:    sweepKeys,
@@ -24,7 +27,7 @@ func init() {
 
 func sweepKeys(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
@@ -49,7 +52,11 @@ func sweepKeys(region string) error {
 			}
 
 			if err != nil {
-				sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error reading KMS Key (%s): %w", keyID, err))
+				if tfawserr.ErrMessageContains(err, "AccessDeniedException", "is not authorized to perform") {
+					log.Printf("[DEBUG] Skipping KMS Key (%s): %s", keyID, err)
+					continue
+				}
+				sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("reading KMS Key (%s): %w", keyID, err))
 				continue
 			}
 
@@ -66,15 +73,15 @@ func sweepKeys(region string) error {
 			d := r.Data(nil)
 			d.SetId(keyID)
 			d.Set("key_id", keyID)
-			d.Set("deletion_window_in_days", "7")
+			d.Set("deletion_window_in_days", 7) //nolint:gomnd
 
-			sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
+			sweepResources = append(sweepResources, sdk.NewSweepResource(r, d, client))
 		}
 
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping KMS Key sweep for %s: %s", region, err)
 		return sweeperErrs.ErrorOrNil() // In case we have completed some pages, but had errors
 	}
@@ -83,7 +90,7 @@ func sweepKeys(region string) error {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error listing KMS Keys (%s): %w", region, err))
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error sweeping KMS Keys (%s): %w", region, err))
diff --git a/internal/service/kms/tags_gen.go b/internal/service/kms/tags_gen.go
index 53962c5d70a..110ab9100c1 100644
--- a/internal/service/kms/tags_gen.go
+++ b/internal/service/kms/tags_gen.go
@@ -4,12 +4,18 @@ package kms
 import (
 	"context"
 	"fmt"
+	"time"
 
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/kms"
 	"github.com/aws/aws-sdk-go/service/kms/kmsiface"
+	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -21,14 +27,34 @@ func listTags(ctx context.Context, conn kmsiface.KMSAPI, identifier string) (tft
 	input := &kms.ListResourceTagsInput{
 		KeyId: aws.String(identifier),
 	}
+	var output []*kms.Tag
 
-	output, err := conn.ListResourceTagsWithContext(ctx, input)
+	err := conn.ListResourceTagsPagesWithContext(ctx, input, func(page *kms.ListResourceTagsOutput, lastPage bool) bool {
+		if page == nil {
+			return !lastPage
+		}
+
+		for _, v := range page.Tags {
+			if v != nil {
+				output = append(output, v)
+			}
+		}
+
+		return !lastPage
+	})
+
+	if tfawserr.ErrCodeEquals(err, "NotFoundException") {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
 
 	if err != nil {
 		return tftags.New(ctx, nil), err
 	}
 
-	return KeyValueTags(ctx, output.Tags), nil
+	return KeyValueTags(ctx, output), nil
 }
 
 // ListTags lists kms service tags and set them in Context.
@@ -102,6 +128,8 @@ func updateTags(ctx context.Context, conn kmsiface.KMSAPI, identifier string, ol
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.KMS)
 	if len(removedTags) > 0 {
@@ -132,6 +160,12 @@ func updateTags(ctx context.Context, conn kmsiface.KMSAPI, identifier string, ol
 		}
 	}
 
+	if len(removedTags) > 0 || len(updatedTags) > 0 {
+		if err := waitTagsPropagated(ctx, conn, identifier, newTags); err != nil {
+			return fmt.Errorf("waiting for resource (%s) tag propagation: %w", identifier, err)
+		}
+	}
+
 	return nil
 }
 
@@ -140,3 +174,36 @@ func updateTags(ctx context.Context, conn kmsiface.KMSAPI, identifier string, ol
 func (p *servicePackage) UpdateTags(ctx context.Context, meta any, identifier string, oldTags, newTags any) error {
 	return updateTags(ctx, meta.(*conns.AWSClient).KMSConn(ctx), identifier, oldTags, newTags)
 }
+
+// waitTagsPropagated waits for kms service tags to be propagated.
+// The identifier is typically the Amazon Resource Name (ARN), although
+// it may also be a different identifier depending on the service.
+func waitTagsPropagated(ctx context.Context, conn kmsiface.KMSAPI, id string, tags tftags.KeyValueTags) error {
+	tflog.Debug(ctx, "Waiting for tag propagation", map[string]any{
+		"tags": tags,
+	})
+
+	checkFunc := func() (bool, error) {
+		output, err := listTags(ctx, conn, id)
+
+		if tfresource.NotFound(err) {
+			return false, nil
+		}
+
+		if err != nil {
+			return false, err
+		}
+
+		if inContext, ok := tftags.FromContext(ctx); ok {
+			output = output.IgnoreConfig(inContext.IgnoreConfig)
+		}
+
+		return output.Equal(tags), nil
+	}
+	opts := tfresource.WaitOpts{
+		ContinuousTargetOccurence: 5,
+		MinTimeout:                1 * time.Second,
+	}
+
+	return tfresource.WaitUntil(ctx, 10*time.Minute, checkFunc, opts)
+}
diff --git a/internal/service/kms/validate.go b/internal/service/kms/validate.go
index 2e22f35880c..bc4a6e58380 100644
--- a/internal/service/kms/validate.go
+++ b/internal/service/kms/validate.go
@@ -1,23 +1,26 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kms
 
 import (
 	"fmt"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
 )
 
 const (
-	aliasNameRegexPattern   = `alias/[a-zA-Z0-9/_-]+`
-	multiRegionKeyIdPattern = `mrk-[a-f0-9]{32}`
+	aliasNameRegexPattern   = `alias/[0-9A-Za-z_/-]+`
+	multiRegionKeyIdPattern = `mrk-[0-9a-f]{32}`
 )
 
 var (
-	aliasNameRegex     = regexp.MustCompile(`^` + aliasNameRegexPattern + `$`)
-	keyIdRegex         = regexp.MustCompile(`^` + verify.UUIDRegexPattern + `|` + multiRegionKeyIdPattern + `$`)
-	keyIdResourceRegex = regexp.MustCompile(`^key/(` + verify.UUIDRegexPattern + `|` + multiRegionKeyIdPattern + `)$`)
+	aliasNameRegex     = regexache.MustCompile(`^` + aliasNameRegexPattern + `$`)
+	keyIdRegex         = regexache.MustCompile(`^` + verify.UUIDRegexPattern + `|` + multiRegionKeyIdPattern + `$`)
+	keyIdResourceRegex = regexache.MustCompile(`^key/(` + verify.UUIDRegexPattern + `|` + multiRegionKeyIdPattern + `)$`)
 )
 
 func validGrantName(v interface{}, k string) (ws []string, es []error) {
@@ -27,8 +30,8 @@ func validGrantName(v interface{}, k string) (ws []string, es []error) {
 		es = append(es, fmt.Errorf("%s can not be greater than 256 characters", k))
 	}
 
-	if !regexp.MustCompile(`^[a-zA-Z0-9:/_-]+$`).MatchString(value) {
-		es = append(es, fmt.Errorf("%s must only contain [a-zA-Z0-9:/_-]", k))
+	if !regexache.MustCompile(`^[0-9A-Za-z_:/-]+$`).MatchString(value) {
+		es = append(es, fmt.Errorf("%s must only contain [0-9A-Za-z_:/-]", k))
 	}
 
 	return
@@ -39,7 +42,7 @@ func validNameForDataSource(v interface{}, k string) (ws []string, es []error) {
 
 	if !aliasNameRegex.MatchString(value) {
 		es = append(es, fmt.Errorf(
-			"%q must begin with 'alias/' and be comprised of only [a-zA-Z0-9/_-]", k))
+			"%q must begin with 'alias/' and be comprised of only [0-9A-Za-z_/-]", k))
 	}
 	return
 }
@@ -47,13 +50,13 @@ func validNameForDataSource(v interface{}, k string) (ws []string, es []error) {
 func validNameForResource(v interface{}, k string) (ws []string, es []error) {
 	value := v.(string)
 
-	if regexp.MustCompile(`^(alias/aws/)`).MatchString(value) {
+	if regexache.MustCompile(`^(alias/aws/)`).MatchString(value) {
 		es = append(es, fmt.Errorf("%q cannot begin with reserved AWS CMK prefix 'alias/aws/'", k))
 	}
 
 	if !aliasNameRegex.MatchString(value) {
 		es = append(es, fmt.Errorf(
-			"%q must begin with 'alias/' and be comprised of only [a-zA-Z0-9/_-]", k))
+			"%q must begin with 'alias/' and be comprised of only [0-9A-Za-z_/-]", k))
 	}
 	return
 }
diff --git a/internal/service/kms/validate_test.go b/internal/service/kms/validate_test.go
index 63f46d2f1a1..a56c597b479 100644
--- a/internal/service/kms/validate_test.go
+++ b/internal/service/kms/validate_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kms
 
 import (
diff --git a/internal/service/kms/wait.go b/internal/service/kms/wait.go
index a9e473cf542..7e83547b795 100644
--- a/internal/service/kms/wait.go
+++ b/internal/service/kms/wait.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package kms
 
 import (
@@ -6,10 +9,8 @@ import (
 
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/kms"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	awspolicy "github.com/hashicorp/awspolicyequivalence"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
-	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
@@ -34,8 +35,8 @@ const (
 
 // WaitIAMPropagation retries the specified function if the returned error indicates an IAM eventual consistency issue.
 // If the retries time out the specified function is called one last time.
-func WaitIAMPropagation[T any](ctx context.Context, f func() (T, error)) (T, error) {
-	outputRaw, err := tfresource.RetryWhenAWSErrCodeEquals(ctx, propagationTimeout, func() (interface{}, error) {
+func WaitIAMPropagation[T any](ctx context.Context, timeout time.Duration, f func() (T, error)) (T, error) {
+	outputRaw, err := tfresource.RetryWhenAWSErrCodeEquals(ctx, timeout, func() (interface{}, error) {
 		return f()
 	},
 		kms.ErrCodeMalformedPolicyDocumentException)
@@ -202,28 +203,6 @@ func WaitKeyValidToPropagated(ctx context.Context, conn *kms.KMS, id string, val
 	return tfresource.WaitUntil(ctx, KeyValidToPropagationTimeout, checkFunc, opts)
 }
 
-func WaitTagsPropagated(ctx context.Context, conn *kms.KMS, id string, tags tftags.KeyValueTags) error {
-	checkFunc := func() (bool, error) {
-		output, err := listTags(ctx, conn, id)
-
-		if tfawserr.ErrCodeEquals(err, kms.ErrCodeNotFoundException) {
-			return false, nil
-		}
-
-		if err != nil {
-			return false, err
-		}
-
-		return output.Equal(tags), nil
-	}
-	opts := tfresource.WaitOpts{
-		ContinuousTargetOccurence: 5,
-		MinTimeout:                1 * time.Second,
-	}
-
-	return tfresource.WaitUntil(ctx, KeyTagsPropagationTimeout, checkFunc, opts)
-}
-
 func WaitReplicaExternalKeyCreated(ctx context.Context, conn *kms.KMS, id string) (*kms.KeyMetadata, error) {
 	stateConf := &retry.StateChangeConf{
 		Pending: []string{kms.KeyStateCreating},
diff --git a/internal/service/lakeformation/consts.go b/internal/service/lakeformation/consts.go
index 1c55c725426..99ef4846bf8 100644
--- a/internal/service/lakeformation/consts.go
+++ b/internal/service/lakeformation/consts.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lakeformation
 
 import (
diff --git a/internal/service/lakeformation/data_lake_settings.go b/internal/service/lakeformation/data_lake_settings.go
index 24d66a9e631..f9511521e6a 100644
--- a/internal/service/lakeformation/data_lake_settings.go
+++ b/internal/service/lakeformation/data_lake_settings.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lakeformation
 
 import (
@@ -42,6 +45,15 @@ func ResourceDataLakeSettings() *schema.Resource {
 					ValidateFunc: verify.ValidARN,
 				},
 			},
+			"read_only_admins": {
+				Type:     schema.TypeSet,
+				Computed: true,
+				Optional: true,
+				Elem: &schema.Schema{
+					Type:         schema.TypeString,
+					ValidateFunc: verify.ValidARN,
+				},
+			},
 			"allow_external_data_filtering": {
 				Type:     schema.TypeBool,
 				Optional: true,
@@ -145,6 +157,10 @@ func resourceDataLakeSettingsCreate(ctx context.Context, d *schema.ResourceData,
 		settings.DataLakeAdmins = expandDataLakeSettingsAdmins(v.(*schema.Set))
 	}
 
+	if v, ok := d.GetOk("read_only_admins"); ok {
+		settings.ReadOnlyAdmins = expandDataLakeSettingsAdmins(v.(*schema.Set))
+	}
+
 	if v, ok := d.GetOk("allow_external_data_filtering"); ok {
 		settings.AllowExternalDataFiltering = aws.Bool(v.(bool))
 	}
@@ -234,6 +250,7 @@ func resourceDataLakeSettingsRead(ctx context.Context, d *schema.ResourceData, m
 	settings := output.DataLakeSettings
 
 	d.Set("admins", flattenDataLakeSettingsAdmins(settings.DataLakeAdmins))
+	d.Set("read_only_admins", flattenDataLakeSettingsAdmins(settings.ReadOnlyAdmins))
 	d.Set("allow_external_data_filtering", settings.AllowExternalDataFiltering)
 	d.Set("authorized_session_tag_value_list", flex.FlattenStringList(settings.AuthorizedSessionTagValueList))
 	d.Set("create_database_default_permissions", flattenDataLakeSettingsCreateDefaultPermissions(settings.CreateDatabaseDefaultPermissions))
@@ -253,6 +270,7 @@ func resourceDataLakeSettingsDelete(ctx context.Context, d *schema.ResourceData,
 			CreateDatabaseDefaultPermissions: make([]*lakeformation.PrincipalPermissions, 0),
 			CreateTableDefaultPermissions:    make([]*lakeformation.PrincipalPermissions, 0),
 			DataLakeAdmins:                   make([]*lakeformation.DataLakePrincipal, 0),
+			ReadOnlyAdmins:                   make([]*lakeformation.DataLakePrincipal, 0),
 			TrustedResourceOwners:            make([]*string, 0),
 		},
 	}
diff --git a/internal/service/lakeformation/data_lake_settings_data_source.go b/internal/service/lakeformation/data_lake_settings_data_source.go
index 537e8843915..5ba440ed862 100644
--- a/internal/service/lakeformation/data_lake_settings_data_source.go
+++ b/internal/service/lakeformation/data_lake_settings_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lakeformation
 
 import (
@@ -27,6 +30,11 @@ func DataSourceDataLakeSettings() *schema.Resource {
 				Computed: true,
 				Elem:     &schema.Schema{Type: schema.TypeString},
 			},
+			"read_only_admins": {
+				Type:     schema.TypeSet,
+				Computed: true,
+				Elem:     &schema.Schema{Type: schema.TypeString},
+			},
 			"allow_external_data_filtering": {
 				Type:     schema.TypeBool,
 				Computed: true,
@@ -118,6 +126,7 @@ func dataSourceDataLakeSettingsRead(ctx context.Context, d *schema.ResourceData,
 	settings := output.DataLakeSettings
 
 	d.Set("admins", flattenDataLakeSettingsAdmins(settings.DataLakeAdmins))
+	d.Set("read_only_admins", flattenDataLakeSettingsAdmins(settings.ReadOnlyAdmins))
 	d.Set("allow_external_data_filtering", settings.AllowExternalDataFiltering)
 	d.Set("authorized_session_tag_value_list", flex.FlattenStringList(settings.AuthorizedSessionTagValueList))
 	d.Set("create_database_default_permissions", flattenDataLakeSettingsCreateDefaultPermissions(settings.CreateDatabaseDefaultPermissions))
diff --git a/internal/service/lakeformation/data_lake_settings_data_source_test.go b/internal/service/lakeformation/data_lake_settings_data_source_test.go
index acd4fdde13e..e4245c9e954 100644
--- a/internal/service/lakeformation/data_lake_settings_data_source_test.go
+++ b/internal/service/lakeformation/data_lake_settings_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lakeformation_test
 
 import (
@@ -33,6 +36,28 @@ func testAccDataLakeSettingsDataSource_basic(t *testing.T) {
 	})
 }
 
+func testAccDataLakeSettingsDataSource_readOnlyAdmins(t *testing.T) {
+	ctx := acctest.Context(t)
+	resourceName := "data.aws_lakeformation_data_lake_settings.test"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, lakeformation.EndpointsID) },
+		ErrorCheck:               acctest.ErrorCheck(t, lakeformation.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckDataLakeSettingsDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccDataLakeSettingsDataSourceConfig_readOnlyAdmins,
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttrPair(resourceName, "catalog_id", "data.aws_caller_identity.current", "account_id"),
+					resource.TestCheckResourceAttr(resourceName, "read_only_admins.#", "1"),
+					resource.TestCheckResourceAttrPair(resourceName, "read_only_admins.0", "data.aws_iam_session_context.current", "issuer_arn"),
+				),
+			},
+		},
+	})
+}
+
 const testAccDataLakeSettingsDataSourceConfig_basic = `
 data "aws_caller_identity" "current" {}
 
@@ -49,3 +74,20 @@ data "aws_lakeformation_data_lake_settings" "test" {
   catalog_id = aws_lakeformation_data_lake_settings.test.catalog_id
 }
 `
+
+const testAccDataLakeSettingsDataSourceConfig_readOnlyAdmins = `
+data "aws_caller_identity" "current" {}
+
+data "aws_iam_session_context" "current" {
+  arn = data.aws_caller_identity.current.arn
+}
+
+resource "aws_lakeformation_data_lake_settings" "test" {
+  catalog_id       = data.aws_caller_identity.current.account_id
+  read_only_admins = [data.aws_iam_session_context.current.issuer_arn]
+}
+
+data "aws_lakeformation_data_lake_settings" "test" {
+  catalog_id = aws_lakeformation_data_lake_settings.test.catalog_id
+}
+`
diff --git a/internal/service/lakeformation/data_lake_settings_test.go b/internal/service/lakeformation/data_lake_settings_test.go
index eb81bd80642..84c3e831544 100644
--- a/internal/service/lakeformation/data_lake_settings_test.go
+++ b/internal/service/lakeformation/data_lake_settings_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lakeformation_test
 
 import (
@@ -95,6 +98,28 @@ func testAccDataLakeSettings_withoutCatalogID(t *testing.T) {
 	})
 }
 
+func testAccDataLakeSettings_readOnlyAdmins(t *testing.T) {
+	ctx := acctest.Context(t)
+	resourceName := "aws_lakeformation_data_lake_settings.test"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, lakeformation.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckDataLakeSettingsDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccDataLakeSettingsConfig_readOnlyAdmins,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckDataLakeSettingsExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "read_only_admins.#", "1"),
+					resource.TestCheckResourceAttrPair(resourceName, "read_only_admins.0", "data.aws_iam_session_context.current", "issuer_arn"),
+				),
+			},
+		},
+	})
+}
+
 func testAccCheckDataLakeSettingsDestroy(ctx context.Context) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		conn := acctest.Provider.Meta().(*conns.AWSClient).LakeFormationConn(ctx)
@@ -123,6 +148,10 @@ func testAccCheckDataLakeSettingsDestroy(ctx context.Context) resource.TestCheck
 			if output != nil && output.DataLakeSettings != nil && len(output.DataLakeSettings.DataLakeAdmins) > 0 {
 				return fmt.Errorf("Lake Formation data lake admin(s) (%s) still exist", rs.Primary.ID)
 			}
+
+			if output != nil && output.DataLakeSettings != nil && len(output.DataLakeSettings.ReadOnlyAdmins) > 0 {
+				return fmt.Errorf("Lake Formation data lake read only admin(s) (%s) still exist", rs.Primary.ID)
+			}
 		}
 
 		return nil
@@ -193,3 +222,17 @@ resource "aws_lakeformation_data_lake_settings" "test" {
   admins = [data.aws_iam_session_context.current.issuer_arn]
 }
 `
+
+const testAccDataLakeSettingsConfig_readOnlyAdmins = `
+data "aws_caller_identity" "current" {}
+
+data "aws_iam_session_context" "current" {
+  arn = data.aws_caller_identity.current.arn
+}
+
+resource "aws_lakeformation_data_lake_settings" "test" {
+  catalog_id = data.aws_caller_identity.current.account_id
+
+  read_only_admins = [data.aws_iam_session_context.current.issuer_arn]
+}
+`
diff --git a/internal/service/lakeformation/filter.go b/internal/service/lakeformation/filter.go
index d37dcc0dced..405da724b68 100644
--- a/internal/service/lakeformation/filter.go
+++ b/internal/service/lakeformation/filter.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lakeformation
 
 import (
diff --git a/internal/service/lakeformation/filter_test.go b/internal/service/lakeformation/filter_test.go
index 2221ced077f..bdec9fc0ddc 100644
--- a/internal/service/lakeformation/filter_test.go
+++ b/internal/service/lakeformation/filter_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lakeformation_test
 
 import (
diff --git a/internal/service/lakeformation/generate.go b/internal/service/lakeformation/generate.go
index 8df5d9cc949..50e7541ecaa 100644
--- a/internal/service/lakeformation/generate.go
+++ b/internal/service/lakeformation/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
 
diff --git a/internal/service/lakeformation/lakeformation_test.go b/internal/service/lakeformation/lakeformation_test.go
index 6f0966caaca..40c8436475d 100644
--- a/internal/service/lakeformation/lakeformation_test.go
+++ b/internal/service/lakeformation/lakeformation_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lakeformation_test
 
 import (
@@ -12,9 +15,13 @@ func TestAccLakeFormation_serial(t *testing.T) {
 	testCases := map[string]map[string]func(t *testing.T){
 		"DataLakeSettings": {
 			"basic":            testAccDataLakeSettings_basic,
-			"dataSource":       testAccDataLakeSettingsDataSource_basic,
 			"disappears":       testAccDataLakeSettings_disappears,
 			"withoutCatalogId": testAccDataLakeSettings_withoutCatalogID,
+			"readOnlyAdmins":   testAccDataLakeSettings_readOnlyAdmins,
+		},
+		"DataLakeSettingsDataSource": {
+			"basic":          testAccDataLakeSettingsDataSource_basic,
+			"readOnlyAdmins": testAccDataLakeSettingsDataSource_readOnlyAdmins,
 		},
 		"PermissionsBasic": {
 			"basic":               testAccPermissions_basic,
@@ -62,11 +69,13 @@ func TestAccLakeFormation_serial(t *testing.T) {
 			"valuesOverFifty": testAccLFTag_Values_overFifty,
 		},
 		"ResourceLFTags": {
-			"basic":            testAccResourceLFTags_basic,
-			"database":         testAccResourceLFTags_database,
-			"databaseMultiple": testAccResourceLFTags_databaseMultiple,
-			"table":            testAccResourceLFTags_table,
-			"tableWithColumns": testAccResourceLFTags_tableWithColumns,
+			"basic":                testAccResourceLFTags_basic,
+			"database":             testAccResourceLFTags_database,
+			"databaseMultipleTags": testAccResourceLFTags_databaseMultipleTags,
+			"disappears":           testAccResourceLFTags_disappears,
+			"hierarchy":            testAccResourceLFTags_hierarchy,
+			"table":                testAccResourceLFTags_table,
+			"tableWithColumns":     testAccResourceLFTags_tableWithColumns,
 		},
 	}
 
diff --git a/internal/service/lakeformation/lf_tag.go b/internal/service/lakeformation/lf_tag.go
index d160f9166a9..13896eed457 100644
--- a/internal/service/lakeformation/lf_tag.go
+++ b/internal/service/lakeformation/lf_tag.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lakeformation
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"strings"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/lakeformation"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -237,7 +240,7 @@ func ReadLFTagID(id string) (string, string, error) {
 func validateLFTagValues() schema.SchemaValidateFunc {
 	return validation.All(
 		validation.StringLenBetween(1, 255),
-		validation.StringMatch(regexp.MustCompile(`^([\p{L}\p{Z}\p{N}_.:\*\/=+\-@%]*)$`), ""),
+		validation.StringMatch(regexache.MustCompile(`^([\p{L}\p{Z}\p{N}_.:\*\/=+\-@%]*)$`), ""),
 	)
 }
 
diff --git a/internal/service/lakeformation/lf_tag_test.go b/internal/service/lakeformation/lf_tag_test.go
index ffe724acf9e..24ad66aec82 100644
--- a/internal/service/lakeformation/lf_tag_test.go
+++ b/internal/service/lakeformation/lf_tag_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lakeformation_test
 
 import (
diff --git a/internal/service/lakeformation/permissions.go b/internal/service/lakeformation/permissions.go
index 66bcb735cdb..594d25ee738 100644
--- a/internal/service/lakeformation/permissions.go
+++ b/internal/service/lakeformation/permissions.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lakeformation
 
 import (
@@ -150,7 +153,6 @@ func ResourcePermissions() *schema.Resource {
 							Required: true,
 							ForceNew: true,
 							MinItems: 1,
-							MaxItems: 15,
 							Elem: &schema.Schema{
 								Type:         schema.TypeString,
 								ValidateFunc: validateLFTagValues(),
@@ -199,7 +201,6 @@ func ResourcePermissions() *schema.Resource {
 										Required: true,
 										ForceNew: true,
 										MinItems: 1,
-										MaxItems: 15,
 										Elem: &schema.Schema{
 											Type:         schema.TypeString,
 											ValidateFunc: validateLFTagValues(),
diff --git a/internal/service/lakeformation/permissions_data_source.go b/internal/service/lakeformation/permissions_data_source.go
index 2df43b96160..f64177b1067 100644
--- a/internal/service/lakeformation/permissions_data_source.go
+++ b/internal/service/lakeformation/permissions_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lakeformation
 
 import (
@@ -95,7 +98,6 @@ func DataSourcePermissions() *schema.Resource {
 							Type:     schema.TypeSet,
 							Required: true,
 							MinItems: 1,
-							MaxItems: 15,
 							Elem: &schema.Schema{
 								Type:         schema.TypeString,
 								ValidateFunc: validateLFTagValues(),
@@ -132,7 +134,6 @@ func DataSourcePermissions() *schema.Resource {
 										Type:     schema.TypeSet,
 										Required: true,
 										MinItems: 1,
-										MaxItems: 15,
 										Elem: &schema.Schema{
 											Type:         schema.TypeString,
 											ValidateFunc: validateLFTagValues(),
diff --git a/internal/service/lakeformation/permissions_data_source_test.go b/internal/service/lakeformation/permissions_data_source_test.go
index 98e5db87281..7a096dc8da4 100644
--- a/internal/service/lakeformation/permissions_data_source_test.go
+++ b/internal/service/lakeformation/permissions_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lakeformation_test
 
 import (
diff --git a/internal/service/lakeformation/permissions_test.go b/internal/service/lakeformation/permissions_test.go
index 1080d4562e1..1103c7cb695 100644
--- a/internal/service/lakeformation/permissions_test.go
+++ b/internal/service/lakeformation/permissions_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lakeformation_test
 
 import (
diff --git a/internal/service/lakeformation/resource.go b/internal/service/lakeformation/resource.go
index 65b225c8ffb..4be275cd29b 100644
--- a/internal/service/lakeformation/resource.go
+++ b/internal/service/lakeformation/resource.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lakeformation
 
 import (
diff --git a/internal/service/lakeformation/resource_data_source.go b/internal/service/lakeformation/resource_data_source.go
index 5853d482f95..bb307fd2b14 100644
--- a/internal/service/lakeformation/resource_data_source.go
+++ b/internal/service/lakeformation/resource_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lakeformation
 
 import (
diff --git a/internal/service/lakeformation/resource_data_source_test.go b/internal/service/lakeformation/resource_data_source_test.go
index dc9f233721f..b223281ba02 100644
--- a/internal/service/lakeformation/resource_data_source_test.go
+++ b/internal/service/lakeformation/resource_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lakeformation_test
 
 import (
diff --git a/internal/service/lakeformation/resource_lf_tags.go b/internal/service/lakeformation/resource_lf_tags.go
index 0f5d45cc450..2a3776f3eac 100644
--- a/internal/service/lakeformation/resource_lf_tags.go
+++ b/internal/service/lakeformation/resource_lf_tags.go
@@ -1,10 +1,12 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lakeformation
 
 import (
 	"bytes"
 	"context"
 	"fmt"
-	"log"
 	"reflect"
 	"time"
 
@@ -18,6 +20,7 @@ import (
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/create"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -223,31 +226,27 @@ func ResourceResourceLFTags() *schema.Resource {
 }
 
 func resourceResourceLFTagsCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+
 	conn := meta.(*conns.AWSClient).LakeFormationConn(ctx)
 
-	input := &lakeformation.AddLFTagsToResourceInput{
-		Resource: &lakeformation.Resource{},
-	}
+	input := &lakeformation.AddLFTagsToResourceInput{}
 
 	if v, ok := d.GetOk("catalog_id"); ok {
 		input.CatalogId = aws.String(v.(string))
 	}
 
-	if v, ok := d.GetOk("database"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
-		input.Resource.Database = ExpandDatabaseResource(v.([]interface{})[0].(map[string]interface{}))
-	}
-
 	if v, ok := d.GetOk("lf_tag"); ok && v.(*schema.Set).Len() > 0 {
 		input.LFTags = expandLFTagPairs(v.(*schema.Set).List())
 	}
 
-	if v, ok := d.GetOk("table"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
-		input.Resource.Table = ExpandTableResource(v.([]interface{})[0].(map[string]interface{}))
+	tagger, ds := lfTagsTagger(d)
+	diags = append(diags, ds...)
+	if diags.HasError() {
+		return diags
 	}
 
-	if v, ok := d.GetOk("table_with_columns"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
-		input.Resource.TableWithColumns = expandTableColumnsResource(v.([]interface{})[0].(map[string]interface{}))
-	}
+	input.Resource = tagger.ExpandResource(d)
 
 	var output *lakeformation.AddLFTagsToResourceOutput
 	err := retry.RetryContext(ctx, IAMPropagationTimeout, func() *retry.RetryError {
@@ -271,19 +270,16 @@ func resourceResourceLFTagsCreate(ctx context.Context, d *schema.ResourceData, m
 	}
 
 	if err != nil {
-		return create.DiagError(names.LakeFormation, create.ErrActionCreating, ResNameLFTags, input.String(), err)
+		return create.AddError(diags, names.LakeFormation, create.ErrActionCreating, ResNameLFTags, input.String(), err)
 	}
 
-	diags := diag.Diagnostics{}
-
 	if output != nil && len(output.Failures) > 0 {
 		for _, v := range output.Failures {
 			if v.LFTag == nil || v.Error == nil {
 				continue
 			}
 
-			diags = create.AddWarning(
-				diags,
+			diags = create.AddError(diags,
 				names.LakeFormation,
 				create.ErrActionCreating,
 				ResNameLFTags,
@@ -291,27 +287,22 @@ func resourceResourceLFTagsCreate(ctx context.Context, d *schema.ResourceData, m
 				awserr.New(aws.StringValue(v.Error.ErrorCode), aws.StringValue(v.Error.ErrorMessage), nil),
 			)
 		}
-
-		if len(diags) == len(input.LFTags) {
-			return append(diags,
-				diag.Diagnostic{
-					Severity: diag.Error,
-					Summary:  create.ProblemStandardMessage(names.LakeFormation, create.ErrActionCreating, ResNameLFTags, "", fmt.Errorf("attempted to add %d tags, %d failures", len(input.LFTags), len(diags))),
-				},
-			)
-		}
+	}
+	if diags.HasError() {
+		return diags
 	}
 
 	d.SetId(fmt.Sprintf("%d", create.StringHashcode(input.String())))
 
-	return append(resourceResourceLFTagsRead(ctx, d, meta), diags...)
+	return append(diags, resourceResourceLFTagsRead(ctx, d, meta)...)
 }
 
 func resourceResourceLFTagsRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+
 	conn := meta.(*conns.AWSClient).LakeFormationConn(ctx)
 
 	input := &lakeformation.GetResourceLFTagsInput{
-		Resource:           &lakeformation.Resource{},
 		ShowAssignedLFTags: aws.Bool(true),
 	}
 
@@ -319,82 +310,53 @@ func resourceResourceLFTagsRead(ctx context.Context, d *schema.ResourceData, met
 		input.CatalogId = aws.String(v.(string))
 	}
 
-	if v, ok := d.GetOk("database"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
-		input.Resource.Database = ExpandDatabaseResource(v.([]interface{})[0].(map[string]interface{}))
-	}
-
-	if v, ok := d.GetOk("table"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
-		input.Resource.Table = ExpandTableResource(v.([]interface{})[0].(map[string]interface{}))
+	tagger, ds := lfTagsTagger(d)
+	diags = append(diags, ds...)
+	if diags.HasError() {
+		return diags
 	}
 
-	if v, ok := d.GetOk("table_with_columns"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
-		input.Resource.TableWithColumns = expandTableColumnsResource(v.([]interface{})[0].(map[string]interface{}))
-	}
+	input.Resource = tagger.ExpandResource(d)
 
 	output, err := conn.GetResourceLFTagsWithContext(ctx, input)
 
 	if err != nil {
-		return create.DiagError(names.LakeFormation, create.ErrActionReading, ResNameLFTags, d.Id(), err)
-	}
-
-	if len(output.LFTagOnDatabase) > 0 {
-		if err := d.Set("lf_tag", flattenLFTagPairs(output.LFTagOnDatabase)); err != nil {
-			return create.DiagError(names.LakeFormation, create.ErrActionSetting, ResNameLFTags, d.Id(), err)
-		}
-	}
-
-	if len(output.LFTagsOnColumns) > 0 {
-		for _, v := range output.LFTagsOnColumns {
-			if aws.StringValue(v.Name) != d.Get("table_with_columns.0.name").(string) {
-				continue
-			}
-
-			if err := d.Set("lf_tag", flattenLFTagPairs(v.LFTags)); err != nil {
-				return create.DiagError(names.LakeFormation, create.ErrActionSetting, ResNameLFTags, d.Id(), err)
-			}
-		}
+		return create.AddError(diags, names.LakeFormation, create.ErrActionReading, ResNameLFTags, d.Id(), err)
 	}
 
-	if len(output.LFTagsOnTable) > 0 {
-		if err := d.Set("lf_tag", flattenLFTagPairs(output.LFTagsOnTable)); err != nil {
-			return create.DiagError(names.LakeFormation, create.ErrActionSetting, ResNameLFTags, d.Id(), err)
-		}
+	if err := d.Set("lf_tag", tagger.FlattenTags(output)); err != nil {
+		return create.AddError(diags, names.LakeFormation, create.ErrActionSetting, ResNameLFTags, d.Id(), err)
 	}
 
-	return nil
+	return diags
 }
 
 func resourceResourceLFTagsDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+
 	conn := meta.(*conns.AWSClient).LakeFormationConn(ctx)
 
-	input := &lakeformation.RemoveLFTagsFromResourceInput{
-		Resource: &lakeformation.Resource{},
-	}
+	input := &lakeformation.RemoveLFTagsFromResourceInput{}
 
 	if v, ok := d.GetOk("catalog_id"); ok {
 		input.CatalogId = aws.String(v.(string))
 	}
 
-	if v, ok := d.GetOk("database"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
-		input.Resource.Database = ExpandDatabaseResource(v.([]interface{})[0].(map[string]interface{}))
-	}
-
 	if v, ok := d.GetOk("lf_tag"); ok && v.(*schema.Set).Len() > 0 {
 		input.LFTags = expandLFTagPairs(v.(*schema.Set).List())
 	}
 
-	if v, ok := d.GetOk("table"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
-		input.Resource.Table = ExpandTableResource(v.([]interface{})[0].(map[string]interface{}))
+	tagger, ds := lfTagsTagger(d)
+	diags = append(diags, ds...)
+	if diags.HasError() {
+		return diags
 	}
 
-	if v, ok := d.GetOk("table_with_columns"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
-		input.Resource.TableWithColumns = expandTableColumnsResource(v.([]interface{})[0].(map[string]interface{}))
-	}
+	input.Resource = tagger.ExpandResource(d)
 
-	if input.Resource == nil || reflect.DeepEqual(input.Resource, &lakeformation.Resource{}) {
+	if input.Resource == nil || reflect.DeepEqual(input.Resource, &lakeformation.Resource{}) || len(input.LFTags) == 0 {
 		// if resource is empty, don't delete = it won't delete anything since this is the predicate
-		log.Printf("[WARN] No Lake Formation Resource LF Tags to remove")
-		return nil
+		return create.AddWarningMessage(diags, names.LakeFormation, create.ErrActionSetting, ResNameLFTags, d.Id(), "no LF-Tags to remove")
 	}
 
 	err := retry.RetryContext(ctx, d.Timeout(schema.TimeoutDelete), func() *retry.RetryError {
@@ -408,7 +370,7 @@ func resourceResourceLFTagsDelete(ctx context.Context, d *schema.ResourceData, m
 				return retry.RetryableError(err)
 			}
 
-			return retry.NonRetryableError(fmt.Errorf("unable to revoke Lake Formation Permissions: %w", err))
+			return retry.NonRetryableError(fmt.Errorf("removing Lake Formation LF-Tags: %w", err))
 		}
 		return nil
 	})
@@ -418,10 +380,83 @@ func resourceResourceLFTagsDelete(ctx context.Context, d *schema.ResourceData, m
 	}
 
 	if err != nil {
-		return create.DiagError(names.LakeFormation, create.ErrActionDeleting, ResNameLFTags, d.Id(), err)
+		return create.AddError(diags, names.LakeFormation, create.ErrActionDeleting, ResNameLFTags, d.Id(), err)
+	}
+
+	return diags
+}
+
+func lfTagsTagger(d *schema.ResourceData) (tagger, diag.Diagnostics) {
+	var diags diag.Diagnostics
+	if v, ok := d.GetOk("database"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
+		return &databaseTagger{}, diags
+	} else if v, ok := d.GetOk("table"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
+		return &tableTagger{}, diags
+	} else if v, ok := d.GetOk("table_with_columns"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
+		return &columnTagger{}, diags
+	} else {
+		diags = append(diags, errs.NewErrorDiagnostic(
+			"Invalid Lake Formation Resource Type",
+			"An unexpected error occurred while resolving the Lake Formation Resource type. "+
+				"This is always an error in the provider. "+
+				"Please report the following to the provider developer:\n\n"+
+				"No Lake Formation Resource defined.",
+		))
+		return nil, diags
+	}
+}
+
+type tagger interface {
+	ExpandResource(*schema.ResourceData) *lakeformation.Resource
+	FlattenTags(*lakeformation.GetResourceLFTagsOutput) []any
+}
+
+type databaseTagger struct{}
+
+func (t *databaseTagger) ExpandResource(d *schema.ResourceData) *lakeformation.Resource {
+	v := d.Get("database").([]any)[0].(map[string]any)
+	return &lakeformation.Resource{
+		Database: ExpandDatabaseResource(v),
+	}
+}
+
+func (t *databaseTagger) FlattenTags(output *lakeformation.GetResourceLFTagsOutput) []any {
+	return flattenLFTagPairs(output.LFTagOnDatabase)
+}
+
+type tableTagger struct{}
+
+func (t *tableTagger) ExpandResource(d *schema.ResourceData) *lakeformation.Resource {
+	v := d.Get("table").([]any)[0].(map[string]any)
+	return &lakeformation.Resource{
+		Table: ExpandTableResource(v),
+	}
+}
+
+func (t *tableTagger) FlattenTags(output *lakeformation.GetResourceLFTagsOutput) []any {
+	return flattenLFTagPairs(output.LFTagsOnTable)
+}
+
+type columnTagger struct{}
+
+func (t *columnTagger) ExpandResource(d *schema.ResourceData) *lakeformation.Resource {
+	v := d.Get("table_with_columns").([]any)[0].(map[string]any)
+	return &lakeformation.Resource{
+		TableWithColumns: expandTableColumnsResource(v),
+	}
+}
+
+func (t *columnTagger) FlattenTags(output *lakeformation.GetResourceLFTagsOutput) []any {
+	if len(output.LFTagsOnColumns) == 0 {
+		return []any{}
+	}
+
+	tags := output.LFTagsOnColumns[0]
+	if tags == nil {
+		return []any{}
 	}
 
-	return nil
+	return flattenLFTagPairs(tags.LFTags)
 }
 
 func lfTagsHash(v interface{}) int {
diff --git a/internal/service/lakeformation/resource_lf_tags_test.go b/internal/service/lakeformation/resource_lf_tags_test.go
index a2f99445768..1abc4ca1213 100644
--- a/internal/service/lakeformation/resource_lf_tags_test.go
+++ b/internal/service/lakeformation/resource_lf_tags_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lakeformation_test
 
 import (
@@ -15,6 +18,7 @@ import (
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	tflakeformation "github.com/hashicorp/terraform-provider-aws/internal/service/lakeformation"
 )
 
 func testAccResourceLFTags_basic(t *testing.T) {
@@ -44,6 +48,29 @@ func testAccResourceLFTags_basic(t *testing.T) {
 	})
 }
 
+func testAccResourceLFTags_disappears(t *testing.T) {
+	ctx := acctest.Context(t)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_lakeformation_resource_lf_tags.test"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, lakeformation.EndpointsID) },
+		ErrorCheck:               acctest.ErrorCheck(t, lakeformation.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckResourceDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccResourceLFTagsConfig_basic(rName, []string{"copse"}, "copse"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckDatabaseLFTagsExists(ctx, resourceName),
+					acctest.CheckResourceDisappears(ctx, acctest.Provider, tflakeformation.ResourceResourceLFTags(), resourceName),
+				),
+				ExpectNonEmptyPlan: true,
+			},
+		},
+	})
+}
+
 func testAccResourceLFTags_database(t *testing.T) {
 	ctx := acctest.Context(t)
 	resourceName := "aws_lakeformation_resource_lf_tags.test"
@@ -80,7 +107,7 @@ func testAccResourceLFTags_database(t *testing.T) {
 	})
 }
 
-func testAccResourceLFTags_databaseMultiple(t *testing.T) {
+func testAccResourceLFTags_databaseMultipleTags(t *testing.T) {
 	ctx := acctest.Context(t)
 	resourceName := "aws_lakeformation_resource_lf_tags.test"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
@@ -92,7 +119,7 @@ func testAccResourceLFTags_databaseMultiple(t *testing.T) {
 		CheckDestroy:             testAccCheckDatabaseLFTagsDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config:  testAccResourceLFTagsConfig_databaseMultiple(rName, []string{"abbey", "village", "luffield", "woodcote", "copse", "chapel", "stowe", "club"}, []string{"farm", "theloop", "aintree", "brooklands", "maggotts", "becketts", "vale"}, "woodcote", "theloop"),
+				Config:  testAccResourceLFTagsConfig_databaseMultipleTags(rName, []string{"abbey", "village", "luffield", "woodcote", "copse", "chapel", "stowe", "club"}, []string{"farm", "theloop", "aintree", "brooklands", "maggotts", "becketts", "vale"}, "woodcote", "theloop"),
 				Destroy: false,
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDatabaseLFTagsExists(ctx, resourceName),
@@ -107,7 +134,7 @@ func testAccResourceLFTags_databaseMultiple(t *testing.T) {
 				),
 			},
 			{
-				Config: testAccResourceLFTagsConfig_databaseMultiple(rName, []string{"abbey", "village", "luffield", "woodcote", "copse", "chapel", "stowe", "club"}, []string{"farm", "theloop", "aintree", "brooklands", "maggotts", "becketts", "vale"}, "stowe", "becketts"),
+				Config: testAccResourceLFTagsConfig_databaseMultipleTags(rName, []string{"abbey", "village", "luffield", "woodcote", "copse", "chapel", "stowe", "club"}, []string{"farm", "theloop", "aintree", "brooklands", "maggotts", "becketts", "vale"}, "stowe", "becketts"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDatabaseLFTagsExists(ctx, resourceName),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "lf_tag.*", map[string]string{
@@ -124,6 +151,83 @@ func testAccResourceLFTags_databaseMultiple(t *testing.T) {
 	})
 }
 
+func testAccResourceLFTags_hierarchy(t *testing.T) {
+	ctx := acctest.Context(t)
+	databaseResourceName := "aws_lakeformation_resource_lf_tags.database_tags"
+	tableResourceName := "aws_lakeformation_resource_lf_tags.table_tags"
+	columnResourceName := "aws_lakeformation_resource_lf_tags.column_tags"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, lakeformation.EndpointsID) },
+		ErrorCheck:               acctest.ErrorCheck(t, lakeformation.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckDatabaseLFTagsDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccResourceLFTagsConfig_hierarchy(rName,
+					[]string{"abbey", "village", "luffield", "woodcote", "copse", "chapel", "stowe", "club"},
+					[]string{"farm", "theloop", "aintree", "brooklands", "maggotts", "becketts", "vale"},
+					[]string{"one", "two", "three"},
+					"woodcote",
+					"theloop",
+					"two",
+				),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckDatabaseLFTagsExists(ctx, databaseResourceName),
+					testAccCheckDatabaseLFTagsExists(ctx, tableResourceName),
+					testAccCheckDatabaseLFTagsExists(ctx, columnResourceName),
+					resource.TestCheckResourceAttr(databaseResourceName, "lf_tag.#", "1"),
+					resource.TestCheckTypeSetElemNestedAttrs(databaseResourceName, "lf_tag.*", map[string]string{
+						"key":   rName,
+						"value": "woodcote",
+					}),
+					resource.TestCheckResourceAttr(tableResourceName, "lf_tag.#", "1"),
+					resource.TestCheckTypeSetElemNestedAttrs(tableResourceName, "lf_tag.*", map[string]string{
+						"key":   fmt.Sprintf("%s-2", rName),
+						"value": "theloop",
+					}),
+					resource.TestCheckResourceAttr(columnResourceName, "lf_tag.#", "1"),
+					resource.TestCheckTypeSetElemNestedAttrs(columnResourceName, "lf_tag.*", map[string]string{
+						"key":   fmt.Sprintf("%s-3", rName),
+						"value": "two",
+					}),
+				),
+			},
+			{
+				Config: testAccResourceLFTagsConfig_hierarchy(rName,
+					[]string{"abbey", "village", "luffield", "woodcote", "copse", "chapel", "stowe", "club"},
+					[]string{"farm", "theloop", "aintree", "brooklands", "maggotts", "becketts", "vale"},
+					[]string{"one", "two", "three"},
+					"stowe",
+					"becketts",
+					"three",
+				),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckDatabaseLFTagsExists(ctx, databaseResourceName),
+					testAccCheckDatabaseLFTagsExists(ctx, tableResourceName),
+					testAccCheckDatabaseLFTagsExists(ctx, columnResourceName),
+					resource.TestCheckResourceAttr(databaseResourceName, "lf_tag.#", "1"),
+					resource.TestCheckTypeSetElemNestedAttrs(databaseResourceName, "lf_tag.*", map[string]string{
+						"key":   rName,
+						"value": "stowe",
+					}),
+					resource.TestCheckResourceAttr(tableResourceName, "lf_tag.#", "1"),
+					resource.TestCheckTypeSetElemNestedAttrs(tableResourceName, "lf_tag.*", map[string]string{
+						"key":   fmt.Sprintf("%s-2", rName),
+						"value": "becketts",
+					}),
+					resource.TestCheckResourceAttr(columnResourceName, "lf_tag.#", "1"),
+					resource.TestCheckTypeSetElemNestedAttrs(columnResourceName, "lf_tag.*", map[string]string{
+						"key":   fmt.Sprintf("%s-3", rName),
+						"value": "three",
+					}),
+				),
+			},
+		},
+	})
+}
+
 func testAccResourceLFTags_table(t *testing.T) {
 	ctx := acctest.Context(t)
 	resourceName := "aws_lakeformation_resource_lf_tags.test"
@@ -172,7 +276,7 @@ func testAccResourceLFTags_tableWithColumns(t *testing.T) {
 		CheckDestroy:             testAccCheckDatabaseLFTagsDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config:  testAccResourceLFTagsConfig_tableWithColumnsMultiple(rName, []string{"abbey", "village", "luffield", "woodcote", "copse", "chapel", "stowe", "club"}, []string{"farm", "theloop", "aintree", "brooklands", "maggotts", "becketts", "vale"}, "luffield", "vale"),
+				Config:  testAccResourceLFTagsConfig_tableWithColumnsMultipleTags(rName, []string{"abbey", "village", "luffield", "woodcote", "copse", "chapel", "stowe", "club"}, []string{"farm", "theloop", "aintree", "brooklands", "maggotts", "becketts", "vale"}, "luffield", "vale"),
 				Destroy: false,
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDatabaseLFTagsExists(ctx, resourceName),
@@ -187,7 +291,7 @@ func testAccResourceLFTags_tableWithColumns(t *testing.T) {
 				),
 			},
 			{
-				Config: testAccResourceLFTagsConfig_tableWithColumnsMultiple(rName, []string{"abbey", "village", "luffield", "woodcote", "copse", "chapel", "stowe", "club"}, []string{"farm", "theloop", "aintree", "brooklands", "maggotts", "becketts", "vale"}, "copse", "aintree"),
+				Config: testAccResourceLFTagsConfig_tableWithColumnsMultipleTags(rName, []string{"abbey", "village", "luffield", "woodcote", "copse", "chapel", "stowe", "club"}, []string{"farm", "theloop", "aintree", "brooklands", "maggotts", "becketts", "vale"}, "copse", "aintree"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDatabaseLFTagsExists(ctx, resourceName),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "lf_tag.*", map[string]string{
@@ -420,7 +524,7 @@ resource "aws_lakeformation_lf_tag" "test" {
   key    = %[1]q
   values = [%[2]s]
 
-  # for consistency, ensure that admins are setup before testing
+  # for consistency, ensure that admins are set up before testing
   depends_on = [aws_lakeformation_data_lake_settings.test]
 }
 
@@ -436,7 +540,7 @@ resource "aws_lakeformation_resource_lf_tags" "test" {
     value = %[3]q
   }
 
-  # for consistency, ensure that admins are setup before testing
+  # for consistency, ensure that admins are set up before testing
   depends_on = [aws_lakeformation_data_lake_settings.test]
 }
 `, rName, fmt.Sprintf(`"%s"`, strings.Join(values, `", "`)), value)
@@ -462,7 +566,7 @@ resource "aws_lakeformation_lf_tag" "test" {
   key    = %[1]q
   values = [%[2]s]
 
-  # for consistency, ensure that admins are setup before testing
+  # for consistency, ensure that admins are set up before testing
   depends_on = [aws_lakeformation_data_lake_settings.test]
 }
 
@@ -476,13 +580,13 @@ resource "aws_lakeformation_resource_lf_tags" "test" {
     value = %[3]q
   }
 
-  # for consistency, ensure that admins are setup before testing
+  # for consistency, ensure that admins are set up before testing
   depends_on = [aws_lakeformation_data_lake_settings.test]
 }
 `, rName, fmt.Sprintf(`"%s"`, strings.Join(values, `", "`)), value)
 }
 
-func testAccResourceLFTagsConfig_databaseMultiple(rName string, values1, values2 []string, value1, value2 string) string {
+func testAccResourceLFTagsConfig_databaseMultipleTags(rName string, values1, values2 []string, value1, value2 string) string {
 	return fmt.Sprintf(`
 data "aws_caller_identity" "current" {}
 
@@ -502,7 +606,7 @@ resource "aws_lakeformation_lf_tag" "test" {
   key    = %[1]q
   values = [%[2]s]
 
-  # for consistency, ensure that admins are setup before testing
+  # for consistency, ensure that admins are set up before testing
   depends_on = [aws_lakeformation_data_lake_settings.test]
 }
 
@@ -510,7 +614,7 @@ resource "aws_lakeformation_lf_tag" "test2" {
   key    = "%[1]s-2"
   values = [%[3]s]
 
-  # for consistency, ensure that admins are setup before testing
+  # for consistency, ensure that admins are set up before testing
   depends_on = [aws_lakeformation_data_lake_settings.test]
 }
 
@@ -529,12 +633,121 @@ resource "aws_lakeformation_resource_lf_tags" "test" {
     value = %[5]q
   }
 
-  # for consistency, ensure that admins are setup before testing
+  # for consistency, ensure that admins are set up before testing
   depends_on = [aws_lakeformation_data_lake_settings.test]
 }
 `, rName, fmt.Sprintf(`"%s"`, strings.Join(values1, `", "`)), fmt.Sprintf(`"%s"`, strings.Join(values2, `", "`)), value1, value2)
 }
 
+func testAccResourceLFTagsConfig_hierarchy(rName string, values1, values2, values3 []string, value1, value2, value3 string) string {
+	return fmt.Sprintf(`
+data "aws_caller_identity" "current" {}
+
+data "aws_iam_session_context" "current" {
+  arn = data.aws_caller_identity.current.arn
+}
+
+resource "aws_lakeformation_data_lake_settings" "test" {
+  admins = [data.aws_iam_session_context.current.issuer_arn]
+}
+
+resource "aws_glue_catalog_database" "test" {
+  name = %[1]q
+}
+
+resource "aws_glue_catalog_table" "test" {
+  name          = %[1]q
+  database_name = aws_glue_catalog_database.test.name
+
+  storage_descriptor {
+    columns {
+      name = "event"
+      type = "string"
+    }
+
+    columns {
+      name = "timestamp"
+      type = "date"
+    }
+
+    columns {
+      name = "value"
+      type = "double"
+    }
+  }
+}
+
+resource "aws_lakeformation_lf_tag" "test" {
+  key    = %[1]q
+  values = [%[2]s]
+
+  # for consistency, ensure that admins are set up before testing
+  depends_on = [aws_lakeformation_data_lake_settings.test]
+}
+
+resource "aws_lakeformation_lf_tag" "test2" {
+  key    = "%[1]s-2"
+  values = [%[3]s]
+
+  # for consistency, ensure that admins are set up before testing
+  depends_on = [aws_lakeformation_data_lake_settings.test]
+}
+
+resource "aws_lakeformation_lf_tag" "column_tags" {
+  key    = "%[1]s-3"
+  values = [%[6]s]
+
+  # for consistency, ensure that admins are set up before testing
+  depends_on = [aws_lakeformation_data_lake_settings.test]
+}
+
+resource "aws_lakeformation_resource_lf_tags" "database_tags" {
+  database {
+    name = aws_glue_catalog_database.test.name
+  }
+
+  lf_tag {
+    key   = aws_lakeformation_lf_tag.test.key
+    value = %[4]q
+  }
+
+  # for consistency, ensure that admins are set up before testing
+  depends_on = [aws_lakeformation_data_lake_settings.test]
+}
+
+resource "aws_lakeformation_resource_lf_tags" "table_tags" {
+  table {
+    database_name = aws_glue_catalog_database.test.name
+    name          = aws_glue_catalog_table.test.name
+  }
+
+  lf_tag {
+    key   = aws_lakeformation_lf_tag.test2.key
+    value = %[5]q
+  }
+
+  # for consistency, ensure that admins are set up before testing
+  depends_on = [aws_lakeformation_data_lake_settings.test]
+}
+
+resource "aws_lakeformation_resource_lf_tags" "column_tags" {
+  table_with_columns {
+    database_name = aws_glue_catalog_database.test.name
+    name          = aws_glue_catalog_table.test.name
+    column_names  = ["event", "timestamp"]
+  }
+
+  lf_tag {
+    key   = aws_lakeformation_lf_tag.column_tags.key
+    value = %[7]q
+  }
+
+  # for consistency, ensure that admins are set up before testing
+  depends_on = [aws_lakeformation_data_lake_settings.test]
+}
+`, rName, fmt.Sprintf(`"%s"`, strings.Join(values1, `", "`)), fmt.Sprintf(`"%s"`, strings.Join(values2, `", "`)), value1, value2, fmt.Sprintf(`"%s"`, strings.Join(values3, `", "`)), value3)
+}
+
 func testAccResourceLFTagsConfig_table(rName string, values []string, value string) string {
 	return fmt.Sprintf(`
 data "aws_caller_identity" "current" {}
@@ -577,7 +790,7 @@ resource "aws_lakeformation_lf_tag" "test" {
   key    = %[1]q
   values = [%[2]s]
 
-  # for consistency, ensure that admins are setup before testing
+  # for consistency, ensure that admins are set up before testing
   depends_on = [aws_lakeformation_data_lake_settings.test]
 }
 
@@ -592,13 +805,13 @@ resource "aws_lakeformation_resource_lf_tags" "test" {
     value = %[3]q
   }
 
-  # for consistency, ensure that admins are setup before testing
+  # for consistency, ensure that admins are set up before testing
   depends_on = [aws_lakeformation_data_lake_settings.test]
 }
 `, rName, fmt.Sprintf(`"%s"`, strings.Join(values, `", "`)), value)
 }
 
-func testAccResourceLFTagsConfig_tableWithColumnsMultiple(rName string, values1, values2 []string, value1 string, value2 string) string {
+func testAccResourceLFTagsConfig_tableWithColumnsMultipleTags(rName string, values1, values2 []string, value1 string, value2 string) string {
 	return fmt.Sprintf(`
 data "aws_caller_identity" "current" {}
 
@@ -640,7 +853,7 @@ resource "aws_lakeformation_lf_tag" "test" {
   key    = %[1]q
   values = [%[2]s]
 
-  # for consistency, ensure that admins are setup before testing
+  # for consistency, ensure that admins are set up before testing
   depends_on = [aws_lakeformation_data_lake_settings.test]
 }
 
@@ -648,7 +861,7 @@ resource "aws_lakeformation_lf_tag" "test2" {
   key    = "%[1]s-2"
   values = [%[3]s]
 
-  # for consistency, ensure that admins are setup before testing
+  # for consistency, ensure that admins are set up before testing
   depends_on = [aws_lakeformation_data_lake_settings.test]
 }
 
@@ -669,7 +882,7 @@ resource "aws_lakeformation_resource_lf_tags" "test" {
     value = %[5]q
   }
 
-  # for consistency, ensure that admins are setup before testing
+  # for consistency, ensure that admins are set up before testing
   depends_on = [aws_lakeformation_data_lake_settings.test]
 }
 `, rName, fmt.Sprintf(`"%s"`, strings.Join(values1, `", "`)), fmt.Sprintf(`"%s"`, strings.Join(values2, `", "`)), value1, value2)
diff --git a/internal/service/lakeformation/resource_test.go b/internal/service/lakeformation/resource_test.go
index 4bab492e651..951d7384006 100644
--- a/internal/service/lakeformation/resource_test.go
+++ b/internal/service/lakeformation/resource_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lakeformation_test
 
 import (
diff --git a/internal/service/lakeformation/service_package_gen.go b/internal/service/lakeformation/service_package_gen.go
index ffa64254579..b6396ca6763 100644
--- a/internal/service/lakeformation/service_package_gen.go
+++ b/internal/service/lakeformation/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	lakeformation_sdkv1 "github.com/aws/aws-sdk-go/service/lakeformation"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -75,4 +76,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*l
 	return lakeformation_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/lakeformation/status.go b/internal/service/lakeformation/status.go
index a5e2561b671..91bfe6011d4 100644
--- a/internal/service/lakeformation/status.go
+++ b/internal/service/lakeformation/status.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lakeformation
 
 import (
diff --git a/internal/service/lakeformation/strings.go b/internal/service/lakeformation/strings.go
index 4028970f570..ece0ae79a5b 100644
--- a/internal/service/lakeformation/strings.go
+++ b/internal/service/lakeformation/strings.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lakeformation
 
 import (
diff --git a/internal/service/lakeformation/strings_test.go b/internal/service/lakeformation/strings_test.go
index 71e95b45924..a864d14f2f0 100644
--- a/internal/service/lakeformation/strings_test.go
+++ b/internal/service/lakeformation/strings_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lakeformation_test
 
 import (
diff --git a/internal/service/lakeformation/validate.go b/internal/service/lakeformation/validate.go
index f1e853efcc2..7f80be4868b 100644
--- a/internal/service/lakeformation/validate.go
+++ b/internal/service/lakeformation/validate.go
@@ -1,9 +1,12 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lakeformation
 
 import (
 	"fmt"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
 )
 
@@ -27,7 +30,7 @@ func validPrincipal(v interface{}, k string) (ws []string, errors []error) {
 	errors = append(errors, errorsARN...)
 
 	pattern := `:(role|user|group|ou|organization)/`
-	if !regexp.MustCompile(pattern).MatchString(value) {
+	if !regexache.MustCompile(pattern).MatchString(value) {
 		errors = append(errors, fmt.Errorf("%q does not look like a user, role, group, OU, or organization: %q", k, value))
 	}
 
diff --git a/internal/service/lakeformation/validate_test.go b/internal/service/lakeformation/validate_test.go
index da5dc943cb9..8f55304ff7d 100644
--- a/internal/service/lakeformation/validate_test.go
+++ b/internal/service/lakeformation/validate_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lakeformation
 
 import (
diff --git a/internal/service/lakeformation/wait.go b/internal/service/lakeformation/wait.go
index b6933be1bdb..f903ee426e0 100644
--- a/internal/service/lakeformation/wait.go
+++ b/internal/service/lakeformation/wait.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lakeformation
 
 import (
diff --git a/internal/service/lambda/alias.go b/internal/service/lambda/alias.go
index ceb68a78600..d84bac2a5d8 100644
--- a/internal/service/lambda/alias.go
+++ b/internal/service/lambda/alias.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lambda
 
 import (
diff --git a/internal/service/lambda/alias_data_source.go b/internal/service/lambda/alias_data_source.go
index a8de546e1b8..e59d95d7b35 100644
--- a/internal/service/lambda/alias_data_source.go
+++ b/internal/service/lambda/alias_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lambda
 
 import (
diff --git a/internal/service/lambda/alias_data_source_test.go b/internal/service/lambda/alias_data_source_test.go
index cb7985402d8..89559b5eb00 100644
--- a/internal/service/lambda/alias_data_source_test.go
+++ b/internal/service/lambda/alias_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lambda_test
 
 import (
diff --git a/internal/service/lambda/alias_test.go b/internal/service/lambda/alias_test.go
index a9e76ef2f9f..ba9460ca713 100644
--- a/internal/service/lambda/alias_test.go
+++ b/internal/service/lambda/alias_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lambda_test
 
 import (
diff --git a/internal/service/lambda/code_signing_config.go b/internal/service/lambda/code_signing_config.go
index 8d23511798d..fb7fd878c7b 100644
--- a/internal/service/lambda/code_signing_config.go
+++ b/internal/service/lambda/code_signing_config.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lambda
 
 import (
diff --git a/internal/service/lambda/code_signing_config_data_source.go b/internal/service/lambda/code_signing_config_data_source.go
index 1b18d812a79..3b339df2686 100644
--- a/internal/service/lambda/code_signing_config_data_source.go
+++ b/internal/service/lambda/code_signing_config_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lambda
 
 import (
diff --git a/internal/service/lambda/code_signing_config_data_source_test.go b/internal/service/lambda/code_signing_config_data_source_test.go
index f15c47d11b8..dd87a587f2a 100644
--- a/internal/service/lambda/code_signing_config_data_source_test.go
+++ b/internal/service/lambda/code_signing_config_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lambda_test
 
 import (
diff --git a/internal/service/lambda/code_signing_config_test.go b/internal/service/lambda/code_signing_config_test.go
index 36738a5b8fc..be094d89796 100644
--- a/internal/service/lambda/code_signing_config_test.go
+++ b/internal/service/lambda/code_signing_config_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lambda_test
 
 import (
diff --git a/internal/service/lambda/consts.go b/internal/service/lambda/consts.go
index 657bf7b9002..6324d4f574a 100644
--- a/internal/service/lambda/consts.go
+++ b/internal/service/lambda/consts.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lambda
 
 import (
diff --git a/internal/service/lambda/diff.go b/internal/service/lambda/diff.go
index 7b7d0c7a395..d00ea23159c 100644
--- a/internal/service/lambda/diff.go
+++ b/internal/service/lambda/diff.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lambda
 
 import (
@@ -14,6 +17,11 @@ func customizeDiffValidateInput(_ context.Context, diff *schema.ResourceDiff, v
 	if diff.Get("lifecycle_scope") == lifecycleScopeCreateOnly {
 		return nil
 	}
+
+	if !diff.GetRawPlan().GetAttr("input").IsWhollyKnown() {
+		return nil
+	}
+
 	// input is validated to be valid JSON in the schema already.
 	inputNoSpaces := strings.TrimSpace(diff.Get("input").(string))
 	if strings.HasPrefix(inputNoSpaces, "{") && strings.HasSuffix(inputNoSpaces, "}") {
diff --git a/internal/service/lambda/event_source_mapping.go b/internal/service/lambda/event_source_mapping.go
index 1f03ebc6154..49a43de57cd 100644
--- a/internal/service/lambda/event_source_mapping.go
+++ b/internal/service/lambda/event_source_mapping.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lambda
 
 import (
@@ -161,7 +164,7 @@ func ResourceEventSourceMapping() *schema.Resource {
 						"filter": {
 							Type:     schema.TypeSet,
 							Optional: true,
-							MaxItems: 5,
+							MaxItems: 10,
 							Elem: &schema.Resource{
 								Schema: map[string]*schema.Schema{
 									"pattern": {
@@ -232,9 +235,10 @@ func ResourceEventSourceMapping() *schema.Resource {
 				Computed:     true,
 			},
 			"queues": {
-				Type:     schema.TypeSet,
+				Type:     schema.TypeList,
 				Optional: true,
 				ForceNew: true,
+				MaxItems: 1,
 				Elem: &schema.Schema{
 					Type:         schema.TypeString,
 					ValidateFunc: validation.StringLenBetween(1, 1000),
@@ -426,8 +430,8 @@ func resourceEventSourceMappingCreate(ctx context.Context, d *schema.ResourceDat
 		input.ParallelizationFactor = aws.Int64(int64(v.(int)))
 	}
 
-	if v, ok := d.GetOk("queues"); ok && v.(*schema.Set).Len() > 0 {
-		input.Queues = flex.ExpandStringSet(v.(*schema.Set))
+	if v, ok := d.GetOk("queues"); ok && len(v.([]interface{})) > 0 {
+		input.Queues = flex.ExpandStringList(v.([]interface{}))
 	}
 
 	if v, ok := d.GetOk("scaling_config"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
diff --git a/internal/service/lambda/event_source_mapping_test.go b/internal/service/lambda/event_source_mapping_test.go
index 2c5efeab389..a83b5b8bf72 100644
--- a/internal/service/lambda/event_source_mapping_test.go
+++ b/internal/service/lambda/event_source_mapping_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lambda_test
 
 import (
diff --git a/internal/service/lambda/flex.go b/internal/service/lambda/flex.go
index 0f35e788a89..daa076fc07d 100644
--- a/internal/service/lambda/flex.go
+++ b/internal/service/lambda/flex.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lambda
 
 import (
@@ -42,6 +45,7 @@ func flattenVPCConfigResponse(s *types.VpcConfigResponse) []map[string]interface
 		return nil
 	}
 
+	settings["ipv6_allowed_for_dual_stack"] = aws.BoolValue(s.Ipv6AllowedForDualStack)
 	settings["subnet_ids"] = flex.FlattenStringValueSet(s.SubnetIds)
 	settings["security_group_ids"] = flex.FlattenStringValueSet(s.SecurityGroupIds)
 	if s.VpcId != nil {
diff --git a/internal/service/lambda/function.go b/internal/service/lambda/function.go
index ed7135a2f80..d196ea4deeb 100644
--- a/internal/service/lambda/function.go
+++ b/internal/service/lambda/function.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lambda
 
 import (
@@ -6,10 +9,10 @@ import (
 	"fmt"
 	"log"
 	"os"
-	"regexp"
 	"strings"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/aws/arn"
 	"github.com/aws/aws-sdk-go-v2/service/lambda"
@@ -158,7 +161,7 @@ func ResourceFunction() *schema.Resource {
 						"local_mount_path": {
 							Type:         schema.TypeString,
 							Required:     true,
-							ValidateFunc: validation.StringMatch(regexp.MustCompile(`^/mnt/[a-zA-Z0-9-_.]+$`), "must start with '/mnt/'"),
+							ValidateFunc: validation.StringMatch(regexache.MustCompile(`^/mnt/[0-9A-Za-z_.-]+$`), "must start with '/mnt/'"),
 						},
 					},
 				},
@@ -374,6 +377,11 @@ func ResourceFunction() *schema.Resource {
 				MaxItems: 1,
 				Elem: &schema.Resource{
 					Schema: map[string]*schema.Schema{
+						"ipv6_allowed_for_dual_stack": {
+							Type:     schema.TypeBool,
+							Optional: true,
+							Default:  false,
+						},
 						"security_group_ids": {
 							Type:     schema.TypeSet,
 							Required: true,
@@ -394,15 +402,16 @@ func ResourceFunction() *schema.Resource {
 				// Suppress diffs if the VPC configuration is provided, but empty
 				// which is a valid Lambda function configuration. e.g.
 				//   vpc_config {
-				//     security_group_ids = []
-				//     subnet_ids         = []
+				//     ipv6_allowed_for_dual_stack = false
+				//     security_group_ids          = []
+				//     subnet_ids                  = []
 				//   }
 				DiffSuppressFunc: func(k, old, new string, d *schema.ResourceData) bool {
 					if d.Id() == "" || old == "1" || new == "0" {
 						return false
 					}
 
-					if d.HasChanges("vpc_config.0.security_group_ids", "vpc_config.0.subnet_ids") {
+					if d.HasChanges("vpc_config.0.security_group_ids", "vpc_config.0.subnet_ids", "vpc_config.0.ipv6_allowed_for_dual_stack") {
 						return false
 					}
 
@@ -530,8 +539,9 @@ func resourceFunctionCreate(ctx context.Context, d *schema.ResourceData, meta in
 	if v, ok := d.GetOk("vpc_config"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
 		tfMap := v.([]interface{})[0].(map[string]interface{})
 		input.VpcConfig = &types.VpcConfig{
-			SecurityGroupIds: flex.ExpandStringValueSet(tfMap["security_group_ids"].(*schema.Set)),
-			SubnetIds:        flex.ExpandStringValueSet(tfMap["subnet_ids"].(*schema.Set)),
+			Ipv6AllowedForDualStack: aws.Bool(tfMap["ipv6_allowed_for_dual_stack"].(bool)),
+			SecurityGroupIds:        flex.ExpandStringValueSet(tfMap["security_group_ids"].(*schema.Set)),
+			SubnetIds:               flex.ExpandStringValueSet(tfMap["subnet_ids"].(*schema.Set)),
 		}
 	}
 
@@ -846,17 +856,19 @@ func resourceFunctionUpdate(ctx context.Context, d *schema.ResourceData, meta in
 			}
 		}
 
-		if d.HasChanges("vpc_config.0.security_group_ids", "vpc_config.0.subnet_ids") {
+		if d.HasChanges("vpc_config.0.security_group_ids", "vpc_config.0.subnet_ids", "vpc_config.0.ipv6_allowed_for_dual_stack") {
 			if v, ok := d.GetOk("vpc_config"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
 				tfMap := v.([]interface{})[0].(map[string]interface{})
 				input.VpcConfig = &types.VpcConfig{
-					SecurityGroupIds: flex.ExpandStringValueSet(tfMap["security_group_ids"].(*schema.Set)),
-					SubnetIds:        flex.ExpandStringValueSet(tfMap["subnet_ids"].(*schema.Set)),
+					Ipv6AllowedForDualStack: aws.Bool(tfMap["ipv6_allowed_for_dual_stack"].(bool)),
+					SecurityGroupIds:        flex.ExpandStringValueSet(tfMap["security_group_ids"].(*schema.Set)),
+					SubnetIds:               flex.ExpandStringValueSet(tfMap["subnet_ids"].(*schema.Set)),
 				}
 			} else {
 				input.VpcConfig = &types.VpcConfig{
-					SecurityGroupIds: []string{},
-					SubnetIds:        []string{},
+					Ipv6AllowedForDualStack: aws.Bool(false),
+					SecurityGroupIds:        []string{},
+					SubnetIds:               []string{},
 				}
 			}
 		}
@@ -1247,6 +1259,7 @@ func needsFunctionConfigUpdate(d verify.ResourceDiffer) bool {
 		d.HasChange("dead_letter_config") ||
 		d.HasChange("snap_start") ||
 		d.HasChange("tracing_config") ||
+		d.HasChange("vpc_config.0.ipv6_allowed_for_dual_stack") ||
 		d.HasChange("vpc_config.0.security_group_ids") ||
 		d.HasChange("vpc_config.0.subnet_ids") ||
 		d.HasChange("runtime") ||
@@ -1286,6 +1299,7 @@ func SignerServiceIsAvailable(region string) bool {
 		endpoints.UsWest1RegionID:      {},
 		endpoints.UsWest2RegionID:      {},
 		endpoints.AfSouth1RegionID:     {},
+		endpoints.ApEast1RegionID:      {},
 		endpoints.ApSouth1RegionID:     {},
 		endpoints.ApNortheast2RegionID: {},
 		endpoints.ApSoutheast1RegionID: {},
diff --git a/internal/service/lambda/function_data_source.go b/internal/service/lambda/function_data_source.go
index 5e99ef69278..bd7e1377e1c 100644
--- a/internal/service/lambda/function_data_source.go
+++ b/internal/service/lambda/function_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lambda
 
 import (
@@ -191,6 +194,10 @@ func DataSourceFunction() *schema.Resource {
 				Computed: true,
 				Elem: &schema.Resource{
 					Schema: map[string]*schema.Schema{
+						"ipv6_allowed_for_dual_stack": {
+							Type:     schema.TypeBool,
+							Computed: true,
+						},
 						"security_group_ids": {
 							Type:     schema.TypeSet,
 							Computed: true,
diff --git a/internal/service/lambda/function_data_source_test.go b/internal/service/lambda/function_data_source_test.go
index 354042fa462..8ca95dfc1f3 100644
--- a/internal/service/lambda/function_data_source_test.go
+++ b/internal/service/lambda/function_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lambda_test
 
 import (
@@ -199,8 +202,10 @@ func TestAccLambdaFunctionDataSource_vpc(t *testing.T) {
 				Check: resource.ComposeAggregateTestCheckFunc(
 					resource.TestCheckResourceAttrPair(dataSourceName, "arn", resourceName, "arn"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "vpc_config.#", resourceName, "vpc_config.#"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "vpc_config.0.ipv6_allowed_for_dual_stack", resourceName, "vpc_config.0.ipv6_allowed_for_dual_stack"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "vpc_config.0.security_group_ids.#", resourceName, "vpc_config.0.security_group_ids.#"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "vpc_config.0.subnet_ids.#", resourceName, "vpc_config.0.subnet_ids.#"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "vpc_config.0.vpc_id", resourceName, "vpc_config.0.vpc_id"),
 				),
 			},
 		},
diff --git a/internal/service/lambda/function_event_invoke_config.go b/internal/service/lambda/function_event_invoke_config.go
index c7831fdf5b9..de4676bc75e 100644
--- a/internal/service/lambda/function_event_invoke_config.go
+++ b/internal/service/lambda/function_event_invoke_config.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lambda
 
 import (
diff --git a/internal/service/lambda/function_event_invoke_config_test.go b/internal/service/lambda/function_event_invoke_config_test.go
index 9b00945ee29..74117b027ef 100644
--- a/internal/service/lambda/function_event_invoke_config_test.go
+++ b/internal/service/lambda/function_event_invoke_config_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lambda_test
 
 import (
diff --git a/internal/service/lambda/function_test.go b/internal/service/lambda/function_test.go
index b93def5573e..db21f4d079f 100644
--- a/internal/service/lambda/function_test.go
+++ b/internal/service/lambda/function_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lambda_test
 
 import (
@@ -6,15 +9,16 @@ import (
 	"fmt"
 	"os"
 	"path/filepath"
-	"regexp"
 	"testing"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/lambda"
 	"github.com/aws/aws-sdk-go-v2/service/lambda/types"
+	"github.com/aws/aws-sdk-go-v2/service/signer"
+	signertypes "github.com/aws/aws-sdk-go-v2/service/signer/types"
 	"github.com/aws/aws-sdk-go/aws/endpoints"
-	"github.com/aws/aws-sdk-go/service/signer"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
@@ -370,7 +374,7 @@ func TestAccLambdaFunction_expectFilenameAndS3Attributes(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccFunctionConfig_noFilenameAndS3Attributes(rName),
-				ExpectError: regexp.MustCompile("one of `filename,image_uri,s3_bucket` must be specified"),
+				ExpectError: regexache.MustCompile("one of `filename,image_uri,s3_bucket` must be specified"),
 			},
 		},
 	})
@@ -575,7 +579,7 @@ func TestAccLambdaFunction_nameValidation(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccFunctionConfig_basic(badFuncName, rName, rName, rName),
-				ExpectError: regexp.MustCompile(`invalid value for function_name \(must be valid function name or function ARN\)`),
+				ExpectError: regexache.MustCompile(`invalid value for function_name \(must be valid function name or function ARN\)`),
 			},
 		},
 	})
@@ -903,7 +907,7 @@ func TestAccLambdaFunction_nilDeadLetter(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config: testAccFunctionConfig_nilDeadLetter(rName),
-				ExpectError: regexp.MustCompile(
+				ExpectError: regexache.MustCompile(
 					fmt.Sprintf("nil dead_letter_config supplied for function: %s", rName)),
 			},
 		},
@@ -1820,7 +1824,7 @@ func TestAccLambdaFunction_localUpdate(t *testing.T) {
 				Config: testAccFunctionConfig_local(path, rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckFunctionExists(ctx, resourceName, &conf),
-					testAccCheckSourceCodeHash(&conf, "8DPiX+G1l2LQ8hjBkwRchQFf1TSCEvPrYGRKlM9UoyY="),
+					testAccCheckSourceCodeHash(&conf, "MbW0T1Pcy1QPtrFC9dT7hUfircj1NXss2uXgakqzAbk="),
 				),
 			},
 			{
@@ -1839,7 +1843,7 @@ func TestAccLambdaFunction_localUpdate(t *testing.T) {
 				Config: testAccFunctionConfig_local(path, rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckFunctionExists(ctx, resourceName, &conf),
-					testAccCheckSourceCodeHash(&conf, "0tdaP9H9hsk9c2CycSwOG/sa/x5JyAmSYunA/ce99Pg="),
+					testAccCheckSourceCodeHash(&conf, "7qn3LZOWCpWK5nm49qjw+VrbPQHfdu2ZrDjBsSUveKM="),
 					func(s *terraform.State) error {
 						return testAccCheckAttributeIsDateAfter(s, resourceName, "last_modified", timeBeforeUpdate)
 					},
@@ -1886,7 +1890,7 @@ func TestAccLambdaFunction_LocalUpdate_nameOnly(t *testing.T) {
 				Config: testAccFunctionConfig_localNameOnly(path, rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckFunctionExists(ctx, resourceName, &conf),
-					testAccCheckSourceCodeHash(&conf, "8DPiX+G1l2LQ8hjBkwRchQFf1TSCEvPrYGRKlM9UoyY="),
+					testAccCheckSourceCodeHash(&conf, "MbW0T1Pcy1QPtrFC9dT7hUfircj1NXss2uXgakqzAbk="),
 				),
 			},
 			{
@@ -1904,7 +1908,7 @@ func TestAccLambdaFunction_LocalUpdate_nameOnly(t *testing.T) {
 				Config: testAccFunctionConfig_localNameOnly(updatedPath, rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckFunctionExists(ctx, resourceName, &conf),
-					testAccCheckSourceCodeHash(&conf, "0tdaP9H9hsk9c2CycSwOG/sa/x5JyAmSYunA/ce99Pg="),
+					testAccCheckSourceCodeHash(&conf, "7qn3LZOWCpWK5nm49qjw+VrbPQHfdu2ZrDjBsSUveKM="),
 				),
 			},
 		},
@@ -1941,7 +1945,7 @@ func TestAccLambdaFunction_S3Update_basic(t *testing.T) {
 				Config: testAccFunctionConfig_s3(key, path, rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckFunctionExists(ctx, resourceName, &conf),
-					testAccCheckSourceCodeHash(&conf, "8DPiX+G1l2LQ8hjBkwRchQFf1TSCEvPrYGRKlM9UoyY="),
+					testAccCheckSourceCodeHash(&conf, "MbW0T1Pcy1QPtrFC9dT7hUfircj1NXss2uXgakqzAbk="),
 				),
 			},
 			{
@@ -1960,7 +1964,7 @@ func TestAccLambdaFunction_S3Update_basic(t *testing.T) {
 				Config: testAccFunctionConfig_s3(key, path, rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckFunctionExists(ctx, resourceName, &conf),
-					testAccCheckSourceCodeHash(&conf, "0tdaP9H9hsk9c2CycSwOG/sa/x5JyAmSYunA/ce99Pg="),
+					testAccCheckSourceCodeHash(&conf, "7qn3LZOWCpWK5nm49qjw+VrbPQHfdu2ZrDjBsSUveKM="),
 				),
 			},
 		},
@@ -1997,7 +2001,7 @@ func TestAccLambdaFunction_S3Update_unversioned(t *testing.T) {
 				Config: testAccFunctionConfig_s3UnversionedTPL(rName, key, path),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckFunctionExists(ctx, resourceName, &conf),
-					testAccCheckSourceCodeHash(&conf, "8DPiX+G1l2LQ8hjBkwRchQFf1TSCEvPrYGRKlM9UoyY="),
+					testAccCheckSourceCodeHash(&conf, "MbW0T1Pcy1QPtrFC9dT7hUfircj1NXss2uXgakqzAbk="),
 				),
 			},
 			{
@@ -2016,7 +2020,7 @@ func TestAccLambdaFunction_S3Update_unversioned(t *testing.T) {
 				Config: testAccFunctionConfig_s3UnversionedTPL(rName, key2, path),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckFunctionExists(ctx, resourceName, &conf),
-					testAccCheckSourceCodeHash(&conf, "0tdaP9H9hsk9c2CycSwOG/sa/x5JyAmSYunA/ce99Pg="),
+					testAccCheckSourceCodeHash(&conf, "7qn3LZOWCpWK5nm49qjw+VrbPQHfdu2ZrDjBsSUveKM="),
 				),
 			},
 		},
@@ -2074,7 +2078,7 @@ func TestAccLambdaFunction_runtimes(t *testing.T) {
 		{
 			// Test invalid runtime.
 			Config:      testAccFunctionConfig_runtime(rName, rName),
-			ExpectError: regexp.MustCompile(`expected runtime to be one of`),
+			ExpectError: regexache.MustCompile(`expected runtime to be one of`),
 		},
 	}
 	for _, runtime := range types.Runtime("").Values() {
@@ -2147,11 +2151,48 @@ func TestAccLambdaFunction_Zip_validation(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccFunctionConfig_zipNoHandler(rName),
-				ExpectError: regexp.MustCompile("handler and runtime must be set when PackageType is Zip"),
+				ExpectError: regexache.MustCompile("handler and runtime must be set when PackageType is Zip"),
 			},
 			{
 				Config:      testAccFunctionConfig_zipNoRuntime(rName),
-				ExpectError: regexp.MustCompile("handler and runtime must be set when PackageType is Zip"),
+				ExpectError: regexache.MustCompile("handler and runtime must be set when PackageType is Zip"),
+			},
+		},
+	})
+}
+
+func TestAccLambdaFunction_ipv6AllowedForDualStack(t *testing.T) {
+	ctx := acctest.Context(t)
+	var conf lambda.GetFunctionOutput
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_lambda_function.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, names.LambdaEndpointID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckFunctionDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccFunctionConfig_ipv6AllowedForDualStackDisabled(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckFunctionExists(ctx, resourceName, &conf),
+					resource.TestCheckResourceAttr(resourceName, "vpc_config.#", "1"),
+				),
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"filename", "publish"},
+			},
+			{
+				Config: testAccFunctionConfig_ipv6AllowedForDualStackEnabled(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckFunctionExists(ctx, resourceName, &conf),
+					resource.TestCheckResourceAttr(resourceName, "vpc_config.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "vpc_config.0.ipv6_allowed_for_dual_stack", "true"),
+				),
 			},
 		},
 	})
@@ -3731,11 +3772,6 @@ resource "aws_s3_bucket" "artifacts" {
   force_destroy = true
 }
 
-resource "aws_s3_bucket_acl" "artifacts" {
-  bucket = aws_s3_bucket.artifacts.id
-  acl    = "private"
-}
-
 resource "aws_s3_bucket_versioning" "artifacts" {
   bucket = aws_s3_bucket.artifacts.id
   versioning_configuration {
@@ -3792,11 +3828,6 @@ resource "aws_s3_bucket" "artifacts" {
   force_destroy = true
 }
 
-resource "aws_s3_bucket_acl" "artifacts" {
-  bucket = aws_s3_bucket.artifacts.id
-  acl    = "private"
-}
-
 resource "aws_s3_object" "o" {
   bucket = aws_s3_bucket.artifacts.bucket
   key    = %[2]q
@@ -3875,6 +3906,45 @@ resource "aws_lambda_function" "test" {
 `, rName))
 }
 
+func testAccFunctionConfig_ipv6AllowedForDualStackDisabled(rName string) string {
+	return acctest.ConfigCompose(
+		acctest.ConfigLambdaBase(rName, rName, rName),
+		fmt.Sprintf(`
+resource "aws_lambda_function" "test" {
+  filename      = "test-fixtures/lambdatest.zip"
+  function_name = %[1]q
+  role          = aws_iam_role.iam_for_lambda.arn
+  handler       = "exports.example"
+  runtime       = "nodejs16.x"
+
+  vpc_config {
+    subnet_ids         = [aws_subnet.subnet_for_lambda.id]
+    security_group_ids = [aws_security_group.sg_for_lambda.id]
+  }
+}
+`, rName))
+}
+
+func testAccFunctionConfig_ipv6AllowedForDualStackEnabled(rName string) string {
+	return acctest.ConfigCompose(
+		acctest.ConfigLambdaBase(rName, rName, rName),
+		fmt.Sprintf(`
+resource "aws_lambda_function" "test" {
+  filename      = "test-fixtures/lambdatest.zip"
+  function_name = %[1]q
+  role          = aws_iam_role.iam_for_lambda.arn
+  handler       = "exports.example"
+  runtime       = "nodejs16.x"
+
+  vpc_config {
+    ipv6_allowed_for_dual_stack = true
+    subnet_ids                  = [aws_subnet.subnet_for_lambda.id]
+    security_group_ids          = [aws_security_group.sg_for_lambda.id]
+  }
+}
+`, rName))
+}
+
 func testAccFunctionConfig_skipDestroy(rName string) string {
 	return acctest.ConfigCompose(acctest.ConfigLambdaBase(rName, rName, rName), fmt.Sprintf(`
 resource "aws_lambda_function" "test" {
@@ -3895,38 +3965,37 @@ func TestFlattenImageConfigShouldNotFailWithEmptyImageConfig(t *testing.T) {
 }
 
 func testAccPreCheckSignerSigningProfile(ctx context.Context, t *testing.T, platformID string) {
-	conn := acctest.Provider.Meta().(*conns.AWSClient).SignerConn(ctx)
+	conn := acctest.Provider.Meta().(*conns.AWSClient).SignerClient(ctx)
+
+	input := &signer.ListSigningPlatformsInput{}
+
+	pages := signer.NewListSigningPlatformsPaginator(conn, input)
+
+	for pages.HasMorePages() {
+		page, err := pages.NextPage(ctx)
+
+		if acctest.PreCheckSkipError(err) {
+			t.Skipf("skipping acceptance testing: %s", err)
+		}
+
+		if err != nil {
+			t.Fatalf("unexpected PreCheck error: %s", err)
+		}
 
-	var foundPlatform bool
-	err := conn.ListSigningPlatformsPagesWithContext(ctx, &signer.ListSigningPlatformsInput{}, func(page *signer.ListSigningPlatformsOutput, lastPage bool) bool {
 		if page == nil {
-			return !lastPage
+			t.Skip("skipping acceptance testing: empty response")
 		}
 
 		for _, platform := range page.Platforms {
-			if platform == nil {
+			if platform == (signertypes.SigningPlatform{}) {
 				continue
 			}
 
 			if aws.ToString(platform.PlatformId) == platformID {
-				foundPlatform = true
-
-				return false
+				return
 			}
 		}
-
-		return !lastPage
-	})
-
-	if acctest.PreCheckSkipError(err) {
-		t.Skipf("skipping acceptance testing: %s", err)
 	}
 
-	if err != nil {
-		t.Fatalf("unexpected PreCheck error: %s", err)
-	}
-
-	if !foundPlatform {
-		t.Skipf("skipping acceptance testing: Signing Platform (%s) not found", platformID)
-	}
+	t.Skipf("skipping acceptance testing: Signing Platform (%s) not found", platformID)
 }
diff --git a/internal/service/lambda/function_url.go b/internal/service/lambda/function_url.go
index f01768884a8..d2d7ef17805 100644
--- a/internal/service/lambda/function_url.go
+++ b/internal/service/lambda/function_url.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lambda
 
 import (
diff --git a/internal/service/lambda/function_url_data_source.go b/internal/service/lambda/function_url_data_source.go
index 3516bf8b21c..3e010a8273b 100644
--- a/internal/service/lambda/function_url_data_source.go
+++ b/internal/service/lambda/function_url_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lambda
 
 import (
diff --git a/internal/service/lambda/function_url_data_source_test.go b/internal/service/lambda/function_url_data_source_test.go
index 033cce3b085..3d1bb4712dd 100644
--- a/internal/service/lambda/function_url_data_source_test.go
+++ b/internal/service/lambda/function_url_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lambda_test
 
 import (
diff --git a/internal/service/lambda/function_url_test.go b/internal/service/lambda/function_url_test.go
index e3f7be3a716..1af0c5d4690 100644
--- a/internal/service/lambda/function_url_test.go
+++ b/internal/service/lambda/function_url_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lambda_test
 
 import (
diff --git a/internal/service/lambda/functions_data_source.go b/internal/service/lambda/functions_data_source.go
index 6f6f624db47..d6a59b28e68 100644
--- a/internal/service/lambda/functions_data_source.go
+++ b/internal/service/lambda/functions_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lambda
 
 import (
diff --git a/internal/service/lambda/functions_data_source_test.go b/internal/service/lambda/functions_data_source_test.go
index fa49bc7d7d6..84854d4b08a 100644
--- a/internal/service/lambda/functions_data_source_test.go
+++ b/internal/service/lambda/functions_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lambda_test
 
 import (
diff --git a/internal/service/lambda/generate.go b/internal/service/lambda/generate.go
index 1e2df5db39d..92e529c5dc8 100644
--- a/internal/service/lambda/generate.go
+++ b/internal/service/lambda/generate.go
@@ -1,4 +1,7 @@
-//go:generate go run ../../generate/tags/main.go -ServiceTagsMap -TagInIDElem=Resource -UpdateTags -AWSSDKVersion=2 -KVTValues -SkipTypesImp
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+//go:generate go run ../../generate/tags/main.go -ServiceTagsMap -TagInIDElem=Resource -UpdateTags -ListTags -ListTagsInIDElem=Resource -ListTagsOp=ListTags -AWSSDKVersion=2 -KVTValues -SkipTypesImp
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
 
diff --git a/internal/service/lambda/invocation.go b/internal/service/lambda/invocation.go
index 71c73b13ff0..46d8c3eb7a8 100644
--- a/internal/service/lambda/invocation.go
+++ b/internal/service/lambda/invocation.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lambda
 
 import (
diff --git a/internal/service/lambda/invocation_data_source.go b/internal/service/lambda/invocation_data_source.go
index 0cea959dced..8bed79a1a3d 100644
--- a/internal/service/lambda/invocation_data_source.go
+++ b/internal/service/lambda/invocation_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lambda
 
 import (
diff --git a/internal/service/lambda/invocation_data_source_test.go b/internal/service/lambda/invocation_data_source_test.go
index 783500bab7c..af8cda882cf 100644
--- a/internal/service/lambda/invocation_data_source_test.go
+++ b/internal/service/lambda/invocation_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lambda_test
 
 import (
diff --git a/internal/service/lambda/invocation_test.go b/internal/service/lambda/invocation_test.go
index cfb8cd916c8..7e40cf28f25 100644
--- a/internal/service/lambda/invocation_test.go
+++ b/internal/service/lambda/invocation_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lambda_test
 
 import (
diff --git a/internal/service/lambda/layer_version.go b/internal/service/lambda/layer_version.go
index 0b9a051b64d..ad5743f6adc 100644
--- a/internal/service/lambda/layer_version.go
+++ b/internal/service/lambda/layer_version.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lambda
 
 import (
@@ -12,11 +15,13 @@ import (
 	"github.com/aws/aws-sdk-go/service/lambda"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
 	"github.com/hashicorp/terraform-provider-aws/internal/flex"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
 const mutexLayerKey = `aws_lambda_layer_version`
@@ -123,8 +128,8 @@ func ResourceLayerVersion() *schema.Resource {
 			"source_code_hash": {
 				Type:     schema.TypeString,
 				Optional: true,
-				ForceNew: true,
 				Computed: true,
+				ForceNew: true,
 			},
 			"source_code_size": {
 				Type:     schema.TypeInt,
@@ -198,6 +203,7 @@ func resourceLayerVersionPublish(ctx context.Context, d *schema.ResourceData, me
 	}
 
 	d.SetId(aws.StringValue(result.LayerVersionArn))
+
 	return append(diags, resourceLayerVersionRead(ctx, d, meta)...)
 }
 
@@ -205,96 +211,92 @@ func resourceLayerVersionRead(ctx context.Context, d *schema.ResourceData, meta
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).LambdaConn(ctx)
 
-	layerName, version, err := LayerVersionParseID(d.Id())
+	layerName, versionNumber, err := LayerVersionParseID(d.Id())
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "parsing lambda layer ID: %s", err)
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
-	layerVersion, err := conn.GetLayerVersionWithContext(ctx, &lambda.GetLayerVersionInput{
-		LayerName:     aws.String(layerName),
-		VersionNumber: aws.Int64(version),
-	})
+	output, err := FindLayerVersionByTwoPartKey(ctx, conn, layerName, versionNumber)
 
-	if tfawserr.ErrCodeEquals(err, lambda.ErrCodeResourceNotFoundException) {
-		log.Printf("[WARN] Lambda Layer Version (%s) not found, removing from state", d.Id())
+	if !d.IsNewResource() && tfresource.NotFound(err) {
+		log.Printf("[WARN] Lambda Layer Version %s not found, removing from state", d.Id())
 		d.SetId("")
-		return diags
+		return nil
 	}
 
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "reading Lambda Layer version (%s): %s", d.Id(), err)
-	}
-
-	if err := d.Set("layer_name", layerName); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting lambda layer name: %s", err)
-	}
-	if err := d.Set("version", strconv.FormatInt(version, 10)); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting lambda layer version: %s", err)
-	}
-	if err := d.Set("arn", layerVersion.LayerVersionArn); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting lambda layer version arn: %s", err)
-	}
-	if err := d.Set("layer_arn", layerVersion.LayerArn); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting lambda layer arn: %s", err)
-	}
-	if err := d.Set("description", layerVersion.Description); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting lambda layer description: %s", err)
-	}
-	if err := d.Set("license_info", layerVersion.LicenseInfo); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting lambda layer license info: %s", err)
-	}
-	if err := d.Set("created_date", layerVersion.CreatedDate); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting lambda layer created date: %s", err)
-	}
-	if err := d.Set("source_code_hash", layerVersion.Content.CodeSha256); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting lambda layer source code hash: %s", err)
-	}
-	if err := d.Set("signing_profile_version_arn", layerVersion.Content.SigningProfileVersionArn); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting lambda layer signing profile arn: %s", err)
-	}
-	if err := d.Set("signing_job_arn", layerVersion.Content.SigningJobArn); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting lambda layer signing job arn: %s", err)
-	}
-	if err := d.Set("source_code_size", layerVersion.Content.CodeSize); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting lambda layer source code size: %s", err)
-	}
-	if err := d.Set("compatible_runtimes", flex.FlattenStringList(layerVersion.CompatibleRuntimes)); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting lambda layer compatible runtimes: %s", err)
+		return diag.Errorf("reading Lambda Layer Version (%s): %s", d.Id(), err)
 	}
 
-	if err := d.Set("compatible_architectures", flex.FlattenStringList(layerVersion.CompatibleArchitectures)); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting lambda layer compatible architectures: %s", err)
-	}
+	d.Set("arn", output.LayerVersionArn)
+	d.Set("compatible_architectures", aws.StringValueSlice(output.CompatibleArchitectures))
+	d.Set("compatible_runtimes", aws.StringValueSlice(output.CompatibleRuntimes))
+	d.Set("created_date", output.CreatedDate)
+	d.Set("description", output.Description)
+	d.Set("layer_arn", output.LayerArn)
+	d.Set("layer_name", layerName)
+	d.Set("license_info", output.LicenseInfo)
+	d.Set("signing_job_arn", output.Content.SigningJobArn)
+	d.Set("signing_profile_version_arn", output.Content.SigningProfileVersionArn)
+	d.Set("source_code_hash", output.Content.CodeSha256)
+	d.Set("source_code_size", output.Content.CodeSize)
+	d.Set("version", strconv.FormatInt(versionNumber, 10))
 
 	return diags
 }
 
 func resourceLayerVersionDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	if v, ok := d.GetOk("skip_destroy"); ok && v.(bool) {
+	conn := meta.(*conns.AWSClient).LambdaConn(ctx)
+
+	if d.Get("skip_destroy").(bool) {
 		log.Printf("[DEBUG] Retaining Lambda Layer Version %q", d.Id())
 		return diags
 	}
 
-	conn := meta.(*conns.AWSClient).LambdaConn(ctx)
-
-	version, err := strconv.ParseInt(d.Get("version").(string), 10, 64)
+	layerName, versionNumber, err := LayerVersionParseID(d.Id())
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "parsing lambda layer version: %s", err)
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
 	_, err = conn.DeleteLayerVersionWithContext(ctx, &lambda.DeleteLayerVersionInput{
-		LayerName:     aws.String(d.Get("layer_name").(string)),
-		VersionNumber: aws.Int64(version),
+		LayerName:     aws.String(layerName),
+		VersionNumber: aws.Int64(versionNumber),
 	})
+
 	if err != nil {
 		return sdkdiag.AppendErrorf(diags, "deleting Lambda Layer Version (%s): %s", d.Id(), err)
 	}
 
-	log.Printf("[DEBUG] Lambda layer %q deleted", d.Get("arn").(string))
 	return diags
 }
 
+func FindLayerVersionByTwoPartKey(ctx context.Context, conn *lambda.Lambda, layerName string, versionNumber int64) (*lambda.GetLayerVersionOutput, error) {
+	input := &lambda.GetLayerVersionInput{
+		LayerName:     aws.String(layerName),
+		VersionNumber: aws.Int64(versionNumber),
+	}
+
+	output, err := conn.GetLayerVersionWithContext(ctx, input)
+
+	if tfawserr.ErrCodeEquals(err, lambda.ErrCodeResourceNotFoundException) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	if output == nil {
+		return nil, tfresource.NewEmptyResultError(input)
+	}
+
+	return output, nil
+}
+
 func LayerVersionParseID(id string) (layerName string, version int64, err error) {
 	arn, err := arn2.Parse(id)
 	if err != nil {
diff --git a/internal/service/lambda/layer_version_data_source.go b/internal/service/lambda/layer_version_data_source.go
index 47951080225..cb57b9ae2ca 100644
--- a/internal/service/lambda/layer_version_data_source.go
+++ b/internal/service/lambda/layer_version_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lambda
 
 import (
diff --git a/internal/service/lambda/layer_version_data_source_test.go b/internal/service/lambda/layer_version_data_source_test.go
index c8730c2a5bd..b0569072149 100644
--- a/internal/service/lambda/layer_version_data_source_test.go
+++ b/internal/service/lambda/layer_version_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lambda_test
 
 import (
diff --git a/internal/service/lambda/layer_version_permission.go b/internal/service/lambda/layer_version_permission.go
index 36ef1ce31b0..9489e31b39d 100644
--- a/internal/service/lambda/layer_version_permission.go
+++ b/internal/service/lambda/layer_version_permission.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lambda
 
 import (
@@ -6,10 +9,10 @@ import (
 	"fmt"
 	"log"
 	"reflect"
-	"regexp"
 	"strconv"
 	"strings"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/aws/aws-sdk-go/service/lambda"
@@ -37,7 +40,7 @@ func ResourceLayerVersionPermission() *schema.Resource {
 			"layer_name": {
 				Type: schema.TypeString,
 				ValidateFunc: validation.Any(
-					validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9-_]+$`), ""),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_-]+$`), ""),
 					verify.ValidARN,
 				),
 				Required: true,
diff --git a/internal/service/lambda/layer_version_permission_test.go b/internal/service/lambda/layer_version_permission_test.go
index 6d8a3106252..17f67aba356 100644
--- a/internal/service/lambda/layer_version_permission_test.go
+++ b/internal/service/lambda/layer_version_permission_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lambda_test
 
 import (
diff --git a/internal/service/lambda/layer_version_test.go b/internal/service/lambda/layer_version_test.go
index 3d1832dd2ff..89183d7dcd9 100644
--- a/internal/service/lambda/layer_version_test.go
+++ b/internal/service/lambda/layer_version_test.go
@@ -1,25 +1,26 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lambda_test
 
 import (
 	"context"
 	"fmt"
-	"strconv"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/lambda"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	tflambda "github.com/hashicorp/terraform-provider-aws/internal/service/lambda"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
 func TestAccLambdaLayerVersion_basic(t *testing.T) {
 	ctx := acctest.Context(t)
-	resourceName := "aws_lambda_layer_version.lambda_layer_test"
+	resourceName := "aws_lambda_layer_version.test"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
@@ -31,7 +32,7 @@ func TestAccLambdaLayerVersion_basic(t *testing.T) {
 			{
 				Config: testAccLayerVersionConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckLayerVersionExists(ctx, resourceName, rName),
+					testAccCheckLayerVersionExists(ctx, resourceName),
 					acctest.CheckResourceAttrRegionalARN(resourceName, "arn", "lambda", fmt.Sprintf("layer:%s:1", rName)),
 					resource.TestCheckResourceAttr(resourceName, "compatible_runtimes.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
@@ -56,7 +57,7 @@ func TestAccLambdaLayerVersion_basic(t *testing.T) {
 
 func TestAccLambdaLayerVersion_update(t *testing.T) {
 	ctx := acctest.Context(t)
-	resourceName := "aws_lambda_layer_version.lambda_layer_test"
+	resourceName := "aws_lambda_layer_version.test"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
@@ -67,19 +68,59 @@ func TestAccLambdaLayerVersion_update(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config: testAccLayerVersionConfig_createBeforeDestroy(rName, "test-fixtures/lambdatest.zip"),
-				Check:  testAccCheckLayerVersionExists(ctx, resourceName, rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckLayerVersionExists(ctx, resourceName),
+					acctest.CheckResourceAttrRegionalARN(resourceName, "arn", "lambda", fmt.Sprintf("layer:%s:1", rName)),
+				),
 			},
-
 			{
 				ResourceName:            resourceName,
 				ImportState:             true,
 				ImportStateVerify:       true,
 				ImportStateVerifyIgnore: []string{"filename", "source_code_hash", "skip_destroy"},
 			},
-
 			{
 				Config: testAccLayerVersionConfig_createBeforeDestroy(rName, "test-fixtures/lambdatest_modified.zip"),
-				Check:  testAccCheckLayerVersionExists(ctx, resourceName, rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckLayerVersionExists(ctx, resourceName),
+					acctest.CheckResourceAttrRegionalARN(resourceName, "arn", "lambda", fmt.Sprintf("layer:%s:2", rName)),
+				),
+			},
+		},
+	})
+}
+
+func TestAccLambdaLayerVersion_sourceCodeHash(t *testing.T) {
+	ctx := acctest.Context(t)
+	resourceName := "aws_lambda_layer_version.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, lambda.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckLayerVersionDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccLayerVersionConfig_sourceCodeHash(rName, "test-fixtures/lambdatest.zip"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckLayerVersionExists(ctx, resourceName),
+					acctest.CheckResourceAttrRegionalARN(resourceName, "arn", "lambda", fmt.Sprintf("layer:%s:1", rName)),
+				),
+			},
+			{
+				Config: testAccLayerVersionConfig_sourceCodeHash(rName, "test-fixtures/lambdatest.zip"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckLayerVersionExists(ctx, resourceName),
+					acctest.CheckResourceAttrRegionalARN(resourceName, "arn", "lambda", fmt.Sprintf("layer:%s:1", rName)),
+				),
+			},
+			{
+				Config: testAccLayerVersionConfig_sourceCodeHash(rName, "test-fixtures/lambdatest_modified.zip"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckLayerVersionExists(ctx, resourceName),
+					acctest.CheckResourceAttrRegionalARN(resourceName, "arn", "lambda", fmt.Sprintf("layer:%s:2", rName)),
+				),
 			},
 		},
 	})
@@ -87,7 +128,7 @@ func TestAccLambdaLayerVersion_update(t *testing.T) {
 
 func TestAccLambdaLayerVersion_s3(t *testing.T) {
 	ctx := acctest.Context(t)
-	resourceName := "aws_lambda_layer_version.lambda_layer_test"
+	resourceName := "aws_lambda_layer_version.test"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
@@ -98,7 +139,7 @@ func TestAccLambdaLayerVersion_s3(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config: testAccLayerVersionConfig_s3(rName),
-				Check:  testAccCheckLayerVersionExists(ctx, resourceName, rName),
+				Check:  testAccCheckLayerVersionExists(ctx, resourceName),
 			},
 
 			{
@@ -113,7 +154,7 @@ func TestAccLambdaLayerVersion_s3(t *testing.T) {
 
 func TestAccLambdaLayerVersion_compatibleRuntimes(t *testing.T) {
 	ctx := acctest.Context(t)
-	resourceName := "aws_lambda_layer_version.lambda_layer_test"
+	resourceName := "aws_lambda_layer_version.test"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
@@ -125,7 +166,7 @@ func TestAccLambdaLayerVersion_compatibleRuntimes(t *testing.T) {
 			{
 				Config: testAccLayerVersionConfig_compatibleRuntimes(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckLayerVersionExists(ctx, resourceName, rName),
+					testAccCheckLayerVersionExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "compatible_runtimes.#", "2"),
 				),
 			},
@@ -142,7 +183,7 @@ func TestAccLambdaLayerVersion_compatibleRuntimes(t *testing.T) {
 
 func TestAccLambdaLayerVersion_compatibleArchitectures(t *testing.T) {
 	ctx := acctest.Context(t)
-	resourceName := "aws_lambda_layer_version.lambda_layer_test"
+	resourceName := "aws_lambda_layer_version.test"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
@@ -154,14 +195,14 @@ func TestAccLambdaLayerVersion_compatibleArchitectures(t *testing.T) {
 			{
 				Config: testAccLayerVersionConfig_compatibleArchitecturesNone(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckLayerVersionExists(ctx, resourceName, rName),
+					testAccCheckLayerVersionExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "compatible_architectures.#", "0"),
 				),
 			},
 			{
 				Config: testAccLayerVersionConfig_compatibleArchitecturesX86(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckLayerVersionExists(ctx, resourceName, rName),
+					testAccCheckLayerVersionExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "compatible_architectures.#", "1"),
 					resource.TestCheckTypeSetElemAttr(resourceName, "compatible_architectures.*", lambda.ArchitectureX8664),
 				),
@@ -169,14 +210,14 @@ func TestAccLambdaLayerVersion_compatibleArchitectures(t *testing.T) {
 			{
 				Config: testAccLayerVersionConfig_compatibleArchitecturesArm(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckLayerVersionExists(ctx, resourceName, rName),
+					testAccCheckLayerVersionExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "compatible_architectures.#", "1"),
 				),
 			},
 			{
 				Config: testAccLayerVersionConfig_compatibleArchitecturesX86Arm(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckLayerVersionExists(ctx, resourceName, rName),
+					testAccCheckLayerVersionExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "compatible_architectures.#", "2"),
 				),
 			},
@@ -193,7 +234,7 @@ func TestAccLambdaLayerVersion_compatibleArchitectures(t *testing.T) {
 
 func TestAccLambdaLayerVersion_description(t *testing.T) {
 	ctx := acctest.Context(t)
-	resourceName := "aws_lambda_layer_version.lambda_layer_test"
+	resourceName := "aws_lambda_layer_version.test"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	testDescription := "test description"
 
@@ -206,7 +247,7 @@ func TestAccLambdaLayerVersion_description(t *testing.T) {
 			{
 				Config: testAccLayerVersionConfig_description(rName, testDescription),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckLayerVersionExists(ctx, resourceName, rName),
+					testAccCheckLayerVersionExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "description", testDescription),
 				),
 			},
@@ -223,7 +264,7 @@ func TestAccLambdaLayerVersion_description(t *testing.T) {
 
 func TestAccLambdaLayerVersion_licenseInfo(t *testing.T) {
 	ctx := acctest.Context(t)
-	resourceName := "aws_lambda_layer_version.lambda_layer_test"
+	resourceName := "aws_lambda_layer_version.test"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	testLicenseInfo := "MIT"
 
@@ -236,7 +277,7 @@ func TestAccLambdaLayerVersion_licenseInfo(t *testing.T) {
 			{
 				Config: testAccLayerVersionConfig_licenseInfo(rName, testLicenseInfo),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckLayerVersionExists(ctx, resourceName, rName),
+					testAccCheckLayerVersionExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "license_info", testLicenseInfo),
 				),
 			},
@@ -253,20 +294,20 @@ func TestAccLambdaLayerVersion_licenseInfo(t *testing.T) {
 
 func TestAccLambdaLayerVersion_skipDestroy(t *testing.T) {
 	ctx := acctest.Context(t)
-	resourceName := "aws_lambda_layer_version.lambda_layer_test"
+	resourceName := "aws_lambda_layer_version.test"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
 		ErrorCheck:               acctest.ErrorCheck(t, lambda.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             nil, // this purposely leaves dangling resources, since skip_destroy = true
+		CheckDestroy:             acctest.CheckDestroyNoop, // this purposely leaves dangling resources, since skip_destroy = true
 		Steps: []resource.TestStep{
 			{
 				Config: testAccLayerVersionConfig_skipDestroy(rName, "nodejs14.x"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckLayerVersionExists(ctx, resourceName, rName),
-					acctest.CheckResourceAttrRegionalARN(resourceName, "arn", "lambda", fmt.Sprintf("layer:%s:2", rName)),
+					testAccCheckLayerVersionExists(ctx, resourceName),
+					acctest.CheckResourceAttrRegionalARN(resourceName, "arn", "lambda", fmt.Sprintf("layer:%s:1", rName)),
 					resource.TestCheckResourceAttr(resourceName, "compatible_runtimes.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "skip_destroy", "true"),
 				),
@@ -274,8 +315,8 @@ func TestAccLambdaLayerVersion_skipDestroy(t *testing.T) {
 			{
 				Config: testAccLayerVersionConfig_skipDestroy(rName, "nodejs16.x"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckLayerVersionExists(ctx, resourceName, rName),
-					acctest.CheckResourceAttrRegionalARN(resourceName, "arn", "lambda", fmt.Sprintf("layer:%s:1", rName)),
+					testAccCheckLayerVersionExists(ctx, resourceName),
+					acctest.CheckResourceAttrRegionalARN(resourceName, "arn", "lambda", fmt.Sprintf("layer:%s:2", rName)),
 					resource.TestCheckResourceAttr(resourceName, "compatible_runtimes.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "skip_destroy", "true"),
 				),
@@ -293,61 +334,51 @@ func testAccCheckLayerVersionDestroy(ctx context.Context) resource.TestCheckFunc
 				continue
 			}
 
-			layerName, version, err := tflambda.LayerVersionParseID(rs.Primary.ID)
+			layerName, versionNumber, err := tflambda.LayerVersionParseID(rs.Primary.ID)
 			if err != nil {
 				return err
 			}
 
-			_, err = conn.GetLayerVersionWithContext(ctx, &lambda.GetLayerVersionInput{
-				LayerName:     aws.String(layerName),
-				VersionNumber: aws.Int64(version),
-			})
-			if tfawserr.ErrCodeEquals(err, lambda.ErrCodeResourceNotFoundException) {
+			_, err = tflambda.FindLayerVersionByTwoPartKey(ctx, conn, layerName, versionNumber)
+
+			if tfresource.NotFound(err) {
 				continue
 			}
+
 			if err != nil {
 				return err
 			}
 
-			return fmt.Errorf("Lambda Layer Version (%s) still exists", rs.Primary.ID)
+			return fmt.Errorf("Lambda Layer Version %s still exists", rs.Primary.ID)
 		}
 
 		return nil
 	}
 }
 
-func testAccCheckLayerVersionExists(ctx context.Context, res, layerName string) resource.TestCheckFunc {
+func testAccCheckLayerVersionExists(ctx context.Context, n string) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		rs, ok := s.RootModule().Resources[res]
+		rs, ok := s.RootModule().Resources[n]
 		if !ok {
-			return fmt.Errorf("Lambda Layer version not found: %s", res)
+			return fmt.Errorf("Not found: %s", n)
 		}
 
-		if rs.Primary.ID == "" {
-			return fmt.Errorf("Lambda Layer ID not set")
-		}
-
-		if rs.Primary.Attributes["version"] == "" {
-			return fmt.Errorf("Lambda Layer Version not set")
-		}
-
-		version, err := strconv.Atoi(rs.Primary.Attributes["version"])
+		layerName, versionNumber, err := tflambda.LayerVersionParseID(rs.Primary.ID)
 		if err != nil {
 			return err
 		}
 
 		conn := acctest.Provider.Meta().(*conns.AWSClient).LambdaConn(ctx)
-		_, err = conn.GetLayerVersionWithContext(ctx, &lambda.GetLayerVersionInput{
-			LayerName:     aws.String(layerName),
-			VersionNumber: aws.Int64(int64(version)),
-		})
+
+		_, err = tflambda.FindLayerVersionByTwoPartKey(ctx, conn, layerName, versionNumber)
+
 		return err
 	}
 }
 
 func testAccLayerVersionConfig_basic(rName string) string {
 	return fmt.Sprintf(`
-resource "aws_lambda_layer_version" "lambda_layer_test" {
+resource "aws_lambda_layer_version" "test" {
   filename   = "test-fixtures/lambdatest.zip"
   layer_name = %[1]q
 }
@@ -366,7 +397,7 @@ resource "aws_s3_object" "lambda_code" {
   source = "test-fixtures/lambdatest.zip"
 }
 
-resource "aws_lambda_layer_version" "lambda_layer_test" {
+resource "aws_lambda_layer_version" "test" {
   s3_bucket  = aws_s3_bucket.lambda_bucket.id
   s3_key     = aws_s3_object.lambda_code.id
   layer_name = %[1]q
@@ -376,7 +407,7 @@ resource "aws_lambda_layer_version" "lambda_layer_test" {
 
 func testAccLayerVersionConfig_createBeforeDestroy(rName string, filename string) string {
 	return fmt.Sprintf(`
-resource "aws_lambda_layer_version" "lambda_layer_test" {
+resource "aws_lambda_layer_version" "test" {
   filename         = %[1]q
   layer_name       = %[2]q
   source_code_hash = filebase64sha256(%[1]q)
@@ -388,9 +419,19 @@ resource "aws_lambda_layer_version" "lambda_layer_test" {
 `, filename, rName)
 }
 
+func testAccLayerVersionConfig_sourceCodeHash(rName string, filename string) string {
+	return fmt.Sprintf(`
+resource "aws_lambda_layer_version" "test" {
+  filename         = %[1]q
+  layer_name       = %[2]q
+  source_code_hash = filebase64sha256(%[1]q)
+}
+`, filename, rName)
+}
+
 func testAccLayerVersionConfig_compatibleRuntimes(rName string) string {
 	return fmt.Sprintf(`
-resource "aws_lambda_layer_version" "lambda_layer_test" {
+resource "aws_lambda_layer_version" "test" {
   filename   = "test-fixtures/lambdatest.zip"
   layer_name = %[1]q
 
@@ -401,7 +442,7 @@ resource "aws_lambda_layer_version" "lambda_layer_test" {
 
 func testAccLayerVersionConfig_compatibleArchitecturesNone(rName string) string {
 	return fmt.Sprintf(`
-resource "aws_lambda_layer_version" "lambda_layer_test" {
+resource "aws_lambda_layer_version" "test" {
   filename   = "test-fixtures/lambdatest.zip"
   layer_name = %[1]q
 }
@@ -410,7 +451,7 @@ resource "aws_lambda_layer_version" "lambda_layer_test" {
 
 func testAccLayerVersionConfig_compatibleArchitecturesX86Arm(rName string) string {
 	return fmt.Sprintf(`
-resource "aws_lambda_layer_version" "lambda_layer_test" {
+resource "aws_lambda_layer_version" "test" {
   filename                 = "test-fixtures/lambdatest.zip"
   layer_name               = %[1]q
   compatible_architectures = ["x86_64", "arm64"]
@@ -420,7 +461,7 @@ resource "aws_lambda_layer_version" "lambda_layer_test" {
 
 func testAccLayerVersionConfig_compatibleArchitecturesX86(rName string) string {
 	return fmt.Sprintf(`
-resource "aws_lambda_layer_version" "lambda_layer_test" {
+resource "aws_lambda_layer_version" "test" {
   filename                 = "test-fixtures/lambdatest.zip"
   layer_name               = %[1]q
   compatible_architectures = ["x86_64"]
@@ -430,7 +471,7 @@ resource "aws_lambda_layer_version" "lambda_layer_test" {
 
 func testAccLayerVersionConfig_compatibleArchitecturesArm(rName string) string {
 	return fmt.Sprintf(`
-resource "aws_lambda_layer_version" "lambda_layer_test" {
+resource "aws_lambda_layer_version" "test" {
   filename                 = "test-fixtures/lambdatest.zip"
   layer_name               = %[1]q
   compatible_architectures = ["arm64"]
@@ -440,7 +481,7 @@ resource "aws_lambda_layer_version" "lambda_layer_test" {
 
 func testAccLayerVersionConfig_description(rName string, description string) string {
 	return fmt.Sprintf(`
-resource "aws_lambda_layer_version" "lambda_layer_test" {
+resource "aws_lambda_layer_version" "test" {
   filename   = "test-fixtures/lambdatest.zip"
   layer_name = %[1]q
 
@@ -451,7 +492,7 @@ resource "aws_lambda_layer_version" "lambda_layer_test" {
 
 func testAccLayerVersionConfig_licenseInfo(rName string, licenseInfo string) string {
 	return fmt.Sprintf(`
-resource "aws_lambda_layer_version" "lambda_layer_test" {
+resource "aws_lambda_layer_version" "test" {
   filename   = "test-fixtures/lambdatest.zip"
   layer_name = %[1]q
 
@@ -462,7 +503,7 @@ resource "aws_lambda_layer_version" "lambda_layer_test" {
 
 func testAccLayerVersionConfig_skipDestroy(rName, compatRuntime string) string {
 	return fmt.Sprintf(`
-resource "aws_lambda_layer_version" "lambda_layer_test" {
+resource "aws_lambda_layer_version" "test" {
   filename            = "test-fixtures/lambdatest.zip"
   layer_name          = %[1]q
   compatible_runtimes = [%[2]q]
diff --git a/internal/service/lambda/permission.go b/internal/service/lambda/permission.go
index 4ac781896aa..d3383355adc 100644
--- a/internal/service/lambda/permission.go
+++ b/internal/service/lambda/permission.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lambda
 
 import (
@@ -5,9 +8,9 @@ import (
 	"encoding/json"
 	"fmt"
 	"log"
-	"regexp"
 	"strings"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/lambda"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -22,7 +25,7 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
 )
 
-var functionRegexp = `^(arn:[\w-]+:lambda:)?([a-z]{2}-(?:[a-z]+-){1,2}\d{1}:)?(\d{12}:)?(function:)?([a-zA-Z0-9-_]+)(:(\$LATEST|[a-zA-Z0-9-_]+))?$`
+var functionRegexp = `^(arn:[\w-]+:lambda:)?([a-z]{2}-(?:[a-z]+-){1,2}\d{1}:)?(\d{12}:)?(function:)?([0-9A-Za-z_-]+)(:(\$LATEST|[0-9A-Za-z_-]+))?$`
 
 // @SDKResource("aws_lambda_permission")
 func ResourcePermission() *schema.Resource {
@@ -353,7 +356,7 @@ func FindPolicyStatementByID(policy *Policy, id string) (*PolicyStatement, error
 }
 
 func GetQualifierFromAliasOrVersionARN(arn string) (string, error) {
-	matches := regexp.MustCompile(functionRegexp).FindStringSubmatch(arn)
+	matches := regexache.MustCompile(functionRegexp).FindStringSubmatch(arn)
 	if len(matches) < 8 || matches[7] == "" {
 		return "", fmt.Errorf("Invalid ARN or otherwise unable to get qualifier from ARN (%q)",
 			arn)
@@ -363,7 +366,7 @@ func GetQualifierFromAliasOrVersionARN(arn string) (string, error) {
 }
 
 func GetFunctionNameFromARN(arn string) (string, error) {
-	matches := regexp.MustCompile(functionRegexp).FindStringSubmatch(arn)
+	matches := regexache.MustCompile(functionRegexp).FindStringSubmatch(arn)
 	if len(matches) < 6 || matches[5] == "" {
 		return "", fmt.Errorf("Invalid ARN or otherwise unable to get qualifier from ARN (%q)",
 			arn)
diff --git a/internal/service/lambda/permission_test.go b/internal/service/lambda/permission_test.go
index 2c5edb650c7..c1566c2b139 100644
--- a/internal/service/lambda/permission_test.go
+++ b/internal/service/lambda/permission_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lambda_test
 
 import (
 	"context"
 	"encoding/json"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/lambda"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -304,7 +307,7 @@ func TestAccLambdaPermission_statementIDDuplicate(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccPermissionConfig_statementIDDuplicate(rName),
-				ExpectError: regexp.MustCompile(`ResourceConflictException`),
+				ExpectError: regexache.MustCompile(`ResourceConflictException`),
 			},
 		},
 	})
@@ -950,12 +953,7 @@ resource "aws_lambda_permission" "test" {
 }
 
 resource "aws_s3_bucket" "test" {
-  bucket = "%s"
-}
-
-resource "aws_s3_bucket_acl" "test" {
-  bucket = aws_s3_bucket.test.id
-  acl    = "private"
+  bucket = %[1]q
 }
 `, rName))
 }
diff --git a/internal/service/lambda/policy_model.go b/internal/service/lambda/policy_model.go
index c7155f65d1c..05ea91b59db 100644
--- a/internal/service/lambda/policy_model.go
+++ b/internal/service/lambda/policy_model.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lambda
 
 import (
diff --git a/internal/service/lambda/provisioned_concurrency_config.go b/internal/service/lambda/provisioned_concurrency_config.go
index 0b2a31872da..0b7a7fee453 100644
--- a/internal/service/lambda/provisioned_concurrency_config.go
+++ b/internal/service/lambda/provisioned_concurrency_config.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lambda
 
 import (
diff --git a/internal/service/lambda/provisioned_concurrency_config_migrate.go b/internal/service/lambda/provisioned_concurrency_config_migrate.go
index e5b0cf00594..672ebe8d663 100644
--- a/internal/service/lambda/provisioned_concurrency_config_migrate.go
+++ b/internal/service/lambda/provisioned_concurrency_config_migrate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lambda
 
 import (
diff --git a/internal/service/lambda/provisioned_concurrency_config_test.go b/internal/service/lambda/provisioned_concurrency_config_test.go
index 2a33d40607b..00ed4cf14b6 100644
--- a/internal/service/lambda/provisioned_concurrency_config_test.go
+++ b/internal/service/lambda/provisioned_concurrency_config_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lambda_test
 
 import (
diff --git a/internal/service/lambda/service_package_gen.go b/internal/service/lambda/service_package_gen.go
index 051b4ecbd0d..60a0f91d2eb 100644
--- a/internal/service/lambda/service_package_gen.go
+++ b/internal/service/lambda/service_package_gen.go
@@ -10,6 +10,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	lambda_sdkv1 "github.com/aws/aws-sdk-go/service/lambda"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -127,9 +128,11 @@ func (p *servicePackage) NewClient(ctx context.Context, config map[string]any) (
 
 	return lambda_sdkv2.NewFromConfig(cfg, func(o *lambda_sdkv2.Options) {
 		if endpoint := config["endpoint"].(string); endpoint != "" {
-			o.EndpointResolver = lambda_sdkv2.EndpointResolverFromURL(endpoint)
+			o.BaseEndpoint = aws_sdkv2.String(endpoint)
 		}
 	}), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/lambda/sweep.go b/internal/service/lambda/sweep.go
index 091db5f3d75..abcc0cec33a 100644
--- a/internal/service/lambda/sweep.go
+++ b/internal/service/lambda/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package lambda
 
@@ -13,9 +13,10 @@ import (
 	multierror "github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_lambda_function", &resource.Sweeper{
 		Name: "aws_lambda_function",
 		F:    sweepFunctions,
@@ -32,7 +33,7 @@ func init() {
 
 func sweepFunctions(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -57,7 +58,7 @@ func sweepFunctions(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Lambda Function sweep for %s: %s", region, err)
 		return nil
 	}
@@ -66,7 +67,7 @@ func sweepFunctions(region string) error {
 		return fmt.Errorf("error listing Lambda Functions (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping Lambda Functions (%s): %w", region, err)
@@ -77,7 +78,7 @@ func sweepFunctions(region string) error {
 
 func sweepLayerVersions(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -115,7 +116,7 @@ func sweepLayerVersions(region string) error {
 				return !lastPage
 			})
 
-			if sweep.SkipSweepError(err) {
+			if awsv1.SkipSweepError(err) {
 				continue
 			}
 
@@ -127,7 +128,7 @@ func sweepLayerVersions(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Lambda Layer Version sweep for %s: %s", region, err)
 		return nil
 	}
@@ -136,7 +137,7 @@ func sweepLayerVersions(region string) error {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error listing Lambda Layers (%s): %w", region, err))
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error sweeping Lambda Layer Versions (%s): %w", region, err))
diff --git a/internal/service/lambda/tags_gen.go b/internal/service/lambda/tags_gen.go
index 1d7b77058ae..535bcdfd0cf 100644
--- a/internal/service/lambda/tags_gen.go
+++ b/internal/service/lambda/tags_gen.go
@@ -7,12 +7,47 @@ import (
 
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/lambda"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
+// listTags lists lambda service tags.
+// The identifier is typically the Amazon Resource Name (ARN), although
+// it may also be a different identifier depending on the service.
+func listTags(ctx context.Context, conn *lambda.Client, identifier string) (tftags.KeyValueTags, error) {
+	input := &lambda.ListTagsInput{
+		Resource: aws.String(identifier),
+	}
+
+	output, err := conn.ListTags(ctx, input)
+
+	if err != nil {
+		return tftags.New(ctx, nil), err
+	}
+
+	return KeyValueTags(ctx, output.Tags), nil
+}
+
+// ListTags lists lambda service tags and set them in Context.
+// It is called from outside this package.
+func (p *servicePackage) ListTags(ctx context.Context, meta any, identifier string) error {
+	tags, err := listTags(ctx, meta.(*conns.AWSClient).LambdaClient(ctx), identifier)
+
+	if err != nil {
+		return err
+	}
+
+	if inContext, ok := tftags.FromContext(ctx); ok {
+		inContext.TagsOut = types.Some(tags)
+	}
+
+	return nil
+}
+
 // map[string]string handling
 
 // Tags returns lambda service tags.
@@ -20,7 +55,7 @@ func Tags(tags tftags.KeyValueTags) map[string]string {
 	return tags.Map()
 }
 
-// KeyValueTags creates KeyValueTags from lambda service tags.
+// KeyValueTags creates tftags.KeyValueTags from lambda service tags.
 func KeyValueTags(ctx context.Context, tags map[string]string) tftags.KeyValueTags {
 	return tftags.New(ctx, tags)
 }
@@ -51,6 +86,8 @@ func updateTags(ctx context.Context, conn *lambda.Client, identifier string, old
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.Lambda)
 	if len(removedTags) > 0 {
diff --git a/internal/service/lambda/test-fixtures/lambda_func.js b/internal/service/lambda/test-fixtures/lambda_func.js
index 556182a5ccc..8ea027b3a05 100644
--- a/internal/service/lambda/test-fixtures/lambda_func.js
+++ b/internal/service/lambda/test-fixtures/lambda_func.js
@@ -1,3 +1,8 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
 var http = require('http')
 
 exports.handler = function(event, context) {
diff --git a/internal/service/lambda/test-fixtures/lambda_func_modified.js b/internal/service/lambda/test-fixtures/lambda_func_modified.js
index 9842040bb4a..6bcd2136aa5 100644
--- a/internal/service/lambda/test-fixtures/lambda_func_modified.js
+++ b/internal/service/lambda/test-fixtures/lambda_func_modified.js
@@ -1,3 +1,8 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
 var http = require('http')
 
 exports.handler = function(event, context) {
diff --git a/internal/service/lambda/test-fixtures/lambda_invocation.js b/internal/service/lambda/test-fixtures/lambda_invocation.js
index abc0191f982..ce72f62d6e6 100644
--- a/internal/service/lambda/test-fixtures/lambda_invocation.js
+++ b/internal/service/lambda/test-fixtures/lambda_invocation.js
@@ -1,3 +1,8 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
 exports.handler = async (event) => {
     if (process.env.TEST_DATA) {
         event.key3 = process.env.TEST_DATA;
diff --git a/internal/service/lambda/test-fixtures/lambda_invocation_crud.js b/internal/service/lambda/test-fixtures/lambda_invocation_crud.js
index 647363214ee..7032f5f02d8 100644
--- a/internal/service/lambda/test-fixtures/lambda_invocation_crud.js
+++ b/internal/service/lambda/test-fixtures/lambda_invocation_crud.js
@@ -1,3 +1,8 @@
+/**
+ * Copyright (c) HashiCorp, Inc.
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
 const AWS = require('aws-sdk')
 const ssmClient = new AWS.SSM();
 
diff --git a/internal/service/lambda/validate.go b/internal/service/lambda/validate.go
index 56cb7c89615..2c0a0edaca3 100644
--- a/internal/service/lambda/validate.go
+++ b/internal/service/lambda/validate.go
@@ -1,31 +1,33 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lambda
 
 import (
-	"regexp"
-
+	"github.com/YakDriver/regexache"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 )
 
 func validFunctionName() schema.SchemaValidateFunc {
 	// http://docs.aws.amazon.com/lambda/latest/dg/API_AddPermission.html
-	pattern := `^(arn:[\w-]+:lambda:)?([a-z]{2}-(?:[a-z]+-){1,2}\d{1}:)?(\d{12}:)?(function:)?([a-zA-Z0-9-_]+)(:(\$LATEST|[a-zA-Z0-9-_]+))?$`
+	pattern := `^(arn:[\w-]+:lambda:)?([a-z]{2}-(?:[a-z]+-){1,2}\d{1}:)?(\d{12}:)?(function:)?([0-9A-Za-z_-]+)(:(\$LATEST|[0-9A-Za-z_-]+))?$`
 
 	return validation.All(
-		validation.StringMatch(regexp.MustCompile(pattern), "must be valid function name or function ARN"),
+		validation.StringMatch(regexache.MustCompile(pattern), "must be valid function name or function ARN"),
 		validation.StringLenBetween(1, 140),
 	)
 }
 
 func validPermissionAction() schema.SchemaValidateFunc {
-	pattern := `^(lambda:[*]|lambda:[a-zA-Z]+|[*])$`
-	return validation.StringMatch(regexp.MustCompile(pattern), "must be a valid action (usually starts with lambda:)")
+	pattern := `^(lambda:[*]|lambda:[A-Za-z]+|[*])$`
+	return validation.StringMatch(regexache.MustCompile(pattern), "must be a valid action (usually starts with lambda:)")
 }
 
 func validPermissionEventSourceToken() schema.SchemaValidateFunc {
 	// https://docs.aws.amazon.com/lambda/latest/dg/API_AddPermission.html
 	return validation.All(
-		validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9._\-]+$`), "must contain alphanumeric, periods, underscores or dashes only"),
+		validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_.-]+$`), "must contain alphanumeric, periods, underscores or dashes only"),
 		validation.StringLenBetween(1, 256),
 	)
 }
@@ -33,7 +35,7 @@ func validPermissionEventSourceToken() schema.SchemaValidateFunc {
 func validQualifier() schema.SchemaValidateFunc {
 	// http://docs.aws.amazon.com/lambda/latest/dg/API_AddPermission.html
 	return validation.All(
-		validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9$_-]+$`), "must contain alphanumeric, dollar signs, underscores or dashes only"),
+		validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_$-]+$`), "must contain alphanumeric, dollar signs, underscores or dashes only"),
 		validation.StringLenBetween(1, 128),
 	)
 }
@@ -41,7 +43,7 @@ func validQualifier() schema.SchemaValidateFunc {
 func validPolicyStatementID() schema.SchemaValidateFunc {
 	// http://docs.aws.amazon.com/lambda/latest/dg/API_AddPermission.html
 	return validation.All(
-		validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9_-]+$`), "must contain alphanumeric, underscores or dashes only"),
+		validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_-]+$`), "must contain alphanumeric, underscores or dashes only"),
 		validation.StringLenBetween(1, 100),
 	)
 }
diff --git a/internal/service/lambda/validate_test.go b/internal/service/lambda/validate_test.go
index 31542c9f3c0..731143384f4 100644
--- a/internal/service/lambda/validate_test.go
+++ b/internal/service/lambda/validate_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lambda
 
 import (
diff --git a/internal/service/lexmodels/bot.go b/internal/service/lexmodels/bot.go
index d36dd1d97c2..91ec3e69b47 100644
--- a/internal/service/lexmodels/bot.go
+++ b/internal/service/lexmodels/bot.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lexmodels
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/aws/aws-sdk-go/service/lexmodelbuildingservice"
@@ -117,7 +120,7 @@ func ResourceBot() *schema.Resource {
 							Required: true,
 							ValidateFunc: validation.All(
 								validation.StringLenBetween(1, 100),
-								validation.StringMatch(regexp.MustCompile(`^([A-Za-z]_?)+$`), ""),
+								validation.StringMatch(regexache.MustCompile(`^([A-Za-z]_?)+$`), ""),
 							),
 						},
 						"intent_version": {
@@ -125,7 +128,7 @@ func ResourceBot() *schema.Resource {
 							Required: true,
 							ValidateFunc: validation.All(
 								validation.StringLenBetween(1, 64),
-								validation.StringMatch(regexp.MustCompile(`\$LATEST|[0-9]+`), ""),
+								validation.StringMatch(regexache.MustCompile(`\$LATEST|[0-9]+`), ""),
 							),
 						},
 					},
@@ -211,12 +214,12 @@ func hasBotConfigChanges(d verify.ResourceDiffer) bool {
 
 var validBotName = validation.All(
 	validation.StringLenBetween(2, 50),
-	validation.StringMatch(regexp.MustCompile(`^([A-Za-z]_?)+$`), ""),
+	validation.StringMatch(regexache.MustCompile(`^([A-Za-z]_?)+$`), ""),
 )
 
 var validBotVersion = validation.All(
 	validation.StringLenBetween(1, 64),
-	validation.StringMatch(regexp.MustCompile(`\$LATEST|[0-9]+`), ""),
+	validation.StringMatch(regexache.MustCompile(`\$LATEST|[0-9]+`), ""),
 )
 
 func resourceBotCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
diff --git a/internal/service/lexmodels/bot_alias.go b/internal/service/lexmodels/bot_alias.go
index 3f398aea76d..bea6b33eaad 100644
--- a/internal/service/lexmodels/bot_alias.go
+++ b/internal/service/lexmodels/bot_alias.go
@@ -1,13 +1,16 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lexmodels
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"strings"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/aws/aws-sdk-go/service/lexmodelbuildingservice"
@@ -116,7 +119,7 @@ func ResourceBotAlias() *schema.Resource {
 
 var validBotAliasName = validation.All(
 	validation.StringLenBetween(1, 100),
-	validation.StringMatch(regexp.MustCompile(`^([A-Za-z]_?)+$`), ""),
+	validation.StringMatch(regexache.MustCompile(`^([A-Za-z]_?)+$`), ""),
 )
 
 func resourceBotAliasCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
diff --git a/internal/service/lexmodels/bot_alias_data_source.go b/internal/service/lexmodels/bot_alias_data_source.go
index 8fb94e3d094..9f2226532ce 100644
--- a/internal/service/lexmodels/bot_alias_data_source.go
+++ b/internal/service/lexmodels/bot_alias_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lexmodels
 
 import (
diff --git a/internal/service/lexmodels/bot_alias_data_source_test.go b/internal/service/lexmodels/bot_alias_data_source_test.go
index 08a9e18ab0d..2758918fe00 100644
--- a/internal/service/lexmodels/bot_alias_data_source_test.go
+++ b/internal/service/lexmodels/bot_alias_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lexmodels_test
 
 import (
diff --git a/internal/service/lexmodels/bot_alias_test.go b/internal/service/lexmodels/bot_alias_test.go
index d99fc51066b..d162ebd391b 100644
--- a/internal/service/lexmodels/bot_alias_test.go
+++ b/internal/service/lexmodels/bot_alias_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lexmodels_test
 
 import (
@@ -6,6 +9,7 @@ import (
 	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/lexmodelbuildingservice"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -152,7 +156,7 @@ func TestAccLexModelsBotAlias_conversationLogsText(t *testing.T) {
 					}),
 					resource.TestCheckTypeSetElemAttrPair(resourceName, "conversation_logs.0.log_settings.*.resource_arn", cloudwatchLogGroupResourceName, "arn"),
 					resource.TestMatchTypeSetElemNestedAttrs(resourceName, "conversation_logs.0.log_settings.*", map[string]*regexp.Regexp{
-						"resource_prefix": regexp.MustCompile(regexp.QuoteMeta(fmt.Sprintf(`aws/lex/%s/%s/%s/`, testBotID, testBotAliasID, tflexmodels.BotVersionLatest))),
+						"resource_prefix": regexache.MustCompile(regexp.QuoteMeta(fmt.Sprintf(`aws/lex/%s/%s/%s/`, testBotID, testBotAliasID, tflexmodels.BotVersionLatest))),
 					}),
 				),
 			},
@@ -203,7 +207,7 @@ func TestAccLexModelsBotAlias_conversationLogsAudio(t *testing.T) {
 					resource.TestCheckTypeSetElemAttrPair(resourceName, "conversation_logs.0.log_settings.*.resource_arn", s3BucketResourceName, "arn"),
 					resource.TestCheckTypeSetElemAttrPair(resourceName, "conversation_logs.0.log_settings.*.kms_key_arn", kmsKeyResourceName, "arn"),
 					resource.TestMatchTypeSetElemNestedAttrs(resourceName, "conversation_logs.0.log_settings.*", map[string]*regexp.Regexp{
-						"resource_prefix": regexp.MustCompile(regexp.QuoteMeta(fmt.Sprintf(`aws/lex/%s/%s/%s/`, testBotID, testBotAliasID, tflexmodels.BotVersionLatest))),
+						"resource_prefix": regexache.MustCompile(regexp.QuoteMeta(fmt.Sprintf(`aws/lex/%s/%s/%s/`, testBotID, testBotAliasID, tflexmodels.BotVersionLatest))),
 					}),
 				),
 			},
diff --git a/internal/service/lexmodels/bot_data_source.go b/internal/service/lexmodels/bot_data_source.go
index c8954609478..725ae1a841b 100644
--- a/internal/service/lexmodels/bot_data_source.go
+++ b/internal/service/lexmodels/bot_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lexmodels
 
 import (
diff --git a/internal/service/lexmodels/bot_data_source_test.go b/internal/service/lexmodels/bot_data_source_test.go
index 90e5161f45a..0f79ac30223 100644
--- a/internal/service/lexmodels/bot_data_source_test.go
+++ b/internal/service/lexmodels/bot_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lexmodels_test
 
 import (
diff --git a/internal/service/lexmodels/bot_test.go b/internal/service/lexmodels/bot_test.go
index 2cbcd77a15d..ccf68a65d3b 100644
--- a/internal/service/lexmodels/bot_test.go
+++ b/internal/service/lexmodels/bot_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lexmodels_test
 
 import (
diff --git a/internal/service/lexmodels/enum.go b/internal/service/lexmodels/enum.go
index f038374c2ef..262b3da324c 100644
--- a/internal/service/lexmodels/enum.go
+++ b/internal/service/lexmodels/enum.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lexmodels
 
 const (
diff --git a/internal/service/lexmodels/find.go b/internal/service/lexmodels/find.go
index b4659271a79..ee507a01a4f 100644
--- a/internal/service/lexmodels/find.go
+++ b/internal/service/lexmodels/find.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lexmodels
 
 import (
diff --git a/internal/service/lexmodels/generate.go b/internal/service/lexmodels/generate.go
index 96a06df6a1d..bc7c633e16c 100644
--- a/internal/service/lexmodels/generate.go
+++ b/internal/service/lexmodels/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
 
diff --git a/internal/service/lexmodels/intent.go b/internal/service/lexmodels/intent.go
index ef4c0c7c1d6..5e3dc5a2cf2 100644
--- a/internal/service/lexmodels/intent.go
+++ b/internal/service/lexmodels/intent.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lexmodels
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/aws/aws-sdk-go/service/lexmodelbuildingservice"
@@ -149,7 +152,7 @@ func ResourceIntent() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 100),
-					validation.StringMatch(regexp.MustCompile(`^([A-Za-z]_?)+$`), ""),
+					validation.StringMatch(regexache.MustCompile(`^([A-Za-z]_?)+$`), ""),
 				),
 			},
 			"parent_intent_signature": {
@@ -192,7 +195,7 @@ func ResourceIntent() *schema.Resource {
 							Required: true,
 							ValidateFunc: validation.All(
 								validation.StringLenBetween(1, 100),
-								validation.StringMatch(regexp.MustCompile(`^([A-Za-z]_?)+$`), ""),
+								validation.StringMatch(regexache.MustCompile(`^([A-Za-z]_?)+$`), ""),
 							),
 						},
 						"priority": {
@@ -226,7 +229,7 @@ func ResourceIntent() *schema.Resource {
 							Required: true,
 							ValidateFunc: validation.All(
 								validation.StringLenBetween(1, 100),
-								validation.StringMatch(regexp.MustCompile(`^((AMAZON\.)_?|[A-Za-z]_?)+`), ""),
+								validation.StringMatch(regexache.MustCompile(`^((AMAZON\.)_?|[A-Za-z]_?)+`), ""),
 							),
 						},
 						"slot_type_version": {
@@ -234,7 +237,7 @@ func ResourceIntent() *schema.Resource {
 							Optional: true,
 							ValidateFunc: validation.All(
 								validation.StringLenBetween(1, 64),
-								validation.StringMatch(regexp.MustCompile(`\$LATEST|[0-9]+`), ""),
+								validation.StringMatch(regexache.MustCompile(`\$LATEST|[0-9]+`), ""),
 							),
 						},
 						"value_elicitation_prompt": {
diff --git a/internal/service/lexmodels/intent_data_source.go b/internal/service/lexmodels/intent_data_source.go
index cb56591b671..fdd89743e96 100644
--- a/internal/service/lexmodels/intent_data_source.go
+++ b/internal/service/lexmodels/intent_data_source.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lexmodels
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/aws/aws-sdk-go/service/lexmodelbuildingservice"
@@ -47,7 +50,7 @@ func DataSourceIntent() *schema.Resource {
 				Required: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 100),
-					validation.StringMatch(regexp.MustCompile(`^([A-Za-z]_?)+$`), ""),
+					validation.StringMatch(regexache.MustCompile(`^([A-Za-z]_?)+$`), ""),
 				),
 			},
 			"parent_intent_signature": {
@@ -60,7 +63,7 @@ func DataSourceIntent() *schema.Resource {
 				Default:  IntentVersionLatest,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 64),
-					validation.StringMatch(regexp.MustCompile(`\$LATEST|[0-9]+`), ""),
+					validation.StringMatch(regexache.MustCompile(`\$LATEST|[0-9]+`), ""),
 				),
 			},
 		},
diff --git a/internal/service/lexmodels/intent_data_source_test.go b/internal/service/lexmodels/intent_data_source_test.go
index 085e779811f..ff5c39120b9 100644
--- a/internal/service/lexmodels/intent_data_source_test.go
+++ b/internal/service/lexmodels/intent_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lexmodels_test
 
 import (
diff --git a/internal/service/lexmodels/intent_test.go b/internal/service/lexmodels/intent_test.go
index 2c37db0a2f3..dfd363e6635 100644
--- a/internal/service/lexmodels/intent_test.go
+++ b/internal/service/lexmodels/intent_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lexmodels_test
 
 import (
diff --git a/internal/service/lexmodels/service_package_gen.go b/internal/service/lexmodels/service_package_gen.go
index 91054d021d1..7280e8b0290 100644
--- a/internal/service/lexmodels/service_package_gen.go
+++ b/internal/service/lexmodels/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	lexmodelbuildingservice_sdkv1 "github.com/aws/aws-sdk-go/service/lexmodelbuildingservice"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -75,4 +76,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*l
 	return lexmodelbuildingservice_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/lexmodels/slot_type.go b/internal/service/lexmodels/slot_type.go
index e70223a309b..39ce343515c 100644
--- a/internal/service/lexmodels/slot_type.go
+++ b/internal/service/lexmodels/slot_type.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lexmodels
 
 import (
 	"context"
 	"log"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/lexmodelbuildingservice"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -96,7 +99,7 @@ func ResourceSlotType() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 100),
-					validation.StringMatch(regexp.MustCompile(`^((AMAZON\.)_?|[A-Za-z]_?)+`), ""),
+					validation.StringMatch(regexache.MustCompile(`^((AMAZON\.)_?|[A-Za-z]_?)+`), ""),
 				),
 			},
 			"value_selection_strategy": {
diff --git a/internal/service/lexmodels/slot_type_data_source.go b/internal/service/lexmodels/slot_type_data_source.go
index fb944454e80..c3135d6ae8e 100644
--- a/internal/service/lexmodels/slot_type_data_source.go
+++ b/internal/service/lexmodels/slot_type_data_source.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lexmodels
 
 import (
 	"context"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
@@ -58,7 +61,7 @@ func DataSourceSlotType() *schema.Resource {
 				Required: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 100),
-					validation.StringMatch(regexp.MustCompile(`^([A-Za-z]_?)+$`), ""),
+					validation.StringMatch(regexache.MustCompile(`^([A-Za-z]_?)+$`), ""),
 				),
 			},
 			"value_selection_strategy": {
@@ -71,7 +74,7 @@ func DataSourceSlotType() *schema.Resource {
 				Default:  SlotTypeVersionLatest,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 64),
-					validation.StringMatch(regexp.MustCompile(`\$LATEST|[0-9]+`), ""),
+					validation.StringMatch(regexache.MustCompile(`\$LATEST|[0-9]+`), ""),
 				),
 			},
 		},
diff --git a/internal/service/lexmodels/slot_type_data_source_test.go b/internal/service/lexmodels/slot_type_data_source_test.go
index ee3ca7bb3e3..16e25958c4b 100644
--- a/internal/service/lexmodels/slot_type_data_source_test.go
+++ b/internal/service/lexmodels/slot_type_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lexmodels_test
 
 import (
diff --git a/internal/service/lexmodels/slot_type_test.go b/internal/service/lexmodels/slot_type_test.go
index 07f81bc0107..a518500dc39 100644
--- a/internal/service/lexmodels/slot_type_test.go
+++ b/internal/service/lexmodels/slot_type_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lexmodels_test
 
 import (
diff --git a/internal/service/lexmodels/status.go b/internal/service/lexmodels/status.go
index c4300b3f3e1..39a0ca3d268 100644
--- a/internal/service/lexmodels/status.go
+++ b/internal/service/lexmodels/status.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lexmodels
 
 import (
diff --git a/internal/service/lexmodels/sweep.go b/internal/service/lexmodels/sweep.go
index 05ea19c7d25..4a50f624ae4 100644
--- a/internal/service/lexmodels/sweep.go
+++ b/internal/service/lexmodels/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package lexmodels
 
@@ -12,9 +12,10 @@ import (
 	"github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_lex_bot_alias", &resource.Sweeper{
 		Name: "aws_lex_bot_alias",
 		F:    sweepBotAliases,
@@ -41,7 +42,7 @@ func init() {
 
 func sweepBotAliases(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
@@ -101,11 +102,11 @@ func sweepBotAliases(region string) error {
 		errs = multierror.Append(errs, fmt.Errorf("error listing Lex Bot Alias for %s: %w", region, err))
 	}
 
-	if err = sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err = sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("error sweeping Lex Bot Alias for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
+	if awsv1.SkipSweepError(errs.ErrorOrNil()) {
 		log.Printf("[WARN] Skipping Lex Bot Alias sweep for %s: %s", region, errs)
 		return nil
 	}
@@ -115,7 +116,7 @@ func sweepBotAliases(region string) error {
 
 func sweepBots(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
@@ -148,11 +149,11 @@ func sweepBots(region string) error {
 		errs = multierror.Append(errs, fmt.Errorf("error listing Lex Bot for %s: %w", region, err))
 	}
 
-	if err = sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err = sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("error sweeping Lex Bot for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
+	if awsv1.SkipSweepError(errs.ErrorOrNil()) {
 		log.Printf("[WARN] Skipping Lex Bot sweep for %s: %s", region, errs)
 		return nil
 	}
@@ -162,7 +163,7 @@ func sweepBots(region string) error {
 
 func sweepIntents(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
@@ -195,11 +196,11 @@ func sweepIntents(region string) error {
 		errs = multierror.Append(errs, fmt.Errorf("error listing Lex Intent for %s: %w", region, err))
 	}
 
-	if err = sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err = sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("error sweeping Lex Intent for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
+	if awsv1.SkipSweepError(errs.ErrorOrNil()) {
 		log.Printf("[WARN] Skipping Lex Intent sweep for %s: %s", region, errs)
 		return nil
 	}
@@ -209,7 +210,7 @@ func sweepIntents(region string) error {
 
 func sweepSlotTypes(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
@@ -242,11 +243,11 @@ func sweepSlotTypes(region string) error {
 		errs = multierror.Append(errs, fmt.Errorf("error listing Lex Slot Type for %s: %w", region, err))
 	}
 
-	if err = sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err = sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("error sweeping Lex Slot Type for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
+	if awsv1.SkipSweepError(errs.ErrorOrNil()) {
 		log.Printf("[WARN] Skipping Lex Slot Type sweep for %s: %s", region, errs)
 		return nil
 	}
diff --git a/internal/service/lexmodels/wait.go b/internal/service/lexmodels/wait.go
index df5122537eb..868959b776c 100644
--- a/internal/service/lexmodels/wait.go
+++ b/internal/service/lexmodels/wait.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lexmodels
 
 import (
diff --git a/internal/service/lexv2models/bot.go b/internal/service/lexv2models/bot.go
new file mode 100644
index 00000000000..83fdc880233
--- /dev/null
+++ b/internal/service/lexv2models/bot.go
@@ -0,0 +1,584 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package lexv2models
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"time"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/aws/arn"
+	"github.com/aws/aws-sdk-go-v2/service/lexmodelsv2"
+	awstypes "github.com/aws/aws-sdk-go-v2/service/lexmodelsv2/types"
+	"github.com/hashicorp/terraform-plugin-framework-timeouts/resource/timeouts"
+	"github.com/hashicorp/terraform-plugin-framework-validators/listvalidator"
+	"github.com/hashicorp/terraform-plugin-framework/attr"
+	"github.com/hashicorp/terraform-plugin-framework/diag"
+	"github.com/hashicorp/terraform-plugin-framework/path"
+	"github.com/hashicorp/terraform-plugin-framework/resource"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema/planmodifier"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema/stringplanmodifier"
+	"github.com/hashicorp/terraform-plugin-framework/schema/validator"
+	"github.com/hashicorp/terraform-plugin-framework/types"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
+	"github.com/hashicorp/terraform-provider-aws/internal/create"
+	"github.com/hashicorp/terraform-provider-aws/internal/enum"
+	"github.com/hashicorp/terraform-provider-aws/internal/framework"
+	"github.com/hashicorp/terraform-provider-aws/internal/framework/flex"
+	fwtypes "github.com/hashicorp/terraform-provider-aws/internal/framework/types"
+	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/names"
+)
+
+// @FrameworkResource(name="Bot")
+// @Tags(identifierAttribute="arn")
+func newResourceBot(_ context.Context) (resource.ResourceWithConfigure, error) {
+	r := &resourceBot{}
+
+	r.SetDefaultCreateTimeout(30 * time.Minute)
+	r.SetDefaultUpdateTimeout(30 * time.Minute)
+	r.SetDefaultDeleteTimeout(30 * time.Minute)
+
+	return r, nil
+}
+
+const (
+	ResNameBot = "Bot"
+)
+
+type resourceBot struct {
+	framework.ResourceWithConfigure
+	framework.WithTimeouts
+}
+
+func (r *resourceBot) Metadata(_ context.Context, req resource.MetadataRequest, resp *resource.MetadataResponse) {
+	resp.TypeName = "aws_lexv2models_bot"
+}
+
+func (r *resourceBot) Schema(ctx context.Context, req resource.SchemaRequest, resp *resource.SchemaResponse) {
+	resp.Schema = schema.Schema{
+		Attributes: map[string]schema.Attribute{
+			"arn": framework.ARNAttributeComputedOnly(),
+			"description": schema.StringAttribute{
+				Optional: true,
+			},
+			"id": framework.IDAttribute(),
+			"idle_session_ttl_in_seconds": schema.Int64Attribute{
+				Required: true,
+			},
+			"name": schema.StringAttribute{
+				Required: true,
+				PlanModifiers: []planmodifier.String{
+					stringplanmodifier.RequiresReplace(),
+				},
+			},
+			names.AttrTags:    tftags.TagsAttribute(),
+			names.AttrTagsAll: tftags.TagsAttributeComputedOnly(),
+			"role_arn": schema.StringAttribute{
+				CustomType: fwtypes.ARNType,
+				Required:   true,
+			},
+			"test_bot_alias_tags": schema.MapAttribute{
+				ElementType: types.StringType,
+				Optional:    true,
+			},
+			"type": schema.StringAttribute{
+				Optional: true,
+				Computed: true,
+				Validators: []validator.String{
+					enum.FrameworkValidate[awstypes.BotType](),
+				},
+				PlanModifiers: []planmodifier.String{
+					stringplanmodifier.UseStateForUnknown(),
+				},
+			},
+		},
+		Blocks: map[string]schema.Block{
+			"members": schema.ListNestedBlock{
+				NestedObject: schema.NestedBlockObject{
+					Attributes: map[string]schema.Attribute{
+						"alias_id": schema.StringAttribute{
+							Required: true,
+						},
+						"alias_name": schema.StringAttribute{
+							Required: true,
+						},
+						"id": schema.StringAttribute{
+							Required: true,
+						},
+						"name": schema.StringAttribute{
+							Required: true,
+						},
+						"version": schema.StringAttribute{
+							Required: true,
+						},
+					},
+				},
+			},
+			"data_privacy": schema.ListNestedBlock{
+				Validators: []validator.List{
+					listvalidator.SizeAtLeast(1),
+				},
+				NestedObject: schema.NestedBlockObject{
+					Attributes: map[string]schema.Attribute{
+						"child_directed": schema.BoolAttribute{
+							Required: true,
+						},
+					},
+				},
+			},
+			"timeouts": timeouts.Block(ctx, timeouts.Opts{
+				Create: true,
+				Update: true,
+				Delete: true,
+			}),
+		},
+	}
+}
+
+func (r *resourceBot) Create(ctx context.Context, req resource.CreateRequest, resp *resource.CreateResponse) {
+	conn := r.Meta().LexV2ModelsClient(ctx)
+
+	var plan resourceBotData
+	resp.Diagnostics.Append(req.Plan.Get(ctx, &plan)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	var dp []dataPrivacyData
+	resp.Diagnostics.Append(plan.DataPrivacy.ElementsAs(ctx, &dp, false)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	dpInput := expandDataPrivacy(ctx, dp)
+
+	in := lexmodelsv2.CreateBotInput{
+		BotName:                 aws.String(plan.Name.ValueString()),
+		DataPrivacy:             dpInput,
+		IdleSessionTTLInSeconds: aws.Int32(int32(plan.IdleSessionTTLInSeconds.ValueInt64())),
+		RoleArn:                 flex.StringFromFramework(ctx, plan.RoleARN),
+		BotTags:                 getTagsIn(ctx),
+	}
+
+	if !plan.TestBotAliasTags.IsNull() {
+		in.TestBotAliasTags = flex.ExpandFrameworkStringValueMap(ctx, plan.TestBotAliasTags)
+	}
+
+	if !plan.Description.IsNull() {
+		in.Description = aws.String(plan.Description.ValueString())
+	}
+
+	var bm []membersData
+	if !plan.Members.IsNull() {
+		bmInput := expandMembers(ctx, bm)
+		in.BotMembers = bmInput
+	}
+
+	out, err := conn.CreateBot(ctx, &in)
+	if err != nil {
+		resp.Diagnostics.AddError(
+			create.ProblemStandardMessage(names.LexV2Models, create.ErrActionCreating, ResNameBot, plan.Name.String(), err),
+			err.Error(),
+		)
+		return
+	}
+	if out == nil || out.BotId == nil {
+		resp.Diagnostics.AddError(
+			create.ProblemStandardMessage(names.LexV2Models, create.ErrActionCreating, ResNameBot, plan.Name.String(), nil),
+			errors.New("empty output").Error(),
+		)
+		return
+	}
+	botArn := arn.ARN{
+		Partition: r.Meta().Partition,
+		Service:   "lex",
+		Region:    r.Meta().Region,
+		AccountID: r.Meta().AccountID,
+		Resource:  fmt.Sprintf("bot/%s", aws.ToString(out.BotId)),
+	}.String()
+	plan.ID = flex.StringToFramework(ctx, out.BotId)
+	state := plan
+	state.Type = flex.StringValueToFramework(ctx, out.BotType)
+	state.ARN = flex.StringValueToFramework(ctx, botArn)
+
+	resp.Diagnostics.Append(resp.State.Set(ctx, state)...)
+
+	createTimeout := r.CreateTimeout(ctx, state.Timeouts)
+	_, err = waitBotCreated(ctx, conn, state.ID.ValueString(), createTimeout)
+	if err != nil {
+		resp.Diagnostics.AddError(
+			create.ProblemStandardMessage(names.LexV2Models, create.ErrActionWaitingForDeletion, ResNameBot, state.ID.String(), err),
+			err.Error(),
+		)
+		return
+	}
+}
+
+func (r *resourceBot) Read(ctx context.Context, req resource.ReadRequest, resp *resource.ReadResponse) {
+	conn := r.Meta().LexV2ModelsClient(ctx)
+	var diags diag.Diagnostics
+	var state resourceBotData
+	resp.Diagnostics.Append(req.State.Get(ctx, &state)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	out, err := FindBotByID(ctx, conn, state.ID.ValueString())
+	if tfresource.NotFound(err) {
+		resp.State.RemoveResource(ctx)
+		return
+	}
+	if err != nil {
+		resp.Diagnostics.AddError(
+			create.ProblemStandardMessage(names.LexV2Models, create.ErrActionSetting, ResNameBot, state.ID.String(), err),
+			err.Error(),
+		)
+		return
+	}
+
+	botArn := arn.ARN{
+		Partition: r.Meta().Partition,
+		Service:   "lex",
+		Region:    r.Meta().Region,
+		AccountID: r.Meta().AccountID,
+		Resource:  fmt.Sprintf("bot/%s", aws.ToString(out.BotId)),
+	}.String()
+	state.ARN = flex.StringValueToFramework(ctx, botArn)
+	state.RoleARN = flex.StringToFrameworkARN(ctx, out.RoleArn, &diags)
+	state.ID = flex.StringToFramework(ctx, out.BotId)
+	state.Name = flex.StringToFramework(ctx, out.BotName)
+	state.Type = flex.StringValueToFramework(ctx, out.BotType)
+	state.Description = flex.StringToFramework(ctx, out.Description)
+	state.IdleSessionTTLInSeconds = flex.Int32ToFramework(ctx, out.IdleSessionTTLInSeconds)
+
+	datap, _ := flattenDataPrivacy(out.DataPrivacy)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	state.DataPrivacy = datap
+	resp.Diagnostics.Append(resp.State.Set(ctx, &state)...)
+}
+
+func (r *resourceBot) Update(ctx context.Context, req resource.UpdateRequest, resp *resource.UpdateResponse) {
+	conn := r.Meta().LexV2ModelsClient(ctx)
+
+	var plan, state resourceBotData
+	resp.Diagnostics.Append(req.Plan.Get(ctx, &plan)...)
+	resp.Diagnostics.Append(req.State.Get(ctx, &state)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	if !plan.Description.Equal(state.Description) ||
+		!plan.IdleSessionTTLInSeconds.Equal(state.IdleSessionTTLInSeconds) ||
+		!plan.RoleARN.Equal(state.RoleARN) ||
+		!plan.TestBotAliasTags.Equal(state.TestBotAliasTags) ||
+		!plan.DataPrivacy.Equal(state.DataPrivacy) ||
+		!plan.Type.Equal(state.Type) {
+		var dp []dataPrivacyData
+		resp.Diagnostics.Append(plan.DataPrivacy.ElementsAs(ctx, &dp, false)...)
+		if resp.Diagnostics.HasError() {
+			return
+		}
+
+		dpInput := expandDataPrivacy(ctx, dp)
+
+		in := lexmodelsv2.UpdateBotInput{
+			BotId:                   flex.StringFromFramework(ctx, plan.ID),
+			BotName:                 flex.StringFromFramework(ctx, plan.Name),
+			IdleSessionTTLInSeconds: aws.Int32(int32(plan.IdleSessionTTLInSeconds.ValueInt64())),
+			DataPrivacy:             dpInput,
+			RoleArn:                 flex.StringFromFramework(ctx, plan.RoleARN),
+		}
+
+		if !plan.Description.IsNull() {
+			in.Description = aws.String(plan.Description.ValueString())
+		}
+
+		if !plan.Members.IsNull() {
+			var tfList []membersData
+			resp.Diagnostics.Append(plan.Members.ElementsAs(ctx, &tfList, false)...)
+			if resp.Diagnostics.HasError() {
+				return
+			}
+		}
+
+		_, err := conn.UpdateBot(ctx, &in)
+		if err != nil {
+			resp.Diagnostics.AddError(
+				create.ProblemStandardMessage(names.LexV2Models, create.ErrActionUpdating, ResNameBot, plan.ID.String(), err),
+				err.Error(),
+			)
+			return
+		}
+		updateTimeout := r.UpdateTimeout(ctx, plan.Timeouts)
+		out, err := waitBotUpdated(ctx, conn, plan.ID.ValueString(), updateTimeout)
+		if err != nil {
+			resp.Diagnostics.AddError(
+				create.ProblemStandardMessage(names.LexV2Models, create.ErrActionWaitingForUpdate, ResNameBot, plan.ID.String(), err),
+				err.Error(),
+			)
+			return
+		}
+
+		if out == nil || out.BotId == nil {
+			resp.Diagnostics.AddError(
+				create.ProblemStandardMessage(names.LexV2Models, create.ErrActionUpdating, ResNameBot, plan.ID.String(), nil),
+				errors.New("empty output").Error(),
+			)
+			return
+		}
+		resp.Diagnostics.Append(plan.refreshFromOutput(ctx, out)...)
+	}
+
+	resp.Diagnostics.Append(resp.State.Set(ctx, &plan)...)
+}
+
+func (r *resourceBot) Delete(ctx context.Context, req resource.DeleteRequest, resp *resource.DeleteResponse) {
+	conn := r.Meta().LexV2ModelsClient(ctx)
+
+	var state resourceBotData
+	resp.Diagnostics.Append(req.State.Get(ctx, &state)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	in := &lexmodelsv2.DeleteBotInput{
+		BotId: aws.String(state.ID.ValueString()),
+	}
+
+	_, err := conn.DeleteBot(ctx, in)
+	if err != nil {
+		var nfe *awstypes.ResourceNotFoundException
+		if errors.As(err, &nfe) {
+			return
+		}
+		resp.Diagnostics.AddError(
+			create.ProblemStandardMessage(names.LexV2Models, create.ErrActionDeleting, ResNameBot, state.ID.String(), err),
+			err.Error(),
+		)
+		return
+	}
+
+	deleteTimeout := r.DeleteTimeout(ctx, state.Timeouts)
+	_, err = waitBotDeleted(ctx, conn, state.ID.ValueString(), deleteTimeout)
+	if err != nil {
+		resp.Diagnostics.AddError(
+			create.ProblemStandardMessage(names.LexV2Models, create.ErrActionWaitingForDeletion, ResNameBot, state.ID.String(), err),
+			err.Error(),
+		)
+		return
+	}
+}
+
+func (r *resourceBot) ModifyPlan(ctx context.Context, req resource.ModifyPlanRequest, resp *resource.ModifyPlanResponse) {
+	r.SetTagsAll(ctx, req, resp)
+}
+
+func (r *resourceBot) ImportState(ctx context.Context, req resource.ImportStateRequest, resp *resource.ImportStateResponse) {
+	resource.ImportStatePassthroughID(ctx, path.Root("id"), req, resp)
+}
+
+func waitBotCreated(ctx context.Context, conn *lexmodelsv2.Client, id string, timeout time.Duration) (*lexmodelsv2.DescribeBotOutput, error) {
+	stateConf := &retry.StateChangeConf{
+		Pending:                   enum.Slice(awstypes.BotStatusCreating),
+		Target:                    enum.Slice(awstypes.BotStatusAvailable),
+		Refresh:                   statusBot(ctx, conn, id),
+		Timeout:                   timeout,
+		NotFoundChecks:            20,
+		ContinuousTargetOccurence: 2,
+	}
+
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+	if out, ok := outputRaw.(*lexmodelsv2.DescribeBotOutput); ok {
+		return out, err
+	}
+
+	return nil, err
+}
+
+func waitBotUpdated(ctx context.Context, conn *lexmodelsv2.Client, id string, timeout time.Duration) (*lexmodelsv2.DescribeBotOutput, error) {
+	stateConf := &retry.StateChangeConf{
+		Pending:                   enum.Slice(awstypes.BotStatusUpdating),
+		Target:                    enum.Slice(awstypes.BotStatusAvailable),
+		Refresh:                   statusBot(ctx, conn, id),
+		Timeout:                   timeout,
+		NotFoundChecks:            20,
+		ContinuousTargetOccurence: 2,
+	}
+
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+	if out, ok := outputRaw.(*lexmodelsv2.DescribeBotOutput); ok {
+		return out, err
+	}
+
+	return nil, err
+}
+
+func waitBotDeleted(ctx context.Context, conn *lexmodelsv2.Client, id string, timeout time.Duration) (*lexmodelsv2.DescribeBotOutput, error) {
+	stateConf := &retry.StateChangeConf{
+		Pending: enum.Slice(awstypes.BotStatusDeleting),
+		Target:  []string{},
+		Refresh: statusBot(ctx, conn, id),
+		Timeout: timeout,
+	}
+
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+	if out, ok := outputRaw.(*lexmodelsv2.DescribeBotOutput); ok {
+		return out, err
+	}
+
+	return nil, err
+}
+
+func statusBot(ctx context.Context, conn *lexmodelsv2.Client, id string) retry.StateRefreshFunc {
+	return func() (interface{}, string, error) {
+		out, err := FindBotByID(ctx, conn, id)
+		if tfresource.NotFound(err) {
+			return nil, "", nil
+		}
+
+		if err != nil {
+			return nil, "", err
+		}
+
+		return out, aws.ToString((*string)(&out.BotStatus)), nil
+	}
+}
+
+func FindBotByID(ctx context.Context, conn *lexmodelsv2.Client, id string) (*lexmodelsv2.DescribeBotOutput, error) {
+	in := &lexmodelsv2.DescribeBotInput{
+		BotId: aws.String(id),
+	}
+
+	out, err := conn.DescribeBot(ctx, in)
+	if err != nil {
+		var nfe *awstypes.ResourceNotFoundException
+		if errors.As(err, &nfe) {
+			return nil, &retry.NotFoundError{
+				LastError:   err,
+				LastRequest: in,
+			}
+		}
+
+		return nil, err
+	}
+
+	if out == nil || out.BotId == nil {
+		return nil, tfresource.NewEmptyResultError(in)
+	}
+
+	return out, nil
+}
+
+func flattenDataPrivacy(apiObject *awstypes.DataPrivacy) (types.List, diag.Diagnostics) {
+	var diags diag.Diagnostics
+	elemType := types.ObjectType{AttrTypes: dataPrivacyAttrTypes}
+
+	if apiObject == nil {
+		return types.ListValueMust(elemType, []attr.Value{}), diags
+	}
+
+	obj := map[string]attr.Value{
+		"child_directed": types.BoolValue(aws.ToBool(&apiObject.ChildDirected)),
+	}
+	objVal, d := types.ObjectValue(dataPrivacyAttrTypes, obj)
+	diags.Append(d...)
+
+	listVal, d := types.ListValue(elemType, []attr.Value{objVal})
+	diags.Append(d...)
+
+	return listVal, diags
+}
+
+func expandDataPrivacy(ctx context.Context, tfList []dataPrivacyData) *awstypes.DataPrivacy {
+	if len(tfList) == 0 {
+		return nil
+	}
+
+	dp := tfList[0]
+	cdBool := flex.BoolFromFramework(ctx, dp.ChildDirected)
+
+	return &awstypes.DataPrivacy{
+		ChildDirected: aws.ToBool(cdBool),
+	}
+}
+
+func expandMembers(ctx context.Context, tfList []membersData) []awstypes.BotMember {
+	if len(tfList) == 0 {
+		return nil
+	}
+	var mb []awstypes.BotMember
+
+	for _, item := range tfList {
+		new := awstypes.BotMember{
+			BotMemberAliasId:   flex.StringFromFramework(ctx, item.AliasID),
+			BotMemberAliasName: flex.StringFromFramework(ctx, item.AliasName),
+			BotMemberId:        flex.StringFromFramework(ctx, item.ID),
+			BotMemberName:      flex.StringFromFramework(ctx, item.Name),
+			BotMemberVersion:   flex.StringFromFramework(ctx, item.Version),
+		}
+		mb = append(mb, new)
+	}
+
+	return mb
+}
+
+func (rd *resourceBotData) refreshFromOutput(ctx context.Context, out *lexmodelsv2.DescribeBotOutput) diag.Diagnostics {
+	var diags diag.Diagnostics
+
+	if out == nil {
+		return diags
+	}
+	rd.RoleARN = flex.StringToFrameworkARN(ctx, out.RoleArn, &diags)
+	rd.ID = flex.StringToFramework(ctx, out.BotId)
+	rd.Name = flex.StringToFramework(ctx, out.BotName)
+	rd.Type = flex.StringToFramework(ctx, (*string)(&out.BotType))
+	rd.Description = flex.StringToFramework(ctx, out.Description)
+	rd.IdleSessionTTLInSeconds = flex.Int32ToFramework(ctx, out.IdleSessionTTLInSeconds)
+
+	datap, d := flattenDataPrivacy(out.DataPrivacy)
+	diags.Append(d...)
+	rd.DataPrivacy = datap
+
+	return diags
+}
+
+type resourceBotData struct {
+	ARN                     types.String   `tfsdk:"arn"`
+	DataPrivacy             types.List     `tfsdk:"data_privacy"`
+	Description             types.String   `tfsdk:"description"`
+	ID                      types.String   `tfsdk:"id"`
+	IdleSessionTTLInSeconds types.Int64    `tfsdk:"idle_session_ttl_in_seconds"`
+	Name                    types.String   `tfsdk:"name"`
+	Members                 types.List     `tfsdk:"members"`
+	RoleARN                 fwtypes.ARN    `tfsdk:"role_arn"`
+	Tags                    types.Map      `tfsdk:"tags"`
+	TagsAll                 types.Map      `tfsdk:"tags_all"`
+	TestBotAliasTags        types.Map      `tfsdk:"test_bot_alias_tags"`
+	Timeouts                timeouts.Value `tfsdk:"timeouts"`
+	Type                    types.String   `tfsdk:"type"`
+}
+
+type dataPrivacyData struct {
+	ChildDirected types.Bool `tfsdk:"child_directed"`
+}
+
+type membersData struct {
+	AliasID   types.String `tfsdk:"alias_id"`
+	AliasName types.String `tfsdk:"alias_name"`
+	ID        types.String `tfsdk:"id"`
+	Name      types.String `tfsdk:"name"`
+	Version   types.String `tfsdk:"version"`
+}
+
+var dataPrivacyAttrTypes = map[string]attr.Type{
+	"child_directed": types.BoolType,
+}
diff --git a/internal/service/lexv2models/bot_test.go b/internal/service/lexv2models/bot_test.go
new file mode 100644
index 00000000000..1e6d826b836
--- /dev/null
+++ b/internal/service/lexv2models/bot_test.go
@@ -0,0 +1,288 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package lexv2models_test
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"testing"
+
+	"github.com/aws/aws-sdk-go-v2/service/lexmodelsv2"
+	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
+	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/create"
+	tflexv2models "github.com/hashicorp/terraform-provider-aws/internal/service/lexv2models"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/names"
+)
+
+func TestAccLexV2ModelsBot_basic(t *testing.T) {
+	ctx := acctest.Context(t)
+
+	var bot lexmodelsv2.DescribeBotOutput
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_lexv2models_bot.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, names.LexV2ModelsEndpointID)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, names.LexV2ModelsEndpointID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckBotDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccBotConfig_basic(rName, 60, true),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckBotExists(ctx, resourceName, &bot),
+					resource.TestCheckResourceAttr(resourceName, "name", rName),
+					resource.TestCheckResourceAttr(resourceName, "idle_session_ttl_in_seconds", "60"),
+					resource.TestCheckResourceAttrSet(resourceName, "role_arn"),
+					resource.TestCheckResourceAttrSet(resourceName, "data_privacy.0.child_directed"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
+func TestAccLexV2ModelsBot_tags(t *testing.T) {
+	ctx := acctest.Context(t)
+	var bot lexmodelsv2.DescribeBotOutput
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_lexv2models_bot.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, names.LexV2ModelsEndpointID)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, names.LexV2ModelsEndpointID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckBotDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccBotConfig_tags1(rName, 60, true, "key1", "value1"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckBotExists(ctx, resourceName, &bot),
+					resource.TestCheckResourceAttr(resourceName, "name", rName),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				Config: testAccBotConfig_tags2(rName, 60, true, "key1", "value1updated", "key2", "value2"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckBotExists(ctx, resourceName, &bot),
+					resource.TestCheckResourceAttr(resourceName, "name", rName),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1updated"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
+				),
+			},
+			{
+				Config: testAccBotConfig_tags1(rName, 60, true, "key2", "value2"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckBotExists(ctx, resourceName, &bot),
+					resource.TestCheckResourceAttr(resourceName, "name", rName),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccLexV2ModelsBot_disappears(t *testing.T) {
+	ctx := acctest.Context(t)
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
+	var bot lexmodelsv2.DescribeBotOutput
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_lexv2models_bot.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, names.LexV2ModelsEndpointID)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, names.LexV2ModelsEndpointID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckBotDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccBotConfig_basic(rName, 60, true),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckBotExists(ctx, resourceName, &bot),
+					acctest.CheckFrameworkResourceDisappears(ctx, acctest.Provider, tflexv2models.ResourceBot, resourceName),
+				),
+				ExpectNonEmptyPlan: true,
+			},
+		},
+	})
+}
+
+func testAccCheckBotDestroy(ctx context.Context) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		conn := acctest.Provider.Meta().(*conns.AWSClient).LexV2ModelsClient(ctx)
+
+		for _, rs := range s.RootModule().Resources {
+			if rs.Type != "aws_lexv2models_bot" {
+				continue
+			}
+
+			_, err := tflexv2models.FindBotByID(ctx, conn, rs.Primary.ID)
+			if tfresource.NotFound(err) {
+				continue
+			}
+
+			if err != nil {
+				return err
+			}
+
+			return create.Error(names.LexV2Models, create.ErrActionCheckingDestroyed, tflexv2models.ResNameBot, rs.Primary.ID, errors.New("not destroyed"))
+		}
+
+		return nil
+	}
+}
+
+func testAccCheckBotExists(ctx context.Context, name string, bot *lexmodelsv2.DescribeBotOutput) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[name]
+		if !ok {
+			return create.Error(names.LexV2Models, create.ErrActionCheckingExistence, tflexv2models.ResNameBot, name, errors.New("not found"))
+		}
+
+		if rs.Primary.ID == "" {
+			return create.Error(names.LexV2Models, create.ErrActionCheckingExistence, tflexv2models.ResNameBot, name, errors.New("not set"))
+		}
+
+		conn := acctest.Provider.Meta().(*conns.AWSClient).LexV2ModelsClient(ctx)
+		resp, err := tflexv2models.FindBotByID(ctx, conn, rs.Primary.ID)
+		if err != nil {
+			return create.Error(names.LexV2Models, create.ErrActionCheckingExistence, tflexv2models.ResNameBot, rs.Primary.ID, err)
+		}
+
+		*bot = *resp
+
+		return nil
+	}
+}
+
+func testAccPreCheck(ctx context.Context, t *testing.T) {
+	conn := acctest.Provider.Meta().(*conns.AWSClient).LexV2ModelsClient(ctx)
+
+	input := &lexmodelsv2.ListBotsInput{}
+	_, err := conn.ListBots(ctx, input)
+
+	if acctest.PreCheckSkipError(err) {
+		t.Skipf("skipping acceptance testing: %s", err)
+	}
+	if err != nil {
+		t.Fatalf("unexpected PreCheck error: %s", err)
+	}
+}
+
+func testAccBotBaseConfig(rName string) string {
+	return fmt.Sprintf(`
+data "aws_partition" "current" {}
+
+resource "aws_iam_role" "test_role" {
+  name = %[1]q
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Action = "sts:AssumeRole"
+        Effect = "Allow"
+        Sid    = ""
+        Principal = {
+          Service = "lexv2.amazonaws.com"
+        }
+      },
+    ]
+  })
+}
+
+resource "aws_iam_role_policy_attachment" "test-attach" {
+  role       = aws_iam_role.test_role.name
+  policy_arn = "arn:${data.aws_partition.current.partition}:iam::aws:policy/AmazonLexFullAccess"
+}
+`, rName)
+}
+
+func testAccBotConfig_basic(rName string, ttl int, dp bool) string {
+	return acctest.ConfigCompose(
+		testAccBotBaseConfig(rName),
+		fmt.Sprintf(`
+resource "aws_lexv2models_bot" "test" {
+  name                        = %[1]q
+  idle_session_ttl_in_seconds = %[2]d
+  role_arn                    = aws_iam_role.test_role.arn
+
+  data_privacy {
+    child_directed = "%[3]t"
+  }
+}
+`, rName, ttl, dp))
+}
+
+func testAccBotConfig_tags1(rName string, ttl int, dp bool, tagKey1, tagValue1 string) string {
+	return acctest.ConfigCompose(
+		testAccBotBaseConfig(rName),
+		fmt.Sprintf(`
+resource "aws_lexv2models_bot" "test" {
+  name                        = %[1]q
+  idle_session_ttl_in_seconds = %[2]d
+  role_arn                    = aws_iam_role.test_role.arn
+
+  data_privacy {
+    child_directed = %[3]t
+  }
+
+  tags = {
+    %[4]q = %[5]q
+  }
+}
+`, rName, ttl, dp, tagKey1, tagValue1))
+}
+
+func testAccBotConfig_tags2(rName string, ttl int, dp bool, tagKey1, tagValue1, tagKey2, tagValue2 string) string {
+	return acctest.ConfigCompose(
+		testAccBotBaseConfig(rName),
+		fmt.Sprintf(`
+resource "aws_lexv2models_bot" "test" {
+  name                        = %[1]q
+  idle_session_ttl_in_seconds = %[2]d
+  role_arn                    = aws_iam_role.test_role.arn
+
+  data_privacy {
+    child_directed = %[3]t
+  }
+
+  tags = {
+    %[4]q = %[5]q
+    %[6]q = %[7]q
+  }
+}
+`, rName, ttl, dp, tagKey1, tagValue1, tagKey2, tagValue2))
+}
diff --git a/internal/service/lexv2models/exports_test.go b/internal/service/lexv2models/exports_test.go
new file mode 100644
index 00000000000..2b3035db1b7
--- /dev/null
+++ b/internal/service/lexv2models/exports_test.go
@@ -0,0 +1,9 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package lexv2models
+
+// Exports for use in tests only.
+var (
+	ResourceBot = newResourceBot
+)
diff --git a/internal/service/lexv2models/generate.go b/internal/service/lexv2models/generate.go
new file mode 100644
index 00000000000..2821de4eb57
--- /dev/null
+++ b/internal/service/lexv2models/generate.go
@@ -0,0 +1,8 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+//go:generate go run ../../generate/tags/main.go -AWSSDKVersion=2 -ServiceTagsMap -KVTValues -SkipTypesImp -TagInIDElem=ResourceARN -ListTagsInIDElem=ResourceARN -ListTags -UpdateTags
+//go:generate go run ../../generate/servicepackage/main.go
+// ONLY generate directives and package declaration! Do not add anything else to this file.
+
+package lexv2models
diff --git a/internal/service/lexv2models/service_package_gen.go b/internal/service/lexv2models/service_package_gen.go
new file mode 100644
index 00000000000..55ef56c5226
--- /dev/null
+++ b/internal/service/lexv2models/service_package_gen.go
@@ -0,0 +1,58 @@
+// Code generated by internal/generate/servicepackages/main.go; DO NOT EDIT.
+
+package lexv2models
+
+import (
+	"context"
+
+	aws_sdkv2 "github.com/aws/aws-sdk-go-v2/aws"
+	lexmodelsv2_sdkv2 "github.com/aws/aws-sdk-go-v2/service/lexmodelsv2"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/types"
+	"github.com/hashicorp/terraform-provider-aws/names"
+)
+
+type servicePackage struct{}
+
+func (p *servicePackage) FrameworkDataSources(ctx context.Context) []*types.ServicePackageFrameworkDataSource {
+	return []*types.ServicePackageFrameworkDataSource{}
+}
+
+func (p *servicePackage) FrameworkResources(ctx context.Context) []*types.ServicePackageFrameworkResource {
+	return []*types.ServicePackageFrameworkResource{
+		{
+			Factory: newResourceBot,
+			Name:    "Bot",
+			Tags: &types.ServicePackageResourceTags{
+				IdentifierAttribute: "arn",
+			},
+		},
+	}
+}
+
+func (p *servicePackage) SDKDataSources(ctx context.Context) []*types.ServicePackageSDKDataSource {
+	return []*types.ServicePackageSDKDataSource{}
+}
+
+func (p *servicePackage) SDKResources(ctx context.Context) []*types.ServicePackageSDKResource {
+	return []*types.ServicePackageSDKResource{}
+}
+
+func (p *servicePackage) ServicePackageName() string {
+	return names.LexV2Models
+}
+
+// NewClient returns a new AWS SDK for Go v2 client for this service package's AWS API.
+func (p *servicePackage) NewClient(ctx context.Context, config map[string]any) (*lexmodelsv2_sdkv2.Client, error) {
+	cfg := *(config["aws_sdkv2_config"].(*aws_sdkv2.Config))
+
+	return lexmodelsv2_sdkv2.NewFromConfig(cfg, func(o *lexmodelsv2_sdkv2.Options) {
+		if endpoint := config["endpoint"].(string); endpoint != "" {
+			o.BaseEndpoint = aws_sdkv2.String(endpoint)
+		}
+	}), nil
+}
+
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/lexv2models/tags_gen.go b/internal/service/lexv2models/tags_gen.go
new file mode 100644
index 00000000000..2fff1cbe092
--- /dev/null
+++ b/internal/service/lexv2models/tags_gen.go
@@ -0,0 +1,128 @@
+// Code generated by internal/generate/tags/main.go; DO NOT EDIT.
+package lexv2models
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/lexmodelsv2"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
+	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
+	"github.com/hashicorp/terraform-provider-aws/internal/types"
+	"github.com/hashicorp/terraform-provider-aws/names"
+)
+
+// listTags lists lexv2models service tags.
+// The identifier is typically the Amazon Resource Name (ARN), although
+// it may also be a different identifier depending on the service.
+func listTags(ctx context.Context, conn *lexmodelsv2.Client, identifier string) (tftags.KeyValueTags, error) {
+	input := &lexmodelsv2.ListTagsForResourceInput{
+		ResourceARN: aws.String(identifier),
+	}
+
+	output, err := conn.ListTagsForResource(ctx, input)
+
+	if err != nil {
+		return tftags.New(ctx, nil), err
+	}
+
+	return KeyValueTags(ctx, output.Tags), nil
+}
+
+// ListTags lists lexv2models service tags and set them in Context.
+// It is called from outside this package.
+func (p *servicePackage) ListTags(ctx context.Context, meta any, identifier string) error {
+	tags, err := listTags(ctx, meta.(*conns.AWSClient).LexV2ModelsClient(ctx), identifier)
+
+	if err != nil {
+		return err
+	}
+
+	if inContext, ok := tftags.FromContext(ctx); ok {
+		inContext.TagsOut = types.Some(tags)
+	}
+
+	return nil
+}
+
+// map[string]string handling
+
+// Tags returns lexv2models service tags.
+func Tags(tags tftags.KeyValueTags) map[string]string {
+	return tags.Map()
+}
+
+// KeyValueTags creates tftags.KeyValueTags from lexv2models service tags.
+func KeyValueTags(ctx context.Context, tags map[string]string) tftags.KeyValueTags {
+	return tftags.New(ctx, tags)
+}
+
+// getTagsIn returns lexv2models service tags from Context.
+// nil is returned if there are no input tags.
+func getTagsIn(ctx context.Context) map[string]string {
+	if inContext, ok := tftags.FromContext(ctx); ok {
+		if tags := Tags(inContext.TagsIn.UnwrapOrDefault()); len(tags) > 0 {
+			return tags
+		}
+	}
+
+	return nil
+}
+
+// setTagsOut sets lexv2models service tags in Context.
+func setTagsOut(ctx context.Context, tags map[string]string) {
+	if inContext, ok := tftags.FromContext(ctx); ok {
+		inContext.TagsOut = types.Some(KeyValueTags(ctx, tags))
+	}
+}
+
+// updateTags updates lexv2models service tags.
+// The identifier is typically the Amazon Resource Name (ARN), although
+// it may also be a different identifier depending on the service.
+func updateTags(ctx context.Context, conn *lexmodelsv2.Client, identifier string, oldTagsMap, newTagsMap any) error {
+	oldTags := tftags.New(ctx, oldTagsMap)
+	newTags := tftags.New(ctx, newTagsMap)
+
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
+	removedTags := oldTags.Removed(newTags)
+	removedTags = removedTags.IgnoreSystem(names.LexV2Models)
+	if len(removedTags) > 0 {
+		input := &lexmodelsv2.UntagResourceInput{
+			ResourceARN: aws.String(identifier),
+			TagKeys:     removedTags.Keys(),
+		}
+
+		_, err := conn.UntagResource(ctx, input)
+
+		if err != nil {
+			return fmt.Errorf("untagging resource (%s): %w", identifier, err)
+		}
+	}
+
+	updatedTags := oldTags.Updated(newTags)
+	updatedTags = updatedTags.IgnoreSystem(names.LexV2Models)
+	if len(updatedTags) > 0 {
+		input := &lexmodelsv2.TagResourceInput{
+			ResourceARN: aws.String(identifier),
+			Tags:        Tags(updatedTags),
+		}
+
+		_, err := conn.TagResource(ctx, input)
+
+		if err != nil {
+			return fmt.Errorf("tagging resource (%s): %w", identifier, err)
+		}
+	}
+
+	return nil
+}
+
+// UpdateTags updates lexv2models service tags.
+// It is called from outside this package.
+func (p *servicePackage) UpdateTags(ctx context.Context, meta any, identifier string, oldTags, newTags any) error {
+	return updateTags(ctx, meta.(*conns.AWSClient).LexV2ModelsClient(ctx), identifier, oldTags, newTags)
+}
diff --git a/internal/service/licensemanager/association.go b/internal/service/licensemanager/association.go
index 8de3f20fe36..e5055554139 100644
--- a/internal/service/licensemanager/association.go
+++ b/internal/service/licensemanager/association.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package licensemanager
 
 import (
diff --git a/internal/service/licensemanager/association_test.go b/internal/service/licensemanager/association_test.go
index d27d21ee2b5..9b967c54e23 100644
--- a/internal/service/licensemanager/association_test.go
+++ b/internal/service/licensemanager/association_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package licensemanager_test
 
 import (
diff --git a/internal/service/licensemanager/common_schema_data_source.go b/internal/service/licensemanager/common_schema_data_source.go
index db66c9cc0a8..166e955cefd 100644
--- a/internal/service/licensemanager/common_schema_data_source.go
+++ b/internal/service/licensemanager/common_schema_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package licensemanager
 
 import (
diff --git a/internal/service/licensemanager/generate.go b/internal/service/licensemanager/generate.go
index d8ebd892efd..1e6ae59c38c 100644
--- a/internal/service/licensemanager/generate.go
+++ b/internal/service/licensemanager/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ServiceTagsSlice -UpdateTags
 //go:generate go run ../../generate/listpages/main.go -ListOps=ListLicenseConfigurations,ListLicenseSpecificationsForResource,ListReceivedLicenses,ListDistributedGrants
 //go:generate go run ../../generate/servicepackage/main.go
diff --git a/internal/service/licensemanager/grant.go b/internal/service/licensemanager/grant.go
index bccf331ae24..06c5cba7d1e 100644
--- a/internal/service/licensemanager/grant.go
+++ b/internal/service/licensemanager/grant.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package licensemanager
 
 import (
diff --git a/internal/service/licensemanager/grant_accepter.go b/internal/service/licensemanager/grant_accepter.go
index 7434374f22d..0a03785a376 100644
--- a/internal/service/licensemanager/grant_accepter.go
+++ b/internal/service/licensemanager/grant_accepter.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package licensemanager
 
 import (
diff --git a/internal/service/licensemanager/grant_accepter_test.go b/internal/service/licensemanager/grant_accepter_test.go
index 4ac911e6b42..4a61989fa7e 100644
--- a/internal/service/licensemanager/grant_accepter_test.go
+++ b/internal/service/licensemanager/grant_accepter_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package licensemanager_test
 
 import (
diff --git a/internal/service/licensemanager/grant_test.go b/internal/service/licensemanager/grant_test.go
index 879b3ccbe27..e2054f40a7c 100644
--- a/internal/service/licensemanager/grant_test.go
+++ b/internal/service/licensemanager/grant_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package licensemanager_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/licensemanager"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -69,7 +72,7 @@ func testAccGrant_basic(t *testing.T) {
 				Config: testAccGrantConfig_basic(licenseARN, rName, principal, homeRegion),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckGrantExists(ctx, resourceName),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "license-manager", regexp.MustCompile(`grant:g-.+`)),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "license-manager", regexache.MustCompile(`grant:g-.+`)),
 					resource.TestCheckTypeSetElemAttr(resourceName, "allowed_operations.*", "ListPurchasedLicenses"),
 					resource.TestCheckTypeSetElemAttr(resourceName, "allowed_operations.*", "CheckoutLicense"),
 					resource.TestCheckTypeSetElemAttr(resourceName, "allowed_operations.*", "CheckInLicense"),
diff --git a/internal/service/licensemanager/license_configuration.go b/internal/service/licensemanager/license_configuration.go
index 9d2a7fd4a69..01e9fd19ec6 100644
--- a/internal/service/licensemanager/license_configuration.go
+++ b/internal/service/licensemanager/license_configuration.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package licensemanager
 
 import (
 	"context"
 	"log"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/licensemanager"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -63,7 +66,7 @@ func ResourceLicenseConfiguration() *schema.Resource {
 				ForceNew: true,
 				Elem: &schema.Schema{
 					Type:         schema.TypeString,
-					ValidateFunc: validation.StringMatch(regexp.MustCompile("^#([^=]+)=(.+)$"), "Expected format is #RuleType=RuleValue"),
+					ValidateFunc: validation.StringMatch(regexache.MustCompile("^#([^=]+)=(.+)$"), "Expected format is #RuleType=RuleValue"),
 				},
 			},
 			"name": {
@@ -108,14 +111,13 @@ func resourceLicenseConfigurationCreate(ctx context.Context, d *schema.ResourceD
 		input.LicenseRules = flex.ExpandStringList(v.([]interface{}))
 	}
 
-	log.Printf("[DEBUG] Creating License Manager License Configuration: %s", input)
-	resp, err := conn.CreateLicenseConfigurationWithContext(ctx, input)
+	output, err := conn.CreateLicenseConfigurationWithContext(ctx, input)
 
 	if err != nil {
 		return diag.Errorf("creating License Manager License Configuration (%s): %s", name, err)
 	}
 
-	d.SetId(aws.StringValue(resp.LicenseConfigurationArn))
+	d.SetId(aws.StringValue(output.LicenseConfigurationArn))
 
 	return resourceLicenseConfigurationRead(ctx, d, meta)
 }
@@ -164,7 +166,6 @@ func resourceLicenseConfigurationUpdate(ctx context.Context, d *schema.ResourceD
 			input.LicenseCount = aws.Int64(int64(v.(int)))
 		}
 
-		log.Printf("[DEBUG] Updating License Manager License Configuration: %s", input)
 		_, err := conn.UpdateLicenseConfigurationWithContext(ctx, input)
 
 		if err != nil {
@@ -183,7 +184,7 @@ func resourceLicenseConfigurationDelete(ctx context.Context, d *schema.ResourceD
 		LicenseConfigurationArn: aws.String(d.Id()),
 	})
 
-	if tfawserr.ErrCodeEquals(err, licensemanager.ErrCodeInvalidParameterValueException) {
+	if tfawserr.ErrMessageContains(err, licensemanager.ErrCodeInvalidParameterValueException, "Invalid license configuration ARN") {
 		return nil
 	}
 
@@ -201,7 +202,7 @@ func FindLicenseConfigurationByARN(ctx context.Context, conn *licensemanager.Lic
 
 	output, err := conn.GetLicenseConfigurationWithContext(ctx, input)
 
-	if tfawserr.ErrCodeEquals(err, licensemanager.ErrCodeInvalidParameterValueException) {
+	if tfawserr.ErrMessageContains(err, licensemanager.ErrCodeInvalidParameterValueException, "Invalid license configuration ARN") {
 		return nil, &retry.NotFoundError{
 			LastError:   err,
 			LastRequest: input,
diff --git a/internal/service/licensemanager/license_configuration_test.go b/internal/service/licensemanager/license_configuration_test.go
index 3c840cb53f5..901b9740b3d 100644
--- a/internal/service/licensemanager/license_configuration_test.go
+++ b/internal/service/licensemanager/license_configuration_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package licensemanager_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/licensemanager"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -42,7 +45,7 @@ func TestAccLicenseManagerLicenseConfiguration_basic(t *testing.T) {
 				Config: testAccLicenseConfigurationConfig_basic(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckLicenseConfigurationExists(ctx, resourceName, &licenseConfiguration),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "license-manager", regexp.MustCompile(`license-configuration:lic-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "license-manager", regexache.MustCompile(`license-configuration:lic-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
 					resource.TestCheckResourceAttr(resourceName, "license_count", "0"),
 					resource.TestCheckResourceAttr(resourceName, "license_count_hard_limit", "false"),
@@ -149,7 +152,7 @@ func TestAccLicenseManagerLicenseConfiguration_update(t *testing.T) {
 				Config: testAccLicenseConfigurationConfig_allAttributes(rName1),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckLicenseConfigurationExists(ctx, resourceName, &licenseConfiguration),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "license-manager", regexp.MustCompile(`license-configuration:lic-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "license-manager", regexache.MustCompile(`license-configuration:lic-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "description", "test1"),
 					resource.TestCheckResourceAttr(resourceName, "license_count", "10"),
 					resource.TestCheckResourceAttr(resourceName, "license_count_hard_limit", "true"),
@@ -170,7 +173,7 @@ func TestAccLicenseManagerLicenseConfiguration_update(t *testing.T) {
 				Config: testAccLicenseConfigurationConfig_allAttributesUpdated(rName2),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckLicenseConfigurationExists(ctx, resourceName, &licenseConfiguration),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "license-manager", regexp.MustCompile(`license-configuration:lic-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "license-manager", regexache.MustCompile(`license-configuration:lic-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "description", "test2"),
 					resource.TestCheckResourceAttr(resourceName, "license_count", "99"),
 					resource.TestCheckResourceAttr(resourceName, "license_count_hard_limit", "false"),
diff --git a/internal/service/licensemanager/license_grants_data_source.go b/internal/service/licensemanager/license_grants_data_source.go
index 56cdb3a4b54..920ac421c52 100644
--- a/internal/service/licensemanager/license_grants_data_source.go
+++ b/internal/service/licensemanager/license_grants_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package licensemanager
 
 import (
diff --git a/internal/service/licensemanager/license_grants_data_source_test.go b/internal/service/licensemanager/license_grants_data_source_test.go
index 43db37a9860..6583e0404b5 100644
--- a/internal/service/licensemanager/license_grants_data_source_test.go
+++ b/internal/service/licensemanager/license_grants_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package licensemanager_test
 
 import (
diff --git a/internal/service/licensemanager/received_license_data_source.go b/internal/service/licensemanager/received_license_data_source.go
index 0c72149f42a..e133e684a46 100644
--- a/internal/service/licensemanager/received_license_data_source.go
+++ b/internal/service/licensemanager/received_license_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package licensemanager
 
 import (
diff --git a/internal/service/licensemanager/received_license_data_source_test.go b/internal/service/licensemanager/received_license_data_source_test.go
index 8de3a2faa96..6addf6eb62b 100644
--- a/internal/service/licensemanager/received_license_data_source_test.go
+++ b/internal/service/licensemanager/received_license_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package licensemanager_test
 
 import (
diff --git a/internal/service/licensemanager/received_licenses_data_source.go b/internal/service/licensemanager/received_licenses_data_source.go
index a20c3791d56..f03f65b3b9c 100644
--- a/internal/service/licensemanager/received_licenses_data_source.go
+++ b/internal/service/licensemanager/received_licenses_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package licensemanager
 
 import (
diff --git a/internal/service/licensemanager/received_licenses_data_source_test.go b/internal/service/licensemanager/received_licenses_data_source_test.go
index 2b52c2c709c..5b971e60008 100644
--- a/internal/service/licensemanager/received_licenses_data_source_test.go
+++ b/internal/service/licensemanager/received_licenses_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package licensemanager_test
 
 import (
diff --git a/internal/service/licensemanager/service_package_gen.go b/internal/service/licensemanager/service_package_gen.go
index b5744e60f44..2f102119151 100644
--- a/internal/service/licensemanager/service_package_gen.go
+++ b/internal/service/licensemanager/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	licensemanager_sdkv1 "github.com/aws/aws-sdk-go/service/licensemanager"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -75,4 +76,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*l
 	return licensemanager_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/licensemanager/sweep.go b/internal/service/licensemanager/sweep.go
index e9ced44e46a..34dafb3c9ab 100644
--- a/internal/service/licensemanager/sweep.go
+++ b/internal/service/licensemanager/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package licensemanager
 
@@ -11,9 +11,10 @@ import (
 	"github.com/aws/aws-sdk-go/service/licensemanager"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_licensemanager_license_configuration", &resource.Sweeper{
 		Name: "aws_licensemanager_license_configuration",
 		F:    sweepLicenseConfigurations,
@@ -22,7 +23,7 @@ func init() {
 
 func sweepLicenseConfigurations(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -46,7 +47,7 @@ func sweepLicenseConfigurations(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping License Manager License Configuration sweep for %s: %s", region, err)
 		return nil
 	}
@@ -55,7 +56,7 @@ func sweepLicenseConfigurations(region string) error {
 		return fmt.Errorf("error listing License Manager License Configurations (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping License Manager License Configurations (%s): %w", region, err)
diff --git a/internal/service/licensemanager/tags_gen.go b/internal/service/licensemanager/tags_gen.go
index 96b627b2cfe..80726944546 100644
--- a/internal/service/licensemanager/tags_gen.go
+++ b/internal/service/licensemanager/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/licensemanager"
 	"github.com/aws/aws-sdk-go/service/licensemanager/licensemanageriface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -69,6 +71,8 @@ func updateTags(ctx context.Context, conn licensemanageriface.LicenseManagerAPI,
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.LicenseManager)
 	if len(removedTags) > 0 {
diff --git a/internal/service/lightsail/bucket.go b/internal/service/lightsail/bucket.go
index a0b5e56c827..170feebfdfc 100644
--- a/internal/service/lightsail/bucket.go
+++ b/internal/service/lightsail/bucket.go
@@ -1,7 +1,11 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lightsail
 
 import (
 	"context"
+	"log"
 	"time"
 
 	"github.com/aws/aws-sdk-go-v2/aws"
@@ -27,6 +31,7 @@ func ResourceBucket() *schema.Resource {
 		ReadWithoutTimeout:   resourceBucketRead,
 		UpdateWithoutTimeout: resourceBucketUpdate,
 		DeleteWithoutTimeout: resourceBucketDelete,
+
 		Importer: &schema.ResourceImporter{
 			StateContext: schema.ImportStatePassthroughContext,
 		},
@@ -40,13 +45,18 @@ func ResourceBucket() *schema.Resource {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
+			"bundle_id": {
+				Type:     schema.TypeString,
+				Required: true,
+			},
 			"created_at": {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
-			"bundle_id": {
-				Type:     schema.TypeString,
-				Required: true,
+			"force_delete": {
+				Type:     schema.TypeBool,
+				Optional: true,
+				Default:  false,
 			},
 			"name": {
 				Type:     schema.TypeString,
@@ -68,6 +78,7 @@ func ResourceBucket() *schema.Resource {
 				Computed: true,
 			},
 		},
+
 		CustomizeDiff: verify.SetTagsDiff,
 	}
 }
@@ -154,8 +165,11 @@ func resourceBucketUpdate(ctx context.Context, d *schema.ResourceData, meta inte
 
 func resourceBucketDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	conn := meta.(*conns.AWSClient).LightsailClient(ctx)
+
+	log.Printf("[DEBUG] Deleting Lightsail Bucket: %s", d.Id())
 	out, err := conn.DeleteBucket(ctx, &lightsail.DeleteBucketInput{
-		BucketName: aws.String(d.Id()),
+		BucketName:  aws.String(d.Id()),
+		ForceDelete: aws.Bool(d.Get("force_delete").(bool)),
 	})
 
 	if err != nil && errs.IsA[*types.NotFoundException](err) {
diff --git a/internal/service/lightsail/bucket_access_key.go b/internal/service/lightsail/bucket_access_key.go
index 9eb31b9456a..e7e35852f8b 100644
--- a/internal/service/lightsail/bucket_access_key.go
+++ b/internal/service/lightsail/bucket_access_key.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lightsail
 
 import (
 	"context"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/lightsail"
 	"github.com/aws/aws-sdk-go-v2/service/lightsail/types"
@@ -43,7 +46,7 @@ func ResourceBucketAccessKey() *schema.Resource {
 				Type:         schema.TypeString,
 				Required:     true,
 				ForceNew:     true,
-				ValidateFunc: validation.StringMatch(regexp.MustCompile(`^[a-z0-9][a-z0-9-]{1,52}[a-z0-9]$`), "Invalid Bucket name. Must match regex: ^[a-z0-9][a-z0-9-]{1,52}[a-z0-9]$"),
+				ValidateFunc: validation.StringMatch(regexache.MustCompile(`^[0-9a-z][0-9a-z-]{1,52}[0-9a-z]$`), "Invalid Bucket name. Must match regex: ^[0-9a-z][0-9a-z-]{1,52}[0-9a-z]$"),
 			},
 			"created_at": {
 				Type:     schema.TypeString,
diff --git a/internal/service/lightsail/bucket_access_key_test.go b/internal/service/lightsail/bucket_access_key_test.go
index 6ee4262aa97..b02198b706f 100644
--- a/internal/service/lightsail/bucket_access_key_test.go
+++ b/internal/service/lightsail/bucket_access_key_test.go
@@ -1,13 +1,16 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lightsail_test
 
 import (
 	"context"
 	"errors"
 	"fmt"
-	"regexp"
 	"strings"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/service/lightsail"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -39,9 +42,9 @@ func TestAccLightsailBucketAccessKey_basic(t *testing.T) {
 				Config: testAccBucketAccessKeyConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketAccessKeyExists(ctx, resourceName),
-					resource.TestMatchResourceAttr(resourceName, "access_key_id", regexp.MustCompile(`((?:ASIA|AKIA|AROA|AIDA)([A-Z0-7]{16}))`)),
+					resource.TestMatchResourceAttr(resourceName, "access_key_id", regexache.MustCompile(`((?:ASIA|AKIA|AROA|AIDA)([0-7A-Z]{16}))`)),
 					resource.TestCheckResourceAttrSet(resourceName, "created_at"),
-					resource.TestMatchResourceAttr(resourceName, "secret_access_key", regexp.MustCompile(`([a-zA-Z0-9+/]{40})`)),
+					resource.TestMatchResourceAttr(resourceName, "secret_access_key", regexache.MustCompile(`([0-9A-Za-z+/]{40})`)),
 					resource.TestCheckResourceAttrSet(resourceName, "status"),
 				),
 			},
diff --git a/internal/service/lightsail/bucket_resource_access.go b/internal/service/lightsail/bucket_resource_access.go
index c067c5dfde9..2e4e3fa5692 100644
--- a/internal/service/lightsail/bucket_resource_access.go
+++ b/internal/service/lightsail/bucket_resource_access.go
@@ -1,9 +1,12 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lightsail
 
 import (
 	"context"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/lightsail"
 	"github.com/aws/aws-sdk-go-v2/service/lightsail/types"
@@ -38,13 +41,13 @@ func ResourceBucketResourceAccess() *schema.Resource {
 				Type:         schema.TypeString,
 				Required:     true,
 				ForceNew:     true,
-				ValidateFunc: validation.StringMatch(regexp.MustCompile(`^[a-z0-9][a-z0-9-]{1,52}[a-z0-9]$`), "Invalid Bucket name. Must match regex: ^[a-z0-9][a-z0-9-]{1,52}[a-z0-9]$"),
+				ValidateFunc: validation.StringMatch(regexache.MustCompile(`^[0-9a-z][0-9a-z-]{1,52}[0-9a-z]$`), "Invalid Bucket name. Must match regex: ^[0-9a-z][0-9a-z-]{1,52}[0-9a-z]$"),
 			},
 			"resource_name": {
 				Type:         schema.TypeString,
 				Required:     true,
 				ForceNew:     true,
-				ValidateFunc: validation.StringMatch(regexp.MustCompile(`\w[\w\-]*\w`), "Invalid resource name. Must match regex: \\w[\\w\\-]*\\w"),
+				ValidateFunc: validation.StringMatch(regexache.MustCompile(`\w[\w\-]*\w`), "Invalid resource name. Must match regex: \\w[\\w\\-]*\\w"),
 			},
 		},
 	}
diff --git a/internal/service/lightsail/bucket_resource_access_test.go b/internal/service/lightsail/bucket_resource_access_test.go
index 7488c736740..b95cf01c88d 100644
--- a/internal/service/lightsail/bucket_resource_access_test.go
+++ b/internal/service/lightsail/bucket_resource_access_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lightsail_test
 
 import (
diff --git a/internal/service/lightsail/bucket_test.go b/internal/service/lightsail/bucket_test.go
index 3f1d7ff6618..971278944f5 100644
--- a/internal/service/lightsail/bucket_test.go
+++ b/internal/service/lightsail/bucket_test.go
@@ -1,13 +1,16 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lightsail_test
 
 import (
 	"context"
 	"errors"
 	"fmt"
-	"regexp"
 	"strings"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/service/lightsail"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -39,7 +42,7 @@ func TestAccLightsailBucket_basic(t *testing.T) {
 				Config: testAccBucketConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "lightsail", regexp.MustCompile(`Bucket/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "lightsail", regexache.MustCompile(`Bucket/.+`)),
 					resource.TestCheckResourceAttrSet(resourceName, "availability_zone"),
 					resource.TestCheckResourceAttr(resourceName, "bundle_id", "small_1_0"),
 					resource.TestCheckResourceAttrSet(resourceName, "created_at"),
@@ -48,12 +51,17 @@ func TestAccLightsailBucket_basic(t *testing.T) {
 					resource.TestCheckResourceAttrSet(resourceName, "support_code"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 					resource.TestCheckResourceAttrSet(resourceName, "url"),
+					resource.TestCheckResourceAttrSet(resourceName, "force_delete"),
+					resource.TestCheckResourceAttr(resourceName, "force_delete", "false"),
 				),
 			},
 			{
 				ResourceName:      resourceName,
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{
+					"force_delete",
+				},
 			},
 		},
 	})
@@ -87,6 +95,9 @@ func TestAccLightsailBucket_BundleId(t *testing.T) {
 				ResourceName:      resourceName,
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{
+					"force_delete",
+				},
 			},
 			{
 				Config: testAccBucketConfig_bundleId(rName, bundle2),
@@ -153,6 +164,9 @@ func TestAccLightsailBucket_tags(t *testing.T) {
 				ResourceName:      resourceName,
 				ImportState:       true,
 				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{
+					"force_delete",
+				},
 			},
 			{
 				Config: testAccBucketConfig_tags2(rName, "key1", "value1updated", "key2", "value2"),
@@ -228,6 +242,40 @@ func testAccCheckBucketDestroy(ctx context.Context) resource.TestCheckFunc {
 	}
 }
 
+func TestAccLightsailBucket_forceDelete(t *testing.T) {
+	ctx := acctest.Context(t)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_lightsail_bucket.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, strings.ToLower(lightsail.ServiceID))
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, strings.ToLower(lightsail.ServiceID)),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckBucketDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccBucketConfig_forceDelete(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckBucketExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "force_delete", "true"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{
+					"force_delete",
+				},
+			},
+		},
+	})
+}
+
 func testAccBucketConfig_basic(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_lightsail_bucket" "test" {
@@ -270,3 +318,13 @@ resource "aws_lightsail_bucket" "test" {
 }
 `, rName, tagKey1, tagValue1, tagKey2, tagValue2)
 }
+
+func testAccBucketConfig_forceDelete(rName string) string {
+	return fmt.Sprintf(`
+resource "aws_lightsail_bucket" "test" {
+  name         = %[1]q
+  bundle_id    = "small_1_0"
+  force_delete = true
+}
+`, rName)
+}
diff --git a/internal/service/lightsail/certificate.go b/internal/service/lightsail/certificate.go
index 7b90f4801b6..9ac0e979186 100644
--- a/internal/service/lightsail/certificate.go
+++ b/internal/service/lightsail/certificate.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lightsail
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/lightsail"
 	"github.com/aws/aws-sdk-go-v2/service/lightsail/types"
@@ -53,7 +56,7 @@ func ResourceCertificate() *schema.Resource {
 				Optional:     true,
 				Computed:     true,
 				ForceNew:     true,
-				ValidateFunc: validation.StringDoesNotMatch(regexp.MustCompile(`\.$`), "cannot end with a period"),
+				ValidateFunc: validation.StringDoesNotMatch(regexache.MustCompile(`\.$`), "cannot end with a period"),
 			},
 			"domain_validation_options": {
 				Type:     schema.TypeSet,
@@ -86,8 +89,8 @@ func ResourceCertificate() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(2, 255),
-					validation.StringMatch(regexp.MustCompile(`^[a-zA-Z]`), "must begin with an alphabetic character"),
-					validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9_\-.]+[^._\-]$`), "must contain only alphanumeric characters, underscores, hyphens, and dots"),
+					validation.StringMatch(regexache.MustCompile(`^[A-Za-z]`), "must begin with an alphabetic character"),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_.-]+[^_.-]$`), "must contain only alphanumeric characters, underscores, hyphens, and dots"),
 				),
 			},
 			"subject_alternative_names": {
@@ -99,7 +102,7 @@ func ResourceCertificate() *schema.Resource {
 					Type: schema.TypeString,
 					ValidateFunc: validation.All(
 						validation.StringLenBetween(1, 253),
-						validation.StringDoesNotMatch(regexp.MustCompile(`\.$`), "cannot end with a period"),
+						validation.StringDoesNotMatch(regexache.MustCompile(`\.$`), "cannot end with a period"),
 					),
 				},
 				Set: schema.HashString,
diff --git a/internal/service/lightsail/certificate_test.go b/internal/service/lightsail/certificate_test.go
index 0e2e52dbdb1..1b523b7be36 100644
--- a/internal/service/lightsail/certificate_test.go
+++ b/internal/service/lightsail/certificate_test.go
@@ -1,14 +1,17 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lightsail_test
 
 import (
 	"context"
 	"errors"
 	"fmt"
-	"regexp"
 	"strings"
 	"testing"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/lightsail"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -42,7 +45,7 @@ func TestAccLightsailCertificate_basic(t *testing.T) {
 				Config: testAccCertificateConfig_basic(rName, domainName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckCertificateExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "lightsail", regexp.MustCompile(`Certificate/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "lightsail", regexache.MustCompile(`Certificate/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "domain_name", domainName),
 					resource.TestCheckResourceAttr(resourceName, "subject_alternative_names.#", "1"),
diff --git a/internal/service/lightsail/consts.go b/internal/service/lightsail/consts.go
index 7caca2ddd77..ce6550e1c24 100644
--- a/internal/service/lightsail/consts.go
+++ b/internal/service/lightsail/consts.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lightsail
 
 const (
diff --git a/internal/service/lightsail/container_service.go b/internal/service/lightsail/container_service.go
index 9af4a7b2f35..7911619c3ad 100644
--- a/internal/service/lightsail/container_service.go
+++ b/internal/service/lightsail/container_service.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lightsail
 
 import (
 	"context"
 	"log"
 	"reflect"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/lightsail"
 	"github.com/aws/aws-sdk-go-v2/service/lightsail/types"
@@ -65,7 +68,7 @@ func ResourceContainerService() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 63),
-					validation.StringMatch(regexp.MustCompile(`^[a-z0-9]{1,2}|[a-z0-9][a-z0-9-]+[a-z0-9]$`), ""),
+					validation.StringMatch(regexache.MustCompile(`^[0-9a-z]{1,2}|[0-9a-z][0-9a-z-]+[0-9a-z]$`), ""),
 				),
 			},
 			"power": {
diff --git a/internal/service/lightsail/container_service_deployment_version.go b/internal/service/lightsail/container_service_deployment_version.go
index 044976d462f..e0fecde1a0a 100644
--- a/internal/service/lightsail/container_service_deployment_version.go
+++ b/internal/service/lightsail/container_service_deployment_version.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lightsail
 
 import (
diff --git a/internal/service/lightsail/container_service_deployment_version_test.go b/internal/service/lightsail/container_service_deployment_version_test.go
index 2cad8ba914e..0727b63127c 100644
--- a/internal/service/lightsail/container_service_deployment_version_test.go
+++ b/internal/service/lightsail/container_service_deployment_version_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lightsail_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"strings"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/service/lightsail"
 	"github.com/aws/aws-sdk-go-v2/service/lightsail/types"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -459,7 +462,7 @@ func TestAccLightsailContainerServiceDeploymentVersion_Container_enableService(t
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccContainerServiceDeploymentVersionConfig_Container_withDisabledService(rName, containerName, true),
-				ExpectError: regexp.MustCompile(`disabled and cannot be deployed to`),
+				ExpectError: regexache.MustCompile(`disabled and cannot be deployed to`),
 			},
 			{
 				Config: testAccContainerServiceDeploymentVersionConfig_Container_withDisabledService(rName, containerName, false),
diff --git a/internal/service/lightsail/container_service_test.go b/internal/service/lightsail/container_service_test.go
index 0c6fa90d962..47dd93cfe0d 100644
--- a/internal/service/lightsail/container_service_test.go
+++ b/internal/service/lightsail/container_service_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lightsail_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"strings"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/service/lightsail"
 	"github.com/aws/aws-sdk-go-v2/service/lightsail/types"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -211,7 +214,7 @@ func TestAccLightsailContainerService_publicDomainNames(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccContainerServiceConfig_publicDomainNames(rName),
-				ExpectError: regexp.MustCompile(`do not exist`),
+				ExpectError: regexache.MustCompile(`do not exist`),
 			},
 		},
 	})
diff --git a/internal/service/lightsail/database.go b/internal/service/lightsail/database.go
index bea18e21ec6..3833a615583 100644
--- a/internal/service/lightsail/database.go
+++ b/internal/service/lightsail/database.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lightsail
 
 import (
 	"context"
 	"log"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/lightsail"
 	"github.com/aws/aws-sdk-go-v2/service/lightsail/types"
@@ -95,7 +98,7 @@ func ResourceDatabase() *schema.Resource {
 				Optional: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(2, 255),
-					validation.StringMatch(regexp.MustCompile(`^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$`), "Must contain from 2 to 255 alphanumeric characters, or hyphens. The first and last character must be a letter or number"),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z][0-9A-Za-z-]+[0-9A-Za-z]$`), "Must contain from 2 to 255 alphanumeric characters, or hyphens. The first and last character must be a letter or number"),
 				),
 			},
 			"master_database_name": {
@@ -104,8 +107,8 @@ func ResourceDatabase() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 64),
-					validation.StringMatch(regexp.MustCompile(`^[A-Za-z]`), "Must begin with a letter"),
-					validation.StringMatch(regexp.MustCompile(`^[0-9A-Za-z_]+$`), "Subsequent characters can be letters, underscores, or digits (0- 9)"),
+					validation.StringMatch(regexache.MustCompile(`^[A-Za-z]`), "Must begin with a letter"),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_]+$`), "Subsequent characters can be letters, underscores, or digits (0- 9)"),
 				),
 			},
 			"master_endpoint_address": {
@@ -122,7 +125,7 @@ func ResourceDatabase() *schema.Resource {
 				Sensitive: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(8, 128),
-					validation.StringMatch(regexp.MustCompile(`^[ -~][^@\/" ]+$`), "The password can include any printable ASCII character except \"/\", \"\"\", or \"@\". It cannot contain spaces."),
+					validation.StringMatch(regexache.MustCompile(`^[ -~][^@\/" ]+$`), "The password can include any printable ASCII character except \"/\", \"\"\", or \"@\". It cannot contain spaces."),
 				),
 			},
 			"master_username": {
@@ -131,8 +134,8 @@ func ResourceDatabase() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 63),
-					validation.StringMatch(regexp.MustCompile(`^[A-Za-z]`), "Must begin with a letter"),
-					validation.StringMatch(regexp.MustCompile(`^[0-9A-Za-z_]+$`), "Subsequent characters can be letters, underscores, or digits (0- 9)"),
+					validation.StringMatch(regexache.MustCompile(`^[A-Za-z]`), "Must begin with a letter"),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_]+$`), "Subsequent characters can be letters, underscores, or digits (0- 9)"),
 				),
 			},
 			"preferred_backup_window": {
@@ -162,7 +165,7 @@ func ResourceDatabase() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(2, 255),
-					validation.StringMatch(regexp.MustCompile(`^[^._\-]+[0-9A-Za-z-]+[^._\-]$`), "Must contain from 2 to 255 alphanumeric characters, or hyphens. The first and last character must be a letter or number"),
+					validation.StringMatch(regexache.MustCompile(`^[^_.-]+[0-9A-Za-z-]+[^_.-]$`), "Must contain from 2 to 255 alphanumeric characters, or hyphens. The first and last character must be a letter or number"),
 				),
 			},
 			"secondary_availability_zone": {
diff --git a/internal/service/lightsail/database_test.go b/internal/service/lightsail/database_test.go
index cd90c731fbb..68a0baa63d0 100644
--- a/internal/service/lightsail/database_test.go
+++ b/internal/service/lightsail/database_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lightsail_test
 
 import (
@@ -5,11 +8,11 @@ import (
 	"errors"
 	"fmt"
 	"log"
-	"regexp"
 	"strings"
 	"testing"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/lightsail"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -96,23 +99,23 @@ func TestAccLightsailDatabase_relationalDatabaseName(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccDatabaseConfig_basic(rNameTooShort),
-				ExpectError: regexp.MustCompile(fmt.Sprintf(`expected length of relational_database_name to be in the range \(2 - 255\), got %s`, rNameTooShort)),
+				ExpectError: regexache.MustCompile(fmt.Sprintf(`expected length of relational_database_name to be in the range \(2 - 255\), got %s`, rNameTooShort)),
 			},
 			{
 				Config:      testAccDatabaseConfig_basic(rNameTooLong),
-				ExpectError: regexp.MustCompile(fmt.Sprintf(`expected length of relational_database_name to be in the range \(2 - 255\), got %s`, rNameTooLong)),
+				ExpectError: regexache.MustCompile(fmt.Sprintf(`expected length of relational_database_name to be in the range \(2 - 255\), got %s`, rNameTooLong)),
 			},
 			{
 				Config:      testAccDatabaseConfig_basic(rNameContainsUnderscore),
-				ExpectError: regexp.MustCompile(`Must contain from 2 to 255 alphanumeric characters, or hyphens. The first and last character must be a letter or number`),
+				ExpectError: regexache.MustCompile(`Must contain from 2 to 255 alphanumeric characters, or hyphens. The first and last character must be a letter or number`),
 			},
 			{
 				Config:      testAccDatabaseConfig_basic(rNameStartingDash),
-				ExpectError: regexp.MustCompile(`Must contain from 2 to 255 alphanumeric characters, or hyphens. The first and last character must be a letter or number`),
+				ExpectError: regexache.MustCompile(`Must contain from 2 to 255 alphanumeric characters, or hyphens. The first and last character must be a letter or number`),
 			},
 			{
 				Config:      testAccDatabaseConfig_basic(rNameEndingDash),
-				ExpectError: regexp.MustCompile(`Must contain from 2 to 255 alphanumeric characters, or hyphens. The first and last character must be a letter or number`),
+				ExpectError: regexache.MustCompile(`Must contain from 2 to 255 alphanumeric characters, or hyphens. The first and last character must be a letter or number`),
 			},
 			{
 				Config: testAccDatabaseConfig_basic(rName),
@@ -159,19 +162,19 @@ func TestAccLightsailDatabase_masterDatabaseName(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccDatabaseConfig_masterDatabaseName(rName, dbNameTooShort),
-				ExpectError: regexp.MustCompile(fmt.Sprintf(`expected length of master_database_name to be in the range \(1 - 64\), got %s`, dbNameTooShort)),
+				ExpectError: regexache.MustCompile(fmt.Sprintf(`expected length of master_database_name to be in the range \(1 - 64\), got %s`, dbNameTooShort)),
 			},
 			{
 				Config:      testAccDatabaseConfig_masterDatabaseName(rName, dbNameTooLong),
-				ExpectError: regexp.MustCompile(fmt.Sprintf(`expected length of master_database_name to be in the range \(1 - 64\), got %s`, dbNameTooLong)),
+				ExpectError: regexache.MustCompile(fmt.Sprintf(`expected length of master_database_name to be in the range \(1 - 64\), got %s`, dbNameTooLong)),
 			},
 			{
 				Config:      testAccDatabaseConfig_masterDatabaseName(rName, dbNameContainsSpaces),
-				ExpectError: regexp.MustCompile(`Subsequent characters can be letters, underscores, or digits \(0- 9\)`),
+				ExpectError: regexache.MustCompile(`Subsequent characters can be letters, underscores, or digits \(0- 9\)`),
 			},
 			{
 				Config:      testAccDatabaseConfig_masterDatabaseName(rName, dbNameContainsStartingDigit),
-				ExpectError: regexp.MustCompile(`Must begin with a letter`),
+				ExpectError: regexache.MustCompile(`Must begin with a letter`),
 			},
 			{
 				Config: testAccDatabaseConfig_masterDatabaseName(rName, dbName),
@@ -226,23 +229,23 @@ func TestAccLightsailDatabase_masterUsername(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccDatabaseConfig_masterUsername(rName, usernameTooShort),
-				ExpectError: regexp.MustCompile(fmt.Sprintf(`expected length of master_username to be in the range \(1 - 63\), got %s`, usernameTooShort)),
+				ExpectError: regexache.MustCompile(fmt.Sprintf(`expected length of master_username to be in the range \(1 - 63\), got %s`, usernameTooShort)),
 			},
 			{
 				Config:      testAccDatabaseConfig_masterUsername(rName, usernameTooLong),
-				ExpectError: regexp.MustCompile(fmt.Sprintf(`expected length of master_username to be in the range \(1 - 63\), got %s`, usernameTooLong)),
+				ExpectError: regexache.MustCompile(fmt.Sprintf(`expected length of master_username to be in the range \(1 - 63\), got %s`, usernameTooLong)),
 			},
 			{
 				Config:      testAccDatabaseConfig_masterUsername(rName, usernameStartingDigit),
-				ExpectError: regexp.MustCompile(`Must begin with a letter`),
+				ExpectError: regexache.MustCompile(`Must begin with a letter`),
 			},
 			{
 				Config:      testAccDatabaseConfig_masterUsername(rName, usernameContainsDash),
-				ExpectError: regexp.MustCompile(`Subsequent characters can be letters, underscores, or digits \(0- 9\)`),
+				ExpectError: regexache.MustCompile(`Subsequent characters can be letters, underscores, or digits \(0- 9\)`),
 			},
 			{
 				Config:      testAccDatabaseConfig_masterUsername(rName, usernameContainsSpecial),
-				ExpectError: regexp.MustCompile(`Subsequent characters can be letters, underscores, or digits \(0- 9\)`),
+				ExpectError: regexache.MustCompile(`Subsequent characters can be letters, underscores, or digits \(0- 9\)`),
 			},
 			{
 				Config: testAccDatabaseConfig_masterUsername(rName, username),
@@ -296,27 +299,27 @@ func TestAccLightsailDatabase_masterPassword(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccDatabaseConfig_masterPassword(rName, passwordTooShort),
-				ExpectError: regexp.MustCompile(fmt.Sprintf(`expected length of master_password to be in the range \(8 - 128\), got %s`, passwordTooShort)),
+				ExpectError: regexache.MustCompile(fmt.Sprintf(`expected length of master_password to be in the range \(8 - 128\), got %s`, passwordTooShort)),
 			},
 			{
 				Config:      testAccDatabaseConfig_masterPassword(rName, passwordTooLong),
-				ExpectError: regexp.MustCompile(fmt.Sprintf(`expected length of master_password to be in the range \(8 - 128\), got %s`, passwordTooLong)),
+				ExpectError: regexache.MustCompile(fmt.Sprintf(`expected length of master_password to be in the range \(8 - 128\), got %s`, passwordTooLong)),
 			},
 			{
 				Config:      testAccDatabaseConfig_masterPassword(rName, passwordContainsSlash),
-				ExpectError: regexp.MustCompile(`The password can include any printable ASCII character except \"/\", \"\"\", or \"@\". It cannot contain spaces.`),
+				ExpectError: regexache.MustCompile(`The password can include any printable ASCII character except \"/\", \"\"\", or \"@\". It cannot contain spaces.`),
 			},
 			{
 				Config:      testAccDatabaseConfig_masterPassword(rName, passwordContainsQuotes),
-				ExpectError: regexp.MustCompile(`The password can include any printable ASCII character except \"/\", \"\"\", or \"@\". It cannot contain spaces.`),
+				ExpectError: regexache.MustCompile(`The password can include any printable ASCII character except \"/\", \"\"\", or \"@\". It cannot contain spaces.`),
 			},
 			{
 				Config:      testAccDatabaseConfig_masterPassword(rName, passwordContainsAtSymbol),
-				ExpectError: regexp.MustCompile(`The password can include any printable ASCII character except \"/\", \"\"\", or \"@\". It cannot contain spaces.`),
+				ExpectError: regexache.MustCompile(`The password can include any printable ASCII character except \"/\", \"\"\", or \"@\". It cannot contain spaces.`),
 			},
 			{
 				Config:      testAccDatabaseConfig_masterPassword(rName, passwordContainsSpaces),
-				ExpectError: regexp.MustCompile(`The password can include any printable ASCII character except \"/\", \"\"\", or \"@\". It cannot contain spaces.`),
+				ExpectError: regexache.MustCompile(`The password can include any printable ASCII character except \"/\", \"\"\", or \"@\". It cannot contain spaces.`),
 			},
 		},
 	})
@@ -341,11 +344,11 @@ func TestAccLightsailDatabase_preferredBackupWindow(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccDatabaseConfig_preferredBackupWindow(rName, backupWindowInvalidHour),
-				ExpectError: regexp.MustCompile(`must satisfy the format of \"hh24:mi-hh24:mi\".`),
+				ExpectError: regexache.MustCompile(`must satisfy the format of \"hh24:mi-hh24:mi\".`),
 			},
 			{
 				Config:      testAccDatabaseConfig_preferredBackupWindow(rName, backupWindowInvalidMinute),
-				ExpectError: regexp.MustCompile(`must satisfy the format of \"hh24:mi-hh24:mi\".`),
+				ExpectError: regexache.MustCompile(`must satisfy the format of \"hh24:mi-hh24:mi\".`),
 			},
 			{
 				Config: testAccDatabaseConfig_preferredBackupWindow(rName, "09:30-10:00"),
@@ -396,15 +399,15 @@ func TestAccLightsailDatabase_preferredMaintenanceWindow(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccDatabaseConfig_preferredMaintenanceWindow(rName, maintenanceWindowInvalidDay),
-				ExpectError: regexp.MustCompile(`must satisfy the format of \"ddd:hh24:mi-ddd:hh24:mi\".`),
+				ExpectError: regexache.MustCompile(`must satisfy the format of \"ddd:hh24:mi-ddd:hh24:mi\".`),
 			},
 			{
 				Config:      testAccDatabaseConfig_preferredMaintenanceWindow(rName, maintenanceWindowInvalidHour),
-				ExpectError: regexp.MustCompile(`must satisfy the format of \"ddd:hh24:mi-ddd:hh24:mi\".`),
+				ExpectError: regexache.MustCompile(`must satisfy the format of \"ddd:hh24:mi-ddd:hh24:mi\".`),
 			},
 			{
 				Config:      testAccDatabaseConfig_preferredMaintenanceWindow(rName, maintenanceWindowInvalidMinute),
-				ExpectError: regexp.MustCompile(`must satisfy the format of \"ddd:hh24:mi-ddd:hh24:mi\".`),
+				ExpectError: regexache.MustCompile(`must satisfy the format of \"ddd:hh24:mi-ddd:hh24:mi\".`),
 			},
 			{
 				Config: testAccDatabaseConfig_preferredMaintenanceWindow(rName, "tue:04:30-tue:05:00"),
@@ -545,19 +548,19 @@ func TestAccLightsailDatabase_finalSnapshotName(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccDatabaseConfig_finalSnapshotName(rName, sNameTooShort),
-				ExpectError: regexp.MustCompile(fmt.Sprintf(`expected length of final_snapshot_name to be in the range \(2 - 255\), got %s`, sNameTooShort)),
+				ExpectError: regexache.MustCompile(fmt.Sprintf(`expected length of final_snapshot_name to be in the range \(2 - 255\), got %s`, sNameTooShort)),
 			},
 			{
 				Config:      testAccDatabaseConfig_finalSnapshotName(rName, sNameTooLong),
-				ExpectError: regexp.MustCompile(fmt.Sprintf(`expected length of final_snapshot_name to be in the range \(2 - 255\), got %s`, sNameTooLong)),
+				ExpectError: regexache.MustCompile(fmt.Sprintf(`expected length of final_snapshot_name to be in the range \(2 - 255\), got %s`, sNameTooLong)),
 			},
 			{
 				Config:      testAccDatabaseConfig_finalSnapshotName(rName, sNameContainsSpaces),
-				ExpectError: regexp.MustCompile(`Must contain from 2 to 255 alphanumeric characters, or hyphens. The first and last character must be a letter or number`),
+				ExpectError: regexache.MustCompile(`Must contain from 2 to 255 alphanumeric characters, or hyphens. The first and last character must be a letter or number`),
 			},
 			{
 				Config:      testAccDatabaseConfig_finalSnapshotName(rName, sNameContainsUnderscore),
-				ExpectError: regexp.MustCompile(`Must contain from 2 to 255 alphanumeric characters, or hyphens. The first and last character must be a letter or number`),
+				ExpectError: regexache.MustCompile(`Must contain from 2 to 255 alphanumeric characters, or hyphens. The first and last character must be a letter or number`),
 			},
 			{
 				Config: testAccDatabaseConfig_finalSnapshotName(rName, sName),
diff --git a/internal/service/lightsail/disk.go b/internal/service/lightsail/disk.go
index 8f551e05333..71005aa9400 100644
--- a/internal/service/lightsail/disk.go
+++ b/internal/service/lightsail/disk.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lightsail
 
 import (
 	"context"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/lightsail"
 	"github.com/aws/aws-sdk-go-v2/service/lightsail/types"
@@ -53,8 +56,8 @@ func ResourceDisk() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(2, 255),
-					validation.StringMatch(regexp.MustCompile(`^[a-zA-Z]`), "must begin with an alphabetic character"),
-					validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9_\-.]+[^._\-]$`), "must contain only alphanumeric characters, underscores, hyphens, and dots"),
+					validation.StringMatch(regexache.MustCompile(`^[A-Za-z]`), "must begin with an alphabetic character"),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_.-]+[^_.-]$`), "must contain only alphanumeric characters, underscores, hyphens, and dots"),
 				),
 			},
 			"size_in_gb": {
diff --git a/internal/service/lightsail/disk_attachment.go b/internal/service/lightsail/disk_attachment.go
index 009e1d56a98..d55812997bb 100644
--- a/internal/service/lightsail/disk_attachment.go
+++ b/internal/service/lightsail/disk_attachment.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lightsail
 
 import (
diff --git a/internal/service/lightsail/disk_attachment_test.go b/internal/service/lightsail/disk_attachment_test.go
index 18322fc02d7..9d695b27c90 100644
--- a/internal/service/lightsail/disk_attachment_test.go
+++ b/internal/service/lightsail/disk_attachment_test.go
@@ -1,13 +1,16 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lightsail_test
 
 import (
 	"context"
 	"errors"
 	"fmt"
-	"regexp"
 	"strings"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/service/lightsail"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -49,7 +52,7 @@ func TestAccLightsailDiskAttachment_basic(t *testing.T) {
 			},
 			{
 				Config:      testAccDiskAttachmentConfig_basic(dName, liName, diskPathBad),
-				ExpectError: regexp.MustCompile(`The disk path is invalid. You must specify a valid disk path.`),
+				ExpectError: regexache.MustCompile(`The disk path is invalid. You must specify a valid disk path.`),
 			},
 		},
 	})
diff --git a/internal/service/lightsail/disk_test.go b/internal/service/lightsail/disk_test.go
index 24749f8ec7f..5fcfa11c23e 100644
--- a/internal/service/lightsail/disk_test.go
+++ b/internal/service/lightsail/disk_test.go
@@ -1,13 +1,16 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lightsail_test
 
 import (
 	"context"
 	"errors"
 	"fmt"
-	"regexp"
 	"strings"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/service/lightsail"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -39,7 +42,7 @@ func TestAccLightsailDisk_basic(t *testing.T) {
 				Config: testAccDiskConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDiskExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "lightsail", regexp.MustCompile(`Disk/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "lightsail", regexache.MustCompile(`Disk/.+`)),
 					resource.TestCheckResourceAttrSet(resourceName, "availability_zone"),
 					resource.TestCheckResourceAttrSet(resourceName, "created_at"),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
diff --git a/internal/service/lightsail/distribution.go b/internal/service/lightsail/distribution.go
index 81eaf06819d..0e13583cb29 100644
--- a/internal/service/lightsail/distribution.go
+++ b/internal/service/lightsail/distribution.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lightsail
 
 import (
 	"context"
 	"errors"
 	"log"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/lightsail"
 	"github.com/aws/aws-sdk-go-v2/service/lightsail/types"
@@ -93,13 +96,13 @@ func ResourceDistribution() *schema.Resource {
 							Type:         schema.TypeString,
 							Optional:     true,
 							Description:  "The HTTP methods that are processed and forwarded to the distribution's origin.",
-							ValidateFunc: validation.StringMatch(regexp.MustCompile(`.*\S.*`), "Value must match regex: .*\\S.*"),
+							ValidateFunc: validation.StringMatch(regexache.MustCompile(`.*\S.*`), "Value must match regex: .*\\S.*"),
 						},
 						"cached_http_methods": {
 							Type:         schema.TypeString,
 							Optional:     true,
 							Description:  "The HTTP method responses that are cached by your distribution.",
-							ValidateFunc: validation.StringMatch(regexp.MustCompile(`.*\S.*`), "Value must match regex: .*\\S.*"),
+							ValidateFunc: validation.StringMatch(regexache.MustCompile(`.*\S.*`), "Value must match regex: .*\\S.*"),
 						},
 						"default_ttl": {
 							Type:        schema.TypeInt,
@@ -191,7 +194,7 @@ func ResourceDistribution() *schema.Resource {
 				Type:         schema.TypeString,
 				Optional:     true,
 				Description:  "The name of the SSL/TLS certificate attached to the distribution, if any.",
-				ValidateFunc: validation.StringMatch(regexp.MustCompile(`\w[\w\-]*\w`), "Certificate name must match regex: \\w[\\w\\-]*\\w"),
+				ValidateFunc: validation.StringMatch(regexache.MustCompile(`\w[\w\-]*\w`), "Certificate name must match regex: \\w[\\w\\-]*\\w"),
 			},
 			"created_at": {
 				Type:        schema.TypeString,
@@ -256,7 +259,7 @@ func ResourceDistribution() *schema.Resource {
 				Type:         schema.TypeString,
 				Required:     true,
 				Description:  "The name of the distribution.",
-				ValidateFunc: validation.StringMatch(regexp.MustCompile(`\w[\w\-]*\w`), "name must match regex: \\w[\\w\\-]*\\w"),
+				ValidateFunc: validation.StringMatch(regexache.MustCompile(`\w[\w\-]*\w`), "name must match regex: \\w[\\w\\-]*\\w"),
 			},
 			"origin": {
 				Type:        schema.TypeList,
@@ -268,7 +271,7 @@ func ResourceDistribution() *schema.Resource {
 						"name": {
 							Type:         schema.TypeString,
 							Required:     true,
-							ValidateFunc: validation.StringMatch(regexp.MustCompile(`\w[\w\-]*\w`), "Name must match regex: \\w[\\w\\-]*\\w"),
+							ValidateFunc: validation.StringMatch(regexache.MustCompile(`\w[\w\-]*\w`), "Name must match regex: \\w[\\w\\-]*\\w"),
 							Description:  "The name of the origin resource.",
 						},
 						"protocol_policy": {
diff --git a/internal/service/lightsail/distribution_test.go b/internal/service/lightsail/distribution_test.go
index 4200b5cb329..2dbd388f4a9 100644
--- a/internal/service/lightsail/distribution_test.go
+++ b/internal/service/lightsail/distribution_test.go
@@ -1,13 +1,16 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lightsail_test
 
 import (
 	"context"
 	"errors"
 	"fmt"
-	"regexp"
 	"strings"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/service/lightsail"
 	"github.com/aws/aws-sdk-go-v2/service/lightsail/types"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -68,7 +71,7 @@ func testAccDistribution_basic(t *testing.T) {
 					testAccCheckDistributionExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "alternative_domain_names.#", "0"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "lightsail", regexp.MustCompile(`Distribution/*`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "lightsail", regexache.MustCompile(`Distribution/*`)),
 					resource.TestCheckResourceAttr(resourceName, "bundle_id", "small_1_0"),
 					resource.TestCheckResourceAttr(resourceName, "cache_behavior_settings.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "cache_behavior_settings.0.allowed_http_methods", "GET,HEAD,OPTIONS,PUT,PATCH,POST,DELETE"),
diff --git a/internal/service/lightsail/domain.go b/internal/service/lightsail/domain.go
index bb46af0b96d..55f5c9c3bf5 100644
--- a/internal/service/lightsail/domain.go
+++ b/internal/service/lightsail/domain.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lightsail
 
 import (
diff --git a/internal/service/lightsail/domain_entry.go b/internal/service/lightsail/domain_entry.go
index bfe0266393e..feda09072f8 100644
--- a/internal/service/lightsail/domain_entry.go
+++ b/internal/service/lightsail/domain_entry.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lightsail
 
 import (
@@ -62,6 +65,7 @@ func ResourceDomainEntry() *schema.Resource {
 				Required: true,
 				ValidateFunc: validation.StringInSlice([]string{
 					"A",
+					"AAAA",
 					"CNAME",
 					"MX",
 					"NS",
diff --git a/internal/service/lightsail/domain_entry_test.go b/internal/service/lightsail/domain_entry_test.go
index 79de226cde8..cb0882765b1 100644
--- a/internal/service/lightsail/domain_entry_test.go
+++ b/internal/service/lightsail/domain_entry_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lightsail_test
 
 import (
@@ -164,6 +167,46 @@ func TestAccLightsailDomainEntry_disappears(t *testing.T) {
 	})
 }
 
+func TestAccLightsailDomainEntry_typeAAAA(t *testing.T) {
+	ctx := acctest.Context(t)
+	resourceName := "aws_lightsail_domain_entry.test"
+	domainName := acctest.RandomDomainName()
+	domainEntryName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckRegion(t, string(types.RegionNameUsEast1)) },
+		ErrorCheck:               acctest.ErrorCheck(t, strings.ToLower(lightsail.ServiceID)),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckDomainEntryDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccDomainEntryConfig_typeAAAA(domainName, domainEntryName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckDomainEntryExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "domain_name", domainName),
+					resource.TestCheckResourceAttr(resourceName, "name", domainEntryName),
+					resource.TestCheckResourceAttr(resourceName, "target", "::1"),
+					resource.TestCheckResourceAttr(resourceName, "type", "AAAA"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			// Validate that we can import an existing resource using the legacy separator
+			// Validate that the ID is updated to use the new common separator
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateIdFunc: testAccDomainEntryStateLegacyIdFunc(resourceName),
+				ImportStateVerify: true,
+				Check:             resource.TestCheckResourceAttr(resourceName, "id", fmt.Sprintf("%s,%s,%s,%s", domainEntryName, domainName, "AAAA", "::1")),
+			},
+		},
+	})
+}
+
 func testAccCheckDomainEntryExists(ctx context.Context, n string) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		rs, ok := s.RootModule().Resources[n]
@@ -233,6 +276,21 @@ resource "aws_lightsail_domain_entry" "test" {
 `, domainName, domainEntryName)
 }
 
+func testAccDomainEntryConfig_typeAAAA(domainName string, domainEntryName string) string {
+	return fmt.Sprintf(`
+resource "aws_lightsail_domain" "test" {
+  domain_name = %[1]q
+}
+
+resource "aws_lightsail_domain_entry" "test" {
+  domain_name = aws_lightsail_domain.test.id
+  name        = %[2]q
+  type        = "AAAA"
+  target      = "::1"
+}
+`, domainName, domainEntryName)
+}
+
 func testAccDomainEntryStateLegacyIdFunc(resourceName string) resource.ImportStateIdFunc {
 	return func(s *terraform.State) (string, error) {
 		rs, ok := s.RootModule().Resources[resourceName]
diff --git a/internal/service/lightsail/domain_test.go b/internal/service/lightsail/domain_test.go
index b8b9dac3712..f5d3ea8bc8d 100644
--- a/internal/service/lightsail/domain_test.go
+++ b/internal/service/lightsail/domain_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lightsail_test
 
 import (
diff --git a/internal/service/lightsail/errs.go b/internal/service/lightsail/errs.go
index c3c8644fed2..5de49bd184f 100644
--- a/internal/service/lightsail/errs.go
+++ b/internal/service/lightsail/errs.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lightsail
 
 import (
diff --git a/internal/service/lightsail/flex.go b/internal/service/lightsail/flex.go
index b2511a2fc70..125ffe1b899 100644
--- a/internal/service/lightsail/flex.go
+++ b/internal/service/lightsail/flex.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lightsail
 
 import (
diff --git a/internal/service/lightsail/generate.go b/internal/service/lightsail/generate.go
index 39edc353c4e..71da4d3c82a 100644
--- a/internal/service/lightsail/generate.go
+++ b/internal/service/lightsail/generate.go
@@ -1,4 +1,7 @@
-//go:generate go run ../../generate/tags/main.go -AWSSDKVersion=2 -ListTagsInIDElem=ResourceName -ServiceTagsSlice -TagInIDElem=ResourceName -UpdateTags
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+//go:generate go run ../../generate/tags/main.go -AWSSDKVersion=2 -ListTagsInIDElem=ResourceName -ServiceTagsSlice -TagInIDElem=ResourceName -UpdateTags  -CreateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
 
diff --git a/internal/service/lightsail/instance.go b/internal/service/lightsail/instance.go
index 2d143799355..e90e73ddd81 100644
--- a/internal/service/lightsail/instance.go
+++ b/internal/service/lightsail/instance.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lightsail
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"strings"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/lightsail"
 	"github.com/aws/aws-sdk-go-v2/service/lightsail/types"
@@ -51,7 +54,7 @@ func ResourceInstance() *schema.Resource {
 						"snapshot_time": {
 							Type:         schema.TypeString,
 							Required:     true,
-							ValidateFunc: validation.StringMatch(regexp.MustCompile(`^(0[0-9]|1[0-9]|2[0-3]):[0-5][0-9]$`), "must be in HH:00 format, and in Coordinated Universal Time (UTC)."),
+							ValidateFunc: validation.StringMatch(regexache.MustCompile(`^(0[0-9]|1[0-9]|2[0-3]):[0-5][0-9]$`), "must be in HH:00 format, and in Coordinated Universal Time (UTC)."),
 						},
 						"status": {
 							Type:         schema.TypeString,
@@ -67,8 +70,8 @@ func ResourceInstance() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(2, 255),
-					validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9]`), "must begin with an alphanumeric character"),
-					validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9_\-.]+[^._\-]$`), "must contain only alphanumeric characters, underscores, hyphens, and dots"),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z]`), "must begin with an alphanumeric character"),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_.-]+[^_.-]$`), "must contain only alphanumeric characters, underscores, hyphens, and dots"),
 				),
 			},
 			"availability_zone": {
diff --git a/internal/service/lightsail/instance_public_ports.go b/internal/service/lightsail/instance_public_ports.go
index a86bba4a9df..e3ef931cbba 100644
--- a/internal/service/lightsail/instance_public_ports.go
+++ b/internal/service/lightsail/instance_public_ports.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lightsail
 
 import (
diff --git a/internal/service/lightsail/instance_public_ports_test.go b/internal/service/lightsail/instance_public_ports_test.go
index 04c0d207d74..02f839b3bb5 100644
--- a/internal/service/lightsail/instance_public_ports_test.go
+++ b/internal/service/lightsail/instance_public_ports_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lightsail_test
 
 import (
diff --git a/internal/service/lightsail/instance_test.go b/internal/service/lightsail/instance_test.go
index 0390fc8bf90..7b947a91b46 100644
--- a/internal/service/lightsail/instance_test.go
+++ b/internal/service/lightsail/instance_test.go
@@ -1,13 +1,16 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lightsail_test
 
 import (
 	"context"
 	"errors"
 	"fmt"
-	"regexp"
 	"strings"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/service/lightsail"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -52,10 +55,10 @@ func TestAccLightsailInstance_basic(t *testing.T) {
 					resource.TestCheckResourceAttrSet(resourceName, "blueprint_id"),
 					resource.TestCheckResourceAttrSet(resourceName, "bundle_id"),
 					resource.TestCheckResourceAttr(resourceName, "ipv6_addresses.#", "1"),
-					resource.TestMatchResourceAttr(resourceName, "ipv6_addresses.0", regexp.MustCompile(`([a-f0-9]{1,4}:){7}[a-f0-9]{1,4}`)),
+					resource.TestMatchResourceAttr(resourceName, "ipv6_addresses.0", regexache.MustCompile(`([0-9a-f]{1,4}:){7}[0-9a-f]{1,4}`)),
 					resource.TestCheckResourceAttrSet(resourceName, "key_pair_name"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
-					resource.TestMatchResourceAttr(resourceName, "ram_size", regexp.MustCompile(`\d+(.\d+)?`)),
+					resource.TestMatchResourceAttr(resourceName, "ram_size", regexache.MustCompile(`\d+(.\d+)?`)),
 				),
 			},
 		},
@@ -83,11 +86,11 @@ func TestAccLightsailInstance_name(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccInstanceConfig_basic(rNameWithSpaces),
-				ExpectError: regexp.MustCompile(`must contain only alphanumeric characters, underscores, hyphens, and dots`),
+				ExpectError: regexache.MustCompile(`must contain only alphanumeric characters, underscores, hyphens, and dots`),
 			},
 			{
 				Config:      testAccInstanceConfig_basic(rNameWithStartingHyphen),
-				ExpectError: regexp.MustCompile(`must begin with an alphanumeric character`),
+				ExpectError: regexache.MustCompile(`must begin with an alphanumeric character`),
 			},
 			{
 				Config: testAccInstanceConfig_basic(rNameWithStartingDigit),
@@ -290,7 +293,7 @@ func TestAccLightsailInstance_availabilityZone(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccInstanceConfig_availabilityZone(rName, availabilityZone),
-				ExpectError: regexp.MustCompile(`availability_zone must be within the same region as provider region.`),
+				ExpectError: regexache.MustCompile(`availability_zone must be within the same region as provider region.`),
 			},
 		},
 	})
diff --git a/internal/service/lightsail/key_pair.go b/internal/service/lightsail/key_pair.go
index fd973a832de..166355d5154 100644
--- a/internal/service/lightsail/key_pair.go
+++ b/internal/service/lightsail/key_pair.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lightsail
 
 import (
@@ -11,25 +14,46 @@ import (
 	"github.com/aws/aws-sdk-go-v2/service/lightsail"
 	"github.com/aws/aws-sdk-go-v2/service/lightsail/types"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/create"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
+	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/vault/helper/pgpkeys"
+	"github.com/hashicorp/terraform-provider-aws/internal/verify"
+	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
 const (
 	ResKeyPair = "KeyPair"
 )
 
-// @SDKResource("aws_lightsail_key_pair")
+// @SDKResource("aws_lightsail_key_pair", name=KeyPair)
+// @Tags(identifierAttribute="id")
 func ResourceKeyPair() *schema.Resource {
 	return &schema.Resource{
 		CreateWithoutTimeout: resourceKeyPairCreate,
 		ReadWithoutTimeout:   resourceKeyPairRead,
+		UpdateWithoutTimeout: resourceKeyPairUpdate,
 		DeleteWithoutTimeout: resourceKeyPairDelete,
 
 		Schema: map[string]*schema.Schema{
+			"arn": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"encrypted_fingerprint": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"encrypted_private_key": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"fingerprint": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
 			"name": {
 				Type:          schema.TypeString,
 				Optional:      true,
@@ -40,25 +64,16 @@ func ResourceKeyPair() *schema.Resource {
 			"name_prefix": {
 				Type:          schema.TypeString,
 				Optional:      true,
+				Computed:      true,
 				ForceNew:      true,
 				ConflictsWith: []string{"name"},
 			},
-
-			// optional fields
 			"pgp_key": {
 				Type:     schema.TypeString,
 				Optional: true,
 				ForceNew: true,
 			},
-
-			// additional info returned from the API
-			"arn": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
-
-			// fields returned from CreateKey
-			"fingerprint": {
+			"private_key": {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
@@ -68,21 +83,11 @@ func ResourceKeyPair() *schema.Resource {
 				Optional: true,
 				ForceNew: true,
 			},
-			"private_key": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
-
-			// encrypted fields if pgp_key is given
-			"encrypted_fingerprint": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
-			"encrypted_private_key": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
+			names.AttrTags:    tftags.TagsSchema(),
+			names.AttrTagsAll: tftags.TagsSchemaComputed(),
 		},
+
+		CustomizeDiff: verify.SetTagsDiff,
 	}
 }
 
@@ -90,15 +95,7 @@ func resourceKeyPairCreate(ctx context.Context, d *schema.ResourceData, meta int
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).LightsailClient(ctx)
 
-	var kName string
-	if v, ok := d.GetOk("name"); ok {
-		kName = v.(string)
-	} else if v, ok := d.GetOk("name_prefix"); ok {
-		kName = id.PrefixedUniqueId(v.(string))
-	} else {
-		kName = id.UniqueId()
-	}
-
+	kName := create.Name(d.Get("name").(string), d.Get("name_prefix").(string))
 	var pubKey string
 	var op *types.Operation
 	if pubKeyInterface, ok := d.GetOk("public_key"); ok {
@@ -109,6 +106,7 @@ func resourceKeyPairCreate(ctx context.Context, d *schema.ResourceData, meta int
 		// creating new key
 		resp, err := conn.CreateKeyPair(ctx, &lightsail.CreateKeyPairInput{
 			KeyPairName: aws.String(kName),
+			Tags:        getTagsIn(ctx),
 		})
 		if err != nil {
 			return sdkdiag.AppendErrorf(diags, "creating Lightsail Key Pair (%s): %s", kName, err)
@@ -157,6 +155,10 @@ func resourceKeyPairCreate(ctx context.Context, d *schema.ResourceData, meta int
 		d.SetId(kName)
 
 		op = resp.Operation
+
+		if err := createTags(ctx, conn, kName, getTagsIn(ctx)); err != nil {
+			return sdkdiag.AppendErrorf(diags, "creating Lightsail Key Pair (%s): %s", kName, err)
+		}
 	}
 
 	diag := expandOperations(ctx, conn, []types.Operation{*op}, "CreateKeyPair", ResKeyPair, kName)
@@ -186,12 +188,20 @@ func resourceKeyPairRead(ctx context.Context, d *schema.ResourceData, meta inter
 	}
 
 	d.Set("arn", resp.KeyPair.Arn)
-	d.Set("name", resp.KeyPair.Name)
 	d.Set("fingerprint", resp.KeyPair.Fingerprint)
+	d.Set("name", resp.KeyPair.Name)
+	d.Set("name_prefix", create.NamePrefixFromName(aws.ToString(resp.KeyPair.Name)))
+
+	setTagsOut(ctx, resp.KeyPair.Tags)
 
 	return diags
 }
 
+func resourceKeyPairUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	// Tags only.
+	return resourceKeyPairRead(ctx, d, meta)
+}
+
 func resourceKeyPairDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).LightsailClient(ctx)
diff --git a/internal/service/lightsail/key_pair_test.go b/internal/service/lightsail/key_pair_test.go
index f63b334b7ee..cde03d15bc8 100644
--- a/internal/service/lightsail/key_pair_test.go
+++ b/internal/service/lightsail/key_pair_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lightsail_test
 
 import (
@@ -24,7 +27,11 @@ func TestAccLightsailKeyPair_basic(t *testing.T) {
 	resourceName := "aws_lightsail_key_pair.test"
 
 	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheck(ctx, t) },
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, strings.ToLower(lightsail.ServiceID))
+			testAccPreCheck(ctx, t)
+		},
 		ErrorCheck:               acctest.ErrorCheck(t, strings.ToLower(lightsail.ServiceID)),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckKeyPairDestroy(ctx),
@@ -35,8 +42,10 @@ func TestAccLightsailKeyPair_basic(t *testing.T) {
 					testAccCheckKeyPairExists(ctx, resourceName),
 					resource.TestCheckResourceAttrSet(resourceName, "arn"),
 					resource.TestCheckResourceAttrSet(resourceName, "fingerprint"),
-					resource.TestCheckResourceAttrSet(resourceName, "public_key"),
+					resource.TestCheckResourceAttr(resourceName, "name", rName),
+					resource.TestCheckResourceAttr(resourceName, "name_prefix", ""),
 					resource.TestCheckResourceAttrSet(resourceName, "private_key"),
+					resource.TestCheckResourceAttrSet(resourceName, "public_key"),
 				),
 			},
 		},
@@ -55,7 +64,11 @@ func TestAccLightsailKeyPair_publicKey(t *testing.T) {
 	}
 
 	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheck(ctx, t) },
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, strings.ToLower(lightsail.ServiceID))
+			testAccPreCheck(ctx, t)
+		},
 		ErrorCheck:               acctest.ErrorCheck(t, strings.ToLower(lightsail.ServiceID)),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckKeyPairDestroy(ctx),
@@ -83,7 +96,11 @@ func TestAccLightsailKeyPair_encrypted(t *testing.T) {
 	resourceName := "aws_lightsail_key_pair.test"
 
 	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheck(ctx, t) },
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, strings.ToLower(lightsail.ServiceID))
+			testAccPreCheck(ctx, t)
+		},
 		ErrorCheck:               acctest.ErrorCheck(t, strings.ToLower(lightsail.ServiceID)),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckKeyPairDestroy(ctx),
@@ -107,7 +124,11 @@ func TestAccLightsailKeyPair_encrypted(t *testing.T) {
 func TestAccLightsailKeyPair_namePrefix(t *testing.T) {
 	ctx := acctest.Context(t)
 	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheck(ctx, t) },
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, strings.ToLower(lightsail.ServiceID))
+			testAccPreCheck(ctx, t)
+		},
 		ErrorCheck:               acctest.ErrorCheck(t, strings.ToLower(lightsail.ServiceID)),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckKeyPairDestroy(ctx),
@@ -125,6 +146,79 @@ func TestAccLightsailKeyPair_namePrefix(t *testing.T) {
 	})
 }
 
+func TestAccLightsailKeyPair_tags(t *testing.T) {
+	ctx := acctest.Context(t)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+
+	resourceName := "aws_lightsail_key_pair.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, strings.ToLower(lightsail.ServiceID))
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, strings.ToLower(lightsail.ServiceID)),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckKeyPairDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccKeyPairConfig_tags1(rName, "key1", "value1"),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckKeyPairExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
+				),
+			},
+			{
+				Config: testAccKeyPairConfig_tags2(rName, "key1", "value1", "key2", "value2"),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckKeyPairExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
+				),
+			},
+			{
+				Config: testAccKeyPairConfig_tags1(rName, "key2", "value2"),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckKeyPairExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccLightsailKeyPair_disappears(t *testing.T) {
+	ctx := acctest.Context(t)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+
+	resourceName := "aws_lightsail_key_pair.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, strings.ToLower(lightsail.ServiceID))
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, strings.ToLower(lightsail.ServiceID)),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckKeyPairDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccKeyPairConfig_basic(rName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckKeyPairExists(ctx, resourceName),
+					acctest.CheckResourceDisappears(ctx, acctest.Provider, tflightsail.ResourceKeyPair(), resourceName),
+				),
+				ExpectNonEmptyPlan: true,
+			},
+		},
+	})
+}
+
 func testAccCheckKeyPairExists(ctx context.Context, n string) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		rs, ok := s.RootModule().Resources[n]
@@ -186,7 +280,7 @@ func testAccCheckKeyPairDestroy(ctx context.Context) resource.TestCheckFunc {
 func testAccKeyPairConfig_basic(lightsailName string) string {
 	return fmt.Sprintf(`
 resource "aws_lightsail_key_pair" "test" {
-  name = "%s"
+  name = %[1]q
 }
 `, lightsailName)
 }
@@ -223,6 +317,31 @@ resource "aws_lightsail_key_pair" "lightsail_key_pair_test_prefixed" {
 `
 }
 
+func testAccKeyPairConfig_tags1(lightsailName, key1, value1 string) string {
+	return fmt.Sprintf(`
+resource "aws_lightsail_key_pair" "test" {
+  name = %[1]q
+
+  tags = {
+    %[2]q = %[3]q
+  }
+}
+`, lightsailName, key1, value1)
+}
+
+func testAccKeyPairConfig_tags2(lightsailName, key1, value1, key2, value2 string) string {
+	return fmt.Sprintf(`
+resource "aws_lightsail_key_pair" "test" {
+  name = %[1]q
+
+  tags = {
+    %[2]q = %[3]q
+    %[4]q = %[5]q
+  }
+}
+`, lightsailName, key1, value1, key2, value2)
+}
+
 const testKeyPairPubKey1 = `mQENBFXbjPUBCADjNjCUQwfxKL+RR2GA6pv/1K+zJZ8UWIF9S0lk7cVIEfJiprzzwiMwBS5cD0da
 rGin1FHvIWOZxujA7oW0O2TUuatqI3aAYDTfRYurh6iKLC+VS+F7H+/mhfFvKmgr0Y5kDCF1j0T/
 063QZ84IRGucR/X43IY7kAtmxGXH0dYOCzOe5UBX1fTn3mXGe2ImCDWBH7gOViynXmb6XNvXkP0f
diff --git a/internal/service/lightsail/lb.go b/internal/service/lightsail/lb.go
index 518c9d0198d..cddc1ec4473 100644
--- a/internal/service/lightsail/lb.go
+++ b/internal/service/lightsail/lb.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lightsail
 
 import (
 	"context"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/lightsail"
 	"github.com/aws/aws-sdk-go-v2/service/lightsail/types"
@@ -81,8 +84,8 @@ func ResourceLoadBalancer() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(2, 255),
-					validation.StringMatch(regexp.MustCompile(`^[a-zA-Z]`), "must begin with an alphabetic character"),
-					validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9_\-.]+[^._\-]$`), "must contain only alphanumeric characters, underscores, hyphens, and dots"),
+					validation.StringMatch(regexache.MustCompile(`^[A-Za-z]`), "must begin with an alphabetic character"),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_.-]+[^_.-]$`), "must contain only alphanumeric characters, underscores, hyphens, and dots"),
 				),
 			},
 			"support_code": {
diff --git a/internal/service/lightsail/lb_attachment.go b/internal/service/lightsail/lb_attachment.go
index 45f1bca020d..a18fa6831e9 100644
--- a/internal/service/lightsail/lb_attachment.go
+++ b/internal/service/lightsail/lb_attachment.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lightsail
 
 import (
 	"context"
 	"errors"
-	"regexp"
 	"strings"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/lightsail"
 	"github.com/aws/aws-sdk-go-v2/service/lightsail/types"
@@ -37,8 +40,8 @@ func ResourceLoadBalancerAttachment() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(2, 255),
-					validation.StringMatch(regexp.MustCompile(`^[a-zA-Z]`), "must begin with an alphabetic character"),
-					validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9_\-.]+[^._\-]$`), "must contain only alphanumeric characters, underscores, hyphens, and dots"),
+					validation.StringMatch(regexache.MustCompile(`^[A-Za-z]`), "must begin with an alphabetic character"),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_.-]+[^_.-]$`), "must contain only alphanumeric characters, underscores, hyphens, and dots"),
 				),
 			},
 			"instance_name": {
diff --git a/internal/service/lightsail/lb_attachment_test.go b/internal/service/lightsail/lb_attachment_test.go
index 42bfc01d8a8..72e602462fe 100644
--- a/internal/service/lightsail/lb_attachment_test.go
+++ b/internal/service/lightsail/lb_attachment_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lightsail_test
 
 import (
diff --git a/internal/service/lightsail/lb_certificate.go b/internal/service/lightsail/lb_certificate.go
index 753217e1e10..451f0ec5579 100644
--- a/internal/service/lightsail/lb_certificate.go
+++ b/internal/service/lightsail/lb_certificate.go
@@ -1,13 +1,16 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lightsail
 
 import (
 	"context"
 	"errors"
 	"fmt"
-	"regexp"
 	"strings"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/lightsail"
 	"github.com/aws/aws-sdk-go-v2/service/lightsail/types"
@@ -50,7 +53,7 @@ func ResourceLoadBalancerCertificate() *schema.Resource {
 				Optional:     true,
 				Computed:     true,
 				ForceNew:     true,
-				ValidateFunc: validation.StringDoesNotMatch(regexp.MustCompile(`\.$`), "cannot end with a period"),
+				ValidateFunc: validation.StringDoesNotMatch(regexache.MustCompile(`\.$`), "cannot end with a period"),
 			},
 			"domain_validation_records": {
 				Type:     schema.TypeSet,
@@ -83,8 +86,8 @@ func ResourceLoadBalancerCertificate() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(2, 255),
-					validation.StringMatch(regexp.MustCompile(`^[a-zA-Z]`), "must begin with an alphabetic character"),
-					validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9_\-.]+[^._\-]$`), "must contain only alphanumeric characters, underscores, hyphens, and dots"),
+					validation.StringMatch(regexache.MustCompile(`^[A-Za-z]`), "must begin with an alphabetic character"),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_.-]+[^_.-]$`), "must contain only alphanumeric characters, underscores, hyphens, and dots"),
 				),
 			},
 			"name": {
@@ -93,8 +96,8 @@ func ResourceLoadBalancerCertificate() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(2, 255),
-					validation.StringMatch(regexp.MustCompile(`^[a-zA-Z]`), "must begin with an alphabetic character"),
-					validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9_\-.]+[^._\-]$`), "must contain only alphanumeric characters, underscores, hyphens, and dots"),
+					validation.StringMatch(regexache.MustCompile(`^[A-Za-z]`), "must begin with an alphabetic character"),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_.-]+[^_.-]$`), "must contain only alphanumeric characters, underscores, hyphens, and dots"),
 				),
 			},
 			"subject_alternative_names": {
@@ -106,7 +109,7 @@ func ResourceLoadBalancerCertificate() *schema.Resource {
 					Type: schema.TypeString,
 					ValidateFunc: validation.All(
 						validation.StringLenBetween(1, 253),
-						validation.StringDoesNotMatch(regexp.MustCompile(`\.$`), "cannot end with a period"),
+						validation.StringDoesNotMatch(regexache.MustCompile(`\.$`), "cannot end with a period"),
 					),
 				},
 				Set: schema.HashString,
diff --git a/internal/service/lightsail/lb_certificate_attachment.go b/internal/service/lightsail/lb_certificate_attachment.go
index d101eea964a..10f4634e57a 100644
--- a/internal/service/lightsail/lb_certificate_attachment.go
+++ b/internal/service/lightsail/lb_certificate_attachment.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lightsail
 
 import (
 	"context"
 	"errors"
 	"log"
-	"regexp"
 	"strings"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/lightsail"
 	"github.com/aws/aws-sdk-go-v2/service/lightsail/types"
@@ -38,8 +41,8 @@ func ResourceLoadBalancerCertificateAttachment() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(2, 255),
-					validation.StringMatch(regexp.MustCompile(`^[a-zA-Z]`), "must begin with an alphabetic character"),
-					validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9_\-.]+[^._\-]$`), "must contain only alphanumeric characters, underscores, hyphens, and dots"),
+					validation.StringMatch(regexache.MustCompile(`^[A-Za-z]`), "must begin with an alphabetic character"),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_.-]+[^_.-]$`), "must contain only alphanumeric characters, underscores, hyphens, and dots"),
 				),
 			},
 			"certificate_name": {
diff --git a/internal/service/lightsail/lb_certificate_attachment_test.go b/internal/service/lightsail/lb_certificate_attachment_test.go
index 7108eac9372..9ab187324b8 100644
--- a/internal/service/lightsail/lb_certificate_attachment_test.go
+++ b/internal/service/lightsail/lb_certificate_attachment_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lightsail_test
 
 import (
 	"fmt"
-	"regexp"
 	"strings"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/service/lightsail"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -30,7 +33,7 @@ func testAccLoadBalancerCertificateAttachment_basic(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccLoadBalancerCertificateAttachmentConfig_basic(lbName, cName, domainName),
-				ExpectError: regexp.MustCompile(`Sorry, you can only attach a validated certificate to a load balancer.`),
+				ExpectError: regexache.MustCompile(`Sorry, you can only attach a validated certificate to a load balancer.`),
 			},
 		},
 	})
diff --git a/internal/service/lightsail/lb_certificate_test.go b/internal/service/lightsail/lb_certificate_test.go
index f25bedd992f..3cbdf648ab6 100644
--- a/internal/service/lightsail/lb_certificate_test.go
+++ b/internal/service/lightsail/lb_certificate_test.go
@@ -1,13 +1,16 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lightsail_test
 
 import (
 	"context"
 	"errors"
 	"fmt"
-	"regexp"
 	"strings"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/service/lightsail"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -41,7 +44,7 @@ func testAccLoadBalancerCertificate_basic(t *testing.T) {
 				Config: testAccLoadBalancerCertificateConfig_basic(rName, lbName, domainName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckLoadBalancerCertificateExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "lightsail", regexp.MustCompile(`LoadBalancerTlsCertificate/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "lightsail", regexache.MustCompile(`LoadBalancerTlsCertificate/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "domain_name", domainName),
 					resource.TestCheckResourceAttr(resourceName, "subject_alternative_names.#", "1"),
diff --git a/internal/service/lightsail/lb_https_redirection_policy.go b/internal/service/lightsail/lb_https_redirection_policy.go
index e7ec665c2ec..a7fe8f75e79 100644
--- a/internal/service/lightsail/lb_https_redirection_policy.go
+++ b/internal/service/lightsail/lb_https_redirection_policy.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lightsail
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/lightsail"
 	"github.com/aws/aws-sdk-go-v2/service/lightsail/types"
@@ -41,8 +44,8 @@ func ResourceLoadBalancerHTTPSRedirectionPolicy() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(2, 255),
-					validation.StringMatch(regexp.MustCompile(`^[a-zA-Z]`), "must begin with an alphabetic character"),
-					validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9_\-.]+[^._\-]$`), "must contain only alphanumeric characters, underscores, hyphens, and dots"),
+					validation.StringMatch(regexache.MustCompile(`^[A-Za-z]`), "must begin with an alphabetic character"),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_.-]+[^_.-]$`), "must contain only alphanumeric characters, underscores, hyphens, and dots"),
 				),
 			},
 		},
diff --git a/internal/service/lightsail/lb_https_redirection_policy_test.go b/internal/service/lightsail/lb_https_redirection_policy_test.go
index 09b1f542a81..b0ab7df8663 100644
--- a/internal/service/lightsail/lb_https_redirection_policy_test.go
+++ b/internal/service/lightsail/lb_https_redirection_policy_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lightsail_test
 
 import (
 	"fmt"
-	"regexp"
 	"strings"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/service/lightsail"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -29,7 +32,7 @@ func testAccLoadBalancerHTTPSRedirectionPolicy_basic(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccLoadBalancerHTTPSRedirectionPolicyConfig_basic(rName, enabled),
-				ExpectError: regexp.MustCompile(`cannot enable https redirection while https is disabled.`),
+				ExpectError: regexache.MustCompile(`cannot enable https redirection while https is disabled.`),
 			},
 		},
 	})
diff --git a/internal/service/lightsail/lb_stickiness_policy.go b/internal/service/lightsail/lb_stickiness_policy.go
index 645f3a692e3..c5561233c60 100644
--- a/internal/service/lightsail/lb_stickiness_policy.go
+++ b/internal/service/lightsail/lb_stickiness_policy.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lightsail
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"strconv"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/lightsail"
 	"github.com/aws/aws-sdk-go-v2/service/lightsail/types"
@@ -46,8 +49,8 @@ func ResourceLoadBalancerStickinessPolicy() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(2, 255),
-					validation.StringMatch(regexp.MustCompile(`^[a-zA-Z]`), "must begin with an alphabetic character"),
-					validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9_\-.]+[^._\-]$`), "must contain only alphanumeric characters, underscores, hyphens, and dots"),
+					validation.StringMatch(regexache.MustCompile(`^[A-Za-z]`), "must begin with an alphabetic character"),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_.-]+[^_.-]$`), "must contain only alphanumeric characters, underscores, hyphens, and dots"),
 				),
 			},
 		},
diff --git a/internal/service/lightsail/lb_stickiness_policy_test.go b/internal/service/lightsail/lb_stickiness_policy_test.go
index c40f38b5703..3f074e87359 100644
--- a/internal/service/lightsail/lb_stickiness_policy_test.go
+++ b/internal/service/lightsail/lb_stickiness_policy_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lightsail_test
 
 import (
diff --git a/internal/service/lightsail/lb_test.go b/internal/service/lightsail/lb_test.go
index 1381f02bf75..d1c1678167f 100644
--- a/internal/service/lightsail/lb_test.go
+++ b/internal/service/lightsail/lb_test.go
@@ -1,14 +1,17 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lightsail_test
 
 import (
 	"context"
 	"errors"
 	"fmt"
-	"regexp"
 	"strings"
 	"testing"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/lightsail"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -114,11 +117,11 @@ func testAccLoadBalancer_name(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccLoadBalancerConfig_basic(lightsailNameWithSpaces),
-				ExpectError: regexp.MustCompile(`must contain only alphanumeric characters, underscores, hyphens, and dots`),
+				ExpectError: regexache.MustCompile(`must contain only alphanumeric characters, underscores, hyphens, and dots`),
 			},
 			{
 				Config:      testAccLoadBalancerConfig_basic(lightsailNameWithStartingDigit),
-				ExpectError: regexp.MustCompile(`must begin with an alphabetic character`),
+				ExpectError: regexache.MustCompile(`must begin with an alphabetic character`),
 			},
 			{
 				Config: testAccLoadBalancerConfig_basic(rName),
diff --git a/internal/service/lightsail/service_package.go b/internal/service/lightsail/service_package.go
index 917dfcc3dc9..5a9d9cd0757 100644
--- a/internal/service/lightsail/service_package.go
+++ b/internal/service/lightsail/service_package.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lightsail
 
 import (
@@ -16,7 +19,7 @@ func (p *servicePackage) NewClient(ctx context.Context, config map[string]any) (
 
 	return lightsail_sdkv2.NewFromConfig(cfg, func(o *lightsail_sdkv2.Options) {
 		if endpoint := config["endpoint"].(string); endpoint != "" {
-			o.EndpointResolver = lightsail_sdkv2.EndpointResolverFromURL(endpoint)
+			o.BaseEndpoint = aws_sdkv2.String(endpoint)
 		}
 
 		retryable := retry_sdkv2.IsErrorRetryableFunc(func(e error) aws_sdkv2.Ternary {
diff --git a/internal/service/lightsail/service_package_gen.go b/internal/service/lightsail/service_package_gen.go
index 45c69a465cd..3b51c47220c 100644
--- a/internal/service/lightsail/service_package_gen.go
+++ b/internal/service/lightsail/service_package_gen.go
@@ -5,6 +5,7 @@ package lightsail
 import (
 	"context"
 
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -112,6 +113,10 @@ func (p *servicePackage) SDKResources(ctx context.Context) []*types.ServicePacka
 		{
 			Factory:  ResourceKeyPair,
 			TypeName: "aws_lightsail_key_pair",
+			Name:     "KeyPair",
+			Tags: &types.ServicePackageResourceTags{
+				IdentifierAttribute: "id",
+			},
 		},
 		{
 			Factory:  ResourceLoadBalancer,
@@ -156,4 +161,6 @@ func (p *servicePackage) ServicePackageName() string {
 	return names.Lightsail
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/lightsail/static_ip.go b/internal/service/lightsail/static_ip.go
index e454d42c59f..33de8d725ee 100644
--- a/internal/service/lightsail/static_ip.go
+++ b/internal/service/lightsail/static_ip.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lightsail
 
 import (
diff --git a/internal/service/lightsail/static_ip_attachment.go b/internal/service/lightsail/static_ip_attachment.go
index 2081b8d91af..5ee8a4244e0 100644
--- a/internal/service/lightsail/static_ip_attachment.go
+++ b/internal/service/lightsail/static_ip_attachment.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lightsail
 
 import (
diff --git a/internal/service/lightsail/static_ip_attachment_test.go b/internal/service/lightsail/static_ip_attachment_test.go
index c72957c2c6f..86e82cddfd0 100644
--- a/internal/service/lightsail/static_ip_attachment_test.go
+++ b/internal/service/lightsail/static_ip_attachment_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lightsail_test
 
 import (
diff --git a/internal/service/lightsail/static_ip_test.go b/internal/service/lightsail/static_ip_test.go
index e24b494eaef..786fa5c5319 100644
--- a/internal/service/lightsail/static_ip_test.go
+++ b/internal/service/lightsail/static_ip_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lightsail_test
 
 import (
diff --git a/internal/service/lightsail/status.go b/internal/service/lightsail/status.go
index 17d6eebe3f2..a9520991646 100644
--- a/internal/service/lightsail/status.go
+++ b/internal/service/lightsail/status.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lightsail
 
 import (
diff --git a/internal/service/lightsail/sweep.go b/internal/service/lightsail/sweep.go
index 1660f5094b7..c9f11cf8780 100644
--- a/internal/service/lightsail/sweep.go
+++ b/internal/service/lightsail/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package lightsail
 
@@ -12,9 +12,10 @@ import (
 	"github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv2"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_lightsail_container_service", &resource.Sweeper{
 		Name: "aws_lightsail_container_service",
 		F:    sweepContainerServices,
@@ -33,19 +34,18 @@ func init() {
 
 func sweepContainerServices(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("Error getting client: %s", err)
 	}
 	conn := client.LightsailClient(ctx)
 
 	input := &lightsail.GetContainerServicesInput{}
-	var sweeperErrs *multierror.Error
 	sweepResources := make([]sweep.Sweepable, 0)
 
 	output, err := conn.GetContainerServices(ctx, input)
 
-	if sweep.SkipSweepError(err) {
+	if awsv2.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Lightsail Container Service sweep for %s: %s", region, err)
 		return nil
 	}
@@ -62,25 +62,16 @@ func sweepContainerServices(region string) error {
 		sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
 	}
 
-	if sweep.SkipSweepError(err) {
-		log.Printf("[WARN] Skipping Lightsail Container Services sweep for %s: %s", region, err)
-		return sweeperErrs.ErrorOrNil()
-	}
-
-	if err != nil {
-		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error listing Lightsail Container Services  for %s: %w", region, err))
-	}
-
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
-		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error sweeping Lightsail Container Services for %s: %w", region, err))
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
+		return fmt.Errorf("error sweeping Lightsail Container Services for %s: %w", region, err)
 	}
 
-	return sweeperErrs.ErrorOrNil()
+	return nil
 }
 
 func sweepInstances(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("Error getting client: %s", err)
 	}
@@ -92,7 +83,7 @@ func sweepInstances(region string) error {
 	for {
 		output, err := conn.GetInstances(ctx, input)
 
-		if sweep.SkipSweepError(err) {
+		if awsv2.SkipSweepError(err) {
 			log.Printf("[WARN] Skipping Lightsail Instance sweep for %s: %s", region, err)
 			return nil
 		}
@@ -129,7 +120,7 @@ func sweepInstances(region string) error {
 
 func sweepStaticIPs(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("Error getting client: %s", err)
 	}
@@ -140,7 +131,7 @@ func sweepStaticIPs(region string) error {
 	for {
 		output, err := conn.GetStaticIps(ctx, input)
 		if err != nil {
-			if sweep.SkipSweepError(err) {
+			if awsv2.SkipSweepError(err) {
 				log.Printf("[WARN] Skipping Lightsail Static IP sweep for %s: %s", region, err)
 				return nil
 			}
diff --git a/internal/service/lightsail/tags_gen.go b/internal/service/lightsail/tags_gen.go
index 4b685fff261..fbc7b434a8d 100644
--- a/internal/service/lightsail/tags_gen.go
+++ b/internal/service/lightsail/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/lightsail"
 	awstypes "github.com/aws/aws-sdk-go-v2/service/lightsail/types"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -62,6 +64,15 @@ func setTagsOut(ctx context.Context, tags []awstypes.Tag) {
 	}
 }
 
+// createTags creates lightsail service tags for new resources.
+func createTags(ctx context.Context, conn *lightsail.Client, identifier string, tags []awstypes.Tag) error {
+	if len(tags) == 0 {
+		return nil
+	}
+
+	return updateTags(ctx, conn, identifier, nil, KeyValueTags(ctx, tags))
+}
+
 // updateTags updates lightsail service tags.
 // The identifier is typically the Amazon Resource Name (ARN), although
 // it may also be a different identifier depending on the service.
@@ -69,6 +80,8 @@ func updateTags(ctx context.Context, conn *lightsail.Client, identifier string,
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.Lightsail)
 	if len(removedTags) > 0 {
diff --git a/internal/service/lightsail/wait.go b/internal/service/lightsail/wait.go
index 729e8d503c5..521763b98c8 100644
--- a/internal/service/lightsail/wait.go
+++ b/internal/service/lightsail/wait.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package lightsail
 
 import (
diff --git a/internal/service/location/generate.go b/internal/service/location/generate.go
index 8f7101c0f7a..b4c3fc3bbdd 100644
--- a/internal/service/location/generate.go
+++ b/internal/service/location/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ServiceTagsMap -UpdateTags -ListTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/location/geofence_collection.go b/internal/service/location/geofence_collection.go
index aa2a737309a..f8962a69845 100644
--- a/internal/service/location/geofence_collection.go
+++ b/internal/service/location/geofence_collection.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package location
 
 import (
diff --git a/internal/service/location/geofence_collection_data_source.go b/internal/service/location/geofence_collection_data_source.go
index b9b86cae478..4ada93f47b1 100644
--- a/internal/service/location/geofence_collection_data_source.go
+++ b/internal/service/location/geofence_collection_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package location
 
 import (
diff --git a/internal/service/location/geofence_collection_data_source_test.go b/internal/service/location/geofence_collection_data_source_test.go
index 4c1607c59b2..a9103e679a5 100644
--- a/internal/service/location/geofence_collection_data_source_test.go
+++ b/internal/service/location/geofence_collection_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package location_test
 
 import (
diff --git a/internal/service/location/geofence_collection_test.go b/internal/service/location/geofence_collection_test.go
index 982ca5110ee..df948a73aed 100644
--- a/internal/service/location/geofence_collection_test.go
+++ b/internal/service/location/geofence_collection_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package location_test
 
 import (
diff --git a/internal/service/location/map.go b/internal/service/location/map.go
index 3e855a8f282..b8868c0a733 100644
--- a/internal/service/location/map.go
+++ b/internal/service/location/map.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package location
 
 import (
diff --git a/internal/service/location/map_data_source.go b/internal/service/location/map_data_source.go
index 8c6b6a63452..8a0f8a6e94c 100644
--- a/internal/service/location/map_data_source.go
+++ b/internal/service/location/map_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package location
 
 import (
diff --git a/internal/service/location/map_data_source_test.go b/internal/service/location/map_data_source_test.go
index b4e4f263bc3..47bd0c8f897 100644
--- a/internal/service/location/map_data_source_test.go
+++ b/internal/service/location/map_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package location_test
 
 import (
diff --git a/internal/service/location/map_test.go b/internal/service/location/map_test.go
index e55d99e8272..5d34a8094dc 100644
--- a/internal/service/location/map_test.go
+++ b/internal/service/location/map_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package location_test
 
 import (
diff --git a/internal/service/location/place_index.go b/internal/service/location/place_index.go
index 894d526945c..6ba3436a0ca 100644
--- a/internal/service/location/place_index.go
+++ b/internal/service/location/place_index.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package location
 
 import (
diff --git a/internal/service/location/place_index_data_source.go b/internal/service/location/place_index_data_source.go
index 4443a09885d..9b90d7c9bb4 100644
--- a/internal/service/location/place_index_data_source.go
+++ b/internal/service/location/place_index_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package location
 
 import (
diff --git a/internal/service/location/place_index_data_source_test.go b/internal/service/location/place_index_data_source_test.go
index 2fb371440b0..70b8cfd79a3 100644
--- a/internal/service/location/place_index_data_source_test.go
+++ b/internal/service/location/place_index_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package location_test
 
 import (
diff --git a/internal/service/location/place_index_test.go b/internal/service/location/place_index_test.go
index b5b1a82ed0d..dda9fbad032 100644
--- a/internal/service/location/place_index_test.go
+++ b/internal/service/location/place_index_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package location_test
 
 import (
diff --git a/internal/service/location/route_calculator.go b/internal/service/location/route_calculator.go
index baf6ad88f4e..8caaf7dbc6c 100644
--- a/internal/service/location/route_calculator.go
+++ b/internal/service/location/route_calculator.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package location
 
 import (
diff --git a/internal/service/location/route_calculator_data_source.go b/internal/service/location/route_calculator_data_source.go
index 7c0f7f03840..e419f8cdd21 100644
--- a/internal/service/location/route_calculator_data_source.go
+++ b/internal/service/location/route_calculator_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package location
 
 import (
diff --git a/internal/service/location/route_calculator_data_source_test.go b/internal/service/location/route_calculator_data_source_test.go
index cb25a219a4d..6ac8100697b 100644
--- a/internal/service/location/route_calculator_data_source_test.go
+++ b/internal/service/location/route_calculator_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package location_test
 
 import (
diff --git a/internal/service/location/route_calculator_test.go b/internal/service/location/route_calculator_test.go
index b79e1f316cc..38a8c63b42a 100644
--- a/internal/service/location/route_calculator_test.go
+++ b/internal/service/location/route_calculator_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package location_test
 
 import (
diff --git a/internal/service/location/service_package_gen.go b/internal/service/location/service_package_gen.go
index 882fdc62bd4..e913d27b0bc 100644
--- a/internal/service/location/service_package_gen.go
+++ b/internal/service/location/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	locationservice_sdkv1 "github.com/aws/aws-sdk-go/service/locationservice"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -115,4 +116,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*l
 	return locationservice_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/location/sweep.go b/internal/service/location/sweep.go
index 7dfe5ee8e9e..b31cd6ab7a9 100644
--- a/internal/service/location/sweep.go
+++ b/internal/service/location/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package location
 
@@ -12,9 +12,10 @@ import (
 	"github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_location_geofence_collection", &resource.Sweeper{
 		Name: "aws_location_geofence_collection",
 		F:    sweepGeofenceCollections,
@@ -48,7 +49,7 @@ func init() {
 
 func sweepGeofenceCollections(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
@@ -82,11 +83,11 @@ func sweepGeofenceCollections(region string) error {
 		errs = multierror.Append(errs, fmt.Errorf("error listing Location Service Geofence Collection for %s: %w", region, err))
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("error sweeping Location Service Geofence Collection for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Location Service Geofence Collection sweep for %s: %s", region, errs)
 		return nil
 	}
@@ -96,7 +97,7 @@ func sweepGeofenceCollections(region string) error {
 
 func sweepMaps(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
@@ -130,11 +131,11 @@ func sweepMaps(region string) error {
 		errs = multierror.Append(errs, fmt.Errorf("error listing Location Service Map for %s: %w", region, err))
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("error sweeping Location Service Map for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Location Service Map sweep for %s: %s", region, errs)
 		return nil
 	}
@@ -144,7 +145,7 @@ func sweepMaps(region string) error {
 
 func sweepPlaceIndexes(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
@@ -178,11 +179,11 @@ func sweepPlaceIndexes(region string) error {
 		errs = multierror.Append(errs, fmt.Errorf("error listing Location Service Place Index for %s: %w", region, err))
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("error sweeping Location Service Place Index for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Location Service Place Index sweep for %s: %s", region, errs)
 		return nil
 	}
@@ -192,7 +193,7 @@ func sweepPlaceIndexes(region string) error {
 
 func sweepRouteCalculators(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
@@ -226,11 +227,11 @@ func sweepRouteCalculators(region string) error {
 		errs = multierror.Append(errs, fmt.Errorf("error listing Location Service Route Calculator for %s: %w", region, err))
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("error sweeping Location Service Route Calculator for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Location Service Route Calculator sweep for %s: %s", region, errs)
 		return nil
 	}
@@ -240,7 +241,7 @@ func sweepRouteCalculators(region string) error {
 
 func sweepTrackers(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
@@ -274,11 +275,11 @@ func sweepTrackers(region string) error {
 		errs = multierror.Append(errs, fmt.Errorf("error listing Location Service Tracker for %s: %w", region, err))
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("error sweeping Location Service Tracker for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Location Service Tracker sweep for %s: %s", region, errs)
 		return nil
 	}
@@ -288,7 +289,7 @@ func sweepTrackers(region string) error {
 
 func sweepTrackerAssociations(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
@@ -339,11 +340,11 @@ func sweepTrackerAssociations(region string) error {
 		errs = multierror.Append(errs, fmt.Errorf("error listing Location Service Tracker for %s: %w", region, err))
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("error sweeping Location Service Tracker Association for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Location Service Tracker Association sweep for %s: %s", region, errs)
 		return nil
 	}
diff --git a/internal/service/location/tags_gen.go b/internal/service/location/tags_gen.go
index a8cc88f3a3a..da39ba34b68 100644
--- a/internal/service/location/tags_gen.go
+++ b/internal/service/location/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/locationservice"
 	"github.com/aws/aws-sdk-go/service/locationservice/locationserviceiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -54,7 +56,7 @@ func Tags(tags tftags.KeyValueTags) map[string]*string {
 	return aws.StringMap(tags.Map())
 }
 
-// KeyValueTags creates KeyValueTags from location service tags.
+// KeyValueTags creates tftags.KeyValueTags from location service tags.
 func KeyValueTags(ctx context.Context, tags map[string]*string) tftags.KeyValueTags {
 	return tftags.New(ctx, tags)
 }
@@ -85,6 +87,8 @@ func updateTags(ctx context.Context, conn locationserviceiface.LocationServiceAP
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.Location)
 	if len(removedTags) > 0 {
diff --git a/internal/service/location/tracker.go b/internal/service/location/tracker.go
index 5c594cfbd9b..c2b7e894976 100644
--- a/internal/service/location/tracker.go
+++ b/internal/service/location/tracker.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package location
 
 import (
diff --git a/internal/service/location/tracker_association.go b/internal/service/location/tracker_association.go
index 4e17aa18ab7..458ed7fa5c9 100644
--- a/internal/service/location/tracker_association.go
+++ b/internal/service/location/tracker_association.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package location
 
 import (
diff --git a/internal/service/location/tracker_association_data_source.go b/internal/service/location/tracker_association_data_source.go
index fcbc435481d..2c7c248ce25 100644
--- a/internal/service/location/tracker_association_data_source.go
+++ b/internal/service/location/tracker_association_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package location
 
 import (
diff --git a/internal/service/location/tracker_association_data_source_test.go b/internal/service/location/tracker_association_data_source_test.go
index 47f0770a188..b6c383f2cdf 100644
--- a/internal/service/location/tracker_association_data_source_test.go
+++ b/internal/service/location/tracker_association_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package location_test
 
 import (
diff --git a/internal/service/location/tracker_association_test.go b/internal/service/location/tracker_association_test.go
index e2e5e4bf1c3..1dc8c137858 100644
--- a/internal/service/location/tracker_association_test.go
+++ b/internal/service/location/tracker_association_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package location_test
 
 import (
diff --git a/internal/service/location/tracker_associations_data_source.go b/internal/service/location/tracker_associations_data_source.go
index 9a8a442308c..9bf7ab09b80 100644
--- a/internal/service/location/tracker_associations_data_source.go
+++ b/internal/service/location/tracker_associations_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package location
 
 import (
diff --git a/internal/service/location/tracker_associations_data_source_test.go b/internal/service/location/tracker_associations_data_source_test.go
index 969ba8e16bf..33675eb3544 100644
--- a/internal/service/location/tracker_associations_data_source_test.go
+++ b/internal/service/location/tracker_associations_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package location_test
 
 import (
diff --git a/internal/service/location/tracker_data_source.go b/internal/service/location/tracker_data_source.go
index ee314823a25..f3cd24651c2 100644
--- a/internal/service/location/tracker_data_source.go
+++ b/internal/service/location/tracker_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package location
 
 import (
diff --git a/internal/service/location/tracker_data_source_test.go b/internal/service/location/tracker_data_source_test.go
index 6bfe19bdfa7..6bab25d0192 100644
--- a/internal/service/location/tracker_data_source_test.go
+++ b/internal/service/location/tracker_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package location_test
 
 import (
diff --git a/internal/service/location/tracker_test.go b/internal/service/location/tracker_test.go
index 18a0d215a3c..b8010536da4 100644
--- a/internal/service/location/tracker_test.go
+++ b/internal/service/location/tracker_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package location_test
 
 import (
diff --git a/internal/service/logs/arn.go b/internal/service/logs/arn.go
index 275e3d9252b..77e238ca8dd 100644
--- a/internal/service/logs/arn.go
+++ b/internal/service/logs/arn.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package logs
 
 import (
diff --git a/internal/service/logs/arn_test.go b/internal/service/logs/arn_test.go
index c8130b9a726..f164cbbe007 100644
--- a/internal/service/logs/arn_test.go
+++ b/internal/service/logs/arn_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package logs_test
 
 import (
diff --git a/internal/service/logs/data_protection_policy.go b/internal/service/logs/data_protection_policy.go
index d93f0f0c400..873b9843dff 100644
--- a/internal/service/logs/data_protection_policy.go
+++ b/internal/service/logs/data_protection_policy.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package logs
 
 import (
diff --git a/internal/service/logs/data_protection_policy_document_data_source.go b/internal/service/logs/data_protection_policy_document_data_source.go
index 8680f8bc85c..ae30b9ac07c 100644
--- a/internal/service/logs/data_protection_policy_document_data_source.go
+++ b/internal/service/logs/data_protection_policy_document_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package logs
 
 import (
diff --git a/internal/service/logs/data_protection_policy_document_data_source_test.go b/internal/service/logs/data_protection_policy_document_data_source_test.go
index 9aacb6c3533..631aa68709e 100644
--- a/internal/service/logs/data_protection_policy_document_data_source_test.go
+++ b/internal/service/logs/data_protection_policy_document_data_source_test.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package logs_test
 
 import (
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
@@ -66,7 +69,7 @@ func TestAccLogsDataProtectionPolicyDocumentDataSource_errorOnBadOrderOfStatemen
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccDataProtectionPolicyDocumentDataSourceConfig_errorOnBadOrderOfStatements,
-				ExpectError: regexp.MustCompile(`the first policy statement must contain only the audit operation`),
+				ExpectError: regexache.MustCompile(`the first policy statement must contain only the audit operation`),
 			},
 		},
 	})
@@ -82,7 +85,7 @@ func TestAccLogsDataProtectionPolicyDocumentDataSource_errorOnNoOperation(t *tes
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccDataProtectionPolicyDocumentDataSourceConfig_errorOnNoOperation,
-				ExpectError: regexp.MustCompile(`the second policy statement must contain only the deidentify operation`),
+				ExpectError: regexache.MustCompile(`the second policy statement must contain only the deidentify operation`),
 			},
 		},
 	})
diff --git a/internal/service/logs/data_protection_policy_test.go b/internal/service/logs/data_protection_policy_test.go
index 7cc73d50c31..23dda5f96b6 100644
--- a/internal/service/logs/data_protection_policy_test.go
+++ b/internal/service/logs/data_protection_policy_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package logs_test
 
 import (
diff --git a/internal/service/logs/destination.go b/internal/service/logs/destination.go
index 41155e13053..f131c21849b 100644
--- a/internal/service/logs/destination.go
+++ b/internal/service/logs/destination.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package logs
 
 import (
 	"context"
 	"log"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/cloudwatchlogs"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -43,7 +46,7 @@ func resourceDestination() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.Any(
 					validation.StringLenBetween(1, 512),
-					validation.StringMatch(regexp.MustCompile(`[^:*]*`), ""),
+					validation.StringMatch(regexache.MustCompile(`[^:*]*`), ""),
 				),
 			},
 			"role_arn": {
diff --git a/internal/service/logs/destination_policy.go b/internal/service/logs/destination_policy.go
index 5e912e467c2..c6e329444e6 100644
--- a/internal/service/logs/destination_policy.go
+++ b/internal/service/logs/destination_policy.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package logs
 
 import (
diff --git a/internal/service/logs/destination_policy_test.go b/internal/service/logs/destination_policy_test.go
index 158781d8d47..4b5a59d6b7a 100644
--- a/internal/service/logs/destination_policy_test.go
+++ b/internal/service/logs/destination_policy_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package logs_test
 
 import (
diff --git a/internal/service/logs/destination_test.go b/internal/service/logs/destination_test.go
index 07c9da54396..87d04ad70cf 100644
--- a/internal/service/logs/destination_test.go
+++ b/internal/service/logs/destination_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package logs_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/cloudwatchlogs"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -34,7 +37,7 @@ func TestAccLogsDestination_basic(t *testing.T) {
 				Config: testAccDestinationConfig_basic(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckDestinationExists(ctx, resourceName, &destination),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "logs", regexp.MustCompile(`destination:.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "logs", regexache.MustCompile(`destination:.+`)),
 					resource.TestCheckResourceAttrPair(resourceName, "role_arn", roleResourceName, "arn"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 					resource.TestCheckResourceAttrPair(resourceName, "target_arn", streamResourceName, "arn"),
diff --git a/internal/service/logs/exports_test.go b/internal/service/logs/exports_test.go
index c416d0831d7..ddc80b16bd6 100644
--- a/internal/service/logs/exports_test.go
+++ b/internal/service/logs/exports_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package logs
 
 // Exports for use in tests only.
diff --git a/internal/service/logs/generate.go b/internal/service/logs/generate.go
index c171abba93a..4393f4b208b 100644
--- a/internal/service/logs/generate.go
+++ b/internal/service/logs/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/listpages/main.go -ListOps=DescribeQueryDefinitions,DescribeResourcePolicies
 //go:generate go run ../../generate/tags/main.go -ListTags -ServiceTagsMap -UpdateTags -CreateTags
 //go:generate go run ../../generate/tags/main.go -ListTags -ListTagsOp=ListTagsLogGroup -ListTagsInIDElem=LogGroupName -ListTagsFunc=listLogGroupTags -TagOp=TagLogGroup -TagInIDElem=LogGroupName -UntagOp=UntagLogGroup -UntagInTagsElem=Tags -UpdateTags -UpdateTagsFunc=updateLogGroupTags -- log_group_tags_gen.go
diff --git a/internal/service/logs/group.go b/internal/service/logs/group.go
index 7ea9a25aeab..3f1ecee3cc7 100644
--- a/internal/service/logs/group.go
+++ b/internal/service/logs/group.go
@@ -1,8 +1,12 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package logs
 
 import (
 	"context"
 	"log"
+	"time"
 
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/cloudwatchlogs"
@@ -215,9 +219,11 @@ func resourceGroupDelete(ctx context.Context, d *schema.ResourceData, meta inter
 	conn := meta.(*conns.AWSClient).LogsConn(ctx)
 
 	log.Printf("[INFO] Deleting CloudWatch Logs Log Group: %s", d.Id())
-	_, err := conn.DeleteLogGroupWithContext(ctx, &cloudwatchlogs.DeleteLogGroupInput{
-		LogGroupName: aws.String(d.Id()),
-	})
+	_, err := tfresource.RetryWhenAWSErrMessageContains(ctx, 1*time.Minute, func() (interface{}, error) {
+		return conn.DeleteLogGroupWithContext(ctx, &cloudwatchlogs.DeleteLogGroupInput{
+			LogGroupName: aws.String(d.Id()),
+		})
+	}, cloudwatchlogs.ErrCodeOperationAbortedException, "try again")
 
 	if tfawserr.ErrCodeEquals(err, cloudwatchlogs.ErrCodeResourceNotFoundException) {
 		return nil
diff --git a/internal/service/logs/group_data_source.go b/internal/service/logs/group_data_source.go
index 95564a23f4f..d1c8bdd6e81 100644
--- a/internal/service/logs/group_data_source.go
+++ b/internal/service/logs/group_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package logs
 
 import (
diff --git a/internal/service/logs/group_data_source_test.go b/internal/service/logs/group_data_source_test.go
index 9f0d5ec346f..b698170ac65 100644
--- a/internal/service/logs/group_data_source_test.go
+++ b/internal/service/logs/group_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package logs_test
 
 import (
diff --git a/internal/service/logs/group_test.go b/internal/service/logs/group_test.go
index 2bd6bcd4982..21ba06e9c44 100644
--- a/internal/service/logs/group_test.go
+++ b/internal/service/logs/group_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package logs_test
 
 import (
@@ -101,7 +104,7 @@ func TestAccLogsGroup_namePrefix(t *testing.T) {
 				ResourceName:            resourceName,
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"retention_in_days", "skip_destroy", "name_prefix"},
+				ImportStateVerifyIgnore: []string{"retention_in_days", "skip_destroy"},
 			},
 		},
 	})
diff --git a/internal/service/logs/groups_data_source.go b/internal/service/logs/groups_data_source.go
index 6bf34249226..7edb674bc7a 100644
--- a/internal/service/logs/groups_data_source.go
+++ b/internal/service/logs/groups_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package logs
 
 import (
diff --git a/internal/service/logs/groups_data_source_test.go b/internal/service/logs/groups_data_source_test.go
index 5a76761e586..af7e8ba2ede 100644
--- a/internal/service/logs/groups_data_source_test.go
+++ b/internal/service/logs/groups_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package logs_test
 
 import (
diff --git a/internal/service/logs/log_group_tags_gen.go b/internal/service/logs/log_group_tags_gen.go
index 999146a7e79..a29e8685b51 100644
--- a/internal/service/logs/log_group_tags_gen.go
+++ b/internal/service/logs/log_group_tags_gen.go
@@ -8,6 +8,8 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/cloudwatchlogs"
 	"github.com/aws/aws-sdk-go/service/cloudwatchlogs/cloudwatchlogsiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -36,6 +38,8 @@ func updateLogGroupTags(ctx context.Context, conn cloudwatchlogsiface.CloudWatch
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.Logs)
 	if len(removedTags) > 0 {
diff --git a/internal/service/logs/metric_filter.go b/internal/service/logs/metric_filter.go
index 03c1e599471..ad17c0b3a0b 100644
--- a/internal/service/logs/metric_filter.go
+++ b/internal/service/logs/metric_filter.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package logs
 
 import (
@@ -15,9 +18,9 @@ import (
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
-	"github.com/hashicorp/terraform-provider-aws/internal/experimental/nullable"
 	"github.com/hashicorp/terraform-provider-aws/internal/flex"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/internal/types/nullable"
 )
 
 // @SDKResource("aws_cloudwatch_log_metric_filter")
diff --git a/internal/service/logs/metric_filter_test.go b/internal/service/logs/metric_filter_test.go
index ece3244507d..8d6a824cf8e 100644
--- a/internal/service/logs/metric_filter_test.go
+++ b/internal/service/logs/metric_filter_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package logs_test
 
 import (
diff --git a/internal/service/logs/query_definition.go b/internal/service/logs/query_definition.go
index 78a21c322e5..fcef87d69a0 100644
--- a/internal/service/logs/query_definition.go
+++ b/internal/service/logs/query_definition.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package logs
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/aws/aws-sdk-go/service/cloudwatchlogs"
@@ -37,7 +40,7 @@ func resourceQueryDefinition() *schema.Resource {
 				Required: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 255),
-					validation.StringMatch(regexp.MustCompile(`^([^:*\/]+\/?)*[^:*\/]+$`), "cannot contain a colon or asterisk and cannot start or end with a slash"),
+					validation.StringMatch(regexache.MustCompile(`^([^:*\/]+\/?)*[^:*\/]+$`), "cannot contain a colon or asterisk and cannot start or end with a slash"),
 				),
 			},
 			"log_group_names": {
@@ -142,7 +145,7 @@ func resourceQueryDefinitionImport(ctx context.Context, d *schema.ResourceData,
 		return nil, fmt.Errorf("unexpected format for ID (%s), expected a CloudWatch query definition ARN", d.Id())
 	}
 
-	matcher := regexp.MustCompile("^query-definition:(" + verify.UUIDRegexPattern + ")$")
+	matcher := regexache.MustCompile("^query-definition:(" + verify.UUIDRegexPattern + ")$")
 	matches := matcher.FindStringSubmatch(arn.Resource)
 	if len(matches) != 2 {
 		return nil, fmt.Errorf("unexpected format for ID (%s), expected a CloudWatch query definition ARN", d.Id())
diff --git a/internal/service/logs/query_definition_test.go b/internal/service/logs/query_definition_test.go
index 302374488a8..9b0297330fe 100644
--- a/internal/service/logs/query_definition_test.go
+++ b/internal/service/logs/query_definition_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package logs_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/aws/aws-sdk-go/service/cloudwatchlogs"
@@ -43,7 +46,7 @@ func TestAccLogsQueryDefinition_basic(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "name", queryName),
 					resource.TestCheckResourceAttr(resourceName, "query_string", expectedQueryString),
 					resource.TestCheckResourceAttr(resourceName, "log_group_names.#", "0"),
-					resource.TestMatchResourceAttr(resourceName, "query_definition_id", regexp.MustCompile(verify.UUIDRegexPattern)),
+					resource.TestMatchResourceAttr(resourceName, "query_definition_id", regexache.MustCompile(verify.UUIDRegexPattern)),
 				),
 			},
 			{
diff --git a/internal/service/logs/resource_policy.go b/internal/service/logs/resource_policy.go
index 08418877026..f07d02e81b3 100644
--- a/internal/service/logs/resource_policy.go
+++ b/internal/service/logs/resource_policy.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package logs
 
 import (
diff --git a/internal/service/logs/resource_policy_test.go b/internal/service/logs/resource_policy_test.go
index dfced40c75c..2731b2a9a8a 100644
--- a/internal/service/logs/resource_policy_test.go
+++ b/internal/service/logs/resource_policy_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package logs_test
 
 import (
@@ -32,7 +35,7 @@ func TestAccLogsResourcePolicy_basic(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckResourcePolicyExists(ctx, resourceName, &resourcePolicy),
 					resource.TestCheckResourceAttr(resourceName, "policy_name", rName),
-					resource.TestCheckResourceAttr(resourceName, "policy_document", fmt.Sprintf("{\"Statement\":[{\"Action\":[\"logs:PutLogEvents\",\"logs:CreateLogStream\"],\"Effect\":\"Allow\",\"Principal\":{\"Service\":\"rds.%s\"},\"Resource\":\"arn:%s:logs:*:*:log-group:/aws/rds/*\",\"Sid\":\"\"}],\"Version\":\"2012-10-17\"}", acctest.PartitionDNSSuffix(), acctest.Partition())),
+					resource.TestCheckResourceAttr(resourceName, "policy_document", fmt.Sprintf("{\"Statement\":[{\"Action\":[\"logs:PutLogEvents\",\"logs:CreateLogStream\"],\"Effect\":\"Allow\",\"Principal\":{\"Service\":\"rds.%s\"},\"Resource\":\"arn:%s:logs:*:*:log-group:/aws/rds/*\"}],\"Version\":\"2012-10-17\"}", acctest.PartitionDNSSuffix(), acctest.Partition())),
 				),
 			},
 			{
@@ -45,7 +48,7 @@ func TestAccLogsResourcePolicy_basic(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckResourcePolicyExists(ctx, resourceName, &resourcePolicy),
 					resource.TestCheckResourceAttr(resourceName, "policy_name", rName),
-					resource.TestCheckResourceAttr(resourceName, "policy_document", fmt.Sprintf("{\"Statement\":[{\"Action\":[\"logs:PutLogEvents\",\"logs:CreateLogStream\"],\"Effect\":\"Allow\",\"Principal\":{\"Service\":\"rds.%s\"},\"Resource\":\"arn:%s:logs:*:*:log-group:/aws/rds/example.com\",\"Sid\":\"\"}],\"Version\":\"2012-10-17\"}", acctest.PartitionDNSSuffix(), acctest.Partition())),
+					resource.TestCheckResourceAttr(resourceName, "policy_document", fmt.Sprintf("{\"Statement\":[{\"Action\":[\"logs:PutLogEvents\",\"logs:CreateLogStream\"],\"Effect\":\"Allow\",\"Principal\":{\"Service\":\"rds.%s\"},\"Resource\":\"arn:%s:logs:*:*:log-group:/aws/rds/example.com\"}],\"Version\":\"2012-10-17\"}", acctest.PartitionDNSSuffix(), acctest.Partition())),
 				),
 			},
 		},
diff --git a/internal/service/logs/service_package_gen.go b/internal/service/logs/service_package_gen.go
index 35d5240f102..834f09e3d35 100644
--- a/internal/service/logs/service_package_gen.go
+++ b/internal/service/logs/service_package_gen.go
@@ -10,6 +10,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	cloudwatchlogs_sdkv1 "github.com/aws/aws-sdk-go/service/cloudwatchlogs"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -105,9 +106,11 @@ func (p *servicePackage) NewClient(ctx context.Context, config map[string]any) (
 
 	return cloudwatchlogs_sdkv2.NewFromConfig(cfg, func(o *cloudwatchlogs_sdkv2.Options) {
 		if endpoint := config["endpoint"].(string); endpoint != "" {
-			o.EndpointResolver = cloudwatchlogs_sdkv2.EndpointResolverFromURL(endpoint)
+			o.BaseEndpoint = aws_sdkv2.String(endpoint)
 		}
 	}), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/logs/stream.go b/internal/service/logs/stream.go
index a61957db5fa..af4a69b1090 100644
--- a/internal/service/logs/stream.go
+++ b/internal/service/logs/stream.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package logs
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"strings"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/cloudwatchlogs"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -175,7 +178,7 @@ func FindLogStreamByTwoPartKey(ctx context.Context, conn *cloudwatchlogs.CloudWa
 
 func validStreamName(v interface{}, k string) (ws []string, errors []error) {
 	value := v.(string)
-	if regexp.MustCompile(`:`).MatchString(value) {
+	if regexache.MustCompile(`:`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"colons not allowed in %q:", k))
 	}
diff --git a/internal/service/logs/stream_test.go b/internal/service/logs/stream_test.go
index de3bbc66292..a4531bf883e 100644
--- a/internal/service/logs/stream_test.go
+++ b/internal/service/logs/stream_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package logs_test
 
 import (
diff --git a/internal/service/logs/subscription_filter.go b/internal/service/logs/subscription_filter.go
index 20de953ead1..207be80ae67 100644
--- a/internal/service/logs/subscription_filter.go
+++ b/internal/service/logs/subscription_filter.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package logs
 
 import (
diff --git a/internal/service/logs/subscription_filter_test.go b/internal/service/logs/subscription_filter_test.go
index b20433b853e..e46fe874cf7 100644
--- a/internal/service/logs/subscription_filter_test.go
+++ b/internal/service/logs/subscription_filter_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package logs_test
 
 import (
@@ -457,11 +460,6 @@ resource "aws_s3_bucket" "test" {
   bucket        = %[1]q
   force_destroy = true
 }
-
-resource "aws_s3_bucket_acl" "test" {
-  bucket = aws_s3_bucket.test.id
-  acl    = "private"
-}
 `, rName)
 }
 
diff --git a/internal/service/logs/sweep.go b/internal/service/logs/sweep.go
index dc1b5dc726a..0cd390e06e3 100644
--- a/internal/service/logs/sweep.go
+++ b/internal/service/logs/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package logs
 
@@ -11,9 +11,10 @@ import (
 	"github.com/aws/aws-sdk-go/service/cloudwatchlogs"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_cloudwatch_log_group", &resource.Sweeper{
 		Name: "aws_cloudwatch_log_group",
 		F:    sweepGroups,
@@ -54,7 +55,7 @@ func init() {
 
 func sweepGroups(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("getting client: %s", err)
 	}
@@ -78,7 +79,7 @@ func sweepGroups(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping CloudWatch Logs Log Group sweep for %s: %s", region, err)
 		return nil
 	}
@@ -87,7 +88,7 @@ func sweepGroups(region string) error {
 		return fmt.Errorf("error listing CloudWatch Logs Log Groups (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping CloudWatch Logs Log Groups (%s): %w", region, err)
@@ -98,7 +99,7 @@ func sweepGroups(region string) error {
 
 func sweeplogQueryDefinitions(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("getting client: %s", err)
 	}
@@ -122,7 +123,7 @@ func sweeplogQueryDefinitions(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping CloudWatch Logs Query Definition sweep for %s: %s", region, err)
 		return nil
 	}
@@ -131,7 +132,7 @@ func sweeplogQueryDefinitions(region string) error {
 		return fmt.Errorf("error listing CloudWatch Logs Query Definitions (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping CloudWatch Logs Query Definitions (%s): %w", region, err)
@@ -142,7 +143,7 @@ func sweeplogQueryDefinitions(region string) error {
 
 func sweepResourcePolicies(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("getting client: %s", err)
 	}
@@ -166,7 +167,7 @@ func sweepResourcePolicies(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping CloudWatch Logs Resource Policy sweep for %s: %s", region, err)
 		return nil
 	}
@@ -175,7 +176,7 @@ func sweepResourcePolicies(region string) error {
 		return fmt.Errorf("error listing CloudWatch Logs Resource Policies (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping CloudWatch Logs Resource Policies (%s): %w", region, err)
diff --git a/internal/service/logs/tags_gen.go b/internal/service/logs/tags_gen.go
index 5a5006e520c..e73ef0791fb 100644
--- a/internal/service/logs/tags_gen.go
+++ b/internal/service/logs/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/cloudwatchlogs"
 	"github.com/aws/aws-sdk-go/service/cloudwatchlogs/cloudwatchlogsiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -54,7 +56,7 @@ func Tags(tags tftags.KeyValueTags) map[string]*string {
 	return aws.StringMap(tags.Map())
 }
 
-// KeyValueTags creates KeyValueTags from logs service tags.
+// KeyValueTags creates tftags.KeyValueTags from logs service tags.
 func KeyValueTags(ctx context.Context, tags map[string]*string) tftags.KeyValueTags {
 	return tftags.New(ctx, tags)
 }
@@ -94,6 +96,8 @@ func updateTags(ctx context.Context, conn cloudwatchlogsiface.CloudWatchLogsAPI,
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.Logs)
 	if len(removedTags) > 0 {
diff --git a/internal/service/logs/validate.go b/internal/service/logs/validate.go
index a8c92fdd487..1cf142c0d3c 100644
--- a/internal/service/logs/validate.go
+++ b/internal/service/logs/validate.go
@@ -1,9 +1,12 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package logs
 
 import (
 	"fmt"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/structure"
 )
 
@@ -28,8 +31,8 @@ func validLogGroupName(v interface{}, k string) (ws []string, errors []error) {
 	}
 
 	// http://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_CreateLogGroup.html
-	pattern := `^[\.\-_/#A-Za-z0-9]+$`
-	if !regexp.MustCompile(pattern).MatchString(value) {
+	pattern := `^[0-9A-Za-z_./#-]+$`
+	if !regexache.MustCompile(pattern).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"%q isn't a valid log group name (alphanumeric characters, underscores,"+
 				" hyphens, slashes, hash signs and dots are allowed): %q",
@@ -48,8 +51,8 @@ func validLogGroupNamePrefix(v interface{}, k string) (ws []string, errors []err
 	}
 
 	// http://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_CreateLogGroup.html
-	pattern := `^[\.\-_/#A-Za-z0-9]+$`
-	if !regexp.MustCompile(pattern).MatchString(value) {
+	pattern := `^[0-9A-Za-z_./#-]+$`
+	if !regexache.MustCompile(pattern).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"%q isn't a valid log group name (alphanumeric characters, underscores,"+
 				" hyphens, slashes, hash signs and dots are allowed): %q",
@@ -69,7 +72,7 @@ func validLogMetricFilterName(v interface{}, k string) (ws []string, errors []er
 
 	// http://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_PutMetricFilter.html
 	pattern := `^[^:*]+$`
-	if !regexp.MustCompile(pattern).MatchString(value) {
+	if !regexache.MustCompile(pattern).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"%q isn't a valid log metric name (must not contain colon nor asterisk): %q",
 			k, value))
@@ -88,7 +91,7 @@ func validLogMetricFilterTransformationName(v interface{}, k string) (ws []strin
 
 	// http://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_MetricTransformation.html
 	pattern := `^[^:*$]*$`
-	if !regexp.MustCompile(pattern).MatchString(value) {
+	if !regexache.MustCompile(pattern).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"%q isn't a valid log metric transformation name (must not contain"+
 				" colon, asterisk nor dollar sign): %q",
diff --git a/internal/service/logs/validate_test.go b/internal/service/logs/validate_test.go
index 273baa1b543..5ac45579f83 100644
--- a/internal/service/logs/validate_test.go
+++ b/internal/service/logs/validate_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package logs
 
 import (
diff --git a/internal/service/macie2/account.go b/internal/service/macie2/account.go
index 3cd5ed3d0cf..cc7273cdfe8 100644
--- a/internal/service/macie2/account.go
+++ b/internal/service/macie2/account.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package macie2
 
 import (
diff --git a/internal/service/macie2/account_test.go b/internal/service/macie2/account_test.go
index 32dfdb96d27..47519294c49 100644
--- a/internal/service/macie2/account_test.go
+++ b/internal/service/macie2/account_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package macie2_test
 
 import (
diff --git a/internal/service/macie2/classification_export_configuration.go b/internal/service/macie2/classification_export_configuration.go
index e48b09679b2..a4328730baf 100644
--- a/internal/service/macie2/classification_export_configuration.go
+++ b/internal/service/macie2/classification_export_configuration.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package macie2
 
 import (
diff --git a/internal/service/macie2/classification_export_configuration_test.go b/internal/service/macie2/classification_export_configuration_test.go
index 6cf153236e1..6c97bac61d8 100644
--- a/internal/service/macie2/classification_export_configuration_test.go
+++ b/internal/service/macie2/classification_export_configuration_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package macie2_test
 
 import (
diff --git a/internal/service/macie2/classification_job.go b/internal/service/macie2/classification_job.go
index c388c40056a..d56d9acafd9 100644
--- a/internal/service/macie2/classification_job.go
+++ b/internal/service/macie2/classification_job.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package macie2
 
 import (
diff --git a/internal/service/macie2/classification_job_test.go b/internal/service/macie2/classification_job_test.go
index e5003fca432..ad8cd1d151e 100644
--- a/internal/service/macie2/classification_job_test.go
+++ b/internal/service/macie2/classification_job_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package macie2_test
 
 import (
diff --git a/internal/service/macie2/consts.go b/internal/service/macie2/consts.go
index 7205c50923b..a9996d1f235 100644
--- a/internal/service/macie2/consts.go
+++ b/internal/service/macie2/consts.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package macie2
 
 const (
diff --git a/internal/service/macie2/custom_data_identifier.go b/internal/service/macie2/custom_data_identifier.go
index 92a8832eb2f..0100394088e 100644
--- a/internal/service/macie2/custom_data_identifier.go
+++ b/internal/service/macie2/custom_data_identifier.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package macie2
 
 import (
diff --git a/internal/service/macie2/custom_data_identifier_test.go b/internal/service/macie2/custom_data_identifier_test.go
index 99631e3b110..109927850df 100644
--- a/internal/service/macie2/custom_data_identifier_test.go
+++ b/internal/service/macie2/custom_data_identifier_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package macie2_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/macie2"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -37,7 +40,7 @@ func testAccCustomDataIdentifier_basic(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "name_prefix", "terraform-"),
 					acctest.CheckResourceAttrRFC3339(resourceName, "created_at"),
 					resource.TestCheckResourceAttr(resourceName, "regex", regex),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "macie2", regexp.MustCompile(`custom-data-identifier/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "macie2", regexache.MustCompile(`custom-data-identifier/.+`)),
 				),
 			},
 			{
@@ -122,7 +125,7 @@ func testAccCustomDataIdentifier_NamePrefix(t *testing.T) {
 					testAccCheckCustomDataIdentifierExists(ctx, resourceName, &macie2Output),
 					acctest.CheckResourceAttrNameFromPrefix(resourceName, "name", namePrefix),
 					resource.TestCheckResourceAttr(resourceName, "name_prefix", namePrefix),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "macie2", regexp.MustCompile(`custom-data-identifier/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "macie2", regexache.MustCompile(`custom-data-identifier/.+`)),
 				),
 			},
 			{
@@ -156,7 +159,7 @@ func testAccCustomDataIdentifier_WithClassificationJob(t *testing.T) {
 					acctest.CheckResourceAttrNameGenerated(resourceName, "name"),
 					resource.TestCheckResourceAttr(resourceName, "name_prefix", "terraform-"),
 					acctest.CheckResourceAttrRFC3339(resourceName, "created_at"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "macie2", regexp.MustCompile(`custom-data-identifier/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "macie2", regexache.MustCompile(`custom-data-identifier/.+`)),
 				),
 			},
 			{
@@ -166,7 +169,7 @@ func testAccCustomDataIdentifier_WithClassificationJob(t *testing.T) {
 					acctest.CheckResourceAttrNameGenerated(resourceName, "name"),
 					resource.TestCheckResourceAttr(resourceName, "name_prefix", "terraform-"),
 					acctest.CheckResourceAttrRFC3339(resourceName, "created_at"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "macie2", regexp.MustCompile(`custom-data-identifier/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "macie2", regexache.MustCompile(`custom-data-identifier/.+`)),
 				),
 			},
 			{
@@ -206,7 +209,7 @@ func testAccCustomDataIdentifier_WithTags(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "tags_all.Key2", "value2"),
 					resource.TestCheckResourceAttr(resourceName, "tags_all.Key3", "value3"),
 					acctest.CheckResourceAttrRFC3339(resourceName, "created_at"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "macie2", regexp.MustCompile(`custom-data-identifier/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "macie2", regexache.MustCompile(`custom-data-identifier/.+`)),
 				),
 			},
 			{
diff --git a/internal/service/macie2/find.go b/internal/service/macie2/find.go
index 64d00cf77a3..ff85ef997db 100644
--- a/internal/service/macie2/find.go
+++ b/internal/service/macie2/find.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package macie2
 
 import (
diff --git a/internal/service/macie2/findings_filter.go b/internal/service/macie2/findings_filter.go
index c296fca3b13..2f5502a1cc1 100644
--- a/internal/service/macie2/findings_filter.go
+++ b/internal/service/macie2/findings_filter.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package macie2
 
 import (
diff --git a/internal/service/macie2/findings_filter_test.go b/internal/service/macie2/findings_filter_test.go
index ae23213bb10..0ce669c2537 100644
--- a/internal/service/macie2/findings_filter_test.go
+++ b/internal/service/macie2/findings_filter_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package macie2_test
 
 import (
@@ -6,6 +9,7 @@ import (
 	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/macie2"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -34,7 +38,7 @@ func testAccFindingsFilter_basic(t *testing.T) {
 					acctest.CheckResourceAttrNameGenerated(resourceName, "name"),
 					resource.TestCheckResourceAttr(resourceName, "name_prefix", "terraform-"),
 					resource.TestCheckResourceAttr(resourceName, "action", macie2.FindingsFilterActionArchive),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "macie2", regexp.MustCompile(`findings-filter/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "macie2", regexache.MustCompile(`findings-filter/.+`)),
 				),
 			},
 			{
@@ -156,7 +160,7 @@ func testAccFindingsFilter_complete(t *testing.T) {
 						"eq.#":  "1",
 						"eq.0":  acctest.Region(),
 					}),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "macie2", regexp.MustCompile(`findings-filter/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "macie2", regexache.MustCompile(`findings-filter/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "description", description),
 					resource.TestCheckResourceAttr(resourceName, "position", "1"),
 				),
@@ -168,7 +172,7 @@ func testAccFindingsFilter_complete(t *testing.T) {
 					acctest.CheckResourceAttrNameGenerated(resourceName, "name"),
 					resource.TestCheckResourceAttr(resourceName, "name_prefix", "terraform-"),
 					resource.TestCheckResourceAttr(resourceName, "action", macie2.FindingsFilterActionNoop),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "macie2", regexp.MustCompile(`findings-filter/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "macie2", regexache.MustCompile(`findings-filter/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "description", descriptionUpdated),
 					resource.TestCheckResourceAttr(resourceName, "position", "1"),
 					resource.TestCheckResourceAttr(resourceName, "finding_criteria.0.criterion.0.field", "region"),
@@ -187,7 +191,7 @@ func testAccFindingsFilter_complete(t *testing.T) {
 					acctest.CheckResourceAttrNameGenerated(resourceName, "name"),
 					resource.TestCheckResourceAttr(resourceName, "name_prefix", "terraform-"),
 					resource.TestCheckResourceAttr(resourceName, "action", macie2.FindingsFilterActionNoop),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "macie2", regexp.MustCompile(`findings-filter/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "macie2", regexache.MustCompile(`findings-filter/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "description", descriptionUpdated),
 					resource.TestCheckResourceAttr(resourceName, "position", "1"),
 					resource.TestCheckResourceAttr(resourceName, "finding_criteria.0.criterion.0.field", "region"),
@@ -237,7 +241,7 @@ func testAccFindingsFilter_WithDate(t *testing.T) {
 						"eq.#":  "1",
 						"eq.0":  acctest.Region(),
 					}),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "macie2", regexp.MustCompile(`findings-filter/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "macie2", regexache.MustCompile(`findings-filter/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "description", description),
 					resource.TestCheckResourceAttr(resourceName, "position", "1"),
 				),
@@ -249,7 +253,7 @@ func testAccFindingsFilter_WithDate(t *testing.T) {
 					acctest.CheckResourceAttrNameGenerated(resourceName, "name"),
 					resource.TestCheckResourceAttr(resourceName, "name_prefix", "terraform-"),
 					resource.TestCheckResourceAttr(resourceName, "action", macie2.FindingsFilterActionNoop),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "macie2", regexp.MustCompile(`findings-filter/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "macie2", regexache.MustCompile(`findings-filter/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "description", descriptionUpdated),
 					resource.TestCheckResourceAttr(resourceName, "position", "1"),
 					resource.TestCheckTypeSetElemAttrPair(resourceName, "finding_criteria.0.criterion.*.eq.*", dataSourceRegion, "name"),
@@ -264,10 +268,10 @@ func testAccFindingsFilter_WithDate(t *testing.T) {
 						"lt":    endDate,
 					}),
 					resource.TestMatchTypeSetElemNestedAttrs(resourceName, "finding_criteria.0.criterion.*", map[string]*regexp.Regexp{
-						"gte": regexp.MustCompile(acctest.RFC3339RegexPattern),
+						"gte": regexache.MustCompile(acctest.RFC3339RegexPattern),
 					}),
 					resource.TestMatchTypeSetElemNestedAttrs(resourceName, "finding_criteria.0.criterion.*", map[string]*regexp.Regexp{
-						"lt": regexp.MustCompile(acctest.RFC3339RegexPattern),
+						"lt": regexache.MustCompile(acctest.RFC3339RegexPattern),
 					}),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "finding_criteria.0.criterion.*", map[string]string{
 						"field": "sample",
@@ -309,7 +313,7 @@ func testAccFindingsFilter_WithNumber(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "name_prefix", "terraform-"),
 					resource.TestCheckResourceAttr(resourceName, "action", macie2.FindingsFilterActionArchive),
 					resource.TestCheckTypeSetElemAttrPair(resourceName, "finding_criteria.0.criterion.*.eq.*", dataSourceRegion, "name"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "macie2", regexp.MustCompile(`findings-filter/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "macie2", regexache.MustCompile(`findings-filter/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "description", description),
 					resource.TestCheckResourceAttr(resourceName, "position", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "finding_criteria.0.criterion.*", map[string]string{
@@ -326,7 +330,7 @@ func testAccFindingsFilter_WithNumber(t *testing.T) {
 					acctest.CheckResourceAttrNameGenerated(resourceName, "name"),
 					resource.TestCheckResourceAttr(resourceName, "name_prefix", "terraform-"),
 					resource.TestCheckResourceAttr(resourceName, "action", macie2.FindingsFilterActionNoop),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "macie2", regexp.MustCompile(`findings-filter/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "macie2", regexache.MustCompile(`findings-filter/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "description", descriptionUpdated),
 					resource.TestCheckResourceAttr(resourceName, "position", "1"),
 					resource.TestCheckResourceAttr(resourceName, "finding_criteria.#", "1"),
@@ -380,7 +384,7 @@ func testAccFindingsFilter_withTags(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "tags.Key", "value"),
 					resource.TestCheckResourceAttr(resourceName, "tags_all.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags_all.Key", "value"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "macie2", regexp.MustCompile(`findings-filter/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "macie2", regexache.MustCompile(`findings-filter/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "position", "1"),
 					resource.TestCheckResourceAttr(resourceName, "description", description),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "finding_criteria.0.criterion.*", map[string]string{
diff --git a/internal/service/macie2/generate.go b/internal/service/macie2/generate.go
index 89ac5b80b1c..a7a03f605de 100644
--- a/internal/service/macie2/generate.go
+++ b/internal/service/macie2/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ServiceTagsMap
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/macie2/invitation_accepter.go b/internal/service/macie2/invitation_accepter.go
index 396b5beda91..412ceb9f448 100644
--- a/internal/service/macie2/invitation_accepter.go
+++ b/internal/service/macie2/invitation_accepter.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package macie2
 
 import (
diff --git a/internal/service/macie2/invitation_accepter_test.go b/internal/service/macie2/invitation_accepter_test.go
index 9c299fa53f5..cb63988189f 100644
--- a/internal/service/macie2/invitation_accepter_test.go
+++ b/internal/service/macie2/invitation_accepter_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package macie2_test
 
 import (
diff --git a/internal/service/macie2/macie2_test.go b/internal/service/macie2/macie2_test.go
index 3e869d50e73..39c7decaaa8 100644
--- a/internal/service/macie2/macie2_test.go
+++ b/internal/service/macie2/macie2_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package macie2_test
 
 import (
diff --git a/internal/service/macie2/member.go b/internal/service/macie2/member.go
index acd475cfc9a..4f714756a0a 100644
--- a/internal/service/macie2/member.go
+++ b/internal/service/macie2/member.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package macie2
 
 import (
diff --git a/internal/service/macie2/member_test.go b/internal/service/macie2/member_test.go
index 493563072c7..7bbd4d6454e 100644
--- a/internal/service/macie2/member_test.go
+++ b/internal/service/macie2/member_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package macie2_test
 
 import (
diff --git a/internal/service/macie2/organization_admin_account.go b/internal/service/macie2/organization_admin_account.go
index 53eff972ee3..05cf01e6980 100644
--- a/internal/service/macie2/organization_admin_account.go
+++ b/internal/service/macie2/organization_admin_account.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package macie2
 
 import (
diff --git a/internal/service/macie2/organization_admin_account_test.go b/internal/service/macie2/organization_admin_account_test.go
index 3c78098bcdf..a504cbf5598 100644
--- a/internal/service/macie2/organization_admin_account_test.go
+++ b/internal/service/macie2/organization_admin_account_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package macie2_test
 
 import (
diff --git a/internal/service/macie2/service_package_gen.go b/internal/service/macie2/service_package_gen.go
index 6c102aee852..1cb66d10e4c 100644
--- a/internal/service/macie2/service_package_gen.go
+++ b/internal/service/macie2/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	macie2_sdkv1 "github.com/aws/aws-sdk-go/service/macie2"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -82,4 +83,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*m
 	return macie2_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/macie2/status.go b/internal/service/macie2/status.go
index 6572e7a62b8..38ccf0b2e46 100644
--- a/internal/service/macie2/status.go
+++ b/internal/service/macie2/status.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package macie2
 
 import (
diff --git a/internal/service/macie2/tags_gen.go b/internal/service/macie2/tags_gen.go
index a7a19f7d7bb..4585dd94808 100644
--- a/internal/service/macie2/tags_gen.go
+++ b/internal/service/macie2/tags_gen.go
@@ -16,7 +16,7 @@ func Tags(tags tftags.KeyValueTags) map[string]*string {
 	return aws.StringMap(tags.Map())
 }
 
-// KeyValueTags creates KeyValueTags from macie2 service tags.
+// KeyValueTags creates tftags.KeyValueTags from macie2 service tags.
 func KeyValueTags(ctx context.Context, tags map[string]*string) tftags.KeyValueTags {
 	return tftags.New(ctx, tags)
 }
diff --git a/internal/service/macie2/wait.go b/internal/service/macie2/wait.go
index df362514ad5..28d379ba3db 100644
--- a/internal/service/macie2/wait.go
+++ b/internal/service/macie2/wait.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package macie2
 
 import (
diff --git a/internal/service/mediaconnect/README.md b/internal/service/mediaconnect/README.md
index 49304e56642..38e3483d735 100644
--- a/internal/service/mediaconnect/README.md
+++ b/internal/service/mediaconnect/README.md
@@ -8,4 +8,4 @@ _At the moment, the Terraform AWS Provider has little or no support for MediaCon
 
 * [Find out about contributing](https://hashicorp.github.io/terraform-provider-aws/#contribute) to the AWS provider!
 * AWS Provider Docs: [Home](https://registry.terraform.io/providers/hashicorp/aws/latest/docs)
-* AWS Docs: [AWS SDK for Go MediaConnect](https://docs.aws.amazon.com/sdk-for-go/api/service/mediaconnect/)
+* AWS Docs: [AWS SDK for Go MediaConnect](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/service/mediaconnect)
diff --git a/internal/service/mediaconnect/generate.go b/internal/service/mediaconnect/generate.go
index b138f9c6c35..3d8ab34c85d 100644
--- a/internal/service/mediaconnect/generate.go
+++ b/internal/service/mediaconnect/generate.go
@@ -1,4 +1,7 @@
-//go:generate go run ../../generate/tags/main.go -ListTags -ServiceTagsMap -UpdateTags
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+//go:generate go run ../../generate/tags/main.go -AWSSDKVersion=2 -KVTValues -SkipTypesImp -ListTags -ServiceTagsMap -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
 
diff --git a/internal/service/mediaconnect/service_package_gen.go b/internal/service/mediaconnect/service_package_gen.go
index a86377a8895..1c3e8fc9bed 100644
--- a/internal/service/mediaconnect/service_package_gen.go
+++ b/internal/service/mediaconnect/service_package_gen.go
@@ -5,9 +5,9 @@ package mediaconnect
 import (
 	"context"
 
-	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
-	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
-	mediaconnect_sdkv1 "github.com/aws/aws-sdk-go/service/mediaconnect"
+	aws_sdkv2 "github.com/aws/aws-sdk-go-v2/aws"
+	mediaconnect_sdkv2 "github.com/aws/aws-sdk-go-v2/service/mediaconnect"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -34,11 +34,17 @@ func (p *servicePackage) ServicePackageName() string {
 	return names.MediaConnect
 }
 
-// NewConn returns a new AWS SDK for Go v1 client for this service package's AWS API.
-func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*mediaconnect_sdkv1.MediaConnect, error) {
-	sess := config["session"].(*session_sdkv1.Session)
+// NewClient returns a new AWS SDK for Go v2 client for this service package's AWS API.
+func (p *servicePackage) NewClient(ctx context.Context, config map[string]any) (*mediaconnect_sdkv2.Client, error) {
+	cfg := *(config["aws_sdkv2_config"].(*aws_sdkv2.Config))
 
-	return mediaconnect_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
+	return mediaconnect_sdkv2.NewFromConfig(cfg, func(o *mediaconnect_sdkv2.Options) {
+		if endpoint := config["endpoint"].(string); endpoint != "" {
+			o.BaseEndpoint = aws_sdkv2.String(endpoint)
+		}
+	}), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/mediaconnect/tags_gen.go b/internal/service/mediaconnect/tags_gen.go
index 662c300990b..aaf7909fb60 100644
--- a/internal/service/mediaconnect/tags_gen.go
+++ b/internal/service/mediaconnect/tags_gen.go
@@ -5,10 +5,11 @@ import (
 	"context"
 	"fmt"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/mediaconnect"
-	"github.com/aws/aws-sdk-go/service/mediaconnect/mediaconnectiface"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/mediaconnect"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -17,12 +18,12 @@ import (
 // listTags lists mediaconnect service tags.
 // The identifier is typically the Amazon Resource Name (ARN), although
 // it may also be a different identifier depending on the service.
-func listTags(ctx context.Context, conn mediaconnectiface.MediaConnectAPI, identifier string) (tftags.KeyValueTags, error) {
+func listTags(ctx context.Context, conn *mediaconnect.Client, identifier string) (tftags.KeyValueTags, error) {
 	input := &mediaconnect.ListTagsForResourceInput{
 		ResourceArn: aws.String(identifier),
 	}
 
-	output, err := conn.ListTagsForResourceWithContext(ctx, input)
+	output, err := conn.ListTagsForResource(ctx, input)
 
 	if err != nil {
 		return tftags.New(ctx, nil), err
@@ -34,7 +35,7 @@ func listTags(ctx context.Context, conn mediaconnectiface.MediaConnectAPI, ident
 // ListTags lists mediaconnect service tags and set them in Context.
 // It is called from outside this package.
 func (p *servicePackage) ListTags(ctx context.Context, meta any, identifier string) error {
-	tags, err := listTags(ctx, meta.(*conns.AWSClient).MediaConnectConn(ctx), identifier)
+	tags, err := listTags(ctx, meta.(*conns.AWSClient).MediaConnectClient(ctx), identifier)
 
 	if err != nil {
 		return err
@@ -47,21 +48,21 @@ func (p *servicePackage) ListTags(ctx context.Context, meta any, identifier stri
 	return nil
 }
 
-// map[string]*string handling
+// map[string]string handling
 
 // Tags returns mediaconnect service tags.
-func Tags(tags tftags.KeyValueTags) map[string]*string {
-	return aws.StringMap(tags.Map())
+func Tags(tags tftags.KeyValueTags) map[string]string {
+	return tags.Map()
 }
 
-// KeyValueTags creates KeyValueTags from mediaconnect service tags.
-func KeyValueTags(ctx context.Context, tags map[string]*string) tftags.KeyValueTags {
+// KeyValueTags creates tftags.KeyValueTags from mediaconnect service tags.
+func KeyValueTags(ctx context.Context, tags map[string]string) tftags.KeyValueTags {
 	return tftags.New(ctx, tags)
 }
 
 // getTagsIn returns mediaconnect service tags from Context.
 // nil is returned if there are no input tags.
-func getTagsIn(ctx context.Context) map[string]*string {
+func getTagsIn(ctx context.Context) map[string]string {
 	if inContext, ok := tftags.FromContext(ctx); ok {
 		if tags := Tags(inContext.TagsIn.UnwrapOrDefault()); len(tags) > 0 {
 			return tags
@@ -72,7 +73,7 @@ func getTagsIn(ctx context.Context) map[string]*string {
 }
 
 // setTagsOut sets mediaconnect service tags in Context.
-func setTagsOut(ctx context.Context, tags map[string]*string) {
+func setTagsOut(ctx context.Context, tags map[string]string) {
 	if inContext, ok := tftags.FromContext(ctx); ok {
 		inContext.TagsOut = types.Some(KeyValueTags(ctx, tags))
 	}
@@ -81,19 +82,21 @@ func setTagsOut(ctx context.Context, tags map[string]*string) {
 // updateTags updates mediaconnect service tags.
 // The identifier is typically the Amazon Resource Name (ARN), although
 // it may also be a different identifier depending on the service.
-func updateTags(ctx context.Context, conn mediaconnectiface.MediaConnectAPI, identifier string, oldTagsMap, newTagsMap any) error {
+func updateTags(ctx context.Context, conn *mediaconnect.Client, identifier string, oldTagsMap, newTagsMap any) error {
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.MediaConnect)
 	if len(removedTags) > 0 {
 		input := &mediaconnect.UntagResourceInput{
 			ResourceArn: aws.String(identifier),
-			TagKeys:     aws.StringSlice(removedTags.Keys()),
+			TagKeys:     removedTags.Keys(),
 		}
 
-		_, err := conn.UntagResourceWithContext(ctx, input)
+		_, err := conn.UntagResource(ctx, input)
 
 		if err != nil {
 			return fmt.Errorf("untagging resource (%s): %w", identifier, err)
@@ -108,7 +111,7 @@ func updateTags(ctx context.Context, conn mediaconnectiface.MediaConnectAPI, ide
 			Tags:        Tags(updatedTags),
 		}
 
-		_, err := conn.TagResourceWithContext(ctx, input)
+		_, err := conn.TagResource(ctx, input)
 
 		if err != nil {
 			return fmt.Errorf("tagging resource (%s): %w", identifier, err)
@@ -121,5 +124,5 @@ func updateTags(ctx context.Context, conn mediaconnectiface.MediaConnectAPI, ide
 // UpdateTags updates mediaconnect service tags.
 // It is called from outside this package.
 func (p *servicePackage) UpdateTags(ctx context.Context, meta any, identifier string, oldTags, newTags any) error {
-	return updateTags(ctx, meta.(*conns.AWSClient).MediaConnectConn(ctx), identifier, oldTags, newTags)
+	return updateTags(ctx, meta.(*conns.AWSClient).MediaConnectClient(ctx), identifier, oldTags, newTags)
 }
diff --git a/internal/service/mediaconvert/generate.go b/internal/service/mediaconvert/generate.go
index acb60ba7099..e85db640728 100644
--- a/internal/service/mediaconvert/generate.go
+++ b/internal/service/mediaconvert/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTags -ListTagsInIDElem=Arn -ListTagsOutTagsElem=ResourceTags.Tags -ServiceTagsMap -TagInIDElem=Arn -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/mediaconvert/queue.go b/internal/service/mediaconvert/queue.go
index 2507b0ea181..a03a3163695 100644
--- a/internal/service/mediaconvert/queue.go
+++ b/internal/service/mediaconvert/queue.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package mediaconvert
 
 import (
diff --git a/internal/service/mediaconvert/queue_data_source.go b/internal/service/mediaconvert/queue_data_source.go
new file mode 100644
index 00000000000..8c3e9e8f404
--- /dev/null
+++ b/internal/service/mediaconvert/queue_data_source.go
@@ -0,0 +1,84 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package mediaconvert
+
+import (
+	"context"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/mediaconvert"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
+	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
+)
+
+// @SDKDataSource("aws_media_convert_queue", name="Queue")
+func DataSourceQueue() *schema.Resource {
+	return &schema.Resource{
+		ReadWithoutTimeout: dataSourceQueueRead,
+
+		Schema: map[string]*schema.Schema{
+			"id": {
+				Type:     schema.TypeString,
+				Required: true,
+			},
+			"name": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"arn": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"status": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"tags": tftags.TagsSchemaComputed(),
+		},
+	}
+}
+
+func dataSourceQueueRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+
+	conn, err := GetAccountClient(ctx, meta.(*conns.AWSClient))
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "getting Media Convert Account Client: %s", err)
+	}
+
+	id := d.Get("id").(string)
+
+	resp, err := conn.GetQueueWithContext(ctx, &mediaconvert.GetQueueInput{
+		Name: aws.String(id),
+	})
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "getting Media Convert Queue (%s): %s", id, err)
+	}
+
+	if resp == nil || resp.Queue == nil {
+		return sdkdiag.AppendErrorf(diags, "getting Media Convert Queue (%s): empty response", id)
+	}
+
+	d.SetId(aws.StringValue(resp.Queue.Name))
+	d.Set("name", resp.Queue.Name)
+	d.Set("arn", resp.Queue.Arn)
+	d.Set("status", resp.Queue.Status)
+
+	ignoreTagsConfig := meta.(*conns.AWSClient).IgnoreTagsConfig
+	tags, err := listTags(ctx, conn, aws.StringValue(resp.Queue.Arn))
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "listing tags for Media Convert Queue (%s): %s", id, err)
+	}
+
+	if err := d.Set("tags", tags.IgnoreAWS().IgnoreConfig(ignoreTagsConfig).Map()); err != nil {
+		return sdkdiag.AppendErrorf(diags, "setting tags for Media Convert Queue (%s): %s", id, err)
+	}
+
+	return diags
+}
diff --git a/internal/service/mediaconvert/queue_data_source_test.go b/internal/service/mediaconvert/queue_data_source_test.go
new file mode 100644
index 00000000000..aac3fa961f8
--- /dev/null
+++ b/internal/service/mediaconvert/queue_data_source_test.go
@@ -0,0 +1,116 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package mediaconvert_test
+
+import (
+	"testing"
+
+	"github.com/aws/aws-sdk-go/service/mediaconvert"
+	sdkacctest "github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
+)
+
+func TestAccMediaConvertQueueDataSource_basic(t *testing.T) {
+	ctx := acctest.Context(t)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_media_convert_queue.test"
+	dataSourceName := "data.aws_media_convert_queue.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, mediaconvert.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckQueueDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccQueueDataSourceConfig_basic(rName),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttrPair(resourceName, "name", dataSourceName, "name"),
+					resource.TestCheckResourceAttrPair(resourceName, "arn", dataSourceName, "arn"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccMediaConvertQueueDataSource_withStatus(t *testing.T) {
+	ctx := acctest.Context(t)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_media_convert_queue.test"
+	dataSourceName := "data.aws_media_convert_queue.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, mediaconvert.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckQueueDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccQueueDataSourceConfig_status(rName, mediaconvert.QueueStatusActive),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttrPair(resourceName, "name", dataSourceName, "name"),
+					resource.TestCheckResourceAttrPair(resourceName, "arn", dataSourceName, "arn"),
+					resource.TestCheckResourceAttrPair(resourceName, "status", dataSourceName, "status"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccMediaConvertQueueDataSource_withTags(t *testing.T) {
+	ctx := acctest.Context(t)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_media_convert_queue.test"
+	dataSourceName := "data.aws_media_convert_queue.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, mediaconvert.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckQueueDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccQueueDataSourceConfig_tags(rName, "foo", "bar", "fizz", "buzz"),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttrPair(resourceName, "name", dataSourceName, "name"),
+					resource.TestCheckResourceAttrPair(resourceName, "arn", dataSourceName, "arn"),
+					resource.TestCheckResourceAttrPair(resourceName, "tags.%", dataSourceName, "tags.%"),
+					resource.TestCheckResourceAttrPair(resourceName, "tags.foo", dataSourceName, "tags.foo"),
+					resource.TestCheckResourceAttrPair(resourceName, "tags.fizz", dataSourceName, "tags.fizz"),
+				),
+			},
+		},
+	})
+}
+
+func testAccQueueDataSourceConfig_basic(rName string) string {
+	return acctest.ConfigCompose(
+		testAccQueueConfig_basic(rName),
+		`
+data "aws_media_convert_queue" "test" {
+  id = aws_media_convert_queue.test.id
+}
+`)
+}
+
+func testAccQueueDataSourceConfig_status(rName, status string) string {
+	return acctest.ConfigCompose(
+		testAccQueueConfig_status(rName, status),
+		`
+data "aws_media_convert_queue" "test" {
+  id = aws_media_convert_queue.test.id
+}
+`)
+}
+
+func testAccQueueDataSourceConfig_tags(rName, tagKey1, tagValue1, tagKey2, tagValue2 string) string {
+	return acctest.ConfigCompose(
+		testAccQueueConfig_tags(rName, tagKey1, tagValue1, tagKey2, tagValue2),
+		`
+data "aws_media_convert_queue" "test" {
+  id = aws_media_convert_queue.test.id
+}
+`)
+}
diff --git a/internal/service/mediaconvert/queue_test.go b/internal/service/mediaconvert/queue_test.go
index a41b7a681b0..48e8d7427b1 100644
--- a/internal/service/mediaconvert/queue_test.go
+++ b/internal/service/mediaconvert/queue_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package mediaconvert_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/mediaconvert"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -33,7 +36,7 @@ func TestAccMediaConvertQueue_basic(t *testing.T) {
 				Config: testAccQueueConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckQueueExists(ctx, resourceName, &queue),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "mediaconvert", regexp.MustCompile(`queues/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "mediaconvert", regexache.MustCompile(`queues/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "pricing_plan", mediaconvert.PricingPlanOnDemand),
 					resource.TestCheckResourceAttr(resourceName, "status", mediaconvert.QueueStatusActive),
diff --git a/internal/service/mediaconvert/service_package_gen.go b/internal/service/mediaconvert/service_package_gen.go
index 8860055afc3..602ea90b139 100644
--- a/internal/service/mediaconvert/service_package_gen.go
+++ b/internal/service/mediaconvert/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	mediaconvert_sdkv1 "github.com/aws/aws-sdk-go/service/mediaconvert"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -23,7 +24,13 @@ func (p *servicePackage) FrameworkResources(ctx context.Context) []*types.Servic
 }
 
 func (p *servicePackage) SDKDataSources(ctx context.Context) []*types.ServicePackageSDKDataSource {
-	return []*types.ServicePackageSDKDataSource{}
+	return []*types.ServicePackageSDKDataSource{
+		{
+			Factory:  DataSourceQueue,
+			TypeName: "aws_media_convert_queue",
+			Name:     "Queue",
+		},
+	}
 }
 
 func (p *servicePackage) SDKResources(ctx context.Context) []*types.ServicePackageSDKResource {
@@ -48,4 +55,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*m
 	return mediaconvert_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/mediaconvert/structure.go b/internal/service/mediaconvert/structure.go
index 5e50f00c15b..e9a9c18eb04 100644
--- a/internal/service/mediaconvert/structure.go
+++ b/internal/service/mediaconvert/structure.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package mediaconvert
 
 import (
diff --git a/internal/service/mediaconvert/tags_gen.go b/internal/service/mediaconvert/tags_gen.go
index aa70a7e1808..7c7db2d562d 100644
--- a/internal/service/mediaconvert/tags_gen.go
+++ b/internal/service/mediaconvert/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/mediaconvert"
 	"github.com/aws/aws-sdk-go/service/mediaconvert/mediaconvertiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -54,7 +56,7 @@ func Tags(tags tftags.KeyValueTags) map[string]*string {
 	return aws.StringMap(tags.Map())
 }
 
-// KeyValueTags creates KeyValueTags from mediaconvert service tags.
+// KeyValueTags creates tftags.KeyValueTags from mediaconvert service tags.
 func KeyValueTags(ctx context.Context, tags map[string]*string) tftags.KeyValueTags {
 	return tftags.New(ctx, tags)
 }
@@ -85,6 +87,8 @@ func updateTags(ctx context.Context, conn mediaconvertiface.MediaConvertAPI, ide
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.MediaConvert)
 	if len(removedTags) > 0 {
diff --git a/internal/service/medialive/channel.go b/internal/service/medialive/channel.go
index 7661138010c..3305ab11f3d 100644
--- a/internal/service/medialive/channel.go
+++ b/internal/service/medialive/channel.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package medialive
 
 import (
@@ -44,177 +47,179 @@ func ResourceChannel() *schema.Resource {
 			Delete: schema.DefaultTimeout(15 * time.Minute),
 		},
 
-		Schema: map[string]*schema.Schema{
-			"arn": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
-			"cdi_input_specification": {
-				Type:     schema.TypeList,
-				Optional: true,
-				MaxItems: 1,
-				Elem: &schema.Resource{
-					Schema: map[string]*schema.Schema{
-						"resolution": {
-							Type:             schema.TypeString,
-							Required:         true,
-							ValidateDiagFunc: enum.Validate[types.CdiInputResolution](),
+		SchemaFunc: func() map[string]*schema.Schema {
+			return map[string]*schema.Schema{
+				"arn": {
+					Type:     schema.TypeString,
+					Computed: true,
+				},
+				"cdi_input_specification": {
+					Type:     schema.TypeList,
+					Optional: true,
+					MaxItems: 1,
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"resolution": {
+								Type:             schema.TypeString,
+								Required:         true,
+								ValidateDiagFunc: enum.Validate[types.CdiInputResolution](),
+							},
 						},
 					},
 				},
-			},
-			"channel_class": {
-				Type:             schema.TypeString,
-				Required:         true,
-				ForceNew:         true,
-				ValidateDiagFunc: enum.Validate[types.ChannelClass](),
-			},
-			"channel_id": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
-			"destinations": {
-				Type:     schema.TypeSet,
-				Required: true,
-				MinItems: 1,
-				Elem: &schema.Resource{
-					Schema: map[string]*schema.Schema{
-						"id": {
-							Type:     schema.TypeString,
-							Required: true,
-						},
-						"media_package_settings": {
-							Type:     schema.TypeSet,
-							Optional: true,
-							Elem: &schema.Resource{
-								Schema: map[string]*schema.Schema{
-									"channel_id": {
-										Type:     schema.TypeString,
-										Required: true,
+				"channel_class": {
+					Type:             schema.TypeString,
+					Required:         true,
+					ForceNew:         true,
+					ValidateDiagFunc: enum.Validate[types.ChannelClass](),
+				},
+				"channel_id": {
+					Type:     schema.TypeString,
+					Computed: true,
+				},
+				"destinations": {
+					Type:     schema.TypeSet,
+					Required: true,
+					MinItems: 1,
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"id": {
+								Type:     schema.TypeString,
+								Required: true,
+							},
+							"media_package_settings": {
+								Type:     schema.TypeSet,
+								Optional: true,
+								Elem: &schema.Resource{
+									Schema: map[string]*schema.Schema{
+										"channel_id": {
+											Type:     schema.TypeString,
+											Required: true,
+										},
 									},
 								},
 							},
-						},
-						"multiplex_settings": {
-							Type:     schema.TypeList,
-							Optional: true,
-							MaxItems: 1,
-							Elem: &schema.Resource{
-								Schema: map[string]*schema.Schema{
-									"multiplex_id": {
-										Type:     schema.TypeString,
-										Required: true,
-									},
-									"program_name": {
-										Type:     schema.TypeString,
-										Required: true,
+							"multiplex_settings": {
+								Type:     schema.TypeList,
+								Optional: true,
+								MaxItems: 1,
+								Elem: &schema.Resource{
+									Schema: map[string]*schema.Schema{
+										"multiplex_id": {
+											Type:     schema.TypeString,
+											Required: true,
+										},
+										"program_name": {
+											Type:     schema.TypeString,
+											Required: true,
+										},
 									},
 								},
 							},
-						},
-						"settings": {
-							Type:     schema.TypeSet,
-							Optional: true,
-							Elem: &schema.Resource{
-								Schema: map[string]*schema.Schema{
-									"password_param": {
-										Type:     schema.TypeString,
-										Optional: true,
-									},
-									"stream_name": {
-										Type:     schema.TypeString,
-										Optional: true,
-									},
-									"url": {
-										Type:     schema.TypeString,
-										Optional: true,
-									},
-									"username": {
-										Type:     schema.TypeString,
-										Optional: true,
+							"settings": {
+								Type:     schema.TypeSet,
+								Optional: true,
+								Elem: &schema.Resource{
+									Schema: map[string]*schema.Schema{
+										"password_param": {
+											Type:     schema.TypeString,
+											Optional: true,
+										},
+										"stream_name": {
+											Type:     schema.TypeString,
+											Optional: true,
+										},
+										"url": {
+											Type:     schema.TypeString,
+											Optional: true,
+										},
+										"username": {
+											Type:     schema.TypeString,
+											Optional: true,
+										},
 									},
 								},
 							},
 						},
 					},
 				},
-			},
-			"encoder_settings": func() *schema.Schema {
-				return channelEncoderSettingsSchema()
-			}(),
-			"input_attachments": {
-				Type:     schema.TypeSet,
-				Required: true,
-				Elem: &schema.Resource{
-					Schema: map[string]*schema.Schema{
-						"automatic_input_failover_settings": {
-							Type:     schema.TypeList,
-							Optional: true,
-							MaxItems: 1,
-							Elem: &schema.Resource{
-								Schema: map[string]*schema.Schema{
-									"secondary_input_id": {
-										Type:     schema.TypeString,
-										Required: true,
-									},
-									"error_clear_time_msec": {
-										Type:     schema.TypeInt,
-										Optional: true,
-									},
-									"failover_condition": {
-										Type:     schema.TypeSet,
-										Optional: true,
-										Elem: &schema.Resource{
-											Schema: map[string]*schema.Schema{
-												"failover_condition_settings": {
-													Type:     schema.TypeList,
-													Optional: true,
-													MaxItems: 1,
-													Elem: &schema.Resource{
-														Schema: map[string]*schema.Schema{
-															"audio_silence_settings": {
-																Type:     schema.TypeList,
-																Optional: true,
-																MaxItems: 1,
-																Elem: &schema.Resource{
-																	Schema: map[string]*schema.Schema{
-																		"audio_selector_name": {
-																			Type:     schema.TypeString,
-																			Required: true,
-																		},
-																		"audio_silence_threshold_msec": {
-																			Type:     schema.TypeInt,
-																			Optional: true,
+				"encoder_settings": func() *schema.Schema {
+					return channelEncoderSettingsSchema()
+				}(),
+				"input_attachments": {
+					Type:     schema.TypeSet,
+					Required: true,
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"automatic_input_failover_settings": {
+								Type:     schema.TypeList,
+								Optional: true,
+								MaxItems: 1,
+								Elem: &schema.Resource{
+									Schema: map[string]*schema.Schema{
+										"secondary_input_id": {
+											Type:     schema.TypeString,
+											Required: true,
+										},
+										"error_clear_time_msec": {
+											Type:     schema.TypeInt,
+											Optional: true,
+										},
+										"failover_condition": {
+											Type:     schema.TypeSet,
+											Optional: true,
+											Elem: &schema.Resource{
+												Schema: map[string]*schema.Schema{
+													"failover_condition_settings": {
+														Type:     schema.TypeList,
+														Optional: true,
+														MaxItems: 1,
+														Elem: &schema.Resource{
+															Schema: map[string]*schema.Schema{
+																"audio_silence_settings": {
+																	Type:     schema.TypeList,
+																	Optional: true,
+																	MaxItems: 1,
+																	Elem: &schema.Resource{
+																		Schema: map[string]*schema.Schema{
+																			"audio_selector_name": {
+																				Type:     schema.TypeString,
+																				Required: true,
+																			},
+																			"audio_silence_threshold_msec": {
+																				Type:     schema.TypeInt,
+																				Optional: true,
+																			},
 																		},
 																	},
 																},
-															},
-															"input_loss_settings": {
-																Type:     schema.TypeList,
-																Optional: true,
-																MaxItems: 1,
-																Elem: &schema.Resource{
-																	Schema: map[string]*schema.Schema{
-																		"input_loss_threshold_msec": {
-																			Type:     schema.TypeInt,
-																			Optional: true,
+																"input_loss_settings": {
+																	Type:     schema.TypeList,
+																	Optional: true,
+																	MaxItems: 1,
+																	Elem: &schema.Resource{
+																		Schema: map[string]*schema.Schema{
+																			"input_loss_threshold_msec": {
+																				Type:     schema.TypeInt,
+																				Optional: true,
+																			},
 																		},
 																	},
 																},
-															},
-															"video_black_settings": {
-																Type:     schema.TypeList,
-																Optional: true,
-																MaxItems: 1,
-																Elem: &schema.Resource{
-																	Schema: map[string]*schema.Schema{
-																		"black_detect_threshold": {
-																			Type:     schema.TypeFloat,
-																			Optional: true,
-																		},
-																		"video_black_threshold_msec": {
-																			Type:     schema.TypeInt,
-																			Optional: true,
+																"video_black_settings": {
+																	Type:     schema.TypeList,
+																	Optional: true,
+																	MaxItems: 1,
+																	Elem: &schema.Resource{
+																		Schema: map[string]*schema.Schema{
+																			"black_detect_threshold": {
+																				Type:     schema.TypeFloat,
+																				Optional: true,
+																			},
+																			"video_black_threshold_msec": {
+																				Type:     schema.TypeInt,
+																				Optional: true,
+																			},
 																		},
 																	},
 																},
@@ -224,107 +229,121 @@ func ResourceChannel() *schema.Resource {
 												},
 											},
 										},
-									},
-									"input_preference": {
-										Type:             schema.TypeString,
-										Optional:         true,
-										ValidateDiagFunc: enum.Validate[types.InputPreference](),
+										"input_preference": {
+											Type:             schema.TypeString,
+											Optional:         true,
+											ValidateDiagFunc: enum.Validate[types.InputPreference](),
+										},
 									},
 								},
 							},
-						},
-						"input_attachment_name": {
-							Type:     schema.TypeString,
-							Required: true,
-						},
-						"input_id": {
-							Type:     schema.TypeString,
-							Required: true,
-						},
-						"input_settings": {
-							Type:     schema.TypeList,
-							Optional: true,
-							Computed: true,
-							MaxItems: 1,
-							Elem: &schema.Resource{
-								Schema: map[string]*schema.Schema{
-									"audio_selector": {
-										Type:     schema.TypeList,
-										Optional: true,
-										Elem: &schema.Resource{
-											Schema: map[string]*schema.Schema{
-												"name": {
-													Type:     schema.TypeString,
-													Required: true,
-												},
-												"selector_settings": {
-													Type:     schema.TypeList,
-													Optional: true,
-													MaxItems: 1,
-													Elem: &schema.Resource{
-														Schema: map[string]*schema.Schema{
-															"audio_hls_rendition_selection": {
-																Type:     schema.TypeList,
-																Optional: true,
-																MaxItems: 1,
-																Elem: &schema.Resource{
-																	Schema: map[string]*schema.Schema{
-																		"group_id": {
-																			Type:     schema.TypeString,
-																			Required: true,
-																		},
-																		"name": {
-																			Type:     schema.TypeString,
-																			Required: true,
+							"input_attachment_name": {
+								Type:     schema.TypeString,
+								Required: true,
+							},
+							"input_id": {
+								Type:     schema.TypeString,
+								Required: true,
+							},
+							"input_settings": {
+								Type:     schema.TypeList,
+								Optional: true,
+								Computed: true,
+								MaxItems: 1,
+								Elem: &schema.Resource{
+									Schema: map[string]*schema.Schema{
+										"audio_selector": {
+											Type:     schema.TypeList,
+											Optional: true,
+											Elem: &schema.Resource{
+												Schema: map[string]*schema.Schema{
+													"name": {
+														Type:     schema.TypeString,
+														Required: true,
+													},
+													"selector_settings": {
+														Type:     schema.TypeList,
+														Optional: true,
+														MaxItems: 1,
+														Elem: &schema.Resource{
+															Schema: map[string]*schema.Schema{
+																"audio_hls_rendition_selection": {
+																	Type:     schema.TypeList,
+																	Optional: true,
+																	MaxItems: 1,
+																	Elem: &schema.Resource{
+																		Schema: map[string]*schema.Schema{
+																			"group_id": {
+																				Type:     schema.TypeString,
+																				Required: true,
+																			},
+																			"name": {
+																				Type:     schema.TypeString,
+																				Required: true,
+																			},
 																		},
 																	},
 																},
-															},
-															"audio_language_selection": {
-																Type:     schema.TypeList,
-																Optional: true,
-																MaxItems: 1,
-																Elem: &schema.Resource{
-																	Schema: map[string]*schema.Schema{
-																		"language_code": {
-																			Type:     schema.TypeString,
-																			Required: true,
-																		},
-																		"language_selection_policy": {
-																			Type:             schema.TypeString,
-																			Optional:         true,
-																			ValidateDiagFunc: enum.Validate[types.AudioLanguageSelectionPolicy](),
+																"audio_language_selection": {
+																	Type:     schema.TypeList,
+																	Optional: true,
+																	MaxItems: 1,
+																	Elem: &schema.Resource{
+																		Schema: map[string]*schema.Schema{
+																			"language_code": {
+																				Type:     schema.TypeString,
+																				Required: true,
+																			},
+																			"language_selection_policy": {
+																				Type:             schema.TypeString,
+																				Optional:         true,
+																				ValidateDiagFunc: enum.Validate[types.AudioLanguageSelectionPolicy](),
+																			},
 																		},
 																	},
 																},
-															},
-															"audio_pid_selection": {
-																Type:     schema.TypeList,
-																Optional: true,
-																MaxItems: 1,
-																Elem: &schema.Resource{
-																	Schema: map[string]*schema.Schema{
-																		"pid": {
-																			Type:     schema.TypeInt,
-																			Required: true,
+																"audio_pid_selection": {
+																	Type:     schema.TypeList,
+																	Optional: true,
+																	MaxItems: 1,
+																	Elem: &schema.Resource{
+																		Schema: map[string]*schema.Schema{
+																			"pid": {
+																				Type:     schema.TypeInt,
+																				Required: true,
+																			},
 																		},
 																	},
 																},
-															},
-															"audio_track_selection": {
-																Type:     schema.TypeList,
-																Optional: true,
-																MaxItems: 1,
-																Elem: &schema.Resource{
-																	Schema: map[string]*schema.Schema{
-																		"track": {
-																			Type:     schema.TypeSet,
-																			Required: true,
-																			Elem: &schema.Resource{
-																				Schema: map[string]*schema.Schema{
-																					"track": {
-																						Type:     schema.TypeInt,
-																						Required: true,
+																"audio_track_selection": {
+																	Type:     schema.TypeList,
+																	Optional: true,
+																	MaxItems: 1,
+																	Elem: &schema.Resource{
+																		Schema: map[string]*schema.Schema{
+																			"dolby_e_decode": {
+																				Type:     schema.TypeList,
+																				Optional: true,
+																				MaxItems: 1,
+																				Elem: &schema.Resource{
+																					Schema: map[string]*schema.Schema{
+																						"program_selection": {
+																							Type:             schema.TypeString,
+																							Required:         true,
+																							ValidateDiagFunc: enum.Validate[types.DolbyEProgramSelection](),
+																						},
+																					},
+																				},
+																			},
+																			"tracks": {
+																				Type:     schema.TypeSet,
+																				Required: true,
+																				Elem: &schema.Resource{
+																					Schema: map[string]*schema.Schema{
+																						"track": {
+																							Type:     schema.TypeInt,
+																							Required: true,
+																						},
 																					},
 																				},
 																			},
@@ -337,154 +356,159 @@ func ResourceChannel() *schema.Resource {
 												},
 											},
 										},
-									},
-									"caption_selector": {
-										Type:     schema.TypeList,
-										Optional: true,
-										Elem: &schema.Resource{
-											Schema: map[string]*schema.Schema{
-												"name": {
-													Type:     schema.TypeString,
-													Required: true,
-												},
-												"language_code": {
-													Type:     schema.TypeString,
-													Optional: true,
-												},
-												"selector_settings": {
-													Type:     schema.TypeList,
-													Optional: true,
-													MaxItems: 1,
-													Elem: &schema.Resource{
-														Schema: map[string]*schema.Schema{
-															"ancillary_source_settings": {
-																Type:     schema.TypeList,
-																Optional: true,
-																MaxItems: 1,
-																Elem: &schema.Resource{
-																	Schema: map[string]*schema.Schema{
-																		"source_ancillary_channel_number": {
-																			Type:     schema.TypeInt,
-																			Optional: true,
+										"caption_selector": {
+											Type:     schema.TypeList,
+											Optional: true,
+											Elem: &schema.Resource{
+												Schema: map[string]*schema.Schema{
+													"name": {
+														Type:     schema.TypeString,
+														Required: true,
+													},
+													"language_code": {
+														Type:     schema.TypeString,
+														Optional: true,
+													},
+													"selector_settings": {
+														Type:     schema.TypeList,
+														Optional: true,
+														MaxItems: 1,
+														Elem: &schema.Resource{
+															Schema: map[string]*schema.Schema{
+																"ancillary_source_settings": {
+																	Type:     schema.TypeList,
+																	Optional: true,
+																	MaxItems: 1,
+																	Elem: &schema.Resource{
+																		Schema: map[string]*schema.Schema{
+																			"source_ancillary_channel_number": {
+																				Type:     schema.TypeInt,
+																				Optional: true,
+																			},
 																		},
 																	},
 																},
-															},
-															"dvb_tdt_settings": {
-																Type:     schema.TypeList,
-																Optional: true,
-																MaxItems: 1,
-																Elem: &schema.Resource{
-																	Schema: map[string]*schema.Schema{
-																		"ocr_language": {
-																			Type:             schema.TypeString,
-																			Optional:         true,
-																			ValidateDiagFunc: enum.Validate[types.DvbSubOcrLanguage](),
-																		},
-																		"pid": {
-																			Type:     schema.TypeInt,
-																			Optional: true,
-																		},
+																"arib_source_settings": {
+																	Type:     schema.TypeList,
+																	Optional: true,
+																	MaxItems: 1,
+																	Elem: &schema.Resource{
+																		Schema: map[string]*schema.Schema{}, // no exported elements in this list
 																	},
 																},
-															},
-															"embedded_source_settings": {
-																Type:     schema.TypeList,
-																Optional: true,
-																MaxItems: 1,
-																Elem: &schema.Resource{
-																	Schema: map[string]*schema.Schema{
-																		"convert_608_to_708": {
-																			Type:             schema.TypeString,
-																			Optional:         true,
-																			ValidateDiagFunc: enum.Validate[types.EmbeddedConvert608To708](),
-																		},
-																		"scte20_detection": {
-																			Type:             schema.TypeString,
-																			Optional:         true,
-																			ValidateDiagFunc: enum.Validate[types.EmbeddedScte20Detection](),
-																		},
-																		"source_608_channel_number": {
-																			Type:     schema.TypeInt,
-																			Optional: true,
-																		},
-																		"source_608_track_number": {
-																			Type:     schema.TypeInt,
-																			Optional: true,
+																"dvb_sub_source_settings": {
+																	Type:     schema.TypeList,
+																	Optional: true,
+																	MaxItems: 1,
+																	Elem: &schema.Resource{
+																		Schema: map[string]*schema.Schema{
+																			"ocr_language": {
+																				Type:             schema.TypeString,
+																				Optional:         true,
+																				ValidateDiagFunc: enum.Validate[types.DvbSubOcrLanguage](),
+																			},
+																			"pid": {
+																				Type:         schema.TypeInt,
+																				Optional:     true,
+																				ValidateFunc: validation.IntAtLeast(1),
+																			},
 																		},
 																	},
 																},
-															},
-															"scte20_source_settings": {
-																Type:     schema.TypeList,
-																Optional: true,
-																MaxItems: 1,
-																Elem: &schema.Resource{
-																	Schema: map[string]*schema.Schema{
-																		"convert_608_to_708": {
-																			Type:             schema.TypeString,
-																			Optional:         true,
-																			ValidateDiagFunc: enum.Validate[types.Scte20Convert608To708](),
-																		},
-																		"source_608_channel_number": {
-																			Type:     schema.TypeInt,
-																			Optional: true,
+																"embedded_source_settings": {
+																	Type:     schema.TypeList,
+																	Optional: true,
+																	MaxItems: 1,
+																	Elem: &schema.Resource{
+																		Schema: map[string]*schema.Schema{
+																			"convert_608_to_708": {
+																				Type:             schema.TypeString,
+																				Optional:         true,
+																				ValidateDiagFunc: enum.Validate[types.EmbeddedConvert608To708](),
+																			},
+																			"scte20_detection": {
+																				Type:             schema.TypeString,
+																				Optional:         true,
+																				ValidateDiagFunc: enum.Validate[types.EmbeddedScte20Detection](),
+																			},
+																			"source_608_channel_number": {
+																				Type:     schema.TypeInt,
+																				Optional: true,
+																			},
 																		},
 																	},
 																},
-															},
-															"scte27_source_settings": {
-																Type:     schema.TypeList,
-																Optional: true,
-																MaxItems: 1,
-																Elem: &schema.Resource{
-																	Schema: map[string]*schema.Schema{
-																		"ocr_language": {
-																			Type:             schema.TypeString,
-																			Optional:         true,
-																			ValidateDiagFunc: enum.Validate[types.Scte27OcrLanguage](),
+																"scte20_source_settings": {
+																	Type:     schema.TypeList,
+																	Optional: true,
+																	MaxItems: 1,
+																	Elem: &schema.Resource{
+																		Schema: map[string]*schema.Schema{
+																			"convert_608_to_708": {
+																				Type:             schema.TypeString,
+																				Optional:         true,
+																				ValidateDiagFunc: enum.Validate[types.Scte20Convert608To708](),
+																			},
+																			"source_608_channel_number": {
+																				Type:     schema.TypeInt,
+																				Optional: true,
+																			},
 																		},
-																		"pid": {
-																			Type:     schema.TypeInt,
-																			Optional: true,
+																	},
+																},
+																"scte27_source_settings": {
+																	Type:     schema.TypeList,
+																	Optional: true,
+																	MaxItems: 1,
+																	Elem: &schema.Resource{
+																		Schema: map[string]*schema.Schema{
+																			"ocr_language": {
+																				Type:             schema.TypeString,
+																				Optional:         true,
+																				ValidateDiagFunc: enum.Validate[types.Scte27OcrLanguage](),
+																			},
+																			"pid": {
+																				Type:     schema.TypeInt,
+																				Optional: true,
+																			},
 																		},
 																	},
 																},
-															},
-															"teletext_source_settings": {
-																Type:     schema.TypeList,
-																Optional: true,
-																MaxItems: 1,
-																Elem: &schema.Resource{
-																	Schema: map[string]*schema.Schema{
-																		"output_rectangle": {
-																			Type:     schema.TypeList,
-																			Optional: true,
-																			MaxItems: 1,
-																			Elem: &schema.Resource{
-																				Schema: map[string]*schema.Schema{
-																					"height": {
-																						Type:     schema.TypeFloat,
-																						Required: true,
-																					},
-																					"left_offset": {
-																						Type:     schema.TypeFloat,
-																						Required: true,
-																					},
-																					"top_offset": {
-																						Type:     schema.TypeFloat,
-																						Required: true,
-																					},
-																					"width": {
-																						Type:     schema.TypeFloat,
-																						Required: true,
+																"teletext_source_settings": {
+																	Type:     schema.TypeList,
+																	Optional: true,
+																	MaxItems: 1,
+																	Elem: &schema.Resource{
+																		Schema: map[string]*schema.Schema{
+																			"output_rectangle": {
+																				Type:     schema.TypeList,
+																				Optional: true,
+																				MaxItems: 1,
+																				Elem: &schema.Resource{
+																					Schema: map[string]*schema.Schema{
+																						"height": {
+																							Type:     schema.TypeFloat,
+																							Required: true,
+																						},
+																						"left_offset": {
+																							Type:     schema.TypeFloat,
+																							Required: true,
+																						},
+																						"top_offset": {
+																							Type:     schema.TypeFloat,
+																							Required: true,
+																						},
+																						"width": {
+																							Type:     schema.TypeFloat,
+																							Required: true,
+																						},
 																					},
 																				},
 																			},
-																		},
-																		"page_number": {
-																			Type:     schema.TypeString,
-																			Optional: true,
+																			"page_number": {
+																				Type:     schema.TypeString,
+																				Optional: true,
+																			},
 																		},
 																	},
 																},
@@ -494,104 +518,104 @@ func ResourceChannel() *schema.Resource {
 												},
 											},
 										},
-									},
-									"deblock_filter": {
-										Type:             schema.TypeString,
-										Optional:         true,
-										ValidateDiagFunc: enum.Validate[types.InputDeblockFilter](),
-									},
-									"denoise_filter": {
-										Type:             schema.TypeString,
-										Optional:         true,
-										ValidateDiagFunc: enum.Validate[types.InputDenoiseFilter](),
-									},
-									"filter_strength": {
-										Type:             schema.TypeInt,
-										Optional:         true,
-										ValidateDiagFunc: validation.ToDiagFunc(validation.IntBetween(1, 5)),
-									},
-									"input_filter": {
-										Type:             schema.TypeString,
-										Optional:         true,
-										Computed:         true,
-										ValidateDiagFunc: enum.Validate[types.InputFilter](),
-									},
-									"network_input_settings": {
-										Type:     schema.TypeList,
-										Optional: true,
-										MaxItems: 1,
-										Elem: &schema.Resource{
-											Schema: map[string]*schema.Schema{
-												"hls_input_settings": {
-													Type:     schema.TypeList,
-													Optional: true,
-													MaxItems: 1,
-													Elem: &schema.Resource{
-														Schema: map[string]*schema.Schema{
-															"bandwidth": {
-																Type:     schema.TypeInt,
-																Optional: true,
-															},
-															"buffer_segments": {
-																Type:     schema.TypeInt,
-																Optional: true,
-															},
-															"retries": {
-																Type:     schema.TypeInt,
-																Optional: true,
-															},
-															"retry_interval": {
-																Type:     schema.TypeInt,
-																Optional: true,
-															},
-															"scte35_source": {
-																Type:             schema.TypeString,
-																Optional:         true,
-																ValidateDiagFunc: enum.Validate[types.HlsScte35SourceType](),
+										"deblock_filter": {
+											Type:             schema.TypeString,
+											Optional:         true,
+											ValidateDiagFunc: enum.Validate[types.InputDeblockFilter](),
+										},
+										"denoise_filter": {
+											Type:             schema.TypeString,
+											Optional:         true,
+											ValidateDiagFunc: enum.Validate[types.InputDenoiseFilter](),
+										},
+										"filter_strength": {
+											Type:             schema.TypeInt,
+											Optional:         true,
+											ValidateDiagFunc: validation.ToDiagFunc(validation.IntBetween(1, 5)),
+										},
+										"input_filter": {
+											Type:             schema.TypeString,
+											Optional:         true,
+											Computed:         true,
+											ValidateDiagFunc: enum.Validate[types.InputFilter](),
+										},
+										"network_input_settings": {
+											Type:     schema.TypeList,
+											Optional: true,
+											MaxItems: 1,
+											Elem: &schema.Resource{
+												Schema: map[string]*schema.Schema{
+													"hls_input_settings": {
+														Type:     schema.TypeList,
+														Optional: true,
+														MaxItems: 1,
+														Elem: &schema.Resource{
+															Schema: map[string]*schema.Schema{
+																"bandwidth": {
+																	Type:     schema.TypeInt,
+																	Optional: true,
+																},
+																"buffer_segments": {
+																	Type:     schema.TypeInt,
+																	Optional: true,
+																},
+																"retries": {
+																	Type:     schema.TypeInt,
+																	Optional: true,
+																},
+																"retry_interval": {
+																	Type:     schema.TypeInt,
+																	Optional: true,
+																},
+																"scte35_source": {
+																	Type:             schema.TypeString,
+																	Optional:         true,
+																	ValidateDiagFunc: enum.Validate[types.HlsScte35SourceType](),
+																},
 															},
 														},
 													},
-												},
-												"server_validation": {
-													Type:             schema.TypeString,
-													Optional:         true,
-													ValidateDiagFunc: enum.Validate[types.NetworkInputServerValidation](),
+													"server_validation": {
+														Type:             schema.TypeString,
+														Optional:         true,
+														ValidateDiagFunc: enum.Validate[types.NetworkInputServerValidation](),
+													},
 												},
 											},
 										},
-									},
-									"scte35_pid": {
-										Type:     schema.TypeInt,
-										Optional: true,
-									},
-									"smpte2038_data_preference": {
-										Type:             schema.TypeString,
-										Optional:         true,
-										ValidateDiagFunc: enum.Validate[types.Smpte2038DataPreference](),
-									},
-									"source_end_behavior": {
-										Type:             schema.TypeString,
-										Optional:         true,
-										ValidateDiagFunc: enum.Validate[types.InputSourceEndBehavior](),
-									},
-									"video_selector": {
-										Type:     schema.TypeList,
-										Optional: true,
-										MaxItems: 1,
-										Elem: &schema.Resource{
-											Schema: map[string]*schema.Schema{
-												"color_space": {
-													Type:             schema.TypeString,
-													Optional:         true,
-													ValidateDiagFunc: enum.Validate[types.VideoSelectorColorSpace](),
-												},
-												// TODO implement color_space_settings
-												"color_space_usage": {
-													Type:             schema.TypeString,
-													Optional:         true,
-													ValidateDiagFunc: enum.Validate[types.VideoSelectorColorSpaceUsage](),
+										"scte35_pid": {
+											Type:     schema.TypeInt,
+											Optional: true,
+										},
+										"smpte2038_data_preference": {
+											Type:             schema.TypeString,
+											Optional:         true,
+											ValidateDiagFunc: enum.Validate[types.Smpte2038DataPreference](),
+										},
+										"source_end_behavior": {
+											Type:             schema.TypeString,
+											Optional:         true,
+											ValidateDiagFunc: enum.Validate[types.InputSourceEndBehavior](),
+										},
+										"video_selector": {
+											Type:     schema.TypeList,
+											Optional: true,
+											MaxItems: 1,
+											Elem: &schema.Resource{
+												Schema: map[string]*schema.Schema{
+													"color_space": {
+														Type:             schema.TypeString,
+														Optional:         true,
+														ValidateDiagFunc: enum.Validate[types.VideoSelectorColorSpace](),
+													},
+													// TODO implement color_space_settings
+													"color_space_usage": {
+														Type:             schema.TypeString,
+														Optional:         true,
+														ValidateDiagFunc: enum.Validate[types.VideoSelectorColorSpaceUsage](),
+													},
+													// TODO implement selector_settings
 												},
-												// TODO implement selector_settings
 											},
 										},
 									},
@@ -600,104 +624,109 @@ func ResourceChannel() *schema.Resource {
 						},
 					},
 				},
-			},
-			"input_specification": {
-				Type:     schema.TypeList,
-				Required: true,
-				MaxItems: 1,
-				Elem: &schema.Resource{
-					Schema: map[string]*schema.Schema{
-						"codec": {
-							Type:             schema.TypeString,
-							Required:         true,
-							ValidateDiagFunc: enum.Validate[types.InputCodec](),
-						},
-						"maximum_bitrate": {
-							Type:             schema.TypeString,
-							Required:         true,
-							ValidateDiagFunc: enum.Validate[types.InputMaximumBitrate](),
-						},
-						"input_resolution": {
-							Type:             schema.TypeString,
-							Required:         true,
-							ValidateDiagFunc: enum.Validate[types.InputResolution](),
+				"input_specification": {
+					Type:     schema.TypeList,
+					Required: true,
+					MaxItems: 1,
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"codec": {
+								Type:             schema.TypeString,
+								Required:         true,
+								ValidateDiagFunc: enum.Validate[types.InputCodec](),
+							},
+							"maximum_bitrate": {
+								Type:             schema.TypeString,
+								Required:         true,
+								ValidateDiagFunc: enum.Validate[types.InputMaximumBitrate](),
+							},
+							"input_resolution": {
+								Type:             schema.TypeString,
+								Required:         true,
+								ValidateDiagFunc: enum.Validate[types.InputResolution](),
+							},
 						},
 					},
 				},
-			},
-			"log_level": {
-				Type:             schema.TypeString,
-				Optional:         true,
-				Computed:         true,
-				ValidateDiagFunc: enum.Validate[types.LogLevel](),
-			},
-			"maintenance": {
-				Type:     schema.TypeList,
-				Optional: true,
-				Computed: true,
-				MaxItems: 1,
-				Elem: &schema.Resource{
-					Schema: map[string]*schema.Schema{
-						"maintenance_day": {
-							Type:             schema.TypeString,
-							Required:         true,
-							ValidateDiagFunc: enum.Validate[types.MaintenanceDay](),
-						},
-						"maintenance_start_time": {
-							Type:     schema.TypeString,
-							Required: true,
+				"log_level": {
+					Type:             schema.TypeString,
+					Optional:         true,
+					Computed:         true,
+					ValidateDiagFunc: enum.Validate[types.LogLevel](),
+				},
+				"maintenance": {
+					Type:     schema.TypeList,
+					Optional: true,
+					Computed: true,
+					MaxItems: 1,
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"maintenance_day": {
+								Type:             schema.TypeString,
+								Required:         true,
+								ValidateDiagFunc: enum.Validate[types.MaintenanceDay](),
+							},
+							"maintenance_start_time": {
+								Type:     schema.TypeString,
+								Required: true,
+							},
 						},
 					},
 				},
-			},
-			"name": {
-				Type:     schema.TypeString,
-				Required: true,
-			},
-			"role_arn": {
-				Type:             schema.TypeString,
-				Optional:         true,
-				ValidateDiagFunc: validation.ToDiagFunc(verify.ValidARN),
-			},
-			"start_channel": {
-				Type:     schema.TypeBool,
-				Optional: true,
-				Default:  false,
-			},
-			"vpc": {
-				Type:     schema.TypeList,
-				Optional: true,
-				MaxItems: 1,
-				ForceNew: true,
-				Elem: &schema.Resource{
-					Schema: map[string]*schema.Schema{
-						"availability_zones": {
-							Type:     schema.TypeList,
-							Computed: true,
-							Elem:     &schema.Schema{Type: schema.TypeString},
-						},
-						"public_address_allocation_ids": {
-							Type:     schema.TypeList,
-							Required: true,
-							Elem:     &schema.Schema{Type: schema.TypeString},
-						},
-						"security_group_ids": {
-							Type:     schema.TypeList,
-							Optional: true,
-							Computed: true,
-							MaxItems: 5,
-							Elem:     &schema.Schema{Type: schema.TypeString},
-						},
-						"subnet_ids": {
-							Type:     schema.TypeList,
-							Required: true,
-							Elem:     &schema.Schema{Type: schema.TypeString},
+				"name": {
+					Type:     schema.TypeString,
+					Required: true,
+				},
+				"role_arn": {
+					Type:             schema.TypeString,
+					Optional:         true,
+					ValidateDiagFunc: validation.ToDiagFunc(verify.ValidARN),
+				},
+				"start_channel": {
+					Type:     schema.TypeBool,
+					Optional: true,
+					Default:  false,
+				},
+				"vpc": {
+					Type:     schema.TypeList,
+					Optional: true,
+					MaxItems: 1,
+					ForceNew: true,
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"availability_zones": {
+								Type:     schema.TypeSet,
+								Computed: true,
+								Elem:     &schema.Schema{Type: schema.TypeString},
+							},
+							"network_interface_ids": {
+								Type:     schema.TypeSet,
+								Computed: true,
+								Elem:     &schema.Schema{Type: schema.TypeString},
+							},
+							"public_address_allocation_ids": {
+								Type:     schema.TypeList,
+								Required: true,
+								Elem:     &schema.Schema{Type: schema.TypeString},
+							},
+							"security_group_ids": {
+								Type:     schema.TypeSet,
+								Optional: true,
+								Computed: true,
+								MaxItems: 5,
+								Elem:     &schema.Schema{Type: schema.TypeString},
+							},
+							"subnet_ids": {
+								Type:     schema.TypeSet,
+								Required: true,
+								Elem:     &schema.Schema{Type: schema.TypeString},
+							},
 						},
 					},
 				},
-			},
-			names.AttrTags:    tftags.TagsSchema(),
-			names.AttrTagsAll: tftags.TagsSchemaComputed(),
+				names.AttrTags:    tftags.TagsSchema(),
+				names.AttrTagsAll: tftags.TagsSchemaComputed(),
+			}
 		},
 
 		CustomizeDiff: verify.SetTagsDiff,
@@ -1137,6 +1166,9 @@ func expandChannelInputAttachments(tfList []interface{}) []types.InputAttachment
 		if v, ok := m["input_settings"].([]interface{}); ok && len(v) > 0 {
 			a.InputSettings = expandInputAttachmentInputSettings(v)
 		}
+		if v, ok := m["automatic_input_failover_settings"].([]interface{}); ok && len(v) > 0 {
+			a.AutomaticInputFailoverSettings = expandInputAttachmentAutomaticInputFailoverSettings(v)
+		}
 
 		attachments = append(attachments, a)
 	}
@@ -1155,7 +1187,7 @@ func expandInputAttachmentInputSettings(tfList []interface{}) *types.InputSettin
 	if v, ok := m["audio_selector"].([]interface{}); ok && len(v) > 0 {
 		out.AudioSelectors = expandInputAttachmentInputSettingsAudioSelectors(v)
 	}
-	if v, ok := m["audio_selector"].([]interface{}); ok && len(v) > 0 {
+	if v, ok := m["caption_selector"].([]interface{}); ok && len(v) > 0 {
 		out.CaptionSelectors = expandInputAttachmentInputSettingsCaptionSelectors(v)
 	}
 	if v, ok := m["deblock_filter"].(string); ok && v != "" {
@@ -1164,8 +1196,8 @@ func expandInputAttachmentInputSettings(tfList []interface{}) *types.InputSettin
 	if v, ok := m["denoise_filter"].(string); ok && v != "" {
 		out.DenoiseFilter = types.InputDenoiseFilter(v)
 	}
-	if v, ok := m["filter_strength"].(int); ok {
-		out.FilterStrength = int32(v)
+	if v, ok := m["filter_strength"].(int); ok && v != 0 {
+		out.FilterStrength = aws.Int32(int32(v))
 	}
 	if v, ok := m["input_filter"].(string); ok && v != "" {
 		out.InputFilter = types.InputFilter(v)
@@ -1173,8 +1205,8 @@ func expandInputAttachmentInputSettings(tfList []interface{}) *types.InputSettin
 	if v, ok := m["network_input_settings"].([]interface{}); ok && len(v) > 0 {
 		out.NetworkInputSettings = expandInputAttachmentInputSettingsNetworkInputSettings(v)
 	}
-	if v, ok := m["scte35_pid"].(int); ok {
-		out.Scte35Pid = int32(v)
+	if v, ok := m["scte35_pid"].(int); ok && v != 0 {
+		out.Scte35Pid = aws.Int32(int32(v))
 	}
 	if v, ok := m["smpte2038_data_preference"].(string); ok && v != "" {
 		out.Smpte2038DataPreference = types.Smpte2038DataPreference(v)
@@ -1198,7 +1230,9 @@ func expandInputAttachmentInputSettingsAudioSelectors(tfList []interface{}) []ty
 		if v, ok := m["name"].(string); ok && v != "" {
 			a.Name = aws.String(v)
 		}
-		// TODO selectorSettings
+		if v, ok := m["selector_settings"].([]interface{}); ok && len(v) > 0 {
+			a.SelectorSettings = expandInputAttachmentInputSettingsAudioSelectorsSelectorSettings(v)
+		}
 
 		as = append(as, a)
 	}
@@ -1206,158 +1240,790 @@ func expandInputAttachmentInputSettingsAudioSelectors(tfList []interface{}) []ty
 	return as
 }
 
-func expandInputAttachmentInputSettingsCaptionSelectors(tfList []interface{}) []types.CaptionSelector {
-	var out []types.CaptionSelector
-	for _, v := range tfList {
-		m, ok := v.(map[string]interface{})
-		if !ok {
-			continue
-		}
+func expandInputAttachmentInputSettingsAudioSelectorsSelectorSettings(tfList []interface{}) *types.AudioSelectorSettings {
+	if tfList == nil {
+		return nil
+	}
 
-		var o types.CaptionSelector
-		if v, ok := m["name"].(string); ok && v != "" {
-			o.Name = aws.String(v)
-		}
-		if v, ok := m["language_code"].(string); ok && v != "" {
-			o.LanguageCode = aws.String(v)
-		}
-		// TODO selectorSettings
+	m := tfList[0].(map[string]interface{})
 
-		out = append(out, o)
+	var out types.AudioSelectorSettings
+	if v, ok := m["audio_hls_rendition_selection"].([]interface{}); ok && len(v) > 0 {
+		out.AudioHlsRenditionSelection = expandInputAttachmentInputSettingsAudioSelectorsSelectorSettingsAudioHlsRenditionSelection(v)
+	}
+	if v, ok := m["audio_language_selection"].([]interface{}); ok && len(v) > 0 {
+		out.AudioLanguageSelection = expandInputAttachmentInputSettingsAudioSelectorsSelectorSettingsAudioLanguageSelection(v)
+	}
+	if v, ok := m["audio_pid_selection"].([]interface{}); ok && len(v) > 0 {
+		out.AudioPidSelection = expandInputAttachmentInputSettingsAudioSelectorsSelectorSettingsAudioPidSelection(v)
+	}
+	if v, ok := m["audio_track_selection"].([]interface{}); ok && len(v) > 0 {
+		out.AudioTrackSelection = expandInputAttachmentInputSettingsAudioSelectorsSelectorSettingsAudioTrackSelection(v)
 	}
 
-	return out
+	return &out
 }
 
-func expandInputAttachmentInputSettingsNetworkInputSettings(tfList []interface{}) *types.NetworkInputSettings {
+func expandInputAttachmentInputSettingsAudioSelectorsSelectorSettingsAudioHlsRenditionSelection(tfList []interface{}) *types.AudioHlsRenditionSelection {
 	if tfList == nil {
 		return nil
 	}
 
 	m := tfList[0].(map[string]interface{})
 
-	var out types.NetworkInputSettings
-	if v, ok := m["hls_input_settings"].([]interface{}); ok && len(v) > 0 {
-		out.HlsInputSettings = expandNetworkInputSettingsHLSInputSettings(v)
+	var out types.AudioHlsRenditionSelection
+	if v, ok := m["group_id"].(string); ok && len(v) > 0 {
+		out.GroupId = aws.String(v)
 	}
-	if v, ok := m["server_validation"].(string); ok && v != "" {
-		out.ServerValidation = types.NetworkInputServerValidation(v)
+	if v, ok := m["name"].(string); ok && len(v) > 0 {
+		out.Name = aws.String(v)
 	}
 
 	return &out
 }
 
-func expandNetworkInputSettingsHLSInputSettings(tfList []interface{}) *types.HlsInputSettings {
+func expandInputAttachmentInputSettingsAudioSelectorsSelectorSettingsAudioLanguageSelection(tfList []interface{}) *types.AudioLanguageSelection {
 	if tfList == nil {
 		return nil
 	}
 
 	m := tfList[0].(map[string]interface{})
 
-	var out types.HlsInputSettings
-	if v, ok := m["bandwidth"].(int); ok {
-		out.Bandwidth = int32(v)
-	}
-	if v, ok := m["buffer_segments"].(int); ok {
-		out.BufferSegments = int32(v)
-	}
-	if v, ok := m["retries"].(int); ok {
-		out.Retries = int32(v)
+	var out types.AudioLanguageSelection
+	if v, ok := m["language_code"].(string); ok && len(v) > 0 {
+		out.LanguageCode = aws.String(v)
 	}
-	if v, ok := m["retry_interval"].(int); ok {
-		out.RetryInterval = int32(v)
-	}
-	if v, ok := m["scte35_source"].(string); ok && v != "" {
-		out.Scte35Source = types.HlsScte35SourceType(v)
+	if v, ok := m["language_selection_policy"].(string); ok && len(v) > 0 {
+		out.LanguageSelectionPolicy = types.AudioLanguageSelectionPolicy(v)
 	}
 
 	return &out
 }
 
-func flattenChannelInputAttachments(tfList []types.InputAttachment) []interface{} {
-	if len(tfList) == 0 {
+func expandInputAttachmentInputSettingsAudioSelectorsSelectorSettingsAudioPidSelection(tfList []interface{}) *types.AudioPidSelection {
+	if tfList == nil {
 		return nil
 	}
 
-	var out []interface{}
-
-	for _, item := range tfList {
-		m := map[string]interface{}{
-			"input_id":              aws.ToString(item.InputId),
-			"input_attachment_name": aws.ToString(item.InputAttachmentName),
-			"input_settings":        flattenInputAttachmentsInputSettings(item.InputSettings),
-		}
+	m := tfList[0].(map[string]interface{})
 
-		out = append(out, m)
+	var out types.AudioPidSelection
+	if v, ok := m["pid"].(int); ok && v != 0 {
+		out.Pid = aws.Int32(int32(v))
 	}
-	return out
+
+	return &out
 }
 
-func flattenInputAttachmentsInputSettings(in *types.InputSettings) []interface{} {
-	if in == nil {
+func expandInputAttachmentInputSettingsAudioSelectorsSelectorSettingsAudioTrackSelection(tfList []interface{}) *types.AudioTrackSelection {
+	if tfList == nil {
 		return nil
 	}
 
-	m := map[string]interface{}{
-		"audio_selector":            flattenInputAttachmentsInputSettingsAudioSelectors(in.AudioSelectors),
-		"caption_selector":          flattenInputAttachmentsInputSettingsCaptionSelectors(in.CaptionSelectors),
-		"deblock_filter":            string(in.DeblockFilter),
-		"denoise_filter":            string(in.DenoiseFilter),
-		"filter_strength":           int(in.FilterStrength),
-		"input_filter":              string(in.InputFilter),
-		"network_input_settings":    flattenInputAttachmentsInputSettingsNetworkInputSettings(in.NetworkInputSettings),
-		"scte35_pid":                int(in.Scte35Pid),
-		"smpte2038_data_preference": string(in.Smpte2038DataPreference),
-		"source_end_behavior":       string(in.SourceEndBehavior),
+	m := tfList[0].(map[string]interface{})
+
+	var out types.AudioTrackSelection
+	if v, ok := m["tracks"].(*schema.Set); ok && v.Len() > 0 {
+		out.Tracks = expandInputAttachmentInputSettingsAudioSelectorsSelectorSettingsAudioTrackSelectionTracks(v.List())
+	}
+	if v, ok := m["dolby_e_decode"].([]interface{}); ok && len(v) > 0 {
+		out.DolbyEDecode = expandInputAttachmentInputSettingsAudioSelectorsSelectorSettingsAudioTrackSelectionDolbyEDecode(v)
 	}
 
-	return []interface{}{m}
+	return &out
 }
 
-func flattenInputAttachmentsInputSettingsAudioSelectors(tfList []types.AudioSelector) []interface{} {
+func expandInputAttachmentInputSettingsAudioSelectorsSelectorSettingsAudioTrackSelectionTracks(tfList []interface{}) []types.AudioTrack {
 	if len(tfList) == 0 {
 		return nil
 	}
 
-	var out []interface{}
-
+	var out []types.AudioTrack
 	for _, v := range tfList {
-		m := map[string]interface{}{
-			"name": aws.ToString(v.Name),
+		m, ok := v.(map[string]interface{})
+		if !ok {
+			continue
 		}
 
-		out = append(out, m)
+		var o types.AudioTrack
+		if v, ok := m["track"].(int); ok && v != 0 {
+			o.Track = aws.Int32(int32(v))
+		}
+
+		out = append(out, o)
 	}
 
 	return out
 }
 
-func flattenInputAttachmentsInputSettingsCaptionSelectors(tfList []types.CaptionSelector) []interface{} {
-	if len(tfList) == 0 {
+func expandInputAttachmentInputSettingsAudioSelectorsSelectorSettingsAudioTrackSelectionDolbyEDecode(tfList []interface{}) *types.AudioDolbyEDecode {
+	if tfList == nil {
 		return nil
 	}
 
-	var out []interface{}
+	m := tfList[0].(map[string]interface{})
+
+	var out types.AudioDolbyEDecode
+	if v, ok := m["program_selection"].(string); ok && v != "" {
+		out.ProgramSelection = types.DolbyEProgramSelection(v)
+	}
+
+	return &out
+}
+
+func expandInputAttachmentInputSettingsCaptionSelectors(tfList []interface{}) []types.CaptionSelector {
+	if len(tfList) == 0 {
+		return nil
+	}
 
+	var out []types.CaptionSelector
 	for _, v := range tfList {
-		m := map[string]interface{}{
-			"name":          aws.ToString(v.Name),
-			"language_code": aws.ToString(v.LanguageCode),
+		m, ok := v.(map[string]interface{})
+		if !ok {
+			continue
 		}
 
-		out = append(out, m)
+		var o types.CaptionSelector
+		if v, ok := m["name"].(string); ok && v != "" {
+			o.Name = aws.String(v)
+		}
+		if v, ok := m["language_code"].(string); ok && v != "" {
+			o.LanguageCode = aws.String(v)
+		}
+		if v, ok := m["selector_settings"].([]interface{}); ok && len(v) > 0 {
+			o.SelectorSettings = expandInputAttachmentInputSettingsCaptionSelectorsSelectorSettings(v)
+		}
+
+		out = append(out, o)
 	}
 
 	return out
 }
 
-func flattenInputAttachmentsInputSettingsNetworkInputSettings(in *types.NetworkInputSettings) []interface{} {
-	if in == nil {
+func expandInputAttachmentInputSettingsCaptionSelectorsSelectorSettings(tfList []interface{}) *types.CaptionSelectorSettings {
+	if tfList == nil {
 		return nil
 	}
 
-	m := map[string]interface{}{
-		"hls_input_settings": flattenNetworkInputSettingsHLSInputSettings(in.HlsInputSettings),
+	m := tfList[0].(map[string]interface{})
+
+	var out types.CaptionSelectorSettings
+	if v, ok := m["ancillary_source_settings"].([]interface{}); ok && len(v) > 0 {
+		out.AncillarySourceSettings = expandInputAttachmentInputSettingsCaptionSelectorsSelectorSettingsAncillarySourceSettings(v)
+	}
+	if v, ok := m["arib_source_settings"].([]interface{}); ok && len(v) > 0 {
+		out.AribSourceSettings = &types.AribSourceSettings{} // no exported fields
+	}
+	if v, ok := m["dvb_sub_source_settings"].([]interface{}); ok && len(v) > 0 {
+		out.DvbSubSourceSettings = expandInputAttachmentInputSettingsCaptionSelectorsSelectorSettingsDvbSubSourceSettings(v)
+	}
+	if v, ok := m["embedded_source_settings"].([]interface{}); ok && len(v) > 0 {
+		out.EmbeddedSourceSettings = expandInputAttachmentInputSettingsCaptionSelectorsSelectorSettingsEmbeddedSourceSettings(v)
+	}
+	if v, ok := m["scte20_source_settings"].([]interface{}); ok && len(v) > 0 {
+		out.Scte20SourceSettings = expandInputAttachmentInputSettingsCaptionSelectorsSelectorSettingsScte20SourceSettings(v)
+	}
+	if v, ok := m["scte27_source_settings"].([]interface{}); ok && len(v) > 0 {
+		out.Scte27SourceSettings = expandInputAttachmentInputSettingsCaptionSelectorsSelectorSettingsScte27SourceSettings(v)
+	}
+	if v, ok := m["teletext_source_settings"].([]interface{}); ok && len(v) > 0 {
+		out.TeletextSourceSettings = expandInputAttachmentInputSettingsCaptionSelectorsSelectorSettingsTeletextSourceSettings(v)
+	}
+
+	return &out
+}
+
+func expandInputAttachmentInputSettingsCaptionSelectorsSelectorSettingsAncillarySourceSettings(tfList []interface{}) *types.AncillarySourceSettings {
+	if tfList == nil {
+		return nil
+	}
+
+	m := tfList[0].(map[string]interface{})
+
+	var out types.AncillarySourceSettings
+	if v, ok := m["source_ancillary_channel_number"].(int); ok && v != 0 {
+		out.SourceAncillaryChannelNumber = aws.Int32(int32(v))
+	}
+
+	return &out
+}
+
+func expandInputAttachmentInputSettingsCaptionSelectorsSelectorSettingsDvbSubSourceSettings(tfList []interface{}) *types.DvbSubSourceSettings {
+	if tfList == nil {
+		return nil
+	}
+
+	m := tfList[0].(map[string]interface{})
+
+	var out types.DvbSubSourceSettings
+	if v, ok := m["ocr_language"].(string); ok && v != "" {
+		out.OcrLanguage = types.DvbSubOcrLanguage(v)
+	}
+	if v, ok := m["pid"].(int); ok {
+		out.Pid = aws.Int32(int32(v))
+	}
+
+	return &out
+}
+
+func expandInputAttachmentInputSettingsCaptionSelectorsSelectorSettingsEmbeddedSourceSettings(tfList []interface{}) *types.EmbeddedSourceSettings {
+	if tfList == nil {
+		return nil
+	}
+
+	m := tfList[0].(map[string]interface{})
+
+	var out types.EmbeddedSourceSettings
+	if v, ok := m["convert_608_to_708"].(string); ok && v != "" {
+		out.Convert608To708 = types.EmbeddedConvert608To708(v)
+	}
+	if v, ok := m["scte20_detection"].(string); ok && v != "" {
+		out.Scte20Detection = types.EmbeddedScte20Detection(v)
+	}
+	if v, ok := m["source_608_channel_number"].(int); ok && v != 0 {
+		out.Source608ChannelNumber = aws.Int32(int32(v))
+	}
+
+	return &out
+}
+
+func expandInputAttachmentInputSettingsCaptionSelectorsSelectorSettingsScte20SourceSettings(tfList []interface{}) *types.Scte20SourceSettings {
+	if tfList == nil {
+		return nil
+	}
+
+	m := tfList[0].(map[string]interface{})
+
+	var out types.Scte20SourceSettings
+	if v, ok := m["convert_608_to_708"].(string); ok && v != "" {
+		out.Convert608To708 = types.Scte20Convert608To708(v)
+	}
+	if v, ok := m["source_608_channel_number"].(int); ok && v != 0 {
+		out.Source608ChannelNumber = aws.Int32(int32(v))
+	}
+
+	return &out
+}
+
+func expandInputAttachmentInputSettingsCaptionSelectorsSelectorSettingsScte27SourceSettings(tfList []interface{}) *types.Scte27SourceSettings {
+	if tfList == nil {
+		return nil
+	}
+
+	m := tfList[0].(map[string]interface{})
+
+	var out types.Scte27SourceSettings
+	if v, ok := m["ocr_language"].(string); ok && v != "" {
+		out.OcrLanguage = types.Scte27OcrLanguage(v)
+	}
+	if v, ok := m["pid"].(int); ok && v != 0 {
+		out.Pid = aws.Int32(int32(v))
+	}
+
+	return &out
+}
+
+func expandInputAttachmentInputSettingsCaptionSelectorsSelectorSettingsTeletextSourceSettings(tfList []interface{}) *types.TeletextSourceSettings {
+	if tfList == nil {
+		return nil
+	}
+
+	m := tfList[0].(map[string]interface{})
+
+	var out types.TeletextSourceSettings
+	if v, ok := m["output_rectangle"].([]interface{}); ok && len(v) > 0 {
+		out.OutputRectangle = expandInputAttachmentInputSettingsCaptionSelectorsSelectorSettingsTeletextSourceSettingsOutputRectangle(v)
+	}
+	if v, ok := m["page_number"].(string); ok && v != "" {
+		out.PageNumber = aws.String(v)
+	}
+
+	return &out
+}
+
+func expandInputAttachmentInputSettingsCaptionSelectorsSelectorSettingsTeletextSourceSettingsOutputRectangle(tfList []interface{}) *types.CaptionRectangle {
+	if tfList == nil {
+		return nil
+	}
+
+	m := tfList[0].(map[string]interface{})
+
+	var out types.CaptionRectangle
+	if v, ok := m["height"].(float32); ok && v != 0.0 {
+		out.Height = aws.Float64(float64(v))
+	}
+	if v, ok := m["left_offset"].(float32); ok && v != 0.0 {
+		out.LeftOffset = aws.Float64(float64(v))
+	}
+	if v, ok := m["top_offset"].(float32); ok && v != 0.0 {
+		out.TopOffset = aws.Float64(float64(v))
+	}
+	if v, ok := m["width"].(float32); ok && v != 0.0 {
+		out.Width = aws.Float64(float64(v))
+	}
+
+	return &out
+}
+
+func expandInputAttachmentInputSettingsNetworkInputSettings(tfList []interface{}) *types.NetworkInputSettings {
+	if tfList == nil {
+		return nil
+	}
+
+	m := tfList[0].(map[string]interface{})
+
+	var out types.NetworkInputSettings
+	if v, ok := m["hls_input_settings"].([]interface{}); ok && len(v) > 0 {
+		out.HlsInputSettings = expandNetworkInputSettingsHLSInputSettings(v)
+	}
+	if v, ok := m["server_validation"].(string); ok && v != "" {
+		out.ServerValidation = types.NetworkInputServerValidation(v)
+	}
+
+	return &out
+}
+
+func expandNetworkInputSettingsHLSInputSettings(tfList []interface{}) *types.HlsInputSettings {
+	if tfList == nil {
+		return nil
+	}
+
+	m := tfList[0].(map[string]interface{})
+
+	var out types.HlsInputSettings
+	if v, ok := m["bandwidth"].(int); ok && v != 0 {
+		out.Bandwidth = aws.Int32(int32(v))
+	}
+	if v, ok := m["buffer_segments"].(int); ok && v != 0 {
+		out.BufferSegments = aws.Int32(int32(v))
+	}
+	if v, ok := m["retries"].(int); ok && v != 0 {
+		out.Retries = aws.Int32(int32(v))
+	}
+	if v, ok := m["retry_interval"].(int); ok && v != 0 {
+		out.RetryInterval = aws.Int32(int32(v))
+	}
+	if v, ok := m["scte35_source"].(string); ok && v != "" {
+		out.Scte35Source = types.HlsScte35SourceType(v)
+	}
+
+	return &out
+}
+
+func expandInputAttachmentAutomaticInputFailoverSettings(tfList []interface{}) *types.AutomaticInputFailoverSettings {
+	if tfList == nil {
+		return nil
+	}
+
+	m := tfList[0].(map[string]interface{})
+
+	var out types.AutomaticInputFailoverSettings
+	if v, ok := m["secondary_input_id"].(string); ok && v != "" {
+		out.SecondaryInputId = aws.String(v)
+	}
+	if v, ok := m["error_clear_time_msec"].(int); ok && v != 0 {
+		out.ErrorClearTimeMsec = aws.Int32(int32(v))
+	}
+	if v, ok := m["failover_conditions"].(*schema.Set); ok && v.Len() > 0 {
+		out.FailoverConditions = expandInputAttachmentAutomaticInputFailoverSettingsFailoverConditions(v.List())
+	}
+	if v, ok := m["input_preference"].(string); ok && v != "" {
+		out.InputPreference = types.InputPreference(v)
+	}
+
+	return &out
+}
+
+func expandInputAttachmentAutomaticInputFailoverSettingsFailoverConditions(tfList []interface{}) []types.FailoverCondition {
+	if len(tfList) == 0 {
+		return nil
+	}
+
+	var out []types.FailoverCondition
+	for _, v := range tfList {
+		m, ok := v.(map[string]interface{})
+		if !ok {
+			continue
+		}
+
+		var o types.FailoverCondition
+		if v, ok := m["failover_condition_settings"].([]interface{}); ok && len(v) > 0 {
+			o.FailoverConditionSettings = expandInputAttachmentAutomaticInputFailoverSettingsFailoverConditionsFailoverConditionSettings(v)
+		}
+
+		out = append(out, o)
+	}
+
+	return out
+}
+
+func expandInputAttachmentAutomaticInputFailoverSettingsFailoverConditionsFailoverConditionSettings(tfList []interface{}) *types.FailoverConditionSettings {
+	if tfList == nil {
+		return nil
+	}
+
+	m := tfList[0].(map[string]interface{})
+
+	var out types.FailoverConditionSettings
+	if v, ok := m["audio_silence_settings"].([]interface{}); ok && len(v) > 0 {
+		out.AudioSilenceSettings = expandInputAttachmentAutomaticInputFailoverSettingsFailoverConditionsFailoverConditionSettingsAudioSilenceSettings(v)
+	}
+	if v, ok := m["input_loss_settings"].([]interface{}); ok && len(v) > 0 {
+		out.InputLossSettings = expandInputAttachmentAutomaticInputFailoverSettingsFailoverConditionsFailoverConditionSettingsInputLossSettings(v)
+	}
+	if v, ok := m["video_black_settings"].([]interface{}); ok && len(v) > 0 {
+		out.VideoBlackSettings = expandInputAttachmentAutomaticInputFailoverSettingsFailoverConditionsFailoverConditionSettingsVideoBlackSettings(v)
+	}
+
+	return &out
+}
+
+func expandInputAttachmentAutomaticInputFailoverSettingsFailoverConditionsFailoverConditionSettingsAudioSilenceSettings(tfList []interface{}) *types.AudioSilenceFailoverSettings {
+	if tfList == nil {
+		return nil
+	}
+
+	m := tfList[0].(map[string]interface{})
+
+	var out types.AudioSilenceFailoverSettings
+	if v, ok := m["audio_selector_name"].(string); ok && v != "" {
+		out.AudioSelectorName = aws.String(v)
+	}
+	if v, ok := m["audio_silence_threshold_msec"].(int); ok && v != 0 {
+		out.AudioSilenceThresholdMsec = aws.Int32(int32(v))
+	}
+
+	return &out
+}
+
+func expandInputAttachmentAutomaticInputFailoverSettingsFailoverConditionsFailoverConditionSettingsInputLossSettings(tfList []interface{}) *types.InputLossFailoverSettings {
+	if tfList == nil {
+		return nil
+	}
+
+	m := tfList[0].(map[string]interface{})
+
+	var out types.InputLossFailoverSettings
+	if v, ok := m["input_loss_threshold_msec"].(int); ok && v != 0 {
+		out.InputLossThresholdMsec = aws.Int32(int32(v))
+	}
+
+	return &out
+}
+
+func expandInputAttachmentAutomaticInputFailoverSettingsFailoverConditionsFailoverConditionSettingsVideoBlackSettings(tfList []interface{}) *types.VideoBlackFailoverSettings {
+	if tfList == nil {
+		return nil
+	}
+
+	m := tfList[0].(map[string]interface{})
+
+	var out types.VideoBlackFailoverSettings
+	if v, ok := m["black_detect_threshold"].(float32); ok && v != 0.0 {
+		out.BlackDetectThreshold = aws.Float64(float64(v))
+	}
+	if v, ok := m["video_black_threshold_msec"].(int); ok && v != 0 {
+		out.VideoBlackThresholdMsec = aws.Int32(int32(v))
+	}
+
+	return &out
+}
+
+func flattenChannelInputAttachments(tfList []types.InputAttachment) []interface{} {
+	if len(tfList) == 0 {
+		return nil
+	}
+
+	var out []interface{}
+
+	for _, item := range tfList {
+		m := map[string]interface{}{
+			"input_id":                          aws.ToString(item.InputId),
+			"input_attachment_name":             aws.ToString(item.InputAttachmentName),
+			"input_settings":                    flattenInputAttachmentsInputSettings(item.InputSettings),
+			"automatic_input_failover_settings": flattenInputAttachmentAutomaticInputFailoverSettings(item.AutomaticInputFailoverSettings),
+		}
+
+		out = append(out, m)
+	}
+
+	return out
+}
+
+func flattenInputAttachmentsInputSettings(in *types.InputSettings) []interface{} {
+	if in == nil {
+		return nil
+	}
+
+	m := map[string]interface{}{
+		"audio_selector":            flattenInputAttachmentsInputSettingsAudioSelectors(in.AudioSelectors),
+		"caption_selector":          flattenInputAttachmentsInputSettingsCaptionSelectors(in.CaptionSelectors),
+		"deblock_filter":            string(in.DeblockFilter),
+		"denoise_filter":            string(in.DenoiseFilter),
+		"filter_strength":           int(aws.ToInt32(in.FilterStrength)),
+		"input_filter":              string(in.InputFilter),
+		"network_input_settings":    flattenInputAttachmentsInputSettingsNetworkInputSettings(in.NetworkInputSettings),
+		"scte35_pid":                int(aws.ToInt32(in.Scte35Pid)),
+		"smpte2038_data_preference": string(in.Smpte2038DataPreference),
+		"source_end_behavior":       string(in.SourceEndBehavior),
+	}
+
+	return []interface{}{m}
+}
+
+func flattenInputAttachmentsInputSettingsAudioSelectors(tfList []types.AudioSelector) []interface{} {
+	if len(tfList) == 0 {
+		return nil
+	}
+
+	var out []interface{}
+
+	for _, v := range tfList {
+		m := map[string]interface{}{
+			"name":              aws.ToString(v.Name),
+			"selector_settings": flattenInputAttachmentsInputSettingsAudioSelectorsSelectorSettings(v.SelectorSettings),
+		}
+
+		out = append(out, m)
+	}
+
+	return out
+}
+
+func flattenInputAttachmentsInputSettingsAudioSelectorsSelectorSettings(in *types.AudioSelectorSettings) []interface{} {
+	if in == nil {
+		return nil
+	}
+
+	m := map[string]interface{}{
+		"audio_hls_rendition_selection": flattenInputAttachmentsInputSettingsAudioSelectorsSelectorSettingsAudioHlsRenditionSelection(in.AudioHlsRenditionSelection),
+		"audio_language_selection":      flattenInputAttachmentsInputSettingsAudioSelectorsSelectorSettingsAudioLanguageSelection(in.AudioLanguageSelection),
+		"audio_pid_selection":           flattenInputAttachmentsInputSettingsAudioSelectorsSelectorSettingsAudioPidSelection(in.AudioPidSelection),
+		"audio_track_selection":         flattenInputAttachmentsInputSettingsAudioSelectorsSelectorSettingsAudioTrackSelection(in.AudioTrackSelection),
+	}
+
+	return []interface{}{m}
+}
+
+func flattenInputAttachmentsInputSettingsAudioSelectorsSelectorSettingsAudioHlsRenditionSelection(in *types.AudioHlsRenditionSelection) []interface{} {
+	if in == nil {
+		return nil
+	}
+
+	m := map[string]interface{}{
+		"group_id": aws.ToString(in.GroupId),
+		"name":     aws.ToString(in.Name),
+	}
+
+	return []interface{}{m}
+}
+
+func flattenInputAttachmentsInputSettingsAudioSelectorsSelectorSettingsAudioLanguageSelection(in *types.AudioLanguageSelection) []interface{} {
+	if in == nil {
+		return nil
+	}
+
+	m := map[string]interface{}{
+		"language_code":             aws.ToString(in.LanguageCode),
+		"language_selection_policy": string(in.LanguageSelectionPolicy),
+	}
+
+	return []interface{}{m}
+}
+
+func flattenInputAttachmentsInputSettingsAudioSelectorsSelectorSettingsAudioPidSelection(in *types.AudioPidSelection) []interface{} {
+	if in == nil {
+		return nil
+	}
+
+	m := map[string]interface{}{
+		"pid": int(aws.ToInt32(in.Pid)),
+	}
+
+	return []interface{}{m}
+}
+
+func flattenInputAttachmentsInputSettingsAudioSelectorsSelectorSettingsAudioTrackSelection(in *types.AudioTrackSelection) []interface{} {
+	if in == nil {
+		return nil
+	}
+
+	m := map[string]interface{}{
+		"dolby_e_decode": flattenInputAttachmentsInputSettingsAudioSelectorsSelectorSettingsAudioTrackSelectionDolbyEDecode(in.DolbyEDecode),
+		"tracks":         flattenInputAttachmentsInputSettingsAudioSelectorsSelectorSettingsAudioTrackSelectionTracks(in.Tracks),
+	}
+
+	return []interface{}{m}
+}
+
+func flattenInputAttachmentsInputSettingsAudioSelectorsSelectorSettingsAudioTrackSelectionDolbyEDecode(in *types.AudioDolbyEDecode) []interface{} {
+	if in == nil {
+		return nil
+	}
+
+	m := map[string]interface{}{
+		"program_selection": string(in.ProgramSelection),
+	}
+
+	return []interface{}{m}
+}
+
+func flattenInputAttachmentsInputSettingsAudioSelectorsSelectorSettingsAudioTrackSelectionTracks(tfList []types.AudioTrack) []interface{} {
+	if len(tfList) == 0 {
+		return nil
+	}
+
+	var out []interface{}
+
+	for _, v := range tfList {
+		m := map[string]interface{}{
+			"track": int(aws.ToInt32(v.Track)),
+		}
+
+		out = append(out, m)
+	}
+
+	return out
+}
+
+func flattenInputAttachmentsInputSettingsCaptionSelectors(tfList []types.CaptionSelector) []interface{} {
+	if len(tfList) == 0 {
+		return nil
+	}
+
+	var out []interface{}
+
+	for _, v := range tfList {
+		m := map[string]interface{}{
+			"name":              aws.ToString(v.Name),
+			"language_code":     aws.ToString(v.LanguageCode),
+			"selector_settings": flattenInputAttachmentsInputSettingsCaptionSelectorsSelectorSettings(v.SelectorSettings),
+		}
+
+		out = append(out, m)
+	}
+
+	return out
+}
+
+func flattenInputAttachmentsInputSettingsCaptionSelectorsSelectorSettings(in *types.CaptionSelectorSettings) []interface{} {
+	if in == nil {
+		return nil
+	}
+
+	m := map[string]interface{}{
+		"ancillary_source_settings": flattenInputAttachmentsInputSettingsCaptionSelectorsSelectorSettingsAncillarySourceSettings(in.AncillarySourceSettings),
+		"arib_source_settings":      []interface{}{}, // attribute has no exported fields
+		"dvb_sub_source_settings":   flattenInputAttachmentsInputSettingsCaptionSelectorsSelectorSettingsDvbSubSourceSettings(in.DvbSubSourceSettings),
+		"embedded_source_settings":  flattenInputAttachmentsInputSettingsCaptionSelectorsSelectorSettingsEmbeddedSourceSettings(in.EmbeddedSourceSettings),
+		"scte20_source_settings":    flattenInputAttachmentsInputSettingsCaptionSelectorsSelectorSettingsScte20SourceSettings(in.Scte20SourceSettings),
+		"scte27_source_settings":    flattenInputAttachmentsInputSettingsCaptionSelectorsSelectorSettingsScte27SourceSettings(in.Scte27SourceSettings),
+		"teletext_source_settings":  flattenInputAttachmentsInputSettingsCaptionSelectorsSelectorSettingsTeletextSourceSettings(in.TeletextSourceSettings),
+	}
+
+	return []interface{}{m}
+}
+
+func flattenInputAttachmentsInputSettingsCaptionSelectorsSelectorSettingsAncillarySourceSettings(in *types.AncillarySourceSettings) []interface{} {
+	if in == nil {
+		return nil
+	}
+
+	m := map[string]interface{}{
+		"source_ancillary_channel_number": int(aws.ToInt32(in.SourceAncillaryChannelNumber)),
+	}
+
+	return []interface{}{m}
+}
+
+func flattenInputAttachmentsInputSettingsCaptionSelectorsSelectorSettingsDvbSubSourceSettings(in *types.DvbSubSourceSettings) []interface{} {
+	if in == nil {
+		return nil
+	}
+
+	m := map[string]interface{}{
+		"ocr_language": string(in.OcrLanguage),
+		"pid":          int(aws.ToInt32(in.Pid)),
+	}
+
+	return []interface{}{m}
+}
+
+func flattenInputAttachmentsInputSettingsCaptionSelectorsSelectorSettingsEmbeddedSourceSettings(in *types.EmbeddedSourceSettings) []interface{} {
+	if in == nil {
+		return nil
+	}
+
+	m := map[string]interface{}{
+		"convert_608_to_708":        string(in.Convert608To708),
+		"scte20_detection":          string(in.Scte20Detection),
+		"source_608_channel_number": int(aws.ToInt32(in.Source608ChannelNumber)),
+	}
+
+	return []interface{}{m}
+}
+
+func flattenInputAttachmentsInputSettingsCaptionSelectorsSelectorSettingsScte20SourceSettings(in *types.Scte20SourceSettings) []interface{} {
+	if in == nil {
+		return nil
+	}
+
+	m := map[string]interface{}{
+		"convert_608_to_708":        string(in.Convert608To708),
+		"source_608_channel_number": int(aws.ToInt32(in.Source608ChannelNumber)),
+	}
+
+	return []interface{}{m}
+}
+
+func flattenInputAttachmentsInputSettingsCaptionSelectorsSelectorSettingsScte27SourceSettings(in *types.Scte27SourceSettings) []interface{} {
+	if in == nil {
+		return nil
+	}
+
+	m := map[string]interface{}{
+		"ocr_language": string(in.OcrLanguage),
+		"pid":          int(aws.ToInt32(in.Pid)),
+	}
+
+	return []interface{}{m}
+}
+
+func flattenInputAttachmentsInputSettingsCaptionSelectorsSelectorSettingsTeletextSourceSettings(in *types.TeletextSourceSettings) []interface{} {
+	if in == nil {
+		return nil
+	}
+
+	m := map[string]interface{}{
+		"output_rectangle": flattenInputAttachmentsInputSettingsCaptionSelectorsSelectorSettingsTeletextSourceSettingsOutputRectangle(in.OutputRectangle),
+		"page_number":      aws.ToString(in.PageNumber),
+	}
+
+	return []interface{}{m}
+}
+
+func flattenInputAttachmentsInputSettingsCaptionSelectorsSelectorSettingsTeletextSourceSettingsOutputRectangle(in *types.CaptionRectangle) []interface{} {
+	if in == nil {
+		return nil
+	}
+
+	m := map[string]interface{}{
+		"height":      float32(aws.ToFloat64(in.Height)),
+		"left_offset": float32(aws.ToFloat64(in.LeftOffset)),
+		"top_offset":  float32(aws.ToFloat64(in.TopOffset)),
+		"width":       float32(aws.ToFloat64(in.Width)),
+	}
+
+	return []interface{}{m}
+}
+
+func flattenInputAttachmentsInputSettingsNetworkInputSettings(in *types.NetworkInputSettings) []interface{} {
+	if in == nil {
+		return nil
+	}
+
+	m := map[string]interface{}{
+		"hls_input_settings": flattenNetworkInputSettingsHLSInputSettings(in.HlsInputSettings),
 		"server_validation":  string(in.ServerValidation),
 	}
 
@@ -1370,16 +2036,100 @@ func flattenNetworkInputSettingsHLSInputSettings(in *types.HlsInputSettings) []i
 	}
 
 	m := map[string]interface{}{
-		"bandwidth":       int(in.Bandwidth),
-		"buffer_segments": int(in.BufferSegments),
-		"retries":         int(in.Retries),
-		"retry_interval":  int(in.RetryInterval),
+		"bandwidth":       int(aws.ToInt32(in.Bandwidth)),
+		"buffer_segments": int(aws.ToInt32(in.BufferSegments)),
+		"retries":         int(aws.ToInt32(in.Retries)),
+		"retry_interval":  int(aws.ToInt32(in.RetryInterval)),
 		"scte35_source":   string(in.Scte35Source),
 	}
 
 	return []interface{}{m}
 }
 
+func flattenInputAttachmentAutomaticInputFailoverSettings(in *types.AutomaticInputFailoverSettings) []interface{} {
+	if in == nil {
+		return nil
+	}
+
+	m := map[string]interface{}{
+		"secondary_input_id":    aws.ToString(in.SecondaryInputId),
+		"error_clear_time_msec": int(aws.ToInt32(in.ErrorClearTimeMsec)),
+		"failover_conditions":   flattenInputAttachmentAutomaticInputFailoverSettingsFailoverConditions(in.FailoverConditions),
+		"input_preference":      string(in.InputPreference),
+	}
+
+	return []interface{}{m}
+}
+
+func flattenInputAttachmentAutomaticInputFailoverSettingsFailoverConditions(tfList []types.FailoverCondition) []interface{} {
+	if len(tfList) == 0 {
+		return nil
+	}
+
+	var out []interface{}
+
+	for _, item := range tfList {
+		m := map[string]interface{}{
+			"failover_condition_settings": flattenInputAttachmentAutomaticInputFailoverSettingsFailoverConditionsFailoverConditionSettings(item.FailoverConditionSettings),
+		}
+
+		out = append(out, m)
+	}
+	return out
+}
+
+func flattenInputAttachmentAutomaticInputFailoverSettingsFailoverConditionsFailoverConditionSettings(in *types.FailoverConditionSettings) []interface{} {
+	if in == nil {
+		return nil
+	}
+
+	m := map[string]interface{}{
+		"audio_silence_settings": flattenInputAttachmentAutomaticInputFailoverSettingsFailoverConditionsFailoverConditionSettingsAudioSilenceSettings(in.AudioSilenceSettings),
+		"input_loss_settings":    flattenInputAttachmentAutomaticInputFailoverSettingsFailoverConditionsFailoverConditionSettingsInputLossSettings(in.InputLossSettings),
+		"video_black_settings":   flattenInputAttachmentAutomaticInputFailoverSettingsFailoverConditionsFailoverConditionSettingsVideoBlackSettings(in.VideoBlackSettings),
+	}
+
+	return []interface{}{m}
+}
+
+func flattenInputAttachmentAutomaticInputFailoverSettingsFailoverConditionsFailoverConditionSettingsAudioSilenceSettings(in *types.AudioSilenceFailoverSettings) []interface{} {
+	if in == nil {
+		return nil
+	}
+
+	m := map[string]interface{}{
+		"audio_selector_name":          aws.ToString(in.AudioSelectorName),
+		"audio_silence_threshold_msec": int(aws.ToInt32(in.AudioSilenceThresholdMsec)),
+	}
+
+	return []interface{}{m}
+}
+
+func flattenInputAttachmentAutomaticInputFailoverSettingsFailoverConditionsFailoverConditionSettingsInputLossSettings(in *types.InputLossFailoverSettings) []interface{} {
+	if in == nil {
+		return nil
+	}
+
+	m := map[string]interface{}{
+		"input_loss_threshold_msec": int(aws.ToInt32(in.InputLossThresholdMsec)),
+	}
+
+	return []interface{}{m}
+}
+
+func flattenInputAttachmentAutomaticInputFailoverSettingsFailoverConditionsFailoverConditionSettingsVideoBlackSettings(in *types.VideoBlackFailoverSettings) []interface{} {
+	if in == nil {
+		return nil
+	}
+
+	m := map[string]interface{}{
+		"black_detect_threshold":     float32(aws.ToFloat64(in.BlackDetectThreshold)),
+		"video_black_threshold_msec": int(aws.ToInt32(in.VideoBlackThresholdMsec)),
+	}
+
+	return []interface{}{m}
+}
+
 func expandChannelCdiInputSpecification(tfList []interface{}) *types.CdiInputSpecification {
 	if tfList == nil {
 		return nil
@@ -1673,14 +2423,14 @@ func expandChannelVPC(tfList []interface{}) *types.VpcOutputSettings {
 	m := tfList[0].(map[string]interface{})
 
 	settings := &types.VpcOutputSettings{}
-	if v, ok := m["security_group_ids"].([]string); ok && len(v) > 0 {
-		settings.SecurityGroupIds = v
+	if v, ok := m["security_group_ids"].(*schema.Set); ok && v.Len() > 0 {
+		settings.SecurityGroupIds = flex.ExpandStringValueSet(v)
 	}
-	if v, ok := m["subnet_ids"].([]string); ok && len(v) > 0 {
-		settings.SubnetIds = v
+	if v, ok := m["subnet_ids"].(*schema.Set); ok && v.Len() > 0 {
+		settings.SubnetIds = flex.ExpandStringValueSet(v)
 	}
-	if v, ok := m["public_address_allocation_ids"].([]string); ok && len(v) > 0 {
-		settings.PublicAddressAllocationIds = v
+	if v, ok := m["public_address_allocation_ids"].(*schema.Set); ok && v.Len() > 0 {
+		settings.PublicAddressAllocationIds = flex.ExpandStringValueSet(v)
 	}
 
 	return settings
@@ -1692,8 +2442,10 @@ func flattenChannelVPC(apiObject *types.VpcOutputSettingsDescription) []interfac
 	}
 
 	m := map[string]interface{}{
-		"security_group_ids": flex.FlattenStringValueList(apiObject.SecurityGroupIds),
-		"subnet_ids":         flex.FlattenStringValueList(apiObject.SubnetIds),
+		"availability_zones":    flex.FlattenStringValueSet(apiObject.AvailabilityZones),
+		"network_interface_ids": flex.FlattenStringValueSet(apiObject.NetworkInterfaceIds),
+		"security_group_ids":    flex.FlattenStringValueSet(apiObject.SecurityGroupIds),
+		"subnet_ids":            flex.FlattenStringValueSet(apiObject.SubnetIds),
 		// public_address_allocation_ids is not included in the output struct
 	}
 
diff --git a/internal/service/medialive/channel_encoder_settings_schema.go b/internal/service/medialive/channel_encoder_settings_schema.go
index e9699b50350..a5500e12baa 100644
--- a/internal/service/medialive/channel_encoder_settings_schema.go
+++ b/internal/service/medialive/channel_encoder_settings_schema.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package medialive
 
 import (
@@ -1921,78 +1924,524 @@ func channelEncoderSettingsSchema() *schema.Schema {
 				},
 				// TODO avail_configuration
 				// TODO blackout_slate
-				// TODO caption_descriptions
-				// TODO feature_activations
-				// TODO global_configuration
-				// TODO motion_graphics_configuration
-				// TODO nielsen_configuration
-			},
-		},
-	}
-}
-func outputSettingsSchema() *schema.Schema {
-	return &schema.Schema{
-		Type:     schema.TypeList,
-		Required: true,
-		MaxItems: 1,
-		Elem: &schema.Resource{
-			Schema: map[string]*schema.Schema{
-				"archive_output_settings": {
+				"caption_descriptions": {
 					Type:     schema.TypeList,
 					Optional: true,
-					MaxItems: 1,
+					Computed: true,
 					Elem: &schema.Resource{
 						Schema: map[string]*schema.Schema{
-							"container_settings": {
+							"caption_selector_name": {
+								Type:     schema.TypeString,
+								Required: true,
+							},
+							"name": {
+								Type:     schema.TypeString,
+								Required: true,
+							},
+							"accessibility": {
+								Type:             schema.TypeString,
+								Optional:         true,
+								ValidateDiagFunc: enum.Validate[types.AccessibilityType](),
+							},
+
+							"destination_settings": {
 								Type:     schema.TypeList,
 								Optional: true,
 								MaxItems: 1,
 								Elem: &schema.Resource{
 									Schema: map[string]*schema.Schema{
-										"m2ts_settings": func() *schema.Schema {
-											return m2tsSettingsSchema()
-										}(),
-										// This is in the API and Go SDK docs, but has no exported fields.
-										"raw_settings": {
+										"arib_destination_settings": {
 											Type:     schema.TypeList,
 											Optional: true,
 											MaxItems: 1,
 											Elem: &schema.Resource{
-												Schema: map[string]*schema.Schema{},
+												Schema: map[string]*schema.Schema{}, // no exported elements in this list
+											},
+										},
+										"burn_in_destination_settings": {
+											Type:     schema.TypeList,
+											Optional: true,
+											MaxItems: 1,
+											Elem: &schema.Resource{
+												Schema: map[string]*schema.Schema{
+													"alignment": {
+														Type:             schema.TypeString,
+														Optional:         true,
+														ValidateDiagFunc: enum.Validate[types.BurnInAlignment](),
+													},
+													"background_color": {
+														Type:             schema.TypeString,
+														Optional:         true,
+														ValidateDiagFunc: enum.Validate[types.BurnInBackgroundColor](),
+													},
+													"background_opacity": {
+														Type:     schema.TypeInt,
+														Optional: true,
+													},
+													"font": func() *schema.Schema {
+														return inputLocationSchema()
+													}(),
+													"font_color": {
+														Type:             schema.TypeString,
+														Optional:         true,
+														ValidateDiagFunc: enum.Validate[types.BurnInFontColor](),
+													},
+													"font_opacity": {
+														Type:         schema.TypeInt,
+														Default:      0,
+														Optional:     true,
+														ValidateFunc: validation.IntAtLeast(0),
+													},
+													"font_resolution": {
+														Type:         schema.TypeInt,
+														Default:      96,
+														Optional:     true,
+														ValidateFunc: validation.IntAtLeast(1),
+													},
+													"font_size": {
+														Type:     schema.TypeString,
+														Optional: true,
+													},
+													"outline_color": {
+														Type:             schema.TypeString,
+														Required:         true,
+														ValidateDiagFunc: enum.Validate[types.BurnInOutlineColor](),
+													},
+													"outline_size": {
+														Type:     schema.TypeInt,
+														Optional: true,
+													},
+													"shadow_color": {
+														Type:             schema.TypeString,
+														Optional:         true,
+														ValidateDiagFunc: enum.Validate[types.BurnInShadowColor](),
+													},
+													"shadow_opacity": {
+														Type:         schema.TypeInt,
+														Default:      0,
+														Optional:     true,
+														ValidateFunc: validation.IntAtLeast(0),
+													},
+													"shadow_x_offset": {
+														Type:     schema.TypeInt,
+														Optional: true,
+													},
+													"shadow_y_offset": {
+														Type:     schema.TypeInt,
+														Optional: true,
+													},
+													"teletext_grid_control": {
+														Type:             schema.TypeString,
+														Required:         true,
+														ValidateDiagFunc: enum.Validate[types.BurnInTeletextGridControl](),
+													},
+													"x_position": {
+														Type:     schema.TypeInt,
+														Optional: true,
+													},
+													"y_position": {
+														Type:     schema.TypeInt,
+														Optional: true,
+													},
+												},
+											},
+										},
+										"dvb_sub_destination_settings": {
+											Type:     schema.TypeList,
+											Optional: true,
+											MaxItems: 1,
+											Elem: &schema.Resource{
+												Schema: map[string]*schema.Schema{
+													"alignment": {
+														Type:             schema.TypeString,
+														Optional:         true,
+														ValidateDiagFunc: enum.Validate[types.DvbSubDestinationAlignment](),
+													},
+													"background_color": {
+														Type:             schema.TypeString,
+														Optional:         true,
+														ValidateDiagFunc: enum.Validate[types.DvbSubDestinationBackgroundColor](),
+													},
+													"background_opacity": {
+														Type:         schema.TypeInt,
+														Default:      0,
+														Optional:     true,
+														ValidateFunc: validation.IntAtLeast(0),
+													},
+													"font": func() *schema.Schema {
+														return inputLocationSchema()
+													}(),
+													"font_color": {
+														Type:             schema.TypeString,
+														Optional:         true,
+														ValidateDiagFunc: enum.Validate[types.DvbSubDestinationFontColor](),
+													},
+													"font_opacity": {
+														Type:         schema.TypeInt,
+														Optional:     true,
+														ValidateFunc: validation.IntAtLeast(0),
+													},
+													"font_resolution": {
+														Type:         schema.TypeInt,
+														Default:      96,
+														Optional:     true,
+														ValidateFunc: validation.IntAtLeast(1),
+													},
+													"font_size": {
+														Type:     schema.TypeString,
+														Optional: true,
+														Computed: true,
+													},
+													"outline_color": {
+														Type:             schema.TypeString,
+														Optional:         true,
+														ValidateDiagFunc: enum.Validate[types.DvbSubDestinationOutlineColor](),
+													},
+													"outline_size": {
+														Type:     schema.TypeInt,
+														Optional: true,
+													},
+													"shadow_color": {
+														Type:             schema.TypeString,
+														Optional:         true,
+														ValidateDiagFunc: enum.Validate[types.DvbSubDestinationShadowColor](),
+													},
+													"shadow_opacity": {
+														Type:         schema.TypeInt,
+														Default:      0,
+														Optional:     true,
+														ValidateFunc: validation.IntAtLeast(0),
+													},
+													"shadow_x_offset": {
+														Type:     schema.TypeInt,
+														Optional: true,
+													},
+													"shadow_y_offset": {
+														Type:     schema.TypeInt,
+														Optional: true,
+													},
+													"teletext_grid_control": {
+														Type:             schema.TypeString,
+														Optional:         true,
+														ValidateDiagFunc: enum.Validate[types.DvbSubDestinationTeletextGridControl](),
+													},
+													"x_position": {
+														Type:     schema.TypeInt,
+														Optional: true,
+													},
+													"y_position": {
+														Type:     schema.TypeInt,
+														Optional: true,
+													},
+												},
+											},
+										},
+										"ebu_tt_d_destination_settings": {
+											Type:     schema.TypeList,
+											Optional: true,
+											MaxItems: 1,
+											Elem: &schema.Resource{
+												Schema: map[string]*schema.Schema{
+													"copyright_holder": {
+														Type:     schema.TypeString,
+														Optional: true,
+													},
+													"fill_line_gap": {
+														Type:             schema.TypeString,
+														Optional:         true,
+														ValidateDiagFunc: enum.Validate[types.EbuTtDFillLineGapControl](),
+													},
+													"font_family": {
+														Type:     schema.TypeString,
+														Optional: true,
+													},
+													"style_control": {
+														Type:             schema.TypeString,
+														Optional:         true,
+														Computed:         true,
+														ValidateDiagFunc: enum.Validate[types.EbuTtDDestinationStyleControl](),
+													},
+												},
+											},
+										},
+										"embedded_destination_settings": {
+											Type:     schema.TypeList,
+											Optional: true,
+											MaxItems: 1,
+											Elem: &schema.Resource{
+												Schema: map[string]*schema.Schema{}, // no exported elements in this list
+											},
+										},
+										"embedded_plus_scte20_destination_settings": {
+											Type:     schema.TypeList,
+											Optional: true,
+											MaxItems: 1,
+											Elem: &schema.Resource{
+												Schema: map[string]*schema.Schema{}, // no exported elements in this list
+											},
+										},
+										"rtmp_caption_info_destination_settings": {
+											Type:     schema.TypeList,
+											Optional: true,
+											MaxItems: 1,
+											Elem: &schema.Resource{
+												Schema: map[string]*schema.Schema{}, // no exported elements in this list
+											},
+										},
+										"scte20_plus_embedded_destination_settings": {
+											Type:     schema.TypeList,
+											Optional: true,
+											MaxItems: 1,
+											Elem: &schema.Resource{
+												Schema: map[string]*schema.Schema{}, // no exported elements in this list
+											},
+										},
+										"scte27_destination_settings": {
+											Type:     schema.TypeList,
+											Optional: true,
+											MaxItems: 1,
+											Elem: &schema.Resource{
+												Schema: map[string]*schema.Schema{}, // no exported elements in this list
+											},
+										},
+										"smpte_tt_destination_settings": {
+											Type:     schema.TypeList,
+											Optional: true,
+											MaxItems: 1,
+											Elem: &schema.Resource{
+												Schema: map[string]*schema.Schema{}, // no exported elements in this list
+											},
+										},
+										"teletext_destination_settings": {
+											Type:     schema.TypeList,
+											Optional: true,
+											MaxItems: 1,
+											Elem: &schema.Resource{
+												Schema: map[string]*schema.Schema{}, // no exported elements in this list
+											},
+										},
+										"ttml_destination_settings": {
+											Type:     schema.TypeList,
+											Optional: true,
+											MaxItems: 1,
+											Elem: &schema.Resource{
+												Schema: map[string]*schema.Schema{
+													"style_control": {
+														Type:             schema.TypeString,
+														Required:         true,
+														ValidateDiagFunc: enum.Validate[types.TtmlDestinationStyleControl](),
+													},
+												},
+											},
+										},
+										"webvtt_destination_settings": {
+											Type:     schema.TypeList,
+											Optional: true,
+											MaxItems: 1,
+											Elem: &schema.Resource{
+												Schema: map[string]*schema.Schema{
+													"style_control": {
+														Type:             schema.TypeString,
+														Required:         true,
+														ValidateDiagFunc: enum.Validate[types.WebvttDestinationStyleControl](),
+													},
+												},
 											},
 										},
 									},
 								},
 							},
-							"extension": {
+							"language_code": {
 								Type:     schema.TypeString,
 								Optional: true,
 							},
-							"name_modifier": {
+							"language_description": {
 								Type:     schema.TypeString,
 								Optional: true,
 							},
 						},
 					},
 				},
-				"frame_capture_output_settings": {
+				// TODO feature_activations
+				"global_configuration": {
 					Type:     schema.TypeList,
 					Optional: true,
 					MaxItems: 1,
 					Elem: &schema.Resource{
 						Schema: map[string]*schema.Schema{
-							"name_modifier": {
-								Type:     schema.TypeString,
+							"initial_audio_gain": {
+								Type:     schema.TypeInt,
 								Optional: true,
-								Computed: true,
 							},
-						},
-					},
-				},
-				"hls_output_settings": {
-					Type:     schema.TypeList,
-					Optional: true,
-					MaxItems: 1,
+							"input_end_action": {
+								Type:             schema.TypeString,
+								Optional:         true,
+								ValidateDiagFunc: enum.Validate[types.GlobalConfigurationInputEndAction](),
+							},
+							"input_loss_behavior": {
+								Type:     schema.TypeList,
+								Optional: true,
+								MaxItems: 1,
+								Elem: &schema.Resource{
+									Schema: map[string]*schema.Schema{
+										"black_frame_msec": {
+											Type:     schema.TypeInt,
+											Optional: true,
+										},
+										"input_loss_image_color": {
+											Type:     schema.TypeString,
+											Optional: true,
+										},
+										"input_loss_image_slate": func() *schema.Schema {
+											return inputLocationSchema()
+										}(),
+
+										"input_loss_image_type": {
+											Type:             schema.TypeString,
+											Optional:         true,
+											ValidateDiagFunc: enum.Validate[types.InputLossImageType](),
+										},
+										"repeat_frame_msec": {
+											Type:     schema.TypeInt,
+											Optional: true,
+										},
+									},
+								},
+							},
+							"output_locking_mode": {
+								Type:             schema.TypeString,
+								Optional:         true,
+								ValidateDiagFunc: enum.Validate[types.GlobalConfigurationOutputLockingMode](),
+							},
+							"output_timing_source": {
+								Type:             schema.TypeString,
+								Optional:         true,
+								ValidateDiagFunc: enum.Validate[types.GlobalConfigurationOutputTimingSource](),
+							},
+							"support_low_framerate_inputs": {
+								Type:             schema.TypeString,
+								Optional:         true,
+								ValidateDiagFunc: enum.Validate[types.GlobalConfigurationLowFramerateInputs](),
+							},
+						},
+					},
+				},
+				"motion_graphics_configuration": {
+					Type:     schema.TypeList,
+					Optional: true,
+					MaxItems: 1,
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"motion_graphics_settings": {
+								Type:     schema.TypeList,
+								Required: true,
+								MaxItems: 1,
+								Elem: &schema.Resource{
+									Schema: map[string]*schema.Schema{
+										"html_motion_graphics_settings": {
+											Type:     schema.TypeList,
+											Optional: true,
+											MaxItems: 1,
+											Elem: &schema.Resource{
+												Schema: map[string]*schema.Schema{}, // no exported elements in this list
+											},
+										},
+									},
+								},
+							},
+							"motion_graphics_insertion": {
+								Type:             schema.TypeString,
+								Optional:         true,
+								ValidateDiagFunc: enum.Validate[types.MotionGraphicsInsertion](),
+							},
+						},
+					},
+				},
+				"nielsen_configuration": {
+					Type:     schema.TypeList,
+					Optional: true,
+					MaxItems: 1,
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"distributor_id": {
+								Type:     schema.TypeString,
+								Optional: true,
+							},
+							"nielsen_pcm_to_id3_tagging": {
+								Type:             schema.TypeString,
+								Optional:         true,
+								ValidateDiagFunc: enum.Validate[types.NielsenPcmToId3TaggingState](),
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+}
+func outputSettingsSchema() *schema.Schema {
+	return &schema.Schema{
+		Type:     schema.TypeList,
+		Required: true,
+		MaxItems: 1,
+		Elem: &schema.Resource{
+			Schema: map[string]*schema.Schema{
+				"archive_output_settings": {
+					Type:     schema.TypeList,
+					Optional: true,
+					MaxItems: 1,
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"container_settings": {
+								Type:     schema.TypeList,
+								Optional: true,
+								MaxItems: 1,
+								Elem: &schema.Resource{
+									Schema: map[string]*schema.Schema{
+										"m2ts_settings": func() *schema.Schema {
+											return m2tsSettingsSchema()
+										}(),
+										// This is in the API and Go SDK docs, but has no exported fields.
+										"raw_settings": {
+											Type:     schema.TypeList,
+											Optional: true,
+											MaxItems: 1,
+											Elem: &schema.Resource{
+												Schema: map[string]*schema.Schema{},
+											},
+										},
+									},
+								},
+							},
+							"extension": {
+								Type:     schema.TypeString,
+								Optional: true,
+							},
+							"name_modifier": {
+								Type:     schema.TypeString,
+								Optional: true,
+							},
+						},
+					},
+				},
+				"frame_capture_output_settings": {
+					Type:     schema.TypeList,
+					Optional: true,
+					MaxItems: 1,
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"name_modifier": {
+								Type:     schema.TypeString,
+								Optional: true,
+								Computed: true,
+							},
+						},
+					},
+				},
+				"hls_output_settings": {
+					Type:     schema.TypeList,
+					Optional: true,
+					MaxItems: 1,
 					Elem: &schema.Resource{
 						Schema: map[string]*schema.Schema{
 							"hls_settings": func() *schema.Schema {
@@ -2636,19 +3085,19 @@ func expandChannelEncoderSettings(tfList []interface{}) *types.EncoderSettings {
 		settings.BlackoutSlate = nil // TODO expandChannelEncoderSettingsBlackoutSlate(v)
 	}
 	if v, ok := m["caption_descriptions"].([]interface{}); ok && len(v) > 0 {
-		settings.CaptionDescriptions = nil // TODO expandChannelEncoderSettingsCaptionDescriptions(v)
+		settings.CaptionDescriptions = expandChannelEncoderSettingsCaptionDescriptions(v)
 	}
 	if v, ok := m["feature_activations"].([]interface{}); ok && len(v) > 0 {
 		settings.FeatureActivations = nil // TODO expandChannelEncoderSettingsFeatureActivations(v)
 	}
 	if v, ok := m["global_configuration"].([]interface{}); ok && len(v) > 0 {
-		settings.GlobalConfiguration = nil // TODO expandChannelEncoderSettingsGlobalConfiguration(v)
+		settings.GlobalConfiguration = expandChannelEncoderSettingsGlobalConfiguration(v)
 	}
 	if v, ok := m["motion_graphics_configuration"].([]interface{}); ok && len(v) > 0 {
-		settings.MotionGraphicsConfiguration = nil // TODO expandChannelEncoderSettingsMotionGraphicsConfiguration(v)
+		settings.MotionGraphicsConfiguration = expandChannelEncoderSettingsMotionGraphicsConfiguration(v)
 	}
 	if v, ok := m["nielsen_configuration"].([]interface{}); ok && len(v) > 0 {
-		settings.NielsenConfiguration = nil // TODO expandChannelEncoderSettingsNielsenConfiguration(v)
+		settings.NielsenConfiguration = expandChannelEncoderSettingsNielsenConfiguration(v)
 	}
 
 	return &settings
@@ -2750,8 +3199,8 @@ func expandAudioDescriptionsAudioNormalizationSettings(tfList []interface{}) *ty
 	if v, ok := m["algorithm_control"].(string); ok && v != "" {
 		out.AlgorithmControl = types.AudioNormalizationAlgorithmControl(v)
 	}
-	if v, ok := m["target_lkfs"].(float32); ok {
-		out.TargetLkfs = float64(v)
+	if v, ok := m["target_lkfs"].(float32); ok && v != 0.0 {
+		out.TargetLkfs = aws.Float64(float64(v))
 	}
 
 	return &out
@@ -2798,8 +3247,8 @@ func expandAudioDescriptionsCodecSettingsAacSettings(tfList []interface{}) *type
 	m := tfList[0].(map[string]interface{})
 
 	var out types.AacSettings
-	if v, ok := m["bitrate"].(float64); ok {
-		out.Bitrate = v
+	if v, ok := m["bitrate"].(float64); ok && v != 0.0 {
+		out.Bitrate = aws.Float64(v)
 	}
 	if v, ok := m["coding_mode"].(string); ok && v != "" {
 		out.CodingMode = types.AacCodingMode(v)
@@ -2816,8 +3265,8 @@ func expandAudioDescriptionsCodecSettingsAacSettings(tfList []interface{}) *type
 	if v, ok := m["raw_format"].(string); ok && v != "" {
 		out.RawFormat = types.AacRawFormat(v)
 	}
-	if v, ok := m["sample_rate"].(float64); ok {
-		out.SampleRate = v
+	if v, ok := m["sample_rate"].(float64); ok && v != 0.0 {
+		out.SampleRate = aws.Float64(v)
 	}
 	if v, ok := m["spec"].(string); ok && v != "" {
 		out.Spec = types.AacSpec(v)
@@ -2837,8 +3286,8 @@ func expandAudioDescriptionsCodecSettingsAc3Settings(tfList []interface{}) *type
 	m := tfList[0].(map[string]interface{})
 
 	var out types.Ac3Settings
-	if v, ok := m["bitrate"].(float64); ok {
-		out.Bitrate = v
+	if v, ok := m["bitrate"].(float64); ok && v != 0.0 {
+		out.Bitrate = aws.Float64(v)
 	}
 	if v, ok := m["bitstream_mode"].(string); ok && v != "" {
 		out.BitstreamMode = types.Ac3BitstreamMode(v)
@@ -2846,8 +3295,8 @@ func expandAudioDescriptionsCodecSettingsAc3Settings(tfList []interface{}) *type
 	if v, ok := m["coding_mode"].(string); ok && v != "" {
 		out.CodingMode = types.Ac3CodingMode(v)
 	}
-	if v, ok := m["dialnorm"].(int); ok {
-		out.Dialnorm = int32(v)
+	if v, ok := m["dialnorm"].(int); ok && v != 0 {
+		out.Dialnorm = aws.Int32(int32(v))
 	}
 	if v, ok := m["drc_profile"].(string); ok && v != "" {
 		out.DrcProfile = types.Ac3DrcProfile(v)
@@ -2870,14 +3319,14 @@ func expandAudioDescriptionsCodecSettingsEac3AtmosSettings(tfList []interface{})
 	m := tfList[0].(map[string]interface{})
 
 	var out types.Eac3AtmosSettings
-	if v, ok := m["bitrate"].(float32); ok {
-		out.Bitrate = float64(v)
+	if v, ok := m["bitrate"].(float32); ok && v != 0.0 {
+		out.Bitrate = aws.Float64(float64(v))
 	}
 	if v, ok := m["coding_mode"].(string); ok && v != "" {
 		out.CodingMode = types.Eac3AtmosCodingMode(v)
 	}
-	if v, ok := m["dialnorm"].(int); ok {
-		out.Dialnorm = int32(v)
+	if v, ok := m["dialnorm"].(int); ok && v != 0 {
+		out.Dialnorm = aws.Int32(int32(v))
 	}
 	if v, ok := m["drc_line"].(string); ok && v != "" {
 		out.DrcLine = types.Eac3AtmosDrcLine(v)
@@ -2885,11 +3334,11 @@ func expandAudioDescriptionsCodecSettingsEac3AtmosSettings(tfList []interface{})
 	if v, ok := m["drc_rf"].(string); ok && v != "" {
 		out.DrcRf = types.Eac3AtmosDrcRf(v)
 	}
-	if v, ok := m["height_trim"].(float32); ok {
-		out.HeightTrim = float64(v)
+	if v, ok := m["height_trim"].(float32); ok && v != 0.0 {
+		out.HeightTrim = aws.Float64(float64(v))
 	}
-	if v, ok := m["surround_trim"].(float32); ok {
-		out.SurroundTrim = float64(v)
+	if v, ok := m["surround_trim"].(float32); ok && v != 0.0 {
+		out.SurroundTrim = aws.Float64(float64(v))
 	}
 
 	return &out
@@ -2906,8 +3355,8 @@ func expandAudioDescriptionsCodecSettingsEac3Settings(tfList []interface{}) *typ
 	if v, ok := m["attenuation_control"].(string); ok && v != "" {
 		out.AttenuationControl = types.Eac3AttenuationControl(v)
 	}
-	if v, ok := m["bitrate"].(float32); ok {
-		out.Bitrate = float64(v)
+	if v, ok := m["bitrate"].(float32); ok && v != 0.0 {
+		out.Bitrate = aws.Float64(float64(v))
 	}
 	if v, ok := m["bitstream_mode"].(string); ok && v != "" {
 		out.BitstreamMode = types.Eac3BitstreamMode(v)
@@ -2918,8 +3367,8 @@ func expandAudioDescriptionsCodecSettingsEac3Settings(tfList []interface{}) *typ
 	if v, ok := m["dc_filter"].(string); ok && v != "" {
 		out.DcFilter = types.Eac3DcFilter(v)
 	}
-	if v, ok := m["dialnorm"].(int); ok {
-		out.Dialnorm = int32(v)
+	if v, ok := m["dialnorm"].(int); ok && v != 0 {
+		out.Dialnorm = aws.Int32(int32(v))
 	}
 	if v, ok := m["drc_line"].(string); ok && v != "" {
 		out.DrcLine = types.Eac3DrcLine(v)
@@ -2933,17 +3382,17 @@ func expandAudioDescriptionsCodecSettingsEac3Settings(tfList []interface{}) *typ
 	if v, ok := m["lfe_filter"].(string); ok && v != "" {
 		out.LfeFilter = types.Eac3LfeFilter(v)
 	}
-	if v, ok := m["lo_ro_center_mix_level"].(float32); ok {
-		out.LoRoCenterMixLevel = float64(v)
+	if v, ok := m["lo_ro_center_mix_level"].(float32); ok && v != 0.0 {
+		out.LoRoCenterMixLevel = aws.Float64(float64(v))
 	}
-	if v, ok := m["lo_ro_surround_mix_level"].(float32); ok {
-		out.LoRoSurroundMixLevel = float64(v)
+	if v, ok := m["lo_ro_surround_mix_level"].(float32); ok && v != 0.0 {
+		out.LoRoSurroundMixLevel = aws.Float64(float64(v))
 	}
-	if v, ok := m["lt_rt_center_mix_level"].(float32); ok {
-		out.LtRtCenterMixLevel = float64(v)
+	if v, ok := m["lt_rt_center_mix_level"].(float32); ok && v != 0.0 {
+		out.LtRtCenterMixLevel = aws.Float64(float64(v))
 	}
-	if v, ok := m["lt_rt_surround_mix_level"].(float32); ok {
-		out.LtRtSurroundMixLevel = float64(v)
+	if v, ok := m["lt_rt_surround_mix_level"].(float32); ok && v != 0.0 {
+		out.LtRtSurroundMixLevel = aws.Float64(float64(v))
 	}
 	if v, ok := m["metadata_control"].(string); ok && v != "" {
 		out.MetadataControl = types.Eac3MetadataControl(v)
@@ -2972,14 +3421,14 @@ func expandAudioDescriptionsCodecSettingsMp2Settings(tfList []interface{}) *type
 	m := tfList[0].(map[string]interface{})
 
 	var out types.Mp2Settings
-	if v, ok := m["bitrate"].(float32); ok {
-		out.Bitrate = float64(v)
+	if v, ok := m["bitrate"].(float32); ok && v != 0.0 {
+		out.Bitrate = aws.Float64(float64(v))
 	}
 	if v, ok := m["coding_mode"].(string); ok && v != "" {
 		out.CodingMode = types.Mp2CodingMode(v)
 	}
-	if v, ok := m["sample_rate"].(float32); ok {
-		out.Bitrate = float64(v)
+	if v, ok := m["sample_rate"].(float32); ok && v != 0.0 {
+		out.Bitrate = aws.Float64(float64(v))
 	}
 
 	return &out
@@ -2993,14 +3442,14 @@ func expandAudioDescriptionsCodecSettingsWavSettings(tfList []interface{}) *type
 	m := tfList[0].(map[string]interface{})
 
 	var out types.WavSettings
-	if v, ok := m["bit_depth"].(float32); ok {
-		out.BitDepth = float64(v)
+	if v, ok := m["bit_depth"].(float32); ok && v != 0.0 {
+		out.BitDepth = aws.Float64(float64(v))
 	}
 	if v, ok := m["coding_mode"].(string); ok && v != "" {
 		out.CodingMode = types.WavCodingMode(v)
 	}
-	if v, ok := m["sample_rate"].(float32); ok {
-		out.SampleRate = float64(v)
+	if v, ok := m["sample_rate"].(float32); ok && v != 0.0 {
+		out.SampleRate = aws.Float64(float64(v))
 	}
 
 	return &out
@@ -3017,11 +3466,11 @@ func expandChannelEncoderSettingsAudioDescriptionsRemixSettings(tfList []interfa
 	if v, ok := m["channel_mappings"].(*schema.Set); ok && v.Len() > 0 {
 		out.ChannelMappings = expandChannelMappings(v.List())
 	}
-	if v, ok := m["channels_in"].(int); ok {
-		out.ChannelsIn = int32(v)
+	if v, ok := m["channels_in"].(int); ok && v != 0 {
+		out.ChannelsIn = aws.Int32(int32(v))
 	}
-	if v, ok := m["channels_out"].(int); ok {
-		out.ChannelsOut = int32(v)
+	if v, ok := m["channels_out"].(int); ok && v != 0 {
+		out.ChannelsOut = aws.Int32(int32(v))
 	}
 
 	return &out
@@ -3043,8 +3492,8 @@ func expandChannelMappings(tfList []interface{}) []types.AudioChannelMapping {
 		if v, ok := m["input_channel_levels"].(*schema.Set); ok && v.Len() > 0 {
 			o.InputChannelLevels = expandInputChannelLevels(v.List())
 		}
-		if v, ok := m["output_channel"].(int); ok {
-			o.OutputChannel = int32(v)
+		if v, ok := m["output_channel"].(int); ok && v != 0 {
+			o.OutputChannel = aws.Int32(int32(v))
 		}
 
 		out = append(out, o)
@@ -3066,11 +3515,11 @@ func expandInputChannelLevels(tfList []interface{}) []types.InputChannelLevel {
 		}
 
 		var o types.InputChannelLevel
-		if v, ok := m["gain"].(int); ok {
-			o.Gain = int32(v)
+		if v, ok := m["gain"].(int); ok && v != 0 {
+			o.Gain = aws.Int32(int32(v))
 		}
-		if v, ok := m["input_channel"].(int); ok {
-			o.InputChannel = int32(v)
+		if v, ok := m["input_channel"].(int); ok && v != 0 {
+			o.InputChannel = aws.Int32(int32(v))
 		}
 
 		out = append(out, o)
@@ -3162,8 +3611,8 @@ func expandArchiveGroupSettings(tfList []interface{}) *types.ArchiveGroupSetting
 	if v, ok := m["archive_cdn_settings"].([]interface{}); ok && len(v) > 0 {
 		o.ArchiveCdnSettings = expandArchiveCDNSettings(v)
 	}
-	if v, ok := m["rollover_interval"].(int); ok {
-		o.RolloverInterval = int32(v)
+	if v, ok := m["rollover_interval"].(int); ok && v != 0 {
+		o.RolloverInterval = aws.Int32(int32(v))
 	}
 
 	return &o
@@ -3275,8 +3724,8 @@ func expandHLSGroupSettings(tfList []interface{}) *types.HlsGroupSettings {
 	if v, ok := m["incomplete_segment_behavior"].(string); ok && v != "" {
 		out.IncompleteSegmentBehavior = types.HlsIncompleteSegmentBehavior(v)
 	}
-	if v, ok := m["index_n_segments"].(int); ok {
-		out.IndexNSegments = int32(v)
+	if v, ok := m["index_n_segments"].(int); ok && v != 0 {
+		out.IndexNSegments = aws.Int32(int32(v))
 	}
 	if v, ok := m["input_loss_action"].(string); ok && v != "" {
 		out.InputLossAction = types.InputLossActionForHlsOut(v)
@@ -3287,8 +3736,8 @@ func expandHLSGroupSettings(tfList []interface{}) *types.HlsGroupSettings {
 	if v, ok := m["iv_source"].(string); ok && v != "" {
 		out.IvSource = types.HlsIvSource(v)
 	}
-	if v, ok := m["keep_segments"].(int); ok {
-		out.KeepSegments = int32(v)
+	if v, ok := m["keep_segments"].(int); ok && v != 0 {
+		out.KeepSegments = aws.Int32(int32(v))
 	}
 	if v, ok := m["key_format"].(string); ok && v != "" {
 		out.KeyFormat = aws.String(v)
@@ -3305,8 +3754,8 @@ func expandHLSGroupSettings(tfList []interface{}) *types.HlsGroupSettings {
 	if v, ok := m["manifest_duration_format"].(string); ok && v != "" {
 		out.ManifestDurationFormat = types.HlsManifestDurationFormat(v)
 	}
-	if v, ok := m["min_segment_length"].(int); ok {
-		out.MinSegmentLength = int32(v)
+	if v, ok := m["min_segment_length"].(int); ok && v != 0 {
+		out.MinSegmentLength = aws.Int32(int32(v))
 	}
 	if v, ok := m["mode"].(string); ok && v != "" {
 		out.Mode = types.HlsMode(v)
@@ -3320,17 +3769,17 @@ func expandHLSGroupSettings(tfList []interface{}) *types.HlsGroupSettings {
 	if v, ok := m["program_date_time_clock"].(string); ok && v != "" {
 		out.ProgramDateTimeClock = types.HlsProgramDateTimeClock(v)
 	}
-	if v, ok := m["program_date_time_period"].(int); ok {
-		out.ProgramDateTimePeriod = int32(v)
+	if v, ok := m["program_date_time_period"].(int); ok && v != 0 {
+		out.ProgramDateTimePeriod = aws.Int32(int32(v))
 	}
 	if v, ok := m["redundant_manifest"].(string); ok && v != "" {
 		out.RedundantManifest = types.HlsRedundantManifest(v)
 	}
-	if v, ok := m["segment_length"].(int); ok {
-		out.SegmentLength = int32(v)
+	if v, ok := m["segment_length"].(int); ok && v != 0 {
+		out.SegmentLength = aws.Int32(int32(v))
 	}
-	if v, ok := m["segments_per_subdirectory"].(int); ok {
-		out.SegmentsPerSubdirectory = int32(v)
+	if v, ok := m["segments_per_subdirectory"].(int); ok && v != 0 {
+		out.SegmentsPerSubdirectory = aws.Int32(int32(v))
 	}
 	if v, ok := m["stream_inf_resolution"].(string); ok && v != "" {
 		out.StreamInfResolution = types.HlsStreamInfResolution(v)
@@ -3338,11 +3787,11 @@ func expandHLSGroupSettings(tfList []interface{}) *types.HlsGroupSettings {
 	if v, ok := m["timed_metadata_id3_frame"].(string); ok && v != "" {
 		out.TimedMetadataId3Frame = types.HlsTimedMetadataId3Frame(v)
 	}
-	if v, ok := m["timed_metadata_id3_period"].(int); ok {
-		out.TimedMetadataId3Period = int32(v)
+	if v, ok := m["timed_metadata_id3_period"].(int); ok && v != 0 {
+		out.TimedMetadataId3Period = aws.Int32(int32(v))
 	}
-	if v, ok := m["timestamp_delta_milliseconds"].(int); ok {
-		out.TimestampDeltaMilliseconds = int32(v)
+	if v, ok := m["timestamp_delta_milliseconds"].(int); ok && v != 0 {
+		out.TimestampDeltaMilliseconds = aws.Int32(int32(v))
 	}
 	if v, ok := m["ts_file_mode"].(string); ok && v != "" {
 		out.TsFileMode = types.HlsTsFileMode(v)
@@ -3371,8 +3820,8 @@ func expandMsSmoothGroupSettings(tfList []interface{}) *types.MsSmoothGroupSetti
 	if v, ok := m["certificate_mode"].(string); ok && v != "" {
 		out.CertificateMode = types.SmoothGroupCertificateMode(v)
 	}
-	if v, ok := m["connection_retry_interval"].(int); ok {
-		out.ConnectionRetryInterval = int32(v)
+	if v, ok := m["connection_retry_interval"].(int); ok && v != 0 {
+		out.ConnectionRetryInterval = aws.Int32(int32(v))
 	}
 	if v, ok := m["event_id"].(string); ok && v != "" {
 		out.EventId = aws.String(v)
@@ -3383,26 +3832,26 @@ func expandMsSmoothGroupSettings(tfList []interface{}) *types.MsSmoothGroupSetti
 	if v, ok := m["event_stop_behavior"].(string); ok && v != "" {
 		out.EventStopBehavior = types.SmoothGroupEventStopBehavior(v)
 	}
-	if v, ok := m["filecache_duration"].(int); ok {
-		out.FilecacheDuration = int32(v)
+	if v, ok := m["filecache_duration"].(int); ok && v != 0 {
+		out.FilecacheDuration = aws.Int32(int32(v))
 	}
-	if v, ok := m["fragment_length"].(int); ok {
-		out.FragmentLength = int32(v)
+	if v, ok := m["fragment_length"].(int); ok && v != 0 {
+		out.FragmentLength = aws.Int32(int32(v))
 	}
 	if v, ok := m["input_loss_action"].(string); ok && v != "" {
 		out.InputLossAction = types.InputLossActionForMsSmoothOut(v)
 	}
-	if v, ok := m["num_retries"].(int); ok {
-		out.NumRetries = int32(v)
+	if v, ok := m["num_retries"].(int); ok && v != 0 {
+		out.NumRetries = aws.Int32(int32(v))
 	}
-	if v, ok := m["restart_delay"].(int); ok {
-		out.RestartDelay = int32(v)
+	if v, ok := m["restart_delay"].(int); ok && v != 0 {
+		out.RestartDelay = aws.Int32(int32(v))
 	}
 	if v, ok := m["segmentation_mode"].(string); ok && v != "" {
 		out.SegmentationMode = types.SmoothGroupSegmentationMode(v)
 	}
-	if v, ok := m["send_delay_ms"].(int); ok {
-		out.SendDelayMs = int32(v)
+	if v, ok := m["send_delay_ms"].(int); ok && v != 0 {
+		out.SendDelayMs = aws.Int32(int32(v))
 	}
 	if v, ok := m["sparse_track_type"].(string); ok && v != "" {
 		out.SparseTrackType = types.SmoothGroupSparseTrackType(v)
@@ -3454,20 +3903,20 @@ func expandHSLAkamaiSettings(tfList []interface{}) *types.HlsAkamaiSettings {
 	m := tfList[0].(map[string]interface{})
 
 	var out types.HlsAkamaiSettings
-	if v, ok := m["connection_retry_interval"].(int); ok {
-		out.ConnectionRetryInterval = int32(v)
+	if v, ok := m["connection_retry_interval"].(int); ok && v != 0 {
+		out.ConnectionRetryInterval = aws.Int32(int32(v))
 	}
-	if v, ok := m["filecache_duration"].(int); ok {
-		out.FilecacheDuration = int32(v)
+	if v, ok := m["filecache_duration"].(int); ok && v != 0 {
+		out.FilecacheDuration = aws.Int32(int32(v))
 	}
 	if v, ok := m["http_transfer_mode"].(string); ok && v != "" {
 		out.HttpTransferMode = types.HlsAkamaiHttpTransferMode(v)
 	}
-	if v, ok := m["num_retries"].(int); ok {
-		out.NumRetries = int32(v)
+	if v, ok := m["num_retries"].(int); ok && v != 0 {
+		out.NumRetries = aws.Int32(int32(v))
 	}
-	if v, ok := m["restart_delay"].(int); ok {
-		out.RestartDelay = int32(v)
+	if v, ok := m["restart_delay"].(int); ok && v != 0 {
+		out.RestartDelay = aws.Int32(int32(v))
 	}
 	if v, ok := m["salt"].(string); ok && v != "" {
 		out.Salt = aws.String(v)
@@ -3487,17 +3936,17 @@ func expandHSLBasicPutSettings(tfList []interface{}) *types.HlsBasicPutSettings
 	m := tfList[0].(map[string]interface{})
 
 	var out types.HlsBasicPutSettings
-	if v, ok := m["connection_retry_interval"].(int); ok {
-		out.ConnectionRetryInterval = int32(v)
+	if v, ok := m["connection_retry_interval"].(int); ok && v != 0 {
+		out.ConnectionRetryInterval = aws.Int32(int32(v))
 	}
-	if v, ok := m["filecache_duration"].(int); ok {
-		out.FilecacheDuration = int32(v)
+	if v, ok := m["filecache_duration"].(int); ok && v != 0 {
+		out.FilecacheDuration = aws.Int32(int32(v))
 	}
-	if v, ok := m["num_retries"].(int); ok {
-		out.NumRetries = int32(v)
+	if v, ok := m["num_retries"].(int); ok && v != 0 {
+		out.NumRetries = aws.Int32(int32(v))
 	}
-	if v, ok := m["restart_delay"].(int); ok {
-		out.RestartDelay = int32(v)
+	if v, ok := m["restart_delay"].(int); ok && v != 0 {
+		out.RestartDelay = aws.Int32(int32(v))
 	}
 
 	return &out
@@ -3511,20 +3960,20 @@ func expandHLSMediaStoreSettings(tfList []interface{}) *types.HlsMediaStoreSetti
 	m := tfList[0].(map[string]interface{})
 
 	var out types.HlsMediaStoreSettings
-	if v, ok := m["connection_retry_interval"].(int); ok {
-		out.ConnectionRetryInterval = int32(v)
+	if v, ok := m["connection_retry_interval"].(int); ok && v != 0 {
+		out.ConnectionRetryInterval = aws.Int32(int32(v))
 	}
-	if v, ok := m["filecache_duration"].(int); ok {
-		out.FilecacheDuration = int32(v)
+	if v, ok := m["filecache_duration"].(int); ok && v != 0 {
+		out.FilecacheDuration = aws.Int32(int32(v))
 	}
 	if v, ok := m["media_store_storage_class"].(string); ok && v != "" {
 		out.MediaStoreStorageClass = types.HlsMediaStoreStorageClass(v)
 	}
-	if v, ok := m["num_retries"].(int); ok {
-		out.NumRetries = int32(v)
+	if v, ok := m["num_retries"].(int); ok && v != 0 {
+		out.NumRetries = aws.Int32(int32(v))
 	}
-	if v, ok := m["restart_delay"].(int); ok {
-		out.RestartDelay = int32(v)
+	if v, ok := m["restart_delay"].(int); ok && v != 0 {
+		out.RestartDelay = aws.Int32(int32(v))
 	}
 
 	return &out
@@ -3553,20 +4002,20 @@ func expandHLSWebdavSettings(tfList []interface{}) *types.HlsWebdavSettings {
 	m := tfList[0].(map[string]interface{})
 
 	var out types.HlsWebdavSettings
-	if v, ok := m["connection_retry_interval"].(int); ok {
-		out.ConnectionRetryInterval = int32(v)
+	if v, ok := m["connection_retry_interval"].(int); ok && v != 0 {
+		out.ConnectionRetryInterval = aws.Int32(int32(v))
 	}
-	if v, ok := m["filecache_duration"].(int); ok {
-		out.FilecacheDuration = int32(v)
+	if v, ok := m["filecache_duration"].(int); ok && v != 0 {
+		out.FilecacheDuration = aws.Int32(int32(v))
 	}
 	if v, ok := m["http_transfer_mode"].(string); ok && v != "" {
 		out.HttpTransferMode = types.HlsWebdavHttpTransferMode(v)
 	}
-	if v, ok := m["num_retries"].(int); ok {
-		out.NumRetries = int32(v)
+	if v, ok := m["num_retries"].(int); ok && v != 0 {
+		out.NumRetries = aws.Int32(int32(v))
 	}
-	if v, ok := m["restart_delay"].(int); ok {
-		out.RestartDelay = int32(v)
+	if v, ok := m["restart_delay"].(int); ok && v != 0 {
+		out.RestartDelay = aws.Int32(int32(v))
 	}
 	return &out
 }
@@ -3584,8 +4033,8 @@ func expandHSLGroupSettingsCaptionLanguageMappings(tfList []interface{}) []types
 		}
 
 		var o types.CaptionLanguageMapping
-		if v, ok := m["caption_channel"].(int); ok {
-			o.CaptionChannel = int32(v)
+		if v, ok := m["caption_channel"].(int); ok && v != 0 {
+			o.CaptionChannel = aws.Int32(int32(v))
 		}
 		if v, ok := m["language_code"].(string); ok && v != "" {
 			o.LanguageCode = aws.String(v)
@@ -3733,8 +4182,8 @@ func expandRtmpGroupSettings(tfList []interface{}) *types.RtmpGroupSettings {
 	if v, ok := m["cache_full_behavior"].(string); ok && v != "" {
 		out.CacheFullBehavior = types.RtmpCacheFullBehavior(v)
 	}
-	if v, ok := m["cache_length"].(int); ok {
-		out.CacheLength = int32(v)
+	if v, ok := m["cache_length"].(int); ok && v != 0 {
+		out.CacheLength = aws.Int32(int32(v))
 	}
 	if v, ok := m["caption_data"].(string); ok && v != "" {
 		out.CaptionData = types.RtmpCaptionData(v)
@@ -3742,8 +4191,8 @@ func expandRtmpGroupSettings(tfList []interface{}) *types.RtmpGroupSettings {
 	if v, ok := m["input_loss_action"].(string); ok && v != "" {
 		out.InputLossAction = types.InputLossActionForRtmpOut(v)
 	}
-	if v, ok := m["restart_delay"].(int); ok {
-		out.RestartDelay = int32(v)
+	if v, ok := m["restart_delay"].(int); ok && v != 0 {
+		out.RestartDelay = aws.Int32(int32(v))
 	}
 
 	return &out
@@ -3763,8 +4212,8 @@ func expandUdpGroupSettings(tfList []interface{}) *types.UdpGroupSettings {
 	if v, ok := m["timed_metadata_id3_frame"].(string); ok && v != "" {
 		out.TimedMetadataId3Frame = types.UdpTimedMetadataId3Frame(v)
 	}
-	if v, ok := m["timed_metadata_id3_period"].(int); ok {
-		out.TimedMetadataId3Period = int32(v)
+	if v, ok := m["timed_metadata_id3_period"].(int); ok && v != 0 {
+		out.TimedMetadataId3Period = aws.Int32(int32(v))
 	}
 
 	return &out
@@ -4050,8 +4499,8 @@ func expandStandardHLSSettingsH3u8Settings(tfList []interface{}) *types.M3u8Sett
 	m := tfList[0].(map[string]interface{})
 
 	var out types.M3u8Settings
-	if v, ok := m["audio_frames_per_pes"].(int); ok {
-		out.AudioFramesPerPes = int32(v)
+	if v, ok := m["audio_frames_per_pes"].(int); ok && v != 0 {
+		out.AudioFramesPerPes = aws.Int32(int32(v))
 	}
 	if v, ok := m["audio_pids"].(string); ok && v != "" {
 		out.AudioPids = aws.String(v)
@@ -4062,26 +4511,26 @@ func expandStandardHLSSettingsH3u8Settings(tfList []interface{}) *types.M3u8Sett
 	if v, ok := m["nielsen_id3_behavior"].(string); ok && v != "" {
 		out.NielsenId3Behavior = types.M3u8NielsenId3Behavior(v)
 	}
-	if v, ok := m["pat_interval"].(int); ok {
-		out.PatInterval = int32(v)
+	if v, ok := m["pat_interval"].(int); ok && v != 0 {
+		out.PatInterval = aws.Int32(int32(v))
 	}
 	if v, ok := m["pcr_control"].(string); ok && v != "" {
 		out.PcrControl = types.M3u8PcrControl(v)
 	}
-	if v, ok := m["pcr_period"].(int); ok {
-		out.PcrPeriod = int32(v)
+	if v, ok := m["pcr_period"].(int); ok && v != 0 {
+		out.PcrPeriod = aws.Int32(int32(v))
 	}
 	if v, ok := m["pcr_pid"].(string); ok && v != "" {
 		out.PcrPid = aws.String(v)
 	}
-	if v, ok := m["pmt_interval"].(int); ok {
-		out.PmtInterval = int32(v)
+	if v, ok := m["pmt_interval"].(int); ok && v != 0 {
+		out.PmtInterval = aws.Int32(int32(v))
 	}
 	if v, ok := m["pmt_pid"].(string); ok && v != "" {
 		out.PmtPid = aws.String(v)
 	}
-	if v, ok := m["program_num"].(int); ok {
-		out.ProgramNum = int32(v)
+	if v, ok := m["program_num"].(int); ok && v != 0 {
+		out.ProgramNum = aws.Int32(int32(v))
 	}
 	if v, ok := m["scte35_behavior"].(string); ok && v != "" {
 		out.Scte35Behavior = types.M3u8Scte35Behavior(v)
@@ -4095,8 +4544,8 @@ func expandStandardHLSSettingsH3u8Settings(tfList []interface{}) *types.M3u8Sett
 	if v, ok := m["timed_metadata_pid"].(string); ok && v != "" {
 		out.TimedMetadataPid = aws.String(v)
 	}
-	if v, ok := m["transport_stream_id"].(int); ok {
-		out.TransportStreamId = int32(v)
+	if v, ok := m["transport_stream_id"].(int); ok && v != 0 {
+		out.TransportStreamId = aws.Int32(int32(v))
 	}
 	if v, ok := m["video_pid"].(string); ok && v != "" {
 		out.VideoPid = aws.String(v)
@@ -4119,11 +4568,11 @@ func expandOutputsOutputSettingsRtmpOutputSettings(tfList []interface{}) *types.
 	if v, ok := m["certificate_mode"].(string); ok && v != "" {
 		settings.CertificateMode = types.RtmpOutputCertificateMode(v)
 	}
-	if v, ok := m["connection_retry_interval"].(int); ok {
-		settings.ConnectionRetryInterval = int32(v)
+	if v, ok := m["connection_retry_interval"].(int); ok && v != 0 {
+		settings.ConnectionRetryInterval = aws.Int32(int32(v))
 	}
-	if v, ok := m["num_retries"].(int); ok {
-		settings.NumRetries = int32(v)
+	if v, ok := m["num_retries"].(int); ok && v != 0 {
+		settings.NumRetries = aws.Int32(int32(v))
 	}
 
 	return &settings
@@ -4143,8 +4592,8 @@ func expandOutputsOutputSettingsUdpOutputSettings(tfList []interface{}) *types.U
 	if v, ok := m["destination"].([]interface{}); ok && len(v) > 0 {
 		settings.Destination = expandDestination(v)
 	}
-	if v, ok := m["buffer_msec"].(int); ok {
-		settings.BufferMsec = int32(v)
+	if v, ok := m["buffer_msec"].(int); ok && v != 0 {
+		settings.BufferMsec = aws.Int32(int32(v))
 	}
 	if v, ok := m["fec_output_settings"].([]interface{}); ok && len(v) > 0 {
 		settings.FecOutputSettings = expandFecOutputSettings(v)
@@ -4194,14 +4643,14 @@ func expandFecOutputSettings(tfList []interface{}) *types.FecOutputSettings {
 	m := tfList[0].(map[string]interface{})
 
 	var settings types.FecOutputSettings
-	if v, ok := m["column_depth"].(int); ok {
-		settings.ColumnDepth = int32(v)
+	if v, ok := m["column_depth"].(int); ok && v != 0 {
+		settings.ColumnDepth = aws.Int32(int32(v))
 	}
 	if v, ok := m["include_fec"].(string); ok && v != "" {
 		settings.IncludeFec = types.FecOutputIncludeFec(v)
 	}
-	if v, ok := m["row_length"].(int); ok {
-		settings.RowLength = int32(v)
+	if v, ok := m["row_length"].(int); ok && v != 0 {
+		settings.RowLength = aws.Int32(int32(v))
 	}
 
 	return &settings
@@ -4230,8 +4679,8 @@ func expandM2tsSettings(tfList []interface{}) *types.M2tsSettings {
 	if v, ok := m["audio_buffer_model"].(string); ok && v != "" {
 		s.AudioBufferModel = types.M2tsAudioBufferModel(v)
 	}
-	if v, ok := m["audio_frames_per_pes"].(int); ok {
-		s.AudioFramesPerPes = int32(v)
+	if v, ok := m["audio_frames_per_pes"].(int); ok && v != 0 {
+		s.AudioFramesPerPes = aws.Int32(int32(v))
 	}
 	if v, ok := m["audio_pids"].(string); ok && v != "" {
 		s.AudioPids = aws.String(v)
@@ -4239,8 +4688,8 @@ func expandM2tsSettings(tfList []interface{}) *types.M2tsSettings {
 	if v, ok := m["audio_stream_type"].(string); ok && v != "" {
 		s.AudioStreamType = types.M2tsAudioStreamType(v)
 	}
-	if v, ok := m["bitrate"].(int); ok {
-		s.Bitrate = int32(v)
+	if v, ok := m["bitrate"].(int); ok && v != 0 {
+		s.Bitrate = aws.Int32(int32(v))
 	}
 	if v, ok := m["buffer_model"].(string); ok && v != "" {
 		s.BufferModel = types.M2tsBufferModel(v)
@@ -4266,8 +4715,8 @@ func expandM2tsSettings(tfList []interface{}) *types.M2tsSettings {
 			m := tfList[0].(map[string]interface{})
 
 			var s types.DvbTdtSettings
-			if v, ok := m["rep_interval"].(int); ok {
-				s.RepInterval = int32(v)
+			if v, ok := m["rep_interval"].(int); ok && v != 0 {
+				s.RepInterval = aws.Int32(int32(v))
 			}
 			return &s
 		}(v)
@@ -4281,8 +4730,8 @@ func expandM2tsSettings(tfList []interface{}) *types.M2tsSettings {
 	if v, ok := m["ebp_audio_interval"].(string); ok && v != "" {
 		s.EbpAudioInterval = types.M2tsAudioInterval(v)
 	}
-	if v, ok := m["ebp_lookahead_ms"].(int); ok {
-		s.EbpLookaheadMs = int32(v)
+	if v, ok := m["ebp_lookahead_ms"].(int); ok && v != 0 {
+		s.EbpLookaheadMs = aws.Int32(int32(v))
 	}
 	if v, ok := m["ebp_placement"].(string); ok && v != "" {
 		s.EbpPlacement = types.M2tsEbpPlacement(v)
@@ -4299,8 +4748,8 @@ func expandM2tsSettings(tfList []interface{}) *types.M2tsSettings {
 	if v, ok := m["etv_signal_pid"].(string); ok && v != "" {
 		s.EtvSignalPid = aws.String(v)
 	}
-	if v, ok := m["fragment_time"].(float64); ok {
-		s.FragmentTime = v
+	if v, ok := m["fragment_time"].(float64); ok && v != 0.0 {
+		s.FragmentTime = aws.Float64(v)
 	}
 	if v, ok := m["klv"].(string); ok && v != "" {
 		s.Klv = types.M2tsKlv(v)
@@ -4311,29 +4760,29 @@ func expandM2tsSettings(tfList []interface{}) *types.M2tsSettings {
 	if v, ok := m["nielsen_id3_behavior"].(string); ok && v != "" {
 		s.NielsenId3Behavior = types.M2tsNielsenId3Behavior(v)
 	}
-	if v, ok := m["null_packet_bitrate"].(float32); ok {
-		s.NullPacketBitrate = float64(v)
+	if v, ok := m["null_packet_bitrate"].(float32); ok && v != 0.0 {
+		s.NullPacketBitrate = aws.Float64(float64(v))
 	}
-	if v, ok := m["pat_interval"].(int); ok {
-		s.PatInterval = int32(v)
+	if v, ok := m["pat_interval"].(int); ok && v != 0 {
+		s.PatInterval = aws.Int32(int32(v))
 	}
 	if v, ok := m["pcr_control"].(string); ok && v != "" {
 		s.PcrControl = types.M2tsPcrControl(v)
 	}
-	if v, ok := m["pcr_period"].(int); ok {
-		s.PcrPeriod = int32(v)
+	if v, ok := m["pcr_period"].(int); ok && v != 0 {
+		s.PcrPeriod = aws.Int32(int32(v))
 	}
 	if v, ok := m["pcr_pid"].(string); ok && v != "" {
 		s.PcrPid = aws.String(v)
 	}
-	if v, ok := m["pmt_interval"].(int); ok {
-		s.PmtInterval = int32(v)
+	if v, ok := m["pmt_interval"].(int); ok && v != 0 {
+		s.PmtInterval = aws.Int32(int32(v))
 	}
 	if v, ok := m["pmt_pid"].(string); ok && v != "" {
 		s.PmtPid = aws.String(v)
 	}
-	if v, ok := m["program_num"].(int); ok {
-		s.ProgramNum = int32(v)
+	if v, ok := m["program_num"].(int); ok && v != 0 {
+		s.ProgramNum = aws.Int32(int32(v))
 	}
 	if v, ok := m["rate_mode"].(string); ok && v != "" {
 		s.RateMode = types.M2tsRateMode(v)
@@ -4353,8 +4802,8 @@ func expandM2tsSettings(tfList []interface{}) *types.M2tsSettings {
 	if v, ok := m["segmentation_style"].(string); ok && v != "" {
 		s.SegmentationStyle = types.M2tsSegmentationStyle(v)
 	}
-	if v, ok := m["segmentation_time"].(float64); ok {
-		s.SegmentationTime = v
+	if v, ok := m["segmentation_time"].(float64); ok && v != 0.0 {
+		s.SegmentationTime = aws.Float64(v)
 	}
 	if v, ok := m["timed_metadata_behavior"].(string); ok && v != "" {
 		s.TimedMetadataBehavior = types.M2tsTimedMetadataBehavior(v)
@@ -4362,8 +4811,8 @@ func expandM2tsSettings(tfList []interface{}) *types.M2tsSettings {
 	if v, ok := m["timed_metadata_pid"].(string); ok && v != "" {
 		s.TimedMetadataPid = aws.String(v)
 	}
-	if v, ok := m["transport_stream_id"].(int); ok {
-		s.TransportStreamId = int32(v)
+	if v, ok := m["transport_stream_id"].(int); ok && v != 0 {
+		s.TransportStreamId = aws.Int32(int32(v))
 	}
 	if v, ok := m["video_pid"].(string); ok && v != "" {
 		s.VideoPid = aws.String(v)
@@ -4380,14 +4829,14 @@ func expandM2tsDvbNitSettings(tfList []interface{}) *types.DvbNitSettings {
 	m := tfList[0].(map[string]interface{})
 
 	var s types.DvbNitSettings
-	if v, ok := m["network_ids"].(int); ok {
-		s.NetworkId = int32(v)
+	if v, ok := m["network_ids"].(int); ok && v != 0 {
+		s.NetworkId = aws.Int32(int32(v))
 	}
 	if v, ok := m["network_name"].(string); ok && v != "" {
 		s.NetworkName = aws.String(v)
 	}
-	if v, ok := m["network_ids"].(int); ok {
-		s.RepInterval = int32(v)
+	if v, ok := m["network_ids"].(int); ok && v != 0 {
+		s.RepInterval = aws.Int32(int32(v))
 	}
 	return &s
 }
@@ -4403,8 +4852,8 @@ func expandM2tsDvbSdtSettings(tfList []interface{}) *types.DvbSdtSettings {
 	if v, ok := m["output_sdt"].(string); ok && v != "" {
 		s.OutputSdt = types.DvbSdtOutputSdt(v)
 	}
-	if v, ok := m["rep_interval"].(int); ok {
-		s.RepInterval = int32(v)
+	if v, ok := m["rep_interval"].(int); ok && v != 0 {
+		s.RepInterval = aws.Int32(int32(v))
 	}
 	if v, ok := m["service_name"].(string); ok && v != "" {
 		s.ServiceName = aws.String(v)
@@ -4426,8 +4875,8 @@ func expandChannelEncoderSettingsTimecodeConfig(tfList []interface{}) *types.Tim
 	if v, ok := m["source"].(string); ok && v != "" {
 		config.Source = types.TimecodeConfigSource(v)
 	}
-	if v, ok := m["sync_threshold"].(int32); ok {
-		config.SyncThreshold = v
+	if v, ok := m["sync_threshold"].(int); ok && v != 0 {
+		config.SyncThreshold = aws.Int32(int32(v))
 	}
 
 	return &config
@@ -4452,8 +4901,8 @@ func expandChannelEncoderSettingsVideoDescriptions(tfList []interface{}) []types
 		if v, ok := m["codec_settings"].([]interface{}); ok && len(v) > 0 {
 			d.CodecSettings = expandChannelEncoderSettingsVideoDescriptionsCodecSettings(v)
 		}
-		if v, ok := m["height"].(int); ok {
-			d.Height = int32(v)
+		if v, ok := m["height"].(int); ok && v != 0 {
+			d.Height = aws.Int32(int32(v))
 		}
 		if v, ok := m["respond_to_afd"].(string); ok && v != "" {
 			d.RespondToAfd = types.VideoDescriptionRespondToAfd(v)
@@ -4461,11 +4910,11 @@ func expandChannelEncoderSettingsVideoDescriptions(tfList []interface{}) []types
 		if v, ok := m["scaling_behavior"].(string); ok && v != "" {
 			d.ScalingBehavior = types.VideoDescriptionScalingBehavior(v)
 		}
-		if v, ok := m["sharpness"].(int); ok {
-			d.Sharpness = int32(v)
+		if v, ok := m["sharpness"].(int); ok && v != 0 {
+			d.Sharpness = aws.Int32(int32(v))
 		}
-		if v, ok := m["width"].(int); ok {
-			d.Width = int32(v)
+		if v, ok := m["width"].(int); ok && v != 0 {
+			d.Width = aws.Int32(int32(v))
 		}
 
 		videoDesc = append(videoDesc, d)
@@ -4492,6 +4941,399 @@ func expandChannelEncoderSettingsAvailBlanking(tfList []interface{}) *types.Avai
 	return &out
 }
 
+func expandChannelEncoderSettingsCaptionDescriptions(tfList []interface{}) []types.CaptionDescription {
+	if tfList == nil {
+		return nil
+	}
+
+	var captionDesc []types.CaptionDescription
+	for _, tfItem := range tfList {
+		m, ok := tfItem.(map[string]interface{})
+		if !ok {
+			continue
+		}
+
+		var d types.CaptionDescription
+		if v, ok := m["caption_selector_name"].(string); ok && v != "" {
+			d.CaptionSelectorName = aws.String(v)
+		}
+		if v, ok := m["name"].(string); ok && v != "" {
+			d.Name = aws.String(v)
+		}
+		if v, ok := m["accessibility"].(string); ok && v != "" {
+			d.Accessibility = types.AccessibilityType(v)
+		}
+		if v, ok := m["destination_settings"].([]interface{}); ok && len(v) > 0 {
+			d.DestinationSettings = expandChannelEncoderSettingsCaptionDescriptionsDestinationSettings(v)
+		}
+		if v, ok := m["language_code"].(string); ok && v != "" {
+			d.LanguageCode = aws.String(v)
+		}
+		if v, ok := m["language_description"].(string); ok && v != "" {
+			d.LanguageDescription = aws.String(v)
+		}
+
+		captionDesc = append(captionDesc, d)
+	}
+
+	return captionDesc
+}
+
+func expandChannelEncoderSettingsCaptionDescriptionsDestinationSettings(tfList []interface{}) *types.CaptionDestinationSettings {
+	if tfList == nil {
+		return nil
+	}
+
+	m := tfList[0].(map[string]interface{})
+
+	var out types.CaptionDestinationSettings
+	if v, ok := m["arib_destination_settings"].([]interface{}); ok && len(v) > 0 {
+		out.AribDestinationSettings = &types.AribDestinationSettings{} // only unexported fields
+	}
+	if v, ok := m["burn_in_destination_settings"].([]interface{}); ok && len(v) > 0 {
+		out.BurnInDestinationSettings = expandsCaptionDescriptionsDestinationSettingsBurnInDestinationSettings(v)
+	}
+	if v, ok := m["dvb_sub_destination_settings"].([]interface{}); ok && len(v) > 0 {
+		out.DvbSubDestinationSettings = expandsCaptionDescriptionsDestinationSettingsDvbSubDestinationSettings(v)
+	}
+	if v, ok := m["ebu_tt_d_destination_settings"].([]interface{}); ok && len(v) > 0 {
+		out.EbuTtDDestinationSettings = expandsCaptionDescriptionsDestinationSettingsEbuTtDDestinationSettings(v)
+	}
+	if v, ok := m["embedded_destination_settings"].([]interface{}); ok && len(v) > 0 {
+		out.EmbeddedDestinationSettings = &types.EmbeddedDestinationSettings{} // only unexported fields
+	}
+	if v, ok := m["embedded_plus_scte20_destination_settings"].([]interface{}); ok && len(v) > 0 {
+		out.EmbeddedPlusScte20DestinationSettings = &types.EmbeddedPlusScte20DestinationSettings{} // only unexported fields
+	}
+	if v, ok := m["rtmp_caption_info_destination_settings"].([]interface{}); ok && len(v) > 0 {
+		out.RtmpCaptionInfoDestinationSettings = &types.RtmpCaptionInfoDestinationSettings{} // only unexported fields
+	}
+	if v, ok := m["scte20_plus_embedded_destination_settings"].([]interface{}); ok && len(v) > 0 {
+		out.Scte20PlusEmbeddedDestinationSettings = &types.Scte20PlusEmbeddedDestinationSettings{} // only unexported fields
+	}
+	if v, ok := m["scte27_destination_settings"].([]interface{}); ok && len(v) > 0 {
+		out.Scte27DestinationSettings = &types.Scte27DestinationSettings{} // only unexported fields
+	}
+	if v, ok := m["smpte_tt_destination_settings"].([]interface{}); ok && len(v) > 0 {
+		out.SmpteTtDestinationSettings = &types.SmpteTtDestinationSettings{} // only unexported fields
+	}
+	if v, ok := m["teletext_destination_settings"].([]interface{}); ok && len(v) > 0 {
+		out.TeletextDestinationSettings = &types.TeletextDestinationSettings{} // only unexported fields
+	}
+	if v, ok := m["ttml_destination_settings"].([]interface{}); ok && len(v) > 0 {
+		out.TtmlDestinationSettings = expandsCaptionDescriptionsDestinationSettingsTtmlDestinationSettings(v)
+	}
+	if v, ok := m["webvtt_destination_settings"].([]interface{}); ok && len(v) > 0 {
+		out.WebvttDestinationSettings = expandsCaptionDescriptionsDestinationSettingsWebvttDestinationSettings(v)
+	}
+
+	return &out
+}
+
+func expandsCaptionDescriptionsDestinationSettingsBurnInDestinationSettings(tfList []interface{}) *types.BurnInDestinationSettings {
+	if tfList == nil {
+		return nil
+	}
+
+	m := tfList[0].(map[string]interface{})
+
+	var out types.BurnInDestinationSettings
+	if v, ok := m["alignment"].(string); ok && len(v) > 0 {
+		out.Alignment = types.BurnInAlignment(v)
+	}
+	if v, ok := m["background_color"].(string); ok && len(v) > 0 {
+		out.BackgroundColor = types.BurnInBackgroundColor(v)
+	}
+	if v, ok := m["background_opacity"].(int); ok && v != 0 {
+		out.BackgroundOpacity = aws.Int32(int32(v))
+	}
+	if v, ok := m["font"].([]interface{}); ok && len(v) > 0 {
+		out.Font = expandInputLocation(v)
+	}
+	if v, ok := m["font_color"].(string); ok && len(v) > 0 {
+		out.FontColor = types.BurnInFontColor(v)
+	}
+	if v, ok := m["font_opacity"].(int); ok && v != 0 {
+		out.FontOpacity = aws.Int32(int32(v))
+	}
+	if v, ok := m["font_resolution"].(int); ok && v != 0 {
+		out.FontResolution = aws.Int32(int32(v))
+	}
+	if v, ok := m["font_size"].(string); ok && v != "" {
+		out.FontSize = aws.String(v)
+	}
+	if v, ok := m["outline_color"].(string); ok && len(v) > 0 {
+		out.OutlineColor = types.BurnInOutlineColor(v)
+	}
+	if v, ok := m["outline_size"].(int); ok && v != 0 {
+		out.OutlineSize = aws.Int32(int32(v))
+	}
+	if v, ok := m["shadow_color"].(string); ok && len(v) > 0 {
+		out.ShadowColor = types.BurnInShadowColor(v)
+	}
+	if v, ok := m["shadow_opacity"].(int); ok && v != 0 {
+		out.ShadowOpacity = aws.Int32(int32(v))
+	}
+	if v, ok := m["shadow_x_offset"].(int); ok && v != 0 {
+		out.ShadowXOffset = aws.Int32(int32(v))
+	}
+	if v, ok := m["shadow_y_offset"].(int); ok && v != 0 {
+		out.ShadowYOffset = aws.Int32(int32(v))
+	}
+	if v, ok := m["teletext_grid_control"].(string); ok && len(v) > 0 {
+		out.TeletextGridControl = types.BurnInTeletextGridControl(v)
+	}
+	if v, ok := m["x_position"].(int); ok && v != 0 {
+		out.XPosition = aws.Int32(int32(v))
+	}
+	if v, ok := m["y_position"].(int); ok && v != 0 {
+		out.YPosition = aws.Int32(int32(v))
+	}
+
+	return &out
+}
+
+func expandsCaptionDescriptionsDestinationSettingsDvbSubDestinationSettings(tfList []interface{}) *types.DvbSubDestinationSettings {
+	if tfList == nil {
+		return nil
+	}
+
+	m := tfList[0].(map[string]interface{})
+
+	var out types.DvbSubDestinationSettings
+	if v, ok := m["alignment"].(string); ok && len(v) > 0 {
+		out.Alignment = types.DvbSubDestinationAlignment(v)
+	}
+	if v, ok := m["background_color"].(string); ok && len(v) > 0 {
+		out.BackgroundColor = types.DvbSubDestinationBackgroundColor(v)
+	}
+	if v, ok := m["background_opacity"].(int); ok && v != 0 {
+		out.BackgroundOpacity = aws.Int32(int32(v))
+	}
+	if v, ok := m["font"].([]interface{}); ok && len(v) > 0 {
+		out.Font = expandInputLocation(v)
+	}
+	if v, ok := m["font_color"].(string); ok && len(v) > 0 {
+		out.FontColor = types.DvbSubDestinationFontColor(v)
+	}
+	if v, ok := m["font_opacity"].(int); ok && v != 0 {
+		out.FontOpacity = aws.Int32(int32(v))
+	}
+	if v, ok := m["font_resolution"].(int); ok && v != 0 {
+		out.FontResolution = aws.Int32(int32(v))
+	}
+	if v, ok := m["font_size"].(string); ok && v != "" {
+		out.FontSize = aws.String(v)
+	}
+	if v, ok := m["outline_color"].(string); ok && len(v) > 0 {
+		out.OutlineColor = types.DvbSubDestinationOutlineColor(v)
+	}
+	if v, ok := m["outline_size"].(int); ok && v != 0 {
+		out.OutlineSize = aws.Int32(int32(v))
+	}
+	if v, ok := m["shadow_color"].(string); ok && len(v) > 0 {
+		out.ShadowColor = types.DvbSubDestinationShadowColor(v)
+	}
+	if v, ok := m["shadow_opacity"].(int); ok && v != 0 {
+		out.ShadowOpacity = aws.Int32(int32(v))
+	}
+	if v, ok := m["shadow_x_offset"].(int); ok && v != 0 {
+		out.ShadowXOffset = aws.Int32(int32(v))
+	}
+	if v, ok := m["shadow_y_offset"].(int); ok && v != 0 {
+		out.ShadowYOffset = aws.Int32(int32(v))
+	}
+	if v, ok := m["teletext_grid_control"].(string); ok && len(v) > 0 {
+		out.TeletextGridControl = types.DvbSubDestinationTeletextGridControl(v)
+	}
+	if v, ok := m["x_position"].(int); ok && v != 0 {
+		out.XPosition = aws.Int32(int32(v))
+	}
+	if v, ok := m["y_position"].(int); ok && v != 0 {
+		out.YPosition = aws.Int32(int32(v))
+	}
+
+	return &out
+}
+
+func expandsCaptionDescriptionsDestinationSettingsEbuTtDDestinationSettings(tfList []interface{}) *types.EbuTtDDestinationSettings {
+	if tfList == nil {
+		return nil
+	}
+
+	m := tfList[0].(map[string]interface{})
+
+	var out types.EbuTtDDestinationSettings
+	if v, ok := m["copyright_holder"].(string); ok && v != "" {
+		out.CopyrightHolder = aws.String(v)
+	}
+
+	if v, ok := m["fill_line_gap"].(string); ok && len(v) > 0 {
+		out.FillLineGap = types.EbuTtDFillLineGapControl(v)
+	}
+
+	if v, ok := m["font_family"].(string); ok && v != "" {
+		out.FontFamily = aws.String(v)
+	}
+
+	if v, ok := m["style_control"].(string); ok && len(v) > 0 {
+		out.StyleControl = types.EbuTtDDestinationStyleControl(v)
+	}
+
+	return &out
+}
+
+func expandsCaptionDescriptionsDestinationSettingsTtmlDestinationSettings(tfList []interface{}) *types.TtmlDestinationSettings {
+	if tfList == nil {
+		return nil
+	}
+
+	m := tfList[0].(map[string]interface{})
+
+	var out types.TtmlDestinationSettings
+	if v, ok := m["style_control"].(string); ok && len(v) > 0 {
+		out.StyleControl = types.TtmlDestinationStyleControl(v)
+	}
+
+	return &out
+}
+
+func expandsCaptionDescriptionsDestinationSettingsWebvttDestinationSettings(tfList []interface{}) *types.WebvttDestinationSettings {
+	if tfList == nil {
+		return nil
+	}
+
+	m := tfList[0].(map[string]interface{})
+
+	var out types.WebvttDestinationSettings
+	if v, ok := m["style_control"].(string); ok && len(v) > 0 {
+		out.StyleControl = types.WebvttDestinationStyleControl(v)
+	}
+	return &out
+}
+
+func expandChannelEncoderSettingsGlobalConfiguration(tfList []interface{}) *types.GlobalConfiguration {
+	if tfList == nil {
+		return nil
+	}
+
+	m := tfList[0].(map[string]interface{})
+
+	var out types.GlobalConfiguration
+
+	if v, ok := m["initial_audio_gain"].(int); ok && v != 0 {
+		out.InitialAudioGain = aws.Int32(int32(v))
+	}
+
+	if v, ok := m["input_end_action"].(string); ok && len(v) > 0 {
+		out.InputEndAction = types.GlobalConfigurationInputEndAction(v)
+	}
+
+	if v, ok := m["input_loss_behavior"].([]interface{}); ok && len(v) > 0 {
+		out.InputLossBehavior = expandChannelEncoderSettingsGlobalConfigurationInputLossBehavior(v)
+	}
+
+	if v, ok := m["output_locking_mode"].(string); ok && len(v) > 0 {
+		out.OutputLockingMode = types.GlobalConfigurationOutputLockingMode(v)
+	}
+
+	if v, ok := m["output_timing_source"].(string); ok && len(v) > 0 {
+		out.OutputTimingSource = types.GlobalConfigurationOutputTimingSource(v)
+	}
+
+	if v, ok := m["support_low_framerate_inputs"].(string); ok && len(v) > 0 {
+		out.SupportLowFramerateInputs = types.GlobalConfigurationLowFramerateInputs(v)
+	}
+
+	return &out
+}
+
+func expandChannelEncoderSettingsGlobalConfigurationInputLossBehavior(tfList []interface{}) *types.InputLossBehavior {
+	if tfList == nil {
+		return nil
+	}
+
+	m := tfList[0].(map[string]interface{})
+
+	var out types.InputLossBehavior
+
+	if v, ok := m["black_frame_msec"].(int); ok && v != 0 {
+		out.BlackFrameMsec = aws.Int32(int32(v))
+	}
+
+	if v, ok := m["input_loss_image_color"].(string); ok && v != "" {
+		out.InputLossImageColor = aws.String(v)
+	}
+
+	if v, ok := m["input_loss_image_slate"].([]interface{}); ok && len(v) > 0 {
+		out.InputLossImageSlate = expandInputLocation(v)
+	}
+
+	if v, ok := m["input_loss_image_type"].(string); ok && len(v) > 0 {
+		out.InputLossImageType = types.InputLossImageType(v)
+	}
+
+	if v, ok := m["repeat_frame_msec"].(int); ok && v != 0 {
+		out.RepeatFrameMsec = aws.Int32(int32(v))
+	}
+
+	return &out
+}
+
+func expandChannelEncoderSettingsMotionGraphicsConfiguration(tfList []interface{}) *types.MotionGraphicsConfiguration {
+	if tfList == nil {
+		return nil
+	}
+
+	m := tfList[0].(map[string]interface{})
+
+	var out types.MotionGraphicsConfiguration
+
+	if v, ok := m["motion_graphics_settings"].([]interface{}); ok && len(v) > 0 {
+		out.MotionGraphicsSettings = expandChannelEncoderSettingsMotionGraphicsConfigurationMotionGraphicsSettings(v)
+	}
+
+	if v, ok := m["motion_graphics_insertion"].(string); ok && len(v) > 0 {
+		out.MotionGraphicsInsertion = types.MotionGraphicsInsertion(v)
+	}
+
+	return &out
+}
+
+func expandChannelEncoderSettingsMotionGraphicsConfigurationMotionGraphicsSettings(tfList []interface{}) *types.MotionGraphicsSettings {
+	if tfList == nil {
+		return nil
+	}
+
+	m := tfList[0].(map[string]interface{})
+
+	var out types.MotionGraphicsSettings
+	if v, ok := m["html_motion_graphics_settings"].([]interface{}); ok && len(v) > 0 {
+		out.HtmlMotionGraphicsSettings = &types.HtmlMotionGraphicsSettings{} // no exported elements in this list
+	}
+
+	return &out
+}
+
+func expandChannelEncoderSettingsNielsenConfiguration(tfList []interface{}) *types.NielsenConfiguration {
+	if tfList == nil {
+		return nil
+	}
+
+	m := tfList[0].(map[string]interface{})
+
+	var out types.NielsenConfiguration
+	if v, ok := m["distributor_id"].(string); ok && v != "" {
+		out.DistributorId = aws.String(v)
+	}
+
+	if v, ok := m["nielsen_pcm_to_id3_tagging"].(string); ok && len(v) > 0 {
+		out.NielsenPcmToId3Tagging = types.NielsenPcmToId3TaggingState(v)
+	}
+
+	return &out
+}
+
 func expandChannelEncoderSettingsVideoDescriptionsCodecSettings(tfList []interface{}) *types.VideoCodecSettings {
 	if tfList == nil {
 		return nil
@@ -4521,8 +5363,8 @@ func expandsVideoDescriptionsCodecSettingsFrameCaptureSettings(tfList []interfac
 	m := tfList[0].(map[string]interface{})
 
 	var out types.FrameCaptureSettings
-	if v, ok := m["capture_interval"].(int); ok {
-		out.CaptureInterval = int32(v)
+	if v, ok := m["capture_interval"].(int); ok && v != 0 {
+		out.CaptureInterval = aws.Int32(int32(v))
 	}
 	if v, ok := m["capture_interval_units"].(string); ok && v != "" {
 		out.CaptureIntervalUnits = types.FrameCaptureIntervalUnit(v)
@@ -4545,14 +5387,14 @@ func expandsVideoDescriptionsCodecSettingsH264Settings(tfList []interface{}) *ty
 	if v, ok := m["afd_signaling"].(string); ok && v != "" {
 		out.AfdSignaling = types.AfdSignaling(v)
 	}
-	if v, ok := m["bitrate"].(int); ok {
-		out.Bitrate = int32(v)
+	if v, ok := m["bitrate"].(int); ok && v != 0 {
+		out.Bitrate = aws.Int32(int32(v))
 	}
-	if v, ok := m["buf_fill_pct"].(int); ok {
-		out.BufFillPct = int32(v)
+	if v, ok := m["buf_fill_pct"].(int); ok && v != 0 {
+		out.BufFillPct = aws.Int32(int32(v))
 	}
-	if v, ok := m["buf_size"].(int); ok {
-		out.BufSize = int32(v)
+	if v, ok := m["buf_size"].(int); ok && v != 0 {
+		out.BufSize = aws.Int32(int32(v))
 	}
 	if v, ok := m["color_metadata"].(string); ok && v != "" {
 		out.ColorMetadata = types.H264ColorMetadata(v)
@@ -4575,23 +5417,23 @@ func expandsVideoDescriptionsCodecSettingsH264Settings(tfList []interface{}) *ty
 	if v, ok := m["framerate_control"].(string); ok && v != "" {
 		out.FramerateControl = types.H264FramerateControl(v)
 	}
-	if v, ok := m["framerate_denominator"].(int); ok {
-		out.FramerateDenominator = int32(v)
+	if v, ok := m["framerate_denominator"].(int); ok && v != 0 {
+		out.FramerateDenominator = aws.Int32(int32(v))
 	}
-	if v, ok := m["framerate_numerator"].(int); ok {
-		out.FramerateNumerator = int32(v)
+	if v, ok := m["framerate_numerator"].(int); ok && v != 0 {
+		out.FramerateNumerator = aws.Int32(int32(v))
 	}
 	if v, ok := m["gop_b_reference"].(string); ok && v != "" {
 		out.GopBReference = types.H264GopBReference(v)
 	}
-	if v, ok := m["gop_closed_cadence"].(int); ok {
-		out.GopClosedCadence = int32(v)
+	if v, ok := m["gop_closed_cadence"].(int); ok && v != 0 {
+		out.GopClosedCadence = aws.Int32(int32(v))
 	}
-	if v, ok := m["gop_num_b_frames"].(int); ok {
-		out.GopNumBFrames = int32(v)
+	if v, ok := m["gop_num_b_frames"].(int); ok && v != 0 {
+		out.GopNumBFrames = aws.Int32(int32(v))
 	}
-	if v, ok := m["gop_size"].(float64); ok {
-		out.GopSize = v
+	if v, ok := m["gop_size"].(float64); ok && v != 0.0 {
+		out.GopSize = aws.Float64(v)
 	}
 	if v, ok := m["gop_size_units"].(string); ok && v != "" {
 		out.GopSizeUnits = types.H264GopSizeUnits(v)
@@ -4602,23 +5444,23 @@ func expandsVideoDescriptionsCodecSettingsH264Settings(tfList []interface{}) *ty
 	if v, ok := m["look_ahead_rate_control"].(string); ok && v != "" {
 		out.LookAheadRateControl = types.H264LookAheadRateControl(v)
 	}
-	if v, ok := m["max_bitrate"].(int); ok {
-		out.MaxBitrate = int32(v)
+	if v, ok := m["max_bitrate"].(int); ok && v != 0 {
+		out.MaxBitrate = aws.Int32(int32(v))
 	}
-	if v, ok := m["min_i_interval"].(int); ok {
-		out.MinIInterval = int32(v)
+	if v, ok := m["min_i_interval"].(int); ok && v != 0 {
+		out.MinIInterval = aws.Int32(int32(v))
 	}
-	if v, ok := m["num_ref_frames"].(int); ok {
-		out.NumRefFrames = int32(v)
+	if v, ok := m["num_ref_frames"].(int); ok && v != 0 {
+		out.NumRefFrames = aws.Int32(int32(v))
 	}
 	if v, ok := m["par_control"].(string); ok && v != "" {
 		out.ParControl = types.H264ParControl(v)
 	}
-	if v, ok := m["par_denominator"].(int); ok {
-		out.ParDenominator = int32(v)
+	if v, ok := m["par_denominator"].(int); ok && v != 0 {
+		out.ParDenominator = aws.Int32(int32(v))
 	}
-	if v, ok := m["par_numerator"].(int); ok {
-		out.ParNumerator = int32(v)
+	if v, ok := m["par_numerator"].(int); ok && v != 0 {
+		out.ParNumerator = aws.Int32(int32(v))
 	}
 	if v, ok := m["profile"].(string); ok && v != "" {
 		out.Profile = types.H264Profile(v)
@@ -4626,8 +5468,8 @@ func expandsVideoDescriptionsCodecSettingsH264Settings(tfList []interface{}) *ty
 	if v, ok := m["quality_level"].(string); ok && v != "" {
 		out.QualityLevel = types.H264QualityLevel(v)
 	}
-	if v, ok := m["qvbr_quality_level"].(int); ok {
-		out.QvbrQualityLevel = int32(v)
+	if v, ok := m["qvbr_quality_level"].(int); ok && v != 0 {
+		out.QvbrQualityLevel = aws.Int32(int32(v))
 	}
 	if v, ok := m["rate_control_mode"].(string); ok && v != "" {
 		out.RateControlMode = types.H264RateControlMode(v)
@@ -4638,11 +5480,11 @@ func expandsVideoDescriptionsCodecSettingsH264Settings(tfList []interface{}) *ty
 	if v, ok := m["scene_change_detect"].(string); ok && v != "" {
 		out.SceneChangeDetect = types.H264SceneChangeDetect(v)
 	}
-	if v, ok := m["slices"].(int); ok {
-		out.Slices = int32(v)
+	if v, ok := m["slices"].(int); ok && v != 0 {
+		out.Slices = aws.Int32(int32(v))
 	}
-	if v, ok := m["softness"].(int); ok {
-		out.Softness = int32(v)
+	if v, ok := m["softness"].(int); ok && v != 0 {
+		out.Softness = aws.Int32(int32(v))
 	}
 	if v, ok := m["spatial_aq"].(string); ok && v != "" {
 		out.SpatialAq = types.H264SpatialAq(v)
@@ -4704,11 +5546,11 @@ func expandsVideoDescriptionsCodecSettingsH265Settings(tfList []interface{}) *ty
 	m := tfList[0].(map[string]interface{})
 
 	var out types.H265Settings
-	if v, ok := m["framerate_denominator"].(int); ok {
-		out.FramerateDenominator = int32(v)
+	if v, ok := m["framerate_denominator"].(int); ok && v != 0 {
+		out.FramerateDenominator = aws.Int32(int32(v))
 	}
-	if v, ok := m["framerate_numerator"].(int); ok {
-		out.FramerateNumerator = int32(v)
+	if v, ok := m["framerate_numerator"].(int); ok && v != 0 {
+		out.FramerateNumerator = aws.Int32(int32(v))
 	}
 	if v, ok := m["adaptive_quantization"].(string); ok && v != "" {
 		out.AdaptiveQuantization = types.H265AdaptiveQuantization(v)
@@ -4719,11 +5561,11 @@ func expandsVideoDescriptionsCodecSettingsH265Settings(tfList []interface{}) *ty
 	if v, ok := m["alternative_transfer_function"].(string); ok && v != "" {
 		out.AlternativeTransferFunction = types.H265AlternativeTransferFunction(v)
 	}
-	if v, ok := m["bitrate"].(int); ok {
-		out.Bitrate = int32(v)
+	if v, ok := m["bitrate"].(int); ok && v != 0 {
+		out.Bitrate = aws.Int32(int32(v))
 	}
-	if v, ok := m["buf_size"].(int); ok {
-		out.BufSize = int32(v)
+	if v, ok := m["buf_size"].(int); ok && v != 0 {
+		out.BufSize = aws.Int32(int32(v))
 	}
 	if v, ok := m["color_metadata"].(string); ok && v != "" {
 		out.ColorMetadata = types.H265ColorMetadata(v)
@@ -4740,11 +5582,11 @@ func expandsVideoDescriptionsCodecSettingsH265Settings(tfList []interface{}) *ty
 	if v, ok := m["flicker_aq"].(string); ok && v != "" {
 		out.FlickerAq = types.H265FlickerAq(v)
 	}
-	if v, ok := m["gop_closed_cadence"].(int); ok {
-		out.GopClosedCadence = int32(v)
+	if v, ok := m["gop_closed_cadence"].(int); ok && v != 0 {
+		out.GopClosedCadence = aws.Int32(int32(v))
 	}
-	if v, ok := m["gop_size"].(float64); ok {
-		out.GopSize = v
+	if v, ok := m["gop_size"].(float64); ok && v != 0.0 {
+		out.GopSize = aws.Float64(v)
 	}
 	if v, ok := m["gop_size_units"].(string); ok && v != "" {
 		out.GopSizeUnits = types.H265GopSizeUnits(v)
@@ -4755,23 +5597,23 @@ func expandsVideoDescriptionsCodecSettingsH265Settings(tfList []interface{}) *ty
 	if v, ok := m["look_ahead_rate_control"].(string); ok && v != "" {
 		out.LookAheadRateControl = types.H265LookAheadRateControl(v)
 	}
-	if v, ok := m["max_bitrate"].(int); ok {
-		out.MaxBitrate = int32(v)
+	if v, ok := m["max_bitrate"].(int); ok && v != 0 {
+		out.MaxBitrate = aws.Int32(int32(v))
 	}
-	if v, ok := m["min_i_interval"].(int); ok {
-		out.MinIInterval = int32(v)
+	if v, ok := m["min_i_interval"].(int); ok && v != 0 {
+		out.MinIInterval = aws.Int32(int32(v))
 	}
-	if v, ok := m["par_denominator"].(int); ok {
-		out.ParDenominator = int32(v)
+	if v, ok := m["par_denominator"].(int); ok && v != 0 {
+		out.ParDenominator = aws.Int32(int32(v))
 	}
-	if v, ok := m["par_numerator"].(int); ok {
-		out.ParNumerator = int32(v)
+	if v, ok := m["par_numerator"].(int); ok && v != 0 {
+		out.ParNumerator = aws.Int32(int32(v))
 	}
 	if v, ok := m["profile"].(string); ok && v != "" {
 		out.Profile = types.H265Profile(v)
 	}
-	if v, ok := m["qvbr_quality_level"].(int); ok {
-		out.QvbrQualityLevel = int32(v)
+	if v, ok := m["qvbr_quality_level"].(int); ok && v != 0 {
+		out.QvbrQualityLevel = aws.Int32(int32(v))
 	}
 	if v, ok := m["rate_control_mode"].(string); ok && v != "" {
 		out.RateControlMode = types.H265RateControlMode(v)
@@ -4782,8 +5624,8 @@ func expandsVideoDescriptionsCodecSettingsH265Settings(tfList []interface{}) *ty
 	if v, ok := m["scene_change_detect"].(string); ok && v != "" {
 		out.SceneChangeDetect = types.H265SceneChangeDetect(v)
 	}
-	if v, ok := m["slices"].(int); ok {
-		out.Slices = int32(v)
+	if v, ok := m["slices"].(int); ok && v != 0 {
+		out.Slices = aws.Int32(int32(v))
 	}
 	if v, ok := m["tier"].(string); ok && v != "" {
 		out.Tier = types.H265Tier(v)
@@ -4833,11 +5675,11 @@ func expandH265Hdr10Settings(tfList []interface{}) *types.Hdr10Settings {
 	m := tfList[0].(map[string]interface{})
 
 	var out types.Hdr10Settings
-	if v, ok := m["max_cll"].(int); ok {
-		out.MaxCll = int32(v)
+	if v, ok := m["max_cll"].(int); ok && v != 0 {
+		out.MaxCll = aws.Int32(int32(v))
 	}
-	if v, ok := m["max_fall"].(int); ok {
-		out.MaxFall = int32(v)
+	if v, ok := m["max_fall"].(int); ok && v != 0 {
+		out.MaxFall = aws.Int32(int32(v))
 	}
 
 	return &out
@@ -4929,8 +5771,8 @@ func expandNielsenNaseIiNwSettings(tfList []interface{}) *types.NielsenNaesIiNw
 	if v, ok := m["check_digit_string"].(string); ok && v != "" {
 		out.CheckDigitString = aws.String(v)
 	}
-	if v, ok := m["sid"].(float32); ok {
-		out.Sid = float64(v)
+	if v, ok := m["sid"].(float32); ok && v != 0.0 {
+		out.Sid = aws.Float64(float64(v))
 	}
 
 	return &out
@@ -4949,11 +5791,11 @@ func flattenChannelEncoderSettings(apiObject *types.EncoderSettings) []interface
 		"avail_blanking":     flattenAvailBlanking(apiObject.AvailBlanking),
 		// TODO avail_configuration
 		// TODO blackout_slate
-		// TODO caption_descriptions
+		"caption_descriptions": flattenCaptionDescriptions(apiObject.CaptionDescriptions),
 		// TODO feature_activations
-		// TODO global_configuration
-		// TODO motion_graphics_configuration
-		// TODO nielsen_configuration
+		"global_configuration":          flattenGlobalConfiguration(apiObject.GlobalConfiguration),
+		"motion_graphics_configuration": flattenMotionGraphicsConfiguration(apiObject.MotionGraphicsConfiguration),
+		"nielsen_configuration":         flattenNielsenConfiguration(apiObject.NielsenConfiguration),
 	}
 
 	return []interface{}{m}
@@ -5208,22 +6050,22 @@ func flattenStandardHLSSettingsM3u8Settings(in *types.M3u8Settings) []interface{
 	}
 
 	m := map[string]interface{}{
-		"audio_frames_per_pes":    int(in.AudioFramesPerPes),
+		"audio_frames_per_pes":    int(aws.ToInt32(in.AudioFramesPerPes)),
 		"audio_pids":              aws.ToString(in.AudioPids),
 		"ecm_pid":                 aws.ToString(in.EcmPid),
 		"nielsen_id3_behavior":    string(in.NielsenId3Behavior),
-		"pat_interval":            int(in.PatInterval),
+		"pat_interval":            int(aws.ToInt32(in.PatInterval)),
 		"pcr_control":             string(in.PcrControl),
-		"pcr_period":              int(in.PcrPeriod),
+		"pcr_period":              int(aws.ToInt32(in.PcrPeriod)),
 		"pcr_pid":                 aws.ToString(in.PcrPid),
-		"pmt_interval":            int(in.PmtInterval),
+		"pmt_interval":            int(aws.ToInt32(in.PmtInterval)),
 		"pmt_pid":                 aws.ToString(in.PmtPid),
-		"program_num":             int(in.ProgramNum),
+		"program_num":             int(aws.ToInt32(in.ProgramNum)),
 		"scte35_behavior":         string(in.Scte35Behavior),
 		"scte35_pid":              aws.ToString(in.Scte35Pid),
 		"timed_metadata_behavior": string(in.TimedMetadataBehavior),
 		"timed_metadata_pid":      aws.ToString(in.TimedMetadataPid),
-		"transport_stream_id":     int(in.TransportStreamId),
+		"transport_stream_id":     int(aws.ToInt32(in.TransportStreamId)),
 		"video_pid":               aws.ToString(in.VideoPid),
 	}
 
@@ -5238,8 +6080,8 @@ func flattenOutputsOutputSettingsRtmpOutputSettings(in *types.RtmpOutputSettings
 	m := map[string]interface{}{
 		"destination":               flattenDestination(in.Destination),
 		"certificate_mode":          string(in.CertificateMode),
-		"connection_retry_interval": int(in.ConnectionRetryInterval),
-		"num_retries":               int(in.NumRetries),
+		"connection_retry_interval": int(aws.ToInt32(in.ConnectionRetryInterval)),
+		"num_retries":               int(aws.ToInt32(in.NumRetries)),
 	}
 
 	return []interface{}{m}
@@ -5253,7 +6095,7 @@ func flattenOutputsOutputSettingsUdpOutputSettings(in *types.UdpOutputSettings)
 	m := map[string]interface{}{
 		"container_settings":  flattenOutputsOutputSettingsUdpOutputSettingsContainerSettings(in.ContainerSettings),
 		"destination":         flattenDestination(in.Destination),
-		"buffer_msec":         int(in.BufferMsec),
+		"buffer_msec":         int(aws.ToInt32(in.BufferMsec)),
 		"fec_output_settings": flattenFecOutputSettings(in.FecOutputSettings),
 	}
 
@@ -5291,9 +6133,9 @@ func flattenFecOutputSettings(in *types.FecOutputSettings) []interface{} {
 	}
 
 	m := map[string]interface{}{
-		"column_depth": int(in.ColumnDepth),
+		"column_depth": int(aws.ToInt32(in.ColumnDepth)),
 		"include_fec":  string(in.IncludeFec),
-		"row_length":   int(in.RowLength),
+		"row_length":   int(aws.ToInt32(in.RowLength)),
 	}
 
 	return []interface{}{m}
@@ -5310,10 +6152,10 @@ func flattenM2tsSettings(in *types.M2tsSettings) []interface{} {
 		"arib_captions_pid":           aws.ToString(in.AribCaptionsPid),
 		"arib_captions_pid_control":   string(in.AribCaptionsPidControl),
 		"audio_buffer_model":          string(in.AudioBufferModel),
-		"audio_frames_per_pes":        int(in.AudioFramesPerPes),
+		"audio_frames_per_pes":        int(aws.ToInt32(in.AudioFramesPerPes)),
 		"audio_pids":                  aws.ToString(in.AudioPids),
 		"audio_stream_type":           string(in.AudioStreamType),
-		"bitrate":                     int(in.Bitrate),
+		"bitrate":                     int(aws.ToInt32(in.Bitrate)),
 		"buffer_model":                string(in.BufferModel),
 		"cc_descriptor":               string(in.CcDescriptor),
 		"dvb_nit_settings":            flattenDvbNitSettings(in.DvbNitSettings),
@@ -5323,7 +6165,7 @@ func flattenM2tsSettings(in *types.M2tsSettings) []interface{} {
 		"dvb_teletext_pid":            aws.ToString(in.DvbTeletextPid),
 		"ebif":                        string(in.Ebif),
 		"ebp_audio_interval":          string(in.EbpAudioInterval),
-		"ebp_lookahead_ms":            int(in.EbpLookaheadMs),
+		"ebp_lookahead_ms":            int(aws.ToInt32(in.EbpLookaheadMs)),
 		"ebp_placement":               string(in.EbpPlacement),
 		"ecm_pid":                     aws.ToString(in.EcmPid),
 		"es_rate_in_pes":              string(in.EsRateInPes),
@@ -5333,14 +6175,14 @@ func flattenM2tsSettings(in *types.M2tsSettings) []interface{} {
 		"klv":                         string(in.Klv),
 		"klv_data_pids":               aws.ToString(in.KlvDataPids),
 		"nielsen_id3_behavior":        string(in.NielsenId3Behavior),
-		"null_packet_bitrate":         float32(in.NullPacketBitrate),
-		"pat_interval":                int(in.PatInterval),
+		"null_packet_bitrate":         float32(aws.ToFloat64(in.NullPacketBitrate)),
+		"pat_interval":                int(aws.ToInt32(in.PatInterval)),
 		"pcr_control":                 string(in.PcrControl),
-		"pcr_period":                  int(in.PcrPeriod),
+		"pcr_period":                  int(aws.ToInt32(in.PcrPeriod)),
 		"pcr_pid":                     aws.ToString(in.PcrPid),
-		"pmt_interval":                int(in.PmtInterval),
+		"pmt_interval":                int(aws.ToInt32(in.PmtInterval)),
 		"pmt_pid":                     aws.ToString(in.PmtPid),
-		"program_num":                 int(in.ProgramNum),
+		"program_num":                 int(aws.ToInt32(in.ProgramNum)),
 		"rate_mode":                   string(in.RateMode),
 		"scte27_pids":                 aws.ToString(in.Scte27Pids),
 		"scte35_control":              string(in.Scte35Control),
@@ -5350,7 +6192,7 @@ func flattenM2tsSettings(in *types.M2tsSettings) []interface{} {
 		"segmentation_time":           in.SegmentationTime,
 		"timed_metadata_behavior":     string(in.TimedMetadataBehavior),
 		"timed_metadata_pid":          aws.ToString(in.TimedMetadataPid),
-		"transport_stream_id":         int(in.TransportStreamId),
+		"transport_stream_id":         int(aws.ToInt32(in.TransportStreamId)),
 		"video_pid":                   aws.ToString(in.VideoPid),
 	}
 
@@ -5363,9 +6205,9 @@ func flattenDvbNitSettings(in *types.DvbNitSettings) []interface{} {
 	}
 
 	m := map[string]interface{}{
-		"network_id":   int(in.NetworkId),
+		"network_id":   int(aws.ToInt32(in.NetworkId)),
 		"network_name": aws.ToString(in.NetworkName),
-		"rep_interval": int(in.RepInterval),
+		"rep_interval": int(aws.ToInt32(in.RepInterval)),
 	}
 
 	return []interface{}{m}
@@ -5378,7 +6220,7 @@ func flattenDvbSdtSettings(in *types.DvbSdtSettings) []interface{} {
 
 	m := map[string]interface{}{
 		"output_sdt":            string(in.OutputSdt),
-		"rep_interval":          int(in.RepInterval),
+		"rep_interval":          int(aws.ToInt32(in.RepInterval)),
 		"service_name":          aws.ToString(in.ServiceName),
 		"service_provider_name": aws.ToString(in.ServiceProviderName),
 	}
@@ -5392,21 +6234,21 @@ func flattenDvbTdtSettings(in *types.DvbTdtSettings) []interface{} {
 	}
 
 	m := map[string]interface{}{
-		"rep_interval": int(in.RepInterval),
+		"rep_interval": int(aws.ToInt32(in.RepInterval)),
 	}
 
 	return []interface{}{m}
 }
 
-func flattenOutputGroupSettingsArchiveGroupSettings(as *types.ArchiveGroupSettings) []interface{} {
-	if as == nil {
+func flattenOutputGroupSettingsArchiveGroupSettings(in *types.ArchiveGroupSettings) []interface{} {
+	if in == nil {
 		return nil
 	}
 
 	m := map[string]interface{}{
-		"destination":          flattenDestination(as.Destination),
-		"archive_cdn_settings": flattenOutputGroupSettingsArchiveCDNSettings(as.ArchiveCdnSettings),
-		"rollover_interval":    int(as.RolloverInterval),
+		"destination":          flattenDestination(in.Destination),
+		"archive_cdn_settings": flattenOutputGroupSettingsArchiveCDNSettings(in.ArchiveCdnSettings),
+		"rollover_interval":    int(aws.ToInt32(in.RolloverInterval)),
 	}
 
 	return []interface{}{m}
@@ -5449,29 +6291,29 @@ func flattenOutputGroupSettingsHLSGroupSettings(in *types.HlsGroupSettings) []in
 		"hls_id3_segment_tagging":      string(in.HlsId3SegmentTagging),
 		"iframe_only_playlists":        string(in.IFrameOnlyPlaylists),
 		"incomplete_segment_behavior":  string(in.IncompleteSegmentBehavior),
-		"index_n_segments":             int(in.IndexNSegments),
+		"index_n_segments":             int(aws.ToInt32(in.IndexNSegments)),
 		"input_loss_action":            string(in.InputLossAction),
 		"iv_in_manifest":               string(in.IvInManifest),
 		"iv_source":                    string(in.IvSource),
-		"keep_segments":                int(in.KeepSegments),
+		"keep_segments":                int(aws.ToInt32(in.KeepSegments)),
 		"key_format":                   aws.ToString(in.KeyFormat),
 		"key_format_versions":          aws.ToString(in.KeyFormatVersions),
 		"key_provider_settings":        flattenHLSKeyProviderSettings(in.KeyProviderSettings),
 		"manifest_compression":         string(in.ManifestCompression),
 		"manifest_duration_format":     string(in.ManifestDurationFormat),
-		"min_segment_length":           int(in.MinSegmentLength),
+		"min_segment_length":           int(aws.ToInt32(in.MinSegmentLength)),
 		"mode":                         string(in.Mode),
 		"output_selection":             string(in.OutputSelection),
 		"program_date_time":            string(in.ProgramDateTime),
 		"program_date_time_clock":      string(in.ProgramDateTimeClock),
-		"program_date_time_period":     int(in.ProgramDateTimePeriod),
+		"program_date_time_period":     int(aws.ToInt32(in.ProgramDateTimePeriod)),
 		"redundant_manifest":           string(in.RedundantManifest),
-		"segment_length":               int(in.SegmentLength),
-		"segments_per_subdirectory":    int(in.SegmentsPerSubdirectory),
+		"segment_length":               int(aws.ToInt32(in.SegmentLength)),
+		"segments_per_subdirectory":    int(aws.ToInt32(in.SegmentsPerSubdirectory)),
 		"stream_inf_resolution":        string(in.StreamInfResolution),
 		"timed_metadata_id3_frame":     string(in.TimedMetadataId3Frame),
-		"timed_metadata_id3_period":    int(in.TimedMetadataId3Period),
-		"timestamp_delta_milliseconds": int(in.TimestampDeltaMilliseconds),
+		"timed_metadata_id3_period":    int(aws.ToInt32(in.TimedMetadataId3Period)),
+		"timestamp_delta_milliseconds": int(aws.ToInt32(in.TimestampDeltaMilliseconds)),
 		"ts_file_mode":                 string(in.TsFileMode),
 	}
 
@@ -5488,17 +6330,17 @@ func flattenOutputGroupSettingsMsSmoothGroupSettings(in *types.MsSmoothGroupSett
 		"acquisition_point_id":        aws.ToString(in.AcquisitionPointId),
 		"audio_only_timecode_control": string(in.AudioOnlyTimecodeControl),
 		"certificate_mode":            string(in.CertificateMode),
-		"connection_retry_interval":   int(in.ConnectionRetryInterval),
+		"connection_retry_interval":   int(aws.ToInt32(in.ConnectionRetryInterval)),
 		"event_id":                    aws.ToString(in.EventId),
 		"event_id_mode":               string(in.EventIdMode),
 		"event_stop_behavior":         string(in.EventStopBehavior),
-		"filecache_duration":          int(in.FilecacheDuration),
-		"fragment_length":             int(in.FragmentLength),
+		"filecache_duration":          int(aws.ToInt32(in.FilecacheDuration)),
+		"fragment_length":             int(aws.ToInt32(in.FragmentLength)),
 		"input_loss_action":           string(in.InputLossAction),
-		"num_retries":                 int(in.NumRetries),
-		"restart_delay":               int(in.RestartDelay),
+		"num_retries":                 int(aws.ToInt32(in.NumRetries)),
+		"restart_delay":               int(aws.ToInt32(in.RestartDelay)),
 		"segmentation_mode":           string(in.SegmentationMode),
-		"send_delay_ms":               int(in.SendDelayMs),
+		"send_delay_ms":               int(aws.ToInt32(in.SendDelayMs)),
 		"sparse_track_type":           string(in.SparseTrackType),
 		"stream_manifest_behavior":    string(in.StreamManifestBehavior),
 		"timestamp_offset":            aws.ToString(in.TimestampOffset),
@@ -5529,7 +6371,7 @@ func flattenHLSCaptionLanguageMappings(in []types.CaptionLanguageMapping) []inte
 	var out []interface{}
 	for _, item := range in {
 		m := map[string]interface{}{
-			"caption_channel":      int(item.CaptionChannel),
+			"caption_channel":      int(aws.ToInt32(item.CaptionChannel)),
 			"language_code":        aws.ToString(item.LanguageCode),
 			"language_description": aws.ToString(item.LanguageDescription),
 		}
@@ -5562,11 +6404,11 @@ func flattenHLSAkamaiSettings(in *types.HlsAkamaiSettings) []interface{} {
 	}
 
 	m := map[string]interface{}{
-		"connection_retry_interval": int(in.ConnectionRetryInterval),
-		"filecache_duration":        int(in.FilecacheDuration),
+		"connection_retry_interval": int(aws.ToInt32(in.ConnectionRetryInterval)),
+		"filecache_duration":        int(aws.ToInt32(in.FilecacheDuration)),
 		"http_transfer_mode":        string(in.HttpTransferMode),
-		"num_retries":               int(in.NumRetries),
-		"restart_delay":             int(in.RestartDelay),
+		"num_retries":               int(aws.ToInt32(in.NumRetries)),
+		"restart_delay":             int(aws.ToInt32(in.RestartDelay)),
 		"salt":                      aws.ToString(in.Salt),
 		"token":                     aws.ToString(in.Token),
 	}
@@ -5580,10 +6422,10 @@ func flattenHLSBasicPutSettings(in *types.HlsBasicPutSettings) []interface{} {
 	}
 
 	m := map[string]interface{}{
-		"connection_retry_interval": int(in.ConnectionRetryInterval),
-		"filecache_duration":        int(in.FilecacheDuration),
-		"num_retries":               int(in.NumRetries),
-		"restart_delay":             int(in.RestartDelay),
+		"connection_retry_interval": int(aws.ToInt32(in.ConnectionRetryInterval)),
+		"filecache_duration":        int(aws.ToInt32(in.FilecacheDuration)),
+		"num_retries":               int(aws.ToInt32(in.NumRetries)),
+		"restart_delay":             int(aws.ToInt32(in.RestartDelay)),
 	}
 
 	return []interface{}{m}
@@ -5595,11 +6437,11 @@ func flattenHLSMediaStoreSettings(in *types.HlsMediaStoreSettings) []interface{}
 	}
 
 	m := map[string]interface{}{
-		"connection_retry_interval": int(in.ConnectionRetryInterval),
-		"filecache_duration":        int(in.FilecacheDuration),
+		"connection_retry_interval": int(aws.ToInt32(in.ConnectionRetryInterval)),
+		"filecache_duration":        int(aws.ToInt32(in.FilecacheDuration)),
 		"media_store_storage_class": string(in.MediaStoreStorageClass),
-		"num_retries":               int(in.NumRetries),
-		"restart_delay":             int(in.RestartDelay),
+		"num_retries":               int(aws.ToInt32(in.NumRetries)),
+		"restart_delay":             int(aws.ToInt32(in.RestartDelay)),
 	}
 
 	return []interface{}{m}
@@ -5635,11 +6477,11 @@ func flattenHLSWebdavSettings(in *types.HlsWebdavSettings) []interface{} {
 	}
 
 	m := map[string]interface{}{
-		"connection_retry_interval": int(in.ConnectionRetryInterval),
-		"filecache_duration":        int(in.FilecacheDuration),
+		"connection_retry_interval": int(aws.ToInt32(in.ConnectionRetryInterval)),
+		"filecache_duration":        int(aws.ToInt32(in.FilecacheDuration)),
 		"http_transfer_mode":        string(in.HttpTransferMode),
-		"num_retries":               int(in.NumRetries),
-		"restart_delay":             int(in.RestartDelay),
+		"num_retries":               int(aws.ToInt32(in.NumRetries)),
+		"restart_delay":             int(aws.ToInt32(in.RestartDelay)),
 	}
 
 	return []interface{}{m}
@@ -5708,19 +6550,19 @@ func flattenOutputGroupSettingsMediaPackageGroupSettings(mp *types.MediaPackageG
 	return []interface{}{m}
 }
 
-func flattenOutputGroupSettingsRtmpGroupSettings(rt *types.RtmpGroupSettings) []interface{} {
-	if rt == nil {
+func flattenOutputGroupSettingsRtmpGroupSettings(in *types.RtmpGroupSettings) []interface{} {
+	if in == nil {
 		return nil
 	}
 
 	m := map[string]interface{}{
-		"ad_markers":            flattenAdMakers(rt.AdMarkers),
-		"authentication_scheme": string(rt.AuthenticationScheme),
-		"cache_full_behavior":   string(rt.CacheFullBehavior),
-		"cache_length":          int(rt.CacheLength),
-		"caption_data":          string(rt.CaptionData),
-		"input_loss_action":     string(rt.InputLossAction),
-		"restart_delay":         int(rt.RestartDelay),
+		"ad_markers":            flattenAdMakers(in.AdMarkers),
+		"authentication_scheme": string(in.AuthenticationScheme),
+		"cache_full_behavior":   string(in.CacheFullBehavior),
+		"cache_length":          int(aws.ToInt32(in.CacheLength)),
+		"caption_data":          string(in.CaptionData),
+		"input_loss_action":     string(in.InputLossAction),
+		"restart_delay":         int(aws.ToInt32(in.RestartDelay)),
 	}
 
 	return []interface{}{m}
@@ -5734,7 +6576,7 @@ func flattenOutputGroupSettingsUdpGroupSettings(in *types.UdpGroupSettings) []in
 	m := map[string]interface{}{
 		"input_loss_action":         string(in.InputLossAction),
 		"timed_metadata_id3_frame":  string(in.TimedMetadataId3Frame),
-		"timed_metadata_id3_period": int(in.TimedMetadataId3Period),
+		"timed_metadata_id3_period": int(aws.ToInt32(in.TimedMetadataId3Period)),
 	}
 
 	return []interface{}{m}
@@ -5794,7 +6636,7 @@ func flattenTimecodeConfig(in *types.TimecodeConfig) []interface{} {
 
 	m := map[string]interface{}{
 		"source":         string(in.Source),
-		"sync_threshold": int(in.SyncThreshold),
+		"sync_threshold": int(aws.ToInt32(in.SyncThreshold)),
 	}
 
 	return []interface{}{m}
@@ -5811,11 +6653,11 @@ func flattenVideoDescriptions(tfList []types.VideoDescription) []interface{} {
 		m := map[string]interface{}{
 			"name":             aws.ToString(item.Name),
 			"codec_settings":   flattenVideoDescriptionsCodecSettings(item.CodecSettings),
-			"height":           int(item.Height),
+			"height":           int(aws.ToInt32(item.Height)),
 			"respond_to_afd":   string(item.RespondToAfd),
 			"scaling_behavior": string(item.ScalingBehavior),
-			"sharpness":        int(item.Sharpness),
-			"width":            int(item.Width),
+			"sharpness":        int(aws.ToInt32(item.Sharpness)),
+			"width":            int(aws.ToInt32(item.Width)),
 		}
 
 		out = append(out, m)
@@ -5836,6 +6678,218 @@ func flattenAvailBlanking(in *types.AvailBlanking) []interface{} {
 	return []interface{}{m}
 }
 
+func flattenCaptionDescriptions(tfList []types.CaptionDescription) []interface{} {
+	if len(tfList) == 0 {
+		return nil
+	}
+
+	var out []interface{}
+
+	for _, item := range tfList {
+		m := map[string]interface{}{
+			"caption_selector_name": aws.ToString(item.CaptionSelectorName),
+			"name":                  aws.ToString(item.Name),
+			"accessibility":         string(item.Accessibility),
+			"destination_settings":  flattenCaptionDescriptionsCaptionDestinationSettings(item.DestinationSettings),
+			"language_code":         aws.ToString(item.LanguageCode),
+			"language_description":  aws.ToString(item.LanguageDescription),
+		}
+
+		out = append(out, m)
+	}
+	return out
+}
+
+func flattenCaptionDescriptionsCaptionDestinationSettings(in *types.CaptionDestinationSettings) []interface{} {
+	if in == nil {
+		return nil
+	}
+
+	m := map[string]interface{}{
+		"arib_destination_settings":                 []interface{}{}, // attribute has no exported fields
+		"burn_in_destination_settings":              flattenCaptionDescriptionsCaptionDestinationSettingsBurnInDestinationSettings(in.BurnInDestinationSettings),
+		"dvb_sub_destination_settings":              flattenCaptionDescriptionsCaptionDestinationSettingsDvbSubDestinationSettings(in.DvbSubDestinationSettings),
+		"ebu_tt_d_destination_settings":             flattenCaptionDescriptionsCaptionDestinationSettingsEbuTtDDestinationSettings(in.EbuTtDDestinationSettings),
+		"embedded_destination_settings":             []interface{}{}, // attribute has no exported fields
+		"embedded_plus_scte20_destination_settings": []interface{}{}, // attribute has no exported fields
+		"rtmp_caption_info_destination_settings":    []interface{}{}, // attribute has no exported fields
+		"scte20_plus_embedded_destination_settings": []interface{}{}, // attribute has no exported fields
+		"scte27_destination_settings":               []interface{}{}, // attribute has no exported fields
+		"smpte_tt_destination_settings":             []interface{}{}, // attribute has no exported fields
+		"teletext_destination_settings":             []interface{}{}, // attribute has no exported fields
+		"ttml_destination_settings":                 flattenCaptionDescriptionsCaptionDestinationSettingsTtmlDestinationSettings(in.TtmlDestinationSettings),
+		"webvtt_destination_settings":               flattenCaptionDescriptionsCaptionDestinationSettingsWebvttDestinationSettings(in.WebvttDestinationSettings),
+	}
+
+	return []interface{}{m}
+}
+
+func flattenCaptionDescriptionsCaptionDestinationSettingsBurnInDestinationSettings(in *types.BurnInDestinationSettings) []interface{} {
+	if in == nil {
+		return nil
+	}
+
+	m := map[string]interface{}{
+		"alignment":             string(in.Alignment),
+		"background_color":      string(in.BackgroundColor),
+		"background_opacity":    int(aws.ToInt32(in.BackgroundOpacity)),
+		"font":                  flattenInputLocation(in.Font),
+		"font_color":            string(in.FontColor),
+		"font_opacity":          int(aws.ToInt32(in.FontOpacity)),
+		"font_resolution":       int(aws.ToInt32(in.FontResolution)),
+		"font_size":             aws.ToString(in.FontSize),
+		"outline_color":         string(in.OutlineColor),
+		"outline_size":          int(aws.ToInt32(in.OutlineSize)),
+		"shadow_color":          string(in.ShadowColor),
+		"shadow_opacity":        int(aws.ToInt32(in.ShadowOpacity)),
+		"shadow_x_offset":       int(aws.ToInt32(in.ShadowXOffset)),
+		"shadow_y_offset":       int(aws.ToInt32(in.ShadowYOffset)),
+		"teletext_grid_control": string(in.TeletextGridControl),
+		"x_position":            int(aws.ToInt32(in.XPosition)),
+		"y_position":            int(aws.ToInt32(in.YPosition)),
+	}
+
+	return []interface{}{m}
+}
+
+func flattenCaptionDescriptionsCaptionDestinationSettingsDvbSubDestinationSettings(in *types.DvbSubDestinationSettings) []interface{} {
+	if in == nil {
+		return nil
+	}
+
+	m := map[string]interface{}{
+		"alignment":             string(in.Alignment),
+		"background_color":      string(in.BackgroundColor),
+		"background_opacity":    int(aws.ToInt32(in.BackgroundOpacity)),
+		"font":                  flattenInputLocation(in.Font),
+		"font_color":            string(in.FontColor),
+		"font_opacity":          int(aws.ToInt32(in.FontOpacity)),
+		"font_resolution":       int(aws.ToInt32(in.FontResolution)),
+		"font_size":             aws.ToString(in.FontSize),
+		"outline_color":         string(in.OutlineColor),
+		"outline_size":          int(aws.ToInt32(in.OutlineSize)),
+		"shadow_color":          string(in.ShadowColor),
+		"shadow_opacity":        int(aws.ToInt32(in.ShadowOpacity)),
+		"shadow_x_offset":       int(aws.ToInt32(in.ShadowXOffset)),
+		"shadow_y_offset":       int(aws.ToInt32(in.ShadowYOffset)),
+		"teletext_grid_control": string(in.TeletextGridControl),
+		"x_position":            int(aws.ToInt32(in.XPosition)),
+		"y_position":            int(aws.ToInt32(in.YPosition)),
+	}
+
+	return []interface{}{m}
+}
+
+func flattenCaptionDescriptionsCaptionDestinationSettingsEbuTtDDestinationSettings(in *types.EbuTtDDestinationSettings) []interface{} {
+	if in == nil {
+		return nil
+	}
+
+	m := map[string]interface{}{
+		"copyright_holder": aws.ToString(in.CopyrightHolder),
+		"fill_line_gap":    string(in.FillLineGap),
+		"font_family":      aws.ToString(in.FontFamily),
+		"style_control":    string(in.StyleControl),
+	}
+
+	return []interface{}{m}
+}
+
+func flattenCaptionDescriptionsCaptionDestinationSettingsTtmlDestinationSettings(in *types.TtmlDestinationSettings) []interface{} {
+	if in == nil {
+		return nil
+	}
+
+	m := map[string]interface{}{
+		"style_control": string(in.StyleControl),
+	}
+
+	return []interface{}{m}
+}
+
+func flattenCaptionDescriptionsCaptionDestinationSettingsWebvttDestinationSettings(in *types.WebvttDestinationSettings) []interface{} {
+	if in == nil {
+		return nil
+	}
+
+	m := map[string]interface{}{
+		"style_control": string(in.StyleControl),
+	}
+
+	return []interface{}{m}
+}
+
+func flattenGlobalConfiguration(in *types.GlobalConfiguration) []interface{} {
+	if in == nil {
+		return nil
+	}
+
+	m := map[string]interface{}{
+		"initial_audio_gain":           int(aws.ToInt32(in.InitialAudioGain)),
+		"input_end_action":             string(in.InputEndAction),
+		"input_loss_behavior":          flattenGlobalConfigurationInputLossBehavior(in.InputLossBehavior),
+		"output_locking_mode":          string(in.OutputLockingMode),
+		"output_timing_source":         string(in.OutputTimingSource),
+		"support_low_framerate_inputs": string(in.SupportLowFramerateInputs),
+	}
+
+	return []interface{}{m}
+}
+
+func flattenGlobalConfigurationInputLossBehavior(in *types.InputLossBehavior) []interface{} {
+	if in == nil {
+		return nil
+	}
+
+	m := map[string]interface{}{
+		"black_frame_msec":       int(aws.ToInt32(in.BlackFrameMsec)),
+		"input_loss_image_color": aws.ToString(in.InputLossImageColor),
+		"input_loss_image_slate": flattenInputLocation(in.InputLossImageSlate),
+		"input_loss_image_type":  string(in.InputLossImageType),
+		"repeat_frame_msec":      int(aws.ToInt32(in.RepeatFrameMsec)),
+	}
+
+	return []interface{}{m}
+}
+
+func flattenMotionGraphicsConfiguration(apiObject *types.MotionGraphicsConfiguration) []interface{} {
+	if apiObject == nil {
+		return nil
+	}
+
+	m := map[string]interface{}{
+		"motion_graphics_settings":  flattenMotionGraphicsConfigurationMotionGraphicsSettings(apiObject.MotionGraphicsSettings),
+		"motion_graphics_insertion": string(apiObject.MotionGraphicsInsertion),
+	}
+
+	return []interface{}{m}
+}
+
+func flattenMotionGraphicsConfigurationMotionGraphicsSettings(in *types.MotionGraphicsSettings) []interface{} {
+	if in == nil {
+		return nil
+	}
+
+	m := map[string]interface{}{
+		"html_motion_graphics_settings": []interface{}{}, // attribute has no exported fields
+	}
+
+	return []interface{}{m}
+}
+
+func flattenNielsenConfiguration(apiObject *types.NielsenConfiguration) []interface{} {
+	if apiObject == nil {
+		return nil
+	}
+
+	m := map[string]interface{}{
+		"distributor_id":             aws.ToString(apiObject.DistributorId),
+		"nielsen_pcm_to_id3_tagging": string(apiObject.NielsenPcmToId3Tagging),
+	}
+
+	return []interface{}{m}
+}
+
 func flattenVideoDescriptionsCodecSettings(in *types.VideoCodecSettings) []interface{} {
 	if in == nil {
 		return nil
@@ -5856,7 +6910,7 @@ func flattenCodecSettingsFrameCaptureSettings(in *types.FrameCaptureSettings) []
 	}
 
 	m := map[string]interface{}{
-		"capture_interval":       int(in.CaptureInterval),
+		"capture_interval":       int(aws.ToInt32(in.CaptureInterval)),
 		"capture_interval_units": string(in.CaptureIntervalUnits),
 	}
 
@@ -5871,9 +6925,9 @@ func flattenCodecSettingsH264Settings(in *types.H264Settings) []interface{} {
 	m := map[string]interface{}{
 		"adaptive_quantization":   string(in.AdaptiveQuantization),
 		"afd_signaling":           string(in.AfdSignaling),
-		"bitrate":                 int(in.Bitrate),
-		"buf_fill_pct":            int(in.BufFillPct),
-		"buf_size":                int(in.BufSize),
+		"bitrate":                 int(aws.ToInt32(in.Bitrate)),
+		"buf_fill_pct":            int(aws.ToInt32(in.BufFillPct)),
+		"buf_size":                int(aws.ToInt32(in.BufSize)),
 		"color_metadata":          string(in.ColorMetadata),
 		"entropy_encoding":        string(in.EntropyEncoding),
 		"filter_settings":         flattenH264SettingsFilterSettings(in.FilterSettings),
@@ -5881,28 +6935,28 @@ func flattenCodecSettingsH264Settings(in *types.H264Settings) []interface{} {
 		"flicker_aq":              string(in.FlickerAq),
 		"force_field_pictures":    string(in.ForceFieldPictures),
 		"framerate_control":       string(in.FramerateControl),
-		"framerate_denominator":   int(in.FramerateDenominator),
-		"framerate_numerator":     int(in.FramerateNumerator),
+		"framerate_denominator":   int(aws.ToInt32(in.FramerateDenominator)),
+		"framerate_numerator":     int(aws.ToInt32(in.FramerateNumerator)),
 		"gop_b_reference":         string(in.GopBReference),
-		"gop_closed_cadence":      int(in.GopClosedCadence),
-		"gop_num_b_frames":        int(in.GopNumBFrames),
+		"gop_closed_cadence":      int(aws.ToInt32(in.GopClosedCadence)),
+		"gop_num_b_frames":        int(aws.ToInt32(in.GopNumBFrames)),
 		"gop_size":                in.GopSize,
 		"gop_size_units":          string(in.GopSizeUnits),
 		"level":                   string(in.Level),
 		"look_ahead_rate_control": string(in.LookAheadRateControl),
-		"max_bitrate":             int(in.MaxBitrate),
-		"min_i_interval":          int(in.MinIInterval),
-		"num_ref_frames":          int(in.NumRefFrames),
+		"max_bitrate":             int(aws.ToInt32(in.MaxBitrate)),
+		"min_i_interval":          int(aws.ToInt32(in.MinIInterval)),
+		"num_ref_frames":          int(aws.ToInt32(in.NumRefFrames)),
 		"par_control":             string(in.ParControl),
-		"par_denominator":         int(in.ParDenominator),
-		"par_numerator":           int(in.ParNumerator),
+		"par_denominator":         int(aws.ToInt32(in.ParDenominator)),
+		"par_numerator":           int(aws.ToInt32(in.ParNumerator)),
 		"profile":                 string(in.Profile),
 		"quality_level":           string(in.QualityLevel),
-		"qvbr_quality_level":      int(in.QvbrQualityLevel),
+		"qvbr_quality_level":      int(aws.ToInt32(in.QvbrQualityLevel)),
 		"rate_control_mode":       string(in.RateControlMode),
 		"scan_type":               string(in.ScanType),
 		"scene_change_detect":     string(in.SceneChangeDetect),
-		"slices":                  int(in.Slices),
+		"slices":                  int(aws.ToInt32(in.Slices)),
 		"spatial_aq":              string(in.SpatialAq),
 		"subgop_length":           string(in.SubgopLength),
 		"syntax":                  string(in.Syntax),
@@ -5944,33 +6998,33 @@ func flattenCodecSettingsH265Settings(in *types.H265Settings) []interface{} {
 	}
 
 	m := map[string]interface{}{
-		"framerate_denominator":         int(in.FramerateDenominator),
-		"framerate_numerator":           int(in.FramerateNumerator),
+		"framerate_denominator":         int(aws.ToInt32(in.FramerateDenominator)),
+		"framerate_numerator":           int(aws.ToInt32(in.FramerateNumerator)),
 		"adaptive_quantization":         string(in.AdaptiveQuantization),
 		"afd_signaling":                 string(in.AfdSignaling),
 		"alternative_transfer_function": string(in.AlternativeTransferFunction),
-		"bitrate":                       int(in.Bitrate),
-		"buf_size":                      int(in.BufSize),
+		"bitrate":                       int(aws.ToInt32(in.Bitrate)),
+		"buf_size":                      int(aws.ToInt32(in.BufSize)),
 		"color_metadata":                string(in.ColorMetadata),
 		"color_space_settings":          flattenH265ColorSpaceSettings(in.ColorSpaceSettings),
 		"filter_settings":               flattenH265FilterSettings(in.FilterSettings),
 		"fixed_afd":                     string(in.FixedAfd),
 		"flicker_aq":                    string(in.FlickerAq),
-		"gop_closed_cadence":            int(in.GopClosedCadence),
+		"gop_closed_cadence":            int(aws.ToInt32(in.GopClosedCadence)),
 		"gop_size":                      in.GopSize,
 		"gop_size_units":                string(in.GopSizeUnits),
 		"level":                         string(in.Level),
 		"look_ahead_rate_control":       string(in.LookAheadRateControl),
-		"max_bitrate":                   int(in.MaxBitrate),
-		"min_i_interval":                int(in.MinIInterval),
-		"par_denominator":               int(in.ParDenominator),
-		"par_numerator":                 int(in.ParNumerator),
+		"max_bitrate":                   int(aws.ToInt32(in.MaxBitrate)),
+		"min_i_interval":                int(aws.ToInt32(in.MinIInterval)),
+		"par_denominator":               int(aws.ToInt32(in.ParDenominator)),
+		"par_numerator":                 int(aws.ToInt32(in.ParNumerator)),
 		"profile":                       string(in.Profile),
-		"qvbr_quality_level":            int(in.QvbrQualityLevel),
+		"qvbr_quality_level":            int(aws.ToInt32(in.QvbrQualityLevel)),
 		"rate_control_mode":             string(in.RateControlMode),
 		"scan_type":                     string(in.ScanType),
 		"scene_change_detect":           string(in.SceneChangeDetect),
-		"slices":                        int(in.Slices),
+		"slices":                        int(aws.ToInt32(in.Slices)),
 		"tier":                          string(in.Tier),
 		"timecode_burnin_settings":      flattenH265TimecodeBurninSettings(in.TimecodeBurninSettings),
 		"timecode_insertion":            string(in.TimecodeInsertion),
@@ -6009,8 +7063,8 @@ func flattenH265Hdr10Settings(in *types.Hdr10Settings) []interface{} {
 	}
 
 	m := map[string]interface{}{
-		"max_cll":  int(in.MaxCll),
-		"max_fall": int(in.MaxFall),
+		"max_cll":  int(aws.ToInt32(in.MaxCll)),
+		"max_fall": int(aws.ToInt32(in.MaxFall)),
 	}
 
 	return []interface{}{m}
@@ -6143,7 +7197,7 @@ func flattenCodecSettingsAc3Settings(in *types.Ac3Settings) []interface{} {
 		"bitrate":          in.Bitrate,
 		"bitstream_mode":   string(in.BitstreamMode),
 		"coding_mode":      string(in.CodingMode),
-		"dialnorm":         int(in.Dialnorm),
+		"dialnorm":         int(aws.ToInt32(in.Dialnorm)),
 		"drc_profile":      string(in.DrcProfile),
 		"lfe_filter":       string(in.LfeFilter),
 		"metadata_control": string(in.MetadataControl),
@@ -6158,13 +7212,13 @@ func flattenCodecSettingsEac3AtmosSettings(in *types.Eac3AtmosSettings) []interf
 	}
 
 	m := map[string]interface{}{
-		"bitrate":       float32(in.Bitrate),
+		"bitrate":       float32(aws.ToFloat64(in.Bitrate)),
 		"coding_mode":   string(in.CodingMode),
-		"dialnorm":      int(in.Dialnorm),
+		"dialnorm":      int(aws.ToInt32(in.Dialnorm)),
 		"drc_line":      string(in.DrcLine),
 		"drc_rf":        string(in.DrcRf),
-		"height_trim":   float32(in.HeightTrim),
-		"surround_trim": float32(in.SurroundTrim),
+		"height_trim":   float32(aws.ToFloat64(in.HeightTrim)),
+		"surround_trim": float32(aws.ToFloat64(in.SurroundTrim)),
 	}
 
 	return []interface{}{m}
@@ -6177,19 +7231,19 @@ func flattenCodecSettingsEac3Settings(in *types.Eac3Settings) []interface{} {
 
 	m := map[string]interface{}{
 		"attenuation_control":      string(in.AttenuationControl),
-		"bitrate":                  float32(in.Bitrate),
+		"bitrate":                  float32(aws.ToFloat64(in.Bitrate)),
 		"bitstream_mode":           string(in.BitstreamMode),
 		"coding_mode":              string(in.CodingMode),
 		"dc_filter":                string(in.DcFilter),
-		"dialnorm":                 int(in.Dialnorm),
+		"dialnorm":                 int(aws.ToInt32(in.Dialnorm)),
 		"drc_line":                 string(in.DrcLine),
 		"drc_rf":                   string(in.DrcRf),
 		"lfe_control":              string(in.LfeControl),
 		"lfe_filter":               string(in.LfeFilter),
-		"lo_ro_center_mix_level":   float32(in.LoRoCenterMixLevel),
-		"lo_ro_surround_mix_level": float32(in.LoRoSurroundMixLevel),
-		"lt_rt_center_mix_level":   float32(in.LtRtCenterMixLevel),
-		"lt_rt_surround_mix_level": float32(in.LtRtSurroundMixLevel),
+		"lo_ro_center_mix_level":   float32(aws.ToFloat64(in.LoRoCenterMixLevel)),
+		"lo_ro_surround_mix_level": float32(aws.ToFloat64(in.LoRoSurroundMixLevel)),
+		"lt_rt_center_mix_level":   float32(aws.ToFloat64(in.LtRtCenterMixLevel)),
+		"lt_rt_surround_mix_level": float32(aws.ToFloat64(in.LtRtSurroundMixLevel)),
 		"metadata_control":         string(in.MetadataControl),
 		"passthrough_control":      string(in.PassthroughControl),
 		"phase_control":            string(in.PhaseControl),
@@ -6207,9 +7261,9 @@ func flattenCodecSettingsMp2Settings(in *types.Mp2Settings) []interface{} {
 	}
 
 	m := map[string]interface{}{
-		"bitrate":     float32(in.Bitrate),
+		"bitrate":     float32(aws.ToFloat64(in.Bitrate)),
 		"coding_mode": string(in.CodingMode),
-		"sample_rate": float32(in.SampleRate),
+		"sample_rate": float32(aws.ToFloat64(in.SampleRate)),
 	}
 
 	return []interface{}{m}
@@ -6221,9 +7275,9 @@ func flattenCodecSettingsWavSettings(in *types.WavSettings) []interface{} {
 	}
 
 	m := map[string]interface{}{
-		"bit_depth":   float32(in.BitDepth),
+		"bit_depth":   float32(aws.ToFloat64(in.BitDepth)),
 		"coding_mode": string(in.CodingMode),
-		"sample_rate": float32(in.SampleRate),
+		"sample_rate": float32(aws.ToFloat64(in.SampleRate)),
 	}
 
 	return []interface{}{m}
@@ -6236,8 +7290,8 @@ func flattenAudioDescriptionsRemixSettings(in *types.RemixSettings) []interface{
 
 	m := map[string]interface{}{
 		"channel_mappings": flattenChannelMappings(in.ChannelMappings),
-		"channels_in":      int(in.ChannelsIn),
-		"channels_out":     int(in.ChannelsOut),
+		"channels_in":      int(aws.ToInt32(in.ChannelsIn)),
+		"channels_out":     int(aws.ToInt32(in.ChannelsOut)),
 	}
 
 	return []interface{}{m}
@@ -6252,7 +7306,7 @@ func flattenChannelMappings(in []types.AudioChannelMapping) []interface{} {
 	for _, item := range in {
 		m := map[string]interface{}{
 			"input_channel_levels": flattenInputChannelLevels(item.InputChannelLevels),
-			"output_channel":       int(item.OutputChannel),
+			"output_channel":       int(aws.ToInt32(item.OutputChannel)),
 		}
 
 		out = append(out, m)
@@ -6269,8 +7323,8 @@ func flattenInputChannelLevels(in []types.InputChannelLevel) []interface{} {
 	var out []interface{}
 	for _, item := range in {
 		m := map[string]interface{}{
-			"gain":          int(item.Gain),
-			"input_channel": int(item.InputChannel),
+			"gain":          int(aws.ToInt32(item.Gain)),
+			"input_channel": int(aws.ToInt32(item.InputChannel)),
 		}
 
 		out = append(out, m)
@@ -6300,7 +7354,7 @@ func flattenNielsenNaesIiNwSettings(in *types.NielsenNaesIiNw) []interface{} {
 
 	m := map[string]interface{}{
 		"check_digit_string": aws.ToString(in.CheckDigitString),
-		"sid":                float32(in.Sid),
+		"sid":                float32(aws.ToFloat64(in.Sid)),
 	}
 
 	return []interface{}{m}
diff --git a/internal/service/medialive/channel_test.go b/internal/service/medialive/channel_test.go
index 5a9ed37ff56..a69dea2e8b5 100644
--- a/internal/service/medialive/channel_test.go
+++ b/internal/service/medialive/channel_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package medialive_test
 
 import (
@@ -76,6 +79,64 @@ func TestAccMediaLiveChannel_basic(t *testing.T) {
 	})
 }
 
+func TestAccMediaLiveChannel_captionDescriptions(t *testing.T) {
+	ctx := acctest.Context(t)
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
+	var channel medialive.DescribeChannelOutput
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_medialive_channel.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, names.MediaLiveEndpointID)
+			testAccChannelsPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, names.MediaLiveEndpointID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckChannelDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccChannelConfig_caption_descriptions(rName, 100),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckChannelExists(ctx, resourceName, &channel),
+					resource.TestCheckResourceAttrSet(resourceName, "channel_id"),
+					resource.TestCheckResourceAttr(resourceName, "channel_class", "STANDARD"),
+					resource.TestCheckResourceAttr(resourceName, "name", rName),
+					resource.TestCheckResourceAttrSet(resourceName, "role_arn"),
+					resource.TestCheckResourceAttr(resourceName, "input_specification.0.codec", "AVC"),
+					resource.TestCheckResourceAttr(resourceName, "input_specification.0.input_resolution", "HD"),
+					resource.TestCheckResourceAttr(resourceName, "input_specification.0.maximum_bitrate", "MAX_20_MBPS"),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "input_attachments.*", map[string]string{
+						"input_attachment_name": "example-input1",
+					}),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "destinations.*", map[string]string{
+						"id": rName,
+					}),
+					resource.TestCheckResourceAttr(resourceName, "encoder_settings.0.timecode_config.0.source", "EMBEDDED"),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "encoder_settings.0.caption_descriptions.*", map[string]string{
+						"caption_selector_name": rName,
+						"name":                  "test-caption-name",
+						"destination_settings.0.dvb_sub_destination_settings.0.font_resolution": "100",
+					}),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "encoder_settings.0.video_descriptions.*", map[string]string{
+						"name": "test-video-name",
+					}),
+				),
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"start_channel"},
+			},
+		},
+	})
+}
+
 func TestAccMediaLiveChannel_M2TS_settings(t *testing.T) {
 	ctx := acctest.Context(t)
 	if testing.Short() {
@@ -951,7 +1012,6 @@ resource "aws_medialive_input" "test" {
   }
 }
 
-
 `, rName)
 }
 
@@ -1741,6 +1801,110 @@ resource "aws_medialive_channel" "test" {
 `, rName))
 }
 
+func testAccChannelConfig_caption_descriptions(rName string, fontResolution int) string {
+	return acctest.ConfigCompose(
+		testAccChannelConfig_base(rName),
+		testAccChannelConfig_baseS3(rName),
+		testAccChannelConfig_baseMultiplex(rName),
+		fmt.Sprintf(`
+resource "aws_medialive_channel" "test" {
+  name          = %[1]q
+  channel_class = "STANDARD"
+  role_arn      = aws_iam_role.test.arn
+
+  input_specification {
+    codec            = "AVC"
+    input_resolution = "HD"
+    maximum_bitrate  = "MAX_20_MBPS"
+  }
+
+  input_attachments {
+    input_attachment_name = "example-input1"
+    input_id              = aws_medialive_input.test.id
+
+    input_settings {
+      caption_selector {
+        name = %[1]q
+      }
+
+      audio_selector {
+        name = "test-audio-selector"
+      }
+    }
+  }
+
+  destinations {
+    id = %[1]q
+
+    settings {
+      url = "s3://${aws_s3_bucket.test1.id}/test1"
+    }
+
+    settings {
+      url = "s3://${aws_s3_bucket.test2.id}/test2"
+    }
+  }
+
+  encoder_settings {
+    timecode_config {
+      source = "EMBEDDED"
+    }
+
+    audio_descriptions {
+      name                = "test-audio-name"
+      audio_selector_name = "test-audio-selector"
+    }
+
+
+    video_descriptions {
+      name = "test-video-name"
+    }
+
+    caption_descriptions {
+      name                  = "test-caption-name"
+      caption_selector_name = aws_medialive_input.test.name
+
+      destination_settings {
+        dvb_sub_destination_settings {
+          font_resolution = %[2]d
+        }
+      }
+    }
+
+    output_groups {
+      output_group_settings {
+        archive_group_settings {
+          destination {
+            destination_ref_id = %[1]q
+          }
+        }
+      }
+
+      outputs {
+        output_name               = "test-output-name"
+        video_description_name    = "test-video-name"
+        audio_description_names   = ["test-audio-name"]
+        caption_description_names = ["test-caption-name"]
+        output_settings {
+          archive_output_settings {
+            name_modifier = "_1"
+            extension     = "m2ts"
+            container_settings {
+              m2ts_settings {
+                audio_buffer_model = "ATSC"
+                buffer_model       = "MULTIPLEX"
+                rate_mode          = "CBR"
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+}
+`, rName, fontResolution))
+}
+
 func testAccChannelConfig_start(rName string, start bool) string {
 	return acctest.ConfigCompose(
 		testAccChannelConfig_base(rName),
diff --git a/internal/service/medialive/exports_test.go b/internal/service/medialive/exports_test.go
index 7ac8016c18d..989fafc36a0 100644
--- a/internal/service/medialive/exports_test.go
+++ b/internal/service/medialive/exports_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package medialive
 
 // Exports for use in tests only.
diff --git a/internal/service/medialive/generate.go b/internal/service/medialive/generate.go
index f556fd94dcf..b51eb9334e2 100644
--- a/internal/service/medialive/generate.go
+++ b/internal/service/medialive/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -AWSSDKVersion=2 -KVTValues=true -SkipTypesImp=true -ListTags -ServiceTagsMap -TagOp=CreateTags -UntagOp=DeleteTags -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/medialive/input.go b/internal/service/medialive/input.go
index cfcbd30b086..0a023dcb5ea 100644
--- a/internal/service/medialive/input.go
+++ b/internal/service/medialive/input.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package medialive
 
 import (
diff --git a/internal/service/medialive/input_security_group.go b/internal/service/medialive/input_security_group.go
index 50d807d57f2..0ea429d20c0 100644
--- a/internal/service/medialive/input_security_group.go
+++ b/internal/service/medialive/input_security_group.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package medialive
 
 import (
diff --git a/internal/service/medialive/input_security_group_test.go b/internal/service/medialive/input_security_group_test.go
index 67fa341c7ac..8d0f4fc3fd5 100644
--- a/internal/service/medialive/input_security_group_test.go
+++ b/internal/service/medialive/input_security_group_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package medialive_test
 
 import (
diff --git a/internal/service/medialive/input_test.go b/internal/service/medialive/input_test.go
index b3c78bf32d8..84482bf0d5a 100644
--- a/internal/service/medialive/input_test.go
+++ b/internal/service/medialive/input_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package medialive_test
 
 import (
diff --git a/internal/service/medialive/medialive_test.go b/internal/service/medialive/medialive_test.go
index 78a0b176652..c18d9ea7748 100644
--- a/internal/service/medialive/medialive_test.go
+++ b/internal/service/medialive/medialive_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package medialive_test
 
 import (
diff --git a/internal/service/medialive/multiplex.go b/internal/service/medialive/multiplex.go
index ced28ddc763..b0f35bbb6ad 100644
--- a/internal/service/medialive/multiplex.go
+++ b/internal/service/medialive/multiplex.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package medialive
 
 import (
@@ -410,16 +413,16 @@ func expandMultiplexSettings(tfList []interface{}) *types.MultiplexSettings {
 	s := types.MultiplexSettings{}
 
 	if v, ok := m["transport_stream_bitrate"]; ok {
-		s.TransportStreamBitrate = int32(v.(int))
+		s.TransportStreamBitrate = aws.Int32(int32(v.(int)))
 	}
 	if v, ok := m["transport_stream_id"]; ok {
-		s.TransportStreamId = int32(v.(int))
+		s.TransportStreamId = aws.Int32(int32(v.(int)))
 	}
 	if val, ok := m["maximum_video_buffer_delay_milliseconds"]; ok {
-		s.MaximumVideoBufferDelayMilliseconds = int32(val.(int))
+		s.MaximumVideoBufferDelayMilliseconds = aws.Int32(int32(val.(int)))
 	}
 	if val, ok := m["transport_stream_reserved_bitrate"]; ok {
-		s.TransportStreamReservedBitrate = int32(val.(int))
+		s.TransportStreamReservedBitrate = aws.Int32(int32(val.(int)))
 	}
 
 	return &s
diff --git a/internal/service/medialive/multiplex_program.go b/internal/service/medialive/multiplex_program.go
index bb1d6b4c370..08a3b9ce1c2 100644
--- a/internal/service/medialive/multiplex_program.go
+++ b/internal/service/medialive/multiplex_program.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package medialive
 
 import (
@@ -24,8 +27,8 @@ import (
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-provider-aws/internal/create"
 	"github.com/hashicorp/terraform-provider-aws/internal/enum"
-	"github.com/hashicorp/terraform-provider-aws/internal/flex"
 	"github.com/hashicorp/terraform-provider-aws/internal/framework"
+	"github.com/hashicorp/terraform-provider-aws/internal/framework/flex"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -403,7 +406,7 @@ func (mps multiplexProgramSettingsObject) expand(ctx context.Context) (*mltypes.
 	data := mps[0]
 
 	l := &mltypes.MultiplexProgramSettings{
-		ProgramNumber:            int32(data.ProgramNumber.ValueInt64()),
+		ProgramNumber:            flex.Int32FromFramework(ctx, data.ProgramNumber),
 		PreferredChannelPipeline: mltypes.PreferredChannelPipeline(data.PreferredChannelPipeline.ValueString()),
 	}
 
@@ -455,27 +458,27 @@ func (sd serviceDescriptorObject) expand(ctx context.Context) *mltypes.Multiplex
 
 type videoSettingsObject []videoSettings
 
-func (vs videoSettingsObject) expand(_ context.Context) *mltypes.MultiplexVideoSettings {
+func (vs videoSettingsObject) expand(ctx context.Context) *mltypes.MultiplexVideoSettings {
 	if len(vs) == 0 {
 		return nil
 	}
 
 	return &mltypes.MultiplexVideoSettings{
-		ConstantBitrate: int32(vs[0].ConstantBitrate.ValueInt64()),
+		ConstantBitrate: flex.Int32FromFramework(ctx, vs[0].ConstantBitrate),
 	}
 }
 
 type statmuxSettingsObject []statmuxSettings
 
-func (sms statmuxSettingsObject) expand(_ context.Context) *mltypes.MultiplexStatmuxVideoSettings {
+func (sms statmuxSettingsObject) expand(ctx context.Context) *mltypes.MultiplexStatmuxVideoSettings {
 	if len(sms) == 0 {
 		return nil
 	}
 
 	return &mltypes.MultiplexStatmuxVideoSettings{
-		MaximumBitrate: int32(sms[0].MaximumBitrate.ValueInt64()),
-		MinimumBitrate: int32(sms[0].MinimumBitrate.ValueInt64()),
-		Priority:       int32(sms[0].Priority.ValueInt64()),
+		MaximumBitrate: flex.Int32FromFramework(ctx, sms[0].MaximumBitrate),
+		MinimumBitrate: flex.Int32FromFramework(ctx, sms[0].MinimumBitrate),
+		Priority:       flex.Int32FromFramework(ctx, sms[0].Priority),
 	}
 }
 
@@ -512,7 +515,7 @@ func flattenMultiplexProgramSettings(ctx context.Context, mps *mltypes.Multiplex
 	}
 
 	attrs := map[string]attr.Value{}
-	attrs["program_number"] = types.Int64Value(int64(mps.ProgramNumber))
+	attrs["program_number"] = flex.Int32ToFramework(ctx, mps.ProgramNumber)
 	attrs["preferred_channel_pipeline"] = flex.StringValueToFrameworkLegacy(ctx, mps.PreferredChannelPipeline)
 	attrs["service_descriptor"] = flattenServiceDescriptor(ctx, mps.ServiceDescriptor)
 	attrs["video_settings"] = flattenVideoSettings(ctx, mps.VideoSettings)
@@ -538,7 +541,7 @@ func flattenServiceDescriptor(ctx context.Context, sd *mltypes.MultiplexProgramS
 	return types.ListValueMust(elemType, []attr.Value{vals})
 }
 
-func flattenStatMuxSettings(_ context.Context, mps *mltypes.MultiplexStatmuxVideoSettings) types.List {
+func flattenStatMuxSettings(ctx context.Context, mps *mltypes.MultiplexStatmuxVideoSettings) types.List {
 	elemType := types.ObjectType{AttrTypes: statmuxAttrs}
 
 	if mps == nil {
@@ -546,9 +549,9 @@ func flattenStatMuxSettings(_ context.Context, mps *mltypes.MultiplexStatmuxVide
 	}
 
 	attrs := map[string]attr.Value{}
-	attrs["minimum_bitrate"] = types.Int64Value(int64(mps.MinimumBitrate))
-	attrs["maximum_bitrate"] = types.Int64Value(int64(mps.MaximumBitrate))
-	attrs["priority"] = types.Int64Value(int64(mps.Priority))
+	attrs["minimum_bitrate"] = flex.Int32ToFramework(ctx, mps.MinimumBitrate)
+	attrs["maximum_bitrate"] = flex.Int32ToFramework(ctx, mps.MaximumBitrate)
+	attrs["priority"] = flex.Int32ToFramework(ctx, mps.Priority)
 
 	vals := types.ObjectValueMust(statmuxAttrs, attrs)
 
@@ -563,7 +566,7 @@ func flattenVideoSettings(ctx context.Context, mps *mltypes.MultiplexVideoSettin
 	}
 
 	attrs := map[string]attr.Value{}
-	attrs["constant_bitrate"] = types.Int64Value(int64(mps.ConstantBitrate))
+	attrs["constant_bitrate"] = flex.Int32ToFramework(ctx, mps.ConstantBitrate)
 	attrs["statmux_settings"] = flattenStatMuxSettings(ctx, mps.StatmuxSettings)
 
 	vals := types.ObjectValueMust(videoSettingsAttrs, attrs)
diff --git a/internal/service/medialive/multiplex_program_test.go b/internal/service/medialive/multiplex_program_test.go
index 153182c0cc5..2f5dbdb9577 100644
--- a/internal/service/medialive/multiplex_program_test.go
+++ b/internal/service/medialive/multiplex_program_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package medialive_test
 
 import (
diff --git a/internal/service/medialive/multiplex_test.go b/internal/service/medialive/multiplex_test.go
index 42b1ef6b92e..9f035becfcd 100644
--- a/internal/service/medialive/multiplex_test.go
+++ b/internal/service/medialive/multiplex_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package medialive_test
 
 import (
diff --git a/internal/service/medialive/schemas.go b/internal/service/medialive/schemas.go
index eb3d609a1e6..c6d6fc91cf5 100644
--- a/internal/service/medialive/schemas.go
+++ b/internal/service/medialive/schemas.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package medialive
 
 import (
diff --git a/internal/service/medialive/service_package_gen.go b/internal/service/medialive/service_package_gen.go
index f7453c214a4..8500cab3d1b 100644
--- a/internal/service/medialive/service_package_gen.go
+++ b/internal/service/medialive/service_package_gen.go
@@ -7,6 +7,7 @@ import (
 
 	aws_sdkv2 "github.com/aws/aws-sdk-go-v2/aws"
 	medialive_sdkv2 "github.com/aws/aws-sdk-go-v2/service/medialive"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -76,9 +77,11 @@ func (p *servicePackage) NewClient(ctx context.Context, config map[string]any) (
 
 	return medialive_sdkv2.NewFromConfig(cfg, func(o *medialive_sdkv2.Options) {
 		if endpoint := config["endpoint"].(string); endpoint != "" {
-			o.EndpointResolver = medialive_sdkv2.EndpointResolverFromURL(endpoint)
+			o.BaseEndpoint = aws_sdkv2.String(endpoint)
 		}
 	}), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/medialive/sweep.go b/internal/service/medialive/sweep.go
index 29c15a64ebf..8095de40418 100644
--- a/internal/service/medialive/sweep.go
+++ b/internal/service/medialive/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package medialive
 
@@ -9,12 +9,12 @@ import (
 
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/medialive"
-	"github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv2"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_medialive_channel", &resource.Sweeper{
 		Name: "aws_medialive_channel",
 		F:    sweepChannels,
@@ -41,23 +41,22 @@ func init() {
 
 func sweepChannels(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
-		fmt.Errorf("error getting client: %s", err)
+		return fmt.Errorf("error getting client: %s", err)
 	}
 
 	conn := client.MediaLiveClient(ctx)
 	sweepResources := make([]sweep.Sweepable, 0)
 	in := &medialive.ListChannelsInput{}
-	var errs *multierror.Error
 
 	pages := medialive.NewListChannelsPaginator(conn, in)
 
 	for pages.HasMorePages() {
 		page, err := pages.NextPage(ctx)
 
-		if sweep.SkipSweepError(err) {
-			log.Println("[WARN] Skipping MediaLive Channels sweep for %s: %s", region, err)
+		if awsv2.SkipSweepError(err) {
+			log.Printf("[WARN] Skipping MediaLive Channels sweep for %s: %s", region, err)
 			return nil
 		}
 
@@ -77,37 +76,31 @@ func sweepChannels(region string) error {
 		}
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
-		errs = multierror.Append(errs, fmt.Errorf("error sweeping MediaLive Channels for %s: %w", region, err))
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
+		return fmt.Errorf("error sweeping MediaLive Channels for %s: %w", region, err)
 	}
 
-	if sweep.SkipSweepError(err) {
-		log.Printf("[WARN] Skipping MediaLive Channels sweep for %s: %s", region, errs)
-		return nil
-	}
-
-	return errs.ErrorOrNil()
+	return nil
 }
 
 func sweepInputs(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
-		fmt.Errorf("error getting client: %s", err)
+		return fmt.Errorf("error getting client: %s", err)
 	}
 
 	conn := client.MediaLiveClient(ctx)
 	sweepResources := make([]sweep.Sweepable, 0)
 	in := &medialive.ListInputsInput{}
-	var errs *multierror.Error
 
 	pages := medialive.NewListInputsPaginator(conn, in)
 
 	for pages.HasMorePages() {
 		page, err := pages.NextPage(ctx)
 
-		if sweep.SkipSweepError(err) {
-			log.Println("[WARN] Skipping MediaLive Inputs sweep for %s: %s", region, err)
+		if awsv2.SkipSweepError(err) {
+			log.Printf("[WARN] Skipping MediaLive Inputs sweep for %s: %s", region, err)
 			return nil
 		}
 
@@ -127,37 +120,31 @@ func sweepInputs(region string) error {
 		}
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
-		errs = multierror.Append(errs, fmt.Errorf("error sweeping MediaLive Inputs for %s: %w", region, err))
-	}
-
-	if sweep.SkipSweepError(err) {
-		log.Printf("[WARN] Skipping MediaLive Inputs sweep for %s: %s", region, errs)
-		return nil
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
+		return fmt.Errorf("error sweeping MediaLive Inputs for %s: %w", region, err)
 	}
 
-	return errs.ErrorOrNil()
+	return nil
 }
 
 func sweepInputSecurityGroups(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
-		fmt.Errorf("error getting client: %s", err)
+		return fmt.Errorf("error getting client: %s", err)
 	}
 
 	conn := client.MediaLiveClient(ctx)
 	sweepResources := make([]sweep.Sweepable, 0)
 	in := &medialive.ListInputSecurityGroupsInput{}
-	var errs *multierror.Error
 
 	pages := medialive.NewListInputSecurityGroupsPaginator(conn, in)
 
 	for pages.HasMorePages() {
 		page, err := pages.NextPage(ctx)
 
-		if sweep.SkipSweepError(err) {
-			log.Println("[WARN] Skipping MediaLive Input Security Groups sweep for %s: %s", region, err)
+		if awsv2.SkipSweepError(err) {
+			log.Printf("[WARN] Skipping MediaLive Input Security Groups sweep for %s: %s", region, err)
 			return nil
 		}
 
@@ -177,37 +164,31 @@ func sweepInputSecurityGroups(region string) error {
 		}
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
-		errs = multierror.Append(errs, fmt.Errorf("error sweeping MediaLive Input Security Groups for %s: %w", region, err))
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
+		return fmt.Errorf("error sweeping MediaLive Input Security Groups for %s: %w", region, err)
 	}
 
-	if sweep.SkipSweepError(err) {
-		log.Printf("[WARN] Skipping MediaLive Input Security Groups sweep for %s: %s", region, errs)
-		return nil
-	}
-
-	return errs.ErrorOrNil()
+	return nil
 }
 
 func sweepMultiplexes(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
-		fmt.Errorf("error getting client: %s", err)
+		return fmt.Errorf("error getting client: %s", err)
 	}
 
 	conn := client.MediaLiveClient(ctx)
 	sweepResources := make([]sweep.Sweepable, 0)
 	in := &medialive.ListMultiplexesInput{}
-	var errs *multierror.Error
 
 	pages := medialive.NewListMultiplexesPaginator(conn, in)
 
 	for pages.HasMorePages() {
 		page, err := pages.NextPage(ctx)
 
-		if sweep.SkipSweepError(err) {
-			log.Println("[WARN] Skipping MediaLive Multiplexes sweep for %s: %s", region, err)
+		if awsv2.SkipSweepError(err) {
+			log.Printf("[WARN] Skipping MediaLive Multiplexes sweep for %s: %s", region, err)
 			return nil
 		}
 
@@ -227,14 +208,9 @@ func sweepMultiplexes(region string) error {
 		}
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
-		errs = multierror.Append(errs, fmt.Errorf("error sweeping MediaLive Multiplexes for %s: %w", region, err))
-	}
-
-	if sweep.SkipSweepError(err) {
-		log.Printf("[WARN] Skipping MediaLive Multiplexes sweep for %s: %s", region, errs)
-		return nil
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
+		return fmt.Errorf("error sweeping MediaLive Multiplexes for %s: %w", region, err)
 	}
 
-	return errs.ErrorOrNil()
+	return nil
 }
diff --git a/internal/service/medialive/tags_gen.go b/internal/service/medialive/tags_gen.go
index a280db76a23..c2e75052a8d 100644
--- a/internal/service/medialive/tags_gen.go
+++ b/internal/service/medialive/tags_gen.go
@@ -7,7 +7,9 @@ import (
 
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/medialive"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -53,7 +55,7 @@ func Tags(tags tftags.KeyValueTags) map[string]string {
 	return tags.Map()
 }
 
-// KeyValueTags creates KeyValueTags from medialive service tags.
+// KeyValueTags creates tftags.KeyValueTags from medialive service tags.
 func KeyValueTags(ctx context.Context, tags map[string]string) tftags.KeyValueTags {
 	return tftags.New(ctx, tags)
 }
@@ -84,6 +86,8 @@ func updateTags(ctx context.Context, conn *medialive.Client, identifier string,
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.MediaLive)
 	if len(removedTags) > 0 {
diff --git a/internal/service/mediapackage/channel.go b/internal/service/mediapackage/channel.go
index 9e1fb8e706a..3ca2263a6a3 100644
--- a/internal/service/mediapackage/channel.go
+++ b/internal/service/mediapackage/channel.go
@@ -1,14 +1,19 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package mediapackage
 
 import (
 	"context"
+	"errors"
 	"fmt"
-	"regexp"
+	"log"
 	"time"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/mediapackage"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/YakDriver/regexache"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/mediapackage"
+	"github.com/aws/aws-sdk-go-v2/service/mediapackage/types"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
@@ -41,7 +46,7 @@ func ResourceChannel() *schema.Resource {
 				Type:         schema.TypeString,
 				Required:     true,
 				ForceNew:     true,
-				ValidateFunc: validation.StringMatch(regexp.MustCompile(`^[\w-]+$`), "must only contain alphanumeric characters, dashes or underscores"),
+				ValidateFunc: validation.StringMatch(regexache.MustCompile(`^[\w-]+$`), "must only contain alphanumeric characters, dashes or underscores"),
 			},
 			"description": {
 				Type:     schema.TypeString,
@@ -87,7 +92,7 @@ func ResourceChannel() *schema.Resource {
 
 func resourceChannelCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).MediaPackageConn(ctx)
+	conn := meta.(*conns.AWSClient).MediaPackageClient(ctx)
 
 	input := &mediapackage.CreateChannelInput{
 		Id:          aws.String(d.Get("channel_id").(string)),
@@ -95,27 +100,32 @@ func resourceChannelCreate(ctx context.Context, d *schema.ResourceData, meta int
 		Tags:        getTagsIn(ctx),
 	}
 
-	resp, err := conn.CreateChannelWithContext(ctx, input)
+	resp, err := conn.CreateChannel(ctx, input)
 	if err != nil {
 		return sdkdiag.AppendErrorf(diags, "creating MediaPackage Channel: %s", err)
 	}
 
-	d.SetId(aws.StringValue(resp.Id))
+	d.SetId(aws.ToString(resp.Id))
 
 	return append(diags, resourceChannelRead(ctx, d, meta)...)
 }
 
 func resourceChannelRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).MediaPackageConn(ctx)
+	conn := meta.(*conns.AWSClient).MediaPackageClient(ctx)
 
-	input := &mediapackage.DescribeChannelInput{
-		Id: aws.String(d.Id()),
+	resp, err := findChannelByID(ctx, conn, d.Id())
+
+	if !d.IsNewResource() && tfresource.NotFound(err) {
+		log.Printf("[WARN] MediaPackage Channel (%s) not found, removing from state", d.Id())
+		d.SetId("")
+		return nil
 	}
-	resp, err := conn.DescribeChannelWithContext(ctx, input)
+
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "describing MediaPackage Channel: %s", err)
+		return sdkdiag.AppendErrorf(diags, "reading MediaPackage Channel: %s", err)
 	}
+
 	d.Set("arn", resp.Arn)
 	d.Set("channel_id", resp.Id)
 	d.Set("description", resp.Description)
@@ -131,14 +141,14 @@ func resourceChannelRead(ctx context.Context, d *schema.ResourceData, meta inter
 
 func resourceChannelUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).MediaPackageConn(ctx)
+	conn := meta.(*conns.AWSClient).MediaPackageClient(ctx)
 
 	input := &mediapackage.UpdateChannelInput{
 		Id:          aws.String(d.Id()),
 		Description: aws.String(d.Get("description").(string)),
 	}
 
-	_, err := conn.UpdateChannelWithContext(ctx, input)
+	_, err := conn.UpdateChannel(ctx, input)
 	if err != nil {
 		return sdkdiag.AppendErrorf(diags, "updating MediaPackage Channel: %s", err)
 	}
@@ -148,14 +158,15 @@ func resourceChannelUpdate(ctx context.Context, d *schema.ResourceData, meta int
 
 func resourceChannelDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).MediaPackageConn(ctx)
+	conn := meta.(*conns.AWSClient).MediaPackageClient(ctx)
 
 	input := &mediapackage.DeleteChannelInput{
 		Id: aws.String(d.Id()),
 	}
-	_, err := conn.DeleteChannelWithContext(ctx, input)
+	_, err := conn.DeleteChannel(ctx, input)
 	if err != nil {
-		if tfawserr.ErrCodeEquals(err, mediapackage.ErrCodeNotFoundException) {
+		var nfe *types.NotFoundException
+		if errors.As(err, &nfe) {
 			return diags
 		}
 		return sdkdiag.AppendErrorf(diags, "deleting MediaPackage Channel: %s", err)
@@ -165,9 +176,10 @@ func resourceChannelDelete(ctx context.Context, d *schema.ResourceData, meta int
 		Id: aws.String(d.Id()),
 	}
 	err = retry.RetryContext(ctx, 5*time.Minute, func() *retry.RetryError {
-		_, err := conn.DescribeChannelWithContext(ctx, dcinput)
+		_, err := conn.DescribeChannel(ctx, dcinput)
 		if err != nil {
-			if tfawserr.ErrCodeEquals(err, mediapackage.ErrCodeNotFoundException) {
+			var nfe *types.NotFoundException
+			if errors.As(err, &nfe) {
 				return nil
 			}
 			return retry.NonRetryableError(err)
@@ -175,7 +187,7 @@ func resourceChannelDelete(ctx context.Context, d *schema.ResourceData, meta int
 		return retry.RetryableError(fmt.Errorf("MediaPackage Channel (%s) still exists", d.Id()))
 	})
 	if tfresource.TimedOut(err) {
-		_, err = conn.DescribeChannelWithContext(ctx, dcinput)
+		_, err = conn.DescribeChannel(ctx, dcinput)
 	}
 	if err != nil {
 		return sdkdiag.AppendErrorf(diags, "waiting for MediaPackage Channel (%s) deletion: %s", d.Id(), err)
@@ -184,7 +196,7 @@ func resourceChannelDelete(ctx context.Context, d *schema.ResourceData, meta int
 	return diags
 }
 
-func flattenHLSIngest(h *mediapackage.HlsIngest) []map[string]interface{} {
+func flattenHLSIngest(h *types.HlsIngest) []map[string]interface{} {
 	if h.IngestEndpoints == nil {
 		return []map[string]interface{}{
 			{"ingest_endpoints": []map[string]interface{}{}},
@@ -194,9 +206,9 @@ func flattenHLSIngest(h *mediapackage.HlsIngest) []map[string]interface{} {
 	var ingestEndpoints []map[string]interface{}
 	for _, e := range h.IngestEndpoints {
 		endpoint := map[string]interface{}{
-			"password": aws.StringValue(e.Password),
-			"url":      aws.StringValue(e.Url),
-			"username": aws.StringValue(e.Username),
+			"password": aws.ToString(e.Password),
+			"url":      aws.ToString(e.Url),
+			"username": aws.ToString(e.Username),
 		}
 
 		ingestEndpoints = append(ingestEndpoints, endpoint)
@@ -206,3 +218,29 @@ func flattenHLSIngest(h *mediapackage.HlsIngest) []map[string]interface{} {
 		{"ingest_endpoints": ingestEndpoints},
 	}
 }
+
+func findChannelByID(ctx context.Context, conn *mediapackage.Client, id string) (*mediapackage.DescribeChannelOutput, error) {
+	in := &mediapackage.DescribeChannelInput{
+		Id: aws.String(id),
+	}
+
+	out, err := conn.DescribeChannel(ctx, in)
+
+	if err != nil {
+		var nfe *types.NotFoundException
+		if errors.As(err, &nfe) {
+			return nil, &retry.NotFoundError{
+				LastRequest: in,
+				LastError:   err,
+			}
+		}
+
+		return nil, err
+	}
+
+	if out == nil {
+		return nil, tfresource.NewEmptyResultError(in)
+	}
+
+	return out, nil
+}
diff --git a/internal/service/mediapackage/channel_test.go b/internal/service/mediapackage/channel_test.go
index 9f03e4a2efb..0deec397258 100644
--- a/internal/service/mediapackage/channel_test.go
+++ b/internal/service/mediapackage/channel_test.go
@@ -1,42 +1,52 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package mediapackage_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
+	"strings"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/mediapackage"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/YakDriver/regexache"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/mediapackage"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	tfmediapackage "github.com/hashicorp/terraform-provider-aws/internal/service/mediapackage"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
 func TestAccMediaPackageChannel_basic(t *testing.T) {
 	ctx := acctest.Context(t)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_media_package_channel.test"
 
 	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, mediapackage.EndpointsID),
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, strings.ToLower(mediapackage.ServiceID))
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, strings.ToLower(mediapackage.ServiceID)),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckChannelDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccChannelConfig_basic(sdkacctest.RandString(5)),
+				Config: testAccChannelConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckChannelExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "mediapackage", regexp.MustCompile(`channels/.+`)),
-					resource.TestMatchResourceAttr(resourceName, "hls_ingest.0.ingest_endpoints.0.password", regexp.MustCompile("^[0-9a-f]*$")),
-					resource.TestMatchResourceAttr(resourceName, "hls_ingest.0.ingest_endpoints.0.url", regexp.MustCompile("^https://")),
-					resource.TestMatchResourceAttr(resourceName, "hls_ingest.0.ingest_endpoints.0.username", regexp.MustCompile("^[0-9a-f]*$")),
-					resource.TestMatchResourceAttr(resourceName, "hls_ingest.0.ingest_endpoints.1.password", regexp.MustCompile("^[0-9a-f]*$")),
-					resource.TestMatchResourceAttr(resourceName, "hls_ingest.0.ingest_endpoints.1.url", regexp.MustCompile("^https://")),
-					resource.TestMatchResourceAttr(resourceName, "hls_ingest.0.ingest_endpoints.1.username", regexp.MustCompile("^[0-9a-f]*$")),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "mediapackage", regexache.MustCompile(`channels/.+`)),
+					resource.TestMatchResourceAttr(resourceName, "hls_ingest.0.ingest_endpoints.0.password", regexache.MustCompile("^[0-9a-f]*$")),
+					resource.TestMatchResourceAttr(resourceName, "hls_ingest.0.ingest_endpoints.0.url", regexache.MustCompile("^https://")),
+					resource.TestMatchResourceAttr(resourceName, "hls_ingest.0.ingest_endpoints.0.username", regexache.MustCompile("^[0-9a-f]*$")),
+					resource.TestMatchResourceAttr(resourceName, "hls_ingest.0.ingest_endpoints.1.password", regexache.MustCompile("^[0-9a-f]*$")),
+					resource.TestMatchResourceAttr(resourceName, "hls_ingest.0.ingest_endpoints.1.url", regexache.MustCompile("^https://")),
+					resource.TestMatchResourceAttr(resourceName, "hls_ingest.0.ingest_endpoints.1.username", regexache.MustCompile("^[0-9a-f]*$")),
 				),
 			},
 			{
@@ -54,8 +64,12 @@ func TestAccMediaPackageChannel_description(t *testing.T) {
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, mediapackage.EndpointsID),
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, strings.ToLower(mediapackage.ServiceID))
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, strings.ToLower(mediapackage.ServiceID)),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckChannelDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -88,8 +102,12 @@ func TestAccMediaPackageChannel_tags(t *testing.T) {
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, mediapackage.EndpointsID),
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, strings.ToLower(mediapackage.ServiceID))
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, strings.ToLower(mediapackage.ServiceID)),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckChannelDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -127,25 +145,52 @@ func TestAccMediaPackageChannel_tags(t *testing.T) {
 	})
 }
 
+func TestAccMediaPackageChannel_disappears(t *testing.T) {
+	ctx := acctest.Context(t)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_media_package_channel.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, strings.ToLower(mediapackage.ServiceID))
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, strings.ToLower(mediapackage.ServiceID)),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckChannelDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccChannelConfig_basic(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckChannelExists(ctx, resourceName),
+					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfmediapackage.ResourceChannel(), resourceName),
+				),
+				ExpectNonEmptyPlan: true,
+			},
+		},
+	})
+}
+
 func testAccCheckChannelDestroy(ctx context.Context) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		conn := acctest.Provider.Meta().(*conns.AWSClient).MediaPackageConn(ctx)
+		conn := acctest.Provider.Meta().(*conns.AWSClient).MediaPackageClient(ctx)
 
 		for _, rs := range s.RootModule().Resources {
 			if rs.Type != "aws_media_package_channel" {
 				continue
 			}
 
-			input := &mediapackage.DescribeChannelInput{
-				Id: aws.String(rs.Primary.ID),
-			}
-
-			_, err := conn.DescribeChannelWithContext(ctx, input)
+			_, err := tfmediapackage.FindChannelByID(ctx, conn, rs.Primary.ID)
 			if err == nil {
 				return fmt.Errorf("MediaPackage Channel (%s) not deleted", rs.Primary.ID)
 			}
 
-			if !tfawserr.ErrCodeEquals(err, mediapackage.ErrCodeNotFoundException) {
+			if tfresource.NotFound(err) {
+				continue
+			}
+
+			if err != nil {
 				return err
 			}
 		}
@@ -161,24 +206,24 @@ func testAccCheckChannelExists(ctx context.Context, name string) resource.TestCh
 			return fmt.Errorf("Not found: %s", name)
 		}
 
-		conn := acctest.Provider.Meta().(*conns.AWSClient).MediaPackageConn(ctx)
+		conn := acctest.Provider.Meta().(*conns.AWSClient).MediaPackageClient(ctx)
 
 		input := &mediapackage.DescribeChannelInput{
 			Id: aws.String(rs.Primary.ID),
 		}
 
-		_, err := conn.DescribeChannelWithContext(ctx, input)
+		_, err := conn.DescribeChannel(ctx, input)
 
 		return err
 	}
 }
 
 func testAccPreCheck(ctx context.Context, t *testing.T) {
-	conn := acctest.Provider.Meta().(*conns.AWSClient).MediaPackageConn(ctx)
+	conn := acctest.Provider.Meta().(*conns.AWSClient).MediaPackageClient(ctx)
 
 	input := &mediapackage.ListChannelsInput{}
 
-	_, err := conn.ListChannelsWithContext(ctx, input)
+	_, err := conn.ListChannels(ctx, input)
 
 	if acctest.PreCheckSkipError(err) {
 		t.Skipf("skipping acceptance testing: %s", err)
@@ -192,7 +237,7 @@ func testAccPreCheck(ctx context.Context, t *testing.T) {
 func testAccChannelConfig_basic(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_media_package_channel" "test" {
-  channel_id = "tf_mediachannel_%s"
+  channel_id = %[1]q
 }
 `, rName)
 }
@@ -200,8 +245,8 @@ resource "aws_media_package_channel" "test" {
 func testAccChannelConfig_description(rName, description string) string {
 	return fmt.Sprintf(`
 resource "aws_media_package_channel" "test" {
-  channel_id  = %q
-  description = %q
+  channel_id  = %[1]q
+  description = %[2]q
 }
 `, rName, description)
 }
@@ -209,12 +254,12 @@ resource "aws_media_package_channel" "test" {
 func testAccChannelConfig_tags(rName, key, value string) string {
 	return fmt.Sprintf(`
 resource "aws_media_package_channel" "test" {
-  channel_id = "%[1]s"
+  channel_id = %[1]q
 
   tags = {
-    Name = "%[1]s"
+    Name = %[1]q
 
-    %[2]s = "%[3]s"
+    %[2]s = %[3]q
   }
 }
 `, rName, key, value)
diff --git a/internal/service/mediapackage/export_test.go b/internal/service/mediapackage/export_test.go
new file mode 100644
index 00000000000..3aa29c44ccc
--- /dev/null
+++ b/internal/service/mediapackage/export_test.go
@@ -0,0 +1,9 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package mediapackage
+
+// Exports for use in tests only.
+var (
+	FindChannelByID = findChannelByID
+)
diff --git a/internal/service/mediapackage/generate.go b/internal/service/mediapackage/generate.go
index a5e20fba3ad..e2d5d7f8d79 100644
--- a/internal/service/mediapackage/generate.go
+++ b/internal/service/mediapackage/generate.go
@@ -1,4 +1,7 @@
-//go:generate go run ../../generate/tags/main.go -ListTags -ServiceTagsMap -UpdateTags
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+//go:generate go run ../../generate/tags/main.go -AWSSDKVersion=2 -SkipTypesImp=true -KVTValues -ListTags -ServiceTagsMap -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
 
diff --git a/internal/service/mediapackage/service_package_gen.go b/internal/service/mediapackage/service_package_gen.go
index 5746c9b10b8..333ae75dcab 100644
--- a/internal/service/mediapackage/service_package_gen.go
+++ b/internal/service/mediapackage/service_package_gen.go
@@ -5,9 +5,9 @@ package mediapackage
 import (
 	"context"
 
-	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
-	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
-	mediapackage_sdkv1 "github.com/aws/aws-sdk-go/service/mediapackage"
+	aws_sdkv2 "github.com/aws/aws-sdk-go-v2/aws"
+	mediapackage_sdkv2 "github.com/aws/aws-sdk-go-v2/service/mediapackage"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -43,11 +43,17 @@ func (p *servicePackage) ServicePackageName() string {
 	return names.MediaPackage
 }
 
-// NewConn returns a new AWS SDK for Go v1 client for this service package's AWS API.
-func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*mediapackage_sdkv1.MediaPackage, error) {
-	sess := config["session"].(*session_sdkv1.Session)
+// NewClient returns a new AWS SDK for Go v2 client for this service package's AWS API.
+func (p *servicePackage) NewClient(ctx context.Context, config map[string]any) (*mediapackage_sdkv2.Client, error) {
+	cfg := *(config["aws_sdkv2_config"].(*aws_sdkv2.Config))
 
-	return mediapackage_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
+	return mediapackage_sdkv2.NewFromConfig(cfg, func(o *mediapackage_sdkv2.Options) {
+		if endpoint := config["endpoint"].(string); endpoint != "" {
+			o.BaseEndpoint = aws_sdkv2.String(endpoint)
+		}
+	}), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/mediapackage/sweep.go b/internal/service/mediapackage/sweep.go
new file mode 100644
index 00000000000..d07d23b3b01
--- /dev/null
+++ b/internal/service/mediapackage/sweep.go
@@ -0,0 +1,66 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package mediapackage
+
+import (
+	"fmt"
+	"log"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/mediapackage"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv2"
+)
+
+func RegisterSweepers() {
+	resource.AddTestSweepers("aws_media_package_channel", &resource.Sweeper{
+		Name: "aws_media_package_channel",
+		F:    sweepChannels,
+	})
+}
+
+func sweepChannels(region string) error {
+	ctx := sweep.Context(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
+	if err != nil {
+		return fmt.Errorf("getting client: %s", err)
+	}
+
+	conn := client.MediaPackageClient(ctx)
+	sweepResources := make([]sweep.Sweepable, 0)
+	in := &mediapackage.ListChannelsInput{}
+
+	pages := mediapackage.NewListChannelsPaginator(conn, in)
+
+	for pages.HasMorePages() {
+		page, err := pages.NextPage(ctx)
+
+		if awsv2.SkipSweepError(err) {
+			log.Printf("[WARN] Skipping MediaPackage Channels sweep for %s: %s", region, err)
+			return nil
+		}
+
+		if err != nil {
+			return fmt.Errorf("retrieving MediaPackage Channels: %w", err)
+		}
+
+		for _, channel := range page.Channels {
+			id := aws.ToString(channel.Id)
+			log.Printf("[INFO] Deleting MediaChannel Channel: %s", id)
+
+			r := ResourceChannel()
+			d := r.Data(nil)
+			d.SetId(id)
+
+			sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
+		}
+	}
+
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
+		return fmt.Errorf("sweeping Mediapackage Channels for %s: %w", region, err)
+	}
+
+	return nil
+}
diff --git a/internal/service/mediapackage/tags_gen.go b/internal/service/mediapackage/tags_gen.go
index 93907a8c6db..ffaae00dff9 100644
--- a/internal/service/mediapackage/tags_gen.go
+++ b/internal/service/mediapackage/tags_gen.go
@@ -5,10 +5,11 @@ import (
 	"context"
 	"fmt"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/mediapackage"
-	"github.com/aws/aws-sdk-go/service/mediapackage/mediapackageiface"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/mediapackage"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -17,12 +18,12 @@ import (
 // listTags lists mediapackage service tags.
 // The identifier is typically the Amazon Resource Name (ARN), although
 // it may also be a different identifier depending on the service.
-func listTags(ctx context.Context, conn mediapackageiface.MediaPackageAPI, identifier string) (tftags.KeyValueTags, error) {
+func listTags(ctx context.Context, conn *mediapackage.Client, identifier string) (tftags.KeyValueTags, error) {
 	input := &mediapackage.ListTagsForResourceInput{
 		ResourceArn: aws.String(identifier),
 	}
 
-	output, err := conn.ListTagsForResourceWithContext(ctx, input)
+	output, err := conn.ListTagsForResource(ctx, input)
 
 	if err != nil {
 		return tftags.New(ctx, nil), err
@@ -34,7 +35,7 @@ func listTags(ctx context.Context, conn mediapackageiface.MediaPackageAPI, ident
 // ListTags lists mediapackage service tags and set them in Context.
 // It is called from outside this package.
 func (p *servicePackage) ListTags(ctx context.Context, meta any, identifier string) error {
-	tags, err := listTags(ctx, meta.(*conns.AWSClient).MediaPackageConn(ctx), identifier)
+	tags, err := listTags(ctx, meta.(*conns.AWSClient).MediaPackageClient(ctx), identifier)
 
 	if err != nil {
 		return err
@@ -47,21 +48,21 @@ func (p *servicePackage) ListTags(ctx context.Context, meta any, identifier stri
 	return nil
 }
 
-// map[string]*string handling
+// map[string]string handling
 
 // Tags returns mediapackage service tags.
-func Tags(tags tftags.KeyValueTags) map[string]*string {
-	return aws.StringMap(tags.Map())
+func Tags(tags tftags.KeyValueTags) map[string]string {
+	return tags.Map()
 }
 
-// KeyValueTags creates KeyValueTags from mediapackage service tags.
-func KeyValueTags(ctx context.Context, tags map[string]*string) tftags.KeyValueTags {
+// KeyValueTags creates tftags.KeyValueTags from mediapackage service tags.
+func KeyValueTags(ctx context.Context, tags map[string]string) tftags.KeyValueTags {
 	return tftags.New(ctx, tags)
 }
 
 // getTagsIn returns mediapackage service tags from Context.
 // nil is returned if there are no input tags.
-func getTagsIn(ctx context.Context) map[string]*string {
+func getTagsIn(ctx context.Context) map[string]string {
 	if inContext, ok := tftags.FromContext(ctx); ok {
 		if tags := Tags(inContext.TagsIn.UnwrapOrDefault()); len(tags) > 0 {
 			return tags
@@ -72,7 +73,7 @@ func getTagsIn(ctx context.Context) map[string]*string {
 }
 
 // setTagsOut sets mediapackage service tags in Context.
-func setTagsOut(ctx context.Context, tags map[string]*string) {
+func setTagsOut(ctx context.Context, tags map[string]string) {
 	if inContext, ok := tftags.FromContext(ctx); ok {
 		inContext.TagsOut = types.Some(KeyValueTags(ctx, tags))
 	}
@@ -81,19 +82,21 @@ func setTagsOut(ctx context.Context, tags map[string]*string) {
 // updateTags updates mediapackage service tags.
 // The identifier is typically the Amazon Resource Name (ARN), although
 // it may also be a different identifier depending on the service.
-func updateTags(ctx context.Context, conn mediapackageiface.MediaPackageAPI, identifier string, oldTagsMap, newTagsMap any) error {
+func updateTags(ctx context.Context, conn *mediapackage.Client, identifier string, oldTagsMap, newTagsMap any) error {
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.MediaPackage)
 	if len(removedTags) > 0 {
 		input := &mediapackage.UntagResourceInput{
 			ResourceArn: aws.String(identifier),
-			TagKeys:     aws.StringSlice(removedTags.Keys()),
+			TagKeys:     removedTags.Keys(),
 		}
 
-		_, err := conn.UntagResourceWithContext(ctx, input)
+		_, err := conn.UntagResource(ctx, input)
 
 		if err != nil {
 			return fmt.Errorf("untagging resource (%s): %w", identifier, err)
@@ -108,7 +111,7 @@ func updateTags(ctx context.Context, conn mediapackageiface.MediaPackageAPI, ide
 			Tags:        Tags(updatedTags),
 		}
 
-		_, err := conn.TagResourceWithContext(ctx, input)
+		_, err := conn.TagResource(ctx, input)
 
 		if err != nil {
 			return fmt.Errorf("tagging resource (%s): %w", identifier, err)
@@ -121,5 +124,5 @@ func updateTags(ctx context.Context, conn mediapackageiface.MediaPackageAPI, ide
 // UpdateTags updates mediapackage service tags.
 // It is called from outside this package.
 func (p *servicePackage) UpdateTags(ctx context.Context, meta any, identifier string, oldTags, newTags any) error {
-	return updateTags(ctx, meta.(*conns.AWSClient).MediaPackageConn(ctx), identifier, oldTags, newTags)
+	return updateTags(ctx, meta.(*conns.AWSClient).MediaPackageClient(ctx), identifier, oldTags, newTags)
 }
diff --git a/internal/service/mediastore/container.go b/internal/service/mediastore/container.go
index 0c6695955b7..20376b9cacf 100644
--- a/internal/service/mediastore/container.go
+++ b/internal/service/mediastore/container.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package mediastore
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/mediastore"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -38,7 +41,7 @@ func ResourceContainer() *schema.Resource {
 				Type:         schema.TypeString,
 				Required:     true,
 				ForceNew:     true,
-				ValidateFunc: validation.StringMatch(regexp.MustCompile(`^\w+$`), "must contain alphanumeric characters or underscores"),
+				ValidateFunc: validation.StringMatch(regexache.MustCompile(`^\w+$`), "must contain alphanumeric characters or underscores"),
 			},
 			"arn": {
 				Type:     schema.TypeString,
diff --git a/internal/service/mediastore/container_policy.go b/internal/service/mediastore/container_policy.go
index 1254687931c..bb418440275 100644
--- a/internal/service/mediastore/container_policy.go
+++ b/internal/service/mediastore/container_policy.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package mediastore
 
 import (
diff --git a/internal/service/mediastore/container_policy_test.go b/internal/service/mediastore/container_policy_test.go
index 1693bb46985..b7978fc322f 100644
--- a/internal/service/mediastore/container_policy_test.go
+++ b/internal/service/mediastore/container_policy_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package mediastore_test
 
 import (
diff --git a/internal/service/mediastore/container_test.go b/internal/service/mediastore/container_test.go
index 871a23c56e1..efed8634027 100644
--- a/internal/service/mediastore/container_test.go
+++ b/internal/service/mediastore/container_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package mediastore_test
 
 import (
diff --git a/internal/service/mediastore/generate.go b/internal/service/mediastore/generate.go
index 073812507f9..55c91274d5b 100644
--- a/internal/service/mediastore/generate.go
+++ b/internal/service/mediastore/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTags -ListTagsInIDElem=Resource -ServiceTagsSlice -TagInIDElem=Resource -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/mediastore/service_package_gen.go b/internal/service/mediastore/service_package_gen.go
index fd88ed31fc1..15af80f5a96 100644
--- a/internal/service/mediastore/service_package_gen.go
+++ b/internal/service/mediastore/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	mediastore_sdkv1 "github.com/aws/aws-sdk-go/service/mediastore"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -54,4 +55,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*m
 	return mediastore_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/mediastore/tags_gen.go b/internal/service/mediastore/tags_gen.go
index 2c2da3ec539..dc0a0bb7824 100644
--- a/internal/service/mediastore/tags_gen.go
+++ b/internal/service/mediastore/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/mediastore"
 	"github.com/aws/aws-sdk-go/service/mediastore/mediastoreiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -102,6 +104,8 @@ func updateTags(ctx context.Context, conn mediastoreiface.MediaStoreAPI, identif
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.MediaStore)
 	if len(removedTags) > 0 {
diff --git a/internal/service/memorydb/acl.go b/internal/service/memorydb/acl.go
index 85b196f656a..618a76d22d8 100644
--- a/internal/service/memorydb/acl.go
+++ b/internal/service/memorydb/acl.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package memorydb
 
 import (
diff --git a/internal/service/memorydb/acl_data_source.go b/internal/service/memorydb/acl_data_source.go
index 8d93599e929..9ccfc697f78 100644
--- a/internal/service/memorydb/acl_data_source.go
+++ b/internal/service/memorydb/acl_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package memorydb
 
 import (
diff --git a/internal/service/memorydb/acl_data_source_test.go b/internal/service/memorydb/acl_data_source_test.go
index c9358affada..d2bbc48eefb 100644
--- a/internal/service/memorydb/acl_data_source_test.go
+++ b/internal/service/memorydb/acl_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package memorydb_test
 
 import (
diff --git a/internal/service/memorydb/acl_test.go b/internal/service/memorydb/acl_test.go
index 17d4060bbf9..abdf617063f 100644
--- a/internal/service/memorydb/acl_test.go
+++ b/internal/service/memorydb/acl_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package memorydb_test
 
 import (
diff --git a/internal/service/memorydb/cluster.go b/internal/service/memorydb/cluster.go
index de57a53ad23..6eacd29bdbe 100644
--- a/internal/service/memorydb/cluster.go
+++ b/internal/service/memorydb/cluster.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package memorydb
 
 import (
diff --git a/internal/service/memorydb/cluster_data_source.go b/internal/service/memorydb/cluster_data_source.go
index 3c9db637e37..a6529fad999 100644
--- a/internal/service/memorydb/cluster_data_source.go
+++ b/internal/service/memorydb/cluster_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package memorydb
 
 import (
diff --git a/internal/service/memorydb/cluster_data_source_test.go b/internal/service/memorydb/cluster_data_source_test.go
index d84dbe050c5..c6a0f68133e 100644
--- a/internal/service/memorydb/cluster_data_source_test.go
+++ b/internal/service/memorydb/cluster_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package memorydb_test
 
 import (
diff --git a/internal/service/memorydb/cluster_test.go b/internal/service/memorydb/cluster_test.go
index e56f41e02f2..8dac81c4c76 100644
--- a/internal/service/memorydb/cluster_test.go
+++ b/internal/service/memorydb/cluster_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package memorydb_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/memorydb"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -34,7 +37,7 @@ func TestAccMemoryDBCluster_basic(t *testing.T) {
 					resource.TestCheckTypeSetElemAttrPair(resourceName, "acl_name", "aws_memorydb_acl.test", "id"),
 					acctest.CheckResourceAttrRegionalARN(resourceName, "arn", "memorydb", "cluster/"+rName),
 					resource.TestCheckResourceAttr(resourceName, "auto_minor_version_upgrade", "false"),
-					resource.TestMatchResourceAttr(resourceName, "cluster_endpoint.0.address", regexp.MustCompile(`^clustercfg\..*?\.amazonaws\.com$`)),
+					resource.TestMatchResourceAttr(resourceName, "cluster_endpoint.0.address", regexache.MustCompile(`^clustercfg\..*?\.amazonaws\.com$`)),
 					resource.TestCheckResourceAttr(resourceName, "cluster_endpoint.0.port", "6379"),
 					resource.TestCheckResourceAttr(resourceName, "data_tiering", "false"),
 					resource.TestCheckResourceAttr(resourceName, "description", "Managed by Terraform"),
@@ -51,14 +54,14 @@ func TestAccMemoryDBCluster_basic(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "security_group_ids.#", "1"),
 					resource.TestCheckTypeSetElemAttrPair(resourceName, "security_group_ids.*", "aws_security_group.test", "id"),
 					resource.TestCheckResourceAttr(resourceName, "shards.#", "2"),
-					resource.TestMatchResourceAttr(resourceName, "shards.0.name", regexp.MustCompile(`^000[12]$`)),
+					resource.TestMatchResourceAttr(resourceName, "shards.0.name", regexache.MustCompile(`^000[12]$`)),
 					resource.TestCheckResourceAttr(resourceName, "shards.0.num_nodes", "2"),
 					resource.TestCheckResourceAttr(resourceName, "shards.0.slots", "0-8191"),
 					resource.TestCheckResourceAttr(resourceName, "shards.0.nodes.#", "2"),
 					resource.TestCheckResourceAttrSet(resourceName, "shards.0.nodes.0.availability_zone"),
 					acctest.CheckResourceAttrRFC3339(resourceName, "shards.0.nodes.0.create_time"),
-					resource.TestMatchResourceAttr(resourceName, "shards.0.nodes.0.name", regexp.MustCompile(`^`+rName+`-000[12]-00[12]$`)),
-					resource.TestMatchResourceAttr(resourceName, "shards.0.nodes.0.endpoint.0.address", regexp.MustCompile(`^`+rName+`-000[12]-00[12]\..*?\.amazonaws\.com$`)),
+					resource.TestMatchResourceAttr(resourceName, "shards.0.nodes.0.name", regexache.MustCompile(`^`+rName+`-000[12]-00[12]$`)),
+					resource.TestMatchResourceAttr(resourceName, "shards.0.nodes.0.endpoint.0.address", regexache.MustCompile(`^`+rName+`-000[12]-00[12]\..*?\.amazonaws\.com$`)),
 					resource.TestCheckResourceAttr(resourceName, "shards.0.nodes.0.endpoint.0.port", "6379"),
 					resource.TestCheckResourceAttr(resourceName, "snapshot_retention_limit", "7"),
 					resource.TestCheckResourceAttrSet(resourceName, "snapshot_window"),
@@ -824,7 +827,7 @@ func TestAccMemoryDBCluster_Update_securityGroupIds(t *testing.T) {
 			},
 			{
 				Config:      testAccClusterConfig_securityGroups(rName, 2, 0), // attempt to remove all
-				ExpectError: regexp.MustCompile(`removing all security groups is not possible`),
+				ExpectError: regexache.MustCompile(`removing all security groups is not possible`),
 			},
 			{
 				Config: testAccClusterConfig_securityGroups(rName, 2, 1),
diff --git a/internal/service/memorydb/enum.go b/internal/service/memorydb/enum.go
index c4e1d210819..9c5b1eaa287 100644
--- a/internal/service/memorydb/enum.go
+++ b/internal/service/memorydb/enum.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package memorydb
 
 // WARNING: As of 01/2022, the MemoryDB API does not provide a formal definition
diff --git a/internal/service/memorydb/find.go b/internal/service/memorydb/find.go
index 52bedac4693..93124d29636 100644
--- a/internal/service/memorydb/find.go
+++ b/internal/service/memorydb/find.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package memorydb
 
 import (
diff --git a/internal/service/memorydb/generate.go b/internal/service/memorydb/generate.go
index 8ebefe5fd13..63b9e021dcd 100644
--- a/internal/service/memorydb/generate.go
+++ b/internal/service/memorydb/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/listpages/main.go -ListOps=DescribeACLs,DescribeClusters,DescribeParameterGroups,DescribeSnapshots,DescribeSubnetGroups,DescribeUsers
 //go:generate go run ../../generate/tags/main.go -ListTags -ListTagsOp=ListTags -ListTagsOutTagsElem=TagList -ServiceTagsSlice -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
diff --git a/internal/service/memorydb/parameter_group.go b/internal/service/memorydb/parameter_group.go
index 1a17005ab53..36215e1258b 100644
--- a/internal/service/memorydb/parameter_group.go
+++ b/internal/service/memorydb/parameter_group.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package memorydb
 
 import (
diff --git a/internal/service/memorydb/parameter_group_data_source.go b/internal/service/memorydb/parameter_group_data_source.go
index 0dda516d8cc..56bcdb9967e 100644
--- a/internal/service/memorydb/parameter_group_data_source.go
+++ b/internal/service/memorydb/parameter_group_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package memorydb
 
 import (
diff --git a/internal/service/memorydb/parameter_group_data_source_test.go b/internal/service/memorydb/parameter_group_data_source_test.go
index 806397c6a8d..ccb3bf5a768 100644
--- a/internal/service/memorydb/parameter_group_data_source_test.go
+++ b/internal/service/memorydb/parameter_group_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package memorydb_test
 
 import (
diff --git a/internal/service/memorydb/parameter_group_test.go b/internal/service/memorydb/parameter_group_test.go
index ece9a4438f5..6da7b4f4763 100644
--- a/internal/service/memorydb/parameter_group_test.go
+++ b/internal/service/memorydb/parameter_group_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package memorydb_test
 
 import (
diff --git a/internal/service/memorydb/service_package_gen.go b/internal/service/memorydb/service_package_gen.go
index a16432afdd3..4ca4e1251be 100644
--- a/internal/service/memorydb/service_package_gen.go
+++ b/internal/service/memorydb/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	memorydb_sdkv1 "github.com/aws/aws-sdk-go/service/memorydb"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -115,4 +116,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*m
 	return memorydb_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/memorydb/snapshot.go b/internal/service/memorydb/snapshot.go
index 6f7704524a6..55240167f2b 100644
--- a/internal/service/memorydb/snapshot.go
+++ b/internal/service/memorydb/snapshot.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package memorydb
 
 import (
diff --git a/internal/service/memorydb/snapshot_data_source.go b/internal/service/memorydb/snapshot_data_source.go
index 48666ffbc72..39a8c9931c6 100644
--- a/internal/service/memorydb/snapshot_data_source.go
+++ b/internal/service/memorydb/snapshot_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package memorydb
 
 import (
diff --git a/internal/service/memorydb/snapshot_data_source_test.go b/internal/service/memorydb/snapshot_data_source_test.go
index 3223b1c940c..51440649af6 100644
--- a/internal/service/memorydb/snapshot_data_source_test.go
+++ b/internal/service/memorydb/snapshot_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package memorydb_test
 
 import (
diff --git a/internal/service/memorydb/snapshot_test.go b/internal/service/memorydb/snapshot_test.go
index 14a1788d38e..6e0bc598d0a 100644
--- a/internal/service/memorydb/snapshot_test.go
+++ b/internal/service/memorydb/snapshot_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package memorydb_test
 
 import (
diff --git a/internal/service/memorydb/status.go b/internal/service/memorydb/status.go
index 866b581d016..54af4c86037 100644
--- a/internal/service/memorydb/status.go
+++ b/internal/service/memorydb/status.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package memorydb
 
 import (
diff --git a/internal/service/memorydb/subnet_group.go b/internal/service/memorydb/subnet_group.go
index 2428ed4e74d..f8739b158d4 100644
--- a/internal/service/memorydb/subnet_group.go
+++ b/internal/service/memorydb/subnet_group.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package memorydb
 
 import (
diff --git a/internal/service/memorydb/subnet_group_data_source.go b/internal/service/memorydb/subnet_group_data_source.go
index 5f7688c49f3..4d3b21ee9e8 100644
--- a/internal/service/memorydb/subnet_group_data_source.go
+++ b/internal/service/memorydb/subnet_group_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package memorydb
 
 import (
diff --git a/internal/service/memorydb/subnet_group_data_source_test.go b/internal/service/memorydb/subnet_group_data_source_test.go
index 0a77d95d441..03f7e23a480 100644
--- a/internal/service/memorydb/subnet_group_data_source_test.go
+++ b/internal/service/memorydb/subnet_group_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package memorydb_test
 
 import (
diff --git a/internal/service/memorydb/subnet_group_test.go b/internal/service/memorydb/subnet_group_test.go
index b2c00225c6f..53cc2fa3300 100644
--- a/internal/service/memorydb/subnet_group_test.go
+++ b/internal/service/memorydb/subnet_group_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package memorydb_test
 
 import (
diff --git a/internal/service/memorydb/sweep.go b/internal/service/memorydb/sweep.go
index 093ef1b60b5..7c751ef9a40 100644
--- a/internal/service/memorydb/sweep.go
+++ b/internal/service/memorydb/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package memorydb
 
@@ -12,9 +12,10 @@ import (
 	"github.com/aws/aws-sdk-go/service/memorydb"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_memorydb_acl", &resource.Sweeper{
 		Name: "aws_memorydb_acl",
 		F:    sweepACLs,
@@ -63,7 +64,7 @@ func init() {
 
 func sweepACLs(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
@@ -93,7 +94,7 @@ func sweepACLs(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping MemoryDB ACL sweep for %s: %s", region, err)
 		return nil
 	}
@@ -102,7 +103,7 @@ func sweepACLs(region string) error {
 		return fmt.Errorf("error listing MemoryDB ACLs (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping MemoryDB ACLs (%s): %w", region, err)
@@ -113,7 +114,7 @@ func sweepACLs(region string) error {
 
 func sweepClusters(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
@@ -137,7 +138,7 @@ func sweepClusters(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping MemoryDB Cluster sweep for %s: %s", region, err)
 		return nil
 	}
@@ -146,7 +147,7 @@ func sweepClusters(region string) error {
 		return fmt.Errorf("error listing MemoryDB Clusters (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping MemoryDB Clusters (%s): %w", region, err)
@@ -157,7 +158,7 @@ func sweepClusters(region string) error {
 
 func sweepParameterGroups(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
@@ -187,7 +188,7 @@ func sweepParameterGroups(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping MemoryDB Parameter Group sweep for %s: %s", region, err)
 		return nil
 	}
@@ -196,7 +197,7 @@ func sweepParameterGroups(region string) error {
 		return fmt.Errorf("error listing MemoryDB Parameter Groups (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping MemoryDB Parameter Groups (%s): %w", region, err)
@@ -207,7 +208,7 @@ func sweepParameterGroups(region string) error {
 
 func sweepSnapshots(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
@@ -231,7 +232,7 @@ func sweepSnapshots(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping MemoryDB Snapshot sweep for %s: %s", region, err)
 		return nil
 	}
@@ -240,7 +241,7 @@ func sweepSnapshots(region string) error {
 		return fmt.Errorf("error listing MemoryDB Snapshots (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping MemoryDB Snapshots (%s): %w", region, err)
@@ -251,7 +252,7 @@ func sweepSnapshots(region string) error {
 
 func sweepSubnetGroups(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
@@ -281,7 +282,7 @@ func sweepSubnetGroups(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping MemoryDB Subnet Group sweep for %s: %s", region, err)
 		return nil
 	}
@@ -290,7 +291,7 @@ func sweepSubnetGroups(region string) error {
 		return fmt.Errorf("error listing MemoryDB Subnet Groups (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping MemoryDB Subnet Groups (%s): %w", region, err)
@@ -301,7 +302,7 @@ func sweepSubnetGroups(region string) error {
 
 func sweepUsers(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
@@ -331,7 +332,7 @@ func sweepUsers(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping MemoryDB User sweep for %s: %s", region, err)
 		return nil
 	}
@@ -340,7 +341,7 @@ func sweepUsers(region string) error {
 		return fmt.Errorf("error listing MemoryDB Users (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping MemoryDB Users (%s): %w", region, err)
diff --git a/internal/service/memorydb/tags_gen.go b/internal/service/memorydb/tags_gen.go
index 73a875d4c48..b2b4b29a848 100644
--- a/internal/service/memorydb/tags_gen.go
+++ b/internal/service/memorydb/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/memorydb"
 	"github.com/aws/aws-sdk-go/service/memorydb/memorydbiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -102,6 +104,8 @@ func updateTags(ctx context.Context, conn memorydbiface.MemoryDBAPI, identifier
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.MemoryDB)
 	if len(removedTags) > 0 {
diff --git a/internal/service/memorydb/user.go b/internal/service/memorydb/user.go
index 0f4e8b4bdaf..c9dc104b044 100644
--- a/internal/service/memorydb/user.go
+++ b/internal/service/memorydb/user.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package memorydb
 
 import (
diff --git a/internal/service/memorydb/user_data_source.go b/internal/service/memorydb/user_data_source.go
index 7c8c4e53c39..926baa9d67a 100644
--- a/internal/service/memorydb/user_data_source.go
+++ b/internal/service/memorydb/user_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package memorydb
 
 import (
diff --git a/internal/service/memorydb/user_data_source_test.go b/internal/service/memorydb/user_data_source_test.go
index d0fca9c8cab..b0c486a36e1 100644
--- a/internal/service/memorydb/user_data_source_test.go
+++ b/internal/service/memorydb/user_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package memorydb_test
 
 import (
diff --git a/internal/service/memorydb/user_test.go b/internal/service/memorydb/user_test.go
index eb122ad42c4..c96ed8e7844 100644
--- a/internal/service/memorydb/user_test.go
+++ b/internal/service/memorydb/user_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package memorydb_test
 
 import (
diff --git a/internal/service/memorydb/validate.go b/internal/service/memorydb/validate.go
index 167523c55b6..df34dc62cf9 100644
--- a/internal/service/memorydb/validate.go
+++ b/internal/service/memorydb/validate.go
@@ -1,8 +1,10 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package memorydb
 
 import (
-	"regexp"
-
+	"github.com/YakDriver/regexache"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 )
@@ -27,7 +29,7 @@ func validateResourceName(maxLength int) schema.SchemaValidateFunc {
 	return validation.All(
 		validateResourceNamePrefix(maxLength),
 		validation.StringDoesNotMatch(
-			regexp.MustCompile(`[-]$`),
+			regexache.MustCompile(`[-]$`),
 			"The name may not end with a hyphen."),
 	)
 }
@@ -36,10 +38,10 @@ func validateResourceNamePrefix(maxLength int) schema.SchemaValidateFunc {
 	return validation.All(
 		validation.StringLenBetween(1, maxLength),
 		validation.StringDoesNotMatch(
-			regexp.MustCompile(`[-][-]`),
+			regexache.MustCompile(`[-][-]`),
 			"The name may not contain two consecutive hyphens."),
 		validation.StringMatch(
-			regexp.MustCompile(`^[a-z0-9-]+$`),
+			regexache.MustCompile(`^[0-9a-z-]+$`),
 			"Only lowercase alphanumeric characters and hyphens are allowed."),
 	)
 }
diff --git a/internal/service/memorydb/wait.go b/internal/service/memorydb/wait.go
index cba30f066ec..eaff72786b7 100644
--- a/internal/service/memorydb/wait.go
+++ b/internal/service/memorydb/wait.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package memorydb
 
 import (
diff --git a/internal/service/meta/arn_data_source.go b/internal/service/meta/arn_data_source.go
index ea1e1a53a48..a1baaa04a33 100644
--- a/internal/service/meta/arn_data_source.go
+++ b/internal/service/meta/arn_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 // Code generated by tools/tfsdk2fw/main.go. Manual editing is required.
 
 package meta
diff --git a/internal/service/meta/arn_data_source_test.go b/internal/service/meta/arn_data_source_test.go
index 8626b531fd8..d122d94b066 100644
--- a/internal/service/meta/arn_data_source_test.go
+++ b/internal/service/meta/arn_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package meta_test
 
 import (
diff --git a/internal/service/meta/billing_service_account_data_source.go b/internal/service/meta/billing_service_account_data_source.go
index 319502dfd5c..969aaf6e65f 100644
--- a/internal/service/meta/billing_service_account_data_source.go
+++ b/internal/service/meta/billing_service_account_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package meta
 
 import (
diff --git a/internal/service/meta/billing_service_account_data_source_test.go b/internal/service/meta/billing_service_account_data_source_test.go
index fbb170f7804..4d61186475c 100644
--- a/internal/service/meta/billing_service_account_data_source_test.go
+++ b/internal/service/meta/billing_service_account_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package meta_test
 
 import (
diff --git a/internal/service/meta/consts.go b/internal/service/meta/consts.go
index ddc8e7a7d28..788d26347f7 100644
--- a/internal/service/meta/consts.go
+++ b/internal/service/meta/consts.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package meta
 
 const (
diff --git a/internal/service/meta/default_tags_data_source.go b/internal/service/meta/default_tags_data_source.go
index 0d0516f1c42..e92ea7051aa 100644
--- a/internal/service/meta/default_tags_data_source.go
+++ b/internal/service/meta/default_tags_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 // Code generated by tools/tfsdk2fw/main.go. Manual editing is required.
 
 package meta
@@ -8,8 +11,8 @@ import (
 	"github.com/hashicorp/terraform-plugin-framework/datasource"
 	"github.com/hashicorp/terraform-plugin-framework/datasource/schema"
 	"github.com/hashicorp/terraform-plugin-framework/types"
-	"github.com/hashicorp/terraform-provider-aws/internal/flex"
 	"github.com/hashicorp/terraform-provider-aws/internal/framework"
+	"github.com/hashicorp/terraform-provider-aws/internal/framework/flex"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 )
 
diff --git a/internal/service/meta/default_tags_data_source_test.go b/internal/service/meta/default_tags_data_source_test.go
index c9ce8b62517..b520101c11f 100644
--- a/internal/service/meta/default_tags_data_source_test.go
+++ b/internal/service/meta/default_tags_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package meta_test
 
 import (
diff --git a/internal/service/meta/generate.go b/internal/service/meta/generate.go
index 73e9446cead..835c158105d 100644
--- a/internal/service/meta/generate.go
+++ b/internal/service/meta/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
 
diff --git a/internal/service/meta/ip_ranges_data_source.go b/internal/service/meta/ip_ranges_data_source.go
index 8537a89e896..0f44a0cecf2 100644
--- a/internal/service/meta/ip_ranges_data_source.go
+++ b/internal/service/meta/ip_ranges_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package meta
 
 import (
@@ -14,8 +17,8 @@ import (
 	"github.com/hashicorp/terraform-plugin-framework/datasource"
 	"github.com/hashicorp/terraform-plugin-framework/datasource/schema"
 	"github.com/hashicorp/terraform-plugin-framework/types"
-	"github.com/hashicorp/terraform-provider-aws/internal/flex"
 	"github.com/hashicorp/terraform-provider-aws/internal/framework"
+	"github.com/hashicorp/terraform-provider-aws/internal/framework/flex"
 	tfslices "github.com/hashicorp/terraform-provider-aws/internal/slices"
 	"golang.org/x/exp/slices"
 )
diff --git a/internal/service/meta/ip_ranges_data_source_test.go b/internal/service/meta/ip_ranges_data_source_test.go
index f411ccdf4ad..24ec1384230 100644
--- a/internal/service/meta/ip_ranges_data_source_test.go
+++ b/internal/service/meta/ip_ranges_data_source_test.go
@@ -1,15 +1,18 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package meta_test
 
 import (
 	"fmt"
 	"net"
-	"regexp"
 	"sort"
 	"strconv"
 	"strings"
 	"testing"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
@@ -123,9 +126,9 @@ func testAccIPRangesCheckAttributes(n string) resource.TestCheckFunc {
 		}
 
 		var (
-			regionMember      = regexp.MustCompile(`regions\.\d+`)
+			regionMember      = regexache.MustCompile(`regions\.\d+`)
 			regions, services int
-			serviceMember     = regexp.MustCompile(`services\.\d+`)
+			serviceMember     = regexache.MustCompile(`services\.\d+`)
 		)
 
 		for k, v := range a {
diff --git a/internal/service/meta/partition_data_source.go b/internal/service/meta/partition_data_source.go
index 368737def3b..1207c5efa67 100644
--- a/internal/service/meta/partition_data_source.go
+++ b/internal/service/meta/partition_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package meta
 
 import (
diff --git a/internal/service/meta/partition_data_source_test.go b/internal/service/meta/partition_data_source_test.go
index c5ed08caf03..748f184ea6a 100644
--- a/internal/service/meta/partition_data_source_test.go
+++ b/internal/service/meta/partition_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package meta_test
 
 import (
diff --git a/internal/service/meta/region_data_source.go b/internal/service/meta/region_data_source.go
index 732732f5c7e..3de2753e506 100644
--- a/internal/service/meta/region_data_source.go
+++ b/internal/service/meta/region_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package meta
 
 import (
diff --git a/internal/service/meta/region_data_source_test.go b/internal/service/meta/region_data_source_test.go
index b3b81b8034c..3f205d63a89 100644
--- a/internal/service/meta/region_data_source_test.go
+++ b/internal/service/meta/region_data_source_test.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package meta_test
 
 import (
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
@@ -91,7 +94,7 @@ func TestAccMetaRegionDataSource_basic(t *testing.T) {
 			{
 				Config: testAccRegionDataSourceConfig_empty,
 				Check: resource.ComposeTestCheckFunc(
-					resource.TestMatchResourceAttr(dataSourceName, "description", regexp.MustCompile(`^.+$`)),
+					resource.TestMatchResourceAttr(dataSourceName, "description", regexache.MustCompile(`^.+$`)),
 					acctest.CheckResourceAttrRegionalHostnameService(dataSourceName, "endpoint", ec2.EndpointsID),
 					resource.TestCheckResourceAttr(dataSourceName, "name", acctest.Region()),
 				),
@@ -112,9 +115,9 @@ func TestAccMetaRegionDataSource_endpoint(t *testing.T) {
 			{
 				Config: testAccRegionDataSourceConfig_endpoint(),
 				Check: resource.ComposeTestCheckFunc(
-					resource.TestMatchResourceAttr(dataSourceName, "description", regexp.MustCompile(`^.+$`)),
-					resource.TestMatchResourceAttr(dataSourceName, "endpoint", regexp.MustCompile(fmt.Sprintf("^%s\\.[^.]+\\.%s$", ec2.EndpointsID, acctest.PartitionDNSSuffix()))),
-					resource.TestMatchResourceAttr(dataSourceName, "name", regexp.MustCompile(`^.+$`)),
+					resource.TestMatchResourceAttr(dataSourceName, "description", regexache.MustCompile(`^.+$`)),
+					resource.TestMatchResourceAttr(dataSourceName, "endpoint", regexache.MustCompile(fmt.Sprintf("^%s\\.[^.]+\\.%s$", ec2.EndpointsID, acctest.PartitionDNSSuffix()))),
+					resource.TestMatchResourceAttr(dataSourceName, "name", regexache.MustCompile(`^.+$`)),
 				),
 			},
 		},
@@ -133,9 +136,9 @@ func TestAccMetaRegionDataSource_endpointAndName(t *testing.T) {
 			{
 				Config: testAccRegionDataSourceConfig_endpointAndName(),
 				Check: resource.ComposeTestCheckFunc(
-					resource.TestMatchResourceAttr(dataSourceName, "description", regexp.MustCompile(`^.+$`)),
-					resource.TestMatchResourceAttr(dataSourceName, "endpoint", regexp.MustCompile(fmt.Sprintf("^ec2\\.[^.]+\\.%s$", acctest.PartitionDNSSuffix()))),
-					resource.TestMatchResourceAttr(dataSourceName, "name", regexp.MustCompile(`^.+$`)),
+					resource.TestMatchResourceAttr(dataSourceName, "description", regexache.MustCompile(`^.+$`)),
+					resource.TestMatchResourceAttr(dataSourceName, "endpoint", regexache.MustCompile(fmt.Sprintf("^ec2\\.[^.]+\\.%s$", acctest.PartitionDNSSuffix()))),
+					resource.TestMatchResourceAttr(dataSourceName, "name", regexache.MustCompile(`^.+$`)),
 				),
 			},
 		},
@@ -154,9 +157,9 @@ func TestAccMetaRegionDataSource_name(t *testing.T) {
 			{
 				Config: testAccRegionDataSourceConfig_name(),
 				Check: resource.ComposeTestCheckFunc(
-					resource.TestMatchResourceAttr(dataSourceName, "description", regexp.MustCompile(`^.+$`)),
-					resource.TestMatchResourceAttr(dataSourceName, "endpoint", regexp.MustCompile(fmt.Sprintf("^ec2\\.[^.]+\\.%s$", acctest.PartitionDNSSuffix()))),
-					resource.TestMatchResourceAttr(dataSourceName, "name", regexp.MustCompile(`^.+$`)),
+					resource.TestMatchResourceAttr(dataSourceName, "description", regexache.MustCompile(`^.+$`)),
+					resource.TestMatchResourceAttr(dataSourceName, "endpoint", regexache.MustCompile(fmt.Sprintf("^ec2\\.[^.]+\\.%s$", acctest.PartitionDNSSuffix()))),
+					resource.TestMatchResourceAttr(dataSourceName, "name", regexache.MustCompile(`^.+$`)),
 				),
 			},
 		},
diff --git a/internal/service/meta/regions_data_source.go b/internal/service/meta/regions_data_source.go
index 8f4d7aebfe0..33df93ff6f0 100644
--- a/internal/service/meta/regions_data_source.go
+++ b/internal/service/meta/regions_data_source.go
@@ -1,19 +1,22 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package meta
 
 import (
 	"context"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/ec2"
 	"github.com/hashicorp/terraform-plugin-framework/datasource"
 	"github.com/hashicorp/terraform-plugin-framework/datasource/schema"
 	"github.com/hashicorp/terraform-plugin-framework/types"
-	"github.com/hashicorp/terraform-provider-aws/internal/flex"
 	"github.com/hashicorp/terraform-provider-aws/internal/framework"
+	"github.com/hashicorp/terraform-provider-aws/internal/framework/flex"
 	tfec2 "github.com/hashicorp/terraform-provider-aws/internal/service/ec2"
 )
 
-// @FrameworkDataSource
+// @FrameworkDataSource(name=Regions)
 func newDataSourceRegions(context.Context) (datasource.DataSourceWithConfigure, error) {
 	d := &dataSourceRegions{}
 	d.SetMigratedFromPluginSDK(true)
@@ -64,14 +67,14 @@ func (d *dataSourceRegions) Read(ctx context.Context, request datasource.ReadReq
 		return
 	}
 
-	conn := d.Meta().EC2Conn(ctx)
+	conn := d.Meta().EC2Client(ctx)
 
 	input := &ec2.DescribeRegionsInput{
 		AllRegions: flex.BoolFromFramework(ctx, data.AllRegions),
-		Filters:    tfec2.BuildCustomFilters(ctx, data.Filters),
+		Filters:    tfec2.BuildCustomFiltersV2(ctx, data.Filters),
 	}
 
-	output, err := conn.DescribeRegionsWithContext(ctx, input)
+	output, err := conn.DescribeRegions(ctx, input)
 
 	if err != nil {
 		response.Diagnostics.AddError("reading Regions", err.Error())
@@ -81,7 +84,7 @@ func (d *dataSourceRegions) Read(ctx context.Context, request datasource.ReadReq
 
 	var names []string
 	for _, v := range output.Regions {
-		names = append(names, aws.StringValue(v.RegionName))
+		names = append(names, aws.ToString(v.RegionName))
 	}
 
 	data.ID = types.StringValue(d.Meta().Partition)
diff --git a/internal/service/meta/regions_data_source_test.go b/internal/service/meta/regions_data_source_test.go
index 8e83dc757a8..f94ad92741c 100644
--- a/internal/service/meta/regions_data_source_test.go
+++ b/internal/service/meta/regions_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package meta_test
 
 import (
diff --git a/internal/service/meta/service_data_source.go b/internal/service/meta/service_data_source.go
index adb00eb94fb..2706a0a0e7b 100644
--- a/internal/service/meta/service_data_source.go
+++ b/internal/service/meta/service_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package meta
 
 import (
diff --git a/internal/service/meta/service_data_source_test.go b/internal/service/meta/service_data_source_test.go
index dc8a8fc9c20..db95a0f5fa1 100644
--- a/internal/service/meta/service_data_source_test.go
+++ b/internal/service/meta/service_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package meta_test
 
 import (
diff --git a/internal/service/meta/service_package_gen.go b/internal/service/meta/service_package_gen.go
index 6bbd72b1a5b..8ae99fcad16 100644
--- a/internal/service/meta/service_package_gen.go
+++ b/internal/service/meta/service_package_gen.go
@@ -5,6 +5,7 @@ package meta
 import (
 	"context"
 
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 )
 
@@ -32,6 +33,7 @@ func (p *servicePackage) FrameworkDataSources(ctx context.Context) []*types.Serv
 		},
 		{
 			Factory: newDataSourceRegions,
+			Name:    "Regions",
 		},
 		{
 			Factory: newDataSourceService,
@@ -55,4 +57,6 @@ func (p *servicePackage) ServicePackageName() string {
 	return "meta"
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/mq/broker.go b/internal/service/mq/broker.go
index 815e91ceb33..21afe8228ee 100644
--- a/internal/service/mq/broker.go
+++ b/internal/service/mq/broker.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package mq
 
 import (
@@ -7,11 +10,11 @@ import (
 	"fmt"
 	"log"
 	"reflect"
-	"regexp"
 	"strconv"
 	"strings"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/mq"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -23,10 +26,10 @@ import (
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/create"
-	"github.com/hashicorp/terraform-provider-aws/internal/experimental/nullable"
 	"github.com/hashicorp/terraform-provider-aws/internal/flex"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/internal/types/nullable"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
 	"github.com/hashicorp/terraform-provider-aws/names"
 	"github.com/mitchellh/copystructure"
@@ -326,6 +329,11 @@ func ResourceBroker() *schema.Resource {
 							Sensitive:    true,
 							ValidateFunc: ValidBrokerPassword,
 						},
+						"replication_user": {
+							Type:     schema.TypeBool,
+							Optional: true,
+							Default:  false,
+						},
 						"username": {
 							Type:         schema.TypeString,
 							Required:     true,
@@ -803,11 +811,12 @@ func DiffBrokerUsers(bId string, oldUsers, newUsers []interface{}) (
 
 			if !reflect.DeepEqual(existingUserMap, newUserMap) {
 				ur = append(ur, &mq.UpdateUserRequest{
-					BrokerId:      aws.String(bId),
-					ConsoleAccess: aws.Bool(newUserMap["console_access"].(bool)),
-					Groups:        flex.ExpandStringList(ng),
-					Password:      aws.String(newUserMap["password"].(string)),
-					Username:      aws.String(username),
+					BrokerId:        aws.String(bId),
+					ConsoleAccess:   aws.Bool(newUserMap["console_access"].(bool)),
+					Groups:          flex.ExpandStringList(ng),
+					ReplicationUser: aws.Bool(newUserMap["replication_user"].(bool)),
+					Password:        aws.String(newUserMap["password"].(string)),
+					Username:        aws.String(username),
 				})
 			}
 
@@ -815,10 +824,11 @@ func DiffBrokerUsers(bId string, oldUsers, newUsers []interface{}) (
 			delete(existingUsers, username)
 		} else {
 			cur := &mq.CreateUserRequest{
-				BrokerId:      aws.String(bId),
-				ConsoleAccess: aws.Bool(newUserMap["console_access"].(bool)),
-				Password:      aws.String(newUserMap["password"].(string)),
-				Username:      aws.String(username),
+				BrokerId:        aws.String(bId),
+				ConsoleAccess:   aws.Bool(newUserMap["console_access"].(bool)),
+				Password:        aws.String(newUserMap["password"].(string)),
+				ReplicationUser: aws.Bool(newUserMap["replication_user"].(bool)),
+				Username:        aws.String(username),
 			}
 			if len(ng) > 0 {
 				cur.Groups = flex.ExpandStringList(ng)
@@ -904,6 +914,9 @@ func expandUsers(cfg []interface{}) []*mq.User {
 		if v, ok := u["console_access"]; ok {
 			user.ConsoleAccess = aws.Bool(v.(bool))
 		}
+		if v, ok := u["replication_user"]; ok {
+			user.ReplicationUser = aws.Bool(v.(bool))
+		}
 		if v, ok := u["groups"]; ok {
 			user.Groups = flex.ExpandStringSet(v.(*schema.Set))
 		}
@@ -930,9 +943,10 @@ func expandUsersForBroker(ctx context.Context, conn *mq.MQ, brokerId string, inp
 		}
 
 		user := &mq.User{
-			ConsoleAccess: uOut.ConsoleAccess,
-			Groups:        uOut.Groups,
-			Username:      uOut.Username,
+			ConsoleAccess:   uOut.ConsoleAccess,
+			Groups:          uOut.Groups,
+			ReplicationUser: uOut.ReplicationUser,
+			Username:        uOut.Username,
 		}
 
 		rawUsers = append(rawUsers, user)
@@ -965,6 +979,9 @@ func flattenUsers(users []*mq.User, cfgUsers []interface{}) *schema.Set {
 		if u.ConsoleAccess != nil {
 			m["console_access"] = aws.BoolValue(u.ConsoleAccess)
 		}
+		if u.ReplicationUser != nil {
+			m["replication_user"] = aws.BoolValue(u.ReplicationUser)
+		}
 		if len(u.Groups) > 0 {
 			m["groups"] = flex.FlattenStringSet(u.Groups)
 		}
@@ -1189,5 +1206,5 @@ func expandLDAPServerMetadata(tfList []interface{}) *mq.LdapServerMetadataInput
 
 var ValidateBrokerName = validation.All(
 	validation.StringLenBetween(1, 50),
-	validation.StringMatch(regexp.MustCompile(`^[0-9A-Za-z_-]+$`), ""),
+	validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_-]+$`), ""),
 )
diff --git a/internal/service/mq/broker_data_source.go b/internal/service/mq/broker_data_source.go
index bede67117f7..212409a2634 100644
--- a/internal/service/mq/broker_data_source.go
+++ b/internal/service/mq/broker_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package mq
 
 import (
@@ -8,8 +11,8 @@ import (
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
-	"github.com/hashicorp/terraform-provider-aws/internal/experimental/nullable"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
+	"github.com/hashicorp/terraform-provider-aws/internal/types/nullable"
 )
 
 // @SDKDataSource("aws_mq_broker")
@@ -222,7 +225,6 @@ func DataSourceBroker() *schema.Resource {
 			"user": {
 				Type:     schema.TypeSet,
 				Computed: true,
-				Set:      resourceUserHash,
 				Elem: &schema.Resource{
 					Schema: map[string]*schema.Schema{
 						"console_access": {
@@ -234,9 +236,13 @@ func DataSourceBroker() *schema.Resource {
 							Elem:     &schema.Schema{Type: schema.TypeString},
 							Computed: true,
 						},
+						"replication_user": {
+							Type:     schema.TypeBool,
+							Computed: true,
+						},
 						"username": {
 							Type:     schema.TypeString,
-							Required: true,
+							Computed: true,
 						},
 					},
 				},
diff --git a/internal/service/mq/broker_data_source_test.go b/internal/service/mq/broker_data_source_test.go
index aba8245d4c3..62c12e6425c 100644
--- a/internal/service/mq/broker_data_source_test.go
+++ b/internal/service/mq/broker_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package mq_test
 
 import (
@@ -64,64 +67,7 @@ func TestAccMQBrokerDataSource_basic(t *testing.T) {
 }
 
 func testAccBrokerDataSourceConfig_base(rName string) string {
-	return fmt.Sprintf(`
-data "aws_availability_zones" "available" {
-  state = "available"
-
-  filter {
-    name   = "opt-in-status"
-    values = ["opt-in-not-required"]
-  }
-}
-
-resource "aws_vpc" "test" {
-  cidr_block = "10.0.0.0/16"
-
-  tags = {
-    Name = %[1]q
-  }
-}
-
-resource "aws_internet_gateway" "test" {
-  vpc_id = aws_vpc.test.id
-}
-
-resource "aws_route_table" "test" {
-  vpc_id = aws_vpc.test.id
-
-  route {
-    cidr_block = "0.0.0.0/0"
-    gateway_id = aws_internet_gateway.test.id
-  }
-}
-
-resource "aws_subnet" "test" {
-  count             = 2
-  cidr_block        = "10.0.${count.index}.0/24"
-  availability_zone = data.aws_availability_zones.available.names[count.index]
-  vpc_id            = aws_vpc.test.id
-
-  tags = {
-    Name = %[1]q
-  }
-}
-
-resource "aws_route_table_association" "test" {
-  count          = 2
-  subnet_id      = aws_subnet.test[count.index].id
-  route_table_id = aws_route_table.test.id
-}
-
-resource "aws_security_group" "test" {
-  count = 2
-
-  vpc_id = aws_vpc.test.id
-
-  tags = {
-    Name = %[1]q
-  }
-}
-
+	return acctest.ConfigCompose(testAccBrokerConfig_baseCustomVPC(rName), fmt.Sprintf(`
 resource "aws_mq_configuration" "test" {
   name           = %[1]q
   engine_type    = "ActiveMQ"
@@ -173,7 +119,7 @@ resource "aws_mq_broker" "test" {
 
   depends_on = [aws_internet_gateway.test]
 }
-`, rName)
+`, rName))
 }
 
 func testAccBrokerDataSourceConfig_byID(rName string) string {
diff --git a/internal/service/mq/broker_instance_type_offerings_data_source.go b/internal/service/mq/broker_instance_type_offerings_data_source.go
index a29fca14dcb..ff41348fc62 100644
--- a/internal/service/mq/broker_instance_type_offerings_data_source.go
+++ b/internal/service/mq/broker_instance_type_offerings_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package mq
 
 import (
diff --git a/internal/service/mq/broker_instance_type_offerings_data_source_test.go b/internal/service/mq/broker_instance_type_offerings_data_source_test.go
index 876422d8c7a..a4c806b3ff8 100644
--- a/internal/service/mq/broker_instance_type_offerings_data_source_test.go
+++ b/internal/service/mq/broker_instance_type_offerings_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package mq_test
 
 import (
diff --git a/internal/service/mq/broker_test.go b/internal/service/mq/broker_test.go
index 6a819d1cd7c..1f92011a40f 100644
--- a/internal/service/mq/broker_test.go
+++ b/internal/service/mq/broker_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package mq_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"strings"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/mq"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
@@ -117,19 +120,21 @@ func TestDiffUsers(t *testing.T) {
 			OldUsers: []interface{}{},
 			NewUsers: []interface{}{
 				map[string]interface{}{
-					"console_access": false,
-					"username":       "second",
-					"password":       "TestTest2222",
-					"groups":         schema.NewSet(schema.HashString, []interface{}{"admin"}),
+					"console_access":   false,
+					"username":         "second",
+					"password":         "TestTest2222",
+					"groups":           schema.NewSet(schema.HashString, []interface{}{"admin"}),
+					"replication_user": false,
 				},
 			},
 			Creations: []*mq.CreateUserRequest{
 				{
-					BrokerId:      aws.String("test"),
-					ConsoleAccess: aws.Bool(false),
-					Username:      aws.String("second"),
-					Password:      aws.String("TestTest2222"),
-					Groups:        aws.StringSlice([]string{"admin"}),
+					BrokerId:        aws.String("test"),
+					ConsoleAccess:   aws.Bool(false),
+					Username:        aws.String("second"),
+					Password:        aws.String("TestTest2222"),
+					Groups:          aws.StringSlice([]string{"admin"}),
+					ReplicationUser: aws.Bool(false),
 				},
 			},
 			Deletions: []*mq.DeleteUserInput{},
@@ -138,24 +143,27 @@ func TestDiffUsers(t *testing.T) {
 		{
 			OldUsers: []interface{}{
 				map[string]interface{}{
-					"console_access": true,
-					"username":       "first",
-					"password":       "TestTest1111",
+					"console_access":   true,
+					"username":         "first",
+					"password":         "TestTest1111",
+					"replication_user": false,
 				},
 			},
 			NewUsers: []interface{}{
 				map[string]interface{}{
-					"console_access": false,
-					"username":       "second",
-					"password":       "TestTest2222",
+					"console_access":   false,
+					"username":         "second",
+					"password":         "TestTest2222",
+					"replication_user": false,
 				},
 			},
 			Creations: []*mq.CreateUserRequest{
 				{
-					BrokerId:      aws.String("test"),
-					ConsoleAccess: aws.Bool(false),
-					Username:      aws.String("second"),
-					Password:      aws.String("TestTest2222"),
+					BrokerId:        aws.String("test"),
+					ConsoleAccess:   aws.Bool(false),
+					Username:        aws.String("second"),
+					Password:        aws.String("TestTest2222"),
+					ReplicationUser: aws.Bool(false),
 				},
 			},
 			Deletions: []*mq.DeleteUserInput{
@@ -166,22 +174,25 @@ func TestDiffUsers(t *testing.T) {
 		{
 			OldUsers: []interface{}{
 				map[string]interface{}{
-					"console_access": true,
-					"username":       "first",
-					"password":       "TestTest1111updated",
+					"console_access":   true,
+					"username":         "first",
+					"password":         "TestTest1111updated",
+					"replication_user": false,
 				},
 				map[string]interface{}{
-					"console_access": false,
-					"username":       "second",
-					"password":       "TestTest2222",
+					"console_access":   false,
+					"username":         "second",
+					"password":         "TestTest2222",
+					"replication_user": false,
 				},
 			},
 			NewUsers: []interface{}{
 				map[string]interface{}{
-					"console_access": false,
-					"username":       "second",
-					"password":       "TestTest2222",
-					"groups":         schema.NewSet(schema.HashString, []interface{}{"admin"}),
+					"console_access":   false,
+					"username":         "second",
+					"password":         "TestTest2222",
+					"groups":           schema.NewSet(schema.HashString, []interface{}{"admin"}),
+					"replication_user": false,
 				},
 			},
 			Creations: []*mq.CreateUserRequest{},
@@ -190,11 +201,12 @@ func TestDiffUsers(t *testing.T) {
 			},
 			Updates: []*mq.UpdateUserRequest{
 				{
-					BrokerId:      aws.String("test"),
-					ConsoleAccess: aws.Bool(false),
-					Username:      aws.String("second"),
-					Password:      aws.String("TestTest2222"),
-					Groups:        aws.StringSlice([]string{"admin"}),
+					BrokerId:        aws.String("test"),
+					ConsoleAccess:   aws.Bool(false),
+					Username:        aws.String("second"),
+					Password:        aws.String("TestTest2222"),
+					Groups:          aws.StringSlice([]string{"admin"}),
+					ReplicationUser: aws.Bool(false),
 				},
 			},
 		},
@@ -256,13 +268,13 @@ func TestAccMQBroker_basic(t *testing.T) {
 				Config: testAccBrokerConfig_basic(rName, testAccBrokerVersionNewer),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckBrokerExists(ctx, resourceName, &broker),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "mq", regexp.MustCompile(`broker:+.`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "mq", regexache.MustCompile(`broker:+.`)),
 					resource.TestCheckResourceAttr(resourceName, "auto_minor_version_upgrade", "false"),
 					resource.TestCheckResourceAttr(resourceName, "authentication_strategy", "simple"),
 					resource.TestCheckResourceAttr(resourceName, "broker_name", rName),
 					resource.TestCheckResourceAttr(resourceName, "configuration.#", "1"),
-					resource.TestMatchResourceAttr(resourceName, "configuration.0.id", regexp.MustCompile(`^c-[a-z0-9-]+$`)),
-					resource.TestMatchResourceAttr(resourceName, "configuration.0.revision", regexp.MustCompile(`^[0-9]+$`)),
+					resource.TestMatchResourceAttr(resourceName, "configuration.0.id", regexache.MustCompile(`^c-[0-9a-z-]+$`)),
+					resource.TestMatchResourceAttr(resourceName, "configuration.0.revision", regexache.MustCompile(`^[0-9]+$`)),
 					resource.TestCheckResourceAttr(resourceName, "deployment_mode", "SINGLE_INSTANCE"),
 					resource.TestCheckResourceAttr(resourceName, "encryption_options.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "encryption_options.0.use_aws_owned_key", "true"),
@@ -271,15 +283,15 @@ func TestAccMQBroker_basic(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "host_instance_type", "mq.t2.micro"),
 					resource.TestCheckResourceAttr(resourceName, "instances.#", "1"),
 					resource.TestMatchResourceAttr(resourceName, "instances.0.console_url",
-						regexp.MustCompile(`^https://[a-f0-9-]+\.mq.[a-z0-9-]+.amazonaws.com:8162$`)),
+						regexache.MustCompile(`^https://[0-9a-f-]+\.mq.[0-9a-z-]+.amazonaws.com:8162$`)),
 					resource.TestCheckResourceAttr(resourceName, "instances.0.endpoints.#", "5"),
-					resource.TestMatchResourceAttr(resourceName, "instances.0.endpoints.0", regexp.MustCompile(`^ssl://[a-z0-9-\.]+:61617$`)),
-					resource.TestMatchResourceAttr(resourceName, "instances.0.endpoints.1", regexp.MustCompile(`^amqp\+ssl://[a-z0-9-\.]+:5671$`)),
-					resource.TestMatchResourceAttr(resourceName, "instances.0.endpoints.2", regexp.MustCompile(`^stomp\+ssl://[a-z0-9-\.]+:61614$`)),
-					resource.TestMatchResourceAttr(resourceName, "instances.0.endpoints.3", regexp.MustCompile(`^mqtt\+ssl://[a-z0-9-\.]+:8883$`)),
-					resource.TestMatchResourceAttr(resourceName, "instances.0.endpoints.4", regexp.MustCompile(`^wss://[a-z0-9-\.]+:61619$`)),
+					resource.TestMatchResourceAttr(resourceName, "instances.0.endpoints.0", regexache.MustCompile(`^ssl://[0-9a-z.-]+:61617$`)),
+					resource.TestMatchResourceAttr(resourceName, "instances.0.endpoints.1", regexache.MustCompile(`^amqp\+ssl://[0-9a-z.-]+:5671$`)),
+					resource.TestMatchResourceAttr(resourceName, "instances.0.endpoints.2", regexache.MustCompile(`^stomp\+ssl://[0-9a-z.-]+:61614$`)),
+					resource.TestMatchResourceAttr(resourceName, "instances.0.endpoints.3", regexache.MustCompile(`^mqtt\+ssl://[0-9a-z.-]+:8883$`)),
+					resource.TestMatchResourceAttr(resourceName, "instances.0.endpoints.4", regexache.MustCompile(`^wss://[0-9a-z.-]+:61619$`)),
 					resource.TestMatchResourceAttr(resourceName, "instances.0.ip_address",
-						regexp.MustCompile(`^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$`)),
+						regexache.MustCompile(`^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$`)),
 					resource.TestCheckResourceAttr(resourceName, "maintenance_window_start_time.#", "1"),
 					resource.TestCheckResourceAttrSet(resourceName, "maintenance_window_start_time.0.day_of_week"),
 					resource.TestCheckResourceAttrSet(resourceName, "maintenance_window_start_time.0.time_of_day"),
@@ -425,8 +437,8 @@ func TestAccMQBroker_throughputOptimized(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "auto_minor_version_upgrade", "false"),
 					resource.TestCheckResourceAttr(resourceName, "broker_name", rName),
 					resource.TestCheckResourceAttr(resourceName, "configuration.#", "1"),
-					resource.TestMatchResourceAttr(resourceName, "configuration.0.id", regexp.MustCompile(`^c-[a-z0-9-]+$`)),
-					resource.TestMatchResourceAttr(resourceName, "configuration.0.revision", regexp.MustCompile(`^[0-9]+$`)),
+					resource.TestMatchResourceAttr(resourceName, "configuration.0.id", regexache.MustCompile(`^c-[0-9a-z-]+$`)),
+					resource.TestMatchResourceAttr(resourceName, "configuration.0.revision", regexache.MustCompile(`^[0-9]+$`)),
 					resource.TestCheckResourceAttr(resourceName, "deployment_mode", "SINGLE_INSTANCE"),
 					resource.TestCheckResourceAttr(resourceName, "encryption_options.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "encryption_options.0.use_aws_owned_key", "true"),
@@ -451,18 +463,18 @@ func TestAccMQBroker_throughputOptimized(t *testing.T) {
 						"username":       "Test",
 						"password":       "TestTest1234",
 					}),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "mq", regexp.MustCompile(`broker:+.`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "mq", regexache.MustCompile(`broker:+.`)),
 					resource.TestCheckResourceAttr(resourceName, "instances.#", "1"),
 					resource.TestMatchResourceAttr(resourceName, "instances.0.console_url",
-						regexp.MustCompile(`^https://[a-f0-9-]+\.mq.[a-z0-9-]+.amazonaws.com:8162$`)),
+						regexache.MustCompile(`^https://[0-9a-f-]+\.mq.[0-9a-z-]+.amazonaws.com:8162$`)),
 					resource.TestMatchResourceAttr(resourceName, "instances.0.ip_address",
-						regexp.MustCompile(`^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$`)),
+						regexache.MustCompile(`^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$`)),
 					resource.TestCheckResourceAttr(resourceName, "instances.0.endpoints.#", "5"),
-					resource.TestMatchResourceAttr(resourceName, "instances.0.endpoints.0", regexp.MustCompile(`^ssl://[a-z0-9-\.]+:61617$`)),
-					resource.TestMatchResourceAttr(resourceName, "instances.0.endpoints.1", regexp.MustCompile(`^amqp\+ssl://[a-z0-9-\.]+:5671$`)),
-					resource.TestMatchResourceAttr(resourceName, "instances.0.endpoints.2", regexp.MustCompile(`^stomp\+ssl://[a-z0-9-\.]+:61614$`)),
-					resource.TestMatchResourceAttr(resourceName, "instances.0.endpoints.3", regexp.MustCompile(`^mqtt\+ssl://[a-z0-9-\.]+:8883$`)),
-					resource.TestMatchResourceAttr(resourceName, "instances.0.endpoints.4", regexp.MustCompile(`^wss://[a-z0-9-\.]+:61619$`)),
+					resource.TestMatchResourceAttr(resourceName, "instances.0.endpoints.0", regexache.MustCompile(`^ssl://[0-9a-z.-]+:61617$`)),
+					resource.TestMatchResourceAttr(resourceName, "instances.0.endpoints.1", regexache.MustCompile(`^amqp\+ssl://[0-9a-z.-]+:5671$`)),
+					resource.TestMatchResourceAttr(resourceName, "instances.0.endpoints.2", regexache.MustCompile(`^stomp\+ssl://[0-9a-z.-]+:61614$`)),
+					resource.TestMatchResourceAttr(resourceName, "instances.0.endpoints.3", regexache.MustCompile(`^mqtt\+ssl://[0-9a-z.-]+:8883$`)),
+					resource.TestMatchResourceAttr(resourceName, "instances.0.endpoints.4", regexache.MustCompile(`^wss://[0-9a-z.-]+:61619$`)),
 				),
 			},
 		},
@@ -509,7 +521,7 @@ func TestAccMQBroker_AllFields_defaultVPC(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "auto_minor_version_upgrade", "true"),
 					resource.TestCheckResourceAttr(resourceName, "broker_name", rName),
 					resource.TestCheckResourceAttr(resourceName, "configuration.#", "1"),
-					resource.TestMatchResourceAttr(resourceName, "configuration.0.id", regexp.MustCompile(`^c-[a-z0-9-]+$`)),
+					resource.TestMatchResourceAttr(resourceName, "configuration.0.id", regexache.MustCompile(`^c-[0-9a-z-]+$`)),
 					resource.TestCheckResourceAttr(resourceName, "configuration.0.revision", "2"),
 					resource.TestCheckResourceAttr(resourceName, "deployment_mode", "ACTIVE_STANDBY_MULTI_AZ"),
 					resource.TestCheckResourceAttr(resourceName, "engine_type", "ActiveMQ"),
@@ -542,28 +554,28 @@ func TestAccMQBroker_AllFields_defaultVPC(t *testing.T) {
 						"username":       "Test",
 						"password":       "TestTest1234",
 					}),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "mq", regexp.MustCompile(`broker:+.`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "mq", regexache.MustCompile(`broker:+.`)),
 					resource.TestCheckResourceAttr(resourceName, "instances.#", "2"),
 					resource.TestMatchResourceAttr(resourceName, "instances.0.console_url",
-						regexp.MustCompile(`^https://[a-f0-9-]+\.mq.[a-z0-9-]+.amazonaws.com:8162$`)),
+						regexache.MustCompile(`^https://[0-9a-f-]+\.mq.[0-9a-z-]+.amazonaws.com:8162$`)),
 					resource.TestMatchResourceAttr(resourceName, "instances.0.ip_address",
-						regexp.MustCompile(`^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$`)),
+						regexache.MustCompile(`^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$`)),
 					resource.TestCheckResourceAttr(resourceName, "instances.0.endpoints.#", "5"),
-					resource.TestMatchResourceAttr(resourceName, "instances.0.endpoints.0", regexp.MustCompile(`^ssl://[a-z0-9-\.]+:61617$`)),
-					resource.TestMatchResourceAttr(resourceName, "instances.0.endpoints.1", regexp.MustCompile(`^amqp\+ssl://[a-z0-9-\.]+:5671$`)),
-					resource.TestMatchResourceAttr(resourceName, "instances.0.endpoints.2", regexp.MustCompile(`^stomp\+ssl://[a-z0-9-\.]+:61614$`)),
-					resource.TestMatchResourceAttr(resourceName, "instances.0.endpoints.3", regexp.MustCompile(`^mqtt\+ssl://[a-z0-9-\.]+:8883$`)),
-					resource.TestMatchResourceAttr(resourceName, "instances.0.endpoints.4", regexp.MustCompile(`^wss://[a-z0-9-\.]+:61619$`)),
+					resource.TestMatchResourceAttr(resourceName, "instances.0.endpoints.0", regexache.MustCompile(`^ssl://[0-9a-z.-]+:61617$`)),
+					resource.TestMatchResourceAttr(resourceName, "instances.0.endpoints.1", regexache.MustCompile(`^amqp\+ssl://[0-9a-z.-]+:5671$`)),
+					resource.TestMatchResourceAttr(resourceName, "instances.0.endpoints.2", regexache.MustCompile(`^stomp\+ssl://[0-9a-z.-]+:61614$`)),
+					resource.TestMatchResourceAttr(resourceName, "instances.0.endpoints.3", regexache.MustCompile(`^mqtt\+ssl://[0-9a-z.-]+:8883$`)),
+					resource.TestMatchResourceAttr(resourceName, "instances.0.endpoints.4", regexache.MustCompile(`^wss://[0-9a-z.-]+:61619$`)),
 					resource.TestMatchResourceAttr(resourceName, "instances.1.console_url",
-						regexp.MustCompile(`^https://[a-f0-9-]+\.mq.[a-z0-9-]+.amazonaws.com:8162$`)),
+						regexache.MustCompile(`^https://[0-9a-f-]+\.mq.[0-9a-z-]+.amazonaws.com:8162$`)),
 					resource.TestMatchResourceAttr(resourceName, "instances.1.ip_address",
-						regexp.MustCompile(`^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$`)),
+						regexache.MustCompile(`^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$`)),
 					resource.TestCheckResourceAttr(resourceName, "instances.1.endpoints.#", "5"),
-					resource.TestMatchResourceAttr(resourceName, "instances.1.endpoints.0", regexp.MustCompile(`^ssl://[a-z0-9-\.]+:61617$`)),
-					resource.TestMatchResourceAttr(resourceName, "instances.1.endpoints.1", regexp.MustCompile(`^amqp\+ssl://[a-z0-9-\.]+:5671$`)),
-					resource.TestMatchResourceAttr(resourceName, "instances.1.endpoints.2", regexp.MustCompile(`^stomp\+ssl://[a-z0-9-\.]+:61614$`)),
-					resource.TestMatchResourceAttr(resourceName, "instances.1.endpoints.3", regexp.MustCompile(`^mqtt\+ssl://[a-z0-9-\.]+:8883$`)),
-					resource.TestMatchResourceAttr(resourceName, "instances.1.endpoints.4", regexp.MustCompile(`^wss://[a-z0-9-\.]+:61619$`)),
+					resource.TestMatchResourceAttr(resourceName, "instances.1.endpoints.0", regexache.MustCompile(`^ssl://[0-9a-z.-]+:61617$`)),
+					resource.TestMatchResourceAttr(resourceName, "instances.1.endpoints.1", regexache.MustCompile(`^amqp\+ssl://[0-9a-z.-]+:5671$`)),
+					resource.TestMatchResourceAttr(resourceName, "instances.1.endpoints.2", regexache.MustCompile(`^stomp\+ssl://[0-9a-z.-]+:61614$`)),
+					resource.TestMatchResourceAttr(resourceName, "instances.1.endpoints.3", regexache.MustCompile(`^mqtt\+ssl://[0-9a-z.-]+:8883$`)),
+					resource.TestMatchResourceAttr(resourceName, "instances.1.endpoints.4", regexache.MustCompile(`^wss://[0-9a-z.-]+:61619$`)),
 				),
 			},
 			{
@@ -579,7 +591,7 @@ func TestAccMQBroker_AllFields_defaultVPC(t *testing.T) {
 					testAccCheckBrokerExists(ctx, resourceName, &broker),
 					resource.TestCheckResourceAttr(resourceName, "broker_name", rName),
 					resource.TestCheckResourceAttr(resourceName, "configuration.#", "1"),
-					resource.TestMatchResourceAttr(resourceName, "configuration.0.id", regexp.MustCompile(`^c-[a-z0-9-]+$`)),
+					resource.TestMatchResourceAttr(resourceName, "configuration.0.id", regexache.MustCompile(`^c-[0-9a-z-]+$`)),
 					resource.TestCheckResourceAttr(resourceName, "configuration.0.revision", "3"),
 				),
 			},
@@ -590,7 +602,7 @@ func TestAccMQBroker_AllFields_defaultVPC(t *testing.T) {
 					testAccCheckBrokerExists(ctx, resourceName, &broker),
 					resource.TestCheckResourceAttr(resourceName, "broker_name", rName),
 					resource.TestCheckResourceAttr(resourceName, "configuration.#", "1"),
-					resource.TestMatchResourceAttr(resourceName, "configuration.0.id", regexp.MustCompile(`^c-[a-z0-9-]+$`)),
+					resource.TestMatchResourceAttr(resourceName, "configuration.0.id", regexache.MustCompile(`^c-[0-9a-z-]+$`)),
 					resource.TestCheckResourceAttr(resourceName, "configuration.0.revision", "2"),
 				),
 			},
@@ -638,7 +650,7 @@ func TestAccMQBroker_AllFields_customVPC(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "auto_minor_version_upgrade", "true"),
 					resource.TestCheckResourceAttr(resourceName, "broker_name", rName),
 					resource.TestCheckResourceAttr(resourceName, "configuration.#", "1"),
-					resource.TestMatchResourceAttr(resourceName, "configuration.0.id", regexp.MustCompile(`^c-[a-z0-9-]+$`)),
+					resource.TestMatchResourceAttr(resourceName, "configuration.0.id", regexache.MustCompile(`^c-[0-9a-z-]+$`)),
 					resource.TestCheckResourceAttr(resourceName, "configuration.0.revision", "2"),
 					resource.TestCheckResourceAttr(resourceName, "deployment_mode", "ACTIVE_STANDBY_MULTI_AZ"),
 					resource.TestCheckResourceAttr(resourceName, "engine_type", "ActiveMQ"),
@@ -671,28 +683,28 @@ func TestAccMQBroker_AllFields_customVPC(t *testing.T) {
 						"username":       "Test",
 						"password":       "TestTest1234",
 					}),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "mq", regexp.MustCompile(`broker:+.`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "mq", regexache.MustCompile(`broker:+.`)),
 					resource.TestCheckResourceAttr(resourceName, "instances.#", "2"),
 					resource.TestMatchResourceAttr(resourceName, "instances.0.console_url",
-						regexp.MustCompile(`^https://[a-f0-9-]+\.mq.[a-z0-9-]+.amazonaws.com:8162$`)),
+						regexache.MustCompile(`^https://[0-9a-f-]+\.mq.[0-9a-z-]+.amazonaws.com:8162$`)),
 					resource.TestMatchResourceAttr(resourceName, "instances.0.ip_address",
-						regexp.MustCompile(`^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$`)),
+						regexache.MustCompile(`^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$`)),
 					resource.TestCheckResourceAttr(resourceName, "instances.0.endpoints.#", "5"),
-					resource.TestMatchResourceAttr(resourceName, "instances.0.endpoints.0", regexp.MustCompile(`^ssl://[a-z0-9-\.]+:61617$`)),
-					resource.TestMatchResourceAttr(resourceName, "instances.0.endpoints.1", regexp.MustCompile(`^amqp\+ssl://[a-z0-9-\.]+:5671$`)),
-					resource.TestMatchResourceAttr(resourceName, "instances.0.endpoints.2", regexp.MustCompile(`^stomp\+ssl://[a-z0-9-\.]+:61614$`)),
-					resource.TestMatchResourceAttr(resourceName, "instances.0.endpoints.3", regexp.MustCompile(`^mqtt\+ssl://[a-z0-9-\.]+:8883$`)),
-					resource.TestMatchResourceAttr(resourceName, "instances.0.endpoints.4", regexp.MustCompile(`^wss://[a-z0-9-\.]+:61619$`)),
+					resource.TestMatchResourceAttr(resourceName, "instances.0.endpoints.0", regexache.MustCompile(`^ssl://[0-9a-z.-]+:61617$`)),
+					resource.TestMatchResourceAttr(resourceName, "instances.0.endpoints.1", regexache.MustCompile(`^amqp\+ssl://[0-9a-z.-]+:5671$`)),
+					resource.TestMatchResourceAttr(resourceName, "instances.0.endpoints.2", regexache.MustCompile(`^stomp\+ssl://[0-9a-z.-]+:61614$`)),
+					resource.TestMatchResourceAttr(resourceName, "instances.0.endpoints.3", regexache.MustCompile(`^mqtt\+ssl://[0-9a-z.-]+:8883$`)),
+					resource.TestMatchResourceAttr(resourceName, "instances.0.endpoints.4", regexache.MustCompile(`^wss://[0-9a-z.-]+:61619$`)),
 					resource.TestMatchResourceAttr(resourceName, "instances.1.console_url",
-						regexp.MustCompile(`^https://[a-f0-9-]+\.mq.[a-z0-9-]+.amazonaws.com:8162$`)),
+						regexache.MustCompile(`^https://[0-9a-f-]+\.mq.[0-9a-z-]+.amazonaws.com:8162$`)),
 					resource.TestMatchResourceAttr(resourceName, "instances.1.ip_address",
-						regexp.MustCompile(`^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$`)),
+						regexache.MustCompile(`^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$`)),
 					resource.TestCheckResourceAttr(resourceName, "instances.1.endpoints.#", "5"),
-					resource.TestMatchResourceAttr(resourceName, "instances.1.endpoints.0", regexp.MustCompile(`^ssl://[a-z0-9-\.]+:61617$`)),
-					resource.TestMatchResourceAttr(resourceName, "instances.1.endpoints.1", regexp.MustCompile(`^amqp\+ssl://[a-z0-9-\.]+:5671$`)),
-					resource.TestMatchResourceAttr(resourceName, "instances.1.endpoints.2", regexp.MustCompile(`^stomp\+ssl://[a-z0-9-\.]+:61614$`)),
-					resource.TestMatchResourceAttr(resourceName, "instances.1.endpoints.3", regexp.MustCompile(`^mqtt\+ssl://[a-z0-9-\.]+:8883$`)),
-					resource.TestMatchResourceAttr(resourceName, "instances.1.endpoints.4", regexp.MustCompile(`^wss://[a-z0-9-\.]+:61619$`)),
+					resource.TestMatchResourceAttr(resourceName, "instances.1.endpoints.0", regexache.MustCompile(`^ssl://[0-9a-z.-]+:61617$`)),
+					resource.TestMatchResourceAttr(resourceName, "instances.1.endpoints.1", regexache.MustCompile(`^amqp\+ssl://[0-9a-z.-]+:5671$`)),
+					resource.TestMatchResourceAttr(resourceName, "instances.1.endpoints.2", regexache.MustCompile(`^stomp\+ssl://[0-9a-z.-]+:61614$`)),
+					resource.TestMatchResourceAttr(resourceName, "instances.1.endpoints.3", regexache.MustCompile(`^mqtt\+ssl://[0-9a-z.-]+:8883$`)),
+					resource.TestMatchResourceAttr(resourceName, "instances.1.endpoints.4", regexache.MustCompile(`^wss://[0-9a-z.-]+:61619$`)),
 				),
 			},
 			{
@@ -708,7 +720,7 @@ func TestAccMQBroker_AllFields_customVPC(t *testing.T) {
 					testAccCheckBrokerExists(ctx, resourceName, &broker),
 					resource.TestCheckResourceAttr(resourceName, "broker_name", rName),
 					resource.TestCheckResourceAttr(resourceName, "configuration.#", "1"),
-					resource.TestMatchResourceAttr(resourceName, "configuration.0.id", regexp.MustCompile(`^c-[a-z0-9-]+$`)),
+					resource.TestMatchResourceAttr(resourceName, "configuration.0.id", regexache.MustCompile(`^c-[0-9a-z-]+$`)),
 					resource.TestCheckResourceAttr(resourceName, "configuration.0.revision", "3"),
 					resource.TestCheckResourceAttr(resourceName, "maintenance_window_start_time.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "maintenance_window_start_time.0.day_of_week", "TUESDAY"),
@@ -723,7 +735,7 @@ func TestAccMQBroker_AllFields_customVPC(t *testing.T) {
 					testAccCheckBrokerExists(ctx, resourceName, &broker),
 					resource.TestCheckResourceAttr(resourceName, "broker_name", rName),
 					resource.TestCheckResourceAttr(resourceName, "configuration.#", "1"),
-					resource.TestMatchResourceAttr(resourceName, "configuration.0.id", regexp.MustCompile(`^c-[a-z0-9-]+$`)),
+					resource.TestMatchResourceAttr(resourceName, "configuration.0.id", regexache.MustCompile(`^c-[0-9a-z-]+$`)),
 					resource.TestCheckResourceAttr(resourceName, "configuration.0.revision", "2"),
 				),
 			},
@@ -1090,13 +1102,61 @@ func TestAccMQBroker_RabbitMQ_basic(t *testing.T) {
 				Config: testAccBrokerConfig_rabbit(rName, testAccRabbitVersion),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBrokerExists(ctx, resourceName, &broker),
-					resource.TestCheckResourceAttr(resourceName, "configuration.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "configuration.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "engine_type", "RabbitMQ"),
 					resource.TestCheckResourceAttr(resourceName, "engine_version", testAccRabbitVersion),
 					resource.TestCheckResourceAttr(resourceName, "host_instance_type", "mq.t3.micro"),
 					resource.TestCheckResourceAttr(resourceName, "instances.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "instances.0.endpoints.#", "1"),
-					resource.TestMatchResourceAttr(resourceName, "instances.0.endpoints.0", regexp.MustCompile(`^amqps://[a-z0-9-\.]+:5671$`)),
+					resource.TestMatchResourceAttr(resourceName, "instances.0.endpoints.0", regexache.MustCompile(`^amqps://[0-9a-z.-]+:5671$`)),
+					resource.TestCheckResourceAttr(resourceName, "logs.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "logs.0.general", "false"),
+					resource.TestCheckResourceAttr(resourceName, "logs.0.audit", ""),
+				),
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"apply_immediately", "user"},
+			},
+		},
+	})
+}
+
+func TestAccMQBroker_RabbitMQ_config(t *testing.T) {
+	ctx := acctest.Context(t)
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
+	var broker mq.DescribeBrokerResponse
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_mq_broker.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, mq.EndpointsID)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, mq.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckBrokerDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccBrokerConfig_rabbitConfig(rName, testAccRabbitVersion),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckBrokerExists(ctx, resourceName, &broker),
+					resource.TestCheckResourceAttr(resourceName, "configuration.#", "1"),
+					resource.TestMatchResourceAttr(resourceName, "configuration.0.id", regexache.MustCompile(`^c-[0-9a-z-]+$`)),
+					resource.TestCheckResourceAttr(resourceName, "configuration.0.revision", "2"),
+					resource.TestCheckResourceAttr(resourceName, "engine_type", "RabbitMQ"),
+					resource.TestCheckResourceAttr(resourceName, "engine_version", testAccRabbitVersion),
+					resource.TestCheckResourceAttr(resourceName, "host_instance_type", "mq.t3.micro"),
+					resource.TestCheckResourceAttr(resourceName, "instances.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "instances.0.endpoints.#", "1"),
+					resource.TestMatchResourceAttr(resourceName, "instances.0.endpoints.0", regexache.MustCompile(`^amqps://[0-9a-z.-]+:5671$`)),
 					resource.TestCheckResourceAttr(resourceName, "logs.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "logs.0.general", "false"),
 					resource.TestCheckResourceAttr(resourceName, "logs.0.audit", ""),
@@ -1136,13 +1196,13 @@ func TestAccMQBroker_RabbitMQ_logs(t *testing.T) {
 				Config: testAccBrokerConfig_rabbitLogs(rName, testAccRabbitVersion),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBrokerExists(ctx, resourceName, &broker),
-					resource.TestCheckResourceAttr(resourceName, "configuration.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "configuration.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "engine_type", "RabbitMQ"),
 					resource.TestCheckResourceAttr(resourceName, "engine_version", testAccRabbitVersion),
 					resource.TestCheckResourceAttr(resourceName, "host_instance_type", "mq.t3.micro"),
 					resource.TestCheckResourceAttr(resourceName, "instances.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "instances.0.endpoints.#", "1"),
-					resource.TestMatchResourceAttr(resourceName, "instances.0.endpoints.0", regexp.MustCompile(`^amqps://[a-z0-9-\.]+:5671$`)),
+					resource.TestMatchResourceAttr(resourceName, "instances.0.endpoints.0", regexache.MustCompile(`^amqps://[0-9a-z.-]+:5671$`)),
 					resource.TestCheckResourceAttr(resourceName, "logs.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "logs.0.general", "true"),
 					resource.TestCheckResourceAttr(resourceName, "logs.0.audit", ""),
@@ -1180,7 +1240,7 @@ func TestAccMQBroker_RabbitMQ_validationAuditLog(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccBrokerConfig_rabbitAuditLog(rName, testAccRabbitVersion, true),
-				ExpectError: regexp.MustCompile(`logs.audit: Can not be configured when engine is RabbitMQ`),
+				ExpectError: regexache.MustCompile(`logs.audit: Can not be configured when engine is RabbitMQ`),
 			},
 			{
 				// Special case: allow explicitly setting logs.0.audit to false,
@@ -1246,12 +1306,12 @@ func TestAccMQBroker_RabbitMQ_cluster(t *testing.T) {
 						"username":       "Test",
 						"password":       "TestTest1234",
 					}),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "mq", regexp.MustCompile(`broker:+.`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "mq", regexache.MustCompile(`broker:+.`)),
 					resource.TestCheckResourceAttr(resourceName, "instances.#", "1"),
 					resource.TestMatchResourceAttr(resourceName, "instances.0.console_url",
-						regexp.MustCompile(`^https://[a-f0-9-]+\.mq.[a-z0-9-]+.amazonaws.com$`)),
+						regexache.MustCompile(`^https://[0-9a-f-]+\.mq.[0-9a-z-]+.amazonaws.com$`)),
 					resource.TestCheckResourceAttr(resourceName, "instances.0.endpoints.#", "1"),
-					resource.TestMatchResourceAttr(resourceName, "instances.0.endpoints.0", regexp.MustCompile(`^amqps://[a-z0-9-\.]+:5671$`)),
+					resource.TestMatchResourceAttr(resourceName, "instances.0.endpoints.0", regexache.MustCompile(`^amqps://[0-9a-z.-]+:5671$`)),
 				),
 			},
 			{
@@ -1539,7 +1599,7 @@ resource "aws_mq_broker" "test" {
 `, rName, version, cfgName, cfgBody)
 }
 
-func testAccBrokerConfig_allFieldsCustomVPC(rName, version, cfgName, cfgBody, tz string) string {
+func testAccBrokerConfig_baseCustomVPC(rName string) string {
 	return acctest.ConfigCompose(acctest.ConfigVPCWithSubnets(rName, 2), fmt.Sprintf(`
 resource "aws_internet_gateway" "test" {
   vpc_id = aws_vpc.test.id
@@ -1579,7 +1639,11 @@ resource "aws_security_group" "test" {
     Name = %[1]q
   }
 }
+`, rName))
+}
 
+func testAccBrokerConfig_allFieldsCustomVPC(rName, version, cfgName, cfgBody, tz string) string {
+	return acctest.ConfigCompose(testAccBrokerConfig_baseCustomVPC(rName), fmt.Sprintf(`
 resource "aws_mq_configuration" "test" {
   name           = %[3]q
   engine_type    = "ActiveMQ"
@@ -1957,6 +2021,49 @@ resource "aws_mq_broker" "test" {
 `, rName, version)
 }
 
+func testAccBrokerConfig_rabbitConfig(rName, version string) string {
+	return fmt.Sprintf(`
+resource "aws_security_group" "test" {
+  name = %[1]q
+
+  tags = {
+    Name = %[1]q
+  }
+}
+
+resource "aws_mq_configuration" "test" {
+  description    = "TfAccTest MQ Configuration"
+  name           = %[1]q
+  engine_type    = "RabbitMQ"
+  engine_version = %[2]q
+
+  data = <<DATA
+  # Default RabbitMQ delivery acknowledgement timeout is 30 minutes
+  consumer_timeout = 1800000
+  
+  DATA
+}
+
+resource "aws_mq_broker" "test" {
+  broker_name        = %[1]q
+  engine_type        = "RabbitMQ"
+  engine_version     = %[2]q
+  host_instance_type = "mq.t3.micro"
+  security_groups    = [aws_security_group.test.id]
+
+  configuration {
+    id       = aws_mq_configuration.test.id
+    revision = aws_mq_configuration.test.latest_revision
+  }
+
+  user {
+    username = "Test"
+    password = "TestTest1234"
+  }
+}
+`, rName, version)
+}
+
 func testAccBrokerConfig_rabbitLogs(rName, version string) string {
 	return fmt.Sprintf(`
 resource "aws_mq_broker" "test" {
diff --git a/internal/service/mq/configuration.go b/internal/service/mq/configuration.go
index 5e16260f3ed..1ec300d9bff 100644
--- a/internal/service/mq/configuration.go
+++ b/internal/service/mq/configuration.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package mq
 
 import (
diff --git a/internal/service/mq/configuration_test.go b/internal/service/mq/configuration_test.go
index aec69c0a4b8..1d4e8801832 100644
--- a/internal/service/mq/configuration_test.go
+++ b/internal/service/mq/configuration_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package mq_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/mq"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -34,7 +37,7 @@ func TestAccMQConfiguration_basic(t *testing.T) {
 				Config: testAccConfigurationConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckConfigurationExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "mq", regexp.MustCompile(`configuration:+.`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "mq", regexache.MustCompile(`configuration:+.`)),
 					resource.TestCheckResourceAttr(resourceName, "authentication_strategy", "simple"),
 					resource.TestCheckResourceAttr(resourceName, "description", "TfAccTest MQ Configuration"),
 					resource.TestCheckResourceAttr(resourceName, "engine_type", "ActiveMQ"),
@@ -52,7 +55,7 @@ func TestAccMQConfiguration_basic(t *testing.T) {
 				Config: testAccConfigurationConfig_descriptionUpdated(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckConfigurationExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "mq", regexp.MustCompile(`configuration:+.`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "mq", regexache.MustCompile(`configuration:+.`)),
 					resource.TestCheckResourceAttr(resourceName, "description", "TfAccTest MQ Configuration Updated"),
 					resource.TestCheckResourceAttr(resourceName, "engine_type", "ActiveMQ"),
 					resource.TestCheckResourceAttr(resourceName, "engine_version", "5.15.0"),
@@ -64,7 +67,7 @@ func TestAccMQConfiguration_basic(t *testing.T) {
 	})
 }
 
-func TestAccMQConfiguration_withData(t *testing.T) {
+func TestAccMQConfiguration_withActiveMQData(t *testing.T) {
 	ctx := acctest.Context(t)
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_mq_configuration.test"
@@ -80,10 +83,10 @@ func TestAccMQConfiguration_withData(t *testing.T) {
 		CheckDestroy:             acctest.CheckDestroyNoop,
 		Steps: []resource.TestStep{
 			{
-				Config: testAccConfigurationConfig_data(rName),
+				Config: testAccConfigurationConfig_activeData(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckConfigurationExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "mq", regexp.MustCompile(`configuration:+.`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "mq", regexache.MustCompile(`configuration:+.`)),
 					resource.TestCheckResourceAttr(resourceName, "description", "TfAccTest MQ Configuration"),
 					resource.TestCheckResourceAttr(resourceName, "engine_type", "ActiveMQ"),
 					resource.TestCheckResourceAttr(resourceName, "engine_version", "5.15.0"),
@@ -100,7 +103,7 @@ func TestAccMQConfiguration_withData(t *testing.T) {
 	})
 }
 
-func TestAccMQConfiguration_withLdapData(t *testing.T) {
+func TestAccMQConfiguration_withActiveMQLdapData(t *testing.T) {
 	ctx := acctest.Context(t)
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_mq_configuration.test"
@@ -116,10 +119,10 @@ func TestAccMQConfiguration_withLdapData(t *testing.T) {
 		CheckDestroy:             acctest.CheckDestroyNoop,
 		Steps: []resource.TestStep{
 			{
-				Config: testAccConfigurationConfig_ldapData(rName),
+				Config: testAccConfigurationConfig_activeLdapData(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckConfigurationExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "mq", regexp.MustCompile(`configuration:+.`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "mq", regexache.MustCompile(`configuration:+.`)),
 					resource.TestCheckResourceAttr(resourceName, "authentication_strategy", "ldap"),
 					resource.TestCheckResourceAttr(resourceName, "description", "TfAccTest MQ Configuration"),
 					resource.TestCheckResourceAttr(resourceName, "engine_type", "ActiveMQ"),
@@ -137,6 +140,43 @@ func TestAccMQConfiguration_withLdapData(t *testing.T) {
 	})
 }
 
+func TestAccMQConfiguration_withRabbitMQData(t *testing.T) {
+	ctx := acctest.Context(t)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_mq_configuration.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, mq.EndpointsID)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, mq.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             acctest.CheckDestroyNoop,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccConfigurationConfig_rabbitData(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckConfigurationExists(ctx, resourceName),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "mq", regexache.MustCompile(`configuration:+.`)),
+					resource.TestCheckResourceAttr(resourceName, "description", "TfAccTest MQ Configuration"),
+					resource.TestCheckResourceAttr(resourceName, "engine_type", "RabbitMQ"),
+					resource.TestCheckResourceAttr(resourceName, "engine_version", "3.11.16"),
+					resource.TestCheckResourceAttr(resourceName, "latest_revision", "2"),
+					resource.TestCheckResourceAttr(resourceName, "name", rName),
+					resource.TestCheckResourceAttr(resourceName, "data", "consumer_timeout = 60000\n"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
 func TestAccMQConfiguration_tags(t *testing.T) {
 	ctx := acctest.Context(t)
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
@@ -240,7 +280,7 @@ DATA
 `, rName)
 }
 
-func testAccConfigurationConfig_data(rName string) string {
+func testAccConfigurationConfig_activeData(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_mq_configuration" "test" {
   description    = "TfAccTest MQ Configuration"
@@ -275,7 +315,7 @@ DATA
 `, rName)
 }
 
-func testAccConfigurationConfig_ldapData(rName string) string {
+func testAccConfigurationConfig_activeLdapData(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_mq_configuration" "test" {
   description             = "TfAccTest MQ Configuration"
@@ -303,6 +343,21 @@ DATA
 `, rName)
 }
 
+func testAccConfigurationConfig_rabbitData(rName string) string {
+	return fmt.Sprintf(`
+resource "aws_mq_configuration" "test" {
+  description    = "TfAccTest MQ Configuration"
+  name           = %[1]q
+  engine_type    = "RabbitMQ"
+  engine_version = "3.11.16"
+
+  data = <<DATA
+consumer_timeout = 60000
+DATA
+}
+`, rName)
+}
+
 func testAccConfigurationConfig_tags1(rName, tagKey1, tagValue1 string) string {
 	return fmt.Sprintf(`
 resource "aws_mq_configuration" "test" {
diff --git a/internal/service/mq/forge.go b/internal/service/mq/forge.go
index 2d7549ef39f..4b4acf8c2d1 100644
--- a/internal/service/mq/forge.go
+++ b/internal/service/mq/forge.go
@@ -1,8 +1,10 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package mq
 
 import (
-	"regexp"
-
+	"github.com/YakDriver/regexache"
 	"github.com/beevik/etree"
 )
 
@@ -20,7 +22,7 @@ func CanonicalXML(s string) (string, error) {
 		return "", err
 	}
 
-	re := regexp.MustCompile(`\s`)
+	re := regexache.MustCompile(`\s`)
 	results := re.ReplaceAllString(rawString, "")
 	return results, nil
 }
diff --git a/internal/service/mq/forge_test.go b/internal/service/mq/forge_test.go
index 84c735856e4..5c3dae88209 100644
--- a/internal/service/mq/forge_test.go
+++ b/internal/service/mq/forge_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package mq_test
 
 import (
diff --git a/internal/service/mq/generate.go b/internal/service/mq/generate.go
index 272272ceea6..f541c1e7d3f 100644
--- a/internal/service/mq/generate.go
+++ b/internal/service/mq/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/listpages/main.go -ListOps=DescribeBrokerInstanceOptions
 //go:generate go run ../../generate/tags/main.go -ListTags -ListTagsOp=ListTags -ServiceTagsMap -TagOp=CreateTags -UntagOp=DeleteTags -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
diff --git a/internal/service/mq/service_package_gen.go b/internal/service/mq/service_package_gen.go
index fc88051d5b1..65642098572 100644
--- a/internal/service/mq/service_package_gen.go
+++ b/internal/service/mq/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	mq_sdkv1 "github.com/aws/aws-sdk-go/service/mq"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -67,4 +68,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*m
 	return mq_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/mq/sweep.go b/internal/service/mq/sweep.go
index c32ad392d88..58ec60e2682 100644
--- a/internal/service/mq/sweep.go
+++ b/internal/service/mq/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package mq
 
@@ -11,9 +11,10 @@ import (
 	"github.com/aws/aws-sdk-go/service/mq"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_mq_broker", &resource.Sweeper{
 		Name: "aws_mq_broker",
 		F:    sweepBrokers,
@@ -22,7 +23,7 @@ func init() {
 
 func sweepBrokers(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -46,7 +47,7 @@ func sweepBrokers(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping MQ Broker sweep for %s: %s", region, err)
 		return nil
 	}
@@ -55,7 +56,7 @@ func sweepBrokers(region string) error {
 		return fmt.Errorf("error listing MQ Brokers (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping MQ Brokers (%s): %w", region, err)
diff --git a/internal/service/mq/tags_gen.go b/internal/service/mq/tags_gen.go
index c03023adaf2..4e8488c8a32 100644
--- a/internal/service/mq/tags_gen.go
+++ b/internal/service/mq/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/mq"
 	"github.com/aws/aws-sdk-go/service/mq/mqiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -54,7 +56,7 @@ func Tags(tags tftags.KeyValueTags) map[string]*string {
 	return aws.StringMap(tags.Map())
 }
 
-// KeyValueTags creates KeyValueTags from mq service tags.
+// KeyValueTags creates tftags.KeyValueTags from mq service tags.
 func KeyValueTags(ctx context.Context, tags map[string]*string) tftags.KeyValueTags {
 	return tftags.New(ctx, tags)
 }
@@ -85,6 +87,8 @@ func updateTags(ctx context.Context, conn mqiface.MQAPI, identifier string, oldT
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.MQ)
 	if len(removedTags) > 0 {
diff --git a/internal/service/mwaa/environment.go b/internal/service/mwaa/environment.go
index 510d3987e5c..3cfec177356 100644
--- a/internal/service/mwaa/environment.go
+++ b/internal/service/mwaa/environment.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package mwaa
 
 import (
diff --git a/internal/service/mwaa/environment_test.go b/internal/service/mwaa/environment_test.go
index 9ed9d2fbf4c..bfc5980a430 100644
--- a/internal/service/mwaa/environment_test.go
+++ b/internal/service/mwaa/environment_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package mwaa_test
 
 import (
diff --git a/internal/service/mwaa/generate.go b/internal/service/mwaa/generate.go
index a239c0146d8..b0f4ab0d274 100644
--- a/internal/service/mwaa/generate.go
+++ b/internal/service/mwaa/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTagsOp=ListTags -ServiceTagsMap -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/mwaa/service_package_gen.go b/internal/service/mwaa/service_package_gen.go
index c0cc9472d74..7c91da7df51 100644
--- a/internal/service/mwaa/service_package_gen.go
+++ b/internal/service/mwaa/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	mwaa_sdkv1 "github.com/aws/aws-sdk-go/service/mwaa"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -50,4 +51,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*m
 	return mwaa_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/mwaa/sweep.go b/internal/service/mwaa/sweep.go
index 287a014a1ed..eba20f39285 100644
--- a/internal/service/mwaa/sweep.go
+++ b/internal/service/mwaa/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package mwaa
 
@@ -13,9 +13,10 @@ import (
 	"github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_mwaa_environment", &resource.Sweeper{
 		Name: "aws_mwaa_environment",
 		F:    sweepEnvironment,
@@ -24,7 +25,7 @@ func init() {
 
 func sweepEnvironment(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -35,7 +36,7 @@ func sweepEnvironment(region string) error {
 
 	listOutput, err := conn.ListEnvironmentsWithContext(ctx, &mwaa.ListEnvironmentsInput{})
 	if err != nil {
-		if sweep.SkipSweepError(err) || tfawserr.ErrCodeEquals(err, "InternalFailure") {
+		if awsv1.SkipSweepError(err) || tfawserr.ErrCodeEquals(err, "InternalFailure") {
 			log.Printf("[WARN] Skipping MWAA Environment sweep for %s: %s", region, err)
 			return nil
 		}
@@ -50,7 +51,7 @@ func sweepEnvironment(region string) error {
 		sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error sweeping MWAA Environment: %w", err))
 	}
 
diff --git a/internal/service/mwaa/tags_gen.go b/internal/service/mwaa/tags_gen.go
index 50bc4789603..71263e1725e 100644
--- a/internal/service/mwaa/tags_gen.go
+++ b/internal/service/mwaa/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/mwaa"
 	"github.com/aws/aws-sdk-go/service/mwaa/mwaaiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -21,7 +23,7 @@ func Tags(tags tftags.KeyValueTags) map[string]*string {
 	return aws.StringMap(tags.Map())
 }
 
-// KeyValueTags creates KeyValueTags from mwaa service tags.
+// KeyValueTags creates tftags.KeyValueTags from mwaa service tags.
 func KeyValueTags(ctx context.Context, tags map[string]*string) tftags.KeyValueTags {
 	return tftags.New(ctx, tags)
 }
@@ -52,6 +54,8 @@ func updateTags(ctx context.Context, conn mwaaiface.MWAAAPI, identifier string,
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.MWAA)
 	if len(removedTags) > 0 {
diff --git a/internal/service/neptune/cluster.go b/internal/service/neptune/cluster.go
index 5baf080f762..ddd4671375a 100644
--- a/internal/service/neptune/cluster.go
+++ b/internal/service/neptune/cluster.go
@@ -1,24 +1,28 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package neptune
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"strings"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/neptune"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/create"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
 	"github.com/hashicorp/terraform-provider-aws/internal/flex"
+	tfslices "github.com/hashicorp/terraform-provider-aws/internal/slices"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
@@ -29,7 +33,8 @@ const (
 	// A constant for the supported CloudwatchLogsExports types
 	// is not currently available in the AWS sdk-for-go
 	// https://docs.aws.amazon.com/sdk-for-go/api/service/neptune/#pkg-constants
-	cloudWatchLogsExportsAudit = "audit"
+	cloudWatchLogsExportsAudit     = "audit"
+	cloudWatchLogsExportsSlowQuery = "slowquery"
 
 	DefaultPort = 8182
 
@@ -50,6 +55,7 @@ func ResourceCluster() *schema.Resource {
 		Importer: &schema.ResourceImporter{
 			StateContext: schema.ImportStatePassthroughContext,
 		},
+
 		Timeouts: &schema.ResourceTimeout{
 			Create: schema.DefaultTimeout(120 * time.Minute),
 			Update: schema.DefaultTimeout(120 * time.Minute),
@@ -57,15 +63,11 @@ func ResourceCluster() *schema.Resource {
 		},
 
 		Schema: map[string]*schema.Schema{
-			// allow_major_version_upgrade is used to indicate whether upgrades between different major versions
-			// are allowed.
 			"allow_major_version_upgrade": {
 				Type:     schema.TypeBool,
 				Optional: true,
 				Computed: true,
 			},
-			// apply_immediately is used to determine when the update modifications
-			// take place.
 			"apply_immediately": {
 				Type:     schema.TypeBool,
 				Optional: true,
@@ -128,6 +130,7 @@ func ResourceCluster() *schema.Resource {
 					Type: schema.TypeString,
 					ValidateFunc: validation.StringInSlice([]string{
 						cloudWatchLogsExportsAudit,
+						cloudWatchLogsExportsSlowQuery,
 					}, false),
 				},
 			},
@@ -152,14 +155,14 @@ func ResourceCluster() *schema.Resource {
 				Optional: true,
 				ValidateFunc: func(v interface{}, k string) (ws []string, es []error) {
 					value := v.(string)
-					if !regexp.MustCompile(`^[0-9A-Za-z-]+$`).MatchString(value) {
+					if !regexache.MustCompile(`^[0-9A-Za-z-]+$`).MatchString(value) {
 						es = append(es, fmt.Errorf(
 							"only alphanumeric characters and hyphens allowed in %q", k))
 					}
-					if regexp.MustCompile(`--`).MatchString(value) {
+					if regexache.MustCompile(`--`).MatchString(value) {
 						es = append(es, fmt.Errorf("%q cannot contain two consecutive hyphens", k))
 					}
-					if regexp.MustCompile(`-$`).MatchString(value) {
+					if regexache.MustCompile(`-$`).MatchString(value) {
 						es = append(es, fmt.Errorf("%q cannot end in a hyphen", k))
 					}
 					return
@@ -303,6 +306,12 @@ func resourceClusterCreate(ctx context.Context, d *schema.ResourceData, meta int
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).NeptuneConn(ctx)
 
+	clusterID := create.NewNameGenerator(
+		create.WithConfiguredName(d.Get("cluster_identifier").(string)),
+		create.WithConfiguredPrefix(d.Get("cluster_identifier_prefix").(string)),
+		create.WithDefaultPrefix("tf-"),
+	).Generate()
+
 	// Check if any of the parameters that require a cluster modification after creation are set.
 	// See https://docs.aws.amazon.com/neptune/latest/userguide/backup-restore-restore-snapshot.html#backup-restore-restore-snapshot-considerations.
 	clusterUpdate := false
@@ -311,34 +320,26 @@ func resourceClusterCreate(ctx context.Context, d *schema.ResourceData, meta int
 		restoreDBClusterFromSnapshot = true
 	}
 
-	var clusterID string
-	if v, ok := d.GetOk("cluster_identifier"); ok {
-		clusterID = v.(string)
-	} else if v, ok := d.GetOk("cluster_identifier_prefix"); ok {
-		clusterID = id.PrefixedUniqueId(v.(string))
-	} else {
-		clusterID = id.PrefixedUniqueId("tf-")
-	}
 	serverlessConfiguration := expandServerlessConfiguration(d.Get("serverless_v2_scaling_configuration").([]interface{}))
 	inputC := &neptune.CreateDBClusterInput{
-		DBClusterIdentifier:              aws.String(clusterID),
 		CopyTagsToSnapshot:               aws.Bool(d.Get("copy_tags_to_snapshot").(bool)),
+		DBClusterIdentifier:              aws.String(clusterID),
+		DeletionProtection:               aws.Bool(d.Get("deletion_protection").(bool)),
 		Engine:                           aws.String(d.Get("engine").(string)),
 		Port:                             aws.Int64(int64(d.Get("port").(int))),
+		ServerlessV2ScalingConfiguration: serverlessConfiguration,
 		StorageEncrypted:                 aws.Bool(d.Get("storage_encrypted").(bool)),
-		DeletionProtection:               aws.Bool(d.Get("deletion_protection").(bool)),
 		Tags:                             getTagsIn(ctx),
-		ServerlessV2ScalingConfiguration: serverlessConfiguration,
 	}
 	inputR := &neptune.RestoreDBClusterFromSnapshotInput{
-		DBClusterIdentifier:              aws.String(clusterID),
 		CopyTagsToSnapshot:               aws.Bool(d.Get("copy_tags_to_snapshot").(bool)),
+		DBClusterIdentifier:              aws.String(clusterID),
+		DeletionProtection:               aws.Bool(d.Get("deletion_protection").(bool)),
 		Engine:                           aws.String(d.Get("engine").(string)),
 		Port:                             aws.Int64(int64(d.Get("port").(int))),
+		ServerlessV2ScalingConfiguration: serverlessConfiguration,
 		SnapshotIdentifier:               aws.String(d.Get("snapshot_identifier").(string)),
-		DeletionProtection:               aws.Bool(d.Get("deletion_protection").(bool)),
 		Tags:                             getTagsIn(ctx),
-		ServerlessV2ScalingConfiguration: serverlessConfiguration,
 	}
 	inputM := &neptune.ModifyDBClusterInput{
 		ApplyImmediately:    aws.Bool(true),
@@ -393,6 +394,7 @@ func resourceClusterCreate(ctx context.Context, d *schema.ResourceData, meta int
 		v := v.(string)
 
 		inputC.KmsKeyId = aws.String(v)
+		inputR.KmsKeyId = aws.String(v)
 	}
 
 	if v, ok := d.GetOk("neptune_cluster_parameter_group_name"); ok {
@@ -447,7 +449,7 @@ func resourceClusterCreate(ctx context.Context, d *schema.ResourceData, meta int
 		}
 
 		return conn.CreateDBClusterWithContext(ctx, inputC)
-	}, "InvalidParameterValue", "IAM role ARN value is invalid or does not include the required permissions")
+	}, errCodeInvalidParameterValue, "IAM role ARN value is invalid or does not include the required permissions")
 
 	if err != nil {
 		return sdkdiag.AppendErrorf(diags, "creating Neptune Cluster (%s): %s", clusterID, err)
@@ -455,7 +457,7 @@ func resourceClusterCreate(ctx context.Context, d *schema.ResourceData, meta int
 
 	d.SetId(clusterID)
 
-	if _, err = waitClusterAvailable(ctx, conn, d.Id(), d.Timeout(schema.TimeoutCreate)); err != nil {
+	if _, err = waitDBClusterAvailable(ctx, conn, d.Id(), d.Timeout(schema.TimeoutCreate)); err != nil {
 		return sdkdiag.AppendErrorf(diags, "waiting for Neptune Cluster (%s) create: %s", d.Id(), err)
 	}
 
@@ -476,7 +478,7 @@ func resourceClusterCreate(ctx context.Context, d *schema.ResourceData, meta int
 			return sdkdiag.AppendErrorf(diags, "modifying Neptune Cluster (%s): %s", d.Id(), err)
 		}
 
-		if _, err = waitClusterAvailable(ctx, conn, d.Id(), d.Timeout(schema.TimeoutCreate)); err != nil {
+		if _, err = waitDBClusterAvailable(ctx, conn, d.Id(), d.Timeout(schema.TimeoutCreate)); err != nil {
 			return sdkdiag.AppendErrorf(diags, "waiting for Neptune Cluster (%s) update: %s", d.Id(), err)
 		}
 	}
@@ -488,7 +490,7 @@ func resourceClusterRead(ctx context.Context, d *schema.ResourceData, meta inter
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).NeptuneConn(ctx)
 
-	dbc, err := FindClusterByID(ctx, conn, d.Id())
+	dbc, err := FindDBClusterByID(ctx, conn, d.Id())
 
 	if !d.IsNewResource() && tfresource.NotFound(err) {
 		log.Printf("[WARN] Neptune Cluster (%s) not found, removing from state", d.Id())
@@ -502,7 +504,7 @@ func resourceClusterRead(ctx context.Context, d *schema.ResourceData, meta inter
 
 	// Ignore the following API error for regions/partitions that do not support Neptune Global Clusters:
 	// InvalidParameterValue: Access Denied to API Version: APIGlobalDatabases
-	if globalCluster, err := findGlobalClusterByClusterARN(ctx, conn, aws.StringValue(dbc.DBClusterArn)); tfresource.NotFound(err) || tfawserr.ErrMessageContains(err, "InvalidParameterValue", "Access Denied to API Version: APIGlobalDatabases") {
+	if globalCluster, err := findGlobalClusterByClusterARN(ctx, conn, aws.StringValue(dbc.DBClusterArn)); tfresource.NotFound(err) || tfawserr.ErrMessageContains(err, errCodeInvalidParameterValue, "Access Denied to API Version: APIGlobalDatabases") {
 		d.Set("global_cluster_identifier", "")
 	} else if err != nil {
 		return sdkdiag.AppendErrorf(diags, "reading Neptune Global Cluster information for Neptune Cluster (%s): %s", d.Id(), err)
@@ -515,6 +517,7 @@ func resourceClusterRead(ctx context.Context, d *schema.ResourceData, meta inter
 	d.Set("availability_zones", aws.StringValueSlice(dbc.AvailabilityZones))
 	d.Set("backup_retention_period", dbc.BackupRetentionPeriod)
 	d.Set("cluster_identifier", dbc.DBClusterIdentifier)
+	d.Set("cluster_identifier_prefix", create.NamePrefixFromName(aws.StringValue(dbc.DBClusterIdentifier)))
 	var clusterMembers []string
 	for _, v := range dbc.DBClusterMembers {
 		clusterMembers = append(clusterMembers, aws.StringValue(v.DBInstanceIdentifier))
@@ -559,7 +562,7 @@ func resourceClusterUpdate(ctx context.Context, d *schema.ResourceData, meta int
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).NeptuneConn(ctx)
 
-	if d.HasChangesExcept("tags", "tags_all", "iam_roles", "global_cluster_identifier") {
+	if d.HasChangesExcept("tags", "tags_all", "global_cluster_identifier", "iam_roles", "skip_final_snapshot") {
 		allowMajorVersionUpgrade := d.Get("allow_major_version_upgrade").(bool)
 		input := &neptune.ModifyDBClusterInput{
 			AllowMajorVersionUpgrade: aws.Bool(allowMajorVersionUpgrade),
@@ -644,7 +647,7 @@ func resourceClusterUpdate(ctx context.Context, d *schema.ResourceData, meta int
 				return conn.ModifyDBClusterWithContext(ctx, input)
 			},
 			func(err error) (bool, error) {
-				if tfawserr.ErrMessageContains(err, "InvalidParameterValue", "IAM role ARN value is invalid or does not include the required permissions") {
+				if tfawserr.ErrMessageContains(err, errCodeInvalidParameterValue, "IAM role ARN value is invalid or does not include the required permissions") {
 					return true, err
 				}
 
@@ -660,7 +663,7 @@ func resourceClusterUpdate(ctx context.Context, d *schema.ResourceData, meta int
 			return sdkdiag.AppendErrorf(diags, "modifying Neptune Cluster (%s): %s", d.Id(), err)
 		}
 
-		if _, err = waitClusterAvailable(ctx, conn, d.Id(), d.Timeout(schema.TimeoutUpdate)); err != nil {
+		if _, err = waitDBClusterAvailable(ctx, conn, d.Id(), d.Timeout(schema.TimeoutUpdate)); err != nil {
 			return sdkdiag.AppendErrorf(diags, "waiting for Neptune Cluster (%s) update: %s", d.Id(), err)
 		}
 	}
@@ -754,7 +757,7 @@ func resourceClusterDelete(ctx context.Context, d *schema.ResourceData, meta int
 		return sdkdiag.AppendErrorf(diags, "deleting Neptune Cluster (%s): %s", d.Id(), err)
 	}
 
-	if _, err := waitClusterDeleted(ctx, conn, d.Id(), d.Timeout(schema.TimeoutDelete)); err != nil {
+	if _, err := waitDBClusterDeleted(ctx, conn, d.Id(), d.Timeout(schema.TimeoutDelete)); err != nil {
 		return sdkdiag.AppendErrorf(diags, "waiting for Neptune Cluster (%s) delete: %s", d.Id(), err)
 	}
 
@@ -787,7 +790,7 @@ func removeClusterFromGlobalCluster(ctx context.Context, conn *neptune.Neptune,
 
 	_, err := conn.RemoveFromGlobalClusterWithContext(ctx, input)
 
-	if tfawserr.ErrCodeEquals(err, neptune.ErrCodeDBClusterNotFoundFault, neptune.ErrCodeGlobalClusterNotFoundFault) || tfawserr.ErrMessageContains(err, "InvalidParameterValue", "is not found in global cluster") {
+	if tfawserr.ErrCodeEquals(err, neptune.ErrCodeDBClusterNotFoundFault, neptune.ErrCodeGlobalClusterNotFoundFault) || tfawserr.ErrMessageContains(err, errCodeInvalidParameterValue, "is not found in global cluster") {
 		return nil
 	}
 
@@ -806,43 +809,46 @@ func removeClusterFromGlobalCluster(ctx context.Context, conn *neptune.Neptune,
 	return nil
 }
 
-func FindClusterByID(ctx context.Context, conn *neptune.Neptune, id string) (*neptune.DBCluster, error) {
+func FindDBClusterByID(ctx context.Context, conn *neptune.Neptune, id string) (*neptune.DBCluster, error) {
 	input := &neptune.DescribeDBClustersInput{
 		DBClusterIdentifier: aws.String(id),
 	}
-
-	output, err := conn.DescribeDBClustersWithContext(ctx, input)
-
-	if tfawserr.ErrCodeEquals(err, neptune.ErrCodeDBClusterNotFoundFault) {
-		return nil, &retry.NotFoundError{
-			LastError:   err,
-			LastRequest: input,
-		}
-	}
+	output, err := findDBCluster(ctx, conn, input, tfslices.PredicateTrue[*neptune.DBCluster]())
 
 	if err != nil {
 		return nil, err
 	}
 
-	if output == nil || len(output.DBClusters) == 0 || output.DBClusters[0] == nil {
-		return nil, tfresource.NewEmptyResultError(input)
-	}
-
-	dbCluster := output.DBClusters[0]
-
 	// Eventual consistency check.
-	if aws.StringValue(dbCluster.DBClusterIdentifier) != id {
+	if aws.StringValue(output.DBClusterIdentifier) != id {
 		return nil, &retry.NotFoundError{
 			LastRequest: input,
 		}
 	}
 
-	return dbCluster, nil
+	return output, nil
 }
 
 func findClusterByARN(ctx context.Context, conn *neptune.Neptune, arn string) (*neptune.DBCluster, error) {
 	input := &neptune.DescribeDBClustersInput{}
-	var output *neptune.DBCluster
+
+	return findDBCluster(ctx, conn, input, func(v *neptune.DBCluster) bool {
+		return aws.StringValue(v.DBClusterArn) == arn
+	})
+}
+
+func findDBCluster(ctx context.Context, conn *neptune.Neptune, input *neptune.DescribeDBClustersInput, filter tfslices.Predicate[*neptune.DBCluster]) (*neptune.DBCluster, error) {
+	output, err := findDBClusters(ctx, conn, input, filter)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return tfresource.AssertSinglePtrResult(output)
+}
+
+func findDBClusters(ctx context.Context, conn *neptune.Neptune, input *neptune.DescribeDBClustersInput, filter tfslices.Predicate[*neptune.DBCluster]) ([]*neptune.DBCluster, error) {
+	var output []*neptune.DBCluster
 
 	err := conn.DescribeDBClustersPagesWithContext(ctx, input, func(page *neptune.DescribeDBClustersOutput, lastPage bool) bool {
 		if page == nil {
@@ -850,34 +856,31 @@ func findClusterByARN(ctx context.Context, conn *neptune.Neptune, arn string) (*
 		}
 
 		for _, v := range page.DBClusters {
-			if v == nil {
-				continue
-			}
-
-			if aws.StringValue(v.DBClusterArn) == arn {
-				output = v
-
-				return false
+			if v != nil && filter(v) {
+				output = append(output, v)
 			}
 		}
 
 		return !lastPage
 	})
 
-	if err != nil {
-		return nil, err
+	if tfawserr.ErrCodeEquals(err, neptune.ErrCodeDBClusterNotFoundFault) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
 	}
 
-	if output == nil {
-		return nil, &retry.NotFoundError{}
+	if err != nil {
+		return nil, err
 	}
 
 	return output, nil
 }
 
-func statusCluster(ctx context.Context, conn *neptune.Neptune, id string) retry.StateRefreshFunc {
+func statusDBCluster(ctx context.Context, conn *neptune.Neptune, id string) retry.StateRefreshFunc {
 	return func() (interface{}, string, error) {
-		output, err := FindClusterByID(ctx, conn, id)
+		output, err := FindDBClusterByID(ctx, conn, id)
 
 		if tfresource.NotFound(err) {
 			return nil, "", nil
@@ -891,7 +894,7 @@ func statusCluster(ctx context.Context, conn *neptune.Neptune, id string) retry.
 	}
 }
 
-func waitClusterAvailable(ctx context.Context, conn *neptune.Neptune, id string, timeout time.Duration) (*neptune.DBCluster, error) { //nolint:unparam
+func waitDBClusterAvailable(ctx context.Context, conn *neptune.Neptune, id string, timeout time.Duration) (*neptune.DBCluster, error) { //nolint:unparam
 	stateConf := &retry.StateChangeConf{
 		Pending: []string{
 			"creating",
@@ -903,7 +906,7 @@ func waitClusterAvailable(ctx context.Context, conn *neptune.Neptune, id string,
 			"upgrading",
 		},
 		Target:     []string{"available"},
-		Refresh:    statusCluster(ctx, conn, id),
+		Refresh:    statusDBCluster(ctx, conn, id),
 		Timeout:    timeout,
 		MinTimeout: 10 * time.Second,
 		Delay:      30 * time.Second,
@@ -918,7 +921,7 @@ func waitClusterAvailable(ctx context.Context, conn *neptune.Neptune, id string,
 	return nil, err
 }
 
-func waitClusterDeleted(ctx context.Context, conn *neptune.Neptune, id string, timeout time.Duration) (*neptune.DBCluster, error) {
+func waitDBClusterDeleted(ctx context.Context, conn *neptune.Neptune, id string, timeout time.Duration) (*neptune.DBCluster, error) {
 	stateConf := &retry.StateChangeConf{
 		Pending: []string{
 			"available",
@@ -927,7 +930,7 @@ func waitClusterDeleted(ctx context.Context, conn *neptune.Neptune, id string, t
 			"modifying",
 		},
 		Target:     []string{},
-		Refresh:    statusCluster(ctx, conn, id),
+		Refresh:    statusDBCluster(ctx, conn, id),
 		Timeout:    timeout,
 		MinTimeout: 10 * time.Second,
 		Delay:      30 * time.Second,
diff --git a/internal/service/neptune/cluster_endpoint.go b/internal/service/neptune/cluster_endpoint.go
index 342ae2f5efc..d4780b44fc9 100644
--- a/internal/service/neptune/cluster_endpoint.go
+++ b/internal/service/neptune/cluster_endpoint.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package neptune
 
 import (
diff --git a/internal/service/neptune/cluster_endpoint_test.go b/internal/service/neptune/cluster_endpoint_test.go
index d43b754006d..8212e545251 100644
--- a/internal/service/neptune/cluster_endpoint_test.go
+++ b/internal/service/neptune/cluster_endpoint_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package neptune_test
 
 import (
 	//"errors"
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/neptune"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
@@ -34,7 +37,7 @@ func TestAccNeptuneClusterEndpoint_basic(t *testing.T) {
 				Config: testAccClusterEndpointConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckClusterEndpointExists(ctx, resourceName, &dbCluster),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "rds", regexp.MustCompile(`cluster-endpoint:.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "rds", regexache.MustCompile(`cluster-endpoint:.+`)),
 					resource.TestCheckResourceAttr(resourceName, "endpoint_type", "READER"),
 					resource.TestCheckResourceAttr(resourceName, "cluster_endpoint_identifier", rName),
 					resource.TestCheckResourceAttrPair(resourceName, "cluster_identifier", "aws_neptune_cluster.test", "cluster_identifier"),
@@ -218,7 +221,7 @@ resource "aws_neptune_cluster" "test" {
   cluster_identifier                   = %[1]q
   availability_zones                   = local.availability_zone_names
   engine                               = "neptune"
-  neptune_cluster_parameter_group_name = "default.neptune1"
+  neptune_cluster_parameter_group_name = "default.neptune1.2"
   skip_final_snapshot                  = true
 }
 `, rName))
diff --git a/internal/service/neptune/cluster_instance.go b/internal/service/neptune/cluster_instance.go
index 9977f86a751..982d27fe336 100644
--- a/internal/service/neptune/cluster_instance.go
+++ b/internal/service/neptune/cluster_instance.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package neptune
 
 import (
@@ -11,11 +14,12 @@ import (
 	"github.com/aws/aws-sdk-go/service/neptune"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/create"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
+	tfslices "github.com/hashicorp/terraform-provider-aws/internal/slices"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
@@ -90,7 +94,6 @@ func ResourceClusterInstance() *schema.Resource {
 				Type:     schema.TypeString,
 				Optional: true,
 				Computed: true,
-				ForceNew: true,
 			},
 			"identifier": {
 				Type:          schema.TypeString,
@@ -182,15 +185,11 @@ func resourceClusterInstanceCreate(ctx context.Context, d *schema.ResourceData,
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).NeptuneConn(ctx)
 
-	var instanceID string
-	if v, ok := d.GetOk("identifier"); ok {
-		instanceID = v.(string)
-	} else if v, ok := d.GetOk("identifier_prefix"); ok {
-		instanceID = id.PrefixedUniqueId(v.(string))
-	} else {
-		instanceID = id.PrefixedUniqueId("tf-")
-	}
-
+	instanceID := create.NewNameGenerator(
+		create.WithConfiguredName(d.Get("identifier").(string)),
+		create.WithConfiguredPrefix(d.Get("identifier_prefix").(string)),
+		create.WithDefaultPrefix("tf-"),
+	).Generate()
 	input := &neptune.CreateDBInstanceInput{
 		AutoMinorVersionUpgrade: aws.Bool(d.Get("auto_minor_version_upgrade").(bool)),
 		DBClusterIdentifier:     aws.String(d.Get("cluster_identifier").(string)),
@@ -228,7 +227,7 @@ func resourceClusterInstanceCreate(ctx context.Context, d *schema.ResourceData,
 
 	outputRaw, err := tfresource.RetryWhenAWSErrMessageContains(ctx, propagationTimeout, func() (interface{}, error) {
 		return conn.CreateDBInstanceWithContext(ctx, input)
-	}, "InvalidParameterValue", "IAM role ARN value is invalid or does not include the required permissions")
+	}, errCodeInvalidParameterValue, "IAM role ARN value is invalid or does not include the required permissions")
 
 	if err != nil {
 		return sdkdiag.AppendErrorf(diags, "creating Neptune Cluster Instance (%s): %s", instanceID, err)
@@ -236,7 +235,7 @@ func resourceClusterInstanceCreate(ctx context.Context, d *schema.ResourceData,
 
 	d.SetId(aws.StringValue(outputRaw.(*neptune.CreateDBInstanceOutput).DBInstance.DBInstanceIdentifier))
 
-	if _, err := waitClusterInstanceAvailable(ctx, conn, d.Id(), d.Timeout(schema.TimeoutCreate)); err != nil {
+	if _, err := waitDBInstanceAvailable(ctx, conn, d.Id(), d.Timeout(schema.TimeoutCreate)); err != nil {
 		return sdkdiag.AppendErrorf(diags, "waiting for Neptune Cluster Instance (%s) create: %s", d.Id(), err)
 	}
 
@@ -247,7 +246,7 @@ func resourceClusterInstanceRead(ctx context.Context, d *schema.ResourceData, me
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).NeptuneConn(ctx)
 
-	db, err := FindClusterInstanceByID(ctx, conn, d.Id())
+	db, err := FindDBInstanceByID(ctx, conn, d.Id())
 
 	if !d.IsNewResource() && tfresource.NotFound(err) {
 		log.Printf("[WARN] Neptune Cluster Instance (%s) not found, removing from state", d.Id())
@@ -268,6 +267,7 @@ func resourceClusterInstanceRead(ctx context.Context, d *schema.ResourceData, me
 	d.Set("engine_version", db.EngineVersion)
 	d.Set("engine", db.Engine)
 	d.Set("identifier", db.DBInstanceIdentifier)
+	d.Set("identifier_prefix", create.NamePrefixFromName(aws.StringValue(db.DBInstanceIdentifier)))
 	d.Set("instance_class", db.DBInstanceClass)
 	d.Set("kms_key_arn", db.KmsKeyId)
 	if len(db.DBParameterGroups) > 0 {
@@ -291,7 +291,7 @@ func resourceClusterInstanceRead(ctx context.Context, d *schema.ResourceData, me
 		d.Set("port", port)
 	}
 
-	m, err := FindClusterMemberByInstanceByTwoPartKey(ctx, conn, clusterID, d.Id())
+	m, err := findClusterMemberByInstanceByTwoPartKey(ctx, conn, clusterID, d.Id())
 
 	if err != nil {
 		return sdkdiag.AppendErrorf(diags, "reading Neptune Cluster (%s) member (%s): %s", clusterID, d.Id(), err)
@@ -338,13 +338,13 @@ func resourceClusterInstanceUpdate(ctx context.Context, d *schema.ResourceData,
 
 		_, err := tfresource.RetryWhenAWSErrMessageContains(ctx, propagationTimeout, func() (interface{}, error) {
 			return conn.ModifyDBInstanceWithContext(ctx, input)
-		}, "InvalidParameterValue", "IAM role ARN value is invalid or does not include the required permissions")
+		}, errCodeInvalidParameterValue, "IAM role ARN value is invalid or does not include the required permissions")
 
 		if err != nil {
 			return sdkdiag.AppendErrorf(diags, "modifying Neptune Cluster Instance (%s): %s", d.Id(), err)
 		}
 
-		if _, err := waitClusterInstanceAvailable(ctx, conn, d.Id(), d.Timeout(schema.TimeoutUpdate)); err != nil {
+		if _, err := waitDBInstanceAvailable(ctx, conn, d.Id(), d.Timeout(schema.TimeoutUpdate)); err != nil {
 			return sdkdiag.AppendErrorf(diags, "waiting for Neptune Cluster Instance (%s) update: %s", d.Id(), err)
 		}
 	}
@@ -369,70 +369,89 @@ func resourceClusterInstanceDelete(ctx context.Context, d *schema.ResourceData,
 		return sdkdiag.AppendErrorf(diags, "deleting Neptune Cluster Instance (%s): %s", d.Id(), err)
 	}
 
-	if _, err := waitClusterInstanceDeleted(ctx, conn, d.Id(), d.Timeout(schema.TimeoutDelete)); err != nil {
+	if _, err := waitDBInstanceDeleted(ctx, conn, d.Id(), d.Timeout(schema.TimeoutDelete)); err != nil {
 		return sdkdiag.AppendErrorf(diags, "waiting for Neptune Cluster Instance (%s) delete: %s", d.Id(), err)
 	}
 
 	return nil
 }
 
-func FindClusterInstanceByID(ctx context.Context, conn *neptune.Neptune, id string) (*neptune.DBInstance, error) {
+func FindDBInstanceByID(ctx context.Context, conn *neptune.Neptune, id string) (*neptune.DBInstance, error) {
 	input := &neptune.DescribeDBInstancesInput{
 		DBInstanceIdentifier: aws.String(id),
 	}
+	output, err := findDBInstance(ctx, conn, input)
 
-	output, err := conn.DescribeDBInstancesWithContext(ctx, input)
+	if err != nil {
+		return nil, err
+	}
 
-	if tfawserr.ErrCodeEquals(err, neptune.ErrCodeDBInstanceNotFoundFault) {
+	// Eventual consistency check.
+	if aws.StringValue(output.DBInstanceIdentifier) != id {
 		return nil, &retry.NotFoundError{
-			LastError:   err,
 			LastRequest: input,
 		}
 	}
 
+	return output, nil
+}
+
+func findDBInstance(ctx context.Context, conn *neptune.Neptune, input *neptune.DescribeDBInstancesInput) (*neptune.DBInstance, error) {
+	output, err := findDBInstances(ctx, conn, input)
+
 	if err != nil {
 		return nil, err
 	}
 
-	if output == nil || len(output.DBInstances) == 0 || output.DBInstances[0] == nil {
-		return nil, tfresource.NewEmptyResultError(input)
-	}
+	return tfresource.AssertSinglePtrResult(output)
+}
 
-	dbInstance := output.DBInstances[0]
+func findDBInstances(ctx context.Context, conn *neptune.Neptune, input *neptune.DescribeDBInstancesInput) ([]*neptune.DBInstance, error) {
+	var output []*neptune.DBInstance
 
-	// Eventual consistency check.
-	if aws.StringValue(dbInstance.DBInstanceIdentifier) != id {
+	err := conn.DescribeDBInstancesPagesWithContext(ctx, input, func(page *neptune.DescribeDBInstancesOutput, lastPage bool) bool {
+		if page == nil {
+			return !lastPage
+		}
+
+		for _, v := range page.DBInstances {
+			if v != nil {
+				output = append(output, v)
+			}
+		}
+
+		return !lastPage
+	})
+
+	if tfawserr.ErrCodeEquals(err, neptune.ErrCodeDBInstanceNotFoundFault) {
 		return nil, &retry.NotFoundError{
+			LastError:   err,
 			LastRequest: input,
 		}
 	}
 
-	return dbInstance, nil
-}
-
-func FindClusterMemberByInstanceByTwoPartKey(ctx context.Context, conn *neptune.Neptune, clusterID, instanceID string) (*neptune.DBClusterMember, error) {
-	dbc, err := FindClusterByID(ctx, conn, clusterID)
-
 	if err != nil {
 		return nil, err
 	}
 
-	for _, v := range dbc.DBClusterMembers {
-		if v == nil {
-			continue
-		}
+	return output, nil
+}
 
-		if aws.StringValue(v.DBInstanceIdentifier) == instanceID {
-			return v, nil
-		}
+func findClusterMemberByInstanceByTwoPartKey(ctx context.Context, conn *neptune.Neptune, clusterID, instanceID string) (*neptune.DBClusterMember, error) {
+	output, err := FindDBClusterByID(ctx, conn, clusterID)
+
+	if err != nil {
+		return nil, err
 	}
 
-	return nil, &retry.NotFoundError{}
+	return tfresource.AssertSinglePtrResult(tfslices.Filter(output.DBClusterMembers, func(v *neptune.DBClusterMember) bool {
+		return aws.StringValue(v.DBInstanceIdentifier) == instanceID
+	}))
 }
 
-func statusClusterInstance(ctx context.Context, conn *neptune.Neptune, id string) retry.StateRefreshFunc {
+func statusDBInstance(ctx context.Context, conn *neptune.Neptune, id string) retry.StateRefreshFunc {
 	return func() (interface{}, string, error) {
-		output, err := FindClusterInstanceByID(ctx, conn, id)
+		output, err := FindDBInstanceByID(ctx, conn, id)
 
 		if tfresource.NotFound(err) {
 			return nil, "", nil
@@ -446,7 +465,7 @@ func statusClusterInstance(ctx context.Context, conn *neptune.Neptune, id string
 	}
 }
 
-func waitClusterInstanceAvailable(ctx context.Context, conn *neptune.Neptune, id string, timeout time.Duration) (*neptune.DBInstance, error) { //nolint:unparam
+func waitDBInstanceAvailable(ctx context.Context, conn *neptune.Neptune, id string, timeout time.Duration) (*neptune.DBInstance, error) { //nolint:unparam
 	stateConf := &retry.StateChangeConf{
 		Pending: []string{
 			"backing-up",
@@ -464,7 +483,7 @@ func waitClusterInstanceAvailable(ctx context.Context, conn *neptune.Neptune, id
 			"upgrading",
 		},
 		Target:     []string{"available"},
-		Refresh:    statusClusterInstance(ctx, conn, id),
+		Refresh:    statusDBInstance(ctx, conn, id),
 		Timeout:    timeout,
 		MinTimeout: 10 * time.Second,
 		Delay:      30 * time.Second,
@@ -479,14 +498,14 @@ func waitClusterInstanceAvailable(ctx context.Context, conn *neptune.Neptune, id
 	return nil, err
 }
 
-func waitClusterInstanceDeleted(ctx context.Context, conn *neptune.Neptune, id string, timeout time.Duration) (*neptune.DBInstance, error) {
+func waitDBInstanceDeleted(ctx context.Context, conn *neptune.Neptune, id string, timeout time.Duration) (*neptune.DBInstance, error) {
 	stateConf := &retry.StateChangeConf{
 		Pending: []string{
 			"modifying",
 			"deleting",
 		},
 		Target:     []string{},
-		Refresh:    statusClusterInstance(ctx, conn, id),
+		Refresh:    statusDBInstance(ctx, conn, id),
 		Timeout:    timeout,
 		MinTimeout: 10 * time.Second,
 		Delay:      30 * time.Second,
diff --git a/internal/service/neptune/cluster_instance_test.go b/internal/service/neptune/cluster_instance_test.go
index bb04504d621..b81e71cfa29 100644
--- a/internal/service/neptune/cluster_instance_test.go
+++ b/internal/service/neptune/cluster_instance_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package neptune_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"strconv"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/neptune"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -38,13 +41,14 @@ func TestAccNeptuneClusterInstance_basic(t *testing.T) {
 					resource.TestCheckResourceAttrSet(resourceName, "address"),
 					acctest.CheckResourceAttrRegionalARN(resourceName, "arn", "rds", fmt.Sprintf("db:%s", rName)),
 					resource.TestCheckResourceAttr(resourceName, "auto_minor_version_upgrade", "true"),
-					resource.TestMatchResourceAttr(resourceName, "availability_zone", regexp.MustCompile(fmt.Sprintf("^%s[a-z]{1}$", acctest.Region()))),
+					resource.TestMatchResourceAttr(resourceName, "availability_zone", regexache.MustCompile(fmt.Sprintf("^%s[a-z]{1}$", acctest.Region()))),
 					resource.TestCheckResourceAttrPair(resourceName, "cluster_identifier", clusterResourceName, "id"),
 					resource.TestCheckResourceAttrSet(resourceName, "dbi_resource_id"),
 					resource.TestCheckResourceAttrSet(resourceName, "address"),
 					resource.TestCheckResourceAttr(resourceName, "engine", "neptune"),
 					resource.TestCheckResourceAttrSet(resourceName, "engine_version"),
 					resource.TestCheckResourceAttr(resourceName, "identifier", rName),
+					resource.TestCheckResourceAttr(resourceName, "identifier_prefix", ""),
 					resource.TestCheckResourceAttrPair(resourceName, "instance_class", "data.aws_neptune_orderable_db_instance.test", "instance_class"),
 					resource.TestCheckResourceAttr(resourceName, "kms_key_arn", ""),
 					resource.TestCheckResourceAttrPair(resourceName, "neptune_parameter_group_name", parameterGroupResourceName, "name"),
@@ -99,7 +103,7 @@ func TestAccNeptuneClusterInstance_disappears(t *testing.T) {
 	})
 }
 
-func TestAccNeptuneClusterInstance_nameGenerated(t *testing.T) {
+func TestAccNeptuneClusterInstance_identifierGenerated(t *testing.T) {
 	ctx := acctest.Context(t)
 	var v neptune.DBInstance
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
@@ -112,10 +116,11 @@ func TestAccNeptuneClusterInstance_nameGenerated(t *testing.T) {
 		CheckDestroy:             testAccCheckClusterInstanceDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccClusterInstanceConfig_nameGenerated(rName),
+				Config: testAccClusterInstanceConfig_identifierGenerated(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckClusterInstanceExists(ctx, resourceName, &v),
-					resource.TestMatchResourceAttr(resourceName, "identifier", regexp.MustCompile("^tf-")),
+					acctest.CheckResourceAttrNameGeneratedWithPrefix(resourceName, "identifier", "tf-"),
+					resource.TestCheckResourceAttr(resourceName, "identifier_prefix", "tf-"),
 				),
 			},
 			{
@@ -127,7 +132,7 @@ func TestAccNeptuneClusterInstance_nameGenerated(t *testing.T) {
 	})
 }
 
-func TestAccNeptuneClusterInstance_namePrefix(t *testing.T) {
+func TestAccNeptuneClusterInstance_identifierPrefix(t *testing.T) {
 	ctx := acctest.Context(t)
 	var v neptune.DBInstance
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
@@ -140,7 +145,7 @@ func TestAccNeptuneClusterInstance_namePrefix(t *testing.T) {
 		CheckDestroy:             testAccCheckClusterInstanceDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccClusterInstanceConfig_namePrefix(rName, "tf-acc-test-prefix-"),
+				Config: testAccClusterInstanceConfig_identifierPrefix(rName, "tf-acc-test-prefix-"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckClusterInstanceExists(ctx, resourceName, &v),
 					acctest.CheckResourceAttrNameFromPrefix(resourceName, "identifier", "tf-acc-test-prefix-"),
@@ -151,9 +156,6 @@ func TestAccNeptuneClusterInstance_namePrefix(t *testing.T) {
 				ResourceName:      resourceName,
 				ImportState:       true,
 				ImportStateVerify: true,
-				ImportStateVerifyIgnore: []string{
-					"identifier_prefix",
-				},
 			},
 		},
 	})
@@ -300,7 +302,7 @@ func testAccCheckClusterInstanceExists(ctx context.Context, n string, v *neptune
 
 		conn := acctest.Provider.Meta().(*conns.AWSClient).NeptuneConn(ctx)
 
-		output, err := tfneptune.FindClusterInstanceByID(ctx, conn, rs.Primary.ID)
+		output, err := tfneptune.FindDBInstanceByID(ctx, conn, rs.Primary.ID)
 
 		if err != nil {
 			return err
@@ -321,7 +323,7 @@ func testAccCheckClusterInstanceDestroy(ctx context.Context) resource.TestCheckF
 				continue
 			}
 
-			_, err := tfneptune.FindClusterInstanceByID(ctx, conn, rs.Primary.ID)
+			_, err := tfneptune.FindDBInstanceByID(ctx, conn, rs.Primary.ID)
 
 			if tfresource.NotFound(err) {
 				continue
@@ -399,7 +401,7 @@ resource "aws_neptune_cluster_instance" "cluster_instances" {
 `, rName))
 }
 
-func testAccClusterInstanceConfig_nameGenerated(rName string) string {
+func testAccClusterInstanceConfig_identifierGenerated(rName string) string {
 	return acctest.ConfigCompose(testAccClusterInstanceConfig_base(rName), `
 resource "aws_neptune_cluster_instance" "test" {
   cluster_identifier = aws_neptune_cluster.test.id
@@ -411,7 +413,7 @@ resource "aws_neptune_cluster_instance" "test" {
 `)
 }
 
-func testAccClusterInstanceConfig_namePrefix(rName, prefix string) string {
+func testAccClusterInstanceConfig_identifierPrefix(rName, prefix string) string {
 	return acctest.ConfigCompose(testAccClusterInstanceConfig_base(rName), fmt.Sprintf(`
 resource "aws_neptune_cluster_instance" "test" {
   identifier_prefix  = %[1]q
diff --git a/internal/service/neptune/cluster_parameter_group.go b/internal/service/neptune/cluster_parameter_group.go
index fb9b4f90cc5..7a4f6d707be 100644
--- a/internal/service/neptune/cluster_parameter_group.go
+++ b/internal/service/neptune/cluster_parameter_group.go
@@ -1,19 +1,26 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package neptune
 
 import (
 	"context"
+	"fmt"
 	"log"
 
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/neptune"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/create"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
+	tfslices "github.com/hashicorp/terraform-provider-aws/internal/slices"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -28,6 +35,7 @@ func ResourceClusterParameterGroup() *schema.Resource {
 		ReadWithoutTimeout:   resourceClusterParameterGroupRead,
 		UpdateWithoutTimeout: resourceClusterParameterGroupUpdate,
 		DeleteWithoutTimeout: resourceClusterParameterGroupDelete,
+
 		Importer: &schema.ResourceImporter{
 			StateContext: schema.ImportStatePassthroughContext,
 		},
@@ -37,6 +45,17 @@ func ResourceClusterParameterGroup() *schema.Resource {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
+			"description": {
+				Type:     schema.TypeString,
+				Optional: true,
+				ForceNew: true,
+				Default:  "Managed by Terraform",
+			},
+			"family": {
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
 			"name": {
 				Type:          schema.TypeString,
 				Optional:      true,
@@ -53,22 +72,17 @@ func ResourceClusterParameterGroup() *schema.Resource {
 				ConflictsWith: []string{"name"},
 				ValidateFunc:  validParamGroupNamePrefix,
 			},
-			"family": {
-				Type:     schema.TypeString,
-				Required: true,
-				ForceNew: true,
-			},
-			"description": {
-				Type:     schema.TypeString,
-				Optional: true,
-				ForceNew: true,
-				Default:  "Managed by Terraform",
-			},
 			"parameter": {
 				Type:     schema.TypeSet,
 				Optional: true,
 				Elem: &schema.Resource{
 					Schema: map[string]*schema.Schema{
+						"apply_method": {
+							Type:         schema.TypeString,
+							Optional:     true,
+							Default:      neptune.ApplyMethodPendingReboot,
+							ValidateFunc: validation.StringInSlice(neptune.ApplyMethod_Values(), false),
+						},
 						"name": {
 							Type:     schema.TypeString,
 							Required: true,
@@ -77,15 +91,6 @@ func ResourceClusterParameterGroup() *schema.Resource {
 							Type:     schema.TypeString,
 							Required: true,
 						},
-						"apply_method": {
-							Type:     schema.TypeString,
-							Optional: true,
-							Default:  neptune.ApplyMethodPendingReboot,
-							ValidateFunc: validation.StringInSlice([]string{
-								neptune.ApplyMethodImmediate,
-								neptune.ApplyMethodPendingReboot,
-							}, false),
-						},
 					},
 				},
 			},
@@ -101,33 +106,27 @@ func resourceClusterParameterGroupCreate(ctx context.Context, d *schema.Resource
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).NeptuneConn(ctx)
 
-	var groupName string
-	if v, ok := d.GetOk("name"); ok {
-		groupName = v.(string)
-	} else if v, ok := d.GetOk("name_prefix"); ok {
-		groupName = id.PrefixedUniqueId(v.(string))
-	} else {
-		groupName = id.UniqueId()
-	}
-
-	createOpts := neptune.CreateDBClusterParameterGroupInput{
-		DBClusterParameterGroupName: aws.String(groupName),
+	name := create.Name(d.Get("name").(string), d.Get("name_prefix").(string))
+	input := &neptune.CreateDBClusterParameterGroupInput{
+		DBClusterParameterGroupName: aws.String(name),
 		DBParameterGroupFamily:      aws.String(d.Get("family").(string)),
 		Description:                 aws.String(d.Get("description").(string)),
 		Tags:                        getTagsIn(ctx),
 	}
 
-	_, err := conn.CreateDBClusterParameterGroupWithContext(ctx, &createOpts)
+	_, err := conn.CreateDBClusterParameterGroupWithContext(ctx, input)
+
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "creating Neptune Cluster Parameter Group (%s): %s", groupName, err)
+		return sdkdiag.AppendErrorf(diags, "creating Neptune Cluster Parameter Group (%s): %s", name, err)
 	}
 
-	d.SetId(aws.StringValue(createOpts.DBClusterParameterGroupName))
+	d.SetId(name)
 
 	if v, ok := d.GetOk("parameter"); ok && v.(*schema.Set).Len() > 0 {
 		err := modifyClusterParameterGroupParameters(ctx, conn, d.Id(), expandParameters(v.(*schema.Set).List()))
+
 		if err != nil {
-			return sdkdiag.AppendErrorf(diags, "modifying Neptune Cluster Parameter Group (%s): %s", d.Id(), err)
+			return sdkdiag.AppendFromErr(diags, err)
 		}
 	}
 
@@ -138,12 +137,9 @@ func resourceClusterParameterGroupRead(ctx context.Context, d *schema.ResourceDa
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).NeptuneConn(ctx)
 
-	describeOpts := neptune.DescribeDBClusterParameterGroupsInput{
-		DBClusterParameterGroupName: aws.String(d.Id()),
-	}
+	dbClusterParameterGroup, err := FindDBClusterParameterGroupByName(ctx, conn, d.Id())
 
-	describeResp, err := conn.DescribeDBClusterParameterGroupsWithContext(ctx, &describeOpts)
-	if !d.IsNewResource() && tfawserr.ErrCodeEquals(err, neptune.ErrCodeDBParameterGroupNotFoundFault) {
+	if !d.IsNewResource() && tfresource.NotFound(err) {
 		log.Printf("[WARN] Neptune Cluster Parameter Group (%s) not found, removing from state", d.Id())
 		d.SetId("")
 		return diags
@@ -153,35 +149,75 @@ func resourceClusterParameterGroupRead(ctx context.Context, d *schema.ResourceDa
 		return sdkdiag.AppendErrorf(diags, "reading Neptune Cluster Parameter Group (%s): %s", d.Id(), err)
 	}
 
-	if describeResp == nil || len(describeResp.DBClusterParameterGroups) == 0 {
-		if d.IsNewResource() {
-			return sdkdiag.AppendErrorf(diags, "reading Neptune Cluster Parameter Group (%s): not found", d.Id())
+	arn := aws.StringValue(dbClusterParameterGroup.DBClusterParameterGroupArn)
+	d.Set("arn", arn)
+	d.Set("description", dbClusterParameterGroup.Description)
+	d.Set("family", dbClusterParameterGroup.DBParameterGroupFamily)
+	d.Set("name", dbClusterParameterGroup.DBClusterParameterGroupName)
+	d.Set("name_prefix", create.NamePrefixFromName(aws.StringValue(dbClusterParameterGroup.DBClusterParameterGroupName)))
+
+	// Only include user customized parameters as there's hundreds of system/default ones
+	input := &neptune.DescribeDBClusterParametersInput{
+		DBClusterParameterGroupName: aws.String(d.Id()),
+		Source:                      aws.String("user"),
+	}
+	var parameters []*neptune.Parameter
+
+	err = conn.DescribeDBClusterParametersPagesWithContext(ctx, input, func(page *neptune.DescribeDBClusterParametersOutput, lastPage bool) bool {
+		if page == nil {
+			return !lastPage
 		}
 
-		log.Printf("[WARN] Neptune Cluster Parameter Group (%s) not found, removing from state", d.Id())
-		d.SetId("")
-		return diags
+		for _, v := range page.Parameters {
+			if v != nil {
+				parameters = append(parameters, v)
+			}
+		}
+
+		return !lastPage
+	})
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "reading Neptune Cluster Parameter Group (%s) parameters: %s", d.Id(), err)
 	}
 
-	d.Set("name", describeResp.DBClusterParameterGroups[0].DBClusterParameterGroupName)
-	d.Set("family", describeResp.DBClusterParameterGroups[0].DBParameterGroupFamily)
-	d.Set("description", describeResp.DBClusterParameterGroups[0].Description)
-	arn := aws.StringValue(describeResp.DBClusterParameterGroups[0].DBClusterParameterGroupArn)
-	d.Set("arn", arn)
+	// Add only system parameters that are set in the config
+	p := d.Get("parameter")
+	if p == nil {
+		p = new(schema.Set)
+	}
+	s := p.(*schema.Set)
+	configParameters := expandParameters(s.List())
 
-	// Only include user customized parameters as there's hundreds of system/default ones
-	describeParametersOpts := neptune.DescribeDBClusterParametersInput{
+	input = &neptune.DescribeDBClusterParametersInput{
 		DBClusterParameterGroupName: aws.String(d.Id()),
-		Source:                      aws.String("user"),
+		Source:                      aws.String("engine-default"),
 	}
 
-	describeParametersResp, err := conn.DescribeDBClusterParametersWithContext(ctx, &describeParametersOpts)
+	err = conn.DescribeDBClusterParametersPagesWithContext(ctx, input, func(page *neptune.DescribeDBClusterParametersOutput, lastPage bool) bool {
+		if page == nil {
+			return !lastPage
+		}
+
+		for _, v := range page.Parameters {
+			if v != nil {
+				for _, p := range configParameters {
+					if aws.StringValue(v.ParameterName) == aws.StringValue(p.ParameterName) {
+						parameters = append(parameters, v)
+					}
+				}
+			}
+		}
+
+		return !lastPage
+	})
+
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "reading Neptune Cluster Parameter Group (%s): %s", d.Id(), err)
+		return sdkdiag.AppendErrorf(diags, "reading Neptune Cluster Parameter Group (%s) parameters: %s", d.Id(), err)
 	}
 
-	if err := d.Set("parameter", flattenParameters(describeParametersResp.Parameters)); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting neptune parameter: %s", err)
+	if err := d.Set("parameter", flattenParameters(parameters)); err != nil {
+		return sdkdiag.AppendErrorf(diags, "setting parameter: %s", err)
 	}
 
 	return diags
@@ -203,12 +239,11 @@ func resourceClusterParameterGroupUpdate(ctx context.Context, d *schema.Resource
 		os := o.(*schema.Set)
 		ns := n.(*schema.Set)
 
-		parameters := expandParameters(ns.Difference(os).List())
-
-		if len(parameters) > 0 {
+		if parameters := expandParameters(ns.Difference(os).List()); len(parameters) > 0 {
 			err := modifyClusterParameterGroupParameters(ctx, conn, d.Id(), parameters)
+
 			if err != nil {
-				return sdkdiag.AppendErrorf(diags, "updating Neptune Cluster Parameter Group (%s) parameter: %s", d.Id(), err)
+				return sdkdiag.AppendFromErr(diags, err)
 			}
 		}
 	}
@@ -220,15 +255,16 @@ func resourceClusterParameterGroupDelete(ctx context.Context, d *schema.Resource
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).NeptuneConn(ctx)
 
-	input := neptune.DeleteDBClusterParameterGroupInput{
+	log.Printf("[DEBUG] Deleting Neptune Cluster Parameter Group: %s", d.Id())
+	_, err := conn.DeleteDBClusterParameterGroupWithContext(ctx, &neptune.DeleteDBClusterParameterGroupInput{
 		DBClusterParameterGroupName: aws.String(d.Id()),
+	})
+
+	if tfawserr.ErrCodeEquals(err, neptune.ErrCodeDBParameterGroupNotFoundFault) {
+		return diags
 	}
 
-	_, err := conn.DeleteDBClusterParameterGroupWithContext(ctx, &input)
 	if err != nil {
-		if tfawserr.ErrCodeEquals(err, neptune.ErrCodeDBParameterGroupNotFoundFault) {
-			return diags
-		}
 		return sdkdiag.AppendErrorf(diags, "deleting Neptune Cluster Parameter Group (%s): %s", d.Id(), err)
 	}
 
@@ -236,26 +272,80 @@ func resourceClusterParameterGroupDelete(ctx context.Context, d *schema.Resource
 }
 
 func modifyClusterParameterGroupParameters(ctx context.Context, conn *neptune.Neptune, name string, parameters []*neptune.Parameter) error {
-	// We can only modify 20 parameters at a time, so walk them until
-	// we've got them all.
-	for parameters != nil {
-		var paramsToModify []*neptune.Parameter
-		if len(parameters) <= clusterParameterGroupMaxParamsBulkEdit {
-			paramsToModify, parameters = parameters[:], nil
-		} else {
-			paramsToModify, parameters = parameters[:clusterParameterGroupMaxParamsBulkEdit], parameters[clusterParameterGroupMaxParamsBulkEdit:]
-		}
-
-		modifyOpts := neptune.ModifyDBClusterParameterGroupInput{
+	// We can only modify 20 parameters at a time, so chunk them until we've got them all.
+	for _, chunk := range tfslices.Chunks(parameters, clusterParameterGroupMaxParamsBulkEdit) {
+		input := &neptune.ModifyDBClusterParameterGroupInput{
 			DBClusterParameterGroupName: aws.String(name),
-			Parameters:                  paramsToModify,
+			Parameters:                  chunk,
 		}
 
-		_, err := conn.ModifyDBClusterParameterGroupWithContext(ctx, &modifyOpts)
+		_, err := conn.ModifyDBClusterParameterGroupWithContext(ctx, input)
+
 		if err != nil {
-			return err
+			return fmt.Errorf("modifying Neptune Cluster Parameter Group (%s): %w", name, err)
 		}
 	}
 
 	return nil
 }
+
+func FindDBClusterParameterGroupByName(ctx context.Context, conn *neptune.Neptune, name string) (*neptune.DBClusterParameterGroup, error) {
+	input := &neptune.DescribeDBClusterParameterGroupsInput{
+		DBClusterParameterGroupName: aws.String(name),
+	}
+	output, err := findDBClusterParameterGroup(ctx, conn, input)
+
+	if err != nil {
+		return nil, err
+	}
+
+	// Eventual consistency check.
+	if aws.StringValue(output.DBClusterParameterGroupName) != name {
+		return nil, &retry.NotFoundError{
+			LastRequest: input,
+		}
+	}
+
+	return output, nil
+}
+
+func findDBClusterParameterGroup(ctx context.Context, conn *neptune.Neptune, input *neptune.DescribeDBClusterParameterGroupsInput) (*neptune.DBClusterParameterGroup, error) {
+	output, err := findDBClusterParameterGroups(ctx, conn, input)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return tfresource.AssertSinglePtrResult(output)
+}
+
+func findDBClusterParameterGroups(ctx context.Context, conn *neptune.Neptune, input *neptune.DescribeDBClusterParameterGroupsInput) ([]*neptune.DBClusterParameterGroup, error) {
+	var output []*neptune.DBClusterParameterGroup
+
+	err := conn.DescribeDBClusterParameterGroupsPagesWithContext(ctx, input, func(page *neptune.DescribeDBClusterParameterGroupsOutput, lastPage bool) bool {
+		if page == nil {
+			return !lastPage
+		}
+
+		for _, v := range page.DBClusterParameterGroups {
+			if v != nil {
+				output = append(output, v)
+			}
+		}
+
+		return !lastPage
+	})
+
+	if tfawserr.ErrCodeEquals(err, neptune.ErrCodeDBParameterGroupNotFoundFault) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	return output, nil
+}
diff --git a/internal/service/neptune/cluster_parameter_group_test.go b/internal/service/neptune/cluster_parameter_group_test.go
index 8d1dc4896c7..36f66276655 100644
--- a/internal/service/neptune/cluster_parameter_group_test.go
+++ b/internal/service/neptune/cluster_parameter_group_test.go
@@ -1,28 +1,28 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package neptune_test
 
 import (
 	"context"
-	"errors"
 	"fmt"
-	"regexp"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/neptune"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	tfneptune "github.com/hashicorp/terraform-provider-aws/internal/service/neptune"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
 func TestAccNeptuneClusterParameterGroup_basic(t *testing.T) {
 	ctx := acctest.Context(t)
 	var v neptune.DBClusterParameterGroup
-
-	parameterGroupName := sdkacctest.RandomWithPrefix("cluster-parameter-group-test-terraform")
-
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_neptune_cluster_parameter_group.test"
 
 	resource.ParallelTest(t, resource.TestCase{
@@ -32,14 +32,14 @@ func TestAccNeptuneClusterParameterGroup_basic(t *testing.T) {
 		CheckDestroy:             testAccCheckClusterParameterGroupDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccClusterParameterGroupConfig_basic(parameterGroupName),
+				Config: testAccClusterParameterGroupConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckClusterParameterGroupExists(ctx, resourceName, &v),
-					testAccCheckClusterParameterGroupAttributes(&v, parameterGroupName),
-					acctest.CheckResourceAttrRegionalARN(resourceName, "arn", "rds", fmt.Sprintf("cluster-pg:%s", parameterGroupName)),
-					resource.TestCheckResourceAttr(resourceName, "name", parameterGroupName),
-					resource.TestCheckResourceAttr(resourceName, "family", "neptune1"),
+					acctest.CheckResourceAttrRegionalARN(resourceName, "arn", "rds", fmt.Sprintf("cluster-pg:%s", rName)),
 					resource.TestCheckResourceAttr(resourceName, "description", "Managed by Terraform"),
+					resource.TestCheckResourceAttr(resourceName, "family", "neptune1"),
+					resource.TestCheckResourceAttr(resourceName, "name", rName),
+					resource.TestCheckResourceAttr(resourceName, "name_prefix", ""),
 					resource.TestCheckResourceAttr(resourceName, "parameter.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 				),
@@ -53,10 +53,10 @@ func TestAccNeptuneClusterParameterGroup_basic(t *testing.T) {
 	})
 }
 
-func TestAccNeptuneClusterParameterGroup_namePrefix(t *testing.T) {
+func TestAccNeptuneClusterParameterGroup_disappears(t *testing.T) {
 	ctx := acctest.Context(t)
 	var v neptune.DBClusterParameterGroup
-
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_neptune_cluster_parameter_group.test"
 
 	resource.ParallelTest(t, resource.TestCase{
@@ -66,26 +66,20 @@ func TestAccNeptuneClusterParameterGroup_namePrefix(t *testing.T) {
 		CheckDestroy:             testAccCheckClusterParameterGroupDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccClusterParameterGroupConfig_namePrefixEmpty,
+				Config: testAccClusterParameterGroupConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckClusterParameterGroupExists(ctx, resourceName, &v),
-					resource.TestMatchResourceAttr(resourceName, "name", regexp.MustCompile("^tf-test-")),
+					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfneptune.ResourceClusterParameterGroup(), resourceName),
 				),
-			},
-			{
-				ResourceName:            resourceName,
-				ImportState:             true,
-				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"name_prefix"},
+				ExpectNonEmptyPlan: true,
 			},
 		},
 	})
 }
 
-func TestAccNeptuneClusterParameterGroup_generatedName(t *testing.T) {
+func TestAccNeptuneClusterParameterGroup_nameGenerated(t *testing.T) {
 	ctx := acctest.Context(t)
 	var v neptune.DBClusterParameterGroup
-
 	resourceName := "aws_neptune_cluster_parameter_group.test"
 
 	resource.ParallelTest(t, resource.TestCase{
@@ -95,9 +89,11 @@ func TestAccNeptuneClusterParameterGroup_generatedName(t *testing.T) {
 		CheckDestroy:             testAccCheckClusterParameterGroupDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccClusterParameterGroupConfig_generatedName,
+				Config: testAccClusterParameterGroupConfig_nameGenerated(),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckClusterParameterGroupExists(ctx, resourceName, &v),
+					acctest.CheckResourceAttrNameGenerated(resourceName, "name"),
+					resource.TestCheckResourceAttr(resourceName, "name_prefix", id.UniqueIdPrefix),
 				),
 			},
 			{
@@ -109,14 +105,11 @@ func TestAccNeptuneClusterParameterGroup_generatedName(t *testing.T) {
 	})
 }
 
-func TestAccNeptuneClusterParameterGroup_description(t *testing.T) {
+func TestAccNeptuneClusterParameterGroup_namePrefix(t *testing.T) {
 	ctx := acctest.Context(t)
 	var v neptune.DBClusterParameterGroup
-
 	resourceName := "aws_neptune_cluster_parameter_group.test"
 
-	parameterGroupName := sdkacctest.RandomWithPrefix("cluster-parameter-group-test-terraform")
-
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
 		ErrorCheck:               acctest.ErrorCheck(t, neptune.EndpointsID),
@@ -124,11 +117,11 @@ func TestAccNeptuneClusterParameterGroup_description(t *testing.T) {
 		CheckDestroy:             testAccCheckClusterParameterGroupDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccClusterParameterGroupConfig_description(parameterGroupName, "custom description"),
+				Config: testAccClusterParameterGroupConfig_namePrefix("tf-acc-test-prefix-"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckClusterParameterGroupExists(ctx, resourceName, &v),
-					testAccCheckClusterParameterGroupAttributes(&v, parameterGroupName),
-					resource.TestCheckResourceAttr(resourceName, "description", "custom description"),
+					acctest.CheckResourceAttrNameFromPrefix(resourceName, "name", "tf-acc-test-prefix-"),
+					resource.TestCheckResourceAttr(resourceName, "name_prefix", "tf-acc-test-prefix-"),
 				),
 			},
 			{
@@ -140,13 +133,11 @@ func TestAccNeptuneClusterParameterGroup_description(t *testing.T) {
 	})
 }
 
-// Reference: https://github.com/hashicorp/terraform-provider-aws/issues/17870
-func TestAccNeptuneClusterParameterGroup_NamePrefix_parameter(t *testing.T) {
+func TestAccNeptuneClusterParameterGroup_tags(t *testing.T) {
 	ctx := acctest.Context(t)
 	var v neptune.DBClusterParameterGroup
-
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_neptune_cluster_parameter_group.test"
-	prefix := acctest.ResourcePrefix
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
@@ -155,46 +146,72 @@ func TestAccNeptuneClusterParameterGroup_NamePrefix_parameter(t *testing.T) {
 		CheckDestroy:             testAccCheckClusterParameterGroupDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccClusterParameterGroupConfig_namePrefix(prefix, "neptune_enable_audit_log", "1"),
+				Config: testAccClusterParameterGroupConfig_tags1(rName, "key1", "value1"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckClusterParameterGroupExists(ctx, resourceName, &v),
-					resource.TestCheckResourceAttr(resourceName, "parameter.#", "1"),
-					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "parameter.*", map[string]string{
-						"apply_method": "pending-reboot",
-						"name":         "neptune_enable_audit_log",
-						"value":        "1",
-					}),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
 				),
 			},
 			{
-				ResourceName:            resourceName,
-				ImportState:             true,
-				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"name_prefix"},
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
 			},
 			{
-				Config: testAccClusterParameterGroupConfig_namePrefix(prefix, "neptune_enable_audit_log", "0"),
+				Config: testAccClusterParameterGroupConfig_tags2(rName, "key1", "value1updated", "key2", "value2"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckClusterParameterGroupExists(ctx, resourceName, &v),
-					resource.TestCheckResourceAttr(resourceName, "parameter.#", "1"),
-					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "parameter.*", map[string]string{
-						"apply_method": "pending-reboot",
-						"name":         "neptune_enable_audit_log",
-						"value":        "0",
-					}),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1updated"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
+				),
+			},
+			{
+				Config: testAccClusterParameterGroupConfig_tags1(rName, "key2", "value2"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckClusterParameterGroupExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
 				),
 			},
 		},
 	})
 }
 
-func TestAccNeptuneClusterParameterGroup_parameter(t *testing.T) {
+func TestAccNeptuneClusterParameterGroup_description(t *testing.T) {
 	ctx := acctest.Context(t)
 	var v neptune.DBClusterParameterGroup
-
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_neptune_cluster_parameter_group.test"
 
-	parameterGroupName := sdkacctest.RandomWithPrefix("cluster-parameter-group-test-tf")
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, neptune.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckClusterParameterGroupDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccClusterParameterGroupConfig_description(rName, "custom description"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckClusterParameterGroupExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "description", "custom description"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
+func TestAccNeptuneClusterParameterGroup_parameter(t *testing.T) {
+	ctx := acctest.Context(t)
+	var v neptune.DBClusterParameterGroup
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_neptune_cluster_parameter_group.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
@@ -203,10 +220,9 @@ func TestAccNeptuneClusterParameterGroup_parameter(t *testing.T) {
 		CheckDestroy:             testAccCheckClusterParameterGroupDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccClusterParameterGroupConfig_one(parameterGroupName, "neptune_enable_audit_log", "1"),
+				Config: testAccClusterParameterGroupConfig_one(rName, "neptune_enable_audit_log", "1"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckClusterParameterGroupExists(ctx, resourceName, &v),
-					testAccCheckClusterParameterGroupAttributes(&v, parameterGroupName),
 					resource.TestCheckResourceAttr(resourceName, "parameter.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "parameter.*", map[string]string{
 						"apply_method": "pending-reboot",
@@ -221,10 +237,9 @@ func TestAccNeptuneClusterParameterGroup_parameter(t *testing.T) {
 				ImportStateVerify: true,
 			},
 			{
-				Config: testAccClusterParameterGroupConfig_one(parameterGroupName, "neptune_enable_audit_log", "0"),
+				Config: testAccClusterParameterGroupConfig_one(rName, "neptune_enable_audit_log", "0"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckClusterParameterGroupExists(ctx, resourceName, &v),
-					testAccCheckClusterParameterGroupAttributes(&v, parameterGroupName),
 					resource.TestCheckResourceAttr(resourceName, "parameter.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "parameter.*", map[string]string{
 						"apply_method": "pending-reboot",
@@ -237,14 +252,14 @@ func TestAccNeptuneClusterParameterGroup_parameter(t *testing.T) {
 	})
 }
 
-func TestAccNeptuneClusterParameterGroup_tags(t *testing.T) {
+// This test ensures that defining a parameter with a default setting is ignored
+// and returns successfully as no changes being applied.
+func TestAccNeptuneClusterParameterGroup_parameterDefault(t *testing.T) {
 	ctx := acctest.Context(t)
 	var v neptune.DBClusterParameterGroup
-
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_neptune_cluster_parameter_group.test"
 
-	parameterGroupName := sdkacctest.RandomWithPrefix("cluster-parameter-group-test-tf")
-
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
 		ErrorCheck:               acctest.ErrorCheck(t, neptune.EndpointsID),
@@ -252,36 +267,17 @@ func TestAccNeptuneClusterParameterGroup_tags(t *testing.T) {
 		CheckDestroy:             testAccCheckClusterParameterGroupDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccClusterParameterGroupConfig_tags(parameterGroupName, "key1", "value1"),
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckClusterParameterGroupExists(ctx, resourceName, &v),
-					testAccCheckClusterParameterGroupAttributes(&v, parameterGroupName),
-					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
-					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
-				),
-			},
-			{
-				ResourceName:      resourceName,
-				ImportState:       true,
-				ImportStateVerify: true,
-			},
-			{
-				Config: testAccClusterParameterGroupConfig_tags(parameterGroupName, "key1", "value2"),
+				Config: testAccClusterParameterGroupConfig_one(rName, "neptune_enable_audit_log", "0"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckClusterParameterGroupExists(ctx, resourceName, &v),
-					testAccCheckClusterParameterGroupAttributes(&v, parameterGroupName),
-					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
-					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value2"),
-				),
-			},
-			{
-				Config: testAccClusterParameterGroupConfig_tags(parameterGroupName, "key2", "value2"),
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckClusterParameterGroupExists(ctx, resourceName, &v),
-					testAccCheckClusterParameterGroupAttributes(&v, parameterGroupName),
-					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
-					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
+					resource.TestCheckResourceAttr(resourceName, "parameter.#", "1"),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "parameter.*", map[string]string{
+						"apply_method": "pending-reboot",
+						"name":         "neptune_enable_audit_log",
+						"value":        "0",
+					}),
 				),
+				ExpectNonEmptyPlan: false,
 			},
 		},
 	})
@@ -296,37 +292,17 @@ func testAccCheckClusterParameterGroupDestroy(ctx context.Context) resource.Test
 				continue
 			}
 
-			resp, err := conn.DescribeDBClusterParameterGroupsWithContext(ctx, &neptune.DescribeDBClusterParameterGroupsInput{
-				DBClusterParameterGroupName: aws.String(rs.Primary.ID),
-			})
+			_, err := tfneptune.FindDBClusterParameterGroupByName(ctx, conn, rs.Primary.ID)
 
-			if err == nil {
-				if len(resp.DBClusterParameterGroups) != 0 &&
-					aws.StringValue(resp.DBClusterParameterGroups[0].DBClusterParameterGroupName) == rs.Primary.ID {
-					return errors.New("Neptune Cluster Parameter Group still exists")
-				}
+			if tfresource.NotFound(err) {
+				continue
 			}
 
 			if err != nil {
-				if tfawserr.ErrCodeEquals(err, neptune.ErrCodeDBParameterGroupNotFoundFault) {
-					return nil
-				}
 				return err
 			}
-		}
-
-		return nil
-	}
-}
 
-func testAccCheckClusterParameterGroupAttributes(v *neptune.DBClusterParameterGroup, name string) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		if *v.DBClusterParameterGroupName != name {
-			return fmt.Errorf("bad name: %#v expected: %v", *v.DBClusterParameterGroupName, name)
-		}
-
-		if *v.DBParameterGroupFamily != "neptune1" {
-			return fmt.Errorf("bad family: %#v", *v.DBParameterGroupFamily)
+			return fmt.Errorf("Neptune Cluster Parameter Group %s still exists", rs.Primary.ID)
 		}
 
 		return nil
@@ -340,102 +316,93 @@ func testAccCheckClusterParameterGroupExists(ctx context.Context, n string, v *n
 			return fmt.Errorf("Not found: %s", n)
 		}
 
-		if rs.Primary.ID == "" {
-			return errors.New("No Neptune Cluster Parameter Group ID is set")
-		}
-
 		conn := acctest.Provider.Meta().(*conns.AWSClient).NeptuneConn(ctx)
 
-		opts := neptune.DescribeDBClusterParameterGroupsInput{
-			DBClusterParameterGroupName: aws.String(rs.Primary.ID),
-		}
-
-		resp, err := conn.DescribeDBClusterParameterGroupsWithContext(ctx, &opts)
+		output, err := tfneptune.FindDBClusterParameterGroupByName(ctx, conn, rs.Primary.ID)
 
 		if err != nil {
 			return err
 		}
 
-		if len(resp.DBClusterParameterGroups) != 1 ||
-			aws.StringValue(resp.DBClusterParameterGroups[0].DBClusterParameterGroupName) != rs.Primary.ID {
-			return errors.New("Neptune Cluster Parameter Group not found")
-		}
-
-		*v = *resp.DBClusterParameterGroups[0]
+		*v = *output
 
 		return nil
 	}
 }
 
-func testAccClusterParameterGroupConfig_description(name, description string) string {
+func testAccClusterParameterGroupConfig_basic(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_neptune_cluster_parameter_group" "test" {
-  description = "%s"
-  family      = "neptune1"
-  name        = "%s"
+  family = "neptune1"
+  name   = %[1]q
 }
-`, description, name)
+`, rName)
 }
 
-func testAccClusterParameterGroupConfig_one(name, pName, pValue string) string {
-	return fmt.Sprintf(`
+func testAccClusterParameterGroupConfig_nameGenerated() string {
+	return `
 resource "aws_neptune_cluster_parameter_group" "test" {
   family = "neptune1"
-  name   = "%s"
-
-  parameter {
-    name  = "%s"
-    value = "%s"
-  }
 }
-`, name, pName, pValue)
+`
 }
 
-func testAccClusterParameterGroupConfig_namePrefix(namePrefix, pName, pValue string) string {
+func testAccClusterParameterGroupConfig_namePrefix(namePrefix string) string {
 	return fmt.Sprintf(`
 resource "aws_neptune_cluster_parameter_group" "test" {
   family      = "neptune1"
-  name_prefix = %q
-
-  parameter {
-    name  = %q
-    value = %q
-  }
+  name_prefix = %[1]q
 }
-`, namePrefix, pName, pValue)
+`, namePrefix)
 }
 
-func testAccClusterParameterGroupConfig_tags(name, tKey, tValue string) string {
+func testAccClusterParameterGroupConfig_tags1(rName, tagKey1, tagValue1 string) string {
 	return fmt.Sprintf(`
 resource "aws_neptune_cluster_parameter_group" "test" {
   family = "neptune1"
-  name   = "%s"
+  name   = %[1]q
 
   tags = {
-    %s = "%s"
+    %[2]q = %[3]q
   }
 }
-`, name, tKey, tValue)
+`, rName, tagKey1, tagValue1)
 }
 
-func testAccClusterParameterGroupConfig_basic(name string) string {
+func testAccClusterParameterGroupConfig_tags2(rName, tagKey1, tagValue1, tagKey2, tagValue2 string) string {
 	return fmt.Sprintf(`
 resource "aws_neptune_cluster_parameter_group" "test" {
   family = "neptune1"
-  name   = "%s"
+  name   = %[1]q
+
+  tags = {
+    %[2]q = %[3]q
+    %[4]q = %[5]q
+  }
 }
-`, name)
+`, rName, tagKey1, tagValue1, tagKey2, tagValue2)
 }
 
-const testAccClusterParameterGroupConfig_namePrefixEmpty = `
+func testAccClusterParameterGroupConfig_description(rName, description string) string {
+	return fmt.Sprintf(`
 resource "aws_neptune_cluster_parameter_group" "test" {
+  description = %[2]q
   family      = "neptune1"
-  name_prefix = "tf-test-"
+  name        = %[1]q
+}
+`, rName, description)
 }
-`
 
-const testAccClusterParameterGroupConfig_generatedName = `
+func testAccClusterParameterGroupConfig_one(rName, pName, pValue string) string {
+	return fmt.Sprintf(`
 resource "aws_neptune_cluster_parameter_group" "test" {
   family = "neptune1"
+  name   = %[1]q
+
+  parameter {
+    name  = %[2]q
+    value = %[3]q
+  }
+}
+`, rName, pName, pValue)
 }
-`
diff --git a/internal/service/neptune/cluster_snapshot.go b/internal/service/neptune/cluster_snapshot.go
index e018da97d32..fc3539b98ad 100644
--- a/internal/service/neptune/cluster_snapshot.go
+++ b/internal/service/neptune/cluster_snapshot.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package neptune
 
 import (
diff --git a/internal/service/neptune/cluster_snapshot_test.go b/internal/service/neptune/cluster_snapshot_test.go
index d0615f71d5e..1fe689dc2d7 100644
--- a/internal/service/neptune/cluster_snapshot_test.go
+++ b/internal/service/neptune/cluster_snapshot_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package neptune_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/neptune"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -44,7 +47,7 @@ func TestAccNeptuneClusterSnapshot_basic(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "source_db_cluster_snapshot_arn", ""),
 					resource.TestCheckResourceAttr(resourceName, "status", "available"),
 					resource.TestCheckResourceAttr(resourceName, "storage_encrypted", "false"),
-					resource.TestMatchResourceAttr(resourceName, "vpc_id", regexp.MustCompile(`^vpc-.+`)),
+					resource.TestMatchResourceAttr(resourceName, "vpc_id", regexache.MustCompile(`^vpc-.+`)),
 				),
 			},
 			{
diff --git a/internal/service/neptune/cluster_test.go b/internal/service/neptune/cluster_test.go
index 907a28910bb..385b48a6680 100644
--- a/internal/service/neptune/cluster_test.go
+++ b/internal/service/neptune/cluster_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package neptune_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/neptune"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
@@ -26,7 +29,6 @@ func testAccClusterImportStep(n string) resource.TestStep {
 		ImportStateVerifyIgnore: []string{
 			"allow_major_version_upgrade",
 			"apply_immediately",
-			"cluster_identifier_prefix",
 			"final_snapshot_identifier",
 			"neptune_instance_parameter_group_name",
 			"skip_final_snapshot",
@@ -38,7 +40,7 @@ func testAccClusterImportStep(n string) resource.TestStep {
 func TestAccNeptuneCluster_basic(t *testing.T) {
 	ctx := acctest.Context(t)
 	var dbCluster neptune.DBCluster
-	rName := sdkacctest.RandomWithPrefix("tf-acc")
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_neptune_cluster.test"
 
 	resource.ParallelTest(t, resource.TestCase{
@@ -51,17 +53,41 @@ func TestAccNeptuneCluster_basic(t *testing.T) {
 				Config: testAccClusterConfig_basic(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckClusterExists(ctx, resourceName, &dbCluster),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "rds", regexp.MustCompile(`cluster:.+`)),
+					resource.TestCheckNoResourceAttr(resourceName, "allow_major_version_upgrade"),
+					resource.TestCheckNoResourceAttr(resourceName, "apply_immediately"),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "rds", regexache.MustCompile(`cluster:.+`)),
+					acctest.CheckResourceAttrGreaterThanValue(resourceName, "availability_zones.#", 0),
+					resource.TestCheckResourceAttr(resourceName, "backup_retention_period", "1"),
+					resource.TestCheckResourceAttr(resourceName, "cluster_identifier", rName),
+					resource.TestCheckResourceAttr(resourceName, "cluster_identifier_prefix", ""),
+					resource.TestCheckResourceAttr(resourceName, "cluster_members.#", "0"),
 					resource.TestCheckResourceAttrSet(resourceName, "cluster_resource_id"),
+					resource.TestCheckResourceAttr(resourceName, "copy_tags_to_snapshot", "false"),
 					resource.TestCheckResourceAttr(resourceName, "deletion_protection", "false"),
+					resource.TestCheckResourceAttr(resourceName, "enable_cloudwatch_logs_exports.#", "0"),
+					resource.TestCheckResourceAttrSet(resourceName, "endpoint"),
 					resource.TestCheckResourceAttr(resourceName, "engine", "neptune"),
 					resource.TestCheckResourceAttrSet(resourceName, "engine_version"),
+					resource.TestCheckNoResourceAttr(resourceName, "final_snapshot_identifier"),
+					resource.TestCheckResourceAttr(resourceName, "global_cluster_identifier", ""),
 					resource.TestCheckResourceAttrSet(resourceName, "hosted_zone_id"),
+					resource.TestCheckResourceAttr(resourceName, "iam_database_authentication_enabled", "false"),
+					resource.TestCheckResourceAttr(resourceName, "iam_roles.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "kms_key_arn", ""),
 					resource.TestCheckResourceAttr(resourceName, "neptune_cluster_parameter_group_name", "default.neptune1.2"),
+					resource.TestCheckNoResourceAttr(resourceName, "neptune_instance_parameter_group_name"),
+					resource.TestCheckResourceAttr(resourceName, "neptune_subnet_group_name", "default"),
+					resource.TestCheckResourceAttr(resourceName, "port", "8182"),
+					resource.TestCheckResourceAttrSet(resourceName, "preferred_backup_window"),
+					resource.TestCheckResourceAttrSet(resourceName, "preferred_maintenance_window"),
 					resource.TestCheckResourceAttrSet(resourceName, "reader_endpoint"),
+					resource.TestCheckResourceAttr(resourceName, "replication_source_identifier", ""),
 					resource.TestCheckResourceAttr(resourceName, "serverless_v2_scaling_configuration.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "skip_final_snapshot", "true"),
+					resource.TestCheckNoResourceAttr(resourceName, "snapshot_identifier"),
 					resource.TestCheckResourceAttr(resourceName, "storage_encrypted", "false"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
+					resource.TestCheckResourceAttr(resourceName, "vpc_security_group_ids.#", "1"),
 				),
 			},
 			testAccClusterImportStep(resourceName),
@@ -69,10 +95,10 @@ func TestAccNeptuneCluster_basic(t *testing.T) {
 	})
 }
 
-func TestAccNeptuneCluster_copyTagsToSnapshot(t *testing.T) {
+func TestAccNeptuneCluster_disappears(t *testing.T) {
 	ctx := acctest.Context(t)
 	var dbCluster neptune.DBCluster
-	rName := sdkacctest.RandomWithPrefix("tf-acc")
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_neptune_cluster.test"
 
 	resource.ParallelTest(t, resource.TestCase{
@@ -82,35 +108,20 @@ func TestAccNeptuneCluster_copyTagsToSnapshot(t *testing.T) {
 		CheckDestroy:             testAccCheckClusterDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccClusterConfig_copyTags(rName, true),
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckClusterExists(ctx, resourceName, &dbCluster),
-					resource.TestCheckResourceAttr(resourceName, "copy_tags_to_snapshot", "true"),
-				),
-			},
-			testAccClusterImportStep(resourceName),
-			{
-				Config: testAccClusterConfig_copyTags(rName, false),
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckClusterExists(ctx, resourceName, &dbCluster),
-					resource.TestCheckResourceAttr(resourceName, "copy_tags_to_snapshot", "false"),
-				),
-			},
-			{
-				Config: testAccClusterConfig_copyTags(rName, true),
+				Config: testAccClusterConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckClusterExists(ctx, resourceName, &dbCluster),
-					resource.TestCheckResourceAttr(resourceName, "copy_tags_to_snapshot", "true"),
+					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfneptune.ResourceCluster(), resourceName),
 				),
+				ExpectNonEmptyPlan: true,
 			},
 		},
 	})
 }
 
-func TestAccNeptuneCluster_namePrefix(t *testing.T) {
+func TestAccNeptuneCluster_identifierGenerated(t *testing.T) {
 	ctx := acctest.Context(t)
 	var v neptune.DBCluster
-	rName := "tf-test-"
 	resourceName := "aws_neptune_cluster.test"
 
 	resource.ParallelTest(t, resource.TestCase{
@@ -120,10 +131,11 @@ func TestAccNeptuneCluster_namePrefix(t *testing.T) {
 		CheckDestroy:             testAccCheckClusterDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccClusterConfig_namePrefix(rName),
+				Config: testAccClusterConfig_identifierGenerated(),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckClusterExists(ctx, resourceName, &v),
-					resource.TestMatchResourceAttr(resourceName, "cluster_identifier", regexp.MustCompile("^tf-test-")),
+					acctest.CheckResourceAttrNameGeneratedWithPrefix(resourceName, "cluster_identifier", "tf-"),
+					resource.TestCheckResourceAttr(resourceName, "cluster_identifier_prefix", "tf-"),
 				),
 			},
 			testAccClusterImportStep(resourceName),
@@ -131,10 +143,9 @@ func TestAccNeptuneCluster_namePrefix(t *testing.T) {
 	})
 }
 
-func TestAccNeptuneCluster_serverlessConfiguration(t *testing.T) {
+func TestAccNeptuneCluster_identifierPrefix(t *testing.T) {
 	ctx := acctest.Context(t)
 	var v neptune.DBCluster
-	rName := sdkacctest.RandomWithPrefix("tf-acc")
 	resourceName := "aws_neptune_cluster.test"
 
 	resource.ParallelTest(t, resource.TestCase{
@@ -144,12 +155,11 @@ func TestAccNeptuneCluster_serverlessConfiguration(t *testing.T) {
 		CheckDestroy:             testAccCheckClusterDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccClusterConfig_serverlessConfiguration(rName),
+				Config: testAccClusterConfig_identifierPrefix("tf-acc-test-prefix-"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckClusterExists(ctx, resourceName, &v),
-					resource.TestCheckResourceAttr(resourceName, "serverless_v2_scaling_configuration.#", "1"),
-					resource.TestCheckResourceAttr(resourceName, "serverless_v2_scaling_configuration.0.min_capacity", "4.5"),
-					resource.TestCheckResourceAttr(resourceName, "serverless_v2_scaling_configuration.0.max_capacity", "12.5"),
+					acctest.CheckResourceAttrNameFromPrefix(resourceName, "cluster_identifier", "tf-acc-test-prefix-"),
+					resource.TestCheckResourceAttr(resourceName, "cluster_identifier_prefix", "tf-acc-test-prefix-"),
 				),
 			},
 			testAccClusterImportStep(resourceName),
@@ -157,7 +167,7 @@ func TestAccNeptuneCluster_serverlessConfiguration(t *testing.T) {
 	})
 }
 
-func TestAccNeptuneCluster_takeFinalSnapshot(t *testing.T) {
+func TestAccNeptuneCluster_tags(t *testing.T) {
 	ctx := acctest.Context(t)
 	var v neptune.DBCluster
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
@@ -167,22 +177,41 @@ func TestAccNeptuneCluster_takeFinalSnapshot(t *testing.T) {
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
 		ErrorCheck:               acctest.ErrorCheck(t, neptune.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckClusterDestroyWithFinalSnapshot(ctx),
+		CheckDestroy:             testAccCheckClusterDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccClusterConfig_finalSnapshot(rName),
+				Config: testAccClusterConfig_tags1(rName, "key1", "value1"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckClusterExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
 				),
 			},
 			testAccClusterImportStep(resourceName),
+			{
+				Config: testAccClusterConfig_tags2(rName, "key1", "value1updated", "key2", "value2"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckClusterExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1updated"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
+				),
+			},
+			{
+				Config: testAccClusterConfig_tags1(rName, "key2", "value2"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckClusterExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
+				),
+			},
 		},
 	})
 }
 
-func TestAccNeptuneCluster_tags(t *testing.T) {
+func TestAccNeptuneCluster_copyTagsToSnapshot(t *testing.T) {
 	ctx := acctest.Context(t)
-	var v neptune.DBCluster
+	var dbCluster neptune.DBCluster
 	rName := sdkacctest.RandomWithPrefix("tf-acc")
 	resourceName := "aws_neptune_cluster.test"
 
@@ -193,31 +222,76 @@ func TestAccNeptuneCluster_tags(t *testing.T) {
 		CheckDestroy:             testAccCheckClusterDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccClusterConfig_tags1(rName, "key1", "value1"),
+				Config: testAccClusterConfig_copyTags(rName, true),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckClusterExists(ctx, resourceName, &v),
-					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
-					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
+					testAccCheckClusterExists(ctx, resourceName, &dbCluster),
+					resource.TestCheckResourceAttr(resourceName, "copy_tags_to_snapshot", "true"),
 				),
 			},
 			testAccClusterImportStep(resourceName),
 			{
-				Config: testAccClusterConfig_tags2(rName, "key1", "value1updated", "key2", "value2"),
+				Config: testAccClusterConfig_copyTags(rName, false),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckClusterExists(ctx, resourceName, &dbCluster),
+					resource.TestCheckResourceAttr(resourceName, "copy_tags_to_snapshot", "false"),
+				),
+			},
+			{
+				Config: testAccClusterConfig_copyTags(rName, true),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckClusterExists(ctx, resourceName, &dbCluster),
+					resource.TestCheckResourceAttr(resourceName, "copy_tags_to_snapshot", "true"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccNeptuneCluster_serverlessConfiguration(t *testing.T) {
+	ctx := acctest.Context(t)
+	var v neptune.DBCluster
+	rName := sdkacctest.RandomWithPrefix("tf-acc")
+	resourceName := "aws_neptune_cluster.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, neptune.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckClusterDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccClusterConfig_serverlessConfiguration(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckClusterExists(ctx, resourceName, &v),
-					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
-					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1updated"),
-					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
+					resource.TestCheckResourceAttr(resourceName, "serverless_v2_scaling_configuration.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "serverless_v2_scaling_configuration.0.min_capacity", "4.5"),
+					resource.TestCheckResourceAttr(resourceName, "serverless_v2_scaling_configuration.0.max_capacity", "12.5"),
 				),
 			},
+			testAccClusterImportStep(resourceName),
+		},
+	})
+}
+
+func TestAccNeptuneCluster_takeFinalSnapshot(t *testing.T) {
+	ctx := acctest.Context(t)
+	var v neptune.DBCluster
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_neptune_cluster.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, neptune.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckClusterDestroyWithFinalSnapshot(ctx),
+		Steps: []resource.TestStep{
 			{
-				Config: testAccClusterConfig_tags1(rName, "key2", "value2"),
+				Config: testAccClusterConfig_finalSnapshot(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckClusterExists(ctx, resourceName, &v),
-					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
-					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
 				),
 			},
+			testAccClusterImportStep(resourceName),
 		},
 	})
 }
@@ -390,8 +464,9 @@ func TestAccNeptuneCluster_updateCloudWatchLogsExports(t *testing.T) {
 				Config: testAccClusterConfig_cloudWatchLogsExports(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckClusterExists(ctx, resourceName, &dbCluster),
-					resource.TestCheckResourceAttr(resourceName, "enable_cloudwatch_logs_exports.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "enable_cloudwatch_logs_exports.#", "2"),
 					resource.TestCheckTypeSetElemAttr(resourceName, "enable_cloudwatch_logs_exports.*", "audit"),
+					resource.TestCheckTypeSetElemAttr(resourceName, "enable_cloudwatch_logs_exports.*", "slowquery"),
 				),
 			},
 			{
@@ -419,18 +494,18 @@ func TestAccNeptuneCluster_updateEngineVersion(t *testing.T) {
 		CheckDestroy:             testAccCheckClusterDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccClusterConfig_engineVersion(rName, "1.0.4.1", "default.neptune1"),
+				Config: testAccClusterConfig_engineVersion(rName, "1.1.0.0", "default.neptune1"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckClusterExists(ctx, resourceName, &dbCluster),
-					resource.TestCheckResourceAttr(resourceName, "engine_version", "1.0.4.1"),
+					resource.TestCheckResourceAttr(resourceName, "engine_version", "1.1.0.0"),
 				),
 			},
 			testAccClusterImportStep(resourceName),
 			{
-				Config: testAccClusterConfig_engineVersion(rName, "1.0.5.1", "default.neptune1"),
+				Config: testAccClusterConfig_engineVersion(rName, "1.1.1.0", "default.neptune1"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckClusterExists(ctx, resourceName, &dbCluster),
-					resource.TestCheckResourceAttr(resourceName, "engine_version", "1.0.5.1"),
+					resource.TestCheckResourceAttr(resourceName, "engine_version", "1.1.1.0"),
 				),
 			},
 			testAccClusterImportStep(resourceName),
@@ -451,18 +526,18 @@ func TestAccNeptuneCluster_updateEngineMajorVersion(t *testing.T) {
 		CheckDestroy:             testAccCheckClusterDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccClusterConfig_engineVersion(rName, "1.0.4.1", "default.neptune1"),
+				Config: testAccClusterConfig_engineVersion(rName, "1.1.1.0", "default.neptune1"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckClusterExists(ctx, resourceName, &dbCluster),
-					resource.TestCheckResourceAttr(resourceName, "engine_version", "1.0.4.1"),
+					resource.TestCheckResourceAttr(resourceName, "engine_version", "1.1.1.0"),
 				),
 			},
 			testAccClusterImportStep(resourceName),
 			{
-				Config: testAccClusterConfig_engineMajorVersionUpdate(rName, "1.1.1.0", "default.neptune1"),
+				Config: testAccClusterConfig_engineMajorVersionUpdate(rName, "1.2.0.1", "default.neptune1.2"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckClusterExists(ctx, resourceName, &dbCluster),
-					resource.TestCheckResourceAttr(resourceName, "engine_version", "1.1.1.0"),
+					resource.TestCheckResourceAttr(resourceName, "engine_version", "1.2.0.1"),
 				),
 			},
 			testAccClusterImportStep(resourceName),
@@ -541,35 +616,12 @@ func TestAccNeptuneCluster_deleteProtection(t *testing.T) {
 	})
 }
 
-func TestAccNeptuneCluster_disappears(t *testing.T) {
-	ctx := acctest.Context(t)
-	var dbCluster neptune.DBCluster
-	rName := sdkacctest.RandomWithPrefix("tf-acc")
-	resourceName := "aws_neptune_cluster.test"
-
-	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, neptune.EndpointsID),
-		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckClusterDestroy(ctx),
-		Steps: []resource.TestStep{
-			{
-				Config: testAccClusterConfig_basic(rName),
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckClusterExists(ctx, resourceName, &dbCluster),
-					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfneptune.ResourceCluster(), resourceName),
-				),
-				ExpectNonEmptyPlan: true,
-			},
-		},
-	})
-}
-
 func TestAccNeptuneCluster_restoreFromSnapshot(t *testing.T) {
 	ctx := acctest.Context(t)
 	var dbCluster neptune.DBCluster
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_neptune_cluster.test"
+	keyResourceName := "aws_kms_key.test2"
 	parameterGroupResourceName := "aws_neptune_cluster_parameter_group.test"
 
 	resource.ParallelTest(t, resource.TestCase{
@@ -584,6 +636,7 @@ func TestAccNeptuneCluster_restoreFromSnapshot(t *testing.T) {
 					testAccCheckClusterExists(ctx, resourceName, &dbCluster),
 					resource.TestCheckResourceAttr(resourceName, "backup_retention_period", "5"),
 					resource.TestCheckResourceAttr(resourceName, "cluster_identifier", rName),
+					resource.TestCheckResourceAttrPair(resourceName, "kms_key_arn", keyResourceName, "arn"),
 					resource.TestCheckResourceAttrPair(resourceName, "neptune_cluster_parameter_group_name", parameterGroupResourceName, "id"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags.Name", rName),
@@ -610,7 +663,7 @@ func testAccCheckClusterDestroyWithProvider(ctx context.Context) acctest.TestChe
 				continue
 			}
 
-			_, err := tfneptune.FindClusterByID(ctx, conn, rs.Primary.ID)
+			_, err := tfneptune.FindDBClusterByID(ctx, conn, rs.Primary.ID)
 
 			if tfresource.NotFound(err) {
 				continue
@@ -644,7 +697,7 @@ func testAccCheckClusterExistsWithProvider(ctx context.Context, n string, v *nep
 
 		conn := providerF().Meta().(*conns.AWSClient).NeptuneConn(ctx)
 
-		output, err := tfneptune.FindClusterByID(ctx, conn, rs.Primary.ID)
+		output, err := tfneptune.FindDBClusterByID(ctx, conn, rs.Primary.ID)
 
 		if err != nil {
 			return err
@@ -680,7 +733,7 @@ func testAccCheckClusterDestroyWithFinalSnapshot(ctx context.Context) resource.T
 				return err
 			}
 
-			_, err = tfneptune.FindClusterByID(ctx, conn, rs.Primary.ID)
+			_, err = tfneptune.FindDBClusterByID(ctx, conn, rs.Primary.ID)
 
 			if tfresource.NotFound(err) {
 				continue
@@ -717,72 +770,74 @@ resource "aws_neptune_cluster" "test" {
 `, rName))
 }
 
-func testAccClusterConfig_copyTags(rName string, copy bool) string {
-	return acctest.ConfigCompose(testAccClusterConfig_base(), fmt.Sprintf(`
+func testAccClusterConfig_identifierGenerated() string {
+	return `
 resource "aws_neptune_cluster" "test" {
-  cluster_identifier                   = %[1]q
-  availability_zones                   = local.availability_zone_names
   engine                               = "neptune"
   neptune_cluster_parameter_group_name = "default.neptune1.2"
   skip_final_snapshot                  = true
-  copy_tags_to_snapshot                = %[2]t
 }
-`, rName, copy))
+`
 }
 
-func testAccClusterConfig_deleteProtection(rName string, isProtected bool) string {
-	return acctest.ConfigCompose(testAccClusterConfig_base(), fmt.Sprintf(`
+func testAccClusterConfig_identifierPrefix(prefix string) string {
+	return fmt.Sprintf(`
 resource "aws_neptune_cluster" "test" {
-  cluster_identifier                   = %[1]q
-  availability_zones                   = local.availability_zone_names
+  cluster_identifier_prefix            = %[1]q
   engine                               = "neptune"
   neptune_cluster_parameter_group_name = "default.neptune1.2"
   skip_final_snapshot                  = true
-  deletion_protection                  = %[2]t
 }
-`, rName, isProtected))
+`, prefix)
 }
 
-func testAccClusterConfig_namePrefix(rName string) string {
-	return fmt.Sprintf(`
+func testAccClusterConfig_tags1(rName, tagKey1, tagValue1 string) string {
+	return acctest.ConfigCompose(testAccClusterConfig_base(), fmt.Sprintf(`
 resource "aws_neptune_cluster" "test" {
-  cluster_identifier_prefix            = %[1]q
+  cluster_identifier                   = %[1]q
+  availability_zones                   = local.availability_zone_names
   engine                               = "neptune"
   neptune_cluster_parameter_group_name = "default.neptune1.2"
   skip_final_snapshot                  = true
+
+  tags = {
+    %[2]q = %[3]q
+  }
 }
-`, rName)
+`, rName, tagKey1, tagValue1))
 }
 
-func testAccClusterConfig_serverlessConfiguration(rName string) string {
-	return fmt.Sprintf(`
+func testAccClusterConfig_tags2(rName, tagKey1, tagValue1, tagKey2, tagValue2 string) string {
+	return acctest.ConfigCompose(testAccClusterConfig_base(), fmt.Sprintf(`
 resource "aws_neptune_cluster" "test" {
-  cluster_identifier_prefix            = %[1]q
+  cluster_identifier                   = %[1]q
+  availability_zones                   = local.availability_zone_names
   engine                               = "neptune"
-  engine_version                       = "1.2.0.1"
   neptune_cluster_parameter_group_name = "default.neptune1.2"
   skip_final_snapshot                  = true
 
-  serverless_v2_scaling_configuration {
-    min_capacity = 4.5
-    max_capacity = 12.5
+  tags = {
+    %[2]q = %[3]q
+    %[4]q = %[5]q
   }
 }
-`, rName)
+`, rName, tagKey1, tagValue1, tagKey2, tagValue2))
 }
 
-func testAccClusterConfig_finalSnapshot(rName string) string {
+func testAccClusterConfig_copyTags(rName string, copy bool) string {
 	return acctest.ConfigCompose(testAccClusterConfig_base(), fmt.Sprintf(`
 resource "aws_neptune_cluster" "test" {
   cluster_identifier                   = %[1]q
   availability_zones                   = local.availability_zone_names
+  engine                               = "neptune"
   neptune_cluster_parameter_group_name = "default.neptune1.2"
-  final_snapshot_identifier            = %[1]q
+  skip_final_snapshot                  = true
+  copy_tags_to_snapshot                = %[2]t
 }
-`, rName))
+`, rName, copy))
 }
 
-func testAccClusterConfig_tags1(rName, tagKey1, tagValue1 string) string {
+func testAccClusterConfig_deleteProtection(rName string, isProtected bool) string {
 	return acctest.ConfigCompose(testAccClusterConfig_base(), fmt.Sprintf(`
 resource "aws_neptune_cluster" "test" {
   cluster_identifier                   = %[1]q
@@ -790,29 +845,37 @@ resource "aws_neptune_cluster" "test" {
   engine                               = "neptune"
   neptune_cluster_parameter_group_name = "default.neptune1.2"
   skip_final_snapshot                  = true
+  deletion_protection                  = %[2]t
+}
+`, rName, isProtected))
+}
 
-  tags = {
-    %[2]q = %[3]q
+func testAccClusterConfig_serverlessConfiguration(rName string) string {
+	return fmt.Sprintf(`
+resource "aws_neptune_cluster" "test" {
+  cluster_identifier_prefix            = %[1]q
+  engine                               = "neptune"
+  engine_version                       = "1.2.0.1"
+  neptune_cluster_parameter_group_name = "default.neptune1.2"
+  skip_final_snapshot                  = true
+
+  serverless_v2_scaling_configuration {
+    min_capacity = 4.5
+    max_capacity = 12.5
   }
 }
-`, rName, tagKey1, tagValue1))
+`, rName)
 }
 
-func testAccClusterConfig_tags2(rName, tagKey1, tagValue1, tagKey2, tagValue2 string) string {
+func testAccClusterConfig_finalSnapshot(rName string) string {
 	return acctest.ConfigCompose(testAccClusterConfig_base(), fmt.Sprintf(`
 resource "aws_neptune_cluster" "test" {
   cluster_identifier                   = %[1]q
   availability_zones                   = local.availability_zone_names
-  engine                               = "neptune"
   neptune_cluster_parameter_group_name = "default.neptune1.2"
-  skip_final_snapshot                  = true
-
-  tags = {
-    %[2]q = %[3]q
-    %[4]q = %[5]q
-  }
+  final_snapshot_identifier            = %[1]q
 }
-`, rName, tagKey1, tagValue1, tagKey2, tagValue2))
+`, rName))
 }
 
 func testAccClusterConfig_includingIAMRoles(rName string) string {
@@ -1142,7 +1205,7 @@ resource "aws_neptune_cluster" "test" {
   cluster_identifier             = %[1]q
   availability_zones             = local.availability_zone_names
   skip_final_snapshot            = true
-  enable_cloudwatch_logs_exports = ["audit"]
+  enable_cloudwatch_logs_exports = ["audit", "slowquery"]
 
   neptune_cluster_parameter_group_name = "default.neptune1.2"
 }
@@ -1292,6 +1355,52 @@ resource "aws_neptune_cluster_instance" "secondary" {
 
 func testAccClusterConfig_restoreFromSnapshot(rName string) string {
 	return fmt.Sprintf(`
+resource "aws_kms_key" "test1" {
+  description = %[1]q
+
+  policy = <<POLICY
+{
+  "Version": "2012-10-17",
+  "Id": "kms-tf-1",
+  "Statement": [
+    {
+      "Sid": "Enable IAM User Permissions",
+      "Effect": "Allow",
+      "Principal": {
+        "AWS": "*"
+      },
+      "Action": "kms:*",
+      "Resource": "*"
+    }
+  ]
+}
+ POLICY
+
+}
+
+resource "aws_kms_key" "test2" {
+  description = %[1]q
+
+  policy = <<POLICY
+{
+  "Version": "2012-10-17",
+  "Id": "kms-tf-2",
+  "Statement": [
+    {
+      "Sid": "Enable IAM User Permissions",
+      "Effect": "Allow",
+      "Principal": {
+        "AWS": "*"
+      },
+      "Action": "kms:*",
+      "Resource": "*"
+    }
+  ]
+}
+ POLICY
+
+}
+
 resource "aws_default_vpc" "test" {}
 
 resource "aws_security_group" "test" {
@@ -1309,6 +1418,8 @@ resource "aws_neptune_cluster" "source" {
   cluster_identifier                   = "%[1]s-src"
   neptune_cluster_parameter_group_name = "default.neptune1.2"
   skip_final_snapshot                  = true
+  storage_encrypted                    = true
+  kms_key_arn                          = aws_kms_key.test1.arn
 }
 
 resource "aws_neptune_cluster_snapshot" "test" {
@@ -1327,10 +1438,11 @@ resource "aws_neptune_cluster_parameter_group" "test" {
 }
 
 resource "aws_neptune_cluster" "test" {
-  cluster_identifier  = %[1]q
-  skip_final_snapshot = true
-  snapshot_identifier = aws_neptune_cluster_snapshot.test.id
-
+  cluster_identifier                   = %[1]q
+  skip_final_snapshot                  = true
+  storage_encrypted                    = true
+  snapshot_identifier                  = aws_neptune_cluster_snapshot.test.id
+  kms_key_arn                          = aws_kms_key.test2.arn
   backup_retention_period              = 5
   neptune_cluster_parameter_group_name = aws_neptune_cluster_parameter_group.test.id
   vpc_security_group_ids               = aws_security_group.test[*].id
diff --git a/internal/service/neptune/consts.go b/internal/service/neptune/consts.go
index 5ad1d45d67a..274e10e636b 100644
--- a/internal/service/neptune/consts.go
+++ b/internal/service/neptune/consts.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package neptune
 
 import (
@@ -16,3 +19,7 @@ const (
 	GlobalClusterStatusModifying = "modifying"
 	GlobalClusterStatusUpgrading = "upgrading"
 )
+
+const (
+	errCodeInvalidParameterValue = "InvalidParameterValue"
+)
diff --git a/internal/service/neptune/engine_version_data_source.go b/internal/service/neptune/engine_version_data_source.go
index b0d73e404a5..b01b3d57052 100644
--- a/internal/service/neptune/engine_version_data_source.go
+++ b/internal/service/neptune/engine_version_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package neptune
 
 import (
diff --git a/internal/service/neptune/engine_version_data_source_test.go b/internal/service/neptune/engine_version_data_source_test.go
index 28f6b67d60e..dcd464096a5 100644
--- a/internal/service/neptune/engine_version_data_source_test.go
+++ b/internal/service/neptune/engine_version_data_source_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package neptune_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/neptune"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -16,7 +19,7 @@ import (
 func TestAccNeptuneEngineVersionDataSource_basic(t *testing.T) {
 	ctx := acctest.Context(t)
 	dataSourceName := "data.aws_neptune_engine_version.test"
-	version := "1.0.2.1"
+	version := "1.1.0.0"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccEngineVersionPreCheck(ctx, t) },
@@ -30,12 +33,12 @@ func TestAccNeptuneEngineVersionDataSource_basic(t *testing.T) {
 					resource.TestCheckResourceAttr(dataSourceName, "engine", "neptune"),
 					resource.TestCheckResourceAttr(dataSourceName, "version", version),
 					resource.TestCheckResourceAttrSet(dataSourceName, "engine_description"),
-					resource.TestMatchResourceAttr(dataSourceName, "exportable_log_types.#", regexp.MustCompile(`^[1-9][0-9]*`)),
+					resource.TestMatchResourceAttr(dataSourceName, "exportable_log_types.#", regexache.MustCompile(`^[1-9][0-9]*`)),
 					resource.TestCheckResourceAttrSet(dataSourceName, "parameter_group_family"),
-					resource.TestMatchResourceAttr(dataSourceName, "supported_timezones.#", regexp.MustCompile(`^[0-9][0-9]*`)),
+					resource.TestMatchResourceAttr(dataSourceName, "supported_timezones.#", regexache.MustCompile(`^[0-9][0-9]*`)),
 					resource.TestCheckResourceAttrSet(dataSourceName, "supports_log_exports_to_cloudwatch"),
 					resource.TestCheckResourceAttrSet(dataSourceName, "supports_read_replica"),
-					resource.TestMatchResourceAttr(dataSourceName, "valid_upgrade_targets.#", regexp.MustCompile(`^[1-9][0-9]*`)),
+					resource.TestMatchResourceAttr(dataSourceName, "valid_upgrade_targets.#", regexache.MustCompile(`^[1-9][0-9]*`)),
 					resource.TestCheckResourceAttrSet(dataSourceName, "version_description"),
 				),
 			},
@@ -57,7 +60,7 @@ func TestAccNeptuneEngineVersionDataSource_preferred(t *testing.T) {
 				Config: testAccEngineVersionDataSourceConfig_preferred(),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr(dataSourceName, "engine", "neptune"),
-					resource.TestCheckResourceAttr(dataSourceName, "version", "1.0.3.0"),
+					resource.TestCheckResourceAttr(dataSourceName, "version", "1.2.0.2"),
 				),
 			},
 		},
@@ -116,7 +119,7 @@ data "aws_neptune_engine_version" "test" {
 func testAccEngineVersionDataSourceConfig_preferred() string {
 	return `
 data "aws_neptune_engine_version" "test" {
-  preferred_versions = ["85.9.12", "1.0.3.0", "1.0.2.2"]
+  preferred_versions = ["85.9.12", "1.2.0.2", "1.1.0.0"]
 }
 `
 }
diff --git a/internal/service/neptune/event_subscription.go b/internal/service/neptune/event_subscription.go
index 78fff87c37d..b7db2ce3d6f 100644
--- a/internal/service/neptune/event_subscription.go
+++ b/internal/service/neptune/event_subscription.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package neptune
 
 import (
@@ -9,13 +12,14 @@ import (
 	"github.com/aws/aws-sdk-go/service/neptune"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/create"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
 	"github.com/hashicorp/terraform-provider-aws/internal/flex"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -28,6 +32,7 @@ func ResourceEventSubscription() *schema.Resource {
 		ReadWithoutTimeout:   resourceEventSubscriptionRead,
 		UpdateWithoutTimeout: resourceEventSubscriptionUpdate,
 		DeleteWithoutTimeout: resourceEventSubscriptionDelete,
+
 		Importer: &schema.ResourceImporter{
 			StateContext: schema.ImportStatePassthroughContext,
 		},
@@ -37,11 +42,26 @@ func ResourceEventSubscription() *schema.Resource {
 			Delete: schema.DefaultTimeout(40 * time.Minute),
 			Update: schema.DefaultTimeout(40 * time.Minute),
 		},
+
 		Schema: map[string]*schema.Schema{
 			"arn": {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
+			"customer_aws_id": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"enabled": {
+				Type:     schema.TypeBool,
+				Optional: true,
+				Default:  true,
+			},
+			"event_categories": {
+				Type:     schema.TypeSet,
+				Optional: true,
+				Elem:     &schema.Schema{Type: schema.TypeString},
+			},
 			"name": {
 				Type:          schema.TypeString,
 				Optional:      true,
@@ -63,31 +83,15 @@ func ResourceEventSubscription() *schema.Resource {
 				Required:     true,
 				ValidateFunc: verify.ValidARN,
 			},
-			"event_categories": {
-				Type:     schema.TypeSet,
-				Optional: true,
-				Elem:     &schema.Schema{Type: schema.TypeString},
-				Set:      schema.HashString,
-			},
 			"source_ids": {
 				Type:     schema.TypeSet,
 				Optional: true,
 				Elem:     &schema.Schema{Type: schema.TypeString},
-				Set:      schema.HashString,
 			},
 			"source_type": {
 				Type:     schema.TypeString,
 				Optional: true,
 			},
-			"enabled": {
-				Type:     schema.TypeBool,
-				Optional: true,
-				Default:  true,
-			},
-			"customer_aws_id": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
 			names.AttrTags:    tftags.TagsSchema(),
 			names.AttrTagsAll: tftags.TagsSchemaComputed(),
 		},
@@ -100,67 +104,40 @@ func resourceEventSubscriptionCreate(ctx context.Context, d *schema.ResourceData
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).NeptuneConn(ctx)
 
-	if v, ok := d.GetOk("name"); ok {
-		d.Set("name", v.(string))
-	} else if v, ok := d.GetOk("name_prefix"); ok {
-		d.Set("name", id.PrefixedUniqueId(v.(string)))
-	} else {
-		d.Set("name", id.PrefixedUniqueId("tf-"))
-	}
-
+	name := create.NewNameGenerator(
+		create.WithConfiguredName(d.Get("name").(string)),
+		create.WithConfiguredPrefix(d.Get("name_prefix").(string)),
+		create.WithDefaultPrefix("tf-"),
+	).Generate()
 	input := &neptune.CreateEventSubscriptionInput{
-		SubscriptionName: aws.String(d.Get("name").(string)),
-		SnsTopicArn:      aws.String(d.Get("sns_topic_arn").(string)),
 		Enabled:          aws.Bool(d.Get("enabled").(bool)),
+		SnsTopicArn:      aws.String(d.Get("sns_topic_arn").(string)),
+		SubscriptionName: aws.String(name),
 		Tags:             getTagsIn(ctx),
 	}
 
-	if v, ok := d.GetOk("source_ids"); ok {
-		sourceIdsSet := v.(*schema.Set)
-		sourceIds := make([]*string, sourceIdsSet.Len())
-		for i, sourceId := range sourceIdsSet.List() {
-			sourceIds[i] = aws.String(sourceId.(string))
-		}
-		input.SourceIds = sourceIds
+	if v, ok := d.GetOk("event_categories"); ok && v.(*schema.Set).Len() > 0 {
+		input.EventCategories = flex.ExpandStringSet(v.(*schema.Set))
 	}
 
-	if v, ok := d.GetOk("event_categories"); ok {
-		eventCategoriesSet := v.(*schema.Set)
-		eventCategories := make([]*string, eventCategoriesSet.Len())
-		for i, eventCategory := range eventCategoriesSet.List() {
-			eventCategories[i] = aws.String(eventCategory.(string))
-		}
-		input.EventCategories = eventCategories
+	if v, ok := d.GetOk("source_ids"); ok && v.(*schema.Set).Len() > 0 {
+		input.SourceIds = flex.ExpandStringSet(v.(*schema.Set))
 	}
 
 	if v, ok := d.GetOk("source_type"); ok {
 		input.SourceType = aws.String(v.(string))
 	}
 
-	log.Println("[DEBUG] Create Neptune Event Subscription:", input)
-
 	output, err := conn.CreateEventSubscriptionWithContext(ctx, input)
-	if err != nil || output.EventSubscription == nil {
-		return sdkdiag.AppendErrorf(diags, "creating Neptune Event Subscription %s: %s", d.Get("name").(string), err)
+
+	if err != nil {
+		return diag.Errorf("creating Neptune Event Subscription (%s): %s", name, err)
 	}
 
 	d.SetId(aws.StringValue(output.EventSubscription.CustSubscriptionId))
 
-	log.Println("[INFO] Waiting for Neptune Event Subscription to be ready")
-
-	stateConf := &retry.StateChangeConf{
-		Pending:    []string{"creating"},
-		Target:     []string{"active"},
-		Refresh:    resourceEventSubscriptionRefreshFunc(ctx, d.Id(), conn),
-		Timeout:    d.Timeout(schema.TimeoutCreate),
-		MinTimeout: 10 * time.Second,
-		Delay:      30 * time.Second,
-	}
-
-	// Wait, catching any errors
-	_, err = stateConf.WaitForStateContext(ctx)
-	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "waiting for Neptune Event Subscription state to be \"active\": %s", err)
+	if _, err := waitEventSubscriptionCreated(ctx, conn, d.Id(), d.Timeout(schema.TimeoutCreate)); err != nil {
+		return diag.Errorf("waiting for Neptune Event Subscription (%s) create: %s", d.Id(), err)
 	}
 
 	return append(diags, resourceEventSubscriptionRead(ctx, d, meta)...)
@@ -170,35 +147,27 @@ func resourceEventSubscriptionRead(ctx context.Context, d *schema.ResourceData,
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).NeptuneConn(ctx)
 
-	sub, err := resourceEventSubscriptionRetrieve(ctx, d.Id(), conn)
-	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "reading Neptune Event Subscription %s: %s", d.Id(), err)
-	}
+	output, err := FindEventSubscriptionByName(ctx, conn, d.Id())
 
-	if sub == nil {
-		log.Printf("[DEBUG] Neptune Event Subscription (%s) not found - removing from state", d.Id())
+	if !d.IsNewResource() && tfresource.NotFound(err) {
+		log.Printf("[WARN] Neptune Event Subscription (%s) not found, removing from state", d.Id())
 		d.SetId("")
-		return diags
+		return nil
 	}
 
-	d.Set("arn", sub.EventSubscriptionArn)
-	d.Set("name", sub.CustSubscriptionId)
-	d.Set("sns_topic_arn", sub.SnsTopicArn)
-	d.Set("enabled", sub.Enabled)
-	d.Set("customer_aws_id", sub.CustomerAwsId)
-	d.Set("source_type", sub.SourceType)
-
-	if sub.SourceIdsList != nil {
-		if err := d.Set("source_ids", flex.FlattenStringList(sub.SourceIdsList)); err != nil {
-			return sdkdiag.AppendErrorf(diags, "saving Source IDs to state for Neptune Event Subscription (%s): %s", d.Id(), err)
-		}
+	if err != nil {
+		return diag.Errorf("reading Neptune Event Subscription (%s): %s", d.Id(), err)
 	}
 
-	if sub.EventCategoriesList != nil {
-		if err := d.Set("event_categories", flex.FlattenStringList(sub.EventCategoriesList)); err != nil {
-			return sdkdiag.AppendErrorf(diags, "saving Event Categories to state for Neptune Event Subscription (%s): %s", d.Id(), err)
-		}
-	}
+	d.Set("arn", output.EventSubscriptionArn)
+	d.Set("customer_aws_id", output.CustomerAwsId)
+	d.Set("enabled", output.Enabled)
+	d.Set("event_categories", aws.StringValueSlice(output.EventCategoriesList))
+	d.Set("name", output.CustSubscriptionId)
+	d.Set("name_prefix", create.NamePrefixFromName(aws.StringValue(output.CustSubscriptionId)))
+	d.Set("sns_topic_arn", output.SnsTopicArn)
+	d.Set("source_ids", aws.StringValueSlice(output.SourceIdsList))
+	d.Set("source_type", output.SourceType)
 
 	return diags
 }
@@ -207,60 +176,36 @@ func resourceEventSubscriptionUpdate(ctx context.Context, d *schema.ResourceData
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).NeptuneConn(ctx)
 
-	requestUpdate := false
-
-	req := &neptune.ModifyEventSubscriptionInput{
-		SubscriptionName: aws.String(d.Id()),
-	}
-
-	if d.HasChange("event_categories") {
-		eventCategoriesSet := d.Get("event_categories").(*schema.Set)
-		req.EventCategories = make([]*string, eventCategoriesSet.Len())
-		for i, eventCategory := range eventCategoriesSet.List() {
-			req.EventCategories[i] = aws.String(eventCategory.(string))
+	if d.HasChangesExcept("tags", "tags_all", "source_ids") {
+		input := &neptune.ModifyEventSubscriptionInput{
+			SubscriptionName: aws.String(d.Id()),
 		}
-		req.SourceType = aws.String(d.Get("source_type").(string))
-		requestUpdate = true
-	}
 
-	if d.HasChange("enabled") {
-		req.Enabled = aws.Bool(d.Get("enabled").(bool))
-		requestUpdate = true
-	}
+		if d.HasChange("enabled") {
+			input.Enabled = aws.Bool(d.Get("enabled").(bool))
+		}
 
-	if d.HasChange("sns_topic_arn") {
-		req.SnsTopicArn = aws.String(d.Get("sns_topic_arn").(string))
-		requestUpdate = true
-	}
+		if d.HasChange("event_categories") {
+			input.EventCategories = flex.ExpandStringSet(d.Get("event_categories").(*schema.Set))
+			input.SourceType = aws.String(d.Get("source_type").(string))
+		}
 
-	if d.HasChange("source_type") {
-		req.SourceType = aws.String(d.Get("source_type").(string))
-		requestUpdate = true
-	}
+		if d.HasChange("sns_topic_arn") {
+			input.SnsTopicArn = aws.String(d.Get("sns_topic_arn").(string))
+		}
 
-	log.Printf("[DEBUG] Send Neptune Event Subscription modification request: %#v", requestUpdate)
-	if requestUpdate {
-		log.Printf("[DEBUG] Neptune Event Subscription modification request: %#v", req)
-		_, err := conn.ModifyEventSubscriptionWithContext(ctx, req)
-		if err != nil {
-			return sdkdiag.AppendErrorf(diags, "updating Neptune Event Subscription (%s): %s", d.Id(), err)
+		if d.HasChange("source_type") {
+			input.SourceType = aws.String(d.Get("source_type").(string))
 		}
 
-		log.Println("[INFO] Waiting for Neptune Event Subscription modification to finish")
+		_, err := conn.ModifyEventSubscriptionWithContext(ctx, input)
 
-		stateConf := &retry.StateChangeConf{
-			Pending:    []string{"modifying"},
-			Target:     []string{"active"},
-			Refresh:    resourceEventSubscriptionRefreshFunc(ctx, d.Id(), conn),
-			Timeout:    d.Timeout(schema.TimeoutUpdate),
-			MinTimeout: 10 * time.Second,
-			Delay:      30 * time.Second,
+		if err != nil {
+			return diag.Errorf("updating Neptune Event Subscription (%s): %s", d.Id(), err)
 		}
 
-		// Wait, catching any errors
-		_, err = stateConf.WaitForStateContext(ctx)
-		if err != nil {
-			return sdkdiag.AppendErrorf(diags, "updating Neptune Event Subscription (%s): waiting for completion: %s", d.Id(), err)
+		if _, err := waitEventSubscriptionUpdated(ctx, conn, d.Id(), d.Timeout(schema.TimeoutUpdate)); err != nil {
+			return diag.Errorf("waiting for Neptune Event Subscription (%s) update: %s", d.Id(), err)
 		}
 	}
 
@@ -279,27 +224,27 @@ func resourceEventSubscriptionUpdate(ctx context.Context, d *schema.ResourceData
 		add := flex.ExpandStringSet(ns.Difference(os))
 
 		if len(remove) > 0 {
-			for _, removing := range remove {
-				log.Printf("[INFO] Removing %s as a Source Identifier from %q", *removing, d.Id())
+			for _, v := range remove {
 				_, err := conn.RemoveSourceIdentifierFromSubscriptionWithContext(ctx, &neptune.RemoveSourceIdentifierFromSubscriptionInput{
-					SourceIdentifier: removing,
+					SourceIdentifier: v,
 					SubscriptionName: aws.String(d.Id()),
 				})
+
 				if err != nil {
-					return sdkdiag.AppendErrorf(diags, "updating Neptune Event Subscription (%s): removing Source Identifier (%s): %s", d.Id(), aws.StringValue(removing), err)
+					return diag.Errorf("removing Neptune Event Subscription (%s) source identifier: %s", d.Id(), err)
 				}
 			}
 		}
 
 		if len(add) > 0 {
-			for _, adding := range add {
-				log.Printf("[INFO] Adding %s as a Source Identifier to %q", *adding, d.Id())
+			for _, v := range add {
 				_, err := conn.AddSourceIdentifierToSubscriptionWithContext(ctx, &neptune.AddSourceIdentifierToSubscriptionInput{
-					SourceIdentifier: adding,
+					SourceIdentifier: v,
 					SubscriptionName: aws.String(d.Id()),
 				})
+
 				if err != nil {
-					return sdkdiag.AppendErrorf(diags, "updating Neptune Event Subscription (%s): adding Source Identifier (%s): %s", d.Id(), aws.StringValue(adding), err)
+					return diag.Errorf("adding Neptune Event Subscription (%s) source identifier: %s", d.Id(), err)
 				}
 			}
 		}
@@ -325,63 +270,143 @@ func resourceEventSubscriptionDelete(ctx context.Context, d *schema.ResourceData
 		return sdkdiag.AppendErrorf(diags, "deleting Neptune Event Subscription (%s): %s", d.Id(), err)
 	}
 
-	stateConf := &retry.StateChangeConf{
-		Pending:    []string{"deleting"},
-		Target:     []string{},
-		Refresh:    resourceEventSubscriptionRefreshFunc(ctx, d.Id(), conn),
-		Timeout:    d.Timeout(schema.TimeoutDelete),
-		MinTimeout: 10 * time.Second,
-		Delay:      30 * time.Second,
+	if _, err := waitEventSubscriptionDeleted(ctx, conn, d.Id(), d.Timeout(schema.TimeoutDelete)); err != nil {
+		return diag.Errorf("waiting for Neptune Event Subscription (%s) delete: %s", d.Id(), err)
 	}
 
-	_, err = stateConf.WaitForStateContext(ctx)
+	return diags
+}
+
+func FindEventSubscriptionByName(ctx context.Context, conn *neptune.Neptune, name string) (*neptune.EventSubscription, error) {
+	input := &neptune.DescribeEventSubscriptionsInput{
+		SubscriptionName: aws.String(name),
+	}
+	output, err := findEventSubscription(ctx, conn, input)
 
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "waiting for Neptune Event Subscription (%s) delete: %s", d.Id(), err)
+		return nil, err
 	}
 
-	return diags
+	// Eventual consistency check.
+	if aws.StringValue(output.CustSubscriptionId) != name {
+		return nil, &retry.NotFoundError{
+			LastRequest: input,
+		}
+	}
+
+	return output, nil
 }
 
-func resourceEventSubscriptionRefreshFunc(ctx context.Context, name string, conn *neptune.Neptune) retry.StateRefreshFunc {
-	return func() (interface{}, string, error) {
-		sub, err := resourceEventSubscriptionRetrieve(ctx, name, conn)
+func findEventSubscription(ctx context.Context, conn *neptune.Neptune, input *neptune.DescribeEventSubscriptionsInput) (*neptune.EventSubscription, error) {
+	output, err := findEventSubscriptions(ctx, conn, input)
 
-		if err != nil {
-			log.Printf("Error on retrieving Neptune Event Subscription when waiting: %s", err)
-			return nil, "", err
+	if err != nil {
+		return nil, err
+	}
+
+	return tfresource.AssertSinglePtrResult(output)
+}
+
+func findEventSubscriptions(ctx context.Context, conn *neptune.Neptune, input *neptune.DescribeEventSubscriptionsInput) ([]*neptune.EventSubscription, error) {
+	var output []*neptune.EventSubscription
+
+	err := conn.DescribeEventSubscriptionsPagesWithContext(ctx, input, func(page *neptune.DescribeEventSubscriptionsOutput, lastPage bool) bool {
+		if page == nil {
+			return !lastPage
+		}
+
+		for _, v := range page.EventSubscriptionsList {
+			if v != nil {
+				output = append(output, v)
+			}
+		}
+
+		return !lastPage
+	})
+
+	if tfawserr.ErrCodeEquals(err, neptune.ErrCodeSubscriptionNotFoundFault) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
 		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
 
-		if sub == nil {
+	return output, nil
+}
+
+func statusEventSubscription(ctx context.Context, conn *neptune.Neptune, name string) retry.StateRefreshFunc {
+	return func() (interface{}, string, error) {
+		output, err := FindEventSubscriptionByName(ctx, conn, name)
+
+		if tfresource.NotFound(err) {
 			return nil, "", nil
 		}
 
-		if sub.Status != nil {
-			log.Printf("[DEBUG] Neptune Event Subscription status for %s: %s", name, aws.StringValue(sub.Status))
+		if err != nil {
+			return nil, "", err
 		}
 
-		return sub, aws.StringValue(sub.Status), nil
+		return output, aws.StringValue(output.Status), nil
 	}
 }
 
-func resourceEventSubscriptionRetrieve(ctx context.Context, name string, conn *neptune.Neptune) (*neptune.EventSubscription, error) {
-	request := &neptune.DescribeEventSubscriptionsInput{
-		SubscriptionName: aws.String(name),
+func waitEventSubscriptionCreated(ctx context.Context, conn *neptune.Neptune, name string, timeout time.Duration) (*neptune.EventSubscription, error) {
+	stateConf := &retry.StateChangeConf{
+		Pending:    []string{"creating"},
+		Target:     []string{"active"},
+		Refresh:    statusEventSubscription(ctx, conn, name),
+		Timeout:    timeout,
+		MinTimeout: 10 * time.Second,
+		Delay:      30 * time.Second,
 	}
 
-	describeResp, err := conn.DescribeEventSubscriptionsWithContext(ctx, request)
-	if err != nil {
-		if tfawserr.ErrCodeEquals(err, neptune.ErrCodeSubscriptionNotFoundFault) {
-			log.Printf("[DEBUG] Neptune Event Subscription (%s) not found", name)
-			return nil, nil
-		}
-		return nil, err
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+
+	if output, ok := outputRaw.(*neptune.EventSubscription); ok {
+		return output, err
 	}
 
-	if len(describeResp.EventSubscriptionsList) != 1 ||
-		aws.StringValue(describeResp.EventSubscriptionsList[0].CustSubscriptionId) != name {
-		return nil, nil
+	return nil, err
+}
+
+func waitEventSubscriptionUpdated(ctx context.Context, conn *neptune.Neptune, name string, timeout time.Duration) (*neptune.EventSubscription, error) {
+	stateConf := &retry.StateChangeConf{
+		Pending:    []string{"modifying"},
+		Target:     []string{"active"},
+		Refresh:    statusEventSubscription(ctx, conn, name),
+		Timeout:    timeout,
+		MinTimeout: 10 * time.Second,
+		Delay:      30 * time.Second,
+	}
+
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+
+	if output, ok := outputRaw.(*neptune.EventSubscription); ok {
+		return output, err
+	}
+
+	return nil, err
+}
+
+func waitEventSubscriptionDeleted(ctx context.Context, conn *neptune.Neptune, name string, timeout time.Duration) (*neptune.EventSubscription, error) {
+	stateConf := &retry.StateChangeConf{
+		Pending:    []string{"deleting"},
+		Target:     []string{},
+		Refresh:    statusEventSubscription(ctx, conn, name),
+		Timeout:    timeout,
+		MinTimeout: 10 * time.Second,
+		Delay:      30 * time.Second,
+	}
+
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+
+	if output, ok := outputRaw.(*neptune.EventSubscription); ok {
+		return output, err
 	}
 
-	return describeResp.EventSubscriptionsList[0], nil
+	return nil, err
 }
diff --git a/internal/service/neptune/event_subscription_test.go b/internal/service/neptune/event_subscription_test.go
index 64ff99dd411..ca600cf3520 100644
--- a/internal/service/neptune/event_subscription_test.go
+++ b/internal/service/neptune/event_subscription_test.go
@@ -1,27 +1,27 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package neptune_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/neptune"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	tfneptune "github.com/hashicorp/terraform-provider-aws/internal/service/neptune"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
 func TestAccNeptuneEventSubscription_basic(t *testing.T) {
 	ctx := acctest.Context(t)
 	var v neptune.EventSubscription
-	rInt := sdkacctest.RandInt()
-	rName := fmt.Sprintf("tf-acc-test-neptune-event-subs-%d", rInt)
-
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_neptune_event_subscription.test"
 
 	resource.ParallelTest(t, resource.TestCase{
@@ -31,25 +31,76 @@ func TestAccNeptuneEventSubscription_basic(t *testing.T) {
 		CheckDestroy:             testAccCheckEventSubscriptionDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccEventSubscriptionConfig_basic(rName, rInt),
+				Config: testAccEventSubscriptionConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckEventSubscriptionExists(ctx, resourceName, &v),
 					acctest.CheckResourceAttrRegionalARN(resourceName, "arn", "rds", fmt.Sprintf("es:%s", rName)),
 					resource.TestCheckResourceAttr(resourceName, "enabled", "true"),
 					resource.TestCheckResourceAttr(resourceName, "source_type", "db-instance"),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
-					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
-					resource.TestCheckResourceAttr(resourceName, "tags.Name", acctest.ResourcePrefix),
+					resource.TestCheckResourceAttr(resourceName, "name_prefix", ""),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 				),
 			},
 			{
-				Config: testAccEventSubscriptionConfig_update(rName, rInt),
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				Config: testAccEventSubscriptionConfig_update(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckEventSubscriptionExists(ctx, resourceName, &v),
 					resource.TestCheckResourceAttr(resourceName, "enabled", "false"),
 					resource.TestCheckResourceAttr(resourceName, "source_type", "db-parameter-group"),
-					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
-					resource.TestCheckResourceAttr(resourceName, "tags.Name", "tf-acc-test1"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccNeptuneEventSubscription_disappears(t *testing.T) {
+	ctx := acctest.Context(t)
+	var v neptune.EventSubscription
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_neptune_event_subscription.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, neptune.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckEventSubscriptionDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccEventSubscriptionConfig_basic(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckEventSubscriptionExists(ctx, resourceName, &v),
+					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfneptune.ResourceEventSubscription(), resourceName),
+				),
+				ExpectNonEmptyPlan: true,
+			},
+		},
+	})
+}
+
+func TestAccNeptuneEventSubscription_nameGenerated(t *testing.T) {
+	ctx := acctest.Context(t)
+	var v neptune.EventSubscription
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_neptune_event_subscription.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, neptune.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckEventSubscriptionDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccEventSubscriptionConfig_nameGenerated(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckEventSubscriptionExists(ctx, resourceName, &v),
+					acctest.CheckResourceAttrNameGeneratedWithPrefix(resourceName, "name", "tf-"),
+					resource.TestCheckResourceAttr(resourceName, "name_prefix", "tf-"),
 				),
 			},
 			{
@@ -61,12 +112,39 @@ func TestAccNeptuneEventSubscription_basic(t *testing.T) {
 	})
 }
 
-func TestAccNeptuneEventSubscription_withPrefix(t *testing.T) {
+func TestAccNeptuneEventSubscription_namePrefix(t *testing.T) {
 	ctx := acctest.Context(t)
 	var v neptune.EventSubscription
-	rInt := sdkacctest.RandInt()
-	startsWithPrefix := regexp.MustCompile("^tf-acc-test-neptune-event-subs-")
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_neptune_event_subscription.test"
 
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, neptune.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckEventSubscriptionDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccEventSubscriptionConfig_namePrefix(rName, "tf-acc-test-prefix-"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckEventSubscriptionExists(ctx, resourceName, &v),
+					acctest.CheckResourceAttrNameFromPrefix(resourceName, "name", "tf-acc-test-prefix-"),
+					resource.TestCheckResourceAttr(resourceName, "name_prefix", "tf-acc-test-prefix-"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
+func TestAccNeptuneEventSubscription_tags(t *testing.T) {
+	ctx := acctest.Context(t)
+	var v neptune.EventSubscription
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_neptune_event_subscription.test"
 
 	resource.ParallelTest(t, resource.TestCase{
@@ -76,17 +154,34 @@ func TestAccNeptuneEventSubscription_withPrefix(t *testing.T) {
 		CheckDestroy:             testAccCheckEventSubscriptionDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccEventSubscriptionConfig_prefix(rInt),
+				Config: testAccEventSubscriptionConfig_tags1(rName, "key1", "value1"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckEventSubscriptionExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				Config: testAccEventSubscriptionConfig_tags2(rName, "key1", "value1updated", "key2", "value2"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckEventSubscriptionExists(ctx, resourceName, &v),
-					resource.TestMatchResourceAttr(resourceName, "name", startsWithPrefix),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1updated"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
 				),
 			},
 			{
-				ResourceName:            resourceName,
-				ImportState:             true,
-				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"name_prefix"},
+				Config: testAccEventSubscriptionConfig_tags1(rName, "key2", "value2"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckEventSubscriptionExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
+				),
 			},
 		},
 	})
@@ -95,8 +190,7 @@ func TestAccNeptuneEventSubscription_withPrefix(t *testing.T) {
 func TestAccNeptuneEventSubscription_withSourceIDs(t *testing.T) {
 	ctx := acctest.Context(t)
 	var v neptune.EventSubscription
-	rInt := sdkacctest.RandInt()
-
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_neptune_event_subscription.test"
 
 	resource.ParallelTest(t, resource.TestCase{
@@ -106,7 +200,7 @@ func TestAccNeptuneEventSubscription_withSourceIDs(t *testing.T) {
 		CheckDestroy:             testAccCheckEventSubscriptionDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccEventSubscriptionConfig_sourceIDs(rInt),
+				Config: testAccEventSubscriptionConfig_sourceIDs(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckEventSubscriptionExists(ctx, resourceName, &v),
 					resource.TestCheckResourceAttr(resourceName, "source_type", "db-parameter-group"),
@@ -114,18 +208,13 @@ func TestAccNeptuneEventSubscription_withSourceIDs(t *testing.T) {
 				),
 			},
 			{
-				Config: testAccEventSubscriptionConfig_updateSourceIDs(rInt),
+				Config: testAccEventSubscriptionConfig_updateSourceIDs(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckEventSubscriptionExists(ctx, resourceName, &v),
 					resource.TestCheckResourceAttr(resourceName, "source_type", "db-parameter-group"),
 					resource.TestCheckResourceAttr(resourceName, "source_ids.#", "2"),
 				),
 			},
-			{
-				ResourceName:      resourceName,
-				ImportState:       true,
-				ImportStateVerify: true,
-			},
 		},
 	})
 }
@@ -133,9 +222,7 @@ func TestAccNeptuneEventSubscription_withSourceIDs(t *testing.T) {
 func TestAccNeptuneEventSubscription_withCategories(t *testing.T) {
 	ctx := acctest.Context(t)
 	var v neptune.EventSubscription
-	rInt := sdkacctest.RandInt()
-	rName := fmt.Sprintf("tf-acc-test-neptune-event-subs-%d", rInt)
-
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_neptune_event_subscription.test"
 
 	resource.ParallelTest(t, resource.TestCase{
@@ -145,7 +232,7 @@ func TestAccNeptuneEventSubscription_withCategories(t *testing.T) {
 		CheckDestroy:             testAccCheckEventSubscriptionDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccEventSubscriptionConfig_basic(rName, rInt),
+				Config: testAccEventSubscriptionConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckEventSubscriptionExists(ctx, resourceName, &v),
 					resource.TestCheckResourceAttr(resourceName, "source_type", "db-instance"),
@@ -153,18 +240,13 @@ func TestAccNeptuneEventSubscription_withCategories(t *testing.T) {
 				),
 			},
 			{
-				Config: testAccEventSubscriptionConfig_updateCategories(rName, rInt),
+				Config: testAccEventSubscriptionConfig_updateCategories(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckEventSubscriptionExists(ctx, resourceName, &v),
 					resource.TestCheckResourceAttr(resourceName, "source_type", "db-instance"),
 					resource.TestCheckResourceAttr(resourceName, "event_categories.#", "1"),
 				),
 			},
-			{
-				ResourceName:      resourceName,
-				ImportState:       true,
-				ImportStateVerify: true,
-			},
 		},
 	})
 }
@@ -176,28 +258,16 @@ func testAccCheckEventSubscriptionExists(ctx context.Context, n string, v *neptu
 			return fmt.Errorf("Not found: %s", n)
 		}
 
-		if rs.Primary.ID == "" {
-			return fmt.Errorf("No Neptune Event Subscription is set")
-		}
-
 		conn := acctest.Provider.Meta().(*conns.AWSClient).NeptuneConn(ctx)
 
-		opts := neptune.DescribeEventSubscriptionsInput{
-			SubscriptionName: aws.String(rs.Primary.ID),
-		}
-
-		resp, err := conn.DescribeEventSubscriptionsWithContext(ctx, &opts)
+		output, err := tfneptune.FindEventSubscriptionByName(ctx, conn, rs.Primary.ID)
 
 		if err != nil {
 			return err
 		}
 
-		if len(resp.EventSubscriptionsList) != 1 ||
-			aws.StringValue(resp.EventSubscriptionsList[0].CustSubscriptionId) != rs.Primary.ID {
-			return fmt.Errorf("Neptune Event Subscription not found")
-		}
+		*v = *output
 
-		*v = *resp.EventSubscriptionsList[0]
 		return nil
 	}
 }
@@ -211,12 +281,9 @@ func testAccCheckEventSubscriptionDestroy(ctx context.Context) resource.TestChec
 				continue
 			}
 
-			var err error
-			resp, err := conn.DescribeEventSubscriptionsWithContext(ctx, &neptune.DescribeEventSubscriptionsInput{
-				SubscriptionName: aws.String(rs.Primary.ID),
-			})
+			_, err := tfneptune.FindEventSubscriptionByName(ctx, conn, rs.Primary.ID)
 
-			if tfawserr.ErrCodeEquals(err, neptune.ErrCodeSubscriptionNotFoundFault) {
+			if tfresource.NotFound(err) {
 				continue
 			}
 
@@ -224,25 +291,22 @@ func testAccCheckEventSubscriptionDestroy(ctx context.Context) resource.TestChec
 				return err
 			}
 
-			if len(resp.EventSubscriptionsList) != 0 &&
-				aws.StringValue(resp.EventSubscriptionsList[0].CustSubscriptionId) == rs.Primary.ID {
-				return fmt.Errorf("Event Subscription still exists")
-			}
+			return fmt.Errorf("Neptune Event Subscription %s still exists", rs.Primary.ID)
 		}
 
 		return nil
 	}
 }
 
-func testAccEventSubscriptionConfig_basic(subscriptionName string, rInt int) string {
+func testAccEventSubscriptionConfig_basic(rName string) string {
 	return fmt.Sprintf(`
-resource "aws_sns_topic" "aws_sns_topic" {
-  name = "tf-acc-test-neptune-event-subs-sns-topic-%[1]d"
+resource "aws_sns_topic" "test" {
+  name = %[1]q
 }
 
 resource "aws_neptune_event_subscription" "test" {
-  name          = %[2]q
-  sns_topic_arn = aws_sns_topic.aws_sns_topic.arn
+  name          = %[1]q
+  sns_topic_arn = aws_sns_topic.test.arn
   source_type   = "db-instance"
 
   event_categories = [
@@ -252,46 +316,59 @@ resource "aws_neptune_event_subscription" "test" {
     "deletion",
     "maintenance",
   ]
-
-  tags = {
-    Name = "tf-acc-test"
-  }
 }
-`, rInt, subscriptionName)
+`, rName)
 }
 
-func testAccEventSubscriptionConfig_update(subscriptionName string, rInt int) string {
+func testAccEventSubscriptionConfig_update(rName string) string {
 	return fmt.Sprintf(`
-resource "aws_sns_topic" "aws_sns_topic" {
-  name = "tf-acc-test-neptune-event-subs-sns-topic-%[1]d"
+resource "aws_sns_topic" "test" {
+  name = %[1]q
 }
 
 resource "aws_neptune_event_subscription" "test" {
-  name          = %[2]q
-  sns_topic_arn = aws_sns_topic.aws_sns_topic.arn
+  name          = %[1]q
+  sns_topic_arn = aws_sns_topic.test.arn
   enabled       = false
   source_type   = "db-parameter-group"
 
   event_categories = [
     "configuration change",
   ]
+}
+`, rName)
+}
 
-  tags = {
-    Name = "tf-acc-test1"
-  }
+func testAccEventSubscriptionConfig_nameGenerated(rName string) string {
+	return fmt.Sprintf(`
+resource "aws_sns_topic" "test" {
+  name = %[1]q
+}
+
+resource "aws_neptune_event_subscription" "test" {
+  sns_topic_arn = aws_sns_topic.test.arn
+  source_type   = "db-instance"
+
+  event_categories = [
+    "availability",
+    "backup",
+    "creation",
+    "deletion",
+    "maintenance",
+  ]
 }
-`, rInt, subscriptionName)
+`, rName)
 }
 
-func testAccEventSubscriptionConfig_prefix(rInt int) string {
+func testAccEventSubscriptionConfig_namePrefix(rName, namePrefix string) string {
 	return fmt.Sprintf(`
-resource "aws_sns_topic" "aws_sns_topic" {
-  name = "tf-acc-test-neptune-event-subs-sns-topic-%d"
+resource "aws_sns_topic" "test" {
+  name = %[1]q
 }
 
 resource "aws_neptune_event_subscription" "test" {
-  name_prefix   = "tf-acc-test-neptune-event-subs-"
-  sns_topic_arn = aws_sns_topic.aws_sns_topic.arn
+  name_prefix   = %[2]q
+  sns_topic_arn = aws_sns_topic.test.arn
   source_type   = "db-instance"
 
   event_categories = [
@@ -301,96 +378,117 @@ resource "aws_neptune_event_subscription" "test" {
     "deletion",
     "maintenance",
   ]
+}
+`, rName, namePrefix)
+}
+
+func testAccEventSubscriptionConfig_tags1(rName, tagKey1, tagValue1 string) string {
+	return fmt.Sprintf(`
+resource "aws_sns_topic" "test" {
+  name = %[1]q
+}
+
+resource "aws_neptune_event_subscription" "test" {
+  name          = %[1]q
+  sns_topic_arn = aws_sns_topic.test.arn
+  enabled       = false
+  source_type   = "db-parameter-group"
+
+  event_categories = [
+    "configuration change",
+  ]
 
   tags = {
-    Name = "tf-acc-test"
+    %[2]q = %[3]q
   }
 }
-`, rInt)
+`, rName, tagKey1, tagValue1)
 }
 
-func testAccEventSubscriptionConfig_sourceIDs(rInt int) string {
+func testAccEventSubscriptionConfig_tags2(rName, tagKey1, tagValue1, tagKey2, tagValue2 string) string {
 	return fmt.Sprintf(`
-resource "aws_sns_topic" "aws_sns_topic" {
-  name = "tf-acc-test-neptune-event-subs-sns-topic-%[1]d"
-}
-
-resource "aws_neptune_parameter_group" "test" {
-  name        = "neptune-parameter-group-event-%[1]d"
-  family      = "neptune1"
-  description = "Test parameter group for terraform"
+resource "aws_sns_topic" "test" {
+  name = %[1]q
 }
 
 resource "aws_neptune_event_subscription" "test" {
-  name          = "tf-acc-test-neptune-event-subs-with-ids-%[1]d"
-  sns_topic_arn = aws_sns_topic.aws_sns_topic.arn
+  name          = %[1]q
+  sns_topic_arn = aws_sns_topic.test.arn
+  enabled       = false
   source_type   = "db-parameter-group"
-  source_ids    = [aws_neptune_parameter_group.test.id]
 
   event_categories = [
     "configuration change",
   ]
 
   tags = {
-    Name = "tf-acc-test"
+    %[2]q = %[3]q
+    %[4]q = %[5]q
   }
 }
-`, rInt)
+`, rName, tagKey1, tagValue1, tagKey2, tagValue2)
 }
 
-func testAccEventSubscriptionConfig_updateSourceIDs(rInt int) string {
+func testAccEventSubscriptionConfig_baseSourceIDs(rName string) string {
 	return fmt.Sprintf(`
-resource "aws_sns_topic" "aws_sns_topic" {
-  name = "tf-acc-test-neptune-event-subs-sns-topic-%[1]d"
+resource "aws_sns_topic" "test" {
+  name = %[1]q
 }
 
 resource "aws_neptune_parameter_group" "test" {
-  name        = "neptune-parameter-group-event-%[1]d"
-  family      = "neptune1"
-  description = "Test parameter group for terraform"
-}
+  count = 2
 
-resource "aws_neptune_parameter_group" "test_2" {
-  name        = "neptune-parameter-group-event-2-%[1]d"
-  family      = "neptune1"
-  description = "Test parameter group for terraform"
+  name   = "%[1]s-${count.index}"
+  family = "neptune1"
+}
+`, rName)
 }
 
+func testAccEventSubscriptionConfig_sourceIDs(rName string) string {
+	return acctest.ConfigCompose(testAccEventSubscriptionConfig_baseSourceIDs(rName), fmt.Sprintf(`
 resource "aws_neptune_event_subscription" "test" {
-  name          = "tf-acc-test-neptune-event-subs-with-ids-%[1]d"
-  sns_topic_arn = aws_sns_topic.aws_sns_topic.arn
+  name          = %[1]q
+  sns_topic_arn = aws_sns_topic.test.arn
   source_type   = "db-parameter-group"
-  source_ids    = [aws_neptune_parameter_group.test.id, aws_neptune_parameter_group.test_2.id]
+  source_ids    = [aws_neptune_parameter_group.test[0].id]
 
   event_categories = [
     "configuration change",
   ]
+}
+`, rName))
+}
 
-  tags = {
-    Name = "tf-acc-test"
-  }
+func testAccEventSubscriptionConfig_updateSourceIDs(rName string) string {
+	return acctest.ConfigCompose(testAccEventSubscriptionConfig_baseSourceIDs(rName), fmt.Sprintf(`
+resource "aws_neptune_event_subscription" "test" {
+  name          = %[1]q
+  sns_topic_arn = aws_sns_topic.test.arn
+  source_type   = "db-parameter-group"
+  source_ids    = aws_neptune_parameter_group.test[*].id
+
+  event_categories = [
+    "configuration change",
+  ]
 }
-`, rInt)
+`, rName))
 }
 
-func testAccEventSubscriptionConfig_updateCategories(subscriptionName string, rInt int) string {
+func testAccEventSubscriptionConfig_updateCategories(rName string) string {
 	return fmt.Sprintf(`
-resource "aws_sns_topic" "aws_sns_topic" {
-  name = "tf-acc-test-neptune-event-subs-sns-topic-%[1]d"
+resource "aws_sns_topic" "test" {
+  name = %[1]q
 }
 
 resource "aws_neptune_event_subscription" "test" {
-  name          = %[2]q
-  sns_topic_arn = aws_sns_topic.aws_sns_topic.arn
+  name          = %[1]q
+  sns_topic_arn = aws_sns_topic.test.arn
   source_type   = "db-instance"
+  enabled       = false
 
   event_categories = [
     "availability",
   ]
-
-  tags = {
-    Name = "tf-acc-test"
-  }
 }
-`, rInt, subscriptionName)
+`, rName)
 }
diff --git a/internal/service/neptune/find.go b/internal/service/neptune/find.go
index 53bcfb87de3..bd8f7d69351 100644
--- a/internal/service/neptune/find.go
+++ b/internal/service/neptune/find.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package neptune
 
 import (
diff --git a/internal/service/neptune/flex.go b/internal/service/neptune/flex.go
index 2d77fde8dbb..34ea166a95e 100644
--- a/internal/service/neptune/flex.go
+++ b/internal/service/neptune/flex.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package neptune
 
 import (
diff --git a/internal/service/neptune/generate.go b/internal/service/neptune/generate.go
index 8f4e546e8aa..90f05698561 100644
--- a/internal/service/neptune/generate.go
+++ b/internal/service/neptune/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTags -ListTagsInIDElem=ResourceName -ListTagsOutTagsElem=TagList -ServiceTagsSlice -TagOp=AddTagsToResource -TagInIDElem=ResourceName -UntagOp=RemoveTagsFromResource -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/neptune/global_cluster.go b/internal/service/neptune/global_cluster.go
index c011a050a0e..a7c626f62ef 100644
--- a/internal/service/neptune/global_cluster.go
+++ b/internal/service/neptune/global_cluster.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package neptune
 
 import (
@@ -233,7 +236,7 @@ func resourceGlobalClusterUpdate(ctx context.Context, d *schema.ResourceData, me
 					return diag.Errorf("modifying Neptune Cluster (%s) engine version: %s", clusterID, err)
 				}
 
-				if _, err := waitClusterAvailable(ctx, conn, clusterID, d.Timeout(schema.TimeoutUpdate)); err != nil {
+				if _, err := waitDBClusterAvailable(ctx, conn, clusterID, d.Timeout(schema.TimeoutUpdate)); err != nil {
 					return diag.Errorf("waiting for Neptune Cluster (%s) update: %s", clusterID, err)
 				}
 			}
diff --git a/internal/service/neptune/global_cluster_test.go b/internal/service/neptune/global_cluster_test.go
index b6217ab90ad..ad29854adfe 100644
--- a/internal/service/neptune/global_cluster_test.go
+++ b/internal/service/neptune/global_cluster_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package neptune_test
 
 import (
 	"context"
 	"errors"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/neptune"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -40,7 +43,7 @@ func TestAccNeptuneGlobalCluster_basic(t *testing.T) {
 					resource.TestCheckResourceAttrSet(resourceName, "engine"),
 					resource.TestCheckResourceAttrSet(resourceName, "engine_version"),
 					resource.TestCheckResourceAttr(resourceName, "global_cluster_identifier", rName),
-					resource.TestMatchResourceAttr(resourceName, "global_cluster_resource_id", regexp.MustCompile(`cluster-.+`)),
+					resource.TestMatchResourceAttr(resourceName, "global_cluster_resource_id", regexache.MustCompile(`cluster-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "storage_encrypted", "false"),
 				),
 			},
@@ -74,7 +77,7 @@ func TestAccNeptuneGlobalCluster_completeBasic(t *testing.T) {
 					resource.TestCheckResourceAttrSet(resourceName, "engine"),
 					resource.TestCheckResourceAttrSet(resourceName, "engine_version"),
 					resource.TestCheckResourceAttr(resourceName, "global_cluster_identifier", rName),
-					resource.TestMatchResourceAttr(resourceName, "global_cluster_resource_id", regexp.MustCompile(`cluster-.+`)),
+					resource.TestMatchResourceAttr(resourceName, "global_cluster_resource_id", regexache.MustCompile(`cluster-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "storage_encrypted", "false"),
 				),
 			},
diff --git a/internal/service/neptune/id.go b/internal/service/neptune/id.go
index a0609eaa16f..1c0a8d41b2e 100644
--- a/internal/service/neptune/id.go
+++ b/internal/service/neptune/id.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package neptune
 
 import (
diff --git a/internal/service/neptune/orderable_db_instance_data_source.go b/internal/service/neptune/orderable_db_instance_data_source.go
index 89144d6a9e6..59f9d61c7ef 100644
--- a/internal/service/neptune/orderable_db_instance_data_source.go
+++ b/internal/service/neptune/orderable_db_instance_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package neptune
 
 import (
diff --git a/internal/service/neptune/orderable_db_instance_data_source_test.go b/internal/service/neptune/orderable_db_instance_data_source_test.go
index 5086e8bddc9..3cd500ee83e 100644
--- a/internal/service/neptune/orderable_db_instance_data_source_test.go
+++ b/internal/service/neptune/orderable_db_instance_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package neptune_test
 
 import (
@@ -16,9 +19,9 @@ func TestAccNeptuneOrderableDBInstanceDataSource_basic(t *testing.T) {
 	ctx := acctest.Context(t)
 	dataSourceName := "data.aws_neptune_orderable_db_instance.test"
 	engine := "neptune"
-	engineVersion := "1.0.2.2"
+	engineVersion := "1.1.0.0"
 	licenseModel := "amazon-license"
-	class := "db.t3.medium"
+	class := "db.t4g.medium"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheckOrderableDBInstance(ctx, t) },
@@ -43,9 +46,9 @@ func TestAccNeptuneOrderableDBInstanceDataSource_preferred(t *testing.T) {
 	ctx := acctest.Context(t)
 	dataSourceName := "data.aws_neptune_orderable_db_instance.test"
 	engine := "neptune"
-	engineVersion := "1.0.3.0"
+	engineVersion := "1.2.0.2"
 	licenseModel := "amazon-license"
-	preferredOption := "db.r4.2xlarge"
+	preferredOption := "db.r5.2xlarge"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheckOrderableDBInstance(ctx, t) },
diff --git a/internal/service/neptune/parameter_group.go b/internal/service/neptune/parameter_group.go
index 540f7666c95..634e4f17cc0 100644
--- a/internal/service/neptune/parameter_group.go
+++ b/internal/service/neptune/parameter_group.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package neptune
 
 import (
diff --git a/internal/service/neptune/parameter_group_test.go b/internal/service/neptune/parameter_group_test.go
index d27671dd0c4..e33f7ea4335 100644
--- a/internal/service/neptune/parameter_group_test.go
+++ b/internal/service/neptune/parameter_group_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package neptune_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/neptune"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -112,7 +115,7 @@ func TestAccNeptuneParameterGroup_parameter(t *testing.T) {
 			// This test should be updated with a dynamic parameter when available
 			{
 				Config:      testAccParameterGroupConfig_basic(rName, "neptune_query_timeout", "25", "immediate"),
-				ExpectError: regexp.MustCompile(`cannot use immediate apply method for static parameter`),
+				ExpectError: regexache.MustCompile(`cannot use immediate apply method for static parameter`),
 			},
 			// Test removing the configuration
 			{
diff --git a/internal/service/neptune/service_package_gen.go b/internal/service/neptune/service_package_gen.go
index 4c37698b121..76972ef6539 100644
--- a/internal/service/neptune/service_package_gen.go
+++ b/internal/service/neptune/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	neptune_sdkv1 "github.com/aws/aws-sdk-go/service/neptune"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -115,4 +116,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*n
 	return neptune_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/neptune/status.go b/internal/service/neptune/status.go
index 44fc695fadb..3b28c15bd2f 100644
--- a/internal/service/neptune/status.go
+++ b/internal/service/neptune/status.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package neptune
 
 import (
diff --git a/internal/service/neptune/subnet_group.go b/internal/service/neptune/subnet_group.go
index 22ad30c7760..be08ae2bf47 100644
--- a/internal/service/neptune/subnet_group.go
+++ b/internal/service/neptune/subnet_group.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package neptune
 
 import (
diff --git a/internal/service/neptune/subnet_group_test.go b/internal/service/neptune/subnet_group_test.go
index 16618e87887..c7a0a24c4b6 100644
--- a/internal/service/neptune/subnet_group_test.go
+++ b/internal/service/neptune/subnet_group_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package neptune_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/neptune"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -33,7 +36,7 @@ func TestAccNeptuneSubnetGroup_basic(t *testing.T) {
 				Config: testAccSubnetGroupConfig_basic(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckSubnetGroupExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "rds", regexp.MustCompile(fmt.Sprintf("subgrp:%s$", rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "rds", regexache.MustCompile(fmt.Sprintf("subgrp:%s$", rName))),
 					resource.TestCheckResourceAttr(resourceName, "description", "Managed by Terraform"),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "name_prefix", ""),
diff --git a/internal/service/neptune/sweep.go b/internal/service/neptune/sweep.go
index 21be7c47435..ea18af9ff21 100644
--- a/internal/service/neptune/sweep.go
+++ b/internal/service/neptune/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package neptune
 
@@ -13,10 +13,11 @@ import (
 	"github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_neptune_event_subscription", &resource.Sweeper{
 		Name: "aws_neptune_event_subscription",
 		F:    sweepEventSubscriptions,
@@ -41,7 +42,7 @@ func init() {
 
 func sweepEventSubscriptions(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("getting client: %w", err)
 	}
@@ -84,7 +85,7 @@ func sweepEventSubscriptions(region string) error {
 
 		return !lastPage
 	})
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Neptune Event Subscriptions sweep for %s: %s", region, err)
 		return sweeperErrs.ErrorOrNil() // In case we have completed some pages, but had errors
 	}
@@ -97,7 +98,7 @@ func sweepEventSubscriptions(region string) error {
 
 func sweepClusters(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("getting client: %s", err)
 	}
@@ -141,7 +142,7 @@ func sweepClusters(region string) error {
 
 		return !lastPage
 	})
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Neptune Cluster sweep for %s: %s", region, err)
 		return sweeperErrs.ErrorOrNil() // In case we have completed some pages, but had errors
 	}
@@ -149,7 +150,7 @@ func sweepClusters(region string) error {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("listing Neptune Clusters (%s): %w", region, err))
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 	if err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("sweeping Neptune Clusters (%s): %w", region, err))
 	}
@@ -159,7 +160,7 @@ func sweepClusters(region string) error {
 
 func sweepClusterInstances(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("getting client: %s", err)
 	}
@@ -185,7 +186,7 @@ func sweepClusterInstances(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Neptune Cluster Instance sweep for %s: %s", region, err)
 		return nil
 	}
@@ -194,7 +195,7 @@ func sweepClusterInstances(region string) error {
 		return fmt.Errorf("listing Neptune Cluster Instances (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("sweeping Neptune Cluster Instances (%s): %w", region, err)
diff --git a/internal/service/neptune/tags_gen.go b/internal/service/neptune/tags_gen.go
index 5f106d9c6cc..618e547b6b7 100644
--- a/internal/service/neptune/tags_gen.go
+++ b/internal/service/neptune/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/neptune"
 	"github.com/aws/aws-sdk-go/service/neptune/neptuneiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -102,6 +104,8 @@ func updateTags(ctx context.Context, conn neptuneiface.NeptuneAPI, identifier st
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.Neptune)
 	if len(removedTags) > 0 {
diff --git a/internal/service/neptune/validate.go b/internal/service/neptune/validate.go
index bac4f74d0ef..567757c405a 100644
--- a/internal/service/neptune/validate.go
+++ b/internal/service/neptune/validate.go
@@ -1,9 +1,12 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package neptune
 
 import (
 	"fmt"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
@@ -17,7 +20,7 @@ func validEngine() schema.SchemaValidateFunc {
 
 func validEventSubscriptionName(v interface{}, k string) (ws []string, errors []error) {
 	value := v.(string)
-	if !regexp.MustCompile(`^[0-9A-Za-z-]+$`).MatchString(value) {
+	if !regexache.MustCompile(`^[0-9A-Za-z-]+$`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"only alphanumeric characters and hyphens allowed in %q", k))
 	}
@@ -30,7 +33,7 @@ func validEventSubscriptionName(v interface{}, k string) (ws []string, errors []
 
 func validEventSubscriptionNamePrefix(v interface{}, k string) (ws []string, errors []error) {
 	value := v.(string)
-	if !regexp.MustCompile(`^[0-9A-Za-z-]+$`).MatchString(value) {
+	if !regexache.MustCompile(`^[0-9A-Za-z-]+$`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"only alphanumeric characters and hyphens allowed in %q", k))
 	}
@@ -44,19 +47,19 @@ func validEventSubscriptionNamePrefix(v interface{}, k string) (ws []string, err
 
 func validIdentifier(v interface{}, k string) (ws []string, errors []error) {
 	value := v.(string)
-	if !regexp.MustCompile(`^[0-9a-z-]+$`).MatchString(value) {
+	if !regexache.MustCompile(`^[0-9a-z-]+$`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"only lowercase alphanumeric characters and hyphens allowed in %q", k))
 	}
-	if !regexp.MustCompile(`^[a-z]`).MatchString(value) {
+	if !regexache.MustCompile(`^[a-z]`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"first character of %q must be a letter", k))
 	}
-	if regexp.MustCompile(`--`).MatchString(value) {
+	if regexache.MustCompile(`--`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"%q cannot contain two consecutive hyphens", k))
 	}
-	if regexp.MustCompile(`-$`).MatchString(value) {
+	if regexache.MustCompile(`-$`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"%q cannot end with a hyphen", k))
 	}
@@ -65,15 +68,15 @@ func validIdentifier(v interface{}, k string) (ws []string, errors []error) {
 
 func validGlobalCusterIdentifier(v interface{}, k string) (ws []string, errors []error) {
 	value := v.(string)
-	if !regexp.MustCompile(`^[0-9A-Za-z-]+$`).MatchString(value) {
+	if !regexache.MustCompile(`^[0-9A-Za-z-]+$`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"only alphanumeric characters and hyphens allowed in %q", k))
 	}
-	if !regexp.MustCompile(`^[A-Za-z]`).MatchString(value) {
+	if !regexache.MustCompile(`^[A-Za-z]`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"first character of %q must be a letter", k))
 	}
-	if regexp.MustCompile(`--`).MatchString(value) {
+	if regexache.MustCompile(`--`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"%q cannot contain two consecutive hyphens", k))
 	}
@@ -86,15 +89,15 @@ func validGlobalCusterIdentifier(v interface{}, k string) (ws []string, errors [
 
 func validIdentifierPrefix(v interface{}, k string) (ws []string, errors []error) {
 	value := v.(string)
-	if !regexp.MustCompile(`^[0-9a-z-]+$`).MatchString(value) {
+	if !regexache.MustCompile(`^[0-9a-z-]+$`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"only lowercase alphanumeric characters and hyphens allowed in %q", k))
 	}
-	if !regexp.MustCompile(`^[a-z]`).MatchString(value) {
+	if !regexache.MustCompile(`^[a-z]`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"first character of %q must be a letter", k))
 	}
-	if regexp.MustCompile(`--`).MatchString(value) {
+	if regexache.MustCompile(`--`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"%q cannot contain two consecutive hyphens", k))
 	}
@@ -103,19 +106,19 @@ func validIdentifierPrefix(v interface{}, k string) (ws []string, errors []error
 
 func validParamGroupName(v interface{}, k string) (ws []string, errors []error) {
 	value := v.(string)
-	if !regexp.MustCompile(`^[0-9a-z-]+$`).MatchString(value) {
+	if !regexache.MustCompile(`^[0-9a-z-]+$`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"only lowercase alphanumeric characters and hyphens allowed in %q", k))
 	}
-	if !regexp.MustCompile(`^[a-z]`).MatchString(value) {
+	if !regexache.MustCompile(`^[a-z]`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"first character of %q must be a letter", k))
 	}
-	if regexp.MustCompile(`--`).MatchString(value) {
+	if regexache.MustCompile(`--`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"%q cannot contain two consecutive hyphens", k))
 	}
-	if regexp.MustCompile(`-$`).MatchString(value) {
+	if regexache.MustCompile(`-$`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"%q cannot end with a hyphen", k))
 	}
@@ -128,15 +131,15 @@ func validParamGroupName(v interface{}, k string) (ws []string, errors []error)
 
 func validParamGroupNamePrefix(v interface{}, k string) (ws []string, errors []error) {
 	value := v.(string)
-	if !regexp.MustCompile(`^[0-9a-z-]+$`).MatchString(value) {
+	if !regexache.MustCompile(`^[0-9a-z-]+$`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"only lowercase alphanumeric characters and hyphens allowed in %q", k))
 	}
-	if !regexp.MustCompile(`^[a-z]`).MatchString(value) {
+	if !regexache.MustCompile(`^[a-z]`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"first character of %q must be a letter", k))
 	}
-	if regexp.MustCompile(`--`).MatchString(value) {
+	if regexache.MustCompile(`--`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"%q cannot contain two consecutive hyphens", k))
 	}
@@ -150,7 +153,7 @@ func validParamGroupNamePrefix(v interface{}, k string) (ws []string, errors []e
 
 func validSubnetGroupName(v interface{}, k string) (ws []string, errors []error) {
 	value := v.(string)
-	if !regexp.MustCompile(`^[ .0-9a-z-_]+$`).MatchString(value) {
+	if !regexache.MustCompile(`^[0-9a-z_ .-]+$`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"only lowercase alphanumeric characters, hyphens, underscores, periods, and spaces allowed in %q", k))
 	}
@@ -167,7 +170,7 @@ func validSubnetGroupName(v interface{}, k string) (ws []string, errors []error)
 
 func validSubnetGroupNamePrefix(v interface{}, k string) (ws []string, errors []error) {
 	value := v.(string)
-	if !regexp.MustCompile(`^[ .0-9a-z-_]+$`).MatchString(value) {
+	if !regexache.MustCompile(`^[0-9a-z_ .-]+$`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"only lowercase alphanumeric characters, hyphens, underscores, periods, and spaces allowed in %q", k))
 	}
diff --git a/internal/service/neptune/validate_test.go b/internal/service/neptune/validate_test.go
index 04af47f41ca..60320275ee3 100644
--- a/internal/service/neptune/validate_test.go
+++ b/internal/service/neptune/validate_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package neptune
 
 import (
diff --git a/internal/service/neptune/wait.go b/internal/service/neptune/wait.go
index c384b9614da..fd84dc6bf24 100644
--- a/internal/service/neptune/wait.go
+++ b/internal/service/neptune/wait.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package neptune
 
 import (
diff --git a/internal/service/networkfirewall/find.go b/internal/service/networkfirewall/find.go
index b6088684ceb..16815140437 100644
--- a/internal/service/networkfirewall/find.go
+++ b/internal/service/networkfirewall/find.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package networkfirewall
 
 import (
diff --git a/internal/service/networkfirewall/firewall.go b/internal/service/networkfirewall/firewall.go
index b2ff1e08085..8020b008e97 100644
--- a/internal/service/networkfirewall/firewall.go
+++ b/internal/service/networkfirewall/firewall.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package networkfirewall
 
 import (
diff --git a/internal/service/networkfirewall/firewall_data_source.go b/internal/service/networkfirewall/firewall_data_source.go
index b127c6a1129..6acdbd62a2b 100644
--- a/internal/service/networkfirewall/firewall_data_source.go
+++ b/internal/service/networkfirewall/firewall_data_source.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package networkfirewall
 
 import (
 	"context"
 	"log"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/networkfirewall"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -149,7 +152,7 @@ func DataSourceFirewall() *schema.Resource {
 				Optional:     true,
 				Computed:     true,
 				AtLeastOneOf: []string{"arn", "name"},
-				ValidateFunc: validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9-]{1,128}$`), "Must have 1-128 valid characters: a-z, A-Z, 0-9 and -(hyphen)"),
+				ValidateFunc: validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z-]{1,128}$`), "Must have 1-128 valid characters: a-z, A-Z, 0-9 and -(hyphen)"),
 			},
 			"subnet_change_protection": {
 				Type:     schema.TypeBool,
diff --git a/internal/service/networkfirewall/firewall_data_source_test.go b/internal/service/networkfirewall/firewall_data_source_test.go
index 90443df75cd..92bb36f66da 100644
--- a/internal/service/networkfirewall/firewall_data_source_test.go
+++ b/internal/service/networkfirewall/firewall_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package networkfirewall_test
 
 import (
@@ -5,6 +8,7 @@ import (
 	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/networkfirewall"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -43,7 +47,7 @@ func TestAccNetworkFirewallFirewallDataSource_arn(t *testing.T) {
 					resource.TestCheckResourceAttr(dataSourceName, "firewall_status.0.sync_states.#", "1"),
 					resource.TestCheckTypeSetElemAttrPair(dataSourceName, "firewall_status.0.sync_states.*.availability_zone", subnetResourceName, "availability_zone"),
 					resource.TestMatchTypeSetElemNestedAttrs(dataSourceName, "firewall_status.0.sync_states.*", map[string]*regexp.Regexp{
-						"attachment.0.endpoint_id": regexp.MustCompile(`vpce-`),
+						"attachment.0.endpoint_id": regexache.MustCompile(`vpce-`),
 					}),
 					resource.TestCheckResourceAttr(dataSourceName, "firewall_status.0.sync_states.0.attachment.0.status", "READY"),
 					resource.TestCheckTypeSetElemAttrPair(dataSourceName, "firewall_status.0.sync_states.*.attachment.0.subnet_id", subnetResourceName, "id"),
@@ -91,7 +95,7 @@ func TestAccNetworkFirewallFirewallDataSource_name(t *testing.T) {
 					resource.TestCheckResourceAttr(dataSourceName, "firewall_status.0.sync_states.#", "1"),
 					resource.TestCheckTypeSetElemAttrPair(dataSourceName, "firewall_status.0.sync_states.*.availability_zone", subnetResourceName, "availability_zone"),
 					resource.TestMatchTypeSetElemNestedAttrs(dataSourceName, "firewall_status.0.sync_states.*", map[string]*regexp.Regexp{
-						"attachment.0.endpoint_id": regexp.MustCompile(`vpce-`),
+						"attachment.0.endpoint_id": regexache.MustCompile(`vpce-`),
 					}),
 					resource.TestCheckResourceAttr(dataSourceName, "firewall_status.0.sync_states.0.attachment.0.status", "READY"),
 					resource.TestCheckTypeSetElemAttrPair(dataSourceName, "firewall_status.0.sync_states.*.attachment.0.subnet_id", subnetResourceName, "id"),
@@ -139,7 +143,7 @@ func TestAccNetworkFirewallFirewallDataSource_arnandname(t *testing.T) {
 					resource.TestCheckResourceAttr(dataSourceName, "firewall_status.0.sync_states.#", "1"),
 					resource.TestCheckTypeSetElemAttrPair(dataSourceName, "firewall_status.0.sync_states.*.availability_zone", subnetResourceName, "availability_zone"),
 					resource.TestMatchTypeSetElemNestedAttrs(dataSourceName, "firewall_status.0.sync_states.*", map[string]*regexp.Regexp{
-						"attachment.0.endpoint_id": regexp.MustCompile(`vpce-`),
+						"attachment.0.endpoint_id": regexache.MustCompile(`vpce-`),
 					}),
 					resource.TestCheckResourceAttr(dataSourceName, "firewall_status.0.sync_states.0.attachment.0.status", "READY"),
 					resource.TestCheckTypeSetElemAttrPair(dataSourceName, "firewall_status.0.sync_states.*.attachment.0.subnet_id", subnetResourceName, "id"),
diff --git a/internal/service/networkfirewall/firewall_policy.go b/internal/service/networkfirewall/firewall_policy.go
index 0aef8439395..4305b6782cf 100644
--- a/internal/service/networkfirewall/firewall_policy.go
+++ b/internal/service/networkfirewall/firewall_policy.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package networkfirewall
 
 import (
@@ -5,6 +8,7 @@ import (
 	"log"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/networkfirewall"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -50,6 +54,46 @@ func ResourceFirewallPolicy() *schema.Resource {
 				MaxItems: 1,
 				Elem: &schema.Resource{
 					Schema: map[string]*schema.Schema{
+						"policy_variables": {
+							Type:     schema.TypeList,
+							Optional: true,
+							MaxItems: 1,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"rule_variables": {
+										Type:     schema.TypeSet,
+										Optional: true,
+										Elem: &schema.Resource{
+											Schema: map[string]*schema.Schema{
+												"key": {
+													Type:     schema.TypeString,
+													Required: true,
+													ValidateFunc: validation.All(
+														validation.StringLenBetween(1, 32),
+														validation.StringMatch(regexache.MustCompile(`^[A-Za-z]`), "must begin with alphabetic character"),
+														validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_]+$`), "must contain only alphanumeric and underscore characters"),
+													),
+												},
+												"ip_set": {
+													Type:     schema.TypeList,
+													Required: true,
+													MaxItems: 1,
+													Elem: &schema.Resource{
+														Schema: map[string]*schema.Schema{
+															"definition": {
+																Type:     schema.TypeSet,
+																Required: true,
+																Elem:     &schema.Schema{Type: schema.TypeString},
+															},
+														},
+													},
+												},
+											},
+										},
+									},
+								},
+							},
+						},
 						"stateful_default_actions": {
 							Type:     schema.TypeSet,
 							Optional: true,
@@ -332,6 +376,20 @@ func waitFirewallPolicyDeleted(ctx context.Context, conn *networkfirewall.Networ
 	return nil, err
 }
 
+func expandPolicyVariables(tfMap map[string]interface{}) *networkfirewall.PolicyVariables {
+	if tfMap == nil {
+		return nil
+	}
+
+	policyVariables := &networkfirewall.PolicyVariables{}
+
+	if rvMap, ok := tfMap["rule_variables"].(*schema.Set); ok && rvMap.Len() > 0 {
+		policyVariables.RuleVariables = expandIPSets(rvMap.List())
+	}
+
+	return policyVariables
+}
+
 func expandStatefulEngineOptions(l []interface{}) *networkfirewall.StatefulEngineOptions {
 	if len(l) == 0 || l[0] == nil {
 		return nil
@@ -426,6 +484,10 @@ func expandFirewallPolicy(l []interface{}) *networkfirewall.FirewallPolicy {
 		StatelessFragmentDefaultActions: flex.ExpandStringSet(lRaw["stateless_fragment_default_actions"].(*schema.Set)),
 	}
 
+	if v, ok := lRaw["policy_variables"]; ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
+		policy.PolicyVariables = expandPolicyVariables(v.([]interface{})[0].(map[string]interface{}))
+	}
+
 	if v, ok := lRaw["stateful_default_actions"].(*schema.Set); ok && v.Len() > 0 {
 		policy.StatefulDefaultActions = flex.ExpandStringSet(v)
 	}
@@ -454,6 +516,9 @@ func flattenFirewallPolicy(policy *networkfirewall.FirewallPolicy) []interface{}
 		return []interface{}{}
 	}
 	p := map[string]interface{}{}
+	if policy.PolicyVariables != nil {
+		p["policy_variables"] = flattenPolicyVariables(policy.PolicyVariables)
+	}
 	if policy.StatefulDefaultActions != nil {
 		p["stateful_default_actions"] = flex.FlattenStringSet(policy.StatefulDefaultActions)
 	}
@@ -479,6 +544,18 @@ func flattenFirewallPolicy(policy *networkfirewall.FirewallPolicy) []interface{}
 	return []interface{}{p}
 }
 
+func flattenPolicyVariables(variables *networkfirewall.PolicyVariables) []interface{} {
+	if variables == nil {
+		return []interface{}{}
+	}
+
+	m := map[string]interface{}{
+		"rule_variables": flattenIPSets(variables.RuleVariables),
+	}
+
+	return []interface{}{m}
+}
+
 func flattenStatefulEngineOptions(options *networkfirewall.StatefulEngineOptions) []interface{} {
 	if options == nil {
 		return []interface{}{}
diff --git a/internal/service/networkfirewall/firewall_policy_data_source.go b/internal/service/networkfirewall/firewall_policy_data_source.go
index 24e9b931e25..1d7e8755715 100644
--- a/internal/service/networkfirewall/firewall_policy_data_source.go
+++ b/internal/service/networkfirewall/firewall_policy_data_source.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package networkfirewall
 
 import (
 	"context"
 	"log"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
@@ -117,7 +120,7 @@ func DataSourceFirewallPolicy() *schema.Resource {
 				Type:         schema.TypeString,
 				Optional:     true,
 				AtLeastOneOf: []string{"arn", "name"},
-				ValidateFunc: validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9-]{1,128}$`), "Must have 1-128 valid characters: a-z, A-Z, 0-9 and -(hyphen)"),
+				ValidateFunc: validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z-]{1,128}$`), "Must have 1-128 valid characters: a-z, A-Z, 0-9 and -(hyphen)"),
 			},
 			"tags": tftags.TagsSchemaComputed(),
 			"update_token": {
diff --git a/internal/service/networkfirewall/firewall_policy_data_source_test.go b/internal/service/networkfirewall/firewall_policy_data_source_test.go
index 4a5d10c7c44..2acfa9d7faf 100644
--- a/internal/service/networkfirewall/firewall_policy_data_source_test.go
+++ b/internal/service/networkfirewall/firewall_policy_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package networkfirewall_test
 
 import (
diff --git a/internal/service/networkfirewall/firewall_policy_test.go b/internal/service/networkfirewall/firewall_policy_test.go
index 9000f2fd8e2..d92381aba7d 100644
--- a/internal/service/networkfirewall/firewall_policy_test.go
+++ b/internal/service/networkfirewall/firewall_policy_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package networkfirewall_test
 
 import (
@@ -30,15 +33,21 @@ func TestAccNetworkFirewallFirewallPolicy_basic(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config: testAccFirewallPolicyConfig_basic(rName),
-				Check: resource.ComposeTestCheckFunc(
+				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckFirewallPolicyExists(ctx, resourceName, &firewallPolicy),
 					acctest.CheckResourceAttrRegionalARN(resourceName, "arn", "network-firewall", fmt.Sprintf("firewall-policy/%s", rName)),
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
 					resource.TestCheckResourceAttr(resourceName, "firewall_policy.#", "1"),
-					resource.TestCheckResourceAttr(resourceName, "firewall_policy.0.stateless_fragment_default_actions.#", "1"),
-					resource.TestCheckTypeSetElemAttr(resourceName, "firewall_policy.0.stateless_fragment_default_actions.*", "aws:drop"),
+					resource.TestCheckResourceAttr(resourceName, "firewall_policy.0.policy_variables.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "firewall_policy.0.stateful_default_actions.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "firewall_policy.0.stateful_engine_options.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "firewall_policy.0.stateful_rule_group_reference.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "firewall_policy.0.stateless_custom_action.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "firewall_policy.0.stateless_default_actions.#", "1"),
 					resource.TestCheckTypeSetElemAttr(resourceName, "firewall_policy.0.stateless_default_actions.*", "aws:pass"),
+					resource.TestCheckResourceAttr(resourceName, "firewall_policy.0.stateless_fragment_default_actions.#", "1"),
+					resource.TestCheckTypeSetElemAttr(resourceName, "firewall_policy.0.stateless_fragment_default_actions.*", "aws:drop"),
+					resource.TestCheckResourceAttr(resourceName, "firewall_policy.0.stateless_rule_group_reference.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 				),
@@ -113,6 +122,59 @@ func TestAccNetworkFirewallFirewallPolicy_encryptionConfiguration(t *testing.T)
 	})
 }
 
+func TestAccNetworkFirewallFirewallPolicy_policyVariables(t *testing.T) {
+	ctx := acctest.Context(t)
+	var firewallPolicy networkfirewall.DescribeFirewallPolicyOutput
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_networkfirewall_firewall_policy.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, networkfirewall.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckFirewallPolicyDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccFirewallPolicyConfig_policyVariables(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckFirewallPolicyExists(ctx, resourceName, &firewallPolicy),
+					resource.TestCheckResourceAttr(resourceName, "firewall_policy.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "firewall_policy.0.policy_variables.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "firewall_policy.0.policy_variables.0.rule_variables.#", "1"),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "firewall_policy.0.policy_variables.0.rule_variables.*", map[string]string{
+						"key":                   "HOME_NET",
+						"ip_set.#":              "1",
+						"ip_set.0.definition.#": "2",
+					}),
+					resource.TestCheckTypeSetElemAttr(resourceName, "firewall_policy.0.policy_variables.0.rule_variables.*.ip_set.0.definition.*", "10.0.0.0/16"),
+					resource.TestCheckTypeSetElemAttr(resourceName, "firewall_policy.0.policy_variables.0.rule_variables.*.ip_set.0.definition.*", "10.0.1.0/24"),
+					resource.TestCheckResourceAttr(resourceName, "firewall_policy.0.stateless_fragment_default_actions.#", "1"),
+					resource.TestCheckTypeSetElemAttr(resourceName, "firewall_policy.0.stateless_fragment_default_actions.*", "aws:drop"),
+					resource.TestCheckResourceAttr(resourceName, "firewall_policy.0.stateless_default_actions.#", "1"),
+					resource.TestCheckTypeSetElemAttr(resourceName, "firewall_policy.0.stateless_default_actions.*", "aws:pass"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				Config: testAccFirewallPolicyConfig_basic(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckFirewallPolicyExists(ctx, resourceName, &firewallPolicy),
+					resource.TestCheckResourceAttr(resourceName, "firewall_policy.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "firewall_policy.0.policy_variables.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "firewall_policy.0.stateless_fragment_default_actions.#", "1"),
+					resource.TestCheckTypeSetElemAttr(resourceName, "firewall_policy.0.stateless_fragment_default_actions.*", "aws:drop"),
+					resource.TestCheckResourceAttr(resourceName, "firewall_policy.0.stateless_default_actions.#", "1"),
+					resource.TestCheckTypeSetElemAttr(resourceName, "firewall_policy.0.stateless_default_actions.*", "aws:pass"),
+				),
+			},
+		},
+	})
+}
+
 func TestAccNetworkFirewallFirewallPolicy_statefulDefaultActions(t *testing.T) {
 	ctx := acctest.Context(t)
 	var firewallPolicy networkfirewall.DescribeFirewallPolicyOutput
@@ -1172,6 +1234,27 @@ resource "aws_networkfirewall_firewall_policy" "test" {
 `, rName, ruleOrder, streamExceptionPolicy)
 }
 
+func testAccFirewallPolicyConfig_policyVariables(rName string) string {
+	return fmt.Sprintf(`
+resource "aws_networkfirewall_firewall_policy" "test" {
+  name = %[1]q
+
+  firewall_policy {
+    policy_variables {
+      rule_variables {
+        key = "HOME_NET"
+        ip_set {
+          definition = ["10.0.0.0/16", "10.0.1.0/24"]
+        }
+      }
+    }
+    stateless_fragment_default_actions = ["aws:drop"]
+    stateless_default_actions          = ["aws:pass"]
+  }
+}
+`, rName)
+}
+
 func testAccFirewallPolicyConfig_ruleOrderOnly(rName, ruleOrder string) string {
 	return fmt.Sprintf(`
 resource "aws_networkfirewall_firewall_policy" "test" {
diff --git a/internal/service/networkfirewall/firewall_resource_policy_data_source.go b/internal/service/networkfirewall/firewall_resource_policy_data_source.go
index 4cef0853fa0..52fa58b203c 100644
--- a/internal/service/networkfirewall/firewall_resource_policy_data_source.go
+++ b/internal/service/networkfirewall/firewall_resource_policy_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package networkfirewall
 
 import (
diff --git a/internal/service/networkfirewall/firewall_resource_policy_data_source_test.go b/internal/service/networkfirewall/firewall_resource_policy_data_source_test.go
index dcaa06f5da9..c7c8af55f7e 100644
--- a/internal/service/networkfirewall/firewall_resource_policy_data_source_test.go
+++ b/internal/service/networkfirewall/firewall_resource_policy_data_source_test.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package networkfirewall_test
 
 import (
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/networkfirewall"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -24,7 +27,7 @@ func TestAccNetworkFirewallFirewallResourcePolicyDataSource_basic(t *testing.T)
 			{
 				Config: testAccResourcePolicyDataSourceConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
-					resource.TestMatchResourceAttr(resourceName, "policy", regexp.MustCompile(`"Action":\["network-firewall:AssociateFirewallPolicy","network-firewall:ListFirewallPolicies"\]`)),
+					resource.TestMatchResourceAttr(resourceName, "policy", regexache.MustCompile(`"Action":\["network-firewall:AssociateFirewallPolicy","network-firewall:ListFirewallPolicies"\]`)),
 					resource.TestCheckResourceAttrPair(resourceName, "resource_arn", "aws_networkfirewall_firewall_policy.test", "arn"),
 				),
 			},
diff --git a/internal/service/networkfirewall/firewall_test.go b/internal/service/networkfirewall/firewall_test.go
index 82b10e6cd65..b960eaecf08 100644
--- a/internal/service/networkfirewall/firewall_test.go
+++ b/internal/service/networkfirewall/firewall_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package networkfirewall_test
 
 import (
@@ -6,6 +9,7 @@ import (
 	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/networkfirewall"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -42,7 +46,7 @@ func TestAccNetworkFirewallFirewall_basic(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "firewall_status.0.sync_states.#", "1"),
 					resource.TestCheckTypeSetElemAttrPair(resourceName, "firewall_status.0.sync_states.*.availability_zone", subnetResourceName, "availability_zone"),
 					resource.TestMatchTypeSetElemNestedAttrs(resourceName, "firewall_status.0.sync_states.*", map[string]*regexp.Regexp{
-						"attachment.0.endpoint_id": regexp.MustCompile(`vpce-`),
+						"attachment.0.endpoint_id": regexache.MustCompile(`vpce-`),
 					}),
 					resource.TestCheckTypeSetElemAttrPair(resourceName, "firewall_status.0.sync_states.*.attachment.0.subnet_id", subnetResourceName, "id"),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
@@ -91,7 +95,7 @@ func TestAccNetworkFirewallFirewall_dualstackSubnet(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "firewall_status.0.sync_states.#", "1"),
 					resource.TestCheckTypeSetElemAttrPair(resourceName, "firewall_status.0.sync_states.*.availability_zone", subnetResourceName, "availability_zone"),
 					resource.TestMatchTypeSetElemNestedAttrs(resourceName, "firewall_status.0.sync_states.*", map[string]*regexp.Regexp{
-						"attachment.0.endpoint_id": regexp.MustCompile(`vpce-`),
+						"attachment.0.endpoint_id": regexache.MustCompile(`vpce-`),
 					}),
 					resource.TestCheckTypeSetElemAttrPair(resourceName, "firewall_status.0.sync_states.*.attachment.0.subnet_id", subnetResourceName, "id"),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
@@ -278,7 +282,7 @@ func TestAccNetworkFirewallFirewall_SubnetMappings_updateSubnet(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "firewall_status.0.sync_states.#", "1"),
 					resource.TestCheckTypeSetElemAttrPair(resourceName, "firewall_status.0.sync_states.*.availability_zone", updateSubnetResourceName, "availability_zone"),
 					resource.TestMatchTypeSetElemNestedAttrs(resourceName, "firewall_status.0.sync_states.*", map[string]*regexp.Regexp{
-						"attachment.0.endpoint_id": regexp.MustCompile(`vpce-`),
+						"attachment.0.endpoint_id": regexache.MustCompile(`vpce-`),
 					}),
 					resource.TestCheckTypeSetElemAttrPair(resourceName, "firewall_status.0.sync_states.*.attachment.0.subnet_id", updateSubnetResourceName, "id"),
 					resource.TestCheckResourceAttr(resourceName, "subnet_mapping.#", "1"),
@@ -338,7 +342,7 @@ func TestAccNetworkFirewallFirewall_SubnetMappings_updateMultipleSubnets(t *test
 					resource.TestCheckResourceAttr(resourceName, "firewall_status.0.sync_states.#", "1"),
 					resource.TestCheckTypeSetElemAttrPair(resourceName, "firewall_status.0.sync_states.*.availability_zone", subnetResourceName, "availability_zone"),
 					resource.TestMatchTypeSetElemNestedAttrs(resourceName, "firewall_status.0.sync_states.*", map[string]*regexp.Regexp{
-						"attachment.0.endpoint_id": regexp.MustCompile(`vpce-`),
+						"attachment.0.endpoint_id": regexache.MustCompile(`vpce-`),
 					}),
 					resource.TestCheckTypeSetElemAttrPair(resourceName, "firewall_status.0.sync_states.*.attachment.0.subnet_id", subnetResourceName, "id"),
 					resource.TestCheckResourceAttr(resourceName, "subnet_mapping.#", "1"),
diff --git a/internal/service/networkfirewall/generate.go b/internal/service/networkfirewall/generate.go
index 333a7805353..98d7418946b 100644
--- a/internal/service/networkfirewall/generate.go
+++ b/internal/service/networkfirewall/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTags -ServiceTagsSlice -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/networkfirewall/helpers.go b/internal/service/networkfirewall/helpers.go
index d0e7242550a..386271d6ef3 100644
--- a/internal/service/networkfirewall/helpers.go
+++ b/internal/service/networkfirewall/helpers.go
@@ -1,8 +1,10 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package networkfirewall
 
 import (
-	"regexp"
-
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/networkfirewall"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
@@ -101,7 +103,7 @@ func customActionSchema() *schema.Schema {
 					Type:         schema.TypeString,
 					Required:     true,
 					ForceNew:     true,
-					ValidateFunc: validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9]+$`), "must contain only alphanumeric characters"),
+					ValidateFunc: validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z]+$`), "must contain only alphanumeric characters"),
 				},
 			},
 		},
diff --git a/internal/service/networkfirewall/logging_configuration.go b/internal/service/networkfirewall/logging_configuration.go
index bdb54fdbedd..f3e8bc0e82b 100644
--- a/internal/service/networkfirewall/logging_configuration.go
+++ b/internal/service/networkfirewall/logging_configuration.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package networkfirewall
 
 import (
diff --git a/internal/service/networkfirewall/logging_configuration_test.go b/internal/service/networkfirewall/logging_configuration_test.go
index 491dbe227c5..5edc2a612ab 100644
--- a/internal/service/networkfirewall/logging_configuration_test.go
+++ b/internal/service/networkfirewall/logging_configuration_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package networkfirewall_test
 
 import (
diff --git a/internal/service/networkfirewall/resource_policy.go b/internal/service/networkfirewall/resource_policy.go
index b8746dac514..34cfc8ae36f 100644
--- a/internal/service/networkfirewall/resource_policy.go
+++ b/internal/service/networkfirewall/resource_policy.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package networkfirewall
 
 import (
diff --git a/internal/service/networkfirewall/resource_policy_test.go b/internal/service/networkfirewall/resource_policy_test.go
index ce89f109079..a40d5d115d1 100644
--- a/internal/service/networkfirewall/resource_policy_test.go
+++ b/internal/service/networkfirewall/resource_policy_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package networkfirewall_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/networkfirewall"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -42,7 +45,7 @@ func TestAccNetworkFirewallResourcePolicy_basic(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckResourcePolicyExists(ctx, resourceName),
 					resource.TestCheckResourceAttrPair(resourceName, "resource_arn", "aws_networkfirewall_firewall_policy.test", "arn"),
-					resource.TestMatchResourceAttr(resourceName, "policy", regexp.MustCompile(`"Action":\["network-firewall:CreateFirewall","network-firewall:UpdateFirewall","network-firewall:AssociateFirewallPolicy","network-firewall:ListFirewallPolicies"\]`)),
+					resource.TestMatchResourceAttr(resourceName, "policy", regexache.MustCompile(`"Action":\["network-firewall:CreateFirewall","network-firewall:UpdateFirewall","network-firewall:AssociateFirewallPolicy","network-firewall:ListFirewallPolicies"\]`)),
 				),
 			},
 			{
@@ -70,14 +73,14 @@ func TestAccNetworkFirewallResourcePolicy_ignoreEquivalent(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckResourcePolicyExists(ctx, resourceName),
 					resource.TestCheckResourceAttrPair(resourceName, "resource_arn", "aws_networkfirewall_firewall_policy.test", "arn"),
-					resource.TestMatchResourceAttr(resourceName, "policy", regexp.MustCompile(`"Action":\["network-firewall:CreateFirewall","network-firewall:UpdateFirewall","network-firewall:AssociateFirewallPolicy","network-firewall:ListFirewallPolicies"\]`)),
+					resource.TestMatchResourceAttr(resourceName, "policy", regexache.MustCompile(`"Action":\["network-firewall:CreateFirewall","network-firewall:UpdateFirewall","network-firewall:AssociateFirewallPolicy","network-firewall:ListFirewallPolicies"\]`)),
 				),
 			},
 			{
 				Config: testAccResourcePolicyConfig_equivalent(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckResourcePolicyExists(ctx, resourceName),
-					resource.TestMatchResourceAttr(resourceName, "policy", regexp.MustCompile(`"Action":\["network-firewall:CreateFirewall","network-firewall:UpdateFirewall","network-firewall:AssociateFirewallPolicy","network-firewall:ListFirewallPolicies"\]`)),
+					resource.TestMatchResourceAttr(resourceName, "policy", regexache.MustCompile(`"Action":\["network-firewall:CreateFirewall","network-firewall:UpdateFirewall","network-firewall:AssociateFirewallPolicy","network-firewall:ListFirewallPolicies"\]`)),
 				),
 			},
 		},
@@ -100,7 +103,7 @@ func TestAccNetworkFirewallResourcePolicy_ruleGroup(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckResourcePolicyExists(ctx, resourceName),
 					resource.TestCheckResourceAttrPair(resourceName, "resource_arn", "aws_networkfirewall_rule_group.test", "arn"),
-					resource.TestMatchResourceAttr(resourceName, "policy", regexp.MustCompile(`"Action":\["network-firewall:CreateFirewallPolicy","network-firewall:UpdateFirewallPolicy","network-firewall:ListRuleGroups"\]`)),
+					resource.TestMatchResourceAttr(resourceName, "policy", regexache.MustCompile(`"Action":\["network-firewall:CreateFirewallPolicy","network-firewall:UpdateFirewallPolicy","network-firewall:ListRuleGroups"\]`)),
 				),
 			},
 			{
@@ -108,7 +111,7 @@ func TestAccNetworkFirewallResourcePolicy_ruleGroup(t *testing.T) {
 				Config: testAccResourcePolicyConfig_ruleGroupUpdate(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckResourcePolicyExists(ctx, resourceName),
-					resource.TestMatchResourceAttr(resourceName, "policy", regexp.MustCompile(`"Action":\["network-firewall:CreateFirewallPolicy","network-firewall:UpdateFirewallPolicy","network-firewall:ListRuleGroups"\]`)),
+					resource.TestMatchResourceAttr(resourceName, "policy", regexache.MustCompile(`"Action":\["network-firewall:CreateFirewallPolicy","network-firewall:UpdateFirewallPolicy","network-firewall:ListRuleGroups"\]`)),
 				),
 			},
 			{
diff --git a/internal/service/networkfirewall/rule_group.go b/internal/service/networkfirewall/rule_group.go
index 8c8722060ef..c8c6169d7eb 100644
--- a/internal/service/networkfirewall/rule_group.go
+++ b/internal/service/networkfirewall/rule_group.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package networkfirewall
 
 import (
 	"context"
 	"log"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/networkfirewall"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -92,8 +95,8 @@ func ResourceRuleGroup() *schema.Resource {
 													Required: true,
 													ValidateFunc: validation.All(
 														validation.StringLenBetween(1, 32),
-														validation.StringMatch(regexp.MustCompile(`^[A-Za-z]`), "must begin with alphabetic character"),
-														validation.StringMatch(regexp.MustCompile(`^[A-Za-z0-9_]+$`), "must contain only alphanumeric and underscore characters"),
+														validation.StringMatch(regexache.MustCompile(`^[A-Za-z]`), "must begin with alphabetic character"),
+														validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_]+$`), "must contain only alphanumeric and underscore characters"),
 													),
 												},
 											},
@@ -355,8 +358,8 @@ func ResourceRuleGroup() *schema.Resource {
 													Required: true,
 													ValidateFunc: validation.All(
 														validation.StringLenBetween(1, 32),
-														validation.StringMatch(regexp.MustCompile(`^[A-Za-z]`), "must begin with alphabetic character"),
-														validation.StringMatch(regexp.MustCompile(`^[A-Za-z0-9_]+$`), "must contain only alphanumeric and underscore characters"),
+														validation.StringMatch(regexache.MustCompile(`^[A-Za-z]`), "must begin with alphabetic character"),
+														validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_]+$`), "must contain only alphanumeric and underscore characters"),
 													),
 												},
 												"ip_set": {
@@ -386,8 +389,8 @@ func ResourceRuleGroup() *schema.Resource {
 													Required: true,
 													ValidateFunc: validation.All(
 														validation.StringLenBetween(1, 32),
-														validation.StringMatch(regexp.MustCompile(`^[A-Za-z]`), "must begin with alphabetic character"),
-														validation.StringMatch(regexp.MustCompile(`^[A-Za-z0-9_]+$`), "must contain only alphanumeric and underscore characters"),
+														validation.StringMatch(regexache.MustCompile(`^[A-Za-z]`), "must begin with alphabetic character"),
+														validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_]+$`), "must contain only alphanumeric and underscore characters"),
 													),
 												},
 												"port_set": {
diff --git a/internal/service/networkfirewall/rule_group_test.go b/internal/service/networkfirewall/rule_group_test.go
index d980d298acf..eae4f020fe0 100644
--- a/internal/service/networkfirewall/rule_group_test.go
+++ b/internal/service/networkfirewall/rule_group_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package networkfirewall_test
 
 import (
@@ -765,6 +768,19 @@ func TestAccNetworkFirewallRuleGroup_StatefulRule_action(t *testing.T) {
 				ImportState:       true,
 				ImportStateVerify: true,
 			},
+			{
+				Config: testAccRuleGroupConfig_statefulAction(rName, networkfirewall.StatefulActionReject),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckRuleGroupExists(ctx, resourceName, &ruleGroup),
+					resource.TestCheckResourceAttr(resourceName, "rule_group.0.rules_source.0.stateful_rule.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "rule_group.0.rules_source.0.stateful_rule.0.action", networkfirewall.StatefulActionReject),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
 		},
 	})
 }
diff --git a/internal/service/networkfirewall/service_package_gen.go b/internal/service/networkfirewall/service_package_gen.go
index a8e10f94098..3b7562c45b4 100644
--- a/internal/service/networkfirewall/service_package_gen.go
+++ b/internal/service/networkfirewall/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	networkfirewall_sdkv1 "github.com/aws/aws-sdk-go/service/networkfirewall"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -87,4 +88,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*n
 	return networkfirewall_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/networkfirewall/sweep.go b/internal/service/networkfirewall/sweep.go
index b8600660a16..5f06cb358ab 100644
--- a/internal/service/networkfirewall/sweep.go
+++ b/internal/service/networkfirewall/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package networkfirewall
 
@@ -11,9 +11,10 @@ import (
 	"github.com/aws/aws-sdk-go/service/networkfirewall"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_networkfirewall_firewall_policy", &resource.Sweeper{
 		Name: "aws_networkfirewall_firewall_policy",
 		F:    sweepFirewallPolicies,
@@ -46,7 +47,7 @@ func init() {
 
 func sweepFirewallPolicies(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
@@ -70,7 +71,7 @@ func sweepFirewallPolicies(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping NetworkFirewall Firewall Policy sweep for %s: %s", region, err)
 		return nil
 	}
@@ -79,7 +80,7 @@ func sweepFirewallPolicies(region string) error {
 		return fmt.Errorf("error listing NetworkFirewall Firewall Policies (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping NetworkFirewall Firewall Policies (%s): %w", region, err)
@@ -90,7 +91,7 @@ func sweepFirewallPolicies(region string) error {
 
 func sweepFirewalls(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -114,7 +115,7 @@ func sweepFirewalls(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping NetworkFirewall Firewall sweep for %s: %s", region, err)
 		return nil
 	}
@@ -123,7 +124,7 @@ func sweepFirewalls(region string) error {
 		return fmt.Errorf("error listing NetworkFirewall Firewalls (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping NetworkFirewall Firewalls (%s): %w", region, err)
@@ -134,7 +135,7 @@ func sweepFirewalls(region string) error {
 
 func sweepLoggingConfigurations(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -158,7 +159,7 @@ func sweepLoggingConfigurations(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping NetworkFirewall Logging Configuration sweep for %s: %s", region, err)
 		return nil
 	}
@@ -167,7 +168,7 @@ func sweepLoggingConfigurations(region string) error {
 		return fmt.Errorf("error listing NetworkFirewall Firewalls (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping NetworkFirewall Logging Configurations (%s): %w", region, err)
@@ -178,7 +179,7 @@ func sweepLoggingConfigurations(region string) error {
 
 func sweepRuleGroups(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
@@ -202,7 +203,7 @@ func sweepRuleGroups(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping NetworkFirewall Rule Group sweep for %s: %s", region, err)
 		return nil
 	}
@@ -211,7 +212,7 @@ func sweepRuleGroups(region string) error {
 		return fmt.Errorf("error listing NetworkFirewall Rule Groups (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping NetworkFirewall Rule Groups (%s): %w", region, err)
diff --git a/internal/service/networkfirewall/tags_gen.go b/internal/service/networkfirewall/tags_gen.go
index 55df8200166..f4211a4c0b0 100644
--- a/internal/service/networkfirewall/tags_gen.go
+++ b/internal/service/networkfirewall/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/networkfirewall"
 	"github.com/aws/aws-sdk-go/service/networkfirewall/networkfirewalliface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -102,6 +104,8 @@ func updateTags(ctx context.Context, conn networkfirewalliface.NetworkFirewallAP
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.NetworkFirewall)
 	if len(removedTags) > 0 {
diff --git a/internal/service/networkmanager/attachment_accepter.go b/internal/service/networkmanager/attachment_accepter.go
index 6cb9aff139a..39d87cb94c5 100644
--- a/internal/service/networkmanager/attachment_accepter.go
+++ b/internal/service/networkmanager/attachment_accepter.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package networkmanager
 
 import (
diff --git a/internal/service/networkmanager/connect_attachment.go b/internal/service/networkmanager/connect_attachment.go
index ab9b523736e..9fdd16a0597 100644
--- a/internal/service/networkmanager/connect_attachment.go
+++ b/internal/service/networkmanager/connect_attachment.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package networkmanager
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/aws/aws-sdk-go/service/networkmanager"
@@ -69,7 +72,7 @@ func ResourceConnectAttachment() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(0, 50),
-					validation.StringMatch(regexp.MustCompile(`^core-network-([0-9a-f]{8,17})$`), "Must start with core-network and then have 8 to 17 characters"),
+					validation.StringMatch(regexache.MustCompile(`^core-network-([0-9a-f]{8,17})$`), "Must start with core-network and then have 8 to 17 characters"),
 				),
 			},
 			"edge_location": {
@@ -78,7 +81,7 @@ func ResourceConnectAttachment() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 63),
-					validation.StringMatch(regexp.MustCompile(`[\s\S]*`), "Anything but whitespace"),
+					validation.StringMatch(regexache.MustCompile(`[\s\S]*`), "Anything but whitespace"),
 				),
 			},
 			"options": {
@@ -90,7 +93,7 @@ func ResourceConnectAttachment() *schema.Resource {
 						"protocol": {
 							Type:         schema.TypeString,
 							Optional:     true,
-							ValidateFunc: validation.StringInSlice([]string{"GRE"}, false),
+							ValidateFunc: validation.StringInSlice(networkmanager.TunnelProtocol_Values(), false),
 						},
 					},
 				},
@@ -119,7 +122,7 @@ func ResourceConnectAttachment() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(0, 50),
-					validation.StringMatch(regexp.MustCompile(`^attachment-([0-9a-f]{8,17})$`), "Must start with attachment- and then have 8 to 17 characters"),
+					validation.StringMatch(regexache.MustCompile(`^attachment-([0-9a-f]{8,17})$`), "Must start with attachment- and then have 8 to 17 characters"),
 				),
 			},
 		},
diff --git a/internal/service/networkmanager/connect_attachment_test.go b/internal/service/networkmanager/connect_attachment_test.go
index c408a9a8877..fc12393296b 100644
--- a/internal/service/networkmanager/connect_attachment_test.go
+++ b/internal/service/networkmanager/connect_attachment_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package networkmanager_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/networkmanager"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -32,10 +35,11 @@ func TestAccNetworkManagerConnectAttachment_basic(t *testing.T) {
 				Config: testAccConnectAttachmentConfig_basic(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckConnectAttachmentExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "networkmanager", regexp.MustCompile(`attachment/.+`)),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "networkmanager", regexache.MustCompile(`attachment/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "attachment_type", "CONNECT"),
 					resource.TestCheckResourceAttrSet(resourceName, "core_network_id"),
 					resource.TestCheckResourceAttr(resourceName, "edge_location", acctest.Region()),
+					resource.TestCheckResourceAttr(resourceName, "options.0.protocol", "GRE"),
 					acctest.CheckResourceAttrAccountID(resourceName, "owner_account_id"),
 					resource.TestCheckResourceAttr(resourceName, "segment_name", "shared"),
 					resource.TestCheckResourceAttrSet(resourceName, "state"),
@@ -67,10 +71,11 @@ func TestAccNetworkManagerConnectAttachment_basic_NoDependsOn(t *testing.T) {
 				Config: testAccConnectAttachmentConfig_basic_NoDependsOn(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckConnectAttachmentExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "networkmanager", regexp.MustCompile(`attachment/.+`)),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "networkmanager", regexache.MustCompile(`attachment/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "attachment_type", "CONNECT"),
 					resource.TestCheckResourceAttrSet(resourceName, "core_network_id"),
 					resource.TestCheckResourceAttr(resourceName, "edge_location", acctest.Region()),
+					resource.TestCheckResourceAttr(resourceName, "options.0.protocol", "GRE"),
 					acctest.CheckResourceAttrAccountID(resourceName, "owner_account_id"),
 					resource.TestCheckResourceAttr(resourceName, "segment_name", "shared"),
 					resource.TestCheckResourceAttrSet(resourceName, "state"),
@@ -110,6 +115,42 @@ func TestAccNetworkManagerConnectAttachment_disappears(t *testing.T) {
 	})
 }
 
+func TestAccNetworkManagerConnectAttachment_protocolNoEncap(t *testing.T) {
+	ctx := acctest.Context(t)
+	var v networkmanager.ConnectAttachment
+	resourceName := "aws_networkmanager_connect_attachment.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, networkmanager.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckConnectAttachmentDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccConnectAttachmentConfig_protocolNoEncap(rName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckConnectAttachmentExists(ctx, resourceName, &v),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "networkmanager", regexache.MustCompile(`attachment/.+`)),
+					resource.TestCheckResourceAttr(resourceName, "attachment_type", "CONNECT"),
+					resource.TestCheckResourceAttrSet(resourceName, "core_network_id"),
+					resource.TestCheckResourceAttr(resourceName, "edge_location", acctest.Region()),
+					resource.TestCheckResourceAttr(resourceName, "options.0.protocol", "NO_ENCAP"),
+					acctest.CheckResourceAttrAccountID(resourceName, "owner_account_id"),
+					resource.TestCheckResourceAttr(resourceName, "segment_name", "shared"),
+					resource.TestCheckResourceAttrSet(resourceName, "state"),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
 func TestAccNetworkManagerConnectAttachment_tags(t *testing.T) {
 	ctx := acctest.Context(t)
 	var v networkmanager.ConnectAttachment
@@ -244,13 +285,17 @@ resource "aws_networkmanager_global_network" "test" {
 
 resource "aws_networkmanager_core_network" "test" {
   global_network_id = aws_networkmanager_global_network.test.id
-  policy_document   = data.aws_networkmanager_core_network_policy_document.test.json
 
   tags = {
     Name = %[1]q
   }
 }
 
+resource "aws_networkmanager_core_network_policy_attachment" "test" {
+  core_network_id = aws_networkmanager_core_network.test.id
+  policy_document = data.aws_networkmanager_core_network_policy_document.test.json
+}
+
 data "aws_networkmanager_core_network_policy_document" "test" {
   core_network_configuration {
     vpn_ecmp_support = false
@@ -294,7 +339,7 @@ func testAccConnectAttachmentConfig_basic(rName string) string {
 	return acctest.ConfigCompose(testAccConnectAttachmentConfig_base(rName), `
 resource "aws_networkmanager_vpc_attachment" "test" {
   subnet_arns     = aws_subnet.test[*].arn
-  core_network_id = aws_networkmanager_core_network.test.id
+  core_network_id = aws_networkmanager_core_network_policy_attachment.test.core_network_id
   vpc_arn         = aws_vpc.test.arn
   tags = {
     segment = "shared"
@@ -332,7 +377,7 @@ func testAccConnectAttachmentConfig_basic_NoDependsOn(rName string) string {
 	return acctest.ConfigCompose(testAccConnectAttachmentConfig_base(rName), `
 resource "aws_networkmanager_vpc_attachment" "test" {
   subnet_arns     = aws_subnet.test[*].arn
-  core_network_id = aws_networkmanager_core_network.test.id
+  core_network_id = aws_networkmanager_core_network_policy_attachment.test.core_network_id
   vpc_arn         = aws_vpc.test.arn
   tags = {
     segment = "shared"
@@ -363,11 +408,49 @@ resource "aws_networkmanager_attachment_accepter" "test2" {
 `)
 }
 
+func testAccConnectAttachmentConfig_protocolNoEncap(rName string) string {
+	return acctest.ConfigCompose(testAccConnectAttachmentConfig_base(rName), `
+resource "aws_networkmanager_vpc_attachment" "test" {
+  subnet_arns     = aws_subnet.test[*].arn
+  core_network_id = aws_networkmanager_core_network_policy_attachment.test.core_network_id
+  vpc_arn         = aws_vpc.test.arn
+  tags = {
+    segment = "shared"
+  }
+}
+
+resource "aws_networkmanager_attachment_accepter" "test" {
+  attachment_id   = aws_networkmanager_vpc_attachment.test.id
+  attachment_type = aws_networkmanager_vpc_attachment.test.attachment_type
+}
+
+resource "aws_networkmanager_connect_attachment" "test" {
+  core_network_id         = aws_networkmanager_core_network.test.id
+  transport_attachment_id = aws_networkmanager_vpc_attachment.test.id
+  edge_location           = aws_networkmanager_vpc_attachment.test.edge_location
+  options {
+    protocol = "NO_ENCAP"
+  }
+  tags = {
+    segment = "shared"
+  }
+  depends_on = [
+    "aws_networkmanager_attachment_accepter.test"
+  ]
+}
+
+resource "aws_networkmanager_attachment_accepter" "test2" {
+  attachment_id   = aws_networkmanager_connect_attachment.test.id
+  attachment_type = aws_networkmanager_connect_attachment.test.attachment_type
+}
+`)
+}
+
 func testAccConnectAttachmentConfig_tags1(rName, tagKey1, tagValue1 string) string {
 	return acctest.ConfigCompose(testAccConnectAttachmentConfig_base(rName), fmt.Sprintf(`
 resource "aws_networkmanager_vpc_attachment" "test" {
   subnet_arns     = [aws_subnet.test[0].arn]
-  core_network_id = aws_networkmanager_core_network.test.id
+  core_network_id = aws_networkmanager_core_network_policy_attachment.test.core_network_id
   vpc_arn         = aws_vpc.test.arn
   tags = {
     segment = "shared"
@@ -405,7 +488,7 @@ func testAccConnectAttachmentConfig_tags2(rName, tagKey1, tagValue1, tagKey2, ta
 	return acctest.ConfigCompose(testAccConnectAttachmentConfig_base(rName), fmt.Sprintf(`
 resource "aws_networkmanager_vpc_attachment" "test" {
   subnet_arns     = [aws_subnet.test[0].arn]
-  core_network_id = aws_networkmanager_core_network.test.id
+  core_network_id = aws_networkmanager_core_network_policy_attachment.test.core_network_id
   vpc_arn         = aws_vpc.test.arn
   tags = {
     segment = "shared"
diff --git a/internal/service/networkmanager/connect_peer.go b/internal/service/networkmanager/connect_peer.go
index 0f253bdef20..ecb5b081005 100644
--- a/internal/service/networkmanager/connect_peer.go
+++ b/internal/service/networkmanager/connect_peer.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package networkmanager
 
 import (
@@ -5,10 +8,10 @@ import (
 	"errors"
 	"fmt"
 	"log"
-	"regexp"
 	"strings"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/aws/aws-sdk-go/service/networkmanager"
@@ -120,7 +123,7 @@ func ResourceConnectPeer() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(0, 50),
-					validation.StringMatch(regexp.MustCompile(`^attachment-([0-9a-f]{8,17})$`), "Must start with attachment and then have 8 to 17 characters"),
+					validation.StringMatch(regexache.MustCompile(`^attachment-([0-9a-f]{8,17})$`), "Must start with attachment and then have 8 to 17 characters"),
 				),
 			},
 			"connect_peer_id": {
@@ -133,7 +136,7 @@ func ResourceConnectPeer() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 50),
-					validation.StringMatch(regexp.MustCompile(`[\s\S]*`), "Anything but whitespace"),
+					validation.StringMatch(regexache.MustCompile(`[\s\S]*`), "Anything but whitespace"),
 				),
 			},
 			"core_network_id": {
@@ -150,7 +153,7 @@ func ResourceConnectPeer() *schema.Resource {
 			},
 			"inside_cidr_blocks": {
 				Type:     schema.TypeList,
-				Required: true,
+				Optional: true,
 				ForceNew: true,
 				MaxItems: 2,
 				Elem: &schema.Schema{
@@ -164,7 +167,15 @@ func ResourceConnectPeer() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 50),
-					validation.StringMatch(regexp.MustCompile(`[\s\S]*`), "Anything but whitespace"),
+					validation.StringMatch(regexache.MustCompile(`[\s\S]*`), "Anything but whitespace"),
+				),
+			},
+			"subnet_arn": {
+				Type:     schema.TypeString,
+				Optional: true,
+				ValidateFunc: validation.All(
+					validation.StringLenBetween(0, 500),
+					validation.StringMatch(regexache.MustCompile(`^arn:[^:]{1,63}:ec2:[^:]{0,63}:[^:]{0,63}:subnet\/subnet-[0-9a-f]{8,17}$|^$`), "Must be a valid subnet ARN"),
 				),
 			},
 			"state": {
@@ -181,13 +192,13 @@ func resourceConnectPeerCreate(ctx context.Context, d *schema.ResourceData, meta
 	conn := meta.(*conns.AWSClient).NetworkManagerConn(ctx)
 
 	connectAttachmentID := d.Get("connect_attachment_id").(string)
-	insideCIDRBlocks := flex.ExpandStringList(d.Get("inside_cidr_blocks").([]interface{}))
+	// insideCIDRBlocks := flex.ExpandStringList(d.Get("inside_cidr_blocks").([]interface{}))
 	peerAddress := d.Get("peer_address").(string)
 	input := &networkmanager.CreateConnectPeerInput{
 		ConnectAttachmentId: aws.String(connectAttachmentID),
-		InsideCidrBlocks:    insideCIDRBlocks,
-		PeerAddress:         aws.String(peerAddress),
-		Tags:                getTagsIn(ctx),
+		// InsideCidrBlocks:    insideCIDRBlocks,
+		PeerAddress: aws.String(peerAddress),
+		Tags:        getTagsIn(ctx),
 	}
 
 	if v, ok := d.GetOk("bgp_options"); ok && len(v.([]interface{})) > 0 {
@@ -198,6 +209,15 @@ func resourceConnectPeerCreate(ctx context.Context, d *schema.ResourceData, meta
 		input.CoreNetworkAddress = aws.String(v.(string))
 	}
 
+	if v, ok := d.GetOk("inside_cidr_blocks"); ok {
+		insideCIDRBlocks := flex.ExpandStringList(v.([]interface{}))
+		input.InsideCidrBlocks = insideCIDRBlocks
+	}
+
+	if v, ok := d.GetOk("subnet_arn"); ok {
+		input.SubnetArn = aws.String(v.(string))
+	}
+
 	outputRaw, err := tfresource.RetryWhen(ctx, d.Timeout(schema.TimeoutCreate),
 		func() (interface{}, error) {
 			return conn.CreateConnectPeerWithContext(ctx, input)
@@ -274,6 +294,7 @@ func resourceConnectPeerRead(ctx context.Context, d *schema.ResourceData, meta i
 	d.Set("connect_attachment_id", connectPeer.ConnectAttachmentId)
 	d.Set("inside_cidr_blocks", connectPeer.Configuration.InsideCidrBlocks)
 	d.Set("peer_address", connectPeer.Configuration.PeerAddress)
+	d.Set("subnet_arn", connectPeer.SubnetArn)
 	d.Set("state", connectPeer.State)
 
 	setTagsOut(ctx, connectPeer.Tags)
diff --git a/internal/service/networkmanager/connect_peer_test.go b/internal/service/networkmanager/connect_peer_test.go
index 4385b4672f7..160be16297e 100644
--- a/internal/service/networkmanager/connect_peer_test.go
+++ b/internal/service/networkmanager/connect_peer_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package networkmanager_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/networkmanager"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -23,6 +26,7 @@ func TestAccNetworkManagerConnectPeer_basic(t *testing.T) {
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	insideCidrBlocksv4 := "169.254.10.0/29"
 	peerAddress := "1.1.1.1"
+	protocol := "GRE"
 	asn := "65501"
 
 	resource.ParallelTest(t, resource.TestCase{
@@ -32,10 +36,10 @@ func TestAccNetworkManagerConnectPeer_basic(t *testing.T) {
 		CheckDestroy:             testAccCheckConnectPeerDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccConnectPeerConfig_basic(rName, insideCidrBlocksv4, peerAddress, asn),
+				Config: testAccConnectPeerConfig_basic(rName, insideCidrBlocksv4, peerAddress, asn, protocol),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckConnectPeerExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "networkmanager", regexp.MustCompile(`connect-peer/.+`)),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "networkmanager", regexache.MustCompile(`connect-peer/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "configuration.#", "1"),
 					resource.TestCheckResourceAttrSet(resourceName, "configuration.0.core_network_address"),
 					resource.TestCheckResourceAttr(resourceName, "configuration.0.inside_cidr_blocks.0", insideCidrBlocksv4),
@@ -67,6 +71,7 @@ func TestAccNetworkManagerConnectPeer_noDependsOn(t *testing.T) {
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	insideCidrBlocksv4 := "169.254.10.0/29"
 	peerAddress := "1.1.1.1"
+	protocol := "GRE"
 	asn := "65501"
 
 	resource.ParallelTest(t, resource.TestCase{
@@ -76,10 +81,10 @@ func TestAccNetworkManagerConnectPeer_noDependsOn(t *testing.T) {
 		CheckDestroy:             testAccCheckConnectPeerDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccConnectPeerConfig_noDependsOn(rName, insideCidrBlocksv4, peerAddress, asn),
+				Config: testAccConnectPeerConfig_noDependsOn(rName, insideCidrBlocksv4, peerAddress, asn, protocol),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckConnectPeerExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "networkmanager", regexp.MustCompile(`connect-peer/.+`)),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "networkmanager", regexache.MustCompile(`connect-peer/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "configuration.#", "1"),
 					resource.TestCheckResourceAttrSet(resourceName, "configuration.0.core_network_address"),
 					resource.TestCheckResourceAttr(resourceName, "configuration.0.inside_cidr_blocks.0", insideCidrBlocksv4),
@@ -104,6 +109,49 @@ func TestAccNetworkManagerConnectPeer_noDependsOn(t *testing.T) {
 	})
 }
 
+func TestAccNetworkManagerConnectPeer_subnetARN(t *testing.T) {
+	ctx := acctest.Context(t)
+	var v networkmanager.ConnectPeer
+	resourceName := "aws_networkmanager_connect_peer.test"
+	subnetResourceName := "aws_subnet.test2"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	peerAddress := "1.1.1.1"
+	protocol := "NO_ENCAP"
+	asn := "65501"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, networkmanager.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckConnectPeerDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccConnectPeerConfig_subnetARN(rName, peerAddress, asn, protocol),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckConnectPeerExists(ctx, resourceName, &v),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "networkmanager", regexache.MustCompile(`connect-peer/.+`)),
+					resource.TestCheckResourceAttr(resourceName, "configuration.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "configuration.0.peer_address", peerAddress),
+					resource.TestCheckResourceAttr(resourceName, "configuration.0.protocol", "NO_ENCAP"),
+					resource.TestCheckResourceAttr(resourceName, "configuration.0.bgp_configurations.#", "1"),
+					resource.TestCheckResourceAttrSet(resourceName, "connect_attachment_id"),
+					resource.TestCheckResourceAttr(resourceName, "peer_address", peerAddress),
+					resource.TestCheckResourceAttr(resourceName, "edge_location", acctest.Region()),
+					resource.TestCheckResourceAttrSet(resourceName, "connect_attachment_id"),
+					resource.TestCheckResourceAttrPair(resourceName, "subnet_arn", subnetResourceName, "arn"),
+					resource.TestCheckResourceAttrSet(resourceName, "state"),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
 func TestAccNetworkManagerConnectPeer_tags(t *testing.T) {
 	ctx := acctest.Context(t)
 	var v networkmanager.ConnectPeer
@@ -111,6 +159,7 @@ func TestAccNetworkManagerConnectPeer_tags(t *testing.T) {
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	insideCidrBlocksv4 := "169.254.10.0/29"
 	peerAddress := "1.1.1.1"
+	protocol := "GRE"
 	asn := "65501"
 
 	resource.ParallelTest(t, resource.TestCase{
@@ -120,7 +169,7 @@ func TestAccNetworkManagerConnectPeer_tags(t *testing.T) {
 		CheckDestroy:             testAccCheckConnectPeerDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccConnectPeerConfig_tags1(rName, "Name", "test", insideCidrBlocksv4, peerAddress, asn),
+				Config: testAccConnectPeerConfig_tags1(rName, "Name", "test", insideCidrBlocksv4, peerAddress, asn, protocol),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckConnectPeerExists(ctx, resourceName, &v),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
@@ -128,7 +177,7 @@ func TestAccNetworkManagerConnectPeer_tags(t *testing.T) {
 				),
 			},
 			{
-				Config: testAccConnectPeerConfig_tags2(rName, "Name", "test", "env", "test", insideCidrBlocksv4, peerAddress, asn),
+				Config: testAccConnectPeerConfig_tags2(rName, "Name", "test", "env", "test", insideCidrBlocksv4, peerAddress, asn, protocol),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckConnectPeerExists(ctx, resourceName, &v),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
@@ -137,7 +186,7 @@ func TestAccNetworkManagerConnectPeer_tags(t *testing.T) {
 				),
 			},
 			{
-				Config: testAccConnectPeerConfig_tags1(rName, "Name", "test", insideCidrBlocksv4, peerAddress, asn),
+				Config: testAccConnectPeerConfig_tags1(rName, "Name", "test", insideCidrBlocksv4, peerAddress, asn, protocol),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckConnectPeerExists(ctx, resourceName, &v),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
@@ -203,7 +252,7 @@ func testAccCheckConnectPeerDestroy(ctx context.Context) resource.TestCheckFunc
 	}
 }
 
-func testAccConnectPeerConfig_base(rName string) string {
+func testAccConnectPeerConfig_base(rName string, protocol string) string {
 	return acctest.ConfigCompose(acctest.ConfigAvailableAZsNoOptIn(), fmt.Sprintf(`
 data "aws_region" "current" {}
 
@@ -235,12 +284,17 @@ resource "aws_networkmanager_global_network" "test" {
 
 resource "aws_networkmanager_core_network" "test" {
   global_network_id = aws_networkmanager_global_network.test.id
-  policy_document   = data.aws_networkmanager_core_network_policy_document.test.json
+
   tags = {
     Name = %[1]q
   }
 }
 
+resource "aws_networkmanager_core_network_policy_attachment" "test" {
+  core_network_id = aws_networkmanager_core_network.test.id
+  policy_document = data.aws_networkmanager_core_network_policy_document.test.json
+}
+
 data "aws_networkmanager_core_network_policy_document" "test" {
   core_network_configuration {
     vpn_ecmp_support   = false
@@ -281,7 +335,7 @@ data "aws_networkmanager_core_network_policy_document" "test" {
 
 resource "aws_networkmanager_vpc_attachment" "test" {
   subnet_arns     = aws_subnet.test[*].arn
-  core_network_id = aws_networkmanager_core_network.test.id
+  core_network_id = aws_networkmanager_core_network_policy_attachment.test.core_network_id
   vpc_arn         = aws_vpc.test.arn
   tags = {
     segment = "shared"
@@ -298,7 +352,7 @@ resource "aws_networkmanager_connect_attachment" "test" {
   transport_attachment_id = aws_networkmanager_vpc_attachment.test.id
   edge_location           = aws_networkmanager_vpc_attachment.test.edge_location
   options {
-    protocol = "GRE"
+    protocol = %[2]q
   }
   tags = {
     segment = "shared"
@@ -312,11 +366,11 @@ resource "aws_networkmanager_attachment_accepter" "test2" {
   attachment_id   = aws_networkmanager_connect_attachment.test.id
   attachment_type = aws_networkmanager_connect_attachment.test.attachment_type
 }
-`, rName))
+`, rName, protocol))
 }
 
-func testAccConnectPeerConfig_basic(rName string, insideCidrBlocks string, peerAddress string, asn string) string {
-	return acctest.ConfigCompose(testAccConnectPeerConfig_base(rName), fmt.Sprintf(`
+func testAccConnectPeerConfig_basic(rName string, insideCidrBlocks string, peerAddress string, asn string, protocol string) string {
+	return acctest.ConfigCompose(testAccConnectPeerConfig_base(rName, protocol), fmt.Sprintf(`
 resource "aws_networkmanager_connect_peer" "test" {
   connect_attachment_id = aws_networkmanager_connect_attachment.test.id
   peer_address          = %[3]q
@@ -336,8 +390,8 @@ resource "aws_networkmanager_connect_peer" "test" {
 `, rName, insideCidrBlocks, peerAddress, asn))
 }
 
-func testAccConnectPeerConfig_noDependsOn(rName string, insideCidrBlocks string, peerAddress string, asn string) string {
-	return acctest.ConfigCompose(testAccConnectPeerConfig_base(rName), fmt.Sprintf(`
+func testAccConnectPeerConfig_noDependsOn(rName string, insideCidrBlocks string, peerAddress string, asn string, protocol string) string {
+	return acctest.ConfigCompose(testAccConnectPeerConfig_base(rName, protocol), fmt.Sprintf(`
 resource "aws_networkmanager_connect_peer" "test" {
   connect_attachment_id = aws_networkmanager_connect_attachment.test.id
   peer_address          = %[3]q
@@ -354,8 +408,32 @@ resource "aws_networkmanager_connect_peer" "test" {
 `, rName, insideCidrBlocks, peerAddress, asn))
 }
 
-func testAccConnectPeerConfig_tags1(rName, tagKey1, tagValue1 string, insideCidrBlocks string, peerAddress string, asn string) string {
-	return acctest.ConfigCompose(testAccConnectPeerConfig_base(rName), fmt.Sprintf(`
+func testAccConnectPeerConfig_subnetARN(rName string, peerAddress string, asn string, protocol string) string {
+	return acctest.ConfigCompose(testAccConnectPeerConfig_base(rName, protocol), fmt.Sprintf(`
+resource "aws_networkmanager_connect_peer" "test" {
+  connect_attachment_id = aws_networkmanager_connect_attachment.test.id
+  peer_address          = %[2]q
+  bgp_options {
+    peer_asn = %[3]q
+  }
+  subnet_arn = aws_subnet.test2.arn
+  tags = {
+    Name = %[1]q
+  }
+  depends_on = [
+    "aws_networkmanager_attachment_accepter.test"
+  ]
+}
+
+resource "aws_subnet" "test2" {
+  vpc_id     = aws_vpc.test.id
+  cidr_block = cidrsubnet(aws_vpc.test.cidr_block, 8, 2)
+}
+`, rName, peerAddress, asn))
+}
+
+func testAccConnectPeerConfig_tags1(rName, tagKey1, tagValue1 string, insideCidrBlocks string, peerAddress string, asn string, protocol string) string {
+	return acctest.ConfigCompose(testAccConnectPeerConfig_base(rName, protocol), fmt.Sprintf(`
 resource "aws_networkmanager_connect_peer" "test" {
   connect_attachment_id = aws_networkmanager_connect_attachment.test.id
   peer_address          = %[4]q
@@ -372,8 +450,8 @@ resource "aws_networkmanager_connect_peer" "test" {
 `, tagKey1, tagValue1, insideCidrBlocks, peerAddress, asn))
 }
 
-func testAccConnectPeerConfig_tags2(rName, tagKey1, tagValue1, tagKey2, tagValue2 string, insideCidrBlocks string, peerAddress string, asn string) string {
-	return acctest.ConfigCompose(testAccConnectPeerConfig_base(rName), fmt.Sprintf(`
+func testAccConnectPeerConfig_tags2(rName, tagKey1, tagValue1, tagKey2, tagValue2 string, insideCidrBlocks string, peerAddress string, asn string, protocol string) string {
+	return acctest.ConfigCompose(testAccConnectPeerConfig_base(rName, protocol), fmt.Sprintf(`
 resource "aws_networkmanager_connect_peer" "test" {
   connect_attachment_id = aws_networkmanager_connect_attachment.test.id
   peer_address          = %[6]q
diff --git a/internal/service/networkmanager/connection.go b/internal/service/networkmanager/connection.go
index d596a1ca8d8..dcd602b9f6c 100644
--- a/internal/service/networkmanager/connection.go
+++ b/internal/service/networkmanager/connection.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package networkmanager
 
 import (
diff --git a/internal/service/networkmanager/connection_data_source.go b/internal/service/networkmanager/connection_data_source.go
index a6e94370a98..7caa49a1e09 100644
--- a/internal/service/networkmanager/connection_data_source.go
+++ b/internal/service/networkmanager/connection_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package networkmanager
 
 import (
diff --git a/internal/service/networkmanager/connection_data_source_test.go b/internal/service/networkmanager/connection_data_source_test.go
index b6a60f43f45..ae24f8822e6 100644
--- a/internal/service/networkmanager/connection_data_source_test.go
+++ b/internal/service/networkmanager/connection_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package networkmanager_test
 
 import (
diff --git a/internal/service/networkmanager/connection_test.go b/internal/service/networkmanager/connection_test.go
index 712faab203d..9960fc959f7 100644
--- a/internal/service/networkmanager/connection_test.go
+++ b/internal/service/networkmanager/connection_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package networkmanager_test
 
 import (
diff --git a/internal/service/networkmanager/connections_data_source.go b/internal/service/networkmanager/connections_data_source.go
index bf4a9f8974e..5662c100834 100644
--- a/internal/service/networkmanager/connections_data_source.go
+++ b/internal/service/networkmanager/connections_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package networkmanager
 
 import (
diff --git a/internal/service/networkmanager/connections_data_source_test.go b/internal/service/networkmanager/connections_data_source_test.go
index 87493dbb769..121b1fb6595 100644
--- a/internal/service/networkmanager/connections_data_source_test.go
+++ b/internal/service/networkmanager/connections_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package networkmanager_test
 
 import (
diff --git a/internal/service/networkmanager/core_network.go b/internal/service/networkmanager/core_network.go
index 2d794c2035b..c74e3a39b14 100644
--- a/internal/service/networkmanager/core_network.go
+++ b/internal/service/networkmanager/core_network.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package networkmanager
 
 import (
@@ -16,6 +19,7 @@ import (
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/structure"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
@@ -61,13 +65,27 @@ func ResourceCoreNetwork() *schema.Resource {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
+			"base_policy_document": {
+				Type:     schema.TypeString,
+				Optional: true,
+				ValidateFunc: validation.All(
+					validation.StringLenBetween(0, 10000000),
+					validation.StringIsJSON,
+				),
+				DiffSuppressFunc: verify.SuppressEquivalentJSONDiffs,
+				StateFunc: func(v interface{}) string {
+					json, _ := structure.NormalizeJsonString(v)
+					return json
+				},
+				ConflictsWith: []string{"base_policy_region", "base_policy_regions"},
+			},
 			"base_policy_region": {
 				Deprecated: "Use the base_policy_regions argument instead. " +
 					"This argument will be removed in the next major version of the provider.",
 				Type:          schema.TypeString,
 				Optional:      true,
 				ValidateFunc:  verify.ValidRegionName,
-				ConflictsWith: []string{"base_policy_regions"},
+				ConflictsWith: []string{"base_policy_document", "base_policy_regions"},
 			},
 			"base_policy_regions": {
 				Type:     schema.TypeSet,
@@ -76,7 +94,7 @@ func ResourceCoreNetwork() *schema.Resource {
 					Type:         schema.TypeString,
 					ValidateFunc: verify.ValidRegionName,
 				},
-				ConflictsWith: []string{"base_policy_region"},
+				ConflictsWith: []string{"base_policy_document", "base_policy_region"},
 			},
 			"create_base_policy": {
 				Type:     schema.TypeBool,
@@ -169,19 +187,25 @@ func resourceCoreNetworkCreate(ctx context.Context, d *schema.ResourceData, meta
 	// this creates the core network with a starting policy document set to LIVE
 	// this is required for the first terraform apply if there attachments to the core network
 	if _, ok := d.GetOk("create_base_policy"); ok {
-		// if user supplies a region or multiple regions use it in the base policy, otherwise use current region
-		regions := []interface{}{meta.(*conns.AWSClient).Region}
-		if v, ok := d.GetOk("base_policy_region"); ok {
-			regions = []interface{}{v.(string)}
-		} else if v, ok := d.GetOk("base_policy_regions"); ok && v.(*schema.Set).Len() > 0 {
-			regions = v.(*schema.Set).List()
-		}
+		// if user supplies a full base_policy_document for maximum flexibility, use it. Otherwise, use regions list
+		// var policyDocumentTarget string
+		if v, ok := d.GetOk("base_policy_document"); ok {
+			input.PolicyDocument = aws.String(v.(string))
+		} else {
+			// if user supplies a region or multiple regions use it in the base policy, otherwise use current region
+			regions := []interface{}{meta.(*conns.AWSClient).Region}
+			if v, ok := d.GetOk("base_policy_region"); ok {
+				regions = []interface{}{v.(string)}
+			} else if v, ok := d.GetOk("base_policy_regions"); ok && v.(*schema.Set).Len() > 0 {
+				regions = v.(*schema.Set).List()
+			}
 
-		policyDocumentTarget, err := buildCoreNetworkBasePolicyDocument(regions)
-		if err != nil {
-			return diag.Errorf("Formatting Core Network Base Policy: %s", err)
+			policyDocumentTarget, err := buildCoreNetworkBasePolicyDocument(regions)
+			if err != nil {
+				return diag.Errorf("Formatting Core Network Base Policy: %s", err)
+			}
+			input.PolicyDocument = aws.String(policyDocumentTarget)
 		}
-		input.PolicyDocument = aws.String(policyDocumentTarget)
 	}
 
 	output, err := conn.CreateCoreNetworkWithContext(ctx, input)
diff --git a/internal/service/networkmanager/core_network_policy_attachment.go b/internal/service/networkmanager/core_network_policy_attachment.go
index 411f658bc5d..60516fc21c9 100644
--- a/internal/service/networkmanager/core_network_policy_attachment.go
+++ b/internal/service/networkmanager/core_network_policy_attachment.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package networkmanager
 
 import (
 	"context"
 	"log"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/private/protocol"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
@@ -39,7 +42,7 @@ func ResourceCoreNetworkPolicyAttachment() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(0, 50),
-					validation.StringMatch(regexp.MustCompile(`^core-network-([0-9a-f]{8,17})$`), "must be a valid Core Network ID"),
+					validation.StringMatch(regexache.MustCompile(`^core-network-([0-9a-f]{8,17})$`), "must be a valid Core Network ID"),
 				),
 			},
 			"policy_document": {
diff --git a/internal/service/networkmanager/core_network_policy_attachment_test.go b/internal/service/networkmanager/core_network_policy_attachment_test.go
index 1127fe2d2f0..c0249427fff 100644
--- a/internal/service/networkmanager/core_network_policy_attachment_test.go
+++ b/internal/service/networkmanager/core_network_policy_attachment_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package networkmanager_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/networkmanager"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -73,7 +76,7 @@ func TestAccNetworkManagerCoreNetworkPolicyAttachment_vpcAttachment(t *testing.T
 				Config: testAccCoreNetworkPolicyAttachmentConfig_vpcAttachmentCreate(),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckCoreNetworkPolicyAttachmentExists(ctx, resourceName),
-					resource.TestMatchResourceAttr(resourceName, "policy_document", regexp.MustCompile(fmt.Sprintf(`{"core-network-configuration":{"asn-ranges":\["65022-65534"\],"edge-locations":\[{"location":"%s"}\],"vpn-ecmp-support":true},"segment-actions":\[{"action":"create-route","destination-cidr-blocks":\["0.0.0.0/0"\],"destinations":\["attachment-.+"\],"segment":"segment"}\],"segments":\[{"isolate-attachments":false,"name":"segment","require-attachment-acceptance":true}\],"version":"2021.12"}`, acctest.Region()))),
+					resource.TestMatchResourceAttr(resourceName, "policy_document", regexache.MustCompile(fmt.Sprintf(`{"core-network-configuration":{"asn-ranges":\["65022-65534"\],"edge-locations":\[{"location":"%s"}\],"vpn-ecmp-support":true},"segment-actions":\[{"action":"create-route","destination-cidr-blocks":\["0.0.0.0/0"\],"destinations":\["attachment-.+"\],"segment":"segment"}\],"segments":\[{"isolate-attachments":false,"name":"segment","require-attachment-acceptance":true}\],"version":"2021.12"}`, acctest.Region()))),
 					resource.TestCheckResourceAttrPair(resourceName, "core_network_id", "aws_networkmanager_core_network.test", "id"),
 					resource.TestCheckResourceAttrPair(resourceName, "id", "aws_networkmanager_core_network.test", "id"),
 					resource.TestCheckResourceAttr(resourceName, "state", networkmanager.CoreNetworkStateAvailable),
@@ -116,7 +119,7 @@ func TestAccNetworkManagerCoreNetworkPolicyAttachment_vpcAttachmentMultiRegion(t
 				Config: testAccCoreNetworkPolicyAttachmentConfig_vpcAttachmentMultiRegionCreate(),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckCoreNetworkPolicyAttachmentExists(ctx, resourceName),
-					resource.TestMatchResourceAttr(resourceName, "policy_document", regexp.MustCompile(fmt.Sprintf(`{"core-network-configuration":{"asn-ranges":\["65022-65534"\],"edge-locations":\[{"location":"%s"},{"location":"%s"}\],"vpn-ecmp-support":true},"segment-actions":\[{"action":"create-route","destination-cidr-blocks":\["10.0.0.0/16"\],"destinations":\["attachment-.+"\],"segment":"segment"},{"action":"create-route","destination-cidr-blocks":\["10.1.0.0/16"\],"destinations":\["attachment-.+"\],"segment":"segment2"}\],"segments":\[{"isolate-attachments":false,"name":"segment","require-attachment-acceptance":true},{"isolate-attachments":false,"name":"segment2","require-attachment-acceptance":true}\],"version":"2021.12"}`, acctest.Region(), acctest.AlternateRegion()))),
+					resource.TestMatchResourceAttr(resourceName, "policy_document", regexache.MustCompile(fmt.Sprintf(`{"core-network-configuration":{"asn-ranges":\["65022-65534"\],"edge-locations":\[{"location":"%s"},{"location":"%s"}\],"vpn-ecmp-support":true},"segment-actions":\[{"action":"create-route","destination-cidr-blocks":\["10.0.0.0/16"\],"destinations":\["attachment-.+"\],"segment":"segment"},{"action":"create-route","destination-cidr-blocks":\["10.1.0.0/16"\],"destinations":\["attachment-.+"\],"segment":"segment2"}\],"segments":\[{"isolate-attachments":false,"name":"segment","require-attachment-acceptance":true},{"isolate-attachments":false,"name":"segment2","require-attachment-acceptance":true}\],"version":"2021.12"}`, acctest.Region(), acctest.AlternateRegion()))),
 					// use test below if the order of locations is unordered
 					// resource.TestCheckResourceAttr(resourceName, "policy_document", fmt.Sprintf("{\"core-network-configuration\":{\"asn-ranges\":[\"65022-65534\"],\"edge-locations\":[{\"location\":\"%s\"},{\"location\":\"%s\"}],\"vpn-ecmp-support\":true},\"segments\":[{\"description\":\"base-policy\",\"isolate-attachments\":false,\"name\":\"segment\",\"require-attachment-acceptance\":false}],\"version\":\"2021.12\"}", acctest.AlternateRegion(), acctest.Region())),
 					resource.TestCheckResourceAttrPair(resourceName, "core_network_id", "aws_networkmanager_core_network.test", "id"),
@@ -145,7 +148,7 @@ func TestAccNetworkManagerCoreNetworkPolicyAttachment_expectPolicyErrorInvalidAS
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccCoreNetworkPolicyAttachmentConfig_expectPolicyErrorInvalidASNRange(),
-				ExpectError: regexp.MustCompile("INVALID_ASN_RANGE"),
+				ExpectError: regexache.MustCompile("INVALID_ASN_RANGE"),
 			},
 		},
 	})
diff --git a/internal/service/networkmanager/core_network_policy_document_data_source.go b/internal/service/networkmanager/core_network_policy_document_data_source.go
index 91fb8fdd918..091e6095057 100644
--- a/internal/service/networkmanager/core_network_policy_document_data_source.go
+++ b/internal/service/networkmanager/core_network_policy_document_data_source.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package networkmanager
 
 import (
 	"context"
 	"encoding/json"
 	"fmt"
-	"regexp"
 	"strconv"
 
+	"github.com/YakDriver/regexache"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
@@ -108,7 +111,7 @@ func DataSourceCoreNetworkPolicyDocument() *schema.Resource {
 									"segment": {
 										Type:     schema.TypeString,
 										Optional: true,
-										ValidateFunc: validation.StringMatch(regexp.MustCompile(`^[a-zA-Z][A-Za-z0-9]{0,63}$`),
+										ValidateFunc: validation.StringMatch(regexache.MustCompile(`^[A-Za-z][0-9A-Za-z]{0,63}$`),
 											"must begin with a letter and contain only alphanumeric characters"),
 									},
 									"tag_value_of_key": {
@@ -194,7 +197,7 @@ func DataSourceCoreNetworkPolicyDocument() *schema.Resource {
 							Optional: true,
 							Elem: &schema.Schema{
 								Type: schema.TypeString,
-								ValidateFunc: validation.StringMatch(regexp.MustCompile(`^[a-zA-Z][A-Za-z0-9]{0,63}$`),
+								ValidateFunc: validation.StringMatch(regexache.MustCompile(`^[A-Za-z][0-9A-Za-z]{0,63}$`),
 									"must begin with a letter and contain only alphanumeric characters"),
 							},
 						},
@@ -203,14 +206,14 @@ func DataSourceCoreNetworkPolicyDocument() *schema.Resource {
 							Optional: true,
 							Elem: &schema.Schema{
 								Type: schema.TypeString,
-								ValidateFunc: validation.StringMatch(regexp.MustCompile(`^[a-zA-Z][A-Za-z0-9]{0,63}$`),
+								ValidateFunc: validation.StringMatch(regexache.MustCompile(`^[A-Za-z][0-9A-Za-z]{0,63}$`),
 									"must begin with a letter and contain only alphanumeric characters"),
 							},
 						},
 						"name": {
 							Type:     schema.TypeString,
 							Required: true,
-							ValidateFunc: validation.StringMatch(regexp.MustCompile(`^[a-zA-Z][A-Za-z0-9]{0,63}$`),
+							ValidateFunc: validation.StringMatch(regexache.MustCompile(`^[A-Za-z][0-9A-Za-z]{0,63}$`),
 								"must begin with a letter and contain only alphanumeric characters"),
 						},
 						"description": {
@@ -265,7 +268,7 @@ func DataSourceCoreNetworkPolicyDocument() *schema.Resource {
 									validation.StringInSlice([]string{
 										"blackhole",
 									}, false),
-									validation.StringMatch(regexp.MustCompile(`^attachment-[0-9a-f]{17}$`),
+									validation.StringMatch(regexache.MustCompile(`^attachment-[0-9a-f]{17}$`),
 										"must be a list of valid attachment ids or a list with only the word \"blackhole\"."),
 								),
 							},
@@ -291,7 +294,7 @@ func DataSourceCoreNetworkPolicyDocument() *schema.Resource {
 						"segment": {
 							Type:     schema.TypeString,
 							Required: true,
-							ValidateFunc: validation.StringMatch(regexp.MustCompile(`^[a-zA-Z][A-Za-z0-9]{0,63}$`),
+							ValidateFunc: validation.StringMatch(regexache.MustCompile(`^[A-Za-z][0-9A-Za-z]{0,63}$`),
 								"must begin with a letter and contain only alphanumeric characters"),
 						},
 						"share_with":        setOfString,
diff --git a/internal/service/networkmanager/core_network_policy_document_data_source_test.go b/internal/service/networkmanager/core_network_policy_document_data_source_test.go
index 16737d30652..224c9cdc434 100644
--- a/internal/service/networkmanager/core_network_policy_document_data_source_test.go
+++ b/internal/service/networkmanager/core_network_policy_document_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package networkmanager_test
 
 import (
diff --git a/internal/service/networkmanager/core_network_policy_model.go b/internal/service/networkmanager/core_network_policy_model.go
index a34d165d1f7..daf1a732a0f 100644
--- a/internal/service/networkmanager/core_network_policy_model.go
+++ b/internal/service/networkmanager/core_network_policy_model.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package networkmanager
 
 import (
diff --git a/internal/service/networkmanager/core_network_test.go b/internal/service/networkmanager/core_network_test.go
index ac3cad7ef98..db49ef2a9af 100644
--- a/internal/service/networkmanager/core_network_test.go
+++ b/internal/service/networkmanager/core_network_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package networkmanager_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/networkmanager"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
@@ -29,10 +32,10 @@ func TestAccNetworkManagerCoreNetwork_basic(t *testing.T) {
 				Config: testAccCoreNetworkConfig_basic(),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckCoreNetworkExists(ctx, resourceName),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "networkmanager", regexp.MustCompile(`core-network/core-network-.+`)),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "networkmanager", regexache.MustCompile(`core-network/core-network-.+`)),
 					resource.TestCheckResourceAttrSet(resourceName, "created_at"),
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
-					resource.TestMatchResourceAttr(resourceName, "id", regexp.MustCompile(`core-network-.+`)),
+					resource.TestMatchResourceAttr(resourceName, "id", regexache.MustCompile(`core-network-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "state", networkmanager.CoreNetworkStateAvailable),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 				),
@@ -273,6 +276,50 @@ func TestAccNetworkManagerCoreNetwork_createBasePolicyDocumentWithMultiRegion(t
 	})
 }
 
+func TestAccNetworkManagerCoreNetwork_createBasePolicyDocumentWithPolicyDocument(t *testing.T) {
+	ctx := acctest.Context(t)
+	resourceName := "aws_networkmanager_core_network.test"
+	edgeAsn1 := "65500"
+	edgeAsn2 := "65501"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, networkmanager.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckCoreNetworkDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccCoreNetworkConfig_basePolicyDocumentWithPolicyDocument(edgeAsn1, edgeAsn2),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckCoreNetworkExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "create_base_policy", "true"),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "edges.*", map[string]string{
+						"asn":                  edgeAsn1,
+						"edge_location":        acctest.AlternateRegion(),
+						"inside_cidr_blocks.#": "0",
+					}),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "edges.*", map[string]string{
+						"asn":                  edgeAsn2,
+						"edge_location":        acctest.Region(),
+						"inside_cidr_blocks.#": "0",
+					}),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "segments.*", map[string]string{
+						"edge_locations.#":  "2",
+						"name":              "segment",
+						"shared_segments.#": "0",
+					}),
+				),
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"base_policy_document", "create_base_policy"},
+			},
+		},
+	})
+}
+
 func TestAccNetworkManagerCoreNetwork_withoutPolicyDocumentUpdateToCreateBasePolicyDocument(t *testing.T) {
 	ctx := acctest.Context(t)
 	resourceName := "aws_networkmanager_core_network.test"
@@ -446,3 +493,35 @@ resource "aws_networkmanager_core_network" "test" {
 }
 `, acctest.AlternateRegion(), acctest.Region())
 }
+
+func testAccCoreNetworkConfig_basePolicyDocumentWithPolicyDocument(edgeAsn1, edgeAsn2 string) string {
+	return fmt.Sprintf(`
+resource "aws_networkmanager_global_network" "test" {}
+
+data "aws_networkmanager_core_network_policy_document" "test" {
+  core_network_configuration {
+    asn_ranges = ["65022-65534"]
+
+    edge_locations {
+      location = %[1]q
+      asn      = %[2]q
+    }
+
+    edge_locations {
+      location = %[3]q
+      asn      = %[4]q
+    }
+  }
+
+  segments {
+    name = "segment"
+  }
+}
+
+resource "aws_networkmanager_core_network" "test" {
+  global_network_id    = aws_networkmanager_global_network.test.id
+  create_base_policy   = true
+  base_policy_document = data.aws_networkmanager_core_network_policy_document.test.json
+}
+`, acctest.AlternateRegion(), edgeAsn1, acctest.Region(), edgeAsn2)
+}
diff --git a/internal/service/networkmanager/customer_gateway_association.go b/internal/service/networkmanager/customer_gateway_association.go
index a75f1de3d15..3baca75fe4b 100644
--- a/internal/service/networkmanager/customer_gateway_association.go
+++ b/internal/service/networkmanager/customer_gateway_association.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package networkmanager
 
 import (
diff --git a/internal/service/networkmanager/customer_gateway_association_test.go b/internal/service/networkmanager/customer_gateway_association_test.go
index d2b364b2a7a..2a0f6c0fafb 100644
--- a/internal/service/networkmanager/customer_gateway_association_test.go
+++ b/internal/service/networkmanager/customer_gateway_association_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package networkmanager_test
 
 import (
diff --git a/internal/service/networkmanager/device.go b/internal/service/networkmanager/device.go
index e97deedd885..9db8f1b3e3f 100644
--- a/internal/service/networkmanager/device.go
+++ b/internal/service/networkmanager/device.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package networkmanager
 
 import (
diff --git a/internal/service/networkmanager/device_data_source.go b/internal/service/networkmanager/device_data_source.go
index 3f494b0b5c1..4610ce86923 100644
--- a/internal/service/networkmanager/device_data_source.go
+++ b/internal/service/networkmanager/device_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package networkmanager
 
 import (
diff --git a/internal/service/networkmanager/device_data_source_test.go b/internal/service/networkmanager/device_data_source_test.go
index 0074c1a8e4b..348d10e9112 100644
--- a/internal/service/networkmanager/device_data_source_test.go
+++ b/internal/service/networkmanager/device_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package networkmanager_test
 
 import (
diff --git a/internal/service/networkmanager/device_test.go b/internal/service/networkmanager/device_test.go
index dde832b840c..e8aa19e2b72 100644
--- a/internal/service/networkmanager/device_test.go
+++ b/internal/service/networkmanager/device_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package networkmanager_test
 
 import (
diff --git a/internal/service/networkmanager/devices_data_source.go b/internal/service/networkmanager/devices_data_source.go
index af636c9683d..f29de277479 100644
--- a/internal/service/networkmanager/devices_data_source.go
+++ b/internal/service/networkmanager/devices_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package networkmanager
 
 import (
diff --git a/internal/service/networkmanager/devices_data_source_test.go b/internal/service/networkmanager/devices_data_source_test.go
index 01508f76721..734588c46c8 100644
--- a/internal/service/networkmanager/devices_data_source_test.go
+++ b/internal/service/networkmanager/devices_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package networkmanager_test
 
 import (
diff --git a/internal/service/networkmanager/errors.go b/internal/service/networkmanager/errors.go
index 6ff3b68dc30..ad293d814be 100644
--- a/internal/service/networkmanager/errors.go
+++ b/internal/service/networkmanager/errors.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package networkmanager
 
 import (
diff --git a/internal/service/networkmanager/generate.go b/internal/service/networkmanager/generate.go
index f7e4eb1a5c5..f6a18a9e8a1 100644
--- a/internal/service/networkmanager/generate.go
+++ b/internal/service/networkmanager/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ServiceTagsSlice -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/networkmanager/global_network.go b/internal/service/networkmanager/global_network.go
index b8bf8928e19..f0ee4b518ac 100644
--- a/internal/service/networkmanager/global_network.go
+++ b/internal/service/networkmanager/global_network.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package networkmanager
 
 import (
diff --git a/internal/service/networkmanager/global_network_data_source.go b/internal/service/networkmanager/global_network_data_source.go
index 662fdcc35e9..3d10c56509c 100644
--- a/internal/service/networkmanager/global_network_data_source.go
+++ b/internal/service/networkmanager/global_network_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package networkmanager
 
 import (
diff --git a/internal/service/networkmanager/global_network_data_source_test.go b/internal/service/networkmanager/global_network_data_source_test.go
index d4f2208edcc..e51dcbb9b64 100644
--- a/internal/service/networkmanager/global_network_data_source_test.go
+++ b/internal/service/networkmanager/global_network_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package networkmanager_test
 
 import (
diff --git a/internal/service/networkmanager/global_network_test.go b/internal/service/networkmanager/global_network_test.go
index 15a092c1513..9b91ea3e651 100644
--- a/internal/service/networkmanager/global_network_test.go
+++ b/internal/service/networkmanager/global_network_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package networkmanager_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/networkmanager"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
@@ -29,7 +32,7 @@ func TestAccNetworkManagerGlobalNetwork_basic(t *testing.T) {
 				Config: testAccGlobalNetworkConfig_basic(),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckGlobalNetworkExists(ctx, resourceName),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "networkmanager", regexp.MustCompile(`global-network/global-network-.+`)),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "networkmanager", regexache.MustCompile(`global-network/global-network-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 				),
diff --git a/internal/service/networkmanager/global_networks_data_source.go b/internal/service/networkmanager/global_networks_data_source.go
index fbad47e1832..775745a46b5 100644
--- a/internal/service/networkmanager/global_networks_data_source.go
+++ b/internal/service/networkmanager/global_networks_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package networkmanager
 
 import (
diff --git a/internal/service/networkmanager/global_networks_data_source_test.go b/internal/service/networkmanager/global_networks_data_source_test.go
index 13a3662d01e..b8f53223a2a 100644
--- a/internal/service/networkmanager/global_networks_data_source_test.go
+++ b/internal/service/networkmanager/global_networks_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package networkmanager_test
 
 import (
diff --git a/internal/service/networkmanager/link.go b/internal/service/networkmanager/link.go
index b16e6fc74a8..f0f6814fd88 100644
--- a/internal/service/networkmanager/link.go
+++ b/internal/service/networkmanager/link.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package networkmanager
 
 import (
diff --git a/internal/service/networkmanager/link_association.go b/internal/service/networkmanager/link_association.go
index 1a34a738755..a442890ed3c 100644
--- a/internal/service/networkmanager/link_association.go
+++ b/internal/service/networkmanager/link_association.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package networkmanager
 
 import (
diff --git a/internal/service/networkmanager/link_association_test.go b/internal/service/networkmanager/link_association_test.go
index f426d07db1c..1e509975177 100644
--- a/internal/service/networkmanager/link_association_test.go
+++ b/internal/service/networkmanager/link_association_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package networkmanager_test
 
 import (
diff --git a/internal/service/networkmanager/link_data_source.go b/internal/service/networkmanager/link_data_source.go
index ca7da61ecce..8c4cba4b55e 100644
--- a/internal/service/networkmanager/link_data_source.go
+++ b/internal/service/networkmanager/link_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package networkmanager
 
 import (
diff --git a/internal/service/networkmanager/link_data_source_test.go b/internal/service/networkmanager/link_data_source_test.go
index b7a54678a05..d5c339dd1ac 100644
--- a/internal/service/networkmanager/link_data_source_test.go
+++ b/internal/service/networkmanager/link_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package networkmanager_test
 
 import (
diff --git a/internal/service/networkmanager/link_test.go b/internal/service/networkmanager/link_test.go
index 3059edf9b05..a19acc23927 100644
--- a/internal/service/networkmanager/link_test.go
+++ b/internal/service/networkmanager/link_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package networkmanager_test
 
 import (
diff --git a/internal/service/networkmanager/links_data_source.go b/internal/service/networkmanager/links_data_source.go
index 2de884e12f7..e68317b1750 100644
--- a/internal/service/networkmanager/links_data_source.go
+++ b/internal/service/networkmanager/links_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package networkmanager
 
 import (
diff --git a/internal/service/networkmanager/links_data_source_test.go b/internal/service/networkmanager/links_data_source_test.go
index 17d5a14e427..9f39b7d373b 100644
--- a/internal/service/networkmanager/links_data_source_test.go
+++ b/internal/service/networkmanager/links_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package networkmanager_test
 
 import (
diff --git a/internal/service/networkmanager/service_package_gen.go b/internal/service/networkmanager/service_package_gen.go
index 82776695884..66504591086 100644
--- a/internal/service/networkmanager/service_package_gen.go
+++ b/internal/service/networkmanager/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	networkmanager_sdkv1 "github.com/aws/aws-sdk-go/service/networkmanager"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -207,4 +208,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*n
 	return networkmanager_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/networkmanager/site.go b/internal/service/networkmanager/site.go
index 77bfa56f39e..7449ea0b48c 100644
--- a/internal/service/networkmanager/site.go
+++ b/internal/service/networkmanager/site.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package networkmanager
 
 import (
diff --git a/internal/service/networkmanager/site_data_source.go b/internal/service/networkmanager/site_data_source.go
index 0d9bf870204..ab8ca54c208 100644
--- a/internal/service/networkmanager/site_data_source.go
+++ b/internal/service/networkmanager/site_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package networkmanager
 
 import (
diff --git a/internal/service/networkmanager/site_data_source_test.go b/internal/service/networkmanager/site_data_source_test.go
index 007c4cc0f07..b428664e5c5 100644
--- a/internal/service/networkmanager/site_data_source_test.go
+++ b/internal/service/networkmanager/site_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package networkmanager_test
 
 import (
diff --git a/internal/service/networkmanager/site_test.go b/internal/service/networkmanager/site_test.go
index c462af8cb9c..22be6a4f389 100644
--- a/internal/service/networkmanager/site_test.go
+++ b/internal/service/networkmanager/site_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package networkmanager_test
 
 import (
diff --git a/internal/service/networkmanager/site_to_site_vpn_attachment.go b/internal/service/networkmanager/site_to_site_vpn_attachment.go
index 5a00d3a0314..27f8f907af4 100644
--- a/internal/service/networkmanager/site_to_site_vpn_attachment.go
+++ b/internal/service/networkmanager/site_to_site_vpn_attachment.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package networkmanager
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/aws/aws-sdk-go/service/networkmanager"
@@ -91,7 +94,7 @@ func ResourceSiteToSiteVPNAttachment() *schema.Resource {
 				Type:         schema.TypeString,
 				Required:     true,
 				ForceNew:     true,
-				ValidateFunc: validation.StringMatch(regexp.MustCompile(`^arn:[^:]{1,63}:ec2:[^:]{0,63}:[^:]{0,63}:vpn-connection\/vpn-[0-9a-f]{8,17}$`), "Must be valid VPN ARN"),
+				ValidateFunc: validation.StringMatch(regexache.MustCompile(`^arn:[^:]{1,63}:ec2:[^:]{0,63}:[^:]{0,63}:vpn-connection\/vpn-[0-9a-f]{8,17}$`), "Must be valid VPN ARN"),
 			},
 		},
 	}
diff --git a/internal/service/networkmanager/site_to_site_vpn_attachment_test.go b/internal/service/networkmanager/site_to_site_vpn_attachment_test.go
index 9343b010394..47d6c057965 100644
--- a/internal/service/networkmanager/site_to_site_vpn_attachment_test.go
+++ b/internal/service/networkmanager/site_to_site_vpn_attachment_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package networkmanager_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/networkmanager"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -39,7 +42,7 @@ func TestAccNetworkManagerSiteToSiteVPNAttachment_basic(t *testing.T) {
 				Config: testAccSiteToSiteVPNAttachmentConfig_basic(rName, bgpASN, vpnIP),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckSiteToSiteVPNAttachmentExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "networkmanager", regexp.MustCompile(`attachment/.+`)),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "networkmanager", regexache.MustCompile(`attachment/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "attachment_policy_rule_number", "1"),
 					resource.TestCheckResourceAttr(resourceName, "attachment_type", "SITE_TO_SITE_VPN"),
 					resource.TestCheckResourceAttrPair(resourceName, "core_network_arn", coreNetworkResourceName, "arn"),
@@ -225,13 +228,17 @@ resource "aws_networkmanager_global_network" "test" {
 
 resource "aws_networkmanager_core_network" "test" {
   global_network_id = aws_networkmanager_global_network.test.id
-  policy_document   = data.aws_networkmanager_core_network_policy_document.test.json
 
   tags = {
     Name = %[1]q
   }
 }
 
+resource "aws_networkmanager_core_network_policy_attachment" "test" {
+  core_network_id = aws_networkmanager_core_network.test.id
+  policy_document = data.aws_networkmanager_core_network_policy_document.test.json
+}
+
 data "aws_networkmanager_core_network_policy_document" "test" {
   core_network_configuration {
     vpn_ecmp_support = false
@@ -278,7 +285,7 @@ data "aws_networkmanager_core_network_policy_document" "test" {
 func testAccSiteToSiteVPNAttachmentConfig_basic(rName string, bgpASN int, vpnIP string) string {
 	return acctest.ConfigCompose(testAccSiteToSiteVPNAttachmentConfig_base(rName, bgpASN, vpnIP), `
 resource "aws_networkmanager_site_to_site_vpn_attachment" "test" {
-  core_network_id    = aws_networkmanager_core_network.test.id
+  core_network_id    = aws_networkmanager_core_network_policy_attachment.test.core_network_id
   vpn_connection_arn = aws_vpn_connection.test.arn
 
   tags = {
@@ -296,7 +303,7 @@ resource "aws_networkmanager_attachment_accepter" "test" {
 func testAccSiteToSiteVPNAttachmentConfig_tags1(rName, vpnIP, tagKey1, tagValue1 string, bgpASN int) string {
 	return acctest.ConfigCompose(testAccSiteToSiteVPNAttachmentConfig_base(rName, bgpASN, vpnIP), fmt.Sprintf(`
 resource "aws_networkmanager_site_to_site_vpn_attachment" "test" {
-  core_network_id    = aws_networkmanager_core_network.test.id
+  core_network_id    = aws_networkmanager_core_network_policy_attachment.test.core_network_id
   vpn_connection_arn = aws_vpn_connection.test.arn
 
   tags = {
@@ -314,7 +321,7 @@ resource "aws_networkmanager_attachment_accepter" "test" {
 func testAccSiteToSiteVPNAttachmentConfig_tags2(rName, vpnIP, tagKey1, tagValue1, tagKey2, tagValue2 string, bgpASN int) string {
 	return acctest.ConfigCompose(testAccSiteToSiteVPNAttachmentConfig_base(rName, bgpASN, vpnIP), fmt.Sprintf(`
 resource "aws_networkmanager_site_to_site_vpn_attachment" "test" {
-  core_network_id    = aws_networkmanager_core_network.test.id
+  core_network_id    = aws_networkmanager_core_network_policy_attachment.test.core_network_id
   vpn_connection_arn = aws_vpn_connection.test.arn
 
   tags = {
diff --git a/internal/service/networkmanager/sites_data_source.go b/internal/service/networkmanager/sites_data_source.go
index d1b94e1d0e3..0289c32c79d 100644
--- a/internal/service/networkmanager/sites_data_source.go
+++ b/internal/service/networkmanager/sites_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package networkmanager
 
 import (
diff --git a/internal/service/networkmanager/sites_data_source_test.go b/internal/service/networkmanager/sites_data_source_test.go
index a79d23c53bf..b82bb21c335 100644
--- a/internal/service/networkmanager/sites_data_source_test.go
+++ b/internal/service/networkmanager/sites_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package networkmanager_test
 
 import (
diff --git a/internal/service/networkmanager/sweep.go b/internal/service/networkmanager/sweep.go
index 0db0f3ee4cb..719f4d2442d 100644
--- a/internal/service/networkmanager/sweep.go
+++ b/internal/service/networkmanager/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package networkmanager
 
@@ -12,9 +12,10 @@ import (
 	multierror "github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_networkmanager_global_network", &resource.Sweeper{
 		Name: "aws_networkmanager_global_network",
 		F:    sweepGlobalNetworks,
@@ -104,7 +105,7 @@ func init() {
 
 func sweepGlobalNetworks(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -128,7 +129,7 @@ func sweepGlobalNetworks(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Network Manager Global Network sweep for %s: %s", region, err)
 		return nil
 	}
@@ -137,7 +138,7 @@ func sweepGlobalNetworks(region string) error {
 		return fmt.Errorf("error listing Network Manager Global Networks (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping Network Manager Global Networks (%s): %w", region, err)
@@ -148,7 +149,7 @@ func sweepGlobalNetworks(region string) error {
 
 func sweepCoreNetworks(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -172,7 +173,7 @@ func sweepCoreNetworks(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Network Manager Core Network sweep for %s: %s", region, err)
 		return nil
 	}
@@ -181,7 +182,7 @@ func sweepCoreNetworks(region string) error {
 		return fmt.Errorf("error listing Network Manager Core Networks (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping Network Manager Core Networks (%s): %w", region, err)
@@ -192,7 +193,7 @@ func sweepCoreNetworks(region string) error {
 
 func sweepConnectAttachments(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -218,7 +219,7 @@ func sweepConnectAttachments(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Network Manager Connect Attachment sweep for %s: %s", region, err)
 		return nil
 	}
@@ -227,7 +228,7 @@ func sweepConnectAttachments(region string) error {
 		return fmt.Errorf("error listing Network Manager Connect Attachments (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping Network Manager Connect Attachments (%s): %w", region, err)
@@ -238,7 +239,7 @@ func sweepConnectAttachments(region string) error {
 
 func sweepSiteToSiteVPNAttachments(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -264,7 +265,7 @@ func sweepSiteToSiteVPNAttachments(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Network Manager Site To Site VPN Attachment sweep for %s: %s", region, err)
 		return nil
 	}
@@ -273,7 +274,7 @@ func sweepSiteToSiteVPNAttachments(region string) error {
 		return fmt.Errorf("error listing Network Manager Site To Site VPN Attachments (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping Network Manager Site To Site VPN Attachments (%s): %w", region, err)
@@ -284,7 +285,7 @@ func sweepSiteToSiteVPNAttachments(region string) error {
 
 func sweepTransitGatewayPeerings(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -310,7 +311,7 @@ func sweepTransitGatewayPeerings(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Network Manager Transit Gateway Peering sweep for %s: %s", region, err)
 		return nil
 	}
@@ -319,7 +320,7 @@ func sweepTransitGatewayPeerings(region string) error {
 		return fmt.Errorf("error listing Network Manager Transit Gateway Peerings (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping Network Manager Transit Gateway Peerings (%s): %w", region, err)
@@ -330,7 +331,7 @@ func sweepTransitGatewayPeerings(region string) error {
 
 func sweepTransitGatewayRouteTableAttachments(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -356,7 +357,7 @@ func sweepTransitGatewayRouteTableAttachments(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Network Manager Transit Gateway Route Table Attachment sweep for %s: %s", region, err)
 		return nil
 	}
@@ -365,7 +366,7 @@ func sweepTransitGatewayRouteTableAttachments(region string) error {
 		return fmt.Errorf("error listing Network Manager Transit Gateway Route Table Attachments (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping Network Manager Transit Gateway Route Table Attachments (%s): %w", region, err)
@@ -376,7 +377,7 @@ func sweepTransitGatewayRouteTableAttachments(region string) error {
 
 func sweepVPCAttachments(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -402,7 +403,7 @@ func sweepVPCAttachments(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Network Manager VPC Attachment sweep for %s: %s", region, err)
 		return nil
 	}
@@ -411,7 +412,7 @@ func sweepVPCAttachments(region string) error {
 		return fmt.Errorf("error listing Network Manager VPC Attachments (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping Network Manager VPC Attachments (%s): %w", region, err)
@@ -422,7 +423,7 @@ func sweepVPCAttachments(region string) error {
 
 func sweepSites(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -458,7 +459,7 @@ func sweepSites(region string) error {
 				return !lastPage
 			})
 
-			if sweep.SkipSweepError(err) {
+			if awsv1.SkipSweepError(err) {
 				continue
 			}
 
@@ -470,7 +471,7 @@ func sweepSites(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Network Manager Site sweep for %s: %s", region, err)
 		return sweeperErrs.ErrorOrNil() // In case we have completed some pages, but had errors
 	}
@@ -479,7 +480,7 @@ func sweepSites(region string) error {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error listing Network Manager Global Networks (%s): %w", region, err))
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error sweeping Network Manager Sites (%s): %w", region, err))
@@ -490,7 +491,7 @@ func sweepSites(region string) error {
 
 func sweepDevices(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -526,7 +527,7 @@ func sweepDevices(region string) error {
 				return !lastPage
 			})
 
-			if sweep.SkipSweepError(err) {
+			if awsv1.SkipSweepError(err) {
 				continue
 			}
 
@@ -538,7 +539,7 @@ func sweepDevices(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Network Manager Device sweep for %s: %s", region, err)
 		return sweeperErrs.ErrorOrNil() // In case we have completed some pages, but had errors
 	}
@@ -547,7 +548,7 @@ func sweepDevices(region string) error {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error listing Network Manager Global Networks (%s): %w", region, err))
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error sweeping Network Manager Devices (%s): %w", region, err))
@@ -558,7 +559,7 @@ func sweepDevices(region string) error {
 
 func sweepLinks(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -594,7 +595,7 @@ func sweepLinks(region string) error {
 				return !lastPage
 			})
 
-			if sweep.SkipSweepError(err) {
+			if awsv1.SkipSweepError(err) {
 				continue
 			}
 
@@ -606,7 +607,7 @@ func sweepLinks(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Network Manager Link sweep for %s: %s", region, err)
 		return sweeperErrs.ErrorOrNil() // In case we have completed some pages, but had errors
 	}
@@ -615,7 +616,7 @@ func sweepLinks(region string) error {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error listing Network Manager Global Networks (%s): %w", region, err))
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error sweeping Network Manager Links (%s): %w", region, err))
@@ -626,7 +627,7 @@ func sweepLinks(region string) error {
 
 func sweepLinkAssociations(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -661,7 +662,7 @@ func sweepLinkAssociations(region string) error {
 				return !lastPage
 			})
 
-			if sweep.SkipSweepError(err) {
+			if awsv1.SkipSweepError(err) {
 				continue
 			}
 
@@ -673,7 +674,7 @@ func sweepLinkAssociations(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Network Manager Link Association sweep for %s: %s", region, err)
 		return sweeperErrs.ErrorOrNil() // In case we have completed some pages, but had errors
 	}
@@ -682,7 +683,7 @@ func sweepLinkAssociations(region string) error {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error listing Network Manager Global Networks (%s): %w", region, err))
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error sweeping Network Manager Link Associations (%s): %w", region, err))
@@ -693,7 +694,7 @@ func sweepLinkAssociations(region string) error {
 
 func sweepConnections(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -729,7 +730,7 @@ func sweepConnections(region string) error {
 				return !lastPage
 			})
 
-			if sweep.SkipSweepError(err) {
+			if awsv1.SkipSweepError(err) {
 				continue
 			}
 
@@ -741,7 +742,7 @@ func sweepConnections(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Network Manager Connection sweep for %s: %s", region, err)
 		return sweeperErrs.ErrorOrNil() // In case we have completed some pages, but had errors
 	}
@@ -750,7 +751,7 @@ func sweepConnections(region string) error {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error listing Network Manager Global Networks (%s): %w", region, err))
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error sweeping Network Manager Connections (%s): %w", region, err))
diff --git a/internal/service/networkmanager/tags_gen.go b/internal/service/networkmanager/tags_gen.go
index 6779ef11ea8..a2c7b46b293 100644
--- a/internal/service/networkmanager/tags_gen.go
+++ b/internal/service/networkmanager/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/networkmanager"
 	"github.com/aws/aws-sdk-go/service/networkmanager/networkmanageriface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -69,6 +71,8 @@ func updateTags(ctx context.Context, conn networkmanageriface.NetworkManagerAPI,
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.NetworkManager)
 	if len(removedTags) > 0 {
diff --git a/internal/service/networkmanager/transit_gateway_connect_peer_association.go b/internal/service/networkmanager/transit_gateway_connect_peer_association.go
index 8366e5c9b5b..e6f63fa5a54 100644
--- a/internal/service/networkmanager/transit_gateway_connect_peer_association.go
+++ b/internal/service/networkmanager/transit_gateway_connect_peer_association.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package networkmanager
 
 import (
diff --git a/internal/service/networkmanager/transit_gateway_connect_peer_association_test.go b/internal/service/networkmanager/transit_gateway_connect_peer_association_test.go
index 9e1ed0ee4cd..50a9e9b08e2 100644
--- a/internal/service/networkmanager/transit_gateway_connect_peer_association_test.go
+++ b/internal/service/networkmanager/transit_gateway_connect_peer_association_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package networkmanager_test
 
 import (
diff --git a/internal/service/networkmanager/transit_gateway_peering.go b/internal/service/networkmanager/transit_gateway_peering.go
index 0d94cd228f6..999b375deae 100644
--- a/internal/service/networkmanager/transit_gateway_peering.go
+++ b/internal/service/networkmanager/transit_gateway_peering.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package networkmanager
 
 import (
diff --git a/internal/service/networkmanager/transit_gateway_peering_test.go b/internal/service/networkmanager/transit_gateway_peering_test.go
index 4a56f84f2e8..ea202e8e868 100644
--- a/internal/service/networkmanager/transit_gateway_peering_test.go
+++ b/internal/service/networkmanager/transit_gateway_peering_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package networkmanager_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/networkmanager"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -16,6 +19,16 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
+func init() {
+	acctest.RegisterServiceErrorCheckFunc(networkmanager.EndpointsID, testAccErrorCheckSkip)
+}
+
+func testAccErrorCheckSkip(t *testing.T) resource.ErrorCheckFunc {
+	return acctest.ErrorCheckSkipMessagesMatches(t,
+		regexache.MustCompile(`Core Network edge location \([0-9a-z-]+\) not available`),
+	)
+}
+
 func TestAccNetworkManagerTransitGatewayPeering_basic(t *testing.T) {
 	ctx := acctest.Context(t)
 	var v networkmanager.TransitGatewayPeering
@@ -33,7 +46,7 @@ func TestAccNetworkManagerTransitGatewayPeering_basic(t *testing.T) {
 				Config: testAccTransitGatewayPeeringConfig_basic(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckTransitGatewayPeeringExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "networkmanager", regexp.MustCompile(`peering/.+`)),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "networkmanager", regexache.MustCompile(`peering/.+`)),
 					resource.TestCheckResourceAttrSet(resourceName, "core_network_arn"),
 					resource.TestCheckResourceAttrSet(resourceName, "core_network_id"),
 					resource.TestCheckResourceAttr(resourceName, "edge_location", acctest.Region()),
diff --git a/internal/service/networkmanager/transit_gateway_registration.go b/internal/service/networkmanager/transit_gateway_registration.go
index 7b021750d68..fa3ab93a96e 100644
--- a/internal/service/networkmanager/transit_gateway_registration.go
+++ b/internal/service/networkmanager/transit_gateway_registration.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package networkmanager
 
 import (
diff --git a/internal/service/networkmanager/transit_gateway_registration_test.go b/internal/service/networkmanager/transit_gateway_registration_test.go
index 56e202ae939..bfeee54a776 100644
--- a/internal/service/networkmanager/transit_gateway_registration_test.go
+++ b/internal/service/networkmanager/transit_gateway_registration_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package networkmanager_test
 
 import (
diff --git a/internal/service/networkmanager/transit_gateway_route_table_attachment.go b/internal/service/networkmanager/transit_gateway_route_table_attachment.go
index e7af23f205b..02ada62ed03 100644
--- a/internal/service/networkmanager/transit_gateway_route_table_attachment.go
+++ b/internal/service/networkmanager/transit_gateway_route_table_attachment.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package networkmanager
 
 import (
diff --git a/internal/service/networkmanager/transit_gateway_route_table_attachment_test.go b/internal/service/networkmanager/transit_gateway_route_table_attachment_test.go
index 6af17579f5e..03b47050bfa 100644
--- a/internal/service/networkmanager/transit_gateway_route_table_attachment_test.go
+++ b/internal/service/networkmanager/transit_gateway_route_table_attachment_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package networkmanager_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/networkmanager"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -32,7 +35,7 @@ func TestAccNetworkManagerTransitGatewayRouteTableAttachment_basic(t *testing.T)
 				Config: testAccTransitGatewayRouteTableAttachmentConfig_basic(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckTransitGatewayRouteTableAttachmentExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "networkmanager", regexp.MustCompile(`attachment/.+`)),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "networkmanager", regexache.MustCompile(`attachment/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "attachment_policy_rule_number", "0"),
 					resource.TestCheckResourceAttr(resourceName, "attachment_type", "TRANSIT_GATEWAY_ROUTE_TABLE"),
 					resource.TestCheckResourceAttr(resourceName, "edge_location", acctest.Region()),
diff --git a/internal/service/networkmanager/vpc_attachment.go b/internal/service/networkmanager/vpc_attachment.go
index 0b72ba44efc..8567b9e63b8 100644
--- a/internal/service/networkmanager/vpc_attachment.go
+++ b/internal/service/networkmanager/vpc_attachment.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package networkmanager
 
 import (
diff --git a/internal/service/networkmanager/vpc_attachment_test.go b/internal/service/networkmanager/vpc_attachment_test.go
index 1bde8c8bad8..6aa0ad8f6c8 100644
--- a/internal/service/networkmanager/vpc_attachment_test.go
+++ b/internal/service/networkmanager/vpc_attachment_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package networkmanager_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/networkmanager"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -34,7 +37,7 @@ func TestAccNetworkManagerVPCAttachment_basic(t *testing.T) {
 				Config: testAccVPCAttachmentConfig_basic(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckVPCAttachmentExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "networkmanager", regexp.MustCompile(`attachment/.+`)),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "networkmanager", regexache.MustCompile(`attachment/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "attachment_policy_rule_number", "0"),
 					resource.TestCheckResourceAttr(resourceName, "attachment_type", "VPC"),
 					resource.TestCheckResourceAttrPair(resourceName, "core_network_arn", coreNetworkResourceName, "arn"),
@@ -274,13 +277,17 @@ resource "aws_networkmanager_global_network" "test" {
 
 resource "aws_networkmanager_core_network" "test" {
   global_network_id = aws_networkmanager_global_network.test.id
-  policy_document   = data.aws_networkmanager_core_network_policy_document.test.json
 
   tags = {
     Name = %[1]q
   }
 }
 
+resource "aws_networkmanager_core_network_policy_attachment" "test" {
+  core_network_id = aws_networkmanager_core_network.test.id
+  policy_document = data.aws_networkmanager_core_network_policy_document.test.json
+}
+
 data "aws_networkmanager_core_network_policy_document" "test" {
   core_network_configuration {
     vpn_ecmp_support = false
@@ -328,7 +335,7 @@ func testAccVPCAttachmentConfig_basic(rName string) string {
 	return acctest.ConfigCompose(testAccVPCAttachmentConfig_base(rName), `
 resource "aws_networkmanager_vpc_attachment" "test" {
   subnet_arns     = aws_subnet.test[*].arn
-  core_network_id = aws_networkmanager_core_network.test.id
+  core_network_id = aws_networkmanager_core_network_policy_attachment.test.core_network_id
   vpc_arn         = aws_vpc.test.arn
 }
 
@@ -343,7 +350,7 @@ func testAccVPCAttachmentConfig_tags1(rName, tagKey1, tagValue1 string) string {
 	return acctest.ConfigCompose(testAccVPCAttachmentConfig_base(rName), fmt.Sprintf(`
 resource "aws_networkmanager_vpc_attachment" "test" {
   subnet_arns     = [aws_subnet.test[0].arn]
-  core_network_id = aws_networkmanager_core_network.test.id
+  core_network_id = aws_networkmanager_core_network_policy_attachment.test.core_network_id
   vpc_arn         = aws_vpc.test.arn
 
   tags = {
@@ -362,7 +369,7 @@ func testAccVPCAttachmentConfig_tags2(rName, tagKey1, tagValue1, tagKey2, tagVal
 	return acctest.ConfigCompose(testAccVPCAttachmentConfig_base(rName), fmt.Sprintf(`
 resource "aws_networkmanager_vpc_attachment" "test" {
   subnet_arns     = [aws_subnet.test[0].arn]
-  core_network_id = aws_networkmanager_core_network.test.id
+  core_network_id = aws_networkmanager_core_network_policy_attachment.test.core_network_id
   vpc_arn         = aws_vpc.test.arn
 
   tags = {
@@ -382,7 +389,7 @@ func testAccVPCAttachmentConfig_updates(rName string, nSubnets int, applianceMod
 	return acctest.ConfigCompose(testAccVPCAttachmentConfig_base(rName), fmt.Sprintf(`
 resource "aws_networkmanager_vpc_attachment" "test" {
   subnet_arns     = slice(aws_subnet.test[*].arn, 0, %[2]d)
-  core_network_id = aws_networkmanager_core_network.test.id
+  core_network_id = aws_networkmanager_core_network_policy_attachment.test.core_network_id
   vpc_arn         = aws_vpc.test.arn
 
   options {
diff --git a/internal/service/oam/generate.go b/internal/service/oam/generate.go
index 1a402c5c361..af3c5176ecb 100644
--- a/internal/service/oam/generate.go
+++ b/internal/service/oam/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -AWSSDKVersion=2 -KVTValues=true -SkipTypesImp=true -ListTags -ServiceTagsMap -TagOp=TagResource -UntagOp=UntagResource -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/oam/link.go b/internal/service/oam/link.go
index e75cc5a7389..f6e430e9230 100644
--- a/internal/service/oam/link.go
+++ b/internal/service/oam/link.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package oam
 
 import (
diff --git a/internal/service/oam/link_data_source.go b/internal/service/oam/link_data_source.go
index 800d4bcbd89..42499a6d094 100644
--- a/internal/service/oam/link_data_source.go
+++ b/internal/service/oam/link_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package oam
 
 import (
diff --git a/internal/service/oam/link_data_source_test.go b/internal/service/oam/link_data_source_test.go
index 5a6234e04c4..e33a8947e73 100644
--- a/internal/service/oam/link_data_source_test.go
+++ b/internal/service/oam/link_data_source_test.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package oam_test
 
 import (
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
@@ -33,7 +36,7 @@ func TestAccObservabilityAccessManagerLinkDataSource_basic(t *testing.T) {
 			{
 				Config: testAccLinkDataSourceConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
-					acctest.MatchResourceAttrRegionalARN(dataSourceName, "arn", "oam", regexp.MustCompile(`link/+.`)),
+					acctest.MatchResourceAttrRegionalARN(dataSourceName, "arn", "oam", regexache.MustCompile(`link/+.`)),
 					resource.TestCheckResourceAttrSet(dataSourceName, "label"),
 					resource.TestCheckResourceAttr(dataSourceName, "label_template", "$AccountName"),
 					resource.TestCheckResourceAttrSet(dataSourceName, "link_id"),
diff --git a/internal/service/oam/link_test.go b/internal/service/oam/link_test.go
index 8fd12dd2587..f1e8a76ebcc 100644
--- a/internal/service/oam/link_test.go
+++ b/internal/service/oam/link_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package oam_test
 
 import (
 	"context"
 	"errors"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/oam"
 	"github.com/aws/aws-sdk-go-v2/service/oam/types"
@@ -45,7 +48,7 @@ func TestAccObservabilityAccessManagerLink_basic(t *testing.T) {
 				Config: testAccLinkConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckLinkExists(ctx, resourceName, &link),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "oam", regexp.MustCompile(`link/+.`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "oam", regexache.MustCompile(`link/+.`)),
 					resource.TestCheckResourceAttrSet(resourceName, "label"),
 					resource.TestCheckResourceAttr(resourceName, "label_template", "$AccountName"),
 					resource.TestCheckResourceAttrSet(resourceName, "link_id"),
@@ -122,7 +125,7 @@ func TestAccObservabilityAccessManagerLink_update(t *testing.T) {
 				Config: testAccLinkConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckLinkExists(ctx, resourceName, &link),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "oam", regexp.MustCompile(`link/+.`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "oam", regexache.MustCompile(`link/+.`)),
 					resource.TestCheckResourceAttrSet(resourceName, "label"),
 					resource.TestCheckResourceAttr(resourceName, "label_template", "$AccountName"),
 					resource.TestCheckResourceAttrSet(resourceName, "link_id"),
@@ -136,7 +139,7 @@ func TestAccObservabilityAccessManagerLink_update(t *testing.T) {
 				Config: testAccLinkConfig_update(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckLinkExists(ctx, resourceName, &link),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "oam", regexp.MustCompile(`link/+.`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "oam", regexache.MustCompile(`link/+.`)),
 					resource.TestCheckResourceAttrSet(resourceName, "label"),
 					resource.TestCheckResourceAttr(resourceName, "label_template", "$AccountName"),
 					resource.TestCheckResourceAttrSet(resourceName, "link_id"),
diff --git a/internal/service/oam/links_data_source.go b/internal/service/oam/links_data_source.go
index f9a79482101..57a9e021f5e 100644
--- a/internal/service/oam/links_data_source.go
+++ b/internal/service/oam/links_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package oam
 
 import (
diff --git a/internal/service/oam/links_data_source_test.go b/internal/service/oam/links_data_source_test.go
index 34d31c96b52..dff2f0c45b8 100644
--- a/internal/service/oam/links_data_source_test.go
+++ b/internal/service/oam/links_data_source_test.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package oam_test
 
 import (
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
@@ -34,7 +37,7 @@ func TestAccObservabilityAccessManagerLinksDataSource_basic(t *testing.T) {
 				Config: testAccLinksDataSourceConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr(dataSourceName, "arns.#", "1"),
-					acctest.MatchResourceAttrRegionalARN(dataSourceName, "arns.0", "oam", regexp.MustCompile(`link/+.`)),
+					acctest.MatchResourceAttrRegionalARN(dataSourceName, "arns.0", "oam", regexache.MustCompile(`link/+.`)),
 				),
 			},
 		},
diff --git a/internal/service/oam/service_package_gen.go b/internal/service/oam/service_package_gen.go
index da13e14d511..b063fba2f5e 100644
--- a/internal/service/oam/service_package_gen.go
+++ b/internal/service/oam/service_package_gen.go
@@ -7,6 +7,7 @@ import (
 
 	aws_sdkv2 "github.com/aws/aws-sdk-go-v2/aws"
 	oam_sdkv2 "github.com/aws/aws-sdk-go-v2/service/oam"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -77,9 +78,11 @@ func (p *servicePackage) NewClient(ctx context.Context, config map[string]any) (
 
 	return oam_sdkv2.NewFromConfig(cfg, func(o *oam_sdkv2.Options) {
 		if endpoint := config["endpoint"].(string); endpoint != "" {
-			o.EndpointResolver = oam_sdkv2.EndpointResolverFromURL(endpoint)
+			o.BaseEndpoint = aws_sdkv2.String(endpoint)
 		}
 	}), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/oam/sink.go b/internal/service/oam/sink.go
index 69a014ee5cb..c78d7cdb9b3 100644
--- a/internal/service/oam/sink.go
+++ b/internal/service/oam/sink.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package oam
 
 import (
diff --git a/internal/service/oam/sink_data_source.go b/internal/service/oam/sink_data_source.go
index 4f373a14c4a..1876eaf293c 100644
--- a/internal/service/oam/sink_data_source.go
+++ b/internal/service/oam/sink_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package oam
 
 import (
diff --git a/internal/service/oam/sink_data_source_test.go b/internal/service/oam/sink_data_source_test.go
index 2a782b38f69..5815e163adb 100644
--- a/internal/service/oam/sink_data_source_test.go
+++ b/internal/service/oam/sink_data_source_test.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package oam_test
 
 import (
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/service/oam"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -41,7 +44,7 @@ func TestAccObservabilityAccessManagerSinkDataSource_basic(t *testing.T) {
 					resource.TestCheckResourceAttrSet(dataSourceName, "sink_identifier"),
 					resource.TestCheckResourceAttr(dataSourceName, "tags.%", "1"),
 					resource.TestCheckResourceAttr(dataSourceName, "tags.key1", "value1"),
-					acctest.MatchResourceAttrRegionalARN(dataSourceName, "arn", "oam", regexp.MustCompile(`sink/+.`)),
+					acctest.MatchResourceAttrRegionalARN(dataSourceName, "arn", "oam", regexache.MustCompile(`sink/+.`)),
 				),
 			},
 		},
diff --git a/internal/service/oam/sink_policy.go b/internal/service/oam/sink_policy.go
index 1b2cd3c23f6..108a6e26b35 100644
--- a/internal/service/oam/sink_policy.go
+++ b/internal/service/oam/sink_policy.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package oam
 
 import (
diff --git a/internal/service/oam/sink_policy_test.go b/internal/service/oam/sink_policy_test.go
index f13159e716b..2b49be06d7d 100644
--- a/internal/service/oam/sink_policy_test.go
+++ b/internal/service/oam/sink_policy_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package oam_test
 
 import (
 	"context"
 	"errors"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/oam"
 	"github.com/aws/aws-sdk-go-v2/service/oam/types"
@@ -44,7 +47,7 @@ func TestAccObservabilityAccessManagerSinkPolicy_basic(t *testing.T) {
 				Config: testAccSinkPolicyConfigBasic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckSinkPolicyExists(ctx, resourceName, &sinkPolicy),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "oam", regexp.MustCompile(`sink/+.`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "oam", regexache.MustCompile(`sink/+.`)),
 					resource.TestCheckResourceAttrWith(resourceName, "policy", func(value string) error {
 						_, err := awspolicy.PoliciesAreEquivalent(value, fmt.Sprintf(`
 {
@@ -103,7 +106,7 @@ func TestAccObservabilityAccessManagerSinkPolicy_update(t *testing.T) {
 				Config: testAccSinkPolicyConfigBasic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckSinkPolicyExists(ctx, resourceName, &sinkPolicy),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "oam", regexp.MustCompile(`sink/+.`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "oam", regexache.MustCompile(`sink/+.`)),
 					resource.TestCheckResourceAttrWith(resourceName, "policy", func(value string) error {
 						_, err := awspolicy.PoliciesAreEquivalent(value, fmt.Sprintf(`
 {
diff --git a/internal/service/oam/sink_test.go b/internal/service/oam/sink_test.go
index d12a8b8d28c..5a2b6c1f0f8 100644
--- a/internal/service/oam/sink_test.go
+++ b/internal/service/oam/sink_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package oam_test
 
 import (
 	"context"
 	"errors"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/oam"
 	"github.com/aws/aws-sdk-go-v2/service/oam/types"
@@ -44,7 +47,7 @@ func TestAccObservabilityAccessManagerSink_basic(t *testing.T) {
 				Config: testAccSinkConfigBasic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckSinkExists(ctx, resourceName, &sink),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "oam", regexp.MustCompile(`sink/+.`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "oam", regexache.MustCompile(`sink/+.`)),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttrSet(resourceName, "sink_id"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
diff --git a/internal/service/oam/sinks_data_source.go b/internal/service/oam/sinks_data_source.go
index 8a6ff9949aa..eabb6398777 100644
--- a/internal/service/oam/sinks_data_source.go
+++ b/internal/service/oam/sinks_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package oam
 
 import (
diff --git a/internal/service/oam/sinks_data_source_test.go b/internal/service/oam/sinks_data_source_test.go
index ef693d7e5ba..0c9fab176fb 100644
--- a/internal/service/oam/sinks_data_source_test.go
+++ b/internal/service/oam/sinks_data_source_test.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package oam_test
 
 import (
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
@@ -33,7 +36,7 @@ func TestAccObservabilityAccessManagerSinksDataSource_basic(t *testing.T) {
 				Config: testAccSinksDataSourceConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr(dataSourceName, "arns.#", "1"),
-					acctest.MatchResourceAttrRegionalARN(dataSourceName, "arns.0", "oam", regexp.MustCompile(`sink/+.`)),
+					acctest.MatchResourceAttrRegionalARN(dataSourceName, "arns.0", "oam", regexache.MustCompile(`sink/+.`)),
 				),
 			},
 		},
diff --git a/internal/service/oam/sweep.go b/internal/service/oam/sweep.go
deleted file mode 100644
index 59ee18f1dee..00000000000
--- a/internal/service/oam/sweep.go
+++ /dev/null
@@ -1,4 +0,0 @@
-//go:build sweep
-// +build sweep
-
-package oam
diff --git a/internal/service/oam/tags_gen.go b/internal/service/oam/tags_gen.go
index 6f22f52c646..0bfe23f4244 100644
--- a/internal/service/oam/tags_gen.go
+++ b/internal/service/oam/tags_gen.go
@@ -7,7 +7,9 @@ import (
 
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/oam"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -53,7 +55,7 @@ func Tags(tags tftags.KeyValueTags) map[string]string {
 	return tags.Map()
 }
 
-// KeyValueTags creates KeyValueTags from oam service tags.
+// KeyValueTags creates tftags.KeyValueTags from oam service tags.
 func KeyValueTags(ctx context.Context, tags map[string]string) tftags.KeyValueTags {
 	return tftags.New(ctx, tags)
 }
@@ -84,6 +86,8 @@ func updateTags(ctx context.Context, conn *oam.Client, identifier string, oldTag
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.ObservabilityAccessManager)
 	if len(removedTags) > 0 {
diff --git a/internal/service/opensearch/consts.go b/internal/service/opensearch/consts.go
index 65856de18dc..8848e558378 100644
--- a/internal/service/opensearch/consts.go
+++ b/internal/service/opensearch/consts.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package opensearch
 
 import (
diff --git a/internal/service/opensearch/domain.go b/internal/service/opensearch/domain.go
index 5901d21885e..07dc1b8d9a6 100644
--- a/internal/service/opensearch/domain.go
+++ b/internal/service/opensearch/domain.go
@@ -1,13 +1,16 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package opensearch
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"strings"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/opensearchservice"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -246,7 +249,7 @@ func ResourceDomain() *schema.Resource {
 						"dedicated_master_count": {
 							Type:             schema.TypeInt,
 							Optional:         true,
-							DiffSuppressFunc: isDedicatedMasterDisabled,
+							DiffSuppressFunc: suppressComputedDedicatedMaster,
 						},
 						"dedicated_master_enabled": {
 							Type:     schema.TypeBool,
@@ -256,7 +259,7 @@ func ResourceDomain() *schema.Resource {
 						"dedicated_master_type": {
 							Type:             schema.TypeString,
 							Optional:         true,
-							DiffSuppressFunc: isDedicatedMasterDisabled,
+							DiffSuppressFunc: suppressComputedDedicatedMaster,
 						},
 						"instance_count": {
 							Type:     schema.TypeInt,
@@ -268,6 +271,10 @@ func ResourceDomain() *schema.Resource {
 							Optional: true,
 							Default:  opensearchservice.OpenSearchPartitionInstanceTypeM3MediumSearch,
 						},
+						"multi_az_with_standby_enabled": {
+							Type:     schema.TypeBool,
+							Optional: true,
+						},
 						"warm_count": {
 							Type:         schema.TypeInt,
 							Optional:     true,
@@ -382,7 +389,7 @@ func ResourceDomain() *schema.Resource {
 				Type:     schema.TypeString,
 				Required: true,
 				ForceNew: true,
-				ValidateFunc: validation.StringMatch(regexp.MustCompile(`^[a-z][0-9a-z\-]{2,27}$`),
+				ValidateFunc: validation.StringMatch(regexache.MustCompile(`^[a-z][0-9a-z\-]{2,27}$`),
 					"must start with a lowercase alphabet and be at least 3 and no more than 28 characters long."+
 						" Valid characters are a-z (lowercase letters), 0-9, and - (hyphen)."),
 			},
@@ -552,6 +559,22 @@ func ResourceDomain() *schema.Resource {
 					},
 				},
 			},
+			"software_update_options": {
+				Type:             schema.TypeList,
+				Optional:         true,
+				Computed:         true,
+				MaxItems:         1,
+				DiffSuppressFunc: verify.SuppressMissingOptionalConfigurationBlock,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"auto_software_update_enabled": {
+							Type:     schema.TypeBool,
+							Optional: true,
+							Computed: true,
+						},
+					},
+				},
+			},
 			names.AttrTags:    tftags.TagsSchema(),
 			names.AttrTagsAll: tftags.TagsSchemaComputed(),
 			"vpc_options": {
@@ -699,6 +722,10 @@ func resourceDomainCreate(ctx context.Context, d *schema.ResourceData, meta inte
 		}
 	}
 
+	if v, ok := d.GetOk("software_update_options"); ok {
+		input.SoftwareUpdateOptions = expandSoftwareUpdateOptions(v.([]interface{}))
+	}
+
 	if v, ok := d.GetOk("vpc_options"); ok {
 		options := v.([]interface{})
 		if options[0] == nil {
@@ -892,8 +919,12 @@ func resourceDomainRead(ctx context.Context, d *schema.ResourceData, meta interf
 		return sdkdiag.AppendErrorf(diags, "setting snapshot_options: %s", err)
 	}
 
+	if err := d.Set("software_update_options", flattenSoftwareUpdateOptions(ds.SoftwareUpdateOptions)); err != nil {
+		return sdkdiag.AppendErrorf(diags, "setting software_update_options: %s", err)
+	}
+
 	if ds.VPCOptions != nil {
-		if err := d.Set("vpc_options", flattenVPCDerivedInfo(ds.VPCOptions)); err != nil {
+		if err := d.Set("vpc_options", []interface{}{flattenVPCDerivedInfo(ds.VPCOptions)}); err != nil {
 			return sdkdiag.AppendErrorf(diags, "setting vpc_options: %s", err)
 		}
 
@@ -1050,6 +1081,10 @@ func resourceDomainUpdate(ctx context.Context, d *schema.ResourceData, meta inte
 			}
 		}
 
+		if d.HasChange("software_update_options") {
+			input.SoftwareUpdateOptions = expandSoftwareUpdateOptions(d.Get("software_update_options").([]interface{}))
+		}
+
 		if d.HasChange("vpc_options") {
 			options := d.Get("vpc_options").([]interface{})
 			s := options[0].(map[string]interface{})
@@ -1109,6 +1144,31 @@ func resourceDomainDelete(ctx context.Context, d *schema.ResourceData, meta inte
 	return diags
 }
 
+func FindDomainByName(ctx context.Context, conn *opensearchservice.OpenSearchService, name string) (*opensearchservice.DomainStatus, error) {
+	input := &opensearchservice.DescribeDomainInput{
+		DomainName: aws.String(name),
+	}
+
+	output, err := conn.DescribeDomainWithContext(ctx, input)
+
+	if tfawserr.ErrCodeEquals(err, opensearchservice.ErrCodeResourceNotFoundException) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	if output == nil || output.DomainStatus == nil {
+		return nil, tfresource.NewEmptyResultError(input)
+	}
+
+	return output.DomainStatus, nil
+}
+
 // inPlaceEncryptionEnableVersion returns true if, based on version, encryption
 // can be enabled in place (without ForceNew)
 func inPlaceEncryptionEnableVersion(version string) bool {
@@ -1142,7 +1202,7 @@ func getKibanaEndpoint(d *schema.ResourceData) string {
 	return d.Get("endpoint").(string) + "/_plugin/kibana/"
 }
 
-func isDedicatedMasterDisabled(k, old, new string, d *schema.ResourceData) bool {
+func suppressComputedDedicatedMaster(k, old, new string, d *schema.ResourceData) bool {
 	v, ok := d.GetOk("cluster_config")
 	if ok {
 		clusterConfig := v.([]interface{})[0].(map[string]interface{})
@@ -1185,6 +1245,10 @@ func flattenNodeToNodeEncryptionOptions(o *opensearchservice.NodeToNodeEncryptio
 func expandClusterConfig(m map[string]interface{}) *opensearchservice.ClusterConfig {
 	config := opensearchservice.ClusterConfig{}
 
+	if v, ok := m["cold_storage_options"]; ok {
+		config.ColdStorageOptions = expandColdStorageOptions(v.([]interface{}))
+	}
+
 	if v, ok := m["dedicated_master_enabled"]; ok {
 		isEnabled := v.(bool)
 		config.DedicatedMasterEnabled = aws.Bool(isEnabled)
@@ -1202,23 +1266,13 @@ func expandClusterConfig(m map[string]interface{}) *opensearchservice.ClusterCon
 	if v, ok := m["instance_count"]; ok {
 		config.InstanceCount = aws.Int64(int64(v.(int)))
 	}
+
 	if v, ok := m["instance_type"]; ok {
 		config.InstanceType = aws.String(v.(string))
 	}
 
-	if v, ok := m["zone_awareness_enabled"]; ok {
-		isEnabled := v.(bool)
-		config.ZoneAwarenessEnabled = aws.Bool(isEnabled)
-
-		if isEnabled {
-			if v, ok := m["zone_awareness_config"]; ok {
-				config.ZoneAwarenessConfig = expandZoneAwarenessConfig(v.([]interface{}))
-			}
-		}
-	}
-
-	if v, ok := m["cold_storage_options"]; ok {
-		config.ColdStorageOptions = expandColdStorageOptions(v.([]interface{}))
+	if v, ok := m["multi_az_with_standby_enabled"]; ok {
+		config.MultiAZWithStandbyEnabled = aws.Bool(v.(bool))
 	}
 
 	if v, ok := m["warm_enabled"]; ok {
@@ -1236,6 +1290,17 @@ func expandClusterConfig(m map[string]interface{}) *opensearchservice.ClusterCon
 		}
 	}
 
+	if v, ok := m["zone_awareness_enabled"]; ok {
+		isEnabled := v.(bool)
+		config.ZoneAwarenessEnabled = aws.Bool(isEnabled)
+
+		if isEnabled {
+			if v, ok := m["zone_awareness_config"]; ok {
+				config.ZoneAwarenessConfig = expandZoneAwarenessConfig(v.([]interface{}))
+			}
+		}
+	}
+
 	return &config
 }
 
@@ -1295,6 +1360,9 @@ func flattenClusterConfig(c *opensearchservice.ClusterConfig) []map[string]inter
 	if c.InstanceType != nil {
 		m["instance_type"] = aws.StringValue(c.InstanceType)
 	}
+	if c.MultiAZWithStandbyEnabled != nil {
+		m["multi_az_with_standby_enabled"] = aws.BoolValue(c.MultiAZWithStandbyEnabled)
+	}
 	if c.WarmEnabled != nil {
 		m["warm_enabled"] = aws.BoolValue(c.WarmEnabled)
 	}
diff --git a/internal/service/opensearch/domain_data_source.go b/internal/service/opensearch/domain_data_source.go
index cb810516e95..b75684f1c45 100644
--- a/internal/service/opensearch/domain_data_source.go
+++ b/internal/service/opensearch/domain_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package opensearch
 
 import (
@@ -138,6 +141,10 @@ func DataSourceDomain() *schema.Resource {
 							Type:     schema.TypeString,
 							Computed: true,
 						},
+						"multi_az_with_standby_enabled": {
+							Type:     schema.TypeBool,
+							Computed: true,
+						},
 						"warm_count": {
 							Type:     schema.TypeInt,
 							Computed: true,
@@ -355,6 +362,18 @@ func DataSourceDomain() *schema.Resource {
 					},
 				},
 			},
+			"software_update_options": {
+				Type:     schema.TypeList,
+				Computed: true,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"auto_software_update_enabled": {
+							Type:     schema.TypeBool,
+							Computed: true,
+						},
+					},
+				},
+			},
 			"tags": tftags.TagsSchemaComputed(),
 			"vpc_options": {
 				Type:     schema.TypeList,
@@ -462,8 +481,12 @@ func dataSourceDomainRead(ctx context.Context, d *schema.ResourceData, meta inte
 		return sdkdiag.AppendErrorf(diags, "setting snapshot_options: %s", err)
 	}
 
+	if err := d.Set("software_update_options", flattenSoftwareUpdateOptions(ds.SoftwareUpdateOptions)); err != nil {
+		return sdkdiag.AppendErrorf(diags, "setting software_update_options: %s", err)
+	}
+
 	if ds.VPCOptions != nil {
-		if err := d.Set("vpc_options", flattenVPCDerivedInfo(ds.VPCOptions)); err != nil {
+		if err := d.Set("vpc_options", []interface{}{flattenVPCDerivedInfo(ds.VPCOptions)}); err != nil {
 			return sdkdiag.AppendErrorf(diags, "setting vpc_options: %s", err)
 		}
 
diff --git a/internal/service/opensearch/domain_data_source_test.go b/internal/service/opensearch/domain_data_source_test.go
index 925c273c2ed..513c8193301 100644
--- a/internal/service/opensearch/domain_data_source_test.go
+++ b/internal/service/opensearch/domain_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package opensearch_test
 
 import (
@@ -48,6 +51,8 @@ func TestAccOpenSearchDomainDataSource_Data_basic(t *testing.T) {
 					resource.TestCheckResourceAttrPair(datasourceName, "off_peak_window_options.#", resourceName, "off_peak_window_options.#"),
 					resource.TestCheckResourceAttrPair(datasourceName, "snapshot_options.#", resourceName, "snapshot_options.#"),
 					resource.TestCheckResourceAttrPair(datasourceName, "snapshot_options.0.automated_snapshot_start_hour", resourceName, "snapshot_options.0.automated_snapshot_start_hour"),
+					resource.TestCheckResourceAttrPair(datasourceName, "software_update_options.#", resourceName, "software_update_options.#"),
+					resource.TestCheckResourceAttrPair(datasourceName, "software_update_options.0.auto_software_update_enabled", resourceName, "software_update_options.0.auto_software_update_enabled"),
 				),
 			},
 		},
@@ -176,6 +181,10 @@ POLICY
   snapshot_options {
     automated_snapshot_start_hour = 23
   }
+
+  software_update_options {
+    auto_software_update_enabled = true
+  }
 }
 
 data "aws_opensearch_domain" "test" {
diff --git a/internal/service/opensearch/domain_policy.go b/internal/service/opensearch/domain_policy.go
index 30eae35158f..10e6aefe2a0 100644
--- a/internal/service/opensearch/domain_policy.go
+++ b/internal/service/opensearch/domain_policy.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package opensearch
 
 import (
diff --git a/internal/service/opensearch/domain_policy_test.go b/internal/service/opensearch/domain_policy_test.go
index 515618d4b7e..d915426c48a 100644
--- a/internal/service/opensearch/domain_policy_test.go
+++ b/internal/service/opensearch/domain_policy_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package opensearch_test
 
 import (
diff --git a/internal/service/opensearch/domain_saml_options.go b/internal/service/opensearch/domain_saml_options.go
index 72e4ff64246..e015d9c8cbd 100644
--- a/internal/service/opensearch/domain_saml_options.go
+++ b/internal/service/opensearch/domain_saml_options.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package opensearch
 
 import (
diff --git a/internal/service/opensearch/domain_saml_options_test.go b/internal/service/opensearch/domain_saml_options_test.go
index d96c50c5eda..7808949ed96 100644
--- a/internal/service/opensearch/domain_saml_options_test.go
+++ b/internal/service/opensearch/domain_saml_options_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package opensearch_test
 
 import (
diff --git a/internal/service/opensearch/domain_structure.go b/internal/service/opensearch/domain_structure.go
index b71dd0de16c..42a97311082 100644
--- a/internal/service/opensearch/domain_structure.go
+++ b/internal/service/opensearch/domain_structure.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package opensearch
 
 import (
@@ -209,11 +212,11 @@ func expandWindowStartTime(tfMap map[string]interface{}) *opensearchservice.Wind
 
 	apiObject := &opensearchservice.WindowStartTime{}
 
-	if v, ok := tfMap["hours"].(int); ok && v != 0 {
+	if v, ok := tfMap["hours"].(int); ok {
 		apiObject.Hours = aws.Int64(int64(v))
 	}
 
-	if v, ok := tfMap["minutes"].(int); ok && v != 0 {
+	if v, ok := tfMap["minutes"].(int); ok {
 		apiObject.Minutes = aws.Int64(int64(v))
 	}
 
diff --git a/internal/service/opensearch/domain_test.go b/internal/service/opensearch/domain_test.go
index ac370ed9024..d8f3ca23833 100644
--- a/internal/service/opensearch/domain_test.go
+++ b/internal/service/opensearch/domain_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package opensearch_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/cognitoidentityprovider"
 	"github.com/aws/aws-sdk-go/service/opensearchservice"
@@ -149,9 +152,9 @@ func TestAccOpenSearchDomain_basic(t *testing.T) {
 				Config: testAccDomainConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDomainExists(ctx, resourceName, &domain),
-					resource.TestMatchResourceAttr(resourceName, "dashboard_endpoint", regexp.MustCompile(`.*(opensearch|es)\..*/_dashboards`)),
+					resource.TestMatchResourceAttr(resourceName, "dashboard_endpoint", regexache.MustCompile(`.*(opensearch|es)\..*/_dashboards`)),
 					resource.TestCheckResourceAttrSet(resourceName, "engine_version"),
-					resource.TestMatchResourceAttr(resourceName, "kibana_endpoint", regexp.MustCompile(`.*(opensearch|es)\..*/_plugin/kibana/`)),
+					resource.TestMatchResourceAttr(resourceName, "kibana_endpoint", regexache.MustCompile(`.*(opensearch|es)\..*/_plugin/kibana/`)),
 					resource.TestCheckResourceAttr(resourceName, "off_peak_window_options.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 					resource.TestCheckResourceAttr(resourceName, "vpc_options.#", "0"),
@@ -499,6 +502,42 @@ func TestAccOpenSearchDomain_Cluster_update(t *testing.T) {
 		}})
 }
 
+func TestAccOpenSearchDomain_Cluster_multiAzWithStandbyEnabled(t *testing.T) {
+	ctx := acctest.Context(t)
+	var domain opensearchservice.DomainStatus
+	rName := testAccRandomDomainName()
+	resourceName := "aws_opensearch_domain.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, opensearchservice.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckDomainDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccDomainConfig_multiAzWithStandbyEnabled(rName, true),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckDomainExists(ctx, resourceName, &domain),
+					resource.TestCheckResourceAttr(resourceName, "cluster_config.0.multi_az_with_standby_enabled", "true"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateId:     rName,
+				ImportStateVerify: true,
+			},
+			{
+				Config: testAccDomainConfig_multiAzWithStandbyEnabled(rName, false),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckDomainExists(ctx, resourceName, &domain),
+					resource.TestCheckResourceAttr(resourceName, "cluster_config.0.multi_az_with_standby_enabled", "false"),
+				),
+			},
+		},
+	})
+}
+
 func TestAccOpenSearchDomain_duplicate(t *testing.T) {
 	ctx := acctest.Context(t)
 	if testing.Short() {
@@ -546,7 +585,7 @@ func TestAccOpenSearchDomain_duplicate(t *testing.T) {
 					testAccCheckDomainExists(ctx, resourceName, &domain),
 					resource.TestCheckResourceAttrSet(resourceName, "engine_version"),
 				),
-				ExpectError: regexp.MustCompile(`OpenSearch Domain ".+" already exists`),
+				ExpectError: regexache.MustCompile(`OpenSearch Domain ".+" already exists`),
 			},
 		},
 	})
@@ -746,7 +785,7 @@ func TestAccOpenSearchDomain_autoTuneOptions(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDomainExists(ctx, resourceName, &domain),
 					resource.TestCheckResourceAttr(resourceName, "engine_version", "Elasticsearch_6.7"),
-					resource.TestMatchResourceAttr(resourceName, "kibana_endpoint", regexp.MustCompile(`.*(opensearch|es)\..*/_plugin/kibana/`)),
+					resource.TestMatchResourceAttr(resourceName, "kibana_endpoint", regexache.MustCompile(`.*(opensearch|es)\..*/_plugin/kibana/`)),
 					resource.TestCheckResourceAttr(resourceName, "auto_tune_options.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "auto_tune_options.0.desired_state", "ENABLED"),
 					resource.TestCheckResourceAttr(resourceName, "auto_tune_options.0.maintenance_schedule.#", "1"),
@@ -1526,6 +1565,18 @@ func TestAccOpenSearchDomain_offPeakWindowOptions(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "off_peak_window_options.0.off_peak_window.0.window_start_time.0.minutes", "15"),
 				),
 			},
+			{
+				Config: testAccDomainConfig_offPeakWindowOptions(rName, 0, 0),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckDomainExists(ctx, resourceName, &domain),
+					resource.TestCheckResourceAttr(resourceName, "off_peak_window_options.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "off_peak_window_options.0.enabled", "true"),
+					resource.TestCheckResourceAttr(resourceName, "off_peak_window_options.0.off_peak_window.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "off_peak_window_options.0.off_peak_window.0.window_start_time.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "off_peak_window_options.0.off_peak_window.0.window_start_time.0.hours", "0"),
+					resource.TestCheckResourceAttr(resourceName, "off_peak_window_options.0.off_peak_window.0.window_start_time.0.minutes", "0"),
+				),
+			},
 		},
 	})
 }
@@ -1766,6 +1817,39 @@ func TestAccOpenSearchDomain_versionUpdate(t *testing.T) {
 		}})
 }
 
+func TestAccOpenSearchDomain_softwareUpdateOptions(t *testing.T) {
+	ctx := acctest.Context(t)
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
+	var domain opensearchservice.DomainStatus
+	rName := testAccRandomDomainName()
+	resourceName := "aws_opensearch_domain.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheckIAMServiceLinkedRole(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, opensearchservice.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckDomainDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccDomainConfig_softwareUpdateOptions(rName, false),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckDomainExists(ctx, resourceName, &domain),
+					resource.TestCheckResourceAttr(resourceName, "software_update_options.0.auto_software_update_enabled", "false"),
+				),
+			},
+			{
+				Config: testAccDomainConfig_softwareUpdateOptions(rName, true),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckDomainExists(ctx, resourceName, &domain),
+					resource.TestCheckResourceAttr(resourceName, "software_update_options.0.auto_software_update_enabled", "true"),
+				),
+			},
+		},
+	})
+}
 func TestAccOpenSearchDomain_disappears(t *testing.T) {
 	ctx := acctest.Context(t)
 	if testing.Short() {
@@ -2343,6 +2427,45 @@ resource "aws_opensearch_domain" "test" {
 `, rName, enabled)
 }
 
+func testAccDomainConfig_multiAzWithStandbyEnabled(rName string, enableStandby bool) string {
+	return fmt.Sprintf(`
+resource "aws_opensearch_domain" "test" {
+  domain_name    = %[1]q
+  engine_version = "OpenSearch_2.7"
+
+  domain_endpoint_options {
+    enforce_https       = true
+    tls_security_policy = "Policy-Min-TLS-1-0-2019-07"
+  }
+
+  ebs_options {
+    ebs_enabled = true
+    volume_size = 20
+  }
+
+  auto_tune_options {
+    desired_state       = "ENABLED"
+    rollback_on_disable = "NO_ROLLBACK"
+  }
+
+  cluster_config {
+    zone_awareness_enabled   = true
+    instance_count           = 3
+    instance_type            = "m6g.large.search"
+    dedicated_master_enabled = true
+    dedicated_master_count   = 3
+    dedicated_master_type    = "m6g.large.search"
+
+    zone_awareness_config {
+      availability_zone_count = 3
+    }
+
+    multi_az_with_standby_enabled = %[2]t
+  }
+}
+`, rName, enableStandby)
+}
+
 func testAccDomainConfig_clusterUpdate(rName string, instanceInt, snapshotInt int) string {
 	return fmt.Sprintf(`
 resource "aws_opensearch_domain" "test" {
@@ -3413,3 +3536,20 @@ resource "aws_opensearch_domain" "test" {
 }
 `, rName, h, m)
 }
+
+func testAccDomainConfig_softwareUpdateOptions(rName string, option bool) string {
+	return fmt.Sprintf(`
+resource "aws_opensearch_domain" "test" {
+  domain_name = %[1]q
+
+  ebs_options {
+    ebs_enabled = true
+    volume_size = 10
+  }
+
+  software_update_options {
+    auto_software_update_enabled = %[2]t
+  }
+}
+`, rName, option)
+}
diff --git a/internal/service/opensearch/exports_test.go b/internal/service/opensearch/exports_test.go
new file mode 100644
index 00000000000..73459f63ae7
--- /dev/null
+++ b/internal/service/opensearch/exports_test.go
@@ -0,0 +1,10 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package opensearch
+
+// Exports for use in tests only.
+var (
+	FindVPCEndpointByID = findVPCEndpointByID
+	VPCEndpointsError   = vpcEndpointsError
+)
diff --git a/internal/service/opensearch/find.go b/internal/service/opensearch/find.go
deleted file mode 100644
index 74948258e89..00000000000
--- a/internal/service/opensearch/find.go
+++ /dev/null
@@ -1,35 +0,0 @@
-package opensearch
-
-import (
-	"context"
-
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/opensearchservice"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
-	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
-)
-
-func FindDomainByName(ctx context.Context, conn *opensearchservice.OpenSearchService, name string) (*opensearchservice.DomainStatus, error) {
-	input := &opensearchservice.DescribeDomainInput{
-		DomainName: aws.String(name),
-	}
-
-	output, err := conn.DescribeDomainWithContext(ctx, input)
-	if tfawserr.ErrCodeEquals(err, opensearchservice.ErrCodeResourceNotFoundException) {
-		return nil, &retry.NotFoundError{
-			LastError:   err,
-			LastRequest: input,
-		}
-	}
-
-	if err != nil {
-		return nil, err
-	}
-
-	if output == nil || output.DomainStatus == nil {
-		return nil, tfresource.NewEmptyResultError(input)
-	}
-
-	return output.DomainStatus, nil
-}
diff --git a/internal/service/opensearch/flex.go b/internal/service/opensearch/flex.go
index 77db447d765..5615066ec13 100644
--- a/internal/service/opensearch/flex.go
+++ b/internal/service/opensearch/flex.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package opensearch
 
 import (
@@ -110,19 +113,6 @@ func expandEncryptAtRestOptions(m map[string]interface{}) *opensearchservice.Enc
 	return &options
 }
 
-func expandVPCOptions(m map[string]interface{}) *opensearchservice.VPCOptions {
-	options := opensearchservice.VPCOptions{}
-
-	if v, ok := m["security_group_ids"]; ok {
-		options.SecurityGroupIds = flex.ExpandStringSet(v.(*schema.Set))
-	}
-	if v, ok := m["subnet_ids"]; ok {
-		options.SubnetIds = flex.ExpandStringSet(v.(*schema.Set))
-	}
-
-	return &options
-}
-
 func flattenCognitoOptions(c *opensearchservice.CognitoOptions) []map[string]interface{} {
 	m := map[string]interface{}{}
 
@@ -213,21 +203,73 @@ func flattenSnapshotOptions(snapshotOptions *opensearchservice.SnapshotOptions)
 	return []map[string]interface{}{m}
 }
 
-func flattenVPCDerivedInfo(o *opensearchservice.VPCDerivedInfo) []map[string]interface{} {
-	m := map[string]interface{}{}
+func expandSoftwareUpdateOptions(in []interface{}) *opensearchservice.SoftwareUpdateOptions {
+	if len(in) == 0 {
+		return nil
+	}
 
-	if o.AvailabilityZones != nil {
-		m["availability_zones"] = flex.FlattenStringSet(o.AvailabilityZones)
+	m := in[0].(map[string]interface{})
+
+	var out opensearchservice.SoftwareUpdateOptions
+	if v, ok := m["auto_software_update_enabled"].(bool); ok {
+		out.AutoSoftwareUpdateEnabled = aws.Bool(v)
 	}
-	if o.SecurityGroupIds != nil {
-		m["security_group_ids"] = flex.FlattenStringSet(o.SecurityGroupIds)
+
+	return &out
+}
+
+func flattenSoftwareUpdateOptions(softwareUpdateOptions *opensearchservice.SoftwareUpdateOptions) []interface{} {
+	if softwareUpdateOptions == nil {
+		return nil
 	}
-	if o.SubnetIds != nil {
-		m["subnet_ids"] = flex.FlattenStringSet(o.SubnetIds)
+
+	m := map[string]interface{}{
+		"auto_software_update_enabled": aws.BoolValue(softwareUpdateOptions.AutoSoftwareUpdateEnabled),
 	}
-	if o.VPCId != nil {
-		m["vpc_id"] = aws.StringValue(o.VPCId)
+
+	return []interface{}{m}
+}
+
+func expandVPCOptions(tfMap map[string]interface{}) *opensearchservice.VPCOptions {
+	if tfMap == nil {
+		return nil
 	}
 
-	return []map[string]interface{}{m}
+	apiObject := &opensearchservice.VPCOptions{}
+
+	if v, ok := tfMap["security_group_ids"].(*schema.Set); ok && v.Len() > 0 {
+		apiObject.SecurityGroupIds = flex.ExpandStringSet(v)
+	}
+
+	if v, ok := tfMap["subnet_ids"].(*schema.Set); ok && v.Len() > 0 {
+		apiObject.SubnetIds = flex.ExpandStringSet(v)
+	}
+
+	return apiObject
+}
+
+func flattenVPCDerivedInfo(apiObject *opensearchservice.VPCDerivedInfo) map[string]interface{} {
+	if apiObject == nil {
+		return nil
+	}
+
+	tfMap := map[string]interface{}{}
+
+	if v := apiObject.AvailabilityZones; v != nil {
+		tfMap["availability_zones"] = aws.StringValueSlice(v)
+	}
+
+	if v := apiObject.SecurityGroupIds; v != nil {
+		tfMap["security_group_ids"] = aws.StringValueSlice(v)
+	}
+
+	if v := apiObject.SubnetIds; v != nil {
+		tfMap["subnet_ids"] = aws.StringValueSlice(v)
+	}
+
+	if v := apiObject.VPCId; v != nil {
+		tfMap["vpc_id"] = aws.StringValue(v)
+	}
+
+	return tfMap
 }
diff --git a/internal/service/opensearch/generate.go b/internal/service/opensearch/generate.go
index 806ac5c47ab..a4f69c05c98 100644
--- a/internal/service/opensearch/generate.go
+++ b/internal/service/opensearch/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTags -ListTagsOp=ListTags -ListTagsInIDElem=ARN -ListTagsOutTagsElem=TagList -ServiceTagsSlice -TagOp=AddTags -TagInIDElem=ARN -TagInTagsElem=TagList -UntagOp=RemoveTags -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/opensearch/inbound_connection_accepter.go b/internal/service/opensearch/inbound_connection_accepter.go
index d35f7357692..8eb6a21dc58 100644
--- a/internal/service/opensearch/inbound_connection_accepter.go
+++ b/internal/service/opensearch/inbound_connection_accepter.go
@@ -1,8 +1,11 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package opensearch
 
 import (
 	"context"
-	"fmt"
+	"errors"
 	"log"
 	"time"
 
@@ -13,6 +16,7 @@ import (
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
 // @SDKResource("aws_opensearch_inbound_connection_accepter")
@@ -21,6 +25,7 @@ func ResourceInboundConnectionAccepter() *schema.Resource {
 		CreateWithoutTimeout: resourceInboundConnectionAccepterCreate,
 		ReadWithoutTimeout:   resourceInboundConnectionRead,
 		DeleteWithoutTimeout: resourceInboundConnectionDelete,
+
 		Importer: &schema.ResourceImporter{
 			StateContext: func(ctx context.Context, d *schema.ResourceData, m interface{}) (result []*schema.ResourceData, err error) {
 				d.Set("connection_id", d.Id())
@@ -30,8 +35,8 @@ func ResourceInboundConnectionAccepter() *schema.Resource {
 		},
 
 		Timeouts: &schema.ResourceTimeout{
-			Create: schema.DefaultTimeout(1 * time.Minute),
-			Delete: schema.DefaultTimeout(1 * time.Minute),
+			Create: schema.DefaultTimeout(5 * time.Minute),
+			Delete: schema.DefaultTimeout(5 * time.Minute),
 		},
 
 		Schema: map[string]*schema.Schema{
@@ -51,25 +56,21 @@ func ResourceInboundConnectionAccepter() *schema.Resource {
 func resourceInboundConnectionAccepterCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	conn := meta.(*conns.AWSClient).OpenSearchConn(ctx)
 
-	// Create the Inbound Connection
-	acceptOpts := &opensearchservice.AcceptInboundConnectionInput{
-		ConnectionId: aws.String(d.Get("connection_id").(string)),
+	connectionID := d.Get("connection_id").(string)
+	input := &opensearchservice.AcceptInboundConnectionInput{
+		ConnectionId: aws.String(connectionID),
 	}
 
-	log.Printf("[DEBUG] Inbound Connection Accept options: %#v", acceptOpts)
+	_, err := conn.AcceptInboundConnectionWithContext(ctx, input)
 
-	resp, err := conn.AcceptInboundConnectionWithContext(ctx, acceptOpts)
 	if err != nil {
-		return diag.Errorf("accepting Inbound Connection: %s", err)
+		return diag.Errorf("accepting OpenSearch Inbound Connection (%s): %s", connectionID, err)
 	}
 
-	// Get the ID and store it
-	d.SetId(aws.StringValue(resp.Connection.ConnectionId))
-	log.Printf("[INFO] Inbound Connection ID: %s", d.Id())
+	d.SetId(connectionID)
 
-	err = inboundConnectionWaitUntilActive(ctx, conn, d.Id(), d.Timeout(schema.TimeoutCreate))
-	if err != nil {
-		return diag.Errorf("waiting for Inbound Connection to become active: %s", err)
+	if _, err := waitInboundConnectionAccepted(ctx, conn, d.Id(), d.Timeout(schema.TimeoutCreate)); err != nil {
+		return diag.Errorf("waiting for OpenSearch Inbound Connection (%s) accept: %s", d.Id(), err)
 	}
 
 	return resourceInboundConnectionRead(ctx, d, meta)
@@ -78,108 +79,196 @@ func resourceInboundConnectionAccepterCreate(ctx context.Context, d *schema.Reso
 func resourceInboundConnectionRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	conn := meta.(*conns.AWSClient).OpenSearchConn(ctx)
 
-	ccscRaw, statusCode, err := inboundConnectionRefreshState(ctx, conn, d.Id())()
+	connection, err := FindInboundConnectionByID(ctx, conn, d.Id())
 
-	if err != nil {
-		return diag.Errorf("reading Inbound Connection: %s", err)
+	if !d.IsNewResource() && tfresource.NotFound(err) {
+		log.Printf("[WARN] OpenSearch Inbound Connection (%s) not found, removing from state", d.Id())
+		d.SetId("")
+		return nil
 	}
 
-	ccsc := ccscRaw.(*opensearchservice.InboundConnection)
-	log.Printf("[DEBUG] Inbound Connection response: %#v", ccsc)
+	if err != nil {
+		return diag.Errorf("reading OpenSearch Inbound Connection (%s): %s", d.Id(), err)
+	}
 
-	d.Set("connection_id", ccsc.ConnectionId)
-	d.Set("connection_status", statusCode)
+	d.Set("connection_id", connection.ConnectionId)
+	d.Set("connection_status", connection.ConnectionStatus.StatusCode)
 	return nil
 }
 
 func resourceInboundConnectionDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	conn := meta.(*conns.AWSClient).OpenSearchConn(ctx)
 
-	req := &opensearchservice.DeleteInboundConnectionInput{
-		ConnectionId: aws.String(d.Id()),
+	if d.Get("connection_status").(string) == opensearchservice.InboundConnectionStatusCodePendingAcceptance {
+		log.Printf("[DEBUG] Rejecting OpenSearch Inbound Connection: %s", d.Id())
+		_, err := conn.RejectInboundConnectionWithContext(ctx, &opensearchservice.RejectInboundConnectionInput{
+			ConnectionId: aws.String(d.Id()),
+		})
+
+		if err != nil {
+			return diag.Errorf("rejecting OpenSearch Inbound Connection (%s): %s", d.Id(), err)
+		}
+
+		if _, err := waitInboundConnectionRejected(ctx, conn, d.Id(), d.Timeout(schema.TimeoutCreate)); err != nil {
+			return diag.Errorf("waiting for OpenSearch Inbound Connection (%s) reject: %s", d.Id(), err)
+		}
+
+		return nil
 	}
 
-	_, err := conn.DeleteInboundConnectionWithContext(ctx, req)
+	log.Printf("[DEBUG] Deleting OpenSearch Inbound Connection: %s", d.Id())
+	_, err := conn.DeleteInboundConnectionWithContext(ctx, &opensearchservice.DeleteInboundConnectionInput{
+		ConnectionId: aws.String(d.Id()),
+	})
 
-	if tfawserr.ErrCodeEquals(err, "ResourceNotFoundException") {
+	if tfawserr.ErrCodeEquals(err, opensearchservice.ErrCodeResourceNotFoundException) {
 		return nil
 	}
 
 	if err != nil {
-		return diag.Errorf("deleting Inbound Connection (%s): %s", d.Id(), err)
+		return diag.Errorf("deleting OpenSearch Inbound Connection (%s): %s", d.Id(), err)
 	}
 
-	if err := waitForInboundConnectionDeletion(ctx, conn, d.Id(), d.Timeout(schema.TimeoutDelete)); err != nil {
-		return diag.Errorf("waiting for VPC Peering Connection (%s) to be deleted: %s", d.Id(), err)
+	if _, err := waitInboundConnectionDeleted(ctx, conn, d.Id(), d.Timeout(schema.TimeoutCreate)); err != nil {
+		return diag.Errorf("waiting for OpenSearch Inbound Connection (%s) delete: %s", d.Id(), err)
 	}
 
 	return nil
 }
 
-func inboundConnectionRefreshState(ctx context.Context, conn *opensearchservice.OpenSearchService, id string) retry.StateRefreshFunc {
-	return func() (interface{}, string, error) {
-		resp, err := conn.DescribeInboundConnectionsWithContext(ctx, &opensearchservice.DescribeInboundConnectionsInput{
-			Filters: []*opensearchservice.Filter{
-				{
-					Name:   aws.String("connection-id"),
-					Values: []*string{aws.String(id)},
-				},
+func FindInboundConnectionByID(ctx context.Context, conn *opensearchservice.OpenSearchService, id string) (*opensearchservice.InboundConnection, error) {
+	input := &opensearchservice.DescribeInboundConnectionsInput{
+		Filters: []*opensearchservice.Filter{
+			{
+				Name:   aws.String("connection-id"),
+				Values: aws.StringSlice([]string{id}),
 			},
-		})
-		if err != nil {
-			return nil, "", err
+		},
+	}
+
+	output, err := findInboundConnection(ctx, conn, input)
+
+	if err != nil {
+		return nil, err
+	}
+
+	if output.ConnectionStatus == nil {
+		return nil, tfresource.NewEmptyResultError(input)
+	}
+
+	if status := aws.StringValue(output.ConnectionStatus.StatusCode); status == opensearchservice.InboundConnectionStatusCodeDeleted || status == opensearchservice.InboundConnectionStatusCodeRejected {
+		return nil, &retry.NotFoundError{
+			Message:     status,
+			LastRequest: input,
 		}
+	}
 
-		if resp == nil || resp.Connections == nil ||
-			len(resp.Connections) == 0 || resp.Connections[0] == nil {
-			// Sometimes AWS just has consistency issues and doesn't see
-			// our connection yet. Return an empty state.
-			return nil, "", nil
+	return output, err
+}
+
+func findInboundConnection(ctx context.Context, conn *opensearchservice.OpenSearchService, input *opensearchservice.DescribeInboundConnectionsInput) (*opensearchservice.InboundConnection, error) {
+	output, err := findInboundConnections(ctx, conn, input)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return tfresource.AssertSinglePtrResult(output)
+}
+
+func findInboundConnections(ctx context.Context, conn *opensearchservice.OpenSearchService, input *opensearchservice.DescribeInboundConnectionsInput) ([]*opensearchservice.InboundConnection, error) {
+	var output []*opensearchservice.InboundConnection
+
+	err := conn.DescribeInboundConnectionsPagesWithContext(ctx, input, func(page *opensearchservice.DescribeInboundConnectionsOutput, lastPage bool) bool {
+		if page == nil {
+			return !lastPage
 		}
-		ccsc := resp.Connections[0]
-		if ccsc.ConnectionStatus == nil {
-			// Sometimes AWS just has consistency issues and doesn't see
-			// our connection yet. Return an empty state.
+
+		for _, v := range page.Connections {
+			if v != nil {
+				output = append(output, v)
+			}
+		}
+
+		return !lastPage
+	})
+
+	if err != nil {
+		return nil, err
+	}
+
+	return output, nil
+}
+
+func statusInboundConnection(ctx context.Context, conn *opensearchservice.OpenSearchService, id string) retry.StateRefreshFunc {
+	return func() (interface{}, string, error) {
+		output, err := FindInboundConnectionByID(ctx, conn, id)
+
+		if tfresource.NotFound(err) {
 			return nil, "", nil
 		}
-		statusCode := aws.StringValue(ccsc.ConnectionStatus.StatusCode)
 
-		return ccsc, statusCode, nil
+		if err != nil {
+			return nil, "", err
+		}
+
+		return output, aws.StringValue(output.ConnectionStatus.StatusCode), nil
 	}
 }
 
-func inboundConnectionWaitUntilActive(ctx context.Context, conn *opensearchservice.OpenSearchService, id string, timeout time.Duration) error {
-	log.Printf("[DEBUG] Waiting for Inbound Connection (%s) to become available.", id)
+func waitInboundConnectionAccepted(ctx context.Context, conn *opensearchservice.OpenSearchService, id string, timeout time.Duration) (*opensearchservice.InboundConnection, error) { //nolint:unparam
 	stateConf := &retry.StateChangeConf{
-		Pending: []string{
-			opensearchservice.InboundConnectionStatusCodeProvisioning,
-			opensearchservice.InboundConnectionStatusCodeApproved,
-		},
-		Target: []string{
-			opensearchservice.InboundConnectionStatusCodeActive,
-		},
-		Refresh: inboundConnectionRefreshState(ctx, conn, id),
+		Pending: []string{opensearchservice.InboundConnectionStatusCodeProvisioning, opensearchservice.InboundConnectionStatusCodeApproved},
+		Target:  []string{opensearchservice.InboundConnectionStatusCodeActive},
+		Refresh: statusInboundConnection(ctx, conn, id),
 		Timeout: timeout,
 	}
-	if _, err := stateConf.WaitForStateContext(ctx); err != nil {
-		return fmt.Errorf("waiting for Inbound Connection (%s) to become available: %s", id, err)
+
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+
+	if output, ok := outputRaw.(*opensearchservice.InboundConnection); ok {
+		tfresource.SetLastError(err, errors.New(aws.StringValue(output.ConnectionStatus.Message)))
+
+		return output, err
 	}
-	return nil
+
+	return nil, err
 }
 
-func waitForInboundConnectionDeletion(ctx context.Context, conn *opensearchservice.OpenSearchService, id string, timeout time.Duration) error {
+func waitInboundConnectionRejected(ctx context.Context, conn *opensearchservice.OpenSearchService, id string, timeout time.Duration) (*opensearchservice.InboundConnection, error) {
 	stateConf := &retry.StateChangeConf{
-		Pending: []string{
-			opensearchservice.InboundConnectionStatusCodeDeleting,
-		},
-		Target: []string{
-			opensearchservice.InboundConnectionStatusCodeDeleted,
-		},
-		Refresh: inboundConnectionRefreshState(ctx, conn, id),
+		Pending: []string{opensearchservice.InboundConnectionStatusCodeRejecting},
+		Target:  []string{},
+		Refresh: statusInboundConnection(ctx, conn, id),
 		Timeout: timeout,
 	}
 
-	_, err := stateConf.WaitForStateContext(ctx)
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+
+	if output, ok := outputRaw.(*opensearchservice.InboundConnection); ok {
+		tfresource.SetLastError(err, errors.New(aws.StringValue(output.ConnectionStatus.Message)))
+
+		return output, err
+	}
+
+	return nil, err
+}
+
+func waitInboundConnectionDeleted(ctx context.Context, conn *opensearchservice.OpenSearchService, id string, timeout time.Duration) (*opensearchservice.InboundConnection, error) {
+	stateConf := &retry.StateChangeConf{
+		Pending: []string{opensearchservice.InboundConnectionStatusCodeDeleting},
+		Target:  []string{},
+		Refresh: statusInboundConnection(ctx, conn, id),
+		Timeout: timeout,
+	}
+
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+
+	if output, ok := outputRaw.(*opensearchservice.InboundConnection); ok {
+		tfresource.SetLastError(err, errors.New(aws.StringValue(output.ConnectionStatus.Message)))
+
+		return output, err
+	}
 
-	return err
+	return nil, err
 }
diff --git a/internal/service/opensearch/inbound_connection_accepter_test.go b/internal/service/opensearch/inbound_connection_accepter_test.go
index 58422dfb846..126d99eaa3b 100644
--- a/internal/service/opensearch/inbound_connection_accepter_test.go
+++ b/internal/service/opensearch/inbound_connection_accepter_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package opensearch_test
 
 import (
diff --git a/internal/service/opensearch/outbound_connection.go b/internal/service/opensearch/outbound_connection.go
index 9eb1ed59324..5e0c4fe64ab 100644
--- a/internal/service/opensearch/outbound_connection.go
+++ b/internal/service/opensearch/outbound_connection.go
@@ -1,9 +1,11 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package opensearch
 
 import (
 	"context"
 	"errors"
-	"fmt"
 	"log"
 	"time"
 
@@ -13,36 +15,108 @@ import (
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
 // @SDKResource("aws_opensearch_outbound_connection")
 func ResourceOutboundConnection() *schema.Resource {
+	outboundConnectionDomainInfoSchema := func() *schema.Schema {
+		return &schema.Schema{
+			Type:     schema.TypeList,
+			Required: true,
+			ForceNew: true,
+			MaxItems: 1,
+			Elem: &schema.Resource{
+				Schema: map[string]*schema.Schema{
+					"domain_name": {
+						Type:     schema.TypeString,
+						Required: true,
+						ForceNew: true,
+					},
+					"owner_id": {
+						Type:     schema.TypeString,
+						Required: true,
+						ForceNew: true,
+					},
+					"region": {
+						Type:     schema.TypeString,
+						Required: true,
+						ForceNew: true,
+					},
+				},
+			},
+		}
+	}
+
 	return &schema.Resource{
 		CreateWithoutTimeout: resourceOutboundConnectionCreate,
 		ReadWithoutTimeout:   resourceOutboundConnectionRead,
 		DeleteWithoutTimeout: resourceOutboundConnectionDelete,
+
 		Importer: &schema.ResourceImporter{
 			StateContext: schema.ImportStatePassthroughContext,
 		},
 
 		Timeouts: &schema.ResourceTimeout{
-			Create: schema.DefaultTimeout(1 * time.Minute),
-			Delete: schema.DefaultTimeout(1 * time.Minute),
+			Create: schema.DefaultTimeout(5 * time.Minute),
+			Delete: schema.DefaultTimeout(5 * time.Minute),
 		},
 
 		Schema: map[string]*schema.Schema{
+			"accept_connection": {
+				Type:     schema.TypeBool,
+				Optional: true,
+				ForceNew: true,
+				Default:  false,
+			},
 			"connection_alias": {
 				Type:     schema.TypeString,
 				Required: true,
 				ForceNew: true,
 			},
-			"local_domain_info":  outboundConnectionDomainInfoSchema(),
-			"remote_domain_info": outboundConnectionDomainInfoSchema(),
+			"connection_mode": {
+				Type:         schema.TypeString,
+				Optional:     true,
+				ForceNew:     true,
+				ValidateFunc: validation.StringInSlice(opensearchservice.ConnectionMode_Values(), false),
+			},
+			"connection_properties": {
+				Type:     schema.TypeList,
+				Optional: true,
+				Computed: true,
+				MaxItems: 1,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"cross_cluster_search": {
+							Type:     schema.TypeList,
+							Optional: true,
+							ForceNew: true,
+							MaxItems: 1,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"skip_unavailable": {
+										Type:     schema.TypeString,
+										Optional: true,
+										ForceNew: true,
+									},
+								},
+							},
+						},
+						"endpoint": {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+					},
+				},
+			},
 			"connection_status": {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
+			"local_domain_info":  outboundConnectionDomainInfoSchema(),
+			"remote_domain_info": outboundConnectionDomainInfoSchema(),
 		},
 	}
 }
@@ -50,27 +124,41 @@ func ResourceOutboundConnection() *schema.Resource {
 func resourceOutboundConnectionCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	conn := meta.(*conns.AWSClient).OpenSearchConn(ctx)
 
-	// Create the Outbound Connection
-	createOpts := &opensearchservice.CreateOutboundConnectionInput{
-		ConnectionAlias:  aws.String(d.Get("connection_alias").(string)),
-		LocalDomainInfo:  expandOutboundConnectionDomainInfo(d.Get("local_domain_info").([]interface{})),
-		RemoteDomainInfo: expandOutboundConnectionDomainInfo(d.Get("remote_domain_info").([]interface{})),
+	connectionAlias := d.Get("connection_alias").(string)
+	input := &opensearchservice.CreateOutboundConnectionInput{
+		ConnectionAlias:      aws.String(connectionAlias),
+		ConnectionMode:       aws.String(d.Get("connection_mode").(string)),
+		ConnectionProperties: expandOutboundConnectionConnectionProperties(d.Get("connection_properties").([]interface{})),
+		LocalDomainInfo:      expandOutboundConnectionDomainInfo(d.Get("local_domain_info").([]interface{})),
+		RemoteDomainInfo:     expandOutboundConnectionDomainInfo(d.Get("remote_domain_info").([]interface{})),
 	}
 
-	log.Printf("[DEBUG] Outbound Connection Create options: %#v", createOpts)
+	output, err := conn.CreateOutboundConnectionWithContext(ctx, input)
 
-	resp, err := conn.CreateOutboundConnectionWithContext(ctx, createOpts)
 	if err != nil {
-		return diag.Errorf("creating Outbound Connection: %s", err)
+		return diag.Errorf("creating OpenSearch Outbound Connection (%s): %s", connectionAlias, err)
 	}
 
-	// Get the ID and store it
-	d.SetId(aws.StringValue(resp.ConnectionId))
-	log.Printf("[INFO] Outbound Connection ID: %s", d.Id())
+	d.SetId(aws.StringValue(output.ConnectionId))
 
-	err = outboundConnectionWaitUntilAvailable(ctx, conn, d.Id(), d.Timeout(schema.TimeoutCreate))
-	if err != nil {
-		return diag.Errorf("waiting for Outbound Connection to become available: %s", err)
+	if _, err := waitOutboundConnectionCreated(ctx, conn, d.Id(), d.Timeout(schema.TimeoutCreate)); err != nil {
+		return diag.Errorf("waiting for OpenSearch Outbound Connection (%s) create: %s", d.Id(), err)
+	}
+
+	if d.Get("accept_connection").(bool) {
+		input := &opensearchservice.AcceptInboundConnectionInput{
+			ConnectionId: aws.String(d.Id()),
+		}
+
+		_, err := conn.AcceptInboundConnectionWithContext(ctx, input)
+
+		if err != nil {
+			return diag.Errorf("accepting OpenSearch Inbound Connection (%s): %s", d.Id(), err)
+		}
+
+		if _, err := waitInboundConnectionAccepted(ctx, conn, d.Id(), d.Timeout(schema.TimeoutCreate)); err != nil {
+			return diag.Errorf("waiting for OpenSearch Inbound Connection (%s) accept: %s", d.Id(), err)
+		}
 	}
 
 	return resourceOutboundConnectionRead(ctx, d, meta)
@@ -79,25 +167,24 @@ func resourceOutboundConnectionCreate(ctx context.Context, d *schema.ResourceDat
 func resourceOutboundConnectionRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	conn := meta.(*conns.AWSClient).OpenSearchConn(ctx)
 
-	ccscRaw, statusCode, err := outboundConnectionRefreshState(ctx, conn, d.Id())()
-
-	if err != nil {
-		return diag.Errorf("reading Outbound Connection: %s", err)
-	}
-
-	ccsc := ccscRaw.(*opensearchservice.OutboundConnection)
-	log.Printf("[DEBUG] Outbound Connection response: %#v", ccsc)
+	connection, err := FindOutboundConnectionByID(ctx, conn, d.Id())
 
-	if !d.IsNewResource() && statusCode == opensearchservice.OutboundConnectionStatusCodeDeleted {
-		log.Printf("[INFO] Outbound Connection (%s) deleted, removing from state", d.Id())
+	if !d.IsNewResource() && tfresource.NotFound(err) {
+		log.Printf("[WARN] OpenSearch Outbound Connection (%s) not found, removing from state", d.Id())
 		d.SetId("")
 		return nil
 	}
 
-	d.Set("connection_alias", ccsc.ConnectionAlias)
-	d.Set("remote_domain_info", flattenOutboundConnectionDomainInfo(ccsc.RemoteDomainInfo))
-	d.Set("local_domain_info", flattenOutboundConnectionDomainInfo(ccsc.LocalDomainInfo))
-	d.Set("connection_status", statusCode)
+	if err != nil {
+		return diag.Errorf("reading OpenSearch Outbound Connection (%s): %s", d.Id(), err)
+	}
+
+	d.Set("connection_alias", connection.ConnectionAlias)
+	d.Set("connection_mode", connection.ConnectionMode)
+	d.Set("connection_properties", flattenOutboundConnectionConnectionProperties(connection.ConnectionProperties))
+	d.Set("connection_status", connection.ConnectionStatus.StatusCode)
+	d.Set("remote_domain_info", flattenOutboundConnectionDomainInfo(connection.RemoteDomainInfo))
+	d.Set("local_domain_info", flattenOutboundConnectionDomainInfo(connection.LocalDomainInfo))
 
 	return nil
 }
@@ -105,72 +192,109 @@ func resourceOutboundConnectionRead(ctx context.Context, d *schema.ResourceData,
 func resourceOutboundConnectionDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	conn := meta.(*conns.AWSClient).OpenSearchConn(ctx)
 
-	req := &opensearchservice.DeleteOutboundConnectionInput{
+	log.Printf("[DEBUG] Deleting OpenSearch Outbound Connection: %s", d.Id())
+	_, err := conn.DeleteOutboundConnectionWithContext(ctx, &opensearchservice.DeleteOutboundConnectionInput{
 		ConnectionId: aws.String(d.Id()),
-	}
+	})
 
-	_, err := conn.DeleteOutboundConnectionWithContext(ctx, req)
-
-	if tfawserr.ErrCodeEquals(err, "ResourceNotFoundException") {
+	if tfawserr.ErrCodeEquals(err, opensearchservice.ErrCodeResourceNotFoundException) {
 		return nil
 	}
 
 	if err != nil {
-		return diag.Errorf("deleting Outbound Connection (%s): %s", d.Id(), err)
+		return diag.Errorf("deleting OpenSearch Outbound Connection (%s): %s", d.Id(), err)
 	}
 
-	if err := waitForOutboundConnectionDeletion(ctx, conn, d.Id(), d.Timeout(schema.TimeoutDelete)); err != nil {
-		return diag.Errorf("waiting for VPC Peering Connection (%s) to be deleted: %s", d.Id(), err)
+	if _, err := waitOutboundConnectionDeleted(ctx, conn, d.Id(), d.Timeout(schema.TimeoutCreate)); err != nil {
+		return diag.Errorf("waiting for OpenSearch Outbound Connection (%s) delete: %s", d.Id(), err)
 	}
 
 	return nil
 }
 
-func outboundConnectionRefreshState(ctx context.Context, conn *opensearchservice.OpenSearchService, id string) retry.StateRefreshFunc {
-	return func() (interface{}, string, error) {
-		resp, err := conn.DescribeOutboundConnectionsWithContext(ctx, &opensearchservice.DescribeOutboundConnectionsInput{
-			Filters: []*opensearchservice.Filter{
-				{
-					Name:   aws.String("connection-id"),
-					Values: []*string{aws.String(id)},
-				},
+func FindOutboundConnectionByID(ctx context.Context, conn *opensearchservice.OpenSearchService, id string) (*opensearchservice.OutboundConnection, error) {
+	input := &opensearchservice.DescribeOutboundConnectionsInput{
+		Filters: []*opensearchservice.Filter{
+			{
+				Name:   aws.String("connection-id"),
+				Values: aws.StringSlice([]string{id}),
 			},
-		})
-		if err != nil {
-			return nil, "", err
+		},
+	}
+
+	output, err := findOutboundConnection(ctx, conn, input)
+
+	if err != nil {
+		return nil, err
+	}
+
+	if output.ConnectionStatus == nil {
+		return nil, tfresource.NewEmptyResultError(input)
+	}
+
+	if status := aws.StringValue(output.ConnectionStatus.StatusCode); status == opensearchservice.OutboundConnectionStatusCodeDeleted {
+		return nil, &retry.NotFoundError{
+			Message:     status,
+			LastRequest: input,
 		}
+	}
 
-		if resp == nil || resp.Connections == nil ||
-			len(resp.Connections) == 0 || resp.Connections[0] == nil {
-			// Sometimes AWS just has consistency issues and doesn't see
-			// our connection yet. Return an empty state.
-			return nil, "", nil
+	return output, err
+}
+
+func findOutboundConnection(ctx context.Context, conn *opensearchservice.OpenSearchService, input *opensearchservice.DescribeOutboundConnectionsInput) (*opensearchservice.OutboundConnection, error) {
+	output, err := findOutboundConnections(ctx, conn, input)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return tfresource.AssertSinglePtrResult(output)
+}
+
+func findOutboundConnections(ctx context.Context, conn *opensearchservice.OpenSearchService, input *opensearchservice.DescribeOutboundConnectionsInput) ([]*opensearchservice.OutboundConnection, error) {
+	var output []*opensearchservice.OutboundConnection
+
+	err := conn.DescribeOutboundConnectionsPagesWithContext(ctx, input, func(page *opensearchservice.DescribeOutboundConnectionsOutput, lastPage bool) bool {
+		if page == nil {
+			return !lastPage
+		}
+
+		for _, v := range page.Connections {
+			if v != nil {
+				output = append(output, v)
+			}
 		}
-		ccsc := resp.Connections[0]
-		if ccsc.ConnectionStatus == nil {
-			// Sometimes AWS just has consistency issues and doesn't see
-			// our connection yet. Return an empty state.
+
+		return !lastPage
+	})
+
+	if err != nil {
+		return nil, err
+	}
+
+	return output, nil
+}
+
+func statusOutboundConnection(ctx context.Context, conn *opensearchservice.OpenSearchService, id string) retry.StateRefreshFunc {
+	return func() (interface{}, string, error) {
+		output, err := FindOutboundConnectionByID(ctx, conn, id)
+
+		if tfresource.NotFound(err) {
 			return nil, "", nil
 		}
-		statusCode := aws.StringValue(ccsc.ConnectionStatus.StatusCode)
 
-		// A Outbound Connection can exist in a failed state,
-		// thus we short circuit before the time out would occur.
-		if statusCode == opensearchservice.OutboundConnectionStatusCodeValidationFailed {
-			return nil, statusCode, errors.New(aws.StringValue(ccsc.ConnectionStatus.Message))
+		if err != nil {
+			return nil, "", err
 		}
 
-		return ccsc, statusCode, nil
+		return output, aws.StringValue(output.ConnectionStatus.StatusCode), nil
 	}
 }
 
-func outboundConnectionWaitUntilAvailable(ctx context.Context, conn *opensearchservice.OpenSearchService, id string, timeout time.Duration) error {
-	log.Printf("[DEBUG] Waiting for Outbound Connection (%s) to become available.", id)
+func waitOutboundConnectionCreated(ctx context.Context, conn *opensearchservice.OpenSearchService, id string, timeout time.Duration) (*opensearchservice.OutboundConnection, error) {
 	stateConf := &retry.StateChangeConf{
-		Pending: []string{
-			opensearchservice.OutboundConnectionStatusCodeValidating,
-			opensearchservice.OutboundConnectionStatusCodeProvisioning,
-		},
+		Pending: []string{opensearchservice.OutboundConnectionStatusCodeValidating, opensearchservice.OutboundConnectionStatusCodeProvisioning},
 		Target: []string{
 			opensearchservice.OutboundConnectionStatusCodePendingAcceptance,
 			opensearchservice.OutboundConnectionStatusCodeActive,
@@ -178,16 +302,22 @@ func outboundConnectionWaitUntilAvailable(ctx context.Context, conn *opensearchs
 			opensearchservice.OutboundConnectionStatusCodeRejected,
 			opensearchservice.OutboundConnectionStatusCodeValidationFailed,
 		},
-		Refresh: outboundConnectionRefreshState(ctx, conn, id),
+		Refresh: statusOutboundConnection(ctx, conn, id),
 		Timeout: timeout,
 	}
-	if _, err := stateConf.WaitForStateContext(ctx); err != nil {
-		return fmt.Errorf("waiting for Outbound Connection (%s) to become available: %s", id, err)
+
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+
+	if output, ok := outputRaw.(*opensearchservice.OutboundConnection); ok {
+		tfresource.SetLastError(err, errors.New(aws.StringValue(output.ConnectionStatus.Message)))
+
+		return output, err
 	}
-	return nil
+
+	return nil, err
 }
 
-func waitForOutboundConnectionDeletion(ctx context.Context, conn *opensearchservice.OpenSearchService, id string, timeout time.Duration) error {
+func waitOutboundConnectionDeleted(ctx context.Context, conn *opensearchservice.OpenSearchService, id string, timeout time.Duration) (*opensearchservice.OutboundConnection, error) {
 	stateConf := &retry.StateChangeConf{
 		Pending: []string{
 			opensearchservice.OutboundConnectionStatusCodeActive,
@@ -195,44 +325,20 @@ func waitForOutboundConnectionDeletion(ctx context.Context, conn *opensearchserv
 			opensearchservice.OutboundConnectionStatusCodeDeleting,
 			opensearchservice.OutboundConnectionStatusCodeRejecting,
 		},
-		Target: []string{
-			opensearchservice.OutboundConnectionStatusCodeDeleted,
-		},
-		Refresh: outboundConnectionRefreshState(ctx, conn, id),
+		Target:  []string{},
+		Refresh: statusOutboundConnection(ctx, conn, id),
 		Timeout: timeout,
 	}
 
-	_, err := stateConf.WaitForStateContext(ctx)
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
 
-	return err
-}
+	if output, ok := outputRaw.(*opensearchservice.OutboundConnection); ok {
+		tfresource.SetLastError(err, errors.New(aws.StringValue(output.ConnectionStatus.Message)))
 
-func outboundConnectionDomainInfoSchema() *schema.Schema {
-	return &schema.Schema{
-		Type:     schema.TypeList,
-		Required: true,
-		ForceNew: true,
-		MaxItems: 1,
-		Elem: &schema.Resource{
-			Schema: map[string]*schema.Schema{
-				"owner_id": {
-					Type:     schema.TypeString,
-					Required: true,
-					ForceNew: true,
-				},
-				"domain_name": {
-					Type:     schema.TypeString,
-					Required: true,
-					ForceNew: true,
-				},
-				"region": {
-					Type:     schema.TypeString,
-					Required: true,
-					ForceNew: true,
-				},
-			},
-		},
+		return output, err
 	}
+
+	return nil, err
 }
 
 func expandOutboundConnectionDomainInfo(vOptions []interface{}) *opensearchservice.DomainInformationContainer {
@@ -261,3 +367,46 @@ func flattenOutboundConnectionDomainInfo(domainInfo *opensearchservice.DomainInf
 		"region":      aws.StringValue(domainInfo.AWSDomainInformation.Region),
 	}}
 }
+
+func expandOutboundConnectionConnectionProperties(cProperties []interface{}) *opensearchservice.ConnectionProperties {
+	if len(cProperties) == 0 || cProperties[0] == nil {
+		return nil
+	}
+
+	mOptions := cProperties[0].(map[string]interface{})
+
+	return &opensearchservice.ConnectionProperties{
+		CrossClusterSearch: expandOutboundConnectionCrossClusterSearchConnectionProperties(mOptions["cross_cluster_search"].([]interface{})),
+	}
+}
+
+func flattenOutboundConnectionConnectionProperties(cProperties *opensearchservice.ConnectionProperties) []interface{} {
+	if cProperties == nil {
+		return nil
+	}
+	return []interface{}{map[string]interface{}{
+		"cross_cluster_search": flattenOutboundConnectionCrossClusterSearchConnectionProperties(cProperties.CrossClusterSearch),
+		"endpoint":             aws.StringValue(cProperties.Endpoint),
+	}}
+}
+
+func expandOutboundConnectionCrossClusterSearchConnectionProperties(cProperties []interface{}) *opensearchservice.CrossClusterSearchConnectionProperties {
+	if len(cProperties) == 0 || cProperties[0] == nil {
+		return nil
+	}
+
+	mOptions := cProperties[0].(map[string]interface{})
+
+	return &opensearchservice.CrossClusterSearchConnectionProperties{
+		SkipUnavailable: aws.String(mOptions["skip_unavailable"].(string)),
+	}
+}
+
+func flattenOutboundConnectionCrossClusterSearchConnectionProperties(cProperties *opensearchservice.CrossClusterSearchConnectionProperties) []interface{} {
+	if cProperties == nil {
+		return nil
+	}
+	return []interface{}{map[string]interface{}{
+		"skip_unavailable": aws.StringValue(cProperties.SkipUnavailable),
+	}}
+}
diff --git a/internal/service/opensearch/outbound_connection_test.go b/internal/service/opensearch/outbound_connection_test.go
index b20d437291e..9b779e781b8 100644
--- a/internal/service/opensearch/outbound_connection_test.go
+++ b/internal/service/opensearch/outbound_connection_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package opensearch_test
 
 import (
@@ -29,13 +32,46 @@ func TestAccOpenSearchOutboundConnection_basic(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDomainExists(ctx, "aws_opensearch_domain.domain_1", &domain),
 					testAccCheckDomainExists(ctx, "aws_opensearch_domain.domain_2", &domain),
-					resource.TestCheckResourceAttr(resourceName, "connection_status", "PENDING_ACCEPTANCE"),
+					resource.TestCheckResourceAttr(resourceName, "connection_status", "ACTIVE"),
 				),
 			},
 			{
-				ResourceName:      resourceName,
-				ImportState:       true,
-				ImportStateVerify: true,
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"accept_connection"},
+			},
+		},
+	})
+}
+
+func TestAccOpenSearchOutboundConnection_vpc(t *testing.T) {
+	ctx := acctest.Context(t)
+	var domain opensearchservice.DomainStatus
+	ri := sdkacctest.RandString(10)
+	name := fmt.Sprintf("tf-test-%s", ri)
+	resourceName := "aws_opensearch_outbound_connection.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, opensearchservice.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckDomainDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccOutboundConnectionConfig_vpcEndpoint(name),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckDomainExists(ctx, "aws_opensearch_domain.domain_1", &domain),
+					testAccCheckDomainExists(ctx, "aws_opensearch_domain.domain_2", &domain),
+					resource.TestCheckResourceAttrSet(resourceName, "connection_properties.0.endpoint"),
+					resource.TestCheckResourceAttr(resourceName, "connection_status", "ACTIVE"),
+				),
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"accept_connection"},
 			},
 		},
 	})
@@ -147,7 +183,16 @@ data "aws_caller_identity" "current" {}
 data "aws_region" "current" {}
 
 resource "aws_opensearch_outbound_connection" "test" {
-  connection_alias = "%s"
+  connection_alias  = "%s"
+  connection_mode   = "DIRECT"
+  accept_connection = true
+
+  connection_properties {
+    cross_cluster_search {
+      skip_unavailable = "ENABLED"
+    }
+  }
+
   local_domain_info {
     owner_id    = data.aws_caller_identity.current.account_id
     region      = data.aws_region.current.name
@@ -162,3 +207,126 @@ resource "aws_opensearch_outbound_connection" "test" {
 }
 `, name, pw, name, pw, name)
 }
+
+func testAccOutboundConnectionConfig_vpcEndpoint(name string) string {
+	// Satisfy the pw requirements
+	pw := fmt.Sprintf("Aa1-%s", sdkacctest.RandString(10))
+
+	return acctest.ConfigCompose(
+		acctest.ConfigAvailableAZsNoOptIn(),
+		fmt.Sprintf(`
+resource "aws_vpc" "test" {
+  cidr_block = "192.168.0.0/22"
+
+  tags = {
+    Name = %[1]q
+  }
+}
+
+resource "aws_subnet" "test" {
+  vpc_id            = aws_vpc.test.id
+  availability_zone = data.aws_availability_zones.available.names[0]
+  cidr_block        = "192.168.0.0/24"
+
+  tags = {
+    Name = %[1]q
+  }
+}
+
+resource "aws_subnet" "test2" {
+  vpc_id            = aws_vpc.test.id
+  availability_zone = data.aws_availability_zones.available.names[1]
+  cidr_block        = "192.168.1.0/24"
+
+  tags = {
+    Name = %[1]q
+  }
+}
+
+resource "aws_security_group" "test" {
+  vpc_id = aws_vpc.test.id
+}
+
+resource "aws_security_group" "test2" {
+  vpc_id = aws_vpc.test.id
+}
+
+resource "aws_opensearch_domain" "domain_1" {
+  domain_name = "%[1]s-1"
+
+  cluster_config {
+    instance_type = "t3.small.search" # supported in both aws and aws-us-gov
+  }
+
+  ebs_options {
+    ebs_enabled = true
+    volume_size = 10
+  }
+
+  node_to_node_encryption {
+    enabled = true
+  }
+
+  advanced_security_options {
+    enabled                        = true
+    internal_user_database_enabled = true
+
+    master_user_options {
+      master_user_name     = "test"
+      master_user_password = %[2]q
+    }
+  }
+
+  encrypt_at_rest {
+    enabled = true
+  }
+
+  domain_endpoint_options {
+    enforce_https       = true
+    tls_security_policy = "Policy-Min-TLS-1-2-2019-07"
+  }
+}
+
+resource "aws_opensearch_domain" "domain_2" {
+  domain_name = "%[1]s-2"
+
+  ebs_options {
+    ebs_enabled = true
+    volume_size = 10
+  }
+
+  cluster_config {
+    instance_count         = 2
+    zone_awareness_enabled = true
+    instance_type          = "t3.small.search"
+  }
+
+  vpc_options {
+    security_group_ids = [aws_security_group.test.id, aws_security_group.test2.id]
+    subnet_ids         = [aws_subnet.test.id, aws_subnet.test2.id]
+  }
+}
+
+data "aws_caller_identity" "current" {}
+data "aws_region" "current" {}
+
+resource "aws_opensearch_outbound_connection" "test" {
+  connection_alias  = %[1]q
+  connection_mode   = "VPC_ENDPOINT"
+  accept_connection = true
+
+  local_domain_info {
+    owner_id    = data.aws_caller_identity.current.account_id
+    region      = data.aws_region.current.name
+    domain_name = aws_opensearch_domain.domain_1.domain_name
+  }
+
+  remote_domain_info {
+    owner_id    = data.aws_caller_identity.current.account_id
+    region      = data.aws_region.current.name
+    domain_name = aws_opensearch_domain.domain_2.domain_name
+  }
+}
+
+`, name, pw))
+}
diff --git a/internal/service/opensearch/package.go b/internal/service/opensearch/package.go
new file mode 100644
index 00000000000..c474ba0a44c
--- /dev/null
+++ b/internal/service/opensearch/package.go
@@ -0,0 +1,236 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package opensearch
+
+import (
+	"context"
+	"log"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/opensearchservice"
+	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+)
+
+// @SDKResource("aws_opensearch_package")
+func ResourcePackage() *schema.Resource {
+	return &schema.Resource{
+		CreateWithoutTimeout: resourcePackageCreate,
+		ReadWithoutTimeout:   resourcePackageRead,
+		UpdateWithoutTimeout: resourcePackageUpdate,
+		DeleteWithoutTimeout: resourcePackageDelete,
+
+		Importer: &schema.ResourceImporter{
+			StateContext: schema.ImportStatePassthroughContext,
+		},
+
+		Schema: map[string]*schema.Schema{
+			"available_package_version": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"package_description": {
+				Type:     schema.TypeString,
+				Optional: true,
+			},
+			"package_id": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"package_name": {
+				Type:         schema.TypeString,
+				Required:     true,
+				ForceNew:     true,
+				ValidateFunc: validation.StringLenBetween(1, 32),
+			},
+			"package_source": {
+				Type:     schema.TypeList,
+				Required: true,
+				ForceNew: true,
+				MaxItems: 1,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"s3_bucket_name": {
+							Type:     schema.TypeString,
+							Required: true,
+							ForceNew: true,
+						},
+						"s3_key": {
+							Type:     schema.TypeString,
+							Required: true,
+							ForceNew: true,
+						},
+					},
+				},
+			},
+			"package_type": {
+				Type:         schema.TypeString,
+				Required:     true,
+				ForceNew:     true,
+				ValidateFunc: validation.StringInSlice(opensearchservice.PackageType_Values(), false),
+			},
+		},
+	}
+}
+
+func resourcePackageCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).OpenSearchConn(ctx)
+
+	name := d.Get("package_name").(string)
+	input := &opensearchservice.CreatePackageInput{
+		PackageDescription: aws.String(d.Get("package_description").(string)),
+		PackageName:        aws.String(name),
+		PackageType:        aws.String(d.Get("package_type").(string)),
+	}
+
+	if v, ok := d.GetOk("package_source"); ok {
+		input.PackageSource = expandPackageSource(v.([]interface{})[0].(map[string]interface{}))
+	}
+
+	output, err := conn.CreatePackageWithContext(ctx, input)
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "creating OpenSearch Package (%s): %s", name, err)
+	}
+
+	d.SetId(aws.StringValue(output.PackageDetails.PackageID))
+
+	return append(diags, resourcePackageRead(ctx, d, meta)...)
+}
+
+func resourcePackageRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).OpenSearchConn(ctx)
+
+	pkg, err := FindPackageByID(ctx, conn, d.Id())
+
+	if !d.IsNewResource() && tfresource.NotFound(err) {
+		log.Printf("[WARN] OpenSearch Package (%s) not found, removing from state", d.Id())
+		d.SetId("")
+		return diags
+	}
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "reading OpenSearch Package (%s): %s", d.Id(), err)
+	}
+
+	d.Set("available_package_version", pkg.AvailablePackageVersion)
+	d.Set("package_description", pkg.PackageDescription)
+	d.Set("package_id", pkg.PackageID)
+	d.Set("package_name", pkg.PackageName)
+	d.Set("package_type", pkg.PackageType)
+
+	return diags
+}
+
+func resourcePackageUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).OpenSearchConn(ctx)
+
+	input := &opensearchservice.UpdatePackageInput{
+		PackageID:          aws.String(d.Id()),
+		PackageDescription: aws.String(d.Get("package_description").(string)),
+		PackageSource:      expandPackageSource(d.Get("package_source").([]interface{})[0].(map[string]interface{})),
+	}
+
+	_, err := conn.UpdatePackageWithContext(ctx, input)
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "updating OpenSearch Package (%s): %s", d.Id(), err)
+	}
+
+	return append(diags, resourcePackageRead(ctx, d, meta)...)
+}
+
+func resourcePackageDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).OpenSearchConn(ctx)
+
+	log.Printf("[DEBUG] Deleting OpenSearch Package: %s", d.Id())
+	_, err := conn.DeletePackageWithContext(ctx, &opensearchservice.DeletePackageInput{
+		PackageID: aws.String(d.Id()),
+	})
+
+	if tfawserr.ErrCodeEquals(err, opensearchservice.ErrCodeResourceNotFoundException) {
+		return diags
+	}
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "deleting OpenSearch Package (%s): %s", d.Id(), err)
+	}
+
+	return diags
+}
+
+func FindPackageByID(ctx context.Context, conn *opensearchservice.OpenSearchService, id string) (*opensearchservice.PackageDetails, error) {
+	input := &opensearchservice.DescribePackagesInput{
+		Filters: []*opensearchservice.DescribePackagesFilter{
+			{
+				Name:  aws.String("PackageID"),
+				Value: aws.StringSlice([]string{id}),
+			},
+		},
+	}
+
+	return findPackage(ctx, conn, input)
+}
+
+func findPackage(ctx context.Context, conn *opensearchservice.OpenSearchService, input *opensearchservice.DescribePackagesInput) (*opensearchservice.PackageDetails, error) {
+	output, err := findPackages(ctx, conn, input)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return tfresource.AssertSinglePtrResult(output)
+}
+
+func findPackages(ctx context.Context, conn *opensearchservice.OpenSearchService, input *opensearchservice.DescribePackagesInput) ([]*opensearchservice.PackageDetails, error) {
+	var output []*opensearchservice.PackageDetails
+
+	err := conn.DescribePackagesPagesWithContext(ctx, input, func(page *opensearchservice.DescribePackagesOutput, lastPage bool) bool {
+		if page == nil {
+			return !lastPage
+		}
+
+		for _, v := range page.PackageDetailsList {
+			if v != nil {
+				output = append(output, v)
+			}
+		}
+
+		return !lastPage
+	})
+
+	if tfawserr.ErrCodeEquals(err, opensearchservice.ErrCodeResourceNotFoundException) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	return output, nil
+}
+
+func expandPackageSource(v interface{}) *opensearchservice.PackageSource {
+	if v == nil {
+		return nil
+	}
+
+	return &opensearchservice.PackageSource{
+		S3BucketName: aws.String(v.(map[string]interface{})["s3_bucket_name"].(string)),
+		S3Key:        aws.String(v.(map[string]interface{})["s3_key"].(string)),
+	}
+}
diff --git a/internal/service/opensearch/package_association.go b/internal/service/opensearch/package_association.go
new file mode 100644
index 00000000000..49aa138b25c
--- /dev/null
+++ b/internal/service/opensearch/package_association.go
@@ -0,0 +1,248 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package opensearch
+
+import (
+	"context"
+	"fmt"
+	"log"
+	"time"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/opensearchservice"
+	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
+	tfslices "github.com/hashicorp/terraform-provider-aws/internal/slices"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+)
+
+// @SDKResource("aws_opensearch_package_association")
+func ResourcePackageAssociation() *schema.Resource {
+	return &schema.Resource{
+		CreateWithoutTimeout: resourcePackageAssociationCreate,
+		ReadWithoutTimeout:   resourcePackageAssociationRead,
+		DeleteWithoutTimeout: resourcePackageAssociationDelete,
+
+		Importer: &schema.ResourceImporter{
+			StateContext: schema.ImportStatePassthroughContext,
+		},
+
+		Timeouts: &schema.ResourceTimeout{
+			Create: schema.DefaultTimeout(10 * time.Minute),
+			Delete: schema.DefaultTimeout(10 * time.Minute),
+		},
+
+		Schema: map[string]*schema.Schema{
+			"domain_name": {
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+			"package_id": {
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+			"reference_path": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+		},
+	}
+}
+
+func resourcePackageAssociationCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).OpenSearchConn(ctx)
+
+	domainName := d.Get("domain_name").(string)
+	packageID := d.Get("package_id").(string)
+	id := fmt.Sprintf("%s-%s", domainName, packageID)
+	input := &opensearchservice.AssociatePackageInput{
+		DomainName: aws.String(domainName),
+		PackageID:  aws.String(packageID),
+	}
+
+	_, err := conn.AssociatePackageWithContext(ctx, input)
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "creating OpenSearch Package Association (%s): %s", id, err)
+	}
+
+	d.SetId(id)
+
+	if _, err := waitPackageAssociationCreated(ctx, conn, domainName, packageID, d.Timeout(schema.TimeoutCreate)); err != nil {
+		return sdkdiag.AppendErrorf(diags, "waiting for OpenSearch Package Association (%s) create: %s", d.Id(), err)
+	}
+
+	return append(diags, resourcePackageAssociationRead(ctx, d, meta)...)
+}
+
+func resourcePackageAssociationRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).OpenSearchConn(ctx)
+
+	domainName := d.Get("domain_name").(string)
+	packageID := d.Get("package_id").(string)
+	pkgAssociation, err := FindPackageAssociationByTwoPartKey(ctx, conn, domainName, packageID)
+
+	if !d.IsNewResource() && tfresource.NotFound(err) {
+		log.Printf("[WARN] OpenSearch Package Association (%s) not found, removing from state", d.Id())
+		d.SetId("")
+		return diags
+	}
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "reading OpenSearch Package Association (%s): %s", d.Id(), err)
+	}
+
+	d.Set("domain_name", pkgAssociation.DomainName)
+	d.Set("package_id", pkgAssociation.PackageID)
+	d.Set("reference_path", pkgAssociation.ReferencePath)
+
+	return diags
+}
+
+func resourcePackageAssociationDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).OpenSearchConn(ctx)
+
+	log.Printf("[DEBUG] Deleting OpenSearch Package Association: %s", d.Id())
+	domainName := d.Get("domain_name").(string)
+	packageID := d.Get("package_id").(string)
+	_, err := conn.DissociatePackageWithContext(ctx, &opensearchservice.DissociatePackageInput{
+		DomainName: aws.String(domainName),
+		PackageID:  aws.String(packageID),
+	})
+
+	if tfawserr.ErrCodeEquals(err, opensearchservice.ErrCodeResourceNotFoundException) {
+		return diags
+	}
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "deleting OpenSearch Package Association (%s): %s", d.Id(), err)
+	}
+
+	if _, err := waitPackageAssociationDeleted(ctx, conn, domainName, packageID, d.Timeout(schema.TimeoutDelete)); err != nil {
+		return sdkdiag.AppendErrorf(diags, "waiting for OpenSearch Package Association (%s) delete: %s", d.Id(), err)
+	}
+
+	return diags
+}
+
+func FindPackageAssociationByTwoPartKey(ctx context.Context, conn *opensearchservice.OpenSearchService, domainName, packageID string) (*opensearchservice.DomainPackageDetails, error) {
+	input := &opensearchservice.ListPackagesForDomainInput{
+		DomainName: aws.String(domainName),
+	}
+	filter := func(v *opensearchservice.DomainPackageDetails) bool {
+		return aws.StringValue(v.PackageID) == packageID
+	}
+
+	return findPackageAssociation(ctx, conn, input, filter)
+}
+
+func findPackageAssociation(ctx context.Context, conn *opensearchservice.OpenSearchService, input *opensearchservice.ListPackagesForDomainInput, filter tfslices.Predicate[*opensearchservice.DomainPackageDetails]) (*opensearchservice.DomainPackageDetails, error) {
+	output, err := findPackageAssociations(ctx, conn, input, filter)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return tfresource.AssertSinglePtrResult(output)
+}
+
+func findPackageAssociations(ctx context.Context, conn *opensearchservice.OpenSearchService, input *opensearchservice.ListPackagesForDomainInput, filter tfslices.Predicate[*opensearchservice.DomainPackageDetails]) ([]*opensearchservice.DomainPackageDetails, error) {
+	var output []*opensearchservice.DomainPackageDetails
+
+	err := conn.ListPackagesForDomainPagesWithContext(ctx, input, func(page *opensearchservice.ListPackagesForDomainOutput, lastPage bool) bool {
+		if page == nil {
+			return !lastPage
+		}
+
+		for _, v := range page.DomainPackageDetailsList {
+			if v != nil && filter(v) {
+				output = append(output, v)
+			}
+		}
+
+		return !lastPage
+	})
+
+	if tfawserr.ErrCodeEquals(err, opensearchservice.ErrCodeResourceNotFoundException) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	return output, nil
+}
+
+func statusPackageAssociation(ctx context.Context, conn *opensearchservice.OpenSearchService, domainName, packageID string) retry.StateRefreshFunc {
+	return func() (interface{}, string, error) {
+		output, err := FindPackageAssociationByTwoPartKey(ctx, conn, domainName, packageID)
+
+		if tfresource.NotFound(err) {
+			return nil, "", nil
+		}
+
+		if err != nil {
+			return nil, "", err
+		}
+
+		return output, aws.StringValue(output.DomainPackageStatus), nil
+	}
+}
+
+func waitPackageAssociationCreated(ctx context.Context, conn *opensearchservice.OpenSearchService, domainName, packageID string, timeout time.Duration) (*opensearchservice.DomainPackageDetails, error) {
+	stateConf := &retry.StateChangeConf{
+		Pending: []string{opensearchservice.DomainPackageStatusAssociating},
+		Target:  []string{opensearchservice.DomainPackageStatusActive},
+		Refresh: statusPackageAssociation(ctx, conn, domainName, packageID),
+		Timeout: timeout,
+		Delay:   30 * time.Second,
+	}
+
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+
+	if output, ok := outputRaw.(*opensearchservice.DomainPackageDetails); ok {
+		if status, details := aws.StringValue(output.DomainPackageStatus), output.ErrorDetails; status == opensearchservice.DomainPackageStatusAssociationFailed && details != nil {
+			tfresource.SetLastError(err, fmt.Errorf("%s: %s", aws.StringValue(details.ErrorType), aws.StringValue(details.ErrorMessage)))
+		}
+
+		return output, err
+	}
+
+	return nil, err
+}
+
+func waitPackageAssociationDeleted(ctx context.Context, conn *opensearchservice.OpenSearchService, domainName, packageID string, timeout time.Duration) (*opensearchservice.DomainPackageDetails, error) {
+	stateConf := &retry.StateChangeConf{
+		Pending: []string{opensearchservice.DomainPackageStatusDissociating},
+		Target:  []string{},
+		Refresh: statusPackageAssociation(ctx, conn, domainName, packageID),
+		Timeout: timeout,
+		Delay:   30 * time.Second,
+	}
+
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+
+	if output, ok := outputRaw.(*opensearchservice.DomainPackageDetails); ok {
+		if status, details := aws.StringValue(output.DomainPackageStatus), output.ErrorDetails; status == opensearchservice.DomainPackageStatusDissociationFailed && details != nil {
+			tfresource.SetLastError(err, fmt.Errorf("%s: %s", aws.StringValue(details.ErrorType), aws.StringValue(details.ErrorMessage)))
+		}
+
+		return output, err
+	}
+
+	return nil, err
+}
diff --git a/internal/service/opensearch/package_association_test.go b/internal/service/opensearch/package_association_test.go
new file mode 100644
index 00000000000..38cfcce2fb1
--- /dev/null
+++ b/internal/service/opensearch/package_association_test.go
@@ -0,0 +1,151 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package opensearch_test
+
+import (
+	"context"
+	"fmt"
+	"testing"
+
+	"github.com/aws/aws-sdk-go/service/opensearchservice"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
+	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	tfopensearch "github.com/hashicorp/terraform-provider-aws/internal/service/opensearch"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+)
+
+func TestAccOpenSearchPackageAssociation_basic(t *testing.T) {
+	ctx := acctest.Context(t)
+	domainName := testAccRandomDomainName()
+	pkgName := testAccRandomDomainName()
+	resourceName := "aws_opensearch_package_association.test"
+	packageResourceName := "aws_opensearch_package.test"
+	domainResourceName := "aws_opensearch_domain.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, opensearchservice.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckPackageAssociationDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccPackageAssociationConfig_basic(pkgName, domainName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckPackageAssociationExists(ctx, resourceName),
+					resource.TestCheckResourceAttrPair(resourceName, "domain_name", domainResourceName, "domain_name"),
+					resource.TestCheckResourceAttrPair(resourceName, "package_id", packageResourceName, "id"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccOpenSearchPackageAssociation_disappears(t *testing.T) {
+	ctx := acctest.Context(t)
+	domainName := testAccRandomDomainName()
+	pkgName := testAccRandomDomainName()
+	resourceName := "aws_opensearch_package_association.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, opensearchservice.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckPackageAssociationDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccPackageAssociationConfig_basic(pkgName, domainName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckPackageAssociationExists(ctx, resourceName),
+					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfopensearch.ResourcePackageAssociation(), resourceName),
+				),
+				ExpectNonEmptyPlan: true,
+			},
+		},
+	})
+}
+
+func testAccCheckPackageAssociationExists(ctx context.Context, n string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		conn := acctest.Provider.Meta().(*conns.AWSClient).OpenSearchConn(ctx)
+
+		_, err := tfopensearch.FindPackageAssociationByTwoPartKey(ctx, conn, rs.Primary.Attributes["domain_name"], rs.Primary.Attributes["package_id"])
+
+		return err
+	}
+}
+
+func testAccCheckPackageAssociationDestroy(ctx context.Context) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		for _, rs := range s.RootModule().Resources {
+			if rs.Type != "aws_opensearch_package_association" {
+				continue
+			}
+
+			conn := acctest.Provider.Meta().(*conns.AWSClient).OpenSearchConn(ctx)
+
+			_, err := tfopensearch.FindPackageAssociationByTwoPartKey(ctx, conn, rs.Primary.Attributes["domain_name"], rs.Primary.Attributes["package_id"])
+
+			if tfresource.NotFound(err) {
+				continue
+			}
+
+			if err != nil {
+				return err
+			}
+
+			return fmt.Errorf("OpenSearch Package Association %s still exists", rs.Primary.ID)
+		}
+
+		return nil
+	}
+}
+
+func testAccPackageAssociationConfig_basic(pkgName, domainName string) string {
+	return fmt.Sprintf(`
+resource "aws_s3_bucket" "test" {
+  bucket = %[1]q
+}
+
+resource "aws_s3_object" "test" {
+  bucket = aws_s3_bucket.test.bucket
+  key    = %[1]q
+  source = "./test-fixtures/example-opensearch-custom-package.txt"
+  etag   = filemd5("./test-fixtures/example-opensearch-custom-package.txt")
+}
+
+resource "aws_opensearch_package" "test" {
+  package_name = %[1]q
+  package_source {
+    s3_bucket_name = aws_s3_bucket.test.bucket
+    s3_key         = aws_s3_object.test.key
+  }
+  package_type = "TXT-DICTIONARY"
+}
+
+resource "aws_opensearch_domain" "test" {
+  domain_name = %[2]q
+
+  cluster_config {
+    instance_type = "t3.small.search" # supported in both aws and aws-us-gov
+  }
+
+  ebs_options {
+    ebs_enabled = true
+    volume_size = 10
+  }
+}
+
+resource "aws_opensearch_package_association" "test" {
+  package_id  = aws_opensearch_package.test.id
+  domain_name = aws_opensearch_domain.test.domain_name
+}
+`, pkgName, domainName)
+}
diff --git a/internal/service/opensearch/package_test.go b/internal/service/opensearch/package_test.go
new file mode 100644
index 00000000000..d31f9fdb907
--- /dev/null
+++ b/internal/service/opensearch/package_test.go
@@ -0,0 +1,141 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package opensearch_test
+
+import (
+	"context"
+	"fmt"
+	"testing"
+
+	"github.com/aws/aws-sdk-go/service/opensearchservice"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
+	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	tfopensearch "github.com/hashicorp/terraform-provider-aws/internal/service/opensearch"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+)
+
+func TestAccOpenSearchPackage_basic(t *testing.T) {
+	ctx := acctest.Context(t)
+	pkgName := testAccRandomDomainName()
+	resourceName := "aws_opensearch_package.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, opensearchservice.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckPackageDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccPackageConfig_basic(pkgName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckPackageExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "available_package_version", ""),
+					resource.TestCheckResourceAttr(resourceName, "package_description", ""),
+					resource.TestCheckResourceAttrSet(resourceName, "package_id"),
+					resource.TestCheckResourceAttr(resourceName, "package_name", pkgName),
+					resource.TestCheckResourceAttr(resourceName, "package_source.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "package_type", "TXT-DICTIONARY"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{
+					"package_source", // This isn't returned by the API
+				},
+			},
+		},
+	})
+}
+
+func TestAccOpenSearchPackage_disappears(t *testing.T) {
+	ctx := acctest.Context(t)
+	pkgName := testAccRandomDomainName()
+	resourceName := "aws_opensearch_package.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, opensearchservice.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckPackageDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccPackageConfig_basic(pkgName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckPackageExists(ctx, resourceName),
+					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfopensearch.ResourcePackage(), resourceName),
+				),
+				ExpectNonEmptyPlan: true,
+			},
+		},
+	})
+}
+
+func testAccCheckPackageExists(ctx context.Context, n string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		conn := acctest.Provider.Meta().(*conns.AWSClient).OpenSearchConn(ctx)
+
+		_, err := tfopensearch.FindPackageByID(ctx, conn, rs.Primary.ID)
+
+		return err
+	}
+}
+
+func testAccCheckPackageDestroy(ctx context.Context) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		for _, rs := range s.RootModule().Resources {
+			if rs.Type != "aws_opensearch_package" {
+				continue
+			}
+
+			conn := acctest.Provider.Meta().(*conns.AWSClient).OpenSearchConn(ctx)
+
+			_, err := tfopensearch.FindPackageByID(ctx, conn, rs.Primary.ID)
+
+			if tfresource.NotFound(err) {
+				continue
+			}
+
+			if err != nil {
+				return err
+			}
+
+			return fmt.Errorf("OpenSearch Package %s still exists", rs.Primary.ID)
+		}
+
+		return nil
+	}
+}
+
+func testAccPackageConfig_basic(rName string) string {
+	return fmt.Sprintf(`
+resource "aws_s3_bucket" "test" {
+  bucket = %[1]q
+}
+
+resource "aws_s3_object" "test" {
+  bucket = aws_s3_bucket.test.bucket
+  key    = %[1]q
+  source = "./test-fixtures/example-opensearch-custom-package.txt"
+  etag   = filemd5("./test-fixtures/example-opensearch-custom-package.txt")
+}
+
+resource "aws_opensearch_package" "test" {
+  package_name = %[1]q
+  package_source {
+    s3_bucket_name = aws_s3_bucket.test.bucket
+    s3_key         = aws_s3_object.test.key
+  }
+  package_type = "TXT-DICTIONARY"
+}
+`, rName)
+}
diff --git a/internal/service/opensearch/service_package_gen.go b/internal/service/opensearch/service_package_gen.go
index 390dc6b9499..a10a8bd9ebe 100644
--- a/internal/service/opensearch/service_package_gen.go
+++ b/internal/service/opensearch/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	opensearchservice_sdkv1 "github.com/aws/aws-sdk-go/service/opensearchservice"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -57,6 +58,18 @@ func (p *servicePackage) SDKResources(ctx context.Context) []*types.ServicePacka
 			Factory:  ResourceOutboundConnection,
 			TypeName: "aws_opensearch_outbound_connection",
 		},
+		{
+			Factory:  ResourcePackage,
+			TypeName: "aws_opensearch_package",
+		},
+		{
+			Factory:  ResourcePackageAssociation,
+			TypeName: "aws_opensearch_package_association",
+		},
+		{
+			Factory:  ResourceVPCEndpoint,
+			TypeName: "aws_opensearch_vpc_endpoint",
+		},
 	}
 }
 
@@ -71,4 +84,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*o
 	return opensearchservice_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/opensearch/status.go b/internal/service/opensearch/status.go
index e031018083b..57d38fd8716 100644
--- a/internal/service/opensearch/status.go
+++ b/internal/service/opensearch/status.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package opensearch
 
 import (
diff --git a/internal/service/opensearch/sweep.go b/internal/service/opensearch/sweep.go
index 8f6118c7771..8274b67818e 100644
--- a/internal/service/opensearch/sweep.go
+++ b/internal/service/opensearch/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package opensearch
 
@@ -12,23 +12,36 @@ import (
 	"github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_opensearch_domain", &resource.Sweeper{
 		Name: "aws_opensearch_domain",
 		F:    sweepDomains,
+		Dependencies: []string{
+			"aws_opensearch_inbound_connection_accepter",
+			"aws_opensearch_outbound_connection",
+		},
+	})
+
+	resource.AddTestSweepers("aws_opensearch_inbound_connection_accepter", &resource.Sweeper{
+		Name: "aws_opensearch_inbound_connection_accepter",
+		F:    sweepInboundConnections,
+	})
+
+	resource.AddTestSweepers("aws_opensearch_outbound_connection", &resource.Sweeper{
+		Name: "aws_opensearch_outbound_connection",
+		F:    sweepOutboundConnections,
 	})
 }
 
 func sweepDomains(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
-
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
-
 	conn := client.OpenSearchConn(ctx)
 	sweepResources := make([]sweep.Sweepable, 0)
 	var errs *multierror.Error
@@ -38,7 +51,7 @@ func sweepDomains(region string) error {
 	// ListDomainNames has no pagination support whatsoever
 	output, err := conn.ListDomainNamesWithContext(ctx, input)
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping OpenSearch Domain sweep for %s: %s", region, err)
 		return errs.ErrorOrNil()
 	}
@@ -62,6 +75,11 @@ func sweepDomains(region string) error {
 
 		name := aws.StringValue(domainInfo.DomainName)
 
+		if engineType := aws.StringValue(domainInfo.EngineType); engineType != opensearchservice.EngineTypeOpenSearch {
+			log.Printf("[INFO] Skipping OpenSearch Domain %s: EngineType = %s", name, engineType)
+			continue
+		}
+
 		// OpenSearch Domains have regularly gotten stuck in a "being deleted" state
 		// e.g. Deleted and Processing are both true for days in the API
 		// Filter out domains that are Deleted already.
@@ -87,14 +105,118 @@ func sweepDomains(region string) error {
 		sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
 	}
 
-	if err = sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err = sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("error sweeping OpenSearch Domains for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
+	if awsv1.SkipSweepError(errs.ErrorOrNil()) {
 		log.Printf("[WARN] Skipping OpenSearch Domain sweep for %s: %s", region, errs)
 		return nil
 	}
 
 	return errs.ErrorOrNil()
 }
+
+func sweepInboundConnections(region string) error {
+	ctx := sweep.Context(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
+	if err != nil {
+		return fmt.Errorf("error getting client: %w", err)
+	}
+	conn := client.OpenSearchConn(ctx)
+	input := &opensearchservice.DescribeInboundConnectionsInput{}
+	sweepResources := make([]sweep.Sweepable, 0)
+
+	err = conn.DescribeInboundConnectionsPagesWithContext(ctx, input, func(page *opensearchservice.DescribeInboundConnectionsOutput, lastPage bool) bool {
+		if page == nil {
+			return !lastPage
+		}
+
+		for _, v := range page.Connections {
+			id := aws.StringValue(v.ConnectionId)
+
+			status := aws.StringValue(v.ConnectionStatus.StatusCode)
+			if status == opensearchservice.InboundConnectionStatusCodeDeleted || status == opensearchservice.InboundConnectionStatusCodeRejected {
+				log.Printf("[INFO] Skipping OpenSearch Inbound Connection %s: %s", id, status)
+				continue
+			}
+
+			r := ResourceInboundConnectionAccepter()
+			d := r.Data(nil)
+			d.SetId(id)
+			d.Set("connection_status", status)
+
+			sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
+		}
+
+		return !lastPage
+	})
+
+	if awsv1.SkipSweepError(err) {
+		log.Printf("[WARN] Skipping OpenSearch Inbound Connection sweep for %s: %s", region, err)
+		return nil
+	}
+
+	if err != nil {
+		return fmt.Errorf("error listing OpenSearch Inbound Connections: %w", err)
+	}
+
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
+
+	if err != nil {
+		return fmt.Errorf("error sweeping OpenSearch Inbound Connections (%s): %w", region, err)
+	}
+
+	return nil
+}
+
+func sweepOutboundConnections(region string) error {
+	ctx := sweep.Context(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
+	if err != nil {
+		return fmt.Errorf("error getting client: %w", err)
+	}
+	conn := client.OpenSearchConn(ctx)
+	input := &opensearchservice.DescribeOutboundConnectionsInput{}
+	sweepResources := make([]sweep.Sweepable, 0)
+
+	err = conn.DescribeOutboundConnectionsPagesWithContext(ctx, input, func(page *opensearchservice.DescribeOutboundConnectionsOutput, lastPage bool) bool {
+		if page == nil {
+			return !lastPage
+		}
+
+		for _, v := range page.Connections {
+			id := aws.StringValue(v.ConnectionId)
+
+			if status := aws.StringValue(v.ConnectionStatus.StatusCode); status == opensearchservice.InboundConnectionStatusCodeDeleted {
+				log.Printf("[INFO] Skipping OpenSearch Outbound Connection %s: %s", id, status)
+				continue
+			}
+
+			r := ResourceOutboundConnection()
+			d := r.Data(nil)
+			d.SetId(id)
+
+			sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
+		}
+
+		return !lastPage
+	})
+
+	if awsv1.SkipSweepError(err) {
+		log.Printf("[WARN] Skipping OpenSearch Outbound Connection sweep for %s: %s", region, err)
+		return nil
+	}
+
+	if err != nil {
+		return fmt.Errorf("error listing OpenSearch Outbound Connections: %w", err)
+	}
+
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
+
+	if err != nil {
+		return fmt.Errorf("error sweeping OpenSearch Outbound Connections (%s): %w", region, err)
+	}
+
+	return nil
+}
diff --git a/internal/service/opensearch/tags_gen.go b/internal/service/opensearch/tags_gen.go
index 0a06050c909..108032ec451 100644
--- a/internal/service/opensearch/tags_gen.go
+++ b/internal/service/opensearch/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/opensearchservice"
 	"github.com/aws/aws-sdk-go/service/opensearchservice/opensearchserviceiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -102,6 +104,8 @@ func updateTags(ctx context.Context, conn opensearchserviceiface.OpenSearchServi
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.OpenSearch)
 	if len(removedTags) > 0 {
diff --git a/internal/service/opensearch/test-fixtures/example-opensearch-custom-package.txt b/internal/service/opensearch/test-fixtures/example-opensearch-custom-package.txt
new file mode 100644
index 00000000000..8249df1efa4
--- /dev/null
+++ b/internal/service/opensearch/test-fixtures/example-opensearch-custom-package.txt
@@ -0,0 +1,4 @@
+danish, croissant, pastry
+ice cream, gelato, frozen custard
+sneaker, tennis shoe, running shoe
+basketball shoe, hightop
diff --git a/internal/service/opensearch/vpc_endpoint.go b/internal/service/opensearch/vpc_endpoint.go
new file mode 100644
index 00000000000..f0a41ba7d8b
--- /dev/null
+++ b/internal/service/opensearch/vpc_endpoint.go
@@ -0,0 +1,331 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package opensearch
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"log"
+	"time"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/opensearchservice"
+	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/internal/verify"
+)
+
+// @SDKResource("aws_opensearch_vpc_endpoint")
+func ResourceVPCEndpoint() *schema.Resource {
+	return &schema.Resource{
+		CreateWithoutTimeout: resourceVPCEndpointCreate,
+		ReadWithoutTimeout:   resourceVPCEndpointRead,
+		UpdateWithoutTimeout: resourceVPCEndpointUpdate,
+		DeleteWithoutTimeout: resourceVPCEndpointDelete,
+
+		Importer: &schema.ResourceImporter{
+			StateContext: schema.ImportStatePassthroughContext,
+		},
+
+		Timeouts: &schema.ResourceTimeout{
+			Create: schema.DefaultTimeout(60 * time.Minute),
+			Update: schema.DefaultTimeout(60 * time.Minute),
+			Delete: schema.DefaultTimeout(90 * time.Minute),
+		},
+
+		Schema: map[string]*schema.Schema{
+			"domain_arn": {
+				Type:         schema.TypeString,
+				Required:     true,
+				ForceNew:     true,
+				ValidateFunc: verify.ValidARN,
+			},
+			"endpoint": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"vpc_options": {
+				Type:     schema.TypeList,
+				Required: true,
+				MaxItems: 1,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"availability_zones": {
+							Type:     schema.TypeSet,
+							Computed: true,
+							Elem:     &schema.Schema{Type: schema.TypeString},
+						},
+						"security_group_ids": {
+							Type:     schema.TypeSet,
+							Optional: true,
+							Computed: true,
+							Elem:     &schema.Schema{Type: schema.TypeString},
+						},
+						"subnet_ids": {
+							Type:     schema.TypeSet,
+							Required: true,
+							Elem:     &schema.Schema{Type: schema.TypeString},
+						},
+						"vpc_id": {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+					},
+				},
+			},
+		},
+	}
+}
+
+func resourceVPCEndpointCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).OpenSearchConn(ctx)
+
+	input := &opensearchservice.CreateVpcEndpointInput{
+		DomainArn:  aws.String(d.Get("domain_arn").(string)),
+		VpcOptions: expandVPCOptions(d.Get("vpc_options").([]interface{})[0].(map[string]interface{})),
+	}
+
+	output, err := conn.CreateVpcEndpointWithContext(ctx, input)
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "creating OpenSearch VPC Endpoint: %s", err)
+	}
+
+	d.SetId(aws.StringValue(output.VpcEndpoint.VpcEndpointId))
+
+	if err := waitVPCEndpointCreated(ctx, conn, d.Id(), d.Timeout(schema.TimeoutCreate)); err != nil {
+		return sdkdiag.AppendErrorf(diags, "waiting for OpenSearch VPC Endpoint (%s) create: %s", d.Id(), err)
+	}
+
+	return append(diags, resourceVPCEndpointRead(ctx, d, meta)...)
+}
+
+func resourceVPCEndpointRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).OpenSearchConn(ctx)
+
+	endpoint, err := findVPCEndpointByID(ctx, conn, d.Id())
+
+	if !d.IsNewResource() && tfresource.NotFound(err) {
+		log.Printf("[WARN] OpenSearch VPC Endpoint (%s) not found, removing from state", d.Id())
+		d.SetId("")
+		return diags
+	}
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "reading OpenSearch VPC Endpoint (%s): %s", d.Id(), err)
+	}
+
+	d.Set("domain_arn", endpoint.DomainArn)
+	d.Set("endpoint", endpoint.Endpoint)
+	if endpoint.VpcOptions != nil {
+		if err := d.Set("vpc_options", []interface{}{flattenVPCDerivedInfo(endpoint.VpcOptions)}); err != nil {
+			return diag.Errorf("setting vpc_options: %s", err)
+		}
+	} else {
+		d.Set("vpc_options", nil)
+	}
+
+	return diags
+}
+
+func resourceVPCEndpointUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).OpenSearchConn(ctx)
+
+	input := &opensearchservice.UpdateVpcEndpointInput{
+		VpcOptions:    expandVPCOptions(d.Get("vpc_options").([]interface{})[0].(map[string]interface{})),
+		VpcEndpointId: aws.String(d.Id()),
+	}
+
+	_, err := conn.UpdateVpcEndpointWithContext(ctx, input)
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "updating OpenSearch VPC Endpoint (%s): %s", d.Id(), err)
+	}
+
+	if err := waitVPCEndpointUpdated(ctx, conn, d.Id(), d.Timeout(schema.TimeoutUpdate)); err != nil {
+		return sdkdiag.AppendErrorf(diags, "waiting for OpenSearch VPC Endpoint (%s) update: %s", d.Id(), err)
+	}
+
+	return append(diags, resourceVPCEndpointRead(ctx, d, meta)...)
+}
+
+func resourceVPCEndpointDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).OpenSearchConn(ctx)
+
+	log.Printf("[DEBUG] Deleting OpenSearch VPC Endpoint: %s", d.Id())
+	_, err := conn.DeleteVpcEndpointWithContext(ctx, &opensearchservice.DeleteVpcEndpointInput{
+		VpcEndpointId: aws.String(d.Id()),
+	})
+
+	if tfawserr.ErrCodeEquals(err, opensearchservice.ErrCodeResourceNotFoundException) {
+		return diags
+	}
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "deleting OpenSearch VPC Endpoint (%s): %s", d.Id(), err)
+	}
+
+	if err := waitVPCEndpointDeleted(ctx, conn, d.Id(), d.Timeout(schema.TimeoutDelete)); err != nil {
+		return sdkdiag.AppendErrorf(diags, "waiting for OpenSearch VPC Endpoint (%s) delete: %s", d.Id(), err)
+	}
+
+	return diags
+}
+
+type vpcEndpointNotFoundError struct {
+	apiError error
+}
+
+func (e *vpcEndpointNotFoundError) Error() string {
+	if e.apiError != nil {
+		return e.apiError.Error()
+	}
+
+	return "VPC endpoint not found"
+}
+
+func (e *vpcEndpointNotFoundError) Is(err error) bool {
+	_, ok := err.(*vpcEndpointNotFoundError)
+	return ok
+}
+
+func (e *vpcEndpointNotFoundError) As(target any) bool {
+	t, ok := target.(**retry.NotFoundError)
+	if !ok {
+		return false
+	}
+
+	*t = &retry.NotFoundError{
+		Message: e.Error(),
+	}
+
+	return true
+}
+
+func vpcEndpointError(apiObject *opensearchservice.VpcEndpointError) error {
+	if apiObject == nil {
+		return nil
+	}
+
+	errorCode := aws.StringValue(apiObject.ErrorCode)
+	innerError := fmt.Errorf("%s: %s", errorCode, aws.StringValue(apiObject.ErrorMessage))
+	err := fmt.Errorf("%s: %w", aws.StringValue(apiObject.VpcEndpointId), innerError)
+
+	if errorCode == opensearchservice.VpcEndpointErrorCodeEndpointNotFound {
+		err = &vpcEndpointNotFoundError{apiError: err}
+	}
+
+	return err
+}
+
+func vpcEndpointsError(apiObjects []*opensearchservice.VpcEndpointError) error {
+	var errs []error
+
+	for _, apiObject := range apiObjects {
+		errs = append(errs, vpcEndpointError(apiObject))
+	}
+
+	return errors.Join(errs...)
+}
+
+func findVPCEndpointByID(ctx context.Context, conn *opensearchservice.OpenSearchService, id string) (*opensearchservice.VpcEndpoint, error) {
+	input := &opensearchservice.DescribeVpcEndpointsInput{
+		VpcEndpointIds: aws.StringSlice([]string{id}),
+	}
+
+	return findVPCEndpoint(ctx, conn, input)
+}
+
+func findVPCEndpoint(ctx context.Context, conn *opensearchservice.OpenSearchService, input *opensearchservice.DescribeVpcEndpointsInput) (*opensearchservice.VpcEndpoint, error) {
+	output, err := findVPCEndpoints(ctx, conn, input)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return tfresource.AssertSinglePtrResult(output)
+}
+
+func findVPCEndpoints(ctx context.Context, conn *opensearchservice.OpenSearchService, input *opensearchservice.DescribeVpcEndpointsInput) ([]*opensearchservice.VpcEndpoint, error) {
+	output, err := conn.DescribeVpcEndpointsWithContext(ctx, input)
+
+	if err != nil {
+		return nil, err
+	}
+
+	if output == nil {
+		return nil, tfresource.NewEmptyResultError(input)
+	}
+
+	if errs := output.VpcEndpointErrors; len(errs) > 0 {
+		return nil, vpcEndpointsError(errs)
+	}
+
+	return output.VpcEndpoints, nil
+}
+
+func statusVPCEndpoint(ctx context.Context, conn *opensearchservice.OpenSearchService, id string) retry.StateRefreshFunc {
+	return func() (interface{}, string, error) {
+		output, err := findVPCEndpointByID(ctx, conn, id)
+
+		if tfresource.NotFound(err) {
+			return nil, "", nil
+		}
+
+		if err != nil {
+			return nil, "", err
+		}
+
+		return output, aws.StringValue(output.Status), nil
+	}
+}
+
+func waitVPCEndpointCreated(ctx context.Context, conn *opensearchservice.OpenSearchService, id string, timeout time.Duration) error {
+	stateConf := &retry.StateChangeConf{
+		Pending: []string{opensearchservice.VpcEndpointStatusCreating},
+		Target:  []string{opensearchservice.VpcEndpointStatusActive},
+		Refresh: statusVPCEndpoint(ctx, conn, id),
+		Timeout: timeout,
+	}
+
+	_, err := stateConf.WaitForStateContext(ctx)
+
+	return err
+}
+
+func waitVPCEndpointUpdated(ctx context.Context, conn *opensearchservice.OpenSearchService, id string, timeout time.Duration) error {
+	stateConf := &retry.StateChangeConf{
+		Pending: []string{opensearchservice.VpcEndpointStatusUpdating},
+		Target:  []string{opensearchservice.VpcEndpointStatusActive},
+		Refresh: statusVPCEndpoint(ctx, conn, id),
+		Timeout: timeout,
+	}
+
+	_, err := stateConf.WaitForStateContext(ctx)
+
+	return err
+}
+
+func waitVPCEndpointDeleted(ctx context.Context, conn *opensearchservice.OpenSearchService, id string, timeout time.Duration) error {
+	stateConf := &retry.StateChangeConf{
+		Pending: []string{opensearchservice.VpcEndpointStatusDeleting},
+		Target:  []string{},
+		Refresh: statusVPCEndpoint(ctx, conn, id),
+		Timeout: timeout,
+	}
+
+	_, err := stateConf.WaitForStateContext(ctx)
+
+	return err
+}
diff --git a/internal/service/opensearch/vpc_endpoint_test.go b/internal/service/opensearch/vpc_endpoint_test.go
new file mode 100644
index 00000000000..427037d1fc5
--- /dev/null
+++ b/internal/service/opensearch/vpc_endpoint_test.go
@@ -0,0 +1,348 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package opensearch_test
+
+import (
+	"context"
+	"fmt"
+	"testing"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/opensearchservice"
+	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
+	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	tfopensearch "github.com/hashicorp/terraform-provider-aws/internal/service/opensearch"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+)
+
+func TestVPCEndpointErrorsNotFound(t *testing.T) {
+	t.Parallel()
+
+	testCases := []struct {
+		name       string
+		apiObjects []*opensearchservice.VpcEndpointError
+		notFound   bool
+	}{
+		{
+			name: "nil input",
+		},
+		{
+			name:       "slice of nil input",
+			apiObjects: []*opensearchservice.VpcEndpointError{nil, nil},
+		},
+		{
+			name: "single SERVER_ERROR",
+			apiObjects: []*opensearchservice.VpcEndpointError{{
+				ErrorCode:     aws.String(opensearchservice.VpcEndpointErrorCodeServerError),
+				ErrorMessage:  aws.String("fail"),
+				VpcEndpointId: aws.String("aos-12345678"),
+			}},
+		},
+		{
+			name: "single ENDPOINT_NOT_FOUND",
+			apiObjects: []*opensearchservice.VpcEndpointError{{
+				ErrorCode:     aws.String(opensearchservice.VpcEndpointErrorCodeEndpointNotFound),
+				ErrorMessage:  aws.String("Endpoint does not exist"),
+				VpcEndpointId: aws.String("aos-12345678"),
+			}},
+			notFound: true,
+		},
+		{
+			name: "no ENDPOINT_NOT_FOUND in many",
+			apiObjects: []*opensearchservice.VpcEndpointError{
+				{
+					ErrorCode:     aws.String(opensearchservice.VpcEndpointErrorCodeServerError),
+					ErrorMessage:  aws.String("fail"),
+					VpcEndpointId: aws.String("aos-abcd0123"),
+				},
+				{
+					ErrorCode:     aws.String(opensearchservice.VpcEndpointErrorCodeServerError),
+					ErrorMessage:  aws.String("crash"),
+					VpcEndpointId: aws.String("aos-12345678"),
+				},
+			},
+		},
+		{
+			name: "single ENDPOINT_NOT_FOUND in many",
+			apiObjects: []*opensearchservice.VpcEndpointError{
+				{
+					ErrorCode:     aws.String(opensearchservice.VpcEndpointErrorCodeServerError),
+					ErrorMessage:  aws.String("fail"),
+					VpcEndpointId: aws.String("aos-abcd0123"),
+				},
+				{
+					ErrorCode:     aws.String(opensearchservice.VpcEndpointErrorCodeEndpointNotFound),
+					ErrorMessage:  aws.String("Endpoint does not exist"),
+					VpcEndpointId: aws.String("aos-12345678"),
+				},
+			},
+			notFound: true,
+		},
+	}
+
+	for _, testCase := range testCases {
+		testCase := testCase
+		t.Run(testCase.name, func(t *testing.T) {
+			t.Parallel()
+
+			if got, want := tfresource.NotFound(tfopensearch.VPCEndpointsError(testCase.apiObjects)), testCase.notFound; got != want {
+				t.Errorf("NotFound = %v, want %v", got, want)
+			}
+		})
+	}
+}
+
+func TestAccOpenSearchVPCEndpoint_basic(t *testing.T) {
+	ctx := acctest.Context(t)
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
+	var v opensearchservice.VpcEndpoint
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	domainName := testAccRandomDomainName()
+	resourceName := "aws_opensearch_vpc_endpoint.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, opensearchservice.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckVPCEndpointDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccVPCEndpointConfig_basic(rName, domainName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckVPCEndpointExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttrSet(resourceName, "endpoint"),
+					resource.TestCheckResourceAttr(resourceName, "vpc_options.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "vpc_options.0.availability_zones.#", "2"),
+					resource.TestCheckResourceAttr(resourceName, "vpc_options.0.security_group_ids.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "vpc_options.0.subnet_ids.#", "2"),
+					resource.TestCheckResourceAttrSet(resourceName, "vpc_options.0.vpc_id"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
+func TestAccOpenSearchVPCEndpoint_disappears(t *testing.T) {
+	ctx := acctest.Context(t)
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
+	var v opensearchservice.VpcEndpoint
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	domainName := testAccRandomDomainName()
+	resourceName := "aws_opensearch_vpc_endpoint.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, opensearchservice.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckVPCEndpointDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccVPCEndpointConfig_basic(rName, domainName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckVPCEndpointExists(ctx, resourceName, &v),
+					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfopensearch.ResourceVPCEndpoint(), resourceName),
+				),
+				ExpectNonEmptyPlan: true,
+			},
+		},
+	})
+}
+
+func TestAccOpenSearchVPCEndpoint_update(t *testing.T) {
+	ctx := acctest.Context(t)
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
+	var v opensearchservice.VpcEndpoint
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	domainName := testAccRandomDomainName()
+	resourceName := "aws_opensearch_vpc_endpoint.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, opensearchservice.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckVPCEndpointDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccVPCEndpointConfig_basic(rName, domainName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckVPCEndpointExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttrSet(resourceName, "endpoint"),
+					resource.TestCheckResourceAttr(resourceName, "vpc_options.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "vpc_options.0.availability_zones.#", "2"),
+					resource.TestCheckResourceAttr(resourceName, "vpc_options.0.security_group_ids.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "vpc_options.0.subnet_ids.#", "2"),
+					resource.TestCheckResourceAttrSet(resourceName, "vpc_options.0.vpc_id"),
+				),
+			},
+			{
+				Config: testAccVPCEndpointConfig_updated(rName, domainName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckVPCEndpointExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttrSet(resourceName, "endpoint"),
+					resource.TestCheckResourceAttr(resourceName, "vpc_options.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "vpc_options.0.availability_zones.#", "2"),
+					resource.TestCheckResourceAttr(resourceName, "vpc_options.0.security_group_ids.#", "2"),
+					resource.TestCheckResourceAttr(resourceName, "vpc_options.0.subnet_ids.#", "2"),
+					resource.TestCheckResourceAttrSet(resourceName, "vpc_options.0.vpc_id"),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckVPCEndpointExists(ctx context.Context, n string, v *opensearchservice.VpcEndpoint) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		conn := acctest.Provider.Meta().(*conns.AWSClient).OpenSearchConn(ctx)
+
+		output, err := tfopensearch.FindVPCEndpointByID(ctx, conn, rs.Primary.ID)
+
+		if err != nil {
+			return err
+		}
+
+		*v = *output
+
+		return nil
+	}
+}
+
+func testAccCheckVPCEndpointDestroy(ctx context.Context) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		for _, rs := range s.RootModule().Resources {
+			if rs.Type != "aws_opensearch_vpc_endpoint" {
+				continue
+			}
+
+			conn := acctest.Provider.Meta().(*conns.AWSClient).OpenSearchConn(ctx)
+
+			_, err := tfopensearch.FindVPCEndpointByID(ctx, conn, rs.Primary.ID)
+
+			if tfresource.NotFound(err) {
+				continue
+			}
+
+			if err != nil {
+				return err
+			}
+
+			return fmt.Errorf("OpenSearch VPC Endpoint %s still exists", rs.Primary.ID)
+		}
+
+		return nil
+	}
+}
+
+func testAccVPCEndpointConfig_base(rName, domainName string) string {
+	return acctest.ConfigCompose(acctest.ConfigVPCWithSubnets(rName, 2), fmt.Sprintf(`
+resource "aws_security_group" "test" {
+  name   = %[1]q
+  vpc_id = aws_vpc.test.id
+
+  tags = {
+    Name = %[1]q
+  }
+}
+
+resource "aws_opensearch_domain" "test" {
+  domain_name = %[2]q
+
+  ebs_options {
+    ebs_enabled = true
+    volume_size = 10
+  }
+
+  cluster_config {
+    instance_count         = 2
+    zone_awareness_enabled = true
+    instance_type          = "t2.small.search"
+  }
+
+  vpc_options {
+    security_group_ids = [aws_security_group.test.id]
+    subnet_ids         = aws_subnet.test[*].id
+  }
+}
+
+resource "aws_vpc" "client" {
+  cidr_block = "10.0.0.0/16"
+
+  enable_dns_support   = true
+  enable_dns_hostnames = true
+
+  tags = {
+    Name = %[1]q
+  }
+}
+
+resource "aws_subnet" "client" {
+  count = 2
+
+  vpc_id            = aws_vpc.client.id
+  availability_zone = data.aws_availability_zones.available.names[count.index]
+  cidr_block        = cidrsubnet(aws_vpc.client.cidr_block, 8, count.index)
+
+  tags = {
+    Name = %[1]q
+  }
+}
+
+resource "aws_security_group" "client" {
+  count = 2
+
+  name   = "%[1]s-client-${count.index}"
+  vpc_id = aws_vpc.client.id
+
+  tags = {
+    Name = %[1]q
+  }
+}
+`, rName, domainName))
+}
+
+func testAccVPCEndpointConfig_basic(rName, domainName string) string {
+	return acctest.ConfigCompose(testAccVPCEndpointConfig_base(rName, domainName), `
+resource "aws_opensearch_vpc_endpoint" "test" {
+  domain_arn = aws_opensearch_domain.test.arn
+
+  vpc_options {
+    subnet_ids = aws_subnet.client[*].id
+  }
+}
+`)
+}
+
+func testAccVPCEndpointConfig_updated(rName, domainName string) string {
+	return acctest.ConfigCompose(testAccVPCEndpointConfig_base(rName, domainName), `
+resource "aws_opensearch_vpc_endpoint" "test" {
+  domain_arn = aws_opensearch_domain.test.arn
+
+  vpc_options {
+    subnet_ids         = aws_subnet.client[*].id
+    security_group_ids = aws_security_group.client[*].id
+  }
+}
+`)
+}
diff --git a/internal/service/opensearch/wait.go b/internal/service/opensearch/wait.go
index eee7404745c..22ed54fe460 100644
--- a/internal/service/opensearch/wait.go
+++ b/internal/service/opensearch/wait.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package opensearch
 
 import (
@@ -83,7 +86,7 @@ func waitForDomainUpdate(ctx context.Context, conn *opensearchservice.OpenSearch
 
 		return retry.RetryableError(
 			fmt.Errorf("%q: Timeout while waiting for changes to be processed", domainName))
-	}, tfresource.WithDelay(10*time.Minute), tfresource.WithPollInterval(10*time.Second))
+	}, tfresource.WithDelay(1*time.Minute), tfresource.WithPollInterval(10*time.Second))
 
 	if tfresource.TimedOut(err) {
 		out, err = FindDomainByName(ctx, conn, domainName)
diff --git a/internal/service/opensearchserverless/access_policy.go b/internal/service/opensearchserverless/access_policy.go
index bab7267f380..14f37c7e28f 100644
--- a/internal/service/opensearchserverless/access_policy.go
+++ b/internal/service/opensearchserverless/access_policy.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package opensearchserverless
 
 import (
@@ -21,8 +24,8 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/create"
 	"github.com/hashicorp/terraform-provider-aws/internal/enum"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/fwdiag"
-	"github.com/hashicorp/terraform-provider-aws/internal/flex"
 	"github.com/hashicorp/terraform-provider-aws/internal/framework"
+	"github.com/hashicorp/terraform-provider-aws/internal/framework/flex"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -139,7 +142,7 @@ func (r *resourceAccessPolicy) Read(ctx context.Context, req resource.ReadReques
 		return
 	}
 
-	out, err := FindAccessPolicyByNameAndType(ctx, conn, state.ID.ValueString(), state.Type.ValueString())
+	out, err := findAccessPolicyByNameAndType(ctx, conn, state.ID.ValueString(), state.Type.ValueString())
 	if tfresource.NotFound(err) {
 		resp.Diagnostics.Append(fwdiag.NewResourceNotFoundWarningDiagnostic(err))
 		resp.State.RemoveResource(ctx)
diff --git a/internal/service/opensearchserverless/access_policy_data_source.go b/internal/service/opensearchserverless/access_policy_data_source.go
new file mode 100644
index 00000000000..4f52b03fa10
--- /dev/null
+++ b/internal/service/opensearchserverless/access_policy_data_source.go
@@ -0,0 +1,113 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package opensearchserverless
+
+import (
+	"context"
+
+	awstypes "github.com/aws/aws-sdk-go-v2/service/opensearchserverless/types"
+	"github.com/hashicorp/terraform-plugin-framework-validators/stringvalidator"
+	"github.com/hashicorp/terraform-plugin-framework/datasource"
+	"github.com/hashicorp/terraform-plugin-framework/datasource/schema"
+	"github.com/hashicorp/terraform-plugin-framework/schema/validator"
+	"github.com/hashicorp/terraform-plugin-framework/types"
+	"github.com/hashicorp/terraform-provider-aws/internal/create"
+	"github.com/hashicorp/terraform-provider-aws/internal/enum"
+	"github.com/hashicorp/terraform-provider-aws/internal/framework"
+	"github.com/hashicorp/terraform-provider-aws/internal/framework/flex"
+	"github.com/hashicorp/terraform-provider-aws/names"
+)
+
+// @FrameworkDataSource(name="Access Policy")
+func newDataSourceAccessPolicy(context.Context) (datasource.DataSourceWithConfigure, error) {
+	return &dataSourceAccessPolicy{}, nil
+}
+
+const (
+	DSNameAccessPolicy = "Access Policy Data Source"
+)
+
+type dataSourceAccessPolicy struct {
+	framework.DataSourceWithConfigure
+}
+
+func (d *dataSourceAccessPolicy) Metadata(_ context.Context, req datasource.MetadataRequest, resp *datasource.MetadataResponse) { // nosemgrep:ci.meta-in-func-name
+	resp.TypeName = "aws_opensearchserverless_access_policy"
+}
+
+func (d *dataSourceAccessPolicy) Schema(_ context.Context, _ datasource.SchemaRequest, resp *datasource.SchemaResponse) {
+	resp.Schema = schema.Schema{
+		Attributes: map[string]schema.Attribute{
+			"description": schema.StringAttribute{
+				Computed: true,
+			},
+			"id": framework.IDAttribute(),
+			"name": schema.StringAttribute{
+				Required: true,
+				Validators: []validator.String{
+					stringvalidator.LengthBetween(3, 32),
+				},
+			},
+			"policy": schema.StringAttribute{
+				Computed: true,
+			},
+			"policy_version": schema.StringAttribute{
+				Computed: true,
+			},
+			"type": schema.StringAttribute{
+				Required: true,
+				Validators: []validator.String{
+					enum.FrameworkValidate[awstypes.AccessPolicyType](),
+				},
+			},
+		},
+	}
+}
+func (d *dataSourceAccessPolicy) Read(ctx context.Context, req datasource.ReadRequest, resp *datasource.ReadResponse) {
+	conn := d.Meta().OpenSearchServerlessClient(ctx)
+
+	var data dataSourceAccessPolicyData
+	resp.Diagnostics.Append(req.Config.Get(ctx, &data)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	out, err := findAccessPolicyByNameAndType(ctx, conn, data.Name.ValueString(), data.Type.ValueString())
+	if err != nil {
+		resp.Diagnostics.AddError(
+			create.ProblemStandardMessage(names.OpenSearchServerless, create.ErrActionReading, DSNameAccessPolicy, data.Name.String(), err),
+			err.Error(),
+		)
+		return
+	}
+
+	data.ID = flex.StringToFramework(ctx, out.Name)
+	data.Description = flex.StringToFramework(ctx, out.Description)
+	data.Name = flex.StringToFramework(ctx, out.Name)
+	data.Type = flex.StringValueToFramework(ctx, out.Type)
+	data.PolicyVersion = flex.StringToFramework(ctx, out.PolicyVersion)
+
+	policyBytes, err := out.Policy.MarshalSmithyDocument()
+
+	if err != nil {
+		resp.Diagnostics.AddError(
+			create.ProblemStandardMessage(names.OpenSearchServerless, create.ErrActionReading, DSNameAccessPolicy, data.Name.String(), err),
+			err.Error(),
+		)
+	}
+
+	pb := string(policyBytes)
+	data.Policy = flex.StringToFramework(ctx, &pb)
+
+	resp.Diagnostics.Append(resp.State.Set(ctx, &data)...)
+}
+
+type dataSourceAccessPolicyData struct {
+	Description   types.String `tfsdk:"description"`
+	ID            types.String `tfsdk:"id"`
+	Name          types.String `tfsdk:"name"`
+	Policy        types.String `tfsdk:"policy"`
+	PolicyVersion types.String `tfsdk:"policy_version"`
+	Type          types.String `tfsdk:"type"`
+}
diff --git a/internal/service/opensearchserverless/access_policy_data_source_test.go b/internal/service/opensearchserverless/access_policy_data_source_test.go
new file mode 100644
index 00000000000..97c0df34186
--- /dev/null
+++ b/internal/service/opensearchserverless/access_policy_data_source_test.go
@@ -0,0 +1,87 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package opensearchserverless_test
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/aws/aws-sdk-go-v2/service/opensearchserverless/types"
+	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
+	"github.com/hashicorp/terraform-provider-aws/names"
+)
+
+func TestAccOpenSearchServerlessAccessPolicyDataSource_basic(t *testing.T) {
+	ctx := acctest.Context(t)
+
+	var accesspolicy types.AccessPolicyDetail
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	dataSourceName := "data.aws_opensearchserverless_access_policy.test"
+	resourceName := "aws_opensearchserverless_access_policy.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, names.OpenSearchServerlessEndpointID)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, names.OpenSearchServerlessEndpointID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckAccessPolicyDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccAccessPolicyDataSourceConfig_basic(rName, "data"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAccessPolicyExists(ctx, dataSourceName, &accesspolicy),
+					resource.TestCheckResourceAttrPair(dataSourceName, "name", resourceName, "name"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "description", resourceName, "description"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "policy", resourceName, "policy"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "policy_version", resourceName, "policy_version"),
+				),
+			},
+		},
+	})
+}
+
+func testAccAccessPolicyDataSourceConfig_basic(rName, policyType string) string {
+	return fmt.Sprintf(`
+data "aws_caller_identity" "current" {}
+data "aws_partition" "current" {}
+
+resource "aws_opensearchserverless_access_policy" "test" {
+  name        = %[1]q
+  type        = %[2]q
+  description = %[1]q
+  policy = jsonencode([
+    {
+      "Rules" : [
+        {
+          "ResourceType" : "index",
+          "Resource" : [
+            "index/books/*"
+          ],
+          "Permission" : [
+            "aoss:CreateIndex",
+            "aoss:ReadDocument",
+            "aoss:UpdateIndex",
+            "aoss:DeleteIndex",
+            "aoss:WriteDocument"
+          ]
+        }
+      ],
+      "Principal" : [
+        "arn:${data.aws_partition.current.partition}:iam::${data.aws_caller_identity.current.account_id}:user/admin"
+      ]
+    }
+  ])
+}
+
+data "aws_opensearchserverless_access_policy" "test" {
+  name = aws_opensearchserverless_access_policy.test.name
+  type = aws_opensearchserverless_access_policy.test.type
+}
+`, rName, policyType)
+}
diff --git a/internal/service/opensearchserverless/access_policy_test.go b/internal/service/opensearchserverless/access_policy_test.go
index 8ebab3ee413..a051f1688ca 100644
--- a/internal/service/opensearchserverless/access_policy_test.go
+++ b/internal/service/opensearchserverless/access_policy_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package opensearchserverless_test
 
 import (
diff --git a/internal/service/opensearchserverless/collection.go b/internal/service/opensearchserverless/collection.go
index f46433ff869..e661616cd74 100644
--- a/internal/service/opensearchserverless/collection.go
+++ b/internal/service/opensearchserverless/collection.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package opensearchserverless
 
 import (
 	"context"
 	"errors"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/opensearchserverless"
 	awstypes "github.com/aws/aws-sdk-go-v2/service/opensearchserverless/types"
@@ -23,8 +26,8 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/create"
 	"github.com/hashicorp/terraform-provider-aws/internal/enum"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/fwdiag"
-	"github.com/hashicorp/terraform-provider-aws/internal/flex"
 	"github.com/hashicorp/terraform-provider-aws/internal/framework"
+	"github.com/hashicorp/terraform-provider-aws/internal/framework/flex"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -103,7 +106,7 @@ func (r *resourceCollection) Schema(ctx context.Context, req resource.SchemaRequ
 				},
 				Validators: []validator.String{
 					stringvalidator.LengthBetween(3, 32),
-					stringvalidator.RegexMatches(regexp.MustCompile(`^[a-z][a-z0-9-]+$`),
+					stringvalidator.RegexMatches(regexache.MustCompile(`^[a-z][0-9a-z-]+$`),
 						`must start with any lower case letter and can can include any lower case letter, number, or "-"`),
 				},
 			},
@@ -198,13 +201,21 @@ func (r *resourceCollection) Read(ctx context.Context, req resource.ReadRequest,
 		return
 	}
 
-	out, err := FindCollectionByID(ctx, conn, state.ID.ValueString())
+	out, err := findCollectionByID(ctx, conn, state.ID.ValueString())
 	if tfresource.NotFound(err) {
 		resp.Diagnostics.Append(fwdiag.NewResourceNotFoundWarningDiagnostic(err))
 		resp.State.RemoveResource(ctx)
 		return
 	}
 
+	if err != nil {
+		resp.Diagnostics.AddError(
+			create.ProblemStandardMessage(names.OpenSearchServerless, create.ErrActionReading, ResNameCollection, state.ID.ValueString(), nil),
+			err.Error(),
+		)
+		return
+	}
+
 	state.ARN = flex.StringToFramework(ctx, out.Arn)
 	state.CollectionEndpoint = flex.StringToFramework(ctx, out.CollectionEndpoint)
 	state.DashboardEndpoint = flex.StringToFramework(ctx, out.DashboardEndpoint)
@@ -339,7 +350,7 @@ func waitCollectionDeleted(ctx context.Context, conn *opensearchserverless.Clien
 
 func statusCollection(ctx context.Context, conn *opensearchserverless.Client, id string) retry.StateRefreshFunc {
 	return func() (interface{}, string, error) {
-		output, err := FindCollectionByID(ctx, conn, id)
+		output, err := findCollectionByID(ctx, conn, id)
 
 		if tfresource.NotFound(err) {
 			return nil, "", nil
diff --git a/internal/service/opensearchserverless/collection_data_source.go b/internal/service/opensearchserverless/collection_data_source.go
new file mode 100644
index 00000000000..74c61741b8d
--- /dev/null
+++ b/internal/service/opensearchserverless/collection_data_source.go
@@ -0,0 +1,173 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package opensearchserverless
+
+import (
+	"context"
+	"time"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	awstypes "github.com/aws/aws-sdk-go-v2/service/opensearchserverless/types"
+	"github.com/hashicorp/terraform-plugin-framework-validators/stringvalidator"
+	"github.com/hashicorp/terraform-plugin-framework/datasource"
+	"github.com/hashicorp/terraform-plugin-framework/datasource/schema"
+	"github.com/hashicorp/terraform-plugin-framework/path"
+	"github.com/hashicorp/terraform-plugin-framework/schema/validator"
+	"github.com/hashicorp/terraform-plugin-framework/types"
+	"github.com/hashicorp/terraform-provider-aws/internal/create"
+	"github.com/hashicorp/terraform-provider-aws/internal/framework"
+	"github.com/hashicorp/terraform-provider-aws/internal/framework/flex"
+	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
+	"github.com/hashicorp/terraform-provider-aws/names"
+)
+
+// @FrameworkDataSource(name="Collection")
+func newDataSourceCollection(context.Context) (datasource.DataSourceWithConfigure, error) {
+	return &dataSourceCollection{}, nil
+}
+
+const (
+	DSNameCollection = "Collection Data Source"
+)
+
+type dataSourceCollection struct {
+	framework.DataSourceWithConfigure
+}
+
+func (d *dataSourceCollection) Metadata(_ context.Context, _ datasource.MetadataRequest, resp *datasource.MetadataResponse) { // nosemgrep:ci.meta-in-func-name
+	resp.TypeName = "aws_opensearchserverless_collection"
+}
+
+func (d *dataSourceCollection) Schema(_ context.Context, _ datasource.SchemaRequest, resp *datasource.SchemaResponse) {
+	resp.Schema = schema.Schema{
+		Attributes: map[string]schema.Attribute{
+			"arn": framework.ARNAttributeComputedOnly(),
+			"collection_endpoint": schema.StringAttribute{
+				Computed: true,
+			},
+			"created_date": schema.StringAttribute{
+				Computed: true,
+			},
+			"dashboard_endpoint": schema.StringAttribute{
+				Computed: true,
+			},
+			"description": schema.StringAttribute{
+				Computed: true,
+			},
+			"id": schema.StringAttribute{
+				Optional: true,
+				Computed: true,
+				Validators: []validator.String{
+					stringvalidator.ConflictsWith(
+						path.MatchRelative().AtParent().AtName("name"),
+					),
+					stringvalidator.ExactlyOneOf(
+						path.MatchRelative().AtParent().AtName("name"),
+					),
+				},
+			},
+			"kms_key_arn": schema.StringAttribute{
+				Computed: true,
+			},
+			"last_modified_date": schema.StringAttribute{
+				Computed: true,
+			},
+			"name": schema.StringAttribute{
+				Optional: true,
+				Computed: true,
+				Validators: []validator.String{
+					stringvalidator.ConflictsWith(
+						path.MatchRelative().AtParent().AtName("id"),
+					),
+				},
+			},
+			names.AttrTags: tftags.TagsAttributeComputedOnly(),
+			"type": schema.StringAttribute{
+				Computed: true,
+			},
+		},
+	}
+}
+func (d *dataSourceCollection) Read(ctx context.Context, req datasource.ReadRequest, resp *datasource.ReadResponse) {
+	conn := d.Meta().OpenSearchServerlessClient(ctx)
+
+	var data dataSourceCollectionData
+	resp.Diagnostics.Append(req.Config.Get(ctx, &data)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	var out *awstypes.CollectionDetail
+
+	if !data.ID.IsNull() && !data.ID.IsUnknown() {
+		output, err := findCollectionByID(ctx, conn, data.ID.ValueString())
+		if err != nil {
+			resp.Diagnostics.AddError(
+				create.ProblemStandardMessage(names.OpenSearchServerless, create.ErrActionReading, DSNameCollection, data.ID.String(), err),
+				err.Error(),
+			)
+			return
+		}
+
+		out = output
+	}
+
+	if !data.Name.IsNull() && !data.Name.IsUnknown() {
+		output, err := findCollectionByName(ctx, conn, data.Name.ValueString())
+		if err != nil {
+			resp.Diagnostics.AddError(
+				create.ProblemStandardMessage(names.OpenSearchServerless, create.ErrActionReading, DSNameCollection, data.ID.String(), err),
+				err.Error(),
+			)
+			return
+		}
+
+		out = output
+	}
+
+	data.ARN = flex.StringToFramework(ctx, out.Arn)
+	data.CollectionEndpoint = flex.StringToFramework(ctx, out.CollectionEndpoint)
+	data.DashboardEndpoint = flex.StringToFramework(ctx, out.DashboardEndpoint)
+	data.Description = flex.StringToFramework(ctx, out.Description)
+	data.ID = flex.StringToFramework(ctx, out.Id)
+	data.KmsKeyARN = flex.StringToFramework(ctx, out.KmsKeyArn)
+	data.Name = flex.StringToFramework(ctx, out.Name)
+	data.Type = flex.StringValueToFramework(ctx, out.Type)
+
+	createdDate := time.UnixMilli(aws.ToInt64(out.CreatedDate))
+	data.CreatedDate = flex.StringValueToFramework(ctx, createdDate.Format(time.RFC3339))
+
+	lastModifiedDate := time.UnixMilli(aws.ToInt64(out.LastModifiedDate))
+	data.LastModifiedDate = flex.StringValueToFramework(ctx, lastModifiedDate.Format(time.RFC3339))
+
+	ignoreTagsConfig := d.Meta().IgnoreTagsConfig
+	tags, err := listTags(ctx, conn, aws.ToString(out.Arn))
+
+	if err != nil {
+		resp.Diagnostics.AddError(
+			create.ProblemStandardMessage(names.OpenSearchServerless, create.ErrActionReading, DSNameCollection, data.ID.String(), err),
+			err.Error(),
+		)
+		return
+	}
+
+	tags = tags.IgnoreConfig(ignoreTagsConfig)
+	data.Tags = flex.FlattenFrameworkStringValueMapLegacy(ctx, tags.Map())
+
+	resp.Diagnostics.Append(resp.State.Set(ctx, &data)...)
+}
+
+type dataSourceCollectionData struct {
+	ARN                types.String `tfsdk:"arn"`
+	CollectionEndpoint types.String `tfsdk:"collection_endpoint"`
+	CreatedDate        types.String `tfsdk:"created_date"`
+	DashboardEndpoint  types.String `tfsdk:"dashboard_endpoint"`
+	Description        types.String `tfsdk:"description"`
+	ID                 types.String `tfsdk:"id"`
+	KmsKeyARN          types.String `tfsdk:"kms_key_arn"`
+	LastModifiedDate   types.String `tfsdk:"last_modified_date"`
+	Name               types.String `tfsdk:"name"`
+	Tags               types.Map    `tfsdk:"tags"`
+	Type               types.String `tfsdk:"type"`
+}
diff --git a/internal/service/opensearchserverless/collection_data_source_test.go b/internal/service/opensearchserverless/collection_data_source_test.go
new file mode 100644
index 00000000000..8635998e569
--- /dev/null
+++ b/internal/service/opensearchserverless/collection_data_source_test.go
@@ -0,0 +1,138 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package opensearchserverless_test
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/aws/aws-sdk-go-v2/service/opensearchserverless/types"
+	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
+	"github.com/hashicorp/terraform-provider-aws/names"
+)
+
+func TestAccOpenSearchServerlessCollectionDataSource_basic(t *testing.T) {
+	ctx := acctest.Context(t)
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
+	var collection types.CollectionDetail
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	dataSourceName := "data.aws_opensearchserverless_collection.test"
+	resourceName := "aws_opensearchserverless_collection.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, names.OpenSearchServerlessEndpointID)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, names.OpenSearchServerlessEndpointID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckCollectionDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccCollectionDataSourceConfig_basic(rName, "encryption"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckCollectionExists(ctx, dataSourceName, &collection),
+					resource.TestCheckResourceAttrPair(dataSourceName, "name", resourceName, "name"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "id", resourceName, "id"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "arn", resourceName, "arn"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "collection_endpoint", resourceName, "collection_endpoint"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "dashboard_endpoint", resourceName, "dashboard_endpoint"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "description", resourceName, "description"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "kms_key_arn", resourceName, "kms_key_arn"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "type", resourceName, "type"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccOpenSearchServerlessCollectionDataSource_name(t *testing.T) {
+	ctx := acctest.Context(t)
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
+	var collection types.CollectionDetail
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	dataSourceName := "data.aws_opensearchserverless_collection.test"
+	resourceName := "aws_opensearchserverless_collection.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, names.OpenSearchServerlessEndpointID)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, names.OpenSearchServerlessEndpointID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckCollectionDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccCollectionDataSourceConfig_name(rName, "encryption"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckCollectionExists(ctx, dataSourceName, &collection),
+					resource.TestCheckResourceAttrPair(dataSourceName, "name", resourceName, "name"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "id", resourceName, "id"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "arn", resourceName, "arn"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "collection_endpoint", resourceName, "collection_endpoint"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "dashboard_endpoint", resourceName, "dashboard_endpoint"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "description", resourceName, "description"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "kms_key_arn", resourceName, "kms_key_arn"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "type", resourceName, "type"),
+				),
+			},
+		},
+	})
+}
+
+func testAccCollectionDataSourceBaseConfig(rName, policyType string) string {
+	return fmt.Sprintf(`
+resource "aws_opensearchserverless_security_policy" "test" {
+  name = %[1]q
+  type = %[2]q
+  policy = jsonencode({
+    Rules = [
+      {
+        Resource = [
+          "collection/%[1]s"
+        ],
+        ResourceType = "collection"
+      }
+    ],
+    AWSOwnedKey = true
+  })
+}
+
+resource "aws_opensearchserverless_collection" "test" {
+  name       = %[1]q
+  depends_on = [aws_opensearchserverless_security_policy.test]
+}
+`, rName, policyType)
+}
+
+func testAccCollectionDataSourceConfig_basic(rName, policyType string) string {
+	return acctest.ConfigCompose(
+		testAccCollectionDataSourceBaseConfig(rName, policyType),
+		`
+data "aws_opensearchserverless_collection" "test" {
+  id = aws_opensearchserverless_collection.test.id
+}
+`)
+}
+
+func testAccCollectionDataSourceConfig_name(rName, policyType string) string {
+	return acctest.ConfigCompose(
+		testAccCollectionDataSourceBaseConfig(rName, policyType),
+		`
+data "aws_opensearchserverless_collection" "test" {
+  name = aws_opensearchserverless_collection.test.name
+}
+`)
+}
diff --git a/internal/service/opensearchserverless/collection_test.go b/internal/service/opensearchserverless/collection_test.go
index a81354c199e..6a43b4957ac 100644
--- a/internal/service/opensearchserverless/collection_test.go
+++ b/internal/service/opensearchserverless/collection_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package opensearchserverless_test
 
 import (
diff --git a/internal/service/opensearchserverless/const.go b/internal/service/opensearchserverless/const.go
index 39e0a350e46..37e4c45a83b 100644
--- a/internal/service/opensearchserverless/const.go
+++ b/internal/service/opensearchserverless/const.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package opensearchserverless
 
 const idSeparator = "/"
diff --git a/internal/service/opensearchserverless/exports_test.go b/internal/service/opensearchserverless/exports_test.go
index 47747b32ac0..05db312ae10 100644
--- a/internal/service/opensearchserverless/exports_test.go
+++ b/internal/service/opensearchserverless/exports_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package opensearchserverless
 
 // Exports for use in tests only.
@@ -7,4 +10,10 @@ var (
 	ResourceSecurityConfig = newResourceSecurityConfig
 	ResourceSecurityPolicy = newResourceSecurityPolicy
 	ResourceVPCEndpoint    = newResourceVPCEndpoint
+
+	FindAccessPolicyByNameAndType   = findAccessPolicyByNameAndType
+	FindCollectionByID              = findCollectionByID
+	FindSecurityConfigByID          = findSecurityConfigByID
+	FindSecurityPolicyByNameAndType = findSecurityPolicyByNameAndType
+	FindVPCEndpointByID             = findVPCEndpointByID
 )
diff --git a/internal/service/opensearchserverless/find.go b/internal/service/opensearchserverless/find.go
index b78cdf8f5b9..ff6fe112e4c 100644
--- a/internal/service/opensearchserverless/find.go
+++ b/internal/service/opensearchserverless/find.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package opensearchserverless
 
 import (
@@ -11,7 +14,7 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
-func FindAccessPolicyByNameAndType(ctx context.Context, conn *opensearchserverless.Client, id, policyType string) (*types.AccessPolicyDetail, error) {
+func findAccessPolicyByNameAndType(ctx context.Context, conn *opensearchserverless.Client, id, policyType string) (*types.AccessPolicyDetail, error) {
 	in := &opensearchserverless.GetAccessPolicyInput{
 		Name: aws.String(id),
 		Type: types.AccessPolicyType(policyType),
@@ -36,7 +39,7 @@ func FindAccessPolicyByNameAndType(ctx context.Context, conn *opensearchserverle
 	return out.AccessPolicyDetail, nil
 }
 
-func FindCollectionByID(ctx context.Context, conn *opensearchserverless.Client, id string) (*types.CollectionDetail, error) {
+func findCollectionByID(ctx context.Context, conn *opensearchserverless.Client, id string) (*types.CollectionDetail, error) {
 	in := &opensearchserverless.BatchGetCollectionInput{
 		Ids: []string{id},
 	}
@@ -60,7 +63,35 @@ func FindCollectionByID(ctx context.Context, conn *opensearchserverless.Client,
 	return &out.CollectionDetails[0], nil
 }
 
-func FindSecurityConfigByID(ctx context.Context, conn *opensearchserverless.Client, id string) (*types.SecurityConfigDetail, error) {
+func findCollectionByName(ctx context.Context, conn *opensearchserverless.Client, name string) (*types.CollectionDetail, error) {
+	in := &opensearchserverless.BatchGetCollectionInput{
+		Names: []string{name},
+	}
+	out, err := conn.BatchGetCollection(ctx, in)
+	if err != nil {
+		var nfe *types.ResourceNotFoundException
+		if errors.As(err, &nfe) {
+			return nil, &retry.NotFoundError{
+				LastError:   err,
+				LastRequest: in,
+			}
+		}
+
+		return nil, err
+	}
+
+	if out == nil || out.CollectionDetails == nil || len(out.CollectionDetails) == 0 {
+		return nil, tfresource.NewEmptyResultError(in)
+	}
+
+	if len(out.CollectionDetails) > 1 {
+		return nil, tfresource.NewTooManyResultsError(len(out.CollectionDetails), in)
+	}
+
+	return &out.CollectionDetails[0], nil
+}
+
+func findSecurityConfigByID(ctx context.Context, conn *opensearchserverless.Client, id string) (*types.SecurityConfigDetail, error) {
 	in := &opensearchserverless.GetSecurityConfigInput{
 		Id: aws.String(id),
 	}
@@ -84,7 +115,7 @@ func FindSecurityConfigByID(ctx context.Context, conn *opensearchserverless.Clie
 	return out.SecurityConfigDetail, nil
 }
 
-func FindSecurityPolicyByNameAndType(ctx context.Context, conn *opensearchserverless.Client, name, policyType string) (*types.SecurityPolicyDetail, error) {
+func findSecurityPolicyByNameAndType(ctx context.Context, conn *opensearchserverless.Client, name, policyType string) (*types.SecurityPolicyDetail, error) {
 	in := &opensearchserverless.GetSecurityPolicyInput{
 		Name: aws.String(name),
 		Type: types.SecurityPolicyType(policyType),
@@ -109,7 +140,7 @@ func FindSecurityPolicyByNameAndType(ctx context.Context, conn *opensearchserver
 	return out.SecurityPolicyDetail, nil
 }
 
-func FindVPCEndpointByID(ctx context.Context, conn *opensearchserverless.Client, id string) (*types.VpcEndpointDetail, error) {
+func findVPCEndpointByID(ctx context.Context, conn *opensearchserverless.Client, id string) (*types.VpcEndpointDetail, error) {
 	in := &opensearchserverless.BatchGetVpcEndpointInput{
 		Ids: []string{id},
 	}
diff --git a/internal/service/opensearchserverless/generate.go b/internal/service/opensearchserverless/generate.go
index ce50d95256a..d5b82af5b6e 100644
--- a/internal/service/opensearchserverless/generate.go
+++ b/internal/service/opensearchserverless/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -AWSSDKVersion=2 -ListTags -ServiceTagsSlice -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/opensearchserverless/security_config.go b/internal/service/opensearchserverless/security_config.go
index 335a7114ab3..a045aae4f8d 100644
--- a/internal/service/opensearchserverless/security_config.go
+++ b/internal/service/opensearchserverless/security_config.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package opensearchserverless
 
 import (
@@ -25,8 +28,8 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/create"
 	"github.com/hashicorp/terraform-provider-aws/internal/enum"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/fwdiag"
-	"github.com/hashicorp/terraform-provider-aws/internal/flex"
 	"github.com/hashicorp/terraform-provider-aws/internal/framework"
+	"github.com/hashicorp/terraform-provider-aws/internal/framework/flex"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -167,7 +170,7 @@ func (r *resourceSecurityConfig) Read(ctx context.Context, req resource.ReadRequ
 		return
 	}
 
-	out, err := FindSecurityConfigByID(ctx, conn, state.ID.ValueString())
+	out, err := findSecurityConfigByID(ctx, conn, state.ID.ValueString())
 	if tfresource.NotFound(err) {
 		resp.Diagnostics.Append(fwdiag.NewResourceNotFoundWarningDiagnostic(err))
 		resp.State.RemoveResource(ctx)
@@ -316,7 +319,7 @@ func expandSAMLOptions(ctx context.Context, object types.Object, diags *diag.Dia
 }
 
 func flattenSAMLOptions(ctx context.Context, so *awstypes.SamlConfigOptions) types.Object {
-	attributeTypes := framework.AttributeTypesMust[samlOptions](ctx)
+	attributeTypes := flex.AttributeTypesMust[samlOptions](ctx)
 
 	if so == nil {
 		return types.ObjectNull(attributeTypes)
diff --git a/internal/service/opensearchserverless/security_config_data_source.go b/internal/service/opensearchserverless/security_config_data_source.go
new file mode 100644
index 00000000000..b72a0667ed9
--- /dev/null
+++ b/internal/service/opensearchserverless/security_config_data_source.go
@@ -0,0 +1,124 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package opensearchserverless
+
+import (
+	"context"
+	"time"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/hashicorp/terraform-plugin-framework/datasource"
+	"github.com/hashicorp/terraform-plugin-framework/datasource/schema"
+	"github.com/hashicorp/terraform-plugin-framework/types"
+	"github.com/hashicorp/terraform-provider-aws/internal/create"
+	"github.com/hashicorp/terraform-provider-aws/internal/framework"
+	"github.com/hashicorp/terraform-provider-aws/internal/framework/flex"
+	"github.com/hashicorp/terraform-provider-aws/names"
+)
+
+// @FrameworkDataSource(name="Security Config")
+func newDataSourceSecurityConfig(context.Context) (datasource.DataSourceWithConfigure, error) {
+	return &dataSourceSecurityConfig{}, nil
+}
+
+const (
+	DSNameSecurityConfig = "Security Config Data Source"
+)
+
+type dataSourceSecurityConfig struct {
+	framework.DataSourceWithConfigure
+}
+
+func (d *dataSourceSecurityConfig) Metadata(_ context.Context, req datasource.MetadataRequest, resp *datasource.MetadataResponse) { // nosemgrep:ci.meta-in-func-name
+	resp.TypeName = "aws_opensearchserverless_security_config"
+}
+
+func (d *dataSourceSecurityConfig) Schema(ctx context.Context, req datasource.SchemaRequest, resp *datasource.SchemaResponse) {
+	resp.Schema = schema.Schema{
+		Attributes: map[string]schema.Attribute{
+			"config_version": schema.StringAttribute{
+				Computed: true,
+			},
+			"created_date": schema.StringAttribute{
+				Computed: true,
+			},
+			"description": schema.StringAttribute{
+				Computed: true,
+			},
+			"id": schema.StringAttribute{
+				Required: true,
+			},
+			"last_modified_date": schema.StringAttribute{
+				Computed: true,
+			},
+			"type": schema.StringAttribute{
+				Computed: true,
+			},
+		},
+		Blocks: map[string]schema.Block{
+			"saml_options": schema.SingleNestedBlock{
+				Attributes: map[string]schema.Attribute{
+					"group_attribute": schema.StringAttribute{
+						Computed: true,
+					},
+					"metadata": schema.StringAttribute{
+						Computed: true,
+					},
+					"session_timeout": schema.Int64Attribute{
+						Computed: true,
+					},
+					"user_attribute": schema.StringAttribute{
+						Computed: true,
+					},
+				},
+			},
+		},
+	}
+}
+
+func (d *dataSourceSecurityConfig) Read(ctx context.Context, req datasource.ReadRequest, resp *datasource.ReadResponse) {
+	conn := d.Meta().OpenSearchServerlessClient(ctx)
+
+	var data dataSourceSecurityConfigData
+	resp.Diagnostics.Append(req.Config.Get(ctx, &data)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	out, err := findSecurityConfigByID(ctx, conn, data.ID.ValueString())
+	if err != nil {
+		resp.Diagnostics.AddError(
+			create.ProblemStandardMessage(names.OpenSearchServerless, create.ErrActionReading, DSNameSecurityConfig, data.ID.String(), err),
+			err.Error(),
+		)
+		return
+	}
+
+	createdDate := time.UnixMilli(aws.ToInt64(out.CreatedDate))
+	data.CreatedDate = flex.StringValueToFramework(ctx, createdDate.Format(time.RFC3339))
+
+	data.ConfigVersion = flex.StringToFramework(ctx, out.ConfigVersion)
+	data.Description = flex.StringToFramework(ctx, out.Description)
+	data.ID = flex.StringToFramework(ctx, out.Id)
+
+	lastModifiedDate := time.UnixMilli(aws.ToInt64(out.LastModifiedDate))
+	data.LastModifiedDate = flex.StringValueToFramework(ctx, lastModifiedDate.Format(time.RFC3339))
+
+	data.Type = flex.StringValueToFramework(ctx, out.Type)
+
+	samlOptions := flattenSAMLOptions(ctx, out.SamlOptions)
+	data.SamlOptions = samlOptions
+
+	resp.Diagnostics.Append(resp.State.Set(ctx, &data)...)
+}
+
+type dataSourceSecurityConfigData struct {
+	ConfigVersion    types.String `tfsdk:"config_version"`
+	CreatedDate      types.String `tfsdk:"created_date"`
+	Description      types.String `tfsdk:"description"`
+	ID               types.String `tfsdk:"id"`
+	LastModifiedDate types.String `tfsdk:"last_modified_date"`
+	SamlOptions      types.Object `tfsdk:"saml_options"`
+	Type             types.String `tfsdk:"type"`
+}
diff --git a/internal/service/opensearchserverless/security_config_data_source_test.go b/internal/service/opensearchserverless/security_config_data_source_test.go
new file mode 100644
index 00000000000..db0699a766b
--- /dev/null
+++ b/internal/service/opensearchserverless/security_config_data_source_test.go
@@ -0,0 +1,68 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package opensearchserverless_test
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/aws/aws-sdk-go-v2/service/opensearchserverless/types"
+	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
+	"github.com/hashicorp/terraform-provider-aws/names"
+)
+
+func TestAccOpenSearchServerlessSecurityConfigDataSource_basic(t *testing.T) {
+	ctx := acctest.Context(t)
+
+	var securityconfig types.SecurityConfigDetail
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_opensearchserverless_security_config.test"
+	dataSourceName := "data.aws_opensearchserverless_security_config.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, names.OpenSearchServerlessEndpointID)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, names.OpenSearchServerlessEndpointID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckSecurityConfigDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccSecurityConfigDataSourceConfig_basic(rName, "description", "test-fixtures/idp-metadata.xml"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckSecurityConfigExists(ctx, dataSourceName, &securityconfig),
+					resource.TestCheckResourceAttrSet(dataSourceName, "created_date"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "config_version", resourceName, "config_version"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "description", resourceName, "description"),
+					resource.TestCheckResourceAttrSet(dataSourceName, "last_modified_date"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "type", resourceName, "type"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "saml_options.metadata", resourceName, "saml_options.metadata"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "saml_options.session_timeout", resourceName, "saml_options.session_timeout"),
+				),
+			},
+		},
+	})
+}
+
+func testAccSecurityConfigDataSourceConfig_basic(rName, description, samlOptions string) string {
+	return fmt.Sprintf(`
+resource "aws_opensearchserverless_security_config" "test" {
+  name        = %[1]q
+  description = %[2]q
+  type        = "saml"
+
+  saml_options {
+    metadata = file("%[3]s")
+  }
+}
+
+data "aws_opensearchserverless_security_config" "test" {
+  id = aws_opensearchserverless_security_config.test.id
+}
+`, rName, description, samlOptions)
+}
diff --git a/internal/service/opensearchserverless/security_config_test.go b/internal/service/opensearchserverless/security_config_test.go
index 3b588739cd8..4be7abc8b33 100644
--- a/internal/service/opensearchserverless/security_config_test.go
+++ b/internal/service/opensearchserverless/security_config_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package opensearchserverless_test
 
 import (
diff --git a/internal/service/opensearchserverless/security_policy.go b/internal/service/opensearchserverless/security_policy.go
index 37813f3283d..4b7479fd64f 100644
--- a/internal/service/opensearchserverless/security_policy.go
+++ b/internal/service/opensearchserverless/security_policy.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package opensearchserverless
 
 import (
@@ -21,8 +24,8 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/create"
 	"github.com/hashicorp/terraform-provider-aws/internal/enum"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/fwdiag"
-	"github.com/hashicorp/terraform-provider-aws/internal/flex"
 	"github.com/hashicorp/terraform-provider-aws/internal/framework"
+	"github.com/hashicorp/terraform-provider-aws/internal/framework/flex"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -139,7 +142,7 @@ func (r *resourceSecurityPolicy) Read(ctx context.Context, req resource.ReadRequ
 		return
 	}
 
-	out, err := FindSecurityPolicyByNameAndType(ctx, conn, state.ID.ValueString(), state.Type.ValueString())
+	out, err := findSecurityPolicyByNameAndType(ctx, conn, state.ID.ValueString(), state.Type.ValueString())
 	if tfresource.NotFound(err) {
 		resp.Diagnostics.Append(fwdiag.NewResourceNotFoundWarningDiagnostic(err))
 		resp.State.RemoveResource(ctx)
diff --git a/internal/service/opensearchserverless/security_policy_data_source.go b/internal/service/opensearchserverless/security_policy_data_source.go
new file mode 100644
index 00000000000..77eeda42d97
--- /dev/null
+++ b/internal/service/opensearchserverless/security_policy_data_source.go
@@ -0,0 +1,95 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package opensearchserverless
+
+import (
+	"context"
+	"time"
+
+	"github.com/YakDriver/regexache"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/opensearchserverless/types"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/enum"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
+)
+
+// @SDKDataSource("aws_opensearchserverless_security_policy")
+func DataSourceSecurityPolicy() *schema.Resource {
+	return &schema.Resource{
+		ReadWithoutTimeout: dataSourceSecurityPolicyRead,
+
+		Schema: map[string]*schema.Schema{
+			"created_date": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"description": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"last_modified_date": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"name": {
+				Type:     schema.TypeString,
+				Required: true,
+				ValidateFunc: validation.All(
+					validation.StringLenBetween(3, 32),
+					validation.StringMatch(regexache.MustCompile(`^[a-z][0-9a-z-]+$`), `must start with any lower case letter and can include any lower case letter, number, or "-"`),
+				),
+			},
+			"policy": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"policy_version": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"type": {
+				Type:             schema.TypeString,
+				Required:         true,
+				ValidateDiagFunc: enum.Validate[types.SecurityPolicyType](),
+			},
+		},
+	}
+}
+
+func dataSourceSecurityPolicyRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).OpenSearchServerlessClient(ctx)
+
+	securityPolicyName := d.Get("name").(string)
+	securityPolicyType := d.Get("type").(string)
+	securityPolicy, err := findSecurityPolicyByNameAndType(ctx, conn, securityPolicyName, securityPolicyType)
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "reading OpenSearch Security Policy with name (%s) and type (%s): %s", securityPolicyName, securityPolicyType, err)
+	}
+
+	policyBytes, err := securityPolicy.Policy.MarshalSmithyDocument()
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "reading JSON policy document for OpenSearch Security Policy with name %s and type %s: %s", securityPolicyName, securityPolicyType, err)
+	}
+
+	d.SetId(aws.ToString(securityPolicy.Name))
+	d.Set("description", securityPolicy.Description)
+	d.Set("name", securityPolicy.Name)
+	d.Set("policy", string(policyBytes))
+	d.Set("policy_version", securityPolicy.PolicyVersion)
+	d.Set("type", securityPolicy.Type)
+
+	createdDate := time.UnixMilli(aws.ToInt64(securityPolicy.CreatedDate))
+	d.Set("created_date", createdDate.Format(time.RFC3339))
+
+	lastModifiedDate := time.UnixMilli(aws.ToInt64(securityPolicy.LastModifiedDate))
+	d.Set("last_modified_date", lastModifiedDate.Format(time.RFC3339))
+
+	return diags
+}
diff --git a/internal/service/opensearchserverless/security_policy_data_source_test.go b/internal/service/opensearchserverless/security_policy_data_source_test.go
new file mode 100644
index 00000000000..46c0da657a8
--- /dev/null
+++ b/internal/service/opensearchserverless/security_policy_data_source_test.go
@@ -0,0 +1,72 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package opensearchserverless_test
+
+import (
+	"fmt"
+	"testing"
+
+	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
+	"github.com/hashicorp/terraform-provider-aws/names"
+)
+
+func TestAccOpenSearchServerlessSecurityPolicyDataSource_basic(t *testing.T) {
+	ctx := acctest.Context(t)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_opensearchserverless_security_policy.test"
+	dataSourceName := "data.aws_opensearchserverless_security_policy.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, names.OpenSearchServerlessEndpointID)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, names.OpenSearchServerlessEndpointID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckSecurityPolicyDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccSecurityPolicyDataSourceConfig_basic(rName),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttrPair(dataSourceName, "name", resourceName, "name"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "type", resourceName, "type"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "description", resourceName, "description"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "policy", resourceName, "policy"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "policy_version", resourceName, "policy_version"),
+					resource.TestCheckResourceAttrSet(dataSourceName, "created_date"),
+					resource.TestCheckResourceAttrSet(dataSourceName, "last_modified_date"),
+				),
+			},
+		},
+	})
+}
+
+func testAccSecurityPolicyDataSourceConfig_basic(rName string) string {
+	collection := fmt.Sprintf("collection/%s", rName)
+	return fmt.Sprintf(`
+resource "aws_opensearchserverless_security_policy" "test" {
+  name        = %[1]q
+  type        = "encryption"
+  description = %[1]q
+  policy = jsonencode({
+    "Rules" = [
+      {
+        "Resource" = [
+          %[2]q
+        ],
+        "ResourceType" = "collection"
+      }
+    ],
+    "AWSOwnedKey" = true
+  })
+}
+
+data "aws_opensearchserverless_security_policy" "test" {
+  name = aws_opensearchserverless_security_policy.test.name
+  type = "encryption"
+}
+`, rName, collection)
+}
diff --git a/internal/service/opensearchserverless/security_policy_test.go b/internal/service/opensearchserverless/security_policy_test.go
index 8c0db583059..ab0e792c081 100644
--- a/internal/service/opensearchserverless/security_policy_test.go
+++ b/internal/service/opensearchserverless/security_policy_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package opensearchserverless_test
 
 import (
diff --git a/internal/service/opensearchserverless/service_package_gen.go b/internal/service/opensearchserverless/service_package_gen.go
index 1a5aae00d61..657dd31619f 100644
--- a/internal/service/opensearchserverless/service_package_gen.go
+++ b/internal/service/opensearchserverless/service_package_gen.go
@@ -7,6 +7,7 @@ import (
 
 	aws_sdkv2 "github.com/aws/aws-sdk-go-v2/aws"
 	opensearchserverless_sdkv2 "github.com/aws/aws-sdk-go-v2/service/opensearchserverless"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -14,7 +15,20 @@ import (
 type servicePackage struct{}
 
 func (p *servicePackage) FrameworkDataSources(ctx context.Context) []*types.ServicePackageFrameworkDataSource {
-	return []*types.ServicePackageFrameworkDataSource{}
+	return []*types.ServicePackageFrameworkDataSource{
+		{
+			Factory: newDataSourceAccessPolicy,
+			Name:    "Access Policy",
+		},
+		{
+			Factory: newDataSourceCollection,
+			Name:    "Collection",
+		},
+		{
+			Factory: newDataSourceSecurityConfig,
+			Name:    "Security Config",
+		},
+	}
 }
 
 func (p *servicePackage) FrameworkResources(ctx context.Context) []*types.ServicePackageFrameworkResource {
@@ -42,7 +56,16 @@ func (p *servicePackage) FrameworkResources(ctx context.Context) []*types.Servic
 }
 
 func (p *servicePackage) SDKDataSources(ctx context.Context) []*types.ServicePackageSDKDataSource {
-	return []*types.ServicePackageSDKDataSource{}
+	return []*types.ServicePackageSDKDataSource{
+		{
+			Factory:  DataSourceSecurityPolicy,
+			TypeName: "aws_opensearchserverless_security_policy",
+		},
+		{
+			Factory:  DataSourceVPCEndpoint,
+			TypeName: "aws_opensearchserverless_vpc_endpoint",
+		},
+	}
 }
 
 func (p *servicePackage) SDKResources(ctx context.Context) []*types.ServicePackageSDKResource {
@@ -59,9 +82,11 @@ func (p *servicePackage) NewClient(ctx context.Context, config map[string]any) (
 
 	return opensearchserverless_sdkv2.NewFromConfig(cfg, func(o *opensearchserverless_sdkv2.Options) {
 		if endpoint := config["endpoint"].(string); endpoint != "" {
-			o.EndpointResolver = opensearchserverless_sdkv2.EndpointResolverFromURL(endpoint)
+			o.BaseEndpoint = aws_sdkv2.String(endpoint)
 		}
 	}), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/opensearchserverless/sweep.go b/internal/service/opensearchserverless/sweep.go
index bf34dd8f0c3..3f2a2275f38 100644
--- a/internal/service/opensearchserverless/sweep.go
+++ b/internal/service/opensearchserverless/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package opensearchserverless
 
@@ -10,13 +10,15 @@ import (
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/opensearchserverless"
 	"github.com/aws/aws-sdk-go-v2/service/opensearchserverless/types"
-	"github.com/hashicorp/go-multierror"
+	"github.com/hashicorp/aws-sdk-go-base/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv2"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep/framework"
+	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_opensearchserverless_access_policy", &resource.Sweeper{
 		Name: "aws_opensearchserverless_access_policy",
 		F:    sweepAccessPolicies,
@@ -41,24 +43,25 @@ func init() {
 
 func sweepAccessPolicies(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
-
+	if region == names.USWest1RegionID {
+		log.Printf("[WARN] Skipping OpenSearch Serverless Access Policy sweep for region: %s", region)
+		return nil
+	}
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
-
 	conn := client.OpenSearchServerlessClient(ctx)
-	sweepResources := make([]sweep.Sweepable, 0)
-	var errs *multierror.Error
 	input := &opensearchserverless.ListAccessPoliciesInput{
 		Type: types.AccessPolicyTypeData,
 	}
+	sweepResources := make([]sweep.Sweepable, 0)
 
 	pages := opensearchserverless.NewListAccessPoliciesPaginator(conn, input)
 
 	for pages.HasMorePages() {
 		page, err := pages.NextPage(ctx)
-		if sweep.SkipSweepError(err) {
+		if awsv2.SkipSweepError(err) || skipSweepErr(err) {
 			log.Printf("[WARN] Skipping OpenSearch Serverless Access Policies sweep for %s: %s", region, err)
 			return nil
 		}
@@ -78,35 +81,32 @@ func sweepAccessPolicies(region string) error {
 		}
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
-		errs = multierror.Append(errs, fmt.Errorf("error sweeping OpenSearch Serverless Access Policies for %s: %w", region, err))
-	}
-	if sweep.SkipSweepError(err) {
-		log.Printf("[WARN] Skipping OpenSearch Serverless Access Policies sweep for %s: %s", region, errs)
-		return nil
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
+		return fmt.Errorf("error sweeping OpenSearch Serverless Access Policies for %s: %w", region, err)
 	}
 
-	return errs.ErrorOrNil()
+	return nil
 }
 
 func sweepCollections(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
-
+	if region == names.USWest1RegionID {
+		log.Printf("[WARN] Skipping OpenSearch Serverless Collection sweep for region: %s", region)
+		return nil
+	}
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
-
 	conn := client.OpenSearchServerlessClient(ctx)
-	sweepResources := make([]sweep.Sweepable, 0)
-	var errs *multierror.Error
 	input := &opensearchserverless.ListCollectionsInput{}
+	sweepResources := make([]sweep.Sweepable, 0)
 
 	pages := opensearchserverless.NewListCollectionsPaginator(conn, input)
 
 	for pages.HasMorePages() {
 		page, err := pages.NextPage(ctx)
-		if sweep.SkipSweepError(err) {
+		if awsv2.SkipSweepError(err) || skipSweepErr(err) {
 			log.Printf("[WARN] Skipping OpenSearch Serverless Collections sweep for %s: %s", region, err)
 			return nil
 		}
@@ -124,37 +124,34 @@ func sweepCollections(region string) error {
 		}
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
-		errs = multierror.Append(errs, fmt.Errorf("error sweeping OpenSearch Serverless Collections for %s: %w", region, err))
-	}
-	if sweep.SkipSweepError(err) {
-		log.Printf("[WARN] Skipping OpenSearch Serverless Collections sweep for %s: %s", region, errs)
-		return nil
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
+		return fmt.Errorf("error sweeping OpenSearch Serverless Collections for %s: %w", region, err)
 	}
 
-	return errs.ErrorOrNil()
+	return nil
 }
 
 func sweepSecurityConfigs(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
-
+	if region == names.USWest1RegionID {
+		log.Printf("[WARN] Skipping OpenSearch Serverless Security Config sweep for region: %s", region)
+		return nil
+	}
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
-
 	conn := client.OpenSearchServerlessClient(ctx)
-	sweepResources := make([]sweep.Sweepable, 0)
-	var errs *multierror.Error
-
 	input := &opensearchserverless.ListSecurityConfigsInput{
 		Type: types.SecurityConfigTypeSaml,
 	}
+	sweepResources := make([]sweep.Sweepable, 0)
+
 	pages := opensearchserverless.NewListSecurityConfigsPaginator(conn, input)
 
 	for pages.HasMorePages() {
 		page, err := pages.NextPage(ctx)
-		if sweep.SkipSweepError(err) {
+		if awsv2.SkipSweepError(err) || skipSweepErr(err) {
 			log.Printf("[WARN] Skipping OpenSearch Serverless Security Configs sweep for %s: %s", region, err)
 			return nil
 		}
@@ -172,37 +169,34 @@ func sweepSecurityConfigs(region string) error {
 		}
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
-		errs = multierror.Append(errs, fmt.Errorf("error sweeping OpenSearch Serverless Security Configs for %s: %w", region, err))
-	}
-	if sweep.SkipSweepError(err) {
-		log.Printf("[WARN] Skipping OpenSearch Serverless Security Configs sweep for %s: %s", region, errs)
-		return nil
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
+		return fmt.Errorf("error sweeping OpenSearch Serverless Security Configs for %s: %w", region, err)
 	}
 
-	return errs.ErrorOrNil()
+	return nil
 }
 
 func sweepSecurityPolicies(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
-
+	if region == names.USWest1RegionID {
+		log.Printf("[WARN] Skipping OpenSearch Serverless Security Policy sweep for region: %s", region)
+		return nil
+	}
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
-
 	conn := client.OpenSearchServerlessClient(ctx)
-	sweepResources := make([]sweep.Sweepable, 0)
-	var errs *multierror.Error
-
 	inputEncryption := &opensearchserverless.ListSecurityPoliciesInput{
 		Type: types.SecurityPolicyTypeEncryption,
 	}
+	sweepResources := make([]sweep.Sweepable, 0)
+
 	pagesEncryption := opensearchserverless.NewListSecurityPoliciesPaginator(conn, inputEncryption)
 
 	for pagesEncryption.HasMorePages() {
 		page, err := pagesEncryption.NextPage(ctx)
-		if sweep.SkipSweepError(err) {
+		if awsv2.SkipSweepError(err) || skipSweepErr(err) {
 			log.Printf("[WARN] Skipping OpenSearch Serverless Security Policies sweep for %s: %s", region, err)
 			return nil
 		}
@@ -229,7 +223,7 @@ func sweepSecurityPolicies(region string) error {
 
 	for pagesNetwork.HasMorePages() {
 		page, err := pagesNetwork.NextPage(ctx)
-		if sweep.SkipSweepError(err) {
+		if awsv2.SkipSweepError(err) || skipSweepErr(err) {
 			log.Printf("[WARN] Skipping OpenSearch Serverless Security Policies sweep for %s: %s", region, err)
 			return nil
 		}
@@ -249,35 +243,32 @@ func sweepSecurityPolicies(region string) error {
 		}
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
-		errs = multierror.Append(errs, fmt.Errorf("error sweeping OpenSearch Serverless Security Policies for %s: %w", region, err))
-	}
-	if sweep.SkipSweepError(err) {
-		log.Printf("[WARN] Skipping OpenSearch Serverless Security Policies sweep for %s: %s", region, errs)
-		return nil
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
+		return fmt.Errorf("error sweeping OpenSearch Serverless Security Policies for %s: %w", region, err)
 	}
 
-	return errs.ErrorOrNil()
+	return nil
 }
 
 func sweepVPCEndpoints(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
-
+	if region == names.USWest1RegionID {
+		log.Printf("[WARN] Skipping OpenSearch Serverless Security Policy sweep for region: %s", region)
+		return nil
+	}
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
-
 	conn := client.OpenSearchServerlessClient(ctx)
-	sweepResources := make([]sweep.Sweepable, 0)
-	var errs *multierror.Error
 	input := &opensearchserverless.ListVpcEndpointsInput{}
+	sweepResources := make([]sweep.Sweepable, 0)
 
 	pages := opensearchserverless.NewListVpcEndpointsPaginator(conn, input)
 
 	for pages.HasMorePages() {
 		page, err := pages.NextPage(ctx)
-		if sweep.SkipSweepError(err) {
+		if awsv2.SkipSweepError(err) || skipSweepErr(err) {
 			log.Printf("[WARN] Skipping OpenSearch Serverless VPC Endpoints sweep for %s: %s", region, err)
 			return nil
 		}
@@ -295,13 +286,14 @@ func sweepVPCEndpoints(region string) error {
 		}
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
-		errs = multierror.Append(errs, fmt.Errorf("error sweeping OpenSearch Serverless VPC Endpoints for %s: %w", region, err))
-	}
-	if sweep.SkipSweepError(err) {
-		log.Printf("[WARN] Skipping OpenSearch Serverless VPC Endpoint sweep for %s: %s", region, errs)
-		return nil
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
+		return fmt.Errorf("error sweeping OpenSearch Serverless VPC Endpoints for %s: %w", region, err)
 	}
 
-	return errs.ErrorOrNil()
+	return nil
+}
+
+func skipSweepErr(err error) bool {
+	// OpenSearch Serverless returns this error when the service is not supported in the region
+	return tfawserr.ErrMessageContains(err, "AccessDeniedException", "UnknownError")
 }
diff --git a/internal/service/opensearchserverless/tags_gen.go b/internal/service/opensearchserverless/tags_gen.go
index de619f99ccd..b33fd7a77e5 100644
--- a/internal/service/opensearchserverless/tags_gen.go
+++ b/internal/service/opensearchserverless/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/opensearchserverless"
 	awstypes "github.com/aws/aws-sdk-go-v2/service/opensearchserverless/types"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -102,6 +104,8 @@ func updateTags(ctx context.Context, conn *opensearchserverless.Client, identifi
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.OpenSearchServerless)
 	if len(removedTags) > 0 {
diff --git a/internal/service/opensearchserverless/test-fixtures/idp-metadata.xml b/internal/service/opensearchserverless/test-fixtures/idp-metadata.xml
index 9c82c3cd361..4d336c9797e 100644
--- a/internal/service/opensearchserverless/test-fixtures/idp-metadata.xml
+++ b/internal/service/opensearchserverless/test-fixtures/idp-metadata.xml
@@ -1,4 +1,9 @@
 <?xml version="1.0" encoding="UTF-8"?>
+<!--
+ Copyright (c) HashiCorp, Inc.
+ SPDX-License-Identifier: MPL-2.0
+-->
+
 <md:EntityDescriptor entityID="entity-id" xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata">
   <md:IDPSSODescriptor WantAuthnRequestsSigned="false" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
     <md:KeyDescriptor use="signing">
diff --git a/internal/service/opensearchserverless/vpc_endpoint.go b/internal/service/opensearchserverless/vpc_endpoint.go
index 782b6fef7f5..dd590722a80 100644
--- a/internal/service/opensearchserverless/vpc_endpoint.go
+++ b/internal/service/opensearchserverless/vpc_endpoint.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package opensearchserverless
 
 import (
@@ -25,8 +28,8 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/create"
 	"github.com/hashicorp/terraform-provider-aws/internal/enum"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/fwdiag"
-	"github.com/hashicorp/terraform-provider-aws/internal/flex"
 	"github.com/hashicorp/terraform-provider-aws/internal/framework"
+	"github.com/hashicorp/terraform-provider-aws/internal/framework/flex"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -151,7 +154,7 @@ func (r *resourceVpcEndpoint) Create(ctx context.Context, req resource.CreateReq
 	// The create operation only returns the Id and Name so retrieve the newly
 	// created VPC Endpoint so we can store the possibly computed
 	// security_group_ids in state
-	vpcEndpoint, err := FindVPCEndpointByID(ctx, conn, aws.ToString(out.CreateVpcEndpointDetail.Id))
+	vpcEndpoint, err := findVPCEndpointByID(ctx, conn, aws.ToString(out.CreateVpcEndpointDetail.Id))
 	if err != nil {
 		resp.Diagnostics.AddError(
 			create.ProblemStandardMessage(names.OpenSearchServerless, create.ErrActionChecking, ResNameVPCEndpoint, plan.Name.String(), nil),
@@ -174,7 +177,7 @@ func (r *resourceVpcEndpoint) Read(ctx context.Context, req resource.ReadRequest
 		return
 	}
 
-	out, err := FindVPCEndpointByID(ctx, conn, state.ID.ValueString())
+	out, err := findVPCEndpointByID(ctx, conn, state.ID.ValueString())
 	if tfresource.NotFound(err) {
 		resp.Diagnostics.Append(fwdiag.NewResourceNotFoundWarningDiagnostic(err))
 		resp.State.RemoveResource(ctx)
@@ -255,7 +258,7 @@ func (r *resourceVpcEndpoint) Update(ctx context.Context, req resource.UpdateReq
 	// The update operation only returns security_group_ids if those were
 	// changed so retrieve the updated VPC Endpoint so we can store the
 	// actual security_group_ids in state
-	vpcEndpoint, err := FindVPCEndpointByID(ctx, conn, *out.UpdateVpcEndpointDetail.Id)
+	vpcEndpoint, err := findVPCEndpointByID(ctx, conn, *out.UpdateVpcEndpointDetail.Id)
 	if err != nil {
 		resp.Diagnostics.AddError(
 			create.ProblemStandardMessage(names.OpenSearchServerless, create.ErrActionChecking, ResNameVPCEndpoint, plan.Name.String(), nil),
@@ -374,7 +377,7 @@ func waitVPCEndpointDeleted(ctx context.Context, conn *opensearchserverless.Clie
 
 func statusVPCEndpoint(ctx context.Context, conn *opensearchserverless.Client, id string) retry.StateRefreshFunc {
 	return func() (interface{}, string, error) {
-		out, err := FindVPCEndpointByID(ctx, conn, id)
+		out, err := findVPCEndpointByID(ctx, conn, id)
 		if tfresource.NotFound(err) {
 			return nil, "", nil
 		}
diff --git a/internal/service/opensearchserverless/vpc_endpoint_data_source.go b/internal/service/opensearchserverless/vpc_endpoint_data_source.go
new file mode 100644
index 00000000000..0b1d22117cc
--- /dev/null
+++ b/internal/service/opensearchserverless/vpc_endpoint_data_source.go
@@ -0,0 +1,81 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package opensearchserverless
+
+import (
+	"context"
+	"time"
+
+	"github.com/YakDriver/regexache"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
+)
+
+// @SDKDataSource("aws_opensearchserverless_vpc_endpoint")
+func DataSourceVPCEndpoint() *schema.Resource {
+	return &schema.Resource{
+		ReadWithoutTimeout: dataSourceVPCEndpointRead,
+
+		Schema: map[string]*schema.Schema{
+			"created_date": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"vpc_endpoint_id": {
+				Type:     schema.TypeString,
+				Required: true,
+				ValidateFunc: validation.All(
+					validation.StringLenBetween(1, 255),
+					validation.StringMatch(regexache.MustCompile(`^vpce-[0-9a-z]*$`), `must start with "vpce-" and can include any lower case letter or number`),
+				),
+			},
+			"name": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"security_group_ids": {
+				Type:     schema.TypeList,
+				Computed: true,
+				Elem:     &schema.Schema{Type: schema.TypeString},
+			},
+			"subnet_ids": {
+				Type:     schema.TypeList,
+				Computed: true,
+				Elem:     &schema.Schema{Type: schema.TypeString},
+			},
+			"vpc_id": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+		},
+	}
+}
+
+func dataSourceVPCEndpointRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).OpenSearchServerlessClient(ctx)
+
+	id := d.Get("vpc_endpoint_id").(string)
+	vpcEndpoint, err := findVPCEndpointByID(ctx, conn, id)
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "reading OpenSearch Serverless VPC Endpoint with id (%s): %s", id, err)
+	}
+
+	d.SetId(aws.ToString(vpcEndpoint.Id))
+
+	createdDate := time.UnixMilli(aws.ToInt64(vpcEndpoint.CreatedDate))
+	d.Set("created_date", createdDate.Format(time.RFC3339))
+
+	d.Set("name", vpcEndpoint.Name)
+	d.Set("security_group_ids", vpcEndpoint.SecurityGroupIds)
+	d.Set("subnet_ids", vpcEndpoint.SubnetIds)
+	d.Set("vpc_id", vpcEndpoint.VpcId)
+
+	return diags
+}
diff --git a/internal/service/opensearchserverless/vpc_endpoint_data_source_test.go b/internal/service/opensearchserverless/vpc_endpoint_data_source_test.go
new file mode 100644
index 00000000000..01e917eac51
--- /dev/null
+++ b/internal/service/opensearchserverless/vpc_endpoint_data_source_test.go
@@ -0,0 +1,110 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package opensearchserverless_test
+
+import (
+	"fmt"
+	"testing"
+
+	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
+	"github.com/hashicorp/terraform-provider-aws/names"
+)
+
+func TestAccOpenSearchServerlessVPCEndpointDataSource_basic(t *testing.T) {
+	ctx := acctest.Context(t)
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_opensearchserverless_vpc_endpoint.test"
+	dataSourceName := "data.aws_opensearchserverless_vpc_endpoint.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, names.OpenSearchServerlessEndpointID)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, names.OpenSearchServerlessEndpointID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckVPCEndpointDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccVPCEndpointDataSourceConfig_basic(rName),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttrSet(dataSourceName, "created_date"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "id", resourceName, "id"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "name", resourceName, "name"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "security_group_ids.#", resourceName, "security_group_ids.#"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "subnet_ids.#", resourceName, "subnet_ids.#"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "vpc_id", resourceName, "vpc_id"),
+				),
+			},
+		},
+	})
+}
+
+func testAccVPCEndpointDataSourceConfig_networkingBase(rName string, subnetCount int) string {
+	return acctest.ConfigCompose(
+		acctest.ConfigAvailableAZsNoOptInDefaultExclude(),
+		fmt.Sprintf(`
+resource "aws_vpc" "test" {
+  cidr_block           = "10.0.0.0/16"
+  enable_dns_hostnames = true
+
+  tags = {
+    Name = %[1]q
+  }
+}
+
+resource "aws_subnet" "test" {
+  count = %[2]d
+
+  vpc_id            = aws_vpc.test.id
+  availability_zone = data.aws_availability_zones.available.names[count.index]
+  cidr_block        = cidrsubnet(aws_vpc.test.cidr_block, 8, count.index)
+
+  tags = {
+    Name = %[1]q
+  }
+}
+`, rName, subnetCount),
+	)
+}
+
+func testAccVPCEndpointDataSourceConfig_securityGroupBase(rName string, sgCount int) string {
+	return acctest.ConfigCompose(
+		fmt.Sprintf(`
+resource "aws_security_group" "test" {
+  count  = %[2]d
+  name   = "%[1]s-${count.index}"
+  vpc_id = aws_vpc.test.id
+
+  tags = {
+    Name = %[1]q
+  }
+}
+`, rName, sgCount),
+	)
+}
+
+func testAccVPCEndpointDataSourceConfig_basic(rName string) string {
+	return acctest.ConfigCompose(
+		testAccVPCEndpointDataSourceConfig_networkingBase(rName, 2),
+		testAccVPCEndpointDataSourceConfig_securityGroupBase(rName, 2),
+		fmt.Sprintf(`
+resource "aws_opensearchserverless_vpc_endpoint" "test" {
+  name               = %[1]q
+  security_group_ids = aws_security_group.test[*].id
+  subnet_ids         = aws_subnet.test[*].id
+  vpc_id             = aws_vpc.test.id
+}
+
+data "aws_opensearchserverless_vpc_endpoint" "test" {
+  vpc_endpoint_id = aws_opensearchserverless_vpc_endpoint.test.id
+}
+`, rName))
+}
diff --git a/internal/service/opensearchserverless/vpc_endpoint_test.go b/internal/service/opensearchserverless/vpc_endpoint_test.go
index fe2abe78dff..a2967812dc1 100644
--- a/internal/service/opensearchserverless/vpc_endpoint_test.go
+++ b/internal/service/opensearchserverless/vpc_endpoint_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package opensearchserverless_test
 
 import (
diff --git a/internal/service/opsworks/application.go b/internal/service/opsworks/application.go
index 3c00b351d0b..5da9050df2f 100644
--- a/internal/service/opsworks/application.go
+++ b/internal/service/opsworks/application.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package opsworks
 
 import (
diff --git a/internal/service/opsworks/application_test.go b/internal/service/opsworks/application_test.go
index d74c7825f1e..d717915fb23 100644
--- a/internal/service/opsworks/application_test.go
+++ b/internal/service/opsworks/application_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package opsworks_test
 
 import (
diff --git a/internal/service/opsworks/consts.go b/internal/service/opsworks/consts.go
index d58dae8d41c..5eac793957b 100644
--- a/internal/service/opsworks/consts.go
+++ b/internal/service/opsworks/consts.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package opsworks
 
 import (
diff --git a/internal/service/opsworks/custom_layer.go b/internal/service/opsworks/custom_layer.go
index 1e02c7cfe13..c6d12dbaa89 100644
--- a/internal/service/opsworks/custom_layer.go
+++ b/internal/service/opsworks/custom_layer.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package opsworks
 
 import (
diff --git a/internal/service/opsworks/custom_layer_test.go b/internal/service/opsworks/custom_layer_test.go
index dfa37a6b3b8..6c50057924f 100644
--- a/internal/service/opsworks/custom_layer_test.go
+++ b/internal/service/opsworks/custom_layer_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package opsworks_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/opsworks"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -29,7 +32,7 @@ func TestAccOpsWorksCustomLayer_basic(t *testing.T) {
 				Config: testAccCustomLayerConfig_basic(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckLayerExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "opsworks", regexp.MustCompile(`layer/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "opsworks", regexache.MustCompile(`layer/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "auto_assign_elastic_ips", "false"),
 					resource.TestCheckResourceAttr(resourceName, "auto_assign_public_ips", "false"),
 					resource.TestCheckResourceAttr(resourceName, "auto_healing", "true"),
@@ -102,7 +105,7 @@ func TestAccOpsWorksCustomLayer_update(t *testing.T) {
 			{
 				Config: testAccCustomLayerConfig_update(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "opsworks", regexp.MustCompile(`layer/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "opsworks", regexache.MustCompile(`layer/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "auto_assign_elastic_ips", "false"),
 					resource.TestCheckResourceAttr(resourceName, "auto_assign_public_ips", "true"),
 					resource.TestCheckResourceAttr(resourceName, "auto_healing", "true"),
diff --git a/internal/service/opsworks/ecs_cluster_layer.go b/internal/service/opsworks/ecs_cluster_layer.go
index 12c74c38d9d..f596028940f 100644
--- a/internal/service/opsworks/ecs_cluster_layer.go
+++ b/internal/service/opsworks/ecs_cluster_layer.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package opsworks
 
 import (
diff --git a/internal/service/opsworks/ecs_cluster_layer_test.go b/internal/service/opsworks/ecs_cluster_layer_test.go
index 373050faaf0..65df45c9b10 100644
--- a/internal/service/opsworks/ecs_cluster_layer_test.go
+++ b/internal/service/opsworks/ecs_cluster_layer_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package opsworks_test
 
 import (
diff --git a/internal/service/opsworks/forge.go b/internal/service/opsworks/forge.go
index 891dc3a5855..9a37383c230 100644
--- a/internal/service/opsworks/forge.go
+++ b/internal/service/opsworks/forge.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package opsworks
 
 import (
diff --git a/internal/service/opsworks/ganglia_layer.go b/internal/service/opsworks/ganglia_layer.go
index c06ea4d632f..79c1eda1b85 100644
--- a/internal/service/opsworks/ganglia_layer.go
+++ b/internal/service/opsworks/ganglia_layer.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package opsworks
 
 import (
diff --git a/internal/service/opsworks/ganglia_layer_test.go b/internal/service/opsworks/ganglia_layer_test.go
index 02740294672..3ffdce5244f 100644
--- a/internal/service/opsworks/ganglia_layer_test.go
+++ b/internal/service/opsworks/ganglia_layer_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package opsworks_test
 
 import (
diff --git a/internal/service/opsworks/generate.go b/internal/service/opsworks/generate.go
index 8803ee38db2..5d496a90d2f 100644
--- a/internal/service/opsworks/generate.go
+++ b/internal/service/opsworks/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTags -ListTagsOp=ListTags -ServiceTagsMap -UpdateTags -CreateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/opsworks/haproxy_layer.go b/internal/service/opsworks/haproxy_layer.go
index 57063ec38d3..485f6e8c599 100644
--- a/internal/service/opsworks/haproxy_layer.go
+++ b/internal/service/opsworks/haproxy_layer.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package opsworks
 
 import (
diff --git a/internal/service/opsworks/haproxy_layer_test.go b/internal/service/opsworks/haproxy_layer_test.go
index f303545f290..70544537a17 100644
--- a/internal/service/opsworks/haproxy_layer_test.go
+++ b/internal/service/opsworks/haproxy_layer_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package opsworks_test
 
 import (
diff --git a/internal/service/opsworks/instance.go b/internal/service/opsworks/instance.go
index 122400416ca..874238e31d5 100644
--- a/internal/service/opsworks/instance.go
+++ b/internal/service/opsworks/instance.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package opsworks
 
 import (
diff --git a/internal/service/opsworks/instance_test.go b/internal/service/opsworks/instance_test.go
index bc40652b398..04ab5703f9d 100644
--- a/internal/service/opsworks/instance_test.go
+++ b/internal/service/opsworks/instance_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package opsworks_test
 
 import (
diff --git a/internal/service/opsworks/java_app_layer.go b/internal/service/opsworks/java_app_layer.go
index 9dab6233bc8..9dc0cd7092e 100644
--- a/internal/service/opsworks/java_app_layer.go
+++ b/internal/service/opsworks/java_app_layer.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package opsworks
 
 import (
diff --git a/internal/service/opsworks/java_app_layer_test.go b/internal/service/opsworks/java_app_layer_test.go
index 2736bebe6cf..5b6713151bb 100644
--- a/internal/service/opsworks/java_app_layer_test.go
+++ b/internal/service/opsworks/java_app_layer_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package opsworks_test
 
 import (
diff --git a/internal/service/opsworks/layers.go b/internal/service/opsworks/layers.go
index 67df766f22e..1b581b2076d 100644
--- a/internal/service/opsworks/layers.go
+++ b/internal/service/opsworks/layers.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package opsworks
 
 import (
@@ -458,7 +461,9 @@ func (lt *opsworksLayerType) resourceSchema() *schema.Resource {
 			StateContext: schema.ImportStatePassthroughContext,
 		},
 
-		Schema: resourceSchema,
+		SchemaFunc: func() map[string]*schema.Schema {
+			return resourceSchema
+		},
 
 		CustomizeDiff: verify.SetTagsDiff,
 	}
diff --git a/internal/service/opsworks/layers_test.go b/internal/service/opsworks/layers_test.go
index b0ae1d6b43e..c6762afc4a3 100644
--- a/internal/service/opsworks/layers_test.go
+++ b/internal/service/opsworks/layers_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package opsworks_test
 
 import (
diff --git a/internal/service/opsworks/memcached_layer.go b/internal/service/opsworks/memcached_layer.go
index b8e2f0bc0ae..293b82933b1 100644
--- a/internal/service/opsworks/memcached_layer.go
+++ b/internal/service/opsworks/memcached_layer.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package opsworks
 
 import (
diff --git a/internal/service/opsworks/memcached_layer_test.go b/internal/service/opsworks/memcached_layer_test.go
index ccf44878ee1..e72ddd9a919 100644
--- a/internal/service/opsworks/memcached_layer_test.go
+++ b/internal/service/opsworks/memcached_layer_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package opsworks_test
 
 import (
diff --git a/internal/service/opsworks/mysql_layer.go b/internal/service/opsworks/mysql_layer.go
index 70e88f10398..79f9eca0dee 100644
--- a/internal/service/opsworks/mysql_layer.go
+++ b/internal/service/opsworks/mysql_layer.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package opsworks
 
 import (
diff --git a/internal/service/opsworks/mysql_layer_test.go b/internal/service/opsworks/mysql_layer_test.go
index d682e83a719..27408704125 100644
--- a/internal/service/opsworks/mysql_layer_test.go
+++ b/internal/service/opsworks/mysql_layer_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package opsworks_test
 
 import (
diff --git a/internal/service/opsworks/nodejs_app_layer.go b/internal/service/opsworks/nodejs_app_layer.go
index 38ce23abf1a..469ceca5b24 100644
--- a/internal/service/opsworks/nodejs_app_layer.go
+++ b/internal/service/opsworks/nodejs_app_layer.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package opsworks
 
 import (
diff --git a/internal/service/opsworks/nodejs_app_layer_test.go b/internal/service/opsworks/nodejs_app_layer_test.go
index 1fbeb874dfd..a91f5fa3a16 100644
--- a/internal/service/opsworks/nodejs_app_layer_test.go
+++ b/internal/service/opsworks/nodejs_app_layer_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package opsworks_test
 
 import (
diff --git a/internal/service/opsworks/permission.go b/internal/service/opsworks/permission.go
index 29c29bd6688..ee94f1ae78c 100644
--- a/internal/service/opsworks/permission.go
+++ b/internal/service/opsworks/permission.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package opsworks
 
 import (
diff --git a/internal/service/opsworks/permission_test.go b/internal/service/opsworks/permission_test.go
index fcfd8dcb5dd..91a960ff3d7 100644
--- a/internal/service/opsworks/permission_test.go
+++ b/internal/service/opsworks/permission_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package opsworks_test
 
 import (
diff --git a/internal/service/opsworks/php_app_layer.go b/internal/service/opsworks/php_app_layer.go
index a8bb7388be5..e8f8a652716 100644
--- a/internal/service/opsworks/php_app_layer.go
+++ b/internal/service/opsworks/php_app_layer.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package opsworks
 
 import (
diff --git a/internal/service/opsworks/php_app_layer_test.go b/internal/service/opsworks/php_app_layer_test.go
index 13bca5f03ba..fa9166757f7 100644
--- a/internal/service/opsworks/php_app_layer_test.go
+++ b/internal/service/opsworks/php_app_layer_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package opsworks_test
 
 import (
diff --git a/internal/service/opsworks/rails_app_layer.go b/internal/service/opsworks/rails_app_layer.go
index 18413cfdbc5..0b0ee1e1485 100644
--- a/internal/service/opsworks/rails_app_layer.go
+++ b/internal/service/opsworks/rails_app_layer.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package opsworks
 
 import (
diff --git a/internal/service/opsworks/rails_app_layer_test.go b/internal/service/opsworks/rails_app_layer_test.go
index 0e1205c7ebc..ea215e0cdd4 100644
--- a/internal/service/opsworks/rails_app_layer_test.go
+++ b/internal/service/opsworks/rails_app_layer_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package opsworks_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws/endpoints"
 	"github.com/aws/aws-sdk-go/service/opsworks"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -32,7 +35,7 @@ func TestAccOpsWorksRailsAppLayer_basic(t *testing.T) {
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckLayerExists(ctx, resourceName, &v),
 					resource.TestCheckResourceAttr(resourceName, "app_server", "apache_passenger"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "opsworks", regexp.MustCompile(`layer/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "opsworks", regexache.MustCompile(`layer/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "auto_assign_elastic_ips", "false"),
 					resource.TestCheckResourceAttr(resourceName, "auto_assign_public_ips", "false"),
 					resource.TestCheckResourceAttr(resourceName, "auto_healing", "true"),
diff --git a/internal/service/opsworks/rds_db_instance.go b/internal/service/opsworks/rds_db_instance.go
index b8967b99006..b55ec8491d4 100644
--- a/internal/service/opsworks/rds_db_instance.go
+++ b/internal/service/opsworks/rds_db_instance.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package opsworks
 
 import (
diff --git a/internal/service/opsworks/rds_db_instance_test.go b/internal/service/opsworks/rds_db_instance_test.go
index df525aaf733..2e08d51f58c 100644
--- a/internal/service/opsworks/rds_db_instance_test.go
+++ b/internal/service/opsworks/rds_db_instance_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package opsworks_test
 
 import (
@@ -140,9 +143,13 @@ func testAccCheckRDSDBInstanceDestroy(ctx context.Context) resource.TestCheckFun
 
 func testAccRDSDBInstanceConfig_basic(rName, userName, password string) string {
 	return acctest.ConfigCompose(testAccStackConfig_basic(rName), fmt.Sprintf(`
+data "aws_rds_engine_version" "default" {
+  engine = "mysql"
+}
+
 data "aws_rds_orderable_db_instance" "test" {
-  engine         = "mysql"
-  engine_version = "8.0.25"
+  engine         = data.aws_rds_engine_version.default.engine
+  engine_version = data.aws_rds_engine_version.default.version
   license_model  = "general-public-license"
   storage_type   = "standard"
 
@@ -168,8 +175,8 @@ resource "aws_opsworks_rds_db_instance" "test" {
   stack_id = aws_opsworks_stack.test.id
 
   rds_db_instance_arn = aws_db_instance.test.arn
-  db_user             = %[1]q
-  db_password         = %[2]q
+  db_user             = %[2]q
+  db_password         = %[3]q
 }
-`, userName, password))
+`, rName, userName, password))
 }
diff --git a/internal/service/opsworks/service_package_gen.go b/internal/service/opsworks/service_package_gen.go
index ee05a19fdb1..a310f3c4a5e 100644
--- a/internal/service/opsworks/service_package_gen.go
+++ b/internal/service/opsworks/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	opsworks_sdkv1 "github.com/aws/aws-sdk-go/service/opsworks"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -156,4 +157,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*o
 	return opsworks_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/opsworks/stack.go b/internal/service/opsworks/stack.go
index 1f5121f998c..5cf1a40ff74 100644
--- a/internal/service/opsworks/stack.go
+++ b/internal/service/opsworks/stack.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package opsworks
 
 import (
diff --git a/internal/service/opsworks/stack_test.go b/internal/service/opsworks/stack_test.go
index ccc101bba0d..60d3ba31f37 100644
--- a/internal/service/opsworks/stack_test.go
+++ b/internal/service/opsworks/stack_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package opsworks_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/aws/aws-sdk-go/aws/endpoints"
 	"github.com/aws/aws-sdk-go/service/opsworks"
@@ -39,7 +42,7 @@ func TestAccOpsWorksStack_basic(t *testing.T) {
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckStackExists(ctx, resourceName, &v),
 					resource.TestCheckResourceAttrSet(resourceName, "agent_version"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "opsworks", regexp.MustCompile(`stack/.+/`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "opsworks", regexache.MustCompile(`stack/.+/`)),
 					resource.TestCheckResourceAttr(resourceName, "berkshelf_version", "3.2.0"),
 					resource.TestCheckResourceAttr(resourceName, "color", ""),
 					resource.TestCheckResourceAttr(resourceName, "configuration_manager_name", "Chef"),
@@ -121,8 +124,8 @@ func TestAccOpsWorksStack_noVPC_basic(t *testing.T) {
 				Config: testAccStackConfig_noVPC(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckStackExists(ctx, resourceName, &v),
-					resource.TestMatchResourceAttr(resourceName, "default_availability_zone", regexp.MustCompile(fmt.Sprintf("%s[a-z]", acctest.Region()))),
-					resource.TestMatchResourceAttr(resourceName, "default_subnet_id", regexp.MustCompile("subnet-[[:alnum:]]")),
+					resource.TestMatchResourceAttr(resourceName, "default_availability_zone", regexache.MustCompile(fmt.Sprintf("%s[a-z]", acctest.Region()))),
+					resource.TestMatchResourceAttr(resourceName, "default_subnet_id", regexache.MustCompile("subnet-[[:alnum:]]")),
 					resource.TestCheckResourceAttrPair(resourceName, "vpc_id", "data.aws_vpc.default", "id"),
 				),
 			},
@@ -164,7 +167,7 @@ func TestAccOpsWorksStack_noVPC_defaultAZ(t *testing.T) {
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckStackExists(ctx, resourceName, &v),
 					resource.TestCheckResourceAttrPair(resourceName, "default_availability_zone", "data.aws_availability_zones.available", "names.1"),
-					resource.TestMatchResourceAttr(resourceName, "default_subnet_id", regexp.MustCompile("subnet-[[:alnum:]]")),
+					resource.TestMatchResourceAttr(resourceName, "default_subnet_id", regexache.MustCompile("subnet-[[:alnum:]]")),
 					resource.TestCheckResourceAttrPair(resourceName, "vpc_id", "data.aws_vpc.default", "id"),
 				),
 			},
@@ -253,7 +256,7 @@ func TestAccOpsWorksStack_tagsAlternateRegion(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckStackExists(ctx, resourceName, &v),
 					resource.TestCheckResourceAttrWith(resourceName, "arn", func(value string) error {
-						if !regexp.MustCompile(arn.ARN{
+						if !regexache.MustCompile(arn.ARN{
 							Partition: acctest.Partition(),
 							Service:   opsworks.ServiceName,
 							Region:    acctest.AlternateRegion(),
@@ -319,7 +322,7 @@ func TestAccOpsWorksStack_allAttributes(t *testing.T) {
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckStackExists(ctx, resourceName, &v),
 					resource.TestCheckResourceAttr(resourceName, "agent_version", "4039-20200430042739"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "opsworks", regexp.MustCompile(`stack/.+/`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "opsworks", regexache.MustCompile(`stack/.+/`)),
 					resource.TestCheckResourceAttr(resourceName, "berkshelf_version", "3.2.0"),
 					resource.TestCheckResourceAttr(resourceName, "color", "rgb(186, 65, 50)"),
 					resource.TestCheckResourceAttr(resourceName, "configuration_manager_name", "Chef"),
@@ -363,7 +366,7 @@ func TestAccOpsWorksStack_allAttributes(t *testing.T) {
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckStackExists(ctx, resourceName, &v),
 					resource.TestCheckResourceAttr(resourceName, "agent_version", "4038-20200305044341"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "opsworks", regexp.MustCompile(`stack/.+/`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "opsworks", regexache.MustCompile(`stack/.+/`)),
 					resource.TestCheckResourceAttr(resourceName, "berkshelf_version", "3.2.0"),
 					resource.TestCheckResourceAttr(resourceName, "color", "rgb(186, 65, 50)"),
 					resource.TestCheckResourceAttr(resourceName, "configuration_manager_name", "Chef"),
@@ -399,7 +402,7 @@ func TestAccOpsWorksStack_allAttributes(t *testing.T) {
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckStackExists(ctx, resourceName, &v),
 					resource.TestCheckResourceAttr(resourceName, "agent_version", "4038-20200305044341"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "opsworks", regexp.MustCompile(`stack/.+/`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "opsworks", regexache.MustCompile(`stack/.+/`)),
 					resource.TestCheckResourceAttr(resourceName, "berkshelf_version", "3.2.0"),
 					resource.TestCheckResourceAttr(resourceName, "color", "rgb(209, 105, 41)"),
 					resource.TestCheckResourceAttr(resourceName, "configuration_manager_name", "Chef"),
diff --git a/internal/service/opsworks/static_web_layer.go b/internal/service/opsworks/static_web_layer.go
index 4cd872df65d..399d01495ab 100644
--- a/internal/service/opsworks/static_web_layer.go
+++ b/internal/service/opsworks/static_web_layer.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package opsworks
 
 import (
diff --git a/internal/service/opsworks/static_web_layer_test.go b/internal/service/opsworks/static_web_layer_test.go
index e8218a5829f..fd37d65c67c 100644
--- a/internal/service/opsworks/static_web_layer_test.go
+++ b/internal/service/opsworks/static_web_layer_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package opsworks_test
 
 import (
diff --git a/internal/service/opsworks/sweep.go b/internal/service/opsworks/sweep.go
index 112f1d7a239..92c691be6b8 100644
--- a/internal/service/opsworks/sweep.go
+++ b/internal/service/opsworks/sweep.go
@@ -1,22 +1,28 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package opsworks
 
 import (
-	"errors"
+	"context"
 	"fmt"
 	"log"
+	"strings"
+	"time"
 
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/opsworks"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	"github.com/hashicorp/go-multierror"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/sdk"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_opsworks_stack", &resource.Sweeper{
 		Name: "aws_opsworks_stack",
 		F:    sweepStacks,
@@ -64,7 +70,7 @@ func init() {
 
 func sweepApplication(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -75,7 +81,7 @@ func sweepApplication(region string) error {
 	output, err := conn.DescribeStacksWithContext(ctx, &opsworks.DescribeStacksInput{})
 
 	if err != nil {
-		if sweep.SkipSweepError(err) {
+		if awsv1.SkipSweepError(err) {
 			log.Printf("[WARN] Skipping OpsWorks Application sweep for %s: %s", region, err)
 			return nil
 		}
@@ -107,16 +113,16 @@ func sweepApplication(region string) error {
 			d := r.Data(nil)
 			d.SetId(aws.StringValue(app.AppId))
 
-			sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
+			sweepResources = append(sweepResources, sdk.NewSweepResource(r, d, client))
 		}
 	}
 
-	return sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	return sweep.SweepOrchestrator(ctx, sweepResources)
 }
 
 func sweepInstance(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -127,7 +133,7 @@ func sweepInstance(region string) error {
 	output, err := conn.DescribeStacksWithContext(ctx, &opsworks.DescribeStacksInput{})
 
 	if err != nil {
-		if sweep.SkipSweepError(err) {
+		if awsv1.SkipSweepError(err) {
 			log.Printf("[WARN] Skipping OpsWorks Instance sweep for %s: %s", region, err)
 			return nil
 		}
@@ -160,16 +166,16 @@ func sweepInstance(region string) error {
 			d.SetId(aws.StringValue(instance.InstanceId))
 			d.Set("status", instance.Status)
 
-			sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
+			sweepResources = append(sweepResources, sdk.NewSweepResource(r, d, client))
 		}
 	}
 
-	return sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	return sweep.SweepOrchestrator(ctx, sweepResources)
 }
 
 func sweepRDSDBInstance(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -180,7 +186,7 @@ func sweepRDSDBInstance(region string) error {
 	output, err := conn.DescribeStacksWithContext(ctx, &opsworks.DescribeStacksInput{})
 
 	if err != nil {
-		if sweep.SkipSweepError(err) {
+		if awsv1.SkipSweepError(err) {
 			log.Printf("[WARN] Skipping OpsWorks RDS DB Instance sweep for %s: %s", region, err)
 			return nil
 		}
@@ -213,16 +219,16 @@ func sweepRDSDBInstance(region string) error {
 			d.SetId(aws.StringValue(dbInstance.DbInstanceIdentifier))
 			d.Set("rds_db_instance_arn", dbInstance.RdsDbInstanceArn)
 
-			sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
+			sweepResources = append(sweepResources, sdk.NewSweepResource(r, d, client))
 		}
 	}
 
-	return sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	return sweep.SweepOrchestrator(ctx, sweepResources)
 }
 
 func sweepStacks(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -233,7 +239,7 @@ func sweepStacks(region string) error {
 	output, err := conn.DescribeStacksWithContext(ctx, &opsworks.DescribeStacksInput{})
 
 	if err != nil {
-		if sweep.SkipSweepError(err) {
+		if awsv1.SkipSweepError(err) {
 			log.Printf("[WARN] Skipping OpsWorks Stack sweep for %s: %s", region, err)
 			return nil
 		}
@@ -257,15 +263,15 @@ func sweepStacks(region string) error {
 			d.Set("use_opsworks_security_groups", true)
 		}
 
-		sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
+		sweepResources = append(sweepResources, sdk.NewSweepResource(r, d, client))
 	}
 
-	return sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	return sweep.SweepOrchestrator(ctx, sweepResources)
 }
 
 func sweepLayers(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -276,7 +282,7 @@ func sweepLayers(region string) error {
 	output, err := conn.DescribeStacksWithContext(ctx, &opsworks.DescribeStacksInput{})
 
 	if err != nil {
-		if sweep.SkipSweepError(err) {
+		if awsv1.SkipSweepError(err) {
 			log.Printf("[WARN] Skipping OpsWorks Layer sweep for %s: %s", region, err)
 			return nil
 		}
@@ -318,16 +324,16 @@ func sweepLayers(region string) error {
 				}
 			}
 
-			sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
+			sweepResources = append(sweepResources, sdk.NewSweepResource(r, d, client))
 		}
 	}
 
-	return sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	return sweep.SweepOrchestrator(ctx, sweepResources)
 }
 
 func sweepUserProfiles(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -338,7 +344,7 @@ func sweepUserProfiles(region string) error {
 	output, err := conn.DescribeUserProfilesWithContext(ctx, &opsworks.DescribeUserProfilesInput{})
 
 	if err != nil {
-		if sweep.SkipSweepError(err) {
+		if awsv1.SkipSweepError(err) {
 			log.Printf("[WARN] Skipping OpsWorks User Profile sweep for %s: %s", region, err)
 			return nil
 		}
@@ -349,23 +355,29 @@ func sweepUserProfiles(region string) error {
 		r := ResourceUserProfile()
 		d := r.Data(nil)
 		d.SetId(aws.StringValue(profile.IamUserArn))
-		sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
+		sweepResources = append(sweepResources, newUserProfileSweeper(r, d, client))
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	return sweep.SweepOrchestrator(ctx, sweepResources)
+}
 
-	var errs *multierror.Error
-	if errors.As(err, &errs) {
-		var es *multierror.Error
-		for _, e := range errs.Errors {
-			if tfawserr.ErrMessageContains(err, opsworks.ErrCodeValidationException, "Cannot delete self") {
-				log.Printf("[WARN] Ignoring error: %s", e.Error())
-			} else {
-				es = multierror.Append(es, e)
-			}
-		}
-		return es.ErrorOrNil()
+type userProfileSweeper struct {
+	d         *schema.ResourceData
+	sweepable sweep.Sweepable
+}
+
+func newUserProfileSweeper(resource *schema.Resource, d *schema.ResourceData, client *conns.AWSClient) *userProfileSweeper {
+	return &userProfileSweeper{
+		d:         d,
+		sweepable: sdk.NewSweepResource(resource, d, client),
 	}
+}
 
+func (ups userProfileSweeper) Delete(ctx context.Context, timeout time.Duration, optFns ...tfresource.OptionsFunc) error {
+	err := ups.sweepable.Delete(ctx, timeout, optFns...)
+	if err != nil && strings.Contains(err.Error(), "Cannot delete self") {
+		log.Printf("[WARN] Skipping OpsWorks User Profile (%s): %s", ups.d.Id(), err)
+		return nil
+	}
 	return err
 }
diff --git a/internal/service/opsworks/tags_gen.go b/internal/service/opsworks/tags_gen.go
index ff44446d54a..61e61f6e89a 100644
--- a/internal/service/opsworks/tags_gen.go
+++ b/internal/service/opsworks/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/opsworks"
 	"github.com/aws/aws-sdk-go/service/opsworks/opsworksiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -54,7 +56,7 @@ func Tags(tags tftags.KeyValueTags) map[string]*string {
 	return aws.StringMap(tags.Map())
 }
 
-// KeyValueTags creates KeyValueTags from opsworks service tags.
+// KeyValueTags creates tftags.KeyValueTags from opsworks service tags.
 func KeyValueTags(ctx context.Context, tags map[string]*string) tftags.KeyValueTags {
 	return tftags.New(ctx, tags)
 }
@@ -94,6 +96,8 @@ func updateTags(ctx context.Context, conn opsworksiface.OpsWorksAPI, identifier
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.OpsWorks)
 	if len(removedTags) > 0 {
diff --git a/internal/service/opsworks/user_profile.go b/internal/service/opsworks/user_profile.go
index 8d922e57e0b..3f9c851dc63 100644
--- a/internal/service/opsworks/user_profile.go
+++ b/internal/service/opsworks/user_profile.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package opsworks
 
 import (
diff --git a/internal/service/opsworks/user_profile_test.go b/internal/service/opsworks/user_profile_test.go
index 3a4bf2f2bdb..6ce7e73bf36 100644
--- a/internal/service/opsworks/user_profile_test.go
+++ b/internal/service/opsworks/user_profile_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package opsworks_test
 
 import (
diff --git a/internal/service/organizations/account.go b/internal/service/organizations/account.go
index 226901e1a84..1765b83d139 100644
--- a/internal/service/organizations/account.go
+++ b/internal/service/organizations/account.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package organizations
 
 import (
 	"context"
 	"errors"
 	"log"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/organizations"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -55,7 +58,7 @@ func ResourceAccount() *schema.Resource {
 				Required: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(6, 64),
-					validation.StringMatch(regexp.MustCompile(`^[^\s@]+@[^\s@]+\.[^\s@]+$`), "must be a valid email address"),
+					validation.StringMatch(regexache.MustCompile(`^[^\s@]+@[^\s@]+\.[^\s@]+$`), "must be a valid email address"),
 				),
 			},
 			"govcloud_id": {
@@ -86,13 +89,13 @@ func ResourceAccount() *schema.Resource {
 				Type:         schema.TypeString,
 				Computed:     true,
 				Optional:     true,
-				ValidateFunc: validation.StringMatch(regexp.MustCompile("^(r-[0-9a-z]{4,32})|(ou-[0-9a-z]{4,32}-[a-z0-9]{8,32})$"), "see https://docs.aws.amazon.com/organizations/latest/APIReference/API_MoveAccount.html#organizations-MoveAccount-request-DestinationParentId"),
+				ValidateFunc: validation.StringMatch(regexache.MustCompile("^(r-[0-9a-z]{4,32})|(ou-[0-9a-z]{4,32}-[0-9a-z]{8,32})$"), "see https://docs.aws.amazon.com/organizations/latest/APIReference/API_MoveAccount.html#organizations-MoveAccount-request-DestinationParentId"),
 			},
 			"role_name": {
 				ForceNew:     true,
 				Type:         schema.TypeString,
 				Optional:     true,
-				ValidateFunc: validation.StringMatch(regexp.MustCompile(`^[\w+=,.@-]{1,64}$`), "must consist of uppercase letters, lowercase letters, digits with no spaces, and any of the following characters"),
+				ValidateFunc: validation.StringMatch(regexache.MustCompile(`^[\w+=,.@-]{1,64}$`), "must consist of uppercase letters, lowercase letters, digits with no spaces, and any of the following characters"),
 			},
 			"status": {
 				Type:     schema.TypeString,
diff --git a/internal/service/organizations/account_test.go b/internal/service/organizations/account_test.go
index 7915c6609c9..13fdcb82176 100644
--- a/internal/service/organizations/account_test.go
+++ b/internal/service/organizations/account_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package organizations_test
 
 import (
diff --git a/internal/service/organizations/delegated_administrator.go b/internal/service/organizations/delegated_administrator.go
index 9cf661ea4a8..39251f167f6 100644
--- a/internal/service/organizations/delegated_administrator.go
+++ b/internal/service/organizations/delegated_administrator.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package organizations
 
 import (
diff --git a/internal/service/organizations/delegated_administrator_test.go b/internal/service/organizations/delegated_administrator_test.go
index 759e3dc6bd5..0348e545583 100644
--- a/internal/service/organizations/delegated_administrator_test.go
+++ b/internal/service/organizations/delegated_administrator_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package organizations_test
 
 import (
diff --git a/internal/service/organizations/delegated_administrators_data_source.go b/internal/service/organizations/delegated_administrators_data_source.go
index 11f431c5c46..79aa1069814 100644
--- a/internal/service/organizations/delegated_administrators_data_source.go
+++ b/internal/service/organizations/delegated_administrators_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package organizations
 
 import (
diff --git a/internal/service/organizations/delegated_administrators_data_source_test.go b/internal/service/organizations/delegated_administrators_data_source_test.go
index d3343e735a5..639558fe2ce 100644
--- a/internal/service/organizations/delegated_administrators_data_source_test.go
+++ b/internal/service/organizations/delegated_administrators_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package organizations_test
 
 import (
diff --git a/internal/service/organizations/delegated_services_data_source.go b/internal/service/organizations/delegated_services_data_source.go
index 6e70e2404ff..50bdbe03a2d 100644
--- a/internal/service/organizations/delegated_services_data_source.go
+++ b/internal/service/organizations/delegated_services_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package organizations
 
 import (
diff --git a/internal/service/organizations/delegated_services_data_source_test.go b/internal/service/organizations/delegated_services_data_source_test.go
index a44381471d8..de7241b7fb5 100644
--- a/internal/service/organizations/delegated_services_data_source_test.go
+++ b/internal/service/organizations/delegated_services_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package organizations_test
 
 import (
@@ -43,6 +46,7 @@ func testAccDelegatedServicesDataSource_multiple(t *testing.T) {
 		PreCheck: func() {
 			acctest.PreCheck(ctx, t)
 			acctest.PreCheckAlternateAccount(t)
+			acctest.PreCheckOrganizationManagementAccount(ctx, t)
 		},
 		ErrorCheck:               acctest.ErrorCheck(t, organizations.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5FactoriesAlternate(ctx, t),
diff --git a/internal/service/organizations/exports_test.go b/internal/service/organizations/exports_test.go
index 322972b3e2d..d9dbace7aaa 100644
--- a/internal/service/organizations/exports_test.go
+++ b/internal/service/organizations/exports_test.go
@@ -1,8 +1,12 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package organizations
 
 // Exports for use in tests only.
 var (
 	FindDelegatedAdministratorByTwoPartKey = findDelegatedAdministratorByTwoPartKey
+	FindOrganizationalUnitByID             = findOrganizationalUnitByID
 	FindPolicyByID                         = findPolicyByID
 	FindResourcePolicy                     = findResourcePolicy
 )
diff --git a/internal/service/organizations/find.go b/internal/service/organizations/find.go
index fdf54cf8cab..fdf5c636e39 100644
--- a/internal/service/organizations/find.go
+++ b/internal/service/organizations/find.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package organizations
 
 import (
diff --git a/internal/service/organizations/flex_test.go b/internal/service/organizations/flex_test.go
deleted file mode 100644
index 7a5078b99e4..00000000000
--- a/internal/service/organizations/flex_test.go
+++ /dev/null
@@ -1,34 +0,0 @@
-package organizations
-
-import (
-	"reflect"
-	"testing"
-
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/organizations"
-)
-
-func TestFlattenOrganizationalUnits(t *testing.T) {
-	t.Parallel()
-
-	input := []*organizations.OrganizationalUnit{
-		{
-			Arn:  aws.String("arn:aws:organizations::123456789012:ou/o-abcde12345/ou-ab12-abcd1234"), //lintignore:AWSAT005
-			Id:   aws.String("ou-ab12-abcd1234"),
-			Name: aws.String("Engineering"),
-		},
-	}
-
-	expected_output := []map[string]interface{}{
-		{
-			"arn":  "arn:aws:organizations::123456789012:ou/o-abcde12345/ou-ab12-abcd1234", //lintignore:AWSAT005
-			"id":   "ou-ab12-abcd1234",
-			"name": "Engineering",
-		},
-	}
-
-	output := FlattenOrganizationalUnits(input)
-	if !reflect.DeepEqual(expected_output, output) {
-		t.Fatalf("Got:\n\n%#v\n\nExpected:\n\n%#v", output, expected_output)
-	}
-}
diff --git a/internal/service/organizations/generate.go b/internal/service/organizations/generate.go
index 79df46f614d..19340ac7311 100644
--- a/internal/service/organizations/generate.go
+++ b/internal/service/organizations/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTags -ListTagsInIDElem=ResourceId -ServiceTagsSlice -TagInIDElem=ResourceId -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/organizations/organization.go b/internal/service/organizations/organization.go
index c4a8c9e5972..65710a699cc 100644
--- a/internal/service/organizations/organization.go
+++ b/internal/service/organizations/organization.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package organizations
 
 import (
@@ -16,11 +19,11 @@ import (
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
+	"github.com/hashicorp/terraform-provider-aws/internal/flex"
+	tfslices "github.com/hashicorp/terraform-provider-aws/internal/slices"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
-const policyTypeStatusDisabled = "DISABLED"
-
 // @SDKResource("aws_organizations_organization")
 func ResourceOrganization() *schema.Resource {
 	return &schema.Resource{
@@ -28,39 +31,19 @@ func ResourceOrganization() *schema.Resource {
 		ReadWithoutTimeout:   resourceOrganizationRead,
 		UpdateWithoutTimeout: resourceOrganizationUpdate,
 		DeleteWithoutTimeout: resourceOrganizationDelete,
+
 		Importer: &schema.ResourceImporter{
-			StateContext: schema.ImportStatePassthroughContext,
+			StateContext: resourceOrganizationImport,
 		},
 
 		CustomizeDiff: customdiff.Sequence(
 			customdiff.ForceNewIfChange("feature_set", func(_ context.Context, old, new, meta interface{}) bool {
-				// Only changes from ALL to CONSOLIDATED_BILLING for feature_set should force a new resource
+				// Only changes from ALL to CONSOLIDATED_BILLING for feature_set should force a new resource.
 				return old.(string) == organizations.OrganizationFeatureSetAll && new.(string) == organizations.OrganizationFeatureSetConsolidatedBilling
 			}),
 		),
 
 		Schema: map[string]*schema.Schema{
-			"arn": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
-			"master_account_arn": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
-			"master_account_email": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
-			"master_account_id": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
-			"aws_service_access_principals": {
-				Type:     schema.TypeSet,
-				Optional: true,
-				Elem:     &schema.Schema{Type: schema.TypeString},
-			},
 			"accounts": {
 				Type:     schema.TypeList,
 				Computed: true,
@@ -89,6 +72,41 @@ func ResourceOrganization() *schema.Resource {
 					},
 				},
 			},
+			"arn": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"aws_service_access_principals": {
+				Type:     schema.TypeSet,
+				Optional: true,
+				Elem:     &schema.Schema{Type: schema.TypeString},
+			},
+			"enabled_policy_types": {
+				Type:     schema.TypeSet,
+				Optional: true,
+				Elem: &schema.Schema{
+					Type:         schema.TypeString,
+					ValidateFunc: validation.StringInSlice(organizations.PolicyType_Values(), false),
+				},
+			},
+			"feature_set": {
+				Type:         schema.TypeString,
+				Optional:     true,
+				Default:      organizations.OrganizationFeatureSetAll,
+				ValidateFunc: validation.StringInSlice(organizations.OrganizationFeatureSet_Values(), true),
+			},
+			"master_account_arn": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"master_account_email": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"master_account_id": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
 			"non_master_accounts": {
 				Type:     schema.TypeList,
 				Computed: true,
@@ -122,15 +140,15 @@ func ResourceOrganization() *schema.Resource {
 				Computed: true,
 				Elem: &schema.Resource{
 					Schema: map[string]*schema.Schema{
-						"id": {
+						"arn": {
 							Type:     schema.TypeString,
 							Computed: true,
 						},
-						"name": {
+						"id": {
 							Type:     schema.TypeString,
 							Computed: true,
 						},
-						"arn": {
+						"name": {
 							Type:     schema.TypeString,
 							Computed: true,
 						},
@@ -153,20 +171,6 @@ func ResourceOrganization() *schema.Resource {
 					},
 				},
 			},
-			"enabled_policy_types": {
-				Type:     schema.TypeSet,
-				Optional: true,
-				Elem: &schema.Schema{
-					Type:         schema.TypeString,
-					ValidateFunc: validation.StringInSlice(organizations.PolicyType_Values(), false),
-				},
-			},
-			"feature_set": {
-				Type:         schema.TypeString,
-				Optional:     true,
-				Default:      organizations.OrganizationFeatureSetAll,
-				ValidateFunc: validation.StringInSlice(organizations.OrganizationFeatureSet_Values(), true),
-			},
 		},
 	}
 }
@@ -175,56 +179,53 @@ func resourceOrganizationCreate(ctx context.Context, d *schema.ResourceData, met
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).OrganizationsConn(ctx)
 
-	createOpts := &organizations.CreateOrganizationInput{
+	input := &organizations.CreateOrganizationInput{
 		FeatureSet: aws.String(d.Get("feature_set").(string)),
 	}
-	log.Printf("[DEBUG] Creating Organization: %#v", createOpts)
 
-	resp, err := conn.CreateOrganizationWithContext(ctx, createOpts)
+	output, err := conn.CreateOrganizationWithContext(ctx, input)
+
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "creating organization: %s", err)
+		return sdkdiag.AppendErrorf(diags, "creating Organization: %s", err)
 	}
 
-	org := resp.Organization
-	d.SetId(aws.StringValue(org.Id))
+	d.SetId(aws.StringValue(output.Organization.Id))
 
-	awsServiceAccessPrincipals := d.Get("aws_service_access_principals").(*schema.Set).List()
-	for _, principalRaw := range awsServiceAccessPrincipals {
-		principal := principalRaw.(string)
-		input := &organizations.EnableAWSServiceAccessInput{
-			ServicePrincipal: aws.String(principal),
-		}
+	if v, ok := d.GetOk("aws_service_access_principals"); ok && v.(*schema.Set).Len() > 0 {
+		for _, principal := range flex.ExpandStringValueSet(v.(*schema.Set)) {
+			input := &organizations.EnableAWSServiceAccessInput{
+				ServicePrincipal: aws.String(principal),
+			}
 
-		log.Printf("[DEBUG] Enabling AWS Service Access in Organization: %s", input)
-		_, err := conn.EnableAWSServiceAccessWithContext(ctx, input)
+			_, err := conn.EnableAWSServiceAccessWithContext(ctx, input)
 
-		if err != nil {
-			return sdkdiag.AppendErrorf(diags, "enabling AWS Service Access (%s) in Organization: %s", principal, err)
+			if err != nil {
+				return sdkdiag.AppendErrorf(diags, "enabling AWS Service Access (%s) in Organization (%s): %s", principal, d.Id(), err)
+			}
 		}
 	}
 
-	enabledPolicyTypes := d.Get("enabled_policy_types").(*schema.Set).List()
-
-	if len(enabledPolicyTypes) > 0 {
-		defaultRoot, err := getOrganizationDefaultRoot(ctx, conn)
+	if v, ok := d.GetOk("enabled_policy_types"); ok && v.(*schema.Set).Len() > 0 {
+		defaultRoot, err := findDefaultRoot(ctx, conn)
 
 		if err != nil {
-			return sdkdiag.AppendErrorf(diags, "getting AWS Organization (%s) default root: %s", d.Id(), err)
+			return sdkdiag.AppendErrorf(diags, "reading Organization (%s) default root: %s", d.Id(), err)
 		}
 
-		for _, v := range enabledPolicyTypes {
-			enabledPolicyType := v.(string)
+		defaultRootID := aws.StringValue(defaultRoot.Id)
+
+		for _, policyType := range flex.ExpandStringValueSet(v.(*schema.Set)) {
 			input := &organizations.EnablePolicyTypeInput{
-				PolicyType: aws.String(enabledPolicyType),
-				RootId:     defaultRoot.Id,
+				PolicyType: aws.String(policyType),
+				RootId:     aws.String(defaultRootID),
 			}
 
 			if _, err := conn.EnablePolicyTypeWithContext(ctx, input); err != nil {
-				return sdkdiag.AppendErrorf(diags, "enabling policy type (%s) in Organization (%s): %s", enabledPolicyType, d.Id(), err)
+				return sdkdiag.AppendErrorf(diags, "enabling policy type (%s) in Organization (%s) Root (%s): %s", policyType, d.Id(), defaultRootID, err)
 			}
 
-			if err := waitForOrganizationDefaultRootPolicyTypeEnable(ctx, conn, enabledPolicyType); err != nil {
-				return sdkdiag.AppendErrorf(diags, "waiting for policy type (%s) enabling in Organization (%s): %s", enabledPolicyType, d.Id(), err)
+			if err := waitDefaultRootPolicyTypeEnabled(ctx, conn, policyType); err != nil {
+				return sdkdiag.AppendErrorf(diags, "waiting for policy type (%s) in Organization (%s) enable: %s", policyType, d.Id(), err)
 			}
 		}
 	}
@@ -236,86 +237,64 @@ func resourceOrganizationRead(ctx context.Context, d *schema.ResourceData, meta
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).OrganizationsConn(ctx)
 
-	log.Printf("[INFO] Reading Organization: %s", d.Id())
-	org, err := conn.DescribeOrganizationWithContext(ctx, &organizations.DescribeOrganizationInput{})
+	org, err := FindOrganization(ctx, conn)
 
-	if tfawserr.ErrCodeEquals(err, organizations.ErrCodeAWSOrganizationsNotInUseException) {
+	if !d.IsNewResource() && tfresource.NotFound(err) {
 		log.Printf("[WARN] Organization does not exist, removing from state: %s", d.Id())
 		d.SetId("")
 		return diags
 	}
 
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "describing Organization: %s", err)
+		return sdkdiag.AppendErrorf(diags, "reading Organization: %s", err)
 	}
 
-	log.Printf("[INFO] Listing Accounts for Organization: %s", d.Id())
-	var accounts []*organizations.Account
-	var nonMasterAccounts []*organizations.Account
-	err = conn.ListAccountsPagesWithContext(ctx, &organizations.ListAccountsInput{}, func(page *organizations.ListAccountsOutput, lastPage bool) bool {
-		for _, account := range page.Accounts {
-			if aws.StringValue(account.Id) != aws.StringValue(org.Organization.MasterAccountId) {
-				nonMasterAccounts = append(nonMasterAccounts, account)
-			}
-
-			accounts = append(accounts, account)
-		}
+	accounts, err := findAccounts(ctx, conn)
 
-		return !lastPage
-	})
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "listing AWS Organization (%s) accounts: %s", d.Id(), err)
+		return sdkdiag.AppendErrorf(diags, "reading Organization (%s) accounts: %s", d.Id(), err)
 	}
 
-	log.Printf("[INFO] Listing Roots for Organization: %s", d.Id())
-	var roots []*organizations.Root
-	err = conn.ListRootsPagesWithContext(ctx, &organizations.ListRootsInput{}, func(page *organizations.ListRootsOutput, lastPage bool) bool {
-		roots = append(roots, page.Roots...)
-		return !lastPage
+	managementAccountID := aws.StringValue(org.MasterAccountId)
+	nonManagementAccounts := tfslices.Filter(accounts, func(v *organizations.Account) bool {
+		return aws.StringValue(v.Id) != managementAccountID
 	})
+
+	roots, err := findRoots(ctx, conn)
+
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "listing AWS Organization (%s) roots: %s", d.Id(), err)
+		return sdkdiag.AppendErrorf(diags, "reading Organization (%s) roots: %s", d.Id(), err)
 	}
 
 	if err := d.Set("accounts", flattenAccounts(accounts)); err != nil {
 		return sdkdiag.AppendErrorf(diags, "setting accounts: %s", err)
 	}
-
-	d.Set("arn", org.Organization.Arn)
-	d.Set("feature_set", org.Organization.FeatureSet)
-	d.Set("master_account_arn", org.Organization.MasterAccountArn)
-	d.Set("master_account_email", org.Organization.MasterAccountEmail)
-	d.Set("master_account_id", org.Organization.MasterAccountId)
-
-	if err := d.Set("non_master_accounts", flattenAccounts(nonMasterAccounts)); err != nil {
+	d.Set("arn", org.Arn)
+	d.Set("feature_set", org.FeatureSet)
+	d.Set("master_account_arn", org.MasterAccountArn)
+	d.Set("master_account_email", org.MasterAccountEmail)
+	d.Set("master_account_id", org.MasterAccountId)
+	if err := d.Set("non_master_accounts", flattenAccounts(nonManagementAccounts)); err != nil {
 		return sdkdiag.AppendErrorf(diags, "setting non_master_accounts: %s", err)
 	}
-
-	if err := d.Set("roots", FlattenRoots(roots)); err != nil {
+	if err := d.Set("roots", flattenRoots(roots)); err != nil {
 		return sdkdiag.AppendErrorf(diags, "setting roots: %s", err)
 	}
 
-	awsServiceAccessPrincipals := make([]string, 0)
+	var awsServiceAccessPrincipals []string
 
 	// ConstraintViolationException: The request failed because the organization does not have all features enabled. Please enable all features in your organization and then retry.
-	if aws.StringValue(org.Organization.FeatureSet) == organizations.OrganizationFeatureSetAll {
-		err = conn.ListAWSServiceAccessForOrganizationPagesWithContext(ctx, &organizations.ListAWSServiceAccessForOrganizationInput{}, func(page *organizations.ListAWSServiceAccessForOrganizationOutput, lastPage bool) bool {
-			for _, enabledServicePrincipal := range page.EnabledServicePrincipals {
-				awsServiceAccessPrincipals = append(awsServiceAccessPrincipals, aws.StringValue(enabledServicePrincipal.ServicePrincipal))
-			}
-			return !lastPage
-		})
+	if aws.StringValue(org.FeatureSet) == organizations.OrganizationFeatureSetAll {
+		awsServiceAccessPrincipals, err = FindEnabledServicePrincipalNames(ctx, conn)
 
 		if err != nil {
-			return sdkdiag.AppendErrorf(diags, "listing AWS Service Access for Organization (%s): %s", d.Id(), err)
+			return sdkdiag.AppendErrorf(diags, "reading Organization (%s) service principals: %s", d.Id(), err)
 		}
 	}
 
-	if err := d.Set("aws_service_access_principals", awsServiceAccessPrincipals); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting aws_service_access_principals: %s", err)
-	}
+	d.Set("aws_service_access_principals", awsServiceAccessPrincipals)
 
-	enabledPolicyTypes := make([]string, 0)
+	var enabledPolicyTypes []string
 
 	for _, policyType := range roots[0].PolicyTypes {
 		if aws.StringValue(policyType.Status) == organizations.PolicyTypeStatusEnabled {
@@ -323,9 +302,7 @@ func resourceOrganizationRead(ctx context.Context, d *schema.ResourceData, meta
 		}
 	}
 
-	if err := d.Set("enabled_policy_types", enabledPolicyTypes); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting enabled_policy_types: %s", err)
-	}
+	d.Set("enabled_policy_types", enabledPolicyTypes)
 
 	return diags
 }
@@ -335,35 +312,25 @@ func resourceOrganizationUpdate(ctx context.Context, d *schema.ResourceData, met
 	conn := meta.(*conns.AWSClient).OrganizationsConn(ctx)
 
 	if d.HasChange("aws_service_access_principals") {
-		oldRaw, newRaw := d.GetChange("aws_service_access_principals")
-		oldSet := oldRaw.(*schema.Set)
-		newSet := newRaw.(*schema.Set)
+		o, n := d.GetChange("aws_service_access_principals")
+		os, ns := o.(*schema.Set), n.(*schema.Set)
+		add, del := flex.ExpandStringValueSet(ns.Difference(os)), flex.ExpandStringValueSet(os.Difference(ns))
 
-		for _, disablePrincipalRaw := range oldSet.Difference(newSet).List() {
-			principal := disablePrincipalRaw.(string)
-			input := &organizations.DisableAWSServiceAccessInput{
-				ServicePrincipal: aws.String(principal),
-			}
-
-			log.Printf("[DEBUG] Disabling AWS Service Access in Organization: %s", input)
-			_, err := conn.DisableAWSServiceAccessWithContext(ctx, input)
-
-			if err != nil {
-				return sdkdiag.AppendErrorf(diags, "disabling AWS Service Access (%s) in Organization: %s", principal, err)
+		for _, principal := range del {
+			if err := DisableServicePrincipal(ctx, conn, principal); err != nil {
+				return sdkdiag.AppendErrorf(diags, "disabling AWS Service Access (%s) in Organization (%s): %s", principal, d.Id(), err)
 			}
 		}
 
-		for _, enablePrincipalRaw := range newSet.Difference(oldSet).List() {
-			principal := enablePrincipalRaw.(string)
+		for _, principal := range add {
 			input := &organizations.EnableAWSServiceAccessInput{
 				ServicePrincipal: aws.String(principal),
 			}
 
-			log.Printf("[DEBUG] Enabling AWS Service Access in Organization: %s", input)
 			_, err := conn.EnableAWSServiceAccessWithContext(ctx, input)
 
 			if err != nil {
-				return sdkdiag.AppendErrorf(diags, "enabling AWS Service Access (%s) in Organization: %s", principal, err)
+				return sdkdiag.AppendErrorf(diags, "enabling AWS Service Access (%s) in Organization (%s): %s", principal, d.Id(), err)
 			}
 		}
 	}
@@ -371,40 +338,36 @@ func resourceOrganizationUpdate(ctx context.Context, d *schema.ResourceData, met
 	if d.HasChange("enabled_policy_types") {
 		defaultRootID := d.Get("roots.0.id").(string)
 		o, n := d.GetChange("enabled_policy_types")
-		oldSet := o.(*schema.Set)
-		newSet := n.(*schema.Set)
+		os, ns := o.(*schema.Set), n.(*schema.Set)
+		add, del := flex.ExpandStringValueSet(ns.Difference(os)), flex.ExpandStringValueSet(os.Difference(ns))
 
-		for _, v := range oldSet.Difference(newSet).List() {
-			policyType := v.(string)
+		for _, policyType := range del {
 			input := &organizations.DisablePolicyTypeInput{
 				PolicyType: aws.String(policyType),
 				RootId:     aws.String(defaultRootID),
 			}
 
-			log.Printf("[DEBUG] Disabling Policy Type in Organization: %s", input)
 			if _, err := conn.DisablePolicyTypeWithContext(ctx, input); err != nil {
 				return sdkdiag.AppendErrorf(diags, "disabling policy type (%s) in Organization (%s) Root (%s): %s", policyType, d.Id(), defaultRootID, err)
 			}
 
-			if err := waitForOrganizationDefaultRootPolicyTypeDisable(ctx, conn, policyType); err != nil {
-				return sdkdiag.AppendErrorf(diags, "waiting for policy type (%s) disabling in Organization (%s) Root (%s): %s", policyType, d.Id(), defaultRootID, err)
+			if err := waitDefaultRootPolicyTypeDisabled(ctx, conn, policyType); err != nil {
+				return sdkdiag.AppendErrorf(diags, "waiting for policy type (%s) in Organization (%s) disable: %s", policyType, d.Id(), err)
 			}
 		}
 
-		for _, v := range newSet.Difference(oldSet).List() {
-			policyType := v.(string)
+		for _, policyType := range add {
 			input := &organizations.EnablePolicyTypeInput{
 				PolicyType: aws.String(policyType),
 				RootId:     aws.String(defaultRootID),
 			}
 
-			log.Printf("[DEBUG] Enabling Policy Type in Organization: %s", input)
 			if _, err := conn.EnablePolicyTypeWithContext(ctx, input); err != nil {
 				return sdkdiag.AppendErrorf(diags, "enabling policy type (%s) in Organization (%s) Root (%s): %s", policyType, d.Id(), defaultRootID, err)
 			}
 
-			if err := waitForOrganizationDefaultRootPolicyTypeEnable(ctx, conn, policyType); err != nil {
-				return sdkdiag.AppendErrorf(diags, "waiting for policy type (%s) enabling in Organization (%s) Root (%s): %s", policyType, d.Id(), defaultRootID, err)
+			if err := waitDefaultRootPolicyTypeEnabled(ctx, conn, policyType); err != nil {
+				return sdkdiag.AppendErrorf(diags, "waiting for policy type (%s) in Organization (%s) enable: %s", policyType, d.Id(), err)
 			}
 		}
 	}
@@ -423,15 +386,33 @@ func resourceOrganizationDelete(ctx context.Context, d *schema.ResourceData, met
 	conn := meta.(*conns.AWSClient).OrganizationsConn(ctx)
 
 	log.Printf("[INFO] Deleting Organization: %s", d.Id())
-
 	_, err := conn.DeleteOrganizationWithContext(ctx, &organizations.DeleteOrganizationInput{})
+
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "deleting Organization: %s", err)
+		return sdkdiag.AppendErrorf(diags, "deleting Organization (%s): %s", d.Id(), err)
 	}
 
 	return diags
 }
 
+func resourceOrganizationImport(ctx context.Context, d *schema.ResourceData, meta interface{}) ([]*schema.ResourceData, error) {
+	conn := meta.(*conns.AWSClient).OrganizationsConn(ctx)
+
+	org, err := FindOrganization(ctx, conn)
+
+	if err != nil {
+		return nil, err
+	}
+
+	// Check that any Org ID specified for import matches the current Org ID.
+	if got, want := aws.StringValue(org.Id), d.Id(); got != want {
+		return nil, fmt.Errorf("current Organization ID (%s) does not match (%s)", got, want)
+	}
+
+	return []*schema.ResourceData{d}, nil
+}
+
+// FindOrganization is called from the acctest package and so can't be made private and exported as "test-only".
 func FindOrganization(ctx context.Context, conn *organizations.Organizations) (*organizations.Organization, error) {
 	input := &organizations.DescribeOrganizationInput{}
 
@@ -476,6 +457,75 @@ func findAccounts(ctx context.Context, conn *organizations.Organizations) ([]*or
 	return output, nil
 }
 
+// FindEnabledServicePrincipalNames is called from the service/ram package.
+func FindEnabledServicePrincipalNames(ctx context.Context, conn *organizations.Organizations) ([]string, error) {
+	output, err := findEnabledServicePrincipals(ctx, conn)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return tfslices.ApplyToAll(output, func(v *organizations.EnabledServicePrincipal) string {
+		return aws.StringValue(v.ServicePrincipal)
+	}), nil
+}
+
+func findEnabledServicePrincipals(ctx context.Context, conn *organizations.Organizations) ([]*organizations.EnabledServicePrincipal, error) {
+	input := &organizations.ListAWSServiceAccessForOrganizationInput{}
+	var output []*organizations.EnabledServicePrincipal
+
+	err := conn.ListAWSServiceAccessForOrganizationPagesWithContext(ctx, input, func(page *organizations.ListAWSServiceAccessForOrganizationOutput, lastPage bool) bool {
+		if page == nil {
+			return !lastPage
+		}
+
+		output = append(output, page.EnabledServicePrincipals...)
+
+		return !lastPage
+	})
+
+	if err != nil {
+		return nil, err
+	}
+
+	return output, nil
+}
+
+func findRoots(ctx context.Context, conn *organizations.Organizations) ([]*organizations.Root, error) {
+	input := &organizations.ListRootsInput{}
+	var output []*organizations.Root
+
+	err := conn.ListRootsPagesWithContext(ctx, input, func(page *organizations.ListRootsOutput, lastPage bool) bool {
+		if page == nil {
+			return !lastPage
+		}
+
+		output = append(output, page.Roots...)
+
+		return !lastPage
+	})
+
+	if err != nil {
+		return nil, err
+	}
+
+	return output, nil
+}
+
+func findDefaultRoot(ctx context.Context, conn *organizations.Organizations) (*organizations.Root, error) {
+	output, err := findRoots(ctx, conn)
+
+	if err != nil {
+		return nil, err
+	}
+
+	if len(output) == 0 || output[0] == nil {
+		return nil, tfresource.NewEmptyResultError(nil)
+	}
+
+	return output[0], nil
+}
+
 func flattenAccounts(accounts []*organizations.Account) []map[string]interface{} {
 	if len(accounts) == 0 {
 		return nil
@@ -493,7 +543,7 @@ func flattenAccounts(accounts []*organizations.Account) []map[string]interface{}
 	return result
 }
 
-func FlattenRoots(roots []*organizations.Root) []map[string]interface{} {
+func flattenRoots(roots []*organizations.Root) []map[string]interface{} {
 	if len(roots) == 0 {
 		return nil
 	}
@@ -523,37 +573,17 @@ func flattenRootPolicyTypeSummaries(summaries []*organizations.PolicyTypeSummary
 	return result
 }
 
-func getOrganizationDefaultRoot(ctx context.Context, conn *organizations.Organizations) (*organizations.Root, error) {
-	var roots []*organizations.Root
-
-	err := conn.ListRootsPagesWithContext(ctx, &organizations.ListRootsInput{}, func(page *organizations.ListRootsOutput, lastPage bool) bool {
-		roots = append(roots, page.Roots...)
-
-		return !lastPage
-	})
-
-	if err != nil {
-		return nil, err
-	}
-
-	if len(roots) == 0 {
-		return nil, fmt.Errorf("no roots found")
-	}
-
-	return roots[0], nil
-}
-
-func getOrganizationDefaultRootPolicyTypeRefreshFunc(ctx context.Context, conn *organizations.Organizations, policyType string) retry.StateRefreshFunc {
+func statusDefaultRootPolicyType(ctx context.Context, conn *organizations.Organizations, policyType string) retry.StateRefreshFunc {
 	return func() (interface{}, string, error) {
-		defaultRoot, err := getOrganizationDefaultRoot(ctx, conn)
+		defaultRoot, err := findDefaultRoot(ctx, conn)
 
 		if err != nil {
-			return nil, "", fmt.Errorf("getting default root: %s", err)
+			return nil, "", err
 		}
 
-		for _, pt := range defaultRoot.PolicyTypes {
-			if aws.StringValue(pt.Type) == policyType {
-				return pt, aws.StringValue(pt.Status), nil
+		for _, v := range defaultRoot.PolicyTypes {
+			if aws.StringValue(v.Type) == policyType {
+				return v, aws.StringValue(v.Status), nil
 			}
 		}
 
@@ -561,14 +591,13 @@ func getOrganizationDefaultRootPolicyTypeRefreshFunc(ctx context.Context, conn *
 	}
 }
 
-func waitForOrganizationDefaultRootPolicyTypeDisable(ctx context.Context, conn *organizations.Organizations, policyType string) error {
+const policyTypeStatusDisabled = "DISABLED"
+
+func waitDefaultRootPolicyTypeDisabled(ctx context.Context, conn *organizations.Organizations, policyType string) error {
 	stateConf := &retry.StateChangeConf{
-		Pending: []string{
-			organizations.PolicyTypeStatusEnabled,
-			organizations.PolicyTypeStatusPendingDisable,
-		},
+		Pending: []string{organizations.PolicyTypeStatusEnabled, organizations.PolicyTypeStatusPendingDisable},
 		Target:  []string{policyTypeStatusDisabled},
-		Refresh: getOrganizationDefaultRootPolicyTypeRefreshFunc(ctx, conn, policyType),
+		Refresh: statusDefaultRootPolicyType(ctx, conn, policyType),
 		Timeout: 5 * time.Minute,
 	}
 
@@ -577,14 +606,11 @@ func waitForOrganizationDefaultRootPolicyTypeDisable(ctx context.Context, conn *
 	return err
 }
 
-func waitForOrganizationDefaultRootPolicyTypeEnable(ctx context.Context, conn *organizations.Organizations, policyType string) error {
+func waitDefaultRootPolicyTypeEnabled(ctx context.Context, conn *organizations.Organizations, policyType string) error {
 	stateConf := &retry.StateChangeConf{
-		Pending: []string{
-			policyTypeStatusDisabled,
-			organizations.PolicyTypeStatusPendingEnable,
-		},
+		Pending: []string{policyTypeStatusDisabled, organizations.PolicyTypeStatusPendingEnable},
 		Target:  []string{organizations.PolicyTypeStatusEnabled},
-		Refresh: getOrganizationDefaultRootPolicyTypeRefreshFunc(ctx, conn, policyType),
+		Refresh: statusDefaultRootPolicyType(ctx, conn, policyType),
 		Timeout: 5 * time.Minute,
 	}
 
@@ -592,3 +618,14 @@ func waitForOrganizationDefaultRootPolicyTypeEnable(ctx context.Context, conn *o
 
 	return err
 }
+
+// DisableServicePrincipal is called from the service/ram package.
+func DisableServicePrincipal(ctx context.Context, conn *organizations.Organizations, servicePrincipal string) error {
+	input := &organizations.DisableAWSServiceAccessInput{
+		ServicePrincipal: aws.String(servicePrincipal),
+	}
+
+	_, err := conn.DisableAWSServiceAccessWithContext(ctx, input)
+
+	return err
+}
diff --git a/internal/service/organizations/organization_data_source.go b/internal/service/organizations/organization_data_source.go
index c719be18843..1ad22204adf 100644
--- a/internal/service/organizations/organization_data_source.go
+++ b/internal/service/organizations/organization_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package organizations
 
 import (
@@ -10,7 +13,7 @@ import (
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
-	"github.com/hashicorp/terraform-provider-aws/internal/slices"
+	tfslices "github.com/hashicorp/terraform-provider-aws/internal/slices"
 )
 
 // @SDKDataSource("aws_organizations_organization")
@@ -171,40 +174,31 @@ func dataSourceOrganizationRead(ctx context.Context, d *schema.ResourceData, met
 
 	if err != nil {
 		if isManagementAccount || !tfawserr.ErrCodeEquals(err, organizations.ErrCodeAccessDeniedException) {
-			return sdkdiag.AppendErrorf(diags, "reading Organizations Accounts: %s", err)
+			return sdkdiag.AppendErrorf(diags, "reading Organization (%s) accounts: %s", d.Id(), err)
 		}
 
 		isDelegatedAdministrator = false
 	}
 
 	if isManagementAccount || isDelegatedAdministrator {
-		nonManagementAccounts := slices.Filter(accounts, func(v *organizations.Account) bool {
+		nonManagementAccounts := tfslices.Filter(accounts, func(v *organizations.Account) bool {
 			return aws.StringValue(v.Id) != managementAccountID
 		})
 
-		var roots []*organizations.Root
-
-		err = conn.ListRootsPagesWithContext(ctx, &organizations.ListRootsInput{}, func(page *organizations.ListRootsOutput, lastPage bool) bool {
-			roots = append(roots, page.Roots...)
-			return !lastPage
-		})
+		roots, err := findRoots(ctx, conn)
 
 		if err != nil {
-			return sdkdiag.AppendErrorf(diags, "reading Organizations roots: %s", err)
+			return sdkdiag.AppendErrorf(diags, "reading Organization (%s) roots: %s", d.Id(), err)
 		}
 
-		awsServiceAccessPrincipals := make([]string, 0)
+		var awsServiceAccessPrincipals []string
+
 		// ConstraintViolationException: The request failed because the organization does not have all features enabled. Please enable all features in your organization and then retry.
 		if aws.StringValue(org.FeatureSet) == organizations.OrganizationFeatureSetAll {
-			err := conn.ListAWSServiceAccessForOrganizationPagesWithContext(ctx, &organizations.ListAWSServiceAccessForOrganizationInput{}, func(page *organizations.ListAWSServiceAccessForOrganizationOutput, lastPage bool) bool {
-				for _, enabledServicePrincipal := range page.EnabledServicePrincipals {
-					awsServiceAccessPrincipals = append(awsServiceAccessPrincipals, aws.StringValue(enabledServicePrincipal.ServicePrincipal))
-				}
-				return !lastPage
-			})
+			awsServiceAccessPrincipals, err = FindEnabledServicePrincipalNames(ctx, conn)
 
 			if err != nil {
-				return sdkdiag.AppendErrorf(diags, "reading Organizations AWS service access: %s", err)
+				return sdkdiag.AppendErrorf(diags, "reading Organization (%s) service principals: %s", d.Id(), err)
 			}
 		}
 
@@ -219,20 +213,12 @@ func dataSourceOrganizationRead(ctx context.Context, d *schema.ResourceData, met
 		if err := d.Set("accounts", flattenAccounts(accounts)); err != nil {
 			return sdkdiag.AppendErrorf(diags, "setting accounts: %s", err)
 		}
-
-		if err := d.Set("aws_service_access_principals", awsServiceAccessPrincipals); err != nil {
-			return sdkdiag.AppendErrorf(diags, "setting aws_service_access_principals: %s", err)
-		}
-
-		if err := d.Set("enabled_policy_types", enabledPolicyTypes); err != nil {
-			return sdkdiag.AppendErrorf(diags, "setting enabled_policy_types: %s", err)
-		}
-
+		d.Set("aws_service_access_principals", awsServiceAccessPrincipals)
+		d.Set("enabled_policy_types", enabledPolicyTypes)
 		if err := d.Set("non_master_accounts", flattenAccounts(nonManagementAccounts)); err != nil {
 			return sdkdiag.AppendErrorf(diags, "setting non_master_accounts: %s", err)
 		}
-
-		if err := d.Set("roots", FlattenRoots(roots)); err != nil {
+		if err := d.Set("roots", flattenRoots(roots)); err != nil {
 			return sdkdiag.AppendErrorf(diags, "setting roots: %s", err)
 		}
 	}
diff --git a/internal/service/organizations/organization_data_source_test.go b/internal/service/organizations/organization_data_source_test.go
index 2b10e0c8936..cba89acab25 100644
--- a/internal/service/organizations/organization_data_source_test.go
+++ b/internal/service/organizations/organization_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package organizations_test
 
 import (
@@ -51,6 +54,7 @@ func testAccOrganizationDataSource_memberAccount(t *testing.T) {
 	resource.Test(t, resource.TestCase{
 		PreCheck: func() {
 			acctest.PreCheck(ctx, t)
+			acctest.PreCheckOrganizationsEnabled(ctx, t)
 			acctest.PreCheckOrganizationMemberAccount(ctx, t)
 		},
 		ErrorCheck:               acctest.ErrorCheck(t, organizations.EndpointsID),
diff --git a/internal/service/organizations/organization_test.go b/internal/service/organizations/organization_test.go
index 39d8fd503b5..3fcf1146ebd 100644
--- a/internal/service/organizations/organization_test.go
+++ b/internal/service/organizations/organization_test.go
@@ -1,19 +1,23 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package organizations_test
 
 import (
 	"context"
+	"errors"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/organizations"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	tforganizations "github.com/hashicorp/terraform-provider-aws/internal/service/organizations"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
 func testAccOrganization_basic(t *testing.T) {
@@ -29,21 +33,21 @@ func testAccOrganization_basic(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config: testAccOrganizationConfig_basic,
-				Check: resource.ComposeTestCheckFunc(
+				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckOrganizationExists(ctx, resourceName, &organization),
 					resource.TestCheckResourceAttr(resourceName, "accounts.#", "1"),
 					resource.TestCheckResourceAttrPair(resourceName, "accounts.0.arn", resourceName, "master_account_arn"),
 					resource.TestCheckResourceAttrPair(resourceName, "accounts.0.email", resourceName, "master_account_email"),
 					resource.TestCheckResourceAttrPair(resourceName, "accounts.0.id", resourceName, "master_account_id"),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "organizations", regexp.MustCompile(`organization/o-.+`)),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "organizations", regexache.MustCompile(`organization/o-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "aws_service_access_principals.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "feature_set", organizations.OrganizationFeatureSetAll),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "master_account_arn", "organizations", regexp.MustCompile(`account/o-.+/.+`)),
-					resource.TestMatchResourceAttr(resourceName, "master_account_email", regexp.MustCompile(`.+@.+`)),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "master_account_arn", "organizations", regexache.MustCompile(`account/o-.+/.+`)),
+					resource.TestMatchResourceAttr(resourceName, "master_account_email", regexache.MustCompile(`.+@.+`)),
 					acctest.CheckResourceAttrAccountID(resourceName, "master_account_id"),
 					resource.TestCheckResourceAttr(resourceName, "non_master_accounts.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "roots.#", "1"),
-					resource.TestMatchResourceAttr(resourceName, "roots.0.id", regexp.MustCompile(`r-[a-z0-9]{4,32}`)),
+					resource.TestMatchResourceAttr(resourceName, "roots.0.id", regexache.MustCompile(`r-[0-9a-z]{4,32}`)),
 					resource.TestCheckResourceAttrSet(resourceName, "roots.0.name"),
 					resource.TestCheckResourceAttrSet(resourceName, "roots.0.arn"),
 					resource.TestCheckResourceAttr(resourceName, "roots.0.policy_types.#", "0"),
@@ -58,6 +62,29 @@ func testAccOrganization_basic(t *testing.T) {
 	})
 }
 
+func testAccOrganization_disappears(t *testing.T) {
+	ctx := acctest.Context(t)
+	var organization organizations.Organization
+	resourceName := "aws_organizations_organization.test"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckOrganizationsAccount(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, organizations.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckOrganizationDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccOrganizationConfig_basic,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckOrganizationExists(ctx, resourceName, &organization),
+					acctest.CheckResourceDisappears(ctx, acctest.Provider, tforganizations.ResourceOrganization(), resourceName),
+				),
+				ExpectNonEmptyPlan: true,
+			},
+		},
+	})
+}
+
 func testAccOrganization_serviceAccessPrincipals(t *testing.T) {
 	ctx := acctest.Context(t)
 	var organization organizations.Organization
@@ -299,63 +326,70 @@ func testAccCheckOrganizationDestroy(ctx context.Context) resource.TestCheckFunc
 				continue
 			}
 
-			params := &organizations.DescribeOrganizationInput{}
-
-			resp, err := conn.DescribeOrganizationWithContext(ctx, params)
+			_, err := tforganizations.FindOrganization(ctx, conn)
 
-			if tfawserr.ErrCodeEquals(err, organizations.ErrCodeAWSOrganizationsNotInUseException) {
-				return nil
+			if tfresource.NotFound(err) {
+				continue
 			}
 
 			if err != nil {
 				return err
 			}
 
-			if resp != nil && resp.Organization != nil {
-				return fmt.Errorf("Bad: Organization still exists: %q", rs.Primary.ID)
-			}
+			return errors.New("Organization still exists")
 		}
 
 		return nil
 	}
 }
 
-func testAccCheckOrganizationExists(ctx context.Context, n string, org *organizations.Organization) resource.TestCheckFunc {
+func testAccCheckOrganizationExists(ctx context.Context, n string, v *organizations.Organization) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		rs, ok := s.RootModule().Resources[n]
+		_, ok := s.RootModule().Resources[n]
 		if !ok {
 			return fmt.Errorf("Not found: %s", n)
 		}
 
-		if rs.Primary.ID == "" {
-			return fmt.Errorf("Organization ID not set")
-		}
-
 		conn := acctest.Provider.Meta().(*conns.AWSClient).OrganizationsConn(ctx)
-		params := &organizations.DescribeOrganizationInput{}
 
-		resp, err := conn.DescribeOrganizationWithContext(ctx, params)
+		output, err := tforganizations.FindOrganization(ctx, conn)
 
 		if err != nil {
 			return err
 		}
 
-		if resp == nil || resp.Organization == nil {
-			return fmt.Errorf("Organization %q does not exist", rs.Primary.ID)
-		}
+		*v = *output
 
-		*org = *resp.Organization
+		return nil
+	}
+}
 
+func testAccOrganizationRecreated(before, after *organizations.Organization) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		if aws.StringValue(before.Id) == aws.StringValue(after.Id) {
+			return fmt.Errorf("Organization (%s) not recreated", aws.StringValue(before.Id))
+		}
 		return nil
 	}
 }
 
-const testAccOrganizationConfig_basic = "resource \"aws_organizations_organization\" \"test\" {}"
+func testAccOrganizationNotRecreated(before, after *organizations.Organization) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		if aws.StringValue(before.Id) != aws.StringValue(after.Id) {
+			return fmt.Errorf("Organization (%s) recreated", aws.StringValue(before.Id))
+		}
+		return nil
+	}
+}
+
+const testAccOrganizationConfig_basic = `
+resource "aws_organizations_organization" "test" {}
+`
 
 func testAccOrganizationConfig_serviceAccessPrincipals1(principal1 string) string {
 	return fmt.Sprintf(`
 resource "aws_organizations_organization" "test" {
-  aws_service_access_principals = [%q]
+  aws_service_access_principals = [%[1]q]
 }
 `, principal1)
 }
@@ -363,7 +397,7 @@ resource "aws_organizations_organization" "test" {
 func testAccOrganizationConfig_serviceAccessPrincipals2(principal1, principal2 string) string {
 	return fmt.Sprintf(`
 resource "aws_organizations_organization" "test" {
-  aws_service_access_principals = [%q, %q]
+  aws_service_access_principals = [%[1]q, %[2]q]
 }
 `, principal1, principal2)
 }
@@ -379,86 +413,7 @@ resource "aws_organizations_organization" "test" {
 func testAccOrganizationConfig_featureSet(featureSet string) string {
 	return fmt.Sprintf(`
 resource "aws_organizations_organization" "test" {
-  feature_set = %q
+  feature_set = %[1]q
 }
 `, featureSet)
 }
-
-func TestFlattenRoots(t *testing.T) {
-	t.Parallel()
-
-	roots := []*organizations.Root{
-		{
-			Name: aws.String("Root1"),
-			Arn:  aws.String("arn:1"),
-			Id:   aws.String("r-1"),
-			PolicyTypes: []*organizations.PolicyTypeSummary{
-				{
-					Status: aws.String("ENABLED"),
-					Type:   aws.String("SERVICE_CONTROL_POLICY"),
-				},
-				{
-					Status: aws.String("DISABLED"),
-					Type:   aws.String("SERVICE_CONTROL_POLICY"),
-				},
-			},
-		},
-	}
-	result := tforganizations.FlattenRoots(roots)
-
-	if len(result) != len(roots) {
-		t.Fatalf("expected result to have %d elements, got %d", len(roots), len(result))
-	}
-
-	for i, r := range roots {
-		if aws.StringValue(r.Name) != result[i]["name"] {
-			t.Fatalf(`expected result[%d]["name"] to equal %q, got %q`, i, aws.StringValue(r.Name), result[i]["name"])
-		}
-		if aws.StringValue(r.Arn) != result[i]["arn"] {
-			t.Fatalf(`expected result[%d]["arn"] to equal %q, got %q`, i, aws.StringValue(r.Arn), result[i]["arn"])
-		}
-		if aws.StringValue(r.Id) != result[i]["id"] {
-			t.Fatalf(`expected result[%d]["id"] to equal %q, got %q`, i, aws.StringValue(r.Id), result[i]["id"])
-		}
-		if result[i]["policy_types"] == nil {
-			continue
-		}
-		if types, ok := result[i]["policy_types"].([]map[string]interface{}); ok {
-			testFlattenRootPolicyTypes(t, i, types, r.PolicyTypes)
-			continue
-		}
-		t.Fatalf(`result[%d]["policy_types"] could not be converted to []map[string]interface{}`, i)
-	}
-}
-
-func testFlattenRootPolicyTypes(t *testing.T, index int, result []map[string]interface{}, types []*organizations.PolicyTypeSummary) {
-	if len(result) != len(types) {
-		t.Fatalf(`expected result[%d]["policy_types"] to have %d elements, got %d`, index, len(types), len(result))
-	}
-	for i, v := range types {
-		if aws.StringValue(v.Status) != result[i]["status"] {
-			t.Fatalf(`expected result[%d]["policy_types"][%d]["status"] to equal %q, got %q`, index, i, aws.StringValue(v.Status), result[i]["status"])
-		}
-		if aws.StringValue(v.Type) != result[i]["type"] {
-			t.Fatalf(`expected result[%d]["policy_types"][%d]["type"] to equal %q, got %q`, index, i, aws.StringValue(v.Type), result[i]["type"])
-		}
-	}
-}
-
-func testAccOrganizationRecreated(before, after *organizations.Organization) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		if aws.StringValue(before.Id) == aws.StringValue(after.Id) {
-			return fmt.Errorf("Organization (%s) not recreated", aws.StringValue(before.Id))
-		}
-		return nil
-	}
-}
-
-func testAccOrganizationNotRecreated(before, after *organizations.Organization) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		if aws.StringValue(before.Id) != aws.StringValue(after.Id) {
-			return fmt.Errorf("Organization (%s) recreated", aws.StringValue(before.Id))
-		}
-		return nil
-	}
-}
diff --git a/internal/service/organizations/organizational_unit.go b/internal/service/organizations/organizational_unit.go
index ba33c024c67..6030b63a5cd 100644
--- a/internal/service/organizations/organizational_unit.go
+++ b/internal/service/organizations/organizational_unit.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package organizations
 
 import (
 	"context"
 	"log"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/organizations"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -29,6 +32,7 @@ func ResourceOrganizationalUnit() *schema.Resource {
 		ReadWithoutTimeout:   resourceOrganizationalUnitRead,
 		UpdateWithoutTimeout: resourceOrganizationalUnitUpdate,
 		DeleteWithoutTimeout: resourceOrganizationalUnitDelete,
+
 		Importer: &schema.ResourceImporter{
 			StateContext: schema.ImportStatePassthroughContext,
 		},
@@ -68,10 +72,10 @@ func ResourceOrganizationalUnit() *schema.Resource {
 				ValidateFunc: validation.StringLenBetween(1, 128),
 			},
 			"parent_id": {
-				ForceNew:     true,
 				Type:         schema.TypeString,
 				Required:     true,
-				ValidateFunc: validation.StringMatch(regexp.MustCompile("^(r-[0-9a-z]{4,32})|(ou-[0-9a-z]{4,32}-[a-z0-9]{8,32})$"), "see https://docs.aws.amazon.com/organizations/latest/APIReference/API_CreateOrganizationalUnit.html#organizations-CreateOrganizationalUnit-request-ParentId"),
+				ForceNew:     true,
+				ValidateFunc: validation.StringMatch(regexache.MustCompile("^(r-[0-9a-z]{4,32})|(ou-[0-9a-z]{4,32}-[0-9a-z]{8,32})$"), "see https://docs.aws.amazon.com/organizations/latest/APIReference/API_CreateOrganizationalUnit.html#organizations-CreateOrganizationalUnit-request-ParentId"),
 			},
 			names.AttrTags:    tftags.TagsSchema(),
 			names.AttrTagsAll: tftags.TagsSchemaComputed(),
@@ -85,38 +89,22 @@ func resourceOrganizationalUnitCreate(ctx context.Context, d *schema.ResourceDat
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).OrganizationsConn(ctx)
 
-	// Create the organizational unit
-	createOpts := &organizations.CreateOrganizationalUnitInput{
-		Name:     aws.String(d.Get("name").(string)),
+	name := d.Get("name").(string)
+	input := &organizations.CreateOrganizationalUnitInput{
+		Name:     aws.String(name),
 		ParentId: aws.String(d.Get("parent_id").(string)),
 		Tags:     getTagsIn(ctx),
 	}
 
-	var err error
-	var resp *organizations.CreateOrganizationalUnitOutput
-	err = retry.RetryContext(ctx, 4*time.Minute, func() *retry.RetryError {
-		resp, err = conn.CreateOrganizationalUnitWithContext(ctx, createOpts)
-
-		if tfawserr.ErrCodeEquals(err, organizations.ErrCodeFinalizingOrganizationException) {
-			return retry.RetryableError(err)
-		}
-
-		if err != nil {
-			return retry.NonRetryableError(err)
-		}
-
-		return nil
-	})
-	if tfresource.TimedOut(err) {
-		resp, err = conn.CreateOrganizationalUnitWithContext(ctx, createOpts)
-	}
+	outputRaw, err := tfresource.RetryWhenAWSErrCodeEquals(ctx, 4*time.Minute, func() (interface{}, error) {
+		return conn.CreateOrganizationalUnitWithContext(ctx, input)
+	}, organizations.ErrCodeFinalizingOrganizationException)
 
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "creating Organizations Organizational Unit: %s", err)
+		return sdkdiag.AppendErrorf(diags, "creating Organizations Organizational Unit (%s): %s", name, err)
 	}
 
-	// Store the ID
-	d.SetId(aws.StringValue(resp.OrganizationalUnit.Id))
+	d.SetId(aws.StringValue(outputRaw.(*organizations.CreateOrganizationalUnitOutput).OrganizationalUnit.Id))
 
 	return append(diags, resourceOrganizationalUnitRead(ctx, d, meta)...)
 }
@@ -125,12 +113,9 @@ func resourceOrganizationalUnitRead(ctx context.Context, d *schema.ResourceData,
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).OrganizationsConn(ctx)
 
-	describeOpts := &organizations.DescribeOrganizationalUnitInput{
-		OrganizationalUnitId: aws.String(d.Id()),
-	}
-	resp, err := conn.DescribeOrganizationalUnitWithContext(ctx, describeOpts)
+	ou, err := findOrganizationalUnitByID(ctx, conn, d.Id())
 
-	if !d.IsNewResource() && tfawserr.ErrCodeEquals(err, organizations.ErrCodeOrganizationalUnitNotFoundException) {
+	if !d.IsNewResource() && tfresource.NotFound(err) {
 		log.Printf("[WARN] Organizations Organizational Unit (%s) does not exist, removing from state", d.Id())
 		d.SetId("")
 		return diags
@@ -140,49 +125,24 @@ func resourceOrganizationalUnitRead(ctx context.Context, d *schema.ResourceData,
 		return sdkdiag.AppendErrorf(diags, "reading Organizations Organizational Unit (%s): %s", d.Id(), err)
 	}
 
-	if resp == nil {
-		return sdkdiag.AppendErrorf(diags, "reading Organizations Organizational Unit (%s): empty response", d.Id())
-	}
-
-	ou := resp.OrganizationalUnit
-	if ou == nil {
-		if d.IsNewResource() {
-			return sdkdiag.AppendErrorf(diags, "reading Organizations Organizational Unit (%s): not found after creation", d.Id())
-		}
-
-		log.Printf("[WARN] Organizations Organizational Unit (%s) does not exist, removing from state", d.Id())
-		d.SetId("")
-		return diags
-	}
-
-	parentId, err := resourceOrganizationalUnitGetParentID(ctx, conn, d.Id())
+	parentAccountID, err := findParentAccountID(ctx, conn, d.Id())
 
 	if err != nil {
 		return sdkdiag.AppendErrorf(diags, "listing Organizations Organizational Unit (%s) parents: %s", d.Id(), err)
 	}
 
-	var accounts []*organizations.Account
-	input := &organizations.ListAccountsForParentInput{
-		ParentId: aws.String(d.Id()),
-	}
-
-	err = conn.ListAccountsForParentPagesWithContext(ctx, input, func(page *organizations.ListAccountsForParentOutput, lastPage bool) bool {
-		accounts = append(accounts, page.Accounts...)
-
-		return !lastPage
-	})
+	accounts, err := findAccountsForParent(ctx, conn, d.Id())
 
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "listing Organizations Organizational Unit (%s) accounts: %s", d.Id(), err)
+		return sdkdiag.AppendErrorf(diags, "listing Organizations Accounts for parent (%s): %s", d.Id(), err)
 	}
 
 	if err := d.Set("accounts", flattenOrganizationalUnitAccounts(accounts)); err != nil {
 		return sdkdiag.AppendErrorf(diags, "setting accounts: %s", err)
 	}
-
 	d.Set("arn", ou.Arn)
 	d.Set("name", ou.Name)
-	d.Set("parent_id", parentId)
+	d.Set("parent_id", parentAccountID)
 
 	return diags
 }
@@ -192,12 +152,13 @@ func resourceOrganizationalUnitUpdate(ctx context.Context, d *schema.ResourceDat
 	conn := meta.(*conns.AWSClient).OrganizationsConn(ctx)
 
 	if d.HasChange("name") {
-		updateOpts := &organizations.UpdateOrganizationalUnitInput{
+		input := &organizations.UpdateOrganizationalUnitInput{
 			Name:                 aws.String(d.Get("name").(string)),
 			OrganizationalUnitId: aws.String(d.Id()),
 		}
 
-		_, err := conn.UpdateOrganizationalUnitWithContext(ctx, updateOpts)
+		_, err := conn.UpdateOrganizationalUnitWithContext(ctx, input)
+
 		if err != nil {
 			return sdkdiag.AppendErrorf(diags, "updating Organizations Organizational Unit (%s): %s", d.Id(), err)
 		}
@@ -210,11 +171,10 @@ func resourceOrganizationalUnitDelete(ctx context.Context, d *schema.ResourceDat
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).OrganizationsConn(ctx)
 
-	input := &organizations.DeleteOrganizationalUnitInput{
+	log.Printf("[DEBUG] Deleting Organizations Organizational Unit: %s", d.Id())
+	_, err := conn.DeleteOrganizationalUnitWithContext(ctx, &organizations.DeleteOrganizationalUnitInput{
 		OrganizationalUnitId: aws.String(d.Id()),
-	}
-
-	_, err := conn.DeleteOrganizationalUnitWithContext(ctx, input)
+	})
 
 	if tfawserr.ErrCodeEquals(err, organizations.ErrCodeOrganizationalUnitNotFoundException) {
 		return diags
@@ -227,34 +187,33 @@ func resourceOrganizationalUnitDelete(ctx context.Context, d *schema.ResourceDat
 	return diags
 }
 
-func resourceOrganizationalUnitGetParentID(ctx context.Context, conn *organizations.Organizations, childId string) (string, error) {
-	input := &organizations.ListParentsInput{
-		ChildId: aws.String(childId),
+func findOrganizationalUnitByID(ctx context.Context, conn *organizations.Organizations, id string) (*organizations.OrganizationalUnit, error) {
+	input := &organizations.DescribeOrganizationalUnitInput{
+		OrganizationalUnitId: aws.String(id),
 	}
-	var parents []*organizations.Parent
 
-	err := conn.ListParentsPagesWithContext(ctx, input, func(page *organizations.ListParentsOutput, lastPage bool) bool {
-		if page == nil {
-			return !lastPage
-		}
+	return findOrganizationalUnit(ctx, conn, input)
+}
 
-		parents = append(parents, page.Parents...)
+func findOrganizationalUnit(ctx context.Context, conn *organizations.Organizations, input *organizations.DescribeOrganizationalUnitInput) (*organizations.OrganizationalUnit, error) {
+	output, err := conn.DescribeOrganizationalUnitWithContext(ctx, input)
 
-		return !lastPage
-	})
+	if tfawserr.ErrCodeEquals(err, organizations.ErrCodeAWSOrganizationsNotInUseException, organizations.ErrCodeOrganizationalUnitNotFoundException) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
 
 	if err != nil {
-		return "", err
+		return nil, err
 	}
 
-	if len(parents) == 0 {
-		return "", nil
+	if output == nil || output.OrganizationalUnit == nil {
+		return nil, tfresource.NewEmptyResultError(input)
 	}
 
-	// assume there is only a single parent
-	// https://docs.aws.amazon.com/organizations/latest/APIReference/API_ListParents.html
-	parent := parents[0]
-	return aws.StringValue(parent.Id), nil
+	return output.OrganizationalUnit, nil
 }
 
 func flattenOrganizationalUnitAccounts(accounts []*organizations.Account) []map[string]interface{} {
diff --git a/internal/service/organizations/organizational_unit_child_accounts_data_source.go b/internal/service/organizations/organizational_unit_child_accounts_data_source.go
index ddf1a828d9d..022e98c6027 100644
--- a/internal/service/organizations/organizational_unit_child_accounts_data_source.go
+++ b/internal/service/organizations/organizational_unit_child_accounts_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package organizations
 
 import (
diff --git a/internal/service/organizations/organizational_unit_child_accounts_data_source_test.go b/internal/service/organizations/organizational_unit_child_accounts_data_source_test.go
index 8ad1677779d..7e2a30bae3b 100644
--- a/internal/service/organizations/organizational_unit_child_accounts_data_source_test.go
+++ b/internal/service/organizations/organizational_unit_child_accounts_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package organizations_test
 
 import (
diff --git a/internal/service/organizations/organizational_unit_data_source.go b/internal/service/organizations/organizational_unit_data_source.go
new file mode 100644
index 00000000000..db18e0cf5c7
--- /dev/null
+++ b/internal/service/organizations/organizational_unit_data_source.go
@@ -0,0 +1,64 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package organizations
+
+import (
+	"context"
+
+	"github.com/YakDriver/regexache"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/organizations"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
+)
+
+// @SDKDataSource("aws_organizations_organizational_unit", name="Organizational Unit")
+func DataSourceOrganizationalUnit() *schema.Resource {
+	return &schema.Resource{
+		ReadWithoutTimeout: dataSourceOrganizationalUnitRead,
+
+		Schema: map[string]*schema.Schema{
+			"arn": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"name": {
+				Type:     schema.TypeString,
+				Required: true,
+			},
+			"parent_id": {
+				Type:         schema.TypeString,
+				Required:     true,
+				ValidateFunc: validation.StringMatch(regexache.MustCompile("^(r-[0-9a-z]{4,32})|(ou-[0-9a-z]{4,32}-[0-9a-z]{8,32})$"), "see https://docs.aws.amazon.com/organizations/latest/APIReference/API_CreateOrganizationalUnit.html#organizations-CreateOrganizationalUnit-request-ParentId"),
+			},
+		},
+	}
+}
+
+func dataSourceOrganizationalUnitRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).OrganizationsConn(ctx)
+
+	name := d.Get("name").(string)
+	parentID := d.Get("parent_id").(string)
+	input := &organizations.ListOrganizationalUnitsForParentInput{
+		ParentId: aws.String(parentID),
+	}
+
+	ou, err := findOrganizationalUnitForParent(ctx, conn, input, func(v *organizations.OrganizationalUnit) bool {
+		return aws.StringValue(v.Name) == name
+	})
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "reading Organizations Organizational Unit (%s/%s): %s", parentID, name, err)
+	}
+
+	d.SetId(aws.StringValue(ou.Id))
+	d.Set("arn", ou.Arn)
+
+	return diags
+}
diff --git a/internal/service/organizations/organizational_unit_data_source_test.go b/internal/service/organizations/organizational_unit_data_source_test.go
new file mode 100644
index 00000000000..9be7b14f2bd
--- /dev/null
+++ b/internal/service/organizations/organizational_unit_data_source_test.go
@@ -0,0 +1,59 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package organizations_test
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/aws/aws-sdk-go/service/organizations"
+	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
+)
+
+func testAccOrganizationalUnitDataSource_basic(t *testing.T) {
+	ctx := acctest.Context(t)
+	resourceName := "aws_organizations_organizational_unit.child"
+	dataSourceName := "data.aws_organizations_organizational_unit.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+
+	resource.Test(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckOrganizationManagementAccount(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, organizations.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccOrganizationalUnitDataSourceConfig_basic(rName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					resource.TestCheckResourceAttrPair(dataSourceName, "arn", resourceName, "arn"),
+				),
+			},
+		},
+	})
+}
+
+func testAccOrganizationalUnitDataSourceConfig_basic(rName string) string {
+	return fmt.Sprintf(`
+data "aws_organizations_organization" "current" {}
+
+resource "aws_organizations_organizational_unit" "parent" {
+  name      = %[1]q
+  parent_id = data.aws_organizations_organization.current.roots[0].id
+}
+
+resource "aws_organizations_organizational_unit" "child" {
+  name      = %[1]q
+  parent_id = aws_organizations_organizational_unit.parent.id
+}
+
+data "aws_organizations_organizational_unit" "test" {
+  name      = aws_organizations_organizational_unit.child.name
+  parent_id = aws_organizations_organizational_unit.parent.id
+}
+`, rName)
+}
diff --git a/internal/service/organizations/organizational_unit_descendant_accounts_data_source.go b/internal/service/organizations/organizational_unit_descendant_accounts_data_source.go
index d88a0cf9a4b..091d9b66148 100644
--- a/internal/service/organizations/organizational_unit_descendant_accounts_data_source.go
+++ b/internal/service/organizations/organizational_unit_descendant_accounts_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package organizations
 
 import (
@@ -85,7 +88,7 @@ func findAllAccountsForParentAndBelow(ctx context.Context, conn *organizations.O
 
 	output = append(output, accounts...)
 
-	ous, err := findOUsForParent(ctx, conn, id)
+	ous, err := findOrganizationalUnitsForParentByID(ctx, conn, id)
 
 	if err != nil {
 		return nil, err
diff --git a/internal/service/organizations/organizational_unit_descendant_accounts_data_source_test.go b/internal/service/organizations/organizational_unit_descendant_accounts_data_source_test.go
index b9b710ad63c..9c5f1eaeedb 100644
--- a/internal/service/organizations/organizational_unit_descendant_accounts_data_source_test.go
+++ b/internal/service/organizations/organizational_unit_descendant_accounts_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package organizations_test
 
 import (
diff --git a/internal/service/organizations/organizational_unit_test.go b/internal/service/organizations/organizational_unit_test.go
index 9a5a5695291..d4a66ca98f8 100644
--- a/internal/service/organizations/organizational_unit_test.go
+++ b/internal/service/organizations/organizational_unit_test.go
@@ -1,42 +1,45 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package organizations_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
 	"github.com/aws/aws-sdk-go/service/organizations"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	tforganizations "github.com/hashicorp/terraform-provider-aws/internal/service/organizations"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
 func testAccOrganizationalUnit_basic(t *testing.T) {
 	ctx := acctest.Context(t)
 	var unit organizations.OrganizationalUnit
-
-	rInt := sdkacctest.RandInt()
-	name := fmt.Sprintf("tf_outest_%d", rInt)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_organizations_organizational_unit.test"
 
 	resource.Test(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckOrganizationsAccount(ctx, t) },
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckOrganizationManagementAccount(ctx, t)
+		},
 		ErrorCheck:               acctest.ErrorCheck(t, organizations.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckOrganizationalUnitDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccOrganizationalUnitConfig_basic(name),
+				Config: testAccOrganizationalUnitConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckOrganizationalUnitExists(ctx, resourceName, &unit),
 					resource.TestCheckResourceAttr(resourceName, "accounts.#", "0"),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "organizations", regexp.MustCompile(`ou/o-.+/ou-.+`)),
-					resource.TestCheckResourceAttr(resourceName, "name", name),
+					resource.TestCheckResourceAttrSet(resourceName, "arn"),
+					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 				),
 			},
@@ -52,19 +55,20 @@ func testAccOrganizationalUnit_basic(t *testing.T) {
 func testAccOrganizationalUnit_disappears(t *testing.T) {
 	ctx := acctest.Context(t)
 	var unit organizations.OrganizationalUnit
-
-	rInt := sdkacctest.RandInt()
-	name := fmt.Sprintf("tf_outest_%d", rInt)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_organizations_organizational_unit.test"
 
 	resource.Test(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckOrganizationsAccount(ctx, t) },
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckOrganizationManagementAccount(ctx, t)
+		},
 		ErrorCheck:               acctest.ErrorCheck(t, organizations.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckOrganizationalUnitDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccOrganizationalUnitConfig_basic(name),
+				Config: testAccOrganizationalUnitConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckOrganizationalUnitExists(ctx, resourceName, &unit),
 					acctest.CheckResourceDisappears(ctx, acctest.Provider, tforganizations.ResourceOrganizationalUnit(), resourceName),
@@ -75,26 +79,27 @@ func testAccOrganizationalUnit_disappears(t *testing.T) {
 	})
 }
 
-func testAccOrganizationalUnit_Name(t *testing.T) {
+func testAccOrganizationalUnit_update(t *testing.T) {
 	ctx := acctest.Context(t)
 	var unit organizations.OrganizationalUnit
-
-	rInt := sdkacctest.RandInt()
-	name1 := fmt.Sprintf("tf_outest_%d", rInt)
-	name2 := fmt.Sprintf("tf_outest_%d", rInt+1)
+	rName1 := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	rName2 := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_organizations_organizational_unit.test"
 
 	resource.Test(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckOrganizationsAccount(ctx, t) },
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckOrganizationManagementAccount(ctx, t)
+		},
 		ErrorCheck:               acctest.ErrorCheck(t, organizations.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckOrganizationalUnitDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccOrganizationalUnitConfig_basic(name1),
+				Config: testAccOrganizationalUnitConfig_basic(rName1),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckOrganizationalUnitExists(ctx, resourceName, &unit),
-					resource.TestCheckResourceAttr(resourceName, "name", name1),
+					resource.TestCheckResourceAttr(resourceName, "name", rName1),
 				),
 			},
 			{
@@ -103,32 +108,33 @@ func testAccOrganizationalUnit_Name(t *testing.T) {
 				ImportStateVerify: true,
 			},
 			{
-				Config: testAccOrganizationalUnitConfig_basic(name2),
+				Config: testAccOrganizationalUnitConfig_basic(rName2),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckOrganizationalUnitExists(ctx, resourceName, &unit),
-					resource.TestCheckResourceAttr(resourceName, "name", name2),
+					resource.TestCheckResourceAttr(resourceName, "name", rName2),
 				),
 			},
 		},
 	})
 }
 
-func testAccOrganizationalUnit_Tags(t *testing.T) {
+func testAccOrganizationalUnit_tags(t *testing.T) {
 	ctx := acctest.Context(t)
 	var unit organizations.OrganizationalUnit
-
-	rInt := sdkacctest.RandInt()
-	name := fmt.Sprintf("tf_outest_%d", rInt)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_organizations_organizational_unit.test"
 
 	resource.Test(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckOrganizationsAccount(ctx, t) },
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckOrganizationManagementAccount(ctx, t)
+		},
 		ErrorCheck:               acctest.ErrorCheck(t, organizations.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckOrganizationalUnitDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccOrganizationalUnitConfig_tags1(name, "key1", "value1"),
+				Config: testAccOrganizationalUnitConfig_tags1(rName, "key1", "value1"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckOrganizationalUnitExists(ctx, resourceName, &unit),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
@@ -141,7 +147,7 @@ func testAccOrganizationalUnit_Tags(t *testing.T) {
 				ImportStateVerify: true,
 			},
 			{
-				Config: testAccOrganizationalUnitConfig_tags2(name, "key1", "value1updated", "key2", "value2"),
+				Config: testAccOrganizationalUnitConfig_tags2(rName, "key1", "value1updated", "key2", "value2"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckOrganizationalUnitExists(ctx, resourceName, &unit),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
@@ -150,10 +156,11 @@ func testAccOrganizationalUnit_Tags(t *testing.T) {
 				),
 			},
 			{
-				Config: testAccOrganizationalUnitConfig_basic(name),
+				Config: testAccOrganizationalUnitConfig_tags1(rName, "key2", "value2"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckOrganizationalUnitExists(ctx, resourceName, &unit),
-					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
 				),
 			},
 		},
@@ -169,32 +176,24 @@ func testAccCheckOrganizationalUnitDestroy(ctx context.Context) resource.TestChe
 				continue
 			}
 
-			params := &organizations.DescribeOrganizationalUnitInput{
-				OrganizationalUnitId: &rs.Primary.ID,
-			}
+			_, err := tforganizations.FindOrganizationalUnitByID(ctx, conn, rs.Primary.ID)
 
-			resp, err := conn.DescribeOrganizationalUnitWithContext(ctx, params)
+			if tfresource.NotFound(err) {
+				continue
+			}
 
 			if err != nil {
-				if tfawserr.ErrCodeEquals(err, organizations.ErrCodeAWSOrganizationsNotInUseException) {
-					continue
-				}
-				if tfawserr.ErrCodeEquals(err, organizations.ErrCodeOrganizationalUnitNotFoundException) {
-					continue
-				}
 				return err
 			}
 
-			if resp != nil && resp.OrganizationalUnit != nil {
-				return fmt.Errorf("Bad: Organizational Unit still exists: %q", rs.Primary.ID)
-			}
+			return fmt.Errorf("Organizations Organizational Unit %s still exists", rs.Primary.ID)
 		}
 
 		return nil
 	}
 }
 
-func testAccCheckOrganizationalUnitExists(ctx context.Context, n string, ou *organizations.OrganizationalUnit) resource.TestCheckFunc {
+func testAccCheckOrganizationalUnitExists(ctx context.Context, n string, v *organizations.OrganizationalUnit) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		rs, ok := s.RootModule().Resources[n]
 		if !ok {
@@ -202,67 +201,57 @@ func testAccCheckOrganizationalUnitExists(ctx context.Context, n string, ou *org
 		}
 
 		conn := acctest.Provider.Meta().(*conns.AWSClient).OrganizationsConn(ctx)
-		params := &organizations.DescribeOrganizationalUnitInput{
-			OrganizationalUnitId: &rs.Primary.ID,
-		}
 
-		resp, err := conn.DescribeOrganizationalUnitWithContext(ctx, params)
+		output, err := tforganizations.FindOrganizationalUnitByID(ctx, conn, rs.Primary.ID)
 
 		if err != nil {
-			if tfawserr.ErrCodeEquals(err, organizations.ErrCodeOrganizationalUnitNotFoundException) {
-				return fmt.Errorf("Organizational Unit %q does not exist", rs.Primary.ID)
-			}
 			return err
 		}
 
-		if resp == nil {
-			return fmt.Errorf("failed to DescribeOrganizationalUnit %q, response was nil", rs.Primary.ID)
-		}
-
-		ou = resp.OrganizationalUnit
+		*v = *output
 
 		return nil
 	}
 }
 
-func testAccOrganizationalUnitConfig_basic(name string) string {
+func testAccOrganizationalUnitConfig_basic(rName string) string {
 	return fmt.Sprintf(`
-resource "aws_organizations_organization" "test" {}
+data "aws_organizations_organization" "current" {}
 
 resource "aws_organizations_organizational_unit" "test" {
   name      = %[1]q
-  parent_id = aws_organizations_organization.test.roots[0].id
+  parent_id = data.aws_organizations_organization.current.roots[0].id
 }
-`, name)
+`, rName)
 }
 
-func testAccOrganizationalUnitConfig_tags1(name, tagKey1, tagValue1 string) string {
+func testAccOrganizationalUnitConfig_tags1(rName, tagKey1, tagValue1 string) string {
 	return fmt.Sprintf(`
-resource "aws_organizations_organization" "test" {}
+data "aws_organizations_organization" "current" {}
 
 resource "aws_organizations_organizational_unit" "test" {
   name      = %[1]q
-  parent_id = aws_organizations_organization.test.roots[0].id
+  parent_id = data.aws_organizations_organization.current.roots[0].id
 
   tags = {
     %[2]q = %[3]q
   }
 }
-`, name, tagKey1, tagValue1)
+`, rName, tagKey1, tagValue1)
 }
 
-func testAccOrganizationalUnitConfig_tags2(name, tagKey1, tagValue1, tagKey2, tagValue2 string) string {
+func testAccOrganizationalUnitConfig_tags2(rName, tagKey1, tagValue1, tagKey2, tagValue2 string) string {
 	return fmt.Sprintf(`
-resource "aws_organizations_organization" "test" {}
+data "aws_organizations_organization" "current" {}
 
 resource "aws_organizations_organizational_unit" "test" {
   name      = %[1]q
-  parent_id = aws_organizations_organization.test.roots[0].id
+  parent_id = data.aws_organizations_organization.current.roots[0].id
 
   tags = {
     %[2]q = %[3]q
     %[4]q = %[5]q
   }
 }
-`, name, tagKey1, tagValue1, tagKey2, tagValue2)
+`, rName, tagKey1, tagValue1, tagKey2, tagValue2)
 }
diff --git a/internal/service/organizations/organizational_units_data_source.go b/internal/service/organizations/organizational_units_data_source.go
index 19690197fa2..fa2d34c7b64 100644
--- a/internal/service/organizations/organizational_units_data_source.go
+++ b/internal/service/organizations/organizational_units_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package organizations
 
 import (
@@ -5,10 +8,14 @@ import (
 
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/organizations"
+	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
+	tfslices "github.com/hashicorp/terraform-provider-aws/internal/slices"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
 // @SDKDataSource("aws_organizations_organizational_units")
@@ -17,10 +24,6 @@ func DataSourceOrganizationalUnits() *schema.Resource {
 		ReadWithoutTimeout: dataSourceOrganizationalUnitsRead,
 
 		Schema: map[string]*schema.Schema{
-			"parent_id": {
-				Type:     schema.TypeString,
-				Required: true,
-			},
 			"children": {
 				Type:     schema.TypeList,
 				Computed: true,
@@ -41,6 +44,10 @@ func DataSourceOrganizationalUnits() *schema.Resource {
 					},
 				},
 			},
+			"parent_id": {
+				Type:     schema.TypeString,
+				Required: true,
+			},
 		},
 	}
 }
@@ -50,33 +57,62 @@ func dataSourceOrganizationalUnitsRead(ctx context.Context, d *schema.ResourceDa
 	conn := meta.(*conns.AWSClient).OrganizationsConn(ctx)
 
 	parentID := d.Get("parent_id").(string)
-	children, err := findOUsForParent(ctx, conn, parentID)
+	children, err := findOrganizationalUnitsForParentByID(ctx, conn, parentID)
 
 	if err != nil {
 		return sdkdiag.AppendErrorf(diags, "listing Organizations Organization Units for parent (%s): %s", parentID, err)
 	}
 
 	d.SetId(parentID)
-
-	if err := d.Set("children", FlattenOrganizationalUnits(children)); err != nil {
+	if err := d.Set("children", flattenOrganizationalUnits(children)); err != nil {
 		return sdkdiag.AppendErrorf(diags, "setting children: %s", err)
 	}
 
 	return diags
 }
 
-func findOUsForParent(ctx context.Context, conn *organizations.Organizations, id string) ([]*organizations.OrganizationalUnit, error) {
+func findOrganizationalUnitsForParentByID(ctx context.Context, conn *organizations.Organizations, id string) ([]*organizations.OrganizationalUnit, error) {
 	input := &organizations.ListOrganizationalUnitsForParentInput{
 		ParentId: aws.String(id),
 	}
+
+	return findOrganizationalUnitsForParent(ctx, conn, input, tfslices.PredicateTrue[*organizations.OrganizationalUnit]())
+}
+
+func findOrganizationalUnitForParent(ctx context.Context, conn *organizations.Organizations, input *organizations.ListOrganizationalUnitsForParentInput, filter tfslices.Predicate[*organizations.OrganizationalUnit]) (*organizations.OrganizationalUnit, error) {
+	output, err := findOrganizationalUnitsForParent(ctx, conn, input, filter)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return tfresource.AssertSinglePtrResult(output)
+}
+
+func findOrganizationalUnitsForParent(ctx context.Context, conn *organizations.Organizations, input *organizations.ListOrganizationalUnitsForParentInput, filter tfslices.Predicate[*organizations.OrganizationalUnit]) ([]*organizations.OrganizationalUnit, error) {
 	var output []*organizations.OrganizationalUnit
 
 	err := conn.ListOrganizationalUnitsForParentPagesWithContext(ctx, input, func(page *organizations.ListOrganizationalUnitsForParentOutput, lastPage bool) bool {
-		output = append(output, page.OrganizationalUnits...)
+		if page == nil {
+			return !lastPage
+		}
+
+		for _, v := range page.OrganizationalUnits {
+			if v != nil && filter(v) {
+				output = append(output, v)
+			}
+		}
 
 		return !lastPage
 	})
 
+	if tfawserr.ErrCodeEquals(err, organizations.ErrCodeParentNotFoundException) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+
 	if err != nil {
 		return nil, err
 	}
@@ -84,10 +120,11 @@ func findOUsForParent(ctx context.Context, conn *organizations.Organizations, id
 	return output, nil
 }
 
-func FlattenOrganizationalUnits(ous []*organizations.OrganizationalUnit) []map[string]interface{} {
+func flattenOrganizationalUnits(ous []*organizations.OrganizationalUnit) []map[string]interface{} {
 	if len(ous) == 0 {
 		return nil
 	}
+
 	var result []map[string]interface{}
 	for _, ou := range ous {
 		result = append(result, map[string]interface{}{
diff --git a/internal/service/organizations/organizational_units_data_source_test.go b/internal/service/organizations/organizational_units_data_source_test.go
index 0c279f31f73..ab97202496a 100644
--- a/internal/service/organizations/organizational_units_data_source_test.go
+++ b/internal/service/organizations/organizational_units_data_source_test.go
@@ -1,15 +1,21 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package organizations_test
 
 import (
+	"fmt"
 	"testing"
 
 	"github.com/aws/aws-sdk-go/service/organizations"
+	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
 )
 
 func testAccOrganizationalUnitsDataSource_basic(t *testing.T) {
 	ctx := acctest.Context(t)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	topOUDataSourceName := "data.aws_organizations_organizational_units.current"
 	newOUDataSourceName := "data.aws_organizations_organizational_units.test"
 
@@ -22,7 +28,7 @@ func testAccOrganizationalUnitsDataSource_basic(t *testing.T) {
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		Steps: []resource.TestStep{
 			{
-				Config: testAccOrganizationalUnitsDataSourceConfig_basic,
+				Config: testAccOrganizationalUnitsDataSourceConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					acctest.CheckResourceAttrGreaterThanValue(topOUDataSourceName, "children.#", 0),
 					resource.TestCheckResourceAttr(newOUDataSourceName, "children.#", "0"),
@@ -32,11 +38,12 @@ func testAccOrganizationalUnitsDataSource_basic(t *testing.T) {
 	})
 }
 
-const testAccOrganizationalUnitsDataSourceConfig_basic = `
+func testAccOrganizationalUnitsDataSourceConfig_basic(rName string) string {
+	return fmt.Sprintf(`
 data "aws_organizations_organization" "current" {}
 
 resource "aws_organizations_organizational_unit" "test" {
-  name      = "test"
+  name      = %[1]q
   parent_id = data.aws_organizations_organization.current.roots[0].id
 }
 
@@ -47,4 +54,5 @@ data "aws_organizations_organizational_units" "current" {
 data "aws_organizations_organizational_units" "test" {
   parent_id = aws_organizations_organizational_unit.test.id
 }
-`
+`, rName)
+}
diff --git a/internal/service/organizations/organizations_test.go b/internal/service/organizations/organizations_test.go
index a073c78052a..9e6034c2060 100644
--- a/internal/service/organizations/organizations_test.go
+++ b/internal/service/organizations/organizations_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package organizations_test
 
 import (
@@ -24,6 +27,7 @@ func TestAccOrganizations_serial(t *testing.T) {
 	testCases := map[string]map[string]func(t *testing.T){
 		"Organization": {
 			"basic":                             testAccOrganization_basic,
+			"disappears":                        testAccOrganization_disappears,
 			"AwsServiceAccessPrincipals":        testAccOrganization_serviceAccessPrincipals,
 			"EnabledPolicyTypes":                testAccOrganization_EnabledPolicyTypes,
 			"FeatureSet_Basic":                  testAccOrganization_FeatureSet,
@@ -32,8 +36,6 @@ func TestAccOrganizations_serial(t *testing.T) {
 			"DataSource_basic":                  testAccOrganizationDataSource_basic,
 			"DataSource_memberAccount":          testAccOrganizationDataSource_memberAccount,
 			"DataSource_delegatedAdministrator": testAccOrganizationDataSource_delegatedAdministrator,
-			"ChildAccountsDataSource":           testAccOrganizationalUnitChildAccountsDataSource_basic,
-			"DescendantAccountsDataSource":      testAccOrganizationalUnitDescendantAccountsDataSource_basic,
 		},
 		"Account": {
 			"basic":           testAccAccount_basic,
@@ -43,13 +45,14 @@ func TestAccOrganizations_serial(t *testing.T) {
 			"GovCloud":        testAccAccount_govCloud,
 		},
 		"OrganizationalUnit": {
-			"basic":      testAccOrganizationalUnit_basic,
-			"disappears": testAccOrganizationalUnit_disappears,
-			"Name":       testAccOrganizationalUnit_Name,
-			"Tags":       testAccOrganizationalUnit_Tags,
-		},
-		"OrganizationalUnits": {
-			"DataSource": testAccOrganizationalUnitsDataSource_basic,
+			"basic":                              testAccOrganizationalUnit_basic,
+			"disappears":                         testAccOrganizationalUnit_disappears,
+			"update":                             testAccOrganizationalUnit_update,
+			"tags":                               testAccOrganizationalUnit_tags,
+			"DataSource_basic":                   testAccOrganizationalUnitDataSource_basic,
+			"ChildAccountsDataSource_basic":      testAccOrganizationalUnitChildAccountsDataSource_basic,
+			"DescendantAccountsDataSource_basic": testAccOrganizationalUnitDescendantAccountsDataSource_basic,
+			"PluralDataSource_basic":             testAccOrganizationalUnitsDataSource_basic,
 		},
 		"Policy": {
 			"basic":                  testAccPolicy_basic,
diff --git a/internal/service/organizations/policies_data_source.go b/internal/service/organizations/policies_data_source.go
index c12147403ac..4eb615e8f96 100644
--- a/internal/service/organizations/policies_data_source.go
+++ b/internal/service/organizations/policies_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package organizations
 
 import (
diff --git a/internal/service/organizations/policies_data_source_test.go b/internal/service/organizations/policies_data_source_test.go
index 42f173394c8..f38ee072bb1 100644
--- a/internal/service/organizations/policies_data_source_test.go
+++ b/internal/service/organizations/policies_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package organizations_test
 
 import (
diff --git a/internal/service/organizations/policies_for_target_data_source.go b/internal/service/organizations/policies_for_target_data_source.go
index 50e7fcaecbb..dd057475c63 100644
--- a/internal/service/organizations/policies_for_target_data_source.go
+++ b/internal/service/organizations/policies_for_target_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package organizations
 
 import (
diff --git a/internal/service/organizations/policies_for_target_data_source_test.go b/internal/service/organizations/policies_for_target_data_source_test.go
index f368cbe5e8e..c281d3ca930 100644
--- a/internal/service/organizations/policies_for_target_data_source_test.go
+++ b/internal/service/organizations/policies_for_target_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package organizations_test
 
 import (
diff --git a/internal/service/organizations/policy.go b/internal/service/organizations/policy.go
index cbf1ccc3b36..443f87ddfda 100644
--- a/internal/service/organizations/policy.go
+++ b/internal/service/organizations/policy.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package organizations
 
 import (
diff --git a/internal/service/organizations/policy_attachment.go b/internal/service/organizations/policy_attachment.go
index 17484fbf8ea..320c4d6a333 100644
--- a/internal/service/organizations/policy_attachment.go
+++ b/internal/service/organizations/policy_attachment.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package organizations
 
 import (
diff --git a/internal/service/organizations/policy_attachment_test.go b/internal/service/organizations/policy_attachment_test.go
index 7986a98dac8..c51e7d6f30a 100644
--- a/internal/service/organizations/policy_attachment_test.go
+++ b/internal/service/organizations/policy_attachment_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package organizations_test
 
 import (
diff --git a/internal/service/organizations/policy_data_source.go b/internal/service/organizations/policy_data_source.go
index 91502c73d54..2d93318c2e8 100644
--- a/internal/service/organizations/policy_data_source.go
+++ b/internal/service/organizations/policy_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package organizations
 
 import (
diff --git a/internal/service/organizations/policy_data_source_test.go b/internal/service/organizations/policy_data_source_test.go
index a0b3a79ae68..ff880e5c6e6 100644
--- a/internal/service/organizations/policy_data_source_test.go
+++ b/internal/service/organizations/policy_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package organizations_test
 
 import (
diff --git a/internal/service/organizations/policy_test.go b/internal/service/organizations/policy_test.go
index cdd2f140a74..68ee06d026e 100644
--- a/internal/service/organizations/policy_test.go
+++ b/internal/service/organizations/policy_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package organizations_test
 
 import (
@@ -7,6 +10,7 @@ import (
 	"strconv"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/organizations"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -36,7 +40,7 @@ func testAccPolicy_basic(t *testing.T) {
 				Config: testAccPolicyConfig_required(rName, content1),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckPolicyExists(ctx, resourceName, &policy),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "organizations", regexp.MustCompile("policy/o-.+/service_control_policy/p-.+$")),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "organizations", regexache.MustCompile("policy/o-.+/service_control_policy/p-.+$")),
 					resource.TestCheckResourceAttr(resourceName, "content", content1),
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
@@ -191,7 +195,7 @@ func testAccPolicy_skipDestroy(t *testing.T) {
 				Config: testAccPolicyConfig_skipDestroy(rName, content),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckPolicyExists(ctx, resourceName, &policy),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "organizations", regexp.MustCompile("policy/o-.+/service_control_policy/p-.+$")),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "organizations", regexache.MustCompile("policy/o-.+/service_control_policy/p-.+$")),
 					resource.TestCheckResourceAttr(resourceName, "content", content),
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
@@ -444,7 +448,7 @@ func testAccPolicy_importManagedPolicy(t *testing.T) {
 				ResourceName:  resourceName,
 				ImportStateId: resourceID,
 				ImportState:   true,
-				ExpectError:   regexp.MustCompile(regexp.QuoteMeta(fmt.Sprintf("AWS-managed Organizations policy (%s) cannot be imported.", resourceID))),
+				ExpectError:   regexache.MustCompile(regexp.QuoteMeta(fmt.Sprintf("AWS-managed Organizations policy (%s) cannot be imported.", resourceID))),
 			},
 		},
 	})
diff --git a/internal/service/organizations/resource_policy.go b/internal/service/organizations/resource_policy.go
index c99a77a50b4..16bad79dfb6 100644
--- a/internal/service/organizations/resource_policy.go
+++ b/internal/service/organizations/resource_policy.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package organizations
 
 import (
diff --git a/internal/service/organizations/resource_policy_test.go b/internal/service/organizations/resource_policy_test.go
index 1c890f795f9..103d1214b22 100644
--- a/internal/service/organizations/resource_policy_test.go
+++ b/internal/service/organizations/resource_policy_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package organizations_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/organizations"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
@@ -34,7 +37,7 @@ func testAccResourcePolicy_basic(t *testing.T) {
 				Config: testAccResourcePolicyConfig_basic(),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckResourcePolicyExists(ctx, resourceName, &policy),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "organizations", regexp.MustCompile("resourcepolicy/o-.+/rp-.+$")),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "organizations", regexache.MustCompile("resourcepolicy/o-.+/rp-.+$")),
 					resource.TestCheckResourceAttrSet(resourceName, "content"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 				),
diff --git a/internal/service/organizations/resource_tags_data_source.go b/internal/service/organizations/resource_tags_data_source.go
index fabab56a1a5..f7afcccde53 100644
--- a/internal/service/organizations/resource_tags_data_source.go
+++ b/internal/service/organizations/resource_tags_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package organizations
 
 import (
diff --git a/internal/service/organizations/resource_tags_data_source_test.go b/internal/service/organizations/resource_tags_data_source_test.go
index c1d77ba4427..838cbaeb8c2 100644
--- a/internal/service/organizations/resource_tags_data_source_test.go
+++ b/internal/service/organizations/resource_tags_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package organizations_test
 
 import (
diff --git a/internal/service/organizations/service_package.go b/internal/service/organizations/service_package.go
index a7701b77086..e91ebaf1ad8 100644
--- a/internal/service/organizations/service_package.go
+++ b/internal/service/organizations/service_package.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package organizations
 
 import (
diff --git a/internal/service/organizations/service_package_gen.go b/internal/service/organizations/service_package_gen.go
index 4980f6d99b2..d26599f9466 100644
--- a/internal/service/organizations/service_package_gen.go
+++ b/internal/service/organizations/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	organizations_sdkv1 "github.com/aws/aws-sdk-go/service/organizations"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -36,6 +37,11 @@ func (p *servicePackage) SDKDataSources(ctx context.Context) []*types.ServicePac
 			Factory:  DataSourceOrganization,
 			TypeName: "aws_organizations_organization",
 		},
+		{
+			Factory:  DataSourceOrganizationalUnit,
+			TypeName: "aws_organizations_organizational_unit",
+			Name:     "Organizational Unit",
+		},
 		{
 			Factory:  DataSourceOrganizationalUnitChildAccounts,
 			TypeName: "aws_organizations_organizational_unit_child_accounts",
@@ -127,4 +133,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*o
 	return organizations_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/organizations/tags_gen.go b/internal/service/organizations/tags_gen.go
index 9ef900ec7e6..bcd9d92a896 100644
--- a/internal/service/organizations/tags_gen.go
+++ b/internal/service/organizations/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/organizations"
 	"github.com/aws/aws-sdk-go/service/organizations/organizationsiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -102,6 +104,8 @@ func updateTags(ctx context.Context, conn organizationsiface.OrganizationsAPI, i
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.Organizations)
 	if len(removedTags) > 0 {
diff --git a/internal/service/outposts/generate.go b/internal/service/outposts/generate.go
index cd7464d1649..fc50806b44e 100644
--- a/internal/service/outposts/generate.go
+++ b/internal/service/outposts/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ServiceTagsMap -UpdateTags -AWSSDKVersion=1 -KVTValues -SkipTypesImp
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/outposts/outpost_asset_data_source.go b/internal/service/outposts/outpost_asset_data_source.go
index d5dec30e623..5d57a94dd6d 100644
--- a/internal/service/outposts/outpost_asset_data_source.go
+++ b/internal/service/outposts/outpost_asset_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package outposts
 
 import (
diff --git a/internal/service/outposts/outpost_asset_data_source_test.go b/internal/service/outposts/outpost_asset_data_source_test.go
index c4de90c6558..759d9c408b6 100644
--- a/internal/service/outposts/outpost_asset_data_source_test.go
+++ b/internal/service/outposts/outpost_asset_data_source_test.go
@@ -1,9 +1,12 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package outposts_test
 
 import (
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/outposts"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
@@ -21,11 +24,11 @@ func TestAccOutpostsAssetDataSource_basic(t *testing.T) {
 			{
 				Config: testAccOutpostAssetDataSourceConfig_basic(),
 				Check: resource.ComposeTestCheckFunc(
-					acctest.MatchResourceAttrRegionalARN(dataSourceName, "arn", "outposts", regexp.MustCompile(`outpost/.+`)),
-					resource.TestMatchResourceAttr(dataSourceName, "asset_id", regexp.MustCompile(`^(\w+)$`)),
+					acctest.MatchResourceAttrRegionalARN(dataSourceName, "arn", "outposts", regexache.MustCompile(`outpost/.+`)),
+					resource.TestMatchResourceAttr(dataSourceName, "asset_id", regexache.MustCompile(`^(\w+)$`)),
 					resource.TestCheckResourceAttrSet(dataSourceName, "asset_type"),
-					resource.TestMatchResourceAttr(dataSourceName, "rack_elevation", regexp.MustCompile(`^[\S \n]+$`)),
-					resource.TestMatchResourceAttr(dataSourceName, "rack_id", regexp.MustCompile(`^[\S \n]+$`)),
+					resource.TestMatchResourceAttr(dataSourceName, "rack_elevation", regexache.MustCompile(`^[\S \n]+$`)),
+					resource.TestMatchResourceAttr(dataSourceName, "rack_id", regexache.MustCompile(`^[\S \n]+$`)),
 				),
 			},
 		},
diff --git a/internal/service/outposts/outpost_assets_data_source.go b/internal/service/outposts/outpost_assets_data_source.go
index ccb001032d8..c11c83f68d7 100644
--- a/internal/service/outposts/outpost_assets_data_source.go
+++ b/internal/service/outposts/outpost_assets_data_source.go
@@ -1,9 +1,12 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package outposts
 
 import (
 	"context"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/outposts"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
@@ -38,7 +41,7 @@ func DataSourceOutpostAssets() *schema.Resource {
 					Type: schema.TypeString,
 					ValidateFunc: validation.All(
 						validation.StringLenBetween(1, 50),
-						validation.StringMatch(regexp.MustCompile(`^[A-Za-z0-9-]*$`), "must match [a-zA-Z0-9-]"),
+						validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z-]*$`), "must match [0-9A-Za-z-]"),
 					),
 				},
 			},
diff --git a/internal/service/outposts/outpost_assets_data_source_test.go b/internal/service/outposts/outpost_assets_data_source_test.go
index 4d0174168da..3aa08157782 100644
--- a/internal/service/outposts/outpost_assets_data_source_test.go
+++ b/internal/service/outposts/outpost_assets_data_source_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package outposts_test
 
 import (
 	"fmt"
 	"os"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/outposts"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
@@ -28,7 +31,7 @@ func TestAccOutpostsAssetsDataSource_id(t *testing.T) {
 			{
 				Config: testAccOutpostAssetsDataSourceConfig_id(),
 				Check: resource.ComposeTestCheckFunc(
-					acctest.MatchResourceAttrRegionalARN(dataSourceName, "arn", "outposts", regexp.MustCompile(`outpost/.+`)),
+					acctest.MatchResourceAttrRegionalARN(dataSourceName, "arn", "outposts", regexache.MustCompile(`outpost/.+`)),
 				),
 			},
 		},
diff --git a/internal/service/outposts/outpost_data_source.go b/internal/service/outposts/outpost_data_source.go
index c8bb9936a22..3a0d10de6cc 100644
--- a/internal/service/outposts/outpost_data_source.go
+++ b/internal/service/outposts/outpost_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package outposts
 
 import (
diff --git a/internal/service/outposts/outpost_data_source_test.go b/internal/service/outposts/outpost_data_source_test.go
index 1389cd9d11b..2012b726208 100644
--- a/internal/service/outposts/outpost_data_source_test.go
+++ b/internal/service/outposts/outpost_data_source_test.go
@@ -1,9 +1,12 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package outposts_test
 
 import (
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/outposts"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
@@ -22,15 +25,15 @@ func TestAccOutpostsOutpostDataSource_id(t *testing.T) {
 			{
 				Config: testAccOutpostDataSourceConfig_id(),
 				Check: resource.ComposeTestCheckFunc(
-					acctest.CheckResourceAttrRegionalARNIgnoreRegionAndAccount(dataSourceName, "arn", "outposts", regexp.MustCompile(`outpost/op-.+$`).String()),
-					resource.TestMatchResourceAttr(dataSourceName, "availability_zone", regexp.MustCompile(`^.+$`)),
-					resource.TestMatchResourceAttr(dataSourceName, "availability_zone_id", regexp.MustCompile(`^.+$`)),
+					acctest.CheckResourceAttrRegionalARNIgnoreRegionAndAccount(dataSourceName, "arn", "outposts", regexache.MustCompile(`outpost/op-.+$`).String()),
+					resource.TestMatchResourceAttr(dataSourceName, "availability_zone", regexache.MustCompile(`^.+$`)),
+					resource.TestMatchResourceAttr(dataSourceName, "availability_zone_id", regexache.MustCompile(`^.+$`)),
 					resource.TestCheckResourceAttrSet(dataSourceName, "description"),
-					resource.TestMatchResourceAttr(dataSourceName, "lifecycle_status", regexp.MustCompile(`^[ A-Za-z]+$`)),
-					resource.TestMatchResourceAttr(dataSourceName, "id", regexp.MustCompile(`^op-.+$`)),
-					resource.TestMatchResourceAttr(dataSourceName, "name", regexp.MustCompile(`^.+$`)),
-					resource.TestMatchResourceAttr(dataSourceName, "owner_id", regexp.MustCompile(`\d{12}`)),
-					acctest.CheckResourceAttrRegionalARNIgnoreRegionAndAccount(dataSourceName, "site_arn", "outposts", regexp.MustCompile(`site/os.+$`).String()),
+					resource.TestMatchResourceAttr(dataSourceName, "lifecycle_status", regexache.MustCompile(`^[A-Za-z ]+$`)),
+					resource.TestMatchResourceAttr(dataSourceName, "id", regexache.MustCompile(`^op-.+$`)),
+					resource.TestMatchResourceAttr(dataSourceName, "name", regexache.MustCompile(`^.+$`)),
+					resource.TestMatchResourceAttr(dataSourceName, "owner_id", regexache.MustCompile(`\d{12}`)),
+					acctest.CheckResourceAttrRegionalARNIgnoreRegionAndAccount(dataSourceName, "site_arn", "outposts", regexache.MustCompile(`site/os.+$`).String()),
 					resource.TestCheckResourceAttrSet(dataSourceName, "site_id"),
 					resource.TestCheckResourceAttrSet(dataSourceName, "supported_hardware_type"),
 					resource.TestCheckResourceAttrSet(dataSourceName, "tags.%"),
diff --git a/internal/service/outposts/outpost_instance_type_data_source.go b/internal/service/outposts/outpost_instance_type_data_source.go
index 2835b576caf..72d1104eaf7 100644
--- a/internal/service/outposts/outpost_instance_type_data_source.go
+++ b/internal/service/outposts/outpost_instance_type_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package outposts
 
 import (
diff --git a/internal/service/outposts/outpost_instance_type_data_source_test.go b/internal/service/outposts/outpost_instance_type_data_source_test.go
index 8ea5ddb0153..c3cdd8e8202 100644
--- a/internal/service/outposts/outpost_instance_type_data_source_test.go
+++ b/internal/service/outposts/outpost_instance_type_data_source_test.go
@@ -1,9 +1,12 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package outposts_test
 
 import (
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/outposts"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
@@ -22,7 +25,7 @@ func TestAccOutpostsOutpostInstanceTypeDataSource_instanceType(t *testing.T) {
 			{
 				Config: testAccOutpostInstanceTypeDataSourceConfig_basic(),
 				Check: resource.ComposeTestCheckFunc(
-					resource.TestMatchResourceAttr(dataSourceName, "instance_type", regexp.MustCompile(`^.+$`)),
+					resource.TestMatchResourceAttr(dataSourceName, "instance_type", regexache.MustCompile(`^.+$`)),
 				),
 			},
 		},
@@ -42,7 +45,7 @@ func TestAccOutpostsOutpostInstanceTypeDataSource_preferredInstanceTypes(t *test
 			{
 				Config: testAccOutpostInstanceTypeDataSourceConfig_preferreds(),
 				Check: resource.ComposeTestCheckFunc(
-					resource.TestMatchResourceAttr(dataSourceName, "instance_type", regexp.MustCompile(`^.+$`)),
+					resource.TestMatchResourceAttr(dataSourceName, "instance_type", regexache.MustCompile(`^.+$`)),
 				),
 			},
 		},
diff --git a/internal/service/outposts/outpost_instance_types_data_source.go b/internal/service/outposts/outpost_instance_types_data_source.go
index 53b226d2090..fd41591fd5f 100644
--- a/internal/service/outposts/outpost_instance_types_data_source.go
+++ b/internal/service/outposts/outpost_instance_types_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package outposts
 
 import (
diff --git a/internal/service/outposts/outpost_instance_types_data_source_test.go b/internal/service/outposts/outpost_instance_types_data_source_test.go
index c2034ff7cec..2e6b468787c 100644
--- a/internal/service/outposts/outpost_instance_types_data_source_test.go
+++ b/internal/service/outposts/outpost_instance_types_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package outposts_test
 
 import (
diff --git a/internal/service/outposts/outposts_data_source.go b/internal/service/outposts/outposts_data_source.go
index 6c46eefddb9..ccab08af764 100644
--- a/internal/service/outposts/outposts_data_source.go
+++ b/internal/service/outposts/outposts_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package outposts
 
 import (
diff --git a/internal/service/outposts/outposts_data_source_test.go b/internal/service/outposts/outposts_data_source_test.go
index 4fb7897f745..71c5e5ae8e6 100644
--- a/internal/service/outposts/outposts_data_source_test.go
+++ b/internal/service/outposts/outposts_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package outposts_test
 
 import (
diff --git a/internal/service/outposts/service_package_gen.go b/internal/service/outposts/service_package_gen.go
index f87af12276a..5176468c563 100644
--- a/internal/service/outposts/service_package_gen.go
+++ b/internal/service/outposts/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	outposts_sdkv1 "github.com/aws/aws-sdk-go/service/outposts"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -74,4 +75,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*o
 	return outposts_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/outposts/site_data_source.go b/internal/service/outposts/site_data_source.go
index 0fb10a57391..3ac9de045d3 100644
--- a/internal/service/outposts/site_data_source.go
+++ b/internal/service/outposts/site_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package outposts
 
 import (
diff --git a/internal/service/outposts/site_data_source_test.go b/internal/service/outposts/site_data_source_test.go
index e430825bee8..657a591d708 100644
--- a/internal/service/outposts/site_data_source_test.go
+++ b/internal/service/outposts/site_data_source_test.go
@@ -1,9 +1,12 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package outposts_test
 
 import (
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/outposts"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
@@ -24,8 +27,8 @@ func TestAccOutpostsSiteDataSource_id(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					acctest.CheckResourceAttrAccountID(dataSourceName, "account_id"),
 					resource.TestCheckResourceAttrSet(dataSourceName, "description"),
-					resource.TestMatchResourceAttr(dataSourceName, "id", regexp.MustCompile(`^os-.+$`)),
-					resource.TestMatchResourceAttr(dataSourceName, "name", regexp.MustCompile(`^.+$`)),
+					resource.TestMatchResourceAttr(dataSourceName, "id", regexache.MustCompile(`^os-.+$`)),
+					resource.TestMatchResourceAttr(dataSourceName, "name", regexache.MustCompile(`^.+$`)),
 				),
 			},
 		},
diff --git a/internal/service/outposts/sites_data_source.go b/internal/service/outposts/sites_data_source.go
index 5cefa8c94fa..ed2a6a60931 100644
--- a/internal/service/outposts/sites_data_source.go
+++ b/internal/service/outposts/sites_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package outposts
 
 import (
diff --git a/internal/service/outposts/sites_data_source_test.go b/internal/service/outposts/sites_data_source_test.go
index 492c47b1ed3..3e3f30455db 100644
--- a/internal/service/outposts/sites_data_source_test.go
+++ b/internal/service/outposts/sites_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package outposts_test
 
 import (
diff --git a/internal/service/outposts/tags_gen.go b/internal/service/outposts/tags_gen.go
index c3a723e872d..c7a2e0f8e7c 100644
--- a/internal/service/outposts/tags_gen.go
+++ b/internal/service/outposts/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/outposts"
 	"github.com/aws/aws-sdk-go/service/outposts/outpostsiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -21,7 +23,7 @@ func Tags(tags tftags.KeyValueTags) map[string]*string {
 	return aws.StringMap(tags.Map())
 }
 
-// KeyValueTags creates KeyValueTags from outposts service tags.
+// KeyValueTags creates tftags.KeyValueTags from outposts service tags.
 func KeyValueTags(ctx context.Context, tags map[string]*string) tftags.KeyValueTags {
 	return tftags.New(ctx, tags)
 }
@@ -52,6 +54,8 @@ func updateTags(ctx context.Context, conn outpostsiface.OutpostsAPI, identifier
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.Outposts)
 	if len(removedTags) > 0 {
diff --git a/internal/service/pinpoint/adm_channel.go b/internal/service/pinpoint/adm_channel.go
index 4a668c92056..4de9b75a2e2 100644
--- a/internal/service/pinpoint/adm_channel.go
+++ b/internal/service/pinpoint/adm_channel.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package pinpoint
 
 import (
diff --git a/internal/service/pinpoint/adm_channel_test.go b/internal/service/pinpoint/adm_channel_test.go
index c889a5935c7..1cf596930df 100644
--- a/internal/service/pinpoint/adm_channel_test.go
+++ b/internal/service/pinpoint/adm_channel_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package pinpoint_test
 
 import (
diff --git a/internal/service/pinpoint/apns_channel.go b/internal/service/pinpoint/apns_channel.go
index d1b4364bc16..19665d137b4 100644
--- a/internal/service/pinpoint/apns_channel.go
+++ b/internal/service/pinpoint/apns_channel.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package pinpoint
 
 import (
diff --git a/internal/service/pinpoint/apns_channel_test.go b/internal/service/pinpoint/apns_channel_test.go
index 2c2e8baeb97..74380d9a060 100644
--- a/internal/service/pinpoint/apns_channel_test.go
+++ b/internal/service/pinpoint/apns_channel_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package pinpoint_test
 
 import (
diff --git a/internal/service/pinpoint/apns_sandbox_channel.go b/internal/service/pinpoint/apns_sandbox_channel.go
index b69bd0d5a22..4b5bdf8266f 100644
--- a/internal/service/pinpoint/apns_sandbox_channel.go
+++ b/internal/service/pinpoint/apns_sandbox_channel.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package pinpoint
 
 import (
diff --git a/internal/service/pinpoint/apns_sandbox_channel_test.go b/internal/service/pinpoint/apns_sandbox_channel_test.go
index 1c301106d7b..d9569a0fdde 100644
--- a/internal/service/pinpoint/apns_sandbox_channel_test.go
+++ b/internal/service/pinpoint/apns_sandbox_channel_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package pinpoint_test
 
 import (
diff --git a/internal/service/pinpoint/apns_voip_channel.go b/internal/service/pinpoint/apns_voip_channel.go
index 2d35c0db185..923ae62a932 100644
--- a/internal/service/pinpoint/apns_voip_channel.go
+++ b/internal/service/pinpoint/apns_voip_channel.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package pinpoint
 
 import (
diff --git a/internal/service/pinpoint/apns_voip_channel_test.go b/internal/service/pinpoint/apns_voip_channel_test.go
index 26c5bd6c117..024ed232d04 100644
--- a/internal/service/pinpoint/apns_voip_channel_test.go
+++ b/internal/service/pinpoint/apns_voip_channel_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package pinpoint_test
 
 import (
diff --git a/internal/service/pinpoint/apns_voip_sandbox_channel.go b/internal/service/pinpoint/apns_voip_sandbox_channel.go
index 9410784ab5a..86945382650 100644
--- a/internal/service/pinpoint/apns_voip_sandbox_channel.go
+++ b/internal/service/pinpoint/apns_voip_sandbox_channel.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package pinpoint
 
 import (
diff --git a/internal/service/pinpoint/apns_voip_sandbox_channel_test.go b/internal/service/pinpoint/apns_voip_sandbox_channel_test.go
index 66ca1228763..f1c012d971e 100644
--- a/internal/service/pinpoint/apns_voip_sandbox_channel_test.go
+++ b/internal/service/pinpoint/apns_voip_sandbox_channel_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package pinpoint_test
 
 import (
diff --git a/internal/service/pinpoint/app.go b/internal/service/pinpoint/app.go
index 6cea051e56a..79c2f2f6682 100644
--- a/internal/service/pinpoint/app.go
+++ b/internal/service/pinpoint/app.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package pinpoint
 
 import (
@@ -8,12 +11,14 @@ import (
 	"github.com/aws/aws-sdk-go/service/pinpoint"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/create"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -31,37 +36,19 @@ func ResourceApp() *schema.Resource {
 		},
 
 		Schema: map[string]*schema.Schema{
-			"name": {
-				Type:          schema.TypeString,
-				Optional:      true,
-				Computed:      true,
-				ForceNew:      true,
-				ConflictsWith: []string{"name_prefix"},
-			},
-			"name_prefix": {
+			"application_id": {
 				Type:     schema.TypeString,
-				Optional: true,
-				ForceNew: true,
+				Computed: true,
 			},
-			"application_id": {
+			"arn": {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
-			//"cloudwatch_metrics_enabled": {
-			//	Type:     schema.TypeBool,
-			//	Optional: true,
-			//	Default:  false,
-			//},
 			"campaign_hook": {
-				Type:     schema.TypeList,
-				Optional: true,
-				MaxItems: 1,
-				DiffSuppressFunc: func(k, old, new string, d *schema.ResourceData) bool {
-					if old == "1" && new == "0" {
-						return true
-					}
-					return false
-				},
+				Type:             schema.TypeList,
+				Optional:         true,
+				MaxItems:         1,
+				DiffSuppressFunc: verify.SuppressMissingOptionalConfigurationBlock,
 				Elem: &schema.Resource{
 					Schema: map[string]*schema.Schema{
 						"lambda_function_name": {
@@ -69,12 +56,9 @@ func ResourceApp() *schema.Resource {
 							Optional: true,
 						},
 						"mode": {
-							Type:     schema.TypeString,
-							Optional: true,
-							ValidateFunc: validation.StringInSlice([]string{
-								pinpoint.ModeDelivery,
-								pinpoint.ModeFilter,
-							}, false),
+							Type:         schema.TypeString,
+							Optional:     true,
+							ValidateFunc: validation.StringInSlice(pinpoint.Mode_Values(), false),
 						},
 						"web_url": {
 							Type:     schema.TypeString,
@@ -83,16 +67,16 @@ func ResourceApp() *schema.Resource {
 					},
 				},
 			},
+			//"cloudwatch_metrics_enabled": {
+			//	Type:     schema.TypeBool,
+			//	Optional: true,
+			//	Default:  false,
+			//},
 			"limits": {
-				Type:     schema.TypeList,
-				Optional: true,
-				MaxItems: 1,
-				DiffSuppressFunc: func(k, old, new string, d *schema.ResourceData) bool {
-					if old == "1" && new == "0" {
-						return true
-					}
-					return false
-				},
+				Type:             schema.TypeList,
+				Optional:         true,
+				MaxItems:         1,
+				DiffSuppressFunc: verify.SuppressMissingOptionalConfigurationBlock,
 				Elem: &schema.Resource{
 					Schema: map[string]*schema.Schema{
 						"daily": {
@@ -118,16 +102,25 @@ func ResourceApp() *schema.Resource {
 					},
 				},
 			},
+			"name": {
+				Type:          schema.TypeString,
+				Optional:      true,
+				Computed:      true,
+				ForceNew:      true,
+				ConflictsWith: []string{"name_prefix"},
+			},
+			"name_prefix": {
+				Type:          schema.TypeString,
+				Optional:      true,
+				Computed:      true,
+				ForceNew:      true,
+				ConflictsWith: []string{"name"},
+			},
 			"quiet_time": {
-				Type:     schema.TypeList,
-				Optional: true,
-				MaxItems: 1,
-				DiffSuppressFunc: func(k, old, new string, d *schema.ResourceData) bool {
-					if old == "1" && new == "0" {
-						return true
-					}
-					return false
-				},
+				Type:             schema.TypeList,
+				Optional:         true,
+				MaxItems:         1,
+				DiffSuppressFunc: verify.SuppressMissingOptionalConfigurationBlock,
 				Elem: &schema.Resource{
 					Schema: map[string]*schema.Schema{
 						"end": {
@@ -141,10 +134,6 @@ func ResourceApp() *schema.Resource {
 					},
 				},
 			},
-			"arn": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
 			names.AttrTags:    tftags.TagsSchema(),
 			names.AttrTagsAll: tftags.TagsSchemaComputed(),
 		},
@@ -157,32 +146,21 @@ func resourceAppCreate(ctx context.Context, d *schema.ResourceData, meta interfa
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).PinpointConn(ctx)
 
-	var name string
-
-	if v, ok := d.GetOk("name"); ok {
-		name = v.(string)
-	} else if v, ok := d.GetOk("name_prefix"); ok {
-		name = id.PrefixedUniqueId(v.(string))
-	} else {
-		name = id.UniqueId()
-	}
-
-	log.Printf("[DEBUG] Pinpoint create app: %s", name)
-
-	req := &pinpoint.CreateAppInput{
+	name := create.Name(d.Get("name").(string), d.Get("name_prefix").(string))
+	input := &pinpoint.CreateAppInput{
 		CreateApplicationRequest: &pinpoint.CreateApplicationRequest{
 			Name: aws.String(name),
 			Tags: getTagsIn(ctx),
 		},
 	}
 
-	output, err := conn.CreateAppWithContext(ctx, req)
+	output, err := conn.CreateAppWithContext(ctx, input)
+
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "creating Pinpoint app: %s", err)
+		return sdkdiag.AppendErrorf(diags, "creating Pinpoint App (%s): %s", name, err)
 	}
 
 	d.SetId(aws.StringValue(output.ApplicationResponse.Id))
-	d.Set("arn", output.ApplicationResponse.Arn)
 
 	return append(diags, resourceAppUpdate(ctx, d, meta)...)
 }
@@ -191,46 +169,35 @@ func resourceAppRead(ctx context.Context, d *schema.ResourceData, meta interface
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).PinpointConn(ctx)
 
-	log.Printf("[INFO] Reading Pinpoint App Attributes for %s", d.Id())
+	app, err := FindAppByID(ctx, conn, d.Id())
 
-	app, err := conn.GetAppWithContext(ctx, &pinpoint.GetAppInput{
-		ApplicationId: aws.String(d.Id()),
-	})
-	if err != nil {
-		if tfawserr.ErrCodeEquals(err, pinpoint.ErrCodeNotFoundException) {
-			log.Printf("[WARN] Pinpoint App (%s) not found, removing from state", d.Id())
-			d.SetId("")
-			return diags
-		}
-
-		return sdkdiag.AppendErrorf(diags, "reading Pinpoint Application (%s): %s", d.Id(), err)
+	if !d.IsNewResource() && tfresource.NotFound(err) {
+		log.Printf("[WARN] Pinpoint App (%s) not found, removing from state", d.Id())
+		d.SetId("")
+		return diags
 	}
 
-	settings, err := conn.GetApplicationSettingsWithContext(ctx, &pinpoint.GetApplicationSettingsInput{
-		ApplicationId: aws.String(d.Id()),
-	})
 	if err != nil {
-		if tfawserr.ErrCodeEquals(err, pinpoint.ErrCodeNotFoundException) {
-			log.Printf("[WARN] Pinpoint App (%s) not found, removing from state", d.Id())
-			d.SetId("")
-			return diags
-		}
-
-		return sdkdiag.AppendErrorf(diags, "reading Pinpoint Application (%s) settings: %s", d.Id(), err)
+		return sdkdiag.AppendErrorf(diags, "reading Pinpoint App (%s): %s", d.Id(), err)
 	}
 
-	arn := aws.StringValue(app.ApplicationResponse.Arn)
-	d.Set("name", app.ApplicationResponse.Name)
-	d.Set("application_id", app.ApplicationResponse.Id)
-	d.Set("arn", arn)
+	settings, err := findAppSettingsByID(ctx, conn, d.Id())
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "reading Pinpoint App (%s) settings: %s", d.Id(), err)
+	}
 
-	if err := d.Set("campaign_hook", flattenCampaignHook(settings.ApplicationSettingsResource.CampaignHook)); err != nil {
+	d.Set("application_id", app.Id)
+	d.Set("arn", app.Arn)
+	if err := d.Set("campaign_hook", flattenCampaignHook(settings.CampaignHook)); err != nil {
 		return sdkdiag.AppendErrorf(diags, "setting campaign_hook: %s", err)
 	}
-	if err := d.Set("limits", flattenCampaignLimits(settings.ApplicationSettingsResource.Limits)); err != nil {
+	if err := d.Set("limits", flattenCampaignLimits(settings.Limits)); err != nil {
 		return sdkdiag.AppendErrorf(diags, "setting limits: %s", err)
 	}
-	if err := d.Set("quiet_time", flattenQuietTime(settings.ApplicationSettingsResource.QuietTime)); err != nil {
+	d.Set("name", app.Name)
+	d.Set("name_prefix", create.NamePrefixFromName(aws.StringValue(app.Name)))
+	if err := d.Set("quiet_time", flattenQuietTime(settings.QuietTime)); err != nil {
 		return sdkdiag.AppendErrorf(diags, "setting quiet_time: %s", err)
 	}
 
@@ -241,32 +208,35 @@ func resourceAppUpdate(ctx context.Context, d *schema.ResourceData, meta interfa
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).PinpointConn(ctx)
 
-	appSettings := &pinpoint.WriteApplicationSettingsRequest{}
+	if d.HasChangesExcept("tags", "tags_all") {
+		appSettings := &pinpoint.WriteApplicationSettingsRequest{}
+
+		if d.HasChange("campaign_hook") {
+			appSettings.CampaignHook = expandCampaignHook(d.Get("campaign_hook").([]interface{}))
+		}
 
-	//if d.HasChange("cloudwatch_metrics_enabled") {
-	//	appSettings.CloudWatchMetricsEnabled = aws.Bool(d.Get("cloudwatch_metrics_enabled").(bool));
-	//}
+		//if d.HasChange("cloudwatch_metrics_enabled") {
+		//	appSettings.CloudWatchMetricsEnabled = aws.Bool(d.Get("cloudwatch_metrics_enabled").(bool));
+		//}
 
-	if d.HasChange("campaign_hook") {
-		appSettings.CampaignHook = expandCampaignHook(d.Get("campaign_hook").([]interface{}))
-	}
+		if d.HasChange("limits") {
+			appSettings.Limits = expandCampaignLimits(d.Get("limits").([]interface{}))
+		}
 
-	if d.HasChange("limits") {
-		appSettings.Limits = expandCampaignLimits(d.Get("limits").([]interface{}))
-	}
+		if d.HasChange("quiet_time") {
+			appSettings.QuietTime = expandQuietTime(d.Get("quiet_time").([]interface{}))
+		}
 
-	if d.HasChange("quiet_time") {
-		appSettings.QuietTime = expandQuietTime(d.Get("quiet_time").([]interface{}))
-	}
+		input := &pinpoint.UpdateApplicationSettingsInput{
+			ApplicationId:                   aws.String(d.Id()),
+			WriteApplicationSettingsRequest: appSettings,
+		}
 
-	req := pinpoint.UpdateApplicationSettingsInput{
-		ApplicationId:                   aws.String(d.Id()),
-		WriteApplicationSettingsRequest: appSettings,
-	}
+		_, err := conn.UpdateApplicationSettingsWithContext(ctx, input)
 
-	_, err := conn.UpdateApplicationSettingsWithContext(ctx, &req)
-	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "updating Pinpoint Application (%s): %s", d.Id(), err)
+		if err != nil {
+			return sdkdiag.AppendErrorf(diags, "updating Pinpoint App (%s) settings: %s", d.Id(), err)
+		}
 	}
 
 	return append(diags, resourceAppRead(ctx, d, meta)...)
@@ -276,7 +246,7 @@ func resourceAppDelete(ctx context.Context, d *schema.ResourceData, meta interfa
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).PinpointConn(ctx)
 
-	log.Printf("[DEBUG] Deleting Pinpoint Application: %s", d.Id())
+	log.Printf("[DEBUG] Deleting Pinpoint App: %s", d.Id())
 	_, err := conn.DeleteAppWithContext(ctx, &pinpoint.DeleteAppInput{
 		ApplicationId: aws.String(d.Id()),
 	})
@@ -286,12 +256,62 @@ func resourceAppDelete(ctx context.Context, d *schema.ResourceData, meta interfa
 	}
 
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "deleting Pinpoint Application (%s): %s", d.Id(), err)
+		return sdkdiag.AppendErrorf(diags, "deleting Pinpoint App (%s): %s", d.Id(), err)
 	}
 
 	return diags
 }
 
+func FindAppByID(ctx context.Context, conn *pinpoint.Pinpoint, id string) (*pinpoint.ApplicationResponse, error) {
+	input := &pinpoint.GetAppInput{
+		ApplicationId: aws.String(id),
+	}
+
+	output, err := conn.GetAppWithContext(ctx, input)
+
+	if tfawserr.ErrCodeEquals(err, pinpoint.ErrCodeNotFoundException) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	if output == nil || output.ApplicationResponse == nil {
+		return nil, tfresource.NewEmptyResultError(input)
+	}
+
+	return output.ApplicationResponse, nil
+}
+
+func findAppSettingsByID(ctx context.Context, conn *pinpoint.Pinpoint, id string) (*pinpoint.ApplicationSettingsResource, error) {
+	input := &pinpoint.GetApplicationSettingsInput{
+		ApplicationId: aws.String(id),
+	}
+
+	output, err := conn.GetApplicationSettingsWithContext(ctx, input)
+
+	if tfawserr.ErrCodeEquals(err, pinpoint.ErrCodeNotFoundException) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	if output == nil || output.ApplicationSettingsResource == nil {
+		return nil, tfresource.NewEmptyResultError(input)
+	}
+
+	return output.ApplicationSettingsResource, nil
+}
+
 func expandCampaignHook(configs []interface{}) *pinpoint.CampaignHook {
 	if len(configs) == 0 {
 		return nil
diff --git a/internal/service/pinpoint/app_test.go b/internal/service/pinpoint/app_test.go
index 765c9bc4f00..f78c739041f 100644
--- a/internal/service/pinpoint/app_test.go
+++ b/internal/service/pinpoint/app_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package pinpoint_test
 
 import (
@@ -5,20 +8,21 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/pinpoint"
-	"github.com/aws/aws-sdk-go/service/ram"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	tfpinpoint "github.com/hashicorp/terraform-provider-aws/internal/service/pinpoint"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
 func TestAccPinpointApp_basic(t *testing.T) {
 	ctx := acctest.Context(t)
 	var application pinpoint.ApplicationResponse
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_pinpoint_app.test"
 
 	resource.ParallelTest(t, resource.TestCase{
@@ -28,9 +32,17 @@ func TestAccPinpointApp_basic(t *testing.T) {
 		CheckDestroy:             testAccCheckAppDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccAppConfig_generatedName,
-				Check: resource.ComposeTestCheckFunc(
+				Config: testAccAppConfig_basic(rName),
+				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckAppExists(ctx, resourceName, &application),
+					resource.TestCheckResourceAttrSet(resourceName, "application_id"),
+					resource.TestCheckResourceAttrSet(resourceName, "arn"),
+					resource.TestCheckResourceAttr(resourceName, "campaign_hook.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "limits.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "name", rName),
+					resource.TestCheckResourceAttr(resourceName, "name_prefix", ""),
+					resource.TestCheckResourceAttr(resourceName, "quiet_time.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 				),
 			},
 			{
@@ -42,7 +54,7 @@ func TestAccPinpointApp_basic(t *testing.T) {
 	})
 }
 
-func TestAccPinpointApp_campaignHookLambda(t *testing.T) {
+func TestAccPinpointApp_disappears(t *testing.T) {
 	ctx := acctest.Context(t)
 	var application pinpoint.ApplicationResponse
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
@@ -55,23 +67,64 @@ func TestAccPinpointApp_campaignHookLambda(t *testing.T) {
 		CheckDestroy:             testAccCheckAppDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccAppConfig_campaignHookLambda(rName),
-				Check: resource.ComposeTestCheckFunc(
+				Config: testAccAppConfig_basic(rName),
+				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckAppExists(ctx, resourceName, &application),
-					resource.TestCheckResourceAttr(resourceName, "campaign_hook.#", "1"),
-					resource.TestCheckResourceAttr(resourceName, "campaign_hook.0.mode", "DELIVERY"),
+					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfpinpoint.ResourceApp(), resourceName),
 				),
+				ExpectNonEmptyPlan: true,
 			},
+		},
+	})
+}
+
+func TestAccPinpointApp_nameGenerated(t *testing.T) {
+	ctx := acctest.Context(t)
+	var application pinpoint.ApplicationResponse
+	resourceName := "aws_pinpoint_app.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheckApp(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, pinpoint.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckAppDestroy(ctx),
+		Steps: []resource.TestStep{
 			{
-				ResourceName:      resourceName,
-				ImportState:       true,
-				ImportStateVerify: true,
+				Config: testAccAppConfig_nameGenerated(),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckAppExists(ctx, resourceName, &application),
+					acctest.CheckResourceAttrNameGenerated(resourceName, "name"),
+					resource.TestCheckResourceAttr(resourceName, "name_prefix", id.UniqueIdPrefix),
+				),
 			},
 		},
 	})
 }
 
-func TestAccPinpointApp_limits(t *testing.T) {
+func TestAccPinpointApp_namePrefix(t *testing.T) {
+	ctx := acctest.Context(t)
+	var application pinpoint.ApplicationResponse
+	resourceName := "aws_pinpoint_app.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheckApp(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, pinpoint.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckAppDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccAppConfig_namePrefix("tf-acc-test-prefix-"),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckAppExists(ctx, resourceName, &application),
+					acctest.CheckResourceAttrNameFromPrefix(resourceName, "name", "tf-acc-test-prefix-"),
+					resource.TestCheckResourceAttr(resourceName, "name_prefix", "tf-acc-test-prefix-"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccPinpointApp_tags(t *testing.T) {
 	ctx := acctest.Context(t)
 	var application pinpoint.ApplicationResponse
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
@@ -84,11 +137,11 @@ func TestAccPinpointApp_limits(t *testing.T) {
 		CheckDestroy:             testAccCheckAppDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccAppConfig_limits(rName),
+				Config: testAccAppConfig_tags1(rName, "key1", "value1"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckAppExists(ctx, resourceName, &application),
-					resource.TestCheckResourceAttr(resourceName, "limits.#", "1"),
-					resource.TestCheckResourceAttr(resourceName, "limits.0.total", "100"),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
 				),
 			},
 			{
@@ -96,11 +149,28 @@ func TestAccPinpointApp_limits(t *testing.T) {
 				ImportState:       true,
 				ImportStateVerify: true,
 			},
+			{
+				Config: testAccAppConfig_tags2(rName, "key1", "value1updated", "key2", "value2"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAppExists(ctx, resourceName, &application),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1updated"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
+				),
+			},
+			{
+				Config: testAccAppConfig_tags1(rName, "key2", "value2"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAppExists(ctx, resourceName, &application),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
+				),
+			},
 		},
 	})
 }
 
-func TestAccPinpointApp_quietTime(t *testing.T) {
+func TestAccPinpointApp_campaignHookLambda(t *testing.T) {
 	ctx := acctest.Context(t)
 	var application pinpoint.ApplicationResponse
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
@@ -113,11 +183,11 @@ func TestAccPinpointApp_quietTime(t *testing.T) {
 		CheckDestroy:             testAccCheckAppDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccAppConfig_quietTime(rName),
+				Config: testAccAppConfig_campaignHookLambda(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckAppExists(ctx, resourceName, &application),
-					resource.TestCheckResourceAttr(resourceName, "quiet_time.#", "1"),
-					resource.TestCheckResourceAttr(resourceName, "quiet_time.0.start", "00:00"),
+					resource.TestCheckResourceAttr(resourceName, "campaign_hook.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "campaign_hook.0.mode", "DELIVERY"),
 				),
 			},
 			{
@@ -129,7 +199,7 @@ func TestAccPinpointApp_quietTime(t *testing.T) {
 	})
 }
 
-func TestAccPinpointApp_tags(t *testing.T) {
+func TestAccPinpointApp_limits(t *testing.T) {
 	ctx := acctest.Context(t)
 	var application pinpoint.ApplicationResponse
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
@@ -139,14 +209,14 @@ func TestAccPinpointApp_tags(t *testing.T) {
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheckApp(ctx, t) },
 		ErrorCheck:               acctest.ErrorCheck(t, pinpoint.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckRAMResourceShareDestroy(ctx),
+		CheckDestroy:             testAccCheckAppDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccAppConfig_tag1(rName, "key1", "value1"),
+				Config: testAccAppConfig_limits(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckAppExists(ctx, resourceName, &application),
-					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
-					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
+					resource.TestCheckResourceAttr(resourceName, "limits.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "limits.0.total", "100"),
 				),
 			},
 			{
@@ -154,22 +224,34 @@ func TestAccPinpointApp_tags(t *testing.T) {
 				ImportState:       true,
 				ImportStateVerify: true,
 			},
+		},
+	})
+}
+
+func TestAccPinpointApp_quietTime(t *testing.T) {
+	ctx := acctest.Context(t)
+	var application pinpoint.ApplicationResponse
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_pinpoint_app.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheckApp(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, pinpoint.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckAppDestroy(ctx),
+		Steps: []resource.TestStep{
 			{
-				Config: testAccAppConfig_tag2(rName, "key1", "value1updated", "key2", "value2"),
+				Config: testAccAppConfig_quietTime(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckAppExists(ctx, resourceName, &application),
-					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
-					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1updated"),
-					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
+					resource.TestCheckResourceAttr(resourceName, "quiet_time.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "quiet_time.0.start", "00:00"),
 				),
 			},
 			{
-				Config: testAccAppConfig_tag1(rName, "key2", "value2"),
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckAppExists(ctx, resourceName, &application),
-					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
-					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
-				),
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
 			},
 		},
 	})
@@ -191,38 +273,99 @@ func testAccPreCheckApp(ctx context.Context, t *testing.T) {
 	}
 }
 
-func testAccCheckAppExists(ctx context.Context, n string, application *pinpoint.ApplicationResponse) resource.TestCheckFunc {
+func testAccCheckAppDestroy(ctx context.Context) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		conn := acctest.Provider.Meta().(*conns.AWSClient).PinpointConn(ctx)
+
+		for _, rs := range s.RootModule().Resources {
+			if rs.Type != "aws_pinpoint_app" {
+				continue
+			}
+
+			_, err := tfpinpoint.FindAppByID(ctx, conn, rs.Primary.ID)
+
+			if tfresource.NotFound(err) {
+				continue
+			}
+
+			if err != nil {
+				return err
+			}
+
+			return fmt.Errorf("Pinpoint App %s still exists", rs.Primary.ID)
+		}
+
+		return nil
+	}
+}
+
+func testAccCheckAppExists(ctx context.Context, n string, v *pinpoint.ApplicationResponse) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		rs, ok := s.RootModule().Resources[n]
 		if !ok {
 			return fmt.Errorf("Not found: %s", n)
 		}
 
-		if rs.Primary.ID == "" {
-			return fmt.Errorf("No Pinpoint app with that ID exists")
-		}
-
 		conn := acctest.Provider.Meta().(*conns.AWSClient).PinpointConn(ctx)
 
-		// Check if the app exists
-		params := &pinpoint.GetAppInput{
-			ApplicationId: aws.String(rs.Primary.ID),
-		}
-		output, err := conn.GetAppWithContext(ctx, params)
+		output, err := tfpinpoint.FindAppByID(ctx, conn, rs.Primary.ID)
 
 		if err != nil {
 			return err
 		}
 
-		*application = *output.ApplicationResponse
+		*v = *output
 
 		return nil
 	}
 }
 
-const testAccAppConfig_generatedName = `
+func testAccAppConfig_basic(rName string) string {
+	return fmt.Sprintf(`
+resource "aws_pinpoint_app" "test" {
+  name = %[1]q
+}
+`, rName)
+}
+
+func testAccAppConfig_nameGenerated() string {
+	return `
 resource "aws_pinpoint_app" "test" {}
 `
+}
+
+func testAccAppConfig_namePrefix(namePrefix string) string {
+	return fmt.Sprintf(`
+resource "aws_pinpoint_app" "test" {
+  name_prefix = %[1]q
+}
+`, namePrefix)
+}
+
+func testAccAppConfig_tags1(rName, tagKey1, tagValue1 string) string {
+	return fmt.Sprintf(`
+resource "aws_pinpoint_app" "test" {
+  name = %[1]q
+
+  tags = {
+    %[2]q = %[3]q
+  }
+}
+`, rName, tagKey1, tagValue1)
+}
+
+func testAccAppConfig_tags2(rName, tagKey1, tagValue1, tagKey2, tagValue2 string) string {
+	return fmt.Sprintf(`
+resource "aws_pinpoint_app" "test" {
+  name = %[1]q
+
+  tags = {
+    %[2]q = %[3]q
+    %[4]q = %[5]q
+  }
+}
+`, rName, tagKey1, tagValue1, tagKey2, tagValue2)
+}
 
 func testAccAppConfig_campaignHookLambda(rName string) string {
 	return fmt.Sprintf(`
@@ -309,86 +452,3 @@ resource "aws_pinpoint_app" "test" {
 }
 `, rName)
 }
-
-func testAccAppConfig_tag1(rName, tagKey1, tagValue1 string) string {
-	return fmt.Sprintf(`
-resource "aws_pinpoint_app" "test" {
-  name = %[1]q
-
-  tags = {
-    %[2]q = %[3]q
-  }
-}
-`, rName, tagKey1, tagValue1)
-}
-
-func testAccAppConfig_tag2(rName, tagKey1, tagValue1, tagKey2, tagValue2 string) string {
-	return fmt.Sprintf(`
-resource "aws_pinpoint_app" "test" {
-  name = %[1]q
-
-  tags = {
-    %[2]q = %[3]q
-    %[4]q = %[5]q
-  }
-}
-`, rName, tagKey1, tagValue1, tagKey2, tagValue2)
-}
-
-func testAccCheckAppDestroy(ctx context.Context) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		conn := acctest.Provider.Meta().(*conns.AWSClient).PinpointConn(ctx)
-
-		for _, rs := range s.RootModule().Resources {
-			if rs.Type != "aws_pinpoint_app" {
-				continue
-			}
-
-			// Check if the topic exists by fetching its attributes
-			params := &pinpoint.GetAppInput{
-				ApplicationId: aws.String(rs.Primary.ID),
-			}
-			_, err := conn.GetAppWithContext(ctx, params)
-			if err != nil {
-				if tfawserr.ErrCodeEquals(err, pinpoint.ErrCodeNotFoundException) {
-					continue
-				}
-				return err
-			}
-			return fmt.Errorf("App exists when it should be destroyed!")
-		}
-
-		return nil
-	}
-}
-
-func testAccCheckRAMResourceShareDestroy(ctx context.Context) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		conn := acctest.Provider.Meta().(*conns.AWSClient).RAMConn(ctx)
-
-		for _, rs := range s.RootModule().Resources {
-			if rs.Type != "aws_ram_resource_share" {
-				continue
-			}
-
-			request := &ram.GetResourceSharesInput{
-				ResourceShareArns: []*string{aws.String(rs.Primary.ID)},
-				ResourceOwner:     aws.String(ram.ResourceOwnerSelf),
-			}
-
-			output, err := conn.GetResourceSharesWithContext(ctx, request)
-			if err != nil {
-				return err
-			}
-
-			if len(output.ResourceShares) > 0 {
-				resourceShare := output.ResourceShares[0]
-				if aws.StringValue(resourceShare.Status) != ram.ResourceShareStatusDeleted {
-					return fmt.Errorf("RAM resource share (%s) still exists", rs.Primary.ID)
-				}
-			}
-		}
-
-		return nil
-	}
-}
diff --git a/internal/service/pinpoint/baidu_channel.go b/internal/service/pinpoint/baidu_channel.go
index 357ca7058e6..ddde104f65f 100644
--- a/internal/service/pinpoint/baidu_channel.go
+++ b/internal/service/pinpoint/baidu_channel.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package pinpoint
 
 import (
diff --git a/internal/service/pinpoint/baidu_channel_test.go b/internal/service/pinpoint/baidu_channel_test.go
index d6eb398993d..66cc16e091b 100644
--- a/internal/service/pinpoint/baidu_channel_test.go
+++ b/internal/service/pinpoint/baidu_channel_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package pinpoint_test
 
 import (
diff --git a/internal/service/pinpoint/consts.go b/internal/service/pinpoint/consts.go
index 2ce2a4d0c69..0a5feebbee6 100644
--- a/internal/service/pinpoint/consts.go
+++ b/internal/service/pinpoint/consts.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package pinpoint
 
 import (
diff --git a/internal/service/pinpoint/email_channel.go b/internal/service/pinpoint/email_channel.go
index 344589e6530..f239a919ccd 100644
--- a/internal/service/pinpoint/email_channel.go
+++ b/internal/service/pinpoint/email_channel.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package pinpoint
 
 import (
diff --git a/internal/service/pinpoint/email_channel_test.go b/internal/service/pinpoint/email_channel_test.go
index 930f55aa3c2..fee78750323 100644
--- a/internal/service/pinpoint/email_channel_test.go
+++ b/internal/service/pinpoint/email_channel_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package pinpoint_test
 
 import (
diff --git a/internal/service/pinpoint/event_stream.go b/internal/service/pinpoint/event_stream.go
index dfe9d8fb3a0..95cb1ca9519 100644
--- a/internal/service/pinpoint/event_stream.go
+++ b/internal/service/pinpoint/event_stream.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package pinpoint
 
 import (
diff --git a/internal/service/pinpoint/event_stream_test.go b/internal/service/pinpoint/event_stream_test.go
index 8b1ee207c8b..63af5473437 100644
--- a/internal/service/pinpoint/event_stream_test.go
+++ b/internal/service/pinpoint/event_stream_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package pinpoint_test
 
 import (
diff --git a/internal/service/pinpoint/gcm_channel.go b/internal/service/pinpoint/gcm_channel.go
index aa7808f7af4..37f64c4dec4 100644
--- a/internal/service/pinpoint/gcm_channel.go
+++ b/internal/service/pinpoint/gcm_channel.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package pinpoint
 
 import (
diff --git a/internal/service/pinpoint/gcm_channel_test.go b/internal/service/pinpoint/gcm_channel_test.go
index 0d54d7192e5..09051f4b527 100644
--- a/internal/service/pinpoint/gcm_channel_test.go
+++ b/internal/service/pinpoint/gcm_channel_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package pinpoint_test
 
 import (
diff --git a/internal/service/pinpoint/generate.go b/internal/service/pinpoint/generate.go
index 5a2ced2a472..b52ebd52b1a 100644
--- a/internal/service/pinpoint/generate.go
+++ b/internal/service/pinpoint/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTags -ListTagsOutTagsElem=TagsModel.Tags -ServiceTagsMap "-TagInCustomVal=&pinpoint.TagsModel{Tags: Tags(updatedTags.IgnoreAWS())}" -TagInTagsElem=TagsModel -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/pinpoint/service_package_gen.go b/internal/service/pinpoint/service_package_gen.go
index 7f5e65ddb7d..a2b2db28301 100644
--- a/internal/service/pinpoint/service_package_gen.go
+++ b/internal/service/pinpoint/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	pinpoint_sdkv1 "github.com/aws/aws-sdk-go/service/pinpoint"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -90,4 +91,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*p
 	return pinpoint_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/pinpoint/sms_channel.go b/internal/service/pinpoint/sms_channel.go
index d900dc3f493..ad373824b07 100644
--- a/internal/service/pinpoint/sms_channel.go
+++ b/internal/service/pinpoint/sms_channel.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package pinpoint
 
 import (
diff --git a/internal/service/pinpoint/sms_channel_test.go b/internal/service/pinpoint/sms_channel_test.go
index 4bc2fd250d5..c378516c38f 100644
--- a/internal/service/pinpoint/sms_channel_test.go
+++ b/internal/service/pinpoint/sms_channel_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package pinpoint_test
 
 import (
diff --git a/internal/service/pinpoint/sweep.go b/internal/service/pinpoint/sweep.go
index 20ab430b00e..9411e513553 100644
--- a/internal/service/pinpoint/sweep.go
+++ b/internal/service/pinpoint/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package pinpoint
 
@@ -11,9 +11,10 @@ import (
 	"github.com/aws/aws-sdk-go/service/pinpoint"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_pinpoint_app", &resource.Sweeper{
 		Name: "aws_pinpoint_app",
 		F:    sweepApps,
@@ -22,7 +23,7 @@ func init() {
 
 func sweepApps(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -33,7 +34,7 @@ func sweepApps(region string) error {
 	for {
 		output, err := conn.GetAppsWithContext(ctx, input)
 		if err != nil {
-			if sweep.SkipSweepError(err) {
+			if awsv1.SkipSweepError(err) {
 				log.Printf("[WARN] Skipping Pinpoint app sweep for %s: %s", region, err)
 				return nil
 			}
diff --git a/internal/service/pinpoint/tags_gen.go b/internal/service/pinpoint/tags_gen.go
index fce7fc67a13..e79decfc135 100644
--- a/internal/service/pinpoint/tags_gen.go
+++ b/internal/service/pinpoint/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/pinpoint"
 	"github.com/aws/aws-sdk-go/service/pinpoint/pinpointiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -54,7 +56,7 @@ func Tags(tags tftags.KeyValueTags) map[string]*string {
 	return aws.StringMap(tags.Map())
 }
 
-// KeyValueTags creates KeyValueTags from pinpoint service tags.
+// KeyValueTags creates tftags.KeyValueTags from pinpoint service tags.
 func KeyValueTags(ctx context.Context, tags map[string]*string) tftags.KeyValueTags {
 	return tftags.New(ctx, tags)
 }
@@ -85,6 +87,8 @@ func updateTags(ctx context.Context, conn pinpointiface.PinpointAPI, identifier
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.Pinpoint)
 	if len(removedTags) > 0 {
diff --git a/internal/service/pipes/enrichment_parameters.go b/internal/service/pipes/enrichment_parameters.go
new file mode 100644
index 00000000000..e4f0d34db36
--- /dev/null
+++ b/internal/service/pipes/enrichment_parameters.go
@@ -0,0 +1,136 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package pipes
+
+import (
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/pipes/types"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
+	"github.com/hashicorp/terraform-provider-aws/internal/flex"
+)
+
+func enrichmentParametersSchema() *schema.Schema {
+	return &schema.Schema{
+		Type:     schema.TypeList,
+		Optional: true,
+		MaxItems: 1,
+		Elem: &schema.Resource{
+			Schema: map[string]*schema.Schema{
+				"http_parameters": {
+					Type:     schema.TypeList,
+					Optional: true,
+					MaxItems: 1,
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"header_parameters": {
+								Type:     schema.TypeMap,
+								Optional: true,
+								Elem:     &schema.Schema{Type: schema.TypeString},
+							},
+							"path_parameter_values": {
+								Type:     schema.TypeList,
+								Optional: true,
+								MaxItems: 1,
+								Elem: &schema.Schema{
+									Type: schema.TypeString,
+								},
+							},
+							"query_string_parameters": {
+								Type:     schema.TypeMap,
+								Optional: true,
+								Elem:     &schema.Schema{Type: schema.TypeString},
+							},
+						},
+					},
+				},
+				"input_template": {
+					Type:         schema.TypeString,
+					Optional:     true,
+					ValidateFunc: validation.StringLenBetween(0, 8192),
+				},
+			},
+		},
+	}
+}
+
+func expandPipeEnrichmentParameters(tfMap map[string]interface{}) *types.PipeEnrichmentParameters {
+	if tfMap == nil {
+		return nil
+	}
+
+	apiObject := &types.PipeEnrichmentParameters{}
+
+	if v, ok := tfMap["http_parameters"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
+		apiObject.HttpParameters = expandPipeEnrichmentHTTPParameters(v[0].(map[string]interface{}))
+	}
+
+	if v, ok := tfMap["input_template"].(string); ok && v != "" {
+		apiObject.InputTemplate = aws.String(v)
+	}
+
+	return apiObject
+}
+
+func expandPipeEnrichmentHTTPParameters(tfMap map[string]interface{}) *types.PipeEnrichmentHttpParameters {
+	if tfMap == nil {
+		return nil
+	}
+
+	apiObject := &types.PipeEnrichmentHttpParameters{}
+
+	if v, ok := tfMap["header_parameters"].(map[string]interface{}); ok && len(v) > 0 {
+		apiObject.HeaderParameters = flex.ExpandStringValueMap(v)
+	}
+
+	if v, ok := tfMap["path_parameter_values"].([]interface{}); ok && len(v) > 0 {
+		apiObject.PathParameterValues = flex.ExpandStringValueList(v)
+	}
+
+	if v, ok := tfMap["query_string_parameters"].(map[string]interface{}); ok && len(v) > 0 {
+		apiObject.QueryStringParameters = flex.ExpandStringValueMap(v)
+	}
+
+	return apiObject
+}
+
+func flattenPipeEnrichmentParameters(apiObject *types.PipeEnrichmentParameters) map[string]interface{} {
+	if apiObject == nil {
+		return nil
+	}
+
+	tfMap := map[string]interface{}{}
+
+	if v := apiObject.HttpParameters; v != nil {
+		tfMap["http_parameters"] = []interface{}{flattenPipeEnrichmentHTTPParameters(v)}
+	}
+
+	if v := apiObject.InputTemplate; v != nil {
+		tfMap["input_template"] = aws.ToString(v)
+	}
+
+	return tfMap
+}
+
+func flattenPipeEnrichmentHTTPParameters(apiObject *types.PipeEnrichmentHttpParameters) map[string]interface{} {
+	if apiObject == nil {
+		return nil
+	}
+
+	tfMap := map[string]interface{}{}
+
+	if v := apiObject.HeaderParameters; v != nil {
+		tfMap["header_parameters"] = v
+	}
+
+	if v := apiObject.PathParameterValues; v != nil {
+		tfMap["path_parameter_values"] = v
+	}
+
+	if v := apiObject.QueryStringParameters; v != nil {
+		tfMap["query_string_parameters"] = v
+	}
+
+	return tfMap
+}
diff --git a/internal/service/pipes/exports_test.go b/internal/service/pipes/exports_test.go
new file mode 100644
index 00000000000..b27f1e9c5b3
--- /dev/null
+++ b/internal/service/pipes/exports_test.go
@@ -0,0 +1,11 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package pipes
+
+// Exports for use in tests only.
+var (
+	FindPipeByName = findPipeByName
+
+	ResourcePipe = resourcePipe
+)
diff --git a/internal/service/pipes/find.go b/internal/service/pipes/find.go
deleted file mode 100644
index 7a3e3a59539..00000000000
--- a/internal/service/pipes/find.go
+++ /dev/null
@@ -1,37 +0,0 @@
-package pipes
-
-import (
-	"context"
-
-	"github.com/aws/aws-sdk-go-v2/aws"
-	"github.com/aws/aws-sdk-go-v2/service/pipes"
-	"github.com/aws/aws-sdk-go-v2/service/pipes/types"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
-	"github.com/hashicorp/terraform-provider-aws/internal/errs"
-	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
-)
-
-func FindPipeByName(ctx context.Context, conn *pipes.Client, name string) (*pipes.DescribePipeOutput, error) {
-	input := &pipes.DescribePipeInput{
-		Name: aws.String(name),
-	}
-
-	output, err := conn.DescribePipe(ctx, input)
-
-	if errs.IsA[*types.NotFoundException](err) {
-		return nil, &retry.NotFoundError{
-			LastError:   err,
-			LastRequest: input,
-		}
-	}
-
-	if err != nil {
-		return nil, err
-	}
-
-	if output == nil || output.Arn == nil {
-		return nil, tfresource.NewEmptyResultError(input)
-	}
-
-	return output, nil
-}
diff --git a/internal/service/pipes/flex.go b/internal/service/pipes/flex.go
deleted file mode 100644
index b3e0de87060..00000000000
--- a/internal/service/pipes/flex.go
+++ /dev/null
@@ -1,146 +0,0 @@
-package pipes
-
-import (
-	"github.com/aws/aws-sdk-go-v2/aws"
-	"github.com/aws/aws-sdk-go-v2/service/pipes/types"
-)
-
-func expandFilter(tfMap map[string]interface{}) *types.Filter {
-	if tfMap == nil {
-		return nil
-	}
-
-	output := &types.Filter{}
-
-	if v, ok := tfMap["pattern"].(string); ok && len(v) > 0 {
-		output.Pattern = aws.String(v)
-	}
-
-	return output
-}
-
-func flattenFilter(apiObject types.Filter) map[string]interface{} {
-	m := map[string]interface{}{}
-
-	if v := apiObject.Pattern; v != nil {
-		m["pattern"] = aws.ToString(v)
-	}
-
-	return m
-}
-
-func expandFilters(tfList []interface{}) []types.Filter {
-	if len(tfList) == 0 {
-		return nil
-	}
-
-	var s []types.Filter
-
-	for _, v := range tfList {
-		a := expandFilter(v.(map[string]interface{}))
-
-		if a == nil {
-			continue
-		}
-
-		s = append(s, *a)
-	}
-
-	return s
-}
-
-func flattenFilters(apiObjects []types.Filter) []interface{} {
-	if len(apiObjects) == 0 {
-		return nil
-	}
-
-	var l []interface{}
-
-	for _, apiObject := range apiObjects {
-		l = append(l, flattenFilter(apiObject))
-	}
-
-	return l
-}
-
-func expandFilterCriteria(tfMap map[string]interface{}) *types.FilterCriteria {
-	if tfMap == nil {
-		return nil
-	}
-
-	output := &types.FilterCriteria{}
-
-	if v, ok := tfMap["filter"].([]interface{}); ok && len(v) > 0 {
-		output.Filters = expandFilters(v)
-	}
-
-	return output
-}
-
-func flattenFilterCriteria(apiObject *types.FilterCriteria) map[string]interface{} {
-	if apiObject == nil {
-		return nil
-	}
-
-	m := map[string]interface{}{}
-
-	m["filter"] = flattenFilters(apiObject.Filters)
-
-	return m
-}
-
-func expandPipeSourceParameters(tfMap map[string]interface{}) *types.PipeSourceParameters {
-	if tfMap == nil {
-		return nil
-	}
-
-	a := &types.PipeSourceParameters{}
-
-	if v, ok := tfMap["filter_criteria"].([]interface{}); ok {
-		a.FilterCriteria = expandFilterCriteria(v[0].(map[string]interface{}))
-	}
-
-	return a
-}
-
-func flattenPipeSourceParameters(apiObject *types.PipeSourceParameters) map[string]interface{} {
-	if apiObject == nil {
-		return nil
-	}
-
-	m := map[string]interface{}{}
-
-	if v := apiObject.FilterCriteria; v != nil {
-		m["filter_criteria"] = []interface{}{flattenFilterCriteria(v)}
-	}
-
-	return m
-}
-
-func expandPipeTargetParameters(tfMap map[string]interface{}) *types.PipeTargetParameters {
-	if tfMap == nil {
-		return nil
-	}
-
-	a := &types.PipeTargetParameters{}
-
-	if v, ok := tfMap["input_template"].(string); ok {
-		a.InputTemplate = aws.String(v)
-	}
-
-	return a
-}
-
-func flattenPipeTargetParameters(apiObject *types.PipeTargetParameters) map[string]interface{} {
-	if apiObject == nil {
-		return nil
-	}
-
-	m := map[string]interface{}{}
-
-	if v := apiObject.InputTemplate; v != nil {
-		m["input_template"] = aws.ToString(v)
-	}
-
-	return m
-}
diff --git a/internal/service/pipes/generate.go b/internal/service/pipes/generate.go
index d54fed6416a..941e7284d7b 100644
--- a/internal/service/pipes/generate.go
+++ b/internal/service/pipes/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -AWSSDKVersion=2 -ListTags -UpdateTags -ServiceTagsMap  -KVTValues -SkipTypesImp
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/pipes/pipe.go b/internal/service/pipes/pipe.go
index e81ed0fc290..2562143fe3e 100644
--- a/internal/service/pipes/pipe.go
+++ b/internal/service/pipes/pipe.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package pipes
 
 import (
@@ -6,11 +9,13 @@ import (
 	"log"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/pipes"
-	"github.com/aws/aws-sdk-go-v2/service/pipes/types"
+	awstypes "github.com/aws/aws-sdk-go-v2/service/pipes/types"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
@@ -19,13 +24,14 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/errs"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
 // @SDKResource("aws_pipes_pipe", name="Pipe")
 // @Tags(identifierAttribute="arn")
-func ResourcePipe() *schema.Resource {
+func resourcePipe() *schema.Resource {
 	return &schema.Resource{
 		CreateWithoutTimeout: resourcePipeCreate,
 		ReadWithoutTimeout:   resourcePipeRead,
@@ -57,21 +63,25 @@ func ResourcePipe() *schema.Resource {
 			"desired_state": {
 				Type:             schema.TypeString,
 				Optional:         true,
-				Default:          string(types.RequestedPipeStateRunning),
-				ValidateDiagFunc: enum.Validate[types.RequestedPipeState](),
+				Default:          string(awstypes.RequestedPipeStateRunning),
+				ValidateDiagFunc: enum.Validate[awstypes.RequestedPipeState](),
 			},
 			"enrichment": {
 				Type:         schema.TypeString,
 				Optional:     true,
-				ValidateFunc: validation.StringLenBetween(1, 1600),
+				ValidateFunc: verify.ValidARN,
 			},
+			"enrichment_parameters": enrichmentParametersSchema(),
 			"name": {
 				Type:          schema.TypeString,
 				Optional:      true,
 				Computed:      true,
 				ForceNew:      true,
 				ConflictsWith: []string{"name_prefix"},
-				ValidateFunc:  validation.StringLenBetween(1, 64),
+				ValidateFunc: validation.All(
+					validation.StringLenBetween(1, 64),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_.-]+`), ""),
+				),
 			},
 			"name_prefix": {
 				Type:          schema.TypeString,
@@ -79,7 +89,10 @@ func ResourcePipe() *schema.Resource {
 				Computed:      true,
 				ForceNew:      true,
 				ConflictsWith: []string{"name"},
-				ValidateFunc:  validation.StringLenBetween(1, 64-id.UniqueIDSuffixLength),
+				ValidateFunc: validation.All(
+					validation.StringLenBetween(1, 64-id.UniqueIDSuffixLength),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_.-]+`), ""),
+				),
 			},
 			"role_arn": {
 				Type:         schema.TypeString,
@@ -87,65 +100,23 @@ func ResourcePipe() *schema.Resource {
 				ValidateFunc: verify.ValidARN,
 			},
 			"source": {
-				Type:         schema.TypeString,
-				Required:     true,
-				ForceNew:     true,
-				ValidateFunc: validation.StringLenBetween(1, 1600),
-			},
-			"source_parameters": {
-				Type:     schema.TypeList,
+				Type:     schema.TypeString,
 				Required: true,
-				MaxItems: 1,
-				Elem: &schema.Resource{
-					Schema: map[string]*schema.Schema{
-						"filter_criteria": {
-							Type:             schema.TypeList,
-							Optional:         true,
-							MaxItems:         1,
-							DiffSuppressFunc: suppressEmptyConfigurationBlock("source_parameters.0.filter_criteria"),
-							Elem: &schema.Resource{
-								Schema: map[string]*schema.Schema{
-									"filter": {
-										Type:     schema.TypeList,
-										Optional: true,
-										MaxItems: 5,
-										Elem: &schema.Resource{
-											Schema: map[string]*schema.Schema{
-												"pattern": {
-													Type:         schema.TypeString,
-													Required:     true,
-													ValidateFunc: validation.StringLenBetween(1, 4096),
-												},
-											},
-										},
-									},
-								},
-							},
-						},
-					},
-				},
+				ForceNew: true,
+				ValidateFunc: validation.Any(
+					verify.ValidARN,
+					validation.StringMatch(regexache.MustCompile(`^smk://(([0-9A-Za-z]|[0-9A-Za-z][0-9A-Za-z-]*[0-9A-Za-z])\.)*([0-9A-Za-z]|[0-9A-Za-z][0-9A-Za-z-]*[0-9A-Za-z]):[0-9]{1,5}|arn:(aws[0-9A-Za-z-]*):([0-9A-Za-z-]+):([a-z]{2}((-gov)|(-iso(b?)))?-[a-z]+-\d{1})?:(\d{12})?:(.+)$`), ""),
+				),
 			},
-			names.AttrTags:    tftags.TagsSchema(),
-			names.AttrTagsAll: tftags.TagsSchemaComputed(),
+			"source_parameters": sourceParametersSchema(),
 			"target": {
 				Type:         schema.TypeString,
 				Required:     true,
-				ValidateFunc: validation.StringLenBetween(1, 1600),
-			},
-			"target_parameters": {
-				Type:     schema.TypeList,
-				Required: true,
-				MaxItems: 1,
-				Elem: &schema.Resource{
-					Schema: map[string]*schema.Schema{
-						"input_template": {
-							Type:         schema.TypeString,
-							Optional:     true,
-							ValidateFunc: validation.StringLenBetween(0, 8192),
-						},
-					},
-				},
+				ValidateFunc: verify.ValidARN,
 			},
+			"target_parameters": targetParametersSchema(),
+			names.AttrTags:      tftags.TagsSchema(),
+			names.AttrTagsAll:   tftags.TagsSchemaComputed(),
 		},
 	}
 }
@@ -159,7 +130,7 @@ func resourcePipeCreate(ctx context.Context, d *schema.ResourceData, meta interf
 
 	name := create.Name(d.Get("name").(string), d.Get("name_prefix").(string))
 	input := &pipes.CreatePipeInput{
-		DesiredState: types.RequestedPipeState(d.Get("desired_state").(string)),
+		DesiredState: awstypes.RequestedPipeState(d.Get("desired_state").(string)),
 		Name:         aws.String(name),
 		RoleArn:      aws.String(d.Get("role_arn").(string)),
 		Source:       aws.String(d.Get("source").(string)),
@@ -167,31 +138,32 @@ func resourcePipeCreate(ctx context.Context, d *schema.ResourceData, meta interf
 		Target:       aws.String(d.Get("target").(string)),
 	}
 
-	if v, ok := d.Get("description").(string); ok {
-		input.Description = aws.String(v)
+	if v, ok := d.GetOk("description"); ok {
+		input.Description = aws.String(v.(string))
 	}
 
-	if v, ok := d.Get("enrichment").(string); ok && v != "" {
-		input.Enrichment = aws.String(v)
+	if v, ok := d.GetOk("enrichment"); ok && v != "" {
+		input.Enrichment = aws.String(v.(string))
 	}
 
-	if v, ok := d.Get("source_parameters").([]interface{}); ok && len(v) > 0 && v[0] != nil {
-		input.SourceParameters = expandPipeSourceParameters(v[0].(map[string]interface{}))
+	if v, ok := d.GetOk("enrichment_parameters"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
+		input.EnrichmentParameters = expandPipeEnrichmentParameters(v.([]interface{})[0].(map[string]interface{}))
 	}
 
-	if v, ok := d.Get("target_parameters").([]interface{}); ok && len(v) > 0 && v[0] != nil {
-		input.TargetParameters = expandPipeTargetParameters(v[0].(map[string]interface{}))
+	if v, ok := d.GetOk("source_parameters"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
+		input.SourceParameters = expandPipeSourceParameters(v.([]interface{})[0].(map[string]interface{}))
+	}
+
+	if v, ok := d.GetOk("target_parameters"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
+		input.TargetParameters = expandPipeTargetParameters(v.([]interface{})[0].(map[string]interface{}))
 	}
 
 	output, err := conn.CreatePipe(ctx, input)
+
 	if err != nil {
 		return create.DiagError(names.Pipes, create.ErrActionCreating, ResNamePipe, name, err)
 	}
 
-	if output == nil || output.Arn == nil {
-		return create.DiagError(names.Pipes, create.ErrActionCreating, ResNamePipe, name, errors.New("empty output"))
-	}
-
 	d.SetId(aws.ToString(output.Name))
 
 	if _, err := waitPipeCreated(ctx, conn, d.Id(), d.Timeout(schema.TimeoutCreate)); err != nil {
@@ -204,7 +176,7 @@ func resourcePipeCreate(ctx context.Context, d *schema.ResourceData, meta interf
 func resourcePipeRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	conn := meta.(*conns.AWSClient).PipesClient(ctx)
 
-	output, err := FindPipeByName(ctx, conn, d.Id())
+	output, err := findPipeByName(ctx, conn, d.Id())
 
 	if !d.IsNewResource() && tfresource.NotFound(err) {
 		log.Printf("[WARN] EventBridge Pipes Pipe (%s) not found, removing from state", d.Id())
@@ -220,23 +192,31 @@ func resourcePipeRead(ctx context.Context, d *schema.ResourceData, meta interfac
 	d.Set("description", output.Description)
 	d.Set("desired_state", output.DesiredState)
 	d.Set("enrichment", output.Enrichment)
+	if v := output.EnrichmentParameters; !types.IsZero(v) {
+		if err := d.Set("enrichment_parameters", []interface{}{flattenPipeEnrichmentParameters(v)}); err != nil {
+			return diag.Errorf("setting enrichment_parameters: %s", err)
+		}
+	} else {
+		d.Set("enrichment_parameters", nil)
+	}
 	d.Set("name", output.Name)
 	d.Set("name_prefix", create.NamePrefixFromName(aws.ToString(output.Name)))
-
-	if v := output.SourceParameters; v != nil {
+	d.Set("role_arn", output.RoleArn)
+	d.Set("source", output.Source)
+	if v := output.SourceParameters; !types.IsZero(v) {
 		if err := d.Set("source_parameters", []interface{}{flattenPipeSourceParameters(v)}); err != nil {
-			return create.DiagError(names.Pipes, create.ErrActionSetting, ResNamePipe, d.Id(), err)
+			return diag.Errorf("setting source_parameters: %s", err)
 		}
+	} else {
+		d.Set("source_parameters", nil)
 	}
-
-	d.Set("role_arn", output.RoleArn)
-	d.Set("source", output.Source)
 	d.Set("target", output.Target)
-
-	if v := output.TargetParameters; v != nil {
+	if v := output.TargetParameters; !types.IsZero(v) {
 		if err := d.Set("target_parameters", []interface{}{flattenPipeTargetParameters(v)}); err != nil {
-			return create.DiagError(names.Pipes, create.ErrActionSetting, ResNamePipe, d.Id(), err)
+			return diag.Errorf("setting target_parameters: %s", err)
 		}
+	} else {
+		d.Set("target_parameters", nil)
 	}
 
 	return nil
@@ -248,45 +228,38 @@ func resourcePipeUpdate(ctx context.Context, d *schema.ResourceData, meta interf
 	if d.HasChangesExcept("tags", "tags_all") {
 		input := &pipes.UpdatePipeInput{
 			Description:  aws.String(d.Get("description").(string)),
-			DesiredState: types.RequestedPipeState(d.Get("desired_state").(string)),
+			DesiredState: awstypes.RequestedPipeState(d.Get("desired_state").(string)),
 			Name:         aws.String(d.Id()),
 			RoleArn:      aws.String(d.Get("role_arn").(string)),
 			Target:       aws.String(d.Get("target").(string)),
-
-			// Omitting the SourceParameters entirely is interpreted as "no change".
-			SourceParameters: &types.UpdatePipeSourceParameters{},
-			TargetParameters: &types.PipeTargetParameters{},
+			// Reset state in case it's a deletion, have to set the input to an empty string otherwise it doesn't get overwritten.
+			TargetParameters: &awstypes.PipeTargetParameters{
+				InputTemplate: aws.String(""),
+			},
 		}
 
 		if d.HasChange("enrichment") {
-			// Reset state in case it's a deletion.
-			input.Enrichment = aws.String("")
+			input.Enrichment = aws.String(d.Get("enrichment").(string))
 		}
 
-		if v, ok := d.Get("enrichment").(string); ok && v != "" {
-			input.Enrichment = aws.String(v)
+		if d.HasChange("enrichment_parameters") {
+			if v, ok := d.GetOk("enrichment_parameters"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
+				input.EnrichmentParameters = expandPipeEnrichmentParameters(v.([]interface{})[0].(map[string]interface{}))
+			}
 		}
 
-		if d.HasChange("source_parameters.0.filter_criteria") {
-			// To unset a parameter, it must be set to an empty object. Nulling a
-			// parameter will be interpreted as "no change".
-			input.SourceParameters.FilterCriteria = &types.FilterCriteria{}
+		if d.HasChange("source_parameters") {
+			if v, ok := d.GetOk("source_parameters"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
+				input.SourceParameters = expandUpdatePipeSourceParameters(v.([]interface{})[0].(map[string]interface{}))
+			}
 		}
 
-		if v, ok := d.Get("source_parameters.0.filter_criteria").([]interface{}); ok && len(v) > 0 && v[0] != nil {
-			input.SourceParameters.FilterCriteria = expandFilterCriteria(v[0].(map[string]interface{}))
+		if d.HasChange("target_parameters") {
+			if v, ok := d.GetOk("target_parameters"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
+				input.TargetParameters = expandPipeTargetParameters(v.([]interface{})[0].(map[string]interface{}))
+			}
 		}
 
-		if d.HasChange("target_parameters.0.input_template") {
-			input.TargetParameters.InputTemplate = aws.String("")
-		}
-
-		if v, ok := d.Get("target_parameters.0.input_template").(string); ok {
-			input.TargetParameters.InputTemplate = aws.String(v)
-		}
-
-		log.Printf("[DEBUG] Updating EventBridge Pipes Pipe (%s): %#v", d.Id(), input)
-
 		output, err := conn.UpdatePipe(ctx, input)
 
 		if err != nil {
@@ -309,7 +282,7 @@ func resourcePipeDelete(ctx context.Context, d *schema.ResourceData, meta interf
 		Name: aws.String(d.Id()),
 	})
 
-	if errs.IsA[*types.NotFoundException](err) {
+	if errs.IsA[*awstypes.NotFoundException](err) {
 		return nil
 	}
 
@@ -324,6 +297,105 @@ func resourcePipeDelete(ctx context.Context, d *schema.ResourceData, meta interf
 	return nil
 }
 
+func findPipeByName(ctx context.Context, conn *pipes.Client, name string) (*pipes.DescribePipeOutput, error) {
+	input := &pipes.DescribePipeInput{
+		Name: aws.String(name),
+	}
+
+	output, err := conn.DescribePipe(ctx, input)
+
+	if errs.IsA[*awstypes.NotFoundException](err) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	if output == nil || output.Arn == nil {
+		return nil, tfresource.NewEmptyResultError(input)
+	}
+
+	return output, nil
+}
+
+func statusPipe(ctx context.Context, conn *pipes.Client, name string) retry.StateRefreshFunc {
+	return func() (interface{}, string, error) {
+		output, err := findPipeByName(ctx, conn, name)
+
+		if tfresource.NotFound(err) {
+			return nil, "", nil
+		}
+
+		if err != nil {
+			return nil, "", err
+		}
+
+		return output, string(output.CurrentState), nil
+	}
+}
+
+func waitPipeCreated(ctx context.Context, conn *pipes.Client, id string, timeout time.Duration) (*pipes.DescribePipeOutput, error) {
+	stateConf := &retry.StateChangeConf{
+		Pending:                   enum.Slice(awstypes.PipeStateCreating),
+		Target:                    enum.Slice(awstypes.PipeStateRunning, awstypes.PipeStateStopped),
+		Refresh:                   statusPipe(ctx, conn, id),
+		Timeout:                   timeout,
+		NotFoundChecks:            20,
+		ContinuousTargetOccurence: 1,
+	}
+
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+	if output, ok := outputRaw.(*pipes.DescribePipeOutput); ok {
+		tfresource.SetLastError(err, errors.New(aws.ToString(output.StateReason)))
+
+		return output, err
+	}
+
+	return nil, err
+}
+
+func waitPipeUpdated(ctx context.Context, conn *pipes.Client, id string, timeout time.Duration) (*pipes.DescribePipeOutput, error) {
+	stateConf := &retry.StateChangeConf{
+		Pending:                   enum.Slice(awstypes.PipeStateUpdating),
+		Target:                    enum.Slice(awstypes.PipeStateRunning, awstypes.PipeStateStopped),
+		Refresh:                   statusPipe(ctx, conn, id),
+		Timeout:                   timeout,
+		NotFoundChecks:            20,
+		ContinuousTargetOccurence: 1,
+	}
+
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+	if output, ok := outputRaw.(*pipes.DescribePipeOutput); ok {
+		tfresource.SetLastError(err, errors.New(aws.ToString(output.StateReason)))
+
+		return output, err
+	}
+
+	return nil, err
+}
+
+func waitPipeDeleted(ctx context.Context, conn *pipes.Client, id string, timeout time.Duration) (*pipes.DescribePipeOutput, error) {
+	stateConf := &retry.StateChangeConf{
+		Pending: enum.Slice(awstypes.PipeStateDeleting),
+		Target:  []string{},
+		Refresh: statusPipe(ctx, conn, id),
+		Timeout: timeout,
+	}
+
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+	if output, ok := outputRaw.(*pipes.DescribePipeOutput); ok {
+		tfresource.SetLastError(err, errors.New(aws.ToString(output.StateReason)))
+
+		return output, err
+	}
+
+	return nil, err
+}
+
 func suppressEmptyConfigurationBlock(key string) schema.SchemaDiffSuppressFunc {
 	return func(k, o, n string, d *schema.ResourceData) bool {
 		if k != key+".#" {
diff --git a/internal/service/pipes/pipe_test.go b/internal/service/pipes/pipe_test.go
index 38fc2db22d9..3c6f4232493 100644
--- a/internal/service/pipes/pipe_test.go
+++ b/internal/service/pipes/pipe_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package pipes_test
 
 import (
@@ -7,6 +10,7 @@ import (
 	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/service/pipes"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -20,13 +24,8 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
-func TestAccPipesPipe_basic(t *testing.T) {
+func TestAccPipesPipe_basicSQS(t *testing.T) {
 	ctx := acctest.Context(t)
-
-	if testing.Short() {
-		t.Skip("skipping long-running test in short mode")
-	}
-
 	var pipe pipes.DescribePipeOutput
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_pipes_pipe.test"
@@ -42,20 +41,31 @@ func TestAccPipesPipe_basic(t *testing.T) {
 		CheckDestroy:             testAccCheckPipeDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccPipeConfig_basic(rName),
-				Check: resource.ComposeTestCheckFunc(
+				Config: testAccPipeConfig_basicSQS(rName),
+				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckPipeExists(ctx, resourceName, &pipe),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "pipes", regexp.MustCompile(regexp.QuoteMeta(`pipe/`+rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "pipes", regexache.MustCompile(regexp.QuoteMeta(`pipe/`+rName))),
 					resource.TestCheckResourceAttr(resourceName, "description", "Managed by Terraform"),
 					resource.TestCheckResourceAttr(resourceName, "desired_state", "RUNNING"),
 					resource.TestCheckResourceAttr(resourceName, "enrichment", ""),
+					resource.TestCheckResourceAttr(resourceName, "enrichment_parameters.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttrPair(resourceName, "role_arn", "aws_iam_role.test", "arn"),
 					resource.TestCheckResourceAttrPair(resourceName, "source", "aws_sqs_queue.source", "arn"),
 					resource.TestCheckResourceAttr(resourceName, "source_parameters.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.activemq_broker_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.dynamodb_stream_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.filter_criteria.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.kinesis_stream_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.managed_streaming_kafka_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.rabbitmq_broker_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.self_managed_kafka_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.sqs_queue_parameters.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.sqs_queue_parameters.0.batch_size", "10"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.sqs_queue_parameters.0.maximum_batching_window_in_seconds", "0"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 					resource.TestCheckResourceAttrPair(resourceName, "target", "aws_sqs_queue.target", "arn"),
-					resource.TestCheckResourceAttr(resourceName, "target_parameters.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.#", "0"),
 				),
 			},
 			{
@@ -69,10 +79,6 @@ func TestAccPipesPipe_basic(t *testing.T) {
 
 func TestAccPipesPipe_disappears(t *testing.T) {
 	ctx := acctest.Context(t)
-	if testing.Short() {
-		t.Skip("skipping long-running test in short mode")
-	}
-
 	var pipe pipes.DescribePipeOutput
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_pipes_pipe.test"
@@ -88,7 +94,7 @@ func TestAccPipesPipe_disappears(t *testing.T) {
 		CheckDestroy:             testAccCheckPipeDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccPipeConfig_basic(rName),
+				Config: testAccPipeConfig_basicSQS(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckPipeExists(ctx, resourceName, &pipe),
 					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfpipes.ResourcePipe(), resourceName),
@@ -101,12 +107,8 @@ func TestAccPipesPipe_disappears(t *testing.T) {
 
 func TestAccPipesPipe_description(t *testing.T) {
 	ctx := acctest.Context(t)
-	if testing.Short() {
-		t.Skip("skipping long-running test in short mode")
-	}
-
 	var pipe pipes.DescribePipeOutput
-	name := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_pipes_pipe.test"
 
 	resource.ParallelTest(t, resource.TestCase{
@@ -120,7 +122,7 @@ func TestAccPipesPipe_description(t *testing.T) {
 		CheckDestroy:             testAccCheckPipeDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccPipeConfig_description(name, "Description 1"),
+				Config: testAccPipeConfig_description(rName, "Description 1"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckPipeExists(ctx, resourceName, &pipe),
 					resource.TestCheckResourceAttr(resourceName, "description", "Description 1"),
@@ -132,53 +134,34 @@ func TestAccPipesPipe_description(t *testing.T) {
 				ImportStateVerify: true,
 			},
 			{
-				Config: testAccPipeConfig_description(name, "Description 2"),
+				Config: testAccPipeConfig_description(rName, "Description 2"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckPipeExists(ctx, resourceName, &pipe),
 					resource.TestCheckResourceAttr(resourceName, "description", "Description 2"),
 				),
 			},
 			{
-				ResourceName:      resourceName,
-				ImportState:       true,
-				ImportStateVerify: true,
-			},
-			{
-				Config: testAccPipeConfig_description(name, ""),
+				Config: testAccPipeConfig_description(rName, ""),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckPipeExists(ctx, resourceName, &pipe),
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
 				),
 			},
 			{
-				ResourceName:      resourceName,
-				ImportState:       true,
-				ImportStateVerify: true,
-			},
-			{
-				Config: testAccPipeConfig_basic(name),
+				Config: testAccPipeConfig_basicSQS(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckPipeExists(ctx, resourceName, &pipe),
 					resource.TestCheckResourceAttr(resourceName, "description", "Managed by Terraform"),
 				),
 			},
-			{
-				ResourceName:      resourceName,
-				ImportState:       true,
-				ImportStateVerify: true,
-			},
 		},
 	})
 }
 
 func TestAccPipesPipe_desiredState(t *testing.T) {
 	ctx := acctest.Context(t)
-	if testing.Short() {
-		t.Skip("skipping long-running test in short mode")
-	}
-
 	var pipe pipes.DescribePipeOutput
-	name := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_pipes_pipe.test"
 
 	resource.ParallelTest(t, resource.TestCase{
@@ -192,7 +175,7 @@ func TestAccPipesPipe_desiredState(t *testing.T) {
 		CheckDestroy:             testAccCheckPipeDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccPipeConfig_desiredState(name, "STOPPED"),
+				Config: testAccPipeConfig_desiredState(rName, "STOPPED"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckPipeExists(ctx, resourceName, &pipe),
 					resource.TestCheckResourceAttr(resourceName, "desired_state", "STOPPED"),
@@ -204,53 +187,34 @@ func TestAccPipesPipe_desiredState(t *testing.T) {
 				ImportStateVerify: true,
 			},
 			{
-				Config: testAccPipeConfig_desiredState(name, "RUNNING"),
+				Config: testAccPipeConfig_desiredState(rName, "RUNNING"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckPipeExists(ctx, resourceName, &pipe),
 					resource.TestCheckResourceAttr(resourceName, "desired_state", "RUNNING"),
 				),
 			},
 			{
-				ResourceName:      resourceName,
-				ImportState:       true,
-				ImportStateVerify: true,
-			},
-			{
-				Config: testAccPipeConfig_desiredState(name, "STOPPED"),
+				Config: testAccPipeConfig_desiredState(rName, "STOPPED"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckPipeExists(ctx, resourceName, &pipe),
 					resource.TestCheckResourceAttr(resourceName, "desired_state", "STOPPED"),
 				),
 			},
 			{
-				ResourceName:      resourceName,
-				ImportState:       true,
-				ImportStateVerify: true,
-			},
-			{
-				Config: testAccPipeConfig_basic(name),
+				Config: testAccPipeConfig_basicSQS(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckPipeExists(ctx, resourceName, &pipe),
 					resource.TestCheckResourceAttr(resourceName, "desired_state", "RUNNING"),
 				),
 			},
-			{
-				ResourceName:      resourceName,
-				ImportState:       true,
-				ImportStateVerify: true,
-			},
 		},
 	})
 }
 
 func TestAccPipesPipe_enrichment(t *testing.T) {
 	ctx := acctest.Context(t)
-	if testing.Short() {
-		t.Skip("skipping long-running test in short mode")
-	}
-
 	var pipe pipes.DescribePipeOutput
-	name := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_pipes_pipe.test"
 
 	resource.ParallelTest(t, resource.TestCase{
@@ -264,7 +228,7 @@ func TestAccPipesPipe_enrichment(t *testing.T) {
 		CheckDestroy:             testAccCheckPipeDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccPipeConfig_enrichment(name, 0),
+				Config: testAccPipeConfig_enrichment(rName, 0),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckPipeExists(ctx, resourceName, &pipe),
 					resource.TestCheckResourceAttrPair(resourceName, "enrichment", "aws_cloudwatch_event_api_destination.test.0", "arn"),
@@ -276,41 +240,82 @@ func TestAccPipesPipe_enrichment(t *testing.T) {
 				ImportStateVerify: true,
 			},
 			{
-				Config: testAccPipeConfig_enrichment(name, 1),
+				Config: testAccPipeConfig_enrichment(rName, 1),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckPipeExists(ctx, resourceName, &pipe),
 					resource.TestCheckResourceAttrPair(resourceName, "enrichment", "aws_cloudwatch_event_api_destination.test.1", "arn"),
 				),
 			},
 			{
-				ResourceName:      resourceName,
-				ImportState:       true,
-				ImportStateVerify: true,
-			},
-			{
-				Config: testAccPipeConfig_basic(name),
+				Config: testAccPipeConfig_basicSQS(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckPipeExists(ctx, resourceName, &pipe),
 					resource.TestCheckResourceAttr(resourceName, "enrichment", ""),
 				),
 			},
+		},
+	})
+}
+
+func TestAccPipesPipe_enrichmentParameters(t *testing.T) {
+	ctx := acctest.Context(t)
+	var pipe pipes.DescribePipeOutput
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_pipes_pipe.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, names.PipesEndpointID)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, names.PipesEndpointID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckPipeDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccPipeConfig_enrichmentParameters(rName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckPipeExists(ctx, resourceName, &pipe),
+					resource.TestCheckResourceAttrPair(resourceName, "enrichment", "aws_cloudwatch_event_api_destination.test", "arn"),
+					resource.TestCheckResourceAttr(resourceName, "enrichment_parameters.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "enrichment_parameters.0.http_parameters.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "enrichment_parameters.0.http_parameters.0.header_parameters.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "enrichment_parameters.0.http_parameters.0.header_parameters.X-Test-1", "Val1"),
+					resource.TestCheckResourceAttr(resourceName, "enrichment_parameters.0.http_parameters.0.path_parameter_values.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "enrichment_parameters.0.http_parameters.0.path_parameter_values.0", "p1"),
+					resource.TestCheckResourceAttr(resourceName, "enrichment_parameters.0.http_parameters.0.query_string_parameters.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "enrichment_parameters.0.http_parameters.0.query_string_parameters.q1", "abc"),
+				),
+			},
 			{
 				ResourceName:      resourceName,
 				ImportState:       true,
 				ImportStateVerify: true,
 			},
+			{
+				Config: testAccPipeConfig_enrichmentParametersUpdated(rName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckPipeExists(ctx, resourceName, &pipe),
+					resource.TestCheckResourceAttrPair(resourceName, "enrichment", "aws_cloudwatch_event_api_destination.test", "arn"),
+					resource.TestCheckResourceAttr(resourceName, "enrichment_parameters.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "enrichment_parameters.0.http_parameters.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "enrichment_parameters.0.http_parameters.0.header_parameters.%", "2"),
+					resource.TestCheckResourceAttr(resourceName, "enrichment_parameters.0.http_parameters.0.header_parameters.X-Test-1", "Val1"),
+					resource.TestCheckResourceAttr(resourceName, "enrichment_parameters.0.http_parameters.0.header_parameters.X-Test-2", "Val2"),
+					resource.TestCheckResourceAttr(resourceName, "enrichment_parameters.0.http_parameters.0.path_parameter_values.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "enrichment_parameters.0.http_parameters.0.path_parameter_values.0", "p2"),
+					resource.TestCheckResourceAttr(resourceName, "enrichment_parameters.0.http_parameters.0.query_string_parameters.%", "0"),
+				),
+			},
 		},
 	})
 }
 
 func TestAccPipesPipe_sourceParameters_filterCriteria(t *testing.T) {
 	ctx := acctest.Context(t)
-	if testing.Short() {
-		t.Skip("skipping long-running test in short mode")
-	}
-
 	var pipe pipes.DescribePipeOutput
-	name := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_pipes_pipe.test"
 
 	resource.ParallelTest(t, resource.TestCase{
@@ -324,9 +329,11 @@ func TestAccPipesPipe_sourceParameters_filterCriteria(t *testing.T) {
 		CheckDestroy:             testAccCheckPipeDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccPipeConfig_sourceParameters_filterCriteria1(name, "test1"),
+				Config: testAccPipeConfig_sourceParameters_filterCriteria1(rName, "test1"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckPipeExists(ctx, resourceName, &pipe),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.filter_criteria.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.filter_criteria.0.filter.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.filter_criteria.0.filter.0.pattern", `{"source":["test1"]}`),
 				),
@@ -337,37 +344,32 @@ func TestAccPipesPipe_sourceParameters_filterCriteria(t *testing.T) {
 				ImportStateVerify: true,
 			},
 			{
-				Config: testAccPipeConfig_sourceParameters_filterCriteria2(name, "test1", "test2"),
+				Config: testAccPipeConfig_sourceParameters_filterCriteria2(rName, "test1", "test2"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckPipeExists(ctx, resourceName, &pipe),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.filter_criteria.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.filter_criteria.0.filter.#", "2"),
 					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.filter_criteria.0.filter.0.pattern", `{"source":["test1"]}`),
 					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.filter_criteria.0.filter.1.pattern", `{"source":["test2"]}`),
 				),
 			},
 			{
-				ResourceName:      resourceName,
-				ImportState:       true,
-				ImportStateVerify: true,
-			},
-			{
-				Config: testAccPipeConfig_sourceParameters_filterCriteria1(name, "test2"),
+				Config: testAccPipeConfig_sourceParameters_filterCriteria1(rName, "test2"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckPipeExists(ctx, resourceName, &pipe),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.filter_criteria.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.filter_criteria.0.filter.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.filter_criteria.0.filter.0.pattern", `{"source":["test2"]}`),
 				),
 			},
 			{
-				ResourceName:      resourceName,
-				ImportState:       true,
-				ImportStateVerify: true,
-			},
-			{
-				Config: testAccPipeConfig_sourceParameters_filterCriteria0(name),
+				Config: testAccPipeConfig_sourceParameters_filterCriteria0(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckPipeExists(ctx, resourceName, &pipe),
-					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.filter_criteria.0.filter.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.filter_criteria.#", "0"),
 				),
 			},
 			{
@@ -376,41 +378,31 @@ func TestAccPipesPipe_sourceParameters_filterCriteria(t *testing.T) {
 				ImportStateVerify: true,
 			},
 			{
-				Config: testAccPipeConfig_sourceParameters_filterCriteria1(name, "test2"),
+				Config: testAccPipeConfig_sourceParameters_filterCriteria1(rName, "test2"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckPipeExists(ctx, resourceName, &pipe),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.filter_criteria.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.filter_criteria.0.filter.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.filter_criteria.0.filter.0.pattern", `{"source":["test2"]}`),
 				),
 			},
 			{
-				ResourceName:      resourceName,
-				ImportState:       true,
-				ImportStateVerify: true,
-			},
-			{
-				Config: testAccPipeConfig_basic(name),
+				Config: testAccPipeConfig_basicSQS(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckPipeExists(ctx, resourceName, &pipe),
-					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.filter_criteria.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.filter_criteria.#", "1"),
 				),
 			},
-			{
-				ResourceName:      resourceName,
-				ImportState:       true,
-				ImportStateVerify: true,
-			},
 		},
 	})
 }
 
 func TestAccPipesPipe_nameGenerated(t *testing.T) {
 	ctx := acctest.Context(t)
-	if testing.Short() {
-		t.Skip("skipping long-running test in short mode")
-	}
-
 	var pipe pipes.DescribePipeOutput
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_pipes_pipe.test"
 
 	resource.ParallelTest(t, resource.TestCase{
@@ -424,7 +416,7 @@ func TestAccPipesPipe_nameGenerated(t *testing.T) {
 		CheckDestroy:             testAccCheckPipeDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccPipeConfig_nameGenerated(),
+				Config: testAccPipeConfig_nameGenerated(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckPipeExists(ctx, resourceName, &pipe),
 					acctest.CheckResourceAttrNameGenerated(resourceName, "name"),
@@ -442,11 +434,8 @@ func TestAccPipesPipe_nameGenerated(t *testing.T) {
 
 func TestAccPipesPipe_namePrefix(t *testing.T) {
 	ctx := acctest.Context(t)
-	if testing.Short() {
-		t.Skip("skipping long-running test in short mode")
-	}
-
 	var pipe pipes.DescribePipeOutput
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_pipes_pipe.test"
 
 	resource.ParallelTest(t, resource.TestCase{
@@ -460,7 +449,7 @@ func TestAccPipesPipe_namePrefix(t *testing.T) {
 		CheckDestroy:             testAccCheckPipeDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccPipeConfig_namePrefix("tf-acc-test-prefix-"),
+				Config: testAccPipeConfig_namePrefix(rName, "tf-acc-test-prefix-"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckPipeExists(ctx, resourceName, &pipe),
 					acctest.CheckResourceAttrNameFromPrefix(resourceName, "name", "tf-acc-test-prefix-"),
@@ -478,12 +467,8 @@ func TestAccPipesPipe_namePrefix(t *testing.T) {
 
 func TestAccPipesPipe_roleARN(t *testing.T) {
 	ctx := acctest.Context(t)
-	if testing.Short() {
-		t.Skip("skipping long-running test in short mode")
-	}
-
 	var pipe pipes.DescribePipeOutput
-	name := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_pipes_pipe.test"
 
 	resource.ParallelTest(t, resource.TestCase{
@@ -497,7 +482,7 @@ func TestAccPipesPipe_roleARN(t *testing.T) {
 		CheckDestroy:             testAccCheckPipeDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccPipeConfig_basic(name),
+				Config: testAccPipeConfig_basicSQS(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckPipeExists(ctx, resourceName, &pipe),
 					resource.TestCheckResourceAttrPair(resourceName, "role_arn", "aws_iam_role.test", "arn"),
@@ -509,29 +494,20 @@ func TestAccPipesPipe_roleARN(t *testing.T) {
 				ImportStateVerify: true,
 			},
 			{
-				Config: testAccPipeConfig_roleARN(name),
+				Config: testAccPipeConfig_roleARN(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckPipeExists(ctx, resourceName, &pipe),
 					resource.TestCheckResourceAttrPair(resourceName, "role_arn", "aws_iam_role.test2", "arn"),
 				),
 			},
-			{
-				ResourceName:      resourceName,
-				ImportState:       true,
-				ImportStateVerify: true,
-			},
 		},
 	})
 }
 
 func TestAccPipesPipe_tags(t *testing.T) {
 	ctx := acctest.Context(t)
-	if testing.Short() {
-		t.Skip("skipping long-running test in short mode")
-	}
-
 	var pipe pipes.DescribePipeOutput
-	name := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_pipes_pipe.test"
 
 	resource.ParallelTest(t, resource.TestCase{
@@ -545,7 +521,7 @@ func TestAccPipesPipe_tags(t *testing.T) {
 		CheckDestroy:             testAccCheckPipeDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccPipeConfig_tags1(name, "key1", "value1"),
+				Config: testAccPipeConfig_tags1(rName, "key1", "value1"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckPipeExists(ctx, resourceName, &pipe),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
@@ -558,7 +534,7 @@ func TestAccPipesPipe_tags(t *testing.T) {
 				ImportStateVerify: true,
 			},
 			{
-				Config: testAccPipeConfig_tags2(name, "key1", "value1updated", "key2", "value2"),
+				Config: testAccPipeConfig_tags2(rName, "key1", "value1updated", "key2", "value2"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckPipeExists(ctx, resourceName, &pipe),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
@@ -567,35 +543,21 @@ func TestAccPipesPipe_tags(t *testing.T) {
 				),
 			},
 			{
-				ResourceName:      resourceName,
-				ImportState:       true,
-				ImportStateVerify: true,
-			},
-			{
-				Config: testAccPipeConfig_tags1(name, "key2", "value2"),
+				Config: testAccPipeConfig_tags1(rName, "key2", "value2"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckPipeExists(ctx, resourceName, &pipe),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
 				),
 			},
-			{
-				ResourceName:      resourceName,
-				ImportState:       true,
-				ImportStateVerify: true,
-			},
 		},
 	})
 }
 
-func TestAccPipesPipe_target(t *testing.T) {
+func TestAccPipesPipe_targetUpdate(t *testing.T) {
 	ctx := acctest.Context(t)
-	if testing.Short() {
-		t.Skip("skipping long-running test in short mode")
-	}
-
 	var pipe pipes.DescribePipeOutput
-	name := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_pipes_pipe.test"
 
 	resource.ParallelTest(t, resource.TestCase{
@@ -609,7 +571,7 @@ func TestAccPipesPipe_target(t *testing.T) {
 		CheckDestroy:             testAccCheckPipeDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccPipeConfig_basic(name),
+				Config: testAccPipeConfig_basicSQS(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckPipeExists(ctx, resourceName, &pipe),
 					resource.TestCheckResourceAttrPair(resourceName, "target", "aws_sqs_queue.target", "arn"),
@@ -621,29 +583,20 @@ func TestAccPipesPipe_target(t *testing.T) {
 				ImportStateVerify: true,
 			},
 			{
-				Config: testAccPipeConfig_target(name),
+				Config: testAccPipeConfig_targetUpdated(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckPipeExists(ctx, resourceName, &pipe),
 					resource.TestCheckResourceAttrPair(resourceName, "target", "aws_sqs_queue.target2", "arn"),
 				),
 			},
-			{
-				ResourceName:      resourceName,
-				ImportState:       true,
-				ImportStateVerify: true,
-			},
 		},
 	})
 }
 
 func TestAccPipesPipe_targetParameters_inputTemplate(t *testing.T) {
 	ctx := acctest.Context(t)
-	if testing.Short() {
-		t.Skip("skipping long-running test in short mode")
-	}
-
 	var pipe pipes.DescribePipeOutput
-	name := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_pipes_pipe.test"
 
 	resource.ParallelTest(t, resource.TestCase{
@@ -657,7 +610,7 @@ func TestAccPipesPipe_targetParameters_inputTemplate(t *testing.T) {
 		CheckDestroy:             testAccCheckPipeDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccPipeConfig_targetParameters_inputTemplate(name, "$.first"),
+				Config: testAccPipeConfig_targetParameters_inputTemplate(rName, "$.first"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckPipeExists(ctx, resourceName, &pipe),
 					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.input_template", "$.first"),
@@ -669,24 +622,87 @@ func TestAccPipesPipe_targetParameters_inputTemplate(t *testing.T) {
 				ImportStateVerify: true,
 			},
 			{
-				Config: testAccPipeConfig_targetParameters_inputTemplate(name, "$.second"),
+				Config: testAccPipeConfig_targetParameters_inputTemplate(rName, "$.second"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckPipeExists(ctx, resourceName, &pipe),
 					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.input_template", "$.second"),
 				),
 			},
 			{
-				ResourceName:      resourceName,
-				ImportState:       true,
-				ImportStateVerify: true,
-			},
-			{
-				Config: testAccPipeConfig_basic(name),
+				Config: testAccPipeConfig_basicSQS(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckPipeExists(ctx, resourceName, &pipe),
 					resource.TestCheckNoResourceAttr(resourceName, "target_parameters.0.input_template"),
 				),
 			},
+		},
+	})
+}
+
+func TestAccPipesPipe_kinesisSourceAndTarget(t *testing.T) {
+	ctx := acctest.Context(t)
+	var pipe pipes.DescribePipeOutput
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_pipes_pipe.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, names.PipesEndpointID)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, names.PipesEndpointID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckPipeDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccPipeConfig_basicKinesis(rName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckPipeExists(ctx, resourceName, &pipe),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "pipes", regexache.MustCompile(regexp.QuoteMeta(`pipe/`+rName))),
+					resource.TestCheckResourceAttr(resourceName, "description", "Managed by Terraform"),
+					resource.TestCheckResourceAttr(resourceName, "desired_state", "RUNNING"),
+					resource.TestCheckResourceAttr(resourceName, "enrichment", ""),
+					resource.TestCheckResourceAttr(resourceName, "enrichment_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "name", rName),
+					resource.TestCheckResourceAttrPair(resourceName, "role_arn", "aws_iam_role.test", "arn"),
+					resource.TestCheckResourceAttrPair(resourceName, "source", "aws_kinesis_stream.source", "arn"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.activemq_broker_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.dynamodb_stream_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.filter_criteria.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.kinesis_stream_parameters.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.kinesis_stream_parameters.0.batch_size", "100"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.kinesis_stream_parameters.0.dead_letter_config.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.kinesis_stream_parameters.0.maximum_batching_window_in_seconds", "0"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.kinesis_stream_parameters.0.maximum_record_age_in_seconds", "0"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.kinesis_stream_parameters.0.maximum_retry_attempts", "0"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.kinesis_stream_parameters.0.on_partial_batch_item_failure", ""),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.kinesis_stream_parameters.0.parallelization_factor", "0"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.kinesis_stream_parameters.0.starting_position", "LATEST"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.kinesis_stream_parameters.0.starting_position_timestamp", ""),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.managed_streaming_kafka_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.rabbitmq_broker_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.self_managed_kafka_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.sqs_queue_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
+					resource.TestCheckResourceAttrPair(resourceName, "target", "aws_kinesis_stream.target", "arn"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.batch_job_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.cloudwatch_logs_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.ecs_task_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.eventbridge_event_bus_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.http_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.input_template", ""),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.kinesis_stream_parameters.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.kinesis_stream_parameters.0.partition_key", "test"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.lambda_function_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.redshift_data_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.sagemaker_pipeline_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.sqs_queue_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.step_function_state_machine_parameters.#", "0"),
+				),
+			},
 			{
 				ResourceName:      resourceName,
 				ImportState:       true,
@@ -696,542 +712,2330 @@ func TestAccPipesPipe_targetParameters_inputTemplate(t *testing.T) {
 	})
 }
 
-func testAccCheckPipeDestroy(ctx context.Context) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		conn := acctest.Provider.Meta().(*conns.AWSClient).PipesClient(ctx)
-
-		for _, rs := range s.RootModule().Resources {
-			if rs.Type != "aws_pipes_pipe" {
-				continue
-			}
-
-			_, err := tfpipes.FindPipeByName(ctx, conn, rs.Primary.ID)
-
-			if tfresource.NotFound(err) {
-				continue
-			}
-
-			if err != nil {
-				return err
-			}
-
-			return create.Error(names.Pipes, create.ErrActionCheckingDestroyed, tfpipes.ResNamePipe, rs.Primary.ID, errors.New("not destroyed"))
-		}
+func TestAccPipesPipe_dynamoDBSourceCloudWatchLogsTarget(t *testing.T) {
+	ctx := acctest.Context(t)
+	var pipe pipes.DescribePipeOutput
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_pipes_pipe.test"
 
-		return nil
-	}
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, names.PipesEndpointID)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, names.PipesEndpointID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckPipeDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccPipeConfig_basicDynamoDBSourceCloudWatchLogsTarget(rName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckPipeExists(ctx, resourceName, &pipe),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "pipes", regexache.MustCompile(regexp.QuoteMeta(`pipe/`+rName))),
+					resource.TestCheckResourceAttr(resourceName, "description", "Managed by Terraform"),
+					resource.TestCheckResourceAttr(resourceName, "desired_state", "RUNNING"),
+					resource.TestCheckResourceAttr(resourceName, "enrichment", ""),
+					resource.TestCheckResourceAttr(resourceName, "enrichment_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "name", rName),
+					resource.TestCheckResourceAttrPair(resourceName, "role_arn", "aws_iam_role.test", "arn"),
+					resource.TestCheckResourceAttrPair(resourceName, "source", "aws_dynamodb_table.source", "stream_arn"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.activemq_broker_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.dynamodb_stream_parameters.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.dynamodb_stream_parameters.0.batch_size", "100"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.dynamodb_stream_parameters.0.dead_letter_config.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.dynamodb_stream_parameters.0.maximum_batching_window_in_seconds", "0"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.dynamodb_stream_parameters.0.maximum_record_age_in_seconds", "0"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.dynamodb_stream_parameters.0.maximum_retry_attempts", "0"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.dynamodb_stream_parameters.0.on_partial_batch_item_failure", ""),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.dynamodb_stream_parameters.0.parallelization_factor", "0"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.dynamodb_stream_parameters.0.starting_position", "LATEST"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.filter_criteria.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.managed_streaming_kafka_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.rabbitmq_broker_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.self_managed_kafka_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.sqs_queue_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
+					resource.TestCheckResourceAttrPair(resourceName, "target", "aws_cloudwatch_log_group.target", "arn"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.batch_job_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.cloudwatch_logs_parameters.#", "1"),
+					resource.TestCheckResourceAttrPair(resourceName, "target_parameters.0.cloudwatch_logs_parameters.0.log_stream_name", "aws_cloudwatch_log_stream.target", "name"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.cloudwatch_logs_parameters.0.timestamp", ""),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.ecs_task_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.eventbridge_event_bus_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.http_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.input_template", ""),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.kinesis_stream_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.lambda_function_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.redshift_data_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.sagemaker_pipeline_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.sqs_queue_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.step_function_state_machine_parameters.#", "0"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
 }
 
-func testAccCheckPipeExists(ctx context.Context, name string, pipe *pipes.DescribePipeOutput) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		rs, ok := s.RootModule().Resources[name]
-		if !ok {
-			return create.Error(names.Pipes, create.ErrActionCheckingExistence, tfpipes.ResNamePipe, name, errors.New("not found"))
-		}
+func TestAccPipesPipe_activeMQSourceStepFunctionTarget(t *testing.T) {
+	ctx := acctest.Context(t)
+	var pipe pipes.DescribePipeOutput
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_pipes_pipe.test"
 
-		if rs.Primary.ID == "" {
-			return create.Error(names.Pipes, create.ErrActionCheckingExistence, tfpipes.ResNamePipe, name, errors.New("not set"))
-		}
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, names.PipesEndpointID)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, names.PipesEndpointID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckPipeDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccPipeConfig_basicActiveMQSourceStepFunctionTarget(rName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckPipeExists(ctx, resourceName, &pipe),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "pipes", regexache.MustCompile(regexp.QuoteMeta(`pipe/`+rName))),
+					resource.TestCheckResourceAttr(resourceName, "description", "Managed by Terraform"),
+					resource.TestCheckResourceAttr(resourceName, "desired_state", "RUNNING"),
+					resource.TestCheckResourceAttr(resourceName, "enrichment", ""),
+					resource.TestCheckResourceAttr(resourceName, "enrichment_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "name", rName),
+					resource.TestCheckResourceAttrPair(resourceName, "role_arn", "aws_iam_role.test", "arn"),
+					resource.TestCheckResourceAttrPair(resourceName, "source", "aws_mq_broker.source", "arn"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.activemq_broker_parameters.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.activemq_broker_parameters.0.batch_size", "100"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.activemq_broker_parameters.0.credentials.#", "1"),
+					resource.TestCheckResourceAttrSet(resourceName, "source_parameters.0.activemq_broker_parameters.0.credentials.0.basic_auth"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.activemq_broker_parameters.0.maximum_batching_window_in_seconds", "0"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.activemq_broker_parameters.0.queue_name", "test"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.dynamodb_stream_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.filter_criteria.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.managed_streaming_kafka_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.rabbitmq_broker_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.self_managed_kafka_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.sqs_queue_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
+					resource.TestCheckResourceAttrPair(resourceName, "target", "aws_sfn_state_machine.target", "arn"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.batch_job_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.cloudwatch_logs_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.ecs_task_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.eventbridge_event_bus_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.http_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.input_template", ""),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.kinesis_stream_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.lambda_function_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.redshift_data_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.sagemaker_pipeline_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.sqs_queue_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.step_function_state_machine_parameters.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.step_function_state_machine_parameters.0.invocation_type", "REQUEST_RESPONSE"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
+func TestAccPipesPipe_rabbitMQSourceEventBusTarget(t *testing.T) {
+	ctx := acctest.Context(t)
+	var pipe pipes.DescribePipeOutput
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_pipes_pipe.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, names.PipesEndpointID)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, names.PipesEndpointID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckPipeDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccPipeConfig_basicRabbitMQSourceEventBusTarget(rName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckPipeExists(ctx, resourceName, &pipe),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "pipes", regexache.MustCompile(regexp.QuoteMeta(`pipe/`+rName))),
+					resource.TestCheckResourceAttr(resourceName, "description", "Managed by Terraform"),
+					resource.TestCheckResourceAttr(resourceName, "desired_state", "RUNNING"),
+					resource.TestCheckResourceAttr(resourceName, "enrichment", ""),
+					resource.TestCheckResourceAttr(resourceName, "enrichment_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "name", rName),
+					resource.TestCheckResourceAttrPair(resourceName, "role_arn", "aws_iam_role.test", "arn"),
+					resource.TestCheckResourceAttrPair(resourceName, "source", "aws_mq_broker.source", "arn"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.activemq_broker_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.dynamodb_stream_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.filter_criteria.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.managed_streaming_kafka_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.rabbitmq_broker_parameters.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.rabbitmq_broker_parameters.0.batch_size", "10"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.rabbitmq_broker_parameters.0.credentials.#", "1"),
+					resource.TestCheckResourceAttrSet(resourceName, "source_parameters.0.rabbitmq_broker_parameters.0.credentials.0.basic_auth"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.rabbitmq_broker_parameters.0.maximum_batching_window_in_seconds", "0"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.rabbitmq_broker_parameters.0.queue_name", "test"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.rabbitmq_broker_parameters.0.virtual_host", ""),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.self_managed_kafka_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.sqs_queue_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
+					resource.TestCheckResourceAttrPair(resourceName, "target", "aws_cloudwatch_event_bus.target", "arn"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.#", "0"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
+func TestAccPipesPipe_mskSourceHTTPTarget(t *testing.T) {
+	acctest.Skip(t, "DependencyViolation errors deleting subnets and security group")
+
+	ctx := acctest.Context(t)
+	var pipe pipes.DescribePipeOutput
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_pipes_pipe.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, names.PipesEndpointID)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, names.PipesEndpointID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckPipeDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccPipeConfig_basicMSKSourceHTTPTarget(rName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckPipeExists(ctx, resourceName, &pipe),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "pipes", regexache.MustCompile(regexp.QuoteMeta(`pipe/`+rName))),
+					resource.TestCheckResourceAttr(resourceName, "description", "Managed by Terraform"),
+					resource.TestCheckResourceAttr(resourceName, "desired_state", "RUNNING"),
+					resource.TestCheckResourceAttr(resourceName, "enrichment", ""),
+					resource.TestCheckResourceAttr(resourceName, "enrichment_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "name", rName),
+					resource.TestCheckResourceAttrPair(resourceName, "role_arn", "aws_iam_role.test", "arn"),
+					resource.TestCheckResourceAttrPair(resourceName, "source", "aws_msk_cluster.source", "arn"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.activemq_broker_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.dynamodb_stream_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.filter_criteria.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.managed_streaming_kafka_parameters.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.managed_streaming_kafka_parameters.0.batch_size", "1"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.managed_streaming_kafka_parameters.0.consumer_group_id", ""),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.managed_streaming_kafka_parameters.0.credentials.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.managed_streaming_kafka_parameters.0.maximum_batching_window_in_seconds", "0"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.managed_streaming_kafka_parameters.0.starting_position", ""),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.managed_streaming_kafka_parameters.0.topic_name", "test"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.rabbitmq_broker_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.self_managed_kafka_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.sqs_queue_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
+					resource.TestCheckResourceAttrSet(resourceName, "target"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.batch_job_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.cloudwatch_logs_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.ecs_task_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.eventbridge_event_bus_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.http_parameters.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.http_parameters.0.header_parameters.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.http_parameters.0.header_parameters.X-Test", "test"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.http_parameters.0.path_parameter_values.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.http_parameters.0.path_parameter_values.0", "p1"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.http_parameters.0.query_string_parameters.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.http_parameters.0.query_string_parameters.testing", "yes"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.input_template", ""),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.kinesis_stream_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.lambda_function_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.redshift_data_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.sagemaker_pipeline_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.sqs_queue_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.step_function_state_machine_parameters.#", "0"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
+func TestAccPipesPipe_selfManagedKafkaSourceLambdaFunctionTarget(t *testing.T) {
+	acctest.Skip(t, "DependencyViolation errors deleting subnets and security group")
+
+	ctx := acctest.Context(t)
+	var pipe pipes.DescribePipeOutput
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_pipes_pipe.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, names.PipesEndpointID)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, names.PipesEndpointID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckPipeDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccPipeConfig_basicSelfManagedKafkaSourceLambdaFunctionTarget(rName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckPipeExists(ctx, resourceName, &pipe),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "pipes", regexache.MustCompile(regexp.QuoteMeta(`pipe/`+rName))),
+					resource.TestCheckResourceAttr(resourceName, "description", "Managed by Terraform"),
+					resource.TestCheckResourceAttr(resourceName, "desired_state", "RUNNING"),
+					resource.TestCheckResourceAttr(resourceName, "enrichment", ""),
+					resource.TestCheckResourceAttr(resourceName, "enrichment_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "name", rName),
+					resource.TestCheckResourceAttrPair(resourceName, "role_arn", "aws_iam_role.test", "arn"),
+					resource.TestCheckResourceAttr(resourceName, "source", "smk://test1:9092,test2:9092"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.activemq_broker_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.dynamodb_stream_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.filter_criteria.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.managed_streaming_kafka_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.rabbitmq_broker_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.self_managed_kafka_parameters.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.self_managed_kafka_parameters.0.additional_bootstrap_servers.#", "1"),
+					resource.TestCheckTypeSetElemAttr(resourceName, "source_parameters.0.self_managed_kafka_parameters.0.additional_bootstrap_servers.*", "testing:1234"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.self_managed_kafka_parameters.0.batch_size", "100"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.self_managed_kafka_parameters.0.consumer_group_id", "self-managed-test-group-id"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.self_managed_kafka_parameters.0.credentials.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.self_managed_kafka_parameters.0.maximum_batching_window_in_seconds", "0"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.self_managed_kafka_parameters.0.server_root_ca_certificate", ""),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.self_managed_kafka_parameters.0.starting_position", ""),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.self_managed_kafka_parameters.0.topic_name", "test"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.self_managed_kafka_parameters.0.vpc.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.self_managed_kafka_parameters.0.vpc.0.security_groups.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.self_managed_kafka_parameters.0.vpc.0.subnets.#", "2"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.sqs_queue_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
+					resource.TestCheckResourceAttrPair(resourceName, "target", "aws_lambda_function.target", "arn"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.batch_job_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.cloudwatch_logs_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.ecs_task_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.eventbridge_event_bus_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.http_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.input_template", ""),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.kinesis_stream_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.lambda_function_parameters.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.lambda_function_parameters.0.invocation_type", "REQUEST_RESPONSE"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.redshift_data_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.sagemaker_pipeline_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.sqs_queue_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.step_function_state_machine_parameters.#", "0"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
+func TestAccPipesPipe_sqsSourceRedshiftTarget(t *testing.T) {
+	ctx := acctest.Context(t)
+	var pipe pipes.DescribePipeOutput
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_pipes_pipe.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, names.PipesEndpointID)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, names.PipesEndpointID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckPipeDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccPipeConfig_basicSQSSourceRedshiftTarget(rName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckPipeExists(ctx, resourceName, &pipe),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "pipes", regexache.MustCompile(regexp.QuoteMeta(`pipe/`+rName))),
+					resource.TestCheckResourceAttr(resourceName, "description", "Managed by Terraform"),
+					resource.TestCheckResourceAttr(resourceName, "desired_state", "RUNNING"),
+					resource.TestCheckResourceAttr(resourceName, "enrichment", ""),
+					resource.TestCheckResourceAttr(resourceName, "enrichment_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "name", rName),
+					resource.TestCheckResourceAttrPair(resourceName, "role_arn", "aws_iam_role.test", "arn"),
+					resource.TestCheckResourceAttrPair(resourceName, "source", "aws_sqs_queue.source", "arn"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.activemq_broker_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.dynamodb_stream_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.filter_criteria.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.managed_streaming_kafka_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.rabbitmq_broker_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.self_managed_kafka_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.sqs_queue_parameters.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.sqs_queue_parameters.0.batch_size", "1"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.sqs_queue_parameters.0.maximum_batching_window_in_seconds", "90"),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
+					resource.TestCheckResourceAttrPair(resourceName, "target", "aws_redshift_cluster.target", "arn"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.batch_job_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.cloudwatch_logs_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.ecs_task_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.eventbridge_event_bus_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.http_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.input_template", ""),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.kinesis_stream_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.lambda_function_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.redshift_data_parameters.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.redshift_data_parameters.0.database", "db1"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.redshift_data_parameters.0.db_user", "user1"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.redshift_data_parameters.0.secret_manager_arn", ""),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.redshift_data_parameters.0.sqls.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.redshift_data_parameters.0.statement_name", "SelectAll"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.redshift_data_parameters.0.with_event", "false"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.sagemaker_pipeline_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.sqs_queue_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.step_function_state_machine_parameters.#", "0"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
+func TestAccPipesPipe_SourceSageMakerTarget(t *testing.T) {
+	acctest.Skip(t, "aws_sagemaker_pipeline resource not yet implemented")
+
+	ctx := acctest.Context(t)
+	var pipe pipes.DescribePipeOutput
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_pipes_pipe.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, names.PipesEndpointID)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, names.PipesEndpointID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckPipeDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccPipeConfig_basicSQSSourceSageMakerTarget(rName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckPipeExists(ctx, resourceName, &pipe),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "pipes", regexache.MustCompile(regexp.QuoteMeta(`pipe/`+rName))),
+					resource.TestCheckResourceAttr(resourceName, "description", "Managed by Terraform"),
+					resource.TestCheckResourceAttr(resourceName, "desired_state", "RUNNING"),
+					resource.TestCheckResourceAttr(resourceName, "enrichment", ""),
+					resource.TestCheckResourceAttr(resourceName, "enrichment_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "name", rName),
+					resource.TestCheckResourceAttrPair(resourceName, "role_arn", "aws_iam_role.test", "arn"),
+					resource.TestCheckResourceAttrPair(resourceName, "source", "aws_sqs_queue.source", "arn"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.activemq_broker_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.dynamodb_stream_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.filter_criteria.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.managed_streaming_kafka_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.rabbitmq_broker_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.self_managed_kafka_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.sqs_queue_parameters.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
+					resource.TestCheckResourceAttrPair(resourceName, "target", "aws_sagemaker_pipeline.target", "arn"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.batch_job_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.cloudwatch_logs_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.ecs_task_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.eventbridge_event_bus_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.http_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.input_template", ""),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.kinesis_stream_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.lambda_function_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.redshift_data_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.sagemaker_pipeline_parameters.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.sagemaker_pipeline_parameters.0.pipeline_parameter.#", "2"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.sagemaker_pipeline_parameters.0.pipeline_parameter.0.name", "p1"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.sagemaker_pipeline_parameters.0.pipeline_parameter.0.value", "v1"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.sagemaker_pipeline_parameters.0.pipeline_parameter.1.name", "p2"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.sagemaker_pipeline_parameters.0.pipeline_parameter.1.value", "v2"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.sqs_queue_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.step_function_state_machine_parameters.#", "0"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
+func TestAccPipesPipe_sqsSourceBatchJobTarget(t *testing.T) {
+	ctx := acctest.Context(t)
+	var pipe pipes.DescribePipeOutput
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_pipes_pipe.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, names.PipesEndpointID)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, names.PipesEndpointID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckPipeDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccPipeConfig_basicSQSSourceBatchJobTarget(rName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckPipeExists(ctx, resourceName, &pipe),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "pipes", regexache.MustCompile(regexp.QuoteMeta(`pipe/`+rName))),
+					resource.TestCheckResourceAttr(resourceName, "description", "Managed by Terraform"),
+					resource.TestCheckResourceAttr(resourceName, "desired_state", "RUNNING"),
+					resource.TestCheckResourceAttr(resourceName, "enrichment", ""),
+					resource.TestCheckResourceAttr(resourceName, "enrichment_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "name", rName),
+					resource.TestCheckResourceAttrPair(resourceName, "role_arn", "aws_iam_role.test", "arn"),
+					resource.TestCheckResourceAttrPair(resourceName, "source", "aws_sqs_queue.source", "arn"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.activemq_broker_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.dynamodb_stream_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.filter_criteria.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.managed_streaming_kafka_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.rabbitmq_broker_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.self_managed_kafka_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.sqs_queue_parameters.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
+					resource.TestCheckResourceAttrPair(resourceName, "target", "aws_batch_job_queue.target", "arn"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.batch_job_parameters.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.batch_job_parameters.0.array_properties.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.batch_job_parameters.0.array_properties.0.size", "512"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.batch_job_parameters.0.container_overrides.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.batch_job_parameters.0.container_overrides.0.command.#", "3"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.batch_job_parameters.0.container_overrides.0.command.0", "rm"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.batch_job_parameters.0.container_overrides.0.command.1", "-fr"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.batch_job_parameters.0.container_overrides.0.command.2", "/"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.batch_job_parameters.0.container_overrides.0.environment.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.batch_job_parameters.0.container_overrides.0.environment.0.name", "TMP"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.batch_job_parameters.0.container_overrides.0.environment.0.value", "/tmp2"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.batch_job_parameters.0.container_overrides.0.instance_type", ""),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.batch_job_parameters.0.container_overrides.0.resource_requirement.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.batch_job_parameters.0.container_overrides.0.resource_requirement.0.type", "GPU"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.batch_job_parameters.0.container_overrides.0.resource_requirement.0.value", "1"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.batch_job_parameters.0.depends_on.#", "0"),
+					resource.TestCheckResourceAttrSet(resourceName, "target_parameters.0.batch_job_parameters.0.job_definition"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.batch_job_parameters.0.job_name", "testing"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.batch_job_parameters.0.parameters.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.batch_job_parameters.0.parameters.Key1", "Value1"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.batch_job_parameters.0.retry_strategy.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.cloudwatch_logs_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.ecs_task_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.eventbridge_event_bus_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.http_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.input_template", ""),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.kinesis_stream_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.lambda_function_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.redshift_data_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.sagemaker_pipeline_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.sqs_queue_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.step_function_state_machine_parameters.#", "0"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
+func TestAccPipesPipe_sqsSourceECSTaskTarget(t *testing.T) {
+	acctest.Skip(t, "ValidationException: [numeric instance is lower than the required minimum (minimum: 1, found: 0)]")
+
+	ctx := acctest.Context(t)
+	var pipe pipes.DescribePipeOutput
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_pipes_pipe.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, names.PipesEndpointID)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, names.PipesEndpointID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckPipeDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccPipeConfig_basicSQSSourceECSTaskTarget(rName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckPipeExists(ctx, resourceName, &pipe),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "pipes", regexache.MustCompile(regexp.QuoteMeta(`pipe/`+rName))),
+					resource.TestCheckResourceAttr(resourceName, "description", "Managed by Terraform"),
+					resource.TestCheckResourceAttr(resourceName, "desired_state", "RUNNING"),
+					resource.TestCheckResourceAttr(resourceName, "enrichment", ""),
+					resource.TestCheckResourceAttr(resourceName, "enrichment_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "name", rName),
+					resource.TestCheckResourceAttrPair(resourceName, "role_arn", "aws_iam_role.test", "arn"),
+					resource.TestCheckResourceAttrPair(resourceName, "source", "aws_sqs_queue.source", "arn"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.activemq_broker_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.dynamodb_stream_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.filter_criteria.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.managed_streaming_kafka_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.rabbitmq_broker_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.self_managed_kafka_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "source_parameters.0.sqs_queue_parameters.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
+					resource.TestCheckResourceAttrPair(resourceName, "target", "aws_ecs_cluster.target", "id"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.batch_job_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.cloudwatch_logs_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.ecs_task_parameters.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.ecs_task_parameters.0.capacity_provider_strategy.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.ecs_task_parameters.0.enable_ecs_managed_tags", "true"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.ecs_task_parameters.0.enable_execute_command", "false"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.ecs_task_parameters.0.group", "g1"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.ecs_task_parameters.0.launch_type", "FARGATE"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.ecs_task_parameters.0.network_configuration.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.ecs_task_parameters.0.network_configuration.0.aws_vpc_configuration.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.ecs_task_parameters.0.network_configuration.0.aws_vpc_configuration.0.assign_public_ip", ""),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.ecs_task_parameters.0.network_configuration.0.aws_vpc_configuration.0.security_groups.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.ecs_task_parameters.0.network_configuration.0.aws_vpc_configuration.0.subnets.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.ecs_task_parameters.0.overrides.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.ecs_task_parameters.0.overrides.0.container_override.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.ecs_task_parameters.0.overrides.0.container_override.0.command.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.ecs_task_parameters.0.overrides.0.container_override.0.cpu", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.ecs_task_parameters.0.overrides.0.container_override.0.environment.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.ecs_task_parameters.0.overrides.0.container_override.0.environment.0.name", "TMP"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.ecs_task_parameters.0.overrides.0.container_override.0.environment.0.value", "/tmp2"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.ecs_task_parameters.0.overrides.0.container_override.0.environment_file.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.ecs_task_parameters.0.overrides.0.container_override.0.memory", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.ecs_task_parameters.0.overrides.0.container_override.0.memory_reservation", "1024"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.ecs_task_parameters.0.overrides.0.container_override.0.name", "first"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.ecs_task_parameters.0.overrides.0.container_override.0.resource_requirement.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.ecs_task_parameters.0.overrides.0.container_override.0.resource_requirement.0.type", "GPU"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.ecs_task_parameters.0.overrides.0.container_override.0.resource_requirement.0.value", "2"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.ecs_task_parameters.0.overrides.0.cpu", ""),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.ecs_task_parameters.0.overrides.0.ephemeral_storage.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.ecs_task_parameters.0.overrides.0.ephemeral_storage.0.size_in_gib", "32"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.ecs_task_parameters.0.overrides.0.execution_role_arn", ""),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.ecs_task_parameters.0.overrides.0.inference_accelerator_override.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.ecs_task_parameters.0.overrides.0.memory", ""),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.ecs_task_parameters.0.overrides.0.task_role_arn", ""),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.ecs_task_parameters.0.placement_constraint.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.ecs_task_parameters.0.placement_strategy.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.ecs_task_parameters.0.placement_strategy.0.field", "cpu"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.ecs_task_parameters.0.placement_strategy.0.type", "binpack"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.ecs_task_parameters.0.platform_version", ""),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.ecs_task_parameters.0.propagate_tags", "TASK_DEFINITION"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.ecs_task_parameters.0.reference_id", "refid"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.ecs_task_parameters.0.tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.ecs_task_parameters.0.tags.Name", rName),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.ecs_task_parameters.0.task_count", "1"),
+					resource.TestCheckResourceAttrSet(resourceName, "target_parameters.0.ecs_task_parameters.0.task_definition_arn"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.eventbridge_event_bus_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.http_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.input_template", ""),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.kinesis_stream_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.lambda_function_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.redshift_data_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.sagemaker_pipeline_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.sqs_queue_parameters.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "target_parameters.0.step_function_state_machine_parameters.#", "0"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
+func testAccCheckPipeDestroy(ctx context.Context) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		conn := acctest.Provider.Meta().(*conns.AWSClient).PipesClient(ctx)
+
+		for _, rs := range s.RootModule().Resources {
+			if rs.Type != "aws_pipes_pipe" {
+				continue
+			}
+
+			_, err := tfpipes.FindPipeByName(ctx, conn, rs.Primary.ID)
+
+			if tfresource.NotFound(err) {
+				continue
+			}
+
+			if err != nil {
+				return err
+			}
+
+			return create.Error(names.Pipes, create.ErrActionCheckingDestroyed, tfpipes.ResNamePipe, rs.Primary.ID, errors.New("not destroyed"))
+		}
+
+		return nil
+	}
+}
+
+func testAccCheckPipeExists(ctx context.Context, name string, pipe *pipes.DescribePipeOutput) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[name]
+		if !ok {
+			return create.Error(names.Pipes, create.ErrActionCheckingExistence, tfpipes.ResNamePipe, name, errors.New("not found"))
+		}
+
+		if rs.Primary.ID == "" {
+			return create.Error(names.Pipes, create.ErrActionCheckingExistence, tfpipes.ResNamePipe, name, errors.New("not set"))
+		}
+
+		conn := acctest.Provider.Meta().(*conns.AWSClient).PipesClient(ctx)
+
+		output, err := tfpipes.FindPipeByName(ctx, conn, rs.Primary.ID)
+
+		if err != nil {
+			return err
+		}
+
+		*pipe = *output
+
+		return nil
+	}
+}
+
+func testAccPreCheck(ctx context.Context, t *testing.T) {
+	conn := acctest.Provider.Meta().(*conns.AWSClient).PipesClient(ctx)
+
+	input := &pipes.ListPipesInput{}
+	_, err := conn.ListPipes(ctx, input)
+
+	if acctest.PreCheckSkipError(err) {
+		t.Skipf("skipping acceptance testing: %s", err)
+	}
+
+	if err != nil {
+		t.Fatalf("unexpected PreCheck error: %s", err)
+	}
+}
+
+func testAccPipeConfig_base(rName string) string {
+	return fmt.Sprintf(`
+data "aws_caller_identity" "main" {}
+data "aws_partition" "main" {}
+
+resource "aws_iam_role" "test" {
+  name = %[1]q
+
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = {
+      Effect = "Allow"
+      Action = "sts:AssumeRole"
+      Principal = {
+        Service = "pipes.${data.aws_partition.main.dns_suffix}"
+      }
+      Condition = {
+        StringEquals = {
+          "aws:SourceAccount" = data.aws_caller_identity.main.account_id
+        }
+      }
+    }
+  })
+}
+`, rName)
+}
+
+func testAccPipeConfig_baseSQSSource(rName string) string {
+	return fmt.Sprintf(`
+resource "aws_iam_role_policy" "source" {
+  role = aws_iam_role.test.id
+  name = "%[1]s-source"
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Effect = "Allow"
+        Action = [
+          "sqs:DeleteMessage",
+          "sqs:GetQueueAttributes",
+          "sqs:ReceiveMessage",
+        ],
+        Resource = [
+          aws_sqs_queue.source.arn,
+        ]
+      },
+    ]
+  })
+}
+
+resource "aws_sqs_queue" "source" {
+  name = "%[1]s-source"
+}
+`, rName)
+}
+
+func testAccPipeConfig_baseSQSTarget(rName string) string {
+	return fmt.Sprintf(`
+resource "aws_iam_role_policy" "target" {
+  role = aws_iam_role.test.id
+  name = "%[1]s-target"
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Effect = "Allow"
+        Action = [
+          "sqs:SendMessage",
+        ],
+        Resource = [
+          aws_sqs_queue.target.arn,
+        ]
+      },
+    ]
+  })
+}
+
+resource "aws_sqs_queue" "target" {
+  name = "%[1]s-target"
+}
+`, rName)
+}
+
+func testAccPipeConfig_baseKinesisSource(rName string) string {
+	return fmt.Sprintf(`
+resource "aws_iam_role_policy" "source" {
+  role = aws_iam_role.test.id
+  name = "%[1]s-source"
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Effect = "Allow"
+        Action = [
+          "kinesis:DescribeStream",
+          "kinesis:DescribeStreamSummary",
+          "kinesis:GetRecords",
+          "kinesis:GetShardIterator",
+          "kinesis:ListShards",
+          "kinesis:ListStreams",
+          "kinesis:SubscribeToShard",
+        ],
+        Resource = [
+          aws_kinesis_stream.source.arn,
+        ]
+      },
+    ]
+  })
+}
+
+resource "aws_kinesis_stream" "source" {
+  name = "%[1]s-source"
+
+  stream_mode_details {
+    stream_mode = "ON_DEMAND"
+  }
+}
+`, rName)
+}
+
+func testAccPipeConfig_baseKinesisTarget(rName string) string {
+	return fmt.Sprintf(`
+resource "aws_iam_role_policy" "target" {
+  role = aws_iam_role.test.id
+  name = "%[1]s-target"
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Effect = "Allow"
+        Action = [
+          "kinesis:PutRecord",
+        ],
+        Resource = [
+          aws_kinesis_stream.target.arn,
+        ]
+      },
+    ]
+  })
+}
+
+resource "aws_kinesis_stream" "target" {
+  name = "%[1]s-target"
+
+  stream_mode_details {
+    stream_mode = "ON_DEMAND"
+  }
+}
+`, rName)
+}
+
+func testAccPipeConfig_basicSQS(rName string) string {
+	return acctest.ConfigCompose(
+		testAccPipeConfig_base(rName),
+		testAccPipeConfig_baseSQSSource(rName),
+		testAccPipeConfig_baseSQSTarget(rName),
+		fmt.Sprintf(`
+resource "aws_pipes_pipe" "test" {
+  depends_on = [aws_iam_role_policy.source, aws_iam_role_policy.target]
+
+  name     = %[1]q
+  role_arn = aws_iam_role.test.arn
+  source   = aws_sqs_queue.source.arn
+  target   = aws_sqs_queue.target.arn
+}
+`, rName))
+}
+
+func testAccPipeConfig_description(rName, description string) string {
+	return acctest.ConfigCompose(
+		testAccPipeConfig_base(rName),
+		testAccPipeConfig_baseSQSSource(rName),
+		testAccPipeConfig_baseSQSTarget(rName),
+		fmt.Sprintf(`
+resource "aws_pipes_pipe" "test" {
+  depends_on = [aws_iam_role_policy.source, aws_iam_role_policy.target]
+
+  name     = %[1]q
+  role_arn = aws_iam_role.test.arn
+  source   = aws_sqs_queue.source.arn
+  target   = aws_sqs_queue.target.arn
+
+  description = %[2]q
+}
+`, rName, description))
+}
+
+func testAccPipeConfig_desiredState(rName, state string) string {
+	return acctest.ConfigCompose(
+		testAccPipeConfig_base(rName),
+		testAccPipeConfig_baseSQSSource(rName),
+		testAccPipeConfig_baseSQSTarget(rName),
+		fmt.Sprintf(`
+resource "aws_pipes_pipe" "test" {
+  depends_on = [aws_iam_role_policy.source, aws_iam_role_policy.target]
+
+  name     = %[1]q
+  role_arn = aws_iam_role.test.arn
+  source   = aws_sqs_queue.source.arn
+  target   = aws_sqs_queue.target.arn
+
+  desired_state = %[2]q
+}
+`, rName, state))
+}
+
+func testAccPipeConfig_enrichment(rName string, i int) string {
+	return acctest.ConfigCompose(
+		testAccPipeConfig_base(rName),
+		testAccPipeConfig_baseSQSSource(rName),
+		testAccPipeConfig_baseSQSTarget(rName),
+		fmt.Sprintf(`
+resource "aws_cloudwatch_event_connection" "test" {
+  name               = %[1]q
+  authorization_type = "API_KEY"
+
+  auth_parameters {
+    api_key {
+      key   = "testKey"
+      value = "testValue"
+    }
+  }
+}
+
+resource "aws_cloudwatch_event_api_destination" "test" {
+  count               = 2
+  name                = "%[1]s-${count.index}"
+  invocation_endpoint = "https://example.com/${count.index}"
+  http_method         = "POST"
+  connection_arn      = aws_cloudwatch_event_connection.test.arn
+}
+
+resource "aws_pipes_pipe" "test" {
+  depends_on = [aws_iam_role_policy.source, aws_iam_role_policy.target]
+
+  name     = %[1]q
+  role_arn = aws_iam_role.test.arn
+  source   = aws_sqs_queue.source.arn
+  target   = aws_sqs_queue.target.arn
+
+  enrichment = aws_cloudwatch_event_api_destination.test[%[2]d].arn
+}
+`, rName, i))
+}
+
+func testAccPipeConfig_enrichmentParameters(rName string) string {
+	return acctest.ConfigCompose(
+		testAccPipeConfig_base(rName),
+		testAccPipeConfig_baseSQSSource(rName),
+		testAccPipeConfig_baseSQSTarget(rName),
+		fmt.Sprintf(`
+resource "aws_cloudwatch_event_connection" "test" {
+  name               = %[1]q
+  authorization_type = "API_KEY"
+
+  auth_parameters {
+    api_key {
+      key   = "testKey"
+      value = "testValue"
+    }
+  }
+}
+
+resource "aws_cloudwatch_event_api_destination" "test" {
+  name                = %[1]q
+  invocation_endpoint = "https://example.com/"
+  http_method         = "POST"
+  connection_arn      = aws_cloudwatch_event_connection.test.arn
+}
+
+resource "aws_pipes_pipe" "test" {
+  depends_on = [aws_iam_role_policy.source, aws_iam_role_policy.target]
+
+  name     = %[1]q
+  role_arn = aws_iam_role.test.arn
+  source   = aws_sqs_queue.source.arn
+  target   = aws_sqs_queue.target.arn
+
+  enrichment = aws_cloudwatch_event_api_destination.test.arn
+
+  enrichment_parameters {
+    http_parameters {
+      header_parameters = {
+        "X-Test-1" = "Val1"
+      }
+
+      path_parameter_values = ["p1"]
+
+      query_string_parameters = {
+        "q1" = "abc"
+      }
+    }
+  }
+}
+`, rName))
+}
+
+func testAccPipeConfig_enrichmentParametersUpdated(rName string) string {
+	return acctest.ConfigCompose(
+		testAccPipeConfig_base(rName),
+		testAccPipeConfig_baseSQSSource(rName),
+		testAccPipeConfig_baseSQSTarget(rName),
+		fmt.Sprintf(`
+resource "aws_cloudwatch_event_connection" "test" {
+  name               = %[1]q
+  authorization_type = "API_KEY"
+
+  auth_parameters {
+    api_key {
+      key   = "testKey"
+      value = "testValue"
+    }
+  }
+}
+
+resource "aws_cloudwatch_event_api_destination" "test" {
+  name                = %[1]q
+  invocation_endpoint = "https://example.com/"
+  http_method         = "POST"
+  connection_arn      = aws_cloudwatch_event_connection.test.arn
+}
+
+resource "aws_pipes_pipe" "test" {
+  depends_on = [aws_iam_role_policy.source, aws_iam_role_policy.target]
+
+  name     = %[1]q
+  role_arn = aws_iam_role.test.arn
+  source   = aws_sqs_queue.source.arn
+  target   = aws_sqs_queue.target.arn
+
+  enrichment = aws_cloudwatch_event_api_destination.test.arn
+
+  enrichment_parameters {
+    http_parameters {
+      header_parameters = {
+        "X-Test-1" = "Val1"
+        "X-Test-2" = "Val2"
+      }
+
+      path_parameter_values = ["p2"]
+    }
+  }
+}
+`, rName))
+}
+
+func testAccPipeConfig_sourceParameters_filterCriteria1(rName, criteria1 string) string {
+	return acctest.ConfigCompose(
+		testAccPipeConfig_base(rName),
+		testAccPipeConfig_baseSQSSource(rName),
+		testAccPipeConfig_baseSQSTarget(rName),
+		fmt.Sprintf(`
+resource "aws_pipes_pipe" "test" {
+  depends_on = [aws_iam_role_policy.source, aws_iam_role_policy.target]
+
+  name     = %[1]q
+  role_arn = aws_iam_role.test.arn
+  source   = aws_sqs_queue.source.arn
+  target   = aws_sqs_queue.target.arn
+
+  source_parameters {
+    filter_criteria {
+      filter {
+        pattern = jsonencode({
+          source = [%[2]q]
+        })
+      }
+    }
+  }
+}
+`, rName, criteria1))
+}
+
+func testAccPipeConfig_sourceParameters_filterCriteria2(rName, criteria1, criteria2 string) string {
+	return acctest.ConfigCompose(
+		testAccPipeConfig_base(rName),
+		testAccPipeConfig_baseSQSSource(rName),
+		testAccPipeConfig_baseSQSTarget(rName),
+		fmt.Sprintf(`
+resource "aws_pipes_pipe" "test" {
+  depends_on = [aws_iam_role_policy.source, aws_iam_role_policy.target]
+
+  name     = %[1]q
+  role_arn = aws_iam_role.test.arn
+  source   = aws_sqs_queue.source.arn
+  target   = aws_sqs_queue.target.arn
+
+  source_parameters {
+    filter_criteria {
+      filter {
+        pattern = jsonencode({
+          source = [%[2]q]
+        })
+      }
+
+      filter {
+        pattern = jsonencode({
+          source = [%[3]q]
+        })
+      }
+    }
+  }
+}
+`, rName, criteria1, criteria2))
+}
+
+func testAccPipeConfig_sourceParameters_filterCriteria0(rName string) string {
+	return acctest.ConfigCompose(
+		testAccPipeConfig_base(rName),
+		testAccPipeConfig_baseSQSSource(rName),
+		testAccPipeConfig_baseSQSTarget(rName),
+		fmt.Sprintf(`
+resource "aws_pipes_pipe" "test" {
+  depends_on = [aws_iam_role_policy.source, aws_iam_role_policy.target]
+  name       = %[1]q
+  role_arn   = aws_iam_role.test.arn
+  source     = aws_sqs_queue.source.arn
+  target     = aws_sqs_queue.target.arn
+
+  source_parameters {
+    filter_criteria {}
+  }
+}
+`, rName))
+}
+
+func testAccPipeConfig_nameGenerated(rName string) string {
+	return acctest.ConfigCompose(
+		testAccPipeConfig_base(rName),
+		testAccPipeConfig_baseSQSSource(rName),
+		testAccPipeConfig_baseSQSTarget(rName),
+		`
+resource "aws_pipes_pipe" "test" {
+  depends_on = [aws_iam_role_policy.source, aws_iam_role_policy.target]
+
+  role_arn = aws_iam_role.test.arn
+  source   = aws_sqs_queue.source.arn
+  target   = aws_sqs_queue.target.arn
+}
+`,
+	)
+}
+
+func testAccPipeConfig_namePrefix(rName, namePrefix string) string {
+	return acctest.ConfigCompose(
+		testAccPipeConfig_base(rName),
+		testAccPipeConfig_baseSQSSource(rName),
+		testAccPipeConfig_baseSQSTarget(rName),
+		fmt.Sprintf(`
+resource "aws_pipes_pipe" "test" {
+  depends_on = [aws_iam_role_policy.source, aws_iam_role_policy.target]
+
+  name_prefix = %[1]q
+  role_arn    = aws_iam_role.test.arn
+  source      = aws_sqs_queue.source.arn
+  target      = aws_sqs_queue.target.arn
+}
+`, namePrefix))
+}
+
+func testAccPipeConfig_roleARN(rName string) string {
+	return acctest.ConfigCompose(
+		testAccPipeConfig_base(rName),
+		testAccPipeConfig_baseSQSSource(rName),
+		testAccPipeConfig_baseSQSTarget(rName),
+		fmt.Sprintf(`
+resource "aws_iam_role" "test2" {
+  name = "%[1]s-2"
+
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = {
+      Effect = "Allow"
+      Action = "sts:AssumeRole"
+      Principal = {
+        Service = "pipes.${data.aws_partition.main.dns_suffix}"
+      }
+      Condition = {
+        StringEquals = {
+          "aws:SourceAccount" = data.aws_caller_identity.main.account_id
+        }
+      }
+    }
+  })
+}
+
+resource "aws_iam_role_policy" "source2" {
+  role = aws_iam_role.test2.id
+  name = "%[1]s-source2"
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Effect = "Allow"
+        Action = [
+          "sqs:DeleteMessage",
+          "sqs:GetQueueAttributes",
+          "sqs:ReceiveMessage",
+        ],
+        Resource = [
+          aws_sqs_queue.source.arn,
+        ]
+      },
+    ]
+  })
+}
+
+resource "aws_pipes_pipe" "test" {
+  depends_on = [aws_iam_role_policy.source2, aws_iam_role_policy.target]
+
+  name     = %[1]q
+  role_arn = aws_iam_role.test2.arn
+  source   = aws_sqs_queue.source.arn
+  target   = aws_sqs_queue.target.arn
+}
+`, rName))
+}
+
+func testAccPipeConfig_tags1(rName, tag1Key, tag1Value string) string {
+	return acctest.ConfigCompose(
+		testAccPipeConfig_base(rName),
+		testAccPipeConfig_baseSQSSource(rName),
+		testAccPipeConfig_baseSQSTarget(rName),
+		fmt.Sprintf(`
+resource "aws_pipes_pipe" "test" {
+  depends_on = [aws_iam_role_policy.source, aws_iam_role_policy.target]
+
+  name     = %[1]q
+  role_arn = aws_iam_role.test.arn
+  source   = aws_sqs_queue.source.arn
+  target   = aws_sqs_queue.target.arn
+
+  tags = {
+    %[2]q = %[3]q
+  }
+}
+`, rName, tag1Key, tag1Value))
+}
+
+func testAccPipeConfig_tags2(rName, tag1Key, tag1Value, tag2Key, tag2Value string) string {
+	return acctest.ConfigCompose(
+		testAccPipeConfig_base(rName),
+		testAccPipeConfig_baseSQSSource(rName),
+		testAccPipeConfig_baseSQSTarget(rName),
+		fmt.Sprintf(`
+resource "aws_pipes_pipe" "test" {
+  depends_on = [aws_iam_role_policy.source, aws_iam_role_policy.target]
+
+  name     = %[1]q
+  role_arn = aws_iam_role.test.arn
+  source   = aws_sqs_queue.source.arn
+  target   = aws_sqs_queue.target.arn
+
+  tags = {
+    %[2]q = %[3]q
+    %[4]q = %[5]q
+  }
+}
+`, rName, tag1Key, tag1Value, tag2Key, tag2Value))
+}
+
+func testAccPipeConfig_targetUpdated(rName string) string {
+	return acctest.ConfigCompose(
+		testAccPipeConfig_base(rName),
+		testAccPipeConfig_baseSQSSource(rName),
+		testAccPipeConfig_baseSQSTarget(rName),
+		fmt.Sprintf(`
+resource "aws_iam_role_policy" "target2" {
+  role = aws_iam_role.test.id
+  name = "%[1]s-target2"
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Effect = "Allow"
+        Action = [
+          "sqs:SendMessage",
+        ],
+        Resource = [
+          aws_sqs_queue.target2.arn,
+        ]
+      },
+    ]
+  })
+}
+
+resource "aws_sqs_queue" "target2" {
+  name = "%[1]s-target2"
+}
+
+resource "aws_pipes_pipe" "test" {
+  depends_on = [aws_iam_role_policy.source, aws_iam_role_policy.target2]
+
+  name     = %[1]q
+  role_arn = aws_iam_role.test.arn
+  source   = aws_sqs_queue.source.arn
+  target   = aws_sqs_queue.target2.arn
+}
+`, rName))
+}
+
+func testAccPipeConfig_targetParameters_inputTemplate(rName, template string) string {
+	return acctest.ConfigCompose(
+		testAccPipeConfig_base(rName),
+		testAccPipeConfig_baseSQSSource(rName),
+		testAccPipeConfig_baseSQSTarget(rName),
+		fmt.Sprintf(`
+resource "aws_pipes_pipe" "test" {
+  depends_on = [aws_iam_role_policy.source, aws_iam_role_policy.target]
+
+  name     = %[1]q
+  role_arn = aws_iam_role.test.arn
+  source   = aws_sqs_queue.source.arn
+  target   = aws_sqs_queue.target.arn
+
+  target_parameters {
+    input_template = %[2]q
+  }
+}
+`, rName, template))
+}
+
+func testAccPipeConfig_basicKinesis(rName string) string {
+	return acctest.ConfigCompose(
+		testAccPipeConfig_base(rName),
+		testAccPipeConfig_baseKinesisSource(rName),
+		testAccPipeConfig_baseKinesisTarget(rName),
+		fmt.Sprintf(`
+resource "aws_pipes_pipe" "test" {
+  depends_on = [aws_iam_role_policy.source, aws_iam_role_policy.target]
+
+  name     = %[1]q
+  role_arn = aws_iam_role.test.arn
+  source   = aws_kinesis_stream.source.arn
+  target   = aws_kinesis_stream.target.arn
+
+  source_parameters {
+    kinesis_stream_parameters {
+      starting_position = "LATEST"
+    }
+  }
 
-		conn := acctest.Provider.Meta().(*conns.AWSClient).PipesClient(ctx)
+  target_parameters {
+    kinesis_stream_parameters {
+      partition_key = "test"
+    }
+  }
+}
+`, rName))
+}
 
-		output, err := tfpipes.FindPipeByName(ctx, conn, rs.Primary.ID)
+func testAccPipeConfig_basicDynamoDBSourceCloudWatchLogsTarget(rName string) string {
+	return acctest.ConfigCompose(
+		testAccPipeConfig_base(rName),
+		fmt.Sprintf(`
+resource "aws_iam_role_policy" "source" {
+  role = aws_iam_role.test.id
+  name = "%[1]s-source"
 
-		if err != nil {
-			return err
-		}
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Effect = "Allow"
+        Action = [
+          "dynamodb:DescribeStream",
+          "dynamodb:GetRecords",
+          "dynamodb:GetShardIterator",
+          "dynamodb:ListStreams",
+        ],
+        Resource = [
+          aws_dynamodb_table.source.stream_arn,
+          "${aws_dynamodb_table.source.stream_arn}/*"
+        ]
+      },
+    ]
+  })
+}
 
-		*pipe = *output
+resource "aws_dynamodb_table" "source" {
+  name             = "%[1]s-source"
+  billing_mode     = "PAY_PER_REQUEST"
+  hash_key         = "PK"
+  range_key        = "SK"
+  stream_enabled   = true
+  stream_view_type = "NEW_AND_OLD_IMAGES"
+
+  attribute {
+    name = "PK"
+    type = "S"
+  }
 
-		return nil
-	}
+  attribute {
+    name = "SK"
+    type = "S"
+  }
 }
 
-func testAccPreCheck(ctx context.Context, t *testing.T) {
-	conn := acctest.Provider.Meta().(*conns.AWSClient).PipesClient(ctx)
+resource "aws_iam_role_policy" "target" {
+  role = aws_iam_role.test.id
+  name = "%[1]s-target"
 
-	input := &pipes.ListPipesInput{}
-	_, err := conn.ListPipes(ctx, input)
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Effect = "Allow"
+        Action = [
+          "logs:PutLogEvents",
+        ],
+        Resource = [
+          aws_cloudwatch_log_stream.target.arn,
+        ]
+      },
+    ]
+  })
+}
 
-	if acctest.PreCheckSkipError(err) {
-		t.Skipf("skipping acceptance testing: %s", err)
-	}
+resource "aws_cloudwatch_log_group" "target" {
+  name = "%[1]s-target"
+}
 
-	if err != nil {
-		t.Fatalf("unexpected PreCheck error: %s", err)
-	}
+resource "aws_cloudwatch_log_stream" "target" {
+  name           = "%[1]s-target"
+  log_group_name = aws_cloudwatch_log_group.target.name
 }
 
-const testAccPipeConfig_base = `
-data "aws_caller_identity" "main" {}
-data "aws_partition" "main" {}
+resource "aws_pipes_pipe" "test" {
+  depends_on = [aws_iam_role_policy.source, aws_iam_role_policy.target]
 
-resource "aws_iam_role" "test" {
-  assume_role_policy = jsonencode({
+  name     = %[1]q
+  role_arn = aws_iam_role.test.arn
+  source   = aws_dynamodb_table.source.stream_arn
+  target   = aws_cloudwatch_log_group.target.arn
+
+  source_parameters {
+    dynamodb_stream_parameters {
+      starting_position = "LATEST"
+    }
+  }
+
+  target_parameters {
+    cloudwatch_logs_parameters {
+      log_stream_name = aws_cloudwatch_log_stream.target.name
+    }
+  }
+}
+`, rName))
+}
+
+func testAccPipeConfig_basicActiveMQSourceStepFunctionTarget(rName string) string {
+	return acctest.ConfigCompose(
+		testAccPipeConfig_base(rName),
+		fmt.Sprintf(`
+resource "aws_iam_role_policy" "source" {
+  role = aws_iam_role.test.id
+  name = "%[1]s-source"
+
+  policy = jsonencode({
     Version = "2012-10-17"
-    Statement = {
-      Effect = "Allow"
-      Action = "sts:AssumeRole"
-      Principal = {
-        Service = "pipes.${data.aws_partition.main.dns_suffix}"
-      }
-      Condition = {
-        StringEquals = {
-          "aws:SourceAccount" = data.aws_caller_identity.main.account_id
-        }
+    Statement = [
+      {
+        Effect = "Allow"
+        Action = [
+          "mq:DescribeBroker",
+          "secretsmanager:GetSecretValue",
+          "ec2:CreateNetworkInterface",
+          "ec2:DescribeNetworkInterfaces",
+          "ec2:DescribeVpcs",
+          "ec2:DeleteNetworkInterface",
+          "ec2:DescribeSubnets",
+          "ec2:DescribeSecurityGroups",
+          "logs:CreateLogGroup",
+          "logs:CreateLogStream",
+          "logs:PutLogEvents"
+        ],
+        Resource = [
+          "*"
+        ]
+      },
+    ]
+  })
+
+  depends_on = [aws_mq_broker.source]
+}
+
+resource "aws_security_group" "source" {
+  name = "%[1]s-source"
+
+  ingress {
+    from_port   = 61617
+    to_port     = 61617
+    protocol    = "tcp"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+
+  tags = {
+    Name = %[1]q
+  }
+}
+
+resource "aws_mq_broker" "source" {
+  broker_name             = "%[1]s-source"
+  engine_type             = "ActiveMQ"
+  engine_version          = "5.15.0"
+  host_instance_type      = "mq.t2.micro"
+  security_groups         = [aws_security_group.source.id]
+  authentication_strategy = "simple"
+  storage_type            = "efs"
+
+  logs {
+    general = true
+  }
+
+  user {
+    username = "Test"
+    password = "TestTest1234"
+  }
+
+  publicly_accessible = true
+}
+
+resource "aws_secretsmanager_secret" "source" {
+  name = "%[1]s-source"
+}
+
+resource "aws_secretsmanager_secret_version" "source" {
+  secret_id     = aws_secretsmanager_secret.source.id
+  secret_string = jsonencode({ username = "Test", password = "TestTest1234" })
+}
+
+resource "aws_iam_role" "target" {
+  name = "%[1]s-target"
+
+  assume_role_policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Action": "sts:AssumeRole",
+      "Principal": {
+        "Service": "states.${data.aws_partition.main.dns_suffix}"
+      },
+      "Effect": "Allow",
+      "Sid": ""
+    }
+  ]
+}
+EOF
+}
+
+resource "aws_sfn_state_machine" "target" {
+  name     = "%[1]s-target"
+  role_arn = aws_iam_role.target.arn
+
+  definition = <<EOF
+{
+  "Comment": "A Hello World example of the Amazon States Language using an AWS Lambda Function",
+  "StartAt": "HelloWorld",
+  "States": {
+    "HelloWorld": {
+      "Type": "Pass",
+      "End": true
+    }
+  }
+}
+EOF
+}
+
+resource "aws_pipes_pipe" "test" {
+  depends_on = [aws_iam_role_policy.source]
+
+  name     = %[1]q
+  role_arn = aws_iam_role.test.arn
+  source   = aws_mq_broker.source.arn
+  target   = aws_sfn_state_machine.target.arn
+
+  source_parameters {
+    activemq_broker_parameters {
+      queue_name = "test"
+
+      credentials {
+        basic_auth = aws_secretsmanager_secret_version.source.arn
       }
     }
-  })
+  }
+
+  target_parameters {
+    step_function_state_machine_parameters {
+      invocation_type = "REQUEST_RESPONSE"
+    }
+  }
+}
+`, rName))
 }
-`
 
-const testAccPipeConfig_base_sqsSource = `
+func testAccPipeConfig_basicRabbitMQSourceEventBusTarget(rName string) string {
+	return acctest.ConfigCompose(
+		testAccPipeConfig_base(rName),
+		fmt.Sprintf(`
 resource "aws_iam_role_policy" "source" {
   role = aws_iam_role.test.id
+  name = "%[1]s-source"
+
   policy = jsonencode({
     Version = "2012-10-17"
     Statement = [
       {
         Effect = "Allow"
         Action = [
-          "sqs:DeleteMessage",
-          "sqs:GetQueueAttributes",
-          "sqs:ReceiveMessage",
+          "mq:DescribeBroker",
+          "secretsmanager:GetSecretValue",
+          "ec2:CreateNetworkInterface",
+          "ec2:DescribeNetworkInterfaces",
+          "ec2:DescribeVpcs",
+          "ec2:DeleteNetworkInterface",
+          "ec2:DescribeSubnets",
+          "ec2:DescribeSecurityGroups",
+          "logs:CreateLogGroup",
+          "logs:CreateLogStream",
+          "logs:PutLogEvents"
         ],
         Resource = [
-          aws_sqs_queue.source.arn,
+          "*"
         ]
       },
     ]
   })
+
+  depends_on = [aws_mq_broker.source]
+}
+
+resource "aws_mq_broker" "source" {
+  broker_name             = "%[1]s-source"
+  engine_type             = "RabbitMQ"
+  engine_version          = "3.8.11"
+  host_instance_type      = "mq.t3.micro"
+  authentication_strategy = "simple"
+
+  logs {
+    general = true
+  }
+
+  user {
+    username = "Test"
+    password = "TestTest1234"
+  }
+
+  publicly_accessible = true
+}
+
+resource "aws_secretsmanager_secret" "source" {
+  name = "%[1]s-source"
 }
 
-resource "aws_sqs_queue" "source" {}
-`
+resource "aws_secretsmanager_secret_version" "source" {
+  secret_id     = aws_secretsmanager_secret.source.id
+  secret_string = jsonencode({ username = "Test", password = "TestTest1234" })
+}
 
-const testAccPipeConfig_base_sqsTarget = `
 resource "aws_iam_role_policy" "target" {
   role = aws_iam_role.test.id
+  name = "%[1]s-target"
+
   policy = jsonencode({
     Version = "2012-10-17"
     Statement = [
       {
         Effect = "Allow"
         Action = [
-          "sqs:SendMessage",
+          "events:PutEvent",
         ],
         Resource = [
-          aws_sqs_queue.target.arn,
+          aws_cloudwatch_event_bus.target.arn,
         ]
       },
     ]
   })
 }
 
-resource "aws_sqs_queue" "target" {}
-`
+resource "aws_cloudwatch_event_bus" "target" {
+  name = "%[1]s-target"
+}
 
-func testAccPipeConfig_basic(name string) string {
-	return acctest.ConfigCompose(
-		testAccPipeConfig_base,
-		testAccPipeConfig_base_sqsSource,
-		testAccPipeConfig_base_sqsTarget,
-		fmt.Sprintf(`
 resource "aws_pipes_pipe" "test" {
   depends_on = [aws_iam_role_policy.source, aws_iam_role_policy.target]
-  name       = %[1]q
-  role_arn   = aws_iam_role.test.arn
-  source     = aws_sqs_queue.source.arn
-  target     = aws_sqs_queue.target.arn
 
-  source_parameters {}
-  target_parameters {}
+  name     = %[1]q
+  role_arn = aws_iam_role.test.arn
+  source   = aws_mq_broker.source.arn
+  target   = aws_cloudwatch_event_bus.target.arn
+
+  source_parameters {
+    rabbitmq_broker_parameters {
+      queue_name = "test"
+
+      credentials {
+        basic_auth = aws_secretsmanager_secret_version.source.arn
+      }
+    }
+  }
 }
-`, name),
-	)
+`, rName))
 }
 
-func testAccPipeConfig_description(name, description string) string {
+func testAccPipeConfig_basicMSKSourceHTTPTarget(rName string) string {
 	return acctest.ConfigCompose(
-		testAccPipeConfig_base,
-		testAccPipeConfig_base_sqsSource,
-		testAccPipeConfig_base_sqsTarget,
+		testAccPipeConfig_base(rName),
+		acctest.ConfigVPCWithSubnets(rName, 3),
 		fmt.Sprintf(`
+resource "aws_iam_role_policy" "source" {
+  role = aws_iam_role.test.id
+  name = "%[1]s-source"
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Effect = "Allow"
+        Action = [
+          "kafka:DescribeCluster",
+          "kafka:GetBootstrapBrokers",
+          "ec2:CreateNetworkInterface",
+          "ec2:DeleteNetworkInterface",
+          "ec2:DescribeNetworkInterfaces",
+          "ec2:DescribeSecurityGroups",
+          "ec2:DescribeSubnets",
+          "ec2:DescribeVpcs",
+          "logs:CreateLogGroup",
+          "logs:CreateLogStream",
+          "logs:PutLogEvents"
+        ],
+        Resource = [
+          "*"
+        ]
+      },
+    ]
+  })
+
+  depends_on = [aws_msk_cluster.source]
+}
+
+resource "aws_security_group" "source" {
+  name   = "%[1]s-source"
+  vpc_id = aws_vpc.test.id
+
+  tags = {
+    Name = "%[1]s-source"
+  }
+}
+
+resource "aws_msk_cluster" "source" {
+  cluster_name           = "%[1]s-source"
+  kafka_version          = "2.7.1"
+  number_of_broker_nodes = 3
+
+  broker_node_group_info {
+    client_subnets  = aws_subnet.test[*].id
+    instance_type   = "kafka.m5.large"
+    security_groups = [aws_security_group.source.id]
+
+    storage_info {
+      ebs_storage_info {
+        volume_size = 10
+      }
+    }
+  }
+}
+
+resource "aws_api_gateway_rest_api" "target" {
+  name = "%[1]s-target"
+
+  body = jsonencode({
+    openapi = "3.0.1"
+    info = {
+      title   = "example"
+      version = "1.0"
+    }
+    paths = {
+      "/" = {
+        get = {
+          x-amazon-apigateway-integration = {
+            httpMethod           = "GET"
+            payloadFormatVersion = "1.0"
+            type                 = "HTTP_PROXY"
+            uri                  = "https://ip-ranges.amazonaws.com"
+          }
+        }
+      }
+    }
+  })
+}
+
+resource "aws_api_gateway_deployment" "target" {
+  rest_api_id = aws_api_gateway_rest_api.target.id
+
+  triggers = {
+    redeployment = sha1(jsonencode(aws_api_gateway_rest_api.target.body))
+  }
+
+  lifecycle {
+    create_before_destroy = true
+  }
+}
+
+resource "aws_api_gateway_stage" "target" {
+  deployment_id = aws_api_gateway_deployment.target.id
+  rest_api_id   = aws_api_gateway_rest_api.target.id
+  stage_name    = "test"
+}
+
 resource "aws_pipes_pipe" "test" {
-  depends_on = [aws_iam_role_policy.source, aws_iam_role_policy.target]
-  name       = %[1]q
-  role_arn   = aws_iam_role.test.arn
-  source     = aws_sqs_queue.source.arn
-  target     = aws_sqs_queue.target.arn
+  depends_on = [aws_iam_role_policy.source]
 
-  source_parameters {}
-  target_parameters {}
+  name     = %[1]q
+  role_arn = aws_iam_role.test.arn
+  source   = aws_msk_cluster.source.arn
+  target   = "${aws_api_gateway_stage.target.execution_arn}/GET/*"
 
-  description = %[2]q
+  source_parameters {
+    managed_streaming_kafka_parameters {
+      topic_name = "test"
+    }
+  }
+
+  target_parameters {
+    http_parameters {
+      header_parameters = {
+        "X-Test" = "test"
+      }
+
+      path_parameter_values = ["p1"]
+
+      query_string_parameters = {
+        "testing" = "yes"
+      }
+    }
+  }
 }
-`, name, description),
-	)
+`, rName))
 }
 
-func testAccPipeConfig_desiredState(name, state string) string {
+func testAccPipeConfig_basicSelfManagedKafkaSourceLambdaFunctionTarget(rName string) string {
 	return acctest.ConfigCompose(
-		testAccPipeConfig_base,
-		testAccPipeConfig_base_sqsSource,
-		testAccPipeConfig_base_sqsTarget,
+		testAccPipeConfig_base(rName),
+		acctest.ConfigVPCWithSubnets(rName, 2),
 		fmt.Sprintf(`
-resource "aws_pipes_pipe" "test" {
-  depends_on = [aws_iam_role_policy.source, aws_iam_role_policy.target]
-  name       = %[1]q
-  role_arn   = aws_iam_role.test.arn
-  source     = aws_sqs_queue.source.arn
-  target     = aws_sqs_queue.target.arn
+resource "aws_iam_role_policy" "source" {
+  role = aws_iam_role.test.id
+  name = "%[1]s-source"
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Effect = "Allow"
+        Action = [
+          "ec2:CreateNetworkInterface",
+          "ec2:DeleteNetworkInterface",
+          "ec2:DescribeNetworkInterfaces",
+          "ec2:DescribeSecurityGroups",
+          "ec2:DescribeSubnets",
+          "ec2:DescribeVpcs",
+          "logs:CreateLogGroup",
+          "logs:CreateLogStream",
+          "logs:PutLogEvents"
+        ],
+        Resource = [
+          "*"
+        ]
+      },
+    ]
+  })
+}
 
-  source_parameters {}
-  target_parameters {}
+resource "aws_security_group" "source" {
+  name   = "%[1]s-source"
+  vpc_id = aws_vpc.test.id
 
-  desired_state = %[2]q
-}
-`, name, state),
-	)
+  tags = {
+    Name = "%[1]s-source"
+  }
 }
 
-func testAccPipeConfig_enrichment(name string, i int) string {
-	return acctest.ConfigCompose(
-		testAccPipeConfig_base,
-		testAccPipeConfig_base_sqsSource,
-		testAccPipeConfig_base_sqsTarget,
-		fmt.Sprintf(`
-resource "aws_cloudwatch_event_connection" "test" {
-  name               = %[1]q
-  authorization_type = "API_KEY"
-  auth_parameters {
-    api_key {
-      key   = "testKey"
-      value = "testValue"
+resource "aws_iam_role" "target" {
+  name = "%[1]s-target"
+
+  assume_role_policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Action": "sts:AssumeRole",
+      "Principal": {
+        "Service": "lambda.${data.aws_partition.main.dns_suffix}"
+      },
+      "Effect": "Allow",
+      "Sid": ""
     }
-  }
+  ]
 }
-
-locals {
-  name_prefix = %[1]q
+EOF
 }
 
-resource "aws_cloudwatch_event_api_destination" "test" {
-  count               = 2
-  name                = "${local.name_prefix}-${count.index}"
-  invocation_endpoint = "https://example.com/${count.index}"
-  http_method         = "POST"
-  connection_arn      = aws_cloudwatch_event_connection.test.arn
+resource "aws_lambda_function" "target" {
+  filename      = "test-fixtures/lambdatest.zip"
+  function_name = "%[1]s-target"
+  role          = aws_iam_role.target.arn
+  handler       = "index.handler"
+  runtime       = "nodejs16.x"
 }
 
 resource "aws_pipes_pipe" "test" {
-  depends_on = [aws_iam_role_policy.source, aws_iam_role_policy.target]
-  name       = %[1]q
-  role_arn   = aws_iam_role.test.arn
-  source     = aws_sqs_queue.source.arn
-  target     = aws_sqs_queue.target.arn
+  depends_on = [aws_iam_role_policy.source]
 
-  source_parameters {}
-  target_parameters {}
+  name     = %[1]q
+  role_arn = aws_iam_role.test.arn
+  source   = "smk://test1:9092,test2:9092"
+  target   = aws_lambda_function.target.arn
 
-  enrichment = aws_cloudwatch_event_api_destination.test[%[2]d].arn
+  source_parameters {
+    self_managed_kafka_parameters {
+      additional_bootstrap_servers = ["testing:1234"]
+      consumer_group_id            = "self-managed-test-group-id"
+      topic_name                   = "test"
+
+      vpc {
+        security_groups = [aws_security_group.source.id]
+        subnets         = aws_subnet.test[*].id
+      }
+    }
+  }
+
+  target_parameters {
+    lambda_function_parameters {
+      invocation_type = "REQUEST_RESPONSE"
+    }
+  }
 }
-`, name, i),
-	)
+`, rName))
 }
 
-func testAccPipeConfig_sourceParameters_filterCriteria1(name, criteria1 string) string {
+func testAccPipeConfig_basicSQSSourceRedshiftTarget(rName string) string {
 	return acctest.ConfigCompose(
-		testAccPipeConfig_base,
-		testAccPipeConfig_base_sqsSource,
-		testAccPipeConfig_base_sqsTarget,
+		testAccPipeConfig_base(rName),
+		testAccPipeConfig_baseSQSSource(rName),
+		acctest.ConfigAvailableAZsNoOptInExclude("usw2-az2"),
 		fmt.Sprintf(`
+resource "aws_redshift_cluster" "target" {
+  cluster_identifier                  = "%[1]s-target"
+  availability_zone                   = data.aws_availability_zones.available.names[0]
+  database_name                       = "test"
+  master_username                     = "tfacctest"
+  master_password                     = "Mustbe8characters"
+  node_type                           = "dc2.large"
+  automated_snapshot_retention_period = 0
+  allow_version_upgrade               = false
+  skip_final_snapshot                 = true
+}
+
 resource "aws_pipes_pipe" "test" {
-  depends_on = [aws_iam_role_policy.source, aws_iam_role_policy.target]
-  name       = %[1]q
-  role_arn   = aws_iam_role.test.arn
-  source     = aws_sqs_queue.source.arn
-  target     = aws_sqs_queue.target.arn
+  depends_on = [aws_iam_role_policy.source]
+
+  name     = %[1]q
+  role_arn = aws_iam_role.test.arn
+  source   = aws_sqs_queue.source.arn
+  target   = aws_redshift_cluster.target.arn
 
   source_parameters {
-    filter_criteria {
-      filter {
-        pattern = jsonencode({
-          source = [%[2]q]
-        })
-      }
+    sqs_queue_parameters {
+      batch_size                         = 1
+      maximum_batching_window_in_seconds = 90
     }
   }
 
-  target_parameters {}
+  target_parameters {
+    redshift_data_parameters {
+      database       = "db1"
+      db_user        = "user1"
+      sqls           = ["SELECT * FROM table"]
+      statement_name = "SelectAll"
+    }
+  }
 }
-`, name, criteria1),
-	)
+`, rName))
 }
 
-func testAccPipeConfig_sourceParameters_filterCriteria2(name, criteria1, criteria2 string) string {
+func testAccPipeConfig_basicSQSSourceSageMakerTarget(rName string) string {
 	return acctest.ConfigCompose(
-		testAccPipeConfig_base,
-		testAccPipeConfig_base_sqsSource,
-		testAccPipeConfig_base_sqsTarget,
+		testAccPipeConfig_base(rName),
+		testAccPipeConfig_baseSQSSource(rName),
 		fmt.Sprintf(`
+# TODO Add aws_sagemaker_pipeline resource.
+
 resource "aws_pipes_pipe" "test" {
-  depends_on = [aws_iam_role_policy.source, aws_iam_role_policy.target]
-  name       = %[1]q
-  role_arn   = aws_iam_role.test.arn
-  source     = aws_sqs_queue.source.arn
-  target     = aws_sqs_queue.target.arn
+  depends_on = [aws_iam_role_policy.source]
 
-  source_parameters {
-    filter_criteria {
-      filter {
-        pattern = jsonencode({
-          source = [%[2]q]
-        })
+  name     = %[1]q
+  role_arn = aws_iam_role.test.arn
+  source   = aws_sqs_queue.source.arn
+  target   = aws_sagemaker_pipeline.target.arn
+
+  target_parameters {
+    sagemaker_pipeline_parameters {
+      pipeline_parameter {
+        name  = "p1"
+        value = "v1"
       }
 
-      filter {
-        pattern = jsonencode({
-          source = [%[3]q]
-        })
+      pipeline_parameter {
+        name  = "p2"
+        value = "v2"
       }
     }
   }
-
-  target_parameters {}
 }
-`, name, criteria1, criteria2),
-	)
+`, rName))
 }
 
-func testAccPipeConfig_sourceParameters_filterCriteria0(name string) string {
+func testAccPipeConfig_basicSQSSourceBatchJobTarget(rName string) string {
 	return acctest.ConfigCompose(
-		testAccPipeConfig_base,
-		testAccPipeConfig_base_sqsSource,
-		testAccPipeConfig_base_sqsTarget,
+		testAccPipeConfig_base(rName),
+		testAccPipeConfig_baseSQSSource(rName),
+		acctest.ConfigVPCWithSubnets(rName, 2),
 		fmt.Sprintf(`
-resource "aws_pipes_pipe" "test" {
-  depends_on = [aws_iam_role_policy.source, aws_iam_role_policy.target]
-  name       = %[1]q
-  role_arn   = aws_iam_role.test.arn
-  source     = aws_sqs_queue.source.arn
-  target     = aws_sqs_queue.target.arn
+resource "aws_iam_role" "target" {
+  name               = "%[1]s-target"
+  assume_role_policy = <<EOF
+{
+    "Version": "2012-10-17",
+    "Statement": [
+    {
+        "Action": "sts:AssumeRole",
+        "Effect": "Allow",
+        "Principal": {
+        "Service": "batch.${data.aws_partition.main.dns_suffix}"
+        }
+    }
+    ]
+}
+EOF
+}
 
-  source_parameters {
-    filter_criteria {}
-  }
+resource "aws_iam_role_policy_attachment" "target" {
+  role       = aws_iam_role.target.name
+  policy_arn = "arn:${data.aws_partition.main.partition}:iam::aws:policy/service-role/AWSBatchServiceRole"
+}
 
-  target_parameters {}
+resource "aws_iam_role" "ecs_instance_role" {
+  name = "%[1]s-ecs"
+
+  assume_role_policy = <<EOF
+{
+    "Version": "2012-10-17",
+    "Statement": [
+    {
+        "Action": "sts:AssumeRole",
+        "Effect": "Allow",
+        "Principal": {
+        "Service": "ec2.${data.aws_partition.main.dns_suffix}"
+        }
+    }
+    ]
 }
-`, name),
-	)
+EOF
 }
 
-func testAccPipeConfig_nameGenerated() string {
-	return acctest.ConfigCompose(
-		testAccPipeConfig_base,
-		testAccPipeConfig_base_sqsSource,
-		testAccPipeConfig_base_sqsTarget,
-		`
-resource "aws_pipes_pipe" "test" {
-  depends_on = [aws_iam_role_policy.source, aws_iam_role_policy.target]
-  role_arn   = aws_iam_role.test.arn
-  source     = aws_sqs_queue.source.arn
-  target     = aws_sqs_queue.target.arn
-
-  source_parameters {}
-  target_parameters {}
+resource "aws_iam_role_policy_attachment" "ecs_instance_role" {
+  role       = aws_iam_role.ecs_instance_role.name
+  policy_arn = "arn:${data.aws_partition.main.partition}:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role"
 }
-`,
-	)
+
+resource "aws_iam_instance_profile" "ecs_instance_role" {
+  name = aws_iam_role.ecs_instance_role.name
+  role = aws_iam_role_policy_attachment.ecs_instance_role.role
 }
 
-func testAccPipeConfig_namePrefix(namePrefix string) string {
-	return acctest.ConfigCompose(
-		testAccPipeConfig_base,
-		testAccPipeConfig_base_sqsSource,
-		testAccPipeConfig_base_sqsTarget,
-		fmt.Sprintf(`
-resource "aws_pipes_pipe" "test" {
-  depends_on  = [aws_iam_role_policy.source, aws_iam_role_policy.target]
-  name_prefix = %[1]q
-  role_arn    = aws_iam_role.test.arn
-  source      = aws_sqs_queue.source.arn
-  target      = aws_sqs_queue.target.arn
+resource "aws_security_group" "target" {
+  name   = %[1]q
+  vpc_id = aws_vpc.test.id
 
-  source_parameters {}
-  target_parameters {}
+  tags = {
+    Name = %[1]q
+  }
 }
-`, namePrefix),
-	)
+
+resource "aws_batch_compute_environment" "target" {
+  compute_environment_name = "%[1]s-target"
+  service_role             = aws_iam_role.target.arn
+  type                     = "MANAGED"
+
+  compute_resources {
+    instance_role      = aws_iam_instance_profile.ecs_instance_role.arn
+    instance_type      = ["c5", "m5", "r5"]
+    max_vcpus          = 1
+    min_vcpus          = 0
+    security_group_ids = [aws_security_group.target.id]
+    subnets            = aws_subnet.test[*].id
+    type               = "EC2"
+  }
+
+  depends_on = [aws_iam_role_policy_attachment.target]
 }
 
-func testAccPipeConfig_roleARN(name string) string {
-	return acctest.ConfigCompose(
-		testAccPipeConfig_base,
-		testAccPipeConfig_base_sqsSource,
-		testAccPipeConfig_base_sqsTarget,
-		fmt.Sprintf(`
-resource "aws_iam_role" "test2" {
-  assume_role_policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = {
-      Effect = "Allow"
-      Action = "sts:AssumeRole"
-      Principal = {
-        Service = "pipes.${data.aws_partition.main.dns_suffix}"
-      }
-      Condition = {
-        StringEquals = {
-          "aws:SourceAccount" = data.aws_caller_identity.main.account_id
-        }
-      }
-    }
-  })
+resource "aws_batch_job_queue" "target" {
+  compute_environments = [aws_batch_compute_environment.target.arn]
+  name                 = "%[1]s-target"
+  priority             = 1
+  state                = "ENABLED"
 }
 
-resource "aws_iam_role_policy" "source2" {
-  role = aws_iam_role.test2.id
-  policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [
-      {
-        Effect = "Allow"
-        Action = [
-          "sqs:DeleteMessage",
-          "sqs:GetQueueAttributes",
-          "sqs:ReceiveMessage",
-        ],
-        Resource = [
-          aws_sqs_queue.source.arn,
-        ]
-      },
-    ]
+resource "aws_batch_job_definition" "target" {
+  container_properties = jsonencode({
+    command = ["echo", "test"]
+    image   = "busybox"
+    memory  = 128
+    vcpus   = 1
   })
+  name = "%[1]s-target"
+  type = "container"
 }
 
 resource "aws_pipes_pipe" "test" {
-  depends_on = [aws_iam_role_policy.source2, aws_iam_role_policy.target]
-  name       = %[1]q
-  role_arn   = aws_iam_role.test2.arn
-  source     = aws_sqs_queue.source.arn
-  target     = aws_sqs_queue.target.arn
+  depends_on = [aws_iam_role_policy.source]
 
-  source_parameters {}
-  target_parameters {}
-}
-`, name),
-	)
-}
+  name     = %[1]q
+  role_arn = aws_iam_role.test.arn
+  source   = aws_sqs_queue.source.arn
+  target   = aws_batch_job_queue.target.arn
 
-func testAccPipeConfig_tags1(name, tag1Key, tag1Value string) string {
-	return acctest.ConfigCompose(
-		testAccPipeConfig_base,
-		testAccPipeConfig_base_sqsSource,
-		testAccPipeConfig_base_sqsTarget,
-		fmt.Sprintf(`
-resource "aws_pipes_pipe" "test" {
-  depends_on = [aws_iam_role_policy.source, aws_iam_role_policy.target]
-  name       = %[1]q
-  role_arn   = aws_iam_role.test.arn
-  source     = aws_sqs_queue.source.arn
-  target     = aws_sqs_queue.target.arn
+  target_parameters {
+    batch_job_parameters {
+      array_properties {
+        size = 512
+      }
 
-  source_parameters {}
-  target_parameters {}
+      container_overrides {
+        command = ["rm", "-fr", "/"]
 
-  tags = {
-    %[2]q = %[3]q
-  }
-}
-`, name, tag1Key, tag1Value),
-	)
-}
+        environment {
+          name  = "TMP"
+          value = "/tmp2"
+        }
 
-func testAccPipeConfig_tags2(name, tag1Key, tag1Value, tag2Key, tag2Value string) string {
-	return acctest.ConfigCompose(
-		testAccPipeConfig_base,
-		testAccPipeConfig_base_sqsSource,
-		testAccPipeConfig_base_sqsTarget,
-		fmt.Sprintf(`
-resource "aws_pipes_pipe" "test" {
-  depends_on = [aws_iam_role_policy.source, aws_iam_role_policy.target]
-  name       = %[1]q
-  role_arn   = aws_iam_role.test.arn
-  source     = aws_sqs_queue.source.arn
-  target     = aws_sqs_queue.target.arn
+        resource_requirement {
+          type  = "GPU"
+          value = "1"
+        }
+      }
 
-  source_parameters {}
-  target_parameters {}
+      job_definition = aws_batch_job_definition.target.arn
+      job_name       = "testing"
 
-  tags = {
-    %[2]q = %[3]q
-    %[4]q = %[5]q
+      parameters = {
+        "Key1" = "Value1"
+      }
+    }
   }
 }
-`, name, tag1Key, tag1Value, tag2Key, tag2Value),
-	)
+`, rName))
 }
 
-func testAccPipeConfig_target(name string) string {
+func testAccPipeConfig_basicSQSSourceECSTaskTarget(rName string) string {
 	return acctest.ConfigCompose(
-		testAccPipeConfig_base,
-		testAccPipeConfig_base_sqsSource,
-		testAccPipeConfig_base_sqsTarget,
+		testAccPipeConfig_base(rName),
+		testAccPipeConfig_baseSQSSource(rName),
+		acctest.ConfigVPCWithSubnets(rName, 1),
 		fmt.Sprintf(`
-resource "aws_iam_role_policy" "target2" {
+resource "aws_iam_role_policy" "target" {
   role = aws_iam_role.test.id
-  policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [
-      {
-        Effect = "Allow"
-        Action = [
-          "sqs:SendMessage",
-        ],
-        Resource = [
-          aws_sqs_queue.target2.arn,
-        ]
-      },
-    ]
-  })
+  name = "%[1]s-target"
+
+  policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [{
+    "Effect": "Allow",
+    "Action": ["ecs:RunTask"],
+    "Resource": ["*"]
+  }]
+}
+EOF
 }
 
-resource "aws_sqs_queue" "target2" {}
-
-resource "aws_pipes_pipe" "test" {
-  depends_on = [aws_iam_role_policy.source, aws_iam_role_policy.target2]
-  name       = %[1]q
-  role_arn   = aws_iam_role.test.arn
-  source     = aws_sqs_queue.source.arn
-  target     = aws_sqs_queue.target2.arn
+resource "aws_ecs_cluster" "target" {
+  name = "%[1]s-target"
+}
 
-  source_parameters {}
-  target_parameters {}
+resource "aws_ecs_cluster_capacity_providers" "target" {
+  cluster_name       = aws_ecs_cluster.target.name
+  capacity_providers = ["FARGATE"]
 }
-`, name),
-	)
+
+resource "aws_ecs_task_definition" "target" {
+  family                   = "%[1]s-target"
+  cpu                      = 256
+  memory                   = 512
+  requires_compatibilities = ["FARGATE"]
+  network_mode             = "awsvpc"
+
+  container_definitions = jsonencode([
+    {
+      name      = "sleep"
+      image     = "busybox"
+      cpu       = 10
+      command   = ["sleep", "300"]
+      memory    = 10
+      essential = true
+      portMappings = [
+        {
+          protocol      = "tcp"
+          containerPort = 8000
+        }
+      ]
+    }
+  ])
+
+  depends_on = [aws_ecs_cluster_capacity_providers.target]
 }
 
-func testAccPipeConfig_targetParameters_inputTemplate(name, template string) string {
-	return acctest.ConfigCompose(
-		testAccPipeConfig_base,
-		testAccPipeConfig_base_sqsSource,
-		testAccPipeConfig_base_sqsTarget,
-		fmt.Sprintf(`
 resource "aws_pipes_pipe" "test" {
   depends_on = [aws_iam_role_policy.source, aws_iam_role_policy.target]
-  name       = %[1]q
-  role_arn   = aws_iam_role.test.arn
-  source     = aws_sqs_queue.source.arn
-  target     = aws_sqs_queue.target.arn
 
-  source_parameters {}
+  name     = %[1]q
+  role_arn = aws_iam_role.test.arn
+  source   = aws_sqs_queue.source.arn
+  target   = aws_ecs_cluster.target.id
 
   target_parameters {
-    input_template = %[2]q
+    ecs_task_parameters {
+      task_definition_arn = aws_ecs_task_definition.target.arn
+
+      enable_ecs_managed_tags = true
+      group                   = "g1"
+      launch_type             = "FARGATE"
+
+      network_configuration {
+        aws_vpc_configuration {
+          subnets = aws_subnet.test[*].id
+        }
+      }
+
+      overrides {
+        container_override {
+          environment {
+            name  = "TMP"
+            value = "/tmp2"
+          }
+
+          memory_reservation = 1024
+          name               = "first"
+
+          resource_requirement {
+            type  = "GPU"
+            value = 2
+          }
+        }
+
+        ephemeral_storage {
+          size_in_gib = 32
+        }
+      }
+
+      placement_strategy {
+        field = "cpu"
+        type  = "binpack"
+      }
+
+      propagate_tags = "TASK_DEFINITION"
+      reference_id   = "refid"
+
+      tags = {
+        Name = %[1]q
+      }
+    }
   }
 }
-`, name, template),
-	)
+`, rName))
 }
diff --git a/internal/service/pipes/service_package_gen.go b/internal/service/pipes/service_package_gen.go
index e4857ee5701..b5a63885af5 100644
--- a/internal/service/pipes/service_package_gen.go
+++ b/internal/service/pipes/service_package_gen.go
@@ -7,6 +7,7 @@ import (
 
 	aws_sdkv2 "github.com/aws/aws-sdk-go-v2/aws"
 	pipes_sdkv2 "github.com/aws/aws-sdk-go-v2/service/pipes"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -28,7 +29,7 @@ func (p *servicePackage) SDKDataSources(ctx context.Context) []*types.ServicePac
 func (p *servicePackage) SDKResources(ctx context.Context) []*types.ServicePackageSDKResource {
 	return []*types.ServicePackageSDKResource{
 		{
-			Factory:  ResourcePipe,
+			Factory:  resourcePipe,
 			TypeName: "aws_pipes_pipe",
 			Name:     "Pipe",
 			Tags: &types.ServicePackageResourceTags{
@@ -48,9 +49,11 @@ func (p *servicePackage) NewClient(ctx context.Context, config map[string]any) (
 
 	return pipes_sdkv2.NewFromConfig(cfg, func(o *pipes_sdkv2.Options) {
 		if endpoint := config["endpoint"].(string); endpoint != "" {
-			o.EndpointResolver = pipes_sdkv2.EndpointResolverFromURL(endpoint)
+			o.BaseEndpoint = aws_sdkv2.String(endpoint)
 		}
 	}), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/pipes/source_parameters.go b/internal/service/pipes/source_parameters.go
new file mode 100644
index 00000000000..b20c0ec540c
--- /dev/null
+++ b/internal/service/pipes/source_parameters.go
@@ -0,0 +1,1681 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package pipes
+
+import (
+	"time"
+
+	"github.com/YakDriver/regexache"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/pipes/types"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
+	"github.com/hashicorp/terraform-provider-aws/internal/enum"
+	"github.com/hashicorp/terraform-provider-aws/internal/flex"
+	"github.com/hashicorp/terraform-provider-aws/internal/verify"
+)
+
+func sourceParametersSchema() *schema.Schema {
+	verifySecretsManagerARN := validation.StringMatch(regexache.MustCompile(`^(^arn:aws([a-z]|\-)*:secretsmanager:([a-z]{2}((-gov)|(-iso(b?)))?-[a-z]+-\d{1}):(\d{12}):secret:.+)$`), "")
+
+	return &schema.Schema{
+		Type:     schema.TypeList,
+		Optional: true,
+		Computed: true,
+		MaxItems: 1,
+		Elem: &schema.Resource{
+			Schema: map[string]*schema.Schema{
+				"activemq_broker_parameters": {
+					Type:     schema.TypeList,
+					Optional: true,
+					Computed: true,
+					MaxItems: 1,
+					ConflictsWith: []string{
+						"source_parameters.0.dynamodb_stream_parameters",
+						"source_parameters.0.kinesis_stream_parameters",
+						"source_parameters.0.managed_streaming_kafka_parameters",
+						"source_parameters.0.rabbitmq_broker_parameters",
+						"source_parameters.0.self_managed_kafka_parameters",
+						"source_parameters.0.sqs_queue_parameters",
+					},
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"batch_size": {
+								Type:         schema.TypeInt,
+								Optional:     true,
+								Computed:     true,
+								ValidateFunc: validation.IntBetween(1, 10000),
+							},
+							"credentials": {
+								Type:     schema.TypeList,
+								Required: true,
+								MaxItems: 1,
+								Elem: &schema.Resource{
+									Schema: map[string]*schema.Schema{
+										"basic_auth": {
+											Type:         schema.TypeString,
+											Required:     true,
+											ValidateFunc: verifySecretsManagerARN,
+										},
+									},
+								},
+							},
+							"maximum_batching_window_in_seconds": {
+								Type:         schema.TypeInt,
+								Optional:     true,
+								Computed:     true,
+								ValidateFunc: validation.IntBetween(0, 300),
+							},
+							"queue_name": {
+								Type:     schema.TypeString,
+								Required: true,
+								ForceNew: true,
+								ValidateFunc: validation.All(
+									validation.StringLenBetween(1, 1000),
+									validation.StringMatch(regexache.MustCompile(`^[\s\S]*$`), ""),
+								),
+							},
+						},
+					},
+				},
+				"dynamodb_stream_parameters": {
+					Type:     schema.TypeList,
+					Optional: true,
+					Computed: true,
+					MaxItems: 1,
+					ConflictsWith: []string{
+						"source_parameters.0.activemq_broker_parameters",
+						"source_parameters.0.kinesis_stream_parameters",
+						"source_parameters.0.managed_streaming_kafka_parameters",
+						"source_parameters.0.rabbitmq_broker_parameters",
+						"source_parameters.0.self_managed_kafka_parameters",
+						"source_parameters.0.sqs_queue_parameters",
+					},
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"batch_size": {
+								Type:         schema.TypeInt,
+								Optional:     true,
+								Computed:     true,
+								ValidateFunc: validation.IntBetween(1, 10000),
+							},
+							"dead_letter_config": {
+								Type:     schema.TypeList,
+								Optional: true,
+								MaxItems: 1,
+								Elem: &schema.Resource{
+									Schema: map[string]*schema.Schema{
+										"arn": {
+											Type:         schema.TypeString,
+											Optional:     true,
+											ValidateFunc: verify.ValidARN,
+										},
+									},
+								},
+							},
+							"maximum_batching_window_in_seconds": {
+								Type:         schema.TypeInt,
+								Optional:     true,
+								Computed:     true,
+								ValidateFunc: validation.IntBetween(0, 300),
+							},
+							"maximum_record_age_in_seconds": {
+								Type:     schema.TypeInt,
+								Optional: true,
+								Computed: true,
+								ValidateFunc: validation.Any(
+									validation.IntInSlice([]int{-1}),
+									validation.IntBetween(60, 604_800),
+								),
+							},
+							"maximum_retry_attempts": {
+								Type:         schema.TypeInt,
+								Optional:     true,
+								ValidateFunc: validation.IntBetween(-1, 10_000),
+							},
+							"on_partial_batch_item_failure": {
+								Type:             schema.TypeString,
+								Optional:         true,
+								ValidateDiagFunc: enum.Validate[types.OnPartialBatchItemFailureStreams](),
+							},
+							"parallelization_factor": {
+								Type:         schema.TypeInt,
+								Optional:     true,
+								Computed:     true,
+								ValidateFunc: validation.IntBetween(1, 10),
+							},
+							"starting_position": {
+								Type:             schema.TypeString,
+								Required:         true,
+								ForceNew:         true,
+								ValidateDiagFunc: enum.Validate[types.DynamoDBStreamStartPosition](),
+							},
+						},
+					},
+				},
+				"filter_criteria": {
+					Type:             schema.TypeList,
+					Optional:         true,
+					MaxItems:         1,
+					DiffSuppressFunc: suppressEmptyConfigurationBlock("source_parameters.0.filter_criteria"),
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"filter": {
+								Type:     schema.TypeList,
+								Optional: true,
+								MaxItems: 5,
+								Elem: &schema.Resource{
+									Schema: map[string]*schema.Schema{
+										"pattern": {
+											Type:         schema.TypeString,
+											Required:     true,
+											ValidateFunc: validation.StringLenBetween(1, 4096),
+										},
+									},
+								},
+							},
+						},
+					},
+				},
+				"kinesis_stream_parameters": {
+					Type:     schema.TypeList,
+					Optional: true,
+					Computed: true,
+					MaxItems: 1,
+					ConflictsWith: []string{
+						"source_parameters.0.activemq_broker_parameters",
+						"source_parameters.0.dynamodb_stream_parameters",
+						"source_parameters.0.managed_streaming_kafka_parameters",
+						"source_parameters.0.rabbitmq_broker_parameters",
+						"source_parameters.0.self_managed_kafka_parameters",
+						"source_parameters.0.sqs_queue_parameters",
+					},
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"batch_size": {
+								Type:         schema.TypeInt,
+								Optional:     true,
+								Computed:     true,
+								ValidateFunc: validation.IntBetween(1, 10000),
+							},
+							"dead_letter_config": {
+								Type:     schema.TypeList,
+								Optional: true,
+								MaxItems: 1,
+								Elem: &schema.Resource{
+									Schema: map[string]*schema.Schema{
+										"arn": {
+											Type:         schema.TypeString,
+											Optional:     true,
+											ValidateFunc: verify.ValidARN,
+										},
+									},
+								},
+							},
+							"maximum_batching_window_in_seconds": {
+								Type:         schema.TypeInt,
+								Optional:     true,
+								Computed:     true,
+								ValidateFunc: validation.IntBetween(0, 300),
+							},
+							"maximum_record_age_in_seconds": {
+								Type:     schema.TypeInt,
+								Optional: true,
+								Computed: true,
+								ValidateFunc: validation.Any(
+									validation.IntInSlice([]int{-1}),
+									validation.IntBetween(60, 604_800),
+								),
+							},
+							"maximum_retry_attempts": {
+								Type:         schema.TypeInt,
+								Optional:     true,
+								ValidateFunc: validation.IntBetween(-1, 10_000),
+							},
+							"on_partial_batch_item_failure": {
+								Type:             schema.TypeString,
+								Optional:         true,
+								ValidateDiagFunc: enum.Validate[types.OnPartialBatchItemFailureStreams](),
+							},
+							"parallelization_factor": {
+								Type:         schema.TypeInt,
+								Optional:     true,
+								Computed:     true,
+								ValidateFunc: validation.IntBetween(1, 10),
+							},
+							"starting_position": {
+								Type:             schema.TypeString,
+								Required:         true,
+								ForceNew:         true,
+								ValidateDiagFunc: enum.Validate[types.KinesisStreamStartPosition](),
+							},
+							"starting_position_timestamp": {
+								Type:         schema.TypeString,
+								Optional:     true,
+								ForceNew:     true,
+								ValidateFunc: validation.IsRFC3339Time,
+							},
+						},
+					},
+				},
+				"managed_streaming_kafka_parameters": {
+					Type:     schema.TypeList,
+					Optional: true,
+					Computed: true,
+					MaxItems: 1,
+					ConflictsWith: []string{
+						"source_parameters.0.activemq_broker_parameters",
+						"source_parameters.0.dynamodb_stream_parameters",
+						"source_parameters.0.kinesis_stream_parameters",
+						"source_parameters.0.rabbitmq_broker_parameters",
+						"source_parameters.0.self_managed_kafka_parameters",
+						"source_parameters.0.sqs_queue_parameters",
+					},
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"batch_size": {
+								Type:         schema.TypeInt,
+								Optional:     true,
+								Computed:     true,
+								ValidateFunc: validation.IntBetween(1, 10000),
+							},
+							"consumer_group_id": {
+								Type:     schema.TypeString,
+								Optional: true,
+								ValidateFunc: validation.All(
+									validation.StringLenBetween(1, 200),
+									validation.StringMatch(regexache.MustCompile(`^[^.]([0-9A-Za-z_.-]+)$`), ""),
+								),
+							},
+							"credentials": {
+								Type:     schema.TypeList,
+								Optional: true,
+								MaxItems: 1,
+								Elem: &schema.Resource{
+									Schema: map[string]*schema.Schema{
+										"client_certificate_tls_auth": {
+											Type:         schema.TypeString,
+											Optional:     true,
+											ValidateFunc: verifySecretsManagerARN,
+										},
+										"sasl_scram_512_auth": {
+											Type:         schema.TypeString,
+											Optional:     true,
+											ValidateFunc: verifySecretsManagerARN,
+										},
+									},
+								},
+							},
+							"maximum_batching_window_in_seconds": {
+								Type:         schema.TypeInt,
+								Optional:     true,
+								Computed:     true,
+								ValidateFunc: validation.IntBetween(0, 300),
+							},
+							"starting_position": {
+								Type:             schema.TypeString,
+								Optional:         true,
+								ForceNew:         true,
+								ValidateDiagFunc: enum.Validate[types.MSKStartPosition](),
+							},
+							"topic_name": {
+								Type:     schema.TypeString,
+								Required: true,
+								ForceNew: true,
+								ValidateFunc: validation.All(
+									validation.StringLenBetween(1, 249),
+									validation.StringMatch(regexache.MustCompile(`^[^.]([0-9A-Za-z_.-]+)$`), ""),
+								),
+							},
+						},
+					},
+				},
+				"rabbitmq_broker_parameters": {
+					Type:     schema.TypeList,
+					Optional: true,
+					Computed: true,
+					MaxItems: 1,
+					ConflictsWith: []string{
+						"source_parameters.0.activemq_broker_parameters",
+						"source_parameters.0.dynamodb_stream_parameters",
+						"source_parameters.0.kinesis_stream_parameters",
+						"source_parameters.0.managed_streaming_kafka_parameters",
+						"source_parameters.0.self_managed_kafka_parameters",
+						"source_parameters.0.sqs_queue_parameters",
+					},
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"batch_size": {
+								Type:         schema.TypeInt,
+								Optional:     true,
+								Computed:     true,
+								ValidateFunc: validation.IntBetween(1, 10000),
+							},
+							"credentials": {
+								Type:     schema.TypeList,
+								Required: true,
+								MaxItems: 1,
+								Elem: &schema.Resource{
+									Schema: map[string]*schema.Schema{
+										"basic_auth": {
+											Type:         schema.TypeString,
+											Required:     true,
+											ValidateFunc: verifySecretsManagerARN,
+										},
+									},
+								},
+							},
+							"maximum_batching_window_in_seconds": {
+								Type:         schema.TypeInt,
+								Optional:     true,
+								Computed:     true,
+								ValidateFunc: validation.IntBetween(0, 300),
+							},
+							"queue_name": {
+								Type:     schema.TypeString,
+								Required: true,
+								ForceNew: true,
+								ValidateFunc: validation.All(
+									validation.StringLenBetween(1, 1000),
+									validation.StringMatch(regexache.MustCompile(`^[\s\S]*$`), ""),
+								),
+							},
+							"virtual_host": {
+								Type:     schema.TypeString,
+								Optional: true,
+								ForceNew: true,
+								ValidateFunc: validation.All(
+									validation.StringLenBetween(1, 200),
+									validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_\/*:+=.@-]*$`), ""),
+								),
+							},
+						},
+					},
+				},
+				"self_managed_kafka_parameters": {
+					Type:     schema.TypeList,
+					Optional: true,
+					Computed: true,
+					MaxItems: 1,
+					ConflictsWith: []string{
+						"source_parameters.0.activemq_broker_parameters",
+						"source_parameters.0.dynamodb_stream_parameters",
+						"source_parameters.0.kinesis_stream_parameters",
+						"source_parameters.0.managed_streaming_kafka_parameters",
+						"source_parameters.0.rabbitmq_broker_parameters",
+						"source_parameters.0.sqs_queue_parameters",
+					},
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"additional_bootstrap_servers": {
+								Type:     schema.TypeSet,
+								Optional: true,
+								ForceNew: true,
+								MaxItems: 2,
+								Elem: &schema.Schema{
+									Type: schema.TypeString,
+									ValidateFunc: validation.All(
+										validation.StringLenBetween(1, 300),
+										validation.StringMatch(regexache.MustCompile(`^(([0-9A-Za-z]|[0-9A-Za-z][0-9A-Za-z-]*[0-9A-Za-z])\.)*([0-9A-Za-z]|[0-9A-Za-z][0-9A-Za-z-]*[0-9A-Za-z]):[0-9]{1,5}$`), ""),
+									),
+								},
+							},
+							"batch_size": {
+								Type:         schema.TypeInt,
+								Optional:     true,
+								Computed:     true,
+								ValidateFunc: validation.IntBetween(1, 10000),
+							},
+							"consumer_group_id": {
+								Type:     schema.TypeString,
+								Optional: true,
+								ForceNew: true,
+								ValidateFunc: validation.All(
+									validation.StringLenBetween(1, 200),
+									validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_\/*:+=.@-]*$`), ""),
+								),
+							},
+							"credentials": {
+								Type:     schema.TypeList,
+								Optional: true,
+								MaxItems: 1,
+								Elem: &schema.Resource{
+									Schema: map[string]*schema.Schema{
+										"basic_auth": {
+											Type:         schema.TypeString,
+											Required:     true,
+											ValidateFunc: verifySecretsManagerARN,
+										},
+										"client_certificate_tls_auth": {
+											Type:         schema.TypeString,
+											Optional:     true,
+											ValidateFunc: verifySecretsManagerARN,
+										},
+										"sasl_scram_256_auth": {
+											Type:         schema.TypeString,
+											Optional:     true,
+											ValidateFunc: verifySecretsManagerARN,
+										},
+										"sasl_scram_512_auth": {
+											Type:         schema.TypeString,
+											Optional:     true,
+											ValidateFunc: verifySecretsManagerARN,
+										},
+									},
+								},
+							},
+							"maximum_batching_window_in_seconds": {
+								Type:         schema.TypeInt,
+								Optional:     true,
+								Computed:     true,
+								ValidateFunc: validation.IntBetween(0, 300),
+							},
+							"server_root_ca_certificate": {
+								Type:         schema.TypeString,
+								Optional:     true,
+								ValidateFunc: verify.ValidARN,
+							},
+							"starting_position": {
+								Type:             schema.TypeString,
+								Optional:         true,
+								ForceNew:         true,
+								ValidateDiagFunc: enum.Validate[types.SelfManagedKafkaStartPosition](),
+							},
+							"topic_name": {
+								Type:     schema.TypeString,
+								Required: true,
+								ForceNew: true,
+								ValidateFunc: validation.All(
+									validation.StringLenBetween(1, 249),
+									validation.StringMatch(regexache.MustCompile(`^[^.]([0-9A-Za-z_.-]+)$`), ""),
+								),
+							},
+							"vpc": {
+								Type:     schema.TypeList,
+								Optional: true,
+								MaxItems: 1,
+								Elem: &schema.Resource{
+									Schema: map[string]*schema.Schema{
+										"security_groups": {
+											Type:     schema.TypeSet,
+											Optional: true,
+											MaxItems: 5,
+											Elem: &schema.Schema{
+												Type: schema.TypeString,
+												ValidateFunc: validation.All(
+													validation.StringLenBetween(1, 1024),
+													validation.StringMatch(regexache.MustCompile(`^sg-[0-9A-Za-z]*$`), ""),
+												),
+											},
+										},
+										"subnets": {
+											Type:     schema.TypeSet,
+											Optional: true,
+											MaxItems: 16,
+											Elem: &schema.Schema{
+												Type: schema.TypeString,
+												ValidateFunc: validation.All(
+													validation.StringLenBetween(1, 1024),
+													validation.StringMatch(regexache.MustCompile(`^subnet-[0-9a-z]*$`), ""),
+												),
+											},
+										},
+									},
+								},
+							},
+						},
+					},
+				},
+				"sqs_queue_parameters": {
+					Type:     schema.TypeList,
+					Optional: true,
+					Computed: true,
+					MaxItems: 1,
+					ConflictsWith: []string{
+						"source_parameters.0.activemq_broker_parameters",
+						"source_parameters.0.dynamodb_stream_parameters",
+						"source_parameters.0.kinesis_stream_parameters",
+						"source_parameters.0.managed_streaming_kafka_parameters",
+						"source_parameters.0.rabbitmq_broker_parameters",
+						"source_parameters.0.self_managed_kafka_parameters",
+					},
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"batch_size": {
+								Type:         schema.TypeInt,
+								Optional:     true,
+								Computed:     true,
+								ValidateFunc: validation.IntBetween(1, 10000),
+							},
+							"maximum_batching_window_in_seconds": {
+								Type:         schema.TypeInt,
+								Optional:     true,
+								Computed:     true,
+								ValidateFunc: validation.IntBetween(0, 300),
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+}
+
+func expandPipeSourceParameters(tfMap map[string]interface{}) *types.PipeSourceParameters {
+	if tfMap == nil {
+		return nil
+	}
+
+	apiObject := &types.PipeSourceParameters{}
+
+	if v, ok := tfMap["activemq_broker_parameters"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
+		apiObject.ActiveMQBrokerParameters = expandPipeSourceActiveMQBrokerParameters(v[0].(map[string]interface{}))
+	}
+
+	if v, ok := tfMap["dynamodb_stream_parameters"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
+		apiObject.DynamoDBStreamParameters = expandPipeSourceDynamoDBStreamParameters(v[0].(map[string]interface{}))
+	}
+
+	if v, ok := tfMap["filter_criteria"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
+		apiObject.FilterCriteria = expandFilterCriteria(v[0].(map[string]interface{}))
+	}
+
+	if v, ok := tfMap["kinesis_stream_parameters"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
+		apiObject.KinesisStreamParameters = expandPipeSourceKinesisStreamParameters(v[0].(map[string]interface{}))
+	}
+
+	if v, ok := tfMap["managed_streaming_kafka_parameters"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
+		apiObject.ManagedStreamingKafkaParameters = expandPipeSourceManagedStreamingKafkaParameters(v[0].(map[string]interface{}))
+	}
+
+	if v, ok := tfMap["rabbitmq_broker_parameters"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
+		apiObject.RabbitMQBrokerParameters = expandPipeSourceRabbitMQBrokerParameters(v[0].(map[string]interface{}))
+	}
+
+	if v, ok := tfMap["self_managed_kafka_parameters"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
+		apiObject.SelfManagedKafkaParameters = expandPipeSourceSelfManagedKafkaParameters(v[0].(map[string]interface{}))
+	}
+
+	if v, ok := tfMap["sqs_queue_parameters"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
+		apiObject.SqsQueueParameters = expandPipeSourceSQSQueueParameters(v[0].(map[string]interface{}))
+	}
+
+	return apiObject
+}
+
+func expandUpdatePipeSourceParameters(tfMap map[string]interface{}) *types.UpdatePipeSourceParameters {
+	if tfMap == nil {
+		return nil
+	}
+
+	apiObject := &types.UpdatePipeSourceParameters{}
+
+	if v, ok := tfMap["activemq_broker_parameters"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
+		apiObject.ActiveMQBrokerParameters = expandUpdatePipeSourceActiveMQBrokerParameters(v[0].(map[string]interface{}))
+	}
+
+	if v, ok := tfMap["dynamodb_stream_parameters"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
+		apiObject.DynamoDBStreamParameters = expandUpdatePipeSourceDynamoDBStreamParameters(v[0].(map[string]interface{}))
+	}
+
+	if v, ok := tfMap["filter_criteria"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
+		apiObject.FilterCriteria = expandFilterCriteria(v[0].(map[string]interface{}))
+	} else {
+		apiObject.FilterCriteria = &types.FilterCriteria{}
+	}
+
+	if v, ok := tfMap["kinesis_stream_parameters"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
+		apiObject.KinesisStreamParameters = expandUpdatePipeSourceKinesisStreamParameters(v[0].(map[string]interface{}))
+	}
+
+	if v, ok := tfMap["managed_streaming_kafka_parameters"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
+		apiObject.ManagedStreamingKafkaParameters = expandUpdatePipeSourceManagedStreamingKafkaParameters(v[0].(map[string]interface{}))
+	}
+
+	if v, ok := tfMap["rabbitmq_broker_parameters"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
+		apiObject.RabbitMQBrokerParameters = expandUpdatePipeSourceRabbitMQBrokerParameters(v[0].(map[string]interface{}))
+	}
+
+	if v, ok := tfMap["self_managed_kafka_parameters"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
+		apiObject.SelfManagedKafkaParameters = expandUpdatePipeSourceSelfManagedKafkaParameters(v[0].(map[string]interface{}))
+	}
+
+	if v, ok := tfMap["sqs_queue_parameters"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
+		apiObject.SqsQueueParameters = expandUpdatePipeSourceSQSQueueParameters(v[0].(map[string]interface{}))
+	}
+
+	return apiObject
+}
+
+func expandFilterCriteria(tfMap map[string]interface{}) *types.FilterCriteria {
+	if tfMap == nil {
+		return nil
+	}
+
+	apiObject := &types.FilterCriteria{}
+
+	if v, ok := tfMap["filter"].([]interface{}); ok && len(v) > 0 {
+		apiObject.Filters = expandFilters(v)
+	}
+
+	return apiObject
+}
+
+func expandFilter(tfMap map[string]interface{}) *types.Filter {
+	if tfMap == nil {
+		return nil
+	}
+
+	apiObject := &types.Filter{}
+
+	if v, ok := tfMap["pattern"].(string); ok && v != "" {
+		apiObject.Pattern = aws.String(v)
+	}
+
+	return apiObject
+}
+
+func expandFilters(tfList []interface{}) []types.Filter {
+	if len(tfList) == 0 {
+		return nil
+	}
+
+	var apiObjects []types.Filter
+
+	for _, tfMapRaw := range tfList {
+		tfMap, ok := tfMapRaw.(map[string]interface{})
+
+		if !ok {
+			continue
+		}
+
+		apiObject := expandFilter(tfMap)
+
+		if apiObject == nil || apiObject.Pattern == nil {
+			continue
+		}
+
+		apiObjects = append(apiObjects, *apiObject)
+	}
+
+	return apiObjects
+}
+
+func expandPipeSourceActiveMQBrokerParameters(tfMap map[string]interface{}) *types.PipeSourceActiveMQBrokerParameters {
+	if tfMap == nil {
+		return nil
+	}
+
+	apiObject := &types.PipeSourceActiveMQBrokerParameters{}
+
+	if v, ok := tfMap["batch_size"].(int); ok && v != 0 {
+		apiObject.BatchSize = aws.Int32(int32(v))
+	}
+
+	if v, ok := tfMap["credentials"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
+		apiObject.Credentials = expandMQBrokerAccessCredentials(v[0].(map[string]interface{}))
+	}
+
+	if v, ok := tfMap["maximum_batching_window_in_seconds"].(int); ok && v != 0 {
+		apiObject.MaximumBatchingWindowInSeconds = aws.Int32(int32(v))
+	}
+
+	if v, ok := tfMap["queue_name"].(string); ok && v != "" {
+		apiObject.QueueName = aws.String(v)
+	}
+
+	return apiObject
+}
+
+func expandUpdatePipeSourceActiveMQBrokerParameters(tfMap map[string]interface{}) *types.UpdatePipeSourceActiveMQBrokerParameters {
+	if tfMap == nil {
+		return nil
+	}
+
+	apiObject := &types.UpdatePipeSourceActiveMQBrokerParameters{}
+
+	if v, ok := tfMap["batch_size"].(int); ok {
+		apiObject.BatchSize = aws.Int32(int32(v))
+	}
+
+	if v, ok := tfMap["credentials"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
+		apiObject.Credentials = expandMQBrokerAccessCredentials(v[0].(map[string]interface{}))
+	}
+
+	if v, ok := tfMap["maximum_batching_window_in_seconds"].(int); ok {
+		apiObject.MaximumBatchingWindowInSeconds = aws.Int32(int32(v))
+	}
+
+	return apiObject
+}
+
+func expandMQBrokerAccessCredentials(tfMap map[string]interface{}) types.MQBrokerAccessCredentials {
+	if tfMap == nil {
+		return nil
+	}
+
+	if v, ok := tfMap["basic_auth"].(string); ok && v != "" {
+		apiObject := &types.MQBrokerAccessCredentialsMemberBasicAuth{
+			Value: v,
+		}
+
+		return apiObject
+	}
+
+	return nil
+}
+
+func expandPipeSourceDynamoDBStreamParameters(tfMap map[string]interface{}) *types.PipeSourceDynamoDBStreamParameters {
+	if tfMap == nil {
+		return nil
+	}
+
+	apiObject := &types.PipeSourceDynamoDBStreamParameters{}
+
+	if v, ok := tfMap["batch_size"].(int); ok && v != 0 {
+		apiObject.BatchSize = aws.Int32(int32(v))
+	}
+
+	if v, ok := tfMap["dead_letter_config"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
+		apiObject.DeadLetterConfig = expandDeadLetterConfig(v[0].(map[string]interface{}))
+	}
+
+	if v, ok := tfMap["maximum_batching_window_in_seconds"].(int); ok && v != 0 {
+		apiObject.MaximumBatchingWindowInSeconds = aws.Int32(int32(v))
+	}
+
+	if v, ok := tfMap["maximum_record_age_in_seconds"].(int); ok && v != 0 {
+		apiObject.MaximumRecordAgeInSeconds = aws.Int32(int32(v))
+	}
+
+	if v, ok := tfMap["maximum_retry_attempts"].(int); ok && v != 0 {
+		apiObject.MaximumRetryAttempts = aws.Int32(int32(v))
+	}
+
+	if v, ok := tfMap["on_partial_batch_item_failure"].(string); ok && v != "" {
+		apiObject.OnPartialBatchItemFailure = types.OnPartialBatchItemFailureStreams(v)
+	}
+
+	if v, ok := tfMap["parallelization_factor"].(int); ok && v != 0 {
+		apiObject.ParallelizationFactor = aws.Int32(int32(v))
+	}
+
+	if v, ok := tfMap["starting_position"].(string); ok && v != "" {
+		apiObject.StartingPosition = types.DynamoDBStreamStartPosition(v)
+	}
+
+	return apiObject
+}
+
+func expandUpdatePipeSourceDynamoDBStreamParameters(tfMap map[string]interface{}) *types.UpdatePipeSourceDynamoDBStreamParameters {
+	if tfMap == nil {
+		return nil
+	}
+
+	apiObject := &types.UpdatePipeSourceDynamoDBStreamParameters{}
+
+	if v, ok := tfMap["batch_size"].(int); ok {
+		apiObject.BatchSize = aws.Int32(int32(v))
+	}
+
+	if v, ok := tfMap["dead_letter_config"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
+		apiObject.DeadLetterConfig = expandDeadLetterConfig(v[0].(map[string]interface{}))
+	} else {
+		apiObject.DeadLetterConfig = &types.DeadLetterConfig{}
+	}
+
+	if v, ok := tfMap["maximum_batching_window_in_seconds"].(int); ok {
+		apiObject.MaximumBatchingWindowInSeconds = aws.Int32(int32(v))
+	}
+
+	if v, ok := tfMap["maximum_record_age_in_seconds"].(int); ok {
+		apiObject.MaximumRecordAgeInSeconds = aws.Int32(int32(v))
+	}
+
+	if v, ok := tfMap["maximum_retry_attempts"].(int); ok {
+		apiObject.MaximumRetryAttempts = aws.Int32(int32(v))
+	}
+
+	if v, ok := tfMap["on_partial_batch_item_failure"].(string); ok {
+		apiObject.OnPartialBatchItemFailure = types.OnPartialBatchItemFailureStreams(v)
+	}
+
+	if v, ok := tfMap["parallelization_factor"].(int); ok {
+		apiObject.ParallelizationFactor = aws.Int32(int32(v))
+	}
+
+	return apiObject
+}
+
+func expandDeadLetterConfig(tfMap map[string]interface{}) *types.DeadLetterConfig {
+	if tfMap == nil {
+		return nil
+	}
+
+	apiObject := &types.DeadLetterConfig{}
+
+	if v, ok := tfMap["arn"].(string); ok && v != "" {
+		apiObject.Arn = aws.String(v)
+	}
+
+	return apiObject
+}
+
+func expandPipeSourceKinesisStreamParameters(tfMap map[string]interface{}) *types.PipeSourceKinesisStreamParameters {
+	if tfMap == nil {
+		return nil
+	}
+
+	apiObject := &types.PipeSourceKinesisStreamParameters{}
+
+	if v, ok := tfMap["batch_size"].(int); ok && v != 0 {
+		apiObject.BatchSize = aws.Int32(int32(v))
+	}
+
+	if v, ok := tfMap["dead_letter_config"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
+		apiObject.DeadLetterConfig = expandDeadLetterConfig(v[0].(map[string]interface{}))
+	}
+
+	if v, ok := tfMap["maximum_batching_window_in_seconds"].(int); ok && v != 0 {
+		apiObject.MaximumBatchingWindowInSeconds = aws.Int32(int32(v))
+	}
+
+	if v, ok := tfMap["maximum_record_age_in_seconds"].(int); ok && v != 0 {
+		apiObject.MaximumRecordAgeInSeconds = aws.Int32(int32(v))
+	}
+
+	if v, ok := tfMap["maximum_retry_attempts"].(int); ok && v != 0 {
+		apiObject.MaximumRetryAttempts = aws.Int32(int32(v))
+	}
+
+	if v, ok := tfMap["on_partial_batch_item_failure"].(string); ok && v != "" {
+		apiObject.OnPartialBatchItemFailure = types.OnPartialBatchItemFailureStreams(v)
+	}
+
+	if v, ok := tfMap["parallelization_factor"].(int); ok && v != 0 {
+		apiObject.ParallelizationFactor = aws.Int32(int32(v))
+	}
+
+	if v, ok := tfMap["starting_position"].(string); ok && v != "" {
+		apiObject.StartingPosition = types.KinesisStreamStartPosition(v)
+	}
+
+	if v, ok := tfMap["starting_position_timestamp"].(string); ok && v != "" {
+		v, _ := time.Parse(time.RFC3339, v)
+
+		apiObject.StartingPositionTimestamp = aws.Time(v)
+	}
+
+	return apiObject
+}
+
+func expandUpdatePipeSourceKinesisStreamParameters(tfMap map[string]interface{}) *types.UpdatePipeSourceKinesisStreamParameters {
+	if tfMap == nil {
+		return nil
+	}
+
+	apiObject := &types.UpdatePipeSourceKinesisStreamParameters{}
+
+	if v, ok := tfMap["batch_size"].(int); ok {
+		apiObject.BatchSize = aws.Int32(int32(v))
+	}
+
+	if v, ok := tfMap["dead_letter_config"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
+		apiObject.DeadLetterConfig = expandDeadLetterConfig(v[0].(map[string]interface{}))
+	} else {
+		apiObject.DeadLetterConfig = &types.DeadLetterConfig{}
+	}
+
+	if v, ok := tfMap["maximum_batching_window_in_seconds"].(int); ok {
+		apiObject.MaximumBatchingWindowInSeconds = aws.Int32(int32(v))
+	}
+
+	if v, ok := tfMap["maximum_record_age_in_seconds"].(int); ok {
+		apiObject.MaximumRecordAgeInSeconds = aws.Int32(int32(v))
+	}
+
+	if v, ok := tfMap["maximum_retry_attempts"].(int); ok {
+		apiObject.MaximumRetryAttempts = aws.Int32(int32(v))
+	}
+
+	if v, ok := tfMap["on_partial_batch_item_failure"].(string); ok {
+		apiObject.OnPartialBatchItemFailure = types.OnPartialBatchItemFailureStreams(v)
+	}
+
+	if v, ok := tfMap["parallelization_factor"].(int); ok {
+		apiObject.ParallelizationFactor = aws.Int32(int32(v))
+	}
+
+	return apiObject
+}
+
+func expandPipeSourceManagedStreamingKafkaParameters(tfMap map[string]interface{}) *types.PipeSourceManagedStreamingKafkaParameters {
+	if tfMap == nil {
+		return nil
+	}
+
+	apiObject := &types.PipeSourceManagedStreamingKafkaParameters{}
+
+	if v, ok := tfMap["batch_size"].(int); ok && v != 0 {
+		apiObject.BatchSize = aws.Int32(int32(v))
+	}
+
+	if v, ok := tfMap["consumer_group_id"].(string); ok && v != "" {
+		apiObject.ConsumerGroupID = aws.String(v)
+	}
+
+	if v, ok := tfMap["credentials"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
+		apiObject.Credentials = expandMSKAccessCredentials(v[0].(map[string]interface{}))
+	}
+
+	if v, ok := tfMap["maximum_batching_window_in_seconds"].(int); ok && v != 0 {
+		apiObject.MaximumBatchingWindowInSeconds = aws.Int32(int32(v))
+	}
+
+	if v, ok := tfMap["starting_position"].(string); ok && v != "" {
+		apiObject.StartingPosition = types.MSKStartPosition(v)
+	}
+
+	if v, ok := tfMap["topic_name"].(string); ok && v != "" {
+		apiObject.TopicName = aws.String(v)
+	}
+
+	return apiObject
+}
+
+func expandUpdatePipeSourceManagedStreamingKafkaParameters(tfMap map[string]interface{}) *types.UpdatePipeSourceManagedStreamingKafkaParameters {
+	if tfMap == nil {
+		return nil
+	}
+
+	apiObject := &types.UpdatePipeSourceManagedStreamingKafkaParameters{}
+
+	if v, ok := tfMap["batch_size"].(int); ok {
+		apiObject.BatchSize = aws.Int32(int32(v))
+	}
+
+	if v, ok := tfMap["credentials"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
+		apiObject.Credentials = expandMSKAccessCredentials(v[0].(map[string]interface{}))
+	}
+
+	if v, ok := tfMap["maximum_batching_window_in_seconds"].(int); ok {
+		apiObject.MaximumBatchingWindowInSeconds = aws.Int32(int32(v))
+	}
+
+	return apiObject
+}
+
+func expandMSKAccessCredentials(tfMap map[string]interface{}) types.MSKAccessCredentials {
+	if tfMap == nil {
+		return nil
+	}
+
+	if v, ok := tfMap["client_certificate_tls_auth"].(string); ok && v != "" {
+		apiObject := &types.MSKAccessCredentialsMemberClientCertificateTlsAuth{
+			Value: v,
+		}
+
+		return apiObject
+	}
+
+	if v, ok := tfMap["sasl_scram_512_auth"].(string); ok && v != "" {
+		apiObject := &types.MSKAccessCredentialsMemberSaslScram512Auth{
+			Value: v,
+		}
+
+		return apiObject
+	}
+
+	return nil
+}
+
+func expandPipeSourceRabbitMQBrokerParameters(tfMap map[string]interface{}) *types.PipeSourceRabbitMQBrokerParameters {
+	if tfMap == nil {
+		return nil
+	}
+
+	apiObject := &types.PipeSourceRabbitMQBrokerParameters{}
+
+	if v, ok := tfMap["batch_size"].(int); ok && v != 0 {
+		apiObject.BatchSize = aws.Int32(int32(v))
+	}
+
+	if v, ok := tfMap["credentials"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
+		apiObject.Credentials = expandMQBrokerAccessCredentials(v[0].(map[string]interface{}))
+	}
+
+	if v, ok := tfMap["maximum_batching_window_in_seconds"].(int); ok && v != 0 {
+		apiObject.MaximumBatchingWindowInSeconds = aws.Int32(int32(v))
+	}
+
+	if v, ok := tfMap["queue_name"].(string); ok && v != "" {
+		apiObject.QueueName = aws.String(v)
+	}
+
+	if v, ok := tfMap["virtual_host"].(string); ok && v != "" {
+		apiObject.VirtualHost = aws.String(v)
+	}
+
+	return apiObject
+}
+
+func expandUpdatePipeSourceRabbitMQBrokerParameters(tfMap map[string]interface{}) *types.UpdatePipeSourceRabbitMQBrokerParameters {
+	if tfMap == nil {
+		return nil
+	}
+
+	apiObject := &types.UpdatePipeSourceRabbitMQBrokerParameters{}
+
+	if v, ok := tfMap["batch_size"].(int); ok {
+		apiObject.BatchSize = aws.Int32(int32(v))
+	}
+
+	if v, ok := tfMap["credentials"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
+		apiObject.Credentials = expandMQBrokerAccessCredentials(v[0].(map[string]interface{}))
+	}
+
+	if v, ok := tfMap["maximum_batching_window_in_seconds"].(int); ok {
+		apiObject.MaximumBatchingWindowInSeconds = aws.Int32(int32(v))
+	}
+
+	return apiObject
+}
+
+func expandPipeSourceSelfManagedKafkaParameters(tfMap map[string]interface{}) *types.PipeSourceSelfManagedKafkaParameters {
+	if tfMap == nil {
+		return nil
+	}
+
+	apiObject := &types.PipeSourceSelfManagedKafkaParameters{}
+
+	if v, ok := tfMap["additional_bootstrap_servers"].(*schema.Set); ok && v.Len() > 0 {
+		apiObject.AdditionalBootstrapServers = flex.ExpandStringValueSet(v)
+	}
+
+	if v, ok := tfMap["batch_size"].(int); ok && v != 0 {
+		apiObject.BatchSize = aws.Int32(int32(v))
+	}
+
+	if v, ok := tfMap["consumer_group_id"].(string); ok && v != "" {
+		apiObject.ConsumerGroupID = aws.String(v)
+	}
+
+	if v, ok := tfMap["credentials"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
+		apiObject.Credentials = expandSelfManagedKafkaAccessConfigurationCredentials(v[0].(map[string]interface{}))
+	}
+
+	if v, ok := tfMap["maximum_batching_window_in_seconds"].(int); ok && v != 0 {
+		apiObject.MaximumBatchingWindowInSeconds = aws.Int32(int32(v))
+	}
+
+	if v, ok := tfMap["server_root_ca_certificate"].(string); ok && v != "" {
+		apiObject.ServerRootCaCertificate = aws.String(v)
+	}
+
+	if v, ok := tfMap["starting_position"].(string); ok && v != "" {
+		apiObject.StartingPosition = types.SelfManagedKafkaStartPosition(v)
+	}
+
+	if v, ok := tfMap["topic_name"].(string); ok && v != "" {
+		apiObject.TopicName = aws.String(v)
+	}
+
+	if v, ok := tfMap["vpc"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
+		apiObject.Vpc = expandSelfManagedKafkaAccessConfigurationVPC(v[0].(map[string]interface{}))
+	}
+
+	return apiObject
+}
+
+func expandUpdatePipeSourceSelfManagedKafkaParameters(tfMap map[string]interface{}) *types.UpdatePipeSourceSelfManagedKafkaParameters {
+	if tfMap == nil {
+		return nil
+	}
+
+	apiObject := &types.UpdatePipeSourceSelfManagedKafkaParameters{}
+
+	if v, ok := tfMap["batch_size"].(int); ok && v != 0 {
+		apiObject.BatchSize = aws.Int32(int32(v))
+	}
+
+	if v, ok := tfMap["credentials"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
+		apiObject.Credentials = expandSelfManagedKafkaAccessConfigurationCredentials(v[0].(map[string]interface{}))
+	}
+
+	if v, ok := tfMap["maximum_batching_window_in_seconds"].(int); ok {
+		apiObject.MaximumBatchingWindowInSeconds = aws.Int32(int32(v))
+	}
+
+	if v, ok := tfMap["server_root_ca_certificate"].(string); ok {
+		apiObject.ServerRootCaCertificate = aws.String(v)
+	}
+
+	if v, ok := tfMap["vpc"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
+		apiObject.Vpc = expandSelfManagedKafkaAccessConfigurationVPC(v[0].(map[string]interface{}))
+	} else {
+		apiObject.Vpc = &types.SelfManagedKafkaAccessConfigurationVpc{}
+	}
+
+	return apiObject
+}
+
+func expandSelfManagedKafkaAccessConfigurationCredentials(tfMap map[string]interface{}) types.SelfManagedKafkaAccessConfigurationCredentials {
+	if tfMap == nil {
+		return nil
+	}
+
+	if v, ok := tfMap["basic_auth"].(string); ok && v != "" {
+		apiObject := &types.SelfManagedKafkaAccessConfigurationCredentialsMemberBasicAuth{
+			Value: v,
+		}
+
+		return apiObject
+	}
+
+	if v, ok := tfMap["client_certificate_tls_auth"].(string); ok && v != "" {
+		apiObject := &types.SelfManagedKafkaAccessConfigurationCredentialsMemberClientCertificateTlsAuth{
+			Value: v,
+		}
+
+		return apiObject
+	}
+
+	if v, ok := tfMap["sasl_scram_256_auth"].(string); ok && v != "" {
+		apiObject := &types.SelfManagedKafkaAccessConfigurationCredentialsMemberSaslScram256Auth{
+			Value: v,
+		}
+
+		return apiObject
+	}
+
+	if v, ok := tfMap["sasl_scram_512_auth"].(string); ok && v != "" {
+		apiObject := &types.SelfManagedKafkaAccessConfigurationCredentialsMemberSaslScram512Auth{
+			Value: v,
+		}
+
+		return apiObject
+	}
+
+	return nil
+}
+
+func expandSelfManagedKafkaAccessConfigurationVPC(tfMap map[string]interface{}) *types.SelfManagedKafkaAccessConfigurationVpc {
+	if tfMap == nil {
+		return nil
+	}
+
+	apiObject := &types.SelfManagedKafkaAccessConfigurationVpc{}
+
+	if v, ok := tfMap["security_groups"].(*schema.Set); ok && v.Len() > 0 {
+		apiObject.SecurityGroup = flex.ExpandStringValueSet(v)
+	}
+
+	if v, ok := tfMap["subnets"].(*schema.Set); ok && v.Len() > 0 {
+		apiObject.Subnets = flex.ExpandStringValueSet(v)
+	}
+
+	return apiObject
+}
+
+func expandPipeSourceSQSQueueParameters(tfMap map[string]interface{}) *types.PipeSourceSqsQueueParameters {
+	if tfMap == nil {
+		return nil
+	}
+
+	apiObject := &types.PipeSourceSqsQueueParameters{}
+
+	if v, ok := tfMap["batch_size"].(int); ok && v != 0 {
+		apiObject.BatchSize = aws.Int32(int32(v))
+	}
+
+	if v, ok := tfMap["maximum_batching_window_in_seconds"].(int); ok && v != 0 {
+		apiObject.MaximumBatchingWindowInSeconds = aws.Int32(int32(v))
+	}
+
+	return apiObject
+}
+
+func expandUpdatePipeSourceSQSQueueParameters(tfMap map[string]interface{}) *types.UpdatePipeSourceSqsQueueParameters {
+	if tfMap == nil {
+		return nil
+	}
+
+	apiObject := &types.UpdatePipeSourceSqsQueueParameters{}
+
+	if v, ok := tfMap["batch_size"].(int); ok {
+		apiObject.BatchSize = aws.Int32(int32(v))
+	}
+
+	if v, ok := tfMap["maximum_batching_window_in_seconds"].(int); ok {
+		apiObject.MaximumBatchingWindowInSeconds = aws.Int32(int32(v))
+	}
+
+	return apiObject
+}
+
+func flattenPipeSourceParameters(apiObject *types.PipeSourceParameters) map[string]interface{} {
+	if apiObject == nil {
+		return nil
+	}
+
+	tfMap := map[string]interface{}{}
+
+	if v := apiObject.ActiveMQBrokerParameters; v != nil {
+		tfMap["activemq_broker_parameters"] = []interface{}{flattenPipeSourceActiveMQBrokerParameters(v)}
+	}
+
+	if v := apiObject.DynamoDBStreamParameters; v != nil {
+		tfMap["dynamodb_stream_parameters"] = []interface{}{flattenPipeSourceDynamoDBStreamParameters(v)}
+	}
+
+	if v := apiObject.FilterCriteria; v != nil {
+		tfMap["filter_criteria"] = []interface{}{flattenFilterCriteria(v)}
+	}
+
+	if v := apiObject.KinesisStreamParameters; v != nil {
+		tfMap["kinesis_stream_parameters"] = []interface{}{flattenPipeSourceKinesisStreamParameters(v)}
+	}
+
+	if v := apiObject.ManagedStreamingKafkaParameters; v != nil {
+		tfMap["managed_streaming_kafka_parameters"] = []interface{}{flattenPipeSourceManagedStreamingKafkaParameters(v)}
+	}
+
+	if v := apiObject.RabbitMQBrokerParameters; v != nil {
+		tfMap["rabbitmq_broker_parameters"] = []interface{}{flattenPipeSourceRabbitMQBrokerParameters(v)}
+	}
+
+	if v := apiObject.SelfManagedKafkaParameters; v != nil {
+		tfMap["self_managed_kafka_parameters"] = []interface{}{flattenPipeSourceSelfManagedKafkaParameters(v)}
+	}
+
+	if v := apiObject.SqsQueueParameters; v != nil {
+		tfMap["sqs_queue_parameters"] = []interface{}{flattenPipeSourceSQSQueueParameters(v)}
+	}
+
+	return tfMap
+}
+
+func flattenFilterCriteria(apiObject *types.FilterCriteria) map[string]interface{} {
+	if apiObject == nil {
+		return nil
+	}
+
+	tfMap := map[string]interface{}{}
+
+	if v := apiObject.Filters; v != nil {
+		tfMap["filter"] = flattenFilters(v)
+	}
+
+	return tfMap
+}
+
+func flattenFilter(apiObject types.Filter) map[string]interface{} {
+	tfMap := map[string]interface{}{}
+
+	if v := apiObject.Pattern; v != nil {
+		tfMap["pattern"] = aws.ToString(v)
+	}
+
+	return tfMap
+}
+
+func flattenFilters(apiObjects []types.Filter) []interface{} {
+	if len(apiObjects) == 0 {
+		return nil
+	}
+
+	var tfList []interface{}
+
+	for _, apiObject := range apiObjects {
+		tfList = append(tfList, flattenFilter(apiObject))
+	}
+
+	return tfList
+}
+
+func flattenPipeSourceActiveMQBrokerParameters(apiObject *types.PipeSourceActiveMQBrokerParameters) map[string]interface{} {
+	if apiObject == nil {
+		return nil
+	}
+
+	tfMap := map[string]interface{}{}
+
+	if v := apiObject.BatchSize; v != nil {
+		tfMap["batch_size"] = aws.ToInt32(v)
+	}
+
+	if v := apiObject.Credentials; v != nil {
+		tfMap["credentials"] = []interface{}{flattenMQBrokerAccessCredentials(v)}
+	}
+
+	if v := apiObject.MaximumBatchingWindowInSeconds; v != nil {
+		tfMap["maximum_batching_window_in_seconds"] = aws.ToInt32(v)
+	}
+
+	if v := apiObject.QueueName; v != nil {
+		tfMap["queue_name"] = aws.ToString(v)
+	}
+
+	return tfMap
+}
+
+func flattenMQBrokerAccessCredentials(apiObject types.MQBrokerAccessCredentials) map[string]interface{} {
+	if apiObject == nil {
+		return nil
+	}
+
+	tfMap := map[string]interface{}{}
+
+	if apiObject, ok := apiObject.(*types.MQBrokerAccessCredentialsMemberBasicAuth); ok {
+		if v := apiObject.Value; v != "" {
+			tfMap["basic_auth"] = v
+		}
+	}
+
+	return tfMap
+}
+
+func flattenPipeSourceDynamoDBStreamParameters(apiObject *types.PipeSourceDynamoDBStreamParameters) map[string]interface{} {
+	if apiObject == nil {
+		return nil
+	}
+
+	tfMap := map[string]interface{}{}
+
+	if v := apiObject.BatchSize; v != nil {
+		tfMap["batch_size"] = aws.ToInt32(v)
+	}
+
+	if v := apiObject.DeadLetterConfig; v != nil {
+		tfMap["dead_letter_config"] = []interface{}{flattenDeadLetterConfig(v)}
+	}
+
+	if v := apiObject.MaximumBatchingWindowInSeconds; v != nil {
+		tfMap["maximum_batching_window_in_seconds"] = aws.ToInt32(v)
+	}
+
+	if v := apiObject.MaximumRecordAgeInSeconds; v != nil {
+		tfMap["maximum_record_age_in_seconds"] = aws.ToInt32(v)
+	}
+
+	if v := apiObject.MaximumRetryAttempts; v != nil {
+		tfMap["maximum_retry_attempts"] = aws.ToInt32(v)
+	}
+
+	if v := apiObject.OnPartialBatchItemFailure; v != "" {
+		tfMap["on_partial_batch_item_failure"] = v
+	}
+
+	if v := apiObject.ParallelizationFactor; v != nil {
+		tfMap["parallelization_factor"] = aws.ToInt32(v)
+	}
+
+	if v := apiObject.StartingPosition; v != "" {
+		tfMap["starting_position"] = v
+	}
+
+	return tfMap
+}
+
+func flattenPipeSourceKinesisStreamParameters(apiObject *types.PipeSourceKinesisStreamParameters) map[string]interface{} {
+	if apiObject == nil {
+		return nil
+	}
+
+	tfMap := map[string]interface{}{}
+
+	if v := apiObject.BatchSize; v != nil {
+		tfMap["batch_size"] = aws.ToInt32(v)
+	}
+
+	if v := apiObject.DeadLetterConfig; v != nil {
+		tfMap["dead_letter_config"] = []interface{}{flattenDeadLetterConfig(v)}
+	}
+
+	if v := apiObject.MaximumBatchingWindowInSeconds; v != nil {
+		tfMap["maximum_batching_window_in_seconds"] = aws.ToInt32(v)
+	}
+
+	if v := apiObject.MaximumRecordAgeInSeconds; v != nil {
+		tfMap["maximum_record_age_in_seconds"] = aws.ToInt32(v)
+	}
+
+	if v := apiObject.MaximumRetryAttempts; v != nil {
+		tfMap["maximum_retry_attempts"] = aws.ToInt32(v)
+	}
+
+	if v := apiObject.OnPartialBatchItemFailure; v != "" {
+		tfMap["on_partial_batch_item_failure"] = v
+	}
+
+	if v := apiObject.ParallelizationFactor; v != nil {
+		tfMap["parallelization_factor"] = aws.ToInt32(v)
+	}
+
+	if v := apiObject.StartingPosition; v != "" {
+		tfMap["starting_position"] = v
+	}
+
+	if v := apiObject.StartingPositionTimestamp; v != nil {
+		tfMap["starting_position_timestamp"] = aws.ToTime(v).Format(time.RFC3339)
+	}
+
+	return tfMap
+}
+
+func flattenPipeSourceManagedStreamingKafkaParameters(apiObject *types.PipeSourceManagedStreamingKafkaParameters) map[string]interface{} {
+	if apiObject == nil {
+		return nil
+	}
+
+	tfMap := map[string]interface{}{}
+
+	if v := apiObject.BatchSize; v != nil {
+		tfMap["batch_size"] = aws.ToInt32(v)
+	}
+
+	if v := apiObject.ConsumerGroupID; v != nil {
+		tfMap["consumer_group_id"] = aws.ToString(v)
+	}
+
+	if v := apiObject.Credentials; v != nil {
+		tfMap["credentials"] = []interface{}{flattenMSKAccessCredentials(v)}
+	}
+
+	if v := apiObject.MaximumBatchingWindowInSeconds; v != nil {
+		tfMap["maximum_batching_window_in_seconds"] = aws.ToInt32(v)
+	}
+
+	if v := apiObject.StartingPosition; v != "" {
+		tfMap["starting_position"] = v
+	}
+
+	if v := apiObject.TopicName; v != nil {
+		tfMap["topic_name"] = aws.ToString(v)
+	}
+
+	return tfMap
+}
+
+func flattenMSKAccessCredentials(apiObject types.MSKAccessCredentials) map[string]interface{} {
+	if apiObject == nil {
+		return nil
+	}
+
+	tfMap := map[string]interface{}{}
+
+	if apiObject, ok := apiObject.(*types.MSKAccessCredentialsMemberClientCertificateTlsAuth); ok {
+		if v := apiObject.Value; v != "" {
+			tfMap["client_certificate_tls_auth"] = v
+		}
+	}
+
+	if apiObject, ok := apiObject.(*types.MSKAccessCredentialsMemberSaslScram512Auth); ok {
+		if v := apiObject.Value; v != "" {
+			tfMap["sasl_scram_512_auth"] = v
+		}
+	}
+
+	return tfMap
+}
+
+func flattenPipeSourceRabbitMQBrokerParameters(apiObject *types.PipeSourceRabbitMQBrokerParameters) map[string]interface{} {
+	if apiObject == nil {
+		return nil
+	}
+
+	tfMap := map[string]interface{}{}
+
+	if v := apiObject.BatchSize; v != nil {
+		tfMap["batch_size"] = aws.ToInt32(v)
+	}
+
+	if v := apiObject.Credentials; v != nil {
+		tfMap["credentials"] = []interface{}{flattenMQBrokerAccessCredentials(v)}
+	}
+
+	if v := apiObject.MaximumBatchingWindowInSeconds; v != nil {
+		tfMap["maximum_batching_window_in_seconds"] = aws.ToInt32(v)
+	}
+
+	if v := apiObject.QueueName; v != nil {
+		tfMap["queue_name"] = aws.ToString(v)
+	}
+
+	if v := apiObject.VirtualHost; v != nil {
+		tfMap["virtual_host"] = aws.ToString(v)
+	}
+
+	return tfMap
+}
+
+func flattenPipeSourceSelfManagedKafkaParameters(apiObject *types.PipeSourceSelfManagedKafkaParameters) map[string]interface{} {
+	if apiObject == nil {
+		return nil
+	}
+
+	tfMap := map[string]interface{}{}
+
+	if v := apiObject.AdditionalBootstrapServers; v != nil {
+		tfMap["additional_bootstrap_servers"] = v
+	}
+
+	if v := apiObject.BatchSize; v != nil {
+		tfMap["batch_size"] = aws.ToInt32(v)
+	}
+
+	if v := apiObject.ConsumerGroupID; v != nil {
+		tfMap["consumer_group_id"] = aws.ToString(v)
+	}
+
+	if v := apiObject.Credentials; v != nil {
+		tfMap["credentials"] = []interface{}{flattenSelfManagedKafkaAccessConfigurationCredentials(v)}
+	}
+
+	if v := apiObject.MaximumBatchingWindowInSeconds; v != nil {
+		tfMap["maximum_batching_window_in_seconds"] = aws.ToInt32(v)
+	}
+
+	if v := apiObject.ServerRootCaCertificate; v != nil {
+		tfMap["server_root_ca_certificate"] = aws.ToString(v)
+	}
+
+	if v := apiObject.StartingPosition; v != "" {
+		tfMap["starting_position"] = v
+	}
+
+	if v := apiObject.TopicName; v != nil {
+		tfMap["topic_name"] = aws.ToString(v)
+	}
+
+	if v := apiObject.Vpc; v != nil {
+		tfMap["vpc"] = []interface{}{flattenSelfManagedKafkaAccessConfigurationVPC(v)}
+	}
+
+	return tfMap
+}
+
+func flattenSelfManagedKafkaAccessConfigurationCredentials(apiObject types.SelfManagedKafkaAccessConfigurationCredentials) map[string]interface{} {
+	if apiObject == nil {
+		return nil
+	}
+
+	tfMap := map[string]interface{}{}
+
+	if apiObject, ok := apiObject.(*types.SelfManagedKafkaAccessConfigurationCredentialsMemberBasicAuth); ok {
+		if v := apiObject.Value; v != "" {
+			tfMap["basic_auth"] = v
+		}
+	}
+
+	if apiObject, ok := apiObject.(*types.SelfManagedKafkaAccessConfigurationCredentialsMemberClientCertificateTlsAuth); ok {
+		if v := apiObject.Value; v != "" {
+			tfMap["client_certificate_tls_auth"] = v
+		}
+	}
+
+	if apiObject, ok := apiObject.(*types.SelfManagedKafkaAccessConfigurationCredentialsMemberSaslScram256Auth); ok {
+		if v := apiObject.Value; v != "" {
+			tfMap["sasl_scram_256_auth"] = v
+		}
+	}
+
+	if apiObject, ok := apiObject.(*types.SelfManagedKafkaAccessConfigurationCredentialsMemberSaslScram512Auth); ok {
+		if v := apiObject.Value; v != "" {
+			tfMap["sasl_scram_512_auth"] = v
+		}
+	}
+
+	return tfMap
+}
+
+func flattenSelfManagedKafkaAccessConfigurationVPC(apiObject *types.SelfManagedKafkaAccessConfigurationVpc) map[string]interface{} {
+	if apiObject == nil {
+		return nil
+	}
+
+	tfMap := map[string]interface{}{}
+
+	if v := apiObject.SecurityGroup; v != nil {
+		tfMap["security_groups"] = v
+	}
+
+	if v := apiObject.Subnets; v != nil {
+		tfMap["subnets"] = v
+	}
+
+	return tfMap
+}
+
+func flattenPipeSourceSQSQueueParameters(apiObject *types.PipeSourceSqsQueueParameters) map[string]interface{} {
+	if apiObject == nil {
+		return nil
+	}
+
+	tfMap := map[string]interface{}{}
+
+	if v := apiObject.BatchSize; v != nil {
+		tfMap["batch_size"] = aws.ToInt32(v)
+	}
+
+	if v := apiObject.MaximumBatchingWindowInSeconds; v != nil {
+		tfMap["maximum_batching_window_in_seconds"] = aws.ToInt32(v)
+	}
+
+	return tfMap
+}
+
+func flattenDeadLetterConfig(apiObject *types.DeadLetterConfig) map[string]interface{} {
+	if apiObject == nil {
+		return nil
+	}
+
+	tfMap := map[string]interface{}{}
+
+	if v := apiObject.Arn; v != nil {
+		tfMap["arn"] = aws.ToString(v)
+	}
+
+	return tfMap
+}
diff --git a/internal/service/pipes/status.go b/internal/service/pipes/status.go
deleted file mode 100644
index 4c51772f949..00000000000
--- a/internal/service/pipes/status.go
+++ /dev/null
@@ -1,40 +0,0 @@
-package pipes
-
-import (
-	"context"
-
-	"github.com/aws/aws-sdk-go-v2/service/pipes"
-	"github.com/aws/aws-sdk-go-v2/service/pipes/types"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
-	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
-)
-
-const (
-	pipeStatusRunning      = string(types.PipeStateRunning)
-	pipeStatusStopped      = string(types.PipeStateStopped)
-	pipeStatusCreating     = string(types.PipeStateCreating)
-	pipeStatusUpdating     = string(types.PipeStateUpdating)
-	pipeStatusDeleting     = string(types.PipeStateDeleting)
-	pipeStatusStarting     = string(types.PipeStateStarting)
-	pipeStatusStopping     = string(types.PipeStateStopping)
-	pipeStatusCreateFailed = string(types.PipeStateCreateFailed)
-	pipeStatusUpdateFailed = string(types.PipeStateUpdateFailed)
-	pipeStatusStartFailed  = string(types.PipeStateStartFailed)
-	pipeStatusStopFailed   = string(types.PipeStateStopFailed)
-)
-
-func statusPipe(ctx context.Context, conn *pipes.Client, name string) retry.StateRefreshFunc {
-	return func() (interface{}, string, error) {
-		output, err := FindPipeByName(ctx, conn, name)
-
-		if tfresource.NotFound(err) {
-			return nil, "", nil
-		}
-
-		if err != nil {
-			return nil, "", err
-		}
-
-		return output, string(output.CurrentState), nil
-	}
-}
diff --git a/internal/service/pipes/sweep.go b/internal/service/pipes/sweep.go
index fc9529a6b48..b129ad42c3d 100644
--- a/internal/service/pipes/sweep.go
+++ b/internal/service/pipes/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package pipes
 
@@ -9,12 +9,12 @@ import (
 
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/pipes"
-	"github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv2"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_pipes_pipe", &resource.Sweeper{
 		Name: "aws_pipes_pipe",
 		F:    sweepPipes,
@@ -23,43 +23,38 @@ func init() {
 
 func sweepPipes(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("getting client: %w", err)
 	}
 	conn := client.PipesClient(ctx)
 	sweepResources := make([]sweep.Sweepable, 0)
-	var errs *multierror.Error
 
-	paginator := pipes.NewListPipesPaginator(conn, &pipes.ListPipesInput{})
+	pages := pipes.NewListPipesPaginator(conn, &pipes.ListPipesInput{})
+	for pages.HasMorePages() {
+		page, err := pages.NextPage(ctx)
 
-	for paginator.HasMorePages() {
-		page, err := paginator.NextPage(ctx)
+		if awsv2.SkipSweepError(err) {
+			log.Printf("[WARN] Skipping Pipe sweep for %s: %s", region, err)
+			return nil
+		}
 
 		if err != nil {
-			errs = multierror.Append(errs, fmt.Errorf("listing Pipes for %s: %w", region, err))
-			break
+			return fmt.Errorf("error listing Pipes (%s): %w", region, err)
 		}
 
-		for _, it := range page.Pipes {
-			name := aws.ToString(it.Name)
-
-			r := ResourcePipe()
+		for _, v := range page.Pipes {
+			r := resourcePipe()
 			d := r.Data(nil)
-			d.SetId(name)
+			d.SetId(aws.ToString(v.Name))
 
 			sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
 		}
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
-		errs = multierror.Append(errs, fmt.Errorf("sweeping Pipe for %s: %w", region, err))
-	}
-
-	if sweep.SkipSweepError(err) {
-		log.Printf("[WARN] Skipping Pipe sweep for %s: %s", region, errs)
-		return nil
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
+		return fmt.Errorf("error sweeping Pipes (%s): %w", region, err)
 	}
 
-	return errs.ErrorOrNil()
+	return nil
 }
diff --git a/internal/service/pipes/tags_gen.go b/internal/service/pipes/tags_gen.go
index e2c1d8b64c7..3f91726e468 100644
--- a/internal/service/pipes/tags_gen.go
+++ b/internal/service/pipes/tags_gen.go
@@ -7,7 +7,9 @@ import (
 
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/pipes"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -53,7 +55,7 @@ func Tags(tags tftags.KeyValueTags) map[string]string {
 	return tags.Map()
 }
 
-// KeyValueTags creates KeyValueTags from pipes service tags.
+// KeyValueTags creates tftags.KeyValueTags from pipes service tags.
 func KeyValueTags(ctx context.Context, tags map[string]string) tftags.KeyValueTags {
 	return tftags.New(ctx, tags)
 }
@@ -84,6 +86,8 @@ func updateTags(ctx context.Context, conn *pipes.Client, identifier string, oldT
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.Pipes)
 	if len(removedTags) > 0 {
diff --git a/internal/service/pipes/target_parameters.go b/internal/service/pipes/target_parameters.go
new file mode 100644
index 00000000000..302b6dc92b2
--- /dev/null
+++ b/internal/service/pipes/target_parameters.go
@@ -0,0 +1,2700 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package pipes
+
+import (
+	"github.com/YakDriver/regexache"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/pipes/types"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
+	"github.com/hashicorp/terraform-provider-aws/internal/enum"
+	"github.com/hashicorp/terraform-provider-aws/internal/flex"
+	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
+	"github.com/hashicorp/terraform-provider-aws/internal/verify"
+)
+
+func targetParametersSchema() *schema.Schema {
+	return &schema.Schema{
+		Type:     schema.TypeList,
+		Optional: true,
+		MaxItems: 1,
+		Elem: &schema.Resource{
+			Schema: map[string]*schema.Schema{
+				"batch_job_parameters": {
+					Type:     schema.TypeList,
+					Optional: true,
+					MaxItems: 1,
+					ConflictsWith: []string{
+						"target_parameters.0.cloudwatch_logs_parameters",
+						"target_parameters.0.ecs_task_parameters",
+						"target_parameters.0.eventbridge_event_bus_parameters",
+						"target_parameters.0.http_parameters",
+						"target_parameters.0.kinesis_stream_parameters",
+						"target_parameters.0.lambda_function_parameters",
+						"target_parameters.0.redshift_data_parameters",
+						"target_parameters.0.sagemaker_pipeline_parameters",
+						"target_parameters.0.sqs_queue_parameters",
+						"target_parameters.0.step_function_state_machine_parameters",
+					},
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"array_properties": {
+								Type:     schema.TypeList,
+								Optional: true,
+								MaxItems: 1,
+								Elem: &schema.Resource{
+									Schema: map[string]*schema.Schema{
+										"size": {
+											Type:         schema.TypeInt,
+											Optional:     true,
+											ValidateFunc: validation.IntBetween(2, 10000),
+										},
+									},
+								},
+							},
+							"container_overrides": {
+								Type:     schema.TypeList,
+								Optional: true,
+								MaxItems: 1,
+								Elem: &schema.Resource{
+									Schema: map[string]*schema.Schema{
+										"command": {
+											Type:     schema.TypeList,
+											Optional: true,
+											Elem: &schema.Schema{
+												Type: schema.TypeString,
+											},
+										},
+										"environment": {
+											Type:     schema.TypeList,
+											Optional: true,
+											Elem: &schema.Resource{
+												Schema: map[string]*schema.Schema{
+													"name": {
+														Type:     schema.TypeString,
+														Optional: true,
+													},
+													"value": {
+														Type:     schema.TypeString,
+														Optional: true,
+													},
+												},
+											},
+										},
+										"instance_type": {
+											Type:     schema.TypeString,
+											Optional: true,
+										},
+										"resource_requirement": {
+											Type:     schema.TypeList,
+											Optional: true,
+											Elem: &schema.Resource{
+												Schema: map[string]*schema.Schema{
+													"type": {
+														Type:             schema.TypeString,
+														Required:         true,
+														ValidateDiagFunc: enum.Validate[types.BatchResourceRequirementType](),
+													},
+													"value": {
+														Type:     schema.TypeString,
+														Required: true,
+													},
+												},
+											},
+										},
+									},
+								},
+							},
+							"depends_on": {
+								Type:     schema.TypeList,
+								Optional: true,
+								MaxItems: 20,
+								Elem: &schema.Resource{
+									Schema: map[string]*schema.Schema{
+										"job_id": {
+											Type:     schema.TypeString,
+											Optional: true,
+										},
+										"type": {
+											Type:             schema.TypeString,
+											Optional:         true,
+											ValidateDiagFunc: enum.Validate[types.BatchJobDependencyType](),
+										},
+									},
+								},
+							},
+							"job_definition": {
+								Type:     schema.TypeString,
+								Required: true,
+							},
+							"job_name": {
+								Type:         schema.TypeString,
+								Required:     true,
+								ValidateFunc: validation.StringLenBetween(1, 128),
+							},
+							"parameters": {
+								Type:     schema.TypeMap,
+								Optional: true,
+								Elem:     &schema.Schema{Type: schema.TypeString},
+							},
+							"retry_strategy": {
+								Type:     schema.TypeList,
+								Optional: true,
+								MaxItems: 1,
+								Elem: &schema.Resource{
+									Schema: map[string]*schema.Schema{
+										"attempts": {
+											Type:         schema.TypeInt,
+											Optional:     true,
+											ValidateFunc: validation.IntBetween(1, 10),
+										},
+									},
+								},
+							},
+						},
+					},
+				},
+				"cloudwatch_logs_parameters": {
+					Type:     schema.TypeList,
+					Optional: true,
+					MaxItems: 1,
+					ConflictsWith: []string{
+						"target_parameters.0.batch_job_parameters",
+						"target_parameters.0.ecs_task_parameters",
+						"target_parameters.0.eventbridge_event_bus_parameters",
+						"target_parameters.0.http_parameters",
+						"target_parameters.0.kinesis_stream_parameters",
+						"target_parameters.0.lambda_function_parameters",
+						"target_parameters.0.redshift_data_parameters",
+						"target_parameters.0.sagemaker_pipeline_parameters",
+						"target_parameters.0.sqs_queue_parameters",
+						"target_parameters.0.step_function_state_machine_parameters",
+					},
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"log_stream_name": {
+								Type:         schema.TypeString,
+								Optional:     true,
+								ValidateFunc: validation.StringLenBetween(0, 256),
+							},
+							"timestamp": {
+								Type:     schema.TypeString,
+								Optional: true,
+								ValidateFunc: validation.All(
+									validation.StringLenBetween(1, 256),
+									validation.StringMatch(regexache.MustCompile(`^\$(\.[\w/_-]+(\[(\d+|\*)\])*)*$`), ""),
+								),
+							},
+						},
+					},
+				},
+				"ecs_task_parameters": {
+					Type:     schema.TypeList,
+					Optional: true,
+					MaxItems: 1,
+					ConflictsWith: []string{
+						"target_parameters.0.batch_job_parameters",
+						"target_parameters.0.cloudwatch_logs_parameters",
+						"target_parameters.0.eventbridge_event_bus_parameters",
+						"target_parameters.0.http_parameters",
+						"target_parameters.0.kinesis_stream_parameters",
+						"target_parameters.0.lambda_function_parameters",
+						"target_parameters.0.redshift_data_parameters",
+						"target_parameters.0.sagemaker_pipeline_parameters",
+						"target_parameters.0.sqs_queue_parameters",
+						"target_parameters.0.step_function_state_machine_parameters",
+					},
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"capacity_provider_strategy": {
+								Type:     schema.TypeList,
+								Optional: true,
+								MaxItems: 6,
+								Elem: &schema.Resource{
+									Schema: map[string]*schema.Schema{
+										"base": {
+											Type:         schema.TypeInt,
+											Optional:     true,
+											ValidateFunc: validation.IntBetween(0, 100000),
+										},
+										"capacity_provider": {
+											Type:         schema.TypeString,
+											Required:     true,
+											ValidateFunc: validation.StringLenBetween(1, 255),
+										},
+										"weight": {
+											Type:         schema.TypeInt,
+											Optional:     true,
+											ValidateFunc: validation.IntBetween(0, 1000),
+										},
+									},
+								},
+							},
+							"enable_ecs_managed_tags": {
+								Type:     schema.TypeBool,
+								Optional: true,
+							},
+							"enable_execute_command": {
+								Type:     schema.TypeBool,
+								Optional: true,
+							},
+							"group": {
+								Type:         schema.TypeString,
+								Optional:     true,
+								ValidateFunc: validation.StringLenBetween(1, 255),
+							},
+							"launch_type": {
+								Type:             schema.TypeString,
+								Optional:         true,
+								ValidateDiagFunc: enum.Validate[types.LaunchType](),
+							},
+							"network_configuration": {
+								Type:     schema.TypeList,
+								Optional: true,
+								MaxItems: 1,
+								Elem: &schema.Resource{
+									Schema: map[string]*schema.Schema{
+										"aws_vpc_configuration": {
+											Type:     schema.TypeList,
+											Optional: true,
+											MaxItems: 1,
+											Elem: &schema.Resource{
+												Schema: map[string]*schema.Schema{
+													"assign_public_ip": {
+														Type:             schema.TypeString,
+														Optional:         true,
+														ValidateDiagFunc: enum.Validate[types.AssignPublicIp](),
+													},
+													"security_groups": {
+														Type:     schema.TypeSet,
+														Optional: true,
+														MaxItems: 5,
+														Elem: &schema.Schema{
+															Type: schema.TypeString,
+															ValidateFunc: validation.All(
+																validation.StringLenBetween(1, 1024),
+																validation.StringMatch(regexache.MustCompile(`^sg-[0-9A-Za-z]*|(\$(\.[\w/_-]+(\[(\d+|\*)\])*)*)$`), ""),
+															),
+														},
+													},
+													"subnets": {
+														Type:     schema.TypeSet,
+														Optional: true,
+														MaxItems: 16,
+														Elem: &schema.Schema{
+															Type: schema.TypeString,
+															ValidateFunc: validation.All(
+																validation.StringLenBetween(1, 1024),
+																validation.StringMatch(regexache.MustCompile(`^subnet-[0-9a-z]*|(\$(\.[\w/_-]+(\[(\d+|\*)\])*)*)$`), ""),
+															),
+														},
+													},
+												},
+											},
+										},
+									},
+								},
+							},
+							"overrides": {
+								Type:     schema.TypeList,
+								Optional: true,
+								MaxItems: 1,
+								Elem: &schema.Resource{
+									Schema: map[string]*schema.Schema{
+										"container_override": {
+											Type:     schema.TypeList,
+											Optional: true,
+											Elem: &schema.Resource{
+												Schema: map[string]*schema.Schema{
+													"command": {
+														Type:     schema.TypeList,
+														Optional: true,
+														Elem: &schema.Schema{
+															Type: schema.TypeString,
+														},
+													},
+													"cpu": {
+														Type:     schema.TypeInt,
+														Optional: true,
+													},
+													"environment": {
+														Type:     schema.TypeList,
+														Optional: true,
+														Elem: &schema.Resource{
+															Schema: map[string]*schema.Schema{
+																"name": {
+																	Type:     schema.TypeString,
+																	Optional: true,
+																},
+																"value": {
+																	Type:     schema.TypeString,
+																	Optional: true,
+																},
+															},
+														},
+													},
+													"environment_file": {
+														Type:     schema.TypeList,
+														Optional: true,
+														Elem: &schema.Resource{
+															Schema: map[string]*schema.Schema{
+																"type": {
+																	Type:             schema.TypeString,
+																	Required:         true,
+																	ValidateDiagFunc: enum.Validate[types.EcsEnvironmentFileType](),
+																},
+																"value": {
+																	Type:         schema.TypeString,
+																	Required:     true,
+																	ValidateFunc: verify.ValidARN,
+																},
+															},
+														},
+													},
+													"memory": {
+														Type:     schema.TypeInt,
+														Optional: true,
+													},
+													"memory_reservation": {
+														Type:     schema.TypeInt,
+														Optional: true,
+													},
+													"name": {
+														Type:     schema.TypeString,
+														Optional: true,
+													},
+													"resource_requirement": {
+														Type:     schema.TypeList,
+														Optional: true,
+														Elem: &schema.Resource{
+															Schema: map[string]*schema.Schema{
+																"type": {
+																	Type:             schema.TypeString,
+																	Required:         true,
+																	ValidateDiagFunc: enum.Validate[types.EcsResourceRequirementType](),
+																},
+																"value": {
+																	Type:     schema.TypeString,
+																	Required: true,
+																},
+															},
+														},
+													},
+												},
+											},
+										},
+										"cpu": {
+											Type:     schema.TypeString,
+											Optional: true,
+										},
+										"ephemeral_storage": {
+											Type:     schema.TypeList,
+											Optional: true,
+											MaxItems: 1,
+											Elem: &schema.Resource{
+												Schema: map[string]*schema.Schema{
+													"size_in_gib": {
+														Type:         schema.TypeInt,
+														Required:     true,
+														ValidateFunc: validation.IntBetween(21, 200),
+													},
+												},
+											},
+										},
+										"execution_role_arn": {
+											Type:         schema.TypeString,
+											Optional:     true,
+											ValidateFunc: verify.ValidARN,
+										},
+										"inference_accelerator_override": {
+											Type:     schema.TypeList,
+											Optional: true,
+											Elem: &schema.Resource{
+												Schema: map[string]*schema.Schema{
+													"device_name": {
+														Type:     schema.TypeString,
+														Optional: true,
+													},
+													"device_type": {
+														Type:     schema.TypeString,
+														Optional: true,
+													},
+												},
+											},
+										},
+										"memory": {
+											Type:     schema.TypeString,
+											Optional: true,
+										},
+										"task_role_arn": {
+											Type:         schema.TypeString,
+											Optional:     true,
+											ValidateFunc: verify.ValidARN,
+										},
+									},
+								},
+							},
+							"placement_constraint": {
+								Type:     schema.TypeList,
+								Optional: true,
+								MaxItems: 10,
+								Elem: &schema.Resource{
+									Schema: map[string]*schema.Schema{
+										"expression": {
+											Type:         schema.TypeString,
+											Optional:     true,
+											ValidateFunc: validation.StringLenBetween(1, 2000),
+										},
+										"type": {
+											Type:             schema.TypeString,
+											Optional:         true,
+											ValidateDiagFunc: enum.Validate[types.PlacementConstraintType](),
+										},
+									},
+								},
+							},
+							"placement_strategy": {
+								Type:     schema.TypeList,
+								Optional: true,
+								MaxItems: 5,
+								Elem: &schema.Resource{
+									Schema: map[string]*schema.Schema{
+										"field": {
+											Type:         schema.TypeString,
+											Optional:     true,
+											ValidateFunc: validation.StringLenBetween(1, 255),
+										},
+										"type": {
+											Type:             schema.TypeString,
+											Optional:         true,
+											ValidateDiagFunc: enum.Validate[types.PlacementStrategyType](),
+										},
+									},
+								},
+							},
+							"platform_version": {
+								Type:     schema.TypeString,
+								Optional: true,
+							},
+							"propagate_tags": {
+								Type:             schema.TypeString,
+								Optional:         true,
+								ValidateDiagFunc: enum.Validate[types.PropagateTags](),
+							},
+							"reference_id": {
+								Type:         schema.TypeString,
+								Optional:     true,
+								ValidateFunc: validation.StringLenBetween(1, 1024),
+							},
+							"tags": tftags.TagsSchema(),
+							"task_count": {
+								Type:     schema.TypeInt,
+								Optional: true,
+							},
+							"task_definition_arn": {
+								Type:         schema.TypeString,
+								Required:     true,
+								ValidateFunc: verify.ValidARN,
+							},
+						},
+					},
+				},
+				"eventbridge_event_bus_parameters": {
+					Type:     schema.TypeList,
+					Optional: true,
+					MaxItems: 1,
+					ConflictsWith: []string{
+						"target_parameters.0.batch_job_parameters",
+						"target_parameters.0.cloudwatch_logs_parameters",
+						"target_parameters.0.ecs_task_parameters",
+						"target_parameters.0.http_parameters",
+						"target_parameters.0.kinesis_stream_parameters",
+						"target_parameters.0.lambda_function_parameters",
+						"target_parameters.0.redshift_data_parameters",
+						"target_parameters.0.sagemaker_pipeline_parameters",
+						"target_parameters.0.sqs_queue_parameters",
+						"target_parameters.0.step_function_state_machine_parameters",
+					},
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"detail_type": {
+								Type:         schema.TypeString,
+								Optional:     true,
+								ValidateFunc: validation.StringLenBetween(0, 128),
+							},
+							"endpoint_id": {
+								Type:     schema.TypeString,
+								Optional: true,
+								ValidateFunc: validation.All(
+									validation.StringLenBetween(1, 50),
+									validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z-]+[\.][0-9A-Za-z-]+$`), ""),
+								),
+							},
+							"resources": {
+								Type:     schema.TypeSet,
+								Optional: true,
+								MaxItems: 10,
+								Elem: &schema.Schema{
+									Type:         schema.TypeString,
+									ValidateFunc: verify.ValidARN,
+								},
+							},
+							"source": {
+								Type:     schema.TypeString,
+								Optional: true,
+								ValidateFunc: validation.All(
+									validation.StringLenBetween(1, 256),
+								),
+							},
+							"time": {
+								Type:     schema.TypeString,
+								Optional: true,
+								ValidateFunc: validation.All(
+									validation.StringLenBetween(1, 256),
+									validation.StringMatch(regexache.MustCompile(`^\$(\.[\w/_-]+(\[(\d+|\*)\])*)*$`), ""),
+								),
+							},
+						},
+					},
+				},
+				"http_parameters": {
+					Type:     schema.TypeList,
+					Optional: true,
+					MaxItems: 1,
+					ConflictsWith: []string{
+						"target_parameters.0.batch_job_parameters",
+						"target_parameters.0.cloudwatch_logs_parameters",
+						"target_parameters.0.ecs_task_parameters",
+						"target_parameters.0.eventbridge_event_bus_parameters",
+						"target_parameters.0.kinesis_stream_parameters",
+						"target_parameters.0.lambda_function_parameters",
+						"target_parameters.0.redshift_data_parameters",
+						"target_parameters.0.sagemaker_pipeline_parameters",
+						"target_parameters.0.sqs_queue_parameters",
+						"target_parameters.0.step_function_state_machine_parameters",
+					},
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"header_parameters": {
+								Type:     schema.TypeMap,
+								Optional: true,
+								Elem:     &schema.Schema{Type: schema.TypeString},
+							},
+							"path_parameter_values": {
+								Type:     schema.TypeList,
+								Optional: true,
+								MaxItems: 1,
+								Elem: &schema.Schema{
+									Type: schema.TypeString,
+								},
+							},
+							"query_string_parameters": {
+								Type:     schema.TypeMap,
+								Optional: true,
+								Elem:     &schema.Schema{Type: schema.TypeString},
+							},
+						},
+					},
+				},
+				"input_template": {
+					Type:         schema.TypeString,
+					Optional:     true,
+					ValidateFunc: validation.StringLenBetween(0, 8192),
+				},
+				"kinesis_stream_parameters": {
+					Type:     schema.TypeList,
+					Optional: true,
+					MaxItems: 1,
+					ConflictsWith: []string{
+						"target_parameters.0.batch_job_parameters",
+						"target_parameters.0.cloudwatch_logs_parameters",
+						"target_parameters.0.ecs_task_parameters",
+						"target_parameters.0.eventbridge_event_bus_parameters",
+						"target_parameters.0.http_parameters",
+						"target_parameters.0.lambda_function_parameters",
+						"target_parameters.0.redshift_data_parameters",
+						"target_parameters.0.sagemaker_pipeline_parameters",
+						"target_parameters.0.sqs_queue_parameters",
+						"target_parameters.0.step_function_state_machine_parameters",
+					},
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"partition_key": {
+								Type:         schema.TypeString,
+								Required:     true,
+								ValidateFunc: validation.StringLenBetween(1, 256),
+							},
+						},
+					},
+				},
+				"lambda_function_parameters": {
+					Type:     schema.TypeList,
+					Optional: true,
+					MaxItems: 1,
+					ConflictsWith: []string{
+						"target_parameters.0.batch_job_parameters",
+						"target_parameters.0.cloudwatch_logs_parameters",
+						"target_parameters.0.ecs_task_parameters",
+						"target_parameters.0.eventbridge_event_bus_parameters",
+						"target_parameters.0.http_parameters",
+						"target_parameters.0.kinesis_stream_parameters",
+						"target_parameters.0.redshift_data_parameters",
+						"target_parameters.0.sagemaker_pipeline_parameters",
+						"target_parameters.0.sqs_queue_parameters",
+						"target_parameters.0.step_function_state_machine_parameters",
+					},
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"invocation_type": {
+								Type:             schema.TypeString,
+								Required:         true,
+								ValidateDiagFunc: enum.Validate[types.PipeTargetInvocationType](),
+							},
+						},
+					},
+				},
+				"redshift_data_parameters": {
+					Type:     schema.TypeList,
+					Optional: true,
+					MaxItems: 1,
+					ConflictsWith: []string{
+						"target_parameters.0.batch_job_parameters",
+						"target_parameters.0.cloudwatch_logs_parameters",
+						"target_parameters.0.ecs_task_parameters",
+						"target_parameters.0.eventbridge_event_bus_parameters",
+						"target_parameters.0.http_parameters",
+						"target_parameters.0.kinesis_stream_parameters",
+						"target_parameters.0.lambda_function_parameters",
+						"target_parameters.0.sagemaker_pipeline_parameters",
+						"target_parameters.0.sqs_queue_parameters",
+						"target_parameters.0.step_function_state_machine_parameters",
+					},
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"database": {
+								Type:         schema.TypeString,
+								Required:     true,
+								ValidateFunc: validation.StringLenBetween(1, 64),
+							},
+							"db_user": {
+								Type:         schema.TypeString,
+								Optional:     true,
+								ValidateFunc: validation.StringLenBetween(1, 128),
+							},
+							"secret_manager_arn": {
+								Type:         schema.TypeString,
+								Optional:     true,
+								ValidateFunc: verify.ValidARN,
+							},
+							"sqls": {
+								Type:     schema.TypeSet,
+								Required: true,
+								Elem: &schema.Schema{
+									Type:         schema.TypeString,
+									ValidateFunc: validation.StringLenBetween(1, 100000),
+								},
+							},
+							"statement_name": {
+								Type:         schema.TypeString,
+								Optional:     true,
+								ValidateFunc: validation.StringLenBetween(1, 500),
+							},
+							"with_event": {
+								Type:     schema.TypeBool,
+								Optional: true,
+							},
+						},
+					},
+				},
+				"sagemaker_pipeline_parameters": {
+					Type:     schema.TypeList,
+					Optional: true,
+					MaxItems: 1,
+					ConflictsWith: []string{
+						"target_parameters.0.batch_job_parameters",
+						"target_parameters.0.cloudwatch_logs_parameters",
+						"target_parameters.0.ecs_task_parameters",
+						"target_parameters.0.eventbridge_event_bus_parameters",
+						"target_parameters.0.http_parameters",
+						"target_parameters.0.kinesis_stream_parameters",
+						"target_parameters.0.lambda_function_parameters",
+						"target_parameters.0.redshift_data_parameters",
+						"target_parameters.0.sqs_queue_parameters",
+						"target_parameters.0.step_function_state_machine_parameters",
+					},
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"pipeline_parameter": {
+								Type:     schema.TypeList,
+								Optional: true,
+								MaxItems: 200,
+								Elem: &schema.Resource{
+									Schema: map[string]*schema.Schema{
+										"name": {
+											Type:     schema.TypeString,
+											Required: true,
+											ValidateFunc: validation.All(
+												validation.StringLenBetween(1, 256),
+												validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z](-*[0-9A-Za-z])*|(\$(\.[\w/_-]+(\[(\d+|\*)\])*)*)$`), ""),
+											),
+										},
+										"value": {
+											Type:         schema.TypeString,
+											Required:     true,
+											ValidateFunc: validation.StringLenBetween(1, 1024),
+										},
+									},
+								},
+							},
+						},
+					},
+				},
+				"sqs_queue_parameters": {
+					Type:     schema.TypeList,
+					Optional: true,
+					MaxItems: 1,
+					ConflictsWith: []string{
+						"target_parameters.0.batch_job_parameters",
+						"target_parameters.0.cloudwatch_logs_parameters",
+						"target_parameters.0.ecs_task_parameters",
+						"target_parameters.0.eventbridge_event_bus_parameters",
+						"target_parameters.0.http_parameters",
+						"target_parameters.0.kinesis_stream_parameters",
+						"target_parameters.0.lambda_function_parameters",
+						"target_parameters.0.redshift_data_parameters",
+						"target_parameters.0.sagemaker_pipeline_parameters",
+						"target_parameters.0.step_function_state_machine_parameters",
+					},
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"message_deduplication_id": {
+								Type:         schema.TypeString,
+								Optional:     true,
+								ValidateFunc: validation.StringLenBetween(1, 100),
+							},
+							"message_group_id": {
+								Type:         schema.TypeString,
+								Optional:     true,
+								ValidateFunc: validation.StringLenBetween(1, 100),
+							},
+						},
+					},
+				},
+				"step_function_state_machine_parameters": {
+					Type:     schema.TypeList,
+					Optional: true,
+					MaxItems: 1,
+					ConflictsWith: []string{
+						"target_parameters.0.batch_job_parameters",
+						"target_parameters.0.cloudwatch_logs_parameters",
+						"target_parameters.0.ecs_task_parameters",
+						"target_parameters.0.eventbridge_event_bus_parameters",
+						"target_parameters.0.http_parameters",
+						"target_parameters.0.kinesis_stream_parameters",
+						"target_parameters.0.lambda_function_parameters",
+						"target_parameters.0.redshift_data_parameters",
+						"target_parameters.0.sagemaker_pipeline_parameters",
+						"target_parameters.0.sqs_queue_parameters",
+					},
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"invocation_type": {
+								Type:             schema.TypeString,
+								Required:         true,
+								ValidateDiagFunc: enum.Validate[types.PipeTargetInvocationType](),
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+}
+
+func expandPipeTargetParameters(tfMap map[string]interface{}) *types.PipeTargetParameters {
+	if tfMap == nil {
+		return nil
+	}
+
+	apiObject := &types.PipeTargetParameters{}
+
+	if v, ok := tfMap["batch_job_parameters"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
+		apiObject.BatchJobParameters = expandPipeTargetBatchJobParameters(v[0].(map[string]interface{}))
+	}
+
+	if v, ok := tfMap["cloudwatch_logs_parameters"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
+		apiObject.CloudWatchLogsParameters = expandPipeTargetCloudWatchLogsParameters(v[0].(map[string]interface{}))
+	}
+
+	if v, ok := tfMap["ecs_task_parameters"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
+		apiObject.EcsTaskParameters = expandPipeTargetECSTaskParameters(v[0].(map[string]interface{}))
+	}
+
+	if v, ok := tfMap["eventbridge_event_bus_parameters"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
+		apiObject.EventBridgeEventBusParameters = expandPipeTargetEventBridgeEventBusParameters(v[0].(map[string]interface{}))
+	}
+
+	if v, ok := tfMap["http_parameters"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
+		apiObject.HttpParameters = expandPipeTargetHTTPParameters(v[0].(map[string]interface{}))
+	}
+
+	if v, ok := tfMap["input_template"].(string); ok && v != "" {
+		apiObject.InputTemplate = aws.String(v)
+	}
+
+	if v, ok := tfMap["kinesis_stream_parameters"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
+		apiObject.KinesisStreamParameters = expandPipeTargetKinesisStreamParameters(v[0].(map[string]interface{}))
+	}
+
+	if v, ok := tfMap["lambda_function_parameters"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
+		apiObject.LambdaFunctionParameters = expandPipeTargetLambdaFunctionParameters(v[0].(map[string]interface{}))
+	}
+
+	if v, ok := tfMap["redshift_data_parameters"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
+		apiObject.RedshiftDataParameters = expandPipeTargetRedshiftDataParameters(v[0].(map[string]interface{}))
+	}
+
+	if v, ok := tfMap["sagemaker_pipeline_parameters"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
+		apiObject.SageMakerPipelineParameters = expandPipeTargetSageMakerPipelineParameters(v[0].(map[string]interface{}))
+	}
+
+	if v, ok := tfMap["sqs_queue_parameters"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
+		apiObject.SqsQueueParameters = expandPipeTargetSQSQueueParameters(v[0].(map[string]interface{}))
+	}
+
+	if v, ok := tfMap["step_function_state_machine_parameters"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
+		apiObject.StepFunctionStateMachineParameters = expandPipeTargetStateMachineParameters(v[0].(map[string]interface{}))
+	}
+
+	return apiObject
+}
+
+func expandPipeTargetBatchJobParameters(tfMap map[string]interface{}) *types.PipeTargetBatchJobParameters {
+	if tfMap == nil {
+		return nil
+	}
+
+	apiObject := &types.PipeTargetBatchJobParameters{}
+
+	if v, ok := tfMap["array_properties"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
+		apiObject.ArrayProperties = expandBatchArrayProperties(v[0].(map[string]interface{}))
+	}
+
+	if v, ok := tfMap["container_overrides"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
+		apiObject.ContainerOverrides = expandBatchContainerOverrides(v[0].(map[string]interface{}))
+	}
+
+	if v, ok := tfMap["depends_on"].([]interface{}); ok && len(v) > 0 {
+		apiObject.DependsOn = expandBatchJobDependencies(v)
+	}
+
+	if v, ok := tfMap["job_definition"].(string); ok && v != "" {
+		apiObject.JobDefinition = aws.String(v)
+	}
+
+	if v, ok := tfMap["job_name"].(string); ok && v != "" {
+		apiObject.JobName = aws.String(v)
+	}
+
+	if v, ok := tfMap["parameters"].(map[string]interface{}); ok && len(v) > 0 {
+		apiObject.Parameters = flex.ExpandStringValueMap(v)
+	}
+
+	if v, ok := tfMap["retry_strategy"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
+		apiObject.RetryStrategy = expandBatchRetryStrategy(v[0].(map[string]interface{}))
+	}
+
+	return apiObject
+}
+
+func expandBatchArrayProperties(tfMap map[string]interface{}) *types.BatchArrayProperties {
+	if tfMap == nil {
+		return nil
+	}
+
+	apiObject := &types.BatchArrayProperties{}
+
+	if v, ok := tfMap["size"].(int); ok {
+		apiObject.Size = int32(v)
+	}
+
+	return apiObject
+}
+
+func expandBatchContainerOverrides(tfMap map[string]interface{}) *types.BatchContainerOverrides {
+	if tfMap == nil {
+		return nil
+	}
+
+	apiObject := &types.BatchContainerOverrides{}
+
+	if v, ok := tfMap["command"].([]interface{}); ok && len(v) > 0 {
+		apiObject.Command = flex.ExpandStringValueList(v)
+	}
+
+	if v, ok := tfMap["environment"].([]interface{}); ok && len(v) > 0 {
+		apiObject.Environment = expandBatchEnvironmentVariables(v)
+	}
+
+	if v, ok := tfMap["instance_type"].(string); ok && v != "" {
+		apiObject.InstanceType = aws.String(v)
+	}
+
+	if v, ok := tfMap["resource_requirement"].([]interface{}); ok && len(v) > 0 {
+		apiObject.ResourceRequirements = expandBatchResourceRequirements(v)
+	}
+
+	return apiObject
+}
+
+func expandBatchEnvironmentVariable(tfMap map[string]interface{}) *types.BatchEnvironmentVariable {
+	if tfMap == nil {
+		return nil
+	}
+
+	apiObject := &types.BatchEnvironmentVariable{}
+
+	if v, ok := tfMap["name"].(string); ok && v != "" {
+		apiObject.Name = aws.String(v)
+	}
+
+	if v, ok := tfMap["value"].(string); ok && v != "" {
+		apiObject.Value = aws.String(v)
+	}
+
+	return apiObject
+}
+
+func expandBatchEnvironmentVariables(tfList []interface{}) []types.BatchEnvironmentVariable {
+	if len(tfList) == 0 {
+		return nil
+	}
+
+	var apiObjects []types.BatchEnvironmentVariable
+
+	for _, tfMapRaw := range tfList {
+		tfMap, ok := tfMapRaw.(map[string]interface{})
+
+		if !ok {
+			continue
+		}
+
+		apiObject := expandBatchEnvironmentVariable(tfMap)
+
+		if apiObject == nil {
+			continue
+		}
+
+		apiObjects = append(apiObjects, *apiObject)
+	}
+
+	return apiObjects
+}
+
+func expandBatchResourceRequirement(tfMap map[string]interface{}) *types.BatchResourceRequirement {
+	if tfMap == nil {
+		return nil
+	}
+
+	apiObject := &types.BatchResourceRequirement{}
+
+	if v, ok := tfMap["type"].(string); ok && v != "" {
+		apiObject.Type = types.BatchResourceRequirementType(v)
+	}
+
+	if v, ok := tfMap["value"].(string); ok && v != "" {
+		apiObject.Value = aws.String(v)
+	}
+
+	return apiObject
+}
+
+func expandBatchResourceRequirements(tfList []interface{}) []types.BatchResourceRequirement {
+	if len(tfList) == 0 {
+		return nil
+	}
+
+	var apiObjects []types.BatchResourceRequirement
+
+	for _, tfMapRaw := range tfList {
+		tfMap, ok := tfMapRaw.(map[string]interface{})
+
+		if !ok {
+			continue
+		}
+
+		apiObject := expandBatchResourceRequirement(tfMap)
+
+		if apiObject == nil {
+			continue
+		}
+
+		apiObjects = append(apiObjects, *apiObject)
+	}
+
+	return apiObjects
+}
+
+func expandBatchJobDependency(tfMap map[string]interface{}) *types.BatchJobDependency {
+	if tfMap == nil {
+		return nil
+	}
+
+	apiObject := &types.BatchJobDependency{}
+
+	if v, ok := tfMap["job_id"].(string); ok && v != "" {
+		apiObject.JobId = aws.String(v)
+	}
+
+	if v, ok := tfMap["type"].(string); ok && v != "" {
+		apiObject.Type = types.BatchJobDependencyType(v)
+	}
+
+	return apiObject
+}
+
+func expandBatchJobDependencies(tfList []interface{}) []types.BatchJobDependency {
+	if len(tfList) == 0 {
+		return nil
+	}
+
+	var apiObjects []types.BatchJobDependency
+
+	for _, tfMapRaw := range tfList {
+		tfMap, ok := tfMapRaw.(map[string]interface{})
+
+		if !ok {
+			continue
+		}
+
+		apiObject := expandBatchJobDependency(tfMap)
+
+		if apiObject == nil {
+			continue
+		}
+
+		apiObjects = append(apiObjects, *apiObject)
+	}
+
+	return apiObjects
+}
+
+func expandBatchRetryStrategy(tfMap map[string]interface{}) *types.BatchRetryStrategy {
+	if tfMap == nil {
+		return nil
+	}
+
+	apiObject := &types.BatchRetryStrategy{}
+
+	if v, ok := tfMap["attempts"].(int); ok {
+		apiObject.Attempts = int32(v)
+	}
+
+	return apiObject
+}
+
+func expandPipeTargetCloudWatchLogsParameters(tfMap map[string]interface{}) *types.PipeTargetCloudWatchLogsParameters {
+	if tfMap == nil {
+		return nil
+	}
+
+	apiObject := &types.PipeTargetCloudWatchLogsParameters{}
+
+	if v, ok := tfMap["log_stream_name"].(string); ok && v != "" {
+		apiObject.LogStreamName = aws.String(v)
+	}
+
+	if v, ok := tfMap["timestamp"].(string); ok && v != "" {
+		apiObject.Timestamp = aws.String(v)
+	}
+
+	return apiObject
+}
+
+func expandPipeTargetECSTaskParameters(tfMap map[string]interface{}) *types.PipeTargetEcsTaskParameters {
+	if tfMap == nil {
+		return nil
+	}
+
+	apiObject := &types.PipeTargetEcsTaskParameters{}
+
+	if v, ok := tfMap["capacity_provider_strategy"].([]interface{}); ok && len(v) > 0 {
+		apiObject.CapacityProviderStrategy = expandCapacityProviderStrategyItems(v)
+	}
+
+	if v, ok := tfMap["enable_ecs_managed_tags"].(bool); ok {
+		apiObject.EnableECSManagedTags = v
+	}
+
+	if v, ok := tfMap["enable_execute_command"].(bool); ok {
+		apiObject.EnableExecuteCommand = v
+	}
+
+	if v, ok := tfMap["group"].(string); ok && v != "" {
+		apiObject.Group = aws.String(v)
+	}
+
+	if v, ok := tfMap["launch_type"].(string); ok && v != "" {
+		apiObject.LaunchType = types.LaunchType(v)
+	}
+
+	if v, ok := tfMap["network_configuration"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
+		apiObject.NetworkConfiguration = expandNetworkConfiguration(v[0].(map[string]interface{}))
+	}
+
+	if v, ok := tfMap["overrides"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
+		apiObject.Overrides = expandECSTaskOverride(v[0].(map[string]interface{}))
+	}
+
+	if v, ok := tfMap["placement_constraint"].([]interface{}); ok && len(v) > 0 {
+		apiObject.PlacementConstraints = expandPlacementConstraints(v)
+	}
+
+	if v, ok := tfMap["placement_strategy"].([]interface{}); ok && len(v) > 0 {
+		apiObject.PlacementStrategy = expandPlacementStrategies(v)
+	}
+
+	if v, ok := tfMap["platform_version"].(string); ok && v != "" {
+		apiObject.PlatformVersion = aws.String(v)
+	}
+
+	if v, ok := tfMap["propagate_tags"].(string); ok && v != "" {
+		apiObject.PropagateTags = types.PropagateTags(v)
+	}
+
+	if v, ok := tfMap["reference_id"].(string); ok && v != "" {
+		apiObject.ReferenceId = aws.String(v)
+	}
+
+	if v, ok := tfMap["tags"].(map[string]interface{}); ok && len(v) > 0 {
+		for k, v := range flex.ExpandStringValueMap(v) {
+			apiObject.Tags = append(apiObject.Tags, types.Tag{Key: aws.String(k), Value: aws.String(v)})
+		}
+	}
+
+	if v, ok := tfMap["task_count"].(int); ok {
+		apiObject.TaskCount = aws.Int32(int32(v))
+	}
+
+	if v, ok := tfMap["task_definition_arn"].(string); ok && v != "" {
+		apiObject.TaskDefinitionArn = aws.String(v)
+	}
+
+	return apiObject
+}
+
+func expandCapacityProviderStrategyItem(tfMap map[string]interface{}) *types.CapacityProviderStrategyItem {
+	if tfMap == nil {
+		return nil
+	}
+
+	apiObject := &types.CapacityProviderStrategyItem{}
+
+	if v, ok := tfMap["base"].(int); ok {
+		apiObject.Base = int32(v)
+	}
+
+	if v, ok := tfMap["capacity_provider"].(string); ok && v != "" {
+		apiObject.CapacityProvider = aws.String(v)
+	}
+
+	if v, ok := tfMap["weight"].(int); ok {
+		apiObject.Weight = int32(v)
+	}
+
+	return apiObject
+}
+
+func expandCapacityProviderStrategyItems(tfList []interface{}) []types.CapacityProviderStrategyItem {
+	if len(tfList) == 0 {
+		return nil
+	}
+
+	var apiObjects []types.CapacityProviderStrategyItem
+
+	for _, tfMapRaw := range tfList {
+		tfMap, ok := tfMapRaw.(map[string]interface{})
+
+		if !ok {
+			continue
+		}
+
+		apiObject := expandCapacityProviderStrategyItem(tfMap)
+
+		if apiObject == nil {
+			continue
+		}
+
+		apiObjects = append(apiObjects, *apiObject)
+	}
+
+	return apiObjects
+}
+
+func expandNetworkConfiguration(tfMap map[string]interface{}) *types.NetworkConfiguration {
+	if tfMap == nil {
+		return nil
+	}
+
+	apiObject := &types.NetworkConfiguration{}
+
+	if v, ok := tfMap["aws_vpc_configuration"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
+		apiObject.AwsvpcConfiguration = expandVPCConfiguration(v[0].(map[string]interface{}))
+	}
+
+	return apiObject
+}
+
+func expandVPCConfiguration(tfMap map[string]interface{}) *types.AwsVpcConfiguration {
+	if tfMap == nil {
+		return nil
+	}
+
+	apiObject := &types.AwsVpcConfiguration{}
+
+	if v, ok := tfMap["assign_public_ip"].(string); ok && v != "" {
+		apiObject.AssignPublicIp = types.AssignPublicIp(v)
+	}
+
+	if v, ok := tfMap["security_groups"].(*schema.Set); ok && v.Len() > 0 {
+		apiObject.SecurityGroups = flex.ExpandStringValueSet(v)
+	}
+
+	if v, ok := tfMap["subnets"].(*schema.Set); ok && v.Len() > 0 {
+		apiObject.Subnets = flex.ExpandStringValueSet(v)
+	}
+
+	return apiObject
+}
+
+func expandECSTaskOverride(tfMap map[string]interface{}) *types.EcsTaskOverride {
+	if tfMap == nil {
+		return nil
+	}
+
+	apiObject := &types.EcsTaskOverride{}
+
+	if v, ok := tfMap["container_override"].([]interface{}); ok && len(v) > 0 {
+		apiObject.ContainerOverrides = expandECSContainerOverrides(v)
+	}
+
+	if v, ok := tfMap["cpu"].(string); ok && v != "" {
+		apiObject.Cpu = aws.String(v)
+	}
+
+	if v, ok := tfMap["ephemeral_storage"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
+		apiObject.EphemeralStorage = expandECSEphemeralStorage(v[0].(map[string]interface{}))
+	}
+
+	if v, ok := tfMap["execution_role_arn"].(string); ok && v != "" {
+		apiObject.ExecutionRoleArn = aws.String(v)
+	}
+
+	if v, ok := tfMap["inference_accelerator_override"].([]interface{}); ok && len(v) > 0 {
+		apiObject.InferenceAcceleratorOverrides = expandECSInferenceAcceleratorOverrides(v)
+	}
+
+	if v, ok := tfMap["memory"].(string); ok && v != "" {
+		apiObject.Memory = aws.String(v)
+	}
+
+	if v, ok := tfMap["task_role_arn"].(string); ok && v != "" {
+		apiObject.TaskRoleArn = aws.String(v)
+	}
+
+	return apiObject
+}
+
+func expandECSContainerOverride(tfMap map[string]interface{}) *types.EcsContainerOverride {
+	if tfMap == nil {
+		return nil
+	}
+
+	apiObject := &types.EcsContainerOverride{}
+
+	if v, ok := tfMap["command"].([]interface{}); ok && len(v) > 0 {
+		apiObject.Command = flex.ExpandStringValueList(v)
+	}
+
+	if v, ok := tfMap["cpu"].(int); ok {
+		apiObject.Cpu = aws.Int32(int32(v))
+	}
+
+	if v, ok := tfMap["environment"].([]interface{}); ok && len(v) > 0 {
+		apiObject.Environment = expandECSEnvironmentVariables(v)
+	}
+
+	if v, ok := tfMap["environment_file"].([]interface{}); ok && len(v) > 0 {
+		apiObject.EnvironmentFiles = expandECSEnvironmentFiles(v)
+	}
+
+	if v, ok := tfMap["memory"].(int); ok {
+		apiObject.Memory = aws.Int32(int32(v))
+	}
+
+	if v, ok := tfMap["memory_reservation"].(int); ok {
+		apiObject.MemoryReservation = aws.Int32(int32(v))
+	}
+
+	if v, ok := tfMap["name"].(string); ok && v != "" {
+		apiObject.Name = aws.String(v)
+	}
+
+	if v, ok := tfMap["resource_requirement"].([]interface{}); ok && len(v) > 0 {
+		apiObject.ResourceRequirements = expandECSResourceRequirements(v)
+	}
+
+	return apiObject
+}
+
+func expandECSContainerOverrides(tfList []interface{}) []types.EcsContainerOverride {
+	if len(tfList) == 0 {
+		return nil
+	}
+
+	var apiObjects []types.EcsContainerOverride
+
+	for _, tfMapRaw := range tfList {
+		tfMap, ok := tfMapRaw.(map[string]interface{})
+
+		if !ok {
+			continue
+		}
+
+		apiObject := expandECSContainerOverride(tfMap)
+
+		if apiObject == nil {
+			continue
+		}
+
+		apiObjects = append(apiObjects, *apiObject)
+	}
+
+	return apiObjects
+}
+
+func expandECSEnvironmentVariable(tfMap map[string]interface{}) *types.EcsEnvironmentVariable {
+	if tfMap == nil {
+		return nil
+	}
+
+	apiObject := &types.EcsEnvironmentVariable{}
+
+	if v, ok := tfMap["name"].(string); ok && v != "" {
+		apiObject.Name = aws.String(v)
+	}
+
+	if v, ok := tfMap["value"].(string); ok && v != "" {
+		apiObject.Value = aws.String(v)
+	}
+
+	return apiObject
+}
+
+func expandECSEnvironmentVariables(tfList []interface{}) []types.EcsEnvironmentVariable {
+	if len(tfList) == 0 {
+		return nil
+	}
+
+	var apiObjects []types.EcsEnvironmentVariable
+
+	for _, tfMapRaw := range tfList {
+		tfMap, ok := tfMapRaw.(map[string]interface{})
+
+		if !ok {
+			continue
+		}
+
+		apiObject := expandECSEnvironmentVariable(tfMap)
+
+		if apiObject == nil {
+			continue
+		}
+
+		apiObjects = append(apiObjects, *apiObject)
+	}
+
+	return apiObjects
+}
+
+func expandECSEnvironmentFile(tfMap map[string]interface{}) *types.EcsEnvironmentFile {
+	if tfMap == nil {
+		return nil
+	}
+
+	apiObject := &types.EcsEnvironmentFile{}
+
+	if v, ok := tfMap["type"].(string); ok && v != "" {
+		apiObject.Type = types.EcsEnvironmentFileType(v)
+	}
+
+	if v, ok := tfMap["value"].(string); ok && v != "" {
+		apiObject.Value = aws.String(v)
+	}
+
+	return apiObject
+}
+
+func expandECSEnvironmentFiles(tfList []interface{}) []types.EcsEnvironmentFile {
+	if len(tfList) == 0 {
+		return nil
+	}
+
+	var apiObjects []types.EcsEnvironmentFile
+
+	for _, tfMapRaw := range tfList {
+		tfMap, ok := tfMapRaw.(map[string]interface{})
+
+		if !ok {
+			continue
+		}
+
+		apiObject := expandECSEnvironmentFile(tfMap)
+
+		if apiObject == nil {
+			continue
+		}
+
+		apiObjects = append(apiObjects, *apiObject)
+	}
+
+	return apiObjects
+}
+
+func expandECSResourceRequirement(tfMap map[string]interface{}) *types.EcsResourceRequirement {
+	if tfMap == nil {
+		return nil
+	}
+
+	apiObject := &types.EcsResourceRequirement{}
+
+	if v, ok := tfMap["type"].(string); ok && v != "" {
+		apiObject.Type = types.EcsResourceRequirementType(v)
+	}
+
+	if v, ok := tfMap["value"].(string); ok && v != "" {
+		apiObject.Value = aws.String(v)
+	}
+
+	return apiObject
+}
+
+func expandECSResourceRequirements(tfList []interface{}) []types.EcsResourceRequirement {
+	if len(tfList) == 0 {
+		return nil
+	}
+
+	var apiObjects []types.EcsResourceRequirement
+
+	for _, tfMapRaw := range tfList {
+		tfMap, ok := tfMapRaw.(map[string]interface{})
+
+		if !ok {
+			continue
+		}
+
+		apiObject := expandECSResourceRequirement(tfMap)
+
+		if apiObject == nil {
+			continue
+		}
+
+		apiObjects = append(apiObjects, *apiObject)
+	}
+
+	return apiObjects
+}
+
+func expandECSEphemeralStorage(tfMap map[string]interface{}) *types.EcsEphemeralStorage {
+	if tfMap == nil {
+		return nil
+	}
+
+	apiObject := &types.EcsEphemeralStorage{}
+
+	if v, ok := tfMap["size_in_gib"].(int); ok {
+		apiObject.SizeInGiB = int32(v)
+	}
+
+	return apiObject
+}
+
+func expandECSInferenceAcceleratorOverride(tfMap map[string]interface{}) *types.EcsInferenceAcceleratorOverride {
+	if tfMap == nil {
+		return nil
+	}
+
+	apiObject := &types.EcsInferenceAcceleratorOverride{}
+
+	if v, ok := tfMap["device_name"].(string); ok && v != "" {
+		apiObject.DeviceName = aws.String(v)
+	}
+
+	if v, ok := tfMap["device_type"].(string); ok && v != "" {
+		apiObject.DeviceType = aws.String(v)
+	}
+
+	return apiObject
+}
+
+func expandECSInferenceAcceleratorOverrides(tfList []interface{}) []types.EcsInferenceAcceleratorOverride {
+	if len(tfList) == 0 {
+		return nil
+	}
+
+	var apiObjects []types.EcsInferenceAcceleratorOverride
+
+	for _, tfMapRaw := range tfList {
+		tfMap, ok := tfMapRaw.(map[string]interface{})
+
+		if !ok {
+			continue
+		}
+
+		apiObject := expandECSInferenceAcceleratorOverride(tfMap)
+
+		if apiObject == nil {
+			continue
+		}
+
+		apiObjects = append(apiObjects, *apiObject)
+	}
+
+	return apiObjects
+}
+
+func expandPlacementConstraint(tfMap map[string]interface{}) *types.PlacementConstraint {
+	if tfMap == nil {
+		return nil
+	}
+
+	apiObject := &types.PlacementConstraint{}
+
+	if v, ok := tfMap["expression"].(string); ok && v != "" {
+		apiObject.Expression = aws.String(v)
+	}
+
+	if v, ok := tfMap["type"].(string); ok && v != "" {
+		apiObject.Type = types.PlacementConstraintType(v)
+	}
+
+	return apiObject
+}
+
+func expandPlacementConstraints(tfList []interface{}) []types.PlacementConstraint {
+	if len(tfList) == 0 {
+		return nil
+	}
+
+	var apiObjects []types.PlacementConstraint
+
+	for _, tfMapRaw := range tfList {
+		tfMap, ok := tfMapRaw.(map[string]interface{})
+
+		if !ok {
+			continue
+		}
+
+		apiObject := expandPlacementConstraint(tfMap)
+
+		if apiObject == nil {
+			continue
+		}
+
+		apiObjects = append(apiObjects, *apiObject)
+	}
+
+	return apiObjects
+}
+
+func expandPlacementStrategy(tfMap map[string]interface{}) *types.PlacementStrategy {
+	if tfMap == nil {
+		return nil
+	}
+
+	apiObject := &types.PlacementStrategy{}
+
+	if v, ok := tfMap["field"].(string); ok && v != "" {
+		apiObject.Field = aws.String(v)
+	}
+
+	if v, ok := tfMap["type"].(string); ok && v != "" {
+		apiObject.Type = types.PlacementStrategyType(v)
+	}
+
+	return apiObject
+}
+
+func expandPlacementStrategies(tfList []interface{}) []types.PlacementStrategy {
+	if len(tfList) == 0 {
+		return nil
+	}
+
+	var apiObjects []types.PlacementStrategy
+
+	for _, tfMapRaw := range tfList {
+		tfMap, ok := tfMapRaw.(map[string]interface{})
+
+		if !ok {
+			continue
+		}
+
+		apiObject := expandPlacementStrategy(tfMap)
+
+		if apiObject == nil {
+			continue
+		}
+
+		apiObjects = append(apiObjects, *apiObject)
+	}
+
+	return apiObjects
+}
+
+func expandPipeTargetEventBridgeEventBusParameters(tfMap map[string]interface{}) *types.PipeTargetEventBridgeEventBusParameters {
+	if tfMap == nil {
+		return nil
+	}
+
+	apiObject := &types.PipeTargetEventBridgeEventBusParameters{}
+
+	if v, ok := tfMap["detail_type"].(string); ok && v != "" {
+		apiObject.DetailType = aws.String(v)
+	}
+
+	if v, ok := tfMap["endpoint_id"].(string); ok && v != "" {
+		apiObject.EndpointId = aws.String(v)
+	}
+
+	if v, ok := tfMap["resources"].(*schema.Set); ok && v.Len() > 0 {
+		apiObject.Resources = flex.ExpandStringValueSet(v)
+	}
+
+	if v, ok := tfMap["source"].(string); ok && v != "" {
+		apiObject.Source = aws.String(v)
+	}
+
+	if v, ok := tfMap["time"].(string); ok && v != "" {
+		apiObject.Time = aws.String(v)
+	}
+
+	return apiObject
+}
+
+func expandPipeTargetHTTPParameters(tfMap map[string]interface{}) *types.PipeTargetHttpParameters {
+	if tfMap == nil {
+		return nil
+	}
+
+	apiObject := &types.PipeTargetHttpParameters{}
+
+	if v, ok := tfMap["header_parameters"].(map[string]interface{}); ok && len(v) > 0 {
+		apiObject.HeaderParameters = flex.ExpandStringValueMap(v)
+	}
+
+	if v, ok := tfMap["path_parameter_values"].([]interface{}); ok && len(v) > 0 {
+		apiObject.PathParameterValues = flex.ExpandStringValueList(v)
+	}
+
+	if v, ok := tfMap["query_string_parameters"].(map[string]interface{}); ok && len(v) > 0 {
+		apiObject.QueryStringParameters = flex.ExpandStringValueMap(v)
+	}
+
+	return apiObject
+}
+
+func expandPipeTargetKinesisStreamParameters(tfMap map[string]interface{}) *types.PipeTargetKinesisStreamParameters {
+	if tfMap == nil {
+		return nil
+	}
+
+	apiObject := &types.PipeTargetKinesisStreamParameters{}
+
+	if v, ok := tfMap["partition_key"].(string); ok && v != "" {
+		apiObject.PartitionKey = aws.String(v)
+	}
+
+	return apiObject
+}
+
+func expandPipeTargetLambdaFunctionParameters(tfMap map[string]interface{}) *types.PipeTargetLambdaFunctionParameters {
+	if tfMap == nil {
+		return nil
+	}
+
+	apiObject := &types.PipeTargetLambdaFunctionParameters{}
+
+	if v, ok := tfMap["invocation_type"].(string); ok && v != "" {
+		apiObject.InvocationType = types.PipeTargetInvocationType(v)
+	}
+
+	return apiObject
+}
+
+func expandPipeTargetRedshiftDataParameters(tfMap map[string]interface{}) *types.PipeTargetRedshiftDataParameters {
+	if tfMap == nil {
+		return nil
+	}
+
+	apiObject := &types.PipeTargetRedshiftDataParameters{}
+
+	if v, ok := tfMap["database"].(string); ok && v != "" {
+		apiObject.Database = aws.String(v)
+	}
+
+	if v, ok := tfMap["db_user"].(string); ok && v != "" {
+		apiObject.DbUser = aws.String(v)
+	}
+
+	if v, ok := tfMap["secret_manager_arn"].(string); ok && v != "" {
+		apiObject.SecretManagerArn = aws.String(v)
+	}
+
+	if v, ok := tfMap["sqls"].(*schema.Set); ok && v.Len() > 0 {
+		apiObject.Sqls = flex.ExpandStringValueSet(v)
+	}
+
+	if v, ok := tfMap["statement_name"].(string); ok && v != "" {
+		apiObject.StatementName = aws.String(v)
+	}
+
+	if v, ok := tfMap["with_event"].(bool); ok {
+		apiObject.WithEvent = v
+	}
+
+	return apiObject
+}
+
+func expandPipeTargetSageMakerPipelineParameters(tfMap map[string]interface{}) *types.PipeTargetSageMakerPipelineParameters {
+	if tfMap == nil {
+		return nil
+	}
+
+	apiObject := &types.PipeTargetSageMakerPipelineParameters{}
+
+	if v, ok := tfMap["pipeline_parameter"].([]interface{}); ok && len(v) > 0 {
+		apiObject.PipelineParameterList = expandSageMakerPipelineParameters(v)
+	}
+
+	return apiObject
+}
+
+func expandSageMakerPipelineParameter(tfMap map[string]interface{}) *types.SageMakerPipelineParameter {
+	if tfMap == nil {
+		return nil
+	}
+
+	apiObject := &types.SageMakerPipelineParameter{}
+
+	if v, ok := tfMap["name"].(string); ok && v != "" {
+		apiObject.Name = aws.String(v)
+	}
+
+	if v, ok := tfMap["value"].(string); ok && v != "" {
+		apiObject.Value = aws.String(v)
+	}
+
+	return apiObject
+}
+
+func expandSageMakerPipelineParameters(tfList []interface{}) []types.SageMakerPipelineParameter {
+	if len(tfList) == 0 {
+		return nil
+	}
+
+	var apiObjects []types.SageMakerPipelineParameter
+
+	for _, tfMapRaw := range tfList {
+		tfMap, ok := tfMapRaw.(map[string]interface{})
+
+		if !ok {
+			continue
+		}
+
+		apiObject := expandSageMakerPipelineParameter(tfMap)
+
+		if apiObject == nil {
+			continue
+		}
+
+		apiObjects = append(apiObjects, *apiObject)
+	}
+
+	return apiObjects
+}
+
+func expandPipeTargetSQSQueueParameters(tfMap map[string]interface{}) *types.PipeTargetSqsQueueParameters {
+	if tfMap == nil {
+		return nil
+	}
+
+	apiObject := &types.PipeTargetSqsQueueParameters{}
+
+	if v, ok := tfMap["message_deduplication_id"].(string); ok && v != "" {
+		apiObject.MessageDeduplicationId = aws.String(v)
+	}
+
+	if v, ok := tfMap["message_group_id"].(string); ok && v != "" {
+		apiObject.MessageGroupId = aws.String(v)
+	}
+
+	return apiObject
+}
+
+func expandPipeTargetStateMachineParameters(tfMap map[string]interface{}) *types.PipeTargetStateMachineParameters {
+	if tfMap == nil {
+		return nil
+	}
+
+	apiObject := &types.PipeTargetStateMachineParameters{}
+
+	if v, ok := tfMap["invocation_type"].(string); ok && v != "" {
+		apiObject.InvocationType = types.PipeTargetInvocationType(v)
+	}
+
+	return apiObject
+}
+
+func flattenPipeTargetParameters(apiObject *types.PipeTargetParameters) map[string]interface{} {
+	if apiObject == nil {
+		return nil
+	}
+
+	tfMap := map[string]interface{}{}
+
+	if v := apiObject.BatchJobParameters; v != nil {
+		tfMap["batch_job_parameters"] = []interface{}{flattenPipeTargetBatchJobParameters(v)}
+	}
+
+	if v := apiObject.CloudWatchLogsParameters; v != nil {
+		tfMap["cloudwatch_logs_parameters"] = []interface{}{flattenPipeTargetCloudWatchLogsParameters(v)}
+	}
+
+	if v := apiObject.EcsTaskParameters; v != nil {
+		tfMap["ecs_task_parameters"] = []interface{}{flattenPipeTargetECSTaskParameters(v)}
+	}
+
+	if v := apiObject.EventBridgeEventBusParameters; v != nil {
+		tfMap["eventbridge_event_bus_parameters"] = []interface{}{flattenPipeTargetEventBridgeEventBusParameters(v)}
+	}
+
+	if v := apiObject.HttpParameters; v != nil {
+		tfMap["http_parameters"] = []interface{}{flattenPipeTargetHTTPParameters(v)}
+	}
+
+	if v := apiObject.InputTemplate; v != nil {
+		tfMap["input_template"] = aws.ToString(v)
+	}
+
+	if v := apiObject.KinesisStreamParameters; v != nil {
+		tfMap["kinesis_stream_parameters"] = []interface{}{flattenPipeTargetKinesisStreamParameters(v)}
+	}
+
+	if v := apiObject.LambdaFunctionParameters; v != nil {
+		tfMap["lambda_function_parameters"] = []interface{}{flattenPipeTargetLambdaFunctionParameters(v)}
+	}
+
+	if v := apiObject.RedshiftDataParameters; v != nil {
+		tfMap["redshift_data_parameters"] = []interface{}{flattenPipeTargetRedshiftDataParameters(v)}
+	}
+
+	if v := apiObject.SageMakerPipelineParameters; v != nil {
+		tfMap["sagemaker_pipeline_parameters"] = []interface{}{flattenPipeTargetSageMakerPipelineParameters(v)}
+	}
+
+	if v := apiObject.SqsQueueParameters; v != nil {
+		tfMap["sqs_queue_parameters"] = []interface{}{flattenPipeTargetSQSQueueParameters(v)}
+	}
+
+	if v := apiObject.StepFunctionStateMachineParameters; v != nil {
+		tfMap["step_function_state_machine_parameters"] = []interface{}{flattenPipeTargetStateMachineParameters(v)}
+	}
+
+	return tfMap
+}
+
+func flattenPipeTargetBatchJobParameters(apiObject *types.PipeTargetBatchJobParameters) map[string]interface{} {
+	if apiObject == nil {
+		return nil
+	}
+
+	tfMap := map[string]interface{}{}
+
+	if v := apiObject.ArrayProperties; v != nil {
+		tfMap["array_properties"] = []interface{}{flattenBatchArrayProperties(v)}
+	}
+
+	if v := apiObject.ContainerOverrides; v != nil {
+		tfMap["container_overrides"] = []interface{}{flattenBatchContainerOverrides(v)}
+	}
+
+	if v := apiObject.DependsOn; v != nil {
+		tfMap["depends_on"] = flattenBatchJobDependencies(v)
+	}
+
+	if v := apiObject.JobDefinition; v != nil {
+		tfMap["job_definition"] = aws.ToString(v)
+	}
+
+	if v := apiObject.JobName; v != nil {
+		tfMap["job_name"] = aws.ToString(v)
+	}
+
+	if v := apiObject.Parameters; v != nil {
+		tfMap["parameters"] = v
+	}
+
+	if v := apiObject.RetryStrategy; v != nil {
+		tfMap["retry_strategy"] = []interface{}{flattenBatchRetryStrategy(v)}
+	}
+
+	return tfMap
+}
+
+func flattenBatchArrayProperties(apiObject *types.BatchArrayProperties) map[string]interface{} {
+	if apiObject == nil {
+		return nil
+	}
+
+	tfMap := map[string]interface{}{}
+
+	if v := apiObject.Size; v != 0 {
+		tfMap["size"] = int(v)
+	}
+
+	return tfMap
+}
+
+func flattenBatchContainerOverrides(apiObject *types.BatchContainerOverrides) map[string]interface{} {
+	if apiObject == nil {
+		return nil
+	}
+
+	tfMap := map[string]interface{}{}
+
+	if v := apiObject.Command; v != nil {
+		tfMap["command"] = v
+	}
+
+	if v := apiObject.Environment; v != nil {
+		tfMap["environment"] = flattenBatchEnvironmentVariables(v)
+	}
+
+	if v := apiObject.InstanceType; v != nil {
+		tfMap["instance_type"] = aws.ToString(v)
+	}
+
+	if v := apiObject.ResourceRequirements; v != nil {
+		tfMap["resource_requirement"] = flattenBatchResourceRequirements(v)
+	}
+
+	return tfMap
+}
+
+func flattenBatchEnvironmentVariable(apiObject types.BatchEnvironmentVariable) map[string]interface{} {
+	tfMap := map[string]interface{}{}
+
+	if v := apiObject.Name; v != nil {
+		tfMap["name"] = aws.ToString(v)
+	}
+
+	if v := apiObject.Value; v != nil {
+		tfMap["value"] = aws.ToString(v)
+	}
+
+	return tfMap
+}
+
+func flattenBatchEnvironmentVariables(apiObjects []types.BatchEnvironmentVariable) []interface{} {
+	if len(apiObjects) == 0 {
+		return nil
+	}
+
+	var tfList []interface{}
+
+	for _, apiObject := range apiObjects {
+		tfList = append(tfList, flattenBatchEnvironmentVariable(apiObject))
+	}
+
+	return tfList
+}
+
+func flattenBatchResourceRequirement(apiObject types.BatchResourceRequirement) map[string]interface{} {
+	tfMap := map[string]interface{}{}
+
+	if v := apiObject.Type; v != "" {
+		tfMap["type"] = v
+	}
+
+	if v := apiObject.Value; v != nil {
+		tfMap["value"] = aws.ToString(v)
+	}
+
+	return tfMap
+}
+
+func flattenBatchResourceRequirements(apiObjects []types.BatchResourceRequirement) []interface{} {
+	if len(apiObjects) == 0 {
+		return nil
+	}
+
+	var tfList []interface{}
+
+	for _, apiObject := range apiObjects {
+		tfList = append(tfList, flattenBatchResourceRequirement(apiObject))
+	}
+
+	return tfList
+}
+
+func flattenBatchJobDependency(apiObject types.BatchJobDependency) map[string]interface{} {
+	tfMap := map[string]interface{}{}
+
+	if v := apiObject.JobId; v != nil {
+		tfMap["job_id"] = aws.ToString(v)
+	}
+
+	if v := apiObject.Type; v != "" {
+		tfMap["type"] = v
+	}
+
+	return tfMap
+}
+
+func flattenBatchJobDependencies(apiObjects []types.BatchJobDependency) []interface{} {
+	if len(apiObjects) == 0 {
+		return nil
+	}
+
+	var tfList []interface{}
+
+	for _, apiObject := range apiObjects {
+		tfList = append(tfList, flattenBatchJobDependency(apiObject))
+	}
+
+	return tfList
+}
+
+func flattenBatchRetryStrategy(apiObject *types.BatchRetryStrategy) map[string]interface{} {
+	if apiObject == nil {
+		return nil
+	}
+
+	tfMap := map[string]interface{}{}
+
+	if v := apiObject.Attempts; v != 0 {
+		tfMap["attempts"] = int(v)
+	}
+
+	return tfMap
+}
+
+func flattenPipeTargetCloudWatchLogsParameters(apiObject *types.PipeTargetCloudWatchLogsParameters) map[string]interface{} {
+	if apiObject == nil {
+		return nil
+	}
+
+	tfMap := map[string]interface{}{}
+
+	if v := apiObject.LogStreamName; v != nil {
+		tfMap["log_stream_name"] = aws.ToString(v)
+	}
+
+	if v := apiObject.Timestamp; v != nil {
+		tfMap["timestamp"] = aws.ToString(v)
+	}
+
+	return tfMap
+}
+
+func flattenPipeTargetECSTaskParameters(apiObject *types.PipeTargetEcsTaskParameters) map[string]interface{} {
+	if apiObject == nil {
+		return nil
+	}
+
+	tfMap := map[string]interface{}{
+		"enable_ecs_managed_tags": apiObject.EnableECSManagedTags,
+		"enable_execute_command":  apiObject.EnableExecuteCommand,
+	}
+
+	if v := apiObject.CapacityProviderStrategy; v != nil {
+		tfMap["capacity_provider_strategy"] = flattenCapacityProviderStrategyItems(v)
+	}
+
+	if v := apiObject.Group; v != nil {
+		tfMap["group"] = aws.ToString(v)
+	}
+
+	if v := apiObject.LaunchType; v != "" {
+		tfMap["launch_type"] = v
+	}
+
+	if v := apiObject.NetworkConfiguration; v != nil {
+		tfMap["network_configuration"] = []interface{}{flattenNetworkConfiguration(v)}
+	}
+
+	if v := apiObject.Overrides; v != nil {
+		tfMap["overrides"] = []interface{}{flattenECSTaskOverride(v)}
+	}
+
+	if v := apiObject.PlacementConstraints; v != nil {
+		tfMap["placement_constraint"] = flattenPlacementConstraints(v)
+	}
+
+	if v := apiObject.PlacementStrategy; v != nil {
+		tfMap["placement_strategy"] = flattenPlacementStrategies(v)
+	}
+
+	if v := apiObject.PlatformVersion; v != nil {
+		tfMap["platform_version"] = aws.ToString(v)
+	}
+
+	if v := apiObject.PropagateTags; v != "" {
+		tfMap["propagate_tags"] = v
+	}
+
+	if v := apiObject.ReferenceId; v != nil {
+		tfMap["reference_id"] = aws.ToString(v)
+	}
+
+	if v := apiObject.Tags; v != nil {
+		tags := map[string]interface{}{}
+
+		for _, apiObject := range v {
+			tags[aws.ToString(apiObject.Key)] = aws.ToString(apiObject.Value)
+		}
+
+		tfMap["tags"] = tags
+	}
+
+	if v := apiObject.TaskCount; v != nil {
+		tfMap["task_count"] = aws.ToInt32(v)
+	}
+
+	if v := apiObject.TaskDefinitionArn; v != nil {
+		tfMap["task_definition_arn"] = aws.ToString(v)
+	}
+
+	return tfMap
+}
+
+func flattenCapacityProviderStrategyItem(apiObject types.CapacityProviderStrategyItem) map[string]interface{} {
+	tfMap := map[string]interface{}{
+		"base":   apiObject.Base,
+		"weight": apiObject.Weight,
+	}
+
+	if v := apiObject.CapacityProvider; v != nil {
+		tfMap["capacity_provider"] = aws.ToString(v)
+	}
+
+	return tfMap
+}
+
+func flattenCapacityProviderStrategyItems(apiObjects []types.CapacityProviderStrategyItem) []interface{} {
+	if len(apiObjects) == 0 {
+		return nil
+	}
+
+	var tfList []interface{}
+
+	for _, apiObject := range apiObjects {
+		tfList = append(tfList, flattenCapacityProviderStrategyItem(apiObject))
+	}
+
+	return tfList
+}
+
+func flattenECSTaskOverride(apiObject *types.EcsTaskOverride) map[string]interface{} {
+	if apiObject == nil {
+		return nil
+	}
+
+	tfMap := map[string]interface{}{}
+
+	if v := apiObject.ContainerOverrides; v != nil {
+		tfMap["container_override"] = flattenECSContainerOverrides(v)
+	}
+
+	if v := apiObject.Cpu; v != nil {
+		tfMap["cpu"] = aws.ToString(v)
+	}
+
+	if v := apiObject.EphemeralStorage; v != nil {
+		tfMap["ephemeral_storage"] = []interface{}{flattenECSEphemeralStorage(v)}
+	}
+
+	if v := apiObject.ExecutionRoleArn; v != nil {
+		tfMap["execution_role_arn"] = aws.ToString(v)
+	}
+
+	if v := apiObject.InferenceAcceleratorOverrides; v != nil {
+		tfMap["inference_accelerator_override"] = flattenECSInferenceAcceleratorOverrides(v)
+	}
+
+	if v := apiObject.Memory; v != nil {
+		tfMap["memory"] = aws.ToString(v)
+	}
+
+	if v := apiObject.TaskRoleArn; v != nil {
+		tfMap["task_role_arn"] = aws.ToString(v)
+	}
+
+	return tfMap
+}
+
+func flattenECSContainerOverride(apiObject types.EcsContainerOverride) map[string]interface{} {
+	tfMap := map[string]interface{}{}
+
+	if v := apiObject.Command; v != nil {
+		tfMap["command"] = v
+	}
+
+	if v := apiObject.Cpu; v != nil {
+		tfMap["cpu"] = aws.ToInt32(v)
+	}
+
+	if v := apiObject.Environment; v != nil {
+		tfMap["environment"] = flattenECSEnvironmentVariables(v)
+	}
+
+	if v := apiObject.EnvironmentFiles; v != nil {
+		tfMap["environment_file"] = flattenECSEnvironmentFiles(v)
+	}
+
+	if v := apiObject.Memory; v != nil {
+		tfMap["memory"] = aws.ToInt32(v)
+	}
+
+	if v := apiObject.MemoryReservation; v != nil {
+		tfMap["memory_reservation"] = aws.ToInt32(v)
+	}
+
+	if v := apiObject.Name; v != nil {
+		tfMap["name"] = aws.ToString(v)
+	}
+
+	if v := apiObject.ResourceRequirements; v != nil {
+		tfMap["resource_requirement"] = flattenECSResourceRequirements(v)
+	}
+
+	return tfMap
+}
+
+func flattenECSContainerOverrides(apiObjects []types.EcsContainerOverride) []interface{} {
+	if len(apiObjects) == 0 {
+		return nil
+	}
+
+	var tfList []interface{}
+
+	for _, apiObject := range apiObjects {
+		tfList = append(tfList, flattenECSContainerOverride(apiObject))
+	}
+
+	return tfList
+}
+
+func flattenECSResourceRequirement(apiObject types.EcsResourceRequirement) map[string]interface{} {
+	tfMap := map[string]interface{}{}
+
+	if v := apiObject.Type; v != "" {
+		tfMap["name"] = v
+	}
+
+	if v := apiObject.Value; v != nil {
+		tfMap["value"] = aws.ToString(v)
+	}
+
+	return tfMap
+}
+
+func flattenECSResourceRequirements(apiObjects []types.EcsResourceRequirement) []interface{} {
+	if len(apiObjects) == 0 {
+		return nil
+	}
+
+	var tfList []interface{}
+
+	for _, apiObject := range apiObjects {
+		tfList = append(tfList, flattenECSResourceRequirement(apiObject))
+	}
+
+	return tfList
+}
+
+func flattenECSEnvironmentFile(apiObject types.EcsEnvironmentFile) map[string]interface{} {
+	tfMap := map[string]interface{}{}
+
+	if v := apiObject.Type; v != "" {
+		tfMap["name"] = v
+	}
+
+	if v := apiObject.Value; v != nil {
+		tfMap["value"] = aws.ToString(v)
+	}
+
+	return tfMap
+}
+
+func flattenECSEnvironmentVariable(apiObject types.EcsEnvironmentVariable) map[string]interface{} {
+	tfMap := map[string]interface{}{}
+
+	if v := apiObject.Name; v != nil {
+		tfMap["name"] = aws.ToString(v)
+	}
+
+	if v := apiObject.Value; v != nil {
+		tfMap["value"] = aws.ToString(v)
+	}
+
+	return tfMap
+}
+
+func flattenECSEnvironmentVariables(apiObjects []types.EcsEnvironmentVariable) []interface{} {
+	if len(apiObjects) == 0 {
+		return nil
+	}
+
+	var tfList []interface{}
+
+	for _, apiObject := range apiObjects {
+		tfList = append(tfList, flattenECSEnvironmentVariable(apiObject))
+	}
+
+	return tfList
+}
+
+func flattenECSEnvironmentFiles(apiObjects []types.EcsEnvironmentFile) []interface{} {
+	if len(apiObjects) == 0 {
+		return nil
+	}
+
+	var tfList []interface{}
+
+	for _, apiObject := range apiObjects {
+		tfList = append(tfList, flattenECSEnvironmentFile(apiObject))
+	}
+
+	return tfList
+}
+
+func flattenECSEphemeralStorage(apiObject *types.EcsEphemeralStorage) map[string]interface{} {
+	if apiObject == nil {
+		return nil
+	}
+
+	tfMap := map[string]interface{}{
+		"size_in_gib": apiObject.SizeInGiB,
+	}
+
+	return tfMap
+}
+
+func flattenECSInferenceAcceleratorOverride(apiObject types.EcsInferenceAcceleratorOverride) map[string]interface{} {
+	tfMap := map[string]interface{}{}
+
+	if v := apiObject.DeviceName; v != nil {
+		tfMap["device_name"] = aws.ToString(v)
+	}
+
+	if v := apiObject.DeviceType; v != nil {
+		tfMap["device_type"] = aws.ToString(v)
+	}
+
+	return tfMap
+}
+
+func flattenECSInferenceAcceleratorOverrides(apiObjects []types.EcsInferenceAcceleratorOverride) []interface{} {
+	if len(apiObjects) == 0 {
+		return nil
+	}
+
+	var tfList []interface{}
+
+	for _, apiObject := range apiObjects {
+		tfList = append(tfList, flattenECSInferenceAcceleratorOverride(apiObject))
+	}
+
+	return tfList
+}
+
+func flattenNetworkConfiguration(apiObject *types.NetworkConfiguration) map[string]interface{} {
+	if apiObject == nil {
+		return nil
+	}
+
+	tfMap := map[string]interface{}{}
+
+	if v := apiObject.AwsvpcConfiguration; v != nil {
+		tfMap["aws_vpc_configuration"] = []interface{}{flattenVPCConfiguration(v)}
+	}
+
+	return tfMap
+}
+
+func flattenVPCConfiguration(apiObject *types.AwsVpcConfiguration) map[string]interface{} {
+	if apiObject == nil {
+		return nil
+	}
+
+	tfMap := map[string]interface{}{}
+
+	if v := apiObject.AssignPublicIp; v != "" {
+		tfMap["assign_public_ip"] = v
+	}
+
+	if v := apiObject.SecurityGroups; v != nil {
+		tfMap["security_groups"] = v
+	}
+
+	if v := apiObject.Subnets; v != nil {
+		tfMap["subnets"] = v
+	}
+
+	return tfMap
+}
+
+func flattenPlacementConstraint(apiObject types.PlacementConstraint) map[string]interface{} {
+	tfMap := map[string]interface{}{}
+
+	if v := apiObject.Expression; v != nil {
+		tfMap["expression"] = aws.ToString(v)
+	}
+
+	if v := apiObject.Type; v != "" {
+		tfMap["type"] = v
+	}
+
+	return tfMap
+}
+
+func flattenPlacementConstraints(apiObjects []types.PlacementConstraint) []interface{} {
+	if len(apiObjects) == 0 {
+		return nil
+	}
+
+	var tfList []interface{}
+
+	for _, apiObject := range apiObjects {
+		tfList = append(tfList, flattenPlacementConstraint(apiObject))
+	}
+
+	return tfList
+}
+
+func flattenPlacementStrategy(apiObject types.PlacementStrategy) map[string]interface{} {
+	tfMap := map[string]interface{}{}
+
+	if v := apiObject.Field; v != nil {
+		tfMap["field"] = aws.ToString(v)
+	}
+
+	if v := apiObject.Type; v != "" {
+		tfMap["type"] = v
+	}
+
+	return tfMap
+}
+
+func flattenPlacementStrategies(apiObjects []types.PlacementStrategy) []interface{} {
+	if len(apiObjects) == 0 {
+		return nil
+	}
+
+	var tfList []interface{}
+
+	for _, apiObject := range apiObjects {
+		tfList = append(tfList, flattenPlacementStrategy(apiObject))
+	}
+
+	return tfList
+}
+
+func flattenPipeTargetEventBridgeEventBusParameters(apiObject *types.PipeTargetEventBridgeEventBusParameters) map[string]interface{} {
+	if apiObject == nil {
+		return nil
+	}
+
+	tfMap := map[string]interface{}{}
+
+	if v := apiObject.DetailType; v != nil {
+		tfMap["detail_type"] = aws.ToString(v)
+	}
+
+	if v := apiObject.EndpointId; v != nil {
+		tfMap["endpoint_id"] = aws.ToString(v)
+	}
+
+	if v := apiObject.Resources; v != nil {
+		tfMap["resources"] = v
+	}
+
+	if v := apiObject.Source; v != nil {
+		tfMap["source"] = aws.ToString(v)
+	}
+
+	if v := apiObject.Time; v != nil {
+		tfMap["time"] = aws.ToString(v)
+	}
+
+	return tfMap
+}
+
+func flattenPipeTargetHTTPParameters(apiObject *types.PipeTargetHttpParameters) map[string]interface{} {
+	if apiObject == nil {
+		return nil
+	}
+
+	tfMap := map[string]interface{}{}
+
+	if v := apiObject.HeaderParameters; v != nil {
+		tfMap["header_parameters"] = v
+	}
+
+	if v := apiObject.PathParameterValues; v != nil {
+		tfMap["path_parameter_values"] = v
+	}
+
+	if v := apiObject.QueryStringParameters; v != nil {
+		tfMap["query_string_parameters"] = v
+	}
+
+	return tfMap
+}
+
+func flattenPipeTargetKinesisStreamParameters(apiObject *types.PipeTargetKinesisStreamParameters) map[string]interface{} {
+	if apiObject == nil {
+		return nil
+	}
+
+	tfMap := map[string]interface{}{}
+
+	if v := apiObject.PartitionKey; v != nil {
+		tfMap["partition_key"] = aws.ToString(v)
+	}
+
+	return tfMap
+}
+
+func flattenPipeTargetLambdaFunctionParameters(apiObject *types.PipeTargetLambdaFunctionParameters) map[string]interface{} {
+	if apiObject == nil {
+		return nil
+	}
+
+	tfMap := map[string]interface{}{}
+
+	if v := apiObject.InvocationType; v != "" {
+		tfMap["invocation_type"] = v
+	}
+
+	return tfMap
+}
+
+func flattenPipeTargetRedshiftDataParameters(apiObject *types.PipeTargetRedshiftDataParameters) map[string]interface{} {
+	if apiObject == nil {
+		return nil
+	}
+
+	tfMap := map[string]interface{}{
+		"with_event": apiObject.WithEvent,
+	}
+
+	if v := apiObject.Database; v != nil {
+		tfMap["database"] = aws.ToString(v)
+	}
+
+	if v := apiObject.DbUser; v != nil {
+		tfMap["db_user"] = aws.ToString(v)
+	}
+
+	if v := apiObject.SecretManagerArn; v != nil {
+		tfMap["secret_manager_arn"] = aws.ToString(v)
+	}
+
+	if v := apiObject.Sqls; v != nil {
+		tfMap["sqls"] = v
+	}
+
+	if v := apiObject.StatementName; v != nil {
+		tfMap["statement_name"] = aws.ToString(v)
+	}
+
+	return tfMap
+}
+
+func flattenPipeTargetSageMakerPipelineParameters(apiObject *types.PipeTargetSageMakerPipelineParameters) map[string]interface{} {
+	if apiObject == nil {
+		return nil
+	}
+
+	tfMap := map[string]interface{}{}
+
+	if v := apiObject.PipelineParameterList; v != nil {
+		tfMap["pipeline_parameter"] = flattenSageMakerPipelineParameters(v)
+	}
+
+	return tfMap
+}
+
+func flattenSageMakerPipelineParameter(apiObject types.SageMakerPipelineParameter) map[string]interface{} {
+	tfMap := map[string]interface{}{}
+
+	if v := apiObject.Name; v != nil {
+		tfMap["name"] = aws.ToString(v)
+	}
+
+	if v := apiObject.Value; v != nil {
+		tfMap["value"] = aws.ToString(v)
+	}
+
+	return tfMap
+}
+
+func flattenSageMakerPipelineParameters(apiObjects []types.SageMakerPipelineParameter) []interface{} {
+	if len(apiObjects) == 0 {
+		return nil
+	}
+
+	var tfList []interface{}
+
+	for _, apiObject := range apiObjects {
+		tfList = append(tfList, flattenSageMakerPipelineParameter(apiObject))
+	}
+
+	return tfList
+}
+
+func flattenPipeTargetSQSQueueParameters(apiObject *types.PipeTargetSqsQueueParameters) map[string]interface{} {
+	if apiObject == nil {
+		return nil
+	}
+
+	tfMap := map[string]interface{}{}
+
+	if v := apiObject.MessageDeduplicationId; v != nil {
+		tfMap["message_deduplication_id"] = aws.ToString(v)
+	}
+
+	if v := apiObject.MessageGroupId; v != nil {
+		tfMap["message_group_id"] = aws.ToString(v)
+	}
+
+	return tfMap
+}
+
+func flattenPipeTargetStateMachineParameters(apiObject *types.PipeTargetStateMachineParameters) map[string]interface{} {
+	if apiObject == nil {
+		return nil
+	}
+
+	tfMap := map[string]interface{}{}
+
+	if v := apiObject.InvocationType; v != "" {
+		tfMap["invocation_type"] = v
+	}
+
+	return tfMap
+}
diff --git a/internal/service/pipes/test-fixtures/lambdatest.zip b/internal/service/pipes/test-fixtures/lambdatest.zip
new file mode 100644
index 00000000000..5c636e955b2
Binary files /dev/null and b/internal/service/pipes/test-fixtures/lambdatest.zip differ
diff --git a/internal/service/pipes/wait.go b/internal/service/pipes/wait.go
deleted file mode 100644
index 16f5cf03146..00000000000
--- a/internal/service/pipes/wait.go
+++ /dev/null
@@ -1,70 +0,0 @@
-package pipes
-
-import (
-	"context"
-	"errors"
-	"time"
-
-	"github.com/aws/aws-sdk-go-v2/aws"
-	"github.com/aws/aws-sdk-go-v2/service/pipes"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
-	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
-)
-
-func waitPipeCreated(ctx context.Context, conn *pipes.Client, id string, timeout time.Duration) (*pipes.DescribePipeOutput, error) {
-	stateConf := &retry.StateChangeConf{
-		Pending:                   []string{pipeStatusCreating},
-		Target:                    []string{pipeStatusRunning, pipeStatusStopped},
-		Refresh:                   statusPipe(ctx, conn, id),
-		Timeout:                   timeout,
-		NotFoundChecks:            20,
-		ContinuousTargetOccurence: 1,
-	}
-
-	outputRaw, err := stateConf.WaitForStateContext(ctx)
-	if output, ok := outputRaw.(*pipes.DescribePipeOutput); ok {
-		tfresource.SetLastError(err, errors.New(aws.ToString(output.StateReason)))
-
-		return output, err
-	}
-
-	return nil, err
-}
-
-func waitPipeUpdated(ctx context.Context, conn *pipes.Client, id string, timeout time.Duration) (*pipes.DescribePipeOutput, error) {
-	stateConf := &retry.StateChangeConf{
-		Pending:                   []string{pipeStatusUpdating},
-		Target:                    []string{pipeStatusRunning, pipeStatusStopped},
-		Refresh:                   statusPipe(ctx, conn, id),
-		Timeout:                   timeout,
-		NotFoundChecks:            20,
-		ContinuousTargetOccurence: 1,
-	}
-
-	outputRaw, err := stateConf.WaitForStateContext(ctx)
-	if output, ok := outputRaw.(*pipes.DescribePipeOutput); ok {
-		tfresource.SetLastError(err, errors.New(aws.ToString(output.StateReason)))
-
-		return output, err
-	}
-
-	return nil, err
-}
-
-func waitPipeDeleted(ctx context.Context, conn *pipes.Client, id string, timeout time.Duration) (*pipes.DescribePipeOutput, error) {
-	stateConf := &retry.StateChangeConf{
-		Pending: []string{pipeStatusDeleting},
-		Target:  []string{},
-		Refresh: statusPipe(ctx, conn, id),
-		Timeout: timeout,
-	}
-
-	outputRaw, err := stateConf.WaitForStateContext(ctx)
-	if output, ok := outputRaw.(*pipes.DescribePipeOutput); ok {
-		tfresource.SetLastError(err, errors.New(aws.ToString(output.StateReason)))
-
-		return output, err
-	}
-
-	return nil, err
-}
diff --git a/internal/service/pricing/generate.go b/internal/service/pricing/generate.go
index aa75ffa7f5d..7c35d32d910 100644
--- a/internal/service/pricing/generate.go
+++ b/internal/service/pricing/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
 
diff --git a/internal/service/pricing/product_data_source.go b/internal/service/pricing/product_data_source.go
index 67957d5e13d..42b818e0e33 100644
--- a/internal/service/pricing/product_data_source.go
+++ b/internal/service/pricing/product_data_source.go
@@ -1,13 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package pricing
 
 import (
 	"context"
-	"encoding/json"
 	"fmt"
-	"log"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/pricing"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/pricing"
+	"github.com/aws/aws-sdk-go-v2/service/pricing/types"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
@@ -16,14 +18,11 @@ import (
 )
 
 // @SDKDataSource("aws_pricing_product")
-func DataSourceProduct() *schema.Resource {
+func dataSourceProduct() *schema.Resource {
 	return &schema.Resource{
 		ReadWithoutTimeout: dataSourceProductRead,
+
 		Schema: map[string]*schema.Schema{
-			"service_code": {
-				Type:     schema.TypeString,
-				Required: true,
-			},
 			"filters": {
 				Type:     schema.TypeList,
 				Required: true,
@@ -45,53 +44,47 @@ func DataSourceProduct() *schema.Resource {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
+			"service_code": {
+				Type:     schema.TypeString,
+				Required: true,
+			},
 		},
 	}
 }
 
 func dataSourceProductRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).PricingConn(ctx)
+	conn := meta.(*conns.AWSClient).PricingClient(ctx)
 
-	params := &pricing.GetProductsInput{
+	input := &pricing.GetProductsInput{
+		Filters:     []types.Filter{},
 		ServiceCode: aws.String(d.Get("service_code").(string)),
-		Filters:     []*pricing.Filter{},
 	}
 
 	filters := d.Get("filters")
 	for _, v := range filters.([]interface{}) {
 		m := v.(map[string]interface{})
-		params.Filters = append(params.Filters, &pricing.Filter{
+		input.Filters = append(input.Filters, types.Filter{
 			Field: aws.String(m["field"].(string)),
+			Type:  types.FilterTypeTermMatch,
 			Value: aws.String(m["value"].(string)),
-			Type:  aws.String(pricing.FilterTypeTermMatch),
 		})
 	}
 
-	log.Printf("[DEBUG] Reading pricing of products: %s", params)
-	resp, err := conn.GetProductsWithContext(ctx, params)
+	output, err := conn.GetProducts(ctx, input)
+
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "reading pricing of products: %s", err)
+		return sdkdiag.AppendErrorf(diags, "reading Pricing Products: %s", err)
 	}
 
-	numberOfElements := len(resp.PriceList)
-	if numberOfElements == 0 {
+	if numberOfElements := len(output.PriceList); numberOfElements == 0 {
 		return sdkdiag.AppendErrorf(diags, "Pricing product query did not return any elements")
 	} else if numberOfElements > 1 {
-		priceListBytes, err := json.Marshal(resp.PriceList)
-		priceListString := string(priceListBytes)
-		if err != nil {
-			priceListString = err.Error()
-		}
-		return sdkdiag.AppendErrorf(diags, "Pricing product query not precise enough. Returned more than one element: %s", priceListString)
+		return sdkdiag.AppendErrorf(diags, "Pricing product query not precise enough. Returned %d elements", numberOfElements)
 	}
 
-	pricingResult, err := json.Marshal(resp.PriceList[0])
-	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "Invalid JSON value returned by AWS: %s", err)
-	}
+	d.SetId(fmt.Sprintf("%d", create.StringHashcode(fmt.Sprintf("%#v", input))))
+	d.Set("result", output.PriceList[0])
 
-	d.SetId(fmt.Sprintf("%d", create.StringHashcode(params.String())))
-	d.Set("result", string(pricingResult))
 	return diags
 }
diff --git a/internal/service/pricing/product_data_source_test.go b/internal/service/pricing/product_data_source_test.go
index 10ba8a5e5b8..d8d70cd949a 100644
--- a/internal/service/pricing/product_data_source_test.go
+++ b/internal/service/pricing/product_data_source_test.go
@@ -1,15 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package pricing_test
 
 import (
-	"encoding/json"
-	"errors"
-	"fmt"
 	"testing"
 
 	"github.com/aws/aws-sdk-go/aws/endpoints"
-	"github.com/aws/aws-sdk-go/service/pricing"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
+	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
 func TestAccPricingProductDataSource_ec2(t *testing.T) {
@@ -21,13 +21,13 @@ func TestAccPricingProductDataSource_ec2(t *testing.T) {
 			acctest.PreCheck(ctx, t)
 			acctest.PreCheckRegion(t, endpoints.UsEast1RegionID, endpoints.ApSouth1RegionID)
 		},
-		ErrorCheck:               acctest.ErrorCheck(t, pricing.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.PricingEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccProductDataSourceConfig_ec2,
 				Check: resource.ComposeAggregateTestCheckFunc(
-					resource.TestCheckResourceAttrWith(dataSourceName, "result", testAccCheckValueIsJSON),
+					acctest.CheckResourceAttrIsJSONString(dataSourceName, "result"),
 				),
 			},
 		},
@@ -43,13 +43,13 @@ func TestAccPricingProductDataSource_redshift(t *testing.T) {
 			acctest.PreCheck(ctx, t)
 			acctest.PreCheckRegion(t, endpoints.UsEast1RegionID, endpoints.ApSouth1RegionID)
 		},
-		ErrorCheck:               acctest.ErrorCheck(t, pricing.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.PricingEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccProductDataSourceConfig_redshift,
 				Check: resource.ComposeAggregateTestCheckFunc(
-					resource.TestCheckResourceAttrWith(dataSourceName, "result", testAccCheckValueIsJSON),
+					acctest.CheckResourceAttrIsJSONString(dataSourceName, "result"),
 				),
 			},
 		},
@@ -129,17 +129,3 @@ data "aws_pricing_product" "test" {
   }
 }
 `
-
-func testAccCheckValueIsJSON(v string) error {
-	var m map[string]*json.RawMessage
-
-	if err := json.Unmarshal([]byte(v), &m); err != nil {
-		return fmt.Errorf("parsing JSON: %s", err)
-	}
-
-	if len(m) == 0 {
-		return errors.New(`empty JSON`)
-	}
-
-	return nil
-}
diff --git a/internal/service/pricing/service_package_gen.go b/internal/service/pricing/service_package_gen.go
index 69dc525c0b3..bf36d86f220 100644
--- a/internal/service/pricing/service_package_gen.go
+++ b/internal/service/pricing/service_package_gen.go
@@ -5,9 +5,9 @@ package pricing
 import (
 	"context"
 
-	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
-	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
-	pricing_sdkv1 "github.com/aws/aws-sdk-go/service/pricing"
+	aws_sdkv2 "github.com/aws/aws-sdk-go-v2/aws"
+	pricing_sdkv2 "github.com/aws/aws-sdk-go-v2/service/pricing"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -25,7 +25,7 @@ func (p *servicePackage) FrameworkResources(ctx context.Context) []*types.Servic
 func (p *servicePackage) SDKDataSources(ctx context.Context) []*types.ServicePackageSDKDataSource {
 	return []*types.ServicePackageSDKDataSource{
 		{
-			Factory:  DataSourceProduct,
+			Factory:  dataSourceProduct,
 			TypeName: "aws_pricing_product",
 		},
 	}
@@ -39,11 +39,17 @@ func (p *servicePackage) ServicePackageName() string {
 	return names.Pricing
 }
 
-// NewConn returns a new AWS SDK for Go v1 client for this service package's AWS API.
-func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*pricing_sdkv1.Pricing, error) {
-	sess := config["session"].(*session_sdkv1.Session)
+// NewClient returns a new AWS SDK for Go v2 client for this service package's AWS API.
+func (p *servicePackage) NewClient(ctx context.Context, config map[string]any) (*pricing_sdkv2.Client, error) {
+	cfg := *(config["aws_sdkv2_config"].(*aws_sdkv2.Config))
 
-	return pricing_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
+	return pricing_sdkv2.NewFromConfig(cfg, func(o *pricing_sdkv2.Options) {
+		if endpoint := config["endpoint"].(string); endpoint != "" {
+			o.BaseEndpoint = aws_sdkv2.String(endpoint)
+		}
+	}), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/qldb/exports_test.go b/internal/service/qldb/exports_test.go
new file mode 100644
index 00000000000..3ab1ddafa11
--- /dev/null
+++ b/internal/service/qldb/exports_test.go
@@ -0,0 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package qldb
+
+// Exports for use in tests only.
+var (
+	FindLedgerByName       = findLedgerByName
+	FindStreamByTwoPartKey = findStreamByTwoPartKey
+
+	ResourceLedger = resourceLedger
+	ResourceStream = resourceStream
+)
diff --git a/internal/service/qldb/generate.go b/internal/service/qldb/generate.go
index b49dd56d173..ef17f2e8f29 100644
--- a/internal/service/qldb/generate.go
+++ b/internal/service/qldb/generate.go
@@ -1,4 +1,7 @@
-//go:generate go run ../../generate/tags/main.go -ListTags -ServiceTagsMap -UpdateTags
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+//go:generate go run ../../generate/tags/main.go -AWSSDKVersion=2 -ListTags -ServiceTagsMap -UpdateTags -SkipTypesImp
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
 
diff --git a/internal/service/qldb/ledger.go b/internal/service/qldb/ledger.go
index 577662113a1..a52bb31dae8 100644
--- a/internal/service/qldb/ledger.go
+++ b/internal/service/qldb/ledger.go
@@ -1,20 +1,25 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package qldb
 
 import (
 	"context"
 	"log"
-	"regexp"
 	"time"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/qldb"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/YakDriver/regexache"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/qldb"
+	"github.com/aws/aws-sdk-go-v2/service/qldb/types"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/create"
+	"github.com/hashicorp/terraform-provider-aws/internal/enum"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
@@ -23,7 +28,7 @@ import (
 
 // @SDKResource("aws_qldb_ledger", name="Ledger")
 // @Tags(identifierAttribute="arn")
-func ResourceLedger() *schema.Resource {
+func resourceLedger() *schema.Resource {
 	return &schema.Resource{
 		CreateWithoutTimeout: resourceLedgerCreate,
 		ReadWithoutTimeout:   resourceLedgerRead,
@@ -65,13 +70,13 @@ func ResourceLedger() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 32),
-					validation.StringMatch(regexp.MustCompile(`^[A-Za-z0-9_-]+`), "must contain only alphanumeric characters, underscores, and hyphens"),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_-]+`), "must contain only alphanumeric characters, underscores, and hyphens"),
 				),
 			},
 			"permissions_mode": {
-				Type:         schema.TypeString,
-				Required:     true,
-				ValidateFunc: validation.StringInSlice(qldb.PermissionsMode_Values(), false),
+				Type:             schema.TypeString,
+				Required:         true,
+				ValidateDiagFunc: enum.Validate[types.PermissionsMode](),
 			},
 			names.AttrTags:    tftags.TagsSchema(),
 			names.AttrTagsAll: tftags.TagsSchemaComputed(),
@@ -82,13 +87,13 @@ func ResourceLedger() *schema.Resource {
 }
 
 func resourceLedgerCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).QLDBConn(ctx)
+	conn := meta.(*conns.AWSClient).QLDBClient(ctx)
 
 	name := create.Name(d.Get("name").(string), "tf")
 	input := &qldb.CreateLedgerInput{
 		DeletionProtection: aws.Bool(d.Get("deletion_protection").(bool)),
 		Name:               aws.String(name),
-		PermissionsMode:    aws.String(d.Get("permissions_mode").(string)),
+		PermissionsMode:    types.PermissionsMode(d.Get("permissions_mode").(string)),
 		Tags:               getTagsIn(ctx),
 	}
 
@@ -96,16 +101,15 @@ func resourceLedgerCreate(ctx context.Context, d *schema.ResourceData, meta inte
 		input.KmsKey = aws.String(v.(string))
 	}
 
-	log.Printf("[DEBUG] Creating QLDB Ledger: %s", input)
-	output, err := conn.CreateLedgerWithContext(ctx, input)
+	output, err := conn.CreateLedger(ctx, input)
 
 	if err != nil {
 		return diag.Errorf("creating QLDB Ledger (%s): %s", name, err)
 	}
 
-	d.SetId(aws.StringValue(output.Name))
+	d.SetId(aws.ToString(output.Name))
 
-	if _, err := waitLedgerCreated(ctx, conn, d.Timeout(schema.TimeoutCreate), d.Id()); err != nil {
+	if _, err := waitLedgerCreated(ctx, conn, d.Id(), d.Timeout(schema.TimeoutCreate)); err != nil {
 		return diag.Errorf("waiting for QLDB Ledger (%s) create: %s", d.Id(), err)
 	}
 
@@ -113,9 +117,9 @@ func resourceLedgerCreate(ctx context.Context, d *schema.ResourceData, meta inte
 }
 
 func resourceLedgerRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).QLDBConn(ctx)
+	conn := meta.(*conns.AWSClient).QLDBClient(ctx)
 
-	ledger, err := FindLedgerByName(ctx, conn, d.Id())
+	ledger, err := findLedgerByName(ctx, conn, d.Id())
 
 	if !d.IsNewResource() && tfresource.NotFound(err) {
 		log.Printf("[WARN] QLDB Ledger %s not found, removing from state", d.Id())
@@ -141,16 +145,15 @@ func resourceLedgerRead(ctx context.Context, d *schema.ResourceData, meta interf
 }
 
 func resourceLedgerUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).QLDBConn(ctx)
+	conn := meta.(*conns.AWSClient).QLDBClient(ctx)
 
 	if d.HasChange("permissions_mode") {
 		input := &qldb.UpdateLedgerPermissionsModeInput{
 			Name:            aws.String(d.Id()),
-			PermissionsMode: aws.String(d.Get("permissions_mode").(string)),
+			PermissionsMode: types.PermissionsMode(d.Get("permissions_mode").(string)),
 		}
 
-		log.Printf("[INFO] Updating QLDB Ledger permissions mode: %s", input)
-		if _, err := conn.UpdateLedgerPermissionsModeWithContext(ctx, input); err != nil {
+		if _, err := conn.UpdateLedgerPermissionsMode(ctx, input); err != nil {
 			return diag.Errorf("updating QLDB Ledger (%s) permissions mode: %s", d.Id(), err)
 		}
 	}
@@ -165,8 +168,7 @@ func resourceLedgerUpdate(ctx context.Context, d *schema.ResourceData, meta inte
 			input.KmsKey = aws.String(d.Get("kms_key").(string))
 		}
 
-		log.Printf("[INFO] Updating QLDB Ledger: %s", input)
-		if _, err := conn.UpdateLedgerWithContext(ctx, input); err != nil {
+		if _, err := conn.UpdateLedger(ctx, input); err != nil {
 			return diag.Errorf("updating QLDB Ledger (%s): %s", d.Id(), err)
 		}
 	}
@@ -175,19 +177,18 @@ func resourceLedgerUpdate(ctx context.Context, d *schema.ResourceData, meta inte
 }
 
 func resourceLedgerDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).QLDBConn(ctx)
+	conn := meta.(*conns.AWSClient).QLDBClient(ctx)
 
 	input := &qldb.DeleteLedgerInput{
 		Name: aws.String(d.Id()),
 	}
 
 	log.Printf("[INFO] Deleting QLDB Ledger: %s", d.Id())
-	_, err := tfresource.RetryWhenAWSErrCodeEquals(ctx, 5*time.Minute,
-		func() (interface{}, error) {
-			return conn.DeleteLedgerWithContext(ctx, input)
-		}, qldb.ErrCodeResourceInUseException)
+	_, err := tfresource.RetryWhenIsA[*types.ResourceInUseException](ctx, d.Timeout(schema.TimeoutDelete), func() (interface{}, error) {
+		return conn.DeleteLedger(ctx, input)
+	})
 
-	if tfawserr.ErrCodeEquals(err, qldb.ErrCodeResourceNotFoundException) {
+	if errs.IsA[*types.ResourceNotFoundException](err) {
 		return nil
 	}
 
@@ -195,21 +196,21 @@ func resourceLedgerDelete(ctx context.Context, d *schema.ResourceData, meta inte
 		return diag.Errorf("deleting QLDB Ledger (%s): %s", d.Id(), err)
 	}
 
-	if _, err := waitLedgerDeleted(ctx, conn, d.Timeout(schema.TimeoutDelete), d.Id()); err != nil {
+	if _, err := waitLedgerDeleted(ctx, conn, d.Id(), d.Timeout(schema.TimeoutDelete)); err != nil {
 		return diag.Errorf("waiting for QLDB Ledger (%s) delete: %s", d.Id(), err)
 	}
 
 	return nil
 }
 
-func FindLedgerByName(ctx context.Context, conn *qldb.QLDB, name string) (*qldb.DescribeLedgerOutput, error) {
+func findLedgerByName(ctx context.Context, conn *qldb.Client, name string) (*qldb.DescribeLedgerOutput, error) {
 	input := &qldb.DescribeLedgerInput{
 		Name: aws.String(name),
 	}
 
-	output, err := conn.DescribeLedgerWithContext(ctx, input)
+	output, err := conn.DescribeLedger(ctx, input)
 
-	if tfawserr.ErrCodeEquals(err, qldb.ErrCodeResourceNotFoundException) {
+	if errs.IsA[*types.ResourceNotFoundException](err) {
 		return nil, &retry.NotFoundError{
 			LastError:   err,
 			LastRequest: input,
@@ -224,9 +225,9 @@ func FindLedgerByName(ctx context.Context, conn *qldb.QLDB, name string) (*qldb.
 		return nil, tfresource.NewEmptyResultError(input)
 	}
 
-	if state := aws.StringValue(output.State); state == qldb.LedgerStateDeleted {
+	if state := output.State; state == types.LedgerStateDeleted {
 		return nil, &retry.NotFoundError{
-			Message:     state,
+			Message:     string(state),
 			LastRequest: input,
 		}
 	}
@@ -234,9 +235,9 @@ func FindLedgerByName(ctx context.Context, conn *qldb.QLDB, name string) (*qldb.
 	return output, nil
 }
 
-func statusLedgerState(ctx context.Context, conn *qldb.QLDB, name string) retry.StateRefreshFunc {
+func statusLedgerState(ctx context.Context, conn *qldb.Client, name string) retry.StateRefreshFunc {
 	return func() (interface{}, string, error) {
-		output, err := FindLedgerByName(ctx, conn, name)
+		output, err := findLedgerByName(ctx, conn, name)
 
 		if tfresource.NotFound(err) {
 			return nil, "", nil
@@ -246,14 +247,14 @@ func statusLedgerState(ctx context.Context, conn *qldb.QLDB, name string) retry.
 			return nil, "", err
 		}
 
-		return output, aws.StringValue(output.State), nil
+		return output, string(output.State), nil
 	}
 }
 
-func waitLedgerCreated(ctx context.Context, conn *qldb.QLDB, timeout time.Duration, name string) (*qldb.DescribeLedgerOutput, error) {
+func waitLedgerCreated(ctx context.Context, conn *qldb.Client, name string, timeout time.Duration) (*qldb.DescribeLedgerOutput, error) {
 	stateConf := &retry.StateChangeConf{
-		Pending:    []string{qldb.LedgerStateCreating},
-		Target:     []string{qldb.LedgerStateActive},
+		Pending:    enum.Slice(types.LedgerStateCreating),
+		Target:     enum.Slice(types.LedgerStateActive),
 		Refresh:    statusLedgerState(ctx, conn, name),
 		Timeout:    timeout,
 		MinTimeout: 3 * time.Second,
@@ -268,9 +269,9 @@ func waitLedgerCreated(ctx context.Context, conn *qldb.QLDB, timeout time.Durati
 	return nil, err
 }
 
-func waitLedgerDeleted(ctx context.Context, conn *qldb.QLDB, timeout time.Duration, name string) (*qldb.DescribeLedgerOutput, error) {
+func waitLedgerDeleted(ctx context.Context, conn *qldb.Client, name string, timeout time.Duration) (*qldb.DescribeLedgerOutput, error) {
 	stateConf := &retry.StateChangeConf{
-		Pending:    []string{qldb.LedgerStateActive, qldb.LedgerStateDeleting},
+		Pending:    enum.Slice(types.LedgerStateActive, types.LedgerStateDeleting),
 		Target:     []string{},
 		Refresh:    statusLedgerState(ctx, conn, name),
 		Timeout:    timeout,
diff --git a/internal/service/qldb/ledger_data_source.go b/internal/service/qldb/ledger_data_source.go
index 75669325ec2..ffce497a507 100644
--- a/internal/service/qldb/ledger_data_source.go
+++ b/internal/service/qldb/ledger_data_source.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package qldb
 
 import (
 	"context"
-	"regexp"
 
-	"github.com/aws/aws-sdk-go/aws"
+	"github.com/YakDriver/regexache"
+	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
@@ -13,7 +16,7 @@ import (
 )
 
 // @SDKDataSource("aws_qldb_ledger")
-func DataSourceLedger() *schema.Resource {
+func dataSourceLedger() *schema.Resource {
 	return &schema.Resource{
 		ReadWithoutTimeout: dataSourceLedgerRead,
 
@@ -35,7 +38,7 @@ func DataSourceLedger() *schema.Resource {
 				Required: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 32),
-					validation.StringMatch(regexp.MustCompile(`^[A-Za-z0-9_-]+`), "must contain only alphanumeric characters, underscores, and hyphens"),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_-]+`), "must contain only alphanumeric characters, underscores, and hyphens"),
 				),
 			},
 			"permissions_mode": {
@@ -48,17 +51,17 @@ func DataSourceLedger() *schema.Resource {
 }
 
 func dataSourceLedgerRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).QLDBConn(ctx)
+	conn := meta.(*conns.AWSClient).QLDBClient(ctx)
 	ignoreTagsConfig := meta.(*conns.AWSClient).IgnoreTagsConfig
 
 	name := d.Get("name").(string)
-	ledger, err := FindLedgerByName(ctx, conn, name)
+	ledger, err := findLedgerByName(ctx, conn, name)
 
 	if err != nil {
 		return diag.Errorf("reading QLDB Ledger (%s): %s", name, err)
 	}
 
-	d.SetId(aws.StringValue(ledger.Name))
+	d.SetId(aws.ToString(ledger.Name))
 	d.Set("arn", ledger.Arn)
 	d.Set("deletion_protection", ledger.DeletionProtection)
 	if ledger.EncryptionDescription != nil {
diff --git a/internal/service/qldb/ledger_data_source_test.go b/internal/service/qldb/ledger_data_source_test.go
index 7fbe88cce9f..e93a8f252cb 100644
--- a/internal/service/qldb/ledger_data_source_test.go
+++ b/internal/service/qldb/ledger_data_source_test.go
@@ -1,13 +1,16 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package qldb_test
 
 import (
 	"fmt"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/service/qldb"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
+	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
 func TestAccQLDBLedgerDataSource_basic(t *testing.T) {
@@ -17,8 +20,8 @@ func TestAccQLDBLedgerDataSource_basic(t *testing.T) {
 	datasourceName := "data.aws_qldb_ledger.test"
 
 	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, qldb.EndpointsID) },
-		ErrorCheck:               acctest.ErrorCheck(t, qldb.EndpointsID),
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, names.QLDBEndpointID) },
+		ErrorCheck:               acctest.ErrorCheck(t, names.QLDBEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		Steps: []resource.TestStep{
 			{
@@ -44,7 +47,7 @@ resource "aws_qldb_ledger" "test" {
   deletion_protection = false
 
   tags = {
-    Env = "test"
+    Name = %[1]q
   }
 }
 
diff --git a/internal/service/qldb/ledger_test.go b/internal/service/qldb/ledger_test.go
index 415200b7a52..36f9137a7b9 100644
--- a/internal/service/qldb/ledger_test.go
+++ b/internal/service/qldb/ledger_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package qldb_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/service/qldb"
+	"github.com/YakDriver/regexache"
+	"github.com/aws/aws-sdk-go-v2/service/qldb"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
@@ -14,6 +17,7 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	tfqldb "github.com/hashicorp/terraform-provider-aws/internal/service/qldb"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
 func TestAccQLDBLedger_basic(t *testing.T) {
@@ -23,8 +27,8 @@ func TestAccQLDBLedger_basic(t *testing.T) {
 	resourceName := "aws_qldb_ledger.test"
 
 	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, qldb.EndpointsID) },
-		ErrorCheck:               acctest.ErrorCheck(t, qldb.EndpointsID),
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, names.QLDBEndpointID) },
+		ErrorCheck:               acctest.ErrorCheck(t, names.QLDBEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckLedgerDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -32,7 +36,7 @@ func TestAccQLDBLedger_basic(t *testing.T) {
 				Config: testAccLedgerConfig_basic(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckLedgerExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "qldb", regexp.MustCompile(`ledger/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "qldb", regexache.MustCompile(`ledger/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "deletion_protection", "false"),
 					resource.TestCheckResourceAttr(resourceName, "kms_key", ""),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
@@ -56,8 +60,8 @@ func TestAccQLDBLedger_disappears(t *testing.T) {
 	resourceName := "aws_qldb_ledger.test"
 
 	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, qldb.EndpointsID) },
-		ErrorCheck:               acctest.ErrorCheck(t, qldb.EndpointsID),
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, names.QLDBEndpointID) },
+		ErrorCheck:               acctest.ErrorCheck(t, names.QLDBEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckLedgerDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -79,8 +83,8 @@ func TestAccQLDBLedger_nameGenerated(t *testing.T) {
 	resourceName := "aws_qldb_ledger.test"
 
 	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, qldb.EndpointsID) },
-		ErrorCheck:               acctest.ErrorCheck(t, qldb.EndpointsID),
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, names.QLDBEndpointID) },
+		ErrorCheck:               acctest.ErrorCheck(t, names.QLDBEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckLedgerDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -88,7 +92,7 @@ func TestAccQLDBLedger_nameGenerated(t *testing.T) {
 				Config: testAccLedgerConfig_nameGenerated(),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckLedgerExists(ctx, resourceName, &v),
-					resource.TestMatchResourceAttr(resourceName, "name", regexp.MustCompile(`tf\d+`)),
+					resource.TestMatchResourceAttr(resourceName, "name", regexache.MustCompile(`tf\d+`)),
 				),
 			},
 			{
@@ -107,8 +111,8 @@ func TestAccQLDBLedger_update(t *testing.T) {
 	resourceName := "aws_qldb_ledger.test"
 
 	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, qldb.EndpointsID) },
-		ErrorCheck:               acctest.ErrorCheck(t, qldb.EndpointsID),
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, names.QLDBEndpointID) },
+		ErrorCheck:               acctest.ErrorCheck(t, names.QLDBEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckLedgerDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -153,8 +157,8 @@ func TestAccQLDBLedger_kmsKey(t *testing.T) {
 	kmsKeyResourceName := "aws_kms_key.test"
 
 	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, qldb.EndpointsID) },
-		ErrorCheck:               acctest.ErrorCheck(t, qldb.EndpointsID),
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, names.QLDBEndpointID) },
+		ErrorCheck:               acctest.ErrorCheck(t, names.QLDBEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckLedgerDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -188,8 +192,8 @@ func TestAccQLDBLedger_tags(t *testing.T) {
 	resourceName := "aws_qldb_ledger.test"
 
 	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, qldb.EndpointsID) },
-		ErrorCheck:               acctest.ErrorCheck(t, qldb.EndpointsID),
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, names.QLDBEndpointID) },
+		ErrorCheck:               acctest.ErrorCheck(t, names.QLDBEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckLedgerDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -229,7 +233,7 @@ func TestAccQLDBLedger_tags(t *testing.T) {
 
 func testAccCheckLedgerDestroy(ctx context.Context) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		conn := acctest.Provider.Meta().(*conns.AWSClient).QLDBConn(ctx)
+		conn := acctest.Provider.Meta().(*conns.AWSClient).QLDBClient(ctx)
 
 		for _, rs := range s.RootModule().Resources {
 			if rs.Type != "aws_qldb_ledger" {
@@ -264,7 +268,7 @@ func testAccCheckLedgerExists(ctx context.Context, n string, v *qldb.DescribeLed
 			return fmt.Errorf("No QLDB Ledger ID is set")
 		}
 
-		conn := acctest.Provider.Meta().(*conns.AWSClient).QLDBConn(ctx)
+		conn := acctest.Provider.Meta().(*conns.AWSClient).QLDBClient(ctx)
 
 		output, err := tfqldb.FindLedgerByName(ctx, conn, rs.Primary.ID)
 
diff --git a/internal/service/qldb/service_package_gen.go b/internal/service/qldb/service_package_gen.go
index 0bdbe1fedcd..1ade7620505 100644
--- a/internal/service/qldb/service_package_gen.go
+++ b/internal/service/qldb/service_package_gen.go
@@ -5,9 +5,9 @@ package qldb
 import (
 	"context"
 
-	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
-	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
-	qldb_sdkv1 "github.com/aws/aws-sdk-go/service/qldb"
+	aws_sdkv2 "github.com/aws/aws-sdk-go-v2/aws"
+	qldb_sdkv2 "github.com/aws/aws-sdk-go-v2/service/qldb"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -25,7 +25,7 @@ func (p *servicePackage) FrameworkResources(ctx context.Context) []*types.Servic
 func (p *servicePackage) SDKDataSources(ctx context.Context) []*types.ServicePackageSDKDataSource {
 	return []*types.ServicePackageSDKDataSource{
 		{
-			Factory:  DataSourceLedger,
+			Factory:  dataSourceLedger,
 			TypeName: "aws_qldb_ledger",
 		},
 	}
@@ -34,7 +34,7 @@ func (p *servicePackage) SDKDataSources(ctx context.Context) []*types.ServicePac
 func (p *servicePackage) SDKResources(ctx context.Context) []*types.ServicePackageSDKResource {
 	return []*types.ServicePackageSDKResource{
 		{
-			Factory:  ResourceLedger,
+			Factory:  resourceLedger,
 			TypeName: "aws_qldb_ledger",
 			Name:     "Ledger",
 			Tags: &types.ServicePackageResourceTags{
@@ -42,7 +42,7 @@ func (p *servicePackage) SDKResources(ctx context.Context) []*types.ServicePacka
 			},
 		},
 		{
-			Factory:  ResourceStream,
+			Factory:  resourceStream,
 			TypeName: "aws_qldb_stream",
 			Name:     "Stream",
 			Tags: &types.ServicePackageResourceTags{
@@ -56,11 +56,17 @@ func (p *servicePackage) ServicePackageName() string {
 	return names.QLDB
 }
 
-// NewConn returns a new AWS SDK for Go v1 client for this service package's AWS API.
-func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*qldb_sdkv1.QLDB, error) {
-	sess := config["session"].(*session_sdkv1.Session)
+// NewClient returns a new AWS SDK for Go v2 client for this service package's AWS API.
+func (p *servicePackage) NewClient(ctx context.Context, config map[string]any) (*qldb_sdkv2.Client, error) {
+	cfg := *(config["aws_sdkv2_config"].(*aws_sdkv2.Config))
 
-	return qldb_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
+	return qldb_sdkv2.NewFromConfig(cfg, func(o *qldb_sdkv2.Options) {
+		if endpoint := config["endpoint"].(string); endpoint != "" {
+			o.BaseEndpoint = aws_sdkv2.String(endpoint)
+		}
+	}), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/qldb/stream.go b/internal/service/qldb/stream.go
index 7bccd0361c0..28e8d9a8ced 100644
--- a/internal/service/qldb/stream.go
+++ b/internal/service/qldb/stream.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package qldb
 
 import (
@@ -6,14 +9,16 @@ import (
 	"log"
 	"time"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/qldb"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/qldb"
+	"github.com/aws/aws-sdk-go-v2/service/qldb/types"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/enum"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
@@ -22,13 +27,18 @@ import (
 
 // @SDKResource("aws_qldb_stream", name="Stream")
 // @Tags(identifierAttribute="arn")
-func ResourceStream() *schema.Resource {
+func resourceStream() *schema.Resource {
 	return &schema.Resource{
 		CreateWithoutTimeout: resourceStreamCreate,
 		ReadWithoutTimeout:   resourceStreamRead,
 		UpdateWithoutTimeout: resourceStreamUpdate,
 		DeleteWithoutTimeout: resourceStreamDelete,
 
+		Timeouts: &schema.ResourceTimeout{
+			Create: schema.DefaultTimeout(8 * time.Minute),
+			Delete: schema.DefaultTimeout(5 * time.Minute),
+		},
+
 		Schema: map[string]*schema.Schema{
 			"arn": {
 				Type:     schema.TypeString,
@@ -99,7 +109,7 @@ func ResourceStream() *schema.Resource {
 }
 
 func resourceStreamCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).QLDBConn(ctx)
+	conn := meta.(*conns.AWSClient).QLDBClient(ctx)
 
 	ledgerName := d.Get("ledger_name").(string)
 	name := d.Get("stream_name").(string)
@@ -124,16 +134,15 @@ func resourceStreamCreate(ctx context.Context, d *schema.ResourceData, meta inte
 		input.KinesisConfiguration = expandKinesisConfiguration(v.([]interface{})[0].(map[string]interface{}))
 	}
 
-	log.Printf("[DEBUG] Creating QLDB Stream: %s", input)
-	output, err := conn.StreamJournalToKinesisWithContext(ctx, input)
+	output, err := conn.StreamJournalToKinesis(ctx, input)
 
 	if err != nil {
 		return diag.Errorf("creating QLDB Stream (%s): %s", name, err)
 	}
 
-	d.SetId(aws.StringValue(output.StreamId))
+	d.SetId(aws.ToString(output.StreamId))
 
-	if _, err := waitStreamCreated(ctx, conn, ledgerName, d.Id()); err != nil {
+	if _, err := waitStreamCreated(ctx, conn, ledgerName, d.Id(), d.Timeout(schema.TimeoutCreate)); err != nil {
 		return diag.Errorf("waiting for QLDB Stream (%s) create: %s", d.Id(), err)
 	}
 
@@ -141,10 +150,10 @@ func resourceStreamCreate(ctx context.Context, d *schema.ResourceData, meta inte
 }
 
 func resourceStreamRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).QLDBConn(ctx)
+	conn := meta.(*conns.AWSClient).QLDBClient(ctx)
 
 	ledgerName := d.Get("ledger_name").(string)
-	stream, err := FindStream(ctx, conn, ledgerName, d.Id())
+	stream, err := findStreamByTwoPartKey(ctx, conn, ledgerName, d.Id())
 
 	if !d.IsNewResource() && tfresource.NotFound(err) {
 		log.Printf("[WARN] QLDB Stream %s not found, removing from state", d.Id())
@@ -158,12 +167,12 @@ func resourceStreamRead(ctx context.Context, d *schema.ResourceData, meta interf
 
 	d.Set("arn", stream.Arn)
 	if stream.ExclusiveEndTime != nil {
-		d.Set("exclusive_end_time", aws.TimeValue(stream.ExclusiveEndTime).Format(time.RFC3339))
+		d.Set("exclusive_end_time", aws.ToTime(stream.ExclusiveEndTime).Format(time.RFC3339))
 	} else {
 		d.Set("exclusive_end_time", nil)
 	}
 	if stream.InclusiveStartTime != nil {
-		d.Set("inclusive_start_time", aws.TimeValue(stream.InclusiveStartTime).Format(time.RFC3339))
+		d.Set("inclusive_start_time", aws.ToTime(stream.InclusiveStartTime).Format(time.RFC3339))
 	} else {
 		d.Set("inclusive_start_time", nil)
 	}
@@ -187,7 +196,7 @@ func resourceStreamUpdate(ctx context.Context, d *schema.ResourceData, meta inte
 }
 
 func resourceStreamDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).QLDBConn(ctx)
+	conn := meta.(*conns.AWSClient).QLDBClient(ctx)
 
 	ledgerName := d.Get("ledger_name").(string)
 	input := &qldb.CancelJournalKinesisStreamInput{
@@ -196,12 +205,11 @@ func resourceStreamDelete(ctx context.Context, d *schema.ResourceData, meta inte
 	}
 
 	log.Printf("[INFO] Deleting QLDB Stream: %s", d.Id())
-	_, err := tfresource.RetryWhenAWSErrCodeEquals(ctx, 5*time.Minute,
-		func() (interface{}, error) {
-			return conn.CancelJournalKinesisStreamWithContext(ctx, input)
-		}, qldb.ErrCodeResourceInUseException)
+	_, err := tfresource.RetryWhenIsA[*types.ResourceInUseException](ctx, d.Timeout(schema.TimeoutDelete), func() (interface{}, error) {
+		return conn.CancelJournalKinesisStream(ctx, input)
+	})
 
-	if tfawserr.ErrCodeEquals(err, qldb.ErrCodeResourceNotFoundException) {
+	if errs.IsA[*types.ResourceNotFoundException](err) {
 		return nil
 	}
 
@@ -209,14 +217,14 @@ func resourceStreamDelete(ctx context.Context, d *schema.ResourceData, meta inte
 		return diag.Errorf("deleting QLDB Stream (%s): %s", d.Id(), err)
 	}
 
-	if _, err := waitStreamDeleted(ctx, conn, ledgerName, d.Id()); err != nil {
+	if _, err := waitStreamDeleted(ctx, conn, ledgerName, d.Id(), d.Timeout(schema.TimeoutDelete)); err != nil {
 		return diag.Errorf("waiting for QLDB Stream (%s) delete: %s", d.Id(), err)
 	}
 
 	return nil
 }
 
-func FindStream(ctx context.Context, conn *qldb.QLDB, ledgerName, streamID string) (*qldb.JournalKinesisStreamDescription, error) {
+func findStreamByTwoPartKey(ctx context.Context, conn *qldb.Client, ledgerName, streamID string) (*types.JournalKinesisStreamDescription, error) {
 	input := &qldb.DescribeJournalKinesisStreamInput{
 		LedgerName: aws.String(ledgerName),
 		StreamId:   aws.String(streamID),
@@ -229,10 +237,10 @@ func FindStream(ctx context.Context, conn *qldb.QLDB, ledgerName, streamID strin
 	}
 
 	// See https://docs.aws.amazon.com/qldb/latest/developerguide/streams.create.html#streams.create.states.
-	switch status := aws.StringValue(output.Status); status {
-	case qldb.StreamStatusCompleted, qldb.StreamStatusCanceled, qldb.StreamStatusFailed:
+	switch status := output.Status; status {
+	case types.StreamStatusCompleted, types.StreamStatusCanceled, types.StreamStatusFailed:
 		return nil, &retry.NotFoundError{
-			Message:     status,
+			Message:     string(status),
 			LastRequest: input,
 		}
 	}
@@ -240,10 +248,10 @@ func FindStream(ctx context.Context, conn *qldb.QLDB, ledgerName, streamID strin
 	return output, nil
 }
 
-func findJournalKinesisStream(ctx context.Context, conn *qldb.QLDB, input *qldb.DescribeJournalKinesisStreamInput) (*qldb.JournalKinesisStreamDescription, error) {
-	output, err := conn.DescribeJournalKinesisStreamWithContext(ctx, input)
+func findJournalKinesisStream(ctx context.Context, conn *qldb.Client, input *qldb.DescribeJournalKinesisStreamInput) (*types.JournalKinesisStreamDescription, error) {
+	output, err := conn.DescribeJournalKinesisStream(ctx, input)
 
-	if tfawserr.ErrCodeEquals(err, qldb.ErrCodeResourceNotFoundException) {
+	if errs.IsA[*types.ResourceNotFoundException](err) {
 		return nil, &retry.NotFoundError{
 			LastError:   err,
 			LastRequest: input,
@@ -261,7 +269,7 @@ func findJournalKinesisStream(ctx context.Context, conn *qldb.QLDB, input *qldb.
 	return output.Stream, nil
 }
 
-func statusStreamCreated(ctx context.Context, conn *qldb.QLDB, ledgerName, streamID string) retry.StateRefreshFunc {
+func statusStreamCreated(ctx context.Context, conn *qldb.Client, ledgerName, streamID string) retry.StateRefreshFunc {
 	return func() (interface{}, string, error) {
 		// Don't call FindStream as it maps useful statuses to NotFoundError.
 		output, err := findJournalKinesisStream(ctx, conn, &qldb.DescribeJournalKinesisStreamInput{
@@ -277,23 +285,23 @@ func statusStreamCreated(ctx context.Context, conn *qldb.QLDB, ledgerName, strea
 			return nil, "", err
 		}
 
-		return output, aws.StringValue(output.Status), nil
+		return output, string(output.Status), nil
 	}
 }
 
-func waitStreamCreated(ctx context.Context, conn *qldb.QLDB, ledgerName, streamID string) (*qldb.JournalKinesisStreamDescription, error) {
+func waitStreamCreated(ctx context.Context, conn *qldb.Client, ledgerName, streamID string, timeout time.Duration) (*types.JournalKinesisStreamDescription, error) {
 	stateConf := &retry.StateChangeConf{
-		Pending:    []string{qldb.StreamStatusImpaired},
-		Target:     []string{qldb.StreamStatusActive},
+		Pending:    enum.Slice(types.StreamStatusImpaired),
+		Target:     enum.Slice(types.StreamStatusActive),
 		Refresh:    statusStreamCreated(ctx, conn, ledgerName, streamID),
-		Timeout:    8 * time.Minute,
+		Timeout:    timeout,
 		MinTimeout: 3 * time.Second,
 	}
 
 	outputRaw, err := stateConf.WaitForStateContext(ctx)
 
-	if output, ok := outputRaw.(*qldb.JournalKinesisStreamDescription); ok {
-		tfresource.SetLastError(err, errors.New(aws.StringValue(output.ErrorCause)))
+	if output, ok := outputRaw.(*types.JournalKinesisStreamDescription); ok {
+		tfresource.SetLastError(err, errors.New(string(output.ErrorCause)))
 
 		return output, err
 	}
@@ -301,9 +309,9 @@ func waitStreamCreated(ctx context.Context, conn *qldb.QLDB, ledgerName, streamI
 	return nil, err
 }
 
-func statusStreamDeleted(ctx context.Context, conn *qldb.QLDB, ledgerName, streamID string) retry.StateRefreshFunc {
+func statusStreamDeleted(ctx context.Context, conn *qldb.Client, ledgerName, streamID string) retry.StateRefreshFunc {
 	return func() (interface{}, string, error) {
-		output, err := FindStream(ctx, conn, ledgerName, streamID)
+		output, err := findStreamByTwoPartKey(ctx, conn, ledgerName, streamID)
 
 		if tfresource.NotFound(err) {
 			return nil, "", nil
@@ -313,23 +321,23 @@ func statusStreamDeleted(ctx context.Context, conn *qldb.QLDB, ledgerName, strea
 			return nil, "", err
 		}
 
-		return output, aws.StringValue(output.Status), nil
+		return output, string(output.Status), nil
 	}
 }
 
-func waitStreamDeleted(ctx context.Context, conn *qldb.QLDB, ledgerName, streamID string) (*qldb.JournalKinesisStreamDescription, error) {
+func waitStreamDeleted(ctx context.Context, conn *qldb.Client, ledgerName, streamID string, timeout time.Duration) (*types.JournalKinesisStreamDescription, error) {
 	stateConf := &retry.StateChangeConf{
-		Pending:    []string{qldb.StreamStatusActive, qldb.StreamStatusImpaired},
+		Pending:    enum.Slice(types.StreamStatusActive, types.StreamStatusImpaired),
 		Target:     []string{},
 		Refresh:    statusStreamDeleted(ctx, conn, ledgerName, streamID),
-		Timeout:    5 * time.Minute,
+		Timeout:    timeout,
 		MinTimeout: 1 * time.Second,
 	}
 
 	outputRaw, err := stateConf.WaitForStateContext(ctx)
 
-	if output, ok := outputRaw.(*qldb.JournalKinesisStreamDescription); ok {
-		tfresource.SetLastError(err, errors.New(aws.StringValue(output.ErrorCause)))
+	if output, ok := outputRaw.(*types.JournalKinesisStreamDescription); ok {
+		tfresource.SetLastError(err, errors.New(string(output.ErrorCause)))
 
 		return output, err
 	}
@@ -337,12 +345,12 @@ func waitStreamDeleted(ctx context.Context, conn *qldb.QLDB, ledgerName, streamI
 	return nil, err
 }
 
-func expandKinesisConfiguration(tfMap map[string]interface{}) *qldb.KinesisConfiguration {
+func expandKinesisConfiguration(tfMap map[string]interface{}) *types.KinesisConfiguration {
 	if tfMap == nil {
 		return nil
 	}
 
-	apiObject := &qldb.KinesisConfiguration{}
+	apiObject := &types.KinesisConfiguration{}
 
 	if v, ok := tfMap["aggregation_enabled"].(bool); ok {
 		apiObject.AggregationEnabled = aws.Bool(v)
@@ -355,7 +363,7 @@ func expandKinesisConfiguration(tfMap map[string]interface{}) *qldb.KinesisConfi
 	return apiObject
 }
 
-func flattenKinesisConfiguration(apiObject *qldb.KinesisConfiguration) map[string]interface{} {
+func flattenKinesisConfiguration(apiObject *types.KinesisConfiguration) map[string]interface{} {
 	if apiObject == nil {
 		return nil
 	}
@@ -363,11 +371,11 @@ func flattenKinesisConfiguration(apiObject *qldb.KinesisConfiguration) map[strin
 	tfMap := map[string]interface{}{}
 
 	if v := apiObject.AggregationEnabled; v != nil {
-		tfMap["aggregation_enabled"] = aws.BoolValue(v)
+		tfMap["aggregation_enabled"] = aws.ToBool(v)
 	}
 
 	if v := apiObject.StreamArn; v != nil {
-		tfMap["stream_arn"] = aws.StringValue(v)
+		tfMap["stream_arn"] = aws.ToString(v)
 	}
 
 	return tfMap
diff --git a/internal/service/qldb/stream_test.go b/internal/service/qldb/stream_test.go
index 334edb0edb2..5baa19df82e 100644
--- a/internal/service/qldb/stream_test.go
+++ b/internal/service/qldb/stream_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package qldb_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/service/qldb"
+	"github.com/YakDriver/regexache"
+	"github.com/aws/aws-sdk-go-v2/service/qldb/types"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
@@ -14,17 +17,18 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	tfqldb "github.com/hashicorp/terraform-provider-aws/internal/service/qldb"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
 func TestAccQLDBStream_basic(t *testing.T) {
 	ctx := acctest.Context(t)
-	var v qldb.JournalKinesisStreamDescription
+	var v types.JournalKinesisStreamDescription
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_qldb_stream.test"
 
 	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, qldb.EndpointsID) },
-		ErrorCheck:               acctest.ErrorCheck(t, qldb.EndpointsID),
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, names.QLDBEndpointID) },
+		ErrorCheck:               acctest.ErrorCheck(t, names.QLDBEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckStreamDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -32,7 +36,7 @@ func TestAccQLDBStream_basic(t *testing.T) {
 				Config: testAccStreamConfig_basic(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckStreamExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "qldb", regexp.MustCompile(`stream/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "qldb", regexache.MustCompile(`stream/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "exclusive_end_time", ""),
 					resource.TestCheckResourceAttrSet(resourceName, "inclusive_start_time"),
 					resource.TestCheckResourceAttr(resourceName, "kinesis_configuration.#", "1"),
@@ -50,13 +54,13 @@ func TestAccQLDBStream_basic(t *testing.T) {
 
 func TestAccQLDBStream_disappears(t *testing.T) {
 	ctx := acctest.Context(t)
-	var v qldb.JournalKinesisStreamDescription
+	var v types.JournalKinesisStreamDescription
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_qldb_stream.test"
 
 	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, qldb.EndpointsID) },
-		ErrorCheck:               acctest.ErrorCheck(t, qldb.EndpointsID),
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, names.QLDBEndpointID) },
+		ErrorCheck:               acctest.ErrorCheck(t, names.QLDBEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckStreamDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -74,13 +78,13 @@ func TestAccQLDBStream_disappears(t *testing.T) {
 
 func TestAccQLDBStream_tags(t *testing.T) {
 	ctx := acctest.Context(t)
-	var v qldb.JournalKinesisStreamDescription
+	var v types.JournalKinesisStreamDescription
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_qldb_stream.test"
 
 	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, qldb.EndpointsID) },
-		ErrorCheck:               acctest.ErrorCheck(t, qldb.EndpointsID),
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, names.QLDBEndpointID) },
+		ErrorCheck:               acctest.ErrorCheck(t, names.QLDBEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckStreamDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -115,13 +119,13 @@ func TestAccQLDBStream_tags(t *testing.T) {
 
 func TestAccQLDBStream_withEndTime(t *testing.T) {
 	ctx := acctest.Context(t)
-	var v qldb.JournalKinesisStreamDescription
+	var v types.JournalKinesisStreamDescription
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_qldb_stream.test"
 
 	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, qldb.EndpointsID) },
-		ErrorCheck:               acctest.ErrorCheck(t, qldb.EndpointsID),
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, names.QLDBEndpointID) },
+		ErrorCheck:               acctest.ErrorCheck(t, names.QLDBEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckStreamDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -140,7 +144,7 @@ func TestAccQLDBStream_withEndTime(t *testing.T) {
 	})
 }
 
-func testAccCheckStreamExists(ctx context.Context, n string, v *qldb.JournalKinesisStreamDescription) resource.TestCheckFunc {
+func testAccCheckStreamExists(ctx context.Context, n string, v *types.JournalKinesisStreamDescription) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		rs, ok := s.RootModule().Resources[n]
 		if !ok {
@@ -151,9 +155,9 @@ func testAccCheckStreamExists(ctx context.Context, n string, v *qldb.JournalKine
 			return fmt.Errorf("No QLDB Stream ID is set")
 		}
 
-		conn := acctest.Provider.Meta().(*conns.AWSClient).QLDBConn(ctx)
+		conn := acctest.Provider.Meta().(*conns.AWSClient).QLDBClient(ctx)
 
-		output, err := tfqldb.FindStream(ctx, conn, rs.Primary.Attributes["ledger_name"], rs.Primary.ID)
+		output, err := tfqldb.FindStreamByTwoPartKey(ctx, conn, rs.Primary.Attributes["ledger_name"], rs.Primary.ID)
 
 		if err != nil {
 			return err
@@ -167,14 +171,14 @@ func testAccCheckStreamExists(ctx context.Context, n string, v *qldb.JournalKine
 
 func testAccCheckStreamDestroy(ctx context.Context) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		conn := acctest.Provider.Meta().(*conns.AWSClient).QLDBConn(ctx)
+		conn := acctest.Provider.Meta().(*conns.AWSClient).QLDBClient(ctx)
 
 		for _, rs := range s.RootModule().Resources {
 			if rs.Type != "aws_qldb_stream" {
 				continue
 			}
 
-			_, err := tfqldb.FindStream(ctx, conn, rs.Primary.Attributes["ledger_name"], rs.Primary.ID)
+			_, err := tfqldb.FindStreamByTwoPartKey(ctx, conn, rs.Primary.Attributes["ledger_name"], rs.Primary.ID)
 
 			if tfresource.NotFound(err) {
 				continue
diff --git a/internal/service/qldb/sweep.go b/internal/service/qldb/sweep.go
index e1b2a254c6f..614b825a7ed 100644
--- a/internal/service/qldb/sweep.go
+++ b/internal/service/qldb/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package qldb
 
@@ -7,14 +7,15 @@ import (
 	"fmt"
 	"log"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/qldb"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/qldb"
 	multierror "github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv2"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_qldb_ledger", &resource.Sweeper{
 		Name: "aws_qldb_ledger",
 		F:    sweepLedgers,
@@ -27,45 +28,41 @@ func init() {
 		Name: "aws_qldb_stream",
 		F:    sweepStreams,
 	})
-
 }
 
 func sweepLedgers(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
-	conn := client.QLDBConn(ctx)
+	conn := client.QLDBClient(ctx)
 	input := &qldb.ListLedgersInput{}
 	sweepResources := make([]sweep.Sweepable, 0)
 
-	err = conn.ListLedgersPagesWithContext(ctx, input, func(page *qldb.ListLedgersOutput, lastPage bool) bool {
-		if page == nil {
-			return !lastPage
+	pages := qldb.NewListLedgersPaginator(conn, input)
+	for pages.HasMorePages() {
+		page, err := pages.NextPage(ctx)
+
+		if awsv2.SkipSweepError(err) {
+			log.Printf("[WARN] Skipping QLDB Ledger sweep for %s: %s", region, err)
+			return nil
+		}
+
+		if err != nil {
+			return fmt.Errorf("error listing QLDB Ledgers (%s): %w", region, err)
 		}
 
 		for _, v := range page.Ledgers {
-			r := ResourceLedger()
+			r := resourceLedger()
 			d := r.Data(nil)
-			d.SetId(aws.StringValue(v.Name))
+			d.SetId(aws.ToString(v.Name))
 
 			sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
 		}
-
-		return !lastPage
-	})
-
-	if sweep.SkipSweepError(err) {
-		log.Printf("[WARN] Skipping QLDB Ledger sweep for %s: %s", region, err)
-		return nil
 	}
 
-	if err != nil {
-		return fmt.Errorf("error listing QLDB Ledgers (%s): %w", region, err)
-	}
-
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping QLDB Ledgers (%s): %w", region, err)
@@ -76,18 +73,26 @@ func sweepLedgers(region string) error {
 
 func sweepStreams(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
-	conn := client.QLDBConn(ctx)
+	conn := client.QLDBClient(ctx)
 	input := &qldb.ListLedgersInput{}
 	var sweeperErrs *multierror.Error
 	sweepResources := make([]sweep.Sweepable, 0)
 
-	err = conn.ListLedgersPagesWithContext(ctx, input, func(page *qldb.ListLedgersOutput, lastPage bool) bool {
-		if page == nil {
-			return !lastPage
+	pages := qldb.NewListLedgersPaginator(conn, input)
+	for pages.HasMorePages() {
+		page, err := pages.NextPage(ctx)
+
+		if awsv2.SkipSweepError(err) {
+			log.Printf("[WARN] Skipping QLDB Stream sweep for %s: %s", region, err)
+			return sweeperErrs.ErrorOrNil() // In case we have completed some pages, but had errors
+		}
+
+		if err != nil {
+			sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error listing QLDB Ledgers (%s): %w", region, err))
 		}
 
 		for _, v := range page.Ledgers {
@@ -95,45 +100,31 @@ func sweepStreams(region string) error {
 				LedgerName: v.Name,
 			}
 
-			err := conn.ListJournalKinesisStreamsForLedgerPagesWithContext(ctx, input, func(page *qldb.ListJournalKinesisStreamsForLedgerOutput, lastPage bool) bool {
-				if page == nil {
-					return !lastPage
+			pages := qldb.NewListJournalKinesisStreamsForLedgerPaginator(conn, input)
+			for pages.HasMorePages() {
+				page, err := pages.NextPage(ctx)
+
+				if awsv2.SkipSweepError(err) {
+					continue
+				}
+
+				if err != nil {
+					sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error listing QLDB Streams (%s): %w", region, err))
 				}
 
 				for _, v := range page.Streams {
-					r := ResourceStream()
+					r := resourceStream()
 					d := r.Data(nil)
-					d.SetId(aws.StringValue(v.StreamId))
+					d.SetId(aws.ToString(v.StreamId))
 					d.Set("ledger_name", v.LedgerName)
 
 					sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
 				}
-
-				return !lastPage
-			})
-
-			if sweep.SkipSweepError(err) {
-				continue
-			}
-
-			if err != nil {
-				sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error listing QLDB Streams (%s): %w", region, err))
 			}
 		}
-
-		return !lastPage
-	})
-
-	if sweep.SkipSweepError(err) {
-		log.Printf("[WARN] Skipping QLDB Stream sweep for %s: %s", region, err)
-		return sweeperErrs.ErrorOrNil() // In case we have completed some pages, but had errors
-	}
-
-	if err != nil {
-		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error listing QLDB Ledgers (%s): %w", region, err))
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error sweeping QLDB Streams (%s): %w", region, err))
diff --git a/internal/service/qldb/tags_gen.go b/internal/service/qldb/tags_gen.go
index b2c8d176f88..3f6b9286943 100644
--- a/internal/service/qldb/tags_gen.go
+++ b/internal/service/qldb/tags_gen.go
@@ -5,10 +5,11 @@ import (
 	"context"
 	"fmt"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/qldb"
-	"github.com/aws/aws-sdk-go/service/qldb/qldbiface"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/qldb"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -17,12 +18,12 @@ import (
 // listTags lists qldb service tags.
 // The identifier is typically the Amazon Resource Name (ARN), although
 // it may also be a different identifier depending on the service.
-func listTags(ctx context.Context, conn qldbiface.QLDBAPI, identifier string) (tftags.KeyValueTags, error) {
+func listTags(ctx context.Context, conn *qldb.Client, identifier string) (tftags.KeyValueTags, error) {
 	input := &qldb.ListTagsForResourceInput{
 		ResourceArn: aws.String(identifier),
 	}
 
-	output, err := conn.ListTagsForResourceWithContext(ctx, input)
+	output, err := conn.ListTagsForResource(ctx, input)
 
 	if err != nil {
 		return tftags.New(ctx, nil), err
@@ -34,7 +35,7 @@ func listTags(ctx context.Context, conn qldbiface.QLDBAPI, identifier string) (t
 // ListTags lists qldb service tags and set them in Context.
 // It is called from outside this package.
 func (p *servicePackage) ListTags(ctx context.Context, meta any, identifier string) error {
-	tags, err := listTags(ctx, meta.(*conns.AWSClient).QLDBConn(ctx), identifier)
+	tags, err := listTags(ctx, meta.(*conns.AWSClient).QLDBClient(ctx), identifier)
 
 	if err != nil {
 		return err
@@ -54,7 +55,7 @@ func Tags(tags tftags.KeyValueTags) map[string]*string {
 	return aws.StringMap(tags.Map())
 }
 
-// KeyValueTags creates KeyValueTags from qldb service tags.
+// KeyValueTags creates tftags.KeyValueTags from qldb service tags.
 func KeyValueTags(ctx context.Context, tags map[string]*string) tftags.KeyValueTags {
 	return tftags.New(ctx, tags)
 }
@@ -81,19 +82,21 @@ func setTagsOut(ctx context.Context, tags map[string]*string) {
 // updateTags updates qldb service tags.
 // The identifier is typically the Amazon Resource Name (ARN), although
 // it may also be a different identifier depending on the service.
-func updateTags(ctx context.Context, conn qldbiface.QLDBAPI, identifier string, oldTagsMap, newTagsMap any) error {
+func updateTags(ctx context.Context, conn *qldb.Client, identifier string, oldTagsMap, newTagsMap any) error {
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.QLDB)
 	if len(removedTags) > 0 {
 		input := &qldb.UntagResourceInput{
 			ResourceArn: aws.String(identifier),
-			TagKeys:     aws.StringSlice(removedTags.Keys()),
+			TagKeys:     removedTags.Keys(),
 		}
 
-		_, err := conn.UntagResourceWithContext(ctx, input)
+		_, err := conn.UntagResource(ctx, input)
 
 		if err != nil {
 			return fmt.Errorf("untagging resource (%s): %w", identifier, err)
@@ -108,7 +111,7 @@ func updateTags(ctx context.Context, conn qldbiface.QLDBAPI, identifier string,
 			Tags:        Tags(updatedTags),
 		}
 
-		_, err := conn.TagResourceWithContext(ctx, input)
+		_, err := conn.TagResource(ctx, input)
 
 		if err != nil {
 			return fmt.Errorf("tagging resource (%s): %w", identifier, err)
@@ -121,5 +124,5 @@ func updateTags(ctx context.Context, conn qldbiface.QLDBAPI, identifier string,
 // UpdateTags updates qldb service tags.
 // It is called from outside this package.
 func (p *servicePackage) UpdateTags(ctx context.Context, meta any, identifier string, oldTags, newTags any) error {
-	return updateTags(ctx, meta.(*conns.AWSClient).QLDBConn(ctx), identifier, oldTags, newTags)
+	return updateTags(ctx, meta.(*conns.AWSClient).QLDBClient(ctx), identifier, oldTags, newTags)
 }
diff --git a/internal/service/quicksight/account_subscription.go b/internal/service/quicksight/account_subscription.go
index 0daa71db975..3e61adfa59b 100644
--- a/internal/service/quicksight/account_subscription.go
+++ b/internal/service/quicksight/account_subscription.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package quicksight
 
 import (
@@ -35,96 +38,98 @@ func ResourceAccountSubscription() *schema.Resource {
 			Delete: schema.DefaultTimeout(10 * time.Minute),
 		},
 
-		Schema: map[string]*schema.Schema{
-			"account_name": {
-				Type:     schema.TypeString,
-				Required: true,
-				ForceNew: true,
-			},
-			"account_subscription_status": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
-			"active_directory_name": {
-				Type:     schema.TypeString,
-				Optional: true,
-				ForceNew: true,
-			},
-			"admin_group": {
-				Type:     schema.TypeList,
-				Optional: true,
-				MinItems: 1,
-				Elem:     &schema.Schema{Type: schema.TypeString},
-				ForceNew: true,
-			},
-			"authentication_method": {
-				Type:         schema.TypeString,
-				Required:     true,
-				ForceNew:     true,
-				ValidateFunc: validation.StringInSlice(quicksight.AuthenticationMethodOption_Values(), false),
-			},
-			"author_group": {
-				Type:     schema.TypeList,
-				Optional: true,
-				MinItems: 1,
-				Elem:     &schema.Schema{Type: schema.TypeString},
-				ForceNew: true,
-			},
-			"aws_account_id": {
-				Type:         schema.TypeString,
-				Optional:     true,
-				Computed:     true,
-				ForceNew:     true,
-				ValidateFunc: verify.ValidAccountID,
-			},
-			"contact_number": {
-				Type:     schema.TypeString,
-				Optional: true,
-				ForceNew: true,
-			},
-			"directory_id": {
-				Type:     schema.TypeString,
-				Optional: true,
-				ForceNew: true,
-			},
-			"edition": {
-				Type:         schema.TypeString,
-				Required:     true,
-				ForceNew:     true,
-				ValidateFunc: validation.StringInSlice(quicksight.Edition_Values(), false),
-			},
-			"email_address": {
-				Type:     schema.TypeString,
-				Optional: true,
-				ForceNew: true,
-			},
-			"first_name": {
-				Type:     schema.TypeString,
-				Optional: true,
-				ForceNew: true,
-			},
-			"last_name": {
-				Type:     schema.TypeString,
-				Optional: true,
-				ForceNew: true,
-			},
-			"notification_email": {
-				Type:     schema.TypeString,
-				Required: true,
-				ForceNew: true,
-			},
-			"reader_group": {
-				Type:     schema.TypeList,
-				Optional: true,
-				ForceNew: true,
-				MinItems: 1,
-				Elem:     &schema.Schema{Type: schema.TypeString},
-			},
-			"realm": {
-				Type:     schema.TypeString,
-				Optional: true,
-				ForceNew: true,
-			},
+		SchemaFunc: func() map[string]*schema.Schema {
+			return map[string]*schema.Schema{
+				"account_name": {
+					Type:     schema.TypeString,
+					Required: true,
+					ForceNew: true,
+				},
+				"account_subscription_status": {
+					Type:     schema.TypeString,
+					Computed: true,
+				},
+				"active_directory_name": {
+					Type:     schema.TypeString,
+					Optional: true,
+					ForceNew: true,
+				},
+				"admin_group": {
+					Type:     schema.TypeList,
+					Optional: true,
+					MinItems: 1,
+					Elem:     &schema.Schema{Type: schema.TypeString},
+					ForceNew: true,
+				},
+				"authentication_method": {
+					Type:         schema.TypeString,
+					Required:     true,
+					ForceNew:     true,
+					ValidateFunc: validation.StringInSlice(quicksight.AuthenticationMethodOption_Values(), false),
+				},
+				"author_group": {
+					Type:     schema.TypeList,
+					Optional: true,
+					MinItems: 1,
+					Elem:     &schema.Schema{Type: schema.TypeString},
+					ForceNew: true,
+				},
+				"aws_account_id": {
+					Type:         schema.TypeString,
+					Optional:     true,
+					Computed:     true,
+					ForceNew:     true,
+					ValidateFunc: verify.ValidAccountID,
+				},
+				"contact_number": {
+					Type:     schema.TypeString,
+					Optional: true,
+					ForceNew: true,
+				},
+				"directory_id": {
+					Type:     schema.TypeString,
+					Optional: true,
+					ForceNew: true,
+				},
+				"edition": {
+					Type:         schema.TypeString,
+					Required:     true,
+					ForceNew:     true,
+					ValidateFunc: validation.StringInSlice(quicksight.Edition_Values(), false),
+				},
+				"email_address": {
+					Type:     schema.TypeString,
+					Optional: true,
+					ForceNew: true,
+				},
+				"first_name": {
+					Type:     schema.TypeString,
+					Optional: true,
+					ForceNew: true,
+				},
+				"last_name": {
+					Type:     schema.TypeString,
+					Optional: true,
+					ForceNew: true,
+				},
+				"notification_email": {
+					Type:     schema.TypeString,
+					Required: true,
+					ForceNew: true,
+				},
+				"reader_group": {
+					Type:     schema.TypeList,
+					Optional: true,
+					ForceNew: true,
+					MinItems: 1,
+					Elem:     &schema.Schema{Type: schema.TypeString},
+				},
+				"realm": {
+					Type:     schema.TypeString,
+					Optional: true,
+					ForceNew: true,
+				},
+			}
 		},
 	}
 }
diff --git a/internal/service/quicksight/account_subscription_test.go b/internal/service/quicksight/account_subscription_test.go
index 3f56302c9df..09f744ecfcf 100644
--- a/internal/service/quicksight/account_subscription_test.go
+++ b/internal/service/quicksight/account_subscription_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package quicksight_test
 
 import (
diff --git a/internal/service/quicksight/analysis.go b/internal/service/quicksight/analysis.go
index 15c7d3d1879..c142ad19fb4 100644
--- a/internal/service/quicksight/analysis.go
+++ b/internal/service/quicksight/analysis.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package quicksight
 
 import (
@@ -51,85 +54,88 @@ func ResourceAnalysis() *schema.Resource {
 			Delete: schema.DefaultTimeout(5 * time.Minute),
 		},
 
-		Schema: map[string]*schema.Schema{
-			"arn": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
-			"aws_account_id": {
-				Type:         schema.TypeString,
-				Optional:     true,
-				Computed:     true,
-				ForceNew:     true,
-				ValidateFunc: verify.ValidAccountID,
-			},
-			"created_time": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
-			"analysis_id": {
-				Type:     schema.TypeString,
-				Required: true,
-				ForceNew: true,
-			},
-			"definition": quicksightschema.AnalysisDefinitionSchema(),
-			"last_updated_time": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
-			"last_published_time": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
-			"name": {
-				Type:         schema.TypeString,
-				Required:     true,
-				ValidateFunc: validation.StringLenBetween(1, 2048),
-			},
-			"parameters": quicksightschema.ParametersSchema(),
-			"permissions": {
-				Type:     schema.TypeList,
-				Optional: true,
-				MinItems: 1,
-				MaxItems: 64,
-				Elem: &schema.Resource{
-					Schema: map[string]*schema.Schema{
-						"actions": {
-							Type:     schema.TypeSet,
-							Required: true,
-							MinItems: 1,
-							MaxItems: 16,
-							Elem:     &schema.Schema{Type: schema.TypeString},
-						},
-						"principal": {
-							Type:         schema.TypeString,
-							Required:     true,
-							ValidateFunc: validation.StringLenBetween(1, 256),
+		SchemaFunc: func() map[string]*schema.Schema {
+			return map[string]*schema.Schema{
+				"arn": {
+					Type:     schema.TypeString,
+					Computed: true,
+				},
+				"aws_account_id": {
+					Type:         schema.TypeString,
+					Optional:     true,
+					Computed:     true,
+					ForceNew:     true,
+					ValidateFunc: verify.ValidAccountID,
+				},
+				"created_time": {
+					Type:     schema.TypeString,
+					Computed: true,
+				},
+				"analysis_id": {
+					Type:     schema.TypeString,
+					Required: true,
+					ForceNew: true,
+				},
+				"definition": quicksightschema.AnalysisDefinitionSchema(),
+				"last_updated_time": {
+					Type:     schema.TypeString,
+					Computed: true,
+				},
+				"last_published_time": {
+					Type:     schema.TypeString,
+					Computed: true,
+				},
+				"name": {
+					Type:         schema.TypeString,
+					Required:     true,
+					ValidateFunc: validation.StringLenBetween(1, 2048),
+				},
+				"parameters": quicksightschema.ParametersSchema(),
+				"permissions": {
+					Type:     schema.TypeSet,
+					Optional: true,
+					MinItems: 1,
+					MaxItems: 64,
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"actions": {
+								Type:     schema.TypeSet,
+								Required: true,
+								MinItems: 1,
+								MaxItems: 16,
+								Elem:     &schema.Schema{Type: schema.TypeString},
+							},
+							"principal": {
+								Type:         schema.TypeString,
+								Required:     true,
+								ValidateFunc: validation.StringLenBetween(1, 256),
+							},
 						},
 					},
 				},
-			},
-			"recovery_window_in_days": {
-				Type:     schema.TypeInt,
-				Optional: true,
-				Default:  30,
-				ValidateFunc: validation.Any(
-					validation.IntBetween(recoveryWindowInDaysMin, recoveryWindowInDaysMax),
-					validation.IntInSlice([]int{0}),
-				),
-			},
-			"source_entity": quicksightschema.AnalysisSourceEntitySchema(),
-			"status": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
-			names.AttrTags:    tftags.TagsSchema(),
-			names.AttrTagsAll: tftags.TagsSchemaComputed(),
-			"theme_arn": {
-				Type:     schema.TypeString,
-				Optional: true,
-			},
+				"recovery_window_in_days": {
+					Type:     schema.TypeInt,
+					Optional: true,
+					Default:  30,
+					ValidateFunc: validation.Any(
+						validation.IntBetween(recoveryWindowInDaysMin, recoveryWindowInDaysMax),
+						validation.IntInSlice([]int{0}),
+					),
+				},
+				"source_entity": quicksightschema.AnalysisSourceEntitySchema(),
+				"status": {
+					Type:     schema.TypeString,
+					Computed: true,
+				},
+				names.AttrTags:    tftags.TagsSchema(),
+				names.AttrTagsAll: tftags.TagsSchemaComputed(),
+				"theme_arn": {
+					Type:     schema.TypeString,
+					Optional: true,
+				},
+			}
 		},
+
 		CustomizeDiff: verify.SetTagsDiff,
 	}
 }
@@ -168,8 +174,8 @@ func resourceAnalysisCreate(ctx context.Context, d *schema.ResourceData, meta in
 		input.Parameters = quicksightschema.ExpandParameters(d.Get("parameters").([]interface{}))
 	}
 
-	if v, ok := d.GetOk("permissions"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
-		input.Permissions = expandResourcePermissions(v.([]interface{}))
+	if v, ok := d.Get("permissions").(*schema.Set); ok && v.Len() > 0 {
+		input.Permissions = expandResourcePermissions(v.List())
 	}
 
 	_, err := conn.CreateAnalysisWithContext(ctx, input)
@@ -287,10 +293,10 @@ func resourceAnalysisUpdate(ctx context.Context, d *schema.ResourceData, meta in
 
 	if d.HasChange("permissions") {
 		oraw, nraw := d.GetChange("permissions")
-		o := oraw.([]interface{})
-		n := nraw.([]interface{})
+		o := oraw.(*schema.Set)
+		n := nraw.(*schema.Set)
 
-		toGrant, toRevoke := DiffPermissions(o, n)
+		toGrant, toRevoke := DiffPermissions(o.List(), n.List())
 
 		params := &quicksight.UpdateAnalysisPermissionsInput{
 			AwsAccountId: aws.String(awsAccountId),
diff --git a/internal/service/quicksight/analysis_test.go b/internal/service/quicksight/analysis_test.go
index 1d19a890210..873fb257fdd 100644
--- a/internal/service/quicksight/analysis_test.go
+++ b/internal/service/quicksight/analysis_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package quicksight_test
 
 import (
@@ -222,6 +225,52 @@ func TestAccQuickSightAnalysis_forceDelete(t *testing.T) {
 	})
 }
 
+func TestAccQuickSightAnalysis_Definition_calculatedFields(t *testing.T) {
+	ctx := acctest.Context(t)
+
+	var analysis quicksight.Analysis
+	resourceName := "aws_quicksight_analysis.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	rId := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, quicksight.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckAnalysisDestroy(ctx, false),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccAnalysisConfig_Definition_calculatedFields(rId, rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAnalysisExists(ctx, resourceName, &analysis),
+					resource.TestCheckResourceAttr(resourceName, "analysis_id", rId),
+					resource.TestCheckResourceAttr(resourceName, "name", rName),
+					resource.TestCheckResourceAttr(resourceName, "status", quicksight.ResourceStatusCreationSuccessful),
+					resource.TestCheckResourceAttr(resourceName, "definition.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "definition.0.calculated_fields.#", "2"),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "definition.0.calculated_fields.*", map[string]string{
+						"data_set_identifier": "1",
+						"expression":          "1",
+						"name":                "test1",
+					}),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "definition.0.calculated_fields.*", map[string]string{
+						"data_set_identifier": "1",
+						"expression":          "2",
+						"name":                "test2",
+					}),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
 func testAccCheckAnalysisDestroy(ctx context.Context, forceDelete bool) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		conn := acctest.Provider.Meta().(*conns.AWSClient).QuickSightConn(ctx)
@@ -609,3 +658,80 @@ resource "aws_quicksight_analysis" "test" {
 }
 `, rId, rName))
 }
+
+func testAccAnalysisConfig_Definition_calculatedFields(rId, rName string) string {
+	return acctest.ConfigCompose(
+		testAccAnalysisConfigBase(rId, rName),
+		fmt.Sprintf(`
+resource "aws_quicksight_analysis" "test" {
+  analysis_id = %[1]q
+  name        = %[2]q
+  definition {
+    data_set_identifiers_declarations {
+      data_set_arn = aws_quicksight_data_set.test.arn
+      identifier   = "1"
+    }
+    calculated_fields {
+      data_set_identifier = "1"
+      expression          = "1"
+      name                = "test1"
+    }
+    calculated_fields {
+      data_set_identifier = "1"
+      expression          = "2"
+      name                = "test2"
+    }
+    sheets {
+      title    = "Test"
+      sheet_id = "Test1"
+      visuals {
+        custom_content_visual {
+          data_set_identifier = "1"
+          title {
+            format_text {
+              plain_text = "Test"
+            }
+          }
+          visual_id = "Test1"
+        }
+      }
+      visuals {
+        line_chart_visual {
+          visual_id = "LineChart"
+          title {
+            format_text {
+              plain_text = "Line Chart Test"
+            }
+          }
+          chart_configuration {
+            field_wells {
+              line_chart_aggregated_field_wells {
+                category {
+                  categorical_dimension_field {
+                    field_id = "1"
+                    column {
+                      data_set_identifier = "1"
+                      column_name         = "Column1"
+                    }
+                  }
+                }
+                values {
+                  categorical_measure_field {
+                    field_id = "2"
+                    column {
+                      data_set_identifier = "1"
+                      column_name         = "Column1"
+                    }
+                    aggregation_function = "COUNT"
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+}
+`, rId, rName))
+}
diff --git a/internal/service/quicksight/dashboard.go b/internal/service/quicksight/dashboard.go
index b7d569e0628..e8f9ba35300 100644
--- a/internal/service/quicksight/dashboard.go
+++ b/internal/service/quicksight/dashboard.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package quicksight
 
 import (
@@ -12,7 +15,6 @@ import (
 	"github.com/aws/aws-sdk-go/service/quicksight"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/customdiff"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
@@ -44,94 +46,94 @@ func ResourceDashboard() *schema.Resource {
 			Delete: schema.DefaultTimeout(5 * time.Minute),
 		},
 
-		Schema: map[string]*schema.Schema{
-			"arn": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
-			"aws_account_id": {
-				Type:         schema.TypeString,
-				Optional:     true,
-				Computed:     true,
-				ForceNew:     true,
-				ValidateFunc: verify.ValidAccountID,
-			},
-			"created_time": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
-			"dashboard_id": {
-				Type:     schema.TypeString,
-				Required: true,
-				ForceNew: true,
-			},
-			"dashboard_publish_options": quicksightschema.DashboardPublishOptionsSchema(),
-			"definition":                quicksightschema.DashboardDefinitionSchema(),
-			"last_updated_time": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
-			"last_published_time": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
-			"name": {
-				Type:         schema.TypeString,
-				Required:     true,
-				ValidateFunc: validation.StringLenBetween(1, 2048),
-			},
-			"parameters": quicksightschema.ParametersSchema(),
-			"permissions": {
-				Type:     schema.TypeList,
-				Optional: true,
-				MinItems: 1,
-				MaxItems: 64,
-				Elem: &schema.Resource{
-					Schema: map[string]*schema.Schema{
-						"actions": {
-							Type:     schema.TypeSet,
-							Required: true,
-							MinItems: 1,
-							MaxItems: 16,
-							Elem:     &schema.Schema{Type: schema.TypeString},
-						},
-						"principal": {
-							Type:         schema.TypeString,
-							Required:     true,
-							ValidateFunc: validation.StringLenBetween(1, 256),
+		SchemaFunc: func() map[string]*schema.Schema {
+			return map[string]*schema.Schema{
+				"arn": {
+					Type:     schema.TypeString,
+					Computed: true,
+				},
+				"aws_account_id": {
+					Type:         schema.TypeString,
+					Optional:     true,
+					Computed:     true,
+					ForceNew:     true,
+					ValidateFunc: verify.ValidAccountID,
+				},
+				"created_time": {
+					Type:     schema.TypeString,
+					Computed: true,
+				},
+				"dashboard_id": {
+					Type:     schema.TypeString,
+					Required: true,
+					ForceNew: true,
+				},
+				"dashboard_publish_options": quicksightschema.DashboardPublishOptionsSchema(),
+				"definition":                quicksightschema.DashboardDefinitionSchema(),
+				"last_updated_time": {
+					Type:     schema.TypeString,
+					Computed: true,
+				},
+				"last_published_time": {
+					Type:     schema.TypeString,
+					Computed: true,
+				},
+				"name": {
+					Type:         schema.TypeString,
+					Required:     true,
+					ValidateFunc: validation.StringLenBetween(1, 2048),
+				},
+				"parameters": quicksightschema.ParametersSchema(),
+				"permissions": {
+					Type:     schema.TypeSet,
+					Optional: true,
+					MinItems: 1,
+					MaxItems: 64,
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"actions": {
+								Type:     schema.TypeSet,
+								Required: true,
+								MinItems: 1,
+								MaxItems: 16,
+								Elem:     &schema.Schema{Type: schema.TypeString},
+							},
+							"principal": {
+								Type:         schema.TypeString,
+								Required:     true,
+								ValidateFunc: validation.StringLenBetween(1, 256),
+							},
 						},
 					},
 				},
-			},
-			"source_entity": quicksightschema.DashboardSourceEntitySchema(),
-			"source_entity_arn": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
-			"status": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
-			names.AttrTags:    tftags.TagsSchema(),
-			names.AttrTagsAll: tftags.TagsSchemaComputed(),
-			"theme_arn": {
-				Type:     schema.TypeString,
-				Optional: true,
-			},
-			"version_description": {
-				Type:         schema.TypeString,
-				Required:     true,
-				ValidateFunc: validation.StringLenBetween(1, 512),
-			},
-			"version_number": {
-				Type:     schema.TypeInt,
-				Computed: true,
-			},
+				"source_entity": quicksightschema.DashboardSourceEntitySchema(),
+				"source_entity_arn": {
+					Type:     schema.TypeString,
+					Computed: true,
+				},
+				"status": {
+					Type:     schema.TypeString,
+					Computed: true,
+				},
+				names.AttrTags:    tftags.TagsSchema(),
+				names.AttrTagsAll: tftags.TagsSchemaComputed(),
+				"theme_arn": {
+					Type:     schema.TypeString,
+					Optional: true,
+				},
+				"version_description": {
+					Type:         schema.TypeString,
+					Required:     true,
+					ValidateFunc: validation.StringLenBetween(1, 512),
+				},
+				"version_number": {
+					Type:     schema.TypeInt,
+					Computed: true,
+				},
+			}
 		},
-		CustomizeDiff: customdiff.All(
-			refreshOutputsDiff,
-			verify.SetTagsDiff,
-		),
+
+		CustomizeDiff: verify.SetTagsDiff,
 	}
 }
 
@@ -177,8 +179,8 @@ func resourceDashboardCreate(ctx context.Context, d *schema.ResourceData, meta i
 		input.Parameters = quicksightschema.ExpandParameters(d.Get("parameters").([]interface{}))
 	}
 
-	if v, ok := d.GetOk("permissions"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
-		input.Permissions = expandResourcePermissions(v.([]interface{}))
+	if v, ok := d.Get("permissions").(*schema.Set); ok && v.Len() > 0 {
+		input.Permissions = expandResourcePermissions(v.List())
 	}
 
 	_, err := conn.CreateDashboardWithContext(ctx, input)
@@ -312,10 +314,10 @@ func resourceDashboardUpdate(ctx context.Context, d *schema.ResourceData, meta i
 
 	if d.HasChange("permissions") {
 		oraw, nraw := d.GetChange("permissions")
-		o := oraw.([]interface{})
-		n := nraw.([]interface{})
+		o := oraw.(*schema.Set)
+		n := nraw.(*schema.Set)
 
-		toGrant, toRevoke := DiffPermissions(o, n)
+		toGrant, toRevoke := DiffPermissions(o.List(), n.List())
 
 		params := &quicksight.UpdateDashboardPermissionsInput{
 			AwsAccountId: aws.String(awsAccountId),
@@ -412,13 +414,3 @@ func extractVersionFromARN(arn string) *int64 {
 	version, _ := strconv.Atoi(arn[strings.LastIndex(arn, "/")+1:])
 	return aws.Int64(int64(version))
 }
-
-func refreshOutputsDiff(_ context.Context, diff *schema.ResourceDiff, meta interface{}) error {
-	if diff.HasChanges("name", "definition", "source_entity", "theme_arn", "version_description", "parameters", "dashboard_publish_options") {
-		if err := diff.SetNewComputed("version_number"); err != nil {
-			return err
-		}
-	}
-
-	return nil
-}
diff --git a/internal/service/quicksight/dashboard_test.go b/internal/service/quicksight/dashboard_test.go
index d6a975d23b8..4e6f3647872 100644
--- a/internal/service/quicksight/dashboard_test.go
+++ b/internal/service/quicksight/dashboard_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package quicksight_test
 
 import (
diff --git a/internal/service/quicksight/data_set.go b/internal/service/quicksight/data_set.go
index ff475f777cd..562a402e305 100644
--- a/internal/service/quicksight/data_set.go
+++ b/internal/service/quicksight/data_set.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package quicksight
 
 import (
@@ -35,307 +38,309 @@ func ResourceDataSet() *schema.Resource {
 			StateContext: schema.ImportStatePassthroughContext,
 		},
 
-		Schema: map[string]*schema.Schema{
-			"arn": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
-			"aws_account_id": {
-				Type:         schema.TypeString,
-				Optional:     true,
-				Computed:     true,
-				ForceNew:     true,
-				ValidateFunc: verify.ValidAccountID,
-			},
-			"column_groups": {
-				Type:     schema.TypeList,
-				Optional: true,
-				MinItems: 1,
-				MaxItems: 8,
-				Elem: &schema.Resource{
-					Schema: map[string]*schema.Schema{
-						"geo_spatial_column_group": {
-							Type:     schema.TypeList,
-							Optional: true,
-							MaxItems: 1,
-							Elem: &schema.Resource{
-								Schema: map[string]*schema.Schema{
-									"columns": {
-										Type:     schema.TypeList,
-										Required: true,
-										MinItems: 1,
-										MaxItems: 16,
-										Elem: &schema.Schema{
+		SchemaFunc: func() map[string]*schema.Schema {
+			return map[string]*schema.Schema{
+				"arn": {
+					Type:     schema.TypeString,
+					Computed: true,
+				},
+				"aws_account_id": {
+					Type:         schema.TypeString,
+					Optional:     true,
+					Computed:     true,
+					ForceNew:     true,
+					ValidateFunc: verify.ValidAccountID,
+				},
+				"column_groups": {
+					Type:     schema.TypeList,
+					Optional: true,
+					MinItems: 1,
+					MaxItems: 8,
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"geo_spatial_column_group": {
+								Type:     schema.TypeList,
+								Optional: true,
+								MaxItems: 1,
+								Elem: &schema.Resource{
+									Schema: map[string]*schema.Schema{
+										"columns": {
+											Type:     schema.TypeList,
+											Required: true,
+											MinItems: 1,
+											MaxItems: 16,
+											Elem: &schema.Schema{
+												Type:         schema.TypeString,
+												ValidateFunc: validation.StringLenBetween(1, 128),
+											},
+										},
+										"country_code": {
 											Type:         schema.TypeString,
-											ValidateFunc: validation.StringLenBetween(1, 128),
+											Required:     true,
+											ValidateFunc: validation.StringInSlice(quicksight.GeoSpatialCountryCode_Values(), false),
+										},
+										"name": {
+											Type:         schema.TypeString,
+											Required:     true,
+											ValidateFunc: validation.StringLenBetween(1, 64),
 										},
-									},
-									"country_code": {
-										Type:         schema.TypeString,
-										Required:     true,
-										ValidateFunc: validation.StringInSlice(quicksight.GeoSpatialCountryCode_Values(), false),
-									},
-									"name": {
-										Type:         schema.TypeString,
-										Required:     true,
-										ValidateFunc: validation.StringLenBetween(1, 64),
 									},
 								},
 							},
 						},
 					},
 				},
-			},
-			"column_level_permission_rules": {
-				Type:     schema.TypeList,
-				MinItems: 1,
-				Optional: true,
-				Elem: &schema.Resource{
-					Schema: map[string]*schema.Schema{
-						"column_names": {
-							Type:     schema.TypeList,
-							Optional: true,
-							MinItems: 1,
-							Elem:     &schema.Schema{Type: schema.TypeString},
-						},
-						"principals": {
-							Type:     schema.TypeList,
-							Optional: true,
-							MinItems: 1,
-							MaxItems: 100,
-							Elem:     &schema.Schema{Type: schema.TypeString},
+				"column_level_permission_rules": {
+					Type:     schema.TypeList,
+					MinItems: 1,
+					Optional: true,
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"column_names": {
+								Type:     schema.TypeList,
+								Optional: true,
+								MinItems: 1,
+								Elem:     &schema.Schema{Type: schema.TypeString},
+							},
+							"principals": {
+								Type:     schema.TypeList,
+								Optional: true,
+								MinItems: 1,
+								MaxItems: 100,
+								Elem:     &schema.Schema{Type: schema.TypeString},
+							},
 						},
 					},
 				},
-			},
-			"data_set_id": {
-				Type:     schema.TypeString,
-				Required: true,
-				ForceNew: true,
-			},
-			"data_set_usage_configuration": {
-				Type:     schema.TypeList,
-				Computed: true,
-				Optional: true,
-				MaxItems: 1,
-				Elem: &schema.Resource{
-					Schema: map[string]*schema.Schema{
-						"disable_use_as_direct_query_source": {
-							Type:     schema.TypeBool,
-							Computed: true,
-							Optional: true,
-						},
-						"disable_use_as_imported_source": {
-							Type:     schema.TypeBool,
-							Computed: true,
-							Optional: true,
+				"data_set_id": {
+					Type:     schema.TypeString,
+					Required: true,
+					ForceNew: true,
+				},
+				"data_set_usage_configuration": {
+					Type:     schema.TypeList,
+					Computed: true,
+					Optional: true,
+					MaxItems: 1,
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"disable_use_as_direct_query_source": {
+								Type:     schema.TypeBool,
+								Computed: true,
+								Optional: true,
+							},
+							"disable_use_as_imported_source": {
+								Type:     schema.TypeBool,
+								Computed: true,
+								Optional: true,
+							},
 						},
 					},
 				},
-			},
-			"field_folders": {
-				Type:     schema.TypeSet,
-				Optional: true,
-				MaxItems: 1000,
-				Elem: &schema.Resource{
-					Schema: map[string]*schema.Schema{
-						"field_folders_id": {
-							Type:     schema.TypeString,
-							Required: true,
-						},
-						"columns": {
-							Type:     schema.TypeList,
-							Optional: true,
-							MaxItems: 5000,
-							Elem:     &schema.Schema{Type: schema.TypeString},
-						},
-						"description": {
-							Type:         schema.TypeString,
-							Optional:     true,
-							ValidateFunc: validation.StringLenBetween(0, 500),
+				"field_folders": {
+					Type:     schema.TypeSet,
+					Optional: true,
+					MaxItems: 1000,
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"field_folders_id": {
+								Type:     schema.TypeString,
+								Required: true,
+							},
+							"columns": {
+								Type:     schema.TypeList,
+								Optional: true,
+								MaxItems: 5000,
+								Elem:     &schema.Schema{Type: schema.TypeString},
+							},
+							"description": {
+								Type:         schema.TypeString,
+								Optional:     true,
+								ValidateFunc: validation.StringLenBetween(0, 500),
+							},
 						},
 					},
 				},
-			},
-			"import_mode": {
-				Type:         schema.TypeString,
-				Required:     true,
-				ValidateFunc: validation.StringInSlice(quicksight.DataSetImportMode_Values(), false),
-			},
-			"logical_table_map": {
-				Type:     schema.TypeSet,
-				Optional: true,
-				Computed: true,
-				MaxItems: 64,
-				Elem:     logicalTableMapSchema(),
-			},
-			"name": {
-				Type:         schema.TypeString,
-				Required:     true,
-				ValidateFunc: validation.StringLenBetween(1, 128),
-			},
-			"output_columns": {
-				Type:     schema.TypeList,
-				Computed: true,
-				Elem: &schema.Resource{
-					Schema: map[string]*schema.Schema{
-						"description": {
-							Type:     schema.TypeString,
-							Computed: true,
-						},
-						"name": {
-							Type:     schema.TypeString,
-							Computed: true,
-						},
-						"type": {
-							Type:     schema.TypeString,
-							Computed: true,
+				"import_mode": {
+					Type:         schema.TypeString,
+					Required:     true,
+					ValidateFunc: validation.StringInSlice(quicksight.DataSetImportMode_Values(), false),
+				},
+				"logical_table_map": {
+					Type:     schema.TypeSet,
+					Optional: true,
+					Computed: true,
+					MaxItems: 64,
+					Elem:     logicalTableMapSchema(),
+				},
+				"name": {
+					Type:         schema.TypeString,
+					Required:     true,
+					ValidateFunc: validation.StringLenBetween(1, 128),
+				},
+				"output_columns": {
+					Type:     schema.TypeList,
+					Computed: true,
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"description": {
+								Type:     schema.TypeString,
+								Computed: true,
+							},
+							"name": {
+								Type:     schema.TypeString,
+								Computed: true,
+							},
+							"type": {
+								Type:     schema.TypeString,
+								Computed: true,
+							},
 						},
 					},
 				},
-			},
-			"permissions": {
-				Type:     schema.TypeList,
-				Optional: true,
-				MinItems: 1,
-				MaxItems: 64,
-				Elem: &schema.Resource{
-					Schema: map[string]*schema.Schema{
-						"actions": {
-							Type:     schema.TypeSet,
-							Required: true,
-							MinItems: 1,
-							MaxItems: 16,
-							Elem:     &schema.Schema{Type: schema.TypeString},
-						},
-						"principal": {
-							Type:         schema.TypeString,
-							Required:     true,
-							ValidateFunc: validation.StringLenBetween(1, 256),
+				"permissions": {
+					Type:     schema.TypeSet,
+					Optional: true,
+					MinItems: 1,
+					MaxItems: 64,
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"actions": {
+								Type:     schema.TypeSet,
+								Required: true,
+								MinItems: 1,
+								MaxItems: 16,
+								Elem:     &schema.Schema{Type: schema.TypeString},
+							},
+							"principal": {
+								Type:         schema.TypeString,
+								Required:     true,
+								ValidateFunc: validation.StringLenBetween(1, 256),
+							},
 						},
 					},
 				},
-			},
-			"physical_table_map": {
-				Type:     schema.TypeSet,
-				Optional: true,
-				MaxItems: 32,
-				Elem:     physicalTableMapSchema(),
-			},
-			"row_level_permission_data_set": {
-				Type:     schema.TypeList,
-				Optional: true,
-				MaxItems: 1,
-				Elem: &schema.Resource{
-					Schema: map[string]*schema.Schema{
-						"arn": {
-							Type:         schema.TypeString,
-							Required:     true,
-							ValidateFunc: verify.ValidARN,
-						},
-						"format_version": {
-							Type:         schema.TypeString,
-							Optional:     true,
-							ValidateFunc: validation.StringInSlice(quicksight.RowLevelPermissionFormatVersion_Values(), false),
-						},
-						"namespace": {
-							Type:         schema.TypeString,
-							Optional:     true,
-							ValidateFunc: validation.StringLenBetween(0, 64),
-						},
-						"permission_policy": {
-							Type:         schema.TypeString,
-							Required:     true,
-							ValidateFunc: validation.StringInSlice(quicksight.RowLevelPermissionPolicy_Values(), false),
-						},
-						"status": {
-							Type:         schema.TypeString,
-							Optional:     true,
-							ValidateFunc: validation.StringInSlice(quicksight.Status_Values(), false),
+				"physical_table_map": {
+					Type:     schema.TypeSet,
+					Optional: true,
+					MaxItems: 32,
+					Elem:     physicalTableMapSchema(),
+				},
+				"row_level_permission_data_set": {
+					Type:     schema.TypeList,
+					Optional: true,
+					MaxItems: 1,
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"arn": {
+								Type:         schema.TypeString,
+								Required:     true,
+								ValidateFunc: verify.ValidARN,
+							},
+							"format_version": {
+								Type:         schema.TypeString,
+								Optional:     true,
+								ValidateFunc: validation.StringInSlice(quicksight.RowLevelPermissionFormatVersion_Values(), false),
+							},
+							"namespace": {
+								Type:         schema.TypeString,
+								Optional:     true,
+								ValidateFunc: validation.StringLenBetween(0, 64),
+							},
+							"permission_policy": {
+								Type:         schema.TypeString,
+								Required:     true,
+								ValidateFunc: validation.StringInSlice(quicksight.RowLevelPermissionPolicy_Values(), false),
+							},
+							"status": {
+								Type:         schema.TypeString,
+								Optional:     true,
+								ValidateFunc: validation.StringInSlice(quicksight.Status_Values(), false),
+							},
 						},
 					},
 				},
-			},
-			"row_level_permission_tag_configuration": {
-				Type:     schema.TypeList,
-				Optional: true,
-				MaxItems: 1,
-				Elem: &schema.Resource{
-					Schema: map[string]*schema.Schema{
-						"status": {
-							Type:         schema.TypeString,
-							Optional:     true,
-							ValidateFunc: validation.StringInSlice(quicksight.Status_Values(), false),
-						},
-						"tag_rules": {
-							Type:     schema.TypeList,
-							Required: true,
-							MinItems: 1,
-							MaxItems: 50,
-							Elem: &schema.Resource{
-								Schema: map[string]*schema.Schema{
-									"column_name": {
-										Type:         schema.TypeString,
-										Required:     true,
-										ValidateFunc: validation.NoZeroValues,
-									},
-									"match_all_value": {
-										Type:         schema.TypeString,
-										Optional:     true,
-										ValidateFunc: validation.StringLenBetween(1, 256),
-									},
-									"tag_key": {
-										Type:         schema.TypeString,
-										Required:     true,
-										ValidateFunc: validation.StringLenBetween(1, 128),
-									},
-									"tag_multi_value_delimiter": {
-										Type:         schema.TypeString,
-										Optional:     true,
-										ValidateFunc: validation.StringLenBetween(1, 10),
+				"row_level_permission_tag_configuration": {
+					Type:     schema.TypeList,
+					Optional: true,
+					MaxItems: 1,
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"status": {
+								Type:         schema.TypeString,
+								Optional:     true,
+								ValidateFunc: validation.StringInSlice(quicksight.Status_Values(), false),
+							},
+							"tag_rules": {
+								Type:     schema.TypeList,
+								Required: true,
+								MinItems: 1,
+								MaxItems: 50,
+								Elem: &schema.Resource{
+									Schema: map[string]*schema.Schema{
+										"column_name": {
+											Type:         schema.TypeString,
+											Required:     true,
+											ValidateFunc: validation.NoZeroValues,
+										},
+										"match_all_value": {
+											Type:         schema.TypeString,
+											Optional:     true,
+											ValidateFunc: validation.StringLenBetween(1, 256),
+										},
+										"tag_key": {
+											Type:         schema.TypeString,
+											Required:     true,
+											ValidateFunc: validation.StringLenBetween(1, 128),
+										},
+										"tag_multi_value_delimiter": {
+											Type:         schema.TypeString,
+											Optional:     true,
+											ValidateFunc: validation.StringLenBetween(1, 10),
+										},
 									},
 								},
 							},
 						},
 					},
 				},
-			},
-			"refresh_properties": {
-				Type:     schema.TypeList,
-				Optional: true,
-				MaxItems: 1,
-				Elem: &schema.Resource{
-					Schema: map[string]*schema.Schema{
-						"refresh_configuration": {
-							Type:     schema.TypeList,
-							Required: true,
-							MaxItems: 1,
-							Elem: &schema.Resource{
-								Schema: map[string]*schema.Schema{
-									"incremental_refresh": {
-										Type:     schema.TypeList,
-										Required: true,
-										MaxItems: 1,
-										Elem: &schema.Resource{
-											Schema: map[string]*schema.Schema{
-												"lookback_window": {
-													Type:     schema.TypeList,
-													Required: true,
-													MaxItems: 1,
-													Elem: &schema.Resource{
-														Schema: map[string]*schema.Schema{
-															"column_name": {
-																Type:     schema.TypeString,
-																Required: true,
-															},
-															"size": {
-																Type:     schema.TypeInt,
-																Required: true,
-															},
-															"size_unit": {
-																Type:         schema.TypeString,
-																Required:     true,
-																ValidateFunc: validation.StringInSlice(quicksight.LookbackWindowSizeUnit_Values(), false),
+				"refresh_properties": {
+					Type:     schema.TypeList,
+					Optional: true,
+					MaxItems: 1,
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"refresh_configuration": {
+								Type:     schema.TypeList,
+								Required: true,
+								MaxItems: 1,
+								Elem: &schema.Resource{
+									Schema: map[string]*schema.Schema{
+										"incremental_refresh": {
+											Type:     schema.TypeList,
+											Required: true,
+											MaxItems: 1,
+											Elem: &schema.Resource{
+												Schema: map[string]*schema.Schema{
+													"lookback_window": {
+														Type:     schema.TypeList,
+														Required: true,
+														MaxItems: 1,
+														Elem: &schema.Resource{
+															Schema: map[string]*schema.Schema{
+																"column_name": {
+																	Type:     schema.TypeString,
+																	Required: true,
+																},
+																"size": {
+																	Type:     schema.TypeInt,
+																	Required: true,
+																},
+																"size_unit": {
+																	Type:         schema.TypeString,
+																	Required:     true,
+																	ValidateFunc: validation.StringInSlice(quicksight.LookbackWindowSizeUnit_Values(), false),
+																},
 															},
 														},
 													},
@@ -348,10 +353,11 @@ func ResourceDataSet() *schema.Resource {
 						},
 					},
 				},
-			},
-			names.AttrTags:    tftags.TagsSchema(),
-			names.AttrTagsAll: tftags.TagsSchemaComputed(),
+				names.AttrTags:    tftags.TagsSchema(),
+				names.AttrTagsAll: tftags.TagsSchemaComputed(),
+			}
 		},
+
 		CustomizeDiff: customdiff.All(
 			func(_ context.Context, diff *schema.ResourceDiff, _ interface{}) error {
 				mode := diff.Get("import_mode").(string)
@@ -871,8 +877,8 @@ func resourceDataSetCreate(ctx context.Context, d *schema.ResourceData, meta int
 		input.LogicalTableMap = expandDataSetLogicalTableMap(v.(*schema.Set))
 	}
 
-	if v, ok := d.GetOk("permissions"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
-		input.Permissions = expandResourcePermissions(v.([]interface{}))
+	if v, ok := d.Get("permissions").(*schema.Set); ok && v.Len() > 0 {
+		input.Permissions = expandResourcePermissions(v.List())
 	}
 
 	if v, ok := d.GetOk("row_level_permission_data_set"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
@@ -1052,10 +1058,10 @@ func resourceDataSetUpdate(ctx context.Context, d *schema.ResourceData, meta int
 		}
 
 		oraw, nraw := d.GetChange("permissions")
-		o := oraw.([]interface{})
-		n := nraw.([]interface{})
+		o := oraw.(*schema.Set)
+		n := nraw.(*schema.Set)
 
-		toGrant, toRevoke := DiffPermissions(o, n)
+		toGrant, toRevoke := DiffPermissions(o.List(), n.List())
 
 		params := &quicksight.UpdateDataSetPermissionsInput{
 			AwsAccountId: aws.String(awsAccountId),
diff --git a/internal/service/quicksight/data_set_data_source.go b/internal/service/quicksight/data_set_data_source.go
index 24883a7ebf7..5ac090680fc 100644
--- a/internal/service/quicksight/data_set_data_source.go
+++ b/internal/service/quicksight/data_set_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package quicksight
 
 import (
@@ -19,214 +22,216 @@ func DataSourceDataSet() *schema.Resource {
 	return &schema.Resource{
 		ReadWithoutTimeout: dataSourceDataSetRead,
 
-		Schema: map[string]*schema.Schema{
-			"arn": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
-			"aws_account_id": {
-				Type:         schema.TypeString,
-				Optional:     true,
-				Computed:     true,
-				ValidateFunc: verify.ValidAccountID,
-			},
-			"column_groups": {
-				Type:     schema.TypeList,
-				Computed: true,
-				Elem: &schema.Resource{
-					Schema: map[string]*schema.Schema{
-						"geo_spatial_column_group": {
-							Type:     schema.TypeList,
-							Computed: true,
-							Elem: &schema.Resource{
-								Schema: map[string]*schema.Schema{
-									"columns": {
-										Type:     schema.TypeList,
-										Computed: true,
-										Elem: &schema.Schema{
-											Type: schema.TypeString,
+		SchemaFunc: func() map[string]*schema.Schema {
+			return map[string]*schema.Schema{
+				"arn": {
+					Type:     schema.TypeString,
+					Computed: true,
+				},
+				"aws_account_id": {
+					Type:         schema.TypeString,
+					Optional:     true,
+					Computed:     true,
+					ValidateFunc: verify.ValidAccountID,
+				},
+				"column_groups": {
+					Type:     schema.TypeList,
+					Computed: true,
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"geo_spatial_column_group": {
+								Type:     schema.TypeList,
+								Computed: true,
+								Elem: &schema.Resource{
+									Schema: map[string]*schema.Schema{
+										"columns": {
+											Type:     schema.TypeList,
+											Computed: true,
+											Elem: &schema.Schema{
+												Type: schema.TypeString,
+											},
+										},
+										"country_code": {
+											Type:     schema.TypeString,
+											Computed: true,
+										},
+										"name": {
+											Type:     schema.TypeString,
+											Computed: true,
 										},
-									},
-									"country_code": {
-										Type:     schema.TypeString,
-										Computed: true,
-									},
-									"name": {
-										Type:     schema.TypeString,
-										Computed: true,
 									},
 								},
 							},
 						},
 					},
 				},
-			},
-			"column_level_permission_rules": {
-				Type:     schema.TypeList,
-				Optional: true,
-				Elem: &schema.Resource{
-					Schema: map[string]*schema.Schema{
-						"column_names": {
-							Type:     schema.TypeList,
-							Computed: true,
-							Elem:     &schema.Schema{Type: schema.TypeString},
-						},
-						"principals": {
-							Type:     schema.TypeList,
-							Computed: true,
-							Elem:     &schema.Schema{Type: schema.TypeString},
+				"column_level_permission_rules": {
+					Type:     schema.TypeList,
+					Optional: true,
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"column_names": {
+								Type:     schema.TypeList,
+								Computed: true,
+								Elem:     &schema.Schema{Type: schema.TypeString},
+							},
+							"principals": {
+								Type:     schema.TypeList,
+								Computed: true,
+								Elem:     &schema.Schema{Type: schema.TypeString},
+							},
 						},
 					},
 				},
-			},
-			"data_set_id": {
-				Type:     schema.TypeString,
-				Required: true,
-			},
-			"data_set_usage_configuration": {
-				Type:     schema.TypeList,
-				Computed: true,
-				Elem: &schema.Resource{
-					Schema: map[string]*schema.Schema{
-						"disable_use_as_direct_query_source": {
-							Type:     schema.TypeBool,
-							Computed: true,
-						},
-						"disable_use_as_imported_source": {
-							Type:     schema.TypeBool,
-							Computed: true,
+				"data_set_id": {
+					Type:     schema.TypeString,
+					Required: true,
+				},
+				"data_set_usage_configuration": {
+					Type:     schema.TypeList,
+					Computed: true,
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"disable_use_as_direct_query_source": {
+								Type:     schema.TypeBool,
+								Computed: true,
+							},
+							"disable_use_as_imported_source": {
+								Type:     schema.TypeBool,
+								Computed: true,
+							},
 						},
 					},
 				},
-			},
-			"field_folders": {
-				Type:     schema.TypeSet,
-				Computed: true,
-				Elem: &schema.Resource{
-					Schema: map[string]*schema.Schema{
-						"field_folders_id": {
-							Type:     schema.TypeString,
-							Computed: true,
-						},
-						"columns": {
-							Type:     schema.TypeList,
-							Computed: true,
-							Elem:     &schema.Schema{Type: schema.TypeString},
-						},
-						"description": {
-							Type:     schema.TypeString,
-							Computed: true,
+				"field_folders": {
+					Type:     schema.TypeSet,
+					Computed: true,
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"field_folders_id": {
+								Type:     schema.TypeString,
+								Computed: true,
+							},
+							"columns": {
+								Type:     schema.TypeList,
+								Computed: true,
+								Elem:     &schema.Schema{Type: schema.TypeString},
+							},
+							"description": {
+								Type:     schema.TypeString,
+								Computed: true,
+							},
 						},
 					},
 				},
-			},
-			"import_mode": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
-			"logical_table_map": {
-				Type:     schema.TypeSet,
-				Computed: true,
-				Elem:     logicalTableMapDataSourceSchema(),
-			},
-			"name": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
-			"permissions": {
-				Type:     schema.TypeList,
-				Computed: true,
-				Elem: &schema.Resource{
-					Schema: map[string]*schema.Schema{
-						"actions": {
-							Type:     schema.TypeSet,
-							Computed: true,
-							Elem:     &schema.Schema{Type: schema.TypeString},
-						},
-						"principal": {
-							Type:     schema.TypeString,
-							Computed: true,
+				"import_mode": {
+					Type:     schema.TypeString,
+					Computed: true,
+				},
+				"logical_table_map": {
+					Type:     schema.TypeSet,
+					Computed: true,
+					Elem:     logicalTableMapDataSourceSchema(),
+				},
+				"name": {
+					Type:     schema.TypeString,
+					Computed: true,
+				},
+				"permissions": {
+					Type:     schema.TypeList,
+					Computed: true,
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"actions": {
+								Type:     schema.TypeSet,
+								Computed: true,
+								Elem:     &schema.Schema{Type: schema.TypeString},
+							},
+							"principal": {
+								Type:     schema.TypeString,
+								Computed: true,
+							},
 						},
 					},
 				},
-			},
-			"physical_table_map": {
-				Type:     schema.TypeSet,
-				Computed: true,
-				Elem:     physicalTableMapDataSourceSchema(),
-			},
-			"row_level_permission_data_set": {
-				Type:     schema.TypeList,
-				Computed: true,
-				Elem: &schema.Resource{
-					Schema: map[string]*schema.Schema{
-						"arn": {
-							Type:     schema.TypeString,
-							Computed: true,
-						},
-						"format_version": {
-							Type:     schema.TypeString,
-							Computed: true,
-						},
-						"namespace": {
-							Type:     schema.TypeString,
-							Computed: true,
-						},
-						"permission_policy": {
-							Type:     schema.TypeString,
-							Computed: true,
-						},
-						"status": {
-							Type:     schema.TypeString,
-							Computed: true,
+				"physical_table_map": {
+					Type:     schema.TypeSet,
+					Computed: true,
+					Elem:     physicalTableMapDataSourceSchema(),
+				},
+				"row_level_permission_data_set": {
+					Type:     schema.TypeList,
+					Computed: true,
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"arn": {
+								Type:     schema.TypeString,
+								Computed: true,
+							},
+							"format_version": {
+								Type:     schema.TypeString,
+								Computed: true,
+							},
+							"namespace": {
+								Type:     schema.TypeString,
+								Computed: true,
+							},
+							"permission_policy": {
+								Type:     schema.TypeString,
+								Computed: true,
+							},
+							"status": {
+								Type:     schema.TypeString,
+								Computed: true,
+							},
 						},
 					},
 				},
-			},
-			"row_level_permission_tag_configuration": {
-				Type:     schema.TypeList,
-				Computed: true,
-				Elem: &schema.Resource{
-					Schema: map[string]*schema.Schema{
-						"status": {
-							Type:     schema.TypeString,
-							Computed: true,
-						},
-						"tag_rules": {
-							Type:     schema.TypeList,
-							Computed: true,
-							Elem: &schema.Resource{
-								Schema: map[string]*schema.Schema{
-									"column_name": {
-										Type:     schema.TypeString,
-										Computed: true,
-									},
-									"match_all_value": {
-										Type:     schema.TypeString,
-										Computed: true,
-									},
-									"tag_key": {
-										Type:     schema.TypeString,
-										Computed: true,
-									},
-									"tag_multi_value_delimiter": {
-										Type:     schema.TypeString,
-										Computed: true,
+				"row_level_permission_tag_configuration": {
+					Type:     schema.TypeList,
+					Computed: true,
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"status": {
+								Type:     schema.TypeString,
+								Computed: true,
+							},
+							"tag_rules": {
+								Type:     schema.TypeList,
+								Computed: true,
+								Elem: &schema.Resource{
+									Schema: map[string]*schema.Schema{
+										"column_name": {
+											Type:     schema.TypeString,
+											Computed: true,
+										},
+										"match_all_value": {
+											Type:     schema.TypeString,
+											Computed: true,
+										},
+										"tag_key": {
+											Type:     schema.TypeString,
+											Computed: true,
+										},
+										"tag_multi_value_delimiter": {
+											Type:     schema.TypeString,
+											Computed: true,
+										},
 									},
 								},
 							},
 						},
 					},
 				},
-			},
-			"tags": tftags.TagsSchemaComputed(),
-			"tags_all": {
-				Type:       schema.TypeMap,
-				Optional:   true,
-				Computed:   true,
-				Elem:       &schema.Schema{Type: schema.TypeString},
-				Deprecated: `this attribute has been deprecated`,
-			},
+				"tags": tftags.TagsSchemaComputed(),
+				"tags_all": {
+					Type:       schema.TypeMap,
+					Optional:   true,
+					Computed:   true,
+					Elem:       &schema.Schema{Type: schema.TypeString},
+					Deprecated: `this attribute has been deprecated`,
+				},
+			}
 		},
 	}
 }
diff --git a/internal/service/quicksight/data_set_data_source_test.go b/internal/service/quicksight/data_set_data_source_test.go
index 5ef3514a404..9694ef185dd 100644
--- a/internal/service/quicksight/data_set_data_source_test.go
+++ b/internal/service/quicksight/data_set_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package quicksight_test
 
 import (
diff --git a/internal/service/quicksight/data_set_test.go b/internal/service/quicksight/data_set_test.go
index 59dac02428b..9baa97a837e 100644
--- a/internal/service/quicksight/data_set_test.go
+++ b/internal/service/quicksight/data_set_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package quicksight_test
 
 import (
@@ -7,6 +10,7 @@ import (
 	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/quicksight"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -276,7 +280,7 @@ func TestAccQuickSightDataSet_permissions(t *testing.T) {
 					testAccCheckDataSetExists(ctx, resourceName, &dataSet),
 					resource.TestCheckResourceAttr(resourceName, "permissions.#", "1"),
 					resource.TestMatchTypeSetElemNestedAttrs(resourceName, "permissions.*", map[string]*regexp.Regexp{
-						"principal": regexp.MustCompile(fmt.Sprintf(`user/default/%s`, rName)),
+						"principal": regexache.MustCompile(fmt.Sprintf(`user/default/%s`, rName)),
 					}),
 					resource.TestCheckTypeSetElemAttr(resourceName, "permissions.*.actions.*", "quicksight:DescribeDataSet"),
 					resource.TestCheckTypeSetElemAttr(resourceName, "permissions.*.actions.*", "quicksight:DescribeDataSetPermissions"),
@@ -296,7 +300,7 @@ func TestAccQuickSightDataSet_permissions(t *testing.T) {
 					testAccCheckDataSetExists(ctx, resourceName, &dataSet),
 					resource.TestCheckResourceAttr(resourceName, "permissions.#", "1"),
 					resource.TestMatchTypeSetElemNestedAttrs(resourceName, "permissions.*", map[string]*regexp.Regexp{
-						"principal": regexp.MustCompile(fmt.Sprintf(`user/default/%s`, rName)),
+						"principal": regexache.MustCompile(fmt.Sprintf(`user/default/%s`, rName)),
 					}),
 					resource.TestCheckTypeSetElemAttr(resourceName, "permissions.*.actions.*", "quicksight:DescribeDataSet"),
 					resource.TestCheckTypeSetElemAttr(resourceName, "permissions.*.actions.*", "quicksight:DescribeDataSetPermissions"),
@@ -326,6 +330,43 @@ func TestAccQuickSightDataSet_permissions(t *testing.T) {
 	})
 }
 
+func TestAccQuickSightDataSet_permissionsMultiple(t *testing.T) {
+	ctx := acctest.Context(t)
+	var dataSet quicksight.DataSet
+	resourceName := "aws_quicksight_data_set.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	rId := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, quicksight.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckDataSetDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccDataSetConfigPermissionsMultiple(rId, rName, 3),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckDataSetExists(ctx, resourceName, &dataSet),
+					resource.TestCheckResourceAttr(resourceName, "permissions.#", "3"),
+					resource.TestMatchTypeSetElemNestedAttrs(resourceName, "permissions.*", map[string]*regexp.Regexp{
+						"principal": regexache.MustCompile(fmt.Sprintf(`user/default/%s`, rName)),
+					}),
+					resource.TestCheckTypeSetElemAttr(resourceName, "permissions.*.actions.*", "quicksight:DescribeDataSet"),
+					resource.TestCheckTypeSetElemAttr(resourceName, "permissions.*.actions.*", "quicksight:DescribeDataSetPermissions"),
+					resource.TestCheckTypeSetElemAttr(resourceName, "permissions.*.actions.*", "quicksight:PassDataSet"),
+					resource.TestCheckTypeSetElemAttr(resourceName, "permissions.*.actions.*", "quicksight:DescribeIngestion"),
+					resource.TestCheckTypeSetElemAttr(resourceName, "permissions.*.actions.*", "quicksight:ListIngestions"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
 func TestAccQuickSightDataSet_rowLevelPermissionTagConfiguration(t *testing.T) {
 	ctx := acctest.Context(t)
 	var dataSet quicksight.DataSet
@@ -896,6 +937,47 @@ resource "aws_quicksight_data_set" "test" {
 `, rId, rName))
 }
 
+func testAccDataSetConfigPermissionsMultiple(rId, rName string, count int) string {
+	return acctest.ConfigCompose(
+		testAccDataSetConfigBase(rId, rName),
+		testAccDataSource_UserConfigMultiple(rName, count),
+		fmt.Sprintf(`
+resource "aws_quicksight_data_set" "test" {
+  data_set_id = %[1]q
+  name        = %[2]q
+  import_mode = "SPICE"
+
+  physical_table_map {
+    physical_table_map_id = %[1]q
+    s3_source {
+      data_source_arn = aws_quicksight_data_source.test.arn
+      input_columns {
+        name = "Column1"
+        type = "STRING"
+      }
+      upload_settings {
+        format = "JSON"
+      }
+    }
+  }
+
+  dynamic "permissions" {
+    for_each = aws_quicksight_user.test
+    content {
+      actions = [
+        "quicksight:DescribeDataSet",
+        "quicksight:DescribeDataSetPermissions",
+        "quicksight:PassDataSet",
+        "quicksight:DescribeIngestion",
+        "quicksight:ListIngestions",
+      ]
+      principal = aws_quicksight_user.test[permissions.key].arn
+    }
+  }
+}
+`, rId, rName))
+}
+
 func testAccDataSetConfigRowLevelPermissionTagConfiguration(rId, rName string) string {
 	return acctest.ConfigCompose(
 		testAccDataSetConfigBase(rId, rName),
diff --git a/internal/service/quicksight/data_source.go b/internal/service/quicksight/data_source.go
index 1a2c6f5d1c5..3412f9be1bb 100644
--- a/internal/service/quicksight/data_source.go
+++ b/internal/service/quicksight/data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package quicksight
 
 import (
@@ -31,574 +34,577 @@ func ResourceDataSource() *schema.Resource {
 			StateContext: schema.ImportStatePassthroughContext,
 		},
 
-		Schema: map[string]*schema.Schema{
-			"arn": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
+		SchemaFunc: func() map[string]*schema.Schema {
+			return map[string]*schema.Schema{
+				"arn": {
+					Type:     schema.TypeString,
+					Computed: true,
+				},
 
-			"aws_account_id": {
-				Type:         schema.TypeString,
-				Optional:     true,
-				Computed:     true,
-				ForceNew:     true,
-				ValidateFunc: verify.ValidAccountID,
-			},
+				"aws_account_id": {
+					Type:         schema.TypeString,
+					Optional:     true,
+					Computed:     true,
+					ForceNew:     true,
+					ValidateFunc: verify.ValidAccountID,
+				},
 
-			"credentials": {
-				Type:     schema.TypeList,
-				Optional: true,
-				MaxItems: 1,
-				Elem: &schema.Resource{
-					Schema: map[string]*schema.Schema{
-						"copy_source_arn": {
-							Type:          schema.TypeString,
-							Optional:      true,
-							ValidateFunc:  verify.ValidARN,
-							ConflictsWith: []string{"credentials.0.credential_pair"},
-						},
-						"credential_pair": {
-							Type:     schema.TypeList,
-							Optional: true,
-							MaxItems: 1,
-							Elem: &schema.Resource{
-								Schema: map[string]*schema.Schema{
-									"password": {
-										Type:     schema.TypeString,
-										Required: true,
-										ValidateFunc: validation.All(
-											validation.NoZeroValues,
-											validation.StringLenBetween(1, 1024),
-										),
-										Sensitive: true,
-									},
-									"username": {
-										Type:     schema.TypeString,
-										Required: true,
-										ValidateFunc: validation.All(
-											validation.NoZeroValues,
-											validation.StringLenBetween(1, 64),
-										),
-										Sensitive: true,
+				"credentials": {
+					Type:     schema.TypeList,
+					Optional: true,
+					MaxItems: 1,
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"copy_source_arn": {
+								Type:          schema.TypeString,
+								Optional:      true,
+								ValidateFunc:  verify.ValidARN,
+								ConflictsWith: []string{"credentials.0.credential_pair"},
+							},
+							"credential_pair": {
+								Type:     schema.TypeList,
+								Optional: true,
+								MaxItems: 1,
+								Elem: &schema.Resource{
+									Schema: map[string]*schema.Schema{
+										"password": {
+											Type:     schema.TypeString,
+											Required: true,
+											ValidateFunc: validation.All(
+												validation.NoZeroValues,
+												validation.StringLenBetween(1, 1024),
+											),
+											Sensitive: true,
+										},
+										"username": {
+											Type:     schema.TypeString,
+											Required: true,
+											ValidateFunc: validation.All(
+												validation.NoZeroValues,
+												validation.StringLenBetween(1, 64),
+											),
+											Sensitive: true,
+										},
 									},
 								},
+								ConflictsWith: []string{"credentials.0.copy_source_arn"},
 							},
-							ConflictsWith: []string{"credentials.0.copy_source_arn"},
 						},
 					},
 				},
-			},
 
-			"data_source_id": {
-				Type:     schema.TypeString,
-				Required: true,
-				ForceNew: true,
-			},
+				"data_source_id": {
+					Type:     schema.TypeString,
+					Required: true,
+					ForceNew: true,
+				},
 
-			"name": {
-				Type:     schema.TypeString,
-				Required: true,
-				ValidateFunc: validation.All(
-					validation.NoZeroValues,
-					validation.StringLenBetween(1, 128),
-				),
-			},
+				"name": {
+					Type:     schema.TypeString,
+					Required: true,
+					ValidateFunc: validation.All(
+						validation.NoZeroValues,
+						validation.StringLenBetween(1, 128),
+					),
+				},
 
-			"parameters": {
-				Type:     schema.TypeList,
-				Required: true,
-				MaxItems: 1,
-				MinItems: 1,
-				Elem: &schema.Resource{
-					Schema: map[string]*schema.Schema{
-						"amazon_elasticsearch": {
-							Type:     schema.TypeList,
-							Optional: true,
-							MaxItems: 1,
-							Elem: &schema.Resource{
-								Schema: map[string]*schema.Schema{
-									"domain": {
-										Type:         schema.TypeString,
-										Required:     true,
-										ValidateFunc: validation.NoZeroValues,
+				"parameters": {
+					Type:     schema.TypeList,
+					Required: true,
+					MaxItems: 1,
+					MinItems: 1,
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"amazon_elasticsearch": {
+								Type:     schema.TypeList,
+								Optional: true,
+								MaxItems: 1,
+								Elem: &schema.Resource{
+									Schema: map[string]*schema.Schema{
+										"domain": {
+											Type:         schema.TypeString,
+											Required:     true,
+											ValidateFunc: validation.NoZeroValues,
+										},
 									},
 								},
 							},
-						},
-						"athena": {
-							Type:     schema.TypeList,
-							Optional: true,
-							MaxItems: 1,
-							Elem: &schema.Resource{
-								Schema: map[string]*schema.Schema{
-									"work_group": {
-										Type:         schema.TypeString,
-										Optional:     true,
-										ValidateFunc: validation.NoZeroValues,
+							"athena": {
+								Type:     schema.TypeList,
+								Optional: true,
+								MaxItems: 1,
+								Elem: &schema.Resource{
+									Schema: map[string]*schema.Schema{
+										"work_group": {
+											Type:         schema.TypeString,
+											Optional:     true,
+											ValidateFunc: validation.NoZeroValues,
+										},
 									},
 								},
 							},
-						},
-						"aurora": {
-							Type:     schema.TypeList,
-							Optional: true,
-							MaxItems: 1,
-							Elem: &schema.Resource{
-								Schema: map[string]*schema.Schema{
-									"database": {
-										Type:         schema.TypeString,
-										Required:     true,
-										ValidateFunc: validation.NoZeroValues,
-									},
-									"host": {
-										Type:         schema.TypeString,
-										Required:     true,
-										ValidateFunc: validation.NoZeroValues,
-									},
-									"port": {
-										Type:         schema.TypeInt,
-										Required:     true,
-										ValidateFunc: validation.IntAtLeast(1),
+							"aurora": {
+								Type:     schema.TypeList,
+								Optional: true,
+								MaxItems: 1,
+								Elem: &schema.Resource{
+									Schema: map[string]*schema.Schema{
+										"database": {
+											Type:         schema.TypeString,
+											Required:     true,
+											ValidateFunc: validation.NoZeroValues,
+										},
+										"host": {
+											Type:         schema.TypeString,
+											Required:     true,
+											ValidateFunc: validation.NoZeroValues,
+										},
+										"port": {
+											Type:         schema.TypeInt,
+											Required:     true,
+											ValidateFunc: validation.IntAtLeast(1),
+										},
 									},
 								},
 							},
-						},
-						"aurora_postgresql": {
-							Type:     schema.TypeList,
-							Optional: true,
-							MaxItems: 1,
-							Elem: &schema.Resource{
-								Schema: map[string]*schema.Schema{
-									"database": {
-										Type:         schema.TypeString,
-										Required:     true,
-										ValidateFunc: validation.NoZeroValues,
-									},
-									"host": {
-										Type:         schema.TypeString,
-										Required:     true,
-										ValidateFunc: validation.NoZeroValues,
-									},
-									"port": {
-										Type:         schema.TypeInt,
-										Required:     true,
-										ValidateFunc: validation.IntAtLeast(1),
+							"aurora_postgresql": {
+								Type:     schema.TypeList,
+								Optional: true,
+								MaxItems: 1,
+								Elem: &schema.Resource{
+									Schema: map[string]*schema.Schema{
+										"database": {
+											Type:         schema.TypeString,
+											Required:     true,
+											ValidateFunc: validation.NoZeroValues,
+										},
+										"host": {
+											Type:         schema.TypeString,
+											Required:     true,
+											ValidateFunc: validation.NoZeroValues,
+										},
+										"port": {
+											Type:         schema.TypeInt,
+											Required:     true,
+											ValidateFunc: validation.IntAtLeast(1),
+										},
 									},
 								},
 							},
-						},
-						"aws_iot_analytics": {
-							Type:     schema.TypeList,
-							Optional: true,
-							MaxItems: 1,
-							Elem: &schema.Resource{
-								Schema: map[string]*schema.Schema{
-									"data_set_name": {
-										Type:         schema.TypeString,
-										Required:     true,
-										ValidateFunc: validation.NoZeroValues,
+							"aws_iot_analytics": {
+								Type:     schema.TypeList,
+								Optional: true,
+								MaxItems: 1,
+								Elem: &schema.Resource{
+									Schema: map[string]*schema.Schema{
+										"data_set_name": {
+											Type:         schema.TypeString,
+											Required:     true,
+											ValidateFunc: validation.NoZeroValues,
+										},
 									},
 								},
 							},
-						},
-						"jira": {
-							Type:     schema.TypeList,
-							Optional: true,
-							MaxItems: 1,
-							Elem: &schema.Resource{
-								Schema: map[string]*schema.Schema{
-									"site_base_url": {
-										Type:         schema.TypeString,
-										Required:     true,
-										ValidateFunc: validation.NoZeroValues,
+							"jira": {
+								Type:     schema.TypeList,
+								Optional: true,
+								MaxItems: 1,
+								Elem: &schema.Resource{
+									Schema: map[string]*schema.Schema{
+										"site_base_url": {
+											Type:         schema.TypeString,
+											Required:     true,
+											ValidateFunc: validation.NoZeroValues,
+										},
 									},
 								},
 							},
-						},
-						"maria_db": {
-							Type:     schema.TypeList,
-							Optional: true,
-							MaxItems: 1,
-							Elem: &schema.Resource{
-								Schema: map[string]*schema.Schema{
-									"database": {
-										Type:         schema.TypeString,
-										Required:     true,
-										ValidateFunc: validation.NoZeroValues,
-									},
-									"host": {
-										Type:         schema.TypeString,
-										Required:     true,
-										ValidateFunc: validation.NoZeroValues,
-									},
-									"port": {
-										Type:         schema.TypeInt,
-										Required:     true,
-										ValidateFunc: validation.IntAtLeast(1),
+							"maria_db": {
+								Type:     schema.TypeList,
+								Optional: true,
+								MaxItems: 1,
+								Elem: &schema.Resource{
+									Schema: map[string]*schema.Schema{
+										"database": {
+											Type:         schema.TypeString,
+											Required:     true,
+											ValidateFunc: validation.NoZeroValues,
+										},
+										"host": {
+											Type:         schema.TypeString,
+											Required:     true,
+											ValidateFunc: validation.NoZeroValues,
+										},
+										"port": {
+											Type:         schema.TypeInt,
+											Required:     true,
+											ValidateFunc: validation.IntAtLeast(1),
+										},
 									},
 								},
 							},
-						},
-						"mysql": {
-							Type:     schema.TypeList,
-							Optional: true,
-							MaxItems: 1,
-							Elem: &schema.Resource{
-								Schema: map[string]*schema.Schema{
-									"database": {
-										Type:         schema.TypeString,
-										Required:     true,
-										ValidateFunc: validation.NoZeroValues,
-									},
-									"host": {
-										Type:         schema.TypeString,
-										Required:     true,
-										ValidateFunc: validation.NoZeroValues,
-									},
-									"port": {
-										Type:         schema.TypeInt,
-										Required:     true,
-										ValidateFunc: validation.IntAtLeast(1),
+							"mysql": {
+								Type:     schema.TypeList,
+								Optional: true,
+								MaxItems: 1,
+								Elem: &schema.Resource{
+									Schema: map[string]*schema.Schema{
+										"database": {
+											Type:         schema.TypeString,
+											Required:     true,
+											ValidateFunc: validation.NoZeroValues,
+										},
+										"host": {
+											Type:         schema.TypeString,
+											Required:     true,
+											ValidateFunc: validation.NoZeroValues,
+										},
+										"port": {
+											Type:         schema.TypeInt,
+											Required:     true,
+											ValidateFunc: validation.IntAtLeast(1),
+										},
 									},
 								},
 							},
-						},
-						"oracle": {
-							Type:     schema.TypeList,
-							Optional: true,
-							MaxItems: 1,
-							Elem: &schema.Resource{
-								Schema: map[string]*schema.Schema{
-									"database": {
-										Type:         schema.TypeString,
-										Required:     true,
-										ValidateFunc: validation.NoZeroValues,
-									},
-									"host": {
-										Type:         schema.TypeString,
-										Required:     true,
-										ValidateFunc: validation.NoZeroValues,
-									},
-									"port": {
-										Type:         schema.TypeInt,
-										Required:     true,
-										ValidateFunc: validation.IntAtLeast(1),
+							"oracle": {
+								Type:     schema.TypeList,
+								Optional: true,
+								MaxItems: 1,
+								Elem: &schema.Resource{
+									Schema: map[string]*schema.Schema{
+										"database": {
+											Type:         schema.TypeString,
+											Required:     true,
+											ValidateFunc: validation.NoZeroValues,
+										},
+										"host": {
+											Type:         schema.TypeString,
+											Required:     true,
+											ValidateFunc: validation.NoZeroValues,
+										},
+										"port": {
+											Type:         schema.TypeInt,
+											Required:     true,
+											ValidateFunc: validation.IntAtLeast(1),
+										},
 									},
 								},
 							},
-						},
-						"postgresql": {
-							Type:     schema.TypeList,
-							Optional: true,
-							MaxItems: 1,
-							Elem: &schema.Resource{
-								Schema: map[string]*schema.Schema{
-									"database": {
-										Type:         schema.TypeString,
-										Required:     true,
-										ValidateFunc: validation.NoZeroValues,
-									},
-									"host": {
-										Type:         schema.TypeString,
-										Required:     true,
-										ValidateFunc: validation.NoZeroValues,
-									},
-									"port": {
-										Type:         schema.TypeInt,
-										Required:     true,
-										ValidateFunc: validation.IntAtLeast(1),
+							"postgresql": {
+								Type:     schema.TypeList,
+								Optional: true,
+								MaxItems: 1,
+								Elem: &schema.Resource{
+									Schema: map[string]*schema.Schema{
+										"database": {
+											Type:         schema.TypeString,
+											Required:     true,
+											ValidateFunc: validation.NoZeroValues,
+										},
+										"host": {
+											Type:         schema.TypeString,
+											Required:     true,
+											ValidateFunc: validation.NoZeroValues,
+										},
+										"port": {
+											Type:         schema.TypeInt,
+											Required:     true,
+											ValidateFunc: validation.IntAtLeast(1),
+										},
 									},
 								},
 							},
-						},
-						"presto": {
-							Type:     schema.TypeList,
-							Optional: true,
-							MaxItems: 1,
-							Elem: &schema.Resource{
-								Schema: map[string]*schema.Schema{
-									"catalog": {
-										Type:         schema.TypeString,
-										Required:     true,
-										ValidateFunc: validation.NoZeroValues,
-									},
-									"host": {
-										Type:         schema.TypeString,
-										Required:     true,
-										ValidateFunc: validation.NoZeroValues,
-									},
-									"port": {
-										Type:         schema.TypeInt,
-										Required:     true,
-										ValidateFunc: validation.IntAtLeast(1),
+							"presto": {
+								Type:     schema.TypeList,
+								Optional: true,
+								MaxItems: 1,
+								Elem: &schema.Resource{
+									Schema: map[string]*schema.Schema{
+										"catalog": {
+											Type:         schema.TypeString,
+											Required:     true,
+											ValidateFunc: validation.NoZeroValues,
+										},
+										"host": {
+											Type:         schema.TypeString,
+											Required:     true,
+											ValidateFunc: validation.NoZeroValues,
+										},
+										"port": {
+											Type:         schema.TypeInt,
+											Required:     true,
+											ValidateFunc: validation.IntAtLeast(1),
+										},
 									},
 								},
 							},
-						},
-						"rds": {
-							Type:     schema.TypeList,
-							Optional: true,
-							MaxItems: 1,
-							Elem: &schema.Resource{
-								Schema: map[string]*schema.Schema{
-									"database": {
-										Type:         schema.TypeString,
-										Required:     true,
-										ValidateFunc: validation.NoZeroValues,
-									},
-									"instance_id": {
-										Type:         schema.TypeString,
-										Required:     true,
-										ValidateFunc: validation.NoZeroValues,
+							"rds": {
+								Type:     schema.TypeList,
+								Optional: true,
+								MaxItems: 1,
+								Elem: &schema.Resource{
+									Schema: map[string]*schema.Schema{
+										"database": {
+											Type:         schema.TypeString,
+											Required:     true,
+											ValidateFunc: validation.NoZeroValues,
+										},
+										"instance_id": {
+											Type:         schema.TypeString,
+											Required:     true,
+											ValidateFunc: validation.NoZeroValues,
+										},
 									},
 								},
 							},
-						},
-						"redshift": {
-							Type:     schema.TypeList,
-							Optional: true,
-							MaxItems: 1,
-							Elem: &schema.Resource{
-								Schema: map[string]*schema.Schema{
-									"cluster_id": {
-										Type:         schema.TypeString,
-										Optional:     true,
-										ValidateFunc: validation.NoZeroValues,
-									},
-									"database": {
-										Type:         schema.TypeString,
-										Required:     true,
-										ValidateFunc: validation.NoZeroValues,
-									},
-									"host": {
-										Type:     schema.TypeString,
-										Optional: true,
-									},
-									"port": {
-										Type:     schema.TypeInt,
-										Optional: true,
+							"redshift": {
+								Type:     schema.TypeList,
+								Optional: true,
+								MaxItems: 1,
+								Elem: &schema.Resource{
+									Schema: map[string]*schema.Schema{
+										"cluster_id": {
+											Type:         schema.TypeString,
+											Optional:     true,
+											ValidateFunc: validation.NoZeroValues,
+										},
+										"database": {
+											Type:         schema.TypeString,
+											Required:     true,
+											ValidateFunc: validation.NoZeroValues,
+										},
+										"host": {
+											Type:     schema.TypeString,
+											Optional: true,
+										},
+										"port": {
+											Type:     schema.TypeInt,
+											Optional: true,
+										},
 									},
 								},
 							},
-						},
-						"s3": {
-							Type:     schema.TypeList,
-							Optional: true,
-							MaxItems: 1,
-							Elem: &schema.Resource{
-								Schema: map[string]*schema.Schema{
-									"manifest_file_location": {
-										Type:     schema.TypeList,
-										Required: true,
-										MaxItems: 1,
-										Elem: &schema.Resource{
-											Schema: map[string]*schema.Schema{
-												"bucket": {
-													Type:         schema.TypeString,
-													Required:     true,
-													ValidateFunc: validation.NoZeroValues,
-												},
-												"key": {
-													Type:         schema.TypeString,
-													Required:     true,
-													ValidateFunc: validation.NoZeroValues,
+							"s3": {
+								Type:     schema.TypeList,
+								Optional: true,
+								MaxItems: 1,
+								Elem: &schema.Resource{
+									Schema: map[string]*schema.Schema{
+										"manifest_file_location": {
+											Type:     schema.TypeList,
+											Required: true,
+											MaxItems: 1,
+											Elem: &schema.Resource{
+												Schema: map[string]*schema.Schema{
+													"bucket": {
+														Type:         schema.TypeString,
+														Required:     true,
+														ValidateFunc: validation.NoZeroValues,
+													},
+													"key": {
+														Type:         schema.TypeString,
+														Required:     true,
+														ValidateFunc: validation.NoZeroValues,
+													},
 												},
 											},
 										},
 									},
 								},
 							},
-						},
-						"service_now": {
-							Type:     schema.TypeList,
-							Optional: true,
-							MaxItems: 1,
-							Elem: &schema.Resource{
-								Schema: map[string]*schema.Schema{
-									"site_base_url": {
-										Type:         schema.TypeString,
-										Required:     true,
-										ValidateFunc: validation.NoZeroValues,
+							"service_now": {
+								Type:     schema.TypeList,
+								Optional: true,
+								MaxItems: 1,
+								Elem: &schema.Resource{
+									Schema: map[string]*schema.Schema{
+										"site_base_url": {
+											Type:         schema.TypeString,
+											Required:     true,
+											ValidateFunc: validation.NoZeroValues,
+										},
 									},
 								},
 							},
-						},
-						"snowflake": {
-							Type:     schema.TypeList,
-							Optional: true,
-							MaxItems: 1,
-							Elem: &schema.Resource{
-								Schema: map[string]*schema.Schema{
-									"database": {
-										Type:         schema.TypeString,
-										Required:     true,
-										ValidateFunc: validation.NoZeroValues,
-									},
-									"host": {
-										Type:         schema.TypeString,
-										Required:     true,
-										ValidateFunc: validation.NoZeroValues,
-									},
-									"warehouse": {
-										Type:         schema.TypeString,
-										Required:     true,
-										ValidateFunc: validation.NoZeroValues,
+							"snowflake": {
+								Type:     schema.TypeList,
+								Optional: true,
+								MaxItems: 1,
+								Elem: &schema.Resource{
+									Schema: map[string]*schema.Schema{
+										"database": {
+											Type:         schema.TypeString,
+											Required:     true,
+											ValidateFunc: validation.NoZeroValues,
+										},
+										"host": {
+											Type:         schema.TypeString,
+											Required:     true,
+											ValidateFunc: validation.NoZeroValues,
+										},
+										"warehouse": {
+											Type:         schema.TypeString,
+											Required:     true,
+											ValidateFunc: validation.NoZeroValues,
+										},
 									},
 								},
 							},
-						},
-						"spark": {
-							Type:     schema.TypeList,
-							Optional: true,
-							MaxItems: 1,
-							Elem: &schema.Resource{
-								Schema: map[string]*schema.Schema{
-									"host": {
-										Type:         schema.TypeString,
-										Required:     true,
-										ValidateFunc: validation.NoZeroValues,
-									},
-									"port": {
-										Type:         schema.TypeInt,
-										Required:     true,
-										ValidateFunc: validation.IntAtLeast(1),
+							"spark": {
+								Type:     schema.TypeList,
+								Optional: true,
+								MaxItems: 1,
+								Elem: &schema.Resource{
+									Schema: map[string]*schema.Schema{
+										"host": {
+											Type:         schema.TypeString,
+											Required:     true,
+											ValidateFunc: validation.NoZeroValues,
+										},
+										"port": {
+											Type:         schema.TypeInt,
+											Required:     true,
+											ValidateFunc: validation.IntAtLeast(1),
+										},
 									},
 								},
 							},
-						},
-						"sql_server": {
-							Type:     schema.TypeList,
-							Optional: true,
-							MaxItems: 1,
-							Elem: &schema.Resource{
-								Schema: map[string]*schema.Schema{
-									"database": {
-										Type:         schema.TypeString,
-										Required:     true,
-										ValidateFunc: validation.NoZeroValues,
-									},
-									"host": {
-										Type:         schema.TypeString,
-										Required:     true,
-										ValidateFunc: validation.NoZeroValues,
-									},
-									"port": {
-										Type:         schema.TypeInt,
-										Required:     true,
-										ValidateFunc: validation.IntAtLeast(1),
+							"sql_server": {
+								Type:     schema.TypeList,
+								Optional: true,
+								MaxItems: 1,
+								Elem: &schema.Resource{
+									Schema: map[string]*schema.Schema{
+										"database": {
+											Type:         schema.TypeString,
+											Required:     true,
+											ValidateFunc: validation.NoZeroValues,
+										},
+										"host": {
+											Type:         schema.TypeString,
+											Required:     true,
+											ValidateFunc: validation.NoZeroValues,
+										},
+										"port": {
+											Type:         schema.TypeInt,
+											Required:     true,
+											ValidateFunc: validation.IntAtLeast(1),
+										},
 									},
 								},
 							},
-						},
-						"teradata": {
-							Type:     schema.TypeList,
-							Optional: true,
-							MaxItems: 1,
-							Elem: &schema.Resource{
-								Schema: map[string]*schema.Schema{
-									"database": {
-										Type:         schema.TypeString,
-										Required:     true,
-										ValidateFunc: validation.NoZeroValues,
-									},
-									"host": {
-										Type:         schema.TypeString,
-										Required:     true,
-										ValidateFunc: validation.NoZeroValues,
-									},
-									"port": {
-										Type:         schema.TypeInt,
-										Required:     true,
-										ValidateFunc: validation.IntAtLeast(1),
+							"teradata": {
+								Type:     schema.TypeList,
+								Optional: true,
+								MaxItems: 1,
+								Elem: &schema.Resource{
+									Schema: map[string]*schema.Schema{
+										"database": {
+											Type:         schema.TypeString,
+											Required:     true,
+											ValidateFunc: validation.NoZeroValues,
+										},
+										"host": {
+											Type:         schema.TypeString,
+											Required:     true,
+											ValidateFunc: validation.NoZeroValues,
+										},
+										"port": {
+											Type:         schema.TypeInt,
+											Required:     true,
+											ValidateFunc: validation.IntAtLeast(1),
+										},
 									},
 								},
 							},
-						},
-						"twitter": {
-							Type:     schema.TypeList,
-							Optional: true,
-							MaxItems: 1,
-							Elem: &schema.Resource{
-								Schema: map[string]*schema.Schema{
-									"max_rows": {
-										Type:         schema.TypeInt,
-										Required:     true,
-										ValidateFunc: validation.IntAtLeast(1),
-									},
-									"query": {
-										Type:         schema.TypeString,
-										Required:     true,
-										ValidateFunc: validation.NoZeroValues,
+							"twitter": {
+								Type:     schema.TypeList,
+								Optional: true,
+								MaxItems: 1,
+								Elem: &schema.Resource{
+									Schema: map[string]*schema.Schema{
+										"max_rows": {
+											Type:         schema.TypeInt,
+											Required:     true,
+											ValidateFunc: validation.IntAtLeast(1),
+										},
+										"query": {
+											Type:         schema.TypeString,
+											Required:     true,
+											ValidateFunc: validation.NoZeroValues,
+										},
 									},
 								},
 							},
 						},
 					},
 				},
-			},
 
-			"permission": {
-				Type:     schema.TypeSet,
-				Optional: true,
-				MinItems: 1,
-				MaxItems: 64,
-				Elem: &schema.Resource{
-					Schema: map[string]*schema.Schema{
-						"actions": {
-							Type:     schema.TypeSet,
-							Required: true,
-							Elem:     &schema.Schema{Type: schema.TypeString},
-							MinItems: 1,
-							MaxItems: 16,
-						},
-						"principal": {
-							Type:         schema.TypeString,
-							Required:     true,
-							ValidateFunc: verify.ValidARN,
+				"permission": {
+					Type:     schema.TypeSet,
+					Optional: true,
+					MinItems: 1,
+					MaxItems: 64,
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"actions": {
+								Type:     schema.TypeSet,
+								Required: true,
+								Elem:     &schema.Schema{Type: schema.TypeString},
+								MinItems: 1,
+								MaxItems: 16,
+							},
+							"principal": {
+								Type:         schema.TypeString,
+								Required:     true,
+								ValidateFunc: verify.ValidARN,
+							},
 						},
 					},
 				},
-			},
 
-			"ssl_properties": {
-				Type:     schema.TypeList,
-				Optional: true,
-				MaxItems: 1,
-				Elem: &schema.Resource{
-					Schema: map[string]*schema.Schema{
-						"disable_ssl": {
-							Type:     schema.TypeBool,
-							Required: true,
+				"ssl_properties": {
+					Type:     schema.TypeList,
+					Optional: true,
+					MaxItems: 1,
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"disable_ssl": {
+								Type:     schema.TypeBool,
+								Required: true,
+							},
 						},
 					},
 				},
-			},
 
-			names.AttrTags:    tftags.TagsSchema(),
-			names.AttrTagsAll: tftags.TagsSchemaComputed(),
+				names.AttrTags:    tftags.TagsSchema(),
+				names.AttrTagsAll: tftags.TagsSchemaComputed(),
 
-			"type": {
-				Type:         schema.TypeString,
-				Required:     true,
-				ForceNew:     true,
-				ValidateFunc: validation.StringInSlice(quicksight.DataSourceType_Values(), false),
-			},
+				"type": {
+					Type:         schema.TypeString,
+					Required:     true,
+					ForceNew:     true,
+					ValidateFunc: validation.StringInSlice(quicksight.DataSourceType_Values(), false),
+				},
 
-			"vpc_connection_properties": {
-				Type:     schema.TypeList,
-				Optional: true,
-				MaxItems: 1,
-				Elem: &schema.Resource{
-					Schema: map[string]*schema.Schema{
-						"vpc_connection_arn": {
-							Type:         schema.TypeString,
-							Required:     true,
-							ValidateFunc: verify.ValidARN,
+				"vpc_connection_properties": {
+					Type:     schema.TypeList,
+					Optional: true,
+					MaxItems: 1,
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"vpc_connection_arn": {
+								Type:         schema.TypeString,
+								Required:     true,
+								ValidateFunc: verify.ValidARN,
+							},
 						},
 					},
 				},
-			},
+			}
 		},
+
 		CustomizeDiff: verify.SetTagsDiff,
 	}
 }
diff --git a/internal/service/quicksight/data_source_test.go b/internal/service/quicksight/data_source_test.go
index 009b29f4015..65c47e7085c 100644
--- a/internal/service/quicksight/data_source_test.go
+++ b/internal/service/quicksight/data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package quicksight_test
 
 import (
@@ -6,6 +9,7 @@ import (
 	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/quicksight"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -146,7 +150,7 @@ func TestAccQuickSightDataSource_permissions(t *testing.T) {
 					testAccCheckDataSourceExists(ctx, resourceName, &dataSource),
 					resource.TestCheckResourceAttr(resourceName, "permission.#", "1"),
 					resource.TestMatchTypeSetElemNestedAttrs(resourceName, "permission.*", map[string]*regexp.Regexp{
-						"principal": regexp.MustCompile(fmt.Sprintf(`user/default/%s`, rName)),
+						"principal": regexache.MustCompile(fmt.Sprintf(`user/default/%s`, rName)),
 					}),
 					resource.TestCheckTypeSetElemAttr(resourceName, "permission.*.actions.*", "quicksight:DescribeDataSource"),
 					resource.TestCheckTypeSetElemAttr(resourceName, "permission.*.actions.*", "quicksight:DescribeDataSourcePermissions"),
@@ -164,7 +168,7 @@ func TestAccQuickSightDataSource_permissions(t *testing.T) {
 					testAccCheckDataSourceExists(ctx, resourceName, &dataSource),
 					resource.TestCheckResourceAttr(resourceName, "permission.#", "1"),
 					resource.TestMatchTypeSetElemNestedAttrs(resourceName, "permission.*", map[string]*regexp.Regexp{
-						"principal": regexp.MustCompile(fmt.Sprintf(`user/default/%s`, rName)),
+						"principal": regexache.MustCompile(fmt.Sprintf(`user/default/%s`, rName)),
 					}),
 					resource.TestCheckTypeSetElemAttr(resourceName, "permission.*.actions.*", "quicksight:DescribeDataSource"),
 					resource.TestCheckTypeSetElemAttr(resourceName, "permission.*.actions.*", "quicksight:DescribeDataSourcePermissions"),
@@ -432,6 +436,26 @@ resource "aws_quicksight_user" "test" {
 `, rName, acctest.DefaultEmailAddress)
 }
 
+func testAccDataSource_UserConfigMultiple(rName string, count int) string {
+	return fmt.Sprintf(`
+data "aws_caller_identity" "current" {}
+
+resource "aws_quicksight_user" "test" {
+  count = %[3]d
+
+  aws_account_id = data.aws_caller_identity.current.account_id
+  user_name      = "%[1]s-${count.index}"
+  email          = %[2]q
+  identity_type  = "QUICKSIGHT"
+  user_role      = "AUTHOR"
+
+  lifecycle {
+    create_before_destroy = true
+  }
+}
+`, rName, acctest.DefaultEmailAddress, count)
+}
+
 func testAccDataSourceConfig_permissions(rId, rName string) string {
 	return acctest.ConfigCompose(
 		testAccBaseDataSourceConfig(rName),
diff --git a/internal/service/quicksight/exports_test.go b/internal/service/quicksight/exports_test.go
index 1e466944b40..b4b337bc677 100644
--- a/internal/service/quicksight/exports_test.go
+++ b/internal/service/quicksight/exports_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package quicksight
 
 // Exports for use in tests only.
diff --git a/internal/service/quicksight/find.go b/internal/service/quicksight/find.go
index 0ebbe2f0524..f330f11dde1 100644
--- a/internal/service/quicksight/find.go
+++ b/internal/service/quicksight/find.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package quicksight
 
 import (
diff --git a/internal/service/quicksight/flex.go b/internal/service/quicksight/flex.go
index 220b2c92296..f0ad9ed6d66 100644
--- a/internal/service/quicksight/flex.go
+++ b/internal/service/quicksight/flex.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package quicksight
 
 import (
diff --git a/internal/service/quicksight/flex_test.go b/internal/service/quicksight/flex_test.go
index 8d90740766b..ad97db5ed58 100644
--- a/internal/service/quicksight/flex_test.go
+++ b/internal/service/quicksight/flex_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package quicksight_test
 
 import (
diff --git a/internal/service/quicksight/folder.go b/internal/service/quicksight/folder.go
index 459430fd3ae..e16594ce6ae 100644
--- a/internal/service/quicksight/folder.go
+++ b/internal/service/quicksight/folder.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package quicksight
 
 import (
@@ -204,7 +207,7 @@ func resourceFolderRead(ctx context.Context, d *schema.ResourceData, meta interf
 	d.Set("name", out.Name)
 
 	if len(out.FolderPath) > 0 {
-		d.Set("parent_folder_arn", out.FolderPath[0])
+		d.Set("parent_folder_arn", out.FolderPath[len(out.FolderPath)-1])
 	}
 
 	if err := d.Set("folder_path", flex.FlattenStringList(out.FolderPath)); err != nil {
diff --git a/internal/service/quicksight/folder_membership.go b/internal/service/quicksight/folder_membership.go
index 1b3befd7220..f856b91b096 100644
--- a/internal/service/quicksight/folder_membership.go
+++ b/internal/service/quicksight/folder_membership.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package quicksight
 
 import (
@@ -19,8 +22,8 @@ import (
 	"github.com/hashicorp/terraform-plugin-framework/types"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-provider-aws/internal/create"
-	"github.com/hashicorp/terraform-provider-aws/internal/flex"
 	"github.com/hashicorp/terraform-provider-aws/internal/framework"
+	"github.com/hashicorp/terraform-provider-aws/internal/framework/flex"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
diff --git a/internal/service/quicksight/folder_membership_test.go b/internal/service/quicksight/folder_membership_test.go
index 06440da73bd..c5c2d3ab532 100644
--- a/internal/service/quicksight/folder_membership_test.go
+++ b/internal/service/quicksight/folder_membership_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package quicksight_test
 
 import (
diff --git a/internal/service/quicksight/folder_test.go b/internal/service/quicksight/folder_test.go
index 34b2216056f..01a6d4e76e3 100644
--- a/internal/service/quicksight/folder_test.go
+++ b/internal/service/quicksight/folder_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package quicksight_test
 
 import (
@@ -7,6 +10,7 @@ import (
 	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/quicksight"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -101,7 +105,7 @@ func TestAccQuickSightFolder_permissions(t *testing.T) {
 					testAccCheckFolderExists(ctx, resourceName, &folder),
 					resource.TestCheckResourceAttr(resourceName, "permissions.#", "1"),
 					resource.TestMatchTypeSetElemNestedAttrs(resourceName, "permissions.*", map[string]*regexp.Regexp{
-						"principal": regexp.MustCompile(fmt.Sprintf(`user/default/%s`, rName)),
+						"principal": regexache.MustCompile(fmt.Sprintf(`user/default/%s`, rName)),
 					}),
 					resource.TestCheckTypeSetElemAttr(resourceName, "permissions.*.actions.*", "quicksight:DescribeFolder"),
 				),
@@ -117,7 +121,7 @@ func TestAccQuickSightFolder_permissions(t *testing.T) {
 					testAccCheckFolderExists(ctx, resourceName, &folder),
 					resource.TestCheckResourceAttr(resourceName, "permissions.#", "1"),
 					resource.TestMatchTypeSetElemNestedAttrs(resourceName, "permissions.*", map[string]*regexp.Regexp{
-						"principal": regexp.MustCompile(fmt.Sprintf(`user/default/%s`, rName)),
+						"principal": regexache.MustCompile(fmt.Sprintf(`user/default/%s`, rName)),
 					}),
 					resource.TestCheckTypeSetElemAttr(resourceName, "permissions.*.actions.*", "quicksight:CreateFolder"),
 					resource.TestCheckTypeSetElemAttr(resourceName, "permissions.*.actions.*", "quicksight:DescribeFolder"),
@@ -238,6 +242,49 @@ func TestAccQuickSightFolder_parentFolder(t *testing.T) {
 	})
 }
 
+func TestAccQuickSightFolder_parentFolderNested(t *testing.T) {
+	ctx := acctest.Context(t)
+	var folder quicksight.Folder
+	rId := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	parentId1 := rId + "-parent1"
+	parentName1 := rName + "-parent1"
+	parentId2 := rId + "-parent2"
+	parentName2 := rName + "-parent2"
+	resourceName := "aws_quicksight_folder.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, quicksight.EndpointsID)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, quicksight.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckFolderDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccFolderConfig_parentFolder(rId, rName, parentId1, parentName1),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckFolderExists(ctx, resourceName, &folder),
+					acctest.CheckResourceAttrRegionalARN(resourceName, "parent_folder_arn", "quicksight", fmt.Sprintf("folder/%s", parentId1)),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				Config: testAccFolderConfig_parentFolder2(rId, rName, parentId1, parentName1, parentId2, parentName2),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckFolderExists(ctx, resourceName, &folder),
+					acctest.CheckResourceAttrRegionalARN(resourceName, "parent_folder_arn", "quicksight", fmt.Sprintf("folder/%s", parentId2)),
+				),
+			},
+		},
+	})
+}
+
 func testAccCheckFolderDestroy(ctx context.Context) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		conn := acctest.Provider.Meta().(*conns.AWSClient).QuickSightConn(ctx)
@@ -396,3 +443,24 @@ resource "aws_quicksight_folder" "test" {
 }
 `, rId, rName, parentId, parentName)
 }
+
+func testAccFolderConfig_parentFolder2(rId, rName, parentId1, parentName1, parentId2, parentName2 string) string {
+	return fmt.Sprintf(`
+resource "aws_quicksight_folder" "parent" {
+  folder_id = %[3]q
+  name      = %[4]q
+}
+
+resource "aws_quicksight_folder" "parent2" {
+  folder_id         = %[5]q
+  name              = %[6]q
+  parent_folder_arn = aws_quicksight_folder.parent.arn
+}
+
+resource "aws_quicksight_folder" "test" {
+  folder_id         = %[1]q
+  name              = %[2]q
+  parent_folder_arn = aws_quicksight_folder.parent2.arn
+}
+`, rId, rName, parentId1, parentName1, parentId2, parentName2)
+}
diff --git a/internal/service/quicksight/generate.go b/internal/service/quicksight/generate.go
index 9158229e61c..2f879bf8717 100644
--- a/internal/service/quicksight/generate.go
+++ b/internal/service/quicksight/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTags -ServiceTagsSlice -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/quicksight/group.go b/internal/service/quicksight/group.go
index 06000416a67..9b711d94f6e 100644
--- a/internal/service/quicksight/group.go
+++ b/internal/service/quicksight/group.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package quicksight
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"strings"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/quicksight"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -33,40 +36,42 @@ func ResourceGroup() *schema.Resource {
 			StateContext: schema.ImportStatePassthroughContext,
 		},
 
-		Schema: map[string]*schema.Schema{
-			"arn": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
-
-			"aws_account_id": {
-				Type:     schema.TypeString,
-				Optional: true,
-				Computed: true,
-				ForceNew: true,
-			},
-
-			"description": {
-				Type:     schema.TypeString,
-				Optional: true,
-			},
-
-			"group_name": {
-				Type:     schema.TypeString,
-				Required: true,
-				ForceNew: true,
-			},
-
-			"namespace": {
-				Type:     schema.TypeString,
-				Optional: true,
-				ForceNew: true,
-				Default:  DefaultGroupNamespace,
-				ValidateFunc: validation.All(
-					validation.StringLenBetween(1, 63),
-					validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9._-]*$`), "must contain only alphanumeric characters, hyphens, underscores, and periods"),
-				),
-			},
+		SchemaFunc: func() map[string]*schema.Schema {
+			return map[string]*schema.Schema{
+				"arn": {
+					Type:     schema.TypeString,
+					Computed: true,
+				},
+
+				"aws_account_id": {
+					Type:     schema.TypeString,
+					Optional: true,
+					Computed: true,
+					ForceNew: true,
+				},
+
+				"description": {
+					Type:     schema.TypeString,
+					Optional: true,
+				},
+
+				"group_name": {
+					Type:     schema.TypeString,
+					Required: true,
+					ForceNew: true,
+				},
+
+				"namespace": {
+					Type:     schema.TypeString,
+					Optional: true,
+					ForceNew: true,
+					Default:  DefaultGroupNamespace,
+					ValidateFunc: validation.All(
+						validation.StringLenBetween(1, 63),
+						validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_.-]*$`), "must contain only alphanumeric characters, hyphens, underscores, and periods"),
+					),
+				},
+			}
 		},
 	}
 }
diff --git a/internal/service/quicksight/group_data_source.go b/internal/service/quicksight/group_data_source.go
index 20a91847c3a..49fe46b0a4b 100644
--- a/internal/service/quicksight/group_data_source.go
+++ b/internal/service/quicksight/group_data_source.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package quicksight
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/quicksight"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
@@ -20,37 +23,39 @@ func DataSourceGroup() *schema.Resource {
 	return &schema.Resource{
 		ReadWithoutTimeout: dataSourceGroupRead,
 
-		Schema: map[string]*schema.Schema{
-			"arn": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
-			"aws_account_id": {
-				Type:     schema.TypeString,
-				Optional: true,
-				Computed: true,
-			},
-			"description": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
-			"group_name": {
-				Type:     schema.TypeString,
-				Required: true,
-			},
-			"namespace": {
-				Type:     schema.TypeString,
-				Optional: true,
-				Default:  DefaultGroupNamespace,
-				ValidateFunc: validation.All(
-					validation.StringLenBetween(1, 63),
-					validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9._-]*$`), "must contain only alphanumeric characters, hyphens, underscores, and periods"),
-				),
-			},
-			"principal_id": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
+		SchemaFunc: func() map[string]*schema.Schema {
+			return map[string]*schema.Schema{
+				"arn": {
+					Type:     schema.TypeString,
+					Computed: true,
+				},
+				"aws_account_id": {
+					Type:     schema.TypeString,
+					Optional: true,
+					Computed: true,
+				},
+				"description": {
+					Type:     schema.TypeString,
+					Computed: true,
+				},
+				"group_name": {
+					Type:     schema.TypeString,
+					Required: true,
+				},
+				"namespace": {
+					Type:     schema.TypeString,
+					Optional: true,
+					Default:  DefaultGroupNamespace,
+					ValidateFunc: validation.All(
+						validation.StringLenBetween(1, 63),
+						validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_.-]*$`), "must contain only alphanumeric characters, hyphens, underscores, and periods"),
+					),
+				},
+				"principal_id": {
+					Type:     schema.TypeString,
+					Computed: true,
+				},
+			}
 		},
 	}
 }
diff --git a/internal/service/quicksight/group_data_source_test.go b/internal/service/quicksight/group_data_source_test.go
index b4a9b612ba4..f4cc9da9854 100644
--- a/internal/service/quicksight/group_data_source_test.go
+++ b/internal/service/quicksight/group_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package quicksight_test
 
 import (
diff --git a/internal/service/quicksight/group_membership.go b/internal/service/quicksight/group_membership.go
index 584559505b8..22c3a2d9744 100644
--- a/internal/service/quicksight/group_membership.go
+++ b/internal/service/quicksight/group_membership.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package quicksight
 
 import (
@@ -6,6 +9,7 @@ import (
 	"log"
 	"strings"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/quicksight"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -26,40 +30,39 @@ func ResourceGroupMembership() *schema.Resource {
 			StateContext: schema.ImportStatePassthroughContext,
 		},
 
-		Schema: map[string]*schema.Schema{
-			"arn": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
-
-			"aws_account_id": {
-				Type:     schema.TypeString,
-				Optional: true,
-				Computed: true,
-				ForceNew: true,
-			},
-
-			"member_name": {
-				Type:     schema.TypeString,
-				Required: true,
-				ForceNew: true,
-			},
-
-			"group_name": {
-				Type:     schema.TypeString,
-				Required: true,
-				ForceNew: true,
-			},
-
-			"namespace": {
-				Type:     schema.TypeString,
-				Optional: true,
-				ForceNew: true,
-				Default:  "default",
-				ValidateFunc: validation.StringInSlice([]string{
-					"default",
-				}, false),
-			},
+		SchemaFunc: func() map[string]*schema.Schema {
+			return map[string]*schema.Schema{
+				"arn": {
+					Type:     schema.TypeString,
+					Computed: true,
+				},
+				"aws_account_id": {
+					Type:     schema.TypeString,
+					Optional: true,
+					Computed: true,
+					ForceNew: true,
+				},
+				"group_name": {
+					Type:     schema.TypeString,
+					Required: true,
+					ForceNew: true,
+				},
+				"member_name": {
+					Type:     schema.TypeString,
+					Required: true,
+					ForceNew: true,
+				},
+				"namespace": {
+					Type:     schema.TypeString,
+					Optional: true,
+					ForceNew: true,
+					Default:  "default",
+					ValidateFunc: validation.All(
+						validation.StringLenBetween(1, 63),
+						validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_.-]*$`), "must contain only alphanumeric characters, hyphens, underscores, and periods"),
+					),
+				},
+			}
 		},
 	}
 }
diff --git a/internal/service/quicksight/group_membership_test.go b/internal/service/quicksight/group_membership_test.go
index 009451dac93..2a90ecf365f 100644
--- a/internal/service/quicksight/group_membership_test.go
+++ b/internal/service/quicksight/group_membership_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package quicksight_test
 
 import (
@@ -19,8 +22,8 @@ import (
 func TestAccQuickSightGroupMembership_basic(t *testing.T) {
 	ctx := acctest.Context(t)
 	groupName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
-	memberName := "tfacctest" + sdkacctest.RandString(10)
-	resourceName := "aws_quicksight_group_membership.default"
+	memberName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_quicksight_group_membership.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
@@ -43,11 +46,42 @@ func TestAccQuickSightGroupMembership_basic(t *testing.T) {
 	})
 }
 
+func TestAccQuickSightGroupMembership_withNamespace(t *testing.T) {
+	ctx := acctest.Context(t)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_quicksight_group_membership.test"
+	groupResourceName := "aws_quicksight_group.test"
+	userResourceName := "aws_quicksight_user.test"
+	namespaceResourceName := "aws_quicksight_namespace.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, quicksight.EndpointsID),
+		CheckDestroy:             testAccCheckGroupMembershipDestroy(ctx),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccGroupMembershipConfig_withNamespace(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckGroupMembershipExists(ctx, resourceName),
+					resource.TestCheckResourceAttrPair(resourceName, "group_name", groupResourceName, "group_name"),
+					resource.TestCheckResourceAttrPair(resourceName, "member_name", userResourceName, "user_name"),
+					resource.TestCheckResourceAttrPair(resourceName, "namespace", namespaceResourceName, "namespace"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
 func TestAccQuickSightGroupMembership_disappears(t *testing.T) {
 	ctx := acctest.Context(t)
 	groupName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
-	memberName := "tfacctest" + sdkacctest.RandString(10)
-	resourceName := "aws_quicksight_group_membership.default"
+	memberName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_quicksight_group_membership.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
@@ -140,9 +174,37 @@ func testAccGroupMembershipConfig_basic(groupName string, memberName string) str
 		testAccGroupConfig_basic(groupName),
 		testAccUserConfig_basic(memberName),
 		fmt.Sprintf(`
-resource "aws_quicksight_group_membership" "default" {
+resource "aws_quicksight_group_membership" "test" {
   group_name  = aws_quicksight_group.default.group_name
   member_name = aws_quicksight_user.%s.user_name
 }
 `, memberName))
 }
+
+func testAccGroupMembershipConfig_withNamespace(rName string) string {
+	return acctest.ConfigCompose(
+		testAccNamespaceConfig_basic(rName),
+		fmt.Sprintf(`
+data "aws_caller_identity" "current" {}
+
+resource "aws_quicksight_group" "test" {
+  group_name = %[1]q
+  namespace  = aws_quicksight_namespace.test.namespace
+}
+
+resource "aws_quicksight_user" "test" {
+  aws_account_id = data.aws_caller_identity.current.account_id
+  user_name      = %[1]q
+  email          = %[2]q
+  namespace      = aws_quicksight_namespace.test.namespace
+  identity_type  = "QUICKSIGHT"
+  user_role      = "READER"
+}
+
+resource "aws_quicksight_group_membership" "test" {
+  group_name  = aws_quicksight_group.test.group_name
+  member_name = aws_quicksight_user.test.user_name
+  namespace   = aws_quicksight_namespace.test.namespace
+}
+`, rName, acctest.DefaultEmailAddress))
+}
diff --git a/internal/service/quicksight/group_test.go b/internal/service/quicksight/group_test.go
index d3395d798d5..adec502dd79 100644
--- a/internal/service/quicksight/group_test.go
+++ b/internal/service/quicksight/group_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package quicksight_test
 
 import (
diff --git a/internal/service/quicksight/iam_policy_assignment.go b/internal/service/quicksight/iam_policy_assignment.go
index 13300028f69..1c307758397 100644
--- a/internal/service/quicksight/iam_policy_assignment.go
+++ b/internal/service/quicksight/iam_policy_assignment.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package quicksight
 
 import (
@@ -23,8 +26,8 @@ import (
 	"github.com/hashicorp/terraform-plugin-framework/types"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-provider-aws/internal/create"
-	"github.com/hashicorp/terraform-provider-aws/internal/flex"
 	"github.com/hashicorp/terraform-provider-aws/internal/framework"
+	"github.com/hashicorp/terraform-provider-aws/internal/framework/flex"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
diff --git a/internal/service/quicksight/iam_policy_assignment_test.go b/internal/service/quicksight/iam_policy_assignment_test.go
index 5e5f9bb349b..0a230066745 100644
--- a/internal/service/quicksight/iam_policy_assignment_test.go
+++ b/internal/service/quicksight/iam_policy_assignment_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package quicksight_test
 
 import (
diff --git a/internal/service/quicksight/ingestion.go b/internal/service/quicksight/ingestion.go
index b04a8f44595..4306e8e3dcd 100644
--- a/internal/service/quicksight/ingestion.go
+++ b/internal/service/quicksight/ingestion.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package quicksight
 
 import (
@@ -19,8 +22,8 @@ import (
 	"github.com/hashicorp/terraform-plugin-framework/types"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-provider-aws/internal/create"
-	"github.com/hashicorp/terraform-provider-aws/internal/flex"
 	"github.com/hashicorp/terraform-provider-aws/internal/framework"
+	"github.com/hashicorp/terraform-provider-aws/internal/framework/flex"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
diff --git a/internal/service/quicksight/ingestion_test.go b/internal/service/quicksight/ingestion_test.go
index 80305ccda98..bbb86a86aba 100644
--- a/internal/service/quicksight/ingestion_test.go
+++ b/internal/service/quicksight/ingestion_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package quicksight_test
 
 import (
diff --git a/internal/service/quicksight/namespace.go b/internal/service/quicksight/namespace.go
index 269243c87be..3fc8abec7a1 100644
--- a/internal/service/quicksight/namespace.go
+++ b/internal/service/quicksight/namespace.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package quicksight
 
 import (
@@ -20,8 +23,8 @@ import (
 	"github.com/hashicorp/terraform-plugin-framework/types"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-provider-aws/internal/create"
-	"github.com/hashicorp/terraform-provider-aws/internal/flex"
 	"github.com/hashicorp/terraform-provider-aws/internal/framework"
+	"github.com/hashicorp/terraform-provider-aws/internal/framework/flex"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/names"
diff --git a/internal/service/quicksight/namespace_test.go b/internal/service/quicksight/namespace_test.go
index 0d5f3276155..5bde0c3152e 100644
--- a/internal/service/quicksight/namespace_test.go
+++ b/internal/service/quicksight/namespace_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package quicksight_test
 
 import (
diff --git a/internal/service/quicksight/quicksight_test.go b/internal/service/quicksight/quicksight_test.go
index bc6400aca72..a9bb4cf8a7a 100644
--- a/internal/service/quicksight/quicksight_test.go
+++ b/internal/service/quicksight/quicksight_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package quicksight_test
 
 import (
diff --git a/internal/service/quicksight/refresh_schedule.go b/internal/service/quicksight/refresh_schedule.go
index fc5a94e7839..58ad7d4f359 100644
--- a/internal/service/quicksight/refresh_schedule.go
+++ b/internal/service/quicksight/refresh_schedule.go
@@ -1,13 +1,16 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package quicksight
 
 import (
 	"context"
 	"errors"
 	"fmt"
-	"regexp"
 	"strings"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/quicksight"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -25,8 +28,8 @@ import (
 	"github.com/hashicorp/terraform-plugin-framework/types"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-provider-aws/internal/create"
-	"github.com/hashicorp/terraform-provider-aws/internal/flex"
 	"github.com/hashicorp/terraform-provider-aws/internal/framework"
+	"github.com/hashicorp/terraform-provider-aws/internal/framework/flex"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -137,7 +140,7 @@ func (r *resourceRefreshSchedule) Schema(ctx context.Context, req resource.Schem
 												"day_of_month": schema.StringAttribute{
 													Optional: true,
 													Validators: []validator.String{
-														stringvalidator.RegexMatches(regexp.MustCompile(dayOfMonthRegex), "day of month must match regex: "+dayOfMonthRegex),
+														stringvalidator.RegexMatches(regexache.MustCompile(dayOfMonthRegex), "day of month must match regex: "+dayOfMonthRegex),
 														stringvalidator.ConflictsWith(
 															path.MatchRelative().AtParent().AtName("day_of_week"),
 														),
diff --git a/internal/service/quicksight/refresh_schedule_test.go b/internal/service/quicksight/refresh_schedule_test.go
index be3993f4bbc..6db5594c991 100644
--- a/internal/service/quicksight/refresh_schedule_test.go
+++ b/internal/service/quicksight/refresh_schedule_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package quicksight_test
 
 import (
diff --git a/internal/service/quicksight/schema/analysis.go b/internal/service/quicksight/schema/analysis.go
index 78b5ce5f0a7..897c0367add 100644
--- a/internal/service/quicksight/schema/analysis.go
+++ b/internal/service/quicksight/schema/analysis.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package schema
 
 import (
@@ -22,19 +25,7 @@ func AnalysisDefinitionSchema() *schema.Schema {
 			Schema: map[string]*schema.Schema{
 				"data_set_identifiers_declarations": dataSetIdentifierDeclarationsSchema(), // https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DataSetIdentifierDeclaration.html
 				"analysis_defaults":                 analysisDefaultSchema(),               // https://docs.aws.amazon.com/quicksight/latest/APIReference/API_AnalysisDefaults.html
-				"calculated_fields": { // https://docs.aws.amazon.com/quicksight/latest/APIReference/API_CalculatedField.html
-					Type:     schema.TypeList,
-					MinItems: 1,
-					MaxItems: 500,
-					Optional: true,
-					Elem: &schema.Resource{
-						Schema: map[string]*schema.Schema{
-							"data_set_identifier": stringSchema(true, validation.StringLenBetween(1, 2048)),
-							"expression":          stringSchema(true, validation.StringLenBetween(1, 4096)),
-							"name":                stringSchema(true, validation.StringLenBetween(1, 128)),
-						},
-					},
-				},
+				"calculated_fields":                 calculatedFieldsSchema(),              // https://docs.aws.amazon.com/quicksight/latest/APIReference/API_CalculatedField.html
 				"column_configurations": { // https://docs.aws.amazon.com/quicksight/latest/APIReference/API_ColumnConfiguration.html
 					Type:     schema.TypeList,
 					MinItems: 1,
@@ -64,7 +55,7 @@ func AnalysisDefinitionSchema() *schema.Schema {
 					},
 				},
 				"parameter_declarations": { // https://docs.aws.amazon.com/quicksight/latest/APIReference/API_ParameterDeclaration.html
-					Type:     schema.TypeList,
+					Type:     schema.TypeSet,
 					MinItems: 1,
 					MaxItems: 200,
 					Optional: true,
@@ -200,8 +191,8 @@ func ExpandAnalysisDefinition(tfList []interface{}) *quicksight.AnalysisDefiniti
 	if v, ok := tfMap["analysis_defaults"].([]interface{}); ok && len(v) > 0 {
 		definition.AnalysisDefaults = expandAnalysisDefaults(v)
 	}
-	if v, ok := tfMap["calculated_fields"].([]interface{}); ok && len(v) > 0 {
-		definition.CalculatedFields = expandCalculatedFields(v)
+	if v, ok := tfMap["calculated_fields"].(*schema.Set); ok && v.Len() > 0 {
+		definition.CalculatedFields = expandCalculatedFields(v.List())
 	}
 	if v, ok := tfMap["column_configurations"].([]interface{}); ok && len(v) > 0 {
 		definition.ColumnConfigurations = expandColumnConfigurations(v)
@@ -212,8 +203,8 @@ func ExpandAnalysisDefinition(tfList []interface{}) *quicksight.AnalysisDefiniti
 	if v, ok := tfMap["filter_groups"].([]interface{}); ok && len(v) > 0 {
 		definition.FilterGroups = expandFilterGroups(v)
 	}
-	if v, ok := tfMap["parameter_declarations"].([]interface{}); ok && len(v) > 0 {
-		definition.ParameterDeclarations = expandParameterDeclarations(v)
+	if v, ok := tfMap["parameter_declarations"].(*schema.Set); ok && v.Len() > 0 {
+		definition.ParameterDeclarations = expandParameterDeclarations(v.List())
 	}
 	if v, ok := tfMap["sheets"].([]interface{}); ok && len(v) > 0 {
 		definition.Sheets = expandSheetDefinitions(v)
diff --git a/internal/service/quicksight/schema/dashboard.go b/internal/service/quicksight/schema/dashboard.go
index 97a6e0a5270..f9b0fbaa45d 100644
--- a/internal/service/quicksight/schema/dashboard.go
+++ b/internal/service/quicksight/schema/dashboard.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package schema
 
 import (
@@ -22,19 +25,7 @@ func DashboardDefinitionSchema() *schema.Schema {
 			Schema: map[string]*schema.Schema{
 				"data_set_identifiers_declarations": dataSetIdentifierDeclarationsSchema(), // https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DataSetIdentifierDeclaration.html
 				"analysis_defaults":                 analysisDefaultSchema(),               // https://docs.aws.amazon.com/quicksight/latest/APIReference/API_AnalysisDefaults.html
-				"calculated_fields": { // https://docs.aws.amazon.com/quicksight/latest/APIReference/API_CalculatedField.html
-					Type:     schema.TypeList,
-					MinItems: 1,
-					MaxItems: 500,
-					Optional: true,
-					Elem: &schema.Resource{
-						Schema: map[string]*schema.Schema{
-							"data_set_identifier": stringSchema(true, validation.StringLenBetween(1, 2048)),
-							"expression":          stringSchema(true, validation.StringLenBetween(1, 4096)),
-							"name":                stringSchema(true, validation.StringLenBetween(1, 128)),
-						},
-					},
-				},
+				"calculated_fields":                 calculatedFieldsSchema(),              // https://docs.aws.amazon.com/quicksight/latest/APIReference/API_CalculatedField.html
 				"column_configurations": { // https://docs.aws.amazon.com/quicksight/latest/APIReference/API_ColumnConfiguration.html
 					Type:     schema.TypeList,
 					MinItems: 1,
@@ -64,7 +55,7 @@ func DashboardDefinitionSchema() *schema.Schema {
 					},
 				},
 				"parameter_declarations": { // https://docs.aws.amazon.com/quicksight/latest/APIReference/API_ParameterDeclaration.html
-					Type:     schema.TypeList,
+					Type:     schema.TypeSet,
 					MinItems: 1,
 					MaxItems: 200,
 					Optional: true,
@@ -355,8 +346,8 @@ func ExpandDashboardDefinition(tfList []interface{}) *quicksight.DashboardVersio
 	if v, ok := tfMap["analysis_defaults"].([]interface{}); ok && len(v) > 0 {
 		definition.AnalysisDefaults = expandAnalysisDefaults(v)
 	}
-	if v, ok := tfMap["calculated_fields"].([]interface{}); ok && len(v) > 0 {
-		definition.CalculatedFields = expandCalculatedFields(v)
+	if v, ok := tfMap["calculated_fields"].(*schema.Set); ok && v.Len() > 0 {
+		definition.CalculatedFields = expandCalculatedFields(v.List())
 	}
 	if v, ok := tfMap["column_configurations"].([]interface{}); ok && len(v) > 0 {
 		definition.ColumnConfigurations = expandColumnConfigurations(v)
@@ -367,8 +358,8 @@ func ExpandDashboardDefinition(tfList []interface{}) *quicksight.DashboardVersio
 	if v, ok := tfMap["filter_groups"].([]interface{}); ok && len(v) > 0 {
 		definition.FilterGroups = expandFilterGroups(v)
 	}
-	if v, ok := tfMap["parameter_declarations"].([]interface{}); ok && len(v) > 0 {
-		definition.ParameterDeclarations = expandParameterDeclarations(v)
+	if v, ok := tfMap["parameter_declarations"].(*schema.Set); ok && v.Len() > 0 {
+		definition.ParameterDeclarations = expandParameterDeclarations(v.List())
 	}
 	if v, ok := tfMap["sheets"].([]interface{}); ok && len(v) > 0 {
 		definition.Sheets = expandSheetDefinitions(v)
diff --git a/internal/service/quicksight/schema/dataset.go b/internal/service/quicksight/schema/dataset.go
index 6ef5737cbeb..67a57f4385e 100644
--- a/internal/service/quicksight/schema/dataset.go
+++ b/internal/service/quicksight/schema/dataset.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package schema
 
 import (
diff --git a/internal/service/quicksight/schema/parameters.go b/internal/service/quicksight/schema/parameters.go
index 2c5f90363f2..767950a0c6f 100644
--- a/internal/service/quicksight/schema/parameters.go
+++ b/internal/service/quicksight/schema/parameters.go
@@ -1,9 +1,12 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package schema
 
 import (
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/quicksight"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
@@ -27,7 +30,7 @@ func ParametersSchema() *schema.Schema {
 					Optional: true,
 					Elem: &schema.Resource{
 						Schema: map[string]*schema.Schema{
-							"name": stringSchema(true, validation.StringMatch(regexp.MustCompile(`.*\S.*`), "")),
+							"name": stringSchema(true, validation.StringMatch(regexache.MustCompile(`.*\S.*`), "")),
 							"values": {
 								Type:     schema.TypeList,
 								MinItems: 1,
@@ -47,7 +50,7 @@ func ParametersSchema() *schema.Schema {
 					Optional: true,
 					Elem: &schema.Resource{
 						Schema: map[string]*schema.Schema{
-							"name": stringSchema(true, validation.StringMatch(regexp.MustCompile(`.*\S.*`), "")),
+							"name": stringSchema(true, validation.StringMatch(regexache.MustCompile(`.*\S.*`), "")),
 							"values": {
 								Type:     schema.TypeList,
 								MinItems: 1,
@@ -66,7 +69,7 @@ func ParametersSchema() *schema.Schema {
 					Optional: true,
 					Elem: &schema.Resource{
 						Schema: map[string]*schema.Schema{
-							"name": stringSchema(true, validation.StringMatch(regexp.MustCompile(`.*\S.*`), "")),
+							"name": stringSchema(true, validation.StringMatch(regexache.MustCompile(`.*\S.*`), "")),
 							"values": {
 								Type:     schema.TypeList,
 								MinItems: 1,
@@ -85,7 +88,7 @@ func ParametersSchema() *schema.Schema {
 					Optional: true,
 					Elem: &schema.Resource{
 						Schema: map[string]*schema.Schema{
-							"name": stringSchema(true, validation.StringMatch(regexp.MustCompile(`.*\S.*`), "")),
+							"name": stringSchema(true, validation.StringMatch(regexache.MustCompile(`.*\S.*`), "")),
 							"values": {
 								Type:     schema.TypeList,
 								MinItems: 1,
diff --git a/internal/service/quicksight/schema/template.go b/internal/service/quicksight/schema/template.go
index eabdca532a4..bdf750ce986 100644
--- a/internal/service/quicksight/schema/template.go
+++ b/internal/service/quicksight/schema/template.go
@@ -1,8 +1,10 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package schema
 
 import (
-	"regexp"
-
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/quicksight"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
@@ -24,19 +26,7 @@ func TemplateDefinitionSchema() *schema.Schema {
 			Schema: map[string]*schema.Schema{
 				"data_set_configuration": dataSetConfigurationSchema(), // https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DataSetConfiguration.html
 				"analysis_defaults":      analysisDefaultSchema(),      // https://docs.aws.amazon.com/quicksight/latest/APIReference/API_AnalysisDefaults.html
-				"calculated_fields": { // https://docs.aws.amazon.com/quicksight/latest/APIReference/API_CalculatedField.html
-					Type:     schema.TypeList,
-					MinItems: 1,
-					MaxItems: 100,
-					Optional: true,
-					Elem: &schema.Resource{
-						Schema: map[string]*schema.Schema{
-							"data_set_identifier": stringSchema(true, validation.StringLenBetween(1, 2048)),
-							"expression":          stringSchema(true, validation.StringLenBetween(1, 4096)),
-							"name":                stringSchema(true, validation.StringLenBetween(1, 128)),
-						},
-					},
-				},
+				"calculated_fields":      calculatedFieldsSchema(),     // https://docs.aws.amazon.com/quicksight/latest/APIReference/API_CalculatedField.html
 				"column_configurations": { // https://docs.aws.amazon.com/quicksight/latest/APIReference/API_ColumnConfiguration.html
 					Type:     schema.TypeList,
 					MinItems: 1,
@@ -174,6 +164,22 @@ func aggregationFunctionSchema(required bool) *schema.Schema {
 	}
 }
 
+func calculatedFieldsSchema() *schema.Schema {
+	return &schema.Schema{ // https://docs.aws.amazon.com/quicksight/latest/APIReference/API_CalculatedField.html
+		Type:     schema.TypeSet,
+		MinItems: 1,
+		MaxItems: 500,
+		Optional: true,
+		Elem: &schema.Resource{
+			Schema: map[string]*schema.Schema{
+				"data_set_identifier": stringSchema(true, validation.StringLenBetween(1, 2048)),
+				"expression":          stringSchema(true, validation.StringLenBetween(1, 32000)),
+				"name":                stringSchema(true, validation.StringLenBetween(1, 128)),
+			},
+		},
+	}
+}
+
 func numericalAggregationFunctionSchema(required bool) *schema.Schema {
 	return &schema.Schema{ // https://docs.aws.amazon.com/quicksight/latest/APIReference/API_NumericalAggregationFunction.html
 		Type:     schema.TypeList,
@@ -210,7 +216,7 @@ func idSchema() *schema.Schema {
 		Required: true,
 		ValidateFunc: validation.All(
 			validation.StringLenBetween(1, 512),
-			validation.StringMatch(regexp.MustCompile(`[\w\-]+`), "must contain only alphanumeric, hyphen, and underscore characters"),
+			validation.StringMatch(regexache.MustCompile(`[\w\-]+`), "must contain only alphanumeric, hyphen, and underscore characters"),
 		),
 	}
 }
@@ -472,8 +478,8 @@ func ExpandTemplateDefinition(tfList []interface{}) *quicksight.TemplateVersionD
 	if v, ok := tfMap["analysis_defaults"].([]interface{}); ok && len(v) > 0 {
 		definition.AnalysisDefaults = expandAnalysisDefaults(v)
 	}
-	if v, ok := tfMap["calculated_fields"].([]interface{}); ok && len(v) > 0 {
-		definition.CalculatedFields = expandCalculatedFields(v)
+	if v, ok := tfMap["calculated_fields"].(*schema.Set); ok && v.Len() > 0 {
+		definition.CalculatedFields = expandCalculatedFields(v.List())
 	}
 	if v, ok := tfMap["column_configurations"].([]interface{}); ok && len(v) > 0 {
 		definition.ColumnConfigurations = expandColumnConfigurations(v)
@@ -484,8 +490,8 @@ func ExpandTemplateDefinition(tfList []interface{}) *quicksight.TemplateVersionD
 	if v, ok := tfMap["filter_groups"].([]interface{}); ok && len(v) > 0 {
 		definition.FilterGroups = expandFilterGroups(v)
 	}
-	if v, ok := tfMap["parameters_declarations"].([]interface{}); ok && len(v) > 0 {
-		definition.ParameterDeclarations = expandParameterDeclarations(v)
+	if v, ok := tfMap["parameters_declarations"].(*schema.Set); ok && v.Len() > 0 {
+		definition.ParameterDeclarations = expandParameterDeclarations(v.List())
 	}
 	if v, ok := tfMap["sheets"].([]interface{}); ok && len(v) > 0 {
 		definition.Sheets = expandSheetDefinitions(v)
diff --git a/internal/service/quicksight/schema/template_control.go b/internal/service/quicksight/schema/template_control.go
index 13f43d244e9..70be4ed2ddc 100644
--- a/internal/service/quicksight/schema/template_control.go
+++ b/internal/service/quicksight/schema/template_control.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package schema
 
 import (
@@ -1206,7 +1209,7 @@ func flattenFontConfiguration(apiObject *quicksight.FontConfiguration) []interfa
 }
 
 func flattenFontSize(apiObject *quicksight.FontSize) []interface{} {
-	if apiObject == nil {
+	if apiObject == nil || apiObject.Relative == nil {
 		return nil
 	}
 
@@ -1219,7 +1222,7 @@ func flattenFontSize(apiObject *quicksight.FontSize) []interface{} {
 }
 
 func flattenFontWeight(apiObject *quicksight.FontWeight) []interface{} {
-	if apiObject == nil {
+	if apiObject == nil || apiObject.Name == nil {
 		return nil
 	}
 
diff --git a/internal/service/quicksight/schema/template_filter.go b/internal/service/quicksight/schema/template_filter.go
index 9cdca6cd104..cc4bfdcc7a3 100644
--- a/internal/service/quicksight/schema/template_filter.go
+++ b/internal/service/quicksight/schema/template_filter.go
@@ -1,9 +1,12 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package schema
 
 import (
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/quicksight"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
@@ -67,10 +70,10 @@ func categoryFilterSchema() *schema.Schema {
 											Optional: true,
 											ValidateFunc: validation.All(
 												validation.StringLenBetween(1, 2048),
-												validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9]+`), ""),
+												validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z]+`), ""),
 											),
 										},
-										"select_all_options": stringSchema(false, validation.StringInSlice(quicksight.SelectAllValueOptions_Values(), false)),
+										"select_all_options": stringSchema(false, validation.StringInSlice(quicksight.CategoryFilterSelectAllOptions_Values(), false)),
 									},
 								},
 							},
@@ -93,7 +96,7 @@ func categoryFilterSchema() *schema.Schema {
 												ValidateFunc: validation.StringLenBetween(1, 512),
 											},
 										},
-										"select_all_options": stringSchema(false, validation.StringInSlice(quicksight.SelectAllValueOptions_Values(), false)),
+										"select_all_options": stringSchema(false, validation.StringInSlice(quicksight.CategoryFilterSelectAllOptions_Values(), false)),
 									},
 								},
 							},
@@ -115,7 +118,7 @@ func categoryFilterSchema() *schema.Schema {
 												ValidateFunc: validation.StringLenBetween(1, 512),
 											},
 										},
-										"select_all_options": stringSchema(false, validation.StringInSlice(quicksight.SelectAllValueOptions_Values(), false)),
+										"select_all_options": stringSchema(false, validation.StringInSlice(quicksight.CategoryFilterSelectAllOptions_Values(), false)),
 									},
 								},
 							},
@@ -142,7 +145,7 @@ func numericEqualityFilterSchema() *schema.Schema {
 				"null_option":          stringSchema(true, validation.StringInSlice(quicksight.FilterNullOption_Values(), false)),
 				"aggregation_function": aggregationFunctionSchema(false), // https://docs.aws.amazon.com/quicksight/latest/APIReference/API_AggregationFunction.html
 				"parameter_name":       parameterNameSchema(false),
-				"select_all_options":   stringSchema(false, validation.StringInSlice(quicksight.SelectAllValueOptions_Values(), false)),
+				"select_all_options":   stringSchema(false, validation.StringInSlice(quicksight.NumericFilterSelectAllOptions_Values(), false)),
 				"value": {
 					Type:     schema.TypeFloat,
 					Optional: true,
@@ -174,7 +177,7 @@ func numericRangeFilterSchema() *schema.Schema {
 				},
 				"range_maximum":      numericRangeFilterValueSchema(), // https://docs.aws.amazon.com/quicksight/latest/APIReference/API_NumericRangeFilterValue.html
 				"range_minimum":      numericRangeFilterValueSchema(), // https://docs.aws.amazon.com/quicksight/latest/APIReference/API_NumericRangeFilterValue.html
-				"select_all_options": stringSchema(false, validation.StringInSlice(quicksight.SelectAllValueOptions_Values(), false)),
+				"select_all_options": stringSchema(false, validation.StringInSlice(quicksight.NumericFilterSelectAllOptions_Values(), false)),
 			},
 		},
 	}
@@ -333,7 +336,7 @@ func numericRangeFilterValueSchema() *schema.Schema {
 					Optional: true,
 					ValidateFunc: validation.All(
 						validation.StringLenBetween(1, 2048),
-						validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9]+$`), ""),
+						validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z]+$`), ""),
 					),
 				},
 				"static_value": {
@@ -358,7 +361,7 @@ func timeRangeFilterValueSchema() *schema.Schema {
 					Optional: true,
 					ValidateFunc: validation.All(
 						validation.StringLenBetween(1, 2048),
-						validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9]+$`), ""),
+						validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z]+$`), ""),
 					),
 				},
 				"rolling_date": rollingDateConfigurationSchema(), // https://docs.aws.amazon.com/quicksight/latest/APIReference/API_RollingDateConfiguration.html,
diff --git a/internal/service/quicksight/schema/template_format.go b/internal/service/quicksight/schema/template_format.go
index 075b4cf27d5..5c126bc2d57 100644
--- a/internal/service/quicksight/schema/template_format.go
+++ b/internal/service/quicksight/schema/template_format.go
@@ -1,8 +1,10 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package schema
 
 import (
-	"regexp"
-
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/quicksight"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
@@ -31,7 +33,7 @@ func numericFormatConfigurationSchema() *schema.Schema {
 							"prefix":                          stringSchema(false, validation.StringLenBetween(1, 128)),
 							"separator_configuration":         separatorConfigurationSchema(),
 							"suffix":                          stringSchema(false, validation.StringLenBetween(1, 128)),
-							"symbol":                          stringSchema(false, validation.StringMatch(regexp.MustCompile(`[A-Z]{3}`), "must be a 3 character currency symbol")),
+							"symbol":                          stringSchema(false, validation.StringMatch(regexache.MustCompile(`[A-Z]{3}`), "must be a 3 character currency symbol")),
 						},
 					},
 				},
@@ -225,11 +227,10 @@ func fontConfigurationSchema() *schema.Schema {
 		Optional: true,
 		Elem: &schema.Resource{
 			Schema: map[string]*schema.Schema{
-				"font_color":      stringSchema(false, validation.StringMatch(regexp.MustCompile(`^#[A-F0-9]{6}$`), "")),
+				"font_color":      stringSchema(false, validation.StringMatch(regexache.MustCompile(`^#[0-9A-F]{6}$`), "")),
 				"font_decoration": stringSchema(false, validation.StringInSlice(quicksight.FontDecoration_Values(), false)),
 				"font_size": { // https://docs.aws.amazon.com/quicksight/latest/APIReference/API_FontSize.html
 					Type:     schema.TypeList,
-					MinItems: 1,
 					MaxItems: 1,
 					Optional: true,
 					Elem: &schema.Resource{
@@ -241,7 +242,6 @@ func fontConfigurationSchema() *schema.Schema {
 				"font_style": stringSchema(false, validation.StringInSlice(quicksight.FontStyle_Values(), false)),
 				"font_weight": { // https://docs.aws.amazon.com/quicksight/latest/APIReference/API_FontWeight.html
 					Type:     schema.TypeList,
-					MinItems: 1,
 					MaxItems: 1,
 					Optional: true,
 					Elem: &schema.Resource{
@@ -559,13 +559,13 @@ func expandFontConfiguration(tfList []interface{}) *quicksight.FontConfiguration
 
 	config := &quicksight.FontConfiguration{}
 
-	if v, ok := tfMap["font_color"].(string); ok {
+	if v, ok := tfMap["font_color"].(string); ok && v != "" {
 		config.FontColor = aws.String(v)
 	}
-	if v, ok := tfMap["font_decoration"].(string); ok {
+	if v, ok := tfMap["font_decoration"].(string); ok && v != "" {
 		config.FontDecoration = aws.String(v)
 	}
-	if v, ok := tfMap["font_style"].(string); ok {
+	if v, ok := tfMap["font_style"].(string); ok && v != "" {
 		config.FontStyle = aws.String(v)
 	}
 	if v, ok := tfMap["font_size"].([]interface{}); ok && len(v) > 0 {
diff --git a/internal/service/quicksight/schema/template_parameter.go b/internal/service/quicksight/schema/template_parameter.go
index 1e002469c95..f26b13251c4 100644
--- a/internal/service/quicksight/schema/template_parameter.go
+++ b/internal/service/quicksight/schema/template_parameter.go
@@ -1,9 +1,12 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package schema
 
 import (
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/quicksight"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
@@ -25,7 +28,7 @@ func dateTimeParameterDeclarationSchema() *schema.Schema {
 					Required: true,
 					ValidateFunc: validation.All(
 						validation.StringLenBetween(1, 2048),
-						validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9]+$`), ""),
+						validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z]+$`), ""),
 					),
 				},
 				"default_values": { // https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DateTimeDefaultValues.html
@@ -85,7 +88,7 @@ func decimalParameterDeclarationSchema() *schema.Schema {
 					Required: true,
 					ValidateFunc: validation.All(
 						validation.StringLenBetween(1, 2048),
-						validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9]+$`), ""),
+						validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z]+$`), ""),
 					),
 				},
 				"parameter_value_type": stringSchema(true, validation.StringInSlice(quicksight.ParameterValueType_Values(), false)),
@@ -142,7 +145,7 @@ func integerParameterDeclarationSchema() *schema.Schema {
 					Required: true,
 					ValidateFunc: validation.All(
 						validation.StringLenBetween(1, 2048),
-						validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9]+$`), ""),
+						validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z]+$`), ""),
 					),
 				},
 				"parameter_value_type": stringSchema(true, validation.StringInSlice(quicksight.ParameterValueType_Values(), false)),
@@ -199,7 +202,7 @@ func stringParameterDeclarationSchema() *schema.Schema {
 					Required: true,
 					ValidateFunc: validation.All(
 						validation.StringLenBetween(1, 2048),
-						validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9]+$`), ""),
+						validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z]+$`), ""),
 					),
 				},
 				"parameter_value_type": stringSchema(true, validation.StringInSlice(quicksight.ParameterValueType_Values(), false)),
@@ -405,7 +408,7 @@ func parameterNameSchema(required bool) *schema.Schema {
 		Optional: !required,
 		ValidateFunc: validation.All(
 			validation.StringLenBetween(1, 2048),
-			validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9]+$`), ""),
+			validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z]+$`), ""),
 		),
 	}
 }
@@ -783,7 +786,7 @@ func flattenDateTimeDefaultValues(apiObject *quicksight.DateTimeDefaultValues) [
 	if apiObject.RollingDate != nil {
 		tfMap["rolling_date"] = flattenRollingDateConfiguration(apiObject.RollingDate)
 	}
-	if apiObject.StaticValues != nil {
+	if len(apiObject.StaticValues) > 0 {
 		tfMap["static_values"] = flex.FlattenTimeStringList(apiObject.StaticValues, time.RFC3339)
 	}
 
@@ -856,7 +859,7 @@ func flattenDecimalDefaultValues(apiObject *quicksight.DecimalDefaultValues) []i
 	if apiObject.DynamicValue != nil {
 		tfMap["dynamic_value"] = flattenDynamicDefaultValue(apiObject.DynamicValue)
 	}
-	if apiObject.StaticValues != nil {
+	if len(apiObject.StaticValues) > 0 {
 		tfMap["static_values"] = flex.FlattenFloat64List(apiObject.StaticValues)
 	}
 
@@ -910,7 +913,7 @@ func flattenIntegerDefaultValues(apiObject *quicksight.IntegerDefaultValues) []i
 	if apiObject.DynamicValue != nil {
 		tfMap["dynamic_value"] = flattenDynamicDefaultValue(apiObject.DynamicValue)
 	}
-	if apiObject.StaticValues != nil {
+	if len(apiObject.StaticValues) > 0 {
 		tfMap["static_values"] = flex.FlattenInt64List(apiObject.StaticValues)
 	}
 
@@ -964,7 +967,7 @@ func flattenStringDefaultValues(apiObject *quicksight.StringDefaultValues) []int
 	if apiObject.DynamicValue != nil {
 		tfMap["dynamic_value"] = flattenDynamicDefaultValue(apiObject.DynamicValue)
 	}
-	if apiObject.StaticValues != nil {
+	if len(apiObject.StaticValues) > 0 {
 		tfMap["static_values"] = flex.FlattenStringList(apiObject.StaticValues)
 	}
 
diff --git a/internal/service/quicksight/schema/template_sheet.go b/internal/service/quicksight/schema/template_sheet.go
index 3c10c89a000..cfedc66a6ca 100644
--- a/internal/service/quicksight/schema/template_sheet.go
+++ b/internal/service/quicksight/schema/template_sheet.go
@@ -1,8 +1,10 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package schema
 
 import (
-	"regexp"
-
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/quicksight"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
@@ -375,7 +377,7 @@ func gridLayoutConfigurationSchema() *schema.Schema {
 									Schema: map[string]*schema.Schema{
 										"optimized_view_port_width": {
 											Type:     schema.TypeString,
-											Required: true,
+											Optional: true,
 										},
 										"resize_option": stringSchema(true, validation.StringInSlice(quicksight.ResizeOption_Values(), false)),
 									},
@@ -456,7 +458,7 @@ func freeFormLayoutElementsSchema() *schema.Schema {
 					MaxItems: 1,
 					Elem: &schema.Resource{
 						Schema: map[string]*schema.Schema{
-							"color":      stringSchema(false, validation.StringMatch(regexp.MustCompile(`^#[A-F0-9]{6}(?:[A-F0-9]{2})?$`), "")),
+							"color":      stringSchema(false, validation.StringMatch(regexache.MustCompile(`^#[0-9A-F]{6}(?:[0-9A-F]{2})?$`), "")),
 							"visibility": stringSchema(false, validation.StringInSlice(quicksight.Visibility_Values(), false)),
 						},
 					},
@@ -468,7 +470,7 @@ func freeFormLayoutElementsSchema() *schema.Schema {
 					MaxItems: 1,
 					Elem: &schema.Resource{
 						Schema: map[string]*schema.Schema{
-							"color":      stringSchema(false, validation.StringMatch(regexp.MustCompile(`^#[A-F0-9]{6}(?:[A-F0-9]{2})?$`), "")),
+							"color":      stringSchema(false, validation.StringMatch(regexache.MustCompile(`^#[0-9A-F]{6}(?:[0-9A-F]{2})?$`), "")),
 							"visibility": stringSchema(false, validation.StringInSlice(quicksight.Visibility_Values(), false)),
 						},
 					},
@@ -513,7 +515,7 @@ func freeFormLayoutElementsSchema() *schema.Schema {
 					MaxItems: 1,
 					Elem: &schema.Resource{
 						Schema: map[string]*schema.Schema{
-							"color":      stringSchema(false, validation.StringMatch(regexp.MustCompile(`^#[A-F0-9]{6}(?:[A-F0-9]{2})?$`), "")),
+							"color":      stringSchema(false, validation.StringMatch(regexache.MustCompile(`^#[0-9A-F]{6}(?:[0-9A-F]{2})?$`), "")),
 							"visibility": stringSchema(false, validation.StringInSlice(quicksight.Visibility_Values(), false)),
 						},
 					},
diff --git a/internal/service/quicksight/schema/visual.go b/internal/service/quicksight/schema/visual.go
index 4d18e50735b..cdae4d34e94 100644
--- a/internal/service/quicksight/schema/visual.go
+++ b/internal/service/quicksight/schema/visual.go
@@ -1,9 +1,12 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package schema
 
 import (
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/quicksight"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
@@ -19,7 +22,7 @@ func visualsSchema() *schema.Schema {
 	return &schema.Schema{ // https://docs.aws.amazon.com/quicksight/latest/APIReference/API_SheetControlLayout.html
 		Type:     schema.TypeList,
 		MinItems: 1,
-		MaxItems: 30,
+		MaxItems: 50,
 		Optional: true,
 		Elem: &schema.Resource{
 			Schema: map[string]*schema.Schema{
@@ -153,7 +156,7 @@ func visualPaletteSchema() *schema.Schema {
 		MaxItems: 1,
 		Elem: &schema.Resource{
 			Schema: map[string]*schema.Schema{
-				"chart_color": stringSchema(false, validation.StringMatch(regexp.MustCompile(`^#[A-F0-9]{6}$`), "")),
+				"chart_color": stringSchema(false, validation.StringMatch(regexache.MustCompile(`^#[0-9A-F]{6}$`), "")),
 				"color_map": { // https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DataPathColor.html
 					Type:     schema.TypeList,
 					Optional: true,
@@ -161,7 +164,7 @@ func visualPaletteSchema() *schema.Schema {
 					MaxItems: 5000,
 					Elem: &schema.Resource{
 						Schema: map[string]*schema.Schema{
-							"color":            stringSchema(true, validation.StringMatch(regexp.MustCompile(`^#[A-F0-9]{6}$`), "")),
+							"color":            stringSchema(true, validation.StringMatch(regexache.MustCompile(`^#[0-9A-F]{6}$`), "")),
 							"element":          dataPathValueSchema(1), // https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DataPathValue.html
 							"time_granularity": stringSchema(false, validation.StringInSlice(quicksight.TimeGranularity_Values(), false)),
 						},
@@ -380,7 +383,7 @@ func colorScaleSchema() *schema.Schema {
 					MaxItems: 3,
 					Elem: &schema.Resource{
 						Schema: map[string]*schema.Schema{
-							"color": stringSchema(false, validation.StringMatch(regexp.MustCompile(`^#[A-F0-9]{6}$`), "")),
+							"color": stringSchema(false, validation.StringMatch(regexache.MustCompile(`^#[0-9A-F]{6}$`), "")),
 							"data_value": {
 								Type:     schema.TypeFloat,
 								Optional: true,
@@ -395,7 +398,7 @@ func colorScaleSchema() *schema.Schema {
 					MaxItems: 1,
 					Elem: &schema.Resource{
 						Schema: map[string]*schema.Schema{
-							"color": stringSchema(false, validation.StringMatch(regexp.MustCompile(`^#[A-F0-9]{6}$`), "")),
+							"color": stringSchema(false, validation.StringMatch(regexache.MustCompile(`^#[0-9A-F]{6}$`), "")),
 							"data_value": {
 								Type:     schema.TypeFloat,
 								Optional: true,
@@ -485,7 +488,7 @@ func dataLabelOptionsSchema() *schema.Schema {
 						},
 					},
 				},
-				"label_color":              stringSchema(false, validation.StringMatch(regexp.MustCompile(`^#[A-F0-9]{6}$`), "")),
+				"label_color":              stringSchema(false, validation.StringMatch(regexache.MustCompile(`^#[0-9A-F]{6}$`), "")),
 				"label_content":            stringSchema(false, validation.StringInSlice(quicksight.DataLabelContent_Values(), false)),
 				"label_font_configuration": fontConfigurationSchema(), // https://docs.aws.amazon.com/quicksight/latest/APIReference/API_FontConfiguration.html
 				"measure_label_visibility": stringSchema(false, validation.StringInSlice(quicksight.Visibility_Values(), false)),
@@ -1280,7 +1283,7 @@ func expandComparisonConfiguration(tfList []interface{}) *quicksight.ComparisonC
 
 	config := &quicksight.ComparisonConfiguration{}
 
-	if v, ok := tfMap["config"].(string); ok && v != "" {
+	if v, ok := tfMap["comparison_method"].(string); ok && v != "" {
 		config.ComparisonMethod = aws.String(v)
 	}
 	if v, ok := tfMap["comparison_format"].([]interface{}); ok && len(v) > 0 {
@@ -1473,7 +1476,7 @@ func flattenDataLabelOptions(apiObject *quicksight.DataLabelOptions) []interface
 		tfMap["label_font_configuration"] = flattenFontConfiguration(apiObject.LabelFontConfiguration)
 	}
 	if apiObject.MeasureLabelVisibility != nil {
-		tfMap["measure_visibility"] = aws.StringValue(apiObject.MeasureLabelVisibility)
+		tfMap["measure_label_visibility"] = aws.StringValue(apiObject.MeasureLabelVisibility)
 	}
 	if apiObject.Overlap != nil {
 		tfMap["overlap"] = aws.StringValue(apiObject.Overlap)
diff --git a/internal/service/quicksight/schema/visual_actions.go b/internal/service/quicksight/schema/visual_actions.go
index 13935115162..49695ed1864 100644
--- a/internal/service/quicksight/schema/visual_actions.go
+++ b/internal/service/quicksight/schema/visual_actions.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package schema
 
 import (
diff --git a/internal/service/quicksight/schema/visual_bar_chart.go b/internal/service/quicksight/schema/visual_bar_chart.go
index 7c2cd3f49ef..b9ef684d6e4 100644
--- a/internal/service/quicksight/schema/visual_bar_chart.go
+++ b/internal/service/quicksight/schema/visual_bar_chart.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package schema
 
 import (
diff --git a/internal/service/quicksight/schema/visual_box_plot.go b/internal/service/quicksight/schema/visual_box_plot.go
index a4e7e9a24fb..a7421cb3fae 100644
--- a/internal/service/quicksight/schema/visual_box_plot.go
+++ b/internal/service/quicksight/schema/visual_box_plot.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package schema
 
 import (
diff --git a/internal/service/quicksight/schema/visual_chart_configuration.go b/internal/service/quicksight/schema/visual_chart_configuration.go
index ab1b8eed33e..6335e3c0f0e 100644
--- a/internal/service/quicksight/schema/visual_chart_configuration.go
+++ b/internal/service/quicksight/schema/visual_chart_configuration.go
@@ -1,8 +1,10 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package schema
 
 import (
-	"regexp"
-
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/quicksight"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
@@ -332,11 +334,11 @@ func referenceLineSchema(maxItems int) *schema.Schema {
 								MaxItems: 1,
 								Elem: &schema.Resource{
 									Schema: map[string]*schema.Schema{
-										"custom_label": stringSchema(true, validation.StringMatch(regexp.MustCompile(`.*\S.*`), "")),
+										"custom_label": stringSchema(true, validation.StringMatch(regexache.MustCompile(`.*\S.*`), "")),
 									},
 								},
 							},
-							"font_color":          stringSchema(false, validation.StringMatch(regexp.MustCompile(`^#[A-F0-9]{6}$`), "")),
+							"font_color":          stringSchema(false, validation.StringMatch(regexache.MustCompile(`^#[0-9A-F]{6}$`), "")),
 							"font_configuration":  fontConfigurationSchema(), // https://docs.aws.amazon.com/quicksight/latest/APIReference/API_FontConfiguration.html
 							"horizontal_position": stringSchema(false, validation.StringInSlice(quicksight.ReferenceLineLabelHorizontalPosition_Values(), false)),
 							"value_label_configuration": { // https://docs.aws.amazon.com/quicksight/latest/APIReference/API_ReferenceLineValueLabelConfiguration.html
@@ -363,7 +365,7 @@ func referenceLineSchema(maxItems int) *schema.Schema {
 					MaxItems: 1,
 					Elem: &schema.Resource{
 						Schema: map[string]*schema.Schema{
-							"color":   stringSchema(false, validation.StringMatch(regexp.MustCompile(`^#[A-F0-9]{6}$`), "")),
+							"color":   stringSchema(false, validation.StringMatch(regexache.MustCompile(`^#[0-9A-F]{6}$`), "")),
 							"pattern": stringSchema(false, validation.StringInSlice(quicksight.ReferenceLinePatternType_Values(), false)),
 						},
 					},
@@ -398,9 +400,9 @@ func smallMultiplesOptionsSchema() *schema.Schema {
 					MaxItems: 1,
 					Elem: &schema.Resource{
 						Schema: map[string]*schema.Schema{
-							"background_color":      stringSchema(false, validation.StringMatch(regexp.MustCompile(`^#[A-F0-9]{6}(?:[A-F0-9]{2})?$`), "")),
+							"background_color":      stringSchema(false, validation.StringMatch(regexache.MustCompile(`^#[0-9A-F]{6}(?:[0-9A-F]{2})?$`), "")),
 							"background_visibility": stringSchema(false, validation.StringInSlice(quicksight.Visibility_Values(), false)),
-							"border_color":          stringSchema(false, validation.StringMatch(regexp.MustCompile(`^#[A-F0-9]{6}(?:[A-F0-9]{2})?$`), "")),
+							"border_color":          stringSchema(false, validation.StringMatch(regexache.MustCompile(`^#[0-9A-F]{6}(?:[0-9A-F]{2})?$`), "")),
 							"border_style":          stringSchema(false, validation.StringInSlice(quicksight.PanelBorderStyle_Values(), false)),
 							"border_thickness": {
 								Type:     schema.TypeString,
@@ -1365,7 +1367,7 @@ func flattenScrollBarOptions(apiObject *quicksight.ScrollBarOptions) []interface
 		tfMap["visibility"] = aws.StringValue(apiObject.Visibility)
 	}
 	if apiObject.VisibleRange != nil {
-		tfMap["visibile_range"] = flattenVisibleRangeOptions(apiObject.VisibleRange)
+		tfMap["visible_range"] = flattenVisibleRangeOptions(apiObject.VisibleRange)
 	}
 
 	return []interface{}{tfMap}
diff --git a/internal/service/quicksight/schema/visual_combo_chart.go b/internal/service/quicksight/schema/visual_combo_chart.go
index 628f5695097..1c232ebe7e3 100644
--- a/internal/service/quicksight/schema/visual_combo_chart.go
+++ b/internal/service/quicksight/schema/visual_combo_chart.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package schema
 
 import (
diff --git a/internal/service/quicksight/schema/visual_conditional_formatting.go b/internal/service/quicksight/schema/visual_conditional_formatting.go
index 6a2efee0077..f788bb186ed 100644
--- a/internal/service/quicksight/schema/visual_conditional_formatting.go
+++ b/internal/service/quicksight/schema/visual_conditional_formatting.go
@@ -1,8 +1,10 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package schema
 
 import (
-	"regexp"
-
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/quicksight"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
@@ -42,7 +44,7 @@ func conditionalFormattingColorSchema() *schema.Schema {
 														Type:     schema.TypeFloat,
 														Required: true,
 													},
-													"color": stringSchema(false, validation.StringMatch(regexp.MustCompile(`^#[A-F0-9]{6}$`), "")),
+													"color": stringSchema(false, validation.StringMatch(regexache.MustCompile(`^#[0-9A-F]{6}$`), "")),
 													"data_value": {
 														Type:     schema.TypeFloat,
 														Optional: true,
@@ -64,7 +66,7 @@ func conditionalFormattingColorSchema() *schema.Schema {
 					MaxItems: 1,
 					Elem: &schema.Resource{
 						Schema: map[string]*schema.Schema{
-							"color":      stringSchema(false, validation.StringMatch(regexp.MustCompile(`^#[A-F0-9]{6}$`), "")),
+							"color":      stringSchema(false, validation.StringMatch(regexache.MustCompile(`^#[0-9A-F]{6}$`), "")),
 							"expression": stringSchema(true, validation.StringLenBetween(1, 4096)),
 						},
 					},
@@ -89,7 +91,7 @@ func conditionalFormattingIconSchema() *schema.Schema {
 					MaxItems: 1,
 					Elem: &schema.Resource{
 						Schema: map[string]*schema.Schema{
-							"color":      stringSchema(false, validation.StringMatch(regexp.MustCompile(`^#[A-F0-9]{6}$`), "")),
+							"color":      stringSchema(false, validation.StringMatch(regexache.MustCompile(`^#[0-9A-F]{6}$`), "")),
 							"expression": stringSchema(true, validation.StringLenBetween(1, 4096)),
 							"icon_options": { // https://docs.aws.amazon.com/quicksight/latest/APIReference/API_ConditionalFormattingCustomIconOptions.html
 								Type:     schema.TypeList,
@@ -99,7 +101,7 @@ func conditionalFormattingIconSchema() *schema.Schema {
 								Elem: &schema.Resource{
 									Schema: map[string]*schema.Schema{
 										"icon":         stringSchema(false, validation.StringInSlice(quicksight.Icon_Values(), false)),
-										"unicode_icon": stringSchema(false, validation.StringMatch(regexp.MustCompile(`^[^\\u0000-\\u00FF]$`), "")),
+										"unicode_icon": stringSchema(false, validation.StringMatch(regexache.MustCompile(`^[^\\u0000-\\u00FF]$`), "")),
 									},
 								},
 							},
diff --git a/internal/service/quicksight/schema/visual_custom_content.go b/internal/service/quicksight/schema/visual_custom_content.go
index be4bf3bd868..ed88377c625 100644
--- a/internal/service/quicksight/schema/visual_custom_content.go
+++ b/internal/service/quicksight/schema/visual_custom_content.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package schema
 
 import (
diff --git a/internal/service/quicksight/schema/visual_empty.go b/internal/service/quicksight/schema/visual_empty.go
index 42db33d2944..16d55fa0cc7 100644
--- a/internal/service/quicksight/schema/visual_empty.go
+++ b/internal/service/quicksight/schema/visual_empty.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package schema
 
 import (
diff --git a/internal/service/quicksight/schema/visual_fields.go b/internal/service/quicksight/schema/visual_fields.go
index 2ff96051232..af6c89a2417 100644
--- a/internal/service/quicksight/schema/visual_fields.go
+++ b/internal/service/quicksight/schema/visual_fields.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package schema
 
 import (
diff --git a/internal/service/quicksight/schema/visual_filled_map.go b/internal/service/quicksight/schema/visual_filled_map.go
index 5ad5f20e18d..f6fcbc771e5 100644
--- a/internal/service/quicksight/schema/visual_filled_map.go
+++ b/internal/service/quicksight/schema/visual_filled_map.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package schema
 
 import (
diff --git a/internal/service/quicksight/schema/visual_funnel_chart.go b/internal/service/quicksight/schema/visual_funnel_chart.go
index 3898cfff91e..4f1520fab59 100644
--- a/internal/service/quicksight/schema/visual_funnel_chart.go
+++ b/internal/service/quicksight/schema/visual_funnel_chart.go
@@ -1,8 +1,10 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package schema
 
 import (
-	"regexp"
-
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/quicksight"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
@@ -36,7 +38,7 @@ func funnelChartVisualSchema() *schema.Schema {
 								Elem: &schema.Resource{
 									Schema: map[string]*schema.Schema{
 										"category_label_visibility": stringSchema(false, validation.StringInSlice(quicksight.Visibility_Values(), false)),
-										"label_color":               stringSchema(false, validation.StringMatch(regexp.MustCompile(`^#[A-F0-9]{6}$`), "")),
+										"label_color":               stringSchema(false, validation.StringMatch(regexache.MustCompile(`^#[0-9A-F]{6}$`), "")),
 										"label_font_configuration":  fontConfigurationSchema(), // https://docs.aws.amazon.com/quicksight/latest/APIReference/API_FontConfiguration.html
 										"measure_data_label_style":  stringSchema(false, validation.StringInSlice(quicksight.FunnelChartMeasureDataLabelStyle_Values(), false)),
 										"measure_label_visibility":  stringSchema(false, validation.StringInSlice(quicksight.Visibility_Values(), false)),
diff --git a/internal/service/quicksight/schema/visual_gauge_chart.go b/internal/service/quicksight/schema/visual_gauge_chart.go
index 398d42e22f7..0e53218019a 100644
--- a/internal/service/quicksight/schema/visual_gauge_chart.go
+++ b/internal/service/quicksight/schema/visual_gauge_chart.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package schema
 
 import (
diff --git a/internal/service/quicksight/schema/visual_geospatial_map.go b/internal/service/quicksight/schema/visual_geospatial_map.go
index 7ac5f2fab5f..60e0e749cb9 100644
--- a/internal/service/quicksight/schema/visual_geospatial_map.go
+++ b/internal/service/quicksight/schema/visual_geospatial_map.go
@@ -1,8 +1,10 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package schema
 
 import (
-	"regexp"
-
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/quicksight"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
@@ -79,7 +81,7 @@ func geospatialMapVisualSchema() *schema.Schema {
 																	MaxItems: 1,
 																	Elem: &schema.Resource{
 																		Schema: map[string]*schema.Schema{
-																			"color": stringSchema(false, validation.StringMatch(regexp.MustCompile(`^#[A-F0-9]{6}$`), "")),
+																			"color": stringSchema(false, validation.StringMatch(regexache.MustCompile(`^#[0-9A-F]{6}$`), "")),
 																		},
 																	},
 																},
diff --git a/internal/service/quicksight/schema/visual_heat_map.go b/internal/service/quicksight/schema/visual_heat_map.go
index ea9b7afae00..55d0a585bb8 100644
--- a/internal/service/quicksight/schema/visual_heat_map.go
+++ b/internal/service/quicksight/schema/visual_heat_map.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package schema
 
 import (
diff --git a/internal/service/quicksight/schema/visual_histogram.go b/internal/service/quicksight/schema/visual_histogram.go
index 436c988dbaa..ac846bd471c 100644
--- a/internal/service/quicksight/schema/visual_histogram.go
+++ b/internal/service/quicksight/schema/visual_histogram.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package schema
 
 import (
diff --git a/internal/service/quicksight/schema/visual_insight.go b/internal/service/quicksight/schema/visual_insight.go
index 9e9eedc86ac..2fb5f8f615d 100644
--- a/internal/service/quicksight/schema/visual_insight.go
+++ b/internal/service/quicksight/schema/visual_insight.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package schema
 
 import (
@@ -743,7 +746,7 @@ func flattenInsightConfiguration(apiObject *quicksight.InsightConfiguration) []i
 
 	tfMap := map[string]interface{}{}
 	if apiObject.Computations != nil {
-		tfMap["computations"] = flattenComputation(apiObject.Computations)
+		tfMap["computation"] = flattenComputation(apiObject.Computations)
 	}
 	if apiObject.CustomNarrative != nil {
 		tfMap["custom_narrative"] = flattenCustomNarrativeOptions(apiObject.CustomNarrative)
diff --git a/internal/service/quicksight/schema/visual_kpi.go b/internal/service/quicksight/schema/visual_kpi.go
index 814c0208a37..576484551ee 100644
--- a/internal/service/quicksight/schema/visual_kpi.go
+++ b/internal/service/quicksight/schema/visual_kpi.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package schema
 
 import (
diff --git a/internal/service/quicksight/schema/visual_line_chart.go b/internal/service/quicksight/schema/visual_line_chart.go
index 94924edd3f3..793c46a94b2 100644
--- a/internal/service/quicksight/schema/visual_line_chart.go
+++ b/internal/service/quicksight/schema/visual_line_chart.go
@@ -1,9 +1,12 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package schema
 
 import (
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/quicksight"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
@@ -311,7 +314,7 @@ func lineChartMarkerStyleSettingsSchema() *schema.Schema {
 		MaxItems: 1,
 		Elem: &schema.Resource{
 			Schema: map[string]*schema.Schema{
-				"marker_color": stringSchema(false, validation.StringMatch(regexp.MustCompile(`^#[A-F0-9]{6}$`), "")),
+				"marker_color": stringSchema(false, validation.StringMatch(regexache.MustCompile(`^#[0-9A-F]{6}$`), "")),
 				"marker_shape": stringSchema(false, validation.StringInSlice(quicksight.LineChartMarkerShape_Values(), false)),
 				"marker_size": {
 					Type:     schema.TypeString,
diff --git a/internal/service/quicksight/schema/visual_map.go b/internal/service/quicksight/schema/visual_map.go
index e55b5b46c9c..4a6c770ec16 100644
--- a/internal/service/quicksight/schema/visual_map.go
+++ b/internal/service/quicksight/schema/visual_map.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package schema
 
 import (
diff --git a/internal/service/quicksight/schema/visual_pie_chart.go b/internal/service/quicksight/schema/visual_pie_chart.go
index e4de76e6903..0d923b8561c 100644
--- a/internal/service/quicksight/schema/visual_pie_chart.go
+++ b/internal/service/quicksight/schema/visual_pie_chart.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package schema
 
 import (
diff --git a/internal/service/quicksight/schema/visual_pivot_table.go b/internal/service/quicksight/schema/visual_pivot_table.go
index c163c5a0eb3..cbe7c9f5b91 100644
--- a/internal/service/quicksight/schema/visual_pivot_table.go
+++ b/internal/service/quicksight/schema/visual_pivot_table.go
@@ -1,8 +1,10 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package schema
 
 import (
-	"regexp"
-
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/quicksight"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
@@ -253,7 +255,7 @@ func tableBorderOptionsSchema() *schema.Schema {
 		MaxItems: 1,
 		Elem: &schema.Resource{
 			Schema: map[string]*schema.Schema{
-				"color":     stringSchema(false, validation.StringMatch(regexp.MustCompile(`^#[A-F0-9]{6}$`), "")),
+				"color":     stringSchema(false, validation.StringMatch(regexache.MustCompile(`^#[0-9A-F]{6}$`), "")),
 				"style":     stringSchema(false, validation.StringInSlice(quicksight.TableBorderStyle_Values(), false)),
 				"thickness": intSchema(false, validation.IntBetween(1, 4)),
 			},
@@ -269,7 +271,7 @@ func tableCellStyleSchema() *schema.Schema {
 		MaxItems: 1,
 		Elem: &schema.Resource{
 			Schema: map[string]*schema.Schema{
-				"background_color": stringSchema(false, validation.StringMatch(regexp.MustCompile(`^#[A-F0-9]{6}$`), "")),
+				"background_color": stringSchema(false, validation.StringMatch(regexache.MustCompile(`^#[0-9A-F]{6}$`), "")),
 				"border": { // https://docs.aws.amazon.com/quicksight/latest/APIReference/API_GlobalTableBorderOptions.html
 					Type:     schema.TypeList,
 					Optional: true,
@@ -377,7 +379,7 @@ func rowAlternateColorOptionsSchema() *schema.Schema {
 					Optional: true,
 					MinItems: 1,
 					MaxItems: 1,
-					Elem:     &schema.Schema{Type: schema.TypeString, ValidateFunc: validation.StringMatch(regexp.MustCompile(`^#[A-F0-9]{6}$`), "")},
+					Elem:     &schema.Schema{Type: schema.TypeString, ValidateFunc: validation.StringMatch(regexache.MustCompile(`^#[0-9A-F]{6}$`), "")},
 				},
 				"status": stringSchema(false, validation.StringInSlice(quicksight.Status_Values(), false)),
 			},
@@ -1292,7 +1294,7 @@ func flattenPivotTableAggregatedFieldWells(apiObject *quicksight.PivotTableAggre
 		tfMap["columns"] = flattenDimensionFields(apiObject.Columns)
 	}
 	if apiObject.Rows != nil {
-		tfMap["row"] = flattenDimensionFields(apiObject.Rows)
+		tfMap["rows"] = flattenDimensionFields(apiObject.Rows)
 	}
 	if apiObject.Values != nil {
 		tfMap["values"] = flattenMeasureFields(apiObject.Values)
@@ -1668,7 +1670,7 @@ func flattenPivotTableFieldOption(apiObject []*quicksight.PivotTableFieldOption)
 			tfMap["custom_label"] = aws.StringValue(config.CustomLabel)
 		}
 		if config.Visibility != nil {
-			tfMap["visbility"] = aws.StringValue(config.Visibility)
+			tfMap["visibility"] = aws.StringValue(config.Visibility)
 		}
 
 		tfList = append(tfList, tfMap)
diff --git a/internal/service/quicksight/schema/visual_radar_chart.go b/internal/service/quicksight/schema/visual_radar_chart.go
index e71b904f480..8047290f9aa 100644
--- a/internal/service/quicksight/schema/visual_radar_chart.go
+++ b/internal/service/quicksight/schema/visual_radar_chart.go
@@ -1,8 +1,10 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package schema
 
 import (
-	"regexp"
-
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/quicksight"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
@@ -28,8 +30,8 @@ func radarChartVisualSchema() *schema.Schema {
 					Elem: &schema.Resource{
 						Schema: map[string]*schema.Schema{
 							"alternate_band_colors_visibility": stringSchema(false, validation.StringInSlice(quicksight.Visibility_Values(), false)),
-							"alternate_band_even_color":        stringSchema(false, validation.StringMatch(regexp.MustCompile(`^#[A-F0-9]{6}$`), "")),
-							"alternate_band_odd_color":         stringSchema(false, validation.StringMatch(regexp.MustCompile(`^#[A-F0-9]{6}$`), "")),
+							"alternate_band_even_color":        stringSchema(false, validation.StringMatch(regexache.MustCompile(`^#[0-9A-F]{6}$`), "")),
+							"alternate_band_odd_color":         stringSchema(false, validation.StringMatch(regexache.MustCompile(`^#[0-9A-F]{6}$`), "")),
 							"base_series_settings": { // https://docs.aws.amazon.com/quicksight/latest/APIReference/API_RadarChartSeriesSettings.html
 								Type:     schema.TypeList,
 								Optional: true,
diff --git a/internal/service/quicksight/schema/visual_sankey_diagram.go b/internal/service/quicksight/schema/visual_sankey_diagram.go
index af0d9081e84..9b9bfd55c3c 100644
--- a/internal/service/quicksight/schema/visual_sankey_diagram.go
+++ b/internal/service/quicksight/schema/visual_sankey_diagram.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package schema
 
 import (
diff --git a/internal/service/quicksight/schema/visual_scatter_plot.go b/internal/service/quicksight/schema/visual_scatter_plot.go
index 0b7ea3591af..321fbd2edaa 100644
--- a/internal/service/quicksight/schema/visual_scatter_plot.go
+++ b/internal/service/quicksight/schema/visual_scatter_plot.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package schema
 
 import (
diff --git a/internal/service/quicksight/schema/visual_sort.go b/internal/service/quicksight/schema/visual_sort.go
index 1db23df9f65..316e1a96301 100644
--- a/internal/service/quicksight/schema/visual_sort.go
+++ b/internal/service/quicksight/schema/visual_sort.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package schema
 
 import (
diff --git a/internal/service/quicksight/schema/visual_table.go b/internal/service/quicksight/schema/visual_table.go
index 33832c19eb3..58281f2256b 100644
--- a/internal/service/quicksight/schema/visual_table.go
+++ b/internal/service/quicksight/schema/visual_table.go
@@ -1,8 +1,10 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package schema
 
 import (
-	"regexp"
-
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/quicksight"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
@@ -239,8 +241,8 @@ func tableVisualSchema() *schema.Schema {
 											Elem: &schema.Resource{
 												Schema: map[string]*schema.Schema{
 													"field_id":       stringSchema(true, validation.StringLenBetween(1, 512)),
-													"negative_color": stringSchema(false, validation.StringMatch(regexp.MustCompile(`^#[A-F0-9]{6}$`), "")),
-													"positive_color": stringSchema(false, validation.StringMatch(regexp.MustCompile(`^#[A-F0-9]{6}$`), "")),
+													"negative_color": stringSchema(false, validation.StringMatch(regexache.MustCompile(`^#[0-9A-F]{6}$`), "")),
+													"positive_color": stringSchema(false, validation.StringMatch(regexache.MustCompile(`^#[0-9A-F]{6}$`), "")),
 												},
 											},
 										},
diff --git a/internal/service/quicksight/schema/visual_tree_map.go b/internal/service/quicksight/schema/visual_tree_map.go
index d19f1b46ba0..60667335233 100644
--- a/internal/service/quicksight/schema/visual_tree_map.go
+++ b/internal/service/quicksight/schema/visual_tree_map.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package schema
 
 import (
diff --git a/internal/service/quicksight/schema/visual_waterfall.go b/internal/service/quicksight/schema/visual_waterfall.go
index d844f5fc39b..e50d68054a1 100644
--- a/internal/service/quicksight/schema/visual_waterfall.go
+++ b/internal/service/quicksight/schema/visual_waterfall.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package schema
 
 import (
diff --git a/internal/service/quicksight/schema/visual_word_cloud.go b/internal/service/quicksight/schema/visual_word_cloud.go
index 821262444f7..ae9f870e951 100644
--- a/internal/service/quicksight/schema/visual_word_cloud.go
+++ b/internal/service/quicksight/schema/visual_word_cloud.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package schema
 
 import (
@@ -357,7 +360,7 @@ func flattenWordCloudOptions(apiObject *quicksight.WordCloudOptions) []interface
 		tfMap["word_casing"] = aws.StringValue(apiObject.WordCasing)
 	}
 	if apiObject.WordOrientation != nil {
-		tfMap["work_orientation"] = aws.StringValue(apiObject.WordOrientation)
+		tfMap["word_orientation"] = aws.StringValue(apiObject.WordOrientation)
 	}
 	if apiObject.WordPadding != nil {
 		tfMap["word_padding"] = aws.StringValue(apiObject.WordPadding)
diff --git a/internal/service/quicksight/service_package_gen.go b/internal/service/quicksight/service_package_gen.go
index 383bb9bddf7..c1388eddb16 100644
--- a/internal/service/quicksight/service_package_gen.go
+++ b/internal/service/quicksight/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	quicksight_sdkv1 "github.com/aws/aws-sdk-go/service/quicksight"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -174,4 +175,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*q
 	return quicksight_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/quicksight/status.go b/internal/service/quicksight/status.go
index 8aa3af249a8..81a0ffee49f 100644
--- a/internal/service/quicksight/status.go
+++ b/internal/service/quicksight/status.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package quicksight
 
 import (
diff --git a/internal/service/quicksight/sweep.go b/internal/service/quicksight/sweep.go
index 906a6b0cdff..e35550f10ac 100644
--- a/internal/service/quicksight/sweep.go
+++ b/internal/service/quicksight/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package quicksight
 
@@ -10,12 +10,14 @@ import (
 
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/quicksight"
-	"github.com/hashicorp/go-multierror"
+	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/framework"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_quicksight_dashboard", &resource.Sweeper{
 		Name: "aws_quicksight_dashboard",
 		F:    sweepDashboards,
@@ -32,6 +34,10 @@ func init() {
 		Name: "aws_quicksight_folder",
 		F:    sweepFolders,
 	})
+	resource.AddTestSweepers("aws_quicksight_group", &resource.Sweeper{
+		Name: "aws_quicksight_group",
+		F:    sweepGroups,
+	})
 	resource.AddTestSweepers("aws_quicksight_template", &resource.Sweeper{
 		Name: "aws_quicksight_template",
 		F:    sweepTemplates,
@@ -39,6 +45,13 @@ func init() {
 	resource.AddTestSweepers("aws_quicksight_user", &resource.Sweeper{
 		Name: "aws_quicksight_user",
 		F:    sweepUsers,
+		Dependencies: []string{
+			"aws_quicksight_group",
+		},
+	})
+	resource.AddTestSweepers("aws_quicksight_vpc_connection", &resource.Sweeper{
+		Name: "aws_quicksight_vpc_connection",
+		F:    sweepVPCConnections,
 	})
 }
 
@@ -47,9 +60,13 @@ const (
 	acctestResourcePrefix = "tf-acc-test"
 )
 
+// TODO
+// TODO Use paginated listers.
+// TODO
+
 func sweepDashboards(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
@@ -57,7 +74,6 @@ func sweepDashboards(region string) error {
 
 	conn := client.QuickSightConn(ctx)
 	sweepResources := make([]sweep.Sweepable, 0)
-	var errs *multierror.Error
 
 	awsAccountId := client.AccountID
 
@@ -85,25 +101,24 @@ func sweepDashboards(region string) error {
 		return !lastPage
 	})
 
-	if err != nil {
-		errs = multierror.Append(errs, fmt.Errorf("listing QuickSight Dashboards: %w", err))
+	if skipSweepError(err) {
+		log.Printf("[WARN] Skipping QuickSight Dashboard sweep for %s: %s", region, err)
+		return nil
 	}
-
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
-		errs = multierror.Append(errs, fmt.Errorf("sweeping QuickSight Dashboards for %s: %w", region, err))
+	if err != nil {
+		return fmt.Errorf("listing QuickSight Dashboards: %w", err)
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
-		log.Printf("[WARN] Skipping QuickSight Dashboard sweep for %s: %s", region, errs)
-		return nil
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
+		return fmt.Errorf("sweeping QuickSight Dashboards for %s: %w", region, err)
 	}
 
-	return errs.ErrorOrNil()
+	return nil
 }
 
 func sweepDataSets(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
@@ -111,7 +126,6 @@ func sweepDataSets(region string) error {
 
 	conn := client.QuickSightConn(ctx)
 	sweepResources := make([]sweep.Sweepable, 0)
-	var errs *multierror.Error
 
 	awsAccountId := client.AccountID
 
@@ -139,25 +153,24 @@ func sweepDataSets(region string) error {
 		return !lastPage
 	})
 
-	if err != nil {
-		errs = multierror.Append(errs, fmt.Errorf("listing QuickSight Data Sets: %w", err))
+	if skipSweepError(err) {
+		log.Printf("[WARN] Skipping QuickSight Data Set sweep for %s: %s", region, err)
+		return nil
 	}
-
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
-		errs = multierror.Append(errs, fmt.Errorf("sweeping QuickSight Data Sets for %s: %w", region, err))
+	if err != nil {
+		return fmt.Errorf("listing QuickSight Data Sets: %w", err)
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
-		log.Printf("[WARN] Skipping QuickSight Data Set sweep for %s: %s", region, errs)
-		return nil
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
+		return fmt.Errorf("sweeping QuickSight Data Sets for %s: %w", region, err)
 	}
 
-	return errs.ErrorOrNil()
+	return nil
 }
 
 func sweepDataSources(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
@@ -165,7 +178,6 @@ func sweepDataSources(region string) error {
 
 	conn := client.QuickSightConn(ctx)
 	sweepResources := make([]sweep.Sweepable, 0)
-	var errs *multierror.Error
 
 	awsAccountId := client.AccountID
 
@@ -193,25 +205,24 @@ func sweepDataSources(region string) error {
 		return !lastPage
 	})
 
+	if skipSweepError(err) {
+		log.Printf("[WARN] Skipping QuickSight Data Source sweep for %s: %s", region, err)
+		return nil
+	}
 	if err != nil {
-		errs = multierror.Append(errs, fmt.Errorf("listing QuickSight Data Sources: %w", err))
+		return fmt.Errorf("listing QuickSight Data Sources: %w", err)
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
-		errs = multierror.Append(errs, fmt.Errorf("sweeping QuickSight Data Sources for %s: %w", region, err))
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
+		return fmt.Errorf("sweeping QuickSight Data Sources for %s: %w", region, err)
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
-		log.Printf("[WARN] Skipping QuickSight Data Source sweep for %s: %s", region, errs)
-		return nil
-	}
-
-	return errs.ErrorOrNil()
+	return nil
 }
 
 func sweepFolders(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("getting client: %w", err)
@@ -220,7 +231,6 @@ func sweepFolders(region string) error {
 	conn := client.QuickSightConn(ctx)
 	awsAccountId := client.AccountID
 	sweepResources := make([]sweep.Sweepable, 0)
-	var errs *multierror.Error
 
 	input := &quicksight.ListFoldersInput{
 		AwsAccountId: aws.String(awsAccountId),
@@ -239,25 +249,70 @@ func sweepFolders(region string) error {
 		sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
 	}
 
+	if skipSweepError(err) {
+		log.Printf("[WARN] Skipping QuickSight Folder sweep for %s: %s", region, err)
+		return nil
+	}
+	if err != nil {
+		return fmt.Errorf("listing QuickSight Folders: %w", err)
+	}
+
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
+		return fmt.Errorf("sweeping QuickSight Folders for %s: %w", region, err)
+	}
+
+	return nil
+}
+
+func sweepGroups(region string) error {
+	ctx := sweep.Context(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
+
 	if err != nil {
-		errs = multierror.Append(errs, fmt.Errorf("listing QuickSight Folder for %s: %w", region, err))
+		return fmt.Errorf("getting client: %w", err)
+	}
+
+	conn := client.QuickSightConn(ctx)
+	awsAccountId := client.AccountID
+	sweepResources := make([]sweep.Sweepable, 0)
+
+	input := &quicksight.ListGroupsInput{
+		AwsAccountId: aws.String(awsAccountId),
+		Namespace:    aws.String(DefaultUserNamespace),
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
-		errs = multierror.Append(errs, fmt.Errorf("sweeping QuickSight Folder for %s: %w", region, err))
+	out, err := conn.ListGroupsWithContext(ctx, input)
+	for _, user := range out.GroupList {
+		groupname := aws.StringValue(user.GroupName)
+		if !strings.HasPrefix(groupname, acctestResourcePrefix) {
+			continue
+		}
+
+		r := ResourceGroup()
+		d := r.Data(nil)
+		d.SetId(fmt.Sprintf("%s/%s/%s", awsAccountId, DefaultUserNamespace, groupname))
+
+		sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
 	}
 
-	if sweep.SkipSweepError(err) {
-		log.Printf("[WARN] Skipping QuickSight Folder sweep for %s: %s", region, errs)
+	if skipSweepUserError(err) {
+		log.Printf("[WARN] Skipping QuickSight Group sweep for %s: %s", region, err)
 		return nil
 	}
+	if err != nil {
+		return fmt.Errorf("listing QuickSight Groups: %w", err)
+	}
+
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
+		return fmt.Errorf("sweeping QuickSight Groups for %s: %w", region, err)
+	}
 
-	return errs.ErrorOrNil()
+	return nil
 }
 
 func sweepTemplates(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
@@ -265,7 +320,6 @@ func sweepTemplates(region string) error {
 
 	conn := client.QuickSightConn(ctx)
 	sweepResources := make([]sweep.Sweepable, 0)
-	var errs *multierror.Error
 
 	awsAccountId := client.AccountID
 
@@ -293,25 +347,24 @@ func sweepTemplates(region string) error {
 		return !lastPage
 	})
 
-	if err != nil {
-		errs = multierror.Append(errs, fmt.Errorf("listing QuickSight Templates: %w", err))
+	if skipSweepError(err) {
+		log.Printf("[WARN] Skipping QuickSight Template sweep for %s: %s", region, err)
+		return nil
 	}
-
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
-		errs = multierror.Append(errs, fmt.Errorf("sweeping QuickSight Templates for %s: %w", region, err))
+	if err != nil {
+		return fmt.Errorf("listing QuickSight Templates: %w", err)
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
-		log.Printf("[WARN] Skipping QuickSight Template sweep for %s: %s", region, errs)
-		return nil
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
+		return fmt.Errorf("sweeping QuickSight Templates for %s: %w", region, err)
 	}
 
-	return errs.ErrorOrNil()
+	return nil
 }
 
 func sweepUsers(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("getting client: %w", err)
@@ -320,7 +373,6 @@ func sweepUsers(region string) error {
 	conn := client.QuickSightConn(ctx)
 	awsAccountId := client.AccountID
 	sweepResources := make([]sweep.Sweepable, 0)
-	var errs *multierror.Error
 
 	input := &quicksight.ListUsersInput{
 		AwsAccountId: aws.String(awsAccountId),
@@ -341,18 +393,85 @@ func sweepUsers(region string) error {
 		sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
 	}
 
+	if skipSweepUserError(err) {
+		log.Printf("[WARN] Skipping QuickSight User sweep for %s: %s", region, err)
+		return nil
+	}
 	if err != nil {
-		errs = multierror.Append(errs, fmt.Errorf("listing QuickSight Users for %s: %w", region, err))
+		return fmt.Errorf("listing QuickSight Users: %w", err)
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
-		errs = multierror.Append(errs, fmt.Errorf("sweeping QuickSight Users for %s: %w", region, err))
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
+		return fmt.Errorf("sweeping QuickSight Users for %s: %w", region, err)
 	}
 
-	if sweep.SkipSweepError(err) {
-		log.Printf("[WARN] Skipping QuickSight User sweep for %s: %s", region, errs)
+	return nil
+}
+
+func sweepVPCConnections(region string) error {
+	ctx := sweep.Context(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
+
+	if err != nil {
+		return fmt.Errorf("getting client: %w", err)
+	}
+
+	conn := client.QuickSightConn(ctx)
+	awsAccountId := client.AccountID
+	sweepResources := make([]sweep.Sweepable, 0)
+
+	input := &quicksight.ListVPCConnectionsInput{
+		AwsAccountId: aws.String(awsAccountId),
+	}
+
+	out, err := conn.ListVPCConnectionsWithContext(ctx, input)
+	for _, v := range out.VPCConnectionSummaries {
+		vpcConnectionID := aws.StringValue(v.VPCConnectionId)
+		sweepResources = append(sweepResources, framework.NewSweepResource(newResourceVPCConnection, client,
+			framework.NewAttribute("id", createVPCConnectionID(awsAccountId, vpcConnectionID)),
+			framework.NewAttribute("aws_account_id", awsAccountId),
+			framework.NewAttribute("vpc_connection_id", vpcConnectionID),
+		))
+	}
+
+	if skipSweepError(err) {
+		log.Printf("[WARN] Skipping QuickSight VPC Connection sweep for %s: %s", region, err)
 		return nil
 	}
+	if err != nil {
+		return fmt.Errorf("listing QuickSight VPC Connections: %w", err)
+	}
+
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
+		return fmt.Errorf("sweeping QuickSight VPC Connections for %s: %w", region, err)
+	}
+
+	return nil
+}
+
+// skipSweepError adds an additional skippable error code for listing QuickSight resources other than User
+func skipSweepError(err error) bool {
+	if tfawserr.ErrCodeEquals(err, quicksight.ErrCodeUnsupportedUserEditionException) {
+		return true
+	}
+	if tfawserr.ErrMessageContains(err, quicksight.ErrCodeResourceNotFoundException, "Directory information for account") {
+		return true
+	}
+	if tfawserr.ErrMessageContains(err, quicksight.ErrCodeResourceNotFoundException, "Account information for account") {
+		return true
+	}
+
+	return awsv1.SkipSweepError(err)
+}
+
+// skipSweepUserError adds an additional skippable error code for listing QuickSight User resources
+func skipSweepUserError(err error) bool {
+	if tfawserr.ErrMessageContains(err, quicksight.ErrCodeResourceNotFoundException, "not signed up with QuickSight") {
+		return true
+	}
+	if tfawserr.ErrMessageContains(err, quicksight.ErrCodeResourceNotFoundException, "Namespace default not found in account") {
+		return true
+	}
 
-	return errs.ErrorOrNil()
+	return awsv1.SkipSweepError(err)
 }
diff --git a/internal/service/quicksight/tags_gen.go b/internal/service/quicksight/tags_gen.go
index 7547b0736ec..d66c2caf3f0 100644
--- a/internal/service/quicksight/tags_gen.go
+++ b/internal/service/quicksight/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/quicksight"
 	"github.com/aws/aws-sdk-go/service/quicksight/quicksightiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -102,6 +104,8 @@ func updateTags(ctx context.Context, conn quicksightiface.QuickSightAPI, identif
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.QuickSight)
 	if len(removedTags) > 0 {
diff --git a/internal/service/quicksight/template.go b/internal/service/quicksight/template.go
index 2e5227849d5..d10ab13a8a7 100644
--- a/internal/service/quicksight/template.go
+++ b/internal/service/quicksight/template.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package quicksight
 
 import (
@@ -42,80 +45,83 @@ func ResourceTemplate() *schema.Resource {
 			StateContext: schema.ImportStatePassthroughContext,
 		},
 
-		Schema: map[string]*schema.Schema{
-			"arn": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
-			"aws_account_id": {
-				Type:         schema.TypeString,
-				Optional:     true,
-				Computed:     true,
-				ForceNew:     true,
-				ValidateFunc: verify.ValidAccountID,
-			},
-			"created_time": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
-			"definition": quicksightschema.TemplateDefinitionSchema(),
-			"last_updated_time": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
-			"name": {
-				Type:         schema.TypeString,
-				Required:     true,
-				ValidateFunc: validation.StringLenBetween(1, 2048),
-			},
-			"permissions": {
-				Type:     schema.TypeList,
-				Optional: true,
-				MinItems: 1,
-				MaxItems: 64,
-				Elem: &schema.Resource{
-					Schema: map[string]*schema.Schema{
-						"actions": {
-							Type:     schema.TypeSet,
-							Required: true,
-							MinItems: 1,
-							MaxItems: 16,
-							Elem:     &schema.Schema{Type: schema.TypeString},
-						},
-						"principal": {
-							Type:         schema.TypeString,
-							Required:     true,
-							ValidateFunc: validation.StringLenBetween(1, 256),
+		SchemaFunc: func() map[string]*schema.Schema {
+			return map[string]*schema.Schema{
+				"arn": {
+					Type:     schema.TypeString,
+					Computed: true,
+				},
+				"aws_account_id": {
+					Type:         schema.TypeString,
+					Optional:     true,
+					Computed:     true,
+					ForceNew:     true,
+					ValidateFunc: verify.ValidAccountID,
+				},
+				"created_time": {
+					Type:     schema.TypeString,
+					Computed: true,
+				},
+				"definition": quicksightschema.TemplateDefinitionSchema(),
+				"last_updated_time": {
+					Type:     schema.TypeString,
+					Computed: true,
+				},
+				"name": {
+					Type:         schema.TypeString,
+					Required:     true,
+					ValidateFunc: validation.StringLenBetween(1, 2048),
+				},
+				"permissions": {
+					Type:     schema.TypeSet,
+					Optional: true,
+					MinItems: 1,
+					MaxItems: 64,
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"actions": {
+								Type:     schema.TypeSet,
+								Required: true,
+								MinItems: 1,
+								MaxItems: 16,
+								Elem:     &schema.Schema{Type: schema.TypeString},
+							},
+							"principal": {
+								Type:         schema.TypeString,
+								Required:     true,
+								ValidateFunc: validation.StringLenBetween(1, 256),
+							},
 						},
 					},
 				},
-			},
-			"source_entity": quicksightschema.TemplateSourceEntitySchema(),
-			"source_entity_arn": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
-			"status": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
-			names.AttrTags:    tftags.TagsSchema(),
-			names.AttrTagsAll: tftags.TagsSchemaComputed(),
-			"template_id": {
-				Type:     schema.TypeString,
-				Required: true,
-				ForceNew: true,
-			},
-			"version_description": {
-				Type:         schema.TypeString,
-				Required:     true,
-				ValidateFunc: validation.StringLenBetween(1, 512),
-			},
-			"version_number": {
-				Type:     schema.TypeInt,
-				Computed: true,
-			},
+				"source_entity": quicksightschema.TemplateSourceEntitySchema(),
+				"source_entity_arn": {
+					Type:     schema.TypeString,
+					Computed: true,
+				},
+				"status": {
+					Type:     schema.TypeString,
+					Computed: true,
+				},
+				names.AttrTags:    tftags.TagsSchema(),
+				names.AttrTagsAll: tftags.TagsSchemaComputed(),
+				"template_id": {
+					Type:     schema.TypeString,
+					Required: true,
+					ForceNew: true,
+				},
+				"version_description": {
+					Type:         schema.TypeString,
+					Required:     true,
+					ValidateFunc: validation.StringLenBetween(1, 512),
+				},
+				"version_number": {
+					Type:     schema.TypeInt,
+					Computed: true,
+				},
+			}
 		},
+
 		CustomizeDiff: verify.SetTagsDiff,
 	}
 }
@@ -154,8 +160,8 @@ func resourceTemplateCreate(ctx context.Context, d *schema.ResourceData, meta in
 		input.Definition = quicksightschema.ExpandTemplateDefinition(d.Get("definition").([]interface{}))
 	}
 
-	if v, ok := d.GetOk("permissions"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
-		input.Permissions = expandResourcePermissions(v.([]interface{}))
+	if v, ok := d.Get("permissions").(*schema.Set); ok && v.Len() > 0 {
+		input.Permissions = expandResourcePermissions(v.List())
 	}
 
 	_, err := conn.CreateTemplateWithContext(ctx, input)
@@ -267,10 +273,10 @@ func resourceTemplateUpdate(ctx context.Context, d *schema.ResourceData, meta in
 
 	if d.HasChange("permissions") {
 		oraw, nraw := d.GetChange("permissions")
-		o := oraw.([]interface{})
-		n := nraw.([]interface{})
+		o := oraw.(*schema.Set)
+		n := nraw.(*schema.Set)
 
-		toGrant, toRevoke := DiffPermissions(o, n)
+		toGrant, toRevoke := DiffPermissions(o.List(), n.List())
 
 		params := &quicksight.UpdateTemplatePermissionsInput{
 			AwsAccountId: aws.String(awsAccountId),
diff --git a/internal/service/quicksight/template_alias.go b/internal/service/quicksight/template_alias.go
index 8898b8f22c9..8c1ea40378d 100644
--- a/internal/service/quicksight/template_alias.go
+++ b/internal/service/quicksight/template_alias.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package quicksight
 
 import (
@@ -17,8 +20,8 @@ import (
 	"github.com/hashicorp/terraform-plugin-framework/types"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-provider-aws/internal/create"
-	"github.com/hashicorp/terraform-provider-aws/internal/flex"
 	"github.com/hashicorp/terraform-provider-aws/internal/framework"
+	"github.com/hashicorp/terraform-provider-aws/internal/framework/flex"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
diff --git a/internal/service/quicksight/template_alias_test.go b/internal/service/quicksight/template_alias_test.go
index 60a47a06b97..d165bf67c2b 100644
--- a/internal/service/quicksight/template_alias_test.go
+++ b/internal/service/quicksight/template_alias_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package quicksight_test
 
 import (
diff --git a/internal/service/quicksight/template_test.go b/internal/service/quicksight/template_test.go
index 4ad811311bc..eab4fb3d7cd 100644
--- a/internal/service/quicksight/template_test.go
+++ b/internal/service/quicksight/template_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package quicksight_test
 
 import (
@@ -611,6 +614,12 @@ resource "aws_quicksight_template" "test" {
               header_style {
                 background_color = "#99CCFF"
                 height           = 20
+                font_configuration {
+                  font_color = "#212121"
+                  font_size {
+                    relative = "LARGE"
+                  }
+                }
               }
             }
             sort_configuration {
diff --git a/internal/service/quicksight/theme.go b/internal/service/quicksight/theme.go
index a8c8ad9441e..a1364d1bc0b 100644
--- a/internal/service/quicksight/theme.go
+++ b/internal/service/quicksight/theme.go
@@ -1,13 +1,16 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package quicksight
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"strings"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/quicksight"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -43,118 +46,120 @@ func ResourceTheme() *schema.Resource {
 			Delete: schema.DefaultTimeout(5 * time.Minute),
 		},
 
-		Schema: map[string]*schema.Schema{
-			"arn": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
-			"aws_account_id": {
-				Type:         schema.TypeString,
-				Optional:     true,
-				Computed:     true,
-				ForceNew:     true,
-				ValidateFunc: verify.ValidAccountID,
-			},
-			"base_theme_id": {
-				Type:     schema.TypeString,
-				Required: true,
-			},
-			"configuration": { // https://docs.aws.amazon.com/quicksight/latest/APIReference/API_ThemeConfiguration.html
-				Type:     schema.TypeList,
-				MaxItems: 1,
-				Optional: true,
-				Elem: &schema.Resource{
-					Schema: map[string]*schema.Schema{
-						"data_color_palette": { // https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DataColorPalette.html
-							Type:     schema.TypeList,
-							MaxItems: 1,
-							Optional: true,
-							Elem: &schema.Resource{
-								Schema: map[string]*schema.Schema{
-									"colors": {
-										Type:     schema.TypeList,
-										Optional: true,
-										MinItems: 8, // Colors size needs to be in the range between 8 and 20
-										MaxItems: 20,
-										Elem: &schema.Schema{
-											Type:         schema.TypeString,
-											ValidateFunc: validation.StringMatch(regexp.MustCompile(`^#[A-F0-9]{6}$`), ""),
+		SchemaFunc: func() map[string]*schema.Schema {
+			return map[string]*schema.Schema{
+				"arn": {
+					Type:     schema.TypeString,
+					Computed: true,
+				},
+				"aws_account_id": {
+					Type:         schema.TypeString,
+					Optional:     true,
+					Computed:     true,
+					ForceNew:     true,
+					ValidateFunc: verify.ValidAccountID,
+				},
+				"base_theme_id": {
+					Type:     schema.TypeString,
+					Required: true,
+				},
+				"configuration": { // https://docs.aws.amazon.com/quicksight/latest/APIReference/API_ThemeConfiguration.html
+					Type:     schema.TypeList,
+					MaxItems: 1,
+					Optional: true,
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"data_color_palette": { // https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DataColorPalette.html
+								Type:     schema.TypeList,
+								MaxItems: 1,
+								Optional: true,
+								Elem: &schema.Resource{
+									Schema: map[string]*schema.Schema{
+										"colors": {
+											Type:     schema.TypeList,
+											Optional: true,
+											MinItems: 8, // Colors size needs to be in the range between 8 and 20
+											MaxItems: 20,
+											Elem: &schema.Schema{
+												Type:         schema.TypeString,
+												ValidateFunc: validation.StringMatch(regexache.MustCompile(`^#[0-9A-F]{6}$`), ""),
+											},
 										},
-									},
-									"empty_fill_color": {
-										Type:         schema.TypeString,
-										Optional:     true,
-										ValidateFunc: validation.StringMatch(regexp.MustCompile(`^#[A-F0-9]{6}$`), ""),
-									},
-									"min_max_gradient": {
-										Type:     schema.TypeList,
-										Optional: true,
-										MinItems: 2, // MinMaxGradient size needs to be 2
-										MaxItems: 2,
-										Elem: &schema.Schema{
+										"empty_fill_color": {
 											Type:         schema.TypeString,
-											ValidateFunc: validation.StringMatch(regexp.MustCompile(`^#[A-F0-9]{6}$`), ""),
+											Optional:     true,
+											ValidateFunc: validation.StringMatch(regexache.MustCompile(`^#[0-9A-F]{6}$`), ""),
+										},
+										"min_max_gradient": {
+											Type:     schema.TypeList,
+											Optional: true,
+											MinItems: 2, // MinMaxGradient size needs to be 2
+											MaxItems: 2,
+											Elem: &schema.Schema{
+												Type:         schema.TypeString,
+												ValidateFunc: validation.StringMatch(regexache.MustCompile(`^#[0-9A-F]{6}$`), ""),
+											},
 										},
 									},
 								},
 							},
-						},
-						"sheet": { // https://docs.aws.amazon.com/quicksight/latest/APIReference/API_SheetStyle.html
-							Type:     schema.TypeList,
-							MaxItems: 1,
-							Optional: true,
-							Elem: &schema.Resource{
-								Schema: map[string]*schema.Schema{
-									"tile": { // https://docs.aws.amazon.com/quicksight/latest/APIReference/API_TileStyle.html
-										Type:     schema.TypeList,
-										MaxItems: 1,
-										Optional: true,
-										Elem: &schema.Resource{
-											Schema: map[string]*schema.Schema{
-												"border": { // https://docs.aws.amazon.com/quicksight/latest/APIReference/API_BorderStyle.html
-													Type:     schema.TypeList,
-													MaxItems: 1,
-													Optional: true,
-													Elem: &schema.Resource{
-														Schema: map[string]*schema.Schema{
-															"show": {
-																Type:     schema.TypeBool,
-																Optional: true,
+							"sheet": { // https://docs.aws.amazon.com/quicksight/latest/APIReference/API_SheetStyle.html
+								Type:     schema.TypeList,
+								MaxItems: 1,
+								Optional: true,
+								Elem: &schema.Resource{
+									Schema: map[string]*schema.Schema{
+										"tile": { // https://docs.aws.amazon.com/quicksight/latest/APIReference/API_TileStyle.html
+											Type:     schema.TypeList,
+											MaxItems: 1,
+											Optional: true,
+											Elem: &schema.Resource{
+												Schema: map[string]*schema.Schema{
+													"border": { // https://docs.aws.amazon.com/quicksight/latest/APIReference/API_BorderStyle.html
+														Type:     schema.TypeList,
+														MaxItems: 1,
+														Optional: true,
+														Elem: &schema.Resource{
+															Schema: map[string]*schema.Schema{
+																"show": {
+																	Type:     schema.TypeBool,
+																	Optional: true,
+																},
 															},
 														},
 													},
 												},
 											},
 										},
-									},
-									"tile_layout": { // https://docs.aws.amazon.com/quicksight/latest/APIReference/API_TileLayoutStyle.html
-										Type:     schema.TypeList,
-										MaxItems: 1,
-										Optional: true,
-										Elem: &schema.Resource{
-											Schema: map[string]*schema.Schema{
-												"gutter": { // https://docs.aws.amazon.com/quicksight/latest/APIReference/API_GutterStyle.html
-													Type:     schema.TypeList,
-													MaxItems: 1,
-													Optional: true,
-													Elem: &schema.Resource{
-														Schema: map[string]*schema.Schema{
-															"show": {
-																Type:     schema.TypeBool,
-																Optional: true,
+										"tile_layout": { // https://docs.aws.amazon.com/quicksight/latest/APIReference/API_TileLayoutStyle.html
+											Type:     schema.TypeList,
+											MaxItems: 1,
+											Optional: true,
+											Elem: &schema.Resource{
+												Schema: map[string]*schema.Schema{
+													"gutter": { // https://docs.aws.amazon.com/quicksight/latest/APIReference/API_GutterStyle.html
+														Type:     schema.TypeList,
+														MaxItems: 1,
+														Optional: true,
+														Elem: &schema.Resource{
+															Schema: map[string]*schema.Schema{
+																"show": {
+																	Type:     schema.TypeBool,
+																	Optional: true,
+																},
 															},
 														},
 													},
-												},
-												"margin": { // https://docs.aws.amazon.com/quicksight/latest/APIReference/API_MarginStyle.html
-													Type:     schema.TypeList,
-													MaxItems: 1,
-													Optional: true,
-													Elem: &schema.Resource{
-														Schema: map[string]*schema.Schema{
-															"show": {
-																Type:     schema.TypeBool,
-																Optional: true,
+													"margin": { // https://docs.aws.amazon.com/quicksight/latest/APIReference/API_MarginStyle.html
+														Type:     schema.TypeList,
+														MaxItems: 1,
+														Optional: true,
+														Elem: &schema.Resource{
+															Schema: map[string]*schema.Schema{
+																"show": {
+																	Type:     schema.TypeBool,
+																	Optional: true,
+																},
 															},
 														},
 													},
@@ -164,177 +169,178 @@ func ResourceTheme() *schema.Resource {
 									},
 								},
 							},
-						},
-						"typography": { // https://docs.aws.amazon.com/quicksight/latest/APIReference/API_Typography.html
-							Type:     schema.TypeList,
-							MaxItems: 1,
-							Optional: true,
-							Elem: &schema.Resource{
-								Schema: map[string]*schema.Schema{
-									"font_families": { // https://docs.aws.amazon.com/quicksight/latest/APIReference/API_Font.html
-										Type:     schema.TypeList,
-										MaxItems: 5,
-										Optional: true,
-										Elem: &schema.Resource{
-											Schema: map[string]*schema.Schema{
-												"font_family": {
-													Type:     schema.TypeString,
-													Optional: true,
+							"typography": { // https://docs.aws.amazon.com/quicksight/latest/APIReference/API_Typography.html
+								Type:     schema.TypeList,
+								MaxItems: 1,
+								Optional: true,
+								Elem: &schema.Resource{
+									Schema: map[string]*schema.Schema{
+										"font_families": { // https://docs.aws.amazon.com/quicksight/latest/APIReference/API_Font.html
+											Type:     schema.TypeList,
+											MaxItems: 5,
+											Optional: true,
+											Elem: &schema.Resource{
+												Schema: map[string]*schema.Schema{
+													"font_family": {
+														Type:     schema.TypeString,
+														Optional: true,
+													},
 												},
 											},
 										},
 									},
 								},
 							},
-						},
-						"ui_color_palette": { // https://docs.aws.amazon.com/quicksight/latest/APIReference/API_UIColorPalette.html
-							Type:     schema.TypeList,
-							MaxItems: 1,
-							Optional: true,
-							Elem: &schema.Resource{
-								Schema: map[string]*schema.Schema{
-									"accent": {
-										Type:         schema.TypeString,
-										Optional:     true,
-										ValidateFunc: validation.StringMatch(regexp.MustCompile(`^#[A-F0-9]{6}$`), ""),
-									},
-									"accent_foreground": {
-										Type:         schema.TypeString,
-										Optional:     true,
-										ValidateFunc: validation.StringMatch(regexp.MustCompile(`^#[A-F0-9]{6}$`), ""),
-									},
-									"danger": {
-										Type:         schema.TypeString,
-										Optional:     true,
-										ValidateFunc: validation.StringMatch(regexp.MustCompile(`^#[A-F0-9]{6}$`), ""),
-									},
-									"danger_foreground": {
-										Type:         schema.TypeString,
-										Optional:     true,
-										ValidateFunc: validation.StringMatch(regexp.MustCompile(`^#[A-F0-9]{6}$`), ""),
-									},
-									"dimension": {
-										Type:         schema.TypeString,
-										Optional:     true,
-										ValidateFunc: validation.StringMatch(regexp.MustCompile(`^#[A-F0-9]{6}$`), ""),
-									},
-									"dimension_foreground": {
-										Type:         schema.TypeString,
-										Optional:     true,
-										ValidateFunc: validation.StringMatch(regexp.MustCompile(`^#[A-F0-9]{6}$`), ""),
-									},
-									"measure": {
-										Type:         schema.TypeString,
-										Optional:     true,
-										ValidateFunc: validation.StringMatch(regexp.MustCompile(`^#[A-F0-9]{6}$`), ""),
-									},
-									"measure_foreground": {
-										Type:         schema.TypeString,
-										Optional:     true,
-										ValidateFunc: validation.StringMatch(regexp.MustCompile(`^#[A-F0-9]{6}$`), ""),
-									},
-									"primary_background": {
-										Type:         schema.TypeString,
-										Optional:     true,
-										ValidateFunc: validation.StringMatch(regexp.MustCompile(`^#[A-F0-9]{6}$`), ""),
-									},
-									"primary_foreground": {
-										Type:         schema.TypeString,
-										Optional:     true,
-										ValidateFunc: validation.StringMatch(regexp.MustCompile(`^#[A-F0-9]{6}$`), ""),
-									},
-									"secondary_background": {
-										Type:         schema.TypeString,
-										Optional:     true,
-										ValidateFunc: validation.StringMatch(regexp.MustCompile(`^#[A-F0-9]{6}$`), ""),
-									},
-									"secondary_foreground": {
-										Type:         schema.TypeString,
-										Optional:     true,
-										ValidateFunc: validation.StringMatch(regexp.MustCompile(`^#[A-F0-9]{6}$`), ""),
-									},
-									"success": {
-										Type:         schema.TypeString,
-										Optional:     true,
-										ValidateFunc: validation.StringMatch(regexp.MustCompile(`^#[A-F0-9]{6}$`), ""),
-									},
-									"success_foreground": {
-										Type:         schema.TypeString,
-										Optional:     true,
-										ValidateFunc: validation.StringMatch(regexp.MustCompile(`^#[A-F0-9]{6}$`), ""),
-									},
-									"warning": {
-										Type:         schema.TypeString,
-										Optional:     true,
-										ValidateFunc: validation.StringMatch(regexp.MustCompile(`^#[A-F0-9]{6}$`), ""),
-									},
-									"warning_foreground": {
-										Type:         schema.TypeString,
-										Optional:     true,
-										ValidateFunc: validation.StringMatch(regexp.MustCompile(`^#[A-F0-9]{6}$`), ""),
+							"ui_color_palette": { // https://docs.aws.amazon.com/quicksight/latest/APIReference/API_UIColorPalette.html
+								Type:     schema.TypeList,
+								MaxItems: 1,
+								Optional: true,
+								Elem: &schema.Resource{
+									Schema: map[string]*schema.Schema{
+										"accent": {
+											Type:         schema.TypeString,
+											Optional:     true,
+											ValidateFunc: validation.StringMatch(regexache.MustCompile(`^#[0-9A-F]{6}$`), ""),
+										},
+										"accent_foreground": {
+											Type:         schema.TypeString,
+											Optional:     true,
+											ValidateFunc: validation.StringMatch(regexache.MustCompile(`^#[0-9A-F]{6}$`), ""),
+										},
+										"danger": {
+											Type:         schema.TypeString,
+											Optional:     true,
+											ValidateFunc: validation.StringMatch(regexache.MustCompile(`^#[0-9A-F]{6}$`), ""),
+										},
+										"danger_foreground": {
+											Type:         schema.TypeString,
+											Optional:     true,
+											ValidateFunc: validation.StringMatch(regexache.MustCompile(`^#[0-9A-F]{6}$`), ""),
+										},
+										"dimension": {
+											Type:         schema.TypeString,
+											Optional:     true,
+											ValidateFunc: validation.StringMatch(regexache.MustCompile(`^#[0-9A-F]{6}$`), ""),
+										},
+										"dimension_foreground": {
+											Type:         schema.TypeString,
+											Optional:     true,
+											ValidateFunc: validation.StringMatch(regexache.MustCompile(`^#[0-9A-F]{6}$`), ""),
+										},
+										"measure": {
+											Type:         schema.TypeString,
+											Optional:     true,
+											ValidateFunc: validation.StringMatch(regexache.MustCompile(`^#[0-9A-F]{6}$`), ""),
+										},
+										"measure_foreground": {
+											Type:         schema.TypeString,
+											Optional:     true,
+											ValidateFunc: validation.StringMatch(regexache.MustCompile(`^#[0-9A-F]{6}$`), ""),
+										},
+										"primary_background": {
+											Type:         schema.TypeString,
+											Optional:     true,
+											ValidateFunc: validation.StringMatch(regexache.MustCompile(`^#[0-9A-F]{6}$`), ""),
+										},
+										"primary_foreground": {
+											Type:         schema.TypeString,
+											Optional:     true,
+											ValidateFunc: validation.StringMatch(regexache.MustCompile(`^#[0-9A-F]{6}$`), ""),
+										},
+										"secondary_background": {
+											Type:         schema.TypeString,
+											Optional:     true,
+											ValidateFunc: validation.StringMatch(regexache.MustCompile(`^#[0-9A-F]{6}$`), ""),
+										},
+										"secondary_foreground": {
+											Type:         schema.TypeString,
+											Optional:     true,
+											ValidateFunc: validation.StringMatch(regexache.MustCompile(`^#[0-9A-F]{6}$`), ""),
+										},
+										"success": {
+											Type:         schema.TypeString,
+											Optional:     true,
+											ValidateFunc: validation.StringMatch(regexache.MustCompile(`^#[0-9A-F]{6}$`), ""),
+										},
+										"success_foreground": {
+											Type:         schema.TypeString,
+											Optional:     true,
+											ValidateFunc: validation.StringMatch(regexache.MustCompile(`^#[0-9A-F]{6}$`), ""),
+										},
+										"warning": {
+											Type:         schema.TypeString,
+											Optional:     true,
+											ValidateFunc: validation.StringMatch(regexache.MustCompile(`^#[0-9A-F]{6}$`), ""),
+										},
+										"warning_foreground": {
+											Type:         schema.TypeString,
+											Optional:     true,
+											ValidateFunc: validation.StringMatch(regexache.MustCompile(`^#[0-9A-F]{6}$`), ""),
+										},
 									},
 								},
 							},
 						},
 					},
 				},
-			},
-			"created_time": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
-			"theme_id": {
-				Type:     schema.TypeString,
-				Required: true,
-				ForceNew: true,
-			},
-			"last_updated_time": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
-			"name": {
-				Type:         schema.TypeString,
-				Required:     true,
-				ValidateFunc: validation.StringLenBetween(1, 2048),
-			},
-			"permissions": {
-				Type:     schema.TypeList,
-				Optional: true,
-				MinItems: 1,
-				MaxItems: 64,
-				Elem: &schema.Resource{
-					Schema: map[string]*schema.Schema{
-						"actions": {
-							Type:     schema.TypeSet,
-							Required: true,
-							MinItems: 1,
-							MaxItems: 16,
-							Elem:     &schema.Schema{Type: schema.TypeString},
-						},
-						"principal": {
-							Type:         schema.TypeString,
-							Required:     true,
-							ValidateFunc: validation.StringLenBetween(1, 256),
+				"created_time": {
+					Type:     schema.TypeString,
+					Computed: true,
+				},
+				"theme_id": {
+					Type:     schema.TypeString,
+					Required: true,
+					ForceNew: true,
+				},
+				"last_updated_time": {
+					Type:     schema.TypeString,
+					Computed: true,
+				},
+				"name": {
+					Type:         schema.TypeString,
+					Required:     true,
+					ValidateFunc: validation.StringLenBetween(1, 2048),
+				},
+				"permissions": {
+					Type:     schema.TypeList,
+					Optional: true,
+					MinItems: 1,
+					MaxItems: 64,
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"actions": {
+								Type:     schema.TypeSet,
+								Required: true,
+								MinItems: 1,
+								MaxItems: 16,
+								Elem:     &schema.Schema{Type: schema.TypeString},
+							},
+							"principal": {
+								Type:         schema.TypeString,
+								Required:     true,
+								ValidateFunc: validation.StringLenBetween(1, 256),
+							},
 						},
 					},
 				},
-			},
-			"status": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
-			names.AttrTags:    tftags.TagsSchema(),
-			names.AttrTagsAll: tftags.TagsSchemaComputed(),
-			"version_description": {
-				Type:         schema.TypeString,
-				Optional:     true,
-				ValidateFunc: validation.StringLenBetween(1, 512),
-			},
-			"version_number": {
-				Type:     schema.TypeInt,
-				Computed: true,
-			},
+				"status": {
+					Type:     schema.TypeString,
+					Computed: true,
+				},
+				names.AttrTags:    tftags.TagsSchema(),
+				names.AttrTagsAll: tftags.TagsSchemaComputed(),
+				"version_description": {
+					Type:         schema.TypeString,
+					Optional:     true,
+					ValidateFunc: validation.StringLenBetween(1, 512),
+				},
+				"version_number": {
+					Type:     schema.TypeInt,
+					Computed: true,
+				},
+			}
 		},
+
 		CustomizeDiff: verify.SetTagsDiff,
 	}
 }
diff --git a/internal/service/quicksight/theme_data_source.go b/internal/service/quicksight/theme_data_source.go
index b0f55c3bd6b..0f8028edef7 100644
--- a/internal/service/quicksight/theme_data_source.go
+++ b/internal/service/quicksight/theme_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package quicksight
 
 import (
@@ -20,102 +23,104 @@ func DataSourceTheme() *schema.Resource {
 	return &schema.Resource{
 		ReadWithoutTimeout: dataSourceThemeRead,
 
-		Schema: map[string]*schema.Schema{
-			"arn": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
-			"aws_account_id": {
-				Type:         schema.TypeString,
-				Optional:     true,
-				Computed:     true,
-				ValidateFunc: verify.ValidAccountID,
-			},
-			"base_theme_id": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
-			"configuration": { // https://docs.aws.amazon.com/quicksight/latest/APIReference/API_ThemeConfiguration.html
-				Type:     schema.TypeList,
-				Computed: true,
-				Elem: &schema.Resource{
-					Schema: map[string]*schema.Schema{
-						"data_color_palette": { // https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DataColorPalette.html
-							Type:     schema.TypeList,
-							Computed: true,
-							Elem: &schema.Resource{
-								Schema: map[string]*schema.Schema{
-									"colors": {
-										Type:     schema.TypeList,
-										Computed: true,
-										Elem: &schema.Schema{
-											Type: schema.TypeString,
+		SchemaFunc: func() map[string]*schema.Schema {
+			return map[string]*schema.Schema{
+				"arn": {
+					Type:     schema.TypeString,
+					Computed: true,
+				},
+				"aws_account_id": {
+					Type:         schema.TypeString,
+					Optional:     true,
+					Computed:     true,
+					ValidateFunc: verify.ValidAccountID,
+				},
+				"base_theme_id": {
+					Type:     schema.TypeString,
+					Computed: true,
+				},
+				"configuration": { // https://docs.aws.amazon.com/quicksight/latest/APIReference/API_ThemeConfiguration.html
+					Type:     schema.TypeList,
+					Computed: true,
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"data_color_palette": { // https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DataColorPalette.html
+								Type:     schema.TypeList,
+								Computed: true,
+								Elem: &schema.Resource{
+									Schema: map[string]*schema.Schema{
+										"colors": {
+											Type:     schema.TypeList,
+											Computed: true,
+											Elem: &schema.Schema{
+												Type: schema.TypeString,
+											},
 										},
-									},
-									"empty_fill_color": {
-										Type:     schema.TypeString,
-										Computed: true,
-									},
-									"min_max_gradient": {
-										Type:     schema.TypeList,
-										Computed: true,
-										Elem: &schema.Schema{
-											Type: schema.TypeString,
+										"empty_fill_color": {
+											Type:     schema.TypeString,
+											Computed: true,
+										},
+										"min_max_gradient": {
+											Type:     schema.TypeList,
+											Computed: true,
+											Elem: &schema.Schema{
+												Type: schema.TypeString,
+											},
 										},
 									},
 								},
 							},
-						},
-						"sheet": { // https://docs.aws.amazon.com/quicksight/latest/APIReference/API_SheetStyle.html
-							Type:     schema.TypeList,
-							Computed: true,
-							Elem: &schema.Resource{
-								Schema: map[string]*schema.Schema{
-									"tile": { // https://docs.aws.amazon.com/quicksight/latest/APIReference/API_TileStyle.html
-										Type:     schema.TypeList,
-										Computed: true,
-										Elem: &schema.Resource{
-											Schema: map[string]*schema.Schema{
-												"border": { // https://docs.aws.amazon.com/quicksight/latest/APIReference/API_BorderStyle.html
-													Type:     schema.TypeList,
-													Computed: true,
-													Elem: &schema.Resource{
-														Schema: map[string]*schema.Schema{
-															"show": {
-																Type:     schema.TypeBool,
-																Computed: true,
+							"sheet": { // https://docs.aws.amazon.com/quicksight/latest/APIReference/API_SheetStyle.html
+								Type:     schema.TypeList,
+								Computed: true,
+								Elem: &schema.Resource{
+									Schema: map[string]*schema.Schema{
+										"tile": { // https://docs.aws.amazon.com/quicksight/latest/APIReference/API_TileStyle.html
+											Type:     schema.TypeList,
+											Computed: true,
+											Elem: &schema.Resource{
+												Schema: map[string]*schema.Schema{
+													"border": { // https://docs.aws.amazon.com/quicksight/latest/APIReference/API_BorderStyle.html
+														Type:     schema.TypeList,
+														Computed: true,
+														Elem: &schema.Resource{
+															Schema: map[string]*schema.Schema{
+																"show": {
+																	Type:     schema.TypeBool,
+																	Computed: true,
+																},
 															},
 														},
 													},
 												},
 											},
 										},
-									},
-									"tile_layout": { // https://docs.aws.amazon.com/quicksight/latest/APIReference/API_TileLayoutStyle.html
-										Type:     schema.TypeList,
-										Computed: true,
-										Elem: &schema.Resource{
-											Schema: map[string]*schema.Schema{
-												"gutter": { // https://docs.aws.amazon.com/quicksight/latest/APIReference/API_GutterStyle.html
-													Type:     schema.TypeList,
-													Computed: true,
-													Elem: &schema.Resource{
-														Schema: map[string]*schema.Schema{
-															"show": {
-																Type:     schema.TypeBool,
-																Computed: true,
+										"tile_layout": { // https://docs.aws.amazon.com/quicksight/latest/APIReference/API_TileLayoutStyle.html
+											Type:     schema.TypeList,
+											Computed: true,
+											Elem: &schema.Resource{
+												Schema: map[string]*schema.Schema{
+													"gutter": { // https://docs.aws.amazon.com/quicksight/latest/APIReference/API_GutterStyle.html
+														Type:     schema.TypeList,
+														Computed: true,
+														Elem: &schema.Resource{
+															Schema: map[string]*schema.Schema{
+																"show": {
+																	Type:     schema.TypeBool,
+																	Computed: true,
+																},
 															},
 														},
 													},
-												},
-												"margin": { // https://docs.aws.amazon.com/quicksight/latest/APIReference/API_MarginStyle.html
-													Type:     schema.TypeList,
-													Computed: true,
-													Elem: &schema.Resource{
-														Schema: map[string]*schema.Schema{
-															"show": {
-																Type:     schema.TypeBool,
-																Computed: true,
+													"margin": { // https://docs.aws.amazon.com/quicksight/latest/APIReference/API_MarginStyle.html
+														Type:     schema.TypeList,
+														Computed: true,
+														Elem: &schema.Resource{
+															Schema: map[string]*schema.Schema{
+																"show": {
+																	Type:     schema.TypeBool,
+																	Computed: true,
+																},
 															},
 														},
 													},
@@ -125,148 +130,148 @@ func DataSourceTheme() *schema.Resource {
 									},
 								},
 							},
-						},
-						"typography": { // https://docs.aws.amazon.com/quicksight/latest/APIReference/API_Typography.html
-							Type:     schema.TypeList,
-							Computed: true,
-							Elem: &schema.Resource{
-								Schema: map[string]*schema.Schema{
-									"font_families": { // https://docs.aws.amazon.com/quicksight/latest/APIReference/API_Font.html
-										Type:     schema.TypeList,
-										Computed: true,
-										Elem: &schema.Resource{
-											Schema: map[string]*schema.Schema{
-												"font_family": {
-													Type:     schema.TypeString,
-													Computed: true,
+							"typography": { // https://docs.aws.amazon.com/quicksight/latest/APIReference/API_Typography.html
+								Type:     schema.TypeList,
+								Computed: true,
+								Elem: &schema.Resource{
+									Schema: map[string]*schema.Schema{
+										"font_families": { // https://docs.aws.amazon.com/quicksight/latest/APIReference/API_Font.html
+											Type:     schema.TypeList,
+											Computed: true,
+											Elem: &schema.Resource{
+												Schema: map[string]*schema.Schema{
+													"font_family": {
+														Type:     schema.TypeString,
+														Computed: true,
+													},
 												},
 											},
 										},
 									},
 								},
 							},
-						},
-						"ui_color_palette": { // https://docs.aws.amazon.com/quicksight/latest/APIReference/API_UIColorPalette.html
-							Type:     schema.TypeList,
-							Computed: true,
-							Elem: &schema.Resource{
-								Schema: map[string]*schema.Schema{
-									"accent": {
-										Type:     schema.TypeString,
-										Computed: true,
-									},
-									"accent_foreground": {
-										Type:     schema.TypeString,
-										Computed: true,
-									},
-									"danger": {
-										Type:     schema.TypeString,
-										Computed: true,
-									},
-									"danger_foreground": {
-										Type:     schema.TypeString,
-										Computed: true,
-									},
-									"dimension": {
-										Type:     schema.TypeString,
-										Computed: true,
-									},
-									"dimension_foreground": {
-										Type:     schema.TypeString,
-										Computed: true,
-									},
-									"measure": {
-										Type:     schema.TypeString,
-										Computed: true,
-									},
-									"measure_foreground": {
-										Type:     schema.TypeString,
-										Computed: true,
-									},
-									"primary_background": {
-										Type:     schema.TypeString,
-										Computed: true,
-									},
-									"primary_foreground": {
-										Type:     schema.TypeString,
-										Computed: true,
-									},
-									"secondary_background": {
-										Type:     schema.TypeString,
-										Computed: true,
-									},
-									"secondary_foreground": {
-										Type:     schema.TypeString,
-										Computed: true,
-									},
-									"success": {
-										Type:     schema.TypeString,
-										Computed: true,
-									},
-									"success_foreground": {
-										Type:     schema.TypeString,
-										Computed: true,
-									},
-									"warning": {
-										Type:     schema.TypeString,
-										Computed: true,
-									},
-									"warning_foreground": {
-										Type:     schema.TypeString,
-										Computed: true,
+							"ui_color_palette": { // https://docs.aws.amazon.com/quicksight/latest/APIReference/API_UIColorPalette.html
+								Type:     schema.TypeList,
+								Computed: true,
+								Elem: &schema.Resource{
+									Schema: map[string]*schema.Schema{
+										"accent": {
+											Type:     schema.TypeString,
+											Computed: true,
+										},
+										"accent_foreground": {
+											Type:     schema.TypeString,
+											Computed: true,
+										},
+										"danger": {
+											Type:     schema.TypeString,
+											Computed: true,
+										},
+										"danger_foreground": {
+											Type:     schema.TypeString,
+											Computed: true,
+										},
+										"dimension": {
+											Type:     schema.TypeString,
+											Computed: true,
+										},
+										"dimension_foreground": {
+											Type:     schema.TypeString,
+											Computed: true,
+										},
+										"measure": {
+											Type:     schema.TypeString,
+											Computed: true,
+										},
+										"measure_foreground": {
+											Type:     schema.TypeString,
+											Computed: true,
+										},
+										"primary_background": {
+											Type:     schema.TypeString,
+											Computed: true,
+										},
+										"primary_foreground": {
+											Type:     schema.TypeString,
+											Computed: true,
+										},
+										"secondary_background": {
+											Type:     schema.TypeString,
+											Computed: true,
+										},
+										"secondary_foreground": {
+											Type:     schema.TypeString,
+											Computed: true,
+										},
+										"success": {
+											Type:     schema.TypeString,
+											Computed: true,
+										},
+										"success_foreground": {
+											Type:     schema.TypeString,
+											Computed: true,
+										},
+										"warning": {
+											Type:     schema.TypeString,
+											Computed: true,
+										},
+										"warning_foreground": {
+											Type:     schema.TypeString,
+											Computed: true,
+										},
 									},
 								},
 							},
 						},
 					},
 				},
-			},
-			"created_time": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
-			"theme_id": {
-				Type:     schema.TypeString,
-				Required: true,
-			},
-			"last_updated_time": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
-			"name": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
-			"permissions": {
-				Type:     schema.TypeList,
-				Computed: true,
-				Elem: &schema.Resource{
-					Schema: map[string]*schema.Schema{
-						"actions": {
-							Type:     schema.TypeSet,
-							Computed: true,
-							Elem:     &schema.Schema{Type: schema.TypeString},
-						},
-						"principal": {
-							Type:     schema.TypeString,
-							Computed: true,
+				"created_time": {
+					Type:     schema.TypeString,
+					Computed: true,
+				},
+				"theme_id": {
+					Type:     schema.TypeString,
+					Required: true,
+				},
+				"last_updated_time": {
+					Type:     schema.TypeString,
+					Computed: true,
+				},
+				"name": {
+					Type:     schema.TypeString,
+					Computed: true,
+				},
+				"permissions": {
+					Type:     schema.TypeList,
+					Computed: true,
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"actions": {
+								Type:     schema.TypeSet,
+								Computed: true,
+								Elem:     &schema.Schema{Type: schema.TypeString},
+							},
+							"principal": {
+								Type:     schema.TypeString,
+								Computed: true,
+							},
 						},
 					},
 				},
-			},
-			"status": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
-			names.AttrTags: tftags.TagsSchemaComputed(),
-			"version_description": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
-			"version_number": {
-				Type:     schema.TypeInt,
-				Computed: true,
-			},
+				"status": {
+					Type:     schema.TypeString,
+					Computed: true,
+				},
+				names.AttrTags: tftags.TagsSchemaComputed(),
+				"version_description": {
+					Type:     schema.TypeString,
+					Computed: true,
+				},
+				"version_number": {
+					Type:     schema.TypeInt,
+					Computed: true,
+				},
+			}
 		},
 	}
 }
diff --git a/internal/service/quicksight/theme_data_source_test.go b/internal/service/quicksight/theme_data_source_test.go
index d346f7d1a58..fbc4a805703 100644
--- a/internal/service/quicksight/theme_data_source_test.go
+++ b/internal/service/quicksight/theme_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package quicksight_test
 
 import (
diff --git a/internal/service/quicksight/theme_test.go b/internal/service/quicksight/theme_test.go
index 969764ab7bc..e3057c61932 100644
--- a/internal/service/quicksight/theme_test.go
+++ b/internal/service/quicksight/theme_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package quicksight_test
 
 import (
diff --git a/internal/service/quicksight/user.go b/internal/service/quicksight/user.go
index de7078030da..4b62682f14d 100644
--- a/internal/service/quicksight/user.go
+++ b/internal/service/quicksight/user.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package quicksight
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"strings"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/quicksight"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -29,74 +32,76 @@ func ResourceUser() *schema.Resource {
 		UpdateWithoutTimeout: resourceUserUpdate,
 		DeleteWithoutTimeout: resourceUserDelete,
 
-		Schema: map[string]*schema.Schema{
-			"arn": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
-
-			"aws_account_id": {
-				Type:     schema.TypeString,
-				Optional: true,
-				Computed: true,
-				ForceNew: true,
-			},
-
-			"email": {
-				Type:     schema.TypeString,
-				Required: true,
-				ForceNew: true,
-			},
-
-			"iam_arn": {
-				Type:     schema.TypeString,
-				Optional: true,
-				ForceNew: true,
-			},
-
-			"identity_type": {
-				Type:     schema.TypeString,
-				Required: true,
-				ForceNew: true,
-				ValidateFunc: validation.StringInSlice([]string{
-					quicksight.IdentityTypeIam,
-					quicksight.IdentityTypeQuicksight,
-				}, false),
-			},
-
-			"namespace": {
-				Type:     schema.TypeString,
-				Optional: true,
-				ForceNew: true,
-				Default:  DefaultUserNamespace,
-				ValidateFunc: validation.All(
-					validation.StringLenBetween(1, 63),
-					validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9._-]*$`), "must contain only alphanumeric characters, hyphens, underscores, and periods"),
-				),
-			},
-
-			"session_name": {
-				Type:     schema.TypeString,
-				Optional: true,
-				ForceNew: true,
-			},
-
-			"user_name": {
-				Type:         schema.TypeString,
-				Optional:     true,
-				ValidateFunc: validation.NoZeroValues,
-			},
-
-			"user_role": {
-				Type:     schema.TypeString,
-				Required: true,
-				ForceNew: true,
-				ValidateFunc: validation.StringInSlice([]string{
-					quicksight.UserRoleReader,
-					quicksight.UserRoleAuthor,
-					quicksight.UserRoleAdmin,
-				}, false),
-			},
+		SchemaFunc: func() map[string]*schema.Schema {
+			return map[string]*schema.Schema{
+				"arn": {
+					Type:     schema.TypeString,
+					Computed: true,
+				},
+
+				"aws_account_id": {
+					Type:     schema.TypeString,
+					Optional: true,
+					Computed: true,
+					ForceNew: true,
+				},
+
+				"email": {
+					Type:     schema.TypeString,
+					Required: true,
+					ForceNew: true,
+				},
+
+				"iam_arn": {
+					Type:     schema.TypeString,
+					Optional: true,
+					ForceNew: true,
+				},
+
+				"identity_type": {
+					Type:     schema.TypeString,
+					Required: true,
+					ForceNew: true,
+					ValidateFunc: validation.StringInSlice([]string{
+						quicksight.IdentityTypeIam,
+						quicksight.IdentityTypeQuicksight,
+					}, false),
+				},
+
+				"namespace": {
+					Type:     schema.TypeString,
+					Optional: true,
+					ForceNew: true,
+					Default:  DefaultUserNamespace,
+					ValidateFunc: validation.All(
+						validation.StringLenBetween(1, 63),
+						validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_.-]*$`), "must contain only alphanumeric characters, hyphens, underscores, and periods"),
+					),
+				},
+
+				"session_name": {
+					Type:     schema.TypeString,
+					Optional: true,
+					ForceNew: true,
+				},
+
+				"user_name": {
+					Type:         schema.TypeString,
+					Optional:     true,
+					ValidateFunc: validation.NoZeroValues,
+				},
+
+				"user_role": {
+					Type:     schema.TypeString,
+					Required: true,
+					ForceNew: true,
+					ValidateFunc: validation.StringInSlice([]string{
+						quicksight.UserRoleReader,
+						quicksight.UserRoleAuthor,
+						quicksight.UserRoleAdmin,
+					}, false),
+				},
+			}
 		},
 	}
 }
diff --git a/internal/service/quicksight/user_data_source.go b/internal/service/quicksight/user_data_source.go
index 5e987f74fc9..f5e0fe98e57 100644
--- a/internal/service/quicksight/user_data_source.go
+++ b/internal/service/quicksight/user_data_source.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package quicksight
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/quicksight"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
@@ -20,49 +23,51 @@ func DataSourceUser() *schema.Resource {
 	return &schema.Resource{
 		ReadWithoutTimeout: dataSourceUserRead,
 
-		Schema: map[string]*schema.Schema{
-			"active": {
-				Type:     schema.TypeBool,
-				Computed: true,
-			},
-			"arn": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
-			"aws_account_id": {
-				Type:     schema.TypeString,
-				Optional: true,
-				Computed: true,
-			},
-			"email": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
-			"identity_type": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
-			"namespace": {
-				Type:     schema.TypeString,
-				Optional: true,
-				Default:  DefaultUserNamespace,
-				ValidateFunc: validation.All(
-					validation.StringLenBetween(1, 63),
-					validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9._-]*$`), "must contain only alphanumeric characters, hyphens, underscores, and periods"),
-				),
-			},
-			"principal_id": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
-			"user_name": {
-				Type:     schema.TypeString,
-				Required: true,
-			},
-			"user_role": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
+		SchemaFunc: func() map[string]*schema.Schema {
+			return map[string]*schema.Schema{
+				"active": {
+					Type:     schema.TypeBool,
+					Computed: true,
+				},
+				"arn": {
+					Type:     schema.TypeString,
+					Computed: true,
+				},
+				"aws_account_id": {
+					Type:     schema.TypeString,
+					Optional: true,
+					Computed: true,
+				},
+				"email": {
+					Type:     schema.TypeString,
+					Computed: true,
+				},
+				"identity_type": {
+					Type:     schema.TypeString,
+					Computed: true,
+				},
+				"namespace": {
+					Type:     schema.TypeString,
+					Optional: true,
+					Default:  DefaultUserNamespace,
+					ValidateFunc: validation.All(
+						validation.StringLenBetween(1, 63),
+						validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_.-]*$`), "must contain only alphanumeric characters, hyphens, underscores, and periods"),
+					),
+				},
+				"principal_id": {
+					Type:     schema.TypeString,
+					Computed: true,
+				},
+				"user_name": {
+					Type:     schema.TypeString,
+					Required: true,
+				},
+				"user_role": {
+					Type:     schema.TypeString,
+					Computed: true,
+				},
+			}
 		},
 	}
 }
diff --git a/internal/service/quicksight/user_data_source_test.go b/internal/service/quicksight/user_data_source_test.go
index 322b929d7c3..9e180d14f31 100644
--- a/internal/service/quicksight/user_data_source_test.go
+++ b/internal/service/quicksight/user_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package quicksight_test
 
 import (
diff --git a/internal/service/quicksight/user_test.go b/internal/service/quicksight/user_test.go
index 84cb85ecdb6..4b7f9faf521 100644
--- a/internal/service/quicksight/user_test.go
+++ b/internal/service/quicksight/user_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package quicksight_test
 
 import (
diff --git a/internal/service/quicksight/vpc_connection.go b/internal/service/quicksight/vpc_connection.go
index 8e77c379b75..6009a572b93 100644
--- a/internal/service/quicksight/vpc_connection.go
+++ b/internal/service/quicksight/vpc_connection.go
@@ -1,13 +1,16 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package quicksight
 
 import (
 	"context"
 	"errors"
 	"fmt"
-	"regexp"
 	"strings"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/quicksight"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -23,8 +26,8 @@ import (
 	"github.com/hashicorp/terraform-plugin-framework/types"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-provider-aws/internal/create"
-	"github.com/hashicorp/terraform-provider-aws/internal/flex"
 	"github.com/hashicorp/terraform-provider-aws/internal/framework"
+	"github.com/hashicorp/terraform-provider-aws/internal/framework/flex"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -78,7 +81,7 @@ func (r *resourceVPCConnection) Schema(ctx context.Context, req resource.SchemaR
 				Validators: []validator.String{
 					stringvalidator.All(
 						stringvalidator.LengthAtMost(1000),
-						stringvalidator.RegexMatches(regexp.MustCompile(vpcConnectionIdRegex), "VPC Connection ID must match regex: "+vpcConnectionIdRegex),
+						stringvalidator.RegexMatches(regexache.MustCompile(vpcConnectionIdRegex), "VPC Connection ID must match regex: "+vpcConnectionIdRegex),
 					),
 				},
 			},
@@ -102,7 +105,7 @@ func (r *resourceVPCConnection) Schema(ctx context.Context, req resource.SchemaR
 					setvalidator.ValueStringsAre(
 						stringvalidator.All(
 							stringvalidator.LengthAtMost(255),
-							stringvalidator.RegexMatches(regexp.MustCompile(securityGroupIdRegex), "Security group ID must match regex: "+securityGroupIdRegex),
+							stringvalidator.RegexMatches(regexache.MustCompile(securityGroupIdRegex), "Security group ID must match regex: "+securityGroupIdRegex),
 						),
 					),
 				},
@@ -115,7 +118,7 @@ func (r *resourceVPCConnection) Schema(ctx context.Context, req resource.SchemaR
 					setvalidator.ValueStringsAre(
 						stringvalidator.All(
 							stringvalidator.LengthAtMost(255),
-							stringvalidator.RegexMatches(regexp.MustCompile(subnetIdRegex), "Subnet ID must match regex: "+subnetIdRegex),
+							stringvalidator.RegexMatches(regexache.MustCompile(subnetIdRegex), "Subnet ID must match regex: "+subnetIdRegex),
 						),
 					),
 				},
diff --git a/internal/service/quicksight/vpc_connection_test.go b/internal/service/quicksight/vpc_connection_test.go
index 741e41cf618..0bb22329dbc 100644
--- a/internal/service/quicksight/vpc_connection_test.go
+++ b/internal/service/quicksight/vpc_connection_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package quicksight_test
 
 import (
diff --git a/internal/service/quicksight/wait.go b/internal/service/quicksight/wait.go
index 752a03a9ef6..3153dfc176e 100644
--- a/internal/service/quicksight/wait.go
+++ b/internal/service/quicksight/wait.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package quicksight
 
 import (
diff --git a/internal/service/ram/find.go b/internal/service/ram/find.go
index 5e25f9094cc..11ec170a13f 100644
--- a/internal/service/ram/find.go
+++ b/internal/service/ram/find.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ram
 
 import (
@@ -6,7 +9,6 @@ import (
 
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ram"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
@@ -16,28 +18,6 @@ const (
 	FindResourceShareTimeout = 1 * time.Minute
 )
 
-// FindResourceShareOwnerOtherAccountsByARN returns the resource share owned by other accounts corresponding to the specified ARN.
-// Returns nil if no configuration is found.
-func FindResourceShareOwnerOtherAccountsByARN(ctx context.Context, conn *ram.RAM, arn string) (*ram.ResourceShare, error) {
-	listResourceSharesInput := &ram.GetResourceSharesInput{
-		ResourceOwner:     aws.String(ram.ResourceOwnerOtherAccounts),
-		ResourceShareArns: aws.StringSlice([]string{arn}),
-	}
-
-	return resourceShare(ctx, conn, listResourceSharesInput)
-}
-
-// FindResourceShareOwnerSelfByARN returns the resource share owned by own account corresponding to the specified ARN.
-// Returns nil if no configuration is found.
-func FindResourceShareOwnerSelfByARN(ctx context.Context, conn *ram.RAM, arn string) (*ram.ResourceShare, error) {
-	listResourceSharesInput := &ram.GetResourceSharesInput{
-		ResourceOwner:     aws.String(ram.ResourceOwnerSelf),
-		ResourceShareArns: aws.StringSlice([]string{arn}),
-	}
-
-	return resourceShare(ctx, conn, listResourceSharesInput)
-}
-
 // FindResourceShareInvitationByResourceShareARNAndStatus returns the resource share invitation corresponding to the specified resource share ARN.
 // Returns nil if no configuration is found.
 func FindResourceShareInvitationByResourceShareARNAndStatus(ctx context.Context, conn *ram.RAM, resourceShareArn, status string) (*ram.ResourceShareInvitation, error) {
@@ -110,44 +90,6 @@ func FindResourceShareInvitationByARN(ctx context.Context, conn *ram.RAM, arn st
 	return invitation, nil
 }
 
-func resourceShare(ctx context.Context, conn *ram.RAM, input *ram.GetResourceSharesInput) (*ram.ResourceShare, error) {
-	var shares *ram.GetResourceSharesOutput
-
-	// Retry for Ram resource share eventual consistency
-	err := retry.RetryContext(ctx, FindResourceShareTimeout, func() *retry.RetryError {
-		ss, err := conn.GetResourceSharesWithContext(ctx, input)
-		shares = ss
-
-		if tfawserr.ErrCodeEquals(err, ram.ErrCodeUnknownResourceException) {
-			return retry.RetryableError(err)
-		}
-
-		if err != nil {
-			return retry.NonRetryableError(err)
-		}
-
-		if len(shares.ResourceShares) == 0 {
-			return retry.RetryableError(&retry.NotFoundError{})
-		}
-
-		return nil
-	})
-
-	if tfresource.TimedOut(err) {
-		shares, err = conn.GetResourceSharesWithContext(ctx, input)
-	}
-
-	if err != nil {
-		return nil, err
-	}
-
-	if shares == nil || len(shares.ResourceShares) == 0 {
-		return nil, nil
-	}
-
-	return shares.ResourceShares[0], nil
-}
-
 func resourceShareInvitationByResourceShareARNAndStatus(ctx context.Context, conn *ram.RAM, resourceShareArn, status string) (*ram.ResourceShareInvitation, error) {
 	var invitation *ram.ResourceShareInvitation
 
diff --git a/internal/service/ram/generate.go b/internal/service/ram/generate.go
index 8ffb8ca2d35..fbcb43cbd23 100644
--- a/internal/service/ram/generate.go
+++ b/internal/service/ram/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTagsInIDElem=ResourceShareArn -ServiceTagsSlice -TagInIDElem=ResourceShareArn -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/ram/principal_association.go b/internal/service/ram/principal_association.go
index aa8539c7886..c19c8b68713 100644
--- a/internal/service/ram/principal_association.go
+++ b/internal/service/ram/principal_association.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ram
 
 import (
diff --git a/internal/service/ram/principal_association_test.go b/internal/service/ram/principal_association_test.go
index 75f089fad43..3db88d0f02e 100644
--- a/internal/service/ram/principal_association_test.go
+++ b/internal/service/ram/principal_association_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ram_test
 
 import (
diff --git a/internal/service/ram/resource_association.go b/internal/service/ram/resource_association.go
index e9427ee8a44..7a69c40ae59 100644
--- a/internal/service/ram/resource_association.go
+++ b/internal/service/ram/resource_association.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ram
 
 import (
diff --git a/internal/service/ram/resource_association_test.go b/internal/service/ram/resource_association_test.go
index 8ae2226d9b5..43cce6f03c6 100644
--- a/internal/service/ram/resource_association_test.go
+++ b/internal/service/ram/resource_association_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ram_test
 
 import (
diff --git a/internal/service/ram/resource_share.go b/internal/service/ram/resource_share.go
index aef21a21122..53fab1f4657 100644
--- a/internal/service/ram/resource_share.go
+++ b/internal/service/ram/resource_share.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ram
 
 import (
@@ -9,11 +12,14 @@ import (
 	"github.com/aws/aws-sdk-go/service/ram"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
 	"github.com/hashicorp/terraform-provider-aws/internal/flex"
+	tfslices "github.com/hashicorp/terraform-provider-aws/internal/slices"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -83,7 +89,6 @@ func resourceResourceShareCreate(ctx context.Context, d *schema.ResourceData, me
 		input.PermissionArns = flex.ExpandStringSet(v.(*schema.Set))
 	}
 
-	log.Printf("[DEBUG] Creating RAM Resource Share: %s", input)
 	output, err := conn.CreateResourceShareWithContext(ctx, input)
 
 	if err != nil {
@@ -92,8 +97,16 @@ func resourceResourceShareCreate(ctx context.Context, d *schema.ResourceData, me
 
 	d.SetId(aws.StringValue(output.ResourceShare.ResourceShareArn))
 
-	if _, err = WaitResourceShareOwnedBySelfActive(ctx, conn, d.Id(), d.Timeout(schema.TimeoutCreate)); err != nil {
-		return sdkdiag.AppendErrorf(diags, "waiting for RAM Resource Share (%s) to become ready: %s", d.Id(), err)
+	_, err = tfresource.RetryWhenNotFound(ctx, FindResourceShareTimeout, func() (interface{}, error) {
+		return FindResourceShareOwnerSelfByARN(ctx, conn, d.Id())
+	})
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "waiting for RAM Resource Share (%s) create: %s", d.Id(), err)
+	}
+
+	if _, err := waitResourceShareOwnedBySelfActive(ctx, conn, d.Id(), d.Timeout(schema.TimeoutCreate)); err != nil {
+		return sdkdiag.AppendErrorf(diags, "waiting for RAM Resource Share (%s) create: %s", d.Id(), err)
 	}
 
 	return append(diags, resourceResourceShareRead(ctx, d, meta)...)
@@ -105,7 +118,7 @@ func resourceResourceShareRead(ctx context.Context, d *schema.ResourceData, meta
 
 	resourceShare, err := FindResourceShareOwnerSelfByARN(ctx, conn, d.Id())
 
-	if !d.IsNewResource() && tfawserr.ErrCodeEquals(err, ram.ErrCodeUnknownResourceException) {
+	if !d.IsNewResource() && tfresource.NotFound(err) {
 		log.Printf("[WARN] RAM Resource Share (%s) not found, removing from state", d.Id())
 		d.SetId("")
 		return diags
@@ -115,33 +128,39 @@ func resourceResourceShareRead(ctx context.Context, d *schema.ResourceData, meta
 		return sdkdiag.AppendErrorf(diags, "reading RAM Resource Share (%s): %s", d.Id(), err)
 	}
 
-	if !d.IsNewResource() && aws.StringValue(resourceShare.Status) != ram.ResourceShareStatusActive {
-		log.Printf("[WARN] RAM Resource Share (%s) not active, removing from state", d.Id())
-		d.SetId("")
-		return diags
-	}
-
 	d.Set("allow_external_principals", resourceShare.AllowExternalPrincipals)
 	d.Set("arn", resourceShare.ResourceShareArn)
 	d.Set("name", resourceShare.Name)
 
 	setTagsOut(ctx, resourceShare.Tags)
 
-	perms, err := conn.ListResourceSharePermissionsWithContext(ctx, &ram.ListResourceSharePermissionsInput{
+	input := &ram.ListResourceSharePermissionsInput{
 		ResourceShareArn: aws.String(d.Id()),
-	})
-
-	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "listing RAM Resource Share (%s) permissions: %s", d.Id(), err)
 	}
+	var permissions []*ram.ResourceSharePermissionSummary
 
-	permissionARNs := make([]*string, 0, len(perms.Permissions))
+	err = conn.ListResourceSharePermissionsPagesWithContext(ctx, input, func(page *ram.ListResourceSharePermissionsOutput, lastPage bool) bool {
+		if page == nil {
+			return !lastPage
+		}
 
-	for _, v := range perms.Permissions {
-		permissionARNs = append(permissionARNs, v.Arn)
+		for _, v := range page.Permissions {
+			if v != nil {
+				permissions = append(permissions, v)
+			}
+		}
+
+		return !lastPage
+	})
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "reading RAM Resource Share (%s) permissions: %s", d.Id(), err)
 	}
 
-	d.Set("permission_arns", aws.StringValueSlice(permissionARNs))
+	permissionARNs := tfslices.ApplyToAll(permissions, func(r *ram.ResourceSharePermissionSummary) string {
+		return aws.StringValue(r.Arn)
+	})
+	d.Set("permission_arns", permissionARNs)
 
 	return diags
 }
@@ -150,14 +169,13 @@ func resourceResourceShareUpdate(ctx context.Context, d *schema.ResourceData, me
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).RAMConn(ctx)
 
-	if d.HasChanges("name", "allow_external_principals") {
+	if d.HasChanges("allow_external_principals", "name") {
 		input := &ram.UpdateResourceShareInput{
 			AllowExternalPrincipals: aws.Bool(d.Get("allow_external_principals").(bool)),
 			Name:                    aws.String(d.Get("name").(string)),
 			ResourceShareArn:        aws.String(d.Id()),
 		}
 
-		log.Printf("[DEBUG] Updating RAM Resource Share: %s", input)
 		_, err := conn.UpdateResourceShareWithContext(ctx, input)
 
 		if err != nil {
@@ -185,9 +203,121 @@ func resourceResourceShareDelete(ctx context.Context, d *schema.ResourceData, me
 		return sdkdiag.AppendErrorf(diags, "deleting RAM Resource Share (%s): %s", d.Id(), err)
 	}
 
-	if _, err = WaitResourceShareOwnedBySelfDeleted(ctx, conn, d.Id(), d.Timeout(schema.TimeoutDelete)); err != nil {
+	if _, err := waitResourceShareOwnedBySelfDeleted(ctx, conn, d.Id(), d.Timeout(schema.TimeoutDelete)); err != nil {
 		return sdkdiag.AppendErrorf(diags, "waiting for RAM Resource Share (%s) delete: %s", d.Id(), err)
 	}
 
 	return diags
 }
+
+func FindResourceShareOwnerSelfByARN(ctx context.Context, conn *ram.RAM, arn string) (*ram.ResourceShare, error) {
+	input := &ram.GetResourceSharesInput{
+		ResourceOwner:     aws.String(ram.ResourceOwnerSelf),
+		ResourceShareArns: aws.StringSlice([]string{arn}),
+	}
+	output, err := findResourceShare(ctx, conn, input)
+
+	if err != nil {
+		return nil, err
+	}
+
+	if status := aws.StringValue(output.Status); status == ram.ResourceShareStatusDeleted {
+		return nil, &retry.NotFoundError{
+			Message:     status,
+			LastRequest: input,
+		}
+	}
+
+	return output, nil
+}
+
+func findResourceShare(ctx context.Context, conn *ram.RAM, input *ram.GetResourceSharesInput) (*ram.ResourceShare, error) {
+	output, err := findResourceShares(ctx, conn, input)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return tfresource.AssertSinglePtrResult(output)
+}
+
+func findResourceShares(ctx context.Context, conn *ram.RAM, input *ram.GetResourceSharesInput) ([]*ram.ResourceShare, error) {
+	var output []*ram.ResourceShare
+
+	err := conn.GetResourceSharesPagesWithContext(ctx, input, func(page *ram.GetResourceSharesOutput, lastPage bool) bool {
+		if page == nil {
+			return !lastPage
+		}
+
+		for _, v := range page.ResourceShares {
+			if v != nil {
+				output = append(output, v)
+			}
+		}
+
+		return !lastPage
+	})
+
+	if tfawserr.ErrCodeEquals(err, ram.ErrCodeResourceArnNotFoundException, ram.ErrCodeUnknownResourceException) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	return output, nil
+}
+
+func statusResourceShareOwnerSelf(ctx context.Context, conn *ram.RAM, arn string) retry.StateRefreshFunc {
+	return func() (interface{}, string, error) {
+		output, err := FindResourceShareOwnerSelfByARN(ctx, conn, arn)
+
+		if tfresource.NotFound(err) {
+			return nil, "", nil
+		}
+
+		if err != nil {
+			return nil, "", err
+		}
+
+		return output, aws.StringValue(output.Status), nil
+	}
+}
+
+func waitResourceShareOwnedBySelfActive(ctx context.Context, conn *ram.RAM, arn string, timeout time.Duration) (*ram.ResourceShare, error) {
+	stateConf := &retry.StateChangeConf{
+		Pending: []string{ram.ResourceShareStatusPending},
+		Target:  []string{ram.ResourceShareStatusActive},
+		Refresh: statusResourceShareOwnerSelf(ctx, conn, arn),
+		Timeout: timeout,
+	}
+
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+
+	if v, ok := outputRaw.(*ram.ResourceShare); ok {
+		return v, err
+	}
+
+	return nil, err
+}
+
+func waitResourceShareOwnedBySelfDeleted(ctx context.Context, conn *ram.RAM, arn string, timeout time.Duration) (*ram.ResourceShare, error) {
+	stateConf := &retry.StateChangeConf{
+		Pending: []string{ram.ResourceShareStatusDeleting},
+		Target:  []string{},
+		Refresh: statusResourceShareOwnerSelf(ctx, conn, arn),
+		Timeout: timeout,
+	}
+
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+
+	if v, ok := outputRaw.(*ram.ResourceShare); ok {
+		return v, err
+	}
+
+	return nil, err
+}
diff --git a/internal/service/ram/resource_share_accepter.go b/internal/service/ram/resource_share_accepter.go
index 888e29ecffe..3e968169179 100644
--- a/internal/service/ram/resource_share_accepter.go
+++ b/internal/service/ram/resource_share_accepter.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ram
 
 import (
@@ -14,7 +17,8 @@ import (
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
-	"github.com/hashicorp/terraform-provider-aws/internal/flex"
+	tfslices "github.com/hashicorp/terraform-provider-aws/internal/slices"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
 )
 
@@ -35,49 +39,42 @@ func ResourceResourceShareAccepter() *schema.Resource {
 		},
 
 		Schema: map[string]*schema.Schema{
-			"share_arn": {
-				Type:         schema.TypeString,
-				Required:     true,
-				ForceNew:     true,
-				ValidateFunc: verify.ValidARN,
-			},
-
 			"invitation_arn": {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
-
-			"share_id": {
+			"receiver_account_id": {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
-
-			"status": {
-				Type:     schema.TypeString,
+			"resources": {
+				Type:     schema.TypeList,
 				Computed: true,
+				Elem: &schema.Schema{
+					Type: schema.TypeString,
+				},
 			},
-
-			"receiver_account_id": {
+			"share_name": {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
-
 			"sender_account_id": {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
-
-			"share_name": {
+			"share_arn": {
+				Type:         schema.TypeString,
+				Required:     true,
+				ForceNew:     true,
+				ValidateFunc: verify.ValidARN,
+			},
+			"share_id": {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
-
-			"resources": {
-				Type:     schema.TypeList,
+			"status": {
+				Type:     schema.TypeString,
 				Computed: true,
-				Elem: &schema.Schema{
-					Type: schema.TypeString,
-				},
 			},
 		},
 	}
@@ -145,50 +142,39 @@ func resourceResourceShareAccepterRead(ctx context.Context, d *schema.ResourceDa
 		d.Set("receiver_account_id", accountID)
 	}
 
-	resourceShare, err := FindResourceShareOwnerOtherAccountsByARN(ctx, conn, d.Id())
+	resourceShare, err := findResourceShareOwnerOtherAccountsByARN(ctx, conn, d.Id())
 
-	if !d.IsNewResource() && (tfawserr.ErrCodeEquals(err, ram.ErrCodeResourceArnNotFoundException) || tfawserr.ErrCodeEquals(err, ram.ErrCodeUnknownResourceException)) {
+	if !d.IsNewResource() && tfresource.NotFound(err) {
 		log.Printf("[WARN] No RAM resource share with ARN (%s) found, removing from state", d.Id())
 		d.SetId("")
 		return diags
 	}
 
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "retrieving resource share: %s", err)
-	}
-
-	if resourceShare == nil {
-		return sdkdiag.AppendErrorf(diags, "getting resource share (%s): empty result", d.Id())
+		return sdkdiag.AppendErrorf(diags, "reading RAM Resource Share (%s): %s", d.Id(), err)
 	}
 
-	d.Set("status", resourceShare.Status)
 	d.Set("sender_account_id", resourceShare.OwningAccountId)
 	d.Set("share_arn", resourceShare.ResourceShareArn)
 	d.Set("share_id", resourceResourceShareGetIDFromARN(d.Id()))
 	d.Set("share_name", resourceShare.Name)
+	d.Set("status", resourceShare.Status)
 
-	listInput := &ram.ListResourcesInput{
+	inputL := &ram.ListResourcesInput{
 		MaxResults:        aws.Int64(500),
 		ResourceOwner:     aws.String(ram.ResourceOwnerOtherAccounts),
 		ResourceShareArns: aws.StringSlice([]string{d.Id()}),
 	}
-
-	var resourceARNs []*string
-	err = conn.ListResourcesPagesWithContext(ctx, listInput, func(page *ram.ListResourcesOutput, lastPage bool) bool {
-		for _, resource := range page.Resources {
-			resourceARNs = append(resourceARNs, resource.Arn)
-		}
-
-		return !lastPage
-	})
+	resources, err := findResources(ctx, conn, inputL)
 
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "reading RAM resource share resources %s: %s", d.Id(), err)
+		return sdkdiag.AppendErrorf(diags, "reading RAM Resource Share (%s) resources: %s", d.Id(), err)
 	}
 
-	if err := d.Set("resources", flex.FlattenStringList(resourceARNs)); err != nil {
-		return sdkdiag.AppendErrorf(diags, "unable to set resources: %s", err)
-	}
+	resourceARNs := tfslices.ApplyToAll(resources, func(r *ram.Resource) string {
+		return aws.StringValue(r.Arn)
+	})
+	d.Set("resources", resourceARNs)
 
 	return diags
 }
@@ -232,3 +218,43 @@ func resourceResourceShareAccepterDelete(ctx context.Context, d *schema.Resource
 func resourceResourceShareGetIDFromARN(arn string) string {
 	return strings.Replace(arn[strings.LastIndex(arn, ":")+1:], "resource-share/", "rs-", -1)
 }
+
+func findResourceShareOwnerOtherAccountsByARN(ctx context.Context, conn *ram.RAM, arn string) (*ram.ResourceShare, error) {
+	input := &ram.GetResourceSharesInput{
+		ResourceOwner:     aws.String(ram.ResourceOwnerOtherAccounts),
+		ResourceShareArns: aws.StringSlice([]string{arn}),
+	}
+	output, err := findResourceShare(ctx, conn, input)
+
+	if err != nil {
+		return nil, err
+	}
+
+	// Deleted resource share OK.
+
+	return output, nil
+}
+
+func findResources(ctx context.Context, conn *ram.RAM, input *ram.ListResourcesInput) ([]*ram.Resource, error) {
+	var output []*ram.Resource
+
+	err := conn.ListResourcesPagesWithContext(ctx, input, func(page *ram.ListResourcesOutput, lastPage bool) bool {
+		if page == nil {
+			return !lastPage
+		}
+
+		for _, v := range page.Resources {
+			if v != nil {
+				output = append(output, v)
+			}
+		}
+
+		return !lastPage
+	})
+
+	if err != nil {
+		return nil, err
+	}
+
+	return output, nil
+}
diff --git a/internal/service/ram/resource_share_accepter_test.go b/internal/service/ram/resource_share_accepter_test.go
index 2eaab72cf2f..93597927c74 100644
--- a/internal/service/ram/resource_share_accepter_test.go
+++ b/internal/service/ram/resource_share_accepter_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ram_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ram"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -18,6 +21,16 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
 )
 
+func init() {
+	acctest.RegisterServiceErrorCheckFunc(ram.EndpointsID, testAccErrorCheckSkip)
+}
+
+func testAccErrorCheckSkip(t *testing.T) resource.ErrorCheckFunc {
+	return acctest.ErrorCheckSkipMessagesContaining(t,
+		"this resource is not necessary",
+	)
+}
+
 func TestAccRAMResourceShareAccepter_basic(t *testing.T) {
 	ctx := acctest.Context(t)
 	resourceName := "aws_ram_resource_share_accepter.test"
@@ -38,11 +51,11 @@ func TestAccRAMResourceShareAccepter_basic(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckResourceShareAccepterExists(ctx, resourceName),
 					resource.TestCheckResourceAttrPair(resourceName, "share_arn", principalAssociationResourceName, "resource_share_arn"),
-					acctest.MatchResourceAttrRegionalARNAccountID(resourceName, "invitation_arn", "ram", `\d{12}`, regexp.MustCompile(fmt.Sprintf("resource-share-invitation/%s$", verify.UUIDRegexPattern))),
-					resource.TestMatchResourceAttr(resourceName, "share_id", regexp.MustCompile(fmt.Sprintf(`^rs-%s$`, verify.UUIDRegexPattern))),
+					acctest.MatchResourceAttrRegionalARNAccountID(resourceName, "invitation_arn", "ram", `\d{12}`, regexache.MustCompile(fmt.Sprintf("resource-share-invitation/%s$", verify.UUIDRegexPattern))),
+					resource.TestMatchResourceAttr(resourceName, "share_id", regexache.MustCompile(fmt.Sprintf(`^rs-%s$`, verify.UUIDRegexPattern))),
 					resource.TestCheckResourceAttr(resourceName, "status", ram.ResourceShareStatusActive),
 					acctest.CheckResourceAttrAccountID(resourceName, "receiver_account_id"),
-					resource.TestMatchResourceAttr(resourceName, "sender_account_id", regexp.MustCompile(`\d{12}`)),
+					resource.TestMatchResourceAttr(resourceName, "sender_account_id", regexache.MustCompile(`\d{12}`)),
 					resource.TestCheckResourceAttr(resourceName, "share_name", rName),
 					resource.TestCheckResourceAttr(resourceName, "resources.%", "0"),
 				),
@@ -103,11 +116,11 @@ func TestAccRAMResourceShareAccepter_resourceAssociation(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckResourceShareAccepterExists(ctx, resourceName),
 					resource.TestCheckResourceAttrPair(resourceName, "share_arn", principalAssociationResourceName, "resource_share_arn"),
-					acctest.MatchResourceAttrRegionalARNAccountID(resourceName, "invitation_arn", "ram", `\d{12}`, regexp.MustCompile(fmt.Sprintf("resource-share-invitation/%s$", verify.UUIDRegexPattern))),
-					resource.TestMatchResourceAttr(resourceName, "share_id", regexp.MustCompile(fmt.Sprintf(`^rs-%s$`, verify.UUIDRegexPattern))),
+					acctest.MatchResourceAttrRegionalARNAccountID(resourceName, "invitation_arn", "ram", `\d{12}`, regexache.MustCompile(fmt.Sprintf("resource-share-invitation/%s$", verify.UUIDRegexPattern))),
+					resource.TestMatchResourceAttr(resourceName, "share_id", regexache.MustCompile(fmt.Sprintf(`^rs-%s$`, verify.UUIDRegexPattern))),
 					resource.TestCheckResourceAttr(resourceName, "status", ram.ResourceShareStatusActive),
 					acctest.CheckResourceAttrAccountID(resourceName, "receiver_account_id"),
-					resource.TestMatchResourceAttr(resourceName, "sender_account_id", regexp.MustCompile(`\d{12}`)),
+					resource.TestMatchResourceAttr(resourceName, "sender_account_id", regexache.MustCompile(`\d{12}`)),
 					resource.TestCheckResourceAttr(resourceName, "share_name", rName),
 					resource.TestCheckResourceAttr(resourceName, "resources.%", "0"),
 				),
diff --git a/internal/service/ram/resource_share_data_source.go b/internal/service/ram/resource_share_data_source.go
index bd87bb10e3d..7788559d76c 100644
--- a/internal/service/ram/resource_share_data_source.go
+++ b/internal/service/ram/resource_share_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ram
 
 import (
@@ -10,15 +13,22 @@ import (
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
+	"github.com/hashicorp/terraform-provider-aws/internal/flex"
+	tfslices "github.com/hashicorp/terraform-provider-aws/internal/slices"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 )
 
 // @SDKDataSource("aws_ram_resource_share")
-func DataSourceResourceShare() *schema.Resource {
+// @Tags
+func dataSourceResourceShare() *schema.Resource {
 	return &schema.Resource{
 		ReadWithoutTimeout: dataSourceResourceShareRead,
 
 		Schema: map[string]*schema.Schema{
+			"arn": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
 			"filter": {
 				Type:     schema.TypeSet,
 				Optional: true,
@@ -36,40 +46,36 @@ func DataSourceResourceShare() *schema.Resource {
 					},
 				},
 			},
-
+			"name": {
+				Type:     schema.TypeString,
+				Required: true,
+			},
+			"owning_account_id": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"resource_arns": {
+				Type:     schema.TypeList,
+				Computed: true,
+				Elem: &schema.Schema{
+					Type: schema.TypeString,
+				},
+			},
 			"resource_owner": {
 				Type:         schema.TypeString,
 				Required:     true,
 				ValidateFunc: validation.StringInSlice(ram.ResourceOwner_Values(), false),
 			},
-
 			"resource_share_status": {
 				Type:         schema.TypeString,
 				Optional:     true,
 				ValidateFunc: validation.StringInSlice(ram.ResourceShareStatus_Values(), false),
 			},
-
-			"name": {
-				Type:     schema.TypeString,
-				Required: true,
-			},
-
-			"arn": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
-
-			"owning_account_id": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
-
-			"tags": tftags.TagsSchemaComputed(),
-
 			"status": {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
+			"tags": tftags.TagsSchemaComputed(),
 		},
 	}
 }
@@ -77,80 +83,95 @@ func DataSourceResourceShare() *schema.Resource {
 func dataSourceResourceShareRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).RAMConn(ctx)
-	ignoreTagsConfig := meta.(*conns.AWSClient).IgnoreTagsConfig
 
 	name := d.Get("name").(string)
-	owner := d.Get("resource_owner").(string)
-
-	filters, filtersOk := d.GetOk("filter")
-
-	params := &ram.GetResourceSharesInput{
+	resourceOwner := d.Get("resource_owner").(string)
+	inputG := &ram.GetResourceSharesInput{
 		Name:          aws.String(name),
-		ResourceOwner: aws.String(owner),
+		ResourceOwner: aws.String(resourceOwner),
+	}
+
+	if v, ok := d.GetOk("filter"); ok && v.(*schema.Set).Len() > 0 {
+		inputG.TagFilters = expandTagFilters(v.(*schema.Set).List())
 	}
 
 	if v, ok := d.GetOk("resource_share_status"); ok {
-		params.ResourceShareStatus = aws.String(v.(string))
+		inputG.ResourceShareStatus = aws.String(v.(string))
 	}
 
-	if filtersOk {
-		params.TagFilters = buildTagFilters(filters.(*schema.Set))
+	share, err := findResourceShare(ctx, conn, inputG)
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "reading RAM Resource Share (%s): %s", name, err)
 	}
 
-	for {
-		resp, err := conn.GetResourceSharesWithContext(ctx, params)
+	arn := aws.StringValue(share.ResourceShareArn)
+	d.SetId(arn)
+	d.Set("arn", arn)
+	d.Set("name", share.Name)
+	d.Set("owning_account_id", share.OwningAccountId)
+	d.Set("status", share.Status)
 
-		if err != nil {
-			return sdkdiag.AppendErrorf(diags, "retrieving resource share: empty response for: %s", params)
-		}
+	setTagsOut(ctx, share.Tags)
 
-		if len(resp.ResourceShares) > 1 {
-			return sdkdiag.AppendErrorf(diags, "Multiple resource shares found for: %s", name)
-		}
+	inputL := &ram.ListResourcesInput{
+		ResourceOwner:     aws.String(resourceOwner),
+		ResourceShareArns: aws.StringSlice([]string{arn}),
+	}
+	resources, err := findResources(ctx, conn, inputL)
 
-		if resp == nil || len(resp.ResourceShares) == 0 {
-			return sdkdiag.AppendErrorf(diags, "No matching resource found: %s", err)
-		}
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "reading RAM Resource Share (%s) resources: %s", arn, err)
+	}
 
-		for _, r := range resp.ResourceShares {
-			if aws.StringValue(r.Name) == name {
-				d.SetId(aws.StringValue(r.ResourceShareArn))
-				d.Set("arn", r.ResourceShareArn)
-				d.Set("owning_account_id", r.OwningAccountId)
-				d.Set("status", r.Status)
+	resourceARNs := tfslices.ApplyToAll(resources, func(r *ram.Resource) string {
+		return aws.StringValue(r.Arn)
+	})
+	d.Set("resource_arns", resourceARNs)
 
-				if err := d.Set("tags", KeyValueTags(ctx, r.Tags).IgnoreAWS().IgnoreConfig(ignoreTagsConfig).Map()); err != nil {
-					return sdkdiag.AppendErrorf(diags, "setting tags: %s", err)
-				}
+	return diags
+}
 
-				break
-			}
-		}
+func expandTagFilter(tfMap map[string]interface{}) *ram.TagFilter {
+	if tfMap == nil {
+		return nil
+	}
 
-		if resp.NextToken == nil {
-			break
-		}
+	apiObject := &ram.TagFilter{}
 
-		params.NextToken = resp.NextToken
+	if v, ok := tfMap["name"].(string); ok && v != "" {
+		apiObject.TagKey = aws.String(v)
 	}
 
-	return diags
+	if v, ok := tfMap["values"].([]interface{}); ok && len(v) > 0 {
+		apiObject.TagValues = flex.ExpandStringList(v)
+	}
+
+	return apiObject
 }
 
-func buildTagFilters(set *schema.Set) []*ram.TagFilter {
-	var filters []*ram.TagFilter
+func expandTagFilters(tfList []interface{}) []*ram.TagFilter {
+	if len(tfList) == 0 {
+		return nil
+	}
+
+	var apiObjects []*ram.TagFilter
 
-	for _, v := range set.List() {
-		m := v.(map[string]interface{})
-		var filterValues []*string
-		for _, e := range m["values"].([]interface{}) {
-			filterValues = append(filterValues, aws.String(e.(string)))
+	for _, tfMapRaw := range tfList {
+		tfMap, ok := tfMapRaw.(map[string]interface{})
+
+		if !ok {
+			continue
 		}
-		filters = append(filters, &ram.TagFilter{
-			TagKey:    aws.String(m["name"].(string)),
-			TagValues: filterValues,
-		})
+
+		apiObject := expandTagFilter(tfMap)
+
+		if apiObject == nil {
+			continue
+		}
+
+		apiObjects = append(apiObjects, apiObject)
 	}
 
-	return filters
+	return apiObjects
 }
diff --git a/internal/service/ram/resource_share_data_source_test.go b/internal/service/ram/resource_share_data_source_test.go
index bba63d9469d..5c9dc50fd94 100644
--- a/internal/service/ram/resource_share_data_source_test.go
+++ b/internal/service/ram/resource_share_data_source_test.go
@@ -1,8 +1,10 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ram_test
 
 import (
 	"fmt"
-	"regexp"
 	"testing"
 
 	"github.com/aws/aws-sdk-go/service/ram"
@@ -22,16 +24,14 @@ func TestAccRAMResourceShareDataSource_basic(t *testing.T) {
 		ErrorCheck:               acctest.ErrorCheck(t, ram.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		Steps: []resource.TestStep{
-			{
-				Config:      testAccResourceShareDataSourceConfig_nonExistent,
-				ExpectError: regexp.MustCompile(`No matching resource found`),
-			},
 			{
 				Config: testAccResourceShareDataSourceConfig_name(rName),
-				Check: resource.ComposeTestCheckFunc(
-					resource.TestCheckResourceAttrPair(datasourceName, "name", resourceName, "name"),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					resource.TestCheckResourceAttrPair(datasourceName, "arn", resourceName, "arn"),
 					resource.TestCheckResourceAttrPair(datasourceName, "id", resourceName, "id"),
-					resource.TestCheckResourceAttrSet(datasourceName, "owning_account_id"),
+					resource.TestCheckResourceAttrPair(datasourceName, "name", resourceName, "name"),
+					acctest.CheckResourceAttrAccountID(datasourceName, "owning_account_id"),
+					resource.TestCheckResourceAttr(datasourceName, "resource_arns.#", "0"),
 				),
 			},
 		},
@@ -52,7 +52,6 @@ func TestAccRAMResourceShareDataSource_tags(t *testing.T) {
 			{
 				Config: testAccResourceShareDataSourceConfig_tags(rName),
 				Check: resource.ComposeTestCheckFunc(
-					resource.TestCheckResourceAttrPair(datasourceName, "name", resourceName, "name"),
 					resource.TestCheckResourceAttrPair(datasourceName, "id", resourceName, "id"),
 					resource.TestCheckResourceAttrPair(datasourceName, "tags.%", resourceName, "tags.%"),
 				),
@@ -61,6 +60,28 @@ func TestAccRAMResourceShareDataSource_tags(t *testing.T) {
 	})
 }
 
+func TestAccRAMResourceShareDataSource_resources(t *testing.T) {
+	ctx := acctest.Context(t)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_ram_resource_share.test"
+	datasourceName := "data.aws_ram_resource_share.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, ram.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccResourceShareDataSourceConfig_resources(rName),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttrPair(datasourceName, "id", resourceName, "id"),
+					resource.TestCheckResourceAttr(datasourceName, "resource_arns.#", "1"),
+				),
+			},
+		},
+	})
+}
+
 func TestAccRAMResourceShareDataSource_status(t *testing.T) {
 	ctx := acctest.Context(t)
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
@@ -75,9 +96,8 @@ func TestAccRAMResourceShareDataSource_status(t *testing.T) {
 			{
 				Config: testAccResourceShareDataSourceConfig_status(rName),
 				Check: resource.ComposeTestCheckFunc(
-					resource.TestCheckResourceAttrPair(datasourceName, "name", resourceName, "name"),
 					resource.TestCheckResourceAttrPair(datasourceName, "id", resourceName, "id"),
-					resource.TestCheckResourceAttrSet(datasourceName, "owning_account_id"),
+					resource.TestCheckResourceAttr(datasourceName, "resource_share_status", "ACTIVE"),
 				),
 			},
 		},
@@ -86,8 +106,8 @@ func TestAccRAMResourceShareDataSource_status(t *testing.T) {
 
 func testAccResourceShareDataSourceConfig_name(rName string) string {
 	return fmt.Sprintf(`
-resource "aws_ram_resource_share" "wrong" {
-  name = "%[1]s-wrong"
+resource "aws_ram_resource_share" "other" {
+  name = "%[1]s-other"
 }
 
 resource "aws_ram_resource_share" "test" {
@@ -97,6 +117,8 @@ resource "aws_ram_resource_share" "test" {
 data "aws_ram_resource_share" "test" {
   name           = aws_ram_resource_share.test.name
   resource_owner = "SELF"
+
+  depends_on = [aws_ram_resource_share.other]
 }
 `, rName)
 }
@@ -107,7 +129,7 @@ resource "aws_ram_resource_share" "test" {
   name = %[1]q
 
   tags = {
-    Name = "%[1]s-Tags"
+    Name = %[1]q
   }
 }
 
@@ -117,23 +139,36 @@ data "aws_ram_resource_share" "test" {
 
   filter {
     name   = "Name"
-    values = ["%[1]s-Tags"]
+    values = [%[1]q]
   }
 }
 `, rName)
 }
 
-const testAccResourceShareDataSourceConfig_nonExistent = `
+func testAccResourceShareDataSourceConfig_resources(rName string) string {
+	return acctest.ConfigCompose(acctest.ConfigVPCWithSubnets(rName, 1), fmt.Sprintf(`
+resource "aws_ram_resource_share" "test" {
+  name = %[1]q
+}
+
+resource "aws_ram_resource_association" "test" {
+  resource_arn       = aws_subnet.test[0].arn
+  resource_share_arn = aws_ram_resource_share.test.arn
+}
+
 data "aws_ram_resource_share" "test" {
-  name           = "tf-acc-test-does-not-exist"
+  name           = aws_ram_resource_share.test.name
   resource_owner = "SELF"
+
+  depends_on = [aws_ram_resource_association.test]
+}
+`, rName))
 }
-`
 
 func testAccResourceShareDataSourceConfig_status(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_ram_resource_share" "test" {
-  name = "%s"
+  name = %[1]q
 }
 
 data "aws_ram_resource_share" "test" {
diff --git a/internal/service/ram/resource_share_test.go b/internal/service/ram/resource_share_test.go
index c8a1a4b1c7b..37a5871417c 100644
--- a/internal/service/ram/resource_share_test.go
+++ b/internal/service/ram/resource_share_test.go
@@ -1,12 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ram_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/aws"
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/ram"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -14,6 +16,7 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	tfram "github.com/hashicorp/terraform-provider-aws/internal/service/ram"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
 func TestAccRAMResourceShare_basic(t *testing.T) {
@@ -32,7 +35,7 @@ func TestAccRAMResourceShare_basic(t *testing.T) {
 				Config: testAccResourceShareConfig_name(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckResourceShareExists(ctx, resourceName, &resourceShare),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ram", regexp.MustCompile(`resource-share/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ram", regexache.MustCompile(`resource-share/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "allow_external_principals", "false"),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "permission_arns.#", "0"),
@@ -64,7 +67,7 @@ func TestAccRAMResourceShare_permission(t *testing.T) {
 				Config: testAccResourceShareConfig_namePermission(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckResourceShareExists(ctx, resourceName, &resourceShare),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ram", regexp.MustCompile(`resource-share/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ram", regexache.MustCompile(`resource-share/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "allow_external_principals", "false"),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "permission_arns.#", "1"),
@@ -221,17 +224,13 @@ func TestAccRAMResourceShare_disappears(t *testing.T) {
 	})
 }
 
-func testAccCheckResourceShareExists(ctx context.Context, resourceName string, v *ram.ResourceShare) resource.TestCheckFunc {
+func testAccCheckResourceShareExists(ctx context.Context, n string, v *ram.ResourceShare) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		conn := acctest.Provider.Meta().(*conns.AWSClient).RAMConn(ctx)
 
-		rs, ok := s.RootModule().Resources[resourceName]
+		rs, ok := s.RootModule().Resources[n]
 		if !ok {
-			return fmt.Errorf("Not found: %s", resourceName)
-		}
-
-		if rs.Primary.ID == "" {
-			return fmt.Errorf("No ID is set")
+			return fmt.Errorf("Not found: %s", n)
 		}
 
 		output, err := tfram.FindResourceShareOwnerSelfByARN(ctx, conn, rs.Primary.ID)
@@ -240,10 +239,6 @@ func testAccCheckResourceShareExists(ctx context.Context, resourceName string, v
 			return err
 		}
 
-		if aws.StringValue(output.Status) != ram.ResourceShareStatusActive {
-			return fmt.Errorf("RAM resource share (%s) delet(ing|ed)", rs.Primary.ID)
-		}
-
 		*v = *output
 
 		return nil
@@ -259,15 +254,17 @@ func testAccCheckResourceShareDestroy(ctx context.Context) resource.TestCheckFun
 				continue
 			}
 
-			resourceShare, err := tfram.FindResourceShareOwnerSelfByARN(ctx, conn, rs.Primary.ID)
+			_, err := tfram.FindResourceShareOwnerSelfByARN(ctx, conn, rs.Primary.ID)
+
+			if tfresource.NotFound(err) {
+				continue
+			}
 
 			if err != nil {
 				return err
 			}
 
-			if aws.StringValue(resourceShare.Status) != ram.ResourceShareStatusDeleted {
-				return fmt.Errorf("RAM resource share (%s) still exists", rs.Primary.ID)
-			}
+			return fmt.Errorf("RAM Resource Share %s still exists", rs.Primary.ID)
 		}
 
 		return nil
diff --git a/internal/service/ram/service_package_gen.go b/internal/service/ram/service_package_gen.go
index 967561ec057..c770ab3c823 100644
--- a/internal/service/ram/service_package_gen.go
+++ b/internal/service/ram/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	ram_sdkv1 "github.com/aws/aws-sdk-go/service/ram"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -25,8 +26,9 @@ func (p *servicePackage) FrameworkResources(ctx context.Context) []*types.Servic
 func (p *servicePackage) SDKDataSources(ctx context.Context) []*types.ServicePackageSDKDataSource {
 	return []*types.ServicePackageSDKDataSource{
 		{
-			Factory:  DataSourceResourceShare,
+			Factory:  dataSourceResourceShare,
 			TypeName: "aws_ram_resource_share",
+			Tags:     &types.ServicePackageResourceTags{},
 		},
 	}
 }
@@ -53,6 +55,10 @@ func (p *servicePackage) SDKResources(ctx context.Context) []*types.ServicePacka
 			Factory:  ResourceResourceShareAccepter,
 			TypeName: "aws_ram_resource_share_accepter",
 		},
+		{
+			Factory:  ResourceSharingWithOrganization,
+			TypeName: "aws_ram_sharing_with_organization",
+		},
 	}
 }
 
@@ -67,4 +73,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*r
 	return ram_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/ram/sharing_with_organization.go b/internal/service/ram/sharing_with_organization.go
new file mode 100644
index 00000000000..2c59b31f14f
--- /dev/null
+++ b/internal/service/ram/sharing_with_organization.go
@@ -0,0 +1,110 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package ram
+
+import (
+	"context"
+	"log"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/ram"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
+	tfiam "github.com/hashicorp/terraform-provider-aws/internal/service/iam"
+	tforganizations "github.com/hashicorp/terraform-provider-aws/internal/service/organizations"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"golang.org/x/exp/slices"
+)
+
+// @SDKResource("aws_ram_sharing_with_organization")
+func ResourceSharingWithOrganization() *schema.Resource {
+	return &schema.Resource{
+		CreateWithoutTimeout: resourceSharingWithOrganizationCreate,
+		ReadWithoutTimeout:   resourceSharingWithOrganizationRead,
+		DeleteWithoutTimeout: resourceSharingWithOrganizationDelete,
+
+		Importer: &schema.ResourceImporter{
+			StateContext: schema.ImportStatePassthroughContext,
+		},
+
+		Schema: map[string]*schema.Schema{},
+	}
+}
+
+const (
+	sharingWithOrganizationRoleName = "AWSServiceRoleForResourceAccessManager"
+	servicePrincipalName            = "ram.amazonaws.com"
+)
+
+func resourceSharingWithOrganizationCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).RAMConn(ctx)
+
+	output, err := conn.EnableSharingWithAwsOrganizationWithContext(ctx, &ram.EnableSharingWithAwsOrganizationInput{})
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "enabling RAM Sharing with Organization: %s", err)
+	}
+
+	if !aws.BoolValue(output.ReturnValue) {
+		return sdkdiag.AppendErrorf(diags, "RAM Sharing with Organization failed")
+	}
+
+	d.SetId(meta.(*conns.AWSClient).AccountID)
+
+	return append(diags, resourceSharingWithOrganizationRead(ctx, d, meta)...)
+}
+
+func resourceSharingWithOrganizationRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+
+	// See https://docs.aws.amazon.com/ram/latest/userguide/getting-started-sharing.html#getting-started-sharing-orgs.
+	// Check for IAM role and Organizations trusted access.
+
+	_, err := tfiam.FindRoleByName(ctx, meta.(*conns.AWSClient).IAMConn(ctx), sharingWithOrganizationRoleName)
+
+	if !d.IsNewResource() && tfresource.NotFound(err) {
+		log.Printf("[WARN] IAM Role (%s) not found, removing from state", sharingWithOrganizationRoleName)
+		d.SetId("")
+		return diags
+	}
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "reading IAM Role (%s): %s", sharingWithOrganizationRoleName, err)
+	}
+
+	servicePrincipalNames, err := tforganizations.FindEnabledServicePrincipalNames(ctx, meta.(*conns.AWSClient).OrganizationsConn(ctx))
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "reading Organization service principals: %s", err)
+	}
+
+	enabled := slices.Contains(servicePrincipalNames, servicePrincipalName)
+
+	if !d.IsNewResource() && !enabled {
+		log.Printf("[WARN] Organization service principal (%s) not enabled, removing from state", servicePrincipalName)
+		d.SetId("")
+		return diags
+	}
+
+	return diags
+}
+
+func resourceSharingWithOrganizationDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+
+	// See https://docs.aws.amazon.com/ram/latest/userguide/security-disable-sharing-with-orgs.html.
+
+	if err := tforganizations.DisableServicePrincipal(ctx, meta.(*conns.AWSClient).OrganizationsConn(ctx), servicePrincipalName); err != nil {
+		return sdkdiag.AppendErrorf(diags, "disabling Organization service principal (%s): %s", servicePrincipalName, err)
+	}
+
+	if err := tfiam.DeleteServiceLinkedRole(ctx, meta.(*conns.AWSClient).IAMConn(ctx), sharingWithOrganizationRoleName); err != nil {
+		return sdkdiag.AppendWarningf(diags, "deleting IAM service-linked Role (%s): %s", sharingWithOrganizationRoleName, err)
+	}
+
+	return diags
+}
diff --git a/internal/service/ram/sharing_with_organization_test.go b/internal/service/ram/sharing_with_organization_test.go
new file mode 100644
index 00000000000..8fd2ba38def
--- /dev/null
+++ b/internal/service/ram/sharing_with_organization_test.go
@@ -0,0 +1,79 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package ram_test
+
+import (
+	"testing"
+
+	"github.com/aws/aws-sdk-go/service/ram"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
+	tfram "github.com/hashicorp/terraform-provider-aws/internal/service/ram"
+)
+
+func TestAccRAMSharingWithOrganization_serial(t *testing.T) {
+	t.Parallel()
+
+	testCases := map[string]func(t *testing.T){
+		"basic":      testAccSharingWithOrganization_basic,
+		"disappears": testAccSharingWithOrganization_disappears,
+	}
+
+	acctest.RunSerialTests1Level(t, testCases, 0)
+}
+
+func testAccSharingWithOrganization_basic(t *testing.T) {
+	ctx := acctest.Context(t)
+	resourceName := "aws_ram_sharing_with_organization.test"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckOrganizationManagementAccount(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, ram.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             acctest.CheckDestroyNoop,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccSharingWithOrganizationConfig_basic(),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
+func testAccSharingWithOrganization_disappears(t *testing.T) {
+	ctx := acctest.Context(t)
+	resourceName := "aws_ram_sharing_with_organization.test"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckOrganizationManagementAccount(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, ram.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             acctest.CheckDestroyNoop,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccSharingWithOrganizationConfig_basic(),
+				Check: resource.ComposeTestCheckFunc(
+					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfram.ResourceSharingWithOrganization(), resourceName),
+				),
+				ExpectNonEmptyPlan: true,
+			},
+		},
+	})
+}
+
+func testAccSharingWithOrganizationConfig_basic() string {
+	return `
+resource "aws_ram_sharing_with_organization" "test" {}
+`
+}
diff --git a/internal/service/ram/status.go b/internal/service/ram/status.go
index f749123888a..4735b8acb73 100644
--- a/internal/service/ram/status.go
+++ b/internal/service/ram/status.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ram
 
 import (
@@ -14,9 +17,6 @@ const (
 	ResourceShareInvitationStatusNotFound = "NotFound"
 	ResourceShareInvitationStatusUnknown  = "Unknown"
 
-	ResourceShareStatusNotFound = "NotFound"
-	ResourceShareStatusUnknown  = "Unknown"
-
 	PrincipalAssociationStatusNotFound = "NotFound"
 )
 
@@ -37,27 +37,6 @@ func StatusResourceShareInvitation(ctx context.Context, conn *ram.RAM, arn strin
 	}
 }
 
-// StatusResourceShareOwnerSelf fetches the ResourceShare and its Status
-func StatusResourceShareOwnerSelf(ctx context.Context, conn *ram.RAM, arn string) retry.StateRefreshFunc {
-	return func() (interface{}, string, error) {
-		share, err := FindResourceShareOwnerSelfByARN(ctx, conn, arn)
-
-		if tfawserr.ErrCodeEquals(err, ram.ErrCodeUnknownResourceException) {
-			return nil, ResourceShareStatusNotFound, nil
-		}
-
-		if err != nil {
-			return nil, ResourceShareStatusUnknown, err
-		}
-
-		if share == nil {
-			return nil, ResourceShareStatusNotFound, nil
-		}
-
-		return share, aws.StringValue(share.Status), nil
-	}
-}
-
 func StatusResourceSharePrincipalAssociation(ctx context.Context, conn *ram.RAM, resourceShareArn, principal string) retry.StateRefreshFunc {
 	return func() (interface{}, string, error) {
 		association, err := FindResourceSharePrincipalAssociationByShareARNPrincipal(ctx, conn, resourceShareArn, principal)
diff --git a/internal/service/ram/sweep.go b/internal/service/ram/sweep.go
index 3d163e03f86..1d844717ac8 100644
--- a/internal/service/ram/sweep.go
+++ b/internal/service/ram/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package ram
 
@@ -11,9 +11,10 @@ import (
 	"github.com/aws/aws-sdk-go/service/ram"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_ram_resource_share", &resource.Sweeper{
 		Name: "aws_ram_resource_share",
 		F:    sweepResourceShares,
@@ -22,7 +23,7 @@ func init() {
 
 func sweepResourceShares(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -52,7 +53,7 @@ func sweepResourceShares(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping RAM Resource Share sweep for %s: %s", region, err)
 		return nil
 	}
@@ -61,7 +62,7 @@ func sweepResourceShares(region string) error {
 		return fmt.Errorf("error listing RAM Resource Shares (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping RAM Resource Shares (%s): %w", region, err)
diff --git a/internal/service/ram/tags_gen.go b/internal/service/ram/tags_gen.go
index a451ed69fd6..57bc470e769 100644
--- a/internal/service/ram/tags_gen.go
+++ b/internal/service/ram/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ram"
 	"github.com/aws/aws-sdk-go/service/ram/ramiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -69,6 +71,8 @@ func updateTags(ctx context.Context, conn ramiface.RAMAPI, identifier string, ol
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.RAM)
 	if len(removedTags) > 0 {
diff --git a/internal/service/ram/wait.go b/internal/service/ram/wait.go
index aa15c0dd221..df1f3eb7ce9 100644
--- a/internal/service/ram/wait.go
+++ b/internal/service/ram/wait.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ram
 
 import (
@@ -36,43 +39,7 @@ func WaitResourceShareOwnedBySelfDisassociated(ctx context.Context, conn *ram.RA
 	stateConf := &retry.StateChangeConf{
 		Pending: []string{ram.ResourceShareAssociationStatusAssociated},
 		Target:  []string{},
-		Refresh: StatusResourceShareOwnerSelf(ctx, conn, arn),
-		Timeout: timeout,
-	}
-
-	outputRaw, err := stateConf.WaitForStateContext(ctx)
-
-	if v, ok := outputRaw.(*ram.ResourceShare); ok {
-		return v, err
-	}
-
-	return nil, err
-}
-
-// WaitResourceShareOwnedBySelfActive waits for a ResourceShare owned by own account to return ACTIVE
-func WaitResourceShareOwnedBySelfActive(ctx context.Context, conn *ram.RAM, arn string, timeout time.Duration) (*ram.ResourceShare, error) {
-	stateConf := &retry.StateChangeConf{
-		Pending: []string{ram.ResourceShareStatusPending},
-		Target:  []string{ram.ResourceShareStatusActive},
-		Refresh: StatusResourceShareOwnerSelf(ctx, conn, arn),
-		Timeout: timeout,
-	}
-
-	outputRaw, err := stateConf.WaitForStateContext(ctx)
-
-	if v, ok := outputRaw.(*ram.ResourceShare); ok {
-		return v, err
-	}
-
-	return nil, err
-}
-
-// WaitResourceShareOwnedBySelfDeleted waits for a ResourceShare owned by own account to return DELETED
-func WaitResourceShareOwnedBySelfDeleted(ctx context.Context, conn *ram.RAM, arn string, timeout time.Duration) (*ram.ResourceShare, error) {
-	stateConf := &retry.StateChangeConf{
-		Pending: []string{ram.ResourceShareStatusDeleting},
-		Target:  []string{ram.ResourceShareStatusDeleted},
-		Refresh: StatusResourceShareOwnerSelf(ctx, conn, arn),
+		Refresh: statusResourceShareOwnerSelf(ctx, conn, arn),
 		Timeout: timeout,
 	}
 
diff --git a/internal/service/rbin/generate.go b/internal/service/rbin/generate.go
index 3afff26f50a..e85092be031 100644
--- a/internal/service/rbin/generate.go
+++ b/internal/service/rbin/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -AWSSDKVersion=2 -ListTags -ListTagsOp=ListTagsForResource -ListTagsInIDElem=ResourceArn  -ServiceTagsSlice -TagOp=TagResource -TagInIDElem=ResourceArn  -UntagOp=UntagResource -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/rbin/rule.go b/internal/service/rbin/rule.go
index 7ccc3260dda..0af0eb3b987 100644
--- a/internal/service/rbin/rule.go
+++ b/internal/service/rbin/rule.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rbin
 
 import (
diff --git a/internal/service/rbin/rule_test.go b/internal/service/rbin/rule_test.go
index 1115f65a845..aede9a00a08 100644
--- a/internal/service/rbin/rule_test.go
+++ b/internal/service/rbin/rule_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rbin_test
 
 import (
diff --git a/internal/service/rbin/service_package_gen.go b/internal/service/rbin/service_package_gen.go
index 501cdf4750d..42735806bae 100644
--- a/internal/service/rbin/service_package_gen.go
+++ b/internal/service/rbin/service_package_gen.go
@@ -7,6 +7,7 @@ import (
 
 	aws_sdkv2 "github.com/aws/aws-sdk-go-v2/aws"
 	rbin_sdkv2 "github.com/aws/aws-sdk-go-v2/service/rbin"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -48,9 +49,11 @@ func (p *servicePackage) NewClient(ctx context.Context, config map[string]any) (
 
 	return rbin_sdkv2.NewFromConfig(cfg, func(o *rbin_sdkv2.Options) {
 		if endpoint := config["endpoint"].(string); endpoint != "" {
-			o.EndpointResolver = rbin_sdkv2.EndpointResolverFromURL(endpoint)
+			o.BaseEndpoint = aws_sdkv2.String(endpoint)
 		}
 	}), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/rbin/tags_gen.go b/internal/service/rbin/tags_gen.go
index c239fc4ddab..4382dabd67d 100644
--- a/internal/service/rbin/tags_gen.go
+++ b/internal/service/rbin/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/rbin"
 	awstypes "github.com/aws/aws-sdk-go-v2/service/rbin/types"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -102,6 +104,8 @@ func updateTags(ctx context.Context, conn *rbin.Client, identifier string, oldTa
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.RBin)
 	if len(removedTags) > 0 {
diff --git a/internal/service/rds/blue_green.go b/internal/service/rds/blue_green.go
index 393971e1e81..5f046f18f95 100644
--- a/internal/service/rds/blue_green.go
+++ b/internal/service/rds/blue_green.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rds
 
 import (
@@ -96,7 +99,7 @@ func newInstanceHandler(conn *rds_sdkv2.Client) *instanceHandler {
 func (h *instanceHandler) precondition(ctx context.Context, d *schema.ResourceData) error {
 	needsPreConditions := false
 	input := &rds_sdkv2.ModifyDBInstanceInput{
-		ApplyImmediately:     true,
+		ApplyImmediately:     aws.Bool(true),
 		DBInstanceIdentifier: aws.String(d.Get("identifier").(string)),
 	}
 
@@ -139,7 +142,7 @@ func (h *instanceHandler) createBlueGreenInput(d *schema.ResourceData) *rds_sdkv
 
 func (h *instanceHandler) modifyTarget(ctx context.Context, identifier string, d *schema.ResourceData, timeout time.Duration, operation string) error {
 	modifyInput := &rds_sdkv2.ModifyDBInstanceInput{
-		ApplyImmediately:     true,
+		ApplyImmediately:     aws.Bool(true),
 		DBInstanceIdentifier: aws.String(identifier),
 	}
 
diff --git a/internal/service/rds/certificate_data_source.go b/internal/service/rds/certificate_data_source.go
index b573c63b74d..796dd6f2ca9 100644
--- a/internal/service/rds/certificate_data_source.go
+++ b/internal/service/rds/certificate_data_source.go
@@ -1,8 +1,10 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rds
 
 import (
 	"context"
-	"sort"
 	"time"
 
 	"github.com/aws/aws-sdk-go/aws"
@@ -11,6 +13,7 @@ import (
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
+	"golang.org/x/exp/slices"
 )
 
 // @SDKDataSource("aws_rds_certificate")
@@ -97,22 +100,20 @@ func dataSourceCertificateRead(ctx context.Context, d *schema.ResourceData, meta
 	var certificate *rds.Certificate
 
 	if d.Get("latest_valid_till").(bool) {
-		sort.Sort(rdsCertificateValidTillSort(certificates))
+		slices.SortFunc(certificates, func(a, b *rds.Certificate) int {
+			return a.ValidTill.Compare(*b.ValidTill)
+		})
 		certificate = certificates[len(certificates)-1]
-	}
-
-	if len(certificates) > 1 {
-		return sdkdiag.AppendErrorf(diags, "multiple RDS Certificates match the criteria; try changing search query")
-	}
-
-	if certificate == nil && len(certificates) == 1 {
+	} else {
+		if len(certificates) > 1 {
+			return sdkdiag.AppendErrorf(diags, "multiple RDS Certificates match the criteria; try changing search query")
+		}
+		if len(certificates) == 0 {
+			return sdkdiag.AppendErrorf(diags, "no RDS Certificates match the criteria")
+		}
 		certificate = certificates[0]
 	}
 
-	if certificate == nil {
-		return sdkdiag.AppendErrorf(diags, "no RDS Certificates match the criteria")
-	}
-
 	d.SetId(aws.StringValue(certificate.CertificateIdentifier))
 
 	d.Set("arn", certificate.CertificateArn)
@@ -135,19 +136,3 @@ func dataSourceCertificateRead(ctx context.Context, d *schema.ResourceData, meta
 
 	return diags
 }
-
-type rdsCertificateValidTillSort []*rds.Certificate
-
-func (s rdsCertificateValidTillSort) Len() int      { return len(s) }
-func (s rdsCertificateValidTillSort) Swap(i, j int) { s[i], s[j] = s[j], s[i] }
-func (s rdsCertificateValidTillSort) Less(i, j int) bool {
-	if s[i] == nil || s[i].ValidTill == nil {
-		return true
-	}
-
-	if s[j] == nil || s[j].ValidTill == nil {
-		return false
-	}
-
-	return (*s[i].ValidTill).Before(*s[j].ValidTill)
-}
diff --git a/internal/service/rds/certificate_data_source_test.go b/internal/service/rds/certificate_data_source_test.go
index 3aaa0a01d70..c9979ad1b3d 100644
--- a/internal/service/rds/certificate_data_source_test.go
+++ b/internal/service/rds/certificate_data_source_test.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rds_test
 
 import (
 	"context"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/rds"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
@@ -23,7 +26,7 @@ func TestAccRDSCertificateDataSource_id(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config: testAccCertificateDataSourceConfig_id(),
-				Check: resource.ComposeTestCheckFunc(
+				Check: resource.ComposeAggregateTestCheckFunc(
 					resource.TestCheckResourceAttrPair(dataSourceName, "id", "data.aws_rds_certificate.latest", "id"),
 				),
 			},
@@ -43,15 +46,15 @@ func TestAccRDSCertificateDataSource_latestValidTill(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config: testAccCertificateDataSourceConfig_latestValidTill(),
-				Check: resource.ComposeTestCheckFunc(
-					acctest.MatchResourceAttrRegionalARNNoAccount(dataSourceName, "arn", "rds", regexp.MustCompile(`cert:rds-ca-[0-9]{4}`)),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					acctest.MatchResourceAttrRegionalARNNoAccount(dataSourceName, "arn", "rds", regexache.MustCompile(`cert:rds-ca-[-0-9a-z]+$`)),
 					resource.TestCheckResourceAttr(dataSourceName, "certificate_type", "CA"),
 					resource.TestCheckResourceAttr(dataSourceName, "customer_override", "false"),
 					resource.TestCheckNoResourceAttr(dataSourceName, "customer_override_valid_till"),
-					resource.TestMatchResourceAttr(dataSourceName, "id", regexp.MustCompile(`rds-ca-[0-9]{4}`)),
-					resource.TestMatchResourceAttr(dataSourceName, "thumbprint", regexp.MustCompile(`[0-9a-f]+`)),
-					resource.TestMatchResourceAttr(dataSourceName, "valid_from", regexp.MustCompile(acctest.RFC3339RegexPattern)),
-					resource.TestMatchResourceAttr(dataSourceName, "valid_till", regexp.MustCompile(acctest.RFC3339RegexPattern)),
+					resource.TestMatchResourceAttr(dataSourceName, "id", regexache.MustCompile(`^rds-ca-[-0-9a-z]+$`)),
+					resource.TestMatchResourceAttr(dataSourceName, "thumbprint", regexache.MustCompile(`^[0-9a-f]+$`)),
+					resource.TestMatchResourceAttr(dataSourceName, "valid_from", regexache.MustCompile(acctest.RFC3339RegexPattern)),
+					resource.TestMatchResourceAttr(dataSourceName, "valid_till", regexache.MustCompile(acctest.RFC3339RegexPattern)),
 				),
 			},
 		},
diff --git a/internal/service/rds/cluster.go b/internal/service/rds/cluster.go
index c20bc0fff8f..135601af249 100644
--- a/internal/service/rds/cluster.go
+++ b/internal/service/rds/cluster.go
@@ -1,26 +1,30 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rds
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"strings"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/aws/aws-sdk-go/service/rds"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/customdiff"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/create"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
 	"github.com/hashicorp/terraform-provider-aws/internal/flex"
+	tfslices "github.com/hashicorp/terraform-provider-aws/internal/slices"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
@@ -147,6 +151,12 @@ func ResourceCluster() *schema.Resource {
 				ForceNew: true,
 				Computed: true,
 			},
+			"db_system_id": {
+				Type:     schema.TypeString,
+				Optional: true,
+				ForceNew: true,
+				Computed: true,
+			},
 			"deletion_protection": {
 				Type:     schema.TypeBool,
 				Optional: true,
@@ -174,10 +184,13 @@ func ResourceCluster() *schema.Resource {
 				Computed: true,
 			},
 			"engine": {
-				Type:         schema.TypeString,
-				Required:     true,
-				ForceNew:     true,
-				ValidateFunc: validClusterEngine(),
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+				ValidateFunc: validation.Any(
+					validation.StringMatch(regexache.MustCompile(fmt.Sprintf(`^%s.*$`, InstanceEngineCustomPrefix)), fmt.Sprintf("must begin with %s", InstanceEngineCustomPrefix)),
+					validation.StringInSlice(ClusterEngine_Values(), false),
+				),
 			},
 			"engine_mode": {
 				Type:         schema.TypeString,
@@ -200,14 +213,14 @@ func ResourceCluster() *schema.Resource {
 				Optional: true,
 				ValidateFunc: func(v interface{}, k string) (ws []string, es []error) {
 					value := v.(string)
-					if !regexp.MustCompile(`^[0-9A-Za-z-]+$`).MatchString(value) {
+					if !regexache.MustCompile(`^[0-9A-Za-z-]+$`).MatchString(value) {
 						es = append(es, fmt.Errorf(
 							"only alphanumeric characters and hyphens allowed in %q", k))
 					}
-					if regexp.MustCompile(`--`).MatchString(value) {
+					if regexache.MustCompile(`--`).MatchString(value) {
 						es = append(es, fmt.Errorf("%q cannot contain two consecutive hyphens", k))
 					}
-					if regexp.MustCompile(`-$`).MatchString(value) {
+					if regexache.MustCompile(`-$`).MatchString(value) {
 						es = append(es, fmt.Errorf("%q cannot end in a hyphen", k))
 					}
 					return
@@ -535,6 +548,12 @@ func resourceClusterCreate(ctx context.Context, d *schema.ResourceData, meta int
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).RDSConn(ctx)
 
+	identifier := create.NewNameGenerator(
+		create.WithConfiguredName(d.Get("cluster_identifier").(string)),
+		create.WithConfiguredPrefix(d.Get("cluster_identifier_prefix").(string)),
+		create.WithDefaultPrefix("tf-"),
+	).Generate()
+
 	// Some API calls (e.g. RestoreDBClusterFromSnapshot do not support all
 	// parameters to correctly apply all settings in one pass. For missing
 	// parameters or unsupported configurations, we may need to call
@@ -545,15 +564,6 @@ func resourceClusterCreate(ctx context.Context, d *schema.ResourceData, meta int
 		ApplyImmediately: aws.Bool(true),
 	}
 
-	var identifier string
-	if v, ok := d.GetOk("cluster_identifier"); ok {
-		identifier = v.(string)
-	} else if v, ok := d.GetOk("cluster_identifier_prefix"); ok {
-		identifier = id.PrefixedUniqueId(v.(string))
-	} else {
-		identifier = id.PrefixedUniqueId("tf-")
-	}
-
 	if v, ok := d.GetOk("snapshot_identifier"); ok {
 		input := &rds.RestoreDBClusterFromSnapshotInput{
 			CopyTagsToSnapshot:  aws.Bool(d.Get("copy_tags_to_snapshot").(bool)),
@@ -785,7 +795,7 @@ func resourceClusterCreate(ctx context.Context, d *schema.ResourceData, meta int
 		if err != nil {
 			return sdkdiag.AppendErrorf(diags, "creating RDS Cluster (restore from S3) (%s): %s", identifier, err)
 		}
-	} else if v, ok := d.GetOk("restore_to_point_in_time"); ok {
+	} else if v, ok := d.GetOk("restore_to_point_in_time"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
 		tfMap := v.([]interface{})[0].(map[string]interface{})
 		input := &rds.RestoreDBClusterToPointInTimeInput{
 			DBClusterIdentifier:       aws.String(identifier),
@@ -938,6 +948,10 @@ func resourceClusterCreate(ctx context.Context, d *schema.ResourceData, meta int
 			input.DBSubnetGroupName = aws.String(v.(string))
 		}
 
+		if v, ok := d.GetOk("db_system_id"); ok {
+			input.DBSystemId = aws.String(v.(string))
+		}
+
 		if v, ok := d.GetOk("enable_global_write_forwarding"); ok {
 			input.EnableGlobalWriteForwarding = aws.Bool(v.(bool))
 		}
@@ -1096,6 +1110,7 @@ func resourceClusterRead(ctx context.Context, d *schema.ResourceData, meta inter
 	d.Set("backtrack_window", dbc.BacktrackWindow)
 	d.Set("backup_retention_period", dbc.BackupRetentionPeriod)
 	d.Set("cluster_identifier", dbc.DBClusterIdentifier)
+	d.Set("cluster_identifier_prefix", create.NamePrefixFromName(aws.StringValue(dbc.DBClusterIdentifier)))
 	var clusterMembers []string
 	for _, v := range dbc.DBClusterMembers {
 		clusterMembers = append(clusterMembers, aws.StringValue(v.DBInstanceIdentifier))
@@ -1113,6 +1128,7 @@ func resourceClusterRead(ctx context.Context, d *schema.ResourceData, meta inter
 	d.Set("db_cluster_instance_class", dbc.DBClusterInstanceClass)
 	d.Set("db_cluster_parameter_group_name", dbc.DBClusterParameterGroup)
 	d.Set("db_subnet_group_name", dbc.DBSubnetGroup)
+	d.Set("db_system_id", dbc.DBSystemId)
 	d.Set("deletion_protection", dbc.DeletionProtection)
 	d.Set("enabled_cloudwatch_logs_exports", aws.StringValueSlice(dbc.EnabledCloudwatchLogsExports))
 	d.Set("enable_http_endpoint", dbc.HttpEndpointEnabled)
@@ -1583,44 +1599,67 @@ func FindDBClusterByID(ctx context.Context, conn *rds.RDS, id string) (*rds.DBCl
 	input := &rds.DescribeDBClustersInput{
 		DBClusterIdentifier: aws.String(id),
 	}
+	output, err := findDBCluster(ctx, conn, input, tfslices.PredicateTrue[*rds.DBCluster]())
 
-	output, err := conn.DescribeDBClustersWithContext(ctx, input)
+	if err != nil {
+		return nil, err
+	}
 
-	if tfawserr.ErrCodeEquals(err, rds.ErrCodeDBClusterNotFoundFault) {
+	// Eventual consistency check.
+	if arn.IsARN(id) {
+		if aws.StringValue(output.DBClusterArn) != id {
+			return nil, &retry.NotFoundError{
+				LastRequest: input,
+			}
+		}
+	} else if aws.StringValue(output.DBClusterIdentifier) != id {
 		return nil, &retry.NotFoundError{
-			LastError:   err,
 			LastRequest: input,
 		}
 	}
 
+	return output, nil
+}
+
+func findDBCluster(ctx context.Context, conn *rds.RDS, input *rds.DescribeDBClustersInput, filter tfslices.Predicate[*rds.DBCluster]) (*rds.DBCluster, error) {
+	output, err := findDBClusters(ctx, conn, input, filter)
+
 	if err != nil {
 		return nil, err
 	}
 
-	if output == nil || len(output.DBClusters) == 0 || output.DBClusters[0] == nil {
-		return nil, tfresource.NewEmptyResultError(input)
-	}
+	return tfresource.AssertSinglePtrResult(output)
+}
 
-	if count := len(output.DBClusters); count > 1 {
-		return nil, tfresource.NewTooManyResultsError(count, input)
-	}
+func findDBClusters(ctx context.Context, conn *rds.RDS, input *rds.DescribeDBClustersInput, filter tfslices.Predicate[*rds.DBCluster]) ([]*rds.DBCluster, error) {
+	var output []*rds.DBCluster
 
-	dbCluster := output.DBClusters[0]
+	err := conn.DescribeDBClustersPagesWithContext(ctx, input, func(page *rds.DescribeDBClustersOutput, lastPage bool) bool {
+		if page == nil {
+			return !lastPage
+		}
 
-	// Eventual consistency check.
-	if arn.IsARN(id) {
-		if aws.StringValue(dbCluster.DBClusterArn) != id {
-			return nil, &retry.NotFoundError{
-				LastRequest: input,
+		for _, v := range page.DBClusters {
+			if v != nil && filter(v) {
+				output = append(output, v)
 			}
 		}
-	} else if aws.StringValue(dbCluster.DBClusterIdentifier) != id {
+
+		return !lastPage
+	})
+
+	if tfawserr.ErrCodeEquals(err, rds.ErrCodeDBClusterNotFoundFault) {
 		return nil, &retry.NotFoundError{
+			LastError:   err,
 			LastRequest: input,
 		}
 	}
 
-	return dbCluster, nil
+	if err != nil {
+		return nil, err
+	}
+
+	return output, nil
 }
 
 func statusDBCluster(ctx context.Context, conn *rds.RDS, id string) retry.StateRefreshFunc {
@@ -1700,6 +1739,7 @@ func waitDBClusterDeleted(ctx context.Context, conn *rds.RDS, id string, timeout
 			ClusterStatusBackingUp,
 			ClusterStatusDeleting,
 			ClusterStatusModifying,
+			ClusterStatusPromoting,
 		},
 		Target:     []string{},
 		Refresh:    statusDBCluster(ctx, conn, id),
diff --git a/internal/service/rds/cluster_activity_stream.go b/internal/service/rds/cluster_activity_stream.go
index 5793705856b..c7eec0ceaa3 100644
--- a/internal/service/rds/cluster_activity_stream.go
+++ b/internal/service/rds/cluster_activity_stream.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rds
 
 import (
diff --git a/internal/service/rds/cluster_activity_stream_test.go b/internal/service/rds/cluster_activity_stream_test.go
index b9f9c56f8e2..2fa5c5277b8 100644
--- a/internal/service/rds/cluster_activity_stream_test.go
+++ b/internal/service/rds/cluster_activity_stream_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rds_test
 
 import (
diff --git a/internal/service/rds/cluster_data_source.go b/internal/service/rds/cluster_data_source.go
index 12e8a8421c3..8121ffb055a 100644
--- a/internal/service/rds/cluster_data_source.go
+++ b/internal/service/rds/cluster_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rds
 
 import (
@@ -59,6 +62,10 @@ func DataSourceCluster() *schema.Resource {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
+			"db_system_id": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
 			"enabled_cloudwatch_logs_exports": {
 				Type:     schema.TypeList,
 				Computed: true,
@@ -198,6 +205,7 @@ func dataSourceClusterRead(ctx context.Context, d *schema.ResourceData, meta int
 	}
 	d.Set("db_cluster_parameter_group_name", dbc.DBClusterParameterGroup)
 	d.Set("db_subnet_group_name", dbc.DBSubnetGroup)
+	d.Set("db_system_id", dbc.DBSystemId)
 	d.Set("enabled_cloudwatch_logs_exports", aws.StringValueSlice(dbc.EnabledCloudwatchLogsExports))
 	d.Set("endpoint", dbc.Endpoint)
 	d.Set("engine", dbc.Engine)
diff --git a/internal/service/rds/cluster_data_source_test.go b/internal/service/rds/cluster_data_source_test.go
index c696e3b84ea..c89f085065f 100644
--- a/internal/service/rds/cluster_data_source_test.go
+++ b/internal/service/rds/cluster_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rds_test
 
 import (
@@ -30,6 +33,7 @@ func TestAccRDSClusterDataSource_basic(t *testing.T) {
 					resource.TestCheckResourceAttrPair(dataSourceName, "database_name", resourceName, "database_name"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "db_cluster_parameter_group_name", resourceName, "db_cluster_parameter_group_name"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "db_subnet_group_name", resourceName, "db_subnet_group_name"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "db_system_id", resourceName, "db_system_id"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "engine", resourceName, "engine"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "engine_mode", resourceName, "engine_mode"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "engine_version", resourceName, "engine_version"),
@@ -89,14 +93,13 @@ resource "aws_db_subnet_group" "test" {
 }
 
 resource "aws_rds_cluster" "test" {
-  cluster_identifier              = %[1]q
-  database_name                   = "test"
-  engine                          = "aurora-mysql"
-  master_username                 = "tfacctest"
-  master_password                 = "avoid-plaintext-passwords"
-  db_cluster_parameter_group_name = "default.aurora-mysql5.7"
-  skip_final_snapshot             = true
-  db_subnet_group_name            = aws_db_subnet_group.test.name
+  cluster_identifier   = %[1]q
+  database_name        = "test"
+  engine               = "aurora-mysql"
+  master_username      = "tfacctest"
+  master_password      = "avoid-plaintext-passwords"
+  skip_final_snapshot  = true
+  db_subnet_group_name = aws_db_subnet_group.test.name
 
   tags = {
     Name = %[1]q
@@ -117,13 +120,13 @@ resource "aws_db_subnet_group" "test" {
 }
 
 resource "aws_rds_cluster" "test" {
-  cluster_identifier              = %[1]q
-  database_name                   = "test"
-  db_cluster_parameter_group_name = "default.aurora5.6"
-  db_subnet_group_name            = aws_db_subnet_group.test.name
-  manage_master_user_password     = true
-  master_username                 = "tfacctest"
-  skip_final_snapshot             = true
+  cluster_identifier          = %[1]q
+  database_name               = "test"
+  engine                      = "aurora-mysql"
+  db_subnet_group_name        = aws_db_subnet_group.test.name
+  manage_master_user_password = true
+  master_username             = "tfacctest"
+  skip_final_snapshot         = true
 
   tags = {
     Name = %[1]q
diff --git a/internal/service/rds/cluster_endpoint.go b/internal/service/rds/cluster_endpoint.go
index 4d7151a48ab..a769d65e56a 100644
--- a/internal/service/rds/cluster_endpoint.go
+++ b/internal/service/rds/cluster_endpoint.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rds
 
 import (
diff --git a/internal/service/rds/cluster_endpoint_test.go b/internal/service/rds/cluster_endpoint_test.go
index d050284a1a1..9d79ede738f 100644
--- a/internal/service/rds/cluster_endpoint_test.go
+++ b/internal/service/rds/cluster_endpoint_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rds_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"strings"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/rds"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -43,9 +46,9 @@ func TestAccRDSClusterEndpoint_basic(t *testing.T) {
 					testAccCheckClusterEndpointAttributes(&customReaderEndpoint),
 					testAccCheckClusterEndpointExists(ctx, defaultResourceName, &customEndpoint),
 					testAccCheckClusterEndpointAttributes(&customEndpoint),
-					acctest.MatchResourceAttrRegionalARN(readerResourceName, "arn", "rds", regexp.MustCompile(`cluster-endpoint:.+`)),
+					acctest.MatchResourceAttrRegionalARN(readerResourceName, "arn", "rds", regexache.MustCompile(`cluster-endpoint:.+`)),
 					resource.TestCheckResourceAttrSet(readerResourceName, "endpoint"),
-					acctest.MatchResourceAttrRegionalARN(defaultResourceName, "arn", "rds", regexp.MustCompile(`cluster-endpoint:.+`)),
+					acctest.MatchResourceAttrRegionalARN(defaultResourceName, "arn", "rds", regexache.MustCompile(`cluster-endpoint:.+`)),
 					resource.TestCheckResourceAttrSet(defaultResourceName, "endpoint"),
 					resource.TestCheckResourceAttr(defaultResourceName, "tags.%", "0"),
 					resource.TestCheckResourceAttr(readerResourceName, "tags.%", "0"),
diff --git a/internal/service/rds/cluster_instance.go b/internal/service/rds/cluster_instance.go
index 2bba0d5cc92..91301d74838 100644
--- a/internal/service/rds/cluster_instance.go
+++ b/internal/service/rds/cluster_instance.go
@@ -1,19 +1,24 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rds
 
 import (
 	"context"
+	"fmt"
 	"log"
 	"strings"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/rds"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/create"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
@@ -78,6 +83,12 @@ func ResourceClusterInstance() *schema.Resource {
 				Optional: true,
 				Default:  false,
 			},
+			"custom_iam_instance_profile": {
+				Type:         schema.TypeString,
+				Optional:     true,
+				ForceNew:     true,
+				ValidateFunc: validation.StringMatch(regexache.MustCompile(`^AWSRDSCustom.*$`), "must begin with AWSRDSCustom"),
+			},
 			"db_parameter_group_name": {
 				Type:     schema.TypeString,
 				Optional: true,
@@ -98,10 +109,13 @@ func ResourceClusterInstance() *schema.Resource {
 				Computed: true,
 			},
 			"engine": {
-				Type:         schema.TypeString,
-				Required:     true,
-				ForceNew:     true,
-				ValidateFunc: validClusterEngine(),
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+				ValidateFunc: validation.Any(
+					validation.StringMatch(regexache.MustCompile(fmt.Sprintf(`^%s.*$`, InstanceEngineCustomPrefix)), fmt.Sprintf("must begin with %s", InstanceEngineCustomPrefix)),
+					validation.StringInSlice(ClusterEngine_Values(), false),
+				),
 			},
 			"engine_version": {
 				Type:     schema.TypeString,
@@ -228,16 +242,11 @@ func resourceClusterInstanceCreate(ctx context.Context, d *schema.ResourceData,
 	conn := meta.(*conns.AWSClient).RDSConn(ctx)
 
 	clusterID := d.Get("cluster_identifier").(string)
-	var identifier string
-	if v, ok := d.GetOk("identifier"); ok {
-		identifier = v.(string)
-	} else {
-		if v, ok := d.GetOk("identifier_prefix"); ok {
-			identifier = id.PrefixedUniqueId(v.(string))
-		} else {
-			identifier = id.PrefixedUniqueId("tf-")
-		}
-	}
+	identifier := create.NewNameGenerator(
+		create.WithConfiguredName(d.Get("identifier").(string)),
+		create.WithConfiguredPrefix(d.Get("identifier_prefix").(string)),
+		create.WithDefaultPrefix("tf-"),
+	).Generate()
 	input := &rds.CreateDBInstanceInput{
 		AutoMinorVersionUpgrade: aws.Bool(d.Get("auto_minor_version_upgrade").(bool)),
 		CopyTagsToSnapshot:      aws.Bool(d.Get("copy_tags_to_snapshot").(bool)),
@@ -262,6 +271,10 @@ func resourceClusterInstanceCreate(ctx context.Context, d *schema.ResourceData,
 		input.DBSubnetGroupName = aws.String(v.(string))
 	}
 
+	if v, ok := d.GetOk("custom_iam_instance_profile"); ok {
+		input.CustomIamInstanceProfile = aws.String(v.(string))
+	}
+
 	if v, ok := d.GetOk("engine_version"); ok {
 		input.EngineVersion = aws.String(v.(string))
 	}
@@ -294,7 +307,6 @@ func resourceClusterInstanceCreate(ctx context.Context, d *schema.ResourceData,
 		input.PreferredMaintenanceWindow = aws.String(v.(string))
 	}
 
-	log.Printf("[DEBUG] Creating RDS Cluster Instance: %s", input)
 	outputRaw, err := tfresource.RetryWhenAWSErrMessageContains(ctx, propagationTimeout,
 		func() (interface{}, error) {
 			return conn.CreateDBInstanceWithContext(ctx, input)
@@ -388,6 +400,7 @@ func resourceClusterInstanceRead(ctx context.Context, d *schema.ResourceData, me
 	d.Set("ca_cert_identifier", db.CACertificateIdentifier)
 	d.Set("cluster_identifier", db.DBClusterIdentifier)
 	d.Set("copy_tags_to_snapshot", db.CopyTagsToSnapshot)
+	d.Set("custom_iam_instance_profile", db.CustomIamInstanceProfile)
 	if len(db.DBParameterGroups) > 0 && db.DBParameterGroups[0] != nil {
 		d.Set("db_parameter_group_name", db.DBParameterGroups[0].DBParameterGroupName)
 	}
@@ -397,6 +410,7 @@ func resourceClusterInstanceRead(ctx context.Context, d *schema.ResourceData, me
 	d.Set("dbi_resource_id", db.DbiResourceId)
 	d.Set("engine", db.Engine)
 	d.Set("identifier", db.DBInstanceIdentifier)
+	d.Set("identifier_prefix", create.NamePrefixFromName(aws.StringValue(db.DBInstanceIdentifier)))
 	d.Set("instance_class", db.DBInstanceClass)
 	d.Set("kms_key_id", db.KmsKeyId)
 	d.Set("monitoring_interval", db.MonitoringInterval)
@@ -509,6 +523,12 @@ func resourceClusterInstanceDelete(ctx context.Context, d *schema.ResourceData,
 		DBInstanceIdentifier: aws.String(d.Id()),
 	}
 
+	// Automatically set skip_final_snapshot = true for RDS Custom instances
+	if strings.HasPrefix(d.Get("engine").(string), InstanceEngineCustomPrefix) {
+		log.Printf("[DEBUG] RDS Custom engine detected (%s) applying SkipFinalSnapshot: %s", d.Get("engine").(string), "true")
+		input.SkipFinalSnapshot = aws.Bool(true)
+	}
+
 	log.Printf("[DEBUG] Deleting RDS Cluster Instance: %s", d.Id())
 	_, err := tfresource.RetryWhenAWSErrMessageContains(ctx, d.Timeout(schema.TimeoutDelete),
 		func() (interface{}, error) {
diff --git a/internal/service/rds/cluster_instance_test.go b/internal/service/rds/cluster_instance_test.go
index d8d8d97593f..ae082dff41f 100644
--- a/internal/service/rds/cluster_instance_test.go
+++ b/internal/service/rds/cluster_instance_test.go
@@ -1,12 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rds_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
-	"strings"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/rds"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -39,14 +41,17 @@ func TestAccRDSClusterInstance_basic(t *testing.T) {
 				Config: testAccClusterInstanceConfig_basic(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckClusterInstanceExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "rds", regexp.MustCompile(`db:.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "rds", regexache.MustCompile(`db:.+`)),
 					resource.TestCheckResourceAttr(resourceName, "auto_minor_version_upgrade", "true"),
 					resource.TestCheckResourceAttrSet(resourceName, "availability_zone"),
 					resource.TestCheckResourceAttr(resourceName, "cluster_identifier", rName),
 					resource.TestCheckResourceAttr(resourceName, "copy_tags_to_snapshot", "false"),
+					resource.TestCheckResourceAttr(resourceName, "custom_iam_instance_profile", ""),
 					resource.TestCheckResourceAttrSet(resourceName, "dbi_resource_id"),
 					resource.TestCheckResourceAttr(resourceName, "engine", "aurora-mysql"),
 					resource.TestCheckResourceAttrSet(resourceName, "engine_version"),
+					resource.TestCheckResourceAttr(resourceName, "identifier", rName),
+					resource.TestCheckResourceAttr(resourceName, "identifier_prefix", ""),
 					resource.TestCheckResourceAttr(resourceName, "network_type", "IPV4"),
 					resource.TestCheckResourceAttrSet(resourceName, "preferred_backup_window"),
 					resource.TestCheckResourceAttrSet(resourceName, "preferred_maintenance_window"),
@@ -58,7 +63,6 @@ func TestAccRDSClusterInstance_basic(t *testing.T) {
 				ImportStateVerify: true,
 				ImportStateVerifyIgnore: []string{
 					"apply_immediately",
-					"identifier_prefix",
 				},
 			},
 			{
@@ -100,7 +104,7 @@ func TestAccRDSClusterInstance_disappears(t *testing.T) {
 	})
 }
 
-func TestAccRDSClusterInstance_tags(t *testing.T) {
+func TestAccRDSClusterInstance_identifierGenerated(t *testing.T) {
 	ctx := acctest.Context(t)
 	if testing.Short() {
 		t.Skip("skipping long-running test in short mode")
@@ -117,11 +121,11 @@ func TestAccRDSClusterInstance_tags(t *testing.T) {
 		CheckDestroy:             testAccCheckClusterInstanceDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccClusterInstanceConfig_tags1(rName, "key1", "value1"),
-				Check: resource.ComposeAggregateTestCheckFunc(
+				Config: testAccClusterInstanceConfig_identifierGenerated(rName),
+				Check: resource.ComposeTestCheckFunc(
 					testAccCheckClusterInstanceExists(ctx, resourceName, &v),
-					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
-					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
+					acctest.CheckResourceAttrNameGeneratedWithPrefix(resourceName, "identifier", "tf-"),
+					resource.TestCheckResourceAttr(resourceName, "identifier_prefix", "tf-"),
 				),
 			},
 			{
@@ -130,31 +134,13 @@ func TestAccRDSClusterInstance_tags(t *testing.T) {
 				ImportStateVerify: true,
 				ImportStateVerifyIgnore: []string{
 					"apply_immediately",
-					"identifier_prefix",
 				},
 			},
-			{
-				Config: testAccClusterInstanceConfig_tags2(rName, "key1", "value1updated", "key2", "value2"),
-				Check: resource.ComposeAggregateTestCheckFunc(
-					testAccCheckClusterInstanceExists(ctx, resourceName, &v),
-					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
-					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1updated"),
-					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
-				),
-			},
-			{
-				Config: testAccClusterInstanceConfig_tags1(rName, "key2", "value2"),
-				Check: resource.ComposeAggregateTestCheckFunc(
-					testAccCheckClusterInstanceExists(ctx, resourceName, &v),
-					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
-					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
-				),
-			},
 		},
 	})
 }
 
-func TestAccRDSClusterInstance_isAlreadyBeingDeleted(t *testing.T) {
+func TestAccRDSClusterInstance_identifierPrefix(t *testing.T) {
 	ctx := acctest.Context(t)
 	if testing.Short() {
 		t.Skip("skipping long-running test in short mode")
@@ -171,32 +157,26 @@ func TestAccRDSClusterInstance_isAlreadyBeingDeleted(t *testing.T) {
 		CheckDestroy:             testAccCheckClusterInstanceDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccClusterInstanceConfig_basic(rName),
+				Config: testAccClusterInstanceConfig_identifierPrefix(rName, "tf-acc-test-prefix-"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckClusterInstanceExists(ctx, resourceName, &v),
+					acctest.CheckResourceAttrNameFromPrefix(resourceName, "identifier", "tf-acc-test-prefix-"),
+					resource.TestCheckResourceAttr(resourceName, "identifier_prefix", "tf-acc-test-prefix-"),
 				),
 			},
 			{
-				PreConfig: func() {
-					// Get Database Instance into deleting state
-					conn := acctest.Provider.Meta().(*conns.AWSClient).RDSConn(ctx)
-					input := &rds.DeleteDBInstanceInput{
-						DBInstanceIdentifier: aws.String(rName),
-						SkipFinalSnapshot:    aws.Bool(true),
-					}
-					_, err := conn.DeleteDBInstanceWithContext(ctx, input)
-					if err != nil {
-						t.Fatalf("error deleting Database Instance: %s", err)
-					}
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{
+					"apply_immediately",
 				},
-				Config:  testAccClusterInstanceConfig_basic(rName),
-				Destroy: true,
 			},
 		},
 	})
 }
 
-func TestAccRDSClusterInstance_az(t *testing.T) {
+func TestAccRDSClusterInstance_tags(t *testing.T) {
 	ctx := acctest.Context(t)
 	if testing.Short() {
 		t.Skip("skipping long-running test in short mode")
@@ -205,7 +185,6 @@ func TestAccRDSClusterInstance_az(t *testing.T) {
 	var v rds.DBInstance
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_rds_cluster_instance.test"
-	availabilityZonesDataSourceName := "data.aws_availability_zones.available"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
@@ -214,10 +193,11 @@ func TestAccRDSClusterInstance_az(t *testing.T) {
 		CheckDestroy:             testAccCheckClusterInstanceDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccClusterInstanceConfig_az(rName),
-				Check: resource.ComposeTestCheckFunc(
+				Config: testAccClusterInstanceConfig_tags1(rName, "key1", "value1"),
+				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckClusterInstanceExists(ctx, resourceName, &v),
-					resource.TestCheckResourceAttrPair(resourceName, "availability_zone", availabilityZonesDataSourceName, "names.0"),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
 				),
 			},
 			{
@@ -226,14 +206,30 @@ func TestAccRDSClusterInstance_az(t *testing.T) {
 				ImportStateVerify: true,
 				ImportStateVerifyIgnore: []string{
 					"apply_immediately",
-					"identifier_prefix",
 				},
 			},
+			{
+				Config: testAccClusterInstanceConfig_tags2(rName, "key1", "value1updated", "key2", "value2"),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckClusterInstanceExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1updated"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
+				),
+			},
+			{
+				Config: testAccClusterInstanceConfig_tags1(rName, "key2", "value2"),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckClusterInstanceExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
+				),
+			},
 		},
 	})
 }
 
-func TestAccRDSClusterInstance_identifierPrefix(t *testing.T) {
+func TestAccRDSClusterInstance_isAlreadyBeingDeleted(t *testing.T) {
 	ctx := acctest.Context(t)
 	if testing.Short() {
 		t.Skip("skipping long-running test in short mode")
@@ -250,28 +246,32 @@ func TestAccRDSClusterInstance_identifierPrefix(t *testing.T) {
 		CheckDestroy:             testAccCheckClusterInstanceDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccClusterInstanceConfig_identifierPrefix(rName, "tf-acc-test-prefix-"),
+				Config: testAccClusterInstanceConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckClusterInstanceExists(ctx, resourceName, &v),
-					resource.TestCheckResourceAttr(resourceName, "db_subnet_group_name", rName),
-					acctest.CheckResourceAttrNameFromPrefix(resourceName, "identifier", "tf-acc-test-prefix-"),
-					resource.TestCheckResourceAttr(resourceName, "identifier_prefix", "tf-acc-test-prefix-"),
 				),
 			},
 			{
-				ResourceName:      resourceName,
-				ImportState:       true,
-				ImportStateVerify: true,
-				ImportStateVerifyIgnore: []string{
-					"apply_immediately",
-					"identifier_prefix",
+				PreConfig: func() {
+					// Get Database Instance into deleting state
+					conn := acctest.Provider.Meta().(*conns.AWSClient).RDSConn(ctx)
+					input := &rds.DeleteDBInstanceInput{
+						DBInstanceIdentifier: aws.String(rName),
+						SkipFinalSnapshot:    aws.Bool(true),
+					}
+					_, err := conn.DeleteDBInstanceWithContext(ctx, input)
+					if err != nil {
+						t.Fatalf("error deleting Database Instance: %s", err)
+					}
 				},
+				Config:  testAccClusterInstanceConfig_basic(rName),
+				Destroy: true,
 			},
 		},
 	})
 }
 
-func TestAccRDSClusterInstance_identifierGenerated(t *testing.T) {
+func TestAccRDSClusterInstance_az(t *testing.T) {
 	ctx := acctest.Context(t)
 	if testing.Short() {
 		t.Skip("skipping long-running test in short mode")
@@ -280,6 +280,7 @@ func TestAccRDSClusterInstance_identifierGenerated(t *testing.T) {
 	var v rds.DBInstance
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_rds_cluster_instance.test"
+	availabilityZonesDataSourceName := "data.aws_availability_zones.available"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
@@ -288,16 +289,10 @@ func TestAccRDSClusterInstance_identifierGenerated(t *testing.T) {
 		CheckDestroy:             testAccCheckClusterInstanceDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccClusterInstanceConfig_identifierGenerated(rName),
+				Config: testAccClusterInstanceConfig_az(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckClusterInstanceExists(ctx, resourceName, &v),
-					resource.TestCheckResourceAttrWith(resourceName, "identifier", func(value string) error {
-						if !strings.HasPrefix(value, "tf-") {
-							return fmt.Errorf("incorrect format: %s", value)
-						}
-						return nil
-					}),
-					resource.TestCheckNoResourceAttr(resourceName, "identifier_prefix"),
+					resource.TestCheckResourceAttrPair(resourceName, "availability_zone", availabilityZonesDataSourceName, "names.0"),
 				),
 			},
 			{
@@ -306,7 +301,6 @@ func TestAccRDSClusterInstance_identifierGenerated(t *testing.T) {
 				ImportStateVerify: true,
 				ImportStateVerifyIgnore: []string{
 					"apply_immediately",
-					"identifier_prefix",
 				},
 			},
 		},
@@ -343,7 +337,6 @@ func TestAccRDSClusterInstance_kmsKey(t *testing.T) {
 				ImportStateVerify: true,
 				ImportStateVerifyIgnore: []string{
 					"apply_immediately",
-					"identifier_prefix",
 				},
 			},
 		},
@@ -379,7 +372,6 @@ func TestAccRDSClusterInstance_publiclyAccessible(t *testing.T) {
 				ImportStateVerify: true,
 				ImportStateVerifyIgnore: []string{
 					"apply_immediately",
-					"identifier_prefix",
 				},
 			},
 			{
@@ -422,7 +414,6 @@ func TestAccRDSClusterInstance_copyTagsToSnapshot(t *testing.T) {
 				ImportStateVerify: true,
 				ImportStateVerifyIgnore: []string{
 					"apply_immediately",
-					"identifier_prefix",
 				},
 			},
 			{
@@ -466,7 +457,6 @@ func TestAccRDSClusterInstance_caCertificateIdentifier(t *testing.T) {
 				ImportStateVerify: true,
 				ImportStateVerifyIgnore: []string{
 					"apply_immediately",
-					"identifier_prefix",
 				},
 			},
 		},
@@ -502,7 +492,6 @@ func TestAccRDSClusterInstance_monitoringInterval(t *testing.T) {
 				ImportStateVerify: true,
 				ImportStateVerifyIgnore: []string{
 					"apply_immediately",
-					"identifier_prefix",
 				},
 			},
 			{
@@ -560,7 +549,6 @@ func TestAccRDSClusterInstance_MonitoringRoleARN_enabledToDisabled(t *testing.T)
 				ImportStateVerify: true,
 				ImportStateVerifyIgnore: []string{
 					"apply_immediately",
-					"identifier_prefix",
 				},
 			},
 			{
@@ -604,7 +592,6 @@ func TestAccRDSClusterInstance_MonitoringRoleARN_enabledToRemoved(t *testing.T)
 				ImportStateVerify: true,
 				ImportStateVerifyIgnore: []string{
 					"apply_immediately",
-					"identifier_prefix",
 				},
 			},
 			{
@@ -646,7 +633,6 @@ func TestAccRDSClusterInstance_MonitoringRoleARN_removedToEnabled(t *testing.T)
 				ImportStateVerify: true,
 				ImportStateVerifyIgnore: []string{
 					"apply_immediately",
-					"identifier_prefix",
 				},
 			},
 			{
@@ -690,7 +676,6 @@ func TestAccRDSClusterInstance_PerformanceInsightsEnabled_auroraMySQL1(t *testin
 				ImportStateVerify: true,
 				ImportStateVerifyIgnore: []string{
 					"apply_immediately",
-					"identifier_prefix",
 				},
 			},
 		},
@@ -727,7 +712,6 @@ func TestAccRDSClusterInstance_PerformanceInsightsEnabled_auroraPostgresql(t *te
 				ImportStateVerify: true,
 				ImportStateVerifyIgnore: []string{
 					"apply_immediately",
-					"identifier_prefix",
 				},
 			},
 		},
@@ -766,7 +750,6 @@ func TestAccRDSClusterInstance_PerformanceInsightsKMSKeyID_auroraMySQL1(t *testi
 				ImportStateVerify: true,
 				ImportStateVerifyIgnore: []string{
 					"apply_immediately",
-					"identifier_prefix",
 				},
 			},
 		},
@@ -803,12 +786,11 @@ func TestAccRDSClusterInstance_PerformanceInsightsKMSKeyIDAuroraMySQL1_defaultKe
 				ImportStateVerify: true,
 				ImportStateVerifyIgnore: []string{
 					"apply_immediately",
-					"identifier_prefix",
 				},
 			},
 			{
 				Config:      testAccClusterInstanceConfig_performanceInsightsKMSKeyIDAuroraMySQL1(rName, engine),
-				ExpectError: regexp.MustCompile(`InvalidParameterCombination: You .* change your Performance Insights KMS key`),
+				ExpectError: regexache.MustCompile(`InvalidParameterCombination: You .* change your Performance Insights KMS key`),
 			},
 		},
 	})
@@ -847,7 +829,6 @@ func TestAccRDSClusterInstance_performanceInsightsRetentionPeriod(t *testing.T)
 				ImportStateVerify: true,
 				ImportStateVerifyIgnore: []string{
 					"apply_immediately",
-					"identifier_prefix",
 				},
 			},
 			{
@@ -902,7 +883,6 @@ func TestAccRDSClusterInstance_PerformanceInsightsKMSKeyID_auroraPostgresql(t *t
 				ImportStateVerify: true,
 				ImportStateVerifyIgnore: []string{
 					"apply_immediately",
-					"identifier_prefix",
 				},
 			},
 		},
@@ -939,12 +919,11 @@ func TestAccRDSClusterInstance_PerformanceInsightsKMSKeyIDAuroraPostgresql_defau
 				ImportStateVerify: true,
 				ImportStateVerifyIgnore: []string{
 					"apply_immediately",
-					"identifier_prefix",
 				},
 			},
 			{
 				Config:      testAccClusterInstanceConfig_performanceInsightsKMSKeyIDAuroraPostgresql(rName, engine),
-				ExpectError: regexp.MustCompile(`InvalidParameterCombination: You .* change your Performance Insights KMS key`),
+				ExpectError: regexache.MustCompile(`InvalidParameterCombination: You .* change your Performance Insights KMS key`),
 			},
 		},
 	})
@@ -1131,31 +1110,63 @@ resource "aws_db_parameter_group" "test" {
 `, rName))
 }
 
-func testAccClusterInstanceConfig_modified(rName string) string {
-	return acctest.ConfigCompose(testAccClusterInstanceConfig_base(rName, "aurora-mysql"), fmt.Sprintf(`
-resource "aws_rds_cluster_instance" "test" {
-  identifier                 = %[1]q
-  engine                     = data.aws_rds_engine_version.default.engine
-  cluster_identifier         = aws_rds_cluster.test.id
-  instance_class             = data.aws_rds_orderable_db_instance.test.instance_class
-  db_parameter_group_name    = aws_db_parameter_group.test.name
-  auto_minor_version_upgrade = false
-  promotion_tier             = "3"
+func testAccClusterInstanceConfig_identifierGenerated(rName string) string {
+	return acctest.ConfigCompose(
+		acctest.ConfigVPCWithSubnets(rName, 2),
+		testAccClusterInstanceConfig_orderableEngineBase("aurora-mysql", false),
+		fmt.Sprintf(`
+resource "aws_rds_cluster" "test" {
+  cluster_identifier   = %[1]q
+  master_username      = "root"
+  master_password      = "password"
+  db_subnet_group_name = aws_db_subnet_group.test.name
+  skip_final_snapshot  = true
+  engine               = data.aws_rds_engine_version.default.engine
+  engine_version       = data.aws_rds_engine_version.default.version
 }
 
-resource "aws_db_parameter_group" "test" {
-  name   = %[1]q
-  family = data.aws_rds_engine_version.default.parameter_group_family
+resource "aws_rds_cluster_instance" "test" {
+  cluster_identifier = aws_rds_cluster.test.id
+  engine             = data.aws_rds_engine_version.default.engine
+  instance_class     = data.aws_rds_orderable_db_instance.test.instance_class
+}
 
-  parameter {
-    name         = "back_log"
-    value        = "32767"
-    apply_method = "pending-reboot"
-  }
+resource "aws_db_subnet_group" "test" {
+  name       = %[1]q
+  subnet_ids = aws_subnet.test[*].id
 }
 `, rName))
 }
 
+func testAccClusterInstanceConfig_identifierPrefix(rName, identifierPrefix string) string {
+	return acctest.ConfigCompose(
+		acctest.ConfigVPCWithSubnets(rName, 2),
+		testAccClusterInstanceConfig_orderableEngineBase("aurora-mysql", false),
+		fmt.Sprintf(`
+resource "aws_rds_cluster" "test" {
+  cluster_identifier   = %[1]q
+  db_subnet_group_name = aws_db_subnet_group.test.name
+  engine               = data.aws_rds_engine_version.default.engine
+  engine_version       = data.aws_rds_engine_version.default.version
+  master_password      = "password"
+  master_username      = "root"
+  skip_final_snapshot  = true
+}
+
+resource "aws_rds_cluster_instance" "test" {
+  identifier_prefix  = %[2]q
+  engine             = data.aws_rds_engine_version.default.engine
+  cluster_identifier = aws_rds_cluster.test.id
+  instance_class     = data.aws_rds_orderable_db_instance.test.instance_class
+}
+
+resource "aws_db_subnet_group" "test" {
+  name       = %[1]q
+  subnet_ids = aws_subnet.test[*].id
+}
+`, rName, identifierPrefix))
+}
+
 func testAccClusterInstanceConfig_tags1(rName, tagKey1, tagValue1 string) string {
 	return acctest.ConfigCompose(testAccClusterInstanceConfig_base(rName, "aurora-mysql"), fmt.Sprintf(`
 resource "aws_rds_cluster_instance" "test" {
@@ -1213,16 +1224,16 @@ resource "aws_db_parameter_group" "test" {
 `, rName, tagKey1, tagValue1, tagKey2, tagValue2))
 }
 
-func testAccClusterInstanceConfig_az(rName string) string {
+func testAccClusterInstanceConfig_modified(rName string) string {
 	return acctest.ConfigCompose(testAccClusterInstanceConfig_base(rName, "aurora-mysql"), fmt.Sprintf(`
 resource "aws_rds_cluster_instance" "test" {
-  identifier              = %[1]q
-  engine                  = data.aws_rds_engine_version.default.engine
-  cluster_identifier      = aws_rds_cluster.test.id
-  instance_class          = data.aws_rds_orderable_db_instance.test.instance_class
-  db_parameter_group_name = aws_db_parameter_group.test.name
-  promotion_tier          = "3"
-  availability_zone       = data.aws_availability_zones.available.names[0]
+  identifier                 = %[1]q
+  engine                     = data.aws_rds_engine_version.default.engine
+  cluster_identifier         = aws_rds_cluster.test.id
+  instance_class             = data.aws_rds_orderable_db_instance.test.instance_class
+  db_parameter_group_name    = aws_db_parameter_group.test.name
+  auto_minor_version_upgrade = false
+  promotion_tier             = "3"
 }
 
 resource "aws_db_parameter_group" "test" {
@@ -1238,59 +1249,27 @@ resource "aws_db_parameter_group" "test" {
 `, rName))
 }
 
-func testAccClusterInstanceConfig_identifierPrefix(rName, identifierPrefix string) string {
-	return acctest.ConfigCompose(
-		acctest.ConfigVPCWithSubnets(rName, 2),
-		testAccClusterInstanceConfig_orderableEngineBase("aurora-mysql", false),
-		fmt.Sprintf(`
-resource "aws_rds_cluster" "test" {
-  cluster_identifier   = %[1]q
-  db_subnet_group_name = aws_db_subnet_group.test.name
-  engine               = data.aws_rds_engine_version.default.engine
-  engine_version       = data.aws_rds_engine_version.default.version
-  master_password      = "password"
-  master_username      = "root"
-  skip_final_snapshot  = true
-}
-
+func testAccClusterInstanceConfig_az(rName string) string {
+	return acctest.ConfigCompose(testAccClusterInstanceConfig_base(rName, "aurora-mysql"), fmt.Sprintf(`
 resource "aws_rds_cluster_instance" "test" {
-  identifier_prefix  = %[2]q
-  engine             = data.aws_rds_engine_version.default.engine
-  cluster_identifier = aws_rds_cluster.test.id
-  instance_class     = data.aws_rds_orderable_db_instance.test.instance_class
-}
-
-resource "aws_db_subnet_group" "test" {
-  name       = %[1]q
-  subnet_ids = aws_subnet.test[*].id
-}
-`, rName, identifierPrefix))
-}
-
-func testAccClusterInstanceConfig_identifierGenerated(rName string) string {
-	return acctest.ConfigCompose(
-		acctest.ConfigVPCWithSubnets(rName, 2),
-		testAccClusterInstanceConfig_orderableEngineBase("aurora-mysql", false),
-		fmt.Sprintf(`
-resource "aws_rds_cluster" "test" {
-  cluster_identifier   = %[1]q
-  master_username      = "root"
-  master_password      = "password"
-  db_subnet_group_name = aws_db_subnet_group.test.name
-  skip_final_snapshot  = true
-  engine               = data.aws_rds_engine_version.default.engine
-  engine_version       = data.aws_rds_engine_version.default.version
+  identifier              = %[1]q
+  engine                  = data.aws_rds_engine_version.default.engine
+  cluster_identifier      = aws_rds_cluster.test.id
+  instance_class          = data.aws_rds_orderable_db_instance.test.instance_class
+  db_parameter_group_name = aws_db_parameter_group.test.name
+  promotion_tier          = "3"
+  availability_zone       = data.aws_availability_zones.available.names[0]
 }
 
-resource "aws_rds_cluster_instance" "test" {
-  cluster_identifier = aws_rds_cluster.test.id
-  engine             = data.aws_rds_engine_version.default.engine
-  instance_class     = data.aws_rds_orderable_db_instance.test.instance_class
-}
+resource "aws_db_parameter_group" "test" {
+  name   = %[1]q
+  family = data.aws_rds_engine_version.default.parameter_group_family
 
-resource "aws_db_subnet_group" "test" {
-  name       = %[1]q
-  subnet_ids = aws_subnet.test[*].id
+  parameter {
+    name         = "back_log"
+    value        = "32767"
+    apply_method = "pending-reboot"
+  }
 }
 `, rName))
 }
@@ -1300,6 +1279,9 @@ func testAccClusterInstanceConfig_kmsKey(rName string) string {
 		acctest.ConfigAvailableAZsNoOptIn(),
 		testAccClusterInstanceConfig_orderableEngineBase("aurora-mysql", false),
 		fmt.Sprintf(`
+data "aws_caller_identity" "current" {}
+data "aws_partition" "current" {}
+
 resource "aws_kms_key" "test" {
   description = %[1]q
 
@@ -1312,7 +1294,7 @@ resource "aws_kms_key" "test" {
       "Sid": "Enable IAM User Permissions",
       "Effect": "Allow",
       "Principal": {
-        "AWS": "*"
+        "AWS": "arn:${data.aws_partition.current.partition}:iam::${data.aws_caller_identity.current.account_id}:root"
       },
       "Action": "kms:*",
       "Resource": "*"
diff --git a/internal/service/rds/cluster_parameter_group.go b/internal/service/rds/cluster_parameter_group.go
index 3f750044e87..1a8c89f6566 100644
--- a/internal/service/rds/cluster_parameter_group.go
+++ b/internal/service/rds/cluster_parameter_group.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rds
 
 import (
@@ -17,7 +20,7 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/create"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
-	"github.com/hashicorp/terraform-provider-aws/internal/slices"
+	tfslices "github.com/hashicorp/terraform-provider-aws/internal/slices"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
@@ -233,7 +236,7 @@ func resourceClusterParameterGroupUpdate(ctx context.Context, d *schema.Resource
 		ns := n.(*schema.Set)
 
 		// Expand the "parameter" set to aws-sdk-go compat []rds.Parameter.
-		for _, chunk := range slices.Chunks(expandParameters(ns.Difference(os).List()), maxParamModifyChunk) {
+		for _, chunk := range tfslices.Chunks(expandParameters(ns.Difference(os).List()), maxParamModifyChunk) {
 			input := &rds.ModifyDBClusterParameterGroupInput{
 				DBClusterParameterGroupName: aws.String(d.Id()),
 				Parameters:                  chunk,
@@ -260,7 +263,7 @@ func resourceClusterParameterGroupUpdate(ctx context.Context, d *schema.Resource
 		}
 
 		// Reset parameters that have been removed.
-		for _, chunk := range slices.Chunks(maps.Values(toRemove), maxParamModifyChunk) {
+		for _, chunk := range tfslices.Chunks(maps.Values(toRemove), maxParamModifyChunk) {
 			input := &rds.ResetDBClusterParameterGroupInput{
 				DBClusterParameterGroupName: aws.String(d.Id()),
 				Parameters:                  chunk,
diff --git a/internal/service/rds/cluster_parameter_group_test.go b/internal/service/rds/cluster_parameter_group_test.go
index dc508db7d1f..70e0fa04a4b 100644
--- a/internal/service/rds/cluster_parameter_group_test.go
+++ b/internal/service/rds/cluster_parameter_group_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rds_test
 
 import (
diff --git a/internal/service/rds/cluster_role_association.go b/internal/service/rds/cluster_role_association.go
index 35fe83e890f..2293b3c61fe 100644
--- a/internal/service/rds/cluster_role_association.go
+++ b/internal/service/rds/cluster_role_association.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rds
 
 import (
diff --git a/internal/service/rds/cluster_role_association_test.go b/internal/service/rds/cluster_role_association_test.go
index 875ad384704..1908a0a778c 100644
--- a/internal/service/rds/cluster_role_association_test.go
+++ b/internal/service/rds/cluster_role_association_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rds_test
 
 import (
diff --git a/internal/service/rds/cluster_snapshot.go b/internal/service/rds/cluster_snapshot.go
index 71b80c93fe5..f2fd2a2edf8 100644
--- a/internal/service/rds/cluster_snapshot.go
+++ b/internal/service/rds/cluster_snapshot.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rds
 
 import (
 	"context"
 	"log"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/rds"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -15,6 +18,7 @@ import (
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
+	tfslices "github.com/hashicorp/terraform-provider-aws/internal/slices"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
@@ -23,7 +27,7 @@ import (
 
 const clusterSnapshotCreateTimeout = 2 * time.Minute
 
-// @SDKResource("aws_db_cluster_snapshot", name="Cluster Snapshot")
+// @SDKResource("aws_db_cluster_snapshot", name="DB Cluster Snapshot")
 // @Tags(identifierAttribute="db_cluster_snapshot_arn")
 func ResourceClusterSnapshot() *schema.Resource {
 	return &schema.Resource{
@@ -65,10 +69,10 @@ func ResourceClusterSnapshot() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 63),
-					validation.StringMatch(regexp.MustCompile(`^[0-9a-z-]+$`), "must contain only lowercase alphanumeric characters and hyphens"),
-					validation.StringMatch(regexp.MustCompile(`^[a-z]`), "must begin with a lowercase letter"),
-					validation.StringDoesNotMatch(regexp.MustCompile(`--`), "cannot contain two consecutive hyphens"),
-					validation.StringDoesNotMatch(regexp.MustCompile(`-$`), "cannot end with a hyphen"),
+					validation.StringMatch(regexache.MustCompile(`^[0-9a-z-]+$`), "must contain only lowercase alphanumeric characters and hyphens"),
+					validation.StringMatch(regexache.MustCompile(`^[a-z]`), "must begin with a lowercase letter"),
+					validation.StringDoesNotMatch(regexache.MustCompile(`--`), "cannot contain two consecutive hyphens"),
+					validation.StringDoesNotMatch(regexache.MustCompile(`-$`), "cannot end with a hyphen"),
 				),
 			},
 			"engine": {
@@ -216,38 +220,61 @@ func FindDBClusterSnapshotByID(ctx context.Context, conn *rds.RDS, id string) (*
 	input := &rds.DescribeDBClusterSnapshotsInput{
 		DBClusterSnapshotIdentifier: aws.String(id),
 	}
+	output, err := findDBClusterSnapshot(ctx, conn, input, tfslices.PredicateTrue[*rds.DBClusterSnapshot]())
 
-	output, err := conn.DescribeDBClusterSnapshotsWithContext(ctx, input)
+	if err != nil {
+		return nil, err
+	}
 
-	if tfawserr.ErrCodeEquals(err, rds.ErrCodeDBClusterSnapshotNotFoundFault) {
+	// Eventual consistency check.
+	if aws.StringValue(output.DBClusterSnapshotIdentifier) != id {
 		return nil, &retry.NotFoundError{
-			LastError:   err,
 			LastRequest: input,
 		}
 	}
 
+	return output, nil
+}
+
+func findDBClusterSnapshot(ctx context.Context, conn *rds.RDS, input *rds.DescribeDBClusterSnapshotsInput, filter tfslices.Predicate[*rds.DBClusterSnapshot]) (*rds.DBClusterSnapshot, error) {
+	output, err := findDBClusterSnapshots(ctx, conn, input, filter)
+
 	if err != nil {
 		return nil, err
 	}
 
-	if output == nil || len(output.DBClusterSnapshots) == 0 || output.DBClusterSnapshots[0] == nil {
-		return nil, tfresource.NewEmptyResultError(input)
-	}
+	return tfresource.AssertSinglePtrResult(output)
+}
 
-	if count := len(output.DBClusterSnapshots); count > 1 {
-		return nil, tfresource.NewTooManyResultsError(count, input)
-	}
+func findDBClusterSnapshots(ctx context.Context, conn *rds.RDS, input *rds.DescribeDBClusterSnapshotsInput, filter tfslices.Predicate[*rds.DBClusterSnapshot]) ([]*rds.DBClusterSnapshot, error) {
+	var output []*rds.DBClusterSnapshot
 
-	dbClusterSnapshot := output.DBClusterSnapshots[0]
+	err := conn.DescribeDBClusterSnapshotsPagesWithContext(ctx, input, func(page *rds.DescribeDBClusterSnapshotsOutput, lastPage bool) bool {
+		if page == nil {
+			return !lastPage
+		}
 
-	// Eventual consistency check.
-	if aws.StringValue(dbClusterSnapshot.DBClusterSnapshotIdentifier) != id {
+		for _, v := range page.DBClusterSnapshots {
+			if v != nil && filter(v) {
+				output = append(output, v)
+			}
+		}
+
+		return !lastPage
+	})
+
+	if tfawserr.ErrCodeEquals(err, rds.ErrCodeDBClusterSnapshotNotFoundFault) {
 		return nil, &retry.NotFoundError{
+			LastError:   err,
 			LastRequest: input,
 		}
 	}
 
-	return dbClusterSnapshot, nil
+	if err != nil {
+		return nil, err
+	}
+
+	return output, nil
 }
 
 func statusDBClusterSnapshot(ctx context.Context, conn *rds.RDS, id string) retry.StateRefreshFunc {
diff --git a/internal/service/rds/cluster_snapshot_data_source.go b/internal/service/rds/cluster_snapshot_data_source.go
index ebc014c1b62..bf5336deada 100644
--- a/internal/service/rds/cluster_snapshot_data_source.go
+++ b/internal/service/rds/cluster_snapshot_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rds
 
 import (
@@ -11,10 +14,13 @@ import (
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
+	tfslices "github.com/hashicorp/terraform-provider-aws/internal/slices"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
+	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
-// @SDKDataSource("aws_db_cluster_snapshot")
+// @SDKDataSource("aws_db_cluster_snapshot", name="DB Cluster Snapshot")
+// @Tags
 func DataSourceClusterSnapshot() *schema.Resource {
 	return &schema.Resource{
 		ReadWithoutTimeout: dataSourceClusterSnapshotRead,
@@ -30,18 +36,16 @@ func DataSourceClusterSnapshot() *schema.Resource {
 				Computed: true,
 			},
 			"db_cluster_identifier": {
-				Type:         schema.TypeString,
-				Optional:     true,
-				AtLeastOneOf: []string{"db_cluster_identifier", "db_cluster_snapshot_identifier"},
+				Type:     schema.TypeString,
+				Optional: true,
 			},
 			"db_cluster_snapshot_arn": {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
 			"db_cluster_snapshot_identifier": {
-				Type:         schema.TypeString,
-				Optional:     true,
-				AtLeastOneOf: []string{"db_cluster_identifier", "db_cluster_snapshot_identifier"},
+				Type:     schema.TypeString,
+				Optional: true,
 			},
 			"engine": {
 				Type:     schema.TypeString,
@@ -98,7 +102,7 @@ func DataSourceClusterSnapshot() *schema.Resource {
 				Type:     schema.TypeBool,
 				Computed: true,
 			},
-			"tags": tftags.TagsSchemaComputed(),
+			names.AttrTags: tftags.TagsSchemaComputed(),
 			"vpc_id": {
 				Type:     schema.TypeString,
 				Computed: true,
@@ -110,7 +114,6 @@ func DataSourceClusterSnapshot() *schema.Resource {
 func dataSourceClusterSnapshotRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).RDSConn(ctx)
-	ignoreTagsConfig := meta.(*conns.AWSClient).IgnoreTagsConfig
 
 	input := &rds.DescribeDBClusterSnapshotsInput{
 		IncludePublic: aws.Bool(d.Get("include_public").(bool)),
@@ -129,25 +132,32 @@ func dataSourceClusterSnapshotRead(ctx context.Context, d *schema.ResourceData,
 		input.SnapshotType = aws.String(v.(string))
 	}
 
-	output, err := conn.DescribeDBClusterSnapshotsWithContext(ctx, input)
+	f := tfslices.PredicateTrue[*rds.DBClusterSnapshot]()
+	if tags := getTagsIn(ctx); len(tags) > 0 {
+		f = func(v *rds.DBClusterSnapshot) bool {
+			return KeyValueTags(ctx, v.TagList).ContainsAll(KeyValueTags(ctx, tags))
+		}
+	}
+
+	snapshots, err := findDBClusterSnapshots(ctx, conn, input, f)
 
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "reading RDS Cluster Snapshots: %s", err)
+		return sdkdiag.AppendErrorf(diags, "reading RDS DB Cluster Snapshots: %s", err)
 	}
 
-	if len(output.DBClusterSnapshots) < 1 {
+	if len(snapshots) < 1 {
 		return sdkdiag.AppendErrorf(diags, "Your query returned no results. Please change your search criteria and try again.")
 	}
 
 	var snapshot *rds.DBClusterSnapshot
-	if len(output.DBClusterSnapshots) > 1 {
+	if len(snapshots) > 1 {
 		if d.Get("most_recent").(bool) {
-			snapshot = mostRecentClusterSnapshot(output.DBClusterSnapshots)
+			snapshot = mostRecentClusterSnapshot(snapshots)
 		} else {
 			return sdkdiag.AppendErrorf(diags, "Your query returned more than one result. Please try a more specific search criteria.")
 		}
 	} else {
-		snapshot = output.DBClusterSnapshots[0]
+		snapshot = snapshots[0]
 	}
 
 	d.SetId(aws.StringValue(snapshot.DBClusterSnapshotIdentifier))
@@ -170,11 +180,7 @@ func dataSourceClusterSnapshotRead(ctx context.Context, d *schema.ResourceData,
 	d.Set("storage_encrypted", snapshot.StorageEncrypted)
 	d.Set("vpc_id", snapshot.VpcId)
 
-	tags := KeyValueTags(ctx, snapshot.TagList)
-
-	if err := d.Set("tags", tags.IgnoreAWS().IgnoreConfig(ignoreTagsConfig).Map()); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting tags: %s", err)
-	}
+	setTagsOut(ctx, snapshot.TagList)
 
 	return diags
 }
diff --git a/internal/service/rds/cluster_snapshot_data_source_test.go b/internal/service/rds/cluster_snapshot_data_source_test.go
index 4f40cec7877..003d96d1143 100644
--- a/internal/service/rds/cluster_snapshot_data_source_test.go
+++ b/internal/service/rds/cluster_snapshot_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rds_test
 
 import (
@@ -39,8 +42,8 @@ func TestAccRDSClusterSnapshotDataSource_dbClusterSnapshotIdentifier(t *testing.
 					resource.TestCheckResourceAttrPair(dataSourceName, "source_db_cluster_snapshot_arn", resourceName, "source_db_cluster_snapshot_arn"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "status", resourceName, "status"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "storage_encrypted", resourceName, "storage_encrypted"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "tags.%", resourceName, "tags.%"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "vpc_id", resourceName, "vpc_id"),
-					resource.TestCheckResourceAttrPair(dataSourceName, "tags", resourceName, "tags"),
 				),
 			},
 		},
@@ -76,8 +79,8 @@ func TestAccRDSClusterSnapshotDataSource_dbClusterIdentifier(t *testing.T) {
 					resource.TestCheckResourceAttrPair(dataSourceName, "source_db_cluster_snapshot_arn", resourceName, "source_db_cluster_snapshot_arn"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "status", resourceName, "status"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "storage_encrypted", resourceName, "storage_encrypted"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "tags.%", resourceName, "tags.%"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "vpc_id", resourceName, "vpc_id"),
-					resource.TestCheckResourceAttrPair(dataSourceName, "tags", resourceName, "tags"),
 				),
 			},
 		},
@@ -106,6 +109,31 @@ func TestAccRDSClusterSnapshotDataSource_mostRecent(t *testing.T) {
 	})
 }
 
+func TestAccRDSClusterSnapshotDataSource_tags(t *testing.T) {
+	ctx := acctest.Context(t)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	dataSourceName := "data.aws_db_cluster_snapshot.test"
+	resourceName := "aws_db_cluster_snapshot.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, rds.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccClusterSnapshotDataSourceConfig_tags(rName),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttrPair(dataSourceName, "db_cluster_identifier", resourceName, "db_cluster_identifier"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "db_cluster_snapshot_arn", resourceName, "db_cluster_snapshot_arn"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "db_cluster_snapshot_identifier", resourceName, "db_cluster_snapshot_identifier"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "tags.%", resourceName, "tags.%"),
+					resource.TestCheckResourceAttr(dataSourceName, "tags.Name", rName),
+				),
+			},
+		},
+	})
+}
+
 func testAccClusterSnapshotDataSourceConfig_clusterSnapshotIdentifier(rName string) string {
 	return acctest.ConfigCompose(testAccClusterSnapshotConfig_base(rName), fmt.Sprintf(`
 resource "aws_db_cluster_snapshot" "test" {
@@ -158,3 +186,35 @@ data "aws_db_cluster_snapshot" "test" {
 }
 `, rName))
 }
+
+func testAccClusterSnapshotDataSourceConfig_tags(rName string) string {
+	return acctest.ConfigCompose(testAccClusterSnapshotConfig_base(rName), fmt.Sprintf(`
+resource "aws_db_cluster_snapshot" "incorrect" {
+  db_cluster_identifier          = aws_rds_cluster.test.id
+  db_cluster_snapshot_identifier = "%[1]s-incorrect"
+
+  tags = {
+    Name = "%[1]s-incorrect"
+    Test = "true"
+  }
+}
+
+resource "aws_db_cluster_snapshot" "test" {
+  db_cluster_identifier          = aws_db_cluster_snapshot.incorrect.db_cluster_identifier
+  db_cluster_snapshot_identifier = %[1]q
+
+  tags = {
+    Name = %[1]q
+    Test = "true"
+  }
+}
+
+data "aws_db_cluster_snapshot" "test" {
+  tags = {
+    Name = %[1]q
+  }
+
+  depends_on = [aws_db_cluster_snapshot.test]
+}
+`, rName))
+}
diff --git a/internal/service/rds/cluster_snapshot_test.go b/internal/service/rds/cluster_snapshot_test.go
index 014517d42d1..43b84b1747d 100644
--- a/internal/service/rds/cluster_snapshot_test.go
+++ b/internal/service/rds/cluster_snapshot_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rds_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/rds"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -34,7 +37,7 @@ func TestAccRDSClusterSnapshot_basic(t *testing.T) {
 					testAccCheckClusterSnapshotExists(ctx, resourceName, &dbClusterSnapshot),
 					resource.TestCheckResourceAttrSet(resourceName, "allocated_storage"),
 					resource.TestCheckResourceAttrSet(resourceName, "availability_zones.#"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "db_cluster_snapshot_arn", "rds", regexp.MustCompile(fmt.Sprintf("cluster-snapshot:%s$", rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "db_cluster_snapshot_arn", "rds", regexache.MustCompile(fmt.Sprintf("cluster-snapshot:%s$", rName))),
 					resource.TestCheckResourceAttrSet(resourceName, "engine"),
 					resource.TestCheckResourceAttrSet(resourceName, "engine_version"),
 					resource.TestCheckResourceAttr(resourceName, "kms_key_id", ""),
@@ -44,7 +47,7 @@ func TestAccRDSClusterSnapshot_basic(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "source_db_cluster_snapshot_arn", ""),
 					resource.TestCheckResourceAttr(resourceName, "status", "available"),
 					resource.TestCheckResourceAttr(resourceName, "storage_encrypted", "false"),
-					resource.TestMatchResourceAttr(resourceName, "vpc_id", regexp.MustCompile(`^vpc-.+`)),
+					resource.TestMatchResourceAttr(resourceName, "vpc_id", regexache.MustCompile(`^vpc-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 				),
 			},
@@ -162,27 +165,30 @@ func testAccCheckClusterSnapshotExists(ctx context.Context, n string, v *rds.DBC
 }
 
 func testAccClusterSnapshotConfig_base(rName string) string {
-	return acctest.ConfigCompose(acctest.ConfigVPCWithSubnets(rName, 2), fmt.Sprintf(`
+	return acctest.ConfigCompose(
+		acctest.ConfigVPCWithSubnets(rName, 2),
+		fmt.Sprintf(`
 resource "aws_db_subnet_group" "test" {
   name       = %[1]q
   subnet_ids = aws_subnet.test[*].id
 }
 
 resource "aws_rds_cluster" "test" {
-  cluster_identifier              = %[1]q
-  db_subnet_group_name            = aws_db_subnet_group.test.name
-  database_name                   = "test"
-  engine                          = "aurora-mysql"
-  master_username                 = "tfacctest"
-  master_password                 = "avoid-plaintext-passwords"
-  db_cluster_parameter_group_name = "default.aurora-mysql5.7"
-  skip_final_snapshot             = true
+  cluster_identifier   = %[1]q
+  db_subnet_group_name = aws_db_subnet_group.test.name
+  database_name        = "test"
+  engine               = "aurora-mysql"
+  master_username      = "tfacctest"
+  master_password      = "avoid-plaintext-passwords"
+  skip_final_snapshot  = true
 }
 `, rName))
 }
 
 func testAccClusterSnapshotConfig_basic(rName string) string {
-	return acctest.ConfigCompose(testAccClusterSnapshotConfig_base(rName), fmt.Sprintf(`
+	return acctest.ConfigCompose(
+		testAccClusterSnapshotConfig_base(rName),
+		fmt.Sprintf(`
 resource "aws_db_cluster_snapshot" "test" {
   db_cluster_identifier          = aws_rds_cluster.test.id
   db_cluster_snapshot_identifier = %[1]q
@@ -191,7 +197,9 @@ resource "aws_db_cluster_snapshot" "test" {
 }
 
 func testAccClusterSnapshotConfig_tags1(rName, tagKey1, tagValue1 string) string {
-	return acctest.ConfigCompose(testAccClusterSnapshotConfig_base(rName), fmt.Sprintf(`
+	return acctest.ConfigCompose(
+		testAccClusterSnapshotConfig_base(rName),
+		fmt.Sprintf(`
 resource "aws_db_cluster_snapshot" "test" {
   db_cluster_identifier          = aws_rds_cluster.test.id
   db_cluster_snapshot_identifier = %[1]q
@@ -204,7 +212,9 @@ resource "aws_db_cluster_snapshot" "test" {
 }
 
 func testAccClusterSnapshotConfig_tags2(rName, tagKey1, tagValue1, tagKey2, tagValue2 string) string {
-	return acctest.ConfigCompose(testAccClusterSnapshotConfig_base(rName), fmt.Sprintf(`
+	return acctest.ConfigCompose(
+		testAccClusterSnapshotConfig_base(rName),
+		fmt.Sprintf(`
 resource "aws_db_cluster_snapshot" "test" {
   db_cluster_identifier          = aws_rds_cluster.test.id
   db_cluster_snapshot_identifier = %[1]q
diff --git a/internal/service/rds/cluster_test.go b/internal/service/rds/cluster_test.go
index ffc2c6e1ad5..f712ce1979c 100644
--- a/internal/service/rds/cluster_test.go
+++ b/internal/service/rds/cluster_test.go
@@ -1,13 +1,16 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rds_test
 
 import (
 	"context"
 	"errors"
 	"fmt"
-	"regexp"
 	"strings"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/rds"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
@@ -24,6 +27,24 @@ func init() {
 	acctest.RegisterServiceErrorCheckFunc(rds.EndpointsID, testAccErrorCheckSkip)
 }
 
+func testAccClusterImportStep(n string) resource.TestStep {
+	return resource.TestStep{
+		ResourceName:      n,
+		ImportState:       true,
+		ImportStateVerify: true,
+		ImportStateVerifyIgnore: []string{
+			"allow_major_version_upgrade",
+			"apply_immediately",
+			"db_instance_parameter_group_name",
+			"enable_global_write_forwarding",
+			"manage_master_user_password",
+			"master_password",
+			"master_user_secret_kms_key_id",
+			"skip_final_snapshot",
+		},
+	}
+}
+
 func testAccErrorCheckSkip(t *testing.T) resource.ErrorCheckFunc {
 	return acctest.ErrorCheckSkipMessagesContaining(t,
 		"engine mode serverless you requested is currently unavailable",
@@ -52,9 +73,12 @@ func TestAccRDSCluster_basic(t *testing.T) {
 					testAccCheckClusterExists(ctx, resourceName, &dbCluster),
 					acctest.CheckResourceAttrRegionalARN(resourceName, "arn", "rds", fmt.Sprintf("cluster:%s", rName)),
 					resource.TestCheckResourceAttr(resourceName, "backtrack_window", "0"),
+					resource.TestCheckResourceAttr(resourceName, "cluster_identifier", rName),
+					resource.TestCheckResourceAttr(resourceName, "cluster_identifier_prefix", ""),
 					resource.TestCheckResourceAttrSet(resourceName, "cluster_resource_id"),
 					resource.TestCheckResourceAttr(resourceName, "copy_tags_to_snapshot", "false"),
-					resource.TestCheckResourceAttr(resourceName, "db_cluster_parameter_group_name", "default.aurora-mysql5.7"),
+					resource.TestCheckResourceAttrSet(resourceName, "db_cluster_parameter_group_name"),
+					resource.TestCheckResourceAttr(resourceName, "db_system_id", ""),
 					resource.TestCheckResourceAttr(resourceName, "enabled_cloudwatch_logs_exports.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "engine", "aurora-mysql"),
 					resource.TestCheckResourceAttrSet(resourceName, "engine_version"),
@@ -67,20 +91,7 @@ func TestAccRDSCluster_basic(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 				),
 			},
-			{
-				ResourceName:      resourceName,
-				ImportState:       true,
-				ImportStateVerify: true,
-				ImportStateVerifyIgnore: []string{
-					"allow_major_version_upgrade",
-					"apply_immediately",
-					"cluster_identifier_prefix",
-					"db_instance_parameter_group_name",
-					"enable_global_write_forwarding",
-					"master_password",
-					"skip_final_snapshot",
-				},
-			},
+			testAccClusterImportStep(resourceName),
 		},
 	})
 }
@@ -109,10 +120,9 @@ func TestAccRDSCluster_disappears(t *testing.T) {
 	})
 }
 
-func TestAccRDSCluster_tags(t *testing.T) {
+func TestAccRDSCluster_identifierGenerated(t *testing.T) {
 	ctx := acctest.Context(t)
-	var dbCluster1, dbCluster2, dbCluster3 rds.DBCluster
-	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	var v rds.DBCluster
 	resourceName := "aws_rds_cluster.test"
 
 	resource.ParallelTest(t, resource.TestCase{
@@ -122,35 +132,19 @@ func TestAccRDSCluster_tags(t *testing.T) {
 		CheckDestroy:             testAccCheckClusterDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccClusterConfig_tags1(rName, "key1", "value1"),
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckClusterExists(ctx, resourceName, &dbCluster1),
-					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
-					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
-				),
-			},
-			{
-				Config: testAccClusterConfig_tags2(rName, "key1", "value1updated", "key2", "value2"),
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckClusterExists(ctx, resourceName, &dbCluster2),
-					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
-					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1updated"),
-					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
-				),
-			},
-			{
-				Config: testAccClusterConfig_tags1(rName, "key2", "value2"),
+				Config: testAccClusterConfig_identifierGenerated(),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckClusterExists(ctx, resourceName, &dbCluster3),
-					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
-					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
+					testAccCheckClusterExists(ctx, resourceName, &v),
+					acctest.CheckResourceAttrNameGeneratedWithPrefix(resourceName, "cluster_identifier", "tf-"),
+					resource.TestCheckResourceAttr(resourceName, "cluster_identifier_prefix", "tf-"),
 				),
 			},
+			testAccClusterImportStep(resourceName),
 		},
 	})
 }
 
-func TestAccRDSCluster_identifierGenerated(t *testing.T) {
+func TestAccRDSCluster_identifierPrefix(t *testing.T) {
 	ctx := acctest.Context(t)
 	var v rds.DBCluster
 	resourceName := "aws_rds_cluster.test"
@@ -162,19 +156,22 @@ func TestAccRDSCluster_identifierGenerated(t *testing.T) {
 		CheckDestroy:             testAccCheckClusterDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccClusterConfig_identifierGenerated(),
+				Config: testAccClusterConfig_identifierPrefix("tf-acc-test-prefix-"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckClusterExists(ctx, resourceName, &v),
-					resource.TestMatchResourceAttr(resourceName, "cluster_identifier", regexp.MustCompile("^tf-")),
+					acctest.CheckResourceAttrNameFromPrefix(resourceName, "cluster_identifier", "tf-acc-test-prefix-"),
+					resource.TestCheckResourceAttr(resourceName, "cluster_identifier_prefix", "tf-acc-test-prefix-"),
 				),
 			},
+			testAccClusterImportStep(resourceName),
 		},
 	})
 }
 
-func TestAccRDSCluster_identifierPrefix(t *testing.T) {
+func TestAccRDSCluster_tags(t *testing.T) {
 	ctx := acctest.Context(t)
-	var v rds.DBCluster
+	var dbCluster1, dbCluster2, dbCluster3 rds.DBCluster
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_rds_cluster.test"
 
 	resource.ParallelTest(t, resource.TestCase{
@@ -184,10 +181,29 @@ func TestAccRDSCluster_identifierPrefix(t *testing.T) {
 		CheckDestroy:             testAccCheckClusterDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccClusterConfig_identifierPrefix("tf-test-"),
+				Config: testAccClusterConfig_tags1(rName, "key1", "value1"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckClusterExists(ctx, resourceName, &v),
-					resource.TestMatchResourceAttr(resourceName, "cluster_identifier", regexp.MustCompile("^tf-test-")),
+					testAccCheckClusterExists(ctx, resourceName, &dbCluster1),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
+				),
+			},
+			testAccClusterImportStep(resourceName),
+			{
+				Config: testAccClusterConfig_tags2(rName, "key1", "value1updated", "key2", "value2"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckClusterExists(ctx, resourceName, &dbCluster2),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1updated"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
+				),
+			},
+			{
+				Config: testAccClusterConfig_tags1(rName, "key2", "value2"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckClusterExists(ctx, resourceName, &dbCluster3),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
 				),
 			},
 		},
@@ -225,20 +241,7 @@ func TestAccRDSCluster_allowMajorVersionUpgrade(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "engine_version", engineVersion1),
 				),
 			},
-			{
-				ResourceName:      resourceName,
-				ImportState:       true,
-				ImportStateVerify: true,
-				ImportStateVerifyIgnore: []string{
-					"allow_major_version_upgrade",
-					"apply_immediately",
-					"cluster_identifier_prefix",
-					"db_instance_parameter_group_name",
-					"enable_global_write_forwarding",
-					"master_password",
-					"skip_final_snapshot",
-				},
-			},
+			testAccClusterImportStep(resourceName),
 			{
 				Config: testAccClusterConfig_allowMajorVersionUpgrade(rName, true, engine, engineVersion2, true),
 				Check: resource.ComposeTestCheckFunc(
@@ -283,20 +286,7 @@ func TestAccRDSCluster_allowMajorVersionUpgradeNoApplyImmediately(t *testing.T)
 					resource.TestCheckResourceAttr(resourceName, "engine_version", engineVersion1),
 				),
 			},
-			{
-				ResourceName:      resourceName,
-				ImportState:       true,
-				ImportStateVerify: true,
-				ImportStateVerifyIgnore: []string{
-					"allow_major_version_upgrade",
-					"apply_immediately",
-					"cluster_identifier_prefix",
-					"db_instance_parameter_group_name",
-					"enable_global_write_forwarding",
-					"master_password",
-					"skip_final_snapshot",
-				},
-			},
+			testAccClusterImportStep(resourceName),
 			{
 				Config: testAccClusterConfig_allowMajorVersionUpgrade(rName, true, engine, engineVersion2, false),
 				Check: resource.ComposeTestCheckFunc(
@@ -385,20 +375,7 @@ func TestAccRDSCluster_allowMajorVersionUpgradeWithCustomParameters(t *testing.T
 					resource.TestCheckResourceAttr(resourceName, "engine_version", engineVersion1),
 				),
 			},
-			{
-				ResourceName:      resourceName,
-				ImportState:       true,
-				ImportStateVerify: true,
-				ImportStateVerifyIgnore: []string{
-					"allow_major_version_upgrade",
-					"apply_immediately",
-					"cluster_identifier_prefix",
-					"db_instance_parameter_group_name",
-					"enable_global_write_forwarding",
-					"master_password",
-					"skip_final_snapshot",
-				},
-			},
+			testAccClusterImportStep(resourceName),
 			{
 				Config: testAccClusterConfig_allowMajorVersionUpgradeCustomParameters(rName, true, engine, engineVersion2, false),
 				Check: resource.ComposeTestCheckFunc(
@@ -757,17 +734,17 @@ func TestAccRDSCluster_dbClusterInstanceClass(t *testing.T) {
 		CheckDestroy:             testAccCheckClusterDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccClusterConfig_dbClusterInstanceClass(rName, "db.m5d.2xlarge"),
+				Config: testAccClusterConfig_dbClusterInstanceClass(rName, "db.m5d.large"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckClusterExists(ctx, resourceName, &dbCluster),
-					resource.TestCheckResourceAttr(resourceName, "db_cluster_instance_class", "db.m5d.2xlarge"),
+					resource.TestCheckResourceAttr(resourceName, "db_cluster_instance_class", "db.m5d.large"),
 				),
 			},
 			{
-				Config: testAccClusterConfig_dbClusterInstanceClass(rName, "db.r6gd.4xlarge"),
+				Config: testAccClusterConfig_dbClusterInstanceClass(rName, "db.r6gd.large"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckClusterExists(ctx, resourceName, &dbCluster),
-					resource.TestCheckResourceAttr(resourceName, "db_cluster_instance_class", "db.r6gd.4xlarge"),
+					resource.TestCheckResourceAttr(resourceName, "db_cluster_instance_class", "db.r6gd.large"),
 				),
 			},
 		},
@@ -919,7 +896,7 @@ func TestAccRDSCluster_missingUserNameCausesError(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccClusterConfig_withoutUserNameAndPassword(sdkacctest.RandInt()),
-				ExpectError: regexp.MustCompile(`InvalidParameterValue: The parameter MasterUsername must be provided`),
+				ExpectError: regexache.MustCompile(`InvalidParameterValue: The parameter MasterUsername must be provided`),
 			},
 		},
 	})
@@ -1113,10 +1090,7 @@ func TestAccRDSCluster_encrypted(t *testing.T) {
 				Config: testAccClusterConfig_encrypted(sdkacctest.RandInt()),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckClusterExists(ctx, resourceName, &v),
-					resource.TestCheckResourceAttr(
-						resourceName, "storage_encrypted", "true"),
-					resource.TestCheckResourceAttr(
-						resourceName, "db_cluster_parameter_group_name", "default.aurora-mysql5.7"),
+					resource.TestCheckResourceAttr(resourceName, "storage_encrypted", "true"),
 				),
 			},
 		},
@@ -1356,7 +1330,7 @@ func TestAccRDSCluster_engineVersion(t *testing.T) {
 			},
 			{
 				Config:      testAccClusterConfig_engineVersion(rName, true),
-				ExpectError: regexp.MustCompile(`Cannot modify engine version without a healthy primary instance in DB cluster`),
+				ExpectError: regexache.MustCompile(`Cannot modify engine version without a healthy primary instance in DB cluster`),
 			},
 		},
 	})
@@ -1447,7 +1421,7 @@ func TestAccRDSCluster_GlobalClusterIdentifierEngineModeGlobal_add(t *testing.T)
 			},
 			{
 				Config:      testAccClusterConfig_GlobalClusterID_EngineMode_global(rName),
-				ExpectError: regexp.MustCompile(`(?i)Existing RDS Clusters cannot be added to an existing RDS Global Cluster`),
+				ExpectError: regexache.MustCompile(`(?i)Existing RDS Clusters cannot be added to an existing RDS Global Cluster`),
 			},
 		},
 	})
@@ -1509,7 +1483,7 @@ func TestAccRDSCluster_GlobalClusterIdentifierEngineModeGlobal_update(t *testing
 			},
 			{
 				Config:      testAccClusterConfig_GlobalClusterID_EngineMode_globalUpdate(rName, globalClusterResourceName2),
-				ExpectError: regexp.MustCompile(`(?i)Existing RDS Clusters cannot be migrated between existing RDS Global Clusters`),
+				ExpectError: regexache.MustCompile(`(?i)Existing RDS Clusters cannot be migrated between existing RDS Global Clusters`),
 			},
 		},
 	})
@@ -1670,7 +1644,6 @@ func TestAccRDSCluster_ManagedMasterPassword_managed(t *testing.T) {
 					testAccCheckClusterExists(ctx, resourceName, &dbCluster),
 					acctest.CheckResourceAttrRegionalARN(resourceName, "arn", "rds", fmt.Sprintf("cluster:%s", rName)),
 					resource.TestCheckResourceAttrSet(resourceName, "cluster_resource_id"),
-					resource.TestCheckResourceAttr(resourceName, "db_cluster_parameter_group_name", "default.aurora-mysql5.7"),
 					resource.TestCheckResourceAttr(resourceName, "engine", "aurora-mysql"),
 					resource.TestCheckResourceAttrSet(resourceName, "engine_version"),
 					resource.TestCheckResourceAttr(resourceName, "manage_master_user_password", "true"),
@@ -1680,20 +1653,7 @@ func TestAccRDSCluster_ManagedMasterPassword_managed(t *testing.T) {
 					resource.TestCheckResourceAttrSet(resourceName, "master_user_secret.0.secret_status"),
 				),
 			},
-			{
-				ResourceName:      resourceName,
-				ImportState:       true,
-				ImportStateVerify: true,
-				ImportStateVerifyIgnore: []string{
-					"allow_major_version_upgrade",
-					"apply_immediately",
-					"cluster_identifier_prefix",
-					"db_instance_parameter_group_name",
-					"enable_global_write_forwarding",
-					"manage_master_user_password",
-					"skip_final_snapshot",
-				},
-			},
+			testAccClusterImportStep(resourceName),
 		},
 	})
 }
@@ -1716,7 +1676,6 @@ func TestAccRDSCluster_ManagedMasterPassword_managedSpecificKMSKey(t *testing.T)
 					testAccCheckClusterExists(ctx, resourceName, &dbCluster),
 					acctest.CheckResourceAttrRegionalARN(resourceName, "arn", "rds", fmt.Sprintf("cluster:%s", rName)),
 					resource.TestCheckResourceAttrSet(resourceName, "cluster_resource_id"),
-					resource.TestCheckResourceAttr(resourceName, "db_cluster_parameter_group_name", "default.aurora-mysql5.7"),
 					resource.TestCheckResourceAttr(resourceName, "engine", "aurora-mysql"),
 					resource.TestCheckResourceAttrSet(resourceName, "engine_version"),
 					resource.TestCheckResourceAttr(resourceName, "manage_master_user_password", "true"),
@@ -1726,21 +1685,7 @@ func TestAccRDSCluster_ManagedMasterPassword_managedSpecificKMSKey(t *testing.T)
 					resource.TestCheckResourceAttrSet(resourceName, "master_user_secret.0.secret_status"),
 				),
 			},
-			{
-				ResourceName:      resourceName,
-				ImportState:       true,
-				ImportStateVerify: true,
-				ImportStateVerifyIgnore: []string{
-					"allow_major_version_upgrade",
-					"apply_immediately",
-					"cluster_identifier_prefix",
-					"db_instance_parameter_group_name",
-					"enable_global_write_forwarding",
-					"manage_master_user_password",
-					"master_user_secret_kms_key_id",
-					"skip_final_snapshot",
-				},
-			},
+			testAccClusterImportStep(resourceName),
 		},
 	})
 }
@@ -1770,20 +1715,7 @@ func TestAccRDSCluster_ManagedMasterPassword_convertToManaged(t *testing.T) {
 					resource.TestCheckNoResourceAttr(resourceName, "manage_master_user_password"),
 				),
 			},
-			{
-				ResourceName:      resourceName,
-				ImportState:       true,
-				ImportStateVerify: true,
-				ImportStateVerifyIgnore: []string{
-					"allow_major_version_upgrade",
-					"apply_immediately",
-					"cluster_identifier_prefix",
-					"db_instance_parameter_group_name",
-					"enable_global_write_forwarding",
-					"master_password",
-					"skip_final_snapshot",
-				},
-			},
+			testAccClusterImportStep(resourceName),
 			{
 				Config: testAccClusterConfig_managedMasterPassword(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
@@ -2652,68 +2584,12 @@ func testAccCheckClusterNotRecreated(i, j *rds.DBCluster) resource.TestCheckFunc
 func testAccClusterConfig_basic(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_rds_cluster" "test" {
-  cluster_identifier              = %[1]q
-  database_name                   = "test"
-  engine                          = "aurora-mysql"
-  master_username                 = "tfacctest"
-  master_password                 = "avoid-plaintext-passwords"
-  db_cluster_parameter_group_name = "default.aurora-mysql5.7"
-  skip_final_snapshot             = true
-}
-`, rName)
-}
-
-func testAccClusterConfig_managedMasterPassword(rName string) string {
-	return fmt.Sprintf(`
-resource "aws_rds_cluster" "test" {
-  cluster_identifier              = %[1]q
-  database_name                   = "test"
-  manage_master_user_password     = true
-  master_username                 = "tfacctest"
-  engine                          = "aurora-mysql"
-  db_cluster_parameter_group_name = "default.aurora-mysql5.7"
-  skip_final_snapshot             = true
-}
-`, rName)
-}
-
-func testAccClusterConfig_managedMasterPasswordKMSKey(rName string) string {
-	return fmt.Sprintf(`
-data "aws_caller_identity" "current" {}
-data "aws_partition" "current" {}
-
-resource "aws_kms_key" "example" {
-  description = "Terraform acc test %[1]s"
-
-  policy = <<POLICY
-{
-  "Version": "2012-10-17",
-  "Id": "kms-tf-1",
-  "Statement": [
-    {
-      "Sid": "Enable IAM User Permissions",
-      "Effect": "Allow",
-      "Principal": {
-        "AWS": "arn:${data.aws_partition.current.partition}:iam::${data.aws_caller_identity.current.account_id}:root"
-      },
-      "Action": "kms:*",
-      "Resource": "*"
-    }
-  ]
-}
- POLICY
-
-}
-
-resource "aws_rds_cluster" "test" {
-  cluster_identifier              = %[1]q
-  database_name                   = "test"
-  engine                          = "aurora-mysql"
-  manage_master_user_password     = true
-  master_username                 = "tfacctest"
-  master_user_secret_kms_key_id   = aws_kms_key.example.arn
-  db_cluster_parameter_group_name = "default.aurora-mysql5.7"
-  skip_final_snapshot             = true
+  cluster_identifier  = %[1]q
+  database_name       = "test"
+  engine              = "aurora-mysql"
+  master_username     = "tfacctest"
+  master_password     = "avoid-plaintext-passwords"
+  skip_final_snapshot = true
 }
 `, rName)
 }
@@ -2721,13 +2597,12 @@ resource "aws_rds_cluster" "test" {
 func testAccClusterConfig_tags1(rName, tagKey1, tagValue1 string) string {
 	return fmt.Sprintf(`
 resource "aws_rds_cluster" "test" {
-  cluster_identifier              = %[1]q
-  database_name                   = "test"
-  master_username                 = "tfacctest"
-  master_password                 = "avoid-plaintext-passwords"
-  engine                          = "aurora-mysql"
-  db_cluster_parameter_group_name = "default.aurora-mysql5.7"
-  skip_final_snapshot             = true
+  cluster_identifier  = %[1]q
+  database_name       = "test"
+  master_username     = "tfacctest"
+  master_password     = "avoid-plaintext-passwords"
+  engine              = "aurora-mysql"
+  skip_final_snapshot = true
 
   tags = {
     %[2]q = %[3]q
@@ -2739,13 +2614,12 @@ resource "aws_rds_cluster" "test" {
 func testAccClusterConfig_tags2(rName, tagKey1, tagValue1, tagKey2, tagValue2 string) string {
 	return fmt.Sprintf(`
 resource "aws_rds_cluster" "test" {
-  cluster_identifier              = %[1]q
-  database_name                   = "test"
-  master_username                 = "tfacctest"
-  master_password                 = "avoid-plaintext-passwords"
-  engine                          = "aurora-mysql"
-  db_cluster_parameter_group_name = "default.aurora-mysql5.7"
-  skip_final_snapshot             = true
+  cluster_identifier  = %[1]q
+  database_name       = "test"
+  master_username     = "tfacctest"
+  master_password     = "avoid-plaintext-passwords"
+  engine              = "aurora-mysql"
+  skip_final_snapshot = true
 
   tags = {
     %[2]q = %[3]q
@@ -2778,6 +2652,59 @@ resource "aws_rds_cluster" "test" {
 `, identifierPrefix)
 }
 
+func testAccClusterConfig_managedMasterPassword(rName string) string {
+	return fmt.Sprintf(`
+resource "aws_rds_cluster" "test" {
+  cluster_identifier          = %[1]q
+  database_name               = "test"
+  manage_master_user_password = true
+  master_username             = "tfacctest"
+  engine                      = "aurora-mysql"
+  skip_final_snapshot         = true
+}
+`, rName)
+}
+
+func testAccClusterConfig_managedMasterPasswordKMSKey(rName string) string {
+	return fmt.Sprintf(`
+data "aws_caller_identity" "current" {}
+data "aws_partition" "current" {}
+
+resource "aws_kms_key" "example" {
+  description = "Terraform acc test %[1]s"
+
+  policy = <<POLICY
+{
+  "Version": "2012-10-17",
+  "Id": "kms-tf-1",
+  "Statement": [
+    {
+      "Sid": "Enable IAM User Permissions",
+      "Effect": "Allow",
+      "Principal": {
+        "AWS": "arn:${data.aws_partition.current.partition}:iam::${data.aws_caller_identity.current.account_id}:root"
+      },
+      "Action": "kms:*",
+      "Resource": "*"
+    }
+  ]
+}
+ POLICY
+
+}
+
+resource "aws_rds_cluster" "test" {
+  cluster_identifier            = %[1]q
+  database_name                 = "test"
+  engine                        = "aurora-mysql"
+  manage_master_user_password   = true
+  master_username               = "tfacctest"
+  master_user_secret_kms_key_id = aws_kms_key.example.arn
+  skip_final_snapshot           = true
+}
+`, rName)
+}
+
 func testAccClusterConfig_allowMajorVersionUpgrade(rName string, allowMajorVersionUpgrade bool, engine string, engineVersion string, applyImmediately bool) string {
 	return fmt.Sprintf(`
 resource "aws_rds_cluster" "test" {
@@ -2953,11 +2880,14 @@ resource "aws_rds_cluster" "test" {
 }
 
 func testAccClusterConfig_storageTypeIo1(rName string) string {
-	return fmt.Sprintf(`
+	return acctest.ConfigCompose(
+		testAccConfig_ClusterSubnetGroup(rName),
+		fmt.Sprintf(`
 resource "aws_rds_cluster" "test" {
   apply_immediately         = true
   cluster_identifier        = %[1]q
   db_cluster_instance_class = "db.r6gd.xlarge"
+  db_subnet_group_name      = aws_db_subnet_group.test.name
   engine                    = "mysql"
   storage_type              = "io1"
   allocated_storage         = 100
@@ -2966,15 +2896,18 @@ resource "aws_rds_cluster" "test" {
   master_username           = "test"
   skip_final_snapshot       = true
 }
-`, rName)
+`, rName))
 }
 
 func testAccClusterConfig_allocatedStorage(rName string) string {
-	return fmt.Sprintf(`
+	return acctest.ConfigCompose(
+		testAccConfig_ClusterSubnetGroup(rName),
+		fmt.Sprintf(`
 resource "aws_rds_cluster" "test" {
   apply_immediately         = true
   cluster_identifier        = %[1]q
   db_cluster_instance_class = "db.r6gd.xlarge"
+  db_subnet_group_name      = aws_db_subnet_group.test.name
   engine                    = "mysql"
   storage_type              = "io1"
   allocated_storage         = 100
@@ -2983,15 +2916,18 @@ resource "aws_rds_cluster" "test" {
   master_username           = "test"
   skip_final_snapshot       = true
 }
-`, rName)
+`, rName))
 }
 
 func testAccClusterConfig_iops(rName string) string {
-	return fmt.Sprintf(`
+	return acctest.ConfigCompose(
+		testAccConfig_ClusterSubnetGroup(rName),
+		fmt.Sprintf(`
 resource "aws_rds_cluster" "test" {
   apply_immediately         = true
   cluster_identifier        = %[1]q
   db_cluster_instance_class = "db.r6gd.xlarge"
+  db_subnet_group_name      = aws_db_subnet_group.test.name
   engine                    = "mysql"
   storage_type              = "io1"
   allocated_storage         = 100
@@ -3000,15 +2936,18 @@ resource "aws_rds_cluster" "test" {
   master_username           = "test"
   skip_final_snapshot       = true
 }
-`, rName)
+`, rName))
 }
 
 func testAccClusterConfig_dbClusterInstanceClass(rName, instanceClass string) string {
-	return fmt.Sprintf(`
+	return acctest.ConfigCompose(
+		testAccConfig_ClusterSubnetGroup(rName),
+		fmt.Sprintf(`
 resource "aws_rds_cluster" "test" {
   apply_immediately         = true
   cluster_identifier        = %[1]q
   db_cluster_instance_class = %[2]q
+  db_subnet_group_name      = aws_db_subnet_group.test.name
   engine                    = "mysql"
   storage_type              = "io1"
   allocated_storage         = 100
@@ -3017,7 +2956,7 @@ resource "aws_rds_cluster" "test" {
   master_username           = "test"
   skip_final_snapshot       = true
 }
-`, rName, instanceClass)
+`, rName, instanceClass))
 }
 
 func testAccClusterConfig_backtrackWindow(backtrackWindow int) string {
@@ -3035,12 +2974,9 @@ resource "aws_rds_cluster" "test" {
 }
 
 func testAccClusterConfig_subnetGroupName(rName string) string {
-	return acctest.ConfigCompose(acctest.ConfigVPCWithSubnets(rName, 3), fmt.Sprintf(`
-resource "aws_db_subnet_group" "test" {
-  name       = %[1]q
-  subnet_ids = aws_subnet.test[*].id
-}
-
+	return acctest.ConfigCompose(
+		testAccConfig_ClusterSubnetGroup(rName),
+		fmt.Sprintf(`
 resource "aws_rds_cluster" "test" {
   cluster_identifier   = %[1]q
   engine               = "aurora-mysql"
@@ -3055,13 +2991,12 @@ resource "aws_rds_cluster" "test" {
 func testAccClusterConfig_finalSnapshot(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_rds_cluster" "test" {
-  cluster_identifier              = %[1]q
-  database_name                   = "test"
-  engine                          = "aurora-mysql"
-  master_username                 = "tfacctest"
-  master_password                 = "avoid-plaintext-passwords"
-  db_cluster_parameter_group_name = "default.aurora-mysql5.7"
-  final_snapshot_identifier       = %[1]q
+  cluster_identifier        = %[1]q
+  database_name             = "test"
+  engine                    = "aurora-mysql"
+  master_username           = "tfacctest"
+  master_password           = "avoid-plaintext-passwords"
+  final_snapshot_identifier = %[1]q
 }
 `, rName)
 }
@@ -3078,12 +3013,9 @@ resource "aws_rds_cluster" "default" {
 }
 
 func testAccClusterConfig_baseForPITR(rName string) string {
-	return acctest.ConfigCompose(acctest.ConfigVPCWithSubnets(rName, 3), fmt.Sprintf(`
-resource "aws_db_subnet_group" "test" {
-  name       = %[1]q
-  subnet_ids = aws_subnet.test[*].id
-}
-
+	return acctest.ConfigCompose(
+		testAccConfig_ClusterSubnetGroup(rName),
+		fmt.Sprintf(`
 resource "aws_rds_cluster" "test" {
   cluster_identifier   = %[1]q
   master_username      = "tfacctest"
@@ -3155,7 +3087,9 @@ resource "aws_rds_cluster" "test" {
 }
 
 func testAccClusterConfig_enabledCloudWatchLogsExportsPostgreSQL1(rName, enabledCloudwatchLogExports1 string) string {
-	return fmt.Sprintf(`
+	return acctest.ConfigCompose(
+		testAccConfig_ClusterSubnetGroup(rName),
+		fmt.Sprintf(`
 resource "aws_rds_cluster" "test" {
   cluster_identifier              = %[1]q
   enabled_cloudwatch_logs_exports = [%[2]q]
@@ -3166,15 +3100,18 @@ resource "aws_rds_cluster" "test" {
   storage_type                    = "io1"
   iops                            = 1000
   db_cluster_instance_class       = "db.m5d.large"
+  db_subnet_group_name            = aws_db_subnet_group.test.name
   engine                          = "postgres"
   engine_mode                     = "provisioned"
-  engine_version                  = "13.4"
+  engine_version                  = "13.12"
 }
-`, rName, enabledCloudwatchLogExports1)
+`, rName, enabledCloudwatchLogExports1))
 }
 
 func testAccClusterConfig_enabledCloudWatchLogsExportsPostgreSQL2(rName, enabledCloudwatchLogExports1, enabledCloudwatchLogExports2 string) string {
-	return fmt.Sprintf(`
+	return acctest.ConfigCompose(
+		testAccConfig_ClusterSubnetGroup(rName),
+		fmt.Sprintf(`
 resource "aws_rds_cluster" "test" {
   cluster_identifier              = %[1]q
   enabled_cloudwatch_logs_exports = [%[2]q, %[3]q]
@@ -3185,15 +3122,18 @@ resource "aws_rds_cluster" "test" {
   storage_type                    = "io1"
   iops                            = 1000
   db_cluster_instance_class       = "db.m5d.large"
+  db_subnet_group_name            = aws_db_subnet_group.test.name
   engine                          = "postgres"
   engine_mode                     = "provisioned"
-  engine_version                  = "13.4"
+  engine_version                  = "13.12"
 }
-`, rName, enabledCloudwatchLogExports1, enabledCloudwatchLogExports2)
+`, rName, enabledCloudwatchLogExports1, enabledCloudwatchLogExports2))
 }
 
 func testAccClusterConfig_kmsKey(n int) string {
 	return fmt.Sprintf(`
+data "aws_caller_identity" "current" {}
+data "aws_partition" "current" {}
 
 resource "aws_kms_key" "foo" {
   description = "Terraform acc test %[1]d"
@@ -3207,7 +3147,7 @@ resource "aws_kms_key" "foo" {
       "Sid": "Enable IAM User Permissions",
       "Effect": "Allow",
       "Principal": {
-        "AWS": "*"
+        "AWS": "arn:${data.aws_partition.current.partition}:iam::${data.aws_caller_identity.current.account_id}:root"
       },
       "Action": "kms:*",
       "Resource": "*"
@@ -3219,15 +3159,14 @@ resource "aws_kms_key" "foo" {
 }
 
 resource "aws_rds_cluster" "test" {
-  cluster_identifier              = "tf-aurora-cluster-%[1]d"
-  database_name                   = "mydb"
-  engine                          = "aurora-mysql"
-  master_username                 = "foo"
-  master_password                 = "mustbeeightcharaters"
-  db_cluster_parameter_group_name = "default.aurora-mysql5.7"
-  storage_encrypted               = true
-  kms_key_id                      = aws_kms_key.foo.arn
-  skip_final_snapshot             = true
+  cluster_identifier  = "tf-aurora-cluster-%[1]d"
+  database_name       = "mydb"
+  engine              = "aurora-mysql"
+  master_username     = "foo"
+  master_password     = "mustbeeightcharaters"
+  storage_encrypted   = true
+  kms_key_id          = aws_kms_key.foo.arn
+  skip_final_snapshot = true
 }
 `, n)
 }
@@ -3460,13 +3399,12 @@ EOF
 }
 
 resource "aws_rds_cluster" "test" {
-  cluster_identifier              = "tf-aurora-cluster-%[1]d"
-  database_name                   = "mydb"
-  engine                          = "aurora-mysql"
-  master_username                 = "foo"
-  master_password                 = "mustbeeightcharaters"
-  db_cluster_parameter_group_name = "default.aurora-mysql5.7"
-  skip_final_snapshot             = true
+  cluster_identifier  = "tf-aurora-cluster-%[1]d"
+  database_name       = "mydb"
+  engine              = "aurora-mysql"
+  master_username     = "foo"
+  master_password     = "mustbeeightcharaters"
+  skip_final_snapshot = true
 
   tags = {
     Environment = "production"
@@ -3554,14 +3492,13 @@ EOF
 }
 
 resource "aws_rds_cluster" "test" {
-  cluster_identifier              = "tf-aurora-cluster-%[1]d"
-  database_name                   = "mydb"
-  engine                          = "aurora-mysql"
-  master_username                 = "foo"
-  master_password                 = "mustbeeightcharaters"
-  db_cluster_parameter_group_name = "default.aurora-mysql5.7"
-  skip_final_snapshot             = true
-  iam_roles                       = [aws_iam_role.rds_sample_role.arn, aws_iam_role.another_rds_sample_role.arn]
+  cluster_identifier  = "tf-aurora-cluster-%[1]d"
+  database_name       = "mydb"
+  engine              = "aurora-mysql"
+  master_username     = "foo"
+  master_password     = "mustbeeightcharaters"
+  skip_final_snapshot = true
+  iam_roles           = [aws_iam_role.rds_sample_role.arn, aws_iam_role.another_rds_sample_role.arn]
 
   tags = {
     Environment = "production"
@@ -3612,14 +3549,13 @@ EOF
 }
 
 resource "aws_rds_cluster" "test" {
-  cluster_identifier              = "tf-aurora-cluster-%[1]d"
-  database_name                   = "mydb"
-  engine                          = "aurora-mysql"
-  master_username                 = "foo"
-  master_password                 = "mustbeeightcharaters"
-  db_cluster_parameter_group_name = "default.aurora-mysql5.7"
-  skip_final_snapshot             = true
-  iam_roles                       = [aws_iam_role.another_rds_sample_role.arn]
+  cluster_identifier  = "tf-aurora-cluster-%[1]d"
+  database_name       = "mydb"
+  engine              = "aurora-mysql"
+  master_username     = "foo"
+  master_password     = "mustbeeightcharaters"
+  skip_final_snapshot = true
+  iam_roles           = [aws_iam_role.another_rds_sample_role.arn]
 
   tags = {
     Environment = "production"
@@ -3644,12 +3580,22 @@ data "aws_availability_zones" "available" {
 }
 
 data "aws_caller_identity" "current" {}
-
+data "aws_partition" "current" {}
 data "aws_region" "current" {}
 
+data "aws_rds_engine_version" "default" {
+  engine = "aurora-mysql"
+}
+
+data "aws_rds_orderable_db_instance" "test" {
+  engine                     = data.aws_rds_engine_version.default.engine
+  engine_version             = data.aws_rds_engine_version.default.version
+  preferred_instance_classes = ["db.t3.small", "db.t3.medium", "db.t3.large"]
+}
+
 resource "aws_rds_cluster_parameter_group" "test" {
   name        = %[1]q
-  family      = "aurora-mysql5.7"
+  family      = data.aws_rds_engine_version.default.parameter_group_family
   description = "RDS default cluster parameter group"
 
   parameter {
@@ -3663,7 +3609,7 @@ resource "aws_rds_cluster" "test" {
   cluster_identifier              = "%[1]s-primary"
   db_cluster_parameter_group_name = aws_rds_cluster_parameter_group.test.name
   database_name                   = "test"
-  engine                          = "aurora-mysql"
+  engine                          = data.aws_rds_engine_version.default.engine
   master_username                 = "tfacctest"
   master_password                 = "avoid-plaintext-passwords"
   storage_encrypted               = true
@@ -3673,7 +3619,7 @@ resource "aws_rds_cluster" "test" {
 resource "aws_rds_cluster_instance" "test" {
   identifier         = "%[1]s-primary"
   cluster_identifier = aws_rds_cluster.test.id
-  instance_class     = "db.t2.small"
+  instance_class     = data.aws_rds_orderable_db_instance.test.instance_class
   engine             = aws_rds_cluster.test.engine
   engine_version     = aws_rds_cluster.test.engine_version
 }
@@ -3692,7 +3638,7 @@ resource "aws_kms_key" "test" {
       "Sid": "Enable IAM User Permissions",
       "Effect": "Allow",
       "Principal": {
-        "AWS": "*"
+        "AWS": "arn:${data.aws_partition.current.partition}:iam::${data.aws_caller_identity.current.account_id}:root"
       },
       "Action": "kms:*",
       "Resource": "*"
@@ -3821,11 +3767,15 @@ func testAccClusterConfig_EngineMode_global(rName string) string {
 resource "aws_rds_cluster" "test" {
   cluster_identifier  = %[1]q
   engine              = "aurora-mysql"
-  engine_version      = "5.7.mysql_aurora.2.11.2"
+  engine_version      = data.aws_rds_engine_version.default.version
   master_password     = "avoid-plaintext-passwords"
   master_username     = "tfacctest"
   skip_final_snapshot = true
 }
+
+data "aws_rds_engine_version" "default" {
+  engine = "aurora-mysql"
+}
 `, rName)
 }
 
@@ -3833,6 +3783,7 @@ func testAccClusterConfig_GlobalClusterID_EngineMode_global(rName string) string
 	return fmt.Sprintf(`
 resource "aws_rds_global_cluster" "test" {
   engine                    = "aurora-mysql"
+  engine_version            = data.aws_rds_engine_version.default.version
   force_destroy             = true # Partial configuration removal ordering fix for after Terraform 0.12
   global_cluster_identifier = %[1]q
 }
@@ -3841,11 +3792,15 @@ resource "aws_rds_cluster" "test" {
   cluster_identifier        = %[1]q
   global_cluster_identifier = aws_rds_global_cluster.test.id
   engine                    = "aurora-mysql"
-  engine_version            = aws_rds_global_cluster.test.engine_version
+  engine_version            = data.aws_rds_engine_version.default.version
   master_password           = "avoid-plaintext-passwords"
   master_username           = "tfacctest"
   skip_final_snapshot       = true
 }
+
+data "aws_rds_engine_version" "default" {
+  engine = "aurora-mysql"
+}
 `, rName)
 }
 
@@ -3855,6 +3810,7 @@ resource "aws_rds_global_cluster" "test" {
   count = 2
 
   engine                    = "aurora-mysql"
+  engine_version            = data.aws_rds_engine_version.default.version
   global_cluster_identifier = "%[1]s-${count.index}"
 }
 
@@ -3862,11 +3818,15 @@ resource "aws_rds_cluster" "test" {
   cluster_identifier        = %[1]q
   global_cluster_identifier = %[2]s.id
   engine                    = "aurora-mysql"
-  engine_version            = %[2]s.engine_version
+  engine_version            = data.aws_rds_engine_version.default.version
   master_password           = "avoid-plaintext-passwords"
   master_username           = "tfacctest"
   skip_final_snapshot       = true
 }
+
+data "aws_rds_engine_version" "default" {
+  engine = "aurora-mysql"
+}
 `, rName, globalClusterIdentifierResourceName)
 }
 
@@ -4632,14 +4592,13 @@ resource "aws_rds_cluster" "test" {
 func testAccClusterConfig_copyTagsToSnapshot(n int, f bool) string {
 	return fmt.Sprintf(`
 resource "aws_rds_cluster" "test" {
-  cluster_identifier              = "tf-aurora-cluster-%d"
-  engine                          = "aurora-mysql"
-  database_name                   = "mydb"
-  master_username                 = "foo"
-  master_password                 = "mustbeeightcharaters"
-  db_cluster_parameter_group_name = "default.aurora-mysql5.7"
-  copy_tags_to_snapshot           = %t
-  skip_final_snapshot             = true
+  cluster_identifier    = "tf-aurora-cluster-%d"
+  engine                = "aurora-mysql"
+  database_name         = "mydb"
+  master_username       = "foo"
+  master_password       = "mustbeeightcharaters"
+  copy_tags_to_snapshot = %t
+  skip_final_snapshot   = true
 }
 `, n, f)
 }
@@ -4722,13 +4681,24 @@ resource "aws_rds_cluster" "test" {
 func testAccClusterConfig_password(rName, password string) string {
 	return fmt.Sprintf(`
 resource "aws_rds_cluster" "test" {
-  cluster_identifier              = %[1]q
-  database_name                   = "test"
-  master_username                 = "tfacctest"
-  master_password                 = %[2]q
-  engine                          = "aurora-mysql"
-  db_cluster_parameter_group_name = "default.aurora-mysql5.7"
-  skip_final_snapshot             = true
+  cluster_identifier  = %[1]q
+  database_name       = "test"
+  master_username     = "tfacctest"
+  master_password     = %[2]q
+  engine              = "aurora-mysql"
+  skip_final_snapshot = true
 }
 `, rName, password)
 }
+
+func testAccConfig_ClusterSubnetGroup(rName string) string {
+	return acctest.ConfigCompose(
+		acctest.ConfigVPCWithSubnets(rName, 3),
+		fmt.Sprintf(`
+resource "aws_db_subnet_group" "test" {
+  name       = %[1]q
+  subnet_ids = aws_subnet.test[*].id
+}
+`, rName),
+	)
+}
diff --git a/internal/service/rds/clusters_data_source.go b/internal/service/rds/clusters_data_source.go
index 4d1063e2c4f..0d2bbc1000b 100644
--- a/internal/service/rds/clusters_data_source.go
+++ b/internal/service/rds/clusters_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rds
 
 import (
diff --git a/internal/service/rds/clusters_data_source_test.go b/internal/service/rds/clusters_data_source_test.go
index cdbb1a62730..ea7284beff2 100644
--- a/internal/service/rds/clusters_data_source_test.go
+++ b/internal/service/rds/clusters_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rds_test
 
 import (
diff --git a/internal/service/rds/consts.go b/internal/service/rds/consts.go
index b5f175587ec..9538da14323 100644
--- a/internal/service/rds/consts.go
+++ b/internal/service/rds/consts.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rds
 
 import (
@@ -19,6 +22,7 @@ const (
 	ClusterStatusMigrating                  = "migrating"
 	ClusterStatusModifying                  = "modifying"
 	ClusterStatusPreparingDataMigration     = "preparing-data-migration"
+	ClusterStatusPromoting                  = "promoting"
 	ClusterStatusRebooting                  = "rebooting"
 	ClusterStatusRenaming                   = "renaming"
 	ClusterStatusResettingMasterCredentials = "resetting-master-credentials"
@@ -61,6 +65,7 @@ const (
 	InstanceEngineSQLServerExpress    = "sqlserver-ex"
 	InstanceEngineSQLServerStandard   = "sqlserver-se"
 	InstanceEngineSQLServerWeb        = "sqlserver-ewb"
+	InstanceEngineCustomPrefix        = "custom-"
 )
 
 // https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/accessing-monitoring.html#Overview.DBInstance.Status.
@@ -77,6 +82,7 @@ const (
 	InstanceStatusFailed                                       = "failed"
 	InstanceStatusInaccessibleEncryptionCredentials            = "inaccessible-encryption-credentials"
 	InstanceStatusInaccessibleEncryptionCredentialsRecoverable = "inaccessible-encryption-credentials-recoverable"
+	InstanceStatusIncompatiblCreate                            = "incompatible-create"
 	InstanceStatusIncompatibleNetwork                          = "incompatible-network"
 	InstanceStatusIncompatibleOptionGroup                      = "incompatible-option-group"
 	InstanceStatusIncompatibleParameters                       = "incompatible-parameters"
@@ -98,9 +104,11 @@ const (
 )
 
 const (
-	InstanceAutomatedBackupStatusPending     = "pending"
-	InstanceAutomatedBackupStatusReplicating = "replicating"
-	InstanceAutomatedBackupStatusRetained    = "retained"
+	GlobalClusterStatusAvailable = "available"
+	GlobalClusterStatusCreating  = "creating"
+	GlobalClusterStatusDeleting  = "deleting"
+	GlobalClusterStatusModifying = "modifying"
+	GlobalClusterStatusUpgrading = "upgrading"
 )
 
 const (
@@ -120,6 +128,7 @@ const (
 	ClusterEngineAuroraPostgreSQL = "aurora-postgresql"
 	ClusterEngineMySQL            = "mysql"
 	ClusterEnginePostgres         = "postgres"
+	ClusterEngineCustomPrefix     = "custom-"
 )
 
 func ClusterEngine_Values() []string {
@@ -131,6 +140,20 @@ func ClusterEngine_Values() []string {
 	}
 }
 
+const (
+	GlobalClusterEngineAurora           = "aurora"
+	GlobalClusterEngineAuroraMySQL      = "aurora-mysql"
+	GlobalClusterEngineAuroraPostgreSQL = "aurora-postgresql"
+)
+
+func GlobalClusterEngine_Values() []string {
+	return []string{
+		GlobalClusterEngineAurora,
+		GlobalClusterEngineAuroraMySQL,
+		GlobalClusterEngineAuroraPostgreSQL,
+	}
+}
+
 const (
 	EngineModeGlobal        = "global"
 	EngineModeMultiMaster   = "multimaster"
@@ -226,6 +249,18 @@ func TimeoutAction_Values() []string {
 	}
 }
 
+const (
+	backupTargetOutposts = "outposts"
+	backupTargetRegion   = "region"
+)
+
+func backupTarget_Values() []string {
+	return []string{
+		backupTargetOutposts,
+		backupTargetRegion,
+	}
+}
+
 const (
 	propagationTimeout = 2 * time.Minute
 )
diff --git a/internal/service/rds/consts_test.go b/internal/service/rds/consts_test.go
index 531f791c3c9..756bbba090f 100644
--- a/internal/service/rds/consts_test.go
+++ b/internal/service/rds/consts_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rds_test
 
 const (
@@ -10,4 +13,5 @@ const (
 	sqlServerPreferredInstanceClasses       = `"db.t2.small", "db.t3.small"`
 	sqlServerSEPreferredInstanceClasses     = `"db.m5.large", "db.m4.large", "db.r4.large"`
 	oracleSE2PreferredInstanceClasses       = `"db.m5.large", "db.m4.large", "db.r4.large"`
+	outpostPreferredInstanceClasses         = `"db.m5.large", "db.r5.large"` // https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/rds-on-outposts.db-instance-classes.html
 )
diff --git a/internal/service/rds/custom_db_engine_version.go b/internal/service/rds/custom_db_engine_version.go
new file mode 100644
index 00000000000..42845da7ce2
--- /dev/null
+++ b/internal/service/rds/custom_db_engine_version.go
@@ -0,0 +1,469 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package rds
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"log"
+	"os"
+	"strings"
+	"time"
+
+	"github.com/YakDriver/regexache"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/rds"
+	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/structure"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/create"
+	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/internal/verify"
+	"github.com/hashicorp/terraform-provider-aws/names"
+	"github.com/mitchellh/go-homedir"
+)
+
+const cevMutexKey = `aws_rds_custom_engine_version`
+
+// @SDKResource("aws_rds_custom_db_engine_version", name="Custom DB Engine Version")
+// @Tags(identifierAttribute="arn")
+func ResourceCustomDBEngineVersion() *schema.Resource {
+	return &schema.Resource{
+		CreateWithoutTimeout: resourceCustomDBEngineVersionCreate,
+		ReadWithoutTimeout:   resourceCustomDBEngineVersionRead,
+		UpdateWithoutTimeout: resourceCustomDBEngineVersionUpdate,
+		DeleteWithoutTimeout: resourceCustomDBEngineVersionDelete,
+		Importer: &schema.ResourceImporter{
+			StateContext: schema.ImportStatePassthroughContext,
+		},
+		Timeouts: &schema.ResourceTimeout{
+			Create: schema.DefaultTimeout(240 * time.Minute),
+			Update: schema.DefaultTimeout(10 * time.Minute),
+			Delete: schema.DefaultTimeout(60 * time.Minute),
+		},
+		Schema: map[string]*schema.Schema{
+			"arn": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"create_time": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"database_installation_files_s3_bucket_name": {
+				Type:         schema.TypeString,
+				Optional:     true,
+				ForceNew:     true,
+				ValidateFunc: validation.StringLenBetween(3, 63),
+			},
+			"database_installation_files_s3_prefix": {
+				Type:         schema.TypeString,
+				Optional:     true,
+				ForceNew:     true,
+				ValidateFunc: validation.StringLenBetween(1, 255),
+			},
+			"db_parameter_group_family": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"description": {
+				Type:         schema.TypeString,
+				Optional:     true,
+				ValidateFunc: validation.StringLenBetween(1, 1000),
+			},
+			"engine": {
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+				ValidateFunc: validation.All(
+					validation.StringMatch(regexache.MustCompile(fmt.Sprintf(`^%s.*$`, InstanceEngineCustomPrefix)), fmt.Sprintf("must begin with %s", InstanceEngineCustomPrefix)),
+					validation.StringLenBetween(1, 35),
+				),
+			},
+			"engine_version": {
+				Type:         schema.TypeString,
+				Required:     true,
+				ForceNew:     true,
+				ValidateFunc: validation.StringLenBetween(1, 60),
+			},
+			"filename": {
+				Type:          schema.TypeString,
+				Optional:      true,
+				ForceNew:      true,
+				ConflictsWith: []string{"manifest"},
+			},
+			//API returns created image_id of the newly created image.
+			"image_id": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"kms_key_id": {
+				Type:         schema.TypeString,
+				Optional:     true,
+				Computed:     true,
+				ForceNew:     true,
+				ValidateFunc: verify.ValidARN,
+			},
+			"major_engine_version": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"manifest": {
+				Type:     schema.TypeString,
+				Optional: true,
+				ForceNew: true,
+				ValidateFunc: validation.All(
+					validation.StringIsJSON,
+					validation.StringLenBetween(1, 100000),
+				),
+				ConflictsWith:    []string{"filename"},
+				DiffSuppressFunc: verify.SuppressEquivalentJSONDiffs,
+				StateFunc: func(v interface{}) string {
+					json, _ := structure.NormalizeJsonString(v)
+					return json
+				},
+			},
+			//API returns manifest with service added additions, non-determinestic.
+			"manifest_computed": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"manifest_hash": {
+				Type:     schema.TypeString,
+				Optional: true,
+			},
+			"status": {
+				Type:         schema.TypeString,
+				Optional:     true,
+				Computed:     true,
+				ValidateFunc: validation.StringInSlice(rds.CustomEngineVersionStatus_Values(), false),
+			},
+			// Allow CEV creation from a source AMI ID.
+			// implicit state passthrough, virtual attribute
+			"source_image_id": {
+				Type:         schema.TypeString,
+				Optional:     true,
+				ForceNew:     true,
+				ValidateFunc: validation.StringLenBetween(1, 255),
+			},
+			names.AttrTags:    tftags.TagsSchema(),
+			names.AttrTagsAll: tftags.TagsSchemaComputed(),
+		},
+		CustomizeDiff: verify.SetTagsDiff,
+	}
+}
+
+const (
+	ResNameCustomDBEngineVersion = "Custom DB Engine Version"
+)
+
+func resourceCustomDBEngineVersionCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).RDSConn(ctx)
+
+	input := rds.CreateCustomDBEngineVersionInput{
+		Engine:        aws.String(d.Get("engine").(string)),
+		EngineVersion: aws.String(d.Get("engine_version").(string)),
+		Tags:          getTagsIn(ctx),
+	}
+
+	if v, ok := d.GetOk("database_installation_files_s3_bucket_name"); ok {
+		input.DatabaseInstallationFilesS3BucketName = aws.String(v.(string))
+	}
+
+	if v, ok := d.GetOk("database_installation_files_s3_prefix"); ok {
+		input.DatabaseInstallationFilesS3Prefix = aws.String(v.(string))
+	}
+
+	if v, ok := d.GetOk("description"); ok {
+		input.Description = aws.String(v.(string))
+	}
+
+	if v, ok := d.GetOk("source_image_id"); ok {
+		input.ImageId = aws.String(v.(string))
+	}
+
+	if v, ok := d.GetOk("kms_key_id"); ok {
+		input.KMSKeyId = aws.String(v.(string))
+	}
+
+	if v, ok := d.GetOk("filename"); ok {
+		filename := v.(string)
+		// Grab an exclusive lock so that we're only reading one contact flow into
+		// memory at a time.
+		// See https://github.com/hashicorp/terraform/issues/9364
+		conns.GlobalMutexKV.Lock(cevMutexKey)
+		defer conns.GlobalMutexKV.Unlock(cevMutexKey)
+		file, err := resourceCustomDBEngineVersionLoadFileContent(filename)
+		if err != nil {
+			return diag.Errorf("unable to load %q: %s", filename, err)
+		}
+		input.Manifest = aws.String(file)
+	} else if v, ok := d.GetOk("manifest"); ok {
+		input.Manifest = aws.String(v.(string))
+	}
+
+	output, err := conn.CreateCustomDBEngineVersionWithContext(ctx, &input)
+	if err != nil {
+		return append(diags, create.DiagError(names.RDS, create.ErrActionCreating, ResNameCustomDBEngineVersion, fmt.Sprintf("%s:%s", aws.StringValue(output.Engine), aws.StringValue(output.EngineVersion)), err)...)
+	}
+
+	if output == nil {
+		return append(diags, create.DiagError(names.RDS, create.ErrActionCreating, ResNameCustomDBEngineVersion, fmt.Sprintf("%s:%s", aws.StringValue(output.Engine), aws.StringValue(output.EngineVersion)), errors.New("empty output"))...)
+	}
+
+	d.SetId(fmt.Sprintf("%s:%s", aws.StringValue(output.Engine), aws.StringValue(output.EngineVersion)))
+
+	if _, err := waitCustomDBEngineVersionCreated(ctx, conn, d.Id(), d.Timeout(schema.TimeoutCreate)); err != nil {
+		return append(diags, create.DiagError(names.RDS, create.ErrActionWaitingForCreation, ResNameCustomDBEngineVersion, d.Id(), err)...)
+	}
+
+	return append(diags, resourceCustomDBEngineVersionRead(ctx, d, meta)...)
+}
+
+func resourceCustomDBEngineVersionRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).RDSConn(ctx)
+
+	out, err := FindCustomDBEngineVersionByID(ctx, conn, d.Id())
+	if !d.IsNewResource() && tfresource.NotFound(err) {
+		log.Printf("[WARN] RDS CustomDBEngineVersion (%s) not found, removing from state", d.Id())
+		d.SetId("")
+		return diags
+	}
+
+	if err != nil {
+		return append(diags, create.DiagError(names.RDS, create.ErrActionReading, ResNameCustomDBEngineVersion, d.Id(), err)...)
+	}
+
+	d.Set("arn", out.DBEngineVersionArn)
+	if out.CreateTime != nil {
+		d.Set("create_time", out.CreateTime.Format(time.RFC3339))
+	}
+	d.Set("database_installation_files_s3_bucket_name", out.DatabaseInstallationFilesS3BucketName)
+	d.Set("database_installation_files_s3_prefix", out.DatabaseInstallationFilesS3Prefix)
+	d.Set("db_parameter_group_family", out.DBParameterGroupFamily)
+	d.Set("description", out.DBEngineVersionDescription)
+	d.Set("engine", out.Engine)
+	d.Set("engine_version", out.EngineVersion)
+	d.Set("image_id", out.Image.ImageId)
+	d.Set("kms_key_id", out.KMSKeyId)
+	d.Set("major_engine_version", out.MajorEngineVersion)
+	d.Set("manifest_computed", out.CustomDBEngineVersionManifest)
+	d.Set("status", out.Status)
+
+	setTagsOut(ctx, out.TagList)
+
+	return diags
+}
+
+func resourceCustomDBEngineVersionUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).RDSConn(ctx)
+
+	if d.HasChangesExcept("description", "status") {
+		return append(diags, create.DiagError(names.RDS, create.ErrActionUpdating, ResNameCustomDBEngineVersion, d.Id(), errors.New("only description and status can be updated"))...)
+	}
+
+	update := false
+	engine, engineVersion, e := customEngineVersionParseID(d.Id())
+	if e != nil {
+		return append(diags, create.DiagError(names.RDS, create.ErrActionUpdating, ResNameCustomDBEngineVersion, d.Id(), e)...)
+	}
+	input := &rds.ModifyCustomDBEngineVersionInput{
+		Engine:        aws.String(engine),
+		EngineVersion: aws.String(engineVersion),
+	}
+
+	if d.HasChanges("description") {
+		input.Description = aws.String(d.Get("description").(string))
+		update = true
+	}
+	if d.HasChanges("status") {
+		input.Status = aws.String(d.Get("status").(string))
+		update = true
+	}
+
+	if !update {
+		return diags
+	}
+
+	log.Printf("[DEBUG] Updating RDS CustomDBEngineVersion (%s): %#v", d.Id(), input)
+	output, err := conn.ModifyCustomDBEngineVersionWithContext(ctx, input)
+	if err != nil {
+		return append(diags, create.DiagError(names.RDS, create.ErrActionUpdating, ResNameCustomDBEngineVersion, d.Id(), err)...)
+	}
+	if output == nil {
+		return append(diags, create.DiagError(names.RDS, create.ErrActionUpdating, ResNameCustomDBEngineVersion, d.Id(), errors.New("empty output"))...)
+	}
+
+	if _, err := waitCustomDBEngineVersionUpdated(ctx, conn, d.Id(), d.Timeout(schema.TimeoutUpdate)); err != nil {
+		return append(diags, create.DiagError(names.RDS, create.ErrActionWaitingForUpdate, ResNameCustomDBEngineVersion, d.Id(), err)...)
+	}
+
+	return append(diags, resourceCustomDBEngineVersionRead(ctx, d, meta)...)
+}
+
+func resourceCustomDBEngineVersionDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).RDSConn(ctx)
+
+	log.Printf("[INFO] Deleting RDS CustomDBEngineVersion %s", d.Id())
+
+	engine, engineVersion, e := customEngineVersionParseID(d.Id())
+	if e != nil {
+		return append(diags, create.DiagError(names.RDS, create.ErrActionUpdating, ResNameCustomDBEngineVersion, d.Id(), e)...)
+	}
+	_, err := conn.DeleteCustomDBEngineVersionWithContext(ctx, &rds.DeleteCustomDBEngineVersionInput{
+		Engine:        aws.String(engine),
+		EngineVersion: aws.String(engineVersion),
+	})
+
+	if tfawserr.ErrCodeEquals(err, rds.ErrCodeCustomDBEngineVersionNotFoundFault) {
+		return diags
+	}
+
+	if err != nil {
+		return append(diags, create.DiagError(names.RDS, create.ErrActionDeleting, ResNameCustomDBEngineVersion, d.Id(), err)...)
+	}
+
+	if _, err := waitCustomDBEngineVersionDeleted(ctx, conn, d.Id(), d.Timeout(schema.TimeoutDelete)); err != nil {
+		return append(diags, create.DiagError(names.RDS, create.ErrActionWaitingForDeletion, ResNameCustomDBEngineVersion, d.Id(), err)...)
+	}
+
+	return diags
+}
+
+const (
+	statusAvailable         = "available"
+	statusCreating          = "creating"
+	statusDeleting          = "deleting"
+	statusDeprecated        = "deprecated"
+	statusFailed            = "failed"
+	statusPendingValidation = "pending-validation" // Custom for SQL Server, ready for validation by an instance
+)
+
+func waitCustomDBEngineVersionCreated(ctx context.Context, conn *rds.RDS, id string, timeout time.Duration) (*rds.DBEngineVersion, error) {
+	stateConf := &retry.StateChangeConf{
+		Pending:                   []string{statusCreating},
+		Target:                    []string{statusAvailable, statusPendingValidation},
+		Refresh:                   statusCustomDBEngineVersion(ctx, conn, id),
+		Timeout:                   timeout,
+		NotFoundChecks:            20,
+		ContinuousTargetOccurence: 2,
+	}
+
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+	if out, ok := outputRaw.(*rds.DBEngineVersion); ok {
+		return out, err
+	}
+
+	return nil, err
+}
+
+func waitCustomDBEngineVersionUpdated(ctx context.Context, conn *rds.RDS, id string, timeout time.Duration) (*rds.DBEngineVersion, error) {
+	stateConf := &retry.StateChangeConf{
+		Pending:                   []string{statusAvailable},
+		Target:                    []string{statusAvailable, statusPendingValidation},
+		Refresh:                   statusCustomDBEngineVersion(ctx, conn, id),
+		Timeout:                   timeout,
+		NotFoundChecks:            20,
+		ContinuousTargetOccurence: 2,
+	}
+
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+	if out, ok := outputRaw.(*rds.DBEngineVersion); ok {
+		return out, err
+	}
+
+	return nil, err
+}
+
+func waitCustomDBEngineVersionDeleted(ctx context.Context, conn *rds.RDS, id string, timeout time.Duration) (*rds.DBEngineVersion, error) {
+	stateConf := &retry.StateChangeConf{
+		Pending: []string{statusDeleting},
+		Target:  []string{},
+		Refresh: statusCustomDBEngineVersion(ctx, conn, id),
+		Timeout: timeout,
+	}
+
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+	if out, ok := outputRaw.(*rds.DBEngineVersion); ok {
+		return out, err
+	}
+
+	return nil, err
+}
+
+func statusCustomDBEngineVersion(ctx context.Context, conn *rds.RDS, id string) retry.StateRefreshFunc {
+	return func() (interface{}, string, error) {
+		out, err := FindCustomDBEngineVersionByID(ctx, conn, id)
+		if tfresource.NotFound(err) {
+			return nil, "", nil
+		}
+
+		if err != nil {
+			return nil, "", err
+		}
+
+		return out, aws.StringValue(out.Status), nil
+	}
+}
+
+func FindCustomDBEngineVersionByID(ctx context.Context, conn *rds.RDS, id string) (*rds.DBEngineVersion, error) {
+	engine, engineVersion, e := customEngineVersionParseID(id)
+	if e != nil {
+		return nil, e
+	}
+	input := &rds.DescribeDBEngineVersionsInput{
+		Engine:        aws.String(engine),
+		EngineVersion: aws.String(engineVersion),
+		IncludeAll:    aws.Bool(true), // Required to return CEVs that are in `creating` state
+	}
+
+	output, err := conn.DescribeDBEngineVersionsWithContext(ctx, input)
+	if tfawserr.ErrCodeEquals(err, rds.ErrCodeCustomDBEngineVersionNotFoundFault) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+	if err != nil {
+		return nil, err
+	}
+	if output == nil || len(output.DBEngineVersions) == 0 {
+		return nil, &retry.NotFoundError{
+			LastRequest: input,
+		}
+	}
+
+	return output.DBEngineVersions[0], nil
+}
+
+func customEngineVersionParseID(id string) (string, string, error) {
+	parts := strings.SplitN(id, ":", 2)
+	if len(parts) != 2 || parts[0] == "" || parts[1] == "" {
+		return "", "", fmt.Errorf("unexpected format of ID (%s), expected engine:engineversion", id)
+	}
+
+	return parts[0], parts[1], nil
+}
+
+func resourceCustomDBEngineVersionLoadFileContent(filename string) (string, error) {
+	filename, err := homedir.Expand(filename)
+	if err != nil {
+		return "", err
+	}
+	fileContent, err := os.ReadFile(filename)
+	if err != nil {
+		return "", err
+	}
+	return string(fileContent), nil
+}
diff --git a/internal/service/rds/custom_db_engine_version_test.go b/internal/service/rds/custom_db_engine_version_test.go
new file mode 100644
index 00000000000..c3a7e9d3cb5
--- /dev/null
+++ b/internal/service/rds/custom_db_engine_version_test.go
@@ -0,0 +1,457 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package rds_test
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"os"
+	"testing"
+
+	"github.com/YakDriver/regexache"
+	"github.com/aws/aws-sdk-go/service/rds"
+	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
+	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/create"
+	tfrds "github.com/hashicorp/terraform-provider-aws/internal/service/rds"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/names"
+)
+
+func TestAccRDSCustomDBEngineVersion_sqlServer(t *testing.T) {
+	ctx := acctest.Context(t)
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
+	// Requires an existing Windows SQL Server AMI owned by operating account set as environmental variable
+	// Blog: https://aws.amazon.com/blogs/database/persist-your-os-level-customization-within-amazon-rds-custom-for-sql-server-using-custom-engine-version-cev/
+	key := "RDS_CUSTOM_WINDOWS_SQLSERVER_AMI"
+	ami := os.Getenv(key)
+	if ami == "" {
+		t.Skipf("Environment variable %s is not set", key)
+	}
+	var customdbengineversion rds.DBEngineVersion
+	rName := fmt.Sprintf("%s%s%d", "15.00.4249.2.", acctest.ResourcePrefix, sdkacctest.RandIntRange(100, 999))
+	resourceName := "aws_rds_custom_db_engine_version.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, rds.EndpointsID)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, rds.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckCustomDBEngineVersionDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccCustomDBEngineVersionConfig_sqlServer(rName, ami),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckCustomDBEngineVersionExists(ctx, resourceName, &customdbengineversion),
+					resource.TestCheckResourceAttr(resourceName, "engine_version", rName),
+					resource.TestCheckResourceAttrSet(resourceName, "create_time"),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "rds",
+						regexache.MustCompile(fmt.Sprintf(`cev:custom-sqlserver.+%s.+`, rName))),
+				),
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"filename", "manifest_hash", "manifest", "source_image_id"},
+			},
+		},
+	})
+}
+
+func TestAccRDSCustomDBEngineVersion_sqlServerUpdate(t *testing.T) {
+	ctx := acctest.Context(t)
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
+	// Requires an existing Windows SQL Server AMI owned by operating account set as environmental variable
+	key := "RDS_CUSTOM_WINDOWS_SQLSERVER_AMI"
+	ami := os.Getenv(key)
+	if ami == "" {
+		t.Skipf("Environment variable %s is not set", key)
+	}
+	var customdbengineversion rds.DBEngineVersion
+	rName := fmt.Sprintf("%s%s%d", "15.00.4249.2.", acctest.ResourcePrefix, sdkacctest.RandIntRange(100, 999))
+	resourceName := "aws_rds_custom_db_engine_version.test"
+	status := "pending-validation"
+	description2 := "inactive"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, rds.EndpointsID)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, rds.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckCustomDBEngineVersionDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccCustomDBEngineVersionConfig_sqlServer(rName, ami),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckCustomDBEngineVersionExists(ctx, resourceName, &customdbengineversion),
+					resource.TestCheckResourceAttr(resourceName, "engine_version", rName),
+					resource.TestCheckResourceAttr(resourceName, "status", status),
+					resource.TestCheckResourceAttrSet(resourceName, "create_time"),
+				),
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"filename", "manifest_hash", "manifest", "source_image_id"},
+			},
+			{
+				Config: testAccCustomDBEngineVersionConfig_sqlServerUpdate(rName, ami, description2),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckCustomDBEngineVersionExists(ctx, resourceName, &customdbengineversion),
+					resource.TestCheckResourceAttr(resourceName, "engine_version", rName),
+					resource.TestCheckResourceAttr(resourceName, "description", description2),
+				),
+			},
+		},
+	})
+}
+
+func TestAccRDSCustomDBEngineVersion_oracle(t *testing.T) {
+	ctx := acctest.Context(t)
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
+	// Requires an existing Oracle installation media in S3 bucket owned (bucket must be in operating region) by operating account set as environmental variable
+	// Pre-requisite: https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/custom-cev.preparing.html
+	key := "RDS_CUSTOM_ORACLE_S3_BUCKET"
+	bucket := os.Getenv(key)
+	if bucket == "" {
+		t.Skipf("Environment variable %s is not set", key)
+	}
+	var customdbengineversion rds.DBEngineVersion
+	rName := fmt.Sprintf("%s%s%d", "19.19.ee.", acctest.ResourcePrefix, sdkacctest.RandIntRange(100, 999))
+	resourceName := "aws_rds_custom_db_engine_version.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, rds.EndpointsID)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, rds.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckCustomDBEngineVersionDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccCustomDBEngineVersionConfig_oracle(rName, bucket),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckCustomDBEngineVersionExists(ctx, resourceName, &customdbengineversion),
+					resource.TestCheckResourceAttr(resourceName, "engine_version", rName),
+					resource.TestCheckResourceAttrSet(resourceName, "create_time"),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "rds", regexache.MustCompile(fmt.Sprintf(`cev:custom-oracle.+%s.+`, rName))),
+				),
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"filename", "manifest_hash", "manifest"},
+			},
+		},
+	})
+}
+
+func TestAccRDSCustomDBEngineVersion_manifestFile(t *testing.T) {
+	ctx := acctest.Context(t)
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
+	// Requires an existing Oracle installation media in S3 bucket owned (bucket must be in operating region) by operating account set as environmental variable
+	// Pre-requisite: https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/custom-cev.preparing.html
+	key := "RDS_CUSTOM_ORACLE_S3_BUCKET"
+	bucket := os.Getenv(key)
+	if bucket == "" {
+		t.Skipf("Environment variable %s is not set", key)
+	}
+	var customdbengineversion rds.DBEngineVersion
+	rName := fmt.Sprintf("%s%s%d", "19.19.ee.", acctest.ResourcePrefix, sdkacctest.RandIntRange(100, 999))
+	filename := "test-fixtures/custom-oracle-manifest.json"
+	resourceName := "aws_rds_custom_db_engine_version.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, rds.EndpointsID)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, rds.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckCustomDBEngineVersionDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccCustomDBEngineVersionConfig_manifestFile(rName, bucket, filename),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckCustomDBEngineVersionExists(ctx, resourceName, &customdbengineversion),
+					resource.TestCheckResourceAttr(resourceName, "engine_version", rName),
+					resource.TestCheckResourceAttrSet(resourceName, "create_time"),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "rds", regexache.MustCompile(fmt.Sprintf(`cev:custom-oracle.+%s.+`, rName))),
+				),
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"filename", "manifest_hash", "manifest"},
+			},
+		},
+	})
+}
+
+func TestAccRDSCustomDBEngineVersion_tags(t *testing.T) {
+	ctx := acctest.Context(t)
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
+	// Requires an existing Windows SQL Server AMI owned by operating account set as environmental variable
+	key := "RDS_CUSTOM_WINDOWS_SQLSERVER_AMI"
+	ami := os.Getenv(key)
+	if ami == "" {
+		t.Skipf("Environment variable %s is not set", key)
+	}
+	var customdbengineversion rds.DBEngineVersion
+	rName := fmt.Sprintf("%s%s%d", "15.00.4249.2.", acctest.ResourcePrefix, sdkacctest.RandIntRange(100, 999))
+	resourceName := "aws_rds_custom_db_engine_version.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, rds.EndpointsID)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, rds.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckCustomDBEngineVersionDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccCustomDBEngineVersionConfig_tags(rName, ami, "key1", "value1"),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckCustomDBEngineVersionExists(ctx, resourceName, &customdbengineversion),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccRDSCustomDBEngineVersion_disappears(t *testing.T) {
+	ctx := acctest.Context(t)
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
+	// Requires an existing Windows SQL Server AMI owned by operating account set as environmental variable
+	key := "RDS_CUSTOM_WINDOWS_SQLSERVER_AMI"
+	ami := os.Getenv(key)
+	if ami == "" {
+		t.Skipf("Environment variable %s is not set", key)
+	}
+	var customdbengineversion rds.DBEngineVersion
+	rName := fmt.Sprintf("%s%s%d", "15.00.4249.2.", acctest.ResourcePrefix, sdkacctest.RandIntRange(100, 999))
+	resourceName := "aws_rds_custom_db_engine_version.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, rds.EndpointsID)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, rds.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckCustomDBEngineVersionDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccCustomDBEngineVersionConfig_sqlServer(rName, ami),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckCustomDBEngineVersionExists(ctx, resourceName, &customdbengineversion),
+					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfrds.ResourceCustomDBEngineVersion(), resourceName),
+				),
+				ExpectNonEmptyPlan: true,
+			},
+		},
+	})
+}
+
+func testAccCheckCustomDBEngineVersionDestroy(ctx context.Context) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		conn := acctest.Provider.Meta().(*conns.AWSClient).RDSConn(ctx)
+
+		for _, rs := range s.RootModule().Resources {
+			if rs.Type != "aws_rds_custom_db_engine_version" {
+				continue
+			}
+
+			_, err := tfrds.FindCustomDBEngineVersionByID(ctx, conn, rs.Primary.ID)
+			if tfresource.NotFound(err) {
+				continue
+			}
+
+			if err != nil {
+				return err
+			}
+
+			return create.Error(names.RDS, create.ErrActionCheckingDestroyed, tfrds.ResNameCustomDBEngineVersion, rs.Primary.ID, errors.New("not destroyed"))
+		}
+
+		return nil
+	}
+}
+
+func testAccCheckCustomDBEngineVersionExists(ctx context.Context, name string, customdbengineversion *rds.DBEngineVersion) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[name]
+		if !ok {
+			return create.Error(names.RDS, create.ErrActionCheckingExistence, tfrds.ResNameCustomDBEngineVersion, name, errors.New("not found"))
+		}
+
+		if rs.Primary.ID == "" {
+			return create.Error(names.RDS, create.ErrActionCheckingExistence, tfrds.ResNameCustomDBEngineVersion, name, errors.New("not set"))
+		}
+
+		conn := acctest.Provider.Meta().(*conns.AWSClient).RDSConn(ctx)
+
+		output, err := tfrds.FindCustomDBEngineVersionByID(ctx, conn, rs.Primary.ID)
+		if err != nil {
+			return create.Error(names.RDS, create.ErrActionCheckingExistence, tfrds.ResNameCustomDBEngineVersion, rs.Primary.ID, err)
+		}
+
+		*customdbengineversion = *output
+
+		return nil
+	}
+}
+
+func testAccPreCheck(ctx context.Context, t *testing.T) {
+	conn := acctest.Provider.Meta().(*conns.AWSClient).RDSConn(ctx)
+
+	input := &rds.DescribeDBEngineVersionsInput{}
+	_, err := conn.DescribeDBEngineVersionsWithContext(ctx, input)
+
+	if acctest.PreCheckSkipError(err) {
+		t.Skipf("skipping acceptance testing: %s", err)
+	}
+	if err != nil {
+		t.Fatalf("unexpected PreCheck error: %s", err)
+	}
+}
+
+func testAccCustomDBEngineVersionConfig_sqlServer(rName, ami string) string {
+	return fmt.Sprintf(`
+data "aws_region" "current" {}
+
+# Copy the Amazon AMI for Windows SQL Server, CEV creation requires an AMI owned by the operator
+resource "aws_ami_copy" "test" {
+  name              = %[1]q
+  source_ami_id     = %[2]q
+  source_ami_region = data.aws_region.current.name
+}
+
+resource "aws_rds_custom_db_engine_version" "test" {
+  engine          = "custom-sqlserver-se"
+  engine_version  = %[1]q
+  source_image_id = aws_ami_copy.test.id
+}
+`, rName, ami)
+}
+
+func testAccCustomDBEngineVersionConfig_sqlServerUpdate(rName, ami, description string) string {
+	return fmt.Sprintf(`
+data "aws_region" "current" {}
+
+# Copy the Amazon AMI for Windows SQL Server, CEV creation requires an AMI owned by the operator
+resource "aws_ami_copy" "test" {
+  name              = %[1]q
+  source_ami_id     = %[2]q
+  source_ami_region = data.aws_region.current.name
+}
+
+resource "aws_rds_custom_db_engine_version" "test" {
+  description     = %[3]q
+  engine          = "custom-sqlserver-se"
+  engine_version  = %[1]q
+  source_image_id = aws_ami_copy.test.id
+}
+`, rName, ami, description)
+}
+
+func testAccCustomDBEngineVersionConfig_oracle(rName, bucket string) string {
+	return fmt.Sprintf(`
+resource "aws_kms_key" "rdscfo_kms_key" {
+  description = "KMS symmetric key for RDS Custom for Oracle"
+}
+
+resource "aws_rds_custom_db_engine_version" "test" {
+  database_installation_files_s3_bucket_name = %[2]q
+  engine                                     = "custom-oracle-ee-cdb"
+  engine_version                             = %[1]q
+  kms_key_id                                 = aws_kms_key.rdscfo_kms_key.arn
+  manifest                                   = <<JSON
+  {
+	"databaseInstallationFileNames":["V982063-01.zip"]
+  }
+  JSON
+}
+`, rName, bucket)
+}
+
+func testAccCustomDBEngineVersionConfig_manifestFile(rName, bucket, filename string) string {
+	return fmt.Sprintf(`
+resource "aws_kms_key" "rdscfo_kms_key" {
+  description = "KMS symmetric key for RDS Custom for Oracle"
+}
+
+resource "aws_rds_custom_db_engine_version" "test" {
+  database_installation_files_s3_bucket_name = %[2]q
+  engine                                     = "custom-oracle-ee-cdb"
+  engine_version                             = %[1]q
+  kms_key_id                                 = aws_kms_key.rdscfo_kms_key.arn
+  filename                                   = %[3]q
+  manifest_hash                              = filebase64sha256(%[3]q)
+}
+`, rName, bucket, filename)
+}
+
+func testAccCustomDBEngineVersionConfig_tags(rName, ami, key, value string) string {
+	return fmt.Sprintf(`
+data "aws_region" "current" {}
+
+# Copy the Amazon AMI for Windows SQL Server, CEV creation requires an AMI owned by the operator
+resource "aws_ami_copy" "test" {
+  name              = %[1]q
+  source_ami_id     = %[2]q
+  source_ami_region = data.aws_region.current.name
+}
+
+resource "aws_rds_custom_db_engine_version" "test" {
+  engine          = "custom-sqlserver-se"
+  engine_version  = %[1]q
+  source_image_id = aws_ami_copy.test.id
+
+  tags = {
+    %[3]q = %[4]q
+  }
+}
+`, rName, ami, key, value)
+}
diff --git a/internal/service/rds/engine_version_data_source.go b/internal/service/rds/engine_version_data_source.go
index 84c5b08e6db..ed38d3f4b56 100644
--- a/internal/service/rds/engine_version_data_source.go
+++ b/internal/service/rds/engine_version_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rds
 
 import (
diff --git a/internal/service/rds/engine_version_data_source_test.go b/internal/service/rds/engine_version_data_source_test.go
index 2bf7653ba98..b8c410f892c 100644
--- a/internal/service/rds/engine_version_data_source_test.go
+++ b/internal/service/rds/engine_version_data_source_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rds_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/rds"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -35,12 +38,12 @@ func TestAccRDSEngineVersionDataSource_basic(t *testing.T) {
 
 					resource.TestCheckResourceAttrSet(dataSourceName, "default_character_set"),
 					resource.TestCheckResourceAttrSet(dataSourceName, "engine_description"),
-					resource.TestMatchResourceAttr(dataSourceName, "exportable_log_types.#", regexp.MustCompile(`^[1-9][0-9]*`)),
+					resource.TestMatchResourceAttr(dataSourceName, "exportable_log_types.#", regexache.MustCompile(`^[1-9][0-9]*`)),
 					resource.TestCheckResourceAttrSet(dataSourceName, "status"),
-					resource.TestMatchResourceAttr(dataSourceName, "supported_character_sets.#", regexp.MustCompile(`^[1-9][0-9]*`)),
-					resource.TestMatchResourceAttr(dataSourceName, "supported_feature_names.#", regexp.MustCompile(`^[1-9][0-9]*`)),
-					resource.TestMatchResourceAttr(dataSourceName, "supported_modes.#", regexp.MustCompile(`^[0-9]*`)),
-					resource.TestMatchResourceAttr(dataSourceName, "supported_timezones.#", regexp.MustCompile(`^[0-9]*`)),
+					resource.TestMatchResourceAttr(dataSourceName, "supported_character_sets.#", regexache.MustCompile(`^[1-9][0-9]*`)),
+					resource.TestMatchResourceAttr(dataSourceName, "supported_feature_names.#", regexache.MustCompile(`^[1-9][0-9]*`)),
+					resource.TestMatchResourceAttr(dataSourceName, "supported_modes.#", regexache.MustCompile(`^[0-9]*`)),
+					resource.TestMatchResourceAttr(dataSourceName, "supported_timezones.#", regexache.MustCompile(`^[0-9]*`)),
 					resource.TestCheckResourceAttrSet(dataSourceName, "supports_global_databases"),
 					resource.TestCheckResourceAttrSet(dataSourceName, "supports_log_exports_to_cloudwatch"),
 					resource.TestCheckResourceAttrSet(dataSourceName, "supports_parallel_query"),
@@ -65,7 +68,7 @@ func TestAccRDSEngineVersionDataSource_upgradeTargets(t *testing.T) {
 			{
 				Config: testAccEngineVersionDataSourceConfig_upgradeTargets(),
 				Check: resource.ComposeTestCheckFunc(
-					resource.TestMatchResourceAttr(dataSourceName, "valid_upgrade_targets.#", regexp.MustCompile(`^[1-9][0-9]*`)),
+					resource.TestMatchResourceAttr(dataSourceName, "valid_upgrade_targets.#", regexache.MustCompile(`^[1-9][0-9]*`)),
 				),
 			},
 		},
@@ -85,7 +88,7 @@ func TestAccRDSEngineVersionDataSource_preferred(t *testing.T) {
 			{
 				Config: testAccEngineVersionDataSourceConfig_preferred(),
 				Check: resource.ComposeTestCheckFunc(
-					resource.TestCheckResourceAttr(dataSourceName, "version", "8.0.27"),
+					resource.TestCheckResourceAttr(dataSourceName, "version", "8.0.32"),
 				),
 			},
 		},
@@ -125,7 +128,7 @@ func TestAccRDSEngineVersionDataSource_defaultOnlyExplicit(t *testing.T) {
 			{
 				Config: testAccEngineVersionDataSourceConfig_defaultOnlyExplicit(),
 				Check: resource.ComposeTestCheckFunc(
-					resource.TestMatchResourceAttr(dataSourceName, "version", regexp.MustCompile(`^8\.0\.`)),
+					resource.TestMatchResourceAttr(dataSourceName, "version", regexache.MustCompile(`^8\.0\.`)),
 				),
 			},
 		},
@@ -165,7 +168,7 @@ func TestAccRDSEngineVersionDataSource_filter(t *testing.T) {
 			{
 				Config: testAccEngineVersionDataSourceConfig_filter(),
 				Check: resource.ComposeTestCheckFunc(
-					resource.TestCheckResourceAttr(dataSourceName, "version", "10.14"),
+					resource.TestCheckResourceAttr(dataSourceName, "version", "13.9"),
 					resource.TestCheckResourceAttr(dataSourceName, "supported_modes.0", "serverless"),
 				),
 			},
@@ -206,7 +209,7 @@ func testAccEngineVersionDataSourceConfig_upgradeTargets() string {
 	return `
 data "aws_rds_engine_version" "test" {
   engine  = "mysql"
-  version = "8.0.27"
+  version = "8.0.32"
 }
 `
 }
@@ -215,7 +218,7 @@ func testAccEngineVersionDataSourceConfig_preferred() string {
 	return `
 data "aws_rds_engine_version" "test" {
   engine             = "mysql"
-  preferred_versions = ["85.9.12", "8.0.27", "8.0.26"]
+  preferred_versions = ["85.9.12", "8.0.32", "8.0.31"]
 }
 `
 }
@@ -252,7 +255,7 @@ func testAccEngineVersionDataSourceConfig_filter() string {
 	return `
 data "aws_rds_engine_version" "test" {
   engine      = "aurora-postgresql"
-  version     = "10.14"
+  version     = "13.9"
   include_all = true
 
   filter {
diff --git a/internal/service/rds/engine_version_test.go b/internal/service/rds/engine_version_test.go
index beed7faa38b..243187124b3 100644
--- a/internal/service/rds/engine_version_test.go
+++ b/internal/service/rds/engine_version_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rds
 
 import (
diff --git a/internal/service/rds/errors.go b/internal/service/rds/errors.go
index 1a82779324d..9f7569c83ca 100644
--- a/internal/service/rds/errors.go
+++ b/internal/service/rds/errors.go
@@ -1,7 +1,10 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rds
 
 const (
+	errCodeInvalidParameterCombination = "InvalidParameterCombination"
 	errCodeInvalidParameterValue       = "InvalidParameterValue"
 	errCodeValidationError             = "ValidationError"
-	errCodeInvalidParameterCombination = "InvalidParameterCombination"
 )
diff --git a/internal/service/rds/event_categories_data_source.go b/internal/service/rds/event_categories_data_source.go
index abe2628e9c5..22df4fec20a 100644
--- a/internal/service/rds/event_categories_data_source.go
+++ b/internal/service/rds/event_categories_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rds
 
 import (
diff --git a/internal/service/rds/event_categories_data_source_test.go b/internal/service/rds/event_categories_data_source_test.go
index 04b56db5cda..8493f0e32a2 100644
--- a/internal/service/rds/event_categories_data_source_test.go
+++ b/internal/service/rds/event_categories_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rds_test
 
 import (
diff --git a/internal/service/rds/event_subscription.go b/internal/service/rds/event_subscription.go
index 0b70ff88bce..ff5634bf8b6 100644
--- a/internal/service/rds/event_subscription.go
+++ b/internal/service/rds/event_subscription.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rds
 
 import (
diff --git a/internal/service/rds/event_subscription_test.go b/internal/service/rds/event_subscription_test.go
index 442a6ef2f01..fe840e744ba 100644
--- a/internal/service/rds/event_subscription_test.go
+++ b/internal/service/rds/event_subscription_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rds_test
 
 import (
diff --git a/internal/service/rds/export_task.go b/internal/service/rds/export_task.go
index 6bc300821b8..4640ba32368 100644
--- a/internal/service/rds/export_task.go
+++ b/internal/service/rds/export_task.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rds
 
 import (
@@ -20,8 +23,8 @@ import (
 	"github.com/hashicorp/terraform-plugin-framework/types/basetypes"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-provider-aws/internal/create"
-	"github.com/hashicorp/terraform-provider-aws/internal/flex"
 	"github.com/hashicorp/terraform-provider-aws/internal/framework"
+	"github.com/hashicorp/terraform-provider-aws/internal/framework/flex"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -369,7 +372,7 @@ func (rd *resourceExportTaskData) refreshFromOutput(ctx context.Context, out *aw
 	rd.FailureCause = flex.StringToFramework(ctx, out.FailureCause)
 	rd.IAMRoleArn = flex.StringToFramework(ctx, out.IamRoleArn)
 	rd.KMSKeyID = flex.StringToFramework(ctx, out.KmsKeyId)
-	rd.PercentProgress = types.Int64Value(int64(out.PercentProgress))
+	rd.PercentProgress = types.Int64Value(int64(aws.ToInt32(out.PercentProgress)))
 	rd.S3BucketName = flex.StringToFramework(ctx, out.S3Bucket)
 	rd.S3Prefix = flex.StringToFramework(ctx, out.S3Prefix)
 	rd.SnapshotTime = timeToFramework(ctx, out.SnapshotTime)
diff --git a/internal/service/rds/export_task_test.go b/internal/service/rds/export_task_test.go
index 20050d23c64..6646dd3d379 100644
--- a/internal/service/rds/export_task_test.go
+++ b/internal/service/rds/export_task_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rds_test
 
 import (
@@ -172,11 +175,6 @@ resource "aws_s3_bucket" "test" {
   force_destroy = true
 }
 
-resource "aws_s3_bucket_acl" "test" {
-  bucket = aws_s3_bucket.test.id
-  acl    = "private"
-}
-
 resource "aws_iam_role" "test" {
   name = %[1]q
 
@@ -240,16 +238,14 @@ resource "aws_kms_key" "test" {
 }
 
 resource "aws_db_instance" "test" {
-  identifier           = %[1]q
-  allocated_storage    = 10
-  db_name              = "test"
-  engine               = "mysql"
-  engine_version       = "5.7"
-  instance_class       = "db.t3.micro"
-  username             = "foo"
-  password             = "foobarbaz"
-  parameter_group_name = "default.mysql5.7"
-  skip_final_snapshot  = true
+  identifier          = %[1]q
+  allocated_storage   = 10
+  db_name             = "test"
+  engine              = "mysql"
+  instance_class      = "db.t3.micro"
+  username            = "foo"
+  password            = "foobarbaz"
+  skip_final_snapshot = true
 }
 
 resource "aws_db_snapshot" "test" {
diff --git a/internal/service/rds/exports_test.go b/internal/service/rds/exports_test.go
index e814a11f5ff..a4c0b177088 100644
--- a/internal/service/rds/exports_test.go
+++ b/internal/service/rds/exports_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rds
 
 // Exports for use in tests only.
diff --git a/internal/service/rds/find.go b/internal/service/rds/find.go
index 8f64cacafcc..d0977c49acb 100644
--- a/internal/service/rds/find.go
+++ b/internal/service/rds/find.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rds
 
 import (
@@ -192,168 +195,6 @@ func FindEventSubscriptionByID(ctx context.Context, conn *rds.RDS, id string) (*
 	return output.EventSubscriptionsList[0], nil
 }
 
-func FindDBInstanceAutomatedBackupByARN(ctx context.Context, conn *rds.RDS, arn string) (*rds.DBInstanceAutomatedBackup, error) {
-	input := &rds.DescribeDBInstanceAutomatedBackupsInput{
-		DBInstanceAutomatedBackupsArn: aws.String(arn),
-	}
-
-	output, err := findDBInstanceAutomatedBackup(ctx, conn, input)
-	if err != nil {
-		return nil, err
-	}
-
-	if status := aws.StringValue(output.Status); status == InstanceAutomatedBackupStatusRetained {
-		// If the automated backup is retained, the replication is stopped.
-		return nil, &retry.NotFoundError{
-			Message:     status,
-			LastRequest: input,
-		}
-	}
-
-	// Eventual consistency check.
-	if aws.StringValue(output.DBInstanceAutomatedBackupsArn) != arn {
-		return nil, &retry.NotFoundError{
-			LastRequest: input,
-		}
-	}
-
-	return output, nil
-}
-
-func findDBInstanceAutomatedBackup(ctx context.Context, conn *rds.RDS, input *rds.DescribeDBInstanceAutomatedBackupsInput) (*rds.DBInstanceAutomatedBackup, error) {
-	output, err := findDBInstanceAutomatedBackups(ctx, conn, input)
-	if err != nil {
-		return nil, err
-	}
-
-	if len(output) == 0 || output[0] == nil {
-		return nil, tfresource.NewEmptyResultError(input)
-	}
-
-	if count := len(output); count > 1 {
-		return nil, tfresource.NewTooManyResultsError(count, input)
-	}
-
-	return output[0], nil
-}
-
-func findDBInstanceAutomatedBackups(ctx context.Context, conn *rds.RDS, input *rds.DescribeDBInstanceAutomatedBackupsInput) ([]*rds.DBInstanceAutomatedBackup, error) {
-	var output []*rds.DBInstanceAutomatedBackup
-
-	err := conn.DescribeDBInstanceAutomatedBackupsPagesWithContext(ctx, input, func(page *rds.DescribeDBInstanceAutomatedBackupsOutput, lastPage bool) bool {
-		if page == nil {
-			return !lastPage
-		}
-
-		for _, v := range page.DBInstanceAutomatedBackups {
-			if v != nil {
-				output = append(output, v)
-			}
-		}
-
-		return !lastPage
-	})
-
-	if tfawserr.ErrCodeEquals(err, rds.ErrCodeDBInstanceAutomatedBackupNotFoundFault) {
-		return nil, &retry.NotFoundError{
-			LastError:   err,
-			LastRequest: input,
-		}
-	}
-
-	if err != nil {
-		return nil, err
-	}
-
-	return output, nil
-}
-
-func FindGlobalClusterByDBClusterARN(ctx context.Context, conn *rds.RDS, dbClusterARN string) (*rds.GlobalCluster, error) {
-	input := &rds.DescribeGlobalClustersInput{}
-	globalClusters, err := findGlobalClusters(ctx, conn, input)
-	if err != nil {
-		return nil, err
-	}
-
-	for _, globalCluster := range globalClusters {
-		for _, v := range globalCluster.GlobalClusterMembers {
-			if aws.StringValue(v.DBClusterArn) == dbClusterARN {
-				return globalCluster, nil
-			}
-		}
-	}
-
-	return nil, &retry.NotFoundError{LastRequest: dbClusterARN}
-}
-
-func FindGlobalClusterByID(ctx context.Context, conn *rds.RDS, id string) (*rds.GlobalCluster, error) {
-	input := &rds.DescribeGlobalClustersInput{
-		GlobalClusterIdentifier: aws.String(id),
-	}
-
-	output, err := findGlobalCluster(ctx, conn, input)
-	if err != nil {
-		return nil, err
-	}
-
-	// Eventual consistency check.
-	if aws.StringValue(output.GlobalClusterIdentifier) != id {
-		return nil, &retry.NotFoundError{
-			LastRequest: input,
-		}
-	}
-
-	return output, nil
-}
-
-func findGlobalCluster(ctx context.Context, conn *rds.RDS, input *rds.DescribeGlobalClustersInput) (*rds.GlobalCluster, error) {
-	output, err := findGlobalClusters(ctx, conn, input)
-	if err != nil {
-		return nil, err
-	}
-
-	if len(output) == 0 || output[0] == nil {
-		return nil, tfresource.NewEmptyResultError(input)
-	}
-
-	if count := len(output); count > 1 {
-		return nil, tfresource.NewTooManyResultsError(count, input)
-	}
-
-	return output[0], nil
-}
-
-func findGlobalClusters(ctx context.Context, conn *rds.RDS, input *rds.DescribeGlobalClustersInput) ([]*rds.GlobalCluster, error) {
-	var output []*rds.GlobalCluster
-
-	err := conn.DescribeGlobalClustersPagesWithContext(ctx, input, func(page *rds.DescribeGlobalClustersOutput, lastPage bool) bool {
-		if page == nil {
-			return !lastPage
-		}
-
-		for _, v := range page.GlobalClusters {
-			if v != nil {
-				output = append(output, v)
-			}
-		}
-
-		return !lastPage
-	})
-
-	if tfawserr.ErrCodeEquals(err, rds.ErrCodeGlobalClusterNotFoundFault) {
-		return nil, &retry.NotFoundError{
-			LastError:   err,
-			LastRequest: input,
-		}
-	}
-
-	if err != nil {
-		return nil, err
-	}
-
-	return output, nil
-}
-
 func FindReservedDBInstanceByID(ctx context.Context, conn *rds.RDS, id string) (*rds.ReservedDBInstance, error) {
 	input := &rds.DescribeReservedDBInstancesInput{
 		ReservedDBInstanceId: aws.String(id),
diff --git a/internal/service/rds/flex.go b/internal/service/rds/flex.go
index fd31bb18756..ca95cd44905 100644
--- a/internal/service/rds/flex.go
+++ b/internal/service/rds/flex.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rds
 
 import (
@@ -256,11 +259,17 @@ func flattenOptions(apiOptions []*rds.Option, optionConfigurations []*rds.Option
 			"db_security_group_memberships":  schema.NewSet(schema.HashString, dbSecurityGroupMemberships),
 			"option_name":                    aws.StringValue(apiOption.OptionName),
 			"option_settings":                schema.NewSet(schema.HashResource(optionSettingsResource), optionSettings),
-			"port":                           aws.Int64Value(apiOption.Port),
-			"version":                        aws.StringValue(apiOption.OptionVersion),
 			"vpc_security_group_memberships": schema.NewSet(schema.HashString, vpcSecurityGroupMemberships),
 		}
 
+		if apiOption.OptionVersion != nil && configuredOption != nil && configuredOption.OptionVersion != nil {
+			r["version"] = aws.StringValue(apiOption.OptionVersion)
+		}
+
+		if apiOption.Port != nil && configuredOption != nil && configuredOption.Port != nil {
+			r["port"] = aws.Int64Value(apiOption.Port)
+		}
+
 		result = append(result, r)
 	}
 
diff --git a/internal/service/rds/flex_test.go b/internal/service/rds/flex_test.go
index 5a3bed3dfce..24b8596c48d 100644
--- a/internal/service/rds/flex_test.go
+++ b/internal/service/rds/flex_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rds
 
 import (
diff --git a/internal/service/rds/generate.go b/internal/service/rds/generate.go
index 13efd80e67a..887fb1d8ded 100644
--- a/internal/service/rds/generate.go
+++ b/internal/service/rds/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTags -ListTagsInIDElem=ResourceName -ListTagsOutTagsElem=TagList -ServiceTagsSlice -TagOp=AddTagsToResource -TagInIDElem=ResourceName -UntagOp=RemoveTagsFromResource -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/rds/global_cluster.go b/internal/service/rds/global_cluster.go
index 5bd1542881c..5a36e018ea4 100644
--- a/internal/service/rds/global_cluster.go
+++ b/internal/service/rds/global_cluster.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rds
 
 import (
@@ -17,20 +20,10 @@ import (
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
+	tfslices "github.com/hashicorp/terraform-provider-aws/internal/slices"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
-const (
-	globalClusterCreateTimeout = 30 * time.Minute
-	globalClusterUpdateTimeout = 90 * time.Minute
-	// globalClusterDeleteTimeout is the overall timeout for detaching cluster members if needed
-	// and deleting the cluster
-	globalClusterDeleteTimeout = 30 * time.Minute
-	// GlobalClusterClusterDeleteTimeout is the timeout for actual deletion of the cluster
-	// This operation will be quick if successful
-	GlobalClusterClusterDeleteTimeout = 5 * time.Minute
-)
-
 // @SDKResource("aws_rds_global_cluster")
 func ResourceGlobalCluster() *schema.Resource {
 	return &schema.Resource{
@@ -38,14 +31,15 @@ func ResourceGlobalCluster() *schema.Resource {
 		ReadWithoutTimeout:   resourceGlobalClusterRead,
 		UpdateWithoutTimeout: resourceGlobalClusterUpdate,
 		DeleteWithoutTimeout: resourceGlobalClusterDelete,
+
 		Importer: &schema.ResourceImporter{
 			StateContext: schema.ImportStatePassthroughContext,
 		},
 
 		Timeouts: &schema.ResourceTimeout{
-			Create: schema.DefaultTimeout(globalClusterCreateTimeout),
-			Update: schema.DefaultTimeout(globalClusterUpdateTimeout),
-			Delete: schema.DefaultTimeout(globalClusterDeleteTimeout),
+			Create: schema.DefaultTimeout(30 * time.Minute),
+			Update: schema.DefaultTimeout(90 * time.Minute),
+			Delete: schema.DefaultTimeout(30 * time.Minute),
 		},
 
 		Schema: map[string]*schema.Schema{
@@ -69,11 +63,7 @@ func ResourceGlobalCluster() *schema.Resource {
 				Computed:      true,
 				ForceNew:      true,
 				ConflictsWith: []string{"source_db_cluster_identifier"},
-				ValidateFunc: validation.StringInSlice([]string{
-					"aurora",
-					"aurora-mysql",
-					"aurora-postgresql",
-				}, false),
+				ValidateFunc:  validation.StringInSlice(GlobalClusterEngine_Values(), false),
 			},
 			"engine_version": {
 				Type:     schema.TypeString,
@@ -89,9 +79,10 @@ func ResourceGlobalCluster() *schema.Resource {
 				Optional: true,
 			},
 			"global_cluster_identifier": {
-				Type:     schema.TypeString,
-				Required: true,
-				ForceNew: true,
+				Type:         schema.TypeString,
+				Required:     true,
+				ForceNew:     true,
+				ValidateFunc: validIdentifier,
 			},
 			"global_cluster_members": {
 				Type:     schema.TypeSet,
@@ -135,8 +126,9 @@ func resourceGlobalClusterCreate(ctx context.Context, d *schema.ResourceData, me
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).RDSConn(ctx)
 
+	globalClusterID := d.Get("global_cluster_identifier").(string)
 	input := &rds.CreateGlobalClusterInput{
-		GlobalClusterIdentifier: aws.String(d.Get("global_cluster_identifier").(string)),
+		GlobalClusterIdentifier: aws.String(globalClusterID),
 	}
 
 	if v, ok := d.GetOk("database_name"); ok {
@@ -167,18 +159,19 @@ func resourceGlobalClusterCreate(ctx context.Context, d *schema.ResourceData, me
 	// since we cannot have Engine default after adding SourceDBClusterIdentifier:
 	// InvalidParameterValue: When creating standalone global cluster, value for engineName should be specified
 	if input.Engine == nil && input.SourceDBClusterIdentifier == nil {
-		input.Engine = aws.String("aurora")
+		input.Engine = aws.String(GlobalClusterEngineAurora)
 	}
 
 	output, err := conn.CreateGlobalClusterWithContext(ctx, input)
+
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "creating RDS Global Cluster: %s", err)
+		return sdkdiag.AppendErrorf(diags, "creating RDS Global Cluster (%s): %s", globalClusterID, err)
 	}
 
 	d.SetId(aws.StringValue(output.GlobalCluster.GlobalClusterIdentifier))
 
-	if err := waitForGlobalClusterCreation(ctx, conn, d.Id(), d.Timeout(schema.TimeoutCreate)); err != nil {
-		return sdkdiag.AppendErrorf(diags, "waiting for RDS Global Cluster (%s) availability: %s", d.Id(), err)
+	if err := waitGlobalClusterCreated(ctx, conn, d.Id(), d.Timeout(schema.TimeoutCreate)); err != nil {
+		return sdkdiag.AppendErrorf(diags, "waiting for RDS Global Cluster (%s) create: %s", d.Id(), err)
 	}
 
 	return append(diags, resourceGlobalClusterRead(ctx, d, meta)...)
@@ -188,28 +181,16 @@ func resourceGlobalClusterRead(ctx context.Context, d *schema.ResourceData, meta
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).RDSConn(ctx)
 
-	globalCluster, err := DescribeGlobalCluster(ctx, conn, d.Id())
+	globalCluster, err := FindGlobalClusterByID(ctx, conn, d.Id())
 
-	if tfawserr.ErrCodeEquals(err, rds.ErrCodeGlobalClusterNotFoundFault) {
+	if !d.IsNewResource() && tfresource.NotFound(err) {
 		log.Printf("[WARN] RDS Global Cluster (%s) not found, removing from state", d.Id())
 		d.SetId("")
 		return diags
 	}
 
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "reading RDS Global Cluster: %s", err)
-	}
-
-	if globalCluster == nil {
-		log.Printf("[WARN] RDS Global Cluster (%s) not found, removing from state", d.Id())
-		d.SetId("")
-		return diags
-	}
-
-	if aws.StringValue(globalCluster.Status) == "deleting" || aws.StringValue(globalCluster.Status) == "deleted" {
-		log.Printf("[WARN] RDS Global Cluster (%s) in deleted state (%s), removing from state", d.Id(), aws.StringValue(globalCluster.Status))
-		d.SetId("")
-		return diags
+		return sdkdiag.AppendErrorf(diags, "reading RDS Global Cluster (%s): %s", d.Id(), err)
 	}
 
 	d.Set("arn", globalCluster.GlobalClusterArn)
@@ -268,8 +249,8 @@ func resourceGlobalClusterUpdate(ctx context.Context, d *schema.ResourceData, me
 		return sdkdiag.AppendErrorf(diags, "updating RDS Global Cluster (%s): %s", d.Id(), err)
 	}
 
-	if err := waitForGlobalClusterUpdate(ctx, conn, d.Id(), d.Timeout(schema.TimeoutUpdate)); err != nil {
-		return sdkdiag.AppendErrorf(diags, "updating RDS Global Cluster (%s): waiting for completion: %s", d.Id(), err)
+	if err := waitGlobalClusterUpdated(ctx, conn, d.Id(), d.Timeout(schema.TimeoutUpdate)); err != nil {
+		return sdkdiag.AppendErrorf(diags, "waiting for RDS Global Cluster (%s) update: %s", d.Id(), err)
 	}
 
 	return append(diags, resourceGlobalClusterRead(ctx, d, meta)...)
@@ -351,8 +332,13 @@ func resourceGlobalClusterDelete(ctx context.Context, d *schema.ResourceData, me
 
 	// Allow for eventual consistency
 	// InvalidGlobalClusterStateFault: Global Cluster arn:aws:rds::123456789012:global-cluster:tf-acc-test-5618525093076697001-0 is not empty
+	const (
+		// GlobalClusterClusterDeleteTimeout is the timeout for actual deletion of the cluster
+		// This operation will be quick if successful
+		globalClusterClusterDeleteTimeout = 5 * time.Minute
+	)
 	var timeout time.Duration
-	if x, y := deadline.Remaining(), GlobalClusterClusterDeleteTimeout; x < y {
+	if x, y := deadline.Remaining(), globalClusterClusterDeleteTimeout; x < y {
 		timeout = x
 	} else {
 		timeout = y
@@ -383,238 +369,197 @@ func resourceGlobalClusterDelete(ctx context.Context, d *schema.ResourceData, me
 		return sdkdiag.AppendErrorf(diags, "deleting RDS Global Cluster: %s", err)
 	}
 
-	if err := WaitForGlobalClusterDeletion(ctx, conn, d.Id(), deadline.Remaining()); err != nil {
-		return sdkdiag.AppendErrorf(diags, "waiting for RDS Global Cluster (%s) deletion: %s", d.Id(), err)
+	if err := waitGlobalClusterDeleted(ctx, conn, d.Id(), deadline.Remaining()); err != nil {
+		return sdkdiag.AppendErrorf(diags, "waiting for RDS Global Cluster (%s) delete: %s", d.Id(), err)
 	}
 
 	return diags
 }
 
-func flattenGlobalClusterMembers(apiObjects []*rds.GlobalClusterMember) []interface{} {
-	if len(apiObjects) == 0 {
-		return nil
+func FindGlobalClusterByDBClusterARN(ctx context.Context, conn *rds.RDS, dbClusterARN string) (*rds.GlobalCluster, error) {
+	input := &rds.DescribeGlobalClustersInput{
+		Filters: []*rds.Filter{
+			{
+				Name:   aws.String("db-cluster-id"),
+				Values: aws.StringSlice([]string{dbClusterARN}),
+			},
+		},
 	}
 
-	var tfList []interface{}
-
-	for _, apiObject := range apiObjects {
-		tfMap := map[string]interface{}{
-			"db_cluster_arn": aws.StringValue(apiObject.DBClusterArn),
-			"is_writer":      aws.BoolValue(apiObject.IsWriter),
+	return findGlobalCluster(ctx, conn, input, func(v *rds.GlobalCluster) bool {
+		for _, v := range v.GlobalClusterMembers {
+			if aws.StringValue(v.DBClusterArn) == dbClusterARN {
+				return true
+			}
 		}
+		return false
+	})
+}
 
-		tfList = append(tfList, tfMap)
+func FindGlobalClusterByID(ctx context.Context, conn *rds.RDS, id string) (*rds.GlobalCluster, error) {
+	input := &rds.DescribeGlobalClustersInput{
+		GlobalClusterIdentifier: aws.String(id),
 	}
+	output, err := findGlobalCluster(ctx, conn, input, tfslices.PredicateTrue[*rds.GlobalCluster]())
 
-	return tfList
+	if err != nil {
+		return nil, err
+	}
+
+	// Eventual consistency check.
+	if aws.StringValue(output.GlobalClusterIdentifier) != id {
+		return nil, &retry.NotFoundError{
+			LastRequest: input,
+		}
+	}
+
+	return output, nil
 }
 
-func DescribeGlobalCluster(ctx context.Context, conn *rds.RDS, globalClusterID string) (*rds.GlobalCluster, error) {
-	var globalCluster *rds.GlobalCluster
+func findGlobalCluster(ctx context.Context, conn *rds.RDS, input *rds.DescribeGlobalClustersInput, filter tfslices.Predicate[*rds.GlobalCluster]) (*rds.GlobalCluster, error) {
+	output, err := findGlobalClusters(ctx, conn, input, filter)
 
-	input := &rds.DescribeGlobalClustersInput{
-		GlobalClusterIdentifier: aws.String(globalClusterID),
+	if err != nil {
+		return nil, err
 	}
 
+	return tfresource.AssertSinglePtrResult(output)
+}
+
+func findGlobalClusters(ctx context.Context, conn *rds.RDS, input *rds.DescribeGlobalClustersInput, filter tfslices.Predicate[*rds.GlobalCluster]) ([]*rds.GlobalCluster, error) {
+	var output []*rds.GlobalCluster
+
 	err := conn.DescribeGlobalClustersPagesWithContext(ctx, input, func(page *rds.DescribeGlobalClustersOutput, lastPage bool) bool {
 		if page == nil {
 			return !lastPage
 		}
 
-		for _, gc := range page.GlobalClusters {
-			if gc == nil {
-				continue
-			}
-
-			if aws.StringValue(gc.GlobalClusterIdentifier) == globalClusterID {
-				globalCluster = gc
-				return false
+		for _, v := range page.GlobalClusters {
+			if v != nil && filter(v) {
+				output = append(output, v)
 			}
 		}
 
 		return !lastPage
 	})
 
-	return globalCluster, err
-}
-
-func DescribeGlobalClusterFromClusterARN(ctx context.Context, conn *rds.RDS, dbClusterARN string) (*rds.GlobalCluster, error) {
-	var globalCluster *rds.GlobalCluster
+	if tfawserr.ErrCodeEquals(err, rds.ErrCodeGlobalClusterNotFoundFault) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
 
-	input := &rds.DescribeGlobalClustersInput{
-		Filters: []*rds.Filter{
-			{
-				Name:   aws.String("db-cluster-id"),
-				Values: []*string{aws.String(dbClusterARN)},
-			},
-		},
+	if err != nil {
+		return nil, err
 	}
 
-	err := conn.DescribeGlobalClustersPagesWithContext(ctx, input, func(page *rds.DescribeGlobalClustersOutput, lastPage bool) bool {
-		if page == nil {
-			return !lastPage
-		}
+	return output, nil
+}
 
-		for _, gc := range page.GlobalClusters {
-			if gc == nil {
-				continue
-			}
+func flattenGlobalClusterMembers(apiObjects []*rds.GlobalClusterMember) []interface{} {
+	if len(apiObjects) == 0 {
+		return nil
+	}
 
-			for _, globalClusterMember := range gc.GlobalClusterMembers {
-				if aws.StringValue(globalClusterMember.DBClusterArn) == dbClusterARN {
-					globalCluster = gc
-					return false
-				}
-			}
+	var tfList []interface{}
+
+	for _, apiObject := range apiObjects {
+		tfMap := map[string]interface{}{
+			"db_cluster_arn": aws.StringValue(apiObject.DBClusterArn),
+			"is_writer":      aws.BoolValue(apiObject.IsWriter),
 		}
 
-		return !lastPage
-	})
+		tfList = append(tfList, tfMap)
+	}
 
-	return globalCluster, err
+	return tfList
 }
 
-func globalClusterRefreshFunc(ctx context.Context, conn *rds.RDS, globalClusterID string) retry.StateRefreshFunc {
+func statusGlobalCluster(ctx context.Context, conn *rds.RDS, id string) retry.StateRefreshFunc {
 	return func() (interface{}, string, error) {
-		globalCluster, err := DescribeGlobalCluster(ctx, conn, globalClusterID)
+		output, err := FindGlobalClusterByID(ctx, conn, id)
 
-		if tfawserr.ErrCodeEquals(err, rds.ErrCodeGlobalClusterNotFoundFault) {
-			return nil, "deleted", nil
+		if tfresource.NotFound(err) {
+			return nil, "", nil
 		}
 
 		if err != nil {
-			return nil, "", fmt.Errorf("reading RDS Global Cluster (%s): %s", globalClusterID, err)
-		}
-
-		if globalCluster == nil {
-			return nil, "deleted", nil
+			return nil, "", err
 		}
 
-		return globalCluster, aws.StringValue(globalCluster.Status), nil
+		return output, aws.StringValue(output.Status), nil
 	}
 }
 
-func waitForGlobalClusterCreation(ctx context.Context, conn *rds.RDS, globalClusterID string, timeout time.Duration) error {
+func waitGlobalClusterCreated(ctx context.Context, conn *rds.RDS, id string, timeout time.Duration) error {
 	stateConf := &retry.StateChangeConf{
-		Pending: []string{"creating"},
-		Target:  []string{"available"},
-		Refresh: globalClusterRefreshFunc(ctx, conn, globalClusterID),
+		Pending: []string{GlobalClusterStatusCreating},
+		Target:  []string{GlobalClusterStatusAvailable},
+		Refresh: statusGlobalCluster(ctx, conn, id),
 		Timeout: timeout,
 	}
 
-	log.Printf("[DEBUG] Waiting for RDS Global Cluster (%s) availability", globalClusterID)
 	_, err := stateConf.WaitForStateContext(ctx)
 
 	return err
 }
 
-func waitForGlobalClusterUpdate(ctx context.Context, conn *rds.RDS, globalClusterID string, timeout time.Duration) error {
+func waitGlobalClusterUpdated(ctx context.Context, conn *rds.RDS, id string, timeout time.Duration) error {
 	stateConf := &retry.StateChangeConf{
-		Pending: []string{"modifying", "upgrading"},
-		Target:  []string{"available"},
-		Refresh: globalClusterRefreshFunc(ctx, conn, globalClusterID),
+		Pending: []string{GlobalClusterStatusModifying, GlobalClusterStatusUpgrading},
+		Target:  []string{GlobalClusterStatusAvailable},
+		Refresh: statusGlobalCluster(ctx, conn, id),
 		Timeout: timeout,
 		Delay:   30 * time.Second,
 	}
 
-	log.Printf("[DEBUG] Waiting for RDS Global Cluster (%s) availability", globalClusterID)
 	_, err := stateConf.WaitForStateContext(ctx)
 
 	return err
 }
 
-func WaitForGlobalClusterDeletion(ctx context.Context, conn *rds.RDS, globalClusterID string, timeout time.Duration) error {
+func waitGlobalClusterDeleted(ctx context.Context, conn *rds.RDS, id string, timeout time.Duration) error {
 	stateConf := &retry.StateChangeConf{
-		Pending: []string{
-			"available",
-			"deleting",
-		},
-		Target:         []string{"deleted"},
-		Refresh:        globalClusterRefreshFunc(ctx, conn, globalClusterID),
+		Pending:        []string{GlobalClusterStatusAvailable, GlobalClusterStatusDeleting},
+		Target:         []string{},
+		Refresh:        statusGlobalCluster(ctx, conn, id),
 		Timeout:        timeout,
 		NotFoundChecks: 1,
 	}
 
 	_, err := stateConf.WaitForStateContext(ctx)
 
-	if tfresource.NotFound(err) {
-		return nil
-	}
-
 	return err
 }
 
-func waitForGlobalClusterRemoval(ctx context.Context, conn *rds.RDS, dbClusterIdentifier string, timeout time.Duration) error {
-	var globalCluster *rds.GlobalCluster
-	stillExistsErr := fmt.Errorf("RDS DB Cluster still exists in RDS Global Cluster")
-
-	err := retry.RetryContext(ctx, timeout, func() *retry.RetryError {
-		var err error
-
-		globalCluster, err = DescribeGlobalClusterFromClusterARN(ctx, conn, dbClusterIdentifier)
-
-		if err != nil {
-			return retry.NonRetryableError(err)
-		}
-
-		if globalCluster != nil {
-			return retry.RetryableError(stillExistsErr)
-		}
-
-		return nil
+func waitForGlobalClusterRemoval(ctx context.Context, conn *rds.RDS, dbClusterARN string, timeout time.Duration) error {
+	_, err := tfresource.RetryUntilNotFound(ctx, timeout, func() (interface{}, error) {
+		return FindGlobalClusterByDBClusterARN(ctx, conn, dbClusterARN)
 	})
 
-	if tfresource.TimedOut(err) {
-		_, err = DescribeGlobalClusterFromClusterARN(ctx, conn, dbClusterIdentifier)
-	}
-
-	if err != nil {
-		return err
-	}
-
-	if globalCluster != nil {
-		return stillExistsErr
-	}
-
-	return nil
+	return err
 }
 
 func globalClusterUpgradeMajorEngineVersion(ctx context.Context, meta interface{}, clusterID string, engineVersion string, timeout time.Duration) error {
 	conn := meta.(*conns.AWSClient).RDSConn(ctx)
 
 	input := &rds.ModifyGlobalClusterInput{
-		GlobalClusterIdentifier: aws.String(clusterID),
+		AllowMajorVersionUpgrade: aws.Bool(true),
+		EngineVersion:            aws.String(engineVersion),
+		GlobalClusterIdentifier:  aws.String(clusterID),
 	}
 
-	input.AllowMajorVersionUpgrade = aws.Bool(true)
-	input.EngineVersion = aws.String(engineVersion)
-
-	err := retry.RetryContext(ctx, timeout, func() *retry.RetryError {
-		_, err := conn.ModifyGlobalClusterWithContext(ctx, input)
-		if err != nil {
-			if tfawserr.ErrCodeEquals(err, rds.ErrCodeGlobalClusterNotFoundFault) {
-				return retry.NonRetryableError(err)
-			}
-
-			if tfawserr.ErrMessageContains(err, "InvalidParameterValue", "only supports Major Version Upgrades") {
-				return retry.NonRetryableError(err)
-			}
-
-			return retry.RetryableError(err)
-		}
-
-		return nil
-	})
-
-	if tfresource.TimedOut(err) {
-		_, err = conn.ModifyGlobalClusterWithContext(ctx, input)
-	}
+	_, err := tfresource.RetryWhenAWSErrMessageContains(ctx, timeout, func() (interface{}, error) {
+		return conn.ModifyGlobalClusterWithContext(ctx, input)
+	}, errCodeInvalidParameterValue, "only supports Major Version Upgrades")
 
 	if err != nil {
 		return fmt.Errorf("while upgrading major version of RDS Global Cluster (%s): %w", clusterID, err)
 	}
 
-	globalCluster, err := DescribeGlobalCluster(ctx, conn, clusterID)
+	globalCluster, err := FindGlobalClusterByID(ctx, conn, clusterID)
+
 	if err != nil {
 		return fmt.Errorf("while upgrading major version of RDS Global Cluster (%s): %w", clusterID, err)
 	}
@@ -750,7 +695,7 @@ func globalClusterUpgradeMinorEngineVersion(ctx context.Context, meta interface{
 		}
 	}
 
-	globalCluster, err := DescribeGlobalCluster(ctx, conn, clusterID)
+	globalCluster, err := FindGlobalClusterByID(ctx, conn, clusterID)
 
 	if tfawserr.ErrCodeEquals(err, rds.ErrCodeGlobalClusterNotFoundFault) {
 		return fmt.Errorf("after upgrading engine_version, could not find RDS Global Cluster (%s): %s", clusterID, err)
diff --git a/internal/service/rds/global_cluster_test.go b/internal/service/rds/global_cluster_test.go
index 0f32c04b809..dbfab938a03 100644
--- a/internal/service/rds/global_cluster_test.go
+++ b/internal/service/rds/global_cluster_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rds_test
 
 import (
 	"context"
 	"errors"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/rds"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -16,6 +19,7 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	tfrds "github.com/hashicorp/terraform-provider-aws/internal/service/rds"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
 func TestClusterIDRegionFromARN(t *testing.T) {
@@ -113,10 +117,10 @@ func TestAccRDSGlobalCluster_basic(t *testing.T) {
 					acctest.CheckResourceAttrGlobalARN(resourceName, "arn", "rds", fmt.Sprintf("global-cluster:%s", rName)),
 					resource.TestCheckResourceAttr(resourceName, "database_name", ""),
 					resource.TestCheckResourceAttr(resourceName, "deletion_protection", "false"),
-					resource.TestCheckResourceAttrSet(resourceName, "engine"),
+					resource.TestCheckResourceAttr(resourceName, "engine", "aurora-postgresql"),
 					resource.TestCheckResourceAttrSet(resourceName, "engine_version"),
 					resource.TestCheckResourceAttr(resourceName, "global_cluster_identifier", rName),
-					resource.TestMatchResourceAttr(resourceName, "global_cluster_resource_id", regexp.MustCompile(`cluster-.+`)),
+					resource.TestMatchResourceAttr(resourceName, "global_cluster_resource_id", regexache.MustCompile(`cluster-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "storage_encrypted", "false"),
 				),
 			},
@@ -145,7 +149,7 @@ func TestAccRDSGlobalCluster_disappears(t *testing.T) {
 				Config: testAccGlobalClusterConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckGlobalClusterExists(ctx, resourceName, &globalCluster1),
-					testAccCheckGlobalClusterDisappears(ctx, &globalCluster1),
+					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfrds.ResourceGlobalCluster(), resourceName),
 				),
 				ExpectNonEmptyPlan: true,
 			},
@@ -225,62 +229,6 @@ func TestAccRDSGlobalCluster_deletionProtection(t *testing.T) {
 	})
 }
 
-func TestAccRDSGlobalCluster_Engine_aurora(t *testing.T) {
-	ctx := acctest.Context(t)
-	var globalCluster1 rds.GlobalCluster
-	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
-	resourceName := "aws_rds_global_cluster.test"
-
-	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheckGlobalCluster(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, rds.EndpointsID),
-		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckGlobalClusterDestroy(ctx),
-		Steps: []resource.TestStep{
-			{
-				Config: testAccGlobalClusterConfig_engine(rName, "aurora"),
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckGlobalClusterExists(ctx, resourceName, &globalCluster1),
-					resource.TestCheckResourceAttr(resourceName, "engine", "aurora"),
-				),
-			},
-			{
-				ResourceName:      resourceName,
-				ImportState:       true,
-				ImportStateVerify: true,
-			},
-		},
-	})
-}
-
-func TestAccRDSGlobalCluster_EngineVersion_aurora(t *testing.T) {
-	ctx := acctest.Context(t)
-	var globalCluster1 rds.GlobalCluster
-	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
-	resourceName := "aws_rds_global_cluster.test"
-
-	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheckGlobalCluster(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, rds.EndpointsID),
-		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckGlobalClusterDestroy(ctx),
-		Steps: []resource.TestStep{
-			{
-				Config: testAccGlobalClusterConfig_engineVersion(rName, "aurora"),
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckGlobalClusterExists(ctx, resourceName, &globalCluster1),
-					resource.TestCheckResourceAttrPair(resourceName, "engine_version", "data.aws_rds_engine_version.default", "version"),
-				),
-			},
-			{
-				ResourceName:      resourceName,
-				ImportState:       true,
-				ImportStateVerify: true,
-			},
-		},
-	})
-}
-
 func TestAccRDSGlobalCluster_EngineVersion_updateMinor(t *testing.T) {
 	ctx := acctest.Context(t)
 	if testing.Short() {
@@ -298,14 +246,13 @@ func TestAccRDSGlobalCluster_EngineVersion_updateMinor(t *testing.T) {
 		CheckDestroy:             testAccCheckGlobalClusterDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				// Config: testAccGlobalClusterConfig_primaryEngineVersion(rName, "aurora", "5.6.mysql_aurora.1.22.2"),
 				Config: testAccGlobalClusterConfig_primaryEngineVersion(rName, "aurora-postgresql", "13.4"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckGlobalClusterExists(ctx, resourceName, &globalCluster1),
+					resource.TestCheckResourceAttr(resourceName, "engine_version", "13.4"),
 				),
 			},
 			{
-				// Config: testAccGlobalClusterConfig_primaryEngineVersion(rName, "aurora", "5.6.mysql_aurora.1.23.2"),
 				Config: testAccGlobalClusterConfig_primaryEngineVersion(rName, "aurora-postgresql", "13.5"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckGlobalClusterExists(ctx, resourceName, &globalCluster2),
@@ -339,17 +286,18 @@ func TestAccRDSGlobalCluster_EngineVersion_updateMajor(t *testing.T) {
 		CheckDestroy:             testAccCheckGlobalClusterDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccGlobalClusterConfig_primaryEngineVersion(rName, "aurora", "5.6.mysql_aurora.1.23.4"),
+				Config: testAccGlobalClusterConfig_primaryEngineVersion(rName, "aurora-mysql", "5.7.mysql_aurora.2.12.0"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckGlobalClusterExists(ctx, resourceName, &globalCluster1),
+					resource.TestCheckResourceAttr(resourceName, "engine_version", "5.7.mysql_aurora.2.12.0"),
 				),
 			},
 			{
-				Config: testAccGlobalClusterConfig_primaryEngineVersion(rName, "aurora-mysql", "5.7.mysql_aurora.2.11.1"),
+				Config: testAccGlobalClusterConfig_primaryEngineVersion(rName, "aurora-mysql", "8.0.mysql_aurora.3.02.3"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckGlobalClusterExists(ctx, resourceName, &globalCluster2),
 					testAccCheckGlobalClusterNotRecreated(&globalCluster1, &globalCluster2),
-					resource.TestCheckResourceAttr(resourceName, "engine_version", "5.7.mysql_aurora.2.11.1"),
+					resource.TestCheckResourceAttr(resourceName, "engine_version", "8.0.mysql_aurora.3.02.3"),
 				),
 			},
 			{
@@ -380,17 +328,18 @@ func TestAccRDSGlobalCluster_EngineVersion_updateMinorMultiRegion(t *testing.T)
 		CheckDestroy:             testAccCheckGlobalClusterDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccGlobalClusterConfig_engineVersionUpgradeMultiRegion(rNameGlobal, rNamePrimary, rNameSecondary, "aurora-mysql", "5.7.mysql_aurora.2.07.5"),
+				Config: testAccGlobalClusterConfig_engineVersionUpgradeMultiRegion(rNameGlobal, rNamePrimary, rNameSecondary, "aurora-mysql", "8.0.mysql_aurora.3.03.0"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckGlobalClusterExists(ctx, resourceName, &globalCluster1),
+					resource.TestCheckResourceAttr(resourceName, "engine_version", "8.0.mysql_aurora.3.03.0"),
 				),
 			},
 			{
-				Config: testAccGlobalClusterConfig_engineVersionUpgradeMultiRegion(rNameGlobal, rNamePrimary, rNameSecondary, "aurora-mysql", "5.7.mysql_aurora.2.07.7"),
+				Config: testAccGlobalClusterConfig_engineVersionUpgradeMultiRegion(rNameGlobal, rNamePrimary, rNameSecondary, "aurora-mysql", "8.0.mysql_aurora.3.03.1"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckGlobalClusterExists(ctx, resourceName, &globalCluster2),
 					testAccCheckGlobalClusterNotRecreated(&globalCluster1, &globalCluster2),
-					resource.TestCheckResourceAttr(resourceName, "engine_version", "5.7.mysql_aurora.2.07.7"),
+					resource.TestCheckResourceAttr(resourceName, "engine_version", "8.0.mysql_aurora.3.03.1"),
 				),
 			},
 		},
@@ -416,17 +365,18 @@ func TestAccRDSGlobalCluster_EngineVersion_updateMajorMultiRegion(t *testing.T)
 		CheckDestroy:             testAccCheckGlobalClusterDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccGlobalClusterConfig_engineVersionUpgradeMultiRegion(rNameGlobal, rNamePrimary, rNameSecondary, "aurora", "5.6.mysql_aurora.1.23.4"),
+				Config: testAccGlobalClusterConfig_engineVersionUpgradeMultiRegion(rNameGlobal, rNamePrimary, rNameSecondary, "aurora-mysql", "5.7.mysql_aurora.2.12.0"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckGlobalClusterExists(ctx, resourceName, &globalCluster1),
+					resource.TestCheckResourceAttr(resourceName, "engine_version", "5.7.mysql_aurora.2.12.0"),
 				),
 			},
 			{
-				Config: testAccGlobalClusterConfig_engineVersionUpgradeMultiRegion(rNameGlobal, rNamePrimary, rNameSecondary, "aurora-mysql", "5.7.mysql_aurora.2.11.1"),
+				Config: testAccGlobalClusterConfig_engineVersionUpgradeMultiRegion(rNameGlobal, rNamePrimary, rNameSecondary, "aurora-mysql", "8.0.mysql_aurora.3.02.3"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckGlobalClusterExists(ctx, resourceName, &globalCluster2),
 					testAccCheckGlobalClusterNotRecreated(&globalCluster1, &globalCluster2),
-					resource.TestCheckResourceAttr(resourceName, "engine_version", "5.7.mysql_aurora.2.11.1"),
+					resource.TestCheckResourceAttr(resourceName, "engine_version", "8.0.mysql_aurora.3.02.3"),
 				),
 			},
 		},
@@ -608,33 +558,22 @@ func TestAccRDSGlobalCluster_storageEncrypted(t *testing.T) {
 	})
 }
 
-func testAccCheckGlobalClusterExists(ctx context.Context, resourceName string, globalCluster *rds.GlobalCluster) resource.TestCheckFunc {
+func testAccCheckGlobalClusterExists(ctx context.Context, n string, v *rds.GlobalCluster) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		rs, ok := s.RootModule().Resources[resourceName]
+		rs, ok := s.RootModule().Resources[n]
 		if !ok {
-			return fmt.Errorf("Not found: %s", resourceName)
-		}
-
-		if rs.Primary.ID == "" {
-			return fmt.Errorf("No RDS Global Cluster ID is set")
+			return fmt.Errorf("Not found: %s", n)
 		}
 
 		conn := acctest.Provider.Meta().(*conns.AWSClient).RDSConn(ctx)
 
-		cluster, err := tfrds.DescribeGlobalCluster(ctx, conn, rs.Primary.ID)
+		output, err := tfrds.FindGlobalClusterByID(ctx, conn, rs.Primary.ID)
+
 		if err != nil {
 			return err
 		}
 
-		if cluster == nil {
-			return fmt.Errorf("RDS Global Cluster not found")
-		}
-
-		if aws.StringValue(cluster.Status) != "available" {
-			return fmt.Errorf("RDS Global Cluster (%s) exists in non-available (%s) state", rs.Primary.ID, aws.StringValue(cluster.Status))
-		}
-
-		*globalCluster = *cluster
+		*v = *output
 
 		return nil
 	}
@@ -649,9 +588,9 @@ func testAccCheckGlobalClusterDestroy(ctx context.Context) resource.TestCheckFun
 				continue
 			}
 
-			globalCluster, err := tfrds.DescribeGlobalCluster(ctx, conn, rs.Primary.ID)
+			_, err := tfrds.FindGlobalClusterByID(ctx, conn, rs.Primary.ID)
 
-			if tfawserr.ErrCodeEquals(err, rds.ErrCodeGlobalClusterNotFoundFault) {
+			if tfresource.NotFound(err) {
 				continue
 			}
 
@@ -659,34 +598,13 @@ func testAccCheckGlobalClusterDestroy(ctx context.Context) resource.TestCheckFun
 				return err
 			}
 
-			if globalCluster == nil {
-				continue
-			}
-
-			return fmt.Errorf("RDS Global Cluster (%s) still exists in non-deleted (%s) state", rs.Primary.ID, aws.StringValue(globalCluster.Status))
+			return fmt.Errorf("RDS Global Cluster %s still exists", rs.Primary.ID)
 		}
 
 		return nil
 	}
 }
 
-func testAccCheckGlobalClusterDisappears(ctx context.Context, globalCluster *rds.GlobalCluster) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		conn := acctest.Provider.Meta().(*conns.AWSClient).RDSConn(ctx)
-
-		input := &rds.DeleteGlobalClusterInput{
-			GlobalClusterIdentifier: globalCluster.GlobalClusterIdentifier,
-		}
-
-		_, err := conn.DeleteGlobalClusterWithContext(ctx, input)
-		if err != nil {
-			return err
-		}
-
-		return tfrds.WaitForGlobalClusterDeletion(ctx, conn, aws.StringValue(globalCluster.GlobalClusterIdentifier), tfrds.GlobalClusterClusterDeleteTimeout)
-	}
-}
-
 func testAccCheckGlobalClusterNotRecreated(i, j *rds.GlobalCluster) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		if aws.StringValue(i.GlobalClusterArn) != aws.StringValue(j.GlobalClusterArn) {
@@ -727,6 +645,7 @@ func testAccGlobalClusterConfig_basic(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_rds_global_cluster" "test" {
   global_cluster_identifier = %[1]q
+  engine                    = "aurora-postgresql"
 }
 `, rName)
 }
@@ -736,6 +655,7 @@ func testAccGlobalClusterConfig_databaseName(rName, databaseName string) string
 resource "aws_rds_global_cluster" "test" {
   database_name             = %[1]q
   global_cluster_identifier = %[2]q
+  engine                    = "aurora-postgresql"
 }
 `, databaseName, rName)
 }
@@ -745,19 +665,11 @@ func testAccGlobalClusterConfig_deletionProtection(rName string, deletionProtect
 resource "aws_rds_global_cluster" "test" {
   deletion_protection       = %[1]t
   global_cluster_identifier = %[2]q
+  engine                    = "aurora-postgresql"
 }
 `, deletionProtection, rName)
 }
 
-func testAccGlobalClusterConfig_engine(rName, engine string) string {
-	return fmt.Sprintf(`
-resource "aws_rds_global_cluster" "test" {
-  engine                    = %[1]q
-  global_cluster_identifier = %[2]q
-}
-`, engine, rName)
-}
-
 func testAccGlobalClusterConfig_engineVersion(rName, engine string) string {
 	return fmt.Sprintf(`
 data "aws_rds_engine_version" "default" {
@@ -776,6 +688,7 @@ func testAccGlobalClusterConfig_forceDestroy(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_rds_global_cluster" "test" {
   global_cluster_identifier = %[1]q
+  engine                    = "aurora-postgresql"
   force_destroy             = true
 }
 `, rName)
@@ -828,9 +741,7 @@ resource "aws_rds_cluster_instance" "test" {
 }
 
 func testAccGlobalClusterConfig_engineVersionUpgradeMultiRegion(rNameGlobal, rNamePrimary, rNameSecondary, engine, engineVersion string) string {
-	return acctest.ConfigCompose(
-		acctest.ConfigMultipleRegionProvider(2),
-		fmt.Sprintf(`
+	return acctest.ConfigCompose(acctest.ConfigMultipleRegionProvider(2), fmt.Sprintf(`
 data "aws_region" "current" {}
 
 data "aws_availability_zones" "alternate" {
@@ -853,12 +764,11 @@ resource "aws_rds_cluster" "primary" {
   allow_major_version_upgrade = true
   apply_immediately           = true
   cluster_identifier          = %[4]q
-  database_name               = "totoro"
   engine                      = aws_rds_global_cluster.test.engine
   engine_version              = aws_rds_global_cluster.test.engine_version
   global_cluster_identifier   = aws_rds_global_cluster.test.id
-  master_password             = "satsukimae"
-  master_username             = "maesatsuki"
+  master_password             = "avoid-plaintext-passwords"
+  master_username             = "tfacctest"
   skip_final_snapshot         = true
 
   lifecycle {
@@ -872,7 +782,7 @@ resource "aws_rds_cluster_instance" "primary" {
   engine             = aws_rds_cluster.primary.engine
   engine_version     = aws_rds_cluster.primary.engine_version
   identifier         = %[4]q
-  instance_class     = "db.r4.large"
+  instance_class     = "db.r5.large"
 }
 
 resource "aws_vpc" "alternate" {
@@ -929,7 +839,7 @@ resource "aws_rds_cluster_instance" "secondary" {
   engine             = aws_rds_cluster.secondary.engine
   engine_version     = aws_rds_cluster.secondary.engine_version
   identifier         = %[5]q
-  instance_class     = "db.r4.large"
+  instance_class     = "db.r5.large"
 }
 `, rNameGlobal, engine, engineVersion, rNamePrimary, rNameSecondary))
 }
@@ -998,6 +908,7 @@ func testAccGlobalClusterConfig_storageEncrypted(rName string, storageEncrypted
 resource "aws_rds_global_cluster" "test" {
   global_cluster_identifier = %[1]q
   storage_encrypted         = %[2]t
+  engine                    = "aurora-postgresql"
 }
 `, rName, storageEncrypted)
 }
diff --git a/internal/service/rds/id.go b/internal/service/rds/id.go
index fff4d0cb6a9..7d6ce52c4a3 100644
--- a/internal/service/rds/id.go
+++ b/internal/service/rds/id.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rds
 
 import (
diff --git a/internal/service/rds/instance.go b/internal/service/rds/instance.go
index 3c05f0cb17b..d0a08c19a35 100644
--- a/internal/service/rds/instance.go
+++ b/internal/service/rds/instance.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rds
 
 import (
@@ -5,18 +8,18 @@ import (
 	"errors"
 	"fmt"
 	"log"
-	"regexp"
 	"strconv"
 	"strings"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/aws/arn"
 	rds_sdkv2 "github.com/aws/aws-sdk-go-v2/service/rds"
 	"github.com/aws/aws-sdk-go-v2/service/rds/types"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/rds"
-	"github.com/aws/smithy-go"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	tfawserr_sdkv2 "github.com/hashicorp/aws-sdk-go-base/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/customdiff"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
@@ -27,6 +30,7 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/errs"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
 	"github.com/hashicorp/terraform-provider-aws/internal/flex"
+	tfslices "github.com/hashicorp/terraform-provider-aws/internal/slices"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
@@ -142,6 +146,13 @@ func ResourceInstance() *schema.Resource {
 				Computed:     true,
 				ValidateFunc: validation.IntBetween(0, 35),
 			},
+			"backup_target": {
+				Type:         schema.TypeString,
+				Optional:     true,
+				Computed:     true,
+				ForceNew:     true,
+				ValidateFunc: validation.StringInSlice(backupTarget_Values(), false),
+			},
 			"backup_window": {
 				Type:         schema.TypeString,
 				Optional:     true,
@@ -181,7 +192,7 @@ func ResourceInstance() *schema.Resource {
 				Type:         schema.TypeString,
 				Optional:     true,
 				ForceNew:     true,
-				ValidateFunc: validation.StringMatch(regexp.MustCompile(`^AWSRDSCustom.*$`), "must begin with AWSRDSCustom"),
+				ValidateFunc: validation.StringMatch(regexache.MustCompile(`^AWSRDSCustom.*$`), "must begin with AWSRDSCustom"),
 			},
 			"customer_owned_ip_enabled": {
 				Type:     schema.TypeBool,
@@ -253,10 +264,10 @@ func ResourceInstance() *schema.Resource {
 				Type:     schema.TypeString,
 				Optional: true,
 				ValidateFunc: validation.All(
-					validation.StringMatch(regexp.MustCompile(`^[A-Za-z]`), "must begin with alphabetic character"),
-					validation.StringMatch(regexp.MustCompile(`^[0-9A-Za-z-]+$`), "must only contain alphanumeric characters and hyphens"),
-					validation.StringDoesNotMatch(regexp.MustCompile(`--`), "cannot contain two consecutive hyphens"),
-					validation.StringDoesNotMatch(regexp.MustCompile(`-$`), "cannot end in a hyphen"),
+					validation.StringMatch(regexache.MustCompile(`^[A-Za-z]`), "must begin with alphabetic character"),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z-]+$`), "must only contain alphanumeric characters and hyphens"),
+					validation.StringDoesNotMatch(regexache.MustCompile(`--`), "cannot contain two consecutive hyphens"),
+					validation.StringDoesNotMatch(regexache.MustCompile(`-$`), "cannot end in a hyphen"),
 				),
 			},
 			"hosted_zone_id": {
@@ -849,6 +860,9 @@ func resourceInstanceCreate(ctx context.Context, d *schema.ResourceData, meta in
 		if _, ok := d.GetOk("timezone"); ok {
 			diags = sdkdiag.AppendErrorf(diags, `"timezone" doesn't work with restores"`)
 		}
+		if _, ok := d.GetOk("backup_target"); ok {
+			diags = sdkdiag.AppendErrorf(diags, `"backup_target" doesn't work with restores"`)
+		}
 		if diags.HasError() {
 			return diags
 		}
@@ -1046,6 +1060,10 @@ func resourceInstanceCreate(ctx context.Context, d *schema.ResourceData, meta in
 			requiresModifyDbInstance = true
 		}
 
+		if v, ok := d.GetOk("backup_target"); ok {
+			input.BackupTarget = aws.String(v.(string))
+		}
+
 		if v, ok := d.GetOk("backup_window"); ok {
 			modifyDbInstanceInput.PreferredBackupWindow = aws.String(v.(string))
 			requiresModifyDbInstance = true
@@ -1102,6 +1120,16 @@ func resourceInstanceCreate(ctx context.Context, d *schema.ResourceData, meta in
 			requiresModifyDbInstance = true
 		}
 
+		if v, ok := d.GetOk("manage_master_user_password"); ok {
+			modifyDbInstanceInput.ManageMasterUserPassword = aws.Bool(v.(bool))
+			requiresModifyDbInstance = true
+		}
+
+		if v, ok := d.GetOk("master_user_secret_kms_key_id"); ok {
+			modifyDbInstanceInput.MasterUserSecretKmsKeyId = aws.String(v.(string))
+			requiresModifyDbInstance = true
+		}
+
 		if v, ok := d.GetOk("max_allocated_storage"); ok {
 			modifyDbInstanceInput.MaxAllocatedStorage = aws.Int64(int64(v.(int)))
 			requiresModifyDbInstance = true
@@ -1220,9 +1248,8 @@ func resourceInstanceCreate(ctx context.Context, d *schema.ResourceData, meta in
 			output := outputRaw.(*rds.RestoreDBInstanceFromDBSnapshotOutput)
 			resourceID = aws.StringValue(output.DBInstance.DbiResourceId)
 		}
-	} else if v, ok := d.GetOk("restore_to_point_in_time"); ok {
+	} else if v, ok := d.GetOk("restore_to_point_in_time"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
 		tfMap := v.([]interface{})[0].(map[string]interface{})
-
 		input := &rds.RestoreDBInstanceToPointInTimeInput{
 			AutoMinorVersionUpgrade:    aws.Bool(d.Get("auto_minor_version_upgrade").(bool)),
 			CopyTagsToSnapshot:         aws.Bool(d.Get("copy_tags_to_snapshot").(bool)),
@@ -1259,6 +1286,10 @@ func resourceInstanceCreate(ctx context.Context, d *schema.ResourceData, meta in
 			input.AvailabilityZone = aws.String(v.(string))
 		}
 
+		if v, ok := d.GetOk("backup_target"); ok {
+			input.BackupTarget = aws.String(v.(string))
+		}
+
 		if v, ok := d.GetOk("custom_iam_instance_profile"); ok {
 			input.CustomIamInstanceProfile = aws.String(v.(string))
 		}
@@ -1307,6 +1338,16 @@ func resourceInstanceCreate(ctx context.Context, d *schema.ResourceData, meta in
 			input.MaxAllocatedStorage = aws.Int64(int64(v.(int)))
 		}
 
+		if v, ok := d.GetOk("manage_master_user_password"); ok {
+			modifyDbInstanceInput.ManageMasterUserPassword = aws.Bool(v.(bool))
+			requiresModifyDbInstance = true
+		}
+
+		if v, ok := d.GetOk("master_user_secret_kms_key_id"); ok {
+			modifyDbInstanceInput.MasterUserSecretKmsKeyId = aws.String(v.(string))
+			requiresModifyDbInstance = true
+		}
+
 		if v, ok := d.GetOk("monitoring_interval"); ok {
 			modifyDbInstanceInput.MonitoringInterval = aws.Int64(int64(v.(int)))
 			requiresModifyDbInstance = true
@@ -1404,6 +1445,10 @@ func resourceInstanceCreate(ctx context.Context, d *schema.ResourceData, meta in
 			input.AvailabilityZone = aws.String(v.(string))
 		}
 
+		if v, ok := d.GetOk("backup_target"); ok {
+			input.BackupTarget = aws.String(v.(string))
+		}
+
 		if v, ok := d.GetOk("backup_window"); ok {
 			input.PreferredBackupWindow = aws.String(v.(string))
 		}
@@ -1563,7 +1608,7 @@ func resourceInstanceCreate(ctx context.Context, d *schema.ResourceData, meta in
 
 	var instance *rds.DBInstance
 	var err error
-	if instance, err = waitDBInstanceAvailableSDKv1(ctx, conn, d.Get("identifier").(string), d.Timeout(schema.TimeoutCreate)); err != nil {
+	if instance, err = waitDBInstanceAvailableSDKv1(ctx, conn, identifier, d.Timeout(schema.TimeoutCreate)); err != nil {
 		return sdkdiag.AppendErrorf(diags, "waiting for RDS DB Instance (%s) create: %s", identifier, err)
 	}
 
@@ -1623,6 +1668,7 @@ func resourceInstanceRead(ctx context.Context, d *schema.ResourceData, meta inte
 	d.Set("auto_minor_version_upgrade", v.AutoMinorVersionUpgrade)
 	d.Set("availability_zone", v.AvailabilityZone)
 	d.Set("backup_retention_period", v.BackupRetentionPeriod)
+	d.Set("backup_target", v.BackupTarget)
 	d.Set("backup_window", v.PreferredBackupWindow)
 	d.Set("ca_cert_identifier", v.CACertificateIdentifier)
 	d.Set("character_set_name", v.CharacterSetName)
@@ -1773,7 +1819,17 @@ func resourceInstanceUpdate(ctx context.Context, d *schema.ResourceData, meta in
 		"skip_final_snapshot",
 		"tags", "tags_all",
 	) {
-		if d.Get("blue_green_update.0.enabled").(bool) {
+		if d.Get("blue_green_update.0.enabled").(bool) && d.HasChangesExcept(
+			"allow_major_version_upgrade",
+			"blue_green_update",
+			"delete_automated_backups",
+			"final_snapshot_identifier",
+			"replicate_source_db",
+			"skip_final_snapshot",
+			"tags", "tags_all",
+			"deletion_protection",
+			"password",
+		) {
 			orchestrator := newBlueGreenOrchestrator(conn)
 			handler := newInstanceHandler(conn)
 			var cleaupWaiters []func(optFns ...tfresource.OptionsFunc)
@@ -1878,7 +1934,7 @@ func resourceInstanceUpdate(ctx context.Context, d *schema.ResourceData, meta in
 			}
 			if d.Get("deletion_protection").(bool) {
 				input := &rds_sdkv2.ModifyDBInstanceInput{
-					ApplyImmediately:     true,
+					ApplyImmediately:     aws.Bool(true),
 					DBInstanceIdentifier: aws.String(sourceARN.Identifier),
 					DeletionProtection:   aws.Bool(false),
 				}
@@ -1889,7 +1945,7 @@ func resourceInstanceUpdate(ctx context.Context, d *schema.ResourceData, meta in
 			}
 			deleteInput := &rds_sdkv2.DeleteDBInstanceInput{
 				DBInstanceIdentifier: aws.String(sourceARN.Identifier),
-				SkipFinalSnapshot:    true,
+				SkipFinalSnapshot:    aws.Bool(true),
 			}
 			_, err = tfresource.RetryWhen(ctx, 5*time.Minute,
 				func() (any, error) {
@@ -1897,12 +1953,11 @@ func resourceInstanceUpdate(ctx context.Context, d *schema.ResourceData, meta in
 				},
 				func(err error) (bool, error) {
 					// Retry for IAM eventual consistency.
-					apiErr, ok := errs.As[smithy.APIError](err)
-					if ok && apiErr.ErrorCode() == errCodeInvalidParameterValue && strings.Contains(apiErr.ErrorMessage(), "IAM role ARN value is invalid or does not include the required permissions") {
+					if tfawserr_sdkv2.ErrMessageContains(err, errCodeInvalidParameterValue, "IAM role ARN value is invalid or does not include the required permissions") {
 						return true, err
 					}
 
-					if ok && apiErr.ErrorCode() == errCodeInvalidParameterCombination && strings.Contains(apiErr.ErrorMessage(), "disable deletion pro") {
+					if tfawserr_sdkv2.ErrMessageContains(err, errCodeInvalidParameterCombination, "disable deletion pro") {
 						return true, err
 					}
 
@@ -1929,12 +1984,14 @@ func resourceInstanceUpdate(ctx context.Context, d *schema.ResourceData, meta in
 				o, _ := d.GetChange("identifier")
 				oldID = o.(string)
 			}
+
+			applyImmediately := d.Get("apply_immediately").(bool)
 			input := &rds_sdkv2.ModifyDBInstanceInput{
-				ApplyImmediately:     d.Get("apply_immediately").(bool),
+				ApplyImmediately:     aws.Bool(applyImmediately),
 				DBInstanceIdentifier: aws.String(oldID),
 			}
 
-			if !input.ApplyImmediately {
+			if !applyImmediately {
 				log.Println("[INFO] Only settings updating, instance changes will be applied in next maintenance window")
 			}
 
@@ -1942,7 +1999,7 @@ func resourceInstanceUpdate(ctx context.Context, d *schema.ResourceData, meta in
 
 			if d.HasChange("engine_version") {
 				input.EngineVersion = aws.String(d.Get("engine_version").(string))
-				input.AllowMajorVersionUpgrade = d.Get("allow_major_version_upgrade").(bool)
+				input.AllowMajorVersionUpgrade = aws.Bool(d.Get("allow_major_version_upgrade").(bool))
 				// if we were to make life easier for practitioners, we could loop through
 				// replicas at this point to update them first, prior to dbInstanceModify()
 				// for the source
@@ -2154,6 +2211,14 @@ func dbInstancePopulateModify(input *rds_sdkv2.ModifyDBInstanceInput, d *schema.
 	if d.HasChange("storage_throughput") {
 		needsModify = true
 		input.StorageThroughput = aws.Int32(int32(d.Get("storage_throughput").(int)))
+
+		if input.Iops == nil {
+			input.Iops = aws.Int32(int32(d.Get("iops").(int)))
+		}
+
+		if input.AllocatedStorage == nil {
+			input.AllocatedStorage = aws.Int32(int32(d.Get("allocated_storage").(int)))
+		}
 	}
 
 	if d.HasChange("storage_type") {
@@ -2182,8 +2247,11 @@ func dbInstanceModify(ctx context.Context, conn *rds_sdkv2.Client, resourceID st
 		},
 		func(err error) (bool, error) {
 			// Retry for IAM eventual consistency.
-			apiErr, ok := errs.As[smithy.APIError](err)
-			if ok && apiErr.ErrorCode() == errCodeInvalidParameterValue && strings.Contains(apiErr.ErrorMessage(), "IAM role ARN value is invalid or does not include the required permissions") {
+			if tfawserr_sdkv2.ErrMessageContains(err, errCodeInvalidParameterValue, "IAM role ARN value is invalid or does not include the required permissions") {
+				return true, err
+			}
+
+			if tfawserr_sdkv2.ErrMessageContains(err, errCodeInvalidParameterCombination, "previous storage change is being optimized") {
 				return true, err
 			}
 
@@ -2330,7 +2398,7 @@ func parseDBInstanceARN(s string) (dbInstanceARN, error) {
 		ARN: arn,
 	}
 
-	re := regexp.MustCompile(`^db:([0-9a-z-]+)$`)
+	re := regexache.MustCompile(`^db:([0-9a-z-]+)$`)
 	matches := re.FindStringSubmatch(arn.Resource)
 	if matches == nil || len(matches) != 2 {
 		return dbInstanceARN{}, errors.New("DB Instance ARN: invalid resource section")
@@ -2344,9 +2412,10 @@ func parseDBInstanceARN(s string) (dbInstanceARN, error) {
 // "db-BE6UI2KLPQP3OVDYD74ZEV6NUM" rather than a DB identifier. However, in some cases only
 // the identifier is available, and can be used.
 func findDBInstanceByIDSDKv1(ctx context.Context, conn *rds.RDS, id string) (*rds.DBInstance, error) {
+	idLooksLikeDbiResourceId := regexache.MustCompile(`^db-[0-9A-Za-z]{2,255}$`).MatchString(id)
 	input := &rds.DescribeDBInstancesInput{}
 
-	if regexp.MustCompile(`^db-[a-zA-Z0-9]{2,255}$`).MatchString(id) {
+	if idLooksLikeDbiResourceId {
 		input.Filters = []*rds.Filter{
 			{
 				Name:   aws.String("dbi-resource-id"),
@@ -2357,33 +2426,63 @@ func findDBInstanceByIDSDKv1(ctx context.Context, conn *rds.RDS, id string) (*rd
 		input.DBInstanceIdentifier = aws.String(id)
 	}
 
-	output, err := conn.DescribeDBInstancesWithContext(ctx, input)
+	output, err := findDBInstanceSDKv1(ctx, conn, input, tfslices.PredicateTrue[*rds.DBInstance]())
 
 	// in case a DB has an *identifier* starting with "db-""
-	if regexp.MustCompile(`^db-[a-zA-Z0-9]{2,255}$`).MatchString(id) && (output == nil || len(output.DBInstances) == 0) {
-		input = &rds.DescribeDBInstancesInput{
+	if idLooksLikeDbiResourceId && tfresource.NotFound(err) {
+		input := &rds.DescribeDBInstancesInput{
 			DBInstanceIdentifier: aws.String(id),
 		}
-		output, err = conn.DescribeDBInstancesWithContext(ctx, input)
+
+		output, err = findDBInstanceSDKv1(ctx, conn, input, tfslices.PredicateTrue[*rds.DBInstance]())
 	}
 
+	if err != nil {
+		return nil, err
+	}
+
+	return output, nil
+}
+
+func findDBInstanceSDKv1(ctx context.Context, conn *rds.RDS, input *rds.DescribeDBInstancesInput, filter tfslices.Predicate[*rds.DBInstance]) (*rds.DBInstance, error) {
+	output, err := findDBInstancesSDKv1(ctx, conn, input, filter)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return tfresource.AssertSinglePtrResult(output)
+}
+
+func findDBInstancesSDKv1(ctx context.Context, conn *rds.RDS, input *rds.DescribeDBInstancesInput, filter tfslices.Predicate[*rds.DBInstance]) ([]*rds.DBInstance, error) {
+	var output []*rds.DBInstance
+
+	err := conn.DescribeDBInstancesPagesWithContext(ctx, input, func(page *rds.DescribeDBInstancesOutput, lastPage bool) bool {
+		if page == nil {
+			return !lastPage
+		}
+
+		for _, v := range page.DBInstances {
+			if v != nil && filter(v) {
+				output = append(output, v)
+			}
+		}
+
+		return !lastPage
+	})
+
 	if tfawserr.ErrCodeEquals(err, rds.ErrCodeDBInstanceNotFoundFault) {
 		return nil, &retry.NotFoundError{
 			LastError:   err,
 			LastRequest: input,
 		}
 	}
+
 	if err != nil {
 		return nil, err
 	}
 
-	if output == nil || len(output.DBInstances) == 0 || output.DBInstances[0] == nil {
-		return nil, tfresource.NewEmptyResultError(input)
-	}
-
-	dbInstance := output.DBInstances[0]
-
-	return dbInstance, nil
+	return output, nil
 }
 
 // findDBInstanceByIDSDKv2 in general should be called with a DbiResourceId of the form
@@ -2392,7 +2491,7 @@ func findDBInstanceByIDSDKv1(ctx context.Context, conn *rds.RDS, id string) (*rd
 func findDBInstanceByIDSDKv2(ctx context.Context, conn *rds_sdkv2.Client, id string) (*types.DBInstance, error) {
 	input := &rds_sdkv2.DescribeDBInstancesInput{}
 
-	if regexp.MustCompile(`^db-[a-zA-Z0-9]{2,255}$`).MatchString(id) {
+	if regexache.MustCompile(`^db-[0-9A-Za-z]{2,255}$`).MatchString(id) {
 		input.Filters = []types.Filter{
 			{
 				Name:   aws.String("dbi-resource-id"),
@@ -2406,7 +2505,7 @@ func findDBInstanceByIDSDKv2(ctx context.Context, conn *rds_sdkv2.Client, id str
 	output, err := conn.DescribeDBInstances(ctx, input)
 
 	// in case a DB has an *identifier* starting with "db-""
-	if regexp.MustCompile(`^db-[a-zA-Z0-9]{2,255}$`).MatchString(id) && (output == nil || len(output.DBInstances) == 0) {
+	if regexache.MustCompile(`^db-[0-9A-Za-z]{2,255}$`).MatchString(id) && (output == nil || len(output.DBInstances) == 0) {
 		input = &rds_sdkv2.DescribeDBInstancesInput{
 			DBInstanceIdentifier: aws.String(id),
 		}
@@ -2419,15 +2518,16 @@ func findDBInstanceByIDSDKv2(ctx context.Context, conn *rds_sdkv2.Client, id str
 			LastRequest: input,
 		}
 	}
+
 	if err != nil {
 		return nil, err
 	}
 
-	if output == nil || len(output.DBInstances) == 0 {
+	if output == nil {
 		return nil, tfresource.NewEmptyResultError(input)
 	}
 
-	return &output.DBInstances[0], nil
+	return tfresource.AssertSingleValueResult(output.DBInstances)
 }
 
 func statusDBInstanceSDKv1(ctx context.Context, conn *rds.RDS, id string) retry.StateRefreshFunc {
diff --git a/internal/service/rds/instance_automated_backups_replication.go b/internal/service/rds/instance_automated_backups_replication.go
index f36feaa74f4..8643e947114 100644
--- a/internal/service/rds/instance_automated_backups_replication.go
+++ b/internal/service/rds/instance_automated_backups_replication.go
@@ -1,8 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rds
 
 import (
 	"context"
 	"log"
+	"strconv"
+	"strings"
 	"time"
 
 	"github.com/aws/aws-sdk-go/aws"
@@ -10,16 +15,20 @@ import (
 	"github.com/aws/aws-sdk-go/service/rds"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
+	tfslices "github.com/hashicorp/terraform-provider-aws/internal/slices"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
 )
 
+// AWS flip-flop on the capitalization of status codes. Use uppercase.
 const (
-	InstanceAutomatedBackupsReplicationCreateTimeout = 75 * time.Minute
-	InstanceAutomatedBackupsReplicationDeleteTimeout = 75 * time.Minute
+	InstanceAutomatedBackupStatusPending     = "PENDING"
+	InstanceAutomatedBackupStatusReplicating = "REPLICATING"
+	InstanceAutomatedBackupStatusRetained    = "RETAINED"
 )
 
 // @SDKResource("aws_db_instance_automated_backups_replication")
@@ -30,8 +39,8 @@ func ResourceInstanceAutomatedBackupsReplication() *schema.Resource {
 		DeleteWithoutTimeout: resourceInstanceAutomatedBackupsReplicationDelete,
 
 		Timeouts: &schema.ResourceTimeout{
-			Create: schema.DefaultTimeout(InstanceAutomatedBackupsReplicationCreateTimeout),
-			Delete: schema.DefaultTimeout(InstanceAutomatedBackupsReplicationDeleteTimeout),
+			Create: schema.DefaultTimeout(75 * time.Minute),
+			Delete: schema.DefaultTimeout(75 * time.Minute),
 		},
 
 		Importer: &schema.ResourceImporter{
@@ -84,7 +93,6 @@ func resourceInstanceAutomatedBackupsReplicationCreate(ctx context.Context, d *s
 		input.PreSignedUrl = aws.String(v.(string))
 	}
 
-	log.Printf("[DEBUG] Starting RDS instance automated backups replication: %s", input)
 	output, err := conn.StartDBInstanceAutomatedBackupsReplicationWithContext(ctx, input)
 	if err != nil {
 		return sdkdiag.AppendErrorf(diags, "starting RDS instance automated backups replication: %s", err)
@@ -134,13 +142,13 @@ func resourceInstanceAutomatedBackupsReplicationDelete(ctx context.Context, d *s
 	}
 
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "deleting RDS DB Instance Automated Backup (%s): %s", d.Id(), err)
+		return sdkdiag.AppendErrorf(diags, "reading RDS instance automated backup (%s): %s", d.Id(), err)
 	}
 
 	dbInstanceID := aws.StringValue(backup.DBInstanceIdentifier)
 	sourceDatabaseARN, err := arn.Parse(aws.StringValue(backup.DBInstanceArn))
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "deleting RDS DB Instance Automated Backup (%s): %s", d.Id(), err)
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
 	log.Printf("[DEBUG] Stopping RDS Instance Automated Backups Replication: %s", d.Id())
@@ -152,6 +160,10 @@ func resourceInstanceAutomatedBackupsReplicationDelete(ctx context.Context, d *s
 		return diags
 	}
 
+	if tfawserr.ErrMessageContains(err, rds.ErrCodeInvalidDBInstanceStateFault, "not replicating to the current region") {
+		return diags
+	}
+
 	if err != nil {
 		return sdkdiag.AppendErrorf(diags, "deleting RDS DB Instance Automated Backup (%s): %s", d.Id(), err)
 	}
@@ -163,8 +175,155 @@ func resourceInstanceAutomatedBackupsReplicationDelete(ctx context.Context, d *s
 	}
 
 	if _, err := waitDBInstanceAutomatedBackupDeleted(ctx, sourceDatabaseConn, dbInstanceID, d.Id(), d.Timeout(schema.TimeoutCreate)); err != nil {
-		return sdkdiag.AppendErrorf(diags, "deleting RDS DB Instance Automated Backup (%s): waiting for completion: %s", d.Id(), err)
+		return sdkdiag.AppendErrorf(diags, "waiting for DB instance automated backup (%s) delete: %s", d.Id(), err)
 	}
 
 	return diags
 }
+
+func FindDBInstanceAutomatedBackupByARN(ctx context.Context, conn *rds.RDS, arn string) (*rds.DBInstanceAutomatedBackup, error) {
+	input := &rds.DescribeDBInstanceAutomatedBackupsInput{
+		DBInstanceAutomatedBackupsArn: aws.String(arn),
+	}
+	output, err := findDBInstanceAutomatedBackup(ctx, conn, input, tfslices.PredicateTrue[*rds.DBInstanceAutomatedBackup]())
+
+	if err != nil {
+		return nil, err
+	}
+
+	// AWS flip-flop on the capitalization of status codes. Case-insensitive comparison.
+	if status := aws.StringValue(output.Status); strings.EqualFold(status, InstanceAutomatedBackupStatusRetained) {
+		// If the automated backup is retained, the replication is stopped.
+		return nil, &retry.NotFoundError{
+			Message:     status,
+			LastRequest: input,
+		}
+	}
+
+	// Eventual consistency check.
+	if aws.StringValue(output.DBInstanceAutomatedBackupsArn) != arn {
+		return nil, &retry.NotFoundError{
+			LastRequest: input,
+		}
+	}
+
+	return output, nil
+}
+
+func findDBInstanceAutomatedBackup(ctx context.Context, conn *rds.RDS, input *rds.DescribeDBInstanceAutomatedBackupsInput, filter tfslices.Predicate[*rds.DBInstanceAutomatedBackup]) (*rds.DBInstanceAutomatedBackup, error) {
+	output, err := findDBInstanceAutomatedBackups(ctx, conn, input, filter)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return tfresource.AssertSinglePtrResult(output)
+}
+
+func findDBInstanceAutomatedBackups(ctx context.Context, conn *rds.RDS, input *rds.DescribeDBInstanceAutomatedBackupsInput, filter tfslices.Predicate[*rds.DBInstanceAutomatedBackup]) ([]*rds.DBInstanceAutomatedBackup, error) {
+	var output []*rds.DBInstanceAutomatedBackup
+
+	err := conn.DescribeDBInstanceAutomatedBackupsPagesWithContext(ctx, input, func(page *rds.DescribeDBInstanceAutomatedBackupsOutput, lastPage bool) bool {
+		if page == nil {
+			return !lastPage
+		}
+
+		for _, v := range page.DBInstanceAutomatedBackups {
+			if v != nil && filter(v) {
+				output = append(output, v)
+			}
+		}
+
+		return !lastPage
+	})
+
+	if tfawserr.ErrCodeEquals(err, rds.ErrCodeDBInstanceAutomatedBackupNotFoundFault) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	return output, nil
+}
+
+func statusDBInstanceAutomatedBackup(ctx context.Context, conn *rds.RDS, arn string) retry.StateRefreshFunc {
+	return func() (interface{}, string, error) {
+		output, err := FindDBInstanceAutomatedBackupByARN(ctx, conn, arn)
+
+		if tfresource.NotFound(err) {
+			return nil, "", nil
+		}
+
+		if err != nil {
+			return nil, "", err
+		}
+
+		// AWS flip-flop on the capitalization of status codes. Convert to uppercase.
+		return output, strings.ToUpper(aws.StringValue(output.Status)), nil
+	}
+}
+
+func waitDBInstanceAutomatedBackupCreated(ctx context.Context, conn *rds.RDS, arn string, timeout time.Duration) (*rds.DBInstanceAutomatedBackup, error) {
+	stateConf := &retry.StateChangeConf{
+		Pending: []string{InstanceAutomatedBackupStatusPending},
+		Target:  []string{InstanceAutomatedBackupStatusReplicating},
+		Refresh: statusDBInstanceAutomatedBackup(ctx, conn, arn),
+		Timeout: timeout,
+	}
+
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+
+	if output, ok := outputRaw.(*rds.DBInstanceAutomatedBackup); ok {
+		return output, err
+	}
+
+	return nil, err
+}
+
+// statusDBInstanceHasAutomatedBackup returns whether or not a database instance has a specified automated backup.
+// The connection must be valid for the database instance's Region.
+func statusDBInstanceHasAutomatedBackup(ctx context.Context, conn *rds.RDS, dbInstanceID, dbInstanceAutomatedBackupsARN string) retry.StateRefreshFunc {
+	return func() (interface{}, string, error) {
+		output, err := findDBInstanceByIDSDKv1(ctx, conn, dbInstanceID)
+
+		if tfresource.NotFound(err) {
+			return nil, "", nil
+		}
+
+		if err != nil {
+			return nil, "", err
+		}
+
+		for _, v := range output.DBInstanceAutomatedBackupsReplications {
+			if aws.StringValue(v.DBInstanceAutomatedBackupsArn) == dbInstanceAutomatedBackupsARN {
+				return output, strconv.FormatBool(true), nil
+			}
+		}
+
+		return output, strconv.FormatBool(false), nil
+	}
+}
+
+// waitDBInstanceAutomatedBackupDeleted waits for a specified automated backup to be deleted from a database instance.
+// The connection must be valid for the database instance's Region.
+func waitDBInstanceAutomatedBackupDeleted(ctx context.Context, conn *rds.RDS, dbInstanceID, dbInstanceAutomatedBackupsARN string, timeout time.Duration) (*rds.DBInstance, error) {
+	stateConf := &retry.StateChangeConf{
+		Pending: []string{strconv.FormatBool(true)},
+		Target:  []string{strconv.FormatBool(false)},
+		Refresh: statusDBInstanceHasAutomatedBackup(ctx, conn, dbInstanceID, dbInstanceAutomatedBackupsARN),
+		Timeout: timeout,
+	}
+
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+
+	if output, ok := outputRaw.(*rds.DBInstance); ok {
+		return output, err
+	}
+
+	return nil, err
+}
diff --git a/internal/service/rds/instance_automated_backups_replication_test.go b/internal/service/rds/instance_automated_backups_replication_test.go
index ac83a5da189..39ed1f943d4 100644
--- a/internal/service/rds/instance_automated_backups_replication_test.go
+++ b/internal/service/rds/instance_automated_backups_replication_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rds_test
 
 import (
@@ -49,6 +52,36 @@ func TestAccRDSInstanceAutomatedBackupsReplication_basic(t *testing.T) {
 	})
 }
 
+func TestAccRDSInstanceAutomatedBackupsReplication_disappears(t *testing.T) {
+	ctx := acctest.Context(t)
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_db_instance_automated_backups_replication.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckMultipleRegion(t, 2)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, rds.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5FactoriesAlternate(ctx, t),
+		CheckDestroy:             testAccCheckInstanceAutomatedBackupsReplicationDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccInstanceAutomatedBackupsReplicationConfig_basic(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckInstanceAutomatedBackupsReplicationExist(ctx, resourceName),
+					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfrds.ResourceInstanceAutomatedBackupsReplication(), resourceName),
+				),
+				ExpectNonEmptyPlan: true,
+			},
+		},
+	})
+}
+
 func TestAccRDSInstanceAutomatedBackupsReplication_retentionPeriod(t *testing.T) {
 	ctx := acctest.Context(t)
 	if testing.Short() {
@@ -117,6 +150,51 @@ func TestAccRDSInstanceAutomatedBackupsReplication_kmsEncrypted(t *testing.T) {
 	})
 }
 
+func testAccCheckInstanceAutomatedBackupsReplicationExist(ctx context.Context, n string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		if rs.Primary.ID == "" {
+			return fmt.Errorf("No RDS instance automated backups replication ID is set")
+		}
+
+		conn := acctest.Provider.Meta().(*conns.AWSClient).RDSConn(ctx)
+
+		_, err := tfrds.FindDBInstanceAutomatedBackupByARN(ctx, conn, rs.Primary.ID)
+
+		return err
+	}
+}
+
+func testAccCheckInstanceAutomatedBackupsReplicationDestroy(ctx context.Context) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		conn := acctest.Provider.Meta().(*conns.AWSClient).RDSConn(ctx)
+
+		for _, rs := range s.RootModule().Resources {
+			if rs.Type != "aws_db_instance_automated_backups_replication" {
+				continue
+			}
+
+			_, err := tfrds.FindDBInstanceAutomatedBackupByARN(ctx, conn, rs.Primary.ID)
+
+			if tfresource.NotFound(err) {
+				continue
+			}
+
+			if err != nil {
+				return err
+			}
+
+			return fmt.Errorf("RDS instance automated backups replication %s still exists", rs.Primary.ID)
+		}
+
+		return nil
+	}
+}
+
 func testAccInstanceAutomatedBackupsReplicationConfig_base(rName string, storageEncrypted bool) string {
 	return acctest.ConfigCompose(acctest.ConfigMultipleRegionProvider(2), fmt.Sprintf(`
 data "aws_availability_zones" "available" {
@@ -165,15 +243,30 @@ resource "aws_db_subnet_group" "test" {
   provider = "awsalternate"
 }
 
+data "aws_rds_engine_version" "default" {
+  engine = "postgres"
+
+  provider = "awsalternate"
+}
+
+data "aws_rds_orderable_db_instance" "test" {
+  engine         = data.aws_rds_engine_version.default.engine
+  engine_version = data.aws_rds_engine_version.default.version
+  license_model  = "postgresql-license"
+  storage_type   = "standard"
+
+  preferred_instance_classes = [%[3]s]
+
+  provider = "awsalternate"
+}
+
 resource "aws_db_instance" "test" {
   allocated_storage       = 10
   identifier              = %[1]q
-  engine                  = "postgres"
-  engine_version          = "13.4"
-  instance_class          = "db.t3.micro"
-  db_name                 = "mydb"
-  username                = "masterusername"
-  password                = "mustbeeightcharacters"
+  engine                  = data.aws_rds_engine_version.default.engine
+  instance_class          = data.aws_rds_orderable_db_instance.test.instance_class
+  password                = "avoid-plaintext-passwords"
+  username                = "tfacctest"
   backup_retention_period = 7
   skip_final_snapshot     = true
   storage_encrypted       = %[2]t
@@ -181,7 +274,7 @@ resource "aws_db_instance" "test" {
 
   provider = "awsalternate"
 }
-`, rName, storageEncrypted))
+`, rName, storageEncrypted, postgresPreferredInstanceClasses))
 }
 
 func testAccInstanceAutomatedBackupsReplicationConfig_basic(rName string) string {
@@ -213,48 +306,3 @@ resource "aws_db_instance_automated_backups_replication" "test" {
 }
 `, rName))
 }
-
-func testAccCheckInstanceAutomatedBackupsReplicationExist(ctx context.Context, n string) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		rs, ok := s.RootModule().Resources[n]
-		if !ok {
-			return fmt.Errorf("Not found: %s", n)
-		}
-
-		if rs.Primary.ID == "" {
-			return fmt.Errorf("No RDS instance automated backups replication ID is set")
-		}
-
-		conn := acctest.Provider.Meta().(*conns.AWSClient).RDSConn(ctx)
-
-		_, err := tfrds.FindDBInstanceAutomatedBackupByARN(ctx, conn, rs.Primary.ID)
-
-		return err
-	}
-}
-
-func testAccCheckInstanceAutomatedBackupsReplicationDestroy(ctx context.Context) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		conn := acctest.Provider.Meta().(*conns.AWSClient).RDSConn(ctx)
-
-		for _, rs := range s.RootModule().Resources {
-			if rs.Type != "aws_db_instance_automated_backups_replication" {
-				continue
-			}
-
-			_, err := tfrds.FindDBInstanceAutomatedBackupByARN(ctx, conn, rs.Primary.ID)
-
-			if tfresource.NotFound(err) {
-				continue
-			}
-
-			if err != nil {
-				return err
-			}
-
-			return fmt.Errorf("RDS instance automated backups replication %s still exists", rs.Primary.ID)
-		}
-
-		return nil
-	}
-}
diff --git a/internal/service/rds/instance_data_source.go b/internal/service/rds/instance_data_source.go
index ad33e0d6150..2c4d66f59e4 100644
--- a/internal/service/rds/instance_data_source.go
+++ b/internal/service/rds/instance_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rds
 
 import (
@@ -5,16 +8,18 @@ import (
 	"fmt"
 
 	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/rds"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
+	tfslices "github.com/hashicorp/terraform-provider-aws/internal/slices"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
-	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
-// @SDKDataSource("aws_db_instance")
+// @SDKDataSource("aws_db_instance", name="DB Instance")
+// @Tags
 func DataSourceInstance() *schema.Resource {
 	return &schema.Resource{
 		ReadWithoutTimeout: dataSourceInstanceRead,
@@ -57,9 +62,9 @@ func DataSourceInstance() *schema.Resource {
 				Computed: true,
 			},
 			"db_instance_identifier": {
-				Type:         schema.TypeString,
-				Required:     true,
-				ValidateFunc: validation.StringIsNotEmpty,
+				Type:     schema.TypeString,
+				Optional: true,
+				Computed: true,
 			},
 			"db_instance_port": {
 				Type:     schema.TypeInt,
@@ -135,6 +140,10 @@ func DataSourceInstance() *schema.Resource {
 					},
 				},
 			},
+			"max_allocated_storage": {
+				Type:     schema.TypeInt,
+				Computed: true,
+			},
 			"monitoring_interval": {
 				Type:     schema.TypeInt,
 				Computed: true,
@@ -192,7 +201,7 @@ func DataSourceInstance() *schema.Resource {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
-			"tags": tftags.TagsSchemaComputed(),
+			names.AttrTags: tftags.TagsSchemaComputed(),
 			"timezone": {
 				Type:     schema.TypeString,
 				Computed: true,
@@ -209,73 +218,98 @@ func DataSourceInstance() *schema.Resource {
 func dataSourceInstanceRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).RDSConn(ctx)
-	ignoreTagsConfig := meta.(*conns.AWSClient).IgnoreTagsConfig
 
-	v, err := findDBInstanceByIDSDKv1(ctx, conn, d.Get("db_instance_identifier").(string))
-	if err != nil {
-		return diag.FromErr(tfresource.SingularDataSourceFindError("RDS DB Instance", err))
+	var instance *rds.DBInstance
+
+	filter := tfslices.PredicateTrue[*rds.DBInstance]()
+	if tags := getTagsIn(ctx); len(tags) > 0 {
+		filter = func(v *rds.DBInstance) bool {
+			return KeyValueTags(ctx, v.TagList).ContainsAll(KeyValueTags(ctx, tags))
+		}
 	}
 
-	d.SetId(aws.StringValue(v.DBInstanceIdentifier))
-	d.Set("allocated_storage", v.AllocatedStorage)
-	d.Set("auto_minor_version_upgrade", v.AutoMinorVersionUpgrade)
-	d.Set("availability_zone", v.AvailabilityZone)
-	d.Set("backup_retention_period", v.BackupRetentionPeriod)
-	d.Set("ca_cert_identifier", v.CACertificateIdentifier)
-	d.Set("db_cluster_identifier", v.DBClusterIdentifier)
-	d.Set("db_instance_arn", v.DBInstanceArn)
-	d.Set("db_instance_class", v.DBInstanceClass)
-	d.Set("db_instance_port", v.DbInstancePort)
-	d.Set("db_name", v.DBName)
-	var parameterGroupNames []string
-	for _, v := range v.DBParameterGroups {
-		parameterGroupNames = append(parameterGroupNames, aws.StringValue(v.DBParameterGroupName))
+	if v, ok := d.GetOk("db_instance_identifier"); ok {
+		id := v.(string)
+		output, err := findDBInstanceByIDSDKv1(ctx, conn, id)
+
+		if err != nil {
+			return sdkdiag.AppendErrorf(diags, "reading RDS DB Instance (%s): %s", id, err)
+		}
+
+		if !filter(output) {
+			return sdkdiag.AppendErrorf(diags, "Your query returned no results. Please change your search criteria and try again.")
+		}
+
+		instance = output
+	} else {
+		input := &rds.DescribeDBInstancesInput{}
+		output, err := findDBInstanceSDKv1(ctx, conn, input, filter)
+
+		if err != nil {
+			return sdkdiag.AppendErrorf(diags, "reading RDS DB Instance: %s", err)
+		}
+
+		instance = output
 	}
+
+	d.SetId(aws.StringValue(instance.DBInstanceIdentifier))
+	d.Set("allocated_storage", instance.AllocatedStorage)
+	d.Set("auto_minor_version_upgrade", instance.AutoMinorVersionUpgrade)
+	d.Set("availability_zone", instance.AvailabilityZone)
+	d.Set("backup_retention_period", instance.BackupRetentionPeriod)
+	d.Set("ca_cert_identifier", instance.CACertificateIdentifier)
+	d.Set("db_cluster_identifier", instance.DBClusterIdentifier)
+	d.Set("db_instance_arn", instance.DBInstanceArn)
+	d.Set("db_instance_class", instance.DBInstanceClass)
+	d.Set("db_instance_port", instance.DbInstancePort)
+	d.Set("db_name", instance.DBName)
+	parameterGroupNames := tfslices.ApplyToAll(instance.DBParameterGroups, func(v *rds.DBParameterGroupStatus) string {
+		return aws.StringValue(v.DBParameterGroupName)
+	})
 	d.Set("db_parameter_groups", parameterGroupNames)
-	if v.DBSubnetGroup != nil {
-		d.Set("db_subnet_group", v.DBSubnetGroup.DBSubnetGroupName)
+	if instance.DBSubnetGroup != nil {
+		d.Set("db_subnet_group", instance.DBSubnetGroup.DBSubnetGroupName)
 	} else {
 		d.Set("db_subnet_group", "")
 	}
-	d.Set("enabled_cloudwatch_logs_exports", aws.StringValueSlice(v.EnabledCloudwatchLogsExports))
-	d.Set("engine", v.Engine)
-	d.Set("engine_version", v.EngineVersion)
-	d.Set("iops", v.Iops)
-	d.Set("kms_key_id", v.KmsKeyId)
-	d.Set("license_model", v.LicenseModel)
-	d.Set("master_username", v.MasterUsername)
-	if v.MasterUserSecret != nil {
-		if err := d.Set("master_user_secret", []interface{}{flattenManagedMasterUserSecret(v.MasterUserSecret)}); err != nil {
+	d.Set("enabled_cloudwatch_logs_exports", aws.StringValueSlice(instance.EnabledCloudwatchLogsExports))
+	d.Set("engine", instance.Engine)
+	d.Set("engine_version", instance.EngineVersion)
+	d.Set("iops", instance.Iops)
+	d.Set("kms_key_id", instance.KmsKeyId)
+	d.Set("license_model", instance.LicenseModel)
+	d.Set("master_username", instance.MasterUsername)
+	if instance.MasterUserSecret != nil {
+		if err := d.Set("master_user_secret", []interface{}{flattenManagedMasterUserSecret(instance.MasterUserSecret)}); err != nil {
 			return sdkdiag.AppendErrorf(diags, "setting master_user_secret: %s", err)
 		}
 	}
-	d.Set("monitoring_interval", v.MonitoringInterval)
-	d.Set("monitoring_role_arn", v.MonitoringRoleArn)
-	d.Set("multi_az", v.MultiAZ)
-	d.Set("network_type", v.NetworkType)
-	var optionGroupNames []string
-	for _, v := range v.OptionGroupMemberships {
-		optionGroupNames = append(optionGroupNames, aws.StringValue(v.OptionGroupName))
-	}
+	d.Set("max_allocated_storage", instance.MaxAllocatedStorage)
+	d.Set("monitoring_interval", instance.MonitoringInterval)
+	d.Set("monitoring_role_arn", instance.MonitoringRoleArn)
+	d.Set("multi_az", instance.MultiAZ)
+	d.Set("network_type", instance.NetworkType)
+	optionGroupNames := tfslices.ApplyToAll(instance.OptionGroupMemberships, func(v *rds.OptionGroupMembership) string {
+		return aws.StringValue(v.OptionGroupName)
+	})
 	d.Set("option_group_memberships", optionGroupNames)
-	d.Set("preferred_backup_window", v.PreferredBackupWindow)
-	d.Set("preferred_maintenance_window", v.PreferredMaintenanceWindow)
-	d.Set("publicly_accessible", v.PubliclyAccessible)
-	d.Set("replicate_source_db", v.ReadReplicaSourceDBInstanceIdentifier)
-	d.Set("resource_id", v.DbiResourceId)
-	d.Set("storage_encrypted", v.StorageEncrypted)
-	d.Set("storage_throughput", v.StorageThroughput)
-	d.Set("storage_type", v.StorageType)
-	d.Set("timezone", v.Timezone)
-	var vpcSecurityGroupIDs []string
-	for _, v := range v.VpcSecurityGroups {
-		vpcSecurityGroupIDs = append(vpcSecurityGroupIDs, aws.StringValue(v.VpcSecurityGroupId))
-	}
+	d.Set("preferred_backup_window", instance.PreferredBackupWindow)
+	d.Set("preferred_maintenance_window", instance.PreferredMaintenanceWindow)
+	d.Set("publicly_accessible", instance.PubliclyAccessible)
+	d.Set("replicate_source_db", instance.ReadReplicaSourceDBInstanceIdentifier)
+	d.Set("resource_id", instance.DbiResourceId)
+	d.Set("storage_encrypted", instance.StorageEncrypted)
+	d.Set("storage_throughput", instance.StorageThroughput)
+	d.Set("storage_type", instance.StorageType)
+	d.Set("timezone", instance.Timezone)
+	vpcSecurityGroupIDs := tfslices.ApplyToAll(instance.VpcSecurityGroups, func(v *rds.VpcSecurityGroupMembership) string {
+		return aws.StringValue(v.VpcSecurityGroupId)
+	})
 	d.Set("vpc_security_groups", vpcSecurityGroupIDs)
 
 	// Per AWS SDK Go docs:
 	// The endpoint might not be shown for instances whose status is creating.
-	if dbEndpoint := v.Endpoint; dbEndpoint != nil {
+	if dbEndpoint := instance.Endpoint; dbEndpoint != nil {
 		d.Set("address", dbEndpoint.Address)
 		d.Set("endpoint", fmt.Sprintf("%s:%d", aws.StringValue(dbEndpoint.Address), aws.Int64Value(dbEndpoint.Port)))
 		d.Set("hosted_zone_id", dbEndpoint.HostedZoneId)
@@ -287,11 +321,7 @@ func dataSourceInstanceRead(ctx context.Context, d *schema.ResourceData, meta in
 		d.Set("port", nil)
 	}
 
-	tags := KeyValueTags(ctx, v.TagList)
-
-	if err := d.Set("tags", tags.IgnoreAWS().IgnoreConfig(ignoreTagsConfig).Map()); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting tags: %s", err)
-	}
+	setTagsOut(ctx, instance.TagList)
 
 	return diags
 }
diff --git a/internal/service/rds/instance_data_source_test.go b/internal/service/rds/instance_data_source_test.go
index c40f7060150..c2b217b8153 100644
--- a/internal/service/rds/instance_data_source_test.go
+++ b/internal/service/rds/instance_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rds_test
 
 import (
@@ -41,6 +44,7 @@ func TestAccRDSInstanceDataSource_basic(t *testing.T) {
 					resource.TestCheckResourceAttrPair(dataSourceName, "hosted_zone_id", resourceName, "hosted_zone_id"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "iops", resourceName, "iops"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "master_username", resourceName, "username"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "max_allocated_storage", resourceName, "max_allocated_storage"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "multi_az", resourceName, "multi_az"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "network_type", resourceName, "network_type"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "port", resourceName, "port"),
@@ -100,6 +104,51 @@ func TestAccRDSInstanceDataSource_ManagedMasterPassword_managed(t *testing.T) {
 	})
 }
 
+func TestAccRDSInstanceDataSource_tags(t *testing.T) {
+	ctx := acctest.Context(t)
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	dataSourceName := "data.aws_db_instance.test"
+	resourceName := "aws_db_instance.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, rds.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccInstanceDataSourceConfig_tags(rName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					resource.TestCheckResourceAttrPair(dataSourceName, "address", resourceName, "address"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "allocated_storage", resourceName, "allocated_storage"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "auto_minor_version_upgrade", resourceName, "auto_minor_version_upgrade"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "db_instance_arn", resourceName, "arn"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "db_instance_class", resourceName, "instance_class"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "db_name", resourceName, "db_name"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "db_subnet_group", resourceName, "db_subnet_group_name"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "enabled_cloudwatch_logs_exports.#", resourceName, "enabled_cloudwatch_logs_exports.#"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "endpoint", resourceName, "endpoint"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "engine", resourceName, "engine"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "hosted_zone_id", resourceName, "hosted_zone_id"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "iops", resourceName, "iops"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "master_username", resourceName, "username"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "max_allocated_storage", resourceName, "max_allocated_storage"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "multi_az", resourceName, "multi_az"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "network_type", resourceName, "network_type"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "port", resourceName, "port"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "resource_id", resourceName, "resource_id"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "storage_throughput", resourceName, "storage_throughput"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "storage_type", resourceName, "storage_type"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "tags.%", resourceName, "tags.%"),
+				),
+			},
+		},
+	})
+}
+
 func testAccInstanceDataSourceConfig_basic(rName string) string {
 	return acctest.ConfigCompose(
 		testAccInstanceConfig_orderableClassMariadb(),
@@ -117,6 +166,7 @@ resource "aws_db_instance" "test" {
   password                = "avoid-plaintext-passwords"
   skip_final_snapshot     = true
   username                = "tfacctest"
+  max_allocated_storage   = 100
 
   enabled_cloudwatch_logs_exports = [
     "audit",
@@ -162,3 +212,42 @@ data "aws_db_instance" "test" {
 }
 `, rName))
 }
+
+func testAccInstanceDataSourceConfig_tags(rName string) string {
+	return acctest.ConfigCompose(
+		testAccInstanceConfig_orderableClassMariadb(),
+		testAccInstanceConfig_baseVPC(rName),
+		fmt.Sprintf(`
+resource "aws_db_instance" "test" {
+  allocated_storage       = 10
+  backup_retention_period = 0
+  db_subnet_group_name    = aws_db_subnet_group.test.name
+  engine                  = data.aws_rds_engine_version.default.engine
+  engine_version          = data.aws_rds_engine_version.default.version
+  identifier              = %[1]q
+  instance_class          = data.aws_rds_orderable_db_instance.test.instance_class
+  db_name                 = "test"
+  password                = "avoid-plaintext-passwords"
+  skip_final_snapshot     = true
+  username                = "tfacctest"
+  max_allocated_storage   = 100
+
+  enabled_cloudwatch_logs_exports = [
+    "audit",
+    "error",
+  ]
+
+  tags = {
+    Name = %[1]q
+  }
+}
+
+data "aws_db_instance" "test" {
+  tags = {
+    Name = %[1]q
+  }
+
+  depends_on = [aws_db_instance.test]
+}
+`, rName))
+}
diff --git a/internal/service/rds/instance_migrate.go b/internal/service/rds/instance_migrate.go
index d2551e34035..30505428932 100644
--- a/internal/service/rds/instance_migrate.go
+++ b/internal/service/rds/instance_migrate.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rds
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"strconv"
 	"strings"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/rds"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
@@ -503,7 +506,7 @@ func resourceInstanceResourceV1() *schema.Resource {
 				Type:         schema.TypeString,
 				Optional:     true,
 				ForceNew:     true,
-				ValidateFunc: validation.StringMatch(regexp.MustCompile(`^AWSRDSCustom.*$`), "must begin with AWSRDSCustom"),
+				ValidateFunc: validation.StringMatch(regexache.MustCompile(`^AWSRDSCustom.*$`), "must begin with AWSRDSCustom"),
 			},
 			"customer_owned_ip_enabled": {
 				Type:     schema.TypeBool,
@@ -575,10 +578,10 @@ func resourceInstanceResourceV1() *schema.Resource {
 				Type:     schema.TypeString,
 				Optional: true,
 				ValidateFunc: validation.All(
-					validation.StringMatch(regexp.MustCompile(`^[A-Za-z]`), "must begin with alphabetic character"),
-					validation.StringMatch(regexp.MustCompile(`^[0-9A-Za-z-]+$`), "must only contain alphanumeric characters and hyphens"),
-					validation.StringDoesNotMatch(regexp.MustCompile(`--`), "cannot contain two consecutive hyphens"),
-					validation.StringDoesNotMatch(regexp.MustCompile(`-$`), "cannot end in a hyphen"),
+					validation.StringMatch(regexache.MustCompile(`^[A-Za-z]`), "must begin with alphabetic character"),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z-]+$`), "must only contain alphanumeric characters and hyphens"),
+					validation.StringDoesNotMatch(regexache.MustCompile(`--`), "cannot contain two consecutive hyphens"),
+					validation.StringDoesNotMatch(regexache.MustCompile(`-$`), "cannot end in a hyphen"),
 				),
 			},
 			"hosted_zone_id": {
diff --git a/internal/service/rds/instance_migrate_test.go b/internal/service/rds/instance_migrate_test.go
index 669448b980b..d17aa18348e 100644
--- a/internal/service/rds/instance_migrate_test.go
+++ b/internal/service/rds/instance_migrate_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rds_test
 
 import (
diff --git a/internal/service/rds/instance_role_association.go b/internal/service/rds/instance_role_association.go
index 0505fe4ea10..16417f70551 100644
--- a/internal/service/rds/instance_role_association.go
+++ b/internal/service/rds/instance_role_association.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rds
 
 import (
diff --git a/internal/service/rds/instance_role_association_test.go b/internal/service/rds/instance_role_association_test.go
index 54629f057e8..95a5f41f24b 100644
--- a/internal/service/rds/instance_role_association_test.go
+++ b/internal/service/rds/instance_role_association_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rds_test
 
 import (
diff --git a/internal/service/rds/instance_test.go b/internal/service/rds/instance_test.go
index 17287306f45..226b70bd5d9 100644
--- a/internal/service/rds/instance_test.go
+++ b/internal/service/rds/instance_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rds_test
 
 import (
@@ -5,9 +8,9 @@ import (
 	"fmt"
 	"log"
 	"os"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/endpoints"
 	"github.com/aws/aws-sdk-go/service/rds"
@@ -45,10 +48,11 @@ func TestAccRDSInstance_basic(t *testing.T) {
 					testAccCheckInstanceAttributes(&v),
 					resource.TestCheckResourceAttr(resourceName, "allocated_storage", "10"),
 					resource.TestCheckNoResourceAttr(resourceName, "allow_major_version_upgrade"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "rds", regexp.MustCompile(`db:.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "rds", regexache.MustCompile(`db:.+`)),
 					resource.TestCheckResourceAttr(resourceName, "auto_minor_version_upgrade", "true"),
 					resource.TestCheckResourceAttrSet(resourceName, "availability_zone"),
 					resource.TestCheckResourceAttr(resourceName, "backup_retention_period", "0"),
+					resource.TestCheckResourceAttr(resourceName, "backup_target", "region"),
 					resource.TestCheckResourceAttrSet(resourceName, "backup_window"),
 					resource.TestCheckResourceAttrSet(resourceName, "ca_cert_identifier"),
 					resource.TestCheckResourceAttr(resourceName, "copy_tags_to_snapshot", "false"),
@@ -69,8 +73,8 @@ func TestAccRDSInstance_basic(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "listener_endpoint.#", "0"),
 					resource.TestCheckResourceAttrSet(resourceName, "maintenance_window"),
 					resource.TestCheckResourceAttr(resourceName, "max_allocated_storage", "0"),
-					resource.TestMatchResourceAttr(resourceName, "option_group_name", regexp.MustCompile(`^default:mysql-\d`)),
-					resource.TestMatchResourceAttr(resourceName, "parameter_group_name", regexp.MustCompile(`^default\.mysql\d`)),
+					resource.TestMatchResourceAttr(resourceName, "option_group_name", regexache.MustCompile(`^default:mysql-\d`)),
+					resource.TestMatchResourceAttr(resourceName, "parameter_group_name", regexache.MustCompile(`^default\.mysql\d`)),
 					resource.TestCheckResourceAttr(resourceName, "port", "3306"),
 					resource.TestCheckResourceAttr(resourceName, "publicly_accessible", "false"),
 					resource.TestCheckResourceAttrSet(resourceName, "resource_id"),
@@ -122,10 +126,11 @@ func TestAccRDSInstance_manage_password(t *testing.T) {
 					testAccCheckInstanceAttributes(&v),
 					resource.TestCheckResourceAttr(resourceName, "allocated_storage", "10"),
 					resource.TestCheckNoResourceAttr(resourceName, "allow_major_version_upgrade"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "rds", regexp.MustCompile(`db:.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "rds", regexache.MustCompile(`db:.+`)),
 					resource.TestCheckResourceAttr(resourceName, "auto_minor_version_upgrade", "true"),
 					resource.TestCheckResourceAttrSet(resourceName, "availability_zone"),
 					resource.TestCheckResourceAttr(resourceName, "backup_retention_period", "0"),
+					resource.TestCheckResourceAttr(resourceName, "backup_target", "region"),
 					resource.TestCheckResourceAttrSet(resourceName, "backup_window"),
 					resource.TestCheckResourceAttrSet(resourceName, "ca_cert_identifier"),
 					resource.TestCheckResourceAttr(resourceName, "copy_tags_to_snapshot", "false"),
@@ -146,8 +151,8 @@ func TestAccRDSInstance_manage_password(t *testing.T) {
 					resource.TestCheckResourceAttrSet(resourceName, "maintenance_window"),
 					resource.TestCheckResourceAttr(resourceName, "master_user_secret.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "max_allocated_storage", "0"),
-					resource.TestMatchResourceAttr(resourceName, "option_group_name", regexp.MustCompile(`^default:mysql-\d`)),
-					resource.TestMatchResourceAttr(resourceName, "parameter_group_name", regexp.MustCompile(`^default\.mysql\d`)),
+					resource.TestMatchResourceAttr(resourceName, "option_group_name", regexache.MustCompile(`^default:mysql-\d`)),
+					resource.TestMatchResourceAttr(resourceName, "parameter_group_name", regexache.MustCompile(`^default\.mysql\d`)),
 					resource.TestCheckResourceAttr(resourceName, "port", "3306"),
 					resource.TestCheckResourceAttr(resourceName, "publicly_accessible", "false"),
 					resource.TestCheckResourceAttrSet(resourceName, "resource_id"),
@@ -914,7 +919,7 @@ func TestAccRDSInstance_password(t *testing.T) {
 		t.Skip("skipping long-running test in short mode")
 	}
 
-	var v rds.DBInstance
+	var v1, v2 rds.DBInstance
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_db_instance.test"
 
@@ -927,12 +932,12 @@ func TestAccRDSInstance_password(t *testing.T) {
 			// Password should not be shown in error message
 			{
 				Config:      testAccInstanceConfig_password(rName, "invalid"),
-				ExpectError: regexp.MustCompile(`MasterUserPassword is not a valid password because it is shorter than 8 characters`),
+				ExpectError: regexache.MustCompile(`MasterUserPassword is not a valid password because it is shorter than 8 characters`),
 			},
 			{
 				Config: testAccInstanceConfig_password(rName, "valid-password-1"),
 				Check: resource.ComposeAggregateTestCheckFunc(
-					testAccCheckInstanceExists(ctx, resourceName, &v),
+					testAccCheckInstanceExists(ctx, resourceName, &v1),
 					resource.TestCheckResourceAttr(resourceName, "password", "valid-password-1"),
 				),
 			},
@@ -950,7 +955,8 @@ func TestAccRDSInstance_password(t *testing.T) {
 			{
 				Config: testAccInstanceConfig_password(rName, "valid-password-2"),
 				Check: resource.ComposeAggregateTestCheckFunc(
-					testAccCheckInstanceExists(ctx, resourceName, &v),
+					testAccCheckInstanceExists(ctx, resourceName, &v2),
+					testAccCheckDBInstanceNotRecreated(&v1, &v2),
 					resource.TestCheckResourceAttr(resourceName, "password", "valid-password-2"),
 				),
 			},
@@ -2292,6 +2298,56 @@ func TestAccRDSInstance_SnapshotIdentifier_basic(t *testing.T) {
 	})
 }
 
+func TestAccRDSInstance_SnapshotIdentifier_ManagedMasterPasswordKMSKey(t *testing.T) {
+	ctx := acctest.Context(t)
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
+	var dbInstance, sourceDbInstance rds.DBInstance
+	var dbSnapshot rds.DBSnapshot
+
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	sourceDbResourceName := "aws_db_instance.source"
+	snapshotResourceName := "aws_db_snapshot.test"
+	resourceName := "aws_db_instance.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, rds.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckInstanceDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccInstanceConfig_snapshotID_ManagedMasterPasswordKMSKey(rName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckInstanceExists(ctx, sourceDbResourceName, &sourceDbInstance),
+					testAccCheckDBSnapshotExists(ctx, snapshotResourceName, &dbSnapshot),
+					testAccCheckInstanceExists(ctx, resourceName, &dbInstance),
+					resource.TestCheckResourceAttr(resourceName, "manage_master_user_password", "true"),
+					resource.TestCheckResourceAttr(resourceName, "master_user_secret.#", "1"),
+					resource.TestCheckResourceAttrSet(resourceName, "master_user_secret.0.kms_key_id"),
+					resource.TestCheckResourceAttrSet(resourceName, "master_user_secret.0.secret_arn"),
+					resource.TestCheckResourceAttrSet(resourceName, "master_user_secret.0.secret_status"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{
+					"apply_immediately",
+					"final_snapshot_identifier",
+					"manage_master_user_password",
+					"master_user_secret_kms_key_id",
+					"snapshot_identifier",
+					"skip_final_snapshot",
+				},
+			},
+		},
+	})
+}
+
 func TestAccRDSInstance_SnapshotIdentifier_namePrefix(t *testing.T) {
 	ctx := acctest.Context(t)
 	if testing.Short() {
@@ -4340,6 +4396,54 @@ func TestAccRDSInstance_RestoreToPointInTime_monitoring(t *testing.T) {
 	})
 }
 
+func TestAccRDSInstance_RestoreToPointInTime_ManagedMasterPassword(t *testing.T) {
+	ctx := acctest.Context(t)
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
+	var dbInstance, sourceDbInstance rds.DBInstance
+	sourceName := "aws_db_instance.test"
+	resourceName := "aws_db_instance.restore"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, rds.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckInstanceDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccInstanceConfig_RestoreToPointInTime_ManageMasterPassword(rName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckInstanceExists(ctx, sourceName, &sourceDbInstance),
+					testAccCheckInstanceExists(ctx, resourceName, &dbInstance),
+					resource.TestCheckResourceAttr(resourceName, "manage_master_user_password", "true"),
+					resource.TestCheckResourceAttr(resourceName, "master_user_secret.#", "1"),
+					resource.TestCheckResourceAttrSet(resourceName, "master_user_secret.0.kms_key_id"),
+					resource.TestCheckResourceAttrSet(resourceName, "master_user_secret.0.secret_arn"),
+					resource.TestCheckResourceAttrSet(resourceName, "master_user_secret.0.secret_status"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{
+					"apply_immediately",
+					"delete_automated_backups",
+					"final_snapshot_identifier",
+					"latest_restorable_time", // dynamic value of a DBInstance
+					"manage_master_user_password",
+					"password",
+					"restore_to_point_in_time",
+					"skip_final_snapshot",
+				},
+			},
+		},
+	})
+}
+
 func TestAccRDSInstance_NationalCharacterSet_oracle(t *testing.T) {
 	ctx := acctest.Context(t)
 	if testing.Short() {
@@ -4420,7 +4524,7 @@ func TestAccRDSInstance_NoNationalCharacterSet_oracle(t *testing.T) {
 	})
 }
 
-func TestAccRDSInstance_coIPEnabled(t *testing.T) {
+func TestAccRDSInstance_CoIPEnabled(t *testing.T) {
 	ctx := acctest.Context(t)
 	var v rds.DBInstance
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
@@ -4595,6 +4699,34 @@ func TestAccRDSInstance_CoIPEnabled_snapshotIdentifier(t *testing.T) {
 	})
 }
 
+func TestAccRDSInstance_BackupTarget(t *testing.T) {
+	ctx := acctest.Context(t)
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
+	var v rds.DBInstance
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_db_instance.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckOutpostsOutposts(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, rds.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckInstanceDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccInstanceConfig_Outpost_BackupTarget(rName, "outposts", 0),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckInstanceExists(ctx, resourceName, &v),
+					testAccCheckInstanceAttributes(&v),
+					resource.TestCheckResourceAttr(resourceName, "backup_target", "outposts"),
+				),
+			},
+		},
+	})
+}
+
 func TestAccRDSInstance_license(t *testing.T) {
 	ctx := acctest.Context(t)
 	if testing.Short() {
@@ -4685,6 +4817,7 @@ func TestAccRDSInstance_BlueGreenDeployment_updateEngineVersion(t *testing.T) {
 					"skip_final_snapshot",
 					"delete_automated_backups",
 					"blue_green_update",
+					"latest_restorable_time",
 				},
 			},
 		},
@@ -4715,7 +4848,7 @@ func TestAccRDSInstance_BlueGreenDeployment_updateParameterGroup(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "backup_retention_period", "1"),
 					// TODO: This should be a TestCheckResourceAttrPair against a parameter group data source.
 					// https://github.com/hashicorp/terraform-provider-aws/pull/13718
-					resource.TestMatchResourceAttr(resourceName, "parameter_group_name", regexp.MustCompile(`^default\.mysql`)),
+					resource.TestMatchResourceAttr(resourceName, "parameter_group_name", regexache.MustCompile(`^default\.mysql`)),
 				),
 			},
 			{
@@ -4790,6 +4923,7 @@ func TestAccRDSInstance_BlueGreenDeployment_tags(t *testing.T) {
 					"skip_final_snapshot",
 					"delete_automated_backups",
 					"blue_green_update",
+					"latest_restorable_time",
 				},
 			},
 		},
@@ -4840,6 +4974,7 @@ func TestAccRDSInstance_BlueGreenDeployment_updateInstanceClass(t *testing.T) {
 					"skip_final_snapshot",
 					"delete_automated_backups",
 					"blue_green_update",
+					"latest_restorable_time",
 				},
 			},
 		},
@@ -4944,14 +5079,14 @@ func TestAccRDSInstance_BlueGreenDeployment_updateAndEnableBackups(t *testing.T)
 					"skip_final_snapshot",
 					"delete_automated_backups",
 					"blue_green_update",
+					"latest_restorable_time",
 				},
 			},
 		},
 	})
 }
 
-// TODO: When the only change is to disable deletion_protection, bypass Blue/Green
-func TestAccRDSInstance_BlueGreenDeployment_deletionProtection(t *testing.T) {
+func TestAccRDSInstance_BlueGreenDeployment_deletionProtectionBypassesBlueGreen(t *testing.T) {
 	ctx := acctest.Context(t)
 	if testing.Short() {
 		t.Skip("skipping long-running test in short mode")
@@ -4986,14 +5121,14 @@ func TestAccRDSInstance_BlueGreenDeployment_deletionProtection(t *testing.T) {
 					"skip_final_snapshot",
 					"delete_automated_backups",
 					"blue_green_update",
+					"latest_restorable_time",
 				},
 			},
 			{
 				Config: testAccInstanceConfig_BlueGreenDeployment_deletionProtection(rName, false),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckInstanceExists(ctx, resourceName, &v2),
-					// TODO: This should bypass Blue/Green Deployment
-					// testAccCheckDBInstanceNotRecreated(&v2, &v3),
+					testAccCheckDBInstanceNotRecreated(&v1, &v2),
 					resource.TestCheckResourceAttr(resourceName, "deletion_protection", "false"),
 					resource.TestCheckResourceAttr(resourceName, "blue_green_update.0.enabled", "true"),
 				),
@@ -5009,12 +5144,48 @@ func TestAccRDSInstance_BlueGreenDeployment_deletionProtection(t *testing.T) {
 					"skip_final_snapshot",
 					"delete_automated_backups",
 					"blue_green_update",
+					"latest_restorable_time",
 				},
 			},
 		},
 	})
 }
 
+func TestAccRDSInstance_BlueGreenDeployment_passwordBypassesBlueGreen(t *testing.T) {
+	ctx := acctest.Context(t)
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
+	var v1, v2 rds.DBInstance
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_db_instance.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, rds.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckInstanceDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccInstanceConfig_BlueGreenDeployment_password(rName, "valid-password-1"),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckInstanceExists(ctx, resourceName, &v1),
+					resource.TestCheckResourceAttr(resourceName, "password", "valid-password-1"),
+				),
+			},
+			{
+				Config: testAccInstanceConfig_BlueGreenDeployment_password(rName, "valid-password-2"),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckInstanceExists(ctx, resourceName, &v2),
+					testAccCheckDBInstanceNotRecreated(&v1, &v2),
+					resource.TestCheckResourceAttr(resourceName, "password", "valid-password-2"),
+				),
+			},
+		},
+	})
+}
+
 func TestAccRDSInstance_BlueGreenDeployment_updateWithDeletionProtection(t *testing.T) {
 	ctx := acctest.Context(t)
 	if testing.Short() {
@@ -5051,6 +5222,7 @@ func TestAccRDSInstance_BlueGreenDeployment_updateWithDeletionProtection(t *test
 					"skip_final_snapshot",
 					"delete_automated_backups",
 					"blue_green_update",
+					"latest_restorable_time",
 				},
 			},
 			{
@@ -5074,14 +5246,14 @@ func TestAccRDSInstance_BlueGreenDeployment_updateWithDeletionProtection(t *test
 					"skip_final_snapshot",
 					"delete_automated_backups",
 					"blue_green_update",
+					"latest_restorable_time",
 				},
 			},
 			{
 				Config: testAccInstanceConfig_BlueGreenDeployment_updateInstanceClassWithDeletionProtection(rName, false),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckInstanceExists(ctx, resourceName, &v3),
-					// TODO: This should bypass Blue/Green Deployment
-					// testAccCheckDBInstanceNotRecreated(&v2, &v3),
+					testAccCheckDBInstanceNotRecreated(&v2, &v3),
 					resource.TestCheckResourceAttr(resourceName, "deletion_protection", "false"),
 					resource.TestCheckResourceAttr(resourceName, "blue_green_update.0.enabled", "true"),
 				),
@@ -5249,7 +5421,8 @@ func TestAccRDSInstance_gp3SQLServer(t *testing.T) {
 	})
 }
 
-func TestAccRDSInstance_storageThroughput(t *testing.T) {
+// // https://github.com/hashicorp/terraform-provider-aws/issues/33512
+func TestAccRDSInstance_storageChangeThroughput(t *testing.T) {
 	ctx := acctest.Context(t)
 	if testing.Short() {
 		t.Skip("skipping long-running test in short mode")
@@ -5275,23 +5448,49 @@ func TestAccRDSInstance_storageThroughput(t *testing.T) {
 				),
 			},
 			{
-				ResourceName:      resourceName,
-				ImportState:       true,
-				ImportStateVerify: true,
-				ImportStateVerifyIgnore: []string{
-					"apply_immediately",
-					"final_snapshot_identifier",
-					"password",
-					"skip_final_snapshot",
-					"delete_automated_backups",
-					"blue_green_update",
-				},
+				Config: testAccInstanceConfig_storageThroughput(rName, 12000, 600),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckInstanceExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "iops", "12000"),
+					resource.TestCheckResourceAttr(resourceName, "storage_throughput", "600"),
+					resource.TestCheckResourceAttr(resourceName, "storage_type", "gp3"),
+				),
+			},
+		},
+	})
+}
+
+// https://github.com/hashicorp/terraform-provider-aws/issues/33512
+func TestAccRDSInstance_storageChangeIOPSThroughput(t *testing.T) {
+	ctx := acctest.Context(t)
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
+	var v rds.DBInstance
+	resourceName := "aws_db_instance.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, rds.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckInstanceDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccInstanceConfig_storageThroughput(rName, 12000, 500),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckInstanceExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "iops", "12000"),
+					resource.TestCheckResourceAttr(resourceName, "storage_throughput", "500"),
+					resource.TestCheckResourceAttr(resourceName, "storage_type", "gp3"),
+				),
 			},
 			{
-				Config: testAccInstanceConfig_storageThroughput(rName, 14000, 600),
+				Config: testAccInstanceConfig_storageThroughput(rName, 13000, 600),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckInstanceExists(ctx, resourceName, &v),
-					resource.TestCheckResourceAttr(resourceName, "iops", "14000"),
+					resource.TestCheckResourceAttr(resourceName, "iops", "13000"),
 					resource.TestCheckResourceAttr(resourceName, "storage_throughput", "600"),
 					resource.TestCheckResourceAttr(resourceName, "storage_type", "gp3"),
 				),
@@ -5300,6 +5499,84 @@ func TestAccRDSInstance_storageThroughput(t *testing.T) {
 	})
 }
 
+// https://github.com/hashicorp/terraform-provider-aws/issues/33512
+func TestAccRDSInstance_storageChangeIOPS(t *testing.T) {
+	ctx := acctest.Context(t)
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
+	var v rds.DBInstance
+	resourceName := "aws_db_instance.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, rds.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckInstanceDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccInstanceConfig_storageThroughput(rName, 12000, 500),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckInstanceExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "iops", "12000"),
+					resource.TestCheckResourceAttr(resourceName, "storage_throughput", "500"),
+					resource.TestCheckResourceAttr(resourceName, "storage_type", "gp3"),
+				),
+			},
+			{
+				Config: testAccInstanceConfig_storageThroughput(rName, 13000, 500),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckInstanceExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "iops", "13000"),
+					resource.TestCheckResourceAttr(resourceName, "storage_throughput", "500"),
+					resource.TestCheckResourceAttr(resourceName, "storage_type", "gp3"),
+				),
+			},
+		},
+	})
+}
+
+// https://github.com/hashicorp/terraform-provider-aws/issues/33512
+func TestAccRDSInstance_storageThroughputSSE(t *testing.T) {
+	ctx := acctest.Context(t)
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
+	var v rds.DBInstance
+	resourceName := "aws_db_instance.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, rds.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckInstanceDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccInstanceConfig_storageThroughputSSE(rName, 4201, 125),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckInstanceExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "iops", "4201"),
+					resource.TestCheckResourceAttr(resourceName, "storage_throughput", "125"),
+					resource.TestCheckResourceAttr(resourceName, "storage_type", "gp3"),
+				),
+			},
+			{
+				Config: testAccInstanceConfig_storageThroughputSSE(rName, 4201, 126),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckInstanceExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "iops", "4201"),
+					resource.TestCheckResourceAttr(resourceName, "storage_throughput", "126"),
+					resource.TestCheckResourceAttr(resourceName, "storage_type", "gp3"),
+				),
+			},
+		},
+	})
+}
+
 func TestAccRDSInstance_storageTypePostgres(t *testing.T) {
 	ctx := acctest.Context(t)
 	if testing.Short() {
@@ -5921,6 +6198,9 @@ func testAccInstanceConfig_kmsKeyID(rName string) string {
 	return acctest.ConfigCompose(
 		testAccInstanceConfig_orderableClassMySQL(),
 		fmt.Sprintf(`
+data "aws_caller_identity" "current" {}
+data "aws_partition" "current" {}
+
 resource "aws_kms_key" "test" {
   description = %[1]q
 
@@ -5933,7 +6213,7 @@ resource "aws_kms_key" "test" {
       "Sid": "Enable IAM User Permissions",
       "Effect": "Allow",
       "Principal": {
-        "AWS": "*"
+        "AWS": "arn:${data.aws_partition.current.partition}:iam::${data.aws_caller_identity.current.account_id}:root"
       },
       "Action": "kms:*",
       "Resource": "*"
@@ -6549,6 +6829,25 @@ resource "aws_db_instance" "restore" {
 `, rName, monitoringInterval))
 }
 
+func testAccInstanceConfig_RestoreToPointInTime_ManageMasterPassword(rName string) string {
+	return acctest.ConfigCompose(
+		testAccInstanceConfig_baseForPITR(rName),
+		fmt.Sprintf(`
+resource "aws_db_instance" "restore" {
+  identifier     = "%[1]s-restore"
+  instance_class = aws_db_instance.test.instance_class
+
+  restore_to_point_in_time {
+    source_db_instance_identifier = aws_db_instance.test.identifier
+    use_latest_restorable_time    = true
+  }
+
+  skip_final_snapshot         = true
+  manage_master_user_password = true
+}
+`, rName))
+}
+
 func testAccInstanceConfig_iopsUpdate(rName string, iops int) string {
 	return fmt.Sprintf(`
 data "aws_rds_engine_version" "default" {
@@ -7386,7 +7685,9 @@ resource "aws_db_instance" "test" {
 }
 
 func testAccInstanceConfig_password(rName, password string) string {
-	return acctest.ConfigCompose(testAccInstanceConfig_orderableClassMySQL(), fmt.Sprintf(`
+	return acctest.ConfigCompose(
+		testAccInstanceConfig_orderableClassMySQL(),
+		fmt.Sprintf(`
 resource "aws_db_instance" "test" {
   allocated_storage   = 5
   engine              = data.aws_rds_orderable_db_instance.test.engine
@@ -8782,6 +9083,62 @@ resource "aws_db_instance" "test" {
 `, rName))
 }
 
+func testAccInstanceConfig_snapshotID_ManagedMasterPasswordKMSKey(rName string) string {
+	return acctest.ConfigCompose(
+		testAccInstanceConfig_orderableClassMariadb(),
+		fmt.Sprintf(`
+data "aws_caller_identity" "current" {}
+data "aws_partition" "current" {}
+
+resource "aws_kms_key" "example" {
+  description = "Terraform acc test %[1]s"
+
+  policy = <<POLICY
+{
+  "Version": "2012-10-17",
+  "Id": "kms-tf-1",
+  "Statement": [
+    {
+      "Sid": "Enable IAM User Permissions",
+      "Effect": "Allow",
+      "Principal": {
+        "AWS": "arn:${data.aws_partition.current.partition}:iam::${data.aws_caller_identity.current.account_id}:root"
+      },
+      "Action": "kms:*",
+      "Resource": "*"
+    }
+  ]
+}
+ POLICY
+
+}
+
+resource "aws_db_instance" "source" {
+  allocated_storage   = 5
+  engine              = data.aws_rds_orderable_db_instance.test.engine
+  identifier          = "%[1]s-source"
+  instance_class      = data.aws_rds_orderable_db_instance.test.instance_class
+  password            = "avoid-plaintext-passwords"
+  username            = "tfacctest"
+  skip_final_snapshot = true
+}
+
+resource "aws_db_snapshot" "test" {
+  db_instance_identifier = aws_db_instance.source.identifier
+  db_snapshot_identifier = %[1]q
+}
+
+resource "aws_db_instance" "test" {
+  identifier                    = %[1]q
+  instance_class                = aws_db_instance.source.instance_class
+  snapshot_identifier           = aws_db_snapshot.test.id
+  skip_final_snapshot           = true
+  manage_master_user_password   = true
+  master_user_secret_kms_key_id = aws_kms_key.example.arn
+}
+`, rName))
+}
+
 func testAccInstanceConfig_SnapshotIdentifier_namePrefix(identifierPrefix, sourceName string) string {
 	return acctest.ConfigCompose(
 		testAccInstanceConfig_orderableClassMariadb(),
@@ -8933,7 +9290,7 @@ func testAccInstanceConfig_SnapshotID_allowMajorVersionUpgrade(rName string, all
 	return fmt.Sprintf(`
 data "aws_rds_orderable_db_instance" "postgres13" {
   engine         = "postgres"
-  engine_version = "13.5"
+  engine_version = "13.12"
   license_model  = "postgresql-license"
   storage_type   = "standard"
 
@@ -8958,7 +9315,7 @@ resource "aws_db_snapshot" "test" {
 
 data "aws_rds_orderable_db_instance" "postgres14" {
   engine         = "postgres"
-  engine_version = "14.1"
+  engine_version = "14.9"
   license_model  = "postgresql-license"
   storage_type   = "standard"
 
@@ -9898,6 +10255,9 @@ resource "aws_db_instance" "test" {
 
 func testAccInstanceConfig_ReplicateSourceDB_performanceInsightsEnabled(rName string) string {
 	return fmt.Sprintf(`
+data "aws_caller_identity" "current" {}
+data "aws_partition" "current" {}
+
 resource "aws_kms_key" "test" {
   description = "Terraform acc test"
 
@@ -9910,7 +10270,7 @@ resource "aws_kms_key" "test" {
       "Sid": "Enable IAM User Permissions",
       "Effect": "Allow",
       "Principal": {
-        "AWS": "*"
+        "AWS": "arn:${data.aws_partition.current.partition}:iam::${data.aws_caller_identity.current.account_id}:root"
       },
       "Action": "kms:*",
       "Resource": "*"
@@ -9959,6 +10319,9 @@ resource "aws_db_instance" "test" {
 
 func testAccInstanceConfig_SnapshotID_performanceInsightsEnabled(rName string) string {
 	return fmt.Sprintf(`
+data "aws_caller_identity" "current" {}
+data "aws_partition" "current" {}
+
 resource "aws_kms_key" "test" {
   description = "Terraform acc test"
 
@@ -9971,7 +10334,7 @@ resource "aws_kms_key" "test" {
       "Sid": "Enable IAM User Permissions",
       "Effect": "Allow",
       "Principal": {
-        "AWS": "*"
+        "AWS": "arn:${data.aws_partition.current.partition}:iam::${data.aws_caller_identity.current.account_id}:root"
       },
       "Action": "kms:*",
       "Resource": "*"
@@ -10039,9 +10402,9 @@ resource "aws_db_instance" "test" {
 `, rName))
 }
 
-func testAccInstanceConfig_Outpost_coIPEnabled(rName string, coipEnabled bool, backupRetentionPeriod int) string {
+func testAccInstanceConfig_baseOutpost(rName string) string {
 	return acctest.ConfigCompose(
-		testAccInstanceConfig_orderableClassMySQL(),
+		testAccInstanceConfig_orderableClass("mysql", "general-public-license", "standard", outpostPreferredInstanceClasses),
 		fmt.Sprintf(`
 data "aws_outposts_outposts" "test" {}
 
@@ -10085,7 +10448,13 @@ resource "aws_ec2_local_gateway_route_table_vpc_association" "test" {
     Name = %[1]q
   }
 }
+`, rName))
+}
 
+func testAccInstanceConfig_Outpost_coIPEnabled(rName string, coipEnabled bool, backupRetentionPeriod int) string {
+	return acctest.ConfigCompose(
+		testAccInstanceConfig_baseOutpost(rName),
+		fmt.Sprintf(`
 resource "aws_db_instance" "test" {
   identifier                = %[1]q
   allocated_storage         = 20
@@ -10143,6 +10512,29 @@ resource "aws_db_instance" "restore" {
 `, rName, targetCoipEnabled))
 }
 
+func testAccInstanceConfig_Outpost_BackupTarget(rName string, backupTarget string, backupRetentionPeriod int) string {
+	return acctest.ConfigCompose(
+		testAccInstanceConfig_baseOutpost(rName),
+		fmt.Sprintf(`
+resource "aws_db_instance" "test" {
+  identifier              = %[1]q
+  allocated_storage       = 20
+  backup_retention_period = %[3]d
+  engine                  = data.aws_rds_orderable_db_instance.test.engine
+  engine_version          = data.aws_rds_orderable_db_instance.test.engine_version
+  instance_class          = data.aws_rds_orderable_db_instance.test.instance_class
+  db_name                 = "test"
+  parameter_group_name    = "default.${data.aws_rds_engine_version.default.parameter_group_family}"
+  skip_final_snapshot     = true
+  password                = "avoid-plaintext-passwords"
+  username                = "tfacctest"
+  db_subnet_group_name    = aws_db_subnet_group.test.name
+  storage_encrypted       = true
+  backup_target           = %[2]q
+}
+`, rName, backupTarget, backupRetentionPeriod))
+}
+
 func testAccInstanceConfig_license(rName, license string) string {
 	return acctest.ConfigCompose(
 		testAccInstanceConfig_orderableClass("oracle-se2", license, "standard", oracleSE2PreferredInstanceClasses),
@@ -10451,6 +10843,30 @@ data "aws_rds_orderable_db_instance" "updated" {
 `, rName, deletionProtection))
 }
 
+func testAccInstanceConfig_BlueGreenDeployment_password(rName, password string) string {
+	return acctest.ConfigCompose(
+		testAccInstanceConfig_orderableClassMySQL(),
+		fmt.Sprintf(`
+resource "aws_db_instance" "test" {
+  identifier              = %[1]q
+  allocated_storage       = 10
+  backup_retention_period = 1
+  engine                  = data.aws_rds_orderable_db_instance.test.engine
+  engine_version          = data.aws_rds_orderable_db_instance.test.engine_version
+  instance_class          = data.aws_rds_orderable_db_instance.test.instance_class
+  db_name                 = "test"
+  parameter_group_name    = "default.${data.aws_rds_engine_version.default.parameter_group_family}"
+  skip_final_snapshot     = true
+  password                = %[2]q
+  username                = "tfacctest"
+
+  blue_green_update {
+    enabled = true
+  }
+}
+`, rName, password))
+}
+
 func testAccInstanceConfig_gp3(rName string, orderableClassConfig func() string, allocatedStorage int) string {
 	return acctest.ConfigCompose(
 		orderableClassConfig(),
@@ -10500,6 +10916,40 @@ resource "aws_db_instance" "test" {
 `, rName, iops, throughput))
 }
 
+func testAccInstanceConfig_storageThroughputSSE(rName string, iops, throughput int) string {
+	return fmt.Sprintf(`
+data "aws_rds_engine_version" "default" {
+  engine = "sqlserver-se"
+}
+
+data "aws_rds_orderable_db_instance" "test" {
+  engine         = data.aws_rds_engine_version.default.engine
+  engine_version = data.aws_rds_engine_version.default.version
+  license_model  = "license-included"
+  storage_type   = "gp3"
+
+  preferred_instance_classes = ["db.m5.medium", "db.m5.large"]
+}
+
+resource "aws_db_instance" "test" {
+  allocated_storage    = 400
+  apply_immediately    = true
+  engine               = data.aws_rds_engine_version.default.engine
+  engine_version       = data.aws_rds_engine_version.default.version
+  identifier           = %[1]q
+  instance_class       = data.aws_rds_orderable_db_instance.test.instance_class
+  iops                 = %[2]d
+  license_model        = data.aws_rds_orderable_db_instance.test.license_model
+  parameter_group_name = "default.${data.aws_rds_engine_version.default.parameter_group_family}"
+  password             = "avoid-plaintext-passwords"
+  skip_final_snapshot  = true
+  storage_throughput   = %[3]d
+  storage_type         = data.aws_rds_orderable_db_instance.test.storage_type
+  username             = "tfacctest"
+}
+`, rName, iops, throughput)
+}
+
 func testAccInstanceConfig_storageTypePostgres(rName string, storageType string, allocatedStorage int) string {
 	return fmt.Sprintf(`
 data "aws_rds_engine_version" "default" {
diff --git a/internal/service/rds/instances_data_source.go b/internal/service/rds/instances_data_source.go
index 5a79b0fb3a3..96aec2101df 100644
--- a/internal/service/rds/instances_data_source.go
+++ b/internal/service/rds/instances_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rds
 
 import (
@@ -8,9 +11,10 @@ import (
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
-	"github.com/hashicorp/terraform-provider-aws/internal/create"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
 	"github.com/hashicorp/terraform-provider-aws/internal/generate/namevaluesfilters"
-	"github.com/hashicorp/terraform-provider-aws/names"
+	tfslices "github.com/hashicorp/terraform-provider-aws/internal/slices"
+	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 )
 
 // @SDKDataSource("aws_db_instances")
@@ -19,6 +23,7 @@ func DataSourceInstances() *schema.Resource {
 		ReadWithoutTimeout: dataSourceInstancesRead,
 
 		Schema: map[string]*schema.Schema{
+			"filter": namevaluesfilters.Schema(),
 			"instance_arns": {
 				Type:     schema.TypeList,
 				Computed: true,
@@ -29,16 +34,13 @@ func DataSourceInstances() *schema.Resource {
 				Computed: true,
 				Elem:     &schema.Schema{Type: schema.TypeString},
 			},
-			"filter": namevaluesfilters.Schema(),
+			"tags": tftags.TagsSchemaComputed(),
 		},
 	}
 }
 
-const (
-	DSNameInstances = "Instances Data Source"
-)
-
 func dataSourceInstancesRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).RDSConn(ctx)
 
 	input := &rds.DescribeDBInstancesInput{}
@@ -47,32 +49,30 @@ func dataSourceInstancesRead(ctx context.Context, d *schema.ResourceData, meta i
 		input.Filters = namevaluesfilters.New(v.(*schema.Set)).RDSFilters()
 	}
 
-	var instanceARNS []string
-	var instanceIdentifiers []string
-
-	err := conn.DescribeDBInstancesPagesWithContext(ctx, input, func(page *rds.DescribeDBInstancesOutput, lastPage bool) bool {
-		if page == nil {
-			return !lastPage
+	filter := tfslices.PredicateTrue[*rds.DBInstance]()
+	if v, ok := d.GetOk("tags"); ok {
+		filter = func(x *rds.DBInstance) bool {
+			return KeyValueTags(ctx, x.TagList).ContainsAll(tftags.New(ctx, v.(map[string]interface{})))
 		}
+	}
 
-		for _, dbInstance := range page.DBInstances {
-			if dbInstance == nil {
-				continue
-			}
-
-			instanceARNS = append(instanceARNS, aws.StringValue(dbInstance.DBInstanceArn))
-			instanceIdentifiers = append(instanceIdentifiers, aws.StringValue(dbInstance.DBInstanceIdentifier))
-		}
+	instances, err := findDBInstancesSDKv1(ctx, conn, input, filter)
 
-		return !lastPage
-	})
 	if err != nil {
-		return create.DiagError(names.RDS, create.ErrActionReading, DSNameInstances, "", err)
+		return sdkdiag.AppendErrorf(diags, "reading RDS DB Instances: %s", err)
+	}
+
+	var instanceARNS []string
+	var instanceIdentifiers []string
+
+	for _, instance := range instances {
+		instanceARNS = append(instanceARNS, aws.StringValue(instance.DBInstanceArn))
+		instanceIdentifiers = append(instanceIdentifiers, aws.StringValue(instance.DBInstanceIdentifier))
 	}
 
 	d.SetId(meta.(*conns.AWSClient).Region)
 	d.Set("instance_arns", instanceARNS)
 	d.Set("instance_identifiers", instanceIdentifiers)
 
-	return nil
+	return diags
 }
diff --git a/internal/service/rds/instances_data_source_test.go b/internal/service/rds/instances_data_source_test.go
index 456b73e94d9..b95684c8f28 100644
--- a/internal/service/rds/instances_data_source_test.go
+++ b/internal/service/rds/instances_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rds_test
 
 import (
@@ -37,6 +40,33 @@ func TestAccRDSInstancesDataSource_filter(t *testing.T) {
 	})
 }
 
+func TestAccRDSInstancesDataSource_tags(t *testing.T) {
+	ctx := acctest.Context(t)
+	var dbInstance rds.DBInstance
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	dataSourceName := "data.aws_db_instances.test"
+	resourceName := "aws_db_instance.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, rds.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckInstanceDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccInstancesDataSourceConfig_tags(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckInstanceExists(ctx, resourceName, &dbInstance),
+					resource.TestCheckResourceAttr(dataSourceName, "instance_arns.#", "1"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "instance_arns.0", resourceName, "arn"),
+					resource.TestCheckResourceAttr(dataSourceName, "instance_identifiers.#", "1"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "instance_identifiers.0", resourceName, "identifier"),
+				),
+			},
+		},
+	})
+}
+
 func testAccInstancesDataSourceConfig_filter(rName string) string {
 	return fmt.Sprintf(`
 data "aws_rds_engine_version" "default" {
@@ -59,7 +89,7 @@ resource "aws_db_instance" "test" {
 }
 
 resource "aws_db_instance" "wrong" {
-  identifier           = "wrong-%[1]s"
+  identifier           = "%[1]s-wrong"
   allocated_storage    = 10
   engine               = data.aws_rds_engine_version.default.engine
   engine_version       = data.aws_rds_engine_version.default.version
@@ -79,6 +109,64 @@ data "aws_db_instances" "test" {
     name   = "db-instance-id"
     values = [aws_db_instance.test.identifier]
   }
+
+  depends_on = [aws_db_instance.wrong]
+}
+`, rName)
+}
+
+func testAccInstancesDataSourceConfig_tags(rName string) string {
+	return fmt.Sprintf(`
+data "aws_rds_engine_version" "default" {
+  engine = "postgres"
+}
+
+resource "aws_db_instance" "test" {
+  identifier           = %[1]q
+  allocated_storage    = 10
+  engine               = data.aws_rds_engine_version.default.engine
+  engine_version       = data.aws_rds_engine_version.default.version
+  instance_class       = "db.t4g.micro"
+  db_name              = "test"
+  password             = "avoid-plaintext-passwords"
+  username             = "tfacctest"
+  parameter_group_name = "default.${data.aws_rds_engine_version.default.parameter_group_family}"
+  skip_final_snapshot  = true
+
+  apply_immediately = true
+
+  tags = {
+    Name = %[1]q
+    Test = "true"
+  }
+}
+
+resource "aws_db_instance" "wrong" {
+  identifier           = "%[1]s-wrong"
+  allocated_storage    = 10
+  engine               = data.aws_rds_engine_version.default.engine
+  engine_version       = data.aws_rds_engine_version.default.version
+  instance_class       = "db.t4g.micro"
+  db_name              = "test"
+  password             = "avoid-plaintext-passwords"
+  username             = "tfacctest"
+  parameter_group_name = "default.${data.aws_rds_engine_version.default.parameter_group_family}"
+  skip_final_snapshot  = true
+
+  apply_immediately = true
+
+  tags = {
+    Name = "%[1]s-wrong"
+    Test = "true"
+  }
+}
+
+data "aws_db_instances" "test" {
+  tags = {
+    Name = %[1]q
+  }
+
+  depends_on = [aws_db_instance.test, aws_db_instance.wrong]
 }
 `, rName)
 }
diff --git a/internal/service/rds/option_group.go b/internal/service/rds/option_group.go
index fad116f7fa8..7336c50e7a5 100644
--- a/internal/service/rds/option_group.go
+++ b/internal/service/rds/option_group.go
@@ -1,9 +1,10 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rds
 
 import (
-	"bytes"
 	"context"
-	"fmt"
 	"log"
 	"strings"
 	"time"
@@ -12,12 +13,12 @@ import (
 	"github.com/aws/aws-sdk-go/service/rds"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/create"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
+	tfslices "github.com/hashicorp/terraform-provider-aws/internal/slices"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
@@ -32,6 +33,7 @@ func ResourceOptionGroup() *schema.Resource {
 		ReadWithoutTimeout:   resourceOptionGroupRead,
 		UpdateWithoutTimeout: resourceOptionGroupUpdate,
 		DeleteWithoutTimeout: resourceOptionGroupDelete,
+
 		Importer: &schema.ResourceImporter{
 			StateContext: schema.ImportStatePassthroughContext,
 		},
@@ -45,6 +47,16 @@ func ResourceOptionGroup() *schema.Resource {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
+			"engine_name": {
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+			"major_engine_version": {
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
 			"name": {
 				Type:          schema.TypeString,
 				Optional:      true,
@@ -61,28 +73,16 @@ func ResourceOptionGroup() *schema.Resource {
 				ConflictsWith: []string{"name"},
 				ValidateFunc:  validOptionGroupNamePrefix,
 			},
-			"engine_name": {
-				Type:     schema.TypeString,
-				Required: true,
-				ForceNew: true,
-			},
-			"major_engine_version": {
-				Type:     schema.TypeString,
-				Required: true,
-				ForceNew: true,
-			},
-			"option_group_description": {
-				Type:     schema.TypeString,
-				Optional: true,
-				ForceNew: true,
-				Default:  "Managed by Terraform",
-			},
-
 			"option": {
 				Type:     schema.TypeSet,
 				Optional: true,
 				Elem: &schema.Resource{
 					Schema: map[string]*schema.Schema{
+						"db_security_group_memberships": {
+							Type:     schema.TypeSet,
+							Optional: true,
+							Elem:     &schema.Schema{Type: schema.TypeString},
+						},
 						"option_name": {
 							Type:     schema.TypeString,
 							Required: true,
@@ -107,27 +107,24 @@ func ResourceOptionGroup() *schema.Resource {
 							Type:     schema.TypeInt,
 							Optional: true,
 						},
-						"db_security_group_memberships": {
-							Type:     schema.TypeSet,
+						"version": {
+							Type:     schema.TypeString,
 							Optional: true,
-							Elem:     &schema.Schema{Type: schema.TypeString},
-							Set:      schema.HashString,
 						},
 						"vpc_security_group_memberships": {
 							Type:     schema.TypeSet,
 							Optional: true,
 							Elem:     &schema.Schema{Type: schema.TypeString},
-							Set:      schema.HashString,
-						},
-						"version": {
-							Type:     schema.TypeString,
-							Optional: true,
 						},
 					},
 				},
-				Set: resourceOptionHash,
 			},
-
+			"option_group_description": {
+				Type:     schema.TypeString,
+				Optional: true,
+				ForceNew: true,
+				Default:  "Managed by Terraform",
+			},
 			names.AttrTags:    tftags.TagsSchema(),
 			names.AttrTagsAll: tftags.TagsSchemaComputed(),
 		},
@@ -140,34 +137,22 @@ func resourceOptionGroupCreate(ctx context.Context, d *schema.ResourceData, meta
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).RDSConn(ctx)
 
-	var groupName string
-	if v, ok := d.GetOk("name"); ok {
-		groupName = v.(string)
-	} else if v, ok := d.GetOk("name_prefix"); ok {
-		groupName = id.PrefixedUniqueId(v.(string))
-	} else {
-		groupName = id.UniqueId()
-	}
-
-	createOpts := &rds.CreateOptionGroupInput{
+	name := create.Name(d.Get("name").(string), d.Get("name_prefix").(string))
+	input := &rds.CreateOptionGroupInput{
 		EngineName:             aws.String(d.Get("engine_name").(string)),
 		MajorEngineVersion:     aws.String(d.Get("major_engine_version").(string)),
 		OptionGroupDescription: aws.String(d.Get("option_group_description").(string)),
-		OptionGroupName:        aws.String(groupName),
+		OptionGroupName:        aws.String(name),
 		Tags:                   getTagsIn(ctx),
 	}
 
-	log.Printf("[DEBUG] Create DB Option Group: %#v", createOpts)
-	output, err := conn.CreateOptionGroupWithContext(ctx, createOpts)
+	_, err := conn.CreateOptionGroupWithContext(ctx, input)
+
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "creating DB Option Group: %s", err)
+		return sdkdiag.AppendErrorf(diags, "creating RDS DB Option Group (%s): %s", name, err)
 	}
 
-	d.SetId(strings.ToLower(groupName))
-	log.Printf("[INFO] DB Option Group ID: %s", d.Id())
-
-	// Set for update
-	d.Set("arn", output.OptionGroup.OptionGroupArn)
+	d.SetId(strings.ToLower(name))
 
 	return append(diags, resourceOptionGroupUpdate(ctx, d, meta)...)
 }
@@ -176,62 +161,35 @@ func resourceOptionGroupRead(ctx context.Context, d *schema.ResourceData, meta i
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).RDSConn(ctx)
 
-	params := &rds.DescribeOptionGroupsInput{
-		OptionGroupName: aws.String(d.Id()),
-	}
-
-	log.Printf("[DEBUG] Describe DB Option Group: %#v", params)
-	options, err := conn.DescribeOptionGroupsWithContext(ctx, params)
+	option, err := FindOptionGroupByName(ctx, conn, d.Id())
 
-	if tfawserr.ErrCodeEquals(err, rds.ErrCodeOptionGroupNotFoundFault) {
-		log.Printf("[WARN] RDS Option Group (%s) not found, removing from state", d.Id())
+	if !d.IsNewResource() && tfresource.NotFound(err) {
+		log.Printf("[WARN] RDS DB Option Group (%s) not found, removing from state", d.Id())
 		d.SetId("")
 		return diags
 	}
 
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "Describing DB Option Group: %s", err)
-	}
-
-	var option *rds.OptionGroup
-	for _, ogl := range options.OptionGroupsList {
-		if aws.StringValue(ogl.OptionGroupName) == d.Id() {
-			option = ogl
-			break
-		}
-	}
-
-	if option == nil {
-		log.Printf("[WARN] RDS Option Group (%s) not found, removing from state", d.Id())
-		d.SetId("")
-		return diags
+		return sdkdiag.AppendErrorf(diags, "reading RDS DB Option Group (%s): %s", d.Id(), err)
 	}
 
 	d.Set("arn", option.OptionGroupArn)
-	d.Set("name", option.OptionGroupName)
-	d.Set("major_engine_version", option.MajorEngineVersion)
 	d.Set("engine_name", option.EngineName)
-	d.Set("option_group_description", option.OptionGroupDescription)
-
+	d.Set("major_engine_version", option.MajorEngineVersion)
+	d.Set("name", option.OptionGroupName)
+	d.Set("name_prefix", create.NamePrefixFromName(aws.StringValue(option.OptionGroupName)))
 	if err := d.Set("option", flattenOptions(option.Options, expandOptionConfiguration(d.Get("option").(*schema.Set).List()))); err != nil {
 		return sdkdiag.AppendErrorf(diags, "setting option: %s", err)
 	}
+	d.Set("option_group_description", option.OptionGroupDescription)
 
 	return diags
 }
 
-func optionInList(optionName string, list []*string) bool {
-	for _, opt := range list {
-		if aws.StringValue(opt) == optionName {
-			return true
-		}
-	}
-	return false
-}
-
 func resourceOptionGroupUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).RDSConn(ctx)
+
 	if d.HasChange("option") {
 		o, n := d.GetChange("option")
 		if o == nil {
@@ -258,37 +216,25 @@ func resourceOptionGroupUpdate(ctx context.Context, d *schema.ResourceData, meta
 		// Ensure there is actually something to update
 		// InvalidParameterValue: At least one option must be added, modified, or removed.
 		if len(optionsToInclude) > 0 || len(optionsToRemove) > 0 {
-			modifyOpts := &rds.ModifyOptionGroupInput{
-				OptionGroupName:  aws.String(d.Id()),
+			input := &rds.ModifyOptionGroupInput{
 				ApplyImmediately: aws.Bool(true),
+				OptionGroupName:  aws.String(d.Id()),
 			}
 
 			if len(optionsToInclude) > 0 {
-				modifyOpts.OptionsToInclude = optionsToInclude
+				input.OptionsToInclude = optionsToInclude
 			}
 
 			if len(optionsToRemove) > 0 {
-				modifyOpts.OptionsToRemove = optionsToRemove
+				input.OptionsToRemove = optionsToRemove
 			}
 
-			log.Printf("[DEBUG] Modify DB Option Group: %s", modifyOpts)
-
-			err := retry.RetryContext(ctx, propagationTimeout, func() *retry.RetryError {
-				_, err := conn.ModifyOptionGroupWithContext(ctx, modifyOpts)
-				if err != nil {
-					// InvalidParameterValue: IAM role ARN value is invalid or does not include the required permissions for: SQLSERVER_BACKUP_RESTORE
-					if tfawserr.ErrMessageContains(err, "InvalidParameterValue", "IAM role ARN value is invalid or does not include the required permissions") {
-						return retry.RetryableError(err)
-					}
-					return retry.NonRetryableError(err)
-				}
-				return nil
-			})
-			if tfresource.TimedOut(err) {
-				_, err = conn.ModifyOptionGroupWithContext(ctx, modifyOpts)
-			}
+			_, err := tfresource.RetryWhenAWSErrMessageContains(ctx, propagationTimeout, func() (interface{}, error) {
+				return conn.ModifyOptionGroupWithContext(ctx, input)
+			}, errCodeInvalidParameterValue, "IAM role ARN value is invalid or does not include the required permissions")
+
 			if err != nil {
-				return sdkdiag.AppendErrorf(diags, "modifying DB Option Group: %s", err)
+				return sdkdiag.AppendErrorf(diags, "modifying RDS DB Option Group (%s): %s", d.Id(), err)
 			}
 		}
 	}
@@ -300,66 +246,100 @@ func resourceOptionGroupDelete(ctx context.Context, d *schema.ResourceData, meta
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).RDSConn(ctx)
 
-	deleteOpts := &rds.DeleteOptionGroupInput{
-		OptionGroupName: aws.String(d.Id()),
-	}
+	log.Printf("[DEBUG] Deleting RDS DB Option Group: %s", d.Id())
+	_, err := tfresource.RetryWhenAWSErrCodeEquals(ctx, d.Timeout(schema.TimeoutDelete), func() (interface{}, error) {
+		return conn.DeleteOptionGroupWithContext(ctx, &rds.DeleteOptionGroupInput{
+			OptionGroupName: aws.String(d.Id()),
+		})
+	}, rds.ErrCodeInvalidOptionGroupStateFault)
 
-	log.Printf("[DEBUG] Deleting RDS Option Group: %s", d.Id())
-	err := retry.RetryContext(ctx, d.Timeout(schema.TimeoutDelete), func() *retry.RetryError {
-		_, err := conn.DeleteOptionGroupWithContext(ctx, deleteOpts)
-		if err != nil {
-			if tfawserr.ErrCodeEquals(err, rds.ErrCodeInvalidOptionGroupStateFault) {
-				log.Printf(`[DEBUG] AWS believes the RDS Option Group is still in use, this could be because of a internal snapshot create by AWS, see github issue #4597 for more info. retrying...`)
-				return retry.RetryableError(err)
-			}
-			return retry.NonRetryableError(err)
-		}
-		return nil
-	})
-	if tfresource.TimedOut(err) {
-		_, err = conn.DeleteOptionGroupWithContext(ctx, deleteOpts)
+	if tfawserr.ErrCodeEquals(err, rds.ErrCodeOptionGroupNotFoundFault) {
+		return diags
 	}
+
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "Deleting DB Option Group: %s", err)
+		return sdkdiag.AppendErrorf(diags, "deleting RDS DB Option Group (%s): %s", d.Id(), err)
 	}
+
 	return diags
 }
 
-func flattenOptionNames(configured []interface{}) []*string {
-	var optionNames []*string
-	for _, pRaw := range configured {
-		data := pRaw.(map[string]interface{})
-		optionNames = append(optionNames, aws.String(data["option_name"].(string)))
+func FindOptionGroupByName(ctx context.Context, conn *rds.RDS, name string) (*rds.OptionGroup, error) {
+	input := &rds.DescribeOptionGroupsInput{
+		OptionGroupName: aws.String(name),
 	}
+	output, err := findOptionGroup(ctx, conn, input, tfslices.PredicateTrue[*rds.OptionGroup]())
 
-	return optionNames
+	if err != nil {
+		return nil, err
+	}
+
+	// Eventual consistency check.
+	if aws.StringValue(output.OptionGroupName) != name {
+		return nil, &retry.NotFoundError{
+			LastRequest: input,
+		}
+	}
+
+	return output, nil
 }
 
-func resourceOptionHash(v interface{}) int {
-	var buf bytes.Buffer
-	m := v.(map[string]interface{})
-	buf.WriteString(fmt.Sprintf("%s-", m["option_name"].(string)))
-	if _, ok := m["port"]; ok {
-		buf.WriteString(fmt.Sprintf("%d-", m["port"].(int)))
+func findOptionGroup(ctx context.Context, conn *rds.RDS, input *rds.DescribeOptionGroupsInput, filter tfslices.Predicate[*rds.OptionGroup]) (*rds.OptionGroup, error) {
+	output, err := findOptionGroups(ctx, conn, input, filter)
+
+	if err != nil {
+		return nil, err
 	}
 
-	for _, oRaw := range m["option_settings"].(*schema.Set).List() {
-		o := oRaw.(map[string]interface{})
-		buf.WriteString(fmt.Sprintf("%s-", o["name"].(string)))
-		buf.WriteString(fmt.Sprintf("%s-", o["value"].(string)))
+	return tfresource.AssertSinglePtrResult(output)
+}
+
+func findOptionGroups(ctx context.Context, conn *rds.RDS, input *rds.DescribeOptionGroupsInput, filter tfslices.Predicate[*rds.OptionGroup]) ([]*rds.OptionGroup, error) {
+	var output []*rds.OptionGroup
+
+	err := conn.DescribeOptionGroupsPagesWithContext(ctx, input, func(page *rds.DescribeOptionGroupsOutput, lastPage bool) bool {
+		if page == nil {
+			return !lastPage
+		}
+
+		for _, v := range page.OptionGroupsList {
+			if v != nil && filter(v) {
+				output = append(output, v)
+			}
+		}
+
+		return !lastPage
+	})
+
+	if tfawserr.ErrCodeEquals(err, rds.ErrCodeOptionGroupNotFoundFault) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
 	}
 
-	for _, vpcRaw := range m["vpc_security_group_memberships"].(*schema.Set).List() {
-		buf.WriteString(fmt.Sprintf("%s-", vpcRaw.(string)))
+	if err != nil {
+		return nil, err
 	}
 
-	for _, sgRaw := range m["db_security_group_memberships"].(*schema.Set).List() {
-		buf.WriteString(fmt.Sprintf("%s-", sgRaw.(string)))
+	return output, nil
+}
+
+func optionInList(optionName string, list []*string) bool {
+	for _, opt := range list {
+		if aws.StringValue(opt) == optionName {
+			return true
+		}
 	}
+	return false
+}
 
-	if v, ok := m["version"]; ok && v.(string) != "" {
-		buf.WriteString(fmt.Sprintf("%s-", v.(string)))
+func flattenOptionNames(configured []interface{}) []*string {
+	var optionNames []*string
+	for _, pRaw := range configured {
+		data := pRaw.(map[string]interface{})
+		optionNames = append(optionNames, aws.String(data["option_name"].(string)))
 	}
 
-	return create.StringHashcode(buf.String())
+	return optionNames
 }
diff --git a/internal/service/rds/option_group_test.go b/internal/service/rds/option_group_test.go
index 88a4dc579d3..11525107979 100644
--- a/internal/service/rds/option_group_test.go
+++ b/internal/service/rds/option_group_test.go
@@ -1,20 +1,25 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rds_test
 
 import (
 	"context"
 	"errors"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/rds"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	tfrds "github.com/hashicorp/terraform-provider-aws/internal/service/rds"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
 func TestAccRDSOptionGroup_basic(t *testing.T) {
@@ -31,28 +36,28 @@ func TestAccRDSOptionGroup_basic(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config: testAccOptionGroupConfig_basic(rName),
-				Check: resource.ComposeTestCheckFunc(
+				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckOptionGroupExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "rds", regexp.MustCompile(`og:.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "rds", regexache.MustCompile(`og:.+`)),
 					resource.TestCheckResourceAttr(resourceName, "engine_name", "mysql"),
 					resource.TestCheckResourceAttr(resourceName, "major_engine_version", "8.0"),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
+					resource.TestCheckResourceAttr(resourceName, "name_prefix", ""),
 					resource.TestCheckResourceAttr(resourceName, "option.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "option_group_description", "Managed by Terraform"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 				),
 			},
 			{
-				ResourceName:            resourceName,
-				ImportState:             true,
-				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"name_prefix"},
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
 			},
 		},
 	})
 }
 
-func TestAccRDSOptionGroup_timeoutBlock(t *testing.T) {
+func TestAccRDSOptionGroup_disappears(t *testing.T) {
 	ctx := acctest.Context(t)
 	var v rds.OptionGroup
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
@@ -65,17 +70,40 @@ func TestAccRDSOptionGroup_timeoutBlock(t *testing.T) {
 		CheckDestroy:             testAccCheckOptionGroupDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccOptionGroupConfig_timeoutBlock(rName),
+				Config: testAccOptionGroupConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckOptionGroupExists(ctx, resourceName, &v),
-					resource.TestCheckResourceAttr(resourceName, "name", rName),
+					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfrds.ResourceOptionGroup(), resourceName),
 				),
+				ExpectNonEmptyPlan: true,
 			},
+		},
+	})
+}
+
+func TestAccRDSOptionGroup_nameGenerated(t *testing.T) {
+	ctx := acctest.Context(t)
+	var v rds.OptionGroup
+	resourceName := "aws_db_option_group.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, rds.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckOptionGroupDestroy(ctx),
+		Steps: []resource.TestStep{
 			{
-				ResourceName:            resourceName,
-				ImportState:             true,
-				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"name_prefix"},
+				Config: testAccOptionGroupConfig_nameGenerated(),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckOptionGroupExists(ctx, resourceName, &v),
+					acctest.CheckResourceAttrNameGenerated(resourceName, "name"),
+					resource.TestCheckResourceAttr(resourceName, "name_prefix", id.UniqueIdPrefix),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
 			},
 		},
 	})
@@ -84,6 +112,7 @@ func TestAccRDSOptionGroup_timeoutBlock(t *testing.T) {
 func TestAccRDSOptionGroup_namePrefix(t *testing.T) {
 	ctx := acctest.Context(t)
 	var v rds.OptionGroup
+	resourceName := "aws_db_option_group.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
@@ -92,25 +121,73 @@ func TestAccRDSOptionGroup_namePrefix(t *testing.T) {
 		CheckDestroy:             testAccCheckOptionGroupDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccOptionGroupConfig_namePrefix,
+				Config: testAccOptionGroupConfig_namePrefix("tf-acc-test-prefix-"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOptionGroupExists(ctx, "aws_db_option_group.test", &v),
-					resource.TestMatchResourceAttr("aws_db_option_group.test", "name", regexp.MustCompile("^tf-test-")),
+					testAccCheckOptionGroupExists(ctx, resourceName, &v),
+					acctest.CheckResourceAttrNameFromPrefix(resourceName, "name", "tf-acc-test-prefix-"),
+					resource.TestCheckResourceAttr(resourceName, "name_prefix", "tf-acc-test-prefix-"),
 				),
 			},
 			{
-				ResourceName:            "aws_db_option_group.test",
-				ImportState:             true,
-				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"name_prefix"},
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
 			},
 		},
 	})
 }
 
-func TestAccRDSOptionGroup_generatedName(t *testing.T) {
+func TestAccRDSOptionGroup_tags(t *testing.T) {
+	ctx := acctest.Context(t)
+	var optionGroup1, optionGroup2, optionGroup3 rds.OptionGroup
+	resourceName := "aws_db_option_group.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, rds.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckOptionGroupDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccOptionGroupConfig_tags1(rName, "key1", "value1"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckOptionGroupExists(ctx, resourceName, &optionGroup1),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				Config: testAccOptionGroupConfig_tags2(rName, "key1", "value1updated", "key2", "value2"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckOptionGroupExists(ctx, resourceName, &optionGroup2),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1updated"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
+				),
+			},
+			{
+				Config: testAccOptionGroupConfig_tags1(rName, "key2", "value2"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckOptionGroupExists(ctx, resourceName, &optionGroup3),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccRDSOptionGroup_timeoutBlock(t *testing.T) {
 	ctx := acctest.Context(t)
 	var v rds.OptionGroup
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_db_option_group.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
@@ -119,16 +196,16 @@ func TestAccRDSOptionGroup_generatedName(t *testing.T) {
 		CheckDestroy:             testAccCheckOptionGroupDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccOptionGroupConfig_generatedName,
+				Config: testAccOptionGroupConfig_timeoutBlock(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOptionGroupExists(ctx, "aws_db_option_group.test", &v),
+					testAccCheckOptionGroupExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "name", rName),
 				),
 			},
 			{
-				ResourceName:            "aws_db_option_group.test",
-				ImportState:             true,
-				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"name_prefix"},
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
 			},
 		},
 	})
@@ -154,10 +231,9 @@ func TestAccRDSOptionGroup_optionGroupDescription(t *testing.T) {
 				),
 			},
 			{
-				ResourceName:            resourceName,
-				ImportState:             true,
-				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"name_prefix"},
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
 			},
 		},
 	})
@@ -182,10 +258,9 @@ func TestAccRDSOptionGroup_basicDestroyWithInstance(t *testing.T) {
 				Config: testAccOptionGroupConfig_destroy(rName),
 			},
 			{
-				ResourceName:            resourceName,
-				ImportState:             true,
-				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"name_prefix"},
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
 			},
 		},
 	})
@@ -220,7 +295,7 @@ func TestAccRDSOptionGroup_Option_optionSettings(t *testing.T) {
 				ImportStateVerify: true,
 				// Ignore option since our current logic skips "unconfigured" default option settings
 				// Even with Config set, ImportState TestStep does not "see" the configuration to check against
-				ImportStateVerifyIgnore: []string{"name_prefix", "option"},
+				ImportStateVerifyIgnore: []string{"option"},
 			},
 			{
 				Config: testAccOptionGroupConfig_optionSettingsUpdate(rName),
@@ -233,12 +308,10 @@ func TestAccRDSOptionGroup_Option_optionSettings(t *testing.T) {
 					}),
 				),
 			},
-			// Ensure we can import non-default value option settings
 			{
-				ResourceName:            resourceName,
-				ImportState:             true,
-				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"name_prefix"},
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
 			},
 		},
 	})
@@ -266,10 +339,9 @@ func TestAccRDSOptionGroup_OptionOptionSettings_iamRole(t *testing.T) {
 				),
 			},
 			{
-				ResourceName:            resourceName,
-				ImportState:             true,
-				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"name_prefix"},
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
 			},
 		},
 	})
@@ -295,10 +367,9 @@ func TestAccRDSOptionGroup_sqlServerOptionsUpdate(t *testing.T) {
 				),
 			},
 			{
-				ResourceName:            resourceName,
-				ImportState:             true,
-				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"name_prefix"},
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
 			},
 			{
 				Config: testAccOptionGroupConfig_sqlServerEEOptionsUpdate(rName),
@@ -338,7 +409,7 @@ func TestAccRDSOptionGroup_oracleOptionsUpdate(t *testing.T) {
 				ImportState:       true,
 				ImportStateVerify: true,
 				// Ignore option since API responds with **** instead of password
-				ImportStateVerifyIgnore: []string{"name_prefix", "option"},
+				ImportStateVerifyIgnore: []string{"option"},
 			},
 			{
 				Config: testAccOptionGroupConfig_oracleEEOptionSettings(rName, "13.3.0.0.v2"),
@@ -374,10 +445,9 @@ func TestAccRDSOptionGroup_OptionOptionSettings_multipleNonDefault(t *testing.T)
 				),
 			},
 			{
-				ResourceName:            resourceName,
-				ImportState:             true,
-				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"name_prefix"},
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
 			},
 			{
 				Config: testAccOptionGroupConfig_settingsMultiple(rName, "example1,example2"),
@@ -411,16 +481,16 @@ func TestAccRDSOptionGroup_multipleOptions(t *testing.T) {
 				),
 			},
 			{
-				ResourceName:            resourceName,
-				ImportState:             true,
-				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"name_prefix"},
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
 			},
 		},
 	})
 }
 
-func TestAccRDSOptionGroup_tags(t *testing.T) {
+// Reference: https://github.com/hashicorp/terraform-provider-aws/issues/7114
+func TestAccRDSOptionGroup_Tags_withOptions(t *testing.T) {
 	ctx := acctest.Context(t)
 	var optionGroup1, optionGroup2, optionGroup3 rds.OptionGroup
 	resourceName := "aws_db_option_group.test"
@@ -433,32 +503,34 @@ func TestAccRDSOptionGroup_tags(t *testing.T) {
 		CheckDestroy:             testAccCheckOptionGroupDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccOptionGroupConfig_tags1(rName, "key1", "value1"),
+				Config: testAccOptionGroupConfig_tagsOption1(rName, "key1", "value1"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckOptionGroupExists(ctx, resourceName, &optionGroup1),
+					resource.TestCheckResourceAttr(resourceName, "option.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
 				),
 			},
 			{
-				ResourceName:            resourceName,
-				ImportState:             true,
-				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"name_prefix"},
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
 			},
 			{
-				Config: testAccOptionGroupConfig_tags2(rName, "key1", "value1updated", "key2", "value2"),
+				Config: testAccOptionGroupConfig_tagsOption2(rName, "key1", "value1updated", "key2", "value2"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckOptionGroupExists(ctx, resourceName, &optionGroup2),
+					resource.TestCheckResourceAttr(resourceName, "option.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1updated"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
 				),
 			},
 			{
-				Config: testAccOptionGroupConfig_tags1(rName, "key2", "value2"),
+				Config: testAccOptionGroupConfig_tagsOption1(rName, "key2", "value2"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckOptionGroupExists(ctx, resourceName, &optionGroup3),
+					resource.TestCheckResourceAttr(resourceName, "option.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
 				),
@@ -467,10 +539,10 @@ func TestAccRDSOptionGroup_tags(t *testing.T) {
 	})
 }
 
-// Reference: https://github.com/hashicorp/terraform-provider-aws/issues/7114
-func TestAccRDSOptionGroup_Tags_withOptions(t *testing.T) {
+// https://github.com/hashicorp/terraform-provider-aws/issues/21367
+func TestAccRDSOptionGroup_badDiffs(t *testing.T) {
 	ctx := acctest.Context(t)
-	var optionGroup1, optionGroup2, optionGroup3 rds.OptionGroup
+	var optionGroup1 rds.OptionGroup
 	resourceName := "aws_db_option_group.test"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
@@ -481,37 +553,39 @@ func TestAccRDSOptionGroup_Tags_withOptions(t *testing.T) {
 		CheckDestroy:             testAccCheckOptionGroupDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccOptionGroupConfig_tagsOption1(rName, "key1", "value1"),
+				Config: testAccOptionGroupConfig_badDiffs1(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckOptionGroupExists(ctx, resourceName, &optionGroup1),
-					resource.TestCheckResourceAttr(resourceName, "option.#", "1"),
-					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
-					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "option.*", map[string]string{
+						"port": "3872",
+					}),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "option.*", map[string]string{
+						"option_name": "SQLT",
+					}),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "option.*", map[string]string{
+						"option_name": "S3_INTEGRATION",
+					}),
 				),
 			},
 			{
-				ResourceName:            resourceName,
-				ImportState:             true,
-				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"name_prefix"},
-			},
-			{
-				Config: testAccOptionGroupConfig_tagsOption2(rName, "key1", "value1updated", "key2", "value2"),
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOptionGroupExists(ctx, resourceName, &optionGroup2),
-					resource.TestCheckResourceAttr(resourceName, "option.#", "1"),
-					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
-					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1updated"),
-					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
-				),
+				Config:   testAccOptionGroupConfig_badDiffs1(rName),
+				PlanOnly: true,
 			},
 			{
-				Config: testAccOptionGroupConfig_tagsOption1(rName, "key2", "value2"),
+				Config: testAccOptionGroupConfig_badDiffs2(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckOptionGroupExists(ctx, resourceName, &optionGroup3),
-					resource.TestCheckResourceAttr(resourceName, "option.#", "1"),
-					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
-					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
+					testAccCheckOptionGroupExists(ctx, resourceName, &optionGroup1),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "option.*", map[string]string{
+						"port": "3873",
+					}),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "option.*", map[string]string{
+						"option_name": "SQLT",
+						"version":     "2018-07-25.v1",
+					}),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "option.*", map[string]string{
+						"option_name": "S3_INTEGRATION",
+						"version":     "1.0",
+					}),
 				),
 			},
 		},
@@ -536,7 +610,7 @@ func testAccCheckOptionGroupOptionSettingsIAMRole(optionGroup *rds.OptionGroup)
 		}
 
 		settingValue := aws.StringValue(optionGroup.Options[0].OptionSettings[0].Value)
-		iamArnRegExp := regexp.MustCompile(fmt.Sprintf(`^arn:%s:iam::\d{12}:role/.+`, acctest.Partition()))
+		iamArnRegExp := regexache.MustCompile(fmt.Sprintf(`^arn:%s:iam::\d{12}:role/.+`, acctest.Partition()))
 		if !iamArnRegExp.MatchString(settingValue) {
 			return fmt.Errorf("Expected option setting to be a valid IAM role but received %s", settingValue)
 		}
@@ -567,27 +641,15 @@ func testAccCheckOptionGroupExists(ctx context.Context, n string, v *rds.OptionG
 			return fmt.Errorf("Not found: %s", n)
 		}
 
-		if rs.Primary.ID == "" {
-			return fmt.Errorf("No DB Option Group Name is set")
-		}
-
 		conn := acctest.Provider.Meta().(*conns.AWSClient).RDSConn(ctx)
 
-		opts := rds.DescribeOptionGroupsInput{
-			OptionGroupName: aws.String(rs.Primary.ID),
-		}
+		output, err := tfrds.FindOptionGroupByName(ctx, conn, rs.Primary.ID)
 
-		resp, err := conn.DescribeOptionGroupsWithContext(ctx, &opts)
 		if err != nil {
 			return err
 		}
 
-		if len(resp.OptionGroupsList) != 1 ||
-			*resp.OptionGroupsList[0].OptionGroupName != rs.Primary.ID {
-			return fmt.Errorf("DB Option Group not found")
-		}
-
-		*v = *resp.OptionGroupsList[0]
+		*v = *output
 
 		return nil
 	}
@@ -602,56 +664,118 @@ func testAccCheckOptionGroupDestroy(ctx context.Context) resource.TestCheckFunc
 				continue
 			}
 
-			resp, err := conn.DescribeOptionGroupsWithContext(ctx, &rds.DescribeOptionGroupsInput{
-				OptionGroupName: aws.String(rs.Primary.ID),
-			})
+			_, err := tfrds.FindOptionGroupByName(ctx, conn, rs.Primary.ID)
 
-			if err == nil {
-				if len(resp.OptionGroupsList) != 0 &&
-					*resp.OptionGroupsList[0].OptionGroupName == rs.Primary.ID {
-					return fmt.Errorf("DB Option Group still exists")
-				}
+			if tfresource.NotFound(err) {
+				continue
 			}
 
-			// Verify the error
-			if !tfawserr.ErrCodeEquals(err, rds.ErrCodeOptionGroupNotFoundFault) {
+			if err != nil {
 				return err
 			}
+
+			return fmt.Errorf("RDS DB Option Group %s still exists", rs.Primary.ID)
 		}
 
 		return nil
 	}
 }
 
-func testAccOptionGroupConfig_timeoutBlock(rName string) string {
+func testAccOptionGroupConfig_basic(rName string) string {
 	return fmt.Sprintf(`
 data "aws_rds_engine_version" "default" {
   engine = "mysql"
 }
 
 resource "aws_db_option_group" "test" {
-  name                     = %[1]q
+  name                 = %[1]q
+  engine_name          = data.aws_rds_engine_version.default.engine
+  major_engine_version = regex("^\\d+\\.\\d+", data.aws_rds_engine_version.default.version)
+}
+`, rName)
+}
+
+func testAccOptionGroupConfig_nameGenerated() string {
+	return `
+data "aws_rds_engine_version" "default" {
+  engine = "mysql"
+}
+
+resource "aws_db_option_group" "test" {
   option_group_description = "Test option group for terraform"
   engine_name              = data.aws_rds_engine_version.default.engine
   major_engine_version     = regex("^\\d+\\.\\d+", data.aws_rds_engine_version.default.version)
+}
+`
+}
 
-  timeouts {
-    delete = "10m"
-  }
+func testAccOptionGroupConfig_namePrefix(namePrefix string) string {
+	return fmt.Sprintf(`
+data "aws_rds_engine_version" "default" {
+  engine = "mysql"
 }
-`, rName)
+
+resource "aws_db_option_group" "test" {
+  name_prefix              = %[1]q
+  option_group_description = "Test option group for terraform"
+  engine_name              = data.aws_rds_engine_version.default.engine
+  major_engine_version     = regex("^\\d+\\.\\d+", data.aws_rds_engine_version.default.version)
+}
+`, namePrefix)
 }
 
-func testAccOptionGroupConfig_basic(rName string) string {
+func testAccOptionGroupConfig_tags1(rName, tagKey1, tagValue1 string) string {
 	return fmt.Sprintf(`
 data "aws_rds_engine_version" "default" {
   engine = "mysql"
 }
 
 resource "aws_db_option_group" "test" {
+  engine_name          = data.aws_rds_engine_version.default.engine
+  major_engine_version = regex("^\\d+\\.\\d+", data.aws_rds_engine_version.default.version)
   name                 = %[1]q
+
+  tags = {
+    %[2]q = %[3]q
+  }
+}
+`, rName, tagKey1, tagValue1)
+}
+
+func testAccOptionGroupConfig_tags2(rName, tagKey1, tagValue1, tagKey2, tagValue2 string) string {
+	return fmt.Sprintf(`
+data "aws_rds_engine_version" "default" {
+  engine = "mysql"
+}
+
+resource "aws_db_option_group" "test" {
   engine_name          = data.aws_rds_engine_version.default.engine
   major_engine_version = regex("^\\d+\\.\\d+", data.aws_rds_engine_version.default.version)
+  name                 = %[1]q
+
+  tags = {
+    %[2]q = %[3]q
+    %[4]q = %[5]q
+  }
+}
+`, rName, tagKey1, tagValue1, tagKey2, tagValue2)
+}
+
+func testAccOptionGroupConfig_timeoutBlock(rName string) string {
+	return fmt.Sprintf(`
+data "aws_rds_engine_version" "default" {
+  engine = "mysql"
+}
+
+resource "aws_db_option_group" "test" {
+  name                     = %[1]q
+  option_group_description = "Test option group for terraform"
+  engine_name              = data.aws_rds_engine_version.default.engine
+  major_engine_version     = regex("^\\d+\\.\\d+", data.aws_rds_engine_version.default.version)
+
+  timeouts {
+    delete = "10m"
+  }
 }
 `, rName)
 }
@@ -673,9 +797,9 @@ resource "aws_db_instance" "test" {
   engine            = data.aws_rds_orderable_db_instance.test.engine
   engine_version    = data.aws_rds_orderable_db_instance.test.engine_version
   instance_class    = data.aws_rds_orderable_db_instance.test.instance_class
-  db_name           = "baz"
-  password          = "barbarbarbar"
-  username          = "foo"
+  identifier        = %[2]q
+  password          = "avoid-plaintext-passwords"
+  username          = "tfacctest"
 
   # Maintenance Window is stored in lower case in the API, though not strictly
   # documented. Terraform will downcase this to match (as opposed to throw a
@@ -886,31 +1010,6 @@ resource "aws_db_option_group" "test" {
 `, rName)
 }
 
-const testAccOptionGroupConfig_namePrefix = `
-data "aws_rds_engine_version" "default" {
-  engine = "mysql"
-}
-
-resource "aws_db_option_group" "test" {
-  name_prefix              = "tf-test-"
-  option_group_description = "Test option group for terraform"
-  engine_name              = data.aws_rds_engine_version.default.engine
-  major_engine_version     = regex("^\\d+\\.\\d+", data.aws_rds_engine_version.default.version)
-}
-`
-
-const testAccOptionGroupConfig_generatedName = `
-data "aws_rds_engine_version" "default" {
-  engine = "mysql"
-}
-
-resource "aws_db_option_group" "test" {
-  option_group_description = "Test option group for terraform"
-  engine_name              = data.aws_rds_engine_version.default.engine
-  major_engine_version     = regex("^\\d+\\.\\d+", data.aws_rds_engine_version.default.version)
-}
-`
-
 func testAccOptionGroupConfig_description(rName, optionGroupDescription string) string {
 	return fmt.Sprintf(`
 data "aws_rds_engine_version" "default" {
@@ -959,7 +1058,7 @@ resource "aws_db_option_group" "test" {
 `, rName, value)
 }
 
-func testAccOptionGroupConfig_tags1(rName, tagKey1, tagValue1 string) string {
+func testAccOptionGroupConfig_tagsOption1(rName, tagKey1, tagValue1 string) string {
 	return fmt.Sprintf(`
 data "aws_rds_engine_version" "default" {
   engine = "mysql"
@@ -970,6 +1069,15 @@ resource "aws_db_option_group" "test" {
   major_engine_version = regex("^\\d+\\.\\d+", data.aws_rds_engine_version.default.version)
   name                 = %[1]q
 
+  option {
+    option_name = "MARIADB_AUDIT_PLUGIN"
+
+    option_settings {
+      name  = "SERVER_AUDIT_FILE_ROTATIONS"
+      value = "0"
+    }
+  }
+
   tags = {
     %[2]q = %[3]q
   }
@@ -977,7 +1085,7 @@ resource "aws_db_option_group" "test" {
 `, rName, tagKey1, tagValue1)
 }
 
-func testAccOptionGroupConfig_tags2(rName, tagKey1, tagValue1, tagKey2, tagValue2 string) string {
+func testAccOptionGroupConfig_tagsOption2(rName, tagKey1, tagValue1, tagKey2, tagValue2 string) string {
 	return fmt.Sprintf(`
 data "aws_rds_engine_version" "default" {
   engine = "mysql"
@@ -988,6 +1096,15 @@ resource "aws_db_option_group" "test" {
   major_engine_version = regex("^\\d+\\.\\d+", data.aws_rds_engine_version.default.version)
   name                 = %[1]q
 
+  option {
+    option_name = "MARIADB_AUDIT_PLUGIN"
+
+    option_settings {
+      name  = "SERVER_AUDIT_FILE_ROTATIONS"
+      value = "0"
+    }
+  }
+
   tags = {
     %[2]q = %[3]q
     %[4]q = %[5]q
@@ -996,57 +1113,122 @@ resource "aws_db_option_group" "test" {
 `, rName, tagKey1, tagValue1, tagKey2, tagValue2)
 }
 
-func testAccOptionGroupConfig_tagsOption1(rName, tagKey1, tagValue1 string) string {
+func testAccOptionGroupConfig_badDiffs1(rName string) string {
 	return fmt.Sprintf(`
+resource "aws_security_group" "test" {
+  name = %[1]q
+}
+
 data "aws_rds_engine_version" "default" {
-  engine = "mysql"
+  engine = "oracle-ee"
 }
 
 resource "aws_db_option_group" "test" {
-  engine_name          = data.aws_rds_engine_version.default.engine
-  major_engine_version = regex("^\\d+\\.\\d+", data.aws_rds_engine_version.default.version)
-  name                 = %[1]q
+  name                     = %[1]q
+  option_group_description = "Option Group for Numagove"
+  engine_name              = data.aws_rds_engine_version.default.engine
+  major_engine_version     = regex("^\\d+", data.aws_rds_engine_version.default.version)
 
   option {
-    option_name = "MARIADB_AUDIT_PLUGIN"
+    option_name = "S3_INTEGRATION"
+  }
 
+  option {
+    option_name = "SQLT"
     option_settings {
-      name  = "SERVER_AUDIT_FILE_ROTATIONS"
-      value = "0"
+      name  = "LICENSE_PACK"
+      value = "T"
     }
   }
 
-  tags = {
-    %[2]q = %[3]q
+  option {
+    option_name                    = "OEM_AGENT"
+    version                        = "13.5.0.0.v1"
+    port                           = 3872
+    vpc_security_group_memberships = [aws_security_group.test.id]
+
+    option_settings {
+      name  = "AGENT_REGISTRATION_PASSWORD"
+      value = "TESTPASSWORDBGY"
+    }
+    option_settings {
+      name  = "MINIMUM_TLS_VERSION"
+      value = "TLSv1.2"
+    }
+    option_settings {
+      name  = "TLS_CIPHER_SUITE"
+      value = "TLS_RSA_WITH_AES_128_CBC_SHA"
+    }
+    option_settings {
+      name  = "OMS_HOST"
+      value = "BGY-TEST"
+    }
+    option_settings {
+      name  = "OMS_PORT"
+      value = "1159"
+    }
   }
 }
-`, rName, tagKey1, tagValue1)
+`, rName)
 }
 
-func testAccOptionGroupConfig_tagsOption2(rName, tagKey1, tagValue1, tagKey2, tagValue2 string) string {
+func testAccOptionGroupConfig_badDiffs2(rName string) string {
 	return fmt.Sprintf(`
+resource "aws_security_group" "test" {
+  name = %[1]q
+}
+
 data "aws_rds_engine_version" "default" {
-  engine = "mysql"
+  engine = "oracle-ee"
 }
 
 resource "aws_db_option_group" "test" {
-  engine_name          = data.aws_rds_engine_version.default.engine
-  major_engine_version = regex("^\\d+\\.\\d+", data.aws_rds_engine_version.default.version)
-  name                 = %[1]q
+  name                     = %[1]q
+  option_group_description = "Option Group for Numagove"
+  engine_name              = data.aws_rds_engine_version.default.engine
+  major_engine_version     = regex("^\\d+", data.aws_rds_engine_version.default.version)
 
   option {
-    option_name = "MARIADB_AUDIT_PLUGIN"
+    option_name = "S3_INTEGRATION"
+    version     = "1.0"
+  }
 
+  option {
+    option_name = "SQLT"
     option_settings {
-      name  = "SERVER_AUDIT_FILE_ROTATIONS"
-      value = "0"
+      name  = "LICENSE_PACK"
+      value = "T"
     }
+    version = "2018-07-25.v1"
   }
 
-  tags = {
-    %[2]q = %[3]q
-    %[4]q = %[5]q
+  option {
+    option_name                    = "OEM_AGENT"
+    version                        = "13.5.0.0.v1"
+    port                           = 3873
+    vpc_security_group_memberships = [aws_security_group.test.id]
+
+    option_settings {
+      name  = "AGENT_REGISTRATION_PASSWORD"
+      value = "TESTPASSWORDBGY"
+    }
+    option_settings {
+      name  = "MINIMUM_TLS_VERSION"
+      value = "TLSv1.2"
+    }
+    option_settings {
+      name  = "TLS_CIPHER_SUITE"
+      value = "TLS_RSA_WITH_AES_128_CBC_SHA"
+    }
+    option_settings {
+      name  = "OMS_HOST"
+      value = "BGY-TEST"
+    }
+    option_settings {
+      name  = "OMS_PORT"
+      value = "1159"
+    }
   }
 }
-`, rName, tagKey1, tagValue1, tagKey2, tagValue2)
+`, rName)
 }
diff --git a/internal/service/rds/orderable_instance_data_source.go b/internal/service/rds/orderable_instance_data_source.go
index a98a1373fa8..5cc8d8b28ca 100644
--- a/internal/service/rds/orderable_instance_data_source.go
+++ b/internal/service/rds/orderable_instance_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rds
 
 import (
diff --git a/internal/service/rds/orderable_instance_data_source_test.go b/internal/service/rds/orderable_instance_data_source_test.go
index b976d60f6f0..fc4606ed1ae 100644
--- a/internal/service/rds/orderable_instance_data_source_test.go
+++ b/internal/service/rds/orderable_instance_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rds_test
 
 import (
diff --git a/internal/service/rds/parameter_group.go b/internal/service/rds/parameter_group.go
index 5290e2aeec6..227dae69358 100644
--- a/internal/service/rds/parameter_group.go
+++ b/internal/service/rds/parameter_group.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rds
 
 import (
diff --git a/internal/service/rds/parameter_group_test.go b/internal/service/rds/parameter_group_test.go
index 85360a2a1b0..ae84cde899c 100644
--- a/internal/service/rds/parameter_group_test.go
+++ b/internal/service/rds/parameter_group_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rds_test
 
 import (
 	"context"
 	"fmt"
 	"reflect"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/rds"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -49,7 +52,7 @@ func TestAccRDSParameterGroup_basic(t *testing.T) {
 						"name":  "character_set_client",
 						"value": "utf8",
 					}),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "rds", regexp.MustCompile(fmt.Sprintf("pg:%s$", rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "rds", regexache.MustCompile(fmt.Sprintf("pg:%s$", rName))),
 				),
 			},
 			{
@@ -84,7 +87,7 @@ func TestAccRDSParameterGroup_basic(t *testing.T) {
 						"name":  "character_set_client",
 						"value": "utf8",
 					}),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "rds", regexp.MustCompile(fmt.Sprintf("pg:%s$", rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "rds", regexache.MustCompile(fmt.Sprintf("pg:%s$", rName))),
 				),
 			},
 			{
@@ -584,7 +587,7 @@ func TestAccRDSParameterGroup_namePrefix(t *testing.T) {
 				Config: testAccDBParameterGroupConfig_namePrefix,
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckParameterGroupExists(ctx, "aws_db_parameter_group.test", &v),
-					resource.TestMatchResourceAttr("aws_db_parameter_group.test", "name", regexp.MustCompile("^tf-test-")),
+					resource.TestMatchResourceAttr("aws_db_parameter_group.test", "name", regexache.MustCompile("^tf-test-")),
 				),
 			},
 		},
diff --git a/internal/service/rds/proxy.go b/internal/service/rds/proxy.go
index 12e4c118ab5..9f299010467 100644
--- a/internal/service/rds/proxy.go
+++ b/internal/service/rds/proxy.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rds
 
 import (
diff --git a/internal/service/rds/proxy_data_source.go b/internal/service/rds/proxy_data_source.go
index 96fb71d4bff..a0fe1652c46 100644
--- a/internal/service/rds/proxy_data_source.go
+++ b/internal/service/rds/proxy_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rds
 
 import (
diff --git a/internal/service/rds/proxy_data_source_test.go b/internal/service/rds/proxy_data_source_test.go
index 01fa90f2db8..591e2f2b399 100644
--- a/internal/service/rds/proxy_data_source_test.go
+++ b/internal/service/rds/proxy_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rds_test
 
 import (
diff --git a/internal/service/rds/proxy_default_target_group.go b/internal/service/rds/proxy_default_target_group.go
index 7cb9452cb1f..f2b16527410 100644
--- a/internal/service/rds/proxy_default_target_group.go
+++ b/internal/service/rds/proxy_default_target_group.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rds
 
 import (
diff --git a/internal/service/rds/proxy_default_target_group_test.go b/internal/service/rds/proxy_default_target_group_test.go
index e7486a3a625..c4240f59413 100644
--- a/internal/service/rds/proxy_default_target_group_test.go
+++ b/internal/service/rds/proxy_default_target_group_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rds_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/rds"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -37,7 +40,7 @@ func TestAccRDSProxyDefaultTargetGroup_basic(t *testing.T) {
 				Config: testAccProxyDefaultTargetGroupConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckProxyTargetGroupExists(ctx, resourceName, &dbProxyTargetGroup),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "rds", regexp.MustCompile(`target-group:.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "rds", regexache.MustCompile(`target-group:.+`)),
 					resource.TestCheckResourceAttr(resourceName, "connection_pool_config.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "connection_pool_config.*", map[string]string{
 						"connection_borrow_timeout":    "120",
@@ -77,7 +80,7 @@ func TestAccRDSProxyDefaultTargetGroup_emptyConnectionPool(t *testing.T) {
 				Config: testAccProxyDefaultTargetGroupConfig_emptyConnectionPoolConfig(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckProxyTargetGroupExists(ctx, resourceName, &dbProxyTargetGroup),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "rds", regexp.MustCompile(`target-group:.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "rds", regexache.MustCompile(`target-group:.+`)),
 					resource.TestCheckResourceAttr(resourceName, "connection_pool_config.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "connection_pool_config.*", map[string]string{
 						"connection_borrow_timeout":    "120",
diff --git a/internal/service/rds/proxy_endpoint.go b/internal/service/rds/proxy_endpoint.go
index 1f46ab04c60..6ee7e25f6bd 100644
--- a/internal/service/rds/proxy_endpoint.go
+++ b/internal/service/rds/proxy_endpoint.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rds
 
 import (
diff --git a/internal/service/rds/proxy_endpoint_test.go b/internal/service/rds/proxy_endpoint_test.go
index 71f830dc067..ad342ca5bc3 100644
--- a/internal/service/rds/proxy_endpoint_test.go
+++ b/internal/service/rds/proxy_endpoint_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rds_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/rds"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -39,13 +42,13 @@ func TestAccRDSProxyEndpoint_basic(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "db_proxy_endpoint_name", rName),
 					resource.TestCheckResourceAttrPair(resourceName, "db_proxy_name", "aws_db_proxy.test", "name"),
 					resource.TestCheckResourceAttr(resourceName, "target_role", "READ_WRITE"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "rds", regexp.MustCompile(`db-proxy-endpoint:.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "rds", regexache.MustCompile(`db-proxy-endpoint:.+`)),
 					resource.TestCheckResourceAttr(resourceName, "vpc_subnet_ids.#", "2"),
 					resource.TestCheckTypeSetElemAttrPair(resourceName, "vpc_subnet_ids.*", "aws_subnet.test.0", "id"),
 					resource.TestCheckTypeSetElemAttrPair(resourceName, "vpc_subnet_ids.*", "aws_subnet.test.1", "id"),
 					resource.TestCheckResourceAttr(resourceName, "vpc_security_group_ids.#", "1"),
 					resource.TestCheckResourceAttrPair(resourceName, "vpc_id", "aws_vpc.test", "id"),
-					resource.TestMatchResourceAttr(resourceName, "endpoint", regexp.MustCompile(`^[\w\-\.]+\.rds\.amazonaws\.com$`)),
+					resource.TestMatchResourceAttr(resourceName, "endpoint", regexache.MustCompile(`^[\w\-\.]+\.rds\.amazonaws\.com$`)),
 					resource.TestCheckResourceAttr(resourceName, "is_default", "false"),
 					resource.TestCheckResourceAttr(resourceName, "tags.#", "0"),
 				),
diff --git a/internal/service/rds/proxy_target.go b/internal/service/rds/proxy_target.go
index 95fd0bdfec7..cbd682650f9 100644
--- a/internal/service/rds/proxy_target.go
+++ b/internal/service/rds/proxy_target.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rds
 
 import (
diff --git a/internal/service/rds/proxy_target_test.go b/internal/service/rds/proxy_target_test.go
index 6aaa5d6208d..4267e879fbe 100644
--- a/internal/service/rds/proxy_target_test.go
+++ b/internal/service/rds/proxy_target_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rds_test
 
 import (
diff --git a/internal/service/rds/proxy_test.go b/internal/service/rds/proxy_test.go
index 59fa316fea2..20155f3f749 100644
--- a/internal/service/rds/proxy_test.go
+++ b/internal/service/rds/proxy_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rds_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/rds"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -39,7 +42,7 @@ func TestAccRDSProxy_basic(t *testing.T) {
 					testAccCheckProxyExists(ctx, resourceName, &v),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "engine_family", "MYSQL"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "rds", regexp.MustCompile(`db-proxy:.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "rds", regexache.MustCompile(`db-proxy:.+`)),
 					resource.TestCheckResourceAttr(resourceName, "auth.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "auth.0.auth_scheme", "SECRETS"),
 					resource.TestCheckResourceAttr(resourceName, "auth.0.description", "test"),
@@ -52,7 +55,7 @@ func TestAccRDSProxy_basic(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "vpc_subnet_ids.#", "2"),
 					resource.TestCheckTypeSetElemAttrPair(resourceName, "vpc_subnet_ids.*", "aws_subnet.test.0", "id"),
 					resource.TestCheckTypeSetElemAttrPair(resourceName, "vpc_subnet_ids.*", "aws_subnet.test.1", "id"),
-					resource.TestMatchResourceAttr(resourceName, "endpoint", regexp.MustCompile(`^[\w\-\.]+\.rds\.amazonaws\.com$`))),
+					resource.TestMatchResourceAttr(resourceName, "endpoint", regexache.MustCompile(`^[\w\-\.]+\.rds\.amazonaws\.com$`))),
 			},
 			{
 				ResourceName:      resourceName,
diff --git a/internal/service/rds/reserved_instance.go b/internal/service/rds/reserved_instance.go
index 6de2feab7cd..602a141e8c7 100644
--- a/internal/service/rds/reserved_instance.go
+++ b/internal/service/rds/reserved_instance.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rds
 
 import (
diff --git a/internal/service/rds/reserved_instance_offering_data_source.go b/internal/service/rds/reserved_instance_offering_data_source.go
index 01ba9aab871..8d78380f774 100644
--- a/internal/service/rds/reserved_instance_offering_data_source.go
+++ b/internal/service/rds/reserved_instance_offering_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rds
 
 import (
diff --git a/internal/service/rds/reserved_instance_offering_data_source_test.go b/internal/service/rds/reserved_instance_offering_data_source_test.go
index e37f156450b..aeb578501d2 100644
--- a/internal/service/rds/reserved_instance_offering_data_source_test.go
+++ b/internal/service/rds/reserved_instance_offering_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rds_test
 
 import (
diff --git a/internal/service/rds/reserved_instance_test.go b/internal/service/rds/reserved_instance_test.go
index 1c3ab107d9f..bf94875cf95 100644
--- a/internal/service/rds/reserved_instance_test.go
+++ b/internal/service/rds/reserved_instance_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rds_test
 
 import (
 	"context"
 	"fmt"
 	"os"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/rds"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -40,7 +43,7 @@ func TestAccRDSReservedInstance_basic(t *testing.T) {
 				Config: testAccReservedInstanceConfig_basic(rName, instanceCount),
 				Check: resource.ComposeTestCheckFunc(
 					testAccReservedInstanceExists(ctx, resourceName, &reservation),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "rds", regexp.MustCompile(`ri:.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "rds", regexache.MustCompile(`ri:.+`)),
 					resource.TestCheckResourceAttrPair(dataSourceName, "currency_code", resourceName, "currency_code"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "db_instance_class", resourceName, "db_instance_class"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "duration", resourceName, "duration"),
diff --git a/internal/service/rds/service_package_gen.go b/internal/service/rds/service_package_gen.go
index 74e5c3192cc..f6d0e9d990a 100644
--- a/internal/service/rds/service_package_gen.go
+++ b/internal/service/rds/service_package_gen.go
@@ -10,6 +10,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	rds_sdkv1 "github.com/aws/aws-sdk-go/service/rds"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -33,6 +34,8 @@ func (p *servicePackage) SDKDataSources(ctx context.Context) []*types.ServicePac
 		{
 			Factory:  DataSourceClusterSnapshot,
 			TypeName: "aws_db_cluster_snapshot",
+			Name:     "DB Cluster Snapshot",
+			Tags:     &types.ServicePackageResourceTags{},
 		},
 		{
 			Factory:  DataSourceEventCategories,
@@ -41,6 +44,8 @@ func (p *servicePackage) SDKDataSources(ctx context.Context) []*types.ServicePac
 		{
 			Factory:  DataSourceInstance,
 			TypeName: "aws_db_instance",
+			Name:     "DB Instance",
+			Tags:     &types.ServicePackageResourceTags{},
 		},
 		{
 			Factory:  DataSourceInstances,
@@ -53,6 +58,8 @@ func (p *servicePackage) SDKDataSources(ctx context.Context) []*types.ServicePac
 		{
 			Factory:  DataSourceSnapshot,
 			TypeName: "aws_db_snapshot",
+			Name:     "DB Snapshot",
+			Tags:     &types.ServicePackageResourceTags{},
 		},
 		{
 			Factory:  DataSourceSubnetGroup,
@@ -90,7 +97,7 @@ func (p *servicePackage) SDKResources(ctx context.Context) []*types.ServicePacka
 		{
 			Factory:  ResourceClusterSnapshot,
 			TypeName: "aws_db_cluster_snapshot",
-			Name:     "Cluster Snapshot",
+			Name:     "DB Cluster Snapshot",
 			Tags: &types.ServicePackageResourceTags{
 				IdentifierAttribute: "db_cluster_snapshot_arn",
 			},
@@ -223,6 +230,14 @@ func (p *servicePackage) SDKResources(ctx context.Context) []*types.ServicePacka
 			Factory:  ResourceClusterRoleAssociation,
 			TypeName: "aws_rds_cluster_role_association",
 		},
+		{
+			Factory:  ResourceCustomDBEngineVersion,
+			TypeName: "aws_rds_custom_db_engine_version",
+			Name:     "Custom DB Engine Version",
+			Tags: &types.ServicePackageResourceTags{
+				IdentifierAttribute: "arn",
+			},
+		},
 		{
 			Factory:  ResourceGlobalCluster,
 			TypeName: "aws_rds_global_cluster",
@@ -255,9 +270,11 @@ func (p *servicePackage) NewClient(ctx context.Context, config map[string]any) (
 
 	return rds_sdkv2.NewFromConfig(cfg, func(o *rds_sdkv2.Options) {
 		if endpoint := config["endpoint"].(string); endpoint != "" {
-			o.EndpointResolver = rds_sdkv2.EndpointResolverFromURL(endpoint)
+			o.BaseEndpoint = aws_sdkv2.String(endpoint)
 		}
 	}), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/rds/snapshot.go b/internal/service/rds/snapshot.go
index f9d911a1007..55ab3e61f9a 100644
--- a/internal/service/rds/snapshot.go
+++ b/internal/service/rds/snapshot.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rds
 
 import (
@@ -14,6 +17,7 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
 	"github.com/hashicorp/terraform-provider-aws/internal/flex"
+	tfslices "github.com/hashicorp/terraform-provider-aws/internal/slices"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
@@ -273,36 +277,59 @@ func FindDBSnapshotByID(ctx context.Context, conn *rds.RDS, id string) (*rds.DBS
 	input := &rds.DescribeDBSnapshotsInput{
 		DBSnapshotIdentifier: aws.String(id),
 	}
+	output, err := findDBSnapshot(ctx, conn, input, tfslices.PredicateTrue[*rds.DBSnapshot]())
 
-	output, err := conn.DescribeDBSnapshotsWithContext(ctx, input)
+	if err != nil {
+		return nil, err
+	}
 
-	if tfawserr.ErrCodeEquals(err, rds.ErrCodeDBSnapshotNotFoundFault) {
+	// Eventual consistency check.
+	if aws.StringValue(output.DBSnapshotIdentifier) != id {
 		return nil, &retry.NotFoundError{
-			LastError:   err,
 			LastRequest: input,
 		}
 	}
 
+	return output, nil
+}
+
+func findDBSnapshot(ctx context.Context, conn *rds.RDS, input *rds.DescribeDBSnapshotsInput, filter tfslices.Predicate[*rds.DBSnapshot]) (*rds.DBSnapshot, error) {
+	output, err := findDBSnapshots(ctx, conn, input, filter)
+
 	if err != nil {
 		return nil, err
 	}
 
-	if output == nil || len(output.DBSnapshots) == 0 || output.DBSnapshots[0] == nil {
-		return nil, tfresource.NewEmptyResultError(input)
-	}
+	return tfresource.AssertSinglePtrResult(output)
+}
 
-	if count := len(output.DBSnapshots); count > 1 {
-		return nil, tfresource.NewTooManyResultsError(count, input)
-	}
+func findDBSnapshots(ctx context.Context, conn *rds.RDS, input *rds.DescribeDBSnapshotsInput, filter tfslices.Predicate[*rds.DBSnapshot]) ([]*rds.DBSnapshot, error) {
+	var output []*rds.DBSnapshot
 
-	dbSnapshot := output.DBSnapshots[0]
+	err := conn.DescribeDBSnapshotsPagesWithContext(ctx, input, func(page *rds.DescribeDBSnapshotsOutput, lastPage bool) bool {
+		if page == nil {
+			return !lastPage
+		}
 
-	// Eventual consistency check.
-	if aws.StringValue(dbSnapshot.DBSnapshotIdentifier) != id {
+		for _, v := range page.DBSnapshots {
+			if v != nil && filter(v) {
+				output = append(output, v)
+			}
+		}
+
+		return !lastPage
+	})
+
+	if tfawserr.ErrCodeEquals(err, rds.ErrCodeDBSnapshotNotFoundFault) {
 		return nil, &retry.NotFoundError{
+			LastError:   err,
 			LastRequest: input,
 		}
 	}
 
-	return dbSnapshot, nil
+	if err != nil {
+		return nil, err
+	}
+
+	return output, nil
 }
diff --git a/internal/service/rds/snapshot_copy.go b/internal/service/rds/snapshot_copy.go
index bf251eb9d06..0d5c055b7c2 100644
--- a/internal/service/rds/snapshot_copy.go
+++ b/internal/service/rds/snapshot_copy.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rds
 
 import (
 	"context"
 	"log"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/rds"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -130,7 +133,7 @@ func ResourceSnapshotCopy() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 255),
-					validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9][\w-]+`), "must contain only alphanumeric, and hyphen (-) characters"),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z][\w-]+`), "must contain only alphanumeric, and hyphen (-) characters"),
 				),
 			},
 			"vpc_id": {
diff --git a/internal/service/rds/snapshot_copy_test.go b/internal/service/rds/snapshot_copy_test.go
index e9a967cb856..aebffac6c50 100644
--- a/internal/service/rds/snapshot_copy_test.go
+++ b/internal/service/rds/snapshot_copy_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rds_test
 
 import (
diff --git a/internal/service/rds/snapshot_data_source.go b/internal/service/rds/snapshot_data_source.go
index 6482ab01b86..08b0f03d75b 100644
--- a/internal/service/rds/snapshot_data_source.go
+++ b/internal/service/rds/snapshot_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rds
 
 import (
@@ -11,9 +14,13 @@ import (
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
+	tfslices "github.com/hashicorp/terraform-provider-aws/internal/slices"
+	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
+	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
-// @SDKDataSource("aws_db_snapshot")
+// @SDKDataSource("aws_db_snapshot", name="DB Snapshot")
+// @Tags
 func DataSourceSnapshot() *schema.Resource {
 	return &schema.Resource{
 		ReadWithoutTimeout: dataSourceSnapshotRead,
@@ -28,18 +35,16 @@ func DataSourceSnapshot() *schema.Resource {
 				Computed: true,
 			},
 			"db_instance_identifier": {
-				Type:         schema.TypeString,
-				Optional:     true,
-				AtLeastOneOf: []string{"db_instance_identifier", "db_snapshot_identifier"},
+				Type:     schema.TypeString,
+				Optional: true,
 			},
 			"db_snapshot_arn": {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
 			"db_snapshot_identifier": {
-				Type:         schema.TypeString,
-				Optional:     true,
-				AtLeastOneOf: []string{"db_instance_identifier", "db_snapshot_identifier"},
+				Type:     schema.TypeString,
+				Optional: true,
 			},
 			"encrypted": {
 				Type:     schema.TypeBool,
@@ -112,6 +117,7 @@ func DataSourceSnapshot() *schema.Resource {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
+			names.AttrTags: tftags.TagsSchemaComputed(),
 			"vpc_id": {
 				Type:     schema.TypeString,
 				Computed: true,
@@ -141,25 +147,32 @@ func dataSourceSnapshotRead(ctx context.Context, d *schema.ResourceData, meta in
 		input.SnapshotType = aws.String(v.(string))
 	}
 
-	output, err := conn.DescribeDBSnapshotsWithContext(ctx, input)
+	f := tfslices.PredicateTrue[*rds.DBSnapshot]()
+	if tags := getTagsIn(ctx); len(tags) > 0 {
+		f = func(v *rds.DBSnapshot) bool {
+			return KeyValueTags(ctx, v.TagList).ContainsAll(KeyValueTags(ctx, tags))
+		}
+	}
+
+	snapshots, err := findDBSnapshots(ctx, conn, input, f)
 
 	if err != nil {
 		return sdkdiag.AppendErrorf(diags, "reading RDS DB Snapshots: %s", err)
 	}
 
-	if len(output.DBSnapshots) < 1 {
+	if len(snapshots) < 1 {
 		return sdkdiag.AppendErrorf(diags, "Your query returned no results. Please change your search criteria and try again.")
 	}
 
 	var snapshot *rds.DBSnapshot
-	if len(output.DBSnapshots) > 1 {
+	if len(snapshots) > 1 {
 		if d.Get("most_recent").(bool) {
-			snapshot = mostRecentDBSnapshot(output.DBSnapshots)
+			snapshot = mostRecentDBSnapshot(snapshots)
 		} else {
 			return sdkdiag.AppendErrorf(diags, "Your query returned more than one result. Please try a more specific search criteria.")
 		}
 	} else {
-		snapshot = output.DBSnapshots[0]
+		snapshot = snapshots[0]
 	}
 
 	d.SetId(aws.StringValue(snapshot.DBSnapshotIdentifier))
@@ -186,6 +199,8 @@ func dataSourceSnapshotRead(ctx context.Context, d *schema.ResourceData, meta in
 	d.Set("storage_type", snapshot.StorageType)
 	d.Set("vpc_id", snapshot.VpcId)
 
+	setTagsOut(ctx, snapshot.TagList)
+
 	return diags
 }
 
diff --git a/internal/service/rds/snapshot_data_source_test.go b/internal/service/rds/snapshot_data_source_test.go
index fc3d75d4d59..7bdc823898b 100644
--- a/internal/service/rds/snapshot_data_source_test.go
+++ b/internal/service/rds/snapshot_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rds_test
 
 import (
@@ -7,7 +10,6 @@ import (
 	"github.com/aws/aws-sdk-go/service/rds"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
-	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
 )
 
@@ -17,76 +19,74 @@ func TestAccRDSSnapshotDataSource_basic(t *testing.T) {
 		t.Skip("skipping long-running test in short mode")
 	}
 
-	rInt := sdkacctest.RandInt()
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_db_snapshot.test"
+	ds1Name := "data.aws_db_snapshot.by_id"
+	ds2Name := "data.aws_db_snapshot.by_tags"
+
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
 		ErrorCheck:               acctest.ErrorCheck(t, rds.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		Steps: []resource.TestStep{
 			{
-				Config: testAccSnapshotDataSourceConfig_basic(rInt),
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckSnapshotIDDataSource("data.aws_db_snapshot.snapshot"),
+				Config: testAccSnapshotDataSourceConfig_basic(rName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					resource.TestCheckResourceAttrPair(ds1Name, "db_instance_identifier", resourceName, "db_instance_identifier"),
+					resource.TestCheckResourceAttrPair(ds1Name, "db_snapshot_arn", resourceName, "db_snapshot_arn"),
+					resource.TestCheckResourceAttrPair(ds1Name, "db_snapshot_identifier", resourceName, "db_snapshot_identifier"),
+					resource.TestCheckResourceAttrPair(ds1Name, "tags.%", resourceName, "tags.%"),
+					resource.TestCheckResourceAttr(ds1Name, "tags.Name", rName),
+
+					resource.TestCheckResourceAttrPair(ds2Name, "db_instance_identifier", resourceName, "db_instance_identifier"),
+					resource.TestCheckResourceAttrPair(ds2Name, "db_snapshot_arn", resourceName, "db_snapshot_arn"),
+					resource.TestCheckResourceAttrPair(ds2Name, "db_snapshot_identifier", resourceName, "db_snapshot_identifier"),
+					resource.TestCheckResourceAttrPair(ds1Name, "tags.%", resourceName, "tags.%"),
+					resource.TestCheckResourceAttr(ds2Name, "tags.Name", rName),
 				),
 			},
 		},
 	})
 }
 
-func testAccCheckSnapshotIDDataSource(n string) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		rs, ok := s.RootModule().Resources[n]
-		if !ok {
-			return fmt.Errorf("Can't find Volume data source: %s", n)
-		}
-
-		if rs.Primary.ID == "" {
-			return fmt.Errorf("Snapshot data source ID not set")
-		}
-		return nil
-	}
-}
-
-func testAccSnapshotDataSourceConfig_basic(rInt int) string {
-	return fmt.Sprintf(`
-data "aws_rds_engine_version" "default" {
-  engine = "mysql"
-}
+func testAccSnapshotDataSourceConfig_basic(rName string) string {
+	return acctest.ConfigCompose(testAccSnapshotConfig_base(rName), fmt.Sprintf(`
+resource "aws_db_snapshot" "test" {
+  db_instance_identifier = aws_db_instance.test.identifier
+  db_snapshot_identifier = %[1]q
 
-data "aws_rds_orderable_db_instance" "test" {
-  engine                     = data.aws_rds_engine_version.default.engine
-  engine_version             = data.aws_rds_engine_version.default.version
-  preferred_instance_classes = [%[1]s]
+  tags = {
+    Name = %[1]q
+    Test = "true"
+  }
 }
 
-resource "aws_db_instance" "bar" {
-  allocated_storage   = 10
-  engine              = data.aws_rds_engine_version.default.engine
-  engine_version      = data.aws_rds_engine_version.default.version
-  instance_class      = data.aws_rds_orderable_db_instance.test.instance_class
-  db_name             = "baz"
-  password            = "barbarbarbar"
-  username            = "foo"
-  skip_final_snapshot = true
+resource "aws_db_snapshot_copy" "test" {
+  source_db_snapshot_identifier = aws_db_snapshot.test.db_snapshot_arn
+  target_db_snapshot_identifier = "%[1]s-copy"
 
-  # Maintenance Window is stored in lower case in the API, though not strictly
-  # documented. Terraform will downcase this to match (as opposed to throw a
-  # validation error).
-  maintenance_window = "Fri:09:00-Fri:09:30"
-
-  backup_retention_period = 0
-
-  parameter_group_name = "default.${data.aws_rds_engine_version.default.parameter_group_family}"
+  tags = {
+    Name = "%[1]s-copy"
+    Test = "true"
+  }
 }
 
-data "aws_db_snapshot" "snapshot" {
+data "aws_db_snapshot" "by_id" {
   most_recent            = "true"
   db_snapshot_identifier = aws_db_snapshot.test.id
+
+  depends_on = [aws_db_snapshot_copy.test]
 }
 
-resource "aws_db_snapshot" "test" {
-  db_instance_identifier = aws_db_instance.bar.identifier
-  db_snapshot_identifier = "testsnapshot%[2]d"
+data "aws_db_snapshot" "by_tags" {
+  most_recent = "true"
+
+  tags = {
+    Name = %[1]q
+  }
+
+  depends_on = [aws_db_snapshot.test, aws_db_snapshot_copy.test]
 }
-`, mySQLPreferredInstanceClasses, rInt)
+
+`, rName))
 }
diff --git a/internal/service/rds/snapshot_test.go b/internal/service/rds/snapshot_test.go
index c10ec5079ee..279049aaac2 100644
--- a/internal/service/rds/snapshot_test.go
+++ b/internal/service/rds/snapshot_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rds_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/rds"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -36,7 +39,7 @@ func TestAccRDSSnapshot_basic(t *testing.T) {
 				Config: testAccSnapshotConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDBSnapshotExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "db_snapshot_arn", "rds", regexp.MustCompile(`snapshot:.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "db_snapshot_arn", "rds", regexache.MustCompile(`snapshot:.+`)),
 					resource.TestCheckResourceAttr(resourceName, "shared_accounts.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 				),
diff --git a/internal/service/rds/status.go b/internal/service/rds/status.go
index 1226e020afe..20fc1da7ca4 100644
--- a/internal/service/rds/status.go
+++ b/internal/service/rds/status.go
@@ -1,8 +1,10 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rds
 
 import (
 	"context"
-	"strconv"
 
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/rds"
@@ -66,46 +68,6 @@ func statusDBClusterRole(ctx context.Context, conn *rds.RDS, dbClusterID, roleAR
 	}
 }
 
-func statusDBInstanceAutomatedBackup(ctx context.Context, conn *rds.RDS, arn string) retry.StateRefreshFunc {
-	return func() (interface{}, string, error) {
-		output, err := FindDBInstanceAutomatedBackupByARN(ctx, conn, arn)
-
-		if tfresource.NotFound(err) {
-			return nil, "", nil
-		}
-
-		if err != nil {
-			return nil, "", err
-		}
-
-		return output, aws.StringValue(output.Status), nil
-	}
-}
-
-// statusDBInstanceHasAutomatedBackup returns whether or not a database instance has a specified automated backup.
-// The connection must be valid for the database instance's Region.
-func statusDBInstanceHasAutomatedBackup(ctx context.Context, conn *rds.RDS, dbInstanceID, dbInstanceAutomatedBackupsARN string) retry.StateRefreshFunc {
-	return func() (interface{}, string, error) {
-		output, err := findDBInstanceByIDSDKv1(ctx, conn, dbInstanceID)
-
-		if tfresource.NotFound(err) {
-			return nil, "", nil
-		}
-
-		if err != nil {
-			return nil, "", err
-		}
-
-		for _, v := range output.DBInstanceAutomatedBackupsReplications {
-			if aws.StringValue(v.DBInstanceAutomatedBackupsArn) == dbInstanceAutomatedBackupsARN {
-				return output, strconv.FormatBool(true), nil
-			}
-		}
-
-		return output, strconv.FormatBool(false), nil
-	}
-}
-
 func statusDBProxy(ctx context.Context, conn *rds.RDS, name string) retry.StateRefreshFunc {
 	return func() (interface{}, string, error) {
 		output, err := FindDBProxyByName(ctx, conn, name)
diff --git a/internal/service/rds/subnet_group.go b/internal/service/rds/subnet_group.go
index 81ad1759ecc..cd51dc7f12d 100644
--- a/internal/service/rds/subnet_group.go
+++ b/internal/service/rds/subnet_group.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rds
 
 import (
diff --git a/internal/service/rds/subnet_group_data_source.go b/internal/service/rds/subnet_group_data_source.go
index 1b72c049e7c..e88d51b4e92 100644
--- a/internal/service/rds/subnet_group_data_source.go
+++ b/internal/service/rds/subnet_group_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rds
 
 import (
diff --git a/internal/service/rds/subnet_group_data_source_test.go b/internal/service/rds/subnet_group_data_source_test.go
index 556d120f552..002f2d2a1bf 100644
--- a/internal/service/rds/subnet_group_data_source_test.go
+++ b/internal/service/rds/subnet_group_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rds_test
 
 import (
diff --git a/internal/service/rds/subnet_group_test.go b/internal/service/rds/subnet_group_test.go
index 886e4ccc555..f8b76c4cb72 100644
--- a/internal/service/rds/subnet_group_test.go
+++ b/internal/service/rds/subnet_group_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rds_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/rds"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -33,7 +36,7 @@ func TestAccRDSSubnetGroup_basic(t *testing.T) {
 				Config: testAccSubnetGroupConfig_basic(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckSubnetGroupExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "rds", regexp.MustCompile(fmt.Sprintf("subgrp:%s$", rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "rds", regexache.MustCompile(fmt.Sprintf("subgrp:%s$", rName))),
 					resource.TestCheckResourceAttr(resourceName, "description", "Managed by Terraform"),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "name_prefix", ""),
diff --git a/internal/service/rds/sweep.go b/internal/service/rds/sweep.go
index 7f06f44fdf2..0e8c28ea297 100644
--- a/internal/service/rds/sweep.go
+++ b/internal/service/rds/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package rds
 
@@ -14,10 +14,11 @@ import (
 	"github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_rds_cluster_parameter_group", &resource.Sweeper{
 		Name: "aws_rds_cluster_parameter_group",
 		F:    sweepClusterParameterGroups,
@@ -109,7 +110,7 @@ func init() {
 
 func sweepClusterParameterGroups(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -139,7 +140,7 @@ func sweepClusterParameterGroups(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping RDS Cluster Parameter Group sweep for %s: %s", region, err)
 		return nil
 	}
@@ -148,7 +149,7 @@ func sweepClusterParameterGroups(region string) error {
 		return fmt.Errorf("error listing RDS Cluster Parameter Groups (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping RDS Cluster Parameter Groups (%s): %w", region, err)
@@ -159,7 +160,7 @@ func sweepClusterParameterGroups(region string) error {
 
 func sweepClusterSnapshots(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -189,7 +190,7 @@ func sweepClusterSnapshots(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping RDS DB Cluster Snapshot sweep for %s: %s", region, err)
 		return nil
 	}
@@ -198,7 +199,7 @@ func sweepClusterSnapshots(region string) error {
 		return fmt.Errorf("error listing RDS DB Cluster Snapshots (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping RDS DB Cluster Snapshots (%s): %w", region, err)
@@ -209,7 +210,7 @@ func sweepClusterSnapshots(region string) error {
 
 func sweepClusters(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -236,7 +237,7 @@ func sweepClusters(region string) error {
 			d.Set("skip_final_snapshot", true)
 
 			if engineMode := aws.StringValue(v.EngineMode); engineMode == EngineModeGlobal || engineMode == EngineModeProvisioned {
-				globalCluster, err := DescribeGlobalClusterFromClusterARN(ctx, conn, arn)
+				globalCluster, err := FindGlobalClusterByDBClusterARN(ctx, conn, arn)
 				if err != nil {
 					if !tfresource.NotFound(err) {
 						sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("reading RDS Global Cluster information for DB Cluster (%s): %s", id, err))
@@ -254,7 +255,7 @@ func sweepClusters(region string) error {
 
 		return !lastPage
 	})
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping RDS Cluster sweep for %s: %s", region, err)
 		return sweeperErrs.ErrorOrNil() // In case we have completed some pages, but had errors
 	}
@@ -262,7 +263,7 @@ func sweepClusters(region string) error {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error listing RDS Clusters (%s): %w", region, err))
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 	if err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error sweeping RDS Clusters (%s): %w", region, err))
 	}
@@ -272,7 +273,7 @@ func sweepClusters(region string) error {
 
 func sweepEventSubscriptions(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -296,7 +297,7 @@ func sweepEventSubscriptions(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping RDS Event Subscription sweep for %s: %s", region, err)
 		return nil
 	}
@@ -305,7 +306,7 @@ func sweepEventSubscriptions(region string) error {
 		return fmt.Errorf("error listing RDS Event Subscriptions (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping RDS Event Subscriptions (%s): %w", region, err)
@@ -316,7 +317,7 @@ func sweepEventSubscriptions(region string) error {
 
 func sweepGlobalClusters(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -342,7 +343,7 @@ func sweepGlobalClusters(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping RDS Global Cluster sweep for %s: %s", region, err)
 		return nil
 	}
@@ -351,7 +352,7 @@ func sweepGlobalClusters(region string) error {
 		return fmt.Errorf("error listing RDS Global Clusters (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping RDS Global Clusters (%s): %w", region, err)
@@ -362,7 +363,7 @@ func sweepGlobalClusters(region string) error {
 
 func sweepInstances(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -391,7 +392,7 @@ func sweepInstances(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping RDS DB Instance sweep for %s: %s", region, err)
 		return nil
 	}
@@ -400,7 +401,7 @@ func sweepInstances(region string) error {
 		return fmt.Errorf("error listing RDS DB Instances (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping RDS DB Instances (%s): %w", region, err)
@@ -411,7 +412,7 @@ func sweepInstances(region string) error {
 
 func sweepOptionGroups(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -441,7 +442,7 @@ func sweepOptionGroups(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping RDS Option Group sweep for %s: %s", region, err)
 		return nil
 	}
@@ -450,7 +451,7 @@ func sweepOptionGroups(region string) error {
 		return fmt.Errorf("error listing RDS Option Groups (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping RDS Option Groups (%s): %w", region, err)
@@ -461,7 +462,7 @@ func sweepOptionGroups(region string) error {
 
 func sweepParameterGroups(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -491,7 +492,7 @@ func sweepParameterGroups(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping RDS DB Parameter Group sweep for %s: %s", region, err)
 		return nil
 	}
@@ -500,7 +501,7 @@ func sweepParameterGroups(region string) error {
 		return fmt.Errorf("error listing RDS DB Parameter Groups (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping RDS DB Parameter Groups (%s): %w", region, err)
@@ -511,7 +512,7 @@ func sweepParameterGroups(region string) error {
 
 func sweepProxies(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("Error getting client: %s", err)
 	}
@@ -535,7 +536,7 @@ func sweepProxies(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping RDS DB Proxy sweep for %s: %s", region, err)
 		return nil
 	}
@@ -544,7 +545,7 @@ func sweepProxies(region string) error {
 		return fmt.Errorf("error listing RDS DB Proxies (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping RDS DB Proxies (%s): %w", region, err)
@@ -555,7 +556,7 @@ func sweepProxies(region string) error {
 
 func sweepSnapshots(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -585,7 +586,7 @@ func sweepSnapshots(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping RDS DB Snapshot sweep for %s: %s", region, err)
 		return nil
 	}
@@ -594,7 +595,7 @@ func sweepSnapshots(region string) error {
 		return fmt.Errorf("error listing RDS DB Snapshots (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping RDS DB Snapshots (%s): %w", region, err)
@@ -605,7 +606,7 @@ func sweepSnapshots(region string) error {
 
 func sweepSubnetGroups(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -629,7 +630,7 @@ func sweepSubnetGroups(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping RDS DB Subnet Group sweep for %s: %s", region, err)
 		return nil
 	}
@@ -638,7 +639,7 @@ func sweepSubnetGroups(region string) error {
 		return fmt.Errorf("error listing RDS DB Subnet Groups (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping RDS DB Subnet Groups (%s): %w", region, err)
@@ -649,7 +650,7 @@ func sweepSubnetGroups(region string) error {
 
 func sweepInstanceAutomatedBackups(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -677,7 +678,7 @@ func sweepInstanceAutomatedBackups(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping RDS Instance Automated Backup sweep for %s: %s", region, err)
 		return nil
 	}
@@ -686,7 +687,7 @@ func sweepInstanceAutomatedBackups(region string) error {
 		return fmt.Errorf("error listing RDS Instance Automated Backups (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping RDS Instance Automated Backups (%s): %w", region, err)
diff --git a/internal/service/rds/tags_gen.go b/internal/service/rds/tags_gen.go
index 2ba6542fe2c..47bbb08841e 100644
--- a/internal/service/rds/tags_gen.go
+++ b/internal/service/rds/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/rds"
 	"github.com/aws/aws-sdk-go/service/rds/rdsiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -102,6 +104,8 @@ func updateTags(ctx context.Context, conn rdsiface.RDSAPI, identifier string, ol
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.RDS)
 	if len(removedTags) > 0 {
diff --git a/internal/service/rds/test-fixtures/custom-oracle-manifest.json b/internal/service/rds/test-fixtures/custom-oracle-manifest.json
new file mode 100644
index 00000000000..bcc3d88a69d
--- /dev/null
+++ b/internal/service/rds/test-fixtures/custom-oracle-manifest.json
@@ -0,0 +1,6 @@
+{
+    "mediaImportTemplateVersion":"2020-08-14",
+    "databaseInstallationFileNames":[
+        "V982063-01.zip"
+    ]
+}
\ No newline at end of file
diff --git a/internal/service/rds/validate.go b/internal/service/rds/validate.go
index 9b06b8985a6..1647dc456f3 100644
--- a/internal/service/rds/validate.go
+++ b/internal/service/rds/validate.go
@@ -1,16 +1,17 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rds
 
 import (
 	"fmt"
-	"regexp"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
+	"github.com/YakDriver/regexache"
 )
 
 func validEventSubscriptionName(v interface{}, k string) (ws []string, errors []error) {
 	value := v.(string)
-	if !regexp.MustCompile(`^[0-9A-Za-z-]+$`).MatchString(value) {
+	if !regexache.MustCompile(`^[0-9A-Za-z-]+$`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"only alphanumeric characters and hyphens allowed in %q", k))
 	}
@@ -23,19 +24,19 @@ func validEventSubscriptionName(v interface{}, k string) (ws []string, errors []
 
 func validOptionGroupName(v interface{}, k string) (ws []string, errors []error) {
 	value := v.(string)
-	if !regexp.MustCompile(`^[a-z]`).MatchString(value) {
+	if !regexache.MustCompile(`^[a-z]`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"first character of %q must be a letter", k))
 	}
-	if !regexp.MustCompile(`^[0-9a-z-]+$`).MatchString(value) {
+	if !regexache.MustCompile(`^[0-9a-z-]+$`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"only lowercase alphanumeric characters and hyphens allowed in %q", k))
 	}
-	if regexp.MustCompile(`--`).MatchString(value) {
+	if regexache.MustCompile(`--`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"%q cannot contain two consecutive hyphens", k))
 	}
-	if regexp.MustCompile(`-$`).MatchString(value) {
+	if regexache.MustCompile(`-$`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"%q cannot end with a hyphen", k))
 	}
@@ -48,15 +49,15 @@ func validOptionGroupName(v interface{}, k string) (ws []string, errors []error)
 
 func validOptionGroupNamePrefix(v interface{}, k string) (ws []string, errors []error) {
 	value := v.(string)
-	if !regexp.MustCompile(`^[a-z]`).MatchString(value) {
+	if !regexache.MustCompile(`^[a-z]`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"first character of %q must be a letter", k))
 	}
-	if !regexp.MustCompile(`^[0-9a-z-]+$`).MatchString(value) {
+	if !regexache.MustCompile(`^[0-9a-z-]+$`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"only alphanumeric characters and hyphens allowed in %q", k))
 	}
-	if regexp.MustCompile(`--`).MatchString(value) {
+	if regexache.MustCompile(`--`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"%q cannot contain two consecutive hyphens", k))
 	}
@@ -69,19 +70,19 @@ func validOptionGroupNamePrefix(v interface{}, k string) (ws []string, errors []
 
 func validParamGroupName(v interface{}, k string) (ws []string, errors []error) {
 	value := v.(string)
-	if !regexp.MustCompile(`^[0-9a-z-]+$`).MatchString(value) {
+	if !regexache.MustCompile(`^[0-9a-z.-]+$`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
-			"only lowercase alphanumeric characters and hyphens allowed in parameter group %q", k))
+			"only lowercase alphanumeric characters, periods, and hyphens allowed in parameter group %q", k))
 	}
-	if !regexp.MustCompile(`^[a-z]`).MatchString(value) {
+	if !regexache.MustCompile(`^[a-z]`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"first character of parameter group %q must be a letter", k))
 	}
-	if regexp.MustCompile(`--`).MatchString(value) {
+	if regexache.MustCompile(`--`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"parameter group %q cannot contain two consecutive hyphens", k))
 	}
-	if regexp.MustCompile(`-$`).MatchString(value) {
+	if regexache.MustCompile(`-$`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"parameter group %q cannot end with a hyphen", k))
 	}
@@ -94,15 +95,15 @@ func validParamGroupName(v interface{}, k string) (ws []string, errors []error)
 
 func validParamGroupNamePrefix(v interface{}, k string) (ws []string, errors []error) {
 	value := v.(string)
-	if !regexp.MustCompile(`^[0-9a-z-]+$`).MatchString(value) {
+	if !regexache.MustCompile(`^[0-9a-z-]+$`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"only lowercase alphanumeric characters and hyphens allowed in parameter group %q", k))
 	}
-	if !regexp.MustCompile(`^[a-z]`).MatchString(value) {
+	if !regexache.MustCompile(`^[a-z]`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"first character of parameter group %q must be a letter", k))
 	}
-	if regexp.MustCompile(`--`).MatchString(value) {
+	if regexache.MustCompile(`--`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"parameter group %q cannot contain two consecutive hyphens", k))
 	}
@@ -115,7 +116,7 @@ func validParamGroupNamePrefix(v interface{}, k string) (ws []string, errors []e
 
 func validSubnetGroupName(v interface{}, k string) (ws []string, errors []error) {
 	value := v.(string)
-	if !regexp.MustCompile(`^[ .0-9a-z-_]+$`).MatchString(value) {
+	if !regexache.MustCompile(`^[0-9a-z_ .-]+$`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"only lowercase alphanumeric characters, hyphens, underscores, periods, and spaces allowed in %q", k))
 	}
@@ -123,7 +124,7 @@ func validSubnetGroupName(v interface{}, k string) (ws []string, errors []error)
 		errors = append(errors, fmt.Errorf(
 			"%q cannot be longer than 255 characters", k))
 	}
-	if regexp.MustCompile(`(?i)^default$`).MatchString(value) {
+	if regexache.MustCompile(`(?i)^default$`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"%q is not allowed as %q", "Default", k))
 	}
@@ -132,7 +133,7 @@ func validSubnetGroupName(v interface{}, k string) (ws []string, errors []error)
 
 func validSubnetGroupNamePrefix(v interface{}, k string) (ws []string, errors []error) {
 	value := v.(string)
-	if !regexp.MustCompile(`^[ .0-9a-z-_]+$`).MatchString(value) {
+	if !regexache.MustCompile(`^[0-9a-z_ .-]+$`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"only lowercase alphanumeric characters, hyphens, underscores, periods, and spaces allowed in %q", k))
 	}
@@ -143,25 +144,21 @@ func validSubnetGroupNamePrefix(v interface{}, k string) (ws []string, errors []
 	return
 }
 
-func validClusterEngine() schema.SchemaValidateFunc {
-	return validation.StringInSlice(ClusterEngine_Values(), false)
-}
-
 func validIdentifier(v interface{}, k string) (ws []string, errors []error) {
 	value := v.(string)
-	if !regexp.MustCompile(`^[0-9a-z-]+$`).MatchString(value) {
+	if !regexache.MustCompile(`^[0-9a-z-]+$`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"only lowercase alphanumeric characters and hyphens allowed in %q", k))
 	}
-	if !regexp.MustCompile(`^[a-z]`).MatchString(value) {
+	if !regexache.MustCompile(`^[a-z]`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"first character of %q must be a letter", k))
 	}
-	if regexp.MustCompile(`--`).MatchString(value) {
+	if regexache.MustCompile(`--`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"%q cannot contain two consecutive hyphens", k))
 	}
-	if regexp.MustCompile(`-$`).MatchString(value) {
+	if regexache.MustCompile(`-$`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"%q cannot end with a hyphen", k))
 	}
@@ -170,15 +167,15 @@ func validIdentifier(v interface{}, k string) (ws []string, errors []error) {
 
 func validIdentifierPrefix(v interface{}, k string) (ws []string, errors []error) {
 	value := v.(string)
-	if !regexp.MustCompile(`^[0-9a-z-]+$`).MatchString(value) {
+	if !regexache.MustCompile(`^[0-9a-z-]+$`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"only lowercase alphanumeric characters and hyphens allowed in %q", k))
 	}
-	if !regexp.MustCompile(`^[a-z]`).MatchString(value) {
+	if !regexache.MustCompile(`^[a-z]`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"first character of %q must be a letter", k))
 	}
-	if regexp.MustCompile(`--`).MatchString(value) {
+	if regexache.MustCompile(`--`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"%q cannot contain two consecutive hyphens", k))
 	}
diff --git a/internal/service/rds/validate_test.go b/internal/service/rds/validate_test.go
index 5ad3638842a..c02eee2c064 100644
--- a/internal/service/rds/validate_test.go
+++ b/internal/service/rds/validate_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rds
 
 import (
@@ -121,6 +124,10 @@ func TestValidParamGroupName(t *testing.T) {
 		Value    string
 		ErrCount int
 	}{
+		{
+			Value:    "default.postgres9.6",
+			ErrCount: 0,
+		},
 		{
 			Value:    "tEsting123",
 			ErrCount: 1,
diff --git a/internal/service/rds/verify.go b/internal/service/rds/verify.go
index e98f2dbc296..999ddb8fe24 100644
--- a/internal/service/rds/verify.go
+++ b/internal/service/rds/verify.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rds
 
 import (
diff --git a/internal/service/rds/wait.go b/internal/service/rds/wait.go
index 7d4117ee908..77c36a77444 100644
--- a/internal/service/rds/wait.go
+++ b/internal/service/rds/wait.go
@@ -1,8 +1,10 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rds
 
 import (
 	"context"
-	"strconv"
 	"time"
 
 	"github.com/aws/aws-sdk-go/service/rds"
@@ -234,42 +236,6 @@ func waitDBClusterInstanceDeleted(ctx context.Context, conn *rds.RDS, id string,
 	return nil, err
 }
 
-func waitDBInstanceAutomatedBackupCreated(ctx context.Context, conn *rds.RDS, arn string, timeout time.Duration) (*rds.DBInstanceAutomatedBackup, error) {
-	stateConf := &retry.StateChangeConf{
-		Pending: []string{InstanceAutomatedBackupStatusPending},
-		Target:  []string{InstanceAutomatedBackupStatusReplicating},
-		Refresh: statusDBInstanceAutomatedBackup(ctx, conn, arn),
-		Timeout: timeout,
-	}
-
-	outputRaw, err := stateConf.WaitForStateContext(ctx)
-
-	if output, ok := outputRaw.(*rds.DBInstanceAutomatedBackup); ok {
-		return output, err
-	}
-
-	return nil, err
-}
-
-// waitDBInstanceAutomatedBackupDeleted waits for a specified automated backup to be deleted from a database instance.
-// The connection must be valid for the database instance's Region.
-func waitDBInstanceAutomatedBackupDeleted(ctx context.Context, conn *rds.RDS, dbInstanceID, dbInstanceAutomatedBackupsARN string, timeout time.Duration) (*rds.DBInstance, error) {
-	stateConf := &retry.StateChangeConf{
-		Pending: []string{strconv.FormatBool(true)},
-		Target:  []string{strconv.FormatBool(false)},
-		Refresh: statusDBInstanceHasAutomatedBackup(ctx, conn, dbInstanceID, dbInstanceAutomatedBackupsARN),
-		Timeout: timeout,
-	}
-
-	outputRaw, err := stateConf.WaitForStateContext(ctx)
-
-	if output, ok := outputRaw.(*rds.DBInstance); ok {
-		return output, err
-	}
-
-	return nil, err
-}
-
 func waitDBProxyCreated(ctx context.Context, conn *rds.RDS, name string, timeout time.Duration) (*rds.DBProxy, error) {
 	stateConf := &retry.StateChangeConf{
 		Pending: []string{rds.DBProxyStatusCreating},
diff --git a/internal/service/redshift/authentication_profile.go b/internal/service/redshift/authentication_profile.go
index 0ed460955db..cf7a8571887 100644
--- a/internal/service/redshift/authentication_profile.go
+++ b/internal/service/redshift/authentication_profile.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package redshift
 
 import (
diff --git a/internal/service/redshift/authentication_profile_test.go b/internal/service/redshift/authentication_profile_test.go
index 309ed656c10..bd72785b8b8 100644
--- a/internal/service/redshift/authentication_profile_test.go
+++ b/internal/service/redshift/authentication_profile_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package redshift_test
 
 import (
diff --git a/internal/service/redshift/cluster.go b/internal/service/redshift/cluster.go
index 8be8a098468..bad4d2fbb6b 100644
--- a/internal/service/redshift/cluster.go
+++ b/internal/service/redshift/cluster.go
@@ -1,13 +1,16 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package redshift
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"strings"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/aws/aws-sdk-go/service/redshift"
@@ -88,10 +91,10 @@ func ResourceCluster() *schema.Resource {
 				Required: true,
 				ForceNew: true,
 				ValidateFunc: validation.All(
-					validation.StringMatch(regexp.MustCompile(`^[0-9a-z-]+$`), "must contain only lowercase alphanumeric characters and hyphens"),
-					validation.StringMatch(regexp.MustCompile(`(?i)^[a-z]`), "first character must be a letter"),
-					validation.StringDoesNotMatch(regexp.MustCompile(`--`), "cannot contain two consecutive hyphens"),
-					validation.StringDoesNotMatch(regexp.MustCompile(`-$`), "cannot end with a hyphen"),
+					validation.StringMatch(regexache.MustCompile(`^[0-9a-z-]+$`), "must contain only lowercase alphanumeric characters and hyphens"),
+					validation.StringMatch(regexache.MustCompile(`(?i)^[a-z]`), "first character must be a letter"),
+					validation.StringDoesNotMatch(regexache.MustCompile(`--`), "cannot contain two consecutive hyphens"),
+					validation.StringDoesNotMatch(regexache.MustCompile(`-$`), "cannot end with a hyphen"),
 				),
 			},
 			"cluster_namespace_arn": {
@@ -155,8 +158,8 @@ func ResourceCluster() *schema.Resource {
 				Computed: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 64),
-					validation.StringMatch(regexp.MustCompile(`^[0-9a-z_$]+$`), "must contain only lowercase alphanumeric characters, underscores, and dollar signs"),
-					validation.StringMatch(regexp.MustCompile(`(?i)^[a-z_]`), "first character must be a letter or underscore"),
+					validation.StringMatch(regexache.MustCompile(`^[0-9a-z_$]+$`), "must contain only lowercase alphanumeric characters, underscores, and dollar signs"),
+					validation.StringMatch(regexache.MustCompile(`(?i)^[a-z_]`), "first character must be a letter or underscore"),
 				),
 			},
 			"default_iam_role_arn": {
@@ -193,9 +196,9 @@ func ResourceCluster() *schema.Resource {
 				Optional: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 255),
-					validation.StringMatch(regexp.MustCompile(`^[0-9A-Za-z-]+$`), "must only contain alphanumeric characters and hyphens"),
-					validation.StringDoesNotMatch(regexp.MustCompile(`--`), "cannot contain two consecutive hyphens"),
-					validation.StringDoesNotMatch(regexp.MustCompile(`-$`), "cannot end in a hyphen"),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z-]+$`), "must only contain alphanumeric characters and hyphens"),
+					validation.StringDoesNotMatch(regexache.MustCompile(`--`), "cannot contain two consecutive hyphens"),
+					validation.StringDoesNotMatch(regexache.MustCompile(`-$`), "cannot end in a hyphen"),
 				),
 			},
 			"iam_roles": {
@@ -264,10 +267,10 @@ func ResourceCluster() *schema.Resource {
 				Sensitive: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(8, 64),
-					validation.StringMatch(regexp.MustCompile(`^.*[a-z].*`), "must contain at least one lowercase letter"),
-					validation.StringMatch(regexp.MustCompile(`^.*[A-Z].*`), "must contain at least one uppercase letter"),
-					validation.StringMatch(regexp.MustCompile(`^.*[0-9].*`), "must contain at least one number"),
-					validation.StringMatch(regexp.MustCompile(`^[^\@\/'" ]*$`), "cannot contain [/@\"' ]"),
+					validation.StringMatch(regexache.MustCompile(`^.*[a-z].*`), "must contain at least one lowercase letter"),
+					validation.StringMatch(regexache.MustCompile(`^.*[A-Z].*`), "must contain at least one uppercase letter"),
+					validation.StringMatch(regexache.MustCompile(`^.*[0-9].*`), "must contain at least one number"),
+					validation.StringMatch(regexache.MustCompile(`^[^\@\/'" ]*$`), "cannot contain [/@\"' ]"),
 				),
 			},
 			"master_username": {
@@ -276,8 +279,8 @@ func ResourceCluster() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 128),
-					validation.StringMatch(regexp.MustCompile(`^\w+$`), "must contain only alphanumeric characters"),
-					validation.StringMatch(regexp.MustCompile(`(?i)^[a-z_]`), "first character must be a letter"),
+					validation.StringMatch(regexache.MustCompile(`^\w+$`), "must contain only alphanumeric characters"),
+					validation.StringMatch(regexache.MustCompile(`(?i)^[a-z_]`), "first character must be a letter"),
 				),
 			},
 			"node_type": {
diff --git a/internal/service/redshift/cluster_credentials_data_source.go b/internal/service/redshift/cluster_credentials_data_source.go
index eebbb6d3709..ce76d682d77 100644
--- a/internal/service/redshift/cluster_credentials_data_source.go
+++ b/internal/service/redshift/cluster_credentials_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package redshift
 
 import (
diff --git a/internal/service/redshift/cluster_credentials_data_source_test.go b/internal/service/redshift/cluster_credentials_data_source_test.go
index 03ab6ace148..a777e33428b 100644
--- a/internal/service/redshift/cluster_credentials_data_source_test.go
+++ b/internal/service/redshift/cluster_credentials_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package redshift_test
 
 import (
diff --git a/internal/service/redshift/cluster_data_source.go b/internal/service/redshift/cluster_data_source.go
index 0a2eb41914d..eac3eabc2fb 100644
--- a/internal/service/redshift/cluster_data_source.go
+++ b/internal/service/redshift/cluster_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package redshift
 
 import (
diff --git a/internal/service/redshift/cluster_data_source_test.go b/internal/service/redshift/cluster_data_source_test.go
index 17e0f1cc26f..7eb7f2fe314 100644
--- a/internal/service/redshift/cluster_data_source_test.go
+++ b/internal/service/redshift/cluster_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package redshift_test
 
 import (
diff --git a/internal/service/redshift/cluster_iam_roles.go b/internal/service/redshift/cluster_iam_roles.go
index d2ef488119b..1520ce7dc14 100644
--- a/internal/service/redshift/cluster_iam_roles.go
+++ b/internal/service/redshift/cluster_iam_roles.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package redshift
 
 import (
diff --git a/internal/service/redshift/cluster_iam_roles_test.go b/internal/service/redshift/cluster_iam_roles_test.go
index f61e1a84937..dcee896466b 100644
--- a/internal/service/redshift/cluster_iam_roles_test.go
+++ b/internal/service/redshift/cluster_iam_roles_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package redshift_test
 
 import (
diff --git a/internal/service/redshift/cluster_snapshot.go b/internal/service/redshift/cluster_snapshot.go
index 31acc6331d1..80ae9099f30 100644
--- a/internal/service/redshift/cluster_snapshot.go
+++ b/internal/service/redshift/cluster_snapshot.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package redshift
 
 import (
diff --git a/internal/service/redshift/cluster_snapshot_test.go b/internal/service/redshift/cluster_snapshot_test.go
index 646f21cd090..723ca47aaf2 100644
--- a/internal/service/redshift/cluster_snapshot_test.go
+++ b/internal/service/redshift/cluster_snapshot_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package redshift_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/redshift"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -32,7 +35,7 @@ func TestAccRedshiftClusterSnapshot_basic(t *testing.T) {
 				Config: testAccClusterSnapshotConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckClusterSnapshotExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "redshift", regexp.MustCompile(`snapshot:.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "redshift", regexache.MustCompile(`snapshot:.+`)),
 					acctest.CheckResourceAttrAccountID(resourceName, "owner_account"),
 					resource.TestCheckResourceAttr(resourceName, "cluster_identifier", rName),
 					resource.TestCheckResourceAttr(resourceName, "snapshot_identifier", rName),
@@ -49,7 +52,7 @@ func TestAccRedshiftClusterSnapshot_basic(t *testing.T) {
 				Config: testAccClusterSnapshotConfig_retention(rName, 1),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckClusterSnapshotExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "redshift", regexp.MustCompile(`snapshot:.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "redshift", regexache.MustCompile(`snapshot:.+`)),
 					resource.TestCheckResourceAttr(resourceName, "cluster_identifier", rName),
 					resource.TestCheckResourceAttr(resourceName, "snapshot_identifier", rName),
 					resource.TestCheckResourceAttr(resourceName, "manual_snapshot_retention_period", "1"),
diff --git a/internal/service/redshift/cluster_test.go b/internal/service/redshift/cluster_test.go
index d4cf578aebc..c940de0b8e4 100644
--- a/internal/service/redshift/cluster_test.go
+++ b/internal/service/redshift/cluster_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package redshift_test
 
 import (
 	"context"
 	"errors"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/redshift"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -39,7 +42,7 @@ func TestAccRedshiftCluster_basic(t *testing.T) {
 					resource.TestCheckResourceAttrSet(resourceName, "cluster_nodes.0.public_ip_address"),
 					resource.TestCheckResourceAttr(resourceName, "cluster_type", "single-node"),
 					resource.TestCheckResourceAttr(resourceName, "publicly_accessible", "true"),
-					resource.TestMatchResourceAttr(resourceName, "dns_name", regexp.MustCompile(fmt.Sprintf("^%s.*\\.redshift\\..*", rName))),
+					resource.TestMatchResourceAttr(resourceName, "dns_name", regexache.MustCompile(fmt.Sprintf("^%s.*\\.redshift\\..*", rName))),
 					resource.TestCheckResourceAttr(resourceName, "availability_zone_relocation_enabled", "false"),
 					resource.TestCheckResourceAttr(resourceName, "aqua_configuration_status", "auto"),
 					resource.TestCheckResourceAttr(resourceName, "maintenance_track_name", "current"),
@@ -629,7 +632,7 @@ func TestAccRedshiftCluster_changeAvailabilityZone_availabilityZoneRelocationNot
 			},
 			{
 				Config:      testAccClusterConfig_updateAvailabilityZoneAvailabilityZoneRelocationNotSet(rName, 1),
-				ExpectError: regexp.MustCompile("cannot change `availability_zone` if `availability_zone_relocation_enabled` is not true"),
+				ExpectError: regexache.MustCompile("cannot change `availability_zone` if `availability_zone_relocation_enabled` is not true"),
 			},
 		},
 	})
diff --git a/internal/service/redshift/consts.go b/internal/service/redshift/consts.go
index df693a9908b..0b9c1cb7881 100644
--- a/internal/service/redshift/consts.go
+++ b/internal/service/redshift/consts.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package redshift
 
 import (
diff --git a/internal/service/redshift/endpoint_access.go b/internal/service/redshift/endpoint_access.go
index 8429ee1fd90..366ebfbe97a 100644
--- a/internal/service/redshift/endpoint_access.go
+++ b/internal/service/redshift/endpoint_access.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package redshift
 
 import (
 	"context"
 	"log"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/redshift"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -44,7 +47,7 @@ func ResourceEndpointAccess() *schema.Resource {
 				Required: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 30),
-					validation.StringMatch(regexp.MustCompile(`^[0-9a-z-]+$`), "must contain only lowercase alphanumeric characters and hyphens"),
+					validation.StringMatch(regexache.MustCompile(`^[0-9a-z-]+$`), "must contain only lowercase alphanumeric characters and hyphens"),
 				),
 			},
 			"port": {
diff --git a/internal/service/redshift/endpoint_access_test.go b/internal/service/redshift/endpoint_access_test.go
index 9b636ec46ff..699a0a5a03f 100644
--- a/internal/service/redshift/endpoint_access_test.go
+++ b/internal/service/redshift/endpoint_access_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package redshift_test
 
 import (
diff --git a/internal/service/redshift/endpoint_authorization.go b/internal/service/redshift/endpoint_authorization.go
index 62928a15f59..fd73b341628 100644
--- a/internal/service/redshift/endpoint_authorization.go
+++ b/internal/service/redshift/endpoint_authorization.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package redshift
 
 import (
diff --git a/internal/service/redshift/endpoint_authorization_test.go b/internal/service/redshift/endpoint_authorization_test.go
index acefadc5315..781e668c281 100644
--- a/internal/service/redshift/endpoint_authorization_test.go
+++ b/internal/service/redshift/endpoint_authorization_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package redshift_test
 
 import (
diff --git a/internal/service/redshift/errors.go b/internal/service/redshift/errors.go
index a2d64b807d1..97d9acb1e6b 100644
--- a/internal/service/redshift/errors.go
+++ b/internal/service/redshift/errors.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package redshift
 
 const (
diff --git a/internal/service/redshift/event_subscription.go b/internal/service/redshift/event_subscription.go
index c1c686c2957..fb8adeb4aaf 100644
--- a/internal/service/redshift/event_subscription.go
+++ b/internal/service/redshift/event_subscription.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package redshift
 
 import (
diff --git a/internal/service/redshift/event_subscription_test.go b/internal/service/redshift/event_subscription_test.go
index 6b55460492e..26e208bd6a2 100644
--- a/internal/service/redshift/event_subscription_test.go
+++ b/internal/service/redshift/event_subscription_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package redshift_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/redshift"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -32,7 +35,7 @@ func TestAccRedshiftEventSubscription_basic(t *testing.T) {
 				Config: testAccEventSubscriptionConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckEventSubscriptionExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "redshift", regexp.MustCompile(`eventsubscription:.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "redshift", regexache.MustCompile(`eventsubscription:.+`)),
 					resource.TestCheckResourceAttr(resourceName, "enabled", "true"),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "severity", "INFO"),
diff --git a/internal/service/redshift/find.go b/internal/service/redshift/find.go
index 5afd6a55509..6062cd53bc6 100644
--- a/internal/service/redshift/find.go
+++ b/internal/service/redshift/find.go
@@ -1,8 +1,10 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package redshift
 
 import (
 	"context"
-	"fmt"
 
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/redshift"
@@ -110,54 +112,6 @@ func FindScheduledActionByName(ctx context.Context, conn *redshift.Redshift, nam
 	return output.ScheduledActions[0], nil
 }
 
-func FindScheduleAssociationById(ctx context.Context, conn *redshift.Redshift, id string) (string, *redshift.ClusterAssociatedToSchedule, error) {
-	clusterIdentifier, scheduleIdentifier, err := SnapshotScheduleAssociationParseID(id)
-	if err != nil {
-		return "", nil, fmt.Errorf("parsing Redshift Cluster Snapshot Schedule Association ID %s: %s", id, err)
-	}
-
-	input := &redshift.DescribeSnapshotSchedulesInput{
-		ClusterIdentifier:  aws.String(clusterIdentifier),
-		ScheduleIdentifier: aws.String(scheduleIdentifier),
-	}
-	resp, err := conn.DescribeSnapshotSchedulesWithContext(ctx, input)
-
-	if tfawserr.ErrCodeEquals(err, redshift.ErrCodeSnapshotScheduleNotFoundFault) {
-		return "", nil, &retry.NotFoundError{
-			LastError:   err,
-			LastRequest: input,
-		}
-	}
-
-	if err != nil {
-		return "", nil, err
-	}
-
-	if resp.SnapshotSchedules == nil || len(resp.SnapshotSchedules) == 0 {
-		return "", nil, tfresource.NewEmptyResultError(input)
-	}
-
-	snapshotSchedule := resp.SnapshotSchedules[0]
-
-	if snapshotSchedule == nil {
-		return "", nil, tfresource.NewEmptyResultError(input)
-	}
-
-	var associatedCluster *redshift.ClusterAssociatedToSchedule
-	for _, cluster := range snapshotSchedule.AssociatedClusters {
-		if aws.StringValue(cluster.ClusterIdentifier) == clusterIdentifier {
-			associatedCluster = cluster
-			break
-		}
-	}
-
-	if associatedCluster == nil {
-		return "", nil, tfresource.NewEmptyResultError(input)
-	}
-
-	return aws.StringValue(snapshotSchedule.ScheduleIdentifier), associatedCluster, nil
-}
-
 func FindHSMClientCertificateByID(ctx context.Context, conn *redshift.Redshift, id string) (*redshift.HsmClientCertificate, error) {
 	input := redshift.DescribeHsmClientCertificatesInput{
 		HsmClientCertificateIdentifier: aws.String(id),
diff --git a/internal/service/redshift/flex.go b/internal/service/redshift/flex.go
index 0ee0347f974..10580842ecc 100644
--- a/internal/service/redshift/flex.go
+++ b/internal/service/redshift/flex.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package redshift
 
 import (
diff --git a/internal/service/redshift/generate.go b/internal/service/redshift/generate.go
index d6303e44efd..191198d019a 100644
--- a/internal/service/redshift/generate.go
+++ b/internal/service/redshift/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTagsOp=DescribeTags -ListTagsInIDElem=ResourceName -ServiceTagsSlice -TagOp=CreateTags -TagInIDElem=ResourceName -UntagOp=DeleteTags -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/redshift/hsm_client_certificate.go b/internal/service/redshift/hsm_client_certificate.go
index baadd04b902..773c73c9b6b 100644
--- a/internal/service/redshift/hsm_client_certificate.go
+++ b/internal/service/redshift/hsm_client_certificate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package redshift
 
 import (
diff --git a/internal/service/redshift/hsm_client_certificate_test.go b/internal/service/redshift/hsm_client_certificate_test.go
index 392b8513cb1..45abd142f93 100644
--- a/internal/service/redshift/hsm_client_certificate_test.go
+++ b/internal/service/redshift/hsm_client_certificate_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package redshift_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/redshift"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -31,7 +34,7 @@ func TestAccRedshiftHSMClientCertificate_basic(t *testing.T) {
 				Config: testAccHSMClientCertificateConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckHSMClientCertificateExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "redshift", regexp.MustCompile(`hsmclientcertificate:.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "redshift", regexache.MustCompile(`hsmclientcertificate:.+`)),
 					resource.TestCheckResourceAttr(resourceName, "hsm_client_certificate_identifier", rName),
 					resource.TestCheckResourceAttrSet(resourceName, "hsm_client_certificate_public_key"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
diff --git a/internal/service/redshift/hsm_configuration.go b/internal/service/redshift/hsm_configuration.go
index d7535d1180e..9b41cc86eea 100644
--- a/internal/service/redshift/hsm_configuration.go
+++ b/internal/service/redshift/hsm_configuration.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package redshift
 
 import (
diff --git a/internal/service/redshift/hsm_configuration_test.go b/internal/service/redshift/hsm_configuration_test.go
index 30cbbe5c79a..c849ebde6c8 100644
--- a/internal/service/redshift/hsm_configuration_test.go
+++ b/internal/service/redshift/hsm_configuration_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package redshift_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/redshift"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -31,7 +34,7 @@ func TestAccRedshiftHSMConfiguration_basic(t *testing.T) {
 				Config: testAccHSMConfigurationConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckHSMConfigurationExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "redshift", regexp.MustCompile(`hsmconfiguration:.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "redshift", regexache.MustCompile(`hsmconfiguration:.+`)),
 					resource.TestCheckResourceAttr(resourceName, "hsm_configuration_identifier", rName),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 				),
diff --git a/internal/service/redshift/orderable_cluster_data_source.go b/internal/service/redshift/orderable_cluster_data_source.go
index 430ade3e285..b915a9c0743 100644
--- a/internal/service/redshift/orderable_cluster_data_source.go
+++ b/internal/service/redshift/orderable_cluster_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package redshift
 
 import (
diff --git a/internal/service/redshift/orderable_cluster_data_source_test.go b/internal/service/redshift/orderable_cluster_data_source_test.go
index b626ee3658e..f78efc0c704 100644
--- a/internal/service/redshift/orderable_cluster_data_source_test.go
+++ b/internal/service/redshift/orderable_cluster_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package redshift_test
 
 import (
diff --git a/internal/service/redshift/parameter_group.go b/internal/service/redshift/parameter_group.go
index 66c05790bb8..2342217bae3 100644
--- a/internal/service/redshift/parameter_group.go
+++ b/internal/service/redshift/parameter_group.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package redshift
 
 import (
@@ -5,9 +8,9 @@ import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"strings"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/aws/aws-sdk-go/service/redshift"
@@ -60,10 +63,10 @@ func ResourceParameterGroup() *schema.Resource {
 				Required: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 255),
-					validation.StringMatch(regexp.MustCompile(`^[0-9a-z-]+$`), "must contain only lowercase alphanumeric characters and hyphens"),
-					validation.StringMatch(regexp.MustCompile(`(?i)^[a-z]`), "first character must be a letter"),
-					validation.StringDoesNotMatch(regexp.MustCompile(`--`), "cannot contain two consecutive hyphens"),
-					validation.StringDoesNotMatch(regexp.MustCompile(`-$`), "cannot end with a hyphen"),
+					validation.StringMatch(regexache.MustCompile(`^[0-9a-z-]+$`), "must contain only lowercase alphanumeric characters and hyphens"),
+					validation.StringMatch(regexache.MustCompile(`(?i)^[a-z]`), "first character must be a letter"),
+					validation.StringDoesNotMatch(regexache.MustCompile(`--`), "cannot contain two consecutive hyphens"),
+					validation.StringDoesNotMatch(regexache.MustCompile(`-$`), "cannot end with a hyphen"),
 				),
 			},
 			"parameter": {
diff --git a/internal/service/redshift/parameter_group_test.go b/internal/service/redshift/parameter_group_test.go
index 69be803e981..e6b62ca9f73 100644
--- a/internal/service/redshift/parameter_group_test.go
+++ b/internal/service/redshift/parameter_group_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package redshift_test
 
 import (
diff --git a/internal/service/redshift/partner.go b/internal/service/redshift/partner.go
index a0cba315543..f77d075ce4a 100644
--- a/internal/service/redshift/partner.go
+++ b/internal/service/redshift/partner.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package redshift
 
 import (
diff --git a/internal/service/redshift/partner_test.go b/internal/service/redshift/partner_test.go
index eb508d5de26..a69151b330f 100644
--- a/internal/service/redshift/partner_test.go
+++ b/internal/service/redshift/partner_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package redshift_test
 
 import (
diff --git a/internal/service/redshift/scheduled_action.go b/internal/service/redshift/scheduled_action.go
index 29dd4db34fa..4da32b7ce16 100644
--- a/internal/service/redshift/scheduled_action.go
+++ b/internal/service/redshift/scheduled_action.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package redshift
 
 import (
 	"context"
 	"log"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/redshift"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -52,7 +55,7 @@ func ResourceScheduledAction() *schema.Resource {
 				Type:         schema.TypeString,
 				Required:     true,
 				ForceNew:     true,
-				ValidateFunc: validation.StringMatch(regexp.MustCompile(`^[a-z0-9-]{1,63}$`), ""),
+				ValidateFunc: validation.StringMatch(regexache.MustCompile(`^[0-9a-z-]{1,63}$`), ""),
 			},
 			"schedule": {
 				Type:     schema.TypeString,
diff --git a/internal/service/redshift/scheduled_action_test.go b/internal/service/redshift/scheduled_action_test.go
index a2c237454aa..9d231730c86 100644
--- a/internal/service/redshift/scheduled_action_test.go
+++ b/internal/service/redshift/scheduled_action_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package redshift_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/redshift"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -485,7 +488,7 @@ resource "aws_redshift_scheduled_action" "test" {
 func TestAccRedshiftScheduledAction_validScheduleName(t *testing.T) {
 	t.Parallel()
 
-	var f = validation.StringMatch(regexp.MustCompile(`^[a-z0-9-]{1,63}$`), "")
+	var f = validation.StringMatch(regexache.MustCompile(`^[0-9a-z-]{1,63}$`), "")
 
 	validIds := []string{
 		"tf-test-schedule-action-1",
diff --git a/internal/service/redshift/service_account_data_source.go b/internal/service/redshift/service_account_data_source.go
index 28cc354fbf0..0e346ab7820 100644
--- a/internal/service/redshift/service_account_data_source.go
+++ b/internal/service/redshift/service_account_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package redshift
 
 import (
diff --git a/internal/service/redshift/service_package_gen.go b/internal/service/redshift/service_package_gen.go
index 0bdb811f775..f19d90cd576 100644
--- a/internal/service/redshift/service_package_gen.go
+++ b/internal/service/redshift/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	redshift_sdkv1 "github.com/aws/aws-sdk-go/service/redshift"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -171,4 +172,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*r
 	return redshift_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/redshift/snapshot_copy_grant.go b/internal/service/redshift/snapshot_copy_grant.go
index 12b36620f1a..7a865417f66 100644
--- a/internal/service/redshift/snapshot_copy_grant.go
+++ b/internal/service/redshift/snapshot_copy_grant.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package redshift
 
 import (
@@ -39,17 +42,17 @@ func ResourceSnapshotCopyGrant() *schema.Resource {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
-			"snapshot_copy_grant_name": {
-				Type:     schema.TypeString,
-				Required: true,
-				ForceNew: true,
-			},
 			"kms_key_id": {
 				Type:     schema.TypeString,
 				Optional: true,
 				ForceNew: true,
 				Computed: true,
 			},
+			"snapshot_copy_grant_name": {
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
 			names.AttrTags:    tftags.TagsSchema(),
 			names.AttrTagsAll: tftags.TagsSchemaComputed(),
 		},
@@ -62,10 +65,9 @@ func resourceSnapshotCopyGrantCreate(ctx context.Context, d *schema.ResourceData
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).RedshiftConn(ctx)
 
-	grantName := d.Get("snapshot_copy_grant_name").(string)
-
-	input := redshift.CreateSnapshotCopyGrantInput{
-		SnapshotCopyGrantName: aws.String(grantName),
+	name := d.Get("snapshot_copy_grant_name").(string)
+	input := &redshift.CreateSnapshotCopyGrantInput{
+		SnapshotCopyGrantName: aws.String(name),
 		Tags:                  getTagsIn(ctx),
 	}
 
@@ -73,25 +75,20 @@ func resourceSnapshotCopyGrantCreate(ctx context.Context, d *schema.ResourceData
 		input.KmsKeyId = aws.String(v.(string))
 	}
 
-	log.Printf("[DEBUG]: Adding new Redshift SnapshotCopyGrant: %s", input)
-
-	var out *redshift.CreateSnapshotCopyGrantOutput
-	var err error
-
-	out, err = conn.CreateSnapshotCopyGrantWithContext(ctx, &input)
+	_, err := conn.CreateSnapshotCopyGrantWithContext(ctx, input)
 
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "creating Redshift Snapshot Copy Grant (%s): %s", grantName, err)
+		return sdkdiag.AppendErrorf(diags, "creating Redshift Snapshot Copy Grant (%s): %s", name, err)
 	}
 
-	log.Printf("[DEBUG] Created new Redshift SnapshotCopyGrant: %s", *out.SnapshotCopyGrant.SnapshotCopyGrantName)
-	d.SetId(grantName)
+	d.SetId(name)
 
 	_, err = tfresource.RetryWhenNotFound(ctx, 3*time.Minute, func() (any, error) {
-		return findSnapshotCopyGrant(ctx, conn, grantName)
+		return FindSnapshotCopyGrantByName(ctx, conn, d.Id())
 	})
+
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "creating Redshift Snapshot Copy Grant (%s): waiting for completion: %s", grantName, err)
+		return sdkdiag.AppendErrorf(diags, "waiting for Redshift Snapshot Copy Grant (%s) create: %s", d.Id(), err)
 	}
 
 	return append(diags, resourceSnapshotCopyGrantRead(ctx, d, meta)...)
@@ -101,16 +98,16 @@ func resourceSnapshotCopyGrantRead(ctx context.Context, d *schema.ResourceData,
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).RedshiftConn(ctx)
 
-	grantName := d.Id()
+	grant, err := FindSnapshotCopyGrantByName(ctx, conn, d.Id())
 
-	grant, err := findSnapshotCopyGrant(ctx, conn, grantName)
 	if !d.IsNewResource() && tfresource.NotFound(err) {
-		log.Printf("[WARN] Redshift Snapshot Copy Grant (%s) not found, removing from state", grantName)
+		log.Printf("[WARN] Redshift Snapshot Copy Grant (%s) not found, removing from state", d.Id())
 		d.SetId("")
 		return diags
 	}
+
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "reading Redshift Snapshot Copy Grant (%s): %s", grantName, err)
+		return sdkdiag.AppendErrorf(diags, "reading Redshift Snapshot Copy Grant (%s): %s", d.Id(), err)
 	}
 
 	arn := arn.ARN{
@@ -118,11 +115,9 @@ func resourceSnapshotCopyGrantRead(ctx context.Context, d *schema.ResourceData,
 		Service:   "redshift",
 		Region:    meta.(*conns.AWSClient).Region,
 		AccountID: meta.(*conns.AWSClient).AccountID,
-		Resource:  fmt.Sprintf("snapshotcopygrant:%s", grantName),
+		Resource:  fmt.Sprintf("snapshotcopygrant:%s", d.Id()),
 	}.String()
-
 	d.Set("arn", arn)
-
 	d.Set("kms_key_id", grant.KmsKeyId)
 	d.Set("snapshot_copy_grant_name", grant.SnapshotCopyGrantName)
 
@@ -143,43 +138,36 @@ func resourceSnapshotCopyGrantDelete(ctx context.Context, d *schema.ResourceData
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).RedshiftConn(ctx)
 
-	grantName := d.Id()
+	log.Printf("[DEBUG] Deleting Redshift Snapshot Copy Grant: %s", d.Id())
+	_, err := conn.DeleteSnapshotCopyGrantWithContext(ctx, &redshift.DeleteSnapshotCopyGrantInput{
+		SnapshotCopyGrantName: aws.String(d.Id()),
+	})
 
-	deleteInput := redshift.DeleteSnapshotCopyGrantInput{
-		SnapshotCopyGrantName: aws.String(grantName),
+	if tfawserr.ErrCodeEquals(err, redshift.ErrCodeSnapshotCopyGrantNotFoundFault) {
+		return diags
 	}
 
-	log.Printf("[DEBUG] Deleting snapshot copy grant: %s", grantName)
-	_, err := conn.DeleteSnapshotCopyGrantWithContext(ctx, &deleteInput)
-
 	if err != nil {
-		if tfawserr.ErrCodeEquals(err, redshift.ErrCodeSnapshotCopyGrantNotFoundFault) {
-			return diags
-		}
 		return sdkdiag.AppendErrorf(diags, "deleting Redshift Snapshot Copy Grant (%s): %s", d.Id(), err)
 	}
 
-	if err := WaitForSnapshotCopyGrantToBeDeleted(ctx, conn, grantName); err != nil {
-		return sdkdiag.AppendErrorf(diags, "deleting Redshift Snapshot Copy Grant (%s): waiting for completion: %s", d.Id(), err)
+	_, err = tfresource.RetryUntilNotFound(ctx, 3*time.Minute, func() (any, error) {
+		return FindSnapshotCopyGrantByName(ctx, conn, d.Id())
+	})
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "waiting for Redshift Snapshot Copy Grant (%s) delete: %s", d.Id(), err)
 	}
 
 	return diags
 }
 
-// Used by the tests as well
-func WaitForSnapshotCopyGrantToBeDeleted(ctx context.Context, conn *redshift.Redshift, grantName string) error {
-	_, err := tfresource.RetryUntilNotFound(ctx, 3*time.Minute, func() (any, error) {
-		return findSnapshotCopyGrant(ctx, conn, grantName)
-	})
-	return err
-}
-
-func findSnapshotCopyGrant(ctx context.Context, conn *redshift.Redshift, grantName string) (*redshift.SnapshotCopyGrant, error) {
-	input := redshift.DescribeSnapshotCopyGrantsInput{
-		SnapshotCopyGrantName: aws.String(grantName),
+func FindSnapshotCopyGrantByName(ctx context.Context, conn *redshift.Redshift, name string) (*redshift.SnapshotCopyGrant, error) {
+	input := &redshift.DescribeSnapshotCopyGrantsInput{
+		SnapshotCopyGrantName: aws.String(name),
 	}
 
-	out, err := conn.DescribeSnapshotCopyGrantsWithContext(ctx, &input)
+	output, err := conn.DescribeSnapshotCopyGrantsWithContext(ctx, input)
 
 	if tfawserr.ErrCodeEquals(err, redshift.ErrCodeSnapshotCopyGrantNotFoundFault) {
 		return nil, &retry.NotFoundError{
@@ -188,12 +176,13 @@ func findSnapshotCopyGrant(ctx context.Context, conn *redshift.Redshift, grantNa
 		}
 	}
 
-	if out == nil || len(out.SnapshotCopyGrants) == 0 {
-		return nil, tfresource.NewEmptyResultError(input)
+	if err != nil {
+		return nil, err
 	}
-	if l := len(out.SnapshotCopyGrants); l > 1 {
-		return nil, tfresource.NewTooManyResultsError(1, nil)
+
+	if output == nil {
+		return nil, tfresource.NewEmptyResultError(input)
 	}
 
-	return out.SnapshotCopyGrants[0], nil
+	return tfresource.AssertSinglePtrResult(output.SnapshotCopyGrants)
 }
diff --git a/internal/service/redshift/snapshot_copy_grant_test.go b/internal/service/redshift/snapshot_copy_grant_test.go
index 5e6d50fb397..c904483ffd5 100644
--- a/internal/service/redshift/snapshot_copy_grant_test.go
+++ b/internal/service/redshift/snapshot_copy_grant_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package redshift_test
 
 import (
@@ -5,7 +8,6 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/redshift"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -13,6 +15,7 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	tfredshift "github.com/hashicorp/terraform-provider-aws/internal/service/redshift"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
 func TestAccRedshiftSnapshotCopyGrant_basic(t *testing.T) {
@@ -30,9 +33,9 @@ func TestAccRedshiftSnapshotCopyGrant_basic(t *testing.T) {
 				Config: testAccSnapshotCopyGrantConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckSnapshotCopyGrantExists(ctx, resourceName),
+					resource.TestCheckResourceAttrSet(resourceName, "kms_key_id"),
 					resource.TestCheckResourceAttr(resourceName, "snapshot_copy_grant_name", rName),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
-					resource.TestCheckResourceAttrSet(resourceName, "kms_key_id"),
 				),
 			},
 			{
@@ -44,7 +47,7 @@ func TestAccRedshiftSnapshotCopyGrant_basic(t *testing.T) {
 	})
 }
 
-func TestAccRedshiftSnapshotCopyGrant_update(t *testing.T) {
+func TestAccRedshiftSnapshotCopyGrant_disappears(t *testing.T) {
 	ctx := acctest.Context(t)
 	resourceName := "aws_redshift_snapshot_copy_grant.test"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
@@ -55,41 +58,19 @@ func TestAccRedshiftSnapshotCopyGrant_update(t *testing.T) {
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckSnapshotCopyGrantDestroy(ctx),
 		Steps: []resource.TestStep{
-			{
-				Config: testAccSnapshotCopyGrantConfig_tags(rName),
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckSnapshotCopyGrantExists(ctx, resourceName),
-					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
-					resource.TestCheckResourceAttr(resourceName, "tags.Name", rName),
-					resource.TestCheckResourceAttr(resourceName, "tags.Env", "Test"),
-				),
-			},
 			{
 				Config: testAccSnapshotCopyGrantConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckSnapshotCopyGrantExists(ctx, resourceName),
-					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
-				),
-			},
-			{
-				Config: testAccSnapshotCopyGrantConfig_tags(rName),
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckSnapshotCopyGrantExists(ctx, resourceName),
-					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
-					resource.TestCheckResourceAttr(resourceName, "tags.Name", rName),
-					resource.TestCheckResourceAttr(resourceName, "tags.Env", "Test"),
+					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfredshift.ResourceSnapshotCopyGrant(), resourceName),
 				),
-			},
-			{
-				ResourceName:      resourceName,
-				ImportState:       true,
-				ImportStateVerify: true,
+				ExpectNonEmptyPlan: true,
 			},
 		},
 	})
 }
 
-func TestAccRedshiftSnapshotCopyGrant_disappears(t *testing.T) {
+func TestAccRedshiftSnapshotCopyGrant_tags(t *testing.T) {
 	ctx := acctest.Context(t)
 	resourceName := "aws_redshift_snapshot_copy_grant.test"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
@@ -101,12 +82,34 @@ func TestAccRedshiftSnapshotCopyGrant_disappears(t *testing.T) {
 		CheckDestroy:             testAccCheckSnapshotCopyGrantDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccSnapshotCopyGrantConfig_basic(rName),
+				Config: testAccSnapshotCopyGrantConfig_tags1(rName, "key1", "value1"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckSnapshotCopyGrantExists(ctx, resourceName),
-					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfredshift.ResourceSnapshotCopyGrant(), resourceName),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				Config: testAccSnapshotCopyGrantConfig_tags2(rName, "key1", "value1updated", "key2", "value2"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckSnapshotCopyGrantExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1updated"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
+				),
+			},
+			{
+				Config: testAccSnapshotCopyGrantConfig_tags1(rName, "key2", "value2"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckSnapshotCopyGrantExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
 				),
-				ExpectNonEmptyPlan: true,
 			},
 		},
 	})
@@ -121,47 +124,35 @@ func testAccCheckSnapshotCopyGrantDestroy(ctx context.Context) resource.TestChec
 				continue
 			}
 
-			err := tfredshift.WaitForSnapshotCopyGrantToBeDeleted(ctx, conn, rs.Primary.ID)
-			return err
+			_, err := tfredshift.FindSnapshotCopyGrantByName(ctx, conn, rs.Primary.ID)
+
+			if tfresource.NotFound(err) {
+				continue
+			}
+
+			if err != nil {
+				return err
+			}
+
+			return fmt.Errorf("Redshift Snapshot Copy Grant %s still exists", rs.Primary.ID)
 		}
 
 		return nil
 	}
 }
 
-func testAccCheckSnapshotCopyGrantExists(ctx context.Context, name string) resource.TestCheckFunc {
+func testAccCheckSnapshotCopyGrantExists(ctx context.Context, n string) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		rs, ok := s.RootModule().Resources[name]
+		rs, ok := s.RootModule().Resources[n]
 		if !ok {
-			return fmt.Errorf("not found: %s", name)
-		}
-
-		if rs.Primary.ID == "" {
-			return fmt.Errorf("Snapshot Copy Grant ID (SnapshotCopyGrantName) is not set")
+			return fmt.Errorf("Not found: %s", n)
 		}
 
-		// retrieve the client from the test provider
 		conn := acctest.Provider.Meta().(*conns.AWSClient).RedshiftConn(ctx)
 
-		input := redshift.DescribeSnapshotCopyGrantsInput{
-			MaxRecords:            aws.Int64(100),
-			SnapshotCopyGrantName: aws.String(rs.Primary.ID),
-		}
-
-		response, err := conn.DescribeSnapshotCopyGrantsWithContext(ctx, &input)
+		_, err := tfredshift.FindSnapshotCopyGrantByName(ctx, conn, rs.Primary.ID)
 
-		if err != nil {
-			return err
-		}
-
-		// we expect only a single snapshot copy grant by this ID. If we find zero, or many,
-		// then we consider this an error
-		if len(response.SnapshotCopyGrants) != 1 ||
-			*response.SnapshotCopyGrants[0].SnapshotCopyGrantName != rs.Primary.ID {
-			return fmt.Errorf("Snapshot copy grant not found")
-		}
-
-		return nil
+		return err
 	}
 }
 
@@ -173,15 +164,27 @@ resource "aws_redshift_snapshot_copy_grant" "test" {
 `, rName)
 }
 
-func testAccSnapshotCopyGrantConfig_tags(rName string) string {
+func testAccSnapshotCopyGrantConfig_tags1(rName, tagKey1, tagValue1 string) string {
 	return fmt.Sprintf(`
 resource "aws_redshift_snapshot_copy_grant" "test" {
   snapshot_copy_grant_name = %[1]q
 
   tags = {
-    Name = %[1]q
-    Env  = "Test"
+    %[2]q = %[3]q
   }
 }
-`, rName)
+`, rName, tagKey1, tagValue1)
+}
+
+func testAccSnapshotCopyGrantConfig_tags2(rName, tagKey1, tagValue1, tagKey2, tagValue2 string) string {
+	return fmt.Sprintf(`
+resource "aws_redshift_snapshot_copy_grant" "test" {
+  snapshot_copy_grant_name = %[1]q
+
+  tags = {
+    %[2]q = %[3]q
+    %[4]q = %[5]q
+  }
+}
+`, rName, tagKey1, tagValue1, tagKey2, tagValue2)
 }
diff --git a/internal/service/redshift/snapshot_schedule.go b/internal/service/redshift/snapshot_schedule.go
index 0ad61a1cdda..5d8adb8445f 100644
--- a/internal/service/redshift/snapshot_schedule.go
+++ b/internal/service/redshift/snapshot_schedule.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package redshift
 
 import (
@@ -10,12 +13,13 @@ import (
 	"github.com/aws/aws-sdk-go/service/redshift"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/create"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
 	"github.com/hashicorp/terraform-provider-aws/internal/flex"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -28,6 +32,7 @@ func ResourceSnapshotSchedule() *schema.Resource {
 		ReadWithoutTimeout:   resourceSnapshotScheduleRead,
 		UpdateWithoutTimeout: resourceSnapshotScheduleUpdate,
 		DeleteWithoutTimeout: resourceSnapshotScheduleDelete,
+
 		Importer: &schema.ResourceImporter{
 			StateContext: schema.ImportStatePassthroughContext,
 		},
@@ -37,35 +42,35 @@ func ResourceSnapshotSchedule() *schema.Resource {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
-			"identifier": {
-				Type:          schema.TypeString,
-				Optional:      true,
-				Computed:      true,
-				ForceNew:      true,
-				ConflictsWith: []string{"identifier_prefix"},
-			},
-			"identifier_prefix": {
-				Type:     schema.TypeString,
-				Optional: true,
-				Computed: true,
-				ForceNew: true,
+			"definitions": {
+				Type:     schema.TypeSet,
+				Required: true,
+				Elem:     &schema.Schema{Type: schema.TypeString},
 			},
 			"description": {
 				Type:     schema.TypeString,
 				Optional: true,
 				ForceNew: true,
 			},
-			"definitions": {
-				Type:     schema.TypeSet,
-				Required: true,
-				Elem:     &schema.Schema{Type: schema.TypeString},
-				Set:      schema.HashString,
-			},
 			"force_destroy": {
 				Type:     schema.TypeBool,
 				Optional: true,
 				Default:  false,
 			},
+			"identifier": {
+				Type:          schema.TypeString,
+				Optional:      true,
+				Computed:      true,
+				ForceNew:      true,
+				ConflictsWith: []string{"identifier_prefix"},
+			},
+			"identifier_prefix": {
+				Type:          schema.TypeString,
+				Optional:      true,
+				Computed:      true,
+				ForceNew:      true,
+				ConflictsWith: []string{"identifier"},
+			},
 			names.AttrTags:    tftags.TagsSchema(),
 			names.AttrTagsAll: tftags.TagsSchemaComputed(),
 		},
@@ -78,31 +83,24 @@ func resourceSnapshotScheduleCreate(ctx context.Context, d *schema.ResourceData,
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).RedshiftConn(ctx)
 
-	var identifier string
-	if v, ok := d.GetOk("identifier"); ok {
-		identifier = v.(string)
-	} else {
-		if v, ok := d.GetOk("identifier_prefix"); ok {
-			identifier = id.PrefixedUniqueId(v.(string))
-		} else {
-			identifier = id.UniqueId()
-		}
-	}
-	createOpts := &redshift.CreateSnapshotScheduleInput{
+	identifier := create.Name(d.Get("identifier").(string), d.Get("identifier_prefix").(string))
+	input := &redshift.CreateSnapshotScheduleInput{
 		ScheduleIdentifier:  aws.String(identifier),
 		ScheduleDefinitions: flex.ExpandStringSet(d.Get("definitions").(*schema.Set)),
 		Tags:                getTagsIn(ctx),
 	}
-	if attr, ok := d.GetOk("description"); ok {
-		createOpts.ScheduleDescription = aws.String(attr.(string))
+
+	if v, ok := d.GetOk("description"); ok {
+		input.ScheduleDescription = aws.String(v.(string))
 	}
 
-	resp, err := conn.CreateSnapshotScheduleWithContext(ctx, createOpts)
+	output, err := conn.CreateSnapshotScheduleWithContext(ctx, input)
+
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "creating Redshift Snapshot Schedule: %s", err)
+		return sdkdiag.AppendErrorf(diags, "creating Redshift Snapshot Schedule (%s): %s", identifier, err)
 	}
 
-	d.SetId(aws.StringValue(resp.ScheduleIdentifier))
+	d.SetId(aws.StringValue(output.ScheduleIdentifier))
 
 	return append(diags, resourceSnapshotScheduleRead(ctx, d, meta)...)
 }
@@ -111,30 +109,18 @@ func resourceSnapshotScheduleRead(ctx context.Context, d *schema.ResourceData, m
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).RedshiftConn(ctx)
 
-	descOpts := &redshift.DescribeSnapshotSchedulesInput{
-		ScheduleIdentifier: aws.String(d.Id()),
-	}
+	snapshotSchedule, err := FindSnapshotScheduleByID(ctx, conn, d.Id())
 
-	resp, err := conn.DescribeSnapshotSchedulesWithContext(ctx, descOpts)
-	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "describing Redshift Cluster Snapshot Schedule %s: %s", d.Id(), err)
-	}
-
-	if !d.IsNewResource() && (resp.SnapshotSchedules == nil || len(resp.SnapshotSchedules) != 1) {
-		log.Printf("[WARN] Redshift Cluster Snapshot Schedule (%s) not found, removing from state", d.Id())
+	if !d.IsNewResource() && tfresource.NotFound(err) {
+		log.Printf("[WARN] Redshift Snapshot Schedule (%s) not found, removing from state", d.Id())
 		d.SetId("")
 		return diags
 	}
-	snapshotSchedule := resp.SnapshotSchedules[0]
 
-	d.Set("identifier", snapshotSchedule.ScheduleIdentifier)
-	d.Set("description", snapshotSchedule.ScheduleDescription)
-	if err := d.Set("definitions", flex.FlattenStringList(snapshotSchedule.ScheduleDefinitions)); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting definitions: %s", err)
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "reading Redshift Snapshot Schedule (%s): %s", d.Id(), err)
 	}
 
-	setTagsOut(ctx, snapshotSchedule.Tags)
-
 	arn := arn.ARN{
 		Partition: meta.(*conns.AWSClient).Partition,
 		Service:   "redshift",
@@ -142,8 +128,13 @@ func resourceSnapshotScheduleRead(ctx context.Context, d *schema.ResourceData, m
 		AccountID: meta.(*conns.AWSClient).AccountID,
 		Resource:  fmt.Sprintf("snapshotschedule:%s", d.Id()),
 	}.String()
-
 	d.Set("arn", arn)
+	d.Set("definitions", aws.StringValueSlice(snapshotSchedule.ScheduleDefinitions))
+	d.Set("description", snapshotSchedule.ScheduleDescription)
+	d.Set("identifier", snapshotSchedule.ScheduleIdentifier)
+	d.Set("identifier_prefix", create.NamePrefixFromName(aws.StringValue(snapshotSchedule.ScheduleIdentifier)))
+
+	setTagsOut(ctx, snapshotSchedule.Tags)
 
 	return diags
 }
@@ -153,13 +144,15 @@ func resourceSnapshotScheduleUpdate(ctx context.Context, d *schema.ResourceData,
 	conn := meta.(*conns.AWSClient).RedshiftConn(ctx)
 
 	if d.HasChange("definitions") {
-		modifyOpts := &redshift.ModifySnapshotScheduleInput{
-			ScheduleIdentifier:  aws.String(d.Id()),
+		input := &redshift.ModifySnapshotScheduleInput{
 			ScheduleDefinitions: flex.ExpandStringSet(d.Get("definitions").(*schema.Set)),
+			ScheduleIdentifier:  aws.String(d.Id()),
 		}
-		_, err := conn.ModifySnapshotScheduleWithContext(ctx, modifyOpts)
+
+		_, err := conn.ModifySnapshotScheduleWithContext(ctx, input)
+
 		if err != nil {
-			return sdkdiag.AppendErrorf(diags, "modifying Redshift Snapshot Schedule %s: %s", d.Id(), err)
+			return sdkdiag.AppendErrorf(diags, "updating Redshift Snapshot Schedule (%s): %s", d.Id(), err)
 		}
 	}
 
@@ -171,17 +164,22 @@ func resourceSnapshotScheduleDelete(ctx context.Context, d *schema.ResourceData,
 	conn := meta.(*conns.AWSClient).RedshiftConn(ctx)
 
 	if d.Get("force_destroy").(bool) {
-		if err := resourceSnapshotScheduleDeleteAllAssociatedClusters(ctx, conn, d.Id()); err != nil {
-			return sdkdiag.AppendErrorf(diags, "deleting Redshift Snapshot Schedule (%s): %s", d.Id(), err)
+		diags = append(diags, snapshotScheduleDisassociateAll(ctx, conn, d.Id())...)
+
+		if diags.HasError() {
+			return diags
 		}
 	}
 
+	log.Printf("[DEBUG] Deleting Redshift Snapshot Schedule: %s", d.Id())
 	_, err := conn.DeleteSnapshotScheduleWithContext(ctx, &redshift.DeleteSnapshotScheduleInput{
 		ScheduleIdentifier: aws.String(d.Id()),
 	})
+
 	if tfawserr.ErrCodeEquals(err, redshift.ErrCodeSnapshotScheduleNotFoundFault) {
 		return diags
 	}
+
 	if err != nil {
 		return sdkdiag.AppendErrorf(diags, "deleting Redshift Snapshot Schedule (%s): %s", d.Id(), err)
 	}
@@ -189,51 +187,56 @@ func resourceSnapshotScheduleDelete(ctx context.Context, d *schema.ResourceData,
 	return diags
 }
 
-func resourceSnapshotScheduleDeleteAllAssociatedClusters(ctx context.Context, conn *redshift.Redshift, scheduleIdentifier string) error {
-	resp, err := conn.DescribeSnapshotSchedulesWithContext(ctx, &redshift.DescribeSnapshotSchedulesInput{
-		ScheduleIdentifier: aws.String(scheduleIdentifier),
-	})
-	if tfawserr.ErrCodeEquals(err, redshift.ErrCodeSnapshotScheduleNotFoundFault) {
-		return nil
-	}
+func snapshotScheduleDisassociateAll(ctx context.Context, conn *redshift.Redshift, id string) diag.Diagnostics {
+	var diags diag.Diagnostics
+
+	snapshotSchedule, err := FindSnapshotScheduleByID(ctx, conn, id)
+
 	if err != nil {
-		return err
-	}
-	if resp.SnapshotSchedules == nil || len(resp.SnapshotSchedules) != 1 {
-		log.Printf("[WARN] Unable to find Redshift Cluster Snapshot Schedule (%s)", scheduleIdentifier)
-		return nil
+		return sdkdiag.AppendErrorf(diags, "reading Redshift Snapshot Schedule (%s): %s", id, err)
 	}
 
-	snapshotSchedule := resp.SnapshotSchedules[0]
-
 	for _, associatedCluster := range snapshotSchedule.AssociatedClusters {
+		clusterIdentifier := aws.StringValue(associatedCluster.ClusterIdentifier)
 		_, err = conn.ModifyClusterSnapshotScheduleWithContext(ctx, &redshift.ModifyClusterSnapshotScheduleInput{
-			ClusterIdentifier:    associatedCluster.ClusterIdentifier,
-			ScheduleIdentifier:   aws.String(scheduleIdentifier),
+			ClusterIdentifier:    aws.String(clusterIdentifier),
+			ScheduleIdentifier:   aws.String(id),
 			DisassociateSchedule: aws.Bool(true),
 		})
 
-		clusterId := aws.StringValue(associatedCluster.ClusterIdentifier)
-
-		if tfawserr.ErrCodeEquals(err, redshift.ErrCodeClusterNotFoundFault) {
-			log.Printf("[WARN] Redshift Snapshot Cluster (%s) not found, removing from state", clusterId)
-			continue
-		}
-		if tfawserr.ErrCodeEquals(err, redshift.ErrCodeSnapshotScheduleNotFoundFault) {
-			log.Printf("[WARN] Redshift Snapshot Schedule (%s) not found, removing from state", scheduleIdentifier)
+		if tfawserr.ErrCodeEquals(err, redshift.ErrCodeClusterNotFoundFault, redshift.ErrCodeSnapshotScheduleNotFoundFault) {
 			continue
 		}
+
 		if err != nil {
-			return fmt.Errorf("disassociating Redshift Cluster (%s): %s", clusterId, err)
+			return sdkdiag.AppendErrorf(diags, "deleting Redshift Snapshot Schedule Association (%s): %s", SnapshotScheduleAssociationCreateResourceID(clusterIdentifier, id), err)
 		}
 	}
 
 	for _, associatedCluster := range snapshotSchedule.AssociatedClusters {
-		id := fmt.Sprintf("%s/%s", aws.StringValue(associatedCluster.ClusterIdentifier), scheduleIdentifier)
-		if _, err := waitScheduleAssociationDeleted(ctx, conn, id); err != nil {
-			return err
+		clusterIdentifier := aws.StringValue(associatedCluster.ClusterIdentifier)
+		if _, err := waitSnapshotScheduleAssociationDeleted(ctx, conn, clusterIdentifier, id); err != nil {
+			return sdkdiag.AppendErrorf(diags, "waiting for Redshift Snapshot Schedule Association (%s) delete: %s", SnapshotScheduleAssociationCreateResourceID(clusterIdentifier, id), err)
 		}
 	}
 
-	return nil
+	return diags
+}
+
+func FindSnapshotScheduleByID(ctx context.Context, conn *redshift.Redshift, id string) (*redshift.SnapshotSchedule, error) {
+	input := &redshift.DescribeSnapshotSchedulesInput{
+		ScheduleIdentifier: aws.String(id),
+	}
+
+	output, err := conn.DescribeSnapshotSchedulesWithContext(ctx, input)
+
+	if err != nil {
+		return nil, err
+	}
+
+	if output == nil {
+		return nil, tfresource.NewEmptyResultError(input)
+	}
+
+	return tfresource.AssertSinglePtrResult(output.SnapshotSchedules)
 }
diff --git a/internal/service/redshift/snapshot_schedule_association.go b/internal/service/redshift/snapshot_schedule_association.go
index 3052aea5492..f1f9b88fac4 100644
--- a/internal/service/redshift/snapshot_schedule_association.go
+++ b/internal/service/redshift/snapshot_schedule_association.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package redshift
 
 import (
@@ -5,11 +8,13 @@ import (
 	"fmt"
 	"log"
 	"strings"
+	"time"
 
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/redshift"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
@@ -44,23 +49,26 @@ func ResourceSnapshotScheduleAssociation() *schema.Resource {
 func resourceSnapshotScheduleAssociationCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).RedshiftConn(ctx)
+
 	clusterIdentifier := d.Get("cluster_identifier").(string)
 	scheduleIdentifier := d.Get("schedule_identifier").(string)
-
-	_, err := conn.ModifyClusterSnapshotScheduleWithContext(ctx, &redshift.ModifyClusterSnapshotScheduleInput{
+	id := SnapshotScheduleAssociationCreateResourceID(clusterIdentifier, scheduleIdentifier)
+	input := &redshift.ModifyClusterSnapshotScheduleInput{
 		ClusterIdentifier:    aws.String(clusterIdentifier),
 		ScheduleIdentifier:   aws.String(scheduleIdentifier),
 		DisassociateSchedule: aws.Bool(false),
-	})
+	}
+
+	_, err := conn.ModifyClusterSnapshotScheduleWithContext(ctx, input)
 
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "creating Redshift Cluster Snapshot Schedule (%s/%s): %s", clusterIdentifier, scheduleIdentifier, err)
+		return sdkdiag.AppendErrorf(diags, "creating Redshift Snapshot Schedule Association (%s): %s", id, err)
 	}
 
-	d.SetId(fmt.Sprintf("%s/%s", clusterIdentifier, scheduleIdentifier))
+	d.SetId(id)
 
-	if _, err := WaitScheduleAssociationActive(ctx, conn, d.Id()); err != nil {
-		return sdkdiag.AppendErrorf(diags, "creating Redshift Cluster Snapshot Schedule (%s): waiting for completion: %s", d.Id(), err)
+	if _, err := WaitSnapshotScheduleAssociationCreated(ctx, conn, clusterIdentifier, scheduleIdentifier); err != nil {
+		return sdkdiag.AppendErrorf(diags, "waiting for Redshift Snapshot Schedule Association (%s) create: %s", d.Id(), err)
 	}
 
 	return append(diags, resourceSnapshotScheduleAssociationRead(ctx, d, meta)...)
@@ -70,18 +78,24 @@ func resourceSnapshotScheduleAssociationRead(ctx context.Context, d *schema.Reso
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).RedshiftConn(ctx)
 
-	scheduleIdentifier, assoicatedCluster, err := FindScheduleAssociationById(ctx, conn, d.Id())
+	clusterIdentifier, scheduleIdentifier, err := SnapshotScheduleAssociationParseResourceID(d.Id())
+	if err != nil {
+		return sdkdiag.AppendFromErr(diags, err)
+	}
+
+	association, err := FindSnapshotScheduleAssociationByTwoPartKey(ctx, conn, clusterIdentifier, scheduleIdentifier)
 
 	if !d.IsNewResource() && tfresource.NotFound(err) {
-		log.Printf("[WARN] Redshift Schedule Association (%s) not found, removing from state", d.Id())
+		log.Printf("[WARN] Redshift Snapshot Schedule Association (%s) not found, removing from state", d.Id())
 		d.SetId("")
 		return diags
 	}
 
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "reading Redshift Schedule Association (%s): %s", d.Id(), err)
+		return sdkdiag.AppendErrorf(diags, "reading Redshift Snapshot Schedule Association (%s): %s", d.Id(), err)
 	}
-	d.Set("cluster_identifier", assoicatedCluster.ClusterIdentifier)
+
+	d.Set("cluster_identifier", association.ClusterIdentifier)
 	d.Set("schedule_identifier", scheduleIdentifier)
 
 	return diags
@@ -90,12 +104,13 @@ func resourceSnapshotScheduleAssociationRead(ctx context.Context, d *schema.Reso
 func resourceSnapshotScheduleAssociationDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).RedshiftConn(ctx)
-	clusterIdentifier, scheduleIdentifier, err := SnapshotScheduleAssociationParseID(d.Id())
+
+	clusterIdentifier, scheduleIdentifier, err := SnapshotScheduleAssociationParseResourceID(d.Id())
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "deleting Redshift Cluster Snapshot Schedule (%s): %s", d.Id(), err)
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
-	log.Printf("[DEBUG] Deleting Redshift Cluster Snapshot Schedule Association: %s", d.Id())
+	log.Printf("[DEBUG] Deleting Redshift Snapshot Schedule Association: %s", d.Id())
 	_, err = conn.ModifyClusterSnapshotScheduleWithContext(ctx, &redshift.ModifyClusterSnapshotScheduleInput{
 		ClusterIdentifier:    aws.String(clusterIdentifier),
 		ScheduleIdentifier:   aws.String(scheduleIdentifier),
@@ -107,24 +122,121 @@ func resourceSnapshotScheduleAssociationDelete(ctx context.Context, d *schema.Re
 	}
 
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "deleting Redshift Cluster Snapshot Schedule (%s): %s", d.Id(), err)
+		return sdkdiag.AppendErrorf(diags, "deleting Redshift Snapshot Schedule Association (%s): %s", d.Id(), err)
 	}
 
-	if _, err := waitScheduleAssociationDeleted(ctx, conn, d.Id()); err != nil {
-		return sdkdiag.AppendErrorf(diags, "deleting Redshift Cluster Snapshot Schedule (%s): waiting for completion: %s", d.Id(), err)
+	if _, err := waitSnapshotScheduleAssociationDeleted(ctx, conn, clusterIdentifier, scheduleIdentifier); err != nil {
+		return sdkdiag.AppendErrorf(diags, "waiting for Redshift Snapshot Schedule Association (%s) delete: %s", d.Id(), err)
 	}
 
 	return diags
 }
 
-func SnapshotScheduleAssociationParseID(id string) (clusterIdentifier, scheduleIdentifier string, err error) {
-	parts := strings.SplitN(id, "/", 2)
+const snapshotScheduleAssociationIDSeparator = "/"
+
+func SnapshotScheduleAssociationCreateResourceID(clusterIdentifier, scheduleIdentifier string) string {
+	parts := []string{clusterIdentifier, scheduleIdentifier}
+	id := strings.Join(parts, snapshotScheduleAssociationIDSeparator)
+
+	return id
+}
+
+func SnapshotScheduleAssociationParseResourceID(id string) (string, string, error) {
+	parts := strings.SplitN(id, snapshotScheduleAssociationIDSeparator, 2)
+
 	if len(parts) != 2 || parts[0] == "" || parts[1] == "" {
-		err = fmt.Errorf("aws_redshift_snapshot_schedule_association id must be of the form <ClusterIdentifier>/<ScheduleIdentifier>")
-		return
+		return "", "", fmt.Errorf("unexpected format for ID (%[1]s), expected <ClusterIdentifier>%[2]s<ScheduleIdentifier>", id, snapshotScheduleAssociationIDSeparator)
+	}
+
+	return parts[0], parts[1], nil
+}
+
+func FindSnapshotScheduleAssociationByTwoPartKey(ctx context.Context, conn *redshift.Redshift, clusterIdentifier, scheduleIdentifier string) (*redshift.ClusterAssociatedToSchedule, error) {
+	input := &redshift.DescribeSnapshotSchedulesInput{
+		ClusterIdentifier:  aws.String(clusterIdentifier),
+		ScheduleIdentifier: aws.String(scheduleIdentifier),
+	}
+
+	output, err := conn.DescribeSnapshotSchedulesWithContext(ctx, input)
+
+	if err != nil {
+		return nil, err
+	}
+
+	if output == nil {
+		return nil, tfresource.NewEmptyResultError(input)
+	}
+
+	schedule, err := tfresource.AssertSinglePtrResult(output.SnapshotSchedules)
+
+	if err != nil {
+		return nil, err
+	}
+
+	for _, v := range schedule.AssociatedClusters {
+		if aws.StringValue(v.ClusterIdentifier) == clusterIdentifier {
+			return v, nil
+		}
+	}
+
+	return nil, &retry.NotFoundError{}
+}
+
+func statusSnapshotScheduleAssociation(ctx context.Context, conn *redshift.Redshift, clusterIdentifier, scheduleIdentifier string) retry.StateRefreshFunc {
+	return func() (interface{}, string, error) {
+		output, err := FindSnapshotScheduleAssociationByTwoPartKey(ctx, conn, clusterIdentifier, scheduleIdentifier)
+
+		if tfresource.NotFound(err) {
+			return nil, "", nil
+		}
+
+		if err != nil {
+			return nil, "", err
+		}
+
+		return output, aws.StringValue(output.ScheduleAssociationState), nil
+	}
+}
+
+func WaitSnapshotScheduleAssociationCreated(ctx context.Context, conn *redshift.Redshift, clusterIdentifier, scheduleIdentifier string) (*redshift.ClusterAssociatedToSchedule, error) {
+	const (
+		timeout = 75 * time.Minute
+	)
+	stateConf := &retry.StateChangeConf{
+		Pending:    []string{redshift.ScheduleStateModifying},
+		Target:     []string{redshift.ScheduleStateActive},
+		Refresh:    statusSnapshotScheduleAssociation(ctx, conn, clusterIdentifier, scheduleIdentifier),
+		Timeout:    timeout,
+		MinTimeout: 10 * time.Second,
+		Delay:      30 * time.Second,
+	}
+
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+
+	if output, ok := outputRaw.(*redshift.ClusterAssociatedToSchedule); ok {
+		return output, err
+	}
+
+	return nil, err
+}
+
+func waitSnapshotScheduleAssociationDeleted(ctx context.Context, conn *redshift.Redshift, clusterIdentifier, scheduleIdentifier string) (*redshift.ClusterAssociatedToSchedule, error) { //nolint:unparam
+	const (
+		timeout = 75 * time.Minute
+	)
+	stateConf := &retry.StateChangeConf{
+		Pending:    []string{redshift.ScheduleStateModifying, redshift.ScheduleStateActive},
+		Target:     []string{},
+		Refresh:    statusSnapshotScheduleAssociation(ctx, conn, clusterIdentifier, scheduleIdentifier),
+		Timeout:    timeout,
+		MinTimeout: 10 * time.Second,
+	}
+
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+
+	if output, ok := outputRaw.(*redshift.ClusterAssociatedToSchedule); ok {
+		return output, err
 	}
 
-	clusterIdentifier = parts[0]
-	scheduleIdentifier = parts[1]
-	return
+	return nil, err
 }
diff --git a/internal/service/redshift/snapshot_schedule_association_test.go b/internal/service/redshift/snapshot_schedule_association_test.go
index 36f7e17b2c9..dc8315d235f 100644
--- a/internal/service/redshift/snapshot_schedule_association_test.go
+++ b/internal/service/redshift/snapshot_schedule_association_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package redshift_test
 
 import (
@@ -19,7 +22,7 @@ func TestAccRedshiftSnapshotScheduleAssociation_basic(t *testing.T) {
 	ctx := acctest.Context(t)
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_redshift_snapshot_schedule_association.test"
-	snapshotScheduleResourceName := "aws_redshift_snapshot_schedule.default"
+	snapshotScheduleResourceName := "aws_redshift_snapshot_schedule.test"
 	clusterResourceName := "aws_redshift_cluster.test"
 
 	resource.ParallelTest(t, resource.TestCase{
@@ -29,11 +32,11 @@ func TestAccRedshiftSnapshotScheduleAssociation_basic(t *testing.T) {
 		CheckDestroy:             testAccCheckSnapshotScheduleAssociationDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccSnapshotScheduleAssociationConfig_basic(rName, "rate(12 hours)"),
+				Config: testAccSnapshotScheduleAssociationConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckSnapshotScheduleAssociationExists(ctx, resourceName),
-					resource.TestCheckResourceAttrPair(resourceName, "schedule_identifier", snapshotScheduleResourceName, "id"),
 					resource.TestCheckResourceAttrPair(resourceName, "cluster_identifier", clusterResourceName, "id"),
+					resource.TestCheckResourceAttrPair(resourceName, "schedule_identifier", snapshotScheduleResourceName, "id"),
 				),
 			},
 			{
@@ -57,7 +60,7 @@ func TestAccRedshiftSnapshotScheduleAssociation_disappears(t *testing.T) {
 		CheckDestroy:             testAccCheckSnapshotScheduleAssociationDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccSnapshotScheduleAssociationConfig_basic(rName, "rate(12 hours)"),
+				Config: testAccSnapshotScheduleAssociationConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckSnapshotScheduleAssociationExists(ctx, resourceName),
 					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfredshift.ResourceSnapshotScheduleAssociation(), resourceName),
@@ -81,7 +84,7 @@ func TestAccRedshiftSnapshotScheduleAssociation_disappears_cluster(t *testing.T)
 		CheckDestroy:             testAccCheckSnapshotScheduleAssociationDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccSnapshotScheduleAssociationConfig_basic(rName, "rate(12 hours)"),
+				Config: testAccSnapshotScheduleAssociationConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckSnapshotScheduleAssociationExists(ctx, resourceName),
 					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfredshift.ResourceCluster(), clusterResourceName),
@@ -99,9 +102,14 @@ func testAccCheckSnapshotScheduleAssociationDestroy(ctx context.Context) resourc
 				continue
 			}
 
+			clusterIdentifier, scheduleIdentifier, err := tfredshift.SnapshotScheduleAssociationParseResourceID(rs.Primary.ID)
+			if err != nil {
+				return err
+			}
+
 			conn := acctest.Provider.Meta().(*conns.AWSClient).RedshiftConn(ctx)
 
-			_, _, err := tfredshift.FindScheduleAssociationById(ctx, conn, rs.Primary.ID)
+			_, err = tfredshift.FindSnapshotScheduleAssociationByTwoPartKey(ctx, conn, clusterIdentifier, scheduleIdentifier)
 
 			if tfresource.NotFound(err) {
 				continue
@@ -111,7 +119,7 @@ func testAccCheckSnapshotScheduleAssociationDestroy(ctx context.Context) resourc
 				return err
 			}
 
-			return fmt.Errorf("Redshift Schedule Association %s still exists", rs.Primary.ID)
+			return fmt.Errorf("Redshift Snapshot Schedule Association %s still exists", rs.Primary.ID)
 		}
 
 		return nil
@@ -126,21 +134,26 @@ func testAccCheckSnapshotScheduleAssociationExists(ctx context.Context, n string
 		}
 
 		if rs.Primary.ID == "" {
-			return fmt.Errorf("No Redshift Cluster Snapshot Schedule Association ID is set")
+			return fmt.Errorf("No Redshift Snapshot Schedule Association ID is set")
+		}
+
+		clusterIdentifier, scheduleIdentifier, err := tfredshift.SnapshotScheduleAssociationParseResourceID(rs.Primary.ID)
+		if err != nil {
+			return err
 		}
 
 		conn := acctest.Provider.Meta().(*conns.AWSClient).RedshiftConn(ctx)
 
-		_, _, err := tfredshift.FindScheduleAssociationById(ctx, conn, rs.Primary.ID)
+		_, err = tfredshift.FindSnapshotScheduleAssociationByTwoPartKey(ctx, conn, clusterIdentifier, scheduleIdentifier)
 
 		return err
 	}
 }
 
-func testAccSnapshotScheduleAssociationConfig_basic(rName, definition string) string {
-	return acctest.ConfigCompose(testAccClusterConfig_basic(rName), testAccSnapshotScheduleConfig_basic(rName, definition), `
+func testAccSnapshotScheduleAssociationConfig_basic(rName string) string {
+	return acctest.ConfigCompose(testAccClusterConfig_basic(rName), testAccSnapshotScheduleConfig_basic(rName), `
 resource "aws_redshift_snapshot_schedule_association" "test" {
-  schedule_identifier = aws_redshift_snapshot_schedule.default.id
+  schedule_identifier = aws_redshift_snapshot_schedule.test.id
   cluster_identifier  = aws_redshift_cluster.test.id
 }
 `)
diff --git a/internal/service/redshift/snapshot_schedule_test.go b/internal/service/redshift/snapshot_schedule_test.go
index 33185141aa1..730b073df40 100644
--- a/internal/service/redshift/snapshot_schedule_test.go
+++ b/internal/service/redshift/snapshot_schedule_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package redshift_test
 
 import (
@@ -7,19 +10,21 @@ import (
 
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/redshift"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	tfredshift "github.com/hashicorp/terraform-provider-aws/internal/service/redshift"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
 func TestAccRedshiftSnapshotSchedule_basic(t *testing.T) {
 	ctx := acctest.Context(t)
 	var v redshift.SnapshotSchedule
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
-	resourceName := "aws_redshift_snapshot_schedule.default"
+	resourceName := "aws_redshift_snapshot_schedule.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
@@ -28,17 +33,16 @@ func TestAccRedshiftSnapshotSchedule_basic(t *testing.T) {
 		CheckDestroy:             testAccCheckSnapshotScheduleDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccSnapshotScheduleConfig_basic(rName, "rate(12 hours)"),
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckSnapshotScheduleExists(ctx, resourceName, &v),
-					resource.TestCheckResourceAttr(resourceName, "definitions.#", "1"),
-				),
-			},
-			{
-				Config: testAccSnapshotScheduleConfig_basic(rName, "cron(30 12 *)"),
-				Check: resource.ComposeTestCheckFunc(
+				Config: testAccSnapshotScheduleConfig_basic(rName),
+				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckSnapshotScheduleExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttrSet(resourceName, "arn"),
 					resource.TestCheckResourceAttr(resourceName, "definitions.#", "1"),
+					resource.TestCheckTypeSetElemAttr(resourceName, "definitions.*", "rate(12 hours)"),
+					resource.TestCheckResourceAttr(resourceName, "description", ""),
+					resource.TestCheckResourceAttr(resourceName, "identifier", rName),
+					resource.TestCheckResourceAttr(resourceName, "identifier_prefix", ""),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 				),
 			},
 			{
@@ -53,11 +57,11 @@ func TestAccRedshiftSnapshotSchedule_basic(t *testing.T) {
 	})
 }
 
-func TestAccRedshiftSnapshotSchedule_withMultipleDefinition(t *testing.T) {
+func TestAccRedshiftSnapshotSchedule_disappears(t *testing.T) {
 	ctx := acctest.Context(t)
 	var v redshift.SnapshotSchedule
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
-	resourceName := "aws_redshift_snapshot_schedule.default"
+	resourceName := "aws_redshift_snapshot_schedule.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
@@ -66,17 +70,35 @@ func TestAccRedshiftSnapshotSchedule_withMultipleDefinition(t *testing.T) {
 		CheckDestroy:             testAccCheckSnapshotScheduleDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccSnapshotScheduleConfig_multipleDefinition(rName, "cron(30 12 *)", "cron(15 6 *)"),
+				Config: testAccSnapshotScheduleConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckSnapshotScheduleExists(ctx, resourceName, &v),
-					resource.TestCheckResourceAttr(resourceName, "definitions.#", "2"),
+					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfredshift.ResourceSnapshotSchedule(), resourceName),
 				),
+				ExpectNonEmptyPlan: true,
 			},
+		},
+	})
+}
+
+func TestAccRedshiftSnapshotSchedule_tags(t *testing.T) {
+	ctx := acctest.Context(t)
+	var v redshift.SnapshotSchedule
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_redshift_snapshot_schedule.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, redshift.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckSnapshotScheduleDestroy(ctx),
+		Steps: []resource.TestStep{
 			{
-				Config: testAccSnapshotScheduleConfig_multipleDefinition(rName, "cron(30 8 *)", "cron(15 10 *)"),
+				Config: testAccSnapshotScheduleConfig_tags1(rName, "key1", "value1"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckSnapshotScheduleExists(ctx, resourceName, &v),
-					resource.TestCheckResourceAttr(resourceName, "definitions.#", "2"),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
 				),
 			},
 			{
@@ -87,14 +109,31 @@ func TestAccRedshiftSnapshotSchedule_withMultipleDefinition(t *testing.T) {
 					"force_destroy",
 				},
 			},
+			{
+				Config: testAccSnapshotScheduleConfig_tags2(rName, "key1", "value1updated", "key2", "value2"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckSnapshotScheduleExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1updated"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
+				),
+			},
+			{
+				Config: testAccSnapshotScheduleConfig_tags1(rName, "key2", "value2"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckSnapshotScheduleExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
+				),
+			},
 		},
 	})
 }
 
-func TestAccRedshiftSnapshotSchedule_withIdentifierPrefix(t *testing.T) {
+func TestAccRedshiftSnapshotSchedule_identifierGenerated(t *testing.T) {
 	ctx := acctest.Context(t)
 	var v redshift.SnapshotSchedule
-	resourceName := "aws_redshift_snapshot_schedule.default"
+	resourceName := "aws_redshift_snapshot_schedule.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
@@ -103,9 +142,11 @@ func TestAccRedshiftSnapshotSchedule_withIdentifierPrefix(t *testing.T) {
 		CheckDestroy:             testAccCheckSnapshotScheduleDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccSnapshotScheduleConfig_identifierPrefix,
+				Config: testAccSnapshotScheduleConfig_identifierGenerated(),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckSnapshotScheduleExists(ctx, resourceName, &v),
+					acctest.CheckResourceAttrNameGenerated(resourceName, "identifier"),
+					resource.TestCheckResourceAttr(resourceName, "identifier_prefix", id.UniqueIdPrefix),
 				),
 			},
 			{
@@ -113,7 +154,6 @@ func TestAccRedshiftSnapshotSchedule_withIdentifierPrefix(t *testing.T) {
 				ImportState:       true,
 				ImportStateVerify: true,
 				ImportStateVerifyIgnore: []string{
-					"identifier_prefix",
 					"force_destroy",
 				},
 			},
@@ -121,11 +161,10 @@ func TestAccRedshiftSnapshotSchedule_withIdentifierPrefix(t *testing.T) {
 	})
 }
 
-func TestAccRedshiftSnapshotSchedule_withDescription(t *testing.T) {
+func TestAccRedshiftSnapshotSchedule_identifierPrefix(t *testing.T) {
 	ctx := acctest.Context(t)
 	var v redshift.SnapshotSchedule
-	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
-	resourceName := "aws_redshift_snapshot_schedule.default"
+	resourceName := "aws_redshift_snapshot_schedule.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
@@ -134,11 +173,11 @@ func TestAccRedshiftSnapshotSchedule_withDescription(t *testing.T) {
 		CheckDestroy:             testAccCheckSnapshotScheduleDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccSnapshotScheduleConfig_description(rName),
+				Config: testAccSnapshotScheduleConfig_identifierPrefix("tf-acc-test-prefix-"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckSnapshotScheduleExists(ctx, resourceName, &v),
-					resource.TestCheckResourceAttr(
-						resourceName, "description", "Test Schedule"),
+					acctest.CheckResourceAttrNameFromPrefix(resourceName, "identifier", "tf-acc-test-prefix-"),
+					resource.TestCheckResourceAttr(resourceName, "identifier_prefix", "tf-acc-test-prefix-"),
 				),
 			},
 			{
@@ -153,11 +192,11 @@ func TestAccRedshiftSnapshotSchedule_withDescription(t *testing.T) {
 	})
 }
 
-func TestAccRedshiftSnapshotSchedule_withTags(t *testing.T) {
+func TestAccRedshiftSnapshotSchedule_update(t *testing.T) {
 	ctx := acctest.Context(t)
 	var v redshift.SnapshotSchedule
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
-	resourceName := "aws_redshift_snapshot_schedule.default"
+	resourceName := "aws_redshift_snapshot_schedule.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
@@ -166,21 +205,60 @@ func TestAccRedshiftSnapshotSchedule_withTags(t *testing.T) {
 		CheckDestroy:             testAccCheckSnapshotScheduleDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccSnapshotScheduleConfig_tags(rName),
+				Config: testAccSnapshotScheduleConfig_multipleDefinitions(rName, "cron(30 12 *)", "cron(15 6 *)"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckSnapshotScheduleExists(ctx, resourceName, &v),
-					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
-					resource.TestCheckResourceAttr(resourceName, "tags.foo", "bar"),
-					resource.TestCheckResourceAttr(resourceName, "tags.fizz", "buzz"),
+					resource.TestCheckResourceAttr(resourceName, "definitions.#", "2"),
+					resource.TestCheckTypeSetElemAttr(resourceName, "definitions.*", "cron(30 12 *)"),
+					resource.TestCheckTypeSetElemAttr(resourceName, "definitions.*", "cron(15 6 *)"),
 				),
 			},
 			{
-				Config: testAccSnapshotScheduleConfig_tagsUpdate(rName),
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{
+					"force_destroy",
+				},
+			},
+			{
+				Config: testAccSnapshotScheduleConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckSnapshotScheduleExists(ctx, resourceName, &v),
-					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
-					resource.TestCheckResourceAttr(resourceName, "tags.foo", "bar2"),
-					resource.TestCheckResourceAttr(resourceName, "tags.good", "bad"),
+					resource.TestCheckResourceAttr(resourceName, "definitions.#", "1"),
+					resource.TestCheckTypeSetElemAttr(resourceName, "definitions.*", "rate(12 hours)"),
+				),
+			},
+			{
+				Config: testAccSnapshotScheduleConfig_multipleDefinitions(rName, "cron(30 8 *)", "cron(15 10 *)"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckSnapshotScheduleExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "definitions.#", "2"),
+					resource.TestCheckTypeSetElemAttr(resourceName, "definitions.*", "cron(30 8 *)"),
+					resource.TestCheckTypeSetElemAttr(resourceName, "definitions.*", "cron(15 10 *)"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccRedshiftSnapshotSchedule_withDescription(t *testing.T) {
+	ctx := acctest.Context(t)
+	var v redshift.SnapshotSchedule
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_redshift_snapshot_schedule.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, redshift.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckSnapshotScheduleDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccSnapshotScheduleConfig_description(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckSnapshotScheduleExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "description", "Test Schedule"),
 				),
 			},
 			{
@@ -200,7 +278,7 @@ func TestAccRedshiftSnapshotSchedule_withForceDestroy(t *testing.T) {
 	var snapshotSchedule redshift.SnapshotSchedule
 	var cluster redshift.Cluster
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
-	resourceName := "aws_redshift_snapshot_schedule.default"
+	resourceName := "aws_redshift_snapshot_schedule.test"
 	clusterResourceName := "aws_redshift_cluster.test"
 
 	resource.ParallelTest(t, resource.TestCase{
@@ -231,27 +309,24 @@ func TestAccRedshiftSnapshotSchedule_withForceDestroy(t *testing.T) {
 
 func testAccCheckSnapshotScheduleDestroy(ctx context.Context) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
+		conn := acctest.Provider.Meta().(*conns.AWSClient).RedshiftConn(ctx)
+
 		for _, rs := range s.RootModule().Resources {
 			if rs.Type != "aws_redshift_snapshot_schedule" {
 				continue
 			}
 
-			conn := acctest.Provider.Meta().(*conns.AWSClient).RedshiftConn(ctx)
-			resp, err := conn.DescribeSnapshotSchedulesWithContext(ctx, &redshift.DescribeSnapshotSchedulesInput{
-				ScheduleIdentifier: aws.String(rs.Primary.ID),
-			})
-
-			if err == nil {
-				if len(resp.SnapshotSchedules) != 0 {
-					for _, s := range resp.SnapshotSchedules {
-						if *s.ScheduleIdentifier == rs.Primary.ID {
-							return fmt.Errorf("Redshift Cluster Snapshot Schedule %s still exists", rs.Primary.ID)
-						}
-					}
-				}
+			_, err := tfredshift.FindSnapshotScheduleByID(ctx, conn, rs.Primary.ID)
+
+			if tfresource.NotFound(err) {
+				continue
+			}
+
+			if err != nil {
+				return err
 			}
 
-			return err
+			return fmt.Errorf("Redshift Snapshot Schedule %s still exists", rs.Primary.ID)
 		}
 
 		return nil
@@ -270,22 +345,16 @@ func testAccCheckSnapshotScheduleExists(ctx context.Context, n string, v *redshi
 		}
 
 		conn := acctest.Provider.Meta().(*conns.AWSClient).RedshiftConn(ctx)
-		resp, err := conn.DescribeSnapshotSchedulesWithContext(ctx, &redshift.DescribeSnapshotSchedulesInput{
-			ScheduleIdentifier: aws.String(rs.Primary.ID),
-		})
+
+		output, err := tfredshift.FindSnapshotScheduleByID(ctx, conn, rs.Primary.ID)
 
 		if err != nil {
 			return err
 		}
 
-		for _, s := range resp.SnapshotSchedules {
-			if *s.ScheduleIdentifier == rs.Primary.ID {
-				*v = *s
-				return nil
-			}
-		}
+		*v = *output
 
-		return fmt.Errorf("Redshift Snapshot Schedule (%s) not found", rs.Primary.ID)
+		return nil
 	}
 }
 
@@ -293,16 +362,17 @@ func testAccCheckSnapshotScheduleCreateSnapshotScheduleAssociation(ctx context.C
 	return func(s *terraform.State) error {
 		conn := acctest.Provider.Meta().(*conns.AWSClient).RedshiftConn(ctx)
 
-		if _, err := conn.ModifyClusterSnapshotScheduleWithContext(ctx, &redshift.ModifyClusterSnapshotScheduleInput{
+		_, err := conn.ModifyClusterSnapshotScheduleWithContext(ctx, &redshift.ModifyClusterSnapshotScheduleInput{
 			ClusterIdentifier:    cluster.ClusterIdentifier,
 			ScheduleIdentifier:   snapshotSchedule.ScheduleIdentifier,
 			DisassociateSchedule: aws.Bool(false),
-		}); err != nil {
-			return fmt.Errorf("Error associate Redshift Cluster and Snapshot Schedule: %s", err)
+		})
+
+		if err != nil {
+			return err
 		}
 
-		id := fmt.Sprintf("%s/%s", aws.StringValue(cluster.ClusterIdentifier), aws.StringValue(snapshotSchedule.ScheduleIdentifier))
-		if _, err := tfredshift.WaitScheduleAssociationActive(ctx, conn, id); err != nil {
+		if _, err := tfredshift.WaitSnapshotScheduleAssociationCreated(ctx, conn, aws.StringValue(cluster.ClusterIdentifier), aws.StringValue(snapshotSchedule.ScheduleIdentifier)); err != nil {
 			return err
 		}
 
@@ -310,87 +380,97 @@ func testAccCheckSnapshotScheduleCreateSnapshotScheduleAssociation(ctx context.C
 	}
 }
 
-const testAccSnapshotScheduleConfig_identifierPrefix = `
-resource "aws_redshift_snapshot_schedule" "default" {
-  identifier_prefix = "tf-acc-test"
+func testAccSnapshotScheduleConfig_basic(rName string) string {
+	return fmt.Sprintf(`
+resource "aws_redshift_snapshot_schedule" "test" {
+  identifier = %[1]q
   definitions = [
     "rate(12 hours)",
   ]
 }
-`
+`, rName)
+}
 
-func testAccSnapshotScheduleConfig_basic(rName, definition string) string {
+func testAccSnapshotScheduleConfig_tags1(rName, tagKey1, tagValue1 string) string {
 	return fmt.Sprintf(`
-resource "aws_redshift_snapshot_schedule" "default" {
+resource "aws_redshift_snapshot_schedule" "test" {
   identifier = %[1]q
   definitions = [
-    "%[2]s",
+    "rate(12 hours)",
   ]
+
+  tags = {
+    %[2]q = %[3]q
+  }
 }
-`, rName, definition)
+`, rName, tagKey1, tagValue1)
 }
 
-func testAccSnapshotScheduleConfig_multipleDefinition(rName, definition1, definition2 string) string {
+func testAccSnapshotScheduleConfig_tags2(rName, tagKey1, tagValue1, tagKey2, tagValue2 string) string {
 	return fmt.Sprintf(`
-resource "aws_redshift_snapshot_schedule" "default" {
+resource "aws_redshift_snapshot_schedule" "test" {
   identifier = %[1]q
   definitions = [
-    "%[2]s",
-    "%[3]s",
+    "rate(12 hours)",
   ]
+
+  tags = {
+    %[2]q = %[3]q
+    %[4]q = %[5]q
+  }
 }
-`, rName, definition1, definition2)
+`, rName, tagKey1, tagValue1, tagKey2, tagValue2)
 }
 
-func testAccSnapshotScheduleConfig_description(rName string) string {
-	return fmt.Sprintf(`
-resource "aws_redshift_snapshot_schedule" "default" {
-  identifier  = %[1]q
-  description = "Test Schedule"
+func testAccSnapshotScheduleConfig_identifierGenerated() string {
+	return `
+resource "aws_redshift_snapshot_schedule" "test" {
   definitions = [
     "rate(12 hours)",
   ]
 }
-`, rName)
+`
 }
 
-func testAccSnapshotScheduleConfig_tags(rName string) string {
+func testAccSnapshotScheduleConfig_identifierPrefix(prefix string) string {
 	return fmt.Sprintf(`
-resource "aws_redshift_snapshot_schedule" "default" {
-  identifier = %[1]q
+resource "aws_redshift_snapshot_schedule" "test" {
+  identifier_prefix = %[1]q
   definitions = [
     "rate(12 hours)",
   ]
-
-  tags = {
-    foo  = "bar"
-    fizz = "buzz"
-  }
 }
-`, rName)
+`, prefix)
 }
 
-func testAccSnapshotScheduleConfig_tagsUpdate(rName string) string {
+func testAccSnapshotScheduleConfig_multipleDefinitions(rName, definition1, definition2 string) string {
 	return fmt.Sprintf(`
-resource "aws_redshift_snapshot_schedule" "default" {
+resource "aws_redshift_snapshot_schedule" "test" {
   identifier = %[1]q
   definitions = [
-    "rate(12 hours)",
+    %[2]q,
+    %[3]q,
   ]
+}
+`, rName, definition1, definition2)
+}
 
-  tags = {
-    foo  = "bar2"
-    good = "bad"
-  }
+func testAccSnapshotScheduleConfig_description(rName string) string {
+	return fmt.Sprintf(`
+resource "aws_redshift_snapshot_schedule" "test" {
+  identifier  = %[1]q
+  description = "Test Schedule"
+  definitions = [
+    "rate(12 hours)",
+  ]
 }
 `, rName)
 }
 
 func testAccSnapshotScheduleConfig_forceDestroy(rName string) string {
 	return acctest.ConfigCompose(testAccClusterConfig_basic(rName), fmt.Sprintf(`
-resource "aws_redshift_snapshot_schedule" "default" {
-  identifier  = %[1]q
-  description = "Test Schedule"
+resource "aws_redshift_snapshot_schedule" "test" {
+  identifier = %[1]q
   definitions = [
     "rate(12 hours)",
   ]
diff --git a/internal/service/redshift/status.go b/internal/service/redshift/status.go
index 207d8c2f9f2..a54bdcf74c0 100644
--- a/internal/service/redshift/status.go
+++ b/internal/service/redshift/status.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package redshift
 
 import (
@@ -73,22 +76,6 @@ func statusClusterAqua(ctx context.Context, conn *redshift.Redshift, id string)
 	}
 }
 
-func statusScheduleAssociation(ctx context.Context, conn *redshift.Redshift, id string) retry.StateRefreshFunc {
-	return func() (interface{}, string, error) {
-		_, output, err := FindScheduleAssociationById(ctx, conn, id)
-
-		if tfresource.NotFound(err) {
-			return nil, "", nil
-		}
-
-		if err != nil {
-			return nil, "", err
-		}
-
-		return output, aws.StringValue(output.ScheduleAssociationState), nil
-	}
-}
-
 func statusEndpointAccess(ctx context.Context, conn *redshift.Redshift, name string) retry.StateRefreshFunc {
 	return func() (interface{}, string, error) {
 		output, err := FindEndpointAccessByName(ctx, conn, name)
diff --git a/internal/service/redshift/subnet_group.go b/internal/service/redshift/subnet_group.go
index dc0f76aa5da..0299067dea1 100644
--- a/internal/service/redshift/subnet_group.go
+++ b/internal/service/redshift/subnet_group.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package redshift
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/aws/aws-sdk-go/service/redshift"
@@ -50,7 +53,7 @@ func ResourceSubnetGroup() *schema.Resource {
 				Required: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 255),
-					validation.StringMatch(regexp.MustCompile(`^[0-9a-z-]+$`), "must contain only lowercase alphanumeric characters and hyphens"),
+					validation.StringMatch(regexache.MustCompile(`^[0-9a-z-]+$`), "must contain only lowercase alphanumeric characters and hyphens"),
 					validation.StringNotInSlice([]string{"default"}, false),
 				),
 			},
diff --git a/internal/service/redshift/subnet_group_data_source.go b/internal/service/redshift/subnet_group_data_source.go
index 83dda2ee0ba..2f93c108059 100644
--- a/internal/service/redshift/subnet_group_data_source.go
+++ b/internal/service/redshift/subnet_group_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package redshift
 
 import (
diff --git a/internal/service/redshift/subnet_group_data_source_test.go b/internal/service/redshift/subnet_group_data_source_test.go
index 6207f1fbd08..8f5899f9f39 100644
--- a/internal/service/redshift/subnet_group_data_source_test.go
+++ b/internal/service/redshift/subnet_group_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package redshift_test
 
 import (
diff --git a/internal/service/redshift/subnet_group_test.go b/internal/service/redshift/subnet_group_test.go
index f69e11c0897..4e4b334b379 100644
--- a/internal/service/redshift/subnet_group_test.go
+++ b/internal/service/redshift/subnet_group_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package redshift_test
 
 import (
diff --git a/internal/service/redshift/sweep.go b/internal/service/redshift/sweep.go
index d023b5ddc38..f3a53a9c63c 100644
--- a/internal/service/redshift/sweep.go
+++ b/internal/service/redshift/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package redshift
 
@@ -13,9 +13,10 @@ import (
 	"github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_redshift_cluster_snapshot", &resource.Sweeper{
 		Name: "aws_redshift_cluster_snapshot",
 		F:    sweepClusterSnapshots,
@@ -70,7 +71,7 @@ func init() {
 
 func sweepClusterSnapshots(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("getting client: %w", err)
 	}
@@ -100,11 +101,11 @@ func sweepClusterSnapshots(region string) error {
 		// in case work can be done, don't jump out yet
 	}
 
-	if err = sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err = sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("sweeping Redshift Snapshots for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
+	if awsv1.SkipSweepError(errs.ErrorOrNil()) {
 		log.Printf("[WARN] Skipping Redshift Snapshots sweep for %s: %s", region, err)
 		return nil
 	}
@@ -114,7 +115,7 @@ func sweepClusterSnapshots(region string) error {
 
 func sweepClusters(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("getting client: %s", err)
@@ -147,11 +148,11 @@ func sweepClusters(region string) error {
 		// in case work can be done, don't jump out yet
 	}
 
-	if err = sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err = sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("sweeping Redshift Clusters for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
+	if awsv1.SkipSweepError(errs.ErrorOrNil()) {
 		log.Printf("[WARN] Skipping Redshift Cluster sweep for %s: %s", region, err)
 		return nil
 	}
@@ -161,7 +162,7 @@ func sweepClusters(region string) error {
 
 func sweepEventSubscriptions(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("getting client: %w", err)
@@ -191,11 +192,11 @@ func sweepEventSubscriptions(region string) error {
 		errs = multierror.Append(errs, fmt.Errorf("describing Redshift Event Subscriptions: %w", err))
 	}
 
-	if err = sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err = sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("sweeping Redshift Event Subscriptions for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
+	if awsv1.SkipSweepError(errs.ErrorOrNil()) {
 		log.Printf("[WARN] Skipping Redshift Event Subscriptions sweep for %s: %s", region, err)
 		return nil
 	}
@@ -205,7 +206,7 @@ func sweepEventSubscriptions(region string) error {
 
 func sweepScheduledActions(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("getting client: %s", err)
 	}
@@ -229,7 +230,7 @@ func sweepScheduledActions(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Redshift Scheduled Action sweep for %s: %s", region, err)
 		return nil
 	}
@@ -238,7 +239,7 @@ func sweepScheduledActions(region string) error {
 		return fmt.Errorf("listing Redshift Scheduled Actions (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("sweeping Redshift Scheduled Actions (%s): %w", region, err)
@@ -249,7 +250,7 @@ func sweepScheduledActions(region string) error {
 
 func sweepSnapshotSchedules(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("getting client: %s", err)
@@ -290,11 +291,11 @@ func sweepSnapshotSchedules(region string) error {
 		errs = multierror.Append(errs, fmt.Errorf("describing Redshift Snapshot Schedules: %w", err))
 	}
 
-	if err = sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err = sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("sweeping Redshift Snapshot Schedules for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
+	if awsv1.SkipSweepError(errs.ErrorOrNil()) {
 		log.Printf("[WARN] Skipping Redshift Snapshot Schedules sweep for %s: %s", region, errs)
 		return nil
 	}
@@ -304,7 +305,7 @@ func sweepSnapshotSchedules(region string) error {
 
 func sweepSubnetGroups(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("getting client: %w", err)
@@ -346,11 +347,11 @@ func sweepSubnetGroups(region string) error {
 		errs = multierror.Append(errs, fmt.Errorf("describing Redshift Subnet Groups: %w", err))
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("sweeping Redshift Subnet Groups for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
+	if awsv1.SkipSweepError(errs.ErrorOrNil()) {
 		log.Printf("[WARN] Skipping Redshift Subnet Group sweep for %s: %s", region, errs)
 		return nil
 	}
@@ -360,7 +361,7 @@ func sweepSubnetGroups(region string) error {
 
 func sweepHSMClientCertificates(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("getting client: %s", err)
@@ -392,11 +393,11 @@ func sweepHSMClientCertificates(region string) error {
 		// in case work can be done, don't jump out yet
 	}
 
-	if err = sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err = sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("sweeping Redshift Hsm Client Certificates for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
+	if awsv1.SkipSweepError(errs.ErrorOrNil()) {
 		log.Printf("[WARN] Skipping Redshift Hsm Client Certificate sweep for %s: %s", region, err)
 		return nil
 	}
@@ -406,7 +407,7 @@ func sweepHSMClientCertificates(region string) error {
 
 func sweepHSMConfigurations(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("getting client: %s", err)
@@ -438,11 +439,11 @@ func sweepHSMConfigurations(region string) error {
 		// in case work can be done, don't jump out yet
 	}
 
-	if err = sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err = sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("sweeping Redshift Hsm Configurations for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
+	if awsv1.SkipSweepError(errs.ErrorOrNil()) {
 		log.Printf("[WARN] Skipping Redshift Hsm Configuration sweep for %s: %s", region, err)
 		return nil
 	}
@@ -452,7 +453,7 @@ func sweepHSMConfigurations(region string) error {
 
 func sweepAuthenticationProfiles(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("getting client: %s", err)
@@ -482,11 +483,11 @@ func sweepAuthenticationProfiles(region string) error {
 		sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
 	}
 
-	if err = sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err = sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("sweeping Redshift Authentication Profiles for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
+	if awsv1.SkipSweepError(errs.ErrorOrNil()) {
 		log.Printf("[WARN] Skipping Redshift Authentication Profile sweep for %s: %s", region, err)
 		return nil
 	}
diff --git a/internal/service/redshift/tags_gen.go b/internal/service/redshift/tags_gen.go
index c162b2fb65d..248b6a6bf09 100644
--- a/internal/service/redshift/tags_gen.go
+++ b/internal/service/redshift/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/redshift"
 	"github.com/aws/aws-sdk-go/service/redshift/redshiftiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -69,6 +71,8 @@ func updateTags(ctx context.Context, conn redshiftiface.RedshiftAPI, identifier
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.Redshift)
 	if len(removedTags) > 0 {
diff --git a/internal/service/redshift/usage_limit.go b/internal/service/redshift/usage_limit.go
index e52b6b17542..37e403ad3f2 100644
--- a/internal/service/redshift/usage_limit.go
+++ b/internal/service/redshift/usage_limit.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package redshift
 
 import (
diff --git a/internal/service/redshift/usage_limit_test.go b/internal/service/redshift/usage_limit_test.go
index 143a1e524dc..d408fd19b6f 100644
--- a/internal/service/redshift/usage_limit_test.go
+++ b/internal/service/redshift/usage_limit_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package redshift_test
 
 import (
diff --git a/internal/service/redshift/wait.go b/internal/service/redshift/wait.go
index a9b5b002bd5..d899f8e45f5 100644
--- a/internal/service/redshift/wait.go
+++ b/internal/service/redshift/wait.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package redshift
 
 import (
@@ -15,9 +18,6 @@ const (
 	clusterInvalidClusterStateFaultTimeout = 15 * time.Minute
 
 	clusterRelocationStatusResolvedTimeout = 1 * time.Minute
-
-	snapshotScheduleAssociationActivatedTimeout = 75 * time.Minute
-	snapshotScheduleAssociationDestroyedTimeout = 75 * time.Minute
 )
 
 func waitClusterCreated(ctx context.Context, conn *redshift.Redshift, id string, timeout time.Duration) (*redshift.Cluster, error) {
@@ -135,46 +135,6 @@ func waitClusterAquaApplied(ctx context.Context, conn *redshift.Redshift, id str
 	return nil, err
 }
 
-func WaitScheduleAssociationActive(ctx context.Context, conn *redshift.Redshift, id string) (*redshift.ClusterAssociatedToSchedule, error) {
-	stateConf := &retry.StateChangeConf{
-		Pending:    []string{redshift.ScheduleStateModifying},
-		Target:     []string{redshift.ScheduleStateActive},
-		Refresh:    statusScheduleAssociation(ctx, conn, id),
-		Timeout:    snapshotScheduleAssociationActivatedTimeout,
-		MinTimeout: 10 * time.Second,
-		Delay:      30 * time.Second,
-	}
-
-	outputRaw, err := stateConf.WaitForStateContext(ctx)
-
-	if output, ok := outputRaw.(*redshift.ClusterAssociatedToSchedule); ok {
-		tfresource.SetLastError(err, errors.New(aws.StringValue(output.ScheduleAssociationState)))
-
-		return output, err
-	}
-
-	return nil, err
-}
-
-func waitScheduleAssociationDeleted(ctx context.Context, conn *redshift.Redshift, id string) (*redshift.ClusterAssociatedToSchedule, error) { //nolint:unparam
-	stateConf := &retry.StateChangeConf{
-		Pending:    []string{redshift.ScheduleStateModifying, redshift.ScheduleStateActive},
-		Target:     []string{},
-		Refresh:    statusScheduleAssociation(ctx, conn, id),
-		Timeout:    snapshotScheduleAssociationDestroyedTimeout,
-		MinTimeout: 10 * time.Second,
-	}
-
-	outputRaw, err := stateConf.WaitForStateContext(ctx)
-
-	if output, ok := outputRaw.(*redshift.ClusterAssociatedToSchedule); ok {
-		tfresource.SetLastError(err, errors.New(aws.StringValue(output.ScheduleAssociationState)))
-		return output, err
-	}
-
-	return nil, err
-}
-
 func waitEndpointAccessActive(ctx context.Context, conn *redshift.Redshift, id string) (*redshift.EndpointAccess, error) { //nolint:unparam
 	stateConf := &retry.StateChangeConf{
 		Pending:    []string{endpointAccessStatusCreating, endpointAccessStatusModifying},
diff --git a/internal/service/redshiftdata/generate.go b/internal/service/redshiftdata/generate.go
index f5874d1c7ef..c8456bd36dd 100644
--- a/internal/service/redshiftdata/generate.go
+++ b/internal/service/redshiftdata/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
 
diff --git a/internal/service/redshiftdata/service_package_gen.go b/internal/service/redshiftdata/service_package_gen.go
index e4c1cf40dca..a93e557b81e 100644
--- a/internal/service/redshiftdata/service_package_gen.go
+++ b/internal/service/redshiftdata/service_package_gen.go
@@ -5,9 +5,9 @@ package redshiftdata
 import (
 	"context"
 
-	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
-	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
-	redshiftdataapiservice_sdkv1 "github.com/aws/aws-sdk-go/service/redshiftdataapiservice"
+	aws_sdkv2 "github.com/aws/aws-sdk-go-v2/aws"
+	redshiftdata_sdkv2 "github.com/aws/aws-sdk-go-v2/service/redshiftdata"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -29,7 +29,7 @@ func (p *servicePackage) SDKDataSources(ctx context.Context) []*types.ServicePac
 func (p *servicePackage) SDKResources(ctx context.Context) []*types.ServicePackageSDKResource {
 	return []*types.ServicePackageSDKResource{
 		{
-			Factory:  ResourceStatement,
+			Factory:  resourceStatement,
 			TypeName: "aws_redshiftdata_statement",
 		},
 	}
@@ -39,11 +39,17 @@ func (p *servicePackage) ServicePackageName() string {
 	return names.RedshiftData
 }
 
-// NewConn returns a new AWS SDK for Go v1 client for this service package's AWS API.
-func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*redshiftdataapiservice_sdkv1.RedshiftDataAPIService, error) {
-	sess := config["session"].(*session_sdkv1.Session)
+// NewClient returns a new AWS SDK for Go v2 client for this service package's AWS API.
+func (p *servicePackage) NewClient(ctx context.Context, config map[string]any) (*redshiftdata_sdkv2.Client, error) {
+	cfg := *(config["aws_sdkv2_config"].(*aws_sdkv2.Config))
 
-	return redshiftdataapiservice_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
+	return redshiftdata_sdkv2.NewFromConfig(cfg, func(o *redshiftdata_sdkv2.Options) {
+		if endpoint := config["endpoint"].(string); endpoint != "" {
+			o.BaseEndpoint = aws_sdkv2.String(endpoint)
+		}
+	}), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/redshiftdata/statement.go b/internal/service/redshiftdata/statement.go
index 8cdd5f51f01..9d856acb890 100644
--- a/internal/service/redshiftdata/statement.go
+++ b/internal/service/redshiftdata/statement.go
@@ -1,26 +1,30 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package redshiftdata
 
 import (
 	"context"
 	"errors"
 	"log"
-	"strings"
 	"time"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/redshiftdataapiservice"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/redshiftdata"
+	"github.com/aws/aws-sdk-go-v2/service/redshiftdata/types"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/enum"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
 )
 
 // @SDKResource("aws_redshiftdata_statement")
-func ResourceStatement() *schema.Resource {
+func resourceStatement() *schema.Resource {
 	return &schema.Resource{
 		CreateWithoutTimeout: resourceStatementCreate,
 		ReadWithoutTimeout:   resourceStatementRead,
@@ -102,9 +106,9 @@ func ResourceStatement() *schema.Resource {
 
 func resourceStatementCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).RedshiftDataConn(ctx)
+	conn := meta.(*conns.AWSClient).RedshiftDataClient(ctx)
 
-	input := &redshiftdataapiservice.ExecuteStatementInput{
+	input := &redshiftdata.ExecuteStatementInput{
 		Database:  aws.String(d.Get("database").(string)),
 		Sql:       aws.String(d.Get("sql").(string)),
 		WithEvent: aws.Bool(d.Get("with_event").(bool)),
@@ -134,16 +138,16 @@ func resourceStatementCreate(ctx context.Context, d *schema.ResourceData, meta i
 		input.WorkgroupName = aws.String(v.(string))
 	}
 
-	output, err := conn.ExecuteStatementWithContext(ctx, input)
+	output, err := conn.ExecuteStatement(ctx, input)
 
 	if err != nil {
 		return sdkdiag.AppendErrorf(diags, "executing Redshift Data Statement: %s", err)
 	}
 
-	d.SetId(aws.StringValue(output.Id))
+	d.SetId(aws.ToString(output.Id))
 
 	if _, err := waitStatementFinished(ctx, conn, d.Id(), d.Timeout(schema.TimeoutCreate)); err != nil {
-		return sdkdiag.AppendErrorf(diags, "waiting for Redshift Data Statement (%s) to finish: %s", d.Id(), err)
+		return sdkdiag.AppendErrorf(diags, "waiting for Redshift Data Statement (%s) finish: %s", d.Id(), err)
 	}
 
 	return append(diags, resourceStatementRead(ctx, d, meta)...)
@@ -151,7 +155,7 @@ func resourceStatementCreate(ctx context.Context, d *schema.ResourceData, meta i
 
 func resourceStatementRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).RedshiftDataConn(ctx)
+	conn := meta.(*conns.AWSClient).RedshiftDataClient(ctx)
 
 	sub, err := FindStatementByID(ctx, conn, d.Id())
 
@@ -166,12 +170,12 @@ func resourceStatementRead(ctx context.Context, d *schema.ResourceData, meta int
 	}
 
 	d.Set("cluster_identifier", sub.ClusterIdentifier)
-	d.Set("secret_arn", sub.SecretArn)
 	d.Set("database", d.Get("database").(string))
 	d.Set("db_user", d.Get("db_user").(string))
 	if err := d.Set("parameters", flattenParameters(sub.QueryParameters)); err != nil {
 		return sdkdiag.AppendErrorf(diags, "setting parameters: %s", err)
 	}
+	d.Set("secret_arn", sub.SecretArn)
 	d.Set("sql", sub.QueryString)
 	d.Set("workgroup_name", sub.WorkgroupName)
 
@@ -180,24 +184,24 @@ func resourceStatementRead(ctx context.Context, d *schema.ResourceData, meta int
 
 // FindStatementByID will only find full statement info for statements created recently.
 // For statements that AWS thinks are expired, FindStatementByID will just return a bare bones DescribeStatementOutput w/ only the Id present.
-func FindStatementByID(ctx context.Context, conn *redshiftdataapiservice.RedshiftDataAPIService, id string) (*redshiftdataapiservice.DescribeStatementOutput, error) {
-	input := &redshiftdataapiservice.DescribeStatementInput{
+func FindStatementByID(ctx context.Context, conn *redshiftdata.Client, id string) (*redshiftdata.DescribeStatementOutput, error) {
+	input := &redshiftdata.DescribeStatementInput{
 		Id: aws.String(id),
 	}
 
-	output, err := conn.DescribeStatementWithContext(ctx, input)
+	output, err := conn.DescribeStatement(ctx, input)
 
-	if tfawserr.ErrCodeEquals(err, redshiftdataapiservice.ErrCodeResourceNotFoundException) {
+	if errs.IsA[*types.ResourceNotFoundException](err) {
 		return nil, &retry.NotFoundError{
 			LastError:   err,
 			LastRequest: input,
 		}
 	}
 
-	if tfawserr.ErrCodeEquals(err, redshiftdataapiservice.ErrCodeValidationException) && strings.Contains(err.Error(), "expired") {
-		return &redshiftdataapiservice.DescribeStatementOutput{
+	if errs.IsAErrorMessageContains[*types.ValidationException](err, "expired") {
+		return &redshiftdata.DescribeStatementOutput{
 			Id:     aws.String(id),
-			Status: aws.String("EXPIRED"),
+			Status: types.StatusString("EXPIRED"),
 		}, nil
 	}
 
@@ -212,7 +216,7 @@ func FindStatementByID(ctx context.Context, conn *redshiftdataapiservice.Redshif
 	return output, nil
 }
 
-func statusStatement(ctx context.Context, conn *redshiftdataapiservice.RedshiftDataAPIService, id string) retry.StateRefreshFunc {
+func statusStatement(ctx context.Context, conn *redshiftdata.Client, id string) retry.StateRefreshFunc {
 	return func() (interface{}, string, error) {
 		output, err := FindStatementByID(ctx, conn, id)
 
@@ -224,18 +228,18 @@ func statusStatement(ctx context.Context, conn *redshiftdataapiservice.RedshiftD
 			return nil, "", err
 		}
 
-		return output, aws.StringValue(output.Status), nil
+		return output, string(output.Status), nil
 	}
 }
 
-func waitStatementFinished(ctx context.Context, conn *redshiftdataapiservice.RedshiftDataAPIService, id string, timeout time.Duration) (*redshiftdataapiservice.DescribeStatementOutput, error) {
+func waitStatementFinished(ctx context.Context, conn *redshiftdata.Client, id string, timeout time.Duration) (*redshiftdata.DescribeStatementOutput, error) {
 	stateConf := &retry.StateChangeConf{
-		Pending: []string{
-			redshiftdataapiservice.StatusStringPicked,
-			redshiftdataapiservice.StatusStringStarted,
-			redshiftdataapiservice.StatusStringSubmitted,
-		},
-		Target:     []string{redshiftdataapiservice.StatusStringFinished},
+		Pending: enum.Slice(
+			types.StatusStringPicked,
+			types.StatusStringStarted,
+			types.StatusStringSubmitted,
+		),
+		Target:     enum.Slice(types.StatusStringFinished),
 		Refresh:    statusStatement(ctx, conn, id),
 		Timeout:    timeout,
 		MinTimeout: 10 * time.Second,
@@ -244,9 +248,9 @@ func waitStatementFinished(ctx context.Context, conn *redshiftdataapiservice.Red
 
 	outputRaw, err := stateConf.WaitForStateContext(ctx)
 
-	if output, ok := outputRaw.(*redshiftdataapiservice.DescribeStatementOutput); ok {
-		if status := aws.StringValue(output.Status); status == redshiftdataapiservice.StatusStringFailed {
-			tfresource.SetLastError(err, errors.New(aws.StringValue(output.Error)))
+	if output, ok := outputRaw.(*redshiftdata.DescribeStatementOutput); ok {
+		if status := output.Status; status == types.StatusStringFailed {
+			tfresource.SetLastError(err, errors.New(aws.ToString(output.Error)))
 		}
 
 		return output, err
@@ -255,12 +259,12 @@ func waitStatementFinished(ctx context.Context, conn *redshiftdataapiservice.Red
 	return nil, err
 }
 
-func expandParameter(tfMap map[string]interface{}) *redshiftdataapiservice.SqlParameter {
+func expandParameter(tfMap map[string]interface{}) *types.SqlParameter {
 	if tfMap == nil {
 		return nil
 	}
 
-	apiObject := &redshiftdataapiservice.SqlParameter{}
+	apiObject := &types.SqlParameter{}
 
 	if v, ok := tfMap["name"].(string); ok {
 		apiObject.Name = aws.String(v)
@@ -273,12 +277,12 @@ func expandParameter(tfMap map[string]interface{}) *redshiftdataapiservice.SqlPa
 	return apiObject
 }
 
-func expandParameters(tfList []interface{}) []*redshiftdataapiservice.SqlParameter {
+func expandParameters(tfList []interface{}) []types.SqlParameter {
 	if len(tfList) == 0 {
 		return nil
 	}
 
-	var apiObjects []*redshiftdataapiservice.SqlParameter
+	var apiObjects []types.SqlParameter
 
 	for _, tfMapRaw := range tfList {
 		tfMap, ok := tfMapRaw.(map[string]interface{})
@@ -293,30 +297,26 @@ func expandParameters(tfList []interface{}) []*redshiftdataapiservice.SqlParamet
 			continue
 		}
 
-		apiObjects = append(apiObjects, apiObject)
+		apiObjects = append(apiObjects, *apiObject)
 	}
 
 	return apiObjects
 }
 
-func flattenParameter(apiObject *redshiftdataapiservice.SqlParameter) map[string]interface{} {
-	if apiObject == nil {
-		return nil
-	}
-
+func flattenParameter(apiObject types.SqlParameter) map[string]interface{} {
 	tfMap := map[string]interface{}{}
 
 	if v := apiObject.Name; v != nil {
-		tfMap["name"] = aws.StringValue(v)
+		tfMap["name"] = aws.ToString(v)
 	}
 
 	if v := apiObject.Value; v != nil {
-		tfMap["value"] = aws.StringValue(v)
+		tfMap["value"] = aws.ToString(v)
 	}
 	return tfMap
 }
 
-func flattenParameters(apiObjects []*redshiftdataapiservice.SqlParameter) []interface{} {
+func flattenParameters(apiObjects []types.SqlParameter) []interface{} {
 	if len(apiObjects) == 0 {
 		return nil
 	}
@@ -324,10 +324,6 @@ func flattenParameters(apiObjects []*redshiftdataapiservice.SqlParameter) []inte
 	var tfList []interface{}
 
 	for _, apiObject := range apiObjects {
-		if apiObject == nil {
-			continue
-		}
-
 		tfList = append(tfList, flattenParameter(apiObject))
 	}
 
diff --git a/internal/service/redshiftdata/statement_test.go b/internal/service/redshiftdata/statement_test.go
index de2f6a10713..d40f3a5f583 100644
--- a/internal/service/redshiftdata/statement_test.go
+++ b/internal/service/redshiftdata/statement_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package redshiftdata_test
 
 import (
@@ -5,24 +8,25 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/service/redshiftdataapiservice"
+	"github.com/aws/aws-sdk-go-v2/service/redshiftdata"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	tfredshiftdata "github.com/hashicorp/terraform-provider-aws/internal/service/redshiftdata"
+	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
 func TestAccRedshiftDataStatement_basic(t *testing.T) {
 	ctx := acctest.Context(t)
-	var v redshiftdataapiservice.DescribeStatementOutput
+	var v redshiftdata.DescribeStatementOutput
 	resourceName := "aws_redshiftdata_statement.test"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, redshiftdataapiservice.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.RedshiftDataEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             acctest.CheckDestroyNoop,
 		Steps: []resource.TestStep{
@@ -48,13 +52,13 @@ func TestAccRedshiftDataStatement_basic(t *testing.T) {
 
 func TestAccRedshiftDataStatement_workgroup(t *testing.T) {
 	ctx := acctest.Context(t)
-	var v redshiftdataapiservice.DescribeStatementOutput
+	var v redshiftdata.DescribeStatementOutput
 	resourceName := "aws_redshiftdata_statement.test"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, redshiftdataapiservice.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.RedshiftDataEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             acctest.CheckDestroyNoop,
 		Steps: []resource.TestStep{
@@ -78,18 +82,14 @@ func TestAccRedshiftDataStatement_workgroup(t *testing.T) {
 	})
 }
 
-func testAccCheckStatementExists(ctx context.Context, n string, v *redshiftdataapiservice.DescribeStatementOutput) resource.TestCheckFunc {
+func testAccCheckStatementExists(ctx context.Context, n string, v *redshiftdata.DescribeStatementOutput) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		rs, ok := s.RootModule().Resources[n]
 		if !ok {
 			return fmt.Errorf("Not found: %s", n)
 		}
 
-		if rs.Primary.ID == "" {
-			return fmt.Errorf("No Redshift Data Statement ID is set")
-		}
-
-		conn := acctest.Provider.Meta().(*conns.AWSClient).RedshiftDataConn(ctx)
+		conn := acctest.Provider.Meta().(*conns.AWSClient).RedshiftDataClient(ctx)
 
 		output, err := tfredshiftdata.FindStatementByID(ctx, conn, rs.Primary.ID)
 
diff --git a/internal/service/redshiftserverless/credentials_data_source.go b/internal/service/redshiftserverless/credentials_data_source.go
index b44865c1424..06993853c1c 100644
--- a/internal/service/redshiftserverless/credentials_data_source.go
+++ b/internal/service/redshiftserverless/credentials_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package redshiftserverless
 
 import (
diff --git a/internal/service/redshiftserverless/credentials_data_source_test.go b/internal/service/redshiftserverless/credentials_data_source_test.go
index f68d266b697..21acb11e89f 100644
--- a/internal/service/redshiftserverless/credentials_data_source_test.go
+++ b/internal/service/redshiftserverless/credentials_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package redshiftserverless_test
 
 import (
diff --git a/internal/service/redshiftserverless/endpoint_access.go b/internal/service/redshiftserverless/endpoint_access.go
index dcfc4319040..a98438afcef 100644
--- a/internal/service/redshiftserverless/endpoint_access.go
+++ b/internal/service/redshiftserverless/endpoint_access.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package redshiftserverless
 
 import (
diff --git a/internal/service/redshiftserverless/endpoint_access_test.go b/internal/service/redshiftserverless/endpoint_access_test.go
index 33e5562c709..5af1acd5031 100644
--- a/internal/service/redshiftserverless/endpoint_access_test.go
+++ b/internal/service/redshiftserverless/endpoint_access_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package redshiftserverless_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/redshiftserverless"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -31,7 +34,7 @@ func TestAccRedshiftServerlessEndpointAccess_basic(t *testing.T) {
 				Config: testAccEndpointAccessConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckEndpointAccessExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "redshift-serverless", regexp.MustCompile("managedvpcendpoint/.+$")),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "redshift-serverless", regexache.MustCompile("managedvpcendpoint/.+$")),
 					resource.TestCheckResourceAttr(resourceName, "workgroup_name", rName),
 					resource.TestCheckResourceAttr(resourceName, "endpoint_name", rName),
 					resource.TestCheckResourceAttrSet(resourceName, "port"),
@@ -47,7 +50,7 @@ func TestAccRedshiftServerlessEndpointAccess_basic(t *testing.T) {
 				Config: testAccEndpointAccessConfig_updated(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckEndpointAccessExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "redshift-serverless", regexp.MustCompile("managedvpcendpoint/.+$")),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "redshift-serverless", regexache.MustCompile("managedvpcendpoint/.+$")),
 					resource.TestCheckResourceAttr(resourceName, "workgroup_name", rName),
 					resource.TestCheckResourceAttr(resourceName, "endpoint_name", rName),
 					resource.TestCheckResourceAttrSet(resourceName, "port"),
diff --git a/internal/service/redshiftserverless/find.go b/internal/service/redshiftserverless/find.go
index bec54ac56ce..4d3fa28bdd8 100644
--- a/internal/service/redshiftserverless/find.go
+++ b/internal/service/redshiftserverless/find.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package redshiftserverless
 
 import (
diff --git a/internal/service/redshiftserverless/generate.go b/internal/service/redshiftserverless/generate.go
index 5fdfa7cf3d0..47d2b4c39b3 100644
--- a/internal/service/redshiftserverless/generate.go
+++ b/internal/service/redshiftserverless/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTags -ServiceTagsSlice -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/redshiftserverless/namespace.go b/internal/service/redshiftserverless/namespace.go
index c95c6b15d1c..d3830440e1d 100644
--- a/internal/service/redshiftserverless/namespace.go
+++ b/internal/service/redshiftserverless/namespace.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package redshiftserverless
 
 import (
 	"context"
 	"log"
-	"regexp"
 	"strings"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/aws/aws-sdk-go/service/redshiftserverless"
@@ -256,7 +259,7 @@ func resourceNamespaceDelete(ctx context.Context, d *schema.ResourceData, meta i
 }
 
 var (
-	reIAMRole = regexp.MustCompile(`^\s*IamRole\((.*)\)\s*$`)
+	reIAMRole = regexache.MustCompile(`^\s*IamRole\((.*)\)\s*$`)
 )
 
 func flattenNamespaceIAMRoles(iamRoles []*string) []string {
diff --git a/internal/service/redshiftserverless/namespace_data_source.go b/internal/service/redshiftserverless/namespace_data_source.go
index d119e722949..3ddf6e3481d 100644
--- a/internal/service/redshiftserverless/namespace_data_source.go
+++ b/internal/service/redshiftserverless/namespace_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package redshiftserverless
 
 import (
diff --git a/internal/service/redshiftserverless/namespace_data_source_test.go b/internal/service/redshiftserverless/namespace_data_source_test.go
index 56cc15cb7c1..2770a51a3db 100644
--- a/internal/service/redshiftserverless/namespace_data_source_test.go
+++ b/internal/service/redshiftserverless/namespace_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package redshiftserverless_test
 
 import (
diff --git a/internal/service/redshiftserverless/namespace_test.go b/internal/service/redshiftserverless/namespace_test.go
index 8043657f1a3..6e255b9453e 100644
--- a/internal/service/redshiftserverless/namespace_test.go
+++ b/internal/service/redshiftserverless/namespace_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package redshiftserverless_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/redshiftserverless"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -31,7 +34,7 @@ func TestAccRedshiftServerlessNamespace_basic(t *testing.T) {
 				Config: testAccNamespaceConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckNamespaceExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "redshift-serverless", regexp.MustCompile("namespace/.+$")),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "redshift-serverless", regexache.MustCompile("namespace/.+$")),
 					resource.TestCheckResourceAttr(resourceName, "namespace_name", rName),
 					resource.TestCheckResourceAttrSet(resourceName, "namespace_id"),
 					resource.TestCheckResourceAttr(resourceName, "log_exports.#", "0"),
@@ -48,7 +51,7 @@ func TestAccRedshiftServerlessNamespace_basic(t *testing.T) {
 				Config: testAccNamespaceConfig_updated(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckNamespaceExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "redshift-serverless", regexp.MustCompile("namespace/.+$")),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "redshift-serverless", regexache.MustCompile("namespace/.+$")),
 					resource.TestCheckResourceAttr(resourceName, "namespace_name", rName),
 					resource.TestCheckResourceAttrSet(resourceName, "namespace_id"),
 					resource.TestCheckResourceAttr(resourceName, "log_exports.#", "0"),
diff --git a/internal/service/redshiftserverless/resource_policy.go b/internal/service/redshiftserverless/resource_policy.go
index 238b6f65f32..f7a1a28b859 100644
--- a/internal/service/redshiftserverless/resource_policy.go
+++ b/internal/service/redshiftserverless/resource_policy.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package redshiftserverless
 
 import (
diff --git a/internal/service/redshiftserverless/resource_policy_test.go b/internal/service/redshiftserverless/resource_policy_test.go
index 66dd8b3a1ff..776fb7b0067 100644
--- a/internal/service/redshiftserverless/resource_policy_test.go
+++ b/internal/service/redshiftserverless/resource_policy_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package redshiftserverless_test
 
 import (
diff --git a/internal/service/redshiftserverless/service_package_gen.go b/internal/service/redshiftserverless/service_package_gen.go
index c1a197b3a12..5bcc73bf89c 100644
--- a/internal/service/redshiftserverless/service_package_gen.go
+++ b/internal/service/redshiftserverless/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	redshiftserverless_sdkv1 "github.com/aws/aws-sdk-go/service/redshiftserverless"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -87,4 +88,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*r
 	return redshiftserverless_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/redshiftserverless/snapshot.go b/internal/service/redshiftserverless/snapshot.go
index b5937fc4550..314b1e4387c 100644
--- a/internal/service/redshiftserverless/snapshot.go
+++ b/internal/service/redshiftserverless/snapshot.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package redshiftserverless
 
 import (
diff --git a/internal/service/redshiftserverless/snapshot_test.go b/internal/service/redshiftserverless/snapshot_test.go
index 90b76dbf89a..ce589cdded3 100644
--- a/internal/service/redshiftserverless/snapshot_test.go
+++ b/internal/service/redshiftserverless/snapshot_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package redshiftserverless_test
 
 import (
diff --git a/internal/service/redshiftserverless/status.go b/internal/service/redshiftserverless/status.go
index 7dab7dfdacc..20854b84494 100644
--- a/internal/service/redshiftserverless/status.go
+++ b/internal/service/redshiftserverless/status.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package redshiftserverless
 
 import (
diff --git a/internal/service/redshiftserverless/sweep.go b/internal/service/redshiftserverless/sweep.go
index 2a9f354fd73..bb86d787985 100644
--- a/internal/service/redshiftserverless/sweep.go
+++ b/internal/service/redshiftserverless/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package redshiftserverless
 
@@ -12,9 +12,10 @@ import (
 	"github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_redshiftserverless_namespace", &resource.Sweeper{
 		Name: "aws_redshiftserverless_namespace",
 		F:    sweepNamespaces,
@@ -36,7 +37,7 @@ func init() {
 
 func sweepNamespaces(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
@@ -66,11 +67,11 @@ func sweepNamespaces(region string) error {
 		errs = multierror.Append(errs, fmt.Errorf("error describing Redshift Serverless Namespaces: %w", err))
 	}
 
-	if err = sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err = sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("error sweeping Redshift Serverless Namespaces for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
+	if awsv1.SkipSweepError(errs.ErrorOrNil()) {
 		log.Printf("[WARN] Skipping Redshift Serverless Namespaces sweep for %s: %s", region, errs)
 		return nil
 	}
@@ -80,7 +81,7 @@ func sweepNamespaces(region string) error {
 
 func sweepWorkgroups(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
@@ -110,11 +111,11 @@ func sweepWorkgroups(region string) error {
 		errs = multierror.Append(errs, fmt.Errorf("error describing Redshift Serverless Workgroups: %w", err))
 	}
 
-	if err = sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err = sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("error sweeping Redshift Serverless Workgroups for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
+	if awsv1.SkipSweepError(errs.ErrorOrNil()) {
 		log.Printf("[WARN] Skipping Redshift Serverless Workgroups sweep for %s: %s", region, errs)
 		return nil
 	}
@@ -124,7 +125,7 @@ func sweepWorkgroups(region string) error {
 
 func sweepSnapshots(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
@@ -154,11 +155,11 @@ func sweepSnapshots(region string) error {
 		errs = multierror.Append(errs, fmt.Errorf("error describing Redshift Serverless Snapshots: %w", err))
 	}
 
-	if err = sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err = sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("error sweeping Redshift Serverless Snapshots for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
+	if awsv1.SkipSweepError(errs.ErrorOrNil()) {
 		log.Printf("[WARN] Skipping Redshift Serverless Snapshots sweep for %s: %s", region, errs)
 		return nil
 	}
diff --git a/internal/service/redshiftserverless/tags_gen.go b/internal/service/redshiftserverless/tags_gen.go
index 09618290eec..7c94bf8414a 100644
--- a/internal/service/redshiftserverless/tags_gen.go
+++ b/internal/service/redshiftserverless/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/redshiftserverless"
 	"github.com/aws/aws-sdk-go/service/redshiftserverless/redshiftserverlessiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -102,6 +104,8 @@ func updateTags(ctx context.Context, conn redshiftserverlessiface.RedshiftServer
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.RedshiftServerless)
 	if len(removedTags) > 0 {
diff --git a/internal/service/redshiftserverless/usage_limit.go b/internal/service/redshiftserverless/usage_limit.go
index fc83db6164a..248df18f9a2 100644
--- a/internal/service/redshiftserverless/usage_limit.go
+++ b/internal/service/redshiftserverless/usage_limit.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package redshiftserverless
 
 import (
diff --git a/internal/service/redshiftserverless/usage_limit_test.go b/internal/service/redshiftserverless/usage_limit_test.go
index c2f5b50c562..203c6b3cb58 100644
--- a/internal/service/redshiftserverless/usage_limit_test.go
+++ b/internal/service/redshiftserverless/usage_limit_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package redshiftserverless_test
 
 import (
diff --git a/internal/service/redshiftserverless/wait.go b/internal/service/redshiftserverless/wait.go
index 8eb37906275..71d972d7457 100644
--- a/internal/service/redshiftserverless/wait.go
+++ b/internal/service/redshiftserverless/wait.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package redshiftserverless
 
 import (
diff --git a/internal/service/redshiftserverless/workgroup.go b/internal/service/redshiftserverless/workgroup.go
index ef1feef3542..74a4727d0fd 100644
--- a/internal/service/redshiftserverless/workgroup.go
+++ b/internal/service/redshiftserverless/workgroup.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package redshiftserverless
 
 import (
@@ -77,6 +80,10 @@ func ResourceWorkgroup() *schema.Resource {
 								"max_query_temp_blocks_to_disk",
 								"max_join_row_count",
 								"max_nested_loop_join_row_count",
+								// default SSL parameters automatically added by AWS
+								// https://docs.aws.amazon.com/redshift/latest/mgmt/connecting-ssl-support.html
+								"require_ssl",
+								"use_fips_ssl",
 							}, false),
 							Required: true,
 						},
diff --git a/internal/service/redshiftserverless/workgroup_data_source.go b/internal/service/redshiftserverless/workgroup_data_source.go
index f2b7063a020..398487dfa4f 100644
--- a/internal/service/redshiftserverless/workgroup_data_source.go
+++ b/internal/service/redshiftserverless/workgroup_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package redshiftserverless
 
 import (
diff --git a/internal/service/redshiftserverless/workgroup_data_source_test.go b/internal/service/redshiftserverless/workgroup_data_source_test.go
index 2ff94257fff..253d13627c5 100644
--- a/internal/service/redshiftserverless/workgroup_data_source_test.go
+++ b/internal/service/redshiftserverless/workgroup_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package redshiftserverless_test
 
 import (
diff --git a/internal/service/redshiftserverless/workgroup_test.go b/internal/service/redshiftserverless/workgroup_test.go
index a0cd8dae4ce..8de013e8c28 100644
--- a/internal/service/redshiftserverless/workgroup_test.go
+++ b/internal/service/redshiftserverless/workgroup_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package redshiftserverless_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/redshiftserverless"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -31,7 +34,7 @@ func TestAccRedshiftServerlessWorkgroup_basic(t *testing.T) {
 				Config: testAccWorkgroupConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckWorkgroupExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "redshift-serverless", regexp.MustCompile("workgroup/.+$")),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "redshift-serverless", regexache.MustCompile("workgroup/.+$")),
 					resource.TestCheckResourceAttr(resourceName, "namespace_name", rName),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 					resource.TestCheckResourceAttrSet(resourceName, "workgroup_id"),
@@ -98,7 +101,7 @@ func TestAccRedshiftServerlessWorkgroup_configParameters(t *testing.T) {
 				Config: testAccWorkgroupConfig_configParameters(rName, "14400"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckWorkgroupExists(ctx, resourceName),
-					resource.TestCheckResourceAttr(resourceName, "config_parameter.#", "7"),
+					resource.TestCheckResourceAttr(resourceName, "config_parameter.#", "9"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "config_parameter.*", map[string]string{
 						"parameter_key":   "datestyle",
 						"parameter_value": "ISO, MDY",
@@ -127,6 +130,14 @@ func TestAccRedshiftServerlessWorkgroup_configParameters(t *testing.T) {
 						"parameter_key":   "enable_case_sensitive_identifier",
 						"parameter_value": "false",
 					}),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "config_parameter.*", map[string]string{
+						"parameter_key":   "require_ssl",
+						"parameter_value": "false",
+					}),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "config_parameter.*", map[string]string{
+						"parameter_key":   "use_fips_ssl",
+						"parameter_value": "false",
+					}),
 				),
 			},
 			{
@@ -138,7 +149,7 @@ func TestAccRedshiftServerlessWorkgroup_configParameters(t *testing.T) {
 				Config: testAccWorkgroupConfig_configParameters(rName, "28800"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckWorkgroupExists(ctx, resourceName),
-					resource.TestCheckResourceAttr(resourceName, "config_parameter.#", "7"),
+					resource.TestCheckResourceAttr(resourceName, "config_parameter.#", "9"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "config_parameter.*", map[string]string{
 						"parameter_key":   "datestyle",
 						"parameter_value": "ISO, MDY",
@@ -167,6 +178,14 @@ func TestAccRedshiftServerlessWorkgroup_configParameters(t *testing.T) {
 						"parameter_key":   "enable_case_sensitive_identifier",
 						"parameter_value": "false",
 					}),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "config_parameter.*", map[string]string{
+						"parameter_key":   "require_ssl",
+						"parameter_value": "false",
+					}),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "config_parameter.*", map[string]string{
+						"parameter_key":   "use_fips_ssl",
+						"parameter_value": "false",
+					}),
 				),
 			},
 		},
@@ -350,6 +369,14 @@ resource "aws_redshiftserverless_workgroup" "test" {
     parameter_key   = "enable_case_sensitive_identifier"
     parameter_value = "false"
   }
+  config_parameter {
+    parameter_key   = "require_ssl"
+    parameter_value = "false"
+  }
+  config_parameter {
+    parameter_key   = "use_fips_ssl"
+    parameter_value = "false"
+  }
 }
 `, rName, maxQueryExecutionTime)
 }
diff --git a/internal/service/resourceexplorer2/exports_test.go b/internal/service/resourceexplorer2/exports_test.go
index 9a268bb6eb0..d00e26eb31b 100644
--- a/internal/service/resourceexplorer2/exports_test.go
+++ b/internal/service/resourceexplorer2/exports_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package resourceexplorer2
 
 // Exports for use in tests only.
diff --git a/internal/service/resourceexplorer2/generate.go b/internal/service/resourceexplorer2/generate.go
index 9cffbc40932..03f697850eb 100644
--- a/internal/service/resourceexplorer2/generate.go
+++ b/internal/service/resourceexplorer2/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -AWSSDKVersion=2 -TagInIDElem=ResourceArn -ListTags -ListTagsInIDElem=ResourceArn -ServiceTagsMap -UpdateTags -UntagInTagsElem=TagKeys -KVTValues -SkipTypesImp
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/resourceexplorer2/index.go b/internal/service/resourceexplorer2/index.go
index 9115389e9a5..1a750b63439 100644
--- a/internal/service/resourceexplorer2/index.go
+++ b/internal/service/resourceexplorer2/index.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package resourceexplorer2
 
 import (
@@ -9,7 +12,6 @@ import (
 	"github.com/aws/aws-sdk-go-v2/service/resourceexplorer2"
 	awstypes "github.com/aws/aws-sdk-go-v2/service/resourceexplorer2/types"
 	"github.com/hashicorp/terraform-plugin-framework-timeouts/resource/timeouts"
-	"github.com/hashicorp/terraform-plugin-framework/path"
 	"github.com/hashicorp/terraform-plugin-framework/resource"
 	"github.com/hashicorp/terraform-plugin-framework/resource/schema"
 	"github.com/hashicorp/terraform-plugin-framework/schema/validator"
@@ -20,8 +22,8 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/enum"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/fwdiag"
-	"github.com/hashicorp/terraform-provider-aws/internal/flex"
 	"github.com/hashicorp/terraform-provider-aws/internal/framework"
+	"github.com/hashicorp/terraform-provider-aws/internal/framework/flex"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -40,6 +42,7 @@ func newResourceIndex(context.Context) (resource.ResourceWithConfigure, error) {
 
 type resourceIndex struct {
 	framework.ResourceWithConfigure
+	framework.WithImportByID
 	framework.WithTimeouts
 }
 
@@ -127,7 +130,7 @@ func (r *resourceIndex) Create(ctx context.Context, request resource.CreateReque
 	}
 
 	// Set values for unknowns.
-	data.ARN = types.StringValue(arn)
+	data.Arn = types.StringValue(arn)
 
 	response.Diagnostics.Append(response.State.Set(ctx, &data)...)
 }
@@ -158,8 +161,11 @@ func (r *resourceIndex) Read(ctx context.Context, request resource.ReadRequest,
 		return
 	}
 
-	data.ARN = flex.StringToFramework(ctx, output.Arn)
-	data.Type = flex.StringValueToFramework(ctx, output.Type)
+	response.Diagnostics.Append(flex.Flatten(ctx, output, &data)...)
+
+	if response.Diagnostics.HasError() {
+		return
+	}
 
 	setTagsOut(ctx, output.Tags)
 
@@ -240,16 +246,13 @@ func (r *resourceIndex) Delete(ctx context.Context, request resource.DeleteReque
 	}
 }
 
-func (r *resourceIndex) ImportState(ctx context.Context, request resource.ImportStateRequest, response *resource.ImportStateResponse) {
-	resource.ImportStatePassthroughID(ctx, path.Root("id"), request, response)
-}
-
 func (r *resourceIndex) ModifyPlan(ctx context.Context, request resource.ModifyPlanRequest, response *resource.ModifyPlanResponse) {
 	r.SetTagsAll(ctx, request, response)
 }
 
+// See https://docs.aws.amazon.com/resource-explorer/latest/apireference/API_Index.html.
 type resourceIndexData struct {
-	ARN      types.String   `tfsdk:"arn"`
+	Arn      types.String   `tfsdk:"arn"`
 	ID       types.String   `tfsdk:"id"`
 	Tags     types.Map      `tfsdk:"tags"`
 	TagsAll  types.Map      `tfsdk:"tags_all"`
diff --git a/internal/service/resourceexplorer2/index_test.go b/internal/service/resourceexplorer2/index_test.go
index 0850554dbf5..b8a4710898a 100644
--- a/internal/service/resourceexplorer2/index_test.go
+++ b/internal/service/resourceexplorer2/index_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package resourceexplorer2_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
@@ -32,7 +35,7 @@ func testAccIndex_basic(t *testing.T) {
 				Config: testAccIndexConfig_basic,
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckIndexExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "resource-explorer-2", regexp.MustCompile(`index/+.`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "resource-explorer-2", regexache.MustCompile(`index/+.`)),
 					resource.TestCheckResourceAttr(resourceName, "type", "LOCAL"),
 				),
 			},
diff --git a/internal/service/resourceexplorer2/resourceexplorer2_test.go b/internal/service/resourceexplorer2/resourceexplorer2_test.go
index a793ad90cdf..c94deeec944 100644
--- a/internal/service/resourceexplorer2/resourceexplorer2_test.go
+++ b/internal/service/resourceexplorer2/resourceexplorer2_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package resourceexplorer2_test
 
 import (
diff --git a/internal/service/resourceexplorer2/service_package_gen.go b/internal/service/resourceexplorer2/service_package_gen.go
index 1561aa55661..f5db83fada3 100644
--- a/internal/service/resourceexplorer2/service_package_gen.go
+++ b/internal/service/resourceexplorer2/service_package_gen.go
@@ -7,6 +7,7 @@ import (
 
 	aws_sdkv2 "github.com/aws/aws-sdk-go-v2/aws"
 	resourceexplorer2_sdkv2 "github.com/aws/aws-sdk-go-v2/service/resourceexplorer2"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -54,9 +55,11 @@ func (p *servicePackage) NewClient(ctx context.Context, config map[string]any) (
 
 	return resourceexplorer2_sdkv2.NewFromConfig(cfg, func(o *resourceexplorer2_sdkv2.Options) {
 		if endpoint := config["endpoint"].(string); endpoint != "" {
-			o.EndpointResolver = resourceexplorer2_sdkv2.EndpointResolverFromURL(endpoint)
+			o.BaseEndpoint = aws_sdkv2.String(endpoint)
 		}
 	}), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/resourceexplorer2/sweep.go b/internal/service/resourceexplorer2/sweep.go
index 8faf61392ff..ab11d6171e6 100644
--- a/internal/service/resourceexplorer2/sweep.go
+++ b/internal/service/resourceexplorer2/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package resourceexplorer2
 
@@ -11,10 +11,11 @@ import (
 	"github.com/aws/aws-sdk-go-v2/service/resourceexplorer2"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv2"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep/framework"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_resourceexplorer2_index", &resource.Sweeper{
 		Name: "aws_resourceexplorer2_index",
 		F:    sweepIndexes,
@@ -23,7 +24,7 @@ func init() {
 
 func sweepIndexes(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -35,7 +36,7 @@ func sweepIndexes(region string) error {
 	for pages.HasMorePages() {
 		page, err := pages.NextPage(ctx)
 
-		if sweep.SkipSweepError(err) {
+		if awsv2.SkipSweepError(err) {
 			log.Printf("[WARN] Skipping Resource Explorer Index sweep for %s: %s", region, err)
 			return nil
 		}
@@ -51,7 +52,7 @@ func sweepIndexes(region string) error {
 		}
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping Resource Explorer Indexes (%s): %w", region, err)
diff --git a/internal/service/resourceexplorer2/tags_gen.go b/internal/service/resourceexplorer2/tags_gen.go
index cb7b8e9ff02..f4747b8a2db 100644
--- a/internal/service/resourceexplorer2/tags_gen.go
+++ b/internal/service/resourceexplorer2/tags_gen.go
@@ -7,7 +7,9 @@ import (
 
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/resourceexplorer2"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -53,7 +55,7 @@ func Tags(tags tftags.KeyValueTags) map[string]string {
 	return tags.Map()
 }
 
-// KeyValueTags creates KeyValueTags from resourceexplorer2 service tags.
+// KeyValueTags creates tftags.KeyValueTags from resourceexplorer2 service tags.
 func KeyValueTags(ctx context.Context, tags map[string]string) tftags.KeyValueTags {
 	return tftags.New(ctx, tags)
 }
@@ -84,6 +86,8 @@ func updateTags(ctx context.Context, conn *resourceexplorer2.Client, identifier
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.ResourceExplorer2)
 	if len(removedTags) > 0 {
diff --git a/internal/service/resourceexplorer2/view.go b/internal/service/resourceexplorer2/view.go
index eeb27f7e4c2..55b4d8f072e 100644
--- a/internal/service/resourceexplorer2/view.go
+++ b/internal/service/resourceexplorer2/view.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package resourceexplorer2
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"strings"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/aws/arn"
 	"github.com/aws/aws-sdk-go-v2/service/resourceexplorer2"
@@ -16,6 +19,7 @@ import (
 	"github.com/hashicorp/terraform-plugin-framework/path"
 	"github.com/hashicorp/terraform-plugin-framework/resource"
 	"github.com/hashicorp/terraform-plugin-framework/resource/schema"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema/booldefault"
 	"github.com/hashicorp/terraform-plugin-framework/resource/schema/planmodifier"
 	"github.com/hashicorp/terraform-plugin-framework/resource/schema/stringplanmodifier"
 	"github.com/hashicorp/terraform-plugin-framework/schema/validator"
@@ -26,9 +30,8 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/enum"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/fwdiag"
-	"github.com/hashicorp/terraform-provider-aws/internal/flex"
 	"github.com/hashicorp/terraform-provider-aws/internal/framework"
-	fwboolplanmodifier "github.com/hashicorp/terraform-provider-aws/internal/framework/boolplanmodifier"
+	"github.com/hashicorp/terraform-provider-aws/internal/framework/flex"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -60,9 +63,7 @@ func (r *resourceView) Schema(ctx context.Context, request resource.SchemaReques
 			"default_view": schema.BoolAttribute{
 				Optional: true,
 				Computed: true,
-				PlanModifiers: []planmodifier.Bool{
-					fwboolplanmodifier.DefaultValue(false),
-				},
+				Default:  booldefault.StaticBool(false),
 			},
 			"id": framework.IDAttribute(),
 			"name": schema.StringAttribute{
@@ -72,7 +73,7 @@ func (r *resourceView) Schema(ctx context.Context, request resource.SchemaReques
 				},
 				Validators: []validator.String{
 					stringvalidator.LengthAtMost(64),
-					stringvalidator.RegexMatches(regexp.MustCompile(`^[a-zA-Z0-9\-]+$`), `can include letters, digits, and the dash (-) character`),
+					stringvalidator.RegexMatches(regexache.MustCompile(`^[0-9A-Za-z-]+$`), `can include letters, digits, and the dash (-) character`),
 				},
 			},
 			names.AttrTags:    tftags.TagsAttribute(),
@@ -123,10 +124,10 @@ func (r *resourceView) Create(ctx context.Context, request resource.CreateReques
 
 	input := &resourceexplorer2.CreateViewInput{
 		ClientToken:        aws.String(id.UniqueId()),
-		Filters:            r.expandSearchFilter(ctx, data.Filters),
-		IncludedProperties: r.expandIncludedProperties(ctx, data.IncludedProperties),
+		Filters:            flex.ExpandFrameworkListNestedBlockPtr(ctx, data.Filters, r.expandSearchFilter),
+		IncludedProperties: flex.ExpandFrameworkListNestedBlock(ctx, data.IncludedProperties, r.expandIncludedProperty),
 		Tags:               getTagsIn(ctx),
-		ViewName:           aws.String(data.Name.ValueString()),
+		ViewName:           aws.String(data.ViewName.ValueString()),
 	}
 
 	output, err := conn.CreateView(ctx, input)
@@ -154,7 +155,7 @@ func (r *resourceView) Create(ctx context.Context, request resource.CreateReques
 	}
 
 	// Set values for unknowns.
-	data.ARN = types.StringValue(arn)
+	data.ViewArn = types.StringValue(arn)
 	data.ID = types.StringValue(arn)
 
 	response.Diagnostics.Append(response.State.Set(ctx, &data)...)
@@ -195,12 +196,12 @@ func (r *resourceView) Read(ctx context.Context, request resource.ReadRequest, r
 	}
 
 	view := output.View
-	data.ARN = flex.StringToFramework(ctx, view.ViewArn)
-	data.DefaultView = types.BoolValue(defaultViewARN == data.ARN.ValueString())
+	data.ViewArn = flex.StringToFramework(ctx, view.ViewArn)
+	data.DefaultView = types.BoolValue(defaultViewARN == data.ViewArn.ValueString())
 	data.Filters = r.flattenSearchFilter(ctx, view.Filters)
-	data.IncludedProperties = r.flattenIncludedProperties(ctx, view.IncludedProperties)
+	data.IncludedProperties = flex.FlattenFrameworkListNestedBlock[viewIncludedPropertyData](ctx, view.IncludedProperties, r.flattenIncludedProperty)
 
-	arn, err := arn.Parse(data.ARN.ValueString())
+	arn, err := arn.Parse(data.ViewArn.ValueString())
 
 	if err != nil {
 		response.Diagnostics.AddError("parsing Resource Explorer View ARN", err.Error())
@@ -218,7 +219,7 @@ func (r *resourceView) Read(ctx context.Context, request resource.ReadRequest, r
 	}
 
 	name := parts[1]
-	data.Name = types.StringValue(name)
+	data.ViewName = types.StringValue(name)
 
 	setTagsOut(ctx, output.Tags)
 
@@ -244,8 +245,8 @@ func (r *resourceView) Update(ctx context.Context, request resource.UpdateReques
 
 	if !new.Filters.Equal(old.Filters) || !new.IncludedProperties.Equal(old.IncludedProperties) {
 		input := &resourceexplorer2.UpdateViewInput{
-			Filters:            r.expandSearchFilter(ctx, new.Filters),
-			IncludedProperties: r.expandIncludedProperties(ctx, new.IncludedProperties),
+			Filters:            flex.ExpandFrameworkListNestedBlockPtr(ctx, new.Filters, r.expandSearchFilter),
+			IncludedProperties: flex.ExpandFrameworkListNestedBlock(ctx, new.IncludedProperties, r.expandIncludedProperty),
 			ViewArn:            flex.StringFromFramework(ctx, new.ID),
 		}
 
@@ -320,30 +321,14 @@ func (r *resourceView) ModifyPlan(ctx context.Context, request resource.ModifyPl
 	r.SetTagsAll(ctx, request, response)
 }
 
-func (r *resourceView) expandSearchFilter(ctx context.Context, tfList types.List) *awstypes.SearchFilter {
-	if tfList.IsNull() || tfList.IsUnknown() {
-		return nil
-	}
-
-	var data []viewSearchFilterData
-
-	if diags := tfList.ElementsAs(ctx, &data, false); diags.HasError() {
-		return nil
-	}
-
-	if len(data) == 0 {
-		return nil
-	}
-
-	apiObject := &awstypes.SearchFilter{
-		FilterString: flex.StringFromFramework(ctx, data[0].FilterString),
+func (r *resourceView) expandSearchFilter(ctx context.Context, data viewSearchFilterData) *awstypes.SearchFilter {
+	return &awstypes.SearchFilter{
+		FilterString: flex.StringFromFramework(ctx, data.FilterString),
 	}
-
-	return apiObject
 }
 
 func (r *resourceView) flattenSearchFilter(ctx context.Context, apiObject *awstypes.SearchFilter) types.List {
-	attributeTypes, _ := framework.AttributeTypes[viewSearchFilterData](ctx)
+	attributeTypes := flex.AttributeTypesMust[viewSearchFilterData](ctx)
 	elementType := types.ObjectType{AttrTypes: attributeTypes}
 
 	// The default is
@@ -365,65 +350,26 @@ func (r *resourceView) flattenSearchFilter(ctx context.Context, apiObject *awsty
 	})
 }
 
-func (r *resourceView) expandIncludedProperties(ctx context.Context, tfList types.List) []awstypes.IncludedProperty {
-	if tfList.IsNull() || tfList.IsUnknown() {
-		return nil
-	}
-
-	var data []viewIncludedPropertyData
-
-	if diags := tfList.ElementsAs(ctx, &data, false); diags.HasError() {
-		return nil
-	}
-
-	var apiObjects []awstypes.IncludedProperty
-
-	for _, v := range data {
-		apiObjects = append(apiObjects, r.expandIncludedProperty(ctx, v))
-	}
-
-	return apiObjects
-}
-
 func (r *resourceView) expandIncludedProperty(ctx context.Context, data viewIncludedPropertyData) awstypes.IncludedProperty {
-	apiObject := awstypes.IncludedProperty{
+	return awstypes.IncludedProperty{
 		Name: flex.StringFromFramework(ctx, data.Name),
 	}
-
-	return apiObject
 }
 
-func (r *resourceView) flattenIncludedProperties(ctx context.Context, apiObjects []awstypes.IncludedProperty) types.List {
-	attributeTypes, _ := framework.AttributeTypes[viewIncludedPropertyData](ctx)
-	elementType := types.ObjectType{AttrTypes: attributeTypes}
-
-	if len(apiObjects) == 0 {
-		return types.ListNull(elementType)
+func (r *resourceView) flattenIncludedProperty(ctx context.Context, apiObject awstypes.IncludedProperty) viewIncludedPropertyData {
+	return viewIncludedPropertyData{
+		Name: flex.StringToFramework(ctx, apiObject.Name),
 	}
-
-	var elements []attr.Value
-
-	for _, apiObject := range apiObjects {
-		elements = append(elements, r.flattenIncludedProperty(ctx, apiObject))
-	}
-
-	return types.ListValueMust(elementType, elements)
-}
-
-func (r *resourceView) flattenIncludedProperty(ctx context.Context, apiObject awstypes.IncludedProperty) types.Object {
-	attributeTypes, _ := framework.AttributeTypes[viewIncludedPropertyData](ctx)
-	return types.ObjectValueMust(attributeTypes, map[string]attr.Value{
-		"name": flex.StringToFramework(ctx, apiObject.Name),
-	})
 }
 
+// See https://docs.aws.amazon.com/resource-explorer/latest/apireference/API_View.html.
 type resourceViewData struct {
-	ARN                types.String `tfsdk:"arn"`
+	ViewArn            types.String `tfsdk:"arn"`
 	DefaultView        types.Bool   `tfsdk:"default_view"`
 	Filters            types.List   `tfsdk:"filters"`
 	ID                 types.String `tfsdk:"id"`
 	IncludedProperties types.List   `tfsdk:"included_property"`
-	Name               types.String `tfsdk:"name"`
+	ViewName           types.String `tfsdk:"name"`
 	Tags               types.Map    `tfsdk:"tags"`
 	TagsAll            types.Map    `tfsdk:"tags_all"`
 }
diff --git a/internal/service/resourceexplorer2/view_test.go b/internal/service/resourceexplorer2/view_test.go
index 88da24e4e57..b23a43a1a2b 100644
--- a/internal/service/resourceexplorer2/view_test.go
+++ b/internal/service/resourceexplorer2/view_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package resourceexplorer2_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/service/resourceexplorer2"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -36,7 +39,7 @@ func testAccView_basic(t *testing.T) {
 				Config: testAccViewConfig_basic(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckViewExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "resource-explorer-2", regexp.MustCompile(`view/+.`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "resource-explorer-2", regexache.MustCompile(`view/+.`)),
 					resource.TestCheckResourceAttr(resourceName, "default_view", "false"),
 					resource.TestCheckResourceAttr(resourceName, "filters.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "included_property.#", "0"),
@@ -144,7 +147,7 @@ func testAccView_filter(t *testing.T) {
 				Config: testAccViewConfig_filter(rName, "resourcetype:ec2:instance"),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckViewExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "resource-explorer-2", regexp.MustCompile(`view/+.`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "resource-explorer-2", regexache.MustCompile(`view/+.`)),
 					resource.TestCheckResourceAttr(resourceName, "default_view", "false"),
 					resource.TestCheckResourceAttr(resourceName, "filters.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "filters.0.filter_string", "resourcetype:ec2:instance"),
@@ -163,7 +166,7 @@ func testAccView_filter(t *testing.T) {
 				Config: testAccViewConfig_filter(rName, "region:global"),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckViewExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "resource-explorer-2", regexp.MustCompile(`view/+.`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "resource-explorer-2", regexache.MustCompile(`view/+.`)),
 					resource.TestCheckResourceAttr(resourceName, "default_view", "false"),
 					resource.TestCheckResourceAttr(resourceName, "filters.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "filters.0.filter_string", "region:global"),
diff --git a/internal/service/resourcegroups/exports_test.go b/internal/service/resourcegroups/exports_test.go
new file mode 100644
index 00000000000..e32d42efdb3
--- /dev/null
+++ b/internal/service/resourcegroups/exports_test.go
@@ -0,0 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package resourcegroups
+
+// Exports for use in tests only.
+var (
+	ResourceGroup    = resourceGroup
+	ResourceResource = resourceResource
+
+	FindGroupByName          = findGroupByName
+	FindResourceByTwoPartKey = findResourceByTwoPartKey
+)
diff --git a/internal/service/resourcegroups/generate.go b/internal/service/resourcegroups/generate.go
index 0288794e200..258b0ff3edb 100644
--- a/internal/service/resourcegroups/generate.go
+++ b/internal/service/resourcegroups/generate.go
@@ -1,4 +1,7 @@
-//go:generate go run ../../generate/tags/main.go -ListTags -ListTagsOp=GetTags -ListTagsInIDElem=Arn -ServiceTagsMap -TagOp=Tag -TagInIDElem=Arn -UntagOp=Untag -UntagInTagsElem=Keys -UpdateTags
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+//go:generate go run ../../generate/tags/main.go -AWSSDKVersion=2 -ListTags -ListTagsOp=GetTags -ListTagsInIDElem=Arn -ServiceTagsMap -TagOp=Tag -TagInIDElem=Arn -UntagOp=Untag -UntagInTagsElem=Keys -UpdateTags -KVTValues -SkipTypesImp
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
 
diff --git a/internal/service/resourcegroups/group.go b/internal/service/resourcegroups/group.go
index 008f2cbd473..3405280a3d7 100644
--- a/internal/service/resourcegroups/group.go
+++ b/internal/service/resourcegroups/group.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package resourcegroups
 
 import (
@@ -6,14 +9,16 @@ import (
 	"log"
 	"time"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/resourcegroups"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/resourcegroups"
+	"github.com/aws/aws-sdk-go-v2/service/resourcegroups/types"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/enum"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
@@ -22,7 +27,7 @@ import (
 
 // @SDKResource("aws_resourcegroups_group", name="Group")
 // @Tags(identifierAttribute="arn")
-func ResourceGroup() *schema.Resource {
+func resourceGroup() *schema.Resource {
 	return &schema.Resource{
 		CreateWithoutTimeout: resourceGroupCreate,
 		ReadWithoutTimeout:   resourceGroupRead,
@@ -44,9 +49,8 @@ func ResourceGroup() *schema.Resource {
 				Computed: true,
 			},
 			"configuration": {
-				Type:          schema.TypeSet,
-				Optional:      true,
-				ConflictsWith: []string{"resource_query"},
+				Type:     schema.TypeSet,
+				Optional: true,
 				Elem: &schema.Resource{
 					Schema: map[string]*schema.Schema{
 						"parameters": {
@@ -85,11 +89,10 @@ func ResourceGroup() *schema.Resource {
 				ForceNew: true,
 			},
 			"resource_query": {
-				Type:          schema.TypeList,
-				Optional:      true,
-				MinItems:      1,
-				MaxItems:      1,
-				ConflictsWith: []string{"configuration"},
+				Type:     schema.TypeList,
+				Optional: true,
+				MinItems: 1,
+				MaxItems: 1,
 				Elem: &schema.Resource{
 					Schema: map[string]*schema.Schema{
 						"query": {
@@ -97,12 +100,10 @@ func ResourceGroup() *schema.Resource {
 							Required: true,
 						},
 						"type": {
-							Type:     schema.TypeString,
-							Optional: true,
-							Default:  resourcegroups.QueryTypeTagFilters10,
-							ValidateFunc: validation.StringInSlice([]string{
-								resourcegroups.QueryTypeTagFilters10,
-							}, false),
+							Type:         schema.TypeString,
+							Optional:     true,
+							Default:      types.QueryTypeTagFilters10,
+							ValidateFunc: validation.StringInSlice(enum.Slice(types.QueryTypeTagFilters10), false),
 						},
 					},
 				},
@@ -116,7 +117,7 @@ func ResourceGroup() *schema.Resource {
 }
 
 func resourceGroupCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).ResourceGroupsConn(ctx)
+	conn := meta.(*conns.AWSClient).ResourceGroupsClient(ctx)
 
 	name := d.Get("name").(string)
 	input := &resourcegroups.CreateGroupInput{
@@ -128,22 +129,22 @@ func resourceGroupCreate(ctx context.Context, d *schema.ResourceData, meta inter
 	waitForConfigurationAttached := false
 	if groupCfg, set := d.GetOk("configuration"); set {
 		// Only expand and add configuration if its set
-		input.Configuration = extractResourceGroupConfigurationItems(groupCfg.(*schema.Set).List())
+		input.Configuration = expandGroupConfigurationItems(groupCfg.(*schema.Set).List())
 		waitForConfigurationAttached = true
 	}
 
 	if resourceQuery, set := d.GetOk("resource_query"); set {
 		// Only expand and add resource query if its set
-		input.ResourceQuery = extractResourceGroupResourceQuery(resourceQuery.([]interface{}))
+		input.ResourceQuery = expandResourceQuery(resourceQuery.([]interface{}))
 	}
 
-	output, err := conn.CreateGroupWithContext(ctx, input)
+	output, err := conn.CreateGroup(ctx, input)
 
 	if err != nil {
 		return diag.Errorf("creating Resource Groups Group (%s): %s", name, err)
 	}
 
-	d.SetId(aws.StringValue(output.Group.Name))
+	d.SetId(aws.ToString(output.Group.Name))
 
 	if waitForConfigurationAttached {
 		if _, err := waitGroupConfigurationUpdated(ctx, conn, d.Id(), d.Timeout(schema.TimeoutCreate)); err != nil {
@@ -155,9 +156,9 @@ func resourceGroupCreate(ctx context.Context, d *schema.ResourceData, meta inter
 }
 
 func resourceGroupRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).ResourceGroupsConn(ctx)
+	conn := meta.(*conns.AWSClient).ResourceGroupsClient(ctx)
 
-	group, err := FindGroupByName(ctx, conn, d.Id())
+	group, err := findGroupByName(ctx, conn, d.Id())
 
 	if !d.IsNewResource() && tfresource.NotFound(err) {
 		log.Printf("[WARN] Resource Groups Group %s not found, removing from state", d.Id())
@@ -169,42 +170,47 @@ func resourceGroupRead(ctx context.Context, d *schema.ResourceData, meta interfa
 		return diag.Errorf("reading Resource Groups Group (%s): %s", d.Id(), err)
 	}
 
-	arn := aws.StringValue(group.GroupArn)
+	arn := aws.ToString(group.GroupArn)
 	d.Set("arn", arn)
 	d.Set("description", group.Description)
 	d.Set("name", group.Name)
 
-	q, err := conn.GetGroupQueryWithContext(ctx, &resourcegroups.GetGroupQueryInput{
+	q, err := conn.GetGroupQuery(ctx, &resourcegroups.GetGroupQueryInput{
 		GroupName: aws.String(d.Id()),
 	})
 
-	isConfigurationGroup := false
+	hasQuery := true
 	if err != nil {
-		if tfawserr.ErrCodeEquals(err, resourcegroups.ErrCodeBadRequestException) {
+		if errs.IsA[*types.BadRequestException](err) {
 			// Attempting to get the query on a configuration group returns BadRequestException.
-			isConfigurationGroup = true
+			hasQuery = false
 		} else {
 			return diag.Errorf("reading Resource Groups Group (%s) resource query: %s", d.Id(), err)
 		}
 	}
 
-	if !isConfigurationGroup {
+	groupCfg, err := findGroupConfigurationByGroupName(ctx, conn, d.Id())
+
+	hasConfiguration := true
+	if err != nil {
+		if errs.IsA[*types.BadRequestException](err) {
+			// Attempting to get configuration on a query group returns BadRequestException.
+			hasConfiguration = false
+		} else {
+			return diag.Errorf("reading Resource Groups Group (%s) configuration: %s", d.Id(), err)
+		}
+	}
+
+	if hasQuery {
 		resultQuery := map[string]interface{}{}
-		resultQuery["query"] = aws.StringValue(q.GroupQuery.ResourceQuery.Query)
-		resultQuery["type"] = aws.StringValue(q.GroupQuery.ResourceQuery.Type)
+		resultQuery["query"] = aws.ToString(q.GroupQuery.ResourceQuery.Query)
+		resultQuery["type"] = q.GroupQuery.ResourceQuery.Type
 		if err := d.Set("resource_query", []map[string]interface{}{resultQuery}); err != nil {
 			return diag.Errorf("setting resource_query: %s", err)
 		}
 	}
-
-	if isConfigurationGroup {
-		groupCfg, err := findGroupConfigurationByGroupName(ctx, conn, d.Id())
-
-		if err != nil {
-			return diag.Errorf("reading Resource Groups Group (%s) configuration: %s", d.Id(), err)
-		}
-
-		if err := d.Set("configuration", flattenResourceGroupConfigurationItems(groupCfg.Configuration)); err != nil {
+	if hasConfiguration {
+		if err := d.Set("configuration", flattenGroupConfigurationItems(groupCfg.Configuration)); err != nil {
 			return diag.Errorf("setting configuration: %s", err)
 		}
 	}
@@ -213,7 +219,7 @@ func resourceGroupRead(ctx context.Context, d *schema.ResourceData, meta interfa
 }
 
 func resourceGroupUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).ResourceGroupsConn(ctx)
+	conn := meta.(*conns.AWSClient).ResourceGroupsClient(ctx)
 
 	// Conversion between a resource-query and configuration group is not possible and vice-versa
 	if d.HasChange("configuration") && d.HasChange("resource_query") {
@@ -226,7 +232,7 @@ func resourceGroupUpdate(ctx context.Context, d *schema.ResourceData, meta inter
 			GroupName:   aws.String(d.Id()),
 		}
 
-		_, err := conn.UpdateGroupWithContext(ctx, input)
+		_, err := conn.UpdateGroup(ctx, input)
 
 		if err != nil {
 			return diag.Errorf("updating Resource Groups Group (%s): %s", d.Id(), err)
@@ -236,10 +242,10 @@ func resourceGroupUpdate(ctx context.Context, d *schema.ResourceData, meta inter
 	if d.HasChange("resource_query") {
 		input := &resourcegroups.UpdateGroupQueryInput{
 			GroupName:     aws.String(d.Id()),
-			ResourceQuery: extractResourceGroupResourceQuery(d.Get("resource_query").([]interface{})),
+			ResourceQuery: expandResourceQuery(d.Get("resource_query").([]interface{})),
 		}
 
-		_, err := conn.UpdateGroupQueryWithContext(ctx, input)
+		_, err := conn.UpdateGroupQuery(ctx, input)
 
 		if err != nil {
 			return diag.Errorf("updating Resource Groups Group (%s) resource query: %s", d.Id(), err)
@@ -248,11 +254,11 @@ func resourceGroupUpdate(ctx context.Context, d *schema.ResourceData, meta inter
 
 	if d.HasChange("configuration") {
 		input := &resourcegroups.PutGroupConfigurationInput{
-			Configuration: extractResourceGroupConfigurationItems(d.Get("configuration").(*schema.Set).List()),
+			Configuration: expandGroupConfigurationItems(d.Get("configuration").(*schema.Set).List()),
 			Group:         aws.String(d.Id()),
 		}
 
-		_, err := conn.PutGroupConfigurationWithContext(ctx, input)
+		_, err := conn.PutGroupConfiguration(ctx, input)
 
 		if err != nil {
 			return diag.Errorf("updating Resource Groups Group (%s) configuration: %s", d.Id(), err)
@@ -267,14 +273,14 @@ func resourceGroupUpdate(ctx context.Context, d *schema.ResourceData, meta inter
 }
 
 func resourceGroupDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).ResourceGroupsConn(ctx)
+	conn := meta.(*conns.AWSClient).ResourceGroupsClient(ctx)
 
 	log.Printf("[DEBUG] Deleting Resource Groups Group: %s", d.Id())
-	_, err := conn.DeleteGroupWithContext(ctx, &resourcegroups.DeleteGroupInput{
+	_, err := conn.DeleteGroup(ctx, &resourcegroups.DeleteGroupInput{
 		GroupName: aws.String(d.Id()),
 	})
 
-	if tfawserr.ErrCodeEquals(err, resourcegroups.ErrCodeNotFoundException) {
+	if errs.IsA[*types.NotFoundException](err) {
 		return nil
 	}
 
@@ -285,14 +291,14 @@ func resourceGroupDelete(ctx context.Context, d *schema.ResourceData, meta inter
 	return nil
 }
 
-func FindGroupByName(ctx context.Context, conn *resourcegroups.ResourceGroups, name string) (*resourcegroups.Group, error) {
+func findGroupByName(ctx context.Context, conn *resourcegroups.Client, name string) (*types.Group, error) {
 	input := &resourcegroups.GetGroupInput{
 		GroupName: aws.String(name),
 	}
 
-	output, err := conn.GetGroupWithContext(ctx, input)
+	output, err := conn.GetGroup(ctx, input)
 
-	if tfawserr.ErrCodeEquals(err, resourcegroups.ErrCodeNotFoundException) {
+	if errs.IsA[*types.NotFoundException](err) {
 		return nil, &retry.NotFoundError{
 			LastError:   err,
 			LastRequest: input,
@@ -310,14 +316,14 @@ func FindGroupByName(ctx context.Context, conn *resourcegroups.ResourceGroups, n
 	return output.Group, nil
 }
 
-func findGroupConfigurationByGroupName(ctx context.Context, conn *resourcegroups.ResourceGroups, groupName string) (*resourcegroups.GroupConfiguration, error) {
+func findGroupConfigurationByGroupName(ctx context.Context, conn *resourcegroups.Client, groupName string) (*types.GroupConfiguration, error) {
 	input := &resourcegroups.GetGroupConfigurationInput{
 		Group: aws.String(groupName),
 	}
 
-	output, err := conn.GetGroupConfigurationWithContext(ctx, input)
+	output, err := conn.GetGroupConfiguration(ctx, input)
 
-	if tfawserr.ErrCodeEquals(err, resourcegroups.ErrCodeNotFoundException) {
+	if errs.IsA[*types.NotFoundException](err) {
 		return nil, &retry.NotFoundError{
 			LastError:   err,
 			LastRequest: input,
@@ -335,7 +341,7 @@ func findGroupConfigurationByGroupName(ctx context.Context, conn *resourcegroups
 	return output.GroupConfiguration, nil
 }
 
-func statusGroupConfiguration(ctx context.Context, conn *resourcegroups.ResourceGroups, groupName string) retry.StateRefreshFunc {
+func statusGroupConfiguration(ctx context.Context, conn *resourcegroups.Client, groupName string) retry.StateRefreshFunc {
 	return func() (interface{}, string, error) {
 		output, err := findGroupConfigurationByGroupName(ctx, conn, groupName)
 
@@ -347,23 +353,23 @@ func statusGroupConfiguration(ctx context.Context, conn *resourcegroups.Resource
 			return nil, "", err
 		}
 
-		return output, aws.StringValue(output.Status), nil
+		return output, string(output.Status), nil
 	}
 }
 
-func waitGroupConfigurationUpdated(ctx context.Context, conn *resourcegroups.ResourceGroups, groupName string, timeout time.Duration) (*resourcegroups.GroupConfiguration, error) { //nolint:unparam
+func waitGroupConfigurationUpdated(ctx context.Context, conn *resourcegroups.Client, groupName string, timeout time.Duration) (*types.GroupConfiguration, error) { //nolint:unparam
 	stateConf := &retry.StateChangeConf{
-		Pending: []string{resourcegroups.GroupConfigurationStatusUpdating},
-		Target:  []string{resourcegroups.GroupConfigurationStatusUpdateComplete},
+		Pending: enum.Slice(types.GroupConfigurationStatusUpdating),
+		Target:  enum.Slice(types.GroupConfigurationStatusUpdateComplete),
 		Refresh: statusGroupConfiguration(ctx, conn, groupName),
 		Timeout: timeout,
 	}
 
 	outputRaw, err := stateConf.WaitForStateContext(ctx)
 
-	if output, ok := outputRaw.(*resourcegroups.GroupConfiguration); ok {
-		if status := aws.StringValue(output.Status); status == resourcegroups.GroupConfigurationStatusUpdateFailed {
-			tfresource.SetLastError(err, errors.New(aws.StringValue(output.FailureReason)))
+	if output, ok := outputRaw.(*types.GroupConfiguration); ok {
+		if status := output.Status; status == types.GroupConfigurationStatusUpdateFailed {
+			tfresource.SetLastError(err, errors.New(aws.ToString(output.FailureReason)))
 		}
 
 		return output, err
@@ -372,8 +378,8 @@ func waitGroupConfigurationUpdated(ctx context.Context, conn *resourcegroups.Res
 	return nil, err
 }
 
-func extractResourceGroupConfigurationParameters(parameterList []interface{}) []*resourcegroups.GroupConfigurationParameter {
-	var parameters []*resourcegroups.GroupConfigurationParameter
+func expandGroupConfigurationParameters(parameterList []interface{}) []types.GroupConfigurationParameter {
+	var parameters []types.GroupConfigurationParameter
 
 	for _, param := range parameterList {
 		parameter := param.(map[string]interface{})
@@ -381,22 +387,22 @@ func extractResourceGroupConfigurationParameters(parameterList []interface{}) []
 		for _, val := range parameter["values"].([]interface{}) {
 			values = append(values, val.(string))
 		}
-		parameters = append(parameters, &resourcegroups.GroupConfigurationParameter{
+		parameters = append(parameters, types.GroupConfigurationParameter{
 			Name:   aws.String(parameter["name"].(string)),
-			Values: aws.StringSlice(values),
+			Values: values,
 		})
 	}
 
 	return parameters
 }
 
-func extractResourceGroupConfigurationItems(configurationItemList []interface{}) []*resourcegroups.GroupConfigurationItem {
-	var configurationItems []*resourcegroups.GroupConfigurationItem
+func expandGroupConfigurationItems(configurationItemList []interface{}) []types.GroupConfigurationItem {
+	var configurationItems []types.GroupConfigurationItem
 
 	for _, configItem := range configurationItemList {
 		configItemMap := configItem.(map[string]interface{})
-		configurationItems = append(configurationItems, &resourcegroups.GroupConfigurationItem{
-			Parameters: extractResourceGroupConfigurationParameters(configItemMap["parameters"].(*schema.Set).List()),
+		configurationItems = append(configurationItems, types.GroupConfigurationItem{
+			Parameters: expandGroupConfigurationParameters(configItemMap["parameters"].(*schema.Set).List()),
 			Type:       aws.String(configItemMap["type"].(string)),
 		})
 	}
@@ -404,39 +410,40 @@ func extractResourceGroupConfigurationItems(configurationItemList []interface{})
 	return configurationItems
 }
 
-func flattenResourceGroupConfigurationParameter(param *resourcegroups.GroupConfigurationParameter) map[string]interface{} {
-	if param == nil {
-		return nil
+func expandResourceQuery(resourceQueryList []interface{}) *types.ResourceQuery {
+	resourceQuery := resourceQueryList[0].(map[string]interface{})
+
+	return &types.ResourceQuery{
+		Query: aws.String(resourceQuery["query"].(string)),
+		Type:  types.QueryType(resourceQuery["type"].(string)),
 	}
+}
 
+func flattenGroupConfigurationParameter(param types.GroupConfigurationParameter) map[string]interface{} {
 	tfMap := map[string]interface{}{}
 
 	if v := param.Name; v != nil {
-		tfMap["name"] = aws.StringValue(param.Name)
+		tfMap["name"] = aws.ToString(param.Name)
 	}
 
 	if v := param.Values; v != nil {
-		tfMap["values"] = aws.StringValueSlice(v)
+		tfMap["values"] = v
 	}
 
 	return tfMap
 }
 
-func flattenResourceGroupConfigurationItem(configuration *resourcegroups.GroupConfigurationItem) map[string]interface{} {
-	if configuration == nil {
-		return nil
-	}
-
+func flattenGroupConfigurationItem(configuration types.GroupConfigurationItem) map[string]interface{} {
 	tfMap := map[string]interface{}{}
 
 	if v := configuration.Type; v != nil {
-		tfMap["type"] = aws.StringValue(v)
+		tfMap["type"] = aws.ToString(v)
 	}
 
 	if v := configuration.Parameters; v != nil {
 		var params []interface{}
 		for _, param := range v {
-			params = append(params, flattenResourceGroupConfigurationParameter(param))
+			params = append(params, flattenGroupConfigurationParameter(param))
 		}
 		tfMap["parameters"] = params
 	}
@@ -444,7 +451,7 @@ func flattenResourceGroupConfigurationItem(configuration *resourcegroups.GroupCo
 	return tfMap
 }
 
-func flattenResourceGroupConfigurationItems(configurationItems []*resourcegroups.GroupConfigurationItem) []interface{} {
+func flattenGroupConfigurationItems(configurationItems []types.GroupConfigurationItem) []interface{} {
 	if len(configurationItems) == 0 {
 		return nil
 	}
@@ -452,21 +459,8 @@ func flattenResourceGroupConfigurationItems(configurationItems []*resourcegroups
 	var tfList []interface{}
 
 	for _, configuration := range configurationItems {
-		if configuration == nil {
-			continue
-		}
-
-		tfList = append(tfList, flattenResourceGroupConfigurationItem(configuration))
+		tfList = append(tfList, flattenGroupConfigurationItem(configuration))
 	}
 
 	return tfList
 }
-
-func extractResourceGroupResourceQuery(resourceQueryList []interface{}) *resourcegroups.ResourceQuery {
-	resourceQuery := resourceQueryList[0].(map[string]interface{})
-
-	return &resourcegroups.ResourceQuery{
-		Query: aws.String(resourceQuery["query"].(string)),
-		Type:  aws.String(resourceQuery["type"].(string)),
-	}
-}
diff --git a/internal/service/resourcegroups/group_test.go b/internal/service/resourcegroups/group_test.go
index f071e1ec566..3de7a3fab8a 100644
--- a/internal/service/resourcegroups/group_test.go
+++ b/internal/service/resourcegroups/group_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package resourcegroups_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/service/resourcegroups"
+	"github.com/YakDriver/regexache"
+	"github.com/aws/aws-sdk-go-v2/service/resourcegroups/types"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
@@ -14,11 +17,12 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	tfresourcegroups "github.com/hashicorp/terraform-provider-aws/internal/service/resourcegroups"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
 func TestAccResourceGroupsGroup_basic(t *testing.T) {
 	ctx := acctest.Context(t)
-	var v resourcegroups.Group
+	var v types.Group
 	resourceName := "aws_resourcegroups_group.test"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
@@ -41,7 +45,7 @@ func TestAccResourceGroupsGroup_basic(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, resourcegroups.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.ResourceGroupsEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckResourceGroupDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -71,16 +75,40 @@ func TestAccResourceGroupsGroup_basic(t *testing.T) {
 	})
 }
 
+func TestAccResourceGroupsGroup_disappears(t *testing.T) {
+	ctx := acctest.Context(t)
+	var v types.Group
+	resourceName := "aws_resourcegroups_group.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, names.ResourceGroupsEndpointID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckResourceGroupDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccGroupConfig_basic(rName, "Hello World", testAccResourceGroupQueryConfig),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckResourceGroupExists(ctx, resourceName, &v),
+					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfresourcegroups.ResourceGroup(), resourceName),
+				),
+				ExpectNonEmptyPlan: true,
+			},
+		},
+	})
+}
+
 func TestAccResourceGroupsGroup_tags(t *testing.T) {
 	ctx := acctest.Context(t)
-	var v resourcegroups.Group
+	var v types.Group
 	resourceName := "aws_resourcegroups_group.test"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	desc1 := "Hello World"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, resourcegroups.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.ResourceGroupsEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckResourceGroupDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -120,7 +148,7 @@ func TestAccResourceGroupsGroup_tags(t *testing.T) {
 
 func TestAccResourceGroupsGroup_Configuration(t *testing.T) {
 	ctx := acctest.Context(t)
-	var v resourcegroups.Group
+	var v types.Group
 	resourceName := "aws_resourcegroups_group.test"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
@@ -131,7 +159,7 @@ func TestAccResourceGroupsGroup_Configuration(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, resourcegroups.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.ResourceGroupsEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckResourceGroupDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -180,7 +208,7 @@ func TestAccResourceGroupsGroup_Configuration(t *testing.T) {
 			// Check that trying to change the configuration group to a resource-query group fails
 			{
 				Config:      testAccGroupConfig_basic(rName, desc1, testAccResourceGroupQueryConfig),
-				ExpectError: regexp.MustCompile(`conversion between resource-query and configuration group types is not possible`),
+				ExpectError: regexache.MustCompile(`conversion between resource-query and configuration group types is not possible`),
 			},
 		},
 	})
@@ -188,7 +216,7 @@ func TestAccResourceGroupsGroup_Configuration(t *testing.T) {
 
 func TestAccResourceGroupsGroup_configurationParametersOptional(t *testing.T) {
 	ctx := acctest.Context(t)
-	var v resourcegroups.Group
+	var v types.Group
 	resourceName := "aws_resourcegroups_group.test"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
@@ -197,7 +225,7 @@ func TestAccResourceGroupsGroup_configurationParametersOptional(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, resourcegroups.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.ResourceGroupsEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckResourceGroupDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -223,18 +251,48 @@ func TestAccResourceGroupsGroup_configurationParametersOptional(t *testing.T) {
 	})
 }
 
-func testAccCheckResourceGroupExists(ctx context.Context, n string, v *resourcegroups.Group) resource.TestCheckFunc {
+func TestAccResourceGroupsGroup_resourceQueryAndConfiguration(t *testing.T) {
+	ctx := acctest.Context(t)
+	var v types.Group
+	resourceName := "aws_resourcegroups_group.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+
+	configType := "AWS::NetworkFirewall::RuleGroup"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, names.ResourceGroupsEndpointID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckResourceGroupDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccGroupConfig_resourceQueryAndConfiguration(rName, testAccResourceGroupQueryConfig, configType),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckResourceGroupExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "name", rName),
+					resource.TestCheckResourceAttrSet(resourceName, "arn"),
+					resource.TestCheckResourceAttr(resourceName, "resource_query.0.query", testAccResourceGroupQueryConfig+"\n"),
+					resource.TestCheckResourceAttr(resourceName, "configuration.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "configuration.0.type", configType),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
+func testAccCheckResourceGroupExists(ctx context.Context, n string, v *types.Group) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		rs, ok := s.RootModule().Resources[n]
 		if !ok {
 			return fmt.Errorf("Not found: %s", n)
 		}
 
-		if rs.Primary.ID == "" {
-			return fmt.Errorf("No Resource Groups Group ID is set")
-		}
-
-		conn := acctest.Provider.Meta().(*conns.AWSClient).ResourceGroupsConn(ctx)
+		conn := acctest.Provider.Meta().(*conns.AWSClient).ResourceGroupsClient(ctx)
 
 		output, err := tfresourcegroups.FindGroupByName(ctx, conn, rs.Primary.ID)
 
@@ -250,7 +308,7 @@ func testAccCheckResourceGroupExists(ctx context.Context, n string, v *resourceg
 
 func testAccCheckResourceGroupDestroy(ctx context.Context) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		conn := acctest.Provider.Meta().(*conns.AWSClient).ResourceGroupsConn(ctx)
+		conn := acctest.Provider.Meta().(*conns.AWSClient).ResourceGroupsClient(ctx)
 
 		for _, rs := range s.RootModule().Resources {
 			if rs.Type != "aws_resourcegroups_group" {
@@ -425,3 +483,22 @@ resource "aws_resourcegroups_group" "test" {
 }
 `, rName, configType1, configType2)
 }
+
+func testAccGroupConfig_resourceQueryAndConfiguration(rName, query, configType string) string {
+	return fmt.Sprintf(`
+resource "aws_resourcegroups_group" "test" {
+  name = %[1]q
+
+  resource_query {
+    query = <<JSON
+%[2]s
+JSON
+
+  }
+
+  configuration {
+    type = %[3]q
+  }
+}
+`, rName, query, configType)
+}
diff --git a/internal/service/resourcegroups/resource.go b/internal/service/resourcegroups/resource.go
index 34560dbdee5..80099777f6e 100644
--- a/internal/service/resourcegroups/resource.go
+++ b/internal/service/resourcegroups/resource.go
@@ -1,25 +1,31 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package resourcegroups
 
 import (
 	"context"
+	"errors"
+	"fmt"
 	"log"
 	"strings"
 	"time"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/resourcegroups"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/resourcegroups"
+	"github.com/aws/aws-sdk-go-v2/service/resourcegroups/types"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
-	"github.com/hashicorp/terraform-provider-aws/internal/create"
+	"github.com/hashicorp/terraform-provider-aws/internal/enum"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs"
+	"github.com/hashicorp/terraform-provider-aws/internal/slices"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
-	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
 // @SDKResource("aws_resourcegroups_resource", name="Resource")
-func ResourceResource() *schema.Resource {
+func resourceResource() *schema.Resource {
 	return &schema.Resource{
 		CreateWithoutTimeout: resourceResourceCreate,
 		ReadWithoutTimeout:   resourceResourceRead,
@@ -49,41 +55,40 @@ func ResourceResource() *schema.Resource {
 	}
 }
 
-const (
-	ResNameResource = "Resource"
-)
-
 func resourceResourceCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).ResourceGroupsConn(ctx)
+	conn := meta.(*conns.AWSClient).ResourceGroupsClient(ctx)
+
+	groupARN := d.Get("group_arn").(string)
+	resourceARN := d.Get("resource_arn").(string)
+	id := strings.Join([]string{strings.Split(strings.ToLower(groupARN), "/")[1], strings.Split(resourceARN, "/")[1]}, "_")
+	input := &resourcegroups.GroupResourcesInput{
+		Group:        aws.String(groupARN),
+		ResourceArns: []string{resourceARN},
+	}
 
-	group := d.Get("group_arn").(string)
-	resourceArn := d.Get("resource_arn").(string)
+	output, err := conn.GroupResources(ctx, input)
 
-	in := &resourcegroups.GroupResourcesInput{
-		Group:        aws.String(group),
-		ResourceArns: []*string{&resourceArn},
+	if err == nil {
+		err = failedResourcesError(output.Failed)
 	}
 
-	_, err := conn.GroupResourcesWithContext(ctx, in)
-
 	if err != nil {
-		return create.DiagError(names.ResourceGroups, create.ErrActionCreating, ResNameResource, d.Get("name").(string), err)
+		return diag.Errorf("creating Resource Groups Resource (%s): %s", id, err)
 	}
 
-	vars := []string{
-		strings.Split(strings.ToLower(d.Get("group_arn").(string)), "/")[1],
-		strings.Split(d.Get("resource_arn").(string), "/")[1],
-	}
+	d.SetId(id)
 
-	d.SetId(strings.Join(vars, "_"))
+	if _, err := waitResourceCreated(ctx, conn, groupARN, resourceARN, d.Timeout(schema.TimeoutDelete)); err != nil {
+		return diag.Errorf("waiting for Resource Groups Resource (%s) create: %s", d.Id(), err)
+	}
 
 	return resourceResourceRead(ctx, d, meta)
 }
 
 func resourceResourceRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).ResourceGroupsConn(ctx)
+	conn := meta.(*conns.AWSClient).ResourceGroupsClient(ctx)
 
-	out, err := FindResourceByARN(ctx, conn, d.Get("group_arn").(string), d.Get("resource_arn").(string))
+	output, err := findResourceByTwoPartKey(ctx, conn, d.Get("group_arn").(string), d.Get("resource_arn").(string))
 
 	if !d.IsNewResource() && tfresource.NotFound(err) {
 		log.Printf("[WARN] ResourceGroups Resource (%s) not found, removing from state", d.Id())
@@ -92,66 +97,141 @@ func resourceResourceRead(ctx context.Context, d *schema.ResourceData, meta inte
 	}
 
 	if err != nil {
-		return create.DiagError(names.ResourceGroups, create.ErrActionReading, ResNameResource, d.Id(), err)
+		return diag.Errorf("reading Resource Groups Resource (%s): %s", d.Id(), err)
 	}
 
-	d.Set("resource_arn", out.Identifier.ResourceArn)
-	d.Set("resource_type", out.Identifier.ResourceType)
+	d.Set("resource_arn", output.Identifier.ResourceArn)
+	d.Set("resource_type", output.Identifier.ResourceType)
 
 	return nil
 }
 
 func resourceResourceDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).ResourceGroupsConn(ctx)
-
-	log.Printf("[INFO] Deleting ResourceGroups Resource %s", d.Id())
+	conn := meta.(*conns.AWSClient).ResourceGroupsClient(ctx)
 
-	group := d.Get("group_arn").(string)
-	resourceArn := d.Get("resource_arn").(string)
+	groupARN := d.Get("group_arn").(string)
+	resourceARN := d.Get("resource_arn").(string)
 
-	_, err := conn.UngroupResourcesWithContext(ctx, &resourcegroups.UngroupResourcesInput{
-		Group:        aws.String(group),
-		ResourceArns: []*string{&resourceArn},
+	log.Printf("[INFO] Deleting Resource Groups Resource: %s", d.Id())
+	output, err := conn.UngroupResources(ctx, &resourcegroups.UngroupResourcesInput{
+		Group:        aws.String(groupARN),
+		ResourceArns: []string{resourceARN},
 	})
 
-	if err != nil {
-		return create.DiagError(names.ResourceGroups, create.ErrActionDeleting, ResNameResource, d.Id(), err)
+	if err == nil {
+		err = failedResourcesError(output.Failed)
 	}
 
-	_, err = tfresource.RetryUntilNotFound(ctx, d.Timeout(schema.TimeoutDelete), func() (interface{}, error) {
-		return FindResourceByARN(ctx, conn, d.Get("group_arn").(string), d.Get("resource_arn").(string))
-	})
-
 	if err != nil {
-		return create.DiagError(names.ResourceGroups, create.ErrActionDeleting, ResNameResource, d.Id(), err)
+		return diag.Errorf("deleting Resource Groups Resource (%s): %s", d.Id(), err)
+	}
+
+	if _, err := waitResourceDeleted(ctx, conn, groupARN, resourceARN, d.Timeout(schema.TimeoutDelete)); err != nil {
+		return diag.Errorf("waiting for Resource Groups Resource (%s) delete: %s", d.Id(), err)
 	}
 
 	return nil
 }
 
-func FindResourceByARN(ctx context.Context, conn *resourcegroups.ResourceGroups, groupArn, resourceArn string) (*resourcegroups.ListGroupResourcesItem, error) {
+func findResourceByTwoPartKey(ctx context.Context, conn *resourcegroups.Client, groupARN, resourceARN string) (*types.ListGroupResourcesItem, error) {
 	input := &resourcegroups.ListGroupResourcesInput{
-		Group: aws.String(groupArn),
+		Group: aws.String(groupARN),
 	}
+	var output []types.ListGroupResourcesItem
+
+	pages := resourcegroups.NewListGroupResourcesPaginator(conn, input)
+	for pages.HasMorePages() {
+		page, err := pages.NextPage(ctx)
 
-	output, err := conn.ListGroupResourcesWithContext(ctx, input)
+		if errs.IsA[*types.NotFoundException](err) {
+			return nil, &retry.NotFoundError{
+				LastError:   err,
+				LastRequest: input,
+			}
+		}
 
-	if tfawserr.ErrCodeEquals(err, resourcegroups.ErrCodeNotFoundException) {
-		return nil, &retry.NotFoundError{
-			LastError:   err,
-			LastRequest: input,
+		if err != nil {
+			return nil, err
 		}
+
+		output = append(output, page.Resources...)
 	}
 
-	if err != nil {
-		return nil, err
+	output = slices.Filter(output, func(v types.ListGroupResourcesItem) bool {
+		return v.Identifier != nil && aws.ToString(v.Identifier.ResourceArn) == resourceARN
+	})
+
+	return tfresource.AssertSingleValueResult(output)
+}
+
+func statusResource(ctx context.Context, conn *resourcegroups.Client, groupARN, resourceARN string) retry.StateRefreshFunc {
+	return func() (interface{}, string, error) {
+		output, err := findResourceByTwoPartKey(ctx, conn, groupARN, resourceARN)
+
+		if tfresource.NotFound(err) {
+			return nil, "", nil
+		}
+
+		if err != nil {
+			return nil, "", err
+		}
+
+		if output.Status == nil {
+			return output, "", nil
+		}
+
+		return output, string(output.Status.Name), nil
+	}
+}
+
+func waitResourceCreated(ctx context.Context, conn *resourcegroups.Client, groupARN, resourceARN string, timeout time.Duration) (*types.ListGroupResourcesItem, error) {
+	stateConf := &retry.StateChangeConf{
+		Pending: enum.Slice(types.ResourceStatusValuePending),
+		Target:  []string{""},
+		Refresh: statusResource(ctx, conn, groupARN, resourceARN),
+		Timeout: timeout,
+	}
+
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+
+	if output, ok := outputRaw.(*types.ListGroupResourcesItem); ok {
+		return output, err
 	}
 
-	for _, resourceItem := range output.Resources {
-		if aws.StringValue(resourceItem.Identifier.ResourceArn) == resourceArn {
-			return resourceItem, nil
+	return nil, err
+}
+
+func waitResourceDeleted(ctx context.Context, conn *resourcegroups.Client, groupARN, resourceARN string, timeout time.Duration) (*types.ListGroupResourcesItem, error) {
+	stateConf := &retry.StateChangeConf{
+		Pending: enum.Slice(types.ResourceStatusValuePending),
+		Target:  []string{},
+		Refresh: statusResource(ctx, conn, groupARN, resourceARN),
+		Timeout: timeout,
+	}
+
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+
+	if output, ok := outputRaw.(*types.ListGroupResourcesItem); ok {
+		return output, err
+	}
+
+	return nil, err
+}
+
+func failedResourceError(apiObject types.FailedResource) error {
+	return fmt.Errorf("%s: %s", aws.ToString(apiObject.ErrorCode), aws.ToString(apiObject.ErrorMessage))
+}
+
+func failedResourcesError(apiObjects []types.FailedResource) error {
+	var errs []error
+
+	for _, apiObject := range apiObjects {
+		err := failedResourceError(apiObject)
+
+		if err != nil {
+			errs = append(errs, fmt.Errorf("%s: %w", aws.ToString(apiObject.ResourceArn), err))
 		}
 	}
 
-	return nil, tfresource.NewEmptyResultError(input)
+	return errors.Join(errs...)
 }
diff --git a/internal/service/resourcegroups/resource_test.go b/internal/service/resourcegroups/resource_test.go
index 2e5cce59307..ce042379739 100644
--- a/internal/service/resourcegroups/resource_test.go
+++ b/internal/service/resourcegroups/resource_test.go
@@ -1,34 +1,33 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package resourcegroups_test
 
 import (
 	"context"
-	"errors"
 	"fmt"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/service/resourcegroups"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/aws/aws-sdk-go-v2/service/resourcegroups/types"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
-	"github.com/hashicorp/terraform-provider-aws/internal/create"
 	tfresourcegroups "github.com/hashicorp/terraform-provider-aws/internal/service/resourcegroups"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
 func TestAccResourceGroupsResource_basic(t *testing.T) {
-	ctx := context.Background()
-	var r resourcegroups.ListGroupResourcesItem
+	ctx := acctest.Context(t)
+	var r types.ListGroupResourcesItem
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_resourcegroups_resource.test"
 
 	resource.ParallelTest(t, resource.TestCase{
-		PreCheck: func() {
-			acctest.PreCheck(ctx, t)
-		},
-		ErrorCheck:               acctest.ErrorCheck(t, resourcegroups.EndpointsID),
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, names.ResourceGroupsEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckResourceDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -47,49 +46,46 @@ func TestAccResourceGroupsResource_basic(t *testing.T) {
 
 func testAccCheckResourceDestroy(ctx context.Context) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		conn := acctest.Provider.Meta().(*conns.AWSClient).ResourceGroupsConn(ctx)
+		conn := acctest.Provider.Meta().(*conns.AWSClient).ResourceGroupsClient(ctx)
 
 		for _, rs := range s.RootModule().Resources {
 			if rs.Type != "aws_resourcegroups_resource" {
 				continue
 			}
 
-			_, err := tfresourcegroups.FindResourceByARN(ctx, conn, rs.Primary.Attributes["group_arn"], rs.Primary.Attributes["resource_arn"])
+			_, err := tfresourcegroups.FindResourceByTwoPartKey(ctx, conn, rs.Primary.Attributes["group_arn"], rs.Primary.Attributes["resource_arn"])
+
+			if tfresource.NotFound(err) {
+				continue
+			}
 
 			if err != nil {
-				if tfawserr.ErrCodeEquals(err, resourcegroups.ErrCodeNotFoundException) {
-					return nil
-				}
 				return err
 			}
 
-			return create.Error(names.ResourceGroups, create.ErrActionCheckingDestroyed, tfresourcegroups.ResNameResource, rs.Primary.ID, errors.New("not destroyed"))
+			return fmt.Errorf("Resource Groups Resource %s still exists", rs.Primary.ID)
 		}
 
 		return nil
 	}
 }
 
-func testAccCheckResourceExists(ctx context.Context, name string, resource *resourcegroups.ListGroupResourcesItem) resource.TestCheckFunc {
+func testAccCheckResourceExists(ctx context.Context, n string, v *types.ListGroupResourcesItem) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		rs, ok := s.RootModule().Resources[name]
+		rs, ok := s.RootModule().Resources[n]
 		if !ok {
-			return create.Error(names.ResourceGroups, create.ErrActionCheckingExistence, tfresourcegroups.ResNameResource, name, errors.New("not found"))
-		}
-
-		if rs.Primary.ID == "" {
-			return create.Error(names.ResourceGroups, create.ErrActionCheckingExistence, tfresourcegroups.ResNameResource, name, errors.New("not set"))
+			return fmt.Errorf("Not found: %s", n)
 		}
 
-		conn := acctest.Provider.Meta().(*conns.AWSClient).ResourceGroupsConn(ctx)
+		conn := acctest.Provider.Meta().(*conns.AWSClient).ResourceGroupsClient(ctx)
 
-		resp, err := tfresourcegroups.FindResourceByARN(ctx, conn, rs.Primary.Attributes["group_arn"], rs.Primary.Attributes["resource_arn"])
+		output, err := tfresourcegroups.FindResourceByTwoPartKey(ctx, conn, rs.Primary.Attributes["group_arn"], rs.Primary.Attributes["resource_arn"])
 
 		if err != nil {
-			return create.Error(names.ResourceGroups, create.ErrActionCheckingExistence, tfresourcegroups.ResNameResource, rs.Primary.ID, err)
+			return err
 		}
 
-		*resource = *resp
+		*v = *output
 
 		return nil
 	}
@@ -126,29 +122,32 @@ resource "aws_resourcegroups_group" "test" {
         "false"
       ]
     }
+
     parameters {
       name = "auto-host-recovery"
       values = [
         "false"
       ]
     }
+
     parameters {
       name = "auto-release-host"
       values = [
         "false"
       ]
     }
-
   }
 
   configuration {
     type = "AWS::ResourceGroups::Generic"
+
     parameters {
       name = "allowed-resource-types"
       values = [
         "AWS::EC2::Host"
       ]
     }
+
     parameters {
       name = "deletion-protection"
       values = [
@@ -156,9 +155,9 @@ resource "aws_resourcegroups_group" "test" {
       ]
     }
   }
-}
-
 
+  depends_on = [aws_ec2_host.test]
+}
 `, rName))
 }
 
diff --git a/internal/service/resourcegroups/service_package_gen.go b/internal/service/resourcegroups/service_package_gen.go
index d205db40a44..c2c6344d0b0 100644
--- a/internal/service/resourcegroups/service_package_gen.go
+++ b/internal/service/resourcegroups/service_package_gen.go
@@ -5,9 +5,9 @@ package resourcegroups
 import (
 	"context"
 
-	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
-	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
-	resourcegroups_sdkv1 "github.com/aws/aws-sdk-go/service/resourcegroups"
+	aws_sdkv2 "github.com/aws/aws-sdk-go-v2/aws"
+	resourcegroups_sdkv2 "github.com/aws/aws-sdk-go-v2/service/resourcegroups"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -29,7 +29,7 @@ func (p *servicePackage) SDKDataSources(ctx context.Context) []*types.ServicePac
 func (p *servicePackage) SDKResources(ctx context.Context) []*types.ServicePackageSDKResource {
 	return []*types.ServicePackageSDKResource{
 		{
-			Factory:  ResourceGroup,
+			Factory:  resourceGroup,
 			TypeName: "aws_resourcegroups_group",
 			Name:     "Group",
 			Tags: &types.ServicePackageResourceTags{
@@ -37,7 +37,7 @@ func (p *servicePackage) SDKResources(ctx context.Context) []*types.ServicePacka
 			},
 		},
 		{
-			Factory:  ResourceResource,
+			Factory:  resourceResource,
 			TypeName: "aws_resourcegroups_resource",
 			Name:     "Resource",
 		},
@@ -48,11 +48,17 @@ func (p *servicePackage) ServicePackageName() string {
 	return names.ResourceGroups
 }
 
-// NewConn returns a new AWS SDK for Go v1 client for this service package's AWS API.
-func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*resourcegroups_sdkv1.ResourceGroups, error) {
-	sess := config["session"].(*session_sdkv1.Session)
+// NewClient returns a new AWS SDK for Go v2 client for this service package's AWS API.
+func (p *servicePackage) NewClient(ctx context.Context, config map[string]any) (*resourcegroups_sdkv2.Client, error) {
+	cfg := *(config["aws_sdkv2_config"].(*aws_sdkv2.Config))
 
-	return resourcegroups_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
+	return resourcegroups_sdkv2.NewFromConfig(cfg, func(o *resourcegroups_sdkv2.Options) {
+		if endpoint := config["endpoint"].(string); endpoint != "" {
+			o.BaseEndpoint = aws_sdkv2.String(endpoint)
+		}
+	}), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/resourcegroups/sweep.go b/internal/service/resourcegroups/sweep.go
new file mode 100644
index 00000000000..baa7db87446
--- /dev/null
+++ b/internal/service/resourcegroups/sweep.go
@@ -0,0 +1,63 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package resourcegroups
+
+import (
+	"fmt"
+	"log"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/resourcegroups"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv2"
+)
+
+func RegisterSweepers() {
+	resource.AddTestSweepers("aws_resourcegroups_group", &resource.Sweeper{
+		Name: "aws_resourcegroups_group",
+		F:    sweepGroups,
+	})
+}
+
+func sweepGroups(region string) error {
+	ctx := sweep.Context(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
+	if err != nil {
+		return fmt.Errorf("error getting client: %s", err)
+	}
+	conn := client.ResourceGroupsClient(ctx)
+	input := &resourcegroups.ListGroupsInput{}
+	sweepResources := make([]sweep.Sweepable, 0)
+
+	pages := resourcegroups.NewListGroupsPaginator(conn, input)
+	for pages.HasMorePages() {
+		page, err := pages.NextPage(ctx)
+
+		if awsv2.SkipSweepError(err) {
+			log.Printf("[WARN] Skipping Resource Groups Group sweep for %s: %s", region, err)
+			return nil
+		}
+
+		if err != nil {
+			return fmt.Errorf("error listing Resource Groups Groups (%s): %w", region, err)
+		}
+
+		for _, v := range page.GroupIdentifiers {
+			r := resourceGroup()
+			d := r.Data(nil)
+			d.SetId(aws.ToString(v.GroupName))
+
+			sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
+		}
+	}
+
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
+
+	if err != nil {
+		return fmt.Errorf("error sweeping Resource Groups Groups (%s): %w", region, err)
+	}
+
+	return nil
+}
diff --git a/internal/service/resourcegroups/tags_gen.go b/internal/service/resourcegroups/tags_gen.go
index 6bcb214b017..35ea1873dad 100644
--- a/internal/service/resourcegroups/tags_gen.go
+++ b/internal/service/resourcegroups/tags_gen.go
@@ -5,10 +5,11 @@ import (
 	"context"
 	"fmt"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/resourcegroups"
-	"github.com/aws/aws-sdk-go/service/resourcegroups/resourcegroupsiface"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/resourcegroups"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -17,12 +18,12 @@ import (
 // listTags lists resourcegroups service tags.
 // The identifier is typically the Amazon Resource Name (ARN), although
 // it may also be a different identifier depending on the service.
-func listTags(ctx context.Context, conn resourcegroupsiface.ResourceGroupsAPI, identifier string) (tftags.KeyValueTags, error) {
+func listTags(ctx context.Context, conn *resourcegroups.Client, identifier string) (tftags.KeyValueTags, error) {
 	input := &resourcegroups.GetTagsInput{
 		Arn: aws.String(identifier),
 	}
 
-	output, err := conn.GetTagsWithContext(ctx, input)
+	output, err := conn.GetTags(ctx, input)
 
 	if err != nil {
 		return tftags.New(ctx, nil), err
@@ -34,7 +35,7 @@ func listTags(ctx context.Context, conn resourcegroupsiface.ResourceGroupsAPI, i
 // ListTags lists resourcegroups service tags and set them in Context.
 // It is called from outside this package.
 func (p *servicePackage) ListTags(ctx context.Context, meta any, identifier string) error {
-	tags, err := listTags(ctx, meta.(*conns.AWSClient).ResourceGroupsConn(ctx), identifier)
+	tags, err := listTags(ctx, meta.(*conns.AWSClient).ResourceGroupsClient(ctx), identifier)
 
 	if err != nil {
 		return err
@@ -47,21 +48,21 @@ func (p *servicePackage) ListTags(ctx context.Context, meta any, identifier stri
 	return nil
 }
 
-// map[string]*string handling
+// map[string]string handling
 
 // Tags returns resourcegroups service tags.
-func Tags(tags tftags.KeyValueTags) map[string]*string {
-	return aws.StringMap(tags.Map())
+func Tags(tags tftags.KeyValueTags) map[string]string {
+	return tags.Map()
 }
 
-// KeyValueTags creates KeyValueTags from resourcegroups service tags.
-func KeyValueTags(ctx context.Context, tags map[string]*string) tftags.KeyValueTags {
+// KeyValueTags creates tftags.KeyValueTags from resourcegroups service tags.
+func KeyValueTags(ctx context.Context, tags map[string]string) tftags.KeyValueTags {
 	return tftags.New(ctx, tags)
 }
 
 // getTagsIn returns resourcegroups service tags from Context.
 // nil is returned if there are no input tags.
-func getTagsIn(ctx context.Context) map[string]*string {
+func getTagsIn(ctx context.Context) map[string]string {
 	if inContext, ok := tftags.FromContext(ctx); ok {
 		if tags := Tags(inContext.TagsIn.UnwrapOrDefault()); len(tags) > 0 {
 			return tags
@@ -72,7 +73,7 @@ func getTagsIn(ctx context.Context) map[string]*string {
 }
 
 // setTagsOut sets resourcegroups service tags in Context.
-func setTagsOut(ctx context.Context, tags map[string]*string) {
+func setTagsOut(ctx context.Context, tags map[string]string) {
 	if inContext, ok := tftags.FromContext(ctx); ok {
 		inContext.TagsOut = types.Some(KeyValueTags(ctx, tags))
 	}
@@ -81,19 +82,21 @@ func setTagsOut(ctx context.Context, tags map[string]*string) {
 // updateTags updates resourcegroups service tags.
 // The identifier is typically the Amazon Resource Name (ARN), although
 // it may also be a different identifier depending on the service.
-func updateTags(ctx context.Context, conn resourcegroupsiface.ResourceGroupsAPI, identifier string, oldTagsMap, newTagsMap any) error {
+func updateTags(ctx context.Context, conn *resourcegroups.Client, identifier string, oldTagsMap, newTagsMap any) error {
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.ResourceGroups)
 	if len(removedTags) > 0 {
 		input := &resourcegroups.UntagInput{
 			Arn:  aws.String(identifier),
-			Keys: aws.StringSlice(removedTags.Keys()),
+			Keys: removedTags.Keys(),
 		}
 
-		_, err := conn.UntagWithContext(ctx, input)
+		_, err := conn.Untag(ctx, input)
 
 		if err != nil {
 			return fmt.Errorf("untagging resource (%s): %w", identifier, err)
@@ -108,7 +111,7 @@ func updateTags(ctx context.Context, conn resourcegroupsiface.ResourceGroupsAPI,
 			Tags: Tags(updatedTags),
 		}
 
-		_, err := conn.TagWithContext(ctx, input)
+		_, err := conn.Tag(ctx, input)
 
 		if err != nil {
 			return fmt.Errorf("tagging resource (%s): %w", identifier, err)
@@ -121,5 +124,5 @@ func updateTags(ctx context.Context, conn resourcegroupsiface.ResourceGroupsAPI,
 // UpdateTags updates resourcegroups service tags.
 // It is called from outside this package.
 func (p *servicePackage) UpdateTags(ctx context.Context, meta any, identifier string, oldTags, newTags any) error {
-	return updateTags(ctx, meta.(*conns.AWSClient).ResourceGroupsConn(ctx), identifier, oldTags, newTags)
+	return updateTags(ctx, meta.(*conns.AWSClient).ResourceGroupsClient(ctx), identifier, oldTags, newTags)
 }
diff --git a/internal/service/resourcegroupstaggingapi/generate.go b/internal/service/resourcegroupstaggingapi/generate.go
index c2c1ef6381f..e7ea9a7c010 100644
--- a/internal/service/resourcegroupstaggingapi/generate.go
+++ b/internal/service/resourcegroupstaggingapi/generate.go
@@ -1,4 +1,7 @@
-//go:generate go run ../../generate/tags/main.go -ServiceTagsSlice
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+//go:generate go run ../../generate/tags/main.go -AWSSDKVersion=2 -ServiceTagsSlice -SkipAWSServiceImp
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
 
diff --git a/internal/service/resourcegroupstaggingapi/resources_data_source.go b/internal/service/resourcegroupstaggingapi/resources_data_source.go
index 2092f6a7cc9..cae855e34e1 100644
--- a/internal/service/resourcegroupstaggingapi/resources_data_source.go
+++ b/internal/service/resourcegroupstaggingapi/resources_data_source.go
@@ -1,10 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package resourcegroupstaggingapi
 
 import (
 	"context"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/resourcegroupstaggingapi"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/resourcegroupstaggingapi"
+	"github.com/aws/aws-sdk-go-v2/service/resourcegroupstaggingapi/types"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
@@ -14,7 +18,7 @@ import (
 )
 
 // @SDKDataSource("aws_resourcegroupstaggingapi_resources")
-func DataSourceResources() *schema.Resource {
+func dataSourceResources() *schema.Resource {
 	return &schema.Resource{
 		ReadWithoutTimeout: dataSourceResourcesRead,
 
@@ -100,7 +104,7 @@ func DataSourceResources() *schema.Resource {
 
 func dataSourceResourcesRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).ResourceGroupsTaggingAPIConn(ctx)
+	conn := meta.(*conns.AWSClient).ResourceGroupsTaggingAPIClient(ctx)
 
 	input := &resourcegroupstaggingapi.GetResourcesInput{}
 
@@ -113,7 +117,7 @@ func dataSourceResourcesRead(ctx context.Context, d *schema.ResourceData, meta i
 	}
 
 	if v, ok := d.GetOk("resource_arn_list"); ok && v.(*schema.Set).Len() > 0 {
-		input.ResourceARNList = flex.ExpandStringSet(v.(*schema.Set))
+		input.ResourceARNList = flex.ExpandStringValueSet(v.(*schema.Set))
 	}
 
 	if v, ok := d.GetOk("tag_filter"); ok {
@@ -121,56 +125,55 @@ func dataSourceResourcesRead(ctx context.Context, d *schema.ResourceData, meta i
 	}
 
 	if v, ok := d.GetOk("resource_type_filters"); ok && v.(*schema.Set).Len() > 0 {
-		input.ResourceTypeFilters = flex.ExpandStringSet(v.(*schema.Set))
+		input.ResourceTypeFilters = flex.ExpandStringValueSet(v.(*schema.Set))
 	}
 
-	var taggings []*resourcegroupstaggingapi.ResourceTagMapping
+	var taggings []types.ResourceTagMapping
+
+	pages := resourcegroupstaggingapi.NewGetResourcesPaginator(conn, input)
+	for pages.HasMorePages() {
+		page, err := pages.NextPage(ctx)
 
-	err := conn.GetResourcesPagesWithContext(ctx, input, func(page *resourcegroupstaggingapi.GetResourcesOutput, lastPage bool) bool {
-		if page == nil {
-			return !lastPage
+		if err != nil {
+			return sdkdiag.AppendErrorf(diags, "reading Resource Groups Tagging API Resources: %s", err)
 		}
 
 		taggings = append(taggings, page.ResourceTagMappingList...)
-		return !lastPage
-	})
-	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "getting Resource Groups Tags API Resources: %s", err)
 	}
 
 	d.SetId(meta.(*conns.AWSClient).Partition)
 
-	if err := d.Set("resource_tag_mapping_list", flattenResourcesTagMappingList(ctx, taggings)); err != nil {
+	if err := d.Set("resource_tag_mapping_list", flattenResourceTagMappings(ctx, taggings)); err != nil {
 		return sdkdiag.AppendErrorf(diags, "setting resource tag mapping list: %s", err)
 	}
 
 	return diags
 }
 
-func expandTagFilters(filters []interface{}) []*resourcegroupstaggingapi.TagFilter {
-	result := make([]*resourcegroupstaggingapi.TagFilter, len(filters))
+func expandTagFilters(filters []interface{}) []types.TagFilter {
+	result := make([]types.TagFilter, len(filters))
 
 	for i, filter := range filters {
 		m := filter.(map[string]interface{})
 
-		result[i] = &resourcegroupstaggingapi.TagFilter{
+		result[i] = types.TagFilter{
 			Key: aws.String(m["key"].(string)),
 		}
 
 		if v, ok := m["values"]; ok && v.(*schema.Set).Len() > 0 {
-			result[i].Values = flex.ExpandStringSet(v.(*schema.Set))
+			result[i].Values = flex.ExpandStringValueSet(v.(*schema.Set))
 		}
 	}
 
 	return result
 }
 
-func flattenResourcesTagMappingList(ctx context.Context, list []*resourcegroupstaggingapi.ResourceTagMapping) []map[string]interface{} {
+func flattenResourceTagMappings(ctx context.Context, list []types.ResourceTagMapping) []map[string]interface{} {
 	result := make([]map[string]interface{}, 0, len(list))
 
 	for _, i := range list {
 		l := map[string]interface{}{
-			"resource_arn": aws.StringValue(i.ResourceARN),
+			"resource_arn": aws.ToString(i.ResourceARN),
 			"tags":         KeyValueTags(ctx, i.Tags).Map(),
 		}
 
@@ -184,15 +187,15 @@ func flattenResourcesTagMappingList(ctx context.Context, list []*resourcegroupst
 	return result
 }
 
-func flattenComplianceDetails(details *resourcegroupstaggingapi.ComplianceDetails) []map[string]interface{} {
+func flattenComplianceDetails(details *types.ComplianceDetails) []map[string]interface{} {
 	if details == nil {
 		return []map[string]interface{}{}
 	}
 
 	m := map[string]interface{}{
-		"compliance_status":             aws.BoolValue(details.ComplianceStatus),
-		"keys_with_noncompliant_values": flex.FlattenStringSet(details.KeysWithNoncompliantValues),
-		"non_compliant_keys":            flex.FlattenStringSet(details.NoncompliantKeys),
+		"compliance_status":             aws.ToBool(details.ComplianceStatus),
+		"keys_with_noncompliant_values": details.KeysWithNoncompliantValues,
+		"non_compliant_keys":            details.NoncompliantKeys,
 	}
 
 	return []map[string]interface{}{m}
diff --git a/internal/service/resourcegroupstaggingapi/resources_data_source_test.go b/internal/service/resourcegroupstaggingapi/resources_data_source_test.go
index e42325659d5..857e1ad21f4 100644
--- a/internal/service/resourcegroupstaggingapi/resources_data_source_test.go
+++ b/internal/service/resourcegroupstaggingapi/resources_data_source_test.go
@@ -1,13 +1,16 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package resourcegroupstaggingapi_test
 
 import (
 	"fmt"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/service/resourcegroupstaggingapi"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
+	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
 func TestAccResourceGroupsTaggingAPIResourcesDataSource_tagFilter(t *testing.T) {
@@ -18,7 +21,7 @@ func TestAccResourceGroupsTaggingAPIResourcesDataSource_tagFilter(t *testing.T)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, resourcegroupstaggingapi.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.ResourceGroupsTaggingAPIEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		Steps: []resource.TestStep{
 			{
@@ -41,7 +44,7 @@ func TestAccResourceGroupsTaggingAPIResourcesDataSource_includeComplianceDetails
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, resourcegroupstaggingapi.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.ResourceGroupsTaggingAPIEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		Steps: []resource.TestStep{
 			{
@@ -63,7 +66,7 @@ func TestAccResourceGroupsTaggingAPIResourcesDataSource_resourceTypeFilters(t *t
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, resourcegroupstaggingapi.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.ResourceGroupsTaggingAPIEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		Steps: []resource.TestStep{
 			{
@@ -87,7 +90,7 @@ func TestAccResourceGroupsTaggingAPIResourcesDataSource_resourceARNList(t *testi
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, resourcegroupstaggingapi.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.ResourceGroupsTaggingAPIEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		Steps: []resource.TestStep{
 			{
diff --git a/internal/service/resourcegroupstaggingapi/service_package_gen.go b/internal/service/resourcegroupstaggingapi/service_package_gen.go
index b54a019b7d9..ccd8189215c 100644
--- a/internal/service/resourcegroupstaggingapi/service_package_gen.go
+++ b/internal/service/resourcegroupstaggingapi/service_package_gen.go
@@ -5,9 +5,9 @@ package resourcegroupstaggingapi
 import (
 	"context"
 
-	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
-	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
-	resourcegroupstaggingapi_sdkv1 "github.com/aws/aws-sdk-go/service/resourcegroupstaggingapi"
+	aws_sdkv2 "github.com/aws/aws-sdk-go-v2/aws"
+	resourcegroupstaggingapi_sdkv2 "github.com/aws/aws-sdk-go-v2/service/resourcegroupstaggingapi"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -25,7 +25,7 @@ func (p *servicePackage) FrameworkResources(ctx context.Context) []*types.Servic
 func (p *servicePackage) SDKDataSources(ctx context.Context) []*types.ServicePackageSDKDataSource {
 	return []*types.ServicePackageSDKDataSource{
 		{
-			Factory:  DataSourceResources,
+			Factory:  dataSourceResources,
 			TypeName: "aws_resourcegroupstaggingapi_resources",
 		},
 	}
@@ -39,11 +39,17 @@ func (p *servicePackage) ServicePackageName() string {
 	return names.ResourceGroupsTaggingAPI
 }
 
-// NewConn returns a new AWS SDK for Go v1 client for this service package's AWS API.
-func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*resourcegroupstaggingapi_sdkv1.ResourceGroupsTaggingAPI, error) {
-	sess := config["session"].(*session_sdkv1.Session)
+// NewClient returns a new AWS SDK for Go v2 client for this service package's AWS API.
+func (p *servicePackage) NewClient(ctx context.Context, config map[string]any) (*resourcegroupstaggingapi_sdkv2.Client, error) {
+	cfg := *(config["aws_sdkv2_config"].(*aws_sdkv2.Config))
 
-	return resourcegroupstaggingapi_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
+	return resourcegroupstaggingapi_sdkv2.NewFromConfig(cfg, func(o *resourcegroupstaggingapi_sdkv2.Options) {
+		if endpoint := config["endpoint"].(string); endpoint != "" {
+			o.BaseEndpoint = aws_sdkv2.String(endpoint)
+		}
+	}), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/resourcegroupstaggingapi/tags_gen.go b/internal/service/resourcegroupstaggingapi/tags_gen.go
index 550e3f5183d..7d1dc4079b4 100644
--- a/internal/service/resourcegroupstaggingapi/tags_gen.go
+++ b/internal/service/resourcegroupstaggingapi/tags_gen.go
@@ -4,8 +4,8 @@ package resourcegroupstaggingapi
 import (
 	"context"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/resourcegroupstaggingapi"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	awstypes "github.com/aws/aws-sdk-go-v2/service/resourcegroupstaggingapi/types"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 )
@@ -13,11 +13,11 @@ import (
 // []*SERVICE.Tag handling
 
 // Tags returns resourcegroupstaggingapi service tags.
-func Tags(tags tftags.KeyValueTags) []*resourcegroupstaggingapi.Tag {
-	result := make([]*resourcegroupstaggingapi.Tag, 0, len(tags))
+func Tags(tags tftags.KeyValueTags) []awstypes.Tag {
+	result := make([]awstypes.Tag, 0, len(tags))
 
 	for k, v := range tags.Map() {
-		tag := &resourcegroupstaggingapi.Tag{
+		tag := awstypes.Tag{
 			Key:   aws.String(k),
 			Value: aws.String(v),
 		}
@@ -29,11 +29,11 @@ func Tags(tags tftags.KeyValueTags) []*resourcegroupstaggingapi.Tag {
 }
 
 // KeyValueTags creates tftags.KeyValueTags from resourcegroupstaggingapi service tags.
-func KeyValueTags(ctx context.Context, tags []*resourcegroupstaggingapi.Tag) tftags.KeyValueTags {
+func KeyValueTags(ctx context.Context, tags []awstypes.Tag) tftags.KeyValueTags {
 	m := make(map[string]*string, len(tags))
 
 	for _, tag := range tags {
-		m[aws.StringValue(tag.Key)] = tag.Value
+		m[aws.ToString(tag.Key)] = tag.Value
 	}
 
 	return tftags.New(ctx, m)
@@ -41,7 +41,7 @@ func KeyValueTags(ctx context.Context, tags []*resourcegroupstaggingapi.Tag) tft
 
 // getTagsIn returns resourcegroupstaggingapi service tags from Context.
 // nil is returned if there are no input tags.
-func getTagsIn(ctx context.Context) []*resourcegroupstaggingapi.Tag {
+func getTagsIn(ctx context.Context) []awstypes.Tag {
 	if inContext, ok := tftags.FromContext(ctx); ok {
 		if tags := Tags(inContext.TagsIn.UnwrapOrDefault()); len(tags) > 0 {
 			return tags
@@ -52,7 +52,7 @@ func getTagsIn(ctx context.Context) []*resourcegroupstaggingapi.Tag {
 }
 
 // setTagsOut sets resourcegroupstaggingapi service tags in Context.
-func setTagsOut(ctx context.Context, tags []*resourcegroupstaggingapi.Tag) {
+func setTagsOut(ctx context.Context, tags []awstypes.Tag) {
 	if inContext, ok := tftags.FromContext(ctx); ok {
 		inContext.TagsOut = types.Some(KeyValueTags(ctx, tags))
 	}
diff --git a/internal/service/rolesanywhere/find.go b/internal/service/rolesanywhere/find.go
index f976ae3687c..6d26f5c5078 100644
--- a/internal/service/rolesanywhere/find.go
+++ b/internal/service/rolesanywhere/find.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rolesanywhere
 
 import (
diff --git a/internal/service/rolesanywhere/flex.go b/internal/service/rolesanywhere/flex.go
index 88cd69bc6a6..72500c467bd 100644
--- a/internal/service/rolesanywhere/flex.go
+++ b/internal/service/rolesanywhere/flex.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rolesanywhere
 
 func expandStringList(tfList []interface{}) []string {
diff --git a/internal/service/rolesanywhere/generate.go b/internal/service/rolesanywhere/generate.go
index 77c3fdda791..e6932f9d9e8 100644
--- a/internal/service/rolesanywhere/generate.go
+++ b/internal/service/rolesanywhere/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -AWSSDKVersion=2 -ListTags -ServiceTagsSlice -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/rolesanywhere/profile.go b/internal/service/rolesanywhere/profile.go
index 6a0f171a891..62d539d3a39 100644
--- a/internal/service/rolesanywhere/profile.go
+++ b/internal/service/rolesanywhere/profile.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rolesanywhere
 
 import (
diff --git a/internal/service/rolesanywhere/profile_test.go b/internal/service/rolesanywhere/profile_test.go
index 39555ee0c59..acf21683cff 100644
--- a/internal/service/rolesanywhere/profile_test.go
+++ b/internal/service/rolesanywhere/profile_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rolesanywhere_test
 
 import (
diff --git a/internal/service/rolesanywhere/service_package_gen.go b/internal/service/rolesanywhere/service_package_gen.go
index 2ef9b9f3019..3730a558e69 100644
--- a/internal/service/rolesanywhere/service_package_gen.go
+++ b/internal/service/rolesanywhere/service_package_gen.go
@@ -7,6 +7,7 @@ import (
 
 	aws_sdkv2 "github.com/aws/aws-sdk-go-v2/aws"
 	rolesanywhere_sdkv2 "github.com/aws/aws-sdk-go-v2/service/rolesanywhere"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -56,9 +57,11 @@ func (p *servicePackage) NewClient(ctx context.Context, config map[string]any) (
 
 	return rolesanywhere_sdkv2.NewFromConfig(cfg, func(o *rolesanywhere_sdkv2.Options) {
 		if endpoint := config["endpoint"].(string); endpoint != "" {
-			o.EndpointResolver = rolesanywhere_sdkv2.EndpointResolverFromURL(endpoint)
+			o.BaseEndpoint = aws_sdkv2.String(endpoint)
 		}
 	}), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/rolesanywhere/tags_gen.go b/internal/service/rolesanywhere/tags_gen.go
index 532fc7203ae..7321e41deb4 100644
--- a/internal/service/rolesanywhere/tags_gen.go
+++ b/internal/service/rolesanywhere/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/rolesanywhere"
 	awstypes "github.com/aws/aws-sdk-go-v2/service/rolesanywhere/types"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -102,6 +104,8 @@ func updateTags(ctx context.Context, conn *rolesanywhere.Client, identifier stri
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.RolesAnywhere)
 	if len(removedTags) > 0 {
diff --git a/internal/service/rolesanywhere/trust_anchor.go b/internal/service/rolesanywhere/trust_anchor.go
index ca515ba3bda..629f097d8f3 100644
--- a/internal/service/rolesanywhere/trust_anchor.go
+++ b/internal/service/rolesanywhere/trust_anchor.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rolesanywhere
 
 import (
diff --git a/internal/service/rolesanywhere/trust_anchor_test.go b/internal/service/rolesanywhere/trust_anchor_test.go
index fd259ca0de1..9236669aa50 100644
--- a/internal/service/rolesanywhere/trust_anchor_test.go
+++ b/internal/service/rolesanywhere/trust_anchor_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rolesanywhere_test
 
 import (
diff --git a/internal/service/route53/cidr_collection.go b/internal/service/route53/cidr_collection.go
index ef0b31580af..367658ec004 100644
--- a/internal/service/route53/cidr_collection.go
+++ b/internal/service/route53/cidr_collection.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/route53"
 	"github.com/hashicorp/terraform-plugin-framework-validators/stringvalidator"
@@ -20,8 +23,8 @@ import (
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/fwdiag"
-	"github.com/hashicorp/terraform-provider-aws/internal/flex"
 	"github.com/hashicorp/terraform-provider-aws/internal/framework"
+	"github.com/hashicorp/terraform-provider-aws/internal/framework/flex"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
@@ -52,7 +55,7 @@ func (r *resourceCIDRCollection) Schema(ctx context.Context, req resource.Schema
 				},
 				Validators: []validator.String{
 					stringvalidator.LengthAtMost(64),
-					stringvalidator.RegexMatches(regexp.MustCompile(`^[a-zA-Z0-9_\-]+$`), `can include letters, digits, underscore (_) and the dash (-) character`),
+					stringvalidator.RegexMatches(regexache.MustCompile(`^[0-9A-Za-z_-]+$`), `can include letters, digits, underscore (_) and the dash (-) character`),
 				},
 			},
 			"version": schema.Int64Attribute{
diff --git a/internal/service/route53/cidr_collection_test.go b/internal/service/route53/cidr_collection_test.go
index 7da70d08488..daf870f2a18 100644
--- a/internal/service/route53/cidr_collection_test.go
+++ b/internal/service/route53/cidr_collection_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/route53"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -32,7 +35,7 @@ func TestAccRoute53CIDRCollection_basic(t *testing.T) {
 				Config: testAccCIDRCollection_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckCIDRCollectionExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrGlobalARNNoAccount(resourceName, "arn", "route53", regexp.MustCompile(`cidrcollection/.+`)),
+					acctest.MatchResourceAttrGlobalARNNoAccount(resourceName, "arn", "route53", regexache.MustCompile(`cidrcollection/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 				),
 			},
diff --git a/internal/service/route53/cidr_location.go b/internal/service/route53/cidr_location.go
index dab9e3dedc6..15f6c257eb3 100644
--- a/internal/service/route53/cidr_location.go
+++ b/internal/service/route53/cidr_location.go
@@ -1,15 +1,19 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"strings"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/route53"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-framework-validators/stringvalidator"
+	"github.com/hashicorp/terraform-plugin-framework/attr"
 	"github.com/hashicorp/terraform-plugin-framework/path"
 	"github.com/hashicorp/terraform-plugin-framework/resource"
 	"github.com/hashicorp/terraform-plugin-framework/resource/schema"
@@ -20,8 +24,8 @@ import (
 	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/fwdiag"
-	"github.com/hashicorp/terraform-provider-aws/internal/flex"
 	"github.com/hashicorp/terraform-provider-aws/internal/framework"
+	"github.com/hashicorp/terraform-provider-aws/internal/framework/flex"
 	fwtypes "github.com/hashicorp/terraform-provider-aws/internal/framework/types"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
@@ -62,7 +66,7 @@ func (r *resourceCIDRLocation) Schema(ctx context.Context, req resource.SchemaRe
 				},
 				Validators: []validator.String{
 					stringvalidator.LengthAtMost(16),
-					stringvalidator.RegexMatches(regexp.MustCompile(`^[a-zA-Z0-9_\-]+$`), `can include letters, digits, underscore (_) and the dash (-) character`),
+					stringvalidator.RegexMatches(regexache.MustCompile(`^[0-9A-Za-z_-]+$`), `can include letters, digits, underscore (_) and the dash (-) character`),
 				},
 			},
 		},
@@ -147,7 +151,15 @@ func (r *resourceCIDRLocation) Read(ctx context.Context, request resource.ReadRe
 		return
 	}
 
-	data.CIDRBlocks = flex.FlattenFrameworkStringValueSet(ctx, cidrBlocks)
+	if n := len(cidrBlocks); n > 0 {
+		elems := make([]attr.Value, n)
+		for i, cidrBlock := range cidrBlocks {
+			elems[i] = fwtypes.CIDRBlockValue(cidrBlock)
+		}
+		data.CIDRBlocks = types.SetValueMust(fwtypes.CIDRBlockType, elems)
+	} else {
+		data.CIDRBlocks = types.SetNull(fwtypes.CIDRBlockType)
+	}
 	data.CIDRCollectionID = types.StringValue(collectionID)
 	data.Name = types.StringValue(name)
 
diff --git a/internal/service/route53/cidr_location_test.go b/internal/service/route53/cidr_location_test.go
index 1bd4b3a9c42..a1e68bb0618 100644
--- a/internal/service/route53/cidr_location_test.go
+++ b/internal/service/route53/cidr_location_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53_test
 
 import (
diff --git a/internal/service/route53/delegation_set.go b/internal/service/route53/delegation_set.go
index 7a4f27aeab0..7454c223eb1 100644
--- a/internal/service/route53/delegation_set.go
+++ b/internal/service/route53/delegation_set.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53
 
 import (
diff --git a/internal/service/route53/delegation_set_data_source.go b/internal/service/route53/delegation_set_data_source.go
index 993309e378f..4f3a493734f 100644
--- a/internal/service/route53/delegation_set_data_source.go
+++ b/internal/service/route53/delegation_set_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53
 
 import (
diff --git a/internal/service/route53/delegation_set_data_source_test.go b/internal/service/route53/delegation_set_data_source_test.go
index 092eb7b5f7c..f7b7b615199 100644
--- a/internal/service/route53/delegation_set_data_source_test.go
+++ b/internal/service/route53/delegation_set_data_source_test.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53_test
 
 import (
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/route53"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
@@ -27,7 +30,7 @@ func TestAccRoute53DelegationSetDataSource_basic(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttrPair(dataSourceName, "arn", resourceName, "arn"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "name_servers.#", resourceName, "name_servers.#"),
-					resource.TestMatchResourceAttr("data.aws_route53_delegation_set.dset", "caller_reference", regexp.MustCompile("DynDNS(.*)")),
+					resource.TestMatchResourceAttr("data.aws_route53_delegation_set.dset", "caller_reference", regexache.MustCompile("DynDNS(.*)")),
 				),
 			},
 		},
diff --git a/internal/service/route53/delegation_set_test.go b/internal/service/route53/delegation_set_test.go
index af2509a11ee..9bccf0b0820 100644
--- a/internal/service/route53/delegation_set_test.go
+++ b/internal/service/route53/delegation_set_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53_test
 
 import (
 	"context"
 	"fmt"
 	"reflect"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/route53"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -32,7 +35,7 @@ func TestAccRoute53DelegationSet_basic(t *testing.T) {
 				Config: testAccDelegationSetConfig_basic(refName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDelegationSetExists(ctx, resourceName),
-					acctest.MatchResourceAttrGlobalARNNoAccount(resourceName, "arn", "route53", regexp.MustCompile("delegationset/.+")),
+					acctest.MatchResourceAttrGlobalARNNoAccount(resourceName, "arn", "route53", regexache.MustCompile("delegationset/.+")),
 				),
 			},
 			{
diff --git a/internal/service/route53/enum.go b/internal/service/route53/enum.go
index be2611b7bbb..579c7067333 100644
--- a/internal/service/route53/enum.go
+++ b/internal/service/route53/enum.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53
 
 const (
diff --git a/internal/service/route53/exports_test.go b/internal/service/route53/exports_test.go
index 6e086c3a2e4..8247b2b87cf 100644
--- a/internal/service/route53/exports_test.go
+++ b/internal/service/route53/exports_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53
 
 // Exports for use in tests only.
diff --git a/internal/service/route53/find.go b/internal/service/route53/find.go
index fae431eadd1..36a410070d0 100644
--- a/internal/service/route53/find.go
+++ b/internal/service/route53/find.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53
 
 import (
diff --git a/internal/service/route53/flex.go b/internal/service/route53/flex.go
index 09a4ab39b27..6351c1d3169 100644
--- a/internal/service/route53/flex.go
+++ b/internal/service/route53/flex.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53
 
 import (
diff --git a/internal/service/route53/flex_test.go b/internal/service/route53/flex_test.go
index 551a12450c7..683b7ce43b5 100644
--- a/internal/service/route53/flex_test.go
+++ b/internal/service/route53/flex_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53
 
 import (
diff --git a/internal/service/route53/generate.go b/internal/service/route53/generate.go
index b87dac9e7e2..22a91d87fef 100644
--- a/internal/service/route53/generate.go
+++ b/internal/service/route53/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/listpages/main.go -ListOps=ListTrafficPolicies -Paginator=TrafficPolicyIdMarker list_traffic_policies_pages_gen.go
 //go:generate go run ../../generate/listpages/main.go -ListOps=ListTrafficPolicyVersions -Paginator=TrafficPolicyVersionMarker list_traffic_policy_versions_pages_gen.go
 //go:generate go run ../../generate/tags/main.go -ListTags -ListTagsInIDElem=ResourceId -ListTagsOutTagsElem=ResourceTagSet.Tags -ServiceTagsSlice -TagOp=ChangeTagsForResource -TagInIDElem=ResourceId -TagInTagsElem=AddTags -TagResTypeElem=ResourceType -UntagOp=ChangeTagsForResource -UntagInTagsElem=RemoveTagKeys -UpdateTags -CreateTags
diff --git a/internal/service/route53/health_check.go b/internal/service/route53/health_check.go
index 69737d0da59..fb41634b7a5 100644
--- a/internal/service/route53/health_check.go
+++ b/internal/service/route53/health_check.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53
 
 import (
diff --git a/internal/service/route53/health_check_test.go b/internal/service/route53/health_check_test.go
index bc7a6e858a3..a537ff87325 100644
--- a/internal/service/route53/health_check_test.go
+++ b/internal/service/route53/health_check_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"strings"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws/endpoints"
 	"github.com/aws/aws-sdk-go/service/route53"
 	r53rcc "github.com/aws/aws-sdk-go/service/route53recoverycontrolconfig"
@@ -34,7 +37,7 @@ func TestAccRoute53HealthCheck_basic(t *testing.T) {
 				Config: testAccHealthCheckConfig_basic("2", true),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckHealthCheckExists(ctx, resourceName, &check),
-					acctest.MatchResourceAttrGlobalARNNoAccount(resourceName, "arn", "route53", regexp.MustCompile("healthcheck/.+")),
+					acctest.MatchResourceAttrGlobalARNNoAccount(resourceName, "arn", "route53", regexache.MustCompile("healthcheck/.+")),
 					resource.TestCheckResourceAttr(resourceName, "measure_latency", "true"),
 					resource.TestCheckResourceAttr(resourceName, "port", "80"),
 					resource.TestCheckResourceAttr(resourceName, "failure_threshold", "2"),
diff --git a/internal/service/route53/hosted_zone_dnssec.go b/internal/service/route53/hosted_zone_dnssec.go
index e47f93bcd6b..ff63d07ea1e 100644
--- a/internal/service/route53/hosted_zone_dnssec.go
+++ b/internal/service/route53/hosted_zone_dnssec.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53
 
 import (
diff --git a/internal/service/route53/hosted_zone_dnssec_test.go b/internal/service/route53/hosted_zone_dnssec_test.go
index 2d4898f952a..a6e061a80f6 100644
--- a/internal/service/route53/hosted_zone_dnssec_test.go
+++ b/internal/service/route53/hosted_zone_dnssec_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53_test
 
 import (
diff --git a/internal/service/route53/id.go b/internal/service/route53/id.go
index a8748fa4eef..e1df458b167 100644
--- a/internal/service/route53/id.go
+++ b/internal/service/route53/id.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53
 
 import (
diff --git a/internal/service/route53/key_signing_key.go b/internal/service/route53/key_signing_key.go
index 27f0e269621..c557393fc75 100644
--- a/internal/service/route53/key_signing_key.go
+++ b/internal/service/route53/key_signing_key.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53
 
 import (
 	"context"
 	"log"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/route53"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -74,7 +77,7 @@ func ResourceKeySigningKey() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(3, 128),
-					validation.StringMatch(regexp.MustCompile("^[a-zA-Z0-9._-]"), "must contain only alphanumeric characters, periods, underscores, or hyphens"),
+					validation.StringMatch(regexache.MustCompile("^[0-9A-Za-z_.-]"), "must contain only alphanumeric characters, periods, underscores, or hyphens"),
 				),
 			},
 			"public_key": {
diff --git a/internal/service/route53/key_signing_key_test.go b/internal/service/route53/key_signing_key_test.go
index 4299bda87b6..6cffcff2675 100644
--- a/internal/service/route53/key_signing_key_test.go
+++ b/internal/service/route53/key_signing_key_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws/endpoints"
 	"github.com/aws/aws-sdk-go/service/route53"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -39,15 +42,15 @@ func TestAccRoute53KeySigningKey_basic(t *testing.T) {
 					testAccKeySigningKeyExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "digest_algorithm_mnemonic", "SHA-256"),
 					resource.TestCheckResourceAttr(resourceName, "digest_algorithm_type", "2"),
-					resource.TestMatchResourceAttr(resourceName, "digest_value", regexp.MustCompile(`^[0-9A-F]+$`)),
-					resource.TestMatchResourceAttr(resourceName, "dnskey_record", regexp.MustCompile(`^257 [0-9]+ [0-9]+ [a-zA-Z0-9+/]+={0,3}$`)),
-					resource.TestMatchResourceAttr(resourceName, "ds_record", regexp.MustCompile(`^[0-9]+ [0-9]+ [0-9]+ [0-9A-F]+$`)),
+					resource.TestMatchResourceAttr(resourceName, "digest_value", regexache.MustCompile(`^[0-9A-F]+$`)),
+					resource.TestMatchResourceAttr(resourceName, "dnskey_record", regexache.MustCompile(`^257 [0-9]+ [0-9]+ [0-9A-Za-z+/]+={0,3}$`)),
+					resource.TestMatchResourceAttr(resourceName, "ds_record", regexache.MustCompile(`^[0-9]+ [0-9]+ [0-9]+ [0-9A-F]+$`)),
 					resource.TestCheckResourceAttr(resourceName, "flag", "257"),
 					resource.TestCheckResourceAttrPair(resourceName, "hosted_zone_id", route53ZoneResourceName, "id"),
 					resource.TestCheckResourceAttrPair(resourceName, "key_management_service_arn", kmsKeyResourceName, "arn"),
-					resource.TestMatchResourceAttr(resourceName, "key_tag", regexp.MustCompile(`^[0-9]+$`)),
+					resource.TestMatchResourceAttr(resourceName, "key_tag", regexache.MustCompile(`^[0-9]+$`)),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
-					resource.TestMatchResourceAttr(resourceName, "public_key", regexp.MustCompile(`^[a-zA-Z0-9+/]+={0,3}$`)),
+					resource.TestMatchResourceAttr(resourceName, "public_key", regexache.MustCompile(`^[0-9A-Za-z+/]+={0,3}$`)),
 					resource.TestCheckResourceAttr(resourceName, "signing_algorithm_mnemonic", "ECDSAP256SHA256"),
 					resource.TestCheckResourceAttr(resourceName, "signing_algorithm_type", "13"),
 					resource.TestCheckResourceAttr(resourceName, "status", tfroute53.KeySigningKeyStatusActive),
diff --git a/internal/service/route53/list_pages.go b/internal/service/route53/list_pages.go
index 226735d1013..cee40a71da9 100644
--- a/internal/service/route53/list_pages.go
+++ b/internal/service/route53/list_pages.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53
 
 import (
@@ -9,7 +12,7 @@ import (
 
 // Custom Route 53 service lister functions using the same format as generated code.
 
-func listTrafficPolicyInstancesPages(ctx context.Context, conn *route53.Route53, input *route53.ListTrafficPolicyInstancesInput, fn func(*route53.ListTrafficPolicyInstancesOutput, bool) bool) error { //nolint:unused // This function is called from a sweeper.
+func listTrafficPolicyInstancesPages(ctx context.Context, conn *route53.Route53, input *route53.ListTrafficPolicyInstancesInput, fn func(*route53.ListTrafficPolicyInstancesOutput, bool) bool) error {
 	for {
 		output, err := conn.ListTrafficPolicyInstancesWithContext(ctx, input)
 		if err != nil {
diff --git a/internal/service/route53/query_log.go b/internal/service/route53/query_log.go
index b4f3900e5e0..feb60f69da1 100644
--- a/internal/service/route53/query_log.go
+++ b/internal/service/route53/query_log.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53
 
 import (
diff --git a/internal/service/route53/query_log_test.go b/internal/service/route53/query_log_test.go
index e341a2f427d..8cbb1411df2 100644
--- a/internal/service/route53/query_log_test.go
+++ b/internal/service/route53/query_log_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws/endpoints"
 	"github.com/aws/aws-sdk-go/service/route53"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -42,7 +45,7 @@ func TestAccRoute53QueryLog_basic(t *testing.T) {
 				Config: testAccQueryLogConfig_basic(rName, domainName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckQueryLogExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrGlobalARNNoAccount(resourceName, "arn", "route53", regexp.MustCompile("queryloggingconfig/.+")),
+					acctest.MatchResourceAttrGlobalARNNoAccount(resourceName, "arn", "route53", regexache.MustCompile("queryloggingconfig/.+")),
 					resource.TestCheckResourceAttrPair(resourceName, "cloudwatch_log_group_arn", cloudwatchLogGroupResourceName, "arn"),
 					resource.TestCheckResourceAttrPair(resourceName, "zone_id", route53ZoneResourceName, "zone_id"),
 				),
diff --git a/internal/service/route53/record.go b/internal/service/route53/record.go
index aebb3c30751..4f2eb6d5efb 100644
--- a/internal/service/route53/record.go
+++ b/internal/service/route53/record.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53
 
 import (
@@ -758,8 +761,6 @@ func ChangeResourceRecordSets(ctx context.Context, conn *route53.Route53, input
 }
 
 func WaitForRecordSetToSync(ctx context.Context, conn *route53.Route53, requestId string) error {
-	rand.Seed(time.Now().UTC().UnixNano())
-
 	wait := retry.StateChangeConf{
 		Pending:      []string{route53.ChangeStatusPending},
 		Target:       []string{route53.ChangeStatusInsync},
diff --git a/internal/service/route53/record_migrate.go b/internal/service/route53/record_migrate.go
index 7b0ab6e1959..1a327ce6ab7 100644
--- a/internal/service/route53/record_migrate.go
+++ b/internal/service/route53/record_migrate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53
 
 import (
diff --git a/internal/service/route53/record_migrate_test.go b/internal/service/route53/record_migrate_test.go
index 0a418a4f41f..7d345c68174 100644
--- a/internal/service/route53/record_migrate_test.go
+++ b/internal/service/route53/record_migrate_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53_test
 
 import (
diff --git a/internal/service/route53/record_test.go b/internal/service/route53/record_test.go
index 76d3ef0e8ae..134ded0d8e9 100644
--- a/internal/service/route53/record_test.go
+++ b/internal/service/route53/record_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"strings"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/endpoints"
 	"github.com/aws/aws-sdk-go/service/route53"
@@ -661,7 +664,7 @@ func TestAccRoute53Record_Alias_vpcEndpoint(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccRecordConfig_aliasCustomVPCEndpointSwappedAliasAttributes(rName),
-				ExpectError: regexp.MustCompile(`expected length of`),
+				ExpectError: regexache.MustCompile(`expected length of`),
 			},
 			{
 				Config: testAccRecordConfig_customVPCEndpoint(rName),
@@ -1519,7 +1522,7 @@ func testAccRecordOverwriteExpectErrorCheck(t *testing.T) resource.ErrorCheckFun
 			t.Fatalf("Expected an error but got none")
 		}
 
-		re := regexp.MustCompile(`Tried to create resource record set \[name='www.domain.test.', type='A'] but it already exists`)
+		re := regexache.MustCompile(`Tried to create resource record set \[name='www.domain.test.', type='A'] but it already exists`)
 		if !re.MatchString(err.Error()) {
 			t.Fatalf("Expected an error with pattern, no match on: %s", err)
 		}
diff --git a/internal/service/route53/service_package.go b/internal/service/route53/service_package.go
index fdb09598074..8f3f345c4b4 100644
--- a/internal/service/route53/service_package.go
+++ b/internal/service/route53/service_package.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53
 
 import (
diff --git a/internal/service/route53/service_package_gen.go b/internal/service/route53/service_package_gen.go
index 2d723164070..f2709931fa4 100644
--- a/internal/service/route53/service_package_gen.go
+++ b/internal/service/route53/service_package_gen.go
@@ -5,6 +5,7 @@ package route53
 import (
 	"context"
 
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -106,4 +107,6 @@ func (p *servicePackage) ServicePackageName() string {
 	return names.Route53
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/route53/status.go b/internal/service/route53/status.go
index 1ee360d3c46..eb9c5f89f5e 100644
--- a/internal/service/route53/status.go
+++ b/internal/service/route53/status.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53
 
 import (
diff --git a/internal/service/route53/sweep.go b/internal/service/route53/sweep.go
index b1ea9840190..807ccf4ca5e 100644
--- a/internal/service/route53/sweep.go
+++ b/internal/service/route53/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package route53
 
@@ -15,10 +15,12 @@ import (
 	"github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_route53_health_check", &resource.Sweeper{
 		Name: "aws_route53_health_check",
 		F:    sweepHealthChecks,
@@ -63,30 +65,27 @@ func init() {
 
 func sweepHealthChecks(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
-
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("getting client: %s", err)
 	}
-
 	conn := client.Route53Conn(ctx)
-	sweepResources := make([]sweep.Sweepable, 0)
-	var errs *multierror.Error
-
 	input := &route53.ListHealthChecksInput{}
+	sweepResources := make([]sweep.Sweepable, 0)
 
 	err = conn.ListHealthChecksPagesWithContext(ctx, input, func(page *route53.ListHealthChecksOutput, lastPage bool) bool {
 		if page == nil {
 			return !lastPage
 		}
 
-		for _, detail := range page.HealthChecks {
-			if detail == nil {
+		for _, v := range page.HealthChecks {
+			id := aws.StringValue(v.Id)
+
+			if v.LinkedService != nil {
+				log.Printf("[INFO] Skipping Route 53 Health Check %s: %s", id, aws.StringValue(v.LinkedService.Description))
 				continue
 			}
 
-			id := aws.StringValue(detail.Id)
-
 			r := ResourceHealthCheck()
 			d := r.Data(nil)
 			d.SetId(id)
@@ -97,25 +96,27 @@ func sweepHealthChecks(region string) error {
 		return !lastPage
 	})
 
-	if err != nil {
-		errs = multierror.Append(errs, fmt.Errorf("describing Route53 Health Checks for %s: %w", region, err))
+	if awsv1.SkipSweepError(err) {
+		log.Printf("[WARN] Skipping Route 53 Health Check sweep for %s: %s", region, err)
+		return nil
 	}
 
-	if err = sweep.SweepOrchestratorWithContext(ctx, sweepResources, tfresource.WithDelayRand(1*time.Minute), tfresource.WithMinPollInterval(10*time.Second), tfresource.WithPollInterval(18*time.Second)); err != nil {
-		errs = multierror.Append(errs, fmt.Errorf("sweeping Route53 Health Checks for %s: %w", region, err))
+	if err != nil {
+		return fmt.Errorf("listing Route 53 Health Checks (%s): %w", region, err)
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
-		log.Printf("[WARN] Skipping Route53 Health Checks sweep for %s: %s", region, errs)
-		return nil
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
+
+	if err != nil {
+		return fmt.Errorf("sweeping Route 53 Health Checks (%s): %w", region, err)
 	}
 
-	return errs.ErrorOrNil()
+	return nil
 }
 
 func sweepKeySigningKeys(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("getting client: %s", err)
@@ -171,7 +172,6 @@ func sweepKeySigningKeys(region string) error {
 
 				sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
 			}
-
 		}
 
 		return !lastPage
@@ -181,11 +181,11 @@ func sweepKeySigningKeys(region string) error {
 		errs = multierror.Append(errs, fmt.Errorf("getting Route53 Key-Signing Keys for %s: %w", region, err))
 	}
 
-	if err = sweep.SweepOrchestratorWithContext(ctx, sweepResources, tfresource.WithDelayRand(1*time.Minute), tfresource.WithMinPollInterval(30*time.Second), tfresource.WithPollInterval(30*time.Second)); err != nil {
+	if err = sweep.SweepOrchestrator(ctx, sweepResources, tfresource.WithDelayRand(1*time.Minute), tfresource.WithMinPollInterval(30*time.Second), tfresource.WithPollInterval(30*time.Second)); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("sweeping Route53 Key-Signing Keys for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
+	if awsv1.SkipSweepError(errs.ErrorOrNil()) {
 		log.Printf("[WARN] Skipping Route53 Key-Signing Keys sweep for %s: %s", region, errs)
 		return nil
 	}
@@ -195,7 +195,7 @@ func sweepKeySigningKeys(region string) error {
 
 func sweepQueryLogs(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("getting client: %w", err)
 	}
@@ -223,7 +223,7 @@ func sweepQueryLogs(region string) error {
 	})
 	// In unsupported AWS partitions, the API may return an error even the SDK cannot handle.
 	// Reference: https://github.com/aws/aws-sdk-go/issues/3313
-	if sweep.SkipSweepError(err) || tfawserr.ErrMessageContains(err, "SerializationError", "failed to unmarshal error message") || tfawserr.ErrMessageContains(err, "AccessDeniedException", "Unable to determine service/operation name to be authorized") {
+	if awsv1.SkipSweepError(err) || tfawserr.ErrMessageContains(err, "SerializationError", "failed to unmarshal error message") || tfawserr.ErrMessageContains(err, "AccessDeniedException", "Unable to determine service/operation name to be authorized") {
 		log.Printf("[WARN] Skipping Route53 query logging configurations sweep for %s: %s", region, err)
 		return sweeperErrs.ErrorOrNil() // In case we have completed some pages, but had errors
 	}
@@ -231,7 +231,7 @@ func sweepQueryLogs(region string) error {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("retrieving Route53 query logging configurations: %w", err))
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error sweeping Route53 query logging configurations: %w", err))
 	}
 
@@ -240,7 +240,11 @@ func sweepQueryLogs(region string) error {
 
 func sweepTrafficPolicies(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	if region == names.USGovEast1RegionID || region == names.USGovWest1RegionID {
+		log.Printf("[WARN] Skipping Route 53 Traffic Policy sweep for region: %s", region)
+		return nil
+	}
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("getting client: %w", err)
 	}
@@ -264,7 +268,7 @@ func sweepTrafficPolicies(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Route 53 Traffic Policy sweep for %s: %s", region, err)
 		return nil
 	}
@@ -273,7 +277,7 @@ func sweepTrafficPolicies(region string) error {
 		return fmt.Errorf("listing Route 53 Traffic Policies (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("sweeping Route 53 Traffic Policies (%s): %w", region, err)
@@ -284,7 +288,11 @@ func sweepTrafficPolicies(region string) error {
 
 func sweepTrafficPolicyInstances(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	if region == names.USGovEast1RegionID || region == names.USGovWest1RegionID {
+		log.Printf("[WARN] Skipping Route 53 Traffic Policy Instance sweep for region: %s", region)
+		return nil
+	}
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("getting client: %w", err)
 	}
@@ -308,7 +316,7 @@ func sweepTrafficPolicyInstances(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Route 53 Traffic Policy Instance sweep for %s: %s", region, err)
 		return nil
 	}
@@ -317,7 +325,7 @@ func sweepTrafficPolicyInstances(region string) error {
 		return fmt.Errorf("listing Route 53 Traffic Policy Instances (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("sweeping Route 53 Traffic Policy Instances (%s): %w", region, err)
@@ -328,17 +336,13 @@ func sweepTrafficPolicyInstances(region string) error {
 
 func sweepZones(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
-
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("getting client: %s", err)
 	}
-
 	conn := client.Route53Conn(ctx)
-	sweepResources := make([]sweep.Sweepable, 0)
-	var errs *multierror.Error
-
 	input := &route53.ListHostedZonesInput{}
+	sweepResources := make([]sweep.Sweepable, 0)
 
 	err = conn.ListHostedZonesPagesWithContext(ctx, input, func(page *route53.ListHostedZonesOutput, lastPage bool) bool {
 		if page == nil {
@@ -346,25 +350,26 @@ func sweepZones(region string) error {
 		}
 
 	MAIN:
-		for _, detail := range page.HostedZones {
-			if detail == nil {
-				continue
-			}
-
-			id := aws.StringValue(detail.Id)
+		for _, v := range page.HostedZones {
+			id := aws.StringValue(v.Id)
 
 			for _, domain := range hostedZonesToPreserve() {
-				if strings.Contains(aws.StringValue(detail.Name), domain) {
-					log.Printf("[DEBUG] Skipping Route53 Hosted Zone (%s): %s", domain, id)
+				if strings.Contains(aws.StringValue(v.Name), domain) {
+					log.Printf("[DEBUG] Skipping Route53 Hosted Zone %s: %s", id, domain)
 					continue MAIN
 				}
 			}
 
+			if v.LinkedService != nil {
+				log.Printf("[INFO] Skipping Route 53 Hosted Zone %s: %s", id, aws.StringValue(v.LinkedService.Description))
+				continue MAIN
+			}
+
 			r := ResourceZone()
 			d := r.Data(nil)
 			d.SetId(id)
 			d.Set("force_destroy", true)
-			d.Set("name", detail.Name)
+			d.Set("name", v.Name)
 
 			sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
 		}
@@ -372,20 +377,22 @@ func sweepZones(region string) error {
 		return !lastPage
 	})
 
-	if err != nil {
-		errs = multierror.Append(errs, fmt.Errorf("describing Route53 Hosted Zones for %s: %w", region, err))
+	if awsv1.SkipSweepError(err) {
+		log.Printf("[WARN] Skipping Route 53 Hosted Zone sweep for %s: %s", region, err)
+		return nil
 	}
 
-	if err = sweep.SweepOrchestratorWithContext(ctx, sweepResources, tfresource.WithDelayRand(1*time.Minute), tfresource.WithMinPollInterval(10*time.Second), tfresource.WithPollInterval(18*time.Second)); err != nil {
-		errs = multierror.Append(errs, fmt.Errorf("sweeping Route53 Hosted Zones for %s: %w", region, err))
+	if err != nil {
+		return fmt.Errorf("listing Route 53 Hosted Zones (%s): %w", region, err)
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
-		log.Printf("[WARN] Skipping Route53 Hosted Zones sweep for %s: %s", region, errs)
-		return nil
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
+
+	if err != nil {
+		return fmt.Errorf("sweeping Route 53 Hosted Zones (%s): %w", region, err)
 	}
 
-	return errs.ErrorOrNil()
+	return nil
 }
 
 func hostedZonesToPreserve() []string {
diff --git a/internal/service/route53/tags_gen.go b/internal/service/route53/tags_gen.go
index e1d7720b5ed..a1f618838da 100644
--- a/internal/service/route53/tags_gen.go
+++ b/internal/service/route53/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/route53"
 	"github.com/aws/aws-sdk-go/service/route53/route53iface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -111,6 +113,9 @@ func createTags(ctx context.Context, conn route53iface.Route53API, identifier, r
 func updateTags(ctx context.Context, conn route53iface.Route53API, identifier, resourceType string, oldTagsMap, newTagsMap any) error {
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
+
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.Route53)
 	updatedTags := oldTags.Updated(newTags)
diff --git a/internal/service/route53/traffic_policy.go b/internal/service/route53/traffic_policy.go
index cd50e8be871..754f1866da4 100644
--- a/internal/service/route53/traffic_policy.go
+++ b/internal/service/route53/traffic_policy.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53
 
 import (
diff --git a/internal/service/route53/traffic_policy_document_data_source.go b/internal/service/route53/traffic_policy_document_data_source.go
index 4c034b2354c..9a25bb87364 100644
--- a/internal/service/route53/traffic_policy_document_data_source.go
+++ b/internal/service/route53/traffic_policy_document_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53
 
 import (
diff --git a/internal/service/route53/traffic_policy_document_data_source_test.go b/internal/service/route53/traffic_policy_document_data_source_test.go
index c3080f4e75c..edfd08c17ec 100644
--- a/internal/service/route53/traffic_policy_document_data_source_test.go
+++ b/internal/service/route53/traffic_policy_document_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53_test
 
 import (
diff --git a/internal/service/route53/traffic_policy_document_model.go b/internal/service/route53/traffic_policy_document_model.go
index c3063f4f5a9..cc86508c37f 100644
--- a/internal/service/route53/traffic_policy_document_model.go
+++ b/internal/service/route53/traffic_policy_document_model.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53
 
 const (
diff --git a/internal/service/route53/traffic_policy_instance.go b/internal/service/route53/traffic_policy_instance.go
index 3de41348219..c2f9ba03f62 100644
--- a/internal/service/route53/traffic_policy_instance.go
+++ b/internal/service/route53/traffic_policy_instance.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53
 
 import (
diff --git a/internal/service/route53/traffic_policy_instance_test.go b/internal/service/route53/traffic_policy_instance_test.go
index 07b3b2f6db8..32dee59d8e8 100644
--- a/internal/service/route53/traffic_policy_instance_test.go
+++ b/internal/service/route53/traffic_policy_instance_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53_test
 
 import (
diff --git a/internal/service/route53/traffic_policy_test.go b/internal/service/route53/traffic_policy_test.go
index 3883d53eb86..4b5d5f617ad 100644
--- a/internal/service/route53/traffic_policy_test.go
+++ b/internal/service/route53/traffic_policy_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53_test
 
 import (
diff --git a/internal/service/route53/vpc_association_authorization.go b/internal/service/route53/vpc_association_authorization.go
index 843484892d8..c35059d6fee 100644
--- a/internal/service/route53/vpc_association_authorization.go
+++ b/internal/service/route53/vpc_association_authorization.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53
 
 import (
diff --git a/internal/service/route53/vpc_association_authorization_test.go b/internal/service/route53/vpc_association_authorization_test.go
index dad7563a823..1c57542deda 100644
--- a/internal/service/route53/vpc_association_authorization_test.go
+++ b/internal/service/route53/vpc_association_authorization_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53_test
 
 import (
diff --git a/internal/service/route53/wait.go b/internal/service/route53/wait.go
index a1b25ad5736..d8f577b2699 100644
--- a/internal/service/route53/wait.go
+++ b/internal/service/route53/wait.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53
 
 import (
@@ -27,8 +30,6 @@ const (
 )
 
 func waitChangeInfoStatusInsync(ctx context.Context, conn *route53.Route53, changeID string) (*route53.ChangeInfo, error) { //nolint:unparam
-	rand.Seed(time.Now().UTC().UnixNano())
-
 	// Route53 is vulnerable to throttling so longer delays, poll intervals helps significantly to avoid
 
 	stateConf := &retry.StateChangeConf{
diff --git a/internal/service/route53/zone.go b/internal/service/route53/zone.go
index ed82d34e887..e39e6ec7c06 100644
--- a/internal/service/route53/zone.go
+++ b/internal/service/route53/zone.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53
 
 import (
@@ -314,7 +317,7 @@ func resourceZoneDelete(ctx context.Context, d *schema.ResourceData, meta interf
 		Id: aws.String(d.Id()),
 	}
 
-	log.Printf("[DEBUG] Deleting Route53 Hosted Zone: %s", input)
+	log.Printf("[DEBUG] Deleting Route53 Hosted Zone: %s", d.Id())
 	_, err := conn.DeleteHostedZoneWithContext(ctx, input)
 
 	if tfawserr.ErrCodeEquals(err, route53.ErrCodeNoSuchHostedZone) {
@@ -407,6 +410,10 @@ func deleteAllResourceRecordsFromHostedZone(ctx context.Context, conn *route53.R
 		return !lastPage
 	})
 
+	if tfawserr.ErrCodeEquals(err, route53.ErrCodeNoSuchHostedZone) {
+		return nil
+	}
+
 	if err != nil {
 		return fmt.Errorf("Failed listing/deleting record sets: %s\nLast error from deletion: %s\nLast error from waiter: %s",
 			err, lastDeleteErr, lastErrorFromWaiter)
@@ -442,7 +449,8 @@ func dnsSECStatus(ctx context.Context, conn *route53.Route53, hostedZoneID strin
 		output, err = conn.GetDNSSECWithContext(ctx, input)
 	}
 
-	if tfawserr.ErrMessageContains(err, route53.ErrCodeInvalidArgument, "Operation is unsupported for private") {
+	if tfawserr.ErrMessageContains(err, route53.ErrCodeInvalidArgument, "Operation is unsupported for private") ||
+		tfawserr.ErrMessageContains(err, "AccessDenied", "The operation GetDNSSEC is not available for the current AWS account") {
 		return "NOT_SIGNING", nil
 	}
 
@@ -680,8 +688,6 @@ func hostedZoneVPCHash(v interface{}) int {
 }
 
 func waitForChangeSynchronization(ctx context.Context, conn *route53.Route53, changeID string) error {
-	rand.Seed(time.Now().UTC().UnixNano())
-
 	conf := retry.StateChangeConf{
 		Pending:      []string{route53.ChangeStatusPending},
 		Target:       []string{route53.ChangeStatusInsync},
diff --git a/internal/service/route53/zone_association.go b/internal/service/route53/zone_association.go
index 185e8c3b514..e17fa7c445b 100644
--- a/internal/service/route53/zone_association.go
+++ b/internal/service/route53/zone_association.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53
 
 import (
diff --git a/internal/service/route53/zone_association_test.go b/internal/service/route53/zone_association_test.go
index d1c5fe93d44..5c7e1fc2fd4 100644
--- a/internal/service/route53/zone_association_test.go
+++ b/internal/service/route53/zone_association_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53_test
 
 import (
diff --git a/internal/service/route53/zone_data_source.go b/internal/service/route53/zone_data_source.go
index 46ba6435a2a..140fbc31e1b 100644
--- a/internal/service/route53/zone_data_source.go
+++ b/internal/service/route53/zone_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53
 
 import (
diff --git a/internal/service/route53/zone_data_source_test.go b/internal/service/route53/zone_data_source_test.go
index 2c0a4590cad..bae8e7d8697 100644
--- a/internal/service/route53/zone_data_source_test.go
+++ b/internal/service/route53/zone_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53_test
 
 import (
diff --git a/internal/service/route53/zone_test.go b/internal/service/route53/zone_test.go
index 58c0610b374..7d7d3c30148 100644
--- a/internal/service/route53/zone_test.go
+++ b/internal/service/route53/zone_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53_test
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/route53"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -101,7 +104,7 @@ func TestAccRoute53Zone_basic(t *testing.T) {
 				Config: testAccZoneConfig_basic(zoneName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckZoneExists(ctx, resourceName, &zone),
-					acctest.MatchResourceAttrGlobalARNNoAccount(resourceName, "arn", "route53", regexp.MustCompile("hostedzone/.+")),
+					acctest.MatchResourceAttrGlobalARNNoAccount(resourceName, "arn", "route53", regexache.MustCompile("hostedzone/.+")),
 					resource.TestCheckResourceAttr(resourceName, "name", zoneName),
 					resource.TestCheckResourceAttr(resourceName, "name_servers.#", "4"),
 					resource.TestCheckResourceAttrSet(resourceName, "primary_name_server"),
@@ -446,6 +449,39 @@ func TestAccRoute53Zone_VPC_updates(t *testing.T) {
 	})
 }
 
+// Excercises exception handling during forced destruction in partitions
+// which do no support DNSSEC (e.g. GovCloud).
+//
+// Ref: https://github.com/hashicorp/terraform-provider-aws/issues/22334
+func TestAccRoute53Zone_VPC_single_forceDestroy(t *testing.T) {
+	ctx := acctest.Context(t)
+	var zone route53.GetHostedZoneOutput
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_route53_zone.test"
+	vpcResourceName := "aws_vpc.test1"
+	zoneName := acctest.RandomDomainName()
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, route53.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckZoneDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccZoneConfig_vpcSingle_forceDestroy(rName, zoneName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckZoneExists(ctx, resourceName, &zone),
+					resource.TestCheckResourceAttr(resourceName, "vpc.#", "1"),
+					testAccCheckZoneAssociatesVPC(vpcResourceName, &zone),
+					// Add >100 records to verify pagination works ok
+					testAccCreateRandomRecordsInZoneID(ctx, &zone, 100),
+					testAccCreateRandomRecordsInZoneID(ctx, &zone, 5),
+				),
+			},
+		},
+	})
+}
+
 func testAccCheckZoneDestroy(ctx context.Context) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		conn := acctest.Provider.Meta().(*conns.AWSClient).Route53Conn(ctx)
@@ -703,3 +739,24 @@ resource "aws_route53_zone" "test" {
 }
 `, rName, zoneName)
 }
+
+func testAccZoneConfig_vpcSingle_forceDestroy(rName, zoneName string) string {
+	return fmt.Sprintf(`
+resource "aws_vpc" "test1" {
+  cidr_block = "10.1.0.0/16"
+
+  tags = {
+    Name = %[1]q
+  }
+}
+
+resource "aws_route53_zone" "test" {
+  force_destroy = true
+  name          = "%[2]s."
+
+  vpc {
+    vpc_id = aws_vpc.test1.id
+  }
+}
+`, rName, zoneName)
+}
diff --git a/internal/service/route53domains/generate.go b/internal/service/route53domains/generate.go
index 57c6c8987a7..9466b787e70 100644
--- a/internal/service/route53domains/generate.go
+++ b/internal/service/route53domains/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -AWSSDKVersion=2 -ListTags -ListTagsOp=ListTagsForDomain -ListTagsInIDElem=DomainName -ListTagsOutTagsElem=TagList -ServiceTagsSlice -UpdateTags -UntagOp=DeleteTagsForDomain -UntagInTagsElem=TagsToDelete -TagOp=UpdateTagsForDomain -TagInTagsElem=TagsToUpdate -TagInIDElem=DomainName -GetTag
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/route53domains/registered_domain.go b/internal/service/route53domains/registered_domain.go
index 14e91b1fa96..cfa6c07f5fa 100644
--- a/internal/service/route53domains/registered_domain.go
+++ b/internal/service/route53domains/registered_domain.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53domains
 
 import (
@@ -6,10 +9,10 @@ import (
 	"fmt"
 	"log"
 	"reflect"
-	"regexp"
 	"strings"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/route53domains"
 	"github.com/aws/aws-sdk-go-v2/service/route53domains/types"
@@ -188,7 +191,7 @@ func ResourceRegisteredDomain() *schema.Resource {
 							Required: true,
 							ValidateFunc: validation.All(
 								validation.StringLenBetween(1, 255),
-								validation.StringMatch(regexp.MustCompile(`[a-zA-Z0-9_\-.]*`), "can contain only alphabetical characters (A-Z or a-z), numeric characters (0-9), underscore (_), the minus sign (-), and the period (.)"),
+								validation.StringMatch(regexache.MustCompile(`[0-9A-Za-z_.-]*`), "can contain only alphabetical characters (A-Z or a-z), numeric characters (0-9), underscore (_), the minus sign (-), and the period (.)"),
 							),
 						},
 					},
diff --git a/internal/service/route53domains/registered_domain_test.go b/internal/service/route53domains/registered_domain_test.go
index ca788e0f5e9..33052fc8024 100644
--- a/internal/service/route53domains/registered_domain_test.go
+++ b/internal/service/route53domains/registered_domain_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53domains_test
 
 import (
diff --git a/internal/service/route53domains/service_package.go b/internal/service/route53domains/service_package.go
index 346d1b61f97..4367966a7bc 100644
--- a/internal/service/route53domains/service_package.go
+++ b/internal/service/route53domains/service_package.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53domains
 
 import (
@@ -14,7 +17,7 @@ func (p *servicePackage) NewClient(ctx context.Context, config map[string]any) (
 
 	return route53domains_sdkv2.NewFromConfig(cfg, func(o *route53domains_sdkv2.Options) {
 		if endpoint := config["endpoint"].(string); endpoint != "" {
-			o.EndpointResolver = route53domains_sdkv2.EndpointResolverFromURL(endpoint)
+			o.BaseEndpoint = aws_sdkv2.String(endpoint)
 		} else if config["partition"].(string) == endpoints_sdkv1.AwsPartitionID {
 			// Route 53 Domains is only available in AWS Commercial us-east-1 Region.
 			o.Region = endpoints_sdkv1.UsEast1RegionID
diff --git a/internal/service/route53domains/service_package_gen.go b/internal/service/route53domains/service_package_gen.go
index 4933e771fda..1ee5bc5e3ef 100644
--- a/internal/service/route53domains/service_package_gen.go
+++ b/internal/service/route53domains/service_package_gen.go
@@ -5,6 +5,7 @@ package route53domains
 import (
 	"context"
 
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -40,4 +41,6 @@ func (p *servicePackage) ServicePackageName() string {
 	return names.Route53Domains
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/route53domains/tags_gen.go b/internal/service/route53domains/tags_gen.go
index a1a01121bc9..b5ef012e8bf 100644
--- a/internal/service/route53domains/tags_gen.go
+++ b/internal/service/route53domains/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/route53domains"
 	awstypes "github.com/aws/aws-sdk-go-v2/service/route53domains/types"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
@@ -122,6 +124,8 @@ func updateTags(ctx context.Context, conn *route53domains.Client, identifier str
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.Route53Domains)
 	if len(removedTags) > 0 {
diff --git a/internal/service/route53recoverycontrolconfig/cluster.go b/internal/service/route53recoverycontrolconfig/cluster.go
index cb3ecda70f0..3bd0fa25e5d 100644
--- a/internal/service/route53recoverycontrolconfig/cluster.go
+++ b/internal/service/route53recoverycontrolconfig/cluster.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53recoverycontrolconfig
 
 import (
diff --git a/internal/service/route53recoverycontrolconfig/cluster_test.go b/internal/service/route53recoverycontrolconfig/cluster_test.go
index 68b342958ab..c09837aeafa 100644
--- a/internal/service/route53recoverycontrolconfig/cluster_test.go
+++ b/internal/service/route53recoverycontrolconfig/cluster_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53recoverycontrolconfig_test
 
 import (
diff --git a/internal/service/route53recoverycontrolconfig/control_panel.go b/internal/service/route53recoverycontrolconfig/control_panel.go
index edd6cdc2a65..4841730902f 100644
--- a/internal/service/route53recoverycontrolconfig/control_panel.go
+++ b/internal/service/route53recoverycontrolconfig/control_panel.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53recoverycontrolconfig
 
 import (
diff --git a/internal/service/route53recoverycontrolconfig/control_panel_test.go b/internal/service/route53recoverycontrolconfig/control_panel_test.go
index a16d3f7bf3f..763f075be91 100644
--- a/internal/service/route53recoverycontrolconfig/control_panel_test.go
+++ b/internal/service/route53recoverycontrolconfig/control_panel_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53recoverycontrolconfig_test
 
 import (
diff --git a/internal/service/route53recoverycontrolconfig/generate.go b/internal/service/route53recoverycontrolconfig/generate.go
index 89ffa8fa222..18b8964a30f 100644
--- a/internal/service/route53recoverycontrolconfig/generate.go
+++ b/internal/service/route53recoverycontrolconfig/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
 
diff --git a/internal/service/route53recoverycontrolconfig/route53recoverycontrolconfig_test.go b/internal/service/route53recoverycontrolconfig/route53recoverycontrolconfig_test.go
index aee34a5cb1d..54c27c4117c 100644
--- a/internal/service/route53recoverycontrolconfig/route53recoverycontrolconfig_test.go
+++ b/internal/service/route53recoverycontrolconfig/route53recoverycontrolconfig_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53recoverycontrolconfig_test
 
 import (
diff --git a/internal/service/route53recoverycontrolconfig/routing_control.go b/internal/service/route53recoverycontrolconfig/routing_control.go
index 5af59a4ec2b..7f571acee58 100644
--- a/internal/service/route53recoverycontrolconfig/routing_control.go
+++ b/internal/service/route53recoverycontrolconfig/routing_control.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53recoverycontrolconfig
 
 import (
diff --git a/internal/service/route53recoverycontrolconfig/routing_control_test.go b/internal/service/route53recoverycontrolconfig/routing_control_test.go
index f74e706f107..87ef235435a 100644
--- a/internal/service/route53recoverycontrolconfig/routing_control_test.go
+++ b/internal/service/route53recoverycontrolconfig/routing_control_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53recoverycontrolconfig_test
 
 import (
diff --git a/internal/service/route53recoverycontrolconfig/safety_rule.go b/internal/service/route53recoverycontrolconfig/safety_rule.go
index 4fc2862c39b..8a0f12c7cd4 100644
--- a/internal/service/route53recoverycontrolconfig/safety_rule.go
+++ b/internal/service/route53recoverycontrolconfig/safety_rule.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53recoverycontrolconfig
 
 import (
diff --git a/internal/service/route53recoverycontrolconfig/safety_rule_test.go b/internal/service/route53recoverycontrolconfig/safety_rule_test.go
index 206ed16f1e4..62a805ce96c 100644
--- a/internal/service/route53recoverycontrolconfig/safety_rule_test.go
+++ b/internal/service/route53recoverycontrolconfig/safety_rule_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53recoverycontrolconfig_test
 
 import (
diff --git a/internal/service/route53recoverycontrolconfig/service_package.go b/internal/service/route53recoverycontrolconfig/service_package.go
index e9b1eada7da..f4acf4f25b4 100644
--- a/internal/service/route53recoverycontrolconfig/service_package.go
+++ b/internal/service/route53recoverycontrolconfig/service_package.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53recoverycontrolconfig
 
 import (
diff --git a/internal/service/route53recoverycontrolconfig/service_package_gen.go b/internal/service/route53recoverycontrolconfig/service_package_gen.go
index 3cadff05d46..5aeb51c243a 100644
--- a/internal/service/route53recoverycontrolconfig/service_package_gen.go
+++ b/internal/service/route53recoverycontrolconfig/service_package_gen.go
@@ -5,6 +5,7 @@ package route53recoverycontrolconfig
 import (
 	"context"
 
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -48,4 +49,6 @@ func (p *servicePackage) ServicePackageName() string {
 	return names.Route53RecoveryControlConfig
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/route53recoverycontrolconfig/status.go b/internal/service/route53recoverycontrolconfig/status.go
index 511f2f26eff..c86024308d4 100644
--- a/internal/service/route53recoverycontrolconfig/status.go
+++ b/internal/service/route53recoverycontrolconfig/status.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53recoverycontrolconfig
 
 import (
diff --git a/internal/service/route53recoverycontrolconfig/sweep.go b/internal/service/route53recoverycontrolconfig/sweep.go
index 6fe951e14e1..225e8fd826f 100644
--- a/internal/service/route53recoverycontrolconfig/sweep.go
+++ b/internal/service/route53recoverycontrolconfig/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package route53recoverycontrolconfig
 
@@ -12,9 +12,10 @@ import (
 	multierror "github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_route53recoverycontrolconfig_cluster", &resource.Sweeper{
 		Name: "aws_route53recoverycontrolconfig_cluster",
 		F:    sweepClusters,
@@ -45,7 +46,7 @@ func init() {
 
 func sweepClusters(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
@@ -69,7 +70,7 @@ func sweepClusters(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Route53 Recovery Control Config Cluster sweep for %s: %s", region, err)
 		return nil
 	}
@@ -78,7 +79,7 @@ func sweepClusters(region string) error {
 		return fmt.Errorf("error listing Route53 Recovery Control Config Clusters (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping Route53 Recovery Control Config Clusters (%s): %w", region, err)
@@ -89,7 +90,7 @@ func sweepClusters(region string) error {
 
 func sweepControlPanels(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
@@ -128,7 +129,7 @@ func sweepControlPanels(region string) error {
 				return !lastPage
 			})
 
-			if sweep.SkipSweepError(err) {
+			if awsv1.SkipSweepError(err) {
 				continue
 			}
 
@@ -140,7 +141,7 @@ func sweepControlPanels(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Route53 Recovery Control Config Control Panel sweep for %s: %s", region, err)
 		return sweeperErrs.ErrorOrNil() // In case we have completed some pages, but had errors
 	}
@@ -149,7 +150,7 @@ func sweepControlPanels(region string) error {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error listing Route53 Recovery Control Config Clusters (%s): %w", region, err))
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error sweeping Route53 Recovery Control Config Control Panels (%s): %w", region, err))
@@ -160,7 +161,7 @@ func sweepControlPanels(region string) error {
 
 func sweepRoutingControls(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
@@ -205,7 +206,7 @@ func sweepRoutingControls(region string) error {
 						return !lastPage
 					})
 
-					if sweep.SkipSweepError(err) {
+					if awsv1.SkipSweepError(err) {
 						continue
 					}
 
@@ -217,7 +218,7 @@ func sweepRoutingControls(region string) error {
 				return !lastPage
 			})
 
-			if sweep.SkipSweepError(err) {
+			if awsv1.SkipSweepError(err) {
 				continue
 			}
 
@@ -229,7 +230,7 @@ func sweepRoutingControls(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Route53 Recovery Control Config Routing Control sweep for %s: %s", region, err)
 		return sweeperErrs.ErrorOrNil() // In case we have completed some pages, but had errors
 	}
@@ -238,7 +239,7 @@ func sweepRoutingControls(region string) error {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error listing Route53 Recovery Control Config Clusters (%s): %w", region, err))
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error sweeping Route53 Recovery Control Config Routing Controls (%s): %w", region, err))
@@ -249,7 +250,7 @@ func sweepRoutingControls(region string) error {
 
 func sweepSafetyRules(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
@@ -300,7 +301,7 @@ func sweepSafetyRules(region string) error {
 						return !lastPage
 					})
 
-					if sweep.SkipSweepError(err) {
+					if awsv1.SkipSweepError(err) {
 						continue
 					}
 
@@ -312,7 +313,7 @@ func sweepSafetyRules(region string) error {
 				return !lastPage
 			})
 
-			if sweep.SkipSweepError(err) {
+			if awsv1.SkipSweepError(err) {
 				continue
 			}
 
@@ -324,7 +325,7 @@ func sweepSafetyRules(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Route53 Recovery Control Config Safety Rule sweep for %s: %s", region, err)
 		return sweeperErrs.ErrorOrNil() // In case we have completed some pages, but had errors
 	}
@@ -333,7 +334,7 @@ func sweepSafetyRules(region string) error {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error listing Route53 Recovery Control Config Clusters (%s): %w", region, err))
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error sweeping Route53 Recovery Control Config Safety Rules (%s): %w", region, err))
diff --git a/internal/service/route53recoverycontrolconfig/wait.go b/internal/service/route53recoverycontrolconfig/wait.go
index 276c5a17387..621f023d227 100644
--- a/internal/service/route53recoverycontrolconfig/wait.go
+++ b/internal/service/route53recoverycontrolconfig/wait.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53recoverycontrolconfig
 
 import (
diff --git a/internal/service/route53recoveryreadiness/cell.go b/internal/service/route53recoveryreadiness/cell.go
index 1da397692d6..6016a54b6d8 100644
--- a/internal/service/route53recoveryreadiness/cell.go
+++ b/internal/service/route53recoveryreadiness/cell.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53recoveryreadiness
 
 import (
diff --git a/internal/service/route53recoveryreadiness/cell_test.go b/internal/service/route53recoveryreadiness/cell_test.go
index d566ed177f9..55d948fbd4a 100644
--- a/internal/service/route53recoveryreadiness/cell_test.go
+++ b/internal/service/route53recoveryreadiness/cell_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53recoveryreadiness_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/route53recoveryreadiness"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -31,7 +34,7 @@ func TestAccRoute53RecoveryReadinessCell_basic(t *testing.T) {
 				Config: testAccCellConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckCellExists(ctx, resourceName),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "route53-recovery-readiness", regexp.MustCompile(`cell/.+`)),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "route53-recovery-readiness", regexache.MustCompile(`cell/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "cells.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "parent_readiness_scopes.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
@@ -86,18 +89,18 @@ func TestAccRoute53RecoveryReadinessCell_nestedCell(t *testing.T) {
 				Config: testAccCellConfig_child(rNameChild),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckCellExists(ctx, resourceNameChild),
-					acctest.MatchResourceAttrGlobalARN(resourceNameChild, "arn", "route53-recovery-readiness", regexp.MustCompile(`cell/.+`)),
+					acctest.MatchResourceAttrGlobalARN(resourceNameChild, "arn", "route53-recovery-readiness", regexache.MustCompile(`cell/.+`)),
 				),
 			},
 			{
 				Config: testAccCellConfig_parent(rNameChild, rNameParent),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckCellExists(ctx, resourceNameParent),
-					acctest.MatchResourceAttrGlobalARN(resourceNameParent, "arn", "route53-recovery-readiness", regexp.MustCompile(`cell/.+`)),
+					acctest.MatchResourceAttrGlobalARN(resourceNameParent, "arn", "route53-recovery-readiness", regexache.MustCompile(`cell/.+`)),
 					resource.TestCheckResourceAttr(resourceNameParent, "cells.#", "1"),
 					resource.TestCheckResourceAttr(resourceNameParent, "parent_readiness_scopes.#", "0"),
 					testAccCheckCellExists(ctx, resourceNameChild),
-					acctest.MatchResourceAttrGlobalARN(resourceNameChild, "arn", "route53-recovery-readiness", regexp.MustCompile(`cell/.+`)),
+					acctest.MatchResourceAttrGlobalARN(resourceNameChild, "arn", "route53-recovery-readiness", regexache.MustCompile(`cell/.+`)),
 					resource.TestCheckResourceAttr(resourceNameChild, "cells.#", "0"),
 				),
 			},
@@ -181,7 +184,7 @@ func TestAccRoute53RecoveryReadinessCell_timeout(t *testing.T) {
 				Config: testAccCellConfig_timeout(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckCellExists(ctx, resourceName),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "route53-recovery-readiness", regexp.MustCompile(`cell/.+`)),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "route53-recovery-readiness", regexache.MustCompile(`cell/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "cells.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "parent_readiness_scopes.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
diff --git a/internal/service/route53recoveryreadiness/generate.go b/internal/service/route53recoveryreadiness/generate.go
index b159ff96c94..994f619e28b 100644
--- a/internal/service/route53recoveryreadiness/generate.go
+++ b/internal/service/route53recoveryreadiness/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTags -ListTagsOp=ListTagsForResources -ServiceTagsMap -UpdateTags -CreateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/route53recoveryreadiness/readiness_check.go b/internal/service/route53recoveryreadiness/readiness_check.go
index c5eed551ee3..60f3184b824 100644
--- a/internal/service/route53recoveryreadiness/readiness_check.go
+++ b/internal/service/route53recoveryreadiness/readiness_check.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53recoveryreadiness
 
 import (
diff --git a/internal/service/route53recoveryreadiness/readiness_check_test.go b/internal/service/route53recoveryreadiness/readiness_check_test.go
index e11722e3b9d..d2f9c8255f4 100644
--- a/internal/service/route53recoveryreadiness/readiness_check_test.go
+++ b/internal/service/route53recoveryreadiness/readiness_check_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53recoveryreadiness_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/aws/aws-sdk-go/aws/endpoints"
@@ -41,7 +44,7 @@ func TestAccRoute53RecoveryReadinessReadinessCheck_basic(t *testing.T) {
 				Config: testAccReadinessCheckConfig_basic(rName, rSetName, cwArn),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckReadinessCheckExists(ctx, resourceName),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "route53-recovery-readiness", regexp.MustCompile(`readiness-check/.+`)),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "route53-recovery-readiness", regexache.MustCompile(`readiness-check/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "resource_set_name", rSetName),
 				),
 			},
@@ -160,7 +163,7 @@ func TestAccRoute53RecoveryReadinessReadinessCheck_timeout(t *testing.T) {
 				Config: testAccReadinessCheckConfig_timeout(rName, rSetName, cwArn),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckReadinessCheckExists(ctx, resourceName),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "route53-recovery-readiness", regexp.MustCompile(`readiness-check/.+`)),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "route53-recovery-readiness", regexache.MustCompile(`readiness-check/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "resource_set_name", rSetName),
 				),
 			},
diff --git a/internal/service/route53recoveryreadiness/recovery_group.go b/internal/service/route53recoveryreadiness/recovery_group.go
index d05afef5dbb..fe16e32b3c7 100644
--- a/internal/service/route53recoveryreadiness/recovery_group.go
+++ b/internal/service/route53recoveryreadiness/recovery_group.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53recoveryreadiness
 
 import (
diff --git a/internal/service/route53recoveryreadiness/recovery_group_test.go b/internal/service/route53recoveryreadiness/recovery_group_test.go
index 146a375d9bb..b1373c040c7 100644
--- a/internal/service/route53recoveryreadiness/recovery_group_test.go
+++ b/internal/service/route53recoveryreadiness/recovery_group_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53recoveryreadiness_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/route53recoveryreadiness"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -31,7 +34,7 @@ func TestAccRoute53RecoveryReadinessRecoveryGroup_basic(t *testing.T) {
 				Config: testAccRecoveryGroupConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRecoveryGroupExists(ctx, resourceName),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "route53-recovery-readiness", regexp.MustCompile(`recovery-group/.+`)),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "route53-recovery-readiness", regexache.MustCompile(`recovery-group/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "cells.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 				),
@@ -83,7 +86,7 @@ func TestAccRoute53RecoveryReadinessRecoveryGroup_nestedCell(t *testing.T) {
 				Config: testAccRecoveryGroupConfig_andCell(rName, rNameCell),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRecoveryGroupExists(ctx, resourceName),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "route53-recovery-readiness", regexp.MustCompile(`recovery-group/.+`)),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "route53-recovery-readiness", regexache.MustCompile(`recovery-group/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "cells.#", "1"),
 				),
 			},
@@ -154,7 +157,7 @@ func TestAccRoute53RecoveryReadinessRecoveryGroup_timeout(t *testing.T) {
 				Config: testAccRecoveryGroupConfig_timeout(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRecoveryGroupExists(ctx, resourceName),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "route53-recovery-readiness", regexp.MustCompile(`recovery-group/.+`)),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "route53-recovery-readiness", regexache.MustCompile(`recovery-group/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "cells.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 				),
diff --git a/internal/service/route53recoveryreadiness/resource_set.go b/internal/service/route53recoveryreadiness/resource_set.go
index f6ca458b798..5e4dfe06ce2 100644
--- a/internal/service/route53recoveryreadiness/resource_set.go
+++ b/internal/service/route53recoveryreadiness/resource_set.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53recoveryreadiness
 
 import (
diff --git a/internal/service/route53recoveryreadiness/resource_set_test.go b/internal/service/route53recoveryreadiness/resource_set_test.go
index 793f3376dd8..845dddcb87f 100644
--- a/internal/service/route53recoveryreadiness/resource_set_test.go
+++ b/internal/service/route53recoveryreadiness/resource_set_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53recoveryreadiness_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/aws/aws-sdk-go/aws/endpoints"
@@ -40,7 +43,7 @@ func TestAccRoute53RecoveryReadinessResourceSet_basic(t *testing.T) {
 				Config: testAccResourceSetConfig_basic(rName, cwArn),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckResourceSetExists(ctx, resourceName),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "route53-recovery-readiness", regexp.MustCompile(`resource-set.+`)),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "route53-recovery-readiness", regexache.MustCompile(`resource-set.+`)),
 					resource.TestCheckResourceAttr(resourceName, "resources.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 				),
@@ -158,7 +161,7 @@ func TestAccRoute53RecoveryReadinessResourceSet_readinessScope(t *testing.T) {
 				Config: testAccResourceSetConfig_readinessScopes(rName, cwArn),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckResourceSetExists(ctx, resourceName),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "route53-recovery-readiness", regexp.MustCompile(`resource-set.+`)),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "route53-recovery-readiness", regexache.MustCompile(`resource-set.+`)),
 					resource.TestCheckResourceAttr(resourceName, "resources.0.readiness_scopes.#", "1"),
 				),
 			},
@@ -199,7 +202,7 @@ func TestAccRoute53RecoveryReadinessResourceSet_basicDNSTargetResource(t *testin
 				Config: testAccResourceSetConfig_basicDNSTarget(rName, domainName, hzArn, recordType, recordSetId),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckResourceSetExists(ctx, resourceName),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "route53-recovery-readiness", regexp.MustCompile(`resource-set.+`)),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "route53-recovery-readiness", regexache.MustCompile(`resource-set.+`)),
 					resource.TestCheckResourceAttr(resourceName, "resources.0.dns_target_resource.0.domain_name", domainName),
 					resource.TestCheckResourceAttrSet(resourceName, "resources.0.dns_target_resource.0.hosted_zone_arn"),
 					resource.TestCheckResourceAttr(resourceName, "resources.0.dns_target_resource.0.record_type", recordType),
@@ -240,7 +243,7 @@ func TestAccRoute53RecoveryReadinessResourceSet_dnsTargetResourceNLBTarget(t *te
 				Config: testAccResourceSetConfig_dnsTargetNlbTarget(rName, hzArn),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckResourceSetExists(ctx, resourceName),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "route53-recovery-readiness", regexp.MustCompile(`resource-set.+`)),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "route53-recovery-readiness", regexache.MustCompile(`resource-set.+`)),
 					resource.TestCheckResourceAttrSet(resourceName, "resources.0.dns_target_resource.0.target_resource.0.nlb_resource.0.arn"),
 				),
 			},
@@ -280,7 +283,7 @@ func TestAccRoute53RecoveryReadinessResourceSet_dnsTargetResourceR53Target(t *te
 				Config: testAccResourceSetConfig_dnsTargetR53Target(rName, hzArn, domainName, recordSetId),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckResourceSetExists(ctx, resourceName),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "route53-recovery-readiness", regexp.MustCompile(`resource-set.+`)),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "route53-recovery-readiness", regexache.MustCompile(`resource-set.+`)),
 					resource.TestCheckResourceAttr(resourceName, "resources.0.dns_target_resource.0.target_resource.0.r53_resource.0.domain_name", domainName),
 					resource.TestCheckResourceAttr(resourceName, "resources.0.dns_target_resource.0.target_resource.0.r53_resource.0.record_set_id", recordSetId),
 				),
@@ -316,7 +319,7 @@ func TestAccRoute53RecoveryReadinessResourceSet_timeout(t *testing.T) {
 				Config: testAccResourceSetConfig_timeout(rName, cwArn),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckResourceSetExists(ctx, resourceName),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "route53-recovery-readiness", regexp.MustCompile(`resource-set.+`)),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "route53-recovery-readiness", regexache.MustCompile(`resource-set.+`)),
 					resource.TestCheckResourceAttr(resourceName, "resources.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 				),
diff --git a/internal/service/route53recoveryreadiness/service_package.go b/internal/service/route53recoveryreadiness/service_package.go
index c9b3f0a974c..3cd81fccabe 100644
--- a/internal/service/route53recoveryreadiness/service_package.go
+++ b/internal/service/route53recoveryreadiness/service_package.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53recoveryreadiness
 
 import (
diff --git a/internal/service/route53recoveryreadiness/service_package_gen.go b/internal/service/route53recoveryreadiness/service_package_gen.go
index f5beaed0d97..ef438d19c70 100644
--- a/internal/service/route53recoveryreadiness/service_package_gen.go
+++ b/internal/service/route53recoveryreadiness/service_package_gen.go
@@ -5,6 +5,7 @@ package route53recoveryreadiness
 import (
 	"context"
 
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -64,4 +65,6 @@ func (p *servicePackage) ServicePackageName() string {
 	return names.Route53RecoveryReadiness
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/route53recoveryreadiness/tags_gen.go b/internal/service/route53recoveryreadiness/tags_gen.go
index 7ae72121438..6ac6929e2b9 100644
--- a/internal/service/route53recoveryreadiness/tags_gen.go
+++ b/internal/service/route53recoveryreadiness/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/route53recoveryreadiness"
 	"github.com/aws/aws-sdk-go/service/route53recoveryreadiness/route53recoveryreadinessiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -54,7 +56,7 @@ func Tags(tags tftags.KeyValueTags) map[string]*string {
 	return aws.StringMap(tags.Map())
 }
 
-// KeyValueTags creates KeyValueTags from route53recoveryreadiness service tags.
+// KeyValueTags creates tftags.KeyValueTags from route53recoveryreadiness service tags.
 func KeyValueTags(ctx context.Context, tags map[string]*string) tftags.KeyValueTags {
 	return tftags.New(ctx, tags)
 }
@@ -94,6 +96,8 @@ func updateTags(ctx context.Context, conn route53recoveryreadinessiface.Route53R
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.Route53RecoveryReadiness)
 	if len(removedTags) > 0 {
diff --git a/internal/service/route53resolver/config.go b/internal/service/route53resolver/config.go
index 61548ec50ed..45b90ed882f 100644
--- a/internal/service/route53resolver/config.go
+++ b/internal/service/route53resolver/config.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53resolver
 
 import (
diff --git a/internal/service/route53resolver/config_test.go b/internal/service/route53resolver/config_test.go
index 2884c50d0dd..b6a5efaf013 100644
--- a/internal/service/route53resolver/config_test.go
+++ b/internal/service/route53resolver/config_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53resolver_test
 
 import (
diff --git a/internal/service/route53resolver/dnssec_config.go b/internal/service/route53resolver/dnssec_config.go
index d8c867c4a39..ce4e1212a7a 100644
--- a/internal/service/route53resolver/dnssec_config.go
+++ b/internal/service/route53resolver/dnssec_config.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53resolver
 
 import (
diff --git a/internal/service/route53resolver/dnssec_config_test.go b/internal/service/route53resolver/dnssec_config_test.go
index 0fb63b6fac0..184c6d6056f 100644
--- a/internal/service/route53resolver/dnssec_config_test.go
+++ b/internal/service/route53resolver/dnssec_config_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53resolver_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/route53resolver"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -31,7 +34,7 @@ func TestAccRoute53ResolverDNSSECConfig_basic(t *testing.T) {
 				Config: testAccDNSSECConfigConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDNSSECConfigExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "route53resolver", regexp.MustCompile(`resolver-dnssec-config/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "route53resolver", regexache.MustCompile(`resolver-dnssec-config/.+$`)),
 					resource.TestCheckResourceAttrSet(resourceName, "id"),
 					resource.TestCheckResourceAttrSet(resourceName, "owner_id"),
 					resource.TestCheckResourceAttrSet(resourceName, "resource_id"),
diff --git a/internal/service/route53resolver/endpoint.go b/internal/service/route53resolver/endpoint.go
index 1f75bb5455b..fdaba25fa4d 100644
--- a/internal/service/route53resolver/endpoint.go
+++ b/internal/service/route53resolver/endpoint.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53resolver
 
 import (
diff --git a/internal/service/route53resolver/endpoint_data_source.go b/internal/service/route53resolver/endpoint_data_source.go
index f4954840db5..8deb06d4048 100644
--- a/internal/service/route53resolver/endpoint_data_source.go
+++ b/internal/service/route53resolver/endpoint_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53resolver
 
 import (
diff --git a/internal/service/route53resolver/endpoint_data_source_test.go b/internal/service/route53resolver/endpoint_data_source_test.go
index 5d499c46697..c1dae57e518 100644
--- a/internal/service/route53resolver/endpoint_data_source_test.go
+++ b/internal/service/route53resolver/endpoint_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53resolver_test
 
 import (
diff --git a/internal/service/route53resolver/endpoint_test.go b/internal/service/route53resolver/endpoint_test.go
index 741d2d8e468..1688d519872 100644
--- a/internal/service/route53resolver/endpoint_test.go
+++ b/internal/service/route53resolver/endpoint_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53resolver_test
 
 import (
diff --git a/internal/service/route53resolver/firewall_config.go b/internal/service/route53resolver/firewall_config.go
index 65698be7707..617b4f08ed8 100644
--- a/internal/service/route53resolver/firewall_config.go
+++ b/internal/service/route53resolver/firewall_config.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53resolver
 
 import (
diff --git a/internal/service/route53resolver/firewall_config_data_source.go b/internal/service/route53resolver/firewall_config_data_source.go
index 3bb19027874..26b7e79142a 100644
--- a/internal/service/route53resolver/firewall_config_data_source.go
+++ b/internal/service/route53resolver/firewall_config_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53resolver
 
 import (
diff --git a/internal/service/route53resolver/firewall_config_data_source_test.go b/internal/service/route53resolver/firewall_config_data_source_test.go
index ed1f109093f..3b5d3a17f5c 100644
--- a/internal/service/route53resolver/firewall_config_data_source_test.go
+++ b/internal/service/route53resolver/firewall_config_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53resolver_test
 
 import (
diff --git a/internal/service/route53resolver/firewall_config_test.go b/internal/service/route53resolver/firewall_config_test.go
index 61d9bf9225b..3fb94e0e733 100644
--- a/internal/service/route53resolver/firewall_config_test.go
+++ b/internal/service/route53resolver/firewall_config_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53resolver_test
 
 import (
diff --git a/internal/service/route53resolver/firewall_domain_list.go b/internal/service/route53resolver/firewall_domain_list.go
index d17a237c688..8e4474fc4e1 100644
--- a/internal/service/route53resolver/firewall_domain_list.go
+++ b/internal/service/route53resolver/firewall_domain_list.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53resolver
 
 import (
diff --git a/internal/service/route53resolver/firewall_domain_list_data_source.go b/internal/service/route53resolver/firewall_domain_list_data_source.go
index 9f905b48a9d..0fa3b2b254c 100644
--- a/internal/service/route53resolver/firewall_domain_list_data_source.go
+++ b/internal/service/route53resolver/firewall_domain_list_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53resolver
 
 import (
diff --git a/internal/service/route53resolver/firewall_domain_list_data_source_test.go b/internal/service/route53resolver/firewall_domain_list_data_source_test.go
index 036134be7da..c8e6a2019e2 100644
--- a/internal/service/route53resolver/firewall_domain_list_data_source_test.go
+++ b/internal/service/route53resolver/firewall_domain_list_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53resolver_test
 
 import (
diff --git a/internal/service/route53resolver/firewall_domain_list_test.go b/internal/service/route53resolver/firewall_domain_list_test.go
index ffc2a0cb0a6..2fac578630d 100644
--- a/internal/service/route53resolver/firewall_domain_list_test.go
+++ b/internal/service/route53resolver/firewall_domain_list_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53resolver_test
 
 import (
diff --git a/internal/service/route53resolver/firewall_rule.go b/internal/service/route53resolver/firewall_rule.go
index 61e80073716..c7796cb93d0 100644
--- a/internal/service/route53resolver/firewall_rule.go
+++ b/internal/service/route53resolver/firewall_rule.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53resolver
 
 import (
diff --git a/internal/service/route53resolver/firewall_rule_group.go b/internal/service/route53resolver/firewall_rule_group.go
index 53e5204db1b..e2389cd83b1 100644
--- a/internal/service/route53resolver/firewall_rule_group.go
+++ b/internal/service/route53resolver/firewall_rule_group.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53resolver
 
 import (
diff --git a/internal/service/route53resolver/firewall_rule_group_association.go b/internal/service/route53resolver/firewall_rule_group_association.go
index 616f2273c97..5486e9df3d1 100644
--- a/internal/service/route53resolver/firewall_rule_group_association.go
+++ b/internal/service/route53resolver/firewall_rule_group_association.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53resolver
 
 import (
diff --git a/internal/service/route53resolver/firewall_rule_group_association_data_source.go b/internal/service/route53resolver/firewall_rule_group_association_data_source.go
index 47ebd483bde..7094d10fe50 100644
--- a/internal/service/route53resolver/firewall_rule_group_association_data_source.go
+++ b/internal/service/route53resolver/firewall_rule_group_association_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53resolver
 
 import (
diff --git a/internal/service/route53resolver/firewall_rule_group_association_data_source_test.go b/internal/service/route53resolver/firewall_rule_group_association_data_source_test.go
index 05eaf04b043..93d28f6d144 100644
--- a/internal/service/route53resolver/firewall_rule_group_association_data_source_test.go
+++ b/internal/service/route53resolver/firewall_rule_group_association_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53resolver_test
 
 import (
diff --git a/internal/service/route53resolver/firewall_rule_group_association_test.go b/internal/service/route53resolver/firewall_rule_group_association_test.go
index 9a140f90071..69180e55915 100644
--- a/internal/service/route53resolver/firewall_rule_group_association_test.go
+++ b/internal/service/route53resolver/firewall_rule_group_association_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53resolver_test
 
 import (
diff --git a/internal/service/route53resolver/firewall_rule_group_data_source.go b/internal/service/route53resolver/firewall_rule_group_data_source.go
index fe5e179656b..d43d1d2f42f 100644
--- a/internal/service/route53resolver/firewall_rule_group_data_source.go
+++ b/internal/service/route53resolver/firewall_rule_group_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53resolver
 
 import (
diff --git a/internal/service/route53resolver/firewall_rule_group_data_source_test.go b/internal/service/route53resolver/firewall_rule_group_data_source_test.go
index 6fced1334f4..c2248e500eb 100644
--- a/internal/service/route53resolver/firewall_rule_group_data_source_test.go
+++ b/internal/service/route53resolver/firewall_rule_group_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53resolver_test
 
 import (
diff --git a/internal/service/route53resolver/firewall_rule_group_test.go b/internal/service/route53resolver/firewall_rule_group_test.go
index 8af22e15ab7..439d5c1a058 100644
--- a/internal/service/route53resolver/firewall_rule_group_test.go
+++ b/internal/service/route53resolver/firewall_rule_group_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53resolver_test
 
 import (
diff --git a/internal/service/route53resolver/firewall_rule_test.go b/internal/service/route53resolver/firewall_rule_test.go
index 2689f6517ce..cc114ac8049 100644
--- a/internal/service/route53resolver/firewall_rule_test.go
+++ b/internal/service/route53resolver/firewall_rule_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53resolver_test
 
 import (
diff --git a/internal/service/route53resolver/firewall_rules_data_source.go b/internal/service/route53resolver/firewall_rules_data_source.go
index 11dead1611f..1a5c45a2ae8 100644
--- a/internal/service/route53resolver/firewall_rules_data_source.go
+++ b/internal/service/route53resolver/firewall_rules_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53resolver
 
 import (
diff --git a/internal/service/route53resolver/firewall_rules_data_source_test.go b/internal/service/route53resolver/firewall_rules_data_source_test.go
index 04592518aaf..25e1400b92f 100644
--- a/internal/service/route53resolver/firewall_rules_data_source_test.go
+++ b/internal/service/route53resolver/firewall_rules_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53resolver_test
 
 import (
diff --git a/internal/service/route53resolver/generate.go b/internal/service/route53resolver/generate.go
index b79dbafb8c0..64e330f47bc 100644
--- a/internal/service/route53resolver/generate.go
+++ b/internal/service/route53resolver/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -GetTag -ListTags -ServiceTagsSlice -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/route53resolver/query_log_config.go b/internal/service/route53resolver/query_log_config.go
index 8b3e66a798d..312e0eec176 100644
--- a/internal/service/route53resolver/query_log_config.go
+++ b/internal/service/route53resolver/query_log_config.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53resolver
 
 import (
diff --git a/internal/service/route53resolver/query_log_config_association.go b/internal/service/route53resolver/query_log_config_association.go
index 1556cc619fc..05b62b2e73b 100644
--- a/internal/service/route53resolver/query_log_config_association.go
+++ b/internal/service/route53resolver/query_log_config_association.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53resolver
 
 import (
diff --git a/internal/service/route53resolver/query_log_config_association_test.go b/internal/service/route53resolver/query_log_config_association_test.go
index df6b7e065ad..b692bd037f6 100644
--- a/internal/service/route53resolver/query_log_config_association_test.go
+++ b/internal/service/route53resolver/query_log_config_association_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53resolver_test
 
 import (
diff --git a/internal/service/route53resolver/query_log_config_data_source.go b/internal/service/route53resolver/query_log_config_data_source.go
index cd67db30a47..1bb083b49be 100644
--- a/internal/service/route53resolver/query_log_config_data_source.go
+++ b/internal/service/route53resolver/query_log_config_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53resolver
 
 import (
diff --git a/internal/service/route53resolver/query_log_config_data_source_test.go b/internal/service/route53resolver/query_log_config_data_source_test.go
index 34727c0647a..62a9cab68a3 100644
--- a/internal/service/route53resolver/query_log_config_data_source_test.go
+++ b/internal/service/route53resolver/query_log_config_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53resolver_test
 
 import (
diff --git a/internal/service/route53resolver/query_log_config_test.go b/internal/service/route53resolver/query_log_config_test.go
index 01cb4e73eed..1d33f23488d 100644
--- a/internal/service/route53resolver/query_log_config_test.go
+++ b/internal/service/route53resolver/query_log_config_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53resolver_test
 
 import (
diff --git a/internal/service/route53resolver/rule.go b/internal/service/route53resolver/rule.go
index 4a9b0039b6b..f730a1a194f 100644
--- a/internal/service/route53resolver/rule.go
+++ b/internal/service/route53resolver/rule.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53resolver
 
 import (
diff --git a/internal/service/route53resolver/rule_association.go b/internal/service/route53resolver/rule_association.go
index d7829ae357a..e513ea7801f 100644
--- a/internal/service/route53resolver/rule_association.go
+++ b/internal/service/route53resolver/rule_association.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53resolver
 
 import (
diff --git a/internal/service/route53resolver/rule_association_test.go b/internal/service/route53resolver/rule_association_test.go
index d2104ec5860..4ba7c2dccea 100644
--- a/internal/service/route53resolver/rule_association_test.go
+++ b/internal/service/route53resolver/rule_association_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53resolver_test
 
 import (
diff --git a/internal/service/route53resolver/rule_data_source.go b/internal/service/route53resolver/rule_data_source.go
index ab0eefa95bb..4e59fa7c38e 100644
--- a/internal/service/route53resolver/rule_data_source.go
+++ b/internal/service/route53resolver/rule_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53resolver
 
 import (
diff --git a/internal/service/route53resolver/rule_data_source_test.go b/internal/service/route53resolver/rule_data_source_test.go
index bbd1954e41b..de7091240a6 100644
--- a/internal/service/route53resolver/rule_data_source_test.go
+++ b/internal/service/route53resolver/rule_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53resolver_test
 
 import (
diff --git a/internal/service/route53resolver/rule_test.go b/internal/service/route53resolver/rule_test.go
index 68c6cae6ccb..2d2fe94c2d3 100644
--- a/internal/service/route53resolver/rule_test.go
+++ b/internal/service/route53resolver/rule_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53resolver_test
 
 import (
diff --git a/internal/service/route53resolver/rules_data_source.go b/internal/service/route53resolver/rules_data_source.go
index 7a00beb1684..d29b0a3ad8a 100644
--- a/internal/service/route53resolver/rules_data_source.go
+++ b/internal/service/route53resolver/rules_data_source.go
@@ -1,9 +1,12 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53resolver
 
 import (
 	"context"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/route53resolver"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
@@ -64,7 +67,7 @@ func dataSourceRulesRead(ctx context.Context, d *schema.ResourceData, meta inter
 
 	err := conn.ListResolverRulesPagesWithContext(ctx, input, func(page *route53resolver.ListResolverRulesOutput, lastPage bool) bool {
 		for _, rule := range page.ResolverRules {
-			if v, ok := d.GetOk("name_regex"); ok && !regexp.MustCompile(v.(string)).MatchString(aws.StringValue(rule.Name)) {
+			if v, ok := d.GetOk("name_regex"); ok && !regexache.MustCompile(v.(string)).MatchString(aws.StringValue(rule.Name)) {
 				continue
 			}
 			if v, ok := d.GetOk("owner_id"); ok && aws.StringValue(rule.OwnerId) != v.(string) {
diff --git a/internal/service/route53resolver/rules_data_source_test.go b/internal/service/route53resolver/rules_data_source_test.go
index 8907f813f3f..d2138249899 100644
--- a/internal/service/route53resolver/rules_data_source_test.go
+++ b/internal/service/route53resolver/rules_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53resolver_test
 
 import (
diff --git a/internal/service/route53resolver/service_package_gen.go b/internal/service/route53resolver/service_package_gen.go
index 71048820415..3ea6052b4fd 100644
--- a/internal/service/route53resolver/service_package_gen.go
+++ b/internal/service/route53resolver/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	route53resolver_sdkv1 "github.com/aws/aws-sdk-go/service/route53resolver"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -151,4 +152,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*r
 	return route53resolver_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/route53resolver/sweep.go b/internal/service/route53resolver/sweep.go
index 74f2f41660a..b73bcf42802 100644
--- a/internal/service/route53resolver/sweep.go
+++ b/internal/service/route53resolver/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package route53resolver
 
@@ -12,9 +12,10 @@ import (
 	multierror "github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_route53_resolver_dnssec_config", &resource.Sweeper{
 		Name: "aws_route53_resolver_dnssec_config",
 		F:    sweepDNSSECConfig,
@@ -65,7 +66,7 @@ func init() {
 
 	resource.AddTestSweepers("aws_route53_resolver_query_log_config_association", &resource.Sweeper{
 		Name: "aws_route53_resolver_query_log_config_association",
-		F:    sweepQueryLogAssociationsConfigs,
+		F:    sweepQueryLogConfigAssociations,
 	})
 
 	resource.AddTestSweepers("aws_route53_resolver_query_log_config", &resource.Sweeper{
@@ -92,7 +93,7 @@ func init() {
 
 func sweepDNSSECConfig(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -117,7 +118,7 @@ func sweepDNSSECConfig(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Route53 Resolver DNSSEC Config sweep for %s: %s", region, err)
 		return nil
 	}
@@ -126,7 +127,7 @@ func sweepDNSSECConfig(region string) error {
 		return fmt.Errorf("error listing Route53 Resolver DNSSEC Configs (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping Route53 Resolver DNSSEC Configs (%s): %w", region, err)
@@ -137,7 +138,7 @@ func sweepDNSSECConfig(region string) error {
 
 func sweepEndpoints(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -161,7 +162,7 @@ func sweepEndpoints(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Route53 Resolver Endpoint sweep for %s: %s", region, err)
 		return nil
 	}
@@ -170,7 +171,7 @@ func sweepEndpoints(region string) error {
 		return fmt.Errorf("error listing Route53 Resolver Endpoints (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping Route53 Resolver Endpoints (%s): %w", region, err)
@@ -181,7 +182,7 @@ func sweepEndpoints(region string) error {
 
 func sweepFirewallConfigs(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -206,7 +207,7 @@ func sweepFirewallConfigs(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Route53 Resolver Firewall Config sweep for %s: %s", region, err)
 		return nil
 	}
@@ -215,7 +216,7 @@ func sweepFirewallConfigs(region string) error {
 		return fmt.Errorf("error listing Route53 Resolver Firewall Configs (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping Route53 Resolver Firewall Configs (%s): %w", region, err)
@@ -226,7 +227,7 @@ func sweepFirewallConfigs(region string) error {
 
 func sweepFirewallDomainLists(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -250,7 +251,7 @@ func sweepFirewallDomainLists(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Route53 Resolver Firewall Domain List sweep for %s: %s", region, err)
 		return nil
 	}
@@ -259,7 +260,7 @@ func sweepFirewallDomainLists(region string) error {
 		return fmt.Errorf("error listing Route53 Resolver Firewall Domain Lists (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping Route53 Resolver Firewall Domain Lists (%s): %w", region, err)
@@ -270,7 +271,7 @@ func sweepFirewallDomainLists(region string) error {
 
 func sweepFirewallRuleGroupAssociations(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -294,7 +295,7 @@ func sweepFirewallRuleGroupAssociations(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Route53 Resolver Firewall Rule Group Association sweep for %s: %s", region, err)
 		return nil
 	}
@@ -303,7 +304,7 @@ func sweepFirewallRuleGroupAssociations(region string) error {
 		return fmt.Errorf("error listing Route53 Resolver Firewall Rule Group Associations (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping Route53 Resolver Firewall Rule Group Associations (%s): %w", region, err)
@@ -314,7 +315,7 @@ func sweepFirewallRuleGroupAssociations(region string) error {
 
 func sweepFirewallRuleGroups(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -338,7 +339,7 @@ func sweepFirewallRuleGroups(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Route53 Resolver Firewall Rule Group sweep for %s: %s", region, err)
 		return nil
 	}
@@ -347,7 +348,7 @@ func sweepFirewallRuleGroups(region string) error {
 		return fmt.Errorf("error listing Route53 Resolver Firewall Rule Groups (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping Route53 Resolver Firewall Rule Groups (%s): %w", region, err)
@@ -358,7 +359,7 @@ func sweepFirewallRuleGroups(region string) error {
 
 func sweepFirewallRules(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -393,7 +394,7 @@ func sweepFirewallRules(region string) error {
 				return !lastPage
 			})
 
-			if sweep.SkipSweepError(err) {
+			if awsv1.SkipSweepError(err) {
 				continue
 			}
 
@@ -405,7 +406,7 @@ func sweepFirewallRules(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Print(fmt.Errorf("[WARN] Skipping Route53 Resolver Firewall Rule sweep for %s: %w", region, err))
 		return sweeperErrs.ErrorOrNil()
 	}
@@ -414,7 +415,7 @@ func sweepFirewallRules(region string) error {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error listing Route53 Resolver Firewall Rule Groups (%s): %w", region, err))
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error sweeping Route53 Resolver Firewall Rules (%s): %w", region, err))
@@ -423,9 +424,9 @@ func sweepFirewallRules(region string) error {
 	return sweeperErrs.ErrorOrNil()
 }
 
-func sweepQueryLogAssociationsConfigs(region string) error {
+func sweepQueryLogConfigAssociations(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -451,7 +452,7 @@ func sweepQueryLogAssociationsConfigs(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Route53 Resolver Query Log Config Association sweep for %s: %s", region, err)
 		return nil
 	}
@@ -460,7 +461,7 @@ func sweepQueryLogAssociationsConfigs(region string) error {
 		return fmt.Errorf("error listing Route53 Resolver Query Log Config Associations (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping Route53 Resolver Query Log Config Associations (%s): %w", region, err)
@@ -471,7 +472,7 @@ func sweepQueryLogAssociationsConfigs(region string) error {
 
 func sweepQueryLogsConfig(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -495,7 +496,7 @@ func sweepQueryLogsConfig(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Route53 Resolver Query Log Config sweep for %s: %s", region, err)
 		return nil
 	}
@@ -504,7 +505,7 @@ func sweepQueryLogsConfig(region string) error {
 		return fmt.Errorf("error listing Route53 Resolver Query Log Configs (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping Route53 Resolver Query Log Configs (%s): %w", region, err)
@@ -515,7 +516,7 @@ func sweepQueryLogsConfig(region string) error {
 
 func sweepRuleAssociations(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -541,7 +542,7 @@ func sweepRuleAssociations(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Route53 Resolver Rule Association sweep for %s: %s", region, err)
 		return nil
 	}
@@ -550,7 +551,7 @@ func sweepRuleAssociations(region string) error {
 		return fmt.Errorf("error listing Route53 Resolver Rule Associations (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping Route53 Resolver Rule Associations (%s): %w", region, err)
@@ -561,7 +562,7 @@ func sweepRuleAssociations(region string) error {
 
 func sweepRules(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -589,7 +590,7 @@ func sweepRules(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Route53 Resolver Rule sweep for %s: %s", region, err)
 		return nil
 	}
@@ -598,7 +599,7 @@ func sweepRules(region string) error {
 		return fmt.Errorf("error listing Route53 Resolver Rules (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping Route53 Resolver Rules (%s): %w", region, err)
diff --git a/internal/service/route53resolver/tags_gen.go b/internal/service/route53resolver/tags_gen.go
index 8151de13937..6938109922a 100644
--- a/internal/service/route53resolver/tags_gen.go
+++ b/internal/service/route53resolver/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/route53resolver"
 	"github.com/aws/aws-sdk-go/service/route53resolver/route53resolveriface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
@@ -122,6 +124,8 @@ func updateTags(ctx context.Context, conn route53resolveriface.Route53ResolverAP
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.Route53Resolver)
 	if len(removedTags) > 0 {
diff --git a/internal/service/route53resolver/validate.go b/internal/service/route53resolver/validate.go
index 3b182098088..e78fa895c52 100644
--- a/internal/service/route53resolver/validate.go
+++ b/internal/service/route53resolver/validate.go
@@ -1,22 +1,26 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53resolver
 
 import (
 	"fmt"
-	"regexp"
+
+	"github.com/YakDriver/regexache"
 )
 
 func validResolverName(v interface{}, k string) (ws []string, errors []error) {
 	// Type: String
 	// Length Constraints: Maximum length of 64.
-	// Pattern: (?!^[0-9]+$)([a-zA-Z0-9-_' ']+)
+	// Pattern: (?!^[0-9]+$)([0-9A-Za-z-_' ']+)
 	value := v.(string)
 
 	// re2 doesn't support negative lookaheads so check for single numeric character explicitly.
-	if regexp.MustCompile(`^[0-9]$`).MatchString(value) {
+	if regexache.MustCompile(`^[0-9]$`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"%q cannot be a single digit", k))
 	}
-	if !regexp.MustCompile(`^[a-zA-Z0-9-_' ']+$`).MatchString(value) {
+	if !regexache.MustCompile(`^[0-9A-Za-z_' '-]+$`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"only alphanumeric characters, '-', '_' and ' ' are allowed in %q", k))
 	}
diff --git a/internal/service/route53resolver/validate_test.go b/internal/service/route53resolver/validate_test.go
index 5cd83bebe3b..ce414e9a80a 100644
--- a/internal/service/route53resolver/validate_test.go
+++ b/internal/service/route53resolver/validate_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package route53resolver
 
 import (
diff --git a/internal/service/rum/app_monitor.go b/internal/service/rum/app_monitor.go
index f017e1f840c..4f6a812d4a6 100644
--- a/internal/service/rum/app_monitor.go
+++ b/internal/service/rum/app_monitor.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rum
 
 import (
diff --git a/internal/service/rum/app_monitor_test.go b/internal/service/rum/app_monitor_test.go
index 981c5112790..6d33305da9b 100644
--- a/internal/service/rum/app_monitor_test.go
+++ b/internal/service/rum/app_monitor_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rum_test
 
 import (
diff --git a/internal/service/rum/generate.go b/internal/service/rum/generate.go
index e55766e0ef8..a6955d2a2d9 100644
--- a/internal/service/rum/generate.go
+++ b/internal/service/rum/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ServiceTagsMap -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/rum/metrics_destination.go b/internal/service/rum/metrics_destination.go
index 5c79011e32e..ea253c1f20a 100644
--- a/internal/service/rum/metrics_destination.go
+++ b/internal/service/rum/metrics_destination.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rum
 
 import (
diff --git a/internal/service/rum/metrics_destination_test.go b/internal/service/rum/metrics_destination_test.go
index e8635e0c978..2790a4a7a6c 100644
--- a/internal/service/rum/metrics_destination_test.go
+++ b/internal/service/rum/metrics_destination_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package rum_test
 
 import (
diff --git a/internal/service/rum/service_package_gen.go b/internal/service/rum/service_package_gen.go
index 3525ae29741..572ef869ee9 100644
--- a/internal/service/rum/service_package_gen.go
+++ b/internal/service/rum/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	cloudwatchrum_sdkv1 "github.com/aws/aws-sdk-go/service/cloudwatchrum"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -54,4 +55,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*c
 	return cloudwatchrum_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/rum/sweep.go b/internal/service/rum/sweep.go
index c5f2a23b671..8c8d75be90b 100644
--- a/internal/service/rum/sweep.go
+++ b/internal/service/rum/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package rum
 
@@ -12,9 +12,10 @@ import (
 	"github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_rum_app_monitor", &resource.Sweeper{
 		Name: "aws_rum_app_monitor",
 		F:    sweepAppMonitors,
@@ -23,7 +24,7 @@ func init() {
 
 func sweepAppMonitors(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
@@ -55,11 +56,11 @@ func sweepAppMonitors(region string) error {
 		// in case work can be done, don't jump out yet
 	}
 
-	if err = sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err = sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("error sweeping RUM App Monitors for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
+	if awsv1.SkipSweepError(errs.ErrorOrNil()) {
 		log.Printf("[WARN] Skipping RUM App Monitor sweep for %s: %s", region, err)
 		return nil
 	}
diff --git a/internal/service/rum/tags_gen.go b/internal/service/rum/tags_gen.go
index 7fe167f5d0c..6cef377156a 100644
--- a/internal/service/rum/tags_gen.go
+++ b/internal/service/rum/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/cloudwatchrum"
 	"github.com/aws/aws-sdk-go/service/cloudwatchrum/cloudwatchrumiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -21,7 +23,7 @@ func Tags(tags tftags.KeyValueTags) map[string]*string {
 	return aws.StringMap(tags.Map())
 }
 
-// KeyValueTags creates KeyValueTags from rum service tags.
+// KeyValueTags creates tftags.KeyValueTags from rum service tags.
 func KeyValueTags(ctx context.Context, tags map[string]*string) tftags.KeyValueTags {
 	return tftags.New(ctx, tags)
 }
@@ -52,6 +54,8 @@ func updateTags(ctx context.Context, conn cloudwatchrumiface.CloudWatchRUMAPI, i
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.RUM)
 	if len(removedTags) > 0 {
diff --git a/internal/service/s3/bucket.go b/internal/service/s3/bucket.go
index 6a759d437cd..601064d418d 100644
--- a/internal/service/s3/bucket.go
+++ b/internal/service/s3/bucket.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3
 
 import (
@@ -12,6 +15,8 @@ import (
 	"strings"
 	"time"
 
+	aws_sdkv2 "github.com/aws/aws-sdk-go-v2/aws"
+	s3_sdkv2 "github.com/aws/aws-sdk-go-v2/service/s3"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/aws/aws-sdk-go/aws/endpoints"
@@ -19,6 +24,7 @@ import (
 	"github.com/aws/aws-sdk-go/service/s3"
 	"github.com/aws/aws-sdk-go/service/s3/s3manager"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	tfawserr_sdkv2 "github.com/hashicorp/aws-sdk-go-base/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
@@ -72,7 +78,7 @@ func ResourceBucket() *schema.Resource {
 				Optional:      true,
 				Computed:      true,
 				ConflictsWith: []string{"grant"},
-				ValidateFunc:  validation.StringInSlice(BucketCannedACL_Values(), false),
+				ValidateFunc:  validation.StringInSlice(bucketCannedACL_Values(), false),
 				Deprecated:    "Use the aws_s3_bucket_acl resource instead",
 			},
 			"arn": {
@@ -695,15 +701,15 @@ func ResourceBucket() *schema.Resource {
 func resourceBucketCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).S3Conn(ctx)
+	connSDKv2 := meta.(*conns.AWSClient).S3Client(ctx)
 
 	bucket := create.Name(d.Get("bucket").(string), d.Get("bucket_prefix").(string))
-
 	awsRegion := meta.(*conns.AWSClient).Region
 
 	// Special case: us-east-1 does not return error if the bucket already exists and is owned by
 	// current account. It also resets the Bucket ACLs.
 	if awsRegion == endpoints.UsEast1RegionID {
-		if err := FindBucket(ctx, conn, bucket); err == nil {
+		if err := findBucket(ctx, connSDKv2, bucket); err == nil {
 			return create.DiagError(names.S3, create.ErrActionCreating, resNameBucket, bucket, errors.New(ErrMessageBucketAlreadyExists))
 		}
 	}
@@ -756,7 +762,7 @@ func resourceBucketCreate(ctx context.Context, d *schema.ResourceData, meta inte
 	d.SetId(bucket)
 
 	_, err = tfresource.RetryWhenNotFound(ctx, d.Timeout(schema.TimeoutCreate), func() (interface{}, error) {
-		return nil, FindBucket(ctx, conn, d.Id())
+		return nil, findBucket(ctx, connSDKv2, d.Id())
 	})
 
 	if err != nil {
@@ -769,8 +775,9 @@ func resourceBucketCreate(ctx context.Context, d *schema.ResourceData, meta inte
 func resourceBucketRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).S3Conn(ctx)
+	connSDKv2 := meta.(*conns.AWSClient).S3Client(ctx)
 
-	err := FindBucket(ctx, conn, d.Id())
+	err := findBucket(ctx, connSDKv2, d.Id())
 
 	if !d.IsNewResource() && tfresource.NotFound(err) {
 		log.Printf("[WARN] S3 Bucket (%s) not found, removing from state", d.Id())
@@ -808,7 +815,7 @@ func resourceBucketRead(ctx context.Context, d *schema.ResourceData, meta interf
 		return diags
 	}
 
-	if err != nil && !tfawserr.ErrCodeEquals(err, ErrCodeNoSuchBucketPolicy, errCodeNotImplemented) {
+	if err != nil && !tfawserr.ErrCodeEquals(err, errCodeNoSuchBucketPolicy, errCodeNotImplemented) {
 		return sdkdiag.AppendErrorf(diags, "getting S3 bucket (%s) policy: %s", d.Id(), err)
 	}
 
@@ -868,7 +875,7 @@ func resourceBucketRead(ctx context.Context, d *schema.ResourceData, meta interf
 		return diags
 	}
 
-	if err != nil && !tfawserr.ErrCodeEquals(err, ErrCodeNoSuchCORSConfiguration, errCodeNotImplemented, errCodeXNotImplemented) {
+	if err != nil && !tfawserr.ErrCodeEquals(err, errCodeNoSuchCORSConfiguration, errCodeNotImplemented, errCodeXNotImplemented) {
 		return sdkdiag.AppendErrorf(diags, "getting S3 Bucket CORS configuration: %s", err)
 	}
 
@@ -899,7 +906,7 @@ func resourceBucketRead(ctx context.Context, d *schema.ResourceData, meta interf
 	if err != nil && !tfawserr.ErrCodeEquals(err,
 		errCodeMethodNotAllowed,
 		errCodeNotImplemented,
-		ErrCodeNoSuchWebsiteConfiguration,
+		errCodeNoSuchWebsiteConfiguration,
 		errCodeXNotImplemented,
 	) {
 		return sdkdiag.AppendErrorf(diags, "getting S3 Bucket website configuration: %s", err)
@@ -1099,7 +1106,7 @@ func resourceBucketRead(ctx context.Context, d *schema.ResourceData, meta interf
 		return diags
 	}
 
-	if err != nil && !tfawserr.ErrMessageContains(err, ErrCodeServerSideEncryptionConfigurationNotFound, "encryption configuration was not found") {
+	if err != nil && !tfawserr.ErrMessageContains(err, errCodeServerSideEncryptionConfigurationNotFound, "encryption configuration was not found") {
 		return sdkdiag.AppendErrorf(diags, "getting S3 Bucket encryption: %s", err)
 	}
 
@@ -1362,6 +1369,7 @@ func resourceBucketUpdate(ctx context.Context, d *schema.ResourceData, meta inte
 
 func resourceBucketDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	conn := meta.(*conns.AWSClient).S3Conn(ctx)
+	connSDKv2 := meta.(*conns.AWSClient).S3Client(ctx)
 
 	log.Printf("[INFO] Deleting S3 Bucket: %s", d.Id())
 	_, err := conn.DeleteBucketWithContext(ctx, &s3.DeleteBucketInput{
@@ -1377,7 +1385,7 @@ func resourceBucketDelete(ctx context.Context, d *schema.ResourceData, meta inte
 			// Use a S3 service client that can handle multiple slashes in URIs.
 			// While aws_s3_object resources cannot create these object
 			// keys, other AWS services and applications using the S3 Bucket can.
-			conn := meta.(*conns.AWSClient).S3ConnURICleaningDisabled(ctx)
+			conn := meta.(*conns.AWSClient).S3Client(ctx)
 
 			// bucket may have things delete them
 			log.Printf("[DEBUG] S3 Bucket attempting to forceDestroy %s", err)
@@ -1390,7 +1398,7 @@ func resourceBucketDelete(ctx context.Context, d *schema.ResourceData, meta inte
 				objectLockEnabled = aws.StringValue(objectLockConfiguration.ObjectLockEnabled) == s3.ObjectLockEnabledEnabled
 			}
 
-			if n, err := EmptyBucket(ctx, conn, d.Id(), objectLockEnabled); err != nil {
+			if n, err := emptyBucket(ctx, conn, d.Id(), objectLockEnabled); err != nil {
 				return diag.Errorf("emptying S3 Bucket (%s): %s", d.Id(), err)
 			} else {
 				log.Printf("[DEBUG] Deleted %d S3 objects", n)
@@ -1405,8 +1413,8 @@ func resourceBucketDelete(ctx context.Context, d *schema.ResourceData, meta inte
 		return create.DiagError(names.S3, create.ErrActionDeleting, resNameBucket, d.Id(), err)
 	}
 
-	_, err = tfresource.RetryUntilNotFound(ctx, 1*time.Minute, func() (interface{}, error) {
-		return nil, FindBucket(ctx, conn, d.Id())
+	_, err = tfresource.RetryUntilNotFound(ctx, d.Timeout(schema.TimeoutDelete), func() (interface{}, error) {
+		return nil, findBucket(ctx, connSDKv2, d.Id())
 	})
 
 	if err != nil {
@@ -1416,14 +1424,14 @@ func resourceBucketDelete(ctx context.Context, d *schema.ResourceData, meta inte
 	return nil
 }
 
-func FindBucket(ctx context.Context, conn *s3.S3, bucket string) error {
-	input := &s3.HeadBucketInput{
-		Bucket: aws.String(bucket),
+func findBucket(ctx context.Context, conn *s3_sdkv2.Client, bucket string) error {
+	input := &s3_sdkv2.HeadBucketInput{
+		Bucket: aws_sdkv2.String(bucket),
 	}
 
-	_, err := conn.HeadBucketWithContext(ctx, input)
+	_, err := conn.HeadBucket(ctx, input)
 
-	if tfawserr.ErrStatusCodeEquals(err, http.StatusNotFound) || tfawserr.ErrCodeEquals(err, s3.ErrCodeNoSuchBucket) {
+	if tfawserr_sdkv2.ErrHTTPStatusCodeEquals(err, http.StatusNotFound) || tfawserr_sdkv2.ErrCodeEquals(err, errCodeNoSuchBucket) {
 		return &retry.NotFoundError{
 			LastError:   err,
 			LastRequest: input,
diff --git a/internal/service/s3/bucket_accelerate_configuration.go b/internal/service/s3/bucket_accelerate_configuration.go
index 4f91e013d58..0a9d32ccdaa 100644
--- a/internal/service/s3/bucket_accelerate_configuration.go
+++ b/internal/service/s3/bucket_accelerate_configuration.go
@@ -1,17 +1,22 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3
 
 import (
 	"context"
 	"log"
-	"time"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/s3"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/s3"
+	"github.com/aws/aws-sdk-go-v2/service/s3/types"
+	"github.com/hashicorp/aws-sdk-go-base/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/enum"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
 )
@@ -23,6 +28,7 @@ func ResourceBucketAccelerateConfiguration() *schema.Resource {
 		ReadWithoutTimeout:   resourceBucketAccelerateConfigurationRead,
 		UpdateWithoutTimeout: resourceBucketAccelerateConfigurationUpdate,
 		DeleteWithoutTimeout: resourceBucketAccelerateConfigurationDelete,
+
 		Importer: &schema.ResourceImporter{
 			StateContext: schema.ImportStatePassthroughContext,
 		},
@@ -41,79 +47,68 @@ func ResourceBucketAccelerateConfiguration() *schema.Resource {
 				ValidateFunc: verify.ValidAccountID,
 			},
 			"status": {
-				Type:         schema.TypeString,
-				Required:     true,
-				ValidateFunc: validation.StringInSlice(s3.BucketAccelerateStatus_Values(), false),
+				Type:             schema.TypeString,
+				Required:         true,
+				ValidateDiagFunc: enum.Validate[types.BucketAccelerateStatus](),
 			},
 		},
 	}
 }
 
 func resourceBucketAccelerateConfigurationCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).S3Conn(ctx)
+	conn := meta.(*conns.AWSClient).S3Client(ctx)
 
 	bucket := d.Get("bucket").(string)
 	expectedBucketOwner := d.Get("expected_bucket_owner").(string)
-
 	input := &s3.PutBucketAccelerateConfigurationInput{
 		Bucket: aws.String(bucket),
-		AccelerateConfiguration: &s3.AccelerateConfiguration{
-			Status: aws.String(d.Get("status").(string)),
+		AccelerateConfiguration: &types.AccelerateConfiguration{
+			Status: types.BucketAccelerateStatus(d.Get("status").(string)),
 		},
 	}
-
 	if expectedBucketOwner != "" {
 		input.ExpectedBucketOwner = aws.String(expectedBucketOwner)
 	}
 
-	_, err := tfresource.RetryWhenAWSErrCodeEquals(ctx, 2*time.Minute, func() (interface{}, error) {
-		return conn.PutBucketAccelerateConfigurationWithContext(ctx, input)
-	}, s3.ErrCodeNoSuchBucket)
+	_, err := tfresource.RetryWhenAWSErrCodeEquals(ctx, s3BucketPropagationTimeout, func() (interface{}, error) {
+		return conn.PutBucketAccelerateConfiguration(ctx, input)
+	}, errCodeNoSuchBucket)
 
 	if err != nil {
-		return diag.Errorf("creating S3 bucket (%s) accelerate configuration: %s", bucket, err)
+		return diag.Errorf("creating S3 Bucket (%s) Accelerate Configuration: %s", bucket, err)
 	}
 
 	d.SetId(CreateResourceID(bucket, expectedBucketOwner))
 
+	_, err = tfresource.RetryWhenNotFound(ctx, s3BucketPropagationTimeout, func() (interface{}, error) {
+		return findBucketAccelerateConfiguration(ctx, conn, bucket, expectedBucketOwner)
+	})
+
+	if err != nil {
+		return diag.Errorf("waiting for S3 Bucket Accelerate Configuration (%s) create: %s", d.Id(), err)
+	}
+
 	return resourceBucketAccelerateConfigurationRead(ctx, d, meta)
 }
 
 func resourceBucketAccelerateConfigurationRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).S3Conn(ctx)
+	conn := meta.(*conns.AWSClient).S3Client(ctx)
 
 	bucket, expectedBucketOwner, err := ParseResourceID(d.Id())
 	if err != nil {
 		return diag.FromErr(err)
 	}
 
-	input := &s3.GetBucketAccelerateConfigurationInput{
-		Bucket: aws.String(bucket),
-	}
-
-	if expectedBucketOwner != "" {
-		input.ExpectedBucketOwner = aws.String(expectedBucketOwner)
-	}
-
-	output, err := conn.GetBucketAccelerateConfigurationWithContext(ctx, input)
+	output, err := findBucketAccelerateConfiguration(ctx, conn, bucket, expectedBucketOwner)
 
-	if !d.IsNewResource() && tfawserr.ErrCodeEquals(err, s3.ErrCodeNoSuchBucket) {
+	if !d.IsNewResource() && tfresource.NotFound(err) {
 		log.Printf("[WARN] S3 Bucket Accelerate Configuration (%s) not found, removing from state", d.Id())
 		d.SetId("")
 		return nil
 	}
 
 	if err != nil {
-		return diag.Errorf("reading S3 bucket accelerate configuration (%s): %s", d.Id(), err)
-	}
-
-	if output == nil {
-		if d.IsNewResource() {
-			return diag.Errorf("reading S3 bucket accelerate configuration (%s): empty output", d.Id())
-		}
-		log.Printf("[WARN] S3 Bucket Accelerate Configuration (%s) not found, removing from state", d.Id())
-		d.SetId("")
-		return nil
+		return diag.Errorf("reading S3 Bucket Accelerate Configuration (%s): %s", d.Id(), err)
 	}
 
 	d.Set("bucket", bucket)
@@ -124,7 +119,7 @@ func resourceBucketAccelerateConfigurationRead(ctx context.Context, d *schema.Re
 }
 
 func resourceBucketAccelerateConfigurationUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).S3Conn(ctx)
+	conn := meta.(*conns.AWSClient).S3Client(ctx)
 
 	bucket, expectedBucketOwner, err := ParseResourceID(d.Id())
 	if err != nil {
@@ -133,26 +128,25 @@ func resourceBucketAccelerateConfigurationUpdate(ctx context.Context, d *schema.
 
 	input := &s3.PutBucketAccelerateConfigurationInput{
 		Bucket: aws.String(bucket),
-		AccelerateConfiguration: &s3.AccelerateConfiguration{
-			Status: aws.String(d.Get("status").(string)),
+		AccelerateConfiguration: &types.AccelerateConfiguration{
+			Status: types.BucketAccelerateStatus(d.Get("status").(string)),
 		},
 	}
-
 	if expectedBucketOwner != "" {
 		input.ExpectedBucketOwner = aws.String(expectedBucketOwner)
 	}
 
-	_, err = conn.PutBucketAccelerateConfigurationWithContext(ctx, input)
+	_, err = conn.PutBucketAccelerateConfiguration(ctx, input)
 
 	if err != nil {
-		return diag.Errorf("updating S3 bucket accelerate configuration (%s): %s", d.Id(), err)
+		return diag.Errorf("updating S3 Bucket Accelerate Configuration (%s): %s", d.Id(), err)
 	}
 
 	return resourceBucketAccelerateConfigurationRead(ctx, d, meta)
 }
 
 func resourceBucketAccelerateConfigurationDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).S3Conn(ctx)
+	conn := meta.(*conns.AWSClient).S3Client(ctx)
 
 	bucket, expectedBucketOwner, err := ParseResourceID(d.Id())
 	if err != nil {
@@ -161,24 +155,54 @@ func resourceBucketAccelerateConfigurationDelete(ctx context.Context, d *schema.
 
 	input := &s3.PutBucketAccelerateConfigurationInput{
 		Bucket: aws.String(bucket),
-		AccelerateConfiguration: &s3.AccelerateConfiguration{
-			Status: aws.String(s3.BucketAccelerateStatusSuspended),
+		AccelerateConfiguration: &types.AccelerateConfiguration{
+			Status: types.BucketAccelerateStatusSuspended,
 		},
 	}
-
 	if expectedBucketOwner != "" {
 		input.ExpectedBucketOwner = aws.String(expectedBucketOwner)
 	}
 
-	_, err = conn.PutBucketAccelerateConfigurationWithContext(ctx, input)
+	log.Printf("[DEBUG] Deleting S3 Bucket Accelerate Configuration: %s", d.Id())
+	_, err = conn.PutBucketAccelerateConfiguration(ctx, input)
 
-	if tfawserr.ErrCodeEquals(err, s3.ErrCodeNoSuchBucket) {
+	if tfawserr.ErrCodeEquals(err, errCodeNoSuchBucket) {
 		return nil
 	}
 
 	if err != nil {
-		return diag.Errorf("deleting S3 bucket accelerate configuration (%s): %s", d.Id(), err)
+		return diag.Errorf("deleting S3 Bucket Accelerate Configuration (%s): %s", d.Id(), err)
 	}
 
+	// Don't wait for the accelerate configuration to disappear as it still exists after suspension.
+
 	return nil
 }
+
+func findBucketAccelerateConfiguration(ctx context.Context, conn *s3.Client, bucket, expectedBucketOwner string) (*s3.GetBucketAccelerateConfigurationOutput, error) {
+	input := &s3.GetBucketAccelerateConfigurationInput{
+		Bucket: aws.String(bucket),
+	}
+	if expectedBucketOwner != "" {
+		input.ExpectedBucketOwner = aws.String(expectedBucketOwner)
+	}
+
+	output, err := conn.GetBucketAccelerateConfiguration(ctx, input)
+
+	if tfawserr.ErrCodeEquals(err, errCodeNoSuchBucket) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	if output == nil {
+		return nil, tfresource.NewEmptyResultError(input)
+	}
+
+	return output, nil
+}
diff --git a/internal/service/s3/bucket_accelerate_configuration_test.go b/internal/service/s3/bucket_accelerate_configuration_test.go
index 1b3872db97f..6e87a810481 100644
--- a/internal/service/s3/bucket_accelerate_configuration_test.go
+++ b/internal/service/s3/bucket_accelerate_configuration_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3_test
 
 import (
@@ -5,16 +8,15 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/cloudfront"
-	"github.com/aws/aws-sdk-go/service/s3"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/aws/aws-sdk-go-v2/service/s3/types"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	tfs3 "github.com/hashicorp/terraform-provider-aws/internal/service/s3"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
 func TestAccS3BucketAccelerateConfiguration_basic(t *testing.T) {
@@ -23,20 +25,17 @@ func TestAccS3BucketAccelerateConfiguration_basic(t *testing.T) {
 	resourceName := "aws_s3_bucket_accelerate_configuration.test"
 
 	resource.ParallelTest(t, resource.TestCase{
-		PreCheck: func() {
-			acctest.PreCheck(ctx, t)
-			acctest.PreCheckPartitionHasService(t, cloudfront.EndpointsID)
-		},
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketAccelerateConfigurationDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccBucketAccelerateConfigurationConfig_basic(bucketName, s3.BucketAccelerateStatusEnabled),
+				Config: testAccBucketAccelerateConfigurationConfig_basic(bucketName, string(types.BucketAccelerateStatusEnabled)),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketAccelerateConfigurationExists(ctx, resourceName),
 					resource.TestCheckResourceAttrPair(resourceName, "bucket", "aws_s3_bucket.test", "id"),
-					resource.TestCheckResourceAttr(resourceName, "status", s3.BucketAccelerateStatusEnabled),
+					resource.TestCheckResourceAttr(resourceName, "status", string(types.BucketAccelerateStatusEnabled)),
 				),
 			},
 			{
@@ -54,28 +53,25 @@ func TestAccS3BucketAccelerateConfiguration_update(t *testing.T) {
 	resourceName := "aws_s3_bucket_accelerate_configuration.test"
 
 	resource.ParallelTest(t, resource.TestCase{
-		PreCheck: func() {
-			acctest.PreCheck(ctx, t)
-			acctest.PreCheckPartitionHasService(t, cloudfront.EndpointsID)
-		},
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketAccelerateConfigurationDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccBucketAccelerateConfigurationConfig_basic(bucketName, s3.BucketAccelerateStatusEnabled),
+				Config: testAccBucketAccelerateConfigurationConfig_basic(bucketName, string(types.BucketAccelerateStatusEnabled)),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketAccelerateConfigurationExists(ctx, resourceName),
 					resource.TestCheckResourceAttrPair(resourceName, "bucket", "aws_s3_bucket.test", "id"),
-					resource.TestCheckResourceAttr(resourceName, "status", s3.BucketAccelerateStatusEnabled),
+					resource.TestCheckResourceAttr(resourceName, "status", string(types.BucketAccelerateStatusEnabled)),
 				),
 			},
 			{
-				Config: testAccBucketAccelerateConfigurationConfig_basic(bucketName, s3.BucketAccelerateStatusSuspended),
+				Config: testAccBucketAccelerateConfigurationConfig_basic(bucketName, string(types.BucketAccelerateStatusSuspended)),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketAccelerateConfigurationExists(ctx, resourceName),
 					resource.TestCheckResourceAttrPair(resourceName, "bucket", "aws_s3_bucket.test", "id"),
-					resource.TestCheckResourceAttr(resourceName, "status", s3.BucketAccelerateStatusSuspended),
+					resource.TestCheckResourceAttr(resourceName, "status", string(types.BucketAccelerateStatusSuspended)),
 				),
 			},
 			{
@@ -93,16 +89,13 @@ func TestAccS3BucketAccelerateConfiguration_disappears(t *testing.T) {
 	resourceName := "aws_s3_bucket_accelerate_configuration.test"
 
 	resource.ParallelTest(t, resource.TestCase{
-		PreCheck: func() {
-			acctest.PreCheck(ctx, t)
-			acctest.PreCheckPartitionHasService(t, cloudfront.EndpointsID)
-		},
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketAccelerateConfigurationDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccBucketAccelerateConfigurationConfig_basic(bucketName, s3.BucketAccelerateStatusEnabled),
+				Config: testAccBucketAccelerateConfigurationConfig_basic(bucketName, string(types.BucketAccelerateStatusEnabled)),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketAccelerateConfigurationExists(ctx, resourceName),
 					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfs3.ResourceBucketAccelerateConfiguration(), resourceName),
@@ -121,23 +114,23 @@ func TestAccS3BucketAccelerateConfiguration_migrate_noChange(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketAccelerateConfigurationDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccBucketConfig_acceleration(rName, s3.BucketAccelerateStatusEnabled),
+				Config: testAccBucketConfig_acceleration(rName, string(types.BucketAccelerateStatusEnabled)),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckBucketExists(ctx, bucketResourceName),
-					resource.TestCheckResourceAttr(bucketResourceName, "acceleration_status", s3.BucketAccelerateStatusEnabled),
+					resource.TestCheckResourceAttr(bucketResourceName, "acceleration_status", string(types.BucketAccelerateStatusEnabled)),
 				),
 			},
 			{
-				Config: testAccBucketAccelerateConfigurationConfig_basic(rName, s3.BucketAccelerateStatusEnabled),
+				Config: testAccBucketAccelerateConfigurationConfig_basic(rName, string(types.BucketAccelerateStatusEnabled)),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckBucketAccelerateConfigurationExists(ctx, resourceName),
 					resource.TestCheckResourceAttrPair(resourceName, "bucket", bucketResourceName, "id"),
-					resource.TestCheckResourceAttr(resourceName, "status", s3.BucketAccelerateStatusEnabled),
+					resource.TestCheckResourceAttr(resourceName, "status", string(types.BucketAccelerateStatusEnabled)),
 				),
 			},
 		},
@@ -152,23 +145,23 @@ func TestAccS3BucketAccelerateConfiguration_migrate_withChange(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketAccelerateConfigurationDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccBucketConfig_acceleration(rName, s3.BucketAccelerateStatusEnabled),
+				Config: testAccBucketConfig_acceleration(rName, string(types.BucketAccelerateStatusEnabled)),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckBucketExists(ctx, bucketResourceName),
-					resource.TestCheckResourceAttr(bucketResourceName, "acceleration_status", s3.BucketAccelerateStatusEnabled),
+					resource.TestCheckResourceAttr(bucketResourceName, "acceleration_status", string(types.BucketAccelerateStatusEnabled)),
 				),
 			},
 			{
-				Config: testAccBucketAccelerateConfigurationConfig_basic(rName, s3.BucketAccelerateStatusSuspended),
+				Config: testAccBucketAccelerateConfigurationConfig_basic(rName, string(types.BucketAccelerateStatusSuspended)),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckBucketAccelerateConfigurationExists(ctx, resourceName),
 					resource.TestCheckResourceAttrPair(resourceName, "bucket", bucketResourceName, "id"),
-					resource.TestCheckResourceAttr(resourceName, "status", s3.BucketAccelerateStatusSuspended),
+					resource.TestCheckResourceAttr(resourceName, "status", string(types.BucketAccelerateStatusSuspended)),
 				),
 			},
 		},
@@ -177,7 +170,7 @@ func TestAccS3BucketAccelerateConfiguration_migrate_withChange(t *testing.T) {
 
 func testAccCheckBucketAccelerateConfigurationDestroy(ctx context.Context) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Conn(ctx)
+		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Client(ctx)
 
 		for _, rs := range s.RootModule().Resources {
 			if rs.Type != "aws_s3_bucket_accelerate_configuration" {
@@ -189,70 +182,40 @@ func testAccCheckBucketAccelerateConfigurationDestroy(ctx context.Context) resou
 				return err
 			}
 
-			input := &s3.GetBucketAccelerateConfigurationInput{
-				Bucket: aws.String(bucket),
-			}
-
-			if expectedBucketOwner != "" {
-				input.ExpectedBucketOwner = aws.String(expectedBucketOwner)
-			}
+			_, err = tfs3.FindBucketAccelerateConfiguration(ctx, conn, bucket, expectedBucketOwner)
 
-			output, err := conn.GetBucketAccelerateConfigurationWithContext(ctx, input)
-
-			if tfawserr.ErrCodeEquals(err, s3.ErrCodeNoSuchBucket) {
+			if tfresource.NotFound(err) {
 				continue
 			}
 
 			if err != nil {
-				return fmt.Errorf("error getting S3 Bucket accelerate configuration (%s): %w", rs.Primary.ID, err)
+				return err
 			}
 
-			if output != nil {
-				return fmt.Errorf("S3 Bucket accelerate configuration (%s) still exists", rs.Primary.ID)
-			}
+			return fmt.Errorf("S3 Bucket Accelerate Configuration %s still exists", rs.Primary.ID)
 		}
 
 		return nil
 	}
 }
 
-func testAccCheckBucketAccelerateConfigurationExists(ctx context.Context, resourceName string) resource.TestCheckFunc {
+func testAccCheckBucketAccelerateConfigurationExists(ctx context.Context, n string) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		rs, ok := s.RootModule().Resources[resourceName]
+		rs, ok := s.RootModule().Resources[n]
 		if !ok {
-			return fmt.Errorf("Not found: %s", resourceName)
+			return fmt.Errorf("Not found: %s", n)
 		}
 
-		if rs.Primary.ID == "" {
-			return fmt.Errorf("Resource (%s) ID not set", resourceName)
-		}
-
-		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Conn(ctx)
+		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Client(ctx)
 
 		bucket, expectedBucketOwner, err := tfs3.ParseResourceID(rs.Primary.ID)
 		if err != nil {
 			return err
 		}
 
-		input := &s3.GetBucketAccelerateConfigurationInput{
-			Bucket: aws.String(bucket),
-		}
-
-		if expectedBucketOwner != "" {
-			input.ExpectedBucketOwner = aws.String(expectedBucketOwner)
-		}
-
-		output, err := conn.GetBucketAccelerateConfigurationWithContext(ctx, input)
+		_, err = tfs3.FindBucketAccelerateConfiguration(ctx, conn, bucket, expectedBucketOwner)
 
-		if err != nil {
-			return fmt.Errorf("error getting S3 Bucket accelerate configuration (%s): %w", rs.Primary.ID, err)
-		}
-
-		if output == nil {
-			return fmt.Errorf("S3 Bucket accelerate configuration (%s) not found", rs.Primary.ID)
-		}
-
-		return nil
+		return err
 	}
 }
 
diff --git a/internal/service/s3/bucket_acl.go b/internal/service/s3/bucket_acl.go
index c7ee3610f46..5b4d7a5121a 100644
--- a/internal/service/s3/bucket_acl.go
+++ b/internal/service/s3/bucket_acl.go
@@ -1,20 +1,26 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"strings"
-	"time"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/s3"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/YakDriver/regexache"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/s3"
+	"github.com/aws/aws-sdk-go-v2/service/s3/types"
+	"github.com/hashicorp/aws-sdk-go-base/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/enum"
+	tfslices "github.com/hashicorp/terraform-provider-aws/internal/slices"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
 )
@@ -27,7 +33,8 @@ func ResourceBucketACL() *schema.Resource {
 		CreateWithoutTimeout: resourceBucketACLCreate,
 		ReadWithoutTimeout:   resourceBucketACLRead,
 		UpdateWithoutTimeout: resourceBucketACLUpdate,
-		DeleteWithoutTimeout: resourceBucketACLDelete,
+		DeleteWithoutTimeout: schema.NoopContext,
+
 		Importer: &schema.ResourceImporter{
 			StateContext: schema.ImportStatePassthroughContext,
 		},
@@ -65,9 +72,9 @@ func ResourceBucketACL() *schema.Resource {
 													Optional: true,
 												},
 												"type": {
-													Type:         schema.TypeString,
-													Required:     true,
-													ValidateFunc: validation.StringInSlice(s3.Type_Values(), false),
+													Type:             schema.TypeString,
+													Required:         true,
+													ValidateDiagFunc: enum.Validate[types.Type](),
 												},
 												"uri": {
 													Type:     schema.TypeString,
@@ -77,9 +84,9 @@ func ResourceBucketACL() *schema.Resource {
 										},
 									},
 									"permission": {
-										Type:         schema.TypeString,
-										Required:     true,
-										ValidateFunc: validation.StringInSlice(s3.Permission_Values(), false),
+										Type:             schema.TypeString,
+										Required:         true,
+										ValidateDiagFunc: enum.Validate[types.Permission](),
 									},
 								},
 							},
@@ -109,7 +116,7 @@ func ResourceBucketACL() *schema.Resource {
 				Type:          schema.TypeString,
 				Optional:      true,
 				ConflictsWith: []string{"access_control_policy"},
-				ValidateFunc:  validation.StringInSlice(BucketCannedACL_Values(), false),
+				ValidateFunc:  validation.StringInSlice(bucketCannedACL_Values(), false),
 			},
 			"bucket": {
 				Type:         schema.TypeString,
@@ -128,20 +135,17 @@ func ResourceBucketACL() *schema.Resource {
 }
 
 func resourceBucketACLCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).S3Conn(ctx)
+	conn := meta.(*conns.AWSClient).S3Client(ctx)
 
 	bucket := d.Get("bucket").(string)
 	expectedBucketOwner := d.Get("expected_bucket_owner").(string)
 	acl := d.Get("acl").(string)
-
 	input := &s3.PutBucketAclInput{
 		Bucket: aws.String(bucket),
 	}
-
 	if acl != "" {
-		input.ACL = aws.String(acl)
+		input.ACL = types.BucketCannedACL(acl)
 	}
-
 	if expectedBucketOwner != "" {
 		input.ExpectedBucketOwner = aws.String(expectedBucketOwner)
 	}
@@ -150,63 +154,59 @@ func resourceBucketACLCreate(ctx context.Context, d *schema.ResourceData, meta i
 		input.AccessControlPolicy = expandBucketACLAccessControlPolicy(v.([]interface{}))
 	}
 
-	_, err := tfresource.RetryWhenAWSErrCodeEquals(ctx, 2*time.Minute, func() (interface{}, error) {
-		return conn.PutBucketAclWithContext(ctx, input)
-	}, s3.ErrCodeNoSuchBucket)
+	_, err := tfresource.RetryWhenAWSErrCodeEquals(ctx, s3BucketPropagationTimeout, func() (interface{}, error) {
+		return conn.PutBucketAcl(ctx, input)
+	}, errCodeNoSuchBucket)
 
 	if err != nil {
-		return diag.Errorf("creating S3 bucket ACL for %s: %s", bucket, err)
+		return diag.Errorf("creating S3 Bucket (%s) ACL: %s", bucket, err)
 	}
 
 	d.SetId(BucketACLCreateResourceID(bucket, expectedBucketOwner, acl))
 
+	_, err = tfresource.RetryWhenNotFound(ctx, s3BucketPropagationTimeout, func() (interface{}, error) {
+		return findBucketACL(ctx, conn, bucket, expectedBucketOwner)
+	})
+
+	if err != nil {
+		return diag.Errorf("waiting for S3 Bucket ACL (%s) create: %s", d.Id(), err)
+	}
+
 	return resourceBucketACLRead(ctx, d, meta)
 }
 
 func resourceBucketACLRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).S3Conn(ctx)
+	conn := meta.(*conns.AWSClient).S3Client(ctx)
 
 	bucket, expectedBucketOwner, acl, err := BucketACLParseResourceID(d.Id())
 	if err != nil {
 		return diag.FromErr(err)
 	}
 
-	input := &s3.GetBucketAclInput{
-		Bucket: aws.String(bucket),
-	}
-
-	if expectedBucketOwner != "" {
-		input.ExpectedBucketOwner = aws.String(expectedBucketOwner)
-	}
-
-	output, err := conn.GetBucketAclWithContext(ctx, input)
+	output, err := findBucketACL(ctx, conn, bucket, expectedBucketOwner)
 
-	if !d.IsNewResource() && tfawserr.ErrCodeEquals(err, s3.ErrCodeNoSuchBucket) {
+	if !d.IsNewResource() && tfresource.NotFound(err) {
 		log.Printf("[WARN] S3 Bucket ACL (%s) not found, removing from state", d.Id())
 		d.SetId("")
 		return nil
 	}
 
 	if err != nil {
-		return diag.Errorf("getting S3 bucket ACL (%s): %s", d.Id(), err)
+		return diag.Errorf("reading S3 Bucket ACL (%s): %s", d.Id(), err)
 	}
 
-	if output == nil {
-		return diag.Errorf("getting S3 bucket ACL (%s): empty output", d.Id())
+	if err := d.Set("access_control_policy", flattenBucketACLAccessControlPolicy(output)); err != nil {
+		return diag.Errorf("setting access_control_policy: %s", err)
 	}
-
 	d.Set("acl", acl)
 	d.Set("bucket", bucket)
 	d.Set("expected_bucket_owner", expectedBucketOwner)
-	if err := d.Set("access_control_policy", flattenBucketACLAccessControlPolicy(output)); err != nil {
-		return diag.Errorf("setting access_control_policy: %s", err)
-	}
 
 	return nil
 }
 
 func resourceBucketACLUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).S3Conn(ctx)
+	conn := meta.(*conns.AWSClient).S3Client(ctx)
 
 	bucket, expectedBucketOwner, acl, err := BucketACLParseResourceID(d.Id())
 	if err != nil {
@@ -216,7 +216,6 @@ func resourceBucketACLUpdate(ctx context.Context, d *schema.ResourceData, meta i
 	input := &s3.PutBucketAclInput{
 		Bucket: aws.String(bucket),
 	}
-
 	if expectedBucketOwner != "" {
 		input.ExpectedBucketOwner = aws.String(expectedBucketOwner)
 	}
@@ -227,10 +226,10 @@ func resourceBucketACLUpdate(ctx context.Context, d *schema.ResourceData, meta i
 
 	if d.HasChange("acl") {
 		acl = d.Get("acl").(string)
-		input.ACL = aws.String(acl)
+		input.ACL = types.BucketCannedACL(acl)
 	}
 
-	_, err = conn.PutBucketAclWithContext(ctx, input)
+	_, err = conn.PutBucketAcl(ctx, input)
 
 	if err != nil {
 		return diag.Errorf("updating S3 bucket ACL (%s): %s", d.Id(), err)
@@ -244,12 +243,7 @@ func resourceBucketACLUpdate(ctx context.Context, d *schema.ResourceData, meta i
 	return resourceBucketACLRead(ctx, d, meta)
 }
 
-func resourceBucketACLDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	log.Printf("[WARN] Cannot destroy S3 Bucket ACL. Terraform will remove this resource from the state file, however resources may remain.")
-	return nil
-}
-
-func expandBucketACLAccessControlPolicy(l []interface{}) *s3.AccessControlPolicy {
+func expandBucketACLAccessControlPolicy(l []interface{}) *types.AccessControlPolicy {
 	if len(l) == 0 || l[0] == nil {
 		return nil
 	}
@@ -259,7 +253,7 @@ func expandBucketACLAccessControlPolicy(l []interface{}) *s3.AccessControlPolicy
 		return nil
 	}
 
-	result := &s3.AccessControlPolicy{}
+	result := &types.AccessControlPolicy{}
 
 	if v, ok := tfMap["grant"].(*schema.Set); ok && v.Len() > 0 {
 		result.Grants = expandBucketACLAccessControlPolicyGrants(v.List())
@@ -272,8 +266,8 @@ func expandBucketACLAccessControlPolicy(l []interface{}) *s3.AccessControlPolicy
 	return result
 }
 
-func expandBucketACLAccessControlPolicyGrants(l []interface{}) []*s3.Grant {
-	var grants []*s3.Grant
+func expandBucketACLAccessControlPolicyGrants(l []interface{}) []types.Grant {
+	var grants []types.Grant
 
 	for _, tfMapRaw := range l {
 		tfMap, ok := tfMapRaw.(map[string]interface{})
@@ -281,14 +275,14 @@ func expandBucketACLAccessControlPolicyGrants(l []interface{}) []*s3.Grant {
 			continue
 		}
 
-		grant := &s3.Grant{}
+		grant := types.Grant{}
 
 		if v, ok := tfMap["grantee"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
 			grant.Grantee = expandBucketACLAccessControlPolicyGrantsGrantee(v)
 		}
 
 		if v, ok := tfMap["permission"].(string); ok && v != "" {
-			grant.Permission = aws.String(v)
+			grant.Permission = types.Permission(v)
 		}
 
 		grants = append(grants, grant)
@@ -297,7 +291,7 @@ func expandBucketACLAccessControlPolicyGrants(l []interface{}) []*s3.Grant {
 	return grants
 }
 
-func expandBucketACLAccessControlPolicyGrantsGrantee(l []interface{}) *s3.Grantee {
+func expandBucketACLAccessControlPolicyGrantsGrantee(l []interface{}) *types.Grantee {
 	if len(l) == 0 || l[0] == nil {
 		return nil
 	}
@@ -307,7 +301,7 @@ func expandBucketACLAccessControlPolicyGrantsGrantee(l []interface{}) *s3.Grante
 		return nil
 	}
 
-	result := &s3.Grantee{}
+	result := &types.Grantee{}
 
 	if v, ok := tfMap["email_address"].(string); ok && v != "" {
 		result.EmailAddress = aws.String(v)
@@ -318,7 +312,7 @@ func expandBucketACLAccessControlPolicyGrantsGrantee(l []interface{}) *s3.Grante
 	}
 
 	if v, ok := tfMap["type"].(string); ok && v != "" {
-		result.Type = aws.String(v)
+		result.Type = types.Type(v)
 	}
 
 	if v, ok := tfMap["uri"].(string); ok && v != "" {
@@ -328,7 +322,7 @@ func expandBucketACLAccessControlPolicyGrantsGrantee(l []interface{}) *s3.Grante
 	return result
 }
 
-func expandBucketACLAccessControlPolicyOwner(l []interface{}) *s3.Owner {
+func expandBucketACLAccessControlPolicyOwner(l []interface{}) *types.Owner {
 	if len(l) == 0 || l[0] == nil {
 		return nil
 	}
@@ -338,7 +332,7 @@ func expandBucketACLAccessControlPolicyOwner(l []interface{}) *s3.Owner {
 		return nil
 	}
 
-	owner := &s3.Owner{}
+	owner := &types.Owner{}
 
 	if v, ok := tfMap["display_name"].(string); ok && v != "" {
 		owner.DisplayName = aws.String(v)
@@ -369,61 +363,53 @@ func flattenBucketACLAccessControlPolicy(output *s3.GetBucketAclOutput) []interf
 	return []interface{}{m}
 }
 
-func flattenBucketACLAccessControlPolicyGrants(grants []*s3.Grant) []interface{} {
+func flattenBucketACLAccessControlPolicyGrants(grants []types.Grant) []interface{} {
 	var results []interface{}
 
 	for _, grant := range grants {
-		if grant == nil {
-			continue
+		m := map[string]interface{}{
+			"permission": grant.Permission,
 		}
 
-		m := make(map[string]interface{})
-
 		if grant.Grantee != nil {
 			m["grantee"] = flattenBucketACLAccessControlPolicyGrantsGrantee(grant.Grantee)
 		}
 
-		if grant.Permission != nil {
-			m["permission"] = aws.StringValue(grant.Permission)
-		}
-
 		results = append(results, m)
 	}
 
 	return results
 }
 
-func flattenBucketACLAccessControlPolicyGrantsGrantee(grantee *s3.Grantee) []interface{} {
+func flattenBucketACLAccessControlPolicyGrantsGrantee(grantee *types.Grantee) []interface{} {
 	if grantee == nil {
 		return []interface{}{}
 	}
 
-	m := make(map[string]interface{})
+	m := map[string]interface{}{
+		"type": grantee.Type,
+	}
 
 	if grantee.DisplayName != nil {
-		m["display_name"] = aws.StringValue(grantee.DisplayName)
+		m["display_name"] = aws.ToString(grantee.DisplayName)
 	}
 
 	if grantee.EmailAddress != nil {
-		m["email_address"] = aws.StringValue(grantee.EmailAddress)
+		m["email_address"] = aws.ToString(grantee.EmailAddress)
 	}
 
 	if grantee.ID != nil {
-		m["id"] = aws.StringValue(grantee.ID)
-	}
-
-	if grantee.Type != nil {
-		m["type"] = aws.StringValue(grantee.Type)
+		m["id"] = aws.ToString(grantee.ID)
 	}
 
 	if grantee.URI != nil {
-		m["uri"] = aws.StringValue(grantee.URI)
+		m["uri"] = aws.ToString(grantee.URI)
 	}
 
 	return []interface{}{m}
 }
 
-func flattenBucketACLAccessControlPolicyOwner(owner *s3.Owner) []interface{} {
+func flattenBucketACLAccessControlPolicyOwner(owner *types.Owner) []interface{} {
 	if owner == nil {
 		return []interface{}{}
 	}
@@ -431,11 +417,11 @@ func flattenBucketACLAccessControlPolicyOwner(owner *s3.Owner) []interface{} {
 	m := make(map[string]interface{})
 
 	if owner.DisplayName != nil {
-		m["display_name"] = aws.StringValue(owner.DisplayName)
+		m["display_name"] = aws.ToString(owner.DisplayName)
 	}
 
 	if owner.ID != nil {
-		m["id"] = aws.StringValue(owner.ID)
+		m["id"] = aws.ToString(owner.ID)
 	}
 
 	return []interface{}{m}
@@ -465,15 +451,15 @@ func BucketACLParseResourceID(id string) (string, string, string, error) {
 	// ~> On or after 3/1/2018: Bucket names can consist of only lowercase letters, numbers, dots, and hyphens; Max 63 characters
 	// ~> Before 3/1/2018: Bucket names could consist of uppercase letters and underscores if in us-east-1; Max 255 characters
 	// Reference: https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucketnamingrules.html
-	bucketRegex := regexp.MustCompile(`^([a-z0-9.-]{1,63}|[a-zA-Z0-9.\-_]{1,255})$`)
+	bucketRegex := regexache.MustCompile(`^([0-9a-z.-]{1,63}|[0-9A-Za-z_.-]{1,255})$`)
 	// For bucket and accountID in the ID e.g. bucket,123456789101
 	// ~> Account IDs must consist of 12 digits
-	bucketAndOwnerRegex := regexp.MustCompile(`^([a-z0-9.-]{1,63}|[a-zA-Z0-9.\-_]{1,255}),\d{12}$`)
+	bucketAndOwnerRegex := regexache.MustCompile(`^([0-9a-z.-]{1,63}|[0-9A-Za-z_.-]{1,255}),\d{12}$`)
 	// For bucket and ACL in the ID e.g. bucket,public-read
 	// ~> (Canned) ACL values include: private, public-read, public-read-write, authenticated-read, aws-exec-read, and log-delivery-write
-	bucketAndAclRegex := regexp.MustCompile(`^([a-z0-9.-]{1,63}|[a-zA-Z0-9.\-_]{1,255}),[a-z-]+$`)
+	bucketAndAclRegex := regexache.MustCompile(`^([0-9a-z.-]{1,63}|[0-9A-Za-z_.-]{1,255}),[a-z-]+$`)
 	// For bucket, accountID, and ACL in the ID e.g. bucket,123456789101,public-read
-	bucketOwnerAclRegex := regexp.MustCompile(`^([a-z0-9.-]{1,63}|[a-zA-Z0-9.\-_]{1,255}),\d{12},[a-z-]+$`)
+	bucketOwnerAclRegex := regexache.MustCompile(`^([0-9a-z.-]{1,63}|[0-9A-Za-z_.-]{1,255}),\d{12},[a-z-]+$`)
 
 	// Bucket name ONLY
 	if bucketRegex.MatchString(id) {
@@ -510,3 +496,41 @@ func BucketACLParseResourceID(id string) (string, string, string, error) {
 	return "", "", "", fmt.Errorf("unexpected format for ID (%s), expected BUCKET or BUCKET%[2]sEXPECTED_BUCKET_OWNER or BUCKET%[2]sACL "+
 		"or BUCKET%[2]sEXPECTED_BUCKET_OWNER%[2]sACL", id, BucketACLSeparator)
 }
+
+func findBucketACL(ctx context.Context, conn *s3.Client, bucket, expectedBucketOwner string) (*s3.GetBucketAclOutput, error) {
+	input := &s3.GetBucketAclInput{
+		Bucket: aws.String(bucket),
+	}
+	if expectedBucketOwner != "" {
+		input.ExpectedBucketOwner = aws.String(expectedBucketOwner)
+	}
+
+	output, err := conn.GetBucketAcl(ctx, input)
+
+	if tfawserr.ErrCodeEquals(err, errCodeNoSuchBucket) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	if output == nil {
+		return nil, tfresource.NewEmptyResultError(input)
+	}
+
+	return output, nil
+}
+
+// These should be defined in the AWS SDK for Go. There is an issue, https://github.com/aws/aws-sdk-go/issues/2683.
+const (
+	bucketCannedACLExecRead         = "aws-exec-read"
+	bucketCannedACLLogDeliveryWrite = "log-delivery-write"
+)
+
+func bucketCannedACL_Values() []string {
+	return tfslices.AppendUnique(enum.Values[types.BucketCannedACL](), bucketCannedACLExecRead, bucketCannedACLLogDeliveryWrite)
+}
diff --git a/internal/service/s3/bucket_acl_test.go b/internal/service/s3/bucket_acl_test.go
index b3bd8b7acec..b6fae42eeab 100644
--- a/internal/service/s3/bucket_acl_test.go
+++ b/internal/service/s3/bucket_acl_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3_test
 
 import (
@@ -6,7 +9,8 @@ import (
 	"regexp"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/aws"
+	"github.com/YakDriver/regexache"
+	"github.com/aws/aws-sdk-go-v2/service/s3/types"
 	"github.com/aws/aws-sdk-go/service/s3"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -14,6 +18,7 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	tfs3 "github.com/hashicorp/terraform-provider-aws/internal/service/s3"
+	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
 func TestBucketACLParseResourceID(t *testing.T) {
@@ -259,9 +264,9 @@ func TestAccS3BucketACL_basic(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckBucketDestroy(ctx),
+		CheckDestroy:             acctest.CheckDestroyNoop,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccBucketACLConfig_basic(bucketName, s3.BucketCannedACLPrivate),
@@ -293,9 +298,9 @@ func TestAccS3BucketACL_disappears(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckBucketDestroy(ctx),
+		CheckDestroy:             acctest.CheckDestroyNoop,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccBucketACLConfig_basic(bucketName, s3.BucketCannedACLPrivate),
@@ -319,22 +324,22 @@ func TestAccS3BucketACL_migrate_aclNoChange(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckBucketDestroy(ctx),
+		CheckDestroy:             acctest.CheckDestroyNoop,
 		Steps: []resource.TestStep{
 			{
-				Config: testAccBucketConfig_acl(bucketName, s3.BucketCannedACLPrivate),
+				Config: testAccBucketConfig_acl(bucketName, string(types.BucketCannedACLPrivate)),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketExists(ctx, bucketResourceName),
-					resource.TestCheckResourceAttr(bucketResourceName, "acl", s3.BucketCannedACLPrivate),
+					resource.TestCheckResourceAttr(bucketResourceName, "acl", string(types.BucketCannedACLPrivate)),
 				),
 			},
 			{
-				Config: testAccBucketACLConfig_basic(bucketName, s3.BucketCannedACLPrivate),
+				Config: testAccBucketACLConfig_basic(bucketName, string(types.BucketCannedACLPrivate)),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketACLExists(ctx, resourceName),
-					resource.TestCheckResourceAttr(resourceName, "acl", s3.BucketCannedACLPrivate),
+					resource.TestCheckResourceAttr(resourceName, "acl", string(types.BucketCannedACLPrivate)),
 				),
 			},
 		},
@@ -349,22 +354,22 @@ func TestAccS3BucketACL_migrate_aclWithChange(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckBucketDestroy(ctx),
+		CheckDestroy:             acctest.CheckDestroyNoop,
 		Steps: []resource.TestStep{
 			{
-				Config: testAccBucketConfig_acl(bucketName, s3.BucketCannedACLPrivate),
+				Config: testAccBucketConfig_acl(bucketName, string(types.BucketCannedACLPrivate)),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketExists(ctx, bucketResourceName),
-					resource.TestCheckResourceAttr(bucketResourceName, "acl", s3.BucketCannedACLPrivate),
+					resource.TestCheckResourceAttr(bucketResourceName, "acl", string(types.BucketCannedACLPrivate)),
 				),
 			},
 			{
-				Config: testAccBucketACLConfig_basic_withDisabledPublicAccessBlock(bucketName, s3.BucketCannedACLPublicRead),
+				Config: testAccBucketACLConfig_basic_withDisabledPublicAccessBlock(bucketName, string(types.BucketCannedACLPublicRead)),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketACLExists(ctx, resourceName),
-					resource.TestCheckResourceAttr(resourceName, "acl", s3.BucketCannedACLPublicRead),
+					resource.TestCheckResourceAttr(resourceName, "acl", string(types.BucketCannedACLPublicRead)),
 				),
 			},
 		},
@@ -379,15 +384,15 @@ func TestAccS3BucketACL_migrate_grantsWithChange(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckBucketDestroy(ctx),
+		CheckDestroy:             acctest.CheckDestroyNoop,
 		Steps: []resource.TestStep{
 			{
-				Config: testAccBucketConfig_acl(bucketName, s3.BucketCannedACLPrivate),
+				Config: testAccBucketConfig_acl(bucketName, string(types.BucketCannedACLPrivate)),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketExists(ctx, bucketResourceName),
-					resource.TestCheckResourceAttr(bucketResourceName, "acl", s3.BucketCannedACLPrivate),
+					resource.TestCheckResourceAttr(bucketResourceName, "acl", string(types.BucketCannedACLPrivate)),
 				),
 			},
 			{
@@ -398,17 +403,17 @@ func TestAccS3BucketACL_migrate_grantsWithChange(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "access_control_policy.0.grant.#", "2"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "access_control_policy.0.grant.*", map[string]string{
 						"grantee.#":      "1",
-						"grantee.0.type": s3.TypeCanonicalUser,
-						"permission":     s3.PermissionRead,
+						"grantee.0.type": string(types.TypeCanonicalUser),
+						"permission":     string(types.PermissionRead),
 					}),
 					resource.TestCheckTypeSetElemAttrPair(resourceName, "access_control_policy.0.grant.*.grantee.0.id", "data.aws_canonical_user_id.current", "id"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "access_control_policy.0.grant.*", map[string]string{
 						"grantee.#":      "1",
-						"grantee.0.type": s3.TypeGroup,
-						"permission":     s3.PermissionReadAcp,
+						"grantee.0.type": string(types.TypeGroup),
+						"permission":     string(types.PermissionReadAcp),
 					}),
 					resource.TestMatchTypeSetElemNestedAttrs(resourceName, "access_control_policy.0.grant.*", map[string]*regexp.Regexp{
-						"grantee.0.uri": regexp.MustCompile(`http://acs.*/groups/s3/LogDelivery`),
+						"grantee.0.uri": regexache.MustCompile(`http://acs.*/groups/s3/LogDelivery`),
 					}),
 					resource.TestCheckResourceAttr(resourceName, "access_control_policy.0.owner.#", "1"),
 					resource.TestCheckResourceAttrPair(resourceName, "access_control_policy.0.owner.0.id", "data.aws_canonical_user_id.current", "id"),
@@ -425,22 +430,22 @@ func TestAccS3BucketACL_updateACL(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckBucketDestroy(ctx),
+		CheckDestroy:             acctest.CheckDestroyNoop,
 		Steps: []resource.TestStep{
 			{
-				Config: testAccBucketACLConfig_basic(bucketName, s3.BucketCannedACLPrivate),
+				Config: testAccBucketACLConfig_basic(bucketName, string(types.BucketCannedACLPrivate)),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketACLExists(ctx, resourceName),
-					resource.TestCheckResourceAttr(resourceName, "acl", s3.BucketCannedACLPrivate),
+					resource.TestCheckResourceAttr(resourceName, "acl", string(types.BucketCannedACLPrivate)),
 				),
 			},
 			{
-				Config: testAccBucketACLConfig_basic_withDisabledPublicAccessBlock(bucketName, s3.BucketCannedACLPublicRead),
+				Config: testAccBucketACLConfig_basic_withDisabledPublicAccessBlock(bucketName, string(types.BucketCannedACLPublicRead)),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketACLExists(ctx, resourceName),
-					resource.TestCheckResourceAttr(resourceName, "acl", s3.BucketCannedACLPublicRead),
+					resource.TestCheckResourceAttr(resourceName, "acl", string(types.BucketCannedACLPublicRead)),
 				),
 			},
 			{
@@ -459,9 +464,9 @@ func TestAccS3BucketACL_updateGrant(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckBucketDestroy(ctx),
+		CheckDestroy:             acctest.CheckDestroyNoop,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccBucketACLConfig_grants(bucketName),
@@ -471,13 +476,13 @@ func TestAccS3BucketACL_updateGrant(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "access_control_policy.0.grant.#", "2"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "access_control_policy.0.grant.*", map[string]string{
 						"grantee.#":      "1",
-						"grantee.0.type": s3.TypeCanonicalUser,
-						"permission":     s3.PermissionFullControl,
+						"grantee.0.type": string(types.TypeCanonicalUser),
+						"permission":     string(types.PermissionFullControl),
 					}),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "access_control_policy.0.grant.*", map[string]string{
 						"grantee.#":      "1",
-						"grantee.0.type": s3.TypeCanonicalUser,
-						"permission":     s3.PermissionWrite,
+						"grantee.0.type": string(types.TypeCanonicalUser),
+						"permission":     string(types.PermissionWrite),
 					}),
 					resource.TestCheckTypeSetElemAttrPair(resourceName, "access_control_policy.0.grant.*.grantee.0.id", "data.aws_canonical_user_id.current", "id"),
 					resource.TestCheckResourceAttr(resourceName, "access_control_policy.0.owner.#", "1"),
@@ -497,17 +502,17 @@ func TestAccS3BucketACL_updateGrant(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "access_control_policy.0.grant.#", "2"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "access_control_policy.0.grant.*", map[string]string{
 						"grantee.#":      "1",
-						"grantee.0.type": s3.TypeCanonicalUser,
-						"permission":     s3.PermissionRead,
+						"grantee.0.type": string(types.TypeCanonicalUser),
+						"permission":     string(types.PermissionRead),
 					}),
 					resource.TestCheckTypeSetElemAttrPair(resourceName, "access_control_policy.0.grant.*.grantee.0.id", "data.aws_canonical_user_id.current", "id"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "access_control_policy.0.grant.*", map[string]string{
 						"grantee.#":      "1",
-						"grantee.0.type": s3.TypeGroup,
-						"permission":     s3.PermissionReadAcp,
+						"grantee.0.type": string(types.TypeGroup),
+						"permission":     string(types.PermissionReadAcp),
 					}),
 					resource.TestMatchTypeSetElemNestedAttrs(resourceName, "access_control_policy.0.grant.*", map[string]*regexp.Regexp{
-						"grantee.0.uri": regexp.MustCompile(`http://acs.*/groups/s3/LogDelivery`),
+						"grantee.0.uri": regexache.MustCompile(`http://acs.*/groups/s3/LogDelivery`),
 					}),
 					resource.TestCheckResourceAttr(resourceName, "access_control_policy.0.owner.#", "1"),
 					resource.TestCheckResourceAttrPair(resourceName, "access_control_policy.0.owner.0.id", "data.aws_canonical_user_id.current", "id"),
@@ -529,15 +534,15 @@ func TestAccS3BucketACL_ACLToGrant(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckBucketDestroy(ctx),
+		CheckDestroy:             acctest.CheckDestroyNoop,
 		Steps: []resource.TestStep{
 			{
-				Config: testAccBucketACLConfig_basic(bucketName, s3.BucketCannedACLPrivate),
+				Config: testAccBucketACLConfig_basic(bucketName, string(types.BucketCannedACLPrivate)),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketACLExists(ctx, resourceName),
-					resource.TestCheckResourceAttr(resourceName, "acl", s3.BucketCannedACLPrivate),
+					resource.TestCheckResourceAttr(resourceName, "acl", string(types.BucketCannedACLPrivate)),
 					resource.TestCheckResourceAttr(resourceName, "access_control_policy.#", "1"),
 				),
 			},
@@ -565,9 +570,9 @@ func TestAccS3BucketACL_grantToACL(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckBucketDestroy(ctx),
+		CheckDestroy:             acctest.CheckDestroyNoop,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccBucketACLConfig_grants(bucketName),
@@ -578,10 +583,10 @@ func TestAccS3BucketACL_grantToACL(t *testing.T) {
 				),
 			},
 			{
-				Config: testAccBucketACLConfig_basic(bucketName, s3.BucketCannedACLPrivate),
+				Config: testAccBucketACLConfig_basic(bucketName, string(types.BucketCannedACLPrivate)),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketACLExists(ctx, resourceName),
-					resource.TestCheckResourceAttr(resourceName, "acl", s3.BucketCannedACLPrivate),
+					resource.TestCheckResourceAttr(resourceName, "acl", string(types.BucketCannedACLPrivate)),
 					resource.TestCheckResourceAttr(resourceName, "access_control_policy.#", "1"),
 				),
 			},
@@ -601,36 +606,16 @@ func testAccCheckBucketACLExists(ctx context.Context, n string) resource.TestChe
 			return fmt.Errorf("Not found: %s", n)
 		}
 
-		if rs.Primary.ID == "" {
-			return fmt.Errorf("No ID is set")
-		}
-
-		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Conn(ctx)
-
 		bucket, expectedBucketOwner, _, err := tfs3.BucketACLParseResourceID(rs.Primary.ID)
 		if err != nil {
 			return err
 		}
 
-		input := &s3.GetBucketAclInput{
-			Bucket: aws.String(bucket),
-		}
-
-		if expectedBucketOwner != "" {
-			input.ExpectedBucketOwner = aws.String(expectedBucketOwner)
-		}
+		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Client(ctx)
 
-		output, err := conn.GetBucketAclWithContext(ctx, input)
-
-		if err != nil {
-			return err
-		}
-
-		if output == nil || len(output.Grants) == 0 || output.Owner == nil {
-			return fmt.Errorf("S3 bucket ACL %s not found", rs.Primary.ID)
-		}
+		_, err = tfs3.FindBucketACL(ctx, conn, bucket, expectedBucketOwner)
 
-		return nil
+		return err
 	}
 }
 
diff --git a/internal/service/s3/bucket_analytics_configuration.go b/internal/service/s3/bucket_analytics_configuration.go
index 3adaf5f5f31..4c15b36d9b5 100644
--- a/internal/service/s3/bucket_analytics_configuration.go
+++ b/internal/service/s3/bucket_analytics_configuration.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3
 
 import (
@@ -5,16 +8,16 @@ import (
 	"fmt"
 	"log"
 	"strings"
-	"time"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/s3"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/s3"
+	"github.com/aws/aws-sdk-go-v2/service/s3/types"
+	"github.com/hashicorp/aws-sdk-go-base/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/enum"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
@@ -28,16 +31,12 @@ func ResourceBucketAnalyticsConfiguration() *schema.Resource {
 		ReadWithoutTimeout:   resourceBucketAnalyticsConfigurationRead,
 		UpdateWithoutTimeout: resourceBucketAnalyticsConfigurationPut,
 		DeleteWithoutTimeout: resourceBucketAnalyticsConfigurationDelete,
+
 		Importer: &schema.ResourceImporter{
 			StateContext: schema.ImportStatePassthroughContext,
 		},
 
 		Schema: map[string]*schema.Schema{
-			"name": {
-				Type:     schema.TypeString,
-				Required: true,
-				ForceNew: true,
-			},
 			"bucket": {
 				Type:     schema.TypeString,
 				Required: true,
@@ -52,17 +51,22 @@ func ResourceBucketAnalyticsConfiguration() *schema.Resource {
 						"prefix": {
 							Type:         schema.TypeString,
 							Optional:     true,
-							AtLeastOneOf: filterAtLeastOneOfKeys,
+							AtLeastOneOf: []string{"filter.0.prefix", "filter.0.tags"},
 						},
 						"tags": {
 							Type:         schema.TypeMap,
 							Optional:     true,
-							AtLeastOneOf: filterAtLeastOneOfKeys,
 							Elem:         &schema.Schema{Type: schema.TypeString},
+							AtLeastOneOf: []string{"filter.0.prefix", "filter.0.tags"},
 						},
 					},
 				},
 			},
+			"name": {
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
 			"storage_class_analysis": {
 				Type:     schema.TypeList,
 				Optional: true,
@@ -76,10 +80,10 @@ func ResourceBucketAnalyticsConfiguration() *schema.Resource {
 							Elem: &schema.Resource{
 								Schema: map[string]*schema.Schema{
 									"output_schema_version": {
-										Type:         schema.TypeString,
-										Optional:     true,
-										Default:      s3.StorageClassAnalysisSchemaVersionV1,
-										ValidateFunc: validation.StringInSlice([]string{s3.StorageClassAnalysisSchemaVersionV1}, false),
+										Type:             schema.TypeString,
+										Optional:         true,
+										Default:          types.StorageClassAnalysisSchemaVersionV1,
+										ValidateDiagFunc: enum.Validate[types.StorageClassAnalysisSchemaVersion](),
 									},
 									"destination": {
 										Type:     schema.TypeList,
@@ -104,10 +108,10 @@ func ResourceBucketAnalyticsConfiguration() *schema.Resource {
 																ValidateFunc: verify.ValidAccountID,
 															},
 															"format": {
-																Type:         schema.TypeString,
-																Optional:     true,
-																Default:      s3.AnalyticsS3ExportFileFormatCsv,
-																ValidateFunc: validation.StringInSlice([]string{s3.AnalyticsS3ExportFileFormatCsv}, false),
+																Type:             schema.TypeString,
+																Optional:         true,
+																Default:          types.AnalyticsS3ExportFileFormatCsv,
+																ValidateDiagFunc: enum.Validate[types.AnalyticsS3ExportFileFormat](),
 															},
 															"prefix": {
 																Type:     schema.TypeString,
@@ -129,101 +133,78 @@ func ResourceBucketAnalyticsConfiguration() *schema.Resource {
 	}
 }
 
-var filterAtLeastOneOfKeys = []string{"filter.0.prefix", "filter.0.tags"}
-
 func resourceBucketAnalyticsConfigurationPut(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).S3Conn(ctx)
+	conn := meta.(*conns.AWSClient).S3Client(ctx)
 
-	bucket := d.Get("bucket").(string)
 	name := d.Get("name").(string)
-
-	log.Printf("[DEBUG] S3 bucket %q, add analytics configuration %q", bucket, name)
-
-	analyticsConfiguration := &s3.AnalyticsConfiguration{
+	analyticsConfiguration := &types.AnalyticsConfiguration{
 		Id:                   aws.String(name),
-		Filter:               ExpandAnalyticsFilter(ctx, d.Get("filter").([]interface{})),
-		StorageClassAnalysis: ExpandStorageClassAnalysis(d.Get("storage_class_analysis").([]interface{})),
+		StorageClassAnalysis: expandStorageClassAnalysis(d.Get("storage_class_analysis").([]interface{})),
 	}
 
+	if v, ok := d.GetOk("filter"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
+		analyticsConfiguration.Filter = expandAnalyticsFilter(ctx, v.([]interface{})[0].(map[string]interface{}))
+	}
+
+	bucket := d.Get("bucket").(string)
 	input := &s3.PutBucketAnalyticsConfigurationInput{
 		Bucket:                 aws.String(bucket),
 		Id:                     aws.String(name),
 		AnalyticsConfiguration: analyticsConfiguration,
 	}
 
-	err := retry.RetryContext(ctx, 1*time.Minute, func() *retry.RetryError {
-		_, err := conn.PutBucketAnalyticsConfigurationWithContext(ctx, input)
+	_, err := tfresource.RetryWhenAWSErrCodeEquals(ctx, s3BucketPropagationTimeout, func() (interface{}, error) {
+		return conn.PutBucketAnalyticsConfiguration(ctx, input)
+	}, errCodeNoSuchBucket)
 
-		if tfawserr.ErrCodeEquals(err, s3.ErrCodeNoSuchBucket) {
-			return retry.RetryableError(err)
-		}
+	if err != nil {
+		return diag.Errorf("creating S3 Bucket (%s) Analytics Configuration (%s): %s", bucket, name, err)
+	}
 
-		if err != nil {
-			return retry.NonRetryableError(err)
-		}
-		return nil
-	})
+	if d.IsNewResource() {
+		d.SetId(fmt.Sprintf("%s:%s", bucket, name))
 
-	if tfresource.TimedOut(err) {
-		_, err = conn.PutBucketAnalyticsConfigurationWithContext(ctx, input)
-	}
+		_, err = tfresource.RetryWhenNotFound(ctx, s3BucketPropagationTimeout, func() (interface{}, error) {
+			return findAnalyticsConfiguration(ctx, conn, bucket, name)
+		})
 
-	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "adding S3 Bucket Analytics Configuration: %s", err)
+		if err != nil {
+			return sdkdiag.AppendErrorf(diags, "waiting for S3 Bucket Analytics Configuration (%s) create: %s", d.Id(), err)
+		}
 	}
 
-	d.SetId(fmt.Sprintf("%s:%s", bucket, name))
-
 	return append(diags, resourceBucketAnalyticsConfigurationRead(ctx, d, meta)...)
 }
 
 func resourceBucketAnalyticsConfigurationRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).S3Conn(ctx)
+	conn := meta.(*conns.AWSClient).S3Client(ctx)
 
 	bucket, name, err := BucketAnalyticsConfigurationParseID(d.Id())
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "reading S3 Bucket Analytics Configuration (%s): %s", d.Id(), err)
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
-	d.Set("bucket", bucket)
-	d.Set("name", name)
-
-	input := &s3.GetBucketAnalyticsConfigurationInput{
-		Bucket: aws.String(bucket),
-		Id:     aws.String(name),
-	}
-
-	log.Printf("[DEBUG] Reading S3 bucket analytics configuration: %s", input)
-	output, err := conn.GetBucketAnalyticsConfigurationWithContext(ctx, input)
-
-	if !d.IsNewResource() && tfawserr.ErrCodeEquals(err, s3.ErrCodeNoSuchBucket) {
-		log.Printf("[WARN] S3 Bucket Analytics Configuration (%s) not found, removing from state", d.Id())
-		d.SetId("")
-		return diags
-	}
+	ac, err := findAnalyticsConfiguration(ctx, conn, bucket, name)
 
-	if !d.IsNewResource() && tfawserr.ErrCodeEquals(err, errCodeNoSuchConfiguration) {
+	if !d.IsNewResource() && tfresource.NotFound(err) {
 		log.Printf("[WARN] S3 Bucket Analytics Configuration (%s) not found, removing from state", d.Id())
 		d.SetId("")
-		return diags
+		return nil
 	}
 
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "getting S3 Bucket Analytics Configuration (%s): %s", d.Id(), err)
-	}
-
-	if output == nil {
-		return sdkdiag.AppendErrorf(diags, "getting S3 Bucket Analytics Configuration (%s): empty response", d.Id())
+		return diag.Errorf("reading S3 Bucket Analytics Configuration (%s): %s", d.Id(), err)
 	}
 
-	if err := d.Set("filter", FlattenAnalyticsFilter(ctx, output.AnalyticsConfiguration.Filter)); err != nil {
+	d.Set("bucket", bucket)
+	if err := d.Set("filter", flattenAnalyticsFilter(ctx, ac.Filter)); err != nil {
 		return sdkdiag.AppendErrorf(diags, "setting filter: %s", err)
 	}
-
-	if err = d.Set("storage_class_analysis", FlattenStorageClassAnalysis(output.AnalyticsConfiguration.StorageClassAnalysis)); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting storage class anyalytics: %s", err)
+	d.Set("name", name)
+	if err = d.Set("storage_class_analysis", flattenStorageClassAnalysis(ac.StorageClassAnalysis)); err != nil {
+		return sdkdiag.AppendErrorf(diags, "setting storage_class_analysis: %s", err)
 	}
 
 	return diags
@@ -231,30 +212,35 @@ func resourceBucketAnalyticsConfigurationRead(ctx context.Context, d *schema.Res
 
 func resourceBucketAnalyticsConfigurationDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).S3Conn(ctx)
+	conn := meta.(*conns.AWSClient).S3Client(ctx)
 
 	bucket, name, err := BucketAnalyticsConfigurationParseID(d.Id())
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "deleting S3 analytics configuration (%s): %s", d.Id(), err)
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
-	input := &s3.DeleteBucketAnalyticsConfigurationInput{
+	log.Printf("[DEBUG] Deleting S3 Bucket Analytics Configuration: %s", d.Id())
+	_, err = conn.DeleteBucketAnalyticsConfiguration(ctx, &s3.DeleteBucketAnalyticsConfigurationInput{
 		Bucket: aws.String(bucket),
 		Id:     aws.String(name),
+	})
+
+	if tfawserr.ErrCodeEquals(err, errCodeNoSuchBucket, errCodeNoSuchConfiguration) {
+		return diags
 	}
 
-	log.Printf("[DEBUG] Deleting S3 bucket analytics configuration: %s", input)
-	_, err = conn.DeleteBucketAnalyticsConfigurationWithContext(ctx, input)
 	if err != nil {
-		if tfawserr.ErrCodeEquals(err, s3.ErrCodeNoSuchBucket) || tfawserr.ErrMessageContains(err, "NoSuchConfiguration", "The specified configuration does not exist.") {
-			return diags
-		}
-		return sdkdiag.AppendErrorf(diags, "deleting S3 analytics configuration (%s): %s", d.Id(), err)
+		return sdkdiag.AppendErrorf(diags, "deleting S3 Bucket Analytics Configuration (%s): %s", d.Id(), err)
 	}
 
-	if err := WaitForDeleteBucketAnalyticsConfiguration(ctx, conn, bucket, name, 1*time.Minute); err != nil {
-		return sdkdiag.AppendErrorf(diags, "deleting S3 analytics configuration (%s): %s", d.Id(), err)
+	_, err = tfresource.RetryUntilNotFound(ctx, s3BucketPropagationTimeout, func() (interface{}, error) {
+		return findAnalyticsConfiguration(ctx, conn, bucket, name)
+	})
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "waiting for S3 Bucket Analytics Configuration (%s) delete: %s", d.Id(), err)
 	}
+
 	return nil
 }
 
@@ -268,46 +254,50 @@ func BucketAnalyticsConfigurationParseID(id string) (string, string, error) {
 	return bucket, name, nil
 }
 
-func ExpandAnalyticsFilter(ctx context.Context, l []interface{}) *s3.AnalyticsFilter {
-	if len(l) == 0 || l[0] == nil {
-		return nil
-	}
-
-	m := l[0].(map[string]interface{})
-
+func expandAnalyticsFilter(ctx context.Context, m map[string]interface{}) types.AnalyticsFilter {
 	var prefix string
 	if v, ok := m["prefix"]; ok {
 		prefix = v.(string)
 	}
 
-	var tags []*s3.Tag
+	var tags []types.Tag
 	if v, ok := m["tags"]; ok {
-		tags = Tags(tftags.New(ctx, v).IgnoreAWS())
+		tags = tagsV2(tftags.New(ctx, v).IgnoreAWS())
 	}
 
 	if prefix == "" && len(tags) == 0 {
 		return nil
 	}
-	analyticsFilter := &s3.AnalyticsFilter{}
+
+	var analyticsFilter types.AnalyticsFilter
+
 	if prefix != "" && len(tags) > 0 {
-		analyticsFilter.And = &s3.AnalyticsAndOperator{
-			Prefix: aws.String(prefix),
-			Tags:   tags,
+		analyticsFilter = &types.AnalyticsFilterMemberAnd{
+			Value: types.AnalyticsAndOperator{
+				Prefix: aws.String(prefix),
+				Tags:   tags,
+			},
 		}
 	} else if len(tags) > 1 {
-		analyticsFilter.And = &s3.AnalyticsAndOperator{
-			Tags: tags,
+		analyticsFilter = &types.AnalyticsFilterMemberAnd{
+			Value: types.AnalyticsAndOperator{
+				Tags: tags,
+			},
 		}
 	} else if len(tags) == 1 {
-		analyticsFilter.Tag = tags[0]
+		analyticsFilter = &types.AnalyticsFilterMemberTag{
+			Value: tags[0],
+		}
 	} else {
-		analyticsFilter.Prefix = aws.String(prefix)
+		analyticsFilter = &types.AnalyticsFilterMemberPrefix{
+			Value: prefix,
+		}
 	}
 	return analyticsFilter
 }
 
-func ExpandStorageClassAnalysis(l []interface{}) *s3.StorageClassAnalysis {
-	result := &s3.StorageClassAnalysis{}
+func expandStorageClassAnalysis(l []interface{}) *types.StorageClassAnalysis {
+	result := &types.StorageClassAnalysis{}
 
 	if len(l) == 0 || l[0] == nil {
 		return result
@@ -315,14 +305,14 @@ func ExpandStorageClassAnalysis(l []interface{}) *s3.StorageClassAnalysis {
 
 	m := l[0].(map[string]interface{})
 	if v, ok := m["data_export"]; ok {
-		dataExport := &s3.StorageClassAnalysisDataExport{}
+		dataExport := &types.StorageClassAnalysisDataExport{}
 		result.DataExport = dataExport
 
 		foo := v.([]interface{})
 		if len(foo) != 0 && foo[0] != nil {
 			bar := foo[0].(map[string]interface{})
 			if v, ok := bar["output_schema_version"]; ok {
-				dataExport.OutputSchemaVersion = aws.String(v.(string))
+				dataExport.OutputSchemaVersion = types.StorageClassAnalysisSchemaVersion(v.(string))
 			}
 
 			dataExport.Destination = expandAnalyticsExportDestination(bar["destination"].([]interface{}))
@@ -332,8 +322,8 @@ func ExpandStorageClassAnalysis(l []interface{}) *s3.StorageClassAnalysis {
 	return result
 }
 
-func expandAnalyticsExportDestination(edl []interface{}) *s3.AnalyticsExportDestination {
-	result := &s3.AnalyticsExportDestination{}
+func expandAnalyticsExportDestination(edl []interface{}) *types.AnalyticsExportDestination {
+	result := &types.AnalyticsExportDestination{}
 
 	if len(edl) != 0 && edl[0] != nil {
 		edm := edl[0].(map[string]interface{})
@@ -342,13 +332,13 @@ func expandAnalyticsExportDestination(edl []interface{}) *s3.AnalyticsExportDest
 	return result
 }
 
-func expandAnalyticsBucketDestination(bdl []interface{}) *s3.AnalyticsS3BucketDestination {
-	result := &s3.AnalyticsS3BucketDestination{}
+func expandAnalyticsBucketDestination(bdl []interface{}) *types.AnalyticsS3BucketDestination {
+	result := &types.AnalyticsS3BucketDestination{}
 
 	if len(bdl) != 0 && bdl[0] != nil {
 		bdm := bdl[0].(map[string]interface{})
 		result.Bucket = aws.String(bdm["bucket_arn"].(string))
-		result.Format = aws.String(bdm["format"].(string))
+		result.Format = types.AnalyticsS3ExportFileFormat(bdm["format"].(string))
 
 		if v, ok := bdm["bucket_account_id"]; ok && v != "" {
 			result.BucketAccountId = aws.String(v.(string))
@@ -362,41 +352,39 @@ func expandAnalyticsBucketDestination(bdl []interface{}) *s3.AnalyticsS3BucketDe
 	return result
 }
 
-func FlattenAnalyticsFilter(ctx context.Context, analyticsFilter *s3.AnalyticsFilter) []map[string]interface{} {
-	if analyticsFilter == nil {
-		return nil
-	}
-
+func flattenAnalyticsFilter(ctx context.Context, analyticsFilter types.AnalyticsFilter) []map[string]interface{} {
 	result := make(map[string]interface{})
-	if and := analyticsFilter.And; and != nil {
-		if and.Prefix != nil {
-			result["prefix"] = aws.StringValue(and.Prefix)
+
+	switch v := analyticsFilter.(type) {
+	case *types.AnalyticsFilterMemberAnd:
+		if v := v.Value.Prefix; v != nil {
+			result["prefix"] = aws.ToString(v)
 		}
-		if and.Tags != nil {
-			result["tags"] = KeyValueTags(ctx, and.Tags).IgnoreAWS().Map()
+		if v := v.Value.Tags; v != nil {
+			result["tags"] = keyValueTagsV2(ctx, v).IgnoreAWS().Map()
 		}
-	} else if analyticsFilter.Prefix != nil {
-		result["prefix"] = aws.StringValue(analyticsFilter.Prefix)
-	} else if analyticsFilter.Tag != nil {
-		tags := []*s3.Tag{
-			analyticsFilter.Tag,
+	case *types.AnalyticsFilterMemberPrefix:
+		result["prefix"] = v.Value
+	case *types.AnalyticsFilterMemberTag:
+		tags := []types.Tag{
+			v.Value,
 		}
-		result["tags"] = KeyValueTags(ctx, tags).IgnoreAWS().Map()
-	} else {
+		result["tags"] = keyValueTagsV2(ctx, tags).IgnoreAWS().Map()
+	default:
 		return nil
 	}
+
 	return []map[string]interface{}{result}
 }
 
-func FlattenStorageClassAnalysis(storageClassAnalysis *s3.StorageClassAnalysis) []map[string]interface{} {
+func flattenStorageClassAnalysis(storageClassAnalysis *types.StorageClassAnalysis) []map[string]interface{} {
 	if storageClassAnalysis == nil || storageClassAnalysis.DataExport == nil {
 		return []map[string]interface{}{}
 	}
 
 	dataExport := storageClassAnalysis.DataExport
-	de := make(map[string]interface{})
-	if dataExport.OutputSchemaVersion != nil {
-		de["output_schema_version"] = aws.StringValue(dataExport.OutputSchemaVersion)
+	de := map[string]interface{}{
+		"output_schema_version": dataExport.OutputSchemaVersion,
 	}
 	if dataExport.Destination != nil {
 		de["destination"] = flattenAnalyticsExportDestination(dataExport.Destination)
@@ -408,7 +396,7 @@ func FlattenStorageClassAnalysis(storageClassAnalysis *s3.StorageClassAnalysis)
 	return []map[string]interface{}{result}
 }
 
-func flattenAnalyticsExportDestination(destination *s3.AnalyticsExportDestination) []interface{} {
+func flattenAnalyticsExportDestination(destination *types.AnalyticsExportDestination) []interface{} {
 	if destination == nil || destination.S3BucketDestination == nil {
 		return []interface{}{}
 	}
@@ -420,56 +408,47 @@ func flattenAnalyticsExportDestination(destination *s3.AnalyticsExportDestinatio
 	}
 }
 
-func flattenAnalyticsBucketDestination(bucketDestination *s3.AnalyticsS3BucketDestination) []interface{} {
+func flattenAnalyticsBucketDestination(bucketDestination *types.AnalyticsS3BucketDestination) []interface{} {
 	if bucketDestination == nil {
 		return nil
 	}
 
 	result := map[string]interface{}{
-		"bucket_arn": aws.StringValue(bucketDestination.Bucket),
-		"format":     aws.StringValue(bucketDestination.Format),
+		"bucket_arn": aws.ToString(bucketDestination.Bucket),
+		"format":     bucketDestination.Format,
 	}
 	if bucketDestination.BucketAccountId != nil {
-		result["bucket_account_id"] = aws.StringValue(bucketDestination.BucketAccountId)
+		result["bucket_account_id"] = aws.ToString(bucketDestination.BucketAccountId)
 	}
 	if bucketDestination.Prefix != nil {
-		result["prefix"] = aws.StringValue(bucketDestination.Prefix)
+		result["prefix"] = aws.ToString(bucketDestination.Prefix)
 	}
 
 	return []interface{}{result}
 }
 
-func WaitForDeleteBucketAnalyticsConfiguration(ctx context.Context, conn *s3.S3, bucket, name string, timeout time.Duration) error {
+func findAnalyticsConfiguration(ctx context.Context, conn *s3.Client, bucket, id string) (*types.AnalyticsConfiguration, error) {
 	input := &s3.GetBucketAnalyticsConfigurationInput{
 		Bucket: aws.String(bucket),
-		Id:     aws.String(name),
+		Id:     aws.String(id),
 	}
 
-	err := retry.RetryContext(ctx, timeout, func() *retry.RetryError {
-		output, err := conn.GetBucketAnalyticsConfigurationWithContext(ctx, input)
+	output, err := conn.GetBucketAnalyticsConfiguration(ctx, input)
 
-		if err != nil {
-			return retry.NonRetryableError(err)
-		}
-
-		if output != nil && output.AnalyticsConfiguration != nil {
-			return retry.RetryableError(fmt.Errorf("S3 bucket analytics configuration exists: %v", output))
+	if tfawserr.ErrCodeEquals(err, errCodeNoSuchBucket, errCodeNoSuchConfiguration) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
 		}
-
-		return nil
-	})
-
-	if tfresource.TimedOut(err) { // nosemgrep:ci.helper-schema-TimeoutError-check-doesnt-return-output
-		_, err = conn.GetBucketAnalyticsConfigurationWithContext(ctx, input)
 	}
 
-	if tfawserr.ErrCodeEquals(err, s3.ErrCodeNoSuchBucket) || tfawserr.ErrMessageContains(err, "NoSuchConfiguration", "The specified configuration does not exist.") {
-		return nil
+	if err != nil {
+		return nil, err
 	}
 
-	if err != nil {
-		return fmt.Errorf("deleting S3 Bucket Analytics Configuration \"%s:%s\": %w", bucket, name, err)
+	if output == nil || output.AnalyticsConfiguration == nil {
+		return nil, tfresource.NewEmptyResultError(input)
 	}
 
-	return nil
+	return output.AnalyticsConfiguration, nil
 }
diff --git a/internal/service/s3/bucket_analytics_configuration_test.go b/internal/service/s3/bucket_analytics_configuration_test.go
index f8351fda039..bfa16612ed9 100644
--- a/internal/service/s3/bucket_analytics_configuration_test.go
+++ b/internal/service/s3/bucket_analytics_configuration_test.go
@@ -1,33 +1,34 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3_test
 
 import (
 	"context"
 	"fmt"
-	"reflect"
-	"regexp"
-	"sort"
 	"testing"
-	"time"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/s3"
+	"github.com/YakDriver/regexache"
+	"github.com/aws/aws-sdk-go-v2/service/s3/types"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	tfs3 "github.com/hashicorp/terraform-provider-aws/internal/service/s3"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
 func TestAccS3BucketAnalyticsConfiguration_basic(t *testing.T) {
 	ctx := acctest.Context(t)
-	var ac s3.AnalyticsConfiguration
+	var ac types.AnalyticsConfiguration
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_s3_bucket_analytics_configuration.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketAnalyticsConfigurationDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -50,15 +51,15 @@ func TestAccS3BucketAnalyticsConfiguration_basic(t *testing.T) {
 	})
 }
 
-func TestAccS3BucketAnalyticsConfiguration_removed(t *testing.T) {
+func TestAccS3BucketAnalyticsConfiguration_disappears(t *testing.T) {
 	ctx := acctest.Context(t)
-	var ac s3.AnalyticsConfiguration
+	var ac types.AnalyticsConfiguration
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_s3_bucket_analytics_configuration.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketAnalyticsConfigurationDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -66,13 +67,9 @@ func TestAccS3BucketAnalyticsConfiguration_removed(t *testing.T) {
 				Config: testAccBucketAnalyticsConfigurationConfig_basic(rName, rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketAnalyticsConfigurationExists(ctx, resourceName, &ac),
+					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfs3.ResourceBucketAnalyticsConfiguration(), resourceName),
 				),
-			},
-			{
-				Config: testAccBucketAnalyticsConfigurationConfig_removed(rName),
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckBucketAnalyticsConfigurationRemoved(ctx, rName, rName),
-				),
+				ExpectNonEmptyPlan: true,
 			},
 		},
 	})
@@ -80,7 +77,7 @@ func TestAccS3BucketAnalyticsConfiguration_removed(t *testing.T) {
 
 func TestAccS3BucketAnalyticsConfiguration_updateBasic(t *testing.T) {
 	ctx := acctest.Context(t)
-	var ac s3.AnalyticsConfiguration
+	var ac types.AnalyticsConfiguration
 	originalACName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	originalBucketName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	updatedACName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
@@ -89,7 +86,7 @@ func TestAccS3BucketAnalyticsConfiguration_updateBasic(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketAnalyticsConfigurationDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -107,7 +104,6 @@ func TestAccS3BucketAnalyticsConfiguration_updateBasic(t *testing.T) {
 				Config: testAccBucketAnalyticsConfigurationConfig_basic(updatedACName, originalBucketName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketAnalyticsConfigurationExists(ctx, resourceName, &ac),
-					testAccCheckBucketAnalyticsConfigurationRemoved(ctx, originalACName, originalBucketName),
 					resource.TestCheckResourceAttr(resourceName, "name", updatedACName),
 					resource.TestCheckResourceAttrPair(resourceName, "bucket", "aws_s3_bucket.test", "bucket"),
 					resource.TestCheckResourceAttr(resourceName, "filter.#", "0"),
@@ -118,7 +114,6 @@ func TestAccS3BucketAnalyticsConfiguration_updateBasic(t *testing.T) {
 				Config: testAccBucketAnalyticsConfigurationConfig_update(updatedACName, originalBucketName, updatedBucketName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketAnalyticsConfigurationExists(ctx, resourceName, &ac),
-					testAccCheckBucketAnalyticsConfigurationRemoved(ctx, updatedACName, originalBucketName),
 					resource.TestCheckResourceAttr(resourceName, "name", updatedACName),
 					resource.TestCheckResourceAttrPair(resourceName, "bucket", "aws_s3_bucket.test_2", "bucket"),
 					resource.TestCheckResourceAttr(resourceName, "filter.#", "0"),
@@ -140,13 +135,13 @@ func TestAccS3BucketAnalyticsConfiguration_WithFilter_empty(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketAnalyticsConfigurationDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccBucketAnalyticsConfigurationConfig_emptyFilter(rName, rName),
-				ExpectError: regexp.MustCompile(`one of .* must be specified`),
+				ExpectError: regexache.MustCompile(`one of .* must be specified`),
 			},
 		},
 	})
@@ -154,7 +149,7 @@ func TestAccS3BucketAnalyticsConfiguration_WithFilter_empty(t *testing.T) {
 
 func TestAccS3BucketAnalyticsConfiguration_WithFilter_prefix(t *testing.T) {
 	ctx := acctest.Context(t)
-	var ac s3.AnalyticsConfiguration
+	var ac types.AnalyticsConfiguration
 	rInt := sdkacctest.RandInt()
 	resourceName := "aws_s3_bucket_analytics_configuration.test"
 
@@ -164,7 +159,7 @@ func TestAccS3BucketAnalyticsConfiguration_WithFilter_prefix(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketAnalyticsConfigurationDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -197,7 +192,7 @@ func TestAccS3BucketAnalyticsConfiguration_WithFilter_prefix(t *testing.T) {
 
 func TestAccS3BucketAnalyticsConfiguration_WithFilter_singleTag(t *testing.T) {
 	ctx := acctest.Context(t)
-	var ac s3.AnalyticsConfiguration
+	var ac types.AnalyticsConfiguration
 	rInt := sdkacctest.RandInt()
 	resourceName := "aws_s3_bucket_analytics_configuration.test"
 
@@ -207,7 +202,7 @@ func TestAccS3BucketAnalyticsConfiguration_WithFilter_singleTag(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketAnalyticsConfigurationDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -242,7 +237,7 @@ func TestAccS3BucketAnalyticsConfiguration_WithFilter_singleTag(t *testing.T) {
 
 func TestAccS3BucketAnalyticsConfiguration_WithFilter_multipleTags(t *testing.T) {
 	ctx := acctest.Context(t)
-	var ac s3.AnalyticsConfiguration
+	var ac types.AnalyticsConfiguration
 	rInt := sdkacctest.RandInt()
 	resourceName := "aws_s3_bucket_analytics_configuration.test"
 
@@ -254,7 +249,7 @@ func TestAccS3BucketAnalyticsConfiguration_WithFilter_multipleTags(t *testing.T)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketAnalyticsConfigurationDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -291,7 +286,7 @@ func TestAccS3BucketAnalyticsConfiguration_WithFilter_multipleTags(t *testing.T)
 
 func TestAccS3BucketAnalyticsConfiguration_WithFilter_prefixAndTags(t *testing.T) {
 	ctx := acctest.Context(t)
-	var ac s3.AnalyticsConfiguration
+	var ac types.AnalyticsConfiguration
 	rInt := sdkacctest.RandInt()
 	resourceName := "aws_s3_bucket_analytics_configuration.test"
 
@@ -305,7 +300,7 @@ func TestAccS3BucketAnalyticsConfiguration_WithFilter_prefixAndTags(t *testing.T
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketAnalyticsConfigurationDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -342,7 +337,7 @@ func TestAccS3BucketAnalyticsConfiguration_WithFilter_prefixAndTags(t *testing.T
 
 func TestAccS3BucketAnalyticsConfiguration_WithFilter_remove(t *testing.T) {
 	ctx := acctest.Context(t)
-	var ac s3.AnalyticsConfiguration
+	var ac types.AnalyticsConfiguration
 	rInt := sdkacctest.RandInt()
 	resourceName := "aws_s3_bucket_analytics_configuration.test"
 
@@ -351,7 +346,7 @@ func TestAccS3BucketAnalyticsConfiguration_WithFilter_remove(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketAnalyticsConfigurationDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -383,13 +378,13 @@ func TestAccS3BucketAnalyticsConfiguration_WithStorageClassAnalysis_empty(t *tes
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketAnalyticsConfigurationDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccBucketAnalyticsConfigurationConfig_emptyStorageClassAnalysis(rName, rName),
-				ExpectError: regexp.MustCompile(`running pre-apply refresh`),
+				ExpectError: regexache.MustCompile(`running pre-apply refresh`),
 			},
 		},
 	})
@@ -397,14 +392,14 @@ func TestAccS3BucketAnalyticsConfiguration_WithStorageClassAnalysis_empty(t *tes
 
 func TestAccS3BucketAnalyticsConfiguration_WithStorageClassAnalysis_default(t *testing.T) {
 	ctx := acctest.Context(t)
-	var ac s3.AnalyticsConfiguration
+	var ac types.AnalyticsConfiguration
 	resourceName := "aws_s3_bucket_analytics_configuration.test"
 
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketAnalyticsConfigurationDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -432,7 +427,7 @@ func TestAccS3BucketAnalyticsConfiguration_WithStorageClassAnalysis_default(t *t
 
 func TestAccS3BucketAnalyticsConfiguration_WithStorageClassAnalysis_full(t *testing.T) {
 	ctx := acctest.Context(t)
-	var ac s3.AnalyticsConfiguration
+	var ac types.AnalyticsConfiguration
 	resourceName := "aws_s3_bucket_analytics_configuration.test"
 
 	rInt := sdkacctest.RandInt()
@@ -441,7 +436,7 @@ func TestAccS3BucketAnalyticsConfiguration_WithStorageClassAnalysis_full(t *test
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketAnalyticsConfigurationDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -470,7 +465,7 @@ func TestAccS3BucketAnalyticsConfiguration_WithStorageClassAnalysis_full(t *test
 
 func testAccCheckBucketAnalyticsConfigurationDestroy(ctx context.Context) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Conn(ctx)
+		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Client(ctx)
 
 		for _, rs := range s.RootModule().Resources {
 			if rs.Type != "aws_s3_bucket_analytics_configuration" {
@@ -482,80 +477,75 @@ func testAccCheckBucketAnalyticsConfigurationDestroy(ctx context.Context) resour
 				return err
 			}
 
-			return tfs3.WaitForDeleteBucketAnalyticsConfiguration(ctx, conn, bucket, name, 1*time.Minute)
+			_, err = tfs3.FindAnalyticsConfiguration(ctx, conn, bucket, name)
+
+			if tfresource.NotFound(err) {
+				continue
+			}
+
+			if err != nil {
+				return err
+			}
+
+			return fmt.Errorf("S3 Bucket Analytics Configuration %s still exists", rs.Primary.ID)
 		}
+
 		return nil
 	}
 }
 
-func testAccCheckBucketAnalyticsConfigurationExists(ctx context.Context, n string, ac *s3.AnalyticsConfiguration) resource.TestCheckFunc {
+func testAccCheckBucketAnalyticsConfigurationExists(ctx context.Context, n string, v *types.AnalyticsConfiguration) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		rs, ok := s.RootModule().Resources[n]
 		if !ok {
 			return fmt.Errorf("Not found: %s", n)
 		}
 
-		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Conn(ctx)
-		output, err := conn.GetBucketAnalyticsConfigurationWithContext(ctx, &s3.GetBucketAnalyticsConfigurationInput{
-			Bucket: aws.String(rs.Primary.Attributes["bucket"]),
-			Id:     aws.String(rs.Primary.Attributes["name"]),
-		})
-
+		bucket, name, err := tfs3.BucketAnalyticsConfigurationParseID(rs.Primary.ID)
 		if err != nil {
 			return err
 		}
 
-		if output == nil || output.AnalyticsConfiguration == nil {
-			return fmt.Errorf("error reading S3 Bucket Analytics Configuration %q: empty response", rs.Primary.ID)
+		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Client(ctx)
+
+		output, err := tfs3.FindAnalyticsConfiguration(ctx, conn, bucket, name)
+
+		if err != nil {
+			return err
 		}
 
-		*ac = *output.AnalyticsConfiguration
+		*v = *output
 
 		return nil
 	}
 }
 
-func testAccCheckBucketAnalyticsConfigurationRemoved(ctx context.Context, name, bucket string) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Conn(ctx)
-		return tfs3.WaitForDeleteBucketAnalyticsConfiguration(ctx, conn, bucket, name, 1*time.Minute)
-	}
-}
-
 func testAccBucketAnalyticsConfigurationConfig_basic(name, bucket string) string {
 	return fmt.Sprintf(`
 resource "aws_s3_bucket_analytics_configuration" "test" {
   bucket = aws_s3_bucket.test.bucket
-  name   = "%s"
+  name   = %[1]q
 }
 
 resource "aws_s3_bucket" "test" {
-  bucket = "%s"
+  bucket = %[2]q
 }
 `, name, bucket)
 }
 
-func testAccBucketAnalyticsConfigurationConfig_removed(bucket string) string {
-	return fmt.Sprintf(`
-resource "aws_s3_bucket" "test" {
-  bucket = "%s"
-}
-`, bucket)
-}
-
 func testAccBucketAnalyticsConfigurationConfig_update(name, originalBucket, updatedBucket string) string {
 	return fmt.Sprintf(`
 resource "aws_s3_bucket_analytics_configuration" "test" {
   bucket = aws_s3_bucket.test_2.bucket
-  name   = "%s"
+  name   = %[1]q
 }
 
 resource "aws_s3_bucket" "test" {
-  bucket = "%s"
+  bucket = %[2]q
 }
 
 resource "aws_s3_bucket" "test_2" {
-  bucket = "%s"
+  bucket = %[3]q
 }
 `, name, originalBucket, updatedBucket)
 }
@@ -564,14 +554,14 @@ func testAccBucketAnalyticsConfigurationConfig_emptyFilter(name, bucket string)
 	return fmt.Sprintf(`
 resource "aws_s3_bucket_analytics_configuration" "test" {
   bucket = aws_s3_bucket.test.bucket
-  name   = "%s"
+  name   = %[1]q
 
   filter {
   }
 }
 
 resource "aws_s3_bucket" "test" {
-  bucket = "%s"
+  bucket = %[2]q
 }
 `, name, bucket)
 }
@@ -580,15 +570,15 @@ func testAccBucketAnalyticsConfigurationConfig_filterPrefix(name, bucket, prefix
 	return fmt.Sprintf(`
 resource "aws_s3_bucket_analytics_configuration" "test" {
   bucket = aws_s3_bucket.test.bucket
-  name   = "%s"
+  name   = %[1]q
 
   filter {
-    prefix = "%s"
+    prefix = %[2]q
   }
 }
 
 resource "aws_s3_bucket" "test" {
-  bucket = "%s"
+  bucket = %[3]q
 }
 `, name, prefix, bucket)
 }
@@ -597,17 +587,17 @@ func testAccBucketAnalyticsConfigurationConfig_filterSingleTag(name, bucket, tag
 	return fmt.Sprintf(`
 resource "aws_s3_bucket_analytics_configuration" "test" {
   bucket = aws_s3_bucket.test.bucket
-  name   = "%s"
+  name   = %[1]q
 
   filter {
     tags = {
-      "tag1" = "%s"
+      "tag1" = %[2]q
     }
   }
 }
 
 resource "aws_s3_bucket" "test" {
-  bucket = "%s"
+  bucket = %[3]q
 }
 `, name, tag, bucket)
 }
@@ -616,18 +606,18 @@ func testAccBucketAnalyticsConfigurationConfig_filterMultipleTags(name, bucket,
 	return fmt.Sprintf(`
 resource "aws_s3_bucket_analytics_configuration" "test" {
   bucket = aws_s3_bucket.test.bucket
-  name   = "%s"
+  name   = %[1]q
 
   filter {
     tags = {
-      "tag1" = "%s"
-      "tag2" = "%s"
+      "tag1" = %[2]q
+      "tag2" = %[3]q
     }
   }
 }
 
 resource "aws_s3_bucket" "test" {
-  bucket = "%s"
+  bucket = %[4]q
 }
 `, name, tag1, tag2, bucket)
 }
@@ -636,20 +626,20 @@ func testAccBucketAnalyticsConfigurationConfig_filterPrefixAndTags(name, bucket,
 	return fmt.Sprintf(`
 resource "aws_s3_bucket_analytics_configuration" "test" {
   bucket = aws_s3_bucket.test.bucket
-  name   = "%s"
+  name   = %[1]q
 
   filter {
-    prefix = "%s"
+    prefix = %[2]q
 
     tags = {
-      "tag1" = "%s"
-      "tag2" = "%s"
+      "tag1" = %[3]q
+      "tag2" = %[4]q
     }
   }
 }
 
 resource "aws_s3_bucket" "test" {
-  bucket = "%s"
+  bucket = %[5]q
 }
 `, name, prefix, tag1, tag2, bucket)
 }
@@ -658,14 +648,14 @@ func testAccBucketAnalyticsConfigurationConfig_emptyStorageClassAnalysis(name, b
 	return fmt.Sprintf(`
 resource "aws_s3_bucket_analytics_configuration" "test" {
   bucket = aws_s3_bucket.test.bucket
-  name   = "%s"
+  name   = %[1]q
 
   storage_class_analysis {
   }
 }
 
 resource "aws_s3_bucket" "test" {
-  bucket = "%s"
+  bucket = %[2]q
 }
 `, name, bucket)
 }
@@ -674,7 +664,7 @@ func testAccBucketAnalyticsConfigurationConfig_defaultStorageClassAnalysis(name,
 	return fmt.Sprintf(`
 resource "aws_s3_bucket_analytics_configuration" "test" {
   bucket = aws_s3_bucket.test.bucket
-  name   = "%s"
+  name   = %[1]q
 
   storage_class_analysis {
     data_export {
@@ -688,7 +678,7 @@ resource "aws_s3_bucket_analytics_configuration" "test" {
 }
 
 resource "aws_s3_bucket" "test" {
-  bucket = "%[2]s"
+  bucket = %[2]q
 }
 
 resource "aws_s3_bucket" "destination" {
@@ -701,7 +691,7 @@ func testAccBucketAnalyticsConfigurationConfig_fullStorageClassAnalysis(name, bu
 	return fmt.Sprintf(`
 resource "aws_s3_bucket_analytics_configuration" "test" {
   bucket = aws_s3_bucket.test.bucket
-  name   = "%s"
+  name   = %[1]q
 
   storage_class_analysis {
     data_export {
@@ -711,7 +701,7 @@ resource "aws_s3_bucket_analytics_configuration" "test" {
         s3_bucket_destination {
           format     = "CSV"
           bucket_arn = aws_s3_bucket.destination.arn
-          prefix     = "%s"
+          prefix     = %[2]q
         }
       }
     }
@@ -719,7 +709,7 @@ resource "aws_s3_bucket_analytics_configuration" "test" {
 }
 
 resource "aws_s3_bucket" "test" {
-  bucket = "%[3]s"
+  bucket = %[3]q
 }
 
 resource "aws_s3_bucket" "destination" {
@@ -727,539 +717,3 @@ resource "aws_s3_bucket" "destination" {
 }
 `, name, prefix, bucket)
 }
-
-func TestExpandAnalyticsFilter(t *testing.T) {
-	t.Parallel()
-
-	ctx := context.Background()
-	testCases := map[string]struct {
-		Input    []interface{}
-		Expected *s3.AnalyticsFilter
-	}{
-		"nil input": {
-			Input:    nil,
-			Expected: nil,
-		},
-		"empty input": {
-			Input:    []interface{}{},
-			Expected: nil,
-		},
-		"prefix only": {
-			Input: []interface{}{
-				map[string]interface{}{
-					"prefix": "prefix/",
-				},
-			},
-			Expected: &s3.AnalyticsFilter{
-				Prefix: aws.String("prefix/"),
-			},
-		},
-		"prefix and single tag": {
-			Input: []interface{}{
-				map[string]interface{}{
-					"prefix": "prefix/",
-					"tags": map[string]interface{}{
-						"tag1key": "tag1value",
-					},
-				},
-			},
-			Expected: &s3.AnalyticsFilter{
-				And: &s3.AnalyticsAndOperator{
-					Prefix: aws.String("prefix/"),
-					Tags: []*s3.Tag{
-						{
-							Key:   aws.String("tag1key"),
-							Value: aws.String("tag1value"),
-						},
-					},
-				},
-			},
-		},
-		"prefix and multiple tags": {
-			Input: []interface{}{map[string]interface{}{
-				"prefix": "prefix/",
-				"tags": map[string]interface{}{
-					"tag1key": "tag1value",
-					"tag2key": "tag2value",
-				},
-			},
-			},
-			Expected: &s3.AnalyticsFilter{
-				And: &s3.AnalyticsAndOperator{
-					Prefix: aws.String("prefix/"),
-					Tags: []*s3.Tag{
-						{
-							Key:   aws.String("tag1key"),
-							Value: aws.String("tag1value"),
-						},
-						{
-							Key:   aws.String("tag2key"),
-							Value: aws.String("tag2value"),
-						},
-					},
-				},
-			},
-		},
-		"single tag only": {
-			Input: []interface{}{
-				map[string]interface{}{
-					"tags": map[string]interface{}{
-						"tag1key": "tag1value",
-					},
-				},
-			},
-			Expected: &s3.AnalyticsFilter{
-				Tag: &s3.Tag{
-					Key:   aws.String("tag1key"),
-					Value: aws.String("tag1value"),
-				},
-			},
-		},
-		"multiple tags only": {
-			Input: []interface{}{
-				map[string]interface{}{
-					"tags": map[string]interface{}{
-						"tag1key": "tag1value",
-						"tag2key": "tag2value",
-					},
-				},
-			},
-			Expected: &s3.AnalyticsFilter{
-				And: &s3.AnalyticsAndOperator{
-					Tags: []*s3.Tag{
-						{
-							Key:   aws.String("tag1key"),
-							Value: aws.String("tag1value"),
-						},
-						{
-							Key:   aws.String("tag2key"),
-							Value: aws.String("tag2value"),
-						},
-					},
-				},
-			},
-		},
-	}
-
-	for k, tc := range testCases {
-		value := tfs3.ExpandAnalyticsFilter(ctx, tc.Input)
-
-		if value == nil {
-			if tc.Expected == nil {
-				continue
-			}
-
-			t.Errorf("Case %q: Got nil\nExpected:\n%v", k, tc.Expected)
-		}
-
-		if tc.Expected == nil {
-			t.Errorf("Case %q: Got: %v\nExpected: nil", k, value)
-		}
-
-		// Sort tags by key for consistency
-		if value.And != nil && value.And.Tags != nil {
-			sort.Slice(value.And.Tags, func(i, j int) bool {
-				return *value.And.Tags[i].Key < *value.And.Tags[j].Key
-			})
-		}
-
-		// Convert to strings to avoid dealing with pointers
-		valueS := fmt.Sprintf("%v", value)
-		expectedValueS := fmt.Sprintf("%v", tc.Expected)
-
-		if valueS != expectedValueS {
-			t.Errorf("Case %q: Given:\n%s\n\nExpected:\n%s", k, valueS, expectedValueS)
-		}
-	}
-}
-
-func TestExpandStorageClassAnalysis(t *testing.T) {
-	t.Parallel()
-
-	testCases := map[string]struct {
-		Input    []interface{}
-		Expected *s3.StorageClassAnalysis
-	}{
-		"nil input": {
-			Input:    nil,
-			Expected: &s3.StorageClassAnalysis{},
-		},
-		"empty input": {
-			Input:    []interface{}{},
-			Expected: &s3.StorageClassAnalysis{},
-		},
-		"nil array": {
-			Input: []interface{}{
-				nil,
-			},
-			Expected: &s3.StorageClassAnalysis{},
-		},
-		"empty data_export": {
-			Input: []interface{}{
-				map[string]interface{}{
-					"data_export": []interface{}{},
-				},
-			},
-			Expected: &s3.StorageClassAnalysis{
-				DataExport: &s3.StorageClassAnalysisDataExport{},
-			},
-		},
-		"data_export complete": {
-			Input: []interface{}{
-				map[string]interface{}{
-					"data_export": []interface{}{
-						map[string]interface{}{
-							"output_schema_version": s3.StorageClassAnalysisSchemaVersionV1,
-							"destination":           []interface{}{},
-						},
-					},
-				},
-			},
-			Expected: &s3.StorageClassAnalysis{
-				DataExport: &s3.StorageClassAnalysisDataExport{
-					OutputSchemaVersion: aws.String(s3.StorageClassAnalysisSchemaVersionV1),
-					Destination:         &s3.AnalyticsExportDestination{},
-				},
-			},
-		},
-		"empty s3_bucket_destination": {
-			Input: []interface{}{
-				map[string]interface{}{
-					"data_export": []interface{}{
-						map[string]interface{}{
-							"destination": []interface{}{
-								map[string]interface{}{
-									"s3_bucket_destination": []interface{}{},
-								},
-							},
-						},
-					},
-				},
-			},
-			Expected: &s3.StorageClassAnalysis{
-				DataExport: &s3.StorageClassAnalysisDataExport{
-					Destination: &s3.AnalyticsExportDestination{
-						S3BucketDestination: &s3.AnalyticsS3BucketDestination{},
-					},
-				},
-			},
-		},
-		"s3_bucket_destination complete": {
-			Input: []interface{}{
-				map[string]interface{}{
-					"data_export": []interface{}{
-						map[string]interface{}{
-							"destination": []interface{}{
-								map[string]interface{}{
-									"s3_bucket_destination": []interface{}{
-										map[string]interface{}{
-											"bucket_arn":        "arn:aws:s3", //lintignore:AWSAT005
-											"bucket_account_id": "1234567890",
-											"format":            s3.AnalyticsS3ExportFileFormatCsv,
-											"prefix":            "prefix/",
-										},
-									},
-								},
-							},
-						},
-					},
-				},
-			},
-			Expected: &s3.StorageClassAnalysis{
-				DataExport: &s3.StorageClassAnalysisDataExport{
-					Destination: &s3.AnalyticsExportDestination{
-						S3BucketDestination: &s3.AnalyticsS3BucketDestination{
-							Bucket:          aws.String("arn:aws:s3"), //lintignore:AWSAT005
-							BucketAccountId: aws.String("1234567890"),
-							Format:          aws.String(s3.AnalyticsS3ExportFileFormatCsv),
-							Prefix:          aws.String("prefix/"),
-						},
-					},
-				},
-			},
-		},
-		"s3_bucket_destination required": {
-			Input: []interface{}{
-				map[string]interface{}{
-					"data_export": []interface{}{
-						map[string]interface{}{
-							"destination": []interface{}{
-								map[string]interface{}{
-									"s3_bucket_destination": []interface{}{
-										map[string]interface{}{
-											"bucket_arn": "arn:aws:s3", //lintignore:AWSAT005
-											"format":     s3.AnalyticsS3ExportFileFormatCsv,
-										},
-									},
-								},
-							},
-						},
-					},
-				},
-			},
-			Expected: &s3.StorageClassAnalysis{
-				DataExport: &s3.StorageClassAnalysisDataExport{
-					Destination: &s3.AnalyticsExportDestination{
-						S3BucketDestination: &s3.AnalyticsS3BucketDestination{
-							Bucket:          aws.String("arn:aws:s3"), //lintignore:AWSAT005
-							BucketAccountId: nil,
-							Format:          aws.String(s3.AnalyticsS3ExportFileFormatCsv),
-							Prefix:          nil,
-						},
-					},
-				},
-			},
-		},
-	}
-
-	for k, tc := range testCases {
-		value := tfs3.ExpandStorageClassAnalysis(tc.Input)
-
-		if !reflect.DeepEqual(value, tc.Expected) {
-			t.Errorf("Case %q:\nGot:\n%v\nExpected:\n%v", k, value, tc.Expected)
-		}
-	}
-}
-
-func TestFlattenAnalyticsFilter(t *testing.T) {
-	t.Parallel()
-
-	ctx := context.Background()
-	testCases := map[string]struct {
-		Input    *s3.AnalyticsFilter
-		Expected []map[string]interface{}
-	}{
-		"nil input": {
-			Input:    nil,
-			Expected: nil,
-		},
-		"empty input": {
-			Input:    &s3.AnalyticsFilter{},
-			Expected: nil,
-		},
-		"prefix only": {
-			Input: &s3.AnalyticsFilter{
-				Prefix: aws.String("prefix/"),
-			},
-			Expected: []map[string]interface{}{
-				{
-					"prefix": "prefix/",
-				},
-			},
-		},
-		"prefix and single tag": {
-			Input: &s3.AnalyticsFilter{
-				And: &s3.AnalyticsAndOperator{
-					Prefix: aws.String("prefix/"),
-					Tags: []*s3.Tag{
-						{
-							Key:   aws.String("tag1key"),
-							Value: aws.String("tag1value"),
-						},
-					},
-				},
-			},
-			Expected: []map[string]interface{}{
-				{
-					"prefix": "prefix/",
-					"tags": map[string]string{
-						"tag1key": "tag1value",
-					},
-				},
-			},
-		},
-		"prefix and multiple tags": {
-			Input: &s3.AnalyticsFilter{
-				And: &s3.AnalyticsAndOperator{
-					Prefix: aws.String("prefix/"),
-					Tags: []*s3.Tag{
-						{
-							Key:   aws.String("tag1key"),
-							Value: aws.String("tag1value"),
-						},
-						{
-							Key:   aws.String("tag2key"),
-							Value: aws.String("tag2value"),
-						},
-					},
-				},
-			},
-			Expected: []map[string]interface{}{
-				{
-					"prefix": "prefix/",
-					"tags": map[string]string{
-						"tag1key": "tag1value",
-						"tag2key": "tag2value",
-					},
-				},
-			},
-		},
-		"single tag only": {
-			Input: &s3.AnalyticsFilter{
-				Tag: &s3.Tag{
-					Key:   aws.String("tag1key"),
-					Value: aws.String("tag1value"),
-				},
-			},
-			Expected: []map[string]interface{}{
-				{
-					"tags": map[string]string{
-						"tag1key": "tag1value",
-					},
-				},
-			},
-		},
-		"multiple tags only": {
-			Input: &s3.AnalyticsFilter{
-				And: &s3.AnalyticsAndOperator{
-					Tags: []*s3.Tag{
-						{
-							Key:   aws.String("tag1key"),
-							Value: aws.String("tag1value"),
-						},
-						{
-							Key:   aws.String("tag2key"),
-							Value: aws.String("tag2value"),
-						},
-					},
-				},
-			},
-			Expected: []map[string]interface{}{
-				{
-					"tags": map[string]string{
-						"tag1key": "tag1value",
-						"tag2key": "tag2value",
-					},
-				},
-			},
-		},
-	}
-
-	for k, tc := range testCases {
-		value := tfs3.FlattenAnalyticsFilter(ctx, tc.Input)
-
-		if !reflect.DeepEqual(value, tc.Expected) {
-			t.Errorf("Case %q: Got:\n%v\n\nExpected:\n%v", k, value, tc.Expected)
-		}
-	}
-}
-
-func TestFlattenStorageClassAnalysis(t *testing.T) {
-	t.Parallel()
-
-	testCases := map[string]struct {
-		Input    *s3.StorageClassAnalysis
-		Expected []map[string]interface{}
-	}{
-		"nil value": {
-			Input:    nil,
-			Expected: []map[string]interface{}{},
-		},
-		"empty root": {
-			Input:    &s3.StorageClassAnalysis{},
-			Expected: []map[string]interface{}{},
-		},
-		"empty data_export": {
-			Input: &s3.StorageClassAnalysis{
-				DataExport: &s3.StorageClassAnalysisDataExport{},
-			},
-			Expected: []map[string]interface{}{
-				{
-					"data_export": []interface{}{
-						map[string]interface{}{},
-					},
-				},
-			},
-		},
-		"data_export complete": {
-			Input: &s3.StorageClassAnalysis{
-				DataExport: &s3.StorageClassAnalysisDataExport{
-					OutputSchemaVersion: aws.String(s3.StorageClassAnalysisSchemaVersionV1),
-					Destination:         &s3.AnalyticsExportDestination{},
-				},
-			},
-			Expected: []map[string]interface{}{
-				{
-					"data_export": []interface{}{
-						map[string]interface{}{
-							"output_schema_version": s3.StorageClassAnalysisSchemaVersionV1,
-							"destination":           []interface{}{},
-						},
-					},
-				},
-			},
-		},
-		"s3_bucket_destination required": {
-			Input: &s3.StorageClassAnalysis{
-				DataExport: &s3.StorageClassAnalysisDataExport{
-					Destination: &s3.AnalyticsExportDestination{
-						S3BucketDestination: &s3.AnalyticsS3BucketDestination{
-							Bucket: aws.String("arn:aws:s3"), //lintignore:AWSAT005
-							Format: aws.String(s3.AnalyticsS3ExportFileFormatCsv),
-						},
-					},
-				},
-			},
-			Expected: []map[string]interface{}{
-				{
-					"data_export": []interface{}{
-						map[string]interface{}{
-							"destination": []interface{}{
-								map[string]interface{}{
-									"s3_bucket_destination": []interface{}{
-										map[string]interface{}{
-											"bucket_arn": "arn:aws:s3", //lintignore:AWSAT005
-											"format":     s3.AnalyticsS3ExportFileFormatCsv,
-										},
-									},
-								},
-							},
-						},
-					},
-				},
-			},
-		},
-		"s3_bucket_destination complete": {
-			Input: &s3.StorageClassAnalysis{
-				DataExport: &s3.StorageClassAnalysisDataExport{
-					Destination: &s3.AnalyticsExportDestination{
-						S3BucketDestination: &s3.AnalyticsS3BucketDestination{
-							Bucket:          aws.String("arn:aws:s3"), //lintignore:AWSAT005
-							BucketAccountId: aws.String("1234567890"),
-							Format:          aws.String(s3.AnalyticsS3ExportFileFormatCsv),
-							Prefix:          aws.String("prefix/"),
-						},
-					},
-				},
-			},
-			Expected: []map[string]interface{}{
-				{
-					"data_export": []interface{}{
-						map[string]interface{}{
-							"destination": []interface{}{
-								map[string]interface{}{
-									"s3_bucket_destination": []interface{}{
-										map[string]interface{}{
-											"bucket_arn":        "arn:aws:s3", //lintignore:AWSAT005
-											"bucket_account_id": "1234567890",
-											"format":            s3.AnalyticsS3ExportFileFormatCsv,
-											"prefix":            "prefix/",
-										},
-									},
-								},
-							},
-						},
-					},
-				},
-			},
-		},
-	}
-
-	for k, tc := range testCases {
-		value := tfs3.FlattenStorageClassAnalysis(tc.Input)
-
-		if !reflect.DeepEqual(value, tc.Expected) {
-			t.Errorf("Case %q:\nGot:\n%v\nExpected:\n%v", k, value, tc.Expected)
-		}
-	}
-}
diff --git a/internal/service/s3/bucket_cors_configuration.go b/internal/service/s3/bucket_cors_configuration.go
index 63da006984e..03ad1fc6fa6 100644
--- a/internal/service/s3/bucket_cors_configuration.go
+++ b/internal/service/s3/bucket_cors_configuration.go
@@ -1,14 +1,18 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3
 
 import (
 	"context"
 	"log"
-	"time"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/s3"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/s3"
+	"github.com/aws/aws-sdk-go-v2/service/s3/types"
+	"github.com/hashicorp/aws-sdk-go-base/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
@@ -24,6 +28,7 @@ func ResourceBucketCorsConfiguration() *schema.Resource {
 		ReadWithoutTimeout:   resourceBucketCorsConfigurationRead,
 		UpdateWithoutTimeout: resourceBucketCorsConfigurationUpdate,
 		DeleteWithoutTimeout: resourceBucketCorsConfigurationDelete,
+
 		Importer: &schema.ResourceImporter{
 			StateContext: schema.ImportStatePassthroughContext,
 		},
@@ -84,87 +89,72 @@ func ResourceBucketCorsConfiguration() *schema.Resource {
 }
 
 func resourceBucketCorsConfigurationCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).S3Conn(ctx)
+	conn := meta.(*conns.AWSClient).S3Client(ctx)
 
 	bucket := d.Get("bucket").(string)
 	expectedBucketOwner := d.Get("expected_bucket_owner").(string)
-
 	input := &s3.PutBucketCorsInput{
 		Bucket: aws.String(bucket),
-		CORSConfiguration: &s3.CORSConfiguration{
-			CORSRules: expandBucketCorsConfigurationCorsRules(d.Get("cors_rule").(*schema.Set).List()),
+		CORSConfiguration: &types.CORSConfiguration{
+			CORSRules: expandCORSRules(d.Get("cors_rule").(*schema.Set).List()),
 		},
 	}
-
 	if expectedBucketOwner != "" {
 		input.ExpectedBucketOwner = aws.String(expectedBucketOwner)
 	}
 
-	_, err := tfresource.RetryWhenAWSErrCodeEquals(ctx, 2*time.Minute, func() (interface{}, error) {
-		return conn.PutBucketCorsWithContext(ctx, input)
-	}, s3.ErrCodeNoSuchBucket)
+	_, err := tfresource.RetryWhenAWSErrCodeEquals(ctx, s3BucketPropagationTimeout, func() (interface{}, error) {
+		return conn.PutBucketCors(ctx, input)
+	}, errCodeNoSuchBucket)
 
 	if err != nil {
-		return diag.Errorf("creating S3 bucket (%s) CORS configuration: %s", bucket, err)
+		return diag.Errorf("creating S3 Bucket (%s) CORS Configuration: %s", bucket, err)
 	}
 
 	d.SetId(CreateResourceID(bucket, expectedBucketOwner))
 
+	_, err = tfresource.RetryWhenNotFound(ctx, s3BucketPropagationTimeout, func() (interface{}, error) {
+		return findCORSRules(ctx, conn, bucket, expectedBucketOwner)
+	})
+
+	if err != nil {
+		return diag.Errorf("waiting for S3 Bucket CORS Configuration (%s) create: %s", d.Id(), err)
+	}
+
 	return resourceBucketCorsConfigurationRead(ctx, d, meta)
 }
 
 func resourceBucketCorsConfigurationRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).S3Conn(ctx)
+	conn := meta.(*conns.AWSClient).S3Client(ctx)
 
 	bucket, expectedBucketOwner, err := ParseResourceID(d.Id())
 	if err != nil {
 		return diag.FromErr(err)
 	}
 
-	input := &s3.GetBucketCorsInput{
-		Bucket: aws.String(bucket),
-	}
+	corsRules, err := findCORSRules(ctx, conn, bucket, expectedBucketOwner)
 
-	if expectedBucketOwner != "" {
-		input.ExpectedBucketOwner = aws.String(expectedBucketOwner)
-	}
-
-	corsResponse, err := tfresource.RetryWhenAWSErrCodeEquals(ctx, 2*time.Minute, func() (interface{}, error) {
-		return conn.GetBucketCorsWithContext(ctx, input)
-	}, ErrCodeNoSuchCORSConfiguration)
-
-	if !d.IsNewResource() && tfawserr.ErrCodeEquals(err, s3.ErrCodeNoSuchBucket, ErrCodeNoSuchCORSConfiguration) {
+	if !d.IsNewResource() && tfresource.NotFound(err) {
 		log.Printf("[WARN] S3 Bucket CORS Configuration (%s) not found, removing from state", d.Id())
 		d.SetId("")
 		return nil
 	}
 
 	if err != nil {
-		return diag.Errorf("reading S3 bucket CORS configuration (%s): %s", d.Id(), err)
-	}
-
-	output, ok := corsResponse.(*s3.GetBucketCorsOutput)
-	if !ok || output == nil {
-		if d.IsNewResource() {
-			return diag.Errorf("reading S3 bucket CORS configuration (%s): empty output", d.Id())
-		}
-		log.Printf("[WARN] S3 Bucket CORS Configuration (%s) not found, removing from state", d.Id())
-		d.SetId("")
-		return nil
+		return diag.Errorf("reading S3 Bucket CORS Configuration (%s): %s", d.Id(), err)
 	}
 
 	d.Set("bucket", bucket)
-	d.Set("expected_bucket_owner", expectedBucketOwner)
-
-	if err := d.Set("cors_rule", flattenBucketCorsConfigurationCorsRules(output.CORSRules)); err != nil {
+	if err := d.Set("cors_rule", flattenCORSRules(corsRules)); err != nil {
 		return diag.Errorf("setting cors_rule: %s", err)
 	}
+	d.Set("expected_bucket_owner", expectedBucketOwner)
 
 	return nil
 }
 
 func resourceBucketCorsConfigurationUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).S3Conn(ctx)
+	conn := meta.(*conns.AWSClient).S3Client(ctx)
 
 	bucket, expectedBucketOwner, err := ParseResourceID(d.Id())
 	if err != nil {
@@ -173,26 +163,25 @@ func resourceBucketCorsConfigurationUpdate(ctx context.Context, d *schema.Resour
 
 	input := &s3.PutBucketCorsInput{
 		Bucket: aws.String(bucket),
-		CORSConfiguration: &s3.CORSConfiguration{
-			CORSRules: expandBucketCorsConfigurationCorsRules(d.Get("cors_rule").(*schema.Set).List()),
+		CORSConfiguration: &types.CORSConfiguration{
+			CORSRules: expandCORSRules(d.Get("cors_rule").(*schema.Set).List()),
 		},
 	}
-
 	if expectedBucketOwner != "" {
 		input.ExpectedBucketOwner = aws.String(expectedBucketOwner)
 	}
 
-	_, err = conn.PutBucketCorsWithContext(ctx, input)
+	_, err = conn.PutBucketCors(ctx, input)
 
 	if err != nil {
-		return diag.Errorf("updating S3 bucket CORS configuration (%s): %s", d.Id(), err)
+		return diag.Errorf("updating S3 Bucket CORS Configuration (%s): %s", d.Id(), err)
 	}
 
 	return resourceBucketCorsConfigurationRead(ctx, d, meta)
 }
 
 func resourceBucketCorsConfigurationDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).S3Conn(ctx)
+	conn := meta.(*conns.AWSClient).S3Client(ctx)
 
 	bucket, expectedBucketOwner, err := ParseResourceID(d.Id())
 	if err != nil {
@@ -202,30 +191,37 @@ func resourceBucketCorsConfigurationDelete(ctx context.Context, d *schema.Resour
 	input := &s3.DeleteBucketCorsInput{
 		Bucket: aws.String(bucket),
 	}
-
 	if expectedBucketOwner != "" {
 		input.ExpectedBucketOwner = aws.String(expectedBucketOwner)
 	}
 
-	_, err = conn.DeleteBucketCorsWithContext(ctx, input)
+	_, err = conn.DeleteBucketCors(ctx, input)
 
-	if tfawserr.ErrCodeEquals(err, s3.ErrCodeNoSuchBucket) {
+	if tfawserr.ErrCodeEquals(err, errCodeNoSuchBucket, errCodeNoSuchCORSConfiguration) {
 		return nil
 	}
 
 	if err != nil {
-		return diag.Errorf("deleting S3 bucket CORS configuration (%s): %s", d.Id(), err)
+		return diag.Errorf("deleting S3 Bucket CORS Configuration (%s): %s", d.Id(), err)
+	}
+
+	_, err = tfresource.RetryUntilNotFound(ctx, s3BucketPropagationTimeout, func() (interface{}, error) {
+		return findCORSRules(ctx, conn, bucket, expectedBucketOwner)
+	})
+
+	if err != nil {
+		return diag.Errorf("waiting for S3 Bucket CORS Configuration (%s) delete: %s", d.Id(), err)
 	}
 
 	return nil
 }
 
-func expandBucketCorsConfigurationCorsRules(l []interface{}) []*s3.CORSRule {
+func expandCORSRules(l []interface{}) []types.CORSRule {
 	if len(l) == 0 {
 		return nil
 	}
 
-	var rules []*s3.CORSRule
+	var rules []types.CORSRule
 
 	for _, tfMapRaw := range l {
 		tfMap, ok := tfMapRaw.(map[string]interface{})
@@ -233,22 +229,22 @@ func expandBucketCorsConfigurationCorsRules(l []interface{}) []*s3.CORSRule {
 			continue
 		}
 
-		rule := &s3.CORSRule{}
+		rule := types.CORSRule{}
 
 		if v, ok := tfMap["allowed_headers"].(*schema.Set); ok && v.Len() > 0 {
-			rule.AllowedHeaders = flex.ExpandStringSet(v)
+			rule.AllowedHeaders = flex.ExpandStringValueSet(v)
 		}
 
 		if v, ok := tfMap["allowed_methods"].(*schema.Set); ok && v.Len() > 0 {
-			rule.AllowedMethods = flex.ExpandStringSet(v)
+			rule.AllowedMethods = flex.ExpandStringValueSet(v)
 		}
 
 		if v, ok := tfMap["allowed_origins"].(*schema.Set); ok && v.Len() > 0 {
-			rule.AllowedOrigins = flex.ExpandStringSet(v)
+			rule.AllowedOrigins = flex.ExpandStringValueSet(v)
 		}
 
 		if v, ok := tfMap["expose_headers"].(*schema.Set); ok && v.Len() > 0 {
-			rule.ExposeHeaders = flex.ExpandStringSet(v)
+			rule.ExposeHeaders = flex.ExpandStringValueSet(v)
 		}
 
 		if v, ok := tfMap["id"].(string); ok && v != "" {
@@ -256,7 +252,7 @@ func expandBucketCorsConfigurationCorsRules(l []interface{}) []*s3.CORSRule {
 		}
 
 		if v, ok := tfMap["max_age_seconds"].(int); ok {
-			rule.MaxAgeSeconds = aws.Int64(int64(v))
+			rule.MaxAgeSeconds = int32(v)
 		}
 
 		rules = append(rules, rule)
@@ -265,38 +261,32 @@ func expandBucketCorsConfigurationCorsRules(l []interface{}) []*s3.CORSRule {
 	return rules
 }
 
-func flattenBucketCorsConfigurationCorsRules(rules []*s3.CORSRule) []interface{} {
+func flattenCORSRules(rules []types.CORSRule) []interface{} {
 	var results []interface{}
 
 	for _, rule := range rules {
-		if rule == nil {
-			continue
+		m := map[string]interface{}{
+			"max_age_seconds": rule.MaxAgeSeconds,
 		}
 
-		m := make(map[string]interface{})
-
 		if len(rule.AllowedHeaders) > 0 {
-			m["allowed_headers"] = flex.FlattenStringSet(rule.AllowedHeaders)
+			m["allowed_headers"] = rule.AllowedHeaders
 		}
 
 		if len(rule.AllowedMethods) > 0 {
-			m["allowed_methods"] = flex.FlattenStringSet(rule.AllowedMethods)
+			m["allowed_methods"] = rule.AllowedMethods
 		}
 
 		if len(rule.AllowedOrigins) > 0 {
-			m["allowed_origins"] = flex.FlattenStringSet(rule.AllowedOrigins)
+			m["allowed_origins"] = rule.AllowedOrigins
 		}
 
 		if len(rule.ExposeHeaders) > 0 {
-			m["expose_headers"] = flex.FlattenStringSet(rule.ExposeHeaders)
+			m["expose_headers"] = rule.ExposeHeaders
 		}
 
 		if rule.ID != nil {
-			m["id"] = aws.StringValue(rule.ID)
-		}
-
-		if rule.MaxAgeSeconds != nil {
-			m["max_age_seconds"] = aws.Int64Value(rule.MaxAgeSeconds)
+			m["id"] = aws.ToString(rule.ID)
 		}
 
 		results = append(results, m)
@@ -304,3 +294,31 @@ func flattenBucketCorsConfigurationCorsRules(rules []*s3.CORSRule) []interface{}
 
 	return results
 }
+
+func findCORSRules(ctx context.Context, conn *s3.Client, bucket, expectedBucketOwner string) ([]types.CORSRule, error) {
+	input := &s3.GetBucketCorsInput{
+		Bucket: aws.String(bucket),
+	}
+	if expectedBucketOwner != "" {
+		input.ExpectedBucketOwner = aws.String(expectedBucketOwner)
+	}
+
+	output, err := conn.GetBucketCors(ctx, input)
+
+	if tfawserr.ErrCodeEquals(err, errCodeNoSuchBucket, errCodeNoSuchCORSConfiguration) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	if output == nil || len(output.CORSRules) == 0 {
+		return nil, tfresource.NewEmptyResultError(input)
+	}
+
+	return output.CORSRules, nil
+}
diff --git a/internal/service/s3/bucket_cors_configuration_test.go b/internal/service/s3/bucket_cors_configuration_test.go
index 0db05a98da2..825ba616c33 100644
--- a/internal/service/s3/bucket_cors_configuration_test.go
+++ b/internal/service/s3/bucket_cors_configuration_test.go
@@ -1,14 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3_test
 
 import (
 	"context"
 	"fmt"
 	"testing"
-	"time"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/s3"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
@@ -16,23 +15,24 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	tfs3 "github.com/hashicorp/terraform-provider-aws/internal/service/s3"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
-func TestAccS3BucketCorsConfiguration_basic(t *testing.T) {
+func TestAccS3BucketCORSConfiguration_basic(t *testing.T) {
 	ctx := acctest.Context(t)
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_s3_bucket_cors_configuration.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckBucketCorsConfigurationDestroy(ctx),
+		CheckDestroy:             testAccCheckBucketCORSConfigurationDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccBucketCORSConfigurationConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckBucketCorsConfigurationExists(ctx, resourceName),
+					testAccCheckBucketCORSConfigurationExists(ctx, resourceName),
 					resource.TestCheckResourceAttrPair(resourceName, "bucket", "aws_s3_bucket.test", "id"),
 					resource.TestCheckResourceAttr(resourceName, "cors_rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "cors_rule.*", map[string]string{
@@ -52,21 +52,21 @@ func TestAccS3BucketCorsConfiguration_basic(t *testing.T) {
 	})
 }
 
-func TestAccS3BucketCorsConfiguration_disappears(t *testing.T) {
+func TestAccS3BucketCORSConfiguration_disappears(t *testing.T) {
 	ctx := acctest.Context(t)
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_s3_bucket_cors_configuration.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckBucketCorsConfigurationDestroy(ctx),
+		CheckDestroy:             testAccCheckBucketCORSConfigurationDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccBucketCORSConfigurationConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckBucketCorsConfigurationExists(ctx, resourceName),
+					testAccCheckBucketCORSConfigurationExists(ctx, resourceName),
 					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfs3.ResourceBucketCorsConfiguration(), resourceName),
 				),
 				ExpectNonEmptyPlan: true,
@@ -75,22 +75,22 @@ func TestAccS3BucketCorsConfiguration_disappears(t *testing.T) {
 	})
 }
 
-func TestAccS3BucketCorsConfiguration_update(t *testing.T) {
+func TestAccS3BucketCORSConfiguration_update(t *testing.T) {
 	ctx := acctest.Context(t)
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_s3_bucket_cors_configuration.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckBucketCorsConfigurationDestroy(ctx),
+		CheckDestroy:             testAccCheckBucketCORSConfigurationDestroy(ctx),
 		Steps: []resource.TestStep{
 
 			{
 				Config: testAccBucketCORSConfigurationConfig_completeSingleRule(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckBucketCorsConfigurationExists(ctx, resourceName),
+					testAccCheckBucketCORSConfigurationExists(ctx, resourceName),
 					resource.TestCheckResourceAttrPair(resourceName, "bucket", "aws_s3_bucket.test", "id"),
 					resource.TestCheckResourceAttr(resourceName, "cors_rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "cors_rule.*", map[string]string{
@@ -106,7 +106,7 @@ func TestAccS3BucketCorsConfiguration_update(t *testing.T) {
 			{
 				Config: testAccBucketCORSConfigurationConfig_multipleRules(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckBucketCorsConfigurationExists(ctx, resourceName),
+					testAccCheckBucketCORSConfigurationExists(ctx, resourceName),
 					resource.TestCheckResourceAttrPair(resourceName, "bucket", "aws_s3_bucket.test", "id"),
 					resource.TestCheckResourceAttr(resourceName, "cors_rule.#", "2"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "cors_rule.*", map[string]string{
@@ -128,7 +128,7 @@ func TestAccS3BucketCorsConfiguration_update(t *testing.T) {
 			{
 				Config: testAccBucketCORSConfigurationConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckBucketCorsConfigurationExists(ctx, resourceName),
+					testAccCheckBucketCORSConfigurationExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "cors_rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "cors_rule.*", map[string]string{
 						"allowed_methods.#": "1",
@@ -140,21 +140,21 @@ func TestAccS3BucketCorsConfiguration_update(t *testing.T) {
 	})
 }
 
-func TestAccS3BucketCorsConfiguration_SingleRule(t *testing.T) {
+func TestAccS3BucketCORSConfiguration_SingleRule(t *testing.T) {
 	ctx := acctest.Context(t)
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_s3_bucket_cors_configuration.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckBucketCorsConfigurationDestroy(ctx),
+		CheckDestroy:             testAccCheckBucketCORSConfigurationDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccBucketCORSConfigurationConfig_completeSingleRule(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckBucketCorsConfigurationExists(ctx, resourceName),
+					testAccCheckBucketCORSConfigurationExists(ctx, resourceName),
 					resource.TestCheckResourceAttrPair(resourceName, "bucket", "aws_s3_bucket.test", "id"),
 					resource.TestCheckResourceAttr(resourceName, "cors_rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "cors_rule.*", map[string]string{
@@ -182,21 +182,21 @@ func TestAccS3BucketCorsConfiguration_SingleRule(t *testing.T) {
 	})
 }
 
-func TestAccS3BucketCorsConfiguration_MultipleRules(t *testing.T) {
+func TestAccS3BucketCORSConfiguration_MultipleRules(t *testing.T) {
 	ctx := acctest.Context(t)
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_s3_bucket_cors_configuration.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckBucketCorsConfigurationDestroy(ctx),
+		CheckDestroy:             testAccCheckBucketCORSConfigurationDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccBucketCORSConfigurationConfig_multipleRules(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckBucketCorsConfigurationExists(ctx, resourceName),
+					testAccCheckBucketCORSConfigurationExists(ctx, resourceName),
 					resource.TestCheckResourceAttrPair(resourceName, "bucket", "aws_s3_bucket.test", "id"),
 					resource.TestCheckResourceAttr(resourceName, "cors_rule.#", "2"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "cors_rule.*", map[string]string{
@@ -226,7 +226,7 @@ func TestAccS3BucketCorsConfiguration_MultipleRules(t *testing.T) {
 	})
 }
 
-func TestAccS3BucketCorsConfiguration_migrate_corsRuleNoChange(t *testing.T) {
+func TestAccS3BucketCORSConfiguration_migrate_corsRuleNoChange(t *testing.T) {
 	ctx := acctest.Context(t)
 	bucketName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	bucketResourceName := "aws_s3_bucket.test"
@@ -234,7 +234,7 @@ func TestAccS3BucketCorsConfiguration_migrate_corsRuleNoChange(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -253,7 +253,7 @@ func TestAccS3BucketCorsConfiguration_migrate_corsRuleNoChange(t *testing.T) {
 			{
 				Config: testAccBucketCORSConfigurationConfig_migrateRuleNoChange(bucketName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckBucketCorsConfigurationExists(ctx, resourceName),
+					testAccCheckBucketCORSConfigurationExists(ctx, resourceName),
 					resource.TestCheckResourceAttrPair(resourceName, "bucket", bucketResourceName, "id"),
 					resource.TestCheckResourceAttr(resourceName, "cors_rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "cors_rule.*", map[string]string{
@@ -269,7 +269,7 @@ func TestAccS3BucketCorsConfiguration_migrate_corsRuleNoChange(t *testing.T) {
 	})
 }
 
-func TestAccS3BucketCorsConfiguration_migrate_corsRuleWithChange(t *testing.T) {
+func TestAccS3BucketCORSConfiguration_migrate_corsRuleWithChange(t *testing.T) {
 	ctx := acctest.Context(t)
 	bucketName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	bucketResourceName := "aws_s3_bucket.test"
@@ -277,7 +277,7 @@ func TestAccS3BucketCorsConfiguration_migrate_corsRuleWithChange(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -296,7 +296,7 @@ func TestAccS3BucketCorsConfiguration_migrate_corsRuleWithChange(t *testing.T) {
 			{
 				Config: testAccBucketCORSConfigurationConfig_migrateRuleChange(bucketName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckBucketCorsConfigurationExists(ctx, resourceName),
+					testAccCheckBucketCORSConfigurationExists(ctx, resourceName),
 					resource.TestCheckResourceAttrPair(resourceName, "bucket", bucketResourceName, "id"),
 					resource.TestCheckResourceAttr(resourceName, "cors_rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "cors_rule.*", map[string]string{
@@ -311,9 +311,9 @@ func TestAccS3BucketCorsConfiguration_migrate_corsRuleWithChange(t *testing.T) {
 	})
 }
 
-func testAccCheckBucketCorsConfigurationDestroy(ctx context.Context) resource.TestCheckFunc {
+func testAccCheckBucketCORSConfigurationDestroy(ctx context.Context) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Conn(ctx)
+		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Client(ctx)
 
 		for _, rs := range s.RootModule().Resources {
 			if rs.Type != "aws_s3_bucket_cors_configuration" {
@@ -325,72 +325,40 @@ func testAccCheckBucketCorsConfigurationDestroy(ctx context.Context) resource.Te
 				return err
 			}
 
-			input := &s3.GetBucketCorsInput{
-				Bucket: aws.String(bucket),
-			}
-
-			if expectedBucketOwner != "" {
-				input.ExpectedBucketOwner = aws.String(expectedBucketOwner)
-			}
-
-			output, err := conn.GetBucketCorsWithContext(ctx, input)
+			_, err = tfs3.FindCORSRules(ctx, conn, bucket, expectedBucketOwner)
 
-			if tfawserr.ErrCodeEquals(err, s3.ErrCodeNoSuchBucket, tfs3.ErrCodeNoSuchCORSConfiguration) {
+			if tfresource.NotFound(err) {
 				continue
 			}
 
 			if err != nil {
-				return fmt.Errorf("error getting S3 Bucket CORS configuration (%s): %w", rs.Primary.ID, err)
+				return err
 			}
 
-			if output != nil {
-				return fmt.Errorf("S3 Bucket CORS configuration (%s) still exists", rs.Primary.ID)
-			}
+			return fmt.Errorf("S3 Bucket Website Configuration %s still exists", rs.Primary.ID)
 		}
 
 		return nil
 	}
 }
 
-func testAccCheckBucketCorsConfigurationExists(ctx context.Context, resourceName string) resource.TestCheckFunc {
+func testAccCheckBucketCORSConfigurationExists(ctx context.Context, n string) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		rs, ok := s.RootModule().Resources[resourceName]
+		rs, ok := s.RootModule().Resources[n]
 		if !ok {
-			return fmt.Errorf("Not found: %s", resourceName)
+			return fmt.Errorf("Not found: %s", n)
 		}
 
-		if rs.Primary.ID == "" {
-			return fmt.Errorf("Resource (%s) ID not set", resourceName)
-		}
-
-		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Conn(ctx)
-
 		bucket, expectedBucketOwner, err := tfs3.ParseResourceID(rs.Primary.ID)
 		if err != nil {
 			return err
 		}
 
-		input := &s3.GetBucketCorsInput{
-			Bucket: aws.String(bucket),
-		}
-
-		if expectedBucketOwner != "" {
-			input.ExpectedBucketOwner = aws.String(expectedBucketOwner)
-		}
+		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Client(ctx)
 
-		corsResponse, err := tfresource.RetryWhenAWSErrCodeEquals(ctx, 2*time.Minute, func() (interface{}, error) {
-			return conn.GetBucketCorsWithContext(ctx, input)
-		}, tfs3.ErrCodeNoSuchCORSConfiguration)
+		_, err = tfs3.FindCORSRules(ctx, conn, bucket, expectedBucketOwner)
 
-		if err != nil {
-			return fmt.Errorf("error getting S3 Bucket CORS configuration (%s): %w", rs.Primary.ID, err)
-		}
-
-		if output, ok := corsResponse.(*s3.GetBucketCorsOutput); !ok || output == nil || len(output.CORSRules) == 0 {
-			return fmt.Errorf("S3 Bucket CORS configuration (%s) not found", rs.Primary.ID)
-		}
-
-		return nil
+		return err
 	}
 }
 
diff --git a/internal/service/s3/bucket_data_source.go b/internal/service/s3/bucket_data_source.go
index c17d0d6600a..776e851c94e 100644
--- a/internal/service/s3/bucket_data_source.go
+++ b/internal/service/s3/bucket_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3
 
 import (
@@ -5,15 +8,14 @@ import (
 	"fmt"
 	"log"
 
-	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go-v2/feature/s3/manager"
+	"github.com/aws/aws-sdk-go-v2/service/s3"
 	"github.com/aws/aws-sdk-go/aws/arn"
-	"github.com/aws/aws-sdk-go/aws/request"
-	"github.com/aws/aws-sdk-go/service/s3"
-	"github.com/aws/aws-sdk-go/service/s3/s3manager"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
 // @SDKDataSource("aws_s3_bucket")
@@ -22,14 +24,14 @@ func DataSourceBucket() *schema.Resource {
 		ReadWithoutTimeout: dataSourceBucketRead,
 
 		Schema: map[string]*schema.Schema{
-			"bucket": {
-				Type:     schema.TypeString,
-				Required: true,
-			},
 			"arn": {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
+			"bucket": {
+				Type:     schema.TypeString,
+				Required: true,
+			},
 			"bucket_domain_name": {
 				Type:     schema.TypeString,
 				Computed: true,
@@ -46,11 +48,11 @@ func DataSourceBucket() *schema.Resource {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
-			"website_endpoint": {
+			"website_domain": {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
-			"website_domain": {
+			"website_endpoint": {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
@@ -60,86 +62,62 @@ func DataSourceBucket() *schema.Resource {
 
 func dataSourceBucketRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).S3Conn(ctx)
+	awsClient := meta.(*conns.AWSClient)
+	conn := awsClient.S3Client(ctx)
 
 	bucket := d.Get("bucket").(string)
+	err := findBucket(ctx, conn, bucket)
 
-	input := &s3.HeadBucketInput{
-		Bucket: aws.String(bucket),
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "reading S3 Bucket (%s): %s", bucket, err)
 	}
 
-	log.Printf("[DEBUG] Reading S3 bucket: %s", input)
-	_, err := conn.HeadBucketWithContext(ctx, input)
+	region, err := manager.GetBucketRegion(ctx, conn, bucket,
+		func(o *s3.Options) {
+			// By default, GetBucketRegion forces virtual host addressing, which
+			// is not compatible with many non-AWS implementations. Instead, pass
+			// the provider s3_force_path_style configuration, which defaults to
+			// false, but allows override.
+			o.UsePathStyle = awsClient.S3UsePathStyle()
+		},
+		func(o *s3.Options) {
+			// By default, GetBucketRegion uses anonymous credentials when doing
+			// a HEAD request to get the bucket region. This breaks in aws-cn regions
+			// when the account doesn't have an ICP license to host public content.
+			// Use the current credentials when getting the bucket region.
+			o.Credentials = awsClient.CredentialsProvider()
+		})
 
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "Failed getting S3 bucket (%s): %s", bucket, err)
+		return sdkdiag.AppendErrorf(diags, "reading S3 Bucket (%s) Region: %s", bucket, err)
 	}
 
 	d.SetId(bucket)
 	arn := arn.ARN{
-		Partition: meta.(*conns.AWSClient).Partition,
+		Partition: awsClient.Partition,
 		Service:   "s3",
 		Resource:  bucket,
 	}.String()
 	d.Set("arn", arn)
-	d.Set("bucket_domain_name", meta.(*conns.AWSClient).PartitionHostname(fmt.Sprintf("%s.s3", bucket)))
-
-	err = bucketLocation(ctx, meta.(*conns.AWSClient), d, bucket)
-	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "getting S3 Bucket location: %s", err)
-	}
-
-	regionalDomainName, err := BucketRegionalDomainName(bucket, d.Get("region").(string))
-	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "getting S3 Bucket regional domain name: %s", err)
-	}
-	d.Set("bucket_regional_domain_name", regionalDomainName)
-
-	return diags
-}
-
-func bucketLocation(ctx context.Context, client *conns.AWSClient, d *schema.ResourceData, bucket string) error {
-	region, err := s3manager.GetBucketRegionWithClient(ctx, client.S3Conn(ctx), bucket, func(r *request.Request) {
-		// By default, GetBucketRegion forces virtual host addressing, which
-		// is not compatible with many non-AWS implementations. Instead, pass
-		// the provider s3_force_path_style configuration, which defaults to
-		// false, but allows override.
-		r.Config.S3ForcePathStyle = client.S3Conn(ctx).Config.S3ForcePathStyle
-
-		// By default, GetBucketRegion uses anonymous credentials when doing
-		// a HEAD request to get the bucket region. This breaks in aws-cn regions
-		// when the account doesn't have an ICP license to host public content.
-		// Use the current credentials when getting the bucket region.
-		r.Config.Credentials = client.S3Conn(ctx).Config.Credentials
-	})
-	if err != nil {
-		return err
-	}
-	if err := d.Set("region", region); err != nil {
-		return err
-	}
-
-	hostedZoneID, err := HostedZoneIDForRegion(region)
-	if err != nil {
-		log.Printf("[WARN] %s", err)
+	d.Set("bucket_domain_name", awsClient.PartitionHostname(fmt.Sprintf("%s.s3", bucket)))
+	if regionalDomainName, err := BucketRegionalDomainName(bucket, region); err == nil {
+		d.Set("bucket_regional_domain_name", regionalDomainName)
 	} else {
+		log.Printf("[WARN] BucketRegionalDomainName: %s", err)
+	}
+	if hostedZoneID, err := HostedZoneIDForRegion(region); err == nil {
 		d.Set("hosted_zone_id", hostedZoneID)
+	} else {
+		log.Printf("[WARN] HostedZoneIDForRegion: %s", err)
 	}
-
-	_, websiteErr := client.S3Conn(ctx).GetBucketWebsite(
-		&s3.GetBucketWebsiteInput{
-			Bucket: aws.String(bucket),
-		},
-	)
-
-	if websiteErr == nil {
-		websiteEndpoint := WebsiteEndpoint(client, bucket, region)
-		if err := d.Set("website_endpoint", websiteEndpoint.Endpoint); err != nil {
-			return err
-		}
-		if err := d.Set("website_domain", websiteEndpoint.Domain); err != nil {
-			return err
-		}
+	d.Set("region", region)
+	if _, err := findBucketWebsite(ctx, conn, bucket, ""); err == nil {
+		website := WebsiteEndpoint(awsClient, bucket, region)
+		d.Set("website_domain", website.Domain)
+		d.Set("website_endpoint", website.Endpoint)
+	} else if !tfresource.NotFound(err) {
+		log.Printf("[WARN] Reading S3 Bucket (%s) Website: %s", bucket, err)
 	}
-	return nil
+
+	return diags
 }
diff --git a/internal/service/s3/bucket_data_source_test.go b/internal/service/s3/bucket_data_source_test.go
index 7d17843412d..5f9e29175a6 100644
--- a/internal/service/s3/bucket_data_source_test.go
+++ b/internal/service/s3/bucket_data_source_test.go
@@ -1,14 +1,17 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3_test
 
 import (
 	"fmt"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/service/s3"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
 	tfs3 "github.com/hashicorp/terraform-provider-aws/internal/service/s3"
+	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
 func TestAccS3BucketDataSource_basic(t *testing.T) {
@@ -19,7 +22,7 @@ func TestAccS3BucketDataSource_basic(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		Steps: []resource.TestStep{
 			{
@@ -44,7 +47,7 @@ func TestAccS3BucketDataSource_website(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		Steps: []resource.TestStep{
 			{
diff --git a/internal/service/s3/bucket_intelligent_tiering_configuration.go b/internal/service/s3/bucket_intelligent_tiering_configuration.go
index 7f1b9d19c9b..c31cd93f99e 100644
--- a/internal/service/s3/bucket_intelligent_tiering_configuration.go
+++ b/internal/service/s3/bucket_intelligent_tiering_configuration.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3
 
 import (
@@ -6,14 +9,15 @@ import (
 	"log"
 	"strings"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/s3"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/s3"
+	"github.com/aws/aws-sdk-go-v2/service/s3/types"
+	"github.com/hashicorp/aws-sdk-go-base/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/enum"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
@@ -26,6 +30,7 @@ func ResourceBucketIntelligentTieringConfiguration() *schema.Resource {
 		ReadWithoutTimeout:   resourceBucketIntelligentTieringConfigurationRead,
 		UpdateWithoutTimeout: resourceBucketIntelligentTieringConfigurationPut,
 		DeleteWithoutTimeout: resourceBucketIntelligentTieringConfigurationDelete,
+
 		Importer: &schema.ResourceImporter{
 			StateContext: schema.ImportStatePassthroughContext,
 		},
@@ -62,10 +67,10 @@ func ResourceBucketIntelligentTieringConfiguration() *schema.Resource {
 				ForceNew: true,
 			},
 			"status": {
-				Type:         schema.TypeString,
-				Optional:     true,
-				Default:      s3.IntelligentTieringStatusEnabled,
-				ValidateFunc: validation.StringInSlice(s3.IntelligentTieringStatus_Values(), false),
+				Type:             schema.TypeString,
+				Optional:         true,
+				Default:          types.IntelligentTieringStatusEnabled,
+				ValidateDiagFunc: enum.Validate[types.IntelligentTieringStatus](),
 			},
 			"tiering": {
 				Type:     schema.TypeSet,
@@ -74,9 +79,9 @@ func ResourceBucketIntelligentTieringConfiguration() *schema.Resource {
 				Elem: &schema.Resource{
 					Schema: map[string]*schema.Schema{
 						"access_tier": {
-							Type:         schema.TypeString,
-							Required:     true,
-							ValidateFunc: validation.StringInSlice(s3.IntelligentTieringAccessTier_Values(), false),
+							Type:             schema.TypeString,
+							Required:         true,
+							ValidateDiagFunc: enum.Validate[types.IntelligentTieringAccessTier](),
 						},
 						"days": {
 							Type:     schema.TypeInt,
@@ -91,67 +96,74 @@ func ResourceBucketIntelligentTieringConfiguration() *schema.Resource {
 
 func resourceBucketIntelligentTieringConfigurationPut(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).S3Conn(ctx)
+	conn := meta.(*conns.AWSClient).S3Client(ctx)
 
-	bucketName := d.Get("bucket").(string)
-	configurationName := d.Get("name").(string)
-	resourceID := BucketIntelligentTieringConfigurationCreateResourceID(bucketName, configurationName)
-	apiObject := &s3.IntelligentTieringConfiguration{
-		Id:     aws.String(configurationName),
-		Status: aws.String(d.Get("status").(string)),
+	name := d.Get("name").(string)
+	intelligentTieringConfiguration := &types.IntelligentTieringConfiguration{
+		Id:     aws.String(name),
+		Status: types.IntelligentTieringStatus(d.Get("status").(string)),
 	}
 
 	if v, ok := d.GetOk("filter"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
-		apiObject.Filter = expandIntelligentTieringFilter(ctx, v.([]interface{})[0].(map[string]interface{}))
+		intelligentTieringConfiguration.Filter = expandIntelligentTieringFilter(ctx, v.([]interface{})[0].(map[string]interface{}))
 	}
 
 	if v, ok := d.GetOk("tiering"); ok && v.(*schema.Set).Len() > 0 {
-		apiObject.Tierings = expandTierings(v.(*schema.Set).List())
+		intelligentTieringConfiguration.Tierings = expandTierings(v.(*schema.Set).List())
 	}
 
+	bucket := d.Get("bucket").(string)
 	input := &s3.PutBucketIntelligentTieringConfigurationInput{
-		Bucket:                          aws.String(bucketName),
-		Id:                              aws.String(configurationName),
-		IntelligentTieringConfiguration: apiObject,
+		Bucket:                          aws.String(bucket),
+		Id:                              aws.String(name),
+		IntelligentTieringConfiguration: intelligentTieringConfiguration,
 	}
 
-	log.Printf("[DEBUG] Creating S3 Intelligent-Tiering Configuration: %s", input)
-	_, err := retryWhenBucketNotFound(ctx, func() (interface{}, error) {
-		return conn.PutBucketIntelligentTieringConfigurationWithContext(ctx, input)
-	})
+	_, err := tfresource.RetryWhenAWSErrCodeEquals(ctx, s3BucketPropagationTimeout, func() (interface{}, error) {
+		return conn.PutBucketIntelligentTieringConfiguration(ctx, input)
+	}, errCodeNoSuchBucket)
 
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "creating S3 Intelligent-Tiering Configuration (%s): %s", resourceID, err)
+		return sdkdiag.AppendErrorf(diags, "creating S3 Bucket (%s) Intelligent-Tiering Configuration (%s): %s", bucket, name, err)
 	}
 
-	d.SetId(resourceID)
+	if d.IsNewResource() {
+		d.SetId(BucketIntelligentTieringConfigurationCreateResourceID(bucket, name))
+
+		_, err = tfresource.RetryWhenNotFound(ctx, s3BucketPropagationTimeout, func() (interface{}, error) {
+			return findIntelligentTieringConfiguration(ctx, conn, bucket, name)
+		})
+
+		if err != nil {
+			return sdkdiag.AppendErrorf(diags, "waiting for S3 Bucket Intelligent-Tiering Configuration (%s) create: %s", d.Id(), err)
+		}
+	}
 
 	return append(diags, resourceBucketIntelligentTieringConfigurationRead(ctx, d, meta)...)
 }
 
 func resourceBucketIntelligentTieringConfigurationRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).S3Conn(ctx)
-
-	bucketName, configurationName, err := BucketIntelligentTieringConfigurationParseResourceID(d.Id())
+	conn := meta.(*conns.AWSClient).S3Client(ctx)
 
+	bucket, name, err := BucketIntelligentTieringConfigurationParseResourceID(d.Id())
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "reading S3 Intelligent-Tiering Configuration (%s): %s", d.Id(), err)
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
-	output, err := FindBucketIntelligentTieringConfiguration(ctx, conn, bucketName, configurationName)
+	output, err := findIntelligentTieringConfiguration(ctx, conn, bucket, name)
 
 	if !d.IsNewResource() && tfresource.NotFound(err) {
-		log.Printf("[WARN] S3 Intelligent-Tiering Configuration (%s) not found, removing from state", d.Id())
+		log.Printf("[WARN] S3 Bucket Intelligent-Tiering Configuration (%s) not found, removing from state", d.Id())
 		d.SetId("")
 		return diags
 	}
 
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "reading S3 Intelligent-Tiering Configuration (%s): %s", d.Id(), err)
+		return sdkdiag.AppendErrorf(diags, "reading S3 Bucket Intelligent-Tiering Configuration (%s): %s", d.Id(), err)
 	}
 
-	d.Set("bucket", bucketName)
+	d.Set("bucket", bucket)
 	if output.Filter != nil {
 		if err := d.Set("filter", []interface{}{flattenIntelligentTieringFilter(ctx, output.Filter)}); err != nil {
 			return sdkdiag.AppendErrorf(diags, "setting filter: %s", err)
@@ -170,26 +182,33 @@ func resourceBucketIntelligentTieringConfigurationRead(ctx context.Context, d *s
 
 func resourceBucketIntelligentTieringConfigurationDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).S3Conn(ctx)
-
-	bucketName, configurationName, err := BucketIntelligentTieringConfigurationParseResourceID(d.Id())
+	conn := meta.(*conns.AWSClient).S3Client(ctx)
 
+	bucket, name, err := BucketIntelligentTieringConfigurationParseResourceID(d.Id())
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "deleting S3 Intelligent-Tiering Configuration (%s): %s", d.Id(), err)
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
-	log.Printf("[DEBUG] Deleting S3 Intelligent-Tiering Configuration: (%s)", d.Id())
-	_, err = conn.DeleteBucketIntelligentTieringConfigurationWithContext(ctx, &s3.DeleteBucketIntelligentTieringConfigurationInput{
-		Bucket: aws.String(bucketName),
-		Id:     aws.String(configurationName),
+	log.Printf("[DEBUG] Deleting S3 Bucket Intelligent-Tiering Configuration: %s", d.Id())
+	_, err = conn.DeleteBucketIntelligentTieringConfiguration(ctx, &s3.DeleteBucketIntelligentTieringConfigurationInput{
+		Bucket: aws.String(bucket),
+		Id:     aws.String(name),
 	})
 
-	if tfawserr.ErrCodeEquals(err, s3.ErrCodeNoSuchBucket, errCodeNoSuchConfiguration) {
+	if tfawserr.ErrCodeEquals(err, errCodeNoSuchBucket, errCodeNoSuchConfiguration) {
 		return diags
 	}
 
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "deleting S3 Intelligent-Tiering Configuration (%s): %s", d.Id(), err)
+		return sdkdiag.AppendErrorf(diags, "deleting S3 Bucket Intelligent-Tiering Configuration (%s): %s", d.Id(), err)
+	}
+
+	_, err = tfresource.RetryUntilNotFound(ctx, s3BucketPropagationTimeout, func() (interface{}, error) {
+		return findIntelligentTieringConfiguration(ctx, conn, bucket, name)
+	})
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "waiting for S3 Bucket Intelligent-Tiering Configuration (%s) delete: %s", d.Id(), err)
 	}
 
 	return diags
@@ -214,15 +233,15 @@ func BucketIntelligentTieringConfigurationParseResourceID(id string) (string, st
 	return "", "", fmt.Errorf("unexpected format for ID (%[1]s), expected bucket-name%[2]sconfiguration-name", id, bucketIntelligentTieringConfigurationResourceIDSeparator)
 }
 
-func FindBucketIntelligentTieringConfiguration(ctx context.Context, conn *s3.S3, bucketName, configurationName string) (*s3.IntelligentTieringConfiguration, error) {
+func findIntelligentTieringConfiguration(ctx context.Context, conn *s3.Client, bucket, name string) (*types.IntelligentTieringConfiguration, error) {
 	input := &s3.GetBucketIntelligentTieringConfigurationInput{
-		Bucket: aws.String(bucketName),
-		Id:     aws.String(configurationName),
+		Bucket: aws.String(bucket),
+		Id:     aws.String(name),
 	}
 
-	output, err := conn.GetBucketIntelligentTieringConfigurationWithContext(ctx, input)
+	output, err := conn.GetBucketIntelligentTieringConfiguration(ctx, input)
 
-	if tfawserr.ErrCodeEquals(err, s3.ErrCodeNoSuchBucket, errCodeNoSuchConfiguration) {
+	if tfawserr.ErrCodeEquals(err, errCodeNoSuchBucket, errCodeNoSuchConfiguration) {
 		return nil, &retry.NotFoundError{
 			LastError:   err,
 			LastRequest: input,
@@ -240,7 +259,7 @@ func FindBucketIntelligentTieringConfiguration(ctx context.Context, conn *s3.S3,
 	return output.IntelligentTieringConfiguration, nil
 }
 
-func expandIntelligentTieringFilter(ctx context.Context, tfMap map[string]interface{}) *s3.IntelligentTieringFilter {
+func expandIntelligentTieringFilter(ctx context.Context, tfMap map[string]interface{}) *types.IntelligentTieringFilter {
 	if tfMap == nil {
 		return nil
 	}
@@ -251,22 +270,22 @@ func expandIntelligentTieringFilter(ctx context.Context, tfMap map[string]interf
 		prefix = v
 	}
 
-	var tags []*s3.Tag
+	var tags []types.Tag
 
 	if v, ok := tfMap["tags"].(map[string]interface{}); ok {
-		tags = Tags(tftags.New(ctx, v))
+		tags = tagsV2(tftags.New(ctx, v))
 	}
 
-	apiObject := &s3.IntelligentTieringFilter{}
+	apiObject := &types.IntelligentTieringFilter{}
 
 	if prefix == "" {
 		switch len(tags) {
 		case 0:
 			return nil
 		case 1:
-			apiObject.Tag = tags[0]
+			apiObject.Tag = &tags[0]
 		default:
-			apiObject.And = &s3.IntelligentTieringAndOperator{
+			apiObject.And = &types.IntelligentTieringAndOperator{
 				Tags: tags,
 			}
 		}
@@ -275,7 +294,7 @@ func expandIntelligentTieringFilter(ctx context.Context, tfMap map[string]interf
 		case 0:
 			apiObject.Prefix = aws.String(prefix)
 		default:
-			apiObject.And = &s3.IntelligentTieringAndOperator{
+			apiObject.And = &types.IntelligentTieringAndOperator{
 				Prefix: aws.String(prefix),
 				Tags:   tags,
 			}
@@ -285,30 +304,30 @@ func expandIntelligentTieringFilter(ctx context.Context, tfMap map[string]interf
 	return apiObject
 }
 
-func expandTiering(tfMap map[string]interface{}) *s3.Tiering {
+func expandTiering(tfMap map[string]interface{}) *types.Tiering {
 	if tfMap == nil {
 		return nil
 	}
 
-	apiObject := &s3.Tiering{}
+	apiObject := &types.Tiering{}
 
 	if v, ok := tfMap["access_tier"].(string); ok && v != "" {
-		apiObject.AccessTier = aws.String(v)
+		apiObject.AccessTier = types.IntelligentTieringAccessTier(v)
 	}
 
 	if v, ok := tfMap["days"].(int); ok && v != 0 {
-		apiObject.Days = aws.Int64(int64(v))
+		apiObject.Days = int32(v)
 	}
 
 	return apiObject
 }
 
-func expandTierings(tfList []interface{}) []*s3.Tiering {
+func expandTierings(tfList []interface{}) []types.Tiering {
 	if len(tfList) == 0 {
 		return nil
 	}
 
-	var apiObjects []*s3.Tiering
+	var apiObjects []types.Tiering
 
 	for _, tfMapRaw := range tfList {
 		tfMap, ok := tfMapRaw.(map[string]interface{})
@@ -323,13 +342,13 @@ func expandTierings(tfList []interface{}) []*s3.Tiering {
 			continue
 		}
 
-		apiObjects = append(apiObjects, apiObject)
+		apiObjects = append(apiObjects, *apiObject)
 	}
 
 	return apiObjects
 }
 
-func flattenIntelligentTieringFilter(ctx context.Context, apiObject *s3.IntelligentTieringFilter) map[string]interface{} {
+func flattenIntelligentTieringFilter(ctx context.Context, apiObject *types.IntelligentTieringFilter) map[string]interface{} {
 	if apiObject == nil {
 		return nil
 	}
@@ -338,46 +357,37 @@ func flattenIntelligentTieringFilter(ctx context.Context, apiObject *s3.Intellig
 
 	if apiObject.And == nil {
 		if v := apiObject.Prefix; v != nil {
-			tfMap["prefix"] = aws.StringValue(v)
+			tfMap["prefix"] = aws.ToString(v)
 		}
 
 		if v := apiObject.Tag; v != nil {
-			tfMap["tags"] = KeyValueTags(ctx, []*s3.Tag{v}).Map()
+			tfMap["tags"] = keyValueTagsV2(ctx, []types.Tag{*v}).Map()
 		}
 	} else {
 		apiObject := apiObject.And
 
 		if v := apiObject.Prefix; v != nil {
-			tfMap["prefix"] = aws.StringValue(v)
+			tfMap["prefix"] = aws.ToString(v)
 		}
 
 		if v := apiObject.Tags; v != nil {
-			tfMap["tags"] = KeyValueTags(ctx, v).Map()
+			tfMap["tags"] = keyValueTagsV2(ctx, v).Map()
 		}
 	}
 
 	return tfMap
 }
 
-func flattenTiering(apiObject *s3.Tiering) map[string]interface{} {
-	if apiObject == nil {
-		return nil
-	}
-
-	tfMap := map[string]interface{}{}
-
-	if v := apiObject.AccessTier; v != nil {
-		tfMap["access_tier"] = aws.StringValue(v)
-	}
-
-	if v := apiObject.Days; v != nil {
-		tfMap["days"] = aws.Int64Value(v)
+func flattenTiering(apiObject types.Tiering) map[string]interface{} {
+	tfMap := map[string]interface{}{
+		"access_tier": apiObject.AccessTier,
+		"days":        apiObject.Days,
 	}
 
 	return tfMap
 }
 
-func flattenTierings(apiObjects []*s3.Tiering) []interface{} {
+func flattenTierings(apiObjects []types.Tiering) []interface{} {
 	if len(apiObjects) == 0 {
 		return nil
 	}
@@ -385,10 +395,6 @@ func flattenTierings(apiObjects []*s3.Tiering) []interface{} {
 	var tfList []interface{}
 
 	for _, apiObject := range apiObjects {
-		if apiObject == nil {
-			continue
-		}
-
 		tfList = append(tfList, flattenTiering(apiObject))
 	}
 
diff --git a/internal/service/s3/bucket_intelligent_tiering_configuration_test.go b/internal/service/s3/bucket_intelligent_tiering_configuration_test.go
index 0c505a27305..9cb32d606e4 100644
--- a/internal/service/s3/bucket_intelligent_tiering_configuration_test.go
+++ b/internal/service/s3/bucket_intelligent_tiering_configuration_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3_test
 
 import (
@@ -5,7 +8,7 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/service/s3"
+	"github.com/aws/aws-sdk-go-v2/service/s3/types"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
@@ -13,18 +16,19 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	tfs3 "github.com/hashicorp/terraform-provider-aws/internal/service/s3"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
 func TestAccS3BucketIntelligentTieringConfiguration_basic(t *testing.T) {
 	ctx := acctest.Context(t)
-	var itc s3.IntelligentTieringConfiguration
+	var itc types.IntelligentTieringConfiguration
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_s3_bucket_intelligent_tiering_configuration.test"
 	bucketResourceName := "aws_s3_bucket.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketIntelligentTieringConfigurationDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -52,13 +56,13 @@ func TestAccS3BucketIntelligentTieringConfiguration_basic(t *testing.T) {
 
 func TestAccS3BucketIntelligentTieringConfiguration_disappears(t *testing.T) {
 	ctx := acctest.Context(t)
-	var itc s3.IntelligentTieringConfiguration
+	var itc types.IntelligentTieringConfiguration
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_s3_bucket_intelligent_tiering_configuration.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketIntelligentTieringConfigurationDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -76,14 +80,14 @@ func TestAccS3BucketIntelligentTieringConfiguration_disappears(t *testing.T) {
 
 func TestAccS3BucketIntelligentTieringConfiguration_Filter(t *testing.T) {
 	ctx := acctest.Context(t)
-	var itc s3.IntelligentTieringConfiguration
+	var itc types.IntelligentTieringConfiguration
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_s3_bucket_intelligent_tiering_configuration.test"
 	bucketResourceName := "aws_s3_bucket.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketIntelligentTieringConfigurationDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -191,6 +195,63 @@ func TestAccS3BucketIntelligentTieringConfiguration_Filter(t *testing.T) {
 	})
 }
 
+func testAccCheckBucketIntelligentTieringConfigurationExists(ctx context.Context, n string, v *types.IntelligentTieringConfiguration) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		bucket, name, err := tfs3.BucketIntelligentTieringConfigurationParseResourceID(rs.Primary.ID)
+		if err != nil {
+			return err
+		}
+
+		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Client(ctx)
+
+		output, err := tfs3.FindIntelligentTieringConfiguration(ctx, conn, bucket, name)
+
+		if err != nil {
+			return err
+		}
+
+		*v = *output
+
+		return nil
+	}
+}
+
+func testAccCheckBucketIntelligentTieringConfigurationDestroy(ctx context.Context) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Client(ctx)
+
+		for _, rs := range s.RootModule().Resources {
+			if rs.Type != "aws_s3_bucket_intelligent_tiering_configuration" {
+				continue
+			}
+
+			bucket, name, err := tfs3.BucketIntelligentTieringConfigurationParseResourceID(rs.Primary.ID)
+			if err != nil {
+				return err
+			}
+
+			_, err = tfs3.FindIntelligentTieringConfiguration(ctx, conn, bucket, name)
+
+			if tfresource.NotFound(err) {
+				continue
+			}
+
+			if err != nil {
+				return err
+			}
+
+			return fmt.Errorf("S3 Intelligent-Tiering Configuration %s still exists", rs.Primary.ID)
+		}
+
+		return nil
+	}
+}
+
 func testAccBucketIntelligentTieringConfigurationConfig_basic(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_s3_bucket_intelligent_tiering_configuration" "test" {
@@ -343,66 +404,3 @@ resource "aws_s3_bucket" "test" {
 }
 `, rName)
 }
-
-func testAccCheckBucketIntelligentTieringConfigurationExists(ctx context.Context, n string, v *s3.IntelligentTieringConfiguration) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		rs, ok := s.RootModule().Resources[n]
-		if !ok {
-			return fmt.Errorf("Not found: %s", n)
-		}
-
-		if rs.Primary.ID == "" {
-			return fmt.Errorf("No S3 Intelligent-Tiering Configuration ID is set")
-		}
-
-		bucketName, configurationName, err := tfs3.BucketIntelligentTieringConfigurationParseResourceID(rs.Primary.ID)
-
-		if err != nil {
-			return err
-		}
-
-		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Conn(ctx)
-
-		output, err := tfs3.FindBucketIntelligentTieringConfiguration(ctx, conn, bucketName, configurationName)
-
-		if err != nil {
-			return err
-		}
-
-		*v = *output
-
-		return nil
-	}
-}
-
-func testAccCheckBucketIntelligentTieringConfigurationDestroy(ctx context.Context) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Conn(ctx)
-
-		for _, rs := range s.RootModule().Resources {
-			if rs.Type != "aws_s3_bucket_intelligent_tiering_configuration" {
-				continue
-			}
-
-			bucketName, configurationName, err := tfs3.BucketIntelligentTieringConfigurationParseResourceID(rs.Primary.ID)
-
-			if err != nil {
-				return err
-			}
-
-			_, err = tfs3.FindBucketIntelligentTieringConfiguration(ctx, conn, bucketName, configurationName)
-
-			if tfresource.NotFound(err) {
-				continue
-			}
-
-			if err != nil {
-				return err
-			}
-
-			return fmt.Errorf("S3 Intelligent-Tiering Configuration %s still exists", rs.Primary.ID)
-		}
-
-		return nil
-	}
-}
diff --git a/internal/service/s3/bucket_inventory.go b/internal/service/s3/bucket_inventory.go
index 303b97aa6b1..71dae46a571 100644
--- a/internal/service/s3/bucket_inventory.go
+++ b/internal/service/s3/bucket_inventory.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3
 
 import (
@@ -6,14 +9,16 @@ import (
 	"log"
 	"strings"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/s3"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/s3"
+	"github.com/aws/aws-sdk-go-v2/service/s3/types"
+	"github.com/hashicorp/aws-sdk-go-base/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/enum"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
 	"github.com/hashicorp/terraform-provider-aws/internal/flex"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
@@ -27,6 +32,7 @@ func ResourceBucketInventory() *schema.Resource {
 		ReadWithoutTimeout:   resourceBucketInventoryRead,
 		UpdateWithoutTimeout: resourceBucketInventoryPut,
 		DeleteWithoutTimeout: resourceBucketInventoryDelete,
+
 		Importer: &schema.ResourceImporter{
 			StateContext: schema.ImportStatePassthroughContext,
 		},
@@ -37,30 +43,6 @@ func ResourceBucketInventory() *schema.Resource {
 				Required: true,
 				ForceNew: true,
 			},
-			"name": {
-				Type:         schema.TypeString,
-				Required:     true,
-				ForceNew:     true,
-				ValidateFunc: validation.StringLenBetween(0, 64),
-			},
-			"enabled": {
-				Type:     schema.TypeBool,
-				Default:  true,
-				Optional: true,
-			},
-			"filter": {
-				Type:     schema.TypeList,
-				Optional: true,
-				MaxItems: 1,
-				Elem: &schema.Resource{
-					Schema: map[string]*schema.Schema{
-						"prefix": {
-							Type:     schema.TypeString,
-							Optional: true,
-						},
-					},
-				},
-			},
 			"destination": {
 				Type:     schema.TypeList,
 				Required: true,
@@ -75,28 +57,15 @@ func ResourceBucketInventory() *schema.Resource {
 							MinItems: 1,
 							Elem: &schema.Resource{
 								Schema: map[string]*schema.Schema{
-									"format": {
-										Type:     schema.TypeString,
-										Required: true,
-										ValidateFunc: validation.StringInSlice([]string{
-											s3.InventoryFormatCsv,
-											s3.InventoryFormatOrc,
-											s3.InventoryFormatParquet,
-										}, false),
-									},
-									"bucket_arn": {
-										Type:         schema.TypeString,
-										Required:     true,
-										ValidateFunc: verify.ValidARN,
-									},
 									"account_id": {
 										Type:         schema.TypeString,
 										Optional:     true,
 										ValidateFunc: verify.ValidAccountID,
 									},
-									"prefix": {
-										Type:     schema.TypeString,
-										Optional: true,
+									"bucket_arn": {
+										Type:         schema.TypeString,
+										Required:     true,
+										ValidateFunc: verify.ValidARN,
 									},
 									"encryption": {
 										Type:     schema.TypeList,
@@ -132,47 +101,72 @@ func ResourceBucketInventory() *schema.Resource {
 											},
 										},
 									},
+									"format": {
+										Type:             schema.TypeString,
+										Required:         true,
+										ValidateDiagFunc: enum.Validate[types.InventoryFormat](),
+									},
+									"prefix": {
+										Type:     schema.TypeString,
+										Optional: true,
+									},
 								},
 							},
 						},
 					},
 				},
 			},
-			"schedule": {
+			"enabled": {
+				Type:     schema.TypeBool,
+				Default:  true,
+				Optional: true,
+			},
+			"filter": {
 				Type:     schema.TypeList,
-				Required: true,
+				Optional: true,
 				MaxItems: 1,
-				MinItems: 1,
 				Elem: &schema.Resource{
 					Schema: map[string]*schema.Schema{
-						"frequency": {
+						"prefix": {
 							Type:     schema.TypeString,
-							Required: true,
-							ValidateFunc: validation.StringInSlice([]string{
-								s3.InventoryFrequencyDaily,
-								s3.InventoryFrequencyWeekly,
-							}, false),
+							Optional: true,
 						},
 					},
 				},
 			},
-			// TODO: Is there a sensible default for this?
 			"included_object_versions": {
-				Type:     schema.TypeString,
-				Required: true,
-				ValidateFunc: validation.StringInSlice([]string{
-					s3.InventoryIncludedObjectVersionsCurrent,
-					s3.InventoryIncludedObjectVersionsAll,
-				}, false),
+				Type:             schema.TypeString,
+				Required:         true,
+				ValidateDiagFunc: enum.Validate[types.InventoryIncludedObjectVersions](),
+			},
+			"name": {
+				Type:         schema.TypeString,
+				Required:     true,
+				ForceNew:     true,
+				ValidateFunc: validation.StringLenBetween(0, 64),
 			},
 			"optional_fields": {
 				Type:     schema.TypeSet,
 				Optional: true,
 				Elem: &schema.Schema{
-					Type:         schema.TypeString,
-					ValidateFunc: validation.StringInSlice(s3.InventoryOptionalField_Values(), false),
+					Type:             schema.TypeString,
+					ValidateDiagFunc: enum.Validate[types.InventoryOptionalField](),
+				},
+			},
+			"schedule": {
+				Type:     schema.TypeList,
+				Required: true,
+				MaxItems: 1,
+				MinItems: 1,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"frequency": {
+							Type:             schema.TypeString,
+							Required:         true,
+							ValidateDiagFunc: enum.Validate[types.InventoryFrequency](),
+						},
+					},
 				},
-				Set: schema.HashString,
 			},
 		},
 	}
@@ -180,215 +174,161 @@ func ResourceBucketInventory() *schema.Resource {
 
 func resourceBucketInventoryPut(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).S3Conn(ctx)
-	bucket := d.Get("bucket").(string)
-	name := d.Get("name").(string)
+	conn := meta.(*conns.AWSClient).S3Client(ctx)
 
-	inventoryConfiguration := &s3.InventoryConfiguration{
+	name := d.Get("name").(string)
+	inventoryConfiguration := &types.InventoryConfiguration{
 		Id:        aws.String(name),
-		IsEnabled: aws.Bool(d.Get("enabled").(bool)),
+		IsEnabled: d.Get("enabled").(bool),
 	}
 
-	if v, ok := d.GetOk("included_object_versions"); ok {
-		inventoryConfiguration.IncludedObjectVersions = aws.String(v.(string))
+	if v, ok := d.GetOk("destination"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
+		tfMap := v.([]interface{})[0].(map[string]interface{})["bucket"].([]interface{})[0].(map[string]interface{})
+		inventoryConfiguration.Destination = &types.InventoryDestination{
+			S3BucketDestination: expandInventoryBucketDestination(tfMap),
+		}
 	}
 
-	if v, ok := d.GetOk("optional_fields"); ok {
-		inventoryConfiguration.OptionalFields = flex.ExpandStringSet(v.(*schema.Set))
+	if v, ok := d.GetOk("filter"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
+		inventoryConfiguration.Filter = expandInventoryFilter(v.([]interface{})[0].(map[string]interface{}))
 	}
 
-	if v, ok := d.GetOk("schedule"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
-		scheduleList := v.([]interface{})
-		scheduleMap := scheduleList[0].(map[string]interface{})
-		inventoryConfiguration.Schedule = &s3.InventorySchedule{
-			Frequency: aws.String(scheduleMap["frequency"].(string)),
-		}
+	if v, ok := d.GetOk("included_object_versions"); ok {
+		inventoryConfiguration.IncludedObjectVersions = types.InventoryIncludedObjectVersions(v.(string))
 	}
 
-	if v, ok := d.GetOk("filter"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
-		filterList := v.([]interface{})
-		filterMap := filterList[0].(map[string]interface{})
-		inventoryConfiguration.Filter = expandInventoryFilter(filterMap)
+	if v, ok := d.GetOk("optional_fields"); ok && v.(*schema.Set).Len() > 0 {
+		inventoryConfiguration.OptionalFields = flex.ExpandStringyValueSet[types.InventoryOptionalField](v.(*schema.Set))
 	}
 
-	if v, ok := d.GetOk("destination"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
-		destinationList := v.([]interface{})
-		destinationMap := destinationList[0].(map[string]interface{})
-		bucketList := destinationMap["bucket"].([]interface{})
-		bucketMap := bucketList[0].(map[string]interface{})
-
-		inventoryConfiguration.Destination = &s3.InventoryDestination{
-			S3BucketDestination: expandInventoryBucketDestination(bucketMap),
+	if v, ok := d.GetOk("schedule"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
+		tfMap := v.([]interface{})[0].(map[string]interface{})
+		inventoryConfiguration.Schedule = &types.InventorySchedule{
+			Frequency: types.InventoryFrequency(tfMap["frequency"].(string)),
 		}
 	}
 
+	bucket := d.Get("bucket").(string)
 	input := &s3.PutBucketInventoryConfigurationInput{
 		Bucket:                 aws.String(bucket),
 		Id:                     aws.String(name),
 		InventoryConfiguration: inventoryConfiguration,
 	}
 
-	log.Printf("[DEBUG] Putting S3 bucket inventory configuration: %s", input)
-	err := retry.RetryContext(ctx, propagationTimeout, func() *retry.RetryError {
-		_, err := conn.PutBucketInventoryConfigurationWithContext(ctx, input)
+	_, err := tfresource.RetryWhenAWSErrCodeEquals(ctx, s3BucketPropagationTimeout, func() (interface{}, error) {
+		return conn.PutBucketInventoryConfiguration(ctx, input)
+	}, errCodeNoSuchBucket)
 
-		if tfawserr.ErrCodeEquals(err, s3.ErrCodeNoSuchBucket) {
-			return retry.RetryableError(err)
-		}
-
-		if err != nil {
-			return retry.NonRetryableError(err)
-		}
+	if err != nil {
+		return diag.Errorf("creating S3 Bucket (%s) Inventory: %s", bucket, err)
+	}
 
-		return nil
-	})
+	if d.IsNewResource() {
+		d.SetId(fmt.Sprintf("%s:%s", bucket, name))
 
-	if tfresource.TimedOut(err) {
-		_, err = conn.PutBucketInventoryConfigurationWithContext(ctx, input)
-	}
+		_, err = tfresource.RetryWhenNotFound(ctx, s3BucketPropagationTimeout, func() (interface{}, error) {
+			return findInventoryConfiguration(ctx, conn, bucket, name)
+		})
 
-	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "putting S3 Bucket Inventory Configuration: %s", err)
+		if err != nil {
+			return sdkdiag.AppendErrorf(diags, "waiting for S3 Bucket Inventory (%s) create: %s", d.Id(), err)
+		}
 	}
 
-	d.SetId(fmt.Sprintf("%s:%s", bucket, name))
-
 	return append(diags, resourceBucketInventoryRead(ctx, d, meta)...)
 }
 
-func resourceBucketInventoryDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+func resourceBucketInventoryRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).S3Conn(ctx)
+	conn := meta.(*conns.AWSClient).S3Client(ctx)
 
 	bucket, name, err := BucketInventoryParseID(d.Id())
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "deleting S3 Bucket Inventory Configuration (%s): %s", d.Id(), err)
-	}
-
-	input := &s3.DeleteBucketInventoryConfigurationInput{
-		Bucket: aws.String(bucket),
-		Id:     aws.String(name),
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
-	log.Printf("[DEBUG] Deleting S3 bucket inventory configuration: %s", input)
-	_, err = conn.DeleteBucketInventoryConfigurationWithContext(ctx, input)
+	ic, err := findInventoryConfiguration(ctx, conn, bucket, name)
 
-	if tfawserr.ErrCodeEquals(err, s3.ErrCodeNoSuchBucket) {
-		return diags
+	if !d.IsNewResource() && tfresource.NotFound(err) {
+		log.Printf("[WARN] S3 Bucket Inventory (%s) not found, removing from state", d.Id())
+		d.SetId("")
+		return nil
 	}
 
-	if tfawserr.ErrCodeEquals(err, errCodeNoSuchConfiguration) {
-		return diags
+	if err != nil {
+		return diag.Errorf("reading S3 Bucket Inventory (%s): %s", d.Id(), err)
 	}
 
-	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "deleting S3 Bucket Inventory Configuration (%s): %s", d.Id(), err)
+	d.Set("bucket", bucket)
+	if v := ic.Destination; v != nil {
+		tfMap := map[string]interface{}{
+			"bucket": flattenInventoryBucketDestination(v.S3BucketDestination),
+		}
+		if err := d.Set("destination", []map[string]interface{}{tfMap}); err != nil {
+			return sdkdiag.AppendErrorf(diags, "setting destination: %s", err)
+		}
+	}
+	d.Set("enabled", ic.IsEnabled)
+	if err := d.Set("filter", flattenInventoryFilter(ic.Filter)); err != nil {
+		return sdkdiag.AppendErrorf(diags, "setting filter: %s", err)
+	}
+	d.Set("included_object_versions", ic.IncludedObjectVersions)
+	d.Set("name", name)
+	d.Set("optional_fields", ic.OptionalFields)
+	if err := d.Set("schedule", flattenInventorySchedule(ic.Schedule)); err != nil {
+		return sdkdiag.AppendErrorf(diags, "setting schedule: %s", err)
 	}
 
 	return diags
 }
 
-func resourceBucketInventoryRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+func resourceBucketInventoryDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).S3Conn(ctx)
+	conn := meta.(*conns.AWSClient).S3Client(ctx)
 
 	bucket, name, err := BucketInventoryParseID(d.Id())
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "reading S3 Bucket Inventory Configuration (%s): %s", d.Id(), err)
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
-	d.Set("bucket", bucket)
-	d.Set("name", name)
-
-	input := &s3.GetBucketInventoryConfigurationInput{
+	input := &s3.DeleteBucketInventoryConfigurationInput{
 		Bucket: aws.String(bucket),
 		Id:     aws.String(name),
 	}
 
-	log.Printf("[DEBUG] Reading S3 bucket inventory configuration: %s", input)
-	var output *s3.GetBucketInventoryConfigurationOutput
-	err = retry.RetryContext(ctx, propagationTimeout, func() *retry.RetryError {
-		var err error
-		output, err = conn.GetBucketInventoryConfigurationWithContext(ctx, input)
-
-		if d.IsNewResource() && tfawserr.ErrCodeEquals(err, s3.ErrCodeNoSuchBucket) {
-			return retry.RetryableError(err)
-		}
-
-		if d.IsNewResource() && tfawserr.ErrCodeEquals(err, errCodeNoSuchConfiguration) {
-			return retry.RetryableError(err)
-		}
-
-		if err != nil {
-			return retry.NonRetryableError(err)
-		}
-
-		return nil
-	})
-
-	if tfresource.TimedOut(err) {
-		output, err = conn.GetBucketInventoryConfigurationWithContext(ctx, input)
-	}
-
-	if !d.IsNewResource() && tfawserr.ErrCodeEquals(err, s3.ErrCodeNoSuchBucket) {
-		log.Printf("[WARN] S3 Bucket Inventory Configuration (%s) not found, removing from state", d.Id())
-		d.SetId("")
-		return diags
-	}
+	log.Printf("[DEBUG] Deleting S3 Bucket Inventory: %s", d.Id())
+	_, err = conn.DeleteBucketInventoryConfiguration(ctx, input)
 
-	if !d.IsNewResource() && tfawserr.ErrCodeEquals(err, errCodeNoSuchConfiguration) {
-		log.Printf("[WARN] S3 Bucket Inventory Configuration (%s) not found, removing from state", d.Id())
-		d.SetId("")
+	if tfawserr.ErrCodeEquals(err, errCodeNoSuchBucket, errCodeNoSuchConfiguration) {
 		return diags
 	}
 
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "getting S3 Bucket Inventory Configuration (%s): %s", d.Id(), err)
-	}
-
-	if output == nil || output.InventoryConfiguration == nil {
-		return sdkdiag.AppendErrorf(diags, "getting S3 Bucket Inventory Configuration (%s): empty response", d.Id())
-	}
-
-	d.Set("enabled", output.InventoryConfiguration.IsEnabled)
-	d.Set("included_object_versions", output.InventoryConfiguration.IncludedObjectVersions)
-
-	if err := d.Set("optional_fields", flex.FlattenStringList(output.InventoryConfiguration.OptionalFields)); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting optional_fields: %s", err)
-	}
-
-	if err := d.Set("filter", flattenInventoryFilter(output.InventoryConfiguration.Filter)); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting filter: %s", err)
-	}
-
-	if err := d.Set("schedule", flattenInventorySchedule(output.InventoryConfiguration.Schedule)); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting schedule: %s", err)
+		return sdkdiag.AppendErrorf(diags, "deleting S3 Bucket Inventory (%s): %s", d.Id(), err)
 	}
 
-	if output.InventoryConfiguration.Destination != nil {
-		destination := map[string]interface{}{
-			"bucket": flattenInventoryBucketDestination(output.InventoryConfiguration.Destination.S3BucketDestination),
-		}
+	_, err = tfresource.RetryUntilNotFound(ctx, s3BucketPropagationTimeout, func() (interface{}, error) {
+		return findInventoryConfiguration(ctx, conn, bucket, name)
+	})
 
-		if err := d.Set("destination", []map[string]interface{}{destination}); err != nil {
-			return sdkdiag.AppendErrorf(diags, "setting destination: %s", err)
-		}
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "waiting for S3 Bucket Inventory (%s) delete: %s", d.Id(), err)
 	}
 
 	return diags
 }
 
-func expandInventoryFilter(m map[string]interface{}) *s3.InventoryFilter {
+func expandInventoryFilter(m map[string]interface{}) *types.InventoryFilter {
 	v, ok := m["prefix"]
 	if !ok {
 		return nil
 	}
-	return &s3.InventoryFilter{
+	return &types.InventoryFilter{
 		Prefix: aws.String(v.(string)),
 	}
 }
 
-func flattenInventoryFilter(filter *s3.InventoryFilter) []map[string]interface{} {
+func flattenInventoryFilter(filter *types.InventoryFilter) []map[string]interface{} {
 	if filter == nil {
 		return nil
 	}
@@ -397,7 +337,7 @@ func flattenInventoryFilter(filter *s3.InventoryFilter) []map[string]interface{}
 
 	m := make(map[string]interface{})
 	if filter.Prefix != nil {
-		m["prefix"] = aws.StringValue(filter.Prefix)
+		m["prefix"] = aws.ToString(filter.Prefix)
 	}
 
 	result = append(result, m)
@@ -405,20 +345,19 @@ func flattenInventoryFilter(filter *s3.InventoryFilter) []map[string]interface{}
 	return result
 }
 
-func flattenInventorySchedule(schedule *s3.InventorySchedule) []map[string]interface{} {
+func flattenInventorySchedule(schedule *types.InventorySchedule) []map[string]interface{} {
 	result := make([]map[string]interface{}, 0, 1)
-
-	m := make(map[string]interface{}, 1)
-	m["frequency"] = aws.StringValue(schedule.Frequency)
-
+	m := map[string]interface{}{
+		"frequency": schedule.Frequency,
+	}
 	result = append(result, m)
 
 	return result
 }
 
-func expandInventoryBucketDestination(m map[string]interface{}) *s3.InventoryS3BucketDestination {
-	destination := &s3.InventoryS3BucketDestination{
-		Format: aws.String(m["format"].(string)),
+func expandInventoryBucketDestination(m map[string]interface{}) *types.InventoryS3BucketDestination {
+	destination := &types.InventoryS3BucketDestination{
+		Format: types.InventoryFormat(m["format"].(string)),
 		Bucket: aws.String(m["bucket_arn"].(string)),
 	}
 
@@ -433,7 +372,7 @@ func expandInventoryBucketDestination(m map[string]interface{}) *s3.InventoryS3B
 	if v, ok := m["encryption"].([]interface{}); ok && len(v) > 0 {
 		encryptionMap := v[0].(map[string]interface{})
 
-		encryption := &s3.InventoryEncryption{}
+		encryption := &types.InventoryEncryption{}
 
 		for k, v := range encryptionMap {
 			data := v.([]interface{})
@@ -445,11 +384,11 @@ func expandInventoryBucketDestination(m map[string]interface{}) *s3.InventoryS3B
 			switch k {
 			case "sse_kms":
 				m := data[0].(map[string]interface{})
-				encryption.SSEKMS = &s3.SSEKMS{
+				encryption.SSEKMS = &types.SSEKMS{
 					KeyId: aws.String(m["key_id"].(string)),
 				}
 			case "sse_s3":
-				encryption.SSES3 = &s3.SSES3{}
+				encryption.SSES3 = &types.SSES3{}
 			}
 		}
 
@@ -459,19 +398,19 @@ func expandInventoryBucketDestination(m map[string]interface{}) *s3.InventoryS3B
 	return destination
 }
 
-func flattenInventoryBucketDestination(destination *s3.InventoryS3BucketDestination) []map[string]interface{} {
+func flattenInventoryBucketDestination(destination *types.InventoryS3BucketDestination) []map[string]interface{} {
 	result := make([]map[string]interface{}, 0, 1)
 
 	m := map[string]interface{}{
-		"format":     aws.StringValue(destination.Format),
-		"bucket_arn": aws.StringValue(destination.Bucket),
+		"format":     destination.Format,
+		"bucket_arn": aws.ToString(destination.Bucket),
 	}
 
 	if destination.AccountId != nil {
-		m["account_id"] = aws.StringValue(destination.AccountId)
+		m["account_id"] = aws.ToString(destination.AccountId)
 	}
 	if destination.Prefix != nil {
-		m["prefix"] = aws.StringValue(destination.Prefix)
+		m["prefix"] = aws.ToString(destination.Prefix)
 	}
 
 	if destination.Encryption != nil {
@@ -481,7 +420,7 @@ func flattenInventoryBucketDestination(destination *s3.InventoryS3BucketDestinat
 		} else if destination.Encryption.SSEKMS != nil {
 			encryption["sse_kms"] = []map[string]interface{}{
 				{
-					"key_id": aws.StringValue(destination.Encryption.SSEKMS.KeyId),
+					"key_id": aws.ToString(destination.Encryption.SSEKMS.KeyId),
 				},
 			}
 		}
@@ -502,3 +441,29 @@ func BucketInventoryParseID(id string) (string, string, error) {
 	name := idParts[1]
 	return bucket, name, nil
 }
+
+func findInventoryConfiguration(ctx context.Context, conn *s3.Client, bucket, id string) (*types.InventoryConfiguration, error) {
+	input := &s3.GetBucketInventoryConfigurationInput{
+		Bucket: aws.String(bucket),
+		Id:     aws.String(id),
+	}
+
+	output, err := conn.GetBucketInventoryConfiguration(ctx, input)
+
+	if tfawserr.ErrCodeEquals(err, errCodeNoSuchBucket, errCodeNoSuchConfiguration) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	if output == nil || output.InventoryConfiguration == nil {
+		return nil, tfresource.NewEmptyResultError(input)
+	}
+
+	return output.InventoryConfiguration, nil
+}
diff --git a/internal/service/s3/bucket_inventory_test.go b/internal/service/s3/bucket_inventory_test.go
index 801bc2ef23a..e83e0bbc2ce 100644
--- a/internal/service/s3/bucket_inventory_test.go
+++ b/internal/service/s3/bucket_inventory_test.go
@@ -1,45 +1,43 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3_test
 
 import (
 	"context"
 	"fmt"
-	"log"
-	"regexp"
 	"testing"
-	"time"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/s3"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
+	"github.com/YakDriver/regexache"
+	"github.com/aws/aws-sdk-go-v2/service/s3/types"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	tfs3 "github.com/hashicorp/terraform-provider-aws/internal/service/s3"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
 func TestAccS3BucketInventory_basic(t *testing.T) {
 	ctx := acctest.Context(t)
-	var conf s3.InventoryConfiguration
-	rString := sdkacctest.RandString(8)
+	var conf types.InventoryConfiguration
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_s3_bucket_inventory.test"
-
-	bucketName := fmt.Sprintf("tf-acc-bucket-inventory-%s", rString)
 	inventoryName := t.Name()
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketInventoryDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccBucketInventoryConfig_basic(bucketName, inventoryName),
+				Config: testAccBucketInventoryConfig_basic(rName, inventoryName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckBucketInventoryExistsConfig(ctx, resourceName, &conf),
-					resource.TestCheckResourceAttr(resourceName, "bucket", bucketName),
+					testAccCheckBucketInventoryExists(ctx, resourceName, &conf),
+					resource.TestCheckResourceAttr(resourceName, "bucket", rName),
 					resource.TestCheckResourceAttr(resourceName, "filter.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "filter.0.prefix", "documents/"),
 					resource.TestCheckResourceAttr(resourceName, "name", inventoryName),
@@ -53,7 +51,7 @@ func TestAccS3BucketInventory_basic(t *testing.T) {
 
 					resource.TestCheckResourceAttr(resourceName, "destination.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "destination.0.bucket.#", "1"),
-					acctest.CheckResourceAttrGlobalARNNoAccount(resourceName, "destination.0.bucket.0.bucket_arn", "s3", bucketName),
+					acctest.CheckResourceAttrGlobalARNNoAccount(resourceName, "destination.0.bucket.0.bucket_arn", "s3", rName),
 					acctest.CheckResourceAttrAccountID(resourceName, "destination.0.bucket.0.account_id"),
 					resource.TestCheckResourceAttr(resourceName, "destination.0.bucket.0.format", "ORC"),
 					resource.TestCheckResourceAttr(resourceName, "destination.0.bucket.0.prefix", "inventory"),
@@ -70,23 +68,21 @@ func TestAccS3BucketInventory_basic(t *testing.T) {
 
 func TestAccS3BucketInventory_encryptWithSSES3(t *testing.T) {
 	ctx := acctest.Context(t)
-	var conf s3.InventoryConfiguration
-	rString := sdkacctest.RandString(8)
+	var conf types.InventoryConfiguration
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_s3_bucket_inventory.test"
-
-	bucketName := fmt.Sprintf("tf-acc-bucket-inventory-%s", rString)
 	inventoryName := t.Name()
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketInventoryDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccBucketInventoryConfig_encryptSSE(bucketName, inventoryName),
+				Config: testAccBucketInventoryConfig_encryptSSE(rName, inventoryName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckBucketInventoryExistsConfig(ctx, resourceName, &conf),
+					testAccCheckBucketInventoryExists(ctx, resourceName, &conf),
 					resource.TestCheckResourceAttr(resourceName, "destination.0.bucket.0.encryption.0.sse_s3.#", "1"),
 				),
 			},
@@ -101,25 +97,23 @@ func TestAccS3BucketInventory_encryptWithSSES3(t *testing.T) {
 
 func TestAccS3BucketInventory_encryptWithSSEKMS(t *testing.T) {
 	ctx := acctest.Context(t)
-	var conf s3.InventoryConfiguration
-	rString := sdkacctest.RandString(8)
+	var conf types.InventoryConfiguration
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_s3_bucket_inventory.test"
-
-	bucketName := fmt.Sprintf("tf-acc-bucket-inventory-%s", rString)
 	inventoryName := t.Name()
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketInventoryDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccBucketInventoryConfig_encryptSSEKMS(bucketName, inventoryName),
+				Config: testAccBucketInventoryConfig_encryptSSEKMS(rName, inventoryName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckBucketInventoryExistsConfig(ctx, resourceName, &conf),
+					testAccCheckBucketInventoryExists(ctx, resourceName, &conf),
 					resource.TestCheckResourceAttr(resourceName, "destination.0.bucket.0.encryption.0.sse_kms.#", "1"),
-					resource.TestMatchResourceAttr(resourceName, "destination.0.bucket.0.encryption.0.sse_kms.0.key_id", regexp.MustCompile(fmt.Sprintf("^arn:%s:kms:", acctest.Partition()))),
+					resource.TestMatchResourceAttr(resourceName, "destination.0.bucket.0.encryption.0.sse_kms.0.key_id", regexache.MustCompile(fmt.Sprintf("^arn:%s:kms:", acctest.Partition()))),
 				),
 			},
 			{
@@ -131,34 +125,27 @@ func TestAccS3BucketInventory_encryptWithSSEKMS(t *testing.T) {
 	})
 }
 
-func testAccCheckBucketInventoryExistsConfig(ctx context.Context, n string, res *s3.InventoryConfiguration) resource.TestCheckFunc {
+func testAccCheckBucketInventoryExists(ctx context.Context, n string, v *types.InventoryConfiguration) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		rs, ok := s.RootModule().Resources[n]
 		if !ok {
 			return fmt.Errorf("Not found: %s", n)
 		}
 
-		if rs.Primary.ID == "" {
-			return fmt.Errorf("No S3 bucket inventory configuration ID is set")
-		}
-
-		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Conn(ctx)
 		bucket, name, err := tfs3.BucketInventoryParseID(rs.Primary.ID)
 		if err != nil {
 			return err
 		}
 
-		input := &s3.GetBucketInventoryConfigurationInput{
-			Bucket: aws.String(bucket),
-			Id:     aws.String(name),
-		}
-		log.Printf("[DEBUG] Reading S3 bucket inventory configuration: %s", input)
-		output, err := conn.GetBucketInventoryConfigurationWithContext(ctx, input)
+		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Client(ctx)
+
+		output, err := tfs3.FindInventoryConfiguration(ctx, conn, bucket, name)
+
 		if err != nil {
 			return err
 		}
 
-		*res = *output.InventoryConfiguration
+		*v = *output
 
 		return nil
 	}
@@ -166,7 +153,7 @@ func testAccCheckBucketInventoryExistsConfig(ctx context.Context, n string, res
 
 func testAccCheckBucketInventoryDestroy(ctx context.Context) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Conn(ctx)
+		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Client(ctx)
 
 		for _, rs := range s.RootModule().Resources {
 			if rs.Type != "aws_s3_bucket_inventory" {
@@ -178,42 +165,33 @@ func testAccCheckBucketInventoryDestroy(ctx context.Context) resource.TestCheckF
 				return err
 			}
 
-			err = retry.RetryContext(ctx, 1*time.Minute, func() *retry.RetryError {
-				input := &s3.GetBucketInventoryConfigurationInput{
-					Bucket: aws.String(bucket),
-					Id:     aws.String(name),
-				}
-				log.Printf("[DEBUG] Reading S3 bucket inventory configuration: %s", input)
-				output, err := conn.GetBucketInventoryConfigurationWithContext(ctx, input)
-				if err != nil {
-					if tfawserr.ErrCodeEquals(err, s3.ErrCodeNoSuchBucket) || tfawserr.ErrMessageContains(err, "NoSuchConfiguration", "The specified configuration does not exist.") {
-						return nil
-					}
-					return retry.NonRetryableError(err)
-				}
-				if output.InventoryConfiguration != nil {
-					return retry.RetryableError(fmt.Errorf("S3 bucket inventory configuration exists: %v", output))
-				}
-				return nil
-			})
+			_, err = tfs3.FindInventoryConfiguration(ctx, conn, bucket, name)
+
+			if tfresource.NotFound(err) {
+				continue
+			}
+
 			if err != nil {
 				return err
 			}
+
+			return fmt.Errorf("S3 Bucket Inventory %s still exists", rs.Primary.ID)
 		}
+
 		return nil
 	}
 }
 
-func testAccBucketInventoryBucketConfig(name string) string {
+func testAccBucketInventoryConfig_base(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_s3_bucket" "test" {
   bucket = %[1]q
 }
-`, name)
+`, rName)
 }
 
 func testAccBucketInventoryConfig_basic(bucketName, inventoryName string) string {
-	return testAccBucketInventoryBucketConfig(bucketName) + fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccBucketInventoryConfig_base(bucketName), fmt.Sprintf(`
 data "aws_caller_identity" "current" {}
 
 resource "aws_s3_bucket_inventory" "test" {
@@ -244,11 +222,11 @@ resource "aws_s3_bucket_inventory" "test" {
     }
   }
 }
-`, inventoryName)
+`, inventoryName))
 }
 
 func testAccBucketInventoryConfig_encryptSSE(bucketName, inventoryName string) string {
-	return testAccBucketInventoryBucketConfig(bucketName) + fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccBucketInventoryConfig_base(bucketName), fmt.Sprintf(`
 resource "aws_s3_bucket_inventory" "test" {
   bucket = aws_s3_bucket.test.id
   name   = %[1]q
@@ -270,13 +248,13 @@ resource "aws_s3_bucket_inventory" "test" {
     }
   }
 }
-`, inventoryName)
+`, inventoryName))
 }
 
 func testAccBucketInventoryConfig_encryptSSEKMS(bucketName, inventoryName string) string {
-	return testAccBucketInventoryBucketConfig(bucketName) + fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccBucketInventoryConfig_base(bucketName), fmt.Sprintf(`
 resource "aws_kms_key" "test" {
-  description             = "Terraform acc test S3 inventory SSE-KMS encryption: %[1]s"
+  description             = %[1]q
   deletion_window_in_days = 7
 }
 
@@ -303,5 +281,5 @@ resource "aws_s3_bucket_inventory" "test" {
     }
   }
 }
-`, bucketName, inventoryName)
+`, bucketName, inventoryName))
 }
diff --git a/internal/service/s3/bucket_lifecycle_configuration.go b/internal/service/s3/bucket_lifecycle_configuration.go
index 64d74bb271f..5b04bf0b61d 100644
--- a/internal/service/s3/bucket_lifecycle_configuration.go
+++ b/internal/service/s3/bucket_lifecycle_configuration.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3
 
 import (
@@ -16,9 +19,9 @@ import (
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
-	"github.com/hashicorp/terraform-provider-aws/internal/experimental/nullable"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/internal/types/nullable"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
 )
 
diff --git a/internal/service/s3/bucket_lifecycle_configuration_test.go b/internal/service/s3/bucket_lifecycle_configuration_test.go
index 5bd89ace7d6..bb59479fcf5 100644
--- a/internal/service/s3/bucket_lifecycle_configuration_test.go
+++ b/internal/service/s3/bucket_lifecycle_configuration_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3_test
 
 import (
diff --git a/internal/service/s3/bucket_logging.go b/internal/service/s3/bucket_logging.go
index 5a5521cb60e..09c88b69cc2 100644
--- a/internal/service/s3/bucket_logging.go
+++ b/internal/service/s3/bucket_logging.go
@@ -1,17 +1,23 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3
 
 import (
 	"context"
 	"log"
-	"time"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/s3"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/s3"
+	"github.com/aws/aws-sdk-go-v2/service/s3/types"
+	"github.com/hashicorp/aws-sdk-go-base/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/enum"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
 )
@@ -23,6 +29,7 @@ func ResourceBucketLogging() *schema.Resource {
 		ReadWithoutTimeout:   resourceBucketLoggingRead,
 		UpdateWithoutTimeout: resourceBucketLoggingUpdate,
 		DeleteWithoutTimeout: resourceBucketLoggingDelete,
+
 		Importer: &schema.ResourceImporter{
 			StateContext: schema.ImportStatePassthroughContext,
 		},
@@ -68,9 +75,9 @@ func ResourceBucketLogging() *schema.Resource {
 										Optional: true,
 									},
 									"type": {
-										Type:         schema.TypeString,
-										Required:     true,
-										ValidateFunc: validation.StringInSlice(s3.Type_Values(), false),
+										Type:             schema.TypeString,
+										Required:         true,
+										ValidateDiagFunc: enum.Validate[types.Type](),
 									},
 									"uri": {
 										Type:     schema.TypeString,
@@ -80,9 +87,9 @@ func ResourceBucketLogging() *schema.Resource {
 							},
 						},
 						"permission": {
-							Type:         schema.TypeString,
-							Required:     true,
-							ValidateFunc: validation.StringInSlice(s3.BucketLogsPermission_Values(), false),
+							Type:             schema.TypeString,
+							Required:         true,
+							ValidateDiagFunc: enum.Validate[types.BucketLogsPermission](),
 						},
 					},
 				},
@@ -96,170 +103,178 @@ func ResourceBucketLogging() *schema.Resource {
 }
 
 func resourceBucketLoggingCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).S3Conn(ctx)
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).S3Client(ctx)
 
 	bucket := d.Get("bucket").(string)
 	expectedBucketOwner := d.Get("expected_bucket_owner").(string)
-
-	loggingEnabled := &s3.LoggingEnabled{
-		TargetBucket: aws.String(d.Get("target_bucket").(string)),
-		TargetPrefix: aws.String(d.Get("target_prefix").(string)),
-	}
-
-	if v, ok := d.GetOk("target_grant"); ok && v.(*schema.Set).Len() > 0 {
-		loggingEnabled.TargetGrants = expandBucketLoggingTargetGrants(v.(*schema.Set).List())
-	}
-
 	input := &s3.PutBucketLoggingInput{
 		Bucket: aws.String(bucket),
-		BucketLoggingStatus: &s3.BucketLoggingStatus{
-			LoggingEnabled: loggingEnabled,
+		BucketLoggingStatus: &types.BucketLoggingStatus{
+			LoggingEnabled: &types.LoggingEnabled{
+				TargetBucket: aws.String(d.Get("target_bucket").(string)),
+				TargetPrefix: aws.String(d.Get("target_prefix").(string)),
+			},
 		},
 	}
-
 	if expectedBucketOwner != "" {
 		input.ExpectedBucketOwner = aws.String(expectedBucketOwner)
 	}
 
-	_, err := tfresource.RetryWhenAWSErrCodeEquals(ctx, 2*time.Minute, func() (interface{}, error) {
-		return conn.PutBucketLoggingWithContext(ctx, input)
-	}, s3.ErrCodeNoSuchBucket)
+	if v, ok := d.GetOk("target_grant"); ok && v.(*schema.Set).Len() > 0 {
+		input.BucketLoggingStatus.LoggingEnabled.TargetGrants = expandBucketLoggingTargetGrants(v.(*schema.Set).List())
+	}
+
+	_, err := tfresource.RetryWhenAWSErrCodeEquals(ctx, s3BucketPropagationTimeout, func() (interface{}, error) {
+		return conn.PutBucketLogging(ctx, input)
+	}, errCodeNoSuchBucket)
 
 	if err != nil {
-		return diag.Errorf("putting S3 bucket (%s) logging: %s", bucket, err)
+		return sdkdiag.AppendErrorf(diags, "creating S3 Bucket (%s) Logging: %s", bucket, err)
 	}
 
 	d.SetId(CreateResourceID(bucket, expectedBucketOwner))
 
+	_, err = tfresource.RetryWhenNotFound(ctx, s3BucketPropagationTimeout, func() (interface{}, error) {
+		return findLoggingEnabled(ctx, conn, bucket, expectedBucketOwner)
+	})
+
+	if err != nil {
+		return diag.Errorf("waiting for S3 Bucket Logging (%s) create: %s", d.Id(), err)
+	}
+
 	return resourceBucketLoggingRead(ctx, d, meta)
 }
 
 func resourceBucketLoggingRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).S3Conn(ctx)
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).S3Client(ctx)
 
 	bucket, expectedBucketOwner, err := ParseResourceID(d.Id())
 	if err != nil {
-		return diag.FromErr(err)
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
-	input := &s3.GetBucketLoggingInput{
-		Bucket: aws.String(bucket),
-	}
-
-	if expectedBucketOwner != "" {
-		input.ExpectedBucketOwner = aws.String(expectedBucketOwner)
-	}
+	loggingEnabled, err := findLoggingEnabled(ctx, conn, bucket, expectedBucketOwner)
 
-	resp, err := tfresource.RetryWhenAWSErrCodeEquals(ctx, 2*time.Minute, func() (interface{}, error) {
-		return conn.GetBucketLoggingWithContext(ctx, input)
-	}, s3.ErrCodeNoSuchBucket)
-
-	if !d.IsNewResource() && tfawserr.ErrCodeEquals(err, s3.ErrCodeNoSuchBucket) {
+	if !d.IsNewResource() && tfresource.NotFound(err) {
 		log.Printf("[WARN] S3 Bucket Logging (%s) not found, removing from state", d.Id())
 		d.SetId("")
-		return nil
+		return diags
 	}
 
 	if err != nil {
-		return diag.Errorf("reading S3 Bucket (%s) Logging: %s", d.Id(), err)
-	}
-
-	output, ok := resp.(*s3.GetBucketLoggingOutput)
-
-	if !ok || output.LoggingEnabled == nil {
-		if d.IsNewResource() {
-			return diag.Errorf("reading S3 Bucket (%s) Logging: empty output", d.Id())
-		}
-		log.Printf("[WARN] S3 Bucket Logging (%s) not found, removing from state", d.Id())
-		d.SetId("")
-		return nil
+		return sdkdiag.AppendErrorf(diags, "reading S3 Bucket Logging (%s): %s", d.Id(), err)
 	}
 
-	loggingEnabled := output.LoggingEnabled
-
-	d.Set("bucket", d.Id())
+	d.Set("bucket", bucket)
 	d.Set("expected_bucket_owner", expectedBucketOwner)
 	d.Set("target_bucket", loggingEnabled.TargetBucket)
-	d.Set("target_prefix", loggingEnabled.TargetPrefix)
-
 	if err := d.Set("target_grant", flattenBucketLoggingTargetGrants(loggingEnabled.TargetGrants)); err != nil {
-		return diag.Errorf("setting target_grant: %s", err)
+		return sdkdiag.AppendErrorf(diags, "setting target_grant: %s", err)
 	}
+	d.Set("target_prefix", loggingEnabled.TargetPrefix)
 
-	return nil
+	return diags
 }
 
 func resourceBucketLoggingUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).S3Conn(ctx)
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).S3Client(ctx)
 
 	bucket, expectedBucketOwner, err := ParseResourceID(d.Id())
 	if err != nil {
-		return diag.FromErr(err)
-	}
-
-	loggingEnabled := &s3.LoggingEnabled{
-		TargetBucket: aws.String(d.Get("target_bucket").(string)),
-		TargetPrefix: aws.String(d.Get("target_prefix").(string)),
-	}
-
-	if v, ok := d.GetOk("target_grant"); ok && v.(*schema.Set).Len() > 0 {
-		loggingEnabled.TargetGrants = expandBucketLoggingTargetGrants(v.(*schema.Set).List())
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
 	input := &s3.PutBucketLoggingInput{
 		Bucket: aws.String(bucket),
-		BucketLoggingStatus: &s3.BucketLoggingStatus{
-			LoggingEnabled: loggingEnabled,
+		BucketLoggingStatus: &types.BucketLoggingStatus{
+			LoggingEnabled: &types.LoggingEnabled{
+				TargetBucket: aws.String(d.Get("target_bucket").(string)),
+				TargetPrefix: aws.String(d.Get("target_prefix").(string)),
+			},
 		},
 	}
-
 	if expectedBucketOwner != "" {
 		input.ExpectedBucketOwner = aws.String(expectedBucketOwner)
 	}
 
-	_, err = tfresource.RetryWhenAWSErrCodeEquals(ctx, 2*time.Minute, func() (interface{}, error) {
-		return conn.PutBucketLoggingWithContext(ctx, input)
-	}, s3.ErrCodeNoSuchBucket)
+	if v, ok := d.GetOk("target_grant"); ok && v.(*schema.Set).Len() > 0 {
+		input.BucketLoggingStatus.LoggingEnabled.TargetGrants = expandBucketLoggingTargetGrants(v.(*schema.Set).List())
+	}
+
+	_, err = conn.PutBucketLogging(ctx, input)
 
 	if err != nil {
-		return diag.Errorf("updating S3 bucket (%s) logging: %s", d.Id(), err)
+		return sdkdiag.AppendErrorf(diags, "updating S3 Bucket Logging (%s): %s", d.Id(), err)
 	}
 
 	return resourceBucketLoggingRead(ctx, d, meta)
 }
 
 func resourceBucketLoggingDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).S3Conn(ctx)
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).S3Client(ctx)
 
 	bucket, expectedBucketOwner, err := ParseResourceID(d.Id())
 	if err != nil {
-		return diag.FromErr(err)
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
 	input := &s3.PutBucketLoggingInput{
 		Bucket:              aws.String(bucket),
-		BucketLoggingStatus: &s3.BucketLoggingStatus{},
+		BucketLoggingStatus: &types.BucketLoggingStatus{},
 	}
-
 	if expectedBucketOwner != "" {
 		input.ExpectedBucketOwner = aws.String(expectedBucketOwner)
 	}
 
-	_, err = conn.PutBucketLoggingWithContext(ctx, input)
+	_, err = conn.PutBucketLogging(ctx, input)
 
-	if tfawserr.ErrCodeEquals(err, s3.ErrCodeNoSuchBucket) {
+	if tfawserr.ErrCodeEquals(err, errCodeNoSuchBucket) {
 		return nil
 	}
 
 	if err != nil {
-		return diag.Errorf("deleting S3 Bucket (%s) Logging: %s", d.Id(), err)
+		return sdkdiag.AppendErrorf(diags, "deleting S3 Bucket Logging (%s): %s", d.Id(), err)
 	}
 
+	// Don't wait for the logging to disappear as it still exists after update.
+
 	return nil
 }
 
-func expandBucketLoggingTargetGrants(l []interface{}) []*s3.TargetGrant {
-	var grants []*s3.TargetGrant
+func findLoggingEnabled(ctx context.Context, conn *s3.Client, bucketName, expectedBucketOwner string) (*types.LoggingEnabled, error) {
+	input := &s3.GetBucketLoggingInput{
+		Bucket: aws.String(bucketName),
+	}
+	if expectedBucketOwner != "" {
+		input.ExpectedBucketOwner = aws.String(expectedBucketOwner)
+	}
+
+	output, err := conn.GetBucketLogging(ctx, input)
+
+	if tfawserr.ErrCodeEquals(err, errCodeNoSuchBucket) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	if output == nil || output.LoggingEnabled == nil {
+		return nil, tfresource.NewEmptyResultError(input)
+	}
+
+	return output.LoggingEnabled, nil
+}
+
+func expandBucketLoggingTargetGrants(l []interface{}) []types.TargetGrant {
+	var grants []types.TargetGrant
 
 	for _, tfMapRaw := range l {
 		tfMap, ok := tfMapRaw.(map[string]interface{})
@@ -267,14 +282,14 @@ func expandBucketLoggingTargetGrants(l []interface{}) []*s3.TargetGrant {
 			continue
 		}
 
-		grant := &s3.TargetGrant{}
+		grant := types.TargetGrant{}
 
 		if v, ok := tfMap["grantee"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
 			grant.Grantee = expandBucketLoggingTargetGrantGrantee(v)
 		}
 
 		if v, ok := tfMap["permission"].(string); ok && v != "" {
-			grant.Permission = aws.String(v)
+			grant.Permission = types.BucketLogsPermission(v)
 		}
 
 		grants = append(grants, grant)
@@ -283,7 +298,7 @@ func expandBucketLoggingTargetGrants(l []interface{}) []*s3.TargetGrant {
 	return grants
 }
 
-func expandBucketLoggingTargetGrantGrantee(l []interface{}) *s3.Grantee {
+func expandBucketLoggingTargetGrantGrantee(l []interface{}) *types.Grantee {
 	if len(l) == 0 || l[0] == nil {
 		return nil
 	}
@@ -293,7 +308,7 @@ func expandBucketLoggingTargetGrantGrantee(l []interface{}) *s3.Grantee {
 		return nil
 	}
 
-	grantee := &s3.Grantee{}
+	grantee := &types.Grantee{}
 
 	if v, ok := tfMap["display_name"].(string); ok && v != "" {
 		grantee.DisplayName = aws.String(v)
@@ -308,7 +323,7 @@ func expandBucketLoggingTargetGrantGrantee(l []interface{}) *s3.Grantee {
 	}
 
 	if v, ok := tfMap["type"].(string); ok && v != "" {
-		grantee.Type = aws.String(v)
+		grantee.Type = types.Type(v)
 	}
 
 	if v, ok := tfMap["uri"].(string); ok && v != "" {
@@ -318,55 +333,47 @@ func expandBucketLoggingTargetGrantGrantee(l []interface{}) *s3.Grantee {
 	return grantee
 }
 
-func flattenBucketLoggingTargetGrants(grants []*s3.TargetGrant) []interface{} {
+func flattenBucketLoggingTargetGrants(grants []types.TargetGrant) []interface{} {
 	var results []interface{}
 
 	for _, grant := range grants {
-		if grant == nil {
-			continue
+		m := map[string]interface{}{
+			"permission": grant.Permission,
 		}
 
-		m := make(map[string]interface{})
-
 		if grant.Grantee != nil {
 			m["grantee"] = flattenBucketLoggingTargetGrantGrantee(grant.Grantee)
 		}
 
-		if grant.Permission != nil {
-			m["permission"] = aws.StringValue(grant.Permission)
-		}
-
 		results = append(results, m)
 	}
 
 	return results
 }
 
-func flattenBucketLoggingTargetGrantGrantee(g *s3.Grantee) []interface{} {
+func flattenBucketLoggingTargetGrantGrantee(g *types.Grantee) []interface{} {
 	if g == nil {
 		return []interface{}{}
 	}
 
-	m := make(map[string]interface{})
+	m := map[string]interface{}{
+		"type": g.Type,
+	}
 
 	if g.DisplayName != nil {
-		m["display_name"] = aws.StringValue(g.DisplayName)
+		m["display_name"] = aws.ToString(g.DisplayName)
 	}
 
 	if g.EmailAddress != nil {
-		m["email_address"] = aws.StringValue(g.EmailAddress)
+		m["email_address"] = aws.ToString(g.EmailAddress)
 	}
 
 	if g.ID != nil {
-		m["id"] = aws.StringValue(g.ID)
-	}
-
-	if g.Type != nil {
-		m["type"] = aws.StringValue(g.Type)
+		m["id"] = aws.ToString(g.ID)
 	}
 
 	if g.URI != nil {
-		m["uri"] = aws.StringValue(g.URI)
+		m["uri"] = aws.ToString(g.URI)
 	}
 
 	return []interface{}{m}
diff --git a/internal/service/s3/bucket_logging_test.go b/internal/service/s3/bucket_logging_test.go
index 037587f0fcd..c255f6dd772 100644
--- a/internal/service/s3/bucket_logging_test.go
+++ b/internal/service/s3/bucket_logging_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3_test
 
 import (
@@ -6,15 +9,15 @@ import (
 	"os"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/s3"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/aws/aws-sdk-go-v2/service/s3/types"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	tfs3 "github.com/hashicorp/terraform-provider-aws/internal/service/s3"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
 func TestAccS3BucketLogging_basic(t *testing.T) {
@@ -24,7 +27,7 @@ func TestAccS3BucketLogging_basic(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketLoggingDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -33,6 +36,7 @@ func TestAccS3BucketLogging_basic(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketLoggingExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "bucket", rName),
+					resource.TestCheckResourceAttr(resourceName, "expected_bucket_owner", ""),
 					resource.TestCheckResourceAttrPair(resourceName, "target_bucket", "aws_s3_bucket.log_bucket", "bucket"),
 					resource.TestCheckResourceAttr(resourceName, "target_prefix", "log/"),
 					resource.TestCheckResourceAttr(resourceName, "target_grant.#", "0"),
@@ -54,7 +58,7 @@ func TestAccS3BucketLogging_disappears(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketLoggingDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -73,12 +77,11 @@ func TestAccS3BucketLogging_disappears(t *testing.T) {
 func TestAccS3BucketLogging_update(t *testing.T) {
 	ctx := acctest.Context(t)
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
-	targetBucketName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_s3_bucket_logging.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketLoggingDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -89,8 +92,8 @@ func TestAccS3BucketLogging_update(t *testing.T) {
 				),
 			},
 			{
-				// Test updating "target_prefix"
-				Config: testAccBucketLoggingConfig_update(rName, rName, "tmp/"),
+				// Test updating "target_prefix".
+				Config: testAccBucketLoggingConfig_update(rName, "tmp/"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketLoggingExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "bucket", rName),
@@ -104,22 +107,6 @@ func TestAccS3BucketLogging_update(t *testing.T) {
 				ImportState:       true,
 				ImportStateVerify: true,
 			},
-			{
-				// Test updating "target_bucket" and "target_prefix"
-				Config: testAccBucketLoggingConfig_update(rName, targetBucketName, "log/"),
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckBucketLoggingExists(ctx, resourceName),
-					resource.TestCheckResourceAttr(resourceName, "bucket", rName),
-					resource.TestCheckResourceAttrPair(resourceName, "target_bucket", "aws_s3_bucket.log_bucket", "bucket"),
-					resource.TestCheckResourceAttr(resourceName, "target_prefix", "log/"),
-					resource.TestCheckResourceAttr(resourceName, "target_grant.#", "0"),
-				),
-			},
-			{
-				ResourceName:      resourceName,
-				ImportState:       true,
-				ImportStateVerify: true,
-			},
 		},
 	})
 }
@@ -131,19 +118,19 @@ func TestAccS3BucketLogging_TargetGrantByID(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketLoggingDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccBucketLoggingConfig_targetGrantByID(rName, s3.BucketLogsPermissionFullControl),
+				Config: testAccBucketLoggingConfig_targetGrantByID(rName, string(types.BucketLogsPermissionFullControl)),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketLoggingExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "target_grant.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "target_grant.*", map[string]string{
 						"grantee.#":      "1",
-						"grantee.0.type": s3.TypeCanonicalUser,
-						"permission":     s3.BucketLogsPermissionFullControl,
+						"grantee.0.type": string(types.TypeCanonicalUser),
+						"permission":     string(types.BucketLogsPermissionFullControl),
 					}),
 					resource.TestCheckTypeSetElemAttrPair(resourceName, "target_grant.*.grantee.0.id", "data.aws_canonical_user_id.current", "id"),
 					resource.TestCheckTypeSetElemAttrPair(resourceName, "target_grant.*.grantee.0.display_name", "data.aws_canonical_user_id.current", "display_name"),
@@ -155,14 +142,14 @@ func TestAccS3BucketLogging_TargetGrantByID(t *testing.T) {
 				ImportStateVerify: true,
 			},
 			{
-				Config: testAccBucketLoggingConfig_targetGrantByID(rName, s3.BucketLogsPermissionRead),
+				Config: testAccBucketLoggingConfig_targetGrantByID(rName, string(types.BucketLogsPermissionRead)),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketLoggingExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "target_grant.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "target_grant.*", map[string]string{
 						"grantee.#":      "1",
-						"grantee.0.type": s3.TypeCanonicalUser,
-						"permission":     s3.BucketLogsPermissionRead,
+						"grantee.0.type": string(types.TypeCanonicalUser),
+						"permission":     string(types.BucketLogsPermissionRead),
 					}),
 					resource.TestCheckTypeSetElemAttrPair(resourceName, "target_grant.*.grantee.0.display_name", "data.aws_canonical_user_id.current", "display_name"),
 				),
@@ -196,20 +183,20 @@ func TestAccS3BucketLogging_TargetGrantByEmail(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketLoggingDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccBucketLoggingConfig_targetGrantByEmail(rName, rEmail, s3.BucketLogsPermissionFullControl),
+				Config: testAccBucketLoggingConfig_targetGrantByEmail(rName, rEmail, string(types.BucketLogsPermissionFullControl)),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketLoggingExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "target_grant.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "target_grant.*", map[string]string{
 						"grantee.#":               "1",
 						"grantee.0.email_address": rEmail,
-						"grantee.0.type":          s3.TypeAmazonCustomerByEmail,
-						"permission":              s3.BucketLogsPermissionFullControl,
+						"grantee.0.type":          string(types.TypeAmazonCustomerByEmail),
+						"permission":              string(types.BucketLogsPermissionFullControl),
 					}),
 				),
 			},
@@ -219,15 +206,15 @@ func TestAccS3BucketLogging_TargetGrantByEmail(t *testing.T) {
 				ImportStateVerify: true,
 			},
 			{
-				Config: testAccBucketLoggingConfig_targetGrantByEmail(rName, rEmail, s3.BucketLogsPermissionRead),
+				Config: testAccBucketLoggingConfig_targetGrantByEmail(rName, rEmail, string(types.BucketLogsPermissionRead)),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketLoggingExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "target_grant.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "target_grant.*", map[string]string{
 						"grantee.#":       "1",
 						"grantee.0.email": rEmail,
-						"grantee.0.type":  s3.TypeAmazonCustomerByEmail,
-						"permission":      s3.BucketLogsPermissionRead,
+						"grantee.0.type":  string(types.TypeAmazonCustomerByEmail),
+						"permission":      string(types.BucketLogsPermissionRead),
 					}),
 				),
 			},
@@ -254,19 +241,19 @@ func TestAccS3BucketLogging_TargetGrantByGroup(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketLoggingDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccBucketLoggingConfig_targetGrantByGroup(rName, s3.BucketLogsPermissionFullControl),
+				Config: testAccBucketLoggingConfig_targetGrantByGroup(rName, string(types.BucketLogsPermissionFullControl)),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketLoggingExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "target_grant.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "target_grant.*", map[string]string{
 						"grantee.#":      "1",
-						"grantee.0.type": s3.TypeGroup,
-						"permission":     s3.BucketLogsPermissionFullControl,
+						"grantee.0.type": string(types.TypeGroup),
+						"permission":     string(types.BucketLogsPermissionFullControl),
 					}),
 					testAccCheckBucketLoggingTargetGrantGranteeURI(resourceName),
 				),
@@ -277,14 +264,14 @@ func TestAccS3BucketLogging_TargetGrantByGroup(t *testing.T) {
 				ImportStateVerify: true,
 			},
 			{
-				Config: testAccBucketLoggingConfig_targetGrantByGroup(rName, s3.BucketLogsPermissionRead),
+				Config: testAccBucketLoggingConfig_targetGrantByGroup(rName, string(types.BucketLogsPermissionRead)),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketLoggingExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "target_grant.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "target_grant.*", map[string]string{
 						"grantee.#":      "1",
-						"grantee.0.type": s3.TypeGroup,
-						"permission":     s3.BucketLogsPermissionRead,
+						"grantee.0.type": string(types.TypeGroup),
+						"permission":     string(types.BucketLogsPermissionRead),
 					}),
 					testAccCheckBucketLoggingTargetGrantGranteeURI(resourceName),
 				),
@@ -313,7 +300,7 @@ func TestAccS3BucketLogging_migrate_loggingNoChange(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -346,7 +333,7 @@ func TestAccS3BucketLogging_migrate_loggingWithChange(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -371,9 +358,40 @@ func TestAccS3BucketLogging_migrate_loggingWithChange(t *testing.T) {
 	})
 }
 
+func TestAccS3BucketLogging_withExpectedBucketOwner(t *testing.T) {
+	ctx := acctest.Context(t)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_s3_bucket_logging.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckBucketLoggingDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccBucketLoggingConfig_withExpectedBucketOwner(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckBucketLoggingExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "bucket", rName),
+					acctest.CheckResourceAttrAccountID(resourceName, "expected_bucket_owner"),
+					resource.TestCheckResourceAttrPair(resourceName, "target_bucket", "aws_s3_bucket.log_bucket", "bucket"),
+					resource.TestCheckResourceAttr(resourceName, "target_prefix", "log/"),
+					resource.TestCheckResourceAttr(resourceName, "target_grant.#", "0"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
 func testAccCheckBucketLoggingDestroy(ctx context.Context) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Conn(ctx)
+		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Client(ctx)
 
 		for _, rs := range s.RootModule().Resources {
 			if rs.Type != "aws_s3_bucket_logging" {
@@ -385,70 +403,40 @@ func testAccCheckBucketLoggingDestroy(ctx context.Context) resource.TestCheckFun
 				return err
 			}
 
-			input := &s3.GetBucketLoggingInput{
-				Bucket: aws.String(bucket),
-			}
-
-			if expectedBucketOwner != "" {
-				input.ExpectedBucketOwner = aws.String(expectedBucketOwner)
-			}
-
-			output, err := conn.GetBucketLoggingWithContext(ctx, input)
+			_, err = tfs3.FindLoggingEnabled(ctx, conn, bucket, expectedBucketOwner)
 
-			if tfawserr.ErrCodeEquals(err, s3.ErrCodeNoSuchBucket) {
+			if tfresource.NotFound(err) {
 				continue
 			}
 
 			if err != nil {
-				return fmt.Errorf("error getting S3 Bucket Logging (%s): %w", rs.Primary.ID, err)
+				return err
 			}
 
-			if output != nil && output.LoggingEnabled != nil {
-				return fmt.Errorf("S3 Bucket Logging (%s) still exists", rs.Primary.ID)
-			}
+			return fmt.Errorf("S3 Bucket Logging %s still exists", rs.Primary.ID)
 		}
 
 		return nil
 	}
 }
 
-func testAccCheckBucketLoggingExists(ctx context.Context, resourceName string) resource.TestCheckFunc {
+func testAccCheckBucketLoggingExists(ctx context.Context, n string) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		rs, ok := s.RootModule().Resources[resourceName]
+		rs, ok := s.RootModule().Resources[n]
 		if !ok {
-			return fmt.Errorf("Not found: %s", resourceName)
-		}
-
-		if rs.Primary.ID == "" {
-			return fmt.Errorf("Resource (%s) ID not set", resourceName)
+			return fmt.Errorf("Not found: %s", n)
 		}
 
-		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Conn(ctx)
-
 		bucket, expectedBucketOwner, err := tfs3.ParseResourceID(rs.Primary.ID)
 		if err != nil {
 			return err
 		}
 
-		input := &s3.GetBucketLoggingInput{
-			Bucket: aws.String(bucket),
-		}
-
-		if expectedBucketOwner != "" {
-			input.ExpectedBucketOwner = aws.String(expectedBucketOwner)
-		}
+		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Client(ctx)
 
-		output, err := conn.GetBucketLoggingWithContext(ctx, input)
-
-		if err != nil {
-			return fmt.Errorf("error getting S3 Bucket Logging (%s): %w", rs.Primary.ID, err)
-		}
+		_, err = tfs3.FindLoggingEnabled(ctx, conn, bucket, expectedBucketOwner)
 
-		if output == nil || output.LoggingEnabled == nil {
-			return fmt.Errorf("S3 Bucket Logging (%s) not found", rs.Primary.ID)
-		}
-
-		return nil
+		return err
 	}
 }
 
@@ -461,7 +449,7 @@ func testAccCheckBucketLoggingTargetGrantGranteeURI(resourceName string) resourc
 	}
 }
 
-func testAccBucketLoggingConfig_basic(rName string) string {
+func testAccBucketLoggingConfig_base(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_s3_bucket" "log_bucket" {
   bucket = "%[1]s-log"
@@ -483,83 +471,38 @@ resource "aws_s3_bucket_acl" "log_bucket_acl" {
 
 resource "aws_s3_bucket" "test" {
   bucket = %[1]q
+
+  depends_on = [aws_s3_bucket_acl.log_bucket_acl]
+}
+`, rName)
 }
 
+func testAccBucketLoggingConfig_basic(rName string) string {
+	return acctest.ConfigCompose(testAccBucketLoggingConfig_base(rName), `
 resource "aws_s3_bucket_logging" "test" {
   bucket = aws_s3_bucket.test.id
 
   target_bucket = aws_s3_bucket.log_bucket.id
   target_prefix = "log/"
 }
-`, rName)
-}
-
-func testAccBucketLoggingConfig_update(rName, targetBucketName, targetPrefix string) string {
-	return fmt.Sprintf(`
-resource "aws_s3_bucket" "test" {
-  bucket = %[1]q
-}
-
-resource "aws_s3_bucket" "log_bucket" {
-  bucket = "%[2]s-log"
-}
-
-resource "aws_s3_bucket_ownership_controls" "log_bucket_ownership" {
-  bucket = aws_s3_bucket.log_bucket.id
-  rule {
-    object_ownership = "BucketOwnerPreferred"
-  }
-}
-
-resource "aws_s3_bucket_acl" "log_bucket_acl" {
-  depends_on = [aws_s3_bucket_ownership_controls.log_bucket_ownership]
-
-  bucket = aws_s3_bucket.log_bucket.id
-  acl    = "log-delivery-write"
+`)
 }
 
+func testAccBucketLoggingConfig_update(rName, targetPrefix string) string {
+	return acctest.ConfigCompose(testAccBucketLoggingConfig_base(rName), fmt.Sprintf(`
 resource "aws_s3_bucket_logging" "test" {
   bucket = aws_s3_bucket.test.id
 
   target_bucket = aws_s3_bucket.log_bucket.id
-  target_prefix = %[3]q
+  target_prefix = %[1]q
 }
-`, rName, targetBucketName, targetPrefix)
+`, targetPrefix))
 }
 
 func testAccBucketLoggingConfig_targetGrantByID(rName, permission string) string {
-	return fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccBucketLoggingConfig_base(rName), fmt.Sprintf(`
 data "aws_canonical_user_id" "current" {}
 
-resource "aws_s3_bucket" "log_bucket" {
-  bucket = "%[1]s-log"
-}
-
-resource "aws_s3_bucket_ownership_controls" "log_bucket_ownership" {
-  bucket = aws_s3_bucket.log_bucket.id
-  rule {
-    object_ownership = "BucketOwnerPreferred"
-  }
-}
-
-resource "aws_s3_bucket_acl" "log_bucket_acl" {
-  depends_on = [aws_s3_bucket_ownership_controls.log_bucket_ownership]
-
-  bucket = aws_s3_bucket.log_bucket.id
-  acl    = "log-delivery-write"
-}
-
-resource "aws_s3_bucket" "test" {
-  bucket = %[1]q
-}
-
-resource "aws_s3_bucket_ownership_controls" "test" {
-  bucket = aws_s3_bucket.test.id
-  rule {
-    object_ownership = "ObjectWriter"
-  }
-}
-
 resource "aws_s3_bucket_logging" "test" {
   bucket = aws_s3_bucket.test.id
 
@@ -571,43 +514,14 @@ resource "aws_s3_bucket_logging" "test" {
       id   = data.aws_canonical_user_id.current.id
       type = "CanonicalUser"
     }
-    permission = %[2]q
+    permission = %[1]q
   }
 }
-`, rName, permission)
+`, permission))
 }
 
 func testAccBucketLoggingConfig_targetGrantByEmail(rName, email, permission string) string {
-	return fmt.Sprintf(`
-resource "aws_s3_bucket" "log_bucket" {
-  bucket = "%[1]s-log"
-}
-
-resource "aws_s3_bucket_ownership_controls" "log_bucket_ownership" {
-  bucket = aws_s3_bucket.log_bucket.id
-  rule {
-    object_ownership = "BucketOwnerPreferred"
-  }
-}
-
-resource "aws_s3_bucket_acl" "log_bucket_acl" {
-  depends_on = [aws_s3_bucket_ownership_controls.log_bucket_ownership]
-
-  bucket = aws_s3_bucket.log_bucket.id
-  acl    = "log-delivery-write"
-}
-
-resource "aws_s3_bucket" "test" {
-  bucket = %[1]q
-}
-
-resource "aws_s3_bucket_ownership_controls" "test" {
-  bucket = aws_s3_bucket.test.id
-  rule {
-    object_ownership = "BucketOwnerPreferred"
-  }
-}
-
+	return acctest.ConfigCompose(testAccBucketLoggingConfig_base(rName), fmt.Sprintf(`
 resource "aws_s3_bucket_logging" "test" {
   bucket = aws_s3_bucket.test.id
 
@@ -616,48 +530,19 @@ resource "aws_s3_bucket_logging" "test" {
 
   target_grant {
     grantee {
-      email_address = %[2]q
+      email_address = %[1]q
       type          = "AmazonCustomerByEmail"
     }
-    permission = %[3]q
+    permission = %[2]q
   }
 }
-`, rName, email, permission)
+`, email, permission))
 }
 
 func testAccBucketLoggingConfig_targetGrantByGroup(rName, permission string) string {
-	return fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccBucketLoggingConfig_base(rName), fmt.Sprintf(`
 data "aws_partition" "current" {}
 
-resource "aws_s3_bucket" "log_bucket" {
-  bucket = "%[1]s-log"
-}
-
-resource "aws_s3_bucket_ownership_controls" "log_bucket_ownership" {
-  bucket = aws_s3_bucket.log_bucket.id
-  rule {
-    object_ownership = "ObjectWriter"
-  }
-}
-
-resource "aws_s3_bucket_acl" "log_bucket_acl" {
-  depends_on = [aws_s3_bucket_ownership_controls.log_bucket_ownership]
-
-  bucket = aws_s3_bucket.log_bucket.id
-  acl    = "log-delivery-write"
-}
-
-resource "aws_s3_bucket" "test" {
-  bucket = %[1]q
-}
-
-resource "aws_s3_bucket_ownership_controls" "test" {
-  bucket = aws_s3_bucket.test.id
-  rule {
-    object_ownership = "ObjectWriter"
-  }
-}
-
 resource "aws_s3_bucket_logging" "test" {
   bucket = aws_s3_bucket.test.id
 
@@ -670,41 +555,34 @@ resource "aws_s3_bucket_logging" "test" {
       # Test with S3 log delivery group
       uri = "http://acs.${data.aws_partition.current.dns_suffix}/groups/s3/LogDelivery"
     }
-    permission = %[2]q
+    permission = %[1]q
   }
 }
-`, rName, permission)
+`, permission))
 }
 
 func testAccBucketLoggingConfig_migrate(rName, targetPrefix string) string {
-	return fmt.Sprintf(`
-resource "aws_s3_bucket" "log_bucket" {
-  bucket = "%[1]s-log"
-}
+	return acctest.ConfigCompose(testAccBucketLoggingConfig_base(rName), fmt.Sprintf(`
+resource "aws_s3_bucket_logging" "test" {
+  bucket = aws_s3_bucket.test.id
 
-resource "aws_s3_bucket_ownership_controls" "log_bucket_ownership" {
-  bucket = aws_s3_bucket.log_bucket.id
-  rule {
-    object_ownership = "BucketOwnerPreferred"
-  }
+  target_bucket = aws_s3_bucket.log_bucket.id
+  target_prefix = %[1]q
 }
-
-resource "aws_s3_bucket_acl" "log_bucket_acl" {
-  depends_on = [aws_s3_bucket_ownership_controls.log_bucket_ownership]
-
-  bucket = aws_s3_bucket.log_bucket.id
-  acl    = "log-delivery-write"
+`, targetPrefix))
 }
 
-resource "aws_s3_bucket" "test" {
-  bucket = %[1]q
-}
+func testAccBucketLoggingConfig_withExpectedBucketOwner(rName string) string {
+	return acctest.ConfigCompose(testAccBucketLoggingConfig_base(rName), `
+data "aws_caller_identity" "current" {}
 
 resource "aws_s3_bucket_logging" "test" {
   bucket = aws_s3_bucket.test.id
 
+  expected_bucket_owner = data.aws_caller_identity.current.account_id
+
   target_bucket = aws_s3_bucket.log_bucket.id
-  target_prefix = %[2]q
+  target_prefix = "log/"
 }
-`, rName, targetPrefix)
+`)
 }
diff --git a/internal/service/s3/bucket_metric.go b/internal/service/s3/bucket_metric.go
index 3cdc71f7a32..4af96a792ff 100644
--- a/internal/service/s3/bucket_metric.go
+++ b/internal/service/s3/bucket_metric.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3
 
 import (
@@ -6,9 +9,10 @@ import (
 	"log"
 	"strings"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/s3"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/s3"
+	"github.com/aws/aws-sdk-go-v2/service/s3/types"
+	"github.com/hashicorp/aws-sdk-go-base/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
@@ -26,6 +30,7 @@ func ResourceBucketMetric() *schema.Resource {
 		ReadWithoutTimeout:   resourceBucketMetricRead,
 		UpdateWithoutTimeout: resourceBucketMetricPut,
 		DeleteWithoutTimeout: resourceBucketMetricDelete,
+
 		Importer: &schema.ResourceImporter{
 			StateContext: schema.ImportStatePassthroughContext,
 		},
@@ -45,13 +50,13 @@ func ResourceBucketMetric() *schema.Resource {
 						"prefix": {
 							Type:         schema.TypeString,
 							Optional:     true,
-							AtLeastOneOf: filterAtLeastOneOfKeys,
+							AtLeastOneOf: []string{"filter.0.prefix", "filter.0.tags"},
 						},
 						"tags": {
 							Type:         schema.TypeMap,
 							Optional:     true,
 							Elem:         &schema.Schema{Type: schema.TypeString},
-							AtLeastOneOf: filterAtLeastOneOfKeys,
+							AtLeastOneOf: []string{"filter.0.prefix", "filter.0.tags"},
 						},
 					},
 				},
@@ -68,182 +73,173 @@ func ResourceBucketMetric() *schema.Resource {
 
 func resourceBucketMetricPut(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).S3Conn(ctx)
-	bucket := d.Get("bucket").(string)
-	name := d.Get("name").(string)
+	conn := meta.(*conns.AWSClient).S3Client(ctx)
 
-	metricsConfiguration := &s3.MetricsConfiguration{
+	name := d.Get("name").(string)
+	metricsConfiguration := &types.MetricsConfiguration{
 		Id: aws.String(name),
 	}
 
 	if v, ok := d.GetOk("filter"); ok {
-		filterList := v.([]interface{})
-		if filterMap, ok := filterList[0].(map[string]interface{}); ok {
-			metricsConfiguration.Filter = ExpandMetricsFilter(ctx, filterMap)
+		if tfMap, ok := v.([]interface{})[0].(map[string]interface{}); ok {
+			metricsConfiguration.Filter = expandMetricsFilter(ctx, tfMap)
 		}
 	}
 
+	bucket := d.Get("bucket").(string)
 	input := &s3.PutBucketMetricsConfigurationInput{
 		Bucket:               aws.String(bucket),
 		Id:                   aws.String(name),
 		MetricsConfiguration: metricsConfiguration,
 	}
 
-	log.Printf("[DEBUG] Putting S3 Bucket Metrics Configuration: %s", input)
-	err := retry.RetryContext(ctx, propagationTimeout, func() *retry.RetryError {
-		_, err := conn.PutBucketMetricsConfigurationWithContext(ctx, input)
-
-		if tfawserr.ErrCodeEquals(err, s3.ErrCodeNoSuchBucket) {
-			return retry.RetryableError(err)
-		}
+	_, err := tfresource.RetryWhenAWSErrCodeEquals(ctx, s3BucketPropagationTimeout, func() (interface{}, error) {
+		return conn.PutBucketMetricsConfiguration(ctx, input)
+	}, errCodeNoSuchBucket)
 
-		if err != nil {
-			return retry.NonRetryableError(err)
-		}
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "creating S3 Bucket (%s) Metric: %s", bucket, err)
+	}
 
-		return nil
-	})
+	if d.IsNewResource() {
+		d.SetId(fmt.Sprintf("%s:%s", bucket, name))
 
-	if tfresource.TimedOut(err) {
-		_, err = conn.PutBucketMetricsConfigurationWithContext(ctx, input)
-	}
+		_, err = tfresource.RetryWhenNotFound(ctx, s3BucketPropagationTimeout, func() (interface{}, error) {
+			return findMetricsConfiguration(ctx, conn, bucket, name)
+		})
 
-	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "putting S3 Bucket Metrics Configuration: %s", err)
+		if err != nil {
+			return sdkdiag.AppendErrorf(diags, "waiting for S3 Bucket Metric (%s) create: %s", d.Id(), err)
+		}
 	}
 
-	d.SetId(fmt.Sprintf("%s:%s", bucket, name))
-
 	return append(diags, resourceBucketMetricRead(ctx, d, meta)...)
 }
 
-func resourceBucketMetricDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+func resourceBucketMetricRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).S3Conn(ctx)
+	conn := meta.(*conns.AWSClient).S3Client(ctx)
 
 	bucket, name, err := BucketMetricParseID(d.Id())
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "deleting S3 Bucket Metrics Configuration (%s): %s", d.Id(), err)
-	}
-
-	input := &s3.DeleteBucketMetricsConfigurationInput{
-		Bucket: aws.String(bucket),
-		Id:     aws.String(name),
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
-	log.Printf("[DEBUG] Deleting S3 Bucket Metrics Configuration: %s", input)
-	_, err = conn.DeleteBucketMetricsConfigurationWithContext(ctx, input)
+	mc, err := findMetricsConfiguration(ctx, conn, bucket, name)
 
-	if tfawserr.ErrCodeEquals(err, s3.ErrCodeNoSuchBucket) {
-		return diags
+	if !d.IsNewResource() && tfresource.NotFound(err) {
+		log.Printf("[WARN] S3 Bucket Metric (%s) not found, removing from state", d.Id())
+		d.SetId("")
+		return nil
 	}
 
-	if tfawserr.ErrCodeEquals(err, errCodeNoSuchConfiguration) {
-		return diags
+	if err != nil {
+		return diag.Errorf("reading S3 Bucket Metric (%s): %s", d.Id(), err)
 	}
 
-	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "deleting S3 Bucket Metrics Configuration (%s): %s", d.Id(), err)
+	d.Set("bucket", bucket)
+	if mc.Filter != nil {
+		if err := d.Set("filter", []interface{}{flattenMetricsFilter(ctx, mc.Filter)}); err != nil {
+			return sdkdiag.AppendErrorf(diags, "setting filter")
+		}
 	}
+	d.Set("name", name)
 
 	return diags
 }
 
-func resourceBucketMetricRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+func resourceBucketMetricDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).S3Conn(ctx)
+	conn := meta.(*conns.AWSClient).S3Client(ctx)
 
 	bucket, name, err := BucketMetricParseID(d.Id())
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "reading S3 Bucket Metrics Configuration (%s): %s", d.Id(), err)
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
-	d.Set("bucket", bucket)
-	d.Set("name", name)
-
-	input := &s3.GetBucketMetricsConfigurationInput{
+	log.Printf("[DEBUG] Deleting S3 Bucket Metric: %s", d.Id())
+	_, err = conn.DeleteBucketMetricsConfiguration(ctx, &s3.DeleteBucketMetricsConfigurationInput{
 		Bucket: aws.String(bucket),
 		Id:     aws.String(name),
-	}
-
-	log.Printf("[DEBUG] Reading S3 Bucket Metrics Configuration: %s", input)
-	output, err := conn.GetBucketMetricsConfigurationWithContext(ctx, input)
-
-	if !d.IsNewResource() && tfawserr.ErrCodeEquals(err, s3.ErrCodeNoSuchBucket) {
-		log.Printf("[WARN] S3 Bucket Metrics Configuration (%s) not found, removing from state", d.Id())
-		d.SetId("")
-		return diags
-	}
+	})
 
-	if !d.IsNewResource() && tfawserr.ErrCodeEquals(err, errCodeNoSuchConfiguration) {
-		log.Printf("[WARN] S3 Bucket Metrics Configuration (%s) not found, removing from state", d.Id())
-		d.SetId("")
+	if tfawserr.ErrCodeEquals(err, errCodeNoSuchBucket, errCodeNoSuchConfiguration) {
 		return diags
 	}
 
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "reading S3 Bucket Metrics Configuration (%s): %s", d.Id(), err)
+		return sdkdiag.AppendErrorf(diags, "deleting S3 Bucket Metric (%s): %s", d.Id(), err)
 	}
 
-	if output == nil || output.MetricsConfiguration == nil {
-		return sdkdiag.AppendErrorf(diags, "reading S3 Bucket Metrics Configuration (%s): empty response", d.Id())
-	}
+	_, err = tfresource.RetryUntilNotFound(ctx, s3BucketPropagationTimeout, func() (interface{}, error) {
+		return findMetricsConfiguration(ctx, conn, bucket, name)
+	})
 
-	if output.MetricsConfiguration.Filter != nil {
-		if err := d.Set("filter", []interface{}{FlattenMetricsFilter(ctx, output.MetricsConfiguration.Filter)}); err != nil {
-			return sdkdiag.AppendErrorf(diags, "setting filter")
-		}
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "waiting for S3 Bucket Metric (%s) delete: %s", d.Id(), err)
 	}
 
 	return diags
 }
 
-func ExpandMetricsFilter(ctx context.Context, m map[string]interface{}) *s3.MetricsFilter {
+func expandMetricsFilter(ctx context.Context, m map[string]interface{}) types.MetricsFilter {
 	var prefix string
 	if v, ok := m["prefix"]; ok {
 		prefix = v.(string)
 	}
 
-	var tags []*s3.Tag
+	var tags []types.Tag
 	if v, ok := m["tags"]; ok {
-		tags = Tags(tftags.New(ctx, v).IgnoreAWS())
+		tags = tagsV2(tftags.New(ctx, v).IgnoreAWS())
 	}
 
-	metricsFilter := &s3.MetricsFilter{}
+	var metricsFilter types.MetricsFilter
+
 	if prefix != "" && len(tags) > 0 {
-		metricsFilter.And = &s3.MetricsAndOperator{
-			Prefix: aws.String(prefix),
-			Tags:   tags,
+		metricsFilter = &types.MetricsFilterMemberAnd{
+			Value: types.MetricsAndOperator{
+				Prefix: aws.String(prefix),
+				Tags:   tags,
+			},
 		}
 	} else if len(tags) > 1 {
-		metricsFilter.And = &s3.MetricsAndOperator{
-			Tags: tags,
+		metricsFilter = &types.MetricsFilterMemberAnd{
+			Value: types.MetricsAndOperator{
+				Tags: tags,
+			},
 		}
 	} else if len(tags) == 1 {
-		metricsFilter.Tag = tags[0]
+		metricsFilter = &types.MetricsFilterMemberTag{
+			Value: tags[0],
+		}
 	} else {
-		metricsFilter.Prefix = aws.String(prefix)
+		metricsFilter = &types.MetricsFilterMemberPrefix{
+			Value: prefix,
+		}
 	}
 	return metricsFilter
 }
 
-func FlattenMetricsFilter(ctx context.Context, metricsFilter *s3.MetricsFilter) map[string]interface{} {
+func flattenMetricsFilter(ctx context.Context, metricsFilter types.MetricsFilter) map[string]interface{} {
 	m := make(map[string]interface{})
 
-	if and := metricsFilter.And; and != nil {
-		if and.Prefix != nil {
-			m["prefix"] = aws.StringValue(and.Prefix)
+	switch v := metricsFilter.(type) {
+	case *types.MetricsFilterMemberAnd:
+		if v := v.Value.Prefix; v != nil {
+			m["prefix"] = aws.ToString(v)
 		}
-		if and.Tags != nil {
-			m["tags"] = KeyValueTags(ctx, and.Tags).IgnoreAWS().Map()
+		if v := v.Value.Tags; v != nil {
+			m["tags"] = keyValueTagsV2(ctx, v).IgnoreAWS().Map()
 		}
-	} else if metricsFilter.Prefix != nil {
-		m["prefix"] = aws.StringValue(metricsFilter.Prefix)
-	} else if metricsFilter.Tag != nil {
-		tags := []*s3.Tag{
-			metricsFilter.Tag,
+	case *types.MetricsFilterMemberPrefix:
+		m["prefix"] = v.Value
+	case *types.MetricsFilterMemberTag:
+		tags := []types.Tag{
+			v.Value,
 		}
-		m["tags"] = KeyValueTags(ctx, tags).IgnoreAWS().Map()
+		m["tags"] = keyValueTagsV2(ctx, tags).IgnoreAWS().Map()
+	default:
+		return nil
 	}
 	return m
 }
@@ -257,3 +253,29 @@ func BucketMetricParseID(id string) (string, string, error) {
 	name := idParts[1]
 	return bucket, name, nil
 }
+
+func findMetricsConfiguration(ctx context.Context, conn *s3.Client, bucket, id string) (*types.MetricsConfiguration, error) {
+	input := &s3.GetBucketMetricsConfigurationInput{
+		Bucket: aws.String(bucket),
+		Id:     aws.String(id),
+	}
+
+	output, err := conn.GetBucketMetricsConfiguration(ctx, input)
+
+	if tfawserr.ErrCodeEquals(err, errCodeNoSuchBucket, errCodeNoSuchConfiguration) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	if output == nil || output.MetricsConfiguration == nil {
+		return nil, tfresource.NewEmptyResultError(input)
+	}
+
+	return output.MetricsConfiguration, nil
+}
diff --git a/internal/service/s3/bucket_metric_test.go b/internal/service/s3/bucket_metric_test.go
index db9395b820a..161d1a0a120 100644
--- a/internal/service/s3/bucket_metric_test.go
+++ b/internal/service/s3/bucket_metric_test.go
@@ -1,300 +1,43 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3_test
 
 import (
 	"context"
 	"fmt"
-	"log"
-	"reflect"
-	"regexp"
-	"sort"
 	"testing"
-	"time"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/s3"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
+	"github.com/YakDriver/regexache"
+	"github.com/aws/aws-sdk-go-v2/service/s3/types"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	tfs3 "github.com/hashicorp/terraform-provider-aws/internal/service/s3"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
-func TestExpandMetricsFilter(t *testing.T) {
-	t.Parallel()
-
-	ctx := context.Background()
-	testCases := []struct {
-		Config                  map[string]interface{}
-		ExpectedS3MetricsFilter *s3.MetricsFilter
-	}{
-		{
-			Config: map[string]interface{}{
-				"prefix": "prefix/",
-			},
-			ExpectedS3MetricsFilter: &s3.MetricsFilter{
-				Prefix: aws.String("prefix/"),
-			},
-		},
-		{
-			Config: map[string]interface{}{
-				"prefix": "prefix/",
-				"tags": map[string]interface{}{
-					"tag1key": "tag1value",
-				},
-			},
-			ExpectedS3MetricsFilter: &s3.MetricsFilter{
-				And: &s3.MetricsAndOperator{
-					Prefix: aws.String("prefix/"),
-					Tags: []*s3.Tag{
-						{
-							Key:   aws.String("tag1key"),
-							Value: aws.String("tag1value"),
-						},
-					},
-				},
-			},
-		},
-		{
-			Config: map[string]interface{}{
-				"prefix": "prefix/",
-				"tags": map[string]interface{}{
-					"tag1key": "tag1value",
-					"tag2key": "tag2value",
-				},
-			},
-			ExpectedS3MetricsFilter: &s3.MetricsFilter{
-				And: &s3.MetricsAndOperator{
-					Prefix: aws.String("prefix/"),
-					Tags: []*s3.Tag{
-						{
-							Key:   aws.String("tag1key"),
-							Value: aws.String("tag1value"),
-						},
-						{
-							Key:   aws.String("tag2key"),
-							Value: aws.String("tag2value"),
-						},
-					},
-				},
-			},
-		},
-		{
-			Config: map[string]interface{}{
-				"tags": map[string]interface{}{
-					"tag1key": "tag1value",
-				},
-			},
-			ExpectedS3MetricsFilter: &s3.MetricsFilter{
-				Tag: &s3.Tag{
-					Key:   aws.String("tag1key"),
-					Value: aws.String("tag1value"),
-				},
-			},
-		},
-		{
-			Config: map[string]interface{}{
-				"tags": map[string]interface{}{
-					"tag1key": "tag1value",
-					"tag2key": "tag2value",
-				},
-			},
-			ExpectedS3MetricsFilter: &s3.MetricsFilter{
-				And: &s3.MetricsAndOperator{
-					Tags: []*s3.Tag{
-						{
-							Key:   aws.String("tag1key"),
-							Value: aws.String("tag1value"),
-						},
-						{
-							Key:   aws.String("tag2key"),
-							Value: aws.String("tag2value"),
-						},
-					},
-				},
-			},
-		},
-	}
-
-	for i, tc := range testCases {
-		value := tfs3.ExpandMetricsFilter(ctx, tc.Config)
-
-		// Sort tags by key for consistency
-		if value.And != nil && value.And.Tags != nil {
-			sort.Slice(value.And.Tags, func(i, j int) bool {
-				return *value.And.Tags[i].Key < *value.And.Tags[j].Key
-			})
-		}
-
-		// Convert to strings to avoid dealing with pointers
-		valueS := fmt.Sprintf("%v", value)
-		expectedValueS := fmt.Sprintf("%v", tc.ExpectedS3MetricsFilter)
-
-		if valueS != expectedValueS {
-			t.Fatalf("Case #%d: Given:\n%s\n\nExpected:\n%s", i, valueS, expectedValueS)
-		}
-	}
-}
-
-func TestFlattenMetricsFilter(t *testing.T) {
-	t.Parallel()
-
-	ctx := context.Background()
-	testCases := []struct {
-		S3MetricsFilter *s3.MetricsFilter
-		ExpectedConfig  map[string]interface{}
-	}{
-		{
-			S3MetricsFilter: &s3.MetricsFilter{
-				Prefix: aws.String("prefix/"),
-			},
-			ExpectedConfig: map[string]interface{}{
-				"prefix": "prefix/",
-			},
-		},
-		{
-			S3MetricsFilter: &s3.MetricsFilter{
-				And: &s3.MetricsAndOperator{
-					Prefix: aws.String("prefix/"),
-					Tags: []*s3.Tag{
-						{
-							Key:   aws.String("tag1key"),
-							Value: aws.String("tag1value"),
-						},
-					},
-				},
-			},
-			ExpectedConfig: map[string]interface{}{
-				"prefix": "prefix/",
-				"tags": map[string]string{
-					"tag1key": "tag1value",
-				},
-			},
-		},
-		{
-			S3MetricsFilter: &s3.MetricsFilter{
-				And: &s3.MetricsAndOperator{
-					Prefix: aws.String("prefix/"),
-					Tags: []*s3.Tag{
-						{
-							Key:   aws.String("tag1key"),
-							Value: aws.String("tag1value"),
-						},
-						{
-							Key:   aws.String("tag2key"),
-							Value: aws.String("tag2value"),
-						},
-					},
-				},
-			},
-			ExpectedConfig: map[string]interface{}{
-				"prefix": "prefix/",
-				"tags": map[string]string{
-					"tag1key": "tag1value",
-					"tag2key": "tag2value",
-				},
-			},
-		},
-		{
-			S3MetricsFilter: &s3.MetricsFilter{
-				Tag: &s3.Tag{
-					Key:   aws.String("tag1key"),
-					Value: aws.String("tag1value"),
-				},
-			},
-			ExpectedConfig: map[string]interface{}{
-				"tags": map[string]string{
-					"tag1key": "tag1value",
-				},
-			},
-		},
-		{
-			S3MetricsFilter: &s3.MetricsFilter{
-				And: &s3.MetricsAndOperator{
-					Tags: []*s3.Tag{
-						{
-							Key:   aws.String("tag1key"),
-							Value: aws.String("tag1value"),
-						},
-						{
-							Key:   aws.String("tag2key"),
-							Value: aws.String("tag2value"),
-						},
-					},
-				},
-			},
-			ExpectedConfig: map[string]interface{}{
-				"tags": map[string]string{
-					"tag1key": "tag1value",
-					"tag2key": "tag2value",
-				},
-			},
-		},
-	}
-
-	for i, tc := range testCases {
-		value := tfs3.FlattenMetricsFilter(ctx, tc.S3MetricsFilter)
-
-		if !reflect.DeepEqual(value, tc.ExpectedConfig) {
-			t.Fatalf("Case #%d: Given:\n%s\n\nExpected:\n%s", i, value, tc.ExpectedConfig)
-		}
-	}
-}
-
-func TestBucketMetricParseID(t *testing.T) {
-	t.Parallel()
-
-	validIds := []string{
-		"foo:bar",
-		"my-bucket:entire-bucket",
-	}
-
-	for _, s := range validIds {
-		_, _, err := tfs3.BucketMetricParseID(s)
-		if err != nil {
-			t.Fatalf("%s should be a valid S3 bucket metrics configuration id: %s", s, err)
-		}
-	}
-
-	invalidIds := []string{
-		"",
-		"foo",
-		"foo:bar:",
-		"foo:bar:baz",
-		"foo::bar",
-		"foo.bar",
-	}
-
-	for _, s := range invalidIds {
-		_, _, err := tfs3.BucketMetricParseID(s)
-		if err == nil {
-			t.Fatalf("%s should not be a valid S3 bucket metrics configuration id", s)
-		}
-	}
-}
-
 func TestAccS3BucketMetric_basic(t *testing.T) {
 	ctx := acctest.Context(t)
-	var conf s3.MetricsConfiguration
-	rInt := sdkacctest.RandInt()
+	var conf types.MetricsConfiguration
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_s3_bucket_metric.test"
-
-	bucketName := fmt.Sprintf("tf-acc-%d", rInt)
 	metricName := t.Name()
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketMetricDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccBucketMetricConfig_noFilter(bucketName, metricName),
+				Config: testAccBucketMetricConfig_noFilter(rName, metricName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketMetricsExistsConfig(ctx, resourceName, &conf),
-					resource.TestCheckResourceAttr(resourceName, "bucket", bucketName),
+					resource.TestCheckResourceAttr(resourceName, "bucket", rName),
 					resource.TestCheckResourceAttr(resourceName, "filter.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "name", metricName),
 				),
@@ -312,25 +55,23 @@ func TestAccS3BucketMetric_basic(t *testing.T) {
 // Disallow Empty filter block
 func TestAccS3BucketMetric_withEmptyFilter(t *testing.T) {
 	ctx := acctest.Context(t)
-	var conf s3.MetricsConfiguration
-	rInt := sdkacctest.RandInt()
+	var conf types.MetricsConfiguration
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_s3_bucket_metric.test"
-
-	bucketName := fmt.Sprintf("tf-acc-%d", rInt)
 	metricName := t.Name()
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketMetricDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccBucketMetricConfig_emptyFilter(bucketName, metricName),
+				Config: testAccBucketMetricConfig_emptyFilter(rName, metricName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketMetricsExistsConfig(ctx, resourceName, &conf),
 				),
-				ExpectError: regexp.MustCompile(`one of .* must be specified`),
+				ExpectError: regexache.MustCompile(`one of .* must be specified`),
 			},
 		},
 	})
@@ -338,10 +79,9 @@ func TestAccS3BucketMetric_withEmptyFilter(t *testing.T) {
 
 func TestAccS3BucketMetric_withFilterPrefix(t *testing.T) {
 	ctx := acctest.Context(t)
-	var conf s3.MetricsConfiguration
+	var conf types.MetricsConfiguration
 	rInt := sdkacctest.RandInt()
 	resourceName := "aws_s3_bucket_metric.test"
-
 	bucketName := fmt.Sprintf("tf-acc-%d", rInt)
 	metricName := t.Name()
 	prefix := fmt.Sprintf("prefix-%d/", rInt)
@@ -349,7 +89,7 @@ func TestAccS3BucketMetric_withFilterPrefix(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketMetricDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -382,10 +122,9 @@ func TestAccS3BucketMetric_withFilterPrefix(t *testing.T) {
 
 func TestAccS3BucketMetric_withFilterPrefixAndMultipleTags(t *testing.T) {
 	ctx := acctest.Context(t)
-	var conf s3.MetricsConfiguration
+	var conf types.MetricsConfiguration
 	rInt := sdkacctest.RandInt()
 	resourceName := "aws_s3_bucket_metric.test"
-
 	bucketName := fmt.Sprintf("tf-acc-%d", rInt)
 	metricName := t.Name()
 	prefix := fmt.Sprintf("prefix-%d/", rInt)
@@ -397,7 +136,7 @@ func TestAccS3BucketMetric_withFilterPrefixAndMultipleTags(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketMetricDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -434,10 +173,9 @@ func TestAccS3BucketMetric_withFilterPrefixAndMultipleTags(t *testing.T) {
 
 func TestAccS3BucketMetric_withFilterPrefixAndSingleTag(t *testing.T) {
 	ctx := acctest.Context(t)
-	var conf s3.MetricsConfiguration
+	var conf types.MetricsConfiguration
 	rInt := sdkacctest.RandInt()
 	resourceName := "aws_s3_bucket_metric.test"
-
 	bucketName := fmt.Sprintf("tf-acc-%d", rInt)
 	metricName := t.Name()
 	prefix := fmt.Sprintf("prefix-%d/", rInt)
@@ -447,7 +185,7 @@ func TestAccS3BucketMetric_withFilterPrefixAndSingleTag(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketMetricDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -482,10 +220,9 @@ func TestAccS3BucketMetric_withFilterPrefixAndSingleTag(t *testing.T) {
 
 func TestAccS3BucketMetric_withFilterMultipleTags(t *testing.T) {
 	ctx := acctest.Context(t)
-	var conf s3.MetricsConfiguration
+	var conf types.MetricsConfiguration
 	rInt := sdkacctest.RandInt()
 	resourceName := "aws_s3_bucket_metric.test"
-
 	bucketName := fmt.Sprintf("tf-acc-%d", rInt)
 	metricName := t.Name()
 	tag1 := fmt.Sprintf("tag1-%d", rInt)
@@ -495,7 +232,7 @@ func TestAccS3BucketMetric_withFilterMultipleTags(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketMetricDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -532,10 +269,9 @@ func TestAccS3BucketMetric_withFilterMultipleTags(t *testing.T) {
 
 func TestAccS3BucketMetric_withFilterSingleTag(t *testing.T) {
 	ctx := acctest.Context(t)
-	var conf s3.MetricsConfiguration
+	var conf types.MetricsConfiguration
 	rInt := sdkacctest.RandInt()
 	resourceName := "aws_s3_bucket_metric.test"
-
 	bucketName := fmt.Sprintf("tf-acc-%d", rInt)
 	metricName := t.Name()
 	tag1 := fmt.Sprintf("tag-%d", rInt)
@@ -543,7 +279,7 @@ func TestAccS3BucketMetric_withFilterSingleTag(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketMetricDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -578,7 +314,7 @@ func TestAccS3BucketMetric_withFilterSingleTag(t *testing.T) {
 
 func testAccCheckBucketMetricDestroy(ctx context.Context) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Conn(ctx)
+		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Client(ctx)
 
 		for _, rs := range s.RootModule().Resources {
 			if rs.Type != "aws_s3_bucket_metric" {
@@ -590,68 +326,50 @@ func testAccCheckBucketMetricDestroy(ctx context.Context) resource.TestCheckFunc
 				return err
 			}
 
-			err = retry.RetryContext(ctx, 1*time.Minute, func() *retry.RetryError {
-				input := &s3.GetBucketMetricsConfigurationInput{
-					Bucket: aws.String(bucket),
-					Id:     aws.String(name),
-				}
-				log.Printf("[DEBUG] Reading S3 bucket metrics configuration: %s", input)
-				output, err := conn.GetBucketMetricsConfigurationWithContext(ctx, input)
-				if err != nil {
-					if tfawserr.ErrCodeEquals(err, s3.ErrCodeNoSuchBucket) || tfawserr.ErrMessageContains(err, "NoSuchConfiguration", "The specified configuration does not exist.") {
-						return nil
-					}
-					return retry.NonRetryableError(err)
-				}
-				if output.MetricsConfiguration != nil {
-					return retry.RetryableError(fmt.Errorf("S3 bucket metrics configuration exists: %v", output))
-				}
-
-				return nil
-			})
+			_, err = tfs3.FindMetricsConfiguration(ctx, conn, bucket, name)
+
+			if tfresource.NotFound(err) {
+				continue
+			}
 
 			if err != nil {
 				return err
 			}
+
+			return fmt.Errorf("S3 Bucket Metric %s still exists", rs.Primary.ID)
 		}
+
 		return nil
 	}
 }
 
-func testAccCheckBucketMetricsExistsConfig(ctx context.Context, n string, res *s3.MetricsConfiguration) resource.TestCheckFunc {
+func testAccCheckBucketMetricsExistsConfig(ctx context.Context, n string, v *types.MetricsConfiguration) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		rs, ok := s.RootModule().Resources[n]
 		if !ok {
 			return fmt.Errorf("Not found: %s", n)
 		}
 
-		if rs.Primary.ID == "" {
-			return fmt.Errorf("No S3 bucket metrics configuration ID is set")
-		}
-
-		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Conn(ctx)
 		bucket, name, err := tfs3.BucketMetricParseID(rs.Primary.ID)
 		if err != nil {
 			return err
 		}
 
-		input := &s3.GetBucketMetricsConfigurationInput{
-			Bucket: aws.String(bucket),
-			Id:     aws.String(name),
-		}
-		log.Printf("[DEBUG] Reading S3 bucket metrics configuration: %s", input)
-		output, err := conn.GetBucketMetricsConfigurationWithContext(ctx, input)
+		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Client(ctx)
+
+		output, err := tfs3.FindMetricsConfiguration(ctx, conn, bucket, name)
+
 		if err != nil {
 			return err
 		}
 
-		*res = *output.MetricsConfiguration
+		*v = *output
 
 		return nil
 	}
 }
 
-func testAccBucketMetricsBucketConfig(bucketName string) string {
+func testAccBucketMetricConfig_base(bucketName string) string {
 	return fmt.Sprintf(`
 resource "aws_s3_bucket" "bucket" {
   bucket = %[1]q
@@ -660,9 +378,7 @@ resource "aws_s3_bucket" "bucket" {
 }
 
 func testAccBucketMetricConfig_emptyFilter(bucketName, metricName string) string {
-	return acctest.ConfigCompose(
-		testAccBucketMetricsBucketConfig(bucketName),
-		fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccBucketMetricConfig_base(bucketName), fmt.Sprintf(`
 resource "aws_s3_bucket_metric" "test" {
   bucket = aws_s3_bucket.bucket.id
   name   = %[1]q
@@ -673,9 +389,7 @@ resource "aws_s3_bucket_metric" "test" {
 }
 
 func testAccBucketMetricConfig_filterPrefix(bucketName, metricName, prefix string) string {
-	return acctest.ConfigCompose(
-		testAccBucketMetricsBucketConfig(bucketName),
-		fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccBucketMetricConfig_base(bucketName), fmt.Sprintf(`
 resource "aws_s3_bucket_metric" "test" {
   bucket = aws_s3_bucket.bucket.id
   name   = %[1]q
@@ -688,9 +402,7 @@ resource "aws_s3_bucket_metric" "test" {
 }
 
 func testAccBucketMetricConfig_filterPrefixAndMultipleTags(bucketName, metricName, prefix, tag1, tag2 string) string {
-	return acctest.ConfigCompose(
-		testAccBucketMetricsBucketConfig(bucketName),
-		fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccBucketMetricConfig_base(bucketName), fmt.Sprintf(`
 resource "aws_s3_bucket_metric" "test" {
   bucket = aws_s3_bucket.bucket.id
   name   = %[1]q
@@ -699,8 +411,8 @@ resource "aws_s3_bucket_metric" "test" {
     prefix = %[2]q
 
     tags = {
-      "tag1" = "%s"
-      "tag2" = "%s"
+      "tag1" = %[3]q
+      "tag2" = %[4]q
     }
   }
 }
@@ -708,9 +420,7 @@ resource "aws_s3_bucket_metric" "test" {
 }
 
 func testAccBucketMetricConfig_filterPrefixAndSingleTag(bucketName, metricName, prefix, tag string) string {
-	return acctest.ConfigCompose(
-		testAccBucketMetricsBucketConfig(bucketName),
-		fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccBucketMetricConfig_base(bucketName), fmt.Sprintf(`
 resource "aws_s3_bucket_metric" "test" {
   bucket = aws_s3_bucket.bucket.id
   name   = %[1]q
@@ -727,9 +437,7 @@ resource "aws_s3_bucket_metric" "test" {
 }
 
 func testAccBucketMetricConfig_filterMultipleTags(bucketName, metricName, tag1, tag2 string) string {
-	return acctest.ConfigCompose(
-		testAccBucketMetricsBucketConfig(bucketName),
-		fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccBucketMetricConfig_base(bucketName), fmt.Sprintf(`
 resource "aws_s3_bucket_metric" "test" {
   bucket = aws_s3_bucket.bucket.id
   name   = %[1]q
@@ -745,9 +453,7 @@ resource "aws_s3_bucket_metric" "test" {
 }
 
 func testAccBucketMetricConfig_filterSingleTag(bucketName, metricName, tag string) string {
-	return acctest.ConfigCompose(
-		testAccBucketMetricsBucketConfig(bucketName),
-		fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccBucketMetricConfig_base(bucketName), fmt.Sprintf(`
 resource "aws_s3_bucket_metric" "test" {
   bucket = aws_s3_bucket.bucket.id
   name   = %[1]q
@@ -762,9 +468,7 @@ resource "aws_s3_bucket_metric" "test" {
 }
 
 func testAccBucketMetricConfig_noFilter(bucketName, metricName string) string {
-	return acctest.ConfigCompose(
-		testAccBucketMetricsBucketConfig(bucketName),
-		fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccBucketMetricConfig_base(bucketName), fmt.Sprintf(`
 resource "aws_s3_bucket_metric" "test" {
   bucket = aws_s3_bucket.bucket.id
   name   = %[1]q
diff --git a/internal/service/s3/bucket_notification.go b/internal/service/s3/bucket_notification.go
index 58e3718869a..e3caf0e5859 100644
--- a/internal/service/s3/bucket_notification.go
+++ b/internal/service/s3/bucket_notification.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3
 
 import (
@@ -6,9 +9,10 @@ import (
 	"log"
 	"strings"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/s3"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/s3"
+	"github.com/aws/aws-sdk-go-v2/service/s3/types"
+	"github.com/hashicorp/aws-sdk-go-base/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
@@ -26,6 +30,7 @@ func ResourceBucketNotification() *schema.Resource {
 		ReadWithoutTimeout:   resourceBucketNotificationRead,
 		UpdateWithoutTimeout: resourceBucketNotificationPut,
 		DeleteWithoutTimeout: resourceBucketNotificationDelete,
+
 		Importer: &schema.ResourceImporter{
 			StateContext: schema.ImportStatePassthroughContext,
 		},
@@ -36,22 +41,20 @@ func ResourceBucketNotification() *schema.Resource {
 				Required: true,
 				ForceNew: true,
 			},
-
 			"eventbridge": {
 				Type:     schema.TypeBool,
 				Optional: true,
 				Default:  false,
 			},
-
-			"topic": {
+			"lambda_function": {
 				Type:     schema.TypeList,
 				Optional: true,
 				Elem: &schema.Resource{
 					Schema: map[string]*schema.Schema{
-						"id": {
-							Type:     schema.TypeString,
-							Optional: true,
-							Computed: true,
+						"events": {
+							Type:     schema.TypeSet,
+							Required: true,
+							Elem:     &schema.Schema{Type: schema.TypeString},
 						},
 						"filter_prefix": {
 							Type:     schema.TypeString,
@@ -61,29 +64,27 @@ func ResourceBucketNotification() *schema.Resource {
 							Type:     schema.TypeString,
 							Optional: true,
 						},
-						"topic_arn": {
+						"id": {
 							Type:     schema.TypeString,
-							Required: true,
+							Optional: true,
+							Computed: true,
 						},
-						"events": {
-							Type:     schema.TypeSet,
-							Required: true,
-							Elem:     &schema.Schema{Type: schema.TypeString},
-							Set:      schema.HashString,
+						"lambda_function_arn": {
+							Type:     schema.TypeString,
+							Optional: true,
 						},
 					},
 				},
 			},
-
 			"queue": {
 				Type:     schema.TypeList,
 				Optional: true,
 				Elem: &schema.Resource{
 					Schema: map[string]*schema.Schema{
-						"id": {
-							Type:     schema.TypeString,
-							Optional: true,
-							Computed: true,
+						"events": {
+							Type:     schema.TypeSet,
+							Required: true,
+							Elem:     &schema.Schema{Type: schema.TypeString},
 						},
 						"filter_prefix": {
 							Type:     schema.TypeString,
@@ -93,29 +94,27 @@ func ResourceBucketNotification() *schema.Resource {
 							Type:     schema.TypeString,
 							Optional: true,
 						},
-						"queue_arn": {
+						"id": {
 							Type:     schema.TypeString,
-							Required: true,
+							Optional: true,
+							Computed: true,
 						},
-						"events": {
-							Type:     schema.TypeSet,
+						"queue_arn": {
+							Type:     schema.TypeString,
 							Required: true,
-							Elem:     &schema.Schema{Type: schema.TypeString},
-							Set:      schema.HashString,
 						},
 					},
 				},
 			},
-
-			"lambda_function": {
+			"topic": {
 				Type:     schema.TypeList,
 				Optional: true,
 				Elem: &schema.Resource{
 					Schema: map[string]*schema.Schema{
-						"id": {
-							Type:     schema.TypeString,
-							Optional: true,
-							Computed: true,
+						"events": {
+							Type:     schema.TypeSet,
+							Required: true,
+							Elem:     &schema.Schema{Type: schema.TypeString},
 						},
 						"filter_prefix": {
 							Type:     schema.TypeString,
@@ -125,15 +124,14 @@ func ResourceBucketNotification() *schema.Resource {
 							Type:     schema.TypeString,
 							Optional: true,
 						},
-						"lambda_function_arn": {
+						"id": {
 							Type:     schema.TypeString,
 							Optional: true,
+							Computed: true,
 						},
-						"events": {
-							Type:     schema.TypeSet,
+						"topic_arn": {
+							Type:     schema.TypeString,
 							Required: true,
-							Elem:     &schema.Schema{Type: schema.TypeString},
-							Set:      schema.HashString,
 						},
 					},
 				},
@@ -144,115 +142,95 @@ func ResourceBucketNotification() *schema.Resource {
 
 func resourceBucketNotificationPut(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).S3Conn(ctx)
+	conn := meta.(*conns.AWSClient).S3Client(ctx)
 	bucket := d.Get("bucket").(string)
 
-	// EventBridge
-	eventbridgeNotifications := d.Get("eventbridge").(bool)
-	var eventbridgeConfig *s3.EventBridgeConfiguration
-	if eventbridgeNotifications {
-		eventbridgeConfig = &s3.EventBridgeConfiguration{}
+	var eventbridgeConfig *types.EventBridgeConfiguration
+	if d.Get("eventbridge").(bool) {
+		eventbridgeConfig = &types.EventBridgeConfiguration{}
 	}
 
-	// TopicNotifications
-	topicNotifications := d.Get("topic").([]interface{})
-	topicConfigs := make([]*s3.TopicConfiguration, 0, len(topicNotifications))
-	for i, c := range topicNotifications {
-		tc := &s3.TopicConfiguration{}
+	lambdaFunctionNotifications := d.Get("lambda_function").([]interface{})
+	lambdaConfigs := make([]types.LambdaFunctionConfiguration, 0, len(lambdaFunctionNotifications))
+	for i, c := range lambdaFunctionNotifications {
+		lc := types.LambdaFunctionConfiguration{}
 
 		c := c.(map[string]interface{})
 
-		// Id
 		if val, ok := c["id"].(string); ok && val != "" {
-			tc.Id = aws.String(val)
+			lc.Id = aws.String(val)
 		} else {
-			tc.Id = aws.String(id.PrefixedUniqueId("tf-s3-topic-"))
+			lc.Id = aws.String(id.PrefixedUniqueId("tf-s3-lambda-"))
 		}
 
-		// TopicArn
-		if val, ok := c["topic_arn"].(string); ok {
-			tc.TopicArn = aws.String(val)
+		if val, ok := c["lambda_function_arn"].(string); ok {
+			lc.LambdaFunctionArn = aws.String(val)
 		}
 
-		// Events
-		events := d.Get(fmt.Sprintf("topic.%d.events", i)).(*schema.Set).List()
-		tc.Events = make([]*string, 0, len(events))
-		for _, e := range events {
-			tc.Events = append(tc.Events, aws.String(e.(string)))
-		}
+		lc.Events = flex.ExpandStringyValueSet[types.Event](d.Get(fmt.Sprintf("lambda_function.%d.events", i)).(*schema.Set))
 
-		// Filter
-		filterRules := make([]*s3.FilterRule, 0, filterRulesSliceStartLen)
+		filterRules := make([]types.FilterRule, 0, filterRulesSliceStartLen)
 		if val, ok := c["filter_prefix"].(string); ok && val != "" {
-			filterRule := &s3.FilterRule{
-				Name:  aws.String("prefix"),
+			filterRule := types.FilterRule{
+				Name:  types.FilterRuleNamePrefix,
 				Value: aws.String(val),
 			}
 			filterRules = append(filterRules, filterRule)
 		}
 		if val, ok := c["filter_suffix"].(string); ok && val != "" {
-			filterRule := &s3.FilterRule{
-				Name:  aws.String("suffix"),
+			filterRule := types.FilterRule{
+				Name:  types.FilterRuleNameSuffix,
 				Value: aws.String(val),
 			}
 			filterRules = append(filterRules, filterRule)
 		}
 		if len(filterRules) > 0 {
-			tc.Filter = &s3.NotificationConfigurationFilter{
-				Key: &s3.KeyFilter{
+			lc.Filter = &types.NotificationConfigurationFilter{
+				Key: &types.S3KeyFilter{
 					FilterRules: filterRules,
 				},
 			}
 		}
-		topicConfigs = append(topicConfigs, tc)
+		lambdaConfigs = append(lambdaConfigs, lc)
 	}
 
-	// SQS
 	queueNotifications := d.Get("queue").([]interface{})
-	queueConfigs := make([]*s3.QueueConfiguration, 0, len(queueNotifications))
+	queueConfigs := make([]types.QueueConfiguration, 0, len(queueNotifications))
 	for i, c := range queueNotifications {
-		qc := &s3.QueueConfiguration{}
+		qc := types.QueueConfiguration{}
 
 		c := c.(map[string]interface{})
 
-		// Id
 		if val, ok := c["id"].(string); ok && val != "" {
 			qc.Id = aws.String(val)
 		} else {
 			qc.Id = aws.String(id.PrefixedUniqueId("tf-s3-queue-"))
 		}
 
-		// QueueArn
 		if val, ok := c["queue_arn"].(string); ok {
 			qc.QueueArn = aws.String(val)
 		}
 
-		// Events
-		events := d.Get(fmt.Sprintf("queue.%d.events", i)).(*schema.Set).List()
-		qc.Events = make([]*string, 0, len(events))
-		for _, e := range events {
-			qc.Events = append(qc.Events, aws.String(e.(string)))
-		}
+		qc.Events = flex.ExpandStringyValueSet[types.Event](d.Get(fmt.Sprintf("queue.%d.events", i)).(*schema.Set))
 
-		// Filter
-		filterRules := make([]*s3.FilterRule, 0, filterRulesSliceStartLen)
+		filterRules := make([]types.FilterRule, 0, filterRulesSliceStartLen)
 		if val, ok := c["filter_prefix"].(string); ok && val != "" {
-			filterRule := &s3.FilterRule{
-				Name:  aws.String("prefix"),
+			filterRule := types.FilterRule{
+				Name:  types.FilterRuleNamePrefix,
 				Value: aws.String(val),
 			}
 			filterRules = append(filterRules, filterRule)
 		}
 		if val, ok := c["filter_suffix"].(string); ok && val != "" {
-			filterRule := &s3.FilterRule{
-				Name:  aws.String("suffix"),
+			filterRule := types.FilterRule{
+				Name:  types.FilterRuleNameSuffix,
 				Value: aws.String(val),
 			}
 			filterRules = append(filterRules, filterRule)
 		}
 		if len(filterRules) > 0 {
-			qc.Filter = &s3.NotificationConfigurationFilter{
-				Key: &s3.KeyFilter{
+			qc.Filter = &types.NotificationConfigurationFilter{
+				Key: &types.S3KeyFilter{
 					FilterRules: filterRules,
 				},
 			}
@@ -260,60 +238,51 @@ func resourceBucketNotificationPut(ctx context.Context, d *schema.ResourceData,
 		queueConfigs = append(queueConfigs, qc)
 	}
 
-	// Lambda
-	lambdaFunctionNotifications := d.Get("lambda_function").([]interface{})
-	lambdaConfigs := make([]*s3.LambdaFunctionConfiguration, 0, len(lambdaFunctionNotifications))
-	for i, c := range lambdaFunctionNotifications {
-		lc := &s3.LambdaFunctionConfiguration{}
+	topicNotifications := d.Get("topic").([]interface{})
+	topicConfigs := make([]types.TopicConfiguration, 0, len(topicNotifications))
+	for i, c := range topicNotifications {
+		tc := types.TopicConfiguration{}
 
 		c := c.(map[string]interface{})
 
-		// Id
 		if val, ok := c["id"].(string); ok && val != "" {
-			lc.Id = aws.String(val)
+			tc.Id = aws.String(val)
 		} else {
-			lc.Id = aws.String(id.PrefixedUniqueId("tf-s3-lambda-"))
+			tc.Id = aws.String(id.PrefixedUniqueId("tf-s3-topic-"))
 		}
 
-		// LambdaFunctionArn
-		if val, ok := c["lambda_function_arn"].(string); ok {
-			lc.LambdaFunctionArn = aws.String(val)
+		if val, ok := c["topic_arn"].(string); ok {
+			tc.TopicArn = aws.String(val)
 		}
 
-		// Events
-		events := d.Get(fmt.Sprintf("lambda_function.%d.events", i)).(*schema.Set).List()
-		lc.Events = make([]*string, 0, len(events))
-		for _, e := range events {
-			lc.Events = append(lc.Events, aws.String(e.(string)))
-		}
+		tc.Events = flex.ExpandStringyValueSet[types.Event](d.Get(fmt.Sprintf("topic.%d.events", i)).(*schema.Set))
 
-		// Filter
-		filterRules := make([]*s3.FilterRule, 0, filterRulesSliceStartLen)
+		filterRules := make([]types.FilterRule, 0, filterRulesSliceStartLen)
 		if val, ok := c["filter_prefix"].(string); ok && val != "" {
-			filterRule := &s3.FilterRule{
-				Name:  aws.String("prefix"),
+			filterRule := types.FilterRule{
+				Name:  types.FilterRuleNamePrefix,
 				Value: aws.String(val),
 			}
 			filterRules = append(filterRules, filterRule)
 		}
 		if val, ok := c["filter_suffix"].(string); ok && val != "" {
-			filterRule := &s3.FilterRule{
-				Name:  aws.String("suffix"),
+			filterRule := types.FilterRule{
+				Name:  types.FilterRuleNameSuffix,
 				Value: aws.String(val),
 			}
 			filterRules = append(filterRules, filterRule)
 		}
 		if len(filterRules) > 0 {
-			lc.Filter = &s3.NotificationConfigurationFilter{
-				Key: &s3.KeyFilter{
+			tc.Filter = &types.NotificationConfigurationFilter{
+				Key: &types.S3KeyFilter{
 					FilterRules: filterRules,
 				},
 			}
 		}
-		lambdaConfigs = append(lambdaConfigs, lc)
+		topicConfigs = append(topicConfigs, tc)
 	}
 
-	notificationConfiguration := &s3.NotificationConfiguration{}
+	notificationConfiguration := &types.NotificationConfiguration{}
 	if eventbridgeConfig != nil {
 		notificationConfiguration.EventBridgeConfiguration = eventbridgeConfig
 	}
@@ -326,123 +295,108 @@ func resourceBucketNotificationPut(ctx context.Context, d *schema.ResourceData,
 	if len(topicConfigs) > 0 {
 		notificationConfiguration.TopicConfigurations = topicConfigs
 	}
-	i := &s3.PutBucketNotificationConfigurationInput{
+	input := &s3.PutBucketNotificationConfigurationInput{
 		Bucket:                    aws.String(bucket),
 		NotificationConfiguration: notificationConfiguration,
 	}
 
-	log.Printf("[DEBUG] S3 bucket: %s, Putting notification: %v", bucket, i)
-	err := retry.RetryContext(ctx, propagationTimeout, func() *retry.RetryError {
-		_, err := conn.PutBucketNotificationConfigurationWithContext(ctx, i)
-
-		if tfawserr.ErrCodeEquals(err, s3.ErrCodeNoSuchBucket) {
-			return retry.RetryableError(err)
-		}
-
-		if err != nil {
-			return retry.NonRetryableError(err)
-		}
-
-		return nil
-	})
-
-	if tfresource.TimedOut(err) {
-		_, err = conn.PutBucketNotificationConfigurationWithContext(ctx, i)
-	}
+	_, err := tfresource.RetryWhenAWSErrCodeEquals(ctx, s3BucketPropagationTimeout, func() (interface{}, error) {
+		return conn.PutBucketNotificationConfiguration(ctx, input)
+	}, errCodeNoSuchBucket)
 
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "putting S3 Bucket Notification Configuration: %s", err)
+		return diag.Errorf("creating S3 Bucket (%s) Notification: %s", bucket, err)
 	}
 
-	d.SetId(bucket)
+	if d.IsNewResource() {
+		d.SetId(bucket)
 
-	return append(diags, resourceBucketNotificationRead(ctx, d, meta)...)
-}
+		_, err = tfresource.RetryWhenNotFound(ctx, s3BucketPropagationTimeout, func() (interface{}, error) {
+			return findBucketNotificationConfiguration(ctx, conn, d.Id(), "")
+		})
 
-func resourceBucketNotificationDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).S3Conn(ctx)
-
-	i := &s3.PutBucketNotificationConfigurationInput{
-		Bucket:                    aws.String(d.Id()),
-		NotificationConfiguration: &s3.NotificationConfiguration{},
-	}
-
-	log.Printf("[DEBUG] S3 bucket: %s, Deleting notification: %v", d.Id(), i)
-	_, err := conn.PutBucketNotificationConfigurationWithContext(ctx, i)
-
-	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "deleting S3 Bucket Notification Configuration (%s): %s", d.Id(), err)
+		if err != nil {
+			return diag.Errorf("waiting for S3 Bucket Notification (%s) create: %s", d.Id(), err)
+		}
 	}
 
-	return diags
+	return append(diags, resourceBucketNotificationRead(ctx, d, meta)...)
 }
 
 func resourceBucketNotificationRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).S3Conn(ctx)
+	conn := meta.(*conns.AWSClient).S3Client(ctx)
 
-	notificationConfigs, err := conn.GetBucketNotificationConfigurationWithContext(ctx, &s3.GetBucketNotificationConfigurationRequest{
-		Bucket: aws.String(d.Id()),
-	})
+	output, err := findBucketNotificationConfiguration(ctx, conn, d.Id(), "")
 
-	if !d.IsNewResource() && tfawserr.ErrCodeEquals(err, s3.ErrCodeNoSuchBucket) {
-		log.Printf("[WARN] S3 Bucket Notification Configuration (%s) not found, removing from state", d.Id())
+	if !d.IsNewResource() && tfresource.NotFound(err) {
+		log.Printf("[WARN] S3 Bucket Notification (%s) not found, removing from state", d.Id())
 		d.SetId("")
 		return diags
 	}
 
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "reading S3 Bucket Notification Configuration (%s): %s", d.Id(), err)
+		return sdkdiag.AppendErrorf(diags, "reading S3 Bucket Notification (%s): %s", d.Id(), err)
 	}
 
-	if notificationConfigs == nil {
-		return sdkdiag.AppendErrorf(diags, "reading S3 Bucket Notification Configuration (%s): empty response", d.Id())
+	d.Set("bucket", d.Id())
+	d.Set("eventbridge", output.EventBridgeConfiguration != nil)
+	if err := d.Set("lambda_function", flattenLambdaFunctionConfigurations(output.LambdaFunctionConfigurations)); err != nil {
+		return sdkdiag.AppendErrorf(diags, "setting lambda_function: %s", err)
+	}
+	if err := d.Set("queue", flattenQueueConfigurations(output.QueueConfigurations)); err != nil {
+		return sdkdiag.AppendErrorf(diags, "setting queue: %s", err)
+	}
+	if err := d.Set("topic", flattenTopicConfigurations(output.TopicConfigurations)); err != nil {
+		return sdkdiag.AppendErrorf(diags, "setting queue: %s", err)
 	}
 
-	log.Printf("[DEBUG] S3 Bucket: %s, get notification: %v", d.Id(), notificationConfigs)
-
-	d.Set("bucket", d.Id())
+	return diags
+}
 
-	// EventBridge Notification
-	d.Set("eventbridge", notificationConfigs.EventBridgeConfiguration != nil)
+func resourceBucketNotificationDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).S3Client(ctx)
 
-	// Topic Notification
-	if err := d.Set("topic", flattenTopicConfigurations(notificationConfigs.TopicConfigurations)); err != nil {
-		return sdkdiag.AppendErrorf(diags, "reading S3 bucket \"%s\" topic notification: %s", d.Id(), err)
+	input := &s3.PutBucketNotificationConfigurationInput{
+		Bucket:                    aws.String(d.Id()),
+		NotificationConfiguration: &types.NotificationConfiguration{},
 	}
 
-	// SQS Notification
-	if err := d.Set("queue", flattenQueueConfigurations(notificationConfigs.QueueConfigurations)); err != nil {
-		return sdkdiag.AppendErrorf(diags, "reading S3 bucket \"%s\" queue notification: %s", d.Id(), err)
+	log.Printf("[DEBUG] Deleting S3 Bucket Notification: %s", d.Id())
+	_, err := conn.PutBucketNotificationConfiguration(ctx, input)
+
+	if tfawserr.ErrCodeEquals(err, errCodeNoSuchBucket) {
+		return nil
 	}
 
-	// Lambda Notification
-	if err := d.Set("lambda_function", flattenLambdaFunctionConfigurations(notificationConfigs.LambdaFunctionConfigurations)); err != nil {
-		return sdkdiag.AppendErrorf(diags, "reading S3 bucket \"%s\" lambda function notification: %s", d.Id(), err)
+	if err != nil {
+		return diag.Errorf("deleting S3 Bucket Notification (%s): %s", d.Id(), err)
 	}
 
+	// Don't wait for the notification configuration to disappear as it still exists after update.
+
 	return diags
 }
 
-func flattenNotificationConfigurationFilter(filter *s3.NotificationConfigurationFilter) map[string]interface{} {
+func flattenNotificationConfigurationFilter(filter *types.NotificationConfigurationFilter) map[string]interface{} {
 	filterRules := map[string]interface{}{}
 	if filter.Key == nil || filter.Key.FilterRules == nil {
 		return filterRules
 	}
 
 	for _, f := range filter.Key.FilterRules {
-		if strings.ToLower(*f.Name) == s3.FilterRuleNamePrefix {
-			filterRules["filter_prefix"] = aws.StringValue(f.Value)
-		}
-		if strings.ToLower(*f.Name) == s3.FilterRuleNameSuffix {
-			filterRules["filter_suffix"] = aws.StringValue(f.Value)
+		name := strings.ToLower(string(f.Name))
+		if name == string(types.FilterRuleNamePrefix) {
+			filterRules["filter_prefix"] = aws.ToString(f.Value)
+		} else if name == string(types.FilterRuleNameSuffix) {
+			filterRules["filter_suffix"] = aws.ToString(f.Value)
 		}
 	}
 	return filterRules
 }
 
-func flattenTopicConfigurations(configs []*s3.TopicConfiguration) []map[string]interface{} {
+func flattenTopicConfigurations(configs []types.TopicConfiguration) []map[string]interface{} {
 	topicNotifications := make([]map[string]interface{}, 0, len(configs))
 	for _, notification := range configs {
 		var conf map[string]interface{}
@@ -452,16 +406,16 @@ func flattenTopicConfigurations(configs []*s3.TopicConfiguration) []map[string]i
 			conf = map[string]interface{}{}
 		}
 
-		conf["id"] = aws.StringValue(notification.Id)
-		conf["events"] = flex.FlattenStringSet(notification.Events)
-		conf["topic_arn"] = aws.StringValue(notification.TopicArn)
+		conf["id"] = aws.ToString(notification.Id)
+		conf["events"] = notification.Events
+		conf["topic_arn"] = aws.ToString(notification.TopicArn)
 		topicNotifications = append(topicNotifications, conf)
 	}
 
 	return topicNotifications
 }
 
-func flattenQueueConfigurations(configs []*s3.QueueConfiguration) []map[string]interface{} {
+func flattenQueueConfigurations(configs []types.QueueConfiguration) []map[string]interface{} {
 	queueNotifications := make([]map[string]interface{}, 0, len(configs))
 	for _, notification := range configs {
 		var conf map[string]interface{}
@@ -471,16 +425,16 @@ func flattenQueueConfigurations(configs []*s3.QueueConfiguration) []map[string]i
 			conf = map[string]interface{}{}
 		}
 
-		conf["id"] = aws.StringValue(notification.Id)
-		conf["events"] = flex.FlattenStringSet(notification.Events)
-		conf["queue_arn"] = aws.StringValue(notification.QueueArn)
+		conf["id"] = aws.ToString(notification.Id)
+		conf["events"] = notification.Events
+		conf["queue_arn"] = aws.ToString(notification.QueueArn)
 		queueNotifications = append(queueNotifications, conf)
 	}
 
 	return queueNotifications
 }
 
-func flattenLambdaFunctionConfigurations(configs []*s3.LambdaFunctionConfiguration) []map[string]interface{} {
+func flattenLambdaFunctionConfigurations(configs []types.LambdaFunctionConfiguration) []map[string]interface{} {
 	lambdaFunctionNotifications := make([]map[string]interface{}, 0, len(configs))
 	for _, notification := range configs {
 		var conf map[string]interface{}
@@ -490,11 +444,39 @@ func flattenLambdaFunctionConfigurations(configs []*s3.LambdaFunctionConfigurati
 			conf = map[string]interface{}{}
 		}
 
-		conf["id"] = aws.StringValue(notification.Id)
-		conf["events"] = flex.FlattenStringSet(notification.Events)
-		conf["lambda_function_arn"] = aws.StringValue(notification.LambdaFunctionArn)
+		conf["id"] = aws.ToString(notification.Id)
+		conf["events"] = notification.Events
+		conf["lambda_function_arn"] = aws.ToString(notification.LambdaFunctionArn)
 		lambdaFunctionNotifications = append(lambdaFunctionNotifications, conf)
 	}
 
 	return lambdaFunctionNotifications
 }
+
+func findBucketNotificationConfiguration(ctx context.Context, conn *s3.Client, bucket, expectedBucketOwner string) (*s3.GetBucketNotificationConfigurationOutput, error) {
+	input := &s3.GetBucketNotificationConfigurationInput{
+		Bucket: aws.String(bucket),
+	}
+	if expectedBucketOwner != "" {
+		input.ExpectedBucketOwner = aws.String(expectedBucketOwner)
+	}
+
+	output, err := conn.GetBucketNotificationConfiguration(ctx, input)
+
+	if tfawserr.ErrCodeEquals(err, errCodeNoSuchBucket) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	if output == nil {
+		return nil, tfresource.NewEmptyResultError(input)
+	}
+
+	return output, nil
+}
diff --git a/internal/service/s3/bucket_notification_test.go b/internal/service/s3/bucket_notification_test.go
index ed6cf38bdd2..19b90debad2 100644
--- a/internal/service/s3/bucket_notification_test.go
+++ b/internal/service/s3/bucket_notification_test.go
@@ -1,39 +1,45 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3_test
 
 import (
 	"context"
 	"fmt"
-	"reflect"
-	"sort"
 	"testing"
-	"time"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/s3"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
+	"github.com/aws/aws-sdk-go-v2/service/s3"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	tfs3 "github.com/hashicorp/terraform-provider-aws/internal/service/s3"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
 func TestAccS3BucketNotification_eventbridge(t *testing.T) {
 	ctx := acctest.Context(t)
+	var v s3.GetBucketNotificationConfigurationOutput
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_s3_bucket_notification.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketNotificationDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccBucketNotificationConfig_eventBridge(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckBucketEventBridgeNotification(ctx, "aws_s3_bucket.test")),
+					testAccCheckBucketNotificationExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "eventbridge", "true"),
+					resource.TestCheckResourceAttr(resourceName, "lambda_function.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "queue.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "topic.#", "0"),
+				),
 			},
 			{
 				ResourceName:      resourceName,
@@ -46,35 +52,27 @@ func TestAccS3BucketNotification_eventbridge(t *testing.T) {
 
 func TestAccS3BucketNotification_lambdaFunction(t *testing.T) {
 	ctx := acctest.Context(t)
+	var v s3.GetBucketNotificationConfigurationOutput
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_s3_bucket_notification.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketNotificationDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccBucketNotificationConfig_lambdaFunction(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckBucketLambdaFunctionConfiguration(ctx, "aws_s3_bucket.test",
-						"notification-lambda",
-						"aws_lambda_function.test",
-						[]string{"s3:ObjectCreated:*", "s3:ObjectRemoved:Delete"},
-						&s3.KeyFilter{
-							FilterRules: []*s3.FilterRule{
-								{
-									Name:  aws.String("Prefix"),
-									Value: aws.String("tf-acc-test/"),
-								},
-								{
-									Name:  aws.String("Suffix"),
-									Value: aws.String(".png"),
-								},
-							},
-						},
-					),
+					testAccCheckBucketNotificationExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "eventbridge", "false"),
+					resource.TestCheckResourceAttr(resourceName, "lambda_function.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "lambda_function.0.events.#", "2"),
+					resource.TestCheckResourceAttr(resourceName, "lambda_function.0.filter_prefix", "tf-acc-test/"),
+					resource.TestCheckResourceAttr(resourceName, "lambda_function.0.filter_suffix", ".png"),
+					resource.TestCheckResourceAttr(resourceName, "queue.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "topic.#", "0"),
 				),
 			},
 			{
@@ -88,24 +86,27 @@ func TestAccS3BucketNotification_lambdaFunction(t *testing.T) {
 
 func TestAccS3BucketNotification_LambdaFunctionLambdaFunctionARN_alias(t *testing.T) {
 	ctx := acctest.Context(t)
+	var v s3.GetBucketNotificationConfigurationOutput
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_s3_bucket_notification.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketNotificationDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccBucketNotificationConfig_lambdaFunctionLambdaFunctionARNAlias(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckBucketLambdaFunctionConfiguration(ctx, "aws_s3_bucket.test",
-						"test",
-						"aws_lambda_alias.test",
-						[]string{"s3:ObjectCreated:*"},
-						nil,
-					),
+					testAccCheckBucketNotificationExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "eventbridge", "false"),
+					resource.TestCheckResourceAttr(resourceName, "lambda_function.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "lambda_function.0.events.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "lambda_function.0.filter_prefix", ""),
+					resource.TestCheckResourceAttr(resourceName, "lambda_function.0.filter_suffix", ""),
+					resource.TestCheckResourceAttr(resourceName, "queue.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "topic.#", "0"),
 				),
 			},
 			{
@@ -119,35 +120,27 @@ func TestAccS3BucketNotification_LambdaFunctionLambdaFunctionARN_alias(t *testin
 
 func TestAccS3BucketNotification_queue(t *testing.T) {
 	ctx := acctest.Context(t)
+	var v s3.GetBucketNotificationConfigurationOutput
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_s3_bucket_notification.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketNotificationDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccBucketNotificationConfig_queue(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckBucketQueueNotification(ctx, "aws_s3_bucket.test",
-						"notification-sqs",
-						"aws_sqs_queue.test",
-						[]string{"s3:ObjectCreated:*", "s3:ObjectRemoved:Delete"},
-						&s3.KeyFilter{
-							FilterRules: []*s3.FilterRule{
-								{
-									Name:  aws.String("Prefix"),
-									Value: aws.String("tf-acc-test/"),
-								},
-								{
-									Name:  aws.String("Suffix"),
-									Value: aws.String(".mp4"),
-								},
-							},
-						},
-					),
+					testAccCheckBucketNotificationExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "eventbridge", "false"),
+					resource.TestCheckResourceAttr(resourceName, "lambda_function.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "queue.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "queue.0.events.#", "2"),
+					resource.TestCheckResourceAttr(resourceName, "queue.0.filter_prefix", "tf-acc-test/"),
+					resource.TestCheckResourceAttr(resourceName, "queue.0.filter_suffix", ".mp4"),
+					resource.TestCheckResourceAttr(resourceName, "topic.#", "0"),
 				),
 			},
 			{
@@ -161,24 +154,27 @@ func TestAccS3BucketNotification_queue(t *testing.T) {
 
 func TestAccS3BucketNotification_topic(t *testing.T) {
 	ctx := acctest.Context(t)
+	var v s3.GetBucketNotificationConfigurationOutput
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_s3_bucket_notification.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketNotificationDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccBucketNotificationConfig_topic(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckBucketTopicNotification(ctx, "aws_s3_bucket.test",
-						"notification-sns1",
-						"aws_sns_topic.test",
-						[]string{"s3:ObjectCreated:*", "s3:ObjectRemoved:Delete"},
-						nil,
-					),
+					testAccCheckBucketNotificationExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "eventbridge", "false"),
+					resource.TestCheckResourceAttr(resourceName, "lambda_function.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "queue.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "topic.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "topic.0.events.#", "2"),
+					resource.TestCheckResourceAttr(resourceName, "topic.0.filter_prefix", ""),
+					resource.TestCheckResourceAttr(resourceName, "topic.0.filter_suffix", ""),
 				),
 			},
 			{
@@ -192,48 +188,30 @@ func TestAccS3BucketNotification_topic(t *testing.T) {
 
 func TestAccS3BucketNotification_Topic_multiple(t *testing.T) {
 	ctx := acctest.Context(t)
+	var v s3.GetBucketNotificationConfigurationOutput
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_s3_bucket_notification.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketNotificationDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccBucketNotificationConfig_topicMultiple(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckBucketTopicNotification(ctx, "aws_s3_bucket.test",
-						"notification-sns1",
-						"aws_sns_topic.test",
-						[]string{"s3:ObjectCreated:*", "s3:ObjectRemoved:Delete"},
-						&s3.KeyFilter{
-							FilterRules: []*s3.FilterRule{
-								{
-									Name:  aws.String("Prefix"),
-									Value: aws.String("tf-acc-test/"),
-								},
-								{
-									Name:  aws.String("Suffix"),
-									Value: aws.String(".txt"),
-								},
-							},
-						},
-					),
-					testAccCheckBucketTopicNotification(ctx, "aws_s3_bucket.test",
-						"notification-sns2",
-						"aws_sns_topic.test",
-						[]string{"s3:ObjectCreated:*", "s3:ObjectRemoved:Delete"},
-						&s3.KeyFilter{
-							FilterRules: []*s3.FilterRule{
-								{
-									Name:  aws.String("Suffix"),
-									Value: aws.String(".log"),
-								},
-							},
-						},
-					),
+					testAccCheckBucketNotificationExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "eventbridge", "false"),
+					resource.TestCheckResourceAttr(resourceName, "lambda_function.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "queue.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "topic.#", "2"),
+					resource.TestCheckResourceAttr(resourceName, "topic.0.events.#", "2"),
+					resource.TestCheckResourceAttr(resourceName, "topic.0.filter_prefix", "tf-acc-test/"),
+					resource.TestCheckResourceAttr(resourceName, "topic.0.filter_suffix", ".txt"),
+					resource.TestCheckResourceAttr(resourceName, "topic.1.events.#", "2"),
+					resource.TestCheckResourceAttr(resourceName, "topic.1.filter_prefix", ""),
+					resource.TestCheckResourceAttr(resourceName, "topic.1.filter_suffix", ".log"),
 				),
 			},
 			{
@@ -247,45 +225,26 @@ func TestAccS3BucketNotification_Topic_multiple(t *testing.T) {
 
 func TestAccS3BucketNotification_update(t *testing.T) {
 	ctx := acctest.Context(t)
+	var v s3.GetBucketNotificationConfigurationOutput
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_s3_bucket_notification.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketNotificationDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccBucketNotificationConfig_topic(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckBucketTopicNotification(ctx, "aws_s3_bucket.test",
-						"notification-sns1",
-						"aws_sns_topic.test",
-						[]string{"s3:ObjectCreated:*", "s3:ObjectRemoved:Delete"},
-						nil,
-					),
+					testAccCheckBucketNotificationExists(ctx, resourceName, &v),
 				),
 			},
 			{
 				Config: testAccBucketNotificationConfig_queue(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckBucketQueueNotification(ctx, "aws_s3_bucket.test",
-						"notification-sqs",
-						"aws_sqs_queue.test",
-						[]string{"s3:ObjectCreated:*", "s3:ObjectRemoved:Delete"},
-						&s3.KeyFilter{
-							FilterRules: []*s3.FilterRule{
-								{
-									Name:  aws.String("Prefix"),
-									Value: aws.String("tf-acc-test/"),
-								},
-								{
-									Name:  aws.String("Suffix"),
-									Value: aws.String(".mp4"),
-								},
-							},
-						},
-					),
+					testAccCheckBucketNotificationExists(ctx, resourceName, &v),
 				),
 			},
 		},
@@ -294,239 +253,48 @@ func TestAccS3BucketNotification_update(t *testing.T) {
 
 func testAccCheckBucketNotificationDestroy(ctx context.Context) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Conn(ctx)
+		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Client(ctx)
 
 		for _, rs := range s.RootModule().Resources {
 			if rs.Type != "aws_s3_bucket_notification" {
 				continue
 			}
-			err := retry.RetryContext(ctx, 1*time.Minute, func() *retry.RetryError {
-				out, err := conn.GetBucketNotificationConfigurationWithContext(ctx, &s3.GetBucketNotificationConfigurationRequest{
-					Bucket: aws.String(rs.Primary.ID),
-				})
-
-				if tfawserr.ErrCodeEquals(err, s3.ErrCodeNoSuchBucket) {
-					return nil
-				}
-
-				if err != nil {
-					return retry.NonRetryableError(err)
-				}
-
-				if len(out.TopicConfigurations) > 0 {
-					return retry.RetryableError(fmt.Errorf("TopicConfigurations is exists: %v", out))
-				}
-				if len(out.LambdaFunctionConfigurations) > 0 {
-					return retry.RetryableError(fmt.Errorf("LambdaFunctionConfigurations is exists: %v", out))
-				}
-				if len(out.QueueConfigurations) > 0 {
-					return retry.RetryableError(fmt.Errorf("QueueConfigurations is exists: %v", out))
-				}
-
-				return nil
-			})
-
-			if err != nil {
-				return err
-			}
-		}
-		return nil
-	}
-}
-
-func testAccCheckBucketTopicNotification(ctx context.Context, n, i, t string, events []string, filters *s3.KeyFilter) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		rs := s.RootModule().Resources[n]
-		topicArn := s.RootModule().Resources[t].Primary.ID
-		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Conn(ctx)
-
-		err := retry.RetryContext(ctx, 1*time.Minute, func() *retry.RetryError {
-			out, err := conn.GetBucketNotificationConfigurationWithContext(ctx, &s3.GetBucketNotificationConfigurationRequest{
-				Bucket: aws.String(rs.Primary.ID),
-			})
-
-			if err != nil {
-				return retry.NonRetryableError(fmt.Errorf("GetBucketNotification error: %v", err))
-			}
-
-			eventSlice := sort.StringSlice(events)
-			eventSlice.Sort()
-
-			outputTopics := out.TopicConfigurations
-			matched := false
-			for _, outputTopic := range outputTopics {
-				if *outputTopic.Id == i {
-					matched = true
-
-					if *outputTopic.TopicArn != topicArn {
-						return retry.RetryableError(fmt.Errorf("bad topic arn, expected: %s, got %#v", topicArn, *outputTopic.TopicArn))
-					}
-
-					if filters != nil {
-						if !reflect.DeepEqual(filters, outputTopic.Filter.Key) {
-							return retry.RetryableError(fmt.Errorf("bad notification filters, expected: %#v, got %#v", filters, outputTopic.Filter.Key))
-						}
-					} else {
-						if outputTopic.Filter != nil {
-							return retry.RetryableError(fmt.Errorf("bad notification filters, expected: nil, got %#v", outputTopic.Filter))
-						}
-					}
-
-					outputEventSlice := sort.StringSlice(aws.StringValueSlice(outputTopic.Events))
-					outputEventSlice.Sort()
-					if !reflect.DeepEqual(eventSlice, outputEventSlice) {
-						return retry.RetryableError(fmt.Errorf("bad notification events, expected: %#v, got %#v", events, outputEventSlice))
-					}
-				}
-			}
-
-			if !matched {
-				return retry.RetryableError(fmt.Errorf("No match topic configurations: %#v", out))
-			}
-
-			return nil
-		})
-
-		return err
-	}
-}
-
-func testAccCheckBucketEventBridgeNotification(ctx context.Context, n string) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		rs := s.RootModule().Resources[n]
-		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Conn(ctx)
-
-		err := retry.RetryContext(ctx, 1*time.Minute, func() *retry.RetryError {
-			out, err := conn.GetBucketNotificationConfigurationWithContext(ctx, &s3.GetBucketNotificationConfigurationRequest{
-				Bucket: aws.String(rs.Primary.ID),
-			})
 
-			if err != nil {
-				return retry.NonRetryableError(fmt.Errorf("GetBucketNotification error: %v", err))
-			}
+			_, err := tfs3.FindBucketNotificationConfiguration(ctx, conn, rs.Primary.ID, "")
 
-			if out.EventBridgeConfiguration == nil {
-				return retry.RetryableError(fmt.Errorf("No EventBridge configuration: %#v", out))
-			} else {
-				return nil
+			if tfresource.NotFound(err) {
+				continue
 			}
-		})
-
-		return err
-	}
-}
-
-func testAccCheckBucketQueueNotification(ctx context.Context, n, i, t string, events []string, filters *s3.KeyFilter) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		rs := s.RootModule().Resources[n]
-		queueArn := s.RootModule().Resources[t].Primary.Attributes["arn"]
-		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Conn(ctx)
-
-		err := retry.RetryContext(ctx, 1*time.Minute, func() *retry.RetryError {
-			out, err := conn.GetBucketNotificationConfigurationWithContext(ctx, &s3.GetBucketNotificationConfigurationRequest{
-				Bucket: aws.String(rs.Primary.ID),
-			})
 
 			if err != nil {
-				return retry.NonRetryableError(fmt.Errorf("GetBucketNotification error: %v", err))
-			}
-
-			eventSlice := sort.StringSlice(events)
-			eventSlice.Sort()
-
-			outputQueues := out.QueueConfigurations
-			matched := false
-			for _, outputQueue := range outputQueues {
-				if *outputQueue.Id == i {
-					matched = true
-
-					if *outputQueue.QueueArn != queueArn {
-						return retry.RetryableError(fmt.Errorf("bad queue arn, expected: %s, got %#v", queueArn, *outputQueue.QueueArn))
-					}
-
-					if filters != nil {
-						if !reflect.DeepEqual(filters, outputQueue.Filter.Key) {
-							return retry.RetryableError(fmt.Errorf("bad notification filters, expected: %#v, got %#v", filters, outputQueue.Filter.Key))
-						}
-					} else {
-						if outputQueue.Filter != nil {
-							return retry.RetryableError(fmt.Errorf("bad notification filters, expected: nil, got %#v", outputQueue.Filter))
-						}
-					}
-
-					outputEventSlice := sort.StringSlice(aws.StringValueSlice(outputQueue.Events))
-					outputEventSlice.Sort()
-					if !reflect.DeepEqual(eventSlice, outputEventSlice) {
-						return retry.RetryableError(fmt.Errorf("bad notification events, expected: %#v, got %#v", events, outputEventSlice))
-					}
-				}
-			}
-
-			if !matched {
-				return retry.RetryableError(fmt.Errorf("No match queue configurations: %#v", out))
+				return err
 			}
 
-			return nil
-		})
+			return fmt.Errorf("S3 Bucket Notification %s still exists", rs.Primary.ID)
+		}
 
-		return err
+		return nil
 	}
 }
 
-func testAccCheckBucketLambdaFunctionConfiguration(ctx context.Context, n, i, t string, events []string, filters *s3.KeyFilter) resource.TestCheckFunc {
+func testAccCheckBucketNotificationExists(ctx context.Context, n string, v *s3.GetBucketNotificationConfigurationOutput) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		rs := s.RootModule().Resources[n]
-		funcArn := s.RootModule().Resources[t].Primary.Attributes["arn"]
-		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Conn(ctx)
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
 
-		err := retry.RetryContext(ctx, 1*time.Minute, func() *retry.RetryError {
-			out, err := conn.GetBucketNotificationConfigurationWithContext(ctx, &s3.GetBucketNotificationConfigurationRequest{
-				Bucket: aws.String(rs.Primary.ID),
-			})
+		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Client(ctx)
 
-			if err != nil {
-				return retry.NonRetryableError(fmt.Errorf("GetBucketNotification error: %v", err))
-			}
-
-			eventSlice := sort.StringSlice(events)
-			eventSlice.Sort()
-
-			outputFunctions := out.LambdaFunctionConfigurations
-			matched := false
-			for _, outputFunc := range outputFunctions {
-				if *outputFunc.Id == i {
-					matched = true
-
-					if *outputFunc.LambdaFunctionArn != funcArn {
-						return retry.RetryableError(fmt.Errorf("bad lambda function arn, expected: %s, got %#v", funcArn, *outputFunc.LambdaFunctionArn))
-					}
-
-					if filters != nil {
-						if !reflect.DeepEqual(filters, outputFunc.Filter.Key) {
-							return retry.RetryableError(fmt.Errorf("bad notification filters, expected: %#v, got %#v", filters, outputFunc.Filter.Key))
-						}
-					} else {
-						if outputFunc.Filter != nil {
-							return retry.RetryableError(fmt.Errorf("bad notification filters, expected: nil, got %#v", outputFunc.Filter))
-						}
-					}
-
-					outputEventSlice := sort.StringSlice(aws.StringValueSlice(outputFunc.Events))
-					outputEventSlice.Sort()
-					if !reflect.DeepEqual(eventSlice, outputEventSlice) {
-						return retry.RetryableError(fmt.Errorf("bad notification events, expected: %#v, got %#v", events, outputEventSlice))
-					}
-				}
-			}
+		output, err := tfs3.FindBucketNotificationConfiguration(ctx, conn, rs.Primary.ID, "")
 
-			if !matched {
-				return retry.RetryableError(fmt.Errorf("No match lambda function configurations: %#v", out))
-			}
+		if err != nil {
+			return err
+		}
 
-			return nil
-		})
+		*v = *output
 
-		return err
+		return nil
 	}
 }
 
diff --git a/internal/service/s3/bucket_object.go b/internal/service/s3/bucket_object.go
index 9150c60dacd..1a6fadf590a 100644
--- a/internal/service/s3/bucket_object.go
+++ b/internal/service/s3/bucket_object.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3
 
 // WARNING: This code is DEPRECATED and will be removed in a future release!!
@@ -12,18 +15,18 @@ import (
 	"io"
 	"log"
 	"os"
-	"regexp"
 	"strings"
-	"time"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/s3"
-	"github.com/aws/aws-sdk-go/service/s3/s3manager"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/feature/s3/manager"
+	"github.com/aws/aws-sdk-go-v2/service/s3"
+	"github.com/aws/aws-sdk-go-v2/service/s3/types"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/customdiff"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/enum"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
 	"github.com/hashicorp/terraform-provider-aws/internal/flex"
 	"github.com/hashicorp/terraform-provider-aws/internal/service/kms"
@@ -54,10 +57,10 @@ func ResourceBucketObject() *schema.Resource {
 
 		Schema: map[string]*schema.Schema{
 			"acl": {
-				Type:         schema.TypeString,
-				Default:      s3.ObjectCannedACLPrivate,
-				Optional:     true,
-				ValidateFunc: validation.StringInSlice(s3.ObjectCannedACL_Values(), false),
+				Type:             schema.TypeString,
+				Default:          types.ObjectCannedACLPrivate,
+				Optional:         true,
+				ValidateDiagFunc: enum.Validate[types.ObjectCannedACL](),
 			},
 			"bucket": {
 				Deprecated:   "Use the aws_s3_object resource instead",
@@ -130,7 +133,7 @@ func ResourceBucketObject() *schema.Resource {
 				ValidateFunc: verify.ValidARN,
 				DiffSuppressFunc: func(k, old, new string, d *schema.ResourceData) bool {
 					// ignore diffs where the user hasn't specified a kms_key_id but the bucket has a default KMS key configured
-					if new == "" && d.Get("server_side_encryption") == s3.ServerSideEncryptionAwsKms {
+					if new == "" && d.Get("server_side_encryption") == types.ServerSideEncryptionAwsKms {
 						return true
 					}
 					return false
@@ -143,14 +146,14 @@ func ResourceBucketObject() *schema.Resource {
 				Elem:         &schema.Schema{Type: schema.TypeString},
 			},
 			"object_lock_legal_hold_status": {
-				Type:         schema.TypeString,
-				Optional:     true,
-				ValidateFunc: validation.StringInSlice(s3.ObjectLockLegalHoldStatus_Values(), false),
+				Type:             schema.TypeString,
+				Optional:         true,
+				ValidateDiagFunc: enum.Validate[types.ObjectLockLegalHoldStatus](),
 			},
 			"object_lock_mode": {
-				Type:         schema.TypeString,
-				Optional:     true,
-				ValidateFunc: validation.StringInSlice(s3.ObjectLockMode_Values(), false),
+				Type:             schema.TypeString,
+				Optional:         true,
+				ValidateDiagFunc: enum.Validate[types.ObjectLockMode](),
 			},
 			"object_lock_retain_until_date": {
 				Type:         schema.TypeString,
@@ -158,10 +161,10 @@ func ResourceBucketObject() *schema.Resource {
 				ValidateFunc: validation.IsRFC3339Time,
 			},
 			"server_side_encryption": {
-				Type:         schema.TypeString,
-				Optional:     true,
-				ValidateFunc: validation.StringInSlice(s3.ServerSideEncryption_Values(), false),
-				Computed:     true,
+				Type:             schema.TypeString,
+				Optional:         true,
+				ValidateDiagFunc: enum.Validate[types.ServerSideEncryption](),
+				Computed:         true,
 			},
 			"source": {
 				Type:          schema.TypeString,
@@ -173,10 +176,10 @@ func ResourceBucketObject() *schema.Resource {
 				Optional: true,
 			},
 			"storage_class": {
-				Type:         schema.TypeString,
-				Optional:     true,
-				Computed:     true,
-				ValidateFunc: validation.StringInSlice(s3.ObjectStorageClass_Values(), false),
+				Type:             schema.TypeString,
+				Optional:         true,
+				Computed:         true,
+				ValidateDiagFunc: enum.Validate[types.ObjectStorageClass](),
 			},
 			names.AttrTags:    tftags.TagsSchema(),
 			names.AttrTagsAll: tftags.TagsSchemaComputed(),
@@ -201,13 +204,11 @@ func resourceBucketObjectCreate(ctx context.Context, d *schema.ResourceData, met
 
 func resourceBucketObjectRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).S3Conn(ctx)
+	conn := meta.(*conns.AWSClient).S3Client(ctx)
 
 	bucket := d.Get("bucket").(string)
-	key := d.Get("key").(string)
-	outputRaw, err := tfresource.RetryWhenNewResourceNotFound(ctx, objectCreationTimeout, func() (interface{}, error) {
-		return FindObjectByThreePartKey(ctx, conn, bucket, key, "")
-	}, d.IsNewResource())
+	key := sdkv1CompatibleCleanKey(d.Get("key").(string))
+	output, err := findObjectByBucketAndKey(ctx, conn, bucket, key, "", "")
 
 	if !d.IsNewResource() && tfresource.NotFound(err) {
 		log.Printf("[WARN] S3 Object (%s) not found, removing from state", d.Id())
@@ -219,59 +220,36 @@ func resourceBucketObjectRead(ctx context.Context, d *schema.ResourceData, meta
 		return sdkdiag.AppendErrorf(diags, "reading S3 Object (%s): %s", d.Id(), err)
 	}
 
-	output := outputRaw.(*s3.HeadObjectOutput)
-
 	d.Set("bucket_key_enabled", output.BucketKeyEnabled)
 	d.Set("cache_control", output.CacheControl)
 	d.Set("content_disposition", output.ContentDisposition)
 	d.Set("content_encoding", output.ContentEncoding)
 	d.Set("content_language", output.ContentLanguage)
 	d.Set("content_type", output.ContentType)
-	metadata := flex.PointersMapToStringList(output.Metadata)
-
-	// AWS Go SDK capitalizes metadata, this is a workaround. https://github.com/aws/aws-sdk-go/issues/445
-	for k, v := range metadata {
-		delete(metadata, k)
-		metadata[strings.ToLower(k)] = v
-	}
-
-	if err := d.Set("metadata", metadata); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting metadata: %s", err)
-	}
-	d.Set("version_id", output.VersionId)
-	d.Set("server_side_encryption", output.ServerSideEncryption)
-	d.Set("website_redirect", output.WebsiteRedirectLocation)
+	// See https://forums.aws.amazon.com/thread.jspa?threadID=44003
+	d.Set("etag", strings.Trim(aws.ToString(output.ETag), `"`))
+	d.Set("metadata", output.Metadata)
 	d.Set("object_lock_legal_hold_status", output.ObjectLockLegalHoldStatus)
 	d.Set("object_lock_mode", output.ObjectLockMode)
 	d.Set("object_lock_retain_until_date", flattenObjectDate(output.ObjectLockRetainUntilDate))
-
-	if err := resourceBucketObjectSetKMS(ctx, d, meta, output.SSEKMSKeyId); err != nil {
-		return sdkdiag.AppendErrorf(diags, "object KMS: %s", err)
-	}
-
-	// See https://forums.aws.amazon.com/thread.jspa?threadID=44003
-	d.Set("etag", strings.Trim(aws.StringValue(output.ETag), `"`))
-
+	d.Set("server_side_encryption", output.ServerSideEncryption)
 	// The "STANDARD" (which is also the default) storage
 	// class when set would not be included in the results.
-	d.Set("storage_class", s3.StorageClassStandard)
-	if output.StorageClass != nil { // nosemgrep: ci.helper-schema-ResourceData-Set-extraneous-nil-check
+	d.Set("storage_class", types.ObjectStorageClassStandard)
+	if output.StorageClass != "" {
 		d.Set("storage_class", output.StorageClass)
 	}
+	d.Set("version_id", output.VersionId)
+	d.Set("website_redirect", output.WebsiteRedirectLocation)
 
-	// Retry due to S3 eventual consistency
-	tagsRaw, err := tfresource.RetryWhenAWSErrCodeEquals(ctx, 2*time.Minute, func() (interface{}, error) {
-		return ObjectListTags(ctx, conn, bucket, key)
-	}, s3.ErrCodeNoSuchBucket)
-
-	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "listing tags for S3 Bucket (%s) Object (%s): %s", bucket, key, err)
+	if err := resourceBucketObjectSetKMS(ctx, d, meta, output.SSEKMSKeyId); err != nil {
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
-	tags, ok := tagsRaw.(tftags.KeyValueTags)
+	tags, err := ObjectListTags(ctx, conn, bucket, key)
 
-	if !ok {
-		return sdkdiag.AppendErrorf(diags, "listing tags for S3 Bucket (%s) Object (%s): unable to convert tags", bucket, key)
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "listing tags for S3 Bucket (%s) Object (%s): %s", bucket, key, err)
 	}
 
 	setTagsOut(ctx, Tags(tags))
@@ -285,41 +263,47 @@ func resourceBucketObjectUpdate(ctx context.Context, d *schema.ResourceData, met
 		return append(diags, resourceBucketObjectUpload(ctx, d, meta)...)
 	}
 
-	conn := meta.(*conns.AWSClient).S3Conn(ctx)
+	conn := meta.(*conns.AWSClient).S3Client(ctx)
 
 	bucket := d.Get("bucket").(string)
-	key := d.Get("key").(string)
+	key := sdkv1CompatibleCleanKey(d.Get("key").(string))
 
 	if d.HasChange("acl") {
-		_, err := conn.PutObjectAclWithContext(ctx, &s3.PutObjectAclInput{
+		input := &s3.PutObjectAclInput{
+			ACL:    types.ObjectCannedACL(d.Get("acl").(string)),
 			Bucket: aws.String(bucket),
 			Key:    aws.String(key),
-			ACL:    aws.String(d.Get("acl").(string)),
-		})
+		}
+
+		_, err := conn.PutObjectAcl(ctx, input)
+
 		if err != nil {
-			return sdkdiag.AppendErrorf(diags, "putting S3 object ACL: %s", err)
+			return sdkdiag.AppendErrorf(diags, "putting S3 Object (%s) ACL: %s", d.Id(), err)
 		}
 	}
 
 	if d.HasChange("object_lock_legal_hold_status") {
-		_, err := conn.PutObjectLegalHoldWithContext(ctx, &s3.PutObjectLegalHoldInput{
+		input := &s3.PutObjectLegalHoldInput{
 			Bucket: aws.String(bucket),
 			Key:    aws.String(key),
-			LegalHold: &s3.ObjectLockLegalHold{
-				Status: aws.String(d.Get("object_lock_legal_hold_status").(string)),
+			LegalHold: &types.ObjectLockLegalHold{
+				Status: types.ObjectLockLegalHoldStatus(d.Get("object_lock_legal_hold_status").(string)),
 			},
-		})
+		}
+
+		_, err := conn.PutObjectLegalHold(ctx, input)
+
 		if err != nil {
-			return sdkdiag.AppendErrorf(diags, "putting S3 object lock legal hold: %s", err)
+			return sdkdiag.AppendErrorf(diags, "putting S3 Object (%s) legal hold: %s", d.Id(), err)
 		}
 	}
 
 	if d.HasChanges("object_lock_mode", "object_lock_retain_until_date") {
-		req := &s3.PutObjectRetentionInput{
+		input := &s3.PutObjectRetentionInput{
 			Bucket: aws.String(bucket),
 			Key:    aws.String(key),
-			Retention: &s3.ObjectLockRetention{
-				Mode:            aws.String(d.Get("object_lock_mode").(string)),
+			Retention: &types.ObjectLockRetention{
+				Mode:            types.ObjectLockRetentionMode(d.Get("object_lock_mode").(string)),
 				RetainUntilDate: expandObjectDate(d.Get("object_lock_retain_until_date").(string)),
 			},
 		}
@@ -327,16 +311,17 @@ func resourceBucketObjectUpdate(ctx context.Context, d *schema.ResourceData, met
 		// Bypass required to lower or clear retain-until date.
 		if d.HasChange("object_lock_retain_until_date") {
 			oraw, nraw := d.GetChange("object_lock_retain_until_date")
-			o := expandObjectDate(oraw.(string))
-			n := expandObjectDate(nraw.(string))
+			o, n := expandObjectDate(oraw.(string)), expandObjectDate(nraw.(string))
+
 			if n == nil || (o != nil && n.Before(*o)) {
-				req.BypassGovernanceRetention = aws.Bool(true)
+				input.BypassGovernanceRetention = true
 			}
 		}
 
-		_, err := conn.PutObjectRetentionWithContext(ctx, req)
+		_, err := conn.PutObjectRetention(ctx, input)
+
 		if err != nil {
-			return sdkdiag.AppendErrorf(diags, "putting S3 object lock retention: %s", err)
+			return sdkdiag.AppendErrorf(diags, "putting S3 Object (%s) retention: %s", d.Id(), err)
 		}
 	}
 
@@ -344,7 +329,7 @@ func resourceBucketObjectUpdate(ctx context.Context, d *schema.ResourceData, met
 		o, n := d.GetChange("tags_all")
 
 		if err := ObjectUpdateTags(ctx, conn, bucket, key, o, n); err != nil {
-			return sdkdiag.AppendErrorf(diags, "updating S3 Bucket (%s) Object (%s) tags: %s", bucket, key, err)
+			return sdkdiag.AppendErrorf(diags, "updating tags: %s", err)
 		}
 	}
 
@@ -353,18 +338,14 @@ func resourceBucketObjectUpdate(ctx context.Context, d *schema.ResourceData, met
 
 func resourceBucketObjectDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).S3Conn(ctx)
+	conn := meta.(*conns.AWSClient).S3Client(ctx)
 
 	bucket := d.Get("bucket").(string)
-	key := d.Get("key").(string)
-	// We are effectively ignoring all leading '/'s in the key name and
-	// treating multiple '/'s as a single '/' as aws.Config.DisableRestProtocolURICleaning is false
-	key = strings.TrimLeft(key, "/")
-	key = regexp.MustCompile(`/+`).ReplaceAllString(key, "/")
+	key := sdkv1CompatibleCleanKey(d.Get("key").(string))
 
 	var err error
 	if _, ok := d.GetOk("version_id"); ok {
-		_, err = DeleteAllObjectVersions(ctx, conn, bucket, key, d.Get("force_destroy").(bool), false)
+		_, err = deleteAllObjectVersions(ctx, conn, bucket, key, d.Get("force_destroy").(bool), false)
 	} else {
 		err = deleteObjectVersion(ctx, conn, bucket, key, "", false)
 	}
@@ -397,8 +378,8 @@ func resourceBucketObjectImport(ctx context.Context, d *schema.ResourceData, met
 
 func resourceBucketObjectUpload(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).S3Conn(ctx)
-	uploader := s3manager.NewUploaderWithClient(conn)
+	conn := meta.(*conns.AWSClient).S3Client(ctx)
+	uploader := manager.NewUploader(conn)
 	defaultTagsConfig := meta.(*conns.AWSClient).DefaultTagsConfig
 	tags := defaultTagsConfig.MergeTags(tftags.New(ctx, d.Get("tags").(map[string]interface{})))
 
@@ -438,30 +419,26 @@ func resourceBucketObjectUpload(ctx context.Context, d *schema.ResourceData, met
 		body = bytes.NewReader([]byte{})
 	}
 
-	bucket := d.Get("bucket").(string)
-	key := d.Get("key").(string)
-
-	input := &s3manager.UploadInput{
-		ACL:    aws.String(d.Get("acl").(string)),
+	input := &s3.PutObjectInput{
 		Body:   body,
-		Bucket: aws.String(bucket),
-		Key:    aws.String(key),
+		Bucket: aws.String(d.Get("bucket").(string)),
+		Key:    aws.String(sdkv1CompatibleCleanKey(d.Get("key").(string))),
 	}
 
-	if v, ok := d.GetOk("storage_class"); ok {
-		input.StorageClass = aws.String(v.(string))
+	if v, ok := d.GetOk("acl"); ok {
+		input.ACL = types.ObjectCannedACL(v.(string))
 	}
 
-	if v, ok := d.GetOk("cache_control"); ok {
-		input.CacheControl = aws.String(v.(string))
+	if v, ok := d.GetOk("bucket_key_enabled"); ok {
+		input.BucketKeyEnabled = v.(bool)
 	}
 
-	if v, ok := d.GetOk("content_type"); ok {
-		input.ContentType = aws.String(v.(string))
+	if v, ok := d.GetOk("cache_control"); ok {
+		input.CacheControl = aws.String(v.(string))
 	}
 
-	if v, ok := d.GetOk("metadata"); ok {
-		input.Metadata = flex.ExpandStringMap(v.(map[string]interface{}))
+	if v, ok := d.GetOk("content_disposition"); ok {
+		input.ContentDisposition = aws.String(v.(string))
 	}
 
 	if v, ok := d.GetOk("content_encoding"); ok {
@@ -472,21 +449,37 @@ func resourceBucketObjectUpload(ctx context.Context, d *schema.ResourceData, met
 		input.ContentLanguage = aws.String(v.(string))
 	}
 
-	if v, ok := d.GetOk("content_disposition"); ok {
-		input.ContentDisposition = aws.String(v.(string))
+	if v, ok := d.GetOk("content_type"); ok {
+		input.ContentType = aws.String(v.(string))
 	}
 
-	if v, ok := d.GetOk("bucket_key_enabled"); ok {
-		input.BucketKeyEnabled = aws.Bool(v.(bool))
+	if v, ok := d.GetOk("kms_key_id"); ok {
+		input.SSEKMSKeyId = aws.String(v.(string))
+		input.ServerSideEncryption = types.ServerSideEncryptionAwsKms
+	}
+
+	if v, ok := d.GetOk("metadata"); ok {
+		input.Metadata = flex.ExpandStringValueMap(v.(map[string]interface{}))
+	}
+
+	if v, ok := d.GetOk("object_lock_legal_hold_status"); ok {
+		input.ObjectLockLegalHoldStatus = types.ObjectLockLegalHoldStatus(v.(string))
+	}
+
+	if v, ok := d.GetOk("object_lock_mode"); ok {
+		input.ObjectLockMode = types.ObjectLockMode(v.(string))
+	}
+
+	if v, ok := d.GetOk("object_lock_retain_until_date"); ok {
+		input.ObjectLockRetainUntilDate = expandObjectDate(v.(string))
 	}
 
 	if v, ok := d.GetOk("server_side_encryption"); ok {
-		input.ServerSideEncryption = aws.String(v.(string))
+		input.ServerSideEncryption = types.ServerSideEncryption(v.(string))
 	}
 
-	if v, ok := d.GetOk("kms_key_id"); ok {
-		input.SSEKMSKeyId = aws.String(v.(string))
-		input.ServerSideEncryption = aws.String(s3.ServerSideEncryptionAwsKms)
+	if v, ok := d.GetOk("storage_class"); ok {
+		input.StorageClass = types.StorageClass(v.(string))
 	}
 
 	if len(tags) > 0 {
@@ -498,24 +491,20 @@ func resourceBucketObjectUpload(ctx context.Context, d *schema.ResourceData, met
 		input.WebsiteRedirectLocation = aws.String(v.(string))
 	}
 
-	if v, ok := d.GetOk("object_lock_legal_hold_status"); ok {
-		input.ObjectLockLegalHoldStatus = aws.String(v.(string))
+	if (input.ObjectLockLegalHoldStatus != "" || input.ObjectLockMode != "" || input.ObjectLockRetainUntilDate != nil) && input.ChecksumAlgorithm == "" {
+		// "Content-MD5 OR x-amz-checksum- HTTP header is required for Put Object requests with Object Lock parameters".
+		// AWS SDK for Go v1 transparently added a Content-MD4 header.
+		input.ChecksumAlgorithm = types.ChecksumAlgorithmCrc32
 	}
 
-	if v, ok := d.GetOk("object_lock_mode"); ok {
-		input.ObjectLockMode = aws.String(v.(string))
+	if _, err := uploader.Upload(ctx, input); err != nil {
+		return sdkdiag.AppendErrorf(diags, "uploading S3 Object (%s) to Bucket (%s): %s", aws.ToString(input.Key), aws.ToString(input.Bucket), err)
 	}
 
-	if v, ok := d.GetOk("object_lock_retain_until_date"); ok {
-		input.ObjectLockRetainUntilDate = expandObjectDate(v.(string))
-	}
-
-	if _, err := uploader.Upload(input); err != nil {
-		return sdkdiag.AppendErrorf(diags, "uploading object to S3 bucket (%s): %s", bucket, err)
+	if d.IsNewResource() {
+		d.SetId(d.Get("key").(string))
 	}
 
-	d.SetId(key)
-
 	return append(diags, resourceBucketObjectRead(ctx, d, meta)...)
 }
 
@@ -529,8 +518,8 @@ func resourceBucketObjectSetKMS(ctx context.Context, d *schema.ResourceData, met
 			return fmt.Errorf("Failed to describe default S3 KMS key (%s): %s", DefaultKMSKeyAlias, err)
 		}
 
-		if aws.StringValue(sseKMSKeyId) != aws.StringValue(keyMetadata.Arn) {
-			log.Printf("[DEBUG] S3 object is encrypted using a non-default KMS Key ID: %s", aws.StringValue(sseKMSKeyId))
+		if kmsKeyID := aws.ToString(sseKMSKeyId); kmsKeyID != aws.ToString(keyMetadata.Arn) {
+			log.Printf("[DEBUG] S3 object is encrypted using a non-default KMS Key ID: %s", kmsKeyID)
 			d.Set("kms_key_id", sseKMSKeyId)
 		}
 	}
diff --git a/internal/service/s3/bucket_object_data_source.go b/internal/service/s3/bucket_object_data_source.go
index 216d08e86e3..a81a16531c6 100644
--- a/internal/service/s3/bucket_object_data_source.go
+++ b/internal/service/s3/bucket_object_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3
 
 // WARNING: This code is DEPRECATED and will be removed in a future release!!
@@ -7,18 +10,16 @@ package s3
 import (
 	"bytes"
 	"context"
-	"fmt"
-	"log"
 	"strings"
 	"time"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/s3"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/s3"
+	"github.com/aws/aws-sdk-go-v2/service/s3/types"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
-	"github.com/hashicorp/terraform-provider-aws/internal/flex"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 )
 
@@ -118,6 +119,7 @@ func DataSourceBucketObject() *schema.Resource {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
+			"tags": tftags.TagsSchemaComputed(),
 			"version_id": {
 				Type:     schema.TypeString,
 				Optional: true,
@@ -127,8 +129,6 @@ func DataSourceBucketObject() *schema.Resource {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
-
-			"tags": tftags.TagsSchemaComputed(),
 		},
 
 		DeprecationMessage: `use the aws_s3_object data source instead`,
@@ -137,13 +137,12 @@ func DataSourceBucketObject() *schema.Resource {
 
 func dataSourceBucketObjectRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).S3Conn(ctx)
+	conn := meta.(*conns.AWSClient).S3Client(ctx)
 	ignoreTagsConfig := meta.(*conns.AWSClient).IgnoreTagsConfig
 
 	bucket := d.Get("bucket").(string)
-	key := d.Get("key").(string)
-
-	input := s3.HeadObjectInput{
+	key := sdkv1CompatibleCleanKey(d.Get("key").(string))
+	input := &s3.HeadObjectInput{
 		Bucket: aws.String(bucket),
 		Key:    aws.String(key),
 	}
@@ -154,25 +153,21 @@ func dataSourceBucketObjectRead(ctx context.Context, d *schema.ResourceData, met
 		input.VersionId = aws.String(v.(string))
 	}
 
-	versionText := ""
-	uniqueId := bucket + "/" + key
-	if v, ok := d.GetOk("version_id"); ok {
-		versionText = fmt.Sprintf(" of version %q", v.(string))
-		uniqueId += "@" + v.(string)
-	}
+	out, err := findObject(ctx, conn, input)
 
-	log.Printf("[DEBUG] Reading S3 Object: %s", input)
-	out, err := conn.HeadObjectWithContext(ctx, &input)
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "getting S3 Bucket (%s) Object (%s): %s", bucket, key, err)
-	}
-	if aws.BoolValue(out.DeleteMarker) {
-		return sdkdiag.AppendErrorf(diags, "Requested S3 object %q%s has been deleted", bucket+key, versionText)
+		return sdkdiag.AppendErrorf(diags, "reading S3 Bucket (%s) Object (%s): %s", bucket, key, err)
 	}
 
-	log.Printf("[DEBUG] Received S3 object: %s", out)
+	if out.DeleteMarker {
+		return sdkdiag.AppendErrorf(diags, "S3 Bucket (%s) Object (%s) has been deleted", bucket, key)
+	}
 
-	d.SetId(uniqueId)
+	id := bucket + "/" + d.Get("key").(string)
+	if v, ok := d.GetOk("version_id"); ok {
+		id += "@" + v.(string)
+	}
+	d.SetId(id)
 
 	d.Set("bucket_key_enabled", out.BucketKeyEnabled)
 	d.Set("cache_control", out.CacheControl)
@@ -182,62 +177,55 @@ func dataSourceBucketObjectRead(ctx context.Context, d *schema.ResourceData, met
 	d.Set("content_length", out.ContentLength)
 	d.Set("content_type", out.ContentType)
 	// See https://forums.aws.amazon.com/thread.jspa?threadID=44003
-	d.Set("etag", strings.Trim(aws.StringValue(out.ETag), `"`))
+	d.Set("etag", strings.Trim(aws.ToString(out.ETag), `"`))
 	d.Set("expiration", out.Expiration)
-	d.Set("expires", out.Expires)
+	if out.Expires != nil {
+		d.Set("expires", out.Expires.Format(time.RFC1123))
+	} else {
+		d.Set("expires", nil)
+	}
 	if out.LastModified != nil {
 		d.Set("last_modified", out.LastModified.Format(time.RFC1123))
 	} else {
 		d.Set("last_modified", "")
 	}
-	d.Set("metadata", flex.PointersMapToStringList(out.Metadata))
+	d.Set("metadata", out.Metadata)
 	d.Set("object_lock_legal_hold_status", out.ObjectLockLegalHoldStatus)
 	d.Set("object_lock_mode", out.ObjectLockMode)
 	d.Set("object_lock_retain_until_date", flattenObjectDate(out.ObjectLockRetainUntilDate))
 	d.Set("server_side_encryption", out.ServerSideEncryption)
 	d.Set("sse_kms_key_id", out.SSEKMSKeyId)
-	d.Set("version_id", out.VersionId)
-	d.Set("website_redirect_location", out.WebsiteRedirectLocation)
-
 	// The "STANDARD" (which is also the default) storage
 	// class when set would not be included in the results.
-	d.Set("storage_class", s3.StorageClassStandard)
-	if out.StorageClass != nil { // nosemgrep: ci.helper-schema-ResourceData-Set-extraneous-nil-check
+	d.Set("storage_class", types.ObjectStorageClassStandard)
+	if out.StorageClass != "" {
 		d.Set("storage_class", out.StorageClass)
 	}
+	d.Set("version_id", out.VersionId)
+	d.Set("website_redirect_location", out.WebsiteRedirectLocation)
 
 	if isContentTypeAllowed(out.ContentType) {
-		input := s3.GetObjectInput{
-			Bucket: aws.String(bucket),
-			Key:    aws.String(key),
+		input := &s3.GetObjectInput{
+			Bucket:    aws.String(bucket),
+			Key:       aws.String(key),
+			VersionId: out.VersionId,
 		}
 		if v, ok := d.GetOk("range"); ok {
 			input.Range = aws.String(v.(string))
 		}
-		if out.VersionId != nil {
-			input.VersionId = out.VersionId
-		}
-		out, err := conn.GetObjectWithContext(ctx, &input)
+
+		out, err := conn.GetObject(ctx, input)
+
 		if err != nil {
-			return sdkdiag.AppendErrorf(diags, "Failed getting S3 object: %s", err)
+			return sdkdiag.AppendErrorf(diags, "downloading S3 Bucket (%s) Object (%s): %s", bucket, key, err)
 		}
 
 		buf := new(bytes.Buffer)
-		bytesRead, err := buf.ReadFrom(out.Body)
-		if err != nil {
-			return sdkdiag.AppendErrorf(diags, "Failed reading content of S3 object (%s): %s", uniqueId, err)
-		}
-		log.Printf("[INFO] Saving %d bytes from S3 object %s", bytesRead, uniqueId)
-		d.Set("body", buf.String())
-	} else {
-		contentType := ""
-		if out.ContentType == nil {
-			contentType = "<EMPTY>"
-		} else {
-			contentType = aws.StringValue(out.ContentType)
+		if _, err := buf.ReadFrom(out.Body); err != nil {
+			return sdkdiag.AppendFromErr(diags, err)
 		}
 
-		log.Printf("[INFO] Ignoring body of S3 object %s with Content-Type %q", uniqueId, contentType)
+		d.Set("body", buf.String())
 	}
 
 	tags, err := ObjectListTags(ctx, conn, bucket, key)
diff --git a/internal/service/s3/bucket_object_data_source_test.go b/internal/service/s3/bucket_object_data_source_test.go
index 1d3f3221a69..a2a9d22d592 100644
--- a/internal/service/s3/bucket_object_data_source_test.go
+++ b/internal/service/s3/bucket_object_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3_test
 
 // WARNING: This code is DEPRECATED and will be removed in a future release!!
@@ -6,41 +9,36 @@ package s3_test
 
 import (
 	"fmt"
-	"regexp"
 	"testing"
 	"time"
 
-	"github.com/aws/aws-sdk-go/service/s3"
+	"github.com/YakDriver/regexache"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
+	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
 func TestAccS3BucketObjectDataSource_basic(t *testing.T) {
 	ctx := acctest.Context(t)
 	rInt := sdkacctest.RandInt()
 
-	var rObj s3.GetObjectOutput
-	var dsObj s3.GetObjectOutput
-
 	resourceName := "aws_s3_object.object"
 	dataSourceName := "data.aws_s3_object.obj"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                  func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:                acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:                acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories:  acctest.ProtoV5ProviderFactories,
 		PreventPostDestroyRefresh: true,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccBucketObjectDataSourceConfig_basic(rInt),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckObjectExists(ctx, resourceName, &rObj),
-					testAccCheckObjectExistsDataSource(ctx, dataSourceName, &dsObj),
 					resource.TestCheckResourceAttr(dataSourceName, "content_length", "11"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "content_type", resourceName, "content_type"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "etag", resourceName, "etag"),
-					resource.TestMatchResourceAttr(dataSourceName, "last_modified", regexp.MustCompile(rfc1123RegexPattern)),
+					resource.TestMatchResourceAttr(dataSourceName, "last_modified", regexache.MustCompile(rfc1123RegexPattern)),
 					resource.TestCheckResourceAttrPair(dataSourceName, "object_lock_legal_hold_status", resourceName, "object_lock_legal_hold_status"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "object_lock_mode", resourceName, "object_lock_mode"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "object_lock_retain_until_date", resourceName, "object_lock_retain_until_date"),
@@ -53,7 +51,6 @@ func TestAccS3BucketObjectDataSource_basic(t *testing.T) {
 
 func TestAccS3BucketObjectDataSource_basicViaAccessPoint(t *testing.T) {
 	ctx := acctest.Context(t)
-	var dsObj, rObj s3.GetObjectOutput
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	dataSourceName := "data.aws_s3_object.test"
@@ -62,15 +59,12 @@ func TestAccS3BucketObjectDataSource_basicViaAccessPoint(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccBucketObjectDataSourceConfig_basicViaAccessPoint(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckObjectExists(ctx, resourceName, &rObj),
-					testAccCheckObjectExistsDataSource(ctx, dataSourceName, &dsObj),
-					testAccCheckObjectExists(ctx, resourceName, &rObj),
 					resource.TestCheckResourceAttrPair(dataSourceName, "bucket", accessPointResourceName, "arn"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "key", resourceName, "key"),
 				),
@@ -83,27 +77,22 @@ func TestAccS3BucketObjectDataSource_readableBody(t *testing.T) {
 	ctx := acctest.Context(t)
 	rInt := sdkacctest.RandInt()
 
-	var rObj s3.GetObjectOutput
-	var dsObj s3.GetObjectOutput
-
 	resourceName := "aws_s3_object.object"
 	dataSourceName := "data.aws_s3_object.obj"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                  func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:                acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:                acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories:  acctest.ProtoV5ProviderFactories,
 		PreventPostDestroyRefresh: true,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccBucketObjectDataSourceConfig_readableBody(rInt),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckObjectExists(ctx, resourceName, &rObj),
-					testAccCheckObjectExistsDataSource(ctx, dataSourceName, &dsObj),
 					resource.TestCheckResourceAttr(dataSourceName, "content_length", "3"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "content_type", resourceName, "content_type"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "etag", resourceName, "etag"),
-					resource.TestMatchResourceAttr(dataSourceName, "last_modified", regexp.MustCompile(rfc1123RegexPattern)),
+					resource.TestMatchResourceAttr(dataSourceName, "last_modified", regexache.MustCompile(rfc1123RegexPattern)),
 					resource.TestCheckResourceAttrPair(dataSourceName, "object_lock_legal_hold_status", resourceName, "object_lock_legal_hold_status"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "object_lock_mode", resourceName, "object_lock_mode"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "object_lock_retain_until_date", resourceName, "object_lock_retain_until_date"),
@@ -118,29 +107,24 @@ func TestAccS3BucketObjectDataSource_kmsEncrypted(t *testing.T) {
 	ctx := acctest.Context(t)
 	rInt := sdkacctest.RandInt()
 
-	var rObj s3.GetObjectOutput
-	var dsObj s3.GetObjectOutput
-
 	resourceName := "aws_s3_object.object"
 	dataSourceName := "data.aws_s3_object.obj"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                  func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:                acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:                acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories:  acctest.ProtoV5ProviderFactories,
 		PreventPostDestroyRefresh: true,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccBucketObjectDataSourceConfig_kmsEncrypted(rInt),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckObjectExists(ctx, resourceName, &rObj),
-					testAccCheckObjectExistsDataSource(ctx, dataSourceName, &dsObj),
 					resource.TestCheckResourceAttr(dataSourceName, "content_length", "22"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "content_type", resourceName, "content_type"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "etag", resourceName, "etag"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "server_side_encryption", resourceName, "server_side_encryption"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "sse_kms_key_id", resourceName, "kms_key_id"),
-					resource.TestMatchResourceAttr(dataSourceName, "last_modified", regexp.MustCompile(rfc1123RegexPattern)),
+					resource.TestMatchResourceAttr(dataSourceName, "last_modified", regexache.MustCompile(rfc1123RegexPattern)),
 					resource.TestCheckResourceAttrPair(dataSourceName, "object_lock_legal_hold_status", resourceName, "object_lock_legal_hold_status"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "object_lock_mode", resourceName, "object_lock_mode"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "object_lock_retain_until_date", resourceName, "object_lock_retain_until_date"),
@@ -155,30 +139,25 @@ func TestAccS3BucketObjectDataSource_bucketKeyEnabled(t *testing.T) {
 	ctx := acctest.Context(t)
 	rInt := sdkacctest.RandInt()
 
-	var rObj s3.GetObjectOutput
-	var dsObj s3.GetObjectOutput
-
 	resourceName := "aws_s3_object.object"
 	dataSourceName := "data.aws_s3_object.obj"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                  func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:                acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:                acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories:  acctest.ProtoV5ProviderFactories,
 		PreventPostDestroyRefresh: true,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccBucketObjectDataSourceConfig_keyEnabled(rInt),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckObjectExists(ctx, resourceName, &rObj),
-					testAccCheckObjectExistsDataSource(ctx, dataSourceName, &dsObj),
 					resource.TestCheckResourceAttr(dataSourceName, "content_length", "22"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "content_type", resourceName, "content_type"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "etag", resourceName, "etag"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "server_side_encryption", resourceName, "server_side_encryption"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "sse_kms_key_id", resourceName, "kms_key_id"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "bucket_key_enabled", resourceName, "bucket_key_enabled"),
-					resource.TestMatchResourceAttr(dataSourceName, "last_modified", regexp.MustCompile(rfc1123RegexPattern)),
+					resource.TestMatchResourceAttr(dataSourceName, "last_modified", regexache.MustCompile(rfc1123RegexPattern)),
 					resource.TestCheckResourceAttrPair(dataSourceName, "object_lock_legal_hold_status", resourceName, "object_lock_legal_hold_status"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "object_lock_mode", resourceName, "object_lock_mode"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "object_lock_retain_until_date", resourceName, "object_lock_retain_until_date"),
@@ -193,27 +172,22 @@ func TestAccS3BucketObjectDataSource_allParams(t *testing.T) {
 	ctx := acctest.Context(t)
 	rInt := sdkacctest.RandInt()
 
-	var rObj s3.GetObjectOutput
-	var dsObj s3.GetObjectOutput
-
 	resourceName := "aws_s3_object.object"
 	dataSourceName := "data.aws_s3_object.obj"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                  func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:                acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:                acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories:  acctest.ProtoV5ProviderFactories,
 		PreventPostDestroyRefresh: true,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccBucketObjectDataSourceConfig_allParams(rInt),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckObjectExists(ctx, resourceName, &rObj),
-					testAccCheckObjectExistsDataSource(ctx, dataSourceName, &dsObj),
 					resource.TestCheckResourceAttr(dataSourceName, "content_length", "25"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "content_type", resourceName, "content_type"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "etag", resourceName, "etag"),
-					resource.TestMatchResourceAttr(dataSourceName, "last_modified", regexp.MustCompile(rfc1123RegexPattern)),
+					resource.TestMatchResourceAttr(dataSourceName, "last_modified", regexache.MustCompile(rfc1123RegexPattern)),
 					resource.TestCheckResourceAttrPair(dataSourceName, "version_id", resourceName, "version_id"),
 					resource.TestCheckNoResourceAttr(dataSourceName, "body"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "bucket_key_enabled", resourceName, "bucket_key_enabled"),
@@ -245,27 +219,22 @@ func TestAccS3BucketObjectDataSource_objectLockLegalHoldOff(t *testing.T) {
 	ctx := acctest.Context(t)
 	rInt := sdkacctest.RandInt()
 
-	var rObj s3.GetObjectOutput
-	var dsObj s3.GetObjectOutput
-
 	resourceName := "aws_s3_object.object"
 	dataSourceName := "data.aws_s3_object.obj"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                  func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:                acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:                acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories:  acctest.ProtoV5ProviderFactories,
 		PreventPostDestroyRefresh: true,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccBucketObjectDataSourceConfig_lockLegalHoldOff(rInt),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckObjectExists(ctx, resourceName, &rObj),
-					testAccCheckObjectExistsDataSource(ctx, dataSourceName, &dsObj),
 					resource.TestCheckResourceAttr(dataSourceName, "content_length", "11"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "content_type", resourceName, "content_type"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "etag", resourceName, "etag"),
-					resource.TestMatchResourceAttr(dataSourceName, "last_modified", regexp.MustCompile(rfc1123RegexPattern)),
+					resource.TestMatchResourceAttr(dataSourceName, "last_modified", regexache.MustCompile(rfc1123RegexPattern)),
 					resource.TestCheckResourceAttrPair(dataSourceName, "object_lock_legal_hold_status", resourceName, "object_lock_legal_hold_status"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "object_lock_mode", resourceName, "object_lock_mode"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "object_lock_retain_until_date", resourceName, "object_lock_retain_until_date"),
@@ -281,27 +250,22 @@ func TestAccS3BucketObjectDataSource_objectLockLegalHoldOn(t *testing.T) {
 	rInt := sdkacctest.RandInt()
 	retainUntilDate := time.Now().UTC().AddDate(0, 0, 10).Format(time.RFC3339)
 
-	var rObj s3.GetObjectOutput
-	var dsObj s3.GetObjectOutput
-
 	resourceName := "aws_s3_object.object"
 	dataSourceName := "data.aws_s3_object.obj"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                  func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:                acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:                acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories:  acctest.ProtoV5ProviderFactories,
 		PreventPostDestroyRefresh: true,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccBucketObjectDataSourceConfig_lockLegalHoldOn(rInt, retainUntilDate),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckObjectExists(ctx, resourceName, &rObj),
-					testAccCheckObjectExistsDataSource(ctx, dataSourceName, &dsObj),
 					resource.TestCheckResourceAttr(dataSourceName, "content_length", "11"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "content_type", resourceName, "content_type"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "etag", resourceName, "etag"),
-					resource.TestMatchResourceAttr(dataSourceName, "last_modified", regexp.MustCompile(rfc1123RegexPattern)),
+					resource.TestMatchResourceAttr(dataSourceName, "last_modified", regexache.MustCompile(rfc1123RegexPattern)),
 					resource.TestCheckResourceAttrPair(dataSourceName, "object_lock_legal_hold_status", resourceName, "object_lock_legal_hold_status"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "object_lock_mode", resourceName, "object_lock_mode"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "object_lock_retain_until_date", resourceName, "object_lock_retain_until_date"),
@@ -314,8 +278,6 @@ func TestAccS3BucketObjectDataSource_objectLockLegalHoldOn(t *testing.T) {
 
 func TestAccS3BucketObjectDataSource_leadingSlash(t *testing.T) {
 	ctx := acctest.Context(t)
-	var rObj s3.GetObjectOutput
-	var dsObj1, dsObj2, dsObj3 s3.GetObjectOutput
 
 	resourceName := "aws_s3_object.object"
 	dataSourceName1 := "data.aws_s3_object.obj1"
@@ -327,38 +289,32 @@ func TestAccS3BucketObjectDataSource_leadingSlash(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                  func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:                acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:                acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories:  acctest.ProtoV5ProviderFactories,
 		PreventPostDestroyRefresh: true,
 		Steps: []resource.TestStep{
 			{ // nosemgrep:ci.test-config-funcs-correct-form
 				Config: resourceOnlyConf,
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckObjectExists(ctx, resourceName, &rObj),
-				),
 			},
 			{ // nosemgrep:ci.test-config-funcs-correct-form
 				Config: conf,
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckObjectExistsDataSource(ctx, dataSourceName1, &dsObj1),
 					resource.TestCheckResourceAttr(dataSourceName1, "content_length", "3"),
 					resource.TestCheckResourceAttrPair(dataSourceName1, "content_type", resourceName, "content_type"),
 					resource.TestCheckResourceAttrPair(dataSourceName1, "etag", resourceName, "etag"),
-					resource.TestMatchResourceAttr(dataSourceName1, "last_modified", regexp.MustCompile(rfc1123RegexPattern)),
+					resource.TestMatchResourceAttr(dataSourceName1, "last_modified", regexache.MustCompile(rfc1123RegexPattern)),
 					resource.TestCheckResourceAttr(dataSourceName1, "body", "yes"),
 
-					testAccCheckObjectExistsDataSource(ctx, dataSourceName2, &dsObj2),
 					resource.TestCheckResourceAttr(dataSourceName2, "content_length", "3"),
 					resource.TestCheckResourceAttrPair(dataSourceName2, "content_type", resourceName, "content_type"),
 					resource.TestCheckResourceAttrPair(dataSourceName2, "etag", resourceName, "etag"),
-					resource.TestMatchResourceAttr(dataSourceName2, "last_modified", regexp.MustCompile(rfc1123RegexPattern)),
+					resource.TestMatchResourceAttr(dataSourceName2, "last_modified", regexache.MustCompile(rfc1123RegexPattern)),
 					resource.TestCheckResourceAttr(dataSourceName2, "body", "yes"),
 
-					testAccCheckObjectExistsDataSource(ctx, dataSourceName3, &dsObj3),
 					resource.TestCheckResourceAttr(dataSourceName3, "content_length", "3"),
 					resource.TestCheckResourceAttrPair(dataSourceName3, "content_type", resourceName, "content_type"),
 					resource.TestCheckResourceAttrPair(dataSourceName3, "etag", resourceName, "etag"),
-					resource.TestMatchResourceAttr(dataSourceName3, "last_modified", regexp.MustCompile(rfc1123RegexPattern)),
+					resource.TestMatchResourceAttr(dataSourceName3, "last_modified", regexache.MustCompile(rfc1123RegexPattern)),
 					resource.TestCheckResourceAttr(dataSourceName3, "body", "yes"),
 				),
 			},
@@ -368,8 +324,6 @@ func TestAccS3BucketObjectDataSource_leadingSlash(t *testing.T) {
 
 func TestAccS3BucketObjectDataSource_multipleSlashes(t *testing.T) {
 	ctx := acctest.Context(t)
-	var rObj1, rObj2 s3.GetObjectOutput
-	var dsObj1, dsObj2, dsObj3 s3.GetObjectOutput
 
 	resourceName1 := "aws_s3_object.object1"
 	resourceName2 := "aws_s3_object.object2"
@@ -382,32 +336,24 @@ func TestAccS3BucketObjectDataSource_multipleSlashes(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                  func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:                acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:                acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories:  acctest.ProtoV5ProviderFactories,
 		PreventPostDestroyRefresh: true,
 		Steps: []resource.TestStep{
 			{ // nosemgrep:ci.test-config-funcs-correct-form
 				Config: resourceOnlyConf,
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckObjectExists(ctx, resourceName1, &rObj1),
-					testAccCheckObjectExists(ctx, resourceName2, &rObj2),
-				),
 			},
 			{ // nosemgrep:ci.test-config-funcs-correct-form
 				Config: conf,
 				Check: resource.ComposeTestCheckFunc(
-
-					testAccCheckObjectExistsDataSource(ctx, dataSourceName1, &dsObj1),
 					resource.TestCheckResourceAttr(dataSourceName1, "content_length", "3"),
 					resource.TestCheckResourceAttrPair(dataSourceName1, "content_type", resourceName1, "content_type"),
 					resource.TestCheckResourceAttr(dataSourceName1, "body", "yes"),
 
-					testAccCheckObjectExistsDataSource(ctx, dataSourceName2, &dsObj2),
 					resource.TestCheckResourceAttr(dataSourceName2, "content_length", "3"),
 					resource.TestCheckResourceAttrPair(dataSourceName2, "content_type", resourceName1, "content_type"),
 					resource.TestCheckResourceAttr(dataSourceName2, "body", "yes"),
 
-					testAccCheckObjectExistsDataSource(ctx, dataSourceName3, &dsObj3),
 					resource.TestCheckResourceAttr(dataSourceName3, "content_length", "2"),
 					resource.TestCheckResourceAttrPair(dataSourceName3, "content_type", resourceName2, "content_type"),
 					resource.TestCheckResourceAttr(dataSourceName3, "body", "no"),
@@ -417,28 +363,6 @@ func TestAccS3BucketObjectDataSource_multipleSlashes(t *testing.T) {
 	})
 }
 
-func TestAccS3BucketObjectDataSource_singleSlashAsKey(t *testing.T) {
-	ctx := acctest.Context(t)
-	var dsObj s3.GetObjectOutput
-	dataSourceName := "data.aws_s3_object.test"
-	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
-
-	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:                  func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:                acctest.ErrorCheck(t, s3.EndpointsID),
-		ProtoV5ProviderFactories:  acctest.ProtoV5ProviderFactories,
-		PreventPostDestroyRefresh: true,
-		Steps: []resource.TestStep{
-			{
-				Config: testAccBucketObjectDataSourceConfig_singleSlashAsKey(rName),
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckObjectExistsDataSource(ctx, dataSourceName, &dsObj),
-				),
-			},
-		},
-	})
-}
-
 func testAccBucketObjectDataSourceConfig_basic(randInt int) string {
 	return fmt.Sprintf(`
 resource "aws_s3_bucket" "object_bucket" {
@@ -744,16 +668,3 @@ data "aws_s3_object" "obj3" {
 
 	return resources, both
 }
-
-func testAccBucketObjectDataSourceConfig_singleSlashAsKey(rName string) string {
-	return fmt.Sprintf(`
-resource "aws_s3_bucket" "test" {
-  bucket = %[1]q
-}
-
-data "aws_s3_object" "test" {
-  bucket = aws_s3_bucket.test.bucket
-  key    = "/"
-}
-`, rName)
-}
diff --git a/internal/service/s3/bucket_object_lock_configuration.go b/internal/service/s3/bucket_object_lock_configuration.go
index 5524fda59ea..dd6a1338ea1 100644
--- a/internal/service/s3/bucket_object_lock_configuration.go
+++ b/internal/service/s3/bucket_object_lock_configuration.go
@@ -1,18 +1,22 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3
 
 import (
 	"context"
 	"log"
-	"time"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/s3"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/s3"
+	"github.com/aws/aws-sdk-go-v2/service/s3/types"
+	"github.com/hashicorp/aws-sdk-go-base/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/enum"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
 )
@@ -24,6 +28,7 @@ func ResourceBucketObjectLockConfiguration() *schema.Resource {
 		ReadWithoutTimeout:   resourceBucketObjectLockConfigurationRead,
 		UpdateWithoutTimeout: resourceBucketObjectLockConfigurationUpdate,
 		DeleteWithoutTimeout: resourceBucketObjectLockConfigurationDelete,
+
 		Importer: &schema.ResourceImporter{
 			StateContext: schema.ImportStatePassthroughContext,
 		},
@@ -42,11 +47,11 @@ func ResourceBucketObjectLockConfiguration() *schema.Resource {
 				ValidateFunc: verify.ValidAccountID,
 			},
 			"object_lock_enabled": {
-				Type:         schema.TypeString,
-				Optional:     true,
-				Default:      s3.ObjectLockEnabledEnabled,
-				ForceNew:     true,
-				ValidateFunc: validation.StringInSlice(s3.ObjectLockEnabled_Values(), false),
+				Type:             schema.TypeString,
+				Optional:         true,
+				ForceNew:         true,
+				Default:          types.ObjectLockEnabledEnabled,
+				ValidateDiagFunc: enum.Validate[types.ObjectLockEnabled](),
 			},
 			"rule": {
 				Type:     schema.TypeList,
@@ -66,9 +71,9 @@ func ResourceBucketObjectLockConfiguration() *schema.Resource {
 										ConflictsWith: []string{"rule.0.default_retention.0.years"},
 									},
 									"mode": {
-										Type:         schema.TypeString,
-										Optional:     true,
-										ValidateFunc: validation.StringInSlice(s3.ObjectLockRetentionMode_Values(), false),
+										Type:             schema.TypeString,
+										Optional:         true,
+										ValidateDiagFunc: enum.Validate[types.ObjectLockRetentionMode](),
 									},
 									"years": {
 										Type:          schema.TypeInt,
@@ -91,55 +96,61 @@ func ResourceBucketObjectLockConfiguration() *schema.Resource {
 }
 
 func resourceBucketObjectLockConfigurationCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).S3Conn(ctx)
+	conn := meta.(*conns.AWSClient).S3Client(ctx)
 
 	bucket := d.Get("bucket").(string)
 	expectedBucketOwner := d.Get("expected_bucket_owner").(string)
 	input := &s3.PutObjectLockConfigurationInput{
 		Bucket: aws.String(bucket),
-		ObjectLockConfiguration: &s3.ObjectLockConfiguration{
+		ObjectLockConfiguration: &types.ObjectLockConfiguration{
 			// ObjectLockEnabled is required by the API, even if configured directly on the S3 bucket
 			// during creation, else a MalformedXML error will be returned.
-			ObjectLockEnabled: aws.String(d.Get("object_lock_enabled").(string)),
+			ObjectLockEnabled: types.ObjectLockEnabled(d.Get("object_lock_enabled").(string)),
 			Rule:              expandBucketObjectLockConfigurationRule(d.Get("rule").([]interface{})),
 		},
 	}
-
 	if expectedBucketOwner != "" {
 		input.ExpectedBucketOwner = aws.String(expectedBucketOwner)
 	}
 
 	if v, ok := d.GetOk("request_payer"); ok {
-		input.RequestPayer = aws.String(v.(string))
+		input.RequestPayer = types.RequestPayer(v.(string))
 	}
 
 	if v, ok := d.GetOk("token"); ok {
 		input.Token = aws.String(v.(string))
 	}
 
-	_, err := tfresource.RetryWhenAWSErrCodeEquals(ctx, 2*time.Minute, func() (interface{}, error) {
-		return conn.PutObjectLockConfigurationWithContext(ctx, input)
-	}, s3.ErrCodeNoSuchBucket)
+	_, err := tfresource.RetryWhenAWSErrCodeEquals(ctx, s3BucketPropagationTimeout, func() (interface{}, error) {
+		return conn.PutObjectLockConfiguration(ctx, input)
+	}, errCodeNoSuchBucket)
 
 	if err != nil {
-		return diag.Errorf("creating S3 Bucket (%s) Object Lock configuration: %s", bucket, err)
+		return diag.Errorf("creating S3 Bucket (%s) Object Lock Configuration: %s", bucket, err)
 	}
 
 	d.SetId(CreateResourceID(bucket, expectedBucketOwner))
 
+	_, err = tfresource.RetryWhenNotFound(ctx, s3BucketPropagationTimeout, func() (interface{}, error) {
+		return findObjectLockConfiguration(ctx, conn, bucket, expectedBucketOwner)
+	})
+
+	if err != nil {
+		return diag.Errorf("waiting for S3 Bucket Object Lock Configuration (%s) create: %s", d.Id(), err)
+	}
+
 	return resourceBucketObjectLockConfigurationRead(ctx, d, meta)
 }
 
 func resourceBucketObjectLockConfigurationRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).S3Conn(ctx)
+	conn := meta.(*conns.AWSClient).S3Client(ctx)
 
 	bucket, expectedBucketOwner, err := ParseResourceID(d.Id())
-
 	if err != nil {
 		return diag.FromErr(err)
 	}
 
-	objLockConfig, err := FindObjectLockConfiguration(ctx, conn, bucket, expectedBucketOwner)
+	objLockConfig, err := findObjectLockConfiguration(ctx, conn, bucket, expectedBucketOwner)
 
 	if !d.IsNewResource() && tfresource.NotFound(err) {
 		log.Printf("[WARN] S3 Bucket Object Lock Configuration (%s) not found, removing from state", d.Id())
@@ -162,37 +173,35 @@ func resourceBucketObjectLockConfigurationRead(ctx context.Context, d *schema.Re
 }
 
 func resourceBucketObjectLockConfigurationUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).S3Conn(ctx)
+	conn := meta.(*conns.AWSClient).S3Client(ctx)
 
 	bucket, expectedBucketOwner, err := ParseResourceID(d.Id())
-
 	if err != nil {
 		return diag.FromErr(err)
 	}
 
 	input := &s3.PutObjectLockConfigurationInput{
 		Bucket: aws.String(bucket),
-		ObjectLockConfiguration: &s3.ObjectLockConfiguration{
+		ObjectLockConfiguration: &types.ObjectLockConfiguration{
 			// ObjectLockEnabled is required by the API, even if configured directly on the S3 bucket
 			// during creation, else a MalformedXML error will be returned.
-			ObjectLockEnabled: aws.String(d.Get("object_lock_enabled").(string)),
+			ObjectLockEnabled: types.ObjectLockEnabled(d.Get("object_lock_enabled").(string)),
 			Rule:              expandBucketObjectLockConfigurationRule(d.Get("rule").([]interface{})),
 		},
 	}
-
 	if expectedBucketOwner != "" {
 		input.ExpectedBucketOwner = aws.String(expectedBucketOwner)
 	}
 
 	if v, ok := d.GetOk("request_payer"); ok {
-		input.RequestPayer = aws.String(v.(string))
+		input.RequestPayer = types.RequestPayer(v.(string))
 	}
 
 	if v, ok := d.GetOk("token"); ok {
 		input.Token = aws.String(v.(string))
 	}
 
-	_, err = conn.PutObjectLockConfigurationWithContext(ctx, input)
+	_, err = conn.PutObjectLockConfiguration(ctx, input)
 
 	if err != nil {
 		return diag.Errorf("updating S3 Bucket Object Lock Configuration (%s): %s", d.Id(), err)
@@ -202,30 +211,32 @@ func resourceBucketObjectLockConfigurationUpdate(ctx context.Context, d *schema.
 }
 
 func resourceBucketObjectLockConfigurationDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).S3Conn(ctx)
+	conn := meta.(*conns.AWSClient).S3Client(ctx)
 
 	bucket, expectedBucketOwner, err := ParseResourceID(d.Id())
-
 	if err != nil {
 		return diag.FromErr(err)
 	}
 
 	input := &s3.PutObjectLockConfigurationInput{
 		Bucket: aws.String(bucket),
-		ObjectLockConfiguration: &s3.ObjectLockConfiguration{
+		ObjectLockConfiguration: &types.ObjectLockConfiguration{
 			// ObjectLockEnabled is required by the API, even if configured directly on the S3 bucket
 			// during creation, else a MalformedXML error will be returned.
-			ObjectLockEnabled: aws.String(d.Get("object_lock_enabled").(string)),
+			ObjectLockEnabled: types.ObjectLockEnabled(d.Get("object_lock_enabled").(string)),
 		},
 	}
-
 	if expectedBucketOwner != "" {
 		input.ExpectedBucketOwner = aws.String(expectedBucketOwner)
 	}
 
-	_, err = conn.PutObjectLockConfigurationWithContext(ctx, input)
+	if v, ok := d.GetOk("request_payer"); ok {
+		input.RequestPayer = types.RequestPayer(v.(string))
+	}
 
-	if tfawserr.ErrCodeEquals(err, s3.ErrCodeNoSuchBucket) || tfawserr.ErrCodeContains(err, errCodeObjectLockConfigurationNotFound) {
+	_, err = conn.PutObjectLockConfiguration(ctx, input)
+
+	if tfawserr.ErrCodeEquals(err, errCodeNoSuchBucket, errCodeObjectLockConfigurationNotFoundError) {
 		return nil
 	}
 
@@ -233,10 +244,12 @@ func resourceBucketObjectLockConfigurationDelete(ctx context.Context, d *schema.
 		return diag.Errorf("deleting S3 Bucket Object Lock Configuration (%s): %s", d.Id(), err)
 	}
 
+	// Don't wait for the object lock configuration to disappear as may still exist.
+
 	return nil
 }
 
-func FindObjectLockConfiguration(ctx context.Context, conn *s3.S3, bucket, expectedBucketOwner string) (*s3.ObjectLockConfiguration, error) {
+func findObjectLockConfiguration(ctx context.Context, conn *s3.Client, bucket, expectedBucketOwner string) (*types.ObjectLockConfiguration, error) {
 	input := &s3.GetObjectLockConfigurationInput{
 		Bucket: aws.String(bucket),
 	}
@@ -244,9 +257,9 @@ func FindObjectLockConfiguration(ctx context.Context, conn *s3.S3, bucket, expec
 		input.ExpectedBucketOwner = aws.String(expectedBucketOwner)
 	}
 
-	output, err := conn.GetObjectLockConfigurationWithContext(ctx, input)
+	output, err := conn.GetObjectLockConfiguration(ctx, input)
 
-	if tfawserr.ErrCodeEquals(err, s3.ErrCodeNoSuchBucket) || tfawserr.ErrCodeContains(err, errCodeObjectLockConfigurationNotFound) {
+	if tfawserr.ErrCodeEquals(err, errCodeNoSuchBucket, errCodeObjectLockConfigurationNotFoundError) {
 		return nil, &retry.NotFoundError{
 			LastError:   err,
 			LastRequest: input,
@@ -264,7 +277,7 @@ func FindObjectLockConfiguration(ctx context.Context, conn *s3.S3, bucket, expec
 	return output.ObjectLockConfiguration, nil
 }
 
-func expandBucketObjectLockConfigurationRule(l []interface{}) *s3.ObjectLockRule {
+func expandBucketObjectLockConfigurationRule(l []interface{}) *types.ObjectLockRule {
 	if len(l) == 0 || l[0] == nil {
 		return nil
 	}
@@ -274,7 +287,7 @@ func expandBucketObjectLockConfigurationRule(l []interface{}) *s3.ObjectLockRule
 		return nil
 	}
 
-	rule := &s3.ObjectLockRule{}
+	rule := &types.ObjectLockRule{}
 
 	if v, ok := tfMap["default_retention"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
 		rule.DefaultRetention = expandBucketObjectLockConfigurationCorsRuleDefaultRetention(v)
@@ -283,7 +296,7 @@ func expandBucketObjectLockConfigurationRule(l []interface{}) *s3.ObjectLockRule
 	return rule
 }
 
-func expandBucketObjectLockConfigurationCorsRuleDefaultRetention(l []interface{}) *s3.DefaultRetention {
+func expandBucketObjectLockConfigurationCorsRuleDefaultRetention(l []interface{}) *types.DefaultRetention {
 	if len(l) == 0 || l[0] == nil {
 		return nil
 	}
@@ -293,24 +306,24 @@ func expandBucketObjectLockConfigurationCorsRuleDefaultRetention(l []interface{}
 		return nil
 	}
 
-	dr := &s3.DefaultRetention{}
+	dr := &types.DefaultRetention{}
 
 	if v, ok := tfMap["days"].(int); ok && v > 0 {
-		dr.Days = aws.Int64(int64(v))
+		dr.Days = int32(v)
 	}
 
 	if v, ok := tfMap["mode"].(string); ok && v != "" {
-		dr.Mode = aws.String(v)
+		dr.Mode = types.ObjectLockRetentionMode(v)
 	}
 
 	if v, ok := tfMap["years"].(int); ok && v > 0 {
-		dr.Years = aws.Int64(int64(v))
+		dr.Years = int32(v)
 	}
 
 	return dr
 }
 
-func flattenBucketObjectLockConfigurationRule(rule *s3.ObjectLockRule) []interface{} {
+func flattenBucketObjectLockConfigurationRule(rule *types.ObjectLockRule) []interface{} {
 	if rule == nil {
 		return []interface{}{}
 	}
@@ -320,26 +333,19 @@ func flattenBucketObjectLockConfigurationRule(rule *s3.ObjectLockRule) []interfa
 	if rule.DefaultRetention != nil {
 		m["default_retention"] = flattenBucketObjectLockConfigurationRuleDefaultRetention(rule.DefaultRetention)
 	}
+
 	return []interface{}{m}
 }
 
-func flattenBucketObjectLockConfigurationRuleDefaultRetention(dr *s3.DefaultRetention) []interface{} {
+func flattenBucketObjectLockConfigurationRuleDefaultRetention(dr *types.DefaultRetention) []interface{} {
 	if dr == nil {
 		return []interface{}{}
 	}
 
-	m := make(map[string]interface{})
-
-	if dr.Days != nil {
-		m["days"] = int(aws.Int64Value(dr.Days))
-	}
-
-	if dr.Mode != nil {
-		m["mode"] = aws.StringValue(dr.Mode)
-	}
-
-	if dr.Years != nil {
-		m["years"] = int(aws.Int64Value(dr.Years))
+	m := map[string]interface{}{
+		"days":  dr.Days,
+		"mode":  dr.Mode,
+		"years": dr.Years,
 	}
 
 	return []interface{}{m}
diff --git a/internal/service/s3/bucket_object_lock_configuration_test.go b/internal/service/s3/bucket_object_lock_configuration_test.go
index 476895b5a86..615868a3031 100644
--- a/internal/service/s3/bucket_object_lock_configuration_test.go
+++ b/internal/service/s3/bucket_object_lock_configuration_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3_test
 
 import (
@@ -5,7 +8,7 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/service/s3"
+	"github.com/aws/aws-sdk-go-v2/service/s3/types"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
@@ -13,6 +16,7 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	tfs3 "github.com/hashicorp/terraform-provider-aws/internal/service/s3"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
 func TestAccS3BucketObjectLockConfiguration_basic(t *testing.T) {
@@ -22,7 +26,7 @@ func TestAccS3BucketObjectLockConfiguration_basic(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketObjectLockConfigurationDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -30,11 +34,11 @@ func TestAccS3BucketObjectLockConfiguration_basic(t *testing.T) {
 				Config: testAccBucketObjectLockConfigurationConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketObjectLockConfigurationExists(ctx, resourceName),
-					resource.TestCheckResourceAttr(resourceName, "object_lock_enabled", s3.ObjectLockEnabledEnabled),
+					resource.TestCheckResourceAttr(resourceName, "object_lock_enabled", string(types.ObjectLockEnabledEnabled)),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "rule.0.default_retention.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "rule.0.default_retention.0.days", "3"),
-					resource.TestCheckResourceAttr(resourceName, "rule.0.default_retention.0.mode", s3.ObjectLockRetentionModeCompliance),
+					resource.TestCheckResourceAttr(resourceName, "rule.0.default_retention.0.mode", string(types.ObjectLockRetentionModeCompliance)),
 				),
 			},
 			{
@@ -53,7 +57,7 @@ func TestAccS3BucketObjectLockConfiguration_disappears(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketObjectLockConfigurationDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -76,7 +80,7 @@ func TestAccS3BucketObjectLockConfiguration_update(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -89,11 +93,11 @@ func TestAccS3BucketObjectLockConfiguration_update(t *testing.T) {
 			{
 				Config: testAccBucketObjectLockConfigurationConfig_update(rName),
 				Check: resource.ComposeTestCheckFunc(
-					resource.TestCheckResourceAttr(resourceName, "object_lock_enabled", s3.ObjectLockEnabledEnabled),
+					resource.TestCheckResourceAttr(resourceName, "object_lock_enabled", string(types.ObjectLockEnabledEnabled)),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "rule.0.default_retention.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "rule.0.default_retention.0.years", "1"),
-					resource.TestCheckResourceAttr(resourceName, "rule.0.default_retention.0.mode", s3.ObjectLockRetentionModeGovernance),
+					resource.TestCheckResourceAttr(resourceName, "rule.0.default_retention.0.mode", string(types.ObjectLockRetentionModeGovernance)),
 				),
 			},
 			{
@@ -113,7 +117,7 @@ func TestAccS3BucketObjectLockConfiguration_migrate_noChange(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketObjectLockConfigurationDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -122,9 +126,9 @@ func TestAccS3BucketObjectLockConfiguration_migrate_noChange(t *testing.T) {
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckBucketExists(ctx, bucketResourceName),
 					resource.TestCheckResourceAttr(bucketResourceName, "object_lock_configuration.#", "1"),
-					resource.TestCheckResourceAttr(bucketResourceName, "object_lock_configuration.0.object_lock_enabled", s3.ObjectLockEnabledEnabled),
+					resource.TestCheckResourceAttr(bucketResourceName, "object_lock_configuration.0.object_lock_enabled", string(types.ObjectLockEnabledEnabled)),
 					resource.TestCheckResourceAttr(bucketResourceName, "object_lock_configuration.0.rule.#", "1"),
-					resource.TestCheckResourceAttr(bucketResourceName, "object_lock_configuration.0.rule.0.default_retention.0.mode", s3.ObjectLockRetentionModeCompliance),
+					resource.TestCheckResourceAttr(bucketResourceName, "object_lock_configuration.0.rule.0.default_retention.0.mode", string(types.ObjectLockRetentionModeCompliance)),
 					resource.TestCheckResourceAttr(bucketResourceName, "object_lock_configuration.0.rule.0.default_retention.0.days", "3"),
 				),
 			},
@@ -132,11 +136,11 @@ func TestAccS3BucketObjectLockConfiguration_migrate_noChange(t *testing.T) {
 				Config: testAccBucketObjectLockConfigurationConfig_basic(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckBucketObjectLockConfigurationExists(ctx, resourceName),
-					resource.TestCheckResourceAttr(resourceName, "object_lock_enabled", s3.ObjectLockEnabledEnabled),
+					resource.TestCheckResourceAttr(resourceName, "object_lock_enabled", string(types.ObjectLockEnabledEnabled)),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "rule.0.default_retention.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "rule.0.default_retention.0.days", "3"),
-					resource.TestCheckResourceAttr(resourceName, "rule.0.default_retention.0.mode", s3.ObjectLockRetentionModeCompliance),
+					resource.TestCheckResourceAttr(resourceName, "rule.0.default_retention.0.mode", string(types.ObjectLockRetentionModeCompliance)),
 				),
 			},
 		},
@@ -151,7 +155,7 @@ func TestAccS3BucketObjectLockConfiguration_migrate_withChange(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketObjectLockConfigurationDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -160,7 +164,7 @@ func TestAccS3BucketObjectLockConfiguration_migrate_withChange(t *testing.T) {
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckBucketExists(ctx, bucketResourceName),
 					resource.TestCheckResourceAttr(bucketResourceName, "object_lock_configuration.#", "1"),
-					resource.TestCheckResourceAttr(bucketResourceName, "object_lock_configuration.0.object_lock_enabled", s3.ObjectLockEnabledEnabled),
+					resource.TestCheckResourceAttr(bucketResourceName, "object_lock_configuration.0.object_lock_enabled", string(types.ObjectLockEnabledEnabled)),
 					resource.TestCheckResourceAttr(bucketResourceName, "object_lock_configuration.0.rule.#", "0"),
 				),
 			},
@@ -168,11 +172,11 @@ func TestAccS3BucketObjectLockConfiguration_migrate_withChange(t *testing.T) {
 				Config: testAccBucketObjectLockConfigurationConfig_basic(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckBucketObjectLockConfigurationExists(ctx, resourceName),
-					resource.TestCheckResourceAttr(resourceName, "object_lock_enabled", s3.ObjectLockEnabledEnabled),
+					resource.TestCheckResourceAttr(resourceName, "object_lock_enabled", string(types.ObjectLockEnabledEnabled)),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "rule.0.default_retention.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "rule.0.default_retention.0.days", "3"),
-					resource.TestCheckResourceAttr(resourceName, "rule.0.default_retention.0.mode", s3.ObjectLockRetentionModeCompliance),
+					resource.TestCheckResourceAttr(resourceName, "rule.0.default_retention.0.mode", string(types.ObjectLockRetentionModeCompliance)),
 				),
 			},
 		},
@@ -186,7 +190,7 @@ func TestAccS3BucketObjectLockConfiguration_noRule(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketObjectLockConfigurationDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -194,7 +198,7 @@ func TestAccS3BucketObjectLockConfiguration_noRule(t *testing.T) {
 				Config: testAccBucketObjectLockConfigurationConfig_noRule(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketObjectLockConfigurationExists(ctx, resourceName),
-					resource.TestCheckResourceAttr(resourceName, "object_lock_enabled", s3.ObjectLockEnabledEnabled),
+					resource.TestCheckResourceAttr(resourceName, "object_lock_enabled", string(types.ObjectLockEnabledEnabled)),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "0"),
 				),
 			},
@@ -209,7 +213,7 @@ func TestAccS3BucketObjectLockConfiguration_noRule(t *testing.T) {
 
 func testAccCheckBucketObjectLockConfigurationDestroy(ctx context.Context) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Conn(ctx)
+		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Client(ctx)
 
 		for _, rs := range s.RootModule().Resources {
 			if rs.Type != "aws_s3_bucket_object_lock_configuration" {
@@ -217,7 +221,6 @@ func testAccCheckBucketObjectLockConfigurationDestroy(ctx context.Context) resou
 			}
 
 			bucket, expectedBucketOwner, err := tfs3.ParseResourceID(rs.Primary.ID)
-
 			if err != nil {
 				return err
 			}
@@ -239,24 +242,19 @@ func testAccCheckBucketObjectLockConfigurationDestroy(ctx context.Context) resou
 	}
 }
 
-func testAccCheckBucketObjectLockConfigurationExists(ctx context.Context, resourceName string) resource.TestCheckFunc {
+func testAccCheckBucketObjectLockConfigurationExists(ctx context.Context, n string) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		rs, ok := s.RootModule().Resources[resourceName]
+		rs, ok := s.RootModule().Resources[n]
 		if !ok {
-			return fmt.Errorf("Not found: %s", resourceName)
-		}
-
-		if rs.Primary.ID == "" {
-			return fmt.Errorf("Resource (%s) ID not set", resourceName)
+			return fmt.Errorf("Not found: %s", n)
 		}
 
 		bucket, expectedBucketOwner, err := tfs3.ParseResourceID(rs.Primary.ID)
-
 		if err != nil {
 			return err
 		}
 
-		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Conn(ctx)
+		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Client(ctx)
 
 		_, err = tfs3.FindObjectLockConfiguration(ctx, conn, bucket, expectedBucketOwner)
 
@@ -282,7 +280,7 @@ resource "aws_s3_bucket_object_lock_configuration" "test" {
     }
   }
 }
-`, bucketName, s3.ObjectLockRetentionModeCompliance)
+`, bucketName, types.ObjectLockRetentionModeCompliance)
 }
 
 func testAccBucketObjectLockConfigurationConfig_update(bucketName string) string {
@@ -303,7 +301,7 @@ resource "aws_s3_bucket_object_lock_configuration" "test" {
     }
   }
 }
-`, bucketName, s3.ObjectLockModeGovernance)
+`, bucketName, types.ObjectLockModeGovernance)
 }
 
 func testAccBucketObjectLockConfigurationConfig_noRule(bucketName string) string {
diff --git a/internal/service/s3/bucket_object_test.go b/internal/service/s3/bucket_object_test.go
index 6ef4d2ae824..8690e29b2db 100644
--- a/internal/service/s3/bucket_object_test.go
+++ b/internal/service/s3/bucket_object_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3_test
 
 // WARNING: This code is DEPRECATED and will be removed in a future release!!
@@ -8,36 +11,32 @@ import (
 	"context"
 	"encoding/base64"
 	"fmt"
-	"io"
 	"os"
-	"reflect"
-	"regexp"
-	"sort"
 	"testing"
 	"time"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/s3"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
+	"github.com/YakDriver/regexache"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/s3"
+	"github.com/aws/aws-sdk-go-v2/service/s3/types"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	tfs3 "github.com/hashicorp/terraform-provider-aws/internal/service/s3"
-	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
 func TestAccS3BucketObject_noNameNoKey(t *testing.T) {
 	ctx := acctest.Context(t)
-	bucketError := regexp.MustCompile(`bucket must not be empty`)
-	keyError := regexp.MustCompile(`key must not be empty`)
+	bucketError := regexache.MustCompile(`bucket must not be empty`)
+	keyError := regexache.MustCompile(`key must not be empty`)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketObjectDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -63,7 +62,7 @@ func TestAccS3BucketObject_empty(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketObjectDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -72,7 +71,7 @@ func TestAccS3BucketObject_empty(t *testing.T) {
 				Config:    testAccBucketObjectConfig_empty(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketObjectExists(ctx, resourceName, &obj),
-					testAccCheckBucketObjectBody(&obj, ""),
+					testAccCheckObjectBody(&obj, ""),
 				),
 			},
 			{
@@ -92,12 +91,12 @@ func TestAccS3BucketObject_source(t *testing.T) {
 	resourceName := "aws_s3_bucket_object.object"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
-	source := testAccBucketObjectCreateTempFile(t, "{anything will do }")
+	source := testAccObjectCreateTempFile(t, "{anything will do }")
 	defer os.Remove(source)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketObjectDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -105,7 +104,7 @@ func TestAccS3BucketObject_source(t *testing.T) {
 				Config: testAccBucketObjectConfig_source(rName, source),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketObjectExists(ctx, resourceName, &obj),
-					testAccCheckBucketObjectBody(&obj, "{anything will do }"),
+					testAccCheckObjectBody(&obj, "{anything will do }"),
 				),
 			},
 			{
@@ -127,7 +126,7 @@ func TestAccS3BucketObject_content(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketObjectDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -136,7 +135,7 @@ func TestAccS3BucketObject_content(t *testing.T) {
 				Config:    testAccBucketObjectConfig_content(rName, "some_bucket_content"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketObjectExists(ctx, resourceName, &obj),
-					testAccCheckBucketObjectBody(&obj, "some_bucket_content"),
+					testAccCheckObjectBody(&obj, "some_bucket_content"),
 				),
 			},
 			{
@@ -155,12 +154,12 @@ func TestAccS3BucketObject_etagEncryption(t *testing.T) {
 	var obj s3.GetObjectOutput
 	resourceName := "aws_s3_bucket_object.object"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
-	source := testAccBucketObjectCreateTempFile(t, "{anything will do }")
+	source := testAccObjectCreateTempFile(t, "{anything will do }")
 	defer os.Remove(source)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketObjectDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -169,7 +168,7 @@ func TestAccS3BucketObject_etagEncryption(t *testing.T) {
 				Config:    testAccBucketObjectConfig_etagEncryption(rName, source),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketObjectExists(ctx, resourceName, &obj),
-					testAccCheckBucketObjectBody(&obj, "{anything will do }"),
+					testAccCheckObjectBody(&obj, "{anything will do }"),
 					resource.TestCheckResourceAttr(resourceName, "etag", "7b006ff4d70f68cc65061acf2f802e6f"),
 				),
 			},
@@ -192,7 +191,7 @@ func TestAccS3BucketObject_contentBase64(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketObjectDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -201,7 +200,7 @@ func TestAccS3BucketObject_contentBase64(t *testing.T) {
 				Config:    testAccBucketObjectConfig_contentBase64(rName, base64.StdEncoding.EncodeToString([]byte("some_bucket_content"))),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketObjectExists(ctx, resourceName, &obj),
-					testAccCheckBucketObjectBody(&obj, "some_bucket_content"),
+					testAccCheckObjectBody(&obj, "some_bucket_content"),
 				),
 			},
 		},
@@ -217,7 +216,7 @@ func TestAccS3BucketObject_sourceHashTrigger(t *testing.T) {
 	startingData := "Ebben!"
 	changingData := "Ne andrò lontana"
 
-	filename := testAccBucketObjectCreateTempFile(t, startingData)
+	filename := testAccObjectCreateTempFile(t, startingData)
 	defer os.Remove(filename)
 
 	rewriteFile := func(*terraform.State) error {
@@ -230,7 +229,7 @@ func TestAccS3BucketObject_sourceHashTrigger(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketObjectDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -239,7 +238,7 @@ func TestAccS3BucketObject_sourceHashTrigger(t *testing.T) {
 				Config:    testAccBucketObjectConfig_sourceHashTrigger(rName, filename),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketObjectExists(ctx, resourceName, &obj),
-					testAccCheckBucketObjectBody(&obj, "Ebben!"),
+					testAccCheckObjectBody(&obj, "Ebben!"),
 					resource.TestCheckResourceAttr(resourceName, "source_hash", "7c7e02a79f28968882bb1426c8f8bfc6"),
 					rewriteFile,
 				),
@@ -250,7 +249,7 @@ func TestAccS3BucketObject_sourceHashTrigger(t *testing.T) {
 				Config:    testAccBucketObjectConfig_sourceHashTrigger(rName, filename),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketObjectExists(ctx, resourceName, &updated_obj),
-					testAccCheckBucketObjectBody(&updated_obj, "Ne andrò lontana"),
+					testAccCheckObjectBody(&updated_obj, "Ne andrò lontana"),
 					resource.TestCheckResourceAttr(resourceName, "source_hash", "cffc5e20de2d21764145b1124c9b337b"),
 				),
 			},
@@ -271,12 +270,12 @@ func TestAccS3BucketObject_withContentCharacteristics(t *testing.T) {
 	resourceName := "aws_s3_bucket_object.object"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
-	source := testAccBucketObjectCreateTempFile(t, "{anything will do }")
+	source := testAccObjectCreateTempFile(t, "{anything will do }")
 	defer os.Remove(source)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketObjectDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -284,7 +283,7 @@ func TestAccS3BucketObject_withContentCharacteristics(t *testing.T) {
 				Config: testAccBucketObjectConfig_contentCharacteristics(rName, source),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketObjectExists(ctx, resourceName, &obj),
-					testAccCheckBucketObjectBody(&obj, "{anything will do }"),
+					testAccCheckObjectBody(&obj, "{anything will do }"),
 					resource.TestCheckResourceAttr(resourceName, "content_type", "binary/octet-stream"),
 					resource.TestCheckResourceAttr(resourceName, "website_redirect", "http://google.com"),
 				),
@@ -295,7 +294,7 @@ func TestAccS3BucketObject_withContentCharacteristics(t *testing.T) {
 
 func TestAccS3BucketObject_nonVersioned(t *testing.T) {
 	ctx := acctest.Context(t)
-	sourceInitial := testAccBucketObjectCreateTempFile(t, "initial object state")
+	sourceInitial := testAccObjectCreateTempFile(t, "initial object state")
 	defer os.Remove(sourceInitial)
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	var originalObj s3.GetObjectOutput
@@ -303,7 +302,7 @@ func TestAccS3BucketObject_nonVersioned(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckAssumeRoleARN(t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketObjectDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -311,7 +310,7 @@ func TestAccS3BucketObject_nonVersioned(t *testing.T) {
 				Config: testAccBucketObjectConfig_nonVersioned(rName, sourceInitial),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketObjectExists(ctx, resourceName, &originalObj),
-					testAccCheckBucketObjectBody(&originalObj, "initial object state"),
+					testAccCheckObjectBody(&originalObj, "initial object state"),
 					resource.TestCheckResourceAttr(resourceName, "version_id", ""),
 				),
 			},
@@ -332,14 +331,14 @@ func TestAccS3BucketObject_updates(t *testing.T) {
 	resourceName := "aws_s3_bucket_object.object"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
-	sourceInitial := testAccBucketObjectCreateTempFile(t, "initial object state")
+	sourceInitial := testAccObjectCreateTempFile(t, "initial object state")
 	defer os.Remove(sourceInitial)
-	sourceModified := testAccBucketObjectCreateTempFile(t, "modified object")
+	sourceModified := testAccObjectCreateTempFile(t, "modified object")
 	defer os.Remove(sourceInitial)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketObjectDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -347,7 +346,7 @@ func TestAccS3BucketObject_updates(t *testing.T) {
 				Config: testAccBucketObjectConfig_updateable(rName, false, sourceInitial),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketObjectExists(ctx, resourceName, &originalObj),
-					testAccCheckBucketObjectBody(&originalObj, "initial object state"),
+					testAccCheckObjectBody(&originalObj, "initial object state"),
 					resource.TestCheckResourceAttr(resourceName, "etag", "647d1d58e1011c743ec67d5e8af87b53"),
 					resource.TestCheckResourceAttr(resourceName, "object_lock_legal_hold_status", ""),
 					resource.TestCheckResourceAttr(resourceName, "object_lock_mode", ""),
@@ -358,7 +357,7 @@ func TestAccS3BucketObject_updates(t *testing.T) {
 				Config: testAccBucketObjectConfig_updateable(rName, false, sourceModified),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketObjectExists(ctx, resourceName, &modifiedObj),
-					testAccCheckBucketObjectBody(&modifiedObj, "modified object"),
+					testAccCheckObjectBody(&modifiedObj, "modified object"),
 					resource.TestCheckResourceAttr(resourceName, "etag", "1c7fd13df1515c2a13ad9eb068931f09"),
 					resource.TestCheckResourceAttr(resourceName, "object_lock_legal_hold_status", ""),
 					resource.TestCheckResourceAttr(resourceName, "object_lock_mode", ""),
@@ -385,7 +384,7 @@ func TestAccS3BucketObject_updateSameFile(t *testing.T) {
 	startingData := "lane 8"
 	changingData := "chicane"
 
-	filename := testAccBucketObjectCreateTempFile(t, startingData)
+	filename := testAccObjectCreateTempFile(t, startingData)
 	defer os.Remove(filename)
 
 	rewriteFile := func(*terraform.State) error {
@@ -398,7 +397,7 @@ func TestAccS3BucketObject_updateSameFile(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketObjectDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -406,7 +405,7 @@ func TestAccS3BucketObject_updateSameFile(t *testing.T) {
 				Config: testAccBucketObjectConfig_updateable(rName, false, filename),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketObjectExists(ctx, resourceName, &originalObj),
-					testAccCheckBucketObjectBody(&originalObj, startingData),
+					testAccCheckObjectBody(&originalObj, startingData),
 					resource.TestCheckResourceAttr(resourceName, "etag", "aa48b42f36a2652cbee40c30a5df7d25"),
 					rewriteFile,
 				),
@@ -416,7 +415,7 @@ func TestAccS3BucketObject_updateSameFile(t *testing.T) {
 				Config: testAccBucketObjectConfig_updateable(rName, false, filename),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketObjectExists(ctx, resourceName, &modifiedObj),
-					testAccCheckBucketObjectBody(&modifiedObj, changingData),
+					testAccCheckObjectBody(&modifiedObj, changingData),
 					resource.TestCheckResourceAttr(resourceName, "etag", "fafc05f8c4da0266a99154681ab86e8c"),
 				),
 			},
@@ -430,14 +429,14 @@ func TestAccS3BucketObject_updatesWithVersioning(t *testing.T) {
 	resourceName := "aws_s3_bucket_object.object"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
-	sourceInitial := testAccBucketObjectCreateTempFile(t, "initial versioned object state")
+	sourceInitial := testAccObjectCreateTempFile(t, "initial versioned object state")
 	defer os.Remove(sourceInitial)
-	sourceModified := testAccBucketObjectCreateTempFile(t, "modified versioned object")
+	sourceModified := testAccObjectCreateTempFile(t, "modified versioned object")
 	defer os.Remove(sourceInitial)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketObjectDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -445,7 +444,7 @@ func TestAccS3BucketObject_updatesWithVersioning(t *testing.T) {
 				Config: testAccBucketObjectConfig_updateable(rName, true, sourceInitial),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketObjectExists(ctx, resourceName, &originalObj),
-					testAccCheckBucketObjectBody(&originalObj, "initial versioned object state"),
+					testAccCheckObjectBody(&originalObj, "initial versioned object state"),
 					resource.TestCheckResourceAttr(resourceName, "etag", "cee4407fa91906284e2a5e5e03e86b1b"),
 				),
 			},
@@ -453,9 +452,9 @@ func TestAccS3BucketObject_updatesWithVersioning(t *testing.T) {
 				Config: testAccBucketObjectConfig_updateable(rName, true, sourceModified),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketObjectExists(ctx, resourceName, &modifiedObj),
-					testAccCheckBucketObjectBody(&modifiedObj, "modified versioned object"),
+					testAccCheckObjectBody(&modifiedObj, "modified versioned object"),
 					resource.TestCheckResourceAttr(resourceName, "etag", "00b8c73b1b50e7cc932362c7225b8e29"),
-					testAccCheckBucketObjectVersionIdDiffers(&modifiedObj, &originalObj),
+					testAccCheckObjectVersionIDDiffers(&modifiedObj, &originalObj),
 				),
 			},
 			{
@@ -476,33 +475,33 @@ func TestAccS3BucketObject_updatesWithVersioningViaAccessPoint(t *testing.T) {
 	resourceName := "aws_s3_bucket_object.test"
 	accessPointResourceName := "aws_s3_access_point.test"
 
-	sourceInitial := testAccBucketObjectCreateTempFile(t, "initial versioned object state")
+	sourceInitial := testAccObjectCreateTempFile(t, "initial versioned object state")
 	defer os.Remove(sourceInitial)
-	sourceModified := testAccBucketObjectCreateTempFile(t, "modified versioned object")
+	sourceModified := testAccObjectCreateTempFile(t, "modified versioned object")
 	defer os.Remove(sourceInitial)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketObjectDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccBucketObjectConfig_updateableViaAccessPoint(rName, s3.BucketVersioningStatusEnabled, sourceInitial),
+				Config: testAccBucketObjectConfig_updateableViaAccessPoint(rName, string(types.BucketVersioningStatusEnabled), sourceInitial),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketObjectExists(ctx, resourceName, &originalObj),
-					testAccCheckBucketObjectBody(&originalObj, "initial versioned object state"),
+					testAccCheckObjectBody(&originalObj, "initial versioned object state"),
 					resource.TestCheckResourceAttrPair(resourceName, "bucket", accessPointResourceName, "arn"),
 					resource.TestCheckResourceAttr(resourceName, "etag", "cee4407fa91906284e2a5e5e03e86b1b"),
 				),
 			},
 			{
-				Config: testAccBucketObjectConfig_updateableViaAccessPoint(rName, s3.BucketVersioningStatusEnabled, sourceModified),
+				Config: testAccBucketObjectConfig_updateableViaAccessPoint(rName, string(types.BucketVersioningStatusEnabled), sourceModified),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketObjectExists(ctx, resourceName, &modifiedObj),
-					testAccCheckBucketObjectBody(&modifiedObj, "modified versioned object"),
+					testAccCheckObjectBody(&modifiedObj, "modified versioned object"),
 					resource.TestCheckResourceAttr(resourceName, "etag", "00b8c73b1b50e7cc932362c7225b8e29"),
-					testAccCheckBucketObjectVersionIdDiffers(&modifiedObj, &originalObj),
+					testAccCheckObjectVersionIDDiffers(&modifiedObj, &originalObj),
 				),
 			},
 		},
@@ -515,12 +514,12 @@ func TestAccS3BucketObject_kms(t *testing.T) {
 	resourceName := "aws_s3_bucket_object.object"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
-	source := testAccBucketObjectCreateTempFile(t, "{anything will do }")
+	source := testAccObjectCreateTempFile(t, "{anything will do }")
 	defer os.Remove(source)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketObjectDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -529,8 +528,8 @@ func TestAccS3BucketObject_kms(t *testing.T) {
 				Config:    testAccBucketObjectConfig_kmsID(rName, source),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketObjectExists(ctx, resourceName, &obj),
-					testAccCheckBucketObjectSSE(ctx, resourceName, "aws:kms"),
-					testAccCheckBucketObjectBody(&obj, "{anything will do }"),
+					testAccCheckObjectSSE(ctx, resourceName, "aws:kms"),
+					testAccCheckObjectBody(&obj, "{anything will do }"),
 				),
 			},
 			{
@@ -550,12 +549,12 @@ func TestAccS3BucketObject_sse(t *testing.T) {
 	resourceName := "aws_s3_bucket_object.object"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
-	source := testAccBucketObjectCreateTempFile(t, "{anything will do }")
+	source := testAccObjectCreateTempFile(t, "{anything will do }")
 	defer os.Remove(source)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketObjectDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -564,8 +563,8 @@ func TestAccS3BucketObject_sse(t *testing.T) {
 				Config:    testAccBucketObjectConfig_sse(rName, source),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketObjectExists(ctx, resourceName, &obj),
-					testAccCheckBucketObjectSSE(ctx, resourceName, "AES256"),
-					testAccCheckBucketObjectBody(&obj, "{anything will do }"),
+					testAccCheckObjectSSE(ctx, resourceName, "AES256"),
+					testAccCheckObjectBody(&obj, "{anything will do }"),
 				),
 			},
 			{
@@ -587,37 +586,37 @@ func TestAccS3BucketObject_acl(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketObjectDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccBucketObjectConfig_acl(rName, "some_bucket_content", s3.BucketCannedACLPrivate, true),
+				Config: testAccBucketObjectConfig_acl(rName, "some_bucket_content", string(types.BucketCannedACLPrivate), true),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketObjectExists(ctx, resourceName, &obj1),
-					testAccCheckBucketObjectBody(&obj1, "some_bucket_content"),
-					resource.TestCheckResourceAttr(resourceName, "acl", s3.BucketCannedACLPrivate),
-					testAccCheckBucketObjectACL(ctx, resourceName, []string{"FULL_CONTROL"}),
+					testAccCheckObjectBody(&obj1, "some_bucket_content"),
+					resource.TestCheckResourceAttr(resourceName, "acl", string(types.BucketCannedACLPrivate)),
+					testAccCheckObjectACL(ctx, resourceName, []string{"FULL_CONTROL"}),
 				),
 			},
 			{
-				Config: testAccBucketObjectConfig_acl(rName, "some_bucket_content", s3.BucketCannedACLPublicRead, false),
+				Config: testAccBucketObjectConfig_acl(rName, "some_bucket_content", string(types.BucketCannedACLPublicRead), false),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketObjectExists(ctx, resourceName, &obj2),
-					testAccCheckBucketObjectVersionIdEquals(&obj2, &obj1),
-					testAccCheckBucketObjectBody(&obj2, "some_bucket_content"),
-					resource.TestCheckResourceAttr(resourceName, "acl", s3.BucketCannedACLPublicRead),
-					testAccCheckBucketObjectACL(ctx, resourceName, []string{"FULL_CONTROL", "READ"}),
+					testAccCheckObjectVersionIDEquals(&obj2, &obj1),
+					testAccCheckObjectBody(&obj2, "some_bucket_content"),
+					resource.TestCheckResourceAttr(resourceName, "acl", string(types.BucketCannedACLPublicRead)),
+					testAccCheckObjectACL(ctx, resourceName, []string{"FULL_CONTROL", "READ"}),
 				),
 			},
 			{
-				Config: testAccBucketObjectConfig_acl(rName, "changed_some_bucket_content", s3.BucketCannedACLPrivate, true),
+				Config: testAccBucketObjectConfig_acl(rName, "changed_some_bucket_content", string(types.BucketCannedACLPrivate), true),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketObjectExists(ctx, resourceName, &obj3),
-					testAccCheckBucketObjectVersionIdDiffers(&obj3, &obj2),
-					testAccCheckBucketObjectBody(&obj3, "changed_some_bucket_content"),
-					resource.TestCheckResourceAttr(resourceName, "acl", s3.BucketCannedACLPrivate),
-					testAccCheckBucketObjectACL(ctx, resourceName, []string{"FULL_CONTROL"}),
+					testAccCheckObjectVersionIDDiffers(&obj3, &obj2),
+					testAccCheckObjectBody(&obj3, "changed_some_bucket_content"),
+					resource.TestCheckResourceAttr(resourceName, "acl", string(types.BucketCannedACLPrivate)),
+					testAccCheckObjectACL(ctx, resourceName, []string{"FULL_CONTROL"}),
 				),
 			},
 			{
@@ -639,7 +638,7 @@ func TestAccS3BucketObject_metadata(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketObjectDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -687,7 +686,7 @@ func TestAccS3BucketObject_storageClass(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketObjectDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -697,7 +696,7 @@ func TestAccS3BucketObject_storageClass(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketObjectExists(ctx, resourceName, &obj),
 					resource.TestCheckResourceAttr(resourceName, "storage_class", "STANDARD"),
-					testAccCheckBucketObjectStorageClass(ctx, resourceName, "STANDARD"),
+					testAccCheckObjectStorageClass(ctx, resourceName, "STANDARD"),
 				),
 			},
 			{
@@ -705,7 +704,7 @@ func TestAccS3BucketObject_storageClass(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketObjectExists(ctx, resourceName, &obj),
 					resource.TestCheckResourceAttr(resourceName, "storage_class", "REDUCED_REDUNDANCY"),
-					testAccCheckBucketObjectStorageClass(ctx, resourceName, "REDUCED_REDUNDANCY"),
+					testAccCheckObjectStorageClass(ctx, resourceName, "REDUCED_REDUNDANCY"),
 				),
 			},
 			{
@@ -713,7 +712,7 @@ func TestAccS3BucketObject_storageClass(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					// Can't GetObject on an object in Glacier without restoring it.
 					resource.TestCheckResourceAttr(resourceName, "storage_class", "GLACIER"),
-					testAccCheckBucketObjectStorageClass(ctx, resourceName, "GLACIER"),
+					testAccCheckObjectStorageClass(ctx, resourceName, "GLACIER"),
 				),
 			},
 			{
@@ -721,7 +720,7 @@ func TestAccS3BucketObject_storageClass(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketObjectExists(ctx, resourceName, &obj),
 					resource.TestCheckResourceAttr(resourceName, "storage_class", "INTELLIGENT_TIERING"),
-					testAccCheckBucketObjectStorageClass(ctx, resourceName, "INTELLIGENT_TIERING"),
+					testAccCheckObjectStorageClass(ctx, resourceName, "INTELLIGENT_TIERING"),
 				),
 			},
 			{
@@ -729,7 +728,7 @@ func TestAccS3BucketObject_storageClass(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					// 	Can't GetObject on an object in DEEP_ARCHIVE without restoring it.
 					resource.TestCheckResourceAttr(resourceName, "storage_class", "DEEP_ARCHIVE"),
-					testAccCheckBucketObjectStorageClass(ctx, resourceName, "DEEP_ARCHIVE"),
+					testAccCheckObjectStorageClass(ctx, resourceName, "DEEP_ARCHIVE"),
 				),
 			},
 			{
@@ -752,7 +751,7 @@ func TestAccS3BucketObject_tags(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketObjectDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -761,7 +760,7 @@ func TestAccS3BucketObject_tags(t *testing.T) {
 				Config:    testAccBucketObjectConfig_tags(rName, key, "stuff"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketObjectExists(ctx, resourceName, &obj1),
-					testAccCheckBucketObjectBody(&obj1, "stuff"),
+					testAccCheckObjectBody(&obj1, "stuff"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "3"),
 					resource.TestCheckResourceAttr(resourceName, "tags.Key1", "A@AA"),
 					resource.TestCheckResourceAttr(resourceName, "tags.Key2", "BBB"),
@@ -773,8 +772,8 @@ func TestAccS3BucketObject_tags(t *testing.T) {
 				Config:    testAccBucketObjectConfig_updatedTags(rName, key, "stuff"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketObjectExists(ctx, resourceName, &obj2),
-					testAccCheckBucketObjectVersionIdEquals(&obj2, &obj1),
-					testAccCheckBucketObjectBody(&obj2, "stuff"),
+					testAccCheckObjectVersionIDEquals(&obj2, &obj1),
+					testAccCheckObjectBody(&obj2, "stuff"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "4"),
 					resource.TestCheckResourceAttr(resourceName, "tags.Key2", "B@BB"),
 					resource.TestCheckResourceAttr(resourceName, "tags.Key3", "X X"),
@@ -787,8 +786,8 @@ func TestAccS3BucketObject_tags(t *testing.T) {
 				Config:    testAccBucketObjectConfig_noTags(rName, key, "stuff"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketObjectExists(ctx, resourceName, &obj3),
-					testAccCheckBucketObjectVersionIdEquals(&obj3, &obj2),
-					testAccCheckBucketObjectBody(&obj3, "stuff"),
+					testAccCheckObjectVersionIDEquals(&obj3, &obj2),
+					testAccCheckObjectBody(&obj3, "stuff"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 				),
 			},
@@ -797,8 +796,8 @@ func TestAccS3BucketObject_tags(t *testing.T) {
 				Config:    testAccBucketObjectConfig_tags(rName, key, "changed stuff"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketObjectExists(ctx, resourceName, &obj4),
-					testAccCheckBucketObjectVersionIdDiffers(&obj4, &obj3),
-					testAccCheckBucketObjectBody(&obj4, "changed stuff"),
+					testAccCheckObjectVersionIDDiffers(&obj4, &obj3),
+					testAccCheckObjectBody(&obj4, "changed stuff"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "3"),
 					resource.TestCheckResourceAttr(resourceName, "tags.Key1", "A@AA"),
 					resource.TestCheckResourceAttr(resourceName, "tags.Key2", "BBB"),
@@ -825,7 +824,7 @@ func TestAccS3BucketObject_tagsLeadingSingleSlash(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketObjectDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -834,7 +833,7 @@ func TestAccS3BucketObject_tagsLeadingSingleSlash(t *testing.T) {
 				Config:    testAccBucketObjectConfig_tags(rName, key, "stuff"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketObjectExists(ctx, resourceName, &obj1),
-					testAccCheckBucketObjectBody(&obj1, "stuff"),
+					testAccCheckObjectBody(&obj1, "stuff"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "3"),
 					resource.TestCheckResourceAttr(resourceName, "tags.Key1", "A@AA"),
 					resource.TestCheckResourceAttr(resourceName, "tags.Key2", "BBB"),
@@ -846,8 +845,8 @@ func TestAccS3BucketObject_tagsLeadingSingleSlash(t *testing.T) {
 				Config:    testAccBucketObjectConfig_updatedTags(rName, key, "stuff"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketObjectExists(ctx, resourceName, &obj2),
-					testAccCheckBucketObjectVersionIdEquals(&obj2, &obj1),
-					testAccCheckBucketObjectBody(&obj2, "stuff"),
+					testAccCheckObjectVersionIDEquals(&obj2, &obj1),
+					testAccCheckObjectBody(&obj2, "stuff"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "4"),
 					resource.TestCheckResourceAttr(resourceName, "tags.Key2", "B@BB"),
 					resource.TestCheckResourceAttr(resourceName, "tags.Key3", "X X"),
@@ -860,8 +859,8 @@ func TestAccS3BucketObject_tagsLeadingSingleSlash(t *testing.T) {
 				Config:    testAccBucketObjectConfig_noTags(rName, key, "stuff"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketObjectExists(ctx, resourceName, &obj3),
-					testAccCheckBucketObjectVersionIdEquals(&obj3, &obj2),
-					testAccCheckBucketObjectBody(&obj3, "stuff"),
+					testAccCheckObjectVersionIDEquals(&obj3, &obj2),
+					testAccCheckObjectBody(&obj3, "stuff"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 				),
 			},
@@ -870,8 +869,8 @@ func TestAccS3BucketObject_tagsLeadingSingleSlash(t *testing.T) {
 				Config:    testAccBucketObjectConfig_tags(rName, key, "changed stuff"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketObjectExists(ctx, resourceName, &obj4),
-					testAccCheckBucketObjectVersionIdDiffers(&obj4, &obj3),
-					testAccCheckBucketObjectBody(&obj4, "changed stuff"),
+					testAccCheckObjectVersionIDDiffers(&obj4, &obj3),
+					testAccCheckObjectBody(&obj4, "changed stuff"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "3"),
 					resource.TestCheckResourceAttr(resourceName, "tags.Key1", "A@AA"),
 					resource.TestCheckResourceAttr(resourceName, "tags.Key2", "BBB"),
@@ -898,7 +897,7 @@ func TestAccS3BucketObject_tagsLeadingMultipleSlashes(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketObjectDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -907,7 +906,7 @@ func TestAccS3BucketObject_tagsLeadingMultipleSlashes(t *testing.T) {
 				Config:    testAccBucketObjectConfig_tags(rName, key, "stuff"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketObjectExists(ctx, resourceName, &obj1),
-					testAccCheckBucketObjectBody(&obj1, "stuff"),
+					testAccCheckObjectBody(&obj1, "stuff"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "3"),
 					resource.TestCheckResourceAttr(resourceName, "tags.Key1", "A@AA"),
 					resource.TestCheckResourceAttr(resourceName, "tags.Key2", "BBB"),
@@ -919,8 +918,8 @@ func TestAccS3BucketObject_tagsLeadingMultipleSlashes(t *testing.T) {
 				Config:    testAccBucketObjectConfig_updatedTags(rName, key, "stuff"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketObjectExists(ctx, resourceName, &obj2),
-					testAccCheckBucketObjectVersionIdEquals(&obj2, &obj1),
-					testAccCheckBucketObjectBody(&obj2, "stuff"),
+					testAccCheckObjectVersionIDEquals(&obj2, &obj1),
+					testAccCheckObjectBody(&obj2, "stuff"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "4"),
 					resource.TestCheckResourceAttr(resourceName, "tags.Key2", "B@BB"),
 					resource.TestCheckResourceAttr(resourceName, "tags.Key3", "X X"),
@@ -933,8 +932,8 @@ func TestAccS3BucketObject_tagsLeadingMultipleSlashes(t *testing.T) {
 				Config:    testAccBucketObjectConfig_noTags(rName, key, "stuff"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketObjectExists(ctx, resourceName, &obj3),
-					testAccCheckBucketObjectVersionIdEquals(&obj3, &obj2),
-					testAccCheckBucketObjectBody(&obj3, "stuff"),
+					testAccCheckObjectVersionIDEquals(&obj3, &obj2),
+					testAccCheckObjectBody(&obj3, "stuff"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 				),
 			},
@@ -943,8 +942,8 @@ func TestAccS3BucketObject_tagsLeadingMultipleSlashes(t *testing.T) {
 				Config:    testAccBucketObjectConfig_tags(rName, key, "changed stuff"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketObjectExists(ctx, resourceName, &obj4),
-					testAccCheckBucketObjectVersionIdDiffers(&obj4, &obj3),
-					testAccCheckBucketObjectBody(&obj4, "changed stuff"),
+					testAccCheckObjectVersionIDDiffers(&obj4, &obj3),
+					testAccCheckObjectBody(&obj4, "changed stuff"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "3"),
 					resource.TestCheckResourceAttr(resourceName, "tags.Key1", "A@AA"),
 					resource.TestCheckResourceAttr(resourceName, "tags.Key2", "BBB"),
@@ -964,7 +963,7 @@ func TestAccS3BucketObject_tagsMultipleSlashes(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketObjectDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -973,7 +972,7 @@ func TestAccS3BucketObject_tagsMultipleSlashes(t *testing.T) {
 				Config:    testAccBucketObjectConfig_tags(rName, key, "stuff"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketObjectExists(ctx, resourceName, &obj1),
-					testAccCheckBucketObjectBody(&obj1, "stuff"),
+					testAccCheckObjectBody(&obj1, "stuff"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "3"),
 					resource.TestCheckResourceAttr(resourceName, "tags.Key1", "A@AA"),
 					resource.TestCheckResourceAttr(resourceName, "tags.Key2", "BBB"),
@@ -985,8 +984,8 @@ func TestAccS3BucketObject_tagsMultipleSlashes(t *testing.T) {
 				Config:    testAccBucketObjectConfig_updatedTags(rName, key, "stuff"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketObjectExists(ctx, resourceName, &obj2),
-					testAccCheckBucketObjectVersionIdEquals(&obj2, &obj1),
-					testAccCheckBucketObjectBody(&obj2, "stuff"),
+					testAccCheckObjectVersionIDEquals(&obj2, &obj1),
+					testAccCheckObjectBody(&obj2, "stuff"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "4"),
 					resource.TestCheckResourceAttr(resourceName, "tags.Key2", "B@BB"),
 					resource.TestCheckResourceAttr(resourceName, "tags.Key3", "X X"),
@@ -999,8 +998,8 @@ func TestAccS3BucketObject_tagsMultipleSlashes(t *testing.T) {
 				Config:    testAccBucketObjectConfig_noTags(rName, key, "stuff"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketObjectExists(ctx, resourceName, &obj3),
-					testAccCheckBucketObjectVersionIdEquals(&obj3, &obj2),
-					testAccCheckBucketObjectBody(&obj3, "stuff"),
+					testAccCheckObjectVersionIDEquals(&obj3, &obj2),
+					testAccCheckObjectBody(&obj3, "stuff"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 				),
 			},
@@ -1009,8 +1008,8 @@ func TestAccS3BucketObject_tagsMultipleSlashes(t *testing.T) {
 				Config:    testAccBucketObjectConfig_tags(rName, key, "changed stuff"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketObjectExists(ctx, resourceName, &obj4),
-					testAccCheckBucketObjectVersionIdDiffers(&obj4, &obj3),
-					testAccCheckBucketObjectBody(&obj4, "changed stuff"),
+					testAccCheckObjectVersionIDDiffers(&obj4, &obj3),
+					testAccCheckObjectBody(&obj4, "changed stuff"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "3"),
 					resource.TestCheckResourceAttr(resourceName, "tags.Key1", "A@AA"),
 					resource.TestCheckResourceAttr(resourceName, "tags.Key2", "BBB"),
@@ -1029,7 +1028,7 @@ func TestAccS3BucketObject_objectLockLegalHoldStartWithNone(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketObjectDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -1037,7 +1036,7 @@ func TestAccS3BucketObject_objectLockLegalHoldStartWithNone(t *testing.T) {
 				Config: testAccBucketObjectConfig_noLockLegalHold(rName, "stuff"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketObjectExists(ctx, resourceName, &obj1),
-					testAccCheckBucketObjectBody(&obj1, "stuff"),
+					testAccCheckObjectBody(&obj1, "stuff"),
 					resource.TestCheckResourceAttr(resourceName, "object_lock_legal_hold_status", ""),
 					resource.TestCheckResourceAttr(resourceName, "object_lock_mode", ""),
 					resource.TestCheckResourceAttr(resourceName, "object_lock_retain_until_date", ""),
@@ -1047,8 +1046,8 @@ func TestAccS3BucketObject_objectLockLegalHoldStartWithNone(t *testing.T) {
 				Config: testAccBucketObjectConfig_lockLegalHold(rName, "stuff", "ON"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketObjectExists(ctx, resourceName, &obj2),
-					testAccCheckBucketObjectVersionIdEquals(&obj2, &obj1),
-					testAccCheckBucketObjectBody(&obj2, "stuff"),
+					testAccCheckObjectVersionIDEquals(&obj2, &obj1),
+					testAccCheckObjectBody(&obj2, "stuff"),
 					resource.TestCheckResourceAttr(resourceName, "object_lock_legal_hold_status", "ON"),
 					resource.TestCheckResourceAttr(resourceName, "object_lock_mode", ""),
 					resource.TestCheckResourceAttr(resourceName, "object_lock_retain_until_date", ""),
@@ -1059,8 +1058,8 @@ func TestAccS3BucketObject_objectLockLegalHoldStartWithNone(t *testing.T) {
 				Config: testAccBucketObjectConfig_lockLegalHold(rName, "changed stuff", "OFF"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketObjectExists(ctx, resourceName, &obj3),
-					testAccCheckBucketObjectVersionIdDiffers(&obj3, &obj2),
-					testAccCheckBucketObjectBody(&obj3, "changed stuff"),
+					testAccCheckObjectVersionIDDiffers(&obj3, &obj2),
+					testAccCheckObjectBody(&obj3, "changed stuff"),
 					resource.TestCheckResourceAttr(resourceName, "object_lock_legal_hold_status", "OFF"),
 					resource.TestCheckResourceAttr(resourceName, "object_lock_mode", ""),
 					resource.TestCheckResourceAttr(resourceName, "object_lock_retain_until_date", ""),
@@ -1078,7 +1077,7 @@ func TestAccS3BucketObject_objectLockLegalHoldStartWithOn(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketObjectDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -1086,7 +1085,7 @@ func TestAccS3BucketObject_objectLockLegalHoldStartWithOn(t *testing.T) {
 				Config: testAccBucketObjectConfig_lockLegalHold(rName, "stuff", "ON"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketObjectExists(ctx, resourceName, &obj1),
-					testAccCheckBucketObjectBody(&obj1, "stuff"),
+					testAccCheckObjectBody(&obj1, "stuff"),
 					resource.TestCheckResourceAttr(resourceName, "object_lock_legal_hold_status", "ON"),
 					resource.TestCheckResourceAttr(resourceName, "object_lock_mode", ""),
 					resource.TestCheckResourceAttr(resourceName, "object_lock_retain_until_date", ""),
@@ -1096,8 +1095,8 @@ func TestAccS3BucketObject_objectLockLegalHoldStartWithOn(t *testing.T) {
 				Config: testAccBucketObjectConfig_lockLegalHold(rName, "stuff", "OFF"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketObjectExists(ctx, resourceName, &obj2),
-					testAccCheckBucketObjectVersionIdEquals(&obj2, &obj1),
-					testAccCheckBucketObjectBody(&obj2, "stuff"),
+					testAccCheckObjectVersionIDEquals(&obj2, &obj1),
+					testAccCheckObjectBody(&obj2, "stuff"),
 					resource.TestCheckResourceAttr(resourceName, "object_lock_legal_hold_status", "OFF"),
 					resource.TestCheckResourceAttr(resourceName, "object_lock_mode", ""),
 					resource.TestCheckResourceAttr(resourceName, "object_lock_retain_until_date", ""),
@@ -1116,7 +1115,7 @@ func TestAccS3BucketObject_objectLockRetentionStartWithNone(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketObjectDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -1124,7 +1123,7 @@ func TestAccS3BucketObject_objectLockRetentionStartWithNone(t *testing.T) {
 				Config: testAccBucketObjectConfig_noLockRetention(rName, "stuff"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketObjectExists(ctx, resourceName, &obj1),
-					testAccCheckBucketObjectBody(&obj1, "stuff"),
+					testAccCheckObjectBody(&obj1, "stuff"),
 					resource.TestCheckResourceAttr(resourceName, "object_lock_legal_hold_status", ""),
 					resource.TestCheckResourceAttr(resourceName, "object_lock_mode", ""),
 					resource.TestCheckResourceAttr(resourceName, "object_lock_retain_until_date", ""),
@@ -1134,8 +1133,8 @@ func TestAccS3BucketObject_objectLockRetentionStartWithNone(t *testing.T) {
 				Config: testAccBucketObjectConfig_lockRetention(rName, "stuff", retainUntilDate),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketObjectExists(ctx, resourceName, &obj2),
-					testAccCheckBucketObjectVersionIdEquals(&obj2, &obj1),
-					testAccCheckBucketObjectBody(&obj2, "stuff"),
+					testAccCheckObjectVersionIDEquals(&obj2, &obj1),
+					testAccCheckObjectBody(&obj2, "stuff"),
 					resource.TestCheckResourceAttr(resourceName, "object_lock_legal_hold_status", ""),
 					resource.TestCheckResourceAttr(resourceName, "object_lock_mode", "GOVERNANCE"),
 					resource.TestCheckResourceAttr(resourceName, "object_lock_retain_until_date", retainUntilDate),
@@ -1146,8 +1145,8 @@ func TestAccS3BucketObject_objectLockRetentionStartWithNone(t *testing.T) {
 				Config: testAccBucketObjectConfig_noLockRetention(rName, "changed stuff"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketObjectExists(ctx, resourceName, &obj3),
-					testAccCheckBucketObjectVersionIdDiffers(&obj3, &obj2),
-					testAccCheckBucketObjectBody(&obj3, "changed stuff"),
+					testAccCheckObjectVersionIDDiffers(&obj3, &obj2),
+					testAccCheckObjectBody(&obj3, "changed stuff"),
 					resource.TestCheckResourceAttr(resourceName, "object_lock_legal_hold_status", ""),
 					resource.TestCheckResourceAttr(resourceName, "object_lock_mode", ""),
 					resource.TestCheckResourceAttr(resourceName, "object_lock_retain_until_date", ""),
@@ -1168,7 +1167,7 @@ func TestAccS3BucketObject_objectLockRetentionStartWithSet(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketObjectDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -1176,7 +1175,7 @@ func TestAccS3BucketObject_objectLockRetentionStartWithSet(t *testing.T) {
 				Config: testAccBucketObjectConfig_lockRetention(rName, "stuff", retainUntilDate1),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketObjectExists(ctx, resourceName, &obj1),
-					testAccCheckBucketObjectBody(&obj1, "stuff"),
+					testAccCheckObjectBody(&obj1, "stuff"),
 					resource.TestCheckResourceAttr(resourceName, "object_lock_legal_hold_status", ""),
 					resource.TestCheckResourceAttr(resourceName, "object_lock_mode", "GOVERNANCE"),
 					resource.TestCheckResourceAttr(resourceName, "object_lock_retain_until_date", retainUntilDate1),
@@ -1186,8 +1185,8 @@ func TestAccS3BucketObject_objectLockRetentionStartWithSet(t *testing.T) {
 				Config: testAccBucketObjectConfig_lockRetention(rName, "stuff", retainUntilDate2),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketObjectExists(ctx, resourceName, &obj2),
-					testAccCheckBucketObjectVersionIdEquals(&obj2, &obj1),
-					testAccCheckBucketObjectBody(&obj2, "stuff"),
+					testAccCheckObjectVersionIDEquals(&obj2, &obj1),
+					testAccCheckObjectBody(&obj2, "stuff"),
 					resource.TestCheckResourceAttr(resourceName, "object_lock_legal_hold_status", ""),
 					resource.TestCheckResourceAttr(resourceName, "object_lock_mode", "GOVERNANCE"),
 					resource.TestCheckResourceAttr(resourceName, "object_lock_retain_until_date", retainUntilDate2),
@@ -1197,8 +1196,8 @@ func TestAccS3BucketObject_objectLockRetentionStartWithSet(t *testing.T) {
 				Config: testAccBucketObjectConfig_lockRetention(rName, "stuff", retainUntilDate3),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketObjectExists(ctx, resourceName, &obj3),
-					testAccCheckBucketObjectVersionIdEquals(&obj3, &obj2),
-					testAccCheckBucketObjectBody(&obj3, "stuff"),
+					testAccCheckObjectVersionIDEquals(&obj3, &obj2),
+					testAccCheckObjectBody(&obj3, "stuff"),
 					resource.TestCheckResourceAttr(resourceName, "object_lock_legal_hold_status", ""),
 					resource.TestCheckResourceAttr(resourceName, "object_lock_mode", "GOVERNANCE"),
 					resource.TestCheckResourceAttr(resourceName, "object_lock_retain_until_date", retainUntilDate3),
@@ -1208,8 +1207,8 @@ func TestAccS3BucketObject_objectLockRetentionStartWithSet(t *testing.T) {
 				Config: testAccBucketObjectConfig_noLockRetention(rName, "stuff"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketObjectExists(ctx, resourceName, &obj4),
-					testAccCheckBucketObjectVersionIdEquals(&obj4, &obj3),
-					testAccCheckBucketObjectBody(&obj4, "stuff"),
+					testAccCheckObjectVersionIDEquals(&obj4, &obj3),
+					testAccCheckObjectBody(&obj4, "stuff"),
 					resource.TestCheckResourceAttr(resourceName, "object_lock_legal_hold_status", ""),
 					resource.TestCheckResourceAttr(resourceName, "object_lock_mode", ""),
 					resource.TestCheckResourceAttr(resourceName, "object_lock_retain_until_date", ""),
@@ -1227,7 +1226,7 @@ func TestAccS3BucketObject_objectBucketKeyEnabled(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketObjectDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -1235,7 +1234,7 @@ func TestAccS3BucketObject_objectBucketKeyEnabled(t *testing.T) {
 				Config: testAccBucketObjectConfig_objectKeyEnabled(rName, "stuff"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketObjectExists(ctx, resourceName, &obj),
-					testAccCheckBucketObjectBody(&obj, "stuff"),
+					testAccCheckObjectBody(&obj, "stuff"),
 					resource.TestCheckResourceAttr(resourceName, "bucket_key_enabled", "true"),
 				),
 			},
@@ -1251,7 +1250,7 @@ func TestAccS3BucketObject_bucketBucketKeyEnabled(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketObjectDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -1259,7 +1258,7 @@ func TestAccS3BucketObject_bucketBucketKeyEnabled(t *testing.T) {
 				Config: testAccBucketObjectConfig_bucketKeyEnabled(rName, "stuff"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketObjectExists(ctx, resourceName, &obj),
-					testAccCheckBucketObjectBody(&obj, "stuff"),
+					testAccCheckObjectBody(&obj, "stuff"),
 					resource.TestCheckResourceAttr(resourceName, "bucket_key_enabled", "true"),
 				),
 			},
@@ -1275,7 +1274,7 @@ func TestAccS3BucketObject_defaultBucketSSE(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketObjectDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -1283,7 +1282,7 @@ func TestAccS3BucketObject_defaultBucketSSE(t *testing.T) {
 				Config: testAccBucketObjectConfig_defaultSSE(rName, "stuff"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketObjectExists(ctx, resourceName, &obj1),
-					testAccCheckBucketObjectBody(&obj1, "stuff"),
+					testAccCheckObjectBody(&obj1, "stuff"),
 				),
 			},
 		},
@@ -1299,7 +1298,7 @@ func TestAccS3BucketObject_ignoreTags(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketObjectDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -1310,10 +1309,10 @@ func TestAccS3BucketObject_ignoreTags(t *testing.T) {
 					testAccBucketObjectConfig_noTags(rName, key, "stuff")),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketObjectExists(ctx, resourceName, &obj),
-					testAccCheckBucketObjectBody(&obj, "stuff"),
-					testAccCheckBucketObjectUpdateTags(ctx, resourceName, nil, map[string]string{"ignorekey1": "ignorevalue1"}),
+					testAccCheckObjectBody(&obj, "stuff"),
+					testAccCheckObjectUpdateTags(ctx, resourceName, nil, map[string]string{"ignorekey1": "ignorevalue1"}),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
-					testAccCheckBucketObjectCheckTags(ctx, resourceName, map[string]string{
+					testAccCheckObjectCheckTags(ctx, resourceName, map[string]string{
 						"ignorekey1": "ignorevalue1",
 					}),
 				),
@@ -1325,12 +1324,12 @@ func TestAccS3BucketObject_ignoreTags(t *testing.T) {
 					testAccBucketObjectConfig_tags(rName, key, "stuff")),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketObjectExists(ctx, resourceName, &obj),
-					testAccCheckBucketObjectBody(&obj, "stuff"),
+					testAccCheckObjectBody(&obj, "stuff"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "3"),
 					resource.TestCheckResourceAttr(resourceName, "tags.Key1", "A@AA"),
 					resource.TestCheckResourceAttr(resourceName, "tags.Key2", "BBB"),
 					resource.TestCheckResourceAttr(resourceName, "tags.Key3", "CCC"),
-					testAccCheckBucketObjectCheckTags(ctx, resourceName, map[string]string{
+					testAccCheckObjectCheckTags(ctx, resourceName, map[string]string{
 						"ignorekey1": "ignorevalue1",
 						"Key1":       "A@AA",
 						"Key2":       "BBB",
@@ -1342,50 +1341,16 @@ func TestAccS3BucketObject_ignoreTags(t *testing.T) {
 	})
 }
 
-func testAccCheckBucketObjectVersionIdDiffers(first, second *s3.GetObjectOutput) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		if first.VersionId == nil {
-			return fmt.Errorf("Expected first object to have VersionId: %s", first)
-		}
-		if second.VersionId == nil {
-			return fmt.Errorf("Expected second object to have VersionId: %s", second)
-		}
-
-		if *first.VersionId == *second.VersionId {
-			return fmt.Errorf("Expected Version IDs to differ, but they are equal (%s)", *first.VersionId)
-		}
-
-		return nil
-	}
-}
-
-func testAccCheckBucketObjectVersionIdEquals(first, second *s3.GetObjectOutput) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		if first.VersionId == nil {
-			return fmt.Errorf("Expected first object to have VersionId: %s", first)
-		}
-		if second.VersionId == nil {
-			return fmt.Errorf("Expected second object to have VersionId: %s", second)
-		}
-
-		if *first.VersionId != *second.VersionId {
-			return fmt.Errorf("Expected Version IDs to be equal, but they differ (%s, %s)", *first.VersionId, *second.VersionId)
-		}
-
-		return nil
-	}
-}
-
 func testAccCheckBucketObjectDestroy(ctx context.Context) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Conn(ctx)
+		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Client(ctx)
 
 		for _, rs := range s.RootModule().Resources {
 			if rs.Type != "aws_s3_bucket_object" {
 				continue
 			}
 
-			_, err := tfs3.FindObjectByThreePartKey(ctx, conn, rs.Primary.Attributes["bucket"], rs.Primary.Attributes["key"], rs.Primary.Attributes["etag"])
+			_, err := tfs3.FindObjectByBucketAndKey(ctx, conn, rs.Primary.Attributes["bucket"], tfs3.SDKv1CompatibleCleanKey(rs.Primary.Attributes["key"]), rs.Primary.Attributes["etag"], rs.Primary.Attributes["checksum_algorithm"])
 
 			if tfresource.NotFound(err) {
 				continue
@@ -1402,192 +1367,28 @@ func testAccCheckBucketObjectDestroy(ctx context.Context) resource.TestCheckFunc
 	}
 }
 
-func testAccCheckBucketObjectExists(ctx context.Context, n string, obj *s3.GetObjectOutput) resource.TestCheckFunc {
+func testAccCheckBucketObjectExists(ctx context.Context, n string, v *s3.GetObjectOutput) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		rs, ok := s.RootModule().Resources[n]
 		if !ok {
 			return fmt.Errorf("Not Found: %s", n)
 		}
 
-		if rs.Primary.ID == "" {
-			return fmt.Errorf("No S3 Object ID is set")
-		}
-
-		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Conn(ctx)
+		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Client(ctx)
 
 		input := &s3.GetObjectInput{
 			Bucket:  aws.String(rs.Primary.Attributes["bucket"]),
-			Key:     aws.String(rs.Primary.Attributes["key"]),
+			Key:     aws.String(tfs3.SDKv1CompatibleCleanKey(rs.Primary.Attributes["key"])),
 			IfMatch: aws.String(rs.Primary.Attributes["etag"]),
 		}
 
-		var out *s3.GetObjectOutput
-
-		err := retry.RetryContext(ctx, 2*time.Minute, func() *retry.RetryError {
-			var err error
-			out, err = conn.GetObjectWithContext(ctx, input)
-
-			if tfawserr.ErrCodeEquals(err, s3.ErrCodeNoSuchKey) {
-				return retry.RetryableError(
-					fmt.Errorf("getting object %s, retrying: %w", rs.Primary.Attributes["bucket"], err),
-				)
-			}
-
-			if err != nil {
-				return retry.NonRetryableError(err)
-			}
-
-			return nil
-		})
-		if tfresource.TimedOut(err) {
-			out, err = conn.GetObjectWithContext(ctx, input)
-		}
-
-		if err != nil {
-			return fmt.Errorf("S3 Object error: %s", err)
-		}
-
-		*obj = *out
-
-		return nil
-	}
-}
-
-func testAccCheckBucketObjectBody(obj *s3.GetObjectOutput, want string) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		body, err := io.ReadAll(obj.Body)
-		if err != nil {
-			return fmt.Errorf("failed to read body: %s", err)
-		}
-		obj.Body.Close()
-
-		if got := string(body); got != want {
-			return fmt.Errorf("wrong result body %q; want %q", got, want)
-		}
-
-		return nil
-	}
-}
-
-func testAccCheckBucketObjectACL(ctx context.Context, n string, expectedPerms []string) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		rs := s.RootModule().Resources[n]
-		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Conn(ctx)
-
-		out, err := conn.GetObjectAclWithContext(ctx, &s3.GetObjectAclInput{
-			Bucket: aws.String(rs.Primary.Attributes["bucket"]),
-			Key:    aws.String(rs.Primary.Attributes["key"]),
-		})
-
-		if err != nil {
-			return fmt.Errorf("GetObjectAcl error: %v", err)
-		}
-
-		var perms []string
-		for _, v := range out.Grants {
-			perms = append(perms, *v.Permission)
-		}
-		sort.Strings(perms)
-
-		if !reflect.DeepEqual(perms, expectedPerms) {
-			return fmt.Errorf("Expected ACL permissions to be %v, got %v", expectedPerms, perms)
-		}
-
-		return nil
-	}
-}
-
-func testAccCheckBucketObjectStorageClass(ctx context.Context, n, expectedClass string) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		rs := s.RootModule().Resources[n]
-		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Conn(ctx)
-
-		out, err := tfs3.FindObjectByThreePartKey(ctx, conn, rs.Primary.Attributes["bucket"], rs.Primary.Attributes["key"], "")
-
-		if err != nil {
-			return err
-		}
-
-		// The "STANDARD" (which is also the default) storage
-		// class when set would not be included in the results.
-		storageClass := s3.StorageClassStandard
-		if out.StorageClass != nil {
-			storageClass = *out.StorageClass
-		}
-
-		if storageClass != expectedClass {
-			return fmt.Errorf("Expected Storage Class to be %v, got %v",
-				expectedClass, storageClass)
-		}
-
-		return nil
-	}
-}
-
-func testAccCheckBucketObjectSSE(ctx context.Context, n, expectedSSE string) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		rs := s.RootModule().Resources[n]
-		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Conn(ctx)
-
-		out, err := tfs3.FindObjectByThreePartKey(ctx, conn, rs.Primary.Attributes["bucket"], rs.Primary.Attributes["key"], "")
+		output, err := conn.GetObject(ctx, input)
 
 		if err != nil {
 			return err
 		}
 
-		if out.ServerSideEncryption == nil {
-			return fmt.Errorf("Expected a non %v Server Side Encryption.", out.ServerSideEncryption)
-		}
-
-		sse := *out.ServerSideEncryption
-		if sse != expectedSSE {
-			return fmt.Errorf("Expected Server Side Encryption %v, got %v.",
-				expectedSSE, sse)
-		}
-
-		return nil
-	}
-}
-
-func testAccBucketObjectCreateTempFile(t *testing.T, data string) string {
-	tmpFile, err := os.CreateTemp("", "tf-acc-s3-obj")
-	if err != nil {
-		t.Fatal(err)
-	}
-	filename := tmpFile.Name()
-
-	err = os.WriteFile(filename, []byte(data), 0644)
-	if err != nil {
-		os.Remove(filename)
-		t.Fatal(err)
-	}
-
-	return filename
-}
-
-func testAccCheckBucketObjectUpdateTags(ctx context.Context, n string, oldTags, newTags map[string]string) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		rs := s.RootModule().Resources[n]
-		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Conn(ctx)
-
-		return tfs3.ObjectUpdateTags(ctx, conn, rs.Primary.Attributes["bucket"], rs.Primary.Attributes["key"], oldTags, newTags)
-	}
-}
-
-func testAccCheckBucketObjectCheckTags(ctx context.Context, n string, expectedTags map[string]string) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		rs := s.RootModule().Resources[n]
-		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Conn(ctx)
-
-		got, err := tfs3.ObjectListTags(ctx, conn, rs.Primary.Attributes["bucket"], rs.Primary.Attributes["key"])
-		if err != nil {
-			return err
-		}
-
-		want := tftags.New(ctx, expectedTags)
-		if !reflect.DeepEqual(want, got) {
-			return fmt.Errorf("Incorrect tags, want: %v got: %v", want, got)
-		}
+		*v = *output
 
 		return nil
 	}
diff --git a/internal/service/s3/bucket_objects_data_source.go b/internal/service/s3/bucket_objects_data_source.go
index 2b9aa48f743..052d6377e32 100644
--- a/internal/service/s3/bucket_objects_data_source.go
+++ b/internal/service/s3/bucket_objects_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3
 
 // WARNING: This code is DEPRECATED and will be removed in a future release!!
@@ -7,8 +10,9 @@ package s3
 import (
 	"context"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/s3"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/s3"
+	"github.com/aws/aws-sdk-go-v2/service/s3/types"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
@@ -26,9 +30,10 @@ func DataSourceBucketObjects() *schema.Resource {
 				Type:       schema.TypeString,
 				Required:   true,
 			},
-			"prefix": {
-				Type:     schema.TypeString,
-				Optional: true,
+			"common_prefixes": {
+				Type:     schema.TypeList,
+				Computed: true,
+				Elem:     &schema.Schema{Type: schema.TypeString},
 			},
 			"delimiter": {
 				Type:     schema.TypeString,
@@ -38,15 +43,6 @@ func DataSourceBucketObjects() *schema.Resource {
 				Type:     schema.TypeString,
 				Optional: true,
 			},
-			"max_keys": {
-				Type:     schema.TypeInt,
-				Optional: true,
-				Default:  1000,
-			},
-			"start_after": {
-				Type:     schema.TypeString,
-				Optional: true,
-			},
 			"fetch_owner": {
 				Type:     schema.TypeBool,
 				Optional: true,
@@ -56,16 +52,24 @@ func DataSourceBucketObjects() *schema.Resource {
 				Computed: true,
 				Elem:     &schema.Schema{Type: schema.TypeString},
 			},
-			"common_prefixes": {
-				Type:     schema.TypeList,
-				Computed: true,
-				Elem:     &schema.Schema{Type: schema.TypeString},
+			"max_keys": {
+				Type:     schema.TypeInt,
+				Optional: true,
+				Default:  1000,
 			},
 			"owners": {
 				Type:     schema.TypeList,
 				Computed: true,
 				Elem:     &schema.Schema{Type: schema.TypeString},
 			},
+			"prefix": {
+				Type:     schema.TypeString,
+				Optional: true,
+			},
+			"start_after": {
+				Type:     schema.TypeString,
+				Optional: true,
+			},
 		},
 
 		DeprecationMessage: `use the aws_s3_objects data source instead`,
@@ -74,25 +78,19 @@ func DataSourceBucketObjects() *schema.Resource {
 
 func dataSourceBucketObjectsRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).S3Conn(ctx)
+	conn := meta.(*conns.AWSClient).S3Client(ctx)
 
 	bucket := d.Get("bucket").(string)
-	prefix := d.Get("prefix").(string)
-
-	listInput := s3.ListObjectsV2Input{
+	input := &s3.ListObjectsV2Input{
 		Bucket: aws.String(bucket),
 	}
 
-	if prefix != "" {
-		listInput.Prefix = aws.String(prefix)
-	}
-
 	if s, ok := d.GetOk("delimiter"); ok {
-		listInput.Delimiter = aws.String(s.(string))
+		input.Delimiter = aws.String(s.(string))
 	}
 
 	if s, ok := d.GetOk("encoding_type"); ok {
-		listInput.EncodingType = aws.String(s.(string))
+		input.EncodingType = types.EncodingType(s.(string))
 	}
 
 	// "listInput.MaxKeys" refers to max keys returned in a single request
@@ -100,60 +98,56 @@ func dataSourceBucketObjectsRead(ctx context.Context, d *schema.ResourceData, me
 	// through the results. "maxKeys" does refer to total keys returned.
 	maxKeys := int64(d.Get("max_keys").(int))
 	if maxKeys <= keyRequestPageSize {
-		listInput.MaxKeys = aws.Int64(maxKeys)
+		input.MaxKeys = int32(maxKeys)
+	}
+
+	if s, ok := d.GetOk("prefix"); ok {
+		input.Prefix = aws.String(s.(string))
 	}
 
 	if s, ok := d.GetOk("start_after"); ok {
-		listInput.StartAfter = aws.String(s.(string))
+		input.StartAfter = aws.String(s.(string))
 	}
 
 	if b, ok := d.GetOk("fetch_owner"); ok {
-		listInput.FetchOwner = aws.Bool(b.(bool))
+		input.FetchOwner = b.(bool)
 	}
 
-	var commonPrefixes []string
-	var keys []string
-	var owners []string
+	var nKeys int64
+	var commonPrefixes, keys, owners []string
+
+	pages := s3.NewListObjectsV2Paginator(conn, input)
+pageLoop:
+	for pages.HasMorePages() {
+		page, err := pages.NextPage(ctx)
+
+		if err != nil {
+			return sdkdiag.AppendErrorf(diags, "listing S3 Bucket (%s) Objects: %s", bucket, err)
+		}
 
-	err := conn.ListObjectsV2PagesWithContext(ctx, &listInput, func(page *s3.ListObjectsV2Output, lastPage bool) bool {
 		for _, commonPrefix := range page.CommonPrefixes {
-			commonPrefixes = append(commonPrefixes, aws.StringValue(commonPrefix.Prefix))
+			commonPrefixes = append(commonPrefixes, aws.ToString(commonPrefix.Prefix))
 		}
 
 		for _, object := range page.Contents {
-			keys = append(keys, aws.StringValue(object.Key))
+			if nKeys >= maxKeys {
+				break pageLoop
+			}
+
+			keys = append(keys, aws.ToString(object.Key))
 
 			if object.Owner != nil {
-				owners = append(owners, aws.StringValue(object.Owner.ID))
+				owners = append(owners, aws.ToString(object.Owner.ID))
 			}
-		}
 
-		maxKeys = maxKeys - aws.Int64Value(page.KeyCount)
-
-		if maxKeys <= keyRequestPageSize {
-			listInput.MaxKeys = aws.Int64(maxKeys)
+			nKeys++
 		}
-
-		return !lastPage
-	})
-
-	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "listing S3 Bucket (%s) Objects: %s", bucket, err)
 	}
 
 	d.SetId(bucket)
-
-	if err := d.Set("common_prefixes", commonPrefixes); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting common_prefixes: %s", err)
-	}
-
-	if err := d.Set("keys", keys); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting keys: %s", err)
-	}
-
-	if err := d.Set("owners", owners); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting owners: %s", err)
-	}
+	d.Set("common_prefixes", commonPrefixes)
+	d.Set("keys", keys)
+	d.Set("owners", owners)
 
 	return diags
 }
diff --git a/internal/service/s3/bucket_objects_data_source_test.go b/internal/service/s3/bucket_objects_data_source_test.go
index f815abc2e3c..a7829183132 100644
--- a/internal/service/s3/bucket_objects_data_source_test.go
+++ b/internal/service/s3/bucket_objects_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3_test
 
 // WARNING: This code is DEPRECATED and will be removed in a future release!!
@@ -8,10 +11,10 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/service/s3"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
+	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
 func TestAccS3BucketObjectsDataSource_basic(t *testing.T) {
@@ -20,7 +23,7 @@ func TestAccS3BucketObjectsDataSource_basic(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                  func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:                acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:                acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories:  acctest.ProtoV5ProviderFactories,
 		PreventPostDestroyRefresh: true,
 		Steps: []resource.TestStep{
@@ -31,7 +34,6 @@ func TestAccS3BucketObjectsDataSource_basic(t *testing.T) {
 			{
 				Config: testAccBucketObjectsDataSourceConfig_basic(rInt),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckObjectsExistsDataSource("data.aws_s3_objects.yesh"),
 					resource.TestCheckResourceAttr("data.aws_s3_objects.yesh", "keys.#", "2"),
 					resource.TestCheckResourceAttr("data.aws_s3_objects.yesh", "keys.0", "arch/navajo/north_window"),
 					resource.TestCheckResourceAttr("data.aws_s3_objects.yesh", "keys.1", "arch/navajo/sand_dune"),
@@ -47,7 +49,7 @@ func TestAccS3BucketObjectsDataSource_basicViaAccessPoint(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                  func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:                acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:                acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories:  acctest.ProtoV5ProviderFactories,
 		PreventPostDestroyRefresh: true,
 		Steps: []resource.TestStep{
@@ -58,7 +60,6 @@ func TestAccS3BucketObjectsDataSource_basicViaAccessPoint(t *testing.T) {
 			{
 				Config: testAccBucketObjectsDataSourceConfig_basicViaAccessPoint(rInt),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckObjectsExistsDataSource("data.aws_s3_objects.yesh"),
 					resource.TestCheckResourceAttr("data.aws_s3_objects.yesh", "keys.#", "2"),
 					resource.TestCheckResourceAttr("data.aws_s3_objects.yesh", "keys.0", "arch/navajo/north_window"),
 					resource.TestCheckResourceAttr("data.aws_s3_objects.yesh", "keys.1", "arch/navajo/sand_dune"),
@@ -74,7 +75,7 @@ func TestAccS3BucketObjectsDataSource_all(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                  func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:                acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:                acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories:  acctest.ProtoV5ProviderFactories,
 		PreventPostDestroyRefresh: true,
 		Steps: []resource.TestStep{
@@ -85,7 +86,6 @@ func TestAccS3BucketObjectsDataSource_all(t *testing.T) {
 			{
 				Config: testAccBucketObjectsDataSourceConfig_all(rInt),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckObjectsExistsDataSource("data.aws_s3_objects.yesh"),
 					resource.TestCheckResourceAttr("data.aws_s3_objects.yesh", "keys.#", "7"),
 					resource.TestCheckResourceAttr("data.aws_s3_objects.yesh", "keys.0", "arch/courthouse_towers/landscape"),
 					resource.TestCheckResourceAttr("data.aws_s3_objects.yesh", "keys.1", "arch/navajo/north_window"),
@@ -106,7 +106,7 @@ func TestAccS3BucketObjectsDataSource_prefixes(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                  func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:                acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:                acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories:  acctest.ProtoV5ProviderFactories,
 		PreventPostDestroyRefresh: true,
 		Steps: []resource.TestStep{
@@ -117,7 +117,6 @@ func TestAccS3BucketObjectsDataSource_prefixes(t *testing.T) {
 			{
 				Config: testAccBucketObjectsDataSourceConfig_prefixes(rInt),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckObjectsExistsDataSource("data.aws_s3_objects.yesh"),
 					resource.TestCheckResourceAttr("data.aws_s3_objects.yesh", "keys.#", "1"),
 					resource.TestCheckResourceAttr("data.aws_s3_objects.yesh", "keys.0", "arch/rubicon"),
 					resource.TestCheckResourceAttr("data.aws_s3_objects.yesh", "common_prefixes.#", "4"),
@@ -137,7 +136,7 @@ func TestAccS3BucketObjectsDataSource_encoded(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                  func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:                acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:                acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories:  acctest.ProtoV5ProviderFactories,
 		PreventPostDestroyRefresh: true,
 		Steps: []resource.TestStep{
@@ -148,7 +147,6 @@ func TestAccS3BucketObjectsDataSource_encoded(t *testing.T) {
 			{
 				Config: testAccBucketObjectsDataSourceConfig_encoded(rInt),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckObjectsExistsDataSource("data.aws_s3_objects.yesh"),
 					resource.TestCheckResourceAttr("data.aws_s3_objects.yesh", "keys.#", "2"),
 					resource.TestCheckResourceAttr("data.aws_s3_objects.yesh", "keys.0", "arch/ru+b+ic+on"),
 					resource.TestCheckResourceAttr("data.aws_s3_objects.yesh", "keys.1", "arch/rubicon"),
@@ -164,7 +162,7 @@ func TestAccS3BucketObjectsDataSource_maxKeys(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                  func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:                acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:                acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories:  acctest.ProtoV5ProviderFactories,
 		PreventPostDestroyRefresh: true,
 		Steps: []resource.TestStep{
@@ -175,7 +173,6 @@ func TestAccS3BucketObjectsDataSource_maxKeys(t *testing.T) {
 			{
 				Config: testAccBucketObjectsDataSourceConfig_maxKeys(rInt),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckObjectsExistsDataSource("data.aws_s3_objects.yesh"),
 					resource.TestCheckResourceAttr("data.aws_s3_objects.yesh", "keys.#", "2"),
 					resource.TestCheckResourceAttr("data.aws_s3_objects.yesh", "keys.0", "arch/courthouse_towers/landscape"),
 					resource.TestCheckResourceAttr("data.aws_s3_objects.yesh", "keys.1", "arch/navajo/north_window"),
@@ -191,7 +188,7 @@ func TestAccS3BucketObjectsDataSource_startAfter(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                  func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:                acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:                acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories:  acctest.ProtoV5ProviderFactories,
 		PreventPostDestroyRefresh: true,
 		Steps: []resource.TestStep{
@@ -202,7 +199,6 @@ func TestAccS3BucketObjectsDataSource_startAfter(t *testing.T) {
 			{
 				Config: testAccBucketObjectsDataSourceConfig_startAfter(rInt),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckObjectsExistsDataSource("data.aws_s3_objects.yesh"),
 					resource.TestCheckResourceAttr("data.aws_s3_objects.yesh", "keys.#", "1"),
 					resource.TestCheckResourceAttr("data.aws_s3_objects.yesh", "keys.0", "arch/three_gossips/turret"),
 				),
@@ -217,7 +213,7 @@ func TestAccS3BucketObjectsDataSource_fetchOwner(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                  func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:                acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:                acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories:  acctest.ProtoV5ProviderFactories,
 		PreventPostDestroyRefresh: true,
 		Steps: []resource.TestStep{
@@ -228,7 +224,6 @@ func TestAccS3BucketObjectsDataSource_fetchOwner(t *testing.T) {
 			{
 				Config: testAccBucketObjectsDataSourceConfig_owners(rInt),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckObjectsExistsDataSource("data.aws_s3_objects.yesh"),
 					resource.TestCheckResourceAttr("data.aws_s3_objects.yesh", "keys.#", "2"),
 					resource.TestCheckResourceAttr("data.aws_s3_objects.yesh", "owners.#", "2"),
 				),
diff --git a/internal/service/s3/bucket_ownership_controls.go b/internal/service/s3/bucket_ownership_controls.go
index a1b7ec446b6..43b83a658bd 100644
--- a/internal/service/s3/bucket_ownership_controls.go
+++ b/internal/service/s3/bucket_ownership_controls.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3
 
 import (
@@ -5,13 +8,16 @@ import (
 	"log"
 	"time"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/s3"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/s3"
+	"github.com/aws/aws-sdk-go-v2/service/s3/types"
+	"github.com/hashicorp/aws-sdk-go-base/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/enum"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
@@ -43,9 +49,9 @@ func ResourceBucketOwnershipControls() *schema.Resource {
 				Elem: &schema.Resource{
 					Schema: map[string]*schema.Schema{
 						"object_ownership": {
-							Type:         schema.TypeString,
-							Required:     true,
-							ValidateFunc: validation.StringInSlice(s3.ObjectOwnership_Values(), false),
+							Type:             schema.TypeString,
+							Required:         true,
+							ValidateDiagFunc: enum.Validate[types.ObjectOwnership](),
 						},
 					},
 				},
@@ -56,18 +62,17 @@ func ResourceBucketOwnershipControls() *schema.Resource {
 
 func resourceBucketOwnershipControlsCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).S3Conn(ctx)
+	conn := meta.(*conns.AWSClient).S3Client(ctx)
 
 	bucket := d.Get("bucket").(string)
-
 	input := &s3.PutBucketOwnershipControlsInput{
 		Bucket: aws.String(bucket),
-		OwnershipControls: &s3.OwnershipControls{
+		OwnershipControls: &types.OwnershipControls{
 			Rules: expandOwnershipControlsRules(d.Get("rule").([]interface{})),
 		},
 	}
 
-	_, err := conn.PutBucketOwnershipControlsWithContext(ctx, input)
+	_, err := conn.PutBucketOwnershipControls(ctx, input)
 
 	if err != nil {
 		return sdkdiag.AppendErrorf(diags, "creating S3 Bucket (%s) Ownership Controls: %s", bucket, err)
@@ -75,47 +80,36 @@ func resourceBucketOwnershipControlsCreate(ctx context.Context, d *schema.Resour
 
 	d.SetId(bucket)
 
+	_, err = tfresource.RetryWhenNotFound(ctx, s3BucketPropagationTimeout, func() (interface{}, error) {
+		return findOwnershipControls(ctx, conn, d.Id())
+	})
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "waiting for S3 Bucket Ownership Controls (%s) create: %s", d.Id(), err)
+	}
+
 	return append(diags, resourceBucketOwnershipControlsRead(ctx, d, meta)...)
 }
 
 func resourceBucketOwnershipControlsRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).S3Conn(ctx)
+	conn := meta.(*conns.AWSClient).S3Client(ctx)
 
-	input := &s3.GetBucketOwnershipControlsInput{
-		Bucket: aws.String(d.Id()),
-	}
-
-	output, err := conn.GetBucketOwnershipControlsWithContext(ctx, input)
-
-	if !d.IsNewResource() && tfawserr.ErrCodeEquals(err, s3.ErrCodeNoSuchBucket) {
-		log.Printf("[WARN] S3 Bucket Ownership Controls (%s) not found, removing from state", d.Id())
-		d.SetId("")
-		return diags
-	}
+	oc, err := findOwnershipControls(ctx, conn, d.Id())
 
-	if !d.IsNewResource() && tfawserr.ErrCodeEquals(err, "OwnershipControlsNotFoundError") {
+	if !d.IsNewResource() && tfresource.NotFound(err) {
 		log.Printf("[WARN] S3 Bucket Ownership Controls (%s) not found, removing from state", d.Id())
 		d.SetId("")
 		return diags
 	}
 
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "reading S3 Bucket (%s) Ownership Controls: %s", d.Id(), err)
-	}
-
-	if output == nil {
-		return sdkdiag.AppendErrorf(diags, "reading S3 Bucket (%s) Ownership Controls: empty response", d.Id())
+		return sdkdiag.AppendErrorf(diags, "reading S3 Bucket Ownership Controls (%s): %s", d.Id(), err)
 	}
 
 	d.Set("bucket", d.Id())
-
-	if output.OwnershipControls == nil {
-		d.Set("rule", nil)
-	} else {
-		if err := d.Set("rule", flattenOwnershipControlsRules(output.OwnershipControls.Rules)); err != nil {
-			return sdkdiag.AppendErrorf(diags, "setting rule: %s", err)
-		}
+	if err := d.Set("rule", flattenOwnershipControlsRules(oc.Rules)); err != nil {
+		return sdkdiag.AppendErrorf(diags, "setting rule: %s", err)
 	}
 
 	return diags
@@ -123,19 +117,19 @@ func resourceBucketOwnershipControlsRead(ctx context.Context, d *schema.Resource
 
 func resourceBucketOwnershipControlsUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).S3Conn(ctx)
+	conn := meta.(*conns.AWSClient).S3Client(ctx)
 
 	input := &s3.PutBucketOwnershipControlsInput{
 		Bucket: aws.String(d.Id()),
-		OwnershipControls: &s3.OwnershipControls{
+		OwnershipControls: &types.OwnershipControls{
 			Rules: expandOwnershipControlsRules(d.Get("rule").([]interface{})),
 		},
 	}
 
-	_, err := conn.PutBucketOwnershipControlsWithContext(ctx, input)
+	_, err := conn.PutBucketOwnershipControls(ctx, input)
 
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "updating S3 Bucket (%s) Ownership Controls: %s", d.Id(), err)
+		return sdkdiag.AppendErrorf(diags, "updating S3 Bucket Ownership Controls (%s): %s", d.Id(), err)
 	}
 
 	return append(diags, resourceBucketOwnershipControlsRead(ctx, d, meta)...)
@@ -143,40 +137,40 @@ func resourceBucketOwnershipControlsUpdate(ctx context.Context, d *schema.Resour
 
 func resourceBucketOwnershipControlsDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).S3Conn(ctx)
-
-	input := &s3.DeleteBucketOwnershipControlsInput{
-		Bucket: aws.String(d.Id()),
-	}
+	conn := meta.(*conns.AWSClient).S3Client(ctx)
 
-	_, err := tfresource.RetryWhenAWSErrCodeEquals(ctx, 5*time.Minute,
-		func() (any, error) {
-			return conn.DeleteBucketOwnershipControlsWithContext(ctx, input)
-		},
-		"OperationAborted",
-	)
+	log.Printf("[DEBUG] Deleting S3 Bucket Ownership Controls: %s", d.Id())
+	_, err := tfresource.RetryWhenAWSErrCodeEquals(ctx, 5*time.Minute, func() (interface{}, error) {
+		return conn.DeleteBucketOwnershipControls(ctx, &s3.DeleteBucketOwnershipControlsInput{
+			Bucket: aws.String(d.Id()),
+		})
+	}, errCodeOperationAborted)
 
-	if tfawserr.ErrCodeEquals(err, s3.ErrCodeNoSuchBucket) {
+	if tfawserr.ErrCodeEquals(err, errCodeNoSuchBucket, errCodeOwnershipControlsNotFoundError) {
 		return diags
 	}
 
-	if tfawserr.ErrCodeEquals(err, "OwnershipControlsNotFoundError") {
-		return diags
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "deleting S3 Bucket Ownership Controls (%s): %s", d.Id(), err)
 	}
 
+	_, err = tfresource.RetryUntilNotFound(ctx, s3BucketPropagationTimeout, func() (interface{}, error) {
+		return findOwnershipControls(ctx, conn, d.Id())
+	})
+
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "deleting S3 Bucket (%s) Ownership Controls: %s", d.Id(), err)
+		return sdkdiag.AppendErrorf(diags, "waiting for S3 Bucket Ownership Controls (%s) delete: %s", d.Id(), err)
 	}
 
 	return diags
 }
 
-func expandOwnershipControlsRules(tfList []interface{}) []*s3.OwnershipControlsRule {
+func expandOwnershipControlsRules(tfList []interface{}) []types.OwnershipControlsRule {
 	if len(tfList) == 0 || tfList[0] == nil {
 		return nil
 	}
 
-	var apiObjects []*s3.OwnershipControlsRule
+	var apiObjects []types.OwnershipControlsRule
 
 	for _, tfMapRaw := range tfList {
 		tfMap, ok := tfMapRaw.(map[string]interface{})
@@ -191,21 +185,17 @@ func expandOwnershipControlsRules(tfList []interface{}) []*s3.OwnershipControlsR
 	return apiObjects
 }
 
-func expandOwnershipControlsRule(tfMap map[string]interface{}) *s3.OwnershipControlsRule {
-	if tfMap == nil {
-		return nil
-	}
-
-	apiObject := &s3.OwnershipControlsRule{}
+func expandOwnershipControlsRule(tfMap map[string]interface{}) types.OwnershipControlsRule {
+	apiObject := types.OwnershipControlsRule{}
 
 	if v, ok := tfMap["object_ownership"].(string); ok && v != "" {
-		apiObject.ObjectOwnership = aws.String(v)
+		apiObject.ObjectOwnership = types.ObjectOwnership(v)
 	}
 
 	return apiObject
 }
 
-func flattenOwnershipControlsRules(apiObjects []*s3.OwnershipControlsRule) []interface{} {
+func flattenOwnershipControlsRules(apiObjects []types.OwnershipControlsRule) []interface{} {
 	if len(apiObjects) == 0 {
 		return nil
 	}
@@ -213,26 +203,41 @@ func flattenOwnershipControlsRules(apiObjects []*s3.OwnershipControlsRule) []int
 	var tfList []interface{}
 
 	for _, apiObject := range apiObjects {
-		if apiObject == nil {
-			continue
-		}
-
 		tfList = append(tfList, flattenOwnershipControlsRule(apiObject))
 	}
 
 	return tfList
 }
 
-func flattenOwnershipControlsRule(apiObject *s3.OwnershipControlsRule) map[string]interface{} {
-	if apiObject == nil {
-		return nil
+func flattenOwnershipControlsRule(apiObject types.OwnershipControlsRule) map[string]interface{} {
+	tfMap := map[string]interface{}{
+		"object_ownership": apiObject.ObjectOwnership,
 	}
 
-	tfMap := map[string]interface{}{}
+	return tfMap
+}
 
-	if v := apiObject.ObjectOwnership; v != nil {
-		tfMap["object_ownership"] = aws.StringValue(v)
+func findOwnershipControls(ctx context.Context, conn *s3.Client, bucket string) (*types.OwnershipControls, error) {
+	input := &s3.GetBucketOwnershipControlsInput{
+		Bucket: aws.String(bucket),
 	}
 
-	return tfMap
+	output, err := conn.GetBucketOwnershipControls(ctx, input)
+
+	if tfawserr.ErrCodeEquals(err, errCodeNoSuchBucket, errCodeOwnershipControlsNotFoundError) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	if output == nil || output.OwnershipControls == nil {
+		return nil, tfresource.NewEmptyResultError(input)
+	}
+
+	return output.OwnershipControls, nil
 }
diff --git a/internal/service/s3/bucket_ownership_controls_test.go b/internal/service/s3/bucket_ownership_controls_test.go
index 17c118ea4d5..e56e978136e 100644
--- a/internal/service/s3/bucket_ownership_controls_test.go
+++ b/internal/service/s3/bucket_ownership_controls_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3_test
 
 import (
@@ -5,15 +8,15 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/s3"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/aws/aws-sdk-go-v2/service/s3/types"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	tfs3 "github.com/hashicorp/terraform-provider-aws/internal/service/s3"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
 func TestAccS3BucketOwnershipControls_basic(t *testing.T) {
@@ -23,17 +26,17 @@ func TestAccS3BucketOwnershipControls_basic(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketOwnershipControlsDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccBucketOwnershipControlsConfig_ruleObject(rName, s3.ObjectOwnershipBucketOwnerPreferred),
+				Config: testAccBucketOwnershipControlsConfig_ruleObject(rName, string(types.ObjectOwnershipBucketOwnerPreferred)),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketOwnershipControlsExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "bucket", rName),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
-					resource.TestCheckResourceAttr(resourceName, "rule.0.object_ownership", s3.ObjectOwnershipBucketOwnerPreferred),
+					resource.TestCheckResourceAttr(resourceName, "rule.0.object_ownership", string(types.ObjectOwnershipBucketOwnerPreferred)),
 				),
 			},
 			{
@@ -52,12 +55,12 @@ func TestAccS3BucketOwnershipControls_disappears(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketOwnershipControlsDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccBucketOwnershipControlsConfig_ruleObject(rName, s3.ObjectOwnershipBucketOwnerPreferred),
+				Config: testAccBucketOwnershipControlsConfig_ruleObject(rName, string(types.ObjectOwnershipBucketOwnerPreferred)),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketOwnershipControlsExists(ctx, resourceName),
 					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfs3.ResourceBucketOwnershipControls(), resourceName),
@@ -76,12 +79,12 @@ func TestAccS3BucketOwnershipControls_Disappears_bucket(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketOwnershipControlsDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccBucketOwnershipControlsConfig_ruleObject(rName, s3.ObjectOwnershipBucketOwnerPreferred),
+				Config: testAccBucketOwnershipControlsConfig_ruleObject(rName, string(types.ObjectOwnershipBucketOwnerPreferred)),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketOwnershipControlsExists(ctx, resourceName),
 					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfs3.ResourceBucket(), s3BucketResourceName),
@@ -99,17 +102,17 @@ func TestAccS3BucketOwnershipControls_Rule_objectOwnership(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketOwnershipControlsDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccBucketOwnershipControlsConfig_ruleObject(rName, s3.ObjectOwnershipObjectWriter),
+				Config: testAccBucketOwnershipControlsConfig_ruleObject(rName, string(types.ObjectOwnershipObjectWriter)),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketOwnershipControlsExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "bucket", rName),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
-					resource.TestCheckResourceAttr(resourceName, "rule.0.object_ownership", s3.ObjectOwnershipObjectWriter),
+					resource.TestCheckResourceAttr(resourceName, "rule.0.object_ownership", string(types.ObjectOwnershipObjectWriter)),
 				),
 			},
 			{
@@ -118,12 +121,12 @@ func TestAccS3BucketOwnershipControls_Rule_objectOwnership(t *testing.T) {
 				ImportStateVerify: true,
 			},
 			{
-				Config: testAccBucketOwnershipControlsConfig_ruleObject(rName, s3.ObjectOwnershipBucketOwnerPreferred),
+				Config: testAccBucketOwnershipControlsConfig_ruleObject(rName, string(types.ObjectOwnershipBucketOwnerPreferred)),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketOwnershipControlsExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "bucket", rName),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
-					resource.TestCheckResourceAttr(resourceName, "rule.0.object_ownership", s3.ObjectOwnershipBucketOwnerPreferred),
+					resource.TestCheckResourceAttr(resourceName, "rule.0.object_ownership", string(types.ObjectOwnershipBucketOwnerPreferred)),
 				),
 			},
 		},
@@ -132,24 +135,16 @@ func TestAccS3BucketOwnershipControls_Rule_objectOwnership(t *testing.T) {
 
 func testAccCheckBucketOwnershipControlsDestroy(ctx context.Context) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Conn(ctx)
+		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Client(ctx)
 
 		for _, rs := range s.RootModule().Resources {
 			if rs.Type != "aws_s3_bucket_ownership_controls" {
 				continue
 			}
 
-			input := &s3.GetBucketOwnershipControlsInput{
-				Bucket: aws.String(rs.Primary.ID),
-			}
-
-			_, err := conn.GetBucketOwnershipControlsWithContext(ctx, input)
-
-			if tfawserr.ErrCodeEquals(err, s3.ErrCodeNoSuchBucket) {
-				continue
-			}
+			_, err := tfs3.FindOwnershipControls(ctx, conn, rs.Primary.ID)
 
-			if tfawserr.ErrCodeEquals(err, "OwnershipControlsNotFoundError") {
+			if tfresource.NotFound(err) {
 				continue
 			}
 
@@ -157,31 +152,23 @@ func testAccCheckBucketOwnershipControlsDestroy(ctx context.Context) resource.Te
 				return err
 			}
 
-			return fmt.Errorf("S3 Bucket Ownership Controls (%s) still exists", rs.Primary.ID)
+			return fmt.Errorf("S3 Bucket Ownership Controls %s still exists", rs.Primary.ID)
 		}
 
 		return nil
 	}
 }
 
-func testAccCheckBucketOwnershipControlsExists(ctx context.Context, resourceName string) resource.TestCheckFunc {
+func testAccCheckBucketOwnershipControlsExists(ctx context.Context, n string) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		rs, ok := s.RootModule().Resources[resourceName]
+		rs, ok := s.RootModule().Resources[n]
 		if !ok {
-			return fmt.Errorf("not found: %s", resourceName)
-		}
-
-		if rs.Primary.ID == "" {
-			return fmt.Errorf("no resource ID is set")
+			return fmt.Errorf("Not found: %s", n)
 		}
 
-		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Conn(ctx)
-
-		input := &s3.GetBucketOwnershipControlsInput{
-			Bucket: aws.String(rs.Primary.ID),
-		}
+		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Client(ctx)
 
-		_, err := conn.GetBucketOwnershipControlsWithContext(ctx, input)
+		_, err := tfs3.FindOwnershipControls(ctx, conn, rs.Primary.ID)
 
 		return err
 	}
diff --git a/internal/service/s3/bucket_policy.go b/internal/service/s3/bucket_policy.go
index 53ee6105c27..32c26742832 100644
--- a/internal/service/s3/bucket_policy.go
+++ b/internal/service/s3/bucket_policy.go
@@ -1,25 +1,24 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3
 
 import (
 	"context"
-	"errors"
 	"log"
-	"time"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/s3"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/s3"
+	"github.com/hashicorp/aws-sdk-go-base/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/structure"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
-	"github.com/hashicorp/terraform-provider-aws/internal/create"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
-	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
 // @SDKResource("aws_s3_bucket_policy")
@@ -29,6 +28,7 @@ func ResourceBucketPolicy() *schema.Resource {
 		ReadWithoutTimeout:   resourceBucketPolicyRead,
 		UpdateWithoutTimeout: resourceBucketPolicyPut,
 		DeleteWithoutTimeout: resourceBucketPolicyDelete,
+
 		Importer: &schema.ResourceImporter{
 			StateContext: schema.ImportStatePassthroughContext,
 		},
@@ -39,7 +39,6 @@ func ResourceBucketPolicy() *schema.Resource {
 				Required: true,
 				ForceNew: true,
 			},
-
 			"policy": {
 				Type:                  schema.TypeString,
 				Required:              true,
@@ -57,99 +56,118 @@ func ResourceBucketPolicy() *schema.Resource {
 
 func resourceBucketPolicyPut(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).S3Conn(ctx)
-
-	bucket := d.Get("bucket").(string)
+	conn := meta.(*conns.AWSClient).S3Client(ctx)
 
 	policy, err := structure.NormalizeJsonString(d.Get("policy").(string))
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "policy (%s) is an invalid JSON: %s", policy, err)
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
-	log.Printf("[DEBUG] S3 bucket: %s, put policy: %s", bucket, policy)
-
-	params := &s3.PutBucketPolicyInput{
+	bucket := d.Get("bucket").(string)
+	input := &s3.PutBucketPolicyInput{
 		Bucket: aws.String(bucket),
 		Policy: aws.String(policy),
 	}
 
-	err = retry.RetryContext(ctx, 1*time.Minute, func() *retry.RetryError {
-		_, err := conn.PutBucketPolicyWithContext(ctx, params)
-		if tfawserr.ErrCodeEquals(err, "MalformedPolicy") {
-			return retry.RetryableError(err)
-		}
-		if err != nil {
-			return retry.NonRetryableError(err)
-		}
-		return nil
-	})
-	if tfresource.TimedOut(err) {
-		_, err = conn.PutBucketPolicyWithContext(ctx, params)
-	}
+	_, err = tfresource.RetryWhenAWSErrCodeEquals(ctx, s3BucketPropagationTimeout, func() (interface{}, error) {
+		return conn.PutBucketPolicy(ctx, input)
+	}, errCodeMalformedPolicy, errCodeNoSuchBucket)
+
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "putting S3 policy: %s", err)
+		return sdkdiag.AppendErrorf(diags, "putting S3 Bucket (%s) Policy: %s", bucket, err)
 	}
 
-	d.SetId(bucket)
+	if d.IsNewResource() {
+		d.SetId(bucket)
 
-	return diags
+		_, err = tfresource.RetryWhenNotFound(ctx, s3BucketPropagationTimeout, func() (interface{}, error) {
+			return findBucketPolicy(ctx, conn, d.Id())
+		})
+
+		if err != nil {
+			return sdkdiag.AppendErrorf(diags, "waiting for S3 Bucket Policy (%s) create: %s", d.Id(), err)
+		}
+	}
+
+	return append(diags, resourceBucketPolicyRead(ctx, d, meta)...)
 }
 
 func resourceBucketPolicyRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).S3Conn(ctx)
+	conn := meta.(*conns.AWSClient).S3Client(ctx)
 
-	log.Printf("[DEBUG] S3 bucket policy, read for bucket: %s", d.Id())
-	pol, err := conn.GetBucketPolicyWithContext(ctx, &s3.GetBucketPolicyInput{
-		Bucket: aws.String(d.Id()),
-	})
+	policy, err := findBucketPolicy(ctx, conn, d.Id())
 
-	if !d.IsNewResource() && tfawserr.ErrCodeEquals(err, ErrCodeNoSuchBucketPolicy, s3.ErrCodeNoSuchBucket) {
+	if !d.IsNewResource() && tfresource.NotFound(err) {
 		log.Printf("[WARN] S3 Bucket Policy (%s) not found, removing from state", d.Id())
 		d.SetId("")
 		return diags
 	}
 
 	if err != nil {
-		return create.DiagError(names.S3, create.ErrActionReading, "Bucket Policy", d.Id(), err)
+		return diag.Errorf("reading S3 Bucket Policy (%s): %s", d.Id(), err)
 	}
 
-	if pol.Policy == nil {
-		return create.DiagError(names.S3, create.ErrActionReading, "Bucket Policy", d.Id(), errors.New("empty policy returned"))
-	}
-
-	policyToSet, err := verify.PolicyToSet(d.Get("policy").(string), aws.StringValue(pol.Policy))
+	policy, err = verify.PolicyToSet(d.Get("policy").(string), policy)
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting policy: %s", err)
-	}
-
-	if err := d.Set("policy", policyToSet); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting policy: %s", err)
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
 	d.Set("bucket", d.Id())
+	d.Set("policy", policy)
 
 	return diags
 }
 
 func resourceBucketPolicyDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).S3Conn(ctx)
-
-	bucket := d.Get("bucket").(string)
+	conn := meta.(*conns.AWSClient).S3Client(ctx)
 
-	log.Printf("[DEBUG] S3 bucket: %s, delete policy", bucket)
-	_, err := conn.DeleteBucketPolicyWithContext(ctx, &s3.DeleteBucketPolicyInput{
-		Bucket: aws.String(bucket),
+	log.Printf("[DEBUG] Deleting S3 Bucket Policy: %s", d.Id())
+	_, err := conn.DeleteBucketPolicy(ctx, &s3.DeleteBucketPolicyInput{
+		Bucket: aws.String(d.Id()),
 	})
 
-	if tfawserr.ErrCodeEquals(err, s3.ErrCodeNoSuchBucket) {
+	if tfawserr.ErrCodeEquals(err, errCodeNoSuchBucket) {
 		return diags
 	}
 
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "deleting S3 policy: %s", err)
+		return sdkdiag.AppendErrorf(diags, "deleting S3 Bucket Policy (%s): %s", d.Id(), err)
+	}
+
+	_, err = tfresource.RetryUntilNotFound(ctx, s3BucketPropagationTimeout, func() (interface{}, error) {
+		return findBucketPolicy(ctx, conn, d.Id())
+	})
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "waiting for S3 Bucket Policy (%s) delete: %s", d.Id(), err)
 	}
 
 	return diags
 }
+
+func findBucketPolicy(ctx context.Context, conn *s3.Client, bucket string) (string, error) {
+	input := &s3.GetBucketPolicyInput{
+		Bucket: aws.String(bucket),
+	}
+
+	output, err := conn.GetBucketPolicy(ctx, input)
+
+	if tfawserr.ErrCodeEquals(err, errCodeNoSuchBucket, errCodeNoSuchBucketPolicy) {
+		return "", &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+
+	if err != nil {
+		return "", err
+	}
+
+	if output == nil || output.Policy == nil {
+		return "", tfresource.NewEmptyResultError(input)
+	}
+
+	return aws.ToString(output.Policy), nil
+}
diff --git a/internal/service/s3/bucket_policy_data_source.go b/internal/service/s3/bucket_policy_data_source.go
index 6cb3fd572f3..fa5bcf5bd38 100644
--- a/internal/service/s3/bucket_policy_data_source.go
+++ b/internal/service/s3/bucket_policy_data_source.go
@@ -1,18 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3
 
 import (
 	"context"
-	"log"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/s3"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/structure"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
-	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
 // @SDKDataSource("aws_s3_bucket_policy")
@@ -34,18 +31,19 @@ func DataSourceBucketPolicy() *schema.Resource {
 }
 
 func dataSourceBucketPolicyRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).S3Conn(ctx)
+	conn := meta.(*conns.AWSClient).S3Client(ctx)
 
 	name := d.Get("bucket").(string)
 
-	out, err := FindBucketPolicy(ctx, conn, name)
+	policy, err := findBucketPolicy(ctx, conn, name)
+
 	if err != nil {
-		return diag.Errorf("failed getting S3 bucket policy (%s): %s", name, err)
+		return diag.Errorf("reading S3 Bucket (%s) Policy: %s", name, err)
 	}
 
-	policy, err := structure.NormalizeJsonString(aws.StringValue(out.Policy))
+	policy, err = structure.NormalizeJsonString(policy)
 	if err != nil {
-		return diag.Errorf("policy (%s) is an invalid JSON: %s", policy, err)
+		return diag.FromErr(err)
 	}
 
 	d.SetId(name)
@@ -53,29 +51,3 @@ func dataSourceBucketPolicyRead(ctx context.Context, d *schema.ResourceData, met
 
 	return nil
 }
-
-func FindBucketPolicy(ctx context.Context, conn *s3.S3, name string) (*s3.GetBucketPolicyOutput, error) {
-	in := &s3.GetBucketPolicyInput{
-		Bucket: aws.String(name),
-	}
-	log.Printf("[DEBUG] Reading S3 bucket policy: %s", in)
-
-	out, err := conn.GetBucketPolicyWithContext(ctx, in)
-
-	if tfawserr.ErrCodeEquals(err, ErrCodeNoSuchBucketPolicy) {
-		return nil, &retry.NotFoundError{
-			LastError:   err,
-			LastRequest: in,
-		}
-	}
-
-	if err != nil {
-		return nil, err
-	}
-
-	if out == nil {
-		return nil, tfresource.NewEmptyResultError(in)
-	}
-
-	return out, nil
-}
diff --git a/internal/service/s3/bucket_policy_data_source_test.go b/internal/service/s3/bucket_policy_data_source_test.go
index 002180d182b..867b5925191 100644
--- a/internal/service/s3/bucket_policy_data_source_test.go
+++ b/internal/service/s3/bucket_policy_data_source_test.go
@@ -1,35 +1,34 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3_test
 
 import (
-	"context"
 	"fmt"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/service/s3"
 	awspolicy "github.com/hashicorp/awspolicyequivalence"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
-	"github.com/hashicorp/terraform-provider-aws/internal/conns"
-	tfs3 "github.com/hashicorp/terraform-provider-aws/internal/service/s3"
+	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
 func TestAccS3BucketPolicyDataSource_basic(t *testing.T) {
 	ctx := acctest.Context(t)
-	var conf s3.GetBucketPolicyOutput
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	dataSourceName := "data.aws_s3_bucket_policy.test"
 	resourceName := "aws_s3_bucket_policy.test"
+
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccBucketPolicyDataSourceConfig_basic(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
-					testAccCheckBucketPolicyExists(ctx, resourceName, &conf),
 					testAccCheckBucketPolicyMatch(dataSourceName, "policy", resourceName, "policy"),
 				),
 			},
@@ -37,30 +36,26 @@ func TestAccS3BucketPolicyDataSource_basic(t *testing.T) {
 	})
 }
 
-func testAccCheckBucketPolicyMatch(resource1, attr1, resource2, attr2 string) resource.TestCheckFunc {
+func testAccCheckBucketPolicyMatch(nameFirst, keyFirst, nameSecond, keySecond string) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		rs, ok := s.RootModule().Resources[resource1]
+		rs, ok := s.RootModule().Resources[nameFirst]
 		if !ok {
-			return fmt.Errorf("not found: %s", resource1)
-		}
-		if rs.Primary.ID == "" {
-			return fmt.Errorf("no ID is set")
+			return fmt.Errorf("Not found: %s", nameFirst)
 		}
-		policy1, ok := rs.Primary.Attributes[attr1]
+
+		policy1, ok := rs.Primary.Attributes[keyFirst]
 		if !ok {
-			return fmt.Errorf("attribute %q not found for %q", attr1, resource1)
+			return fmt.Errorf("attribute %q not found for %q", keyFirst, nameFirst)
 		}
 
-		rs, ok = s.RootModule().Resources[resource2]
+		rs, ok = s.RootModule().Resources[nameSecond]
 		if !ok {
-			return fmt.Errorf("not found: %s", resource2)
-		}
-		if rs.Primary.ID == "" {
-			return fmt.Errorf("mo ID is set")
+			return fmt.Errorf("Not found: %s", nameSecond)
 		}
-		policy2, ok := rs.Primary.Attributes[attr2]
+
+		policy2, ok := rs.Primary.Attributes[keySecond]
 		if !ok {
-			return fmt.Errorf("attribute %q not found for %q", attr2, resource2)
+			return fmt.Errorf("attribute %q not found for %q", keySecond, nameSecond)
 		}
 
 		areEquivalent, err := awspolicy.PoliciesAreEquivalent(policy1, policy2)
@@ -76,38 +71,10 @@ func testAccCheckBucketPolicyMatch(resource1, attr1, resource2, attr2 string) re
 	}
 }
 
-func testAccCheckBucketPolicyExists(ctx context.Context, n string, ci *s3.GetBucketPolicyOutput) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		rs, ok := s.RootModule().Resources[n]
-		if !ok {
-			return fmt.Errorf("not found: %s", n)
-		}
-
-		if rs.Primary.ID == "" {
-			return fmt.Errorf("no S3 Bucket Policy ID is set")
-		}
-
-		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Conn(ctx)
-
-		output, err := tfs3.FindBucketPolicy(ctx, conn, rs.Primary.ID)
-		if err != nil {
-			return err
-		}
-
-		*ci = *output
-
-		return nil
-	}
-}
-
-func testAccDataSourceBucketPolicyBaseConfig(rName string) string {
+func testAccDataSourceBucketPolicyConfig_base(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_s3_bucket" "test" {
   bucket = %[1]q
-
-  tags = {
-    Name = %[1]q
-  }
 }
 
 resource "aws_s3_bucket_policy" "test" {
@@ -139,7 +106,7 @@ data "aws_iam_policy_document" "test" {
 }
 
 func testAccBucketPolicyDataSourceConfig_basic(rName string) string {
-	return acctest.ConfigCompose(testAccDataSourceBucketPolicyBaseConfig(rName), `
+	return acctest.ConfigCompose(testAccDataSourceBucketPolicyConfig_base(rName), `
 data "aws_s3_bucket_policy" "test" {
   bucket = aws_s3_bucket.test.id
 
diff --git a/internal/service/s3/bucket_policy_test.go b/internal/service/s3/bucket_policy_test.go
index 5944c5b38ec..3decf8c2113 100644
--- a/internal/service/s3/bucket_policy_test.go
+++ b/internal/service/s3/bucket_policy_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3_test
 
 import (
@@ -5,8 +8,6 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/s3"
 	awspolicy "github.com/hashicorp/awspolicyequivalence"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -14,11 +15,13 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	tfs3 "github.com/hashicorp/terraform-provider-aws/internal/service/s3"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
 func TestAccS3BucketPolicy_basic(t *testing.T) {
 	ctx := acctest.Context(t)
-	name := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_s3_bucket_policy.bucket"
 	bucketResourceName := "aws_s3_bucket.bucket"
 
@@ -42,15 +45,14 @@ func TestAccS3BucketPolicy_basic(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckBucketDestroy(ctx),
+		CheckDestroy:             testAccCheckBucketPolicyDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccBucketPolicyConfig_basic(name),
+				Config: testAccBucketPolicyConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckBucketExists(ctx, bucketResourceName),
-					testAccCheckBucketHasPolicy(ctx, bucketResourceName, expectedPolicyTemplate, name),
+					testAccCheckBucketHasPolicy(ctx, bucketResourceName, expectedPolicyTemplate, rName),
 				),
 			},
 			{
@@ -64,7 +66,7 @@ func TestAccS3BucketPolicy_basic(t *testing.T) {
 
 func TestAccS3BucketPolicy_disappears(t *testing.T) {
 	ctx := acctest.Context(t)
-	name := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_s3_bucket_policy.bucket"
 	bucketResourceName := "aws_s3_bucket.bucket"
 
@@ -88,15 +90,14 @@ func TestAccS3BucketPolicy_disappears(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckBucketDestroy(ctx),
+		CheckDestroy:             testAccCheckBucketPolicyDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccBucketPolicyConfig_basic(name),
+				Config: testAccBucketPolicyConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckBucketExists(ctx, bucketResourceName),
-					testAccCheckBucketHasPolicy(ctx, bucketResourceName, expectedPolicyTemplate, name),
+					testAccCheckBucketHasPolicy(ctx, bucketResourceName, expectedPolicyTemplate, rName),
 					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfs3.ResourceBucketPolicy(), resourceName),
 				),
 				ExpectNonEmptyPlan: true,
@@ -107,7 +108,7 @@ func TestAccS3BucketPolicy_disappears(t *testing.T) {
 
 func TestAccS3BucketPolicy_disappears_bucket(t *testing.T) {
 	ctx := acctest.Context(t)
-	name := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	bucketResourceName := "aws_s3_bucket.bucket"
 
 	expectedPolicyTemplate := `{
@@ -130,15 +131,14 @@ func TestAccS3BucketPolicy_disappears_bucket(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckBucketDestroy(ctx),
+		CheckDestroy:             testAccCheckBucketPolicyDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccBucketPolicyConfig_basic(name),
+				Config: testAccBucketPolicyConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckBucketExists(ctx, bucketResourceName),
-					testAccCheckBucketHasPolicy(ctx, bucketResourceName, expectedPolicyTemplate, name),
+					testAccCheckBucketHasPolicy(ctx, bucketResourceName, expectedPolicyTemplate, rName),
 					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfs3.ResourceBucket(), bucketResourceName),
 				),
 				ExpectNonEmptyPlan: true,
@@ -149,7 +149,7 @@ func TestAccS3BucketPolicy_disappears_bucket(t *testing.T) {
 
 func TestAccS3BucketPolicy_policyUpdate(t *testing.T) {
 	ctx := acctest.Context(t)
-	name := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_s3_bucket_policy.bucket"
 	bucketResourceName := "aws_s3_bucket.bucket"
 
@@ -195,26 +195,22 @@ func TestAccS3BucketPolicy_policyUpdate(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckBucketDestroy(ctx),
+		CheckDestroy:             testAccCheckBucketPolicyDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccBucketPolicyConfig_basic(name),
+				Config: testAccBucketPolicyConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckBucketExists(ctx, bucketResourceName),
-					testAccCheckBucketHasPolicy(ctx, bucketResourceName, expectedPolicyTemplate1, name),
+					testAccCheckBucketHasPolicy(ctx, bucketResourceName, expectedPolicyTemplate1, rName),
 				),
 			},
-
 			{
-				Config: testAccBucketPolicyConfig_updated(name),
+				Config: testAccBucketPolicyConfig_updated(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckBucketExists(ctx, bucketResourceName),
-					testAccCheckBucketHasPolicy(ctx, bucketResourceName, expectedPolicyTemplate2, name),
+					testAccCheckBucketHasPolicy(ctx, bucketResourceName, expectedPolicyTemplate2, rName),
 				),
 			},
-
 			{
 				ResourceName:      resourceName,
 				ImportState:       true,
@@ -228,19 +224,15 @@ func TestAccS3BucketPolicy_policyUpdate(t *testing.T) {
 func TestAccS3BucketPolicy_IAMRoleOrder_policyDoc(t *testing.T) {
 	ctx := acctest.Context(t)
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
-	bucketResourceName := "aws_s3_bucket.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckBucketDestroy(ctx),
+		CheckDestroy:             testAccCheckBucketPolicyDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccBucketPolicyConfig_iamRoleOrderIAMDoc(rName),
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckBucketExists(ctx, bucketResourceName),
-				),
 			},
 			{
 				Config:   testAccBucketPolicyConfig_iamRoleOrderIAMDoc(rName),
@@ -263,25 +255,18 @@ func TestAccS3BucketPolicy_IAMRoleOrder_policyDoc(t *testing.T) {
 func TestAccS3BucketPolicy_IAMRoleOrder_policyDocNotPrincipal(t *testing.T) {
 	ctx := acctest.Context(t)
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
-	bucketResourceName := "aws_s3_bucket.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckBucketDestroy(ctx),
+		CheckDestroy:             testAccCheckBucketPolicyDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccBucketPolicyConfig_iamRoleOrderIAMDocNotPrincipal(rName),
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckBucketExists(ctx, bucketResourceName),
-				),
 			},
 			{
 				Config: testAccBucketPolicyConfig_iamRoleOrderIAMDocNotPrincipal(rName),
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckBucketExists(ctx, bucketResourceName),
-				),
 			},
 			{
 				Config:   testAccBucketPolicyConfig_iamRoleOrderIAMDocNotPrincipal(rName),
@@ -298,32 +283,25 @@ func TestAccS3BucketPolicy_IAMRoleOrder_policyDocNotPrincipal(t *testing.T) {
 // Reference: https://github.com/hashicorp/terraform-provider-aws/issues/11801
 func TestAccS3BucketPolicy_IAMRoleOrder_jsonEncode(t *testing.T) {
 	ctx := acctest.Context(t)
-	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	rName1 := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	rName2 := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	rName3 := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
-	bucketResourceName := "aws_s3_bucket.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckBucketDestroy(ctx),
+		CheckDestroy:             testAccCheckBucketPolicyDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccBucketPolicyConfig_iamRoleOrderJSONEncode(rName),
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckBucketExists(ctx, bucketResourceName),
-				),
+				Config: testAccBucketPolicyConfig_iamRoleOrderJSONEncode(rName1),
 			},
 			{
-				Config:   testAccBucketPolicyConfig_iamRoleOrderJSONEncode(rName),
+				Config:   testAccBucketPolicyConfig_iamRoleOrderJSONEncode(rName1),
 				PlanOnly: true,
 			},
 			{
 				Config: testAccBucketPolicyConfig_iamRoleOrderJSONEncodeOrder2(rName2),
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckBucketExists(ctx, bucketResourceName),
-				),
 			},
 			{
 				Config:   testAccBucketPolicyConfig_iamRoleOrderJSONEncode(rName2),
@@ -331,9 +309,6 @@ func TestAccS3BucketPolicy_IAMRoleOrder_jsonEncode(t *testing.T) {
 			},
 			{
 				Config: testAccBucketPolicyConfig_iamRoleOrderJSONEncodeOrder3(rName3),
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckBucketExists(ctx, bucketResourceName),
-				),
 			},
 			{
 				Config:   testAccBucketPolicyConfig_iamRoleOrderJSONEncode(rName3),
@@ -368,21 +343,19 @@ func TestAccS3BucketPolicy_migrate_noChange(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckBucketDestroy(ctx),
+		CheckDestroy:             testAccCheckBucketPolicyDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccBucketConfig_policy(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
-					testAccCheckBucketExists(ctx, bucketResourceName),
 					testAccCheckBucketHasPolicy(ctx, bucketResourceName, expectedPolicyTemplate, rName),
 				),
 			},
 			{
 				Config: testAccBucketPolicyConfig_migrateNoChange(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
-					testAccCheckBucketExists(ctx, bucketResourceName),
 					testAccCheckBucketHasPolicy(ctx, bucketResourceName, expectedPolicyTemplate, rName),
 				),
 			},
@@ -437,21 +410,19 @@ func TestAccS3BucketPolicy_migrate_withChange(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckBucketDestroy(ctx),
+		CheckDestroy:             testAccCheckBucketPolicyDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccBucketConfig_policy(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
-					testAccCheckBucketExists(ctx, bucketResourceName),
 					testAccCheckBucketHasPolicy(ctx, bucketResourceName, expectedPolicyTemplate1, rName),
 				),
 			},
 			{
 				Config: testAccBucketPolicyConfig_migrateChange(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
-					testAccCheckBucketExists(ctx, bucketResourceName),
 					testAccCheckBucketHasPolicy(ctx, bucketResourceName, expectedPolicyTemplate2, rName),
 				),
 			},
@@ -459,6 +430,32 @@ func TestAccS3BucketPolicy_migrate_withChange(t *testing.T) {
 	})
 }
 
+func testAccCheckBucketPolicyDestroy(ctx context.Context) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Client(ctx)
+
+		for _, rs := range s.RootModule().Resources {
+			if rs.Type != "aws_s3_bucket_policy" {
+				continue
+			}
+
+			_, err := tfs3.FindBucketPolicy(ctx, conn, rs.Primary.ID)
+
+			if tfresource.NotFound(err) {
+				continue
+			}
+
+			if err != nil {
+				return err
+			}
+
+			return fmt.Errorf("S3 Bucket Policy %s still exists", rs.Primary.ID)
+		}
+
+		return nil
+	}
+}
+
 func testAccCheckBucketHasPolicy(ctx context.Context, n string, expectedPolicyTemplate string, bucketName string) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		rs, ok := s.RootModule().Resources[n]
@@ -466,31 +463,24 @@ func testAccCheckBucketHasPolicy(ctx context.Context, n string, expectedPolicyTe
 			return fmt.Errorf("Not found: %s", n)
 		}
 
-		if rs.Primary.ID == "" {
-			return fmt.Errorf("No S3 Bucket ID is set")
-		}
+		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Client(ctx)
 
-		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Conn(ctx)
+		policy, err := tfs3.FindBucketPolicy(ctx, conn, rs.Primary.ID)
 
-		policy, err := conn.GetBucketPolicyWithContext(ctx, &s3.GetBucketPolicyInput{
-			Bucket: aws.String(rs.Primary.ID),
-		})
 		if err != nil {
-			return fmt.Errorf("GetBucketPolicy error: %v", err)
+			return err
 		}
 
-		actualPolicyText := *policy.Policy
-
 		// Policy text must be generated inside a resource.TestCheckFunc in order for
 		// the acctest.AccountID() helper to function properly.
 		expectedPolicyText := fmt.Sprintf(expectedPolicyTemplate, acctest.AccountID(), acctest.Partition(), bucketName)
-		equivalent, err := awspolicy.PoliciesAreEquivalent(actualPolicyText, expectedPolicyText)
+		equivalent, err := awspolicy.PoliciesAreEquivalent(policy, expectedPolicyText)
 		if err != nil {
 			return fmt.Errorf("Error testing policy equivalence: %s", err)
 		}
 		if !equivalent {
 			return fmt.Errorf("Non-equivalent policy error:\n\nexpected: %s\n\n     got: %s\n",
-				expectedPolicyTemplate, actualPolicyText)
+				expectedPolicyTemplate, policy)
 		}
 
 		return nil
@@ -504,10 +494,6 @@ data "aws_caller_identity" "current" {}
 
 resource "aws_s3_bucket" "bucket" {
   bucket = %[1]q
-
-  tags = {
-    TestName = "TestAccS3BucketPolicy_basic"
-  }
 }
 
 resource "aws_s3_bucket_policy" "bucket" {
@@ -544,10 +530,6 @@ data "aws_caller_identity" "current" {}
 
 resource "aws_s3_bucket" "bucket" {
   bucket = %[1]q
-
-  tags = {
-    TestName = "TestAccS3BucketPolicy_basic"
-  }
 }
 
 resource "aws_s3_bucket_policy" "bucket" {
@@ -579,7 +561,7 @@ data "aws_iam_policy_document" "policy" {
 `, bucketName)
 }
 
-func testAccBucketPolicyIAMRoleOrderBaseConfig(rName string) string {
+func testAccBucketPolicyIAMRoleOrderConfig_base(rName string) string {
 	return fmt.Sprintf(`
 data "aws_partition" "current" {}
 
@@ -660,17 +642,13 @@ resource "aws_iam_role" "test5" {
 
 resource "aws_s3_bucket" "test" {
   bucket = %[1]q
-
-  tags = {
-    TestName = %[1]q
-  }
 }
 `, rName)
 }
 
 func testAccBucketPolicyConfig_iamRoleOrderIAMDoc(rName string) string {
 	return acctest.ConfigCompose(
-		testAccBucketPolicyIAMRoleOrderBaseConfig(rName),
+		testAccBucketPolicyIAMRoleOrderConfig_base(rName),
 		fmt.Sprintf(`
 data "aws_iam_policy_document" "test" {
   policy_id = %[1]q
@@ -708,7 +686,7 @@ resource "aws_s3_bucket_policy" "bucket" {
 
 func testAccBucketPolicyConfig_iamRoleOrderJSONEncode(rName string) string {
 	return acctest.ConfigCompose(
-		testAccBucketPolicyIAMRoleOrderBaseConfig(rName),
+		testAccBucketPolicyIAMRoleOrderConfig_base(rName),
 		fmt.Sprintf(`
 resource "aws_s3_bucket_policy" "bucket" {
   bucket = aws_s3_bucket.test.bucket
@@ -745,7 +723,7 @@ resource "aws_s3_bucket_policy" "bucket" {
 
 func testAccBucketPolicyConfig_iamRoleOrderJSONEncodeOrder2(rName string) string {
 	return acctest.ConfigCompose(
-		testAccBucketPolicyIAMRoleOrderBaseConfig(rName),
+		testAccBucketPolicyIAMRoleOrderConfig_base(rName),
 		fmt.Sprintf(`
 resource "aws_s3_bucket_policy" "bucket" {
   bucket = aws_s3_bucket.test.bucket
@@ -782,7 +760,7 @@ resource "aws_s3_bucket_policy" "bucket" {
 
 func testAccBucketPolicyConfig_iamRoleOrderJSONEncodeOrder3(rName string) string {
 	return acctest.ConfigCompose(
-		testAccBucketPolicyIAMRoleOrderBaseConfig(rName),
+		testAccBucketPolicyIAMRoleOrderConfig_base(rName),
 		fmt.Sprintf(`
 resource "aws_s3_bucket_policy" "bucket" {
   bucket = aws_s3_bucket.test.bucket
@@ -819,7 +797,7 @@ resource "aws_s3_bucket_policy" "bucket" {
 
 func testAccBucketPolicyConfig_iamRoleOrderIAMDocNotPrincipal(rName string) string {
 	return acctest.ConfigCompose(
-		testAccBucketPolicyIAMRoleOrderBaseConfig(rName),
+		testAccBucketPolicyIAMRoleOrderConfig_base(rName),
 		`
 data "aws_caller_identity" "current" {}
 
@@ -860,7 +838,7 @@ resource "aws_s3_bucket_policy" "bucket" {
 `)
 }
 
-func testAccBucketPolicyConfig_migrateNoChange(bucketName string) string {
+func testAccBucketPolicyConfig_migrateNoChange(rName string) string {
 	return fmt.Sprintf(`
 data "aws_partition" "current" {}
 data "aws_caller_identity" "current" {}
@@ -893,10 +871,10 @@ resource "aws_s3_bucket_policy" "test" {
   bucket = aws_s3_bucket.test.id
   policy = data.aws_iam_policy_document.policy.json
 }
-`, bucketName)
+`, rName)
 }
 
-func testAccBucketPolicyConfig_migrateChange(bucketName string) string {
+func testAccBucketPolicyConfig_migrateChange(rName string) string {
 	return fmt.Sprintf(`
 data "aws_partition" "current" {}
 data "aws_caller_identity" "current" {}
@@ -931,5 +909,5 @@ resource "aws_s3_bucket_policy" "test" {
   bucket = aws_s3_bucket.test.id
   policy = data.aws_iam_policy_document.policy.json
 }
-`, bucketName)
+`, rName)
 }
diff --git a/internal/service/s3/bucket_public_access_block.go b/internal/service/s3/bucket_public_access_block.go
index 73c556e2898..c2eb902b709 100644
--- a/internal/service/s3/bucket_public_access_block.go
+++ b/internal/service/s3/bucket_public_access_block.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3
 
 import (
@@ -111,7 +114,7 @@ func resourceBucketPublicAccessBlockRead(ctx context.Context, d *schema.Resource
 
 	// Retry for eventual consistency on creation
 	var output *s3.GetPublicAccessBlockOutput
-	err := retry.RetryContext(ctx, propagationTimeout, func() *retry.RetryError {
+	err := retry.RetryContext(ctx, s3BucketPropagationTimeout, func() *retry.RetryError {
 		var err error
 		output, err = conn.GetPublicAccessBlockWithContext(ctx, input)
 
diff --git a/internal/service/s3/bucket_public_access_block_test.go b/internal/service/s3/bucket_public_access_block_test.go
index 5e207d65765..33e3c8b1ec7 100644
--- a/internal/service/s3/bucket_public_access_block_test.go
+++ b/internal/service/s3/bucket_public_access_block_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3_test
 
 import (
diff --git a/internal/service/s3/bucket_replication_configuration.go b/internal/service/s3/bucket_replication_configuration.go
index 9dd87a80054..9a47ddd6a2b 100644
--- a/internal/service/s3/bucket_replication_configuration.go
+++ b/internal/service/s3/bucket_replication_configuration.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3
 
 import (
@@ -325,7 +328,7 @@ func resourceBucketReplicationConfigurationCreate(ctx context.Context, d *schema
 		input.Token = aws.String(v.(string))
 	}
 
-	err := retry.RetryContext(ctx, propagationTimeout, func() *retry.RetryError {
+	err := retry.RetryContext(ctx, s3BucketPropagationTimeout, func() *retry.RetryError {
 		_, err := conn.PutBucketReplicationWithContext(ctx, input)
 		if tfawserr.ErrCodeEquals(err, s3.ErrCodeNoSuchBucket) || tfawserr.ErrMessageContains(err, "InvalidRequest", "Versioning must be 'Enabled' on the bucket") {
 			return retry.RetryableError(err)
@@ -346,7 +349,7 @@ func resourceBucketReplicationConfigurationCreate(ctx context.Context, d *schema
 
 	d.SetId(bucket)
 
-	_, err = tfresource.RetryWhenNotFound(ctx, propagationTimeout, func() (interface{}, error) {
+	_, err = tfresource.RetryWhenNotFound(ctx, s3BucketPropagationTimeout, func() (interface{}, error) {
 		return FindBucketReplicationConfigurationByID(ctx, conn, d.Id())
 	})
 
@@ -402,7 +405,7 @@ func resourceBucketReplicationConfigurationUpdate(ctx context.Context, d *schema
 		input.Token = aws.String(v.(string))
 	}
 
-	err := retry.RetryContext(ctx, propagationTimeout, func() *retry.RetryError {
+	err := retry.RetryContext(ctx, s3BucketPropagationTimeout, func() *retry.RetryError {
 		_, err := conn.PutBucketReplicationWithContext(ctx, input)
 		if tfawserr.ErrCodeEquals(err, s3.ErrCodeNoSuchBucket) || tfawserr.ErrMessageContains(err, "InvalidRequest", "Versioning must be 'Enabled' on the bucket") {
 			return retry.RetryableError(err)
diff --git a/internal/service/s3/bucket_replication_configuration_test.go b/internal/service/s3/bucket_replication_configuration_test.go
index d021b070bc5..b40625178cd 100644
--- a/internal/service/s3/bucket_replication_configuration_test.go
+++ b/internal/service/s3/bucket_replication_configuration_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3_test
 
 import (
diff --git a/internal/service/s3/bucket_request_payment_configuration.go b/internal/service/s3/bucket_request_payment_configuration.go
index 5e0d1a9804f..c41120129b9 100644
--- a/internal/service/s3/bucket_request_payment_configuration.go
+++ b/internal/service/s3/bucket_request_payment_configuration.go
@@ -1,17 +1,22 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3
 
 import (
 	"context"
 	"log"
-	"time"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/s3"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/s3"
+	"github.com/aws/aws-sdk-go-v2/service/s3/types"
+	"github.com/hashicorp/aws-sdk-go-base/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/enum"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
 )
@@ -23,6 +28,7 @@ func ResourceBucketRequestPaymentConfiguration() *schema.Resource {
 		ReadWithoutTimeout:   resourceBucketRequestPaymentConfigurationRead,
 		UpdateWithoutTimeout: resourceBucketRequestPaymentConfigurationUpdate,
 		DeleteWithoutTimeout: resourceBucketRequestPaymentConfigurationDelete,
+
 		Importer: &schema.ResourceImporter{
 			StateContext: schema.ImportStatePassthroughContext,
 		},
@@ -41,70 +47,68 @@ func ResourceBucketRequestPaymentConfiguration() *schema.Resource {
 				ValidateFunc: verify.ValidAccountID,
 			},
 			"payer": {
-				Type:         schema.TypeString,
-				Required:     true,
-				ValidateFunc: validation.StringInSlice(s3.Payer_Values(), false),
+				Type:             schema.TypeString,
+				Required:         true,
+				ValidateDiagFunc: enum.Validate[types.Payer](),
 			},
 		},
 	}
 }
 
 func resourceBucketRequestPaymentConfigurationCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).S3Conn(ctx)
+	conn := meta.(*conns.AWSClient).S3Client(ctx)
 
 	bucket := d.Get("bucket").(string)
 	expectedBucketOwner := d.Get("expected_bucket_owner").(string)
-
 	input := &s3.PutBucketRequestPaymentInput{
 		Bucket: aws.String(bucket),
-		RequestPaymentConfiguration: &s3.RequestPaymentConfiguration{
-			Payer: aws.String(d.Get("payer").(string)),
+		RequestPaymentConfiguration: &types.RequestPaymentConfiguration{
+			Payer: types.Payer(d.Get("payer").(string)),
 		},
 	}
-
 	if expectedBucketOwner != "" {
 		input.ExpectedBucketOwner = aws.String(expectedBucketOwner)
 	}
 
-	_, err := tfresource.RetryWhenAWSErrCodeEquals(ctx, 2*time.Minute, func() (interface{}, error) {
-		return conn.PutBucketRequestPaymentWithContext(ctx, input)
-	}, s3.ErrCodeNoSuchBucket)
+	_, err := tfresource.RetryWhenAWSErrCodeEquals(ctx, s3BucketPropagationTimeout, func() (interface{}, error) {
+		return conn.PutBucketRequestPayment(ctx, input)
+	}, errCodeNoSuchBucket)
 
 	if err != nil {
-		return diag.Errorf("creating S3 bucket (%s) request payment configuration: %s", bucket, err)
+		return diag.Errorf("creating S3 Bucket (%s) Request Payment Configuration: %s", bucket, err)
 	}
 
 	d.SetId(CreateResourceID(bucket, expectedBucketOwner))
 
+	_, err = tfresource.RetryWhenNotFound(ctx, s3BucketPropagationTimeout, func() (interface{}, error) {
+		return findBucketRequestPayment(ctx, conn, bucket, expectedBucketOwner)
+	})
+
+	if err != nil {
+		return diag.Errorf("waiting for S3 Bucket Request Payment Configuration (%s) create: %s", d.Id(), err)
+	}
+
 	return resourceBucketRequestPaymentConfigurationRead(ctx, d, meta)
 }
 
 func resourceBucketRequestPaymentConfigurationRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).S3Conn(ctx)
+	conn := meta.(*conns.AWSClient).S3Client(ctx)
 
 	bucket, expectedBucketOwner, err := ParseResourceID(d.Id())
 	if err != nil {
 		return diag.FromErr(err)
 	}
 
-	input := &s3.GetBucketRequestPaymentInput{
-		Bucket: aws.String(bucket),
-	}
-
-	if expectedBucketOwner != "" {
-		input.ExpectedBucketOwner = aws.String(expectedBucketOwner)
-	}
-
-	output, err := conn.GetBucketRequestPaymentWithContext(ctx, input)
+	output, err := findBucketRequestPayment(ctx, conn, bucket, expectedBucketOwner)
 
-	if !d.IsNewResource() && tfawserr.ErrCodeEquals(err, s3.ErrCodeNoSuchBucket) {
+	if !d.IsNewResource() && tfresource.NotFound(err) {
 		log.Printf("[WARN] S3 Bucket Request Payment Configuration (%s) not found, removing from state", d.Id())
 		d.SetId("")
 		return nil
 	}
 
-	if output == nil {
-		return diag.Errorf("reading S3 bucket request payment configuration (%s): empty output", d.Id())
+	if err != nil {
+		return diag.Errorf("reading S3 Bucket Request Payment Configuration (%s): %s", d.Id(), err)
 	}
 
 	d.Set("bucket", bucket)
@@ -115,7 +119,7 @@ func resourceBucketRequestPaymentConfigurationRead(ctx context.Context, d *schem
 }
 
 func resourceBucketRequestPaymentConfigurationUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).S3Conn(ctx)
+	conn := meta.(*conns.AWSClient).S3Client(ctx)
 
 	bucket, expectedBucketOwner, err := ParseResourceID(d.Id())
 	if err != nil {
@@ -124,26 +128,25 @@ func resourceBucketRequestPaymentConfigurationUpdate(ctx context.Context, d *sch
 
 	input := &s3.PutBucketRequestPaymentInput{
 		Bucket: aws.String(bucket),
-		RequestPaymentConfiguration: &s3.RequestPaymentConfiguration{
-			Payer: aws.String(d.Get("payer").(string)),
+		RequestPaymentConfiguration: &types.RequestPaymentConfiguration{
+			Payer: types.Payer(d.Get("payer").(string)),
 		},
 	}
-
 	if expectedBucketOwner != "" {
 		input.ExpectedBucketOwner = aws.String(expectedBucketOwner)
 	}
 
-	_, err = conn.PutBucketRequestPaymentWithContext(ctx, input)
+	_, err = conn.PutBucketRequestPayment(ctx, input)
 
 	if err != nil {
-		return diag.Errorf("updating S3 bucket request payment configuration (%s): %s", d.Id(), err)
+		return diag.Errorf("updating S3 Bucket Request Payment Configuration (%s): %s", d.Id(), err)
 	}
 
 	return resourceBucketRequestPaymentConfigurationRead(ctx, d, meta)
 }
 
 func resourceBucketRequestPaymentConfigurationDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).S3Conn(ctx)
+	conn := meta.(*conns.AWSClient).S3Client(ctx)
 
 	bucket, expectedBucketOwner, err := ParseResourceID(d.Id())
 	if err != nil {
@@ -152,26 +155,55 @@ func resourceBucketRequestPaymentConfigurationDelete(ctx context.Context, d *sch
 
 	input := &s3.PutBucketRequestPaymentInput{
 		Bucket: aws.String(bucket),
-		RequestPaymentConfiguration: &s3.RequestPaymentConfiguration{
+		RequestPaymentConfiguration: &types.RequestPaymentConfiguration{
 			// To remove a configuration, it is equivalent to disabling
 			// "Requester Pays" in the console; thus, we reset "Payer" back to "BucketOwner"
-			Payer: aws.String(s3.PayerBucketOwner),
+			Payer: types.PayerBucketOwner,
 		},
 	}
-
 	if expectedBucketOwner != "" {
 		input.ExpectedBucketOwner = aws.String(expectedBucketOwner)
 	}
 
-	_, err = conn.PutBucketRequestPaymentWithContext(ctx, input)
+	_, err = conn.PutBucketRequestPayment(ctx, input)
 
-	if tfawserr.ErrCodeEquals(err, s3.ErrCodeNoSuchBucket) {
+	if tfawserr.ErrCodeEquals(err, errCodeNoSuchBucket) {
 		return nil
 	}
 
 	if err != nil {
-		return diag.Errorf("deleting S3 bucket request payment configuration (%s): %s", d.Id(), err)
+		return diag.Errorf("deleting S3 Bucket Request Payment Configuration (%s): %s", d.Id(), err)
 	}
 
+	// Don't wait for the request payment configuration to disappear as it still exists after reset.
+
 	return nil
 }
+
+func findBucketRequestPayment(ctx context.Context, conn *s3.Client, bucket, expectedBucketOwner string) (*s3.GetBucketRequestPaymentOutput, error) {
+	input := &s3.GetBucketRequestPaymentInput{
+		Bucket: aws.String(bucket),
+	}
+	if expectedBucketOwner != "" {
+		input.ExpectedBucketOwner = aws.String(expectedBucketOwner)
+	}
+
+	output, err := conn.GetBucketRequestPayment(ctx, input)
+
+	if tfawserr.ErrCodeEquals(err, errCodeNoSuchBucket) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	if output == nil {
+		return nil, tfresource.NewEmptyResultError(input)
+	}
+
+	return output, nil
+}
diff --git a/internal/service/s3/bucket_request_payment_configuration_test.go b/internal/service/s3/bucket_request_payment_configuration_test.go
index 46c9b7e0962..5a337de15e2 100644
--- a/internal/service/s3/bucket_request_payment_configuration_test.go
+++ b/internal/service/s3/bucket_request_payment_configuration_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3_test
 
 import (
@@ -5,15 +8,15 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/s3"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/aws/aws-sdk-go-v2/service/s3/types"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	tfs3 "github.com/hashicorp/terraform-provider-aws/internal/service/s3"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
 func TestAccS3BucketRequestPaymentConfiguration_Basic_BucketOwner(t *testing.T) {
@@ -23,16 +26,16 @@ func TestAccS3BucketRequestPaymentConfiguration_Basic_BucketOwner(t *testing.T)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketRequestPaymentConfigurationDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccBucketRequestPaymentConfigurationConfig_basic(rName, s3.PayerBucketOwner),
+				Config: testAccBucketRequestPaymentConfigurationConfig_basic(rName, string(types.PayerBucketOwner)),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketRequestPaymentConfigurationExists(ctx, resourceName),
 					resource.TestCheckResourceAttrPair(resourceName, "bucket", "aws_s3_bucket.test", "id"),
-					resource.TestCheckResourceAttr(resourceName, "payer", s3.PayerBucketOwner),
+					resource.TestCheckResourceAttr(resourceName, "payer", string(types.PayerBucketOwner)),
 				),
 			},
 			{
@@ -51,16 +54,16 @@ func TestAccS3BucketRequestPaymentConfiguration_Basic_Requester(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketRequestPaymentConfigurationDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccBucketRequestPaymentConfigurationConfig_basic(rName, s3.PayerRequester),
+				Config: testAccBucketRequestPaymentConfigurationConfig_basic(rName, string(types.PayerRequester)),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketRequestPaymentConfigurationExists(ctx, resourceName),
 					resource.TestCheckResourceAttrPair(resourceName, "bucket", "aws_s3_bucket.test", "id"),
-					resource.TestCheckResourceAttr(resourceName, "payer", s3.PayerRequester),
+					resource.TestCheckResourceAttr(resourceName, "payer", string(types.PayerRequester)),
 				),
 			},
 			{
@@ -79,20 +82,22 @@ func TestAccS3BucketRequestPaymentConfiguration_update(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketRequestPaymentConfigurationDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccBucketRequestPaymentConfigurationConfig_basic(rName, s3.PayerRequester),
+				Config: testAccBucketRequestPaymentConfigurationConfig_basic(rName, string(types.PayerRequester)),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketRequestPaymentConfigurationExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "payer", string(types.PayerRequester)),
 				),
 			},
 			{
-				Config: testAccBucketRequestPaymentConfigurationConfig_basic(rName, s3.PayerBucketOwner),
+				Config: testAccBucketRequestPaymentConfigurationConfig_basic(rName, string(types.PayerBucketOwner)),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketRequestPaymentConfigurationExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "payer", string(types.PayerBucketOwner)),
 				),
 			},
 			{
@@ -101,9 +106,10 @@ func TestAccS3BucketRequestPaymentConfiguration_update(t *testing.T) {
 				ImportStateVerify: true,
 			},
 			{
-				Config: testAccBucketRequestPaymentConfigurationConfig_basic(rName, s3.PayerRequester),
+				Config: testAccBucketRequestPaymentConfigurationConfig_basic(rName, string(types.PayerRequester)),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketRequestPaymentConfigurationExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "payer", string(types.PayerRequester)),
 				),
 			},
 		},
@@ -118,22 +124,22 @@ func TestAccS3BucketRequestPaymentConfiguration_migrate_noChange(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketRequestPaymentConfigurationDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccBucketConfig_requestPayer(rName, s3.PayerRequester),
+				Config: testAccBucketConfig_requestPayer(rName, string(types.PayerRequester)),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketExists(ctx, bucketResourceName),
-					resource.TestCheckResourceAttr(bucketResourceName, "request_payer", s3.PayerRequester),
+					resource.TestCheckResourceAttr(bucketResourceName, "request_payer", string(types.PayerRequester)),
 				),
 			},
 			{
-				Config: testAccBucketRequestPaymentConfigurationConfig_basic(rName, s3.PayerRequester),
+				Config: testAccBucketRequestPaymentConfigurationConfig_basic(rName, string(types.PayerRequester)),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketRequestPaymentConfigurationExists(ctx, resourceName),
-					resource.TestCheckResourceAttr(resourceName, "payer", s3.PayerRequester),
+					resource.TestCheckResourceAttr(resourceName, "payer", string(types.PayerRequester)),
 				),
 			},
 		},
@@ -148,22 +154,22 @@ func TestAccS3BucketRequestPaymentConfiguration_migrate_withChange(t *testing.T)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketRequestPaymentConfigurationDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccBucketConfig_requestPayer(rName, s3.PayerRequester),
+				Config: testAccBucketConfig_requestPayer(rName, string(types.PayerRequester)),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketExists(ctx, bucketResourceName),
-					resource.TestCheckResourceAttr(bucketResourceName, "request_payer", s3.PayerRequester),
+					resource.TestCheckResourceAttr(bucketResourceName, "request_payer", string(types.PayerRequester)),
 				),
 			},
 			{
-				Config: testAccBucketRequestPaymentConfigurationConfig_basic(rName, s3.PayerBucketOwner),
+				Config: testAccBucketRequestPaymentConfigurationConfig_basic(rName, string(types.PayerBucketOwner)),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketRequestPaymentConfigurationExists(ctx, resourceName),
-					resource.TestCheckResourceAttr(resourceName, "payer", s3.PayerBucketOwner),
+					resource.TestCheckResourceAttr(resourceName, "payer", string(types.PayerBucketOwner)),
 				),
 			},
 		},
@@ -172,7 +178,7 @@ func TestAccS3BucketRequestPaymentConfiguration_migrate_withChange(t *testing.T)
 
 func testAccCheckBucketRequestPaymentConfigurationDestroy(ctx context.Context) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Conn(ctx)
+		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Client(ctx)
 
 		for _, rs := range s.RootModule().Resources {
 			if rs.Type != "aws_s3_bucket_request_payment_configuration" {
@@ -184,70 +190,40 @@ func testAccCheckBucketRequestPaymentConfigurationDestroy(ctx context.Context) r
 				return err
 			}
 
-			input := &s3.GetBucketRequestPaymentInput{
-				Bucket: aws.String(bucket),
-			}
-
-			if expectedBucketOwner != "" {
-				input.ExpectedBucketOwner = aws.String(expectedBucketOwner)
-			}
-
-			output, err := conn.GetBucketRequestPaymentWithContext(ctx, input)
+			_, err = tfs3.FindBucketRequestPayment(ctx, conn, bucket, expectedBucketOwner)
 
-			if tfawserr.ErrCodeEquals(err, s3.ErrCodeNoSuchBucket) {
+			if tfresource.NotFound(err) {
 				continue
 			}
 
 			if err != nil {
-				return fmt.Errorf("error getting S3 bucket request payment configuration (%s): %w", rs.Primary.ID, err)
+				return err
 			}
 
-			if output != nil && aws.StringValue(output.Payer) != s3.PayerBucketOwner {
-				return fmt.Errorf("S3 bucket request payment configuration (%s) still exists", rs.Primary.ID)
-			}
+			return fmt.Errorf("S3 Bucket Request Payment Configuration %s still exists", rs.Primary.ID)
 		}
 
 		return nil
 	}
 }
 
-func testAccCheckBucketRequestPaymentConfigurationExists(ctx context.Context, resourceName string) resource.TestCheckFunc {
+func testAccCheckBucketRequestPaymentConfigurationExists(ctx context.Context, n string) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		rs, ok := s.RootModule().Resources[resourceName]
+		rs, ok := s.RootModule().Resources[n]
 		if !ok {
-			return fmt.Errorf("Not found: %s", resourceName)
+			return fmt.Errorf("Not found: %s", n)
 		}
 
-		if rs.Primary.ID == "" {
-			return fmt.Errorf("Resource (%s) ID not set", resourceName)
-		}
-
-		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Conn(ctx)
-
 		bucket, expectedBucketOwner, err := tfs3.ParseResourceID(rs.Primary.ID)
 		if err != nil {
 			return err
 		}
 
-		input := &s3.GetBucketRequestPaymentInput{
-			Bucket: aws.String(bucket),
-		}
-
-		if expectedBucketOwner != "" {
-			input.ExpectedBucketOwner = aws.String(expectedBucketOwner)
-		}
+		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Client(ctx)
 
-		output, err := conn.GetBucketRequestPaymentWithContext(ctx, input)
+		_, err = tfs3.FindBucketRequestPayment(ctx, conn, bucket, expectedBucketOwner)
 
-		if err != nil {
-			return fmt.Errorf("error getting S3 bucket request payment configuration (%s): %w", rs.Primary.ID, err)
-		}
-
-		if output == nil {
-			return fmt.Errorf("S3 Bucket request payment configuration (%s) not found", rs.Primary.ID)
-		}
-
-		return nil
+		return err
 	}
 }
 
diff --git a/internal/service/s3/bucket_server_side_encryption_configuration.go b/internal/service/s3/bucket_server_side_encryption_configuration.go
index 418493f2439..0d499ff8c59 100644
--- a/internal/service/s3/bucket_server_side_encryption_configuration.go
+++ b/internal/service/s3/bucket_server_side_encryption_configuration.go
@@ -1,16 +1,22 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3
 
 import (
 	"context"
 	"log"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/s3"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/s3"
+	"github.com/aws/aws-sdk-go-v2/service/s3/types"
+	"github.com/hashicorp/aws-sdk-go-base/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/enum"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
 )
@@ -22,6 +28,7 @@ func ResourceBucketServerSideEncryptionConfiguration() *schema.Resource {
 		ReadWithoutTimeout:   resourceBucketServerSideEncryptionConfigurationRead,
 		UpdateWithoutTimeout: resourceBucketServerSideEncryptionConfigurationUpdate,
 		DeleteWithoutTimeout: resourceBucketServerSideEncryptionConfigurationDelete,
+
 		Importer: &schema.ResourceImporter{
 			StateContext: schema.ImportStatePassthroughContext,
 		},
@@ -55,9 +62,9 @@ func ResourceBucketServerSideEncryptionConfiguration() *schema.Resource {
 										Optional: true,
 									},
 									"sse_algorithm": {
-										Type:         schema.TypeString,
-										Required:     true,
-										ValidateFunc: validation.StringInSlice(s3.ServerSideEncryption_Values(), false),
+										Type:             schema.TypeString,
+										Required:         true,
+										ValidateDiagFunc: enum.Validate[types.ServerSideEncryption](),
 									},
 								},
 							},
@@ -74,85 +81,61 @@ func ResourceBucketServerSideEncryptionConfiguration() *schema.Resource {
 }
 
 func resourceBucketServerSideEncryptionConfigurationCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).S3Conn(ctx)
+	conn := meta.(*conns.AWSClient).S3Client(ctx)
 
 	bucket := d.Get("bucket").(string)
 	expectedBucketOwner := d.Get("expected_bucket_owner").(string)
-
 	input := &s3.PutBucketEncryptionInput{
 		Bucket: aws.String(bucket),
-		ServerSideEncryptionConfiguration: &s3.ServerSideEncryptionConfiguration{
+		ServerSideEncryptionConfiguration: &types.ServerSideEncryptionConfiguration{
 			Rules: expandBucketServerSideEncryptionConfigurationRules(d.Get("rule").(*schema.Set).List()),
 		},
 	}
-
 	if expectedBucketOwner != "" {
 		input.ExpectedBucketOwner = aws.String(expectedBucketOwner)
 	}
 
-	_, err := tfresource.RetryWhenAWSErrCodeEquals(ctx, propagationTimeout,
-		func() (interface{}, error) {
-			return conn.PutBucketEncryptionWithContext(ctx, input)
-		},
-		s3.ErrCodeNoSuchBucket,
-		errCodeOperationAborted,
-	)
+	_, err := tfresource.RetryWhenAWSErrCodeEquals(ctx, s3BucketPropagationTimeout, func() (interface{}, error) {
+		return conn.PutBucketEncryption(ctx, input)
+	}, errCodeNoSuchBucket, errCodeOperationAborted)
 
 	if err != nil {
-		return diag.Errorf("creating S3 bucket (%s) server-side encryption configuration: %s", bucket, err)
+		return diag.Errorf("creating S3 Bucket (%s) Server-side Encryption Configuration: %s", bucket, err)
 	}
 
 	d.SetId(CreateResourceID(bucket, expectedBucketOwner))
 
+	_, err = tfresource.RetryWhenNotFound(ctx, s3BucketPropagationTimeout, func() (interface{}, error) {
+		return findServerSideEncryptionConfiguration(ctx, conn, bucket, expectedBucketOwner)
+	})
+
+	if err != nil {
+		return diag.Errorf("waiting for S3 Bucket Server-side Encryption Configuration (%s) create: %s", d.Id(), err)
+	}
+
 	return resourceBucketServerSideEncryptionConfigurationRead(ctx, d, meta)
 }
 
 func resourceBucketServerSideEncryptionConfigurationRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).S3Conn(ctx)
+	conn := meta.(*conns.AWSClient).S3Client(ctx)
 
 	bucket, expectedBucketOwner, err := ParseResourceID(d.Id())
 	if err != nil {
 		return diag.FromErr(err)
 	}
 
-	input := &s3.GetBucketEncryptionInput{
-		Bucket: aws.String(bucket),
-	}
-
-	if expectedBucketOwner != "" {
-		input.ExpectedBucketOwner = aws.String(expectedBucketOwner)
-	}
+	sse, err := findServerSideEncryptionConfiguration(ctx, conn, bucket, expectedBucketOwner)
 
-	resp, err := tfresource.RetryWhenAWSErrCodeEquals(ctx, propagationTimeout,
-		func() (interface{}, error) {
-			return conn.GetBucketEncryptionWithContext(ctx, input)
-		},
-		s3.ErrCodeNoSuchBucket,
-		ErrCodeServerSideEncryptionConfigurationNotFound,
-	)
-
-	if !d.IsNewResource() && tfawserr.ErrCodeEquals(err, s3.ErrCodeNoSuchBucket, ErrCodeServerSideEncryptionConfigurationNotFound) {
-		log.Printf("[WARN] S3 Bucket Server-Side Encryption Configuration (%s) not found, removing from state", d.Id())
+	if !d.IsNewResource() && tfresource.NotFound(err) {
+		log.Printf("[WARN] S3 Bucket Server-side Encryption Configuration (%s) not found, removing from state", d.Id())
 		d.SetId("")
 		return nil
 	}
 
 	if err != nil {
-		return diag.Errorf("reading S3 bucket server-side encryption configuration (%s): %s", d.Id(), err)
+		return diag.Errorf("reading S3 Bucket Server-side Encryption Configuration (%s): %s", d.Id(), err)
 	}
 
-	output, ok := resp.(*s3.GetBucketEncryptionOutput)
-	if !ok || output.ServerSideEncryptionConfiguration == nil {
-		if d.IsNewResource() {
-			return diag.Errorf("reading S3 bucket server-side encryption configuration (%s): empty output", d.Id())
-		}
-		log.Printf("[WARN] S3 Bucket Server-Side Encryption Configuration (%s) not found, removing from state", d.Id())
-		d.SetId("")
-		return nil
-	}
-
-	sse := output.ServerSideEncryptionConfiguration
-
 	d.Set("bucket", bucket)
 	d.Set("expected_bucket_owner", expectedBucketOwner)
 	if err := d.Set("rule", flattenBucketServerSideEncryptionConfigurationRules(sse.Rules)); err != nil {
@@ -163,7 +146,7 @@ func resourceBucketServerSideEncryptionConfigurationRead(ctx context.Context, d
 }
 
 func resourceBucketServerSideEncryptionConfigurationUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).S3Conn(ctx)
+	conn := meta.(*conns.AWSClient).S3Client(ctx)
 
 	bucket, expectedBucketOwner, err := ParseResourceID(d.Id())
 	if err != nil {
@@ -172,32 +155,27 @@ func resourceBucketServerSideEncryptionConfigurationUpdate(ctx context.Context,
 
 	input := &s3.PutBucketEncryptionInput{
 		Bucket: aws.String(bucket),
-		ServerSideEncryptionConfiguration: &s3.ServerSideEncryptionConfiguration{
+		ServerSideEncryptionConfiguration: &types.ServerSideEncryptionConfiguration{
 			Rules: expandBucketServerSideEncryptionConfigurationRules(d.Get("rule").(*schema.Set).List()),
 		},
 	}
-
 	if expectedBucketOwner != "" {
 		input.ExpectedBucketOwner = aws.String(expectedBucketOwner)
 	}
 
-	_, err = tfresource.RetryWhenAWSErrCodeEquals(ctx, propagationTimeout,
-		func() (interface{}, error) {
-			return conn.PutBucketEncryptionWithContext(ctx, input)
-		},
-		s3.ErrCodeNoSuchBucket,
-		errCodeOperationAborted,
-	)
+	_, err = tfresource.RetryWhenAWSErrCodeEquals(ctx, s3BucketPropagationTimeout, func() (interface{}, error) {
+		return conn.PutBucketEncryption(ctx, input)
+	}, errCodeNoSuchBucket, errCodeOperationAborted)
 
 	if err != nil {
-		return diag.Errorf("updating S3 bucket (%s) server-side encryption configuration: %s", d.Id(), err)
+		return diag.Errorf("updating S3 Bucket Server-side Encryption Configuration (%s): %s", d.Id(), err)
 	}
 
 	return resourceBucketServerSideEncryptionConfigurationRead(ctx, d, meta)
 }
 
 func resourceBucketServerSideEncryptionConfigurationDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).S3Conn(ctx)
+	conn := meta.(*conns.AWSClient).S3Client(ctx)
 
 	bucket, expectedBucketOwner, err := ParseResourceID(d.Id())
 	if err != nil {
@@ -207,25 +185,54 @@ func resourceBucketServerSideEncryptionConfigurationDelete(ctx context.Context,
 	input := &s3.DeleteBucketEncryptionInput{
 		Bucket: aws.String(bucket),
 	}
-
 	if expectedBucketOwner != "" {
 		input.ExpectedBucketOwner = aws.String(expectedBucketOwner)
 	}
 
-	_, err = conn.DeleteBucketEncryptionWithContext(ctx, input)
+	_, err = conn.DeleteBucketEncryption(ctx, input)
 
-	if tfawserr.ErrCodeEquals(err, s3.ErrCodeNoSuchBucket, ErrCodeServerSideEncryptionConfigurationNotFound) {
+	if tfawserr.ErrCodeEquals(err, errCodeNoSuchBucket, errCodeServerSideEncryptionConfigurationNotFound) {
 		return nil
 	}
 
 	if err != nil {
-		return diag.Errorf("deleting S3 bucket server-side encryption configuration (%s): %s", d.Id(), err)
+		return diag.Errorf("deleting S3 Bucket Server-side Encryption Configuration (%s): %s", d.Id(), err)
 	}
 
+	// Don't wait for the SSE configuration to disappear as the bucket now always has one.
+
 	return nil
 }
 
-func expandBucketServerSideEncryptionConfigurationRuleApplyServerSideEncryptionByDefault(l []interface{}) *s3.ServerSideEncryptionByDefault {
+func findServerSideEncryptionConfiguration(ctx context.Context, conn *s3.Client, bucketName, expectedBucketOwner string) (*types.ServerSideEncryptionConfiguration, error) {
+	input := &s3.GetBucketEncryptionInput{
+		Bucket: aws.String(bucketName),
+	}
+	if expectedBucketOwner != "" {
+		input.ExpectedBucketOwner = aws.String(expectedBucketOwner)
+	}
+
+	output, err := conn.GetBucketEncryption(ctx, input)
+
+	if tfawserr.ErrCodeEquals(err, errCodeNoSuchBucket, errCodeServerSideEncryptionConfigurationNotFound) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	if output == nil || output.ServerSideEncryptionConfiguration == nil {
+		return nil, tfresource.NewEmptyResultError(input)
+	}
+
+	return output.ServerSideEncryptionConfiguration, nil
+}
+
+func expandBucketServerSideEncryptionConfigurationRuleApplyServerSideEncryptionByDefault(l []interface{}) *types.ServerSideEncryptionByDefault {
 	if len(l) == 0 || l[0] == nil {
 		return nil
 	}
@@ -235,21 +242,21 @@ func expandBucketServerSideEncryptionConfigurationRuleApplyServerSideEncryptionB
 		return nil
 	}
 
-	sse := &s3.ServerSideEncryptionByDefault{}
+	sse := &types.ServerSideEncryptionByDefault{}
 
 	if v, ok := tfMap["kms_master_key_id"].(string); ok && v != "" {
 		sse.KMSMasterKeyID = aws.String(v)
 	}
 
 	if v, ok := tfMap["sse_algorithm"].(string); ok && v != "" {
-		sse.SSEAlgorithm = aws.String(v)
+		sse.SSEAlgorithm = types.ServerSideEncryption(v)
 	}
 
 	return sse
 }
 
-func expandBucketServerSideEncryptionConfigurationRules(l []interface{}) []*s3.ServerSideEncryptionRule {
-	var rules []*s3.ServerSideEncryptionRule
+func expandBucketServerSideEncryptionConfigurationRules(l []interface{}) []types.ServerSideEncryptionRule {
+	var rules []types.ServerSideEncryptionRule
 
 	for _, tfMapRaw := range l {
 		tfMap, ok := tfMapRaw.(map[string]interface{})
@@ -257,14 +264,14 @@ func expandBucketServerSideEncryptionConfigurationRules(l []interface{}) []*s3.S
 			continue
 		}
 
-		rule := &s3.ServerSideEncryptionRule{}
+		rule := types.ServerSideEncryptionRule{}
 
 		if v, ok := tfMap["apply_server_side_encryption_by_default"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
 			rule.ApplyServerSideEncryptionByDefault = expandBucketServerSideEncryptionConfigurationRuleApplyServerSideEncryptionByDefault(v)
 		}
 
 		if v, ok := tfMap["bucket_key_enabled"].(bool); ok {
-			rule.BucketKeyEnabled = aws.Bool(v)
+			rule.BucketKeyEnabled = v
 		}
 		rules = append(rules, rule)
 	}
@@ -272,22 +279,17 @@ func expandBucketServerSideEncryptionConfigurationRules(l []interface{}) []*s3.S
 	return rules
 }
 
-func flattenBucketServerSideEncryptionConfigurationRules(rules []*s3.ServerSideEncryptionRule) []interface{} {
+func flattenBucketServerSideEncryptionConfigurationRules(rules []types.ServerSideEncryptionRule) []interface{} {
 	var results []interface{}
 
 	for _, rule := range rules {
-		if rule == nil {
-			continue
+		m := map[string]interface{}{
+			"bucket_key_enabled": rule.BucketKeyEnabled,
 		}
 
-		m := make(map[string]interface{})
-
 		if rule.ApplyServerSideEncryptionByDefault != nil {
 			m["apply_server_side_encryption_by_default"] = flattenBucketServerSideEncryptionConfigurationRuleApplyServerSideEncryptionByDefault(rule.ApplyServerSideEncryptionByDefault)
 		}
-		if rule.BucketKeyEnabled != nil {
-			m["bucket_key_enabled"] = aws.BoolValue(rule.BucketKeyEnabled)
-		}
 
 		results = append(results, m)
 	}
@@ -295,19 +297,17 @@ func flattenBucketServerSideEncryptionConfigurationRules(rules []*s3.ServerSideE
 	return results
 }
 
-func flattenBucketServerSideEncryptionConfigurationRuleApplyServerSideEncryptionByDefault(sse *s3.ServerSideEncryptionByDefault) []interface{} {
+func flattenBucketServerSideEncryptionConfigurationRuleApplyServerSideEncryptionByDefault(sse *types.ServerSideEncryptionByDefault) []interface{} {
 	if sse == nil {
-		return []interface{}{}
+		return nil
 	}
 
-	m := make(map[string]interface{})
-
-	if sse.KMSMasterKeyID != nil {
-		m["kms_master_key_id"] = aws.StringValue(sse.KMSMasterKeyID)
+	m := map[string]interface{}{
+		"sse_algorithm": sse.SSEAlgorithm,
 	}
 
-	if sse.SSEAlgorithm != nil {
-		m["sse_algorithm"] = aws.StringValue(sse.SSEAlgorithm)
+	if sse.KMSMasterKeyID != nil {
+		m["kms_master_key_id"] = aws.ToString(sse.KMSMasterKeyID)
 	}
 
 	return []interface{}{m}
diff --git a/internal/service/s3/bucket_server_side_encryption_configuration_test.go b/internal/service/s3/bucket_server_side_encryption_configuration_test.go
index 2680937331d..2460aa58581 100644
--- a/internal/service/s3/bucket_server_side_encryption_configuration_test.go
+++ b/internal/service/s3/bucket_server_side_encryption_configuration_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3_test
 
 import (
@@ -5,15 +8,15 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go-v2/service/s3/types"
 	"github.com/aws/aws-sdk-go/service/s3"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	tfs3 "github.com/hashicorp/terraform-provider-aws/internal/service/s3"
+	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
 func TestAccS3BucketServerSideEncryptionConfiguration_basic(t *testing.T) {
@@ -23,9 +26,9 @@ func TestAccS3BucketServerSideEncryptionConfiguration_basic(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckBucketServerSideEncryptionConfigurationDestroy(ctx),
+		CheckDestroy:             acctest.CheckDestroyNoop,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccBucketServerSideEncryptionConfigurationConfig_basic(rName),
@@ -33,8 +36,9 @@ func TestAccS3BucketServerSideEncryptionConfiguration_basic(t *testing.T) {
 					testAccCheckBucketServerSideEncryptionConfigurationExists(ctx, resourceName),
 					resource.TestCheckResourceAttrPair(resourceName, "bucket", "aws_s3_bucket.test", "bucket"),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
-					resource.TestCheckResourceAttr(resourceName, "rule.0.apply_server_side_encryption_by_default.#", "0"),
-					resource.TestCheckNoResourceAttr(resourceName, "rule.0.bucket_key_enabled"),
+					resource.TestCheckResourceAttr(resourceName, "rule.0.apply_server_side_encryption_by_default.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "rule.0.apply_server_side_encryption_by_default.0.kms_master_key_id", ""),
+					resource.TestCheckResourceAttr(resourceName, "rule.0.apply_server_side_encryption_by_default.0.sse_algorithm", "AES256"),
 				),
 			},
 			{
@@ -46,47 +50,54 @@ func TestAccS3BucketServerSideEncryptionConfiguration_basic(t *testing.T) {
 	})
 }
 
-func TestAccS3BucketServerSideEncryptionConfiguration_disappears(t *testing.T) {
+func TestAccS3BucketServerSideEncryptionConfiguration_ApplySEEByDefault_AES256(t *testing.T) {
 	ctx := acctest.Context(t)
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_s3_bucket_server_side_encryption_configuration.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckBucketServerSideEncryptionConfigurationDestroy(ctx),
+		CheckDestroy:             acctest.CheckDestroyNoop,
 		Steps: []resource.TestStep{
 			{
-				Config: testAccBucketServerSideEncryptionConfigurationConfig_basic(rName),
+				Config: testAccBucketServerSideEncryptionConfigurationConfig_applySSEByDefaultSSEAlgorithm(rName, string(types.ServerSideEncryptionAes256)),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketServerSideEncryptionConfigurationExists(ctx, resourceName),
-					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfs3.ResourceBucketServerSideEncryptionConfiguration(), resourceName),
+					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "rule.0.apply_server_side_encryption_by_default.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "rule.0.apply_server_side_encryption_by_default.0.sse_algorithm", string(types.ServerSideEncryptionAes256)),
+					resource.TestCheckResourceAttr(resourceName, "rule.0.apply_server_side_encryption_by_default.0.kms_master_key_id", ""),
 				),
-				ExpectNonEmptyPlan: true,
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
 			},
 		},
 	})
 }
 
-func TestAccS3BucketServerSideEncryptionConfiguration_ApplySEEByDefault_AES256(t *testing.T) {
+func TestAccS3BucketServerSideEncryptionConfiguration_ApplySSEByDefault_KMS(t *testing.T) {
 	ctx := acctest.Context(t)
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_s3_bucket_server_side_encryption_configuration.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckBucketServerSideEncryptionConfigurationDestroy(ctx),
+		CheckDestroy:             acctest.CheckDestroyNoop,
 		Steps: []resource.TestStep{
 			{
-				Config: testAccBucketServerSideEncryptionConfigurationConfig_applySSEByDefaultSSEAlgorithm(rName, s3.ServerSideEncryptionAes256),
+				Config: testAccBucketServerSideEncryptionConfigurationConfig_applySSEByDefaultSSEAlgorithm(rName, string(types.ServerSideEncryptionAwsKms)),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketServerSideEncryptionConfigurationExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "rule.0.apply_server_side_encryption_by_default.#", "1"),
-					resource.TestCheckResourceAttr(resourceName, "rule.0.apply_server_side_encryption_by_default.0.sse_algorithm", s3.ServerSideEncryptionAes256),
+					resource.TestCheckResourceAttr(resourceName, "rule.0.apply_server_side_encryption_by_default.0.sse_algorithm", string(types.ServerSideEncryptionAwsKms)),
 					resource.TestCheckResourceAttr(resourceName, "rule.0.apply_server_side_encryption_by_default.0.kms_master_key_id", ""),
 				),
 			},
@@ -99,24 +110,24 @@ func TestAccS3BucketServerSideEncryptionConfiguration_ApplySEEByDefault_AES256(t
 	})
 }
 
-func TestAccS3BucketServerSideEncryptionConfiguration_ApplySSEByDefault_KMS(t *testing.T) {
+func TestAccS3BucketServerSideEncryptionConfiguration_ApplySSEByDefault_KMSDSSE(t *testing.T) {
 	ctx := acctest.Context(t)
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_s3_bucket_server_side_encryption_configuration.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckBucketServerSideEncryptionConfigurationDestroy(ctx),
+		CheckDestroy:             acctest.CheckDestroyNoop,
 		Steps: []resource.TestStep{
 			{
-				Config: testAccBucketServerSideEncryptionConfigurationConfig_applySSEByDefaultSSEAlgorithm(rName, s3.ServerSideEncryptionAwsKms),
+				Config: testAccBucketServerSideEncryptionConfigurationConfig_applySSEByDefaultSSEAlgorithm(rName, string(types.ServerSideEncryptionAwsKmsDsse)),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketServerSideEncryptionConfigurationExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "rule.0.apply_server_side_encryption_by_default.#", "1"),
-					resource.TestCheckResourceAttr(resourceName, "rule.0.apply_server_side_encryption_by_default.0.sse_algorithm", s3.ServerSideEncryptionAwsKms),
+					resource.TestCheckResourceAttr(resourceName, "rule.0.apply_server_side_encryption_by_default.0.sse_algorithm", string(types.ServerSideEncryptionAwsKmsDsse)),
 					resource.TestCheckResourceAttr(resourceName, "rule.0.apply_server_side_encryption_by_default.0.kms_master_key_id", ""),
 				),
 			},
@@ -136,17 +147,17 @@ func TestAccS3BucketServerSideEncryptionConfiguration_ApplySSEByDefault_UpdateSS
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckBucketServerSideEncryptionConfigurationDestroy(ctx),
+		CheckDestroy:             acctest.CheckDestroyNoop,
 		Steps: []resource.TestStep{
 			{
-				Config: testAccBucketServerSideEncryptionConfigurationConfig_applySSEByDefaultSSEAlgorithm(rName, s3.ServerSideEncryptionAwsKms),
+				Config: testAccBucketServerSideEncryptionConfigurationConfig_applySSEByDefaultSSEAlgorithm(rName, string(types.ServerSideEncryptionAwsKms)),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketServerSideEncryptionConfigurationExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "rule.0.apply_server_side_encryption_by_default.#", "1"),
-					resource.TestCheckResourceAttr(resourceName, "rule.0.apply_server_side_encryption_by_default.0.sse_algorithm", s3.ServerSideEncryptionAwsKms),
+					resource.TestCheckResourceAttr(resourceName, "rule.0.apply_server_side_encryption_by_default.0.sse_algorithm", string(types.ServerSideEncryptionAwsKms)),
 				),
 			},
 			{
@@ -155,12 +166,12 @@ func TestAccS3BucketServerSideEncryptionConfiguration_ApplySSEByDefault_UpdateSS
 				ImportStateVerify: true,
 			},
 			{
-				Config: testAccBucketServerSideEncryptionConfigurationConfig_applySSEByDefaultSSEAlgorithm(rName, s3.ServerSideEncryptionAes256),
+				Config: testAccBucketServerSideEncryptionConfigurationConfig_applySSEByDefaultSSEAlgorithm(rName, string(types.ServerSideEncryptionAes256)),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketServerSideEncryptionConfigurationExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "rule.0.apply_server_side_encryption_by_default.#", "1"),
-					resource.TestCheckResourceAttr(resourceName, "rule.0.apply_server_side_encryption_by_default.0.sse_algorithm", s3.ServerSideEncryptionAes256),
+					resource.TestCheckResourceAttr(resourceName, "rule.0.apply_server_side_encryption_by_default.0.sse_algorithm", string(types.ServerSideEncryptionAes256)),
 				),
 			},
 			{
@@ -179,9 +190,9 @@ func TestAccS3BucketServerSideEncryptionConfiguration_ApplySSEByDefault_KMSWithM
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckBucketServerSideEncryptionConfigurationDestroy(ctx),
+		CheckDestroy:             acctest.CheckDestroyNoop,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccBucketServerSideEncryptionConfigurationConfig_applySSEByDefaultKMSMasterKeyARN(rName),
@@ -189,7 +200,7 @@ func TestAccS3BucketServerSideEncryptionConfiguration_ApplySSEByDefault_KMSWithM
 					testAccCheckBucketServerSideEncryptionConfigurationExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "rule.0.apply_server_side_encryption_by_default.#", "1"),
-					resource.TestCheckResourceAttr(resourceName, "rule.0.apply_server_side_encryption_by_default.0.sse_algorithm", s3.ServerSideEncryptionAwsKms),
+					resource.TestCheckResourceAttr(resourceName, "rule.0.apply_server_side_encryption_by_default.0.sse_algorithm", string(types.ServerSideEncryptionAwsKms)),
 					resource.TestCheckResourceAttrPair(resourceName, "rule.0.apply_server_side_encryption_by_default.0.kms_master_key_id", "aws_kms_key.test", "arn"),
 				),
 			},
@@ -209,9 +220,9 @@ func TestAccS3BucketServerSideEncryptionConfiguration_ApplySSEByDefault_KMSWithM
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckBucketServerSideEncryptionConfigurationDestroy(ctx),
+		CheckDestroy:             acctest.CheckDestroyNoop,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccBucketServerSideEncryptionConfigurationConfig_applySSEByDefaultKMSMasterKeyID(rName),
@@ -219,7 +230,7 @@ func TestAccS3BucketServerSideEncryptionConfiguration_ApplySSEByDefault_KMSWithM
 					testAccCheckBucketServerSideEncryptionConfigurationExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "rule.0.apply_server_side_encryption_by_default.#", "1"),
-					resource.TestCheckResourceAttr(resourceName, "rule.0.apply_server_side_encryption_by_default.0.sse_algorithm", s3.ServerSideEncryptionAwsKms),
+					resource.TestCheckResourceAttr(resourceName, "rule.0.apply_server_side_encryption_by_default.0.sse_algorithm", string(types.ServerSideEncryptionAwsKms)),
 					resource.TestCheckResourceAttrPair(resourceName, "rule.0.apply_server_side_encryption_by_default.0.kms_master_key_id", "aws_kms_key.test", "id"),
 				),
 			},
@@ -239,9 +250,9 @@ func TestAccS3BucketServerSideEncryptionConfiguration_BucketKeyEnabled(t *testin
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckBucketServerSideEncryptionConfigurationDestroy(ctx),
+		CheckDestroy:             acctest.CheckDestroyNoop,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccBucketServerSideEncryptionConfigurationConfig_keyEnabled(rName, true),
@@ -282,9 +293,9 @@ func TestAccS3BucketServerSideEncryptionConfiguration_ApplySSEByDefault_BucketKe
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckBucketServerSideEncryptionConfigurationDestroy(ctx),
+		CheckDestroy:             acctest.CheckDestroyNoop,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccBucketServerSideEncryptionConfigurationConfig_applySSEByDefaultKeyEnabled(rName, true),
@@ -293,7 +304,7 @@ func TestAccS3BucketServerSideEncryptionConfiguration_ApplySSEByDefault_BucketKe
 					resource.TestCheckResourceAttrPair(resourceName, "bucket", "aws_s3_bucket.test", "bucket"),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "rule.0.apply_server_side_encryption_by_default.#", "1"),
-					resource.TestCheckResourceAttr(resourceName, "rule.0.apply_server_side_encryption_by_default.0.sse_algorithm", s3.ServerSideEncryptionAwsKms),
+					resource.TestCheckResourceAttr(resourceName, "rule.0.apply_server_side_encryption_by_default.0.sse_algorithm", string(types.ServerSideEncryptionAwsKms)),
 					resource.TestCheckResourceAttrPair(resourceName, "rule.0.apply_server_side_encryption_by_default.0.kms_master_key_id", "aws_kms_key.test", "id"),
 					resource.TestCheckResourceAttr(resourceName, "rule.0.bucket_key_enabled", "true"),
 				),
@@ -310,7 +321,7 @@ func TestAccS3BucketServerSideEncryptionConfiguration_ApplySSEByDefault_BucketKe
 					resource.TestCheckResourceAttrPair(resourceName, "bucket", "aws_s3_bucket.test", "bucket"),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "rule.0.apply_server_side_encryption_by_default.#", "1"),
-					resource.TestCheckResourceAttr(resourceName, "rule.0.apply_server_side_encryption_by_default.0.sse_algorithm", s3.ServerSideEncryptionAwsKms),
+					resource.TestCheckResourceAttr(resourceName, "rule.0.apply_server_side_encryption_by_default.0.sse_algorithm", string(types.ServerSideEncryptionAwsKms)),
 					resource.TestCheckResourceAttrPair(resourceName, "rule.0.apply_server_side_encryption_by_default.0.kms_master_key_id", "aws_kms_key.test", "id"),
 					resource.TestCheckResourceAttr(resourceName, "rule.0.bucket_key_enabled", "false"),
 				),
@@ -332,9 +343,9 @@ func TestAccS3BucketServerSideEncryptionConfiguration_migrate_noChange(t *testin
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckBucketServerSideEncryptionConfigurationDestroy(ctx),
+		CheckDestroy:             acctest.CheckDestroyNoop,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccBucketConfig_defaultEncryptionDefaultKey(rName, s3.ServerSideEncryptionAwsKms),
@@ -343,7 +354,7 @@ func TestAccS3BucketServerSideEncryptionConfiguration_migrate_noChange(t *testin
 					resource.TestCheckResourceAttr(bucketResourceName, "server_side_encryption_configuration.#", "1"),
 					resource.TestCheckResourceAttr(bucketResourceName, "server_side_encryption_configuration.0.rule.#", "1"),
 					resource.TestCheckResourceAttr(bucketResourceName, "server_side_encryption_configuration.0.rule.0.apply_server_side_encryption_by_default.#", "1"),
-					resource.TestCheckResourceAttr(bucketResourceName, "server_side_encryption_configuration.0.rule.0.apply_server_side_encryption_by_default.0.sse_algorithm", s3.ServerSideEncryptionAwsKms),
+					resource.TestCheckResourceAttr(bucketResourceName, "server_side_encryption_configuration.0.rule.0.apply_server_side_encryption_by_default.0.sse_algorithm", string(types.ServerSideEncryptionAwsKms)),
 					resource.TestCheckResourceAttr(bucketResourceName, "server_side_encryption_configuration.0.rule.0.bucket_key_enabled", "false"),
 				),
 			},
@@ -354,7 +365,7 @@ func TestAccS3BucketServerSideEncryptionConfiguration_migrate_noChange(t *testin
 					resource.TestCheckResourceAttrPair(resourceName, "bucket", bucketResourceName, "bucket"),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "rule.0.apply_server_side_encryption_by_default.#", "1"),
-					resource.TestCheckResourceAttr(resourceName, "rule.0.apply_server_side_encryption_by_default.0.sse_algorithm", s3.ServerSideEncryptionAwsKms),
+					resource.TestCheckResourceAttr(resourceName, "rule.0.apply_server_side_encryption_by_default.0.sse_algorithm", string(types.ServerSideEncryptionAwsKms)),
 					resource.TestCheckNoResourceAttr(resourceName, "rule.0.bucket_key_enabled"),
 				),
 			},
@@ -370,29 +381,29 @@ func TestAccS3BucketServerSideEncryptionConfiguration_migrate_withChange(t *test
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckBucketServerSideEncryptionConfigurationDestroy(ctx),
+		CheckDestroy:             acctest.CheckDestroyNoop,
 		Steps: []resource.TestStep{
 			{
-				Config: testAccBucketConfig_defaultEncryptionDefaultKey(rName, s3.ServerSideEncryptionAwsKms),
+				Config: testAccBucketConfig_defaultEncryptionDefaultKey(rName, string(types.ServerSideEncryptionAwsKms)),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckBucketExists(ctx, bucketResourceName),
 					resource.TestCheckResourceAttr(bucketResourceName, "server_side_encryption_configuration.#", "1"),
 					resource.TestCheckResourceAttr(bucketResourceName, "server_side_encryption_configuration.0.rule.#", "1"),
 					resource.TestCheckResourceAttr(bucketResourceName, "server_side_encryption_configuration.0.rule.0.apply_server_side_encryption_by_default.#", "1"),
-					resource.TestCheckResourceAttr(bucketResourceName, "server_side_encryption_configuration.0.rule.0.apply_server_side_encryption_by_default.0.sse_algorithm", s3.ServerSideEncryptionAwsKms),
+					resource.TestCheckResourceAttr(bucketResourceName, "server_side_encryption_configuration.0.rule.0.apply_server_side_encryption_by_default.0.sse_algorithm", string(types.ServerSideEncryptionAwsKms)),
 					resource.TestCheckResourceAttr(bucketResourceName, "server_side_encryption_configuration.0.rule.0.bucket_key_enabled", "false"),
 				),
 			},
 			{
-				Config: testAccBucketServerSideEncryptionConfigurationConfig_applySSEByDefaultSSEAlgorithm(rName, s3.ServerSideEncryptionAes256),
+				Config: testAccBucketServerSideEncryptionConfigurationConfig_applySSEByDefaultSSEAlgorithm(rName, string(types.ServerSideEncryptionAes256)),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckBucketServerSideEncryptionConfigurationExists(ctx, resourceName),
 					resource.TestCheckResourceAttrPair(resourceName, "bucket", bucketResourceName, "bucket"),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "rule.0.apply_server_side_encryption_by_default.#", "1"),
-					resource.TestCheckResourceAttr(resourceName, "rule.0.apply_server_side_encryption_by_default.0.sse_algorithm", s3.ServerSideEncryptionAes256),
+					resource.TestCheckResourceAttr(resourceName, "rule.0.apply_server_side_encryption_by_default.0.sse_algorithm", string(types.ServerSideEncryptionAes256)),
 					resource.TestCheckNoResourceAttr(resourceName, "rule.0.bucket_key_enabled"),
 				),
 			},
@@ -400,84 +411,23 @@ func TestAccS3BucketServerSideEncryptionConfiguration_migrate_withChange(t *test
 	})
 }
 
-func testAccCheckBucketServerSideEncryptionConfigurationDestroy(ctx context.Context) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Conn(ctx)
-
-		for _, rs := range s.RootModule().Resources {
-			if rs.Type != "aws_s3_bucket_server_side_encryption_configuration" {
-				continue
-			}
-
-			bucket, expectedBucketOwner, err := tfs3.ParseResourceID(rs.Primary.ID)
-			if err != nil {
-				return err
-			}
-
-			input := &s3.GetBucketEncryptionInput{
-				Bucket: aws.String(bucket),
-			}
-
-			if expectedBucketOwner != "" {
-				input.ExpectedBucketOwner = aws.String(expectedBucketOwner)
-			}
-
-			output, err := conn.GetBucketEncryptionWithContext(ctx, input)
-
-			if tfawserr.ErrCodeEquals(err, s3.ErrCodeNoSuchBucket, tfs3.ErrCodeServerSideEncryptionConfigurationNotFound) {
-				continue
-			}
-
-			if err != nil {
-				return fmt.Errorf("error getting S3 Bucket server-side encryption configuration (%s): %w", rs.Primary.ID, err)
-			}
-
-			if output != nil && output.ServerSideEncryptionConfiguration != nil {
-				return fmt.Errorf("S3 Bucket server-side encryption configuration (%s) still exists", rs.Primary.ID)
-			}
-		}
-
-		return nil
-	}
-}
-
-func testAccCheckBucketServerSideEncryptionConfigurationExists(ctx context.Context, resourceName string) resource.TestCheckFunc {
+func testAccCheckBucketServerSideEncryptionConfigurationExists(ctx context.Context, n string) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		rs, ok := s.RootModule().Resources[resourceName]
+		rs, ok := s.RootModule().Resources[n]
 		if !ok {
-			return fmt.Errorf("Not found: %s", resourceName)
+			return fmt.Errorf("Not found: %s", n)
 		}
 
-		if rs.Primary.ID == "" {
-			return fmt.Errorf("Resource (%s) ID not set", resourceName)
-		}
-
-		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Conn(ctx)
-
 		bucket, expectedBucketOwner, err := tfs3.ParseResourceID(rs.Primary.ID)
 		if err != nil {
 			return err
 		}
 
-		input := &s3.GetBucketEncryptionInput{
-			Bucket: aws.String(bucket),
-		}
-
-		if expectedBucketOwner != "" {
-			input.ExpectedBucketOwner = aws.String(expectedBucketOwner)
-		}
+		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Client(ctx)
 
-		output, err := conn.GetBucketEncryptionWithContext(ctx, input)
+		_, err = tfs3.FindServerSideEncryptionConfiguration(ctx, conn, bucket, expectedBucketOwner)
 
-		if err != nil {
-			return fmt.Errorf("error getting S3 Bucket server-side encryption configuration (%s): %w", rs.Primary.ID, err)
-		}
-
-		if output == nil || output.ServerSideEncryptionConfiguration == nil {
-			return fmt.Errorf("S3 Bucket server-side encryption configuration (%s) not found", rs.Primary.ID)
-		}
-
-		return nil
+		return err
 	}
 }
 
@@ -490,7 +440,12 @@ resource "aws_s3_bucket" "test" {
 resource "aws_s3_bucket_server_side_encryption_configuration" "test" {
   bucket = aws_s3_bucket.test.id
 
-  rule {}
+  rule {
+    # This is Amazon S3 bucket default encryption.
+    apply_server_side_encryption_by_default {
+      sse_algorithm = "AES256"
+    }
+  }
 }
 `, rName)
 }
@@ -571,6 +526,11 @@ resource "aws_s3_bucket_server_side_encryption_configuration" "test" {
   bucket = aws_s3_bucket.test.id
 
   rule {
+    # This is Amazon S3 bucket default encryption.
+    apply_server_side_encryption_by_default {
+      sse_algorithm = "AES256"
+    }
+
     bucket_key_enabled = %[2]t
   }
 }
diff --git a/internal/service/s3/bucket_test.go b/internal/service/s3/bucket_test.go
index 90b5b4fe587..b05f83fab25 100644
--- a/internal/service/s3/bucket_test.go
+++ b/internal/service/s3/bucket_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3_test
 
 import (
@@ -5,11 +8,13 @@ import (
 	"fmt"
 	"log"
 	"reflect"
-	"regexp"
 	"strings"
 	"testing"
 	"time"
 
+	"github.com/YakDriver/regexache"
+	aws_sdkv2 "github.com/aws/aws-sdk-go-v2/aws"
+	s3_sdkv2 "github.com/aws/aws-sdk-go-v2/service/s3"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/endpoints"
 	"github.com/aws/aws-sdk-go/service/cloudformation"
@@ -98,7 +103,8 @@ func TestAccS3Bucket_Basic_emptyString(t *testing.T) {
 				Config: testAccBucketConfig_emptyString,
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketExists(ctx, resourceName),
-					resource.TestMatchResourceAttr(resourceName, "bucket", regexp.MustCompile("^terraform-")),
+					acctest.CheckResourceAttrNameGenerated(resourceName, "bucket"),
+					resource.TestCheckResourceAttr(resourceName, "bucket_prefix", id.UniqueIdPrefix),
 				),
 			},
 			{
@@ -111,7 +117,7 @@ func TestAccS3Bucket_Basic_emptyString(t *testing.T) {
 	})
 }
 
-func TestAccS3Bucket_Basic_generatedName(t *testing.T) {
+func TestAccS3Bucket_Basic_nameGenerated(t *testing.T) {
 	ctx := acctest.Context(t)
 	resourceName := "aws_s3_bucket.test"
 
@@ -122,16 +128,18 @@ func TestAccS3Bucket_Basic_generatedName(t *testing.T) {
 		CheckDestroy:             testAccCheckBucketDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccBucketConfig_generatedName,
+				Config: testAccBucketConfig_nameGenerated,
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketExists(ctx, resourceName),
+					acctest.CheckResourceAttrNameGenerated(resourceName, "bucket"),
+					resource.TestCheckResourceAttr(resourceName, "bucket_prefix", id.UniqueIdPrefix),
 				),
 			},
 			{
 				ResourceName:            resourceName,
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"force_destroy", "bucket_prefix"},
+				ImportStateVerifyIgnore: []string{"force_destroy"},
 			},
 		},
 	})
@@ -148,17 +156,18 @@ func TestAccS3Bucket_Basic_namePrefix(t *testing.T) {
 		CheckDestroy:             testAccCheckBucketDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccBucketConfig_namePrefix,
+				Config: testAccBucketConfig_namePrefix("tf-test-"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketExists(ctx, resourceName),
-					resource.TestMatchResourceAttr(resourceName, "bucket", regexp.MustCompile("^tf-test-")),
+					acctest.CheckResourceAttrNameFromPrefix(resourceName, "bucket", "tf-test-"),
+					resource.TestCheckResourceAttr(resourceName, "bucket_prefix", "tf-test-"),
 				),
 			},
 			{
 				ResourceName:            resourceName,
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"force_destroy", "bucket_prefix"},
+				ImportStateVerifyIgnore: []string{"force_destroy"},
 			},
 		},
 	})
@@ -292,7 +301,7 @@ func TestAccS3Bucket_Basic_keyEnabled(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "server_side_encryption_configuration.0.rule.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "server_side_encryption_configuration.0.rule.0.apply_server_side_encryption_by_default.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "server_side_encryption_configuration.0.rule.0.apply_server_side_encryption_by_default.0.sse_algorithm", "aws:kms"),
-					resource.TestMatchResourceAttr(resourceName, "server_side_encryption_configuration.0.rule.0.apply_server_side_encryption_by_default.0.kms_master_key_id", regexp.MustCompile("^arn")),
+					resource.TestMatchResourceAttr(resourceName, "server_side_encryption_configuration.0.rule.0.apply_server_side_encryption_by_default.0.kms_master_key_id", regexache.MustCompile("^arn")),
 					resource.TestCheckResourceAttr(resourceName, "server_side_encryption_configuration.0.rule.0.bucket_key_enabled", "true"),
 				),
 			},
@@ -382,7 +391,7 @@ func TestAccS3Bucket_Duplicate_basic(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccBucketConfig_duplicate(region, bucketName),
-				ExpectError: regexp.MustCompile(s3.ErrCodeBucketAlreadyOwnedByYou),
+				ExpectError: regexache.MustCompile(s3.ErrCodeBucketAlreadyOwnedByYou),
 			},
 		},
 	})
@@ -402,7 +411,7 @@ func TestAccS3Bucket_Duplicate_UsEast1(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccBucketConfig_duplicate(endpoints.UsEast1RegionID, bucketName),
-				ExpectError: regexp.MustCompile(tfs3.ErrMessageBucketAlreadyExists),
+				ExpectError: regexache.MustCompile(tfs3.ErrMessageBucketAlreadyExists),
 			},
 		},
 	})
@@ -423,7 +432,7 @@ func TestAccS3Bucket_Duplicate_UsEast1AltAccount(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccBucketConfig_duplicateAltAccount(endpoints.UsEast1RegionID, bucketName),
-				ExpectError: regexp.MustCompile(s3.ErrCodeBucketAlreadyExists),
+				ExpectError: regexache.MustCompile(s3.ErrCodeBucketAlreadyExists),
 			},
 		},
 	})
@@ -1557,7 +1566,7 @@ func TestAccS3Bucket_Replication_expectVersioningValidationError(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccBucketConfig_replicationNoVersioning(bucketName),
-				ExpectError: regexp.MustCompile(`versioning must be enabled to allow S3 bucket replication`),
+				ExpectError: regexache.MustCompile(`versioning must be enabled to allow S3 bucket replication`),
 			},
 		},
 	})
@@ -2027,7 +2036,7 @@ func TestAccS3Bucket_Security_enableDefaultEncryptionWhenTypical(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "server_side_encryption_configuration.0.rule.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "server_side_encryption_configuration.0.rule.0.apply_server_side_encryption_by_default.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "server_side_encryption_configuration.0.rule.0.apply_server_side_encryption_by_default.0.sse_algorithm", s3.ServerSideEncryptionAwsKms),
-					resource.TestMatchResourceAttr(resourceName, "server_side_encryption_configuration.0.rule.0.apply_server_side_encryption_by_default.0.kms_master_key_id", regexp.MustCompile("^arn")),
+					resource.TestMatchResourceAttr(resourceName, "server_side_encryption_configuration.0.rule.0.apply_server_side_encryption_by_default.0.kms_master_key_id", regexache.MustCompile("^arn")),
 				),
 			},
 			{
@@ -2547,7 +2556,7 @@ func testAccCheckBucketDestroy(ctx context.Context) resource.TestCheckFunc {
 
 func testAccCheckBucketDestroyWithProvider(ctx context.Context) acctest.TestCheckWithProviderFunc {
 	return func(s *terraform.State, provider *schema.Provider) error {
-		conn := provider.Meta().(*conns.AWSClient).S3Conn(ctx)
+		conn := provider.Meta().(*conns.AWSClient).S3Client(ctx)
 
 		for _, rs := range s.RootModule().Resources {
 			if rs.Type != "aws_s3_bucket" {
@@ -2586,7 +2595,7 @@ func testAccCheckBucketExistsWithProvider(ctx context.Context, n string, provide
 			return fmt.Errorf("No S3 Bucket ID is set")
 		}
 
-		conn := providerF().Meta().(*conns.AWSClient).S3Conn(ctx)
+		conn := providerF().Meta().(*conns.AWSClient).S3Client(ctx)
 
 		return tfs3.FindBucket(ctx, conn, rs.Primary.ID)
 	}
@@ -2595,12 +2604,12 @@ func testAccCheckBucketExistsWithProvider(ctx context.Context, n string, provide
 func testAccCheckBucketAddObjects(ctx context.Context, n string, keys ...string) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		rs := s.RootModule().Resources[n]
-		conn := acctest.Provider.Meta().(*conns.AWSClient).S3ConnURICleaningDisabled(ctx)
+		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Client(ctx)
 
 		for _, key := range keys {
-			_, err := conn.PutObjectWithContext(ctx, &s3.PutObjectInput{
-				Bucket: aws.String(rs.Primary.ID),
-				Key:    aws.String(key),
+			_, err := conn.PutObject(ctx, &s3_sdkv2.PutObjectInput{
+				Bucket: aws_sdkv2.String(rs.Primary.ID),
+				Key:    aws_sdkv2.String(key),
 			})
 
 			if err != nil {
@@ -2633,6 +2642,25 @@ func testAccCheckBucketAddObjectsWithLegalHold(ctx context.Context, n string, ke
 	}
 }
 
+func testAccCheckBucketAddObjectWithMetadata(ctx context.Context, n string, key string, metadata map[string]string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs := s.RootModule().Resources[n]
+		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Conn(ctx)
+
+		_, err := conn.PutObjectWithContext(ctx, &s3.PutObjectInput{
+			Bucket:   aws.String(rs.Primary.ID),
+			Key:      aws.String(key),
+			Metadata: aws.StringMap(metadata),
+		})
+
+		if err != nil {
+			return fmt.Errorf("PutObject error: %s", err)
+		}
+
+		return nil
+	}
+}
+
 // Create an S3 bucket via a CF stack so that it has system tags.
 func testAccCheckBucketCreateViaCloudFormation(ctx context.Context, n string, stackID *string) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
@@ -4340,16 +4368,16 @@ resource "aws_s3_bucket" "test" {
 }
 `
 
-const testAccBucketConfig_namePrefix = `
+func testAccBucketConfig_namePrefix(namePrefix string) string {
+	return fmt.Sprintf(`
 resource "aws_s3_bucket" "test" {
-  bucket_prefix = "tf-test-"
+  bucket_prefix = %[1]q
 }
-`
-
-const testAccBucketConfig_generatedName = `
-resource "aws_s3_bucket" "test" {
-  bucket_prefix = "tf-test-"
+`, namePrefix)
 }
+
+const testAccBucketConfig_nameGenerated = `
+resource "aws_s3_bucket" "test" {}
 `
 
 func testAccBucketConfig_duplicate(region, bucketName string) string {
diff --git a/internal/service/s3/bucket_versioning.go b/internal/service/s3/bucket_versioning.go
index 225c4935c64..a3830914332 100644
--- a/internal/service/s3/bucket_versioning.go
+++ b/internal/service/s3/bucket_versioning.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3
 
 import (
@@ -6,14 +9,18 @@ import (
 	"log"
 	"time"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/s3"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/s3"
+	"github.com/aws/aws-sdk-go-v2/service/s3/types"
+	"github.com/hashicorp/aws-sdk-go-base/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/customdiff"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/enum"
+	tfslices "github.com/hashicorp/terraform-provider-aws/internal/slices"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
 )
@@ -25,6 +32,7 @@ func ResourceBucketVersioning() *schema.Resource {
 		ReadWithoutTimeout:   resourceBucketVersioningRead,
 		UpdateWithoutTimeout: resourceBucketVersioningUpdate,
 		DeleteWithoutTimeout: resourceBucketVersioningDelete,
+
 		Importer: &schema.ResourceImporter{
 			StateContext: schema.ImportStatePassthroughContext,
 		},
@@ -53,15 +61,15 @@ func ResourceBucketVersioning() *schema.Resource {
 				Elem: &schema.Resource{
 					Schema: map[string]*schema.Schema{
 						"mfa_delete": {
-							Type:         schema.TypeString,
-							Optional:     true,
-							Computed:     true,
-							ValidateFunc: validation.StringInSlice(s3.MFADelete_Values(), false),
+							Type:             schema.TypeString,
+							Optional:         true,
+							Computed:         true,
+							ValidateDiagFunc: enum.Validate[types.MFADelete](),
 						},
 						"status": {
 							Type:         schema.TypeString,
 							Required:     true,
-							ValidateFunc: validation.StringInSlice(BucketVersioningStatus_Values(), false),
+							ValidateFunc: validation.StringInSlice(bucketVersioningStatus_Values(), false),
 						},
 					},
 				},
@@ -80,7 +88,7 @@ func ResourceBucketVersioning() *schema.Resource {
 				oldStatusRaw, newStatusRaw := diff.GetChange("versioning_configuration.0.status")
 				oldStatus, newStatus := oldStatusRaw.(string), newStatusRaw.(string)
 
-				if newStatus == BucketVersioningStatusDisabled && (oldStatus == s3.BucketVersioningStatusEnabled || oldStatus == s3.BucketVersioningStatusSuspended) {
+				if newStatus == BucketVersioningStatusDisabled && (oldStatus == string(types.BucketVersioningStatusEnabled) || oldStatus == string(types.BucketVersioningStatusSuspended)) {
 					return fmt.Errorf("versioning_configuration.status cannot be updated from '%s' to '%s'", oldStatus, newStatus)
 				}
 
@@ -91,7 +99,7 @@ func ResourceBucketVersioning() *schema.Resource {
 }
 
 func resourceBucketVersioningCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).S3Conn(ctx)
+	conn := meta.(*conns.AWSClient).S3Client(ctx)
 
 	bucket := d.Get("bucket").(string)
 	expectedBucketOwner := d.Get("expected_bucket_owner").(string)
@@ -102,12 +110,11 @@ func resourceBucketVersioningCreate(ctx context.Context, d *schema.ResourceData,
 	// versioning resources that represent unversioned S3 buckets as was previously
 	// supported within the aws_s3_bucket resource of the 3.x version of the provider.
 	// Thus, we essentially bring existing bucket versioning into adoption.
-	if aws.StringValue(versioningConfiguration.Status) != BucketVersioningStatusDisabled {
+	if string(versioningConfiguration.Status) != BucketVersioningStatusDisabled {
 		input := &s3.PutBucketVersioningInput{
 			Bucket:                  aws.String(bucket),
 			VersioningConfiguration: versioningConfiguration,
 		}
-
 		if expectedBucketOwner != "" {
 			input.ExpectedBucketOwner = aws.String(expectedBucketOwner)
 		}
@@ -116,12 +123,12 @@ func resourceBucketVersioningCreate(ctx context.Context, d *schema.ResourceData,
 			input.MFA = aws.String(v.(string))
 		}
 
-		_, err := tfresource.RetryWhenAWSErrCodeEquals(ctx, 2*time.Minute, func() (interface{}, error) {
-			return conn.PutBucketVersioningWithContext(ctx, input)
-		}, s3.ErrCodeNoSuchBucket)
+		_, err := tfresource.RetryWhenAWSErrCodeEquals(ctx, s3BucketPropagationTimeout, func() (interface{}, error) {
+			return conn.PutBucketVersioning(ctx, input)
+		}, errCodeNoSuchBucket)
 
 		if err != nil {
-			return diag.Errorf("creating S3 bucket versioning for %s: %s", bucket, err)
+			return diag.Errorf("creating S3 Bucket (%s) Versioning: %s", bucket, err)
 		}
 	} else {
 		log.Printf("[DEBUG] Creating S3 bucket versioning for unversioned bucket: %s", bucket)
@@ -129,21 +136,21 @@ func resourceBucketVersioningCreate(ctx context.Context, d *schema.ResourceData,
 
 	d.SetId(CreateResourceID(bucket, expectedBucketOwner))
 
+	// Waiting for the versioning configuration to appear is done in resource Read.
+
 	return resourceBucketVersioningRead(ctx, d, meta)
 }
 
 func resourceBucketVersioningRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).S3Conn(ctx)
+	conn := meta.(*conns.AWSClient).S3Client(ctx)
 
 	bucket, expectedBucketOwner, err := ParseResourceID(d.Id())
-
 	if err != nil {
 		return diag.FromErr(err)
 	}
 
-	var output *s3.GetBucketVersioningOutput
+	output, err := waitForBucketVersioningStatus(ctx, conn, bucket, expectedBucketOwner)
 
-	output, err = waitForBucketVersioningStatus(ctx, conn, bucket, expectedBucketOwner)
 	if !d.IsNewResource() && tfresource.NotFound(err) {
 		log.Printf("[WARN] S3 Bucket Versioning (%s) not found, removing from state", d.Id())
 		d.SetId("")
@@ -151,7 +158,7 @@ func resourceBucketVersioningRead(ctx context.Context, d *schema.ResourceData, m
 	}
 
 	if err != nil {
-		return diag.Errorf("getting S3 bucket versioning (%s): %s", d.Id(), err)
+		return diag.Errorf("reading S3 Bucket Versioning (%s): %s", d.Id(), err)
 	}
 
 	d.Set("bucket", bucket)
@@ -164,7 +171,7 @@ func resourceBucketVersioningRead(ctx context.Context, d *schema.ResourceData, m
 }
 
 func resourceBucketVersioningUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).S3Conn(ctx)
+	conn := meta.(*conns.AWSClient).S3Client(ctx)
 
 	bucket, expectedBucketOwner, err := ParseResourceID(d.Id())
 	if err != nil {
@@ -175,7 +182,6 @@ func resourceBucketVersioningUpdate(ctx context.Context, d *schema.ResourceData,
 		Bucket:                  aws.String(bucket),
 		VersioningConfiguration: expandBucketVersioningConfiguration(d.Get("versioning_configuration").([]interface{})),
 	}
-
 	if expectedBucketOwner != "" {
 		input.ExpectedBucketOwner = aws.String(expectedBucketOwner)
 	}
@@ -184,19 +190,19 @@ func resourceBucketVersioningUpdate(ctx context.Context, d *schema.ResourceData,
 		input.MFA = aws.String(v.(string))
 	}
 
-	_, err = conn.PutBucketVersioningWithContext(ctx, input)
+	_, err = conn.PutBucketVersioning(ctx, input)
 
 	if err != nil {
-		return diag.Errorf("updating S3 bucket versioning (%s): %s", d.Id(), err)
+		return diag.Errorf("updating S3 Bucket Versioning (%s): %s", d.Id(), err)
 	}
 
 	return resourceBucketVersioningRead(ctx, d, meta)
 }
 
 func resourceBucketVersioningDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).S3Conn(ctx)
+	conn := meta.(*conns.AWSClient).S3Client(ctx)
 
-	if v := expandBucketVersioningConfiguration(d.Get("versioning_configuration").([]interface{})); v != nil && aws.StringValue(v.Status) == BucketVersioningStatusDisabled {
+	if v := expandBucketVersioningConfiguration(d.Get("versioning_configuration").([]interface{})); v != nil && string(v.Status) == BucketVersioningStatusDisabled {
 		log.Printf("[DEBUG] Removing S3 bucket versioning for unversioned bucket (%s) from state", d.Id())
 		return nil
 	}
@@ -208,20 +214,19 @@ func resourceBucketVersioningDelete(ctx context.Context, d *schema.ResourceData,
 
 	input := &s3.PutBucketVersioningInput{
 		Bucket: aws.String(bucket),
-		VersioningConfiguration: &s3.VersioningConfiguration{
+		VersioningConfiguration: &types.VersioningConfiguration{
 			// Status must be provided thus to "remove" this resource,
 			// we suspend versioning
-			Status: aws.String(s3.BucketVersioningStatusSuspended),
+			Status: types.BucketVersioningStatusSuspended,
 		},
 	}
-
 	if expectedBucketOwner != "" {
 		input.ExpectedBucketOwner = aws.String(expectedBucketOwner)
 	}
 
-	_, err = conn.PutBucketVersioningWithContext(ctx, input)
+	_, err = conn.PutBucketVersioning(ctx, input)
 
-	if tfawserr.ErrCodeEquals(err, s3.ErrCodeNoSuchBucket) {
+	if tfawserr.ErrCodeEquals(err, errCodeNoSuchBucket) {
 		return nil
 	}
 
@@ -231,13 +236,15 @@ func resourceBucketVersioningDelete(ctx context.Context, d *schema.ResourceData,
 	}
 
 	if err != nil {
-		return diag.Errorf("deleting S3 bucket versioning (%s): %s", d.Id(), err)
+		return diag.Errorf("deleting S3 Bucket Versioning (%s): %s", d.Id(), err)
 	}
 
+	// Don't wait for the versioning configuration to disappear as it still exists after suspension.
+
 	return nil
 }
 
-func expandBucketVersioningConfiguration(l []interface{}) *s3.VersioningConfiguration {
+func expandBucketVersioningConfiguration(l []interface{}) *types.VersioningConfiguration {
 	if len(l) == 0 || l[0] == nil {
 		return nil
 	}
@@ -247,14 +254,14 @@ func expandBucketVersioningConfiguration(l []interface{}) *s3.VersioningConfigur
 		return nil
 	}
 
-	result := &s3.VersioningConfiguration{}
+	result := &types.VersioningConfiguration{}
 
 	if v, ok := tfMap["mfa_delete"].(string); ok && v != "" {
-		result.MFADelete = aws.String(v)
+		result.MFADelete = types.MFADelete(v)
 	}
 
 	if v, ok := tfMap["status"].(string); ok && v != "" {
-		result.Status = aws.String(v)
+		result.Status = types.BucketVersioningStatus(v)
 	}
 
 	return result
@@ -265,14 +272,12 @@ func flattenBucketVersioningConfiguration(config *s3.GetBucketVersioningOutput)
 		return []interface{}{}
 	}
 
-	m := make(map[string]interface{})
-
-	if config.MFADelete != nil {
-		m["mfa_delete"] = aws.StringValue(config.MFADelete)
+	m := map[string]interface{}{
+		"mfa_delete": config.MFADelete,
 	}
 
-	if config.Status != nil {
-		m["status"] = aws.StringValue(config.Status)
+	if config.Status != "" {
+		m["status"] = config.Status
 	} else {
 		// Bucket Versioning by default is disabled but not set in the config struct's Status field
 		m["status"] = BucketVersioningStatusDisabled
@@ -280,3 +285,79 @@ func flattenBucketVersioningConfiguration(config *s3.GetBucketVersioningOutput)
 
 	return []interface{}{m}
 }
+
+func findBucketVersioning(ctx context.Context, conn *s3.Client, bucket, expectedBucketOwner string) (*s3.GetBucketVersioningOutput, error) {
+	input := &s3.GetBucketVersioningInput{
+		Bucket: aws.String(bucket),
+	}
+	if expectedBucketOwner != "" {
+		input.ExpectedBucketOwner = aws.String(expectedBucketOwner)
+	}
+
+	output, err := conn.GetBucketVersioning(ctx, input)
+
+	if tfawserr.ErrCodeEquals(err, errCodeNoSuchBucket) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	if output == nil {
+		return nil, tfresource.NewEmptyResultError(input)
+	}
+
+	return output, nil
+}
+
+func statusBucketVersioning(ctx context.Context, conn *s3.Client, bucket, expectedBucketOwner string) retry.StateRefreshFunc {
+	return func() (interface{}, string, error) {
+		output, err := findBucketVersioning(ctx, conn, bucket, expectedBucketOwner)
+
+		if tfresource.NotFound(err) {
+			return nil, "", nil
+		}
+
+		if err != nil {
+			return nil, "", err
+		}
+
+		if output.Status == "" {
+			return output, BucketVersioningStatusDisabled, nil
+		}
+
+		return output, string(output.Status), nil
+	}
+}
+
+func waitForBucketVersioningStatus(ctx context.Context, conn *s3.Client, bucket, expectedBucketOwner string) (*s3.GetBucketVersioningOutput, error) {
+	stateConf := &retry.StateChangeConf{
+		Pending:                   []string{""},
+		Target:                    bucketVersioningStatus_Values(),
+		Refresh:                   statusBucketVersioning(ctx, conn, bucket, expectedBucketOwner),
+		Timeout:                   s3BucketPropagationTimeout,
+		ContinuousTargetOccurence: 3,
+		NotFoundChecks:            3,
+		Delay:                     1 * time.Second,
+	}
+
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+
+	if output, ok := outputRaw.(*s3.GetBucketVersioningOutput); ok {
+		return output, err
+	}
+
+	return nil, err
+}
+
+const (
+	BucketVersioningStatusDisabled = "Disabled"
+)
+
+func bucketVersioningStatus_Values() []string {
+	return tfslices.AppendUnique(enum.Values[types.BucketVersioningStatus](), BucketVersioningStatusDisabled)
+}
diff --git a/internal/service/s3/bucket_versioning_test.go b/internal/service/s3/bucket_versioning_test.go
index 2eea3c238ce..27c69c02a13 100644
--- a/internal/service/s3/bucket_versioning_test.go
+++ b/internal/service/s3/bucket_versioning_test.go
@@ -1,20 +1,23 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/s3"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/YakDriver/regexache"
+	"github.com/aws/aws-sdk-go-v2/service/s3/types"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	tfs3 "github.com/hashicorp/terraform-provider-aws/internal/service/s3"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
 func TestAccS3BucketVersioning_basic(t *testing.T) {
@@ -24,17 +27,17 @@ func TestAccS3BucketVersioning_basic(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketVersioningDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccBucketVersioningConfig_basic(rName, s3.BucketVersioningStatusEnabled),
+				Config: testAccBucketVersioningConfig_basic(rName, string(types.BucketVersioningStatusEnabled)),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketVersioningExists(ctx, resourceName),
 					resource.TestCheckResourceAttrPair(resourceName, "bucket", "aws_s3_bucket.test", "id"),
 					resource.TestCheckResourceAttr(resourceName, "versioning_configuration.#", "1"),
-					resource.TestCheckResourceAttr(resourceName, "versioning_configuration.0.status", s3.BucketVersioningStatusEnabled),
+					resource.TestCheckResourceAttr(resourceName, "versioning_configuration.0.status", string(types.BucketVersioningStatusEnabled)),
 				),
 			},
 			{
@@ -53,12 +56,12 @@ func TestAccS3BucketVersioning_disappears(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketVersioningDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccBucketVersioningConfig_basic(rName, s3.BucketVersioningStatusEnabled),
+				Config: testAccBucketVersioningConfig_basic(rName, string(types.BucketVersioningStatusEnabled)),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketVersioningExists(ctx, resourceName),
 					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfs3.ResourceBucketVersioning(), resourceName),
@@ -77,12 +80,12 @@ func TestAccS3BucketVersioning_disappears_bucket(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketVersioningDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccBucketVersioningConfig_basic(rName, s3.BucketVersioningStatusEnabled),
+				Config: testAccBucketVersioningConfig_basic(rName, string(types.BucketVersioningStatusEnabled)),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketVersioningExists(ctx, resourceName),
 					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfs3.ResourceBucket(), bucketResourceName),
@@ -100,21 +103,21 @@ func TestAccS3BucketVersioning_update(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketVersioningDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccBucketVersioningConfig_basic(rName, s3.BucketVersioningStatusEnabled),
+				Config: testAccBucketVersioningConfig_basic(rName, string(types.BucketVersioningStatusEnabled)),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketVersioningExists(ctx, resourceName),
 				),
 			},
 			{
-				Config: testAccBucketVersioningConfig_basic(rName, s3.BucketVersioningStatusSuspended),
+				Config: testAccBucketVersioningConfig_basic(rName, string(types.BucketVersioningStatusSuspended)),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketVersioningExists(ctx, resourceName),
-					resource.TestCheckResourceAttr(resourceName, "versioning_configuration.0.status", s3.BucketVersioningStatusSuspended),
+					resource.TestCheckResourceAttr(resourceName, "versioning_configuration.0.status", string(types.BucketVersioningStatusSuspended)),
 				),
 			},
 			{
@@ -123,10 +126,10 @@ func TestAccS3BucketVersioning_update(t *testing.T) {
 				ImportStateVerify: true,
 			},
 			{
-				Config: testAccBucketVersioningConfig_basic(rName, s3.BucketVersioningStatusEnabled),
+				Config: testAccBucketVersioningConfig_basic(rName, string(types.BucketVersioningStatusEnabled)),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketVersioningExists(ctx, resourceName),
-					resource.TestCheckResourceAttr(resourceName, "versioning_configuration.0.status", s3.BucketVersioningStatusEnabled),
+					resource.TestCheckResourceAttr(resourceName, "versioning_configuration.0.status", string(types.BucketVersioningStatusEnabled)),
 				),
 			},
 		},
@@ -142,17 +145,17 @@ func TestAccS3BucketVersioning_MFADelete(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketVersioningDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccBucketVersioningConfig_mfaDelete(rName, s3.MFADeleteDisabled),
+				Config: testAccBucketVersioningConfig_mfaDelete(rName, string(types.MFADeleteDisabled)),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketVersioningExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "versioning_configuration.#", "1"),
-					resource.TestCheckResourceAttr(resourceName, "versioning_configuration.0.mfa_delete", s3.MFADeleteDisabled),
-					resource.TestCheckResourceAttr(resourceName, "versioning_configuration.0.status", s3.BucketVersioningStatusEnabled),
+					resource.TestCheckResourceAttr(resourceName, "versioning_configuration.0.mfa_delete", string(types.MFADeleteDisabled)),
+					resource.TestCheckResourceAttr(resourceName, "versioning_configuration.0.status", string(types.BucketVersioningStatusEnabled)),
 				),
 			},
 			{
@@ -172,7 +175,7 @@ func TestAccS3BucketVersioning_migrate_versioningDisabledNoChange(t *testing.T)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -204,7 +207,7 @@ func TestAccS3BucketVersioning_migrate_versioningDisabledWithChange(t *testing.T
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -217,11 +220,11 @@ func TestAccS3BucketVersioning_migrate_versioningDisabledWithChange(t *testing.T
 				),
 			},
 			{
-				Config: testAccBucketVersioningConfig_migrateEnabled(bucketName, s3.BucketVersioningStatusEnabled),
+				Config: testAccBucketVersioningConfig_migrateEnabled(bucketName, string(types.BucketVersioningStatusEnabled)),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketVersioningExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "versioning_configuration.#", "1"),
-					resource.TestCheckResourceAttr(resourceName, "versioning_configuration.0.status", s3.BucketVersioningStatusEnabled),
+					resource.TestCheckResourceAttr(resourceName, "versioning_configuration.0.status", string(types.BucketVersioningStatusEnabled)),
 				),
 			},
 		},
@@ -236,7 +239,7 @@ func TestAccS3BucketVersioning_migrate_versioningEnabledNoChange(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -249,11 +252,11 @@ func TestAccS3BucketVersioning_migrate_versioningEnabledNoChange(t *testing.T) {
 				),
 			},
 			{
-				Config: testAccBucketVersioningConfig_migrateEnabled(bucketName, s3.BucketVersioningStatusEnabled),
+				Config: testAccBucketVersioningConfig_migrateEnabled(bucketName, string(types.BucketVersioningStatusEnabled)),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketVersioningExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "versioning_configuration.#", "1"),
-					resource.TestCheckResourceAttr(resourceName, "versioning_configuration.0.status", s3.BucketVersioningStatusEnabled),
+					resource.TestCheckResourceAttr(resourceName, "versioning_configuration.0.status", string(types.BucketVersioningStatusEnabled)),
 				),
 			},
 		},
@@ -268,7 +271,7 @@ func TestAccS3BucketVersioning_migrate_versioningEnabledWithChange(t *testing.T)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -281,11 +284,11 @@ func TestAccS3BucketVersioning_migrate_versioningEnabledWithChange(t *testing.T)
 				),
 			},
 			{
-				Config: testAccBucketVersioningConfig_migrateEnabled(bucketName, s3.BucketVersioningStatusSuspended),
+				Config: testAccBucketVersioningConfig_migrateEnabled(bucketName, string(types.BucketVersioningStatusSuspended)),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketVersioningExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "versioning_configuration.#", "1"),
-					resource.TestCheckResourceAttr(resourceName, "versioning_configuration.0.status", s3.BucketVersioningStatusSuspended),
+					resource.TestCheckResourceAttr(resourceName, "versioning_configuration.0.status", string(types.BucketVersioningStatusSuspended)),
 				),
 			},
 		},
@@ -302,7 +305,7 @@ func TestAccS3BucketVersioning_migrate_mfaDeleteNoChange(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -315,11 +318,11 @@ func TestAccS3BucketVersioning_migrate_mfaDeleteNoChange(t *testing.T) {
 				),
 			},
 			{
-				Config: testAccBucketVersioningConfig_migrateMFADelete(bucketName, s3.MFADeleteDisabled),
+				Config: testAccBucketVersioningConfig_migrateMFADelete(bucketName, string(types.MFADeleteDisabled)),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketVersioningExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "versioning_configuration.#", "1"),
-					resource.TestCheckResourceAttr(resourceName, "versioning_configuration.0.mfa_delete", s3.MFADeleteDisabled),
+					resource.TestCheckResourceAttr(resourceName, "versioning_configuration.0.mfa_delete", string(types.MFADeleteDisabled)),
 				),
 			},
 		},
@@ -333,7 +336,7 @@ func TestAccS3BucketVersioning_Status_disabled(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketVersioningDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -361,7 +364,7 @@ func TestAccS3BucketVersioning_Status_disabledToEnabled(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketVersioningDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -374,11 +377,11 @@ func TestAccS3BucketVersioning_Status_disabledToEnabled(t *testing.T) {
 				),
 			},
 			{
-				Config: testAccBucketVersioningConfig_basic(rName, s3.BucketVersioningStatusEnabled),
+				Config: testAccBucketVersioningConfig_basic(rName, string(types.BucketVersioningStatusEnabled)),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketVersioningExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "versioning_configuration.#", "1"),
-					resource.TestCheckResourceAttr(resourceName, "versioning_configuration.0.status", s3.BucketVersioningStatusEnabled),
+					resource.TestCheckResourceAttr(resourceName, "versioning_configuration.0.status", string(types.BucketVersioningStatusEnabled)),
 				),
 			},
 			{
@@ -397,7 +400,7 @@ func TestAccS3BucketVersioning_Status_disabledToSuspended(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketVersioningDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -410,11 +413,11 @@ func TestAccS3BucketVersioning_Status_disabledToSuspended(t *testing.T) {
 				),
 			},
 			{
-				Config: testAccBucketVersioningConfig_basic(rName, s3.BucketVersioningStatusSuspended),
+				Config: testAccBucketVersioningConfig_basic(rName, string(types.BucketVersioningStatusSuspended)),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketVersioningExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "versioning_configuration.#", "1"),
-					resource.TestCheckResourceAttr(resourceName, "versioning_configuration.0.status", s3.BucketVersioningStatusSuspended),
+					resource.TestCheckResourceAttr(resourceName, "versioning_configuration.0.status", string(types.BucketVersioningStatusSuspended)),
 				),
 			},
 			{
@@ -433,21 +436,21 @@ func TestAccS3BucketVersioning_Status_enabledToDisabled(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketVersioningDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccBucketVersioningConfig_basic(rName, s3.BucketVersioningStatusEnabled),
+				Config: testAccBucketVersioningConfig_basic(rName, string(types.BucketVersioningStatusEnabled)),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketVersioningExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "versioning_configuration.#", "1"),
-					resource.TestCheckResourceAttr(resourceName, "versioning_configuration.0.status", s3.BucketVersioningStatusEnabled),
+					resource.TestCheckResourceAttr(resourceName, "versioning_configuration.0.status", string(types.BucketVersioningStatusEnabled)),
 				),
 			},
 			{
 				Config:      testAccBucketVersioningConfig_basic(rName, tfs3.BucketVersioningStatusDisabled),
-				ExpectError: regexp.MustCompile(`versioning_configuration.status cannot be updated from 'Enabled' to 'Disabled'`),
+				ExpectError: regexache.MustCompile(`versioning_configuration.status cannot be updated from 'Enabled' to 'Disabled'`),
 			},
 		},
 	})
@@ -460,21 +463,21 @@ func TestAccS3BucketVersioning_Status_suspendedToDisabled(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketVersioningDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccBucketVersioningConfig_basic(rName, s3.BucketVersioningStatusSuspended),
+				Config: testAccBucketVersioningConfig_basic(rName, string(types.BucketVersioningStatusSuspended)),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketVersioningExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "versioning_configuration.#", "1"),
-					resource.TestCheckResourceAttr(resourceName, "versioning_configuration.0.status", s3.BucketVersioningStatusSuspended),
+					resource.TestCheckResourceAttr(resourceName, "versioning_configuration.0.status", string(types.BucketVersioningStatusSuspended)),
 				),
 			},
 			{
 				Config:      testAccBucketVersioningConfig_basic(rName, tfs3.BucketVersioningStatusDisabled),
-				ExpectError: regexp.MustCompile(`versioning_configuration.status cannot be updated from 'Suspended' to 'Disabled'`),
+				ExpectError: regexache.MustCompile(`versioning_configuration.status cannot be updated from 'Suspended' to 'Disabled'`),
 			},
 		},
 	})
@@ -482,64 +485,52 @@ func TestAccS3BucketVersioning_Status_suspendedToDisabled(t *testing.T) {
 
 func testAccCheckBucketVersioningDestroy(ctx context.Context) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Conn(ctx)
+		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Client(ctx)
 
 		for _, rs := range s.RootModule().Resources {
 			if rs.Type != "aws_s3_bucket_versioning" {
 				continue
 			}
 
-			input := &s3.GetBucketVersioningInput{
-				Bucket: aws.String(rs.Primary.ID),
+			bucket, expectedBucketOwner, err := tfs3.ParseResourceID(rs.Primary.ID)
+			if err != nil {
+				return err
 			}
 
-			output, err := conn.GetBucketVersioningWithContext(ctx, input)
+			_, err = tfs3.FindBucketVersioning(ctx, conn, bucket, expectedBucketOwner)
 
-			if tfawserr.ErrCodeEquals(err, s3.ErrCodeNoSuchBucket) {
+			if tfresource.NotFound(err) {
 				continue
 			}
 
 			if err != nil {
-				return fmt.Errorf("error getting S3 bucket versioning (%s): %w", rs.Primary.ID, err)
+				return err
 			}
 
-			if output != nil && aws.StringValue(output.Status) == s3.ReplicationRuleStatusEnabled {
-				return fmt.Errorf("S3 bucket versioning (%s) still exists", rs.Primary.ID)
-			}
+			return fmt.Errorf("S3 Bucket Versioning %s still exists", rs.Primary.ID)
 		}
 
 		return nil
 	}
 }
 
-func testAccCheckBucketVersioningExists(ctx context.Context, resourceName string) resource.TestCheckFunc {
+func testAccCheckBucketVersioningExists(ctx context.Context, n string) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		rs, ok := s.RootModule().Resources[resourceName]
+		rs, ok := s.RootModule().Resources[n]
 		if !ok {
-			return fmt.Errorf("Not found: %s", resourceName)
-		}
-
-		if rs.Primary.ID == "" {
-			return fmt.Errorf("Resource (%s) ID not set", resourceName)
-		}
-
-		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Conn(ctx)
-
-		input := &s3.GetBucketVersioningInput{
-			Bucket: aws.String(rs.Primary.ID),
+			return fmt.Errorf("Not found: %s", n)
 		}
 
-		output, err := conn.GetBucketVersioningWithContext(ctx, input)
-
+		bucket, expectedBucketOwner, err := tfs3.ParseResourceID(rs.Primary.ID)
 		if err != nil {
-			return fmt.Errorf("error getting S3 bucket versioning (%s): %w", rs.Primary.ID, err)
+			return err
 		}
 
-		if output == nil {
-			return fmt.Errorf("S3 Bucket versioning (%s) not found", rs.Primary.ID)
-		}
+		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Client(ctx)
 
-		return nil
+		_, err = tfs3.FindBucketVersioning(ctx, conn, bucket, expectedBucketOwner)
+
+		return err
 	}
 }
 
diff --git a/internal/service/s3/bucket_website_configuration.go b/internal/service/s3/bucket_website_configuration.go
index 965e5571bb9..48e80a6b57c 100644
--- a/internal/service/s3/bucket_website_configuration.go
+++ b/internal/service/s3/bucket_website_configuration.go
@@ -1,20 +1,24 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3
 
 import (
 	"context"
 	"encoding/json"
-	"fmt"
 	"log"
-	"time"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/s3"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/s3"
+	"github.com/aws/aws-sdk-go-v2/service/s3/types"
+	"github.com/hashicorp/aws-sdk-go-base/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/structure"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/enum"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
 )
@@ -26,6 +30,7 @@ func ResourceBucketWebsiteConfiguration() *schema.Resource {
 		ReadWithoutTimeout:   resourceBucketWebsiteConfigurationRead,
 		UpdateWithoutTimeout: resourceBucketWebsiteConfigurationUpdate,
 		DeleteWithoutTimeout: resourceBucketWebsiteConfigurationDelete,
+
 		Importer: &schema.ResourceImporter{
 			StateContext: schema.ImportStatePassthroughContext,
 		},
@@ -86,9 +91,9 @@ func ResourceBucketWebsiteConfiguration() *schema.Resource {
 							Required: true,
 						},
 						"protocol": {
-							Type:         schema.TypeString,
-							Optional:     true,
-							ValidateFunc: validation.StringInSlice(s3.Protocol_Values(), false),
+							Type:             schema.TypeString,
+							Optional:         true,
+							ValidateDiagFunc: enum.Validate[types.Protocol](),
 						},
 					},
 				},
@@ -132,9 +137,9 @@ func ResourceBucketWebsiteConfiguration() *schema.Resource {
 										Optional: true,
 									},
 									"protocol": {
-										Type:         schema.TypeString,
-										Optional:     true,
-										ValidateFunc: validation.StringInSlice(s3.Protocol_Values(), false),
+										Type:             schema.TypeString,
+										Optional:         true,
+										ValidateDiagFunc: enum.Validate[types.Protocol](),
 									},
 									"replace_key_prefix_with": {
 										Type:     schema.TypeString,
@@ -161,11 +166,11 @@ func ResourceBucketWebsiteConfiguration() *schema.Resource {
 					return json
 				},
 			},
-			"website_endpoint": {
+			"website_domain": {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
-			"website_domain": {
+			"website_endpoint": {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
@@ -174,12 +179,9 @@ func ResourceBucketWebsiteConfiguration() *schema.Resource {
 }
 
 func resourceBucketWebsiteConfigurationCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).S3Conn(ctx)
-
-	bucket := d.Get("bucket").(string)
-	expectedBucketOwner := d.Get("expected_bucket_owner").(string)
+	conn := meta.(*conns.AWSClient).S3Client(ctx)
 
-	websiteConfig := &s3.WebsiteConfiguration{}
+	websiteConfig := &types.WebsiteConfiguration{}
 
 	if v, ok := d.GetOk("error_document"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
 		websiteConfig.ErrorDocument = expandBucketWebsiteConfigurationErrorDocument(v.([]interface{}))
@@ -198,120 +200,108 @@ func resourceBucketWebsiteConfigurationCreate(ctx context.Context, d *schema.Res
 	}
 
 	if v, ok := d.GetOk("routing_rules"); ok {
-		var unmarshalledRules []*s3.RoutingRule
+		var unmarshalledRules []types.RoutingRule
 		if err := json.Unmarshal([]byte(v.(string)), &unmarshalledRules); err != nil {
-			return diag.Errorf("creating S3 Bucket (%s) website configuration: %s", bucket, err)
+			return diag.FromErr(err)
 		}
 		websiteConfig.RoutingRules = unmarshalledRules
 	}
 
+	bucket := d.Get("bucket").(string)
+	expectedBucketOwner := d.Get("expected_bucket_owner").(string)
 	input := &s3.PutBucketWebsiteInput{
 		Bucket:               aws.String(bucket),
 		WebsiteConfiguration: websiteConfig,
 	}
-
 	if expectedBucketOwner != "" {
 		input.ExpectedBucketOwner = aws.String(expectedBucketOwner)
 	}
 
-	_, err := tfresource.RetryWhenAWSErrCodeEquals(ctx, 2*time.Minute, func() (interface{}, error) {
-		return conn.PutBucketWebsiteWithContext(ctx, input)
-	}, s3.ErrCodeNoSuchBucket)
+	_, err := tfresource.RetryWhenAWSErrCodeEquals(ctx, s3BucketPropagationTimeout, func() (interface{}, error) {
+		return conn.PutBucketWebsite(ctx, input)
+	}, errCodeNoSuchBucket)
 
 	if err != nil {
-		return diag.Errorf("creating S3 bucket (%s) website configuration: %s", bucket, err)
+		return diag.Errorf("creating S3 Bucket (%s) Website Configuration: %s", bucket, err)
 	}
 
 	d.SetId(CreateResourceID(bucket, expectedBucketOwner))
 
+	_, err = tfresource.RetryWhenNotFound(ctx, s3BucketPropagationTimeout, func() (interface{}, error) {
+		return findBucketWebsite(ctx, conn, bucket, expectedBucketOwner)
+	})
+
+	if err != nil {
+		return diag.Errorf("waiting for S3 Bucket Accelerate Configuration (%s) create: %s", d.Id(), err)
+	}
+
 	return resourceBucketWebsiteConfigurationRead(ctx, d, meta)
 }
 
 func resourceBucketWebsiteConfigurationRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).S3Conn(ctx)
+	conn := meta.(*conns.AWSClient).S3Client(ctx)
 
 	bucket, expectedBucketOwner, err := ParseResourceID(d.Id())
 	if err != nil {
 		return diag.FromErr(err)
 	}
 
-	input := &s3.GetBucketWebsiteInput{
-		Bucket: aws.String(bucket),
-	}
-
-	if expectedBucketOwner != "" {
-		input.ExpectedBucketOwner = aws.String(expectedBucketOwner)
-	}
+	output, err := findBucketWebsite(ctx, conn, bucket, expectedBucketOwner)
 
-	output, err := conn.GetBucketWebsiteWithContext(ctx, input)
-
-	if !d.IsNewResource() && tfawserr.ErrCodeEquals(err, s3.ErrCodeNoSuchBucket, ErrCodeNoSuchWebsiteConfiguration) {
+	if !d.IsNewResource() && tfresource.NotFound(err) {
 		log.Printf("[WARN] S3 Bucket Website Configuration (%s) not found, removing from state", d.Id())
 		d.SetId("")
 		return nil
 	}
 
-	if output == nil {
-		if d.IsNewResource() {
-			return diag.Errorf("reading S3 bucket website configuration (%s): empty output", d.Id())
-		}
-		log.Printf("[WARN] S3 Bucket Website Configuration (%s) not found, removing from state", d.Id())
-		d.SetId("")
-		return nil
+	if err != nil {
+		return diag.Errorf("reading S3 Bucket Website Configuration (%s): %s", d.Id(), err)
 	}
 
 	d.Set("bucket", bucket)
-	d.Set("expected_bucket_owner", expectedBucketOwner)
-
 	if err := d.Set("error_document", flattenBucketWebsiteConfigurationErrorDocument(output.ErrorDocument)); err != nil {
 		return diag.Errorf("setting error_document: %s", err)
 	}
-
+	d.Set("expected_bucket_owner", expectedBucketOwner)
 	if err := d.Set("index_document", flattenBucketWebsiteConfigurationIndexDocument(output.IndexDocument)); err != nil {
 		return diag.Errorf("setting index_document: %s", err)
 	}
-
 	if err := d.Set("redirect_all_requests_to", flattenBucketWebsiteConfigurationRedirectAllRequestsTo(output.RedirectAllRequestsTo)); err != nil {
 		return diag.Errorf("setting redirect_all_requests_to: %s", err)
 	}
-
 	if err := d.Set("routing_rule", flattenBucketWebsiteConfigurationRoutingRules(output.RoutingRules)); err != nil {
 		return diag.Errorf("setting routing_rule: %s", err)
 	}
-
 	if output.RoutingRules != nil {
-		rr, err := normalizeRoutingRules(output.RoutingRules)
+		rr, err := normalizeRoutingRulesV2(output.RoutingRules)
 		if err != nil {
-			return diag.Errorf("while marshaling routing rules: %s", err)
+			return diag.FromErr(err)
 		}
 		d.Set("routing_rules", rr)
 	} else {
 		d.Set("routing_rules", nil)
 	}
 
-	// Add website_endpoint and website_domain as attributes
-	websiteEndpoint, err := resourceBucketWebsiteConfigurationWebsiteEndpoint(ctx, meta.(*conns.AWSClient), bucket, expectedBucketOwner)
-	if err != nil {
-		return diag.FromErr(err)
-	}
-
-	if websiteEndpoint != nil {
-		d.Set("website_endpoint", websiteEndpoint.Endpoint)
-		d.Set("website_domain", websiteEndpoint.Domain)
+	if output, err := findBucketLocation(ctx, conn, bucket, expectedBucketOwner); err != nil {
+		return diag.Errorf("reading S3 Bucket (%s) Location: %s", d.Id(), err)
+	} else {
+		website := WebsiteEndpoint(meta.(*conns.AWSClient), bucket, string(output.LocationConstraint))
+		d.Set("website_domain", website.Domain)
+		d.Set("website_endpoint", website.Endpoint)
 	}
 
 	return nil
 }
 
 func resourceBucketWebsiteConfigurationUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).S3Conn(ctx)
+	conn := meta.(*conns.AWSClient).S3Client(ctx)
 
 	bucket, expectedBucketOwner, err := ParseResourceID(d.Id())
 	if err != nil {
 		return diag.FromErr(err)
 	}
 
-	websiteConfig := &s3.WebsiteConfiguration{}
+	websiteConfig := &types.WebsiteConfiguration{}
 
 	if v, ok := d.GetOk("error_document"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
 		websiteConfig.ErrorDocument = expandBucketWebsiteConfigurationErrorDocument(v.([]interface{}))
@@ -329,9 +319,9 @@ func resourceBucketWebsiteConfigurationUpdate(ctx context.Context, d *schema.Res
 		if d.HasChange("routing_rule") {
 			websiteConfig.RoutingRules = expandBucketWebsiteConfigurationRoutingRules(d.Get("routing_rule").([]interface{}))
 		} else {
-			var unmarshalledRules []*s3.RoutingRule
+			var unmarshalledRules []types.RoutingRule
 			if err := json.Unmarshal([]byte(d.Get("routing_rules").(string)), &unmarshalledRules); err != nil {
-				return diag.Errorf("updating S3 Bucket (%s) website configuration: %s", bucket, err)
+				return diag.FromErr(err)
 			}
 			websiteConfig.RoutingRules = unmarshalledRules
 		}
@@ -342,9 +332,9 @@ func resourceBucketWebsiteConfigurationUpdate(ctx context.Context, d *schema.Res
 		}
 
 		if v, ok := d.GetOk("routing_rules"); ok {
-			var unmarshalledRules []*s3.RoutingRule
+			var unmarshalledRules []types.RoutingRule
 			if err := json.Unmarshal([]byte(v.(string)), &unmarshalledRules); err != nil {
-				return diag.Errorf("updating S3 Bucket (%s) website configuration: %s", bucket, err)
+				return diag.FromErr(err)
 			}
 			websiteConfig.RoutingRules = unmarshalledRules
 		}
@@ -354,22 +344,21 @@ func resourceBucketWebsiteConfigurationUpdate(ctx context.Context, d *schema.Res
 		Bucket:               aws.String(bucket),
 		WebsiteConfiguration: websiteConfig,
 	}
-
 	if expectedBucketOwner != "" {
 		input.ExpectedBucketOwner = aws.String(expectedBucketOwner)
 	}
 
-	_, err = conn.PutBucketWebsiteWithContext(ctx, input)
+	_, err = conn.PutBucketWebsite(ctx, input)
 
 	if err != nil {
-		return diag.Errorf("updating S3 bucket website configuration (%s): %s", d.Id(), err)
+		return diag.Errorf("updating S3 Bucket Website Configuration (%s): %s", d.Id(), err)
 	}
 
 	return resourceBucketWebsiteConfigurationRead(ctx, d, meta)
 }
 
 func resourceBucketWebsiteConfigurationDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).S3Conn(ctx)
+	conn := meta.(*conns.AWSClient).S3Client(ctx)
 
 	bucket, expectedBucketOwner, err := ParseResourceID(d.Id())
 	if err != nil {
@@ -379,49 +368,32 @@ func resourceBucketWebsiteConfigurationDelete(ctx context.Context, d *schema.Res
 	input := &s3.DeleteBucketWebsiteInput{
 		Bucket: aws.String(bucket),
 	}
-
 	if expectedBucketOwner != "" {
 		input.ExpectedBucketOwner = aws.String(expectedBucketOwner)
 	}
 
-	_, err = conn.DeleteBucketWebsiteWithContext(ctx, input)
+	_, err = conn.DeleteBucketWebsite(ctx, input)
 
-	if tfawserr.ErrCodeEquals(err, s3.ErrCodeNoSuchBucket, ErrCodeNoSuchWebsiteConfiguration) {
+	if tfawserr.ErrCodeEquals(err, errCodeNoSuchBucket, errCodeNoSuchWebsiteConfiguration) {
 		return nil
 	}
 
 	if err != nil {
-		return diag.Errorf("deleting S3 bucket website configuration (%s): %s", d.Id(), err)
-	}
-
-	return nil
-}
-
-func resourceBucketWebsiteConfigurationWebsiteEndpoint(ctx context.Context, client *conns.AWSClient, bucket, expectedBucketOwner string) (*S3Website, error) {
-	conn := client.S3Conn(ctx)
-
-	input := &s3.GetBucketLocationInput{
-		Bucket: aws.String(bucket),
+		return diag.Errorf("deleting S3 Bucket Website Configuration (%s): %s", d.Id(), err)
 	}
 
-	if expectedBucketOwner != "" {
-		input.ExpectedBucketOwner = aws.String(expectedBucketOwner)
-	}
+	_, err = tfresource.RetryUntilNotFound(ctx, s3BucketPropagationTimeout, func() (interface{}, error) {
+		return findBucketWebsite(ctx, conn, bucket, expectedBucketOwner)
+	})
 
-	output, err := conn.GetBucketLocationWithContext(ctx, input)
 	if err != nil {
-		return nil, fmt.Errorf("getting S3 Bucket (%s) Location: %w", bucket, err)
-	}
-
-	var region string
-	if output.LocationConstraint != nil {
-		region = aws.StringValue(output.LocationConstraint)
+		return diag.Errorf("waiting for S3 Bucket Accelerate Configuration (%s) delete: %s", d.Id(), err)
 	}
 
-	return WebsiteEndpoint(client, bucket, region), nil
+	return nil
 }
 
-func expandBucketWebsiteConfigurationErrorDocument(l []interface{}) *s3.ErrorDocument {
+func expandBucketWebsiteConfigurationErrorDocument(l []interface{}) *types.ErrorDocument {
 	if len(l) == 0 || l[0] == nil {
 		return nil
 	}
@@ -431,7 +403,7 @@ func expandBucketWebsiteConfigurationErrorDocument(l []interface{}) *s3.ErrorDoc
 		return nil
 	}
 
-	result := &s3.ErrorDocument{}
+	result := &types.ErrorDocument{}
 
 	if v, ok := tfMap["key"].(string); ok && v != "" {
 		result.Key = aws.String(v)
@@ -440,7 +412,7 @@ func expandBucketWebsiteConfigurationErrorDocument(l []interface{}) *s3.ErrorDoc
 	return result
 }
 
-func expandBucketWebsiteConfigurationIndexDocument(l []interface{}) *s3.IndexDocument {
+func expandBucketWebsiteConfigurationIndexDocument(l []interface{}) *types.IndexDocument {
 	if len(l) == 0 || l[0] == nil {
 		return nil
 	}
@@ -450,7 +422,7 @@ func expandBucketWebsiteConfigurationIndexDocument(l []interface{}) *s3.IndexDoc
 		return nil
 	}
 
-	result := &s3.IndexDocument{}
+	result := &types.IndexDocument{}
 
 	if v, ok := tfMap["suffix"].(string); ok && v != "" {
 		result.Suffix = aws.String(v)
@@ -459,7 +431,7 @@ func expandBucketWebsiteConfigurationIndexDocument(l []interface{}) *s3.IndexDoc
 	return result
 }
 
-func expandBucketWebsiteConfigurationRedirectAllRequestsTo(l []interface{}) *s3.RedirectAllRequestsTo {
+func expandBucketWebsiteConfigurationRedirectAllRequestsTo(l []interface{}) *types.RedirectAllRequestsTo {
 	if len(l) == 0 || l[0] == nil {
 		return nil
 	}
@@ -469,21 +441,21 @@ func expandBucketWebsiteConfigurationRedirectAllRequestsTo(l []interface{}) *s3.
 		return nil
 	}
 
-	result := &s3.RedirectAllRequestsTo{}
+	result := &types.RedirectAllRequestsTo{}
 
 	if v, ok := tfMap["host_name"].(string); ok && v != "" {
 		result.HostName = aws.String(v)
 	}
 
 	if v, ok := tfMap["protocol"].(string); ok && v != "" {
-		result.Protocol = aws.String(v)
+		result.Protocol = types.Protocol(v)
 	}
 
 	return result
 }
 
-func expandBucketWebsiteConfigurationRoutingRules(l []interface{}) []*s3.RoutingRule {
-	var results []*s3.RoutingRule
+func expandBucketWebsiteConfigurationRoutingRules(l []interface{}) []types.RoutingRule {
+	var results []types.RoutingRule
 
 	for _, tfMapRaw := range l {
 		tfMap, ok := tfMapRaw.(map[string]interface{})
@@ -491,7 +463,7 @@ func expandBucketWebsiteConfigurationRoutingRules(l []interface{}) []*s3.Routing
 			continue
 		}
 
-		rule := &s3.RoutingRule{}
+		rule := types.RoutingRule{}
 
 		if v, ok := tfMap["condition"].([]interface{}); ok && len(v) > 0 && v[0] != nil {
 			rule.Condition = expandBucketWebsiteConfigurationRoutingRuleCondition(v)
@@ -507,7 +479,7 @@ func expandBucketWebsiteConfigurationRoutingRules(l []interface{}) []*s3.Routing
 	return results
 }
 
-func expandBucketWebsiteConfigurationRoutingRuleCondition(l []interface{}) *s3.Condition {
+func expandBucketWebsiteConfigurationRoutingRuleCondition(l []interface{}) *types.Condition {
 	if len(l) == 0 || l[0] == nil {
 		return nil
 	}
@@ -517,7 +489,7 @@ func expandBucketWebsiteConfigurationRoutingRuleCondition(l []interface{}) *s3.C
 		return nil
 	}
 
-	result := &s3.Condition{}
+	result := &types.Condition{}
 
 	if v, ok := tfMap["http_error_code_returned_equals"].(string); ok && v != "" {
 		result.HttpErrorCodeReturnedEquals = aws.String(v)
@@ -530,7 +502,7 @@ func expandBucketWebsiteConfigurationRoutingRuleCondition(l []interface{}) *s3.C
 	return result
 }
 
-func expandBucketWebsiteConfigurationRoutingRuleRedirect(l []interface{}) *s3.Redirect {
+func expandBucketWebsiteConfigurationRoutingRuleRedirect(l []interface{}) *types.Redirect {
 	if len(l) == 0 || l[0] == nil {
 		return nil
 	}
@@ -540,7 +512,7 @@ func expandBucketWebsiteConfigurationRoutingRuleRedirect(l []interface{}) *s3.Re
 		return nil
 	}
 
-	result := &s3.Redirect{}
+	result := &types.Redirect{}
 
 	if v, ok := tfMap["host_name"].(string); ok && v != "" {
 		result.HostName = aws.String(v)
@@ -551,7 +523,7 @@ func expandBucketWebsiteConfigurationRoutingRuleRedirect(l []interface{}) *s3.Re
 	}
 
 	if v, ok := tfMap["protocol"].(string); ok && v != "" {
-		result.Protocol = aws.String(v)
+		result.Protocol = types.Protocol(v)
 	}
 
 	if v, ok := tfMap["replace_key_prefix_with"].(string); ok && v != "" {
@@ -565,7 +537,7 @@ func expandBucketWebsiteConfigurationRoutingRuleRedirect(l []interface{}) *s3.Re
 	return result
 }
 
-func flattenBucketWebsiteConfigurationIndexDocument(i *s3.IndexDocument) []interface{} {
+func flattenBucketWebsiteConfigurationIndexDocument(i *types.IndexDocument) []interface{} {
 	if i == nil {
 		return []interface{}{}
 	}
@@ -573,13 +545,13 @@ func flattenBucketWebsiteConfigurationIndexDocument(i *s3.IndexDocument) []inter
 	m := make(map[string]interface{})
 
 	if i.Suffix != nil {
-		m["suffix"] = aws.StringValue(i.Suffix)
+		m["suffix"] = aws.ToString(i.Suffix)
 	}
 
 	return []interface{}{m}
 }
 
-func flattenBucketWebsiteConfigurationErrorDocument(e *s3.ErrorDocument) []interface{} {
+func flattenBucketWebsiteConfigurationErrorDocument(e *types.ErrorDocument) []interface{} {
 	if e == nil {
 		return []interface{}{}
 	}
@@ -587,38 +559,32 @@ func flattenBucketWebsiteConfigurationErrorDocument(e *s3.ErrorDocument) []inter
 	m := make(map[string]interface{})
 
 	if e.Key != nil {
-		m["key"] = aws.StringValue(e.Key)
+		m["key"] = aws.ToString(e.Key)
 	}
 
 	return []interface{}{m}
 }
 
-func flattenBucketWebsiteConfigurationRedirectAllRequestsTo(r *s3.RedirectAllRequestsTo) []interface{} {
+func flattenBucketWebsiteConfigurationRedirectAllRequestsTo(r *types.RedirectAllRequestsTo) []interface{} {
 	if r == nil {
 		return []interface{}{}
 	}
 
-	m := make(map[string]interface{})
-
-	if r.HostName != nil {
-		m["host_name"] = aws.StringValue(r.HostName)
+	m := map[string]interface{}{
+		"protocol": string(r.Protocol),
 	}
 
-	if r.Protocol != nil {
-		m["protocol"] = aws.StringValue(r.Protocol)
+	if r.HostName != nil {
+		m["host_name"] = aws.ToString(r.HostName)
 	}
 
 	return []interface{}{m}
 }
 
-func flattenBucketWebsiteConfigurationRoutingRules(rules []*s3.RoutingRule) []interface{} {
+func flattenBucketWebsiteConfigurationRoutingRules(rules []types.RoutingRule) []interface{} {
 	var results []interface{}
 
 	for _, rule := range rules {
-		if rule == nil {
-			continue
-		}
-
 		m := make(map[string]interface{})
 
 		if rule.Condition != nil {
@@ -635,7 +601,7 @@ func flattenBucketWebsiteConfigurationRoutingRules(rules []*s3.RoutingRule) []in
 	return results
 }
 
-func flattenBucketWebsiteConfigurationRoutingRuleCondition(c *s3.Condition) []interface{} {
+func flattenBucketWebsiteConfigurationRoutingRuleCondition(c *types.Condition) []interface{} {
 	if c == nil {
 		return []interface{}{}
 	}
@@ -643,42 +609,147 @@ func flattenBucketWebsiteConfigurationRoutingRuleCondition(c *s3.Condition) []in
 	m := make(map[string]interface{})
 
 	if c.KeyPrefixEquals != nil {
-		m["key_prefix_equals"] = aws.StringValue(c.KeyPrefixEquals)
+		m["key_prefix_equals"] = aws.ToString(c.KeyPrefixEquals)
 	}
 
 	if c.HttpErrorCodeReturnedEquals != nil {
-		m["http_error_code_returned_equals"] = aws.StringValue(c.HttpErrorCodeReturnedEquals)
+		m["http_error_code_returned_equals"] = aws.ToString(c.HttpErrorCodeReturnedEquals)
 	}
 
 	return []interface{}{m}
 }
 
-func flattenBucketWebsiteConfigurationRoutingRuleRedirect(r *s3.Redirect) []interface{} {
+func flattenBucketWebsiteConfigurationRoutingRuleRedirect(r *types.Redirect) []interface{} {
 	if r == nil {
 		return []interface{}{}
 	}
 
-	m := make(map[string]interface{})
+	m := map[string]interface{}{
+		"protocol": string(r.Protocol),
+	}
 
 	if r.HostName != nil {
-		m["host_name"] = aws.StringValue(r.HostName)
+		m["host_name"] = aws.ToString(r.HostName)
 	}
 
 	if r.HttpRedirectCode != nil {
-		m["http_redirect_code"] = aws.StringValue(r.HttpRedirectCode)
-	}
-
-	if r.Protocol != nil {
-		m["protocol"] = aws.StringValue(r.Protocol)
+		m["http_redirect_code"] = aws.ToString(r.HttpRedirectCode)
 	}
 
 	if r.ReplaceKeyWith != nil {
-		m["replace_key_with"] = aws.StringValue(r.ReplaceKeyWith)
+		m["replace_key_with"] = aws.ToString(r.ReplaceKeyWith)
 	}
 
 	if r.ReplaceKeyPrefixWith != nil {
-		m["replace_key_prefix_with"] = aws.StringValue(r.ReplaceKeyPrefixWith)
+		m["replace_key_prefix_with"] = aws.ToString(r.ReplaceKeyPrefixWith)
 	}
 
 	return []interface{}{m}
 }
+
+func normalizeRoutingRulesV2(w []types.RoutingRule) (string, error) {
+	withNulls, err := json.Marshal(w)
+	if err != nil {
+		return "", err
+	}
+
+	var rules []map[string]interface{}
+	if err := json.Unmarshal(withNulls, &rules); err != nil {
+		return "", err
+	}
+
+	var cleanRules []map[string]interface{}
+	for _, rule := range rules {
+		cleanRules = append(cleanRules, removeNilOrEmptyProtocol(rule))
+	}
+
+	withoutNulls, err := json.Marshal(cleanRules)
+	if err != nil {
+		return "", err
+	}
+
+	return string(withoutNulls), nil
+}
+
+// removeNilOrEmptyProtocol removes nils and empty ("") Protocol values from a RoutingRule JSON document.
+func removeNilOrEmptyProtocol(data map[string]interface{}) map[string]interface{} {
+	withoutNil := make(map[string]interface{})
+
+	for k, v := range data {
+		if v == nil {
+			continue
+		}
+
+		switch v := v.(type) {
+		case map[string]interface{}:
+			withoutNil[k] = removeNilOrEmptyProtocol(v)
+		case string:
+			// With AWS SDK for Go v2 Protocol changed type from *string to types.Protocol.
+			// An empty ("") value is equivalent to nil.
+			if k == "Protocol" && v == "" {
+				continue
+			}
+			withoutNil[k] = v
+		default:
+			withoutNil[k] = v
+		}
+	}
+
+	return withoutNil
+}
+
+func findBucketWebsite(ctx context.Context, conn *s3.Client, bucket, expectedBucketOwner string) (*s3.GetBucketWebsiteOutput, error) {
+	input := &s3.GetBucketWebsiteInput{
+		Bucket: aws.String(bucket),
+	}
+	if expectedBucketOwner != "" {
+		input.ExpectedBucketOwner = aws.String(expectedBucketOwner)
+	}
+
+	output, err := conn.GetBucketWebsite(ctx, input)
+
+	if tfawserr.ErrCodeEquals(err, errCodeNoSuchBucket, errCodeNoSuchWebsiteConfiguration) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	if output == nil {
+		return nil, tfresource.NewEmptyResultError(input)
+	}
+
+	return output, nil
+}
+
+func findBucketLocation(ctx context.Context, conn *s3.Client, bucket, expectedBucketOwner string) (*s3.GetBucketLocationOutput, error) {
+	input := &s3.GetBucketLocationInput{
+		Bucket: aws.String(bucket),
+	}
+	if expectedBucketOwner != "" {
+		input.ExpectedBucketOwner = aws.String(expectedBucketOwner)
+	}
+
+	output, err := conn.GetBucketLocation(ctx, input)
+
+	if tfawserr.ErrCodeEquals(err, errCodeNoSuchBucket) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	if output == nil {
+		return nil, tfresource.NewEmptyResultError(input)
+	}
+
+	return output, nil
+}
diff --git a/internal/service/s3/bucket_website_configuration_test.go b/internal/service/s3/bucket_website_configuration_test.go
index 007b12578cd..103d2549382 100644
--- a/internal/service/s3/bucket_website_configuration_test.go
+++ b/internal/service/s3/bucket_website_configuration_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3_test
 
 import (
@@ -5,15 +8,15 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/s3"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/aws/aws-sdk-go-v2/service/s3/types"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	tfs3 "github.com/hashicorp/terraform-provider-aws/internal/service/s3"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
 func TestAccS3BucketWebsiteConfiguration_basic(t *testing.T) {
@@ -23,7 +26,7 @@ func TestAccS3BucketWebsiteConfiguration_basic(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketWebsiteConfigurationDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -54,7 +57,7 @@ func TestAccS3BucketWebsiteConfiguration_disappears(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketWebsiteConfigurationDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -77,7 +80,7 @@ func TestAccS3BucketWebsiteConfiguration_update(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketWebsiteConfigurationDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -114,7 +117,7 @@ func TestAccS3BucketWebsiteConfiguration_Redirect(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketWebsiteConfigurationDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -143,7 +146,7 @@ func TestAccS3BucketWebsiteConfiguration_RoutingRule_ConditionAndRedirect(t *tes
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketWebsiteConfigurationDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -215,7 +218,7 @@ func TestAccS3BucketWebsiteConfiguration_RoutingRule_MultipleRules(t *testing.T)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketWebsiteConfigurationDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -261,7 +264,7 @@ func TestAccS3BucketWebsiteConfiguration_RoutingRule_RedirectOnly(t *testing.T)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketWebsiteConfigurationDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -272,7 +275,7 @@ func TestAccS3BucketWebsiteConfiguration_RoutingRule_RedirectOnly(t *testing.T)
 					resource.TestCheckResourceAttr(resourceName, "routing_rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "routing_rule.*", map[string]string{
 						"redirect.#":                  "1",
-						"redirect.0.protocol":         s3.ProtocolHttps,
+						"redirect.0.protocol":         string(types.ProtocolHttps),
 						"redirect.0.replace_key_with": "errorpage.html",
 					}),
 					resource.TestCheckResourceAttrSet(resourceName, "routing_rules"),
@@ -294,7 +297,7 @@ func TestAccS3BucketWebsiteConfiguration_RoutingRules_ConditionAndRedirect(t *te
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketWebsiteConfigurationDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -322,7 +325,7 @@ func TestAccS3BucketWebsiteConfiguration_RoutingRules_ConditionAndRedirectWithEm
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketWebsiteConfigurationDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -350,7 +353,7 @@ func TestAccS3BucketWebsiteConfiguration_RoutingRules_updateConditionAndRedirect
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketWebsiteConfigurationDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -381,7 +384,7 @@ func TestAccS3BucketWebsiteConfiguration_RoutingRuleToRoutingRules(t *testing.T)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketWebsiteConfigurationDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -413,7 +416,7 @@ func TestAccS3BucketWebsiteConfiguration_migrate_websiteWithIndexDocumentNoChang
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -445,7 +448,7 @@ func TestAccS3BucketWebsiteConfiguration_migrate_websiteWithIndexDocumentWithCha
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -477,7 +480,7 @@ func TestAccS3BucketWebsiteConfiguration_migrate_websiteWithRoutingRuleNoChange(
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -508,7 +511,7 @@ func TestAccS3BucketWebsiteConfiguration_migrate_websiteWithRoutingRuleWithChang
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -526,7 +529,7 @@ func TestAccS3BucketWebsiteConfiguration_migrate_websiteWithRoutingRuleWithChang
 					testAccCheckBucketWebsiteConfigurationExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "routing_rule.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "routing_rule.0.redirect.#", "1"),
-					resource.TestCheckResourceAttr(resourceName, "routing_rule.0.redirect.0.protocol", s3.ProtocolHttps),
+					resource.TestCheckResourceAttr(resourceName, "routing_rule.0.redirect.0.protocol", string(types.ProtocolHttps)),
 					resource.TestCheckResourceAttr(resourceName, "routing_rule.0.redirect.0.replace_key_with", "errorpage.html"),
 				),
 			},
@@ -536,7 +539,7 @@ func TestAccS3BucketWebsiteConfiguration_migrate_websiteWithRoutingRuleWithChang
 
 func testAccCheckBucketWebsiteConfigurationDestroy(ctx context.Context) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Conn(ctx)
+		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Client(ctx)
 
 		for _, rs := range s.RootModule().Resources {
 			if rs.Type != "aws_s3_bucket_website_configuration" {
@@ -548,70 +551,40 @@ func testAccCheckBucketWebsiteConfigurationDestroy(ctx context.Context) resource
 				return err
 			}
 
-			input := &s3.GetBucketWebsiteInput{
-				Bucket: aws.String(bucket),
-			}
-
-			if expectedBucketOwner != "" {
-				input.ExpectedBucketOwner = aws.String(expectedBucketOwner)
-			}
-
-			output, err := conn.GetBucketWebsiteWithContext(ctx, input)
+			_, err = tfs3.FindBucketWebsite(ctx, conn, bucket, expectedBucketOwner)
 
-			if tfawserr.ErrCodeEquals(err, s3.ErrCodeNoSuchBucket, tfs3.ErrCodeNoSuchWebsiteConfiguration) {
+			if tfresource.NotFound(err) {
 				continue
 			}
 
 			if err != nil {
-				return fmt.Errorf("error getting S3 bucket website configuration (%s): %w", rs.Primary.ID, err)
+				return err
 			}
 
-			if output != nil {
-				return fmt.Errorf("S3 bucket website configuration (%s) still exists", rs.Primary.ID)
-			}
+			return fmt.Errorf("S3 Bucket Website Configuration %s still exists", rs.Primary.ID)
 		}
 
 		return nil
 	}
 }
 
-func testAccCheckBucketWebsiteConfigurationExists(ctx context.Context, resourceName string) resource.TestCheckFunc {
+func testAccCheckBucketWebsiteConfigurationExists(ctx context.Context, n string) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		rs, ok := s.RootModule().Resources[resourceName]
+		rs, ok := s.RootModule().Resources[n]
 		if !ok {
-			return fmt.Errorf("Not found: %s", resourceName)
+			return fmt.Errorf("Not found: %s", n)
 		}
 
-		if rs.Primary.ID == "" {
-			return fmt.Errorf("Resource (%s) ID not set", resourceName)
-		}
-
-		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Conn(ctx)
+		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Client(ctx)
 
 		bucket, expectedBucketOwner, err := tfs3.ParseResourceID(rs.Primary.ID)
 		if err != nil {
 			return err
 		}
 
-		input := &s3.GetBucketWebsiteInput{
-			Bucket: aws.String(bucket),
-		}
+		_, err = tfs3.FindBucketWebsite(ctx, conn, bucket, expectedBucketOwner)
 
-		if expectedBucketOwner != "" {
-			input.ExpectedBucketOwner = aws.String(expectedBucketOwner)
-		}
-
-		output, err := conn.GetBucketWebsiteWithContext(ctx, input)
-
-		if err != nil {
-			return fmt.Errorf("error getting S3 bucket website configuration (%s): %w", rs.Primary.ID, err)
-		}
-
-		if output == nil {
-			return fmt.Errorf("S3 Bucket website configuration (%s) not found", rs.Primary.ID)
-		}
-
-		return nil
+		return err
 	}
 }
 
diff --git a/internal/service/s3/canonical_user_id_data_source.go b/internal/service/s3/canonical_user_id_data_source.go
index e4bbedf36cb..ea633c69b22 100644
--- a/internal/service/s3/canonical_user_id_data_source.go
+++ b/internal/service/s3/canonical_user_id_data_source.go
@@ -1,11 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3
 
 import (
 	"context"
-	"log"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/s3"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/s3"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
@@ -13,7 +15,7 @@ import (
 )
 
 // @SDKDataSource("aws_canonical_user_id")
-func DataSourceCanonicalUserID() *schema.Resource {
+func dataSourceCanonicalUserID() *schema.Resource {
 	return &schema.Resource{
 		ReadWithoutTimeout: dataSourceCanonicalUserIDRead,
 
@@ -28,21 +30,20 @@ func DataSourceCanonicalUserID() *schema.Resource {
 
 func dataSourceCanonicalUserIDRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).S3Conn(ctx)
+	conn := meta.(*conns.AWSClient).S3Client(ctx)
 
-	log.Printf("[DEBUG] Reading S3 Buckets")
+	output, err := conn.ListBuckets(ctx, &s3.ListBucketsInput{})
 
-	req := &s3.ListBucketsInput{}
-	resp, err := conn.ListBucketsWithContext(ctx, req)
 	if err != nil {
 		return sdkdiag.AppendErrorf(diags, "listing S3 Buckets: %s", err)
 	}
-	if resp == nil || resp.Owner == nil {
-		return sdkdiag.AppendErrorf(diags, "no canonical user ID found")
+
+	if output == nil || output.Owner == nil {
+		return sdkdiag.AppendErrorf(diags, "S3 Canonical User ID not found")
 	}
 
-	d.SetId(aws.StringValue(resp.Owner.ID))
-	d.Set("display_name", resp.Owner.DisplayName)
+	d.SetId(aws.ToString(output.Owner.ID))
+	d.Set("display_name", output.Owner.DisplayName)
 
 	return diags
 }
diff --git a/internal/service/s3/canonical_user_id_data_source_test.go b/internal/service/s3/canonical_user_id_data_source_test.go
index 69b127735ab..451583c90c9 100644
--- a/internal/service/s3/canonical_user_id_data_source_test.go
+++ b/internal/service/s3/canonical_user_id_data_source_test.go
@@ -1,50 +1,36 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3_test
 
 import (
-	"fmt"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/service/s3"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
-	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
+	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
 func TestAccS3CanonicalUserIDDataSource_basic(t *testing.T) {
 	ctx := acctest.Context(t)
+	dataSourceName := "data.aws_canonical_user_id.test"
+
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccCanonicalUserIDDataSourceConfig_basic,
-				Check: resource.ComposeTestCheckFunc(
-					testAccCanonicalUserIdCheckExistsDataSource("data.aws_canonical_user_id.current"),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					resource.TestCheckResourceAttrSet(dataSourceName, "display_name"),
+					resource.TestCheckResourceAttrSet(dataSourceName, "id"),
 				),
 			},
 		},
 	})
 }
 
-func testAccCanonicalUserIdCheckExistsDataSource(name string) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		rs, ok := s.RootModule().Resources[name]
-		if !ok {
-			return fmt.Errorf("Can't find Canonical User ID resource: %s", name)
-		}
-
-		if rs.Primary.Attributes["id"] == "" {
-			return fmt.Errorf("Missing Canonical User ID")
-		}
-		if rs.Primary.Attributes["display_name"] == "" {
-			return fmt.Errorf("Missing Display Name")
-		}
-
-		return nil
-	}
-}
-
 const testAccCanonicalUserIDDataSourceConfig_basic = `
-data "aws_canonical_user_id" "current" {}
+data "aws_canonical_user_id" "test" {}
 `
diff --git a/internal/service/s3/consts.go b/internal/service/s3/consts.go
index 272dfe94e2c..607199431ea 100644
--- a/internal/service/s3/consts.go
+++ b/internal/service/s3/consts.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3
 
 const (
diff --git a/internal/service/s3/delete.go b/internal/service/s3/delete.go
index 6ca87c588d5..10b359f7dbd 100644
--- a/internal/service/s3/delete.go
+++ b/internal/service/s3/delete.go
@@ -1,22 +1,26 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3
 
 import (
 	"context"
+	"errors"
 	"fmt"
+	"log"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/aws/awserr"
-	"github.com/aws/aws-sdk-go/service/s3"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
-	multierror "github.com/hashicorp/go-multierror"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/s3"
+	"github.com/aws/aws-sdk-go-v2/service/s3/types"
+	"github.com/hashicorp/aws-sdk-go-base/v2/tfawserr"
 )
 
-// EmptyBucket empties the specified S3 bucket by deleting all object versions and delete markers.
+// emptyBucket empties the specified S3 bucket by deleting all object versions and delete markers.
 // If `force` is `true` then S3 Object Lock governance mode restrictions are bypassed and
 // an attempt is made to remove any S3 Object Lock legal holds.
 // Returns the number of objects deleted.
-func EmptyBucket(ctx context.Context, conn *s3.S3, bucket string, force bool) (int64, error) {
-	nObjects, err := forEachObjectVersionsPage(ctx, conn, bucket, func(ctx context.Context, conn *s3.S3, bucket string, page *s3.ListObjectVersionsOutput) (int64, error) {
+func emptyBucket(ctx context.Context, conn *s3.Client, bucket string, force bool) (int64, error) {
+	nObjects, err := forEachObjectVersionsPage(ctx, conn, bucket, func(ctx context.Context, conn *s3.Client, bucket string, page *s3.ListObjectVersionsOutput) (int64, error) {
 		return deletePageOfObjectVersions(ctx, conn, bucket, force, page)
 	})
 
@@ -31,7 +35,7 @@ func EmptyBucket(ctx context.Context, conn *s3.S3, bucket string, force bool) (i
 }
 
 // forEachObjectVersionsPage calls the specified function for each page returned from the S3 ListObjectVersionsPages API.
-func forEachObjectVersionsPage(ctx context.Context, conn *s3.S3, bucket string, fn func(ctx context.Context, conn *s3.S3, bucket string, page *s3.ListObjectVersionsOutput) (int64, error)) (int64, error) {
+func forEachObjectVersionsPage(ctx context.Context, conn *s3.Client, bucket string, fn func(ctx context.Context, conn *s3.Client, bucket string, page *s3.ListObjectVersionsOutput) (int64, error)) (int64, error) {
 	var nObjects int64
 
 	input := &s3.ListObjectVersionsInput{
@@ -39,9 +43,12 @@ func forEachObjectVersionsPage(ctx context.Context, conn *s3.S3, bucket string,
 	}
 	var lastErr error
 
-	err := conn.ListObjectVersionsPagesWithContext(ctx, input, func(page *s3.ListObjectVersionsOutput, lastPage bool) bool {
-		if page == nil {
-			return !lastPage
+	pages := s3.NewListObjectVersionsPaginator(conn, input)
+	for pages.HasMorePages() {
+		page, err := pages.NextPage(ctx)
+
+		if err != nil {
+			return nObjects, fmt.Errorf("listing S3 bucket (%s) object versions: %w", bucket, err)
 		}
 
 		n, err := fn(ctx, conn, bucket, page)
@@ -49,15 +56,8 @@ func forEachObjectVersionsPage(ctx context.Context, conn *s3.S3, bucket string,
 
 		if err != nil {
 			lastErr = err
-
-			return false
+			break
 		}
-
-		return !lastPage
-	})
-
-	if err != nil {
-		return nObjects, fmt.Errorf("listing S3 Bucket (%s) object versions: %w", bucket, err)
 	}
 
 	if lastErr != nil {
@@ -71,12 +71,12 @@ func forEachObjectVersionsPage(ctx context.Context, conn *s3.S3, bucket string,
 // If `force` is `true` then S3 Object Lock governance mode restrictions are bypassed and
 // an attempt is made to remove any S3 Object Lock legal holds.
 // Returns the number of objects deleted.
-func deletePageOfObjectVersions(ctx context.Context, conn *s3.S3, bucket string, force bool, page *s3.ListObjectVersionsOutput) (int64, error) {
+func deletePageOfObjectVersions(ctx context.Context, conn *s3.Client, bucket string, force bool, page *s3.ListObjectVersionsOutput) (int64, error) {
 	var nObjects int64
 
-	toDelete := make([]*s3.ObjectIdentifier, 0, len(page.Versions))
+	toDelete := make([]types.ObjectIdentifier, 0, len(page.Versions))
 	for _, v := range page.Versions {
-		toDelete = append(toDelete, &s3.ObjectIdentifier{
+		toDelete = append(toDelete, types.ObjectIdentifier{
 			Key:       v.Key,
 			VersionId: v.VersionId,
 		})
@@ -87,77 +87,74 @@ func deletePageOfObjectVersions(ctx context.Context, conn *s3.S3, bucket string,
 	}
 
 	input := &s3.DeleteObjectsInput{
-		Bucket: aws.String(bucket),
-		Delete: &s3.Delete{
+		Bucket:                    aws.String(bucket),
+		BypassGovernanceRetention: force,
+		Delete: &types.Delete{
 			Objects: toDelete,
-			Quiet:   aws.Bool(true), // Only report errors.
+			Quiet:   true, // Only report errors.
 		},
 	}
 
-	if force {
-		input.BypassGovernanceRetention = aws.Bool(true)
-	}
-
-	output, err := conn.DeleteObjectsWithContext(ctx, input)
+	output, err := conn.DeleteObjects(ctx, input)
 
-	if tfawserr.ErrCodeEquals(err, s3.ErrCodeNoSuchBucket) {
+	if tfawserr.ErrCodeEquals(err, errCodeNoSuchBucket) {
 		return nObjects, nil
 	}
 
 	if err != nil {
-		return nObjects, fmt.Errorf("deleting S3 Bucket (%s) objects: %w", bucket, err)
+		return nObjects, fmt.Errorf("deleting S3 bucket (%s) objects: %w", bucket, err)
 	}
 
 	nObjects -= int64(len(output.Errors))
 
-	var deleteErrs *multierror.Error
+	var deleteErrs []error
 
 	for _, v := range output.Errors {
-		code := aws.StringValue(v.Code)
+		code := aws.ToString(v.Code)
 
-		if code == s3.ErrCodeNoSuchKey {
+		if code == errCodeNoSuchKey {
 			continue
 		}
 
 		// Attempt to remove any legal hold on the object.
 		if force && code == errCodeAccessDenied {
-			key := aws.StringValue(v.Key)
-			versionID := aws.StringValue(v.VersionId)
+			key := aws.ToString(v.Key)
+			versionID := aws.ToString(v.VersionId)
 
-			_, err := conn.PutObjectLegalHoldWithContext(ctx, &s3.PutObjectLegalHoldInput{
+			_, err := conn.PutObjectLegalHold(ctx, &s3.PutObjectLegalHoldInput{
 				Bucket:    aws.String(bucket),
 				Key:       aws.String(key),
 				VersionId: aws.String(versionID),
-				LegalHold: &s3.ObjectLockLegalHold{
-					Status: aws.String(s3.ObjectLockLegalHoldStatusOff),
+				LegalHold: &types.ObjectLockLegalHold{
+					Status: types.ObjectLockLegalHoldStatusOff,
 				},
 			})
 
 			if err != nil {
 				// Add the original error and the new error.
-				deleteErrs = multierror.Append(deleteErrs, newDeleteObjectVersionError(v))
-				deleteErrs = multierror.Append(deleteErrs, fmt.Errorf("removing legal hold: %w", newObjectVersionError(key, versionID, err)))
+				deleteErrs = append(deleteErrs, newDeleteObjectVersionError(v))
+				deleteErrs = append(deleteErrs, fmt.Errorf("removing legal hold: %w", newObjectVersionError(key, versionID, err)))
 			} else {
 				// Attempt to delete the object once the legal hold has been removed.
-				_, err := conn.DeleteObjectWithContext(ctx, &s3.DeleteObjectInput{
+				_, err := conn.DeleteObject(ctx, &s3.DeleteObjectInput{
 					Bucket:    aws.String(bucket),
 					Key:       aws.String(key),
 					VersionId: aws.String(versionID),
 				})
 
 				if err != nil {
-					deleteErrs = multierror.Append(deleteErrs, fmt.Errorf("deleting: %w", newObjectVersionError(key, versionID, err)))
+					deleteErrs = append(deleteErrs, fmt.Errorf("deleting: %w", newObjectVersionError(key, versionID, err)))
 				} else {
 					nObjects++
 				}
 			}
 		} else {
-			deleteErrs = multierror.Append(deleteErrs, newDeleteObjectVersionError(v))
+			deleteErrs = append(deleteErrs, newDeleteObjectVersionError(v))
 		}
 	}
 
-	if err := deleteErrs.ErrorOrNil(); err != nil {
-		return nObjects, fmt.Errorf("deleting S3 Bucket (%s) objects: %w", bucket, err)
+	if err := errors.Join(deleteErrs...); err != nil {
+		return nObjects, fmt.Errorf("deleting S3 bucket (%s) objects: %w", bucket, err)
 	}
 
 	return nObjects, nil
@@ -165,12 +162,12 @@ func deletePageOfObjectVersions(ctx context.Context, conn *s3.S3, bucket string,
 
 // deletePageOfDeleteMarkers deletes a page (<= 1000) of S3 object delete markers.
 // Returns the number of delete markers deleted.
-func deletePageOfDeleteMarkers(ctx context.Context, conn *s3.S3, bucket string, page *s3.ListObjectVersionsOutput) (int64, error) {
+func deletePageOfDeleteMarkers(ctx context.Context, conn *s3.Client, bucket string, page *s3.ListObjectVersionsOutput) (int64, error) {
 	var nObjects int64
 
-	toDelete := make([]*s3.ObjectIdentifier, 0, len(page.Versions))
+	toDelete := make([]types.ObjectIdentifier, 0, len(page.Versions))
 	for _, v := range page.DeleteMarkers {
-		toDelete = append(toDelete, &s3.ObjectIdentifier{
+		toDelete = append(toDelete, types.ObjectIdentifier{
 			Key:       v.Key,
 			VersionId: v.VersionId,
 		})
@@ -182,32 +179,32 @@ func deletePageOfDeleteMarkers(ctx context.Context, conn *s3.S3, bucket string,
 
 	input := &s3.DeleteObjectsInput{
 		Bucket: aws.String(bucket),
-		Delete: &s3.Delete{
+		Delete: &types.Delete{
 			Objects: toDelete,
-			Quiet:   aws.Bool(true), // Only report errors.
+			Quiet:   true, // Only report errors.
 		},
 	}
 
-	output, err := conn.DeleteObjectsWithContext(ctx, input)
+	output, err := conn.DeleteObjects(ctx, input)
 
-	if tfawserr.ErrCodeEquals(err, s3.ErrCodeNoSuchBucket) {
+	if tfawserr.ErrCodeEquals(err, errCodeNoSuchBucket) {
 		return nObjects, nil
 	}
 
 	if err != nil {
-		return nObjects, fmt.Errorf("deleting S3 Bucket (%s) delete markers: %w", bucket, err)
+		return nObjects, fmt.Errorf("deleting S3 bucket (%s) delete markers: %w", bucket, err)
 	}
 
 	nObjects -= int64(len(output.Errors))
 
-	var deleteErrs *multierror.Error
+	var deleteErrs []error
 
 	for _, v := range output.Errors {
-		deleteErrs = multierror.Append(deleteErrs, newDeleteObjectVersionError(v))
+		deleteErrs = append(deleteErrs, newDeleteObjectVersionError(v))
 	}
 
-	if err := deleteErrs.ErrorOrNil(); err != nil {
-		return nObjects, fmt.Errorf("deleting S3 Bucket (%s) delete markers: %w", bucket, err)
+	if err := errors.Join(deleteErrs...); err != nil {
+		return nObjects, fmt.Errorf("deleting S3 bucket (%s) delete markers: %w", bucket, err)
 	}
 
 	return nObjects, nil
@@ -225,12 +222,183 @@ func newObjectVersionError(key, versionID string, err error) error {
 	return fmt.Errorf("S3 object (%s) version (%s): %w", key, versionID, err)
 }
 
-func newDeleteObjectVersionError(err *s3.Error) error {
-	if err == nil {
-		return nil
+func newDeleteObjectVersionError(err types.Error) error {
+	s3Err := fmt.Errorf("%s: %s", aws.ToString(err.Code), aws.ToString(err.Message))
+
+	return fmt.Errorf("deleting: %w", newObjectVersionError(aws.ToString(err.Key), aws.ToString(err.VersionId), s3Err))
+}
+
+// deleteAllObjectVersions deletes all versions of a specified key from an S3 bucket.
+// If key is empty then all versions of all objects are deleted.
+// Set force to true to override any S3 object lock protections on object lock enabled buckets.
+// Returns the number of objects deleted.
+func deleteAllObjectVersions(ctx context.Context, conn *s3.Client, bucket, key string, force, ignoreObjectErrors bool) (int64, error) {
+	var nObjects int64
+
+	input := &s3.ListObjectVersionsInput{
+		Bucket: aws.String(bucket),
+	}
+	if key != "" {
+		input.Prefix = aws.String(key)
+	}
+	var lastErr error
+
+	pages := s3.NewListObjectVersionsPaginator(conn, input)
+	for pages.HasMorePages() {
+		page, err := pages.NextPage(ctx)
+
+		if tfawserr.ErrCodeEquals(err, errCodeNoSuchBucket) {
+			break
+		}
+
+		if err != nil {
+			return nObjects, err
+		}
+
+		for _, objectVersion := range page.Versions {
+			objectKey := aws.ToString(objectVersion.Key)
+			objectVersionID := aws.ToString(objectVersion.VersionId)
+
+			if key != "" && key != objectKey {
+				continue
+			}
+
+			err := deleteObjectVersion(ctx, conn, bucket, objectKey, objectVersionID, force)
+
+			if err == nil {
+				nObjects++
+			}
+
+			if tfawserr.ErrCodeEquals(err, errCodeAccessDenied) && force {
+				// Remove any legal hold.
+				input := &s3.HeadObjectInput{
+					Bucket:    aws.String(bucket),
+					Key:       aws.String(objectKey),
+					VersionId: aws.String(objectVersionID),
+				}
+
+				output, err := conn.HeadObject(ctx, input)
+
+				if err != nil {
+					log.Printf("[ERROR] Getting S3 Bucket (%s) Object (%s) Version (%s) metadata: %s", bucket, objectKey, objectVersionID, err)
+					lastErr = err
+					continue
+				}
+
+				if output.ObjectLockLegalHoldStatus == types.ObjectLockLegalHoldStatusOn {
+					input := &s3.PutObjectLegalHoldInput{
+						Bucket: aws.String(bucket),
+						Key:    aws.String(objectKey),
+						LegalHold: &types.ObjectLockLegalHold{
+							Status: types.ObjectLockLegalHoldStatusOff,
+						},
+						VersionId: aws.String(objectVersionID),
+					}
+
+					_, err := conn.PutObjectLegalHold(ctx, input)
+
+					if err != nil {
+						log.Printf("[ERROR] Putting S3 Bucket (%s) Object (%s) Version(%s) legal hold: %s", bucket, objectKey, objectVersionID, err)
+						lastErr = err
+						continue
+					}
+
+					// Attempt to delete again.
+					err = deleteObjectVersion(ctx, conn, bucket, objectKey, objectVersionID, force)
+
+					if err != nil {
+						lastErr = err
+					} else {
+						nObjects++
+					}
+
+					continue
+				}
+
+				// AccessDenied for another reason.
+				lastErr = fmt.Errorf("deleting S3 Bucket (%s) Object (%s) Version (%s): %w", bucket, objectKey, objectVersionID, err)
+				continue
+			}
+
+			if err != nil {
+				lastErr = err
+			}
+		}
+	}
+
+	if lastErr != nil {
+		if !ignoreObjectErrors {
+			return nObjects, fmt.Errorf("deleting at least one S3 Object version, last error: %w", lastErr)
+		}
+
+		lastErr = nil
+	}
+
+	pages = s3.NewListObjectVersionsPaginator(conn, input)
+	for pages.HasMorePages() {
+		page, err := pages.NextPage(ctx)
+
+		if tfawserr.ErrCodeEquals(err, errCodeNoSuchBucket) {
+			break
+		}
+
+		if err != nil {
+			return nObjects, err
+		}
+
+		for _, deleteMarker := range page.DeleteMarkers {
+			deleteMarkerKey := aws.ToString(deleteMarker.Key)
+			deleteMarkerVersionID := aws.ToString(deleteMarker.VersionId)
+
+			if key != "" && key != deleteMarkerKey {
+				continue
+			}
+
+			// Delete markers have no object lock protections.
+			err := deleteObjectVersion(ctx, conn, bucket, deleteMarkerKey, deleteMarkerVersionID, false)
+
+			if err != nil {
+				lastErr = err
+			} else {
+				nObjects++
+			}
+		}
+	}
+
+	if lastErr != nil {
+		if !ignoreObjectErrors {
+			return nObjects, fmt.Errorf("deleting at least one S3 Object delete marker, last error: %w", lastErr)
+		}
 	}
 
-	awsErr := awserr.New(aws.StringValue(err.Code), aws.StringValue(err.Message), nil)
+	return nObjects, nil
+}
+
+// deleteObjectVersion deletes a specific object version.
+// Set force to true to override any S3 object lock protections.
+func deleteObjectVersion(ctx context.Context, conn *s3.Client, b, k, v string, force bool) error {
+	input := &s3.DeleteObjectInput{
+		Bucket: aws.String(b),
+		Key:    aws.String(k),
+	}
+
+	if v != "" {
+		input.VersionId = aws.String(v)
+	}
+	if force {
+		input.BypassGovernanceRetention = true
+	}
+
+	log.Printf("[INFO] Deleting S3 Bucket (%s) Object (%s) Version (%s)", b, k, v)
+	_, err := conn.DeleteObject(ctx, input)
+
+	if err != nil {
+		log.Printf("[WARN] Deleting S3 Bucket (%s) Object (%s) Version (%s): %s", b, k, v, err)
+	}
+
+	if tfawserr.ErrCodeEquals(err, errCodeNoSuchBucket, errCodeNoSuchKey) {
+		return nil
+	}
 
-	return fmt.Errorf("deleting: %w", newObjectVersionError(aws.StringValue(err.Key), aws.StringValue(err.VersionId), awsErr))
+	return err
 }
diff --git a/internal/service/s3/delete_test.go b/internal/service/s3/delete_test.go
index f0a9b13932b..7aa44ed718c 100644
--- a/internal/service/s3/delete_test.go
+++ b/internal/service/s3/delete_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3_test
 
 import (
 	"flag"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/aws/session"
-	"github.com/aws/aws-sdk-go/service/s3"
+	"github.com/aws/aws-sdk-go-v2/config"
+	"github.com/aws/aws-sdk-go-v2/service/s3"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
 	tfs3 "github.com/hashicorp/terraform-provider-aws/internal/service/s3"
 )
@@ -24,10 +27,13 @@ func TestEmptyBucket(t *testing.T) {
 		t.Skip("bucket not specified")
 	}
 
-	sess := session.Must(session.NewSession())
-	svc := s3.New(sess)
+	cfg, err := config.LoadDefaultConfig(ctx)
+	if err != nil {
+		t.Fatalf("error loading default SDK config: %s", err)
+	}
 
-	n, err := tfs3.EmptyBucket(ctx, svc, *bucket, *force)
+	client := s3.NewFromConfig(cfg)
+	n, err := tfs3.EmptyBucket(ctx, client, *bucket, *force)
 
 	if err != nil {
 		t.Fatalf("error emptying S3 bucket (%s): %s", *bucket, err)
@@ -45,10 +51,13 @@ func TestDeleteAllObjectVersions(t *testing.T) {
 		t.Skip("bucket not specified")
 	}
 
-	sess := session.Must(session.NewSession())
-	svc := s3.New(sess)
+	cfg, err := config.LoadDefaultConfig(ctx)
+	if err != nil {
+		t.Fatalf("error loading default SDK config: %s", err)
+	}
 
-	n, err := tfs3.DeleteAllObjectVersions(ctx, svc, *bucket, "", *force, false)
+	client := s3.NewFromConfig(cfg)
+	n, err := tfs3.DeleteAllObjectVersions(ctx, client, *bucket, "", *force, false)
 
 	if err != nil {
 		t.Fatalf("error emptying S3 bucket (%s): %s", *bucket, err)
diff --git a/internal/service/s3/enum.go b/internal/service/s3/enum.go
index 235479e3354..0abc9157708 100644
--- a/internal/service/s3/enum.go
+++ b/internal/service/s3/enum.go
@@ -1,40 +1,11 @@
-package s3
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
-import (
-	"github.com/aws/aws-sdk-go/service/s3"
-)
+package s3
 
 const DefaultKMSKeyAlias = "alias/aws/s3"
 
-// These should be defined in the AWS SDK for Go. There is an open issue https://github.com/aws/aws-sdk-go/issues/2683
 const (
-	BucketCannedACLExecRead         = "aws-exec-read"
-	BucketCannedACLLogDeliveryWrite = "log-delivery-write"
-
-	BucketVersioningStatusDisabled = "Disabled"
-
 	LifecycleRuleStatusEnabled  = "Enabled"
 	LifecycleRuleStatusDisabled = "Disabled"
 )
-
-func BucketCannedACL_Values() []string {
-	result := s3.BucketCannedACL_Values()
-	result = appendUniqueString(result, BucketCannedACLExecRead)
-	result = appendUniqueString(result, BucketCannedACLLogDeliveryWrite)
-	return result
-}
-
-func BucketVersioningStatus_Values() []string {
-	result := s3.BucketVersioningStatus_Values()
-	result = appendUniqueString(result, BucketVersioningStatusDisabled)
-	return result
-}
-
-func appendUniqueString(slice []string, elem string) []string {
-	for _, e := range slice {
-		if e == elem {
-			return slice
-		}
-	}
-	return append(slice, elem)
-}
diff --git a/internal/service/s3/errors.go b/internal/service/s3/errors.go
index 35780d68137..758f1839cbd 100644
--- a/internal/service/s3/errors.go
+++ b/internal/service/s3/errors.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3
 
 // Error code constants missing from AWS Go SDK:
@@ -10,21 +13,25 @@ const (
 	errCodeInvalidRequest                       = "InvalidRequest"
 	errCodeMalformedPolicy                      = "MalformedPolicy"
 	errCodeMethodNotAllowed                     = "MethodNotAllowed"
-	ErrCodeNoSuchBucketPolicy                   = "NoSuchBucketPolicy"
+	errCodeNoSuchBucket                         = "NoSuchBucket"
+	errCodeNoSuchBucketPolicy                   = "NoSuchBucketPolicy"
 	errCodeNoSuchConfiguration                  = "NoSuchConfiguration"
-	ErrCodeNoSuchCORSConfiguration              = "NoSuchCORSConfiguration"
+	errCodeNoSuchCORSConfiguration              = "NoSuchCORSConfiguration"
 	ErrCodeNoSuchLifecycleConfiguration         = "NoSuchLifecycleConfiguration"
+	errCodeNoSuchKey                            = "NoSuchKey"
 	ErrCodeNoSuchPublicAccessBlockConfiguration = "NoSuchPublicAccessBlockConfiguration"
 	errCodeNoSuchTagSet                         = "NoSuchTagSet"
 	errCodeNoSuchTagSetError                    = "NoSuchTagSetError"
-	ErrCodeNoSuchWebsiteConfiguration           = "NoSuchWebsiteConfiguration"
+	errCodeNoSuchWebsiteConfiguration           = "NoSuchWebsiteConfiguration"
 	errCodeNotImplemented                       = "NotImplemented"
 	// errCodeObjectLockConfigurationNotFound should be used with tfawserr.ErrCodeContains, not tfawserr.ErrCodeEquals.
 	// Reference: https://github.com/hashicorp/terraform-provider-aws/pull/26317
 	errCodeObjectLockConfigurationNotFound           = "ObjectLockConfigurationNotFound"
+	errCodeObjectLockConfigurationNotFoundError      = "ObjectLockConfigurationNotFoundError"
 	errCodeOperationAborted                          = "OperationAborted"
+	errCodeOwnershipControlsNotFoundError            = "OwnershipControlsNotFoundError"
 	ErrCodeReplicationConfigurationNotFound          = "ReplicationConfigurationNotFoundError"
-	ErrCodeServerSideEncryptionConfigurationNotFound = "ServerSideEncryptionConfigurationNotFoundError"
+	errCodeServerSideEncryptionConfigurationNotFound = "ServerSideEncryptionConfigurationNotFoundError"
 	errCodeUnsupportedArgument                       = "UnsupportedArgument"
 	// errCodeXNotImplemented is returned from Third Party S3 implementations
 	// and so far has been noticed with calls to GetBucketWebsite.
diff --git a/internal/service/s3/exports_test.go b/internal/service/s3/exports_test.go
new file mode 100644
index 00000000000..77bc655eb55
--- /dev/null
+++ b/internal/service/s3/exports_test.go
@@ -0,0 +1,31 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package s3
+
+// Exports for use in tests only.
+var (
+	DeleteAllObjectVersions               = deleteAllObjectVersions
+	EmptyBucket                           = emptyBucket
+	FindAnalyticsConfiguration            = findAnalyticsConfiguration
+	FindBucket                            = findBucket
+	FindBucketACL                         = findBucketACL
+	FindBucketAccelerateConfiguration     = findBucketAccelerateConfiguration
+	FindBucketNotificationConfiguration   = findBucketNotificationConfiguration
+	FindBucketPolicy                      = findBucketPolicy
+	FindBucketRequestPayment              = findBucketRequestPayment
+	FindBucketVersioning                  = findBucketVersioning
+	FindBucketWebsite                     = findBucketWebsite
+	FindCORSRules                         = findCORSRules
+	FindIntelligentTieringConfiguration   = findIntelligentTieringConfiguration
+	FindInventoryConfiguration            = findInventoryConfiguration
+	FindLoggingEnabled                    = findLoggingEnabled
+	FindMetricsConfiguration              = findMetricsConfiguration
+	FindObjectByBucketAndKey              = findObjectByBucketAndKey
+	FindObjectLockConfiguration           = findObjectLockConfiguration
+	FindOwnershipControls                 = findOwnershipControls
+	FindServerSideEncryptionConfiguration = findServerSideEncryptionConfiguration
+	SDKv1CompatibleCleanKey               = sdkv1CompatibleCleanKey
+
+	ErrCodeNoSuchCORSConfiguration = errCodeNoSuchCORSConfiguration
+)
diff --git a/internal/service/s3/flex.go b/internal/service/s3/flex.go
index 9206752c18e..1ce441db303 100644
--- a/internal/service/s3/flex.go
+++ b/internal/service/s3/flex.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3
 
 import (
@@ -9,8 +12,8 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/s3"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
-	"github.com/hashicorp/terraform-provider-aws/internal/experimental/nullable"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
+	"github.com/hashicorp/terraform-provider-aws/internal/types/nullable"
 )
 
 func ExpandReplicationRuleDestinationAccessControlTranslation(l []interface{}) *s3.AccessControlTranslation {
diff --git a/internal/service/s3/flex_test.go b/internal/service/s3/flex_test.go
index f542a8ca63d..63309b58949 100644
--- a/internal/service/s3/flex_test.go
+++ b/internal/service/s3/flex_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3
 
 import (
diff --git a/internal/service/s3/generate.go b/internal/service/s3/generate.go
index 32b1c136ee1..bb62eb52883 100644
--- a/internal/service/s3/generate.go
+++ b/internal/service/s3/generate.go
@@ -1,4 +1,8 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ServiceTagsSlice
+//go:generate go run ../../generate/tags/main.go -AWSSDKVersion=2 -SkipAWSServiceImp -ServiceTagsSlice -TagsFunc=tagsV2 -KeyValueTagsFunc=keyValueTagsV2 -GetTagsInFunc=getTagsInV2 -SetTagsOutFunc=setTagsOutV2 -- tagsv2_gen.go
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
 
diff --git a/internal/service/s3/hosted_zones.go b/internal/service/s3/hosted_zones.go
index 6b9dd3f1eee..76b5c5c0c1c 100644
--- a/internal/service/s3/hosted_zones.go
+++ b/internal/service/s3/hosted_zones.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3
 
 import (
@@ -30,6 +33,7 @@ var hostedZoneIDsMap = map[string]string{
 	endpoints.EuWest1RegionID:      "Z1BKCTXD74EZPE",
 	endpoints.EuWest2RegionID:      "Z3GKZC51ZF0DB4",
 	endpoints.EuWest3RegionID:      "Z3R1K369G5AVDG",
+	endpoints.IlCentral1RegionID:   "Z09640613K4A3MN55U7GU",
 	endpoints.MeCentral1RegionID:   "Z06143092I8HRXZRUZROF",
 	endpoints.MeSouth1RegionID:     "Z1MPMWCPA7YB62",
 	endpoints.SaEast1RegionID:      "Z7KQH4QJS55SO",
diff --git a/internal/service/s3/id.go b/internal/service/s3/id.go
index 23e67789579..3d5d03dadd3 100644
--- a/internal/service/s3/id.go
+++ b/internal/service/s3/id.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3
 
 import (
diff --git a/internal/service/s3/id_test.go b/internal/service/s3/id_test.go
index 3b16539e0e7..043760d7e63 100644
--- a/internal/service/s3/id_test.go
+++ b/internal/service/s3/id_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3_test
 
 import (
diff --git a/internal/service/s3/object.go b/internal/service/s3/object.go
index a15996da365..6a5c50a615e 100644
--- a/internal/service/s3/object.go
+++ b/internal/service/s3/object.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3
 
 import (
@@ -9,20 +12,22 @@ import (
 	"log"
 	"net/http"
 	"os"
-	"regexp"
 	"strings"
 	"time"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/s3"
-	"github.com/aws/aws-sdk-go/service/s3/s3manager"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/YakDriver/regexache"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/feature/s3/manager"
+	"github.com/aws/aws-sdk-go-v2/service/s3"
+	"github.com/aws/aws-sdk-go-v2/service/s3/types"
+	"github.com/hashicorp/aws-sdk-go-base/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/customdiff"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/enum"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
 	"github.com/hashicorp/terraform-provider-aws/internal/flex"
 	"github.com/hashicorp/terraform-provider-aws/internal/service/kms"
@@ -33,8 +38,6 @@ import (
 	"github.com/mitchellh/go-homedir"
 )
 
-const objectCreationTimeout = 2 * time.Minute
-
 // @SDKResource("aws_s3_object", name="Object")
 // @Tags
 func ResourceObject() *schema.Resource {
@@ -55,9 +58,10 @@ func ResourceObject() *schema.Resource {
 
 		Schema: map[string]*schema.Schema{
 			"acl": {
-				Type:         schema.TypeString,
-				Optional:     true,
-				ValidateFunc: validation.StringInSlice(s3.ObjectCannedACL_Values(), false),
+				Type:             schema.TypeString,
+				Optional:         true,
+				Computed:         true,
+				ValidateDiagFunc: enum.Validate[types.ObjectCannedACL](),
 			},
 			"bucket": {
 				Type:         schema.TypeString,
@@ -74,6 +78,27 @@ func ResourceObject() *schema.Resource {
 				Type:     schema.TypeString,
 				Optional: true,
 			},
+			"checksum_algorithm": {
+				Type:             schema.TypeString,
+				Optional:         true,
+				ValidateDiagFunc: enum.Validate[types.ChecksumAlgorithm](),
+			},
+			"checksum_crc32": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"checksum_crc32c": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"checksum_sha1": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"checksum_sha256": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
 			"content": {
 				Type:          schema.TypeString,
 				Optional:      true,
@@ -128,7 +153,7 @@ func ResourceObject() *schema.Resource {
 				ValidateFunc: verify.ValidARN,
 				DiffSuppressFunc: func(k, old, new string, d *schema.ResourceData) bool {
 					// ignore diffs where the user hasn't specified a kms_key_id but the bucket has a default KMS key configured
-					if new == "" && d.Get("server_side_encryption") == s3.ServerSideEncryptionAwsKms {
+					if new == "" && d.Get("server_side_encryption") == types.ServerSideEncryptionAwsKms {
 						return true
 					}
 					return false
@@ -136,19 +161,19 @@ func ResourceObject() *schema.Resource {
 			},
 			"metadata": {
 				Type:         schema.TypeMap,
-				ValidateFunc: validateMetadataIsLowerCase,
 				Optional:     true,
 				Elem:         &schema.Schema{Type: schema.TypeString},
+				ValidateFunc: validateMetadataIsLowerCase,
 			},
 			"object_lock_legal_hold_status": {
-				Type:         schema.TypeString,
-				Optional:     true,
-				ValidateFunc: validation.StringInSlice(s3.ObjectLockLegalHoldStatus_Values(), false),
+				Type:             schema.TypeString,
+				Optional:         true,
+				ValidateDiagFunc: enum.Validate[types.ObjectLockLegalHoldStatus](),
 			},
 			"object_lock_mode": {
-				Type:         schema.TypeString,
-				Optional:     true,
-				ValidateFunc: validation.StringInSlice(s3.ObjectLockMode_Values(), false),
+				Type:             schema.TypeString,
+				Optional:         true,
+				ValidateDiagFunc: enum.Validate[types.ObjectLockMode](),
 			},
 			"object_lock_retain_until_date": {
 				Type:         schema.TypeString,
@@ -156,10 +181,10 @@ func ResourceObject() *schema.Resource {
 				ValidateFunc: validation.IsRFC3339Time,
 			},
 			"server_side_encryption": {
-				Type:         schema.TypeString,
-				Optional:     true,
-				ValidateFunc: validation.StringInSlice(s3.ServerSideEncryption_Values(), false),
-				Computed:     true,
+				Type:             schema.TypeString,
+				Optional:         true,
+				Computed:         true,
+				ValidateDiagFunc: enum.Validate[types.ServerSideEncryption](),
 			},
 			"source": {
 				Type:          schema.TypeString,
@@ -171,10 +196,10 @@ func ResourceObject() *schema.Resource {
 				Optional: true,
 			},
 			"storage_class": {
-				Type:         schema.TypeString,
-				Optional:     true,
-				Computed:     true,
-				ValidateFunc: validation.StringInSlice(s3.ObjectStorageClass_Values(), false),
+				Type:             schema.TypeString,
+				Optional:         true,
+				Computed:         true,
+				ValidateDiagFunc: enum.Validate[types.ObjectStorageClass](),
 			},
 			names.AttrTags:    tftags.TagsSchema(),
 			names.AttrTagsAll: tftags.TagsSchemaComputed(),
@@ -197,13 +222,11 @@ func resourceObjectCreate(ctx context.Context, d *schema.ResourceData, meta inte
 
 func resourceObjectRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).S3Conn(ctx)
+	conn := meta.(*conns.AWSClient).S3Client(ctx)
 
 	bucket := d.Get("bucket").(string)
-	key := d.Get("key").(string)
-	outputRaw, err := tfresource.RetryWhenNewResourceNotFound(ctx, objectCreationTimeout, func() (interface{}, error) {
-		return FindObjectByThreePartKey(ctx, conn, bucket, key, "")
-	}, d.IsNewResource())
+	key := sdkv1CompatibleCleanKey(d.Get("key").(string))
+	output, err := findObjectByBucketAndKey(ctx, conn, bucket, key, "", d.Get("checksum_algorithm").(string))
 
 	if !d.IsNewResource() && tfresource.NotFound(err) {
 		log.Printf("[WARN] S3 Object (%s) not found, removing from state", d.Id())
@@ -215,60 +238,40 @@ func resourceObjectRead(ctx context.Context, d *schema.ResourceData, meta interf
 		return sdkdiag.AppendErrorf(diags, "reading S3 Object (%s): %s", d.Id(), err)
 	}
 
-	output := outputRaw.(*s3.HeadObjectOutput)
-
 	d.Set("bucket_key_enabled", output.BucketKeyEnabled)
 	d.Set("cache_control", output.CacheControl)
+	d.Set("checksum_crc32", output.ChecksumCRC32)
+	d.Set("checksum_crc32c", output.ChecksumCRC32C)
+	d.Set("checksum_sha1", output.ChecksumSHA1)
+	d.Set("checksum_sha256", output.ChecksumSHA256)
 	d.Set("content_disposition", output.ContentDisposition)
 	d.Set("content_encoding", output.ContentEncoding)
 	d.Set("content_language", output.ContentLanguage)
 	d.Set("content_type", output.ContentType)
-	metadata := flex.PointersMapToStringList(output.Metadata)
-
-	// AWS Go SDK capitalizes metadata, this is a workaround. https://github.com/aws/aws-sdk-go/issues/445
-	for k, v := range metadata {
-		delete(metadata, k)
-		metadata[strings.ToLower(k)] = v
-	}
-
-	if err := d.Set("metadata", metadata); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting metadata: %s", err)
-	}
-	d.Set("version_id", output.VersionId)
-	d.Set("server_side_encryption", output.ServerSideEncryption)
-	d.Set("website_redirect", output.WebsiteRedirectLocation)
+	// See https://forums.aws.amazon.com/thread.jspa?threadID=44003
+	d.Set("etag", strings.Trim(aws.ToString(output.ETag), `"`))
+	d.Set("metadata", output.Metadata)
 	d.Set("object_lock_legal_hold_status", output.ObjectLockLegalHoldStatus)
 	d.Set("object_lock_mode", output.ObjectLockMode)
 	d.Set("object_lock_retain_until_date", flattenObjectDate(output.ObjectLockRetainUntilDate))
-
-	if err := resourceObjectSetKMS(ctx, d, meta, output.SSEKMSKeyId); err != nil {
-		return sdkdiag.AppendErrorf(diags, "object KMS: %s", err)
-	}
-
-	// See https://forums.aws.amazon.com/thread.jspa?threadID=44003
-	d.Set("etag", strings.Trim(aws.StringValue(output.ETag), `"`))
-
+	d.Set("server_side_encryption", output.ServerSideEncryption)
 	// The "STANDARD" (which is also the default) storage
 	// class when set would not be included in the results.
-	if output.StorageClass == nil {
-		d.Set("storage_class", s3.StorageClassStandard)
-	} else {
+	d.Set("storage_class", types.ObjectStorageClassStandard)
+	if output.StorageClass != "" {
 		d.Set("storage_class", output.StorageClass)
 	}
+	d.Set("version_id", output.VersionId)
+	d.Set("website_redirect", output.WebsiteRedirectLocation)
 
-	// Retry due to S3 eventual consistency
-	tagsRaw, err := tfresource.RetryWhenAWSErrCodeEquals(ctx, 2*time.Minute, func() (interface{}, error) {
-		return ObjectListTags(ctx, conn, bucket, key)
-	}, s3.ErrCodeNoSuchBucket)
-
-	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "listing tags for S3 Bucket (%s) Object (%s): %s", bucket, key, err)
+	if err := resourceObjectSetKMS(ctx, d, meta, output.SSEKMSKeyId); err != nil {
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
-	tags, ok := tagsRaw.(tftags.KeyValueTags)
+	tags, err := ObjectListTags(ctx, conn, bucket, key)
 
-	if !ok {
-		return sdkdiag.AppendErrorf(diags, "listing tags for S3 Bucket (%s) Object (%s): unable to convert tags", bucket, key)
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "listing tags for S3 Bucket (%s) Object (%s): %s", bucket, key, err)
 	}
 
 	setTagsOut(ctx, Tags(tags))
@@ -282,41 +285,47 @@ func resourceObjectUpdate(ctx context.Context, d *schema.ResourceData, meta inte
 		return append(diags, resourceObjectUpload(ctx, d, meta)...)
 	}
 
-	conn := meta.(*conns.AWSClient).S3Conn(ctx)
+	conn := meta.(*conns.AWSClient).S3Client(ctx)
 
 	bucket := d.Get("bucket").(string)
-	key := d.Get("key").(string)
+	key := sdkv1CompatibleCleanKey(d.Get("key").(string))
 
 	if d.HasChange("acl") {
-		_, err := conn.PutObjectAclWithContext(ctx, &s3.PutObjectAclInput{
+		input := &s3.PutObjectAclInput{
+			ACL:    types.ObjectCannedACL(d.Get("acl").(string)),
 			Bucket: aws.String(bucket),
 			Key:    aws.String(key),
-			ACL:    aws.String(d.Get("acl").(string)),
-		})
+		}
+
+		_, err := conn.PutObjectAcl(ctx, input)
+
 		if err != nil {
-			return sdkdiag.AppendErrorf(diags, "putting S3 object ACL: %s", err)
+			return sdkdiag.AppendErrorf(diags, "putting S3 Object (%s) ACL: %s", d.Id(), err)
 		}
 	}
 
 	if d.HasChange("object_lock_legal_hold_status") {
-		_, err := conn.PutObjectLegalHoldWithContext(ctx, &s3.PutObjectLegalHoldInput{
+		input := &s3.PutObjectLegalHoldInput{
 			Bucket: aws.String(bucket),
 			Key:    aws.String(key),
-			LegalHold: &s3.ObjectLockLegalHold{
-				Status: aws.String(d.Get("object_lock_legal_hold_status").(string)),
+			LegalHold: &types.ObjectLockLegalHold{
+				Status: types.ObjectLockLegalHoldStatus(d.Get("object_lock_legal_hold_status").(string)),
 			},
-		})
+		}
+
+		_, err := conn.PutObjectLegalHold(ctx, input)
+
 		if err != nil {
-			return sdkdiag.AppendErrorf(diags, "putting S3 object lock legal hold: %s", err)
+			return sdkdiag.AppendErrorf(diags, "putting S3 Object (%s) legal hold: %s", d.Id(), err)
 		}
 	}
 
 	if d.HasChanges("object_lock_mode", "object_lock_retain_until_date") {
-		req := &s3.PutObjectRetentionInput{
+		input := &s3.PutObjectRetentionInput{
 			Bucket: aws.String(bucket),
 			Key:    aws.String(key),
-			Retention: &s3.ObjectLockRetention{
-				Mode:            aws.String(d.Get("object_lock_mode").(string)),
+			Retention: &types.ObjectLockRetention{
+				Mode:            types.ObjectLockRetentionMode(d.Get("object_lock_mode").(string)),
 				RetainUntilDate: expandObjectDate(d.Get("object_lock_retain_until_date").(string)),
 			},
 		}
@@ -324,16 +333,17 @@ func resourceObjectUpdate(ctx context.Context, d *schema.ResourceData, meta inte
 		// Bypass required to lower or clear retain-until date.
 		if d.HasChange("object_lock_retain_until_date") {
 			oraw, nraw := d.GetChange("object_lock_retain_until_date")
-			o := expandObjectDate(oraw.(string))
-			n := expandObjectDate(nraw.(string))
+			o, n := expandObjectDate(oraw.(string)), expandObjectDate(nraw.(string))
+
 			if n == nil || (o != nil && n.Before(*o)) {
-				req.BypassGovernanceRetention = aws.Bool(true)
+				input.BypassGovernanceRetention = true
 			}
 		}
 
-		_, err := conn.PutObjectRetentionWithContext(ctx, req)
+		_, err := conn.PutObjectRetention(ctx, input)
+
 		if err != nil {
-			return sdkdiag.AppendErrorf(diags, "putting S3 object lock retention: %s", err)
+			return sdkdiag.AppendErrorf(diags, "putting S3 Object (%s) retention: %s", d.Id(), err)
 		}
 	}
 
@@ -350,18 +360,14 @@ func resourceObjectUpdate(ctx context.Context, d *schema.ResourceData, meta inte
 
 func resourceObjectDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).S3Conn(ctx)
+	conn := meta.(*conns.AWSClient).S3Client(ctx)
 
 	bucket := d.Get("bucket").(string)
-	key := d.Get("key").(string)
-	// We are effectively ignoring all leading '/'s in the key name and
-	// treating multiple '/'s as a single '/' as aws.Config.DisableRestProtocolURICleaning is false
-	key = strings.TrimLeft(key, "/")
-	key = regexp.MustCompile(`/+`).ReplaceAllString(key, "/")
+	key := sdkv1CompatibleCleanKey(d.Get("key").(string))
 
 	var err error
 	if _, ok := d.GetOk("version_id"); ok {
-		_, err = DeleteAllObjectVersions(ctx, conn, bucket, key, d.Get("force_destroy").(bool), false)
+		_, err = deleteAllObjectVersions(ctx, conn, bucket, key, d.Get("force_destroy").(bool), false)
 	} else {
 		err = deleteObjectVersion(ctx, conn, bucket, key, "", false)
 	}
@@ -394,8 +400,8 @@ func resourceObjectImport(ctx context.Context, d *schema.ResourceData, meta inte
 
 func resourceObjectUpload(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).S3Conn(ctx)
-	uploader := s3manager.NewUploaderWithClient(conn)
+	conn := meta.(*conns.AWSClient).S3Client(ctx)
+	uploader := manager.NewUploader(conn)
 	defaultTagsConfig := meta.(*conns.AWSClient).DefaultTagsConfig
 	tags := defaultTagsConfig.MergeTags(tftags.New(ctx, d.Get("tags").(map[string]interface{})))
 
@@ -435,33 +441,30 @@ func resourceObjectUpload(ctx context.Context, d *schema.ResourceData, meta inte
 		body = bytes.NewReader([]byte{})
 	}
 
-	bucket := d.Get("bucket").(string)
-	key := d.Get("key").(string)
-
-	input := &s3manager.UploadInput{
+	input := &s3.PutObjectInput{
 		Body:   body,
-		Bucket: aws.String(bucket),
-		Key:    aws.String(key),
+		Bucket: aws.String(d.Get("bucket").(string)),
+		Key:    aws.String(sdkv1CompatibleCleanKey(d.Get("key").(string))),
 	}
 
 	if v, ok := d.GetOk("acl"); ok {
-		input.ACL = aws.String(v.(string))
+		input.ACL = types.ObjectCannedACL(v.(string))
 	}
 
-	if v, ok := d.GetOk("storage_class"); ok {
-		input.StorageClass = aws.String(v.(string))
+	if v, ok := d.GetOk("bucket_key_enabled"); ok {
+		input.BucketKeyEnabled = v.(bool)
 	}
 
 	if v, ok := d.GetOk("cache_control"); ok {
 		input.CacheControl = aws.String(v.(string))
 	}
 
-	if v, ok := d.GetOk("content_type"); ok {
-		input.ContentType = aws.String(v.(string))
+	if v, ok := d.GetOk("checksum_algorithm"); ok {
+		input.ChecksumAlgorithm = types.ChecksumAlgorithm(v.(string))
 	}
 
-	if v, ok := d.GetOk("metadata"); ok {
-		input.Metadata = flex.ExpandStringMap(v.(map[string]interface{}))
+	if v, ok := d.GetOk("content_disposition"); ok {
+		input.ContentDisposition = aws.String(v.(string))
 	}
 
 	if v, ok := d.GetOk("content_encoding"); ok {
@@ -472,21 +475,37 @@ func resourceObjectUpload(ctx context.Context, d *schema.ResourceData, meta inte
 		input.ContentLanguage = aws.String(v.(string))
 	}
 
-	if v, ok := d.GetOk("content_disposition"); ok {
-		input.ContentDisposition = aws.String(v.(string))
+	if v, ok := d.GetOk("content_type"); ok {
+		input.ContentType = aws.String(v.(string))
 	}
 
-	if v, ok := d.GetOk("bucket_key_enabled"); ok {
-		input.BucketKeyEnabled = aws.Bool(v.(bool))
+	if v, ok := d.GetOk("kms_key_id"); ok {
+		input.SSEKMSKeyId = aws.String(v.(string))
+		input.ServerSideEncryption = types.ServerSideEncryptionAwsKms
+	}
+
+	if v, ok := d.GetOk("metadata"); ok {
+		input.Metadata = flex.ExpandStringValueMap(v.(map[string]interface{}))
+	}
+
+	if v, ok := d.GetOk("object_lock_legal_hold_status"); ok {
+		input.ObjectLockLegalHoldStatus = types.ObjectLockLegalHoldStatus(v.(string))
+	}
+
+	if v, ok := d.GetOk("object_lock_mode"); ok {
+		input.ObjectLockMode = types.ObjectLockMode(v.(string))
+	}
+
+	if v, ok := d.GetOk("object_lock_retain_until_date"); ok {
+		input.ObjectLockRetainUntilDate = expandObjectDate(v.(string))
 	}
 
 	if v, ok := d.GetOk("server_side_encryption"); ok {
-		input.ServerSideEncryption = aws.String(v.(string))
+		input.ServerSideEncryption = types.ServerSideEncryption(v.(string))
 	}
 
-	if v, ok := d.GetOk("kms_key_id"); ok {
-		input.SSEKMSKeyId = aws.String(v.(string))
-		input.ServerSideEncryption = aws.String(s3.ServerSideEncryptionAwsKms)
+	if v, ok := d.GetOk("storage_class"); ok {
+		input.StorageClass = types.StorageClass(v.(string))
 	}
 
 	if len(tags) > 0 {
@@ -498,24 +517,20 @@ func resourceObjectUpload(ctx context.Context, d *schema.ResourceData, meta inte
 		input.WebsiteRedirectLocation = aws.String(v.(string))
 	}
 
-	if v, ok := d.GetOk("object_lock_legal_hold_status"); ok {
-		input.ObjectLockLegalHoldStatus = aws.String(v.(string))
-	}
-
-	if v, ok := d.GetOk("object_lock_mode"); ok {
-		input.ObjectLockMode = aws.String(v.(string))
+	if (input.ObjectLockLegalHoldStatus != "" || input.ObjectLockMode != "" || input.ObjectLockRetainUntilDate != nil) && input.ChecksumAlgorithm == "" {
+		// "Content-MD5 OR x-amz-checksum- HTTP header is required for Put Object requests with Object Lock parameters".
+		// AWS SDK for Go v1 transparently added a Content-MD4 header.
+		input.ChecksumAlgorithm = types.ChecksumAlgorithmCrc32
 	}
 
-	if v, ok := d.GetOk("object_lock_retain_until_date"); ok {
-		input.ObjectLockRetainUntilDate = expandObjectDate(v.(string))
+	if _, err := uploader.Upload(ctx, input); err != nil {
+		return sdkdiag.AppendErrorf(diags, "uploading S3 Object (%s) to Bucket (%s): %s", aws.ToString(input.Key), aws.ToString(input.Bucket), err)
 	}
 
-	if _, err := uploader.Upload(input); err != nil {
-		return sdkdiag.AppendErrorf(diags, "uploading object to S3 bucket (%s): %s", bucket, err)
+	if d.IsNewResource() {
+		d.SetId(d.Get("key").(string))
 	}
 
-	d.SetId(key)
-
 	return append(diags, resourceObjectRead(ctx, d, meta)...)
 }
 
@@ -529,8 +544,8 @@ func resourceObjectSetKMS(ctx context.Context, d *schema.ResourceData, meta inte
 			return fmt.Errorf("Failed to describe default S3 KMS key (%s): %s", DefaultKMSKeyAlias, err)
 		}
 
-		if aws.StringValue(sseKMSKeyId) != aws.StringValue(keyMetadata.Arn) {
-			log.Printf("[DEBUG] S3 object is encrypted using a non-default KMS Key ID: %s", aws.StringValue(sseKMSKeyId))
+		if kmsKeyID := aws.ToString(sseKMSKeyId); kmsKeyID != aws.ToString(keyMetadata.Arn) {
+			log.Printf("[DEBUG] S3 object is encrypted using a non-default KMS Key ID: %s", kmsKeyID)
 			d.Set("kms_key_id", sseKMSKeyId)
 		}
 	}
@@ -567,6 +582,7 @@ func hasObjectContentChanges(d verify.ResourceDiffer) bool {
 	for _, key := range []string{
 		"bucket_key_enabled",
 		"cache_control",
+		"checksum_algorithm",
 		"content_base64",
 		"content_disposition",
 		"content_encoding",
@@ -589,184 +605,40 @@ func hasObjectContentChanges(d verify.ResourceDiffer) bool {
 	return false
 }
 
-// DeleteAllObjectVersions deletes all versions of a specified key from an S3 bucket.
-// If key is empty then all versions of all objects are deleted.
-// Set force to true to override any S3 object lock protections on object lock enabled buckets.
-// Returns the number of objects deleted.
-func DeleteAllObjectVersions(ctx context.Context, conn *s3.S3, bucketName, key string, force, ignoreObjectErrors bool) (int64, error) {
-	var nObjects int64
-
-	input := &s3.ListObjectVersionsInput{
-		Bucket: aws.String(bucketName),
-	}
-	if key != "" {
-		input.Prefix = aws.String(key)
-	}
-
-	var lastErr error
-	err := conn.ListObjectVersionsPagesWithContext(ctx, input, func(page *s3.ListObjectVersionsOutput, lastPage bool) bool {
-		if page == nil {
-			return !lastPage
-		}
-
-		for _, objectVersion := range page.Versions {
-			objectKey := aws.StringValue(objectVersion.Key)
-			objectVersionID := aws.StringValue(objectVersion.VersionId)
-
-			if key != "" && key != objectKey {
-				continue
-			}
-
-			err := deleteObjectVersion(ctx, conn, bucketName, objectKey, objectVersionID, force)
-
-			if err == nil {
-				nObjects++
-			}
-
-			if tfawserr.ErrCodeEquals(err, "AccessDenied") && force {
-				// Remove any legal hold.
-				resp, err := conn.HeadObjectWithContext(ctx, &s3.HeadObjectInput{
-					Bucket:    aws.String(bucketName),
-					Key:       objectVersion.Key,
-					VersionId: objectVersion.VersionId,
-				})
-
-				if err != nil {
-					log.Printf("[ERROR] Error getting S3 Bucket (%s) Object (%s) Version (%s) metadata: %s", bucketName, objectKey, objectVersionID, err)
-					lastErr = err
-					continue
-				}
-
-				if aws.StringValue(resp.ObjectLockLegalHoldStatus) == s3.ObjectLockLegalHoldStatusOn {
-					_, err := conn.PutObjectLegalHoldWithContext(ctx, &s3.PutObjectLegalHoldInput{
-						Bucket:    aws.String(bucketName),
-						Key:       objectVersion.Key,
-						VersionId: objectVersion.VersionId,
-						LegalHold: &s3.ObjectLockLegalHold{
-							Status: aws.String(s3.ObjectLockLegalHoldStatusOff),
-						},
-					})
-
-					if err != nil {
-						log.Printf("[ERROR] Error putting S3 Bucket (%s) Object (%s) Version(%s) legal hold: %s", bucketName, objectKey, objectVersionID, err)
-						lastErr = err
-						continue
-					}
-
-					// Attempt to delete again.
-					err = deleteObjectVersion(ctx, conn, bucketName, objectKey, objectVersionID, force)
-
-					if err != nil {
-						lastErr = err
-					} else {
-						nObjects++
-					}
-
-					continue
-				}
-
-				// AccessDenied for another reason.
-				lastErr = fmt.Errorf("AccessDenied deleting S3 Bucket (%s) Object (%s) Version: %s", bucketName, objectKey, objectVersionID)
-				continue
-			}
-
-			if err != nil {
-				lastErr = err
-			}
-		}
-
-		return !lastPage
-	})
-
-	if tfawserr.ErrCodeEquals(err, s3.ErrCodeNoSuchBucket) {
-		err = nil
-	}
-
-	if err != nil {
-		return nObjects, err
-	}
-
-	if lastErr != nil {
-		if !ignoreObjectErrors {
-			return nObjects, fmt.Errorf("deleting at least one object version, last error: %s", lastErr)
-		}
-
-		lastErr = nil
-	}
-
-	err = conn.ListObjectVersionsPagesWithContext(ctx, input, func(page *s3.ListObjectVersionsOutput, lastPage bool) bool {
-		if page == nil {
-			return !lastPage
-		}
-
-		for _, deleteMarker := range page.DeleteMarkers {
-			deleteMarkerKey := aws.StringValue(deleteMarker.Key)
-			deleteMarkerVersionID := aws.StringValue(deleteMarker.VersionId)
-
-			if key != "" && key != deleteMarkerKey {
-				continue
-			}
-
-			// Delete markers have no object lock protections.
-			err := deleteObjectVersion(ctx, conn, bucketName, deleteMarkerKey, deleteMarkerVersionID, false)
-
-			if err != nil {
-				lastErr = err
-			} else {
-				nObjects++
-			}
-		}
-
-		return !lastPage
-	})
-
-	if tfawserr.ErrCodeEquals(err, s3.ErrCodeNoSuchBucket) {
-		err = nil
+func findObjectByBucketAndKey(ctx context.Context, conn *s3.Client, bucket, key, etag, checksumAlgorithm string) (*s3.HeadObjectOutput, error) {
+	input := &s3.HeadObjectInput{
+		Bucket: aws.String(bucket),
+		Key:    aws.String(key),
 	}
-
-	if err != nil {
-		return nObjects, err
+	if checksumAlgorithm != "" {
+		input.ChecksumMode = types.ChecksumModeEnabled
 	}
-
-	if lastErr != nil {
-		if !ignoreObjectErrors {
-			return nObjects, fmt.Errorf("deleting at least one object delete marker, last error: %s", lastErr)
-		}
-
-		lastErr = nil
+	if etag != "" {
+		input.IfMatch = aws.String(etag)
 	}
 
-	return nObjects, nil
+	return findObject(ctx, conn, input)
 }
 
-// deleteObjectVersion deletes a specific object version.
-// Set force to true to override any S3 object lock protections.
-func deleteObjectVersion(ctx context.Context, conn *s3.S3, b, k, v string, force bool) error {
-	input := &s3.DeleteObjectInput{
-		Bucket: aws.String(b),
-		Key:    aws.String(k),
-	}
+func findObject(ctx context.Context, conn *s3.Client, input *s3.HeadObjectInput) (*s3.HeadObjectOutput, error) {
+	output, err := conn.HeadObject(ctx, input)
 
-	if v != "" {
-		input.VersionId = aws.String(v)
-	}
-
-	if force {
-		input.BypassGovernanceRetention = aws.Bool(true)
+	if tfawserr.ErrHTTPStatusCodeEquals(err, http.StatusNotFound) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
 	}
 
-	log.Printf("[INFO] Deleting S3 Bucket (%s) Object (%s) Version: %s", b, k, v)
-	_, err := conn.DeleteObjectWithContext(ctx, input)
-
 	if err != nil {
-		log.Printf("[WARN] Error deleting S3 Bucket (%s) Object (%s) Version (%s): %s", b, k, v, err)
+		return nil, err
 	}
 
-	if tfawserr.ErrCodeEquals(err, s3.ErrCodeNoSuchBucket) || tfawserr.ErrCodeEquals(err, s3.ErrCodeNoSuchKey) {
-		return nil
+	if output == nil {
+		return nil, tfresource.NewEmptyResultError(input)
 	}
 
-	return err
+	return output, nil
 }
 
 func expandObjectDate(v string) *time.Time {
@@ -786,31 +658,14 @@ func flattenObjectDate(t *time.Time) string {
 	return t.Format(time.RFC3339)
 }
 
-func FindObjectByThreePartKey(ctx context.Context, conn *s3.S3, bucket, key, etag string) (*s3.HeadObjectOutput, error) {
-	input := &s3.HeadObjectInput{
-		Bucket: aws.String(bucket),
-		Key:    aws.String(key),
-	}
-	if etag != "" {
-		input.IfMatch = aws.String(etag)
-	}
-
-	output, err := conn.HeadObjectWithContext(ctx, input)
-
-	if tfawserr.ErrStatusCodeEquals(err, http.StatusNotFound) {
-		return nil, &retry.NotFoundError{
-			LastError:   err,
-			LastRequest: input,
-		}
-	}
-
-	if err != nil {
-		return nil, err
-	}
-
-	if output == nil {
-		return nil, tfresource.NewEmptyResultError(input)
-	}
-
-	return output, nil
+// sdkv1CompatibleCleanKey returns an AWS SDK for Go v1 compatible clean key.
+// DisableRestProtocolURICleaning was false on the standard S3Conn, so to ensure backwards
+// compatibility we must "clean" the configured key before passing to AWS SDK for Go v2 APIs.
+// See https://docs.aws.amazon.com/sdk-for-go/api/service/s3/#hdr-Automatic_URI_cleaning.
+// See https://github.com/aws/aws-sdk-go/blob/cf903c8c543034654bb8f53b5f9d6454fdb2117f/private/protocol/rest/build.go#L247-L258.
+func sdkv1CompatibleCleanKey(key string) string {
+	// We are effectively ignoring all leading '/'s and treating multiple '/'s as a single '/'.
+	key = strings.TrimLeft(key, "/")
+	key = regexache.MustCompile(`/+`).ReplaceAllString(key, "/")
+	return key
 }
diff --git a/internal/service/s3/object_copy.go b/internal/service/s3/object_copy.go
index b3237669406..8cc595685b9 100644
--- a/internal/service/s3/object_copy.go
+++ b/internal/service/s3/object_copy.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3
 
 import (
@@ -6,17 +9,17 @@ import (
 	"fmt"
 	"log"
 	"net/url"
-	"regexp"
 	"strings"
-	"time"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/s3"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/s3"
+	"github.com/aws/aws-sdk-go-v2/service/s3/types"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/create"
+	"github.com/hashicorp/terraform-provider-aws/internal/enum"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
 	"github.com/hashicorp/terraform-provider-aws/internal/flex"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
@@ -36,10 +39,11 @@ func ResourceObjectCopy() *schema.Resource {
 
 		Schema: map[string]*schema.Schema{
 			"acl": {
-				Type:          schema.TypeString,
-				Optional:      true,
-				ValidateFunc:  validation.StringInSlice(s3.ObjectCannedACL_Values(), false),
-				ConflictsWith: []string{"grant"},
+				Type:             schema.TypeString,
+				Optional:         true,
+				Computed:         true,
+				ValidateDiagFunc: enum.Validate[types.ObjectCannedACL](),
+				ConflictsWith:    []string{"grant"},
 			},
 			"bucket": {
 				Type:         schema.TypeString,
@@ -57,6 +61,27 @@ func ResourceObjectCopy() *schema.Resource {
 				Optional: true,
 				Computed: true,
 			},
+			"checksum_algorithm": {
+				Type:             schema.TypeString,
+				Optional:         true,
+				ValidateDiagFunc: enum.Validate[types.ChecksumAlgorithm](),
+			},
+			"checksum_crc32": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"checksum_crc32c": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"checksum_sha1": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"checksum_sha256": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
 			"content_disposition": {
 				Type:     schema.TypeString,
 				Optional: true,
@@ -154,22 +179,21 @@ func ResourceObjectCopy() *schema.Resource {
 						"permissions": {
 							Type:     schema.TypeSet,
 							Required: true,
-							Set:      schema.HashString,
 							Elem: &schema.Schema{
 								Type: schema.TypeString,
-								ValidateFunc: validation.StringInSlice([]string{
+								ValidateDiagFunc: validation.ToDiagFunc(validation.StringInSlice(enum.Slice(
 									//write permission not valid here
-									s3.PermissionFullControl,
-									s3.PermissionRead,
-									s3.PermissionReadAcp,
-									s3.PermissionWriteAcp,
-								}, false),
+									types.PermissionFullControl,
+									types.PermissionRead,
+									types.PermissionReadAcp,
+									types.PermissionWriteAcp,
+								), false)),
 							},
 						},
 						"type": {
-							Type:         schema.TypeString,
-							Required:     true,
-							ValidateFunc: validation.StringInSlice(s3.Type_Values(), false),
+							Type:             schema.TypeString,
+							Required:         true,
+							ValidateDiagFunc: enum.Validate[types.Type](),
 						},
 						"uri": {
 							Type:     schema.TypeString,
@@ -210,21 +234,21 @@ func ResourceObjectCopy() *schema.Resource {
 				Elem:         &schema.Schema{Type: schema.TypeString},
 			},
 			"metadata_directive": {
-				Type:         schema.TypeString,
-				Optional:     true,
-				ValidateFunc: validation.StringInSlice(s3.MetadataDirective_Values(), false),
+				Type:             schema.TypeString,
+				Optional:         true,
+				ValidateDiagFunc: enum.Validate[types.MetadataDirective](),
 			},
 			"object_lock_legal_hold_status": {
-				Type:         schema.TypeString,
-				Optional:     true,
-				Computed:     true,
-				ValidateFunc: validation.StringInSlice(s3.ObjectLockLegalHoldStatus_Values(), false),
+				Type:             schema.TypeString,
+				Optional:         true,
+				Computed:         true,
+				ValidateDiagFunc: enum.Validate[types.ObjectLockLegalHoldStatus](),
 			},
 			"object_lock_mode": {
-				Type:         schema.TypeString,
-				Optional:     true,
-				Computed:     true,
-				ValidateFunc: validation.StringInSlice(s3.ObjectLockMode_Values(), false),
+				Type:             schema.TypeString,
+				Optional:         true,
+				Computed:         true,
+				ValidateDiagFunc: enum.Validate[types.ObjectLockMode](),
 			},
 			"object_lock_retain_until_date": {
 				Type:         schema.TypeString,
@@ -237,15 +261,15 @@ func ResourceObjectCopy() *schema.Resource {
 				Computed: true,
 			},
 			"request_payer": {
-				Type:         schema.TypeString,
-				Optional:     true,
-				ValidateFunc: validation.StringInSlice(s3.RequestPayer_Values(), false),
+				Type:             schema.TypeString,
+				Optional:         true,
+				ValidateDiagFunc: enum.Validate[types.RequestPayer](),
 			},
 			"server_side_encryption": {
-				Type:         schema.TypeString,
-				Optional:     true,
-				Computed:     true,
-				ValidateFunc: validation.StringInSlice(s3.ServerSideEncryption_Values(), false),
+				Type:             schema.TypeString,
+				Optional:         true,
+				Computed:         true,
+				ValidateDiagFunc: enum.Validate[types.ServerSideEncryption](),
 			},
 			"source": {
 				Type:         schema.TypeString,
@@ -271,15 +295,15 @@ func ResourceObjectCopy() *schema.Resource {
 				Computed: true,
 			},
 			"storage_class": {
-				Type:         schema.TypeString,
-				Optional:     true,
-				Computed:     true,
-				ValidateFunc: validation.StringInSlice(s3.ObjectStorageClass_Values(), false),
+				Type:             schema.TypeString,
+				Optional:         true,
+				Computed:         true,
+				ValidateDiagFunc: enum.Validate[types.ObjectStorageClass](),
 			},
 			"tagging_directive": {
-				Type:         schema.TypeString,
-				Optional:     true,
-				ValidateFunc: validation.StringInSlice(s3.TaggingDirective_Values(), false),
+				Type:             schema.TypeString,
+				Optional:         true,
+				ValidateDiagFunc: enum.Validate[types.TaggingDirective](),
 			},
 			names.AttrTags:    tftags.TagsSchema(),
 			names.AttrTagsAll: tftags.TagsSchemaComputed(),
@@ -305,11 +329,11 @@ func resourceObjectCopyCreate(ctx context.Context, d *schema.ResourceData, meta
 
 func resourceObjectCopyRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).S3Conn(ctx)
+	conn := meta.(*conns.AWSClient).S3Client(ctx)
 
 	bucket := d.Get("bucket").(string)
-	key := d.Get("key").(string)
-	output, err := FindObjectByThreePartKey(ctx, conn, bucket, key, "")
+	key := sdkv1CompatibleCleanKey(d.Get("key").(string))
+	output, err := findObjectByBucketAndKey(ctx, conn, bucket, key, "", d.Get("checksum_algorithm").(string))
 
 	if !d.IsNewResource() && tfresource.NotFound(err) {
 		log.Printf("[WARN] S3 Object (%s) not found, removing from state", d.Id())
@@ -323,55 +347,43 @@ func resourceObjectCopyRead(ctx context.Context, d *schema.ResourceData, meta in
 
 	d.Set("bucket_key_enabled", output.BucketKeyEnabled)
 	d.Set("cache_control", output.CacheControl)
+	d.Set("checksum_crc32", output.ChecksumCRC32)
+	d.Set("checksum_crc32c", output.ChecksumCRC32C)
+	d.Set("checksum_sha1", output.ChecksumSHA1)
+	d.Set("checksum_sha256", output.ChecksumSHA256)
 	d.Set("content_disposition", output.ContentDisposition)
 	d.Set("content_encoding", output.ContentEncoding)
 	d.Set("content_language", output.ContentLanguage)
 	d.Set("content_type", output.ContentType)
-	metadata := flex.PointersMapToStringList(output.Metadata)
-
-	// AWS Go SDK capitalizes metadata, this is a workaround. https://github.com/aws/aws-sdk-go/issues/445
-	for k, v := range metadata {
-		delete(metadata, k)
-		metadata[strings.ToLower(k)] = v
-	}
-
-	if err := d.Set("metadata", metadata); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting metadata: %s", err)
-	}
-	d.Set("version_id", output.VersionId)
-	d.Set("server_side_encryption", output.ServerSideEncryption)
-	d.Set("website_redirect", output.WebsiteRedirectLocation)
+	d.Set("customer_algorithm", output.SSECustomerAlgorithm)
+	d.Set("customer_key_md5", output.SSECustomerKeyMD5)
+	// See https://forums.aws.amazon.com/thread.jspa?threadID=44003
+	d.Set("etag", strings.Trim(aws.ToString(output.ETag), `"`))
+	d.Set("expiration", output.Expiration)
+	d.Set("kms_key_id", output.SSEKMSKeyId)
+	d.Set("last_modified", flattenObjectDate(output.LastModified))
+	d.Set("metadata", output.Metadata)
 	d.Set("object_lock_legal_hold_status", output.ObjectLockLegalHoldStatus)
 	d.Set("object_lock_mode", output.ObjectLockMode)
 	d.Set("object_lock_retain_until_date", flattenObjectDate(output.ObjectLockRetainUntilDate))
-
-	if err := resourceObjectSetKMS(ctx, d, meta, output.SSEKMSKeyId); err != nil {
-		return sdkdiag.AppendErrorf(diags, "object KMS: %s", err)
-	}
-
-	// See https://forums.aws.amazon.com/thread.jspa?threadID=44003
-	d.Set("etag", strings.Trim(aws.StringValue(output.ETag), `"`))
-
+	d.Set("server_side_encryption", output.ServerSideEncryption)
 	// The "STANDARD" (which is also the default) storage
 	// class when set would not be included in the results.
-	d.Set("storage_class", s3.ObjectStorageClassStandard)
-	if output.StorageClass != nil { // nosemgrep: ci.helper-schema-ResourceData-Set-extraneous-nil-check
+	d.Set("storage_class", types.ObjectStorageClassStandard)
+	if output.StorageClass != "" {
 		d.Set("storage_class", output.StorageClass)
 	}
+	d.Set("version_id", output.VersionId)
+	d.Set("website_redirect", output.WebsiteRedirectLocation)
 
-	// Retry due to S3 eventual consistency
-	tagsRaw, err := tfresource.RetryWhenAWSErrCodeEquals(ctx, 2*time.Minute, func() (interface{}, error) {
-		return ObjectListTags(ctx, conn, bucket, key)
-	}, s3.ErrCodeNoSuchBucket)
-
-	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "listing tags for S3 Bucket (%s) Object (%s): %s", bucket, key, err)
+	if err := resourceObjectSetKMS(ctx, d, meta, output.SSEKMSKeyId); err != nil {
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
-	tags, ok := tagsRaw.(tftags.KeyValueTags)
+	tags, err := ObjectListTags(ctx, conn, bucket, key)
 
-	if !ok {
-		return sdkdiag.AppendErrorf(diags, "listing tags for S3 Bucket (%s) Object (%s): unable to convert tags", bucket, key)
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "listing tags for S3 Bucket (%s) Object (%s): %s", bucket, key, err)
 	}
 
 	setTagsOut(ctx, Tags(tags))
@@ -380,10 +392,9 @@ func resourceObjectCopyRead(ctx context.Context, d *schema.ResourceData, meta in
 }
 
 func resourceObjectCopyUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	var
-	// if any of these exist, let the API decide whether to copy
-	diags diag.Diagnostics
+	var diags diag.Diagnostics
 
+	// if any of these exist, let the API decide whether to copy
 	for _, key := range []string{
 		"copy_if_match",
 		"copy_if_modified_since",
@@ -400,6 +411,7 @@ func resourceObjectCopyUpdate(ctx context.Context, d *schema.ResourceData, meta
 		"bucket",
 		"bucket_key_enabled",
 		"cache_control",
+		"checksum_algorithm",
 		"content_disposition",
 		"content_encoding",
 		"content_language",
@@ -440,18 +452,14 @@ func resourceObjectCopyUpdate(ctx context.Context, d *schema.ResourceData, meta
 
 func resourceObjectCopyDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).S3Conn(ctx)
+	conn := meta.(*conns.AWSClient).S3Client(ctx)
 
 	bucket := d.Get("bucket").(string)
-	key := d.Get("key").(string)
-	// We are effectively ignoring all leading '/'s in the key name and
-	// treating multiple '/'s as a single '/' as aws.Config.DisableRestProtocolURICleaning is false
-	key = strings.TrimLeft(key, "/")
-	key = regexp.MustCompile(`/+`).ReplaceAllString(key, "/")
+	key := sdkv1CompatibleCleanKey(d.Get("key").(string))
 
 	var err error
 	if _, ok := d.GetOk("version_id"); ok {
-		_, err = DeleteAllObjectVersions(ctx, conn, bucket, key, d.Get("force_destroy").(bool), false)
+		_, err = deleteAllObjectVersions(ctx, conn, bucket, key, d.Get("force_destroy").(bool), false)
 	} else {
 		err = deleteObjectVersion(ctx, conn, bucket, key, "", false)
 	}
@@ -464,28 +472,32 @@ func resourceObjectCopyDelete(ctx context.Context, d *schema.ResourceData, meta
 
 func resourceObjectCopyDoCopy(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).S3Conn(ctx)
+	conn := meta.(*conns.AWSClient).S3Client(ctx)
 	defaultTagsConfig := meta.(*conns.AWSClient).DefaultTagsConfig
 	tags := defaultTagsConfig.MergeTags(tftags.New(ctx, d.Get("tags").(map[string]interface{})))
 
 	input := &s3.CopyObjectInput{
 		Bucket:     aws.String(d.Get("bucket").(string)),
-		Key:        aws.String(d.Get("key").(string)),
 		CopySource: aws.String(url.QueryEscape(d.Get("source").(string))),
+		Key:        aws.String(sdkv1CompatibleCleanKey(d.Get("key").(string))),
 	}
 
 	if v, ok := d.GetOk("acl"); ok {
-		input.ACL = aws.String(v.(string))
+		input.ACL = types.ObjectCannedACL(v.(string))
 	}
 
 	if v, ok := d.GetOk("bucket_key_enabled"); ok {
-		input.BucketKeyEnabled = aws.Bool(v.(bool))
+		input.BucketKeyEnabled = v.(bool)
 	}
 
 	if v, ok := d.GetOk("cache_control"); ok {
 		input.CacheControl = aws.String(v.(string))
 	}
 
+	if v, ok := d.GetOk("checksum_algorithm"); ok {
+		input.ChecksumAlgorithm = types.ChecksumAlgorithm(v.(string))
+	}
+
 	if v, ok := d.GetOk("content_disposition"); ok {
 		input.ContentDisposition = aws.String(v.(string))
 	}
@@ -548,7 +560,7 @@ func resourceObjectCopyDoCopy(ctx context.Context, d *schema.ResourceData, meta
 		input.GrantRead = grants.Read
 		input.GrantReadACP = grants.ReadACP
 		input.GrantWriteACP = grants.WriteACP
-		input.ACL = nil
+		input.ACL = ""
 	}
 
 	if v, ok := d.GetOk("kms_encryption_context"); ok {
@@ -557,23 +569,23 @@ func resourceObjectCopyDoCopy(ctx context.Context, d *schema.ResourceData, meta
 
 	if v, ok := d.GetOk("kms_key_id"); ok {
 		input.SSEKMSKeyId = aws.String(v.(string))
-		input.ServerSideEncryption = aws.String(s3.ServerSideEncryptionAwsKms)
+		input.ServerSideEncryption = types.ServerSideEncryptionAwsKms
 	}
 
 	if v, ok := d.GetOk("metadata"); ok {
-		input.Metadata = flex.ExpandStringMap(v.(map[string]interface{}))
+		input.Metadata = flex.ExpandStringValueMap(v.(map[string]interface{}))
 	}
 
 	if v, ok := d.GetOk("metadata_directive"); ok {
-		input.MetadataDirective = aws.String(v.(string))
+		input.MetadataDirective = types.MetadataDirective(v.(string))
 	}
 
 	if v, ok := d.GetOk("object_lock_legal_hold_status"); ok {
-		input.ObjectLockLegalHoldStatus = aws.String(v.(string))
+		input.ObjectLockLegalHoldStatus = types.ObjectLockLegalHoldStatus(v.(string))
 	}
 
 	if v, ok := d.GetOk("object_lock_mode"); ok {
-		input.ObjectLockMode = aws.String(v.(string))
+		input.ObjectLockMode = types.ObjectLockMode(v.(string))
 	}
 
 	if v, ok := d.GetOk("object_lock_retain_until_date"); ok {
@@ -581,11 +593,11 @@ func resourceObjectCopyDoCopy(ctx context.Context, d *schema.ResourceData, meta
 	}
 
 	if v, ok := d.GetOk("request_payer"); ok {
-		input.RequestPayer = aws.String(v.(string))
+		input.RequestPayer = types.RequestPayer(v.(string))
 	}
 
 	if v, ok := d.GetOk("server_side_encryption"); ok {
-		input.ServerSideEncryption = aws.String(v.(string))
+		input.ServerSideEncryption = types.ServerSideEncryption(v.(string))
 	}
 
 	if v, ok := d.GetOk("source_customer_algorithm"); ok {
@@ -601,11 +613,11 @@ func resourceObjectCopyDoCopy(ctx context.Context, d *schema.ResourceData, meta
 	}
 
 	if v, ok := d.GetOk("storage_class"); ok {
-		input.StorageClass = aws.String(v.(string))
+		input.StorageClass = types.StorageClass(v.(string))
 	}
 
 	if v, ok := d.GetOk("tagging_directive"); ok {
-		input.TaggingDirective = aws.String(v.(string))
+		input.TaggingDirective = types.TaggingDirective(v.(string))
 	}
 
 	if len(tags) > 0 {
@@ -617,30 +629,22 @@ func resourceObjectCopyDoCopy(ctx context.Context, d *schema.ResourceData, meta
 		input.WebsiteRedirectLocation = aws.String(v.(string))
 	}
 
-	output, err := conn.CopyObjectWithContext(ctx, input)
+	output, err := conn.CopyObject(ctx, input)
+
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "copying S3 object (bucket: %s; key: %s; source: %s): %s", aws.StringValue(input.Bucket), aws.StringValue(input.Key), aws.StringValue(input.CopySource), err)
+		return sdkdiag.AppendErrorf(diags, "copying %s to S3 Bucket (%s) Object (%s): %s", aws.ToString(input.CopySource), aws.ToString(input.Bucket), aws.ToString(input.Key), err)
 	}
 
-	d.Set("customer_algorithm", output.SSECustomerAlgorithm)
-	d.Set("customer_key_md5", output.SSECustomerKeyMD5)
-
-	if output.CopyObjectResult != nil {
-		d.Set("etag", strings.Trim(aws.StringValue(output.CopyObjectResult.ETag), `"`))
-		d.Set("last_modified", flattenObjectDate(output.CopyObjectResult.LastModified))
+	if d.IsNewResource() {
+		d.SetId(d.Get("key").(string))
 	}
 
-	d.Set("expiration", output.Expiration)
+	// These attributes aren't returned from HeadObject.
 	d.Set("kms_encryption_context", output.SSEKMSEncryptionContext)
-	d.Set("kms_key_id", output.SSEKMSKeyId)
-	d.Set("request_charged", output.RequestCharged)
-	d.Set("server_side_encryption", output.ServerSideEncryption)
+	d.Set("request_charged", output.RequestCharged == types.RequestChargedRequester)
 	d.Set("source_version_id", output.CopySourceVersionId)
-	d.Set("version_id", output.VersionId)
-
-	d.SetId(d.Get("key").(string))
 
-	return append(diags, resourceObjectRead(ctx, d, meta)...)
+	return append(diags, resourceObjectCopyRead(ctx, d, meta)...)
 }
 
 type s3Grants struct {
@@ -655,22 +659,22 @@ func expandObjectCopyGrant(tfMap map[string]interface{}) string {
 		return ""
 	}
 
-	apiObject := &s3.Grantee{}
+	apiObject := &types.Grantee{}
 
 	if v, ok := tfMap["email"].(string); ok && v != "" {
-		apiObject.SetEmailAddress(v)
+		apiObject.EmailAddress = aws.String(v)
 	}
 
 	if v, ok := tfMap["id"].(string); ok && v != "" {
-		apiObject.SetID(v)
+		apiObject.ID = aws.String(v)
 	}
 
 	if v, ok := tfMap["type"].(string); ok && v != "" {
-		apiObject.SetType(v)
+		apiObject.Type = types.Type(v)
 	}
 
 	if v, ok := tfMap["uri"].(string); ok && v != "" {
-		apiObject.SetURI(v)
+		apiObject.URI = aws.String(v)
 	}
 
 	// Examples:
@@ -679,14 +683,14 @@ func expandObjectCopyGrant(tfMap map[string]interface{}) string {
 	//"GrantFullControl": "id=examplee7a2f25102679df27bb0ae12b3f85be6f290b936c4393484",
 	//"GrantWrite": "uri=http://acs.amazonaws.com/groups/s3/LogDelivery"
 
-	switch *apiObject.Type {
-	case s3.TypeAmazonCustomerByEmail:
-		return fmt.Sprintf("emailaddress=%s", *apiObject.EmailAddress)
-	case s3.TypeCanonicalUser:
-		return fmt.Sprintf("id=%s", *apiObject.ID)
+	switch apiObject.Type {
+	case types.TypeAmazonCustomerByEmail:
+		return fmt.Sprintf("emailaddress=%s", aws.ToString(apiObject.EmailAddress))
+	case types.TypeCanonicalUser:
+		return fmt.Sprintf("id=%s", aws.ToString(apiObject.ID))
 	}
 
-	return fmt.Sprintf("uri=%s", *apiObject.URI)
+	return fmt.Sprintf("uri=%s", aws.ToString(apiObject.URI))
 }
 
 func expandObjectCopyGrants(tfList []interface{}) *s3Grants {
@@ -708,14 +712,14 @@ func expandObjectCopyGrants(tfList []interface{}) *s3Grants {
 
 		for _, perm := range tfMap["permissions"].(*schema.Set).List() {
 			if v := expandObjectCopyGrant(tfMap); v != "" {
-				switch perm.(string) {
-				case s3.PermissionFullControl:
+				switch types.Permission(perm.(string)) {
+				case types.PermissionFullControl:
 					grantFullControl = append(grantFullControl, v)
-				case s3.PermissionRead:
+				case types.PermissionRead:
 					grantRead = append(grantRead, v)
-				case s3.PermissionReadAcp:
+				case types.PermissionReadAcp:
 					grantReadACP = append(grantReadACP, v)
-				case s3.PermissionWriteAcp:
+				case types.PermissionWriteAcp:
 					grantWriteACP = append(grantWriteACP, v)
 				}
 			}
diff --git a/internal/service/s3/object_copy_test.go b/internal/service/s3/object_copy_test.go
index 1276d344fd6..def0d35abb6 100644
--- a/internal/service/s3/object_copy_test.go
+++ b/internal/service/s3/object_copy_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3_test
 
 import (
@@ -5,8 +8,6 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/s3"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
@@ -14,6 +15,7 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	tfs3 "github.com/hashicorp/terraform-provider-aws/internal/service/s3"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
 func TestAccS3ObjectCopy_basic(t *testing.T) {
@@ -22,23 +24,197 @@ func TestAccS3ObjectCopy_basic(t *testing.T) {
 	rName2 := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_s3_object_copy.test"
 	sourceName := "aws_s3_object.source"
-	key := "HundBegraven"
-	sourceKey := "WshngtnNtnls"
+	sourceKey := "source"
+	targetKey := "target"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckObjectCopyDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccObjectCopyConfig_basic(rName1, sourceKey, rName2, key),
-				Check: resource.ComposeTestCheckFunc(
+				Config: testAccObjectCopyConfig_basic(rName1, sourceKey, rName2, targetKey),
+				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckObjectCopyExists(ctx, resourceName),
+					resource.TestCheckNoResourceAttr(resourceName, "acl"),
 					resource.TestCheckResourceAttr(resourceName, "bucket", rName2),
-					resource.TestCheckResourceAttr(resourceName, "key", key),
-					resource.TestCheckResourceAttr(resourceName, "source", fmt.Sprintf("%s/%s", rName1, sourceKey)),
+					resource.TestCheckResourceAttr(resourceName, "bucket_key_enabled", "false"),
+					resource.TestCheckResourceAttr(resourceName, "cache_control", ""),
+					resource.TestCheckNoResourceAttr(resourceName, "checksum_algorithm"),
+					resource.TestCheckResourceAttr(resourceName, "checksum_crc32", ""),
+					resource.TestCheckResourceAttr(resourceName, "checksum_crc32c", ""),
+					resource.TestCheckResourceAttr(resourceName, "checksum_sha1", ""),
+					resource.TestCheckResourceAttr(resourceName, "checksum_sha256", ""),
+					resource.TestCheckResourceAttr(resourceName, "content_disposition", ""),
+					resource.TestCheckResourceAttr(resourceName, "content_encoding", ""),
+					resource.TestCheckResourceAttr(resourceName, "content_language", ""),
+					resource.TestCheckResourceAttr(resourceName, "content_type", "application/octet-stream"),
+					resource.TestCheckNoResourceAttr(resourceName, "copy_if_match"),
+					resource.TestCheckNoResourceAttr(resourceName, "copy_if_modified_since"),
+					resource.TestCheckNoResourceAttr(resourceName, "copy_if_none_match"),
+					resource.TestCheckNoResourceAttr(resourceName, "copy_if_unmodified_since"),
+					resource.TestCheckResourceAttr(resourceName, "customer_algorithm", ""),
+					resource.TestCheckNoResourceAttr(resourceName, "customer_key"),
+					resource.TestCheckResourceAttr(resourceName, "customer_key_md5", ""),
 					resource.TestCheckResourceAttrPair(resourceName, "etag", sourceName, "etag"),
+					resource.TestCheckNoResourceAttr(resourceName, "expected_bucket_owner"),
+					resource.TestCheckNoResourceAttr(resourceName, "expected_source_bucket_owner"),
+					resource.TestCheckResourceAttr(resourceName, "expiration", ""),
+					resource.TestCheckNoResourceAttr(resourceName, "expires"),
+					resource.TestCheckResourceAttr(resourceName, "force_destroy", "false"),
+					resource.TestCheckResourceAttr(resourceName, "grant.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "key", targetKey),
+					resource.TestCheckResourceAttr(resourceName, "kms_encryption_context", ""),
+					resource.TestCheckResourceAttr(resourceName, "kms_key_id", ""),
+					resource.TestCheckResourceAttrSet(resourceName, "last_modified"),
+					resource.TestCheckResourceAttr(resourceName, "metadata.%", "0"),
+					resource.TestCheckNoResourceAttr(resourceName, "metadata_directive"),
+					resource.TestCheckResourceAttr(resourceName, "object_lock_legal_hold_status", ""),
+					resource.TestCheckResourceAttr(resourceName, "object_lock_mode", ""),
+					resource.TestCheckResourceAttr(resourceName, "object_lock_retain_until_date", ""),
+					resource.TestCheckResourceAttr(resourceName, "request_charged", "false"),
+					resource.TestCheckNoResourceAttr(resourceName, "request_payer"),
+					resource.TestCheckResourceAttr(resourceName, "server_side_encryption", "AES256"),
+					resource.TestCheckResourceAttr(resourceName, "source", fmt.Sprintf("%s/%s", rName1, sourceKey)),
+					resource.TestCheckNoResourceAttr(resourceName, "source_customer_algorithm"),
+					resource.TestCheckNoResourceAttr(resourceName, "source_customer_key"),
+					resource.TestCheckNoResourceAttr(resourceName, "source_customer_key_md5"),
+					resource.TestCheckResourceAttr(resourceName, "source_version_id", ""),
+					resource.TestCheckResourceAttr(resourceName, "storage_class", "STANDARD"),
+					resource.TestCheckNoResourceAttr(resourceName, "tagging_directive"),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
+					resource.TestCheckResourceAttr(resourceName, "version_id", ""),
+					resource.TestCheckResourceAttr(resourceName, "website_redirect", ""),
+				),
+			},
+		},
+	})
+}
+
+func TestAccS3ObjectCopy_disappears(t *testing.T) {
+	ctx := acctest.Context(t)
+	rName1 := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	rName2 := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_s3_object_copy.test"
+	sourceKey := "source"
+	targetKey := "target"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckObjectCopyDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccObjectCopyConfig_basic(rName1, sourceKey, rName2, targetKey),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckObjectCopyExists(ctx, resourceName),
+					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfs3.ResourceObjectCopy(), resourceName),
+				),
+				ExpectNonEmptyPlan: true,
+			},
+		},
+	})
+}
+
+func TestAccS3ObjectCopy_tags(t *testing.T) {
+	ctx := acctest.Context(t)
+	rName1 := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	rName2 := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_s3_object_copy.test"
+	sourceKey := "source"
+	targetKey := "target"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckObjectCopyDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccObjectCopyConfig_tags1(rName1, sourceKey, rName2, targetKey, "key1", "value1"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckObjectCopyExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "tagging_directive", "REPLACE"),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
+				),
+			},
+			{
+				Config: testAccObjectCopyConfig_tags2(rName1, sourceKey, rName2, targetKey, "key1", "value1updated", "key2", "value2"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckObjectCopyExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "tagging_directive", "REPLACE"),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1updated"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
+				),
+			},
+			{
+				Config: testAccObjectCopyConfig_tags1(rName1, sourceKey, rName2, targetKey, "key2", "value2"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckObjectCopyExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "tagging_directive", "REPLACE"),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccS3ObjectCopy_metadata(t *testing.T) {
+	ctx := acctest.Context(t)
+	rName1 := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	rName2 := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_s3_object_copy.test"
+	sourceKey := "source"
+	targetKey := "target"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckObjectCopyDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccObjectCopyConfig_metadata(rName1, sourceKey, rName2, targetKey),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckObjectCopyExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "metadata_directive", "REPLACE"),
+					resource.TestCheckResourceAttr(resourceName, "metadata.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "metadata.mk1", "mv1"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccS3ObjectCopy_grant(t *testing.T) {
+	ctx := acctest.Context(t)
+	rName1 := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	rName2 := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_s3_object_copy.test"
+	sourceKey := "source"
+	targetKey := "target"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckObjectCopyDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccObjectCopyConfig_grant(rName1, sourceKey, rName2, targetKey),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckObjectCopyExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "grant.#", "1"),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "grant.*", map[string]string{
+						"permissions.#": "1",
+						"type":          "Group",
+						"uri":           "http://acs.amazonaws.com/groups/global/AllUsers",
+					}),
 				),
 			},
 		},
@@ -47,17 +223,20 @@ func TestAccS3ObjectCopy_basic(t *testing.T) {
 
 func TestAccS3ObjectCopy_BucketKeyEnabled_bucket(t *testing.T) {
 	ctx := acctest.Context(t)
-	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	rName1 := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	rName2 := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_s3_object_copy.test"
+	sourceKey := "source"
+	targetKey := "target"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckObjectCopyDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccObjectCopyConfig_bucketKeyEnabledBucket(rName),
+				Config: testAccObjectCopyConfig_bucketKeyEnabledBucket(rName1, sourceKey, rName2, targetKey),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckObjectCopyExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "bucket_key_enabled", "true"),
@@ -69,17 +248,20 @@ func TestAccS3ObjectCopy_BucketKeyEnabled_bucket(t *testing.T) {
 
 func TestAccS3ObjectCopy_BucketKeyEnabled_object(t *testing.T) {
 	ctx := acctest.Context(t)
-	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	rName1 := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	rName2 := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_s3_object_copy.test"
+	sourceKey := "source"
+	targetKey := "target"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckObjectCopyDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccObjectCopyConfig_bucketKeyEnabled(rName),
+				Config: testAccObjectCopyConfig_bucketKeyEnabledObject(rName1, sourceKey, rName2, targetKey),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckObjectCopyExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "bucket_key_enabled", "true"),
@@ -89,16 +271,180 @@ func TestAccS3ObjectCopy_BucketKeyEnabled_object(t *testing.T) {
 	})
 }
 
+func TestAccS3ObjectCopy_sourceWithSlashes(t *testing.T) {
+	ctx := acctest.Context(t)
+	rName1 := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	rName2 := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_s3_object_copy.test"
+	sourceKey := "dir1/dir2/source"
+	targetKey := "target"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckObjectCopyDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccObjectCopyConfig_baseSourceAndTargetBuckets(rName1, rName2),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckBucketAddObjects(ctx, "aws_s3_bucket.source", sourceKey),
+				),
+			},
+			{
+				Config: testAccObjectCopyConfig_externalSourceObject(rName1, sourceKey, rName2, targetKey),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckObjectCopyExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "source", fmt.Sprintf("%s/%s", rName1, sourceKey)),
+				),
+			},
+		},
+	})
+}
+
+func TestAccS3ObjectCopy_checksumAlgorithm(t *testing.T) {
+	ctx := acctest.Context(t)
+	rName1 := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	rName2 := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_s3_object_copy.test"
+	sourceKey := "source"
+	targetKey := "target"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckObjectCopyDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccObjectCopyConfig_checksumAlgorithm(rName1, sourceKey, rName2, targetKey, "CRC32C"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckObjectCopyExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "checksum_algorithm", "CRC32C"),
+					resource.TestCheckResourceAttr(resourceName, "checksum_crc32", ""),
+					resource.TestCheckResourceAttr(resourceName, "checksum_crc32c", "7y1BJA=="),
+					resource.TestCheckResourceAttr(resourceName, "checksum_sha1", ""),
+					resource.TestCheckResourceAttr(resourceName, "checksum_sha256", ""),
+				),
+			},
+			{
+				Config: testAccObjectCopyConfig_checksumAlgorithm(rName1, sourceKey, rName2, targetKey, "SHA1"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckObjectCopyExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "checksum_algorithm", "SHA1"),
+					resource.TestCheckResourceAttr(resourceName, "checksum_crc32", ""),
+					resource.TestCheckResourceAttr(resourceName, "checksum_crc32c", ""),
+					resource.TestCheckResourceAttr(resourceName, "checksum_sha1", "7MuLDoLjuZB9Uv63Krr4E7U5x30="),
+					resource.TestCheckResourceAttr(resourceName, "checksum_sha256", ""),
+				),
+			},
+		},
+	})
+}
+
+func TestAccS3ObjectCopy_objectLockLegalHold(t *testing.T) {
+	ctx := acctest.Context(t)
+	rName1 := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	rName2 := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_s3_object_copy.test"
+	sourceKey := "source"
+	targetKey := "target"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckObjectCopyDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccObjectCopyConfig_lockLegalHold(rName1, sourceKey, rName2, targetKey, "ON"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckObjectCopyExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "object_lock_legal_hold_status", "ON"),
+				),
+			},
+			{
+				Config: testAccObjectCopyConfig_lockLegalHold(rName1, sourceKey, rName2, targetKey, "OFF"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckObjectCopyExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "object_lock_legal_hold_status", "OFF"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccS3ObjectCopy_targetWithMultipleSlashes(t *testing.T) {
+	ctx := acctest.Context(t)
+	rName1 := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	rName2 := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_s3_object_copy.test"
+	sourceKey := "source"
+	targetKey := "/dir//target/"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckObjectCopyDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccObjectCopyConfig_basic(rName1, sourceKey, rName2, targetKey),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(resourceName, "key", targetKey),
+					resource.TestCheckResourceAttr(resourceName, "source", fmt.Sprintf("%s/%s", rName1, sourceKey)),
+				),
+			},
+		},
+	})
+}
+
+func TestAccS3ObjectCopy_targetWithMultipleSlashesMigrated(t *testing.T) {
+	ctx := acctest.Context(t)
+	rName1 := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	rName2 := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_s3_object_copy.test"
+	sourceKey := "source"
+	targetKey := "/dir//target/"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:     func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:   acctest.ErrorCheck(t, names.S3EndpointID),
+		CheckDestroy: testAccCheckObjectCopyDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				ExternalProviders: map[string]resource.ExternalProvider{
+					// Final version for aws_s3_object_copy using AWS SDK for Go v1.
+					"aws": {
+						Source:            "hashicorp/aws",
+						VersionConstraint: "5.15.0",
+					},
+				},
+				Config: testAccObjectCopyConfig_basic(rName1, sourceKey, rName2, targetKey),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(resourceName, "key", targetKey),
+					resource.TestCheckResourceAttr(resourceName, "source", fmt.Sprintf("%s/%s", rName1, sourceKey)),
+				),
+			},
+			{
+				ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+				Config:                   testAccObjectCopyConfig_basic(rName1, sourceKey, rName2, targetKey),
+				PlanOnly:                 true,
+			},
+		},
+	})
+}
+
 func testAccCheckObjectCopyDestroy(ctx context.Context) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Conn(ctx)
+		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Client(ctx)
 
 		for _, rs := range s.RootModule().Resources {
 			if rs.Type != "aws_s3_object_copy" {
 				continue
 			}
 
-			_, err := tfs3.FindObjectByThreePartKey(ctx, conn, rs.Primary.Attributes["bucket"], rs.Primary.Attributes["key"], rs.Primary.Attributes["etag"])
+			_, err := tfs3.FindObjectByBucketAndKey(ctx, conn, rs.Primary.Attributes["bucket"], tfs3.SDKv1CompatibleCleanKey(rs.Primary.Attributes["key"]), rs.Primary.Attributes["etag"], "")
 
 			if tfresource.NotFound(err) {
 				continue
@@ -122,40 +468,99 @@ func testAccCheckObjectCopyExists(ctx context.Context, n string) resource.TestCh
 			return fmt.Errorf("Not Found: %s", n)
 		}
 
-		if rs.Primary.ID == "" {
-			return fmt.Errorf("No S3 Object ID is set")
-		}
+		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Client(ctx)
 
-		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Conn(ctx)
-		_, err := conn.GetObjectWithContext(ctx, &s3.GetObjectInput{
-			Bucket:  aws.String(rs.Primary.Attributes["bucket"]),
-			Key:     aws.String(rs.Primary.Attributes["key"]),
-			IfMatch: aws.String(rs.Primary.Attributes["etag"]),
-		})
-		if err != nil {
-			return fmt.Errorf("S3 Object error: %s", err)
-		}
+		_, err := tfs3.FindObjectByBucketAndKey(ctx, conn, rs.Primary.Attributes["bucket"], tfs3.SDKv1CompatibleCleanKey(rs.Primary.Attributes["key"]), rs.Primary.Attributes["etag"], "")
 
-		return nil
+		return err
 	}
 }
 
-func testAccObjectCopyConfig_basic(rName1, sourceKey, rName2, key string) string {
+func testAccObjectCopyConfig_baseSourceAndTargetBuckets(sourceBucket, targetBucket string) string {
 	return fmt.Sprintf(`
 resource "aws_s3_bucket" "source" {
   bucket = %[1]q
+
+  force_destroy = true
+}
+
+resource "aws_s3_bucket" "target" {
+  bucket = %[2]q
+}
+`, sourceBucket, targetBucket)
 }
 
+func testAccObjectCopyConfig_baseSourceObject(sourceBucket, sourceKey, targetBucket string) string {
+	return acctest.ConfigCompose(testAccObjectCopyConfig_baseSourceAndTargetBuckets(sourceBucket, targetBucket), fmt.Sprintf(`
 resource "aws_s3_object" "source" {
   bucket  = aws_s3_bucket.source.bucket
-  key     = %[2]q
-  content = "Ingen ko på isen"
+  key     = %[1]q
+  content = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ"
+}
+`, sourceKey))
 }
 
-resource "aws_s3_bucket" "target" {
-  bucket = %[3]q
+func testAccObjectCopyConfig_basic(sourceBucket, sourceKey, targetBucket, targetKey string) string {
+	return acctest.ConfigCompose(testAccObjectCopyConfig_baseSourceObject(sourceBucket, sourceKey, targetBucket), fmt.Sprintf(`
+resource "aws_s3_object_copy" "test" {
+  bucket = aws_s3_bucket.target.bucket
+  key    = %[1]q
+  source = "${aws_s3_bucket.source.bucket}/${aws_s3_object.source.key}"
 }
+`, targetKey))
+}
+
+func testAccObjectCopyConfig_tags1(sourceBucket, sourceKey, targetBucket, targetKey, tagKey1, tagValue1 string) string {
+	return acctest.ConfigCompose(testAccObjectCopyConfig_baseSourceObject(sourceBucket, sourceKey, targetBucket), fmt.Sprintf(`
+resource "aws_s3_object_copy" "test" {
+  bucket = aws_s3_bucket.target.bucket
+  key    = %[1]q
+  source = "${aws_s3_bucket.source.bucket}/${aws_s3_object.source.key}"
 
+  tagging_directive = "REPLACE"
+
+  tags = {
+    %[2]q = %[3]q
+  }
+}
+`, targetKey, tagKey1, tagValue1))
+}
+
+func testAccObjectCopyConfig_tags2(sourceBucket, sourceKey, targetBucket, targetKey, tagKey1, tagValue1, tagKey2, tagValue2 string) string {
+	return acctest.ConfigCompose(testAccObjectCopyConfig_baseSourceObject(sourceBucket, sourceKey, targetBucket), fmt.Sprintf(`
+resource "aws_s3_object_copy" "test" {
+  bucket = aws_s3_bucket.target.bucket
+  key    = %[1]q
+  source = "${aws_s3_bucket.source.bucket}/${aws_s3_object.source.key}"
+
+  tagging_directive = "REPLACE"
+
+  tags = {
+    %[2]q = %[3]q
+    %[4]q = %[5]q
+  }
+}
+`, targetKey, tagKey1, tagValue1, tagKey2, tagValue2))
+}
+
+func testAccObjectCopyConfig_metadata(sourceBucket, sourceKey, targetBucket, targetKey string) string {
+	return acctest.ConfigCompose(testAccObjectCopyConfig_baseSourceObject(sourceBucket, sourceKey, targetBucket), fmt.Sprintf(`
+resource "aws_s3_object_copy" "test" {
+  bucket = aws_s3_bucket.target.bucket
+  key    = %[1]q
+  source = "${aws_s3_bucket.source.bucket}/${aws_s3_object.source.key}"
+
+  metadata_directive = "REPLACE"
+
+  metadata = {
+    "mk1" = "mv1"
+  }
+}
+`, targetKey))
+}
+
+func testAccObjectCopyConfig_grant(sourceBucket, sourceKey, targetBucket, targetKey string) string {
+	return acctest.ConfigCompose(testAccObjectCopyConfig_baseSourceObject(sourceBucket, sourceKey, targetBucket), fmt.Sprintf(`
 resource "aws_s3_bucket_public_access_block" "target" {
   bucket = aws_s3_bucket.target.id
 
@@ -179,7 +584,7 @@ resource "aws_s3_object_copy" "test" {
   ]
 
   bucket = aws_s3_bucket.target.bucket
-  key    = %[4]q
+  key    = %[1]q
   source = "${aws_s3_bucket.source.bucket}/${aws_s3_object.source.key}"
 
   grant {
@@ -188,31 +593,21 @@ resource "aws_s3_object_copy" "test" {
     permissions = ["READ"]
   }
 }
-`, rName1, sourceKey, rName2, key)
+`, targetKey))
 }
 
-func testAccObjectCopyConfig_bucketKeyEnabledBucket(rName string) string {
-	return fmt.Sprintf(`
+func testAccObjectCopyConfig_baseBucketKeyEnabled(sourceBucket, sourceKey, targetBucket string) string {
+	return acctest.ConfigCompose(testAccObjectCopyConfig_baseSourceObject(sourceBucket, sourceKey, targetBucket), fmt.Sprintf(`
 resource "aws_kms_key" "test" {
-  description             = "Encrypts test objects"
+  description             = %[1]q
   deletion_window_in_days = 7
 }
-
-resource "aws_s3_bucket" "source" {
-  bucket = "%[1]s-source"
-}
-
-resource "aws_s3_object" "source" {
-  bucket  = aws_s3_bucket.source.bucket
-  content = "Ingen ko på isen"
-  key     = "test"
+`, targetBucket))
 }
 
-resource "aws_s3_bucket" "target" {
-  bucket = "%[1]s-target"
-}
-
-resource "aws_s3_bucket_server_side_encryption_configuration" "test" {
+func testAccObjectCopyConfig_bucketKeyEnabledBucket(sourceBucket, sourceKey, targetBucket, targetKey string) string {
+	return acctest.ConfigCompose(testAccObjectCopyConfig_baseBucketKeyEnabled(sourceBucket, sourceKey, targetBucket), fmt.Sprintf(`
+resource "aws_s3_bucket_server_side_encryption_configuration" "target" {
   bucket = aws_s3_bucket.target.id
 
   rule {
@@ -226,42 +621,86 @@ resource "aws_s3_bucket_server_side_encryption_configuration" "test" {
 
 resource "aws_s3_object_copy" "test" {
   # Must have bucket SSE enabled first
-  depends_on = [aws_s3_bucket_server_side_encryption_configuration.test]
+  depends_on = [aws_s3_bucket_server_side_encryption_configuration.target]
 
   bucket = aws_s3_bucket.target.bucket
-  key    = "test"
+  key    = %[1]q
   source = "${aws_s3_bucket.source.bucket}/${aws_s3_object.source.key}"
 }
-`, rName)
+`, targetKey))
 }
 
-func testAccObjectCopyConfig_bucketKeyEnabled(rName string) string {
-	return fmt.Sprintf(`
-resource "aws_kms_key" "test" {
-  description             = "Encrypts test objects"
-  deletion_window_in_days = 7
+func testAccObjectCopyConfig_bucketKeyEnabledObject(sourceBucket, sourceKey, targetBucket, targetKey string) string {
+	return acctest.ConfigCompose(testAccObjectCopyConfig_baseBucketKeyEnabled(sourceBucket, sourceKey, targetBucket), fmt.Sprintf(`
+resource "aws_s3_object_copy" "test" {
+  bucket             = aws_s3_bucket.target.bucket
+  bucket_key_enabled = true
+  key                = %[1]q
+  kms_key_id         = aws_kms_key.test.arn
+  source             = "${aws_s3_bucket.source.bucket}/${aws_s3_object.source.key}"
+}
+`, targetKey))
 }
 
-resource "aws_s3_bucket" "source" {
-  bucket = "%[1]s-source"
+func testAccObjectCopyConfig_externalSourceObject(sourceBucket, sourceKey, targetBucket, targetKey string) string {
+	return acctest.ConfigCompose(testAccObjectCopyConfig_baseSourceAndTargetBuckets(sourceBucket, targetBucket), fmt.Sprintf(`
+resource "aws_s3_object_copy" "test" {
+  bucket = aws_s3_bucket.target.bucket
+  key    = %[2]q
+  source = "${aws_s3_bucket.source.bucket}/%[1]s"
+}
+`, sourceKey, targetKey))
 }
 
-resource "aws_s3_object" "source" {
-  bucket  = aws_s3_bucket.source.bucket
-  content = "Ingen ko på isen"
-  key     = "test"
+func testAccObjectCopyConfig_checksumAlgorithm(sourceBucket, sourceKey, targetBucket, targetKey, checksumAlgorithm string) string {
+	return acctest.ConfigCompose(testAccObjectCopyConfig_baseSourceObject(sourceBucket, sourceKey, targetBucket), fmt.Sprintf(`
+resource "aws_s3_object_copy" "test" {
+  bucket = aws_s3_bucket.target.bucket
+  key    = %[1]q
+  source = "${aws_s3_bucket.source.bucket}/${aws_s3_object.source.key}"
+
+  checksum_algorithm = %[2]q
+}
+`, targetKey, checksumAlgorithm))
+}
+
+func testAccObjectCopyConfig_lockLegalHold(sourceBucket, sourceKey, targetBucket, targetKey, legalHoldStatus string) string {
+	return fmt.Sprintf(`
+resource "aws_s3_bucket" "source" {
+  bucket = %[1]q
+
+  force_destroy = true
 }
 
 resource "aws_s3_bucket" "target" {
-  bucket = "%[1]s-target"
+  bucket = %[3]q
+
+  object_lock_enabled = true
+
+  force_destroy = true
+}
+
+resource "aws_s3_bucket_versioning" "target" {
+  bucket = aws_s3_bucket.target.id
+  versioning_configuration {
+    status = "Enabled"
+  }
+}
+
+resource "aws_s3_object" "source" {
+  bucket  = aws_s3_bucket.source.bucket
+  key     = %[2]q
+  content = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ"
 }
 
 resource "aws_s3_object_copy" "test" {
-  bucket             = aws_s3_bucket.target.bucket
-  bucket_key_enabled = true
-  key                = "test"
-  kms_key_id         = aws_kms_key.test.arn
-  source             = "${aws_s3_bucket.source.bucket}/${aws_s3_object.source.key}"
+  # Must have bucket versioning enabled first
+  bucket = aws_s3_bucket_versioning.target.bucket
+  key    = %[4]q
+  source = "${aws_s3_bucket.source.bucket}/${aws_s3_object.source.key}"
+
+  object_lock_legal_hold_status = %[5]q
+  force_destroy                 = true
 }
-`, rName)
+`, sourceBucket, sourceKey, targetBucket, targetKey, legalHoldStatus)
 }
diff --git a/internal/service/s3/object_data_source.go b/internal/service/s3/object_data_source.go
index b3818193d85..44068b8d1c3 100644
--- a/internal/service/s3/object_data_source.go
+++ b/internal/service/s3/object_data_source.go
@@ -1,21 +1,24 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3
 
 import (
-	"bytes"
 	"context"
-	"fmt"
-	"log"
 	"regexp"
 	"strings"
 	"time"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/s3"
+	"github.com/YakDriver/regexache"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/feature/s3/manager"
+	"github.com/aws/aws-sdk-go-v2/service/s3"
+	"github.com/aws/aws-sdk-go-v2/service/s3/types"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/enum"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
-	"github.com/hashicorp/terraform-provider-aws/internal/flex"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 )
 
@@ -41,6 +44,27 @@ func DataSourceObject() *schema.Resource {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
+			"checksum_mode": {
+				Type:             schema.TypeString,
+				Optional:         true,
+				ValidateDiagFunc: enum.Validate[types.ChecksumMode](),
+			},
+			"checksum_crc32": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"checksum_crc32c": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"checksum_sha1": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"checksum_sha256": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
 			"content_disposition": {
 				Type:     schema.TypeString,
 				Computed: true,
@@ -114,6 +138,7 @@ func DataSourceObject() *schema.Resource {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
+			"tags": tftags.TagsSchemaComputed(),
 			"version_id": {
 				Type:     schema.TypeString,
 				Optional: true,
@@ -123,24 +148,24 @@ func DataSourceObject() *schema.Resource {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
-
-			"tags": tftags.TagsSchemaComputed(),
 		},
 	}
 }
 
 func dataSourceObjectRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).S3Conn(ctx)
+	conn := meta.(*conns.AWSClient).S3Client(ctx)
 	ignoreTagsConfig := meta.(*conns.AWSClient).IgnoreTagsConfig
 
 	bucket := d.Get("bucket").(string)
-	key := d.Get("key").(string)
-
-	input := s3.HeadObjectInput{
+	key := sdkv1CompatibleCleanKey(d.Get("key").(string))
+	input := &s3.HeadObjectInput{
 		Bucket: aws.String(bucket),
 		Key:    aws.String(key),
 	}
+	if v, ok := d.GetOk("checksum_mode"); ok {
+		input.ChecksumMode = types.ChecksumMode(v.(string))
+	}
 	if v, ok := d.GetOk("range"); ok {
 		input.Range = aws.String(v.(string))
 	}
@@ -148,91 +173,80 @@ func dataSourceObjectRead(ctx context.Context, d *schema.ResourceData, meta inte
 		input.VersionId = aws.String(v.(string))
 	}
 
-	versionText := ""
-	uniqueId := bucket + "/" + key
-	if v, ok := d.GetOk("version_id"); ok {
-		versionText = fmt.Sprintf(" of version %q", v.(string))
-		uniqueId += "@" + v.(string)
-	}
+	output, err := findObject(ctx, conn, input)
 
-	log.Printf("[DEBUG] Reading S3 Object: %s", input)
-	out, err := conn.HeadObjectWithContext(ctx, &input)
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "getting S3 Bucket (%s) Object (%s): %s", bucket, key, err)
-	}
-	if aws.BoolValue(out.DeleteMarker) {
-		return sdkdiag.AppendErrorf(diags, "Requested S3 object %q%s has been deleted", bucket+key, versionText)
+		return sdkdiag.AppendErrorf(diags, "reading S3 Bucket (%s) Object (%s): %s", bucket, key, err)
 	}
 
-	log.Printf("[DEBUG] Received S3 object: %s", out)
+	if output.DeleteMarker {
+		return sdkdiag.AppendErrorf(diags, "S3 Bucket (%s) Object (%s) has been deleted", bucket, key)
+	}
 
-	d.SetId(uniqueId)
+	id := bucket + "/" + d.Get("key").(string)
+	if v, ok := d.GetOk("version_id"); ok {
+		id += "@" + v.(string)
+	}
+	d.SetId(id)
 
-	d.Set("bucket_key_enabled", out.BucketKeyEnabled)
-	d.Set("cache_control", out.CacheControl)
-	d.Set("content_disposition", out.ContentDisposition)
-	d.Set("content_encoding", out.ContentEncoding)
-	d.Set("content_language", out.ContentLanguage)
-	d.Set("content_length", out.ContentLength)
-	d.Set("content_type", out.ContentType)
+	d.Set("bucket_key_enabled", output.BucketKeyEnabled)
+	d.Set("cache_control", output.CacheControl)
+	d.Set("checksum_crc32", output.ChecksumCRC32)
+	d.Set("checksum_crc32c", output.ChecksumCRC32C)
+	d.Set("checksum_sha1", output.ChecksumSHA1)
+	d.Set("checksum_sha256", output.ChecksumSHA256)
+	d.Set("content_disposition", output.ContentDisposition)
+	d.Set("content_encoding", output.ContentEncoding)
+	d.Set("content_language", output.ContentLanguage)
+	d.Set("content_length", output.ContentLength)
+	d.Set("content_type", output.ContentType)
 	// See https://forums.aws.amazon.com/thread.jspa?threadID=44003
-	d.Set("etag", strings.Trim(aws.StringValue(out.ETag), `"`))
-	d.Set("expiration", out.Expiration)
-	d.Set("expires", out.Expires)
-	if out.LastModified != nil {
-		d.Set("last_modified", out.LastModified.Format(time.RFC1123))
+	d.Set("etag", strings.Trim(aws.ToString(output.ETag), `"`))
+	d.Set("expiration", output.Expiration)
+	if output.Expires != nil {
+		d.Set("expires", output.Expires.Format(time.RFC1123))
 	} else {
-		d.Set("last_modified", "")
+		d.Set("expires", nil)
 	}
-	d.Set("metadata", flex.PointersMapToStringList(out.Metadata))
-	d.Set("object_lock_legal_hold_status", out.ObjectLockLegalHoldStatus)
-	d.Set("object_lock_mode", out.ObjectLockMode)
-	d.Set("object_lock_retain_until_date", flattenObjectDate(out.ObjectLockRetainUntilDate))
-	d.Set("server_side_encryption", out.ServerSideEncryption)
-	d.Set("sse_kms_key_id", out.SSEKMSKeyId)
-	d.Set("version_id", out.VersionId)
-	d.Set("website_redirect_location", out.WebsiteRedirectLocation)
-
+	if output.LastModified != nil {
+		d.Set("last_modified", output.LastModified.Format(time.RFC1123))
+	} else {
+		d.Set("last_modified", nil)
+	}
+	d.Set("metadata", output.Metadata)
+	d.Set("object_lock_legal_hold_status", output.ObjectLockLegalHoldStatus)
+	d.Set("object_lock_mode", output.ObjectLockMode)
+	d.Set("object_lock_retain_until_date", flattenObjectDate(output.ObjectLockRetainUntilDate))
+	d.Set("server_side_encryption", output.ServerSideEncryption)
+	d.Set("sse_kms_key_id", output.SSEKMSKeyId)
 	// The "STANDARD" (which is also the default) storage
 	// class when set would not be included in the results.
-	if out.StorageClass == nil {
-		d.Set("storage_class", s3.StorageClassStandard)
-	} else {
-		d.Set("storage_class", out.StorageClass)
+	d.Set("storage_class", types.ObjectStorageClassStandard)
+	if output.StorageClass != "" {
+		d.Set("storage_class", output.StorageClass)
 	}
+	d.Set("version_id", output.VersionId)
+	d.Set("website_redirect_location", output.WebsiteRedirectLocation)
 
-	if isContentTypeAllowed(out.ContentType) {
-		input := s3.GetObjectInput{
-			Bucket: aws.String(bucket),
-			Key:    aws.String(key),
+	if isContentTypeAllowed(output.ContentType) {
+		downloader := manager.NewDownloader(conn)
+		buf := manager.NewWriteAtBuffer(make([]byte, 0))
+		input := &s3.GetObjectInput{
+			Bucket:    aws.String(bucket),
+			Key:       aws.String(key),
+			VersionId: output.VersionId,
 		}
 		if v, ok := d.GetOk("range"); ok {
 			input.Range = aws.String(v.(string))
 		}
-		if out.VersionId != nil {
-			input.VersionId = out.VersionId
-		}
-		out, err := conn.GetObjectWithContext(ctx, &input)
-		if err != nil {
-			return sdkdiag.AppendErrorf(diags, "Failed getting S3 object: %s", err)
-		}
 
-		buf := new(bytes.Buffer)
-		bytesRead, err := buf.ReadFrom(out.Body)
+		_, err := downloader.Download(ctx, buf, input)
+
 		if err != nil {
-			return sdkdiag.AppendErrorf(diags, "Failed reading content of S3 object (%s): %s", uniqueId, err)
-		}
-		log.Printf("[INFO] Saving %d bytes from S3 object %s", bytesRead, uniqueId)
-		d.Set("body", buf.String())
-	} else {
-		contentType := ""
-		if out.ContentType == nil {
-			contentType = "<EMPTY>"
-		} else {
-			contentType = aws.StringValue(out.ContentType)
+			return sdkdiag.AppendErrorf(diags, "downloading S3 Bucket (%s) Object (%s): %s", bucket, key, err)
 		}
 
-		log.Printf("[INFO] Ignoring body of S3 object %s with Content-Type %q", uniqueId, contentType)
+		d.Set("body", string(buf.Bytes()))
 	}
 
 	tags, err := ObjectListTags(ctx, conn, bucket, key)
@@ -248,28 +262,26 @@ func dataSourceObjectRead(ctx context.Context, d *schema.ResourceData, meta inte
 	return diags
 }
 
-// This is to prevent potential issues w/ binary files
-// and generally unprintable characters
-// See https://github.com/hashicorp/terraform/pull/3858#issuecomment-156856738
+// This is to prevent potential issues w/ binary files and generally unprintable characters.
+// See https://github.com/hashicorp/terraform/pull/3858#issuecomment-156856738.
 func isContentTypeAllowed(contentType *string) bool {
 	if contentType == nil {
 		return false
 	}
 
 	allowedContentTypes := []*regexp.Regexp{
-		regexp.MustCompile(`^application/atom\+xml$`),
-		regexp.MustCompile(`^application/json$`),
-		regexp.MustCompile(`^application/ld\+json$`),
-		regexp.MustCompile(`^application/x-csh$`),
-		regexp.MustCompile(`^application/x-httpd-php$`),
-		regexp.MustCompile(`^application/x-sh$`),
-		regexp.MustCompile(`^application/xhtml\+xml$`),
-		regexp.MustCompile(`^application/xml$`),
-		regexp.MustCompile(`^text/.+`),
+		regexache.MustCompile(`^application/atom\+xml$`),
+		regexache.MustCompile(`^application/json$`),
+		regexache.MustCompile(`^application/ld\+json$`),
+		regexache.MustCompile(`^application/x-csh$`),
+		regexache.MustCompile(`^application/x-httpd-php$`),
+		regexache.MustCompile(`^application/x-sh$`),
+		regexache.MustCompile(`^application/xhtml\+xml$`),
+		regexache.MustCompile(`^application/xml$`),
+		regexache.MustCompile(`^text/.+`),
 	}
-
 	for _, r := range allowedContentTypes {
-		if r.MatchString(*contentType) {
+		if r.MatchString(aws.ToString(contentType)) {
 			return true
 		}
 	}
diff --git a/internal/service/s3/object_data_source_test.go b/internal/service/s3/object_data_source_test.go
index 7593315246a..e690926fa45 100644
--- a/internal/service/s3/object_data_source_test.go
+++ b/internal/service/s3/object_data_source_test.go
@@ -1,52 +1,52 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3_test
 
 import (
-	"context"
 	"fmt"
-	"regexp"
 	"testing"
 	"time"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/s3"
+	"github.com/YakDriver/regexache"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
-	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
-	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
-const rfc1123RegexPattern = `^[a-zA-Z]{3}, [0-9]+ [a-zA-Z]+ [0-9]{4} [0-9:]+ [A-Z]+$`
+const rfc1123RegexPattern = `^[A-Za-z]{3}, [0-9]+ [A-Za-z]+ [0-9]{4} [0-9:]+ [A-Z]+$`
 
 func TestAccS3ObjectDataSource_basic(t *testing.T) {
 	ctx := acctest.Context(t)
-	rInt := sdkacctest.RandInt()
-
-	var rObj s3.GetObjectOutput
-	var dsObj s3.GetObjectOutput
-
-	resourceName := "aws_s3_object.object"
-	dataSourceName := "data.aws_s3_object.obj"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_s3_object.test"
+	dataSourceName := "data.aws_s3_object.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                  func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:                acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:                acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories:  acctest.ProtoV5ProviderFactories,
 		PreventPostDestroyRefresh: true,
 		Steps: []resource.TestStep{
 			{
-				Config: testAccObjectDataSourceConfig_basic(rInt),
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckObjectExists(ctx, resourceName, &rObj),
-					testAccCheckObjectExistsDataSource(ctx, dataSourceName, &dsObj),
+				Config: testAccObjectDataSourceConfig_basic(rName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					resource.TestCheckNoResourceAttr(dataSourceName, "body"),
+					resource.TestCheckNoResourceAttr(dataSourceName, "checksum_mode"),
+					resource.TestCheckResourceAttr(resourceName, "checksum_crc32", ""),
+					resource.TestCheckResourceAttr(resourceName, "checksum_crc32c", ""),
+					resource.TestCheckResourceAttr(resourceName, "checksum_sha1", ""),
+					resource.TestCheckResourceAttr(resourceName, "checksum_sha256", ""),
 					resource.TestCheckResourceAttr(dataSourceName, "content_length", "11"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "content_type", resourceName, "content_type"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "etag", resourceName, "etag"),
-					resource.TestMatchResourceAttr(dataSourceName, "last_modified", regexp.MustCompile(rfc1123RegexPattern)),
+					resource.TestMatchResourceAttr(dataSourceName, "last_modified", regexache.MustCompile(rfc1123RegexPattern)),
+					resource.TestCheckResourceAttr(dataSourceName, "metadata.%", "0"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "object_lock_legal_hold_status", resourceName, "object_lock_legal_hold_status"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "object_lock_mode", resourceName, "object_lock_mode"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "object_lock_retain_until_date", resourceName, "object_lock_retain_until_date"),
-					resource.TestCheckNoResourceAttr(dataSourceName, "body"),
+					resource.TestCheckResourceAttr(dataSourceName, "tags.%", "0"),
 				),
 			},
 		},
@@ -55,24 +55,19 @@ func TestAccS3ObjectDataSource_basic(t *testing.T) {
 
 func TestAccS3ObjectDataSource_basicViaAccessPoint(t *testing.T) {
 	ctx := acctest.Context(t)
-	var dsObj, rObj s3.GetObjectOutput
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
-
 	dataSourceName := "data.aws_s3_object.test"
 	resourceName := "aws_s3_object.test"
 	accessPointResourceName := "aws_s3_access_point.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccObjectDataSourceConfig_basicViaAccessPoint(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckObjectExists(ctx, resourceName, &rObj),
-					testAccCheckObjectExistsDataSource(ctx, dataSourceName, &dsObj),
-					testAccCheckObjectExists(ctx, resourceName, &rObj),
 					resource.TestCheckResourceAttrPair(dataSourceName, "bucket", accessPointResourceName, "arn"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "key", resourceName, "key"),
 				),
@@ -83,33 +78,27 @@ func TestAccS3ObjectDataSource_basicViaAccessPoint(t *testing.T) {
 
 func TestAccS3ObjectDataSource_readableBody(t *testing.T) {
 	ctx := acctest.Context(t)
-	rInt := sdkacctest.RandInt()
-
-	var rObj s3.GetObjectOutput
-	var dsObj s3.GetObjectOutput
-
-	resourceName := "aws_s3_object.object"
-	dataSourceName := "data.aws_s3_object.obj"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_s3_object.test"
+	dataSourceName := "data.aws_s3_object.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                  func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:                acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:                acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories:  acctest.ProtoV5ProviderFactories,
 		PreventPostDestroyRefresh: true,
 		Steps: []resource.TestStep{
 			{
-				Config: testAccObjectDataSourceConfig_readableBody(rInt),
+				Config: testAccObjectDataSourceConfig_readableBody(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckObjectExists(ctx, resourceName, &rObj),
-					testAccCheckObjectExistsDataSource(ctx, dataSourceName, &dsObj),
+					resource.TestCheckResourceAttr(dataSourceName, "body", "yes"),
 					resource.TestCheckResourceAttr(dataSourceName, "content_length", "3"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "content_type", resourceName, "content_type"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "etag", resourceName, "etag"),
-					resource.TestMatchResourceAttr(dataSourceName, "last_modified", regexp.MustCompile(rfc1123RegexPattern)),
+					resource.TestMatchResourceAttr(dataSourceName, "last_modified", regexache.MustCompile(rfc1123RegexPattern)),
 					resource.TestCheckResourceAttrPair(dataSourceName, "object_lock_legal_hold_status", resourceName, "object_lock_legal_hold_status"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "object_lock_mode", resourceName, "object_lock_mode"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "object_lock_retain_until_date", resourceName, "object_lock_retain_until_date"),
-					resource.TestCheckResourceAttr(dataSourceName, "body", "yes"),
 				),
 			},
 		},
@@ -118,35 +107,29 @@ func TestAccS3ObjectDataSource_readableBody(t *testing.T) {
 
 func TestAccS3ObjectDataSource_kmsEncrypted(t *testing.T) {
 	ctx := acctest.Context(t)
-	rInt := sdkacctest.RandInt()
-
-	var rObj s3.GetObjectOutput
-	var dsObj s3.GetObjectOutput
-
-	resourceName := "aws_s3_object.object"
-	dataSourceName := "data.aws_s3_object.obj"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_s3_object.test"
+	dataSourceName := "data.aws_s3_object.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                  func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:                acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:                acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories:  acctest.ProtoV5ProviderFactories,
 		PreventPostDestroyRefresh: true,
 		Steps: []resource.TestStep{
 			{
-				Config: testAccObjectDataSourceConfig_kmsEncrypted(rInt),
+				Config: testAccObjectDataSourceConfig_kmsEncrypted(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckObjectExists(ctx, resourceName, &rObj),
-					testAccCheckObjectExistsDataSource(ctx, dataSourceName, &dsObj),
+					resource.TestCheckResourceAttr(dataSourceName, "body", "Keep Calm and Carry On"),
 					resource.TestCheckResourceAttr(dataSourceName, "content_length", "22"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "content_type", resourceName, "content_type"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "etag", resourceName, "etag"),
-					resource.TestCheckResourceAttrPair(dataSourceName, "server_side_encryption", resourceName, "server_side_encryption"),
-					resource.TestCheckResourceAttrPair(dataSourceName, "sse_kms_key_id", resourceName, "kms_key_id"),
-					resource.TestMatchResourceAttr(dataSourceName, "last_modified", regexp.MustCompile(rfc1123RegexPattern)),
+					resource.TestMatchResourceAttr(dataSourceName, "last_modified", regexache.MustCompile(rfc1123RegexPattern)),
 					resource.TestCheckResourceAttrPair(dataSourceName, "object_lock_legal_hold_status", resourceName, "object_lock_legal_hold_status"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "object_lock_mode", resourceName, "object_lock_mode"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "object_lock_retain_until_date", resourceName, "object_lock_retain_until_date"),
-					resource.TestCheckResourceAttr(dataSourceName, "body", "Keep Calm and Carry On"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "server_side_encryption", resourceName, "server_side_encryption"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "sse_kms_key_id", resourceName, "kms_key_id"),
 				),
 			},
 		},
@@ -155,36 +138,30 @@ func TestAccS3ObjectDataSource_kmsEncrypted(t *testing.T) {
 
 func TestAccS3ObjectDataSource_bucketKeyEnabled(t *testing.T) {
 	ctx := acctest.Context(t)
-	rInt := sdkacctest.RandInt()
-
-	var rObj s3.GetObjectOutput
-	var dsObj s3.GetObjectOutput
-
-	resourceName := "aws_s3_object.object"
-	dataSourceName := "data.aws_s3_object.obj"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_s3_object.test"
+	dataSourceName := "data.aws_s3_object.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                  func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:                acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:                acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories:  acctest.ProtoV5ProviderFactories,
 		PreventPostDestroyRefresh: true,
 		Steps: []resource.TestStep{
 			{
-				Config: testAccObjectDataSourceConfig_bucketKeyEnabled(rInt),
+				Config: testAccObjectDataSourceConfig_bucketKeyEnabled(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckObjectExists(ctx, resourceName, &rObj),
-					testAccCheckObjectExistsDataSource(ctx, dataSourceName, &dsObj),
+					resource.TestCheckResourceAttr(dataSourceName, "body", "Keep Calm and Carry On"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "bucket_key_enabled", resourceName, "bucket_key_enabled"),
 					resource.TestCheckResourceAttr(dataSourceName, "content_length", "22"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "content_type", resourceName, "content_type"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "etag", resourceName, "etag"),
-					resource.TestCheckResourceAttrPair(dataSourceName, "server_side_encryption", resourceName, "server_side_encryption"),
-					resource.TestCheckResourceAttrPair(dataSourceName, "sse_kms_key_id", resourceName, "kms_key_id"),
-					resource.TestCheckResourceAttrPair(dataSourceName, "bucket_key_enabled", resourceName, "bucket_key_enabled"),
-					resource.TestMatchResourceAttr(dataSourceName, "last_modified", regexp.MustCompile(rfc1123RegexPattern)),
+					resource.TestMatchResourceAttr(dataSourceName, "last_modified", regexache.MustCompile(rfc1123RegexPattern)),
 					resource.TestCheckResourceAttrPair(dataSourceName, "object_lock_legal_hold_status", resourceName, "object_lock_legal_hold_status"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "object_lock_mode", resourceName, "object_lock_mode"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "object_lock_retain_until_date", resourceName, "object_lock_retain_until_date"),
-					resource.TestCheckResourceAttr(dataSourceName, "body", "Keep Calm and Carry On"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "server_side_encryption", resourceName, "server_side_encryption"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "sse_kms_key_id", resourceName, "kms_key_id"),
 				),
 			},
 		},
@@ -193,50 +170,44 @@ func TestAccS3ObjectDataSource_bucketKeyEnabled(t *testing.T) {
 
 func TestAccS3ObjectDataSource_allParams(t *testing.T) {
 	ctx := acctest.Context(t)
-	rInt := sdkacctest.RandInt()
-
-	var rObj s3.GetObjectOutput
-	var dsObj s3.GetObjectOutput
-
-	resourceName := "aws_s3_object.object"
-	dataSourceName := "data.aws_s3_object.obj"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_s3_object.test"
+	dataSourceName := "data.aws_s3_object.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                  func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:                acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:                acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories:  acctest.ProtoV5ProviderFactories,
 		PreventPostDestroyRefresh: true,
 		Steps: []resource.TestStep{
 			{
-				Config: testAccObjectDataSourceConfig_allParams(rInt),
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckObjectExists(ctx, resourceName, &rObj),
-					testAccCheckObjectExistsDataSource(ctx, dataSourceName, &dsObj),
-					resource.TestCheckResourceAttr(dataSourceName, "content_length", "25"),
-					resource.TestCheckResourceAttrPair(dataSourceName, "content_type", resourceName, "content_type"),
-					resource.TestCheckResourceAttrPair(dataSourceName, "etag", resourceName, "etag"),
-					resource.TestMatchResourceAttr(dataSourceName, "last_modified", regexp.MustCompile(rfc1123RegexPattern)),
-					resource.TestCheckResourceAttrPair(dataSourceName, "version_id", resourceName, "version_id"),
+				Config: testAccObjectDataSourceConfig_allParams(rName),
+				Check: resource.ComposeAggregateTestCheckFunc(
 					resource.TestCheckNoResourceAttr(dataSourceName, "body"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "bucket_key_enabled", resourceName, "bucket_key_enabled"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "cache_control", resourceName, "cache_control"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "content_disposition", resourceName, "content_disposition"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "content_encoding", resourceName, "content_encoding"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "content_language", resourceName, "content_language"),
-					// Encryption is off
-					resource.TestCheckResourceAttrPair(dataSourceName, "server_side_encryption", resourceName, "server_side_encryption"),
-					resource.TestCheckResourceAttr(dataSourceName, "sse_kms_key_id", ""),
-					// Supported, but difficult to reproduce in short testing time
-					resource.TestCheckResourceAttrPair(dataSourceName, "storage_class", resourceName, "storage_class"),
+					resource.TestCheckResourceAttr(dataSourceName, "content_length", "25"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "content_type", resourceName, "content_type"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "etag", resourceName, "etag"),
 					resource.TestCheckResourceAttr(dataSourceName, "expiration", ""),
 					// Currently unsupported in aws_s3_object resource
 					resource.TestCheckResourceAttr(dataSourceName, "expires", ""),
-					resource.TestCheckResourceAttrPair(dataSourceName, "website_redirect_location", resourceName, "website_redirect"),
+					resource.TestMatchResourceAttr(dataSourceName, "last_modified", regexache.MustCompile(rfc1123RegexPattern)),
 					resource.TestCheckResourceAttr(dataSourceName, "metadata.%", "0"),
-					resource.TestCheckResourceAttr(dataSourceName, "tags.%", "1"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "object_lock_legal_hold_status", resourceName, "object_lock_legal_hold_status"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "object_lock_mode", resourceName, "object_lock_mode"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "object_lock_retain_until_date", resourceName, "object_lock_retain_until_date"),
+					// Encryption is off
+					resource.TestCheckResourceAttrPair(dataSourceName, "server_side_encryption", resourceName, "server_side_encryption"),
+					resource.TestCheckResourceAttr(dataSourceName, "sse_kms_key_id", ""),
+					// Supported, but difficult to reproduce in short testing time
+					resource.TestCheckResourceAttrPair(dataSourceName, "storage_class", resourceName, "storage_class"),
+					resource.TestCheckResourceAttr(dataSourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "version_id", resourceName, "version_id"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "website_redirect_location", resourceName, "website_redirect"),
 				),
 			},
 		},
@@ -245,33 +216,27 @@ func TestAccS3ObjectDataSource_allParams(t *testing.T) {
 
 func TestAccS3ObjectDataSource_objectLockLegalHoldOff(t *testing.T) {
 	ctx := acctest.Context(t)
-	rInt := sdkacctest.RandInt()
-
-	var rObj s3.GetObjectOutput
-	var dsObj s3.GetObjectOutput
-
-	resourceName := "aws_s3_object.object"
-	dataSourceName := "data.aws_s3_object.obj"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_s3_object.test"
+	dataSourceName := "data.aws_s3_object.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                  func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:                acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:                acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories:  acctest.ProtoV5ProviderFactories,
 		PreventPostDestroyRefresh: true,
 		Steps: []resource.TestStep{
 			{
-				Config: testAccObjectDataSourceConfig_lockLegalHoldOff(rInt),
+				Config: testAccObjectDataSourceConfig_lockLegalHoldOff(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckObjectExists(ctx, resourceName, &rObj),
-					testAccCheckObjectExistsDataSource(ctx, dataSourceName, &dsObj),
+					resource.TestCheckNoResourceAttr(dataSourceName, "body"),
 					resource.TestCheckResourceAttr(dataSourceName, "content_length", "11"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "content_type", resourceName, "content_type"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "etag", resourceName, "etag"),
-					resource.TestMatchResourceAttr(dataSourceName, "last_modified", regexp.MustCompile(rfc1123RegexPattern)),
+					resource.TestMatchResourceAttr(dataSourceName, "last_modified", regexache.MustCompile(rfc1123RegexPattern)),
 					resource.TestCheckResourceAttrPair(dataSourceName, "object_lock_legal_hold_status", resourceName, "object_lock_legal_hold_status"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "object_lock_mode", resourceName, "object_lock_mode"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "object_lock_retain_until_date", resourceName, "object_lock_retain_until_date"),
-					resource.TestCheckNoResourceAttr(dataSourceName, "body"),
 				),
 			},
 		},
@@ -280,34 +245,28 @@ func TestAccS3ObjectDataSource_objectLockLegalHoldOff(t *testing.T) {
 
 func TestAccS3ObjectDataSource_objectLockLegalHoldOn(t *testing.T) {
 	ctx := acctest.Context(t)
-	rInt := sdkacctest.RandInt()
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	retainUntilDate := time.Now().UTC().AddDate(0, 0, 10).Format(time.RFC3339)
-
-	var rObj s3.GetObjectOutput
-	var dsObj s3.GetObjectOutput
-
-	resourceName := "aws_s3_object.object"
-	dataSourceName := "data.aws_s3_object.obj"
+	resourceName := "aws_s3_object.test"
+	dataSourceName := "data.aws_s3_object.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                  func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:                acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:                acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories:  acctest.ProtoV5ProviderFactories,
 		PreventPostDestroyRefresh: true,
 		Steps: []resource.TestStep{
 			{
-				Config: testAccObjectDataSourceConfig_lockLegalHoldOn(rInt, retainUntilDate),
+				Config: testAccObjectDataSourceConfig_lockLegalHoldOn(rName, retainUntilDate),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckObjectExists(ctx, resourceName, &rObj),
-					testAccCheckObjectExistsDataSource(ctx, dataSourceName, &dsObj),
+					resource.TestCheckNoResourceAttr(dataSourceName, "body"),
 					resource.TestCheckResourceAttr(dataSourceName, "content_length", "11"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "content_type", resourceName, "content_type"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "etag", resourceName, "etag"),
-					resource.TestMatchResourceAttr(dataSourceName, "last_modified", regexp.MustCompile(rfc1123RegexPattern)),
+					resource.TestMatchResourceAttr(dataSourceName, "last_modified", regexache.MustCompile(rfc1123RegexPattern)),
 					resource.TestCheckResourceAttrPair(dataSourceName, "object_lock_legal_hold_status", resourceName, "object_lock_legal_hold_status"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "object_lock_mode", resourceName, "object_lock_mode"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "object_lock_retain_until_date", resourceName, "object_lock_retain_until_date"),
-					resource.TestCheckNoResourceAttr(dataSourceName, "body"),
 				),
 			},
 		},
@@ -316,52 +275,43 @@ func TestAccS3ObjectDataSource_objectLockLegalHoldOn(t *testing.T) {
 
 func TestAccS3ObjectDataSource_leadingSlash(t *testing.T) {
 	ctx := acctest.Context(t)
-	var rObj s3.GetObjectOutput
-	var dsObj1, dsObj2, dsObj3 s3.GetObjectOutput
-
-	resourceName := "aws_s3_object.object"
-	dataSourceName1 := "data.aws_s3_object.obj1"
-	dataSourceName2 := "data.aws_s3_object.obj2"
-	dataSourceName3 := "data.aws_s3_object.obj3"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_s3_object.test"
+	dataSourceName1 := "data.aws_s3_object.test1"
+	dataSourceName2 := "data.aws_s3_object.test2"
+	dataSourceName3 := "data.aws_s3_object.test3"
 
-	rInt := sdkacctest.RandInt()
-	resourceOnlyConf, conf := testAccObjectDataSourceConfig_leadingSlash(rInt)
+	resourceOnlyConf, conf := testAccObjectDataSourceConfig_leadingSlash(rName)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                  func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:                acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:                acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories:  acctest.ProtoV5ProviderFactories,
 		PreventPostDestroyRefresh: true,
 		Steps: []resource.TestStep{
 			{ // nosemgrep:ci.test-config-funcs-correct-form
 				Config: resourceOnlyConf,
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckObjectExists(ctx, resourceName, &rObj),
-				),
 			},
 			{ // nosemgrep:ci.test-config-funcs-correct-form
 				Config: conf,
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckObjectExistsDataSource(ctx, dataSourceName1, &dsObj1),
+					resource.TestCheckResourceAttr(dataSourceName1, "body", "yes"),
 					resource.TestCheckResourceAttr(dataSourceName1, "content_length", "3"),
 					resource.TestCheckResourceAttrPair(dataSourceName1, "content_type", resourceName, "content_type"),
 					resource.TestCheckResourceAttrPair(dataSourceName1, "etag", resourceName, "etag"),
-					resource.TestMatchResourceAttr(dataSourceName1, "last_modified", regexp.MustCompile(rfc1123RegexPattern)),
-					resource.TestCheckResourceAttr(dataSourceName1, "body", "yes"),
+					resource.TestMatchResourceAttr(dataSourceName1, "last_modified", regexache.MustCompile(rfc1123RegexPattern)),
 
-					testAccCheckObjectExistsDataSource(ctx, dataSourceName2, &dsObj2),
+					resource.TestCheckResourceAttr(dataSourceName2, "body", "yes"),
 					resource.TestCheckResourceAttr(dataSourceName2, "content_length", "3"),
 					resource.TestCheckResourceAttrPair(dataSourceName2, "content_type", resourceName, "content_type"),
 					resource.TestCheckResourceAttrPair(dataSourceName2, "etag", resourceName, "etag"),
-					resource.TestMatchResourceAttr(dataSourceName2, "last_modified", regexp.MustCompile(rfc1123RegexPattern)),
-					resource.TestCheckResourceAttr(dataSourceName2, "body", "yes"),
+					resource.TestMatchResourceAttr(dataSourceName2, "last_modified", regexache.MustCompile(rfc1123RegexPattern)),
 
-					testAccCheckObjectExistsDataSource(ctx, dataSourceName3, &dsObj3),
+					resource.TestCheckResourceAttr(dataSourceName3, "body", "yes"),
 					resource.TestCheckResourceAttr(dataSourceName3, "content_length", "3"),
 					resource.TestCheckResourceAttrPair(dataSourceName3, "content_type", resourceName, "content_type"),
 					resource.TestCheckResourceAttrPair(dataSourceName3, "etag", resourceName, "etag"),
-					resource.TestMatchResourceAttr(dataSourceName3, "last_modified", regexp.MustCompile(rfc1123RegexPattern)),
-					resource.TestCheckResourceAttr(dataSourceName3, "body", "yes"),
+					resource.TestMatchResourceAttr(dataSourceName3, "last_modified", regexache.MustCompile(rfc1123RegexPattern)),
 				),
 			},
 		},
@@ -370,49 +320,38 @@ func TestAccS3ObjectDataSource_leadingSlash(t *testing.T) {
 
 func TestAccS3ObjectDataSource_multipleSlashes(t *testing.T) {
 	ctx := acctest.Context(t)
-	var rObj1, rObj2 s3.GetObjectOutput
-	var dsObj1, dsObj2, dsObj3 s3.GetObjectOutput
-
-	resourceName1 := "aws_s3_object.object1"
-	resourceName2 := "aws_s3_object.object2"
-	dataSourceName1 := "data.aws_s3_object.obj1"
-	dataSourceName2 := "data.aws_s3_object.obj2"
-	dataSourceName3 := "data.aws_s3_object.obj3"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName1 := "aws_s3_object.test1"
+	resourceName2 := "aws_s3_object.test2"
+	dataSourceName1 := "data.aws_s3_object.test1"
+	dataSourceName2 := "data.aws_s3_object.test2"
+	dataSourceName3 := "data.aws_s3_object.test3"
 
-	rInt := sdkacctest.RandInt()
-	resourceOnlyConf, conf := testAccObjectDataSourceConfig_multipleSlashes(rInt)
+	resourceOnlyConf, conf := testAccObjectDataSourceConfig_multipleSlashes(rName)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                  func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:                acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:                acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories:  acctest.ProtoV5ProviderFactories,
 		PreventPostDestroyRefresh: true,
 		Steps: []resource.TestStep{
 			{ // nosemgrep:ci.test-config-funcs-correct-form
 				Config: resourceOnlyConf,
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckObjectExists(ctx, resourceName1, &rObj1),
-					testAccCheckObjectExists(ctx, resourceName2, &rObj2),
-				),
 			},
 			{ // nosemgrep:ci.test-config-funcs-correct-form
 				Config: conf,
 				Check: resource.ComposeTestCheckFunc(
-
-					testAccCheckObjectExistsDataSource(ctx, dataSourceName1, &dsObj1),
+					resource.TestCheckResourceAttr(dataSourceName1, "body", "yes"),
 					resource.TestCheckResourceAttr(dataSourceName1, "content_length", "3"),
 					resource.TestCheckResourceAttrPair(dataSourceName1, "content_type", resourceName1, "content_type"),
-					resource.TestCheckResourceAttr(dataSourceName1, "body", "yes"),
 
-					testAccCheckObjectExistsDataSource(ctx, dataSourceName2, &dsObj2),
+					resource.TestCheckResourceAttr(dataSourceName2, "body", "yes"),
 					resource.TestCheckResourceAttr(dataSourceName2, "content_length", "3"),
 					resource.TestCheckResourceAttrPair(dataSourceName2, "content_type", resourceName1, "content_type"),
-					resource.TestCheckResourceAttr(dataSourceName2, "body", "yes"),
 
-					testAccCheckObjectExistsDataSource(ctx, dataSourceName3, &dsObj3),
+					resource.TestCheckResourceAttr(dataSourceName3, "body", "no"),
 					resource.TestCheckResourceAttr(dataSourceName3, "content_length", "2"),
 					resource.TestCheckResourceAttrPair(dataSourceName3, "content_type", resourceName2, "content_type"),
-					resource.TestCheckResourceAttr(dataSourceName3, "body", "no"),
 				),
 			},
 		},
@@ -421,70 +360,125 @@ func TestAccS3ObjectDataSource_multipleSlashes(t *testing.T) {
 
 func TestAccS3ObjectDataSource_singleSlashAsKey(t *testing.T) {
 	ctx := acctest.Context(t)
-	var dsObj s3.GetObjectOutput
-	dataSourceName := "data.aws_s3_object.test"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                  func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:                acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:                acctest.ErrorCheck(t, names.S3EndpointID),
+		ProtoV5ProviderFactories:  acctest.ProtoV5ProviderFactories,
+		PreventPostDestroyRefresh: true,
+		Steps: []resource.TestStep{
+			{
+				Config:      testAccObjectDataSourceConfig_singleSlashAsKey(rName),
+				ExpectError: regexache.MustCompile(`input member Key must not be empty`),
+			},
+		},
+	})
+}
+
+func TestAccS3ObjectDataSource_checksumMode(t *testing.T) {
+	ctx := acctest.Context(t)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_s3_object.test"
+	dataSourceName := "data.aws_s3_object.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                  func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:                acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories:  acctest.ProtoV5ProviderFactories,
 		PreventPostDestroyRefresh: true,
 		Steps: []resource.TestStep{
 			{
-				Config: testAccObjectDataSourceConfig_singleSlashAsKey(rName),
+				Config: testAccObjectDataSourceConfig_checksumMode(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckObjectExistsDataSource(ctx, dataSourceName, &dsObj),
+					resource.TestCheckResourceAttr(dataSourceName, "checksum_mode", "ENABLED"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "checksum_crc32", resourceName, "checksum_crc32"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "checksum_crc32c", resourceName, "checksum_crc32c"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "checksum_sha1", resourceName, "checksum_sha1"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "checksum_sha256", resourceName, "checksum_sha256"),
+					resource.TestCheckResourceAttrSet(dataSourceName, "checksum_sha256"),
 				),
 			},
 		},
 	})
 }
 
-func testAccCheckObjectExistsDataSource(ctx context.Context, n string, obj *s3.GetObjectOutput) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		rs, ok := s.RootModule().Resources[n]
-		if !ok {
-			return fmt.Errorf("Can't find S3 object data source: %s", n)
-		}
-
-		if rs.Primary.ID == "" {
-			return fmt.Errorf("S3 object data source ID not set")
-		}
+func TestAccS3ObjectDataSource_metadata(t *testing.T) {
+	ctx := acctest.Context(t)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	dataSourceName := "data.aws_s3_object.test"
 
-		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Conn(ctx)
-		out, err := conn.GetObjectWithContext(ctx, &s3.GetObjectInput{
-			Bucket: aws.String(rs.Primary.Attributes["bucket"]),
-			Key:    aws.String(rs.Primary.Attributes["key"]),
-		})
-		if err != nil {
-			return fmt.Errorf("Failed getting S3 Object from %s: %s",
-				rs.Primary.Attributes["bucket"]+"/"+rs.Primary.Attributes["key"], err)
-		}
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                  func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:                acctest.ErrorCheck(t, names.S3EndpointID),
+		ProtoV5ProviderFactories:  acctest.ProtoV5ProviderFactories,
+		PreventPostDestroyRefresh: true,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccObjectDataSourceConfig_metadata(rName),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(dataSourceName, "metadata.%", "2"),
+					resource.TestCheckResourceAttr(dataSourceName, "metadata.key1", "value1"),
+					resource.TestCheckResourceAttr(dataSourceName, "metadata.key2", "Value2"),
+				),
+			},
+		},
+	})
+}
 
-		*obj = *out
+func TestAccS3ObjectDataSource_metadataUppercaseKey(t *testing.T) {
+	ctx := acctest.Context(t)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	key := fmt.Sprintf("%[1]s-key", rName)
+	bucketResourceName := "aws_s3_bucket.test"
+	dataSourceName := "data.aws_s3_object.test"
 
-		return nil
-	}
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                  func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:                acctest.ErrorCheck(t, names.S3EndpointID),
+		ProtoV5ProviderFactories:  acctest.ProtoV5ProviderFactories,
+		PreventPostDestroyRefresh: true,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccObjectDataSourceConfig_metadataBucketOnly(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckBucketAddObjectWithMetadata(ctx, bucketResourceName, key, map[string]string{
+						"key1": "value1",
+						"Key2": "Value2",
+					}),
+				),
+			},
+			{
+				Config: testAccObjectDataSourceConfig_metadataBucketAndDS(rName, key),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(dataSourceName, "metadata.%", "2"),
+					resource.TestCheckResourceAttr(dataSourceName, "metadata.key1", "value1"),
+					// https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/service/s3#HeadObjectOutput
+					// Map keys will be normalized to lower-case.
+					resource.TestCheckResourceAttr(dataSourceName, "metadata.key2", "Value2"),
+				),
+			},
+		},
+	})
 }
 
-func testAccObjectDataSourceConfig_basic(randInt int) string {
+func testAccObjectDataSourceConfig_basic(rName string) string {
 	return fmt.Sprintf(`
-resource "aws_s3_bucket" "object_bucket" {
-  bucket = "tf-object-test-bucket-%[1]d"
+resource "aws_s3_bucket" "test" {
+  bucket = %[1]q
 }
 
-resource "aws_s3_object" "object" {
-  bucket  = aws_s3_bucket.object_bucket.bucket
-  key     = "tf-testing-obj-%[1]d"
+resource "aws_s3_object" "test" {
+  bucket  = aws_s3_bucket.test.bucket
+  key     = "%[1]s-key"
   content = "Hello World"
 }
 
-data "aws_s3_object" "obj" {
-  bucket = aws_s3_bucket.object_bucket.bucket
-  key    = aws_s3_object.object.key
+data "aws_s3_object" "test" {
+  bucket = aws_s3_bucket.test.bucket
+  key    = aws_s3_object.test.key
 }
-`, randInt)
+`, rName)
 }
 
 func testAccObjectDataSourceConfig_basicViaAccessPoint(rName string) string {
@@ -500,7 +494,7 @@ resource "aws_s3_access_point" "test" {
 
 resource "aws_s3_object" "test" {
   bucket  = aws_s3_bucket.test.bucket
-  key     = %[1]q
+  key     = "%[1]s-key"
   content = "Hello World"
 }
 
@@ -511,98 +505,98 @@ data "aws_s3_object" "test" {
 `, rName)
 }
 
-func testAccObjectDataSourceConfig_readableBody(randInt int) string {
+func testAccObjectDataSourceConfig_readableBody(rName string) string {
 	return fmt.Sprintf(`
-resource "aws_s3_bucket" "object_bucket" {
-  bucket = "tf-object-test-bucket-%[1]d"
+resource "aws_s3_bucket" "test" {
+  bucket = %[1]q
 }
 
-resource "aws_s3_object" "object" {
-  bucket       = aws_s3_bucket.object_bucket.bucket
-  key          = "tf-testing-obj-%[1]d-readable"
+resource "aws_s3_object" "test" {
+  bucket       = aws_s3_bucket.test.bucket
+  key          = "%[1]s-key"
   content      = "yes"
   content_type = "text/plain"
 }
 
-data "aws_s3_object" "obj" {
-  bucket = aws_s3_bucket.object_bucket.bucket
-  key    = aws_s3_object.object.key
+data "aws_s3_object" "test" {
+  bucket = aws_s3_bucket.test.bucket
+  key    = aws_s3_object.test.key
 }
-`, randInt)
+`, rName)
 }
 
-func testAccObjectDataSourceConfig_kmsEncrypted(randInt int) string {
+func testAccObjectDataSourceConfig_kmsEncrypted(rName string) string {
 	return fmt.Sprintf(`
-resource "aws_s3_bucket" "object_bucket" {
-  bucket = "tf-object-test-bucket-%[1]d"
+resource "aws_s3_bucket" "test" {
+  bucket = %[1]q
 }
 
-resource "aws_kms_key" "example" {
-  description             = "TF Acceptance Test KMS key"
+resource "aws_kms_key" "test" {
+  description             = %[1]q
   deletion_window_in_days = 7
 }
 
-resource "aws_s3_object" "object" {
-  bucket       = aws_s3_bucket.object_bucket.bucket
-  key          = "tf-testing-obj-%[1]d-encrypted"
+resource "aws_s3_object" "test" {
+  bucket       = aws_s3_bucket.test.bucket
+  key          = "%[1]s-key"
   content      = "Keep Calm and Carry On"
   content_type = "text/plain"
-  kms_key_id   = aws_kms_key.example.arn
+  kms_key_id   = aws_kms_key.test.arn
 }
 
-data "aws_s3_object" "obj" {
-  bucket = aws_s3_bucket.object_bucket.bucket
-  key    = aws_s3_object.object.key
+data "aws_s3_object" "test" {
+  bucket = aws_s3_bucket.test.bucket
+  key    = aws_s3_object.test.key
 }
-`, randInt)
+`, rName)
 }
 
-func testAccObjectDataSourceConfig_bucketKeyEnabled(randInt int) string {
+func testAccObjectDataSourceConfig_bucketKeyEnabled(rName string) string {
 	return fmt.Sprintf(`
-resource "aws_s3_bucket" "object_bucket" {
-  bucket = "tf-object-test-bucket-%[1]d"
+resource "aws_s3_bucket" "test" {
+  bucket = %[1]q
 }
 
-resource "aws_kms_key" "example" {
-  description             = "TF Acceptance Test KMS key"
+resource "aws_kms_key" "test" {
+  description             = %[1]q
   deletion_window_in_days = 7
 }
 
-resource "aws_s3_object" "object" {
-  bucket             = aws_s3_bucket.object_bucket.bucket
-  key                = "tf-testing-obj-%[1]d-encrypted"
+resource "aws_s3_object" "test" {
+  bucket             = aws_s3_bucket.test.bucket
+  key                = "%[1]s-key"
   content            = "Keep Calm and Carry On"
   content_type       = "text/plain"
-  kms_key_id         = aws_kms_key.example.arn
+  kms_key_id         = aws_kms_key.test.arn
   bucket_key_enabled = true
 }
 
-data "aws_s3_object" "obj" {
-  bucket = aws_s3_bucket.object_bucket.bucket
-  key    = aws_s3_object.object.key
+data "aws_s3_object" "test" {
+  bucket = aws_s3_bucket.test.bucket
+  key    = aws_s3_object.test.key
 }
-`, randInt)
+`, rName)
 }
 
-func testAccObjectDataSourceConfig_allParams(randInt int) string {
+func testAccObjectDataSourceConfig_allParams(rName string) string {
 	return fmt.Sprintf(`
-resource "aws_s3_bucket" "object_bucket" {
-  bucket = "tf-object-test-bucket-%[1]d"
+resource "aws_s3_bucket" "test" {
+  bucket = %[1]q
 }
 
-resource "aws_s3_bucket_versioning" "object_bucket" {
-  bucket = aws_s3_bucket.object_bucket.id
+resource "aws_s3_bucket_versioning" "test" {
+  bucket = aws_s3_bucket.test.id
   versioning_configuration {
     status = "Enabled"
   }
 }
 
-resource "aws_s3_object" "object" {
+resource "aws_s3_object" "test" {
   # Must have bucket versioning enabled first
-  depends_on = [aws_s3_bucket_versioning.object_bucket]
+  depends_on = [aws_s3_bucket_versioning.test]
 
-  bucket = aws_s3_bucket.object_bucket.bucket
-  key    = "tf-testing-obj-%[1]d-all-params"
+  bucket = aws_s3_bucket.test.bucket
+  key    = "%[1]s-key"
 
   content             = <<CONTENT
 {
@@ -616,156 +610,152 @@ CONTENT
   content_language    = "en-GB"
 
   tags = {
-    Key1 = "Value 1"
+    Name = %[1]q
   }
 }
 
-data "aws_s3_object" "obj" {
-  bucket = aws_s3_bucket.object_bucket.bucket
-  key    = aws_s3_object.object.key
+data "aws_s3_object" "test" {
+  bucket = aws_s3_bucket.test.bucket
+  key    = aws_s3_object.test.key
 }
-`, randInt)
+`, rName)
 }
 
-func testAccObjectDataSourceConfig_lockLegalHoldOff(randInt int) string {
+func testAccObjectDataSourceConfig_lockLegalHoldOff(rName string) string {
 	return fmt.Sprintf(`
-resource "aws_s3_bucket" "object_bucket" {
-  bucket = "tf-object-test-bucket-%[1]d"
+resource "aws_s3_bucket" "test" {
+  bucket = %[1]q
 
   object_lock_enabled = true
 }
 
-resource "aws_s3_bucket_versioning" "object_bucket" {
-  bucket = aws_s3_bucket.object_bucket.id
+resource "aws_s3_bucket_versioning" "test" {
+  bucket = aws_s3_bucket.test.id
   versioning_configuration {
     status = "Enabled"
   }
 }
 
-resource "aws_s3_object" "object" {
+resource "aws_s3_object" "test" {
   # Must have bucket versioning enabled first
-  bucket                        = aws_s3_bucket_versioning.object_bucket.bucket
-  key                           = "tf-testing-obj-%[1]d"
+  bucket                        = aws_s3_bucket_versioning.test.bucket
+  key                           = "%[1]s-key"
   content                       = "Hello World"
   object_lock_legal_hold_status = "OFF"
 }
 
-data "aws_s3_object" "obj" {
-  bucket = aws_s3_bucket.object_bucket.bucket
-  key    = aws_s3_object.object.key
+data "aws_s3_object" "test" {
+  bucket = aws_s3_bucket.test.bucket
+  key    = aws_s3_object.test.key
 }
-`, randInt)
+`, rName)
 }
 
-func testAccObjectDataSourceConfig_lockLegalHoldOn(randInt int, retainUntilDate string) string {
+func testAccObjectDataSourceConfig_lockLegalHoldOn(rName, retainUntilDate string) string {
 	return fmt.Sprintf(`
-resource "aws_s3_bucket" "object_bucket" {
-  bucket = "tf-object-test-bucket-%[1]d"
+resource "aws_s3_bucket" "test" {
+  bucket = %[1]q
 
   object_lock_enabled = true
 }
 
-resource "aws_s3_bucket_versioning" "object_bucket" {
-  bucket = aws_s3_bucket.object_bucket.id
+resource "aws_s3_bucket_versioning" "test" {
+  bucket = aws_s3_bucket.test.id
   versioning_configuration {
     status = "Enabled"
   }
 }
 
-resource "aws_s3_object" "object" {
+resource "aws_s3_object" "test" {
   # Must have bucket versioning enabled first
-  bucket                        = aws_s3_bucket_versioning.object_bucket.bucket
-  key                           = "tf-testing-obj-%[1]d"
+  bucket                        = aws_s3_bucket_versioning.test.bucket
+  key                           = "%[1]s-key"
   content                       = "Hello World"
   force_destroy                 = true
   object_lock_legal_hold_status = "ON"
   object_lock_mode              = "GOVERNANCE"
-  object_lock_retain_until_date = "%[2]s"
+  object_lock_retain_until_date = %[2]q
 }
 
-data "aws_s3_object" "obj" {
-  bucket = aws_s3_bucket.object_bucket.bucket
-  key    = aws_s3_object.object.key
+data "aws_s3_object" "test" {
+  bucket = aws_s3_bucket.test.bucket
+  key    = aws_s3_object.test.key
 }
-`, randInt, retainUntilDate)
+`, rName, retainUntilDate)
 }
 
-func testAccObjectDataSourceConfig_leadingSlash(randInt int) (string, string) {
+func testAccObjectDataSourceConfig_leadingSlash(rName string) (string, string) {
 	resources := fmt.Sprintf(`
-resource "aws_s3_bucket" "object_bucket" {
-  bucket = "tf-object-test-bucket-%[1]d"
+resource "aws_s3_bucket" "test" {
+  bucket = %[1]q
 }
 
-resource "aws_s3_object" "object" {
-  bucket       = aws_s3_bucket.object_bucket.bucket
-  key          = "//tf-testing-obj-%[1]d-readable"
+resource "aws_s3_object" "test" {
+  bucket       = aws_s3_bucket.test.bucket
+  key          = "//%[1]s-key"
   content      = "yes"
   content_type = "text/plain"
 }
-`, randInt)
-
-	both := fmt.Sprintf(`
-%[1]s
+`, rName)
 
-data "aws_s3_object" "obj1" {
-  bucket = aws_s3_bucket.object_bucket.bucket
-  key    = "tf-testing-obj-%[2]d-readable"
+	both := acctest.ConfigCompose(resources, fmt.Sprintf(`
+data "aws_s3_object" "test1" {
+  bucket = aws_s3_bucket.test.bucket
+  key    = "%[1]s-key"
 }
 
-data "aws_s3_object" "obj2" {
-  bucket = aws_s3_bucket.object_bucket.bucket
-  key    = "/tf-testing-obj-%[2]d-readable"
+data "aws_s3_object" "test2" {
+  bucket = aws_s3_bucket.test.bucket
+  key    = "/%[1]s-key"
 }
 
-data "aws_s3_object" "obj3" {
-  bucket = aws_s3_bucket.object_bucket.bucket
-  key    = "//tf-testing-obj-%[2]d-readable"
+data "aws_s3_object" "test3" {
+  bucket = aws_s3_bucket.test.bucket
+  key    = "//%[1]s-key"
 }
-`, resources, randInt)
+`, rName))
 
 	return resources, both
 }
 
-func testAccObjectDataSourceConfig_multipleSlashes(randInt int) (string, string) {
+func testAccObjectDataSourceConfig_multipleSlashes(rName string) (string, string) {
 	resources := fmt.Sprintf(`
-resource "aws_s3_bucket" "object_bucket" {
-  bucket = "tf-object-test-bucket-%[1]d"
+resource "aws_s3_bucket" "test" {
+  bucket = %[1]q
 }
 
-resource "aws_s3_object" "object1" {
-  bucket       = aws_s3_bucket.object_bucket.bucket
+resource "aws_s3_object" "test1" {
+  bucket       = aws_s3_bucket.test.bucket
   key          = "first//second///third//"
   content      = "yes"
   content_type = "text/plain"
 }
 
 # Without a trailing slash.
-resource "aws_s3_object" "object2" {
-  bucket       = aws_s3_bucket.object_bucket.bucket
+resource "aws_s3_object" "test2" {
+  bucket       = aws_s3_bucket.test.bucket
   key          = "/first////second/third"
   content      = "no"
   content_type = "text/plain"
 }
-`, randInt)
-
-	both := fmt.Sprintf(`
-%s
+`, rName)
 
-data "aws_s3_object" "obj1" {
-  bucket = aws_s3_bucket.object_bucket.bucket
+	both := acctest.ConfigCompose(resources, `
+data "aws_s3_object" "test1" {
+  bucket = aws_s3_bucket.test.bucket
   key    = "first/second/third/"
 }
 
-data "aws_s3_object" "obj2" {
-  bucket = aws_s3_bucket.object_bucket.bucket
+data "aws_s3_object" "test2" {
+  bucket = aws_s3_bucket.test.bucket
   key    = "first//second///third//"
 }
 
-data "aws_s3_object" "obj3" {
-  bucket = aws_s3_bucket.object_bucket.bucket
+data "aws_s3_object" "test3" {
+  bucket = aws_s3_bucket.test.bucket
   key    = "first/second/third"
 }
-`, resources)
+`)
 
 	return resources, both
 }
@@ -782,3 +772,73 @@ data "aws_s3_object" "test" {
 }
 `, rName)
 }
+
+func testAccObjectDataSourceConfig_checksumMode(rName string) string {
+	return fmt.Sprintf(`
+resource "aws_s3_bucket" "test" {
+  bucket = %[1]q
+}
+
+resource "aws_s3_object" "test" {
+  bucket  = aws_s3_bucket.test.bucket
+  key     = "%[1]s-key"
+  content = "Keep Calm and Carry On"
+
+  checksum_algorithm = "SHA256"
+}
+
+data "aws_s3_object" "test" {
+  bucket = aws_s3_bucket.test.bucket
+  key    = aws_s3_object.test.key
+
+  checksum_mode = "ENABLED"
+}
+`, rName)
+}
+
+func testAccObjectDataSourceConfig_metadata(rName string) string {
+	return fmt.Sprintf(`
+resource "aws_s3_bucket" "test" {
+  bucket = %[1]q
+}
+
+resource "aws_s3_object" "test" {
+  bucket  = aws_s3_bucket.test.bucket
+  key     = "%[1]s-key"
+  content = "Hello World"
+
+  metadata = {
+    key1 = "value1"
+    key2 = "Value2"
+  }
+}
+
+data "aws_s3_object" "test" {
+  bucket = aws_s3_bucket.test.bucket
+  key    = aws_s3_object.test.key
+}
+`, rName)
+}
+
+func testAccObjectDataSourceConfig_metadataBucketOnly(rName string) string {
+	return fmt.Sprintf(`
+resource "aws_s3_bucket" "test" {
+  bucket        = %[1]q
+  force_destroy = true
+}
+`, rName)
+}
+
+func testAccObjectDataSourceConfig_metadataBucketAndDS(rName, key string) string {
+	return fmt.Sprintf(`
+resource "aws_s3_bucket" "test" {
+  bucket        = %[1]q
+  force_destroy = true
+}
+
+data "aws_s3_object" "test" {
+  bucket = aws_s3_bucket.test.bucket
+  key    = %[2]q
+}
+`, rName, key)
+}
diff --git a/internal/service/s3/object_test.go b/internal/service/s3/object_test.go
index 348bb11ef3a..7d743a679b4 100644
--- a/internal/service/s3/object_test.go
+++ b/internal/service/s3/object_test.go
@@ -1,21 +1,23 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3_test
 
 import (
 	"context"
 	"encoding/base64"
+	"errors"
 	"fmt"
 	"io"
 	"os"
-	"reflect"
-	"regexp"
 	"sort"
 	"testing"
 	"time"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/s3"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/s3"
+	"github.com/aws/aws-sdk-go-v2/service/s3/types"
+	"github.com/google/go-cmp/cmp"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
@@ -24,59 +26,171 @@ import (
 	tfs3 "github.com/hashicorp/terraform-provider-aws/internal/service/s3"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
-func TestAccS3Object_noNameNoKey(t *testing.T) {
+func TestSDKv1CompatibleCleanKey(t *testing.T) {
+	t.Parallel()
+
+	testCases := []struct {
+		name string
+		key  string
+		want string
+	}{
+		{
+			name: "empty string",
+		},
+		{
+			name: "no slashes",
+			key:  "test-key",
+			want: "test-key",
+		},
+		{
+			name: "just a slash",
+			key:  "/",
+			want: "",
+		},
+		{
+			name: "simple slashes",
+			key:  "dir1/dir2/test-key",
+			want: "dir1/dir2/test-key",
+		},
+		{
+			name: "trailing slash",
+			key:  "a/b/c/",
+			want: "a/b/c/",
+		},
+		{
+			name: "leading slash",
+			key:  "/a/b/c",
+			want: "a/b/c",
+		},
+		{
+			name: "leading and trailing slashes",
+			key:  "/a/b/c/",
+			want: "a/b/c/",
+		},
+		{
+			name: "multiple leading slashes",
+			key:  "/////a/b/c",
+			want: "a/b/c",
+		},
+		{
+			name: "multiple trailing slashes",
+			key:  "a/b/c/////",
+			want: "a/b/c/",
+		},
+		{
+			name: "repeated inner slashes",
+			key:  "a/b//c///d/////e",
+			want: "a/b/c/d/e",
+		},
+		{
+			name: "all the slashes",
+			key:  "/a/b//c///d/////e/",
+			want: "a/b/c/d/e/",
+		},
+	}
+
+	for _, testCase := range testCases {
+		testCase := testCase
+		t.Run(testCase.name, func(t *testing.T) {
+			t.Parallel()
+
+			if got, want := tfs3.SDKv1CompatibleCleanKey(testCase.key), testCase.want; got != want {
+				t.Errorf("SDKv1CompatibleCleanKey(%q) = %v, want %v", testCase.key, got, want)
+			}
+		})
+	}
+}
+
+func TestAccS3Object_basic(t *testing.T) {
 	ctx := acctest.Context(t)
-	bucketError := regexp.MustCompile(`bucket must not be empty`)
-	keyError := regexp.MustCompile(`key must not be empty`)
+	var obj s3.GetObjectOutput
+	resourceName := "aws_s3_object.object"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckObjectDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				PreConfig:   func() {},
-				Config:      testAccObjectConfig_basic("", "a key"),
-				ExpectError: bucketError,
+				Config: testAccObjectConfig_basic(rName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckObjectExists(ctx, resourceName, &obj),
+					testAccCheckObjectBody(&obj, ""),
+					resource.TestCheckNoResourceAttr(resourceName, "acl"),
+					resource.TestCheckResourceAttr(resourceName, "bucket", rName),
+					resource.TestCheckResourceAttr(resourceName, "bucket_key_enabled", "false"),
+					resource.TestCheckResourceAttr(resourceName, "cache_control", ""),
+					resource.TestCheckNoResourceAttr(resourceName, "checksum_algorithm"),
+					resource.TestCheckResourceAttr(resourceName, "checksum_crc32", ""),
+					resource.TestCheckResourceAttr(resourceName, "checksum_crc32c", ""),
+					resource.TestCheckResourceAttr(resourceName, "checksum_sha1", ""),
+					resource.TestCheckResourceAttr(resourceName, "checksum_sha256", ""),
+					resource.TestCheckNoResourceAttr(resourceName, "content"),
+					resource.TestCheckNoResourceAttr(resourceName, "content_base64"),
+					resource.TestCheckResourceAttr(resourceName, "content_disposition", ""),
+					resource.TestCheckResourceAttr(resourceName, "content_encoding", ""),
+					resource.TestCheckResourceAttr(resourceName, "content_language", ""),
+					resource.TestCheckResourceAttr(resourceName, "content_type", "application/octet-stream"),
+					resource.TestCheckResourceAttrSet(resourceName, "etag"),
+					resource.TestCheckResourceAttr(resourceName, "force_destroy", "false"),
+					resource.TestCheckResourceAttr(resourceName, "key", "test-key"),
+					resource.TestCheckNoResourceAttr(resourceName, "kms_key_id"),
+					resource.TestCheckResourceAttr(resourceName, "metadata.%", "0"),
+					resource.TestCheckResourceAttr(resourceName, "object_lock_legal_hold_status", ""),
+					resource.TestCheckResourceAttr(resourceName, "object_lock_mode", ""),
+					resource.TestCheckResourceAttr(resourceName, "object_lock_retain_until_date", ""),
+					resource.TestCheckResourceAttr(resourceName, "server_side_encryption", "AES256"),
+					resource.TestCheckNoResourceAttr(resourceName, "source"),
+					resource.TestCheckNoResourceAttr(resourceName, "source_hash"),
+					resource.TestCheckResourceAttr(resourceName, "storage_class", "STANDARD"),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
+					resource.TestCheckResourceAttr(resourceName, "version_id", ""),
+					resource.TestCheckResourceAttr(resourceName, "website_redirect", ""),
+				),
 			},
 			{
-				PreConfig:   func() {},
-				Config:      testAccObjectConfig_basic("a name", ""),
-				ExpectError: keyError,
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"force_destroy"},
+				ImportStateId:           fmt.Sprintf("s3://%s/test-key", rName),
 			},
 		},
 	})
 }
 
-func TestAccS3Object_empty(t *testing.T) {
+func TestAccS3Object_upgradeFromV4(t *testing.T) {
 	ctx := acctest.Context(t)
 	var obj s3.GetObjectOutput
 	resourceName := "aws_s3_object.object"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
-		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckObjectDestroy(ctx),
+		PreCheck:     func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:   acctest.ErrorCheck(t, names.S3EndpointID),
+		CheckDestroy: testAccCheckObjectDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				PreConfig: func() {},
-				Config:    testAccObjectConfig_empty(rName),
+				ExternalProviders: map[string]resource.ExternalProvider{
+					"aws": {
+						Source:            "hashicorp/aws",
+						VersionConstraint: "4.67.0",
+					},
+				},
+				Config: testAccObjectConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckObjectExists(ctx, resourceName, &obj),
-					testAccCheckObjectBody(&obj, ""),
 				),
 			},
 			{
-				ResourceName:            resourceName,
-				ImportState:             true,
-				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"acl", "force_destroy"},
-				ImportStateId:           fmt.Sprintf("s3://%s/test-key", rName),
+				ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+				Config:                   testAccObjectConfig_basic(rName),
+				PlanOnly:                 true,
 			},
 		},
 	})
@@ -93,7 +207,7 @@ func TestAccS3Object_source(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckObjectDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -108,7 +222,7 @@ func TestAccS3Object_source(t *testing.T) {
 				ResourceName:            resourceName,
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"acl", "source", "force_destroy"},
+				ImportStateVerifyIgnore: []string{"force_destroy", "source"},
 				ImportStateId:           fmt.Sprintf("s3://%s/test-key", rName),
 			},
 		},
@@ -123,13 +237,12 @@ func TestAccS3Object_content(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckObjectDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				PreConfig: func() {},
-				Config:    testAccObjectConfig_content(rName, "some_bucket_content"),
+				Config: testAccObjectConfig_content(rName, "some_bucket_content"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckObjectExists(ctx, resourceName, &obj),
 					testAccCheckObjectBody(&obj, "some_bucket_content"),
@@ -139,7 +252,7 @@ func TestAccS3Object_content(t *testing.T) {
 				ResourceName:            resourceName,
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"acl", "content", "content_base64", "force_destroy"},
+				ImportStateVerifyIgnore: []string{"content", "content_base64", "force_destroy"},
 				ImportStateId:           fmt.Sprintf("s3://%s/test-key", rName),
 			},
 		},
@@ -156,13 +269,12 @@ func TestAccS3Object_etagEncryption(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckObjectDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				PreConfig: func() {},
-				Config:    testAccObjectConfig_etagEncryption(rName, source),
+				Config: testAccObjectConfig_etagEncryption(rName, source),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckObjectExists(ctx, resourceName, &obj),
 					testAccCheckObjectBody(&obj, "{anything will do }"),
@@ -173,7 +285,7 @@ func TestAccS3Object_etagEncryption(t *testing.T) {
 				ResourceName:            resourceName,
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"acl", "source", "force_destroy"},
+				ImportStateVerifyIgnore: []string{"force_destroy", "source"},
 				ImportStateId:           fmt.Sprintf("s3://%s/test-key", rName),
 			},
 		},
@@ -188,13 +300,12 @@ func TestAccS3Object_contentBase64(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckObjectDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				PreConfig: func() {},
-				Config:    testAccObjectConfig_contentBase64(rName, base64.StdEncoding.EncodeToString([]byte("some_bucket_content"))),
+				Config: testAccObjectConfig_contentBase64(rName, base64.StdEncoding.EncodeToString([]byte("some_bucket_content"))),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckObjectExists(ctx, resourceName, &obj),
 					testAccCheckObjectBody(&obj, "some_bucket_content"),
@@ -226,13 +337,12 @@ func TestAccS3Object_sourceHashTrigger(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckObjectDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				PreConfig: func() {},
-				Config:    testAccObjectConfig_sourceHashTrigger(rName, filename),
+				Config: testAccObjectConfig_sourceHashTrigger(rName, filename),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckObjectExists(ctx, resourceName, &obj),
 					testAccCheckObjectBody(&obj, "Ebben!"),
@@ -242,8 +352,7 @@ func TestAccS3Object_sourceHashTrigger(t *testing.T) {
 				ExpectNonEmptyPlan: true,
 			},
 			{
-				PreConfig: func() {},
-				Config:    testAccObjectConfig_sourceHashTrigger(rName, filename),
+				Config: testAccObjectConfig_sourceHashTrigger(rName, filename),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckObjectExists(ctx, resourceName, &updated_obj),
 					testAccCheckObjectBody(&updated_obj, "Ne andrò lontana"),
@@ -254,7 +363,7 @@ func TestAccS3Object_sourceHashTrigger(t *testing.T) {
 				ResourceName:            resourceName,
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"acl", "content", "content_base64", "force_destroy", "source", "source_hash"},
+				ImportStateVerifyIgnore: []string{"content", "content_base64", "force_destroy", "source", "source_hash"},
 				ImportStateId:           fmt.Sprintf("s3://%s/test-key", rName),
 			},
 		},
@@ -272,7 +381,7 @@ func TestAccS3Object_withContentCharacteristics(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckObjectDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -299,7 +408,7 @@ func TestAccS3Object_nonVersioned(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckAssumeRoleARN(t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckObjectDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -315,7 +424,7 @@ func TestAccS3Object_nonVersioned(t *testing.T) {
 				ResourceName:            resourceName,
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"acl", "source", "force_destroy"},
+				ImportStateVerifyIgnore: []string{"force_destroy", "source"},
 				ImportStateId:           fmt.Sprintf("s3://%s/updateable-key", rName),
 			},
 		},
@@ -335,7 +444,7 @@ func TestAccS3Object_updates(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckObjectDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -365,7 +474,7 @@ func TestAccS3Object_updates(t *testing.T) {
 				ResourceName:            resourceName,
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"acl", "source", "force_destroy"},
+				ImportStateVerifyIgnore: []string{"force_destroy", "source"},
 				ImportStateId:           fmt.Sprintf("s3://%s/updateable-key", rName),
 			},
 		},
@@ -394,7 +503,7 @@ func TestAccS3Object_updateSameFile(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckObjectDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -433,7 +542,7 @@ func TestAccS3Object_updatesWithVersioning(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckObjectDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -451,14 +560,14 @@ func TestAccS3Object_updatesWithVersioning(t *testing.T) {
 					testAccCheckObjectExists(ctx, resourceName, &modifiedObj),
 					testAccCheckObjectBody(&modifiedObj, "modified versioned object"),
 					resource.TestCheckResourceAttr(resourceName, "etag", "00b8c73b1b50e7cc932362c7225b8e29"),
-					testAccCheckObjectVersionIdDiffers(&modifiedObj, &originalObj),
+					testAccCheckObjectVersionIDDiffers(&modifiedObj, &originalObj),
 				),
 			},
 			{
 				ResourceName:            resourceName,
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"acl", "source", "force_destroy"},
+				ImportStateVerifyIgnore: []string{"force_destroy", "source"},
 				ImportStateId:           fmt.Sprintf("s3://%s/updateable-key", rName),
 			},
 		},
@@ -479,7 +588,7 @@ func TestAccS3Object_updatesWithVersioningViaAccessPoint(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckObjectDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -498,7 +607,7 @@ func TestAccS3Object_updatesWithVersioningViaAccessPoint(t *testing.T) {
 					testAccCheckObjectExists(ctx, resourceName, &modifiedObj),
 					testAccCheckObjectBody(&modifiedObj, "modified versioned object"),
 					resource.TestCheckResourceAttr(resourceName, "etag", "00b8c73b1b50e7cc932362c7225b8e29"),
-					testAccCheckObjectVersionIdDiffers(&modifiedObj, &originalObj),
+					testAccCheckObjectVersionIDDiffers(&modifiedObj, &originalObj),
 				),
 			},
 		},
@@ -516,13 +625,12 @@ func TestAccS3Object_kms(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckObjectDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				PreConfig: func() {},
-				Config:    testAccObjectConfig_kmsID(rName, source),
+				Config: testAccObjectConfig_kmsID(rName, source),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckObjectExists(ctx, resourceName, &obj),
 					testAccCheckObjectSSE(ctx, resourceName, "aws:kms"),
@@ -533,7 +641,7 @@ func TestAccS3Object_kms(t *testing.T) {
 				ResourceName:            resourceName,
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"acl", "source", "force_destroy"},
+				ImportStateVerifyIgnore: []string{"force_destroy", "source"},
 				ImportStateId:           fmt.Sprintf("s3://%s/test-key", rName),
 			},
 		},
@@ -551,13 +659,12 @@ func TestAccS3Object_sse(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckObjectDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				PreConfig: func() {},
-				Config:    testAccObjectConfig_sse(rName, source),
+				Config: testAccObjectConfig_sse(rName, source),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckObjectExists(ctx, resourceName, &obj),
 					testAccCheckObjectSSE(ctx, resourceName, "AES256"),
@@ -568,7 +675,7 @@ func TestAccS3Object_sse(t *testing.T) {
 				ResourceName:            resourceName,
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"acl", "source", "force_destroy"},
+				ImportStateVerifyIgnore: []string{"force_destroy", "source"},
 				ImportStateId:           fmt.Sprintf("s3://%s/test-key", rName),
 			},
 		},
@@ -583,36 +690,36 @@ func TestAccS3Object_acl(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckObjectDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccObjectConfig_acl(rName, "some_bucket_content", s3.BucketCannedACLPrivate, true),
+				Config: testAccObjectConfig_acl(rName, "some_bucket_content", string(types.BucketCannedACLPrivate), true),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckObjectExists(ctx, resourceName, &obj1),
 					testAccCheckObjectBody(&obj1, "some_bucket_content"),
-					resource.TestCheckResourceAttr(resourceName, "acl", s3.BucketCannedACLPrivate),
+					resource.TestCheckResourceAttr(resourceName, "acl", string(types.BucketCannedACLPrivate)),
 					testAccCheckObjectACL(ctx, resourceName, []string{"FULL_CONTROL"}),
 				),
 			},
 			{
-				Config: testAccObjectConfig_acl(rName, "some_bucket_content", s3.BucketCannedACLPublicRead, false),
+				Config: testAccObjectConfig_acl(rName, "some_bucket_content", string(types.BucketCannedACLPublicRead), false),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckObjectExists(ctx, resourceName, &obj2),
-					testAccCheckObjectVersionIdEquals(&obj2, &obj1),
+					testAccCheckObjectVersionIDEquals(&obj2, &obj1),
 					testAccCheckObjectBody(&obj2, "some_bucket_content"),
-					resource.TestCheckResourceAttr(resourceName, "acl", s3.BucketCannedACLPublicRead),
+					resource.TestCheckResourceAttr(resourceName, "acl", string(types.BucketCannedACLPublicRead)),
 					testAccCheckObjectACL(ctx, resourceName, []string{"FULL_CONTROL", "READ"}),
 				),
 			},
 			{
-				Config: testAccObjectConfig_acl(rName, "changed_some_bucket_content", s3.BucketCannedACLPrivate, true),
+				Config: testAccObjectConfig_acl(rName, "changed_some_bucket_content", string(types.BucketCannedACLPrivate), true),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckObjectExists(ctx, resourceName, &obj3),
-					testAccCheckObjectVersionIdDiffers(&obj3, &obj2),
+					testAccCheckObjectVersionIDDiffers(&obj3, &obj2),
 					testAccCheckObjectBody(&obj3, "changed_some_bucket_content"),
-					resource.TestCheckResourceAttr(resourceName, "acl", s3.BucketCannedACLPrivate),
+					resource.TestCheckResourceAttr(resourceName, "acl", string(types.BucketCannedACLPrivate)),
 					testAccCheckObjectACL(ctx, resourceName, []string{"FULL_CONTROL"}),
 				),
 			},
@@ -635,7 +742,7 @@ func TestAccS3Object_metadata(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckObjectDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -658,7 +765,7 @@ func TestAccS3Object_metadata(t *testing.T) {
 				),
 			},
 			{
-				Config: testAccObjectConfig_empty(rName),
+				Config: testAccObjectConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckObjectExists(ctx, resourceName, &obj),
 					resource.TestCheckResourceAttr(resourceName, "metadata.%", "0"),
@@ -668,7 +775,7 @@ func TestAccS3Object_metadata(t *testing.T) {
 				ResourceName:            resourceName,
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"acl", "force_destroy"},
+				ImportStateVerifyIgnore: []string{"force_destroy"},
 				ImportStateId:           fmt.Sprintf("s3://%s/test-key", rName),
 			},
 		},
@@ -683,13 +790,12 @@ func TestAccS3Object_storageClass(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckObjectDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				PreConfig: func() {},
-				Config:    testAccObjectConfig_content(rName, "some_bucket_content"),
+				Config: testAccObjectConfig_content(rName, "some_bucket_content"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckObjectExists(ctx, resourceName, &obj),
 					resource.TestCheckResourceAttr(resourceName, "storage_class", "STANDARD"),
@@ -732,7 +838,7 @@ func TestAccS3Object_storageClass(t *testing.T) {
 				ResourceName:            resourceName,
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"content", "acl", "force_destroy"},
+				ImportStateVerifyIgnore: []string{"content", "force_destroy"},
 				ImportStateId:           fmt.Sprintf("s3://%s/test-key", rName),
 			},
 		},
@@ -748,13 +854,12 @@ func TestAccS3Object_tags(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckObjectDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				PreConfig: func() {},
-				Config:    testAccObjectConfig_tags(rName, key, "stuff"),
+				Config: testAccObjectConfig_tags(rName, key, "stuff"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckObjectExists(ctx, resourceName, &obj1),
 					testAccCheckObjectBody(&obj1, "stuff"),
@@ -765,11 +870,10 @@ func TestAccS3Object_tags(t *testing.T) {
 				),
 			},
 			{
-				PreConfig: func() {},
-				Config:    testAccObjectConfig_updatedTags(rName, key, "stuff"),
+				Config: testAccObjectConfig_updatedTags(rName, key, "stuff"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckObjectExists(ctx, resourceName, &obj2),
-					testAccCheckObjectVersionIdEquals(&obj2, &obj1),
+					testAccCheckObjectVersionIDEquals(&obj2, &obj1),
 					testAccCheckObjectBody(&obj2, "stuff"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "4"),
 					resource.TestCheckResourceAttr(resourceName, "tags.Key2", "B@BB"),
@@ -779,21 +883,19 @@ func TestAccS3Object_tags(t *testing.T) {
 				),
 			},
 			{
-				PreConfig: func() {},
-				Config:    testAccObjectConfig_noTags(rName, key, "stuff"),
+				Config: testAccObjectConfig_noTags(rName, key, "stuff"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckObjectExists(ctx, resourceName, &obj3),
-					testAccCheckObjectVersionIdEquals(&obj3, &obj2),
+					testAccCheckObjectVersionIDEquals(&obj3, &obj2),
 					testAccCheckObjectBody(&obj3, "stuff"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 				),
 			},
 			{
-				PreConfig: func() {},
-				Config:    testAccObjectConfig_tags(rName, key, "changed stuff"),
+				Config: testAccObjectConfig_tags(rName, key, "changed stuff"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckObjectExists(ctx, resourceName, &obj4),
-					testAccCheckObjectVersionIdDiffers(&obj4, &obj3),
+					testAccCheckObjectVersionIDDiffers(&obj4, &obj3),
 					testAccCheckObjectBody(&obj4, "changed stuff"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "3"),
 					resource.TestCheckResourceAttr(resourceName, "tags.Key1", "A@AA"),
@@ -805,7 +907,7 @@ func TestAccS3Object_tags(t *testing.T) {
 				ResourceName:            resourceName,
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"content", "acl", "force_destroy"},
+				ImportStateVerifyIgnore: []string{"content", "force_destroy"},
 				ImportStateId:           fmt.Sprintf("s3://%s/%s", rName, key),
 			},
 		},
@@ -821,13 +923,12 @@ func TestAccS3Object_tagsLeadingSingleSlash(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckObjectDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				PreConfig: func() {},
-				Config:    testAccObjectConfig_tags(rName, key, "stuff"),
+				Config: testAccObjectConfig_tags(rName, key, "stuff"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckObjectExists(ctx, resourceName, &obj1),
 					testAccCheckObjectBody(&obj1, "stuff"),
@@ -838,11 +939,10 @@ func TestAccS3Object_tagsLeadingSingleSlash(t *testing.T) {
 				),
 			},
 			{
-				PreConfig: func() {},
-				Config:    testAccObjectConfig_updatedTags(rName, key, "stuff"),
+				Config: testAccObjectConfig_updatedTags(rName, key, "stuff"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckObjectExists(ctx, resourceName, &obj2),
-					testAccCheckObjectVersionIdEquals(&obj2, &obj1),
+					testAccCheckObjectVersionIDEquals(&obj2, &obj1),
 					testAccCheckObjectBody(&obj2, "stuff"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "4"),
 					resource.TestCheckResourceAttr(resourceName, "tags.Key2", "B@BB"),
@@ -852,21 +952,19 @@ func TestAccS3Object_tagsLeadingSingleSlash(t *testing.T) {
 				),
 			},
 			{
-				PreConfig: func() {},
-				Config:    testAccObjectConfig_noTags(rName, key, "stuff"),
+				Config: testAccObjectConfig_noTags(rName, key, "stuff"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckObjectExists(ctx, resourceName, &obj3),
-					testAccCheckObjectVersionIdEquals(&obj3, &obj2),
+					testAccCheckObjectVersionIDEquals(&obj3, &obj2),
 					testAccCheckObjectBody(&obj3, "stuff"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 				),
 			},
 			{
-				PreConfig: func() {},
-				Config:    testAccObjectConfig_tags(rName, key, "changed stuff"),
+				Config: testAccObjectConfig_tags(rName, key, "changed stuff"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckObjectExists(ctx, resourceName, &obj4),
-					testAccCheckObjectVersionIdDiffers(&obj4, &obj3),
+					testAccCheckObjectVersionIDDiffers(&obj4, &obj3),
 					testAccCheckObjectBody(&obj4, "changed stuff"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "3"),
 					resource.TestCheckResourceAttr(resourceName, "tags.Key1", "A@AA"),
@@ -878,7 +976,7 @@ func TestAccS3Object_tagsLeadingSingleSlash(t *testing.T) {
 				ResourceName:            resourceName,
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"content", "acl", "force_destroy"},
+				ImportStateVerifyIgnore: []string{"content", "force_destroy"},
 				ImportStateId:           fmt.Sprintf("s3://%s/%s", rName, key),
 			},
 		},
@@ -894,13 +992,12 @@ func TestAccS3Object_tagsLeadingMultipleSlashes(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckObjectDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				PreConfig: func() {},
-				Config:    testAccObjectConfig_tags(rName, key, "stuff"),
+				Config: testAccObjectConfig_tags(rName, key, "stuff"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckObjectExists(ctx, resourceName, &obj1),
 					testAccCheckObjectBody(&obj1, "stuff"),
@@ -911,11 +1008,10 @@ func TestAccS3Object_tagsLeadingMultipleSlashes(t *testing.T) {
 				),
 			},
 			{
-				PreConfig: func() {},
-				Config:    testAccObjectConfig_updatedTags(rName, key, "stuff"),
+				Config: testAccObjectConfig_updatedTags(rName, key, "stuff"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckObjectExists(ctx, resourceName, &obj2),
-					testAccCheckObjectVersionIdEquals(&obj2, &obj1),
+					testAccCheckObjectVersionIDEquals(&obj2, &obj1),
 					testAccCheckObjectBody(&obj2, "stuff"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "4"),
 					resource.TestCheckResourceAttr(resourceName, "tags.Key2", "B@BB"),
@@ -925,21 +1021,19 @@ func TestAccS3Object_tagsLeadingMultipleSlashes(t *testing.T) {
 				),
 			},
 			{
-				PreConfig: func() {},
-				Config:    testAccObjectConfig_noTags(rName, key, "stuff"),
+				Config: testAccObjectConfig_noTags(rName, key, "stuff"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckObjectExists(ctx, resourceName, &obj3),
-					testAccCheckObjectVersionIdEquals(&obj3, &obj2),
+					testAccCheckObjectVersionIDEquals(&obj3, &obj2),
 					testAccCheckObjectBody(&obj3, "stuff"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 				),
 			},
 			{
-				PreConfig: func() {},
-				Config:    testAccObjectConfig_tags(rName, key, "changed stuff"),
+				Config: testAccObjectConfig_tags(rName, key, "changed stuff"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckObjectExists(ctx, resourceName, &obj4),
-					testAccCheckObjectVersionIdDiffers(&obj4, &obj3),
+					testAccCheckObjectVersionIDDiffers(&obj4, &obj3),
 					testAccCheckObjectBody(&obj4, "changed stuff"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "3"),
 					resource.TestCheckResourceAttr(resourceName, "tags.Key1", "A@AA"),
@@ -960,13 +1054,12 @@ func TestAccS3Object_tagsMultipleSlashes(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckObjectDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				PreConfig: func() {},
-				Config:    testAccObjectConfig_tags(rName, key, "stuff"),
+				Config: testAccObjectConfig_tags(rName, key, "stuff"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckObjectExists(ctx, resourceName, &obj1),
 					testAccCheckObjectBody(&obj1, "stuff"),
@@ -977,11 +1070,10 @@ func TestAccS3Object_tagsMultipleSlashes(t *testing.T) {
 				),
 			},
 			{
-				PreConfig: func() {},
-				Config:    testAccObjectConfig_updatedTags(rName, key, "stuff"),
+				Config: testAccObjectConfig_updatedTags(rName, key, "stuff"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckObjectExists(ctx, resourceName, &obj2),
-					testAccCheckObjectVersionIdEquals(&obj2, &obj1),
+					testAccCheckObjectVersionIDEquals(&obj2, &obj1),
 					testAccCheckObjectBody(&obj2, "stuff"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "4"),
 					resource.TestCheckResourceAttr(resourceName, "tags.Key2", "B@BB"),
@@ -991,21 +1083,19 @@ func TestAccS3Object_tagsMultipleSlashes(t *testing.T) {
 				),
 			},
 			{
-				PreConfig: func() {},
-				Config:    testAccObjectConfig_noTags(rName, key, "stuff"),
+				Config: testAccObjectConfig_noTags(rName, key, "stuff"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckObjectExists(ctx, resourceName, &obj3),
-					testAccCheckObjectVersionIdEquals(&obj3, &obj2),
+					testAccCheckObjectVersionIDEquals(&obj3, &obj2),
 					testAccCheckObjectBody(&obj3, "stuff"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 				),
 			},
 			{
-				PreConfig: func() {},
-				Config:    testAccObjectConfig_tags(rName, key, "changed stuff"),
+				Config: testAccObjectConfig_tags(rName, key, "changed stuff"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckObjectExists(ctx, resourceName, &obj4),
-					testAccCheckObjectVersionIdDiffers(&obj4, &obj3),
+					testAccCheckObjectVersionIDDiffers(&obj4, &obj3),
 					testAccCheckObjectBody(&obj4, "changed stuff"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "3"),
 					resource.TestCheckResourceAttr(resourceName, "tags.Key1", "A@AA"),
@@ -1025,7 +1115,7 @@ func TestAccS3Object_objectLockLegalHoldStartWithNone(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckObjectDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -1043,7 +1133,7 @@ func TestAccS3Object_objectLockLegalHoldStartWithNone(t *testing.T) {
 				Config: testAccObjectConfig_lockLegalHold(rName, "stuff", "ON"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckObjectExists(ctx, resourceName, &obj2),
-					testAccCheckObjectVersionIdEquals(&obj2, &obj1),
+					testAccCheckObjectVersionIDEquals(&obj2, &obj1),
 					testAccCheckObjectBody(&obj2, "stuff"),
 					resource.TestCheckResourceAttr(resourceName, "object_lock_legal_hold_status", "ON"),
 					resource.TestCheckResourceAttr(resourceName, "object_lock_mode", ""),
@@ -1055,7 +1145,7 @@ func TestAccS3Object_objectLockLegalHoldStartWithNone(t *testing.T) {
 				Config: testAccObjectConfig_lockLegalHold(rName, "changed stuff", "OFF"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckObjectExists(ctx, resourceName, &obj3),
-					testAccCheckObjectVersionIdDiffers(&obj3, &obj2),
+					testAccCheckObjectVersionIDDiffers(&obj3, &obj2),
 					testAccCheckObjectBody(&obj3, "changed stuff"),
 					resource.TestCheckResourceAttr(resourceName, "object_lock_legal_hold_status", "OFF"),
 					resource.TestCheckResourceAttr(resourceName, "object_lock_mode", ""),
@@ -1074,7 +1164,7 @@ func TestAccS3Object_objectLockLegalHoldStartWithOn(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckObjectDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -1092,7 +1182,7 @@ func TestAccS3Object_objectLockLegalHoldStartWithOn(t *testing.T) {
 				Config: testAccObjectConfig_lockLegalHold(rName, "stuff", "OFF"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckObjectExists(ctx, resourceName, &obj2),
-					testAccCheckObjectVersionIdEquals(&obj2, &obj1),
+					testAccCheckObjectVersionIDEquals(&obj2, &obj1),
 					testAccCheckObjectBody(&obj2, "stuff"),
 					resource.TestCheckResourceAttr(resourceName, "object_lock_legal_hold_status", "OFF"),
 					resource.TestCheckResourceAttr(resourceName, "object_lock_mode", ""),
@@ -1112,7 +1202,7 @@ func TestAccS3Object_objectLockRetentionStartWithNone(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckObjectDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -1130,7 +1220,7 @@ func TestAccS3Object_objectLockRetentionStartWithNone(t *testing.T) {
 				Config: testAccObjectConfig_lockRetention(rName, "stuff", retainUntilDate),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckObjectExists(ctx, resourceName, &obj2),
-					testAccCheckObjectVersionIdEquals(&obj2, &obj1),
+					testAccCheckObjectVersionIDEquals(&obj2, &obj1),
 					testAccCheckObjectBody(&obj2, "stuff"),
 					resource.TestCheckResourceAttr(resourceName, "object_lock_legal_hold_status", ""),
 					resource.TestCheckResourceAttr(resourceName, "object_lock_mode", "GOVERNANCE"),
@@ -1142,7 +1232,7 @@ func TestAccS3Object_objectLockRetentionStartWithNone(t *testing.T) {
 				Config: testAccObjectConfig_noLockRetention(rName, "changed stuff"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckObjectExists(ctx, resourceName, &obj3),
-					testAccCheckObjectVersionIdDiffers(&obj3, &obj2),
+					testAccCheckObjectVersionIDDiffers(&obj3, &obj2),
 					testAccCheckObjectBody(&obj3, "changed stuff"),
 					resource.TestCheckResourceAttr(resourceName, "object_lock_legal_hold_status", ""),
 					resource.TestCheckResourceAttr(resourceName, "object_lock_mode", ""),
@@ -1164,7 +1254,7 @@ func TestAccS3Object_objectLockRetentionStartWithSet(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckObjectDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -1182,7 +1272,7 @@ func TestAccS3Object_objectLockRetentionStartWithSet(t *testing.T) {
 				Config: testAccObjectConfig_lockRetention(rName, "stuff", retainUntilDate2),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckObjectExists(ctx, resourceName, &obj2),
-					testAccCheckObjectVersionIdEquals(&obj2, &obj1),
+					testAccCheckObjectVersionIDEquals(&obj2, &obj1),
 					testAccCheckObjectBody(&obj2, "stuff"),
 					resource.TestCheckResourceAttr(resourceName, "object_lock_legal_hold_status", ""),
 					resource.TestCheckResourceAttr(resourceName, "object_lock_mode", "GOVERNANCE"),
@@ -1193,7 +1283,7 @@ func TestAccS3Object_objectLockRetentionStartWithSet(t *testing.T) {
 				Config: testAccObjectConfig_lockRetention(rName, "stuff", retainUntilDate3),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckObjectExists(ctx, resourceName, &obj3),
-					testAccCheckObjectVersionIdEquals(&obj3, &obj2),
+					testAccCheckObjectVersionIDEquals(&obj3, &obj2),
 					testAccCheckObjectBody(&obj3, "stuff"),
 					resource.TestCheckResourceAttr(resourceName, "object_lock_legal_hold_status", ""),
 					resource.TestCheckResourceAttr(resourceName, "object_lock_mode", "GOVERNANCE"),
@@ -1204,7 +1294,7 @@ func TestAccS3Object_objectLockRetentionStartWithSet(t *testing.T) {
 				Config: testAccObjectConfig_noLockRetention(rName, "stuff"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckObjectExists(ctx, resourceName, &obj4),
-					testAccCheckObjectVersionIdEquals(&obj4, &obj3),
+					testAccCheckObjectVersionIDEquals(&obj4, &obj3),
 					testAccCheckObjectBody(&obj4, "stuff"),
 					resource.TestCheckResourceAttr(resourceName, "object_lock_legal_hold_status", ""),
 					resource.TestCheckResourceAttr(resourceName, "object_lock_mode", ""),
@@ -1223,7 +1313,7 @@ func TestAccS3Object_objectBucketKeyEnabled(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckObjectDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -1247,7 +1337,7 @@ func TestAccS3Object_bucketBucketKeyEnabled(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckObjectDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -1271,7 +1361,7 @@ func TestAccS3Object_defaultBucketSSE(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckObjectDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -1295,12 +1385,11 @@ func TestAccS3Object_ignoreTags(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckObjectDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				PreConfig: func() {},
 				Config: acctest.ConfigCompose(
 					acctest.ConfigIgnoreTagsKeyPrefixes1("ignorekey"),
 					testAccObjectConfig_noTags(rName, key, "stuff")),
@@ -1315,7 +1404,6 @@ func TestAccS3Object_ignoreTags(t *testing.T) {
 				),
 			},
 			{
-				PreConfig: func() {},
 				Config: acctest.ConfigCompose(
 					acctest.ConfigIgnoreTagsKeyPrefixes1("ignorekey"),
 					testAccObjectConfig_tags(rName, key, "stuff")),
@@ -1338,34 +1426,102 @@ func TestAccS3Object_ignoreTags(t *testing.T) {
 	})
 }
 
-func testAccCheckObjectVersionIdDiffers(first, second *s3.GetObjectOutput) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		if first.VersionId == nil {
-			return fmt.Errorf("Expected first object to have VersionId: %s", first)
-		}
-		if second.VersionId == nil {
-			return fmt.Errorf("Expected second object to have VersionId: %s", second)
-		}
+func TestAccS3Object_checksumAlgorithm(t *testing.T) {
+	ctx := acctest.Context(t)
+	var obj s3.GetObjectOutput
+	resourceName := "aws_s3_object.object"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
-		if *first.VersionId == *second.VersionId {
-			return fmt.Errorf("Expected Version IDs to differ, but they are equal (%s)", *first.VersionId)
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3EndpointID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckObjectDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccObjectConfig_checksumAlgorithm(rName, "CRC32"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckObjectExists(ctx, resourceName, &obj),
+					testAccCheckObjectBody(&obj, "ABCDEFGHIJKLMNOPQRSTUVWXYZ"),
+					resource.TestCheckResourceAttr(resourceName, "checksum_algorithm", "CRC32"),
+					resource.TestCheckResourceAttr(resourceName, "checksum_crc32", "q/d4Ig=="),
+					resource.TestCheckResourceAttr(resourceName, "checksum_crc32c", ""),
+					resource.TestCheckResourceAttr(resourceName, "checksum_sha1", ""),
+					resource.TestCheckResourceAttr(resourceName, "checksum_sha256", ""),
+				),
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"checksum_algorithm", "checksum_crc32", "content", "force_destroy"},
+				ImportStateId:           fmt.Sprintf("s3://%s/test-key", rName),
+			},
+			{
+				Config: testAccObjectConfig_checksumAlgorithm(rName, "SHA256"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckObjectExists(ctx, resourceName, &obj),
+					testAccCheckObjectBody(&obj, "ABCDEFGHIJKLMNOPQRSTUVWXYZ"),
+					resource.TestCheckResourceAttr(resourceName, "checksum_algorithm", "SHA256"),
+					resource.TestCheckResourceAttr(resourceName, "checksum_crc32", ""),
+					resource.TestCheckResourceAttr(resourceName, "checksum_crc32c", ""),
+					resource.TestCheckResourceAttr(resourceName, "checksum_sha1", ""),
+					resource.TestCheckResourceAttr(resourceName, "checksum_sha256", "1uxomN6H3axuWzYRcIp6ocLSmCkzScwabCmaHbcUnTg="),
+				),
+			},
+		},
+	})
+}
+
+func TestAccS3Object_keyWithSlashesMigrated(t *testing.T) {
+	ctx := acctest.Context(t)
+	var obj s3.GetObjectOutput
+	resourceName := "aws_s3_object.object"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:     func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:   acctest.ErrorCheck(t, names.S3EndpointID),
+		CheckDestroy: testAccCheckObjectDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				ExternalProviders: map[string]resource.ExternalProvider{
+					// Final version for aws_s3_object using AWS SDK for Go v1.
+					"aws": {
+						Source:            "hashicorp/aws",
+						VersionConstraint: "5.16.0",
+					},
+				},
+				Config: testAccObjectConfig_keyWithSlashes(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckObjectExists(ctx, resourceName, &obj),
+					resource.TestCheckResourceAttr(resourceName, "bucket", rName),
+					resource.TestCheckResourceAttr(resourceName, "key", "/a/b//c///d/////e/"),
+				),
+			},
+			{
+				ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+				Config:                   testAccObjectConfig_keyWithSlashes(rName),
+				PlanOnly:                 true,
+			},
+		},
+	})
+}
+
+func testAccCheckObjectVersionIDDiffers(first, second *s3.GetObjectOutput) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		if aws.ToString(first.VersionId) == aws.ToString(second.VersionId) {
+			return errors.New("S3 Object version IDs are equal")
 		}
 
 		return nil
 	}
 }
 
-func testAccCheckObjectVersionIdEquals(first, second *s3.GetObjectOutput) resource.TestCheckFunc {
+func testAccCheckObjectVersionIDEquals(first, second *s3.GetObjectOutput) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		if first.VersionId == nil {
-			return fmt.Errorf("Expected first object to have VersionId: %s", first)
-		}
-		if second.VersionId == nil {
-			return fmt.Errorf("Expected second object to have VersionId: %s", second)
-		}
-
-		if *first.VersionId != *second.VersionId {
-			return fmt.Errorf("Expected Version IDs to be equal, but they differ (%s, %s)", *first.VersionId, *second.VersionId)
+		if aws.ToString(first.VersionId) != aws.ToString(second.VersionId) {
+			return errors.New("S3 Object version IDs differ")
 		}
 
 		return nil
@@ -1374,14 +1530,14 @@ func testAccCheckObjectVersionIdEquals(first, second *s3.GetObjectOutput) resour
 
 func testAccCheckObjectDestroy(ctx context.Context) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Conn(ctx)
+		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Client(ctx)
 
 		for _, rs := range s.RootModule().Resources {
 			if rs.Type != "aws_s3_object" {
 				continue
 			}
 
-			_, err := tfs3.FindObjectByThreePartKey(ctx, conn, rs.Primary.Attributes["bucket"], rs.Primary.Attributes["key"], rs.Primary.Attributes["etag"])
+			_, err := tfs3.FindObjectByBucketAndKey(ctx, conn, rs.Primary.Attributes["bucket"], tfs3.SDKv1CompatibleCleanKey(rs.Primary.Attributes["key"]), rs.Primary.Attributes["etag"], rs.Primary.Attributes["checksum_algorithm"])
 
 			if tfresource.NotFound(err) {
 				continue
@@ -1398,52 +1554,28 @@ func testAccCheckObjectDestroy(ctx context.Context) resource.TestCheckFunc {
 	}
 }
 
-func testAccCheckObjectExists(ctx context.Context, n string, obj *s3.GetObjectOutput) resource.TestCheckFunc {
+func testAccCheckObjectExists(ctx context.Context, n string, v *s3.GetObjectOutput) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		rs, ok := s.RootModule().Resources[n]
 		if !ok {
 			return fmt.Errorf("Not Found: %s", n)
 		}
 
-		if rs.Primary.ID == "" {
-			return fmt.Errorf("No S3 Object ID is set")
-		}
-
-		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Conn(ctx)
+		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Client(ctx)
 
 		input := &s3.GetObjectInput{
 			Bucket:  aws.String(rs.Primary.Attributes["bucket"]),
-			Key:     aws.String(rs.Primary.Attributes["key"]),
+			Key:     aws.String(tfs3.SDKv1CompatibleCleanKey(rs.Primary.Attributes["key"])),
 			IfMatch: aws.String(rs.Primary.Attributes["etag"]),
 		}
 
-		var out *s3.GetObjectOutput
-
-		err := retry.RetryContext(ctx, 2*time.Minute, func() *retry.RetryError {
-			var err error
-			out, err = conn.GetObjectWithContext(ctx, input)
-
-			if tfawserr.ErrCodeEquals(err, s3.ErrCodeNoSuchKey) {
-				return retry.RetryableError(
-					fmt.Errorf("getting object %s, retrying: %w", rs.Primary.Attributes["bucket"], err),
-				)
-			}
-
-			if err != nil {
-				return retry.NonRetryableError(err)
-			}
-
-			return nil
-		})
-		if tfresource.TimedOut(err) {
-			out, err = conn.GetObjectWithContext(ctx, input)
-		}
+		output, err := conn.GetObject(ctx, input)
 
 		if err != nil {
-			return fmt.Errorf("S3 Object error: %s", err)
+			return err
 		}
 
-		*obj = *out
+		*v = *output
 
 		return nil
 	}
@@ -1453,52 +1585,52 @@ func testAccCheckObjectBody(obj *s3.GetObjectOutput, want string) resource.TestC
 	return func(s *terraform.State) error {
 		body, err := io.ReadAll(obj.Body)
 		if err != nil {
-			return fmt.Errorf("failed to read body: %s", err)
+			return err
 		}
 		obj.Body.Close()
 
 		if got := string(body); got != want {
-			return fmt.Errorf("wrong result body %q; want %q", got, want)
+			return fmt.Errorf("S3 Object body = %v, want %v", got, want)
 		}
 
 		return nil
 	}
 }
 
-func testAccCheckObjectACL(ctx context.Context, n string, expectedPerms []string) resource.TestCheckFunc {
+func testAccCheckObjectACL(ctx context.Context, n string, want []string) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		rs := s.RootModule().Resources[n]
-		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Conn(ctx)
+		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Client(ctx)
 
-		out, err := conn.GetObjectAclWithContext(ctx, &s3.GetObjectAclInput{
+		output, err := conn.GetObjectAcl(ctx, &s3.GetObjectAclInput{
 			Bucket: aws.String(rs.Primary.Attributes["bucket"]),
-			Key:    aws.String(rs.Primary.Attributes["key"]),
+			Key:    aws.String(tfs3.SDKv1CompatibleCleanKey(rs.Primary.Attributes["key"])),
 		})
 
 		if err != nil {
-			return fmt.Errorf("GetObjectAcl error: %v", err)
+			return err
 		}
 
-		var perms []string
-		for _, v := range out.Grants {
-			perms = append(perms, *v.Permission)
+		var got []string
+		for _, v := range output.Grants {
+			got = append(got, string(v.Permission))
 		}
-		sort.Strings(perms)
+		sort.Strings(got)
 
-		if !reflect.DeepEqual(perms, expectedPerms) {
-			return fmt.Errorf("Expected ACL permissions to be %v, got %v", expectedPerms, perms)
+		if diff := cmp.Diff(got, want); diff != "" {
+			return fmt.Errorf("unexpected S3 Object ACL diff (+wanted, -got): %s", diff)
 		}
 
 		return nil
 	}
 }
 
-func testAccCheckObjectStorageClass(ctx context.Context, n, expectedClass string) resource.TestCheckFunc {
+func testAccCheckObjectStorageClass(ctx context.Context, n, want string) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		rs := s.RootModule().Resources[n]
-		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Conn(ctx)
+		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Client(ctx)
 
-		out, err := tfs3.FindObjectByThreePartKey(ctx, conn, rs.Primary.Attributes["bucket"], rs.Primary.Attributes["key"], "")
+		output, err := tfs3.FindObjectByBucketAndKey(ctx, conn, rs.Primary.Attributes["bucket"], tfs3.SDKv1CompatibleCleanKey(rs.Primary.Attributes["key"]), "", "")
 
 		if err != nil {
 			return err
@@ -1506,39 +1638,32 @@ func testAccCheckObjectStorageClass(ctx context.Context, n, expectedClass string
 
 		// The "STANDARD" (which is also the default) storage
 		// class when set would not be included in the results.
-		storageClass := s3.StorageClassStandard
-		if out.StorageClass != nil {
-			storageClass = *out.StorageClass
+		storageClass := types.StorageClassStandard
+		if output.StorageClass != "" {
+			storageClass = output.StorageClass
 		}
 
-		if storageClass != expectedClass {
-			return fmt.Errorf("Expected Storage Class to be %v, got %v",
-				expectedClass, storageClass)
+		if got := string(storageClass); got != want {
+			return fmt.Errorf("S3 Object storage class = %v, want %v", got, want)
 		}
 
 		return nil
 	}
 }
 
-func testAccCheckObjectSSE(ctx context.Context, n, expectedSSE string) resource.TestCheckFunc {
+func testAccCheckObjectSSE(ctx context.Context, n, want string) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		rs := s.RootModule().Resources[n]
-		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Conn(ctx)
+		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Client(ctx)
 
-		out, err := tfs3.FindObjectByThreePartKey(ctx, conn, rs.Primary.Attributes["bucket"], rs.Primary.Attributes["key"], "")
+		output, err := tfs3.FindObjectByBucketAndKey(ctx, conn, rs.Primary.Attributes["bucket"], tfs3.SDKv1CompatibleCleanKey(rs.Primary.Attributes["key"]), "", "")
 
 		if err != nil {
 			return err
 		}
 
-		if out.ServerSideEncryption == nil {
-			return fmt.Errorf("Expected a non %v Server Side Encryption.", out.ServerSideEncryption)
-		}
-
-		sse := *out.ServerSideEncryption
-		if sse != expectedSSE {
-			return fmt.Errorf("Expected Server Side Encryption %v, got %v.",
-				expectedSSE, sse)
+		if got := string(output.ServerSideEncryption); got != want {
+			return fmt.Errorf("S3 Object server-side encryption = %v, want %v", got, want)
 		}
 
 		return nil
@@ -1564,41 +1689,32 @@ func testAccObjectCreateTempFile(t *testing.T, data string) string {
 func testAccCheckObjectUpdateTags(ctx context.Context, n string, oldTags, newTags map[string]string) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		rs := s.RootModule().Resources[n]
-		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Conn(ctx)
+		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Client(ctx)
 
-		return tfs3.ObjectUpdateTags(ctx, conn, rs.Primary.Attributes["bucket"], rs.Primary.Attributes["key"], oldTags, newTags)
+		return tfs3.ObjectUpdateTags(ctx, conn, rs.Primary.Attributes["bucket"], tfs3.SDKv1CompatibleCleanKey(rs.Primary.Attributes["key"]), oldTags, newTags)
 	}
 }
 
 func testAccCheckObjectCheckTags(ctx context.Context, n string, expectedTags map[string]string) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		rs := s.RootModule().Resources[n]
-		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Conn(ctx)
+		conn := acctest.Provider.Meta().(*conns.AWSClient).S3Client(ctx)
 
-		got, err := tfs3.ObjectListTags(ctx, conn, rs.Primary.Attributes["bucket"], rs.Primary.Attributes["key"])
+		got, err := tfs3.ObjectListTags(ctx, conn, rs.Primary.Attributes["bucket"], tfs3.SDKv1CompatibleCleanKey(rs.Primary.Attributes["key"]))
 		if err != nil {
 			return err
 		}
 
 		want := tftags.New(ctx, expectedTags)
-		if !reflect.DeepEqual(want, got) {
-			return fmt.Errorf("Incorrect tags, want: %v got: %v", want, got)
+		if diff := cmp.Diff(got, want); diff != "" {
+			return fmt.Errorf("unexpected S3 Object tags diff (+wanted, -got): %s", diff)
 		}
 
 		return nil
 	}
 }
 
-func testAccObjectConfig_basic(bucket, key string) string {
-	return fmt.Sprintf(`
-resource "aws_s3_object" "object" {
-  bucket = %[1]q
-  key    = %[2]q
-}
-`, bucket, key)
-}
-
-func testAccObjectConfig_empty(rName string) string {
+func testAccObjectConfig_basic(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_s3_bucket" "test" {
   bucket = %[1]q
@@ -1847,8 +1963,7 @@ resource "aws_s3_object" "object" {
 func testAccObjectConfig_tags(rName, key, content string) string {
 	return fmt.Sprintf(`
 resource "aws_s3_bucket" "test" {
-  bucket        = %[1]q
-  force_destroy = true
+  bucket = %[1]q
 }
 
 resource "aws_s3_bucket_versioning" "test" {
@@ -1876,8 +1991,7 @@ resource "aws_s3_object" "object" {
 func testAccObjectConfig_updatedTags(rName, key, content string) string {
 	return fmt.Sprintf(`
 resource "aws_s3_bucket" "test" {
-  bucket        = %[1]q
-  force_destroy = true
+  bucket = %[1]q
 }
 
 resource "aws_s3_bucket_versioning" "test" {
@@ -1906,8 +2020,7 @@ resource "aws_s3_object" "object" {
 func testAccObjectConfig_noTags(rName, key, content string) string {
 	return fmt.Sprintf(`
 resource "aws_s3_bucket" "test" {
-  bucket        = %[1]q
-  force_destroy = true
+  bucket = %[1]q
 }
 
 resource "aws_s3_bucket_versioning" "test" {
@@ -2170,3 +2283,32 @@ resource "aws_s3_object" "object" {
 }
 `, rName, content)
 }
+
+func testAccObjectConfig_checksumAlgorithm(rName, checksumAlgorithm string) string {
+	return fmt.Sprintf(`
+resource "aws_s3_bucket" "test" {
+  bucket = %[1]q
+}
+
+resource "aws_s3_object" "object" {
+  bucket  = aws_s3_bucket.test.bucket
+  key     = "test-key"
+  content = "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
+
+  checksum_algorithm = %[2]q
+}
+`, rName, checksumAlgorithm)
+}
+
+func testAccObjectConfig_keyWithSlashes(rName string) string {
+	return fmt.Sprintf(`
+resource "aws_s3_bucket" "test" {
+  bucket = %[1]q
+}
+
+resource "aws_s3_object" "object" {
+  bucket = aws_s3_bucket.test.bucket
+  key    = "/a/b//c///d/////e/"
+}
+`, rName)
+}
diff --git a/internal/service/s3/objects_data_source.go b/internal/service/s3/objects_data_source.go
index 975f6fc8d53..192b4ea63b2 100644
--- a/internal/service/s3/objects_data_source.go
+++ b/internal/service/s3/objects_data_source.go
@@ -1,13 +1,18 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3
 
 import (
 	"context"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/s3"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/s3"
+	"github.com/aws/aws-sdk-go-v2/service/s3/types"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/enum"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
 )
 
@@ -23,26 +28,19 @@ func DataSourceObjects() *schema.Resource {
 				Type:     schema.TypeString,
 				Required: true,
 			},
-			"prefix": {
-				Type:     schema.TypeString,
-				Optional: true,
+			"common_prefixes": {
+				Type:     schema.TypeList,
+				Computed: true,
+				Elem:     &schema.Schema{Type: schema.TypeString},
 			},
 			"delimiter": {
 				Type:     schema.TypeString,
 				Optional: true,
 			},
 			"encoding_type": {
-				Type:     schema.TypeString,
-				Optional: true,
-			},
-			"max_keys": {
-				Type:     schema.TypeInt,
-				Optional: true,
-				Default:  1000,
-			},
-			"start_after": {
-				Type:     schema.TypeString,
-				Optional: true,
+				Type:             schema.TypeString,
+				Optional:         true,
+				ValidateDiagFunc: enum.Validate[types.EncodingType](),
 			},
 			"fetch_owner": {
 				Type:     schema.TypeBool,
@@ -53,102 +51,117 @@ func DataSourceObjects() *schema.Resource {
 				Computed: true,
 				Elem:     &schema.Schema{Type: schema.TypeString},
 			},
-			"common_prefixes": {
-				Type:     schema.TypeList,
-				Computed: true,
-				Elem:     &schema.Schema{Type: schema.TypeString},
+			"max_keys": {
+				Type:     schema.TypeInt,
+				Optional: true,
+				Default:  1000,
 			},
 			"owners": {
 				Type:     schema.TypeList,
 				Computed: true,
 				Elem:     &schema.Schema{Type: schema.TypeString},
 			},
+			"prefix": {
+				Type:     schema.TypeString,
+				Optional: true,
+			},
+			"request_charged": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"request_payer": {
+				Type:             schema.TypeString,
+				Optional:         true,
+				ValidateDiagFunc: enum.Validate[types.RequestPayer](),
+			},
+			"start_after": {
+				Type:     schema.TypeString,
+				Optional: true,
+			},
 		},
 	}
 }
 
 func dataSourceObjectsRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).S3Conn(ctx)
+	conn := meta.(*conns.AWSClient).S3Client(ctx)
 
 	bucket := d.Get("bucket").(string)
-	prefix := d.Get("prefix").(string)
-
-	listInput := s3.ListObjectsV2Input{
+	input := &s3.ListObjectsV2Input{
 		Bucket: aws.String(bucket),
 	}
 
-	if prefix != "" {
-		listInput.Prefix = aws.String(prefix)
+	if v, ok := d.GetOk("delimiter"); ok {
+		input.Delimiter = aws.String(v.(string))
 	}
 
-	if s, ok := d.GetOk("delimiter"); ok {
-		listInput.Delimiter = aws.String(s.(string))
+	if v, ok := d.GetOk("encoding_type"); ok {
+		input.EncodingType = types.EncodingType(v.(string))
 	}
 
-	if s, ok := d.GetOk("encoding_type"); ok {
-		listInput.EncodingType = aws.String(s.(string))
+	if v, ok := d.GetOk("fetch_owner"); ok {
+		input.FetchOwner = v.(bool)
 	}
 
-	// "listInput.MaxKeys" refers to max keys returned in a single request
-	// (i.e., page size), not the total number of keys returned if you page
-	// through the results. "maxKeys" does refer to total keys returned.
+	// "input.MaxKeys" refers to max keys returned in a single request
+	// (i.e. page size), not the total number of keys returned if you page
+	// through the results. "max_keys" does refer to total keys returned.
 	maxKeys := int64(d.Get("max_keys").(int))
 	if maxKeys <= keyRequestPageSize {
-		listInput.MaxKeys = aws.Int64(maxKeys)
+		input.MaxKeys = int32(maxKeys)
 	}
 
-	if s, ok := d.GetOk("start_after"); ok {
-		listInput.StartAfter = aws.String(s.(string))
+	if v, ok := d.GetOk("prefix"); ok {
+		input.Prefix = aws.String(v.(string))
 	}
 
-	if b, ok := d.GetOk("fetch_owner"); ok {
-		listInput.FetchOwner = aws.Bool(b.(bool))
+	if v, ok := d.GetOk("request_payer"); ok {
+		input.RequestPayer = types.RequestPayer(v.(string))
 	}
 
-	var commonPrefixes []string
-	var keys []string
-	var owners []string
+	if v, ok := d.GetOk("start_after"); ok {
+		input.StartAfter = aws.String(v.(string))
+	}
 
-	err := conn.ListObjectsV2PagesWithContext(ctx, &listInput, func(page *s3.ListObjectsV2Output, lastPage bool) bool {
-		for _, commonPrefix := range page.CommonPrefixes {
-			commonPrefixes = append(commonPrefixes, aws.StringValue(commonPrefix.Prefix))
-		}
+	var nKeys int64
+	var commonPrefixes, keys, owners []string
+	var requestCharged string
 
-		for _, object := range page.Contents {
-			keys = append(keys, aws.StringValue(object.Key))
+	pages := s3.NewListObjectsV2Paginator(conn, input)
+pageLoop:
+	for pages.HasMorePages() {
+		page, err := pages.NextPage(ctx)
 
-			if object.Owner != nil {
-				owners = append(owners, aws.StringValue(object.Owner.ID))
-			}
+		if err != nil {
+			return sdkdiag.AppendErrorf(diags, "listing S3 Bucket (%s) Objects: %s", bucket, err)
 		}
 
-		maxKeys = maxKeys - aws.Int64Value(page.KeyCount)
+		requestCharged = string(page.RequestCharged)
 
-		if maxKeys <= keyRequestPageSize {
-			listInput.MaxKeys = aws.Int64(maxKeys)
+		for _, v := range page.CommonPrefixes {
+			commonPrefixes = append(commonPrefixes, aws.ToString(v.Prefix))
 		}
 
-		return !lastPage
-	})
+		for _, v := range page.Contents {
+			if nKeys >= maxKeys {
+				break pageLoop
+			}
 
-	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "listing S3 Bucket (%s) Objects: %s", bucket, err)
-	}
+			keys = append(keys, aws.ToString(v.Key))
 
-	d.SetId(bucket)
-
-	if err := d.Set("common_prefixes", commonPrefixes); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting common_prefixes: %s", err)
-	}
+			if v := v.Owner; v != nil {
+				owners = append(owners, aws.ToString(v.ID))
+			}
 
-	if err := d.Set("keys", keys); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting keys: %s", err)
+			nKeys++
+		}
 	}
 
-	if err := d.Set("owners", owners); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting owners: %s", err)
-	}
+	d.SetId(bucket)
+	d.Set("common_prefixes", commonPrefixes)
+	d.Set("keys", keys)
+	d.Set("owners", owners)
+	d.Set("request_charged", requestCharged)
 
 	return diags
 }
diff --git a/internal/service/s3/objects_data_source_test.go b/internal/service/s3/objects_data_source_test.go
index 28176b0a529..52ee0abfafc 100644
--- a/internal/service/s3/objects_data_source_test.go
+++ b/internal/service/s3/objects_data_source_test.go
@@ -1,37 +1,36 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3_test
 
 import (
 	"fmt"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/service/s3"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
-	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
+	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
 func TestAccS3ObjectsDataSource_basic(t *testing.T) {
 	ctx := acctest.Context(t)
-	rInt := sdkacctest.RandInt()
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	dataSourceName := "data.aws_s3_objects.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                  func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:                acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:                acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories:  acctest.ProtoV5ProviderFactories,
 		PreventPostDestroyRefresh: true,
 		Steps: []resource.TestStep{
 			{
-				Config: testAccObjectsDataSourceConfig_resources(rInt), // NOTE: contains no data source
-				// Does not need Check
-			},
-			{
-				Config: testAccObjectsDataSourceConfig_basic(rInt),
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckObjectsExistsDataSource("data.aws_s3_objects.yesh"),
-					resource.TestCheckResourceAttr("data.aws_s3_objects.yesh", "keys.#", "2"),
-					resource.TestCheckResourceAttr("data.aws_s3_objects.yesh", "keys.0", "arch/navajo/north_window"),
-					resource.TestCheckResourceAttr("data.aws_s3_objects.yesh", "keys.1", "arch/navajo/sand_dune"),
+				Config: testAccObjectsDataSourceConfig_basic(rName, 1),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					resource.TestCheckResourceAttr(dataSourceName, "common_prefixes.#", "0"),
+					resource.TestCheckResourceAttr(dataSourceName, "keys.#", "3"),
+					resource.TestCheckResourceAttr(dataSourceName, "owners.#", "0"),
+					resource.TestCheckResourceAttr(dataSourceName, "request_charged", ""),
 				),
 			},
 		},
@@ -40,142 +39,135 @@ func TestAccS3ObjectsDataSource_basic(t *testing.T) {
 
 func TestAccS3ObjectsDataSource_basicViaAccessPoint(t *testing.T) {
 	ctx := acctest.Context(t)
-	rInt := sdkacctest.RandInt()
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	dataSourceName := "data.aws_s3_objects.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                  func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:                acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:                acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories:  acctest.ProtoV5ProviderFactories,
 		PreventPostDestroyRefresh: true,
 		Steps: []resource.TestStep{
 			{
-				Config: testAccObjectsDataSourceConfig_resourcesPlusAccessPoint(rInt), // NOTE: contains no data source
-				// Does not need Check
-			},
-			{
-				Config: testAccObjectsDataSourceConfig_basicViaAccessPoint(rInt),
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckObjectsExistsDataSource("data.aws_s3_objects.yesh"),
-					resource.TestCheckResourceAttr("data.aws_s3_objects.yesh", "keys.#", "2"),
-					resource.TestCheckResourceAttr("data.aws_s3_objects.yesh", "keys.0", "arch/navajo/north_window"),
-					resource.TestCheckResourceAttr("data.aws_s3_objects.yesh", "keys.1", "arch/navajo/sand_dune"),
+				Config: testAccObjectsDataSourceConfig_basicViaAccessPoint(rName, 1),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					resource.TestCheckResourceAttr(dataSourceName, "common_prefixes.#", "0"),
+					resource.TestCheckResourceAttr(dataSourceName, "keys.#", "3"),
+					resource.TestCheckResourceAttr(dataSourceName, "owners.#", "0"),
 				),
 			},
 		},
 	})
 }
 
-func TestAccS3ObjectsDataSource_all(t *testing.T) {
+func TestAccS3ObjectsDataSource_prefixes(t *testing.T) {
 	ctx := acctest.Context(t)
-	rInt := sdkacctest.RandInt()
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	dataSourceName := "data.aws_s3_objects.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                  func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:                acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:                acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories:  acctest.ProtoV5ProviderFactories,
 		PreventPostDestroyRefresh: true,
 		Steps: []resource.TestStep{
 			{
-				Config: testAccObjectsDataSourceConfig_resources(rInt), // NOTE: contains no data source
-				// Does not need Check
-			},
-			{
-				Config: testAccObjectsDataSourceConfig_all(rInt),
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckObjectsExistsDataSource("data.aws_s3_objects.yesh"),
-					resource.TestCheckResourceAttr("data.aws_s3_objects.yesh", "keys.#", "7"),
-					resource.TestCheckResourceAttr("data.aws_s3_objects.yesh", "keys.0", "arch/courthouse_towers/landscape"),
-					resource.TestCheckResourceAttr("data.aws_s3_objects.yesh", "keys.1", "arch/navajo/north_window"),
-					resource.TestCheckResourceAttr("data.aws_s3_objects.yesh", "keys.2", "arch/navajo/sand_dune"),
-					resource.TestCheckResourceAttr("data.aws_s3_objects.yesh", "keys.3", "arch/partition/park_avenue"),
-					resource.TestCheckResourceAttr("data.aws_s3_objects.yesh", "keys.4", "arch/rubicon"),
-					resource.TestCheckResourceAttr("data.aws_s3_objects.yesh", "keys.5", "arch/three_gossips/broken"),
-					resource.TestCheckResourceAttr("data.aws_s3_objects.yesh", "keys.6", "arch/three_gossips/turret"),
+				Config: testAccObjectsDataSourceConfig_prefixes(rName, 1),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					resource.TestCheckResourceAttr(dataSourceName, "common_prefixes.#", "2"),
+					resource.TestCheckResourceAttr(dataSourceName, "keys.#", "0"),
+					resource.TestCheckResourceAttr(dataSourceName, "owners.#", "0"),
 				),
 			},
 		},
 	})
 }
 
-func TestAccS3ObjectsDataSource_prefixes(t *testing.T) {
+func TestAccS3ObjectsDataSource_encoded(t *testing.T) {
 	ctx := acctest.Context(t)
-	rInt := sdkacctest.RandInt()
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	dataSourceName := "data.aws_s3_objects.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                  func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:                acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:                acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories:  acctest.ProtoV5ProviderFactories,
 		PreventPostDestroyRefresh: true,
 		Steps: []resource.TestStep{
 			{
-				Config: testAccObjectsDataSourceConfig_resources(rInt), // NOTE: contains no data source
-				// Does not need Check
-			},
-			{
-				Config: testAccObjectsDataSourceConfig_prefixes(rInt),
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckObjectsExistsDataSource("data.aws_s3_objects.yesh"),
-					resource.TestCheckResourceAttr("data.aws_s3_objects.yesh", "keys.#", "1"),
-					resource.TestCheckResourceAttr("data.aws_s3_objects.yesh", "keys.0", "arch/rubicon"),
-					resource.TestCheckResourceAttr("data.aws_s3_objects.yesh", "common_prefixes.#", "4"),
-					resource.TestCheckResourceAttr("data.aws_s3_objects.yesh", "common_prefixes.0", "arch/courthouse_towers/"),
-					resource.TestCheckResourceAttr("data.aws_s3_objects.yesh", "common_prefixes.1", "arch/navajo/"),
-					resource.TestCheckResourceAttr("data.aws_s3_objects.yesh", "common_prefixes.2", "arch/partition/"),
-					resource.TestCheckResourceAttr("data.aws_s3_objects.yesh", "common_prefixes.3", "arch/three_gossips/"),
+				Config: testAccObjectsDataSourceConfig_encoded(rName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					resource.TestCheckResourceAttr(dataSourceName, "common_prefixes.#", "0"),
+					resource.TestCheckResourceAttr(dataSourceName, "keys.#", "1"),
+					resource.TestCheckResourceAttr(dataSourceName, "keys.0", "prefix/a+b"),
+					resource.TestCheckResourceAttr(dataSourceName, "owners.#", "0"),
 				),
 			},
 		},
 	})
 }
 
-func TestAccS3ObjectsDataSource_encoded(t *testing.T) {
+func TestAccS3ObjectsDataSource_maxKeysSmall(t *testing.T) {
 	ctx := acctest.Context(t)
-	rInt := sdkacctest.RandInt()
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	dataSourceName := "data.aws_s3_objects.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                  func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:                acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:                acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories:  acctest.ProtoV5ProviderFactories,
 		PreventPostDestroyRefresh: true,
 		Steps: []resource.TestStep{
 			{
-				Config: testAccObjectsDataSourceConfig_extraResource(rInt), // NOTE: contains no data source
-				// Does not need Check
+				Config: testAccObjectsDataSourceConfig_maxKeysSmall(rName, 1, 5),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					resource.TestCheckResourceAttr(dataSourceName, "common_prefixes.#", "0"),
+					resource.TestCheckResourceAttr(dataSourceName, "keys.#", "3"),
+					resource.TestCheckResourceAttr(dataSourceName, "owners.#", "0"),
+				),
 			},
 			{
-				Config: testAccObjectsDataSourceConfig_encoded(rInt),
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckObjectsExistsDataSource("data.aws_s3_objects.yesh"),
-					resource.TestCheckResourceAttr("data.aws_s3_objects.yesh", "keys.#", "2"),
-					resource.TestCheckResourceAttr("data.aws_s3_objects.yesh", "keys.0", "arch/ru+b+ic+on"),
-					resource.TestCheckResourceAttr("data.aws_s3_objects.yesh", "keys.1", "arch/rubicon"),
+				Config: testAccObjectsDataSourceConfig_maxKeysSmall(rName, 2, 5),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					resource.TestCheckResourceAttr(dataSourceName, "common_prefixes.#", "0"),
+					resource.TestCheckResourceAttr(dataSourceName, "keys.#", "5"),
+					resource.TestCheckResourceAttr(dataSourceName, "owners.#", "0"),
 				),
 			},
 		},
 	})
 }
 
-func TestAccS3ObjectsDataSource_maxKeys(t *testing.T) {
+func TestAccS3ObjectsDataSource_maxKeysLarge(t *testing.T) {
 	ctx := acctest.Context(t)
-	rInt := sdkacctest.RandInt()
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	dataSourceName := "data.aws_s3_objects.test"
+	var keys []string
+	for i := 0; i < 1500; i++ {
+		keys = append(keys, fmt.Sprintf("data%d", i))
+	}
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                  func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:                acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:                acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories:  acctest.ProtoV5ProviderFactories,
 		PreventPostDestroyRefresh: true,
 		Steps: []resource.TestStep{
 			{
-				Config: testAccObjectsDataSourceConfig_resources(rInt), // NOTE: contains no data source
-				// Does not need Check
+				Config: testAccObjectsDataSourceConfig_maxKeysLarge(rName, 1002),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					resource.TestCheckResourceAttr(dataSourceName, "common_prefixes.#", "0"),
+					resource.TestCheckResourceAttr(dataSourceName, "keys.#", "0"),
+					resource.TestCheckResourceAttr(dataSourceName, "owners.#", "0"),
+					testAccCheckBucketAddObjects(ctx, "aws_s3_bucket.test", keys...),
+				),
 			},
 			{
-				Config: testAccObjectsDataSourceConfig_maxKeys(rInt),
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckObjectsExistsDataSource("data.aws_s3_objects.yesh"),
-					resource.TestCheckResourceAttr("data.aws_s3_objects.yesh", "keys.#", "2"),
-					resource.TestCheckResourceAttr("data.aws_s3_objects.yesh", "keys.0", "arch/courthouse_towers/landscape"),
-					resource.TestCheckResourceAttr("data.aws_s3_objects.yesh", "keys.1", "arch/navajo/north_window"),
+				Config: testAccObjectsDataSourceConfig_maxKeysLarge(rName, 1002),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					resource.TestCheckResourceAttr(dataSourceName, "common_prefixes.#", "0"),
+					resource.TestCheckResourceAttr(dataSourceName, "keys.#", "1002"),
+					resource.TestCheckResourceAttr(dataSourceName, "owners.#", "0"),
 				),
 			},
 		},
@@ -184,24 +176,21 @@ func TestAccS3ObjectsDataSource_maxKeys(t *testing.T) {
 
 func TestAccS3ObjectsDataSource_startAfter(t *testing.T) {
 	ctx := acctest.Context(t)
-	rInt := sdkacctest.RandInt()
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	dataSourceName := "data.aws_s3_objects.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                  func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:                acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:                acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories:  acctest.ProtoV5ProviderFactories,
 		PreventPostDestroyRefresh: true,
 		Steps: []resource.TestStep{
 			{
-				Config: testAccObjectsDataSourceConfig_resources(rInt), // NOTE: contains no data source
-				// Does not need Check
-			},
-			{
-				Config: testAccObjectsDataSourceConfig_startAfter(rInt),
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckObjectsExistsDataSource("data.aws_s3_objects.yesh"),
-					resource.TestCheckResourceAttr("data.aws_s3_objects.yesh", "keys.#", "1"),
-					resource.TestCheckResourceAttr("data.aws_s3_objects.yesh", "keys.0", "arch/three_gossips/turret"),
+				Config: testAccObjectsDataSourceConfig_startAfter(rName, 1, "prefix1/sub2/0"),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					resource.TestCheckResourceAttr(dataSourceName, "common_prefixes.#", "0"),
+					resource.TestCheckResourceAttr(dataSourceName, "keys.#", "1"),
+					resource.TestCheckResourceAttr(dataSourceName, "owners.#", "0"),
 				),
 			},
 		},
@@ -210,202 +199,161 @@ func TestAccS3ObjectsDataSource_startAfter(t *testing.T) {
 
 func TestAccS3ObjectsDataSource_fetchOwner(t *testing.T) {
 	ctx := acctest.Context(t)
-	rInt := sdkacctest.RandInt()
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	dataSourceName := "data.aws_s3_objects.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                  func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:                acctest.ErrorCheck(t, s3.EndpointsID),
+		ErrorCheck:                acctest.ErrorCheck(t, names.S3EndpointID),
 		ProtoV5ProviderFactories:  acctest.ProtoV5ProviderFactories,
 		PreventPostDestroyRefresh: true,
 		Steps: []resource.TestStep{
 			{
-				Config: testAccObjectsDataSourceConfig_resources(rInt), // NOTE: contains no data source
-				// Does not need Check
-			},
-			{
-				Config: testAccObjectsDataSourceConfig_owners(rInt),
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckObjectsExistsDataSource("data.aws_s3_objects.yesh"),
-					resource.TestCheckResourceAttr("data.aws_s3_objects.yesh", "keys.#", "2"),
-					resource.TestCheckResourceAttr("data.aws_s3_objects.yesh", "owners.#", "2"),
+				Config: testAccObjectsDataSourceConfig_owners(rName, 1),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					resource.TestCheckResourceAttr(dataSourceName, "common_prefixes.#", "0"),
+					resource.TestCheckResourceAttr(dataSourceName, "keys.#", "3"),
+					resource.TestCheckResourceAttr(dataSourceName, "owners.#", "3"),
 				),
 			},
 		},
 	})
 }
 
-func testAccCheckObjectsExistsDataSource(addr string) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		rs, ok := s.RootModule().Resources[addr]
-		if !ok {
-			return fmt.Errorf("Can't find S3 objects data source: %s", addr)
-		}
-
-		if rs.Primary.ID == "" {
-			return fmt.Errorf("S3 objects data source ID not set")
-		}
-
-		return nil
-	}
-}
-
-func testAccObjectsDataSourceConfig_resources(randInt int) string {
+func testAccObjectsDataSourceConfig_base(rName string, n int) string {
 	return fmt.Sprintf(`
-resource "aws_s3_bucket" "objects_bucket" {
-  bucket = "tf-acc-objects-test-bucket-%d"
+resource "aws_s3_bucket" "test" {
+  bucket = %[1]q
 }
 
-resource "aws_s3_object" "object1" {
-  bucket  = aws_s3_bucket.objects_bucket.id
-  key     = "arch/three_gossips/turret"
-  content = "Delicate"
-}
+resource "aws_s3_object" "test1" {
+  count = %[2]d
 
-resource "aws_s3_object" "object2" {
-  bucket  = aws_s3_bucket.objects_bucket.id
-  key     = "arch/three_gossips/broken"
-  content = "Dark Angel"
+  bucket  = aws_s3_bucket.test.id
+  key     = "prefix1/sub1/${count.index}"
+  content = "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
 }
 
-resource "aws_s3_object" "object3" {
-  bucket  = aws_s3_bucket.objects_bucket.id
-  key     = "arch/navajo/north_window"
-  content = "Balanced Rock"
-}
+resource "aws_s3_object" "test2" {
+  count = %[2]d
 
-resource "aws_s3_object" "object4" {
-  bucket  = aws_s3_bucket.objects_bucket.id
-  key     = "arch/navajo/sand_dune"
-  content = "Queen Victoria Rock"
+  bucket  = aws_s3_bucket.test.id
+  key     = "prefix1/sub2/${count.index}"
+  content = "0123456789"
 }
 
-resource "aws_s3_object" "object5" {
-  bucket  = aws_s3_bucket.objects_bucket.id
-  key     = "arch/partition/park_avenue"
-  content = "Double-O"
-}
+resource "aws_s3_object" "test3" {
+  count = %[2]d
 
-resource "aws_s3_object" "object6" {
-  bucket  = aws_s3_bucket.objects_bucket.id
-  key     = "arch/courthouse_towers/landscape"
-  content = "Fiery Furnace"
+  bucket  = aws_s3_bucket.test.id
+  key     = "prefix2/${count.index}"
+  content = "abcdefghijklmnopqrstuvwxyz"
 }
+`, rName, n)
+}
+
+func testAccObjectsDataSourceConfig_basic(rName string, n int) string {
+	return acctest.ConfigCompose(testAccObjectsDataSourceConfig_base(rName, n), `
+data "aws_s3_objects" "test" {
+  bucket = aws_s3_bucket.test.id
 
-resource "aws_s3_object" "object7" {
-  bucket  = aws_s3_bucket.objects_bucket.id
-  key     = "arch/rubicon"
-  content = "Devils Garden"
+  depends_on = [aws_s3_object.test1, aws_s3_object.test2, aws_s3_object.test3]
 }
-`, randInt)
+`)
 }
 
-func testAccObjectsDataSourceConfig_resourcesPlusAccessPoint(randInt int) string {
-	return testAccObjectsDataSourceConfig_resources(randInt) + fmt.Sprintf(`
+func testAccObjectsDataSourceConfig_basicViaAccessPoint(rName string, n int) string {
+	return acctest.ConfigCompose(testAccObjectsDataSourceConfig_base(rName, n), fmt.Sprintf(`
 resource "aws_s3_access_point" "test" {
-  bucket = aws_s3_bucket.objects_bucket.bucket
-  name   = "tf-objects-test-access-point-%[1]d"
-}
-`, randInt)
+  bucket = aws_s3_bucket.test.bucket
+  name   = "%[1]s-access-point"
 }
 
-func testAccObjectsDataSourceConfig_basic(randInt int) string {
-	return fmt.Sprintf(`
-%s
+data "aws_s3_objects" "test" {
+  bucket = aws_s3_access_point.test.arn
 
-data "aws_s3_objects" "yesh" {
-  bucket    = aws_s3_bucket.objects_bucket.id
-  prefix    = "arch/navajo/"
-  delimiter = "/"
+  depends_on = [aws_s3_object.test1, aws_s3_object.test2, aws_s3_object.test3]
 }
-`, testAccObjectsDataSourceConfig_resources(randInt))
+`, rName))
 }
 
-func testAccObjectsDataSourceConfig_basicViaAccessPoint(randInt int) string {
-	return testAccObjectsDataSourceConfig_resourcesPlusAccessPoint(randInt) + `
-data "aws_s3_objects" "yesh" {
-  bucket    = aws_s3_access_point.test.arn
-  prefix    = "arch/navajo/"
+func testAccObjectsDataSourceConfig_prefixes(rName string, n int) string {
+	return acctest.ConfigCompose(testAccObjectsDataSourceConfig_base(rName, n), `
+data "aws_s3_objects" "test" {
+  bucket    = aws_s3_bucket.test.id
+  prefix    = "prefix1/"
   delimiter = "/"
-}
-`
-}
-
-func testAccObjectsDataSourceConfig_all(randInt int) string {
-	return fmt.Sprintf(`
-%s
 
-data "aws_s3_objects" "yesh" {
-  bucket = aws_s3_bucket.objects_bucket.id
+  depends_on = [aws_s3_object.test1, aws_s3_object.test2, aws_s3_object.test3]
 }
-`, testAccObjectsDataSourceConfig_resources(randInt))
+`)
 }
 
-func testAccObjectsDataSourceConfig_prefixes(randInt int) string {
+func testAccObjectsDataSourceConfig_encoded(rName string) string {
 	return fmt.Sprintf(`
-%s
-
-data "aws_s3_objects" "yesh" {
-  bucket    = aws_s3_bucket.objects_bucket.id
-  prefix    = "arch/"
-  delimiter = "/"
+resource "aws_s3_bucket" "test" {
+  bucket = %[1]q
 }
-`, testAccObjectsDataSourceConfig_resources(randInt))
+
+resource "aws_s3_object" "test" {
+  bucket  = aws_s3_bucket.test.id
+  key     = "prefix/a b"
+  content = "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
 }
 
-func testAccObjectsDataSourceConfig_extraResource(randInt int) string {
-	return fmt.Sprintf(`
-%s
+data "aws_s3_objects" "test" {
+  bucket        = aws_s3_bucket.test.id
+  encoding_type = "url"
 
-resource "aws_s3_object" "object8" {
-  bucket  = aws_s3_bucket.objects_bucket.id
-  key     = "arch/ru b ic on"
-  content = "Goose Island"
+  depends_on = [aws_s3_object.test]
 }
-`, testAccObjectsDataSourceConfig_resources(randInt))
+`, rName)
 }
 
-func testAccObjectsDataSourceConfig_encoded(randInt int) string {
-	return fmt.Sprintf(`
-%s
+func testAccObjectsDataSourceConfig_maxKeysSmall(rName string, n, maxKeys int) string {
+	return acctest.ConfigCompose(testAccObjectsDataSourceConfig_base(rName, n), fmt.Sprintf(`
+data "aws_s3_objects" "test" {
+  bucket   = aws_s3_bucket.test.id
+  max_keys = %[1]d
 
-data "aws_s3_objects" "yesh" {
-  bucket        = aws_s3_bucket.objects_bucket.id
-  encoding_type = "url"
-  prefix        = "arch/ru"
+  depends_on = [aws_s3_object.test1, aws_s3_object.test2, aws_s3_object.test3]
 }
-`, testAccObjectsDataSourceConfig_extraResource(randInt))
+`, maxKeys))
 }
 
-func testAccObjectsDataSourceConfig_maxKeys(randInt int) string {
+// Objects are added to the bucket outside this configuration.
+func testAccObjectsDataSourceConfig_maxKeysLarge(rName string, maxKeys int) string {
 	return fmt.Sprintf(`
-%s
+resource "aws_s3_bucket" "test" {
+  bucket        = %[1]q
+  force_destroy = true
+}
 
-data "aws_s3_objects" "yesh" {
-  bucket   = aws_s3_bucket.objects_bucket.id
-  max_keys = 2
+data "aws_s3_objects" "test" {
+  bucket   = aws_s3_bucket.test.id
+  max_keys = %[2]d
 }
-`, testAccObjectsDataSourceConfig_resources(randInt))
+`, rName, maxKeys)
 }
 
-func testAccObjectsDataSourceConfig_startAfter(randInt int) string {
-	return fmt.Sprintf(`
-%s
+func testAccObjectsDataSourceConfig_startAfter(rName string, n int, startAfter string) string {
+	return acctest.ConfigCompose(testAccObjectsDataSourceConfig_base(rName, n), fmt.Sprintf(`
+data "aws_s3_objects" "test" {
+  bucket      = aws_s3_bucket.test.id
+  start_after = %[1]q
 
-data "aws_s3_objects" "yesh" {
-  bucket      = aws_s3_bucket.objects_bucket.id
-  start_after = "arch/three_gossips/broken"
+  depends_on = [aws_s3_object.test1, aws_s3_object.test2, aws_s3_object.test3]
 }
-`, testAccObjectsDataSourceConfig_resources(randInt))
+`, startAfter))
 }
 
-func testAccObjectsDataSourceConfig_owners(randInt int) string {
-	return fmt.Sprintf(`
-%s
-
-data "aws_s3_objects" "yesh" {
-  bucket      = aws_s3_bucket.objects_bucket.id
-  prefix      = "arch/three_gossips/"
+func testAccObjectsDataSourceConfig_owners(rName string, n int) string {
+	return acctest.ConfigCompose(testAccObjectsDataSourceConfig_base(rName, n), `
+data "aws_s3_objects" "test" {
+  bucket      = aws_s3_bucket.test.id
   fetch_owner = true
+
+  depends_on = [aws_s3_object.test1, aws_s3_object.test2, aws_s3_object.test3]
 }
-`, testAccObjectsDataSourceConfig_resources(randInt))
+`)
 }
diff --git a/internal/service/s3/service_package.go b/internal/service/s3/service_package.go
index b2e1fec2ac5..04b32070e85 100644
--- a/internal/service/s3/service_package.go
+++ b/internal/service/s3/service_package.go
@@ -1,13 +1,22 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3
 
 import (
 	"context"
 
+	aws_sdkv2 "github.com/aws/aws-sdk-go-v2/aws"
+	retry_sdkv2 "github.com/aws/aws-sdk-go-v2/aws/retry"
+	s3_sdkv2 "github.com/aws/aws-sdk-go-v2/service/s3"
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
+	endpoints_sdkv1 "github.com/aws/aws-sdk-go/aws/endpoints"
 	request_sdkv1 "github.com/aws/aws-sdk-go/aws/request"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	s3_sdkv1 "github.com/aws/aws-sdk-go/service/s3"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	tfawserr_sdkv1 "github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	tfawserr_sdkv2 "github.com/hashicorp/aws-sdk-go-base/v2/tfawserr"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 )
 
 // NewConn returns a new AWS SDK for Go v1 client for this service package's AWS API.
@@ -18,16 +27,43 @@ func (p *servicePackage) NewConn(ctx context.Context, m map[string]any) (*s3_sdk
 		S3ForcePathStyle: aws_sdkv1.Bool(m["s3_use_path_style"].(bool)),
 	}
 
+	if v, ok := m["s3_us_east_1_regional_endpoint"]; ok {
+		config.S3UsEast1RegionalEndpoint = v.(endpoints_sdkv1.S3UsEast1RegionalEndpoint)
+	}
+
 	return s3_sdkv1.New(sess.Copy(config)), nil
 }
 
 // CustomizeConn customizes a new AWS SDK for Go v1 client for this service package's AWS API.
 func (p *servicePackage) CustomizeConn(ctx context.Context, conn *s3_sdkv1.S3) (*s3_sdkv1.S3, error) {
 	conn.Handlers.Retry.PushBack(func(r *request_sdkv1.Request) {
-		if tfawserr.ErrMessageContains(r.Error, errCodeOperationAborted, "A conflicting conditional operation is currently in progress against this resource. Please try again.") {
+		if tfawserr_sdkv1.ErrMessageContains(r.Error, errCodeOperationAborted, "A conflicting conditional operation is currently in progress against this resource. Please try again.") {
 			r.Retryable = aws_sdkv1.Bool(true)
 		}
 	})
 
 	return conn, nil
 }
+
+// NewClient returns a new AWS SDK for Go v2 client for this service package's AWS API.
+func (p *servicePackage) NewClient(ctx context.Context, config map[string]any) (*s3_sdkv2.Client, error) {
+	cfg := *(config["aws_sdkv2_config"].(*aws_sdkv2.Config))
+
+	return s3_sdkv2.NewFromConfig(cfg, func(o *s3_sdkv2.Options) {
+		if endpoint := config["endpoint"].(string); endpoint != "" {
+			o.BaseEndpoint = aws_sdkv2.String(endpoint)
+		} else if o.Region == endpoints_sdkv1.UsEast1RegionID && config["s3_us_east_1_regional_endpoint"].(endpoints_sdkv1.S3UsEast1RegionalEndpoint) != endpoints_sdkv1.RegionalS3UsEast1Endpoint {
+			// Maintain the AWS SDK for Go v1 default of using the global endpoint in us-east-1.
+			// See https://github.com/hashicorp/terraform-provider-aws/issues/33028.
+			o.Region = "aws-global"
+		}
+		o.UsePathStyle = config["s3_use_path_style"].(bool)
+
+		o.Retryer = conns.AddIsErrorRetryables(cfg.Retryer().(aws_sdkv2.RetryerV2), retry_sdkv2.IsErrorRetryableFunc(func(err error) aws_sdkv2.Ternary {
+			if tfawserr_sdkv2.ErrMessageContains(err, errCodeOperationAborted, "A conflicting conditional operation is currently in progress against this resource. Please try again.") {
+				return aws_sdkv2.TrueTernary
+			}
+			return aws_sdkv2.UnknownTernary // Delegate to configured Retryer.
+		}))
+	}), nil
+}
diff --git a/internal/service/s3/service_package_gen.go b/internal/service/s3/service_package_gen.go
index b76355c4031..f0ff0323eec 100644
--- a/internal/service/s3/service_package_gen.go
+++ b/internal/service/s3/service_package_gen.go
@@ -5,6 +5,7 @@ package s3
 import (
 	"context"
 
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -22,7 +23,7 @@ func (p *servicePackage) FrameworkResources(ctx context.Context) []*types.Servic
 func (p *servicePackage) SDKDataSources(ctx context.Context) []*types.ServicePackageSDKDataSource {
 	return []*types.ServicePackageSDKDataSource{
 		{
-			Factory:  DataSourceCanonicalUserID,
+			Factory:  dataSourceCanonicalUserID,
 			TypeName: "aws_canonical_user_id",
 		},
 		{
@@ -161,4 +162,6 @@ func (p *servicePackage) ServicePackageName() string {
 	return names.S3
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/s3/status.go b/internal/service/s3/status.go
index 494ac03ff39..0e6ffc477a5 100644
--- a/internal/service/s3/status.go
+++ b/internal/service/s3/status.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3
 
 import (
@@ -57,38 +60,3 @@ func lifecycleConfigurationRulesStatus(ctx context.Context, conn *s3.S3, bucket,
 		return output, LifecycleConfigurationRulesStatusReady, nil
 	}
 }
-
-func bucketVersioningStatus(ctx context.Context, conn *s3.S3, bucket, expectedBucketOwner string) retry.StateRefreshFunc {
-	return func() (interface{}, string, error) {
-		input := &s3.GetBucketVersioningInput{
-			Bucket: aws.String(bucket),
-		}
-
-		if expectedBucketOwner != "" {
-			input.ExpectedBucketOwner = aws.String(expectedBucketOwner)
-		}
-
-		output, err := conn.GetBucketVersioningWithContext(ctx, input)
-
-		if tfawserr.ErrCodeEquals(err, s3.ErrCodeNoSuchBucket) {
-			return nil, "", nil
-		}
-
-		if err != nil {
-			return nil, "", err
-		}
-
-		if output == nil {
-			return nil, "", &retry.NotFoundError{
-				Message:     "Empty result",
-				LastRequest: input,
-			}
-		}
-
-		if output.Status == nil {
-			return output, BucketVersioningStatusDisabled, nil
-		}
-
-		return output, aws.StringValue(output.Status), nil
-	}
-}
diff --git a/internal/service/s3/sweep.go b/internal/service/s3/sweep.go
index 65e7c267a9f..2dff1482890 100644
--- a/internal/service/s3/sweep.go
+++ b/internal/service/s3/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package s3
 
@@ -7,22 +7,23 @@ import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"strings"
 	"time"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/aws/request"
-	"github.com/aws/aws-sdk-go/service/s3"
-	"github.com/aws/aws-sdk-go/service/s3/s3manager"
-	"github.com/hashicorp/go-multierror"
+	"github.com/YakDriver/regexache"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/feature/s3/manager"
+	"github.com/aws/aws-sdk-go-v2/service/s3"
+	"github.com/aws/aws-sdk-go-v2/service/s3/types"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	tfslices "github.com/hashicorp/terraform-provider-aws/internal/slices"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv2"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_s3_object", &resource.Sweeper{
 		Name: "aws_s3_object",
 		F:    sweepObjects,
@@ -41,19 +42,20 @@ func init() {
 
 func sweepObjects(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("getting client: %s", err)
 	}
-
-	conn := client.S3ConnURICleaningDisabled(ctx)
+	conn := client.S3Client(ctx)
 	input := &s3.ListBucketsInput{}
 
-	output, err := conn.ListBucketsWithContext(ctx, input)
-	if sweep.SkipSweepError(err) {
+	output, err := conn.ListBuckets(ctx, input)
+
+	if awsv2.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping S3 Objects sweep for %s: %s", region, err)
 		return nil
 	}
+
 	if err != nil {
 		return fmt.Errorf("listing S3 Buckets: %w", err)
 	}
@@ -63,70 +65,67 @@ func sweepObjects(region string) error {
 		return nil
 	}
 
+	buckets := tfslices.Filter(output.Buckets, bucketRegionFilter(ctx, conn, region, client.S3UsePathStyle()))
+	buckets = tfslices.Filter(buckets, bucketNameFilter)
 	sweepables := make([]sweep.Sweepable, 0)
-	var errs *multierror.Error
-
-	buckets, err := filterBuckets(output.Buckets, bucketRegionFilter(ctx, conn, region))
-	if err != nil {
-		errs = multierror.Append(errs, err)
-	}
-
-	buckets, err = filterBuckets(buckets, bucketNameFilter)
-	if err != nil {
-		errs = multierror.Append(errs, err)
-	}
 
 	for _, bucket := range buckets {
-		bucketName := aws.StringValue(bucket.Name)
+		bucket := aws.ToString(bucket.Name)
+		objLockConfig, err := findObjectLockConfiguration(ctx, conn, bucket, "")
 
-		objectLockEnabled, err := objectLockEnabled(ctx, conn, bucketName)
-		if err != nil {
-			errs = multierror.Append(errs, fmt.Errorf("reading S3 Bucket (%s) object lock: %w", bucketName, err))
-			continue
+		var objectLockEnabled bool
+
+		if !tfresource.NotFound(err) {
+			if err != nil {
+				log.Printf("[WARN] Reading S3 Bucket Object Lock Configuration (%s): %s", bucket, err)
+				continue
+			}
+			objectLockEnabled = objLockConfig.ObjectLockEnabled == types.ObjectLockEnabledEnabled
 		}
 
 		sweepables = append(sweepables, objectSweeper{
 			conn:   conn,
-			name:   bucketName,
+			bucket: bucket,
 			locked: objectLockEnabled,
 		})
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepables); err != nil {
-		errs = multierror.Append(errs, fmt.Errorf("sweeping DynamoDB Backups for %s: %w", region, err))
+	err = sweep.SweepOrchestrator(ctx, sweepables)
+
+	if err != nil {
+		return fmt.Errorf("error sweeping S3 Objects (%s): %w", region, err)
 	}
 
-	return errs.ErrorOrNil()
+	return nil
 }
 
 type objectSweeper struct {
-	conn   *s3.S3
-	name   string
+	conn   *s3.Client
+	bucket string
 	locked bool
 }
 
 func (os objectSweeper) Delete(ctx context.Context, timeout time.Duration, optFns ...tfresource.OptionsFunc) error {
-	// Delete everything including locked objects
-	_, err := DeleteAllObjectVersions(ctx, os.conn, os.name, "", os.locked, true)
+	// Delete everything including locked objects.
+	_, err := deleteAllObjectVersions(ctx, os.conn, os.bucket, "", os.locked, true)
 	if err != nil {
-		return fmt.Errorf("deleting S3 Bucket (%s) contents: %w", os.name, err)
+		return fmt.Errorf("deleting S3 Bucket (%s) objects: %w", os.bucket, err)
 	}
 	return nil
 }
 
 func sweepBuckets(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("getting client: %s", err)
 	}
-
-	conn := client.S3Conn(ctx)
+	conn := client.S3Client(ctx)
 	input := &s3.ListBucketsInput{}
 
-	output, err := conn.ListBucketsWithContext(ctx, input)
+	output, err := conn.ListBuckets(ctx, input)
 
-	if sweep.SkipSweepError(err) {
+	if awsv2.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping S3 Buckets sweep for %s: %s", region, err)
 		return nil
 	}
@@ -140,44 +139,38 @@ func sweepBuckets(region string) error {
 		return nil
 	}
 
-	var errs *multierror.Error
-	sweepResources := make([]sweep.Sweepable, 0)
-
-	buckets, err := filterBuckets(output.Buckets, bucketRegionFilter(ctx, conn, region))
-	if err != nil {
-		errs = multierror.Append(errs, err)
-	}
-
-	buckets, err = filterBuckets(buckets, bucketNameFilter)
-	if err != nil {
-		errs = multierror.Append(errs, err)
-	}
+	buckets := tfslices.Filter(output.Buckets, bucketRegionFilter(ctx, conn, region, client.S3UsePathStyle()))
+	buckets = tfslices.Filter(buckets, bucketNameFilter)
+	sweepables := make([]sweep.Sweepable, 0)
 
 	for _, bucket := range buckets {
-		name := aws.StringValue(bucket.Name)
+		name := aws.ToString(bucket.Name)
 
 		r := ResourceBucket()
 		d := r.Data(nil)
 		d.SetId(name)
 
-		sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
+		sweepables = append(sweepables, sweep.NewSweepResource(r, d, client))
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
-		errs = multierror.Append(errs, fmt.Errorf("sweeping S3 Buckets for %s: %w", region, err))
+	err = sweep.SweepOrchestrator(ctx, sweepables)
+
+	if err != nil {
+		return fmt.Errorf("error sweeping S3 Buckets (%s): %w", region, err)
 	}
 
-	return errs.ErrorOrNil()
+	return nil
 }
 
-func bucketRegion(ctx context.Context, conn *s3.S3, bucket string) (string, error) {
-	region, err := s3manager.GetBucketRegionWithClient(ctx, conn, bucket, func(r *request.Request) {
+func bucketRegion(ctx context.Context, conn *s3.Client, bucket string, s3UsePathStyle bool) (string, error) {
+	region, err := manager.GetBucketRegion(ctx, conn, bucket, func(o *s3.Options) {
 		// By default, GetBucketRegion forces virtual host addressing, which
 		// is not compatible with many non-AWS implementations. Instead, pass
 		// the provider s3_force_path_style configuration, which defaults to
 		// false, but allows override.
-		r.Config.S3ForcePathStyle = conn.Config.S3ForcePathStyle
+		o.UsePathStyle = s3UsePathStyle
 	})
+
 	if err != nil {
 		return "", err
 	}
@@ -185,77 +178,50 @@ func bucketRegion(ctx context.Context, conn *s3.S3, bucket string) (string, erro
 	return region, nil
 }
 
-func objectLockEnabled(ctx context.Context, conn *s3.S3, bucket string) (bool, error) {
-	output, err := FindObjectLockConfiguration(ctx, conn, bucket, "")
-
-	if tfresource.NotFound(err) {
-		return false, nil
-	}
-
-	if err != nil {
-		return false, err
-	}
-
-	return aws.StringValue(output.ObjectLockEnabled) == s3.ObjectLockEnabledEnabled, nil
-}
-
-type bucketFilter func(*s3.Bucket) (bool, error)
-
-func filterBuckets(in []*s3.Bucket, f bucketFilter) ([]*s3.Bucket, error) {
-	var errs *multierror.Error
-	var out []*s3.Bucket
-
-	for _, b := range in {
-		if ok, err := f(b); err != nil {
-			errs = multierror.Append(errs, err)
-		} else if ok {
-			out = append(out, b)
-		}
-	}
-
-	return out, errs.ErrorOrNil()
-}
-
-func bucketNameFilter(bucket *s3.Bucket) (bool, error) {
-	name := aws.StringValue(bucket.Name)
+func bucketNameFilter(bucket types.Bucket) bool {
+	name := aws.ToString(bucket.Name)
 
 	prefixes := []string{
 		"tf-acc",
 		"tf-object-test",
 		"tf-test",
 		"tftest.applicationversion",
+		"terraform-remote-s3-test",
 	}
 	for _, prefix := range prefixes {
 		if strings.HasPrefix(name, prefix) {
-			return true, nil
+			return true
 		}
 	}
 
 	if defaultNameRegexp.MatchString(name) {
-		return true, nil
+		return true
 	}
 
 	log.Printf("[INFO] Skipping S3 Bucket (%s): not in prefix list", name)
-	return false, nil
+	return false
 }
 
 var (
-	defaultNameRegexp = regexp.MustCompile(fmt.Sprintf(`^%s\d+$`, id.UniqueIdPrefix))
+	defaultNameRegexp = regexache.MustCompile(fmt.Sprintf(`^%s\d+$`, id.UniqueIdPrefix))
 )
 
-func bucketRegionFilter(ctx context.Context, conn *s3.S3, region string) bucketFilter {
-	return func(bucket *s3.Bucket) (bool, error) {
-		name := aws.StringValue(bucket.Name)
+func bucketRegionFilter(ctx context.Context, conn *s3.Client, region string, s3UsePathStyle bool) tfslices.Predicate[types.Bucket] {
+	return func(bucket types.Bucket) bool {
+		name := aws.ToString(bucket.Name)
+
+		bucketRegion, err := bucketRegion(ctx, conn, name, s3UsePathStyle)
 
-		bucketRegion, err := bucketRegion(ctx, conn, name)
 		if err != nil {
-			return false, err
+			log.Printf("[WARN] Getting S3 Bucket (%s) region: %s", name, err)
+			return false
 		}
+
 		if bucketRegion != region {
 			log.Printf("[INFO] Skipping S3 Bucket (%s): not in %s", name, region)
-			return false, nil
+			return false
 		}
 
-		return true, nil
+		return true
 	}
 }
diff --git a/internal/service/s3/tags.go b/internal/service/s3/tags.go
index 640abc4c8bd..690521b27fd 100644
--- a/internal/service/s3/tags.go
+++ b/internal/service/s3/tags.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:build !generate
 // +build !generate
 
@@ -6,23 +9,25 @@ package s3
 import (
 	"context"
 	"fmt"
-	"time"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/s3"
-	"github.com/aws/aws-sdk-go/service/s3/s3iface"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	aws_sdkv2 "github.com/aws/aws-sdk-go-v2/aws"
+	s3_sdkv2 "github.com/aws/aws-sdk-go-v2/service/s3"
+	s3types_sdkv2 "github.com/aws/aws-sdk-go-v2/service/s3/types"
+	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
+	s3_sdkv1 "github.com/aws/aws-sdk-go/service/s3"
+	s3iface_sdkv1 "github.com/aws/aws-sdk-go/service/s3/s3iface"
+	tfawserr_sdkv1 "github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	tfawserr_sdkv2 "github.com/hashicorp/aws-sdk-go-base/v2/tfawserr"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
-	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
 // Custom S3 tag service update functions using the same format as generated code.
 
 // BucketListTags lists S3 bucket tags.
 // The identifier is the bucket name.
-func BucketListTags(ctx context.Context, conn s3iface.S3API, identifier string) (tftags.KeyValueTags, error) {
-	input := &s3.GetBucketTaggingInput{
-		Bucket: aws.String(identifier),
+func BucketListTags(ctx context.Context, conn s3iface_sdkv1.S3API, identifier string) (tftags.KeyValueTags, error) {
+	input := &s3_sdkv1.GetBucketTaggingInput{
+		Bucket: aws_sdkv1.String(identifier),
 	}
 
 	output, err := conn.GetBucketTaggingWithContext(ctx, input)
@@ -30,7 +35,7 @@ func BucketListTags(ctx context.Context, conn s3iface.S3API, identifier string)
 	// S3 API Reference (https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketTagging.html)
 	// lists the special error as NoSuchTagSetError, however the existing logic used NoSuchTagSet
 	// and the AWS Go SDK has neither as a constant.
-	if tfawserr.ErrCodeEquals(err, errCodeNoSuchTagSet, errCodeNoSuchTagSetError) {
+	if tfawserr_sdkv1.ErrCodeEquals(err, errCodeNoSuchTagSet, errCodeNoSuchTagSetError) {
 		return tftags.New(ctx, nil), nil
 	}
 
@@ -43,7 +48,7 @@ func BucketListTags(ctx context.Context, conn s3iface.S3API, identifier string)
 
 // BucketUpdateTags updates S3 bucket tags.
 // The identifier is the bucket name.
-func BucketUpdateTags(ctx context.Context, conn s3iface.S3API, identifier string, oldTagsMap, newTagsMap any) error {
+func BucketUpdateTags(ctx context.Context, conn s3iface_sdkv1.S3API, identifier string, oldTagsMap, newTagsMap any) error {
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
@@ -57,9 +62,9 @@ func BucketUpdateTags(ctx context.Context, conn s3iface.S3API, identifier string
 	ignoredTags := allTags.Ignore(oldTags).Ignore(newTags)
 
 	if len(newTags)+len(ignoredTags) > 0 {
-		input := &s3.PutBucketTaggingInput{
-			Bucket: aws.String(identifier),
-			Tagging: &s3.Tagging{
+		input := &s3_sdkv1.PutBucketTaggingInput{
+			Bucket: aws_sdkv1.String(identifier),
+			Tagging: &s3_sdkv1.Tagging{
 				TagSet: Tags(newTags.Merge(ignoredTags)),
 			},
 		}
@@ -70,8 +75,8 @@ func BucketUpdateTags(ctx context.Context, conn s3iface.S3API, identifier string
 			return fmt.Errorf("setting resource tags (%s): %w", identifier, err)
 		}
 	} else if len(oldTags) > 0 && len(ignoredTags) == 0 {
-		input := &s3.DeleteBucketTaggingInput{
-			Bucket: aws.String(identifier),
+		input := &s3_sdkv1.DeleteBucketTaggingInput{
+			Bucket: aws_sdkv1.String(identifier),
 		}
 
 		_, err := conn.DeleteBucketTaggingWithContext(ctx, input)
@@ -85,17 +90,15 @@ func BucketUpdateTags(ctx context.Context, conn s3iface.S3API, identifier string
 }
 
 // ObjectListTags lists S3 object tags.
-func ObjectListTags(ctx context.Context, conn s3iface.S3API, bucket, key string) (tftags.KeyValueTags, error) {
-	input := &s3.GetObjectTaggingInput{
-		Bucket: aws.String(bucket),
-		Key:    aws.String(key),
+func ObjectListTags(ctx context.Context, conn *s3_sdkv2.Client, bucket, key string) (tftags.KeyValueTags, error) {
+	input := &s3_sdkv2.GetObjectTaggingInput{
+		Bucket: aws_sdkv2.String(bucket),
+		Key:    aws_sdkv2.String(key),
 	}
 
-	outputRaw, err := tfresource.RetryWhenAWSErrCodeEquals(ctx, 1*time.Minute, func() (interface{}, error) {
-		return conn.GetObjectTaggingWithContext(ctx, input)
-	}, s3.ErrCodeNoSuchKey)
+	output, err := conn.GetObjectTagging(ctx, input)
 
-	if tfawserr.ErrCodeEquals(err, errCodeNoSuchTagSet, errCodeNoSuchTagSetError) {
+	if tfawserr_sdkv2.ErrCodeEquals(err, errCodeNoSuchTagSet, errCodeNoSuchTagSetError) {
 		return tftags.New(ctx, nil), nil
 	}
 
@@ -103,11 +106,11 @@ func ObjectListTags(ctx context.Context, conn s3iface.S3API, bucket, key string)
 		return tftags.New(ctx, nil), err
 	}
 
-	return KeyValueTags(ctx, outputRaw.(*s3.GetObjectTaggingOutput).TagSet), nil
+	return keyValueTagsV2(ctx, output.TagSet), nil
 }
 
 // ObjectUpdateTags updates S3 object tags.
-func ObjectUpdateTags(ctx context.Context, conn s3iface.S3API, bucket, key string, oldTagsMap, newTagsMap any) error {
+func ObjectUpdateTags(ctx context.Context, conn *s3_sdkv2.Client, bucket, key string, oldTagsMap, newTagsMap any) error {
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
@@ -121,26 +124,26 @@ func ObjectUpdateTags(ctx context.Context, conn s3iface.S3API, bucket, key strin
 	ignoredTags := allTags.Ignore(oldTags).Ignore(newTags)
 
 	if len(newTags)+len(ignoredTags) > 0 {
-		input := &s3.PutObjectTaggingInput{
-			Bucket: aws.String(bucket),
-			Key:    aws.String(key),
-			Tagging: &s3.Tagging{
-				TagSet: Tags(newTags.Merge(ignoredTags)),
+		input := &s3_sdkv2.PutObjectTaggingInput{
+			Bucket: aws_sdkv2.String(bucket),
+			Key:    aws_sdkv2.String(key),
+			Tagging: &s3types_sdkv2.Tagging{
+				TagSet: tagsV2(newTags.Merge(ignoredTags)),
 			},
 		}
 
-		_, err := conn.PutObjectTaggingWithContext(ctx, input)
+		_, err := conn.PutObjectTagging(ctx, input)
 
 		if err != nil {
 			return fmt.Errorf("setting resource tags (%s/%s): %w", bucket, key, err)
 		}
 	} else if len(oldTags) > 0 && len(ignoredTags) == 0 {
-		input := &s3.DeleteObjectTaggingInput{
-			Bucket: aws.String(bucket),
-			Key:    aws.String(key),
+		input := &s3_sdkv2.DeleteObjectTaggingInput{
+			Bucket: aws_sdkv2.String(bucket),
+			Key:    aws_sdkv2.String(key),
 		}
 
-		_, err := conn.DeleteObjectTaggingWithContext(ctx, input)
+		_, err := conn.DeleteObjectTagging(ctx, input)
 
 		if err != nil {
 			return fmt.Errorf("deleting resource tags (%s/%s): %w", bucket, key, err)
diff --git a/internal/service/s3/tagsv2_gen.go b/internal/service/s3/tagsv2_gen.go
new file mode 100644
index 00000000000..10215b864dd
--- /dev/null
+++ b/internal/service/s3/tagsv2_gen.go
@@ -0,0 +1,59 @@
+// Code generated by internal/generate/tags/main.go; DO NOT EDIT.
+package s3
+
+import (
+	"context"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	awstypes "github.com/aws/aws-sdk-go-v2/service/s3/types"
+	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
+	"github.com/hashicorp/terraform-provider-aws/internal/types"
+)
+
+// []*SERVICE.Tag handling
+
+// tagsV2 returns s3 service tags.
+func tagsV2(tags tftags.KeyValueTags) []awstypes.Tag {
+	result := make([]awstypes.Tag, 0, len(tags))
+
+	for k, v := range tags.Map() {
+		tag := awstypes.Tag{
+			Key:   aws.String(k),
+			Value: aws.String(v),
+		}
+
+		result = append(result, tag)
+	}
+
+	return result
+}
+
+// keyValueTagsV2 creates tftags.KeyValueTags from s3 service tags.
+func keyValueTagsV2(ctx context.Context, tags []awstypes.Tag) tftags.KeyValueTags {
+	m := make(map[string]*string, len(tags))
+
+	for _, tag := range tags {
+		m[aws.ToString(tag.Key)] = tag.Value
+	}
+
+	return tftags.New(ctx, m)
+}
+
+// getTagsInV2 returns s3 service tags from Context.
+// nil is returned if there are no input tags.
+func getTagsInV2(ctx context.Context) []awstypes.Tag {
+	if inContext, ok := tftags.FromContext(ctx); ok {
+		if tags := tagsV2(inContext.TagsIn.UnwrapOrDefault()); len(tags) > 0 {
+			return tags
+		}
+	}
+
+	return nil
+}
+
+// setTagsOutV2 sets s3 service tags in Context.
+func setTagsOutV2(ctx context.Context, tags []awstypes.Tag) {
+	if inContext, ok := tftags.FromContext(ctx); ok {
+		inContext.TagsOut = types.Some(keyValueTagsV2(ctx, tags))
+	}
+}
diff --git a/internal/service/s3/test-fixtures/populate_bucket.py b/internal/service/s3/test-fixtures/populate_bucket.py
index b642284f1d2..7dda3084bd7 100755
--- a/internal/service/s3/test-fixtures/populate_bucket.py
+++ b/internal/service/s3/test-fixtures/populate_bucket.py
@@ -1,4 +1,7 @@
 #!/usr/bin/env python3
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 
 import argparse
 import random
diff --git a/internal/service/s3/validate.go b/internal/service/s3/validate.go
index 0c5ce27b36a..f659d03f77d 100644
--- a/internal/service/s3/validate.go
+++ b/internal/service/s3/validate.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3
 
 import (
 	"fmt"
-	"regexp"
 	"strings"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws/endpoints"
 )
 
@@ -17,10 +20,10 @@ func ValidBucketName(value string, region string) error {
 		if (len(value) < 3) || (len(value) > 63) {
 			return fmt.Errorf("%q must contain from 3 to 63 characters", value)
 		}
-		if !regexp.MustCompile(`^[0-9a-z-.]+$`).MatchString(value) {
+		if !regexache.MustCompile(`^[0-9a-z-.]+$`).MatchString(value) {
 			return fmt.Errorf("only lowercase alphanumeric characters and hyphens allowed in %q", value)
 		}
-		if regexp.MustCompile(`^(?:[0-9]{1,3}\.){3}[0-9]{1,3}$`).MatchString(value) {
+		if regexache.MustCompile(`^(?:[0-9]{1,3}\.){3}[0-9]{1,3}$`).MatchString(value) {
 			return fmt.Errorf("%q must not be formatted as an IP address", value)
 		}
 		if strings.HasPrefix(value, `.`) {
@@ -36,7 +39,7 @@ func ValidBucketName(value string, region string) error {
 		if len(value) > 255 {
 			return fmt.Errorf("%q must contain less than 256 characters", value)
 		}
-		if !regexp.MustCompile(`^[0-9a-zA-Z-._]+$`).MatchString(value) {
+		if !regexache.MustCompile(`^[0-9A-Za-z_.-]+$`).MatchString(value) {
 			return fmt.Errorf("only alphanumeric characters, hyphens, periods, and underscores allowed in %q", value)
 		}
 	}
diff --git a/internal/service/s3/wait.go b/internal/service/s3/wait.go
index ba4a2ef351e..fa5525cb2e5 100644
--- a/internal/service/s3/wait.go
+++ b/internal/service/s3/wait.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3
 
 import (
@@ -6,15 +9,16 @@ import (
 
 	"github.com/aws/aws-sdk-go/service/s3"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
-	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
 const (
-	bucketVersioningStableTimeout                 = 1 * time.Minute
 	lifecycleConfigurationExtraRetryDelay         = 5 * time.Second
 	lifecycleConfigurationRulesPropagationTimeout = 3 * time.Minute
 	lifecycleConfigurationRulesSteadyTimeout      = 2 * time.Minute
-	propagationTimeout                            = 1 * time.Minute
+
+	// General timeout for S3 bucket changes to propagate.
+	// See https://docs.aws.amazon.com/AmazonS3/latest/userguide/Welcome.html#ConsistencyModel.
+	s3BucketPropagationTimeout = 2 * time.Minute // nosemgrep:ci.s3-in-const-name, ci.s3-in-var-name
 
 	// LifecycleConfigurationRulesStatusReady occurs when all configured rules reach their desired state (Enabled or Disabled)
 	LifecycleConfigurationRulesStatusReady = "READY"
@@ -22,10 +26,6 @@ const (
 	LifecycleConfigurationRulesStatusNotReady = "NOT_READY"
 )
 
-func retryWhenBucketNotFound(ctx context.Context, f func() (interface{}, error)) (interface{}, error) {
-	return tfresource.RetryWhenAWSErrCodeEquals(ctx, propagationTimeout, f, s3.ErrCodeNoSuchBucket)
-}
-
 func waitForLifecycleConfigurationRulesStatus(ctx context.Context, conn *s3.S3, bucket, expectedBucketOwner string, rules []*s3.LifecycleRule) error {
 	stateConf := &retry.StateChangeConf{
 		Pending:                   []string{"", LifecycleConfigurationRulesStatusNotReady},
@@ -41,23 +41,3 @@ func waitForLifecycleConfigurationRulesStatus(ctx context.Context, conn *s3.S3,
 
 	return err
 }
-
-func waitForBucketVersioningStatus(ctx context.Context, conn *s3.S3, bucket, expectedBucketOwner string) (*s3.GetBucketVersioningOutput, error) {
-	stateConf := &retry.StateChangeConf{
-		Pending:                   []string{""},
-		Target:                    []string{s3.BucketVersioningStatusEnabled, s3.BucketVersioningStatusSuspended, BucketVersioningStatusDisabled},
-		Refresh:                   bucketVersioningStatus(ctx, conn, bucket, expectedBucketOwner),
-		Timeout:                   bucketVersioningStableTimeout,
-		ContinuousTargetOccurence: 3,
-		NotFoundChecks:            3,
-		Delay:                     1 * time.Second,
-	}
-
-	outputRaw, err := stateConf.WaitForStateContext(ctx)
-
-	if output, ok := outputRaw.(*s3.GetBucketVersioningOutput); ok {
-		return output, err
-	}
-
-	return nil, err
-}
diff --git a/internal/service/s3control/access_point.go b/internal/service/s3control/access_point.go
index 997390fe3e0..cdcc1d94c14 100644
--- a/internal/service/s3control/access_point.go
+++ b/internal/service/s3control/access_point.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3control
 
 import (
@@ -6,10 +9,11 @@ import (
 	"log"
 	"strings"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/aws/arn"
-	"github.com/aws/aws-sdk-go/service/s3control"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/aws/arn"
+	"github.com/aws/aws-sdk-go-v2/service/s3control"
+	"github.com/aws/aws-sdk-go-v2/service/s3control/types"
+	"github.com/hashicorp/aws-sdk-go-base/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
@@ -153,14 +157,13 @@ func resourceAccessPoint() *schema.Resource {
 }
 
 func resourceAccessPointCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).S3ControlConn(ctx)
+	conn := meta.(*conns.AWSClient).S3ControlClient(ctx)
 
 	accountID := meta.(*conns.AWSClient).AccountID
 	if v, ok := d.GetOk("account_id"); ok {
 		accountID = v.(string)
 	}
 	name := d.Get("name").(string)
-
 	input := &s3control.CreateAccessPointInput{
 		AccountId: aws.String(accountID),
 		Bucket:    aws.String(d.Get("bucket").(string)),
@@ -179,20 +182,18 @@ func resourceAccessPointCreate(ctx context.Context, d *schema.ResourceData, meta
 		input.VpcConfiguration = expandVPCConfiguration(v.([]interface{})[0].(map[string]interface{}))
 	}
 
-	output, err := conn.CreateAccessPointWithContext(ctx, input)
+	output, err := conn.CreateAccessPoint(ctx, input)
 
 	if err != nil {
 		return diag.Errorf("creating S3 Access Point (%s): %s", name, err)
 	}
 
-	resourceID, err := AccessPointCreateResourceID(aws.StringValue(output.AccessPointArn))
-
+	resourceID, err := AccessPointCreateResourceID(aws.ToString(output.AccessPointArn))
 	if err != nil {
 		return diag.FromErr(err)
 	}
 
 	accountID, name, err = AccessPointParseResourceID(resourceID)
-
 	if err != nil {
 		return diag.FromErr(err)
 	}
@@ -202,7 +203,7 @@ func resourceAccessPointCreate(ctx context.Context, d *schema.ResourceData, meta
 	if v, ok := d.GetOk("policy"); ok && v.(string) != "" && v.(string) != "{}" {
 		policy, err := structure.NormalizeJsonString(v.(string))
 		if err != nil {
-			return diag.Errorf("policy (%s) is invalid JSON: %s", v.(string), err)
+			return diag.FromErr(err)
 		}
 
 		input := &s3control.PutAccessPointPolicyInput{
@@ -211,7 +212,7 @@ func resourceAccessPointCreate(ctx context.Context, d *schema.ResourceData, meta
 			Policy:    aws.String(policy),
 		}
 
-		_, err = conn.PutAccessPointPolicyWithContext(ctx, input)
+		_, err = conn.PutAccessPointPolicy(ctx, input)
 
 		if err != nil {
 			return diag.Errorf("creating S3 Access Point (%s) policy: %s", d.Id(), err)
@@ -222,17 +223,14 @@ func resourceAccessPointCreate(ctx context.Context, d *schema.ResourceData, meta
 }
 
 func resourceAccessPointRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).S3ControlConn(ctx)
+	conn := meta.(*conns.AWSClient).S3ControlClient(ctx)
 
 	accountID, name, err := AccessPointParseResourceID(d.Id())
-
 	if err != nil {
 		return diag.FromErr(err)
 	}
 
-	s3OnOutposts := arn.IsARN(name)
-
-	output, err := FindAccessPointByTwoPartKey(ctx, conn, accountID, name)
+	output, err := findAccessPointByTwoPartKey(ctx, conn, accountID, name)
 
 	if !d.IsNewResource() && tfresource.NotFound(err) {
 		log.Printf("[WARN] S3 Access Point (%s) not found, removing from state", d.Id())
@@ -244,9 +242,10 @@ func resourceAccessPointRead(ctx context.Context, d *schema.ResourceData, meta i
 		return diag.Errorf("reading S3 Access Point (%s): %s", d.Id(), err)
 	}
 
+	s3OnOutposts := arn.IsARN(name)
+
 	if s3OnOutposts {
 		accessPointARN, err := arn.Parse(name)
-
 		if err != nil {
 			return diag.FromErr(err)
 		}
@@ -259,8 +258,8 @@ func resourceAccessPointRead(ctx context.Context, d *schema.ResourceData, meta i
 			AccountID: accessPointARN.AccountID,
 			Resource: strings.Replace(
 				accessPointARN.Resource,
-				fmt.Sprintf("accesspoint/%s", aws.StringValue(output.Name)),
-				fmt.Sprintf("bucket/%s", aws.StringValue(output.Bucket)),
+				fmt.Sprintf("accesspoint/%s", aws.ToString(output.Name)),
+				fmt.Sprintf("bucket/%s", aws.ToString(output.Bucket)),
 				1,
 			),
 		}
@@ -274,7 +273,7 @@ func resourceAccessPointRead(ctx context.Context, d *schema.ResourceData, meta i
 			Service:   "s3",
 			Region:    meta.(*conns.AWSClient).Region,
 			AccountID: accountID,
-			Resource:  fmt.Sprintf("accesspoint/%s", aws.StringValue(output.Name)),
+			Resource:  fmt.Sprintf("accesspoint/%s", aws.ToString(output.Name)),
 		}
 
 		d.Set("arn", accessPointARN.String())
@@ -284,8 +283,8 @@ func resourceAccessPointRead(ctx context.Context, d *schema.ResourceData, meta i
 	d.Set("account_id", accountID)
 	d.Set("alias", output.Alias)
 	d.Set("bucket_account_id", output.BucketAccountId)
-	d.Set("domain_name", meta.(*conns.AWSClient).RegionalHostname(fmt.Sprintf("%s-%s.s3-accesspoint", aws.StringValue(output.Name), accountID)))
-	d.Set("endpoints", aws.StringValueMap(output.Endpoints))
+	d.Set("domain_name", meta.(*conns.AWSClient).RegionalHostname(fmt.Sprintf("%s-%s.s3-accesspoint", aws.ToString(output.Name), accountID)))
+	d.Set("endpoints", output.Endpoints)
 	d.Set("name", output.Name)
 	d.Set("network_origin", output.NetworkOrigin)
 	if output.PublicAccessBlockConfiguration != nil {
@@ -303,7 +302,7 @@ func resourceAccessPointRead(ctx context.Context, d *schema.ResourceData, meta i
 		d.Set("vpc_configuration", nil)
 	}
 
-	policy, status, err := FindAccessPointPolicyAndStatusByTwoPartKey(ctx, conn, accountID, name)
+	policy, status, err := findAccessPointPolicyAndStatusByTwoPartKey(ctx, conn, accountID, name)
 
 	if err == nil && policy != "" {
 		if s3OnOutposts {
@@ -329,10 +328,9 @@ func resourceAccessPointRead(ctx context.Context, d *schema.ResourceData, meta i
 }
 
 func resourceAccessPointUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).S3ControlConn(ctx)
+	conn := meta.(*conns.AWSClient).S3ControlClient(ctx)
 
 	accountID, name, err := AccessPointParseResourceID(d.Id())
-
 	if err != nil {
 		return diag.FromErr(err)
 	}
@@ -341,7 +339,7 @@ func resourceAccessPointUpdate(ctx context.Context, d *schema.ResourceData, meta
 		if v, ok := d.GetOk("policy"); ok && v.(string) != "" && v.(string) != "{}" {
 			policy, err := structure.NormalizeJsonString(v.(string))
 			if err != nil {
-				return diag.Errorf("policy (%s) is invalid JSON: %s", v.(string), err)
+				return diag.FromErr(err)
 			}
 
 			input := &s3control.PutAccessPointPolicyInput{
@@ -350,16 +348,18 @@ func resourceAccessPointUpdate(ctx context.Context, d *schema.ResourceData, meta
 				Policy:    aws.String(policy),
 			}
 
-			_, err = conn.PutAccessPointPolicyWithContext(ctx, input)
+			_, err = conn.PutAccessPointPolicy(ctx, input)
 
 			if err != nil {
 				return diag.Errorf("updating S3 Access Point (%s) policy: %s", d.Id(), err)
 			}
 		} else {
-			_, err := conn.DeleteAccessPointPolicyWithContext(ctx, &s3control.DeleteAccessPointPolicyInput{
+			input := &s3control.DeleteAccessPointPolicyInput{
 				AccountId: aws.String(accountID),
 				Name:      aws.String(name),
-			})
+			}
+
+			_, err := conn.DeleteAccessPointPolicy(ctx, input)
 
 			if err != nil {
 				return diag.Errorf("deleting S3 Access Point (%s) policy: %s", d.Id(), err)
@@ -371,16 +371,15 @@ func resourceAccessPointUpdate(ctx context.Context, d *schema.ResourceData, meta
 }
 
 func resourceAccessPointDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).S3ControlConn(ctx)
+	conn := meta.(*conns.AWSClient).S3ControlClient(ctx)
 
 	accountID, name, err := AccessPointParseResourceID(d.Id())
-
 	if err != nil {
 		return diag.FromErr(err)
 	}
 
 	log.Printf("[DEBUG] Deleting S3 Access Point: %s", d.Id())
-	_, err = conn.DeleteAccessPointWithContext(ctx, &s3control.DeleteAccessPointInput{
+	_, err = conn.DeleteAccessPoint(ctx, &s3control.DeleteAccessPointInput{
 		AccountId: aws.String(accountID),
 		Name:      aws.String(name),
 	})
@@ -396,13 +395,13 @@ func resourceAccessPointDelete(ctx context.Context, d *schema.ResourceData, meta
 	return nil
 }
 
-func FindAccessPointByTwoPartKey(ctx context.Context, conn *s3control.S3Control, accountID string, name string) (*s3control.GetAccessPointOutput, error) {
+func findAccessPointByTwoPartKey(ctx context.Context, conn *s3control.Client, accountID, name string) (*s3control.GetAccessPointOutput, error) {
 	input := &s3control.GetAccessPointInput{
 		AccountId: aws.String(accountID),
 		Name:      aws.String(name),
 	}
 
-	output, err := conn.GetAccessPointWithContext(ctx, input)
+	output, err := conn.GetAccessPoint(ctx, input)
 
 	if tfawserr.ErrCodeEquals(err, errCodeNoSuchAccessPoint) {
 		return nil, &retry.NotFoundError{
@@ -465,12 +464,12 @@ func AccessPointParseResourceID(id string) (string, string, error) {
 	return "", "", fmt.Errorf("unexpected format for ID (%[1]s), expected account-id%[2]saccess-point-name", id, accessPointResourceIDSeparator)
 }
 
-func expandVPCConfiguration(tfMap map[string]interface{}) *s3control.VpcConfiguration {
+func expandVPCConfiguration(tfMap map[string]interface{}) *types.VpcConfiguration {
 	if tfMap == nil {
 		return nil
 	}
 
-	apiObject := &s3control.VpcConfiguration{}
+	apiObject := &types.VpcConfiguration{}
 
 	if v, ok := tfMap["vpc_id"].(string); ok {
 		apiObject.VpcId = aws.String(v)
@@ -479,7 +478,7 @@ func expandVPCConfiguration(tfMap map[string]interface{}) *s3control.VpcConfigur
 	return apiObject
 }
 
-func flattenVPCConfiguration(apiObject *s3control.VpcConfiguration) map[string]interface{} {
+func flattenVPCConfiguration(apiObject *types.VpcConfiguration) map[string]interface{} {
 	if apiObject == nil {
 		return nil
 	}
@@ -487,7 +486,7 @@ func flattenVPCConfiguration(apiObject *s3control.VpcConfiguration) map[string]i
 	tfMap := map[string]interface{}{}
 
 	if v := apiObject.VpcId; v != nil {
-		tfMap["vpc_id"] = aws.StringValue(v)
+		tfMap["vpc_id"] = aws.ToString(v)
 	}
 
 	return tfMap
diff --git a/internal/service/s3control/access_point_policy.go b/internal/service/s3control/access_point_policy.go
index 31381cfd107..855466a40d0 100644
--- a/internal/service/s3control/access_point_policy.go
+++ b/internal/service/s3control/access_point_policy.go
@@ -1,12 +1,16 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3control
 
 import (
 	"context"
 	"log"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/s3control"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/s3control"
+	"github.com/aws/aws-sdk-go-v2/service/s3control/types"
+	"github.com/hashicorp/aws-sdk-go-base/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
@@ -56,23 +60,21 @@ func resourceAccessPointPolicy() *schema.Resource {
 }
 
 func resourceAccessPointPolicyCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).S3ControlConn(ctx)
+	conn := meta.(*conns.AWSClient).S3ControlClient(ctx)
 
 	resourceID, err := AccessPointCreateResourceID(d.Get("access_point_arn").(string))
-
 	if err != nil {
 		return diag.FromErr(err)
 	}
 
 	accountID, name, err := AccessPointParseResourceID(resourceID)
-
 	if err != nil {
 		return diag.FromErr(err)
 	}
 
 	policy, err := structure.NormalizeJsonString(d.Get("policy").(string))
 	if err != nil {
-		return diag.Errorf("policy (%s) is invalid JSON: %s", d.Get("policy").(string), err)
+		return diag.FromErr(err)
 	}
 
 	input := &s3control.PutAccessPointPolicyInput{
@@ -81,7 +83,7 @@ func resourceAccessPointPolicyCreate(ctx context.Context, d *schema.ResourceData
 		Policy:    aws.String(policy),
 	}
 
-	_, err = conn.PutAccessPointPolicyWithContext(ctx, input)
+	_, err = conn.PutAccessPointPolicy(ctx, input)
 
 	if err != nil {
 		return diag.Errorf("creating S3 Access Point (%s) Policy: %s", resourceID, err)
@@ -93,15 +95,14 @@ func resourceAccessPointPolicyCreate(ctx context.Context, d *schema.ResourceData
 }
 
 func resourceAccessPointPolicyRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).S3ControlConn(ctx)
+	conn := meta.(*conns.AWSClient).S3ControlClient(ctx)
 
 	accountID, name, err := AccessPointParseResourceID(d.Id())
-
 	if err != nil {
 		return diag.FromErr(err)
 	}
 
-	policy, status, err := FindAccessPointPolicyAndStatusByTwoPartKey(ctx, conn, accountID, name)
+	policy, status, err := findAccessPointPolicyAndStatusByTwoPartKey(ctx, conn, accountID, name)
 
 	if !d.IsNewResource() && tfresource.NotFound(err) {
 		log.Printf("[WARN] S3 Access Point Policy (%s) not found, removing from state", d.Id())
@@ -130,17 +131,16 @@ func resourceAccessPointPolicyRead(ctx context.Context, d *schema.ResourceData,
 }
 
 func resourceAccessPointPolicyUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).S3ControlConn(ctx)
+	conn := meta.(*conns.AWSClient).S3ControlClient(ctx)
 
 	accountID, name, err := AccessPointParseResourceID(d.Id())
-
 	if err != nil {
 		return diag.FromErr(err)
 	}
 
 	policy, err := structure.NormalizeJsonString(d.Get("policy").(string))
 	if err != nil {
-		return diag.Errorf("policy (%s) is invalid JSON: %s", d.Get("policy").(string), err)
+		return diag.FromErr(err)
 	}
 
 	input := &s3control.PutAccessPointPolicyInput{
@@ -149,7 +149,7 @@ func resourceAccessPointPolicyUpdate(ctx context.Context, d *schema.ResourceData
 		Policy:    aws.String(policy),
 	}
 
-	_, err = conn.PutAccessPointPolicyWithContext(ctx, input)
+	_, err = conn.PutAccessPointPolicy(ctx, input)
 
 	if err != nil {
 		return diag.Errorf("updating S3 Access Point Policy (%s): %s", d.Id(), err)
@@ -159,16 +159,15 @@ func resourceAccessPointPolicyUpdate(ctx context.Context, d *schema.ResourceData
 }
 
 func resourceAccessPointPolicyDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).S3ControlConn(ctx)
+	conn := meta.(*conns.AWSClient).S3ControlClient(ctx)
 
 	accountID, name, err := AccessPointParseResourceID(d.Id())
-
 	if err != nil {
 		return diag.FromErr(err)
 	}
 
 	log.Printf("[DEBUG] Deleting S3 Access Point Policy: %s", d.Id())
-	_, err = conn.DeleteAccessPointPolicyWithContext(ctx, &s3control.DeleteAccessPointPolicyInput{
+	_, err = conn.DeleteAccessPointPolicy(ctx, &s3control.DeleteAccessPointPolicyInput{
 		AccountId: aws.String(accountID),
 		Name:      aws.String(name),
 	})
@@ -197,18 +196,18 @@ func resourceAccessPointPolicyImport(ctx context.Context, d *schema.ResourceData
 	return []*schema.ResourceData{d}, nil
 }
 
-func FindAccessPointPolicyAndStatusByTwoPartKey(ctx context.Context, conn *s3control.S3Control, accountID string, name string) (string, *s3control.PolicyStatus, error) {
-	input1 := &s3control.GetAccessPointPolicyInput{
+func findAccessPointPolicyAndStatusByTwoPartKey(ctx context.Context, conn *s3control.Client, accountID, name string) (string, *types.PolicyStatus, error) {
+	inputGAPP := &s3control.GetAccessPointPolicyInput{
 		AccountId: aws.String(accountID),
 		Name:      aws.String(name),
 	}
 
-	output1, err := conn.GetAccessPointPolicyWithContext(ctx, input1)
+	outputGAPP, err := conn.GetAccessPointPolicy(ctx, inputGAPP)
 
 	if tfawserr.ErrCodeEquals(err, errCodeNoSuchAccessPoint, errCodeNoSuchAccessPointPolicy) {
 		return "", nil, &retry.NotFoundError{
 			LastError:   err,
-			LastRequest: input1,
+			LastRequest: inputGAPP,
 		}
 	}
 
@@ -216,27 +215,27 @@ func FindAccessPointPolicyAndStatusByTwoPartKey(ctx context.Context, conn *s3con
 		return "", nil, err
 	}
 
-	if output1 == nil {
-		return "", nil, tfresource.NewEmptyResultError(input1)
+	if outputGAPP == nil {
+		return "", nil, tfresource.NewEmptyResultError(inputGAPP)
 	}
 
-	policy := aws.StringValue(output1.Policy)
+	policy := aws.ToString(outputGAPP.Policy)
 
 	if policy == "" {
-		return "", nil, tfresource.NewEmptyResultError(input1)
+		return "", nil, tfresource.NewEmptyResultError(inputGAPP)
 	}
 
-	input2 := &s3control.GetAccessPointPolicyStatusInput{
+	inputGAPPS := &s3control.GetAccessPointPolicyStatusInput{
 		AccountId: aws.String(accountID),
 		Name:      aws.String(name),
 	}
 
-	output2, err := conn.GetAccessPointPolicyStatusWithContext(ctx, input2)
+	outputGAPPS, err := conn.GetAccessPointPolicyStatus(ctx, inputGAPPS)
 
 	if tfawserr.ErrCodeEquals(err, errCodeNoSuchAccessPoint, errCodeNoSuchAccessPointPolicy) {
 		return "", nil, &retry.NotFoundError{
 			LastError:   err,
-			LastRequest: input2,
+			LastRequest: inputGAPPS,
 		}
 	}
 
@@ -244,9 +243,9 @@ func FindAccessPointPolicyAndStatusByTwoPartKey(ctx context.Context, conn *s3con
 		return "", nil, err
 	}
 
-	if output2 == nil || output2.PolicyStatus == nil {
-		return "", nil, tfresource.NewEmptyResultError(input2)
+	if outputGAPPS == nil || outputGAPPS.PolicyStatus == nil {
+		return "", nil, tfresource.NewEmptyResultError(inputGAPPS)
 	}
 
-	return policy, output2.PolicyStatus, nil
+	return policy, outputGAPPS.PolicyStatus, nil
 }
diff --git a/internal/service/s3control/access_point_policy_test.go b/internal/service/s3control/access_point_policy_test.go
index 77bd8270857..6f912b144b6 100644
--- a/internal/service/s3control/access_point_policy_test.go
+++ b/internal/service/s3control/access_point_policy_test.go
@@ -1,12 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3control_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/service/s3control"
+	"github.com/YakDriver/regexache"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
@@ -14,6 +16,7 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	tfs3control "github.com/hashicorp/terraform-provider-aws/internal/service/s3control"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
 func TestAccS3ControlAccessPointPolicy_basic(t *testing.T) {
@@ -23,7 +26,7 @@ func TestAccS3ControlAccessPointPolicy_basic(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3control.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3ControlEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckAccessPointPolicyDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -31,8 +34,8 @@ func TestAccS3ControlAccessPointPolicy_basic(t *testing.T) {
 				Config: testAccAccessPointPolicyConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckAccessPointPolicyExists(ctx, resourceName),
-					resource.TestCheckResourceAttr(resourceName, "has_public_access_policy", "true"),
-					resource.TestMatchResourceAttr(resourceName, "policy", regexp.MustCompile(`s3:GetObjectTagging`)),
+					resource.TestCheckResourceAttr(resourceName, "has_public_access_policy", "false"),
+					resource.TestMatchResourceAttr(resourceName, "policy", regexache.MustCompile(`s3:GetObjectTagging`)),
 				),
 			},
 			{
@@ -52,7 +55,7 @@ func TestAccS3ControlAccessPointPolicy_disappears(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3control.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3ControlEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckAccessPointPolicyDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -76,7 +79,7 @@ func TestAccS3ControlAccessPointPolicy_disappears_AccessPoint(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3control.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3ControlEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckAccessPointPolicyDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -99,7 +102,7 @@ func TestAccS3ControlAccessPointPolicy_update(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3control.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3ControlEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckAccessPointPolicyDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -107,8 +110,8 @@ func TestAccS3ControlAccessPointPolicy_update(t *testing.T) {
 				Config: testAccAccessPointPolicyConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckAccessPointPolicyExists(ctx, resourceName),
-					resource.TestCheckResourceAttr(resourceName, "has_public_access_policy", "true"),
-					resource.TestMatchResourceAttr(resourceName, "policy", regexp.MustCompile(`s3:GetObjectTagging`)),
+					resource.TestCheckResourceAttr(resourceName, "has_public_access_policy", "false"),
+					resource.TestMatchResourceAttr(resourceName, "policy", regexache.MustCompile(`s3:GetObjectTagging`)),
 				),
 			},
 			{
@@ -121,8 +124,8 @@ func TestAccS3ControlAccessPointPolicy_update(t *testing.T) {
 				Config: testAccAccessPointPolicyConfig_updated(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckAccessPointPolicyExists(ctx, resourceName),
-					resource.TestCheckResourceAttr(resourceName, "has_public_access_policy", "true"),
-					resource.TestMatchResourceAttr(resourceName, "policy", regexp.MustCompile(`s3:GetObjectLegalHold`)),
+					resource.TestCheckResourceAttr(resourceName, "has_public_access_policy", "false"),
+					resource.TestMatchResourceAttr(resourceName, "policy", regexache.MustCompile(`s3:GetObjectLegalHold`)),
 				),
 			},
 		},
@@ -142,7 +145,7 @@ func testAccAccessPointPolicyImportStateIdFunc(n string) resource.ImportStateIdF
 
 func testAccCheckAccessPointPolicyDestroy(ctx context.Context) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		conn := acctest.Provider.Meta().(*conns.AWSClient).S3ControlConn(ctx)
+		conn := acctest.Provider.Meta().(*conns.AWSClient).S3ControlClient(ctx)
 
 		for _, rs := range s.RootModule().Resources {
 			if rs.Type != "aws_s3control_access_point_policy" {
@@ -150,7 +153,6 @@ func testAccCheckAccessPointPolicyDestroy(ctx context.Context) resource.TestChec
 			}
 
 			accountID, name, err := tfs3control.AccessPointParseResourceID(rs.Primary.ID)
-
 			if err != nil {
 				return err
 			}
@@ -179,17 +181,12 @@ func testAccCheckAccessPointPolicyExists(ctx context.Context, n string) resource
 			return fmt.Errorf("Not found: %s", n)
 		}
 
-		if rs.Primary.ID == "" {
-			return fmt.Errorf("No S3 Access Point Policy ID is set")
-		}
-
 		accountID, name, err := tfs3control.AccessPointParseResourceID(rs.Primary.ID)
-
 		if err != nil {
 			return err
 		}
 
-		conn := acctest.Provider.Meta().(*conns.AWSClient).S3ControlConn(ctx)
+		conn := acctest.Provider.Meta().(*conns.AWSClient).S3ControlClient(ctx)
 
 		_, _, err = tfs3control.FindAccessPointPolicyAndStatusByTwoPartKey(ctx, conn, accountID, name)
 
@@ -197,8 +194,11 @@ func testAccCheckAccessPointPolicyExists(ctx context.Context, n string) resource
 	}
 }
 
-func testAccAccessPointPolicyConfig_basic(rName string) string {
+func testAccAccessPointPolicyConfig_base(rName string) string {
 	return fmt.Sprintf(`
+data "aws_caller_identity" "current" {}
+data "aws_partition" "current" {}
+
 resource "aws_s3_bucket" "test" {
   bucket = %[1]q
 }
@@ -218,7 +218,11 @@ resource "aws_s3_access_point" "test" {
     ignore_changes = [policy]
   }
 }
+`, rName)
+}
 
+func testAccAccessPointPolicyConfig_basic(rName string) string {
+	return acctest.ConfigCompose(testAccAccessPointPolicyConfig_base(rName), `
 resource "aws_s3control_access_point_policy" "test" {
   access_point_arn = aws_s3_access_point.test.arn
 
@@ -228,37 +232,17 @@ resource "aws_s3control_access_point_policy" "test" {
       Effect = "Allow"
       Action = "s3:GetObjectTagging"
       Principal = {
-        AWS = "*"
+        AWS = "arn:${data.aws_partition.current.partition}:iam::${data.aws_caller_identity.current.account_id}:root"
       }
       Resource = "${aws_s3_access_point.test.arn}/object/*"
     }]
   })
 }
-`, rName)
+`)
 }
 
 func testAccAccessPointPolicyConfig_updated(rName string) string {
-	return fmt.Sprintf(`
-resource "aws_s3_bucket" "test" {
-  bucket = %[1]q
-}
-
-resource "aws_s3_access_point" "test" {
-  bucket = aws_s3_bucket.test.id
-  name   = %[1]q
-
-  public_access_block_configuration {
-    block_public_acls       = true
-    block_public_policy     = false
-    ignore_public_acls      = true
-    restrict_public_buckets = false
-  }
-
-  lifecycle {
-    ignore_changes = [policy]
-  }
-}
-
+	return acctest.ConfigCompose(testAccAccessPointPolicyConfig_base(rName), `
 resource "aws_s3control_access_point_policy" "test" {
   access_point_arn = aws_s3_access_point.test.arn
 
@@ -271,11 +255,11 @@ resource "aws_s3control_access_point_policy" "test" {
         "s3:GetObjectRetention",
       ]
       Principal = {
-        AWS = "*"
+        AWS = "arn:${data.aws_partition.current.partition}:iam::${data.aws_caller_identity.current.account_id}:root"
       }
       Resource = "${aws_s3_access_point.test.arn}/object/prefix/*"
     }]
   })
 }
-`, rName)
+`)
 }
diff --git a/internal/service/s3control/access_point_test.go b/internal/service/s3control/access_point_test.go
index 671fc66bb9d..3babc72773e 100644
--- a/internal/service/s3control/access_point_test.go
+++ b/internal/service/s3control/access_point_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3control_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/service/s3control"
+	"github.com/YakDriver/regexache"
+	"github.com/aws/aws-sdk-go-v2/service/s3control"
 	awspolicy "github.com/hashicorp/awspolicyequivalence"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -15,6 +18,7 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	tfs3control "github.com/hashicorp/terraform-provider-aws/internal/service/s3control"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
 func TestAccS3ControlAccessPoint_basic(t *testing.T) {
@@ -26,7 +30,7 @@ func TestAccS3ControlAccessPoint_basic(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3control.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3ControlEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckAccessPointDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -36,11 +40,11 @@ func TestAccS3ControlAccessPoint_basic(t *testing.T) {
 					testAccCheckAccessPointExists(ctx, resourceName, &v),
 					acctest.CheckResourceAttrAccountID(resourceName, "account_id"),
 					// https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-points-alias.html:
-					resource.TestMatchResourceAttr(resourceName, "alias", regexp.MustCompile(`^.*-s3alias$`)),
+					resource.TestMatchResourceAttr(resourceName, "alias", regexache.MustCompile(`^.*-s3alias$`)),
 					acctest.CheckResourceAttrRegionalARN(resourceName, "arn", "s3", fmt.Sprintf("accesspoint/%s", accessPointName)),
 					resource.TestCheckResourceAttr(resourceName, "bucket", bucketName),
 					acctest.CheckResourceAttrAccountID(resourceName, "bucket_account_id"),
-					acctest.MatchResourceAttrRegionalHostname(resourceName, "domain_name", "s3-accesspoint", regexp.MustCompile(fmt.Sprintf("^%s-\\d{12}", accessPointName))),
+					acctest.MatchResourceAttrRegionalHostname(resourceName, "domain_name", "s3-accesspoint", regexache.MustCompile(fmt.Sprintf("^%s-\\d{12}", accessPointName))),
 					resource.TestCheckResourceAttr(resourceName, "endpoints.%", "4"),
 					resource.TestCheckResourceAttr(resourceName, "has_public_access_policy", "false"),
 					resource.TestCheckResourceAttr(resourceName, "name", accessPointName),
@@ -72,7 +76,7 @@ func TestAccS3ControlAccessPoint_disappears(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3control.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3ControlEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckAccessPointDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -96,7 +100,7 @@ func TestAccS3ControlAccessPoint_Bucket_arn(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckOutpostsOutposts(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3control.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3ControlEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckAccessPointDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -107,7 +111,7 @@ func TestAccS3ControlAccessPoint_Bucket_arn(t *testing.T) {
 					acctest.CheckResourceAttrAccountID(resourceName, "account_id"),
 					acctest.CheckResourceAttrRegionalARN(resourceName, "arn", "s3-outposts", fmt.Sprintf("outpost/[^/]+/accesspoint/%s", rName)),
 					resource.TestCheckResourceAttrPair(resourceName, "bucket", "aws_s3control_bucket.test", "arn"),
-					acctest.MatchResourceAttrRegionalHostname(resourceName, "domain_name", "s3-accesspoint", regexp.MustCompile(fmt.Sprintf("^%s-\\d{12}", rName))),
+					acctest.MatchResourceAttrRegionalHostname(resourceName, "domain_name", "s3-accesspoint", regexache.MustCompile(fmt.Sprintf("^%s-\\d{12}", rName))),
 					resource.TestCheckResourceAttr(resourceName, "has_public_access_policy", "false"),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "network_origin", "Vpc"),
@@ -144,11 +148,11 @@ func TestAccS3ControlAccessPoint_policy(t *testing.T) {
       "Sid": "",
       "Effect": "Allow",
       "Principal": {
-        "AWS": "*"
+        "AWS": "arn:%[1]s:iam::%[3]s:root"
       },
       "Action": "s3:GetObjectTagging",
       "Resource": [
-        "arn:%s:s3:%s:%s:accesspoint/%s/object/*"
+        "arn:%[1]s:s3:%[2]s:%[3]s:accesspoint/%[4]s/object/*"
       ]
     }
   ]
@@ -162,14 +166,14 @@ func TestAccS3ControlAccessPoint_policy(t *testing.T) {
       "Sid": "",
       "Effect": "Allow",
       "Principal": {
-        "AWS": "*"
+        "AWS": "arn:%[1]s:iam::%[3]s:root"
       },
       "Action": [
         "s3:GetObjectLegalHold",
         "s3:GetObjectRetention"
       ],
       "Resource": [
-        "arn:%s:s3:%s:%s:accesspoint/%s/object/*"
+        "arn:%[1]s:s3:%[2]s:%[3]s:accesspoint/%[4]s/object/*"
       ]
     }
   ]
@@ -178,7 +182,7 @@ func TestAccS3ControlAccessPoint_policy(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3control.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3ControlEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckAccessPointDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -190,7 +194,7 @@ func TestAccS3ControlAccessPoint_policy(t *testing.T) {
 					acctest.CheckResourceAttrAccountID(resourceName, "account_id"),
 					acctest.CheckResourceAttrRegionalARN(resourceName, "arn", "s3", fmt.Sprintf("accesspoint/%s", rName)),
 					resource.TestCheckResourceAttr(resourceName, "bucket", rName),
-					resource.TestCheckResourceAttr(resourceName, "has_public_access_policy", "true"),
+					resource.TestCheckResourceAttr(resourceName, "has_public_access_policy", "false"),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "network_origin", "Internet"),
 					resource.TestCheckResourceAttr(resourceName, "public_access_block_configuration.#", "1"),
@@ -217,7 +221,6 @@ func TestAccS3ControlAccessPoint_policy(t *testing.T) {
 				Config: testAccAccessPointConfig_noPolicy(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckAccessPointExists(ctx, resourceName, &v),
-					resource.TestCheckResourceAttr(resourceName, "has_public_access_policy", "false"),
 					resource.TestCheckResourceAttr(resourceName, "policy", ""),
 				),
 			},
@@ -233,7 +236,7 @@ func TestAccS3ControlAccessPoint_publicAccessBlock(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3control.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3ControlEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckAccessPointDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -274,7 +277,7 @@ func TestAccS3ControlAccessPoint_vpc(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3control.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3ControlEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckAccessPointDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -309,7 +312,7 @@ func TestAccS3ControlAccessPoint_vpc(t *testing.T) {
 
 func testAccCheckAccessPointDestroy(ctx context.Context) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		conn := acctest.Provider.Meta().(*conns.AWSClient).S3ControlConn(ctx)
+		conn := acctest.Provider.Meta().(*conns.AWSClient).S3ControlClient(ctx)
 
 		for _, rs := range s.RootModule().Resources {
 			if rs.Type != "aws_s3_access_point" {
@@ -317,7 +320,6 @@ func testAccCheckAccessPointDestroy(ctx context.Context) resource.TestCheckFunc
 			}
 
 			accountID, name, err := tfs3control.AccessPointParseResourceID(rs.Primary.ID)
-
 			if err != nil {
 				return err
 			}
@@ -346,17 +348,12 @@ func testAccCheckAccessPointExists(ctx context.Context, n string, v *s3control.G
 			return fmt.Errorf("Not found: %s", n)
 		}
 
-		if rs.Primary.ID == "" {
-			return fmt.Errorf("No S3 Access Point ID is set")
-		}
-
 		accountID, name, err := tfs3control.AccessPointParseResourceID(rs.Primary.ID)
-
 		if err != nil {
 			return err
 		}
 
-		conn := acctest.Provider.Meta().(*conns.AWSClient).S3ControlConn(ctx)
+		conn := acctest.Provider.Meta().(*conns.AWSClient).S3ControlClient(ctx)
 
 		output, err := tfs3control.FindAccessPointByTwoPartKey(ctx, conn, accountID, name)
 
@@ -377,17 +374,12 @@ func testAccCheckAccessPointHasPolicy(ctx context.Context, n string, fn func() s
 			return fmt.Errorf("Not found: %s", n)
 		}
 
-		if rs.Primary.ID == "" {
-			return fmt.Errorf("No S3 Access Point ID is set")
-		}
-
 		accountID, name, err := tfs3control.AccessPointParseResourceID(rs.Primary.ID)
-
 		if err != nil {
 			return err
 		}
 
-		conn := acctest.Provider.Meta().(*conns.AWSClient).S3ControlConn(ctx)
+		conn := acctest.Provider.Meta().(*conns.AWSClient).S3ControlClient(ctx)
 
 		actualPolicyText, _, err := tfs3control.FindAccessPointPolicyAndStatusByTwoPartKey(ctx, conn, accountID, name)
 
@@ -492,7 +484,7 @@ data "aws_iam_policy_document" "test" {
 
     principals {
       type        = "AWS"
-      identifiers = ["*"]
+      identifiers = ["arn:${data.aws_partition.current.partition}:iam::${data.aws_caller_identity.current.account_id}:root"]
     }
   }
 }
@@ -537,7 +529,7 @@ data "aws_iam_policy_document" "test" {
 
     principals {
       type        = "AWS"
-      identifiers = ["*"]
+      identifiers = ["arn:${data.aws_partition.current.partition}:iam::${data.aws_caller_identity.current.account_id}:root"]
     }
   }
 }
diff --git a/internal/service/s3control/account_public_access_block.go b/internal/service/s3control/account_public_access_block.go
index efeed95a44d..444cf453d1e 100644
--- a/internal/service/s3control/account_public_access_block.go
+++ b/internal/service/s3control/account_public_access_block.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3control
 
 import (
@@ -88,7 +91,7 @@ func resourceAccountPublicAccessBlockCreate(ctx context.Context, d *schema.Resou
 	d.SetId(accountID)
 
 	_, err = tfresource.RetryWhenNotFound(ctx, propagationTimeout, func() (interface{}, error) {
-		return FindPublicAccessBlockByAccountID(ctx, conn, d.Id())
+		return findPublicAccessBlockByAccountID(ctx, conn, d.Id())
 	})
 
 	if err != nil {
@@ -101,7 +104,7 @@ func resourceAccountPublicAccessBlockCreate(ctx context.Context, d *schema.Resou
 func resourceAccountPublicAccessBlockRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	conn := meta.(*conns.AWSClient).S3ControlConn(ctx)
 
-	output, err := FindPublicAccessBlockByAccountID(ctx, conn, d.Id())
+	output, err := findPublicAccessBlockByAccountID(ctx, conn, d.Id())
 
 	if !d.IsNewResource() && tfresource.NotFound(err) {
 		log.Printf("[WARN] S3 Account Public Access Block (%s) not found, removing from state", d.Id())
@@ -168,7 +171,7 @@ func resourceAccountPublicAccessBlockDelete(ctx context.Context, d *schema.Resou
 	return nil
 }
 
-func FindPublicAccessBlockByAccountID(ctx context.Context, conn *s3control.S3Control, accountID string) (*s3control.PublicAccessBlockConfiguration, error) {
+func findPublicAccessBlockByAccountID(ctx context.Context, conn *s3control.S3Control, accountID string) (*s3control.PublicAccessBlockConfiguration, error) {
 	input := &s3control.GetPublicAccessBlockInput{
 		AccountId: aws.String(accountID),
 	}
@@ -195,7 +198,7 @@ func FindPublicAccessBlockByAccountID(ctx context.Context, conn *s3control.S3Con
 
 func statusPublicAccessBlockEqual(ctx context.Context, conn *s3control.S3Control, accountID string, target *s3control.PublicAccessBlockConfiguration) retry.StateRefreshFunc {
 	return func() (interface{}, string, error) {
-		output, err := FindPublicAccessBlockByAccountID(ctx, conn, accountID)
+		output, err := findPublicAccessBlockByAccountID(ctx, conn, accountID)
 
 		if tfresource.NotFound(err) {
 			return nil, "", nil
diff --git a/internal/service/s3control/account_public_access_block_data_source.go b/internal/service/s3control/account_public_access_block_data_source.go
index 072b212270f..693bacecb75 100644
--- a/internal/service/s3control/account_public_access_block_data_source.go
+++ b/internal/service/s3control/account_public_access_block_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3control
 
 import (
@@ -48,7 +51,7 @@ func dataSourceAccountPublicAccessBlockRead(ctx context.Context, d *schema.Resou
 		accountID = v.(string)
 	}
 
-	output, err := FindPublicAccessBlockByAccountID(ctx, conn, accountID)
+	output, err := findPublicAccessBlockByAccountID(ctx, conn, accountID)
 
 	if err != nil {
 		return diag.Errorf("reading S3 Account Public Access Block (%s): %s", accountID, err)
diff --git a/internal/service/s3control/account_public_access_block_data_source_test.go b/internal/service/s3control/account_public_access_block_data_source_test.go
index b80ee9598cf..72ce7a5639f 100644
--- a/internal/service/s3control/account_public_access_block_data_source_test.go
+++ b/internal/service/s3control/account_public_access_block_data_source_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3control_test
 
 import (
 	"testing"
 
-	"github.com/aws/aws-sdk-go/service/s3control"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
+	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
 func testAccAccountPublicAccessBlockDataSource_basic(t *testing.T) {
@@ -15,7 +18,7 @@ func testAccAccountPublicAccessBlockDataSource_basic(t *testing.T) {
 
 	resource.Test(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3control.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3ControlEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		Steps: []resource.TestStep{
 			{
diff --git a/internal/service/s3control/account_public_access_block_test.go b/internal/service/s3control/account_public_access_block_test.go
index f70327032dd..845d660020e 100644
--- a/internal/service/s3control/account_public_access_block_test.go
+++ b/internal/service/s3control/account_public_access_block_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3control_test
 
 import (
@@ -288,10 +291,6 @@ func testAccCheckAccountPublicAccessBlockExists(ctx context.Context, n string, v
 			return fmt.Errorf("Not found: %s", n)
 		}
 
-		if rs.Primary.ID == "" {
-			return fmt.Errorf("No S3 Account Public Access Block ID is set")
-		}
-
 		conn := acctest.Provider.Meta().(*conns.AWSClient).S3ControlConn(ctx)
 
 		output, err := tfs3control.FindPublicAccessBlockByAccountID(ctx, conn, rs.Primary.ID)
diff --git a/internal/service/s3control/bucket.go b/internal/service/s3control/bucket.go
index 8543a0cfb39..a4d4a5267b7 100644
--- a/internal/service/s3control/bucket.go
+++ b/internal/service/s3control/bucket.go
@@ -1,17 +1,21 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3control
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"strings"
 	"time"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/aws/arn"
-	"github.com/aws/aws-sdk-go/service/s3control"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/YakDriver/regexache"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/aws/arn"
+	"github.com/aws/aws-sdk-go-v2/service/s3control"
+	"github.com/aws/aws-sdk-go-v2/service/s3control/types"
+	"github.com/hashicorp/aws-sdk-go-base/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
@@ -52,9 +56,9 @@ func resourceBucket() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(3, 63),
-					validation.StringMatch(regexp.MustCompile(`^[a-z0-9.-]+$`), "must contain only lowercase letters, numbers, periods, and hyphens"),
-					validation.StringMatch(regexp.MustCompile(`^[a-z0-9]`), "must begin with lowercase letter or number"),
-					validation.StringMatch(regexp.MustCompile(`[a-z0-9]$`), "must end with lowercase letter or number"),
+					validation.StringMatch(regexache.MustCompile(`^[0-9a-z.-]+$`), "must contain only lowercase letters, numbers, periods, and hyphens"),
+					validation.StringMatch(regexache.MustCompile(`^[0-9a-z]`), "must begin with lowercase letter or number"),
+					validation.StringMatch(regexache.MustCompile(`[0-9a-z]$`), "must end with lowercase letter or number"),
 				),
 			},
 			"creation_date": {
@@ -80,7 +84,7 @@ func resourceBucket() *schema.Resource {
 }
 
 func resourceBucketCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).S3ControlConn(ctx)
+	conn := meta.(*conns.AWSClient).S3ControlClient(ctx)
 
 	bucket := d.Get("bucket").(string)
 	input := &s3control.CreateBucketInput{
@@ -88,13 +92,13 @@ func resourceBucketCreate(ctx context.Context, d *schema.ResourceData, meta inte
 		OutpostId: aws.String(d.Get("outpost_id").(string)),
 	}
 
-	output, err := conn.CreateBucketWithContext(ctx, input)
+	output, err := conn.CreateBucket(ctx, input)
 
 	if err != nil {
 		return diag.Errorf("creating S3 Control Bucket (%s): %s", bucket, err)
 	}
 
-	d.SetId(aws.StringValue(output.BucketArn))
+	d.SetId(aws.ToString(output.BucketArn))
 
 	if tags := KeyValueTags(ctx, getTagsIn(ctx)); len(tags) > 0 {
 		if err := bucketUpdateTags(ctx, conn, d.Id(), nil, tags); err != nil {
@@ -106,7 +110,7 @@ func resourceBucketCreate(ctx context.Context, d *schema.ResourceData, meta inte
 }
 
 func resourceBucketRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).S3ControlConn(ctx)
+	conn := meta.(*conns.AWSClient).S3ControlClient(ctx)
 
 	parsedArn, err := arn.Parse(d.Id())
 
@@ -121,7 +125,7 @@ func resourceBucketRead(ctx context.Context, d *schema.ResourceData, meta interf
 		return diag.Errorf("parsing S3 Control Bucket ARN (%s): unknown format", d.Id())
 	}
 
-	output, err := FindBucketByTwoPartKey(ctx, conn, parsedArn.AccountID, d.Id())
+	output, err := findBucketByTwoPartKey(ctx, conn, parsedArn.AccountID, d.Id())
 
 	if !d.IsNewResource() && tfresource.NotFound(err) {
 		log.Printf("[WARN] S3 Control Bucket (%s) not found, removing from state", d.Id())
@@ -136,7 +140,7 @@ func resourceBucketRead(ctx context.Context, d *schema.ResourceData, meta interf
 	d.Set("arn", d.Id())
 	d.Set("bucket", output.Bucket)
 	if output.CreationDate != nil {
-		d.Set("creation_date", aws.TimeValue(output.CreationDate).Format(time.RFC3339))
+		d.Set("creation_date", aws.ToTime(output.CreationDate).Format(time.RFC3339))
 	}
 	d.Set("outpost_id", arnResourceParts[1])
 	d.Set("public_access_block_enabled", output.PublicAccessBlockEnabled)
@@ -153,7 +157,7 @@ func resourceBucketRead(ctx context.Context, d *schema.ResourceData, meta interf
 }
 
 func resourceBucketUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).S3ControlConn(ctx)
+	conn := meta.(*conns.AWSClient).S3ControlClient(ctx)
 
 	if d.HasChange("tags_all") {
 		o, n := d.GetChange("tags_all")
@@ -167,7 +171,7 @@ func resourceBucketUpdate(ctx context.Context, d *schema.ResourceData, meta inte
 }
 
 func resourceBucketDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).S3ControlConn(ctx)
+	conn := meta.(*conns.AWSClient).S3ControlClient(ctx)
 
 	parsedArn, err := arn.Parse(d.Id())
 
@@ -185,7 +189,7 @@ func resourceBucketDelete(ctx context.Context, d *schema.ResourceData, meta inte
 	//   InvalidBucketState: Bucket is in an invalid state
 	log.Printf("[DEBUG] Deleting S3 Control Bucket: %s", d.Id())
 	_, err = tfresource.RetryWhenAWSErrCodeEquals(ctx, bucketStatePropagationTimeout, func() (interface{}, error) {
-		return conn.DeleteBucketWithContext(ctx, input)
+		return conn.DeleteBucket(ctx, input)
 	}, errCodeInvalidBucketState)
 
 	if tfawserr.ErrCodeEquals(err, errCodeNoSuchBucket, errCodeNoSuchOutpost) {
@@ -199,13 +203,13 @@ func resourceBucketDelete(ctx context.Context, d *schema.ResourceData, meta inte
 	return nil
 }
 
-func FindBucketByTwoPartKey(ctx context.Context, conn *s3control.S3Control, accountID, bucket string) (*s3control.GetBucketOutput, error) {
+func findBucketByTwoPartKey(ctx context.Context, conn *s3control.Client, accountID, bucket string) (*s3control.GetBucketOutput, error) {
 	input := &s3control.GetBucketInput{
 		AccountId: aws.String(accountID),
 		Bucket:    aws.String(bucket),
 	}
 
-	output, err := conn.GetBucketWithContext(ctx, input)
+	output, err := conn.GetBucket(ctx, input)
 
 	if tfawserr.ErrCodeEquals(err, errCodeNoSuchBucket, errCodeNoSuchOutpost) {
 		return nil, &retry.NotFoundError{
@@ -229,7 +233,7 @@ func FindBucketByTwoPartKey(ctx context.Context, conn *s3control.S3Control, acco
 
 // bucketListTags lists S3control bucket tags.
 // The identifier is the bucket ARN.
-func bucketListTags(ctx context.Context, conn *s3control.S3Control, identifier string) (tftags.KeyValueTags, error) {
+func bucketListTags(ctx context.Context, conn *s3control.Client, identifier string) (tftags.KeyValueTags, error) {
 	parsedArn, err := arn.Parse(identifier)
 
 	if err != nil {
@@ -241,7 +245,7 @@ func bucketListTags(ctx context.Context, conn *s3control.S3Control, identifier s
 		Bucket:    aws.String(identifier),
 	}
 
-	output, err := conn.GetBucketTaggingWithContext(ctx, input)
+	output, err := conn.GetBucketTagging(ctx, input)
 
 	if tfawserr.ErrCodeEquals(err, errCodeNoSuchTagSet) {
 		return tftags.New(ctx, nil), nil
@@ -256,7 +260,7 @@ func bucketListTags(ctx context.Context, conn *s3control.S3Control, identifier s
 
 // bucketUpdateTags updates S3control bucket tags.
 // The identifier is the bucket ARN.
-func bucketUpdateTags(ctx context.Context, conn *s3control.S3Control, identifier string, oldTagsMap, newTagsMap any) error {
+func bucketUpdateTags(ctx context.Context, conn *s3control.Client, identifier string, oldTagsMap, newTagsMap any) error {
 	parsedArn, err := arn.Parse(identifier)
 
 	if err != nil {
@@ -279,12 +283,12 @@ func bucketUpdateTags(ctx context.Context, conn *s3control.S3Control, identifier
 		input := &s3control.PutBucketTaggingInput{
 			AccountId: aws.String(parsedArn.AccountID),
 			Bucket:    aws.String(identifier),
-			Tagging: &s3control.Tagging{
+			Tagging: &types.Tagging{
 				TagSet: Tags(newTags.Merge(ignoredTags)),
 			},
 		}
 
-		_, err := conn.PutBucketTaggingWithContext(ctx, input)
+		_, err := conn.PutBucketTagging(ctx, input)
 
 		if err != nil {
 			return fmt.Errorf("setting resource tags (%s): %s", identifier, err)
@@ -295,7 +299,7 @@ func bucketUpdateTags(ctx context.Context, conn *s3control.S3Control, identifier
 			Bucket:    aws.String(identifier),
 		}
 
-		_, err := conn.DeleteBucketTaggingWithContext(ctx, input)
+		_, err := conn.DeleteBucketTagging(ctx, input)
 
 		if err != nil {
 			return fmt.Errorf("deleting resource tags (%s): %s", identifier, err)
diff --git a/internal/service/s3control/bucket_lifecycle_configuration.go b/internal/service/s3control/bucket_lifecycle_configuration.go
index 4d942f694dc..508ebddf3d4 100644
--- a/internal/service/s3control/bucket_lifecycle_configuration.go
+++ b/internal/service/s3control/bucket_lifecycle_configuration.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3control
 
 import (
@@ -6,10 +9,11 @@ import (
 	"log"
 	"time"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/aws/arn"
-	"github.com/aws/aws-sdk-go/service/s3control"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/aws/arn"
+	"github.com/aws/aws-sdk-go-v2/service/s3control"
+	"github.com/aws/aws-sdk-go-v2/service/s3control/types"
+	"github.com/hashicorp/aws-sdk-go-base/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
@@ -113,7 +117,7 @@ func resourceBucketLifecycleConfiguration() *schema.Resource {
 						"status": {
 							Type:     schema.TypeString,
 							Optional: true,
-							Default:  s3control.ExpirationStatusEnabled,
+							Default:  types.ExpirationStatusEnabled,
 						},
 					},
 				},
@@ -123,7 +127,7 @@ func resourceBucketLifecycleConfiguration() *schema.Resource {
 }
 
 func resourceBucketLifecycleConfigurationCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).S3ControlConn(ctx)
+	conn := meta.(*conns.AWSClient).S3ControlClient(ctx)
 
 	bucket := d.Get("bucket").(string)
 
@@ -140,12 +144,12 @@ func resourceBucketLifecycleConfigurationCreate(ctx context.Context, d *schema.R
 	input := &s3control.PutBucketLifecycleConfigurationInput{
 		AccountId: aws.String(parsedArn.AccountID),
 		Bucket:    aws.String(bucket),
-		LifecycleConfiguration: &s3control.LifecycleConfiguration{
+		LifecycleConfiguration: &types.LifecycleConfiguration{
 			Rules: expandLifecycleRules(ctx, d.Get("rule").(*schema.Set).List()),
 		},
 	}
 
-	_, err = conn.PutBucketLifecycleConfigurationWithContext(ctx, input)
+	_, err = conn.PutBucketLifecycleConfiguration(ctx, input)
 
 	if err != nil {
 		return diag.Errorf("creating S3 Control Bucket Lifecycle Configuration (%s): %s", bucket, err)
@@ -157,7 +161,7 @@ func resourceBucketLifecycleConfigurationCreate(ctx context.Context, d *schema.R
 }
 
 func resourceBucketLifecycleConfigurationRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).S3ControlConn(ctx)
+	conn := meta.(*conns.AWSClient).S3ControlClient(ctx)
 
 	parsedArn, err := arn.Parse(d.Id())
 
@@ -169,7 +173,7 @@ func resourceBucketLifecycleConfigurationRead(ctx context.Context, d *schema.Res
 		return diag.Errorf("parsing S3 Control Bucket ARN (%s): unknown format", d.Id())
 	}
 
-	output, err := FindBucketLifecycleConfigurationByTwoPartKey(ctx, conn, parsedArn.AccountID, d.Id())
+	output, err := findBucketLifecycleConfigurationByTwoPartKey(ctx, conn, parsedArn.AccountID, d.Id())
 
 	if !d.IsNewResource() && tfresource.NotFound(err) {
 		log.Printf("[WARN] S3 Control Bucket Lifecycle Configuration (%s) not found, removing from state", d.Id())
@@ -191,7 +195,7 @@ func resourceBucketLifecycleConfigurationRead(ctx context.Context, d *schema.Res
 }
 
 func resourceBucketLifecycleConfigurationUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).S3ControlConn(ctx)
+	conn := meta.(*conns.AWSClient).S3ControlClient(ctx)
 
 	parsedArn, err := arn.Parse(d.Id())
 
@@ -206,12 +210,12 @@ func resourceBucketLifecycleConfigurationUpdate(ctx context.Context, d *schema.R
 	input := &s3control.PutBucketLifecycleConfigurationInput{
 		AccountId: aws.String(parsedArn.AccountID),
 		Bucket:    aws.String(d.Id()),
-		LifecycleConfiguration: &s3control.LifecycleConfiguration{
+		LifecycleConfiguration: &types.LifecycleConfiguration{
 			Rules: expandLifecycleRules(ctx, d.Get("rule").(*schema.Set).List()),
 		},
 	}
 
-	_, err = conn.PutBucketLifecycleConfigurationWithContext(ctx, input)
+	_, err = conn.PutBucketLifecycleConfiguration(ctx, input)
 
 	if err != nil {
 		return diag.Errorf("updating S3 Control Bucket Lifecycle Configuration (%s): %s", d.Id(), err)
@@ -221,7 +225,7 @@ func resourceBucketLifecycleConfigurationUpdate(ctx context.Context, d *schema.R
 }
 
 func resourceBucketLifecycleConfigurationDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).S3ControlConn(ctx)
+	conn := meta.(*conns.AWSClient).S3ControlClient(ctx)
 
 	parsedArn, err := arn.Parse(d.Id())
 
@@ -234,7 +238,7 @@ func resourceBucketLifecycleConfigurationDelete(ctx context.Context, d *schema.R
 	}
 
 	log.Printf("[DEBUG] Deleting S3 Control Bucket Lifecycle Configuration: %s", d.Id())
-	_, err = conn.DeleteBucketLifecycleConfigurationWithContext(ctx, &s3control.DeleteBucketLifecycleConfigurationInput{
+	_, err = conn.DeleteBucketLifecycleConfiguration(ctx, &s3control.DeleteBucketLifecycleConfigurationInput{
 		AccountId: aws.String(parsedArn.AccountID),
 		Bucket:    aws.String(d.Id()),
 	})
@@ -250,13 +254,13 @@ func resourceBucketLifecycleConfigurationDelete(ctx context.Context, d *schema.R
 	return nil
 }
 
-func FindBucketLifecycleConfigurationByTwoPartKey(ctx context.Context, conn *s3control.S3Control, accountID, bucket string) (*s3control.GetBucketLifecycleConfigurationOutput, error) {
+func findBucketLifecycleConfigurationByTwoPartKey(ctx context.Context, conn *s3control.Client, accountID, bucket string) (*s3control.GetBucketLifecycleConfigurationOutput, error) {
 	input := &s3control.GetBucketLifecycleConfigurationInput{
 		AccountId: aws.String(accountID),
 		Bucket:    aws.String(bucket),
 	}
 
-	output, err := conn.GetBucketLifecycleConfigurationWithContext(ctx, input)
+	output, err := conn.GetBucketLifecycleConfiguration(ctx, input)
 
 	if tfawserr.ErrCodeEquals(err, errCodeNoSuchBucket, errCodeNoSuchLifecycleConfiguration, errCodeNoSuchOutpost) {
 		return nil, &retry.NotFoundError{
@@ -276,7 +280,7 @@ func FindBucketLifecycleConfigurationByTwoPartKey(ctx context.Context, conn *s3c
 	return output, nil
 }
 
-func expandAbortIncompleteMultipartUpload(tfList []interface{}) *s3control.AbortIncompleteMultipartUpload {
+func expandAbortIncompleteMultipartUpload(tfList []interface{}) *types.AbortIncompleteMultipartUpload {
 	if len(tfList) == 0 || tfList[0] == nil {
 		return nil
 	}
@@ -287,16 +291,16 @@ func expandAbortIncompleteMultipartUpload(tfList []interface{}) *s3control.Abort
 		return nil
 	}
 
-	apiObject := &s3control.AbortIncompleteMultipartUpload{}
+	apiObject := &types.AbortIncompleteMultipartUpload{}
 
 	if v, ok := tfMap["days_after_initiation"].(int); ok && v != 0 {
-		apiObject.DaysAfterInitiation = aws.Int64(int64(v))
+		apiObject.DaysAfterInitiation = int32(v)
 	}
 
 	return apiObject
 }
 
-func expandLifecycleExpiration(tfList []interface{}) *s3control.LifecycleExpiration {
+func expandLifecycleExpiration(tfList []interface{}) *types.LifecycleExpiration {
 	if len(tfList) == 0 || tfList[0] == nil {
 		return nil
 	}
@@ -307,7 +311,7 @@ func expandLifecycleExpiration(tfList []interface{}) *s3control.LifecycleExpirat
 		return nil
 	}
 
-	apiObject := &s3control.LifecycleExpiration{}
+	apiObject := &types.LifecycleExpiration{}
 
 	if v, ok := tfMap["date"].(string); ok && v != "" {
 		parsedDate, err := time.Parse("2006-01-02", v)
@@ -318,18 +322,18 @@ func expandLifecycleExpiration(tfList []interface{}) *s3control.LifecycleExpirat
 	}
 
 	if v, ok := tfMap["days"].(int); ok && v != 0 {
-		apiObject.Days = aws.Int64(int64(v))
+		apiObject.Days = int32(v)
 	}
 
 	if v, ok := tfMap["expired_object_delete_marker"].(bool); ok && v {
-		apiObject.ExpiredObjectDeleteMarker = aws.Bool(v)
+		apiObject.ExpiredObjectDeleteMarker = v
 	}
 
 	return apiObject
 }
 
-func expandLifecycleRules(ctx context.Context, tfList []interface{}) []*s3control.LifecycleRule {
-	var apiObjects []*s3control.LifecycleRule
+func expandLifecycleRules(ctx context.Context, tfList []interface{}) []types.LifecycleRule {
+	var apiObjects []types.LifecycleRule
 
 	for _, tfMapRaw := range tfList {
 		tfMap, ok := tfMapRaw.(map[string]interface{})
@@ -344,18 +348,18 @@ func expandLifecycleRules(ctx context.Context, tfList []interface{}) []*s3contro
 			continue
 		}
 
-		apiObjects = append(apiObjects, apiObject)
+		apiObjects = append(apiObjects, *apiObject)
 	}
 
 	return apiObjects
 }
 
-func expandLifecycleRule(ctx context.Context, tfMap map[string]interface{}) *s3control.LifecycleRule {
+func expandLifecycleRule(ctx context.Context, tfMap map[string]interface{}) *types.LifecycleRule {
 	if len(tfMap) == 0 {
 		return nil
 	}
 
-	apiObject := &s3control.LifecycleRule{}
+	apiObject := &types.LifecycleRule{}
 
 	if v, ok := tfMap["abort_incomplete_multipart_upload"].([]interface{}); ok && len(v) > 0 {
 		apiObject.AbortIncompleteMultipartUpload = expandAbortIncompleteMultipartUpload(v)
@@ -374,21 +378,21 @@ func expandLifecycleRule(ctx context.Context, tfMap map[string]interface{}) *s3c
 	}
 
 	if v, ok := tfMap["status"].(string); ok && v != "" {
-		apiObject.Status = aws.String(v)
+		apiObject.Status = types.ExpirationStatus(v)
 	}
 
 	// Terraform Plugin SDK sometimes sends map with only empty configuration blocks:
 	//   map[abort_incomplete_multipart_upload:[] expiration:[] filter:[] id: status:]
 	// This is to prevent this error: InvalidParameter: 1 validation error(s) found.
 	//  - missing required field, PutBucketLifecycleConfigurationInput.LifecycleConfiguration.Rules[0].Status.
-	if apiObject.ID == nil && apiObject.Status == nil {
+	if apiObject.ID == nil && apiObject.Status == "" {
 		return nil
 	}
 
 	return apiObject
 }
 
-func expandLifecycleRuleFilter(ctx context.Context, tfList []interface{}) *s3control.LifecycleRuleFilter {
+func expandLifecycleRuleFilter(ctx context.Context, tfList []interface{}) *types.LifecycleRuleFilter {
 	if len(tfList) == 0 || tfList[0] == nil {
 		return nil
 	}
@@ -399,7 +403,7 @@ func expandLifecycleRuleFilter(ctx context.Context, tfList []interface{}) *s3con
 		return nil
 	}
 
-	apiObject := &s3control.LifecycleRuleFilter{}
+	apiObject := &types.LifecycleRuleFilter{}
 
 	if v, ok := tfMap["prefix"].(string); ok && v != "" {
 		apiObject.Prefix = aws.String(v)
@@ -408,9 +412,9 @@ func expandLifecycleRuleFilter(ctx context.Context, tfList []interface{}) *s3con
 	if v, ok := tfMap["tags"].(map[string]interface{}); ok && len(v) > 0 {
 		// See also aws_s3_bucket ReplicationRule.Filter handling
 		if len(v) == 1 {
-			apiObject.Tag = Tags(tftags.New(ctx, v))[0]
+			apiObject.Tag = &Tags(tftags.New(ctx, v))[0]
 		} else {
-			apiObject.And = &s3control.LifecycleRuleAndOperator{
+			apiObject.And = &types.LifecycleRuleAndOperator{
 				Prefix: apiObject.Prefix,
 				Tags:   Tags(tftags.New(ctx, v)),
 			}
@@ -421,63 +425,50 @@ func expandLifecycleRuleFilter(ctx context.Context, tfList []interface{}) *s3con
 	return apiObject
 }
 
-func flattenAbortIncompleteMultipartUpload(apiObject *s3control.AbortIncompleteMultipartUpload) []interface{} {
+func flattenAbortIncompleteMultipartUpload(apiObject *types.AbortIncompleteMultipartUpload) []interface{} {
 	if apiObject == nil {
 		return nil
 	}
 
-	tfMap := map[string]interface{}{}
-
-	if v := apiObject.DaysAfterInitiation; v != nil {
-		tfMap["days_after_initiation"] = aws.Int64Value(v)
+	tfMap := map[string]interface{}{
+		"days_after_initiation": apiObject.DaysAfterInitiation,
 	}
 
 	return []interface{}{tfMap}
 }
 
-func flattenLifecycleExpiration(apiObject *s3control.LifecycleExpiration) []interface{} {
+func flattenLifecycleExpiration(apiObject *types.LifecycleExpiration) []interface{} {
 	if apiObject == nil {
 		return nil
 	}
 
-	tfMap := map[string]interface{}{}
-
-	if v := apiObject.Date; v != nil {
-		tfMap["date"] = aws.TimeValue(v).Format("2006-01-02")
-	}
-
-	if v := apiObject.Days; v != nil {
-		tfMap["days"] = aws.Int64Value(v)
+	tfMap := map[string]interface{}{
+		"days":                         apiObject.Days,
+		"expired_object_delete_marker": apiObject.ExpiredObjectDeleteMarker,
 	}
 
-	if v := apiObject.ExpiredObjectDeleteMarker; v != nil {
-		tfMap["expired_object_delete_marker"] = aws.BoolValue(v)
+	if v := apiObject.Date; v != nil {
+		tfMap["date"] = aws.ToTime(v).Format("2006-01-02")
 	}
 
 	return []interface{}{tfMap}
 }
 
-func flattenLifecycleRules(ctx context.Context, apiObjects []*s3control.LifecycleRule) []interface{} {
+func flattenLifecycleRules(ctx context.Context, apiObjects []types.LifecycleRule) []interface{} {
 	var tfMaps []interface{}
 
 	for _, apiObject := range apiObjects {
-		if apiObject == nil {
-			continue
-		}
-
 		tfMaps = append(tfMaps, flattenLifecycleRule(ctx, apiObject))
 	}
 
 	return tfMaps
 }
 
-func flattenLifecycleRule(ctx context.Context, apiObject *s3control.LifecycleRule) map[string]interface{} {
-	if apiObject == nil {
-		return nil
+func flattenLifecycleRule(ctx context.Context, apiObject types.LifecycleRule) map[string]interface{} {
+	tfMap := map[string]interface{}{
+		"status": apiObject.Status,
 	}
 
-	tfMap := map[string]interface{}{}
-
 	if v := apiObject.AbortIncompleteMultipartUpload; v != nil {
 		tfMap["abort_incomplete_multipart_upload"] = flattenAbortIncompleteMultipartUpload(v)
 	}
@@ -491,17 +482,13 @@ func flattenLifecycleRule(ctx context.Context, apiObject *s3control.LifecycleRul
 	}
 
 	if v := apiObject.ID; v != nil {
-		tfMap["id"] = aws.StringValue(v)
-	}
-
-	if v := apiObject.Status; v != nil {
-		tfMap["status"] = aws.StringValue(v)
+		tfMap["id"] = aws.ToString(v)
 	}
 
 	return tfMap
 }
 
-func flattenLifecycleRuleFilter(ctx context.Context, apiObject *s3control.LifecycleRuleFilter) []interface{} {
+func flattenLifecycleRuleFilter(ctx context.Context, apiObject *types.LifecycleRuleFilter) []interface{} {
 	if apiObject == nil {
 		return nil
 	}
@@ -510,7 +497,7 @@ func flattenLifecycleRuleFilter(ctx context.Context, apiObject *s3control.Lifecy
 
 	if apiObject.And != nil {
 		if v := apiObject.And.Prefix; v != nil {
-			tfMap["prefix"] = aws.StringValue(v)
+			tfMap["prefix"] = aws.ToString(v)
 		}
 
 		if v := apiObject.And.Tags; v != nil {
@@ -518,11 +505,11 @@ func flattenLifecycleRuleFilter(ctx context.Context, apiObject *s3control.Lifecy
 		}
 	} else {
 		if v := apiObject.Prefix; v != nil {
-			tfMap["prefix"] = aws.StringValue(v)
+			tfMap["prefix"] = aws.ToString(v)
 		}
 
 		if v := apiObject.Tag; v != nil {
-			tfMap["tags"] = KeyValueTags(ctx, []*s3control.S3Tag{v}).IgnoreAWS().Map()
+			tfMap["tags"] = KeyValueTags(ctx, []types.S3Tag{*v}).IgnoreAWS().Map()
 		}
 	}
 
diff --git a/internal/service/s3control/bucket_lifecycle_configuration_test.go b/internal/service/s3control/bucket_lifecycle_configuration_test.go
index 3530ae10e87..41b6ff1291c 100644
--- a/internal/service/s3control/bucket_lifecycle_configuration_test.go
+++ b/internal/service/s3control/bucket_lifecycle_configuration_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3control_test
 
 import (
@@ -6,8 +9,8 @@ import (
 	"testing"
 	"time"
 
-	"github.com/aws/aws-sdk-go/aws/arn"
-	"github.com/aws/aws-sdk-go/service/s3control"
+	"github.com/aws/aws-sdk-go-v2/aws/arn"
+	"github.com/aws/aws-sdk-go-v2/service/s3control/types"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
@@ -15,6 +18,7 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	tfs3control "github.com/hashicorp/terraform-provider-aws/internal/service/s3control"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
 func TestAccS3ControlBucketLifecycleConfiguration_basic(t *testing.T) {
@@ -24,7 +28,7 @@ func TestAccS3ControlBucketLifecycleConfiguration_basic(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckOutpostsOutposts(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3control.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3ControlEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketLifecycleConfigurationDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -38,7 +42,7 @@ func TestAccS3ControlBucketLifecycleConfiguration_basic(t *testing.T) {
 						"expiration.#":      "1",
 						"expiration.0.days": "365",
 						"id":                "test",
-						"status":            s3control.ExpirationStatusEnabled,
+						"status":            string(types.ExpirationStatusEnabled),
 					}),
 				),
 			},
@@ -58,7 +62,7 @@ func TestAccS3ControlBucketLifecycleConfiguration_disappears(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckOutpostsOutposts(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3control.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3ControlEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketLifecycleConfigurationDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -81,7 +85,7 @@ func TestAccS3ControlBucketLifecycleConfiguration_RuleAbortIncompleteMultipartUp
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckOutpostsOutposts(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3control.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3ControlEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketLifecycleConfigurationDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -125,7 +129,7 @@ func TestAccS3ControlBucketLifecycleConfiguration_RuleExpiration_date(t *testing
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckOutpostsOutposts(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3control.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3ControlEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketLifecycleConfigurationDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -167,7 +171,7 @@ func TestAccS3ControlBucketLifecycleConfiguration_RuleExpiration_days(t *testing
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckOutpostsOutposts(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3control.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3ControlEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketLifecycleConfigurationDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -210,7 +214,7 @@ func TestAccS3ControlBucketLifecycleConfiguration_RuleExpiration_expiredObjectDe
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckOutpostsOutposts(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3control.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3ControlEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketLifecycleConfigurationDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -252,7 +256,7 @@ func TestAccS3ControlBucketLifecycleConfiguration_RuleFilter_prefix(t *testing.T
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckOutpostsOutposts(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3control.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3ControlEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketLifecycleConfigurationDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -294,7 +298,7 @@ func TestAccS3ControlBucketLifecycleConfiguration_RuleFilter_tags(t *testing.T)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckOutpostsOutposts(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3control.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3ControlEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketLifecycleConfigurationDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -354,7 +358,7 @@ func TestAccS3ControlBucketLifecycleConfiguration_Rule_id(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckOutpostsOutposts(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3control.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3ControlEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketLifecycleConfigurationDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -394,17 +398,17 @@ func TestAccS3ControlBucketLifecycleConfiguration_Rule_status(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckOutpostsOutposts(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3control.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3ControlEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketLifecycleConfigurationDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccBucketLifecycleConfigurationConfig_ruleStatus(rName, s3control.ExpirationStatusDisabled),
+				Config: testAccBucketLifecycleConfigurationConfig_ruleStatus(rName, string(types.ExpirationStatusDisabled)),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketLifecycleConfigurationExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
-						"status": s3control.ExpirationStatusDisabled,
+						"status": string(types.ExpirationStatusDisabled),
 					}),
 				),
 			},
@@ -414,12 +418,12 @@ func TestAccS3ControlBucketLifecycleConfiguration_Rule_status(t *testing.T) {
 				ImportStateVerify: true,
 			},
 			{
-				Config: testAccBucketLifecycleConfigurationConfig_ruleStatus(rName, s3control.ExpirationStatusEnabled),
+				Config: testAccBucketLifecycleConfigurationConfig_ruleStatus(rName, string(types.ExpirationStatusEnabled)),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketLifecycleConfigurationExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
-						"status": s3control.ExpirationStatusEnabled,
+						"status": string(types.ExpirationStatusEnabled),
 					}),
 				),
 			},
@@ -429,7 +433,7 @@ func TestAccS3ControlBucketLifecycleConfiguration_Rule_status(t *testing.T) {
 
 func testAccCheckBucketLifecycleConfigurationDestroy(ctx context.Context) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		conn := acctest.Provider.Meta().(*conns.AWSClient).S3ControlConn(ctx)
+		conn := acctest.Provider.Meta().(*conns.AWSClient).S3ControlClient(ctx)
 
 		for _, rs := range s.RootModule().Resources {
 			if rs.Type != "aws_s3control_bucket_lifecycle_configuration" {
@@ -437,7 +441,6 @@ func testAccCheckBucketLifecycleConfigurationDestroy(ctx context.Context) resour
 			}
 
 			parsedArn, err := arn.Parse(rs.Primary.ID)
-
 			if err != nil {
 				return err
 			}
@@ -466,14 +469,9 @@ func testAccCheckBucketLifecycleConfigurationExists(ctx context.Context, n strin
 			return fmt.Errorf("Not found: %s", n)
 		}
 
-		if rs.Primary.ID == "" {
-			return fmt.Errorf("No S3 Control Bucket Lifecycle Configuration ID is set")
-		}
-
-		conn := acctest.Provider.Meta().(*conns.AWSClient).S3ControlConn(ctx)
+		conn := acctest.Provider.Meta().(*conns.AWSClient).S3ControlClient(ctx)
 
 		parsedArn, err := arn.Parse(rs.Primary.ID)
-
 		if err != nil {
 			return err
 		}
diff --git a/internal/service/s3control/bucket_policy.go b/internal/service/s3control/bucket_policy.go
index 408bd0e69d1..5b267367292 100644
--- a/internal/service/s3control/bucket_policy.go
+++ b/internal/service/s3control/bucket_policy.go
@@ -1,13 +1,16 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3control
 
 import (
 	"context"
 	"log"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/aws/arn"
-	"github.com/aws/aws-sdk-go/service/s3control"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/aws/arn"
+	"github.com/aws/aws-sdk-go-v2/service/s3control"
+	"github.com/hashicorp/aws-sdk-go-base/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
@@ -53,13 +56,13 @@ func resourceBucketPolicy() *schema.Resource {
 }
 
 func resourceBucketPolicyCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).S3ControlConn(ctx)
+	conn := meta.(*conns.AWSClient).S3ControlClient(ctx)
 
 	bucket := d.Get("bucket").(string)
 
 	policy, err := structure.NormalizeJsonString(d.Get("policy").(string))
 	if err != nil {
-		return diag.Errorf("policy (%s) is invalid JSON: %s", d.Get("policy").(string), err)
+		return diag.FromErr(err)
 	}
 
 	input := &s3control.PutBucketPolicyInput{
@@ -67,7 +70,7 @@ func resourceBucketPolicyCreate(ctx context.Context, d *schema.ResourceData, met
 		Policy: aws.String(policy),
 	}
 
-	_, err = conn.PutBucketPolicyWithContext(ctx, input)
+	_, err = conn.PutBucketPolicy(ctx, input)
 
 	if err != nil {
 		return diag.Errorf("creating S3 Control Bucket Policy (%s): %s", bucket, err)
@@ -79,10 +82,9 @@ func resourceBucketPolicyCreate(ctx context.Context, d *schema.ResourceData, met
 }
 
 func resourceBucketPolicyRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).S3ControlConn(ctx)
+	conn := meta.(*conns.AWSClient).S3ControlClient(ctx)
 
 	parsedArn, err := arn.Parse(d.Id())
-
 	if err != nil {
 		return diag.FromErr(err)
 	}
@@ -91,7 +93,7 @@ func resourceBucketPolicyRead(ctx context.Context, d *schema.ResourceData, meta
 		return diag.Errorf("parsing S3 Control Bucket ARN (%s): unknown format", d.Id())
 	}
 
-	output, err := FindBucketPolicyByTwoPartKey(ctx, conn, parsedArn.AccountID, d.Id())
+	output, err := findBucketPolicyByTwoPartKey(ctx, conn, parsedArn.AccountID, d.Id())
 
 	if !d.IsNewResource() && tfresource.NotFound(err) {
 		log.Printf("[WARN] S3 Control Bucket Policy (%s) not found, removing from state", d.Id())
@@ -106,7 +108,7 @@ func resourceBucketPolicyRead(ctx context.Context, d *schema.ResourceData, meta
 	d.Set("bucket", d.Id())
 
 	if output.Policy != nil {
-		policyToSet, err := verify.PolicyToSet(d.Get("policy").(string), aws.StringValue(output.Policy))
+		policyToSet, err := verify.PolicyToSet(d.Get("policy").(string), aws.ToString(output.Policy))
 		if err != nil {
 			return diag.FromErr(err)
 		}
@@ -120,11 +122,11 @@ func resourceBucketPolicyRead(ctx context.Context, d *schema.ResourceData, meta
 }
 
 func resourceBucketPolicyUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).S3ControlConn(ctx)
+	conn := meta.(*conns.AWSClient).S3ControlClient(ctx)
 
 	policy, err := structure.NormalizeJsonString(d.Get("policy").(string))
 	if err != nil {
-		return diag.Errorf("policy (%s) is invalid JSON: %s", d.Get("policy").(string), err)
+		return diag.FromErr(err)
 	}
 
 	input := &s3control.PutBucketPolicyInput{
@@ -132,7 +134,7 @@ func resourceBucketPolicyUpdate(ctx context.Context, d *schema.ResourceData, met
 		Policy: aws.String(policy),
 	}
 
-	_, err = conn.PutBucketPolicyWithContext(ctx, input)
+	_, err = conn.PutBucketPolicy(ctx, input)
 
 	if err != nil {
 		return diag.Errorf("updating S3 Control Bucket Policy (%s): %s", d.Id(), err)
@@ -142,7 +144,7 @@ func resourceBucketPolicyUpdate(ctx context.Context, d *schema.ResourceData, met
 }
 
 func resourceBucketPolicyDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).S3ControlConn(ctx)
+	conn := meta.(*conns.AWSClient).S3ControlClient(ctx)
 
 	parsedArn, err := arn.Parse(d.Id())
 
@@ -151,7 +153,7 @@ func resourceBucketPolicyDelete(ctx context.Context, d *schema.ResourceData, met
 	}
 
 	log.Printf("[DEBUG] Deleting S3 Control Bucket Policy: %s", d.Id())
-	_, err = conn.DeleteBucketPolicyWithContext(ctx, &s3control.DeleteBucketPolicyInput{
+	_, err = conn.DeleteBucketPolicy(ctx, &s3control.DeleteBucketPolicyInput{
 		AccountId: aws.String(parsedArn.AccountID),
 		Bucket:    aws.String(d.Id()),
 	})
@@ -167,13 +169,13 @@ func resourceBucketPolicyDelete(ctx context.Context, d *schema.ResourceData, met
 	return nil
 }
 
-func FindBucketPolicyByTwoPartKey(ctx context.Context, conn *s3control.S3Control, accountID, bucket string) (*s3control.GetBucketPolicyOutput, error) {
+func findBucketPolicyByTwoPartKey(ctx context.Context, conn *s3control.Client, accountID, bucket string) (*s3control.GetBucketPolicyOutput, error) {
 	input := &s3control.GetBucketPolicyInput{
 		AccountId: aws.String(accountID),
 		Bucket:    aws.String(bucket),
 	}
 
-	output, err := conn.GetBucketPolicyWithContext(ctx, input)
+	output, err := conn.GetBucketPolicy(ctx, input)
 
 	if tfawserr.ErrCodeEquals(err, errCodeNoSuchBucket, errCodeNoSuchBucketPolicy, errCodeNoSuchOutpost) {
 		return nil, &retry.NotFoundError{
diff --git a/internal/service/s3control/bucket_policy_test.go b/internal/service/s3control/bucket_policy_test.go
index 3bf9a35d866..37725abd1ff 100644
--- a/internal/service/s3control/bucket_policy_test.go
+++ b/internal/service/s3control/bucket_policy_test.go
@@ -1,13 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3control_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/aws/arn"
-	"github.com/aws/aws-sdk-go/service/s3control"
+	"github.com/YakDriver/regexache"
+	"github.com/aws/aws-sdk-go-v2/aws/arn"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
@@ -15,6 +17,7 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	tfs3control "github.com/hashicorp/terraform-provider-aws/internal/service/s3control"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
 func TestAccS3ControlBucketPolicy_basic(t *testing.T) {
@@ -24,7 +27,7 @@ func TestAccS3ControlBucketPolicy_basic(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckOutpostsOutposts(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3control.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3ControlEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketPolicyDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -33,7 +36,7 @@ func TestAccS3ControlBucketPolicy_basic(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketPolicyExists(ctx, resourceName),
 					resource.TestCheckResourceAttrPair(resourceName, "bucket", "aws_s3control_bucket.test", "arn"),
-					resource.TestMatchResourceAttr(resourceName, "policy", regexp.MustCompile(`s3-outposts:\*`)),
+					resource.TestMatchResourceAttr(resourceName, "policy", regexache.MustCompile(`s3-outposts:\*`)),
 				),
 			},
 			{
@@ -52,7 +55,7 @@ func TestAccS3ControlBucketPolicy_disappears(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckOutpostsOutposts(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3control.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3ControlEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketPolicyDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -75,7 +78,7 @@ func TestAccS3ControlBucketPolicy_policy(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckOutpostsOutposts(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3control.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3ControlEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketPolicyDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -83,7 +86,7 @@ func TestAccS3ControlBucketPolicy_policy(t *testing.T) {
 				Config: testAccBucketPolicyConfig_basic(rName, "s3-outposts:GetObject"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketPolicyExists(ctx, resourceName),
-					resource.TestMatchResourceAttr(resourceName, "policy", regexp.MustCompile(`s3-outposts:GetObject`)),
+					resource.TestMatchResourceAttr(resourceName, "policy", regexache.MustCompile(`s3-outposts:GetObject`)),
 				),
 			},
 			{
@@ -95,7 +98,7 @@ func TestAccS3ControlBucketPolicy_policy(t *testing.T) {
 				Config: testAccBucketPolicyConfig_basic(rName, "s3-outposts:PutObject"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketPolicyExists(ctx, resourceName),
-					resource.TestMatchResourceAttr(resourceName, "policy", regexp.MustCompile(`s3-outposts:PutObject`)),
+					resource.TestMatchResourceAttr(resourceName, "policy", regexache.MustCompile(`s3-outposts:PutObject`)),
 				),
 			},
 		},
@@ -104,7 +107,7 @@ func TestAccS3ControlBucketPolicy_policy(t *testing.T) {
 
 func testAccCheckBucketPolicyDestroy(ctx context.Context) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		conn := acctest.Provider.Meta().(*conns.AWSClient).S3ControlConn(ctx)
+		conn := acctest.Provider.Meta().(*conns.AWSClient).S3ControlClient(ctx)
 
 		for _, rs := range s.RootModule().Resources {
 			if rs.Type != "aws_s3control_bucket_policy" {
@@ -112,7 +115,6 @@ func testAccCheckBucketPolicyDestroy(ctx context.Context) resource.TestCheckFunc
 			}
 
 			parsedArn, err := arn.Parse(rs.Primary.ID)
-
 			if err != nil {
 				return err
 			}
@@ -141,14 +143,9 @@ func testAccCheckBucketPolicyExists(ctx context.Context, n string) resource.Test
 			return fmt.Errorf("Not found: %s", n)
 		}
 
-		if rs.Primary.ID == "" {
-			return fmt.Errorf("No S3 Control Bucket Policy ID is set")
-		}
-
-		conn := acctest.Provider.Meta().(*conns.AWSClient).S3ControlConn(ctx)
+		conn := acctest.Provider.Meta().(*conns.AWSClient).S3ControlClient(ctx)
 
 		parsedArn, err := arn.Parse(rs.Primary.ID)
-
 		if err != nil {
 			return err
 		}
diff --git a/internal/service/s3control/bucket_test.go b/internal/service/s3control/bucket_test.go
index 9a228ba770d..338d1d3114c 100644
--- a/internal/service/s3control/bucket_test.go
+++ b/internal/service/s3control/bucket_test.go
@@ -1,13 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3control_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/aws/arn"
-	"github.com/aws/aws-sdk-go/service/s3control"
+	"github.com/YakDriver/regexache"
+	"github.com/aws/aws-sdk-go-v2/aws/arn"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
@@ -15,6 +17,7 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	tfs3control "github.com/hashicorp/terraform-provider-aws/internal/service/s3control"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
 func TestAccS3ControlBucket_basic(t *testing.T) {
@@ -24,7 +27,7 @@ func TestAccS3ControlBucket_basic(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckOutpostsOutposts(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3control.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3ControlEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -32,7 +35,7 @@ func TestAccS3ControlBucket_basic(t *testing.T) {
 				Config: testAccBucketConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckBucketExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "s3-outposts", regexp.MustCompile(fmt.Sprintf("outpost/[^/]+/bucket/%s", rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "s3-outposts", regexache.MustCompile(fmt.Sprintf("outpost/[^/]+/bucket/%s", rName))),
 					resource.TestCheckResourceAttr(resourceName, "bucket", rName),
 					resource.TestCheckResourceAttrSet(resourceName, "creation_date"),
 					resource.TestCheckResourceAttrPair(resourceName, "outpost_id", "data.aws_outposts_outpost.test", "id"),
@@ -56,7 +59,7 @@ func TestAccS3ControlBucket_disappears(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckOutpostsOutposts(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3control.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3ControlEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -81,7 +84,7 @@ func TestAccS3ControlBucket_tags(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckOutpostsOutposts(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3control.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3ControlEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckBucketDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -121,7 +124,7 @@ func TestAccS3ControlBucket_tags(t *testing.T) {
 
 func testAccCheckBucketDestroy(ctx context.Context) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		conn := acctest.Provider.Meta().(*conns.AWSClient).S3ControlConn(ctx)
+		conn := acctest.Provider.Meta().(*conns.AWSClient).S3ControlClient(ctx)
 
 		for _, rs := range s.RootModule().Resources {
 			if rs.Type != "aws_s3control_bucket" {
@@ -129,7 +132,6 @@ func testAccCheckBucketDestroy(ctx context.Context) resource.TestCheckFunc {
 			}
 
 			parsedArn, err := arn.Parse(rs.Primary.ID)
-
 			if err != nil {
 				return err
 			}
@@ -158,14 +160,9 @@ func testAccCheckBucketExists(ctx context.Context, n string) resource.TestCheckF
 			return fmt.Errorf("Not found: %s", n)
 		}
 
-		if rs.Primary.ID == "" {
-			return fmt.Errorf("No S3 Control Bucket ID is set")
-		}
-
-		conn := acctest.Provider.Meta().(*conns.AWSClient).S3ControlConn(ctx)
+		conn := acctest.Provider.Meta().(*conns.AWSClient).S3ControlClient(ctx)
 
 		parsedArn, err := arn.Parse(rs.Primary.ID)
-
 		if err != nil {
 			return err
 		}
diff --git a/internal/service/s3control/consts.go b/internal/service/s3control/consts.go
deleted file mode 100644
index 68a30d284a3..00000000000
--- a/internal/service/s3control/consts.go
+++ /dev/null
@@ -1,7 +0,0 @@
-package s3control
-
-// AsyncOperation.RequestStatus values.
-const (
-	RequestStatusFailed    = "FAILED"
-	RequestStatusSucceeded = "SUCCEEDED"
-)
diff --git a/internal/service/s3control/errors.go b/internal/service/s3control/errors.go
index 01a3f3c4405..1417a470e9f 100644
--- a/internal/service/s3control/errors.go
+++ b/internal/service/s3control/errors.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3control
 
 // Error code constants missing from AWS Go SDK:
diff --git a/internal/service/s3control/exports_test.go b/internal/service/s3control/exports_test.go
index bd998d22d53..9cb98471b08 100644
--- a/internal/service/s3control/exports_test.go
+++ b/internal/service/s3control/exports_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3control
 
 // Exports for use in tests only.
@@ -13,4 +16,17 @@ var (
 	ResourceObjectLambdaAccessPoint       = resourceObjectLambdaAccessPoint
 	ResourceObjectLambdaAccessPointPolicy = resourceObjectLambdaAccessPointPolicy
 	ResourceStorageLensConfiguration      = resourceStorageLensConfiguration
+
+	FindAccessPointByTwoPartKey                            = findAccessPointByTwoPartKey
+	FindAccessPointPolicyAndStatusByTwoPartKey             = findAccessPointPolicyAndStatusByTwoPartKey
+	FindBucketByTwoPartKey                                 = findBucketByTwoPartKey
+	FindBucketLifecycleConfigurationByTwoPartKey           = findBucketLifecycleConfigurationByTwoPartKey
+	FindBucketPolicyByTwoPartKey                           = findBucketPolicyByTwoPartKey
+	FindMultiRegionAccessPointByTwoPartKey                 = findMultiRegionAccessPointByTwoPartKey
+	FindMultiRegionAccessPointPolicyDocumentByTwoPartKey   = findMultiRegionAccessPointPolicyDocumentByTwoPartKey
+	FindObjectLambdaAccessPointAliasByTwoPartKey           = findObjectLambdaAccessPointAliasByTwoPartKey
+	FindObjectLambdaAccessPointConfigurationByTwoPartKey   = findObjectLambdaAccessPointConfigurationByTwoPartKey
+	FindObjectLambdaAccessPointPolicyAndStatusByTwoPartKey = findObjectLambdaAccessPointPolicyAndStatusByTwoPartKey
+	FindPublicAccessBlockByAccountID                       = findPublicAccessBlockByAccountID
+	FindStorageLensConfigurationByAccountIDAndConfigID     = findStorageLensConfigurationByAccountIDAndConfigID
 )
diff --git a/internal/service/s3control/generate.go b/internal/service/s3control/generate.go
index 8f678bac091..336712b75e0 100644
--- a/internal/service/s3control/generate.go
+++ b/internal/service/s3control/generate.go
@@ -1,4 +1,7 @@
-//go:generate go run ../../generate/tags/main.go -ServiceTagsSlice -TagType=S3Tag
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+//go:generate go run ../../generate/tags/main.go -AWSSDKVersion=2 -ServiceTagsSlice -SkipAWSServiceImp -TagType=S3Tag
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
 
diff --git a/internal/service/s3control/multi_region_access_point.go b/internal/service/s3control/multi_region_access_point.go
index d12e0d440ac..946a95e5e46 100644
--- a/internal/service/s3control/multi_region_access_point.go
+++ b/internal/service/s3control/multi_region_access_point.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3control
 
 import (
@@ -7,11 +10,11 @@ import (
 	"strings"
 	"time"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/aws/arn"
-	"github.com/aws/aws-sdk-go/aws/endpoints"
-	"github.com/aws/aws-sdk-go/service/s3control"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/aws/arn"
+	"github.com/aws/aws-sdk-go-v2/service/s3control"
+	"github.com/aws/aws-sdk-go-v2/service/s3control/types"
+	"github.com/hashicorp/aws-sdk-go-base/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
@@ -19,6 +22,7 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
+	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
 // @SDKResource("aws_s3control_multi_region_access_point")
@@ -117,6 +121,17 @@ func resourceMultiRegionAccessPoint() *schema.Resource {
 										ForceNew:     true,
 										ValidateFunc: validation.StringLenBetween(3, 255),
 									},
+									"bucket_account_id": {
+										Type:         schema.TypeString,
+										Optional:     true,
+										Computed:     true,
+										ForceNew:     true,
+										ValidateFunc: verify.ValidAccountID,
+									},
+									"region": {
+										Type:     schema.TypeString,
+										Computed: true,
+									},
 								},
 							},
 						},
@@ -136,17 +151,12 @@ func resourceMultiRegionAccessPoint() *schema.Resource {
 }
 
 func resourceMultiRegionAccessPointCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn, err := ConnForMRAP(ctx, meta.(*conns.AWSClient))
-
-	if err != nil {
-		return diag.FromErr(err)
-	}
+	conn := meta.(*conns.AWSClient).S3ControlClient(ctx)
 
 	accountID := meta.(*conns.AWSClient).AccountID
 	if v, ok := d.GetOk("account_id"); ok {
 		accountID = v.(string)
 	}
-
 	input := &s3control.CreateMultiRegionAccessPointInput{
 		AccountId: aws.String(accountID),
 	}
@@ -155,39 +165,35 @@ func resourceMultiRegionAccessPointCreate(ctx context.Context, d *schema.Resourc
 		input.Details = expandCreateMultiRegionAccessPointInput_(v.([]interface{})[0].(map[string]interface{}))
 	}
 
-	resourceID := MultiRegionAccessPointCreateResourceID(accountID, aws.StringValue(input.Details.Name))
+	id := MultiRegionAccessPointCreateResourceID(accountID, aws.ToString(input.Details.Name))
 
-	output, err := conn.CreateMultiRegionAccessPointWithContext(ctx, input)
+	output, err := conn.CreateMultiRegionAccessPoint(ctx, input, func(o *s3control.Options) {
+		// All Multi-Region Access Point actions are routed to the US West (Oregon) Region.
+		o.Region = names.USWest2RegionID
+	})
 
 	if err != nil {
-		return diag.Errorf("creating S3 Multi-Region Access Point (%s): %s", resourceID, err)
+		return diag.Errorf("creating S3 Multi-Region Access Point (%s): %s", id, err)
 	}
 
-	d.SetId(resourceID)
-
-	_, err = waitMultiRegionAccessPointRequestSucceeded(ctx, conn, accountID, aws.StringValue(output.RequestTokenARN), d.Timeout(schema.TimeoutCreate))
+	d.SetId(id)
 
-	if err != nil {
-		return diag.Errorf("waiting for Multi-Region Access Point (%s) create: %s", d.Id(), err)
+	if _, err := waitMultiRegionAccessPointRequestSucceeded(ctx, conn, accountID, aws.ToString(output.RequestTokenARN), d.Timeout(schema.TimeoutCreate)); err != nil {
+		return diag.Errorf("waiting for S3 Multi-Region Access Point (%s) create: %s", d.Id(), err)
 	}
 
 	return resourceMultiRegionAccessPointRead(ctx, d, meta)
 }
 
 func resourceMultiRegionAccessPointRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn, err := ConnForMRAP(ctx, meta.(*conns.AWSClient))
-
-	if err != nil {
-		return diag.FromErr(err)
-	}
+	conn := meta.(*conns.AWSClient).S3ControlClient(ctx)
 
 	accountID, name, err := MultiRegionAccessPointParseResourceID(d.Id())
-
 	if err != nil {
 		return diag.FromErr(err)
 	}
 
-	accessPoint, err := FindMultiRegionAccessPointByTwoPartKey(ctx, conn, accountID, name)
+	accessPoint, err := findMultiRegionAccessPointByTwoPartKey(ctx, conn, accountID, name)
 
 	if !d.IsNewResource() && tfresource.NotFound(err) {
 		log.Printf("[WARN] S3 Multi-Region Access Point (%s) not found, removing from state", d.Id())
@@ -199,7 +205,7 @@ func resourceMultiRegionAccessPointRead(ctx context.Context, d *schema.ResourceD
 		return diag.Errorf("reading S3 Multi-Region Access Point (%s): %s", d.Id(), err)
 	}
 
-	alias := aws.StringValue(accessPoint.Alias)
+	alias := aws.ToString(accessPoint.Alias)
 	arn := arn.ARN{
 		Partition: meta.(*conns.AWSClient).Partition,
 		Service:   "s3",
@@ -220,24 +226,24 @@ func resourceMultiRegionAccessPointRead(ctx context.Context, d *schema.ResourceD
 }
 
 func resourceMultiRegionAccessPointDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn, err := ConnForMRAP(ctx, meta.(*conns.AWSClient))
-
-	if err != nil {
-		return diag.FromErr(err)
-	}
+	conn := meta.(*conns.AWSClient).S3ControlClient(ctx)
 
 	accountID, name, err := MultiRegionAccessPointParseResourceID(d.Id())
-
 	if err != nil {
 		return diag.FromErr(err)
 	}
 
-	log.Printf("[DEBUG] Deleting S3 Multi-Region Access Point: %s", d.Id())
-	output, err := conn.DeleteMultiRegionAccessPointWithContext(ctx, &s3control.DeleteMultiRegionAccessPointInput{
+	input := &s3control.DeleteMultiRegionAccessPointInput{
 		AccountId: aws.String(accountID),
-		Details: &s3control.DeleteMultiRegionAccessPointInput_{
+		Details: &types.DeleteMultiRegionAccessPointInput{
 			Name: aws.String(name),
 		},
+	}
+
+	log.Printf("[DEBUG] Deleting S3 Multi-Region Access Point: %s", d.Id())
+	output, err := conn.DeleteMultiRegionAccessPoint(ctx, input, func(o *s3control.Options) {
+		// All Multi-Region Access Point actions are routed to the US West (Oregon) Region.
+		o.Region = names.USWest2RegionID
 	})
 
 	if tfawserr.ErrCodeEquals(err, errCodeNoSuchMultiRegionAccessPoint) {
@@ -248,40 +254,23 @@ func resourceMultiRegionAccessPointDelete(ctx context.Context, d *schema.Resourc
 		return diag.Errorf("deleting S3 Multi-Region Access Point (%s): %s", d.Id(), err)
 	}
 
-	_, err = waitMultiRegionAccessPointRequestSucceeded(ctx, conn, accountID, aws.StringValue(output.RequestTokenARN), d.Timeout(schema.TimeoutDelete))
-
-	if err != nil {
+	if _, err := waitMultiRegionAccessPointRequestSucceeded(ctx, conn, accountID, aws.ToString(output.RequestTokenARN), d.Timeout(schema.TimeoutDelete)); err != nil {
 		return diag.Errorf("waiting for S3 Multi-Region Access Point (%s) delete: %s", d.Id(), err)
 	}
 
 	return nil
 }
 
-func ConnForMRAP(ctx context.Context, client *conns.AWSClient) (*s3control.S3Control, error) {
-	originalConn := client.S3ControlConn(ctx)
-	// All Multi-Region Access Point actions are routed to the US West (Oregon) Region.
-	region := endpoints.UsWest2RegionID
-
-	if originalConn.Config.Region != nil && aws.StringValue(originalConn.Config.Region) == region {
-		return originalConn, nil
-	}
-
-	sess, err := conns.NewSessionForRegion(&originalConn.Config, region, client.TerraformVersion)
-
-	if err != nil {
-		return nil, fmt.Errorf("creating AWS session: %w", err)
-	}
-
-	return s3control.New(sess), nil
-}
-
-func FindMultiRegionAccessPointByTwoPartKey(ctx context.Context, conn *s3control.S3Control, accountID string, name string) (*s3control.MultiRegionAccessPointReport, error) {
+func findMultiRegionAccessPointByTwoPartKey(ctx context.Context, conn *s3control.Client, accountID, name string) (*types.MultiRegionAccessPointReport, error) {
 	input := &s3control.GetMultiRegionAccessPointInput{
 		AccountId: aws.String(accountID),
 		Name:      aws.String(name),
 	}
 
-	output, err := conn.GetMultiRegionAccessPointWithContext(ctx, input)
+	output, err := conn.GetMultiRegionAccessPoint(ctx, input, func(o *s3control.Options) {
+		// All Multi-Region Access Point actions are routed to the US West (Oregon) Region.
+		o.Region = names.USWest2RegionID
+	})
 
 	if tfawserr.ErrCodeEquals(err, errCodeNoSuchMultiRegionAccessPoint) {
 		return nil, &retry.NotFoundError{
@@ -301,13 +290,16 @@ func FindMultiRegionAccessPointByTwoPartKey(ctx context.Context, conn *s3control
 	return output.AccessPoint, nil
 }
 
-func findMultiRegionAccessPointOperationByAccountIDAndTokenARN(ctx context.Context, conn *s3control.S3Control, accountID string, requestTokenARN string) (*s3control.AsyncOperation, error) {
+func findMultiRegionAccessPointOperationByTwoPartKey(ctx context.Context, conn *s3control.Client, accountID, requestTokenARN string) (*types.AsyncOperation, error) {
 	input := &s3control.DescribeMultiRegionAccessPointOperationInput{
 		AccountId:       aws.String(accountID),
 		RequestTokenARN: aws.String(requestTokenARN),
 	}
 
-	output, err := conn.DescribeMultiRegionAccessPointOperationWithContext(ctx, input)
+	output, err := conn.DescribeMultiRegionAccessPointOperation(ctx, input, func(o *s3control.Options) {
+		// All Multi-Region Access Point actions are routed to the US West (Oregon) Region.
+		o.Region = names.USWest2RegionID
+	})
 
 	if tfawserr.ErrCodeEquals(err, errCodeNoSuchAsyncRequest) {
 		return nil, &retry.NotFoundError{
@@ -327,9 +319,9 @@ func findMultiRegionAccessPointOperationByAccountIDAndTokenARN(ctx context.Conte
 	return output.AsyncOperation, nil
 }
 
-func statusMultiRegionAccessPointRequest(ctx context.Context, conn *s3control.S3Control, accountID string, requestTokenARN string) retry.StateRefreshFunc {
+func statusMultiRegionAccessPointRequest(ctx context.Context, conn *s3control.Client, accountID, requestTokenARN string) retry.StateRefreshFunc {
 	return func() (interface{}, string, error) {
-		output, err := findMultiRegionAccessPointOperationByAccountIDAndTokenARN(ctx, conn, accountID, requestTokenARN)
+		output, err := findMultiRegionAccessPointOperationByTwoPartKey(ctx, conn, accountID, requestTokenARN)
 
 		if tfresource.NotFound(err) {
 			return nil, "", nil
@@ -339,7 +331,7 @@ func statusMultiRegionAccessPointRequest(ctx context.Context, conn *s3control.S3
 			return nil, "", err
 		}
 
-		return output, aws.StringValue(output.RequestStatus), nil
+		return output, aws.ToString(output.RequestStatus), nil
 	}
 }
 
@@ -358,20 +350,25 @@ const (
 	multiRegionAccessPointRequestSucceededDelay = 15 * time.Second
 )
 
-func waitMultiRegionAccessPointRequestSucceeded(ctx context.Context, conn *s3control.S3Control, accountID string, requestTokenArn string, timeout time.Duration) (*s3control.AsyncOperation, error) { //nolint:unparam
+func waitMultiRegionAccessPointRequestSucceeded(ctx context.Context, conn *s3control.Client, accountID, requestTokenARN string, timeout time.Duration) (*types.AsyncOperation, error) { //nolint:unparam
+	const (
+		// AsyncOperation.RequestStatus values.
+		asyncOperationRequestStatusFailed    = "FAILED"
+		asyncOperationRequestStatusSucceeded = "SUCCEEDED"
+	)
 	stateConf := &retry.StateChangeConf{
-		Target:     []string{RequestStatusSucceeded},
+		Target:     []string{asyncOperationRequestStatusSucceeded},
 		Timeout:    timeout,
-		Refresh:    statusMultiRegionAccessPointRequest(ctx, conn, accountID, requestTokenArn),
+		Refresh:    statusMultiRegionAccessPointRequest(ctx, conn, accountID, requestTokenARN),
 		MinTimeout: multiRegionAccessPointRequestSucceededMinTimeout,
 		Delay:      multiRegionAccessPointRequestSucceededDelay,
 	}
 
 	outputRaw, err := stateConf.WaitForStateContext(ctx)
 
-	if output, ok := outputRaw.(*s3control.AsyncOperation); ok {
-		if status, responseDetails := aws.StringValue(output.RequestStatus), output.ResponseDetails; status == RequestStatusFailed && responseDetails != nil && responseDetails.ErrorDetails != nil {
-			tfresource.SetLastError(err, fmt.Errorf("%s: %s", aws.StringValue(responseDetails.ErrorDetails.Code), aws.StringValue(responseDetails.ErrorDetails.Message)))
+	if output, ok := outputRaw.(*types.AsyncOperation); ok {
+		if status, responseDetails := aws.ToString(output.RequestStatus), output.ResponseDetails; status == asyncOperationRequestStatusFailed && responseDetails != nil && responseDetails.ErrorDetails != nil {
+			tfresource.SetLastError(err, fmt.Errorf("%s: %s", aws.ToString(responseDetails.ErrorDetails.Code), aws.ToString(responseDetails.ErrorDetails.Message)))
 		}
 
 		return output, err
@@ -399,14 +396,14 @@ func MultiRegionAccessPointParseResourceID(id string) (string, string, error) {
 	return "", "", fmt.Errorf("unexpected format for ID (%[1]s), expected account-id%[2]saccess-point-name", id, multiRegionAccessPointResourceIDSeparator)
 }
 
-func expandCreateMultiRegionAccessPointInput_(tfMap map[string]interface{}) *s3control.CreateMultiRegionAccessPointInput_ {
+func expandCreateMultiRegionAccessPointInput_(tfMap map[string]interface{}) *types.CreateMultiRegionAccessPointInput {
 	if tfMap == nil {
 		return nil
 	}
 
-	apiObject := &s3control.CreateMultiRegionAccessPointInput_{}
+	apiObject := &types.CreateMultiRegionAccessPointInput{}
 
-	if v, ok := tfMap["name"].(string); ok {
+	if v, ok := tfMap["name"].(string); ok && v != "" {
 		apiObject.Name = aws.String(v)
 	}
 
@@ -421,52 +418,56 @@ func expandCreateMultiRegionAccessPointInput_(tfMap map[string]interface{}) *s3c
 	return apiObject
 }
 
-func expandPublicAccessBlockConfiguration(tfMap map[string]interface{}) *s3control.PublicAccessBlockConfiguration {
+func expandPublicAccessBlockConfiguration(tfMap map[string]interface{}) *types.PublicAccessBlockConfiguration {
 	if tfMap == nil {
 		return nil
 	}
 
-	apiObject := &s3control.PublicAccessBlockConfiguration{}
+	apiObject := &types.PublicAccessBlockConfiguration{}
 
 	if v, ok := tfMap["block_public_acls"].(bool); ok {
-		apiObject.BlockPublicAcls = aws.Bool(v)
+		apiObject.BlockPublicAcls = v
 	}
 
 	if v, ok := tfMap["block_public_policy"].(bool); ok {
-		apiObject.BlockPublicPolicy = aws.Bool(v)
+		apiObject.BlockPublicPolicy = v
 	}
 
 	if v, ok := tfMap["ignore_public_acls"].(bool); ok {
-		apiObject.IgnorePublicAcls = aws.Bool(v)
+		apiObject.IgnorePublicAcls = v
 	}
 
 	if v, ok := tfMap["restrict_public_buckets"].(bool); ok {
-		apiObject.RestrictPublicBuckets = aws.Bool(v)
+		apiObject.RestrictPublicBuckets = v
 	}
 
 	return apiObject
 }
 
-func expandRegion(tfMap map[string]interface{}) *s3control.Region {
+func expandRegion(tfMap map[string]interface{}) *types.Region {
 	if tfMap == nil {
 		return nil
 	}
 
-	apiObject := &s3control.Region{}
+	apiObject := &types.Region{}
 
-	if v, ok := tfMap["bucket"].(string); ok {
+	if v, ok := tfMap["bucket"].(string); ok && v != "" {
 		apiObject.Bucket = aws.String(v)
 	}
 
+	if v, ok := tfMap["bucket_account_id"].(string); ok && v != "" {
+		apiObject.BucketAccountId = aws.String(v)
+	}
+
 	return apiObject
 }
 
-func expandRegions(tfList []interface{}) []*s3control.Region {
+func expandRegions(tfList []interface{}) []types.Region {
 	if len(tfList) == 0 {
 		return nil
 	}
 
-	var apiObjects []*s3control.Region
+	var apiObjects []types.Region
 
 	for _, tfMapRaw := range tfList {
 		tfMap, ok := tfMapRaw.(map[string]interface{})
@@ -481,13 +482,13 @@ func expandRegions(tfList []interface{}) []*s3control.Region {
 			continue
 		}
 
-		apiObjects = append(apiObjects, apiObject)
+		apiObjects = append(apiObjects, *apiObject)
 	}
 
 	return apiObjects
 }
 
-func flattenMultiRegionAccessPointReport(apiObject *s3control.MultiRegionAccessPointReport) map[string]interface{} {
+func flattenMultiRegionAccessPointReport(apiObject *types.MultiRegionAccessPointReport) map[string]interface{} {
 	if apiObject == nil {
 		return nil
 	}
@@ -495,7 +496,7 @@ func flattenMultiRegionAccessPointReport(apiObject *s3control.MultiRegionAccessP
 	tfMap := map[string]interface{}{}
 
 	if v := apiObject.Name; v != nil {
-		tfMap["name"] = aws.StringValue(v)
+		tfMap["name"] = aws.ToString(v)
 	}
 
 	if v := apiObject.PublicAccessBlock; v != nil {
@@ -509,47 +510,40 @@ func flattenMultiRegionAccessPointReport(apiObject *s3control.MultiRegionAccessP
 	return tfMap
 }
 
-func flattenPublicAccessBlockConfiguration(apiObject *s3control.PublicAccessBlockConfiguration) map[string]interface{} {
+func flattenPublicAccessBlockConfiguration(apiObject *types.PublicAccessBlockConfiguration) map[string]interface{} {
 	if apiObject == nil {
 		return nil
 	}
 
-	tfMap := map[string]interface{}{}
-
-	if v := apiObject.BlockPublicAcls; v != nil {
-		tfMap["block_public_acls"] = aws.BoolValue(v)
-	}
-
-	if v := apiObject.BlockPublicPolicy; v != nil {
-		tfMap["block_public_policy"] = aws.BoolValue(v)
-	}
-
-	if v := apiObject.IgnorePublicAcls; v != nil {
-		tfMap["ignore_public_acls"] = aws.BoolValue(v)
-	}
-
-	if v := apiObject.RestrictPublicBuckets; v != nil {
-		tfMap["restrict_public_buckets"] = aws.BoolValue(v)
+	tfMap := map[string]interface{}{
+		"block_public_acls":       apiObject.BlockPublicAcls,
+		"block_public_policy":     apiObject.BlockPublicPolicy,
+		"ignore_public_acls":      apiObject.IgnorePublicAcls,
+		"restrict_public_buckets": apiObject.RestrictPublicBuckets,
 	}
 
 	return tfMap
 }
 
-func flattenRegionReport(apiObject *s3control.RegionReport) map[string]interface{} {
-	if apiObject == nil {
-		return nil
-	}
-
+func flattenRegionReport(apiObject types.RegionReport) map[string]interface{} {
 	tfMap := map[string]interface{}{}
 
 	if v := apiObject.Bucket; v != nil {
-		tfMap["bucket"] = aws.StringValue(v)
+		tfMap["bucket"] = aws.ToString(v)
+	}
+
+	if v := apiObject.BucketAccountId; v != nil {
+		tfMap["bucket_account_id"] = aws.ToString(v)
+	}
+
+	if v := apiObject.Region; v != nil {
+		tfMap["region"] = aws.ToString(v)
 	}
 
 	return tfMap
 }
 
-func flattenRegionReports(apiObjects []*s3control.RegionReport) []interface{} {
+func flattenRegionReports(apiObjects []types.RegionReport) []interface{} {
 	if len(apiObjects) == 0 {
 		return nil
 	}
@@ -557,10 +551,6 @@ func flattenRegionReports(apiObjects []*s3control.RegionReport) []interface{} {
 	var tfList []interface{}
 
 	for _, apiObject := range apiObjects {
-		if apiObject == nil {
-			continue
-		}
-
 		tfList = append(tfList, flattenRegionReport(apiObject))
 	}
 
diff --git a/internal/service/s3control/multi_region_access_point_data_source.go b/internal/service/s3control/multi_region_access_point_data_source.go
index 5190acfd524..286960f8c1c 100644
--- a/internal/service/s3control/multi_region_access_point_data_source.go
+++ b/internal/service/s3control/multi_region_access_point_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3control
 
 import (
@@ -5,8 +8,8 @@ import (
 	"fmt"
 	"time"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/aws/arn"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/aws/arn"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
@@ -78,6 +81,10 @@ func dataSourceMultiRegionAccessPoint() *schema.Resource {
 							Type:     schema.TypeString,
 							Computed: true,
 						},
+						"bucket_account_id": {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
 						"region": {
 							Type:     schema.TypeString,
 							Computed: true,
@@ -94,11 +101,7 @@ func dataSourceMultiRegionAccessPoint() *schema.Resource {
 }
 
 func dataSourceMultiRegionAccessPointBlockRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn, err := ConnForMRAP(ctx, meta.(*conns.AWSClient))
-
-	if err != nil {
-		return diag.FromErr(err)
-	}
+	conn := meta.(*conns.AWSClient).S3ControlClient(ctx)
 
 	accountID := meta.(*conns.AWSClient).AccountID
 	if v, ok := d.GetOk("account_id"); ok {
@@ -106,7 +109,7 @@ func dataSourceMultiRegionAccessPointBlockRead(ctx context.Context, d *schema.Re
 	}
 	name := d.Get("name").(string)
 
-	accessPoint, err := FindMultiRegionAccessPointByTwoPartKey(ctx, conn, accountID, name)
+	accessPoint, err := findMultiRegionAccessPointByTwoPartKey(ctx, conn, accountID, name)
 
 	if err != nil {
 		return diag.Errorf("reading S3 Multi Region Access Point (%s): %s", name, err)
@@ -114,7 +117,7 @@ func dataSourceMultiRegionAccessPointBlockRead(ctx context.Context, d *schema.Re
 
 	d.SetId(MultiRegionAccessPointCreateResourceID(accountID, name))
 
-	alias := aws.StringValue(accessPoint.Alias)
+	alias := aws.ToString(accessPoint.Alias)
 	arn := arn.ARN{
 		Partition: meta.(*conns.AWSClient).Partition,
 		Service:   "s3",
@@ -124,7 +127,7 @@ func dataSourceMultiRegionAccessPointBlockRead(ctx context.Context, d *schema.Re
 	d.Set("account_id", accountID)
 	d.Set("alias", alias)
 	d.Set("arn", arn)
-	d.Set("created_at", aws.TimeValue(accessPoint.CreatedAt).Format(time.RFC3339))
+	d.Set("created_at", aws.ToTime(accessPoint.CreatedAt).Format(time.RFC3339))
 	// https://docs.aws.amazon.com/AmazonS3/latest/userguide//MultiRegionAccessPointRequests.html#MultiRegionAccessPointHostnames.
 	d.Set("domain_name", meta.(*conns.AWSClient).PartitionHostname(fmt.Sprintf("%s.accesspoint.s3-global", alias)))
 	d.Set("name", accessPoint.Name)
diff --git a/internal/service/s3control/multi_region_access_point_data_source_test.go b/internal/service/s3control/multi_region_access_point_data_source_test.go
index 07bf8da967e..40e5326ce58 100644
--- a/internal/service/s3control/multi_region_access_point_data_source_test.go
+++ b/internal/service/s3control/multi_region_access_point_data_source_test.go
@@ -1,14 +1,16 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3control_test
 
 import (
 	"fmt"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/aws/endpoints"
-	"github.com/aws/aws-sdk-go/service/s3control"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
+	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
 func TestAccS3ControlMultiRegionAccessPointDataSource_basic(t *testing.T) {
@@ -23,9 +25,9 @@ func TestAccS3ControlMultiRegionAccessPointDataSource_basic(t *testing.T) {
 		PreCheck: func() {
 			acctest.PreCheck(ctx, t)
 			acctest.PreCheckMultipleRegion(t, 2)
-			acctest.PreCheckPartitionNot(t, endpoints.AwsUsGovPartitionID)
+			acctest.PreCheckPartitionNot(t, names.USGovCloudPartitionID)
 		},
-		ErrorCheck:               acctest.ErrorCheck(t, s3control.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3ControlEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5FactoriesMultipleRegions(ctx, t, 2),
 		Steps: []resource.TestStep{
 			{
diff --git a/internal/service/s3control/multi_region_access_point_policy.go b/internal/service/s3control/multi_region_access_point_policy.go
index 384b111a859..b90e52e1961 100644
--- a/internal/service/s3control/multi_region_access_point_policy.go
+++ b/internal/service/s3control/multi_region_access_point_policy.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3control
 
 import (
@@ -5,9 +8,10 @@ import (
 	"log"
 	"time"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/s3control"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/s3control"
+	"github.com/aws/aws-sdk-go-v2/service/s3control/types"
+	"github.com/hashicorp/aws-sdk-go-base/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
@@ -16,6 +20,7 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
+	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
 // @SDKResource("aws_s3control_multi_region_access_point_policy")
@@ -83,17 +88,12 @@ func resourceMultiRegionAccessPointPolicy() *schema.Resource {
 }
 
 func resourceMultiRegionAccessPointPolicyCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn, err := ConnForMRAP(ctx, meta.(*conns.AWSClient))
-
-	if err != nil {
-		return diag.FromErr(err)
-	}
+	conn := meta.(*conns.AWSClient).S3ControlClient(ctx)
 
 	accountID := meta.(*conns.AWSClient).AccountID
 	if v, ok := d.GetOk("account_id"); ok {
 		accountID = v.(string)
 	}
-
 	input := &s3control.PutMultiRegionAccessPointPolicyInput{
 		AccountId: aws.String(accountID),
 	}
@@ -102,19 +102,20 @@ func resourceMultiRegionAccessPointPolicyCreate(ctx context.Context, d *schema.R
 		input.Details = expandPutMultiRegionAccessPointPolicyInput_(v.([]interface{})[0].(map[string]interface{}))
 	}
 
-	resourceID := MultiRegionAccessPointCreateResourceID(accountID, aws.StringValue(input.Details.Name))
+	id := MultiRegionAccessPointCreateResourceID(accountID, aws.ToString(input.Details.Name))
 
-	output, err := conn.PutMultiRegionAccessPointPolicyWithContext(ctx, input)
+	output, err := conn.PutMultiRegionAccessPointPolicy(ctx, input, func(o *s3control.Options) {
+		// All Multi-Region Access Point actions are routed to the US West (Oregon) Region.
+		o.Region = names.USWest2RegionID
+	})
 
 	if err != nil {
-		return diag.Errorf("creating S3 Multi-Region Access Point (%s) Policy: %s", resourceID, err)
+		return diag.Errorf("creating S3 Multi-Region Access Point (%s) Policy: %s", id, err)
 	}
 
-	d.SetId(resourceID)
-
-	_, err = waitMultiRegionAccessPointRequestSucceeded(ctx, conn, accountID, aws.StringValue(output.RequestTokenARN), d.Timeout(schema.TimeoutCreate))
+	d.SetId(id)
 
-	if err != nil {
+	if _, err := waitMultiRegionAccessPointRequestSucceeded(ctx, conn, accountID, aws.ToString(output.RequestTokenARN), d.Timeout(schema.TimeoutCreate)); err != nil {
 		return diag.Errorf("waiting for S3 Multi-Region Access Point Policy (%s) create: %s", d.Id(), err)
 	}
 
@@ -122,19 +123,14 @@ func resourceMultiRegionAccessPointPolicyCreate(ctx context.Context, d *schema.R
 }
 
 func resourceMultiRegionAccessPointPolicyRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn, err := ConnForMRAP(ctx, meta.(*conns.AWSClient))
-
-	if err != nil {
-		return diag.FromErr(err)
-	}
+	conn := meta.(*conns.AWSClient).S3ControlClient(ctx)
 
 	accountID, name, err := MultiRegionAccessPointParseResourceID(d.Id())
-
 	if err != nil {
 		return diag.FromErr(err)
 	}
 
-	policyDocument, err := FindMultiRegionAccessPointPolicyDocumentByTwoPartKey(ctx, conn, accountID, name)
+	policyDocument, err := findMultiRegionAccessPointPolicyDocumentByTwoPartKey(ctx, conn, accountID, name)
 
 	if !d.IsNewResource() && tfresource.NotFound(err) {
 		log.Printf("[WARN] S3 Multi-Region Access Point Policy (%s) not found, removing from state", d.Id())
@@ -174,14 +170,9 @@ func resourceMultiRegionAccessPointPolicyRead(ctx context.Context, d *schema.Res
 }
 
 func resourceMultiRegionAccessPointPolicyUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn, err := ConnForMRAP(ctx, meta.(*conns.AWSClient))
-
-	if err != nil {
-		return diag.FromErr(err)
-	}
+	conn := meta.(*conns.AWSClient).S3ControlClient(ctx)
 
 	accountID, _, err := MultiRegionAccessPointParseResourceID(d.Id())
-
 	if err != nil {
 		return diag.FromErr(err)
 	}
@@ -194,28 +185,32 @@ func resourceMultiRegionAccessPointPolicyUpdate(ctx context.Context, d *schema.R
 		input.Details = expandPutMultiRegionAccessPointPolicyInput_(v.([]interface{})[0].(map[string]interface{}))
 	}
 
-	output, err := conn.PutMultiRegionAccessPointPolicyWithContext(ctx, input)
+	output, err := conn.PutMultiRegionAccessPointPolicy(ctx, input, func(o *s3control.Options) {
+		// All Multi-Region Access Point actions are routed to the US West (Oregon) Region.
+		o.Region = names.USWest2RegionID
+	})
 
 	if err != nil {
 		return diag.Errorf("updating S3 Multi-Region Access Point Policy (%s): %s", d.Id(), err)
 	}
 
-	_, err = waitMultiRegionAccessPointRequestSucceeded(ctx, conn, accountID, aws.StringValue(output.RequestTokenARN), d.Timeout(schema.TimeoutUpdate))
-
-	if err != nil {
+	if _, err := waitMultiRegionAccessPointRequestSucceeded(ctx, conn, accountID, aws.ToString(output.RequestTokenARN), d.Timeout(schema.TimeoutUpdate)); err != nil {
 		return diag.Errorf("waiting for S3 Multi-Region Access Point Policy (%s) update: %s", d.Id(), err)
 	}
 
 	return resourceMultiRegionAccessPointPolicyRead(ctx, d, meta)
 }
 
-func FindMultiRegionAccessPointPolicyDocumentByTwoPartKey(ctx context.Context, conn *s3control.S3Control, accountID string, name string) (*s3control.MultiRegionAccessPointPolicyDocument, error) {
+func findMultiRegionAccessPointPolicyDocumentByTwoPartKey(ctx context.Context, conn *s3control.Client, accountID, name string) (*types.MultiRegionAccessPointPolicyDocument, error) {
 	input := &s3control.GetMultiRegionAccessPointPolicyInput{
 		AccountId: aws.String(accountID),
 		Name:      aws.String(name),
 	}
 
-	output, err := conn.GetMultiRegionAccessPointPolicyWithContext(ctx, input)
+	output, err := conn.GetMultiRegionAccessPointPolicy(ctx, input, func(o *s3control.Options) {
+		// All Multi-Region Access Point actions are routed to the US West (Oregon) Region.
+		o.Region = names.USWest2RegionID
+	})
 
 	if tfawserr.ErrCodeEquals(err, errCodeNoSuchMultiRegionAccessPoint) {
 		return nil, &retry.NotFoundError{
@@ -235,12 +230,12 @@ func FindMultiRegionAccessPointPolicyDocumentByTwoPartKey(ctx context.Context, c
 	return output.Policy, nil
 }
 
-func expandPutMultiRegionAccessPointPolicyInput_(tfMap map[string]interface{}) *s3control.PutMultiRegionAccessPointPolicyInput_ {
+func expandPutMultiRegionAccessPointPolicyInput_(tfMap map[string]interface{}) *types.PutMultiRegionAccessPointPolicyInput {
 	if tfMap == nil {
 		return nil
 	}
 
-	apiObject := &s3control.PutMultiRegionAccessPointPolicyInput_{}
+	apiObject := &types.PutMultiRegionAccessPointPolicyInput{}
 
 	if v, ok := tfMap["name"].(string); ok {
 		apiObject.Name = aws.String(v)
@@ -258,7 +253,7 @@ func expandPutMultiRegionAccessPointPolicyInput_(tfMap map[string]interface{}) *
 	return apiObject
 }
 
-func flattenMultiRegionAccessPointPolicyDocument(name string, apiObject *s3control.MultiRegionAccessPointPolicyDocument, old map[string]interface{}) map[string]interface{} {
+func flattenMultiRegionAccessPointPolicyDocument(name string, apiObject *types.MultiRegionAccessPointPolicyDocument, old map[string]interface{}) map[string]interface{} {
 	if apiObject == nil {
 		return nil
 	}
@@ -269,14 +264,14 @@ func flattenMultiRegionAccessPointPolicyDocument(name string, apiObject *s3contr
 
 	if v := apiObject.Proposed; v != nil {
 		if v := v.Policy; v != nil {
-			policyToSet := aws.StringValue(v)
+			policyToSet := aws.ToString(v)
 			if old != nil {
 				if w, ok := old["policy"].(string); ok {
 					var err error
-					policyToSet, err = verify.PolicyToSet(w, aws.StringValue(v))
+					policyToSet, err = verify.PolicyToSet(w, aws.ToString(v))
 
 					if err != nil {
-						policyToSet = aws.StringValue(v)
+						policyToSet = aws.ToString(v)
 					}
 				}
 			}
diff --git a/internal/service/s3control/multi_region_access_point_policy_test.go b/internal/service/s3control/multi_region_access_point_policy_test.go
index c28a295874a..a2cbb100107 100644
--- a/internal/service/s3control/multi_region_access_point_policy_test.go
+++ b/internal/service/s3control/multi_region_access_point_policy_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3control_test
 
 import (
@@ -5,27 +8,27 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/aws/endpoints"
-	"github.com/aws/aws-sdk-go/service/s3control"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/s3control/types"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	tfs3control "github.com/hashicorp/terraform-provider-aws/internal/service/s3control"
+	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
 func TestAccS3ControlMultiRegionAccessPointPolicy_basic(t *testing.T) {
 	ctx := acctest.Context(t)
-	var v s3control.MultiRegionAccessPointPolicyDocument
+	var v types.MultiRegionAccessPointPolicyDocument
 	resourceName := "aws_s3control_multi_region_access_point_policy.test"
 	bucketName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	multiRegionAccessPointName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionNot(t, endpoints.AwsUsGovPartitionID) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3control.EndpointsID),
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionNot(t, names.USGovCloudPartitionID) },
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3ControlEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		// Multi-Region Access Point Policy cannot be deleted once applied.
 		// Ensure parent resource is destroyed instead.
@@ -55,15 +58,15 @@ func TestAccS3ControlMultiRegionAccessPointPolicy_basic(t *testing.T) {
 
 func TestAccS3ControlMultiRegionAccessPointPolicy_disappears_MultiRegionAccessPoint(t *testing.T) {
 	ctx := acctest.Context(t)
-	var v s3control.MultiRegionAccessPointReport
+	var v types.MultiRegionAccessPointReport
 	parentResourceName := "aws_s3control_multi_region_access_point.test"
 	resourceName := "aws_s3control_multi_region_access_point_policy.test"
 	bucketName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionNot(t, endpoints.AwsUsGovPartitionID) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3control.EndpointsID),
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionNot(t, names.USGovCloudPartitionID) },
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3ControlEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		// Multi-Region Access Point Policy cannot be deleted once applied.
 		// Ensure parent resource is destroyed instead.
@@ -83,14 +86,14 @@ func TestAccS3ControlMultiRegionAccessPointPolicy_disappears_MultiRegionAccessPo
 
 func TestAccS3ControlMultiRegionAccessPointPolicy_details_policy(t *testing.T) {
 	ctx := acctest.Context(t)
-	var v1, v2 s3control.MultiRegionAccessPointPolicyDocument
+	var v1, v2 types.MultiRegionAccessPointPolicyDocument
 	resourceName := "aws_s3control_multi_region_access_point_policy.test"
 	multiRegionAccessPointName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	bucketName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionNot(t, endpoints.AwsUsGovPartitionID) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3control.EndpointsID),
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionNot(t, names.USGovCloudPartitionID) },
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3ControlEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		// Multi-Region Access Point Policy cannot be deleted once applied.
 		// Ensure parent resource is destroyed instead.
@@ -120,15 +123,15 @@ func TestAccS3ControlMultiRegionAccessPointPolicy_details_policy(t *testing.T) {
 
 func TestAccS3ControlMultiRegionAccessPointPolicy_details_name(t *testing.T) {
 	ctx := acctest.Context(t)
-	var v1, v2 s3control.MultiRegionAccessPointPolicyDocument
+	var v1, v2 types.MultiRegionAccessPointPolicyDocument
 	resourceName := "aws_s3control_multi_region_access_point_policy.test"
 	multiRegionAccessPointName1 := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	multiRegionAccessPointName2 := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	bucketName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionNot(t, endpoints.AwsUsGovPartitionID) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3control.EndpointsID),
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionNot(t, names.USGovCloudPartitionID) },
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3ControlEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		// Multi-Region Access Point Policy cannot be deleted once applied.
 		// Ensure parent resource is destroyed instead.
@@ -157,28 +160,19 @@ func TestAccS3ControlMultiRegionAccessPointPolicy_details_name(t *testing.T) {
 	})
 }
 
-func testAccCheckMultiRegionAccessPointPolicyExists(ctx context.Context, n string, v *s3control.MultiRegionAccessPointPolicyDocument) resource.TestCheckFunc {
+func testAccCheckMultiRegionAccessPointPolicyExists(ctx context.Context, n string, v *types.MultiRegionAccessPointPolicyDocument) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		rs, ok := s.RootModule().Resources[n]
 		if !ok {
 			return fmt.Errorf("Not found: %s", n)
 		}
 
-		if rs.Primary.ID == "" {
-			return fmt.Errorf("No S3 Multi-Region Access Point Policy ID is set")
-		}
-
 		accountID, name, err := tfs3control.MultiRegionAccessPointParseResourceID(rs.Primary.ID)
-
 		if err != nil {
 			return err
 		}
 
-		conn, err := tfs3control.ConnForMRAP(ctx, acctest.Provider.Meta().(*conns.AWSClient))
-
-		if err != nil {
-			return err
-		}
+		conn := acctest.Provider.Meta().(*conns.AWSClient).S3ControlClient(ctx)
 
 		output, err := tfs3control.FindMultiRegionAccessPointPolicyDocumentByTwoPartKey(ctx, conn, accountID, name)
 
@@ -192,9 +186,9 @@ func testAccCheckMultiRegionAccessPointPolicyExists(ctx context.Context, n strin
 	}
 }
 
-func testAccCheckMultiRegionAccessPointPolicyChanged(i, j *s3control.MultiRegionAccessPointPolicyDocument) resource.TestCheckFunc {
+func testAccCheckMultiRegionAccessPointPolicyChanged(i, j *types.MultiRegionAccessPointPolicyDocument) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		if aws.StringValue(i.Proposed.Policy) == aws.StringValue(j.Proposed.Policy) {
+		if aws.ToString(i.Proposed.Policy) == aws.ToString(j.Proposed.Policy) {
 			return fmt.Errorf("S3 Multi-Region Access Point Policy did not change")
 		}
 
diff --git a/internal/service/s3control/multi_region_access_point_test.go b/internal/service/s3control/multi_region_access_point_test.go
index c039d48b25d..1c537029cd3 100644
--- a/internal/service/s3control/multi_region_access_point_test.go
+++ b/internal/service/s3control/multi_region_access_point_test.go
@@ -1,14 +1,16 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3control_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/aws/endpoints"
-	"github.com/aws/aws-sdk-go/service/s3control"
+	"github.com/YakDriver/regexache"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/s3control/types"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
@@ -16,29 +18,30 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	tfs3control "github.com/hashicorp/terraform-provider-aws/internal/service/s3control"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
 func TestAccS3ControlMultiRegionAccessPoint_basic(t *testing.T) {
 	ctx := acctest.Context(t)
-	var v s3control.MultiRegionAccessPointReport
+	var v types.MultiRegionAccessPointReport
 	resourceName := "aws_s3control_multi_region_access_point.test"
 	bucketName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionNot(t, endpoints.AwsUsGovPartitionID) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3control.EndpointsID),
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionNot(t, names.USGovCloudPartitionID) },
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3ControlEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckMultiRegionAccessPointDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccMultiRegionAccessPointConfig_basic(bucketName, rName),
-				Check: resource.ComposeTestCheckFunc(
+				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckMultiRegionAccessPointExists(ctx, resourceName, &v),
 					acctest.CheckResourceAttrAccountID(resourceName, "account_id"),
-					resource.TestMatchResourceAttr(resourceName, "alias", regexp.MustCompile(`^[a-z][a-z0-9]*[.]mrap$`)),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "s3", regexp.MustCompile(`accesspoint\/[a-z][a-z0-9]*[.]mrap$`)),
-					acctest.MatchResourceAttrGlobalHostname(resourceName, "domain_name", "accesspoint.s3-global", regexp.MustCompile(`^[a-z][a-z0-9]*[.]mrap`)),
+					resource.TestMatchResourceAttr(resourceName, "alias", regexache.MustCompile(`^[a-z][0-9a-z]*[.]mrap$`)),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "s3", regexache.MustCompile(`accesspoint\/[a-z][0-9a-z]*[.]mrap$`)),
+					acctest.MatchResourceAttrGlobalHostname(resourceName, "domain_name", "accesspoint.s3-global", regexache.MustCompile(`^[a-z][0-9a-z]*[.]mrap`)),
 					resource.TestCheckResourceAttr(resourceName, "details.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "details.0.name", rName),
 					resource.TestCheckResourceAttr(resourceName, "details.0.public_access_block.#", "1"),
@@ -48,9 +51,11 @@ func TestAccS3ControlMultiRegionAccessPoint_basic(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "details.0.public_access_block.0.restrict_public_buckets", "true"),
 					resource.TestCheckResourceAttr(resourceName, "details.0.region.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "details.0.region.*", map[string]string{
-						"bucket": bucketName,
+						"bucket":            bucketName,
+						"bucket_account_id": acctest.AccountID(),
+						"region":            acctest.Region(),
 					}),
-					resource.TestCheckResourceAttr(resourceName, "status", s3control.MultiRegionAccessPointStatusReady),
+					resource.TestCheckResourceAttr(resourceName, "status", string(types.MultiRegionAccessPointStatusReady)),
 				),
 			},
 			{
@@ -64,14 +69,14 @@ func TestAccS3ControlMultiRegionAccessPoint_basic(t *testing.T) {
 
 func TestAccS3ControlMultiRegionAccessPoint_disappears(t *testing.T) {
 	ctx := acctest.Context(t)
-	var v s3control.MultiRegionAccessPointReport
+	var v types.MultiRegionAccessPointReport
 	resourceName := "aws_s3control_multi_region_access_point.test"
 	bucketName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionNot(t, endpoints.AwsUsGovPartitionID) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3control.EndpointsID),
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionNot(t, names.USGovCloudPartitionID) },
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3ControlEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckMultiRegionAccessPointDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -89,14 +94,14 @@ func TestAccS3ControlMultiRegionAccessPoint_disappears(t *testing.T) {
 
 func TestAccS3ControlMultiRegionAccessPoint_PublicAccessBlock(t *testing.T) {
 	ctx := acctest.Context(t)
-	var v s3control.MultiRegionAccessPointReport
+	var v types.MultiRegionAccessPointReport
 	resourceName := "aws_s3control_multi_region_access_point.test"
 	bucketName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionNot(t, endpoints.AwsUsGovPartitionID) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3control.EndpointsID),
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionNot(t, names.USGovCloudPartitionID) },
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3ControlEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckMultiRegionAccessPointDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -122,15 +127,15 @@ func TestAccS3ControlMultiRegionAccessPoint_PublicAccessBlock(t *testing.T) {
 
 func TestAccS3ControlMultiRegionAccessPoint_name(t *testing.T) {
 	ctx := acctest.Context(t)
-	var v1, v2 s3control.MultiRegionAccessPointReport
+	var v1, v2 types.MultiRegionAccessPointReport
 	resourceName := "aws_s3control_multi_region_access_point.test"
 	rName1 := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	rName2 := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	bucketName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionNot(t, endpoints.AwsUsGovPartitionID) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3control.EndpointsID),
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionNot(t, names.USGovCloudPartitionID) },
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3ControlEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckMultiRegionAccessPointDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -160,7 +165,7 @@ func TestAccS3ControlMultiRegionAccessPoint_name(t *testing.T) {
 
 func TestAccS3ControlMultiRegionAccessPoint_threeRegions(t *testing.T) {
 	ctx := acctest.Context(t)
-	var v s3control.MultiRegionAccessPointReport
+	var v types.MultiRegionAccessPointReport
 	resourceName := "aws_s3control_multi_region_access_point.test"
 	bucket1Name := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	bucket2Name := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
@@ -171,9 +176,9 @@ func TestAccS3ControlMultiRegionAccessPoint_threeRegions(t *testing.T) {
 		PreCheck: func() {
 			acctest.PreCheck(ctx, t)
 			acctest.PreCheckMultipleRegion(t, 3)
-			acctest.PreCheckPartitionNot(t, endpoints.AwsUsGovPartitionID)
+			acctest.PreCheckPartitionNot(t, names.USGovCloudPartitionID)
 		},
-		ErrorCheck:               acctest.ErrorCheck(t, s3control.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3ControlEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5FactoriesMultipleRegions(ctx, t, 3),
 		CheckDestroy:             testAccCheckMultiRegionAccessPointDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -191,7 +196,7 @@ func TestAccS3ControlMultiRegionAccessPoint_threeRegions(t *testing.T) {
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "details.0.region.*", map[string]string{
 						"bucket": bucket3Name,
 					}),
-					resource.TestCheckResourceAttr(resourceName, "status", s3control.MultiRegionAccessPointStatusReady),
+					resource.TestCheckResourceAttr(resourceName, "status", string(types.MultiRegionAccessPointStatusReady)),
 				),
 			},
 			{
@@ -203,13 +208,32 @@ func TestAccS3ControlMultiRegionAccessPoint_threeRegions(t *testing.T) {
 	})
 }
 
+func TestAccS3ControlMultiRegionAccessPoint_putAndGetObject(t *testing.T) {
+	ctx := acctest.Context(t)
+	var v types.MultiRegionAccessPointReport
+	resourceName := "aws_s3control_multi_region_access_point.test"
+	bucketName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionNot(t, names.USGovCloudPartitionID) },
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3ControlEndpointID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckMultiRegionAccessPointDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccMultiRegionAccessPointConfig_putAndGetObject(bucketName, rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckMultiRegionAccessPointExists(ctx, resourceName, &v),
+				),
+			},
+		},
+	})
+}
+
 func testAccCheckMultiRegionAccessPointDestroy(ctx context.Context) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		conn, err := tfs3control.ConnForMRAP(ctx, acctest.Provider.Meta().(*conns.AWSClient))
-
-		if err != nil {
-			return err
-		}
+		conn := acctest.Provider.Meta().(*conns.AWSClient).S3ControlClient(ctx)
 
 		for _, rs := range s.RootModule().Resources {
 			if rs.Type != "aws_s3control_multi_region_access_point" {
@@ -217,7 +241,6 @@ func testAccCheckMultiRegionAccessPointDestroy(ctx context.Context) resource.Tes
 			}
 
 			accountID, name, err := tfs3control.MultiRegionAccessPointParseResourceID(rs.Primary.ID)
-
 			if err != nil {
 				return err
 			}
@@ -239,28 +262,19 @@ func testAccCheckMultiRegionAccessPointDestroy(ctx context.Context) resource.Tes
 	}
 }
 
-func testAccCheckMultiRegionAccessPointExists(ctx context.Context, n string, v *s3control.MultiRegionAccessPointReport) resource.TestCheckFunc {
+func testAccCheckMultiRegionAccessPointExists(ctx context.Context, n string, v *types.MultiRegionAccessPointReport) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		rs, ok := s.RootModule().Resources[n]
 		if !ok {
 			return fmt.Errorf("Not found: %s", n)
 		}
 
-		if rs.Primary.ID == "" {
-			return fmt.Errorf("No S3 Multi-Region Access Point ID is set")
-		}
-
 		accountID, name, err := tfs3control.MultiRegionAccessPointParseResourceID(rs.Primary.ID)
-
 		if err != nil {
 			return err
 		}
 
-		conn, err := tfs3control.ConnForMRAP(ctx, acctest.Provider.Meta().(*conns.AWSClient))
-
-		if err != nil {
-			return err
-		}
+		conn := acctest.Provider.Meta().(*conns.AWSClient).S3ControlClient(ctx)
 
 		output, err := tfs3control.FindMultiRegionAccessPointByTwoPartKey(ctx, conn, accountID, name)
 
@@ -277,9 +291,9 @@ func testAccCheckMultiRegionAccessPointExists(ctx context.Context, n string, v *
 // Multi-Region Access Point aliases are unique throughout time and aren’t based on the name or configuration of a Multi-Region Access Point.
 // If you create a Multi-Region Access Point, and then delete it and create another one with the same name and configuration, the
 // second Multi-Region Access Point will have a different alias than the first. (https://docs.aws.amazon.com/AmazonS3/latest/userguide/CreatingMultiRegionAccessPoints.html#multi-region-access-point-naming)
-func testAccCheckMultiRegionAccessPointRecreated(before, after *s3control.MultiRegionAccessPointReport) resource.TestCheckFunc {
+func testAccCheckMultiRegionAccessPointRecreated(before, after *types.MultiRegionAccessPointReport) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		if before, after := aws.StringValue(before.Alias), aws.StringValue(after.Alias); before == after {
+		if before, after := aws.ToString(before.Alias), aws.ToString(after.Alias); before == after {
 			return fmt.Errorf("S3 Multi-Region Access Point (%s) not recreated", before)
 		}
 
@@ -333,9 +347,7 @@ resource "aws_s3control_multi_region_access_point" "test" {
 }
 
 func testAccMultiRegionAccessPointConfig_three(bucketName1, bucketName2, bucketName3, multiRegionAccessPointName string) string {
-	return acctest.ConfigCompose(
-		acctest.ConfigMultipleRegionProvider(3),
-		fmt.Sprintf(`
+	return acctest.ConfigCompose(acctest.ConfigMultipleRegionProvider(3), fmt.Sprintf(`
 resource "aws_s3_bucket" "test1" {
   provider = aws
 
@@ -378,3 +390,38 @@ resource "aws_s3control_multi_region_access_point" "test" {
 }
 `, bucketName1, bucketName2, bucketName3, multiRegionAccessPointName))
 }
+
+func testAccMultiRegionAccessPointConfig_putAndGetObject(bucketName, multiRegionAccessPointName string) string {
+	return fmt.Sprintf(`
+resource "aws_s3_bucket" "test" {
+  bucket        = %[1]q
+  force_destroy = true
+}
+
+resource "aws_s3control_multi_region_access_point" "test" {
+  details {
+    name = %[2]q
+
+    region {
+      bucket = aws_s3_bucket.test.id
+    }
+  }
+}
+
+resource "aws_s3_object" "test" {
+  bucket  = aws_s3control_multi_region_access_point.test.arn
+  key     = "%[1]s-key"
+  content = "Hello World"
+
+  tags = {
+    Name = %[2]q
+  }
+}
+
+# Ensure that we can GET through the bucket.
+data "aws_s3_object" "test" {
+  bucket = aws_s3_bucket.test.bucket
+  key    = aws_s3_object.test.key
+}
+`, bucketName, multiRegionAccessPointName)
+}
diff --git a/internal/service/s3control/object_lambda_access_point.go b/internal/service/s3control/object_lambda_access_point.go
index fa25b139f71..36f3867cad6 100644
--- a/internal/service/s3control/object_lambda_access_point.go
+++ b/internal/service/s3control/object_lambda_access_point.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3control
 
 import (
@@ -6,15 +9,16 @@ import (
 	"log"
 	"strings"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/aws/arn"
-	"github.com/aws/aws-sdk-go/service/s3control"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/aws/arn"
+	"github.com/aws/aws-sdk-go-v2/service/s3control"
+	"github.com/aws/aws-sdk-go-v2/service/s3control/types"
+	"github.com/hashicorp/aws-sdk-go-base/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/enum"
 	"github.com/hashicorp/terraform-provider-aws/internal/flex"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
@@ -40,6 +44,10 @@ func resourceObjectLambdaAccessPoint() *schema.Resource {
 				ForceNew:     true,
 				ValidateFunc: verify.ValidAccountID,
 			},
+			"alias": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
 			"arn": {
 				Type:     schema.TypeString,
 				Computed: true,
@@ -54,8 +62,8 @@ func resourceObjectLambdaAccessPoint() *schema.Resource {
 							Type:     schema.TypeSet,
 							Optional: true,
 							Elem: &schema.Schema{
-								Type:         schema.TypeString,
-								ValidateFunc: validation.StringInSlice(s3control.ObjectLambdaAllowedFeature_Values(), false),
+								Type:             schema.TypeString,
+								ValidateDiagFunc: enum.Validate[types.ObjectLambdaAllowedFeature](),
 							},
 						},
 						"cloud_watch_metrics_enabled": {
@@ -77,8 +85,8 @@ func resourceObjectLambdaAccessPoint() *schema.Resource {
 										Type:     schema.TypeSet,
 										Required: true,
 										Elem: &schema.Schema{
-											Type:         schema.TypeString,
-											ValidateFunc: validation.StringInSlice(s3control.ObjectLambdaTransformationConfigurationAction_Values(), false),
+											Type:             schema.TypeString,
+											ValidateDiagFunc: enum.Validate[types.ObjectLambdaTransformationConfigurationAction](),
 										},
 									},
 									"content_transformation": {
@@ -124,15 +132,14 @@ func resourceObjectLambdaAccessPoint() *schema.Resource {
 }
 
 func resourceObjectLambdaAccessPointCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).S3ControlConn(ctx)
+	conn := meta.(*conns.AWSClient).S3ControlClient(ctx)
 
 	accountID := meta.(*conns.AWSClient).AccountID
 	if v, ok := d.GetOk("account_id"); ok {
 		accountID = v.(string)
 	}
 	name := d.Get("name").(string)
-	resourceID := ObjectLambdaAccessPointCreateResourceID(accountID, name)
-
+	id := ObjectLambdaAccessPointCreateResourceID(accountID, name)
 	input := &s3control.CreateAccessPointForObjectLambdaInput{
 		AccountId: aws.String(accountID),
 		Name:      aws.String(name),
@@ -142,27 +149,26 @@ func resourceObjectLambdaAccessPointCreate(ctx context.Context, d *schema.Resour
 		input.Configuration = expandObjectLambdaConfiguration(v.([]interface{})[0].(map[string]interface{}))
 	}
 
-	_, err := conn.CreateAccessPointForObjectLambdaWithContext(ctx, input)
+	_, err := conn.CreateAccessPointForObjectLambda(ctx, input)
 
 	if err != nil {
-		return diag.Errorf("creating S3 Object Lambda Access Point (%s): %s", resourceID, err)
+		return diag.Errorf("creating S3 Object Lambda Access Point (%s): %s", id, err)
 	}
 
-	d.SetId(resourceID)
+	d.SetId(id)
 
 	return resourceObjectLambdaAccessPointRead(ctx, d, meta)
 }
 
 func resourceObjectLambdaAccessPointRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).S3ControlConn(ctx)
+	conn := meta.(*conns.AWSClient).S3ControlClient(ctx)
 
 	accountID, name, err := ObjectLambdaAccessPointParseResourceID(d.Id())
-
 	if err != nil {
 		return diag.FromErr(err)
 	}
 
-	output, err := FindObjectLambdaAccessPointByTwoPartKey(ctx, conn, accountID, name)
+	outputConfiguration, err := findObjectLambdaAccessPointConfigurationByTwoPartKey(ctx, conn, accountID, name)
 
 	if !d.IsNewResource() && tfresource.NotFound(err) {
 		log.Printf("[WARN] S3 Object Lambda Access Point (%s) not found, removing from state", d.Id())
@@ -184,19 +190,26 @@ func resourceObjectLambdaAccessPointRead(ctx context.Context, d *schema.Resource
 		Resource:  fmt.Sprintf("accesspoint/%s", name),
 	}.String()
 	d.Set("arn", arn)
-	if err := d.Set("configuration", []interface{}{flattenObjectLambdaConfiguration(output)}); err != nil {
+	if err := d.Set("configuration", []interface{}{flattenObjectLambdaConfiguration(outputConfiguration)}); err != nil {
 		return diag.Errorf("setting configuration: %s", err)
 	}
 	d.Set("name", name)
 
+	outputAlias, err := findObjectLambdaAccessPointAliasByTwoPartKey(ctx, conn, accountID, name)
+
+	if err != nil {
+		return diag.Errorf("reading S3 Object Lambda Access Point (%s): %s", d.Id(), err)
+	}
+
+	d.Set("alias", outputAlias.Value)
+
 	return nil
 }
 
 func resourceObjectLambdaAccessPointUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).S3ControlConn(ctx)
+	conn := meta.(*conns.AWSClient).S3ControlClient(ctx)
 
 	accountID, name, err := ObjectLambdaAccessPointParseResourceID(d.Id())
-
 	if err != nil {
 		return diag.FromErr(err)
 	}
@@ -210,7 +223,7 @@ func resourceObjectLambdaAccessPointUpdate(ctx context.Context, d *schema.Resour
 		input.Configuration = expandObjectLambdaConfiguration(v.([]interface{})[0].(map[string]interface{}))
 	}
 
-	_, err = conn.PutAccessPointConfigurationForObjectLambdaWithContext(ctx, input)
+	_, err = conn.PutAccessPointConfigurationForObjectLambda(ctx, input)
 
 	if err != nil {
 		return diag.Errorf("updating S3 Object Lambda Access Point (%s): %s", d.Id(), err)
@@ -220,16 +233,15 @@ func resourceObjectLambdaAccessPointUpdate(ctx context.Context, d *schema.Resour
 }
 
 func resourceObjectLambdaAccessPointDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).S3ControlConn(ctx)
+	conn := meta.(*conns.AWSClient).S3ControlClient(ctx)
 
 	accountID, name, err := ObjectLambdaAccessPointParseResourceID(d.Id())
-
 	if err != nil {
 		return diag.FromErr(err)
 	}
 
 	log.Printf("[DEBUG] Deleting S3 Object Lambda Access Point: %s", d.Id())
-	_, err = conn.DeleteAccessPointForObjectLambdaWithContext(ctx, &s3control.DeleteAccessPointForObjectLambdaInput{
+	_, err = conn.DeleteAccessPointForObjectLambda(ctx, &s3control.DeleteAccessPointForObjectLambdaInput{
 		AccountId: aws.String(accountID),
 		Name:      aws.String(name),
 	})
@@ -245,13 +257,13 @@ func resourceObjectLambdaAccessPointDelete(ctx context.Context, d *schema.Resour
 	return nil
 }
 
-func FindObjectLambdaAccessPointByTwoPartKey(ctx context.Context, conn *s3control.S3Control, accountID string, name string) (*s3control.ObjectLambdaConfiguration, error) {
+func findObjectLambdaAccessPointConfigurationByTwoPartKey(ctx context.Context, conn *s3control.Client, accountID, name string) (*types.ObjectLambdaConfiguration, error) {
 	input := &s3control.GetAccessPointConfigurationForObjectLambdaInput{
 		AccountId: aws.String(accountID),
 		Name:      aws.String(name),
 	}
 
-	output, err := conn.GetAccessPointConfigurationForObjectLambdaWithContext(ctx, input)
+	output, err := conn.GetAccessPointConfigurationForObjectLambda(ctx, input)
 
 	if tfawserr.ErrCodeEquals(err, errCodeNoSuchAccessPoint) {
 		return nil, &retry.NotFoundError{
@@ -271,6 +283,32 @@ func FindObjectLambdaAccessPointByTwoPartKey(ctx context.Context, conn *s3contro
 	return output.Configuration, nil
 }
 
+func findObjectLambdaAccessPointAliasByTwoPartKey(ctx context.Context, conn *s3control.Client, accountID, name string) (*types.ObjectLambdaAccessPointAlias, error) {
+	input := &s3control.GetAccessPointForObjectLambdaInput{
+		AccountId: aws.String(accountID),
+		Name:      aws.String(name),
+	}
+
+	output, err := conn.GetAccessPointForObjectLambda(ctx, input)
+
+	if tfawserr.ErrCodeEquals(err, errCodeNoSuchAccessPoint) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	if output == nil || output.Alias == nil {
+		return nil, tfresource.NewEmptyResultError(input)
+	}
+
+	return output.Alias, nil
+}
+
 const objectLambdaAccessPointResourceIDSeparator = ":"
 
 func ObjectLambdaAccessPointCreateResourceID(accountID, accessPointName string) string {
@@ -290,19 +328,19 @@ func ObjectLambdaAccessPointParseResourceID(id string) (string, string, error) {
 	return "", "", fmt.Errorf("unexpected format for ID (%[1]s), expected account-id%[2]saccess-point-name", id, objectLambdaAccessPointResourceIDSeparator)
 }
 
-func expandObjectLambdaConfiguration(tfMap map[string]interface{}) *s3control.ObjectLambdaConfiguration {
+func expandObjectLambdaConfiguration(tfMap map[string]interface{}) *types.ObjectLambdaConfiguration {
 	if tfMap == nil {
 		return nil
 	}
 
-	apiObject := &s3control.ObjectLambdaConfiguration{}
+	apiObject := &types.ObjectLambdaConfiguration{}
 
 	if v, ok := tfMap["allowed_features"].(*schema.Set); ok && v.Len() > 0 {
-		apiObject.AllowedFeatures = flex.ExpandStringSet(v)
+		apiObject.AllowedFeatures = flex.ExpandStringyValueSet[types.ObjectLambdaAllowedFeature](v)
 	}
 
 	if v, ok := tfMap["cloud_watch_metrics_enabled"].(bool); ok && v {
-		apiObject.CloudWatchMetricsEnabled = aws.Bool(v)
+		apiObject.CloudWatchMetricsEnabled = v
 	}
 
 	if v, ok := tfMap["supporting_access_point"].(string); ok && v != "" {
@@ -316,15 +354,15 @@ func expandObjectLambdaConfiguration(tfMap map[string]interface{}) *s3control.Ob
 	return apiObject
 }
 
-func expandObjectLambdaTransformationConfiguration(tfMap map[string]interface{}) *s3control.ObjectLambdaTransformationConfiguration {
+func expandObjectLambdaTransformationConfiguration(tfMap map[string]interface{}) *types.ObjectLambdaTransformationConfiguration {
 	if tfMap == nil {
 		return nil
 	}
 
-	apiObject := &s3control.ObjectLambdaTransformationConfiguration{}
+	apiObject := &types.ObjectLambdaTransformationConfiguration{}
 
 	if v, ok := tfMap["actions"].(*schema.Set); ok && v.Len() > 0 {
-		apiObject.Actions = flex.ExpandStringSet(v)
+		apiObject.Actions = flex.ExpandStringyValueSet[types.ObjectLambdaTransformationConfigurationAction](v)
 	}
 
 	if v, ok := tfMap["content_transformation"].([]interface{}); ok && len(v) > 0 {
@@ -334,12 +372,12 @@ func expandObjectLambdaTransformationConfiguration(tfMap map[string]interface{})
 	return apiObject
 }
 
-func expandObjectLambdaTransformationConfigurations(tfList []interface{}) []*s3control.ObjectLambdaTransformationConfiguration {
+func expandObjectLambdaTransformationConfigurations(tfList []interface{}) []types.ObjectLambdaTransformationConfiguration {
 	if len(tfList) == 0 {
 		return nil
 	}
 
-	var apiObjects []*s3control.ObjectLambdaTransformationConfiguration
+	var apiObjects []types.ObjectLambdaTransformationConfiguration
 
 	for _, tfMapRaw := range tfList {
 		tfMap, ok := tfMapRaw.(map[string]interface{})
@@ -354,32 +392,28 @@ func expandObjectLambdaTransformationConfigurations(tfList []interface{}) []*s3c
 			continue
 		}
 
-		apiObjects = append(apiObjects, apiObject)
+		apiObjects = append(apiObjects, *apiObject)
 	}
 
 	return apiObjects
 }
 
-func expandObjectLambdaContentTransformation(tfMap map[string]interface{}) *s3control.ObjectLambdaContentTransformation {
+func expandObjectLambdaContentTransformation(tfMap map[string]interface{}) types.ObjectLambdaContentTransformation {
 	if tfMap == nil {
 		return nil
 	}
 
-	apiObject := &s3control.ObjectLambdaContentTransformation{}
+	apiObject := &types.ObjectLambdaContentTransformationMemberAwsLambda{}
 
 	if v, ok := tfMap["aws_lambda"].([]interface{}); ok && len(v) > 0 {
-		apiObject.AwsLambda = expandLambdaTransformation(v[0].(map[string]interface{}))
+		apiObject.Value = expandLambdaTransformation(v[0].(map[string]interface{}))
 	}
 
 	return apiObject
 }
 
-func expandLambdaTransformation(tfMap map[string]interface{}) *s3control.AwsLambdaTransformation {
-	if tfMap == nil {
-		return nil
-	}
-
-	apiObject := &s3control.AwsLambdaTransformation{}
+func expandLambdaTransformation(tfMap map[string]interface{}) types.AwsLambdaTransformation {
+	apiObject := types.AwsLambdaTransformation{}
 
 	if v, ok := tfMap["function_arn"].(string); ok && v != "" {
 		apiObject.FunctionArn = aws.String(v)
@@ -392,23 +426,21 @@ func expandLambdaTransformation(tfMap map[string]interface{}) *s3control.AwsLamb
 	return apiObject
 }
 
-func flattenObjectLambdaConfiguration(apiObject *s3control.ObjectLambdaConfiguration) map[string]interface{} {
+func flattenObjectLambdaConfiguration(apiObject *types.ObjectLambdaConfiguration) map[string]interface{} {
 	if apiObject == nil {
 		return nil
 	}
 
-	tfMap := map[string]interface{}{}
-
-	if v := apiObject.AllowedFeatures; v != nil {
-		tfMap["allowed_features"] = aws.StringValueSlice(v)
+	tfMap := map[string]interface{}{
+		"cloud_watch_metrics_enabled": apiObject.CloudWatchMetricsEnabled,
 	}
 
-	if v := apiObject.CloudWatchMetricsEnabled; v != nil {
-		tfMap["cloud_watch_metrics_enabled"] = aws.BoolValue(v)
+	if v := apiObject.AllowedFeatures; v != nil {
+		tfMap["allowed_features"] = v
 	}
 
 	if v := apiObject.SupportingAccessPoint; v != nil {
-		tfMap["supporting_access_point"] = aws.StringValue(v)
+		tfMap["supporting_access_point"] = aws.ToString(v)
 	}
 
 	if v := apiObject.TransformationConfigurations; v != nil {
@@ -418,15 +450,11 @@ func flattenObjectLambdaConfiguration(apiObject *s3control.ObjectLambdaConfigura
 	return tfMap
 }
 
-func flattenObjectLambdaTransformationConfiguration(apiObject *s3control.ObjectLambdaTransformationConfiguration) map[string]interface{} {
-	if apiObject == nil {
-		return nil
-	}
-
+func flattenObjectLambdaTransformationConfiguration(apiObject types.ObjectLambdaTransformationConfiguration) map[string]interface{} {
 	tfMap := map[string]interface{}{}
 
 	if v := apiObject.Actions; v != nil {
-		tfMap["actions"] = aws.StringValueSlice(v)
+		tfMap["actions"] = v
 	}
 
 	if v := apiObject.ContentTransformation; v != nil {
@@ -436,7 +464,7 @@ func flattenObjectLambdaTransformationConfiguration(apiObject *s3control.ObjectL
 	return tfMap
 }
 
-func flattenObjectLambdaTransformationConfigurations(apiObjects []*s3control.ObjectLambdaTransformationConfiguration) []interface{} {
+func flattenObjectLambdaTransformationConfigurations(apiObjects []types.ObjectLambdaTransformationConfiguration) []interface{} {
 	if len(apiObjects) == 0 {
 		return nil
 	}
@@ -444,43 +472,31 @@ func flattenObjectLambdaTransformationConfigurations(apiObjects []*s3control.Obj
 	var tfList []interface{}
 
 	for _, apiObject := range apiObjects {
-		if apiObject == nil {
-			continue
-		}
-
 		tfList = append(tfList, flattenObjectLambdaTransformationConfiguration(apiObject))
 	}
 
 	return tfList
 }
 
-func flattenObjectLambdaContentTransformation(apiObject *s3control.ObjectLambdaContentTransformation) map[string]interface{} {
-	if apiObject == nil {
-		return nil
-	}
-
+func flattenObjectLambdaContentTransformation(apiObject types.ObjectLambdaContentTransformation) map[string]interface{} {
 	tfMap := map[string]interface{}{}
 
-	if v := apiObject.AwsLambda; v != nil {
-		tfMap["aws_lambda"] = []interface{}{flattenLambdaTransformation(v)}
+	if v, ok := apiObject.(*types.ObjectLambdaContentTransformationMemberAwsLambda); ok {
+		tfMap["aws_lambda"] = []interface{}{flattenLambdaTransformation(v.Value)}
 	}
 
 	return tfMap
 }
 
-func flattenLambdaTransformation(apiObject *s3control.AwsLambdaTransformation) map[string]interface{} {
-	if apiObject == nil {
-		return nil
-	}
-
+func flattenLambdaTransformation(apiObject types.AwsLambdaTransformation) map[string]interface{} {
 	tfMap := map[string]interface{}{}
 
 	if v := apiObject.FunctionArn; v != nil {
-		tfMap["function_arn"] = aws.StringValue(v)
+		tfMap["function_arn"] = aws.ToString(v)
 	}
 
 	if v := apiObject.FunctionPayload; v != nil {
-		tfMap["function_payload"] = aws.StringValue(v)
+		tfMap["function_payload"] = aws.ToString(v)
 	}
 
 	return tfMap
diff --git a/internal/service/s3control/object_lambda_access_point_policy.go b/internal/service/s3control/object_lambda_access_point_policy.go
index e6ae0a0b243..b6d23f01180 100644
--- a/internal/service/s3control/object_lambda_access_point_policy.go
+++ b/internal/service/s3control/object_lambda_access_point_policy.go
@@ -1,12 +1,16 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3control
 
 import (
 	"context"
 	"log"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/s3control"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/s3control"
+	"github.com/aws/aws-sdk-go-v2/service/s3control/types"
+	"github.com/hashicorp/aws-sdk-go-base/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
@@ -61,47 +65,45 @@ func resourceObjectLambdaAccessPointPolicy() *schema.Resource {
 }
 
 func resourceObjectLambdaAccessPointPolicyCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).S3ControlConn(ctx)
+	conn := meta.(*conns.AWSClient).S3ControlClient(ctx)
+
+	policy, err := structure.NormalizeJsonString(d.Get("policy").(string))
+	if err != nil {
+		return diag.FromErr(err)
+	}
 
 	accountID := meta.(*conns.AWSClient).AccountID
 	if v, ok := d.GetOk("account_id"); ok {
 		accountID = v.(string)
 	}
 	name := d.Get("name").(string)
-	resourceID := ObjectLambdaAccessPointCreateResourceID(accountID, name)
-
-	policy, err := structure.NormalizeJsonString(d.Get("policy").(string))
-	if err != nil {
-		return diag.Errorf("policy (%s) is invalid JSON: %s", d.Get("policy").(string), err)
-	}
-
+	id := ObjectLambdaAccessPointCreateResourceID(accountID, name)
 	input := &s3control.PutAccessPointPolicyForObjectLambdaInput{
 		AccountId: aws.String(accountID),
 		Name:      aws.String(name),
 		Policy:    aws.String(policy),
 	}
 
-	_, err = conn.PutAccessPointPolicyForObjectLambdaWithContext(ctx, input)
+	_, err = conn.PutAccessPointPolicyForObjectLambda(ctx, input)
 
 	if err != nil {
-		return diag.Errorf("creating S3 Object Lambda Access Point (%s) Policy: %s", resourceID, err)
+		return diag.Errorf("creating S3 Object Lambda Access Point (%s) Policy: %s", id, err)
 	}
 
-	d.SetId(resourceID)
+	d.SetId(id)
 
 	return resourceObjectLambdaAccessPointPolicyRead(ctx, d, meta)
 }
 
 func resourceObjectLambdaAccessPointPolicyRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).S3ControlConn(ctx)
+	conn := meta.(*conns.AWSClient).S3ControlClient(ctx)
 
 	accountID, name, err := ObjectLambdaAccessPointParseResourceID(d.Id())
-
 	if err != nil {
 		return diag.FromErr(err)
 	}
 
-	policy, status, err := FindObjectLambdaAccessPointPolicyAndStatusByTwoPartKey(ctx, conn, accountID, name)
+	policy, status, err := findObjectLambdaAccessPointPolicyAndStatusByTwoPartKey(ctx, conn, accountID, name)
 
 	if !d.IsNewResource() && tfresource.NotFound(err) {
 		log.Printf("[WARN] S3 Object Lambda Access Point Policy (%s) not found, removing from state", d.Id())
@@ -132,17 +134,16 @@ func resourceObjectLambdaAccessPointPolicyRead(ctx context.Context, d *schema.Re
 }
 
 func resourceObjectLambdaAccessPointPolicyUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).S3ControlConn(ctx)
+	conn := meta.(*conns.AWSClient).S3ControlClient(ctx)
 
 	accountID, name, err := ObjectLambdaAccessPointParseResourceID(d.Id())
-
 	if err != nil {
 		return diag.FromErr(err)
 	}
 
 	policy, err := structure.NormalizeJsonString(d.Get("policy").(string))
 	if err != nil {
-		return diag.Errorf("policy (%s) is invalid JSON: %s", d.Get("policy").(string), err)
+		return diag.FromErr(err)
 	}
 
 	input := &s3control.PutAccessPointPolicyForObjectLambdaInput{
@@ -151,7 +152,7 @@ func resourceObjectLambdaAccessPointPolicyUpdate(ctx context.Context, d *schema.
 		Policy:    aws.String(policy),
 	}
 
-	_, err = conn.PutAccessPointPolicyForObjectLambdaWithContext(ctx, input)
+	_, err = conn.PutAccessPointPolicyForObjectLambda(ctx, input)
 
 	if err != nil {
 		return diag.Errorf("updating S3 Object Lambda Access Point Policy (%s): %s", d.Id(), err)
@@ -161,16 +162,15 @@ func resourceObjectLambdaAccessPointPolicyUpdate(ctx context.Context, d *schema.
 }
 
 func resourceObjectLambdaAccessPointPolicyDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).S3ControlConn(ctx)
+	conn := meta.(*conns.AWSClient).S3ControlClient(ctx)
 
 	accountID, name, err := ObjectLambdaAccessPointParseResourceID(d.Id())
-
 	if err != nil {
 		return diag.FromErr(err)
 	}
 
 	log.Printf("[DEBUG] Deleting S3 Object Lambda Access Point Policy: %s", d.Id())
-	_, err = conn.DeleteAccessPointPolicyForObjectLambdaWithContext(ctx, &s3control.DeleteAccessPointPolicyForObjectLambdaInput{
+	_, err = conn.DeleteAccessPointPolicyForObjectLambda(ctx, &s3control.DeleteAccessPointPolicyForObjectLambdaInput{
 		AccountId: aws.String(accountID),
 		Name:      aws.String(name),
 	})
@@ -186,18 +186,18 @@ func resourceObjectLambdaAccessPointPolicyDelete(ctx context.Context, d *schema.
 	return nil
 }
 
-func FindObjectLambdaAccessPointPolicyAndStatusByTwoPartKey(ctx context.Context, conn *s3control.S3Control, accountID string, name string) (string, *s3control.PolicyStatus, error) {
-	input1 := &s3control.GetAccessPointPolicyForObjectLambdaInput{
+func findObjectLambdaAccessPointPolicyAndStatusByTwoPartKey(ctx context.Context, conn *s3control.Client, accountID, name string) (string, *types.PolicyStatus, error) {
+	inputGAPPFOL := &s3control.GetAccessPointPolicyForObjectLambdaInput{
 		AccountId: aws.String(accountID),
 		Name:      aws.String(name),
 	}
 
-	output1, err := conn.GetAccessPointPolicyForObjectLambdaWithContext(ctx, input1)
+	outputGAPPFOL, err := conn.GetAccessPointPolicyForObjectLambda(ctx, inputGAPPFOL)
 
 	if tfawserr.ErrCodeEquals(err, errCodeNoSuchAccessPoint, errCodeNoSuchAccessPointPolicy) {
 		return "", nil, &retry.NotFoundError{
 			LastError:   err,
-			LastRequest: input1,
+			LastRequest: inputGAPPFOL,
 		}
 	}
 
@@ -205,27 +205,27 @@ func FindObjectLambdaAccessPointPolicyAndStatusByTwoPartKey(ctx context.Context,
 		return "", nil, err
 	}
 
-	if output1 == nil {
-		return "", nil, tfresource.NewEmptyResultError(input1)
+	if outputGAPPFOL == nil {
+		return "", nil, tfresource.NewEmptyResultError(inputGAPPFOL)
 	}
 
-	policy := aws.StringValue(output1.Policy)
+	policy := aws.ToString(outputGAPPFOL.Policy)
 
 	if policy == "" {
-		return "", nil, tfresource.NewEmptyResultError(input1)
+		return "", nil, tfresource.NewEmptyResultError(inputGAPPFOL)
 	}
 
-	input2 := &s3control.GetAccessPointPolicyStatusForObjectLambdaInput{
+	inputGAPPSFOL := &s3control.GetAccessPointPolicyStatusForObjectLambdaInput{
 		AccountId: aws.String(accountID),
 		Name:      aws.String(name),
 	}
 
-	output2, err := conn.GetAccessPointPolicyStatusForObjectLambdaWithContext(ctx, input2)
+	outputGAPPSFOL, err := conn.GetAccessPointPolicyStatusForObjectLambda(ctx, inputGAPPSFOL)
 
 	if tfawserr.ErrCodeEquals(err, errCodeNoSuchAccessPoint, errCodeNoSuchAccessPointPolicy) {
 		return "", nil, &retry.NotFoundError{
 			LastError:   err,
-			LastRequest: input2,
+			LastRequest: inputGAPPSFOL,
 		}
 	}
 
@@ -233,9 +233,9 @@ func FindObjectLambdaAccessPointPolicyAndStatusByTwoPartKey(ctx context.Context,
 		return "", nil, err
 	}
 
-	if output2 == nil || output2.PolicyStatus == nil {
-		return "", nil, tfresource.NewEmptyResultError(input2)
+	if outputGAPPSFOL == nil || outputGAPPSFOL.PolicyStatus == nil {
+		return "", nil, tfresource.NewEmptyResultError(inputGAPPSFOL)
 	}
 
-	return policy, output2.PolicyStatus, nil
+	return policy, outputGAPPSFOL.PolicyStatus, nil
 }
diff --git a/internal/service/s3control/object_lambda_access_point_policy_test.go b/internal/service/s3control/object_lambda_access_point_policy_test.go
index 9103ef4e155..28effe0310c 100644
--- a/internal/service/s3control/object_lambda_access_point_policy_test.go
+++ b/internal/service/s3control/object_lambda_access_point_policy_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3control_test
 
 import (
@@ -5,7 +8,6 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/service/s3control"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
@@ -13,6 +15,7 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	tfs3control "github.com/hashicorp/terraform-provider-aws/internal/service/s3control"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
 func TestAccS3ControlObjectLambdaAccessPointPolicy_basic(t *testing.T) {
@@ -22,7 +25,7 @@ func TestAccS3ControlObjectLambdaAccessPointPolicy_basic(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3control.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3ControlEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckObjectLambdaAccessPointPolicyDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -52,7 +55,7 @@ func TestAccS3ControlObjectLambdaAccessPointPolicy_disappears(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3control.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3ControlEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckObjectLambdaAccessPointPolicyDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -76,7 +79,7 @@ func TestAccS3ControlObjectLambdaAccessPointPolicy_Disappears_accessPoint(t *tes
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3control.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3ControlEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckObjectLambdaAccessPointPolicyDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -99,7 +102,7 @@ func TestAccS3ControlObjectLambdaAccessPointPolicy_update(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3control.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3ControlEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckObjectLambdaAccessPointPolicyDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -134,7 +137,7 @@ func TestAccS3ControlObjectLambdaAccessPointPolicy_update(t *testing.T) {
 
 func testAccCheckObjectLambdaAccessPointPolicyDestroy(ctx context.Context) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		conn := acctest.Provider.Meta().(*conns.AWSClient).S3ControlConn(ctx)
+		conn := acctest.Provider.Meta().(*conns.AWSClient).S3ControlClient(ctx)
 
 		for _, rs := range s.RootModule().Resources {
 			if rs.Type != "aws_s3control_object_lambda_access_point_policy" {
@@ -142,7 +145,6 @@ func testAccCheckObjectLambdaAccessPointPolicyDestroy(ctx context.Context) resou
 			}
 
 			accountID, name, err := tfs3control.ObjectLambdaAccessPointParseResourceID(rs.Primary.ID)
-
 			if err != nil {
 				return err
 			}
@@ -171,17 +173,12 @@ func testAccCheckObjectLambdaAccessPointPolicyExists(ctx context.Context, n stri
 			return fmt.Errorf("Not found: %s", n)
 		}
 
-		if rs.Primary.ID == "" {
-			return fmt.Errorf("No S3 Object Lambda Access Point Policy ID is set")
-		}
-
 		accountID, name, err := tfs3control.ObjectLambdaAccessPointParseResourceID(rs.Primary.ID)
-
 		if err != nil {
 			return err
 		}
 
-		conn := acctest.Provider.Meta().(*conns.AWSClient).S3ControlConn(ctx)
+		conn := acctest.Provider.Meta().(*conns.AWSClient).S3ControlClient(ctx)
 
 		_, _, err = tfs3control.FindObjectLambdaAccessPointPolicyAndStatusByTwoPartKey(ctx, conn, accountID, name)
 
diff --git a/internal/service/s3control/object_lambda_access_point_test.go b/internal/service/s3control/object_lambda_access_point_test.go
index 39487d80c98..93a4ce0e242 100644
--- a/internal/service/s3control/object_lambda_access_point_test.go
+++ b/internal/service/s3control/object_lambda_access_point_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3control_test
 
 import (
@@ -5,7 +8,8 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/service/s3control"
+	"github.com/YakDriver/regexache"
+	"github.com/aws/aws-sdk-go-v2/service/s3control/types"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
@@ -13,11 +17,12 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	tfs3control "github.com/hashicorp/terraform-provider-aws/internal/service/s3control"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
 func TestAccS3ControlObjectLambdaAccessPoint_basic(t *testing.T) {
 	ctx := acctest.Context(t)
-	var v s3control.ObjectLambdaConfiguration
+	var v types.ObjectLambdaConfiguration
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_s3control_object_lambda_access_point.test"
 	accessPointResourceName := "aws_s3_access_point.test"
@@ -25,7 +30,7 @@ func TestAccS3ControlObjectLambdaAccessPoint_basic(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3control.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3ControlEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckObjectLambdaAccessPointDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -34,6 +39,7 @@ func TestAccS3ControlObjectLambdaAccessPoint_basic(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckObjectLambdaAccessPointExists(ctx, resourceName, &v),
 					acctest.CheckResourceAttrAccountID(resourceName, "account_id"),
+					resource.TestMatchResourceAttr(resourceName, "alias", regexache.MustCompile("^.{1,20}-.*--ol-s3$")),
 					acctest.CheckResourceAttrRegionalARN(resourceName, "arn", "s3-object-lambda", fmt.Sprintf("accesspoint/%s", rName)),
 					resource.TestCheckResourceAttr(resourceName, "configuration.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "configuration.0.allowed_features.#", "0"),
@@ -61,13 +67,13 @@ func TestAccS3ControlObjectLambdaAccessPoint_basic(t *testing.T) {
 
 func TestAccS3ControlObjectLambdaAccessPoint_disappears(t *testing.T) {
 	ctx := acctest.Context(t)
-	var v s3control.ObjectLambdaConfiguration
+	var v types.ObjectLambdaConfiguration
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_s3control_object_lambda_access_point.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3control.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3ControlEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckObjectLambdaAccessPointDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -85,7 +91,7 @@ func TestAccS3ControlObjectLambdaAccessPoint_disappears(t *testing.T) {
 
 func TestAccS3ControlObjectLambdaAccessPoint_update(t *testing.T) {
 	ctx := acctest.Context(t)
-	var v s3control.ObjectLambdaConfiguration
+	var v types.ObjectLambdaConfiguration
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_s3control_object_lambda_access_point.test"
 	accessPointResourceName := "aws_s3_access_point.test"
@@ -93,7 +99,7 @@ func TestAccS3ControlObjectLambdaAccessPoint_update(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3control.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3ControlEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckObjectLambdaAccessPointDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -152,7 +158,7 @@ func TestAccS3ControlObjectLambdaAccessPoint_update(t *testing.T) {
 
 func testAccCheckObjectLambdaAccessPointDestroy(ctx context.Context) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		conn := acctest.Provider.Meta().(*conns.AWSClient).S3ControlConn(ctx)
+		conn := acctest.Provider.Meta().(*conns.AWSClient).S3ControlClient(ctx)
 
 		for _, rs := range s.RootModule().Resources {
 			if rs.Type != "aws_s3control_object_lambda_access_point" {
@@ -160,12 +166,11 @@ func testAccCheckObjectLambdaAccessPointDestroy(ctx context.Context) resource.Te
 			}
 
 			accountID, name, err := tfs3control.ObjectLambdaAccessPointParseResourceID(rs.Primary.ID)
-
 			if err != nil {
 				return err
 			}
 
-			_, err = tfs3control.FindObjectLambdaAccessPointByTwoPartKey(ctx, conn, accountID, name)
+			_, err = tfs3control.FindObjectLambdaAccessPointConfigurationByTwoPartKey(ctx, conn, accountID, name)
 
 			if tfresource.NotFound(err) {
 				continue
@@ -182,26 +187,21 @@ func testAccCheckObjectLambdaAccessPointDestroy(ctx context.Context) resource.Te
 	}
 }
 
-func testAccCheckObjectLambdaAccessPointExists(ctx context.Context, n string, v *s3control.ObjectLambdaConfiguration) resource.TestCheckFunc {
+func testAccCheckObjectLambdaAccessPointExists(ctx context.Context, n string, v *types.ObjectLambdaConfiguration) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		rs, ok := s.RootModule().Resources[n]
 		if !ok {
 			return fmt.Errorf("Not found: %s", n)
 		}
 
-		if rs.Primary.ID == "" {
-			return fmt.Errorf("No S3 Object Lambda Access Point ID is set")
-		}
-
 		accountID, name, err := tfs3control.ObjectLambdaAccessPointParseResourceID(rs.Primary.ID)
-
 		if err != nil {
 			return err
 		}
 
-		conn := acctest.Provider.Meta().(*conns.AWSClient).S3ControlConn(ctx)
+		conn := acctest.Provider.Meta().(*conns.AWSClient).S3ControlClient(ctx)
 
-		output, err := tfs3control.FindObjectLambdaAccessPointByTwoPartKey(ctx, conn, accountID, name)
+		output, err := tfs3control.FindObjectLambdaAccessPointConfigurationByTwoPartKey(ctx, conn, accountID, name)
 
 		if err != nil {
 			return err
diff --git a/internal/service/s3control/service_package_gen.go b/internal/service/s3control/service_package_gen.go
index 74f502e77bb..2582b151696 100644
--- a/internal/service/s3control/service_package_gen.go
+++ b/internal/service/s3control/service_package_gen.go
@@ -10,6 +10,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	s3control_sdkv1 "github.com/aws/aws-sdk-go/service/s3control"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -107,9 +108,11 @@ func (p *servicePackage) NewClient(ctx context.Context, config map[string]any) (
 
 	return s3control_sdkv2.NewFromConfig(cfg, func(o *s3control_sdkv2.Options) {
 		if endpoint := config["endpoint"].(string); endpoint != "" {
-			o.EndpointResolver = s3control_sdkv2.EndpointResolverFromURL(endpoint)
+			o.BaseEndpoint = aws_sdkv2.String(endpoint)
 		}
 	}), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/s3control/storage_lens_configuration.go b/internal/service/s3control/storage_lens_configuration.go
index 63c471ad759..169fd31f7a8 100644
--- a/internal/service/s3control/storage_lens_configuration.go
+++ b/internal/service/s3control/storage_lens_configuration.go
@@ -1,17 +1,19 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3control
 
 import (
 	"context"
-	"errors"
 	"fmt"
 	"log"
-	nethttp "net/http"
+	"net/http"
 	"strings"
 
 	"github.com/aws/aws-sdk-go-v2/aws"
-	"github.com/aws/aws-sdk-go-v2/aws/transport/http"
 	"github.com/aws/aws-sdk-go-v2/service/s3control"
 	"github.com/aws/aws-sdk-go-v2/service/s3control/types"
+	"github.com/hashicorp/aws-sdk-go-base/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
@@ -400,11 +402,10 @@ func resourceStorageLensConfigurationCreate(ctx context.Context, d *schema.Resou
 	}
 	configID := d.Get("config_id").(string)
 	id := StorageLensConfigurationCreateResourceID(accountID, configID)
-
 	input := &s3control.PutStorageLensConfigurationInput{
 		AccountId: aws.String(accountID),
 		ConfigId:  aws.String(configID),
-		Tags:      StorageLensTags(KeyValueTags(ctx, getTagsIn(ctx))),
+		Tags:      storageLensTags(KeyValueTags(ctx, getTagsIn(ctx))),
 	}
 
 	if v, ok := d.GetOk("storage_lens_configuration"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
@@ -427,12 +428,11 @@ func resourceStorageLensConfigurationRead(ctx context.Context, d *schema.Resourc
 	conn := meta.(*conns.AWSClient).S3ControlClient(ctx)
 
 	accountID, configID, err := StorageLensConfigurationParseResourceID(d.Id())
-
 	if err != nil {
 		return diag.FromErr(err)
 	}
 
-	output, err := FindStorageLensConfigurationByAccountIDAndConfigID(ctx, conn, accountID, configID)
+	output, err := findStorageLensConfigurationByAccountIDAndConfigID(ctx, conn, accountID, configID)
 
 	if !d.IsNewResource() && tfresource.NotFound(err) {
 		log.Printf("[WARN] S3 Storage Lens Configuration (%s) not found, removing from state", d.Id())
@@ -466,7 +466,6 @@ func resourceStorageLensConfigurationUpdate(ctx context.Context, d *schema.Resou
 	conn := meta.(*conns.AWSClient).S3ControlClient(ctx)
 
 	accountID, configID, err := StorageLensConfigurationParseResourceID(d.Id())
-
 	if err != nil {
 		return diag.FromErr(err)
 	}
@@ -504,7 +503,6 @@ func resourceStorageLensConfigurationDelete(ctx context.Context, d *schema.Resou
 	conn := meta.(*conns.AWSClient).S3ControlClient(ctx)
 
 	accountID, configID, err := StorageLensConfigurationParseResourceID(d.Id())
-
 	if err != nil {
 		return diag.FromErr(err)
 	}
@@ -515,6 +513,10 @@ func resourceStorageLensConfigurationDelete(ctx context.Context, d *schema.Resou
 		ConfigId:  aws.String(configID),
 	})
 
+	if tfawserr.ErrHTTPStatusCodeEquals(err, http.StatusNotFound) {
+		return nil
+	}
+
 	if err != nil {
 		return diag.Errorf("deleting S3 Storage Lens Configuration (%s): %s", d.Id(), err)
 	}
@@ -541,7 +543,7 @@ func StorageLensConfigurationParseResourceID(id string) (string, string, error)
 	return "", "", fmt.Errorf("unexpected format for ID (%[1]s), expected account-id%[2]sconfig-id", id, storageLensConfigurationResourceIDSeparator)
 }
 
-func FindStorageLensConfigurationByAccountIDAndConfigID(ctx context.Context, conn *s3control.Client, accountID, configID string) (*types.StorageLensConfiguration, error) {
+func findStorageLensConfigurationByAccountIDAndConfigID(ctx context.Context, conn *s3control.Client, accountID, configID string) (*types.StorageLensConfiguration, error) {
 	input := &s3control.GetStorageLensConfigurationInput{
 		AccountId: aws.String(accountID),
 		ConfigId:  aws.String(configID),
@@ -549,9 +551,7 @@ func FindStorageLensConfigurationByAccountIDAndConfigID(ctx context.Context, con
 
 	output, err := conn.GetStorageLensConfiguration(ctx, input)
 
-	// No types.NoSuchConfiguration defined.
-	var re *http.ResponseError
-	if errors.As(err, &re) && re.Response.StatusCode == nethttp.StatusNotFound {
+	if tfawserr.ErrHTTPStatusCodeEquals(err, http.StatusNotFound) {
 		return nil, &retry.NotFoundError{
 			LastError:   err,
 			LastRequest: input,
@@ -569,7 +569,7 @@ func FindStorageLensConfigurationByAccountIDAndConfigID(ctx context.Context, con
 	return output.StorageLensConfiguration, nil
 }
 
-func StorageLensTags(tags tftags.KeyValueTags) []types.StorageLensTag {
+func storageLensTags(tags tftags.KeyValueTags) []types.StorageLensTag {
 	result := make([]types.StorageLensTag, 0, len(tags))
 
 	for k, v := range tags.Map() {
@@ -584,7 +584,7 @@ func StorageLensTags(tags tftags.KeyValueTags) []types.StorageLensTag {
 	return result
 }
 
-func KeyValueTagsFromStorageLensTags(ctx context.Context, tags []types.StorageLensTag) tftags.KeyValueTags {
+func keyValueTagsFromStorageLensTags(ctx context.Context, tags []types.StorageLensTag) tftags.KeyValueTags {
 	m := make(map[string]*string, len(tags))
 
 	for _, tag := range tags {
@@ -606,7 +606,7 @@ func storageLensConfigurationListTags(ctx context.Context, conn *s3control.Clien
 		return tftags.New(ctx, nil), err
 	}
 
-	return KeyValueTagsFromStorageLensTags(ctx, output.Tags), nil
+	return keyValueTagsFromStorageLensTags(ctx, output.Tags), nil
 }
 
 func storageLensConfigurationUpdateTags(ctx context.Context, conn *s3control.Client, accountID, configID string, oldTagsMap, newTagsMap any) error {
@@ -626,7 +626,7 @@ func storageLensConfigurationUpdateTags(ctx context.Context, conn *s3control.Cli
 		input := &s3control.PutStorageLensConfigurationTaggingInput{
 			AccountId: aws.String(accountID),
 			ConfigId:  aws.String(configID),
-			Tags:      StorageLensTags(newTags.Merge(ignoredTags)),
+			Tags:      storageLensTags(newTags.Merge(ignoredTags)),
 		}
 
 		_, err := conn.PutStorageLensConfigurationTagging(ctx, input)
@@ -846,11 +846,11 @@ func expandSelectionCriteria(tfMap map[string]interface{}) *types.SelectionCrite
 	}
 
 	if v, ok := tfMap["max_depth"].(int); ok && v != 0 {
-		apiObject.MaxDepth = int32(v)
+		apiObject.MaxDepth = aws.Int32(int32(v))
 	}
 
 	if v, ok := tfMap["min_storage_bytes_percentage"].(float64); ok && v != 0.0 {
-		apiObject.MinStorageBytesPercentage = v
+		apiObject.MinStorageBytesPercentage = aws.Float64(v)
 	}
 
 	return apiObject
@@ -1185,8 +1185,8 @@ func flattenSelectionCriteria(apiObject *types.SelectionCriteria) map[string]int
 		tfMap["delimiter"] = aws.ToString(v)
 	}
 
-	tfMap["max_depth"] = apiObject.MaxDepth
-	tfMap["min_storage_bytes_percentage"] = apiObject.MinStorageBytesPercentage
+	tfMap["max_depth"] = aws.ToInt32(apiObject.MaxDepth)
+	tfMap["min_storage_bytes_percentage"] = aws.ToFloat64(apiObject.MinStorageBytesPercentage)
 
 	return tfMap
 }
diff --git a/internal/service/s3control/storage_lens_configuration_test.go b/internal/service/s3control/storage_lens_configuration_test.go
index b8b175b077a..d8e3e93928a 100644
--- a/internal/service/s3control/storage_lens_configuration_test.go
+++ b/internal/service/s3control/storage_lens_configuration_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3control_test
 
 import (
@@ -5,7 +8,6 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/service/s3control"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
@@ -13,6 +15,7 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	tfs3control "github.com/hashicorp/terraform-provider-aws/internal/service/s3control"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
 func TestAccS3ControlStorageLensConfiguration_basic(t *testing.T) {
@@ -22,7 +25,7 @@ func TestAccS3ControlStorageLensConfiguration_basic(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3control.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3ControlEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckStorageLensConfigurationDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -68,7 +71,7 @@ func TestAccS3ControlStorageLensConfiguration_disappears(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3control.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3ControlEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckStorageLensConfigurationDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -91,7 +94,7 @@ func TestAccS3ControlStorageLensConfiguration_tags(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3control.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3ControlEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckStorageLensConfigurationDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -136,7 +139,7 @@ func TestAccS3ControlStorageLensConfiguration_update(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3control.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3ControlEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckStorageLensConfigurationDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -242,7 +245,7 @@ func TestAccS3ControlStorageLensConfiguration_advancedMetrics(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, s3control.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.S3ControlEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckStorageLensConfigurationDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -331,7 +334,6 @@ func testAccCheckStorageLensConfigurationDestroy(ctx context.Context) resource.T
 			}
 
 			accountID, configID, err := tfs3control.StorageLensConfigurationParseResourceID(rs.Primary.ID)
-
 			if err != nil {
 				return err
 			}
@@ -360,12 +362,7 @@ func testAccCheckStorageLensConfigurationExists(ctx context.Context, n string) r
 			return fmt.Errorf("Not found: %s", n)
 		}
 
-		if rs.Primary.ID == "" {
-			return fmt.Errorf("No S3 Storage Lens Configuration ID is set")
-		}
-
 		accountID, configID, err := tfs3control.StorageLensConfigurationParseResourceID(rs.Primary.ID)
-
 		if err != nil {
 			return err
 		}
diff --git a/internal/service/s3control/sweep.go b/internal/service/s3control/sweep.go
index eb826b46e4a..1496ae2415a 100644
--- a/internal/service/s3control/sweep.go
+++ b/internal/service/s3control/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package s3control
 
@@ -7,15 +7,16 @@ import (
 	"fmt"
 	"log"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/aws/endpoints"
-	"github.com/aws/aws-sdk-go/service/s3control"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/s3control"
 	multierror "github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv2"
+	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_s3_access_point", &resource.Sweeper{
 		Name: "aws_s3_access_point",
 		F:    sweepAccessPoints,
@@ -42,11 +43,11 @@ func init() {
 
 func sweepAccessPoints(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
-	conn := client.S3ControlConn(ctx)
+	conn := client.S3ControlClient(ctx)
 	accountID := client.AccountID
 	input := &s3control.ListAccessPointsInput{
 		AccountId: aws.String(accountID),
@@ -54,37 +55,34 @@ func sweepAccessPoints(region string) error {
 	sweepResources := make([]sweep.Sweepable, 0)
 	var sweeperErrs *multierror.Error
 
-	err = conn.ListAccessPointsPagesWithContext(ctx, input, func(page *s3control.ListAccessPointsOutput, lastPage bool) bool {
-		if page == nil {
-			return !lastPage
+	pages := s3control.NewListAccessPointsPaginator(conn, input)
+	for pages.HasMorePages() {
+		page, err := pages.NextPage(ctx)
+
+		if awsv2.SkipSweepError(err) {
+			log.Printf("[WARN] Skipping S3 Access Point sweep for %s: %s", region, err)
+			return sweeperErrs.ErrorOrNil()
+		}
+
+		if err != nil {
+			return fmt.Errorf("error listing S3 Access Points (%s): %w", region, err)
 		}
 
 		for _, v := range page.AccessPointList {
 			r := resourceAccessPoint()
 			d := r.Data(nil)
-			if id, err := AccessPointCreateResourceID(aws.StringValue(v.AccessPointArn)); err != nil {
+			id, err := AccessPointCreateResourceID(aws.ToString(v.AccessPointArn))
+			if err != nil {
 				sweeperErrs = multierror.Append(sweeperErrs, err)
 				continue
-			} else {
-				d.SetId(id)
 			}
+			d.SetId(id)
 
 			sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
 		}
-
-		return !lastPage
-	})
-
-	if sweep.SkipSweepError(err) {
-		log.Printf("[WARN] Skipping S3 Access Point sweep for %s: %s", region, err)
-		return sweeperErrs.ErrorOrNil()
 	}
 
-	if err != nil {
-		return fmt.Errorf("error listing S3 Access Points (%s): %w", region, err)
-	}
-
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error sweeping S3 Access Points (%s): %w", region, err))
@@ -95,48 +93,44 @@ func sweepAccessPoints(region string) error {
 
 func sweepMultiRegionAccessPoints(region string) error {
 	ctx := sweep.Context(region)
-	if region != endpoints.UsWest2RegionID {
+	if region != names.USWest2RegionID {
 		log.Printf("[WARN] Skipping S3 Multi-Region Access Point sweep for region: %s", region)
 		return nil
 	}
-
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
-	conn := client.S3ControlConn(ctx)
+	conn := client.S3ControlClient(ctx)
 	accountID := client.AccountID
 	input := &s3control.ListMultiRegionAccessPointsInput{
 		AccountId: aws.String(accountID),
 	}
 	sweepResources := make([]sweep.Sweepable, 0)
 
-	err = conn.ListMultiRegionAccessPointsPagesWithContext(ctx, input, func(page *s3control.ListMultiRegionAccessPointsOutput, lastPage bool) bool {
-		if page == nil {
-			return !lastPage
+	pages := s3control.NewListMultiRegionAccessPointsPaginator(conn, input)
+	for pages.HasMorePages() {
+		page, err := pages.NextPage(ctx)
+
+		if awsv2.SkipSweepError(err) {
+			log.Printf("[WARN] Skipping S3 Multi-Region Access Point sweep for %s: %s", region, err)
+			return nil
+		}
+
+		if err != nil {
+			return fmt.Errorf("error listing S3 Multi-Region Access Points (%s): %w", region, err)
 		}
 
 		for _, v := range page.AccessPoints {
 			r := resourceMultiRegionAccessPoint()
 			d := r.Data(nil)
-			d.SetId(MultiRegionAccessPointCreateResourceID(accountID, aws.StringValue(v.Name)))
+			d.SetId(MultiRegionAccessPointCreateResourceID(accountID, aws.ToString(v.Name)))
 
 			sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
 		}
-
-		return !lastPage
-	})
-
-	if sweep.SkipSweepError(err) {
-		log.Printf("[WARN] Skipping S3 Multi-Region Access Point sweep for %s: %s", region, err)
-		return nil
 	}
 
-	if err != nil {
-		return fmt.Errorf("error listing S3 Multi-Region Access Points (%s): %w", region, err)
-	}
-
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping S3 Multi-Region Access Points (%s): %w", region, err)
@@ -147,43 +141,40 @@ func sweepMultiRegionAccessPoints(region string) error {
 
 func sweepObjectLambdaAccessPoints(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
-	conn := client.S3ControlConn(ctx)
+	conn := client.S3ControlClient(ctx)
 	accountID := client.AccountID
 	input := &s3control.ListAccessPointsForObjectLambdaInput{
 		AccountId: aws.String(accountID),
 	}
 	sweepResources := make([]sweep.Sweepable, 0)
 
-	conn.ListAccessPointsForObjectLambdaPagesWithContext(ctx, input, func(page *s3control.ListAccessPointsForObjectLambdaOutput, lastPage bool) bool {
-		if page == nil {
-			return !lastPage
+	pages := s3control.NewListAccessPointsForObjectLambdaPaginator(conn, input)
+	for pages.HasMorePages() {
+		page, err := pages.NextPage(ctx)
+
+		if awsv2.SkipSweepError(err) {
+			log.Printf("[WARN] Skipping S3 Object Lambda Access Point sweep for %s: %s", region, err)
+			return nil
+		}
+
+		if err != nil {
+			return fmt.Errorf("error listing S3 Object Lambda Access Points (%s): %w", region, err)
 		}
 
 		for _, v := range page.ObjectLambdaAccessPointList {
 			r := resourceObjectLambdaAccessPoint()
 			d := r.Data(nil)
-			d.SetId(ObjectLambdaAccessPointCreateResourceID(accountID, aws.StringValue(v.Name)))
+			d.SetId(ObjectLambdaAccessPointCreateResourceID(accountID, aws.ToString(v.Name)))
 
 			sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
 		}
-
-		return !lastPage
-	})
-
-	if sweep.SkipSweepError(err) {
-		log.Printf("[WARN] Skipping S3 Object Lambda Access Point sweep for %s: %s", region, err)
-		return nil
 	}
 
-	if err != nil {
-		return fmt.Errorf("error listing S3 Object Lambda Access Points (%s): %w", region, err)
-	}
-
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping S3 Object Lambda Access Points (%s): %w", region, err)
@@ -194,24 +185,36 @@ func sweepObjectLambdaAccessPoints(region string) error {
 
 func sweepStorageLensConfigurations(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	if region == names.USGovEast1RegionID || region == names.USGovWest1RegionID {
+		log.Printf("[WARN] Skipping S3 Storage Lens Configuration sweep for region: %s", region)
+		return nil
+	}
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
-	conn := client.S3ControlConn(ctx)
+	conn := client.S3ControlClient(ctx)
 	accountID := client.AccountID
 	input := &s3control.ListStorageLensConfigurationsInput{
 		AccountId: aws.String(accountID),
 	}
 	sweepResources := make([]sweep.Sweepable, 0)
 
-	conn.ListStorageLensConfigurationsPagesWithContext(ctx, input, func(page *s3control.ListStorageLensConfigurationsOutput, lastPage bool) bool {
-		if page == nil {
-			return !lastPage
+	pages := s3control.NewListStorageLensConfigurationsPaginator(conn, input)
+	for pages.HasMorePages() {
+		page, err := pages.NextPage(ctx)
+
+		if awsv2.SkipSweepError(err) {
+			log.Printf("[WARN] Skipping S3 Storage Lens Configuration sweep for %s: %s", region, err)
+			return nil
+		}
+
+		if err != nil {
+			return fmt.Errorf("error listing S3 Storage Lens Configurations (%s): %w", region, err)
 		}
 
 		for _, v := range page.StorageLensConfigurationList {
-			configID := aws.StringValue(v.Id)
+			configID := aws.ToString(v.Id)
 
 			if configID == "default-account-dashboard" {
 				continue
@@ -223,20 +226,9 @@ func sweepStorageLensConfigurations(region string) error {
 
 			sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
 		}
-
-		return !lastPage
-	})
-
-	if sweep.SkipSweepError(err) {
-		log.Printf("[WARN] Skipping S3 Storage Lens Configuration sweep for %s: %s", region, err)
-		return nil
-	}
-
-	if err != nil {
-		return fmt.Errorf("error listing S3 Storage Lens Configurations (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping S3 Storage Lens Configurations (%s): %w", region, err)
diff --git a/internal/service/s3control/tags_gen.go b/internal/service/s3control/tags_gen.go
index 720217ef2ae..c36f25b0dbf 100644
--- a/internal/service/s3control/tags_gen.go
+++ b/internal/service/s3control/tags_gen.go
@@ -4,8 +4,8 @@ package s3control
 import (
 	"context"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/s3control"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	awstypes "github.com/aws/aws-sdk-go-v2/service/s3control/types"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 )
@@ -13,11 +13,11 @@ import (
 // []*SERVICE.Tag handling
 
 // Tags returns s3control service tags.
-func Tags(tags tftags.KeyValueTags) []*s3control.S3Tag {
-	result := make([]*s3control.S3Tag, 0, len(tags))
+func Tags(tags tftags.KeyValueTags) []awstypes.S3Tag {
+	result := make([]awstypes.S3Tag, 0, len(tags))
 
 	for k, v := range tags.Map() {
-		tag := &s3control.S3Tag{
+		tag := awstypes.S3Tag{
 			Key:   aws.String(k),
 			Value: aws.String(v),
 		}
@@ -29,11 +29,11 @@ func Tags(tags tftags.KeyValueTags) []*s3control.S3Tag {
 }
 
 // KeyValueTags creates tftags.KeyValueTags from s3control service tags.
-func KeyValueTags(ctx context.Context, tags []*s3control.S3Tag) tftags.KeyValueTags {
+func KeyValueTags(ctx context.Context, tags []awstypes.S3Tag) tftags.KeyValueTags {
 	m := make(map[string]*string, len(tags))
 
 	for _, tag := range tags {
-		m[aws.StringValue(tag.Key)] = tag.Value
+		m[aws.ToString(tag.Key)] = tag.Value
 	}
 
 	return tftags.New(ctx, m)
@@ -41,7 +41,7 @@ func KeyValueTags(ctx context.Context, tags []*s3control.S3Tag) tftags.KeyValueT
 
 // getTagsIn returns s3control service tags from Context.
 // nil is returned if there are no input tags.
-func getTagsIn(ctx context.Context) []*s3control.S3Tag {
+func getTagsIn(ctx context.Context) []awstypes.S3Tag {
 	if inContext, ok := tftags.FromContext(ctx); ok {
 		if tags := Tags(inContext.TagsIn.UnwrapOrDefault()); len(tags) > 0 {
 			return tags
@@ -52,7 +52,7 @@ func getTagsIn(ctx context.Context) []*s3control.S3Tag {
 }
 
 // setTagsOut sets s3control service tags in Context.
-func setTagsOut(ctx context.Context, tags []*s3control.S3Tag) {
+func setTagsOut(ctx context.Context, tags []awstypes.S3Tag) {
 	if inContext, ok := tftags.FromContext(ctx); ok {
 		inContext.TagsOut = types.Some(KeyValueTags(ctx, tags))
 	}
diff --git a/internal/service/s3control/validate.go b/internal/service/s3control/validate.go
index b7f0af1d942..cffefd44ee9 100644
--- a/internal/service/s3control/validate.go
+++ b/internal/service/s3control/validate.go
@@ -1,8 +1,12 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3control
 
 import (
 	"fmt"
-	"regexp"
+
+	"github.com/YakDriver/regexache"
 )
 
 func validateS3MultiRegionAccessPointName(v interface{}, k string) (ws []string, errors []error) {
@@ -11,15 +15,15 @@ func validateS3MultiRegionAccessPointName(v interface{}, k string) (ws []string,
 		errors = append(errors, fmt.Errorf(
 			"%q cannot be less than 3 or longer than 50 characters", k))
 	}
-	if regexp.MustCompile(`_|[A-Z]|\.`).MatchString(value) {
+	if regexache.MustCompile(`_|[A-Z]|\.`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"cannot contain underscores, uppercase letters, or periods. %q", k))
 	}
-	if regexp.MustCompile(`^-`).MatchString(value) {
+	if regexache.MustCompile(`^-`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"%q cannot begin with a hyphen", k))
 	}
-	if regexp.MustCompile(`-$`).MatchString(value) {
+	if regexache.MustCompile(`-$`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"%q cannot end with a hyphen", k))
 	}
diff --git a/internal/service/s3outposts/endpoint.go b/internal/service/s3outposts/endpoint.go
index ebb12380245..0e4fba2c01d 100644
--- a/internal/service/s3outposts/endpoint.go
+++ b/internal/service/s3outposts/endpoint.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3outposts
 
 import (
diff --git a/internal/service/s3outposts/endpoint_test.go b/internal/service/s3outposts/endpoint_test.go
index 760a82b0934..4a17603c820 100644
--- a/internal/service/s3outposts/endpoint_test.go
+++ b/internal/service/s3outposts/endpoint_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package s3outposts_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/s3outposts"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -32,7 +35,7 @@ func TestAccS3OutpostsEndpoint_basic(t *testing.T) {
 				Config: testAccEndpointConfig_basic(rName, rInt),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckEndpointExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "s3-outposts", regexp.MustCompile(`outpost/[^/]+/endpoint/[a-z0-9]+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "s3-outposts", regexache.MustCompile(`outpost/[^/]+/endpoint/[0-9a-z]+`)),
 					resource.TestCheckResourceAttrSet(resourceName, "creation_time"),
 					resource.TestCheckResourceAttrPair(resourceName, "cidr_block", "aws_vpc.test", "cidr_block"),
 					resource.TestCheckResourceAttr(resourceName, "network_interfaces.#", "4"),
@@ -68,7 +71,7 @@ func TestAccS3OutpostsEndpoint_private(t *testing.T) {
 				Config: testAccEndpointConfig_private(rName, rInt),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckEndpointExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "s3-outposts", regexp.MustCompile(`outpost/[^/]+/endpoint/[a-z0-9]+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "s3-outposts", regexache.MustCompile(`outpost/[^/]+/endpoint/[0-9a-z]+`)),
 					resource.TestCheckResourceAttrSet(resourceName, "creation_time"),
 					resource.TestCheckResourceAttrPair(resourceName, "cidr_block", "aws_vpc.test", "cidr_block"),
 					resource.TestCheckResourceAttr(resourceName, "network_interfaces.#", "4"),
@@ -104,7 +107,7 @@ func TestAccS3OutpostsEndpoint_customerOwnedIPv4Pool(t *testing.T) {
 				Config: testAccEndpointConfig_customerOwnedIPv4Pool(rName, rInt),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckEndpointExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "s3-outposts", regexp.MustCompile(`outpost/[^/]+/endpoint/[a-z0-9]+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "s3-outposts", regexache.MustCompile(`outpost/[^/]+/endpoint/[0-9a-z]+`)),
 					resource.TestCheckResourceAttrSet(resourceName, "creation_time"),
 					resource.TestCheckResourceAttrPair(resourceName, "cidr_block", "aws_vpc.test", "cidr_block"),
 					resource.TestCheckResourceAttr(resourceName, "network_interfaces.#", "4"),
@@ -112,7 +115,7 @@ func TestAccS3OutpostsEndpoint_customerOwnedIPv4Pool(t *testing.T) {
 					resource.TestCheckResourceAttrPair(resourceName, "security_group_id", "aws_security_group.test", "id"),
 					resource.TestCheckResourceAttrPair(resourceName, "subnet_id", "aws_subnet.test", "id"),
 					resource.TestCheckResourceAttr(resourceName, "access_type", "CustomerOwnedIp"),
-					resource.TestMatchResourceAttr(resourceName, "customer_owned_ipv4_pool", regexp.MustCompile(`^ipv4pool-coip-.+$`)),
+					resource.TestMatchResourceAttr(resourceName, "customer_owned_ipv4_pool", regexache.MustCompile(`^ipv4pool-coip-.+$`)),
 				),
 			},
 			{
diff --git a/internal/service/s3outposts/generate.go b/internal/service/s3outposts/generate.go
index 9a48994e17d..d20c5a7e9f1 100644
--- a/internal/service/s3outposts/generate.go
+++ b/internal/service/s3outposts/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
 
diff --git a/internal/service/s3outposts/service_package_gen.go b/internal/service/s3outposts/service_package_gen.go
index 25bb437399f..74b107c3dfe 100644
--- a/internal/service/s3outposts/service_package_gen.go
+++ b/internal/service/s3outposts/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	s3outposts_sdkv1 "github.com/aws/aws-sdk-go/service/s3outposts"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -46,4 +47,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*s
 	return s3outposts_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/sagemaker/app.go b/internal/service/sagemaker/app.go
index 589bae48b1f..f21b31673c6 100644
--- a/internal/service/sagemaker/app.go
+++ b/internal/service/sagemaker/app.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sagemaker
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"strings"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/aws/aws-sdk-go/service/sagemaker"
@@ -45,7 +48,7 @@ func ResourceApp() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 63),
-					validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9](-*[a-zA-Z0-9]){0,62}`), "Valid characters are a-z, A-Z, 0-9, and - (hyphen)."),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z](-*[0-9A-Za-z]){0,62}`), "Valid characters are a-z, A-Z, 0-9, and - (hyphen)."),
 				),
 			},
 			"app_type": {
diff --git a/internal/service/sagemaker/app_image_config.go b/internal/service/sagemaker/app_image_config.go
index ee746a3ca7f..4673e7557f7 100644
--- a/internal/service/sagemaker/app_image_config.go
+++ b/internal/service/sagemaker/app_image_config.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sagemaker
 
 import (
 	"context"
 	"log"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/sagemaker"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -41,7 +44,7 @@ func ResourceAppImageConfig() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 63),
-					validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9](-*[a-zA-Z0-9])*$`), "Valid characters are a-z, A-Z, 0-9, and - (hyphen)."),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z](-*[0-9A-Za-z])*$`), "Valid characters are a-z, A-Z, 0-9, and - (hyphen)."),
 				),
 			},
 			"kernel_gateway_image_config": {
@@ -74,7 +77,7 @@ func ResourceAppImageConfig() *schema.Resource {
 										Default:  "/home/sagemaker-user",
 										ValidateFunc: validation.All(
 											validation.StringLenBetween(1, 1024),
-											validation.StringMatch(regexp.MustCompile(`^\/.*`), "Must start with `/`."),
+											validation.StringMatch(regexache.MustCompile(`^\/.*`), "Must start with `/`."),
 										),
 									},
 								},
diff --git a/internal/service/sagemaker/app_image_config_test.go b/internal/service/sagemaker/app_image_config_test.go
index 19c7d6e591d..cafe600c64b 100644
--- a/internal/service/sagemaker/app_image_config_test.go
+++ b/internal/service/sagemaker/app_image_config_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sagemaker_test
 
 import (
diff --git a/internal/service/sagemaker/app_test.go b/internal/service/sagemaker/app_test.go
index 95e57baf931..a9abb8ad942 100644
--- a/internal/service/sagemaker/app_test.go
+++ b/internal/service/sagemaker/app_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sagemaker_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/sagemaker"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -39,7 +42,7 @@ func testAccApp_basic(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "app_name", rName),
 					resource.TestCheckResourceAttrPair(resourceName, "domain_id", "aws_sagemaker_domain.test", "id"),
 					resource.TestCheckResourceAttrPair(resourceName, "user_profile_name", "aws_sagemaker_user_profile.test", "user_profile_name"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "sagemaker", regexp.MustCompile(`app/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "sagemaker", regexache.MustCompile(`app/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "resource_spec.#", "1"),
 					resource.TestCheckResourceAttrSet(resourceName, "resource_spec.0.sagemaker_image_arn"),
 					resource.TestCheckResourceAttr(resourceName, "resource_spec.0.instance_type", "system"),
diff --git a/internal/service/sagemaker/code_repository.go b/internal/service/sagemaker/code_repository.go
index 7771c026a5e..6ca66c66a2e 100644
--- a/internal/service/sagemaker/code_repository.go
+++ b/internal/service/sagemaker/code_repository.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sagemaker
 
 import (
 	"context"
 	"log"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/sagemaker"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -42,7 +45,7 @@ func ResourceCodeRepository() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 63),
-					validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9](-*[a-zA-Z0-9])*$`), "Valid characters are a-z, A-Z, 0-9, and - (hyphen)."),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z](-*[0-9A-Za-z])*$`), "Valid characters are a-z, A-Z, 0-9, and - (hyphen)."),
 				),
 			},
 			"git_config": {
diff --git a/internal/service/sagemaker/code_repository_test.go b/internal/service/sagemaker/code_repository_test.go
index f092dde4ba8..bc21b52b79b 100644
--- a/internal/service/sagemaker/code_repository_test.go
+++ b/internal/service/sagemaker/code_repository_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sagemaker_test
 
 import (
diff --git a/internal/service/sagemaker/consts.go b/internal/service/sagemaker/consts.go
index c1ed618905f..46dd1f56c8d 100644
--- a/internal/service/sagemaker/consts.go
+++ b/internal/service/sagemaker/consts.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sagemaker
 
 import (
diff --git a/internal/service/sagemaker/data_quality_job_definition.go b/internal/service/sagemaker/data_quality_job_definition.go
index 0b835075a28..1a3806466bc 100644
--- a/internal/service/sagemaker/data_quality_job_definition.go
+++ b/internal/service/sagemaker/data_quality_job_definition.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sagemaker
 
 import (
 	"context"
 	"log"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/sagemaker"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -65,7 +68,7 @@ func ResourceDataQualityJobDefinition() *schema.Resource {
 							Optional: true,
 							ForceNew: true,
 							ValidateFunc: validation.All(
-								validation.StringMatch(regexp.MustCompile(`^(https|s3)://([^/])/?(.*)$`), ""),
+								validation.StringMatch(regexache.MustCompile(`^(https|s3)://([^/])/?(.*)$`), ""),
 								validation.StringLenBetween(1, 512),
 							),
 						},
@@ -74,7 +77,7 @@ func ResourceDataQualityJobDefinition() *schema.Resource {
 							Optional: true,
 							ForceNew: true,
 							ValidateFunc: validation.All(
-								validation.StringMatch(regexp.MustCompile(`^(https|s3)://([^/])/?(.*)$`), ""),
+								validation.StringMatch(regexache.MustCompile(`^(https|s3)://([^/])/?(.*)$`), ""),
 								validation.StringLenBetween(1, 512),
 							),
 						},
@@ -100,7 +103,7 @@ func ResourceDataQualityJobDefinition() *schema.Resource {
 										Optional: true,
 										ForceNew: true,
 										ValidateFunc: validation.All(
-											validation.StringMatch(regexp.MustCompile(`^(https|s3)://([^/])/?(.*)$`), ""),
+											validation.StringMatch(regexache.MustCompile(`^(https|s3)://([^/])/?(.*)$`), ""),
 											validation.StringLenBetween(1, 512),
 										),
 									},
@@ -119,7 +122,7 @@ func ResourceDataQualityJobDefinition() *schema.Resource {
 										Optional: true,
 										ForceNew: true,
 										ValidateFunc: validation.All(
-											validation.StringMatch(regexp.MustCompile(`^(https|s3)://([^/])/?(.*)$`), ""),
+											validation.StringMatch(regexache.MustCompile(`^(https|s3)://([^/])/?(.*)$`), ""),
 											validation.StringLenBetween(1, 512),
 										),
 									},
@@ -148,7 +151,7 @@ func ResourceDataQualityJobDefinition() *schema.Resource {
 										Required: true,
 										ForceNew: true,
 										ValidateFunc: validation.All(
-											validation.StringMatch(regexp.MustCompile(`^(https|s3)://([^/])/?(.*)$`), ""),
+											validation.StringMatch(regexache.MustCompile(`^(https|s3)://([^/])/?(.*)$`), ""),
 											validation.StringLenBetween(1, 512),
 										),
 									},
@@ -199,7 +202,7 @@ func ResourceDataQualityJobDefinition() *schema.Resource {
 										ForceNew: true,
 										ValidateFunc: validation.All(
 											validation.StringLenBetween(1, 1024),
-											validation.StringMatch(regexp.MustCompile(`^\/opt\/ml\/processing\/.*`), "Must start with `/opt/ml/processing`."),
+											validation.StringMatch(regexache.MustCompile(`^\/opt\/ml\/processing\/.*`), "Must start with `/opt/ml/processing`."),
 										),
 									},
 									"s3_data_distribution_type": {
@@ -239,7 +242,7 @@ func ResourceDataQualityJobDefinition() *schema.Resource {
 										ForceNew: true,
 										ValidateFunc: validation.All(
 											validation.StringLenBetween(1, 1024),
-											validation.StringMatch(regexp.MustCompile(`^\/opt\/ml\/processing\/.*`), "Must start with `/opt/ml/processing`."),
+											validation.StringMatch(regexache.MustCompile(`^\/opt\/ml\/processing\/.*`), "Must start with `/opt/ml/processing`."),
 										),
 									},
 									"s3_data_distribution_type": {
@@ -296,7 +299,7 @@ func ResourceDataQualityJobDefinition() *schema.Resource {
 													ForceNew: true,
 													ValidateFunc: validation.All(
 														validation.StringLenBetween(1, 1024),
-														validation.StringMatch(regexp.MustCompile(`^\/opt\/ml\/processing\/.*`), "Must start with `/opt/ml/processing`."),
+														validation.StringMatch(regexache.MustCompile(`^\/opt\/ml\/processing\/.*`), "Must start with `/opt/ml/processing`."),
 													),
 												},
 												"s3_upload_mode": {
@@ -311,7 +314,7 @@ func ResourceDataQualityJobDefinition() *schema.Resource {
 													Required: true,
 													ForceNew: true,
 													ValidateFunc: validation.All(
-														validation.StringMatch(regexp.MustCompile(`^(https|s3)://([^/])/?(.*)$`), ""),
+														validation.StringMatch(regexache.MustCompile(`^(https|s3)://([^/])/?(.*)$`), ""),
 														validation.StringLenBetween(1, 512),
 													),
 												},
diff --git a/internal/service/sagemaker/data_quality_job_definition_test.go b/internal/service/sagemaker/data_quality_job_definition_test.go
index 74448342189..d54b4cc1dbc 100644
--- a/internal/service/sagemaker/data_quality_job_definition_test.go
+++ b/internal/service/sagemaker/data_quality_job_definition_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sagemaker_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/sagemaker"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -43,7 +46,7 @@ func TestAccSageMakerDataQualityJobDefinition_endpoint(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "data_quality_job_output_config.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "data_quality_job_output_config.0.monitoring_outputs.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "data_quality_job_output_config.0.monitoring_outputs.0.s3_output.#", "1"),
-					resource.TestMatchResourceAttr(resourceName, "data_quality_job_output_config.0.monitoring_outputs.0.s3_output.0.s3_uri", regexp.MustCompile("output")),
+					resource.TestMatchResourceAttr(resourceName, "data_quality_job_output_config.0.monitoring_outputs.0.s3_output.0.s3_uri", regexache.MustCompile("output")),
 					resource.TestCheckResourceAttr(resourceName, "data_quality_job_output_config.0.monitoring_outputs.0.s3_output.0.s3_upload_mode", "EndOfJob"),
 					resource.TestCheckResourceAttr(resourceName, "job_resources.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "job_resources.0.cluster_config.#", "1"),
@@ -86,8 +89,8 @@ func TestAccSageMakerDataQualityJobDefinition_appSpecificationOptional(t *testin
 					resource.TestCheckResourceAttrPair(resourceName, "data_quality_app_specification.0.image_uri", "data.aws_sagemaker_prebuilt_ecr_image.monitor", "registry_path"),
 					resource.TestCheckResourceAttr(resourceName, "data_quality_app_specification.0.environment.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "data_quality_app_specification.0.environment.foo", "bar"),
-					resource.TestMatchResourceAttr(resourceName, "data_quality_app_specification.0.record_preprocessor_source_uri", regexp.MustCompile("pre.sh")),
-					resource.TestMatchResourceAttr(resourceName, "data_quality_app_specification.0.post_analytics_processor_source_uri", regexp.MustCompile("post.sh")),
+					resource.TestMatchResourceAttr(resourceName, "data_quality_app_specification.0.record_preprocessor_source_uri", regexache.MustCompile("pre.sh")),
+					resource.TestMatchResourceAttr(resourceName, "data_quality_app_specification.0.post_analytics_processor_source_uri", regexache.MustCompile("post.sh")),
 				),
 			},
 			{
@@ -117,9 +120,9 @@ func TestAccSageMakerDataQualityJobDefinition_baselineConfig(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "data_quality_baseline_config.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "data_quality_baseline_config.0.constraints_resource.#", "1"),
-					resource.TestMatchResourceAttr(resourceName, "data_quality_baseline_config.0.constraints_resource.0.s3_uri", regexp.MustCompile("constraints")),
+					resource.TestMatchResourceAttr(resourceName, "data_quality_baseline_config.0.constraints_resource.0.s3_uri", regexache.MustCompile("constraints")),
 					resource.TestCheckResourceAttr(resourceName, "data_quality_baseline_config.0.statistics_resource.#", "1"),
-					resource.TestMatchResourceAttr(resourceName, "data_quality_baseline_config.0.statistics_resource.0.s3_uri", regexp.MustCompile("statistics")),
+					resource.TestMatchResourceAttr(resourceName, "data_quality_baseline_config.0.statistics_resource.0.s3_uri", regexache.MustCompile("statistics")),
 				),
 			},
 			{
@@ -148,7 +151,7 @@ func TestAccSageMakerDataQualityJobDefinition_batchTransform(t *testing.T) {
 					testAccCheckDataQualityJobDefinitionExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "data_quality_job_input.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "data_quality_job_input.0.batch_transform_input.#", "1"),
-					resource.TestMatchResourceAttr(resourceName, "data_quality_job_input.0.batch_transform_input.0.data_captured_destination_s3_uri", regexp.MustCompile("captured")),
+					resource.TestMatchResourceAttr(resourceName, "data_quality_job_input.0.batch_transform_input.0.data_captured_destination_s3_uri", regexache.MustCompile("captured")),
 					resource.TestCheckResourceAttr(resourceName, "data_quality_job_input.0.batch_transform_input.0.dataset_format.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "data_quality_job_input.0.batch_transform_input.0.dataset_format.0.csv.#", "1"),
 				),
@@ -238,7 +241,7 @@ func TestAccSageMakerDataQualityJobDefinition_batchTransformJSONLine(t *testing.
 					testAccCheckDataQualityJobDefinitionExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "data_quality_job_input.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "data_quality_job_input.0.batch_transform_input.#", "1"),
-					resource.TestMatchResourceAttr(resourceName, "data_quality_job_input.0.batch_transform_input.0.data_captured_destination_s3_uri", regexp.MustCompile("captured")),
+					resource.TestMatchResourceAttr(resourceName, "data_quality_job_input.0.batch_transform_input.0.data_captured_destination_s3_uri", regexache.MustCompile("captured")),
 					resource.TestCheckResourceAttr(resourceName, "data_quality_job_input.0.batch_transform_input.0.dataset_format.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "data_quality_job_input.0.batch_transform_input.0.dataset_format.0.json.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "data_quality_job_input.0.batch_transform_input.0.dataset_format.0.json.0.line", "true"),
diff --git a/internal/service/sagemaker/device.go b/internal/service/sagemaker/device.go
index 5b7e76d9702..81b4f2f0e75 100644
--- a/internal/service/sagemaker/device.go
+++ b/internal/service/sagemaker/device.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sagemaker
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"strings"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/sagemaker"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -44,7 +47,7 @@ func ResourceDevice() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 63),
-					validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9](-*[a-zA-Z0-9]){0,62}$`), "Valid characters are a-z, A-Z, 0-9, and - (hyphen)."),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z](-*[0-9A-Za-z]){0,62}$`), "Valid characters are a-z, A-Z, 0-9, and - (hyphen)."),
 				),
 			},
 			"device": {
diff --git a/internal/service/sagemaker/device_fleet.go b/internal/service/sagemaker/device_fleet.go
index 4144c32ab1e..2225f48e24b 100644
--- a/internal/service/sagemaker/device_fleet.go
+++ b/internal/service/sagemaker/device_fleet.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sagemaker
 
 import (
 	"context"
 	"log"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/sagemaker"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -48,7 +51,7 @@ func ResourceDeviceFleet() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 63),
-					validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9](-*[a-zA-Z0-9]){0,62}$`), "Valid characters are a-z, A-Z, 0-9, and - (hyphen)."),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z](-*[0-9A-Za-z]){0,62}$`), "Valid characters are a-z, A-Z, 0-9, and - (hyphen)."),
 				),
 			},
 			"enable_iot_role_alias": {
diff --git a/internal/service/sagemaker/device_fleet_test.go b/internal/service/sagemaker/device_fleet_test.go
index 6ece44f1129..a619d50166b 100644
--- a/internal/service/sagemaker/device_fleet_test.go
+++ b/internal/service/sagemaker/device_fleet_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sagemaker_test
 
 import (
@@ -213,11 +216,6 @@ resource "aws_s3_bucket" "test" {
   force_destroy = true
 }
 
-resource "aws_s3_bucket_acl" "test" {
-  bucket = aws_s3_bucket.test.id
-  acl    = "private"
-}
-
 data "aws_partition" "current" {}
 
 resource "aws_iam_role" "test" {
diff --git a/internal/service/sagemaker/device_test.go b/internal/service/sagemaker/device_test.go
index 9c1791521f3..44004828543 100644
--- a/internal/service/sagemaker/device_test.go
+++ b/internal/service/sagemaker/device_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sagemaker_test
 
 import (
@@ -199,11 +202,6 @@ resource "aws_s3_bucket" "test" {
   force_destroy = true
 }
 
-resource "aws_s3_bucket_acl" "test" {
-  bucket = aws_s3_bucket.test.id
-  acl    = "private"
-}
-
 data "aws_partition" "current" {}
 
 resource "aws_iam_role" "test" {
diff --git a/internal/service/sagemaker/domain.go b/internal/service/sagemaker/domain.go
index 904a526ff02..d0f780cdfc2 100644
--- a/internal/service/sagemaker/domain.go
+++ b/internal/service/sagemaker/domain.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sagemaker
 
 import (
 	"context"
 	"log"
-	"regexp"
 	"strings"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/aws/aws-sdk-go/service/sagemaker"
@@ -260,6 +263,27 @@ func ResourceDomain() *schema.Resource {
 											},
 										},
 									},
+									"workspace_settings": {
+										Type:     schema.TypeList,
+										Optional: true,
+										MaxItems: 1,
+										Elem: &schema.Resource{
+											Schema: map[string]*schema.Schema{
+												"s3_artifact_path": {
+													Type:     schema.TypeString,
+													Optional: true,
+													ValidateFunc: validation.All(
+														validation.StringMatch(regexache.MustCompile(`^(https|s3)://([^/])/?(.*)$`), ""),
+														validation.StringLenBetween(1, 1024),
+													),
+												},
+												"s3_kms_key_id": {
+													Type:     schema.TypeString,
+													Optional: true,
+												},
+											},
+										},
+									},
 								},
 							},
 						},
@@ -488,9 +512,8 @@ func ResourceDomain() *schema.Resource {
 										ValidateFunc: validation.StringInSlice(sagemaker.NotebookOutputOption_Values(), false),
 									},
 									"s3_kms_key_id": {
-										Type:         schema.TypeString,
-										Optional:     true,
-										ValidateFunc: verify.ValidARN,
+										Type:     schema.TypeString,
+										Optional: true,
 									},
 									"s3_output_path": {
 										Type:     schema.TypeString,
@@ -546,7 +569,7 @@ func ResourceDomain() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 63),
-					validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9](-*[a-zA-Z0-9])*$`), "Valid characters are a-z, A-Z, 0-9, and - (hyphen)."),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z](-*[0-9A-Za-z])*$`), "Valid characters are a-z, A-Z, 0-9, and - (hyphen)."),
 				),
 			},
 			"domain_settings": {
@@ -626,10 +649,9 @@ func ResourceDomain() *schema.Resource {
 				Computed: true,
 			},
 			"kms_key_id": {
-				Type:         schema.TypeString,
-				ForceNew:     true,
-				Optional:     true,
-				ValidateFunc: verify.ValidARN,
+				Type:     schema.TypeString,
+				ForceNew: true,
+				Optional: true,
 			},
 			"retention_policy": {
 				Type:     schema.TypeList,
@@ -1134,6 +1156,7 @@ func expandCanvasAppSettings(l []interface{}) *sagemaker.CanvasAppSettings {
 	config := &sagemaker.CanvasAppSettings{
 		ModelRegisterSettings:         expandModelRegisterSettings(m["model_register_settings"].([]interface{})),
 		TimeSeriesForecastingSettings: expandTimeSeriesForecastingSettings(m["time_series_forecasting_settings"].([]interface{})),
+		WorkspaceSettings:             expandWorkspaceSettings(m["workspace_settings"].([]interface{})),
 	}
 
 	return config
@@ -1179,6 +1202,26 @@ func expandTimeSeriesForecastingSettings(l []interface{}) *sagemaker.TimeSeriesF
 	return config
 }
 
+func expandWorkspaceSettings(l []interface{}) *sagemaker.WorkspaceSettings {
+	if len(l) == 0 || l[0] == nil {
+		return nil
+	}
+
+	m := l[0].(map[string]interface{})
+
+	config := &sagemaker.WorkspaceSettings{}
+
+	if v, ok := m["s3_artifact_path"].(string); ok && v != "" {
+		config.S3ArtifactPath = aws.String(v)
+	}
+
+	if v, ok := m["s3_kms_key_id"].(string); ok && v != "" {
+		config.S3KmsKeyId = aws.String(v)
+	}
+
+	return config
+}
+
 func expandDomainCustomImages(l []interface{}) []*sagemaker.CustomImage {
 	images := make([]*sagemaker.CustomImage, 0, len(l))
 
@@ -1394,6 +1437,7 @@ func flattenCanvasAppSettings(config *sagemaker.CanvasAppSettings) []map[string]
 	m := map[string]interface{}{
 		"time_series_forecasting_settings": flattenTimeSeriesForecastingSettings(config.TimeSeriesForecastingSettings),
 		"model_register_settings":          flattenModelRegisterSettings(config.ModelRegisterSettings),
+		"workspace_settings":               flattenWorkspaceSettings(config.WorkspaceSettings),
 	}
 
 	return []map[string]interface{}{m}
@@ -1425,6 +1469,19 @@ func flattenTimeSeriesForecastingSettings(config *sagemaker.TimeSeriesForecastin
 	return []map[string]interface{}{m}
 }
 
+func flattenWorkspaceSettings(config *sagemaker.WorkspaceSettings) []map[string]interface{} {
+	if config == nil {
+		return []map[string]interface{}{}
+	}
+
+	m := map[string]interface{}{
+		"s3_artifact_path": aws.StringValue(config.S3ArtifactPath),
+		"s3_kms_key_id":    aws.StringValue(config.S3KmsKeyId),
+	}
+
+	return []map[string]interface{}{m}
+}
+
 func flattenDomainSettings(config *sagemaker.DomainSettings) []map[string]interface{} {
 	if config == nil {
 		return []map[string]interface{}{}
diff --git a/internal/service/sagemaker/domain_test.go b/internal/service/sagemaker/domain_test.go
index 18aa72290f6..53dcf4f7a0f 100644
--- a/internal/service/sagemaker/domain_test.go
+++ b/internal/service/sagemaker/domain_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sagemaker_test
 
 import (
 	"context"
 	"fmt"
 	"os"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/sagemaker"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -41,7 +44,7 @@ func testAccDomain_basic(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "default_space_settings.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "default_user_settings.#", "1"),
 					resource.TestCheckResourceAttrPair(resourceName, "default_user_settings.0.execution_role", "aws_iam_role.test", "arn"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "sagemaker", regexp.MustCompile(`domain/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "sagemaker", regexache.MustCompile(`domain/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 					resource.TestCheckResourceAttrPair(resourceName, "vpc_id", "aws_vpc.test", "id"),
 					resource.TestCheckResourceAttrSet(resourceName, "url"),
@@ -113,7 +116,7 @@ func testAccDomain_kms(t *testing.T) {
 				Config: testAccDomainConfig_kms(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDomainExists(ctx, resourceName, &domain),
-					resource.TestCheckResourceAttrPair(resourceName, "kms_key_id", "aws_kms_key.test", "arn"),
+					resource.TestCheckResourceAttrPair(resourceName, "kms_key_id", "aws_kms_key.test", "key_id"),
 				),
 			},
 			{
@@ -230,7 +233,7 @@ func testAccDomain_sharingSettings(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "default_user_settings.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "default_user_settings.0.sharing_settings.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "default_user_settings.0.sharing_settings.0.notebook_output_option", "Allowed"),
-					resource.TestCheckResourceAttrPair(resourceName, "default_user_settings.0.sharing_settings.0.s3_kms_key_id", "aws_kms_key.test", "arn"),
+					resource.TestCheckResourceAttrPair(resourceName, "default_user_settings.0.sharing_settings.0.s3_kms_key_id", "aws_kms_key.test", "key_id"),
 					resource.TestCheckResourceAttrSet(resourceName, "default_user_settings.0.sharing_settings.0.s3_output_path"),
 				),
 			},
@@ -308,6 +311,38 @@ func testAccDomain_modelRegisterSettings(t *testing.T) {
 	})
 }
 
+func testAccDomain_workspaceSettings(t *testing.T) {
+	ctx := acctest.Context(t)
+	var domain sagemaker.DescribeDomainOutput
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_sagemaker_domain.test"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, sagemaker.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckDomainDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccDomainConfig_workspaceSettings(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckDomainExists(ctx, resourceName, &domain),
+					resource.TestCheckResourceAttr(resourceName, "default_user_settings.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "default_user_settings.0.canvas_app_settings.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "default_user_settings.0.canvas_app_settings.0.workspace_settings.#", "1"),
+					resource.TestCheckResourceAttrSet(resourceName, "default_user_settings.0.canvas_app_settings.0.workspace_settings.0.s3_artifact_path"),
+				),
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"retention_policy"},
+			},
+		},
+	})
+}
+
 func testAccDomain_tensorboardAppSettings(t *testing.T) {
 	ctx := acctest.Context(t)
 	var domain sagemaker.DescribeDomainOutput
@@ -696,7 +731,7 @@ func testAccDomain_defaultUserSettingsUpdated(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "subnet_ids.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "default_user_settings.#", "1"),
 					resource.TestCheckResourceAttrPair(resourceName, "default_user_settings.0.execution_role", "aws_iam_role.test", "arn"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "sagemaker", regexp.MustCompile(`domain/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "sagemaker", regexache.MustCompile(`domain/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 					resource.TestCheckResourceAttrPair(resourceName, "vpc_id", "aws_vpc.test", "id"),
 					resource.TestCheckResourceAttrSet(resourceName, "url"),
@@ -716,7 +751,7 @@ func testAccDomain_defaultUserSettingsUpdated(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "default_user_settings.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "default_user_settings.0.sharing_settings.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "default_user_settings.0.sharing_settings.0.notebook_output_option", "Allowed"),
-					resource.TestCheckResourceAttrPair(resourceName, "default_user_settings.0.sharing_settings.0.s3_kms_key_id", "aws_kms_key.test", "arn"),
+					resource.TestCheckResourceAttrPair(resourceName, "default_user_settings.0.sharing_settings.0.s3_kms_key_id", "aws_kms_key.test", "key_id"),
 					resource.TestCheckResourceAttrSet(resourceName, "default_user_settings.0.sharing_settings.0.s3_output_path"),
 				),
 			},
@@ -919,7 +954,7 @@ resource "aws_sagemaker_domain" "test" {
   auth_mode   = "IAM"
   vpc_id      = aws_vpc.test.id
   subnet_ids  = aws_subnet.test[*].id
-  kms_key_id  = aws_kms_key.test.arn
+  kms_key_id  = aws_kms_key.test.key_id
 
   default_user_settings {
     execution_role = aws_iam_role.test.arn
@@ -1063,7 +1098,7 @@ resource "aws_sagemaker_domain" "test" {
 
     sharing_settings {
       notebook_output_option = "Allowed"
-      s3_kms_key_id          = aws_kms_key.test.arn
+      s3_kms_key_id          = aws_kms_key.test.key_id
       s3_output_path         = "s3://${aws_s3_bucket.test.bucket}/sharing"
     }
   }
@@ -1125,6 +1160,36 @@ resource "aws_sagemaker_domain" "test" {
 `, rName))
 }
 
+func testAccDomainConfig_workspaceSettings(rName string) string {
+	return acctest.ConfigCompose(testAccDomainConfig_base(rName), fmt.Sprintf(`
+resource "aws_s3_bucket" "test" {
+  bucket        = %[1]q
+  force_destroy = true
+}
+
+resource "aws_sagemaker_domain" "test" {
+  domain_name = %[1]q
+  auth_mode   = "IAM"
+  vpc_id      = aws_vpc.test.id
+  subnet_ids  = aws_subnet.test[*].id
+
+  default_user_settings {
+    execution_role = aws_iam_role.test.arn
+
+    canvas_app_settings {
+      workspace_settings {
+        s3_artifact_path = "s3://${aws_s3_bucket.test.bucket}/path"
+      }
+    }
+  }
+
+  retention_policy {
+    home_efs_file_system = "Delete"
+  }
+}
+`, rName))
+}
+
 func testAccDomainConfig_tensorBoardAppSettings(rName string) string {
 	return acctest.ConfigCompose(testAccDomainConfig_base(rName), fmt.Sprintf(`
 resource "aws_sagemaker_domain" "test" {
diff --git a/internal/service/sagemaker/endpoint.go b/internal/service/sagemaker/endpoint.go
index 388770d1775..cb4f9322a72 100644
--- a/internal/service/sagemaker/endpoint.go
+++ b/internal/service/sagemaker/endpoint.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sagemaker
 
 import (
@@ -68,8 +71,12 @@ func ResourceEndpoint() *schema.Resource {
 						},
 						"blue_green_update_policy": {
 							Type:     schema.TypeList,
-							Required: true,
+							Optional: true,
 							MaxItems: 1,
+							ExactlyOneOf: []string{
+								"deployment_config.0.blue_green_update_policy",
+								"deployment_config.0.rolling_update_policy",
+							},
 							Elem: &schema.Resource{
 								Schema: map[string]*schema.Schema{
 									"maximum_execution_timeout_in_seconds": {
@@ -143,6 +150,67 @@ func ResourceEndpoint() *schema.Resource {
 								},
 							},
 						},
+						"rolling_update_policy": {
+							Type:     schema.TypeList,
+							Optional: true,
+							MaxItems: 1,
+							ExactlyOneOf: []string{
+								"deployment_config.0.blue_green_update_policy",
+								"deployment_config.0.rolling_update_policy",
+							},
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"maximum_batch_size": {
+										Type:     schema.TypeList,
+										Required: true,
+										MaxItems: 1,
+										Elem: &schema.Resource{
+											Schema: map[string]*schema.Schema{
+												"type": {
+													Type:         schema.TypeString,
+													Required:     true,
+													ValidateFunc: validation.StringInSlice(sagemaker.CapacitySizeType_Values(), false),
+												},
+												"value": {
+													Type:         schema.TypeInt,
+													Required:     true,
+													ValidateFunc: validation.IntAtLeast(1),
+												},
+											},
+										},
+									},
+									"maximum_execution_timeout_in_seconds": {
+										Type:         schema.TypeInt,
+										Optional:     true,
+										ValidateFunc: validation.IntBetween(600, 14400),
+									},
+									"rollback_maximum_batch_size": {
+										Type:     schema.TypeList,
+										Optional: true,
+										MaxItems: 1,
+										Elem: &schema.Resource{
+											Schema: map[string]*schema.Schema{
+												"type": {
+													Type:         schema.TypeString,
+													Required:     true,
+													ValidateFunc: validation.StringInSlice(sagemaker.CapacitySizeType_Values(), false),
+												},
+												"value": {
+													Type:         schema.TypeInt,
+													Required:     true,
+													ValidateFunc: validation.IntAtLeast(1),
+												},
+											},
+										},
+									},
+									"wait_interval_in_seconds": {
+										Type:         schema.TypeInt,
+										Required:     true,
+										ValidateFunc: validation.IntBetween(0, 3600),
+									},
+								},
+							},
+						},
 					},
 				},
 			},
@@ -310,6 +378,10 @@ func expandEndpointDeploymentConfig(configured []interface{}) *sagemaker.Deploym
 		c.AutoRollbackConfiguration = expandEndpointDeploymentConfigAutoRollbackConfig(v)
 	}
 
+	if v, ok := m["rolling_update_policy"].([]interface{}); ok && len(v) > 0 {
+		c.RollingUpdatePolicy = expandEndpointDeploymentConfigRollingUpdatePolicy(v)
+	}
+
 	return c
 }
 
@@ -326,6 +398,10 @@ func flattenEndpointDeploymentConfig(configured *sagemaker.DeploymentConfig) []m
 		cfg["auto_rollback_configuration"] = flattenEndpointDeploymentConfigAutoRollbackConfig(configured.AutoRollbackConfiguration)
 	}
 
+	if configured.RollingUpdatePolicy != nil {
+		cfg["rolling_update_policy"] = flattenEndpointDeploymentConfigRollingUpdatePolicy(configured.RollingUpdatePolicy)
+	}
+
 	return []map[string]interface{}{cfg}
 }
 
@@ -378,11 +454,11 @@ func expandEndpointDeploymentConfigTrafficRoutingConfiguration(configured []inte
 	}
 
 	if v, ok := m["canary_size"].([]interface{}); ok && len(v) > 0 {
-		c.CanarySize = expandEndpointDeploymentConfigTrafficRoutingConfigurationCapacitySize(v)
+		c.CanarySize = expandEndpointDeploymentCapacitySize(v)
 	}
 
 	if v, ok := m["linear_step_size"].([]interface{}); ok && len(v) > 0 {
-		c.LinearStepSize = expandEndpointDeploymentConfigTrafficRoutingConfigurationCapacitySize(v)
+		c.LinearStepSize = expandEndpointDeploymentCapacitySize(v)
 	}
 
 	return c
@@ -399,17 +475,17 @@ func flattenEndpointDeploymentConfigTrafficRoutingConfiguration(configured *sage
 	}
 
 	if configured.CanarySize != nil {
-		cfg["canary_size"] = flattenEndpointDeploymentConfigTrafficRoutingConfigurationCapacitySize(configured.CanarySize)
+		cfg["canary_size"] = flattenEndpointDeploymentCapacitySize(configured.CanarySize)
 	}
 
 	if configured.LinearStepSize != nil {
-		cfg["linear_step_size"] = flattenEndpointDeploymentConfigTrafficRoutingConfigurationCapacitySize(configured.LinearStepSize)
+		cfg["linear_step_size"] = flattenEndpointDeploymentCapacitySize(configured.LinearStepSize)
 	}
 
 	return []map[string]interface{}{cfg}
 }
 
-func expandEndpointDeploymentConfigTrafficRoutingConfigurationCapacitySize(configured []interface{}) *sagemaker.CapacitySize {
+func expandEndpointDeploymentCapacitySize(configured []interface{}) *sagemaker.CapacitySize {
 	if len(configured) == 0 {
 		return nil
 	}
@@ -424,7 +500,7 @@ func expandEndpointDeploymentConfigTrafficRoutingConfigurationCapacitySize(confi
 	return c
 }
 
-func flattenEndpointDeploymentConfigTrafficRoutingConfigurationCapacitySize(configured *sagemaker.CapacitySize) []map[string]interface{} {
+func flattenEndpointDeploymentCapacitySize(configured *sagemaker.CapacitySize) []map[string]interface{} {
 	if configured == nil {
 		return []map[string]interface{}{}
 	}
@@ -463,6 +539,47 @@ func flattenEndpointDeploymentConfigAutoRollbackConfig(configured *sagemaker.Aut
 	return []map[string]interface{}{cfg}
 }
 
+func expandEndpointDeploymentConfigRollingUpdatePolicy(configured []interface{}) *sagemaker.RollingUpdatePolicy {
+	if len(configured) == 0 {
+		return nil
+	}
+
+	m := configured[0].(map[string]interface{})
+
+	c := &sagemaker.RollingUpdatePolicy{
+		WaitIntervalInSeconds: aws.Int64(int64(m["wait_interval_in_seconds"].(int))),
+	}
+
+	if v, ok := m["maximum_execution_timeout_in_seconds"].(int); ok && v > 0 {
+		c.MaximumExecutionTimeoutInSeconds = aws.Int64(int64(v))
+	}
+
+	if v, ok := m["maximum_batch_size"].([]interface{}); ok && len(v) > 0 {
+		c.MaximumBatchSize = expandEndpointDeploymentCapacitySize(v)
+	}
+
+	if v, ok := m["rollback_maximum_batch_size"].([]interface{}); ok && len(v) > 0 {
+		c.RollbackMaximumBatchSize = expandEndpointDeploymentCapacitySize(v)
+	}
+
+	return c
+}
+
+func flattenEndpointDeploymentConfigRollingUpdatePolicy(configured *sagemaker.RollingUpdatePolicy) []map[string]interface{} {
+	if configured == nil {
+		return []map[string]interface{}{}
+	}
+
+	cfg := map[string]interface{}{
+		"maximum_execution_timeout_in_seconds": aws.Int64Value(configured.MaximumExecutionTimeoutInSeconds),
+		"wait_interval_in_seconds":             aws.Int64Value(configured.WaitIntervalInSeconds),
+		"maximum_batch_size":                   flattenEndpointDeploymentCapacitySize(configured.MaximumBatchSize),
+		"rollback_maximum_batch_size":          flattenEndpointDeploymentCapacitySize(configured.RollbackMaximumBatchSize),
+	}
+
+	return []map[string]interface{}{cfg}
+}
+
 func expandEndpointDeploymentConfigAutoRollbackConfigAlarms(configured []interface{}) []*sagemaker.Alarm {
 	if len(configured) == 0 {
 		return nil
diff --git a/internal/service/sagemaker/endpoint_configuration.go b/internal/service/sagemaker/endpoint_configuration.go
index ad3390087c6..aaadb9512a2 100644
--- a/internal/service/sagemaker/endpoint_configuration.go
+++ b/internal/service/sagemaker/endpoint_configuration.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sagemaker
 
 import (
 	"context"
 	"log"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/sagemaker"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -111,7 +114,7 @@ func ResourceEndpointConfiguration() *schema.Resource {
 										Optional: true,
 										ForceNew: true,
 										ValidateFunc: validation.All(
-											validation.StringMatch(regexp.MustCompile(`^(https|s3)://([^/])/?(.*)$`), ""),
+											validation.StringMatch(regexache.MustCompile(`^(https|s3)://([^/])/?(.*)$`), ""),
 											validation.StringLenBetween(1, 512),
 										),
 									},
@@ -120,7 +123,7 @@ func ResourceEndpointConfiguration() *schema.Resource {
 										Required: true,
 										ForceNew: true,
 										ValidateFunc: validation.All(
-											validation.StringMatch(regexp.MustCompile(`^(https|s3)://([^/])/?(.*)$`), ""),
+											validation.StringMatch(regexache.MustCompile(`^(https|s3)://([^/])/?(.*)$`), ""),
 											validation.StringLenBetween(1, 512),
 										),
 									},
@@ -151,7 +154,7 @@ func ResourceEndpointConfiguration() *schema.Resource {
 										Elem: &schema.Schema{
 											Type: schema.TypeString,
 											ValidateFunc: validation.All(
-												validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9](-*[a-zA-Z0-9])*\/[a-zA-Z0-9](-*[a-zA-Z0-9.])*`), ""),
+												validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z](-*[0-9A-Za-z])*\/[0-9A-Za-z](-*[0-9A-Za-z.])*`), ""),
 												validation.StringLenBetween(1, 256),
 											),
 										},
@@ -165,7 +168,7 @@ func ResourceEndpointConfiguration() *schema.Resource {
 										Elem: &schema.Schema{
 											Type: schema.TypeString,
 											ValidateFunc: validation.All(
-												validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9](-*[a-zA-Z0-9])*\/[a-zA-Z0-9](-*[a-zA-Z0-9.])*`), ""),
+												validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z](-*[0-9A-Za-z])*\/[0-9A-Za-z](-*[0-9A-Za-z.])*`), ""),
 												validation.StringLenBetween(1, 256),
 											),
 										},
@@ -197,7 +200,7 @@ func ResourceEndpointConfiguration() *schema.Resource {
 							Required: true,
 							ForceNew: true,
 							ValidateFunc: validation.All(
-								validation.StringMatch(regexp.MustCompile(`^(https|s3)://([^/])/?(.*)$`), ""),
+								validation.StringMatch(regexache.MustCompile(`^(https|s3)://([^/])/?(.*)$`), ""),
 								validation.StringLenBetween(1, 512),
 							),
 						},
@@ -274,7 +277,7 @@ func ResourceEndpointConfiguration() *schema.Resource {
 										Required: true,
 										ForceNew: true,
 										ValidateFunc: validation.All(
-											validation.StringMatch(regexp.MustCompile(`^(https|s3)://([^/])/?(.*)$`), ""),
+											validation.StringMatch(regexache.MustCompile(`^(https|s3)://([^/])/?(.*)$`), ""),
 											validation.StringLenBetween(1, 512),
 										),
 									},
@@ -397,7 +400,7 @@ func ResourceEndpointConfiguration() *schema.Resource {
 										Required: true,
 										ForceNew: true,
 										ValidateFunc: validation.All(
-											validation.StringMatch(regexp.MustCompile(`^(https|s3)://([^/])/?(.*)$`), ""),
+											validation.StringMatch(regexache.MustCompile(`^(https|s3)://([^/])/?(.*)$`), ""),
 											validation.StringLenBetween(1, 512),
 										),
 									},
diff --git a/internal/service/sagemaker/endpoint_configuration_test.go b/internal/service/sagemaker/endpoint_configuration_test.go
index 7c16e37629e..97077b20f8c 100644
--- a/internal/service/sagemaker/endpoint_configuration_test.go
+++ b/internal/service/sagemaker/endpoint_configuration_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sagemaker_test
 
 import (
diff --git a/internal/service/sagemaker/endpoint_test.go b/internal/service/sagemaker/endpoint_test.go
index b7179cb718d..bd7b95f38e7 100644
--- a/internal/service/sagemaker/endpoint_test.go
+++ b/internal/service/sagemaker/endpoint_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sagemaker_test
 
 import (
@@ -168,7 +171,7 @@ func TestAccSageMakerEndpoint_deploymentConfig(t *testing.T) {
 	})
 }
 
-func TestAccSageMakerEndpoint_deploymentConfig_full(t *testing.T) {
+func TestAccSageMakerEndpoint_deploymentConfig_blueGreen(t *testing.T) {
 	ctx := acctest.Context(t)
 	if testing.Short() {
 		t.Skip("skipping long-running test in short mode")
@@ -184,7 +187,7 @@ func TestAccSageMakerEndpoint_deploymentConfig_full(t *testing.T) {
 		CheckDestroy:             testAccCheckEndpointDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccEndpointConfig_deploymentFull(rName),
+				Config: testAccEndpointConfig_deploymentBlueGreen(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckEndpointExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
@@ -201,6 +204,46 @@ func TestAccSageMakerEndpoint_deploymentConfig_full(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "deployment_config.0.blue_green_update_policy.0.traffic_routing_configuration.0.linear_step_size.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "deployment_config.0.blue_green_update_policy.0.traffic_routing_configuration.0.linear_step_size.0.type", "INSTANCE_COUNT"),
 					resource.TestCheckResourceAttr(resourceName, "deployment_config.0.blue_green_update_policy.0.traffic_routing_configuration.0.linear_step_size.0.value", "1"),
+					resource.TestCheckResourceAttr(resourceName, "deployment_config.0.rolling_update_policy.#", "0"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
+func TestAccSageMakerEndpoint_deploymentConfig_rolling(t *testing.T) {
+	ctx := acctest.Context(t)
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_sagemaker_endpoint.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, sagemaker.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckEndpointDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccEndpointConfig_deploymentRolling(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckEndpointExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "name", rName),
+					resource.TestCheckResourceAttr(resourceName, "deployment_config.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "deployment_config.0.auto_rollback_configuration.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "deployment_config.0.auto_rollback_configuration.0.alarms.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "deployment_config.0.blue_green_update_policy.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "deployment_config.0.rolling_update_policy.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "deployment_config.0.rolling_update_policy.0.wait_interval_in_seconds", "60"),
+					resource.TestCheckResourceAttr(resourceName, "deployment_config.0.rolling_update_policy.0.maximum_batch_size.0.type", "CAPACITY_PERCENT"),
+					resource.TestCheckResourceAttr(resourceName, "deployment_config.0.rolling_update_policy.0.maximum_batch_size.0.value", "5"),
 				),
 			},
 			{
@@ -330,11 +373,6 @@ resource "aws_s3_bucket" "test" {
   bucket = %[1]q
 }
 
-resource "aws_s3_bucket_acl" "test" {
-  bucket = aws_s3_bucket.test.id
-  acl    = "private"
-}
-
 resource "aws_s3_object" "test" {
   bucket = aws_s3_bucket.test.id
   key    = "model.tar.gz"
@@ -446,7 +484,7 @@ resource "aws_sagemaker_endpoint" "test" {
 `, rName, tType, wait)
 }
 
-func testAccEndpointConfig_deploymentFull(rName string) string {
+func testAccEndpointConfig_deploymentBlueGreen(rName string) string {
 	return testAccEndpointConfig_Base(rName) + fmt.Sprintf(`
 resource "aws_cloudwatch_metric_alarm" "test" {
   alarm_name                = %[1]q
@@ -491,3 +529,46 @@ resource "aws_sagemaker_endpoint" "test" {
 }
 `, rName)
 }
+
+func testAccEndpointConfig_deploymentRolling(rName string) string {
+	return testAccEndpointConfig_Base(rName) + fmt.Sprintf(`
+resource "aws_cloudwatch_metric_alarm" "test" {
+  alarm_name                = %[1]q
+  comparison_operator       = "GreaterThanOrEqualToThreshold"
+  evaluation_periods        = "2"
+  metric_name               = "CPUUtilization"
+  namespace                 = "AWS/EC2"
+  period                    = "120"
+  statistic                 = "Average"
+  threshold                 = "80"
+  alarm_description         = "This metric monitors ec2 cpu utilization"
+  insufficient_data_actions = []
+
+  dimensions = {
+    InstanceId = "i-abc123"
+  }
+}
+
+resource "aws_sagemaker_endpoint" "test" {
+  endpoint_config_name = aws_sagemaker_endpoint_configuration.test.name
+  name                 = %[1]q
+
+  deployment_config {
+    auto_rollback_configuration {
+      alarms {
+        alarm_name = aws_cloudwatch_metric_alarm.test.alarm_name
+      }
+    }
+
+    rolling_update_policy {
+      wait_interval_in_seconds = 60
+
+      maximum_batch_size {
+        type  = "CAPACITY_PERCENT"
+        value = 5
+      }
+    }
+  }
+}
+`, rName)
+}
diff --git a/internal/service/sagemaker/errors.go b/internal/service/sagemaker/errors.go
index 2eb2da79efe..13e07ff940d 100644
--- a/internal/service/sagemaker/errors.go
+++ b/internal/service/sagemaker/errors.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sagemaker
 
 const (
diff --git a/internal/service/sagemaker/feature_group.go b/internal/service/sagemaker/feature_group.go
index dd287ba214d..c74d84cdc11 100644
--- a/internal/service/sagemaker/feature_group.go
+++ b/internal/service/sagemaker/feature_group.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sagemaker
 
 import (
 	"context"
 	"log"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/sagemaker"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -49,7 +52,7 @@ func ResourceFeatureGroup() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 64),
-					validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9]([-_]*[a-zA-Z0-9]){0,63}`),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z]([-_]*[0-9A-Za-z]){0,63}`),
 						"Must start and end with an alphanumeric character and Can only contains alphanumeric characters, hyphens, underscores. Spaces are not allowed."),
 				),
 			},
@@ -67,7 +70,7 @@ func ResourceFeatureGroup() *schema.Resource {
 							ValidateFunc: validation.All(
 								validation.StringLenBetween(1, 64),
 								validation.StringNotInSlice([]string{"is_deleted", "write_time", "api_invocation_time"}, false),
-								validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9]([-_]*[a-zA-Z0-9]){0,63}`),
+								validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z]([-_]*[0-9A-Za-z]){0,63}`),
 									"Must start and end with an alphanumeric character and Can only contains alphanumeric characters, hyphens, underscores. Spaces are not allowed."),
 							),
 						},
@@ -85,7 +88,7 @@ func ResourceFeatureGroup() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 64),
-					validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9](-*[a-zA-Z0-9]){0,63}`),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z](-*[0-9A-Za-z]){0,63}`),
 						"Must start and end with an alphanumeric character and Can only contain alphanumeric character and hyphens. Spaces are not allowed."),
 				),
 			},
@@ -189,7 +192,7 @@ func ResourceFeatureGroup() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 64),
-					validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9]([-_]*[a-zA-Z0-9]){0,63}`),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z]([-_]*[0-9A-Za-z]){0,63}`),
 						"Must start and end with an alphanumeric character and Can only contains alphanumeric characters, hyphens, underscores. Spaces are not allowed."),
 				),
 			},
diff --git a/internal/service/sagemaker/feature_group_test.go b/internal/service/sagemaker/feature_group_test.go
index cdb517dac04..1bd33832d9d 100644
--- a/internal/service/sagemaker/feature_group_test.go
+++ b/internal/service/sagemaker/feature_group_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sagemaker_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/sagemaker"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -307,7 +310,7 @@ func testAccFeatureGroup_offlineConfig_createCatalog(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "offline_store_config.0.data_catalog_config.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "offline_store_config.0.data_catalog_config.0.catalog", "AwsDataCatalog"),
 					resource.TestCheckResourceAttr(resourceName, "offline_store_config.0.data_catalog_config.0.database", "sagemaker_featurestore"),
-					resource.TestMatchResourceAttr(resourceName, "offline_store_config.0.data_catalog_config.0.table_name", regexp.MustCompile(fmt.Sprintf("^%s-", rName))),
+					resource.TestMatchResourceAttr(resourceName, "offline_store_config.0.data_catalog_config.0.table_name", regexache.MustCompile(fmt.Sprintf("^%s-", rName))),
 				),
 			},
 			{
diff --git a/internal/service/sagemaker/find.go b/internal/service/sagemaker/find.go
index 0b8e37e3083..3fc0e8bd68f 100644
--- a/internal/service/sagemaker/find.go
+++ b/internal/service/sagemaker/find.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sagemaker
 
 import (
@@ -613,3 +616,28 @@ func FindSpaceByName(ctx context.Context, conn *sagemaker.SageMaker, domainId, n
 
 	return output, nil
 }
+
+func FindPipelineByName(ctx context.Context, conn *sagemaker.SageMaker, name string) (*sagemaker.DescribePipelineOutput, error) {
+	input := &sagemaker.DescribePipelineInput{
+		PipelineName: aws.String(name),
+	}
+
+	output, err := conn.DescribePipelineWithContext(ctx, input)
+
+	if tfawserr.ErrCodeEquals(err, sagemaker.ErrCodeResourceNotFound) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	if output == nil {
+		return nil, tfresource.NewEmptyResultError(input)
+	}
+
+	return output, nil
+}
diff --git a/internal/service/sagemaker/flow_definition.go b/internal/service/sagemaker/flow_definition.go
index b0e3b3c069a..6c8eac1712a 100644
--- a/internal/service/sagemaker/flow_definition.go
+++ b/internal/service/sagemaker/flow_definition.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sagemaker
 
 import (
 	"context"
 	"log"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/private/protocol"
 	"github.com/aws/aws-sdk-go/service/sagemaker"
@@ -46,7 +49,7 @@ func ResourceFlowDefinition() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 63),
-					validation.StringMatch(regexp.MustCompile(`^[a-z0-9](-*[a-z0-9])*$`), "Valid characters are a-z, 0-9, and - (hyphen)."),
+					validation.StringMatch(regexache.MustCompile(`^[0-9a-z](-*[0-9a-z])*$`), "Valid characters are a-z, 0-9, and - (hyphen)."),
 				),
 			},
 			"human_loop_activation_config": {
@@ -162,7 +165,7 @@ func ResourceFlowDefinition() *schema.Resource {
 								Type: schema.TypeString,
 								ValidateFunc: validation.All(
 									validation.StringLenBetween(1, 30),
-									validation.StringMatch(regexp.MustCompile(`^[A-Za-z0-9]+( [A-Za-z0-9]+)*$`), ""),
+									validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z]+( [0-9A-Za-z]+)*$`), ""),
 								),
 							},
 						},
@@ -223,7 +226,7 @@ func ResourceFlowDefinition() *schema.Resource {
 							ForceNew: true,
 							Required: true,
 							ValidateFunc: validation.All(
-								validation.StringMatch(regexp.MustCompile(`^(https|s3)://([^/])/?(.*)$`), ""),
+								validation.StringMatch(regexache.MustCompile(`^(https|s3)://([^/])/?(.*)$`), ""),
 								validation.StringLenBetween(1, 512),
 							),
 						},
diff --git a/internal/service/sagemaker/flow_definition_test.go b/internal/service/sagemaker/flow_definition_test.go
index 75ee1b04497..4e0558bda0b 100644
--- a/internal/service/sagemaker/flow_definition_test.go
+++ b/internal/service/sagemaker/flow_definition_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sagemaker_test
 
 import (
diff --git a/internal/service/sagemaker/generate.go b/internal/service/sagemaker/generate.go
index 5946c7d2f98..8d0db66e7bd 100644
--- a/internal/service/sagemaker/generate.go
+++ b/internal/service/sagemaker/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTags -ListTagsOp=ListTags -ServiceTagsSlice -TagOp=AddTags -UntagOp=DeleteTags -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/sagemaker/human_task_ui.go b/internal/service/sagemaker/human_task_ui.go
index b6a2135983e..535cb4d609d 100644
--- a/internal/service/sagemaker/human_task_ui.go
+++ b/internal/service/sagemaker/human_task_ui.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sagemaker
 
 import (
 	"context"
 	"log"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/sagemaker"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -66,7 +69,7 @@ func ResourceHumanTaskUI() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 63),
-					validation.StringMatch(regexp.MustCompile(`^[a-z0-9](-*[a-z0-9])*$`), "Valid characters are a-z, A-Z, 0-9, and - (hyphen)."),
+					validation.StringMatch(regexache.MustCompile(`^[0-9a-z](-*[0-9a-z])*$`), "Valid characters are a-z, A-Z, 0-9, and - (hyphen)."),
 				),
 			},
 			names.AttrTags:    tftags.TagsSchema(),
diff --git a/internal/service/sagemaker/human_task_ui_test.go b/internal/service/sagemaker/human_task_ui_test.go
index cc324c73dc3..8257bab36c3 100644
--- a/internal/service/sagemaker/human_task_ui_test.go
+++ b/internal/service/sagemaker/human_task_ui_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sagemaker_test
 
 import (
diff --git a/internal/service/sagemaker/image.go b/internal/service/sagemaker/image.go
index d5ddae22c85..a0d5bfacbee 100644
--- a/internal/service/sagemaker/image.go
+++ b/internal/service/sagemaker/image.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sagemaker
 
 import (
 	"context"
 	"log"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/sagemaker"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -43,7 +46,7 @@ func ResourceImage() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 63),
-					validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9](-*[a-zA-Z0-9])*$`), "Valid characters are a-z, A-Z, 0-9, and - (hyphen)."),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z](-*[0-9A-Za-z])*$`), "Valid characters are a-z, A-Z, 0-9, and - (hyphen)."),
 				),
 			},
 			"role_arn": {
diff --git a/internal/service/sagemaker/image_test.go b/internal/service/sagemaker/image_test.go
index 6d9e17441f2..64019727559 100644
--- a/internal/service/sagemaker/image_test.go
+++ b/internal/service/sagemaker/image_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sagemaker_test
 
 import (
diff --git a/internal/service/sagemaker/image_version.go b/internal/service/sagemaker/image_version.go
index 824835d7eb7..affba11814e 100644
--- a/internal/service/sagemaker/image_version.go
+++ b/internal/service/sagemaker/image_version.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sagemaker
 
 import (
diff --git a/internal/service/sagemaker/image_version_test.go b/internal/service/sagemaker/image_version_test.go
index 985a6c2b007..b763cac2c00 100644
--- a/internal/service/sagemaker/image_version_test.go
+++ b/internal/service/sagemaker/image_version_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sagemaker_test
 
 import (
diff --git a/internal/service/sagemaker/model.go b/internal/service/sagemaker/model.go
index 90f26162c32..19f56d47315 100644
--- a/internal/service/sagemaker/model.go
+++ b/internal/service/sagemaker/model.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sagemaker
 
 import (
diff --git a/internal/service/sagemaker/model_package_group.go b/internal/service/sagemaker/model_package_group.go
index c68489a9758..6d721f80545 100644
--- a/internal/service/sagemaker/model_package_group.go
+++ b/internal/service/sagemaker/model_package_group.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sagemaker
 
 import (
 	"context"
 	"log"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/sagemaker"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -41,7 +44,7 @@ func ResourceModelPackageGroup() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 63),
-					validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9](-*[a-zA-Z0-9]){0,62}$`),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z](-*[0-9A-Za-z]){0,62}$`),
 						"Valid characters are a-z, A-Z, 0-9, and - (hyphen)."),
 				),
 			},
diff --git a/internal/service/sagemaker/model_package_group_policy.go b/internal/service/sagemaker/model_package_group_policy.go
index 1f2d9b32a62..9023e861ddc 100644
--- a/internal/service/sagemaker/model_package_group_policy.go
+++ b/internal/service/sagemaker/model_package_group_policy.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sagemaker
 
 import (
diff --git a/internal/service/sagemaker/model_package_group_policy_test.go b/internal/service/sagemaker/model_package_group_policy_test.go
index 738c4246fa8..81d6c7dadfb 100644
--- a/internal/service/sagemaker/model_package_group_policy_test.go
+++ b/internal/service/sagemaker/model_package_group_policy_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sagemaker_test
 
 import (
diff --git a/internal/service/sagemaker/model_package_group_test.go b/internal/service/sagemaker/model_package_group_test.go
index f5b363fc9ea..42da9ef8298 100644
--- a/internal/service/sagemaker/model_package_group_test.go
+++ b/internal/service/sagemaker/model_package_group_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sagemaker_test
 
 import (
diff --git a/internal/service/sagemaker/model_test.go b/internal/service/sagemaker/model_test.go
index d92ba4f9885..1d41fb416d6 100644
--- a/internal/service/sagemaker/model_test.go
+++ b/internal/service/sagemaker/model_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sagemaker_test
 
 import (
diff --git a/internal/service/sagemaker/monitoring_schedule.go b/internal/service/sagemaker/monitoring_schedule.go
index 61b4fb2229d..10b7b855360 100644
--- a/internal/service/sagemaker/monitoring_schedule.go
+++ b/internal/service/sagemaker/monitoring_schedule.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sagemaker
 
 import (
 	"context"
 	"log"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/sagemaker"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -73,7 +76,7 @@ func ResourceMonitoringSchedule() *schema.Resource {
 										Type:     schema.TypeString,
 										Required: true,
 										ValidateFunc: validation.All(
-											validation.StringMatch(regexp.MustCompile(`^cron`), ""),
+											validation.StringMatch(regexache.MustCompile(`^cron`), ""),
 											validation.StringLenBetween(1, 512),
 										),
 									},
diff --git a/internal/service/sagemaker/monitoring_schedule_test.go b/internal/service/sagemaker/monitoring_schedule_test.go
index f17c7b1de52..da1d496941a 100644
--- a/internal/service/sagemaker/monitoring_schedule_test.go
+++ b/internal/service/sagemaker/monitoring_schedule_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sagemaker_test
 
 import (
diff --git a/internal/service/sagemaker/notebook_instance.go b/internal/service/sagemaker/notebook_instance.go
index 663a3c25988..5f7e239ce6f 100644
--- a/internal/service/sagemaker/notebook_instance.go
+++ b/internal/service/sagemaker/notebook_instance.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sagemaker
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/sagemaker"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
@@ -116,7 +119,7 @@ func ResourceNotebookInstance() *schema.Resource {
 				Optional:     true,
 				Computed:     true,
 				ForceNew:     true,
-				ValidateFunc: validation.StringMatch(regexp.MustCompile(`^(notebook-al1-v1|notebook-al2-v1|notebook-al2-v2)$`), ""),
+				ValidateFunc: validation.StringMatch(regexache.MustCompile(`^(notebook-al1-v1|notebook-al2-v1|notebook-al2-v2)$`), ""),
 			},
 			"role_arn": {
 				Type:         schema.TypeString,
diff --git a/internal/service/sagemaker/notebook_instance_lifecycle_configuration.go b/internal/service/sagemaker/notebook_instance_lifecycle_configuration.go
index 119d1c3f186..a1290526072 100644
--- a/internal/service/sagemaker/notebook_instance_lifecycle_configuration.go
+++ b/internal/service/sagemaker/notebook_instance_lifecycle_configuration.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sagemaker
 
 import (
diff --git a/internal/service/sagemaker/notebook_instance_lifecycle_configuration_test.go b/internal/service/sagemaker/notebook_instance_lifecycle_configuration_test.go
index 4922ee15b51..c6e34a64acf 100644
--- a/internal/service/sagemaker/notebook_instance_lifecycle_configuration_test.go
+++ b/internal/service/sagemaker/notebook_instance_lifecycle_configuration_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sagemaker_test
 
 import (
diff --git a/internal/service/sagemaker/notebook_instance_test.go b/internal/service/sagemaker/notebook_instance_test.go
index 7efc6067af2..fc99c25deb6 100644
--- a/internal/service/sagemaker/notebook_instance_test.go
+++ b/internal/service/sagemaker/notebook_instance_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sagemaker_test
 
 import (
 	"context"
 	"errors"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/sagemaker"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -450,7 +453,7 @@ func TestAccSageMakerNotebookInstance_DirectInternet_access(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "direct_internet_access", "Disabled"),
 					resource.TestCheckResourceAttrPair(resourceName, "subnet_id", "aws_subnet.test", "id"),
 					resource.TestCheckResourceAttr(resourceName, "security_groups.#", "1"),
-					resource.TestMatchResourceAttr(resourceName, "network_interface_id", regexp.MustCompile("eni-.*")),
+					resource.TestMatchResourceAttr(resourceName, "network_interface_id", regexache.MustCompile("eni-.*")),
 				),
 			},
 			{
@@ -465,7 +468,7 @@ func TestAccSageMakerNotebookInstance_DirectInternet_access(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "direct_internet_access", "Enabled"),
 					resource.TestCheckResourceAttrPair(resourceName, "subnet_id", "aws_subnet.test", "id"),
 					resource.TestCheckResourceAttr(resourceName, "security_groups.#", "1"),
-					resource.TestMatchResourceAttr(resourceName, "network_interface_id", regexp.MustCompile("eni-.*")),
+					resource.TestMatchResourceAttr(resourceName, "network_interface_id", regexache.MustCompile("eni-.*")),
 				),
 			},
 		},
diff --git a/internal/service/sagemaker/pipeline.go b/internal/service/sagemaker/pipeline.go
new file mode 100644
index 00000000000..25328eb40bc
--- /dev/null
+++ b/internal/service/sagemaker/pipeline.go
@@ -0,0 +1,300 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package sagemaker
+
+import (
+	"context"
+	"log"
+
+	"github.com/YakDriver/regexache"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/sagemaker"
+	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
+	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/internal/verify"
+	"github.com/hashicorp/terraform-provider-aws/names"
+)
+
+// @SDKResource("aws_sagemaker_pipeline", name="Pipeline")
+// @Tags(identifierAttribute="arn")
+func ResourcePipeline() *schema.Resource {
+	return &schema.Resource{
+		CreateWithoutTimeout: resourcePipelineCreate,
+		ReadWithoutTimeout:   resourcePipelineRead,
+		UpdateWithoutTimeout: resourcePipelineUpdate,
+		DeleteWithoutTimeout: resourcePipelineDelete,
+
+		Importer: &schema.ResourceImporter{
+			StateContext: schema.ImportStatePassthroughContext,
+		},
+
+		Schema: map[string]*schema.Schema{
+			"arn": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"parallelism_configuration": {
+				Type:     schema.TypeList,
+				Optional: true,
+				MaxItems: 1,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"max_parallel_execution_steps": {
+							Type:         schema.TypeInt,
+							Required:     true,
+							ValidateFunc: validation.IntAtLeast(1),
+						},
+					},
+				},
+			},
+			"pipeline_definition": {
+				Type:         schema.TypeString,
+				Optional:     true,
+				ExactlyOneOf: []string{"pipeline_definition", "pipeline_definition_s3_location"},
+				ValidateFunc: validation.All(
+					validation.StringLenBetween(1, 1048576),
+					validation.StringIsJSON,
+				),
+			},
+			"pipeline_definition_s3_location": {
+				Type:         schema.TypeList,
+				Optional:     true,
+				ExactlyOneOf: []string{"pipeline_definition", "pipeline_definition_s3_location"},
+				MaxItems:     1,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"bucket": {
+							Type:     schema.TypeString,
+							Required: true,
+						},
+						"object_key": {
+							Type:     schema.TypeString,
+							Required: true,
+						},
+						"version_id": {
+							Type:     schema.TypeString,
+							Optional: true,
+						},
+					},
+				},
+			},
+			"pipeline_description": {
+				Type:         schema.TypeString,
+				Optional:     true,
+				ValidateFunc: validation.StringLenBetween(1, 3072),
+			},
+			"pipeline_display_name": {
+				Type:     schema.TypeString,
+				Required: true,
+				ValidateFunc: validation.All(
+					validation.StringLenBetween(1, 256),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z]([0-9A-Za-z-])*$`), "Valid characters are a-z, A-Z, 0-9, and - (hyphen)."),
+				),
+			},
+			"pipeline_name": {
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+				ValidateFunc: validation.All(
+					validation.StringLenBetween(1, 256),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z]([0-9A-Za-z-])*$`), "Valid characters are a-z, A-Z, 0-9, and - (hyphen)."),
+				),
+			},
+			"role_arn": {
+				Type:         schema.TypeString,
+				Optional:     true,
+				ValidateFunc: verify.ValidARN,
+			},
+			names.AttrTags:    tftags.TagsSchema(),
+			names.AttrTagsAll: tftags.TagsSchemaComputed(),
+		},
+
+		CustomizeDiff: verify.SetTagsDiff,
+	}
+}
+
+func resourcePipelineCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).SageMakerConn(ctx)
+
+	name := d.Get("pipeline_name").(string)
+	input := &sagemaker.CreatePipelineInput{
+		ClientRequestToken:  aws.String(id.UniqueId()),
+		PipelineDisplayName: aws.String(d.Get("pipeline_display_name").(string)),
+		PipelineName:        aws.String(name),
+		RoleArn:             aws.String(d.Get("role_arn").(string)),
+		Tags:                getTagsIn(ctx),
+	}
+
+	if v, ok := d.GetOk("parallelism_configuration"); ok {
+		input.ParallelismConfiguration = expandParallelismConfiguration(v.([]interface{}))
+	}
+
+	if v, ok := d.GetOk("pipeline_definition"); ok {
+		input.PipelineDefinition = aws.String(v.(string))
+	}
+
+	if v, ok := d.GetOk("pipeline_definition_s3_location"); ok {
+		input.PipelineDefinitionS3Location = expandPipelineDefinitionS3Location(v.([]interface{}))
+	}
+
+	if v, ok := d.GetOk("pipeline_description"); ok {
+		input.PipelineDescription = aws.String(v.(string))
+	}
+
+	_, err := conn.CreatePipelineWithContext(ctx, input)
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "creating SageMaker Pipeline (%s): %s", name, err)
+	}
+
+	d.SetId(name)
+
+	return append(diags, resourcePipelineRead(ctx, d, meta)...)
+}
+
+func resourcePipelineRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).SageMakerConn(ctx)
+
+	pipeline, err := FindPipelineByName(ctx, conn, d.Id())
+
+	if !d.IsNewResource() && tfresource.NotFound(err) {
+		log.Printf("[WARN] SageMaker Pipeline (%s) not found, removing from state", d.Id())
+		d.SetId("")
+		return diags
+	}
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "reading SageMaker Pipeline (%s): %s", d.Id(), err)
+	}
+
+	d.Set("arn", pipeline.PipelineArn)
+	if err := d.Set("parallelism_configuration", flattenParallelismConfiguration(pipeline.ParallelismConfiguration)); err != nil {
+		return sdkdiag.AppendErrorf(diags, "setting parallelism_configuration: %s", err)
+	}
+	d.Set("pipeline_definition", pipeline.PipelineDefinition)
+	d.Set("pipeline_description", pipeline.PipelineDescription)
+	d.Set("pipeline_display_name", pipeline.PipelineDisplayName)
+	d.Set("pipeline_name", pipeline.PipelineName)
+	d.Set("role_arn", pipeline.RoleArn)
+
+	return diags
+}
+
+func resourcePipelineUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).SageMakerConn(ctx)
+
+	if d.HasChangesExcept("tags", "tags_all") {
+		input := &sagemaker.UpdatePipelineInput{
+			PipelineName: aws.String(d.Id()),
+		}
+
+		if d.HasChange("parallelism_configuration") {
+			input.ParallelismConfiguration = expandParallelismConfiguration(d.Get("parallelism_configuration").([]interface{}))
+		}
+
+		if d.HasChange("pipeline_definition") {
+			input.PipelineDefinition = aws.String(d.Get("pipeline_definition").(string))
+		}
+
+		if d.HasChange("pipeline_definition_s3_location") {
+			input.PipelineDefinitionS3Location = expandPipelineDefinitionS3Location(d.Get("pipeline_definition_s3_location").([]interface{}))
+		}
+
+		if d.HasChange("pipeline_description") {
+			input.PipelineDescription = aws.String(d.Get("pipeline_description").(string))
+		}
+
+		if d.HasChange("pipeline_display_name") {
+			input.PipelineDisplayName = aws.String(d.Get("pipeline_display_name").(string))
+		}
+
+		if d.HasChange("role_arn") {
+			input.RoleArn = aws.String(d.Get("role_arn").(string))
+		}
+
+		_, err := conn.UpdatePipelineWithContext(ctx, input)
+
+		if err != nil {
+			return sdkdiag.AppendErrorf(diags, "updating SageMaker Pipeline (%s): %s", d.Id(), err)
+		}
+	}
+
+	return append(diags, resourcePipelineRead(ctx, d, meta)...)
+}
+
+func resourcePipelineDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).SageMakerConn(ctx)
+
+	log.Printf("[DEBUG] Deleting SageMaker Pipeline: %s", d.Id())
+	_, err := conn.DeletePipelineWithContext(ctx, &sagemaker.DeletePipelineInput{
+		ClientRequestToken: aws.String(id.UniqueId()),
+		PipelineName:       aws.String(d.Id()),
+	})
+
+	if tfawserr.ErrMessageContains(err, "ValidationException", "No pipeline") {
+		return diags
+	}
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "deleting SageMaker Pipeline (%s): %s", d.Id(), err)
+	}
+
+	return diags
+}
+
+func expandPipelineDefinitionS3Location(l []interface{}) *sagemaker.PipelineDefinitionS3Location {
+	if len(l) == 0 || l[0] == nil {
+		return &sagemaker.PipelineDefinitionS3Location{}
+	}
+
+	m := l[0].(map[string]interface{})
+
+	config := &sagemaker.PipelineDefinitionS3Location{
+		Bucket:    aws.String(m["bucket"].(string)),
+		ObjectKey: aws.String(m["object_key"].(string)),
+	}
+
+	if v, ok := m["version_id"].(string); ok && v != "" {
+		config.VersionId = aws.String(v)
+	}
+
+	return config
+}
+
+func expandParallelismConfiguration(l []interface{}) *sagemaker.ParallelismConfiguration {
+	if len(l) == 0 || l[0] == nil {
+		return &sagemaker.ParallelismConfiguration{}
+	}
+
+	m := l[0].(map[string]interface{})
+
+	config := &sagemaker.ParallelismConfiguration{
+		MaxParallelExecutionSteps: aws.Int64(int64(m["max_parallel_execution_steps"].(int))),
+	}
+
+	return config
+}
+
+func flattenParallelismConfiguration(config *sagemaker.ParallelismConfiguration) []map[string]interface{} {
+	if config == nil {
+		return []map[string]interface{}{}
+	}
+
+	m := map[string]interface{}{
+		"max_parallel_execution_steps": aws.Int64Value(config.MaxParallelExecutionSteps),
+	}
+
+	return []map[string]interface{}{m}
+}
diff --git a/internal/service/sagemaker/pipeline_test.go b/internal/service/sagemaker/pipeline_test.go
new file mode 100644
index 00000000000..dc9d47e6cf0
--- /dev/null
+++ b/internal/service/sagemaker/pipeline_test.go
@@ -0,0 +1,335 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package sagemaker_test
+
+import (
+	"context"
+	"fmt"
+	"testing"
+
+	"github.com/YakDriver/regexache"
+	"github.com/aws/aws-sdk-go/service/sagemaker"
+	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
+	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	tfsagemaker "github.com/hashicorp/terraform-provider-aws/internal/service/sagemaker"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+)
+
+func TestAccSageMakerPipeline_basic(t *testing.T) {
+	ctx := acctest.Context(t)
+	var pipeline sagemaker.DescribePipelineOutput
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	rNameUpdated := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_sagemaker_pipeline.test"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, sagemaker.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckPipelineDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccPipelinePipelineConfig_basic(rName, rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckPipelineExists(ctx, resourceName, &pipeline),
+					resource.TestCheckResourceAttr(resourceName, "pipeline_name", rName),
+					resource.TestCheckResourceAttr(resourceName, "pipeline_display_name", rName),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "sagemaker", regexache.MustCompile(`pipeline/.+`)),
+					resource.TestCheckResourceAttrPair(resourceName, "role_arn", "aws_iam_role.test", "arn"),
+					resource.TestCheckResourceAttr(resourceName, "parallelism_configuration.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				Config: testAccPipelinePipelineConfig_basic(rName, rNameUpdated),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckPipelineExists(ctx, resourceName, &pipeline),
+					resource.TestCheckResourceAttr(resourceName, "pipeline_name", rName),
+					resource.TestCheckResourceAttr(resourceName, "pipeline_display_name", rNameUpdated),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "sagemaker", regexache.MustCompile(`pipeline/.+`)),
+					resource.TestCheckResourceAttrPair(resourceName, "role_arn", "aws_iam_role.test", "arn"),
+					resource.TestCheckResourceAttr(resourceName, "parallelism_configuration.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccSageMakerPipeline_parallelism(t *testing.T) {
+	ctx := acctest.Context(t)
+	var pipeline sagemaker.DescribePipelineOutput
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_sagemaker_pipeline.test"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, sagemaker.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckPipelineDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccPipelinePipelineConfig_parallelism(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckPipelineExists(ctx, resourceName, &pipeline),
+					resource.TestCheckResourceAttr(resourceName, "pipeline_name", rName),
+					resource.TestCheckResourceAttr(resourceName, "parallelism_configuration.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "parallelism_configuration.0.max_parallel_execution_steps", "1"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
+func TestAccSageMakerPipeline_tags(t *testing.T) {
+	ctx := acctest.Context(t)
+	var pipeline sagemaker.DescribePipelineOutput
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_sagemaker_pipeline.test"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, sagemaker.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckPipelineDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccPipelinePipelineConfig_tags1(rName, "key1", "value1"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckPipelineExists(ctx, resourceName, &pipeline),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				Config: testAccPipelinePipelineConfig_tags2(rName, "key1", "value1updated", "key2", "value2"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckPipelineExists(ctx, resourceName, &pipeline),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1updated"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
+				),
+			},
+			{
+				Config: testAccPipelinePipelineConfig_tags1(rName, "key2", "value2"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckPipelineExists(ctx, resourceName, &pipeline),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccSageMakerPipeline_disappears(t *testing.T) {
+	ctx := acctest.Context(t)
+	var pipeline sagemaker.DescribePipelineOutput
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_sagemaker_pipeline.test"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, sagemaker.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckPipelineDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccPipelinePipelineConfig_basic(rName, rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckPipelineExists(ctx, resourceName, &pipeline),
+					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfsagemaker.ResourcePipeline(), resourceName),
+				),
+				ExpectNonEmptyPlan: true,
+			},
+		},
+	})
+}
+
+func testAccCheckPipelineDestroy(ctx context.Context) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		conn := acctest.Provider.Meta().(*conns.AWSClient).SageMakerConn(ctx)
+
+		for _, rs := range s.RootModule().Resources {
+			if rs.Type != "aws_sagemaker_pipeline" {
+				continue
+			}
+
+			_, err := tfsagemaker.FindPipelineByName(ctx, conn, rs.Primary.ID)
+
+			if tfresource.NotFound(err) {
+				continue
+			}
+
+			if err != nil {
+				return err
+			}
+
+			return fmt.Errorf("SageMaker Pipeline %s still exists", rs.Primary.ID)
+		}
+
+		return nil
+	}
+}
+
+func testAccCheckPipelineExists(ctx context.Context, n string, pipeline *sagemaker.DescribePipelineOutput) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		if rs.Primary.ID == "" {
+			return fmt.Errorf("No SageMaker Pipeline ID is set")
+		}
+
+		conn := acctest.Provider.Meta().(*conns.AWSClient).SageMakerConn(ctx)
+
+		output, err := tfsagemaker.FindPipelineByName(ctx, conn, rs.Primary.ID)
+
+		if err != nil {
+			return err
+		}
+
+		*pipeline = *output
+
+		return nil
+	}
+}
+
+func testAccPipelinePipelineConfig_base(rName string) string {
+	return fmt.Sprintf(`
+resource "aws_iam_role" "test" {
+  name               = %[1]q
+  path               = "/"
+  assume_role_policy = data.aws_iam_policy_document.test.json
+}
+
+data "aws_iam_policy_document" "test" {
+  statement {
+    actions = ["sts:AssumeRole"]
+
+    principals {
+      type        = "Service"
+      identifiers = ["sagemaker.amazonaws.com"]
+    }
+  }
+}
+`, rName)
+}
+
+func testAccPipelinePipelineConfig_basic(rName, dispName string) string {
+	return acctest.ConfigCompose(testAccPipelinePipelineConfig_base(rName), fmt.Sprintf(`
+resource "aws_sagemaker_pipeline" "test" {
+  pipeline_name         = %[1]q
+  pipeline_display_name = %[2]q
+  role_arn              = aws_iam_role.test.arn
+
+  pipeline_definition = jsonencode({
+    Version = "2020-12-01"
+    Steps = [{
+      Name = "Test"
+      Type = "Fail"
+      Arguments = {
+        ErrorMessage = "test"
+      }
+    }]
+  })
+}
+`, rName, dispName))
+}
+
+func testAccPipelinePipelineConfig_parallelism(rName string) string {
+	return acctest.ConfigCompose(testAccPipelinePipelineConfig_base(rName), fmt.Sprintf(`
+resource "aws_sagemaker_pipeline" "test" {
+  pipeline_name         = %[1]q
+  pipeline_display_name = %[1]q
+  role_arn              = aws_iam_role.test.arn
+
+  pipeline_definition = jsonencode({
+    Version = "2020-12-01"
+    Steps = [{
+      Name = "Test"
+      Type = "Fail"
+      Arguments = {
+        ErrorMessage = "test"
+      }
+    }]
+  })
+
+  parallelism_configuration {
+    max_parallel_execution_steps = 1
+  }
+}
+`, rName))
+}
+
+func testAccPipelinePipelineConfig_tags1(rName, tagKey1, tagValue1 string) string {
+	return acctest.ConfigCompose(testAccPipelinePipelineConfig_base(rName), fmt.Sprintf(`
+resource "aws_sagemaker_pipeline" "test" {
+  pipeline_name         = %[1]q
+  pipeline_display_name = %[1]q
+  role_arn              = aws_iam_role.test.arn
+
+  pipeline_definition = jsonencode({
+    Version = "2020-12-01"
+    Steps = [{
+      Name = "Test"
+      Type = "Fail"
+      Arguments = {
+        ErrorMessage = "test"
+      }
+    }]
+  })
+
+  tags = {
+    %[2]q = %[3]q
+  }
+}
+`, rName, tagKey1, tagValue1))
+}
+
+func testAccPipelinePipelineConfig_tags2(rName, tagKey1, tagValue1, tagKey2, tagValue2 string) string {
+	return acctest.ConfigCompose(testAccPipelinePipelineConfig_base(rName), fmt.Sprintf(`
+resource "aws_sagemaker_pipeline" "test" {
+  pipeline_name         = %[1]q
+  pipeline_display_name = %[1]q
+  role_arn              = aws_iam_role.test.arn
+
+  pipeline_definition = jsonencode({
+    Version = "2020-12-01"
+    Steps = [{
+      Name = "Test"
+      Type = "Fail"
+      Arguments = {
+        ErrorMessage = "test"
+      }
+    }]
+  })
+
+  tags = {
+    %[2]q = %[3]q
+    %[4]q = %[5]q
+  }
+}
+`, rName, tagKey1, tagValue1, tagKey2, tagValue2))
+}
diff --git a/internal/service/sagemaker/prebuilt_ecr_image_data_source.go b/internal/service/sagemaker/prebuilt_ecr_image_data_source.go
index eeba9a2d2a0..ff79088f271 100644
--- a/internal/service/sagemaker/prebuilt_ecr_image_data_source.go
+++ b/internal/service/sagemaker/prebuilt_ecr_image_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sagemaker
 
 import (
diff --git a/internal/service/sagemaker/prebuilt_ecr_image_data_source_test.go b/internal/service/sagemaker/prebuilt_ecr_image_data_source_test.go
index affc70d65b7..ae6683d0c36 100644
--- a/internal/service/sagemaker/prebuilt_ecr_image_data_source_test.go
+++ b/internal/service/sagemaker/prebuilt_ecr_image_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sagemaker_test
 
 import (
diff --git a/internal/service/sagemaker/project.go b/internal/service/sagemaker/project.go
index 1b1cb11fe6a..68922ceffaa 100644
--- a/internal/service/sagemaker/project.go
+++ b/internal/service/sagemaker/project.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sagemaker
 
 import (
 	"context"
 	"log"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/sagemaker"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -47,7 +50,7 @@ func ResourceProject() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 32),
-					validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9](-*[a-zA-Z0-9]){0,31}$`),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z](-*[0-9A-Za-z]){0,31}$`),
 						"Valid characters are a-z, A-Z, 0-9, and - (hyphen)."),
 				),
 			},
@@ -197,15 +200,17 @@ func resourceProjectDelete(ctx context.Context, d *schema.ResourceData, meta int
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).SageMakerConn(ctx)
 
-	input := &sagemaker.DeleteProjectInput{
+	log.Printf("[DEBUG] Deleting SageMaker Project: %s", d.Id())
+	_, err := conn.DeleteProjectWithContext(ctx, &sagemaker.DeleteProjectInput{
 		ProjectName: aws.String(d.Id()),
+	})
+
+	if tfawserr.ErrMessageContains(err, "ValidationException", "does not exist") ||
+		tfawserr.ErrMessageContains(err, "ValidationException", "Cannot delete Project in DeleteCompleted status") {
+		return diags
 	}
 
-	if _, err := conn.DeleteProjectWithContext(ctx, input); err != nil {
-		if tfawserr.ErrMessageContains(err, "ValidationException", "does not exist") ||
-			tfawserr.ErrMessageContains(err, "ValidationException", "Cannot delete Project in DeleteCompleted status") {
-			return diags
-		}
+	if err != nil {
 		return sdkdiag.AppendErrorf(diags, "deleting SageMaker Project (%s): %s", d.Id(), err)
 	}
 
diff --git a/internal/service/sagemaker/project_test.go b/internal/service/sagemaker/project_test.go
index 2be60d891bb..3933ea02e67 100644
--- a/internal/service/sagemaker/project_test.go
+++ b/internal/service/sagemaker/project_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sagemaker_test
 
 import (
@@ -225,11 +228,6 @@ resource "aws_s3_bucket" "test" {
   force_destroy = true
 }
 
-resource "aws_s3_bucket_acl" "test" {
-  bucket = aws_s3_bucket.test.id
-  acl    = "private"
-}
-
 resource "aws_s3_object" "test" {
   bucket = aws_s3_bucket.test.id
   key    = "%[1]s.json"
diff --git a/internal/service/sagemaker/sagemaker_test.go b/internal/service/sagemaker/sagemaker_test.go
index e385ad6313c..1a9d775a9a4 100644
--- a/internal/service/sagemaker/sagemaker_test.go
+++ b/internal/service/sagemaker/sagemaker_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sagemaker_test
 
 import (
@@ -51,6 +54,7 @@ func TestAccSageMaker_serial(t *testing.T) {
 			"defaultUserSettingsUpdated":                             testAccDomain_defaultUserSettingsUpdated,
 			"canvas":                                                 testAccDomain_canvasAppSettings,
 			"modelRegisterSettings":                                  testAccDomain_modelRegisterSettings,
+			"workspaceSettings":                                      testAccDomain_workspaceSettings,
 			"domainSettings":                                         testAccDomain_domainSettings,
 			"rSessionAppSettings":                                    testAccDomain_rSessionAppSettings,
 			"rStudioServerProAppSettings":                            testAccDomain_rStudioServerProAppSettings,
diff --git a/internal/service/sagemaker/service_package_gen.go b/internal/service/sagemaker/service_package_gen.go
index 9b676fb7a19..e546ca3e3f9 100644
--- a/internal/service/sagemaker/service_package_gen.go
+++ b/internal/service/sagemaker/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	sagemaker_sdkv1 "github.com/aws/aws-sdk-go/service/sagemaker"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -176,6 +177,14 @@ func (p *servicePackage) SDKResources(ctx context.Context) []*types.ServicePacka
 			Factory:  ResourceNotebookInstanceLifeCycleConfiguration,
 			TypeName: "aws_sagemaker_notebook_instance_lifecycle_configuration",
 		},
+		{
+			Factory:  ResourcePipeline,
+			TypeName: "aws_sagemaker_pipeline",
+			Name:     "Pipeline",
+			Tags: &types.ServicePackageResourceTags{
+				IdentifierAttribute: "arn",
+			},
+		},
 		{
 			Factory:  ResourceProject,
 			TypeName: "aws_sagemaker_project",
@@ -238,4 +247,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*s
 	return sagemaker_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/sagemaker/servicecatalog_portfolio_status.go b/internal/service/sagemaker/servicecatalog_portfolio_status.go
index 9345eb1de92..e8b35ea7112 100644
--- a/internal/service/sagemaker/servicecatalog_portfolio_status.go
+++ b/internal/service/sagemaker/servicecatalog_portfolio_status.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sagemaker
 
 import (
diff --git a/internal/service/sagemaker/servicecatalog_portfolio_status_test.go b/internal/service/sagemaker/servicecatalog_portfolio_status_test.go
index e1b166699e6..fb6fb60c60d 100644
--- a/internal/service/sagemaker/servicecatalog_portfolio_status_test.go
+++ b/internal/service/sagemaker/servicecatalog_portfolio_status_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sagemaker_test
 
 import (
diff --git a/internal/service/sagemaker/space.go b/internal/service/sagemaker/space.go
index 5bf8b517828..0e92f559e75 100644
--- a/internal/service/sagemaker/space.go
+++ b/internal/service/sagemaker/space.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sagemaker
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"strings"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/aws/aws-sdk-go/service/sagemaker"
@@ -44,7 +47,7 @@ func ResourceSpace() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 63),
-					validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9](-*[a-zA-Z0-9]){0,62}`), "Valid characters are a-z, A-Z, 0-9, and - (hyphen)."),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z](-*[0-9A-Za-z]){0,62}`), "Valid characters are a-z, A-Z, 0-9, and - (hyphen)."),
 				),
 			},
 			"domain_id": {
diff --git a/internal/service/sagemaker/space_test.go b/internal/service/sagemaker/space_test.go
index c5f0e8ee5f7..261e45555ca 100644
--- a/internal/service/sagemaker/space_test.go
+++ b/internal/service/sagemaker/space_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sagemaker_test
 
 import (
 	"context"
 	"fmt"
 	"os"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/sagemaker"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -37,7 +40,7 @@ func testAccSpace_basic(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "space_name", rName),
 					resource.TestCheckResourceAttrPair(resourceName, "domain_id", "aws_sagemaker_domain.test", "id"),
 					resource.TestCheckResourceAttr(resourceName, "space_settings.#", "0"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "sagemaker", regexp.MustCompile(`space/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "sagemaker", regexache.MustCompile(`space/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 					resource.TestCheckResourceAttrSet(resourceName, "home_efs_file_system_uid"),
 				),
diff --git a/internal/service/sagemaker/status.go b/internal/service/sagemaker/status.go
index 9e5fc4aa81e..b7645548e71 100644
--- a/internal/service/sagemaker/status.go
+++ b/internal/service/sagemaker/status.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sagemaker
 
 import (
diff --git a/internal/service/sagemaker/studio_lifecycle_config.go b/internal/service/sagemaker/studio_lifecycle_config.go
index 9fc98e825de..86c3f04c920 100644
--- a/internal/service/sagemaker/studio_lifecycle_config.go
+++ b/internal/service/sagemaker/studio_lifecycle_config.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sagemaker
 
 import (
 	"context"
 	"log"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/sagemaker"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -54,7 +57,7 @@ func ResourceStudioLifecycleConfig() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 63),
-					validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9](-*[a-zA-Z0-9])*$`), "Valid characters are a-z, A-Z, 0-9, and - (hyphen)."),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z](-*[0-9A-Za-z])*$`), "Valid characters are a-z, A-Z, 0-9, and - (hyphen)."),
 				),
 			},
 			names.AttrTags:    tftags.TagsSchema(),
diff --git a/internal/service/sagemaker/studio_lifecycle_config_test.go b/internal/service/sagemaker/studio_lifecycle_config_test.go
index e8bacb936f2..65b587de30d 100644
--- a/internal/service/sagemaker/studio_lifecycle_config_test.go
+++ b/internal/service/sagemaker/studio_lifecycle_config_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sagemaker_test
 
 import (
diff --git a/internal/service/sagemaker/sweep.go b/internal/service/sagemaker/sweep.go
index c1e4e311295..3604bd64b19 100644
--- a/internal/service/sagemaker/sweep.go
+++ b/internal/service/sagemaker/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package sagemaker
 
@@ -13,9 +13,11 @@ import (
 	"github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/sdk"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_sagemaker_app_image_config", &resource.Sweeper{
 		Name: "aws_sagemaker_app_image_config",
 		F:    sweepAppImagesConfig,
@@ -115,9 +117,14 @@ func init() {
 		},
 	})
 
+	resource.AddTestSweepers("aws_sagemaker_project", &resource.Sweeper{
+		Name: "aws_sagemaker_project",
+		F:    sweepProjects,
+	})
+
 	resource.AddTestSweepers("aws_sagemaker_space", &resource.Sweeper{
 		Name: "aws_sagemaker_space",
-		F:    sweepUserProfiles,
+		F:    sweepSpaces,
 		Dependencies: []string{
 			"aws_sagemaker_app",
 		},
@@ -144,15 +151,15 @@ func init() {
 		F:    sweepWorkteams,
 	})
 
-	resource.AddTestSweepers("aws_sagemaker_project", &resource.Sweeper{
-		Name: "aws_sagemaker_project",
-		F:    sweepProjects,
+	resource.AddTestSweepers("aws_sagemaker_pipeline", &resource.Sweeper{
+		Name: "aws_sagemaker_pipeline",
+		F:    sweepPipelines,
 	})
 }
 
 func sweepAppImagesConfig(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("getting client: %w", err)
 	}
@@ -165,7 +172,7 @@ func sweepAppImagesConfig(region string) error {
 	for {
 		output, err := conn.ListAppImageConfigsWithContext(ctx, input)
 
-		if sweep.SkipSweepError(err) {
+		if awsv1.SkipSweepError(err) {
 			log.Printf("[WARN] Skipping SageMaker App Image Config for %s: %s", region, err)
 			return sweeperErrs.ErrorOrNil()
 		}
@@ -176,7 +183,6 @@ func sweepAppImagesConfig(region string) error {
 		}
 
 		for _, config := range output.AppImageConfigs {
-
 			name := aws.StringValue(config.AppImageConfigName)
 			r := ResourceAppImageConfig()
 			d := r.Data(nil)
@@ -192,7 +198,7 @@ func sweepAppImagesConfig(region string) error {
 		input.NextToken = output.NextToken
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("sweeping SageMaker App Image Configs: %w", err))
 	}
 
@@ -201,7 +207,7 @@ func sweepAppImagesConfig(region string) error {
 
 func sweepSpaces(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("getting client: %w", err)
 	}
@@ -212,7 +218,6 @@ func sweepSpaces(region string) error {
 
 	err = conn.ListSpacesPagesWithContext(ctx, &sagemaker.ListSpacesInput{}, func(page *sagemaker.ListSpacesOutput, lastPage bool) bool {
 		for _, space := range page.Spaces {
-
 			r := ResourceSpace()
 			d := r.Data(nil)
 			d.SetId(aws.StringValue(space.SpaceName))
@@ -225,7 +230,7 @@ func sweepSpaces(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping SageMaker Space sweep for %s: %s", region, err)
 		return sweeperErrs.ErrorOrNil()
 	}
@@ -233,7 +238,7 @@ func sweepSpaces(region string) error {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("retrieving SageMaker Spaces: %w", err))
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("sweeping SageMaker Spaces: %w", err))
 	}
 
@@ -242,7 +247,7 @@ func sweepSpaces(region string) error {
 
 func sweepApps(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("getting client: %w", err)
 	}
@@ -253,7 +258,6 @@ func sweepApps(region string) error {
 
 	err = conn.ListAppsPagesWithContext(ctx, &sagemaker.ListAppsInput{}, func(page *sagemaker.ListAppsOutput, lastPage bool) bool {
 		for _, app := range page.Apps {
-
 			if aws.StringValue(app.Status) == sagemaker.AppStatusDeleted {
 				continue
 			}
@@ -273,7 +277,7 @@ func sweepApps(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping SageMaker App sweep for %s: %s", region, err)
 		return sweeperErrs.ErrorOrNil()
 	}
@@ -281,7 +285,7 @@ func sweepApps(region string) error {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("retrieving SageMaker Apps: %w", err))
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("sweeping SageMaker Apps: %w", err))
 	}
 
@@ -290,7 +294,7 @@ func sweepApps(region string) error {
 
 func sweepCodeRepositories(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("getting client: %s", err)
 	}
@@ -311,7 +315,7 @@ func sweepCodeRepositories(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping SageMaker Code Repository sweep for %s: %s", region, err)
 		return sweeperErrs.ErrorOrNil()
 	}
@@ -319,7 +323,7 @@ func sweepCodeRepositories(region string) error {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("retrieving SageMaker Code Repositories: %w", err))
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("sweeping SageMaker Code Repositories: %w", err))
 	}
 
@@ -328,7 +332,7 @@ func sweepCodeRepositories(region string) error {
 
 func sweepDeviceFleets(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("getting client: %s", err)
 	}
@@ -351,7 +355,7 @@ func sweepDeviceFleets(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping SageMaker Device Fleet sweep for %s: %s", region, err)
 		return sweeperErrs.ErrorOrNil()
 	}
@@ -359,7 +363,7 @@ func sweepDeviceFleets(region string) error {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("retrieving SageMaker Device Fleets: %w", err))
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("sweeping SageMaker Device Fleets: %w", err))
 	}
 
@@ -368,7 +372,7 @@ func sweepDeviceFleets(region string) error {
 
 func sweepDomains(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("getting client: %s", err)
 	}
@@ -379,7 +383,6 @@ func sweepDomains(region string) error {
 
 	err = conn.ListDomainsPagesWithContext(ctx, &sagemaker.ListDomainsInput{}, func(page *sagemaker.ListDomainsOutput, lastPage bool) bool {
 		for _, domain := range page.Domains {
-
 			r := ResourceDomain()
 			d := r.Data(nil)
 			d.SetId(aws.StringValue(domain.DomainId))
@@ -391,7 +394,7 @@ func sweepDomains(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping SageMaker domain sweep for %s: %s", region, err)
 		return sweeperErrs.ErrorOrNil()
 	}
@@ -399,7 +402,7 @@ func sweepDomains(region string) error {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("retrieving SageMaker Domains: %w", err))
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("sweeping API Gateway VPC Links: %w", err))
 	}
 
@@ -408,7 +411,7 @@ func sweepDomains(region string) error {
 
 func sweepEndpointConfigurations(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("getting client: %w", err)
 	}
@@ -432,7 +435,7 @@ func sweepEndpointConfigurations(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping SageMaker Endpoint Config sweep for %s: %s", region, err)
 		return sweeperErrs.ErrorOrNil()
 	}
@@ -440,7 +443,7 @@ func sweepEndpointConfigurations(region string) error {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("retrieving SageMaker Endpoint Configs: %w", err))
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("sweeping SageMaker Endpoint Configs: %w", err))
 	}
 
@@ -449,7 +452,7 @@ func sweepEndpointConfigurations(region string) error {
 
 func sweepEndpoints(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("getting client: %s", err)
 	}
@@ -482,7 +485,7 @@ func sweepEndpoints(region string) error {
 
 func sweepFeatureGroups(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("getting client: %s", err)
 	}
@@ -503,7 +506,7 @@ func sweepFeatureGroups(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping SageMaker Feature Group sweep for %s: %s", region, err)
 		return sweeperErrs.ErrorOrNil()
 	}
@@ -511,7 +514,7 @@ func sweepFeatureGroups(region string) error {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("retrieving SageMaker Feature Groups: %w", err))
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("sweeping SageMaker Feature Groups: %w", err))
 	}
 
@@ -520,7 +523,7 @@ func sweepFeatureGroups(region string) error {
 
 func sweepFlowDefinitions(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("getting client: %w", err)
 	}
@@ -531,7 +534,6 @@ func sweepFlowDefinitions(region string) error {
 
 	err = conn.ListFlowDefinitionsPagesWithContext(ctx, &sagemaker.ListFlowDefinitionsInput{}, func(page *sagemaker.ListFlowDefinitionsOutput, lastPage bool) bool {
 		for _, flowDefinition := range page.FlowDefinitionSummaries {
-
 			r := ResourceFlowDefinition()
 			d := r.Data(nil)
 			d.SetId(aws.StringValue(flowDefinition.FlowDefinitionName))
@@ -542,7 +544,7 @@ func sweepFlowDefinitions(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping SageMaker Flow Definition sweep for %s: %s", region, err)
 		return sweeperErrs.ErrorOrNil()
 	}
@@ -550,7 +552,7 @@ func sweepFlowDefinitions(region string) error {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("retrieving SageMaker Flow Definitions: %w", err))
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("sweeping SageMaker Flow Definitions: %w", err))
 	}
 
@@ -559,7 +561,7 @@ func sweepFlowDefinitions(region string) error {
 
 func sweepHumanTaskUIs(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("getting client: %w", err)
 	}
@@ -570,7 +572,6 @@ func sweepHumanTaskUIs(region string) error {
 
 	err = conn.ListHumanTaskUisPagesWithContext(ctx, &sagemaker.ListHumanTaskUisInput{}, func(page *sagemaker.ListHumanTaskUisOutput, lastPage bool) bool {
 		for _, humanTaskUi := range page.HumanTaskUiSummaries {
-
 			r := ResourceHumanTaskUI()
 			d := r.Data(nil)
 			d.SetId(aws.StringValue(humanTaskUi.HumanTaskUiName))
@@ -581,7 +582,7 @@ func sweepHumanTaskUIs(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping SageMaker HumanTaskUi sweep for %s: %s", region, err)
 		return sweeperErrs.ErrorOrNil()
 	}
@@ -589,7 +590,7 @@ func sweepHumanTaskUIs(region string) error {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("retrieving SageMaker HumanTaskUis: %w", err))
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("sweeping SageMaker HumanTaskUis: %w", err))
 	}
 
@@ -598,7 +599,7 @@ func sweepHumanTaskUIs(region string) error {
 
 func sweepImages(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("getting client: %s", err)
 	}
@@ -619,7 +620,7 @@ func sweepImages(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping SageMaker Image sweep for %s: %s", region, err)
 		return sweeperErrs.ErrorOrNil()
 	}
@@ -627,7 +628,7 @@ func sweepImages(region string) error {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("retrieving SageMaker Images: %w", err))
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("sweeping SageMaker Images: %w", err))
 	}
 
@@ -636,7 +637,7 @@ func sweepImages(region string) error {
 
 func sweepModelPackageGroups(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("getting client: %s", err)
 	}
@@ -657,7 +658,7 @@ func sweepModelPackageGroups(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping SageMaker Model Package Group sweep for %s: %s", region, err)
 		return sweeperErrs.ErrorOrNil()
 	}
@@ -665,7 +666,7 @@ func sweepModelPackageGroups(region string) error {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("retrieving SageMaker Model Package Groups: %w", err))
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("sweeping SageMaker Model Package Groups: %w", err))
 	}
 
@@ -674,7 +675,7 @@ func sweepModelPackageGroups(region string) error {
 
 func sweepModels(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("getting client: %w", err)
 	}
@@ -685,7 +686,6 @@ func sweepModels(region string) error {
 
 	err = conn.ListModelsPagesWithContext(ctx, &sagemaker.ListModelsInput{}, func(page *sagemaker.ListModelsOutput, lastPage bool) bool {
 		for _, model := range page.Models {
-
 			r := ResourceModel()
 			d := r.Data(nil)
 			d.SetId(aws.StringValue(model.ModelName))
@@ -695,7 +695,7 @@ func sweepModels(region string) error {
 
 		return !lastPage
 	})
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping SageMaker Model sweep for %s: %s", region, err)
 		return sweeperErrs.ErrorOrNil()
 	}
@@ -703,7 +703,7 @@ func sweepModels(region string) error {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("retrieving SageMaker Models: %w", err))
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("sweeping SageMaker Models: %w", err))
 	}
 
@@ -712,7 +712,7 @@ func sweepModels(region string) error {
 
 func sweepNotebookInstanceLifecycleConfiguration(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("getting client: %s", err)
 	}
@@ -738,7 +738,7 @@ func sweepNotebookInstanceLifecycleConfiguration(region string) error {
 		}
 		return !lastPage
 	})
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping SageMaker Notebook Instance Lifecycle Configuration sweep for %s: %s", region, err)
 		return nil
 	}
@@ -746,7 +746,7 @@ func sweepNotebookInstanceLifecycleConfiguration(region string) error {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("retrieving SageMaker Notebook Instance Lifecycle Configurations: %s", err))
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("sweeping SageMaker Notebook Instance Lifecycle Configurations: %w", err))
 	}
 
@@ -755,7 +755,7 @@ func sweepNotebookInstanceLifecycleConfiguration(region string) error {
 
 func sweepNotebookInstances(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("getting client: %s", err)
 	}
@@ -778,7 +778,7 @@ func sweepNotebookInstances(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping SageMaker Notebook Instance sweep for %s: %s", region, err)
 		return sweeperErrs.ErrorOrNil()
 	}
@@ -786,7 +786,7 @@ func sweepNotebookInstances(region string) error {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("retrieving SageMaker Notbook Instances: %w", err))
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("sweeping SageMaker Notbook Instances: %w", err))
 	}
 
@@ -795,7 +795,7 @@ func sweepNotebookInstances(region string) error {
 
 func sweepStudioLifecyclesConfig(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("getting client: %w", err)
 	}
@@ -806,7 +806,6 @@ func sweepStudioLifecyclesConfig(region string) error {
 
 	err = conn.ListStudioLifecycleConfigsPagesWithContext(ctx, &sagemaker.ListStudioLifecycleConfigsInput{}, func(page *sagemaker.ListStudioLifecycleConfigsOutput, lastPage bool) bool {
 		for _, config := range page.StudioLifecycleConfigs {
-
 			r := ResourceStudioLifecycleConfig()
 			d := r.Data(nil)
 			d.SetId(aws.StringValue(config.StudioLifecycleConfigName))
@@ -817,7 +816,7 @@ func sweepStudioLifecyclesConfig(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping SageMaker Studio Lifecycle Config sweep for %s: %s", region, err)
 		return sweeperErrs.ErrorOrNil()
 	}
@@ -825,7 +824,7 @@ func sweepStudioLifecyclesConfig(region string) error {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("retrieving SageMaker Studio Lifecycle Configs: %w", err))
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("sweeping SageMaker Studio Lifecycle Configs: %w", err))
 	}
 
@@ -834,7 +833,7 @@ func sweepStudioLifecyclesConfig(region string) error {
 
 func sweepUserProfiles(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("getting client: %s", err)
 	}
@@ -845,7 +844,6 @@ func sweepUserProfiles(region string) error {
 
 	err = conn.ListUserProfilesPagesWithContext(ctx, &sagemaker.ListUserProfilesInput{}, func(page *sagemaker.ListUserProfilesOutput, lastPage bool) bool {
 		for _, userProfile := range page.UserProfiles {
-
 			r := ResourceUserProfile()
 			d := r.Data(nil)
 			d.SetId(aws.StringValue(userProfile.UserProfileName))
@@ -858,7 +856,7 @@ func sweepUserProfiles(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping SageMaker domain sweep for %s: %s", region, err)
 		return sweeperErrs.ErrorOrNil()
 	}
@@ -866,7 +864,7 @@ func sweepUserProfiles(region string) error {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("retrieving SageMaker User Profiles: %w", err))
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("sweeping SageMaker User Profiles: %w", err))
 	}
 
@@ -875,7 +873,7 @@ func sweepUserProfiles(region string) error {
 
 func sweepWorkforces(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("getting client: %w", err)
 	}
@@ -886,7 +884,6 @@ func sweepWorkforces(region string) error {
 
 	err = conn.ListWorkforcesPagesWithContext(ctx, &sagemaker.ListWorkforcesInput{}, func(page *sagemaker.ListWorkforcesOutput, lastPage bool) bool {
 		for _, workforce := range page.Workforces {
-
 			r := ResourceWorkforce()
 			d := r.Data(nil)
 			d.SetId(aws.StringValue(workforce.WorkforceName))
@@ -897,7 +894,7 @@ func sweepWorkforces(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping SageMaker workforce sweep for %s: %s", region, err)
 		return sweeperErrs.ErrorOrNil()
 	}
@@ -905,7 +902,7 @@ func sweepWorkforces(region string) error {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("retrieving SageMaker Workforces: %w", err))
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("sweeping SageMaker Workforces: %w", err))
 	}
 
@@ -914,7 +911,7 @@ func sweepWorkforces(region string) error {
 
 func sweepWorkteams(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("getting client: %w", err)
 	}
@@ -925,7 +922,6 @@ func sweepWorkteams(region string) error {
 
 	err = conn.ListWorkteamsPagesWithContext(ctx, &sagemaker.ListWorkteamsInput{}, func(page *sagemaker.ListWorkteamsOutput, lastPage bool) bool {
 		for _, workteam := range page.Workteams {
-
 			r := ResourceWorkteam()
 			d := r.Data(nil)
 			d.SetId(aws.StringValue(workteam.WorkteamName))
@@ -936,7 +932,7 @@ func sweepWorkteams(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping SageMaker workteam sweep for %s: %s", region, err)
 		return sweeperErrs.ErrorOrNil()
 	}
@@ -944,7 +940,7 @@ func sweepWorkteams(region string) error {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("retrieving SageMaker Workteams: %w", err))
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("sweeping SageMaker Workteams: %w", err))
 	}
 
@@ -953,7 +949,54 @@ func sweepWorkteams(region string) error {
 
 func sweepProjects(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
+	if err != nil {
+		return fmt.Errorf("getting client: %s", err)
+	}
+	conn := client.SageMakerConn(ctx)
+	input := &sagemaker.ListProjectsInput{}
+	var sweeperErrs *multierror.Error
+
+	err = conn.ListProjectsPagesWithContext(ctx, input, func(page *sagemaker.ListProjectsOutput, lastPage bool) bool {
+		if page == nil {
+			return !lastPage
+		}
+
+		for _, v := range page.ProjectSummaryList {
+			name := aws.StringValue(v.ProjectName)
+
+			if status := aws.StringValue(v.ProjectStatus); status == sagemaker.ProjectStatusDeleteCompleted {
+				log.Printf("[INFO] Skipping SageMaker Project %s: ProjectStatus=%s", name, status)
+				continue
+			}
+
+			r := ResourceProject()
+			d := r.Data(nil)
+			d.SetId(name)
+
+			if err := sdk.NewSweepResource(r, d, client).Delete(ctx, sweep.ThrottlingRetryTimeout); err != nil { // nosemgrep:ci.semgrep.migrate.direct-CRUD-calls
+				sweeperErrs = multierror.Append(sweeperErrs, err)
+			}
+		}
+
+		return !lastPage
+	})
+
+	if awsv1.SkipSweepError(err) {
+		log.Printf("[WARN] Skipping SageMaker Project sweep for %s: %s", region, err)
+		return sweeperErrs.ErrorOrNil()
+	}
+
+	if err != nil {
+		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error listing SageMaker Projects (%s): %w", region, err))
+	}
+
+	return sweeperErrs.ErrorOrNil()
+}
+
+func sweepPipelines(region string) error {
+	ctx := sweep.Context(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("getting client: %s", err)
 	}
@@ -962,11 +1005,11 @@ func sweepProjects(region string) error {
 	sweepResources := make([]sweep.Sweepable, 0)
 	var sweeperErrs *multierror.Error
 
-	err = conn.ListProjectsPagesWithContext(ctx, &sagemaker.ListProjectsInput{}, func(page *sagemaker.ListProjectsOutput, lastPage bool) bool {
-		for _, project := range page.ProjectSummaryList {
-			name := aws.StringValue(project.ProjectName)
+	err = conn.ListPipelinesPagesWithContext(ctx, &sagemaker.ListPipelinesInput{}, func(page *sagemaker.ListPipelinesOutput, lastPage bool) bool {
+		for _, project := range page.PipelineSummaries {
+			name := aws.StringValue(project.PipelineName)
 
-			r := ResourceProject()
+			r := ResourcePipeline()
 			d := r.Data(nil)
 			d.SetId(name)
 
@@ -976,16 +1019,16 @@ func sweepProjects(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
-		log.Printf("[WARN] Skipping SageMaker Project sweep for %s: %s", region, err)
+	if awsv1.SkipSweepError(err) {
+		log.Printf("[WARN] Skipping SageMaker Pipeline sweep for %s: %s", region, err)
 		return sweeperErrs.ErrorOrNil()
 	}
 	if err != nil {
-		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("retrieving SageMaker Projects: %w", err))
+		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("retrieving SageMaker Pipelines: %w", err))
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
-		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("sweeping SageMaker Projects: %w", err))
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
+		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("sweeping SageMaker Pipelines: %w", err))
 	}
 
 	return sweeperErrs.ErrorOrNil()
diff --git a/internal/service/sagemaker/tags_gen.go b/internal/service/sagemaker/tags_gen.go
index 3f2461046f7..a3bebc7668e 100644
--- a/internal/service/sagemaker/tags_gen.go
+++ b/internal/service/sagemaker/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/sagemaker"
 	"github.com/aws/aws-sdk-go/service/sagemaker/sagemakeriface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -102,6 +104,8 @@ func updateTags(ctx context.Context, conn sagemakeriface.SageMakerAPI, identifie
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.SageMaker)
 	if len(removedTags) > 0 {
diff --git a/internal/service/sagemaker/test-fixtures/sagemaker-human-task-ui-tmpl.html b/internal/service/sagemaker/test-fixtures/sagemaker-human-task-ui-tmpl.html
index f8b547b8a8f..eeb044524e0 100644
--- a/internal/service/sagemaker/test-fixtures/sagemaker-human-task-ui-tmpl.html
+++ b/internal/service/sagemaker/test-fixtures/sagemaker-human-task-ui-tmpl.html
@@ -1,3 +1,8 @@
+<!--
+ Copyright (c) HashiCorp, Inc.
+ SPDX-License-Identifier: MPL-2.0
+-->
+
 <script src="https://assets.crowd.aws/crowd-html-elements.js"></script>
 
 <crowd-form>
diff --git a/internal/service/sagemaker/user_profile.go b/internal/service/sagemaker/user_profile.go
index 17a7665351c..efe72024ffb 100644
--- a/internal/service/sagemaker/user_profile.go
+++ b/internal/service/sagemaker/user_profile.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sagemaker
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"strings"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/aws/aws-sdk-go/service/sagemaker"
@@ -45,7 +48,7 @@ func ResourceUserProfile() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 63),
-					validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9](-*[a-zA-Z0-9]){0,62}`), "Valid characters are a-z, A-Z, 0-9, and - (hyphen)."),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z](-*[0-9A-Za-z]){0,62}`), "Valid characters are a-z, A-Z, 0-9, and - (hyphen)."),
 				),
 			},
 			"domain_id": {
@@ -113,6 +116,27 @@ func ResourceUserProfile() *schema.Resource {
 											},
 										},
 									},
+									"workspace_settings": {
+										Type:     schema.TypeList,
+										Optional: true,
+										MaxItems: 1,
+										Elem: &schema.Resource{
+											Schema: map[string]*schema.Schema{
+												"s3_artifact_path": {
+													Type:     schema.TypeString,
+													Optional: true,
+													ValidateFunc: validation.All(
+														validation.StringMatch(regexache.MustCompile(`^(https|s3)://([^/])/?(.*)$`), ""),
+														validation.StringLenBetween(1, 1024),
+													),
+												},
+												"s3_kms_key_id": {
+													Type:     schema.TypeString,
+													Optional: true,
+												},
+											},
+										},
+									},
 								},
 							},
 						},
diff --git a/internal/service/sagemaker/user_profile_test.go b/internal/service/sagemaker/user_profile_test.go
index fc3c2cb1d99..f378e67b4ff 100644
--- a/internal/service/sagemaker/user_profile_test.go
+++ b/internal/service/sagemaker/user_profile_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sagemaker_test
 
 import (
 	"context"
 	"fmt"
 	"os"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/sagemaker"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -37,7 +40,7 @@ func testAccUserProfile_basic(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "user_profile_name", rName),
 					resource.TestCheckResourceAttrPair(resourceName, "domain_id", "aws_sagemaker_domain.test", "id"),
 					resource.TestCheckResourceAttr(resourceName, "user_settings.#", "0"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "sagemaker", regexp.MustCompile(`user-profile/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "sagemaker", regexache.MustCompile(`user-profile/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 					resource.TestCheckResourceAttrSet(resourceName, "home_efs_file_system_uid"),
 				),
diff --git a/internal/service/sagemaker/validate.go b/internal/service/sagemaker/validate.go
index 86a1184fafe..45368cf7f3d 100644
--- a/internal/service/sagemaker/validate.go
+++ b/internal/service/sagemaker/validate.go
@@ -1,16 +1,19 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sagemaker
 
 import (
 	"fmt"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 )
 
 func validEnvironment(v interface{}, k string) (ws []string, errors []error) {
 	value := v.(map[string]interface{})
 	for envK, envV := range value {
-		if !regexp.MustCompile(`^[0-9A-Za-z_]+$`).MatchString(envK) {
+		if !regexache.MustCompile(`^[0-9A-Za-z_]+$`).MatchString(envK) {
 			errors = append(errors, fmt.Errorf(
 				"only alphanumeric characters and underscore allowed in %q: %q",
 				k, envK))
@@ -23,7 +26,7 @@ func validEnvironment(v interface{}, k string) (ws []string, errors []error) {
 			errors = append(errors, fmt.Errorf(
 				"%q cannot be longer than 1024 characters: %q", k, envV.(string)))
 		}
-		if regexp.MustCompile(`^[0-9]`).MatchString(envK) {
+		if regexache.MustCompile(`^[0-9]`).MatchString(envK) {
 			errors = append(errors, fmt.Errorf(
 				"%q cannot begin with a digit: %q", k, envK))
 		}
@@ -33,7 +36,7 @@ func validEnvironment(v interface{}, k string) (ws []string, errors []error) {
 
 func validImage(v interface{}, k string) (ws []string, errors []error) {
 	value := v.(string)
-	if !regexp.MustCompile(`[\S]+`).MatchString(value) {
+	if !regexache.MustCompile(`[\S]+`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"no whitespace allowed in %q: %q",
 			k, value))
@@ -47,7 +50,7 @@ func validImage(v interface{}, k string) (ws []string, errors []error) {
 
 func validModelDataURL(v interface{}, k string) (ws []string, errors []error) {
 	value := v.(string)
-	if !regexp.MustCompile(`^(https|s3)://([^/]+)/?(.*)$`).MatchString(value) {
+	if !regexache.MustCompile(`^(https|s3)://([^/]+)/?(.*)$`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"%q must be a valid path: %q",
 			k, value))
@@ -56,7 +59,7 @@ func validModelDataURL(v interface{}, k string) (ws []string, errors []error) {
 		errors = append(errors, fmt.Errorf(
 			"%q cannot be longer than 1024 characters: %q", k, value))
 	}
-	if !regexp.MustCompile(`^(https|s3)://`).MatchString(value) {
+	if !regexache.MustCompile(`^(https|s3)://`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"%q must be a path that starts with either s3 or https: %q", k, value))
 	}
@@ -65,7 +68,7 @@ func validModelDataURL(v interface{}, k string) (ws []string, errors []error) {
 
 func validName(v interface{}, k string) (ws []string, errors []error) {
 	value := v.(string)
-	if !regexp.MustCompile(`^[0-9A-Za-z-]+$`).MatchString(value) {
+	if !regexache.MustCompile(`^[0-9A-Za-z-]+$`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"only alphanumeric characters and hyphens allowed in %q: %q",
 			k, value))
@@ -74,7 +77,7 @@ func validName(v interface{}, k string) (ws []string, errors []error) {
 		errors = append(errors, fmt.Errorf(
 			"%q cannot be longer than 63 characters: %q", k, value))
 	}
-	if regexp.MustCompile(`^-`).MatchString(value) {
+	if regexache.MustCompile(`^-`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"%q cannot begin with a hyphen: %q", k, value))
 	}
@@ -83,7 +86,7 @@ func validName(v interface{}, k string) (ws []string, errors []error) {
 
 func validPrefix(v interface{}, k string) (ws []string, errors []error) {
 	value := v.(string)
-	if !regexp.MustCompile(`^[0-9A-Za-z-]+$`).MatchString(value) {
+	if !regexache.MustCompile(`^[0-9A-Za-z-]+$`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"only alphanumeric characters and hyphens allowed in %q: %q",
 			k, value))
@@ -93,7 +96,7 @@ func validPrefix(v interface{}, k string) (ws []string, errors []error) {
 		errors = append(errors, fmt.Errorf(
 			"%q cannot be longer than %d characters: %q", k, maxLength, value))
 	}
-	if regexp.MustCompile(`^-`).MatchString(value) {
+	if regexache.MustCompile(`^-`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"%q cannot begin with a hyphen: %q", k, value))
 	}
diff --git a/internal/service/sagemaker/validate_test.go b/internal/service/sagemaker/validate_test.go
index 84270e8289e..fe00065929d 100644
--- a/internal/service/sagemaker/validate_test.go
+++ b/internal/service/sagemaker/validate_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sagemaker
 
 import (
diff --git a/internal/service/sagemaker/wait.go b/internal/service/sagemaker/wait.go
index d011e142af1..3cceea30ff7 100644
--- a/internal/service/sagemaker/wait.go
+++ b/internal/service/sagemaker/wait.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sagemaker
 
 import (
diff --git a/internal/service/sagemaker/workforce.go b/internal/service/sagemaker/workforce.go
index cedd514eb03..2af1497a742 100644
--- a/internal/service/sagemaker/workforce.go
+++ b/internal/service/sagemaker/workforce.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sagemaker
 
 import (
 	"context"
 	"log"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/sagemaker"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -146,7 +149,7 @@ func ResourceWorkforce() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 63),
-					validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9]([a-zA-Z0-9\-])*$`), "Valid characters are a-z, A-Z, 0-9, and - (hyphen)."),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z]([0-9A-Za-z-])*$`), "Valid characters are a-z, A-Z, 0-9, and - (hyphen)."),
 				),
 			},
 			"workforce_vpc_config": {
diff --git a/internal/service/sagemaker/workforce_test.go b/internal/service/sagemaker/workforce_test.go
index 567bd7bf4c2..7220da2f871 100644
--- a/internal/service/sagemaker/workforce_test.go
+++ b/internal/service/sagemaker/workforce_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sagemaker_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/sagemaker"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -33,7 +36,7 @@ func testAccWorkforce_cognitoConfig(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckWorkforceExists(ctx, resourceName, &workforce),
 					resource.TestCheckResourceAttr(resourceName, "workforce_name", rName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "sagemaker", regexp.MustCompile(`workforce/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "sagemaker", regexache.MustCompile(`workforce/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "cognito_config.#", "1"),
 					resource.TestCheckResourceAttrPair(resourceName, "cognito_config.0.client_id", "aws_cognito_user_pool_client.test", "id"),
 					resource.TestCheckResourceAttrPair(resourceName, "cognito_config.0.user_pool", "aws_cognito_user_pool.test", "id"),
@@ -72,7 +75,7 @@ func testAccWorkforce_oidcConfig(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckWorkforceExists(ctx, resourceName, &workforce),
 					resource.TestCheckResourceAttr(resourceName, "workforce_name", rName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "sagemaker", regexp.MustCompile(`workforce/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "sagemaker", regexache.MustCompile(`workforce/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "cognito_config.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "oidc_config.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "oidc_config.0.authorization_endpoint", endpoint1),
@@ -99,7 +102,7 @@ func testAccWorkforce_oidcConfig(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckWorkforceExists(ctx, resourceName, &workforce),
 					resource.TestCheckResourceAttr(resourceName, "workforce_name", rName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "sagemaker", regexp.MustCompile(`workforce/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "sagemaker", regexache.MustCompile(`workforce/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "cognito_config.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "oidc_config.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "oidc_config.0.authorization_endpoint", endpoint2),
diff --git a/internal/service/sagemaker/workteam.go b/internal/service/sagemaker/workteam.go
index 014ec943d7d..bed21814b03 100644
--- a/internal/service/sagemaker/workteam.go
+++ b/internal/service/sagemaker/workteam.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sagemaker
 
 import (
 	"context"
 	"log"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/sagemaker"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -125,7 +128,7 @@ func ResourceWorkteam() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 63),
-					validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9](-*[a-zA-Z0-9])*$`), "Valid characters are a-z, A-Z, 0-9, and - (hyphen)."),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z](-*[0-9A-Za-z])*$`), "Valid characters are a-z, A-Z, 0-9, and - (hyphen)."),
 				),
 			},
 		},
diff --git a/internal/service/sagemaker/workteam_test.go b/internal/service/sagemaker/workteam_test.go
index 1687535e79b..810fadcfd89 100644
--- a/internal/service/sagemaker/workteam_test.go
+++ b/internal/service/sagemaker/workteam_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sagemaker_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/sagemaker"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -33,7 +36,7 @@ func testAccWorkteam_cognitoConfig(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckWorkteamExists(ctx, resourceName, &workteam),
 					resource.TestCheckResourceAttr(resourceName, "workteam_name", rName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "sagemaker", regexp.MustCompile(`workteam/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "sagemaker", regexache.MustCompile(`workteam/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "description", rName),
 					resource.TestCheckResourceAttr(resourceName, "member_definition.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "member_definition.0.cognito_member_definition.#", "1"),
@@ -55,7 +58,7 @@ func testAccWorkteam_cognitoConfig(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckWorkteamExists(ctx, resourceName, &workteam),
 					resource.TestCheckResourceAttr(resourceName, "workteam_name", rName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "sagemaker", regexp.MustCompile(`workteam/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "sagemaker", regexache.MustCompile(`workteam/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "description", rName),
 					resource.TestCheckResourceAttr(resourceName, "member_definition.#", "2"),
 					resource.TestCheckResourceAttr(resourceName, "member_definition.0.cognito_member_definition.#", "1"),
@@ -74,7 +77,7 @@ func testAccWorkteam_cognitoConfig(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckWorkteamExists(ctx, resourceName, &workteam),
 					resource.TestCheckResourceAttr(resourceName, "workteam_name", rName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "sagemaker", regexp.MustCompile(`workteam/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "sagemaker", regexache.MustCompile(`workteam/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "description", rName),
 					resource.TestCheckResourceAttr(resourceName, "member_definition.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "member_definition.0.cognito_member_definition.#", "1"),
@@ -105,7 +108,7 @@ func testAccWorkteam_oidcConfig(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckWorkteamExists(ctx, resourceName, &workteam),
 					resource.TestCheckResourceAttr(resourceName, "workteam_name", rName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "sagemaker", regexp.MustCompile(`workteam/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "sagemaker", regexache.MustCompile(`workteam/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "member_definition.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "member_definition.0.oidc_member_definition.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "member_definition.0.oidc_member_definition.0.groups.#", "1"),
@@ -123,7 +126,7 @@ func testAccWorkteam_oidcConfig(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckWorkteamExists(ctx, resourceName, &workteam),
 					resource.TestCheckResourceAttr(resourceName, "workteam_name", rName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "sagemaker", regexp.MustCompile(`workteam/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "sagemaker", regexache.MustCompile(`workteam/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "member_definition.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "member_definition.0.oidc_member_definition.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "member_definition.0.oidc_member_definition.0.groups.#", "2"),
@@ -136,7 +139,7 @@ func testAccWorkteam_oidcConfig(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckWorkteamExists(ctx, resourceName, &workteam),
 					resource.TestCheckResourceAttr(resourceName, "workteam_name", rName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "sagemaker", regexp.MustCompile(`workteam/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "sagemaker", regexache.MustCompile(`workteam/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "member_definition.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "member_definition.0.oidc_member_definition.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "member_definition.0.oidc_member_definition.0.groups.#", "1"),
@@ -210,7 +213,7 @@ func testAccWorkteam_notificationConfig(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckWorkteamExists(ctx, resourceName, &workteam),
 					resource.TestCheckResourceAttr(resourceName, "workteam_name", rName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "sagemaker", regexp.MustCompile(`workteam/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "sagemaker", regexache.MustCompile(`workteam/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "description", rName),
 					resource.TestCheckResourceAttr(resourceName, "notification_configuration.#", "1"),
 					resource.TestCheckResourceAttrPair(resourceName, "notification_configuration.0.notification_topic_arn", "aws_sns_topic.test", "arn"),
@@ -227,7 +230,7 @@ func testAccWorkteam_notificationConfig(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckWorkteamExists(ctx, resourceName, &workteam),
 					resource.TestCheckResourceAttr(resourceName, "workteam_name", rName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "sagemaker", regexp.MustCompile(`workteam/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "sagemaker", regexache.MustCompile(`workteam/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "description", rName),
 					resource.TestCheckResourceAttr(resourceName, "notification_configuration.#", "1"),
 				),
@@ -237,7 +240,7 @@ func testAccWorkteam_notificationConfig(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckWorkteamExists(ctx, resourceName, &workteam),
 					resource.TestCheckResourceAttr(resourceName, "workteam_name", rName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "sagemaker", regexp.MustCompile(`workteam/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "sagemaker", regexache.MustCompile(`workteam/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "description", rName),
 					resource.TestCheckResourceAttr(resourceName, "notification_configuration.#", "1"),
 					resource.TestCheckResourceAttrPair(resourceName, "notification_configuration.0.notification_topic_arn", "aws_sns_topic.test", "arn"),
diff --git a/internal/service/scheduler/exports_test.go b/internal/service/scheduler/exports_test.go
index 56dacaccb30..6e354af2834 100644
--- a/internal/service/scheduler/exports_test.go
+++ b/internal/service/scheduler/exports_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package scheduler
 
 // Exports for use in tests only.
diff --git a/internal/service/scheduler/find.go b/internal/service/scheduler/find.go
index ef52c586d08..cdd279b93bf 100644
--- a/internal/service/scheduler/find.go
+++ b/internal/service/scheduler/find.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package scheduler
 
 import (
diff --git a/internal/service/scheduler/flex.go b/internal/service/scheduler/flex.go
index e98f3038af6..556e7e92a72 100644
--- a/internal/service/scheduler/flex.go
+++ b/internal/service/scheduler/flex.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package scheduler
 
 import (
diff --git a/internal/service/scheduler/generate.go b/internal/service/scheduler/generate.go
index 3ed1203935a..4507f6aab30 100644
--- a/internal/service/scheduler/generate.go
+++ b/internal/service/scheduler/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -AWSSDKVersion=2 -ListTags -UpdateTags -ServiceTagsSlice
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/scheduler/retry.go b/internal/service/scheduler/retry.go
index aea870cacea..90d328eb318 100644
--- a/internal/service/scheduler/retry.go
+++ b/internal/service/scheduler/retry.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package scheduler
 
 import (
diff --git a/internal/service/scheduler/schedule.go b/internal/service/scheduler/schedule.go
index 1bbb4d6d975..664fbbcd3f5 100644
--- a/internal/service/scheduler/schedule.go
+++ b/internal/service/scheduler/schedule.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package scheduler
 
 import (
@@ -7,10 +10,10 @@ import (
 	"fmt"
 	"log"
 	"math"
-	"regexp"
 	"strings"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/scheduler"
 	"github.com/aws/aws-sdk-go-v2/service/scheduler/types"
@@ -97,7 +100,7 @@ func resourceSchedule() *schema.Resource {
 				ConflictsWith: []string{"name_prefix"},
 				ValidateDiagFunc: validation.ToDiagFunc(validation.All(
 					validation.StringLenBetween(1, 64),
-					validation.StringMatch(regexp.MustCompile(`^[0-9a-zA-Z-_.]+$`), `The name must consist of alphanumerics, hyphens, and underscores.`),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_.-]+$`), `The name must consist of alphanumerics, hyphens, and underscores.`),
 				)),
 			},
 			"name_prefix": {
@@ -108,7 +111,7 @@ func resourceSchedule() *schema.Resource {
 				ConflictsWith: []string{"name"},
 				ValidateDiagFunc: validation.ToDiagFunc(validation.All(
 					validation.StringLenBetween(1, 64-id.UniqueIDSuffixLength),
-					validation.StringMatch(regexp.MustCompile(`^[0-9a-zA-Z-_.]+$`), `The name must consist of alphanumerics, hyphens, and underscores.`),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_.-]+$`), `The name must consist of alphanumerics, hyphens, and underscores.`),
 				)),
 			},
 			"schedule_expression": {
diff --git a/internal/service/scheduler/schedule_group.go b/internal/service/scheduler/schedule_group.go
index 620d34ab17e..3a2d2d58119 100644
--- a/internal/service/scheduler/schedule_group.go
+++ b/internal/service/scheduler/schedule_group.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package scheduler
 
 import (
 	"context"
 	"errors"
 	"log"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/scheduler"
 	"github.com/aws/aws-sdk-go-v2/service/scheduler/types"
@@ -63,7 +66,7 @@ func ResourceScheduleGroup() *schema.Resource {
 				ConflictsWith: []string{"name_prefix"},
 				ValidateDiagFunc: validation.ToDiagFunc(validation.All(
 					validation.StringLenBetween(1, 64),
-					validation.StringMatch(regexp.MustCompile(`^[0-9a-zA-Z-_.]+$`), `The name must consist of alphanumerics, hyphens, and underscores.`),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_.-]+$`), `The name must consist of alphanumerics, hyphens, and underscores.`),
 				)),
 			},
 			"name_prefix": {
@@ -74,7 +77,7 @@ func ResourceScheduleGroup() *schema.Resource {
 				ConflictsWith: []string{"name"},
 				ValidateDiagFunc: validation.ToDiagFunc(validation.All(
 					validation.StringLenBetween(1, 64-id.UniqueIDSuffixLength),
-					validation.StringMatch(regexp.MustCompile(`^[0-9a-zA-Z-_.]+$`), `The name must consist of alphanumerics, hyphens, and underscores.`),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_.-]+$`), `The name must consist of alphanumerics, hyphens, and underscores.`),
 				)),
 			},
 			"state": {
diff --git a/internal/service/scheduler/schedule_group_test.go b/internal/service/scheduler/schedule_group_test.go
index 5cfa3af8b5f..d4583f80287 100644
--- a/internal/service/scheduler/schedule_group_test.go
+++ b/internal/service/scheduler/schedule_group_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package scheduler_test
 
 import (
@@ -8,6 +11,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/scheduler"
 	"github.com/aws/aws-sdk-go-v2/service/scheduler/types"
@@ -42,7 +46,7 @@ func TestAccSchedulerScheduleGroup_basic(t *testing.T) {
 				Config: testAccScheduleGroupConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckScheduleGroupExists(ctx, resourceName, &scheduleGroup),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "scheduler", regexp.MustCompile(regexp.QuoteMeta(`schedule-group/`+rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "scheduler", regexache.MustCompile(regexp.QuoteMeta(`schedule-group/`+rName))),
 					resource.TestCheckResourceAttrWith(resourceName, "creation_date", func(actual string) error {
 						expect := scheduleGroup.CreationDate.Format(time.RFC3339)
 						if actual != expect {
diff --git a/internal/service/scheduler/schedule_test.go b/internal/service/scheduler/schedule_test.go
index 9dc891be654..c0919c2c302 100644
--- a/internal/service/scheduler/schedule_test.go
+++ b/internal/service/scheduler/schedule_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package scheduler_test
 
 import (
@@ -7,6 +10,7 @@ import (
 	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/service/scheduler"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -198,7 +202,7 @@ func TestAccSchedulerSchedule_basic(t *testing.T) {
 				Config: testAccScheduleConfig_basic(name),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckScheduleExists(ctx, t, resourceName, &schedule),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "scheduler", regexp.MustCompile(regexp.QuoteMeta(`schedule/default/`+name))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "scheduler", regexache.MustCompile(regexp.QuoteMeta(`schedule/default/`+name))),
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
 					resource.TestCheckResourceAttr(resourceName, "end_date", ""),
 					resource.TestCheckResourceAttr(resourceName, "flexible_time_window.0.maximum_window_in_minutes", "0"),
diff --git a/internal/service/scheduler/service_package_gen.go b/internal/service/scheduler/service_package_gen.go
index 6ddbf33ca40..aa8c9f65ef5 100644
--- a/internal/service/scheduler/service_package_gen.go
+++ b/internal/service/scheduler/service_package_gen.go
@@ -7,6 +7,7 @@ import (
 
 	aws_sdkv2 "github.com/aws/aws-sdk-go-v2/aws"
 	scheduler_sdkv2 "github.com/aws/aws-sdk-go-v2/service/scheduler"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -52,9 +53,11 @@ func (p *servicePackage) NewClient(ctx context.Context, config map[string]any) (
 
 	return scheduler_sdkv2.NewFromConfig(cfg, func(o *scheduler_sdkv2.Options) {
 		if endpoint := config["endpoint"].(string); endpoint != "" {
-			o.EndpointResolver = scheduler_sdkv2.EndpointResolverFromURL(endpoint)
+			o.BaseEndpoint = aws_sdkv2.String(endpoint)
 		}
 	}), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/scheduler/status.go b/internal/service/scheduler/status.go
index 88aec603ce8..d8b576064d2 100644
--- a/internal/service/scheduler/status.go
+++ b/internal/service/scheduler/status.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package scheduler
 
 import (
diff --git a/internal/service/scheduler/sweep.go b/internal/service/scheduler/sweep.go
index 717cc9248d7..fa55131e604 100644
--- a/internal/service/scheduler/sweep.go
+++ b/internal/service/scheduler/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package scheduler
 
@@ -9,12 +9,12 @@ import (
 
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/scheduler"
-	"github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv2"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_scheduler_schedule_group", &resource.Sweeper{
 		Name: "aws_scheduler_schedule_group",
 		F:    sweepScheduleGroups,
@@ -31,7 +31,7 @@ func init() {
 
 func sweepScheduleGroups(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("getting client: %w", err)
@@ -39,16 +39,17 @@ func sweepScheduleGroups(region string) error {
 
 	conn := client.SchedulerClient(ctx)
 	sweepResources := make([]sweep.Sweepable, 0)
-	var errs *multierror.Error
 
 	paginator := scheduler.NewListScheduleGroupsPaginator(conn, &scheduler.ListScheduleGroupsInput{})
 
 	for paginator.HasMorePages() {
 		page, err := paginator.NextPage(ctx)
-
+		if awsv2.SkipSweepError(err) {
+			log.Printf("[WARN] Skipping Schedule Group sweep for %s: %s", region, err)
+			return nil
+		}
 		if err != nil {
-			errs = multierror.Append(errs, fmt.Errorf("listing Schedule Groups for %s: %w", region, err))
-			break
+			return fmt.Errorf("listing Schedule Groups for %s: %w", region, err)
 		}
 
 		for _, it := range page.ScheduleGroups {
@@ -67,21 +68,16 @@ func sweepScheduleGroups(region string) error {
 		}
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
-		errs = multierror.Append(errs, fmt.Errorf("sweeping Schedule Group for %s: %w", region, err))
-	}
-
-	if sweep.SkipSweepError(err) {
-		log.Printf("[WARN] Skipping Schedule Group sweep for %s: %s", region, errs)
-		return nil
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
+		return fmt.Errorf("sweeping Schedule Group for %s: %w", region, err)
 	}
 
-	return errs.ErrorOrNil()
+	return nil
 }
 
 func sweepSchedules(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("getting client: %w", err)
@@ -89,16 +85,17 @@ func sweepSchedules(region string) error {
 
 	conn := client.SchedulerClient(ctx)
 	sweepResources := make([]sweep.Sweepable, 0)
-	var errs *multierror.Error
 
 	paginator := scheduler.NewListSchedulesPaginator(conn, &scheduler.ListSchedulesInput{})
 
 	for paginator.HasMorePages() {
 		page, err := paginator.NextPage(ctx)
-
+		if awsv2.SkipSweepError(err) {
+			log.Printf("[WARN] Skipping Schedule sweep for %s: %s", region, err)
+			return nil
+		}
 		if err != nil {
-			errs = multierror.Append(errs, fmt.Errorf("listing Schedules for %s: %w", region, err))
-			break
+			return fmt.Errorf("listing Schedules for %s: %w", region, err)
 		}
 
 		for _, it := range page.Schedules {
@@ -113,14 +110,9 @@ func sweepSchedules(region string) error {
 		}
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
-		errs = multierror.Append(errs, fmt.Errorf("sweeping Schedule for %s: %w", region, err))
-	}
-
-	if sweep.SkipSweepError(err) {
-		log.Printf("[WARN] Skipping Schedule sweep for %s: %s", region, errs)
-		return nil
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
+		return fmt.Errorf("sweeping Schedule for %s: %w", region, err)
 	}
 
-	return errs.ErrorOrNil()
+	return nil
 }
diff --git a/internal/service/scheduler/tags_gen.go b/internal/service/scheduler/tags_gen.go
index 071f9aa5a03..f1c291f3fbd 100644
--- a/internal/service/scheduler/tags_gen.go
+++ b/internal/service/scheduler/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/scheduler"
 	awstypes "github.com/aws/aws-sdk-go-v2/service/scheduler/types"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -102,6 +104,8 @@ func updateTags(ctx context.Context, conn *scheduler.Client, identifier string,
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.Scheduler)
 	if len(removedTags) > 0 {
diff --git a/internal/service/scheduler/wait.go b/internal/service/scheduler/wait.go
index 66b167b95ae..9f03fb5687c 100644
--- a/internal/service/scheduler/wait.go
+++ b/internal/service/scheduler/wait.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package scheduler
 
 import (
diff --git a/internal/service/schemas/discoverer.go b/internal/service/schemas/discoverer.go
index eec58dc6a98..c5ecf827fc7 100644
--- a/internal/service/schemas/discoverer.go
+++ b/internal/service/schemas/discoverer.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package schemas
 
 import (
diff --git a/internal/service/schemas/discoverer_test.go b/internal/service/schemas/discoverer_test.go
index b453915aa6e..0104677ee83 100644
--- a/internal/service/schemas/discoverer_test.go
+++ b/internal/service/schemas/discoverer_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package schemas_test
 
 import (
diff --git a/internal/service/schemas/find.go b/internal/service/schemas/find.go
index bb9b5a14eed..bc5de784df5 100644
--- a/internal/service/schemas/find.go
+++ b/internal/service/schemas/find.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package schemas
 
 import (
diff --git a/internal/service/schemas/generate.go b/internal/service/schemas/generate.go
index 9731a32d407..d1ac8908d49 100644
--- a/internal/service/schemas/generate.go
+++ b/internal/service/schemas/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTags -ServiceTagsMap -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/schemas/id.go b/internal/service/schemas/id.go
index cb695e49eed..91d538d782a 100644
--- a/internal/service/schemas/id.go
+++ b/internal/service/schemas/id.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package schemas
 
 import (
diff --git a/internal/service/schemas/registry.go b/internal/service/schemas/registry.go
index d89cc65051c..ad81c64c1c3 100644
--- a/internal/service/schemas/registry.go
+++ b/internal/service/schemas/registry.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package schemas
 
 import (
 	"context"
 	"log"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/schemas"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -49,7 +52,7 @@ func ResourceRegistry() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 64),
-					validation.StringMatch(regexp.MustCompile(`^[\.\-_A-Za-z0-9]+`), ""),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_.-]+`), ""),
 				),
 			},
 			names.AttrTags:    tftags.TagsSchema(),
diff --git a/internal/service/schemas/registry_policy.go b/internal/service/schemas/registry_policy.go
index 960ebb53457..828045b73f9 100644
--- a/internal/service/schemas/registry_policy.go
+++ b/internal/service/schemas/registry_policy.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package schemas
 
 import (
diff --git a/internal/service/schemas/registry_policy_test.go b/internal/service/schemas/registry_policy_test.go
index 93ec4836245..30609df9bee 100644
--- a/internal/service/schemas/registry_policy_test.go
+++ b/internal/service/schemas/registry_policy_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package schemas_test
 
 import (
diff --git a/internal/service/schemas/registry_test.go b/internal/service/schemas/registry_test.go
index a5539b8bf27..03a06d85536 100644
--- a/internal/service/schemas/registry_test.go
+++ b/internal/service/schemas/registry_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package schemas_test
 
 import (
diff --git a/internal/service/schemas/schema.go b/internal/service/schemas/schema.go
index 4c44997afdd..9370e4ec02e 100644
--- a/internal/service/schemas/schema.go
+++ b/internal/service/schemas/schema.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package schemas
 
 import (
 	"context"
 	"log"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/schemas"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -14,6 +17,7 @@ import (
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
+	tfslices "github.com/hashicorp/terraform-provider-aws/internal/slices"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
@@ -61,7 +65,7 @@ func ResourceSchema() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 385),
-					validation.StringMatch(regexp.MustCompile(`^[\.\-_A-Za-z@]+`), ""),
+					validation.StringMatch(regexache.MustCompile(`^[A-Za-z_.@-]+`), ""),
 				),
 			},
 
@@ -74,7 +78,7 @@ func ResourceSchema() *schema.Resource {
 			"type": {
 				Type:         schema.TypeString,
 				Required:     true,
-				ValidateFunc: validation.StringInSlice(schemas.Type_Values(), true),
+				ValidateFunc: validation.StringInSlice(type_Values(), true),
 			},
 
 			"version": {
@@ -231,3 +235,8 @@ func resourceSchemaDelete(ctx context.Context, d *schema.ResourceData, meta inte
 
 	return diags
 }
+
+func type_Values() []string {
+	// For some reason AWS SDK for Go v1 does not define a TypeJSONSchemaDraft4 constant.
+	return tfslices.AppendUnique(schemas.Type_Values(), "JSONSchemaDraft4")
+}
diff --git a/internal/service/schemas/schema_test.go b/internal/service/schemas/schema_test.go
index 045ab525eee..2a384319a3b 100644
--- a/internal/service/schemas/schema_test.go
+++ b/internal/service/schemas/schema_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package schemas_test
 
 import (
@@ -60,14 +63,36 @@ const (
             "format": "date-time"
           }
         }
-	  }
-	}
+      }
+    }
   }
 }
+`
+
+	testAccJSONSchemaContent = `
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://example.com/product.schema.json",
+  "title": "Event",
+  "description": "An generic example",
+  "type": "object",
+  "properties": {
+    "name": {
+      "description": "The unique identifier for a product",
+      "type": "string"
+    },
+    "created_at": {
+      "description": "Date-time format",
+      "type": "string",
+      "format": "date-time"
+    }
+  },
+  "required": [ "name" ]
+}
 `
 )
 
-func TestAccSchemasSchema_basic(t *testing.T) {
+func TestAccSchemasSchema_openAPI3(t *testing.T) {
 	ctx := acctest.Context(t)
 	var v schemas.DescribeSchemaOutput
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
@@ -104,6 +129,43 @@ func TestAccSchemasSchema_basic(t *testing.T) {
 	})
 }
 
+func TestAccSchemasSchema_jsonSchemaDraftv4(t *testing.T) {
+	ctx := acctest.Context(t)
+	var v schemas.DescribeSchemaOutput
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_schemas_schema.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, schemas.EndpointsID) },
+		ErrorCheck:               acctest.ErrorCheck(t, schemas.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckSchemaDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccSchemaConfig_jsonSchema(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckSchemaExists(ctx, resourceName, &v),
+					acctest.CheckResourceAttrRegionalARN(resourceName, "arn", "schemas", fmt.Sprintf("schema/%s/%s", rName, rName)),
+					resource.TestCheckResourceAttr(resourceName, "description", ""),
+					resource.TestCheckResourceAttr(resourceName, "content", testAccJSONSchemaContent),
+					resource.TestCheckResourceAttrSet(resourceName, "last_modified"),
+					resource.TestCheckResourceAttr(resourceName, "name", rName),
+					resource.TestCheckResourceAttr(resourceName, "registry_name", rName),
+					resource.TestCheckResourceAttr(resourceName, "type", "JSONSchemaDraft4"),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
+					resource.TestCheckResourceAttr(resourceName, "version", "1"),
+					resource.TestCheckResourceAttrSet(resourceName, "version_created_date"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
 func TestAccSchemasSchema_disappears(t *testing.T) {
 	ctx := acctest.Context(t)
 	var v schemas.DescribeSchemaOutput
@@ -299,6 +361,21 @@ resource "aws_schemas_schema" "test" {
 `, rName, testAccSchemaContent)
 }
 
+func testAccSchemaConfig_jsonSchema(rName string) string {
+	return fmt.Sprintf(`
+resource "aws_schemas_registry" "test" {
+  name = %[1]q
+}
+
+resource "aws_schemas_schema" "test" {
+  name          = %[1]q
+  registry_name = aws_schemas_registry.test.name
+  type          = "JSONSchemaDraft4"
+  content       = %[2]q
+}
+`, rName, testAccJSONSchemaContent)
+}
+
 func testAccSchemaConfig_contentDescription(rName, content, description string) string {
 	return fmt.Sprintf(`
 resource "aws_schemas_registry" "test" {
diff --git a/internal/service/schemas/service_package_gen.go b/internal/service/schemas/service_package_gen.go
index 21ed784aab2..111d632ba89 100644
--- a/internal/service/schemas/service_package_gen.go
+++ b/internal/service/schemas/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	schemas_sdkv1 "github.com/aws/aws-sdk-go/service/schemas"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -70,4 +71,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*s
 	return schemas_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/schemas/sweep.go b/internal/service/schemas/sweep.go
index 23326a53c08..b9d64974622 100644
--- a/internal/service/schemas/sweep.go
+++ b/internal/service/schemas/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package schemas
 
@@ -13,9 +13,10 @@ import (
 	"github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_schemas_discoverer", &resource.Sweeper{
 		Name: "aws_schemas_discoverer",
 		F:    sweepDiscoverers,
@@ -37,7 +38,7 @@ func init() {
 
 func sweepDiscoverers(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("getting client: %w", err)
 	}
@@ -63,7 +64,7 @@ func sweepDiscoverers(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping EventBridge Schemas Discoverer sweep for %s: %s", region, err)
 		return sweeperErrs.ErrorOrNil() // In case we have completed some pages, but had errors
 	}
@@ -71,7 +72,7 @@ func sweepDiscoverers(region string) error {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("listing EventBridge Schemas Discoverers: %w", err))
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("sweeping EventBridge Schemas Discoverers: %w", err))
 	}
 
@@ -80,7 +81,7 @@ func sweepDiscoverers(region string) error {
 
 func sweepRegistries(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("getting client: %w", err)
 	}
@@ -111,7 +112,7 @@ func sweepRegistries(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping EventBridge Schemas Registry sweep for %s: %s", region, err)
 		return sweeperErrs.ErrorOrNil() // In case we have completed some pages, but had errors
 	}
@@ -119,7 +120,7 @@ func sweepRegistries(region string) error {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("listing EventBridge Schemas Registries: %w", err))
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error sweeping EventBridge Schemas Registries: %w", err))
 	}
 
@@ -128,7 +129,7 @@ func sweepRegistries(region string) error {
 
 func sweepSchemas(region string) error { // nosemgrep:ci.schemas-in-func-name
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("getting client: %w", err)
 	}
@@ -179,7 +180,7 @@ func sweepSchemas(region string) error { // nosemgrep:ci.schemas-in-func-name
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping EventBridge Schemas Schemas sweep for %s: %s", region, err)
 		return sweeperErrs.ErrorOrNil() // In case we have completed some pages, but had errors
 	}
@@ -187,7 +188,7 @@ func sweepSchemas(region string) error { // nosemgrep:ci.schemas-in-func-name
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("listing EventBridge Schemas Schemas (%s): %w", region, err))
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error sweeping EventBridge Schemas Schemas (%s): %w", region, err))
 	}
 
diff --git a/internal/service/schemas/tags_gen.go b/internal/service/schemas/tags_gen.go
index 63a92cb4f3f..1206225447e 100644
--- a/internal/service/schemas/tags_gen.go
+++ b/internal/service/schemas/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/schemas"
 	"github.com/aws/aws-sdk-go/service/schemas/schemasiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -54,7 +56,7 @@ func Tags(tags tftags.KeyValueTags) map[string]*string {
 	return aws.StringMap(tags.Map())
 }
 
-// KeyValueTags creates KeyValueTags from schemas service tags.
+// KeyValueTags creates tftags.KeyValueTags from schemas service tags.
 func KeyValueTags(ctx context.Context, tags map[string]*string) tftags.KeyValueTags {
 	return tftags.New(ctx, tags)
 }
@@ -85,6 +87,8 @@ func updateTags(ctx context.Context, conn schemasiface.SchemasAPI, identifier st
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.Schemas)
 	if len(removedTags) > 0 {
diff --git a/internal/service/secretsmanager/consts.go b/internal/service/secretsmanager/consts.go
index 1df547c7771..c17ad53267f 100644
--- a/internal/service/secretsmanager/consts.go
+++ b/internal/service/secretsmanager/consts.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package secretsmanager
 
 import (
diff --git a/internal/service/secretsmanager/generate.go b/internal/service/secretsmanager/generate.go
index af6682aeddc..c1b1ca83239 100644
--- a/internal/service/secretsmanager/generate.go
+++ b/internal/service/secretsmanager/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTagsInIDElem=SecretId -ServiceTagsSlice -TagInIDElem=SecretId -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/secretsmanager/random_password_data_source.go b/internal/service/secretsmanager/random_password_data_source.go
index bc3f5ab8726..839de8b39ff 100644
--- a/internal/service/secretsmanager/random_password_data_source.go
+++ b/internal/service/secretsmanager/random_password_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package secretsmanager
 
 import (
diff --git a/internal/service/secretsmanager/random_password_data_source_test.go b/internal/service/secretsmanager/random_password_data_source_test.go
index 697aa4e0497..f14c46e92a3 100644
--- a/internal/service/secretsmanager/random_password_data_source_test.go
+++ b/internal/service/secretsmanager/random_password_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package secretsmanager_test
 
 import (
diff --git a/internal/service/secretsmanager/secret.go b/internal/service/secretsmanager/secret.go
index 27121e6ec57..d2fa147abbf 100644
--- a/internal/service/secretsmanager/secret.go
+++ b/internal/service/secretsmanager/secret.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package secretsmanager
 
 import (
diff --git a/internal/service/secretsmanager/secret_data_source.go b/internal/service/secretsmanager/secret_data_source.go
index da3c09b7cd6..d4b1676d1e1 100644
--- a/internal/service/secretsmanager/secret_data_source.go
+++ b/internal/service/secretsmanager/secret_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package secretsmanager
 
 import (
diff --git a/internal/service/secretsmanager/secret_data_source_test.go b/internal/service/secretsmanager/secret_data_source_test.go
index b97b4651bf4..1948d255cf4 100644
--- a/internal/service/secretsmanager/secret_data_source_test.go
+++ b/internal/service/secretsmanager/secret_data_source_test.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package secretsmanager_test
 
 import (
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/secretsmanager"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -21,15 +24,15 @@ func TestAccSecretsManagerSecretDataSource_basic(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccSecretDataSourceConfig_missingRequired,
-				ExpectError: regexp.MustCompile(`must specify either arn or name`),
+				ExpectError: regexache.MustCompile(`must specify either arn or name`),
 			},
 			{
 				Config:      testAccSecretDataSourceConfig_multipleSpecified,
-				ExpectError: regexp.MustCompile(`specify only arn or name`),
+				ExpectError: regexache.MustCompile(`specify only arn or name`),
 			},
 			{
 				Config:      testAccSecretDataSourceConfig_nonExistent,
-				ExpectError: regexp.MustCompile(`not found`),
+				ExpectError: regexache.MustCompile(`not found`),
 			},
 		},
 	})
diff --git a/internal/service/secretsmanager/secret_policy.go b/internal/service/secretsmanager/secret_policy.go
index 6738c1a3285..5c4f53d075f 100644
--- a/internal/service/secretsmanager/secret_policy.go
+++ b/internal/service/secretsmanager/secret_policy.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package secretsmanager
 
 import (
diff --git a/internal/service/secretsmanager/secret_policy_test.go b/internal/service/secretsmanager/secret_policy_test.go
index cf9ce9ac6e4..16824737975 100644
--- a/internal/service/secretsmanager/secret_policy_test.go
+++ b/internal/service/secretsmanager/secret_policy_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package secretsmanager_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/secretsmanager"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -36,7 +39,7 @@ func TestAccSecretsManagerSecretPolicy_basic(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckSecretPolicyExists(ctx, resourceName, &policy),
 					resource.TestMatchResourceAttr(resourceName, "policy",
-						regexp.MustCompile(`{"Action":"secretsmanager:GetSecretValue".+`)),
+						regexache.MustCompile(`{"Action":"secretsmanager:GetSecretValue".+`)),
 				),
 			},
 			{
@@ -50,7 +53,7 @@ func TestAccSecretsManagerSecretPolicy_basic(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckSecretPolicyExists(ctx, resourceName, &policy),
 					resource.TestMatchResourceAttr(resourceName, "policy",
-						regexp.MustCompile(`{"Action":"secretsmanager:\*".+`)),
+						regexache.MustCompile(`{"Action":"secretsmanager:\*".+`)),
 				),
 			},
 		},
diff --git a/internal/service/secretsmanager/secret_rotation.go b/internal/service/secretsmanager/secret_rotation.go
index 24937d54104..f0faf31ef8e 100644
--- a/internal/service/secretsmanager/secret_rotation.go
+++ b/internal/service/secretsmanager/secret_rotation.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package secretsmanager
 
 import (
 	"context"
 	"log"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/secretsmanager"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
@@ -58,14 +61,14 @@ func ResourceSecretRotation() *schema.Resource {
 						"duration": {
 							Type:         schema.TypeString,
 							Optional:     true,
-							ValidateFunc: validation.StringMatch(regexp.MustCompile(`[0-9h]+`), ""),
+							ValidateFunc: validation.StringMatch(regexache.MustCompile(`[0-9h]+`), ""),
 						},
 						"schedule_expression": {
 							Type:          schema.TypeString,
 							Optional:      true,
 							ConflictsWith: []string{"rotation_rules.0.automatically_after_days"},
 							ExactlyOneOf:  []string{"rotation_rules.0.automatically_after_days", "rotation_rules.0.schedule_expression"},
-							ValidateFunc:  validation.StringMatch(regexp.MustCompile(`[0-9A-Za-z\(\)#\?\*\-\/, ]+`), ""),
+							ValidateFunc:  validation.StringMatch(regexache.MustCompile(`[0-9A-Za-z\(\)#\?\*\-\/, ]+`), ""),
 						},
 					},
 				},
@@ -182,7 +185,6 @@ func resourceSecretRotationDelete(ctx context.Context, d *schema.ResourceData, m
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).SecretsManagerConn(ctx)
 
-	log.Printf("[DEBUG] Deleting Secrets Manager Rotation: %s", d.Id())
 	_, err := conn.CancelRotateSecretWithContext(ctx, &secretsmanager.CancelRotateSecretInput{
 		SecretId: aws.String(d.Get("secret_id").(string)),
 	})
@@ -224,7 +226,8 @@ func flattenRotationRules(rules *secretsmanager.RotationRulesType) []interface{}
 
 	m := map[string]interface{}{}
 
-	if v := rules.AutomaticallyAfterDays; v != nil {
+	if v := rules.AutomaticallyAfterDays; v != nil && rules.ScheduleExpression == nil {
+		// Only populate automatically_after_days if schedule_expression is not set, otherwise we won't be able to update the resource
 		m["automatically_after_days"] = int(aws.Int64Value(v))
 	}
 
diff --git a/internal/service/secretsmanager/secret_rotation_data_source.go b/internal/service/secretsmanager/secret_rotation_data_source.go
index ec07402c52d..8ed3b4457fc 100644
--- a/internal/service/secretsmanager/secret_rotation_data_source.go
+++ b/internal/service/secretsmanager/secret_rotation_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package secretsmanager
 
 import (
diff --git a/internal/service/secretsmanager/secret_rotation_data_source_test.go b/internal/service/secretsmanager/secret_rotation_data_source_test.go
index 236c14b3602..30d522f97a8 100644
--- a/internal/service/secretsmanager/secret_rotation_data_source_test.go
+++ b/internal/service/secretsmanager/secret_rotation_data_source_test.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package secretsmanager_test
 
 import (
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/secretsmanager"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -24,7 +27,7 @@ func TestAccSecretsManagerSecretRotationDataSource_basic(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccSecretRotationDataSourceConfig_nonExistent,
-				ExpectError: regexp.MustCompile(`couldn't find resource`),
+				ExpectError: regexache.MustCompile(`couldn't find resource`),
 			},
 			{
 				Config: testAccSecretRotationDataSourceConfig_default(rName, 7),
diff --git a/internal/service/secretsmanager/secret_rotation_test.go b/internal/service/secretsmanager/secret_rotation_test.go
index aec811d79be..51beff9738d 100644
--- a/internal/service/secretsmanager/secret_rotation_test.go
+++ b/internal/service/secretsmanager/secret_rotation_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package secretsmanager_test
 
 import (
@@ -50,7 +53,7 @@ func TestAccSecretsManagerSecretRotation_basic(t *testing.T) {
 					Check: resource.ComposeTestCheckFunc(
 						testAccCheckSecretRotationExists(resourceName, &secret),
 						resource.TestCheckResourceAttr(resourceName, "rotation_enabled", "true"),
-						resource.TestMatchResourceAttr(resourceName, "rotation_lambda_arn", regexp.MustCompile(fmt.Sprintf("^arn:[^:]+:lambda:[^:]+:[^:]+:function:%s-2$", rName))),
+						resource.TestMatchResourceAttr(resourceName, "rotation_lambda_arn", regexache.MustCompile(fmt.Sprintf("^arn:[^:]+:lambda:[^:]+:[^:]+:function:%s-2$", rName))),
 					),
 				},
 			*/
@@ -109,6 +112,52 @@ func TestAccSecretsManagerSecretRotation_scheduleExpression(t *testing.T) {
 	})
 }
 
+func TestAccSecretsManagerSecretRotation_scheduleExpressionHours(t *testing.T) {
+	ctx := acctest.Context(t)
+	var secret secretsmanager.DescribeSecretOutput
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_secretsmanager_secret_rotation.test"
+	lambdaFunctionResourceName := "aws_lambda_function.test1"
+	scheduleExpression := "rate(6 hours)"
+	scheduleExpression02 := "rate(10 hours)"
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, secretsmanager.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckSecretRotationDestroy(ctx),
+		Steps: []resource.TestStep{
+			// Test creating secret rotation resource
+			{
+				Config: testAccSecretRotationConfig_scheduleExpression(rName, scheduleExpression),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckSecretRotationExists(ctx, resourceName, &secret),
+					resource.TestCheckResourceAttr(resourceName, "rotation_enabled", "true"),
+					resource.TestCheckResourceAttrPair(resourceName, "rotation_lambda_arn", lambdaFunctionResourceName, "arn"),
+					resource.TestCheckResourceAttr(resourceName, "rotation_rules.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "rotation_rules.0.schedule_expression", scheduleExpression),
+					testSecretValueIsCurrent(ctx, rName),
+				),
+			},
+			{
+				Config: testAccSecretRotationConfig_scheduleExpression(rName, scheduleExpression02),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckSecretRotationExists(ctx, resourceName, &secret),
+					resource.TestCheckResourceAttr(resourceName, "rotation_enabled", "true"),
+					resource.TestCheckResourceAttrPair(resourceName, "rotation_lambda_arn", lambdaFunctionResourceName, "arn"),
+					resource.TestCheckResourceAttr(resourceName, "rotation_rules.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "rotation_rules.0.schedule_expression", scheduleExpression02),
+				),
+			},
+			// Test importing secret rotation
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
 func TestAccSecretsManagerSecretRotation_duration(t *testing.T) {
 	ctx := acctest.Context(t)
 	var secret secretsmanager.DescribeSecretOutput
@@ -358,3 +407,36 @@ resource "aws_secretsmanager_secret_rotation" "test" {
 }
 `, rName, automaticallyAfterDays, duration))
 }
+
+func testSecretValueIsCurrent(ctx context.Context, rName string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		conn := acctest.Provider.Meta().(*conns.AWSClient).SecretsManagerConn(ctx)
+		// Write secret value to clear in-rotation state, otherwise updating the secret rotation
+		// will fail with "A previous rotation isn't complete. That rotation will be reattempted."
+		put_secret_input := &secretsmanager.PutSecretValueInput{
+			SecretId:     aws.String(rName),
+			SecretString: aws.String("secret-value"),
+		}
+		_, err := conn.PutSecretValueWithContext(ctx, put_secret_input)
+		if err != nil {
+			return err
+		}
+		input := &secretsmanager.DescribeSecretInput{
+			SecretId: aws.String(rName),
+		}
+		output, err := conn.DescribeSecretWithContext(ctx, input)
+		if err != nil {
+			return err
+		} else {
+			// Ensure that the current version of the secret is in the AWSCURRENT stage
+			for _, stage := range output.VersionIdsToStages {
+				if *stage[0] == "AWSCURRENT" {
+					return nil
+				} else {
+					return fmt.Errorf("Secret version is not in AWSCURRENT stage: %s", *stage[0])
+				}
+			}
+			return nil
+		}
+	}
+}
diff --git a/internal/service/secretsmanager/secret_test.go b/internal/service/secretsmanager/secret_test.go
index 9d0561d78c2..607a392a098 100644
--- a/internal/service/secretsmanager/secret_test.go
+++ b/internal/service/secretsmanager/secret_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package secretsmanager_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/secretsmanager"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -32,7 +35,7 @@ func TestAccSecretsManagerSecret_basic(t *testing.T) {
 				Config: testAccSecretConfig_name(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckSecretExists(ctx, resourceName, &secret),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "secretsmanager", regexp.MustCompile(fmt.Sprintf("secret:%s-[[:alnum:]]+$", rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "secretsmanager", regexache.MustCompile(fmt.Sprintf("secret:%s-[[:alnum:]]+$", rName))),
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
 					resource.TestCheckResourceAttr(resourceName, "force_overwrite_replica_secret", "false"),
 					resource.TestCheckResourceAttr(resourceName, "kms_key_id", ""),
@@ -316,7 +319,7 @@ func TestAccSecretsManagerSecret_policy(t *testing.T) {
 					testAccCheckSecretExists(ctx, resourceName, &secret),
 					resource.TestCheckResourceAttr(resourceName, "description", "San Holo feat. Duskus"),
 					resource.TestMatchResourceAttr(resourceName, "policy",
-						regexp.MustCompile(`{"Action":"secretsmanager:GetSecretValue".+`)),
+						regexache.MustCompile(`{"Action":"secretsmanager:GetSecretValue".+`)),
 				),
 			},
 			{
@@ -332,7 +335,7 @@ func TestAccSecretsManagerSecret_policy(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckSecretExists(ctx, resourceName, &secret),
 					resource.TestMatchResourceAttr(resourceName, "policy",
-						regexp.MustCompile(`{"Action":"secretsmanager:GetSecretValue".+`)),
+						regexache.MustCompile(`{"Action":"secretsmanager:GetSecretValue".+`)),
 				),
 			},
 		},
diff --git a/internal/service/secretsmanager/secret_version.go b/internal/service/secretsmanager/secret_version.go
index 254d94baa1e..e088430315b 100644
--- a/internal/service/secretsmanager/secret_version.go
+++ b/internal/service/secretsmanager/secret_version.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package secretsmanager
 
 import (
diff --git a/internal/service/secretsmanager/secret_version_data_source.go b/internal/service/secretsmanager/secret_version_data_source.go
index c7d1275b71f..4228b6b4d76 100644
--- a/internal/service/secretsmanager/secret_version_data_source.go
+++ b/internal/service/secretsmanager/secret_version_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package secretsmanager
 
 import (
diff --git a/internal/service/secretsmanager/secret_version_data_source_test.go b/internal/service/secretsmanager/secret_version_data_source_test.go
index 0c7158cd5c4..b7af6627d96 100644
--- a/internal/service/secretsmanager/secret_version_data_source_test.go
+++ b/internal/service/secretsmanager/secret_version_data_source_test.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package secretsmanager_test
 
 import (
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/secretsmanager"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -25,7 +28,7 @@ func TestAccSecretsManagerSecretVersionDataSource_basic(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccSecretVersionDataSourceConfig_nonExistent,
-				ExpectError: regexp.MustCompile(`not found`),
+				ExpectError: regexache.MustCompile(`not found`),
 			},
 			{
 				Config: testAccSecretVersionDataSourceConfig_stageDefault(rName),
diff --git a/internal/service/secretsmanager/secret_version_test.go b/internal/service/secretsmanager/secret_version_test.go
index fbe9f76de80..4c9fc8c0bf6 100644
--- a/internal/service/secretsmanager/secret_version_test.go
+++ b/internal/service/secretsmanager/secret_version_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package secretsmanager_test
 
 import (
diff --git a/internal/service/secretsmanager/secrets_data_source.go b/internal/service/secretsmanager/secrets_data_source.go
index dc28009ce79..e33af97f5ed 100644
--- a/internal/service/secretsmanager/secrets_data_source.go
+++ b/internal/service/secretsmanager/secrets_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package secretsmanager
 
 import (
diff --git a/internal/service/secretsmanager/secrets_data_source_test.go b/internal/service/secretsmanager/secrets_data_source_test.go
index 41711a99032..a247c79e653 100644
--- a/internal/service/secretsmanager/secrets_data_source_test.go
+++ b/internal/service/secretsmanager/secrets_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package secretsmanager_test
 
 import (
diff --git a/internal/service/secretsmanager/service_package_gen.go b/internal/service/secretsmanager/service_package_gen.go
index ed65ddd6652..93068a3ee7b 100644
--- a/internal/service/secretsmanager/service_package_gen.go
+++ b/internal/service/secretsmanager/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	secretsmanager_sdkv1 "github.com/aws/aws-sdk-go/service/secretsmanager"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -83,4 +84,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*s
 	return secretsmanager_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/secretsmanager/sweep.go b/internal/service/secretsmanager/sweep.go
index 29389a47a55..d81e8541513 100644
--- a/internal/service/secretsmanager/sweep.go
+++ b/internal/service/secretsmanager/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package secretsmanager
 
@@ -12,9 +12,10 @@ import (
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_secretsmanager_secret_policy", &resource.Sweeper{
 		Name: "aws_secretsmanager_secret_policy",
 		F:    sweepSecretPolicies,
@@ -28,7 +29,7 @@ func init() {
 
 func sweepSecretPolicies(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -60,7 +61,7 @@ func sweepSecretPolicies(region string) error {
 		return !lastPage
 	})
 	if err != nil {
-		if sweep.SkipSweepError(err) {
+		if awsv1.SkipSweepError(err) {
 			log.Printf("[WARN] Skipping Secrets Manager Secret sweep for %s: %s", region, err)
 			return nil
 		}
@@ -71,7 +72,7 @@ func sweepSecretPolicies(region string) error {
 
 func sweepSecrets(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -104,7 +105,7 @@ func sweepSecrets(region string) error {
 		return !lastPage
 	})
 	if err != nil {
-		if sweep.SkipSweepError(err) {
+		if awsv1.SkipSweepError(err) {
 			log.Printf("[WARN] Skipping Secrets Manager Secret sweep for %s: %s", region, err)
 			return nil
 		}
diff --git a/internal/service/secretsmanager/tags_gen.go b/internal/service/secretsmanager/tags_gen.go
index bff4ae1b05d..005ec0242fe 100644
--- a/internal/service/secretsmanager/tags_gen.go
+++ b/internal/service/secretsmanager/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/secretsmanager"
 	"github.com/aws/aws-sdk-go/service/secretsmanager/secretsmanageriface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -69,6 +71,8 @@ func updateTags(ctx context.Context, conn secretsmanageriface.SecretsManagerAPI,
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.SecretsManager)
 	if len(removedTags) > 0 {
diff --git a/internal/service/secretsmanager/validate.go b/internal/service/secretsmanager/validate.go
index 5e6d9aa965e..5fe0a562380 100644
--- a/internal/service/secretsmanager/validate.go
+++ b/internal/service/secretsmanager/validate.go
@@ -1,15 +1,18 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package secretsmanager
 
 import (
 	"fmt"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 )
 
 func validSecretName(v interface{}, k string) (ws []string, errors []error) {
 	value := v.(string)
-	if !regexp.MustCompile(`^[0-9A-Za-z/_+=.@-]+$`).MatchString(value) {
+	if !regexache.MustCompile(`^[0-9A-Za-z/_+=.@-]+$`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"only alphanumeric characters and /_+=.@- special characters are allowed in %q", k))
 	}
@@ -22,7 +25,7 @@ func validSecretName(v interface{}, k string) (ws []string, errors []error) {
 
 func validSecretNamePrefix(v interface{}, k string) (ws []string, errors []error) {
 	value := v.(string)
-	if !regexp.MustCompile(`^[0-9A-Za-z/_+=.@-]+$`).MatchString(value) {
+	if !regexache.MustCompile(`^[0-9A-Za-z/_+=.@-]+$`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"only alphanumeric characters and /_+=.@- special characters are allowed in %q", k))
 	}
diff --git a/internal/service/secretsmanager/validate_test.go b/internal/service/secretsmanager/validate_test.go
index 777902fb37c..3b7b6bfc748 100644
--- a/internal/service/secretsmanager/validate_test.go
+++ b/internal/service/secretsmanager/validate_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package secretsmanager
 
 import (
diff --git a/internal/service/securityhub/account.go b/internal/service/securityhub/account.go
index f34037ba700..aa44cefc065 100644
--- a/internal/service/securityhub/account.go
+++ b/internal/service/securityhub/account.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package securityhub
 
 import (
@@ -58,7 +61,7 @@ func ResourceAccount() *schema.Resource {
 			"control_finding_generator": {
 				Type:         schema.TypeString,
 				Optional:     true,
-				Default:      securityhub.ControlFindingGeneratorSecurityControl,
+				Computed:     true,
 				ValidateFunc: validation.StringInSlice(securityhub.ControlFindingGenerator_Values(), false),
 			},
 			"enable_default_standards": {
@@ -91,8 +94,19 @@ func resourceAccountCreate(ctx context.Context, d *schema.ResourceData, meta int
 
 	d.SetId(meta.(*conns.AWSClient).AccountID)
 
-	// auto_enable_controls has to be done from the update API
-	return append(diags, resourceAccountUpdate(ctx, d, meta)...)
+	if autoEnableControls := d.Get("auto_enable_controls").(bool); !autoEnableControls {
+		input := &securityhub.UpdateSecurityHubConfigurationInput{
+			AutoEnableControls: aws.Bool(autoEnableControls),
+		}
+
+		_, err := conn.UpdateSecurityHubConfigurationWithContext(ctx, input)
+
+		if err != nil {
+			return sdkdiag.AppendErrorf(diags, "updating Security Hub Account (%s): %s", d.Id(), err)
+		}
+	}
+
+	return append(diags, resourceAccountRead(ctx, d, meta)...)
 }
 
 func resourceAccountRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
@@ -133,8 +147,11 @@ func resourceAccountUpdate(ctx context.Context, d *schema.ResourceData, meta int
 	conn := meta.(*conns.AWSClient).SecurityHubConn(ctx)
 
 	input := &securityhub.UpdateSecurityHubConfigurationInput{
-		ControlFindingGenerator: aws.String(d.Get("control_finding_generator").(string)),
-		AutoEnableControls:      aws.Bool(d.Get("auto_enable_controls").(bool)),
+		AutoEnableControls: aws.Bool(d.Get("auto_enable_controls").(bool)),
+	}
+
+	if d.HasChange("control_finding_generator") {
+		input.ControlFindingGenerator = aws.String(d.Get("control_finding_generator").(string))
 	}
 
 	_, err := conn.UpdateSecurityHubConfigurationWithContext(ctx, input)
diff --git a/internal/service/securityhub/account_test.go b/internal/service/securityhub/account_test.go
index 38d5c8e78ce..8da51974e1a 100644
--- a/internal/service/securityhub/account_test.go
+++ b/internal/service/securityhub/account_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package securityhub_test
 
 import (
@@ -5,6 +8,7 @@ import (
 	"fmt"
 	"testing"
 
+	"github.com/aws/aws-sdk-go/aws/endpoints"
 	"github.com/aws/aws-sdk-go/service/securityhub"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
@@ -17,6 +21,10 @@ import (
 func testAccAccount_basic(t *testing.T) {
 	ctx := acctest.Context(t)
 	resourceName := "aws_securityhub_account.test"
+	controlFindingGeneratorDefaultValueFromAWS := "SECURITY_CONTROL"
+	if acctest.Partition() == endpoints.AwsUsGovPartitionID {
+		controlFindingGeneratorDefaultValueFromAWS = ""
+	}
 
 	resource.Test(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
@@ -29,7 +37,7 @@ func testAccAccount_basic(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckAccountExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "enable_default_standards", "true"),
-					resource.TestCheckResourceAttr(resourceName, "control_finding_generator", "SECURITY_CONTROL"),
+					resource.TestCheckResourceAttr(resourceName, "control_finding_generator", controlFindingGeneratorDefaultValueFromAWS),
 					resource.TestCheckResourceAttr(resourceName, "auto_enable_controls", "true"),
 				),
 			},
@@ -91,27 +99,26 @@ func testAccAccount_full(t *testing.T) {
 	resourceName := "aws_securityhub_account.test"
 
 	resource.Test(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		// control_finding_generator not supported in AWS GovCloud.
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionNot(t, endpoints.AwsUsGovPartitionID) },
 		ErrorCheck:               acctest.ErrorCheck(t, securityhub.EndpointsID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckAccountDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccAccountConfig_basic,
+				Config: testAccAccountConfig_full(false, "STANDARD_CONTROL"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckAccountExists(ctx, resourceName),
-					resource.TestCheckResourceAttr(resourceName, "enable_default_standards", "true"),
-					resource.TestCheckResourceAttr(resourceName, "control_finding_generator", "SECURITY_CONTROL"),
-					resource.TestCheckResourceAttr(resourceName, "auto_enable_controls", "true"),
+					resource.TestCheckResourceAttr(resourceName, "auto_enable_controls", "false"),
+					resource.TestCheckResourceAttr(resourceName, "control_finding_generator", "STANDARD_CONTROL"),
 				),
 			},
 			{
-				Config: testAccAccountConfig_full,
+				Config: testAccAccountConfig_full(true, "SECURITY_CONTROL"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckAccountExists(ctx, resourceName),
-					resource.TestCheckResourceAttr(resourceName, "enable_default_standards", "false"),
-					resource.TestCheckResourceAttr(resourceName, "control_finding_generator", "STANDARD_CONTROL"),
-					resource.TestCheckResourceAttr(resourceName, "auto_enable_controls", "false"),
+					resource.TestCheckResourceAttr(resourceName, "auto_enable_controls", "true"),
+					resource.TestCheckResourceAttr(resourceName, "control_finding_generator", "SECURITY_CONTROL"),
 				),
 			},
 		},
@@ -149,6 +156,46 @@ func testAccAccount_migrateV0(t *testing.T) {
 	})
 }
 
+// https://github.com/hashicorp/terraform-provider-aws/issues/33039 et al.
+func testAccAccount_removeControlFindingGeneratorDefaultValue(t *testing.T) {
+	ctx := acctest.Context(t)
+	resourceName := "aws_securityhub_account.test"
+	controlFindingGeneratorExpectedValue := "SECURITY_CONTROL"
+	if acctest.Partition() == endpoints.AwsUsGovPartitionID {
+		controlFindingGeneratorExpectedValue = ""
+	}
+	expectNonEmptyPlan := acctest.Partition() == endpoints.AwsUsGovPartitionID
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:   acctest.ErrorCheck(t, securityhub.EndpointsID),
+		CheckDestroy: testAccCheckAccountDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				ExternalProviders: map[string]resource.ExternalProvider{
+					"aws": {
+						Source:            "hashicorp/aws",
+						VersionConstraint: "5.13.0",
+					},
+				},
+				Config: testAccAccountConfig_basic,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAccountExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "enable_default_standards", "true"),
+					resource.TestCheckResourceAttr(resourceName, "control_finding_generator", controlFindingGeneratorExpectedValue),
+					resource.TestCheckResourceAttr(resourceName, "auto_enable_controls", "true"),
+				),
+				ExpectNonEmptyPlan: expectNonEmptyPlan,
+			},
+			{
+				ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+				Config:                   testAccAccountConfig_basic,
+				PlanOnly:                 true,
+			},
+		},
+	})
+}
+
 func testAccCheckAccountExists(ctx context.Context, n string) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		rs, ok := s.RootModule().Resources[n]
@@ -204,10 +251,11 @@ resource "aws_securityhub_account" "test" {
 }
 `
 
-const testAccAccountConfig_full = `
+func testAccAccountConfig_full(autoEnableControls bool, controlFindingGenerator string) string {
+	return fmt.Sprintf(`
 resource "aws_securityhub_account" "test" {
-  enable_default_standards  = false
-  control_finding_generator = "STANDARD_CONTROL"
-  auto_enable_controls      = false
+  control_finding_generator = %[2]q
+  auto_enable_controls      = %[1]t
+}
+`, autoEnableControls, controlFindingGenerator)
 }
-`
diff --git a/internal/service/securityhub/action_target.go b/internal/service/securityhub/action_target.go
index f4d4f98feb1..ee602f5b210 100644
--- a/internal/service/securityhub/action_target.go
+++ b/internal/service/securityhub/action_target.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package securityhub
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"strings"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/securityhub"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
@@ -42,7 +45,7 @@ func ResourceActionTarget() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 20),
-					validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9]+$`), "must contain only alphanumeric characters"),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z]+$`), "must contain only alphanumeric characters"),
 				),
 			},
 			"name": {
diff --git a/internal/service/securityhub/action_target_test.go b/internal/service/securityhub/action_target_test.go
index 12c275e3d21..953e56c0d74 100644
--- a/internal/service/securityhub/action_target_test.go
+++ b/internal/service/securityhub/action_target_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package securityhub_test
 
 import (
diff --git a/internal/service/securityhub/arn.go b/internal/service/securityhub/arn.go
index f000c67d02d..a7484cd00f5 100644
--- a/internal/service/securityhub/arn.go
+++ b/internal/service/securityhub/arn.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package securityhub
 
 import (
diff --git a/internal/service/securityhub/arn_test.go b/internal/service/securityhub/arn_test.go
index b01d812f709..4348d31b98a 100644
--- a/internal/service/securityhub/arn_test.go
+++ b/internal/service/securityhub/arn_test.go
@@ -1,9 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package securityhub_test
 
 import (
 	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	tfsecurityhub "github.com/hashicorp/terraform-provider-aws/internal/service/securityhub"
 )
 
@@ -19,22 +23,22 @@ func TestStandardsControlARNToStandardsSubscriptionARN(t *testing.T) {
 		{
 			TestName:      "empty ARN",
 			InputARN:      "",
-			ExpectedError: regexp.MustCompile(`parsing ARN`),
+			ExpectedError: regexache.MustCompile(`parsing ARN`),
 		},
 		{
 			TestName:      "unparsable ARN",
 			InputARN:      "test",
-			ExpectedError: regexp.MustCompile(`parsing ARN`),
+			ExpectedError: regexache.MustCompile(`parsing ARN`),
 		},
 		{
 			TestName:      "invalid ARN service",
 			InputARN:      "arn:aws:ec2:us-west-2:1234567890:control/cis-aws-foundations-benchmark/v/1.2.0/1.1", //lintignore:AWSAT003,AWSAT005
-			ExpectedError: regexp.MustCompile(`expected service securityhub`),
+			ExpectedError: regexache.MustCompile(`expected service securityhub`),
 		},
 		{
 			TestName:      "invalid ARN resource parts",
 			InputARN:      "arn:aws:securityhub:us-west-2:1234567890:control/cis-aws-foundations-benchmark", //lintignore:AWSAT003,AWSAT005
-			ExpectedError: regexp.MustCompile(`expected at least 3 resource parts`),
+			ExpectedError: regexache.MustCompile(`expected at least 3 resource parts`),
 		},
 		{
 			TestName:    "valid ARN",
diff --git a/internal/service/securityhub/find.go b/internal/service/securityhub/find.go
index 1cd2aee03ff..4ec936dba2a 100644
--- a/internal/service/securityhub/find.go
+++ b/internal/service/securityhub/find.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package securityhub
 
 import (
diff --git a/internal/service/securityhub/finding_aggregator.go b/internal/service/securityhub/finding_aggregator.go
index 5f6784af411..8034e342381 100644
--- a/internal/service/securityhub/finding_aggregator.go
+++ b/internal/service/securityhub/finding_aggregator.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package securityhub
 
 import (
diff --git a/internal/service/securityhub/finding_aggregator_test.go b/internal/service/securityhub/finding_aggregator_test.go
index 28d685e1938..78fb144bc32 100644
--- a/internal/service/securityhub/finding_aggregator_test.go
+++ b/internal/service/securityhub/finding_aggregator_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package securityhub_test
 
 import (
diff --git a/internal/service/securityhub/generate.go b/internal/service/securityhub/generate.go
index e16979ae4c1..4c686ec0ac2 100644
--- a/internal/service/securityhub/generate.go
+++ b/internal/service/securityhub/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTags -ServiceTagsMap -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/securityhub/insight.go b/internal/service/securityhub/insight.go
index 3c9c943f552..da8b2c5c953 100644
--- a/internal/service/securityhub/insight.go
+++ b/internal/service/securityhub/insight.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package securityhub
 
 import (
diff --git a/internal/service/securityhub/insight_test.go b/internal/service/securityhub/insight_test.go
index 139b181272f..b001aabaade 100644
--- a/internal/service/securityhub/insight_test.go
+++ b/internal/service/securityhub/insight_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package securityhub_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/securityhub"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -507,7 +510,7 @@ func testAccCheckInsightARN(resourceName string) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		expectedArn := fmt.Sprintf(`^arn:aws[^:]*:securityhub:%s:%s:insight/%s/custom/.+$`, acctest.Region(), acctest.AccountID(), acctest.AccountID())
 		//lintignore:AWSAT001
-		return resource.TestMatchResourceAttr(resourceName, "arn", regexp.MustCompile(expectedArn))(s)
+		return resource.TestMatchResourceAttr(resourceName, "arn", regexache.MustCompile(expectedArn))(s)
 	}
 }
 
diff --git a/internal/service/securityhub/invite_accepter.go b/internal/service/securityhub/invite_accepter.go
index 1385260e8a9..e1771e5c7b5 100644
--- a/internal/service/securityhub/invite_accepter.go
+++ b/internal/service/securityhub/invite_accepter.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package securityhub
 
 import (
diff --git a/internal/service/securityhub/invite_accepter_test.go b/internal/service/securityhub/invite_accepter_test.go
index 9cfff817130..e10f7c7f80b 100644
--- a/internal/service/securityhub/invite_accepter_test.go
+++ b/internal/service/securityhub/invite_accepter_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package securityhub_test
 
 import (
diff --git a/internal/service/securityhub/member.go b/internal/service/securityhub/member.go
index fed6b98ad5f..ad2466b150e 100644
--- a/internal/service/securityhub/member.go
+++ b/internal/service/securityhub/member.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package securityhub
 
 import (
diff --git a/internal/service/securityhub/member_test.go b/internal/service/securityhub/member_test.go
index 1fe11ae2a9a..a0f9e70d515 100644
--- a/internal/service/securityhub/member_test.go
+++ b/internal/service/securityhub/member_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package securityhub_test
 
 import (
diff --git a/internal/service/securityhub/organization_admin_account.go b/internal/service/securityhub/organization_admin_account.go
index 47ea2e87f67..069d567a6ef 100644
--- a/internal/service/securityhub/organization_admin_account.go
+++ b/internal/service/securityhub/organization_admin_account.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package securityhub
 
 import (
diff --git a/internal/service/securityhub/organization_admin_account_test.go b/internal/service/securityhub/organization_admin_account_test.go
index 83c0cd97dd8..c80bdcb17ae 100644
--- a/internal/service/securityhub/organization_admin_account_test.go
+++ b/internal/service/securityhub/organization_admin_account_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package securityhub_test
 
 import (
diff --git a/internal/service/securityhub/organization_configuration.go b/internal/service/securityhub/organization_configuration.go
index d1d0849b6d6..2a087b90bc0 100644
--- a/internal/service/securityhub/organization_configuration.go
+++ b/internal/service/securityhub/organization_configuration.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package securityhub
 
 import (
diff --git a/internal/service/securityhub/organization_configuration_test.go b/internal/service/securityhub/organization_configuration_test.go
index 17ca64412cc..69701f3cd0b 100644
--- a/internal/service/securityhub/organization_configuration_test.go
+++ b/internal/service/securityhub/organization_configuration_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package securityhub_test
 
 import (
diff --git a/internal/service/securityhub/product_subscription.go b/internal/service/securityhub/product_subscription.go
index f11bc563cb3..f7b556d778f 100644
--- a/internal/service/securityhub/product_subscription.go
+++ b/internal/service/securityhub/product_subscription.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package securityhub
 
 import (
diff --git a/internal/service/securityhub/product_subscription_test.go b/internal/service/securityhub/product_subscription_test.go
index 5d1fed42d55..6080ccd3b25 100644
--- a/internal/service/securityhub/product_subscription_test.go
+++ b/internal/service/securityhub/product_subscription_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package securityhub_test
 
 import (
diff --git a/internal/service/securityhub/securityhub_test.go b/internal/service/securityhub/securityhub_test.go
index afb7de01a03..189af9b1c0c 100644
--- a/internal/service/securityhub/securityhub_test.go
+++ b/internal/service/securityhub/securityhub_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package securityhub_test
 
 import (
@@ -15,7 +18,8 @@ func TestAccSecurityHub_serial(t *testing.T) {
 			"disappears":                  testAccAccount_disappears,
 			"EnableDefaultStandardsFalse": testAccAccount_enableDefaultStandardsFalse,
 			"MigrateV0":                   testAccAccount_migrateV0,
-			"full":                        testAccAccount_full,
+			"Full":                        testAccAccount_full,
+			"RemoveControlFindingGeneratorDefaultValue": testAccAccount_removeControlFindingGeneratorDefaultValue,
 		},
 		"Member": {
 			"basic":  testAccMember_basic,
diff --git a/internal/service/securityhub/service_package.go b/internal/service/securityhub/service_package.go
index 627275241d3..c59033f052a 100644
--- a/internal/service/securityhub/service_package.go
+++ b/internal/service/securityhub/service_package.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package securityhub
 
 import (
diff --git a/internal/service/securityhub/service_package_gen.go b/internal/service/securityhub/service_package_gen.go
index ef3839227ba..b9b5a844b4c 100644
--- a/internal/service/securityhub/service_package_gen.go
+++ b/internal/service/securityhub/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	securityhub_sdkv1 "github.com/aws/aws-sdk-go/service/securityhub"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -86,4 +87,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*s
 	return securityhub_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/securityhub/standards_control.go b/internal/service/securityhub/standards_control.go
index 75f4bd81000..4e2254fc6c6 100644
--- a/internal/service/securityhub/standards_control.go
+++ b/internal/service/securityhub/standards_control.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package securityhub
 
 import (
diff --git a/internal/service/securityhub/standards_control_test.go b/internal/service/securityhub/standards_control_test.go
index cacd2fd4b2c..81077531fd5 100644
--- a/internal/service/securityhub/standards_control_test.go
+++ b/internal/service/securityhub/standards_control_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package securityhub_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/securityhub"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
@@ -78,7 +81,7 @@ func testAccStandardsControl_enabledControlStatusAndDisabledReason(t *testing.T)
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccStandardsControlConfig_enabledStatus(),
-				ExpectError: regexp.MustCompile("InvalidInputException: DisabledReason should not be given for action other than disabling control"),
+				ExpectError: regexache.MustCompile("InvalidInputException: DisabledReason should not be given for action other than disabling control"),
 			},
 		},
 	})
diff --git a/internal/service/securityhub/standards_subscription.go b/internal/service/securityhub/standards_subscription.go
index cca42af92b9..0f470871ca9 100644
--- a/internal/service/securityhub/standards_subscription.go
+++ b/internal/service/securityhub/standards_subscription.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package securityhub
 
 import (
diff --git a/internal/service/securityhub/standards_subscription_test.go b/internal/service/securityhub/standards_subscription_test.go
index 73bff2383e2..5f84f55ee7e 100644
--- a/internal/service/securityhub/standards_subscription_test.go
+++ b/internal/service/securityhub/standards_subscription_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package securityhub_test
 
 import (
diff --git a/internal/service/securityhub/status.go b/internal/service/securityhub/status.go
index d8898f67040..8aab1dc5382 100644
--- a/internal/service/securityhub/status.go
+++ b/internal/service/securityhub/status.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package securityhub
 
 import (
diff --git a/internal/service/securityhub/tags_gen.go b/internal/service/securityhub/tags_gen.go
index 9fc4b3e71ef..a39c6ef569a 100644
--- a/internal/service/securityhub/tags_gen.go
+++ b/internal/service/securityhub/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/securityhub"
 	"github.com/aws/aws-sdk-go/service/securityhub/securityhubiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -54,7 +56,7 @@ func Tags(tags tftags.KeyValueTags) map[string]*string {
 	return aws.StringMap(tags.Map())
 }
 
-// KeyValueTags creates KeyValueTags from securityhub service tags.
+// KeyValueTags creates tftags.KeyValueTags from securityhub service tags.
 func KeyValueTags(ctx context.Context, tags map[string]*string) tftags.KeyValueTags {
 	return tftags.New(ctx, tags)
 }
@@ -85,6 +87,8 @@ func updateTags(ctx context.Context, conn securityhubiface.SecurityHubAPI, ident
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.SecurityHub)
 	if len(removedTags) > 0 {
diff --git a/internal/service/securityhub/wait.go b/internal/service/securityhub/wait.go
index a2f404a1fde..0f15cb72e69 100644
--- a/internal/service/securityhub/wait.go
+++ b/internal/service/securityhub/wait.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package securityhub
 
 import (
diff --git a/internal/service/securitylake/generate.go b/internal/service/securitylake/generate.go
index 657c287a041..311d0a09137 100644
--- a/internal/service/securitylake/generate.go
+++ b/internal/service/securitylake/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
 
diff --git a/internal/service/securitylake/service_package_gen.go b/internal/service/securitylake/service_package_gen.go
index dad643c2ae4..37f6cb5d793 100644
--- a/internal/service/securitylake/service_package_gen.go
+++ b/internal/service/securitylake/service_package_gen.go
@@ -7,6 +7,7 @@ import (
 
 	aws_sdkv2 "github.com/aws/aws-sdk-go-v2/aws"
 	securitylake_sdkv2 "github.com/aws/aws-sdk-go-v2/service/securitylake"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -39,9 +40,11 @@ func (p *servicePackage) NewClient(ctx context.Context, config map[string]any) (
 
 	return securitylake_sdkv2.NewFromConfig(cfg, func(o *securitylake_sdkv2.Options) {
 		if endpoint := config["endpoint"].(string); endpoint != "" {
-			o.EndpointResolver = securitylake_sdkv2.EndpointResolverFromURL(endpoint)
+			o.BaseEndpoint = aws_sdkv2.String(endpoint)
 		}
 	}), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/serverlessrepo/application_data_source.go b/internal/service/serverlessrepo/application_data_source.go
index 556636bf944..ef3a5408cc1 100644
--- a/internal/service/serverlessrepo/application_data_source.go
+++ b/internal/service/serverlessrepo/application_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package serverlessrepo
 
 import (
diff --git a/internal/service/serverlessrepo/application_data_source_test.go b/internal/service/serverlessrepo/application_data_source_test.go
index 6e636837d43..b32554c8b35 100644
--- a/internal/service/serverlessrepo/application_data_source_test.go
+++ b/internal/service/serverlessrepo/application_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package serverlessrepo_test
 
 import (
diff --git a/internal/service/serverlessrepo/cloudformation_stack.go b/internal/service/serverlessrepo/cloudformation_stack.go
index d4e63d8f5af..a89e9bb56e9 100644
--- a/internal/service/serverlessrepo/cloudformation_stack.go
+++ b/internal/service/serverlessrepo/cloudformation_stack.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package serverlessrepo
 
 import ( // nosemgrep:ci.semgrep.aws.multiple-service-imports
@@ -134,7 +137,7 @@ func resourceCloudFormationStackRead(ctx context.Context, d *schema.ResourceData
 	serverlessConn := meta.(*conns.AWSClient).ServerlessRepoConn(ctx)
 	cfConn := meta.(*conns.AWSClient).CloudFormationConn(ctx)
 
-	stack, err := tfcloudformation.FindStackByID(ctx, cfConn, d.Id())
+	stack, err := tfcloudformation.FindStackByName(ctx, cfConn, d.Id())
 
 	if tfresource.NotFound(err) {
 		log.Printf("[WARN] Serverless Application Repository CloudFormation Stack (%s) not found, removing from state", d.Id())
@@ -282,7 +285,7 @@ func resourceCloudFormationStackImport(ctx context.Context, d *schema.ResourceDa
 	}
 
 	cfConn := meta.(*conns.AWSClient).CloudFormationConn(ctx)
-	stack, err := tfcloudformation.FindStackByID(ctx, cfConn, stackID)
+	stack, err := tfcloudformation.FindStackByName(ctx, cfConn, stackID)
 	if err != nil {
 		return nil, fmt.Errorf("describing Serverless Application Repository CloudFormation Stack (%s): %w", stackID, err)
 	}
diff --git a/internal/service/serverlessrepo/cloudformation_stack_test.go b/internal/service/serverlessrepo/cloudformation_stack_test.go
index b45f2f4f3d5..c303d8a3b12 100644
--- a/internal/service/serverlessrepo/cloudformation_stack_test.go
+++ b/internal/service/serverlessrepo/cloudformation_stack_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package serverlessrepo_test
 
 import (
diff --git a/internal/service/serverlessrepo/find.go b/internal/service/serverlessrepo/find.go
index 7fcda5a246d..dda60b0c33c 100644
--- a/internal/service/serverlessrepo/find.go
+++ b/internal/service/serverlessrepo/find.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package serverlessrepo
 
 import (
diff --git a/internal/service/serverlessrepo/generate.go b/internal/service/serverlessrepo/generate.go
index 777b1a1447a..71aeaf48552 100644
--- a/internal/service/serverlessrepo/generate.go
+++ b/internal/service/serverlessrepo/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ServiceTagsSlice
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/serverlessrepo/service_package_gen.go b/internal/service/serverlessrepo/service_package_gen.go
index e75d41be1b0..3639a275c06 100644
--- a/internal/service/serverlessrepo/service_package_gen.go
+++ b/internal/service/serverlessrepo/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	serverlessapplicationrepository_sdkv1 "github.com/aws/aws-sdk-go/service/serverlessapplicationrepository"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -53,4 +54,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*s
 	return serverlessapplicationrepository_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/serverlessrepo/wait.go b/internal/service/serverlessrepo/wait.go
index e19060c42fc..6afa90687fa 100644
--- a/internal/service/serverlessrepo/wait.go
+++ b/internal/service/serverlessrepo/wait.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package serverlessrepo
 
 import (
diff --git a/internal/service/servicecatalog/budget_resource_association.go b/internal/service/servicecatalog/budget_resource_association.go
index 6a969b227a7..d81ffe83795 100644
--- a/internal/service/servicecatalog/budget_resource_association.go
+++ b/internal/service/servicecatalog/budget_resource_association.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package servicecatalog
 
 import (
diff --git a/internal/service/servicecatalog/budget_resource_association_test.go b/internal/service/servicecatalog/budget_resource_association_test.go
index 7706e36fd29..2b7e804e869 100644
--- a/internal/service/servicecatalog/budget_resource_association_test.go
+++ b/internal/service/servicecatalog/budget_resource_association_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package servicecatalog_test
 
 import (
diff --git a/internal/service/servicecatalog/constraint.go b/internal/service/servicecatalog/constraint.go
index 839e8b4a012..c27738af865 100644
--- a/internal/service/servicecatalog/constraint.go
+++ b/internal/service/servicecatalog/constraint.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package servicecatalog
 
 import (
diff --git a/internal/service/servicecatalog/constraint_data_source.go b/internal/service/servicecatalog/constraint_data_source.go
index e55308464bd..bec183cb34c 100644
--- a/internal/service/servicecatalog/constraint_data_source.go
+++ b/internal/service/servicecatalog/constraint_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package servicecatalog
 
 import (
diff --git a/internal/service/servicecatalog/constraint_data_source_test.go b/internal/service/servicecatalog/constraint_data_source_test.go
index cd49df32ed1..5daa01a1e34 100644
--- a/internal/service/servicecatalog/constraint_data_source_test.go
+++ b/internal/service/servicecatalog/constraint_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package servicecatalog_test
 
 import (
diff --git a/internal/service/servicecatalog/constraint_test.go b/internal/service/servicecatalog/constraint_test.go
index 892460db2fd..efed3a93cfd 100644
--- a/internal/service/servicecatalog/constraint_test.go
+++ b/internal/service/servicecatalog/constraint_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package servicecatalog_test
 
 import (
@@ -166,11 +169,6 @@ resource "aws_s3_bucket" "test" {
   force_destroy = true
 }
 
-resource "aws_s3_bucket_acl" "test" {
-  bucket = aws_s3_bucket.test.id
-  acl    = "private"
-}
-
 resource "aws_s3_object" "test" {
   bucket = aws_s3_bucket.test.id
   key    = "%[1]s.json"
diff --git a/internal/service/servicecatalog/diff.go b/internal/service/servicecatalog/diff.go
index 78263ddd1b6..94a977c9310 100644
--- a/internal/service/servicecatalog/diff.go
+++ b/internal/service/servicecatalog/diff.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package servicecatalog
 
 import (
diff --git a/internal/service/servicecatalog/enum.go b/internal/service/servicecatalog/enum.go
index 90f3ea3ccfe..3873d07f40a 100644
--- a/internal/service/servicecatalog/enum.go
+++ b/internal/service/servicecatalog/enum.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package servicecatalog
 
 const (
diff --git a/internal/service/servicecatalog/find.go b/internal/service/servicecatalog/find.go
index 2df619e32b7..1c7857993b7 100644
--- a/internal/service/servicecatalog/find.go
+++ b/internal/service/servicecatalog/find.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package servicecatalog
 
 import (
@@ -147,35 +150,23 @@ func FindTagOptionResourceAssociation(ctx context.Context, conn *servicecatalog.
 	return result, err
 }
 
-func FindPrincipalPortfolioAssociation(ctx context.Context, conn *servicecatalog.ServiceCatalog, acceptLanguage, principalARN, portfolioID string) (*servicecatalog.Principal, error) {
-	input := &servicecatalog.ListPrincipalsForPortfolioInput{
-		PortfolioId: aws.String(portfolioID),
+func findProductByID(ctx context.Context, conn *servicecatalog.ServiceCatalog, productID string) (*servicecatalog.DescribeProductAsAdminOutput, error) {
+	in := &servicecatalog.DescribeProductAsAdminInput{
+		Id: aws.String(productID),
 	}
 
-	if acceptLanguage != "" {
-		input.AcceptLanguage = aws.String(acceptLanguage)
-	}
-
-	var result *servicecatalog.Principal
-
-	err := conn.ListPrincipalsForPortfolioPagesWithContext(ctx, input, func(page *servicecatalog.ListPrincipalsForPortfolioOutput, lastPage bool) bool {
-		if page == nil {
-			return !lastPage
-		}
-
-		for _, deet := range page.Principals {
-			if deet == nil {
-				continue
-			}
+	out, err := conn.DescribeProductAsAdminWithContext(ctx, in)
 
-			if aws.StringValue(deet.PrincipalARN) == principalARN {
-				result = deet
-				return false
-			}
+	if tfawserr.ErrCodeEquals(err, servicecatalog.ErrCodeResourceNotFoundException) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: in,
 		}
+	}
 
-		return !lastPage
-	})
+	if err != nil {
+		return nil, err
+	}
 
-	return result, err
+	return out, nil
 }
diff --git a/internal/service/servicecatalog/generate.go b/internal/service/servicecatalog/generate.go
index 87dd0df1d6c..bf6c4db1fc5 100644
--- a/internal/service/servicecatalog/generate.go
+++ b/internal/service/servicecatalog/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ServiceTagsSlice
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/servicecatalog/id.go b/internal/service/servicecatalog/id.go
index a15f1a759a2..4af593f2019 100644
--- a/internal/service/servicecatalog/id.go
+++ b/internal/service/servicecatalog/id.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package servicecatalog
 
 import (
@@ -74,20 +77,6 @@ func ProvisioningArtifactParseID(id string) (string, string, error) {
 	return parts[0], parts[1], nil
 }
 
-func PrincipalPortfolioAssociationParseID(id string) (string, string, string, error) {
-	parts := strings.SplitN(id, ",", 3)
-
-	if len(parts) != 3 || parts[0] == "" || parts[1] == "" || parts[2] == "" {
-		return "", "", "", fmt.Errorf("unexpected format of ID (%s), expected acceptLanguage,principalARN,portfolioID", id)
-	}
-
-	return parts[0], parts[1], parts[2], nil
-}
-
-func PrincipalPortfolioAssociationID(acceptLanguage, principalARN, portfolioID string) string {
-	return strings.Join([]string{acceptLanguage, principalARN, portfolioID}, ",")
-}
-
 func PortfolioConstraintsID(acceptLanguage, portfolioID, productID string) string {
 	return strings.Join([]string{acceptLanguage, portfolioID, productID}, ":")
 }
diff --git a/internal/service/servicecatalog/launch_paths_data_source.go b/internal/service/servicecatalog/launch_paths_data_source.go
index 7108727f10e..29d81dbf06f 100644
--- a/internal/service/servicecatalog/launch_paths_data_source.go
+++ b/internal/service/servicecatalog/launch_paths_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package servicecatalog
 
 import (
diff --git a/internal/service/servicecatalog/launch_paths_data_source_test.go b/internal/service/servicecatalog/launch_paths_data_source_test.go
index 2fa50be8995..a089c326b52 100644
--- a/internal/service/servicecatalog/launch_paths_data_source_test.go
+++ b/internal/service/servicecatalog/launch_paths_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package servicecatalog_test
 
 import (
diff --git a/internal/service/servicecatalog/organizations_access.go b/internal/service/servicecatalog/organizations_access.go
index 658515713d6..d736c82fa60 100644
--- a/internal/service/servicecatalog/organizations_access.go
+++ b/internal/service/servicecatalog/organizations_access.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package servicecatalog
 
 import (
diff --git a/internal/service/servicecatalog/organizations_access_test.go b/internal/service/servicecatalog/organizations_access_test.go
index f14a5590e5a..9d33d6c9b4c 100644
--- a/internal/service/servicecatalog/organizations_access_test.go
+++ b/internal/service/servicecatalog/organizations_access_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package servicecatalog_test
 
 import (
diff --git a/internal/service/servicecatalog/portfolio.go b/internal/service/servicecatalog/portfolio.go
index f1dd7e589d9..2a1e79d3300 100644
--- a/internal/service/servicecatalog/portfolio.go
+++ b/internal/service/servicecatalog/portfolio.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package servicecatalog
 
 import (
diff --git a/internal/service/servicecatalog/portfolio_constraints_data_source.go b/internal/service/servicecatalog/portfolio_constraints_data_source.go
index e25c8653c5c..d064657a0a1 100644
--- a/internal/service/servicecatalog/portfolio_constraints_data_source.go
+++ b/internal/service/servicecatalog/portfolio_constraints_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package servicecatalog
 
 import (
diff --git a/internal/service/servicecatalog/portfolio_constraints_data_source_test.go b/internal/service/servicecatalog/portfolio_constraints_data_source_test.go
index f836d59603e..dd689f04ac5 100644
--- a/internal/service/servicecatalog/portfolio_constraints_data_source_test.go
+++ b/internal/service/servicecatalog/portfolio_constraints_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package servicecatalog_test
 
 import (
diff --git a/internal/service/servicecatalog/portfolio_data_source.go b/internal/service/servicecatalog/portfolio_data_source.go
index 429c341bb87..e80a520159f 100644
--- a/internal/service/servicecatalog/portfolio_data_source.go
+++ b/internal/service/servicecatalog/portfolio_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package servicecatalog
 
 import (
diff --git a/internal/service/servicecatalog/portfolio_data_source_test.go b/internal/service/servicecatalog/portfolio_data_source_test.go
index 4db3ec0d0d2..236bd396787 100644
--- a/internal/service/servicecatalog/portfolio_data_source_test.go
+++ b/internal/service/servicecatalog/portfolio_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package servicecatalog_test
 
 import (
diff --git a/internal/service/servicecatalog/portfolio_share.go b/internal/service/servicecatalog/portfolio_share.go
index 6e6bfc0b547..568639c6177 100644
--- a/internal/service/servicecatalog/portfolio_share.go
+++ b/internal/service/servicecatalog/portfolio_share.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package servicecatalog
 
 import (
diff --git a/internal/service/servicecatalog/portfolio_share_test.go b/internal/service/servicecatalog/portfolio_share_test.go
index 4ffa0fa2824..cbae8a242cf 100644
--- a/internal/service/servicecatalog/portfolio_share_test.go
+++ b/internal/service/servicecatalog/portfolio_share_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package servicecatalog_test
 
 import (
diff --git a/internal/service/servicecatalog/portfolio_test.go b/internal/service/servicecatalog/portfolio_test.go
index 720989bc8f2..96ccfe8e8ad 100644
--- a/internal/service/servicecatalog/portfolio_test.go
+++ b/internal/service/servicecatalog/portfolio_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package servicecatalog_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/servicecatalog"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -32,7 +35,7 @@ func TestAccServiceCatalogPortfolio_basic(t *testing.T) {
 				Config: testAccPortfolioConfig_basic(name),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckPortfolioExists(ctx, resourceName, &dpo),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "catalog", regexp.MustCompile(`portfolio/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "catalog", regexache.MustCompile(`portfolio/.+`)),
 					resource.TestCheckResourceAttrSet(resourceName, "created_time"),
 					resource.TestCheckResourceAttr(resourceName, "name", name),
 					resource.TestCheckResourceAttr(resourceName, "description", "test-2"),
diff --git a/internal/service/servicecatalog/principal_portfolio_association.go b/internal/service/servicecatalog/principal_portfolio_association.go
index 159fbf40ff9..fae6b29fe54 100644
--- a/internal/service/servicecatalog/principal_portfolio_association.go
+++ b/internal/service/servicecatalog/principal_portfolio_association.go
@@ -1,8 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package servicecatalog
 
 import (
 	"context"
+	"fmt"
 	"log"
+	"strings"
+	"time"
 
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/servicecatalog"
@@ -13,6 +19,7 @@ import (
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
+	tfslices "github.com/hashicorp/terraform-provider-aws/internal/slices"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
@@ -22,14 +29,24 @@ func ResourcePrincipalPortfolioAssociation() *schema.Resource {
 		CreateWithoutTimeout: resourcePrincipalPortfolioAssociationCreate,
 		ReadWithoutTimeout:   resourcePrincipalPortfolioAssociationRead,
 		DeleteWithoutTimeout: resourcePrincipalPortfolioAssociationDelete,
+
 		Importer: &schema.ResourceImporter{
 			StateContext: schema.ImportStatePassthroughContext,
 		},
 
 		Timeouts: &schema.ResourceTimeout{
-			Create: schema.DefaultTimeout(PrincipalPortfolioAssociationReadyTimeout),
-			Read:   schema.DefaultTimeout(PrincipalPortfolioAssociationReadTimeout),
-			Delete: schema.DefaultTimeout(PrincipalPortfolioAssociationDeleteTimeout),
+			Create: schema.DefaultTimeout(3 * time.Minute),
+			Read:   schema.DefaultTimeout(10 * time.Minute),
+			Delete: schema.DefaultTimeout(3 * time.Minute),
+		},
+
+		SchemaVersion: 1,
+		StateUpgraders: []schema.StateUpgrader{
+			{
+				Type:    resourcePrincipalPortfolioAssociationV0().CoreConfigSchema().ImpliedType(),
+				Upgrade: principalPortfolioAssociationUpgradeV0,
+				Version: 0,
+			},
 		},
 
 		Schema: map[string]*schema.Schema{
@@ -65,50 +82,33 @@ func resourcePrincipalPortfolioAssociationCreate(ctx context.Context, d *schema.
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).ServiceCatalogConn(ctx)
 
+	acceptLanguage, principalARN, portfolioID, principalType := d.Get("accept_language").(string), d.Get("principal_arn").(string), d.Get("portfolio_id").(string), d.Get("principal_type").(string)
+	id := PrincipalPortfolioAssociationCreateResourceID(acceptLanguage, principalARN, portfolioID, principalType)
 	input := &servicecatalog.AssociatePrincipalWithPortfolioInput{
-		PortfolioId:  aws.String(d.Get("portfolio_id").(string)),
-		PrincipalARN: aws.String(d.Get("principal_arn").(string)),
+		AcceptLanguage: aws.String(acceptLanguage),
+		PortfolioId:    aws.String(portfolioID),
+		PrincipalARN:   aws.String(principalARN),
+		PrincipalType:  aws.String(principalType),
 	}
 
-	if v, ok := d.GetOk("accept_language"); ok {
-		input.AcceptLanguage = aws.String(v.(string))
-	}
+	_, err := tfresource.RetryWhenAWSErrMessageContains(ctx, d.Timeout(schema.TimeoutCreate), func() (interface{}, error) {
+		return conn.AssociatePrincipalWithPortfolioWithContext(ctx, input)
+	}, servicecatalog.ErrCodeInvalidParametersException, "profile does not exist")
 
-	if v, ok := d.GetOk("principal_type"); ok {
-		input.PrincipalType = aws.String(v.(string))
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "creating Service Catalog Principal Portfolio Association (%s): %s", id, err)
 	}
 
-	var output *servicecatalog.AssociatePrincipalWithPortfolioOutput
-	err := retry.RetryContext(ctx, d.Timeout(schema.TimeoutCreate), func() *retry.RetryError {
-		var err error
-
-		output, err = conn.AssociatePrincipalWithPortfolioWithContext(ctx, input)
-
-		if tfawserr.ErrMessageContains(err, servicecatalog.ErrCodeInvalidParametersException, "profile does not exist") {
-			return retry.RetryableError(err)
-		}
+	d.SetId(id)
 
-		if err != nil {
-			return retry.NonRetryableError(err)
-		}
-
-		return nil
+	_, err = tfresource.RetryWhenNotFound(ctx, d.Timeout(schema.TimeoutRead), func() (interface{}, error) {
+		return FindPrincipalPortfolioAssociation(ctx, conn, acceptLanguage, principalARN, portfolioID, principalType)
 	})
 
-	if tfresource.TimedOut(err) {
-		output, err = conn.AssociatePrincipalWithPortfolioWithContext(ctx, input)
-	}
-
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "associating Service Catalog Principal with Portfolio: %s", err)
-	}
-
-	if output == nil {
-		return sdkdiag.AppendErrorf(diags, "creating Service Catalog Principal Portfolio Association: empty response")
+		return sdkdiag.AppendErrorf(diags, "waiting for Service Catalog Principal Portfolio Association (%s) create: %s", d.Id(), err)
 	}
 
-	d.SetId(PrincipalPortfolioAssociationID(d.Get("accept_language").(string), d.Get("principal_arn").(string), d.Get("portfolio_id").(string)))
-
 	return append(diags, resourcePrincipalPortfolioAssociationRead(ctx, d, meta)...)
 }
 
@@ -116,30 +116,21 @@ func resourcePrincipalPortfolioAssociationRead(ctx context.Context, d *schema.Re
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).ServiceCatalogConn(ctx)
 
-	acceptLanguage, principalARN, portfolioID, err := PrincipalPortfolioAssociationParseID(d.Id())
-
+	acceptLanguage, principalARN, portfolioID, principalType, err := PrincipalPortfolioAssociationParseResourceID(d.Id())
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "could not parse ID (%s): %s", d.Id(), err)
-	}
-
-	if acceptLanguage == "" {
-		acceptLanguage = AcceptLanguageEnglish
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
-	output, err := WaitPrincipalPortfolioAssociationReady(ctx, conn, acceptLanguage, principalARN, portfolioID, d.Timeout(schema.TimeoutRead))
+	output, err := FindPrincipalPortfolioAssociation(ctx, conn, acceptLanguage, principalARN, portfolioID, principalType)
 
-	if !d.IsNewResource() && (tfresource.NotFound(err) || tfawserr.ErrCodeEquals(err, servicecatalog.ErrCodeResourceNotFoundException)) {
+	if !d.IsNewResource() && tfresource.NotFound(err) {
 		log.Printf("[WARN] Service Catalog Principal Portfolio Association (%s) not found, removing from state", d.Id())
 		d.SetId("")
 		return diags
 	}
 
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "describing Service Catalog Principal Portfolio Association (%s): %s", d.Id(), err)
-	}
-
-	if output == nil {
-		return sdkdiag.AppendErrorf(diags, "getting Service Catalog Principal Portfolio Association (%s): empty response", d.Id())
+		return sdkdiag.AppendErrorf(diags, "reading Service Catalog Principal Portfolio Association (%s): %s", d.Id(), err)
 	}
 
 	d.Set("accept_language", acceptLanguage)
@@ -154,22 +145,19 @@ func resourcePrincipalPortfolioAssociationDelete(ctx context.Context, d *schema.
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).ServiceCatalogConn(ctx)
 
-	acceptLanguage, principalARN, portfolioID, err := PrincipalPortfolioAssociationParseID(d.Id())
-
+	acceptLanguage, principalARN, portfolioID, principalType, err := PrincipalPortfolioAssociationParseResourceID(d.Id())
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "could not parse ID (%s): %s", d.Id(), err)
-	}
-
-	if acceptLanguage == "" {
-		acceptLanguage = AcceptLanguageEnglish
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
 	input := &servicecatalog.DisassociatePrincipalFromPortfolioInput{
 		PortfolioId:    aws.String(portfolioID),
 		PrincipalARN:   aws.String(principalARN),
 		AcceptLanguage: aws.String(acceptLanguage),
+		PrincipalType:  aws.String(principalType),
 	}
 
+	log.Printf("[WARN] Deleting Service Catalog Principal Portfolio Association: %s", d.Id())
 	_, err = conn.DisassociatePrincipalFromPortfolioWithContext(ctx, input)
 
 	if tfawserr.ErrCodeEquals(err, servicecatalog.ErrCodeResourceNotFoundException) {
@@ -177,18 +165,129 @@ func resourcePrincipalPortfolioAssociationDelete(ctx context.Context, d *schema.
 	}
 
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "disassociating Service Catalog Principal from Portfolio (%s): %s", d.Id(), err)
+		return sdkdiag.AppendErrorf(diags, "deleting Service Catalog Principal Portfolio Association (%s): %s", d.Id(), err)
 	}
 
-	err = WaitPrincipalPortfolioAssociationDeleted(ctx, conn, acceptLanguage, principalARN, portfolioID, d.Timeout(schema.TimeoutDelete))
+	_, err = tfresource.RetryUntilNotFound(ctx, d.Timeout(schema.TimeoutDelete), func() (interface{}, error) {
+		return FindPrincipalPortfolioAssociation(ctx, conn, acceptLanguage, principalARN, portfolioID, principalType)
+	})
 
-	if tfresource.NotFound(err) || tfawserr.ErrCodeEquals(err, servicecatalog.ErrCodeResourceNotFoundException) {
-		return diags
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "waiting for Service Catalog Principal Portfolio Association (%s) delete: %s", d.Id(), err)
+	}
+
+	return diags
+}
+
+const principalPortfolioAssociationResourceIDSeparator = ","
+
+func PrincipalPortfolioAssociationParseResourceID(id string) (string, string, string, string, error) {
+	parts := strings.SplitN(id, principalPortfolioAssociationResourceIDSeparator, 4)
+
+	if len(parts) != 4 || parts[0] == "" || parts[1] == "" || parts[2] == "" || parts[3] == "" {
+		return "", "", "", "", fmt.Errorf("unexpected format of ID (%[1]s), expected acceptLanguage%[2]sprincipalARN%[2]sportfolioID%[2]sprincipalType", id, principalPortfolioAssociationResourceIDSeparator)
 	}
 
+	return parts[0], parts[1], parts[2], parts[3], nil
+}
+
+func PrincipalPortfolioAssociationCreateResourceID(acceptLanguage, principalARN, portfolioID, principalType string) string {
+	return strings.Join([]string{acceptLanguage, principalARN, portfolioID, principalType}, principalPortfolioAssociationResourceIDSeparator)
+}
+
+func findPrincipalForPortfolio(ctx context.Context, conn *servicecatalog.ServiceCatalog, input *servicecatalog.ListPrincipalsForPortfolioInput, filter tfslices.Predicate[*servicecatalog.Principal]) (*servicecatalog.Principal, error) {
+	output, err := findPrincipalsForPortfolio(ctx, conn, input, filter)
+
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "waiting for Service Catalog Principal Portfolio Disassociation (%s): %s", d.Id(), err)
+		return nil, err
 	}
 
-	return diags
+	return tfresource.AssertSinglePtrResult(output)
+}
+
+func findPrincipalsForPortfolio(ctx context.Context, conn *servicecatalog.ServiceCatalog, input *servicecatalog.ListPrincipalsForPortfolioInput, filter tfslices.Predicate[*servicecatalog.Principal]) ([]*servicecatalog.Principal, error) {
+	var output []*servicecatalog.Principal
+
+	err := conn.ListPrincipalsForPortfolioPagesWithContext(ctx, input, func(page *servicecatalog.ListPrincipalsForPortfolioOutput, lastPage bool) bool {
+		if page == nil {
+			return !lastPage
+		}
+
+		for _, v := range page.Principals {
+			if v != nil && filter(v) {
+				output = append(output, v)
+			}
+		}
+
+		return !lastPage
+	})
+
+	if tfawserr.ErrCodeEquals(err, servicecatalog.ErrCodeResourceNotFoundException) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	return output, nil
+}
+
+func FindPrincipalPortfolioAssociation(ctx context.Context, conn *servicecatalog.ServiceCatalog, acceptLanguage, principalARN, portfolioID, principalType string) (*servicecatalog.Principal, error) {
+	input := &servicecatalog.ListPrincipalsForPortfolioInput{
+		AcceptLanguage: aws.String(acceptLanguage),
+		PortfolioId:    aws.String(portfolioID),
+	}
+	filter := func(v *servicecatalog.Principal) bool {
+		return aws.StringValue(v.PrincipalARN) == principalARN && aws.StringValue(v.PrincipalType) == principalType
+	}
+
+	return findPrincipalForPortfolio(ctx, conn, input, filter)
+}
+
+// aws_autoscaling_group aws_servicecatalog_principal_portfolio_association's Schema @v5.15.0 minus validators.
+func resourcePrincipalPortfolioAssociationV0() *schema.Resource {
+	return &schema.Resource{
+		Schema: map[string]*schema.Schema{
+			"accept_language": {
+				Type:     schema.TypeString,
+				Optional: true,
+				ForceNew: true,
+				Default:  AcceptLanguageEnglish,
+			},
+			"portfolio_id": {
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+			"principal_arn": {
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+			"principal_type": {
+				Type:     schema.TypeString,
+				Optional: true,
+				ForceNew: true,
+				Default:  servicecatalog.PrincipalTypeIam,
+			},
+		},
+	}
+}
+
+func principalPortfolioAssociationUpgradeV0(_ context.Context, rawState map[string]interface{}, meta interface{}) (map[string]interface{}, error) {
+	if rawState == nil {
+		rawState = map[string]interface{}{}
+	}
+
+	// Is resource ID in the correct format?
+	if _, _, _, _, err := PrincipalPortfolioAssociationParseResourceID(rawState["id"].(string)); err != nil {
+		acceptLanguage, principalARN, portfolioID, principalType := rawState["accept_language"].(string), rawState["principal_arn"].(string), rawState["portfolio_id"].(string), rawState["principal_type"].(string)
+		rawState["id"] = PrincipalPortfolioAssociationCreateResourceID(acceptLanguage, principalARN, portfolioID, principalType)
+	}
+
+	return rawState, nil
 }
diff --git a/internal/service/servicecatalog/principal_portfolio_association_test.go b/internal/service/servicecatalog/principal_portfolio_association_test.go
index 300294798ce..be50b5f527a 100644
--- a/internal/service/servicecatalog/principal_portfolio_association_test.go
+++ b/internal/service/servicecatalog/principal_portfolio_association_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package servicecatalog_test
 
 import (
@@ -6,7 +9,6 @@ import (
 	"testing"
 
 	"github.com/aws/aws-sdk-go/service/servicecatalog"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
@@ -16,8 +18,6 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
-// add sweeper to delete known test servicecat principal portfolio associations
-
 func TestAccServiceCatalogPrincipalPortfolioAssociation_basic(t *testing.T) {
 	ctx := acctest.Context(t)
 	resourceName := "aws_servicecatalog_principal_portfolio_association.test"
@@ -46,6 +46,33 @@ func TestAccServiceCatalogPrincipalPortfolioAssociation_basic(t *testing.T) {
 	})
 }
 
+func TestAccServiceCatalogPrincipalPortfolioAssociation_iam_pattern(t *testing.T) {
+	ctx := acctest.Context(t)
+	resourceName := "aws_servicecatalog_principal_portfolio_association.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, servicecatalog.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckPrincipalPortfolioAssociationDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccPrincipalPortfolioAssociationConfig_iam_pattern(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckPrincipalPortfolioAssociationExists(ctx, resourceName),
+					resource.TestCheckResourceAttrPair(resourceName, "portfolio_id", "aws_servicecatalog_portfolio.test", "id"),
+					resource.TestCheckResourceAttr(resourceName, "principal_type", "IAM_PATTERN"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
 func TestAccServiceCatalogPrincipalPortfolioAssociation_disappears(t *testing.T) {
 	ctx := acctest.Context(t)
 	resourceName := "aws_servicecatalog_principal_portfolio_association.test"
@@ -69,6 +96,41 @@ func TestAccServiceCatalogPrincipalPortfolioAssociation_disappears(t *testing.T)
 	})
 }
 
+func TestAccServiceCatalogPrincipalPortfolioAssociation_migrateV0(t *testing.T) {
+	ctx := acctest.Context(t)
+	resourceName := "aws_servicecatalog_principal_portfolio_association.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:     func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:   acctest.ErrorCheck(t, servicecatalog.EndpointsID),
+		CheckDestroy: testAccCheckPrincipalPortfolioAssociationDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				ExternalProviders: map[string]resource.ExternalProvider{
+					"aws": {
+						Source:            "hashicorp/aws",
+						VersionConstraint: "5.15.0",
+					},
+				},
+				Config: testAccPrincipalPortfolioAssociationConfig_basic(rName),
+				Check: resource.ComposeTestCheckFunc(
+					// Can't call this as the old ID format is invalid.
+					// testAccCheckPrincipalPortfolioAssociationExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "principal_type", "IAM"),
+				),
+			},
+			{
+				ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+				Config:                   testAccPrincipalPortfolioAssociationConfig_basic(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckPrincipalPortfolioAssociationExists(ctx, resourceName),
+				),
+			},
+		},
+	})
+}
+
 func testAccCheckPrincipalPortfolioAssociationDestroy(ctx context.Context) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		conn := acctest.Provider.Meta().(*conns.AWSClient).ServiceCatalogConn(ctx)
@@ -78,50 +140,45 @@ func testAccCheckPrincipalPortfolioAssociationDestroy(ctx context.Context) resou
 				continue
 			}
 
-			acceptLanguage, principalARN, portfolioID, err := tfservicecatalog.PrincipalPortfolioAssociationParseID(rs.Primary.ID)
-
+			acceptLanguage, principalARN, portfolioID, principalType, err := tfservicecatalog.PrincipalPortfolioAssociationParseResourceID(rs.Primary.ID)
 			if err != nil {
-				return fmt.Errorf("could not parse ID (%s): %w", rs.Primary.ID, err)
+				return err
 			}
 
-			err = tfservicecatalog.WaitPrincipalPortfolioAssociationDeleted(ctx, conn, acceptLanguage, principalARN, portfolioID, tfservicecatalog.PrincipalPortfolioAssociationDeleteTimeout)
+			_, err = tfservicecatalog.FindPrincipalPortfolioAssociation(ctx, conn, acceptLanguage, principalARN, portfolioID, principalType)
 
-			if tfresource.NotFound(err) || tfawserr.ErrCodeEquals(err, servicecatalog.ErrCodeResourceNotFoundException) {
+			if tfresource.NotFound(err) {
 				continue
 			}
 
 			if err != nil {
-				return fmt.Errorf("waiting for Service Catalog Principal Portfolio Association to be destroyed (%s): %w", rs.Primary.ID, err)
+				return err
 			}
+
+			return fmt.Errorf("Service Catalog Principal Portfolio Association (%s) still exists", rs.Primary.ID)
 		}
 
 		return nil
 	}
 }
 
-func testAccCheckPrincipalPortfolioAssociationExists(ctx context.Context, resourceName string) resource.TestCheckFunc {
+func testAccCheckPrincipalPortfolioAssociationExists(ctx context.Context, n string) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		rs, ok := s.RootModule().Resources[resourceName]
-
+		rs, ok := s.RootModule().Resources[n]
 		if !ok {
-			return fmt.Errorf("resource not found: %s", resourceName)
+			return fmt.Errorf("Not found: %s", n)
 		}
 
-		acceptLanguage, principalARN, portfolioID, err := tfservicecatalog.PrincipalPortfolioAssociationParseID(rs.Primary.ID)
-
+		acceptLanguage, principalARN, portfolioID, principalType, err := tfservicecatalog.PrincipalPortfolioAssociationParseResourceID(rs.Primary.ID)
 		if err != nil {
-			return fmt.Errorf("could not parse ID (%s): %w", rs.Primary.ID, err)
+			return err
 		}
 
 		conn := acctest.Provider.Meta().(*conns.AWSClient).ServiceCatalogConn(ctx)
 
-		_, err = tfservicecatalog.WaitPrincipalPortfolioAssociationReady(ctx, conn, acceptLanguage, principalARN, portfolioID, tfservicecatalog.PrincipalPortfolioAssociationReadyTimeout)
-
-		if err != nil {
-			return fmt.Errorf("waiting for Service Catalog Principal Portfolio Association existence (%s): %w", rs.Primary.ID, err)
-		}
+		_, err = tfservicecatalog.FindPrincipalPortfolioAssociation(ctx, conn, acceptLanguage, principalARN, portfolioID, principalType)
 
-		return nil
+		return err
 	}
 }
 
@@ -160,3 +217,13 @@ resource "aws_servicecatalog_principal_portfolio_association" "test" {
 }
 `)
 }
+
+func testAccPrincipalPortfolioAssociationConfig_iam_pattern(rName string) string {
+	return acctest.ConfigCompose(testAccPrincipalPortfolioAssociationConfig_base(rName), `
+resource "aws_servicecatalog_principal_portfolio_association" "test" {
+  portfolio_id   = aws_servicecatalog_portfolio.test.id
+  principal_arn  = "arn:${data.aws_partition.current.partition}:iam:::role/${aws_iam_role.test.name}"
+  principal_type = "IAM_PATTERN"
+}
+`)
+}
diff --git a/internal/service/servicecatalog/product.go b/internal/service/servicecatalog/product.go
index 32f167d2b90..98064f6ac82 100644
--- a/internal/service/servicecatalog/product.go
+++ b/internal/service/servicecatalog/product.go
@@ -1,8 +1,12 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package servicecatalog
 
 import (
 	"context"
 	"log"
+	"sort"
 	"time"
 
 	"github.com/aws/aws-sdk-go/aws"
@@ -31,7 +35,7 @@ func ResourceProduct() *schema.Resource {
 		DeleteWithoutTimeout: resourceProductDelete,
 
 		Importer: &schema.ResourceImporter{
-			StateContext: schema.ImportStatePassthroughContext,
+			StateContext: resourceProductImport,
 		},
 
 		Timeouts: &schema.ResourceTimeout{
@@ -160,6 +164,40 @@ func ResourceProduct() *schema.Resource {
 	}
 }
 
+func resourceProductImport(ctx context.Context, d *schema.ResourceData, meta interface{}) ([]*schema.ResourceData, error) {
+	conn := meta.(*conns.AWSClient).ServiceCatalogConn(ctx)
+
+	productData, err := findProductByID(ctx, conn, d.Id())
+
+	if err != nil {
+		return []*schema.ResourceData{d}, err
+	}
+
+	// import the last entry in the summary
+	if len(productData.ProvisioningArtifactSummaries) > 0 {
+		sort.Slice(productData.ProvisioningArtifactSummaries, func(i, j int) bool {
+			return aws.TimeValue(productData.ProvisioningArtifactSummaries[i].CreatedTime).Before(aws.TimeValue(productData.ProvisioningArtifactSummaries[j].CreatedTime))
+		})
+
+		provisioningArtifact := productData.ProvisioningArtifactSummaries[len(productData.ProvisioningArtifactSummaries)-1]
+		in := &servicecatalog.DescribeProvisioningArtifactInput{
+			ProductId:              aws.String(d.Id()),
+			ProvisioningArtifactId: provisioningArtifact.Id,
+		}
+
+		// Find additional artifact details.
+		artifactData, err := conn.DescribeProvisioningArtifactWithContext(ctx, in)
+
+		if err != nil {
+			return []*schema.ResourceData{d}, err
+		}
+
+		d.Set("provisioning_artifact_parameters", flattenProvisioningArtifactParameters(artifactData))
+	}
+
+	return []*schema.ResourceData{d}, nil
+}
+
 func resourceProductCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).ServiceCatalogConn(ctx)
@@ -430,3 +468,28 @@ func expandProvisioningArtifactParameters(tfMap map[string]interface{}) *service
 
 	return apiObject
 }
+
+func flattenProvisioningArtifactParameters(apiObject *servicecatalog.DescribeProvisioningArtifactOutput) []interface{} {
+	if apiObject == nil {
+		return nil
+	}
+
+	m := map[string]interface{}{
+		"description":                 aws.StringValue(apiObject.ProvisioningArtifactDetail.Description),
+		"disable_template_validation": false, // set default because it cannot be read
+		"name":                        aws.StringValue(apiObject.ProvisioningArtifactDetail.Name),
+		"type":                        aws.StringValue(apiObject.ProvisioningArtifactDetail.Type),
+	}
+
+	if apiObject.Info != nil {
+		if v, ok := apiObject.Info["TemplateUrl"]; ok {
+			m["template_url"] = aws.StringValue(v)
+		}
+
+		if v, ok := apiObject.Info["PhysicalId"]; ok {
+			m["template_physical_id"] = aws.StringValue(v)
+		}
+	}
+
+	return []interface{}{m}
+}
diff --git a/internal/service/servicecatalog/product_data_source.go b/internal/service/servicecatalog/product_data_source.go
index 4e6e8eba595..4afc5da8b07 100644
--- a/internal/service/servicecatalog/product_data_source.go
+++ b/internal/service/servicecatalog/product_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package servicecatalog
 
 import (
diff --git a/internal/service/servicecatalog/product_data_source_test.go b/internal/service/servicecatalog/product_data_source_test.go
index 5cde16fc89b..945ff774cb7 100644
--- a/internal/service/servicecatalog/product_data_source_test.go
+++ b/internal/service/servicecatalog/product_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package servicecatalog_test
 
 import (
diff --git a/internal/service/servicecatalog/product_portfolio_association.go b/internal/service/servicecatalog/product_portfolio_association.go
index c975890fdea..28c5274799f 100644
--- a/internal/service/servicecatalog/product_portfolio_association.go
+++ b/internal/service/servicecatalog/product_portfolio_association.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package servicecatalog
 
 import (
diff --git a/internal/service/servicecatalog/product_portfolio_association_test.go b/internal/service/servicecatalog/product_portfolio_association_test.go
index 8def82bfa41..e8af4cec28c 100644
--- a/internal/service/servicecatalog/product_portfolio_association_test.go
+++ b/internal/service/servicecatalog/product_portfolio_association_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package servicecatalog_test
 
 import (
diff --git a/internal/service/servicecatalog/product_test.go b/internal/service/servicecatalog/product_test.go
index b8af3a58afd..d4012712323 100644
--- a/internal/service/servicecatalog/product_test.go
+++ b/internal/service/servicecatalog/product_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package servicecatalog_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/servicecatalog"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -36,7 +39,7 @@ func TestAccServiceCatalogProduct_basic(t *testing.T) {
 				Config: testAccProductConfig_basic(rName, "beskrivning", "supportbeskrivning", domain, acctest.DefaultEmailAddress),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckProductExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "catalog", regexp.MustCompile(`product/prod-.*`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "catalog", regexache.MustCompile(`product/prod-.*`)),
 					resource.TestCheckResourceAttr(resourceName, "accept_language", tfservicecatalog.AcceptLanguageEnglish),
 					acctest.CheckResourceAttrRFC3339(resourceName, "created_time"),
 					resource.TestCheckResourceAttr(resourceName, "description", "beskrivning"),
@@ -65,7 +68,7 @@ func TestAccServiceCatalogProduct_basic(t *testing.T) {
 				ImportStateVerify: true,
 				ImportStateVerifyIgnore: []string{
 					"accept_language",
-					"provisioning_artifact_parameters",
+					"provisioning_artifact_parameters.0.disable_template_validation",
 				},
 			},
 		},
@@ -185,7 +188,7 @@ func TestAccServiceCatalogProduct_physicalID(t *testing.T) {
 				Config: testAccProductConfig_physicalID(rName, domain, acctest.DefaultEmailAddress),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckProductExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "catalog", regexp.MustCompile(`product/prod-.*`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "catalog", regexache.MustCompile(`product/prod-.*`)),
 					resource.TestCheckResourceAttr(resourceName, "provisioning_artifact_parameters.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "provisioning_artifact_parameters.0.description", "artefaktbeskrivning"),
 					resource.TestCheckResourceAttr(resourceName, "provisioning_artifact_parameters.0.name", rName),
@@ -194,7 +197,7 @@ func TestAccServiceCatalogProduct_physicalID(t *testing.T) {
 						resourceName,
 						"provisioning_artifact_parameters.0.template_physical_id",
 						"cloudformation",
-						regexp.MustCompile(fmt.Sprintf(`stack/%s/.*`, rName)),
+						regexache.MustCompile(fmt.Sprintf(`stack/%s/.*`, rName)),
 					),
 					resource.TestCheckResourceAttr(resourceName, "provisioning_artifact_parameters.0.type", servicecatalog.ProvisioningArtifactTypeCloudFormationTemplate),
 				),
@@ -205,7 +208,7 @@ func TestAccServiceCatalogProduct_physicalID(t *testing.T) {
 				ImportStateVerify: true,
 				ImportStateVerifyIgnore: []string{
 					"accept_language",
-					"provisioning_artifact_parameters",
+					"provisioning_artifact_parameters.0.disable_template_validation",
 				},
 			},
 		},
diff --git a/internal/service/servicecatalog/provisioned_product.go b/internal/service/servicecatalog/provisioned_product.go
index a9c1a5ba986..a91adf4023b 100644
--- a/internal/service/servicecatalog/provisioned_product.go
+++ b/internal/service/servicecatalog/provisioned_product.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package servicecatalog
 
 import (
diff --git a/internal/service/servicecatalog/provisioned_product_test.go b/internal/service/servicecatalog/provisioned_product_test.go
index 086e1f34c6a..35e9b6b7b4c 100644
--- a/internal/service/servicecatalog/provisioned_product_test.go
+++ b/internal/service/servicecatalog/provisioned_product_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package servicecatalog_test
 
 import (
@@ -6,6 +9,7 @@ import (
 	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/servicecatalog"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -35,7 +39,7 @@ func TestAccServiceCatalogProvisionedProduct_basic(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckProvisionedProductExists(ctx, resourceName, &pprod),
 					resource.TestCheckResourceAttr(resourceName, "accept_language", tfservicecatalog.AcceptLanguageEnglish),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", servicecatalog.ServiceName, regexp.MustCompile(fmt.Sprintf(`stack/%s/pp-.*`, rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", servicecatalog.ServiceName, regexache.MustCompile(fmt.Sprintf(`stack/%s/pp-.*`, rName))),
 					acctest.CheckResourceAttrRFC3339(resourceName, "created_time"),
 					resource.TestCheckResourceAttrSet(resourceName, "last_provisioning_record_id"),
 					resource.TestCheckResourceAttrSet(resourceName, "last_record_id"),
@@ -50,7 +54,7 @@ func TestAccServiceCatalogProvisionedProduct_basic(t *testing.T) {
 						"key":         "VpcID",
 					}),
 					resource.TestMatchTypeSetElemNestedAttrs(resourceName, "outputs.*", map[string]*regexp.Regexp{
-						"value": regexp.MustCompile(`vpc-.+`),
+						"value": regexache.MustCompile(`vpc-.+`),
 					}),
 					resource.TestCheckResourceAttrPair(resourceName, "path_id", "data.aws_servicecatalog_launch_paths.test", "summaries.0.path_id"),
 					resource.TestCheckResourceAttrPair(resourceName, "product_id", "aws_servicecatalog_product.test", "id"),
@@ -102,7 +106,7 @@ func TestAccServiceCatalogProvisionedProduct_update(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckProvisionedProductExists(ctx, resourceName, &pprod),
 					resource.TestCheckResourceAttr(resourceName, "accept_language", tfservicecatalog.AcceptLanguageEnglish),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", servicecatalog.ServiceName, regexp.MustCompile(fmt.Sprintf(`stack/%s/pp-.*`, rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", servicecatalog.ServiceName, regexache.MustCompile(fmt.Sprintf(`stack/%s/pp-.*`, rName))),
 					acctest.CheckResourceAttrRFC3339(resourceName, "created_time"),
 					resource.TestCheckResourceAttrSet(resourceName, "last_provisioning_record_id"),
 					resource.TestCheckResourceAttrSet(resourceName, "last_record_id"),
@@ -117,7 +121,7 @@ func TestAccServiceCatalogProvisionedProduct_update(t *testing.T) {
 						"key":         "VpcID",
 					}),
 					resource.TestMatchTypeSetElemNestedAttrs(resourceName, "outputs.*", map[string]*regexp.Regexp{
-						"value": regexp.MustCompile(`vpc-.+`),
+						"value": regexache.MustCompile(`vpc-.+`),
 					}),
 					resource.TestCheckResourceAttrPair(resourceName, "path_id", "data.aws_servicecatalog_launch_paths.test", "summaries.0.path_id"),
 					resource.TestCheckResourceAttrPair(resourceName, "product_id", "aws_servicecatalog_product.test", "id"),
@@ -416,7 +420,7 @@ func TestAccServiceCatalogProvisionedProduct_errorOnCreate(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccProvisionedProductConfig_error(rName, domain, acctest.DefaultEmailAddress, "10.1.0.0/16"),
-				ExpectError: regexp.MustCompile(`AmazonCloudFormationException  Unresolved resource dependencies \[MyVPC\] in the Outputs block of the template`),
+				ExpectError: regexache.MustCompile(`AmazonCloudFormationException  Unresolved resource dependencies \[MyVPC\] in the Outputs block of the template`),
 			},
 		},
 	})
@@ -443,7 +447,7 @@ func TestAccServiceCatalogProvisionedProduct_errorOnUpdate(t *testing.T) {
 			},
 			{
 				Config:      testAccProvisionedProductConfig_error(rName, domain, acctest.DefaultEmailAddress, "10.1.0.0/16"),
-				ExpectError: regexp.MustCompile(`AmazonCloudFormationException  Unresolved resource dependencies \[MyVPC\] in the Outputs block of the template`),
+				ExpectError: regexache.MustCompile(`AmazonCloudFormationException  Unresolved resource dependencies \[MyVPC\] in the Outputs block of the template`),
 			},
 			{
 				// Check we can still run a complete apply after the previous update error
diff --git a/internal/service/servicecatalog/provisioning_artifact.go b/internal/service/servicecatalog/provisioning_artifact.go
index 4684b1625b9..7e30143a529 100644
--- a/internal/service/servicecatalog/provisioning_artifact.go
+++ b/internal/service/servicecatalog/provisioning_artifact.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package servicecatalog
 
 import (
diff --git a/internal/service/servicecatalog/provisioning_artifact_test.go b/internal/service/servicecatalog/provisioning_artifact_test.go
index 7ea92415259..72b7c25c3c7 100644
--- a/internal/service/servicecatalog/provisioning_artifact_test.go
+++ b/internal/service/servicecatalog/provisioning_artifact_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package servicecatalog_test
 
 import (
diff --git a/internal/service/servicecatalog/provisioning_artifacts_data_source.go b/internal/service/servicecatalog/provisioning_artifacts_data_source.go
index 8519ca77599..58a9ea1bf25 100644
--- a/internal/service/servicecatalog/provisioning_artifacts_data_source.go
+++ b/internal/service/servicecatalog/provisioning_artifacts_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package servicecatalog
 
 import (
diff --git a/internal/service/servicecatalog/provisioning_artifacts_data_source_test.go b/internal/service/servicecatalog/provisioning_artifacts_data_source_test.go
index d54a10cbf66..0a177f36bd7 100644
--- a/internal/service/servicecatalog/provisioning_artifacts_data_source_test.go
+++ b/internal/service/servicecatalog/provisioning_artifacts_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package servicecatalog_test
 
 import (
@@ -46,11 +49,6 @@ resource "aws_s3_bucket" "test" {
   force_destroy = true
 }
 
-resource "aws_s3_bucket_acl" "test" {
-  bucket = aws_s3_bucket.test.id
-  acl    = "private"
-}
-
 resource "aws_s3_object" "test" {
   bucket = aws_s3_bucket.test.id
   key    = "%[1]s.json"
diff --git a/internal/service/servicecatalog/service_action.go b/internal/service/servicecatalog/service_action.go
index cf840474e0d..2c9b3b54813 100644
--- a/internal/service/servicecatalog/service_action.go
+++ b/internal/service/servicecatalog/service_action.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package servicecatalog
 
 import (
diff --git a/internal/service/servicecatalog/service_action_test.go b/internal/service/servicecatalog/service_action_test.go
index a7131d50941..b828e7a6e2f 100644
--- a/internal/service/servicecatalog/service_action_test.go
+++ b/internal/service/servicecatalog/service_action_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package servicecatalog_test
 
 import (
diff --git a/internal/service/servicecatalog/service_package_gen.go b/internal/service/servicecatalog/service_package_gen.go
index a544277c40c..bb0eb4609cd 100644
--- a/internal/service/servicecatalog/service_package_gen.go
+++ b/internal/service/servicecatalog/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	servicecatalog_sdkv1 "github.com/aws/aws-sdk-go/service/servicecatalog"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -125,4 +126,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*s
 	return servicecatalog_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/servicecatalog/servicecatalog_test.go b/internal/service/servicecatalog/servicecatalog_test.go
index 7599a3d6c7b..34d707ecb6f 100644
--- a/internal/service/servicecatalog/servicecatalog_test.go
+++ b/internal/service/servicecatalog/servicecatalog_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package servicecatalog_test
 
 import (
diff --git a/internal/service/servicecatalog/status.go b/internal/service/servicecatalog/status.go
index 56d0c68d3ef..4839e6990ee 100644
--- a/internal/service/servicecatalog/status.go
+++ b/internal/service/servicecatalog/status.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package servicecatalog
 
 import (
@@ -293,26 +296,6 @@ func StatusProvisioningArtifact(ctx context.Context, conn *servicecatalog.Servic
 	}
 }
 
-func StatusPrincipalPortfolioAssociation(ctx context.Context, conn *servicecatalog.ServiceCatalog, acceptLanguage, principalARN, portfolioID string) retry.StateRefreshFunc {
-	return func() (interface{}, string, error) {
-		output, err := FindPrincipalPortfolioAssociation(ctx, conn, acceptLanguage, principalARN, portfolioID)
-
-		if tfawserr.ErrCodeEquals(err, servicecatalog.ErrCodeResourceNotFoundException) {
-			return nil, StatusNotFound, err
-		}
-
-		if err != nil {
-			return nil, servicecatalog.StatusFailed, fmt.Errorf("describing principal portfolio association: %w", err)
-		}
-
-		if output == nil {
-			return nil, StatusNotFound, err
-		}
-
-		return output, servicecatalog.StatusAvailable, err
-	}
-}
-
 func StatusLaunchPaths(ctx context.Context, conn *servicecatalog.ServiceCatalog, acceptLanguage, productID string) retry.StateRefreshFunc {
 	return func() (interface{}, string, error) {
 		input := &servicecatalog.ListLaunchPathsInput{
diff --git a/internal/service/servicecatalog/sweep.go b/internal/service/servicecatalog/sweep.go
index fdae337ccde..6622b14885e 100644
--- a/internal/service/servicecatalog/sweep.go
+++ b/internal/service/servicecatalog/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package servicecatalog
 
@@ -15,9 +15,10 @@ import (
 	"github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_servicecatalog_budget_resource_association", &resource.Sweeper{
 		Name:         "aws_servicecatalog_budget_resource_association",
 		Dependencies: []string{},
@@ -83,7 +84,7 @@ func init() {
 
 func sweepBudgetResourceAssociations(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
@@ -181,11 +182,11 @@ func sweepBudgetResourceAssociations(region string) error {
 		errs = multierror.Append(errs, fmt.Errorf("error describing Service Catalog Budget Resource (Product) Associations for %s: %w", region, err))
 	}
 
-	if err = sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err = sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("error sweeping Service Catalog Budget Resource Associations for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
+	if awsv1.SkipSweepError(errs.ErrorOrNil()) {
 		log.Printf("[WARN] Skipping Service Catalog Budget Resource Associations sweep for %s: %s", region, errs)
 		return nil
 	}
@@ -195,7 +196,7 @@ func sweepBudgetResourceAssociations(region string) error {
 
 func sweepConstraints(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
@@ -251,11 +252,11 @@ func sweepConstraints(region string) error {
 		errs = multierror.Append(errs, fmt.Errorf("error describing Service Catalog Constraints for %s: %w", region, err))
 	}
 
-	if err = sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err = sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("error sweeping Service Catalog Constraints for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
+	if awsv1.SkipSweepError(errs.ErrorOrNil()) {
 		log.Printf("[WARN] Skipping Service Catalog Constraints sweep for %s: %s", region, errs)
 		return nil
 	}
@@ -265,7 +266,7 @@ func sweepConstraints(region string) error {
 
 func sweepPrincipalPortfolioAssociations(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
@@ -303,7 +304,7 @@ func sweepPrincipalPortfolioAssociations(region string) error {
 
 					r := ResourcePrincipalPortfolioAssociation()
 					d := r.Data(nil)
-					d.SetId(PrincipalPortfolioAssociationID(AcceptLanguageEnglish, aws.StringValue(principal.PrincipalARN), aws.StringValue(detail.Id)))
+					d.SetId(PrincipalPortfolioAssociationCreateResourceID(AcceptLanguageEnglish, aws.StringValue(principal.PrincipalARN), aws.StringValue(detail.Id), aws.StringValue(principal.PrincipalType)))
 
 					sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
 				}
@@ -324,11 +325,11 @@ func sweepPrincipalPortfolioAssociations(region string) error {
 		errs = multierror.Append(errs, fmt.Errorf("error describing Service Catalog Principal Portfolio Associations for %s: %w", region, err))
 	}
 
-	if err = sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err = sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("error sweeping Service Catalog Principal Portfolio Associations for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
+	if awsv1.SkipSweepError(errs.ErrorOrNil()) {
 		log.Printf("[WARN] Skipping Service Catalog Principal Portfolio Associations sweep for %s: %s", region, errs)
 		return nil
 	}
@@ -338,7 +339,7 @@ func sweepPrincipalPortfolioAssociations(region string) error {
 
 func sweepProductPortfolioAssociations(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
@@ -417,11 +418,11 @@ func sweepProductPortfolioAssociations(region string) error {
 		errs = multierror.Append(errs, fmt.Errorf("error describing Service Catalog Product Portfolio Associations for %s: %w", region, err))
 	}
 
-	if err = sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err = sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("error sweeping Service Catalog Product Portfolio Associations for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
+	if awsv1.SkipSweepError(errs.ErrorOrNil()) {
 		log.Printf("[WARN] Skipping Service Catalog Product Portfolio Associations sweep for %s: %s", region, errs)
 		return nil
 	}
@@ -431,7 +432,7 @@ func sweepProductPortfolioAssociations(region string) error {
 
 func sweepProducts(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
@@ -469,11 +470,11 @@ func sweepProducts(region string) error {
 		errs = multierror.Append(errs, fmt.Errorf("error describing Service Catalog Products for %s: %w", region, err))
 	}
 
-	if err = sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err = sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("error sweeping Service Catalog Products for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
+	if awsv1.SkipSweepError(errs.ErrorOrNil()) {
 		log.Printf("[WARN] Skipping Service Catalog Products sweep for %s: %s", region, errs)
 		return nil
 	}
@@ -483,7 +484,7 @@ func sweepProducts(region string) error {
 
 func sweepProvisionedProducts(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
@@ -513,6 +514,7 @@ func sweepProvisionedProducts(region string) error {
 			r := ResourceProvisionedProduct()
 			d := r.Data(nil)
 			d.SetId(aws.StringValue(detail.Id))
+			d.Set("ignore_errors", true)
 
 			sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
 		}
@@ -524,11 +526,11 @@ func sweepProvisionedProducts(region string) error {
 		errs = multierror.Append(errs, fmt.Errorf("error describing Service Catalog Provisioned Products for %s: %w", region, err))
 	}
 
-	if err = sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err = sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("error sweeping Service Catalog Provisioned Products for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
+	if awsv1.SkipSweepError(errs.ErrorOrNil()) {
 		log.Printf("[WARN] Skipping Service Catalog Provisioned Products sweep for %s: %s", region, errs)
 		return nil
 	}
@@ -538,7 +540,7 @@ func sweepProvisionedProducts(region string) error {
 
 func sweepProvisioningArtifacts(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
@@ -571,9 +573,7 @@ func sweepProvisioningArtifacts(region string) error {
 				output, err := conn.ListProvisioningArtifactsWithContext(ctx, artInput)
 
 				if err != nil {
-					err := fmt.Errorf("error listing Service Catalog Provisioning Artifacts for product (%s): %w", productID, err)
-					log.Printf("[ERROR] %s", err)
-					errs = multierror.Append(errs, err)
+					errs = multierror.Append(errs, fmt.Errorf("error listing Service Catalog Provisioning Artifacts for product (%s): %w", productID, err))
 					break
 				}
 
@@ -581,8 +581,7 @@ func sweepProvisioningArtifacts(region string) error {
 					r := ResourceProvisioningArtifact()
 					d := r.Data(nil)
 
-					d.SetId(aws.StringValue(pad.Id))
-					d.Set("product_id", productID)
+					d.SetId(ProvisioningArtifactID(aws.StringValue(pad.Id), productID))
 
 					sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
 				}
@@ -606,11 +605,11 @@ func sweepProvisioningArtifacts(region string) error {
 		errs = multierror.Append(errs, fmt.Errorf("error describing Service Catalog Provisioning Artifacts for %s: %w", region, err))
 	}
 
-	if err = sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err = sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("error sweeping Service Catalog Provisioning Artifacts for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
+	if awsv1.SkipSweepError(errs.ErrorOrNil()) {
 		log.Printf("[WARN] Skipping Service Catalog Provisioning Artifacts sweep for %s: %s", region, errs)
 		return nil
 	}
@@ -620,7 +619,7 @@ func sweepProvisioningArtifacts(region string) error {
 
 func sweepServiceActions(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
@@ -658,11 +657,11 @@ func sweepServiceActions(region string) error {
 		errs = multierror.Append(errs, fmt.Errorf("error describing Service Catalog Service Actions for %s: %w", region, err))
 	}
 
-	if err = sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err = sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("error sweeping Service Catalog Service Actions for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
+	if awsv1.SkipSweepError(errs.ErrorOrNil()) {
 		log.Printf("[WARN] Skipping Service Catalog Service Actions sweep for %s: %s", region, errs)
 		return nil
 	}
@@ -672,7 +671,7 @@ func sweepServiceActions(region string) error {
 
 func sweepTagOptionResourceAssociations(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
@@ -730,11 +729,11 @@ func sweepTagOptionResourceAssociations(region string) error {
 		errs = multierror.Append(errs, fmt.Errorf("error describing Service Catalog Tag Option Resource Associations for %s: %w", region, err))
 	}
 
-	if err = sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err = sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("error sweeping Service Catalog Tag Option Resource Associations for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
+	if awsv1.SkipSweepError(errs.ErrorOrNil()) {
 		log.Printf("[WARN] Skipping Service Catalog Tag Option Resource Associations sweep for %s: %s", region, errs)
 		return nil
 	}
@@ -744,7 +743,7 @@ func sweepTagOptionResourceAssociations(region string) error {
 
 func sweepTagOptions(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
@@ -786,11 +785,11 @@ func sweepTagOptions(region string) error {
 		errs = multierror.Append(errs, fmt.Errorf("error describing Service Catalog Tag Options for %s: %w", region, err))
 	}
 
-	if err = sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err = sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("error sweeping Service Catalog Tag Options for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
+	if awsv1.SkipSweepError(errs.ErrorOrNil()) {
 		log.Printf("[WARN] Skipping Service Catalog Tag Options sweep for %s: %s", region, errs)
 		return nil
 	}
diff --git a/internal/service/servicecatalog/tag_option.go b/internal/service/servicecatalog/tag_option.go
index b2de3017a1f..12fa6683880 100644
--- a/internal/service/servicecatalog/tag_option.go
+++ b/internal/service/servicecatalog/tag_option.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package servicecatalog
 
 import (
diff --git a/internal/service/servicecatalog/tag_option_resource_association.go b/internal/service/servicecatalog/tag_option_resource_association.go
index 871f459699d..c54ded2dd5d 100644
--- a/internal/service/servicecatalog/tag_option_resource_association.go
+++ b/internal/service/servicecatalog/tag_option_resource_association.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package servicecatalog
 
 import (
diff --git a/internal/service/servicecatalog/tag_option_resource_association_test.go b/internal/service/servicecatalog/tag_option_resource_association_test.go
index d026c25391a..323394b4302 100644
--- a/internal/service/servicecatalog/tag_option_resource_association_test.go
+++ b/internal/service/servicecatalog/tag_option_resource_association_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package servicecatalog_test
 
 import (
diff --git a/internal/service/servicecatalog/tag_option_test.go b/internal/service/servicecatalog/tag_option_test.go
index 8943079178d..b6eb3303f84 100644
--- a/internal/service/servicecatalog/tag_option_test.go
+++ b/internal/service/servicecatalog/tag_option_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package servicecatalog_test
 
 import (
diff --git a/internal/service/servicecatalog/tags.go b/internal/service/servicecatalog/tags.go
index af6f3277a5d..720d6fe435c 100644
--- a/internal/service/servicecatalog/tags.go
+++ b/internal/service/servicecatalog/tags.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:build !generate
 // +build !generate
 
diff --git a/internal/service/servicecatalog/validate.go b/internal/service/servicecatalog/validate.go
index 3adaddef31e..fbad6f2ab51 100644
--- a/internal/service/servicecatalog/validate.go
+++ b/internal/service/servicecatalog/validate.go
@@ -1,9 +1,12 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package servicecatalog
 
 import (
 	"fmt"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
 )
 
@@ -22,7 +25,7 @@ func validSharePrincipal(v interface{}, k string) (ws []string, errors []error)
 	errors = append(errors, errorsARN...)
 
 	pattern := `^arn:[\w-]+:organizations:.*:(ou|organization)/`
-	if !regexp.MustCompile(pattern).MatchString(value) {
+	if !regexache.MustCompile(pattern).MatchString(value) {
 		errors = append(errors, fmt.Errorf("%q does not look like an OU or organization: %q", k, value))
 	}
 
diff --git a/internal/service/servicecatalog/validate_test.go b/internal/service/servicecatalog/validate_test.go
index cdf1a3e505c..a5e46739af8 100644
--- a/internal/service/servicecatalog/validate_test.go
+++ b/internal/service/servicecatalog/validate_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package servicecatalog
 
 import (
diff --git a/internal/service/servicecatalog/wait.go b/internal/service/servicecatalog/wait.go
index bafdcdda716..6e634f627da 100644
--- a/internal/service/servicecatalog/wait.go
+++ b/internal/service/servicecatalog/wait.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package servicecatalog
 
 import (
@@ -12,53 +15,50 @@ import (
 )
 
 const (
-	BudgetResourceAssociationDeleteTimeout     = 3 * time.Minute
-	BudgetResourceAssociationReadTimeout       = 10 * time.Minute
-	BudgetResourceAssociationReadyTimeout      = 3 * time.Minute
-	ConstraintDeleteTimeout                    = 3 * time.Minute
-	ConstraintReadTimeout                      = 10 * time.Minute
-	ConstraintReadyTimeout                     = 3 * time.Minute
-	ConstraintUpdateTimeout                    = 3 * time.Minute
-	LaunchPathsReadyTimeout                    = 3 * time.Minute
-	OrganizationsAccessStableTimeout           = 3 * time.Minute
-	PortfolioConstraintsReadyTimeout           = 3 * time.Minute
-	PortfolioCreateTimeout                     = 30 * time.Minute
-	PortfolioDeleteTimeout                     = 30 * time.Minute
-	PortfolioReadTimeout                       = 10 * time.Minute
-	PortfolioShareCreateTimeout                = 3 * time.Minute
-	PortfolioShareDeleteTimeout                = 3 * time.Minute
-	PortfolioShareReadTimeout                  = 10 * time.Minute
-	PortfolioShareUpdateTimeout                = 3 * time.Minute
-	PortfolioUpdateTimeout                     = 30 * time.Minute
-	PrincipalPortfolioAssociationDeleteTimeout = 3 * time.Minute
-	PrincipalPortfolioAssociationReadTimeout   = 10 * time.Minute
-	PrincipalPortfolioAssociationReadyTimeout  = 3 * time.Minute
-	ProductDeleteTimeout                       = 5 * time.Minute
-	ProductPortfolioAssociationDeleteTimeout   = 3 * time.Minute
-	ProductPortfolioAssociationReadTimeout     = 10 * time.Minute
-	ProductPortfolioAssociationReadyTimeout    = 3 * time.Minute
-	ProductReadTimeout                         = 10 * time.Minute
-	ProductReadyTimeout                        = 5 * time.Minute
-	ProductUpdateTimeout                       = 5 * time.Minute
-	ProvisionedProductDeleteTimeout            = 30 * time.Minute
-	ProvisionedProductReadTimeout              = 10 * time.Minute
-	ProvisionedProductReadyTimeout             = 30 * time.Minute
-	ProvisionedProductUpdateTimeout            = 30 * time.Minute
-	ProvisioningArtifactDeleteTimeout          = 3 * time.Minute
-	ProvisioningArtifactReadTimeout            = 10 * time.Minute
-	ProvisioningArtifactReadyTimeout           = 3 * time.Minute
-	ProvisioningArtifactUpdateTimeout          = 3 * time.Minute
-	ServiceActionDeleteTimeout                 = 3 * time.Minute
-	ServiceActionReadTimeout                   = 10 * time.Minute
-	ServiceActionReadyTimeout                  = 3 * time.Minute
-	ServiceActionUpdateTimeout                 = 3 * time.Minute
-	TagOptionDeleteTimeout                     = 3 * time.Minute
-	TagOptionReadTimeout                       = 10 * time.Minute
-	TagOptionReadyTimeout                      = 3 * time.Minute
-	TagOptionResourceAssociationDeleteTimeout  = 3 * time.Minute
-	TagOptionResourceAssociationReadTimeout    = 10 * time.Minute
-	TagOptionResourceAssociationReadyTimeout   = 3 * time.Minute
-	TagOptionUpdateTimeout                     = 3 * time.Minute
+	BudgetResourceAssociationDeleteTimeout    = 3 * time.Minute
+	BudgetResourceAssociationReadTimeout      = 10 * time.Minute
+	BudgetResourceAssociationReadyTimeout     = 3 * time.Minute
+	ConstraintDeleteTimeout                   = 3 * time.Minute
+	ConstraintReadTimeout                     = 10 * time.Minute
+	ConstraintReadyTimeout                    = 3 * time.Minute
+	ConstraintUpdateTimeout                   = 3 * time.Minute
+	LaunchPathsReadyTimeout                   = 3 * time.Minute
+	OrganizationsAccessStableTimeout          = 3 * time.Minute
+	PortfolioConstraintsReadyTimeout          = 3 * time.Minute
+	PortfolioCreateTimeout                    = 30 * time.Minute
+	PortfolioDeleteTimeout                    = 30 * time.Minute
+	PortfolioReadTimeout                      = 10 * time.Minute
+	PortfolioShareCreateTimeout               = 3 * time.Minute
+	PortfolioShareDeleteTimeout               = 3 * time.Minute
+	PortfolioShareReadTimeout                 = 10 * time.Minute
+	PortfolioShareUpdateTimeout               = 3 * time.Minute
+	PortfolioUpdateTimeout                    = 30 * time.Minute
+	ProductDeleteTimeout                      = 5 * time.Minute
+	ProductPortfolioAssociationDeleteTimeout  = 3 * time.Minute
+	ProductPortfolioAssociationReadTimeout    = 10 * time.Minute
+	ProductPortfolioAssociationReadyTimeout   = 3 * time.Minute
+	ProductReadTimeout                        = 10 * time.Minute
+	ProductReadyTimeout                       = 5 * time.Minute
+	ProductUpdateTimeout                      = 5 * time.Minute
+	ProvisionedProductDeleteTimeout           = 30 * time.Minute
+	ProvisionedProductReadTimeout             = 10 * time.Minute
+	ProvisionedProductReadyTimeout            = 30 * time.Minute
+	ProvisionedProductUpdateTimeout           = 30 * time.Minute
+	ProvisioningArtifactDeleteTimeout         = 3 * time.Minute
+	ProvisioningArtifactReadTimeout           = 10 * time.Minute
+	ProvisioningArtifactReadyTimeout          = 3 * time.Minute
+	ProvisioningArtifactUpdateTimeout         = 3 * time.Minute
+	ServiceActionDeleteTimeout                = 3 * time.Minute
+	ServiceActionReadTimeout                  = 10 * time.Minute
+	ServiceActionReadyTimeout                 = 3 * time.Minute
+	ServiceActionUpdateTimeout                = 3 * time.Minute
+	TagOptionDeleteTimeout                    = 3 * time.Minute
+	TagOptionReadTimeout                      = 10 * time.Minute
+	TagOptionReadyTimeout                     = 3 * time.Minute
+	TagOptionResourceAssociationDeleteTimeout = 3 * time.Minute
+	TagOptionResourceAssociationReadTimeout   = 10 * time.Minute
+	TagOptionResourceAssociationReadyTimeout  = 3 * time.Minute
+	TagOptionUpdateTimeout                    = 3 * time.Minute
 
 	MinTimeout                 = 2 * time.Second
 	NotFoundChecks             = 5
@@ -438,40 +438,6 @@ func WaitProvisioningArtifactDeleted(ctx context.Context, conn *servicecatalog.S
 	return err
 }
 
-func WaitPrincipalPortfolioAssociationReady(ctx context.Context, conn *servicecatalog.ServiceCatalog, acceptLanguage, principalARN, portfolioID string, timeout time.Duration) (*servicecatalog.Principal, error) {
-	stateConf := &retry.StateChangeConf{
-		Pending:                   []string{StatusNotFound, StatusUnavailable},
-		Target:                    []string{servicecatalog.StatusAvailable},
-		Refresh:                   StatusPrincipalPortfolioAssociation(ctx, conn, acceptLanguage, principalARN, portfolioID),
-		Timeout:                   timeout,
-		ContinuousTargetOccurence: ContinuousTargetOccurrence,
-		NotFoundChecks:            NotFoundChecks,
-		MinTimeout:                MinTimeout,
-	}
-
-	outputRaw, err := stateConf.WaitForStateContext(ctx)
-
-	if output, ok := outputRaw.(*servicecatalog.Principal); ok {
-		return output, err
-	}
-
-	return nil, err
-}
-
-func WaitPrincipalPortfolioAssociationDeleted(ctx context.Context, conn *servicecatalog.ServiceCatalog, acceptLanguage, principalARN, portfolioID string, timeout time.Duration) error {
-	stateConf := &retry.StateChangeConf{
-		Pending:        []string{servicecatalog.StatusAvailable},
-		Target:         []string{StatusNotFound, StatusUnavailable},
-		Refresh:        StatusPrincipalPortfolioAssociation(ctx, conn, acceptLanguage, principalARN, portfolioID),
-		Timeout:        timeout,
-		NotFoundChecks: 1,
-	}
-
-	_, err := stateConf.WaitForStateContext(ctx)
-
-	return err
-}
-
 func WaitLaunchPathsReady(ctx context.Context, conn *servicecatalog.ServiceCatalog, acceptLanguage, productID string, timeout time.Duration) ([]*servicecatalog.LaunchPathSummary, error) {
 	stateConf := &retry.StateChangeConf{
 		Pending:                   []string{StatusNotFound},
@@ -495,7 +461,7 @@ func WaitLaunchPathsReady(ctx context.Context, conn *servicecatalog.ServiceCatal
 func WaitProvisionedProductReady(ctx context.Context, conn *servicecatalog.ServiceCatalog, acceptLanguage, id, name string, timeout time.Duration) (*servicecatalog.DescribeProvisionedProductOutput, error) {
 	stateConf := &retry.StateChangeConf{
 		Pending:                   []string{servicecatalog.ProvisionedProductStatusUnderChange, servicecatalog.ProvisionedProductStatusPlanInProgress},
-		Target:                    []string{servicecatalog.StatusAvailable},
+		Target:                    []string{servicecatalog.ProvisionedProductStatusAvailable},
 		Refresh:                   StatusProvisionedProduct(ctx, conn, acceptLanguage, id, name),
 		Timeout:                   timeout,
 		ContinuousTargetOccurence: ContinuousTargetOccurrence,
@@ -525,7 +491,7 @@ func WaitProvisionedProductReady(ctx context.Context, conn *servicecatalog.Servi
 
 func WaitProvisionedProductTerminated(ctx context.Context, conn *servicecatalog.ServiceCatalog, acceptLanguage, id, name string, timeout time.Duration) error {
 	stateConf := &retry.StateChangeConf{
-		Pending: []string{servicecatalog.StatusAvailable, servicecatalog.ProvisionedProductStatusUnderChange},
+		Pending: []string{servicecatalog.ProvisionedProductStatusAvailable, servicecatalog.ProvisionedProductStatusUnderChange},
 		Target:  []string{},
 		Refresh: StatusProvisionedProduct(ctx, conn, acceptLanguage, id, name),
 		Timeout: timeout,
diff --git a/internal/service/servicediscovery/dns_namespace_data_source.go b/internal/service/servicediscovery/dns_namespace_data_source.go
index 82b819bd56e..8589a91e582 100644
--- a/internal/service/servicediscovery/dns_namespace_data_source.go
+++ b/internal/service/servicediscovery/dns_namespace_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package servicediscovery
 
 import (
diff --git a/internal/service/servicediscovery/dns_namespace_data_source_test.go b/internal/service/servicediscovery/dns_namespace_data_source_test.go
index e68020179ae..c17bfa9f10e 100644
--- a/internal/service/servicediscovery/dns_namespace_data_source_test.go
+++ b/internal/service/servicediscovery/dns_namespace_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package servicediscovery_test
 
 import (
diff --git a/internal/service/servicediscovery/find.go b/internal/service/servicediscovery/find.go
index 83adde8c113..270f15d4a3f 100644
--- a/internal/service/servicediscovery/find.go
+++ b/internal/service/servicediscovery/find.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package servicediscovery
 
 import (
diff --git a/internal/service/servicediscovery/generate.go b/internal/service/servicediscovery/generate.go
index 00a44612178..7eb072888d4 100644
--- a/internal/service/servicediscovery/generate.go
+++ b/internal/service/servicediscovery/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTags -ListTagsInIDElem=ResourceARN -ServiceTagsSlice -TagInIDElem=ResourceARN -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/servicediscovery/http_namespace.go b/internal/service/servicediscovery/http_namespace.go
index 08b1bf9d651..d52ea853c6f 100644
--- a/internal/service/servicediscovery/http_namespace.go
+++ b/internal/service/servicediscovery/http_namespace.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package servicediscovery
 
 import (
diff --git a/internal/service/servicediscovery/http_namespace_data_source.go b/internal/service/servicediscovery/http_namespace_data_source.go
index d59d11aba09..06ce864d530 100644
--- a/internal/service/servicediscovery/http_namespace_data_source.go
+++ b/internal/service/servicediscovery/http_namespace_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package servicediscovery
 
 import (
diff --git a/internal/service/servicediscovery/http_namespace_data_source_test.go b/internal/service/servicediscovery/http_namespace_data_source_test.go
index 535adcde38c..3581b700469 100644
--- a/internal/service/servicediscovery/http_namespace_data_source_test.go
+++ b/internal/service/servicediscovery/http_namespace_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package servicediscovery_test
 
 import (
diff --git a/internal/service/servicediscovery/http_namespace_test.go b/internal/service/servicediscovery/http_namespace_test.go
index 3e1a40acc0c..6e7106d95da 100644
--- a/internal/service/servicediscovery/http_namespace_test.go
+++ b/internal/service/servicediscovery/http_namespace_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package servicediscovery_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/servicediscovery"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -35,7 +38,7 @@ func TestAccServiceDiscoveryHTTPNamespace_basic(t *testing.T) {
 				Config: testAccHTTPNamespaceConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckHTTPNamespaceExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "servicediscovery", regexp.MustCompile(`namespace/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "servicediscovery", regexache.MustCompile(`namespace/.+`)),
 					resource.TestCheckResourceAttrSet(resourceName, "arn"),
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
diff --git a/internal/service/servicediscovery/instance.go b/internal/service/servicediscovery/instance.go
index 26c36eeab61..598f66034fa 100644
--- a/internal/service/servicediscovery/instance.go
+++ b/internal/service/servicediscovery/instance.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package servicediscovery
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"strings"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/servicediscovery"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
@@ -16,7 +19,6 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/flex"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
-	"github.com/hashicorp/terraform-provider-aws/internal/verify"
 )
 
 // @SDKResource("aws_service_discovery_instance")
@@ -36,11 +38,11 @@ func ResourceInstance() *schema.Resource {
 				Type:     schema.TypeMap,
 				Required: true,
 				Elem:     &schema.Schema{Type: schema.TypeString},
-				ValidateDiagFunc: verify.ValidAllDiag(
+				ValidateDiagFunc: validation.AllDiag(
 					validation.MapKeyLenBetween(1, 255),
-					validation.MapKeyMatch(regexp.MustCompile(`^[a-zA-Z0-9!-~]+$`), ""),
+					validation.MapKeyMatch(regexache.MustCompile(`^[0-9A-Za-z!-~]+$`), ""),
 					validation.MapValueLenBetween(0, 1024),
-					validation.MapValueMatch(regexp.MustCompile(`^([a-zA-Z0-9!-~][ \ta-zA-Z0-9!-~]*){0,1}[a-zA-Z0-9!-~]{0,1}$`), ""),
+					validation.MapValueMatch(regexache.MustCompile(`^([0-9A-Za-z!-~][0-9A-Za-z \t!-~]*){0,1}[0-9A-Za-z!-~]{0,1}$`), ""),
 				),
 			},
 			"instance_id": {
@@ -49,7 +51,7 @@ func ResourceInstance() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 64),
-					validation.StringMatch(regexp.MustCompile(`^[0-9a-zA-Z_/:.@-]+$`), ""),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_/:.@-]+$`), ""),
 				),
 			},
 			"service_id": {
diff --git a/internal/service/servicediscovery/instance_test.go b/internal/service/servicediscovery/instance_test.go
index b4b8b35fd29..0ce5276f283 100644
--- a/internal/service/servicediscovery/instance_test.go
+++ b/internal/service/servicediscovery/instance_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package servicediscovery_test
 
 import (
diff --git a/internal/service/servicediscovery/private_dns_namespace.go b/internal/service/servicediscovery/private_dns_namespace.go
index be42dab26ed..87d477dbef2 100644
--- a/internal/service/servicediscovery/private_dns_namespace.go
+++ b/internal/service/servicediscovery/private_dns_namespace.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package servicediscovery
 
 import (
@@ -47,7 +50,6 @@ func ResourcePrivateDNSNamespace() *schema.Resource {
 			"description": {
 				Type:     schema.TypeString,
 				Optional: true,
-				ForceNew: true,
 			},
 			"hosted_zone": {
 				Type:     schema.TypeString,
@@ -87,7 +89,6 @@ func resourcePrivateDNSNamespaceCreate(ctx context.Context, d *schema.ResourceDa
 		input.Description = aws.String(v.(string))
 	}
 
-	log.Printf("[DEBUG] Creating Service Discovery Private DNS Namespace: %s", input)
 	output, err := conn.CreatePrivateDnsNamespaceWithContext(ctx, input)
 
 	if err != nil {
@@ -140,7 +141,30 @@ func resourcePrivateDNSNamespaceRead(ctx context.Context, d *schema.ResourceData
 }
 
 func resourcePrivateDNSNamespaceUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	// Tags only.
+	conn := meta.(*conns.AWSClient).ServiceDiscoveryConn(ctx)
+
+	if d.HasChange("description") {
+		input := &servicediscovery.UpdatePrivateDnsNamespaceInput{
+			Id: aws.String(d.Id()),
+			Namespace: &servicediscovery.PrivateDnsNamespaceChange{
+				Description: aws.String(d.Get("description").(string)),
+			},
+			UpdaterRequestId: aws.String(id.UniqueId()),
+		}
+
+		output, err := conn.UpdatePrivateDnsNamespaceWithContext(ctx, input)
+
+		if err != nil {
+			return diag.Errorf("updating Service Discovery Private DNS Namespace (%s): %s", d.Id(), err)
+		}
+
+		if output != nil && output.OperationId != nil {
+			if _, err := WaitOperationSuccess(ctx, conn, aws.StringValue(output.OperationId)); err != nil {
+				return diag.Errorf("waiting for Service Discovery Private DNS Namespace (%s) update: %s", d.Id(), err)
+			}
+		}
+	}
+
 	return resourcePrivateDNSNamespaceRead(ctx, d, meta)
 }
 
diff --git a/internal/service/servicediscovery/private_dns_namespace_test.go b/internal/service/servicediscovery/private_dns_namespace_test.go
index 0363a200c71..14208c1df33 100644
--- a/internal/service/servicediscovery/private_dns_namespace_test.go
+++ b/internal/service/servicediscovery/private_dns_namespace_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package servicediscovery_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/servicediscovery"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -35,7 +38,7 @@ func TestAccServiceDiscoveryPrivateDNSNamespace_basic(t *testing.T) {
 				Config: testAccPrivateDNSNamespaceConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckPrivateDNSNamespaceExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "servicediscovery", regexp.MustCompile(`namespace/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "servicediscovery", regexache.MustCompile(`namespace/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
 					resource.TestCheckResourceAttrSet(resourceName, "hosted_zone"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
@@ -94,10 +97,17 @@ func TestAccServiceDiscoveryPrivateDNSNamespace_description(t *testing.T) {
 		CheckDestroy:             testAccCheckPrivateDNSNamespaceDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccPrivateDNSNamespaceConfig_description(rName, "test"),
+				Config: testAccPrivateDNSNamespaceConfig_description(rName, "desc1"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckPrivateDNSNamespaceExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "description", "desc1"),
+				),
+			},
+			{
+				Config: testAccPrivateDNSNamespaceConfig_description(rName, "desc2"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckPrivateDNSNamespaceExists(ctx, resourceName),
-					resource.TestCheckResourceAttr(resourceName, "description", "test"),
+					resource.TestCheckResourceAttr(resourceName, "description", "desc2"),
 				),
 			},
 		},
@@ -123,7 +133,7 @@ func TestAccServiceDiscoveryPrivateDNSNamespace_Error_overlap(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccPrivateDNSNamespaceConfig_overlapping(rName),
-				ExpectError: regexp.MustCompile(`ConflictingDomainExists`),
+				ExpectError: regexache.MustCompile(`ConflictingDomainExists`),
 			},
 		},
 	})
diff --git a/internal/service/servicediscovery/public_dns_namespace.go b/internal/service/servicediscovery/public_dns_namespace.go
index d7ae35bcc8d..d5aef120a29 100644
--- a/internal/service/servicediscovery/public_dns_namespace.go
+++ b/internal/service/servicediscovery/public_dns_namespace.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package servicediscovery
 
 import (
@@ -37,7 +40,6 @@ func ResourcePublicDNSNamespace() *schema.Resource {
 			"description": {
 				Type:     schema.TypeString,
 				Optional: true,
-				ForceNew: true,
 			},
 			"hosted_zone": {
 				Type:     schema.TypeString,
@@ -71,7 +73,6 @@ func resourcePublicDNSNamespaceCreate(ctx context.Context, d *schema.ResourceDat
 		input.Description = aws.String(v.(string))
 	}
 
-	log.Printf("[DEBUG] Creating Service Discovery Public DNS Namespace: %s", input)
 	output, err := conn.CreatePublicDnsNamespaceWithContext(ctx, input)
 
 	if err != nil {
@@ -124,7 +125,30 @@ func resourcePublicDNSNamespaceRead(ctx context.Context, d *schema.ResourceData,
 }
 
 func resourcePublicDNSNamespaceUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	// Tags only.
+	conn := meta.(*conns.AWSClient).ServiceDiscoveryConn(ctx)
+
+	if d.HasChange("description") {
+		input := &servicediscovery.UpdatePublicDnsNamespaceInput{
+			Id: aws.String(d.Id()),
+			Namespace: &servicediscovery.PublicDnsNamespaceChange{
+				Description: aws.String(d.Get("description").(string)),
+			},
+			UpdaterRequestId: aws.String(id.UniqueId()),
+		}
+
+		output, err := conn.UpdatePublicDnsNamespaceWithContext(ctx, input)
+
+		if err != nil {
+			return diag.Errorf("updating Service Discovery Public DNS Namespace (%s): %s", d.Id(), err)
+		}
+
+		if output != nil && output.OperationId != nil {
+			if _, err := WaitOperationSuccess(ctx, conn, aws.StringValue(output.OperationId)); err != nil {
+				return diag.Errorf("waiting for Service Discovery Public DNS Namespace (%s) update: %s", d.Id(), err)
+			}
+		}
+	}
+
 	return resourcePublicDNSNamespaceRead(ctx, d, meta)
 }
 
diff --git a/internal/service/servicediscovery/public_dns_namespace_test.go b/internal/service/servicediscovery/public_dns_namespace_test.go
index ad34259131f..4af15f89901 100644
--- a/internal/service/servicediscovery/public_dns_namespace_test.go
+++ b/internal/service/servicediscovery/public_dns_namespace_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package servicediscovery_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/servicediscovery"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -35,7 +38,7 @@ func TestAccServiceDiscoveryPublicDNSNamespace_basic(t *testing.T) {
 				Config: testAccPublicDNSNamespaceConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckPublicDNSNamespaceExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "servicediscovery", regexp.MustCompile(`namespace/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "servicediscovery", regexache.MustCompile(`namespace/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
 					resource.TestCheckResourceAttrSet(resourceName, "hosted_zone"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
@@ -93,10 +96,17 @@ func TestAccServiceDiscoveryPublicDNSNamespace_description(t *testing.T) {
 		CheckDestroy:             testAccCheckPublicDNSNamespaceDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccPublicDNSNamespaceConfig_description(rName, "test"),
+				Config: testAccPublicDNSNamespaceConfig_description(rName, "desc1"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckPublicDNSNamespaceExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "description", "desc1"),
+				),
+			},
+			{
+				Config: testAccPublicDNSNamespaceConfig_description(rName, "desc2"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckPublicDNSNamespaceExists(ctx, resourceName),
-					resource.TestCheckResourceAttr(resourceName, "description", "test"),
+					resource.TestCheckResourceAttr(resourceName, "description", "desc2"),
 				),
 			},
 		},
diff --git a/internal/service/servicediscovery/service.go b/internal/service/servicediscovery/service.go
index 553b5d0bce0..a6e2282daa8 100644
--- a/internal/service/servicediscovery/service.go
+++ b/internal/service/servicediscovery/service.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package servicediscovery
 
 import (
diff --git a/internal/service/servicediscovery/service_data_source.go b/internal/service/servicediscovery/service_data_source.go
index a0550edc07c..0664e6be8b8 100644
--- a/internal/service/servicediscovery/service_data_source.go
+++ b/internal/service/servicediscovery/service_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package servicediscovery
 
 import (
diff --git a/internal/service/servicediscovery/service_data_source_test.go b/internal/service/servicediscovery/service_data_source_test.go
index caf7db6e408..c6ad538f337 100644
--- a/internal/service/servicediscovery/service_data_source_test.go
+++ b/internal/service/servicediscovery/service_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package servicediscovery_test
 
 import (
diff --git a/internal/service/servicediscovery/service_package_gen.go b/internal/service/servicediscovery/service_package_gen.go
index ce5a718a8cd..fdc70ea5e12 100644
--- a/internal/service/servicediscovery/service_package_gen.go
+++ b/internal/service/servicediscovery/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	servicediscovery_sdkv1 "github.com/aws/aws-sdk-go/service/servicediscovery"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -91,4 +92,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*s
 	return servicediscovery_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/servicediscovery/service_test.go b/internal/service/servicediscovery/service_test.go
index 412b2f5038d..66c2749f8fc 100644
--- a/internal/service/servicediscovery/service_test.go
+++ b/internal/service/servicediscovery/service_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package servicediscovery_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/servicediscovery"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -35,7 +38,7 @@ func TestAccServiceDiscoveryService_private(t *testing.T) {
 				Config: testAccServiceConfig_private(rName, 5),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckServiceExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "servicediscovery", regexp.MustCompile(`service/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "servicediscovery", regexache.MustCompile(`service/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
 					resource.TestCheckResourceAttr(resourceName, "dns_config.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "dns_config.0.dns_records.#", "1"),
@@ -60,7 +63,7 @@ func TestAccServiceDiscoveryService_private(t *testing.T) {
 				Config: testAccServiceConfig_privateUpdate(rName, 5),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckServiceExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "servicediscovery", regexp.MustCompile(`service/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "servicediscovery", regexache.MustCompile(`service/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "description", "test"),
 					resource.TestCheckResourceAttr(resourceName, "dns_config.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "dns_config.0.dns_records.#", "2"),
@@ -99,7 +102,7 @@ func TestAccServiceDiscoveryService_public(t *testing.T) {
 				Config: testAccServiceConfig_public(rName, 5, "/path"),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckServiceExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "servicediscovery", regexp.MustCompile(`service/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "servicediscovery", regexache.MustCompile(`service/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "description", "test"),
 					resource.TestCheckResourceAttr(resourceName, "dns_config.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "dns_config.0.routing_policy", "WEIGHTED"),
@@ -121,7 +124,7 @@ func TestAccServiceDiscoveryService_public(t *testing.T) {
 				Config: testAccServiceConfig_public(rName, 3, "/updated-path"),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckServiceExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "servicediscovery", regexp.MustCompile(`service/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "servicediscovery", regexache.MustCompile(`service/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "description", "test"),
 					resource.TestCheckResourceAttr(resourceName, "dns_config.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "health_check_config.#", "1"),
@@ -136,7 +139,7 @@ func TestAccServiceDiscoveryService_public(t *testing.T) {
 				Config: testAccServiceConfig_publicUpdateNoHealthCheck(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckServiceExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "servicediscovery", regexp.MustCompile(`service/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "servicediscovery", regexache.MustCompile(`service/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
 					resource.TestCheckResourceAttr(resourceName, "dns_config.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "health_check_config.#", "0"),
@@ -163,7 +166,7 @@ func TestAccServiceDiscoveryService_private_http(t *testing.T) {
 				Config: testAccServiceConfig_private_http(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckServiceExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "servicediscovery", regexp.MustCompile(`service/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "servicediscovery", regexache.MustCompile(`service/.+`)),
 					resource.TestCheckResourceAttrSet(resourceName, "namespace_id"),
 					resource.TestCheckResourceAttr(resourceName, "type", "HTTP"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
@@ -194,7 +197,7 @@ func TestAccServiceDiscoveryService_http(t *testing.T) {
 				Config: testAccServiceConfig_http(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckServiceExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "servicediscovery", regexp.MustCompile(`service/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "servicediscovery", regexache.MustCompile(`service/.+`)),
 					resource.TestCheckResourceAttrSet(resourceName, "namespace_id"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 				),
diff --git a/internal/service/servicediscovery/status.go b/internal/service/servicediscovery/status.go
index 7661c9a5496..da24245cd7c 100644
--- a/internal/service/servicediscovery/status.go
+++ b/internal/service/servicediscovery/status.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package servicediscovery
 
 import (
diff --git a/internal/service/servicediscovery/sweep.go b/internal/service/servicediscovery/sweep.go
index e86df7aa584..01adca6a17a 100644
--- a/internal/service/servicediscovery/sweep.go
+++ b/internal/service/servicediscovery/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package servicediscovery
 
@@ -11,9 +11,10 @@ import (
 	"github.com/aws/aws-sdk-go/service/servicediscovery"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_service_discovery_http_namespace", &resource.Sweeper{
 		Name: "aws_service_discovery_http_namespace",
 		F:    sweepHTTPNamespaces,
@@ -46,7 +47,7 @@ func init() {
 
 func sweepHTTPNamespaces(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -55,7 +56,7 @@ func sweepHTTPNamespaces(region string) error {
 
 	namespaces, err := findNamespacesByType(ctx, conn, servicediscovery.NamespaceTypeHttp)
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Service Discovery HTTP Namespace sweep for %s: %s", region, err)
 		return nil
 	}
@@ -72,7 +73,7 @@ func sweepHTTPNamespaces(region string) error {
 		sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping Service Discovery HTTP Namespaces (%s): %w", region, err)
@@ -83,7 +84,7 @@ func sweepHTTPNamespaces(region string) error {
 
 func sweepPrivateDNSNamespaces(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -92,7 +93,7 @@ func sweepPrivateDNSNamespaces(region string) error {
 
 	namespaces, err := findNamespacesByType(ctx, conn, servicediscovery.NamespaceTypeDnsPrivate)
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Service Discovery Private DNS Namespace sweep for %s: %s", region, err)
 		return nil
 	}
@@ -109,7 +110,7 @@ func sweepPrivateDNSNamespaces(region string) error {
 		sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping Service Discovery Private DNS Namespaces (%s): %w", region, err)
@@ -120,7 +121,7 @@ func sweepPrivateDNSNamespaces(region string) error {
 
 func sweepPublicDNSNamespaces(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -129,7 +130,7 @@ func sweepPublicDNSNamespaces(region string) error {
 
 	namespaces, err := findNamespacesByType(ctx, conn, servicediscovery.NamespaceTypeDnsPublic)
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Service Discovery Public DNS Namespace sweep for %s: %s", region, err)
 		return nil
 	}
@@ -146,7 +147,7 @@ func sweepPublicDNSNamespaces(region string) error {
 		sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping Service Discovery Public DNS Namespaces (%s): %w", region, err)
@@ -157,7 +158,7 @@ func sweepPublicDNSNamespaces(region string) error {
 
 func sweepServices(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -167,7 +168,7 @@ func sweepServices(region string) error {
 
 	services, err := findServices(ctx, conn, input)
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Service Discovery Service sweep for %s: %s", region, err)
 		return nil
 	}
@@ -185,7 +186,7 @@ func sweepServices(region string) error {
 		sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping Service Discovery Services (%s): %w", region, err)
diff --git a/internal/service/servicediscovery/tags_gen.go b/internal/service/servicediscovery/tags_gen.go
index c18dc6b33ed..efcb4e2e37c 100644
--- a/internal/service/servicediscovery/tags_gen.go
+++ b/internal/service/servicediscovery/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/servicediscovery"
 	"github.com/aws/aws-sdk-go/service/servicediscovery/servicediscoveryiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -102,6 +104,8 @@ func updateTags(ctx context.Context, conn servicediscoveryiface.ServiceDiscovery
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.ServiceDiscovery)
 	if len(removedTags) > 0 {
diff --git a/internal/service/servicediscovery/validate.go b/internal/service/servicediscovery/validate.go
index 7c2f6b433d0..3990927a190 100644
--- a/internal/service/servicediscovery/validate.go
+++ b/internal/service/servicediscovery/validate.go
@@ -1,12 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package servicediscovery
 
 import (
-	"regexp"
-
+	"github.com/YakDriver/regexache"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 )
 
 var validNamespaceName = validation.All(
 	validation.StringLenBetween(1, 1024),
-	validation.StringMatch(regexp.MustCompile(`^[0-9A-Za-z._-]+$`), ""),
+	validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z._-]+$`), ""),
 )
diff --git a/internal/service/servicediscovery/validate_test.go b/internal/service/servicediscovery/validate_test.go
index b8c9953b701..cb5764a5f06 100644
--- a/internal/service/servicediscovery/validate_test.go
+++ b/internal/service/servicediscovery/validate_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package servicediscovery
 
 import (
diff --git a/internal/service/servicediscovery/wait.go b/internal/service/servicediscovery/wait.go
index ca8d35eba6b..534eb064199 100644
--- a/internal/service/servicediscovery/wait.go
+++ b/internal/service/servicediscovery/wait.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package servicediscovery
 
 import (
diff --git a/internal/service/servicequotas/acc_test.go b/internal/service/servicequotas/acc_test.go
index 4b1f827c8c3..c2a7d92b7fc 100644
--- a/internal/service/servicequotas/acc_test.go
+++ b/internal/service/servicequotas/acc_test.go
@@ -1,12 +1,16 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package servicequotas_test
 
 import (
 	"context"
+	"errors"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/servicequotas"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/servicequotas"
+	"github.com/aws/aws-sdk-go-v2/service/servicequotas/types"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 )
@@ -26,11 +30,11 @@ const (
 )
 
 func testAccPreCheck(ctx context.Context, t *testing.T) {
-	conn := acctest.Provider.Meta().(*conns.AWSClient).ServiceQuotasConn(ctx)
+	conn := acctest.Provider.Meta().(*conns.AWSClient).ServiceQuotasClient(ctx)
 
 	input := &servicequotas.ListServicesInput{}
 
-	_, err := conn.ListServicesWithContext(ctx, input)
+	_, err := conn.ListServices(ctx, input)
 
 	if acctest.PreCheckSkipError(err) {
 		t.Skipf("skipping acceptance testing: %s", err)
@@ -43,15 +47,16 @@ func testAccPreCheck(ctx context.Context, t *testing.T) {
 
 // nosemgrep:ci.servicequotas-in-func-name
 func preCheckServiceQuotaSet(ctx context.Context, serviceCode, quotaCode string, t *testing.T) {
-	conn := acctest.Provider.Meta().(*conns.AWSClient).ServiceQuotasConn(ctx)
+	conn := acctest.Provider.Meta().(*conns.AWSClient).ServiceQuotasClient(ctx)
 
 	input := &servicequotas.GetServiceQuotaInput{
 		QuotaCode:   aws.String(quotaCode),
 		ServiceCode: aws.String(serviceCode),
 	}
 
-	_, err := conn.GetServiceQuotaWithContext(ctx, input)
-	if tfawserr.ErrCodeEquals(err, servicequotas.ErrCodeNoSuchResourceException) {
+	_, err := conn.GetServiceQuota(ctx, input)
+	var nsr *types.NoSuchResourceException
+	if errors.As(err, &nsr) {
 		t.Fatalf("The Service Quota (%s/%s) has never been set. This test can only be run with a quota that has previously been set. Please update the test to check a new quota.", serviceCode, quotaCode)
 	}
 	if err != nil {
@@ -60,31 +65,32 @@ func preCheckServiceQuotaSet(ctx context.Context, serviceCode, quotaCode string,
 }
 
 func preCheckServiceQuotaUnset(ctx context.Context, serviceCode, quotaCode string, t *testing.T) {
-	conn := acctest.Provider.Meta().(*conns.AWSClient).ServiceQuotasConn(ctx)
+	conn := acctest.Provider.Meta().(*conns.AWSClient).ServiceQuotasClient(ctx)
 
 	input := &servicequotas.GetServiceQuotaInput{
 		QuotaCode:   aws.String(quotaCode),
 		ServiceCode: aws.String(serviceCode),
 	}
 
-	_, err := conn.GetServiceQuotaWithContext(ctx, input)
+	_, err := conn.GetServiceQuota(ctx, input)
 	if err == nil {
 		t.Fatalf("The Service Quota (%s/%s) has been set. This test can only be run with a quota that has never been set. Please update the test to check a new quota.", serviceCode, quotaCode)
 	}
-	if !tfawserr.ErrCodeEquals(err, servicequotas.ErrCodeNoSuchResourceException) {
+	var nsr *types.NoSuchResourceException
+	if !errors.As(err, &nsr) {
 		t.Fatalf("unexpected PreCheck error getting Service Quota (%s/%s) : %s", serviceCode, quotaCode, err)
 	}
 }
 
 func preCheckServiceQuotaHasUsageMetric(ctx context.Context, serviceCode, quotaCode string, t *testing.T) {
-	conn := acctest.Provider.Meta().(*conns.AWSClient).ServiceQuotasConn(ctx)
+	conn := acctest.Provider.Meta().(*conns.AWSClient).ServiceQuotasClient(ctx)
 
 	input := &servicequotas.GetAWSDefaultServiceQuotaInput{
 		QuotaCode:   aws.String(quotaCode),
 		ServiceCode: aws.String(serviceCode),
 	}
 
-	quota, err := conn.GetAWSDefaultServiceQuotaWithContext(ctx, input)
+	quota, err := conn.GetAWSDefaultServiceQuota(ctx, input)
 	if err != nil {
 		t.Fatalf("unexpected PreCheck error getting Service Quota (%s/%s) : %s", serviceCode, quotaCode, err)
 	}
diff --git a/internal/service/servicequotas/exports_test.go b/internal/service/servicequotas/exports_test.go
new file mode 100644
index 00000000000..edc5a42066c
--- /dev/null
+++ b/internal/service/servicequotas/exports_test.go
@@ -0,0 +1,10 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package servicequotas
+
+// Exports for use in tests only.
+var (
+	ResourceTemplate            = newResourceTemplate
+	ResourceTemplateAssociation = newResourceTemplateAssociation
+)
diff --git a/internal/service/servicequotas/find.go b/internal/service/servicequotas/find.go
index 4abd401a624..bf2208d9569 100644
--- a/internal/service/servicequotas/find.go
+++ b/internal/service/servicequotas/find.go
@@ -1,23 +1,27 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package servicequotas
 
 import (
 	"context"
+	"errors"
 	"fmt"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/servicequotas"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/servicequotas"
+	"github.com/aws/aws-sdk-go-v2/service/servicequotas/types"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
-func findServiceQuotaDefaultByID(ctx context.Context, conn *servicequotas.ServiceQuotas, serviceCode, quotaCode string) (*servicequotas.ServiceQuota, error) {
+func findServiceQuotaDefaultByID(ctx context.Context, conn *servicequotas.Client, serviceCode, quotaCode string) (*types.ServiceQuota, error) {
 	input := &servicequotas.GetAWSDefaultServiceQuotaInput{
 		ServiceCode: aws.String(serviceCode),
 		QuotaCode:   aws.String(quotaCode),
 	}
 
-	output, err := conn.GetAWSDefaultServiceQuotaWithContext(ctx, input)
+	output, err := conn.GetAWSDefaultServiceQuota(ctx, input)
 
 	if err != nil {
 		return nil, err
@@ -29,45 +33,38 @@ func findServiceQuotaDefaultByID(ctx context.Context, conn *servicequotas.Servic
 	return output.Quota, nil
 }
 
-func findServiceQuotaDefaultByName(ctx context.Context, conn *servicequotas.ServiceQuotas, serviceCode, quotaName string) (*servicequotas.ServiceQuota, error) {
+func findServiceQuotaDefaultByName(ctx context.Context, conn *servicequotas.Client, serviceCode, quotaName string) (*types.ServiceQuota, error) {
 	input := &servicequotas.ListAWSDefaultServiceQuotasInput{
 		ServiceCode: aws.String(serviceCode),
 	}
 
-	var defaultQuota *servicequotas.ServiceQuota
-	err := conn.ListAWSDefaultServiceQuotasPagesWithContext(ctx, input, func(page *servicequotas.ListAWSDefaultServiceQuotasOutput, lastPage bool) bool {
-		if page == nil {
-			return !lastPage
+	paginator := servicequotas.NewListAWSDefaultServiceQuotasPaginator(conn, input)
+	for paginator.HasMorePages() {
+		page, err := paginator.NextPage(ctx)
+		if err != nil {
+			return nil, err
 		}
 
 		for _, q := range page.Quotas {
-			if aws.StringValue(q.QuotaName) == quotaName {
-				defaultQuota = q
-				return false
+			if aws.ToString(q.QuotaName) == quotaName {
+				return &q, nil
 			}
 		}
-
-		return !lastPage
-	})
-	if err != nil {
-		return nil, err
-	}
-	if defaultQuota == nil {
-		return nil, tfresource.NewEmptyResultError(input)
 	}
 
-	return defaultQuota, nil
+	return nil, tfresource.NewEmptyResultError(input)
 }
 
-func findServiceQuotaByID(ctx context.Context, conn *servicequotas.ServiceQuotas, serviceCode, quotaCode string) (*servicequotas.ServiceQuota, error) {
+func findServiceQuotaByID(ctx context.Context, conn *servicequotas.Client, serviceCode, quotaCode string) (*types.ServiceQuota, error) {
 	input := &servicequotas.GetServiceQuotaInput{
 		ServiceCode: aws.String(serviceCode),
 		QuotaCode:   aws.String(quotaCode),
 	}
 
-	output, err := conn.GetServiceQuotaWithContext(ctx, input)
+	output, err := conn.GetServiceQuota(ctx, input)
 
-	if tfawserr.ErrCodeEquals(err, servicequotas.ErrCodeNoSuchResourceException) {
+	var nsr *types.NoSuchResourceException
+	if errors.As(err, &nsr) {
 		return nil, &retry.NotFoundError{
 			LastError:   err,
 			LastRequest: input,
@@ -83,7 +80,7 @@ func findServiceQuotaByID(ctx context.Context, conn *servicequotas.ServiceQuotas
 
 	if output.Quota.ErrorReason != nil {
 		return nil, &retry.NotFoundError{
-			Message:     fmt.Sprintf("%s: %s", aws.StringValue(output.Quota.ErrorReason.ErrorCode), aws.StringValue(output.Quota.ErrorReason.ErrorMessage)),
+			Message:     fmt.Sprintf("%s: %s", output.Quota.ErrorReason.ErrorCode, aws.ToString(output.Quota.ErrorReason.ErrorMessage)),
 			LastRequest: input,
 		}
 	}
diff --git a/internal/service/servicequotas/generate.go b/internal/service/servicequotas/generate.go
index d96bec2fcc5..83f9adc9719 100644
--- a/internal/service/servicequotas/generate.go
+++ b/internal/service/servicequotas/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
 
diff --git a/internal/service/servicequotas/service_data_source.go b/internal/service/servicequotas/service_data_source.go
index 5ef3f05115b..736e8f4f387 100644
--- a/internal/service/servicequotas/service_data_source.go
+++ b/internal/service/servicequotas/service_data_source.go
@@ -1,10 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package servicequotas
 
 import (
 	"context"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/servicequotas"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/servicequotas"
+	"github.com/aws/aws-sdk-go-v2/service/servicequotas/types"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
@@ -31,26 +35,31 @@ func DataSourceService() *schema.Resource {
 
 func dataSourceServiceRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).ServiceQuotasConn(ctx)
+	conn := meta.(*conns.AWSClient).ServiceQuotasClient(ctx)
 
 	serviceName := d.Get("service_name").(string)
 
 	input := &servicequotas.ListServicesInput{}
 
-	var service *servicequotas.ServiceInfo
-	err := conn.ListServicesPagesWithContext(ctx, input, func(page *servicequotas.ListServicesOutput, lastPage bool) bool {
+	var service *types.ServiceInfo
+	paginator := servicequotas.NewListServicesPaginator(conn, input)
+	for paginator.HasMorePages() {
+		page, err := paginator.NextPage(ctx)
+		if err != nil {
+			return sdkdiag.AppendErrorf(diags, "listing Services: %s", err)
+		}
+
 		for _, s := range page.Services {
-			if aws.StringValue(s.ServiceName) == serviceName {
-				service = s
+			s := s
+			if aws.ToString(s.ServiceName) == serviceName {
+				service = &s
 				break
 			}
 		}
 
-		return !lastPage
-	})
-
-	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "listing Services: %s", err)
+		if service != nil {
+			break // stop paging once found
+		}
 	}
 
 	if service == nil {
@@ -59,7 +68,7 @@ func dataSourceServiceRead(ctx context.Context, d *schema.ResourceData, meta int
 
 	d.Set("service_code", service.ServiceCode)
 	d.Set("service_name", service.ServiceName)
-	d.SetId(aws.StringValue(service.ServiceCode))
+	d.SetId(aws.ToString(service.ServiceCode))
 
 	return diags
 }
diff --git a/internal/service/servicequotas/service_data_source_test.go b/internal/service/servicequotas/service_data_source_test.go
index b43ae05719e..f7726560664 100644
--- a/internal/service/servicequotas/service_data_source_test.go
+++ b/internal/service/servicequotas/service_data_source_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package servicequotas_test
 
 import (
 	"fmt"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/service/servicequotas"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
+	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
 func TestAccServiceQuotasServiceDataSource_serviceName(t *testing.T) {
@@ -14,8 +17,11 @@ func TestAccServiceQuotasServiceDataSource_serviceName(t *testing.T) {
 	dataSourceName := "data.aws_servicequotas_service.test"
 
 	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckPartitionHasService(t, servicequotas.EndpointsID) },
-		ErrorCheck:               acctest.ErrorCheck(t, servicequotas.EndpointsID),
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, names.ServiceQuotasEndpointID)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, names.ServiceQuotasEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		Steps: []resource.TestStep{
 			{
diff --git a/internal/service/servicequotas/service_package_gen.go b/internal/service/servicequotas/service_package_gen.go
index 2b2a6943d27..2654bb122e4 100644
--- a/internal/service/servicequotas/service_package_gen.go
+++ b/internal/service/servicequotas/service_package_gen.go
@@ -5,9 +5,9 @@ package servicequotas
 import (
 	"context"
 
-	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
-	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
-	servicequotas_sdkv1 "github.com/aws/aws-sdk-go/service/servicequotas"
+	aws_sdkv2 "github.com/aws/aws-sdk-go-v2/aws"
+	servicequotas_sdkv2 "github.com/aws/aws-sdk-go-v2/service/servicequotas"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -15,11 +15,25 @@ import (
 type servicePackage struct{}
 
 func (p *servicePackage) FrameworkDataSources(ctx context.Context) []*types.ServicePackageFrameworkDataSource {
-	return []*types.ServicePackageFrameworkDataSource{}
+	return []*types.ServicePackageFrameworkDataSource{
+		{
+			Factory: newDataSourceTemplates,
+			Name:    "Templates",
+		},
+	}
 }
 
 func (p *servicePackage) FrameworkResources(ctx context.Context) []*types.ServicePackageFrameworkResource {
-	return []*types.ServicePackageFrameworkResource{}
+	return []*types.ServicePackageFrameworkResource{
+		{
+			Factory: newResourceTemplate,
+			Name:    "Template",
+		},
+		{
+			Factory: newResourceTemplateAssociation,
+			Name:    "Template Association",
+		},
+	}
 }
 
 func (p *servicePackage) SDKDataSources(ctx context.Context) []*types.ServicePackageSDKDataSource {
@@ -48,11 +62,17 @@ func (p *servicePackage) ServicePackageName() string {
 	return names.ServiceQuotas
 }
 
-// NewConn returns a new AWS SDK for Go v1 client for this service package's AWS API.
-func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*servicequotas_sdkv1.ServiceQuotas, error) {
-	sess := config["session"].(*session_sdkv1.Session)
+// NewClient returns a new AWS SDK for Go v2 client for this service package's AWS API.
+func (p *servicePackage) NewClient(ctx context.Context, config map[string]any) (*servicequotas_sdkv2.Client, error) {
+	cfg := *(config["aws_sdkv2_config"].(*aws_sdkv2.Config))
 
-	return servicequotas_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
+	return servicequotas_sdkv2.NewFromConfig(cfg, func(o *servicequotas_sdkv2.Options) {
+		if endpoint := config["endpoint"].(string); endpoint != "" {
+			o.BaseEndpoint = aws_sdkv2.String(endpoint)
+		}
+	}), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/servicequotas/service_quota.go b/internal/service/servicequotas/service_quota.go
index c2ae2f8cc7b..daaac872408 100644
--- a/internal/service/servicequotas/service_quota.go
+++ b/internal/service/servicequotas/service_quota.go
@@ -1,14 +1,18 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package servicequotas
 
 import (
 	"context"
+	"errors"
 	"fmt"
-	"regexp"
 	"strings"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/servicequotas"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/YakDriver/regexache"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/servicequotas"
+	"github.com/aws/aws-sdk-go-v2/service/servicequotas/types"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
@@ -47,8 +51,8 @@ func ResourceServiceQuota() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 128),
-					validation.StringMatch(regexp.MustCompile(`^[a-zA-Z]`), "must begin with alphabetic character"),
-					validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9-]+$`), "must contain only alphanumeric and hyphen characters"),
+					validation.StringMatch(regexache.MustCompile(`^[A-Za-z]`), "must begin with alphabetic character"),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z-]+$`), "must contain only alphanumeric and hyphen characters"),
 				),
 			},
 			"quota_name": {
@@ -69,8 +73,8 @@ func ResourceServiceQuota() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 63),
-					validation.StringMatch(regexp.MustCompile(`^[a-zA-Z]`), "must begin with alphabetic character"),
-					validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9-]+$`), "must contain only alphanumeric and hyphen characters"),
+					validation.StringMatch(regexache.MustCompile(`^[A-Za-z]`), "must begin with alphabetic character"),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z-]+$`), "must contain only alphanumeric and hyphen characters"),
 				),
 			},
 			"service_name": {
@@ -131,7 +135,7 @@ func ResourceServiceQuota() *schema.Resource {
 
 func resourceServiceQuotaCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).ServiceQuotasConn(ctx)
+	conn := meta.(*conns.AWSClient).ServiceQuotasClient(ctx)
 
 	quotaCode := d.Get("quota_code").(string)
 	serviceCode := d.Get("service_code").(string)
@@ -145,14 +149,14 @@ func resourceServiceQuotaCreate(ctx context.Context, d *schema.ResourceData, met
 	if err != nil {
 		return sdkdiag.AppendErrorf(diags, "getting Default Service Quota for (%s/%s): %s", serviceCode, quotaCode, err)
 	}
-	quotaValue := aws.Float64Value(defaultQuota.Value)
+	quotaValue := aws.ToFloat64(defaultQuota.Value)
 
 	serviceQuota, err := findServiceQuotaByID(ctx, conn, serviceCode, quotaCode)
 	if err != nil && !tfresource.NotFound(err) {
 		return sdkdiag.AppendErrorf(diags, "getting Service Quota for (%s/%s): %s", serviceCode, quotaCode, err)
 	}
 	if serviceQuota != nil {
-		quotaValue = aws.Float64Value(serviceQuota.Value)
+		quotaValue = aws.ToFloat64(serviceQuota.Value)
 	}
 
 	if value > quotaValue {
@@ -162,7 +166,7 @@ func resourceServiceQuotaCreate(ctx context.Context, d *schema.ResourceData, met
 			ServiceCode:  aws.String(serviceCode),
 		}
 
-		output, err := conn.RequestServiceQuotaIncreaseWithContext(ctx, input)
+		output, err := conn.RequestServiceQuotaIncrease(ctx, input)
 
 		if err != nil {
 			return sdkdiag.AppendErrorf(diags, "requesting Service Quota (%s) increase: %s", d.Id(), err)
@@ -180,7 +184,7 @@ func resourceServiceQuotaCreate(ctx context.Context, d *schema.ResourceData, met
 
 func resourceServiceQuotaRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).ServiceQuotasConn(ctx)
+	conn := meta.(*conns.AWSClient).ServiceQuotasClient(ctx)
 
 	serviceCode, quotaCode, err := resourceServiceQuotaParseID(d.Id())
 
@@ -225,9 +229,10 @@ func resourceServiceQuotaRead(ctx context.Context, d *schema.ResourceData, meta
 			RequestId: aws.String(requestID),
 		}
 
-		output, err := conn.GetRequestedServiceQuotaChangeWithContext(ctx, input)
+		output, err := conn.GetRequestedServiceQuotaChange(ctx, input)
 
-		if tfawserr.ErrCodeEquals(err, servicequotas.ErrCodeNoSuchResourceException) {
+		var nsr *types.NoSuchResourceException
+		if errors.As(err, &nsr) {
 			d.Set("request_id", "")
 			d.Set("request_status", "")
 			return diags
@@ -241,13 +246,12 @@ func resourceServiceQuotaRead(ctx context.Context, d *schema.ResourceData, meta
 			return sdkdiag.AppendErrorf(diags, "getting Service Quotas Requested Service Quota Change (%s): empty result", requestID)
 		}
 
-		requestStatus := aws.StringValue(output.RequestedQuota.Status)
-		d.Set("request_status", requestStatus)
+		d.Set("request_status", output.RequestedQuota.Status)
 
-		switch requestStatus {
-		case servicequotas.RequestStatusApproved, servicequotas.RequestStatusCaseClosed, servicequotas.RequestStatusDenied:
+		switch output.RequestedQuota.Status {
+		case types.RequestStatusApproved, types.RequestStatusCaseClosed, types.RequestStatusDenied:
 			d.Set("request_id", "")
-		case servicequotas.RequestStatusCaseOpened, servicequotas.RequestStatusPending:
+		case types.RequestStatusCaseOpened, types.RequestStatusPending:
 			d.Set("value", output.RequestedQuota.DesiredValue)
 		}
 	}
@@ -257,7 +261,7 @@ func resourceServiceQuotaRead(ctx context.Context, d *schema.ResourceData, meta
 
 func resourceServiceQuotaUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).ServiceQuotasConn(ctx)
+	conn := meta.(*conns.AWSClient).ServiceQuotasClient(ctx)
 
 	value := d.Get("value").(float64)
 	serviceCode, quotaCode, err := resourceServiceQuotaParseID(d.Id())
@@ -272,7 +276,7 @@ func resourceServiceQuotaUpdate(ctx context.Context, d *schema.ResourceData, met
 		ServiceCode:  aws.String(serviceCode),
 	}
 
-	output, err := conn.RequestServiceQuotaIncreaseWithContext(ctx, input)
+	output, err := conn.RequestServiceQuotaIncrease(ctx, input)
 
 	if err != nil {
 		return sdkdiag.AppendErrorf(diags, "requesting Service Quota (%s) increase: %s", d.Id(), err)
diff --git a/internal/service/servicequotas/service_quota_data_source.go b/internal/service/servicequotas/service_quota_data_source.go
index 428364e6853..6979abe91bf 100644
--- a/internal/service/servicequotas/service_quota_data_source.go
+++ b/internal/service/servicequotas/service_quota_data_source.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package servicequotas
 
 import (
 	"context"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/servicequotas"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/servicequotas/types"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
@@ -106,7 +109,7 @@ func DataSourceServiceQuota() *schema.Resource {
 	}
 }
 
-func flattenUsageMetric(usageMetric *servicequotas.MetricInfo) []interface{} {
+func flattenUsageMetric(usageMetric *types.MetricInfo) []interface{} {
 	if usageMetric == nil {
 		return []interface{}{}
 	}
@@ -114,7 +117,7 @@ func flattenUsageMetric(usageMetric *servicequotas.MetricInfo) []interface{} {
 	var usageMetrics []interface{}
 	var metricDimensions []interface{}
 
-	if usageMetric.MetricDimensions != nil && usageMetric.MetricDimensions["Service"] != nil {
+	if usageMetric.MetricDimensions != nil && usageMetric.MetricDimensions["Service"] != "" {
 		metricDimensions = append(metricDimensions, map[string]interface{}{
 			"service":  usageMetric.MetricDimensions["Service"],
 			"class":    usageMetric.MetricDimensions["Class"],
@@ -137,14 +140,14 @@ func flattenUsageMetric(usageMetric *servicequotas.MetricInfo) []interface{} {
 
 func dataSourceServiceQuotaRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).ServiceQuotasConn(ctx)
+	conn := meta.(*conns.AWSClient).ServiceQuotasClient(ctx)
 
 	quotaCode := d.Get("quota_code").(string)
 	quotaName := d.Get("quota_name").(string)
 	serviceCode := d.Get("service_code").(string)
 
 	var err error
-	var defaultQuota *servicequotas.ServiceQuota
+	var defaultQuota *types.ServiceQuota
 
 	// A Service Quota will always have a default value, but will only have a current value if it has been set.
 	// If it is not set, `GetServiceQuota` will return "NoSuchResourceException"
@@ -154,7 +157,7 @@ func dataSourceServiceQuotaRead(ctx context.Context, d *schema.ResourceData, met
 			return sdkdiag.AppendErrorf(diags, "getting Default Service Quota for (%s/%s): %s", serviceCode, quotaName, err)
 		}
 
-		quotaCode = aws.StringValue(defaultQuota.QuotaCode)
+		quotaCode = aws.ToString(defaultQuota.QuotaCode)
 	} else {
 		defaultQuota, err = findServiceQuotaDefaultByID(ctx, conn, serviceCode, quotaCode)
 		if err != nil {
@@ -162,7 +165,7 @@ func dataSourceServiceQuotaRead(ctx context.Context, d *schema.ResourceData, met
 		}
 	}
 
-	d.SetId(aws.StringValue(defaultQuota.QuotaArn))
+	d.SetId(aws.ToString(defaultQuota.QuotaArn))
 	d.Set("adjustable", defaultQuota.Adjustable)
 	d.Set("arn", defaultQuota.QuotaArn)
 	d.Set("default_value", defaultQuota.Value)
diff --git a/internal/service/servicequotas/service_quota_data_source_test.go b/internal/service/servicequotas/service_quota_data_source_test.go
index f65d3d43344..2fb65c7c358 100644
--- a/internal/service/servicequotas/service_quota_data_source_test.go
+++ b/internal/service/servicequotas/service_quota_data_source_test.go
@@ -1,13 +1,16 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package servicequotas_test
 
 import (
 	"fmt"
-	"regexp"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/service/servicequotas"
+	"github.com/YakDriver/regexache"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
+	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
 func TestAccServiceQuotasServiceQuotaDataSource_quotaCode(t *testing.T) {
@@ -17,10 +20,10 @@ func TestAccServiceQuotasServiceQuotaDataSource_quotaCode(t *testing.T) {
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck: func() {
 			acctest.PreCheck(ctx, t)
-			acctest.PreCheckPartitionHasService(t, servicequotas.EndpointsID)
+			acctest.PreCheckPartitionHasService(t, names.ServiceQuotasEndpointID)
 			preCheckServiceQuotaSet(ctx, setQuotaServiceCode, setQuotaQuotaCode, t)
 		},
-		ErrorCheck:               acctest.ErrorCheck(t, servicequotas.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.ServiceQuotasEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		Steps: []resource.TestStep{
 			{
@@ -35,7 +38,7 @@ func TestAccServiceQuotasServiceQuotaDataSource_quotaCode(t *testing.T) {
 					resource.TestCheckResourceAttr(dataSourceName, "service_code", setQuotaServiceCode),
 					resource.TestCheckResourceAttr(dataSourceName, "service_name", "Amazon Virtual Private Cloud (Amazon VPC)"),
 					resource.TestCheckResourceAttr(dataSourceName, "usage_metric.#", "0"),
-					resource.TestMatchResourceAttr(dataSourceName, "value", regexp.MustCompile(`^\d+$`)),
+					resource.TestMatchResourceAttr(dataSourceName, "value", regexache.MustCompile(`^\d+$`)),
 				),
 			},
 		},
@@ -49,10 +52,10 @@ func TestAccServiceQuotasServiceQuotaDataSource_quotaCode_Unset(t *testing.T) {
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck: func() {
 			acctest.PreCheck(ctx, t)
-			acctest.PreCheckPartitionHasService(t, servicequotas.EndpointsID)
+			acctest.PreCheckPartitionHasService(t, names.ServiceQuotasEndpointID)
 			preCheckServiceQuotaUnset(ctx, unsetQuotaServiceCode, unsetQuotaQuotaCode, t)
 		},
-		ErrorCheck:               acctest.ErrorCheck(t, servicequotas.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.ServiceQuotasEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		Steps: []resource.TestStep{
 			{
@@ -60,14 +63,14 @@ func TestAccServiceQuotasServiceQuotaDataSource_quotaCode_Unset(t *testing.T) {
 				Check: resource.ComposeAggregateTestCheckFunc(
 					acctest.CheckResourceAttrRegionalARNNoAccount(dataSourceName, "arn", "servicequotas", fmt.Sprintf("%s/%s", unsetQuotaServiceCode, unsetQuotaQuotaCode)),
 					resource.TestCheckResourceAttr(dataSourceName, "adjustable", "true"),
-					resource.TestMatchResourceAttr(dataSourceName, "default_value", regexp.MustCompile(`^\d+$`)),
+					resource.TestMatchResourceAttr(dataSourceName, "default_value", regexache.MustCompile(`^\d+$`)),
 					resource.TestCheckResourceAttr(dataSourceName, "global_quota", "false"),
 					resource.TestCheckResourceAttr(dataSourceName, "quota_code", unsetQuotaQuotaCode),
 					resource.TestCheckResourceAttr(dataSourceName, "quota_name", unsetQuotaQuotaName),
 					resource.TestCheckResourceAttr(dataSourceName, "service_code", unsetQuotaServiceCode),
 					resource.TestCheckResourceAttr(dataSourceName, "service_name", "Amazon Simple Storage Service (Amazon S3)"),
 					resource.TestCheckResourceAttr(dataSourceName, "usage_metric.#", "0"),
-					resource.TestMatchResourceAttr(dataSourceName, "value", regexp.MustCompile(`^\d+$`)),
+					resource.TestMatchResourceAttr(dataSourceName, "value", regexache.MustCompile(`^\d+$`)),
 					resource.TestCheckResourceAttrPair(dataSourceName, "value", dataSourceName, "default_value"),
 				),
 			},
@@ -82,10 +85,10 @@ func TestAccServiceQuotasServiceQuotaDataSource_quotaCode_hasUsageMetric(t *test
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck: func() {
 			acctest.PreCheck(ctx, t)
-			acctest.PreCheckPartitionHasService(t, servicequotas.EndpointsID)
+			acctest.PreCheckPartitionHasService(t, names.ServiceQuotasEndpointID)
 			preCheckServiceQuotaHasUsageMetric(ctx, hasUsageMetricServiceCode, hasUsageMetricQuotaCode, t)
 		},
-		ErrorCheck:               acctest.ErrorCheck(t, servicequotas.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.ServiceQuotasEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		Steps: []resource.TestStep{
 			{
@@ -108,7 +111,7 @@ func TestAccServiceQuotasServiceQuotaDataSource_quotaCode_hasUsageMetric(t *test
 					resource.TestCheckResourceAttr(dataSourceName, "usage_metric.0.metric_dimensions.0.class", "None"),
 					resource.TestCheckResourceAttr(dataSourceName, "usage_metric.0.metric_dimensions.0.type", "Resource"),
 					resource.TestCheckResourceAttr(dataSourceName, "usage_metric.0.metric_dimensions.0.resource", "NumberOfAutoScalingGroup"),
-					resource.TestMatchResourceAttr(dataSourceName, "value", regexp.MustCompile(`^\d+$`)),
+					resource.TestMatchResourceAttr(dataSourceName, "value", regexache.MustCompile(`^\d+$`)),
 				),
 			},
 		},
@@ -123,13 +126,13 @@ func TestAccServiceQuotasServiceQuotaDataSource_PermissionError_quotaCode(t *tes
 			testAccPreCheck(ctx, t)
 			acctest.PreCheckAssumeRoleARN(t)
 		},
-		ErrorCheck:               acctest.ErrorCheck(t, servicequotas.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.ServiceQuotasEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             nil,
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccServiceQuotaDataSourceConfig_permissionErrorCode("elasticloadbalancing", "L-53DA6B97"),
-				ExpectError: regexp.MustCompile(`DEPENDENCY_ACCESS_DENIED_ERROR`),
+				ExpectError: regexache.MustCompile(`DEPENDENCY_ACCESS_DENIED_ERROR`),
 			},
 		},
 	})
@@ -142,10 +145,10 @@ func TestAccServiceQuotasServiceQuotaDataSource_quotaName(t *testing.T) {
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck: func() {
 			acctest.PreCheck(ctx, t)
-			acctest.PreCheckPartitionHasService(t, servicequotas.EndpointsID)
+			acctest.PreCheckPartitionHasService(t, names.ServiceQuotasEndpointID)
 			preCheckServiceQuotaSet(ctx, setQuotaServiceCode, setQuotaQuotaCode, t)
 		},
-		ErrorCheck:               acctest.ErrorCheck(t, servicequotas.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.ServiceQuotasEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		Steps: []resource.TestStep{
 			{
@@ -160,7 +163,7 @@ func TestAccServiceQuotasServiceQuotaDataSource_quotaName(t *testing.T) {
 					resource.TestCheckResourceAttr(dataSourceName, "service_code", setQuotaServiceCode),
 					resource.TestCheckResourceAttr(dataSourceName, "service_name", "Amazon Virtual Private Cloud (Amazon VPC)"),
 					resource.TestCheckResourceAttr(dataSourceName, "usage_metric.#", "0"),
-					resource.TestMatchResourceAttr(dataSourceName, "value", regexp.MustCompile(`^\d+$`)),
+					resource.TestMatchResourceAttr(dataSourceName, "value", regexache.MustCompile(`^\d+$`)),
 				),
 			},
 		},
@@ -174,10 +177,10 @@ func TestAccServiceQuotasServiceQuotaDataSource_quotaName_Unset(t *testing.T) {
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck: func() {
 			acctest.PreCheck(ctx, t)
-			acctest.PreCheckPartitionHasService(t, servicequotas.EndpointsID)
+			acctest.PreCheckPartitionHasService(t, names.ServiceQuotasEndpointID)
 			preCheckServiceQuotaUnset(ctx, unsetQuotaServiceCode, unsetQuotaQuotaCode, t)
 		},
-		ErrorCheck:               acctest.ErrorCheck(t, servicequotas.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.ServiceQuotasEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		Steps: []resource.TestStep{
 			{
@@ -185,14 +188,14 @@ func TestAccServiceQuotasServiceQuotaDataSource_quotaName_Unset(t *testing.T) {
 				Check: resource.ComposeAggregateTestCheckFunc(
 					acctest.CheckResourceAttrRegionalARNNoAccount(dataSourceName, "arn", "servicequotas", fmt.Sprintf("%s/%s", unsetQuotaServiceCode, unsetQuotaQuotaCode)),
 					resource.TestCheckResourceAttr(dataSourceName, "adjustable", "true"),
-					resource.TestMatchResourceAttr(dataSourceName, "default_value", regexp.MustCompile(`^\d+$`)),
+					resource.TestMatchResourceAttr(dataSourceName, "default_value", regexache.MustCompile(`^\d+$`)),
 					resource.TestCheckResourceAttr(dataSourceName, "global_quota", "false"),
 					resource.TestCheckResourceAttr(dataSourceName, "quota_code", unsetQuotaQuotaCode),
 					resource.TestCheckResourceAttr(dataSourceName, "quota_name", unsetQuotaQuotaName),
 					resource.TestCheckResourceAttr(dataSourceName, "service_code", unsetQuotaServiceCode),
 					resource.TestCheckResourceAttr(dataSourceName, "service_name", "Amazon Simple Storage Service (Amazon S3)"),
 					resource.TestCheckResourceAttr(dataSourceName, "usage_metric.#", "0"),
-					resource.TestMatchResourceAttr(dataSourceName, "value", regexp.MustCompile(`^\d+$`)),
+					resource.TestMatchResourceAttr(dataSourceName, "value", regexache.MustCompile(`^\d+$`)),
 					resource.TestCheckResourceAttrPair(dataSourceName, "value", dataSourceName, "default_value"),
 				),
 			},
@@ -207,10 +210,10 @@ func TestAccServiceQuotasServiceQuotaDataSource_quotaName_hasUsageMetric(t *test
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck: func() {
 			acctest.PreCheck(ctx, t)
-			acctest.PreCheckPartitionHasService(t, servicequotas.EndpointsID)
+			acctest.PreCheckPartitionHasService(t, names.ServiceQuotasEndpointID)
 			preCheckServiceQuotaHasUsageMetric(ctx, hasUsageMetricServiceCode, hasUsageMetricQuotaCode, t)
 		},
-		ErrorCheck:               acctest.ErrorCheck(t, servicequotas.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.ServiceQuotasEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		Steps: []resource.TestStep{
 			{
@@ -233,7 +236,7 @@ func TestAccServiceQuotasServiceQuotaDataSource_quotaName_hasUsageMetric(t *test
 					resource.TestCheckResourceAttr(dataSourceName, "usage_metric.0.metric_dimensions.0.class", "None"),
 					resource.TestCheckResourceAttr(dataSourceName, "usage_metric.0.metric_dimensions.0.type", "Resource"),
 					resource.TestCheckResourceAttr(dataSourceName, "usage_metric.0.metric_dimensions.0.resource", "NumberOfAutoScalingGroup"),
-					resource.TestMatchResourceAttr(dataSourceName, "value", regexp.MustCompile(`^\d+$`)),
+					resource.TestMatchResourceAttr(dataSourceName, "value", regexache.MustCompile(`^\d+$`)),
 				),
 			},
 		},
@@ -248,13 +251,13 @@ func TestAccServiceQuotasServiceQuotaDataSource_PermissionError_quotaName(t *tes
 			testAccPreCheck(ctx, t)
 			acctest.PreCheckAssumeRoleARN(t)
 		},
-		ErrorCheck:               acctest.ErrorCheck(t, servicequotas.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.ServiceQuotasEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             nil,
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccServiceQuotaDataSourceConfig_permissionErrorName("elasticloadbalancing", "Application Load Balancers per Region"),
-				ExpectError: regexp.MustCompile(`DEPENDENCY_ACCESS_DENIED_ERROR`),
+				ExpectError: regexache.MustCompile(`DEPENDENCY_ACCESS_DENIED_ERROR`),
 			},
 		},
 	})
diff --git a/internal/service/servicequotas/service_quota_test.go b/internal/service/servicequotas/service_quota_test.go
index 82418b119e3..1a62f9a1186 100644
--- a/internal/service/servicequotas/service_quota_test.go
+++ b/internal/service/servicequotas/service_quota_test.go
@@ -1,14 +1,17 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package servicequotas_test
 
 import (
 	"fmt"
 	"os"
-	"regexp"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/service/servicequotas"
+	"github.com/YakDriver/regexache"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
+	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
 // This resource is different than many since quotas are pre-existing
@@ -26,7 +29,7 @@ func TestAccServiceQuotasServiceQuota_basic(t *testing.T) {
 			testAccPreCheck(ctx, t)
 			preCheckServiceQuotaSet(ctx, setQuotaServiceCode, setQuotaQuotaCode, t)
 		},
-		ErrorCheck:               acctest.ErrorCheck(t, servicequotas.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.ServiceQuotasEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             nil,
 		Steps: []resource.TestStep{
@@ -66,7 +69,7 @@ func TestAccServiceQuotasServiceQuota_basic_Unset(t *testing.T) {
 			testAccPreCheck(ctx, t)
 			preCheckServiceQuotaUnset(ctx, unsetQuotaServiceCode, unsetQuotaQuotaCode, t)
 		},
-		ErrorCheck:               acctest.ErrorCheck(t, servicequotas.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.ServiceQuotasEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             nil,
 		Steps: []resource.TestStep{
@@ -106,7 +109,7 @@ func TestAccServiceQuotasServiceQuota_basic_hasUsageMetric(t *testing.T) {
 			testAccPreCheck(ctx, t)
 			preCheckServiceQuotaHasUsageMetric(ctx, hasUsageMetricServiceCode, hasUsageMetricQuotaCode, t)
 		},
-		ErrorCheck:               acctest.ErrorCheck(t, servicequotas.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.ServiceQuotasEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             nil,
 		Steps: []resource.TestStep{
@@ -163,7 +166,7 @@ func TestAccServiceQuotasServiceQuota_Value_increaseOnCreate(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, servicequotas.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.ServiceQuotasEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             nil,
 		Steps: []resource.TestStep{
@@ -208,7 +211,7 @@ func TestAccServiceQuotasServiceQuota_Value_increaseOnUpdate(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, servicequotas.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.ServiceQuotasEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             nil,
 		Steps: []resource.TestStep{
@@ -238,13 +241,13 @@ func TestAccServiceQuotasServiceQuota_permissionError(t *testing.T) {
 	ctx := acctest.Context(t)
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheck(ctx, t); acctest.PreCheckAssumeRoleARN(t) },
-		ErrorCheck:               acctest.ErrorCheck(t, servicequotas.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.ServiceQuotasEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             nil,
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccServiceQuotaConfig_permissionError("elasticloadbalancing", "L-53DA6B97"),
-				ExpectError: regexp.MustCompile(`DEPENDENCY_ACCESS_DENIED_ERROR`),
+				ExpectError: regexache.MustCompile(`DEPENDENCY_ACCESS_DENIED_ERROR`),
 			},
 		},
 	})
diff --git a/internal/service/servicequotas/servicequotas_test.go b/internal/service/servicequotas/servicequotas_test.go
new file mode 100644
index 00000000000..2260e3b994e
--- /dev/null
+++ b/internal/service/servicequotas/servicequotas_test.go
@@ -0,0 +1,32 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package servicequotas_test
+
+import (
+	"testing"
+
+	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
+)
+
+func TestAccServiceQuotas_serial(t *testing.T) {
+	t.Parallel()
+
+	testCases := map[string]map[string]func(t *testing.T){
+		"Template": {
+			"basic":      testAccTemplate_basic,
+			"disappears": testAccTemplate_disappears,
+			"value":      testAccTemplate_value,
+		},
+		"TemplateAssociation": {
+			"basic":       testAccTemplateAssociation_basic,
+			"disappears":  testAccTemplateAssociation_disappears,
+			"skipDestroy": testAccTemplateAssociation_skipDestroy,
+		},
+		"TemplatesDataSource": {
+			"basic": testAccTemplatesDataSource_basic,
+		},
+	}
+
+	acctest.RunSerialTests2Levels(t, testCases, 0)
+}
diff --git a/internal/service/servicequotas/template.go b/internal/service/servicequotas/template.go
new file mode 100644
index 00000000000..482b64dd01d
--- /dev/null
+++ b/internal/service/servicequotas/template.go
@@ -0,0 +1,310 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package servicequotas
+
+import (
+	"context"
+	"errors"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/servicequotas"
+	awstypes "github.com/aws/aws-sdk-go-v2/service/servicequotas/types"
+	"github.com/hashicorp/terraform-plugin-framework/path"
+	"github.com/hashicorp/terraform-plugin-framework/resource"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema/boolplanmodifier"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema/planmodifier"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema/stringplanmodifier"
+	"github.com/hashicorp/terraform-plugin-framework/types"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
+	"github.com/hashicorp/terraform-provider-aws/internal/create"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs"
+	"github.com/hashicorp/terraform-provider-aws/internal/flex"
+	"github.com/hashicorp/terraform-provider-aws/internal/framework"
+	fwflex "github.com/hashicorp/terraform-provider-aws/internal/framework/flex"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/names"
+)
+
+// @FrameworkResource(name="Template")
+func newResourceTemplate(_ context.Context) (resource.ResourceWithConfigure, error) {
+	return &resourceTemplate{}, nil
+}
+
+const (
+	ResNameTemplate     = "Template"
+	templateIDPartCount = 3
+)
+
+type resourceTemplate struct {
+	framework.ResourceWithConfigure
+}
+
+func (r *resourceTemplate) Metadata(_ context.Context, req resource.MetadataRequest, resp *resource.MetadataResponse) {
+	resp.TypeName = "aws_servicequotas_template"
+}
+
+func (r *resourceTemplate) Schema(ctx context.Context, req resource.SchemaRequest, resp *resource.SchemaResponse) {
+	resp.Schema = schema.Schema{
+		Attributes: map[string]schema.Attribute{
+			"global_quota": schema.BoolAttribute{
+				Computed: true,
+				PlanModifiers: []planmodifier.Bool{
+					boolplanmodifier.UseStateForUnknown(),
+				},
+			},
+			"id": framework.IDAttribute(),
+			"quota_code": schema.StringAttribute{
+				Required: true,
+				PlanModifiers: []planmodifier.String{
+					stringplanmodifier.RequiresReplace(),
+				},
+			},
+			"quota_name": schema.StringAttribute{
+				Computed: true,
+				PlanModifiers: []planmodifier.String{
+					stringplanmodifier.UseStateForUnknown(),
+				},
+			},
+			"region": schema.StringAttribute{
+				Required: true,
+				PlanModifiers: []planmodifier.String{
+					stringplanmodifier.RequiresReplace(),
+				},
+			},
+			"service_code": schema.StringAttribute{
+				Required: true,
+				PlanModifiers: []planmodifier.String{
+					stringplanmodifier.RequiresReplace(),
+				},
+			},
+			"service_name": schema.StringAttribute{
+				Computed: true,
+				PlanModifiers: []planmodifier.String{
+					stringplanmodifier.UseStateForUnknown(),
+				},
+			},
+			"unit": schema.StringAttribute{
+				Computed: true,
+				PlanModifiers: []planmodifier.String{
+					stringplanmodifier.UseStateForUnknown(),
+				},
+			},
+			"value": schema.Float64Attribute{
+				Required: true,
+			},
+		},
+	}
+}
+
+func (r *resourceTemplate) Create(ctx context.Context, req resource.CreateRequest, resp *resource.CreateResponse) {
+	conn := r.Meta().ServiceQuotasClient(ctx)
+
+	var plan resourceTemplateData
+	resp.Diagnostics.Append(req.Plan.Get(ctx, &plan)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	region := plan.Region.ValueString()
+	quotaCode := plan.QuotaCode.ValueString()
+	serviceCode := plan.ServiceCode.ValueString()
+
+	parts := []string{region, quotaCode, serviceCode}
+	id, err := flex.FlattenResourceId(parts, templateIDPartCount, false)
+	if err != nil {
+		resp.Diagnostics.AddError(
+			create.ProblemStandardMessage(names.ServiceQuotas, create.ErrActionCreating, ResNameTemplate, id, err),
+			err.Error(),
+		)
+	}
+	plan.ID = fwflex.StringValueToFramework(ctx, id)
+
+	in := &servicequotas.PutServiceQuotaIncreaseRequestIntoTemplateInput{
+		AwsRegion:    aws.String(region),
+		DesiredValue: aws.Float64(plan.Value.ValueFloat64()),
+		QuotaCode:    aws.String(quotaCode),
+		ServiceCode:  aws.String(serviceCode),
+	}
+
+	out, err := conn.PutServiceQuotaIncreaseRequestIntoTemplate(ctx, in)
+	if err != nil {
+		resp.Diagnostics.AddError(
+			create.ProblemStandardMessage(names.ServiceQuotas, create.ErrActionCreating, ResNameTemplate, plan.ID.String(), err),
+			err.Error(),
+		)
+		return
+	}
+	if out == nil || out.ServiceQuotaIncreaseRequestInTemplate == nil {
+		resp.Diagnostics.AddError(
+			create.ProblemStandardMessage(names.ServiceQuotas, create.ErrActionCreating, ResNameTemplate, plan.ID.String(), nil),
+			errors.New("empty output").Error(),
+		)
+		return
+	}
+
+	templateItem := out.ServiceQuotaIncreaseRequestInTemplate
+	plan.GlobalQuota = types.BoolValue(templateItem.GlobalQuota)
+	plan.QuotaName = fwflex.StringToFramework(ctx, templateItem.QuotaName)
+	plan.ServiceName = fwflex.StringToFramework(ctx, templateItem.ServiceName)
+	plan.Unit = fwflex.StringToFramework(ctx, templateItem.Unit)
+
+	resp.Diagnostics.Append(resp.State.Set(ctx, plan)...)
+}
+
+func (r *resourceTemplate) Read(ctx context.Context, req resource.ReadRequest, resp *resource.ReadResponse) {
+	conn := r.Meta().ServiceQuotasClient(ctx)
+
+	var state resourceTemplateData
+	resp.Diagnostics.Append(req.State.Get(ctx, &state)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	out, err := FindTemplateByID(ctx, conn, state.ID.ValueString())
+	if tfresource.NotFound(err) {
+		resp.State.RemoveResource(ctx)
+		return
+	}
+	if err != nil {
+		resp.Diagnostics.AddError(
+			create.ProblemStandardMessage(names.ServiceQuotas, create.ErrActionSetting, ResNameTemplate, state.ID.String(), err),
+			err.Error(),
+		)
+		return
+	}
+
+	state.GlobalQuota = types.BoolValue(out.GlobalQuota)
+	state.QuotaCode = fwflex.StringToFramework(ctx, out.QuotaCode)
+	state.QuotaName = fwflex.StringToFramework(ctx, out.QuotaName)
+	state.Region = fwflex.StringToFramework(ctx, out.AwsRegion)
+	state.ServiceCode = fwflex.StringToFramework(ctx, out.ServiceCode)
+	state.ServiceName = fwflex.StringToFramework(ctx, out.ServiceName)
+	state.Unit = fwflex.StringToFramework(ctx, out.Unit)
+	state.Value = fwflex.Float64ToFramework(ctx, out.DesiredValue)
+
+	resp.Diagnostics.Append(resp.State.Set(ctx, &state)...)
+}
+
+func (r *resourceTemplate) Update(ctx context.Context, req resource.UpdateRequest, resp *resource.UpdateResponse) {
+	conn := r.Meta().ServiceQuotasClient(ctx)
+
+	var state, plan resourceTemplateData
+	resp.Diagnostics.Append(req.State.Get(ctx, &state)...)
+	resp.Diagnostics.Append(req.Plan.Get(ctx, &plan)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	if !plan.Value.Equal(state.Value) {
+		in := &servicequotas.PutServiceQuotaIncreaseRequestIntoTemplateInput{
+			AwsRegion:    aws.String(plan.Region.ValueString()),
+			DesiredValue: aws.Float64(plan.Value.ValueFloat64()),
+			QuotaCode:    aws.String(plan.QuotaCode.ValueString()),
+			ServiceCode:  aws.String(plan.ServiceCode.ValueString()),
+		}
+
+		out, err := conn.PutServiceQuotaIncreaseRequestIntoTemplate(ctx, in)
+		if err != nil {
+			resp.Diagnostics.AddError(
+				create.ProblemStandardMessage(names.ServiceQuotas, create.ErrActionUpdating, ResNameTemplate, plan.ID.String(), err),
+				err.Error(),
+			)
+			return
+		}
+		if out == nil || out.ServiceQuotaIncreaseRequestInTemplate == nil {
+			resp.Diagnostics.AddError(
+				create.ProblemStandardMessage(names.ServiceQuotas, create.ErrActionUpdating, ResNameTemplate, plan.ID.String(), nil),
+				errors.New("empty output").Error(),
+			)
+			return
+		}
+
+		templateItem := out.ServiceQuotaIncreaseRequestInTemplate
+		plan.GlobalQuota = types.BoolValue(templateItem.GlobalQuota)
+		plan.QuotaName = fwflex.StringToFramework(ctx, templateItem.QuotaName)
+		plan.ServiceName = fwflex.StringToFramework(ctx, templateItem.ServiceName)
+		plan.Unit = fwflex.StringToFramework(ctx, templateItem.Unit)
+
+		resp.Diagnostics.Append(resp.State.Set(ctx, plan)...)
+	}
+}
+
+func (r *resourceTemplate) Delete(ctx context.Context, req resource.DeleteRequest, resp *resource.DeleteResponse) {
+	conn := r.Meta().ServiceQuotasClient(ctx)
+
+	var state resourceTemplateData
+	resp.Diagnostics.Append(req.State.Get(ctx, &state)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	in := &servicequotas.DeleteServiceQuotaIncreaseRequestFromTemplateInput{
+		AwsRegion:   aws.String(state.Region.ValueString()),
+		QuotaCode:   aws.String(state.QuotaCode.ValueString()),
+		ServiceCode: aws.String(state.ServiceCode.ValueString()),
+	}
+
+	_, err := conn.DeleteServiceQuotaIncreaseRequestFromTemplate(ctx, in)
+	if err != nil {
+		if errs.IsA[*awstypes.NoSuchResourceException](err) {
+			return
+		}
+		resp.Diagnostics.AddError(
+			create.ProblemStandardMessage(names.ServiceQuotas, create.ErrActionDeleting, ResNameTemplate, state.ID.String(), err),
+			err.Error(),
+		)
+		return
+	}
+}
+
+func (r *resourceTemplate) ImportState(ctx context.Context, req resource.ImportStateRequest, resp *resource.ImportStateResponse) {
+	resource.ImportStatePassthroughID(ctx, path.Root("id"), req, resp)
+}
+
+func FindTemplateByID(ctx context.Context, conn *servicequotas.Client, id string) (*awstypes.ServiceQuotaIncreaseRequestInTemplate, error) {
+	parts, err := flex.ExpandResourceId(id, templateIDPartCount, false)
+	if err != nil {
+		return nil, err
+	}
+	region := parts[0]
+	quotaCode := parts[1]
+	serviceCode := parts[2]
+
+	in := &servicequotas.GetServiceQuotaIncreaseRequestFromTemplateInput{
+		AwsRegion:   aws.String(region),
+		QuotaCode:   aws.String(quotaCode),
+		ServiceCode: aws.String(serviceCode),
+	}
+
+	out, err := conn.GetServiceQuotaIncreaseRequestFromTemplate(ctx, in)
+	if err != nil {
+		if errs.IsA[*awstypes.NoSuchResourceException](err) {
+			return nil, &retry.NotFoundError{
+				LastError:   err,
+				LastRequest: in,
+			}
+		}
+
+		return nil, err
+	}
+
+	if out == nil || out.ServiceQuotaIncreaseRequestInTemplate == nil {
+		return nil, tfresource.NewEmptyResultError(in)
+	}
+
+	return out.ServiceQuotaIncreaseRequestInTemplate, nil
+}
+
+type resourceTemplateData struct {
+	GlobalQuota types.Bool    `tfsdk:"global_quota"`
+	ID          types.String  `tfsdk:"id"`
+	QuotaCode   types.String  `tfsdk:"quota_code"`
+	QuotaName   types.String  `tfsdk:"quota_name"`
+	Region      types.String  `tfsdk:"region"`
+	ServiceCode types.String  `tfsdk:"service_code"`
+	ServiceName types.String  `tfsdk:"service_name"`
+	Unit        types.String  `tfsdk:"unit"`
+	Value       types.Float64 `tfsdk:"value"`
+}
diff --git a/internal/service/servicequotas/template_association.go b/internal/service/servicequotas/template_association.go
new file mode 100644
index 00000000000..5ef2471a4c8
--- /dev/null
+++ b/internal/service/servicequotas/template_association.go
@@ -0,0 +1,149 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package servicequotas
+
+import (
+	"context"
+
+	"github.com/aws/aws-sdk-go-v2/service/servicequotas"
+	awstypes "github.com/aws/aws-sdk-go-v2/service/servicequotas/types"
+	"github.com/hashicorp/terraform-plugin-framework/path"
+	"github.com/hashicorp/terraform-plugin-framework/resource"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema"
+	"github.com/hashicorp/terraform-plugin-framework/types"
+	"github.com/hashicorp/terraform-provider-aws/internal/create"
+	"github.com/hashicorp/terraform-provider-aws/internal/framework"
+	"github.com/hashicorp/terraform-provider-aws/internal/framework/flex"
+	"github.com/hashicorp/terraform-provider-aws/names"
+)
+
+// @FrameworkResource(name="Template Association")
+func newResourceTemplateAssociation(_ context.Context) (resource.ResourceWithConfigure, error) {
+	return &resourceTemplateAssociation{}, nil
+}
+
+const (
+	ResNameTemplateAssociation = "Template Association"
+)
+
+type resourceTemplateAssociation struct {
+	framework.ResourceWithConfigure
+}
+
+func (r *resourceTemplateAssociation) Metadata(_ context.Context, req resource.MetadataRequest, resp *resource.MetadataResponse) {
+	resp.TypeName = "aws_servicequotas_template_association"
+}
+
+func (r *resourceTemplateAssociation) Schema(ctx context.Context, req resource.SchemaRequest, resp *resource.SchemaResponse) {
+	resp.Schema = schema.Schema{
+		Attributes: map[string]schema.Attribute{
+			"id": framework.IDAttribute(),
+			"skip_destroy": schema.BoolAttribute{
+				Optional: true,
+			},
+			"status": schema.StringAttribute{
+				Computed: true,
+			},
+		},
+	}
+}
+
+func (r *resourceTemplateAssociation) Create(ctx context.Context, req resource.CreateRequest, resp *resource.CreateResponse) {
+	conn := r.Meta().ServiceQuotasClient(ctx)
+
+	var plan resourceTemplateAssociationData
+	resp.Diagnostics.Append(req.Plan.Get(ctx, &plan)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	plan.ID = types.StringValue(r.Meta().AccountID)
+
+	_, err := conn.AssociateServiceQuotaTemplate(ctx, &servicequotas.AssociateServiceQuotaTemplateInput{})
+	if err != nil {
+		resp.Diagnostics.AddError(
+			create.ProblemStandardMessage(names.ServiceQuotas, create.ErrActionCreating, ResNameTemplateAssociation, plan.ID.String(), err),
+			err.Error(),
+		)
+		return
+	}
+
+	// Status is not returned from Associate API, so call Get to get computed value
+	out, err := conn.GetAssociationForServiceQuotaTemplate(ctx, &servicequotas.GetAssociationForServiceQuotaTemplateInput{})
+	if err != nil {
+		resp.Diagnostics.AddError(
+			create.ProblemStandardMessage(names.ServiceQuotas, create.ErrActionCreating, ResNameTemplateAssociation, plan.ID.String(), err),
+			err.Error(),
+		)
+		return
+	}
+
+	plan.Status = flex.StringValueToFramework(ctx, string(out.ServiceQuotaTemplateAssociationStatus))
+
+	resp.Diagnostics.Append(resp.State.Set(ctx, plan)...)
+}
+
+func (r *resourceTemplateAssociation) Read(ctx context.Context, req resource.ReadRequest, resp *resource.ReadResponse) {
+	conn := r.Meta().ServiceQuotasClient(ctx)
+
+	var state resourceTemplateAssociationData
+	resp.Diagnostics.Append(req.State.Get(ctx, &state)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	out, err := conn.GetAssociationForServiceQuotaTemplate(ctx, &servicequotas.GetAssociationForServiceQuotaTemplateInput{})
+	if out == nil || out.ServiceQuotaTemplateAssociationStatus == awstypes.ServiceQuotaTemplateAssociationStatusDisassociated {
+		resp.State.RemoveResource(ctx)
+		return
+	}
+	if err != nil {
+		resp.Diagnostics.AddError(
+			create.ProblemStandardMessage(names.ServiceQuotas, create.ErrActionSetting, ResNameTemplateAssociation, state.ID.String(), err),
+			err.Error(),
+		)
+		return
+	}
+
+	state.Status = flex.StringValueToFramework(ctx, string(out.ServiceQuotaTemplateAssociationStatus))
+
+	resp.Diagnostics.Append(resp.State.Set(ctx, &state)...)
+}
+
+// Update is a no-op
+func (r *resourceTemplateAssociation) Update(ctx context.Context, req resource.UpdateRequest, resp *resource.UpdateResponse) {
+}
+
+func (r *resourceTemplateAssociation) Delete(ctx context.Context, req resource.DeleteRequest, resp *resource.DeleteResponse) {
+	conn := r.Meta().ServiceQuotasClient(ctx)
+
+	var state resourceTemplateAssociationData
+	resp.Diagnostics.Append(req.State.Get(ctx, &state)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	if state.SkipDestroy.ValueBool() {
+		return
+	}
+
+	_, err := conn.DisassociateServiceQuotaTemplate(ctx, &servicequotas.DisassociateServiceQuotaTemplateInput{})
+	if err != nil {
+		resp.Diagnostics.AddError(
+			create.ProblemStandardMessage(names.ServiceQuotas, create.ErrActionDeleting, ResNameTemplateAssociation, state.ID.String(), err),
+			err.Error(),
+		)
+		return
+	}
+}
+
+func (r *resourceTemplateAssociation) ImportState(ctx context.Context, req resource.ImportStateRequest, resp *resource.ImportStateResponse) {
+	resource.ImportStatePassthroughID(ctx, path.Root("id"), req, resp)
+}
+
+type resourceTemplateAssociationData struct {
+	ID          types.String `tfsdk:"id"`
+	SkipDestroy types.Bool   `tfsdk:"skip_destroy"`
+	Status      types.String `tfsdk:"status"`
+}
diff --git a/internal/service/servicequotas/template_association_test.go b/internal/service/servicequotas/template_association_test.go
new file mode 100644
index 00000000000..fae307b7f00
--- /dev/null
+++ b/internal/service/servicequotas/template_association_test.go
@@ -0,0 +1,209 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package servicequotas_test
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"testing"
+
+	"github.com/aws/aws-sdk-go-v2/service/servicequotas"
+	"github.com/aws/aws-sdk-go-v2/service/servicequotas/types"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
+	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/create"
+	tfservicequotas "github.com/hashicorp/terraform-provider-aws/internal/service/servicequotas"
+	"github.com/hashicorp/terraform-provider-aws/names"
+)
+
+func testAccTemplateAssociation_basic(t *testing.T) {
+	ctx := acctest.Context(t)
+	resourceName := "aws_servicequotas_template_association.test"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckRegion(t, names.USEast1RegionID)
+			acctest.PreCheckPartitionHasService(t, names.ServiceQuotasEndpointID)
+			testAccPreCheckTemplate(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, names.ServiceQuotasEndpointID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckTemplateAssociationDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccTemplateAssociationConfig_basic(),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckTemplateAssociationExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "status", string(types.ServiceQuotaTemplateAssociationStatusAssociated)),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
+func testAccTemplateAssociation_disappears(t *testing.T) {
+	ctx := acctest.Context(t)
+	resourceName := "aws_servicequotas_template_association.test"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckRegion(t, names.USEast1RegionID)
+			acctest.PreCheckPartitionHasService(t, names.ServiceQuotasEndpointID)
+			testAccPreCheckTemplate(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, names.ServiceQuotasEndpointID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckTemplateAssociationDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccTemplateAssociationConfig_basic(),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckTemplateAssociationExists(ctx, resourceName),
+					acctest.CheckFrameworkResourceDisappears(ctx, acctest.Provider, tfservicequotas.ResourceTemplateAssociation, resourceName),
+				),
+				ExpectNonEmptyPlan: true,
+			},
+		},
+	})
+}
+
+func testAccTemplateAssociation_skipDestroy(t *testing.T) {
+	ctx := acctest.Context(t)
+	resourceName := "aws_servicequotas_template_association.test"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckRegion(t, names.USEast1RegionID)
+			acctest.PreCheckPartitionHasService(t, names.ServiceQuotasEndpointID)
+			testAccPreCheckTemplate(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, names.ServiceQuotasEndpointID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckTemplateAssociationDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccTemplateAssociationConfig_skipDestroy(),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckTemplateAssociationExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "status", string(types.ServiceQuotaTemplateAssociationStatusAssociated)),
+				),
+			},
+			{
+				// aws_servicequotas_template_association resource is removed from config
+				Config: testAccTemplateConfig_basic(lambdaENIQuotaCode, lambdaServiceCode, lambdaENIValue),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckTemplateAssociationAssociated(ctx), // verify association is still live on the remote
+				),
+			},
+			{
+				// Use the basic config to remove association on destroy
+				Config: testAccTemplateAssociationConfig_basic(),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckTemplateAssociationExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "status", string(types.ServiceQuotaTemplateAssociationStatusAssociated)),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckTemplateAssociationDestroy(ctx context.Context) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		conn := acctest.Provider.Meta().(*conns.AWSClient).ServiceQuotasClient(ctx)
+
+		for _, rs := range s.RootModule().Resources {
+			if rs.Type != "aws_servicequotas_template_association" {
+				continue
+			}
+
+			out, err := conn.GetAssociationForServiceQuotaTemplate(ctx, &servicequotas.GetAssociationForServiceQuotaTemplateInput{})
+			if out != nil && out.ServiceQuotaTemplateAssociationStatus == types.ServiceQuotaTemplateAssociationStatusDisassociated {
+				return nil
+			}
+			if err != nil {
+				return create.Error(names.ServiceQuotas, create.ErrActionCheckingDestroyed, tfservicequotas.ResNameTemplateAssociation, rs.Primary.ID, err)
+			}
+
+			return create.Error(names.ServiceQuotas, create.ErrActionCheckingDestroyed, tfservicequotas.ResNameTemplateAssociation, rs.Primary.ID, errors.New("not destroyed"))
+		}
+
+		return nil
+	}
+}
+
+func testAccCheckTemplateAssociationExists(ctx context.Context, name string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[name]
+		if !ok {
+			return create.Error(names.ServiceQuotas, create.ErrActionCheckingExistence, tfservicequotas.ResNameTemplateAssociation, name, errors.New("not found"))
+		}
+
+		if rs.Primary.ID == "" {
+			return create.Error(names.ServiceQuotas, create.ErrActionCheckingExistence, tfservicequotas.ResNameTemplateAssociation, name, errors.New("not set"))
+		}
+
+		conn := acctest.Provider.Meta().(*conns.AWSClient).ServiceQuotasClient(ctx)
+		out, err := conn.GetAssociationForServiceQuotaTemplate(ctx, &servicequotas.GetAssociationForServiceQuotaTemplateInput{})
+		if err != nil {
+			return create.Error(names.ServiceQuotas, create.ErrActionCheckingExistence, tfservicequotas.ResNameTemplateAssociation, rs.Primary.ID, err)
+		}
+		if out != nil && out.ServiceQuotaTemplateAssociationStatus == types.ServiceQuotaTemplateAssociationStatusDisassociated {
+			return create.Error(names.ServiceQuotas, create.ErrActionCheckingExistence, tfservicequotas.ResNameTemplateAssociation, rs.Primary.ID, fmt.Errorf("unexpected status: %s", out.ServiceQuotaTemplateAssociationStatus))
+		}
+
+		return nil
+	}
+}
+
+// testAccCheckTemplateAssociationAssociated is a helper function for verifying a
+// template association remains in place when the skip_destroy argument is set to true
+// and the association resource is removed
+func testAccCheckTemplateAssociationAssociated(ctx context.Context) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		conn := acctest.Provider.Meta().(*conns.AWSClient).ServiceQuotasClient(ctx)
+
+		out, err := conn.GetAssociationForServiceQuotaTemplate(ctx, &servicequotas.GetAssociationForServiceQuotaTemplateInput{})
+		if err != nil {
+			return create.Error(names.ServiceQuotas, create.ErrActionCheckingExistence, tfservicequotas.ResNameTemplateAssociation, "", err)
+		}
+		if out == nil || out.ServiceQuotaTemplateAssociationStatus != types.ServiceQuotaTemplateAssociationStatusAssociated {
+			return create.Error(names.ServiceQuotas, create.ErrActionCheckingExistence, tfservicequotas.ResNameTemplateAssociation, "", fmt.Errorf("unexpected status: %s", out.ServiceQuotaTemplateAssociationStatus))
+		}
+
+		return nil
+	}
+}
+
+func testAccTemplateAssociationConfig_basic() string {
+	return acctest.ConfigCompose(
+		testAccTemplateConfig_basic(lambdaENIQuotaCode, lambdaServiceCode, lambdaENIValue),
+		`
+resource "aws_servicequotas_template_association" "test" {
+  depends_on = ["aws_servicequotas_template.test"]
+}
+`)
+}
+
+func testAccTemplateAssociationConfig_skipDestroy() string {
+	return acctest.ConfigCompose(
+		testAccTemplateConfig_basic(lambdaENIQuotaCode, lambdaServiceCode, lambdaENIValue),
+		`
+resource "aws_servicequotas_template_association" "test" {
+  depends_on = ["aws_servicequotas_template.test"]
+
+  skip_destroy = true
+}
+`)
+}
diff --git a/internal/service/servicequotas/template_test.go b/internal/service/servicequotas/template_test.go
new file mode 100644
index 00000000000..ae38be53bba
--- /dev/null
+++ b/internal/service/servicequotas/template_test.go
@@ -0,0 +1,224 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package servicequotas_test
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"testing"
+
+	"github.com/aws/aws-sdk-go-v2/service/servicequotas"
+	"github.com/aws/aws-sdk-go-v2/service/servicequotas/types"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
+	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/create"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs"
+	tfservicequotas "github.com/hashicorp/terraform-provider-aws/internal/service/servicequotas"
+	"github.com/hashicorp/terraform-provider-aws/names"
+)
+
+const (
+	lambdaServiceCode = "lambda"
+
+	lambdaStorageQuotaCode = "L-2ACBD22F" // Function and layer storage
+	lambdaStorageValue     = "80"         // Default is 75 GB
+
+	lambdaConcurrentExecQuotaCode = "L-B99A9384" // Concurrent executions
+	lambdaConcurrentExecValue     = "1500"       // Default is 1000
+
+	lambdaENIQuotaCode    = "L-9FEE3D26" // Elastic network interfaces per VPC
+	lambdaENIValue        = "275"        // Default is 250
+	lambdaENIValueUpdated = "300"        // Default is 250
+)
+
+func testAccTemplate_basic(t *testing.T) {
+	ctx := acctest.Context(t)
+	var template types.ServiceQuotaIncreaseRequestInTemplate
+	resourceName := "aws_servicequotas_template.test"
+	regionDataSourceName := "data.aws_region.current"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckRegion(t, names.USEast1RegionID)
+			acctest.PreCheckPartitionHasService(t, names.ServiceQuotasEndpointID)
+			testAccPreCheckTemplate(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, names.ServiceQuotasEndpointID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckTemplateDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccTemplateConfig_basic(lambdaStorageQuotaCode, lambdaServiceCode, lambdaStorageValue),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckTemplateExists(ctx, resourceName, &template),
+					resource.TestCheckResourceAttrPair(resourceName, "region", regionDataSourceName, "name"),
+					resource.TestCheckResourceAttr(resourceName, "quota_code", lambdaStorageQuotaCode),
+					resource.TestCheckResourceAttr(resourceName, "service_code", lambdaServiceCode),
+					resource.TestCheckResourceAttr(resourceName, "value", lambdaStorageValue),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
+func testAccTemplate_disappears(t *testing.T) {
+	ctx := acctest.Context(t)
+	var template types.ServiceQuotaIncreaseRequestInTemplate
+	resourceName := "aws_servicequotas_template.test"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckRegion(t, names.USEast1RegionID)
+			acctest.PreCheckPartitionHasService(t, names.ServiceQuotasEndpointID)
+			testAccPreCheckTemplate(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, names.ServiceQuotasEndpointID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckTemplateDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccTemplateConfig_basic(lambdaConcurrentExecQuotaCode, lambdaServiceCode, lambdaConcurrentExecValue),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckTemplateExists(ctx, resourceName, &template),
+					acctest.CheckFrameworkResourceDisappears(ctx, acctest.Provider, tfservicequotas.ResourceTemplate, resourceName),
+				),
+				ExpectNonEmptyPlan: true,
+			},
+		},
+	})
+}
+
+func testAccTemplate_value(t *testing.T) {
+	ctx := acctest.Context(t)
+	var template types.ServiceQuotaIncreaseRequestInTemplate
+	resourceName := "aws_servicequotas_template.test"
+	regionDataSourceName := "data.aws_region.current"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckRegion(t, names.USEast1RegionID)
+			acctest.PreCheckPartitionHasService(t, names.ServiceQuotasEndpointID)
+			testAccPreCheckTemplate(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, names.ServiceQuotasEndpointID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckTemplateDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccTemplateConfig_basic(lambdaENIQuotaCode, lambdaServiceCode, lambdaENIValue),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckTemplateExists(ctx, resourceName, &template),
+					resource.TestCheckResourceAttrPair(resourceName, "region", regionDataSourceName, "name"),
+					resource.TestCheckResourceAttr(resourceName, "quota_code", lambdaENIQuotaCode),
+					resource.TestCheckResourceAttr(resourceName, "service_code", lambdaServiceCode),
+					resource.TestCheckResourceAttr(resourceName, "value", lambdaENIValue),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				Config: testAccTemplateConfig_basic(lambdaENIQuotaCode, lambdaServiceCode, lambdaENIValueUpdated),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckTemplateExists(ctx, resourceName, &template),
+					resource.TestCheckResourceAttrPair(resourceName, "region", regionDataSourceName, "name"),
+					resource.TestCheckResourceAttr(resourceName, "quota_code", lambdaENIQuotaCode),
+					resource.TestCheckResourceAttr(resourceName, "service_code", lambdaServiceCode),
+					resource.TestCheckResourceAttr(resourceName, "value", lambdaENIValueUpdated),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckTemplateDestroy(ctx context.Context) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		conn := acctest.Provider.Meta().(*conns.AWSClient).ServiceQuotasClient(ctx)
+
+		for _, rs := range s.RootModule().Resources {
+			if rs.Type != "aws_servicequotas_template" {
+				continue
+			}
+
+			_, err := tfservicequotas.FindTemplateByID(ctx, conn, rs.Primary.ID)
+			if errs.IsA[*types.NoSuchResourceException](err) {
+				return nil
+			}
+			if err != nil {
+				return create.Error(names.ServiceQuotas, create.ErrActionCheckingDestroyed, tfservicequotas.ResNameTemplate, rs.Primary.ID, err)
+			}
+
+			return create.Error(names.ServiceQuotas, create.ErrActionCheckingDestroyed, tfservicequotas.ResNameTemplate, rs.Primary.ID, errors.New("not destroyed"))
+		}
+
+		return nil
+	}
+}
+
+func testAccCheckTemplateExists(ctx context.Context, name string, template *types.ServiceQuotaIncreaseRequestInTemplate) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[name]
+		if !ok {
+			return create.Error(names.ServiceQuotas, create.ErrActionCheckingExistence, tfservicequotas.ResNameTemplate, name, errors.New("not found"))
+		}
+
+		if rs.Primary.ID == "" {
+			return create.Error(names.ServiceQuotas, create.ErrActionCheckingExistence, tfservicequotas.ResNameTemplate, name, errors.New("not set"))
+		}
+
+		conn := acctest.Provider.Meta().(*conns.AWSClient).ServiceQuotasClient(ctx)
+		resp, err := tfservicequotas.FindTemplateByID(ctx, conn, rs.Primary.ID)
+		if err != nil {
+			return create.Error(names.ServiceQuotas, create.ErrActionCheckingExistence, tfservicequotas.ResNameTemplate, rs.Primary.ID, err)
+		}
+
+		*template = *resp
+
+		return nil
+	}
+}
+
+func testAccPreCheckTemplate(ctx context.Context, t *testing.T) {
+	conn := acctest.Provider.Meta().(*conns.AWSClient).ServiceQuotasClient(ctx)
+
+	input := &servicequotas.ListServiceQuotaIncreaseRequestsInTemplateInput{}
+	_, err := conn.ListServiceQuotaIncreaseRequestsInTemplate(ctx, input)
+
+	// Request must come from organization owner account
+	if errs.IsAErrorMessageContains[*types.AccessDeniedException](err, "The request was called by a member account.") {
+		t.Skipf("skipping acceptance testing: %s", err)
+	}
+	if acctest.PreCheckSkipError(err) {
+		t.Skipf("skipping acceptance testing: %s", err)
+	}
+	if err != nil {
+		t.Fatalf("unexpected PreCheck error: %s", err)
+	}
+}
+
+func testAccTemplateConfig_basic(quotaCode, serviceCode, value string) string {
+	return fmt.Sprintf(`
+data "aws_region" "current" {}
+
+resource "aws_servicequotas_template" "test" {
+  region       = data.aws_region.current.name
+  quota_code   = %[1]q
+  service_code = %[2]q
+  value        = %[3]s
+}
+`, quotaCode, serviceCode, value)
+}
diff --git a/internal/service/servicequotas/templates_data_source.go b/internal/service/servicequotas/templates_data_source.go
new file mode 100644
index 00000000000..149068a1ebd
--- /dev/null
+++ b/internal/service/servicequotas/templates_data_source.go
@@ -0,0 +1,155 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package servicequotas
+
+import (
+	"context"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/servicequotas"
+	awstypes "github.com/aws/aws-sdk-go-v2/service/servicequotas/types"
+	"github.com/hashicorp/terraform-plugin-framework/attr"
+	"github.com/hashicorp/terraform-plugin-framework/datasource"
+	"github.com/hashicorp/terraform-plugin-framework/datasource/schema"
+	"github.com/hashicorp/terraform-plugin-framework/diag"
+	"github.com/hashicorp/terraform-plugin-framework/types"
+	"github.com/hashicorp/terraform-provider-aws/internal/create"
+	"github.com/hashicorp/terraform-provider-aws/internal/framework"
+	"github.com/hashicorp/terraform-provider-aws/internal/framework/flex"
+	"github.com/hashicorp/terraform-provider-aws/names"
+)
+
+// @FrameworkDataSource(name="Templates")
+func newDataSourceTemplates(context.Context) (datasource.DataSourceWithConfigure, error) {
+	return &dataSourceTemplates{}, nil
+}
+
+const (
+	DSNameTemplates = "Templates Data Source"
+)
+
+type dataSourceTemplates struct {
+	framework.DataSourceWithConfigure
+}
+
+func (d *dataSourceTemplates) Metadata(_ context.Context, req datasource.MetadataRequest, resp *datasource.MetadataResponse) { // nosemgrep:ci.meta-in-func-name
+	resp.TypeName = "aws_servicequotas_templates"
+}
+
+func (d *dataSourceTemplates) Schema(ctx context.Context, req datasource.SchemaRequest, resp *datasource.SchemaResponse) {
+	resp.Schema = schema.Schema{
+		Attributes: map[string]schema.Attribute{
+			"id": framework.IDAttribute(),
+			"region": schema.StringAttribute{
+				Required: true,
+			},
+		},
+		Blocks: map[string]schema.Block{
+			"templates": schema.ListNestedBlock{
+				NestedObject: schema.NestedBlockObject{
+					Attributes: map[string]schema.Attribute{
+						"global_quota": schema.BoolAttribute{
+							Computed: true,
+						},
+						"quota_code": schema.StringAttribute{
+							Computed: true,
+						},
+						"quota_name": schema.StringAttribute{
+							Computed: true,
+						},
+						"region": schema.StringAttribute{
+							Computed: true,
+						},
+						"service_code": schema.StringAttribute{
+							Computed: true,
+						},
+						"service_name": schema.StringAttribute{
+							Computed: true,
+						},
+						"unit": schema.StringAttribute{
+							Computed: true,
+						},
+						"value": schema.Float64Attribute{
+							Computed: true,
+						},
+					},
+				},
+			},
+		},
+	}
+}
+
+func (d *dataSourceTemplates) Read(ctx context.Context, req datasource.ReadRequest, resp *datasource.ReadResponse) {
+	conn := d.Meta().ServiceQuotasClient(ctx)
+
+	var data dataSourceTemplatesData
+	resp.Diagnostics.Append(req.Config.Get(ctx, &data)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	input := servicequotas.ListServiceQuotaIncreaseRequestsInTemplateInput{
+		AwsRegion: aws.String(data.Region.ValueString()),
+	}
+	out, err := conn.ListServiceQuotaIncreaseRequestsInTemplate(ctx, &input)
+	if err != nil {
+		resp.Diagnostics.AddError(
+			create.ProblemStandardMessage(names.ServiceQuotas, create.ErrActionReading, DSNameTemplates, data.Region.String(), err),
+			err.Error(),
+		)
+		return
+	}
+
+	data.ID = types.StringValue(data.Region.ValueString())
+
+	templates, diags := flattenTemplates(ctx, out.ServiceQuotaIncreaseRequestInTemplateList)
+	resp.Diagnostics.Append(diags...)
+	data.Templates = templates
+
+	resp.Diagnostics.Append(resp.State.Set(ctx, &data)...)
+}
+
+var templatesSourceAttrTypes = map[string]attr.Type{
+	"global_quota": types.BoolType,
+	"quota_code":   types.StringType,
+	"quota_name":   types.StringType,
+	"region":       types.StringType,
+	"service_code": types.StringType,
+	"service_name": types.StringType,
+	"unit":         types.StringType,
+	"value":        types.Float64Type,
+}
+
+type dataSourceTemplatesData struct {
+	Region    types.String `tfsdk:"region"`
+	ID        types.String `tfsdk:"id"`
+	Templates types.List   `tfsdk:"templates"`
+}
+
+func flattenTemplates(ctx context.Context, apiObject []awstypes.ServiceQuotaIncreaseRequestInTemplate) (types.List, diag.Diagnostics) {
+	var diags diag.Diagnostics
+	elemType := types.ObjectType{AttrTypes: templatesSourceAttrTypes}
+
+	elems := []attr.Value{}
+	for _, t := range apiObject {
+		obj := map[string]attr.Value{
+			"global_quota": types.BoolValue(t.GlobalQuota),
+			"quota_code":   flex.StringToFramework(ctx, t.QuotaCode),
+			"quota_name":   flex.StringToFramework(ctx, t.QuotaName),
+			"region":       flex.StringToFramework(ctx, t.AwsRegion),
+			"service_code": flex.StringToFramework(ctx, t.ServiceCode),
+			"service_name": flex.StringToFramework(ctx, t.ServiceName),
+			"unit":         flex.StringToFramework(ctx, t.Unit),
+			"value":        flex.Float64ToFramework(ctx, t.DesiredValue),
+		}
+		objVal, d := types.ObjectValue(templatesSourceAttrTypes, obj)
+		diags.Append(d...)
+
+		elems = append(elems, objVal)
+	}
+	listVal, d := types.ListValue(elemType, elems)
+	diags.Append(d...)
+
+	return listVal, diags
+}
diff --git a/internal/service/servicequotas/templates_data_source_test.go b/internal/service/servicequotas/templates_data_source_test.go
new file mode 100644
index 00000000000..01f8876c8d8
--- /dev/null
+++ b/internal/service/servicequotas/templates_data_source_test.go
@@ -0,0 +1,49 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package servicequotas_test
+
+import (
+	"testing"
+
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
+	"github.com/hashicorp/terraform-provider-aws/names"
+)
+
+func testAccTemplatesDataSource_basic(t *testing.T) {
+	ctx := acctest.Context(t)
+	dataSourceName := "data.aws_servicequotas_templates.test"
+	regionDataSourceName := "data.aws_region.current"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckRegion(t, names.USEast1RegionID)
+			acctest.PreCheckPartitionHasService(t, names.ServiceQuotasEndpointID)
+			testAccPreCheckTemplate(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, names.ServiceQuotasEndpointID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckTemplateDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccTemplatesDataSourceConfig_basic(),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttrPair(dataSourceName, "region", regionDataSourceName, "name"),
+					resource.TestCheckResourceAttr(dataSourceName, "templates.#", "1"),
+				),
+			},
+		},
+	})
+}
+
+func testAccTemplatesDataSourceConfig_basic() string {
+	return acctest.ConfigCompose(
+		testAccTemplateConfig_basic(lambdaStorageQuotaCode, lambdaServiceCode, lambdaStorageValue),
+		`
+data "aws_servicequotas_templates" "test" {
+  region = aws_servicequotas_template.test.region
+}
+`)
+}
diff --git a/internal/service/ses/active_receipt_rule_set.go b/internal/service/ses/active_receipt_rule_set.go
index a363f3089fa..ad6e2cc5ed2 100644
--- a/internal/service/ses/active_receipt_rule_set.go
+++ b/internal/service/ses/active_receipt_rule_set.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ses
 
 import (
diff --git a/internal/service/ses/active_receipt_rule_set_data_source.go b/internal/service/ses/active_receipt_rule_set_data_source.go
index 4638513da6f..54ef9a54d80 100644
--- a/internal/service/ses/active_receipt_rule_set_data_source.go
+++ b/internal/service/ses/active_receipt_rule_set_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ses
 
 import (
diff --git a/internal/service/ses/active_receipt_rule_set_data_source_test.go b/internal/service/ses/active_receipt_rule_set_data_source_test.go
index 138f53589f9..8ef120e8084 100644
--- a/internal/service/ses/active_receipt_rule_set_data_source_test.go
+++ b/internal/service/ses/active_receipt_rule_set_data_source_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ses_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/ses"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -52,7 +55,7 @@ func testAccActiveReceiptRuleSetDataSource_noActiveRuleSet(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccActiveReceiptRuleSetDataSourceConfig_noActiveRuleSet(),
-				ExpectError: regexp.MustCompile("empty result"),
+				ExpectError: regexache.MustCompile("empty result"),
 			},
 		},
 	})
diff --git a/internal/service/ses/active_receipt_rule_set_test.go b/internal/service/ses/active_receipt_rule_set_test.go
index 7e91f36c98b..c6044e378ec 100644
--- a/internal/service/ses/active_receipt_rule_set_test.go
+++ b/internal/service/ses/active_receipt_rule_set_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ses_test
 
 import (
diff --git a/internal/service/ses/configuration_set.go b/internal/service/ses/configuration_set.go
index b569d343e29..4f51991a4b6 100644
--- a/internal/service/ses/configuration_set.go
+++ b/internal/service/ses/configuration_set.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ses
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/aws/aws-sdk-go/service/ses"
@@ -78,7 +81,7 @@ func ResourceConfigurationSet() *schema.Resource {
 						"custom_redirect_domain": {
 							Type:         schema.TypeString,
 							Optional:     true,
-							ValidateFunc: validation.StringDoesNotMatch(regexp.MustCompile(`\.$`), "cannot end with a period"),
+							ValidateFunc: validation.StringDoesNotMatch(regexache.MustCompile(`\.$`), "cannot end with a period"),
 						},
 					},
 				},
diff --git a/internal/service/ses/configuration_set_test.go b/internal/service/ses/configuration_set_test.go
index 5e778d46251..eace5f418d2 100644
--- a/internal/service/ses/configuration_set_test.go
+++ b/internal/service/ses/configuration_set_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ses_test
 
 import (
diff --git a/internal/service/ses/domain_dkim.go b/internal/service/ses/domain_dkim.go
index 8d0ac0d272f..81099ff17bf 100644
--- a/internal/service/ses/domain_dkim.go
+++ b/internal/service/ses/domain_dkim.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ses
 
 import (
diff --git a/internal/service/ses/domain_dkim_test.go b/internal/service/ses/domain_dkim_test.go
index db72192d8ce..39298ebcdde 100644
--- a/internal/service/ses/domain_dkim_test.go
+++ b/internal/service/ses/domain_dkim_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ses_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"strconv"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ses"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -109,7 +112,7 @@ func testAccCheckDomainDKIMTokens(n string) resource.TestCheckFunc {
 		rs := s.RootModule().Resources[n]
 
 		expectedNum := 3
-		expectedFormat := regexp.MustCompile("[a-z0-9]{32}")
+		expectedFormat := regexache.MustCompile("[0-9a-z]{32}")
 
 		tokenNum, _ := strconv.Atoi(rs.Primary.Attributes["dkim_tokens.#"])
 		if expectedNum != tokenNum {
diff --git a/internal/service/ses/domain_identity.go b/internal/service/ses/domain_identity.go
index fb2150eebd6..6f643df6100 100644
--- a/internal/service/ses/domain_identity.go
+++ b/internal/service/ses/domain_identity.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ses
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/aws/aws-sdk-go/service/ses"
@@ -35,7 +38,7 @@ func ResourceDomainIdentity() *schema.Resource {
 				Type:         schema.TypeString,
 				Required:     true,
 				ForceNew:     true,
-				ValidateFunc: validation.StringDoesNotMatch(regexp.MustCompile(`\.$`), "cannot end with a period"),
+				ValidateFunc: validation.StringDoesNotMatch(regexache.MustCompile(`\.$`), "cannot end with a period"),
 			},
 			"verification_token": {
 				Type:     schema.TypeString,
diff --git a/internal/service/ses/domain_identity_data_source.go b/internal/service/ses/domain_identity_data_source.go
index 7c012db862e..d5cd92fba47 100644
--- a/internal/service/ses/domain_identity_data_source.go
+++ b/internal/service/ses/domain_identity_data_source.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ses
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/aws/aws-sdk-go/service/ses"
@@ -27,7 +30,7 @@ func DataSourceDomainIdentity() *schema.Resource {
 			"domain": {
 				Type:         schema.TypeString,
 				Required:     true,
-				ValidateFunc: validation.StringDoesNotMatch(regexp.MustCompile(`\.$`), "cannot end with a period"),
+				ValidateFunc: validation.StringDoesNotMatch(regexache.MustCompile(`\.$`), "cannot end with a period"),
 			},
 			"verification_token": {
 				Type:     schema.TypeString,
diff --git a/internal/service/ses/domain_identity_data_source_test.go b/internal/service/ses/domain_identity_data_source_test.go
index 4dce8214198..0eef4c41c65 100644
--- a/internal/service/ses/domain_identity_data_source_test.go
+++ b/internal/service/ses/domain_identity_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ses_test
 
 import (
diff --git a/internal/service/ses/domain_identity_test.go b/internal/service/ses/domain_identity_test.go
index dade843d28f..17fafce935a 100644
--- a/internal/service/ses/domain_identity_test.go
+++ b/internal/service/ses/domain_identity_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ses_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"strings"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/aws/aws-sdk-go/service/ses"
@@ -73,7 +76,7 @@ func TestAccSESDomainIdentity_trailingPeriod(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccDomainIdentityConfig_basic(domain),
-				ExpectError: regexp.MustCompile(`invalid value for domain \(cannot end with a period\)`),
+				ExpectError: regexache.MustCompile(`invalid value for domain \(cannot end with a period\)`),
 			},
 		},
 	})
diff --git a/internal/service/ses/domain_identity_verification.go b/internal/service/ses/domain_identity_verification.go
index 63817b3f06a..cdaed364d61 100644
--- a/internal/service/ses/domain_identity_verification.go
+++ b/internal/service/ses/domain_identity_verification.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ses
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/aws/aws-sdk-go/service/ses"
@@ -35,7 +38,7 @@ func ResourceDomainIdentityVerification() *schema.Resource {
 				Type:         schema.TypeString,
 				Required:     true,
 				ForceNew:     true,
-				ValidateFunc: validation.StringDoesNotMatch(regexp.MustCompile(`\.$`), "cannot end with a period"),
+				ValidateFunc: validation.StringDoesNotMatch(regexache.MustCompile(`\.$`), "cannot end with a period"),
 			},
 		},
 		Timeouts: &schema.ResourceTimeout{
diff --git a/internal/service/ses/domain_identity_verification_test.go b/internal/service/ses/domain_identity_verification_test.go
index d417e42252f..f8774009bd6 100644
--- a/internal/service/ses/domain_identity_verification_test.go
+++ b/internal/service/ses/domain_identity_verification_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ses_test
 
 import (
 	"context"
 	"fmt"
 	"os"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/aws/aws-sdk-go/service/ses"
@@ -59,7 +62,7 @@ func TestAccSESDomainIdentityVerification_timeout(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccDomainIdentityVerificationConfig_timeout(domain),
-				ExpectError: regexp.MustCompile("Expected domain verification Success, but was in state Pending"),
+				ExpectError: regexache.MustCompile("Expected domain verification Success, but was in state Pending"),
 			},
 		},
 	})
@@ -77,7 +80,7 @@ func TestAccSESDomainIdentityVerification_nonexistent(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccDomainIdentityVerificationConfig_nonexistent(domain),
-				ExpectError: regexp.MustCompile(fmt.Sprintf("SES Domain Identity %s not found in AWS", domain)),
+				ExpectError: regexache.MustCompile(fmt.Sprintf("SES Domain Identity %s not found in AWS", domain)),
 			},
 		},
 	})
diff --git a/internal/service/ses/domain_mail_from.go b/internal/service/ses/domain_mail_from.go
index ee535366660..f7e44a0acfb 100644
--- a/internal/service/ses/domain_mail_from.go
+++ b/internal/service/ses/domain_mail_from.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ses
 
 import (
diff --git a/internal/service/ses/domain_mail_from_test.go b/internal/service/ses/domain_mail_from_test.go
index ae9a82de4c7..ce495a45419 100644
--- a/internal/service/ses/domain_mail_from_test.go
+++ b/internal/service/ses/domain_mail_from_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ses_test
 
 import (
diff --git a/internal/service/ses/email_identity.go b/internal/service/ses/email_identity.go
index 2b0f19b866b..67931b7343e 100644
--- a/internal/service/ses/email_identity.go
+++ b/internal/service/ses/email_identity.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ses
 
 import (
diff --git a/internal/service/ses/email_identity_data_dource_test.go b/internal/service/ses/email_identity_data_dource_test.go
index dd6c7389314..325e8fc8ee8 100644
--- a/internal/service/ses/email_identity_data_dource_test.go
+++ b/internal/service/ses/email_identity_data_dource_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ses_test
 
 import (
@@ -6,6 +9,7 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/ses"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
@@ -25,7 +29,7 @@ func TestAccSESEmailIdentityDataSource_basic(t *testing.T) {
 				Config: testAccEmailIdentityDataDourceConfig_source(email),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckEmailIdentityExists(ctx, "aws_ses_email_identity.test"),
-					acctest.MatchResourceAttrRegionalARN("data.aws_ses_email_identity.test", "arn", "ses", regexp.MustCompile(fmt.Sprintf("identity/%s$", regexp.QuoteMeta(email)))),
+					acctest.MatchResourceAttrRegionalARN("data.aws_ses_email_identity.test", "arn", "ses", regexache.MustCompile(fmt.Sprintf("identity/%s$", regexp.QuoteMeta(email)))),
 				),
 			},
 		},
@@ -46,7 +50,7 @@ func TestAccSESEmailIdentityDataSource_trailingPeriod(t *testing.T) {
 				Config: testAccEmailIdentityDataDourceConfig_source(email),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckEmailIdentityExists(ctx, "aws_ses_email_identity.test"),
-					acctest.MatchResourceAttrRegionalARN("data.aws_ses_email_identity.test", "arn", "ses", regexp.MustCompile(fmt.Sprintf("identity/%s$", regexp.QuoteMeta(strings.TrimSuffix(email, "."))))),
+					acctest.MatchResourceAttrRegionalARN("data.aws_ses_email_identity.test", "arn", "ses", regexache.MustCompile(fmt.Sprintf("identity/%s$", regexp.QuoteMeta(strings.TrimSuffix(email, "."))))),
 				),
 			},
 		},
diff --git a/internal/service/ses/email_identity_data_source.go b/internal/service/ses/email_identity_data_source.go
index 9a50f435e0b..e0f625c58cd 100644
--- a/internal/service/ses/email_identity_data_source.go
+++ b/internal/service/ses/email_identity_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ses
 
 import (
diff --git a/internal/service/ses/email_identity_test.go b/internal/service/ses/email_identity_test.go
index 8121de4f332..9cf4bbc3ffb 100644
--- a/internal/service/ses/email_identity_test.go
+++ b/internal/service/ses/email_identity_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ses_test
 
 import (
@@ -7,6 +10,7 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ses"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -30,7 +34,7 @@ func TestAccSESEmailIdentity_basic(t *testing.T) {
 				Config: testAccEmailIdentityConfig_basic(email),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckEmailIdentityExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ses", regexp.MustCompile(fmt.Sprintf("identity/%s$", regexp.QuoteMeta(email)))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ses", regexache.MustCompile(fmt.Sprintf("identity/%s$", regexp.QuoteMeta(email)))),
 				),
 			},
 			{
@@ -57,7 +61,7 @@ func TestAccSESEmailIdentity_trailingPeriod(t *testing.T) {
 				Config: testAccEmailIdentityConfig_basic(email),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckEmailIdentityExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ses", regexp.MustCompile(fmt.Sprintf("identity/%s$", regexp.QuoteMeta(strings.TrimSuffix(email, "."))))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ses", regexache.MustCompile(fmt.Sprintf("identity/%s$", regexp.QuoteMeta(strings.TrimSuffix(email, "."))))),
 				),
 			},
 			{
diff --git a/internal/service/ses/event_destination.go b/internal/service/ses/event_destination.go
index b24b4732703..3172c0efb20 100644
--- a/internal/service/ses/event_destination.go
+++ b/internal/service/ses/event_destination.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ses
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"strings"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/aws/aws-sdk-go/service/ses"
@@ -47,7 +50,7 @@ func ResourceEventDestination() *schema.Resource {
 							Required: true,
 							ValidateFunc: validation.All(
 								validation.StringLenBetween(1, 256),
-								validation.StringMatch(regexp.MustCompile(`^[0-9a-zA-Z_\-\.@]+$`), "must contain only alphanumeric, underscore, hyphen, period, and at signs characters"),
+								validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_.@-]+$`), "must contain only alphanumeric, underscore, hyphen, period, and at signs characters"),
 							),
 						},
 						"dimension_name": {
@@ -55,7 +58,7 @@ func ResourceEventDestination() *schema.Resource {
 							Required: true,
 							ValidateFunc: validation.All(
 								validation.StringLenBetween(1, 256),
-								validation.StringMatch(regexp.MustCompile(`^[0-9a-zA-Z_:-]+$`), "must contain only alphanumeric, underscore, and hyphen characters"),
+								validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_:-]+$`), "must contain only alphanumeric, underscore, and hyphen characters"),
 							),
 						},
 						"value_source": {
@@ -114,7 +117,7 @@ func ResourceEventDestination() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 64),
-					validation.StringMatch(regexp.MustCompile(`^[0-9a-zA-Z_-]+$`), "must contain only alphanumeric, underscore, and hyphen characters"),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_-]+$`), "must contain only alphanumeric, underscore, and hyphen characters"),
 				),
 			},
 			"sns_destination": {
diff --git a/internal/service/ses/event_destination_test.go b/internal/service/ses/event_destination_test.go
index 42d81b46701..c96c3e542a1 100644
--- a/internal/service/ses/event_destination_test.go
+++ b/internal/service/ses/event_destination_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ses_test
 
 import (
diff --git a/internal/service/ses/generate.go b/internal/service/ses/generate.go
index 2819e4e77a0..9dc354bec86 100644
--- a/internal/service/ses/generate.go
+++ b/internal/service/ses/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
 
diff --git a/internal/service/ses/identity_notification_topic.go b/internal/service/ses/identity_notification_topic.go
index c1fa37837dd..cc29ea202aa 100644
--- a/internal/service/ses/identity_notification_topic.go
+++ b/internal/service/ses/identity_notification_topic.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ses
 
 import (
diff --git a/internal/service/ses/identity_notification_topic_test.go b/internal/service/ses/identity_notification_topic_test.go
index 27d0123bd44..5715a04d88d 100644
--- a/internal/service/ses/identity_notification_topic_test.go
+++ b/internal/service/ses/identity_notification_topic_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ses_test
 
 import (
diff --git a/internal/service/ses/identity_policy.go b/internal/service/ses/identity_policy.go
index 73aa24948c3..825dd908002 100644
--- a/internal/service/ses/identity_policy.go
+++ b/internal/service/ses/identity_policy.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ses
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"strings"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ses"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
@@ -41,7 +44,7 @@ func ResourceIdentityPolicy() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 64),
-					validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9\-\_]+$`), "must contain only alphanumeric characters, dashes, and underscores"),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_-]+$`), "must contain only alphanumeric characters, dashes, and underscores"),
 				),
 			},
 			"policy": {
diff --git a/internal/service/ses/identity_policy_test.go b/internal/service/ses/identity_policy_test.go
index fbaf16421aa..dd81d70c4c3 100644
--- a/internal/service/ses/identity_policy_test.go
+++ b/internal/service/ses/identity_policy_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ses_test
 
 import (
diff --git a/internal/service/ses/receipt_filter.go b/internal/service/ses/receipt_filter.go
index 3d282b04b76..a1a6455cd64 100644
--- a/internal/service/ses/receipt_filter.go
+++ b/internal/service/ses/receipt_filter.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ses
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/aws/aws-sdk-go/service/ses"
@@ -37,9 +40,9 @@ func ResourceReceiptFilter() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 64),
-					validation.StringMatch(regexp.MustCompile(`^[0-9a-zA-Z._-]+$`), "must contain only alphanumeric, period, underscore, and hyphen characters"),
-					validation.StringMatch(regexp.MustCompile(`^[0-9a-zA-Z]`), "must begin with a alphanumeric character"),
-					validation.StringMatch(regexp.MustCompile(`[0-9a-zA-Z]$`), "must end with a alphanumeric character"),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_.-]+$`), "must contain only alphanumeric, period, underscore, and hyphen characters"),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z]`), "must begin with a alphanumeric character"),
+					validation.StringMatch(regexache.MustCompile(`[0-9A-Za-z]$`), "must end with a alphanumeric character"),
 				),
 			},
 
diff --git a/internal/service/ses/receipt_filter_test.go b/internal/service/ses/receipt_filter_test.go
index 58c059ee412..80ed9361b1f 100644
--- a/internal/service/ses/receipt_filter_test.go
+++ b/internal/service/ses/receipt_filter_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ses_test
 
 import (
diff --git a/internal/service/ses/receipt_rule.go b/internal/service/ses/receipt_rule.go
index 770f36f4d8d..62ede192e34 100644
--- a/internal/service/ses/receipt_rule.go
+++ b/internal/service/ses/receipt_rule.go
@@ -1,13 +1,16 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ses
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"sort"
 	"strings"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/aws/aws-sdk-go/service/ses"
@@ -46,7 +49,7 @@ func ResourceReceiptRule() *schema.Resource {
 							Required: true,
 							ValidateFunc: validation.All(
 								validation.StringLenBetween(1, 50),
-								validation.StringMatch(regexp.MustCompile(`^[0-9a-zA-Z-]+$`), "must contain only alphanumeric and dash characters"),
+								validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z-]+$`), "must contain only alphanumeric and dash characters"),
 							),
 						},
 						"header_value": {
@@ -141,9 +144,9 @@ func ResourceReceiptRule() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 64),
-					validation.StringMatch(regexp.MustCompile(`^[0-9a-zA-Z._-]+$`), "must contain only alphanumeric, period, underscore, and hyphen characters"),
-					validation.StringMatch(regexp.MustCompile(`^[0-9a-zA-Z]`), "must begin with a alphanumeric character"),
-					validation.StringMatch(regexp.MustCompile(`[0-9a-zA-Z]$`), "must end with a alphanumeric character"),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_.-]+$`), "must contain only alphanumeric, period, underscore, and hyphen characters"),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z]`), "must begin with a alphanumeric character"),
+					validation.StringMatch(regexache.MustCompile(`[0-9A-Za-z]$`), "must end with a alphanumeric character"),
 				),
 			},
 			"recipients": {
diff --git a/internal/service/ses/receipt_rule_set.go b/internal/service/ses/receipt_rule_set.go
index 1b608962fe9..9b909f5100c 100644
--- a/internal/service/ses/receipt_rule_set.go
+++ b/internal/service/ses/receipt_rule_set.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ses
 
 import (
diff --git a/internal/service/ses/receipt_rule_set_test.go b/internal/service/ses/receipt_rule_set_test.go
index dbeafd31b2f..836e2b6a92d 100644
--- a/internal/service/ses/receipt_rule_set_test.go
+++ b/internal/service/ses/receipt_rule_set_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ses_test
 
 import (
diff --git a/internal/service/ses/receipt_rule_test.go b/internal/service/ses/receipt_rule_test.go
index c44cf3100a0..e9d93493434 100644
--- a/internal/service/ses/receipt_rule_test.go
+++ b/internal/service/ses/receipt_rule_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ses_test
 
 import (
@@ -471,7 +474,28 @@ resource "aws_s3_bucket" "test" {
   force_destroy = "true"
 }
 
+resource "aws_s3_bucket_public_access_block" "test" {
+  bucket = aws_s3_bucket.test.id
+
+  block_public_acls       = false
+  block_public_policy     = false
+  ignore_public_acls      = false
+  restrict_public_buckets = false
+}
+
+resource "aws_s3_bucket_ownership_controls" "test" {
+  bucket = aws_s3_bucket.test.id
+  rule {
+    object_ownership = "BucketOwnerPreferred"
+  }
+}
+
 resource "aws_s3_bucket_acl" "test" {
+  depends_on = [
+    aws_s3_bucket_public_access_block.test,
+    aws_s3_bucket_ownership_controls.test,
+  ]
+
   bucket = aws_s3_bucket.test.id
   acl    = "public-read-write"
 }
diff --git a/internal/service/ses/service_package_gen.go b/internal/service/ses/service_package_gen.go
index aa2d1dcc822..1bf148b99b6 100644
--- a/internal/service/ses/service_package_gen.go
+++ b/internal/service/ses/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	ses_sdkv1 "github.com/aws/aws-sdk-go/service/ses"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -111,4 +112,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*s
 	return ses_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/ses/sweep.go b/internal/service/ses/sweep.go
index e625ad2f9bb..53be5e346e1 100644
--- a/internal/service/ses/sweep.go
+++ b/internal/service/ses/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package ses
 
@@ -13,9 +13,10 @@ import (
 	"github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_ses_configuration_set", &resource.Sweeper{
 		Name: "aws_ses_configuration_set",
 		F:    sweepConfigurationSets,
@@ -39,7 +40,7 @@ func init() {
 
 func sweepConfigurationSets(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("getting client: %w", err)
 	}
@@ -49,7 +50,7 @@ func sweepConfigurationSets(region string) error {
 
 	for {
 		output, err := conn.ListConfigurationSetsWithContext(ctx, input)
-		if sweep.SkipSweepError(err) {
+		if awsv1.SkipSweepError(err) {
 			log.Printf("[WARN] Skipping SES Configuration Sets sweep for %s: %s", region, err)
 			return sweeperErrs.ErrorOrNil() // In case we have completed some pages, but had errors
 		}
@@ -87,7 +88,7 @@ func sweepConfigurationSets(region string) error {
 
 func sweepIdentities(region, identityType string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("getting client: %w", err)
 	}
@@ -119,7 +120,7 @@ func sweepIdentities(region, identityType string) error {
 
 		return !lastPage
 	})
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping SES Identities sweep for %s: %s", region, err)
 		return sweeperErrs.ErrorOrNil() // In case we have completed some pages, but had errors
 	}
@@ -132,17 +133,18 @@ func sweepIdentities(region, identityType string) error {
 
 func sweepReceiptRuleSets(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("getting client: %w", err)
 	}
 	conn := client.SESConn(ctx)
 
 	// You cannot delete the receipt rule set that is currently active.
-	// Setting the name of the receipt rule set to make active to null disables all email receiving.
+	// Setting the name of the active receipt rule set to null disables all email receiving.
 	log.Printf("[INFO] Disabling any currently active SES Receipt Rule Set")
 	_, err = conn.SetActiveReceiptRuleSetWithContext(ctx, &ses.SetActiveReceiptRuleSetInput{})
-	if sweep.SkipSweepError(err) {
+	// In some regions, this will return "InvalidAction" with no message
+	if awsv1.SkipSweepError(err) || tfawserr.ErrCodeEquals(err, "InvalidAction") {
 		log.Printf("[WARN] Skipping SES Receipt Rule Sets sweep for %s: %s", region, err)
 		return nil
 	}
@@ -155,7 +157,7 @@ func sweepReceiptRuleSets(region string) error {
 
 	for {
 		output, err := conn.ListReceiptRuleSetsWithContext(ctx, input)
-		if sweep.SkipSweepError(err) {
+		if awsv1.SkipSweepError(err) {
 			log.Printf("[WARN] Skipping SES Receipt Rule Sets sweep for %s: %s", region, err)
 			return sweeperErrs.ErrorOrNil() // In case we have completed some pages, but had errors
 		}
diff --git a/internal/service/ses/template.go b/internal/service/ses/template.go
index 768b1da8796..46dab7b68b5 100644
--- a/internal/service/ses/template.go
+++ b/internal/service/ses/template.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ses
 
 import (
diff --git a/internal/service/ses/template_test.go b/internal/service/ses/template_test.go
index 93c3558f6b9..dd5220dba9a 100644
--- a/internal/service/ses/template_test.go
+++ b/internal/service/ses/template_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ses_test
 
 import (
diff --git a/internal/service/sesv2/account_vdm_attributes.go b/internal/service/sesv2/account_vdm_attributes.go
new file mode 100644
index 00000000000..f994cbf8fd2
--- /dev/null
+++ b/internal/service/sesv2/account_vdm_attributes.go
@@ -0,0 +1,239 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package sesv2
+
+import (
+	"context"
+	"errors"
+	"log"
+
+	"github.com/aws/aws-sdk-go-v2/service/sesv2"
+	"github.com/aws/aws-sdk-go-v2/service/sesv2/types"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/create"
+	"github.com/hashicorp/terraform-provider-aws/internal/enum"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/names"
+)
+
+// @SDKResource("aws_sesv2_account_vdm_attributes", name="Account VDM Attributes")
+func ResourceAccountVDMAttributes() *schema.Resource {
+	return &schema.Resource{
+		CreateWithoutTimeout: resourceAccountVDMAttributesUpdate,
+		ReadWithoutTimeout:   resourceAccountVDMAttributesRead,
+		UpdateWithoutTimeout: resourceAccountVDMAttributesUpdate,
+		DeleteWithoutTimeout: resourceAccountVDMAttributesDelete,
+
+		Importer: &schema.ResourceImporter{
+			StateContext: schema.ImportStatePassthroughContext,
+		},
+
+		Schema: map[string]*schema.Schema{
+			"dashboard_attributes": {
+				Type:     schema.TypeList,
+				Optional: true,
+				Computed: true,
+				MaxItems: 1,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"engagement_metrics": {
+							Type:             schema.TypeString,
+							Optional:         true,
+							ValidateDiagFunc: enum.Validate[types.FeatureStatus](),
+						},
+					},
+				},
+			},
+			"guardian_attributes": {
+				Type:     schema.TypeList,
+				Optional: true,
+				Computed: true,
+				MaxItems: 1,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"optimized_shared_delivery": {
+							Type:             schema.TypeString,
+							Optional:         true,
+							ValidateDiagFunc: enum.Validate[types.FeatureStatus](),
+						},
+					},
+				},
+			},
+			"vdm_enabled": {
+				Type:             schema.TypeString,
+				Required:         true,
+				ValidateDiagFunc: enum.Validate[types.FeatureStatus](),
+			},
+		},
+	}
+}
+
+const (
+	ResNameAccountVDMAttributes = "Account VDM Attributes"
+)
+
+func resourceAccountVDMAttributesUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	conn := meta.(*conns.AWSClient).SESV2Client(ctx)
+
+	in := &sesv2.PutAccountVdmAttributesInput{
+		VdmAttributes: &types.VdmAttributes{
+			VdmEnabled: types.FeatureStatus(d.Get("vdm_enabled").(string)),
+		},
+	}
+
+	if v, ok := d.GetOk("dashboard_attributes"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
+		in.VdmAttributes.DashboardAttributes = expandDashboardAttributes(v.([]interface{})[0].(map[string]interface{}))
+	}
+
+	if v, ok := d.GetOk("guardian_attributes"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
+		in.VdmAttributes.GuardianAttributes = expandGuardianAttributes(v.([]interface{})[0].(map[string]interface{}))
+	}
+
+	out, err := conn.PutAccountVdmAttributes(ctx, in)
+	if err != nil {
+		return create.DiagError(names.SESV2, create.ErrActionCreating, ResNameAccountVDMAttributes, "", err)
+	}
+
+	if out == nil {
+		return create.DiagError(names.SESV2, create.ErrActionCreating, ResNameAccountVDMAttributes, "", errors.New("empty output"))
+	}
+
+	if d.IsNewResource() {
+		d.SetId("ses-account-vdm-attributes")
+	}
+
+	return resourceAccountVDMAttributesRead(ctx, d, meta)
+}
+
+func resourceAccountVDMAttributesRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	conn := meta.(*conns.AWSClient).SESV2Client(ctx)
+
+	out, err := FindAccountVDMAttributes(ctx, conn)
+
+	if !d.IsNewResource() && tfresource.NotFound(err) {
+		log.Printf("[WARN] SESV2 AccountVDMAttributes (%s) not found, removing from state", d.Id())
+		d.SetId("")
+		return nil
+	}
+
+	if err != nil {
+		return create.DiagError(names.SESV2, create.ErrActionReading, ResNameAccountVDMAttributes, d.Id(), err)
+	}
+
+	if out.DashboardAttributes != nil {
+		if err := d.Set("dashboard_attributes", []interface{}{flattenDashboardAttributes(out.DashboardAttributes)}); err != nil {
+			return create.DiagError(names.SESV2, create.ErrActionSetting, ResNameAccountVDMAttributes, d.Id(), err)
+		}
+	}
+
+	if out.GuardianAttributes != nil {
+		if err := d.Set("guardian_attributes", []interface{}{flattenGuardianAttributes(out.GuardianAttributes)}); err != nil {
+			return create.DiagError(names.SESV2, create.ErrActionSetting, ResNameAccountVDMAttributes, d.Id(), err)
+		}
+	}
+
+	d.Set("vdm_enabled", out.VdmEnabled)
+
+	return nil
+}
+
+func resourceAccountVDMAttributesDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	conn := meta.(*conns.AWSClient).SESV2Client(ctx)
+
+	log.Printf("[INFO] Deleting SESV2 AccountVDMAttributes %s", d.Id())
+
+	_, err := conn.PutAccountVdmAttributes(ctx, &sesv2.PutAccountVdmAttributesInput{
+		VdmAttributes: &types.VdmAttributes{
+			VdmEnabled: "DISABLED",
+		},
+	})
+
+	if err != nil {
+		var nfe *types.NotFoundException
+		if errors.As(err, &nfe) {
+			return nil
+		}
+
+		return create.DiagError(names.SESV2, create.ErrActionDeleting, ResNameAccountVDMAttributes, d.Id(), err)
+	}
+
+	return nil
+}
+
+func FindAccountVDMAttributes(ctx context.Context, conn *sesv2.Client) (*types.VdmAttributes, error) {
+	in := &sesv2.GetAccountInput{}
+	out, err := conn.GetAccount(ctx, in)
+	if err != nil {
+		var nfe *types.NotFoundException
+		if errors.As(err, &nfe) {
+			return nil, &retry.NotFoundError{
+				LastError:   err,
+				LastRequest: in,
+			}
+		}
+
+		return nil, err
+	}
+
+	if out == nil || out.VdmAttributes == nil {
+		return nil, tfresource.NewEmptyResultError(in)
+	}
+
+	return out.VdmAttributes, nil
+}
+
+func expandDashboardAttributes(tfMap map[string]interface{}) *types.DashboardAttributes {
+	if tfMap == nil {
+		return nil
+	}
+
+	a := &types.DashboardAttributes{}
+
+	if v, ok := tfMap["engagement_metrics"].(string); ok && v != "" {
+		a.EngagementMetrics = types.FeatureStatus(v)
+	}
+
+	return a
+}
+
+func expandGuardianAttributes(tfMap map[string]interface{}) *types.GuardianAttributes {
+	if tfMap == nil {
+		return nil
+	}
+
+	a := &types.GuardianAttributes{}
+
+	if v, ok := tfMap["optimized_shared_delivery"].(string); ok && v != "" {
+		a.OptimizedSharedDelivery = types.FeatureStatus(v)
+	}
+
+	return a
+}
+
+func flattenDashboardAttributes(apiObject *types.DashboardAttributes) map[string]interface{} {
+	if apiObject == nil {
+		return nil
+	}
+
+	m := map[string]interface{}{
+		"engagement_metrics": string(apiObject.EngagementMetrics),
+	}
+
+	return m
+}
+
+func flattenGuardianAttributes(apiObject *types.GuardianAttributes) map[string]interface{} {
+	if apiObject == nil {
+		return nil
+	}
+
+	m := map[string]interface{}{
+		"optimized_shared_delivery": string(apiObject.OptimizedSharedDelivery),
+	}
+
+	return m
+}
diff --git a/internal/service/sesv2/account_vdm_attributes_test.go b/internal/service/sesv2/account_vdm_attributes_test.go
new file mode 100644
index 00000000000..ca4d2e1c1fb
--- /dev/null
+++ b/internal/service/sesv2/account_vdm_attributes_test.go
@@ -0,0 +1,202 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package sesv2_test
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"testing"
+
+	"github.com/aws/aws-sdk-go-v2/service/sesv2/types"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
+	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/create"
+	tfsesv2 "github.com/hashicorp/terraform-provider-aws/internal/service/sesv2"
+	"github.com/hashicorp/terraform-provider-aws/names"
+)
+
+func TestAccSESV2AccountVDMAttributes_serial(t *testing.T) {
+	t.Parallel()
+
+	testCases := map[string]func(t *testing.T){
+		"basic":                   testAccAccountVDMAttributes_basic,
+		"disappears":              testAccAccountVDMAttributes_disappears,
+		"engagementMetrics":       testAccAccountVDMAttributes_engagementMetrics,
+		"optimizedSharedDelivery": testAccAccountVDMAttributes_optimizedSharedDelivery,
+	}
+
+	acctest.RunSerialTests1Level(t, testCases, 0)
+}
+
+func testAccAccountVDMAttributes_basic(t *testing.T) {
+	ctx := acctest.Context(t)
+	resourceName := "aws_sesv2_account_vdm_attributes.test"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, names.SESV2EndpointID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckAccountVDMAttributesDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccAccountVDMAttributesConfig_basic(),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(resourceName, "vdm_enabled", string(types.FeatureStatusEnabled)),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
+func testAccAccountVDMAttributes_disappears(t *testing.T) {
+	ctx := acctest.Context(t)
+	resourceName := "aws_sesv2_account_vdm_attributes.test"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, names.SESV2EndpointID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckAccountVDMAttributesDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccAccountVDMAttributesConfig_basic(),
+				Check: resource.ComposeTestCheckFunc(
+					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfsesv2.ResourceAccountVDMAttributes(), resourceName),
+				),
+				ExpectNonEmptyPlan: true,
+			},
+		},
+	})
+}
+
+func testAccAccountVDMAttributes_engagementMetrics(t *testing.T) {
+	ctx := acctest.Context(t)
+	resourceName := "aws_sesv2_account_vdm_attributes.test"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, names.SESV2EndpointID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckAccountVDMAttributesDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccAccountVDMAttributesConfig_engagementMetrics(string(types.FeatureStatusEnabled)),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(resourceName, "dashboard_attributes.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "dashboard_attributes.0.engagement_metrics", string(types.FeatureStatusEnabled)),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				Config: testAccAccountVDMAttributesConfig_engagementMetrics(string(types.FeatureStatusDisabled)),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(resourceName, "dashboard_attributes.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "dashboard_attributes.0.engagement_metrics", string(types.FeatureStatusDisabled)),
+				),
+			},
+		},
+	})
+}
+
+func testAccAccountVDMAttributes_optimizedSharedDelivery(t *testing.T) {
+	ctx := acctest.Context(t)
+	resourceName := "aws_sesv2_account_vdm_attributes.test"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, names.SESV2EndpointID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckAccountVDMAttributesDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccAccountVDMAttributesConfig_optimizedSharedDelivery(string(types.FeatureStatusEnabled)),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(resourceName, "guardian_attributes.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "guardian_attributes.0.optimized_shared_delivery", string(types.FeatureStatusEnabled)),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				Config: testAccAccountVDMAttributesConfig_optimizedSharedDelivery(string(types.FeatureStatusDisabled)),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(resourceName, "guardian_attributes.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "guardian_attributes.0.optimized_shared_delivery", string(types.FeatureStatusDisabled)),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckAccountVDMAttributesDestroy(ctx context.Context) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		conn := acctest.Provider.Meta().(*conns.AWSClient).SESV2Client(ctx)
+
+		for _, rs := range s.RootModule().Resources {
+			if rs.Type != "aws_sesv2_account_vdm_attributes" {
+				continue
+			}
+
+			out, err := tfsesv2.FindAccountVDMAttributes(ctx, conn)
+			if err != nil {
+				return err
+			}
+
+			if out.VdmEnabled == types.FeatureStatusDisabled {
+				return nil
+			}
+
+			return create.Error(names.SESV2, create.ErrActionCheckingDestroyed, tfsesv2.ResNameAccountVDMAttributes, rs.Primary.ID, errors.New("not destroyed"))
+		}
+
+		return nil
+	}
+}
+
+func testAccAccountVDMAttributesConfig_basic() string {
+	return `
+resource "aws_sesv2_account_vdm_attributes" "test" {
+  vdm_enabled = "ENABLED"
+}
+`
+}
+
+func testAccAccountVDMAttributesConfig_engagementMetrics(engagementMetrics string) string {
+	return fmt.Sprintf(`
+resource "aws_sesv2_account_vdm_attributes" "test" {
+  vdm_enabled = "ENABLED"
+
+  dashboard_attributes {
+    engagement_metrics = %[1]q
+  }
+}
+`, engagementMetrics)
+}
+
+func testAccAccountVDMAttributesConfig_optimizedSharedDelivery(optimizedSharedDelivery string) string {
+	return fmt.Sprintf(`
+resource "aws_sesv2_account_vdm_attributes" "test" {
+  vdm_enabled = "ENABLED"
+
+  guardian_attributes {
+    optimized_shared_delivery = %[1]q
+  }
+}
+`, optimizedSharedDelivery)
+}
diff --git a/internal/service/sesv2/configuration_set.go b/internal/service/sesv2/configuration_set.go
index b5d230510ca..8aaff77f63b 100644
--- a/internal/service/sesv2/configuration_set.go
+++ b/internal/service/sesv2/configuration_set.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sesv2
 
 import (
diff --git a/internal/service/sesv2/configuration_set_data_source.go b/internal/service/sesv2/configuration_set_data_source.go
index 99ff30b2bef..7e970eee8e6 100644
--- a/internal/service/sesv2/configuration_set_data_source.go
+++ b/internal/service/sesv2/configuration_set_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sesv2
 
 import (
diff --git a/internal/service/sesv2/configuration_set_data_source_test.go b/internal/service/sesv2/configuration_set_data_source_test.go
index 7130bc4613c..54cb7576969 100644
--- a/internal/service/sesv2/configuration_set_data_source_test.go
+++ b/internal/service/sesv2/configuration_set_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sesv2_test
 
 import (
diff --git a/internal/service/sesv2/configuration_set_event_destination.go b/internal/service/sesv2/configuration_set_event_destination.go
index aa2a5195fba..301926cd85f 100644
--- a/internal/service/sesv2/configuration_set_event_destination.go
+++ b/internal/service/sesv2/configuration_set_event_destination.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sesv2
 
 import (
diff --git a/internal/service/sesv2/configuration_set_event_destination_test.go b/internal/service/sesv2/configuration_set_event_destination_test.go
index 79e2dfa2ad4..b0db61e44da 100644
--- a/internal/service/sesv2/configuration_set_event_destination_test.go
+++ b/internal/service/sesv2/configuration_set_event_destination_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sesv2_test
 
 import (
diff --git a/internal/service/sesv2/configuration_set_test.go b/internal/service/sesv2/configuration_set_test.go
index 31285c054be..dc73704809c 100644
--- a/internal/service/sesv2/configuration_set_test.go
+++ b/internal/service/sesv2/configuration_set_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sesv2_test
 
 import (
 	"context"
 	"errors"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/service/sesv2/types"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -34,7 +37,7 @@ func TestAccSESV2ConfigurationSet_basic(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckConfigurationSetExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "configuration_set_name", rName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ses", regexp.MustCompile(`configuration-set/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ses", regexache.MustCompile(`configuration-set/.+`)),
 				),
 			},
 			{
diff --git a/internal/service/sesv2/contact_list.go b/internal/service/sesv2/contact_list.go
index 7923f8f9dac..b95a225ac88 100644
--- a/internal/service/sesv2/contact_list.go
+++ b/internal/service/sesv2/contact_list.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sesv2
 
 import (
diff --git a/internal/service/sesv2/contact_list_test.go b/internal/service/sesv2/contact_list_test.go
index 3786742e200..bab445efcd6 100644
--- a/internal/service/sesv2/contact_list_test.go
+++ b/internal/service/sesv2/contact_list_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sesv2_test
 
 import (
diff --git a/internal/service/sesv2/dedicated_ip_assignment.go b/internal/service/sesv2/dedicated_ip_assignment.go
index af920ab66c6..c55792c88e0 100644
--- a/internal/service/sesv2/dedicated_ip_assignment.go
+++ b/internal/service/sesv2/dedicated_ip_assignment.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sesv2
 
 import (
diff --git a/internal/service/sesv2/dedicated_ip_assignment_test.go b/internal/service/sesv2/dedicated_ip_assignment_test.go
index 5d75c8ae6e3..72772a93cf9 100644
--- a/internal/service/sesv2/dedicated_ip_assignment_test.go
+++ b/internal/service/sesv2/dedicated_ip_assignment_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sesv2_test
 
 import (
diff --git a/internal/service/sesv2/dedicated_ip_pool.go b/internal/service/sesv2/dedicated_ip_pool.go
index 24c4c113faa..29fc9843fad 100644
--- a/internal/service/sesv2/dedicated_ip_pool.go
+++ b/internal/service/sesv2/dedicated_ip_pool.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sesv2
 
 import (
diff --git a/internal/service/sesv2/dedicated_ip_pool_data_source.go b/internal/service/sesv2/dedicated_ip_pool_data_source.go
index a0f9a36eceb..2c5a76a50cc 100644
--- a/internal/service/sesv2/dedicated_ip_pool_data_source.go
+++ b/internal/service/sesv2/dedicated_ip_pool_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sesv2
 
 import (
diff --git a/internal/service/sesv2/dedicated_ip_pool_data_source_test.go b/internal/service/sesv2/dedicated_ip_pool_data_source_test.go
index e693dd0e67a..6ee8e0eaec5 100644
--- a/internal/service/sesv2/dedicated_ip_pool_data_source_test.go
+++ b/internal/service/sesv2/dedicated_ip_pool_data_source_test.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sesv2_test
 
 import (
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
@@ -30,7 +33,7 @@ func TestAccSESV2DedicatedIPPoolDataSource_basic(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDedicatedIPPoolExists(ctx, dataSourceName),
 					resource.TestCheckResourceAttr(dataSourceName, "pool_name", rName),
-					acctest.MatchResourceAttrRegionalARN(dataSourceName, "arn", "ses", regexp.MustCompile(`dedicated-ip-pool/.+`)),
+					acctest.MatchResourceAttrRegionalARN(dataSourceName, "arn", "ses", regexache.MustCompile(`dedicated-ip-pool/.+`)),
 				),
 			},
 		},
diff --git a/internal/service/sesv2/dedicated_ip_pool_test.go b/internal/service/sesv2/dedicated_ip_pool_test.go
index 911a3651c66..8b821b0a9c3 100644
--- a/internal/service/sesv2/dedicated_ip_pool_test.go
+++ b/internal/service/sesv2/dedicated_ip_pool_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sesv2_test
 
 import (
 	"context"
 	"errors"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/service/sesv2"
 	"github.com/aws/aws-sdk-go-v2/service/sesv2/types"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -35,7 +38,7 @@ func TestAccSESV2DedicatedIPPool_basic(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDedicatedIPPoolExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "pool_name", rName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ses", regexp.MustCompile(`dedicated-ip-pool/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ses", regexache.MustCompile(`dedicated-ip-pool/.+`)),
 				),
 			},
 			{
diff --git a/internal/service/sesv2/email_identity.go b/internal/service/sesv2/email_identity.go
index 0b574d1460f..9a0e1ddef4f 100644
--- a/internal/service/sesv2/email_identity.go
+++ b/internal/service/sesv2/email_identity.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sesv2
 
 import (
@@ -61,6 +64,7 @@ func ResourceEmailIdentity() *schema.Resource {
 						"domain_signing_private_key": {
 							Type:         schema.TypeString,
 							Optional:     true,
+							Sensitive:    true,
 							RequiredWith: []string{"dkim_signing_attributes.0.domain_signing_selector"},
 							ValidateFunc: validation.All(
 								validation.StringLenBetween(1, 20480),
@@ -163,6 +167,16 @@ func resourceEmailIdentityCreate(ctx context.Context, d *schema.ResourceData, me
 	return resourceEmailIdentityRead(ctx, d, meta)
 }
 
+func emailIdentityNameToARN(meta interface{}, emailIdentityName string) string {
+	return arn.ARN{
+		Partition: meta.(*conns.AWSClient).Partition,
+		Service:   "ses",
+		Region:    meta.(*conns.AWSClient).Region,
+		AccountID: meta.(*conns.AWSClient).AccountID,
+		Resource:  fmt.Sprintf("identity/%s", emailIdentityName),
+	}.String()
+}
+
 func resourceEmailIdentityRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	conn := meta.(*conns.AWSClient).SESV2Client(ctx)
 
@@ -178,13 +192,7 @@ func resourceEmailIdentityRead(ctx context.Context, d *schema.ResourceData, meta
 		return create.DiagError(names.SESV2, create.ErrActionReading, ResNameEmailIdentity, d.Id(), err)
 	}
 
-	arn := arn.ARN{
-		Partition: meta.(*conns.AWSClient).Partition,
-		Service:   "ses",
-		Region:    meta.(*conns.AWSClient).Region,
-		AccountID: meta.(*conns.AWSClient).AccountID,
-		Resource:  fmt.Sprintf("identity/%s", d.Id()),
-	}.String()
+	arn := emailIdentityNameToARN(meta, d.Id())
 
 	d.Set("arn", arn)
 	d.Set("configuration_set_name", out.ConfigurationSetName)
diff --git a/internal/service/sesv2/email_identity_data_source.go b/internal/service/sesv2/email_identity_data_source.go
new file mode 100644
index 00000000000..a90caf37d3f
--- /dev/null
+++ b/internal/service/sesv2/email_identity_data_source.go
@@ -0,0 +1,129 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package sesv2
+
+import (
+	"context"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/create"
+	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
+	"github.com/hashicorp/terraform-provider-aws/names"
+)
+
+// @SDKDataSource("aws_sesv2_email_identity")
+// @Tags(identifierAttribute="arn")
+func DataSourceEmailIdentity() *schema.Resource {
+	return &schema.Resource{
+		ReadWithoutTimeout: dataSourceEmailIdentityRead,
+
+		Schema: map[string]*schema.Schema{
+			"arn": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"configuration_set_name": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"dkim_signing_attributes": {
+				Type:     schema.TypeList,
+				Computed: true,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"current_signing_key_length": {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+						"domain_signing_private_key": {
+							Type:      schema.TypeString,
+							Computed:  true,
+							Sensitive: true,
+						},
+						"domain_signing_selector": {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+						"last_key_generation_timestamp": {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+						"next_signing_key_length": {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+						"signing_attributes_origin": {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+						"status": {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+						"tokens": {
+							Type:     schema.TypeList,
+							Computed: true,
+							Elem:     &schema.Schema{Type: schema.TypeString},
+						},
+					},
+				},
+			},
+			"email_identity": {
+				Type:     schema.TypeString,
+				Required: true,
+			},
+			"identity_type": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			names.AttrTags: tftags.TagsSchemaComputed(),
+			"verified_for_sending_status": {
+				Type:     schema.TypeBool,
+				Computed: true,
+			},
+		},
+	}
+}
+
+const (
+	DSNameEmailIdentity = "Email Identity Data Source"
+)
+
+func dataSourceEmailIdentityRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).SESV2Client(ctx)
+
+	name := d.Get("email_identity").(string)
+
+	out, err := FindEmailIdentityByID(ctx, conn, name)
+	if err != nil {
+		return append(diags, create.DiagError(names.SESV2, create.ErrActionReading, DSNameEmailIdentity, name, err)...)
+	}
+
+	arn := emailIdentityNameToARN(meta, name)
+
+	d.SetId(name)
+	d.Set("arn", arn)
+	d.Set("configuration_set_name", out.ConfigurationSetName)
+	d.Set("email_identity", name)
+
+	if out.DkimAttributes != nil {
+		tfMap := flattenDKIMAttributes(out.DkimAttributes)
+		tfMap["domain_signing_private_key"] = d.Get("dkim_signing_attributes.0.domain_signing_private_key").(string)
+		tfMap["domain_signing_selector"] = d.Get("dkim_signing_attributes.0.domain_signing_selector").(string)
+
+		if err := d.Set("dkim_signing_attributes", []interface{}{tfMap}); err != nil {
+			return append(diags, create.DiagError(names.SESV2, create.ErrActionSetting, ResNameEmailIdentity, name, err)...)
+		}
+	} else {
+		d.Set("dkim_signing_attributes", nil)
+	}
+
+	d.Set("identity_type", string(out.IdentityType))
+	d.Set("verified_for_sending_status", out.VerifiedForSendingStatus)
+
+	return diags
+}
diff --git a/internal/service/sesv2/email_identity_data_source_test.go b/internal/service/sesv2/email_identity_data_source_test.go
new file mode 100644
index 00000000000..ea4278763ad
--- /dev/null
+++ b/internal/service/sesv2/email_identity_data_source_test.go
@@ -0,0 +1,59 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package sesv2_test
+
+import (
+	"fmt"
+	"testing"
+
+	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
+	"github.com/hashicorp/terraform-provider-aws/names"
+)
+
+func TestAccSESV2EmailIdentityDataSource_basic(t *testing.T) {
+	ctx := acctest.Context(t)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_sesv2_email_identity.test"
+	dataSourceName := "data.aws_sesv2_email_identity.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, names.SESV2EndpointID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckEmailIdentityDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccEmailIdentityDataSourceConfig_basic(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckEmailIdentityExists(ctx, dataSourceName),
+					resource.TestCheckResourceAttrPair(resourceName, "arn", dataSourceName, "arn"),
+					resource.TestCheckResourceAttrPair(resourceName, "email_identity", dataSourceName, "email_identity"),
+					resource.TestCheckResourceAttrPair(resourceName, "dkim_signing_attributes.#", dataSourceName, "dkim_signing_attributes.#"),
+					resource.TestCheckResourceAttrPair(resourceName, "dkim_signing_attributes.0.current_signing_key_length", dataSourceName, "dkim_signing_attributes.0.current_signing_key_length"),
+					resource.TestCheckResourceAttrPair(resourceName, "dkim_signing_attributes.0.last_key_generation_timestamp", dataSourceName, "dkim_signing_attributes.0.last_key_generation_timestamp"),
+					resource.TestCheckResourceAttrPair(resourceName, "dkim_signing_attributes.0.next_signing_key_length", dataSourceName, "dkim_signing_attributes.0.next_signing_key_length"),
+					resource.TestCheckResourceAttrPair(resourceName, "dkim_signing_attributes.0.signing_attributes_origin", dataSourceName, "dkim_signing_attributes.0.signing_attributes_origin"),
+					resource.TestCheckResourceAttrPair(resourceName, "dkim_signing_attributes.0.status", dataSourceName, "dkim_signing_attributes.0.status"),
+					resource.TestCheckResourceAttrPair(resourceName, "dkim_signing_attributes.0.tokens.#", dataSourceName, "dkim_signing_attributes.0.tokens.#"),
+					resource.TestCheckResourceAttrPair(resourceName, "identity_type", dataSourceName, "identity_type"),
+					resource.TestCheckResourceAttrPair(resourceName, "verified_for_sending_status", dataSourceName, "verified_for_sending_status"),
+				),
+			},
+		},
+	})
+}
+
+func testAccEmailIdentityDataSourceConfig_basic(rName string) string {
+	return fmt.Sprintf(`
+resource "aws_sesv2_email_identity" "test" {
+  email_identity = %[1]q
+}
+
+data "aws_sesv2_email_identity" "test" {
+  email_identity = aws_sesv2_email_identity.test.email_identity
+}
+`, rName)
+}
diff --git a/internal/service/sesv2/email_identity_feedback_attributes.go b/internal/service/sesv2/email_identity_feedback_attributes.go
index 60446d86586..314ebab34aa 100644
--- a/internal/service/sesv2/email_identity_feedback_attributes.go
+++ b/internal/service/sesv2/email_identity_feedback_attributes.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sesv2
 
 import (
diff --git a/internal/service/sesv2/email_identity_feedback_attributes_test.go b/internal/service/sesv2/email_identity_feedback_attributes_test.go
index 5fc50f4285e..2448dd6e585 100644
--- a/internal/service/sesv2/email_identity_feedback_attributes_test.go
+++ b/internal/service/sesv2/email_identity_feedback_attributes_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sesv2_test
 
 import (
diff --git a/internal/service/sesv2/email_identity_mail_from_attributes.go b/internal/service/sesv2/email_identity_mail_from_attributes.go
index 199b1877472..673afef7f8c 100644
--- a/internal/service/sesv2/email_identity_mail_from_attributes.go
+++ b/internal/service/sesv2/email_identity_mail_from_attributes.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sesv2
 
 import (
diff --git a/internal/service/sesv2/email_identity_mail_from_attributes_data_source.go b/internal/service/sesv2/email_identity_mail_from_attributes_data_source.go
new file mode 100644
index 00000000000..896d10c7e4f
--- /dev/null
+++ b/internal/service/sesv2/email_identity_mail_from_attributes_data_source.go
@@ -0,0 +1,66 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package sesv2
+
+import (
+	"context"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/create"
+	"github.com/hashicorp/terraform-provider-aws/names"
+)
+
+// @SDKDataSource("aws_sesv2_email_identity_mail_from_attributes")
+func DataSourceEmailIdentityMailFromAttributes() *schema.Resource {
+	return &schema.Resource{
+		ReadWithoutTimeout: dataSourceEmailIdentityMailFromAttributesRead,
+
+		Schema: map[string]*schema.Schema{
+			"behavior_on_mx_failure": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"email_identity": {
+				Type:     schema.TypeString,
+				Required: true,
+			},
+			"mail_from_domain": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+		},
+	}
+}
+
+const (
+	DSNameEmailIdentityMailFromAttributes = "Email Identity Mail From Attributes Data Source"
+)
+
+func dataSourceEmailIdentityMailFromAttributesRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).SESV2Client(ctx)
+
+	name := d.Get("email_identity").(string)
+
+	out, err := FindEmailIdentityByID(ctx, conn, name)
+
+	if err != nil {
+		return append(diags, create.DiagError(names.SESV2, create.ErrActionReading, ResNameEmailIdentityMailFromAttributes, name, err)...)
+	}
+
+	d.SetId(name)
+	d.Set("email_identity", name)
+
+	if out.MailFromAttributes != nil {
+		d.Set("behavior_on_mx_failure", out.MailFromAttributes.BehaviorOnMxFailure)
+		d.Set("mail_from_domain", out.MailFromAttributes.MailFromDomain)
+	} else {
+		d.Set("behavior_on_mx_failure", nil)
+		d.Set("mail_from_domain", nil)
+	}
+
+	return diags
+}
diff --git a/internal/service/sesv2/email_identity_mail_from_attributes_data_source_test.go b/internal/service/sesv2/email_identity_mail_from_attributes_data_source_test.go
new file mode 100644
index 00000000000..ef9cdda1945
--- /dev/null
+++ b/internal/service/sesv2/email_identity_mail_from_attributes_data_source_test.go
@@ -0,0 +1,60 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package sesv2_test
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/aws/aws-sdk-go-v2/service/sesv2/types"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
+	"github.com/hashicorp/terraform-provider-aws/names"
+)
+
+func TestAccSESV2EmailIdentityMailFromAttributesDataSource_basic(t *testing.T) {
+	ctx := acctest.Context(t)
+	domain := acctest.RandomDomain()
+	mailFromDomain1 := domain.Subdomain("test1")
+
+	rName := domain.String()
+	resourceName := "aws_sesv2_email_identity_mail_from_attributes.test"
+	dataSourceName := "data.aws_sesv2_email_identity_mail_from_attributes.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, names.SESV2EndpointID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckEmailIdentityDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccEmailIdentityMailFromAttributesDataSourceConfig_basic(rName, string(types.BehaviorOnMxFailureRejectMessage), mailFromDomain1.String()),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckEmailIdentityMailFromAttributesExists(ctx, dataSourceName),
+					resource.TestCheckResourceAttrPair(resourceName, "email_identity", dataSourceName, "email_identity"),
+					resource.TestCheckResourceAttrPair(resourceName, "behavior_on_mx_failure", dataSourceName, "behavior_on_mx_failure"),
+					resource.TestCheckResourceAttrPair(resourceName, "mail_from_domain", dataSourceName, "mail_from_domain"),
+				),
+			},
+		},
+	})
+}
+
+func testAccEmailIdentityMailFromAttributesDataSourceConfig_basic(rName, behaviorOnMXFailure, mailFromDomain string) string {
+	return fmt.Sprintf(`
+resource "aws_sesv2_email_identity" "test" {
+  email_identity = %[1]q
+}
+
+resource "aws_sesv2_email_identity_mail_from_attributes" "test" {
+  email_identity         = aws_sesv2_email_identity.test.email_identity
+  behavior_on_mx_failure = %[2]q
+  mail_from_domain       = %[3]q
+}
+
+data "aws_sesv2_email_identity_mail_from_attributes" "test" {
+  email_identity = aws_sesv2_email_identity_mail_from_attributes.test.email_identity
+}
+`, rName, behaviorOnMXFailure, mailFromDomain)
+}
diff --git a/internal/service/sesv2/email_identity_mail_from_attributes_test.go b/internal/service/sesv2/email_identity_mail_from_attributes_test.go
index 7c4a5ecc523..37fe5e1cf5d 100644
--- a/internal/service/sesv2/email_identity_mail_from_attributes_test.go
+++ b/internal/service/sesv2/email_identity_mail_from_attributes_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sesv2_test
 
 import (
diff --git a/internal/service/sesv2/email_identity_test.go b/internal/service/sesv2/email_identity_test.go
index 29d587e0d5e..6125d0b76ad 100644
--- a/internal/service/sesv2/email_identity_test.go
+++ b/internal/service/sesv2/email_identity_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sesv2_test
 
 import (
 	"context"
 	"errors"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/service/sesv2/types"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -35,7 +38,7 @@ func TestAccSESV2EmailIdentity_basic_emailAddress(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckEmailIdentityExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "email_identity", rName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ses", regexp.MustCompile(`identity/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ses", regexache.MustCompile(`identity/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "dkim_signing_attributes.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "dkim_signing_attributes.0.current_signing_key_length", ""),
 					resource.TestCheckResourceAttr(resourceName, "dkim_signing_attributes.0.last_key_generation_timestamp", ""),
@@ -72,7 +75,7 @@ func TestAccSESV2EmailIdentity_basic_domain(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckEmailIdentityExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "email_identity", rName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ses", regexp.MustCompile(`identity/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ses", regexache.MustCompile(`identity/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "dkim_signing_attributes.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "dkim_signing_attributes.0.current_signing_key_length", "RSA_2048_BIT"),
 					acctest.CheckResourceAttrRFC3339(resourceName, "dkim_signing_attributes.0.last_key_generation_timestamp"),
diff --git a/internal/service/sesv2/generate.go b/internal/service/sesv2/generate.go
index 5a1a18b7845..d2c7c7719b4 100644
--- a/internal/service/sesv2/generate.go
+++ b/internal/service/sesv2/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -AWSSDKVersion=2 -ServiceTagsSlice -ListTags -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/sesv2/list.go b/internal/service/sesv2/list.go
index 9f5389386b4..c0c0d505f4a 100644
--- a/internal/service/sesv2/list.go
+++ b/internal/service/sesv2/list.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sesv2
 
 import (
diff --git a/internal/service/sesv2/service_package_gen.go b/internal/service/sesv2/service_package_gen.go
index ec5a4deaf15..8bd83b3cbf8 100644
--- a/internal/service/sesv2/service_package_gen.go
+++ b/internal/service/sesv2/service_package_gen.go
@@ -7,6 +7,7 @@ import (
 
 	aws_sdkv2 "github.com/aws/aws-sdk-go-v2/aws"
 	sesv2_sdkv2 "github.com/aws/aws-sdk-go-v2/service/sesv2"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -31,11 +32,27 @@ func (p *servicePackage) SDKDataSources(ctx context.Context) []*types.ServicePac
 			Factory:  DataSourceDedicatedIPPool,
 			TypeName: "aws_sesv2_dedicated_ip_pool",
 		},
+		{
+			Factory:  DataSourceEmailIdentity,
+			TypeName: "aws_sesv2_email_identity",
+			Tags: &types.ServicePackageResourceTags{
+				IdentifierAttribute: "arn",
+			},
+		},
+		{
+			Factory:  DataSourceEmailIdentityMailFromAttributes,
+			TypeName: "aws_sesv2_email_identity_mail_from_attributes",
+		},
 	}
 }
 
 func (p *servicePackage) SDKResources(ctx context.Context) []*types.ServicePackageSDKResource {
 	return []*types.ServicePackageSDKResource{
+		{
+			Factory:  ResourceAccountVDMAttributes,
+			TypeName: "aws_sesv2_account_vdm_attributes",
+			Name:     "Account VDM Attributes",
+		},
 		{
 			Factory:  ResourceConfigurationSet,
 			TypeName: "aws_sesv2_configuration_set",
@@ -97,9 +114,11 @@ func (p *servicePackage) NewClient(ctx context.Context, config map[string]any) (
 
 	return sesv2_sdkv2.NewFromConfig(cfg, func(o *sesv2_sdkv2.Options) {
 		if endpoint := config["endpoint"].(string); endpoint != "" {
-			o.EndpointResolver = sesv2_sdkv2.EndpointResolverFromURL(endpoint)
+			o.BaseEndpoint = aws_sdkv2.String(endpoint)
 		}
 	}), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/sesv2/sweep.go b/internal/service/sesv2/sweep.go
index 14875616cce..651cfa8a5a2 100644
--- a/internal/service/sesv2/sweep.go
+++ b/internal/service/sesv2/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package sesv2
 
@@ -12,9 +12,10 @@ import (
 	"github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv2"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_sesv2_configuration_set", &resource.Sweeper{
 		Name: "aws_sesv2_configuration_set",
 		F:    sweepConfigurationSets,
@@ -28,7 +29,7 @@ func init() {
 
 func sweepConfigurationSets(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("getting client: %w", err)
@@ -61,11 +62,11 @@ func sweepConfigurationSets(region string) error {
 		errs = multierror.Append(errs, fmt.Errorf("listing Configuration Sets for %s: %w", region, err))
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("sweeping Configuration Sets for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(err) {
+	if awsv2.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Configuration Sets sweep for %s: %s", region, errs)
 		return nil
 	}
@@ -75,7 +76,7 @@ func sweepConfigurationSets(region string) error {
 
 func sweepContactLists(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("getting client: %w", err)
@@ -108,11 +109,11 @@ func sweepContactLists(region string) error {
 		errs = multierror.Append(errs, fmt.Errorf("listing Contact Lists for %s: %w", region, err))
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("sweeping Contact Lists for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(err) {
+	if awsv2.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Contact Lists sweep for %s: %s", region, errs)
 		return nil
 	}
diff --git a/internal/service/sesv2/tags_gen.go b/internal/service/sesv2/tags_gen.go
index c99b1ce1afa..e9747a0cb9f 100644
--- a/internal/service/sesv2/tags_gen.go
+++ b/internal/service/sesv2/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/sesv2"
 	awstypes "github.com/aws/aws-sdk-go-v2/service/sesv2/types"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -102,6 +104,8 @@ func updateTags(ctx context.Context, conn *sesv2.Client, identifier string, oldT
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.SESV2)
 	if len(removedTags) > 0 {
diff --git a/internal/service/sfn/activity.go b/internal/service/sfn/activity.go
index 1b431c14138..815edbde635 100644
--- a/internal/service/sfn/activity.go
+++ b/internal/service/sfn/activity.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sfn
 
 import (
diff --git a/internal/service/sfn/activity_data_source.go b/internal/service/sfn/activity_data_source.go
index 366d537ed2c..c64ed750f55 100644
--- a/internal/service/sfn/activity_data_source.go
+++ b/internal/service/sfn/activity_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sfn
 
 import (
diff --git a/internal/service/sfn/activity_data_source_test.go b/internal/service/sfn/activity_data_source_test.go
index 2eac17b0d6e..c8acb430b5e 100644
--- a/internal/service/sfn/activity_data_source_test.go
+++ b/internal/service/sfn/activity_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sfn_test
 
 import (
diff --git a/internal/service/sfn/activity_test.go b/internal/service/sfn/activity_test.go
index d90502ce5ed..d8360381766 100644
--- a/internal/service/sfn/activity_test.go
+++ b/internal/service/sfn/activity_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sfn_test
 
 import (
diff --git a/internal/service/sfn/alias.go b/internal/service/sfn/alias.go
new file mode 100644
index 00000000000..379acb54360
--- /dev/null
+++ b/internal/service/sfn/alias.go
@@ -0,0 +1,283 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package sfn
+
+import (
+	"context"
+	"errors"
+	"log"
+	"time"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/sfn"
+	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/create"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/names"
+)
+
+// @SDKResource("aws_sfn_alias")
+func ResourceAlias() *schema.Resource {
+	return &schema.Resource{
+		CreateWithoutTimeout: resourceAliasCreate,
+		ReadWithoutTimeout:   resourceAliasRead,
+		UpdateWithoutTimeout: resourceAliasUpdate,
+		DeleteWithoutTimeout: resourceAliasDelete,
+
+		Importer: &schema.ResourceImporter{
+			StateContext: schema.ImportStatePassthroughContext,
+		},
+
+		Timeouts: &schema.ResourceTimeout{
+			Create: schema.DefaultTimeout(30 * time.Minute),
+			Update: schema.DefaultTimeout(30 * time.Minute),
+			Delete: schema.DefaultTimeout(30 * time.Minute),
+		},
+		Schema: map[string]*schema.Schema{
+			"arn": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"creation_date": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"description": {
+				Type:     schema.TypeString,
+				Optional: true,
+			},
+			"name": {
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+			"routing_configuration": {
+				Type:     schema.TypeList,
+				Required: true,
+				MinItems: 1,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"state_machine_version_arn": {
+							Type:     schema.TypeString,
+							Required: true,
+						},
+						"weight": {
+							Type:     schema.TypeInt,
+							Required: true,
+						},
+					},
+				},
+			},
+		},
+	}
+}
+
+const (
+	ResNameAlias = "Alias"
+)
+
+func resourceAliasCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	conn := meta.(*conns.AWSClient).SFNConn(ctx)
+
+	in := &sfn.CreateStateMachineAliasInput{
+		Name:        aws.String(d.Get("name").(string)),
+		Description: aws.String(d.Get("description").(string)),
+	}
+
+	if v, ok := d.GetOk("routing_configuration"); ok && len(v.([]interface{})) > 0 {
+		in.RoutingConfiguration = expandAliasRoutingConfiguration(v.([]interface{}))
+	}
+
+	out, err := conn.CreateStateMachineAliasWithContext(ctx, in)
+	if err != nil {
+		return create.DiagError(names.SFN, create.ErrActionCreating, ResNameAlias, d.Get("name").(string), err)
+	}
+
+	if out == nil || out.StateMachineAliasArn == nil {
+		return create.DiagError(names.SFN, create.ErrActionCreating, ResNameAlias, d.Get("name").(string), errors.New("empty output"))
+	}
+
+	d.SetId(aws.StringValue(out.StateMachineAliasArn))
+
+	return resourceAliasRead(ctx, d, meta)
+}
+
+func resourceAliasRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	conn := meta.(*conns.AWSClient).SFNConn(ctx)
+
+	out, err := FindAliasByARN(ctx, conn, d.Id())
+
+	if !d.IsNewResource() && tfresource.NotFound(err) {
+		log.Printf("[WARN] SFN Alias (%s) not found, removing from state", d.Id())
+		d.SetId("")
+		return nil
+	}
+
+	if err != nil {
+		return create.DiagError(names.SFN, create.ErrActionReading, ResNameAlias, d.Id(), err)
+	}
+
+	d.Set("arn", out.StateMachineAliasArn)
+	d.Set("name", out.Name)
+	d.Set("description", out.Description)
+	d.Set("creation_date", aws.TimeValue(out.CreationDate).Format(time.RFC3339))
+	d.SetId(aws.StringValue(out.StateMachineAliasArn))
+
+	if err := d.Set("routing_configuration", flattenAliasRoutingConfiguration(out.RoutingConfiguration)); err != nil {
+		return create.DiagError(names.SFN, create.ErrActionSetting, ResNameAlias, d.Id(), err)
+	}
+	return nil
+}
+
+func resourceAliasUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	conn := meta.(*conns.AWSClient).SFNConn(ctx)
+
+	update := false
+
+	in := &sfn.UpdateStateMachineAliasInput{
+		StateMachineAliasArn: aws.String(d.Id()),
+	}
+
+	if d.HasChanges("description") {
+		in.Description = aws.String(d.Get("description").(string))
+		update = true
+	}
+
+	if d.HasChange("routing_configuration") {
+		in.RoutingConfiguration = expandAliasRoutingConfiguration(d.Get("routing_configuration").([]interface{}))
+		update = true
+	}
+
+	if !update {
+		return nil
+	}
+
+	log.Printf("[DEBUG] Updating SFN Alias (%s): %#v", d.Id(), in)
+	_, err := conn.UpdateStateMachineAliasWithContext(ctx, in)
+	if err != nil {
+		return create.DiagError(names.SFN, create.ErrActionUpdating, ResNameAlias, d.Id(), err)
+	}
+
+	return resourceAliasRead(ctx, d, meta)
+}
+
+func resourceAliasDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	conn := meta.(*conns.AWSClient).SFNConn(ctx)
+	log.Printf("[INFO] Deleting SFN Alias %s", d.Id())
+
+	_, err := conn.DeleteStateMachineAliasWithContext(ctx, &sfn.DeleteStateMachineAliasInput{
+		StateMachineAliasArn: aws.String(d.Id()),
+	})
+
+	if err != nil {
+		return create.DiagError(names.SFN, create.ErrActionDeleting, ResNameAlias, d.Id(), err)
+	}
+
+	return nil
+}
+
+func FindAliasByARN(ctx context.Context, conn *sfn.SFN, arn string) (*sfn.DescribeStateMachineAliasOutput, error) {
+	in := &sfn.DescribeStateMachineAliasInput{
+		StateMachineAliasArn: aws.String(arn),
+	}
+	out, err := conn.DescribeStateMachineAliasWithContext(ctx, in)
+	if tfawserr.ErrCodeEquals(err, sfn.ErrCodeResourceNotFound) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: in,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	if out == nil {
+		return nil, tfresource.NewEmptyResultError(in)
+	}
+
+	return out, nil
+}
+
+func flattenAliasRoutingConfigurationItem(apiObject *sfn.RoutingConfigurationListItem) map[string]interface{} {
+	if apiObject == nil {
+		return nil
+	}
+
+	tfMap := map[string]interface{}{}
+
+	if v := apiObject.StateMachineVersionArn; v != nil {
+		tfMap["state_machine_version_arn"] = aws.StringValue(v)
+	}
+
+	if v := apiObject.Weight; v != nil {
+		tfMap["weight"] = aws.Int64Value(v)
+	}
+
+	return tfMap
+}
+
+func flattenAliasRoutingConfiguration(apiObjects []*sfn.RoutingConfigurationListItem) []interface{} {
+	if len(apiObjects) == 0 {
+		return nil
+	}
+
+	var tfList []interface{}
+
+	for _, apiObject := range apiObjects {
+		if apiObject == nil {
+			continue
+		}
+
+		tfList = append(tfList, flattenAliasRoutingConfigurationItem(apiObject))
+	}
+
+	return tfList
+}
+
+func expandAliasRoutingConfiguration(tfList []interface{}) []*sfn.RoutingConfigurationListItem {
+	if len(tfList) == 0 {
+		return nil
+	}
+	var configurationListItems []*sfn.RoutingConfigurationListItem
+
+	for _, tfMapRaw := range tfList {
+		tfMap, ok := tfMapRaw.(map[string]interface{})
+
+		if !ok {
+			continue
+		}
+
+		configurationListItem := expandAliasRoutingConfigurationItem(tfMap)
+
+		if configurationListItem == nil {
+			continue
+		}
+
+		configurationListItems = append(configurationListItems, configurationListItem)
+	}
+
+	return configurationListItems
+}
+
+func expandAliasRoutingConfigurationItem(tfMap map[string]interface{}) *sfn.RoutingConfigurationListItem {
+	if tfMap == nil {
+		return nil
+	}
+
+	apiObject := &sfn.RoutingConfigurationListItem{}
+	if v, ok := tfMap["state_machine_version_arn"].(string); ok && v != "" {
+		apiObject.StateMachineVersionArn = aws.String(v)
+	}
+
+	if v, ok := tfMap["weight"].(int); ok && v != 0 {
+		apiObject.Weight = aws.Int64(int64(v))
+	}
+
+	return apiObject
+}
diff --git a/internal/service/sfn/alias_data_source.go b/internal/service/sfn/alias_data_source.go
new file mode 100644
index 00000000000..a0d3724d7a5
--- /dev/null
+++ b/internal/service/sfn/alias_data_source.go
@@ -0,0 +1,115 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package sfn
+
+import (
+	"context"
+	"strings"
+	"time"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/sfn"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/create"
+	"github.com/hashicorp/terraform-provider-aws/names"
+)
+
+// @SDKDataSource("aws_sfn_alias")
+func DataSourceAlias() *schema.Resource {
+	return &schema.Resource{
+		ReadWithoutTimeout: dataSourceAliasRead,
+
+		Schema: map[string]*schema.Schema{
+			"arn": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"creation_date": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"description": {
+				Type:     schema.TypeString,
+				Optional: true,
+			},
+			"name": {
+				Type:     schema.TypeString,
+				Required: true,
+			},
+			"routing_configuration": {
+				Type:     schema.TypeList,
+				Computed: true,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"state_machine_version_arn": {
+							Type:     schema.TypeString,
+							Required: true,
+						},
+						"weight": {
+							Type:     schema.TypeInt,
+							Required: true,
+						},
+					},
+				},
+			},
+			"statemachine_arn": {
+				Type:     schema.TypeString,
+				Required: true,
+			},
+		},
+	}
+}
+
+const (
+	DSNameAlias = "Alias Data Source"
+)
+
+func dataSourceAliasRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	conn := meta.(*conns.AWSClient).SFNConn(ctx)
+	aliasArn := ""
+
+	in := &sfn.ListStateMachineAliasesInput{
+		StateMachineArn: aws.String(d.Get("statemachine_arn").(string)),
+	}
+
+	out, err := conn.ListStateMachineAliasesWithContext(ctx, in)
+
+	if err != nil {
+		return diag.Errorf("listing Step Functions State Machines: %s", err)
+	}
+
+	if n := len(out.StateMachineAliases); n == 0 {
+		return diag.Errorf("no Step Functions State Machine Aliases matched")
+	}
+
+	for _, in := range out.StateMachineAliases {
+		if v := aws.StringValue(in.StateMachineAliasArn); strings.HasSuffix(v, d.Get("name").(string)) {
+			aliasArn = v
+		}
+	}
+
+	if aliasArn == "" {
+		return diag.Errorf("no Step Functions State Machine Aliases matched")
+	}
+
+	output, err := FindAliasByARN(ctx, conn, aliasArn)
+
+	if err != nil {
+		return diag.Errorf("reading Step Functions State Machine Alias (%s): %s", aliasArn, err)
+	}
+
+	d.SetId(aliasArn)
+	d.Set("arn", output.StateMachineAliasArn)
+	d.Set("name", output.Name)
+	d.Set("description", output.Description)
+	d.Set("creation_date", aws.TimeValue(output.CreationDate).Format(time.RFC3339))
+
+	if err := d.Set("routing_configuration", flattenAliasRoutingConfiguration(output.RoutingConfiguration)); err != nil {
+		return create.DiagError(names.SFN, create.ErrActionSetting, ResNameAlias, d.Id(), err)
+	}
+
+	return nil
+}
diff --git a/internal/service/sfn/alias_data_source_test.go b/internal/service/sfn/alias_data_source_test.go
new file mode 100644
index 00000000000..cf1d2c7f992
--- /dev/null
+++ b/internal/service/sfn/alias_data_source_test.go
@@ -0,0 +1,49 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package sfn_test
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/aws/aws-sdk-go/service/sfn"
+	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
+)
+
+func TestAccSFNAliasDataSource_basic(t *testing.T) {
+	ctx := acctest.Context(t)
+	dataSourceName := "data.aws_sfn_alias.test"
+	resourceName := "aws_sfn_alias.test"
+	rString := sdkacctest.RandString(8)
+	stateMachineName := fmt.Sprintf("tf_acc_state_machine_alias_basic_%s", rString)
+	aliasName := fmt.Sprintf("tf_acc_state_machine_alias_basic_%s", rString)
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, sfn.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccAliasDataSourceConfig_basic(stateMachineName, aliasName, 10),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					resource.TestCheckResourceAttrPair(resourceName, "id", dataSourceName, "arn"),
+					resource.TestCheckResourceAttrPair(resourceName, "creation_date", dataSourceName, "creation_date"),
+					resource.TestCheckResourceAttrPair(resourceName, "description", dataSourceName, "description"),
+					resource.TestCheckResourceAttrPair(resourceName, "name", dataSourceName, "name"),
+				),
+			},
+		},
+	})
+}
+
+func testAccAliasDataSourceConfig_basic(statemachineName string, aliasName string, rMaxAttempts int) string {
+	return acctest.ConfigCompose(testAccStateMachineAliasConfig_basic(statemachineName, aliasName, rMaxAttempts), `
+data "aws_sfn_alias" "test" {
+  name             = aws_sfn_alias.test.name
+  statemachine_arn = aws_sfn_state_machine.test.arn
+}
+`)
+}
diff --git a/internal/service/sfn/alias_test.go b/internal/service/sfn/alias_test.go
new file mode 100644
index 00000000000..4bf815ac6f7
--- /dev/null
+++ b/internal/service/sfn/alias_test.go
@@ -0,0 +1,295 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package sfn_test
+
+import (
+	"context"
+	"fmt"
+	"testing"
+
+	"github.com/aws/aws-sdk-go/service/sfn"
+	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
+	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	tfsfn "github.com/hashicorp/terraform-provider-aws/internal/service/sfn"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+)
+
+func TestAccSFNAlias_basic(t *testing.T) {
+	ctx := acctest.Context(t)
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
+	var alias sfn.DescribeStateMachineAliasOutput
+	rString := sdkacctest.RandString(8)
+	stateMachineName := fmt.Sprintf("tf_acc_state_machine_alias_basic_%s", rString)
+	aliasName := fmt.Sprintf("tf_acc_state_machine_alias_basic_%s", rString)
+	resourceName := "aws_sfn_alias.test"
+	functionArnResourcePart := fmt.Sprintf("stateMachine:%s:%s", stateMachineName, aliasName)
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, sfn.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckAliasDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccStateMachineAliasConfig_basic(stateMachineName, aliasName, 10),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAliasExists(ctx, resourceName, &alias),
+					testAccCheckAliasAttributes(&alias),
+					resource.TestCheckResourceAttrSet(resourceName, "creation_date"),
+					resource.TestCheckResourceAttr(resourceName, "name", aliasName),
+					acctest.CheckResourceAttrRegionalARN(resourceName, "arn", "states", functionArnResourcePart),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
+func TestAccSFNAlias_disappears(t *testing.T) {
+	ctx := acctest.Context(t)
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
+	var alias sfn.DescribeStateMachineAliasOutput
+	rString := sdkacctest.RandString(8)
+	stateMachineName := fmt.Sprintf("tf_acc_state_machine_alias_basic_%s", rString)
+	aliasName := fmt.Sprintf("tf_acc_state_machine_alias_basic_%s", rString)
+	resourceName := "aws_sfn_alias.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, sfn.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckAliasDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccStateMachineAliasConfig_basic(stateMachineName, aliasName, 10),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAliasExists(ctx, resourceName, &alias),
+					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfsfn.ResourceAlias(), resourceName),
+				),
+				ExpectNonEmptyPlan: true,
+			},
+		},
+	})
+}
+
+func testAccCheckAliasAttributes(mapping *sfn.DescribeStateMachineAliasOutput) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		name := *mapping.Name
+		arn := *mapping.StateMachineAliasArn
+		if arn == "" {
+			return fmt.Errorf("Could not read StateMachine alias ARN")
+		}
+		if name == "" {
+			return fmt.Errorf("Could not read StateMachine alias name")
+		}
+		return nil
+	}
+}
+
+func testAccCheckAliasDestroy(ctx context.Context) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		conn := acctest.Provider.Meta().(*conns.AWSClient).SFNConn(ctx)
+
+		for _, rs := range s.RootModule().Resources {
+			if rs.Type != "aws_sfn_alias" {
+				continue
+			}
+
+			_, err := tfsfn.FindAliasByARN(ctx, conn, rs.Primary.ID)
+
+			if tfresource.NotFound(err) {
+				continue
+			}
+
+			if err != nil {
+				return err
+			}
+
+			return fmt.Errorf("Step Functions State Machine Alias %s still exists", rs.Primary.ID)
+		}
+
+		return nil
+	}
+}
+
+func testAccCheckAliasExists(ctx context.Context, name string, v *sfn.DescribeStateMachineAliasOutput) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[name]
+		if !ok {
+			return fmt.Errorf("Not found: %s", name)
+		}
+
+		if rs.Primary.ID == "" {
+			return fmt.Errorf("No Step Functions State Machine Alias ID is set")
+		}
+
+		conn := acctest.Provider.Meta().(*conns.AWSClient).SFNConn(ctx)
+
+		output, err := tfsfn.FindAliasByARN(ctx, conn, rs.Primary.ID)
+
+		if err != nil {
+			return err
+		}
+
+		*v = *output
+
+		return nil
+	}
+}
+
+func testAccStateMachineAliasConfig_base(rName string, rMaxAttempts int) string {
+	return fmt.Sprintf(`
+resource "aws_iam_role_policy" "for_lambda" {
+  name = "%[1]s-lambda"
+  role = aws_iam_role.for_lambda.id
+
+  policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [{
+    "Effect": "Allow",
+    "Action": [
+      "logs:CreateLogGroup",
+      "logs:CreateLogStream",
+      "logs:PutLogEvents"
+    ],
+    "Resource": "arn:${data.aws_partition.current.partition}:logs:*:*:*"
+  }]
+}
+EOF
+}
+
+resource "aws_iam_role" "for_lambda" {
+  name = "%[1]s-lambda"
+
+  assume_role_policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [{
+    "Action": "sts:AssumeRole",
+    "Principal": {
+      "Service": "lambda.amazonaws.com"
+    },
+    "Effect": "Allow"
+  }]
+}
+EOF
+}
+
+resource "aws_lambda_function" "test" {
+  filename      = "test-fixtures/lambdatest.zip"
+  function_name = %[1]q
+  role          = aws_iam_role.for_lambda.arn
+  handler       = "exports.example"
+  runtime       = "nodejs16.x"
+}
+
+data "aws_region" "current" {}
+
+data "aws_partition" "current" {}
+
+resource "aws_iam_role_policy" "for_sfn" {
+  name = "%[1]s-sfn"
+  role = aws_iam_role.for_sfn.id
+
+  policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [{
+    "Effect": "Allow",
+    "Action": [
+      "lambda:InvokeFunction",
+      "logs:CreateLogDelivery",
+      "logs:GetLogDelivery",
+      "logs:UpdateLogDelivery",
+      "logs:DeleteLogDelivery",
+      "logs:ListLogDeliveries",
+      "logs:PutResourcePolicy",
+      "logs:DescribeResourcePolicies",
+      "logs:DescribeLogGroups",
+      "xray:PutTraceSegments",
+      "xray:PutTelemetryRecords",
+      "xray:GetSamplingRules",
+      "xray:GetSamplingTargets"
+    ],
+    "Resource": "*"
+  }]
+}
+EOF
+}
+
+resource "aws_iam_role" "for_sfn" {
+  name = "%[1]s-sfn"
+
+  assume_role_policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [{
+    "Effect": "Allow",
+    "Principal": {
+      "Service": "states.${data.aws_region.current.name}.amazonaws.com"
+    },
+    "Action": "sts:AssumeRole"
+  }]
+}
+EOF
+}
+
+resource "aws_sfn_state_machine" "test" {
+  name     = %[1]q
+  publish  = true
+  role_arn = aws_iam_role.for_sfn.arn
+
+  definition = <<EOF
+  {
+	"Comment": "A Hello World example of the Amazon States Language using an AWS Lambda Function",
+	"StartAt": "HelloWorld",
+	"States": {
+	  "HelloWorld": {
+		"Type": "Task",
+		"Resource": "${aws_lambda_function.test.arn}",
+		"Retry": [
+		  {
+			"ErrorEquals": [
+			  "States.ALL"
+			],
+			"IntervalSeconds": 5,
+			"MaxAttempts": %[2]d,
+			"BackoffRate": 8
+		  }
+		],
+		"End": true
+	  }
+	}
+  }
+EOF
+}
+`, rName, rMaxAttempts)
+}
+
+func testAccStateMachineAliasConfig_basic(statemachineName string, aliasName string, rMaxAttempts int) string {
+	return acctest.ConfigCompose(testAccStateMachineAliasConfig_base(statemachineName, rMaxAttempts), fmt.Sprintf(`
+resource "aws_sfn_alias" "test" {
+  name = %[1]q
+
+  routing_configuration {
+    state_machine_version_arn = aws_sfn_state_machine.test.state_machine_version_arn
+    weight                    = 100
+  }
+}
+`, aliasName))
+}
diff --git a/internal/service/sfn/generate.go b/internal/service/sfn/generate.go
index ec2c7a06a6b..5b3d8d3fe08 100644
--- a/internal/service/sfn/generate.go
+++ b/internal/service/sfn/generate.go
@@ -1,3 +1,7 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+//go:generate go run ../../generate/listpages/main.go -ListOps=ListStateMachineVersions
 //go:generate go run ../../generate/tags/main.go -ListTags -ServiceTagsSlice -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/sfn/list_pages_gen.go b/internal/service/sfn/list_pages_gen.go
new file mode 100644
index 00000000000..cd37e2773e3
--- /dev/null
+++ b/internal/service/sfn/list_pages_gen.go
@@ -0,0 +1,28 @@
+// Code generated by "internal/generate/listpages/main.go -ListOps=ListStateMachineVersions"; DO NOT EDIT.
+
+package sfn
+
+import (
+	"context"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/sfn"
+	"github.com/aws/aws-sdk-go/service/sfn/sfniface"
+)
+
+func listStateMachineVersionsPages(ctx context.Context, conn sfniface.SFNAPI, input *sfn.ListStateMachineVersionsInput, fn func(*sfn.ListStateMachineVersionsOutput, bool) bool) error {
+	for {
+		output, err := conn.ListStateMachineVersionsWithContext(ctx, input)
+		if err != nil {
+			return err
+		}
+
+		lastPage := aws.StringValue(output.NextToken) == ""
+		if !fn(output, lastPage) || lastPage {
+			break
+		}
+
+		input.NextToken = output.NextToken
+	}
+	return nil
+}
diff --git a/internal/service/sfn/service_package_gen.go b/internal/service/sfn/service_package_gen.go
index b46f65a5f8a..69f79c7ab52 100644
--- a/internal/service/sfn/service_package_gen.go
+++ b/internal/service/sfn/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	sfn_sdkv1 "github.com/aws/aws-sdk-go/service/sfn"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -28,10 +29,18 @@ func (p *servicePackage) SDKDataSources(ctx context.Context) []*types.ServicePac
 			Factory:  DataSourceActivity,
 			TypeName: "aws_sfn_activity",
 		},
+		{
+			Factory:  DataSourceAlias,
+			TypeName: "aws_sfn_alias",
+		},
 		{
 			Factory:  DataSourceStateMachine,
 			TypeName: "aws_sfn_state_machine",
 		},
+		{
+			Factory:  DataSourceStateMachineVersions,
+			TypeName: "aws_sfn_state_machine_versions",
+		},
 	}
 }
 
@@ -45,6 +54,10 @@ func (p *servicePackage) SDKResources(ctx context.Context) []*types.ServicePacka
 				IdentifierAttribute: "id",
 			},
 		},
+		{
+			Factory:  ResourceAlias,
+			TypeName: "aws_sfn_alias",
+		},
 		{
 			Factory:  ResourceStateMachine,
 			TypeName: "aws_sfn_state_machine",
@@ -67,4 +80,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*s
 	return sfn_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/sfn/state_machine.go b/internal/service/sfn/state_machine.go
index d5281cf2409..16354d231d9 100644
--- a/internal/service/sfn/state_machine.go
+++ b/internal/service/sfn/state_machine.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sfn
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/sfn"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -56,6 +59,10 @@ func ResourceStateMachine() *schema.Resource {
 				Required:     true,
 				ValidateFunc: validation.StringLenBetween(0, 1024*1024), // 1048576
 			},
+			"description": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
 			"logging_configuration": {
 				Type:     schema.TypeList,
 				Optional: true,
@@ -88,7 +95,7 @@ func ResourceStateMachine() *schema.Resource {
 				ConflictsWith: []string{"name_prefix"},
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 80),
-					validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9-_]+$`), "the name should only contain 0-9, A-Z, a-z, - and _"),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_-]+$`), "the name should only contain 0-9, A-Z, a-z, - and _"),
 				),
 			},
 			"name_prefix": {
@@ -99,18 +106,31 @@ func ResourceStateMachine() *schema.Resource {
 				ConflictsWith: []string{"name"},
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 80-id.UniqueIDSuffixLength),
-					validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9-_]+$`), "the name should only contain 0-9, A-Z, a-z, - and _"),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_-]+$`), "the name should only contain 0-9, A-Z, a-z, - and _"),
 				),
 			},
+			"publish": {
+				Type:     schema.TypeBool,
+				Default:  false,
+				Optional: true,
+			},
 			"role_arn": {
 				Type:         schema.TypeString,
 				Required:     true,
 				ValidateFunc: verify.ValidARN,
 			},
+			"revision_id": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
 			"status": {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
+			"state_machine_version_arn": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
 			names.AttrTags:    tftags.TagsSchema(),
 			names.AttrTagsAll: tftags.TagsSchemaComputed(),
 			"tracing_configuration": {
@@ -135,6 +155,10 @@ func ResourceStateMachine() *schema.Resource {
 				Default:      sfn.StateMachineTypeStandard,
 				ValidateFunc: validation.StringInSlice(sfn.StateMachineType_Values(), false),
 			},
+			"version_description": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
 		},
 
 		CustomizeDiff: verify.SetTagsDiff,
@@ -148,6 +172,7 @@ func resourceStateMachineCreate(ctx context.Context, d *schema.ResourceData, met
 	input := &sfn.CreateStateMachineInput{
 		Definition: aws.String(d.Get("definition").(string)),
 		Name:       aws.String(name),
+		Publish:    aws.Bool(d.Get("publish").(bool)),
 		RoleArn:    aws.String(d.Get("role_arn").(string)),
 		Tags:       getTagsIn(ctx),
 		Type:       aws.String(d.Get("type").(string)),
@@ -173,7 +198,8 @@ func resourceStateMachineCreate(ctx context.Context, d *schema.ResourceData, met
 		return diag.Errorf("creating Step Functions State Machine (%s): %s", name, err)
 	}
 
-	d.SetId(aws.StringValue(outputRaw.(*sfn.CreateStateMachineOutput).StateMachineArn))
+	arn := aws.StringValue(outputRaw.(*sfn.CreateStateMachineOutput).StateMachineArn)
+	d.SetId(arn)
 
 	return resourceStateMachineRead(ctx, d, meta)
 }
@@ -200,6 +226,7 @@ func resourceStateMachineRead(ctx context.Context, d *schema.ResourceData, meta
 		d.Set("creation_date", nil)
 	}
 	d.Set("definition", output.Definition)
+	d.Set("description", output.Description)
 	if output.LoggingConfiguration != nil {
 		if err := d.Set("logging_configuration", []interface{}{flattenLoggingConfiguration(output.LoggingConfiguration)}); err != nil {
 			return diag.Errorf("setting logging_configuration: %s", err)
@@ -209,7 +236,9 @@ func resourceStateMachineRead(ctx context.Context, d *schema.ResourceData, meta
 	}
 	d.Set("name", output.Name)
 	d.Set("name_prefix", create.NamePrefixFromName(aws.StringValue(output.Name)))
+	d.Set("publish", d.Get("publish").(bool))
 	d.Set("role_arn", output.RoleArn)
+	d.Set("revision_id", output.RevisionId)
 	d.Set("status", output.Status)
 	if output.TracingConfiguration != nil {
 		if err := d.Set("tracing_configuration", []interface{}{flattenTracingConfiguration(output.TracingConfiguration)}); err != nil {
@@ -220,6 +249,23 @@ func resourceStateMachineRead(ctx context.Context, d *schema.ResourceData, meta
 	}
 	d.Set("type", output.Type)
 
+	input := &sfn.ListStateMachineVersionsInput{
+		StateMachineArn: aws.String(d.Id()),
+	}
+	listVersionsOutput, err := conn.ListStateMachineVersionsWithContext(ctx, input)
+
+	if err != nil {
+		return diag.Errorf("listing Step Functions State Machine (%s) Versions: %s", d.Id(), err)
+	}
+
+	// The results are sorted in descending order of the version creation time.
+	// https://docs.aws.amazon.com/step-functions/latest/apireference/API_ListStateMachineVersions.html
+	if len(listVersionsOutput.StateMachineVersions) > 0 {
+		d.Set("state_machine_version_arn", listVersionsOutput.StateMachineVersions[0].StateMachineVersionArn)
+	} else {
+		d.Set("state_machine_version_arn", nil)
+	}
+
 	return nil
 }
 
@@ -232,6 +278,11 @@ func resourceStateMachineUpdate(ctx context.Context, d *schema.ResourceData, met
 			Definition:      aws.String(d.Get("definition").(string)),
 			RoleArn:         aws.String(d.Get("role_arn").(string)),
 			StateMachineArn: aws.String(d.Id()),
+			Publish:         aws.Bool(d.Get("publish").(bool)),
+		}
+
+		if v, ok := d.GetOk("publish"); ok && v == true {
+			input.VersionDescription = aws.String(d.Get("version_description").(string))
 		}
 
 		if d.HasChange("logging_configuration") {
@@ -262,6 +313,7 @@ func resourceStateMachineUpdate(ctx context.Context, d *schema.ResourceData, met
 
 			if d.HasChange("definition") && !verify.JSONBytesEqual([]byte(aws.StringValue(output.Definition)), []byte(d.Get("definition").(string))) ||
 				d.HasChange("role_arn") && aws.StringValue(output.RoleArn) != d.Get("role_arn").(string) ||
+				//d.HasChange("publish") && aws.Bool(output.Publish) != d.Get("publish").(bool) ||
 				d.HasChange("tracing_configuration.0.enabled") && output.TracingConfiguration != nil && aws.BoolValue(output.TracingConfiguration.Enabled) != d.Get("tracing_configuration.0.enabled").(bool) ||
 				d.HasChange("logging_configuration.0.include_execution_data") && output.LoggingConfiguration != nil && aws.BoolValue(output.LoggingConfiguration.IncludeExecutionData) != d.Get("logging_configuration.0.include_execution_data").(bool) ||
 				d.HasChange("logging_configuration.0.level") && output.LoggingConfiguration != nil && aws.StringValue(output.LoggingConfiguration.Level) != d.Get("logging_configuration.0.level").(string) {
diff --git a/internal/service/sfn/state_machine_data_source.go b/internal/service/sfn/state_machine_data_source.go
index b616409e51c..b4823518309 100644
--- a/internal/service/sfn/state_machine_data_source.go
+++ b/internal/service/sfn/state_machine_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sfn
 
 import (
@@ -29,6 +32,10 @@ func DataSourceStateMachine() *schema.Resource {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
+			"description": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
 			"name": {
 				Type:     schema.TypeString,
 				Required: true,
@@ -37,6 +44,10 @@ func DataSourceStateMachine() *schema.Resource {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
+			"revision_id": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
 			"status": {
 				Type:     schema.TypeString,
 				Computed: true,
@@ -85,9 +96,11 @@ func dataSourceStateMachineRead(ctx context.Context, d *schema.ResourceData, met
 	d.SetId(arn)
 	d.Set("arn", output.StateMachineArn)
 	d.Set("creation_date", output.CreationDate.Format(time.RFC3339))
+	d.Set("description", output.Description)
 	d.Set("definition", output.Definition)
 	d.Set("name", output.Name)
 	d.Set("role_arn", output.RoleArn)
+	d.Set("revision_id", output.RevisionId)
 	d.Set("status", output.Status)
 
 	return nil
diff --git a/internal/service/sfn/state_machine_data_source_test.go b/internal/service/sfn/state_machine_data_source_test.go
index 10f96b98510..994ad191ace 100644
--- a/internal/service/sfn/state_machine_data_source_test.go
+++ b/internal/service/sfn/state_machine_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sfn_test
 
 import (
@@ -28,6 +31,7 @@ func TestAccSFNStateMachineDataSource_basic(t *testing.T) {
 					resource.TestCheckResourceAttrPair(resourceName, "definition", dataSourceName, "definition"),
 					resource.TestCheckResourceAttrPair(resourceName, "name", dataSourceName, "name"),
 					resource.TestCheckResourceAttrPair(resourceName, "role_arn", dataSourceName, "role_arn"),
+					resource.TestCheckResourceAttrPair(resourceName, "revision_id", dataSourceName, "revision_id"),
 					resource.TestCheckResourceAttrPair(resourceName, "status", dataSourceName, "status"),
 				),
 			},
diff --git a/internal/service/sfn/state_machine_test.go b/internal/service/sfn/state_machine_test.go
index d5df334d1d2..4c37459f620 100644
--- a/internal/service/sfn/state_machine_test.go
+++ b/internal/service/sfn/state_machine_test.go
@@ -1,11 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sfn_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
+	"strings"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/sfn"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -32,7 +36,7 @@ func TestAccSFNStateMachine_createUpdate(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config: testAccStateMachineConfig_basic(rName, 5),
-				Check: resource.ComposeTestCheckFunc(
+				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckExists(ctx, resourceName, &sm),
 					acctest.CheckResourceAttrRegionalARN(resourceName, "arn", "states", fmt.Sprintf("stateMachine:%s", rName)),
 					resource.TestCheckResourceAttr(resourceName, "status", sfn.StateMachineStatusActive),
@@ -40,12 +44,15 @@ func TestAccSFNStateMachine_createUpdate(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "name_prefix", ""),
 					resource.TestCheckResourceAttrSet(resourceName, "creation_date"),
 					resource.TestCheckResourceAttrSet(resourceName, "definition"),
-					resource.TestMatchResourceAttr(resourceName, "definition", regexp.MustCompile(`.*\"MaxAttempts\": 5.*`)),
+					resource.TestMatchResourceAttr(resourceName, "definition", regexache.MustCompile(`.*\"MaxAttempts\": 5.*`)),
 					resource.TestCheckResourceAttrPair(resourceName, "role_arn", roleResourceName, "arn"),
 					resource.TestCheckResourceAttr(resourceName, "logging_configuration.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "logging_configuration.0.include_execution_data", "false"),
 					resource.TestCheckResourceAttr(resourceName, "logging_configuration.0.level", "OFF"),
 					resource.TestCheckResourceAttr(resourceName, "logging_configuration.0.log_destination", ""),
+					resource.TestCheckResourceAttr(resourceName, "publish", "false"),
+					resource.TestCheckResourceAttr(resourceName, "revision_id", ""),
+					resource.TestCheckResourceAttr(resourceName, "state_machine_version_arn", ""),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 					resource.TestCheckResourceAttr(resourceName, "tracing_configuration.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tracing_configuration.0.enabled", "false"),
@@ -59,18 +66,20 @@ func TestAccSFNStateMachine_createUpdate(t *testing.T) {
 			},
 			{
 				Config: testAccStateMachineConfig_basic(rName, 10),
-				Check: resource.ComposeTestCheckFunc(
+				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckExists(ctx, resourceName, &sm),
 					acctest.CheckResourceAttrRegionalARN(resourceName, "arn", "states", fmt.Sprintf("stateMachine:%s", rName)),
 					resource.TestCheckResourceAttr(resourceName, "status", sfn.StateMachineStatusActive),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttrSet(resourceName, "creation_date"),
-					resource.TestMatchResourceAttr(resourceName, "definition", regexp.MustCompile(`.*\"MaxAttempts\": 10.*`)),
+					resource.TestMatchResourceAttr(resourceName, "definition", regexache.MustCompile(`.*\"MaxAttempts\": 10.*`)),
 					resource.TestCheckResourceAttrPair(resourceName, "role_arn", roleResourceName, "arn"),
 					resource.TestCheckResourceAttr(resourceName, "logging_configuration.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "logging_configuration.0.include_execution_data", "false"),
 					resource.TestCheckResourceAttr(resourceName, "logging_configuration.0.level", "OFF"),
 					resource.TestCheckResourceAttr(resourceName, "logging_configuration.0.log_destination", ""),
+					resource.TestCheckResourceAttr(resourceName, "publish", "false"),
+					resource.TestCheckResourceAttr(resourceName, "state_machine_version_arn", ""),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 					resource.TestCheckResourceAttr(resourceName, "tracing_configuration.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tracing_configuration.0.enabled", "false"),
@@ -95,26 +104,41 @@ func TestAccSFNStateMachine_expressUpdate(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config: testAccStateMachineConfig_typed(rName, "EXPRESS", 5),
-				Check: resource.ComposeTestCheckFunc(
+				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckExists(ctx, resourceName, &sm),
 					resource.TestCheckResourceAttr(resourceName, "status", sfn.StateMachineStatusActive),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttrSet(resourceName, "creation_date"),
 					resource.TestCheckResourceAttrSet(resourceName, "definition"),
-					resource.TestMatchResourceAttr(resourceName, "definition", regexp.MustCompile(`.*\"MaxAttempts\": 5.*`)),
+					resource.TestMatchResourceAttr(resourceName, "definition", regexache.MustCompile(`.*\"MaxAttempts\": 5.*`)),
+					resource.TestCheckResourceAttr(resourceName, "revision_id", ""),
 					resource.TestCheckResourceAttrSet(resourceName, "role_arn"),
+					resource.TestCheckResourceAttrWith(resourceName, "state_machine_version_arn", func(value string) error {
+						if !strings.HasSuffix(value, ":1") {
+							return fmt.Errorf("incorrect version number: %s", value)
+						}
+
+						return nil
+					}),
 					resource.TestCheckResourceAttr(resourceName, "type", "EXPRESS"),
 				),
 			},
 			{
 				Config: testAccStateMachineConfig_typed(rName, "EXPRESS", 10),
-				Check: resource.ComposeTestCheckFunc(
+				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckExists(ctx, resourceName, &sm),
 					resource.TestCheckResourceAttr(resourceName, "status", sfn.StateMachineStatusActive),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttrSet(resourceName, "creation_date"),
-					resource.TestMatchResourceAttr(resourceName, "definition", regexp.MustCompile(`.*\"MaxAttempts\": 10.*`)),
+					resource.TestMatchResourceAttr(resourceName, "definition", regexache.MustCompile(`.*\"MaxAttempts\": 10.*`)),
 					resource.TestCheckResourceAttrSet(resourceName, "role_arn"),
+					resource.TestCheckResourceAttrWith(resourceName, "state_machine_version_arn", func(value string) error {
+						if !strings.HasSuffix(value, ":2") {
+							return fmt.Errorf("incorrect version number: %s", value)
+						}
+
+						return nil
+					}),
 					resource.TestCheckResourceAttr(resourceName, "type", "EXPRESS"),
 				),
 			},
@@ -136,26 +160,43 @@ func TestAccSFNStateMachine_standardUpdate(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config: testAccStateMachineConfig_typed(rName, "STANDARD", 5),
-				Check: resource.ComposeTestCheckFunc(
+				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckExists(ctx, resourceName, &sm),
 					resource.TestCheckResourceAttr(resourceName, "status", sfn.StateMachineStatusActive),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttrSet(resourceName, "creation_date"),
 					resource.TestCheckResourceAttrSet(resourceName, "definition"),
-					resource.TestMatchResourceAttr(resourceName, "definition", regexp.MustCompile(`.*\"MaxAttempts\": 5.*`)),
+					resource.TestMatchResourceAttr(resourceName, "definition", regexache.MustCompile(`.*\"MaxAttempts\": 5.*`)),
+					resource.TestCheckResourceAttr(resourceName, "publish", "true"),
+					resource.TestCheckResourceAttr(resourceName, "revision_id", ""),
 					resource.TestCheckResourceAttrSet(resourceName, "role_arn"),
+					resource.TestCheckResourceAttrWith(resourceName, "state_machine_version_arn", func(value string) error {
+						if !strings.HasSuffix(value, ":1") {
+							return fmt.Errorf("incorrect version number: %s", value)
+						}
+
+						return nil
+					}),
 					resource.TestCheckResourceAttr(resourceName, "type", "STANDARD"),
 				),
 			},
 			{
 				Config: testAccStateMachineConfig_typed(rName, "STANDARD", 10),
-				Check: resource.ComposeTestCheckFunc(
+				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckExists(ctx, resourceName, &sm),
 					resource.TestCheckResourceAttr(resourceName, "status", sfn.StateMachineStatusActive),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttrSet(resourceName, "creation_date"),
-					resource.TestMatchResourceAttr(resourceName, "definition", regexp.MustCompile(`.*\"MaxAttempts\": 10.*`)),
+					resource.TestMatchResourceAttr(resourceName, "definition", regexache.MustCompile(`.*\"MaxAttempts\": 10.*`)),
+					resource.TestCheckResourceAttr(resourceName, "publish", "true"),
 					resource.TestCheckResourceAttrSet(resourceName, "role_arn"),
+					resource.TestCheckResourceAttrWith(resourceName, "state_machine_version_arn", func(value string) error {
+						if !strings.HasSuffix(value, ":2") {
+							return fmt.Errorf("incorrect version number: %s", value)
+						}
+
+						return nil
+					}),
 					resource.TestCheckResourceAttr(resourceName, "type", "STANDARD"),
 				),
 			},
@@ -221,6 +262,36 @@ func TestAccSFNStateMachine_namePrefix(t *testing.T) {
 	})
 }
 
+func TestAccSFNStateMachine_publish(t *testing.T) {
+	ctx := acctest.Context(t)
+	var sm sfn.DescribeStateMachineOutput
+	resourceName := "aws_sfn_state_machine.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, sfn.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckStateMachineDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccStateMachineConfig_publish(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckExists(ctx, resourceName, &sm),
+					resource.TestCheckResourceAttr(resourceName, "publish", "true"),
+					resource.TestCheckResourceAttrSet(resourceName, "state_machine_version_arn"),
+				),
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"publish"},
+			},
+		},
+	})
+}
+
 func TestAccSFNStateMachine_tags(t *testing.T) {
 	ctx := acctest.Context(t)
 	var sm sfn.DescribeStateMachineOutput
@@ -348,7 +419,7 @@ func TestAccSFNStateMachine_expressLogging(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttrSet(resourceName, "creation_date"),
 					resource.TestCheckResourceAttrSet(resourceName, "definition"),
-					resource.TestMatchResourceAttr(resourceName, "definition", regexp.MustCompile(`.*\"MaxAttempts\": 5.*`)),
+					resource.TestMatchResourceAttr(resourceName, "definition", regexache.MustCompile(`.*\"MaxAttempts\": 5.*`)),
 					resource.TestCheckResourceAttrSet(resourceName, "role_arn"),
 					resource.TestCheckResourceAttr(resourceName, "logging_configuration.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "logging_configuration.0.level", sfn.LogLevelError),
@@ -361,7 +432,7 @@ func TestAccSFNStateMachine_expressLogging(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "status", sfn.StateMachineStatusActive),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttrSet(resourceName, "creation_date"),
-					resource.TestMatchResourceAttr(resourceName, "definition", regexp.MustCompile(`.*\"MaxAttempts\": 5.*`)),
+					resource.TestMatchResourceAttr(resourceName, "definition", regexache.MustCompile(`.*\"MaxAttempts\": 5.*`)),
 					resource.TestCheckResourceAttrSet(resourceName, "role_arn"),
 					resource.TestCheckResourceAttr(resourceName, "logging_configuration.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "logging_configuration.0.level", sfn.LogLevelAll),
@@ -620,6 +691,39 @@ EOF
 `, namePrefix))
 }
 
+func testAccStateMachineConfig_publish(rName string) string {
+	return acctest.ConfigCompose(testAccStateMachineConfig_base(rName), `
+resource "aws_sfn_state_machine" "test" {
+  role_arn = aws_iam_role.for_sfn.arn
+  publish  = true
+
+  definition = <<EOF
+{
+  "Comment": "A Hello World example of the Amazon States Language using an AWS Lambda Function",
+  "StartAt": "HelloWorld",
+  "States": {
+    "HelloWorld": {
+      "Type": "Task",
+      "Resource": "${aws_lambda_function.test.arn}",
+      "Retry": [
+        {
+          "ErrorEquals": [
+            "States.ALL"
+          ],
+          "IntervalSeconds": 5,
+          "MaxAttempts": 5,
+          "BackoffRate": 8
+        }
+      ],
+      "End": true
+    }
+  }
+}
+EOF
+}
+`)
+}
+
 func testAccStateMachineConfig_tags1(rName, tag1Key, tag1Value string) string {
 	return acctest.ConfigCompose(testAccStateMachineConfig_base(rName), fmt.Sprintf(`
 resource "aws_sfn_state_machine" "test" {
@@ -701,6 +805,7 @@ resource "aws_sfn_state_machine" "test" {
   name     = %[1]q
   role_arn = aws_iam_role.for_sfn.arn
   type     = %[2]q
+  publish  = true
 
   definition = <<EOF
 {
diff --git a/internal/service/sfn/state_machine_versions_data_source.go b/internal/service/sfn/state_machine_versions_data_source.go
new file mode 100644
index 00000000000..babbb6b089a
--- /dev/null
+++ b/internal/service/sfn/state_machine_versions_data_source.go
@@ -0,0 +1,70 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package sfn
+
+import (
+	"context"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/sfn"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
+	"github.com/hashicorp/terraform-provider-aws/internal/verify"
+)
+
+// @SDKDataSource("aws_sfn_state_machine_versions")
+func DataSourceStateMachineVersions() *schema.Resource {
+	return &schema.Resource{
+		ReadWithoutTimeout: dataSourceStateMachineVersionsRead,
+
+		Schema: map[string]*schema.Schema{
+			"statemachine_arn": {
+				Type:         schema.TypeString,
+				Required:     true,
+				ValidateFunc: verify.ValidARN,
+			},
+			"statemachine_versions": {
+				Type:     schema.TypeList,
+				Computed: true,
+				Elem:     &schema.Schema{Type: schema.TypeString},
+			},
+		},
+	}
+}
+
+func dataSourceStateMachineVersionsRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).SFNConn(ctx)
+
+	smARN := d.Get("statemachine_arn").(string)
+	input := &sfn.ListStateMachineVersionsInput{
+		StateMachineArn: aws.String(smARN),
+	}
+	var smvARNs []string
+
+	err := listStateMachineVersionsPages(ctx, conn, input, func(page *sfn.ListStateMachineVersionsOutput, lastPage bool) bool {
+		if page == nil {
+			return !lastPage
+		}
+
+		for _, v := range page.StateMachineVersions {
+			if v != nil {
+				smvARNs = append(smvARNs, aws.StringValue(v.StateMachineVersionArn))
+			}
+		}
+
+		return !lastPage
+	})
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "listing Step Functions State Machine (%s) Versions: %s", smARN, err)
+	}
+
+	d.SetId(smARN)
+	d.Set("statemachine_versions", smvARNs)
+
+	return diags
+}
diff --git a/internal/service/sfn/state_machine_versions_data_source_test.go b/internal/service/sfn/state_machine_versions_data_source_test.go
new file mode 100644
index 00000000000..9a97da68549
--- /dev/null
+++ b/internal/service/sfn/state_machine_versions_data_source_test.go
@@ -0,0 +1,43 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package sfn_test
+
+import (
+	"testing"
+
+	"github.com/aws/aws-sdk-go/service/sfn"
+	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
+)
+
+func TestAccSFNStateMachineVersionsDataSource_basic(t *testing.T) {
+	ctx := acctest.Context(t)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	dataSourceName := "data.aws_sfn_state_machine_versions.test"
+	resourceName := "aws_sfn_state_machine.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, sfn.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccStateMachineVersionsDataSourceConfig_basic(rName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					resource.TestCheckResourceAttrPair(resourceName, "id", dataSourceName, "statemachine_arn"),
+					resource.TestCheckResourceAttr(dataSourceName, "statemachine_versions.#", "1"),
+				),
+			},
+		},
+	})
+}
+
+func testAccStateMachineVersionsDataSourceConfig_basic(rName string) string {
+	return acctest.ConfigCompose(testAccStateMachineAliasConfig_base(rName, 5), `
+data "aws_sfn_state_machine_versions" "test" {
+  statemachine_arn = aws_sfn_state_machine.test.arn
+}
+`)
+}
diff --git a/internal/service/sfn/sweep.go b/internal/service/sfn/sweep.go
index e2199c62048..01c846d6b3f 100644
--- a/internal/service/sfn/sweep.go
+++ b/internal/service/sfn/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package sfn
 
@@ -11,9 +11,10 @@ import (
 	"github.com/aws/aws-sdk-go/service/sfn"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_sfn_activity", &resource.Sweeper{
 		Name: "aws_sfn_activity",
 		F:    sweepActivities,
@@ -27,7 +28,7 @@ func init() {
 
 func sweepActivities(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -51,7 +52,7 @@ func sweepActivities(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Step Functions Activity sweep for %s: %s", region, err)
 		return nil
 	}
@@ -60,7 +61,7 @@ func sweepActivities(region string) error {
 		return fmt.Errorf("error listing Step Functions Activities (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping Step Functions Activities (%s): %w", region, err)
@@ -71,7 +72,7 @@ func sweepActivities(region string) error {
 
 func sweepStateMachines(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -95,7 +96,7 @@ func sweepStateMachines(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Step Functions State Machine sweep for %s: %s", region, err)
 		return nil
 	}
@@ -104,7 +105,7 @@ func sweepStateMachines(region string) error {
 		return fmt.Errorf("error listing Step Functions State Machines (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping Step Functions State Machines (%s): %w", region, err)
diff --git a/internal/service/sfn/tags_gen.go b/internal/service/sfn/tags_gen.go
index 2897ba0b73b..b5baaf5fd8e 100644
--- a/internal/service/sfn/tags_gen.go
+++ b/internal/service/sfn/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/sfn"
 	"github.com/aws/aws-sdk-go/service/sfn/sfniface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -102,6 +104,8 @@ func updateTags(ctx context.Context, conn sfniface.SFNAPI, identifier string, ol
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.SFN)
 	if len(removedTags) > 0 {
diff --git a/internal/service/shield/application_layer_automatic_response.go b/internal/service/shield/application_layer_automatic_response.go
new file mode 100644
index 00000000000..eb8dcc894ad
--- /dev/null
+++ b/internal/service/shield/application_layer_automatic_response.go
@@ -0,0 +1,404 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package shield
+
+import (
+	"context"
+	"errors"
+	"time"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/shield"
+	"github.com/hashicorp/terraform-plugin-framework-timeouts/resource/timeouts"
+	"github.com/hashicorp/terraform-plugin-framework-validators/stringvalidator"
+	"github.com/hashicorp/terraform-plugin-framework/path"
+	"github.com/hashicorp/terraform-plugin-framework/resource"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema/planmodifier"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema/stringplanmodifier"
+	"github.com/hashicorp/terraform-plugin-framework/schema/validator"
+	"github.com/hashicorp/terraform-plugin-framework/types"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
+	"github.com/hashicorp/terraform-provider-aws/internal/create"
+	"github.com/hashicorp/terraform-provider-aws/internal/framework"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/names"
+)
+
+// @FrameworkResource(name="Application Layer Automatic Response")
+func newResourceApplicationLayerAutomaticResponse(_ context.Context) (resource.ResourceWithConfigure, error) {
+	r := &resourceApplicationLayerAutomaticResponse{}
+
+	r.SetDefaultCreateTimeout(30 * time.Minute)
+	r.SetDefaultUpdateTimeout(30 * time.Minute)
+	r.SetDefaultDeleteTimeout(30 * time.Minute)
+
+	return r, nil
+}
+
+const (
+	ResNameApplicationLayerAutomaticResponse = "Application Layer Automatic Response"
+)
+
+type resourceApplicationLayerAutomaticResponse struct {
+	framework.ResourceWithConfigure
+	framework.WithTimeouts
+}
+
+func (r *resourceApplicationLayerAutomaticResponse) Metadata(_ context.Context, req resource.MetadataRequest, resp *resource.MetadataResponse) {
+	resp.TypeName = "aws_shield_application_layer_automatic_response"
+}
+
+func (r *resourceApplicationLayerAutomaticResponse) Schema(ctx context.Context, req resource.SchemaRequest, resp *resource.SchemaResponse) {
+	resp.Schema = schema.Schema{
+		Attributes: map[string]schema.Attribute{
+			"id": framework.IDAttribute(),
+			"resource_arn": schema.StringAttribute{
+				Required: true,
+				PlanModifiers: []planmodifier.String{
+					stringplanmodifier.RequiresReplace(),
+				},
+			},
+			"action": schema.StringAttribute{
+				Required: true,
+				Validators: []validator.String{
+					stringvalidator.OneOf([]string{"BLOCK", "COUNT"}...),
+				},
+			},
+		},
+		Blocks: map[string]schema.Block{
+			"timeouts": timeouts.Block(ctx, timeouts.Opts{
+				Create: true,
+				Update: true,
+				Delete: true,
+			}),
+		},
+	}
+}
+
+func (r *resourceApplicationLayerAutomaticResponse) Create(ctx context.Context, req resource.CreateRequest, resp *resource.CreateResponse) {
+	conn := r.Meta().ShieldConn(ctx)
+
+	var plan resourceApplicationLayerAutomaticResponseData
+	resp.Diagnostics.Append(req.Plan.Get(ctx, &plan)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	action := &shield.ResponseAction{}
+	switch plan.Action.ValueString() {
+	case "BLOCK":
+		action.Block = &shield.BlockAction{}
+	case "COUNT":
+		action.Count = &shield.CountAction{}
+	}
+
+	in := &shield.EnableApplicationLayerAutomaticResponseInput{
+		ResourceArn: aws.String(plan.ResourceARN.ValueString()),
+		Action:      action,
+	}
+
+	_, err := conn.EnableApplicationLayerAutomaticResponseWithContext(ctx, in)
+	if err != nil {
+		resp.Diagnostics.AddError(
+			create.ProblemStandardMessage(names.Shield, create.ErrActionCreating, ResNameApplicationLayerAutomaticResponse, plan.ResourceARN.String(), err),
+			err.Error(),
+		)
+		return
+	}
+
+	createTimeout := r.CreateTimeout(ctx, plan.Timeouts)
+	_, err = waitApplicationLayerAutomaticResponseCreated(ctx, conn, plan.ResourceARN.ValueString(), createTimeout)
+	if err != nil {
+		resp.Diagnostics.AddError(
+			create.ProblemStandardMessage(names.Shield, create.ErrActionWaitingForCreation, ResNameApplicationLayerAutomaticResponse, plan.ResourceARN.String(), err),
+			err.Error(),
+		)
+		return
+	}
+
+	plan.ID = types.StringValue(plan.ResourceARN.ValueString())
+
+	resp.Diagnostics.Append(resp.State.Set(ctx, plan)...)
+}
+
+func (r *resourceApplicationLayerAutomaticResponse) Read(ctx context.Context, req resource.ReadRequest, resp *resource.ReadResponse) {
+	conn := r.Meta().ShieldConn(ctx)
+
+	var state resourceApplicationLayerAutomaticResponseData
+	resp.Diagnostics.Append(req.State.Get(ctx, &state)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	in := &shield.DescribeProtectionInput{
+		ResourceArn: aws.String(state.ID.ValueString()),
+	}
+
+	out, err := conn.DescribeProtectionWithContext(ctx, in)
+	if tfresource.NotFound(err) {
+		resp.State.RemoveResource(ctx)
+		return
+	}
+	if err != nil {
+		resp.Diagnostics.AddError(
+			create.ProblemStandardMessage(names.Shield, create.ErrActionSetting, ResNameApplicationLayerAutomaticResponse, state.ID.String(), err),
+			err.Error(),
+		)
+		return
+	}
+	if out != nil &&
+		out.Protection != nil &&
+		out.Protection.ApplicationLayerAutomaticResponseConfiguration != nil &&
+		out.Protection.ApplicationLayerAutomaticResponseConfiguration.Action != nil {
+		if out.Protection.ApplicationLayerAutomaticResponseConfiguration.Action.Block != nil {
+			state.Action = types.StringValue("BLOCK")
+		}
+		if out.Protection.ApplicationLayerAutomaticResponseConfiguration.Action.Count != nil {
+			state.Action = types.StringValue("COUNT")
+		}
+	}
+	resp.Diagnostics.Append(resp.State.Set(ctx, &state)...)
+}
+
+func (r *resourceApplicationLayerAutomaticResponse) Update(ctx context.Context, req resource.UpdateRequest, resp *resource.UpdateResponse) {
+	conn := r.Meta().ShieldConn(ctx)
+
+	var plan, state resourceApplicationLayerAutomaticResponseData
+	resp.Diagnostics.Append(req.Plan.Get(ctx, &plan)...)
+	resp.Diagnostics.Append(req.State.Get(ctx, &state)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	if !plan.Action.Equal(state.Action) {
+		action := &shield.ResponseAction{}
+		switch plan.Action.ValueString() {
+		case "BLOCK":
+			action.Block = &shield.BlockAction{}
+		case "COUNT":
+			action.Count = &shield.CountAction{}
+		}
+		in := &shield.UpdateApplicationLayerAutomaticResponseInput{
+			ResourceArn: aws.String(plan.ResourceARN.ValueString()),
+			Action:      action,
+		}
+
+		out, err := conn.UpdateApplicationLayerAutomaticResponseWithContext(ctx, in)
+		if err != nil {
+			resp.Diagnostics.AddError(
+				create.ProblemStandardMessage(names.Shield, create.ErrActionUpdating, ResNameApplicationLayerAutomaticResponse, plan.ID.String(), err),
+				err.Error(),
+			)
+			return
+		}
+		if out == nil {
+			resp.Diagnostics.AddError(
+				create.ProblemStandardMessage(names.Shield, create.ErrActionUpdating, ResNameApplicationLayerAutomaticResponse, plan.ID.String(), nil),
+				errors.New("empty output").Error(),
+			)
+			return
+		}
+	}
+
+	updateTimeout := r.UpdateTimeout(ctx, plan.Timeouts)
+	_, err := waitApplicationLayerAutomaticResponseUpdated(ctx, conn, plan.ResourceARN.ValueString(), updateTimeout)
+	if err != nil {
+		resp.Diagnostics.AddError(
+			create.ProblemStandardMessage(names.Shield, create.ErrActionWaitingForUpdate, ResNameApplicationLayerAutomaticResponse, plan.ID.String(), err),
+			err.Error(),
+		)
+		return
+	}
+	resp.Diagnostics.Append(resp.State.Set(ctx, &plan)...)
+}
+
+func (r *resourceApplicationLayerAutomaticResponse) Delete(ctx context.Context, req resource.DeleteRequest, resp *resource.DeleteResponse) {
+	conn := r.Meta().ShieldConn(ctx)
+
+	var state resourceApplicationLayerAutomaticResponseData
+	resp.Diagnostics.Append(req.State.Get(ctx, &state)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	in := &shield.DisableApplicationLayerAutomaticResponseInput{
+		ResourceArn: aws.String(state.ResourceARN.ValueString()),
+	}
+
+	protectionOutput, err := conn.DescribeProtectionWithContext(ctx, &shield.DescribeProtectionInput{
+		ResourceArn: aws.String(state.ResourceARN.ValueString()),
+	})
+	if err != nil {
+		var nfe *shield.ResourceNotFoundException
+		if errors.As(err, &nfe) {
+			return
+		}
+		resp.Diagnostics.AddError(
+			create.ProblemStandardMessage(names.Shield, create.ErrActionDeleting, ResNameApplicationLayerAutomaticResponse, state.ID.String(), err),
+			err.Error(),
+		)
+		return
+	}
+	if protectionOutput != nil {
+		if protectionOutput.Protection.ApplicationLayerAutomaticResponseConfiguration != nil && protectionOutput.Protection.ApplicationLayerAutomaticResponseConfiguration.Status != nil {
+			if aws.StringValue(protectionOutput.Protection.ApplicationLayerAutomaticResponseConfiguration.Status) == "DISABLED" {
+				return
+			}
+		}
+	} else {
+		resp.Diagnostics.AddError(
+			create.ProblemStandardMessage(names.Shield, create.ErrActionDeleting, ResNameApplicationLayerAutomaticResponse, state.ID.String(), nil),
+			errors.New("empty output").Error(),
+		)
+	}
+
+	_, err = conn.DisableApplicationLayerAutomaticResponseWithContext(ctx, in)
+	if err != nil {
+		var nfe *shield.ResourceNotFoundException
+		if errors.As(err, &nfe) {
+			return
+		}
+		resp.Diagnostics.AddError(
+			create.ProblemStandardMessage(names.Shield, create.ErrActionDeleting, ResNameApplicationLayerAutomaticResponse, state.ID.String(), err),
+			err.Error(),
+		)
+		return
+	}
+
+	// TIP: -- 5. Use a waiter to wait for delete to complete
+	deleteTimeout := r.DeleteTimeout(ctx, state.Timeouts)
+	_, err = waitApplicationLayerAutomaticResponseDeleted(ctx, conn, state.ResourceARN.ValueString(), deleteTimeout)
+
+	if err != nil {
+		resp.Diagnostics.AddError(
+			create.ProblemStandardMessage(names.Shield, create.ErrActionWaitingForDeletion, ResNameApplicationLayerAutomaticResponse, state.ID.String(), err),
+			err.Error(),
+		)
+		return
+	}
+}
+
+func (r *resourceApplicationLayerAutomaticResponse) ImportState(ctx context.Context, req resource.ImportStateRequest, resp *resource.ImportStateResponse) {
+	resource.ImportStatePassthroughID(ctx, path.Root("id"), req, resp)
+}
+
+func waitApplicationLayerAutomaticResponseCreated(ctx context.Context, conn *shield.Shield, resourceArn string, timeout time.Duration) (*shield.DescribeProtectionOutput, error) {
+	stateConf := &retry.StateChangeConf{
+		Pending:                   []string{},
+		Target:                    []string{statusNormal},
+		Refresh:                   statusApplicationLayerAutomaticResponse(ctx, conn, resourceArn),
+		Timeout:                   timeout,
+		NotFoundChecks:            20,
+		ContinuousTargetOccurence: 2,
+	}
+
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+	if out, ok := outputRaw.(*shield.DescribeProtectionOutput); ok {
+		return out, err
+	}
+
+	return nil, err
+}
+
+func waitApplicationLayerAutomaticResponseUpdated(ctx context.Context, conn *shield.Shield, resourceArn string, timeout time.Duration) (*shield.DescribeProtectionOutput, error) {
+	stateConf := &retry.StateChangeConf{
+		Pending:                   []string{statusChangePending},
+		Target:                    []string{statusUpdated},
+		Refresh:                   statusApplicationLayerAutomaticResponse(ctx, conn, resourceArn),
+		Timeout:                   timeout,
+		NotFoundChecks:            20,
+		ContinuousTargetOccurence: 2,
+	}
+
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+	if out, ok := outputRaw.(*shield.DescribeProtectionOutput); ok {
+		return out, err
+	}
+
+	return nil, err
+}
+
+func waitApplicationLayerAutomaticResponseDeleted(ctx context.Context, conn *shield.Shield, resourceArn string, timeout time.Duration) (*shield.DescribeProtectionOutput, error) {
+	stateConf := &retry.StateChangeConf{
+		Pending: []string{statusDeleting, statusNormal},
+		Target:  []string{},
+		Refresh: statusApplicationLayerAutomaticResponseDeleted(ctx, conn, resourceArn),
+		Timeout: timeout,
+	}
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+
+	if out, ok := outputRaw.(*shield.DescribeProtectionOutput); ok {
+		return out, err
+	}
+
+	return nil, err
+}
+
+func statusApplicationLayerAutomaticResponse(ctx context.Context, conn *shield.Shield, resourceArn string) retry.StateRefreshFunc {
+	return func() (interface{}, string, error) {
+		out, err := describeApplicationLayerAutomaticResponse(ctx, conn, resourceArn)
+		if tfresource.NotFound(err) {
+			return nil, "", nil
+		}
+
+		if err != nil {
+			return nil, "", err
+		}
+		curStatus := aws.StringValue(out.Protection.ApplicationLayerAutomaticResponseConfiguration.Status)
+
+		if curStatus == "ENABLED" {
+			return out, statusNormal, nil
+		}
+		return nil, statusChangePending, nil
+	}
+}
+
+func statusApplicationLayerAutomaticResponseDeleted(ctx context.Context, conn *shield.Shield, resourceArn string) retry.StateRefreshFunc {
+	return func() (interface{}, string, error) {
+		out, err := describeApplicationLayerAutomaticResponse(ctx, conn, resourceArn)
+		if tfresource.NotFound(err) {
+			return nil, "", nil
+		}
+
+		if err != nil {
+			return nil, "", err
+		}
+		curStatus := aws.StringValue(out.Protection.ApplicationLayerAutomaticResponseConfiguration.Status)
+
+		if curStatus == "DISABLED" {
+			return nil, "", nil
+		}
+		return out, statusDeleting, nil
+	}
+}
+
+func describeApplicationLayerAutomaticResponse(ctx context.Context, conn *shield.Shield, resourceArn string) (*shield.DescribeProtectionOutput, error) {
+	in := &shield.DescribeProtectionInput{
+		ResourceArn: aws.String(resourceArn),
+	}
+	out, err := conn.DescribeProtectionWithContext(ctx, in)
+	if err != nil {
+		var nfe *shield.ResourceNotFoundException
+		if errors.As(err, &nfe) {
+			return nil, &retry.NotFoundError{
+				LastError:   err,
+				LastRequest: in,
+			}
+		}
+	}
+
+	if out == nil || out.Protection == nil || out.Protection.ApplicationLayerAutomaticResponseConfiguration == nil {
+		return nil, tfresource.NewEmptyResultError(in)
+	}
+
+	return out, nil
+}
+
+type resourceApplicationLayerAutomaticResponseData struct {
+	ID          types.String   `tfsdk:"id"`
+	ResourceARN types.String   `tfsdk:"resource_arn"`
+	Action      types.String   `tfsdk:"action"`
+	Timeouts    timeouts.Value `tfsdk:"timeouts"`
+}
diff --git a/internal/service/shield/application_layer_automatic_response_test.go b/internal/service/shield/application_layer_automatic_response_test.go
new file mode 100644
index 00000000000..bbc688ae3fa
--- /dev/null
+++ b/internal/service/shield/application_layer_automatic_response_test.go
@@ -0,0 +1,226 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package shield_test
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"testing"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/shield"
+	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
+	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/create"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs"
+	tfshield "github.com/hashicorp/terraform-provider-aws/internal/service/shield"
+	"github.com/hashicorp/terraform-provider-aws/names"
+)
+
+func TestAccShieldApplicationLayerAutomaticResponse_basic(t *testing.T) {
+	ctx := acctest.Context(t)
+	// TIP: This is a long-running test guard for tests that run longer than
+	// 300s (5 min) generally.
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
+	var applicationlayerautomaticresponse shield.DescribeProtectionOutput
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_shield_application_layer_automatic_response.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckWAFV2CloudFrontScope(ctx, t)
+			testAccPreCheck(ctx, t)
+		},
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckApplicationLayerAutomaticResponseDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccApplicationLayerAutomaticResponseConfig_basic(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckApplicationLayerAutomaticResponseExists(ctx, resourceName, &applicationlayerautomaticresponse),
+				),
+			},
+		},
+	})
+}
+
+func TestAccShieldApplicationLayerAutomaticResponse_disappears(t *testing.T) {
+	ctx := acctest.Context(t)
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
+	var applicationlayerautomaticresponse shield.DescribeProtectionOutput
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_shield_application_layer_automatic_response.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckWAFV2CloudFrontScope(ctx, t)
+			testAccPreCheck(ctx, t)
+		},
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckApplicationLayerAutomaticResponseDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccApplicationLayerAutomaticResponseConfig_basic(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckApplicationLayerAutomaticResponseExists(ctx, resourceName, &applicationlayerautomaticresponse),
+					acctest.CheckFrameworkResourceDisappears(ctx, acctest.Provider, tfshield.ResourceApplicationLayerAutomaticResponse, resourceName),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckApplicationLayerAutomaticResponseDestroy(ctx context.Context) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		conn := acctest.Provider.Meta().(*conns.AWSClient).ShieldConn(ctx)
+
+		for _, rs := range s.RootModule().Resources {
+			if rs.Type != "aws_shield_application_layer_automatic_response" {
+				continue
+			}
+
+			input := &shield.DescribeProtectionInput{
+				ResourceArn: aws.String(rs.Primary.ID),
+			}
+			resp, err := conn.DescribeProtectionWithContext(ctx, input)
+			if errs.IsA[*shield.ResourceNotFoundException](err) {
+				return nil
+			}
+
+			if err != nil {
+				return err
+			}
+
+			if resp != nil && *resp.Protection.ApplicationLayerAutomaticResponseConfiguration.Status == "DISABLED" {
+				return nil
+			}
+			return create.Error(names.Shield, create.ErrActionCheckingDestroyed, tfshield.ResNameApplicationLayerAutomaticResponse, rs.Primary.ID, errors.New("not destroyed"))
+		}
+
+		return nil
+	}
+}
+
+func testAccCheckApplicationLayerAutomaticResponseExists(ctx context.Context, name string, applicationlayerautomaticresponse *shield.DescribeProtectionOutput) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[name]
+		if !ok {
+			return create.Error(names.Shield, create.ErrActionCheckingExistence, tfshield.ResNameApplicationLayerAutomaticResponse, name, errors.New("not found"))
+		}
+
+		if rs.Primary.ID == "" {
+			return create.Error(names.Shield, create.ErrActionCheckingExistence, tfshield.ResNameApplicationLayerAutomaticResponse, name, errors.New("not set"))
+		}
+
+		conn := acctest.Provider.Meta().(*conns.AWSClient).ShieldConn(ctx)
+		resp, err := conn.DescribeProtectionWithContext(ctx, &shield.DescribeProtectionInput{
+			ResourceArn: aws.String(rs.Primary.ID),
+		})
+
+		if err != nil {
+			return create.Error(names.Shield, create.ErrActionCheckingExistence, tfshield.ResNameApplicationLayerAutomaticResponse, rs.Primary.ID, err)
+		}
+
+		*applicationlayerautomaticresponse = *resp
+
+		return nil
+	}
+}
+
+func testAccApplicationLayerAutomaticResponseConfig_basic(rName string) string {
+	return fmt.Sprintf(`
+resource "aws_wafv2_web_acl" "test" {
+  name        = %[1]q
+  description = %[1]q
+  scope       = "CLOUDFRONT"
+  default_action {
+    allow {}
+  }
+  visibility_config {
+    cloudwatch_metrics_enabled = false
+    metric_name                = %[1]q
+    sampled_requests_enabled   = false
+  }
+  lifecycle {
+    ignore_changes = [
+      rule,
+    ]
+  }
+}
+resource "aws_cloudfront_distribution" "test" {
+  origin {
+    custom_origin_config {
+      http_port              = 80
+      https_port             = 443
+      origin_protocol_policy = "https-only"
+      origin_ssl_protocols = [
+        "TLSv1",
+        "TLSv1.1",
+        "TLSv1.2",
+      ]
+    }
+    # This is a fake origin and it's set to this name to indicate that.
+    domain_name = "%[1]s.com"
+    origin_id   = %[1]q
+  }
+  enabled             = false
+  wait_for_deployment = false
+  web_acl_id          = aws_wafv2_web_acl.test.arn
+  default_cache_behavior {
+    allowed_methods  = ["HEAD", "DELETE", "POST", "GET", "OPTIONS", "PUT", "PATCH"]
+    cached_methods   = ["GET", "HEAD"]
+    target_origin_id = %[1]q
+    forwarded_values {
+      query_string = false
+      headers      = ["*"]
+      cookies {
+        forward = "none"
+      }
+    }
+    viewer_protocol_policy = "redirect-to-https"
+    min_ttl                = 0
+    default_ttl            = 0
+    max_ttl                = 0
+  }
+  restrictions {
+    geo_restriction {
+      restriction_type = "none"
+    }
+  }
+  tags = {
+    Name = %[1]q
+  }
+  viewer_certificate {
+    cloudfront_default_certificate = true
+  }
+}
+
+resource "aws_shield_protection" "test" {
+  name         = %[1]q
+  resource_arn = aws_cloudfront_distribution.test.arn
+}
+resource "aws_shield_application_layer_automatic_response" "test" {
+  resource_arn = aws_cloudfront_distribution.test.arn
+  action       = "COUNT"
+
+  depends_on = [
+    aws_shield_protection.test,
+    aws_cloudfront_distribution.test,
+    aws_wafv2_web_acl.test
+  ]
+}
+`, rName)
+}
diff --git a/internal/service/shield/drt_access_log_bucket_association.go b/internal/service/shield/drt_access_log_bucket_association.go
new file mode 100644
index 00000000000..faa84be8648
--- /dev/null
+++ b/internal/service/shield/drt_access_log_bucket_association.go
@@ -0,0 +1,379 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package shield
+
+import (
+	"context"
+	"errors"
+	"time"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/shield"
+	"github.com/hashicorp/terraform-plugin-framework-timeouts/resource/timeouts"
+	"github.com/hashicorp/terraform-plugin-framework-validators/stringvalidator"
+	"github.com/hashicorp/terraform-plugin-framework/resource"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema/planmodifier"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema/stringplanmodifier"
+	"github.com/hashicorp/terraform-plugin-framework/schema/validator"
+	"github.com/hashicorp/terraform-plugin-framework/types"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
+	"github.com/hashicorp/terraform-provider-aws/internal/create"
+	"github.com/hashicorp/terraform-provider-aws/internal/framework"
+	"github.com/hashicorp/terraform-provider-aws/internal/framework/flex"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/names"
+)
+
+// @FrameworkResource(name="DRT Access Log Bucket Association")
+func newResourceDRTAccessLogBucketAssociation(_ context.Context) (resource.ResourceWithConfigure, error) {
+	r := &resourceDRTAccessLogBucketAssociation{}
+
+	r.SetDefaultCreateTimeout(30 * time.Minute)
+	r.SetDefaultUpdateTimeout(30 * time.Minute)
+	r.SetDefaultDeleteTimeout(30 * time.Minute)
+
+	return r, nil
+}
+
+const (
+	ResNameDRTAccessLogBucketAssociation = "DRT Access Log Bucket Association"
+)
+
+type resourceDRTAccessLogBucketAssociation struct {
+	framework.ResourceWithConfigure
+	framework.WithTimeouts
+}
+
+func (r *resourceDRTAccessLogBucketAssociation) Metadata(_ context.Context, req resource.MetadataRequest, resp *resource.MetadataResponse) {
+	resp.TypeName = "aws_shield_drt_access_log_bucket_association"
+}
+
+func (r *resourceDRTAccessLogBucketAssociation) Schema(ctx context.Context, req resource.SchemaRequest, resp *resource.SchemaResponse) {
+	resp.Schema = schema.Schema{
+		Attributes: map[string]schema.Attribute{
+			"id": schema.StringAttribute{ // required by hashicorps terraform plugin testing framework
+				DeprecationMessage:  "id is only for framework compatibility and not used by the provider",
+				MarkdownDescription: "The ID of the directory.",
+				Computed:            true,
+				PlanModifiers: []planmodifier.String{
+					stringplanmodifier.UseStateForUnknown(),
+				},
+			},
+			"log_bucket": schema.StringAttribute{
+				Required: true,
+				Validators: []validator.String{
+					// Validate string value length must be at least 3 characters and max 63.
+					stringvalidator.LengthBetween(3, 63),
+				},
+			},
+			"role_arn_association_id": schema.StringAttribute{
+				Required: true,
+			},
+		},
+		Blocks: map[string]schema.Block{
+			"timeouts": timeouts.Block(ctx, timeouts.Opts{
+				Create: true,
+				Delete: true,
+				Read:   true,
+			}),
+		},
+	}
+}
+
+func (r *resourceDRTAccessLogBucketAssociation) Create(ctx context.Context, req resource.CreateRequest, resp *resource.CreateResponse) {
+	conn := r.Meta().ShieldConn(ctx)
+
+	var plan resourceDRTAccessLogBucketAssociationData
+	resp.Diagnostics.Append(req.Plan.Get(ctx, &plan)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	in := &shield.AssociateDRTLogBucketInput{
+		LogBucket: aws.String(plan.LogBucket.ValueString()),
+	}
+	out, err := conn.AssociateDRTLogBucketWithContext(ctx, in)
+	if err != nil {
+		resp.Diagnostics.AddError(
+			create.ProblemStandardMessage(names.Shield, create.ErrActionCreating, ResNameDRTAccessLogBucketAssociation, plan.LogBucket.String(), err),
+			err.Error(),
+		)
+		return
+	}
+	if out == nil {
+		resp.Diagnostics.AddError(
+			create.ProblemStandardMessage(names.Shield, create.ErrActionCreating, ResNameDRTAccessLogBucketAssociation, plan.LogBucket.String(), nil),
+			errors.New("empty output").Error(),
+		)
+		return
+	}
+
+	createTimeout := r.CreateTimeout(ctx, plan.Timeouts)
+	_, err = waitDRTAccessLogBucketAssociationCreated(ctx, conn, plan.LogBucket.ValueString(), createTimeout)
+	if err != nil {
+		resp.Diagnostics.AddError(
+			create.ProblemStandardMessage(names.Shield, create.ErrActionWaitingForCreation, ResNameDRTAccessLogBucketAssociation, plan.LogBucket.String(), err),
+			err.Error(),
+		)
+		return
+	}
+	plan.ID = types.StringValue(plan.LogBucket.ValueString())
+
+	resp.Diagnostics.Append(resp.State.Set(ctx, plan)...)
+}
+
+func (r *resourceDRTAccessLogBucketAssociation) Read(ctx context.Context, req resource.ReadRequest, resp *resource.ReadResponse) {
+	conn := r.Meta().ShieldConn(ctx)
+
+	var state resourceDRTAccessLogBucketAssociationData
+	resp.Diagnostics.Append(req.State.Get(ctx, &state)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+	in := &shield.DescribeDRTAccessInput{}
+
+	out, err := conn.DescribeDRTAccessWithContext(ctx, in)
+	if tfresource.NotFound(err) {
+		resp.State.RemoveResource(ctx)
+		return
+	}
+
+	if err != nil {
+		resp.Diagnostics.AddError(
+			create.ProblemStandardMessage(names.Shield, create.ErrActionSetting, ResNameDRTAccessLogBucketAssociation, state.LogBucket.String(), err),
+			err.Error(),
+		)
+		return
+	}
+	var associatedLogBucket *string
+	if out != nil {
+		associatedLogBucket = getAssociatedLogBucket(state.LogBucket.ValueString(), out.LogBucketList)
+		if len(out.LogBucketList) > 0 && associatedLogBucket == nil {
+			resp.Diagnostics.AddError(
+				create.ProblemStandardMessage(names.Shield, create.ErrActionSetting, ResNameDRTAccessLogBucketAssociation, state.LogBucket.String(), nil),
+				errors.New("Log Bucket not in list").Error(),
+			)
+		}
+	}
+
+	if state.ID.IsNull() || state.ID.IsUnknown() {
+		// Setting ID of state - required by hashicorps terraform plugin testing framework for Import. See issue https://github.com/hashicorp/terraform-plugin-testing/issues/84
+		state.ID = types.StringValue(state.LogBucket.ValueString())
+	}
+	state.LogBucket = flex.StringToFramework(ctx, associatedLogBucket)
+
+	resp.Diagnostics.Append(resp.State.Set(ctx, &state)...)
+}
+
+func getAssociatedLogBucket(bucket string, bucketList []*string) *string {
+	for _, bkt := range bucketList {
+		if aws.StringValue(bkt) == bucket {
+			return bkt
+		}
+	}
+	return nil
+}
+
+func (r *resourceDRTAccessLogBucketAssociation) Update(ctx context.Context, req resource.UpdateRequest, resp *resource.UpdateResponse) {
+	conn := r.Meta().ShieldConn(ctx)
+
+	var plan, state resourceDRTAccessLogBucketAssociationData
+	resp.Diagnostics.Append(req.Plan.Get(ctx, &plan)...)
+	resp.Diagnostics.Append(req.State.Get(ctx, &state)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	if !plan.LogBucket.Equal(state.LogBucket) {
+		in := &shield.AssociateDRTLogBucketInput{
+			LogBucket: aws.String(plan.LogBucket.ValueString()),
+		}
+		out, err := conn.AssociateDRTLogBucketWithContext(ctx, in)
+		if err != nil {
+			resp.Diagnostics.AddError(
+				create.ProblemStandardMessage(names.Shield, create.ErrActionUpdating, ResNameDRTAccessLogBucketAssociation, plan.LogBucket.String(), err),
+				err.Error(),
+			)
+			return
+		}
+		if out == nil {
+			resp.Diagnostics.AddError(
+				create.ProblemStandardMessage(names.Shield, create.ErrActionUpdating, ResNameDRTAccessLogBucketAssociation, plan.LogBucket.String(), nil),
+				errors.New("empty output").Error(),
+			)
+			return
+		}
+	}
+
+	updateTimeout := r.UpdateTimeout(ctx, plan.Timeouts)
+	_, err := waitDRTAccessLogBucketAssociationUpdated(ctx, conn, plan.LogBucket.ValueString(), updateTimeout)
+	if err != nil {
+		resp.Diagnostics.AddError(
+			create.ProblemStandardMessage(names.Shield, create.ErrActionWaitingForUpdate, ResNameDRTAccessLogBucketAssociation, plan.LogBucket.String(), err),
+			err.Error(),
+		)
+		return
+	}
+
+	resp.Diagnostics.Append(resp.State.Set(ctx, &plan)...)
+}
+
+func (r *resourceDRTAccessLogBucketAssociation) Delete(ctx context.Context, req resource.DeleteRequest, resp *resource.DeleteResponse) {
+	conn := r.Meta().ShieldConn(ctx)
+
+	var state resourceDRTAccessLogBucketAssociationData
+	resp.Diagnostics.Append(req.State.Get(ctx, &state)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+	if state.LogBucket.ValueString() == "" {
+		return
+	}
+
+	in := &shield.DisassociateDRTLogBucketInput{
+		LogBucket: aws.String(state.LogBucket.ValueString()),
+	}
+
+	_, err := conn.DisassociateDRTLogBucketWithContext(ctx, in)
+	if err != nil {
+		var nfe *shield.ResourceNotFoundException
+		if errors.As(err, &nfe) {
+			return
+		}
+		resp.Diagnostics.AddError(
+			create.ProblemStandardMessage(names.Shield, create.ErrActionDeleting, ResNameDRTAccessLogBucketAssociation, state.LogBucket.String(), err),
+			err.Error(),
+		)
+		return
+	}
+	deleteTimeout := r.DeleteTimeout(ctx, state.Timeouts)
+	_, err = waitDRTAccessLogBucketAssociationDeleted(ctx, conn, state.LogBucket.ValueString(), deleteTimeout)
+	if err != nil {
+		resp.Diagnostics.AddError(
+			create.ProblemStandardMessage(names.Shield, create.ErrActionWaitingForDeletion, ResNameDRTAccessLogBucketAssociation, state.LogBucket.String(), err),
+			err.Error(),
+		)
+		return
+	}
+}
+
+const (
+	statusChangePending = "Pending"
+	statusDeleting      = "Deleting"
+	statusNormal        = "Normal"
+	statusUpdated       = "Updated"
+)
+
+func waitDRTAccessLogBucketAssociationCreated(ctx context.Context, conn *shield.Shield, bucket string, timeout time.Duration) (*shield.DescribeDRTAccessOutput, error) {
+	stateConf := &retry.StateChangeConf{
+		Pending:                   []string{},
+		Target:                    []string{statusNormal},
+		Refresh:                   statusDRTAccessLogBucketAssociation(ctx, conn, bucket),
+		Timeout:                   timeout,
+		NotFoundChecks:            2,
+		ContinuousTargetOccurence: 2,
+	}
+
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+	if out, ok := outputRaw.(*shield.DescribeDRTAccessOutput); ok {
+		return out, err
+	}
+
+	return nil, err
+}
+
+func waitDRTAccessLogBucketAssociationUpdated(ctx context.Context, conn *shield.Shield, bucket string, timeout time.Duration) (*shield.DescribeDRTAccessOutput, error) {
+	stateConf := &retry.StateChangeConf{
+		Pending:                   []string{statusChangePending},
+		Target:                    []string{statusUpdated},
+		Refresh:                   statusDRTAccessLogBucketAssociation(ctx, conn, bucket),
+		Timeout:                   timeout,
+		NotFoundChecks:            2,
+		ContinuousTargetOccurence: 2,
+	}
+
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+	if out, ok := outputRaw.(*shield.DescribeDRTAccessOutput); ok {
+		return out, err
+	}
+
+	return nil, err
+}
+
+func waitDRTAccessLogBucketAssociationDeleted(ctx context.Context, conn *shield.Shield, bucket string, timeout time.Duration) (*shield.DescribeDRTAccessOutput, error) {
+	stateConf := &retry.StateChangeConf{
+		Pending: []string{statusDeleting, statusNormal},
+		Target:  []string{},
+		Refresh: statusDRTAccessLogBucketAssociation(ctx, conn, bucket),
+		Timeout: timeout,
+	}
+
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+	if out, ok := outputRaw.(*shield.DescribeDRTAccessOutput); ok {
+		return out, err
+	}
+
+	return nil, err
+}
+
+func statusDRTAccessLogBucketAssociation(ctx context.Context, conn *shield.Shield, bucket string) retry.StateRefreshFunc {
+	return func() (interface{}, string, error) {
+		out, err := describeDRTAccessLogBucketAssociation(ctx, conn, bucket)
+		if tfresource.NotFound(err) {
+			return nil, "", nil
+		}
+
+		if err != nil {
+			return nil, "", err
+		}
+		if out == nil || out.LogBucketList == nil || len(out.LogBucketList) == 0 {
+			return nil, "", nil
+		}
+
+		if out != nil && len(out.LogBucketList) > 0 {
+			for _, bkt := range out.LogBucketList {
+				if aws.StringValue(bkt) == bucket {
+					return out, statusNormal, nil
+				}
+			}
+			return nil, "", nil
+		}
+
+		return out, statusNormal, nil
+	}
+}
+
+func describeDRTAccessLogBucketAssociation(ctx context.Context, conn *shield.Shield, bucketName string) (*shield.DescribeDRTAccessOutput, error) {
+	in := &shield.DescribeDRTAccessInput{}
+
+	out, err := conn.DescribeDRTAccessWithContext(ctx, in)
+	if err != nil {
+		var nfe *shield.ResourceNotFoundException
+		if errors.As(err, &nfe) {
+			return nil, &retry.NotFoundError{
+				LastError:   err,
+				LastRequest: in,
+			}
+		}
+	}
+
+	if out == nil || out.LogBucketList == nil || len(out.LogBucketList) == 0 {
+		return nil, tfresource.NewEmptyResultError(in)
+	}
+
+	for _, bucket := range out.LogBucketList {
+		if aws.StringValue(bucket) == bucketName {
+			return out, nil
+		}
+	}
+	return nil, err
+}
+
+type resourceDRTAccessLogBucketAssociationData struct {
+	ID                   types.String   `tfsdk:"id"`
+	RoleArnAssociationID types.String   `tfsdk:"role_arn_association_id"`
+	LogBucket            types.String   `tfsdk:"log_bucket"`
+	Timeouts             timeouts.Value `tfsdk:"timeouts"`
+}
diff --git a/internal/service/shield/drt_access_log_bucket_association_test.go b/internal/service/shield/drt_access_log_bucket_association_test.go
new file mode 100644
index 00000000000..e824e9c73a1
--- /dev/null
+++ b/internal/service/shield/drt_access_log_bucket_association_test.go
@@ -0,0 +1,290 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package shield_test
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"testing"
+
+	"github.com/aws/aws-sdk-go/service/shield"
+	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
+	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/create"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs"
+	tfshield "github.com/hashicorp/terraform-provider-aws/internal/service/shield"
+	"github.com/hashicorp/terraform-provider-aws/names"
+)
+
+func TestAccShieldDRTAccessLogBucketAssociation_basic(t *testing.T) {
+	ctx := acctest.Context(t)
+
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+	var drtaccesslogbucketassociation shield.DescribeDRTAccessOutput
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	bucketName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_shield_drt_access_log_bucket_association.test"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			testAccPreCheckLogBucket(ctx, t)
+		},
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckDRTAccessLogBucketAssociationDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccDRTAccessLogBucketAssociationConfig_basic(rName, bucketName),
+				Check:  testAccCheckDRTAccessLogBucketAssociationExists(ctx, resourceName, &drtaccesslogbucketassociation),
+			},
+		},
+	})
+}
+
+func TestAccShieldDRTAccessLogBucketAssociation_multibucket(t *testing.T) {
+	ctx := acctest.Context(t)
+
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+	var drtaccesslogbucketassociation shield.DescribeDRTAccessOutput
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	var buckets = []string{}
+	for i := 0; i < 2; i++ {
+		buckets = append(buckets, sdkacctest.RandomWithPrefix(acctest.ResourcePrefix))
+	}
+	resourceName1 := "aws_shield_drt_access_log_bucket_association.test1"
+	resourceName2 := "aws_shield_drt_access_log_bucket_association.test2"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			testAccPreCheckLogBucket(ctx, t)
+		},
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckDRTAccessLogBucketAssociationDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccDRTAccessLogBucketAssociationConfig_multibucket(rName, buckets),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckDRTAccessLogBucketAssociationExists(ctx, resourceName1, &drtaccesslogbucketassociation),
+					testAccCheckDRTAccessLogBucketAssociationExists(ctx, resourceName2, &drtaccesslogbucketassociation),
+				),
+			},
+		},
+	})
+}
+
+func TestAccShieldDRTAccessLogBucketAssociation_disappears(t *testing.T) {
+	ctx := acctest.Context(t)
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+	var drtaccesslogbucketassociation shield.DescribeDRTAccessOutput
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	bucketName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_shield_drt_access_log_bucket_association.test"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			testAccPreCheckLogBucket(ctx, t)
+		},
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckDRTAccessLogBucketAssociationDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccDRTAccessLogBucketAssociationConfig_basic(rName, bucketName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckDRTAccessLogBucketAssociationExists(ctx, resourceName, &drtaccesslogbucketassociation),
+					acctest.CheckFrameworkResourceDisappears(ctx, acctest.Provider, tfshield.ResourceDRTAccessLogBucketAssociation, resourceName),
+				),
+				ExpectNonEmptyPlan: true,
+			},
+		},
+	})
+}
+
+func testAccCheckDRTAccessLogBucketAssociationDestroy(ctx context.Context) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		conn := acctest.Provider.Meta().(*conns.AWSClient).ShieldConn(ctx)
+
+		for _, rs := range s.RootModule().Resources {
+			if rs.Type != "aws_shield_drt_access_log_bucket_association" {
+				continue
+			}
+
+			input := &shield.DescribeDRTAccessInput{}
+			resp, err := conn.DescribeDRTAccessWithContext(ctx, input)
+
+			if errs.IsA[*shield.ResourceNotFoundException](err) {
+				return nil
+			}
+			if err != nil {
+				return err
+			}
+			if resp != nil {
+				if resp.LogBucketList != nil && len(resp.LogBucketList) > 0 {
+					for _, bucket := range resp.LogBucketList {
+						if *bucket == rs.Primary.Attributes["log_bucket"] {
+							return create.Error(names.Shield, create.ErrActionCheckingDestroyed, tfshield.ResNameDRTAccessLogBucketAssociation, rs.Primary.ID, errors.New("bucket association not destroyed"))
+						}
+					}
+				}
+				return nil
+			}
+
+			return create.Error(names.Shield, create.ErrActionCheckingDestroyed, tfshield.ResNameDRTAccessLogBucketAssociation, rs.Primary.ID, errors.New("not destroyed"))
+		}
+
+		return nil
+	}
+}
+
+func testAccCheckDRTAccessLogBucketAssociationExists(ctx context.Context, name string, drtaccesslogbucketassociation *shield.DescribeDRTAccessOutput) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[name]
+
+		if !ok {
+			return create.Error(names.Shield, create.ErrActionCheckingExistence, tfshield.ResNameDRTAccessLogBucketAssociation, name, errors.New("not found"))
+		}
+
+		if rs.Primary.ID == "" {
+			return create.Error(names.Shield, create.ErrActionCheckingExistence, tfshield.ResNameDRTAccessLogBucketAssociation, name, errors.New("not set"))
+		}
+
+		conn := acctest.Provider.Meta().(*conns.AWSClient).ShieldConn(ctx)
+		resp, err := conn.DescribeDRTAccessWithContext(ctx, &shield.DescribeDRTAccessInput{})
+		if err != nil {
+			return create.Error(names.Shield, create.ErrActionCheckingExistence, tfshield.ResNameDRTAccessLogBucketAssociation, rs.Primary.ID, err)
+		}
+
+		*drtaccesslogbucketassociation = *resp
+
+		return nil
+	}
+}
+
+func testAccPreCheckLogBucket(ctx context.Context, t *testing.T) {
+	conn := acctest.Provider.Meta().(*conns.AWSClient).ShieldConn(ctx)
+
+	input := &shield.DescribeDRTAccessInput{}
+	_, err := conn.DescribeDRTAccessWithContext(ctx, input)
+
+	if acctest.PreCheckSkipError(err) {
+		t.Skipf("skipping acceptance testing: %s", err)
+	}
+	if err != nil {
+		t.Fatalf("unexpected PreCheck error: %s", err)
+	}
+}
+
+func testAccDRTAccessLogBucketAssociationConfig_basic(rName string, bucket string) string {
+	return fmt.Sprintf(`
+data "aws_partition" "current" {}
+
+resource "aws_s3_bucket" "test" {
+  bucket = %[2]q
+}
+
+resource "aws_iam_role" "test" {
+  name = %[1]q
+
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [{
+      "Sid" : "",
+      "Effect" : "Allow",
+      "Principal" : {
+        "Service" : "drt.shield.amazonaws.com"
+      },
+      "Action" : "sts:AssumeRole"
+    }]
+  })
+}
+
+resource "aws_iam_role_policy_attachment" "test" {
+  role       = aws_iam_role.test.name
+  policy_arn = "arn:${data.aws_partition.current.partition}:iam::aws:policy/service-role/AWSShieldDRTAccessPolicy"
+}
+
+resource "aws_shield_protection_group" "test" {
+  protection_group_id = %[1]q
+  aggregation         = "MAX"
+  pattern             = "ALL"
+}
+
+resource "aws_shield_drt_access_role_arn_association" "test" {
+  role_arn = aws_iam_role.test.arn
+}
+
+resource "aws_shield_drt_access_log_bucket_association" "test" {
+  log_bucket              = aws_s3_bucket.test.id
+  role_arn_association_id = aws_shield_drt_access_role_arn_association.test.id
+}
+`, rName, bucket)
+}
+
+func testAccDRTAccessLogBucketAssociationConfig_multibucket(rName string, buckets []string) string {
+	return fmt.Sprintf(`
+data "aws_partition" "current" {}
+
+resource "aws_s3_bucket" "test1" {
+  bucket = %[2]q
+}
+
+resource "aws_s3_bucket" "test2" {
+  bucket = %[3]q
+}
+
+resource "aws_iam_role" "test" {
+  name = %[1]q
+
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [{
+      "Sid" : "",
+      "Effect" : "Allow",
+      "Principal" : {
+        "Service" : "drt.shield.amazonaws.com"
+      },
+      "Action" : "sts:AssumeRole"
+    }]
+  })
+}
+
+resource "aws_iam_role_policy_attachment" "test" {
+  role       = aws_iam_role.test.name
+  policy_arn = "arn:${data.aws_partition.current.partition}:iam::aws:policy/service-role/AWSShieldDRTAccessPolicy"
+}
+
+resource "aws_shield_protection_group" "test" {
+  protection_group_id = %[1]q
+  aggregation         = "MAX"
+  pattern             = "ALL"
+}
+
+resource "aws_shield_drt_access_role_arn_association" "test" {
+  role_arn = aws_iam_role.test.arn
+}
+
+resource "aws_shield_drt_access_log_bucket_association" "test1" {
+  log_bucket              = aws_s3_bucket.test1.id
+  role_arn_association_id = aws_shield_drt_access_role_arn_association.test.id
+}
+
+resource "aws_shield_drt_access_log_bucket_association" "test2" {
+  log_bucket              = aws_s3_bucket.test2.id
+  role_arn_association_id = aws_shield_drt_access_role_arn_association.test.id
+
+  depends_on = [aws_shield_drt_access_log_bucket_association.test1]
+}
+`, rName, buckets[0], buckets[1])
+}
diff --git a/internal/service/shield/drt_access_role_arn_association.go b/internal/service/shield/drt_access_role_arn_association.go
new file mode 100644
index 00000000000..9a4ab4b02f5
--- /dev/null
+++ b/internal/service/shield/drt_access_role_arn_association.go
@@ -0,0 +1,359 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package shield
+
+import (
+	"context"
+	"errors"
+	"time"
+
+	"github.com/YakDriver/regexache"
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/shield"
+	"github.com/hashicorp/terraform-plugin-framework-timeouts/resource/timeouts"
+	"github.com/hashicorp/terraform-plugin-framework-validators/stringvalidator"
+	"github.com/hashicorp/terraform-plugin-framework/resource"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema/planmodifier"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema/stringplanmodifier"
+	"github.com/hashicorp/terraform-plugin-framework/schema/validator"
+	"github.com/hashicorp/terraform-plugin-framework/types"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
+	"github.com/hashicorp/terraform-provider-aws/internal/create"
+	"github.com/hashicorp/terraform-provider-aws/internal/framework"
+	"github.com/hashicorp/terraform-provider-aws/internal/framework/flex"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/names"
+)
+
+// Function annotations are used for resource registration to the Provider. DO NOT EDIT.
+// @FrameworkResource(name="DRT Access Role ARN Association")
+func newResourceDRTAccessRoleARNAssociation(_ context.Context) (resource.ResourceWithConfigure, error) {
+	r := &resourceDRTAccessRoleARNAssociation{}
+
+	r.SetDefaultCreateTimeout(30 * time.Minute)
+	r.SetDefaultUpdateTimeout(30 * time.Minute)
+	r.SetDefaultDeleteTimeout(30 * time.Minute)
+
+	return r, nil
+}
+
+const (
+	ResNameDRTAccessRoleARNAssociation = "DRT Access Role ARN Association"
+)
+
+type resourceDRTAccessRoleARNAssociation struct {
+	framework.ResourceWithConfigure
+	framework.WithTimeouts
+}
+
+func (r *resourceDRTAccessRoleARNAssociation) Metadata(_ context.Context, req resource.MetadataRequest, resp *resource.MetadataResponse) {
+	resp.TypeName = "aws_shield_drt_access_role_arn_association"
+}
+
+func (r *resourceDRTAccessRoleARNAssociation) Schema(ctx context.Context, req resource.SchemaRequest, resp *resource.SchemaResponse) {
+	resp.Schema = schema.Schema{
+		Attributes: map[string]schema.Attribute{
+			"id": schema.StringAttribute{ // required by hashicorps terraform plugin testing framework
+				DeprecationMessage:  "id is only for framework compatibility and not used by the provider",
+				MarkdownDescription: "The ID of the directory.",
+				Computed:            true,
+				PlanModifiers: []planmodifier.String{
+					stringplanmodifier.UseStateForUnknown(),
+				},
+			},
+			"role_arn": schema.StringAttribute{
+				Required: true,
+				Validators: []validator.String{
+					stringvalidator.LengthBetween(1, 2048),
+					stringvalidator.RegexMatches(
+						regexache.MustCompile(`^arn:?[A-Za-z-]+:iam::\d{12}:role/?[0-9A-Za-z_+,./=@-]+`),
+						"must match arn pattern",
+					),
+				},
+			},
+		},
+		Blocks: map[string]schema.Block{
+			"timeouts": timeouts.Block(ctx, timeouts.Opts{
+				Create: true,
+				Delete: true,
+				Read:   true,
+			}),
+		},
+	}
+}
+
+func (r *resourceDRTAccessRoleARNAssociation) Create(ctx context.Context, req resource.CreateRequest, resp *resource.CreateResponse) {
+	conn := r.Meta().ShieldConn(ctx)
+
+	var plan resourceDRTAccessRoleARNAssociationData
+	resp.Diagnostics.Append(req.Plan.Get(ctx, &plan)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	in := &shield.AssociateDRTRoleInput{
+		RoleArn: aws.String(plan.RoleARN.ValueString()),
+	}
+
+	out, err := conn.AssociateDRTRoleWithContext(ctx, in)
+	if err != nil {
+		resp.Diagnostics.AddError(
+			create.ProblemStandardMessage(names.Shield, create.ErrActionCreating, ResNameDRTAccessRoleARNAssociation, plan.RoleARN.String(), err),
+			err.Error(),
+		)
+		return
+	}
+	if out == nil {
+		resp.Diagnostics.AddError(
+			create.ProblemStandardMessage(names.Shield, create.ErrActionCreating, ResNameDRTAccessRoleARNAssociation, plan.RoleARN.String(), nil),
+			errors.New("empty output").Error(),
+		)
+		return
+	}
+
+	createTimeout := r.CreateTimeout(ctx, plan.Timeouts)
+	_, err = waitDRTAccessRoleARNAssociationCreated(ctx, conn, plan.RoleARN.ValueString(), createTimeout)
+	if err != nil {
+		resp.Diagnostics.AddError(
+			create.ProblemStandardMessage(names.Shield, create.ErrActionWaitingForCreation, ResNameDRTAccessRoleARNAssociation, plan.RoleARN.String(), err),
+			err.Error(),
+		)
+		return
+	}
+
+	plan.ID = types.StringValue(plan.RoleARN.ValueString())
+
+	resp.Diagnostics.Append(resp.State.Set(ctx, plan)...)
+}
+
+func (r *resourceDRTAccessRoleARNAssociation) Read(ctx context.Context, req resource.ReadRequest, resp *resource.ReadResponse) {
+	conn := r.Meta().ShieldConn(ctx)
+
+	var state resourceDRTAccessRoleARNAssociationData
+	resp.Diagnostics.Append(req.State.Get(ctx, &state)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	in := &shield.DescribeDRTAccessInput{}
+	out, err := conn.DescribeDRTAccessWithContext(ctx, in)
+
+	if tfresource.NotFound(err) {
+		resp.State.RemoveResource(ctx)
+		return
+	}
+	if err != nil {
+		resp.Diagnostics.AddError(
+			create.ProblemStandardMessage(names.Shield, create.ErrActionSetting, ResNameDRTAccessRoleARNAssociation, state.RoleARN.String(), err),
+			err.Error(),
+		)
+		return
+	}
+	if state.ID.IsNull() || state.ID.IsUnknown() {
+		// Setting ID of state - required by hashicorps terraform plugin testing framework for Import. See issue https://github.com/hashicorp/terraform-plugin-testing/issues/84
+		state.ID = types.StringValue(state.RoleARN.ValueString())
+	}
+
+	state.RoleARN = flex.StringToFramework(ctx, out.RoleArn)
+	resp.Diagnostics.Append(resp.State.Set(ctx, &state)...)
+}
+
+func (r *resourceDRTAccessRoleARNAssociation) Update(ctx context.Context, req resource.UpdateRequest, resp *resource.UpdateResponse) {
+	conn := r.Meta().ShieldConn(ctx)
+
+	// TIP: -- 2. Fetch the plan
+	var plan, state resourceDRTAccessRoleARNAssociationData
+	resp.Diagnostics.Append(req.Plan.Get(ctx, &plan)...)
+	resp.Diagnostics.Append(req.State.Get(ctx, &state)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	if !plan.RoleARN.Equal(state.RoleARN) {
+		in := &shield.AssociateDRTRoleInput{
+			RoleArn: aws.String(plan.RoleARN.ValueString()),
+		}
+
+		out, err := conn.AssociateDRTRoleWithContext(ctx, in)
+		if err != nil {
+			resp.Diagnostics.AddError(
+				create.ProblemStandardMessage(names.Shield, create.ErrActionUpdating, ResNameDRTAccessRoleARNAssociation, plan.RoleARN.String(), err),
+				err.Error(),
+			)
+			return
+		}
+		if out == nil {
+			resp.Diagnostics.AddError(
+				create.ProblemStandardMessage(names.Shield, create.ErrActionUpdating, ResNameDRTAccessRoleARNAssociation, plan.RoleARN.String(), nil),
+				errors.New("empty output").Error(),
+			)
+			return
+		}
+	}
+
+	updateTimeout := r.UpdateTimeout(ctx, plan.Timeouts)
+	_, err := waitDRTAccessRoleARNAssociationUpdated(ctx, conn, plan.RoleARN.ValueString(), updateTimeout)
+	if err != nil {
+		resp.Diagnostics.AddError(
+			create.ProblemStandardMessage(names.Shield, create.ErrActionWaitingForUpdate, ResNameDRTAccessRoleARNAssociation, plan.RoleARN.String(), err),
+			err.Error(),
+		)
+		return
+	}
+
+	resp.Diagnostics.Append(resp.State.Set(ctx, &plan)...)
+}
+
+func (r *resourceDRTAccessRoleARNAssociation) Delete(ctx context.Context, req resource.DeleteRequest, resp *resource.DeleteResponse) {
+	conn := r.Meta().ShieldConn(ctx)
+
+	var state resourceDRTAccessRoleARNAssociationData
+
+	resp.Diagnostics.Append(req.State.Get(ctx, &state)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+	in := &shield.DisassociateDRTRoleInput{}
+
+	_, err := conn.DisassociateDRTRoleWithContext(ctx, in)
+	if err != nil {
+		var nfe *shield.ResourceNotFoundException
+		if errors.As(err, &nfe) {
+			return
+		}
+
+		resp.Diagnostics.AddError(
+			create.ProblemStandardMessage(names.Shield, create.ErrActionDeleting, ResNameDRTAccessRoleARNAssociation, state.RoleARN.String(), err),
+			err.Error(),
+		)
+		return
+	}
+
+	deleteTimeout := r.DeleteTimeout(ctx, state.Timeouts)
+	_, err = waitDRTAccessRoleARNAssociationDeleted(ctx, conn, state.RoleARN.ValueString(), deleteTimeout)
+
+	if err != nil {
+		resp.Diagnostics.AddError(
+			create.ProblemStandardMessage(names.Shield, create.ErrActionWaitingForDeletion, ResNameDRTAccessRoleARNAssociation, state.RoleARN.String(), err),
+			err.Error(),
+		)
+		return
+	}
+}
+
+func waitDRTAccessRoleARNAssociationCreated(ctx context.Context, conn *shield.Shield, roleARN string, timeout time.Duration) (*shield.DescribeDRTAccessOutput, error) {
+	stateConf := &retry.StateChangeConf{
+		Pending:                   []string{},
+		Target:                    []string{statusNormal},
+		Refresh:                   statusDRTAccessRoleARNAssociation(ctx, conn, roleARN),
+		Timeout:                   timeout,
+		NotFoundChecks:            20,
+		ContinuousTargetOccurence: 2,
+	}
+
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+	if out, ok := outputRaw.(*shield.DescribeDRTAccessOutput); ok {
+		return out, err
+	}
+
+	return nil, err
+}
+
+func waitDRTAccessRoleARNAssociationUpdated(ctx context.Context, conn *shield.Shield, roleARN string, timeout time.Duration) (*shield.DescribeDRTAccessOutput, error) {
+	stateConf := &retry.StateChangeConf{
+		Pending:                   []string{statusChangePending},
+		Target:                    []string{statusUpdated},
+		Refresh:                   statusDRTAccessRoleARNAssociation(ctx, conn, roleARN),
+		Timeout:                   timeout,
+		NotFoundChecks:            20,
+		ContinuousTargetOccurence: 2,
+	}
+
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+	if out, ok := outputRaw.(*shield.DescribeDRTAccessOutput); ok {
+		return out, err
+	}
+
+	return nil, err
+}
+
+func waitDRTAccessRoleARNAssociationDeleted(ctx context.Context, conn *shield.Shield, roleARN string, timeout time.Duration) (*shield.DescribeDRTAccessOutput, error) {
+	stateConf := &retry.StateChangeConf{
+		Pending: []string{statusDeleting, statusNormal},
+		Target:  []string{},
+		Refresh: statusDRTAccessRoleARNAssociationDeleted(ctx, conn, roleARN),
+		Timeout: timeout,
+	}
+
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+
+	if out, ok := outputRaw.(*shield.DescribeDRTAccessOutput); ok {
+		return out, err
+	}
+
+	return nil, err
+}
+
+func statusDRTAccessRoleARNAssociation(ctx context.Context, conn *shield.Shield, roleARN string) retry.StateRefreshFunc {
+	return func() (interface{}, string, error) {
+		out, err := describeDRTAccessRoleARNAssociation(ctx, conn, roleARN)
+		if tfresource.NotFound(err) {
+			return nil, "", nil
+		}
+
+		if err != nil {
+			return nil, "", err
+		}
+
+		return out, statusNormal, nil
+	}
+}
+
+func statusDRTAccessRoleARNAssociationDeleted(ctx context.Context, conn *shield.Shield, roleARN string) retry.StateRefreshFunc {
+	return func() (interface{}, string, error) {
+		out, err := describeDRTAccessRoleARNAssociation(ctx, conn, roleARN)
+
+		if tfresource.NotFound(err) {
+			return nil, "", nil
+		}
+
+		if err != nil {
+			return nil, "", err
+		}
+
+		if out.RoleArn != nil && aws.StringValue(out.RoleArn) == roleARN {
+			return out, statusDeleting, nil
+		}
+
+		return out, statusDeleting, nil
+	}
+}
+
+func describeDRTAccessRoleARNAssociation(ctx context.Context, conn *shield.Shield, roleARN string) (*shield.DescribeDRTAccessOutput, error) {
+	in := &shield.DescribeDRTAccessInput{}
+
+	out, err := conn.DescribeDRTAccessWithContext(ctx, in)
+	if err != nil {
+		var nfe *shield.ResourceNotFoundException
+		if errors.As(err, &nfe) {
+			return nil, &retry.NotFoundError{
+				LastError:   err,
+				LastRequest: in,
+			}
+		}
+	}
+
+	if out == nil || out.RoleArn == nil || aws.StringValue(out.RoleArn) != roleARN {
+		return nil, tfresource.NewEmptyResultError(in)
+	}
+
+	return out, nil
+}
+
+type resourceDRTAccessRoleARNAssociationData struct {
+	ID       types.String   `tfsdk:"id"`
+	RoleARN  types.String   `tfsdk:"role_arn"`
+	Timeouts timeouts.Value `tfsdk:"timeouts"`
+}
diff --git a/internal/service/shield/drt_access_role_arn_association_test.go b/internal/service/shield/drt_access_role_arn_association_test.go
new file mode 100644
index 00000000000..c2162d52822
--- /dev/null
+++ b/internal/service/shield/drt_access_role_arn_association_test.go
@@ -0,0 +1,181 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package shield_test
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"testing"
+
+	"github.com/aws/aws-sdk-go/service/shield"
+	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
+	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/create"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs"
+	tfshield "github.com/hashicorp/terraform-provider-aws/internal/service/shield"
+	"github.com/hashicorp/terraform-provider-aws/names"
+)
+
+// Acceptance test access AWS and cost money to run.
+func TestAccShieldDRTAccessRoleARNAssociation_basic(t *testing.T) {
+	ctx := acctest.Context(t)
+
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
+	var drtaccessrolearnassociation shield.DescribeDRTAccessOutput
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_shield_drt_access_role_arn_association.test"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			testAccPreCheckRoleARN(ctx, t)
+		},
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckDRTAccessRoleARNAssociationDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccDRTAccessRoleARNAssociationConfig_basic(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckDRTAccessRoleARNAssociationExists(ctx, resourceName, &drtaccessrolearnassociation),
+				),
+			},
+		},
+	})
+}
+
+func TestAccShieldDRTAccessRoleARNAssociation_disappears(t *testing.T) {
+	ctx := acctest.Context(t)
+	if testing.Short() {
+		t.Skip("skipping long-running test in short mode")
+	}
+
+	var drtaccessrolearnassociation shield.DescribeDRTAccessOutput
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_shield_drt_access_role_arn_association.test"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			testAccPreCheckRoleARN(ctx, t)
+		},
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckDRTAccessRoleARNAssociationDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccDRTAccessRoleARNAssociationConfig_basic(rName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckDRTAccessRoleARNAssociationExists(ctx, resourceName, &drtaccessrolearnassociation),
+					acctest.CheckFrameworkResourceDisappears(ctx, acctest.Provider, tfshield.ResourceDRTAccessRoleARNAssociation, resourceName),
+				),
+				ExpectNonEmptyPlan: true,
+			},
+		},
+	})
+}
+
+func testAccCheckDRTAccessRoleARNAssociationDestroy(ctx context.Context) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		conn := acctest.Provider.Meta().(*conns.AWSClient).ShieldConn(ctx)
+		for _, rs := range s.RootModule().Resources {
+			if rs.Type != "aws_shield_drt_access_role_arn_association" {
+				continue
+			}
+
+			input := &shield.DescribeDRTAccessInput{}
+			resp, err := conn.DescribeDRTAccessWithContext(ctx, input)
+
+			if errs.IsA[*shield.ResourceNotFoundException](err) {
+				return nil
+			}
+
+			if resp != nil && (resp.RoleArn == nil || *resp.RoleArn == "") {
+				return nil
+			}
+
+			return create.Error(names.Shield, create.ErrActionCheckingDestroyed, tfshield.ResNameDRTAccessRoleARNAssociation, rs.Primary.ID, errors.New("not destroyed"))
+		}
+		return nil
+	}
+}
+
+func testAccCheckDRTAccessRoleARNAssociationExists(ctx context.Context, name string, drtaccessrolearnassociation *shield.DescribeDRTAccessOutput) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[name]
+		if !ok {
+			return create.Error(names.Shield, create.ErrActionCheckingExistence, tfshield.ResNameDRTAccessLogBucketAssociation, name, errors.New("not found"))
+		}
+
+		if rs.Primary.ID == "" {
+			return create.Error(names.Shield, create.ErrActionCheckingExistence, tfshield.ResNameDRTAccessLogBucketAssociation, name, errors.New("not set"))
+		}
+		conn := acctest.Provider.Meta().(*conns.AWSClient).ShieldConn(ctx)
+		resp, err := conn.DescribeDRTAccessWithContext(ctx, &shield.DescribeDRTAccessInput{})
+		if err != nil {
+			return create.Error(names.Shield, create.ErrActionCheckingExistence, tfshield.ResNameDRTAccessRoleARNAssociation, "testing", err)
+		}
+
+		*drtaccessrolearnassociation = *resp
+		return nil
+	}
+}
+
+func testAccPreCheckRoleARN(ctx context.Context, t *testing.T) {
+	conn := acctest.Provider.Meta().(*conns.AWSClient).ShieldConn(ctx)
+
+	input := &shield.DescribeDRTAccessInput{}
+	_, err := conn.DescribeDRTAccessWithContext(ctx, input)
+	if acctest.PreCheckSkipError(err) {
+		t.Skipf("skipping acceptance testing: %s", err)
+	}
+	if err != nil {
+		t.Fatalf("unexpected PreCheck error: %s", err)
+	}
+}
+
+func testAccDRTAccessRoleARNAssociationConfig_basic(rName string) string {
+	return fmt.Sprintf(`
+data "aws_partition" "current" {}
+
+resource "aws_iam_role" "test" {
+  name = %[1]q
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        "Sid" : "",
+        "Effect" : "Allow",
+        "Principal" : {
+          "Service" : "drt.shield.amazonaws.com"
+        },
+        "Action" : "sts:AssumeRole"
+      },
+    ]
+  })
+}
+
+resource "aws_shield_protection_group" "test" {
+  protection_group_id = %[1]q
+  aggregation         = "MAX"
+  pattern             = "ALL"
+}
+
+resource "aws_iam_role_policy_attachment" "test" {
+  role       = aws_iam_role.test.name
+  policy_arn = "arn:${data.aws_partition.current.partition}:iam::aws:policy/service-role/AWSShieldDRTAccessPolicy"
+}
+
+resource "aws_shield_drt_access_role_arn_association" "test" {
+  role_arn = aws_iam_role.test.arn
+
+  depends_on = [aws_iam_role_policy_attachment.test]
+}
+`, rName)
+}
diff --git a/internal/service/shield/exports_test.go b/internal/service/shield/exports_test.go
new file mode 100644
index 00000000000..a8535ae0763
--- /dev/null
+++ b/internal/service/shield/exports_test.go
@@ -0,0 +1,11 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package shield
+
+// Exports for use in tests only.
+var (
+	ResourceDRTAccessRoleARNAssociation       = newResourceDRTAccessRoleARNAssociation
+	ResourceDRTAccessLogBucketAssociation     = newResourceDRTAccessLogBucketAssociation
+	ResourceApplicationLayerAutomaticResponse = newResourceApplicationLayerAutomaticResponse
+)
diff --git a/internal/service/shield/generate.go b/internal/service/shield/generate.go
index d5953d2462d..e4f0db018e8 100644
--- a/internal/service/shield/generate.go
+++ b/internal/service/shield/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTags -ListTagsInIDElem=ResourceARN -ServiceTagsSlice -TagInIDElem=ResourceARN -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/shield/id.go b/internal/service/shield/id.go
index 7ee3e22eafe..6f8da58b1ec 100644
--- a/internal/service/shield/id.go
+++ b/internal/service/shield/id.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package shield
 
 import (
diff --git a/internal/service/shield/protection.go b/internal/service/shield/protection.go
index 044eb933e6d..783095187e0 100644
--- a/internal/service/shield/protection.go
+++ b/internal/service/shield/protection.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package shield
 
 import (
diff --git a/internal/service/shield/protection_group.go b/internal/service/shield/protection_group.go
index 1ba2fcd88bc..a1737271d66 100644
--- a/internal/service/shield/protection_group.go
+++ b/internal/service/shield/protection_group.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package shield
 
 import (
diff --git a/internal/service/shield/protection_group_test.go b/internal/service/shield/protection_group_test.go
index bc8b7cb4e29..bbd06556d7e 100644
--- a/internal/service/shield/protection_group_test.go
+++ b/internal/service/shield/protection_group_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package shield_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/shield"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -144,7 +147,7 @@ func TestAccShieldProtectionGroup_members(t *testing.T) {
 					testAccCheckProtectionGroupExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "pattern", shield.ProtectionGroupPatternArbitrary),
 					resource.TestCheckResourceAttr(resourceName, "members.#", "1"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "members.0", "ec2", regexp.MustCompile(`eip-allocation/eipalloc-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "members.0", "ec2", regexache.MustCompile(`eip-allocation/eipalloc-.+`)),
 				),
 			},
 			{
diff --git a/internal/service/shield/protection_health_check_association.go b/internal/service/shield/protection_health_check_association.go
index 9ff416a5cdb..04fe573e634 100644
--- a/internal/service/shield/protection_health_check_association.go
+++ b/internal/service/shield/protection_health_check_association.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package shield
 
 import (
diff --git a/internal/service/shield/protection_health_check_association_test.go b/internal/service/shield/protection_health_check_association_test.go
index c33d00e311a..ae5ff790be4 100644
--- a/internal/service/shield/protection_health_check_association_test.go
+++ b/internal/service/shield/protection_health_check_association_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package shield_test
 
 import (
diff --git a/internal/service/shield/protection_test.go b/internal/service/shield/protection_test.go
index 45636250e9c..03fe4c82280 100644
--- a/internal/service/shield/protection_test.go
+++ b/internal/service/shield/protection_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package shield_test
 
 import (
diff --git a/internal/service/shield/service_package.go b/internal/service/shield/service_package.go
index 636d95af4d1..7ae182f311c 100644
--- a/internal/service/shield/service_package.go
+++ b/internal/service/shield/service_package.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package shield
 
 import (
diff --git a/internal/service/shield/service_package_gen.go b/internal/service/shield/service_package_gen.go
index 4e0318f9796..ca80da187ea 100644
--- a/internal/service/shield/service_package_gen.go
+++ b/internal/service/shield/service_package_gen.go
@@ -5,6 +5,7 @@ package shield
 import (
 	"context"
 
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -16,7 +17,20 @@ func (p *servicePackage) FrameworkDataSources(ctx context.Context) []*types.Serv
 }
 
 func (p *servicePackage) FrameworkResources(ctx context.Context) []*types.ServicePackageFrameworkResource {
-	return []*types.ServicePackageFrameworkResource{}
+	return []*types.ServicePackageFrameworkResource{
+		{
+			Factory: newResourceApplicationLayerAutomaticResponse,
+			Name:    "Application Layer Automatic Response",
+		},
+		{
+			Factory: newResourceDRTAccessLogBucketAssociation,
+			Name:    "DRT Access Log Bucket Association",
+		},
+		{
+			Factory: newResourceDRTAccessRoleARNAssociation,
+			Name:    "DRT Access Role ARN Association",
+		},
+	}
 }
 
 func (p *servicePackage) SDKDataSources(ctx context.Context) []*types.ServicePackageSDKDataSource {
@@ -52,4 +66,6 @@ func (p *servicePackage) ServicePackageName() string {
 	return names.Shield
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/shield/tags_gen.go b/internal/service/shield/tags_gen.go
index 7941e5312f5..ef63675ea32 100644
--- a/internal/service/shield/tags_gen.go
+++ b/internal/service/shield/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/shield"
 	"github.com/aws/aws-sdk-go/service/shield/shieldiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -102,6 +104,8 @@ func updateTags(ctx context.Context, conn shieldiface.ShieldAPI, identifier stri
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.Shield)
 	if len(removedTags) > 0 {
diff --git a/internal/service/signer/consts.go b/internal/service/signer/consts.go
index bcda216448a..4c03e15edf1 100644
--- a/internal/service/signer/consts.go
+++ b/internal/service/signer/consts.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package signer
 
 import (
diff --git a/internal/service/signer/exports_test.go b/internal/service/signer/exports_test.go
new file mode 100644
index 00000000000..84f5f99b009
--- /dev/null
+++ b/internal/service/signer/exports_test.go
@@ -0,0 +1,11 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package signer
+
+// Exports for use in tests only.
+var (
+	FindPermissionByTwoPartKey = findPermissionByTwoPartKey
+	FindSigningJobByID         = findSigningJobByID
+	FindSigningProfileByName   = findSigningProfileByName
+)
diff --git a/internal/service/signer/generate.go b/internal/service/signer/generate.go
index 78be6a81c8e..07c06aee301 100644
--- a/internal/service/signer/generate.go
+++ b/internal/service/signer/generate.go
@@ -1,4 +1,7 @@
-//go:generate go run ../../generate/tags/main.go -ListTags -ServiceTagsMap -UpdateTags
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+//go:generate go run ../../generate/tags/main.go -AWSSDKVersion=2 -SkipTypesImp -KVTValues -ListTags -ServiceTagsMap -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
 
diff --git a/internal/service/signer/service_package_gen.go b/internal/service/signer/service_package_gen.go
index 142043429a6..b0afad51649 100644
--- a/internal/service/signer/service_package_gen.go
+++ b/internal/service/signer/service_package_gen.go
@@ -5,9 +5,9 @@ package signer
 import (
 	"context"
 
-	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
-	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
-	signer_sdkv1 "github.com/aws/aws-sdk-go/service/signer"
+	aws_sdkv2 "github.com/aws/aws-sdk-go-v2/aws"
+	signer_sdkv2 "github.com/aws/aws-sdk-go-v2/service/signer"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -60,11 +60,17 @@ func (p *servicePackage) ServicePackageName() string {
 	return names.Signer
 }
 
-// NewConn returns a new AWS SDK for Go v1 client for this service package's AWS API.
-func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*signer_sdkv1.Signer, error) {
-	sess := config["session"].(*session_sdkv1.Session)
+// NewClient returns a new AWS SDK for Go v2 client for this service package's AWS API.
+func (p *servicePackage) NewClient(ctx context.Context, config map[string]any) (*signer_sdkv2.Client, error) {
+	cfg := *(config["aws_sdkv2_config"].(*aws_sdkv2.Config))
 
-	return signer_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
+	return signer_sdkv2.NewFromConfig(cfg, func(o *signer_sdkv2.Options) {
+		if endpoint := config["endpoint"].(string); endpoint != "" {
+			o.BaseEndpoint = aws_sdkv2.String(endpoint)
+		}
+	}), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/signer/signing_job.go b/internal/service/signer/signing_job.go
index 0d8f0ec7b4b..c8fed8290ad 100644
--- a/internal/service/signer/signing_job.go
+++ b/internal/service/signer/signing_job.go
@@ -1,18 +1,23 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package signer
 
 import (
 	"context"
+	"errors"
 	"log"
 	"time"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/aws/request"
-	"github.com/aws/aws-sdk-go/service/signer"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/signer"
+	"github.com/aws/aws-sdk-go-v2/service/signer/types"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
 // @SDKResource("aws_signer_signing_job")
@@ -200,7 +205,7 @@ func ResourceSigningJob() *schema.Resource {
 
 func resourceSigningJobCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).SignerConn(ctx)
+	conn := meta.(*conns.AWSClient).SignerClient(ctx)
 	profileName := d.Get("profile_name")
 	source := d.Get("source").([]interface{})
 	destination := d.Get("destination").([]interface{})
@@ -212,20 +217,26 @@ func resourceSigningJobCreate(ctx context.Context, d *schema.ResourceData, meta
 	}
 
 	log.Printf("[DEBUG] Starting Signer Signing Job using profile name %q.", profileName)
-	startSigningJobOutput, err := conn.StartSigningJobWithContext(ctx, startSigningJobInput)
+	startSigningJobOutput, err := conn.StartSigningJob(ctx, startSigningJobInput)
 	if err != nil {
 		return sdkdiag.AppendErrorf(diags, "creating Signing Job: %s", err)
 	}
 
-	jobId := aws.StringValue(startSigningJobOutput.JobId)
+	jobId := aws.ToString(startSigningJobOutput.JobId)
 
 	ignoreSigningJobFailure := d.Get("ignore_signing_job_failure").(bool)
 	log.Printf("[DEBUG] Waiting for Signer Signing Job ID (%s) to complete.", jobId)
-	err = conn.WaitUntilSuccessfulSigningJobWithContext(ctx, &signer.DescribeSigningJobInput{
+
+	waitInput := &signer.DescribeSigningJobInput{
 		JobId: aws.String(jobId),
-	}, request.WithWaiterMaxAttempts(200), request.WithWaiterDelay(request.ConstantWaiterDelay(5*time.Second)))
+	}
+	waiter := signer.NewSuccessfulSigningJobWaiter(conn)
+	waitTime := 5 * time.Minute
+	err = waiter.Wait(ctx, waitInput, waitTime)
+
 	if err != nil {
-		if !ignoreSigningJobFailure || !tfawserr.ErrCodeEquals(err, request.WaiterResourceNotReadyErrorCode) {
+		var rnr *types.ResourceNotFoundException
+		if !errors.As(err, &rnr) || !ignoreSigningJobFailure {
 			return sdkdiag.AppendErrorf(diags, "creating Signing Job: waiting for completion: %s", err)
 		}
 	}
@@ -237,14 +248,12 @@ func resourceSigningJobCreate(ctx context.Context, d *schema.ResourceData, meta
 
 func resourceSigningJobRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).SignerConn(ctx)
+	conn := meta.(*conns.AWSClient).SignerClient(ctx)
 	jobId := d.Id()
 
-	describeSigningJobOutput, err := conn.DescribeSigningJobWithContext(ctx, &signer.DescribeSigningJobInput{
-		JobId: aws.String(jobId),
-	})
+	describeSigningJobOutput, err := findSigningJobByID(ctx, conn, jobId)
 
-	if !d.IsNewResource() && tfawserr.ErrCodeEquals(err, signer.ErrCodeResourceNotFoundException) {
+	if !d.IsNewResource() && tfresource.NotFound(err) {
 		log.Printf("[WARN] Signer Signing Job (%s) not found, removing from state", d.Id())
 		d.SetId("")
 		return diags
@@ -258,11 +267,11 @@ func resourceSigningJobRead(ctx context.Context, d *schema.ResourceData, meta in
 		return sdkdiag.AppendErrorf(diags, "setting signer signing job id: %s", err)
 	}
 
-	if err := d.Set("completed_at", aws.TimeValue(describeSigningJobOutput.CompletedAt).Format(time.RFC3339)); err != nil {
+	if err := d.Set("completed_at", aws.ToTime(describeSigningJobOutput.CompletedAt).Format(time.RFC3339)); err != nil {
 		return sdkdiag.AppendErrorf(diags, "setting signer signing job completed at: %s", err)
 	}
 
-	if err := d.Set("created_at", aws.TimeValue(describeSigningJobOutput.CreatedAt).Format(time.RFC3339)); err != nil {
+	if err := d.Set("created_at", aws.ToTime(describeSigningJobOutput.CreatedAt).Format(time.RFC3339)); err != nil {
 		return sdkdiag.AppendErrorf(diags, "setting signer signing job created at: %s", err)
 	}
 
@@ -300,7 +309,7 @@ func resourceSigningJobRead(ctx context.Context, d *schema.ResourceData, meta in
 
 	signatureExpiresAt := ""
 	if describeSigningJobOutput.SignatureExpiresAt != nil {
-		signatureExpiresAt = aws.TimeValue(describeSigningJobOutput.SignatureExpiresAt).Format(time.RFC3339)
+		signatureExpiresAt = aws.ToTime(describeSigningJobOutput.SignatureExpiresAt).Format(time.RFC3339)
 	}
 	if err := d.Set("signature_expires_at", signatureExpiresAt); err != nil {
 		return sdkdiag.AppendErrorf(diags, "setting signer signing job requested by: %s", err)
@@ -325,7 +334,7 @@ func resourceSigningJobRead(ctx context.Context, d *schema.ResourceData, meta in
 	return diags
 }
 
-func flattenSigningJobRevocationRecord(apiObject *signer.SigningJobRevocationRecord) []interface{} {
+func flattenSigningJobRevocationRecord(apiObject *types.SigningJobRevocationRecord) []interface{} {
 	if apiObject == nil {
 		return []interface{}{}
 	}
@@ -333,21 +342,21 @@ func flattenSigningJobRevocationRecord(apiObject *signer.SigningJobRevocationRec
 	tfMap := map[string]interface{}{}
 
 	if v := apiObject.Reason; v != nil {
-		tfMap["reason"] = aws.StringValue(v)
+		tfMap["reason"] = aws.ToString(v)
 	}
 
 	if v := apiObject.RevokedAt; v != nil {
-		tfMap["revoked_at"] = aws.TimeValue(v).Format(time.RFC3339)
+		tfMap["revoked_at"] = aws.ToTime(v).Format(time.RFC3339)
 	}
 
 	if v := apiObject.RevokedBy; v != nil {
-		tfMap["revoked_by"] = aws.StringValue(v)
+		tfMap["revoked_by"] = aws.ToString(v)
 	}
 
 	return []interface{}{tfMap}
 }
 
-func flattenSigningJobSource(apiObject *signer.Source) []interface{} {
+func flattenSigningJobSource(apiObject *types.Source) []interface{} {
 	if apiObject == nil || apiObject.S3 == nil {
 		return []interface{}{}
 	}
@@ -359,7 +368,7 @@ func flattenSigningJobSource(apiObject *signer.Source) []interface{} {
 	return []interface{}{tfMap}
 }
 
-func flattenSigningJobS3Source(apiObject *signer.S3Source) []interface{} {
+func flattenSigningJobS3Source(apiObject *types.S3Source) []interface{} {
 	if apiObject == nil {
 		return nil
 	}
@@ -367,21 +376,21 @@ func flattenSigningJobS3Source(apiObject *signer.S3Source) []interface{} {
 	tfMap := map[string]interface{}{}
 
 	if v := apiObject.BucketName; v != nil {
-		tfMap["bucket"] = aws.StringValue(v)
+		tfMap["bucket"] = aws.ToString(v)
 	}
 
 	if v := apiObject.Key; v != nil {
-		tfMap["key"] = aws.StringValue(v)
+		tfMap["key"] = aws.ToString(v)
 	}
 
 	if v := apiObject.Version; v != nil {
-		tfMap["version"] = aws.StringValue(v)
+		tfMap["version"] = aws.ToString(v)
 	}
 
 	return []interface{}{tfMap}
 }
 
-func expandSigningJobSource(tfList []interface{}) *signer.Source {
+func expandSigningJobSource(tfList []interface{}) *types.Source {
 	if tfList == nil || tfList[0] == nil {
 		return nil
 	}
@@ -391,9 +400,9 @@ func expandSigningJobSource(tfList []interface{}) *signer.Source {
 		return nil
 	}
 
-	var source *signer.Source
+	var source *types.Source
 	if v, ok := tfMap["s3"].([]interface{}); ok && len(v) > 0 {
-		source = &signer.Source{
+		source = &types.Source{
 			S3: expandSigningJobS3Source(v),
 		}
 	}
@@ -401,7 +410,7 @@ func expandSigningJobSource(tfList []interface{}) *signer.Source {
 	return source
 }
 
-func expandSigningJobS3Source(tfList []interface{}) *signer.S3Source {
+func expandSigningJobS3Source(tfList []interface{}) *types.S3Source {
 	if tfList == nil || tfList[0] == nil {
 		return nil
 	}
@@ -410,7 +419,7 @@ func expandSigningJobS3Source(tfList []interface{}) *signer.S3Source {
 	if !ok {
 		return nil
 	}
-	s3Source := &signer.S3Source{}
+	s3Source := &types.S3Source{}
 
 	if v, ok := tfMap["bucket"].(string); ok {
 		s3Source.BucketName = aws.String(v)
@@ -427,7 +436,7 @@ func expandSigningJobS3Source(tfList []interface{}) *signer.S3Source {
 	return s3Source
 }
 
-func expandSigningJobDestination(tfList []interface{}) *signer.Destination {
+func expandSigningJobDestination(tfList []interface{}) *types.Destination {
 	if tfList == nil || tfList[0] == nil {
 		return nil
 	}
@@ -437,9 +446,9 @@ func expandSigningJobDestination(tfList []interface{}) *signer.Destination {
 		return nil
 	}
 
-	var destination *signer.Destination
+	var destination *types.Destination
 	if v, ok := tfMap["s3"].([]interface{}); ok && len(v) > 0 {
-		destination = &signer.Destination{
+		destination = &types.Destination{
 			S3: expandSigningJobS3Destination(v),
 		}
 	}
@@ -447,13 +456,13 @@ func expandSigningJobDestination(tfList []interface{}) *signer.Destination {
 	return destination
 }
 
-func expandSigningJobS3Destination(tfList []interface{}) *signer.S3Destination {
+func expandSigningJobS3Destination(tfList []interface{}) *types.S3Destination {
 	if tfList == nil {
 		return nil
 	}
 
 	tfMap := tfList[0].(map[string]interface{})
-	s3Destination := &signer.S3Destination{}
+	s3Destination := &types.S3Destination{}
 
 	if _, ok := tfMap["bucket"]; ok {
 		s3Destination.BucketName = aws.String(tfMap["bucket"].(string))
@@ -466,7 +475,7 @@ func expandSigningJobS3Destination(tfList []interface{}) *signer.S3Destination {
 	return s3Destination
 }
 
-func flattenSigningJobSignedObject(apiObject *signer.SignedObject) []interface{} {
+func flattenSigningJobSignedObject(apiObject *types.SignedObject) []interface{} {
 	if apiObject == nil || apiObject.S3 == nil {
 		return []interface{}{}
 	}
@@ -478,7 +487,7 @@ func flattenSigningJobSignedObject(apiObject *signer.SignedObject) []interface{}
 	return []interface{}{tfMap}
 }
 
-func flattenSigningJobS3SignedObject(apiObject *signer.S3SignedObject) []interface{} {
+func flattenSigningJobS3SignedObject(apiObject *types.S3SignedObject) []interface{} {
 	if apiObject == nil {
 		return nil
 	}
@@ -486,12 +495,38 @@ func flattenSigningJobS3SignedObject(apiObject *signer.S3SignedObject) []interfa
 	tfMap := map[string]interface{}{}
 
 	if v := apiObject.BucketName; v != nil {
-		tfMap["bucket"] = aws.StringValue(v)
+		tfMap["bucket"] = aws.ToString(v)
 	}
 
 	if v := apiObject.Key; v != nil {
-		tfMap["key"] = aws.StringValue(v)
+		tfMap["key"] = aws.ToString(v)
 	}
 
 	return []interface{}{tfMap}
 }
+
+func findSigningJobByID(ctx context.Context, conn *signer.Client, id string) (*signer.DescribeSigningJobOutput, error) {
+	in := &signer.DescribeSigningJobInput{
+		JobId: aws.String(id),
+	}
+
+	out, err := conn.DescribeSigningJob(ctx, in)
+
+	if err != nil {
+		return nil, err
+	}
+
+	var nfe *types.ResourceNotFoundException
+	if errors.As(err, &nfe) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: in,
+		}
+	}
+
+	if out == nil {
+		return nil, tfresource.NewEmptyResultError(in)
+	}
+
+	return out, nil
+}
diff --git a/internal/service/signer/signing_job_data_source.go b/internal/service/signer/signing_job_data_source.go
index b21bbfae84b..34d30d5cab9 100644
--- a/internal/service/signer/signing_job_data_source.go
+++ b/internal/service/signer/signing_job_data_source.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package signer
 
 import (
 	"context"
 	"time"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/signer"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/signer"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
@@ -148,10 +151,10 @@ func DataSourceSigningJob() *schema.Resource {
 
 func dataSourceSigningJobRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).SignerConn(ctx)
+	conn := meta.(*conns.AWSClient).SignerClient(ctx)
 	jobId := d.Get("job_id").(string)
 
-	describeSigningJobOutput, err := conn.DescribeSigningJobWithContext(ctx, &signer.DescribeSigningJobInput{
+	describeSigningJobOutput, err := conn.DescribeSigningJob(ctx, &signer.DescribeSigningJobInput{
 		JobId: aws.String(jobId),
 	})
 
@@ -159,11 +162,11 @@ func dataSourceSigningJobRead(ctx context.Context, d *schema.ResourceData, meta
 		return sdkdiag.AppendErrorf(diags, "reading Signer signing job (%s): %s", d.Id(), err)
 	}
 
-	if err := d.Set("completed_at", aws.TimeValue(describeSigningJobOutput.CompletedAt).Format(time.RFC3339)); err != nil {
+	if err := d.Set("completed_at", aws.ToTime(describeSigningJobOutput.CompletedAt).Format(time.RFC3339)); err != nil {
 		return sdkdiag.AppendErrorf(diags, "setting signer signing job completed at: %s", err)
 	}
 
-	if err := d.Set("created_at", aws.TimeValue(describeSigningJobOutput.CreatedAt).Format(time.RFC3339)); err != nil {
+	if err := d.Set("created_at", aws.ToTime(describeSigningJobOutput.CreatedAt).Format(time.RFC3339)); err != nil {
 		return sdkdiag.AppendErrorf(diags, "setting signer signing job created at: %s", err)
 	}
 
@@ -201,7 +204,7 @@ func dataSourceSigningJobRead(ctx context.Context, d *schema.ResourceData, meta
 
 	signatureExpiresAt := ""
 	if describeSigningJobOutput.SignatureExpiresAt != nil {
-		signatureExpiresAt = aws.TimeValue(describeSigningJobOutput.SignatureExpiresAt).Format(time.RFC3339)
+		signatureExpiresAt = aws.ToTime(describeSigningJobOutput.SignatureExpiresAt).Format(time.RFC3339)
 	}
 	if err := d.Set("signature_expires_at", signatureExpiresAt); err != nil {
 		return sdkdiag.AppendErrorf(diags, "setting signer signing job requested by: %s", err)
@@ -223,7 +226,7 @@ func dataSourceSigningJobRead(ctx context.Context, d *schema.ResourceData, meta
 		return sdkdiag.AppendErrorf(diags, "setting signer signing job status reason: %s", err)
 	}
 
-	d.SetId(aws.StringValue(describeSigningJobOutput.JobId))
+	d.SetId(aws.ToString(describeSigningJobOutput.JobId))
 
 	return diags
 }
diff --git a/internal/service/signer/signing_job_data_source_test.go b/internal/service/signer/signing_job_data_source_test.go
index 302d7284382..e65fbd76fdd 100644
--- a/internal/service/signer/signing_job_data_source_test.go
+++ b/internal/service/signer/signing_job_data_source_test.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package signer_test
 
 import (
 	"fmt"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/service/signer"
+	"github.com/aws/aws-sdk-go-v2/service/signer"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
@@ -21,7 +24,7 @@ func TestAccSignerSigningJobDataSource_basic(t *testing.T) {
 			acctest.PreCheck(ctx, t)
 			testAccPreCheckSingerSigningProfile(ctx, t, "AWSLambda-SHA384-ECDSA")
 		},
-		ErrorCheck:               acctest.ErrorCheck(t, signer.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, signer.ServiceID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		Steps: []resource.TestStep{
 			{
diff --git a/internal/service/signer/signing_job_test.go b/internal/service/signer/signing_job_test.go
index 007efa78a1b..17c66597513 100644
--- a/internal/service/signer/signing_job_test.go
+++ b/internal/service/signer/signing_job_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package signer_test
 
 import (
@@ -5,13 +8,13 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/signer"
+	"github.com/aws/aws-sdk-go-v2/service/signer"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	tfsigner "github.com/hashicorp/terraform-provider-aws/internal/service/signer"
 )
 
 func TestAccSignerSigningJob_basic(t *testing.T) {
@@ -28,7 +31,7 @@ func TestAccSignerSigningJob_basic(t *testing.T) {
 			acctest.PreCheck(ctx, t)
 			testAccPreCheckSingerSigningProfile(ctx, t, "AWSLambda-SHA384-ECDSA")
 		},
-		ErrorCheck:               acctest.ErrorCheck(t, signer.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, signer.ServiceID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             nil,
 		Steps: []resource.TestStep{
@@ -111,13 +114,9 @@ func testAccCheckSigningJobExists(ctx context.Context, res string, job *signer.D
 			return fmt.Errorf("Signing job with that ID does not exist")
 		}
 
-		conn := acctest.Provider.Meta().(*conns.AWSClient).SignerConn(ctx)
-
-		params := &signer.DescribeSigningJobInput{
-			JobId: aws.String(rs.Primary.ID),
-		}
+		conn := acctest.Provider.Meta().(*conns.AWSClient).SignerClient(ctx)
 
-		getJob, err := conn.DescribeSigningJobWithContext(ctx, params)
+		getJob, err := tfsigner.FindSigningJobByID(ctx, conn, rs.Primary.ID)
 		if err != nil {
 			return err
 		}
diff --git a/internal/service/signer/signing_profile.go b/internal/service/signer/signing_profile.go
index 14344268d22..2377887ebd2 100644
--- a/internal/service/signer/signing_profile.go
+++ b/internal/service/signer/signing_profile.go
@@ -1,22 +1,28 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package signer
 
 import (
 	"context"
 	"log"
-	"regexp"
-	"strings"
 	"time"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/signer"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/YakDriver/regexache"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/signer"
+	"github.com/aws/aws-sdk-go-v2/service/signer/types"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/create"
+	"github.com/hashicorp/terraform-provider-aws/internal/enum"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -35,13 +41,9 @@ func ResourceSigningProfile() *schema.Resource {
 		},
 
 		Schema: map[string]*schema.Schema{
-			"platform_id": {
+			"arn": {
 				Type:     schema.TypeString,
-				Required: true,
-				ForceNew: true,
-				ValidateFunc: validation.StringInSlice([]string{
-					"AWSLambda-SHA384-ECDSA"},
-					false),
+				Computed: true,
 			},
 			"name": {
 				Type:          schema.TypeString,
@@ -49,14 +51,45 @@ func ResourceSigningProfile() *schema.Resource {
 				Computed:      true,
 				ForceNew:      true,
 				ConflictsWith: []string{"name_prefix"},
-				ValidateFunc:  validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9_]{0,64}$`), "must be alphanumeric with max length of 64 characters"),
+				ValidateFunc:  validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_]{0,64}$`), "must be alphanumeric with max length of 64 characters"),
 			},
 			"name_prefix": {
 				Type:          schema.TypeString,
 				Optional:      true,
+				Computed:      true,
 				ForceNew:      true,
 				ConflictsWith: []string{"name"},
-				ValidateFunc:  validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9_]{0,38}$`), "must be alphanumeric with max length of 38 characters"),
+				ValidateFunc:  validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_]{0,38}$`), "must be alphanumeric with max length of 38 characters"),
+			},
+			"platform_display_name": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"platform_id": {
+				Type:         schema.TypeString,
+				Required:     true,
+				ForceNew:     true,
+				ValidateFunc: validation.StringInSlice(PlatformID_Values(), false),
+			},
+			"revocation_record": {
+				Type:     schema.TypeList,
+				Computed: true,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"revocation_effective_from": {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+						"revoked_at": {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+						"revoked_by": {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+					},
+				},
 			},
 			"signature_validity_period": {
 				Type:     schema.TypeList,
@@ -66,46 +99,32 @@ func ResourceSigningProfile() *schema.Resource {
 				ForceNew: true,
 				Elem: &schema.Resource{
 					Schema: map[string]*schema.Schema{
+						"type": {
+							Type:             schema.TypeString,
+							Required:         true,
+							ForceNew:         true,
+							ValidateDiagFunc: enum.Validate[types.ValidityType](),
+						},
 						"value": {
 							Type:     schema.TypeInt,
 							Required: true,
 							ForceNew: true,
 						},
-						"type": {
-							Type:         schema.TypeString,
-							Required:     true,
-							ForceNew:     true,
-							ValidateFunc: validation.StringInSlice(signer.ValidityType_Values(), false),
-						},
 					},
 				},
 			},
-			names.AttrTags:    tftags.TagsSchema(),
-			names.AttrTagsAll: tftags.TagsSchemaComputed(),
-			"arn": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
-			"platform_display_name": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
-			"revocation_record": {
+			"signing_material": {
 				Type:     schema.TypeList,
+				MaxItems: 1,
 				Computed: true,
+				Optional: true,
+				ForceNew: true,
 				Elem: &schema.Resource{
 					Schema: map[string]*schema.Schema{
-						"revocation_effective_from": {
-							Type:     schema.TypeString,
-							Computed: true,
-						},
-						"revoked_at": {
+						"certificate_arn": {
 							Type:     schema.TypeString,
-							Computed: true,
-						},
-						"revoked_by": {
-							Type:     schema.TypeString,
-							Computed: true,
+							Required: true,
+							ForceNew: true,
 						},
 					},
 				},
@@ -114,6 +133,8 @@ func ResourceSigningProfile() *schema.Resource {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
+			names.AttrTags:    tftags.TagsSchema(),
+			names.AttrTagsAll: tftags.TagsSchemaComputed(),
 			"version": {
 				Type:     schema.TypeString,
 				Computed: true,
@@ -130,97 +151,86 @@ func ResourceSigningProfile() *schema.Resource {
 
 func resourceSigningProfileCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).SignerConn(ctx)
-
-	log.Printf("[DEBUG] Creating Signer signing profile")
-
-	profileName := create.Name(d.Get("name").(string), d.Get("name_prefix").(string))
-	profileName = strings.Replace(profileName, "-", "_", -1)
-
-	signingProfileInput := &signer.PutSigningProfileInput{
-		ProfileName: aws.String(profileName),
+	conn := meta.(*conns.AWSClient).SignerClient(ctx)
+
+	name := create.NewNameGenerator(
+		create.WithConfiguredName(d.Get("name").(string)),
+		create.WithConfiguredPrefix(d.Get("name_prefix").(string)),
+		create.WithDefaultPrefix("terraform_"),
+	).Generate()
+	input := &signer.PutSigningProfileInput{
 		PlatformId:  aws.String(d.Get("platform_id").(string)),
+		ProfileName: aws.String(name),
 		Tags:        getTagsIn(ctx),
 	}
 
 	if v, exists := d.GetOk("signature_validity_period"); exists {
 		signatureValidityPeriod := v.([]interface{})[0].(map[string]interface{})
-		signingProfileInput.SignatureValidityPeriod = &signer.SignatureValidityPeriod{
-			Value: aws.Int64(int64(signatureValidityPeriod["value"].(int))),
-			Type:  aws.String(signatureValidityPeriod["type"].(string)),
+		input.SignatureValidityPeriod = &types.SignatureValidityPeriod{
+			Value: int32(signatureValidityPeriod["value"].(int)),
+			Type:  types.ValidityType(signatureValidityPeriod["type"].(string)),
 		}
 	}
 
-	_, err := conn.PutSigningProfileWithContext(ctx, signingProfileInput)
+	if v, ok := d.Get("signing_material").([]interface{}); ok && len(v) > 0 {
+		input.SigningMaterial = expandSigningMaterial(v)
+	}
+
+	_, err := conn.PutSigningProfile(ctx, input)
+
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "creating Signer signing profile: %s", err)
+		return sdkdiag.AppendErrorf(diags, "creating Signer Signing Profile (%s): %s", name, err)
 	}
 
-	d.SetId(profileName)
+	d.SetId(name)
 
 	return append(diags, resourceSigningProfileRead(ctx, d, meta)...)
 }
 
 func resourceSigningProfileRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).SignerConn(ctx)
+	conn := meta.(*conns.AWSClient).SignerClient(ctx)
 
-	signingProfileOutput, err := conn.GetSigningProfileWithContext(ctx, &signer.GetSigningProfileInput{
-		ProfileName: aws.String(d.Id()),
-	})
+	output, err := findSigningProfileByName(ctx, conn, d.Id())
 
-	if !d.IsNewResource() && tfawserr.ErrCodeEquals(err, signer.ErrCodeResourceNotFoundException) {
+	if !d.IsNewResource() && tfresource.NotFound(err) {
 		log.Printf("[WARN] Signer Signing Profile (%s) not found, removing from state", d.Id())
 		d.SetId("")
 		return diags
 	}
 
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "reading Signer signing profile (%s): %s", d.Id(), err)
-	}
-
-	if err := d.Set("platform_id", signingProfileOutput.PlatformId); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting signer signing profile platform id: %s", err)
-	}
-
-	if err := d.Set("signature_validity_period", []interface{}{
-		map[string]interface{}{
-			"value": signingProfileOutput.SignatureValidityPeriod.Value,
-			"type":  signingProfileOutput.SignatureValidityPeriod.Type,
-		},
-	}); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting signer signing profile signature validity period: %s", err)
-	}
-
-	if err := d.Set("platform_display_name", signingProfileOutput.PlatformDisplayName); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting signer signing profile platform display name: %s", err)
+		return sdkdiag.AppendErrorf(diags, "reading Signer Signing Profile (%s): %s", d.Id(), err)
 	}
 
-	if err := d.Set("name", signingProfileOutput.ProfileName); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting signer signing profile name: %s", err)
+	d.Set("arn", output.Arn)
+	d.Set("name", output.ProfileName)
+	d.Set("name_prefix", create.NamePrefixFromName(aws.ToString(output.ProfileName)))
+	d.Set("platform_display_name", output.PlatformDisplayName)
+	d.Set("platform_id", output.PlatformId)
+	if err := d.Set("revocation_record", flattenSigningProfileRevocationRecord(output.RevocationRecord)); err != nil {
+		return sdkdiag.AppendErrorf(diags, "setting revocation_record: %s", err)
 	}
-
-	if err := d.Set("arn", signingProfileOutput.Arn); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting signer signing profile arn: %s", err)
-	}
-
-	if err := d.Set("version", signingProfileOutput.ProfileVersion); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting signer signing profile version: %s", err)
-	}
-
-	if err := d.Set("version_arn", signingProfileOutput.ProfileVersionArn); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting signer signing profile version arn: %s", err)
+	if v := output.SignatureValidityPeriod; v != nil {
+		if err := d.Set("signature_validity_period", []interface{}{
+			map[string]interface{}{
+				"value": v.Value,
+				"type":  v.Type,
+			},
+		}); err != nil {
+			return sdkdiag.AppendErrorf(diags, "setting signature_validity_period: %s", err)
+		}
 	}
-
-	if err := d.Set("status", signingProfileOutput.Status); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting signer signing profile status: %s", err)
+	if output.SigningMaterial != nil {
+		if err := d.Set("signing_material", flattenSigningMaterial(output.SigningMaterial)); err != nil {
+			return sdkdiag.AppendErrorf(diags, "setting signing_material: %s", err)
+		}
 	}
+	d.Set("status", output.Status)
+	d.Set("version", output.ProfileVersion)
+	d.Set("version_arn", output.ProfileVersionArn)
 
-	setTagsOut(ctx, signingProfileOutput.Tags)
-
-	if err := d.Set("revocation_record", flattenSigningProfileRevocationRecord(signingProfileOutput.RevocationRecord)); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting signer signing profile revocation record: %s", err)
-	}
+	setTagsOut(ctx, output.Tags)
 
 	return diags
 }
@@ -235,24 +245,52 @@ func resourceSigningProfileUpdate(ctx context.Context, d *schema.ResourceData, m
 
 func resourceSigningProfileDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).SignerConn(ctx)
+	conn := meta.(*conns.AWSClient).SignerClient(ctx)
 
-	_, err := conn.CancelSigningProfileWithContext(ctx, &signer.CancelSigningProfileInput{
+	log.Printf("[DEBUG] Deleting Signer Signing Profile: %s", d.Id())
+	_, err := conn.CancelSigningProfile(ctx, &signer.CancelSigningProfileInput{
 		ProfileName: aws.String(d.Id()),
 	})
 
+	if errs.IsA[*types.ResourceNotFoundException](err) {
+		return diags
+	}
+
 	if err != nil {
-		if tfawserr.ErrCodeEquals(err, signer.ErrCodeResourceNotFoundException) {
-			return diags
-		}
-		return sdkdiag.AppendErrorf(diags, "canceling Signer signing profile (%s): %s", d.Id(), err)
+		return sdkdiag.AppendErrorf(diags, "deleting Signer Signing Profile (%s): %s", d.Id(), err)
 	}
 
-	log.Printf("[DEBUG] Signer signing profile %q canceled", d.Id())
 	return diags
 }
 
-func flattenSigningProfileRevocationRecord(apiObject *signer.SigningProfileRevocationRecord) interface{} {
+func expandSigningMaterial(in []interface{}) *types.SigningMaterial {
+	if len(in) == 0 {
+		return nil
+	}
+
+	m := in[0].(map[string]interface{})
+	var out types.SigningMaterial
+
+	if v, ok := m["certificate_arn"].(string); ok && v != "" {
+		out.CertificateArn = aws.String(v)
+	}
+
+	return &out
+}
+
+func flattenSigningMaterial(apiObject *types.SigningMaterial) []interface{} {
+	if apiObject == nil {
+		return nil
+	}
+
+	m := map[string]interface{}{
+		"certificate_arn": aws.ToString(apiObject.CertificateArn),
+	}
+
+	return []interface{}{m}
+}
+
+func flattenSigningProfileRevocationRecord(apiObject *types.SigningProfileRevocationRecord) interface{} {
 	if apiObject == nil {
 		return []interface{}{}
 	}
@@ -260,16 +298,57 @@ func flattenSigningProfileRevocationRecord(apiObject *signer.SigningProfileRevoc
 	tfMap := map[string]interface{}{}
 
 	if v := apiObject.RevocationEffectiveFrom; v != nil {
-		tfMap["revocation_effective_from"] = aws.TimeValue(v).Format(time.RFC3339)
+		tfMap["revocation_effective_from"] = aws.ToTime(v).Format(time.RFC3339)
 	}
 
 	if v := apiObject.RevokedAt; v != nil {
-		tfMap["revoked_at"] = aws.TimeValue(v).Format(time.RFC3339)
+		tfMap["revoked_at"] = aws.ToTime(v).Format(time.RFC3339)
 	}
 
 	if v := apiObject.RevokedBy; v != nil {
-		tfMap["revoked_by"] = aws.StringValue(v)
+		tfMap["revoked_by"] = aws.ToString(v)
 	}
 
 	return []interface{}{tfMap}
 }
+
+func PlatformID_Values() []string {
+	return []string{
+		"AWSLambda-SHA384-ECDSA",
+		"Notation-OCI-SHA384-ECDSA",
+		"AWSIoTDeviceManagement-SHA256-ECDSA",
+		"AmazonFreeRTOS-TI-CC3220SF",
+		"AmazonFreeRTOS-Default"}
+}
+
+func findSigningProfileByName(ctx context.Context, conn *signer.Client, name string) (*signer.GetSigningProfileOutput, error) {
+	input := &signer.GetSigningProfileInput{
+		ProfileName: aws.String(name),
+	}
+
+	output, err := conn.GetSigningProfile(ctx, input)
+
+	if errs.IsA[*types.ResourceNotFoundException](err) {
+		return nil, &retry.NotFoundError{
+			LastRequest: input,
+			LastError:   err,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	if output == nil {
+		return nil, tfresource.NewEmptyResultError(input)
+	}
+
+	if status := output.Status; status == types.SigningProfileStatusCanceled {
+		return nil, &retry.NotFoundError{
+			Message:     string(status),
+			LastRequest: input,
+		}
+	}
+
+	return output, nil
+}
diff --git a/internal/service/signer/signing_profile_data_source.go b/internal/service/signer/signing_profile_data_source.go
index 2872adf5d64..588883b245b 100644
--- a/internal/service/signer/signing_profile_data_source.go
+++ b/internal/service/signer/signing_profile_data_source.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package signer
 
 import (
 	"context"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/signer"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/signer"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
@@ -89,11 +92,11 @@ func DataSourceSigningProfile() *schema.Resource {
 
 func dataSourceSigningProfileRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).SignerConn(ctx)
+	conn := meta.(*conns.AWSClient).SignerClient(ctx)
 	ignoreTagsConfig := meta.(*conns.AWSClient).IgnoreTagsConfig
 
 	profileName := d.Get("name").(string)
-	signingProfileOutput, err := conn.GetSigningProfileWithContext(ctx, &signer.GetSigningProfileInput{
+	signingProfileOutput, err := conn.GetSigningProfile(ctx, &signer.GetSigningProfileInput{
 		ProfileName: aws.String(profileName),
 	})
 
@@ -142,7 +145,7 @@ func dataSourceSigningProfileRead(ctx context.Context, d *schema.ResourceData, m
 		return sdkdiag.AppendErrorf(diags, "setting signer signing profile revocation record: %s", err)
 	}
 
-	d.SetId(aws.StringValue(signingProfileOutput.ProfileName))
+	d.SetId(aws.ToString(signingProfileOutput.ProfileName))
 
 	return diags
 }
diff --git a/internal/service/signer/signing_profile_data_source_test.go b/internal/service/signer/signing_profile_data_source_test.go
index 9efabf2fdbd..965bc0b854b 100644
--- a/internal/service/signer/signing_profile_data_source_test.go
+++ b/internal/service/signer/signing_profile_data_source_test.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package signer_test
 
 import (
 	"fmt"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/service/signer"
+	"github.com/aws/aws-sdk-go-v2/service/signer"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
@@ -22,7 +25,7 @@ func TestAccSignerSigningProfileDataSource_basic(t *testing.T) {
 			acctest.PreCheck(ctx, t)
 			testAccPreCheckSingerSigningProfile(ctx, t, "AWSLambda-SHA384-ECDSA")
 		},
-		ErrorCheck:               acctest.ErrorCheck(t, signer.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, signer.ServiceID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		Steps: []resource.TestStep{
 			{
diff --git a/internal/service/signer/signing_profile_permission.go b/internal/service/signer/signing_profile_permission.go
index 982d616e6e1..2f5dde56dcf 100644
--- a/internal/service/signer/signing_profile_permission.go
+++ b/internal/service/signer/signing_profile_permission.go
@@ -1,22 +1,27 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package signer
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"strings"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/signer"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/YakDriver/regexache"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/signer"
+	"github.com/aws/aws-sdk-go-v2/service/signer/types"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/create"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
+	tfslices "github.com/hashicorp/terraform-provider-aws/internal/slices"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
@@ -32,12 +37,6 @@ func ResourceSigningProfilePermission() *schema.Resource {
 		},
 
 		Schema: map[string]*schema.Schema{
-			"profile_name": {
-				Type:         schema.TypeString,
-				Required:     true,
-				ForceNew:     true,
-				ValidateFunc: validation.StringLenBetween(2, 64),
-			},
 			"action": {
 				Type:     schema.TypeString,
 				Required: true,
@@ -45,14 +44,21 @@ func ResourceSigningProfilePermission() *schema.Resource {
 				ValidateFunc: validation.StringInSlice([]string{
 					"signer:StartSigningJob",
 					"signer:GetSigningProfile",
-					"signer:RevokeSignature"},
-					false),
+					"signer:RevokeSignature",
+					"signer:SignPayload",
+				}, false),
 			},
 			"principal": {
 				Type:     schema.TypeString,
 				Required: true,
 				ForceNew: true,
 			},
+			"profile_name": {
+				Type:         schema.TypeString,
+				Required:     true,
+				ForceNew:     true,
+				ValidateFunc: validation.StringLenBetween(2, 64),
+			},
 			"profile_version": {
 				Type:         schema.TypeString,
 				Optional:     true,
@@ -66,14 +72,15 @@ func ResourceSigningProfilePermission() *schema.Resource {
 				Computed:      true,
 				ForceNew:      true,
 				ConflictsWith: []string{"statement_id_prefix"},
-				ValidateFunc:  validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9-_]{0,64}$`), "must be alphanumeric with max length of 64 characters"),
+				ValidateFunc:  validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_-]{0,64}$`), "must be alphanumeric with max length of 64 characters"),
 			},
 			"statement_id_prefix": {
 				Type:          schema.TypeString,
 				Optional:      true,
+				Computed:      true,
 				ForceNew:      true,
 				ConflictsWith: []string{"statement_id"},
-				ValidateFunc:  validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9-_]{0,38}$`), "must be alphanumeric with max length of 38 characters"),
+				ValidateFunc:  validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_-]{0,38}$`), "must be alphanumeric with max length of 38 characters"),
 			},
 		},
 	}
@@ -81,215 +88,141 @@ func ResourceSigningProfilePermission() *schema.Resource {
 
 func resourceSigningProfilePermissionCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).SignerConn(ctx)
+	conn := meta.(*conns.AWSClient).SignerClient(ctx)
 
 	profileName := d.Get("profile_name").(string)
 
 	conns.GlobalMutexKV.Lock(profileName)
 	defer conns.GlobalMutexKV.Unlock(profileName)
 
-	listProfilePermissionsInput := &signer.ListProfilePermissionsInput{
+	var revisionID string
+	output, err := conn.ListProfilePermissions(ctx, &signer.ListProfilePermissionsInput{
 		ProfileName: aws.String(profileName),
-	}
+	})
 
-	var revisionId string
-	getProfilePermissionsOutput, err := conn.ListProfilePermissionsWithContext(ctx, listProfilePermissionsInput)
-	if err != nil {
-		if tfawserr.ErrCodeEquals(err, signer.ErrCodeResourceNotFoundException) {
-			revisionId = ""
-		} else {
-			return sdkdiag.AppendErrorf(diags, "creating Signer Signing Profile Permission: %s", err)
-		}
-	} else {
-		revisionId = aws.StringValue(getProfilePermissionsOutput.RevisionId)
+	if err == nil {
+		revisionID = aws.ToString(output.RevisionId)
+	} else if !errs.IsA[*types.ResourceNotFoundException](err) {
+		return sdkdiag.AppendErrorf(diags, "reading Signer Signing Profile (%s) Permissions: %s", profileName, err)
 	}
 
-	statementId := create.Name(d.Get("statement_id").(string), d.Get("statement_id_prefix").(string))
-
-	addProfilePermissionInput := &signer.AddProfilePermissionInput{
+	statementID := create.Name(d.Get("statement_id").(string), d.Get("statement_id_prefix").(string))
+	input := &signer.AddProfilePermissionInput{
 		Action:      aws.String(d.Get("action").(string)),
 		Principal:   aws.String(d.Get("principal").(string)),
 		ProfileName: aws.String(profileName),
-		RevisionId:  aws.String(revisionId),
-		StatementId: aws.String(statementId),
+		RevisionId:  aws.String(revisionID),
+		StatementId: aws.String(statementID),
 	}
 
 	if v, ok := d.GetOk("profile_version"); ok {
-		addProfilePermissionInput.ProfileVersion = aws.String(v.(string))
+		input.ProfileVersion = aws.String(v.(string))
 	}
 
-	log.Printf("[DEBUG] Adding new Signer Signing Profile Permission: %s", addProfilePermissionInput)
-	// Retry for IAM eventual consistency
-	err = retry.RetryContext(ctx, propagationTimeout, func() *retry.RetryError {
-		_, err := conn.AddProfilePermissionWithContext(ctx, addProfilePermissionInput)
+	_, err = tfresource.RetryWhen(ctx, propagationTimeout,
+		func() (interface{}, error) {
+			return conn.AddProfilePermission(ctx, input)
+		},
+		func(err error) (bool, error) {
+			if errs.IsA[*types.ConflictException](err) || errs.IsA[*types.ResourceNotFoundException](err) {
+				return true, err
+			}
 
-		if tfawserr.ErrCodeEquals(err, signer.ErrCodeConflictException) || tfawserr.ErrCodeEquals(err, signer.ErrCodeResourceNotFoundException) {
-			return retry.RetryableError(err)
-		}
-		if err != nil {
-			return retry.NonRetryableError(err)
-		}
+			return false, err
+		},
+	)
 
-		return nil
-	})
-	if tfresource.TimedOut(err) {
-		_, err = conn.AddProfilePermissionWithContext(ctx, addProfilePermissionInput)
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "adding Signer Signing Profile (%s) Permission: %s", profileName, err)
 	}
 
+	d.SetId(fmt.Sprintf("%s/%s", profileName, statementID))
+
+	_, err = tfresource.RetryWhenNotFound(ctx, propagationTimeout, func() (interface{}, error) {
+		return findPermissionByTwoPartKey(ctx, conn, profileName, statementID)
+	})
+
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "adding new Signer Signing Profile Permission for %q: %s", profileName, err)
+		return sdkdiag.AppendErrorf(diags, "waiting for Signer Signing Profile Permission (%s) create: %s", d.Id(), err)
 	}
 
-	d.Set("statement_id", statementId)
-	d.SetId(fmt.Sprintf("%s/%s", profileName, statementId))
+	d.Set("statement_id", statementID)
 
 	return append(diags, resourceSigningProfilePermissionRead(ctx, d, meta)...)
 }
 
 func resourceSigningProfilePermissionRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).SignerConn(ctx)
+	conn := meta.(*conns.AWSClient).SignerClient(ctx)
 
-	listProfilePermissionsInput := &signer.ListProfilePermissionsInput{
-		ProfileName: aws.String(d.Get("profile_name").(string)),
-	}
+	profileName, statementID := d.Get("profile_name").(string), d.Get("statement_id").(string)
+	permission, err := findPermissionByTwoPartKey(ctx, conn, profileName, statementID)
 
-	log.Printf("[DEBUG] Getting Signer Signing Profile Permissions: %s", listProfilePermissionsInput)
-	var listProfilePermissionsOutput *signer.ListProfilePermissionsOutput
-	err := retry.RetryContext(ctx, propagationTimeout, func() *retry.RetryError {
-		// IAM is eventually consistent :/
-		var err error
-		listProfilePermissionsOutput, err = conn.ListProfilePermissionsWithContext(ctx, listProfilePermissionsInput)
-		if err != nil {
-			if tfawserr.ErrCodeEquals(err, signer.ErrCodeResourceNotFoundException) {
-				return retry.RetryableError(err)
-			}
-			return retry.NonRetryableError(err)
-		}
-
-		return nil
-	})
-	if tfresource.TimedOut(err) {
-		listProfilePermissionsOutput, err = conn.ListProfilePermissionsWithContext(ctx, listProfilePermissionsInput)
-	}
-
-	if !d.IsNewResource() && tfawserr.ErrCodeEquals(err, signer.ErrCodeResourceNotFoundException) {
-		log.Printf("[WARN] No Signer Signing Profile Permissions found (%s), removing from state", d.Id())
+	if !d.IsNewResource() && tfresource.NotFound(err) {
+		log.Printf("[WARN] Signer Signing Profile Permission (%s) not found, removing from state", d.Id())
 		d.SetId("")
 		return diags
 	}
 
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "reading Signer Signing Profile Permissions (%s): %s", d.Id(), err)
-	}
-
-	statementId := d.Get("statement_id").(string)
-	permission := getProfilePermission(listProfilePermissionsOutput.Permissions, statementId)
-	if permission == nil {
-		log.Printf("[WARN] No Signer Signing Profile Permission found matching statement id: %s", statementId)
-		d.SetId("")
-		return diags
+		return sdkdiag.AppendErrorf(diags, "reading Signer Signing Profile Permission (%s): %s", d.Id(), err)
 	}
 
-	if err := d.Set("action", permission.Action); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting signer signing profile permission action: %s", err)
-	}
-	if err := d.Set("principal", permission.Principal); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting signer signing profile permission principal: %s", err)
-	}
-	if err := d.Set("profile_version", permission.ProfileVersion); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting signer signing profile permission profile version: %s", err)
-	}
-	if err := d.Set("statement_id", permission.StatementId); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting signer signing profile permission statement id: %s", err)
-	}
+	d.Set("action", permission.Action)
+	d.Set("principal", permission.Principal)
+	d.Set("profile_version", permission.ProfileVersion)
+	d.Set("statement_id", permission.StatementId)
+	d.Set("statement_id_prefix", create.NamePrefixFromName(aws.ToString(permission.StatementId)))
 
 	return diags
 }
 
-func getProfilePermission(permissions []*signer.Permission, statementId string) *signer.Permission {
-	for _, permission := range permissions {
-		if permission == nil {
-			continue
-		}
-
-		if aws.StringValue(permission.StatementId) == statementId {
-			return permission
-		}
-	}
-
-	return nil
-}
-
 func resourceSigningProfilePermissionDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).SignerConn(ctx)
+	conn := meta.(*conns.AWSClient).SignerClient(ctx)
 
 	profileName := d.Get("profile_name").(string)
 
 	conns.GlobalMutexKV.Lock(profileName)
 	defer conns.GlobalMutexKV.Unlock(profileName)
 
-	listProfilePermissionsInput := &signer.ListProfilePermissionsInput{
+	output, err := conn.ListProfilePermissions(ctx, &signer.ListProfilePermissionsInput{
 		ProfileName: aws.String(profileName),
-	}
-
-	listProfilePermissionsOutput, err := conn.ListProfilePermissionsWithContext(ctx, listProfilePermissionsInput)
-	if err != nil {
-		if tfawserr.ErrCodeEquals(err, signer.ErrCodeResourceNotFoundException) {
-			log.Printf("[WARN] No Signer Signing Profile Permission found for: %v", listProfilePermissionsInput)
-			return diags
-		}
-		return sdkdiag.AppendErrorf(diags, "deleting Signer Signing Profile Permission (%s): %s", d.Id(), err)
-	}
-
-	revisionId := aws.StringValue(listProfilePermissionsOutput.RevisionId)
+	})
 
-	statementId := d.Get("statement_id").(string)
-	permission := getProfilePermission(listProfilePermissionsOutput.Permissions, statementId)
-	if permission == nil {
-		log.Printf("[WARN] No Signer Signing Profile Permission found matching statement id: %s", statementId)
+	if errs.IsA[*types.ResourceNotFoundException](err) {
 		return diags
 	}
 
-	removeProfilePermissionInput := &signer.RemoveProfilePermissionInput{
-		ProfileName: aws.String(profileName),
-		RevisionId:  aws.String(revisionId),
-		StatementId: permission.StatementId,
-	}
-
-	log.Printf("[DEBUG] Removing Signer singing profile permission: %s", removeProfilePermissionInput)
-	_, err = conn.RemoveProfilePermissionWithContext(ctx, removeProfilePermissionInput)
 	if err != nil {
-		if tfawserr.ErrCodeEquals(err, signer.ErrCodeResourceNotFoundException) {
-			log.Printf("[WARN] No Signer Signing Profile Permission found: %v", removeProfilePermissionInput)
-			return diags
-		}
-		return sdkdiag.AppendErrorf(diags, "deleting Signer Signing Profile Permission (%s): %s", d.Id(), err)
+		return sdkdiag.AppendErrorf(diags, "reading Signer Signing Profile (%s) Permissions: %s", profileName, err)
 	}
 
-	params := &signer.ListProfilePermissionsInput{
-		ProfileName: aws.String(profileName),
-	}
+	revisionID := aws.ToString(output.RevisionId)
+	statementID := d.Get("statement_id").(string)
 
-	resp, err := conn.ListProfilePermissionsWithContext(ctx, params)
+	log.Printf("[DEBUG] Deleting Signer Signing Profile Permission: %s", d.Id())
+	_, err = conn.RemoveProfilePermission(ctx, &signer.RemoveProfilePermissionInput{
+		ProfileName: aws.String(profileName),
+		RevisionId:  aws.String(revisionID),
+		StatementId: aws.String(statementID),
+	})
 
-	if tfawserr.ErrCodeEquals(err, signer.ErrCodeResourceNotFoundException) {
+	if errs.IsA[*types.ResourceNotFoundException](err) {
 		return diags
 	}
 
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "getting Signer Signing Profile Permissions: %s", err)
+		return sdkdiag.AppendErrorf(diags, "deleting Signer Signing Profile Permission (%s): %s", d.Id(), err)
 	}
 
-	if len(resp.Permissions) > 0 {
-		permission := getProfilePermission(resp.Permissions, statementId)
-		if permission != nil {
-			return sdkdiag.AppendErrorf(diags, "to delete Signer singing profile permission with ID %q", statementId)
-		}
-	}
+	_, err = tfresource.RetryUntilNotFound(ctx, propagationTimeout, func() (interface{}, error) {
+		return findPermissionByTwoPartKey(ctx, conn, profileName, statementID)
+	})
 
-	log.Printf("[DEBUG] Signer Signing Profile Permission with ID %q removed", statementId)
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "waiting for Signer Signing Profile Permission (%s) delete: %s", d.Id(), err)
+	}
 
 	return diags
 }
@@ -300,11 +233,65 @@ func resourceSigningProfilePermissionImport(ctx context.Context, d *schema.Resou
 		return nil, fmt.Errorf("unexpected format of ID (%q), expected PROFILE_NAME/STATEMENT_ID", d.Id())
 	}
 
-	profileName := idParts[0]
-	statementId := idParts[1]
+	profileName, statementID := idParts[0], idParts[1]
 
 	d.Set("profile_name", profileName)
-	d.Set("statement_id", statementId)
-	d.SetId(statementId)
+	d.Set("statement_id", statementID)
+	d.SetId(fmt.Sprintf("%s/%s", profileName, statementID))
+
 	return []*schema.ResourceData{d}, nil
 }
+
+func findPermissionByTwoPartKey(ctx context.Context, conn *signer.Client, profileName, statementID string) (*types.Permission, error) {
+	input := &signer.ListProfilePermissionsInput{
+		ProfileName: aws.String(profileName),
+	}
+
+	return findPermission(ctx, conn, input, func(v types.Permission) bool {
+		return aws.ToString(v.StatementId) == statementID
+	})
+}
+
+func findPermission(ctx context.Context, conn *signer.Client, input *signer.ListProfilePermissionsInput, filter tfslices.Predicate[types.Permission]) (*types.Permission, error) {
+	output, err := findPermissions(ctx, conn, input, filter)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return tfresource.AssertSingleValueResult(output)
+}
+
+func findPermissions(ctx context.Context, conn *signer.Client, input *signer.ListProfilePermissionsInput, filter tfslices.Predicate[types.Permission]) ([]types.Permission, error) {
+	var permissions []types.Permission
+
+	// No paginator in the AWS SDK for Go v2.
+	for {
+		output, err := conn.ListProfilePermissions(ctx, input)
+
+		if errs.IsA[*types.ResourceNotFoundException](err) {
+			return nil, &retry.NotFoundError{
+				LastError:   err,
+				LastRequest: input,
+			}
+		}
+
+		if err != nil {
+			return nil, err
+		}
+
+		for _, v := range output.Permissions {
+			if filter(v) {
+				permissions = append(permissions, v)
+			}
+		}
+
+		if aws.ToString(output.NextToken) == "" {
+			break
+		}
+
+		input.NextToken = output.NextToken
+	}
+
+	return permissions, nil
+}
diff --git a/internal/service/signer/signing_profile_permission_test.go b/internal/service/signer/signing_profile_permission_test.go
index 1cc6f87b321..488538ff3e9 100644
--- a/internal/service/signer/signing_profile_permission_test.go
+++ b/internal/service/signer/signing_profile_permission_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package signer_test
 
 import (
@@ -5,269 +8,335 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/signer"
+	"github.com/aws/aws-sdk-go-v2/service/signer"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	tfsigner "github.com/hashicorp/terraform-provider-aws/internal/service/signer"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
 func TestAccSignerSigningProfilePermission_basic(t *testing.T) {
 	ctx := acctest.Context(t)
+	rName := fmt.Sprintf("tf_acc_test_%d", sdkacctest.RandInt())
 	resourceName := "aws_signer_signing_profile_permission.test_sp_permission"
-	profileResourceName := "aws_signer_signing_profile.test_sp"
-	rString := sdkacctest.RandString(53)
-	profileName := fmt.Sprintf("tf_acc_spp_%s", rString)
-
-	var conf signer.GetSigningProfileOutput
-	var sppconf signer.ListProfilePermissionsOutput
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck: func() {
 			acctest.PreCheck(ctx, t)
 			testAccPreCheckSingerSigningProfile(ctx, t, "AWSLambda-SHA384-ECDSA")
 		},
-		ErrorCheck:               acctest.ErrorCheck(t, signer.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, signer.ServiceID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckSigningProfileDestroy(ctx),
+		CheckDestroy:             testAccCheckSigningProfilePermissionDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config:  testAccSigningProfilePermissionConfig_basic(profileName),
+				Config:  testAccSigningProfilePermissionConfig_basic(rName),
 				Destroy: false,
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckSigningProfileExists(ctx, profileResourceName, &conf),
-					testAccCheckSigningProfilePermissionExists(ctx, resourceName, profileName, &sppconf),
-					acctest.CheckResourceAttrNameGenerated(resourceName, "statement_id"),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckSigningProfilePermissionExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "action", "signer:StartSigningJob"),
+					resource.TestCheckResourceAttr(resourceName, "profile_version", ""),
+					resource.TestCheckResourceAttr(resourceName, "statement_id", rName),
+					resource.TestCheckResourceAttr(resourceName, "statement_id_prefix", ""),
 				),
 			},
 			{
-				ResourceName:            profileResourceName,
-				ImportState:             true,
-				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"name_prefix"},
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+				ImportStateIdFunc: testAccSigningProfilePermissionImportStateIdFunc(resourceName),
 			},
 		},
 	})
 }
 
-func TestAccSignerSigningProfilePermission_getSigningProfile(t *testing.T) {
+func TestAccSignerSigningProfilePermission_disappears(t *testing.T) {
 	ctx := acctest.Context(t)
+	rName := fmt.Sprintf("tf_acc_test_%d", sdkacctest.RandInt())
 	resourceName := "aws_signer_signing_profile_permission.test_sp_permission"
-	profileResourceName := "aws_signer_signing_profile.test_sp"
-	rString := sdkacctest.RandString(53)
-	profileName := fmt.Sprintf("tf_acc_spp_%s", rString)
-
-	var conf signer.GetSigningProfileOutput
-	var sppconf signer.ListProfilePermissionsOutput
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck: func() {
 			acctest.PreCheck(ctx, t)
 			testAccPreCheckSingerSigningProfile(ctx, t, "AWSLambda-SHA384-ECDSA")
 		},
-		ErrorCheck:               acctest.ErrorCheck(t, signer.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, signer.ServiceID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckSigningProfileDestroy(ctx),
+		CheckDestroy:             testAccCheckSigningProfilePermissionDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config:  testAccSigningProfilePermissionConfig_getSP(profileName),
+				Config:  testAccSigningProfilePermissionConfig_basic(rName),
 				Destroy: false,
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckSigningProfileExists(ctx, profileResourceName, &conf),
-					testAccCheckSigningProfilePermissionExists(ctx, resourceName, profileName, &sppconf),
+					testAccCheckSigningProfilePermissionExists(ctx, resourceName),
+					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfsigner.ResourceSigningProfilePermission(), resourceName),
 				),
+				ExpectNonEmptyPlan: true,
 			},
+		},
+	})
+}
+
+func TestAccSignerSigningProfilePermission_statementIDGenerated(t *testing.T) {
+	ctx := acctest.Context(t)
+	rName := fmt.Sprintf("tf_acc_test_%d", sdkacctest.RandInt())
+	resourceName := "aws_signer_signing_profile_permission.test_sp_permission"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			testAccPreCheckSingerSigningProfile(ctx, t, "AWSLambda-SHA384-ECDSA")
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, signer.ServiceID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckSigningProfilePermissionDestroy(ctx),
+		Steps: []resource.TestStep{
 			{
-				ResourceName:            profileResourceName,
-				ImportState:             true,
-				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"name_prefix"},
-			},
-			{
-				Config:  testAccSigningProfilePermissionConfig_revokeSignature(profileName),
-				Destroy: false,
+				Config: testAccSigningProfilePermissionConfig_statementIDGenerated(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckSigningProfileExists(ctx, profileResourceName, &conf),
-					testAccCheckSigningProfilePermissionExists(ctx, resourceName, profileName, &sppconf),
+					testAccCheckSigningProfilePermissionExists(ctx, resourceName),
+					acctest.CheckResourceAttrNameGenerated(resourceName, "statement_id"),
+					resource.TestCheckResourceAttr(resourceName, "statement_id_prefix", id.UniqueIdPrefix),
 				),
 			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+				ImportStateIdFunc: testAccSigningProfilePermissionImportStateIdFunc(resourceName),
+			},
 		},
 	})
 }
 
-func TestAccSignerSigningProfilePermission_StartSigningJob_getSP(t *testing.T) {
+func TestAccSignerSigningProfilePermission_statementIDPrefix(t *testing.T) {
 	ctx := acctest.Context(t)
-	resourceName1 := "aws_signer_signing_profile_permission.sp1_perm"
-	resourceName2 := "aws_signer_signing_profile_permission.sp2_perm"
-	profileResourceName := "aws_signer_signing_profile.test_sp"
-	rString := sdkacctest.RandString(53)
-	profileName := fmt.Sprintf("tf_acc_spp_%s", rString)
-
-	var conf signer.GetSigningProfileOutput
-	var sppconf signer.ListProfilePermissionsOutput
+	rName := fmt.Sprintf("tf_acc_test_%d", sdkacctest.RandInt())
+	resourceName := "aws_signer_signing_profile_permission.test_sp_permission"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck: func() {
 			acctest.PreCheck(ctx, t)
 			testAccPreCheckSingerSigningProfile(ctx, t, "AWSLambda-SHA384-ECDSA")
 		},
-		ErrorCheck:               acctest.ErrorCheck(t, signer.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, signer.ServiceID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckSigningProfileDestroy(ctx),
+		CheckDestroy:             testAccCheckSigningProfilePermissionDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccSigningProfilePermissionConfig_startJobGetSP(profileName),
+				Config: testAccSigningProfilePermissionConfig_statementIDPrefix(rName, "tf-acc-test-prefix-"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckSigningProfileExists(ctx, profileResourceName, &conf),
-					testAccCheckSigningProfilePermissionExists(ctx, resourceName1, profileName, &sppconf),
-					testAccCheckSigningProfilePermissionExists(ctx, resourceName2, profileName, &sppconf),
+					testAccCheckSigningProfilePermissionExists(ctx, resourceName),
+					acctest.CheckResourceAttrNameFromPrefix(resourceName, "statement_id", "tf-acc-test-prefix-"),
+					resource.TestCheckResourceAttr(resourceName, "statement_id_prefix", "tf-acc-test-prefix-"),
 				),
 			},
 			{
-				ResourceName:            profileResourceName,
-				ImportState:             true,
-				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"name_prefix"},
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+				ImportStateIdFunc: testAccSigningProfilePermissionImportStateIdFunc(resourceName),
 			},
 		},
 	})
 }
 
-func TestAccSignerSigningProfilePermission_statementPrefix(t *testing.T) {
+func TestAccSignerSigningProfilePermission_getSigningProfile(t *testing.T) {
 	ctx := acctest.Context(t)
-	resourceName := "aws_signer_signing_profile_permission.sp1_perm"
-	profileResourceName := "aws_signer_signing_profile.test_sp"
-	rString := sdkacctest.RandString(53)
-	profileName := fmt.Sprintf("tf_acc_spp_%s", rString)
-	statementNamePrefix := "tf_acc_spp_statement_"
-
-	//var conf signer.GetSigningProfileOutput
-	var sppconf signer.ListProfilePermissionsOutput
+	rName := fmt.Sprintf("tf_acc_test_%d", sdkacctest.RandInt())
+	resourceName := "aws_signer_signing_profile_permission.test_sp_permission"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck: func() {
 			acctest.PreCheck(ctx, t)
 			testAccPreCheckSingerSigningProfile(ctx, t, "AWSLambda-SHA384-ECDSA")
 		},
-		ErrorCheck:               acctest.ErrorCheck(t, signer.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, signer.ServiceID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckSigningProfileDestroy(ctx),
+		CheckDestroy:             testAccCheckSigningProfilePermissionDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccSigningProfilePermissionConfig_statementPrefix(statementNamePrefix, profileName),
+				Config: testAccSigningProfilePermissionConfig_getSP(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckSigningProfilePermissionExists(ctx, resourceName, profileName, &sppconf),
-					acctest.CheckResourceAttrNameFromPrefix(resourceName, "statement_id", statementNamePrefix),
+					testAccCheckSigningProfilePermissionExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "action", "signer:GetSigningProfile"),
 				),
 			},
 			{
-				ResourceName:            profileResourceName,
-				ImportState:             true,
-				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"name_prefix"},
+				Config: testAccSigningProfilePermissionConfig_revokeSignature(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckSigningProfilePermissionExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "action", "signer:RevokeSignature"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccSignerSigningProfilePermission_StartSigningJob_getSP(t *testing.T) {
+	ctx := acctest.Context(t)
+	rName := fmt.Sprintf("tf_acc_test_%d", sdkacctest.RandInt())
+	resourceName1 := "aws_signer_signing_profile_permission.sp1_perm"
+	resourceName2 := "aws_signer_signing_profile_permission.sp2_perm"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			testAccPreCheckSingerSigningProfile(ctx, t, "AWSLambda-SHA384-ECDSA")
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, signer.ServiceID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckSigningProfilePermissionDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccSigningProfilePermissionConfig_startJobGetSP(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckSigningProfilePermissionExists(ctx, resourceName1),
+					testAccCheckSigningProfilePermissionExists(ctx, resourceName2),
+				),
 			},
 		},
 	})
 }
 
-func testAccSigningProfilePermissionConfig_basic(profileName string) string {
-	return fmt.Sprintf(testAccSigningProfilePermissionConfig_base(profileName) + `
+func testAccCheckSigningProfilePermissionExists(ctx context.Context, n string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		conn := acctest.Provider.Meta().(*conns.AWSClient).SignerClient(ctx)
+
+		_, err := tfsigner.FindPermissionByTwoPartKey(ctx, conn, rs.Primary.Attributes["profile_name"], rs.Primary.Attributes["statement_id"])
+
+		return err
+	}
+}
+
+func testAccCheckSigningProfilePermissionDestroy(ctx context.Context) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		conn := acctest.Provider.Meta().(*conns.AWSClient).SignerClient(ctx)
+
+		for _, rs := range s.RootModule().Resources {
+			if rs.Type != "aws_signer_signing_profile_permission" {
+				continue
+			}
+
+			_, err := tfsigner.FindPermissionByTwoPartKey(ctx, conn, rs.Primary.Attributes["profile_name"], rs.Primary.Attributes["statement_id"])
+
+			if tfresource.NotFound(err) {
+				continue
+			}
+
+			if err != nil {
+				return err
+			}
+
+			return fmt.Errorf("Signer Signing Profile Permission %s still exists", rs.Primary.ID)
+		}
+
+		return nil
+	}
+}
+
+func testAccSigningProfilePermissionImportStateIdFunc(resourceName string) resource.ImportStateIdFunc {
+	return func(s *terraform.State) (string, error) {
+		rs, ok := s.RootModule().Resources[resourceName]
+		if !ok {
+			return "", fmt.Errorf("Not found: %s", resourceName)
+		}
+
+		return fmt.Sprintf("%s/%s", rs.Primary.Attributes["profile_name"], rs.Primary.Attributes["statement_id"]), nil
+	}
+}
+
+func testAccSigningProfilePermissionConfig_base(rName string) string {
+	return fmt.Sprintf(`
+resource "aws_signer_signing_profile" "test_sp" {
+  platform_id = "AWSLambda-SHA384-ECDSA"
+  name        = %[1]q
+}`, rName)
+}
+
+func testAccSigningProfilePermissionConfig_basic(rName string) string {
+	return acctest.ConfigCompose(testAccSigningProfilePermissionConfig_base(rName), fmt.Sprintf(`
 data "aws_caller_identity" "current" {}
 
 resource "aws_signer_signing_profile_permission" "test_sp_permission" {
   profile_name = aws_signer_signing_profile.test_sp.name
   action       = "signer:StartSigningJob"
   principal    = data.aws_caller_identity.current.account_id
-}`)
+  statement_id = %[1]q
+}`, rName))
 }
 
-func testAccSigningProfilePermissionConfig_startJobGetSP(profileName string) string {
-	return fmt.Sprintf(testAccSigningProfilePermissionConfig_base(profileName) + `
+func testAccSigningProfilePermissionConfig_statementIDGenerated(rName string) string {
+	return acctest.ConfigCompose(testAccSigningProfilePermissionConfig_base(rName), `
 data "aws_caller_identity" "current" {}
 
-resource "aws_signer_signing_profile_permission" "sp1_perm" {
+resource "aws_signer_signing_profile_permission" "test_sp_permission" {
   profile_name = aws_signer_signing_profile.test_sp.name
   action       = "signer:StartSigningJob"
   principal    = data.aws_caller_identity.current.account_id
-  statement_id = "statementid1"
-}
-
-resource "aws_signer_signing_profile_permission" "sp2_perm" {
-  profile_name = aws_signer_signing_profile.test_sp.name
-  action       = "signer:GetSigningProfile"
-  principal    = data.aws_caller_identity.current.account_id
-  statement_id = "statementid2"
 }`)
 }
 
-func testAccSigningProfilePermissionConfig_statementPrefix(statementNamePrefix, profileName string) string {
-	return fmt.Sprintf(testAccSigningProfilePermissionConfig_base(profileName)+`
+func testAccSigningProfilePermissionConfig_statementIDPrefix(rName, prefix string) string {
+	return acctest.ConfigCompose(testAccSigningProfilePermissionConfig_base(rName), fmt.Sprintf(`
 data "aws_caller_identity" "current" {}
 
-resource "aws_signer_signing_profile_permission" "sp1_perm" {
+resource "aws_signer_signing_profile_permission" "test_sp_permission" {
   profile_name        = aws_signer_signing_profile.test_sp.name
   action              = "signer:StartSigningJob"
   principal           = data.aws_caller_identity.current.account_id
   statement_id_prefix = %[1]q
-}`, statementNamePrefix)
+}`, prefix))
 }
 
-func testAccSigningProfilePermissionConfig_getSP(profileName string) string {
-	return fmt.Sprintf(testAccSigningProfilePermissionConfig_base(profileName) + `
+func testAccSigningProfilePermissionConfig_startJobGetSP(rName string) string {
+	return acctest.ConfigCompose(testAccSigningProfilePermissionConfig_base(rName), `
 data "aws_caller_identity" "current" {}
 
-resource "aws_signer_signing_profile_permission" "test_sp_permission" {
+resource "aws_signer_signing_profile_permission" "sp1_perm" {
+  profile_name = aws_signer_signing_profile.test_sp.name
+  action       = "signer:StartSigningJob"
+  principal    = data.aws_caller_identity.current.account_id
+  statement_id = "statementid1"
+}
+
+resource "aws_signer_signing_profile_permission" "sp2_perm" {
   profile_name = aws_signer_signing_profile.test_sp.name
   action       = "signer:GetSigningProfile"
   principal    = data.aws_caller_identity.current.account_id
+  statement_id = "statementid2"
 }`)
 }
 
-func testAccSigningProfilePermissionConfig_revokeSignature(profileName string) string {
-	return fmt.Sprintf(testAccSigningProfilePermissionConfig_base(profileName) + `
+func testAccSigningProfilePermissionConfig_getSP(rName string) string {
+	return acctest.ConfigCompose(testAccSigningProfilePermissionConfig_base(rName), fmt.Sprintf(`
 data "aws_caller_identity" "current" {}
 
 resource "aws_signer_signing_profile_permission" "test_sp_permission" {
   profile_name = aws_signer_signing_profile.test_sp.name
-  action       = "signer:RevokeSignature"
+  action       = "signer:GetSigningProfile"
   principal    = data.aws_caller_identity.current.account_id
-}`)
-}
-
-func testAccSigningProfilePermissionConfig_base(profileName string) string {
-	return fmt.Sprintf(`
-resource "aws_signer_signing_profile" "test_sp" {
-  platform_id = "AWSLambda-SHA384-ECDSA"
-  name        = "%s"
-}`, profileName)
+  statement_id = %[1]q
+}`, rName))
 }
 
-func testAccCheckSigningProfilePermissionExists(ctx context.Context, res, profileName string, spp *signer.ListProfilePermissionsOutput) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		rs, ok := s.RootModule().Resources[res]
-		if !ok {
-			return fmt.Errorf("Signing profile permission not found: %s", res)
-		}
-
-		if rs.Primary.ID == "" {
-			return fmt.Errorf("Signing Profile with that ARN does not exist")
-		}
-
-		conn := acctest.Provider.Meta().(*conns.AWSClient).SignerConn(ctx)
-
-		params := &signer.ListProfilePermissionsInput{
-			ProfileName: aws.String(profileName),
-		}
-
-		getSp, err := conn.ListProfilePermissionsWithContext(ctx, params)
-		if err != nil {
-			return err
-		}
-
-		*spp = *getSp
+func testAccSigningProfilePermissionConfig_revokeSignature(rName string) string {
+	return acctest.ConfigCompose(testAccSigningProfilePermissionConfig_base(rName), fmt.Sprintf(`
+data "aws_caller_identity" "current" {}
 
-		return nil
-	}
+resource "aws_signer_signing_profile_permission" "test_sp_permission" {
+  profile_name = aws_signer_signing_profile.test_sp.name
+  action       = "signer:RevokeSignature"
+  principal    = data.aws_caller_identity.current.account_id
+  statement_id = %[1]q
+}`, rName))
 }
diff --git a/internal/service/signer/signing_profile_test.go b/internal/service/signer/signing_profile_test.go
index c431dcd297a..48b1dbfbb42 100644
--- a/internal/service/signer/signing_profile_test.go
+++ b/internal/service/signer/signing_profile_test.go
@@ -1,85 +1,95 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package signer_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
-	"time"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/signer"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/signer"
+	"github.com/aws/aws-sdk-go-v2/service/signer/types"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	tfsigner "github.com/hashicorp/terraform-provider-aws/internal/service/signer"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
 func TestAccSignerSigningProfile_basic(t *testing.T) {
 	ctx := acctest.Context(t)
-	resourceName := "aws_signer_signing_profile.test_sp"
-	rString := sdkacctest.RandString(48)
-	profileName := fmt.Sprintf("tf_acc_sp_basic_%s", rString)
-
 	var conf signer.GetSigningProfileOutput
+	rName := fmt.Sprintf("tf_acc_test_%d", sdkacctest.RandInt())
+	resourceName := "aws_signer_signing_profile.test_sp"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck: func() {
 			acctest.PreCheck(ctx, t)
 			testAccPreCheckSingerSigningProfile(ctx, t, "AWSLambda-SHA384-ECDSA")
 		},
-		ErrorCheck:               acctest.ErrorCheck(t, signer.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, signer.ServiceID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckSigningProfileDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccSigningProfileConfig_providedName(profileName),
-				Check: resource.ComposeTestCheckFunc(
+				Config: testAccSigningProfileConfig_basic(rName),
+				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckSigningProfileExists(ctx, resourceName, &conf),
-					resource.TestMatchResourceAttr(resourceName, "name",
-						regexp.MustCompile("^[a-zA-Z0-9_]{0,64}$")),
+					resource.TestCheckResourceAttrSet(resourceName, "arn"),
+					resource.TestCheckResourceAttr(resourceName, "name", rName),
+					resource.TestCheckResourceAttr(resourceName, "name_prefix", ""),
+					resource.TestCheckResourceAttrSet(resourceName, "platform_display_name"),
 					resource.TestCheckResourceAttr(resourceName, "platform_id", "AWSLambda-SHA384-ECDSA"),
+					resource.TestCheckResourceAttr(resourceName, "revocation_record.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "signature_validity_period.#", "1"),
+					resource.TestCheckNoResourceAttr(resourceName, "signing_material"),
+					resource.TestCheckResourceAttr(resourceName, "status", "Active"),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
+					resource.TestCheckResourceAttrSet(resourceName, "version"),
+					resource.TestCheckResourceAttrSet(resourceName, "version_arn"),
 				),
 			},
 			{
-				ResourceName:            resourceName,
-				ImportState:             true,
-				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"name_prefix"},
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
 			},
 		},
 	})
 }
 
-func TestAccSignerSigningProfile_generateNameWithNamePrefix(t *testing.T) {
+func TestAccSignerSigningProfile_disappears(t *testing.T) {
 	ctx := acctest.Context(t)
-	resourceName := "aws_signer_signing_profile.test_sp"
-	namePrefix := "tf_acc_sp_basic_"
-
 	var conf signer.GetSigningProfileOutput
+	rName := fmt.Sprintf("tf_acc_test_%d", sdkacctest.RandInt())
+	resourceName := "aws_signer_signing_profile.test_sp"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck: func() {
 			acctest.PreCheck(ctx, t)
 			testAccPreCheckSingerSigningProfile(ctx, t, "AWSLambda-SHA384-ECDSA")
 		},
-		ErrorCheck:               acctest.ErrorCheck(t, signer.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, signer.ServiceID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckSigningProfileDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccSigningProfileConfig_basic(namePrefix),
+				Config: testAccSigningProfileConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckSigningProfileExists(ctx, resourceName, &conf),
-					resource.TestCheckResourceAttr(resourceName, "platform_id", "AWSLambda-SHA384-ECDSA"),
+					acctest.CheckResourceDisappears(ctx, acctest.Provider, tfsigner.ResourceSigningProfile(), resourceName),
 				),
+				ExpectNonEmptyPlan: true,
 			},
 		},
 	})
 }
 
-func TestAccSignerSigningProfile_generateName(t *testing.T) {
+func TestAccSignerSigningProfile_nameGenerated(t *testing.T) {
 	ctx := acctest.Context(t)
 	resourceName := "aws_signer_signing_profile.test_sp"
 
@@ -90,50 +100,101 @@ func TestAccSignerSigningProfile_generateName(t *testing.T) {
 			acctest.PreCheck(ctx, t)
 			testAccPreCheckSingerSigningProfile(ctx, t, "AWSLambda-SHA384-ECDSA")
 		},
-		ErrorCheck:               acctest.ErrorCheck(t, signer.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, signer.ServiceID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckSigningProfileDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccSigningProfileConfig_generateName(),
+				Config: testAccSigningProfileConfig_nameGenerated(),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckSigningProfileExists(ctx, resourceName, &conf),
-					resource.TestCheckResourceAttr(resourceName, "platform_id", "AWSLambda-SHA384-ECDSA"),
+					acctest.CheckResourceAttrNameGeneratedWithPrefix(resourceName, "name", "terraform_"),
+					resource.TestCheckResourceAttr(resourceName, "name_prefix", "terraform_"),
 				),
 			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
 		},
 	})
 }
 
-func TestAccSignerSigningProfile_tags(t *testing.T) {
+func TestAccSignerSigningProfile_namePrefix(t *testing.T) {
 	ctx := acctest.Context(t)
+	var conf signer.GetSigningProfileOutput
 	resourceName := "aws_signer_signing_profile.test_sp"
-	namePrefix := "tf_acc_sp_basic_"
 
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			testAccPreCheckSingerSigningProfile(ctx, t, "AWSLambda-SHA384-ECDSA")
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, signer.ServiceID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckSigningProfileDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccSigningProfileConfig_namePrefix("tf_acc_test_prefix_"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckSigningProfileExists(ctx, resourceName, &conf),
+					acctest.CheckResourceAttrNameFromPrefix(resourceName, "name", "tf_acc_test_prefix_"),
+					resource.TestCheckResourceAttr(resourceName, "name_prefix", "tf_acc_test_prefix_"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
+func TestAccSignerSigningProfile_tags(t *testing.T) {
+	ctx := acctest.Context(t)
 	var conf signer.GetSigningProfileOutput
+	rName := fmt.Sprintf("tf_acc_test_%d", sdkacctest.RandInt())
+	resourceName := "aws_signer_signing_profile.test_sp"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck: func() {
 			acctest.PreCheck(ctx, t)
 			testAccPreCheckSingerSigningProfile(ctx, t, "AWSLambda-SHA384-ECDSA")
 		},
-		ErrorCheck:               acctest.ErrorCheck(t, signer.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, signer.ServiceID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckSigningProfileDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccSigningProfileConfig_tags(namePrefix),
+				Config: testAccSigningProfileConfig_tags1(rName, "key1", "value1"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckSigningProfileExists(ctx, resourceName, &conf),
-					resource.TestCheckResourceAttr(resourceName, "tags.tag1", "value1"),
-					resource.TestCheckResourceAttr(resourceName, "tags.tag2", "value2"),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
 				),
 			},
 			{
-				Config: testAccSigningProfileConfig_updateTags(),
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				Config: testAccSigningProfileConfig_tags2(rName, "key1", "value1updated", "key2", "value2"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckSigningProfileExists(ctx, resourceName, &conf),
-					resource.TestCheckResourceAttr(resourceName, "tags.tag1", "prod"),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1updated"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
+				),
+			},
+			{
+				Config: testAccSigningProfileConfig_tags1(rName, "key2", "value2"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckSigningProfileExists(ctx, resourceName, &conf),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
 				),
 			},
 		},
@@ -142,198 +203,168 @@ func TestAccSignerSigningProfile_tags(t *testing.T) {
 
 func TestAccSignerSigningProfile_signatureValidityPeriod(t *testing.T) {
 	ctx := acctest.Context(t)
-	resourceName := "aws_signer_signing_profile.test_sp"
-	namePrefix := "tf_acc_sp_basic_"
-
 	var conf signer.GetSigningProfileOutput
+	rName := fmt.Sprintf("tf_acc_test_%d", sdkacctest.RandInt())
+	resourceName := "aws_signer_signing_profile.test_sp"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck: func() {
 			acctest.PreCheck(ctx, t)
 			testAccPreCheckSingerSigningProfile(ctx, t, "AWSLambda-SHA384-ECDSA")
 		},
-		ErrorCheck:               acctest.ErrorCheck(t, signer.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, signer.ServiceID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckSigningProfileDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccSigningProfileConfig_svp(namePrefix),
+				Config: testAccSigningProfileConfig_svp(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckSigningProfileExists(ctx, resourceName, &conf),
+					resource.TestCheckResourceAttr(resourceName, "signature_validity_period.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "signature_validity_period.0.type", "DAYS"),
 					resource.TestCheckResourceAttr(resourceName, "signature_validity_period.0.value", "10"),
 				),
 			},
-			{
-				Config: testAccSigningProfileConfig_updateSVP(),
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckSigningProfileExists(ctx, resourceName, &conf),
-					resource.TestCheckResourceAttr(resourceName, "signature_validity_period.0.type", "MONTHS"),
-					resource.TestCheckResourceAttr(resourceName, "signature_validity_period.0.value", "10"),
-				),
-			},
 		},
 	})
 }
 
 func testAccPreCheckSingerSigningProfile(ctx context.Context, t *testing.T, platformID string) {
-	conn := acctest.Provider.Meta().(*conns.AWSClient).SignerConn(ctx)
+	conn := acctest.Provider.Meta().(*conns.AWSClient).SignerClient(ctx)
 
 	input := &signer.ListSigningPlatformsInput{}
 
-	output, err := conn.ListSigningPlatformsWithContext(ctx, input)
+	pages := signer.NewListSigningPlatformsPaginator(conn, input)
 
-	if acctest.PreCheckSkipError(err) {
-		t.Skipf("skipping acceptance testing: %s", err)
-	}
+	for pages.HasMorePages() {
+		page, err := pages.NextPage(ctx)
+		if err != nil {
+			t.Fatalf("unexpected PreCheck error: %s", err)
+		}
 
-	if err != nil {
-		t.Fatalf("unexpected PreCheck error: %s", err)
-	}
+		if page == nil {
+			t.Skip("skipping acceptance testing: empty response")
+		}
+
+		for _, platform := range page.Platforms {
+			if platform == (types.SigningPlatform{}) {
+				continue
+			}
 
-	if output == nil {
-		t.Skip("skipping acceptance testing: empty response")
+			if aws.ToString(platform.PlatformId) == platformID {
+				return
+			}
+		}
 	}
 
-	for _, platform := range output.Platforms {
-		if platform == nil {
-			continue
+	t.Skipf("skipping acceptance testing: Signing Platform (%s) not found", platformID)
+}
+
+func testAccCheckSigningProfileExists(ctx context.Context, n string, v *signer.GetSigningProfileOutput) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
 		}
 
-		if aws.StringValue(platform.PlatformId) == platformID {
-			return
+		conn := acctest.Provider.Meta().(*conns.AWSClient).SignerClient(ctx)
+
+		output, err := tfsigner.FindSigningProfileByName(ctx, conn, rs.Primary.ID)
+
+		if err != nil {
+			return err
 		}
-	}
 
-	t.Skipf("skipping acceptance testing: Signing Platform (%s) not found", platformID)
+		*v = *output
+
+		return nil
+	}
 }
 
-func testAccSigningProfileConfig_basic(namePrefix string) string {
-	return testAccSigningProfileBaseConfig(namePrefix)
+func testAccCheckSigningProfileDestroy(ctx context.Context) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		conn := acctest.Provider.Meta().(*conns.AWSClient).SignerClient(ctx)
+
+		for _, rs := range s.RootModule().Resources {
+			if rs.Type != "aws_signer_signing_profile" {
+				continue
+			}
+
+			_, err := tfsigner.FindSigningProfileByName(ctx, conn, rs.Primary.ID)
+
+			if tfresource.NotFound(err) {
+				continue
+			}
+
+			if err != nil {
+				return err
+			}
+
+			return fmt.Errorf("Signer Signing Profile %s still exists", rs.Primary.ID)
+		}
+
+		return nil
+	}
 }
 
-func testAccSigningProfileConfig_generateName() string {
-	return `
+func testAccSigningProfileConfig_basic(rName string) string {
+	return fmt.Sprintf(`
 resource "aws_signer_signing_profile" "test_sp" {
   platform_id = "AWSLambda-SHA384-ECDSA"
-}`
+  name        = %[1]q
+}`, rName)
 }
 
-func testAccSigningProfileConfig_providedName(profileName string) string {
-	return fmt.Sprintf(`
+func testAccSigningProfileConfig_nameGenerated() string {
+	return `
 resource "aws_signer_signing_profile" "test_sp" {
   platform_id = "AWSLambda-SHA384-ECDSA"
-  name        = "%s"
-}`, profileName)
+}`
 }
 
-func testAccSigningProfileConfig_tags(namePrefix string) string {
+func testAccSigningProfileConfig_namePrefix(namePrefix string) string {
 	return fmt.Sprintf(`
 resource "aws_signer_signing_profile" "test_sp" {
   platform_id = "AWSLambda-SHA384-ECDSA"
-  name_prefix = "%s"
-  tags = {
-    "tag1" = "value1"
-    "tag2" = "value2"
-  }
+  name_prefix = %[1]q
 }`, namePrefix)
 }
 
-func testAccSigningProfileConfig_svp(namePrefix string) string {
+func testAccSigningProfileConfig_tags1(rName, tagKey1, tagValue1 string) string {
 	return fmt.Sprintf(`
 resource "aws_signer_signing_profile" "test_sp" {
   platform_id = "AWSLambda-SHA384-ECDSA"
-  name_prefix = "%s"
+  name        = %[1]q
 
-  signature_validity_period {
-    value = 10
-    type  = "DAYS"
+  tags = {
+    %[2]q = %[3]q
   }
-}
-`, namePrefix)
+}`, rName, tagKey1, tagValue1)
 }
 
-func testAccSigningProfileConfig_updateSVP() string {
-	return `
+func testAccSigningProfileConfig_tags2(rName, tagKey1, tagValue1, tagKey2, tagValue2 string) string {
+	return fmt.Sprintf(`
 resource "aws_signer_signing_profile" "test_sp" {
   platform_id = "AWSLambda-SHA384-ECDSA"
+  name        = %[1]q
 
-  signature_validity_period {
-    value = 10
-    type  = "MONTHS"
-  }
-}
-`
-}
-
-func testAccSigningProfileConfig_updateTags() string {
-	return `
-resource "aws_signer_signing_profile" "test_sp" {
-  platform_id = "AWSLambda-SHA384-ECDSA"
   tags = {
-    "tag1" = "prod"
+    %[2]q = %[3]q
+    %[4]q = %[5]q
   }
-}
-`
+}`, rName, tagKey1, tagValue1, tagKey2, tagValue2)
 }
 
-func testAccSigningProfileBaseConfig(namePrefix string) string {
+func testAccSigningProfileConfig_svp(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_signer_signing_profile" "test_sp" {
   platform_id = "AWSLambda-SHA384-ECDSA"
-  name_prefix = "%s"
-}
-`, namePrefix)
-}
-
-func testAccCheckSigningProfileExists(ctx context.Context, res string, sp *signer.GetSigningProfileOutput) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		rs, ok := s.RootModule().Resources[res]
-		if !ok {
-			return fmt.Errorf("Signing profile not found: %s", res)
-		}
-
-		if rs.Primary.ID == "" {
-			return fmt.Errorf("Signing Profile with that ARN does not exist")
-		}
-
-		conn := acctest.Provider.Meta().(*conns.AWSClient).SignerConn(ctx)
+  name_prefix = %[1]q
 
-		params := &signer.GetSigningProfileInput{
-			ProfileName: aws.String(rs.Primary.ID),
-		}
-
-		getSp, err := conn.GetSigningProfileWithContext(ctx, params)
-		if err != nil {
-			return err
-		}
-
-		*sp = *getSp
-
-		return nil
-	}
+  signature_validity_period {
+    value = 10
+    type  = "DAYS"
+  }
 }
-
-func testAccCheckSigningProfileDestroy(ctx context.Context) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		conn := acctest.Provider.Meta().(*conns.AWSClient).SignerConn(ctx)
-
-		time.Sleep(5 * time.Second)
-
-		for _, rs := range s.RootModule().Resources {
-			if rs.Type != "aws_signer_signing_profile" {
-				continue
-			}
-
-			out, err := conn.GetSigningProfileWithContext(ctx, &signer.GetSigningProfileInput{
-				ProfileName: aws.String(rs.Primary.ID),
-			})
-
-			if *out.Status != signer.SigningProfileStatusCanceled && err == nil {
-				return fmt.Errorf("Signing Profile not cancelled%s", *out.ProfileName)
-			}
-		}
-
-		return nil
-	}
+`, rName)
 }
diff --git a/internal/service/signer/sweep.go b/internal/service/signer/sweep.go
new file mode 100644
index 00000000000..7a2805ee56e
--- /dev/null
+++ b/internal/service/signer/sweep.go
@@ -0,0 +1,65 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package signer
+
+import (
+	"fmt"
+	"log"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/signer"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv2"
+)
+
+func RegisterSweepers() {
+	resource.AddTestSweepers("aws_signer_signing_profile", &resource.Sweeper{
+		Name: "aws_signer_signing_profile",
+		F:    sweepSigningProfiles,
+	})
+}
+
+func sweepSigningProfiles(region string) error {
+	ctx := sweep.Context(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
+
+	if err != nil {
+		return fmt.Errorf("error getting client: %w", err)
+	}
+
+	conn := client.SignerClient(ctx)
+	sweepResources := make([]sweep.Sweepable, 0)
+	input := &signer.ListSigningProfilesInput{}
+
+	pages := signer.NewListSigningProfilesPaginator(conn, input)
+
+	for pages.HasMorePages() {
+		page, err := pages.NextPage(ctx)
+		if awsv2.SkipSweepError(err) {
+			log.Printf("[WARN] Skipping Signer Signing Profiles sweep for %s: %s", region, err)
+			return nil
+		}
+		if err != nil {
+			return fmt.Errorf("error retrieving Signer Signing Profiles: %w", err)
+		}
+
+		for _, profile := range page.Profiles {
+			name := aws.ToString(profile.ProfileName)
+
+			r := ResourceSigningProfile()
+			d := r.Data(nil)
+			d.SetId(name)
+
+			log.Printf("[INFO] Deleting Signer Signing Profile: %s", name)
+			sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
+		}
+	}
+
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
+		return fmt.Errorf("error sweeping Signer Signing Profiles for %s: %w", region, err)
+	}
+
+	return nil
+}
diff --git a/internal/service/signer/tags_gen.go b/internal/service/signer/tags_gen.go
index af14b3c5776..427ccc4dd90 100644
--- a/internal/service/signer/tags_gen.go
+++ b/internal/service/signer/tags_gen.go
@@ -5,10 +5,11 @@ import (
 	"context"
 	"fmt"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/signer"
-	"github.com/aws/aws-sdk-go/service/signer/signeriface"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/signer"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -17,12 +18,12 @@ import (
 // listTags lists signer service tags.
 // The identifier is typically the Amazon Resource Name (ARN), although
 // it may also be a different identifier depending on the service.
-func listTags(ctx context.Context, conn signeriface.SignerAPI, identifier string) (tftags.KeyValueTags, error) {
+func listTags(ctx context.Context, conn *signer.Client, identifier string) (tftags.KeyValueTags, error) {
 	input := &signer.ListTagsForResourceInput{
 		ResourceArn: aws.String(identifier),
 	}
 
-	output, err := conn.ListTagsForResourceWithContext(ctx, input)
+	output, err := conn.ListTagsForResource(ctx, input)
 
 	if err != nil {
 		return tftags.New(ctx, nil), err
@@ -34,7 +35,7 @@ func listTags(ctx context.Context, conn signeriface.SignerAPI, identifier string
 // ListTags lists signer service tags and set them in Context.
 // It is called from outside this package.
 func (p *servicePackage) ListTags(ctx context.Context, meta any, identifier string) error {
-	tags, err := listTags(ctx, meta.(*conns.AWSClient).SignerConn(ctx), identifier)
+	tags, err := listTags(ctx, meta.(*conns.AWSClient).SignerClient(ctx), identifier)
 
 	if err != nil {
 		return err
@@ -47,21 +48,21 @@ func (p *servicePackage) ListTags(ctx context.Context, meta any, identifier stri
 	return nil
 }
 
-// map[string]*string handling
+// map[string]string handling
 
 // Tags returns signer service tags.
-func Tags(tags tftags.KeyValueTags) map[string]*string {
-	return aws.StringMap(tags.Map())
+func Tags(tags tftags.KeyValueTags) map[string]string {
+	return tags.Map()
 }
 
-// KeyValueTags creates KeyValueTags from signer service tags.
-func KeyValueTags(ctx context.Context, tags map[string]*string) tftags.KeyValueTags {
+// KeyValueTags creates tftags.KeyValueTags from signer service tags.
+func KeyValueTags(ctx context.Context, tags map[string]string) tftags.KeyValueTags {
 	return tftags.New(ctx, tags)
 }
 
 // getTagsIn returns signer service tags from Context.
 // nil is returned if there are no input tags.
-func getTagsIn(ctx context.Context) map[string]*string {
+func getTagsIn(ctx context.Context) map[string]string {
 	if inContext, ok := tftags.FromContext(ctx); ok {
 		if tags := Tags(inContext.TagsIn.UnwrapOrDefault()); len(tags) > 0 {
 			return tags
@@ -72,7 +73,7 @@ func getTagsIn(ctx context.Context) map[string]*string {
 }
 
 // setTagsOut sets signer service tags in Context.
-func setTagsOut(ctx context.Context, tags map[string]*string) {
+func setTagsOut(ctx context.Context, tags map[string]string) {
 	if inContext, ok := tftags.FromContext(ctx); ok {
 		inContext.TagsOut = types.Some(KeyValueTags(ctx, tags))
 	}
@@ -81,19 +82,21 @@ func setTagsOut(ctx context.Context, tags map[string]*string) {
 // updateTags updates signer service tags.
 // The identifier is typically the Amazon Resource Name (ARN), although
 // it may also be a different identifier depending on the service.
-func updateTags(ctx context.Context, conn signeriface.SignerAPI, identifier string, oldTagsMap, newTagsMap any) error {
+func updateTags(ctx context.Context, conn *signer.Client, identifier string, oldTagsMap, newTagsMap any) error {
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.Signer)
 	if len(removedTags) > 0 {
 		input := &signer.UntagResourceInput{
 			ResourceArn: aws.String(identifier),
-			TagKeys:     aws.StringSlice(removedTags.Keys()),
+			TagKeys:     removedTags.Keys(),
 		}
 
-		_, err := conn.UntagResourceWithContext(ctx, input)
+		_, err := conn.UntagResource(ctx, input)
 
 		if err != nil {
 			return fmt.Errorf("untagging resource (%s): %w", identifier, err)
@@ -108,7 +111,7 @@ func updateTags(ctx context.Context, conn signeriface.SignerAPI, identifier stri
 			Tags:        Tags(updatedTags),
 		}
 
-		_, err := conn.TagResourceWithContext(ctx, input)
+		_, err := conn.TagResource(ctx, input)
 
 		if err != nil {
 			return fmt.Errorf("tagging resource (%s): %w", identifier, err)
@@ -121,5 +124,5 @@ func updateTags(ctx context.Context, conn signeriface.SignerAPI, identifier stri
 // UpdateTags updates signer service tags.
 // It is called from outside this package.
 func (p *servicePackage) UpdateTags(ctx context.Context, meta any, identifier string, oldTags, newTags any) error {
-	return updateTags(ctx, meta.(*conns.AWSClient).SignerConn(ctx), identifier, oldTags, newTags)
+	return updateTags(ctx, meta.(*conns.AWSClient).SignerClient(ctx), identifier, oldTags, newTags)
 }
diff --git a/internal/service/simpledb/domain.go b/internal/service/simpledb/domain.go
index 450b33c5f64..66c6ba8e1a7 100644
--- a/internal/service/simpledb/domain.go
+++ b/internal/service/simpledb/domain.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package simpledb
 
 import (
@@ -16,8 +19,8 @@ import (
 	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/fwdiag"
-	"github.com/hashicorp/terraform-provider-aws/internal/flex"
 	"github.com/hashicorp/terraform-provider-aws/internal/framework"
+	"github.com/hashicorp/terraform-provider-aws/internal/framework/flex"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
diff --git a/internal/service/simpledb/domain_test.go b/internal/service/simpledb/domain_test.go
index e79aa499644..0e97f28c037 100644
--- a/internal/service/simpledb/domain_test.go
+++ b/internal/service/simpledb/domain_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package simpledb_test
 
 import (
diff --git a/internal/service/simpledb/exports_test.go b/internal/service/simpledb/exports_test.go
index 8c66737d1c7..4e604242d3b 100644
--- a/internal/service/simpledb/exports_test.go
+++ b/internal/service/simpledb/exports_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package simpledb
 
 // Exports for use in tests only.
diff --git a/internal/service/simpledb/generate.go b/internal/service/simpledb/generate.go
index 9ea6724bbb6..775f0211f8a 100644
--- a/internal/service/simpledb/generate.go
+++ b/internal/service/simpledb/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
 
diff --git a/internal/service/simpledb/service_package_gen.go b/internal/service/simpledb/service_package_gen.go
index 28209ff2c05..3bb1625ebd7 100644
--- a/internal/service/simpledb/service_package_gen.go
+++ b/internal/service/simpledb/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	simpledb_sdkv1 "github.com/aws/aws-sdk-go/service/simpledb"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -45,4 +46,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*s
 	return simpledb_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/simpledb/sweep.go b/internal/service/simpledb/sweep.go
index 72c70024a57..eca88168b2b 100644
--- a/internal/service/simpledb/sweep.go
+++ b/internal/service/simpledb/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package simpledb
 
@@ -11,10 +11,11 @@ import (
 	"github.com/aws/aws-sdk-go/service/simpledb"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep/framework"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_simpledb_domain", &resource.Sweeper{
 		Name: "aws_simpledb_domain",
 		F:    sweepDomains,
@@ -23,7 +24,7 @@ func init() {
 
 func sweepDomains(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -45,7 +46,7 @@ func sweepDomains(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping SimpleDB Domain sweep for %s: %s", region, err)
 		return nil
 	}
@@ -54,7 +55,7 @@ func sweepDomains(region string) error {
 		return fmt.Errorf("error listing SimpleDB Domains (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping SimpleDB Domains (%s): %w", region, err)
diff --git a/internal/service/sns/consts.go b/internal/service/sns/consts.go
index 67e60be3022..032c40da382 100644
--- a/internal/service/sns/consts.go
+++ b/internal/service/sns/consts.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sns
 
 import (
diff --git a/internal/service/sns/find.go b/internal/service/sns/find.go
index a997906f11f..e7b6406a0ef 100644
--- a/internal/service/sns/find.go
+++ b/internal/service/sns/find.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sns
 
 import (
diff --git a/internal/service/sns/generate.go b/internal/service/sns/generate.go
index 1dc138e0697..43fe4e8a6cb 100644
--- a/internal/service/sns/generate.go
+++ b/internal/service/sns/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTags -ServiceTagsSlice -UpdateTags -CreateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/sns/platform_application.go b/internal/service/sns/platform_application.go
index 2e7765a8816..634be0a234c 100644
--- a/internal/service/sns/platform_application.go
+++ b/internal/service/sns/platform_application.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sns
 
 import (
diff --git a/internal/service/sns/platform_application_test.go b/internal/service/sns/platform_application_test.go
index d3e885d982b..c28d8204e4c 100644
--- a/internal/service/sns/platform_application_test.go
+++ b/internal/service/sns/platform_application_test.go
@@ -1,14 +1,17 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sns_test
 
 import (
 	"context"
 	"fmt"
 	"os"
-	"regexp"
 	"strconv"
 	"strings"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/sns"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -334,7 +337,7 @@ func TestAccSNSPlatformApplication_basic(t *testing.T) {
 						Config: testAccPlatformApplicationConfig_basic(name, platform),
 						Check: resource.ComposeTestCheckFunc(
 							testAccCheckPlatformApplicationExists(ctx, resourceName),
-							acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "sns", regexp.MustCompile(fmt.Sprintf("app/%s/%s$", platform.Name, name))),
+							acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "sns", regexache.MustCompile(fmt.Sprintf("app/%s/%s$", platform.Name, name))),
 							resource.TestCheckResourceAttr(resourceName, "name", name),
 							resource.TestCheckResourceAttr(resourceName, "platform", platform.Name),
 							resource.TestCheckResourceAttrSet(resourceName, "platform_credential"),
diff --git a/internal/service/sns/service_package_gen.go b/internal/service/sns/service_package_gen.go
index d189c22e138..4c2126a82b0 100644
--- a/internal/service/sns/service_package_gen.go
+++ b/internal/service/sns/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	sns_sdkv1 "github.com/aws/aws-sdk-go/service/sns"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -75,4 +76,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*s
 	return sns_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/sns/sms_preferences.go b/internal/service/sns/sms_preferences.go
index ebf0d4adb71..5253905a9b1 100644
--- a/internal/service/sns/sms_preferences.go
+++ b/internal/service/sns/sms_preferences.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sns
 
 import (
diff --git a/internal/service/sns/sms_preferences_test.go b/internal/service/sns/sms_preferences_test.go
index 76b8a965a9b..b4371c29797 100644
--- a/internal/service/sns/sms_preferences_test.go
+++ b/internal/service/sns/sms_preferences_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sns_test
 
 import (
diff --git a/internal/service/sns/sweep.go b/internal/service/sns/sweep.go
index 44cdbf86ca7..077829c5bb4 100644
--- a/internal/service/sns/sweep.go
+++ b/internal/service/sns/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package sns
 
@@ -11,9 +11,10 @@ import (
 	"github.com/aws/aws-sdk-go/service/sns"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_sns_platform_application", &resource.Sweeper{
 		Name: "aws_sns_platform_application",
 		F:    sweepPlatformApplications,
@@ -52,7 +53,7 @@ func init() {
 
 func sweepPlatformApplications(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
@@ -76,7 +77,7 @@ func sweepPlatformApplications(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping SNS Platform Applications sweep for %s: %s", region, err)
 		return nil
 	}
@@ -85,7 +86,7 @@ func sweepPlatformApplications(region string) error {
 		return fmt.Errorf("error listing SNS Platform Applications: %w", err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping SNS Platform Applications (%s): %w", region, err)
@@ -96,7 +97,7 @@ func sweepPlatformApplications(region string) error {
 
 func sweepTopics(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
@@ -120,7 +121,7 @@ func sweepTopics(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping SNS Topics sweep for %s: %s", region, err)
 		return nil
 	}
@@ -129,7 +130,7 @@ func sweepTopics(region string) error {
 		return fmt.Errorf("error listing SNS Topics: %w", err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping SNS Topics (%s): %w", region, err)
@@ -140,7 +141,7 @@ func sweepTopics(region string) error {
 
 func sweepTopicSubscriptions(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
@@ -169,7 +170,7 @@ func sweepTopicSubscriptions(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping SNS Topic Subscriptions sweep for %s: %s", region, err)
 		return nil
 	}
@@ -178,7 +179,7 @@ func sweepTopicSubscriptions(region string) error {
 		return fmt.Errorf("error listing SNS Topic Subscriptions: %w", err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping SNS Topic Subscriptions (%s): %w", region, err)
diff --git a/internal/service/sns/tags_gen.go b/internal/service/sns/tags_gen.go
index a29f5b6a21d..1d7023126c7 100644
--- a/internal/service/sns/tags_gen.go
+++ b/internal/service/sns/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/sns"
 	"github.com/aws/aws-sdk-go/service/sns/snsiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -111,6 +113,8 @@ func updateTags(ctx context.Context, conn snsiface.SNSAPI, identifier string, ol
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.SNS)
 	if len(removedTags) > 0 {
diff --git a/internal/service/sns/topic.go b/internal/service/sns/topic.go
index 4c43b0d2ab0..cf0ee212c9d 100644
--- a/internal/service/sns/topic.go
+++ b/internal/service/sns/topic.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sns
 
 import (
@@ -7,6 +10,7 @@ import (
 	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/aws/aws-sdk-go/service/sns"
@@ -238,21 +242,13 @@ func resourceTopicCreate(ctx context.Context, d *schema.ResourceData, meta inter
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).SNSConn(ctx)
 
-	var name string
-	fifoTopic := d.Get("fifo_topic").(bool)
-	if fifoTopic {
-		name = create.NameWithSuffix(d.Get("name").(string), d.Get("name_prefix").(string), FIFOTopicNameSuffix)
-	} else {
-		name = create.Name(d.Get("name").(string), d.Get("name_prefix").(string))
-	}
-
+	name := topicName(d)
 	input := &sns.CreateTopicInput{
 		Name: aws.String(name),
 		Tags: getTagsIn(ctx),
 	}
 
 	attributes, err := topicAttributeMap.ResourceDataToAPIAttributesCreate(d)
-
 	if err != nil {
 		return diag.FromErr(err)
 	}
@@ -325,13 +321,11 @@ func resourceTopicRead(ctx context.Context, d *schema.ResourceData, meta any) di
 	}
 
 	err = topicAttributeMap.APIAttributesToResourceData(attributes, d)
-
 	if err != nil {
 		return diag.FromErr(err)
 	}
 
 	arn, err := arn.Parse(d.Id())
-
 	if err != nil {
 		return diag.FromErr(err)
 	}
@@ -352,13 +346,11 @@ func resourceTopicUpdate(ctx context.Context, d *schema.ResourceData, meta inter
 
 	if d.HasChangesExcept("tags", "tags_all") {
 		attributes, err := topicAttributeMap.ResourceDataToAPIAttributesUpdate(d)
-
 		if err != nil {
 			return diag.FromErr(err)
 		}
 
 		err = putTopicAttributes(ctx, conn, d.Id(), attributes)
-
 		if err != nil {
 			return diag.FromErr(err)
 		}
@@ -392,21 +384,13 @@ func resourceTopicCustomizeDiff(_ context.Context, diff *schema.ResourceDiff, me
 
 	if diff.Id() == "" {
 		// Create.
-
-		var name string
-
-		if fifoTopic {
-			name = create.NameWithSuffix(diff.Get("name").(string), diff.Get("name_prefix").(string), FIFOTopicNameSuffix)
-		} else {
-			name = create.Name(diff.Get("name").(string), diff.Get("name_prefix").(string))
-		}
-
+		name := topicName(diff)
 		var re *regexp.Regexp
 
 		if fifoTopic {
-			re = regexp.MustCompile(`^[a-zA-Z0-9_-]{1,251}\.fifo$`)
+			re = regexache.MustCompile(`^[0-9A-Za-z_-]{1,251}\.fifo$`)
 		} else {
-			re = regexp.MustCompile(`^[a-zA-Z0-9_-]{1,256}$`)
+			re = regexache.MustCompile(`^[0-9A-Za-z_-]{1,256}$`)
 		}
 
 		if !re.MatchString(name) {
@@ -458,3 +442,11 @@ func putTopicAttribute(ctx context.Context, conn *sns.SNS, arn string, name, val
 
 	return nil
 }
+
+func topicName(d interface{ Get(string) any }) string {
+	optFns := []create.NameGeneratorOptionsFunc{create.WithConfiguredName(d.Get("name").(string)), create.WithConfiguredPrefix(d.Get("name_prefix").(string))}
+	if d.Get("fifo_topic").(bool) {
+		optFns = append(optFns, create.WithSuffix(FIFOTopicNameSuffix))
+	}
+	return create.NewNameGenerator(optFns...).Generate()
+}
diff --git a/internal/service/sns/topic_data_protection_policy.go b/internal/service/sns/topic_data_protection_policy.go
index e35e50acd74..d2d918b859b 100644
--- a/internal/service/sns/topic_data_protection_policy.go
+++ b/internal/service/sns/topic_data_protection_policy.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sns
 
 import (
diff --git a/internal/service/sns/topic_data_protection_policy_test.go b/internal/service/sns/topic_data_protection_policy_test.go
index 4ba574f9313..2ae0ae256b3 100644
--- a/internal/service/sns/topic_data_protection_policy_test.go
+++ b/internal/service/sns/topic_data_protection_policy_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sns_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/sns"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -33,7 +36,7 @@ func TestAccSNSTopicDataProtectionPolicy_basic(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckTopicExists(ctx, "aws_sns_topic.test", &attributes),
 					resource.TestCheckResourceAttrPair(resourceName, "arn", "aws_sns_topic.test", "arn"),
-					resource.TestMatchResourceAttr(resourceName, "policy", regexp.MustCompile(fmt.Sprintf("\"Sid\":\"%[1]s\"", rName))),
+					resource.TestMatchResourceAttr(resourceName, "policy", regexache.MustCompile(fmt.Sprintf("\"Sid\":\"%[1]s\"", rName))),
 				),
 			},
 			{
diff --git a/internal/service/sns/topic_data_source.go b/internal/service/sns/topic_data_source.go
index 97bea026392..3d2f35771fc 100644
--- a/internal/service/sns/topic_data_source.go
+++ b/internal/service/sns/topic_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sns
 
 import (
diff --git a/internal/service/sns/topic_data_source_test.go b/internal/service/sns/topic_data_source_test.go
index f2476b636c5..487b3d49cc7 100644
--- a/internal/service/sns/topic_data_source_test.go
+++ b/internal/service/sns/topic_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sns_test
 
 import (
diff --git a/internal/service/sns/topic_policy.go b/internal/service/sns/topic_policy.go
index 6c53a9ed73a..75a8e19a7dc 100644
--- a/internal/service/sns/topic_policy.go
+++ b/internal/service/sns/topic_policy.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sns
 
 import (
diff --git a/internal/service/sns/topic_policy_test.go b/internal/service/sns/topic_policy_test.go
index 8c5b291e85f..12463cdb7ba 100644
--- a/internal/service/sns/topic_policy_test.go
+++ b/internal/service/sns/topic_policy_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sns_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/sns"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -34,7 +37,7 @@ func TestAccSNSTopicPolicy_basic(t *testing.T) {
 					testAccCheckTopicExists(ctx, "aws_sns_topic.test", &attributes),
 					resource.TestCheckResourceAttrPair(resourceName, "arn", "aws_sns_topic.test", "arn"),
 					acctest.CheckResourceAttrAccountID(resourceName, "owner"),
-					resource.TestMatchResourceAttr(resourceName, "policy", regexp.MustCompile(fmt.Sprintf("\"Sid\":\"%[1]s\"", rName))),
+					resource.TestMatchResourceAttr(resourceName, "policy", regexache.MustCompile(fmt.Sprintf("\"Sid\":\"%[1]s\"", rName))),
 				),
 			},
 			{
@@ -62,7 +65,7 @@ func TestAccSNSTopicPolicy_updated(t *testing.T) {
 				Config: testAccTopicPolicyConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckTopicExists(ctx, "aws_sns_topic.test", &attributes),
-					resource.TestMatchResourceAttr(resourceName, "policy", regexp.MustCompile(fmt.Sprintf("\"Sid\":\"%[1]s\"", rName))),
+					resource.TestMatchResourceAttr(resourceName, "policy", regexache.MustCompile(fmt.Sprintf("\"Sid\":\"%[1]s\"", rName))),
 				),
 			},
 			{
@@ -74,8 +77,8 @@ func TestAccSNSTopicPolicy_updated(t *testing.T) {
 				Config: testAccTopicPolicyConfig_updated(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckTopicExists(ctx, "aws_sns_topic.test", &attributes),
-					resource.TestMatchResourceAttr(resourceName, "policy", regexp.MustCompile(fmt.Sprintf("\"Sid\":\"%[1]s\"", rName))),
-					resource.TestMatchResourceAttr(resourceName, "policy", regexp.MustCompile("SNS:DeleteTopic")),
+					resource.TestMatchResourceAttr(resourceName, "policy", regexache.MustCompile(fmt.Sprintf("\"Sid\":\"%[1]s\"", rName))),
+					resource.TestMatchResourceAttr(resourceName, "policy", regexache.MustCompile("SNS:DeleteTopic")),
 				),
 			},
 		},
@@ -147,7 +150,7 @@ func TestAccSNSTopicPolicy_ignoreEquivalent(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckTopicExists(ctx, "aws_sns_topic.test", &attributes),
 					resource.TestCheckResourceAttrPair(resourceName, "arn", "aws_sns_topic.test", "arn"),
-					resource.TestMatchResourceAttr(resourceName, "policy", regexp.MustCompile(fmt.Sprintf("\"Sid\":\"%[1]s\"", rName))),
+					resource.TestMatchResourceAttr(resourceName, "policy", regexache.MustCompile(fmt.Sprintf("\"Sid\":\"%[1]s\"", rName))),
 					acctest.CheckResourceAttrAccountID(resourceName, "owner"),
 				),
 			},
diff --git a/internal/service/sns/topic_subscription.go b/internal/service/sns/topic_subscription.go
index a117c744e11..97e1d8a056f 100644
--- a/internal/service/sns/topic_subscription.go
+++ b/internal/service/sns/topic_subscription.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sns
 
 import (
diff --git a/internal/service/sns/topic_subscription_test.go b/internal/service/sns/topic_subscription_test.go
index c8ff61920dc..2c592f350f3 100644
--- a/internal/service/sns/topic_subscription_test.go
+++ b/internal/service/sns/topic_subscription_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sns_test
 
 import (
@@ -5,10 +8,10 @@ import (
 	"encoding/json"
 	"fmt"
 	"reflect"
-	"regexp"
 	"strconv"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/aws/aws-sdk-go/service/sns"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -84,7 +87,7 @@ func TestAccSNSTopicSubscription_basic(t *testing.T) {
 				Config: testAccTopicSubscriptionConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckTopicSubscriptionExists(ctx, resourceName, &attributes),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", sns.ServiceName, regexp.MustCompile(fmt.Sprintf("%s:.+", rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", sns.ServiceName, regexache.MustCompile(fmt.Sprintf("%s:.+", rName))),
 					resource.TestCheckResourceAttr(resourceName, "confirmation_was_authenticated", "true"),
 					resource.TestCheckResourceAttr(resourceName, "delivery_policy", ""),
 					resource.TestCheckResourceAttrPair(resourceName, "endpoint", "aws_sqs_queue.test", "arn"),
@@ -345,7 +348,7 @@ func TestAccSNSTopicSubscription_filterPolicyScope_policyNotSet(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccTopicSubscriptionConfig_filterPolicyScope_policyNotSet(rName),
-				ExpectError: regexp.MustCompile(`filter_policy is required when filter_policy_scope is set`),
+				ExpectError: regexache.MustCompile(`filter_policy is required when filter_policy_scope is set`),
 			},
 		},
 	})
@@ -596,7 +599,7 @@ func TestAccSNSTopicSubscription_email(t *testing.T) {
 				Config: testAccTopicSubscriptionConfig_email(rName, acctest.DefaultEmailAddress),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckTopicSubscriptionExists(ctx, resourceName, &attributes),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", sns.ServiceName, regexp.MustCompile(fmt.Sprintf("%s:.+", rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", sns.ServiceName, regexache.MustCompile(fmt.Sprintf("%s:.+", rName))),
 					resource.TestCheckResourceAttr(resourceName, "confirmation_was_authenticated", "false"),
 					resource.TestCheckResourceAttr(resourceName, "delivery_policy", ""),
 					resource.TestCheckResourceAttr(resourceName, "endpoint", acctest.DefaultEmailAddress),
@@ -627,7 +630,7 @@ func TestAccSNSTopicSubscription_firehose(t *testing.T) {
 				Config: testAccTopicSubscriptionConfig_firehose(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckTopicSubscriptionExists(ctx, resourceName, &attributes),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", sns.ServiceName, regexp.MustCompile(fmt.Sprintf("%s:.+", rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", sns.ServiceName, regexache.MustCompile(fmt.Sprintf("%s:.+", rName))),
 					resource.TestCheckResourceAttr(resourceName, "delivery_policy", ""),
 					resource.TestCheckResourceAttrPair(resourceName, "endpoint", "aws_kinesis_firehose_delivery_stream.test_stream", "arn"),
 					resource.TestCheckResourceAttr(resourceName, "filter_policy", ""),
diff --git a/internal/service/sns/topic_test.go b/internal/service/sns/topic_test.go
index 1ed4e7aaee8..28d9cde9624 100644
--- a/internal/service/sns/topic_test.go
+++ b/internal/service/sns/topic_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sns_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/sns"
 	awspolicy "github.com/hashicorp/awspolicyequivalence"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -47,7 +50,7 @@ func TestAccSNSTopic_basic(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "application_failure_feedback_role_arn", ""),
 					resource.TestCheckResourceAttr(resourceName, "application_success_feedback_role_arn", ""),
 					resource.TestCheckResourceAttr(resourceName, "application_success_feedback_sample_rate", "0"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "sns", regexp.MustCompile(`terraform-.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "sns", regexache.MustCompile(`terraform-.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "content_based_deduplication", "false"),
 					resource.TestCheckResourceAttr(resourceName, "delivery_policy", ""),
 					resource.TestCheckResourceAttr(resourceName, "display_name", ""),
@@ -280,7 +283,7 @@ func TestAccSNSTopic_withFakeIAMRole(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccTopicConfig_fakeIAMRole(rName),
-				ExpectError: regexp.MustCompile(`PrincipalNotFound`),
+				ExpectError: regexache.MustCompile(`PrincipalNotFound`),
 			},
 		},
 	})
@@ -496,7 +499,7 @@ func TestAccSNSTopic_fifoExpectContentBasedDeduplicationError(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccTopicConfig_expectContentBasedDeduplicationError(rName),
-				ExpectError: regexp.MustCompile(`content-based deduplication can only be set for FIFO topics`),
+				ExpectError: regexache.MustCompile(`content-based deduplication can only be set for FIFO topics`),
 			},
 		},
 	})
diff --git a/internal/service/sqs/attribute_funcs.go b/internal/service/sqs/attribute_funcs.go
index b9ddc651591..ecc66cc0e03 100644
--- a/internal/service/sqs/attribute_funcs.go
+++ b/internal/service/sqs/attribute_funcs.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sqs
 
 import (
diff --git a/internal/service/sqs/consts.go b/internal/service/sqs/consts.go
index 4b8c4c86b87..1c20ff993aa 100644
--- a/internal/service/sqs/consts.go
+++ b/internal/service/sqs/consts.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sqs
 
 const (
diff --git a/internal/service/sqs/exports_test.go b/internal/service/sqs/exports_test.go
index 47fb0711104..3493b5953a0 100644
--- a/internal/service/sqs/exports_test.go
+++ b/internal/service/sqs/exports_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sqs
 
 // Exports for use in tests only.
diff --git a/internal/service/sqs/find.go b/internal/service/sqs/find.go
index 63d2ec030a6..76f4aba9cb1 100644
--- a/internal/service/sqs/find.go
+++ b/internal/service/sqs/find.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sqs
 
 import (
diff --git a/internal/service/sqs/generate.go b/internal/service/sqs/generate.go
index e821fc1459e..ed0ae9547ca 100644
--- a/internal/service/sqs/generate.go
+++ b/internal/service/sqs/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTags -ListTagsOp=ListQueueTags -ListTagsInIDElem=QueueUrl -ServiceTagsMap -TagOp=TagQueue -TagInIDElem=QueueUrl -UntagOp=UntagQueue -UpdateTags -CreateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/sqs/json.go b/internal/service/sqs/json.go
index 73f07ca2c67..503efc89bf2 100644
--- a/internal/service/sqs/json.go
+++ b/internal/service/sqs/json.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sqs
 
 import (
diff --git a/internal/service/sqs/json_test.go b/internal/service/sqs/json_test.go
index a98864b888d..772db163b79 100644
--- a/internal/service/sqs/json_test.go
+++ b/internal/service/sqs/json_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sqs
 
 import (
diff --git a/internal/service/sqs/name.go b/internal/service/sqs/name.go
index 9653911ecba..0eab8355e86 100644
--- a/internal/service/sqs/name.go
+++ b/internal/service/sqs/name.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sqs
 
 import (
diff --git a/internal/service/sqs/name_test.go b/internal/service/sqs/name_test.go
index 8c8b28fb309..13cd91c902d 100644
--- a/internal/service/sqs/name_test.go
+++ b/internal/service/sqs/name_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sqs_test
 
 import (
diff --git a/internal/service/sqs/queue.go b/internal/service/sqs/queue.go
index 67a7a1a59ef..79a4eda6f6b 100644
--- a/internal/service/sqs/queue.go
+++ b/internal/service/sqs/queue.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sqs
 
 import (
@@ -6,6 +9,7 @@ import (
 	"log"
 	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/sqs"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -198,21 +202,13 @@ func ResourceQueue() *schema.Resource {
 func resourceQueueCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	conn := meta.(*conns.AWSClient).SQSConn(ctx)
 
-	var name string
-	fifoQueue := d.Get("fifo_queue").(bool)
-	if fifoQueue {
-		name = create.NameWithSuffix(d.Get("name").(string), d.Get("name_prefix").(string), FIFOQueueNameSuffix)
-	} else {
-		name = create.Name(d.Get("name").(string), d.Get("name_prefix").(string))
-	}
-
+	name := queueName(d)
 	input := &sqs.CreateQueueInput{
 		QueueName: aws.String(name),
 		Tags:      getTagsIn(ctx),
 	}
 
 	attributes, err := queueAttributeMap.ResourceDataToAPIAttributesCreate(d)
-
 	if err != nil {
 		return diag.FromErr(err)
 	}
@@ -277,15 +273,11 @@ func resourceQueueRead(ctx context.Context, d *schema.ResourceData, meta interfa
 	}
 
 	name, err := QueueNameFromURL(d.Id())
-
 	if err != nil {
 		return diag.FromErr(err)
 	}
 
-	output := outputRaw.(map[string]string)
-
-	err = queueAttributeMap.APIAttributesToResourceData(output, d)
-
+	err = queueAttributeMap.APIAttributesToResourceData(outputRaw.(map[string]string), d)
 	if err != nil {
 		return diag.FromErr(err)
 	}
@@ -311,7 +303,6 @@ func resourceQueueUpdate(ctx context.Context, d *schema.ResourceData, meta inter
 
 	if d.HasChangesExcept("tags", "tags_all") {
 		attributes, err := queueAttributeMap.ResourceDataToAPIAttributesUpdate(d)
-
 		if err != nil {
 			return diag.FromErr(err)
 		}
@@ -321,16 +312,13 @@ func resourceQueueUpdate(ctx context.Context, d *schema.ResourceData, meta inter
 			QueueUrl:   aws.String(d.Id()),
 		}
 
-		log.Printf("[DEBUG] Updating SQS Queue: %s", input)
 		_, err = conn.SetQueueAttributesWithContext(ctx, input)
 
 		if err != nil {
 			return diag.Errorf("updating SQS Queue (%s) attributes: %s", d.Id(), err)
 		}
 
-		err = waitQueueAttributesPropagated(ctx, conn, d.Id(), attributes)
-
-		if err != nil {
+		if err := waitQueueAttributesPropagated(ctx, conn, d.Id(), attributes); err != nil {
 			return diag.Errorf("waiting for SQS Queue (%s) attributes update: %s", d.Id(), err)
 		}
 	}
@@ -354,9 +342,7 @@ func resourceQueueDelete(ctx context.Context, d *schema.ResourceData, meta inter
 		return diag.Errorf("deleting SQS Queue (%s): %s", d.Id(), err)
 	}
 
-	err = waitQueueDeleted(ctx, conn, d.Id())
-
-	if err != nil {
+	if err := waitQueueDeleted(ctx, conn, d.Id()); err != nil {
 		return diag.Errorf("waiting for SQS Queue (%s) delete: %s", d.Id(), err)
 	}
 
@@ -369,21 +355,13 @@ func resourceQueueCustomizeDiff(_ context.Context, diff *schema.ResourceDiff, me
 
 	if diff.Id() == "" {
 		// Create.
-
-		var name string
-
-		if fifoQueue {
-			name = create.NameWithSuffix(diff.Get("name").(string), diff.Get("name_prefix").(string), FIFOQueueNameSuffix)
-		} else {
-			name = create.Name(diff.Get("name").(string), diff.Get("name_prefix").(string))
-		}
-
+		name := queueName(diff)
 		var re *regexp.Regexp
 
 		if fifoQueue {
-			re = regexp.MustCompile(`^[a-zA-Z0-9_-]{1,75}\.fifo$`)
+			re = regexache.MustCompile(`^[0-9A-Za-z_-]{1,75}\.fifo$`)
 		} else {
-			re = regexp.MustCompile(`^[a-zA-Z0-9_-]{1,80}$`)
+			re = regexache.MustCompile(`^[0-9A-Za-z_-]{1,80}$`)
 		}
 
 		if !re.MatchString(name) {
@@ -397,3 +375,11 @@ func resourceQueueCustomizeDiff(_ context.Context, diff *schema.ResourceDiff, me
 
 	return nil
 }
+
+func queueName(d interface{ Get(string) any }) string {
+	optFns := []create.NameGeneratorOptionsFunc{create.WithConfiguredName(d.Get("name").(string)), create.WithConfiguredPrefix(d.Get("name_prefix").(string))}
+	if d.Get("fifo_queue").(bool) {
+		optFns = append(optFns, create.WithSuffix(FIFOQueueNameSuffix))
+	}
+	return create.NewNameGenerator(optFns...).Generate()
+}
diff --git a/internal/service/sqs/queue_data_source.go b/internal/service/sqs/queue_data_source.go
index de12cab5c3b..93484685448 100644
--- a/internal/service/sqs/queue_data_source.go
+++ b/internal/service/sqs/queue_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sqs
 
 import (
diff --git a/internal/service/sqs/queue_data_source_test.go b/internal/service/sqs/queue_data_source_test.go
index d87e800ec88..c2470518191 100644
--- a/internal/service/sqs/queue_data_source_test.go
+++ b/internal/service/sqs/queue_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sqs_test
 
 import (
diff --git a/internal/service/sqs/queue_policy.go b/internal/service/sqs/queue_policy.go
index f86384c5a09..c3c2ad9d16d 100644
--- a/internal/service/sqs/queue_policy.go
+++ b/internal/service/sqs/queue_policy.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sqs
 
 import (
diff --git a/internal/service/sqs/queue_policy_migrate.go b/internal/service/sqs/queue_policy_migrate.go
index 207ffe12a4e..0340acaa81d 100644
--- a/internal/service/sqs/queue_policy_migrate.go
+++ b/internal/service/sqs/queue_policy_migrate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sqs
 
 import (
diff --git a/internal/service/sqs/queue_policy_migrate_test.go b/internal/service/sqs/queue_policy_migrate_test.go
index e432bc2e2a9..f68cf338ee4 100644
--- a/internal/service/sqs/queue_policy_migrate_test.go
+++ b/internal/service/sqs/queue_policy_migrate_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sqs_test
 
 import (
diff --git a/internal/service/sqs/queue_policy_test.go b/internal/service/sqs/queue_policy_test.go
index c6e3458b1bf..0e61e6e48f8 100644
--- a/internal/service/sqs/queue_policy_test.go
+++ b/internal/service/sqs/queue_policy_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sqs_test
 
 import (
diff --git a/internal/service/sqs/queue_redrive_allow_policy.go b/internal/service/sqs/queue_redrive_allow_policy.go
index 44c30116888..f9b50a833ec 100644
--- a/internal/service/sqs/queue_redrive_allow_policy.go
+++ b/internal/service/sqs/queue_redrive_allow_policy.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sqs
 
 import (
diff --git a/internal/service/sqs/queue_redrive_allow_policy_test.go b/internal/service/sqs/queue_redrive_allow_policy_test.go
index ffcc0014c90..6bbbb2162aa 100644
--- a/internal/service/sqs/queue_redrive_allow_policy_test.go
+++ b/internal/service/sqs/queue_redrive_allow_policy_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sqs_test
 
 import (
diff --git a/internal/service/sqs/queue_redrive_policy.go b/internal/service/sqs/queue_redrive_policy.go
index 9f93ea1090f..7f55a8e6e8e 100644
--- a/internal/service/sqs/queue_redrive_policy.go
+++ b/internal/service/sqs/queue_redrive_policy.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sqs
 
 import (
diff --git a/internal/service/sqs/queue_redrive_policy_test.go b/internal/service/sqs/queue_redrive_policy_test.go
index b020037959e..ce6525d3884 100644
--- a/internal/service/sqs/queue_redrive_policy_test.go
+++ b/internal/service/sqs/queue_redrive_policy_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sqs_test
 
 import (
diff --git a/internal/service/sqs/queue_test.go b/internal/service/sqs/queue_test.go
index 56323b31df7..9fba9402ab9 100644
--- a/internal/service/sqs/queue_test.go
+++ b/internal/service/sqs/queue_test.go
@@ -1,13 +1,16 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sqs_test
 
 import (
 	"context"
 	"errors"
 	"fmt"
-	"regexp"
 	"strconv"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/sqs"
 	awspolicy "github.com/hashicorp/awspolicyequivalence"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -563,7 +566,7 @@ func TestAccSQSQueue_FIFOQueue_expectNameError(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccQueueConfig_fifo(rName),
-				ExpectError: regexp.MustCompile(`invalid queue name:`),
+				ExpectError: regexache.MustCompile(`invalid queue name:`),
 			},
 		},
 	})
@@ -649,7 +652,7 @@ func TestAccSQSQueue_StandardQueue_expectContentBasedDeduplicationError(t *testi
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccQueueConfig_standardExpectContentBasedDeduplicationError(rName),
-				ExpectError: regexp.MustCompile(`content-based deduplication can only be set for FIFO queue`),
+				ExpectError: regexache.MustCompile(`content-based deduplication can only be set for FIFO queue`),
 			},
 		},
 	})
diff --git a/internal/service/sqs/queues_data_source.go b/internal/service/sqs/queues_data_source.go
index 4bcc60887b3..5ce15f94531 100644
--- a/internal/service/sqs/queues_data_source.go
+++ b/internal/service/sqs/queues_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sqs
 
 import (
diff --git a/internal/service/sqs/queues_data_source_test.go b/internal/service/sqs/queues_data_source_test.go
index da03ba8feb9..780c20fcf0b 100644
--- a/internal/service/sqs/queues_data_source_test.go
+++ b/internal/service/sqs/queues_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sqs_test
 
 import (
diff --git a/internal/service/sqs/service_package_gen.go b/internal/service/sqs/service_package_gen.go
index 5c4cccce8aa..235612d3bff 100644
--- a/internal/service/sqs/service_package_gen.go
+++ b/internal/service/sqs/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	sqs_sdkv1 "github.com/aws/aws-sdk-go/service/sqs"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -71,4 +72,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*s
 	return sqs_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/sqs/status.go b/internal/service/sqs/status.go
index 9af1464ec71..3f58082acd1 100644
--- a/internal/service/sqs/status.go
+++ b/internal/service/sqs/status.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sqs
 
 import (
diff --git a/internal/service/sqs/sweep.go b/internal/service/sqs/sweep.go
index f8262153735..a18637bb8c6 100644
--- a/internal/service/sqs/sweep.go
+++ b/internal/service/sqs/sweep.go
@@ -1,48 +1,37 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package sqs
 
 import (
-	"fmt"
-	"log"
+	"context"
 
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/sqs"
-	"github.com/hashicorp/go-multierror"
-	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
-	"github.com/hashicorp/terraform-provider-aws/internal/sweep/sdk"
 )
 
-func init() {
-	resource.AddTestSweepers("aws_sqs_queue", &resource.Sweeper{
-		Name: "aws_sqs_queue",
-		F:    sweepQueues,
-		Dependencies: []string{
-			"aws_autoscaling_group",
-			"aws_cloudwatch_event_rule",
-			"aws_elastic_beanstalk_environment",
-			"aws_iot_topic_rule",
-			"aws_lambda_function",
-			"aws_s3_bucket",
-			"aws_sns_topic",
-		},
-	})
+func RegisterSweepers() {
+	sweep.Register("aws_sqs_queue", sweepQueues,
+		"aws_autoscaling_group",
+		"aws_cloudwatch_event_rule",
+		"aws_elastic_beanstalk_environment",
+		"aws_iot_topic_rule",
+		"aws_lambda_function",
+		"aws_s3_bucket",
+		"aws_sns_topic",
+	)
 }
 
-func sweepQueues(region string) error {
-	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
-	if err != nil {
-		return fmt.Errorf("error getting client: %w", err)
-	}
+func sweepQueues(ctx context.Context, client *conns.AWSClient) ([]sweep.Sweepable, error) {
 	conn := client.SQSConn(ctx)
 
+	var sweepResources []sweep.Sweepable
+
 	input := &sqs.ListQueuesInput{}
-	var sweeperErrs *multierror.Error
 
-	err = conn.ListQueuesPagesWithContext(ctx, input, func(page *sqs.ListQueuesOutput, lastPage bool) bool {
+	err := conn.ListQueuesPagesWithContext(ctx, input, func(page *sqs.ListQueuesOutput, lastPage bool) bool {
 		if page == nil {
 			return !lastPage
 		}
@@ -51,26 +40,12 @@ func sweepQueues(region string) error {
 			r := ResourceQueue()
 			d := r.Data(nil)
 			d.SetId(aws.StringValue(queueUrl))
-			err = sdk.DeleteResource(ctx, r, d, client)
 
-			if err != nil {
-				log.Printf("[ERROR] %s", err)
-				sweeperErrs = multierror.Append(sweeperErrs, err)
-				continue
-			}
+			sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
 		}
 
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
-		log.Printf("[WARN] Skipping SQS Queue sweep for %s: %s", region, err)
-		return sweeperErrs.ErrorOrNil() // In case we have completed some pages, but had errors
-	}
-
-	if err != nil {
-		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error listing SQS Queues: %w", err))
-	}
-
-	return sweeperErrs.ErrorOrNil()
+	return sweepResources, err
 }
diff --git a/internal/service/sqs/tags_gen.go b/internal/service/sqs/tags_gen.go
index 1fabd70abe2..131b4565547 100644
--- a/internal/service/sqs/tags_gen.go
+++ b/internal/service/sqs/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/sqs"
 	"github.com/aws/aws-sdk-go/service/sqs/sqsiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -54,7 +56,7 @@ func Tags(tags tftags.KeyValueTags) map[string]*string {
 	return aws.StringMap(tags.Map())
 }
 
-// KeyValueTags creates KeyValueTags from sqs service tags.
+// KeyValueTags creates tftags.KeyValueTags from sqs service tags.
 func KeyValueTags(ctx context.Context, tags map[string]*string) tftags.KeyValueTags {
 	return tftags.New(ctx, tags)
 }
@@ -94,6 +96,8 @@ func updateTags(ctx context.Context, conn sqsiface.SQSAPI, identifier string, ol
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.SQS)
 	if len(removedTags) > 0 {
diff --git a/internal/service/sqs/wait.go b/internal/service/sqs/wait.go
index 36b73fbe154..5c57c8ee85d 100644
--- a/internal/service/sqs/wait.go
+++ b/internal/service/sqs/wait.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sqs
 
 import (
diff --git a/internal/service/ssm/activation.go b/internal/service/ssm/activation.go
index 89b668a5828..664b56eba0d 100644
--- a/internal/service/ssm/activation.go
+++ b/internal/service/ssm/activation.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssm
 
 import (
diff --git a/internal/service/ssm/activation_test.go b/internal/service/ssm/activation_test.go
index e038e6cd388..c17f94c102b 100644
--- a/internal/service/ssm/activation_test.go
+++ b/internal/service/ssm/activation_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssm_test
 
 import (
diff --git a/internal/service/ssm/association.go b/internal/service/ssm/association.go
index a150df610ef..f6d3f240690 100644
--- a/internal/service/ssm/association.go
+++ b/internal/service/ssm/association.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssm
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/aws/aws-sdk-go/service/ssm"
@@ -49,50 +52,49 @@ func ResourceAssociation() *schema.Resource {
 				Optional: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(3, 128),
-					validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9_\-.]{3,128}$`), "must contain only alphanumeric, underscore, hyphen, or period characters"),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_.-]{3,128}$`), "must contain only alphanumeric, underscore, hyphen, or period characters"),
 				),
 			},
 			"association_id": {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
-			"instance_id": {
-				Type:       schema.TypeString,
-				ForceNew:   true,
-				Optional:   true,
-				Deprecated: "use 'targets' argument instead. https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_CreateAssociation.html#systemsmanager-CreateAssociation-request-InstanceId",
+			"automation_target_parameter_name": {
+				Type:         schema.TypeString,
+				Optional:     true,
+				ValidateFunc: validation.StringLenBetween(1, 50),
+			},
+			"compliance_severity": {
+				Type:         schema.TypeString,
+				Optional:     true,
+				ValidateFunc: validation.StringInSlice(ssm.ComplianceSeverity_Values(), false),
 			},
 			"document_version": {
 				Type:         schema.TypeString,
 				Optional:     true,
 				Computed:     true,
-				ValidateFunc: validation.StringMatch(regexp.MustCompile(`^([$]LATEST|[$]DEFAULT|^[1-9][0-9]*$)$`), ""),
+				ValidateFunc: validation.StringMatch(regexache.MustCompile(`^([$]LATEST|[$]DEFAULT|^[1-9][0-9]*$)$`), ""),
 			},
 			"max_concurrency": {
 				Type:         schema.TypeString,
 				Optional:     true,
-				ValidateFunc: validation.StringMatch(regexp.MustCompile(`^([1-9][0-9]*|[1-9][0-9]%|[1-9]%|100%)$`), "must be a valid number (e.g. 10) or percentage including the percent sign (e.g. 10%)"),
+				ValidateFunc: validation.StringMatch(regexache.MustCompile(`^([1-9][0-9]*|[1-9][0-9]%|[1-9]%|100%)$`), "must be a valid number (e.g. 10) or percentage including the percent sign (e.g. 10%)"),
 			},
 			"max_errors": {
 				Type:         schema.TypeString,
 				Optional:     true,
-				ValidateFunc: validation.StringMatch(regexp.MustCompile(`^([1-9][0-9]*|[0]|[1-9][0-9]%|[0-9]%|100%)$`), "must be a valid number (e.g. 10) or percentage including the percent sign (e.g. 10%)"),
+				ValidateFunc: validation.StringMatch(regexache.MustCompile(`^([1-9][0-9]*|[0]|[1-9][0-9]%|[0-9]%|100%)$`), "must be a valid number (e.g. 10) or percentage including the percent sign (e.g. 10%)"),
 			},
 			"name": {
 				Type:     schema.TypeString,
 				ForceNew: true,
 				Required: true,
 			},
-			"parameters": {
-				Type:     schema.TypeMap,
-				Optional: true,
-				Computed: true,
-				Elem:     &schema.Schema{Type: schema.TypeString},
-			},
-			"schedule_expression": {
-				Type:         schema.TypeString,
-				Optional:     true,
-				ValidateFunc: validation.StringLenBetween(1, 256),
+			"instance_id": {
+				Type:       schema.TypeString,
+				ForceNew:   true,
+				Optional:   true,
+				Deprecated: "use 'targets' argument instead. https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_CreateAssociation.html#systemsmanager-CreateAssociation-request-InstanceId",
 			},
 			"output_location": {
 				Type:     schema.TypeList,
@@ -118,6 +120,22 @@ func ResourceAssociation() *schema.Resource {
 					},
 				},
 			},
+			"parameters": {
+				Type:     schema.TypeMap,
+				Optional: true,
+				Computed: true,
+				Elem:     &schema.Schema{Type: schema.TypeString},
+			},
+			"schedule_expression": {
+				Type:         schema.TypeString,
+				Optional:     true,
+				ValidateFunc: validation.StringLenBetween(1, 256),
+			},
+			"sync_compliance": {
+				Type:         schema.TypeString,
+				Optional:     true,
+				ValidateFunc: validation.StringInSlice(ssm.AssociationSyncCompliance_Values(), false),
+			},
 			"targets": {
 				Type:     schema.TypeList,
 				Optional: true,
@@ -139,16 +157,6 @@ func ResourceAssociation() *schema.Resource {
 					},
 				},
 			},
-			"compliance_severity": {
-				Type:         schema.TypeString,
-				Optional:     true,
-				ValidateFunc: validation.StringInSlice(ssm.ComplianceSeverity_Values(), false),
-			},
-			"automation_target_parameter_name": {
-				Type:         schema.TypeString,
-				Optional:     true,
-				ValidateFunc: validation.StringLenBetween(1, 50),
-			},
 			"wait_for_success_timeout_seconds": {
 				Type:     schema.TypeInt,
 				Optional: true,
@@ -183,12 +191,16 @@ func resourceAssociationCreate(ctx context.Context, d *schema.ResourceData, meta
 		associationInput.DocumentVersion = aws.String(v.(string))
 	}
 
+	if v, ok := d.GetOk("parameters"); ok {
+		associationInput.Parameters = expandDocumentParameters(v.(map[string]interface{}))
+	}
+
 	if v, ok := d.GetOk("schedule_expression"); ok {
 		associationInput.ScheduleExpression = aws.String(v.(string))
 	}
 
-	if v, ok := d.GetOk("parameters"); ok {
-		associationInput.Parameters = expandDocumentParameters(v.(map[string]interface{}))
+	if v, ok := d.GetOk("sync_compliance"); ok {
+		associationInput.SyncCompliance = aws.String(v.(string))
 	}
 
 	if v, ok := d.GetOk("targets"); ok {
@@ -267,6 +279,7 @@ func resourceAssociationRead(ctx context.Context, d *schema.ResourceData, meta i
 	d.Set("name", association.Name)
 	d.Set("association_id", association.AssociationId)
 	d.Set("schedule_expression", association.ScheduleExpression)
+	d.Set("sync_compliance", association.SyncCompliance)
 	d.Set("document_version", association.DocumentVersion)
 	d.Set("compliance_severity", association.ComplianceSeverity)
 	d.Set("max_concurrency", association.MaxConcurrency)
@@ -315,6 +328,10 @@ func resourceAssociationUpdate(ctx context.Context, d *schema.ResourceData, meta
 		associationInput.ScheduleExpression = aws.String(v.(string))
 	}
 
+	if d.HasChange("sync_compliance") {
+		associationInput.SyncCompliance = aws.String(d.Get("sync_compliance").(string))
+	}
+
 	if v, ok := d.GetOk("parameters"); ok {
 		associationInput.Parameters = expandDocumentParameters(v.(map[string]interface{}))
 	}
diff --git a/internal/service/ssm/association_migrate.go b/internal/service/ssm/association_migrate.go
index d536d3a1138..81c10f32883 100644
--- a/internal/service/ssm/association_migrate.go
+++ b/internal/service/ssm/association_migrate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssm
 
 import (
diff --git a/internal/service/ssm/association_migrate_test.go b/internal/service/ssm/association_migrate_test.go
index 99e51fe0aaf..e82689fabbb 100644
--- a/internal/service/ssm/association_migrate_test.go
+++ b/internal/service/ssm/association_migrate_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssm_test
 
 import (
diff --git a/internal/service/ssm/association_test.go b/internal/service/ssm/association_test.go
index 9b64d9b2215..254278f61f7 100644
--- a/internal/service/ssm/association_test.go
+++ b/internal/service/ssm/association_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssm_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ssm"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -32,7 +35,7 @@ func TestAccSSMAssociation_basic(t *testing.T) {
 				Config: testAccAssociationConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckAssociationExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ssm", regexp.MustCompile(`association/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ssm", regexache.MustCompile(`association/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "apply_only_at_cron_interval", "false"),
 					resource.TestCheckResourceAttrPair(resourceName, "instance_id", "aws_instance.test", "id"),
 					resource.TestCheckResourceAttr(resourceName, "output_location.#", "0"),
@@ -608,6 +611,35 @@ func TestAccSSMAssociation_rateControl(t *testing.T) {
 	})
 }
 
+func TestAccSSMAssociation_syncCompliance(t *testing.T) {
+	ctx := acctest.Context(t)
+	rName := "AWS-RunPatchBaselineAssociation"
+	resourceName := "aws_ssm_association.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, ssm.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckAssociationDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccAssociationSyncComplianceConfig(rName, "MANUAL"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAssociationExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "sync_compliance", "MANUAL"),
+				),
+			},
+			{
+				Config: testAccAssociationSyncComplianceConfig(rName, "AUTO"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAssociationExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, "sync_compliance", "AUTO"),
+				),
+			},
+		},
+	})
+}
+
 func testAccCheckAssociationExists(ctx context.Context, n string) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		rs, ok := s.RootModule().Resources[n]
@@ -1569,6 +1601,30 @@ resource "aws_ssm_association" "test" {
 `, rName, rate)
 }
 
+func testAccAssociationSyncComplianceConfig(rName, syncCompliance string) string {
+	return fmt.Sprintf(`
+resource "aws_ssm_association" "test" {
+  name = %[1]q
+  targets {
+    key    = "InstanceIds"
+    values = ["*"]
+  }
+  apply_only_at_cron_interval = false
+  sync_compliance             = %[2]q
+  parameters = {
+    Operation    = "Scan"
+    RebootOption = "NoReboot"
+  }
+  schedule_expression = "cron(0 6 ? * * *)"
+  lifecycle {
+    ignore_changes = [
+      parameters["AssociationId"]
+    ]
+  }
+}
+`, rName, syncCompliance)
+}
+
 func testAccAssociationConfig_outputLocationAndWaitForSuccess(rName string) string {
 	return acctest.ConfigCompose(
 		testAccAssociationWithOutputLocationS3RegionConfigBase(rName),
diff --git a/internal/service/ssm/consts.go b/internal/service/ssm/consts.go
index 798dd711248..2f48b424cd3 100644
--- a/internal/service/ssm/consts.go
+++ b/internal/service/ssm/consts.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssm
 
 import (
diff --git a/internal/service/ssm/default_patch_baseline.go b/internal/service/ssm/default_patch_baseline.go
index da71eef20f0..d8d927ba08a 100644
--- a/internal/service/ssm/default_patch_baseline.go
+++ b/internal/service/ssm/default_patch_baseline.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssm
 
 import (
@@ -5,8 +8,8 @@ import (
 	"errors"
 	"fmt"
 	"log"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/aws/arn"
 	"github.com/aws/aws-sdk-go-v2/service/ssm"
@@ -102,7 +105,7 @@ func diffSuppressPatchBaselineID(_, oldValue, newValue string, _ *schema.Resourc
 	return false
 }
 
-var validatePatchBaselineID = validation.StringMatch(regexp.MustCompile(`^`+patchBaselineIDRegexPattern+`$`), `must match "pb-" followed by 17 hexadecimal characters`)
+var validatePatchBaselineID = validation.StringMatch(regexache.MustCompile(`^`+patchBaselineIDRegexPattern+`$`), `must match "pb-" followed by 17 hexadecimal characters`)
 
 func validatePatchBaselineARN(v any, k string) (ws []string, errors []error) {
 	value, ok := v.(string)
@@ -129,7 +132,7 @@ func validatePatchBaselineARN(v any, k string) (ws []string, errors []error) {
 }
 
 func isPatchBaselineID(s string) bool {
-	re := regexp.MustCompile(`^` + patchBaselineIDRegexPattern + `$`)
+	re := regexache.MustCompile(`^` + patchBaselineIDRegexPattern + `$`)
 
 	return re.MatchString(s)
 }
@@ -153,7 +156,7 @@ func patchBaselineIDFromARN(s string) string {
 }
 
 func patchBaselineIDFromARNResource(s string) string {
-	re := regexp.MustCompile(`^patchbaseline/(` + patchBaselineIDRegexPattern + ")$")
+	re := regexache.MustCompile(`^patchbaseline/(` + patchBaselineIDRegexPattern + ")$")
 	matches := re.FindStringSubmatch(s)
 	if matches == nil || len(matches) != 2 {
 		return ""
@@ -235,7 +238,7 @@ func ownerIsAWSFilter() types.PatchOrchestratorFilter { // nosemgrep:ci.aws-in-f
 	}
 }
 
-func ownerIsSelfFilter() types.PatchOrchestratorFilter { //nolint:unused // This function is called from a sweeper.
+func ownerIsSelfFilter() types.PatchOrchestratorFilter {
 	return types.PatchOrchestratorFilter{
 		Key:    aws.String("OWNER"),
 		Values: []string{"Self"},
@@ -332,7 +335,7 @@ func FindDefaultDefaultPatchBaselineIDForOS(ctx context.Context, conn *ssm.Clien
 		operatingSystemFilter(os),
 		ownerIsAWSFilter(),
 	)
-	re := regexp.MustCompile(`^AWS-[A-Za-z0-9]+PatchBaseline$`)
+	re := regexache.MustCompile(`^AWS-[0-9A-Za-z]+PatchBaseline$`)
 	var baselineIdentityIDs []string
 	for paginator.HasMorePages() {
 		page, err := paginator.NextPage(ctx)
diff --git a/internal/service/ssm/default_patch_baseline_test.go b/internal/service/ssm/default_patch_baseline_test.go
index 8fd89588d49..a50821cc70c 100644
--- a/internal/service/ssm/default_patch_baseline_test.go
+++ b/internal/service/ssm/default_patch_baseline_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssm_test
 
 import (
@@ -7,6 +10,7 @@ import (
 	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/ssm"
 	"github.com/aws/aws-sdk-go-v2/service/ssm/types"
@@ -186,7 +190,7 @@ func testAccSSMDefaultPatchBaseline_wrongOperatingSystem(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccDefaultPatchBaselineConfig_wrongOperatingSystem(rName, types.OperatingSystemAmazonLinux2022, types.OperatingSystemUbuntu),
-				ExpectError: regexp.MustCompile(regexp.QuoteMeta(fmt.Sprintf("Patch Baseline Operating System (%s) does not match %s", types.OperatingSystemAmazonLinux2022, types.OperatingSystemUbuntu))),
+				ExpectError: regexache.MustCompile(regexp.QuoteMeta(fmt.Sprintf("Patch Baseline Operating System (%s) does not match %s", types.OperatingSystemAmazonLinux2022, types.OperatingSystemUbuntu))),
 			},
 		},
 	})
diff --git a/internal/service/ssm/document.go b/internal/service/ssm/document.go
index 6d87604ca65..425a0bfa4cb 100644
--- a/internal/service/ssm/document.go
+++ b/internal/service/ssm/document.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssm
 
 import (
@@ -9,6 +12,7 @@ import (
 	"strings"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/aws/aws-sdk-go/service/ssm"
@@ -64,7 +68,7 @@ func ResourceDocument() *schema.Resource {
 							Type:     schema.TypeString,
 							Optional: true,
 							ValidateFunc: validation.All(
-								validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9_\-.]+$`), "must contain only alphanumeric, underscore, hyphen, or period characters"),
+								validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_.-]+$`), "must contain only alphanumeric, underscore, hyphen, or period characters"),
 								validation.StringLenBetween(3, 128),
 							),
 						},
@@ -128,7 +132,7 @@ func ResourceDocument() *schema.Resource {
 				Required: true,
 				ForceNew: true,
 				ValidateFunc: validation.All(
-					validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9_\-.]+$`), "must contain only alphanumeric, underscore, hyphen, or period characters"),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_.-]+$`), "must contain only alphanumeric, underscore, hyphen, or period characters"),
 					validation.StringLenBetween(3, 128),
 				),
 			},
@@ -186,7 +190,7 @@ func ResourceDocument() *schema.Resource {
 				Type:     schema.TypeString,
 				Optional: true,
 				ValidateFunc: validation.All(
-					validation.StringMatch(regexp.MustCompile(`^\/[\w\.\-\:\/]*$`), "must contain a forward slash optionally followed by a resource type such as AWS::EC2::Instance"),
+					validation.StringMatch(regexache.MustCompile(`^\/[\w\.\-\:\/]*$`), "must contain a forward slash optionally followed by a resource type such as AWS::EC2::Instance"),
 					validation.StringLenBetween(1, 200),
 				),
 			},
@@ -194,7 +198,7 @@ func ResourceDocument() *schema.Resource {
 				Type:     schema.TypeString,
 				Optional: true,
 				ValidateFunc: validation.All(
-					validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9_\-.]{3,128}$`), "must contain only alphanumeric, underscore, hyphen, or period characters"),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_.-]{3,128}$`), "must contain only alphanumeric, underscore, hyphen, or period characters"),
 					validation.StringLenBetween(3, 128),
 				),
 			},
diff --git a/internal/service/ssm/document_data_source.go b/internal/service/ssm/document_data_source.go
index 99035239a82..ed7c1e1dcac 100644
--- a/internal/service/ssm/document_data_source.go
+++ b/internal/service/ssm/document_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssm
 
 import (
diff --git a/internal/service/ssm/document_data_source_test.go b/internal/service/ssm/document_data_source_test.go
index 87278c9c7aa..b136b4ea437 100644
--- a/internal/service/ssm/document_data_source_test.go
+++ b/internal/service/ssm/document_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssm_test
 
 import (
diff --git a/internal/service/ssm/document_test.go b/internal/service/ssm/document_test.go
index 113db4e3ab2..ca9e791203a 100644
--- a/internal/service/ssm/document_test.go
+++ b/internal/service/ssm/document_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssm_test
 
 import (
diff --git a/internal/service/ssm/find.go b/internal/service/ssm/find.go
index c27c332889c..19e5e95f817 100644
--- a/internal/service/ssm/find.go
+++ b/internal/service/ssm/find.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssm
 
 import (
diff --git a/internal/service/ssm/flex.go b/internal/service/ssm/flex.go
index 6a6052917ee..64ebd97c948 100644
--- a/internal/service/ssm/flex.go
+++ b/internal/service/ssm/flex.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssm
 
 import (
diff --git a/internal/service/ssm/generate.go b/internal/service/ssm/generate.go
index de5585feae4..bb8460a6a78 100644
--- a/internal/service/ssm/generate.go
+++ b/internal/service/ssm/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTags -ListTagsInIDElem=ResourceId -ListTagsOutTagsElem=TagList -ServiceTagsSlice -TagOp=AddTagsToResource -TagInIDElem=ResourceId -TagResTypeElem=ResourceType -UntagOp=RemoveTagsFromResource -UpdateTags  -CreateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/ssm/instances_data_source.go b/internal/service/ssm/instances_data_source.go
index 965a1ad5f89..e43c393ac04 100644
--- a/internal/service/ssm/instances_data_source.go
+++ b/internal/service/ssm/instances_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssm
 
 import (
diff --git a/internal/service/ssm/instances_data_source_test.go b/internal/service/ssm/instances_data_source_test.go
index edd8912173e..807f957b400 100644
--- a/internal/service/ssm/instances_data_source_test.go
+++ b/internal/service/ssm/instances_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssm_test
 
 import (
diff --git a/internal/service/ssm/maintenance_window.go b/internal/service/ssm/maintenance_window.go
index 7f6e99b33a9..40e2c0cf7fa 100644
--- a/internal/service/ssm/maintenance_window.go
+++ b/internal/service/ssm/maintenance_window.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssm
 
 import (
diff --git a/internal/service/ssm/maintenance_window_target.go b/internal/service/ssm/maintenance_window_target.go
index aa8deee728c..f659b099d38 100644
--- a/internal/service/ssm/maintenance_window_target.go
+++ b/internal/service/ssm/maintenance_window_target.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssm
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"strings"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ssm"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -60,7 +63,7 @@ func ResourceMaintenanceWindowTarget() *schema.Resource {
 							Type:     schema.TypeString,
 							Required: true,
 							ValidateFunc: validation.All(
-								validation.StringMatch(regexp.MustCompile(`^[\p{L}\p{Z}\p{N}_.:/=\-@]*$|resource-groups:ResourceTypeFilters|resource-groups:Name$`), ""),
+								validation.StringMatch(regexache.MustCompile(`^[\p{L}\p{Z}\p{N}_.:/=\-@]*$|resource-groups:ResourceTypeFilters|resource-groups:Name$`), ""),
 								validation.StringLenBetween(1, 163),
 							),
 						},
@@ -78,7 +81,7 @@ func ResourceMaintenanceWindowTarget() *schema.Resource {
 				Type:         schema.TypeString,
 				Optional:     true,
 				ForceNew:     true,
-				ValidateFunc: validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9_\-.]{3,128}$`), "Only alphanumeric characters, hyphens, dots & underscores allowed"),
+				ValidateFunc: validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_.-]{3,128}$`), "Only alphanumeric characters, hyphens, dots & underscores allowed"),
 			},
 
 			"description": {
diff --git a/internal/service/ssm/maintenance_window_target_test.go b/internal/service/ssm/maintenance_window_target_test.go
index 9f2c0f7c637..884944811a7 100644
--- a/internal/service/ssm/maintenance_window_target_test.go
+++ b/internal/service/ssm/maintenance_window_target_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssm_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ssm"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -99,15 +102,15 @@ func TestAccSSMMaintenanceWindowTarget_validation(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccMaintenanceWindowTargetConfig_basic2(name, "Bäd Name!@#$%^", "good description"),
-				ExpectError: regexp.MustCompile(`Only alphanumeric characters, hyphens, dots & underscores allowed`),
+				ExpectError: regexache.MustCompile(`Only alphanumeric characters, hyphens, dots & underscores allowed`),
 			},
 			{
 				Config:      testAccMaintenanceWindowTargetConfig_basic2(name, "goodname", "bd"),
-				ExpectError: regexp.MustCompile(`expected length of [\w]+ to be in the range \(3 - 128\), got [\w]+`),
+				ExpectError: regexache.MustCompile(`expected length of [\w]+ to be in the range \(3 - 128\), got [\w]+`),
 			},
 			{
 				Config:      testAccMaintenanceWindowTargetConfig_basic2(name, "goodname", "This description is tooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo long"),
-				ExpectError: regexp.MustCompile(`expected length of [\w]+ to be in the range \(3 - 128\), got [\w]+`),
+				ExpectError: regexache.MustCompile(`expected length of [\w]+ to be in the range \(3 - 128\), got [\w]+`),
 			},
 		},
 	})
diff --git a/internal/service/ssm/maintenance_window_task.go b/internal/service/ssm/maintenance_window_task.go
index 7d220e5f588..e632db4a8a6 100644
--- a/internal/service/ssm/maintenance_window_task.go
+++ b/internal/service/ssm/maintenance_window_task.go
@@ -1,13 +1,16 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssm
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"sort"
 	"strings"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/aws/aws-sdk-go/service/ssm"
@@ -57,14 +60,14 @@ func ResourceMaintenanceWindowTask() *schema.Resource {
 				Type:         schema.TypeString,
 				Optional:     true,
 				Computed:     true,
-				ValidateFunc: validation.StringMatch(regexp.MustCompile(`^([1-9][0-9]*|[1-9][0-9]%|[1-9]%|100%)$`), "must be a number without leading zeros or a percentage between 1% and 100% without leading zeros and ending with the percentage symbol"),
+				ValidateFunc: validation.StringMatch(regexache.MustCompile(`^([1-9][0-9]*|[1-9][0-9]%|[1-9]%|100%)$`), "must be a number without leading zeros or a percentage between 1% and 100% without leading zeros and ending with the percentage symbol"),
 			},
 
 			"max_errors": {
 				Type:         schema.TypeString,
 				Optional:     true,
 				Computed:     true,
-				ValidateFunc: validation.StringMatch(regexp.MustCompile(`^([1-9][0-9]*|[0]|[1-9][0-9]%|[0-9]%|100%)$`), "must be zero, a number without leading zeros, or a percentage between 1% and 100% without leading zeros and ending with the percentage symbol"),
+				ValidateFunc: validation.StringMatch(regexache.MustCompile(`^([1-9][0-9]*|[0]|[1-9][0-9]%|[0-9]%|100%)$`), "must be zero, a number without leading zeros, or a percentage between 1% and 100% without leading zeros and ending with the percentage symbol"),
 			},
 
 			"task_type": {
@@ -109,7 +112,7 @@ func ResourceMaintenanceWindowTask() *schema.Resource {
 			"name": {
 				Type:     schema.TypeString,
 				Optional: true,
-				ValidateFunc: validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9_\-.]{3,128}$`),
+				ValidateFunc: validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_.-]{3,128}$`),
 					"Only alphanumeric characters, hyphens, dots & underscores allowed."),
 			},
 
@@ -140,7 +143,7 @@ func ResourceMaintenanceWindowTask() *schema.Resource {
 									"document_version": {
 										Type:         schema.TypeString,
 										Optional:     true,
-										ValidateFunc: validation.StringMatch(regexp.MustCompile("([$]LATEST|[$]DEFAULT|^[1-9][0-9]*$)"), "see https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_MaintenanceWindowAutomationParameters.html"),
+										ValidateFunc: validation.StringMatch(regexache.MustCompile("([$]LATEST|[$]DEFAULT|^[1-9][0-9]*$)"), "see https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_MaintenanceWindowAutomationParameters.html"),
 									},
 									"parameter": {
 										Type:     schema.TypeSet,
@@ -218,7 +221,7 @@ func ResourceMaintenanceWindowTask() *schema.Resource {
 									"document_version": {
 										Type:         schema.TypeString,
 										Optional:     true,
-										ValidateFunc: validation.StringMatch(regexp.MustCompile(`([$]LATEST|[$]DEFAULT|^[1-9][0-9]*$)`), "must be $DEFAULT, $LATEST, or a version number"),
+										ValidateFunc: validation.StringMatch(regexache.MustCompile(`([$]LATEST|[$]DEFAULT|^[1-9][0-9]*$)`), "must be $DEFAULT, $LATEST, or a version number"),
 									},
 
 									"notification_config": {
diff --git a/internal/service/ssm/maintenance_window_task_test.go b/internal/service/ssm/maintenance_window_task_test.go
index 35d61f24d85..a219895f573 100644
--- a/internal/service/ssm/maintenance_window_task_test.go
+++ b/internal/service/ssm/maintenance_window_task_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssm_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ssm"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -33,7 +36,7 @@ func TestAccSSMMaintenanceWindowTask_basic(t *testing.T) {
 				Config: testAccMaintenanceWindowTaskConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckMaintenanceWindowTaskExists(ctx, resourceName, &before),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ssm", regexp.MustCompile(`windowtask/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ssm", regexache.MustCompile(`windowtask/.+`)),
 					resource.TestCheckResourceAttrSet(resourceName, "window_task_id"),
 					resource.TestCheckResourceAttrPair(resourceName, "window_id", "aws_ssm_maintenance_window.test", "id"),
 					resource.TestCheckResourceAttr(resourceName, "targets.#", "1"),
@@ -905,11 +908,6 @@ resource "aws_s3_bucket" "test" {
   force_destroy = true
 }
 
-resource "aws_s3_bucket_acl" "test" {
-  bucket = aws_s3_bucket.test.id
-  acl    = "private"
-}
-
 resource "aws_ssm_maintenance_window_task" "test" {
   window_id        = aws_ssm_maintenance_window.test.id
   task_type        = "AUTOMATION"
@@ -1019,11 +1017,6 @@ resource "aws_s3_bucket" "test" {
   force_destroy = true
 }
 
-resource "aws_s3_bucket_acl" "test" {
-  bucket = aws_s3_bucket.test.id
-  acl    = "private"
-}
-
 resource "aws_ssm_maintenance_window_task" "test" {
   window_id        = aws_ssm_maintenance_window.test.id
   task_type        = "RUN_COMMAND"
diff --git a/internal/service/ssm/maintenance_window_test.go b/internal/service/ssm/maintenance_window_test.go
index 20e10a2ed8c..25ae690d3f1 100644
--- a/internal/service/ssm/maintenance_window_test.go
+++ b/internal/service/ssm/maintenance_window_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssm_test
 
 import (
diff --git a/internal/service/ssm/maintenance_windows_data_source.go b/internal/service/ssm/maintenance_windows_data_source.go
index e3913be915e..559c390aea6 100644
--- a/internal/service/ssm/maintenance_windows_data_source.go
+++ b/internal/service/ssm/maintenance_windows_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssm
 
 import (
diff --git a/internal/service/ssm/maintenance_windows_data_source_test.go b/internal/service/ssm/maintenance_windows_data_source_test.go
index 65f90c0c639..c07a797acba 100644
--- a/internal/service/ssm/maintenance_windows_data_source_test.go
+++ b/internal/service/ssm/maintenance_windows_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssm_test
 
 import (
diff --git a/internal/service/ssm/parameter.go b/internal/service/ssm/parameter.go
index ec48e6f70be..544385cfa6c 100644
--- a/internal/service/ssm/parameter.go
+++ b/internal/service/ssm/parameter.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssm
 
 import (
@@ -300,7 +303,7 @@ func resourceParameterUpdate(ctx context.Context, d *schema.ResourceData, meta i
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).SSMConn(ctx)
 
-	if d.HasChangesExcept("tags", "tags_all") {
+	if d.HasChangesExcept("overwrite", "tags", "tags_all") {
 		value := d.Get("value").(string)
 
 		if v, ok := d.Get("insecure_value").(string); ok && v != "" {
diff --git a/internal/service/ssm/parameter_data_source.go b/internal/service/ssm/parameter_data_source.go
index d9d82f6ff4b..9ab93933a80 100644
--- a/internal/service/ssm/parameter_data_source.go
+++ b/internal/service/ssm/parameter_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssm
 
 import (
@@ -21,6 +24,10 @@ func DataSourceParameter() *schema.Resource {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
+			"insecure_value": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
 			"name": {
 				Type:     schema.TypeString,
 				Required: true,
@@ -69,9 +76,13 @@ func dataParameterRead(ctx context.Context, d *schema.ResourceData, meta interfa
 
 	d.SetId(aws.StringValue(param.Name))
 	d.Set("arn", param.ARN)
+	d.Set("value", param.Value)
+	d.Set("insecure_value", nil)
+	if aws.StringValue(param.Type) != ssm.ParameterTypeSecureString {
+		d.Set("insecure_value", param.Value)
+	}
 	d.Set("name", param.Name)
 	d.Set("type", param.Type)
-	d.Set("value", param.Value)
 	d.Set("version", param.Version)
 
 	return diags
diff --git a/internal/service/ssm/parameter_data_source_test.go b/internal/service/ssm/parameter_data_source_test.go
index d0c8abf8842..bfc9b7bb376 100644
--- a/internal/service/ssm/parameter_data_source_test.go
+++ b/internal/service/ssm/parameter_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssm_test
 
 import (
@@ -69,6 +72,30 @@ func TestAccSSMParameterDataSource_fullPath(t *testing.T) {
 	})
 }
 
+func TestAccSSMParameterDataSource_insecureValue(t *testing.T) {
+	ctx := acctest.Context(t)
+	var param ssm.Parameter
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_ssm_parameter.test"
+	dataSourceName := "data.aws_ssm_parameter.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, ssm.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckParameterDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccParameterConfig_insecureValue(rName, "String"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckParameterExists(ctx, dataSourceName, &param),
+					resource.TestCheckResourceAttrPair(dataSourceName, "insecure_value", resourceName, "insecure_value"),
+				),
+			},
+		},
+	})
+}
+
 func testAccParameterDataSourceConfig_basic(name string, withDecryption string) string {
 	return fmt.Sprintf(`
 resource "aws_ssm_parameter" "test" {
@@ -83,3 +110,17 @@ data "aws_ssm_parameter" "test" {
 }
 `, name, withDecryption)
 }
+
+func testAccParameterConfig_insecureValue(rName, pType string) string {
+	return fmt.Sprintf(`
+resource "aws_ssm_parameter" "test" {
+  name           = %[1]q
+  type           = %[2]q
+  insecure_value = "notsecret"
+}
+
+data "aws_ssm_parameter" "test" {
+  name = aws_ssm_parameter.test.name
+}
+`, rName, pType)
+}
diff --git a/internal/service/ssm/parameter_test.go b/internal/service/ssm/parameter_test.go
index 5aa05698cc8..f0b57e5350a 100644
--- a/internal/service/ssm/parameter_test.go
+++ b/internal/service/ssm/parameter_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssm_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ssm"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -40,6 +43,132 @@ func TestAccSSMParameter_basic(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 					resource.TestCheckResourceAttrSet(resourceName, "version"),
 					resource.TestCheckResourceAttr(resourceName, "data_type", "text"),
+					resource.TestCheckNoResourceAttr(resourceName, "overwrite"),
+				),
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"overwrite"},
+			},
+		},
+	})
+}
+
+// TestAccSSMParameter_multiple is mostly a performance benchmark
+func TestAccSSMParameter_multiple(t *testing.T) {
+	ctx := acctest.Context(t)
+	var param ssm.Parameter
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_ssm_parameter.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, ssm.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckParameterDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccParameterConfig_multiple(rName, "String", "test2"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckParameterExists(ctx, resourceName, &param),
+					acctest.CheckResourceAttrRegionalARN(resourceName, "arn", "ssm", fmt.Sprintf("parameter/%s-1", rName)),
+					resource.TestCheckResourceAttr(resourceName, "value", "test2"),
+					resource.TestCheckResourceAttr(resourceName, "type", "String"),
+					resource.TestCheckResourceAttr(resourceName, "tier", ssm.ParameterTierStandard),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
+					resource.TestCheckResourceAttrSet(resourceName, "version"),
+					resource.TestCheckResourceAttr(resourceName, "data_type", "text"),
+					resource.TestCheckNoResourceAttr(resourceName, "overwrite"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccSSMParameter_updateValue(t *testing.T) {
+	ctx := acctest.Context(t)
+	var param ssm.Parameter
+	name := fmt.Sprintf("%s_%s", t.Name(), sdkacctest.RandString(10))
+	resourceName := "aws_ssm_parameter.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, ssm.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckParameterDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccParameterConfig_basic(name, "String", "test"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckParameterExists(ctx, resourceName, &param),
+					resource.TestCheckResourceAttr(resourceName, "type", "String"),
+					resource.TestCheckResourceAttr(resourceName, "value", "test"),
+					resource.TestCheckNoResourceAttr(resourceName, "overwrite"),
+				),
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"overwrite"},
+			},
+			{
+				Config: testAccParameterConfig_basic(name, "String", "test2"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckParameterExists(ctx, resourceName, &param),
+					resource.TestCheckResourceAttr(resourceName, "type", "String"),
+					resource.TestCheckResourceAttr(resourceName, "value", "test2"),
+					resource.TestCheckNoResourceAttr(resourceName, "overwrite"),
+				),
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"overwrite"},
+			},
+		},
+	})
+}
+
+func TestAccSSMParameter_updateDescription(t *testing.T) {
+	ctx := acctest.Context(t)
+	var param ssm.Parameter
+	name := fmt.Sprintf("%s_%s", t.Name(), sdkacctest.RandString(10))
+	resourceName := "aws_ssm_parameter.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, ssm.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckParameterDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccParameterConfig_description(name, "description", "String", "test"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckParameterExists(ctx, resourceName, &param),
+					resource.TestCheckResourceAttr(resourceName, "description", "description"),
+					resource.TestCheckResourceAttr(resourceName, "type", "String"),
+					resource.TestCheckResourceAttr(resourceName, "value", "test"),
+					resource.TestCheckNoResourceAttr(resourceName, "overwrite"),
+				),
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"overwrite"},
+			},
+			{
+				Config: testAccParameterConfig_description(name, "updated description", "String", "test"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckParameterExists(ctx, resourceName, &param),
+					resource.TestCheckResourceAttr(resourceName, "description", "updated description"),
+					resource.TestCheckResourceAttr(resourceName, "type", "String"),
+					resource.TestCheckResourceAttr(resourceName, "value", "test"),
+					resource.TestCheckNoResourceAttr(resourceName, "overwrite"),
 				),
 			},
 			{
@@ -313,12 +442,14 @@ func TestAccSSMParameter_Overwrite_basic(t *testing.T) {
 				Config: testAccParameterConfig_basicOverwrite(name, "String", "This value is set using Terraform"),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr(resourceName, "version", "2"),
+					resource.TestCheckResourceAttr(resourceName, "overwrite", "true"),
 				),
 			},
 			{
 				Config: testAccParameterConfig_basicOverwrite(name, "String", "test2"),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr(resourceName, "version", "3"),
+					resource.TestCheckResourceAttr(resourceName, "overwrite", "true"),
 				),
 			},
 			{
@@ -334,6 +465,7 @@ func TestAccSSMParameter_Overwrite_basic(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "value", "test3"),
 					resource.TestCheckResourceAttr(resourceName, "type", "String"),
 					resource.TestCheckResourceAttr(resourceName, "version", "4"),
+					resource.TestCheckResourceAttr(resourceName, "overwrite", "true"),
 				),
 			},
 		},
@@ -465,6 +597,41 @@ func TestAccSSMParameter_Overwrite_updateToTags(t *testing.T) {
 		},
 	})
 }
+func TestAccSSMParameter_Overwrite_removeAttribute(t *testing.T) {
+	ctx := acctest.Context(t)
+	var param ssm.Parameter
+	rName := fmt.Sprintf("%s_%s", t.Name(), sdkacctest.RandString(10))
+	resourceName := "aws_ssm_parameter.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:     func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:   acctest.ErrorCheck(t, ssm.EndpointsID),
+		CheckDestroy: testAccCheckParameterDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				ExternalProviders: map[string]resource.ExternalProvider{
+					"aws": {
+						Source:            "hashicorp/aws",
+						VersionConstraint: "4.67.0",
+					},
+				},
+				Config: testAccParameterConfig_overwriteRemove_Setup(rName, "String", "value1"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckParameterExists(ctx, resourceName, &param),
+					resource.TestCheckResourceAttr(resourceName, "overwrite", "true"),
+				),
+			},
+			{
+				ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+				Config:                   testAccParameterConfig_overwriteRemove_Remove(rName, "String", "value1"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckParameterExists(ctx, resourceName, &param),
+					resource.TestCheckResourceAttr(resourceName, "overwrite", "false"),
+				),
+			},
+		},
+	})
+}
 
 func TestAccSSMParameter_tags(t *testing.T) {
 	ctx := acctest.Context(t)
@@ -710,7 +877,7 @@ func TestAccSSMParameter_Secure_insecure(t *testing.T) {
 			},
 			{
 				Config:      testAccParameterConfig_insecure(rName, "SecureString", "notsecret"),
-				ExpectError: regexp.MustCompile("invalid configuration"),
+				ExpectError: regexache.MustCompile("invalid configuration"),
 			},
 		},
 	})
@@ -980,6 +1147,141 @@ resource "aws_ssm_parameter" "test" {
 `, rName, pType, value)
 }
 
+func testAccParameterConfig_multiple(rName, pType, value string) string {
+	return fmt.Sprintf(`
+resource "aws_ssm_parameter" "test" {
+  name  = "%[1]s-1"
+  type  = %[2]q
+  value = %[3]q
+}
+
+resource "aws_ssm_parameter" "test2" {
+  name  = "%[1]s-2"
+  type  = %[2]q
+  value = %[3]q
+}
+
+resource "aws_ssm_parameter" "test3" {
+  name  = "%[1]s-3"
+  type  = %[2]q
+  value = %[3]q
+}
+
+resource "aws_ssm_parameter" "test4" {
+  name  = "%[1]s-4"
+  type  = %[2]q
+  value = %[3]q
+}
+
+resource "aws_ssm_parameter" "test5" {
+  name  = "%[1]s-5"
+  type  = %[2]q
+  value = %[3]q
+}
+
+resource "aws_ssm_parameter" "test6" {
+  name  = "%[1]s-6"
+  type  = %[2]q
+  value = %[3]q
+}
+
+resource "aws_ssm_parameter" "test7" {
+  name  = "%[1]s-7"
+  type  = %[2]q
+  value = %[3]q
+}
+
+resource "aws_ssm_parameter" "test8" {
+  name  = "%[1]s-8"
+  type  = %[2]q
+  value = %[3]q
+}
+
+resource "aws_ssm_parameter" "test9" {
+  name  = "%[1]s-9"
+  type  = %[2]q
+  value = %[3]q
+}
+
+resource "aws_ssm_parameter" "test10" {
+  name  = "%[1]s-10"
+  type  = %[2]q
+  value = %[3]q
+}
+
+resource "aws_ssm_parameter" "test11" {
+  name  = "%[1]s-11"
+  type  = %[2]q
+  value = %[3]q
+}
+
+resource "aws_ssm_parameter" "test12" {
+  name  = "%[1]s-12"
+  type  = %[2]q
+  value = %[3]q
+}
+
+resource "aws_ssm_parameter" "test13" {
+  name  = "%[1]s-13"
+  type  = %[2]q
+  value = %[3]q
+}
+
+resource "aws_ssm_parameter" "test14" {
+  name  = "%[1]s-14"
+  type  = %[2]q
+  value = %[3]q
+}
+
+resource "aws_ssm_parameter" "test15" {
+  name  = "%[1]s-15"
+  type  = %[2]q
+  value = %[3]q
+}
+
+resource "aws_ssm_parameter" "test16" {
+  name  = "%[1]s-16"
+  type  = %[2]q
+  value = %[3]q
+}
+
+resource "aws_ssm_parameter" "test17" {
+  name  = "%[1]s-17"
+  type  = %[2]q
+  value = %[3]q
+}
+
+resource "aws_ssm_parameter" "test18" {
+  name  = "%[1]s-18"
+  type  = %[2]q
+  value = %[3]q
+}
+
+resource "aws_ssm_parameter" "test19" {
+  name  = "%[1]s-19"
+  type  = %[2]q
+  value = %[3]q
+}
+
+resource "aws_ssm_parameter" "test20" {
+  name  = "%[1]s-20"
+  type  = %[2]q
+  value = %[3]q
+}
+`, rName, pType, value)
+}
+
+func testAccParameterConfig_description(rName, description, pType, value string) string {
+	return fmt.Sprintf(`
+resource "aws_ssm_parameter" "test" {
+  name        = %[1]q
+  description = %[2]q
+  type        = %[3]q
+  value       = %[4]q
+}
+`, rName, description, pType, value)
+}
+
 func testAccParameterConfig_insecure(rName, pType, value string) string {
 	return fmt.Sprintf(`
 resource "aws_ssm_parameter" "test" {
@@ -1121,6 +1423,29 @@ resource "aws_ssm_parameter" "test_downstream" {
 `, rName, value)
 }
 
+func testAccParameterConfig_overwriteRemove_Setup(rName, pType, value string) string {
+	return fmt.Sprintf(`
+resource "aws_ssm_parameter" "test" {
+  name        = "test_parameter-%[1]s"
+  description = "description for parameter %[1]s"
+  type        = "%[2]s"
+  value       = "%[3]s"
+  overwrite   = true
+}
+`, rName, pType, value)
+}
+
+func testAccParameterConfig_overwriteRemove_Remove(rName, pType, value string) string {
+	return fmt.Sprintf(`
+resource "aws_ssm_parameter" "test" {
+  name        = "test_parameter-%[1]s"
+  description = "description for parameter %[1]s"
+  type        = "%[2]s"
+  value       = "%[3]s"
+}
+`, rName, pType, value)
+}
+
 func testAccParameterConfig_secure(rName string, value string) string {
 	return fmt.Sprintf(`
 resource "aws_ssm_parameter" "test" {
diff --git a/internal/service/ssm/parameters_by_path_data_source.go b/internal/service/ssm/parameters_by_path_data_source.go
index 362c5f88eb3..1d9ba9f2fab 100644
--- a/internal/service/ssm/parameters_by_path_data_source.go
+++ b/internal/service/ssm/parameters_by_path_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssm
 
 import (
diff --git a/internal/service/ssm/parameters_by_path_data_source_test.go b/internal/service/ssm/parameters_by_path_data_source_test.go
index ee043425e2a..72b31e14bf9 100644
--- a/internal/service/ssm/parameters_by_path_data_source_test.go
+++ b/internal/service/ssm/parameters_by_path_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssm_test
 
 import (
diff --git a/internal/service/ssm/patch_baseline.go b/internal/service/ssm/patch_baseline.go
index 6a56a156b46..0cd41f900a6 100644
--- a/internal/service/ssm/patch_baseline.go
+++ b/internal/service/ssm/patch_baseline.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssm
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"strings"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/service/ssm/types"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/arn"
@@ -46,7 +49,7 @@ func ResourcePatchBaseline() *schema.Resource {
 				Required: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(3, 128),
-					validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9_\-.]{3,128}$`), "must contain only alphanumeric, underscore, hyphen, or period characters"),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_.-]{3,128}$`), "must contain only alphanumeric, underscore, hyphen, or period characters"),
 				),
 			},
 
@@ -95,7 +98,7 @@ func ResourcePatchBaseline() *schema.Resource {
 						"approve_until_date": {
 							Type:         schema.TypeString,
 							Optional:     true,
-							ValidateFunc: validation.StringMatch(regexp.MustCompile(`([12]\d{3}-(0[1-9]|1[0-2])-(0[1-9]|[12]\d|3[01]))`), "must be formatted YYYY-MM-DD"),
+							ValidateFunc: validation.StringMatch(regexache.MustCompile(`([12]\d{3}-(0[1-9]|1[0-2])-(0[1-9]|[12]\d|3[01]))`), "must be formatted YYYY-MM-DD"),
 						},
 
 						"compliance_level": {
@@ -195,7 +198,7 @@ func ResourcePatchBaseline() *schema.Resource {
 							Required: true,
 							ValidateFunc: validation.All(
 								validation.StringLenBetween(3, 50),
-								validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9_\-.]{3,50}$`), "must contain only alphanumeric, underscore, hyphen, or period characters"),
+								validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_.-]{3,50}$`), "must contain only alphanumeric, underscore, hyphen, or period characters"),
 							),
 						},
 
diff --git a/internal/service/ssm/patch_baseline_data_source.go b/internal/service/ssm/patch_baseline_data_source.go
index 206c58c64ec..5ae469620ac 100644
--- a/internal/service/ssm/patch_baseline_data_source.go
+++ b/internal/service/ssm/patch_baseline_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssm
 
 import (
diff --git a/internal/service/ssm/patch_baseline_data_source_test.go b/internal/service/ssm/patch_baseline_data_source_test.go
index 9c852310f51..f075cc4c702 100644
--- a/internal/service/ssm/patch_baseline_data_source_test.go
+++ b/internal/service/ssm/patch_baseline_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssm_test
 
 import (
diff --git a/internal/service/ssm/patch_baseline_test.go b/internal/service/ssm/patch_baseline_test.go
index b6d0c9b4800..9c778ff648c 100644
--- a/internal/service/ssm/patch_baseline_test.go
+++ b/internal/service/ssm/patch_baseline_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssm_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ssm"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -31,7 +34,7 @@ func TestAccSSMPatchBaseline_basic(t *testing.T) {
 				Config: testAccPatchBaselineConfig_basic(name),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckPatchBaselineExists(ctx, resourceName, &before),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ssm", regexp.MustCompile(`patchbaseline/pb-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ssm", regexache.MustCompile(`patchbaseline/pb-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "approved_patches.#", "1"),
 					resource.TestCheckTypeSetElemAttr(resourceName, "approved_patches.*", "KB123456"),
 					resource.TestCheckResourceAttr(resourceName, "name", fmt.Sprintf("patch-baseline-%s", name)),
@@ -50,7 +53,7 @@ func TestAccSSMPatchBaseline_basic(t *testing.T) {
 				Config: testAccPatchBaselineConfig_basicUpdated(name),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckPatchBaselineExists(ctx, resourceName, &after),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ssm", regexp.MustCompile(`patchbaseline/pb-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ssm", regexache.MustCompile(`patchbaseline/pb-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "approved_patches.#", "2"),
 					resource.TestCheckTypeSetElemAttr(resourceName, "approved_patches.*", "KB123456"),
 					resource.TestCheckTypeSetElemAttr(resourceName, "approved_patches.*", "KB456789"),
diff --git a/internal/service/ssm/patch_group.go b/internal/service/ssm/patch_group.go
index 1732deacb81..f22e42f9ec9 100644
--- a/internal/service/ssm/patch_group.go
+++ b/internal/service/ssm/patch_group.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssm
 
 import (
@@ -110,20 +113,20 @@ func resourcePatchGroupDelete(ctx context.Context, d *schema.ResourceData, meta
 
 	patchGroup, baselineId, err := ParsePatchGroupID(d.Id())
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "parsing SSM Patch Group ID (%s): %s", d.Id(), err)
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
-	params := &ssm.DeregisterPatchBaselineForPatchGroupInput{
+	log.Printf("[WARN] Deleting SSM Patch Group: %s", d.Id())
+	_, err = conn.DeregisterPatchBaselineForPatchGroupWithContext(ctx, &ssm.DeregisterPatchBaselineForPatchGroupInput{
 		BaselineId: aws.String(baselineId),
 		PatchGroup: aws.String(patchGroup),
-	}
+	})
 
-	_, err = conn.DeregisterPatchBaselineForPatchGroupWithContext(ctx, params)
+	if tfawserr.ErrCodeEquals(err, ssm.ErrCodeDoesNotExistException) {
+		return diags
+	}
 
 	if err != nil {
-		if tfawserr.ErrCodeEquals(err, ssm.ErrCodeDoesNotExistException) {
-			return diags
-		}
 		return sdkdiag.AppendErrorf(diags, "deregistering SSM Patch Baseline (%s) for Patch Group (%s): %s", baselineId, patchGroup, err)
 	}
 
diff --git a/internal/service/ssm/patch_group_migrate.go b/internal/service/ssm/patch_group_migrate.go
index 703dbcb19f8..90d4194f70f 100644
--- a/internal/service/ssm/patch_group_migrate.go
+++ b/internal/service/ssm/patch_group_migrate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssm
 
 import (
diff --git a/internal/service/ssm/patch_group_migrate_test.go b/internal/service/ssm/patch_group_migrate_test.go
index a72d021cf0b..54479207650 100644
--- a/internal/service/ssm/patch_group_migrate_test.go
+++ b/internal/service/ssm/patch_group_migrate_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssm_test
 
 import (
diff --git a/internal/service/ssm/patch_group_test.go b/internal/service/ssm/patch_group_test.go
index f0d4251b2b4..b9259e6a011 100644
--- a/internal/service/ssm/patch_group_test.go
+++ b/internal/service/ssm/patch_group_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssm_test
 
 import (
diff --git a/internal/service/ssm/resource_data_sync.go b/internal/service/ssm/resource_data_sync.go
index 61bf2190820..6d446caecfb 100644
--- a/internal/service/ssm/resource_data_sync.go
+++ b/internal/service/ssm/resource_data_sync.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssm
 
 import (
diff --git a/internal/service/ssm/resource_data_sync_test.go b/internal/service/ssm/resource_data_sync_test.go
index e43fa0c172b..67c31ef1e5a 100644
--- a/internal/service/ssm/resource_data_sync_test.go
+++ b/internal/service/ssm/resource_data_sync_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssm_test
 
 import (
diff --git a/internal/service/ssm/service_package_gen.go b/internal/service/ssm/service_package_gen.go
index 838c63ca62e..014ec193c33 100644
--- a/internal/service/ssm/service_package_gen.go
+++ b/internal/service/ssm/service_package_gen.go
@@ -10,6 +10,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	ssm_sdkv1 "github.com/aws/aws-sdk-go/service/ssm"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -145,9 +146,11 @@ func (p *servicePackage) NewClient(ctx context.Context, config map[string]any) (
 
 	return ssm_sdkv2.NewFromConfig(cfg, func(o *ssm_sdkv2.Options) {
 		if endpoint := config["endpoint"].(string); endpoint != "" {
-			o.EndpointResolver = ssm_sdkv2.EndpointResolverFromURL(endpoint)
+			o.BaseEndpoint = aws_sdkv2.String(endpoint)
 		}
 	}), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/ssm/service_setting.go b/internal/service/ssm/service_setting.go
index cdf892dc1a3..5df2bcd2f4d 100644
--- a/internal/service/ssm/service_setting.go
+++ b/internal/service/ssm/service_setting.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssm
 
 import (
diff --git a/internal/service/ssm/service_setting_test.go b/internal/service/ssm/service_setting_test.go
index 77f0e96dccb..8d1646dce57 100644
--- a/internal/service/ssm/service_setting_test.go
+++ b/internal/service/ssm/service_setting_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssm_test
 
 import (
diff --git a/internal/service/ssm/ssm_test.go b/internal/service/ssm/ssm_test.go
index ba0a817bb00..c56e401c79a 100644
--- a/internal/service/ssm/ssm_test.go
+++ b/internal/service/ssm/ssm_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssm_test
 
 import (
diff --git a/internal/service/ssm/status.go b/internal/service/ssm/status.go
index e88b979dbc8..0452199c0f2 100644
--- a/internal/service/ssm/status.go
+++ b/internal/service/ssm/status.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssm
 
 import (
diff --git a/internal/service/ssm/sweep.go b/internal/service/ssm/sweep.go
index f2d249da3bb..0a882b6c194 100644
--- a/internal/service/ssm/sweep.go
+++ b/internal/service/ssm/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package ssm
 
@@ -20,13 +20,15 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
 	tfslices "github.com/hashicorp/terraform-provider-aws/internal/slices"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv2"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_ssm_default_patch_baseline", &resource.Sweeper{
 		Name: "aws_ssm_default_patch_baseline",
-		F:    sweepResourceDefaultPatchBaselines,
+		F:    sweepDefaultPatchBaselines,
 	})
 
 	resource.AddTestSweepers("aws_ssm_maintenance_window", &resource.Sweeper{
@@ -36,21 +38,27 @@ func init() {
 
 	resource.AddTestSweepers("aws_ssm_patch_baseline", &resource.Sweeper{
 		Name: "aws_ssm_patch_baseline",
-		F:    sweepResourcePatchBaselines,
+		F:    sweepPatchBaselines,
 		Dependencies: []string{
 			"aws_ssm_default_patch_baseline",
+			"aws_ssm_patch_group",
 		},
 	})
 
+	resource.AddTestSweepers("aws_ssm_patch_group", &resource.Sweeper{
+		Name: "aws_ssm_patch_group",
+		F:    sweepPatchGroups,
+	})
+
 	resource.AddTestSweepers("aws_ssm_resource_data_sync", &resource.Sweeper{
 		Name: "aws_ssm_resource_data_sync",
 		F:    sweepResourceDataSyncs,
 	})
 }
 
-func sweepResourceDefaultPatchBaselines(region string) error {
+func sweepDefaultPatchBaselines(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("getting client: %w", err)
 	}
@@ -63,6 +71,10 @@ func sweepResourceDefaultPatchBaselines(region string) error {
 	paginator := patchBaselinesPaginator(conn, ownerIsSelfFilter())
 	for paginator.HasMorePages() {
 		page, err := paginator.NextPage(ctx)
+		if awsv2.SkipSweepError(err) {
+			log.Printf("[WARN] Skipping Default Patch Baselines sweep for %s: %s", region, errs)
+			break
+		}
 		if err != nil {
 			errs = multierror.Append(errs, fmt.Errorf("listing Default Patch Baselines for %s: %w", region, err))
 			break
@@ -84,15 +96,10 @@ func sweepResourceDefaultPatchBaselines(region string) error {
 		}
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepables); err != nil {
+	if err := sweep.SweepOrchestrator(ctx, sweepables); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("sweeping Default Patch Baselines for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(err) {
-		log.Printf("[WARN] Skipping Default Patch Baselines sweep for %s: %s", region, errs)
-		return nil
-	}
-
 	return errs.ErrorOrNil()
 }
 
@@ -116,7 +123,7 @@ func (s defaultPatchBaselineSweeper) Delete(ctx context.Context, timeout time.Du
 
 func sweepMaintenanceWindows(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("getting client: %s", err)
@@ -130,7 +137,7 @@ func sweepMaintenanceWindows(region string) error {
 	for {
 		output, err := conn.DescribeMaintenanceWindowsWithContext(ctx, input)
 
-		if sweep.SkipSweepError(err) {
+		if awsv1.SkipSweepError(err) {
 			log.Printf("[WARN] Skipping SSM Maintenance Window sweep for %s: %s", region, err)
 			return nil
 		}
@@ -154,9 +161,7 @@ func sweepMaintenanceWindows(region string) error {
 			}
 
 			if err != nil {
-				sweeperErr := fmt.Errorf("deleting SSM Maintenance Window (%s): %w", id, err)
-				log.Printf("[ERROR] %s", sweeperErr)
-				sweeperErrs = multierror.Append(sweeperErrs, sweeperErr)
+				sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("deleting SSM Maintenance Window (%s): %w", id, err))
 				continue
 			}
 		}
@@ -171,9 +176,9 @@ func sweepMaintenanceWindows(region string) error {
 	return nil
 }
 
-func sweepResourcePatchBaselines(region string) error {
+func sweepPatchBaselines(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("getting client: %w", err)
 	}
@@ -186,6 +191,10 @@ func sweepResourcePatchBaselines(region string) error {
 	paginator := patchBaselinesPaginator(conn, ownerIsSelfFilter())
 	for paginator.HasMorePages() {
 		page, err := paginator.NextPage(ctx)
+		if awsv2.SkipSweepError(err) {
+			log.Printf("[WARN] Skipping Patch Baselines sweep for %s: %s", region, errs)
+			break
+		}
 		if err != nil {
 			errs = multierror.Append(errs, fmt.Errorf("listing Patch Baselines for %s: %w", region, err))
 			break
@@ -195,19 +204,58 @@ func sweepResourcePatchBaselines(region string) error {
 			baselineID := aws.ToString(identity.BaselineId)
 			r := ResourcePatchBaseline()
 			d := r.Data(nil)
-
 			d.SetId(baselineID)
+			d.Set("operating_system", identity.OperatingSystem)
 
 			sweepables = append(sweepables, sweep.NewSweepResource(r, d, client))
 		}
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepables); err != nil {
+	if err := sweep.SweepOrchestrator(ctx, sweepables); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("sweeping Patch Baselines for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(err) {
-		log.Printf("[WARN] Skipping Patch Baselines sweep for %s: %s", region, errs)
+	return errs.ErrorOrNil()
+}
+
+func sweepPatchGroups(region string) error {
+	ctx := sweep.Context(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
+	if err != nil {
+		return fmt.Errorf("getting client: %w", err)
+	}
+	conn := client.SSMConn(ctx)
+	sweepResources := make([]sweep.Sweepable, 0)
+	var errs *multierror.Error
+
+	input := &ssm_sdkv1.DescribePatchGroupsInput{}
+
+	err = conn.DescribePatchGroupsPagesWithContext(ctx, input, func(page *ssm_sdkv1.DescribePatchGroupsOutput, lastPage bool) bool {
+		if page == nil {
+			return !lastPage
+		}
+
+		for _, mapping := range page.Mappings {
+			r := ResourcePatchGroup()
+			d := r.Data(nil)
+			d.SetId(fmt.Sprintf("%s,%s", aws.ToString(mapping.PatchGroup), aws.ToString(mapping.BaselineIdentity.BaselineId)))
+
+			sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
+		}
+
+		return !lastPage
+	})
+
+	if err != nil {
+		errs = multierror.Append(errs, fmt.Errorf("listing SSM Patch Groups for %s: %w", region, err))
+	}
+
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
+		errs = multierror.Append(errs, fmt.Errorf("sweeping SSM Patch Groups for %s: %w", region, err))
+	}
+
+	if awsv1.SkipSweepError(errs.ErrorOrNil()) {
+		log.Printf("[WARN] Skipping SSM Patch Group sweep for %s: %s", region, errs)
 		return nil
 	}
 
@@ -216,7 +264,7 @@ func sweepResourcePatchBaselines(region string) error {
 
 func sweepResourceDataSyncs(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("getting client: %w", err)
@@ -251,11 +299,11 @@ func sweepResourceDataSyncs(region string) error {
 		errs = multierror.Append(errs, fmt.Errorf("listing SSM Resource Data Sync for %s: %w", region, err))
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("sweeping SSM Resource Data Sync for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
+	if awsv1.SkipSweepError(errs.ErrorOrNil()) {
 		log.Printf("[WARN] Skipping SSM Resource Data Sync sweep for %s: %s", region, errs)
 		return nil
 	}
diff --git a/internal/service/ssm/tags_gen.go b/internal/service/ssm/tags_gen.go
index 5d8a1d3eabf..3a27c7ef308 100644
--- a/internal/service/ssm/tags_gen.go
+++ b/internal/service/ssm/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ssm"
 	"github.com/aws/aws-sdk-go/service/ssm/ssmiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -112,6 +114,8 @@ func updateTags(ctx context.Context, conn ssmiface.SSMAPI, identifier, resourceT
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.SSM)
 	if len(removedTags) > 0 {
diff --git a/internal/service/ssm/wait.go b/internal/service/ssm/wait.go
index cd6dd61e421..e817bde1bf5 100644
--- a/internal/service/ssm/wait.go
+++ b/internal/service/ssm/wait.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssm
 
 import (
diff --git a/internal/service/ssmcontacts/contact.go b/internal/service/ssmcontacts/contact.go
index 22c255f1469..fdd50b15a6e 100644
--- a/internal/service/ssmcontacts/contact.go
+++ b/internal/service/ssmcontacts/contact.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssmcontacts
 
 import (
diff --git a/internal/service/ssmcontacts/contact_channel.go b/internal/service/ssmcontacts/contact_channel.go
index 1fe0eba83f5..d66f1a2cb2e 100644
--- a/internal/service/ssmcontacts/contact_channel.go
+++ b/internal/service/ssmcontacts/contact_channel.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssmcontacts
 
 import (
diff --git a/internal/service/ssmcontacts/contact_channel_data_source.go b/internal/service/ssmcontacts/contact_channel_data_source.go
index 4bec3ba11c4..655907ec84c 100644
--- a/internal/service/ssmcontacts/contact_channel_data_source.go
+++ b/internal/service/ssmcontacts/contact_channel_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssmcontacts
 
 import (
diff --git a/internal/service/ssmcontacts/contact_channel_data_source_test.go b/internal/service/ssmcontacts/contact_channel_data_source_test.go
index 184a97689f1..5754577660f 100644
--- a/internal/service/ssmcontacts/contact_channel_data_source_test.go
+++ b/internal/service/ssmcontacts/contact_channel_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssmcontacts_test
 
 import (
diff --git a/internal/service/ssmcontacts/contact_channel_test.go b/internal/service/ssmcontacts/contact_channel_test.go
index 1df69e0379d..e89c39bb3fd 100644
--- a/internal/service/ssmcontacts/contact_channel_test.go
+++ b/internal/service/ssmcontacts/contact_channel_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssmcontacts_test
 
 import (
 	"context"
 	"errors"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/ssmcontacts"
 	"github.com/aws/aws-sdk-go-v2/service/ssmcontacts/types"
@@ -49,7 +52,7 @@ func testContactChannel_basic(t *testing.T) {
 					resource.TestCheckResourceAttr(channelResourceName, "name", rName),
 					resource.TestCheckResourceAttr(channelResourceName, "type", "EMAIL"),
 					resource.TestCheckResourceAttrPair(channelResourceName, "contact_id", contactResourceName, "arn"),
-					acctest.MatchResourceAttrRegionalARN(channelResourceName, "arn", "ssm-contacts", regexp.MustCompile("contact-channel/test-contact-for-"+rName+"/.")),
+					acctest.MatchResourceAttrRegionalARN(channelResourceName, "arn", "ssm-contacts", regexache.MustCompile("contact-channel/test-contact-for-"+rName+"/.")),
 				),
 			},
 			{
diff --git a/internal/service/ssmcontacts/contact_data_source.go b/internal/service/ssmcontacts/contact_data_source.go
index 252952c57c9..f5172ab19a6 100644
--- a/internal/service/ssmcontacts/contact_data_source.go
+++ b/internal/service/ssmcontacts/contact_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssmcontacts
 
 import (
diff --git a/internal/service/ssmcontacts/contact_data_source_test.go b/internal/service/ssmcontacts/contact_data_source_test.go
index 9f05d9e5fa9..c80ed308857 100644
--- a/internal/service/ssmcontacts/contact_data_source_test.go
+++ b/internal/service/ssmcontacts/contact_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssmcontacts_test
 
 import (
diff --git a/internal/service/ssmcontacts/contact_test.go b/internal/service/ssmcontacts/contact_test.go
index 09293df13c4..874caa58ac0 100644
--- a/internal/service/ssmcontacts/contact_test.go
+++ b/internal/service/ssmcontacts/contact_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssmcontacts_test
 
 import (
 	"context"
 	"errors"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/ssmcontacts"
 	"github.com/aws/aws-sdk-go-v2/service/ssmcontacts/types"
@@ -44,7 +47,7 @@ func testContact_basic(t *testing.T) {
 					testAccCheckContactExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "alias", rName),
 					resource.TestCheckResourceAttr(resourceName, "type", "PERSONAL"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ssm-contacts", regexp.MustCompile(`contact/+.`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "ssm-contacts", regexache.MustCompile(`contact/+.`)),
 				),
 			},
 			{
diff --git a/internal/service/ssmcontacts/find.go b/internal/service/ssmcontacts/find.go
index c69edfcfad3..373b2ea09da 100644
--- a/internal/service/ssmcontacts/find.go
+++ b/internal/service/ssmcontacts/find.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssmcontacts
 
 import (
diff --git a/internal/service/ssmcontacts/flex.go b/internal/service/ssmcontacts/flex.go
index 6155b716dd9..ad5bfaec505 100644
--- a/internal/service/ssmcontacts/flex.go
+++ b/internal/service/ssmcontacts/flex.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssmcontacts
 
 import (
diff --git a/internal/service/ssmcontacts/generate.go b/internal/service/ssmcontacts/generate.go
index 1fa1d936fbe..a8f164c78ed 100644
--- a/internal/service/ssmcontacts/generate.go
+++ b/internal/service/ssmcontacts/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ServiceTagsSlice -ListTags -UpdateTags -AWSSDKVersion=2 -TagInIDElem=ResourceARN -ListTagsInIDElem=ResourceARN
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/ssmcontacts/helper.go b/internal/service/ssmcontacts/helper.go
index c8316140ca9..3e541c4a404 100644
--- a/internal/service/ssmcontacts/helper.go
+++ b/internal/service/ssmcontacts/helper.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssmcontacts
 
 import (
diff --git a/internal/service/ssmcontacts/plan.go b/internal/service/ssmcontacts/plan.go
index 013d5453815..81ded8a6bbc 100644
--- a/internal/service/ssmcontacts/plan.go
+++ b/internal/service/ssmcontacts/plan.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssmcontacts
 
 import (
diff --git a/internal/service/ssmcontacts/plan_data_source.go b/internal/service/ssmcontacts/plan_data_source.go
index be2a164d17e..f816da18d7f 100644
--- a/internal/service/ssmcontacts/plan_data_source.go
+++ b/internal/service/ssmcontacts/plan_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssmcontacts
 
 import (
diff --git a/internal/service/ssmcontacts/plan_data_source_test.go b/internal/service/ssmcontacts/plan_data_source_test.go
index 7935f33d2b3..3e2f5a19452 100644
--- a/internal/service/ssmcontacts/plan_data_source_test.go
+++ b/internal/service/ssmcontacts/plan_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssmcontacts_test
 
 import (
diff --git a/internal/service/ssmcontacts/plan_test.go b/internal/service/ssmcontacts/plan_test.go
index f2475cc00ca..bcdd5d92066 100644
--- a/internal/service/ssmcontacts/plan_test.go
+++ b/internal/service/ssmcontacts/plan_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssmcontacts_test
 
 import (
diff --git a/internal/service/ssmcontacts/service_package_gen.go b/internal/service/ssmcontacts/service_package_gen.go
index 370086ab765..5cabb01b9dc 100644
--- a/internal/service/ssmcontacts/service_package_gen.go
+++ b/internal/service/ssmcontacts/service_package_gen.go
@@ -7,6 +7,7 @@ import (
 
 	aws_sdkv2 "github.com/aws/aws-sdk-go-v2/aws"
 	ssmcontacts_sdkv2 "github.com/aws/aws-sdk-go-v2/service/ssmcontacts"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -71,9 +72,11 @@ func (p *servicePackage) NewClient(ctx context.Context, config map[string]any) (
 
 	return ssmcontacts_sdkv2.NewFromConfig(cfg, func(o *ssmcontacts_sdkv2.Options) {
 		if endpoint := config["endpoint"].(string); endpoint != "" {
-			o.EndpointResolver = ssmcontacts_sdkv2.EndpointResolverFromURL(endpoint)
+			o.BaseEndpoint = aws_sdkv2.String(endpoint)
 		}
 	}), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/ssmcontacts/ssmcontacts_test.go b/internal/service/ssmcontacts/ssmcontacts_test.go
index 48c650a66af..2c872cd9ee6 100644
--- a/internal/service/ssmcontacts/ssmcontacts_test.go
+++ b/internal/service/ssmcontacts/ssmcontacts_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssmcontacts_test
 
 import (
diff --git a/internal/service/ssmcontacts/tags_gen.go b/internal/service/ssmcontacts/tags_gen.go
index cfb30b4b9a4..43bbba79758 100644
--- a/internal/service/ssmcontacts/tags_gen.go
+++ b/internal/service/ssmcontacts/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/ssmcontacts"
 	awstypes "github.com/aws/aws-sdk-go-v2/service/ssmcontacts/types"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -102,6 +104,8 @@ func updateTags(ctx context.Context, conn *ssmcontacts.Client, identifier string
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.SSMContacts)
 	if len(removedTags) > 0 {
diff --git a/internal/service/ssmincidents/find.go b/internal/service/ssmincidents/find.go
index 7f00715a16d..acb0d515062 100644
--- a/internal/service/ssmincidents/find.go
+++ b/internal/service/ssmincidents/find.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssmincidents
 
 import (
diff --git a/internal/service/ssmincidents/flex.go b/internal/service/ssmincidents/flex.go
index 904d12033f9..85faad23dd4 100644
--- a/internal/service/ssmincidents/flex.go
+++ b/internal/service/ssmincidents/flex.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssmincidents
 
 import (
diff --git a/internal/service/ssmincidents/generate.go b/internal/service/ssmincidents/generate.go
index 07a39513473..5634f6d59a9 100644
--- a/internal/service/ssmincidents/generate.go
+++ b/internal/service/ssmincidents/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go  -AWSSDKVersion=2 -TagInIDElem=ResourceArn -ListTags -ListTagsInIDElem=ResourceArn -ServiceTagsMap -UpdateTags -KVTValues -SkipTypesImp
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/ssmincidents/helper.go b/internal/service/ssmincidents/helper.go
index d94ebb1f676..f08c85a662c 100644
--- a/internal/service/ssmincidents/helper.go
+++ b/internal/service/ssmincidents/helper.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssmincidents
 
 import (
diff --git a/internal/service/ssmincidents/replication_set.go b/internal/service/ssmincidents/replication_set.go
index 05ddf5ec26a..54ab5f336ec 100644
--- a/internal/service/ssmincidents/replication_set.go
+++ b/internal/service/ssmincidents/replication_set.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssmincidents
 
 import (
diff --git a/internal/service/ssmincidents/replication_set_data_source.go b/internal/service/ssmincidents/replication_set_data_source.go
index d67c396dba4..aa56d45a85d 100644
--- a/internal/service/ssmincidents/replication_set_data_source.go
+++ b/internal/service/ssmincidents/replication_set_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssmincidents
 
 import (
diff --git a/internal/service/ssmincidents/replication_set_data_source_test.go b/internal/service/ssmincidents/replication_set_data_source_test.go
index dc01754f336..f7a10ccfd7e 100644
--- a/internal/service/ssmincidents/replication_set_data_source_test.go
+++ b/internal/service/ssmincidents/replication_set_data_source_test.go
@@ -1,11 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssmincidents_test
 
 import (
-	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -16,8 +18,7 @@ func testReplicationSetDataSource_basic(t *testing.T) {
 		t.Skip("skipping long-running test in short mode")
 	}
 
-	ctx := context.Background()
-
+	ctx := acctest.Context(t)
 	dataSourceName := "data.aws_ssmincidents_replication_set.test"
 	resourceName := "aws_ssmincidents_replication_set.test"
 
@@ -45,7 +46,7 @@ func testReplicationSetDataSource_basic(t *testing.T) {
 					resource.TestCheckTypeSetElemAttrPair(resourceName, "region.0.status", dataSourceName, "region.0.status"),
 					resource.TestCheckTypeSetElemAttrPair(resourceName, "region.0.status_message", dataSourceName, "region.0.status_message"),
 
-					acctest.MatchResourceAttrGlobalARN(dataSourceName, "arn", "ssm-incidents", regexp.MustCompile(`replication-set\/+.`)),
+					acctest.MatchResourceAttrGlobalARN(dataSourceName, "arn", "ssm-incidents", regexache.MustCompile(`replication-set\/+.`)),
 				),
 			},
 		},
diff --git a/internal/service/ssmincidents/replication_set_test.go b/internal/service/ssmincidents/replication_set_test.go
index ef74f6d7ec7..9f67541edc3 100644
--- a/internal/service/ssmincidents/replication_set_test.go
+++ b/internal/service/ssmincidents/replication_set_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssmincidents_test
 
 import (
@@ -5,9 +8,9 @@ import (
 	"errors"
 	"fmt"
 	"log"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
@@ -24,8 +27,7 @@ func testReplicationSet_basic(t *testing.T) {
 		t.Skip("skipping long-running test in short mode")
 	}
 
-	ctx := context.Background()
-
+	ctx := acctest.Context(t)
 	resourceName := "aws_ssmincidents_replication_set.test"
 	region1 := acctest.Region()
 	region2 := acctest.AlternateRegion()
@@ -53,7 +55,7 @@ func testReplicationSet_basic(t *testing.T) {
 						"name":        region2,
 						"kms_key_arn": "DefaultKey",
 					}),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "ssm-incidents", regexp.MustCompile(`replication-set\/+.`)),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "ssm-incidents", regexache.MustCompile(`replication-set\/+.`)),
 				),
 			},
 			{
@@ -70,8 +72,7 @@ func testReplicationSet_updateRegionsWithoutCMK(t *testing.T) {
 		t.Skip("skipping long-running test in short mode")
 	}
 
-	ctx := context.Background()
-
+	ctx := acctest.Context(t)
 	resourceName := "aws_ssmincidents_replication_set.test"
 	region1 := acctest.Region()
 	region2 := acctest.AlternateRegion()
@@ -96,7 +97,7 @@ func testReplicationSet_updateRegionsWithoutCMK(t *testing.T) {
 						"kms_key_arn": "DefaultKey",
 					}),
 
-					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "ssm-incidents", regexp.MustCompile(`replication-set\/+.`)),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "ssm-incidents", regexache.MustCompile(`replication-set\/+.`)),
 				),
 			},
 			{
@@ -119,7 +120,7 @@ func testReplicationSet_updateRegionsWithoutCMK(t *testing.T) {
 						"kms_key_arn": "DefaultKey",
 					}),
 
-					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "ssm-incidents", regexp.MustCompile(`replication-set\/+.`)),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "ssm-incidents", regexache.MustCompile(`replication-set\/+.`)),
 				),
 			},
 			{
@@ -138,7 +139,7 @@ func testReplicationSet_updateRegionsWithoutCMK(t *testing.T) {
 						"kms_key_arn": "DefaultKey",
 					}),
 
-					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "ssm-incidents", regexp.MustCompile(`replication-set\/+.`)),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "ssm-incidents", regexache.MustCompile(`replication-set\/+.`)),
 				),
 			},
 			{
@@ -156,8 +157,7 @@ func testReplicationSet_updateRegionsWithCMK(t *testing.T) {
 		t.Skip("skipping long-running test in short mode")
 	}
 
-	ctx := context.Background()
-
+	ctx := acctest.Context(t)
 	resourceName := "aws_ssmincidents_replication_set.test"
 
 	resource.Test(t, resource.TestCase{
@@ -178,7 +178,7 @@ func testReplicationSet_updateRegionsWithCMK(t *testing.T) {
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "region.*", map[string]string{
 						"name": acctest.Region(),
 					}),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "ssm-incidents", regexp.MustCompile(`replication-set\/+.`)),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "ssm-incidents", regexache.MustCompile(`replication-set\/+.`)),
 				),
 			},
 			{
@@ -198,7 +198,7 @@ func testReplicationSet_updateRegionsWithCMK(t *testing.T) {
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "region.*", map[string]string{
 						"name": acctest.AlternateRegion(),
 					}),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "ssm-incidents", regexp.MustCompile(`replication-set\/+.`)),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "ssm-incidents", regexache.MustCompile(`replication-set\/+.`)),
 				),
 			},
 			{
@@ -215,7 +215,7 @@ func testReplicationSet_updateRegionsWithCMK(t *testing.T) {
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "region.*", map[string]string{
 						"name": acctest.Region(),
 					}),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "ssm-incidents", regexp.MustCompile(`replication-set\/+.`)),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "ssm-incidents", regexache.MustCompile(`replication-set\/+.`)),
 				),
 			},
 			{
@@ -233,8 +233,7 @@ func testReplicationSet_updateTags(t *testing.T) {
 		t.Skip("skipping long-running test in short mode")
 	}
 
-	ctx := context.Background()
-
+	ctx := acctest.Context(t)
 	resourceName := "aws_ssmincidents_replication_set.test"
 
 	rKey1 := sdkacctest.RandString(26)
@@ -273,7 +272,7 @@ func testReplicationSet_updateTags(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "tags."+rKey1, rVal1Ini),
 					resource.TestCheckResourceAttr(resourceName, "tags_all.%", "2"),
 					resource.TestCheckResourceAttr(resourceName, "tags_all."+rProviderKey1, rProviderVal1Ini),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "ssm-incidents", regexp.MustCompile(`replication-set\/+.`)),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "ssm-incidents", regexache.MustCompile(`replication-set\/+.`)),
 				),
 			},
 			{
@@ -292,7 +291,7 @@ func testReplicationSet_updateTags(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "tags."+rKey1, rVal1Updated),
 					resource.TestCheckResourceAttr(resourceName, "tags_all.%", "2"),
 					resource.TestCheckResourceAttr(resourceName, "tags_all."+rProviderKey1, rProviderVal1Upd),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "ssm-incidents", regexp.MustCompile(`replication-set\/+.`)),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "ssm-incidents", regexache.MustCompile(`replication-set\/+.`)),
 				),
 			},
 			{
@@ -313,7 +312,7 @@ func testReplicationSet_updateTags(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "tags_all.%", "4"),
 					resource.TestCheckResourceAttr(resourceName, "tags_all."+rProviderKey2, rProviderVal2),
 					resource.TestCheckResourceAttr(resourceName, "tags_all."+rProviderKey3, rProviderVal3),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "ssm-incidents", regexp.MustCompile(`replication-set\/+.`)),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "ssm-incidents", regexache.MustCompile(`replication-set\/+.`)),
 				),
 			},
 			{
@@ -330,8 +329,7 @@ func testReplicationSet_updateEmptyTags(t *testing.T) {
 		t.Skip("skipping long-running test in short mode")
 	}
 
-	ctx := context.Background()
-
+	ctx := acctest.Context(t)
 	resourceName := "aws_ssmincidents_replication_set.test"
 
 	rKey1 := sdkacctest.RandString(26)
@@ -352,7 +350,7 @@ func testReplicationSet_updateEmptyTags(t *testing.T) {
 					testAccCheckReplicationSetExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags."+rKey1, ""),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "ssm-incidents", regexp.MustCompile(`replication-set\/+.`)),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "ssm-incidents", regexache.MustCompile(`replication-set\/+.`)),
 				),
 			},
 			{
@@ -367,7 +365,7 @@ func testReplicationSet_updateEmptyTags(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
 					resource.TestCheckResourceAttr(resourceName, "tags."+rKey1, ""),
 					resource.TestCheckResourceAttr(resourceName, "tags."+rKey2, ""),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "ssm-incidents", regexp.MustCompile(`replication-set\/+.`)),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "ssm-incidents", regexache.MustCompile(`replication-set\/+.`)),
 				),
 			},
 			{
@@ -381,7 +379,7 @@ func testReplicationSet_updateEmptyTags(t *testing.T) {
 					testAccCheckReplicationSetExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags."+rKey1, ""),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "ssm-incidents", regexp.MustCompile(`replication-set\/+.`)),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "ssm-incidents", regexache.MustCompile(`replication-set\/+.`)),
 				),
 			},
 		},
@@ -393,8 +391,7 @@ func testReplicationSet_disappears(t *testing.T) {
 		t.Skip("skipping long-running test in short mode")
 	}
 
-	ctx := context.Background()
-
+	ctx := acctest.Context(t)
 	resourceName := "aws_ssmincidents_replication_set.test"
 	region1 := acctest.Region()
 	region2 := acctest.AlternateRegion()
diff --git a/internal/service/ssmincidents/response_plan.go b/internal/service/ssmincidents/response_plan.go
index 302b03ad5f6..e388fefd01d 100644
--- a/internal/service/ssmincidents/response_plan.go
+++ b/internal/service/ssmincidents/response_plan.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssmincidents
 
 import (
diff --git a/internal/service/ssmincidents/response_plan_data_source.go b/internal/service/ssmincidents/response_plan_data_source.go
index 3fd656b1736..f23d01ada10 100644
--- a/internal/service/ssmincidents/response_plan_data_source.go
+++ b/internal/service/ssmincidents/response_plan_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssmincidents
 
 import (
diff --git a/internal/service/ssmincidents/response_plan_data_source_test.go b/internal/service/ssmincidents/response_plan_data_source_test.go
index 9e7a55f40ec..118391d4310 100644
--- a/internal/service/ssmincidents/response_plan_data_source_test.go
+++ b/internal/service/ssmincidents/response_plan_data_source_test.go
@@ -1,11 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssmincidents_test
 
 import (
-	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
@@ -13,8 +15,7 @@ import (
 )
 
 func testResponsePlanDataSource_basic(t *testing.T) {
-	ctx := context.Background()
-
+	ctx := acctest.Context(t)
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	rTitle := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	dataSourceName := "data.aws_ssmincidents_response_plan.test"
@@ -174,7 +175,7 @@ func testResponsePlanDataSource_basic(t *testing.T) {
 					resource.TestCheckResourceAttrPair(resourceName, "tags.a", dataSourceName, "tags.a"),
 					resource.TestCheckResourceAttrPair(resourceName, "tags.b", dataSourceName, "tags.b"),
 
-					acctest.MatchResourceAttrGlobalARN(dataSourceName, "arn", "ssm-incidents", regexp.MustCompile(`response-plan/+.`)),
+					acctest.MatchResourceAttrGlobalARN(dataSourceName, "arn", "ssm-incidents", regexache.MustCompile(`response-plan/+.`)),
 				),
 			},
 		},
diff --git a/internal/service/ssmincidents/response_plan_test.go b/internal/service/ssmincidents/response_plan_test.go
index 474ec38c5be..560f823cab8 100644
--- a/internal/service/ssmincidents/response_plan_test.go
+++ b/internal/service/ssmincidents/response_plan_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssmincidents_test
 
 import (
@@ -22,8 +25,7 @@ func testResponsePlan_basic(t *testing.T) {
 		t.Skip("skipping long-running test in short mode")
 	}
 
-	ctx := context.Background()
-
+	ctx := acctest.Context(t)
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	rTitle := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	rImpact := "3"
@@ -72,8 +74,7 @@ func testResponsePlan_updateRequiredFields(t *testing.T) {
 		t.Skip("skipping long-running test in short mode")
 	}
 
-	ctx := context.Background()
-
+	ctx := acctest.Context(t)
 	iniName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	updName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
@@ -153,8 +154,7 @@ func testResponsePlan_updateTags(t *testing.T) {
 		t.Skip("skipping long-running test in short mode")
 	}
 
-	ctx := context.Background()
-
+	ctx := acctest.Context(t)
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	rTitle := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
@@ -253,8 +253,7 @@ func testResponsePlan_updateEmptyTags(t *testing.T) {
 		t.Skip("skipping long-running test in short mode")
 	}
 
-	ctx := context.Background()
-
+	ctx := acctest.Context(t)
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	rTitle := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
@@ -324,8 +323,7 @@ func testResponsePlan_disappears(t *testing.T) {
 		t.Skip("skipping long-running test in short mode")
 	}
 
-	ctx := context.Background()
-
+	ctx := acctest.Context(t)
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	rTitle := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	impact := "3"
@@ -357,8 +355,7 @@ func testResponsePlan_incidentTemplateOptionalFields(t *testing.T) {
 		t.Skip("skipping long-running test in short mode")
 	}
 
-	ctx := context.Background()
-
+	ctx := acctest.Context(t)
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	rTitle := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
@@ -431,8 +428,7 @@ func testResponsePlan_displayName(t *testing.T) {
 		t.Skip("skipping long-running test in short mode")
 	}
 
-	ctx := context.Background()
-
+	ctx := acctest.Context(t)
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	oldDisplayName := rName + "-old-display-name"
 	newDisplayName := rName + "-new-display-name"
@@ -483,8 +479,7 @@ func testResponsePlan_chatChannel(t *testing.T) {
 		t.Skip("skipping long-running test in short mode")
 	}
 
-	ctx := context.Background()
-
+	ctx := acctest.Context(t)
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	chatChannelTopic1 := "aws_sns_topic.topic1"
 	chatChannelTopic2 := "aws_sns_topic.topic2"
@@ -565,8 +560,7 @@ func testResponsePlan_engagement(t *testing.T) {
 		t.Skip("skipping long-running test in short mode")
 	}
 
-	ctx := context.Background()
-
+	ctx := acctest.Context(t)
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	//lintignore:AWSAT003
 	//lintignore:AWSAT005
@@ -651,8 +645,7 @@ func testResponsePlan_action(t *testing.T) {
 		t.Skip("skipping long-running test in short mode")
 	}
 
-	ctx := context.Background()
-
+	ctx := acctest.Context(t)
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resourceName := "aws_ssmincidents_response_plan.test"
@@ -798,8 +791,7 @@ func testResponsePlan_action(t *testing.T) {
 //		t.Skip("skipping long-running test in short mode")
 //	}
 //
-//	ctx := context.Background()
-//
+//  ctx := acctest.Context(t)
 //	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 //
 //	resourceName := "aws_ssmincidents_response_plan.test"
diff --git a/internal/service/ssmincidents/service_package_gen.go b/internal/service/ssmincidents/service_package_gen.go
index bb3822446a3..59a3cede662 100644
--- a/internal/service/ssmincidents/service_package_gen.go
+++ b/internal/service/ssmincidents/service_package_gen.go
@@ -7,6 +7,7 @@ import (
 
 	aws_sdkv2 "github.com/aws/aws-sdk-go-v2/aws"
 	ssmincidents_sdkv2 "github.com/aws/aws-sdk-go-v2/service/ssmincidents"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -65,9 +66,11 @@ func (p *servicePackage) NewClient(ctx context.Context, config map[string]any) (
 
 	return ssmincidents_sdkv2.NewFromConfig(cfg, func(o *ssmincidents_sdkv2.Options) {
 		if endpoint := config["endpoint"].(string); endpoint != "" {
-			o.EndpointResolver = ssmincidents_sdkv2.EndpointResolverFromURL(endpoint)
+			o.BaseEndpoint = aws_sdkv2.String(endpoint)
 		}
 	}), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/ssmincidents/ssmincidents_test.go b/internal/service/ssmincidents/ssmincidents_test.go
index 6458dddadd1..848715775f5 100644
--- a/internal/service/ssmincidents/ssmincidents_test.go
+++ b/internal/service/ssmincidents/ssmincidents_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssmincidents_test
 
 import (
diff --git a/internal/service/ssmincidents/tags_gen.go b/internal/service/ssmincidents/tags_gen.go
index 05908c62a7e..452f4073d56 100644
--- a/internal/service/ssmincidents/tags_gen.go
+++ b/internal/service/ssmincidents/tags_gen.go
@@ -7,7 +7,9 @@ import (
 
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/ssmincidents"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -53,7 +55,7 @@ func Tags(tags tftags.KeyValueTags) map[string]string {
 	return tags.Map()
 }
 
-// KeyValueTags creates KeyValueTags from ssmincidents service tags.
+// KeyValueTags creates tftags.KeyValueTags from ssmincidents service tags.
 func KeyValueTags(ctx context.Context, tags map[string]string) tftags.KeyValueTags {
 	return tftags.New(ctx, tags)
 }
@@ -84,6 +86,8 @@ func updateTags(ctx context.Context, conn *ssmincidents.Client, identifier strin
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.SSMIncidents)
 	if len(removedTags) > 0 {
diff --git a/internal/service/ssoadmin/account_assignment.go b/internal/service/ssoadmin/account_assignment.go
index 804f39621e3..5360669f344 100644
--- a/internal/service/ssoadmin/account_assignment.go
+++ b/internal/service/ssoadmin/account_assignment.go
@@ -1,20 +1,28 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssoadmin
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"log"
-	"regexp"
 	"strings"
+	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ssoadmin"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
+	tfslices "github.com/hashicorp/terraform-provider-aws/internal/slices"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
 )
 
@@ -29,6 +37,11 @@ func ResourceAccountAssignment() *schema.Resource {
 			StateContext: schema.ImportStatePassthroughContext,
 		},
 
+		Timeouts: &schema.ResourceTimeout{
+			Create: schema.DefaultTimeout(5 * time.Minute),
+			Delete: schema.DefaultTimeout(5 * time.Minute),
+		},
+
 		Schema: map[string]*schema.Schema{
 			"instance_arn": {
 				Type:         schema.TypeString,
@@ -36,38 +49,33 @@ func ResourceAccountAssignment() *schema.Resource {
 				ForceNew:     true,
 				ValidateFunc: verify.ValidARN,
 			},
-
 			"permission_set_arn": {
 				Type:         schema.TypeString,
 				Required:     true,
 				ForceNew:     true,
 				ValidateFunc: verify.ValidARN,
 			},
-
 			"principal_id": {
 				Type:     schema.TypeString,
 				Required: true,
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 47),
-					validation.StringMatch(regexp.MustCompile(`^([0-9a-f]{10}-|)[A-Fa-f0-9]{8}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{12}$`), "must match ([0-9a-f]{10}-|)[A-Fa-f0-9]{8}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{12}"),
+					validation.StringMatch(regexache.MustCompile(`^([0-9a-f]{10}-|)[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}$`), "must match ([0-9a-f]{10}-|)[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}"),
 				),
 			},
-
 			"principal_type": {
 				Type:         schema.TypeString,
 				Required:     true,
 				ForceNew:     true,
 				ValidateFunc: validation.StringInSlice(ssoadmin.PrincipalType_Values(), false),
 			},
-
 			"target_id": {
 				Type:         schema.TypeString,
 				Required:     true,
 				ForceNew:     true,
 				ValidateFunc: verify.ValidAccountID,
 			},
-
 			"target_type": {
 				Type:         schema.TypeString,
 				Optional:     true,
@@ -82,27 +90,25 @@ func resourceAccountAssignmentCreate(ctx context.Context, d *schema.ResourceData
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).SSOAdminConn(ctx)
 
-	instanceArn := d.Get("instance_arn").(string)
-	permissionSetArn := d.Get("permission_set_arn").(string)
+	instanceARN := d.Get("instance_arn").(string)
+	permissionSetARN := d.Get("permission_set_arn").(string)
 	principalID := d.Get("principal_id").(string)
 	principalType := d.Get("principal_type").(string)
 	targetID := d.Get("target_id").(string)
 	targetType := d.Get("target_type").(string)
 
-	// We need to check if the assignment exists before creating it
-	// since the AWS SSO API doesn't prevent us from creating duplicates
-	accountAssignment, err := FindAccountAssignment(ctx, conn, principalID, principalType, targetID, permissionSetArn, instanceArn)
-	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "listing SSO Account Assignments for AccountId (%s) PermissionSet (%s): %s", targetID, permissionSetArn, err)
-	}
+	// We need to check if the assignment exists before creating it since the AWS SSO API doesn't prevent us from creating duplicates.
+	_, err := FindAccountAssignment(ctx, conn, principalID, principalType, targetID, permissionSetARN, instanceARN)
 
-	if accountAssignment != nil {
+	if err == nil {
 		return sdkdiag.AppendErrorf(diags, "creating SSO Account Assignment for %s (%s): already exists", principalType, principalID)
+	} else if !tfresource.NotFound(err) {
+		return sdkdiag.AppendErrorf(diags, "listing SSO Account Assignments for Account ID (%s) Permission Set (%s): %s", targetID, permissionSetARN, err)
 	}
 
 	input := &ssoadmin.CreateAccountAssignmentInput{
-		InstanceArn:      aws.String(instanceArn),
-		PermissionSetArn: aws.String(permissionSetArn),
+		InstanceArn:      aws.String(instanceARN),
+		PermissionSetArn: aws.String(permissionSetARN),
 		PrincipalId:      aws.String(principalID),
 		PrincipalType:    aws.String(principalType),
 		TargetId:         aws.String(targetID),
@@ -110,22 +116,16 @@ func resourceAccountAssignmentCreate(ctx context.Context, d *schema.ResourceData
 	}
 
 	output, err := conn.CreateAccountAssignmentWithContext(ctx, input)
+
 	if err != nil {
 		return sdkdiag.AppendErrorf(diags, "creating SSO Account Assignment for %s (%s): %s", principalType, principalID, err)
 	}
 
-	if output == nil || output.AccountAssignmentCreationStatus == nil {
-		return sdkdiag.AppendErrorf(diags, "creating SSO Account Assignment for %s (%s): empty output", principalType, principalID)
-	}
-
-	status := output.AccountAssignmentCreationStatus
-
-	_, err = waitAccountAssignmentCreated(ctx, conn, instanceArn, aws.StringValue(status.RequestId))
-	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "waiting for SSO Account Assignment for %s (%s) to be created: %s", principalType, principalID, err)
+	if _, err := waitAccountAssignmentCreated(ctx, conn, instanceARN, aws.StringValue(output.AccountAssignmentCreationStatus.RequestId), d.Timeout(schema.TimeoutCreate)); err != nil {
+		return sdkdiag.AppendErrorf(diags, "waiting for SSO Account Assignment for %s (%s) create: %s", principalType, principalID, err)
 	}
 
-	d.SetId(fmt.Sprintf("%s,%s,%s,%s,%s,%s", principalID, principalType, targetID, targetType, permissionSetArn, instanceArn))
+	d.SetId(fmt.Sprintf("%s,%s,%s,%s,%s,%s", principalID, principalType, targetID, targetType, permissionSetARN, instanceARN))
 
 	return append(diags, resourceAccountAssignmentRead(ctx, d, meta)...)
 }
@@ -136,19 +136,19 @@ func resourceAccountAssignmentRead(ctx context.Context, d *schema.ResourceData,
 
 	idParts, err := ParseAccountAssignmentID(d.Id())
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "parsing SSO Account Assignment ID: %s", err)
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
 	principalID := idParts[0]
 	principalType := idParts[1]
 	targetID := idParts[2]
 	targetType := idParts[3]
-	permissionSetArn := idParts[4]
-	instanceArn := idParts[5]
+	permissionSetARN := idParts[4]
+	instanceARN := idParts[5]
 
-	accountAssignment, err := FindAccountAssignment(ctx, conn, principalID, principalType, targetID, permissionSetArn, instanceArn)
+	accountAssignment, err := FindAccountAssignment(ctx, conn, principalID, principalType, targetID, permissionSetARN, instanceARN)
 
-	if !d.IsNewResource() && tfawserr.ErrCodeEquals(err, ssoadmin.ErrCodeResourceNotFoundException) {
+	if !d.IsNewResource() && tfresource.NotFound(err) {
 		log.Printf("[WARN] SSO Account Assignment for Principal (%s) not found, removing from state", principalID)
 		d.SetId("")
 		return diags
@@ -158,17 +158,7 @@ func resourceAccountAssignmentRead(ctx context.Context, d *schema.ResourceData,
 		return sdkdiag.AppendErrorf(diags, "reading SSO Account Assignment for Principal (%s): %s", principalID, err)
 	}
 
-	if accountAssignment == nil {
-		if d.IsNewResource() {
-			return sdkdiag.AppendErrorf(diags, "reading SSO Account Assignment for Principal (%s): not found", principalID)
-		}
-
-		log.Printf("[WARN] SSO Account Assignment for Principal (%s) not found, removing from state", principalID)
-		d.SetId("")
-		return diags
-	}
-
-	d.Set("instance_arn", instanceArn)
+	d.Set("instance_arn", instanceARN)
 	d.Set("permission_set_arn", accountAssignment.PermissionSetArn)
 	d.Set("principal_id", accountAssignment.PrincipalId)
 	d.Set("principal_type", accountAssignment.PrincipalType)
@@ -184,42 +174,37 @@ func resourceAccountAssignmentDelete(ctx context.Context, d *schema.ResourceData
 
 	idParts, err := ParseAccountAssignmentID(d.Id())
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "parsing SSO Account Assignment ID: %s", err)
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
 	principalID := idParts[0]
 	principalType := idParts[1]
 	targetID := idParts[2]
 	targetType := idParts[3]
-	permissionSetArn := idParts[4]
-	instanceArn := idParts[5]
+	permissionSetARN := idParts[4]
+	instanceARN := idParts[5]
 
 	input := &ssoadmin.DeleteAccountAssignmentInput{
+		InstanceArn:      aws.String(instanceARN),
+		PermissionSetArn: aws.String(permissionSetARN),
 		PrincipalId:      aws.String(principalID),
-		InstanceArn:      aws.String(instanceArn),
-		PermissionSetArn: aws.String(permissionSetArn),
+		PrincipalType:    aws.String(principalType),
 		TargetType:       aws.String(targetType),
 		TargetId:         aws.String(targetID),
-		PrincipalType:    aws.String(principalType),
 	}
 
 	output, err := conn.DeleteAccountAssignmentWithContext(ctx, input)
-	if err != nil {
-		if tfawserr.ErrCodeEquals(err, ssoadmin.ErrCodeResourceNotFoundException) {
-			return diags
-		}
-		return sdkdiag.AppendErrorf(diags, "deleting SSO Account Assignment for Principal (%s): %s", principalID, err)
-	}
 
-	if output == nil || output.AccountAssignmentDeletionStatus == nil {
-		return sdkdiag.AppendErrorf(diags, "deleting SSO Account Assignment for Principal (%s): empty output", principalID)
+	if tfawserr.ErrCodeEquals(err, ssoadmin.ErrCodeResourceNotFoundException) {
+		return diags
 	}
 
-	status := output.AccountAssignmentDeletionStatus
-
-	_, err = waitAccountAssignmentDeleted(ctx, conn, instanceArn, aws.StringValue(status.RequestId))
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "waiting for SSO Account Assignment for Principal (%s) to be deleted: %s", principalID, err)
+		return sdkdiag.AppendErrorf(diags, "deleting SSO Account Assignment for Principal (%s): %s", principalID, err)
+	}
+
+	if _, err := waitAccountAssignmentDeleted(ctx, conn, instanceARN, aws.StringValue(output.AccountAssignmentDeletionStatus.RequestId), d.Timeout(schema.TimeoutDelete)); err != nil {
+		return sdkdiag.AppendErrorf(diags, "waiting for SSO Account Assignment for Principal (%s) delete: %s", principalID, err)
 	}
 
 	return diags
@@ -233,3 +218,183 @@ func ParseAccountAssignmentID(id string) ([]string, error) {
 	}
 	return idParts, nil
 }
+
+func FindAccountAssignment(ctx context.Context, conn *ssoadmin.SSOAdmin, principalID, principalType, accountID, permissionSetARN, instanceARN string) (*ssoadmin.AccountAssignment, error) {
+	input := &ssoadmin.ListAccountAssignmentsInput{
+		AccountId:        aws.String(accountID),
+		InstanceArn:      aws.String(instanceARN),
+		PermissionSetArn: aws.String(permissionSetARN),
+	}
+	filter := func(a *ssoadmin.AccountAssignment) bool {
+		return aws.StringValue(a.PrincipalId) == principalID && aws.StringValue(a.PrincipalType) == principalType
+	}
+
+	return findAccountAssignment(ctx, conn, input, filter)
+}
+
+func findAccountAssignment(ctx context.Context, conn *ssoadmin.SSOAdmin, input *ssoadmin.ListAccountAssignmentsInput, filter tfslices.Predicate[*ssoadmin.AccountAssignment]) (*ssoadmin.AccountAssignment, error) {
+	output, err := findAccountAssignments(ctx, conn, input, filter)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return tfresource.AssertSinglePtrResult(output)
+}
+
+func findAccountAssignments(ctx context.Context, conn *ssoadmin.SSOAdmin, input *ssoadmin.ListAccountAssignmentsInput, filter tfslices.Predicate[*ssoadmin.AccountAssignment]) ([]*ssoadmin.AccountAssignment, error) {
+	var output []*ssoadmin.AccountAssignment
+
+	err := conn.ListAccountAssignmentsPagesWithContext(ctx, input, func(page *ssoadmin.ListAccountAssignmentsOutput, lastPage bool) bool {
+		if page == nil {
+			return !lastPage
+		}
+
+		for _, v := range page.AccountAssignments {
+			if v != nil && filter(v) {
+				output = append(output, v)
+			}
+		}
+
+		return !lastPage
+	})
+
+	if tfawserr.ErrCodeEquals(err, ssoadmin.ErrCodeResourceNotFoundException) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	return output, nil
+}
+
+func findAccountAssignmentCreationStatus(ctx context.Context, conn *ssoadmin.SSOAdmin, instanceARN, requestID string) (*ssoadmin.AccountAssignmentOperationStatus, error) {
+	input := &ssoadmin.DescribeAccountAssignmentCreationStatusInput{
+		AccountAssignmentCreationRequestId: aws.String(requestID),
+		InstanceArn:                        aws.String(instanceARN),
+	}
+
+	output, err := conn.DescribeAccountAssignmentCreationStatusWithContext(ctx, input)
+
+	if tfawserr.ErrCodeEquals(err, ssoadmin.ErrCodeResourceNotFoundException) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	if output == nil || output.AccountAssignmentCreationStatus == nil {
+		return nil, tfresource.NewEmptyResultError(input)
+	}
+
+	return output.AccountAssignmentCreationStatus, nil
+}
+
+func statusAccountAssignmentCreation(ctx context.Context, conn *ssoadmin.SSOAdmin, instanceARN, requestID string) retry.StateRefreshFunc {
+	return func() (interface{}, string, error) {
+		output, err := findAccountAssignmentCreationStatus(ctx, conn, instanceARN, requestID)
+
+		if tfresource.NotFound(err) {
+			return nil, "", nil
+		}
+
+		if err != nil {
+			return nil, "", err
+		}
+
+		return output, aws.StringValue(output.Status), nil
+	}
+}
+
+func findAccountAssignmentDeletionStatus(ctx context.Context, conn *ssoadmin.SSOAdmin, instanceARN, requestID string) (*ssoadmin.AccountAssignmentOperationStatus, error) {
+	input := &ssoadmin.DescribeAccountAssignmentDeletionStatusInput{
+		AccountAssignmentDeletionRequestId: aws.String(requestID),
+		InstanceArn:                        aws.String(instanceARN),
+	}
+
+	output, err := conn.DescribeAccountAssignmentDeletionStatusWithContext(ctx, input)
+
+	if tfawserr.ErrCodeEquals(err, ssoadmin.ErrCodeResourceNotFoundException) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	if output == nil || output.AccountAssignmentDeletionStatus == nil {
+		return nil, tfresource.NewEmptyResultError(input)
+	}
+
+	return output.AccountAssignmentDeletionStatus, nil
+}
+
+func statusAccountAssignmentDeletion(ctx context.Context, conn *ssoadmin.SSOAdmin, instanceARN, requestID string) retry.StateRefreshFunc {
+	return func() (interface{}, string, error) {
+		output, err := findAccountAssignmentDeletionStatus(ctx, conn, instanceARN, requestID)
+
+		if tfresource.NotFound(err) {
+			return nil, "", nil
+		}
+
+		if err != nil {
+			return nil, "", err
+		}
+
+		return output, aws.StringValue(output.Status), nil
+	}
+}
+
+func waitAccountAssignmentCreated(ctx context.Context, conn *ssoadmin.SSOAdmin, instanceARN, requestID string, timeout time.Duration) (*ssoadmin.AccountAssignmentOperationStatus, error) {
+	stateConf := &retry.StateChangeConf{
+		Pending:    []string{ssoadmin.StatusValuesInProgress},
+		Target:     []string{ssoadmin.StatusValuesSucceeded},
+		Refresh:    statusAccountAssignmentCreation(ctx, conn, instanceARN, requestID),
+		Timeout:    timeout,
+		Delay:      10 * time.Second,
+		MinTimeout: 5 * time.Second,
+	}
+
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+
+	if output, ok := outputRaw.(*ssoadmin.AccountAssignmentOperationStatus); ok {
+		tfresource.SetLastError(err, errors.New(aws.StringValue(output.FailureReason)))
+
+		return output, err
+	}
+
+	return nil, err
+}
+
+func waitAccountAssignmentDeleted(ctx context.Context, conn *ssoadmin.SSOAdmin, instanceArn, requestID string, timeout time.Duration) (*ssoadmin.AccountAssignmentOperationStatus, error) {
+	stateConf := &retry.StateChangeConf{
+		Pending:    []string{ssoadmin.StatusValuesInProgress},
+		Target:     []string{ssoadmin.StatusValuesSucceeded},
+		Refresh:    statusAccountAssignmentDeletion(ctx, conn, instanceArn, requestID),
+		Timeout:    timeout,
+		Delay:      10 * time.Second,
+		MinTimeout: 5 * time.Second,
+	}
+
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+
+	if output, ok := outputRaw.(*ssoadmin.AccountAssignmentOperationStatus); ok {
+		tfresource.SetLastError(err, errors.New(aws.StringValue(output.FailureReason)))
+
+		return output, err
+	}
+
+	return nil, err
+}
diff --git a/internal/service/ssoadmin/account_assignment_test.go b/internal/service/ssoadmin/account_assignment_test.go
index c1b4702fbd0..94a6fbad621 100644
--- a/internal/service/ssoadmin/account_assignment_test.go
+++ b/internal/service/ssoadmin/account_assignment_test.go
@@ -1,20 +1,23 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssoadmin_test
 
 import (
 	"context"
 	"fmt"
 	"os"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/ssoadmin"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	tfssoadmin "github.com/hashicorp/terraform-provider-aws/internal/service/ssoadmin"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
 func TestAccSSOAdminAccountAssignment_Basic_group(t *testing.T) {
@@ -39,7 +42,7 @@ func TestAccSSOAdminAccountAssignment_Basic_group(t *testing.T) {
 					testAccCheckAccountAssignmentExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "target_type", "AWS_ACCOUNT"),
 					resource.TestCheckResourceAttr(resourceName, "principal_type", "GROUP"),
-					resource.TestMatchResourceAttr(resourceName, "principal_id", regexp.MustCompile("^([0-9a-f]{10}-|)[A-Fa-f0-9]{8}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{12}")),
+					resource.TestMatchResourceAttr(resourceName, "principal_id", regexache.MustCompile("^([0-9a-f]{10}-|)[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}")),
 				),
 			},
 			{
@@ -73,7 +76,7 @@ func TestAccSSOAdminAccountAssignment_Basic_user(t *testing.T) {
 					testAccCheckAccountAssignmentExists(ctx, resourceName),
 					resource.TestCheckResourceAttr(resourceName, "target_type", "AWS_ACCOUNT"),
 					resource.TestCheckResourceAttr(resourceName, "principal_type", "USER"),
-					resource.TestMatchResourceAttr(resourceName, "principal_id", regexp.MustCompile("^([0-9a-f]{10}-|)[A-Fa-f0-9]{8}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{12}")),
+					resource.TestMatchResourceAttr(resourceName, "principal_id", regexache.MustCompile("^([0-9a-f]{10}-|)[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}")),
 				),
 			},
 			{
@@ -85,6 +88,30 @@ func TestAccSSOAdminAccountAssignment_Basic_user(t *testing.T) {
 	})
 }
 
+func TestAccSSOAdminAccountAssignment_MissingPolicy(t *testing.T) {
+	ctx := acctest.Context(t)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	userName := os.Getenv("AWS_IDENTITY_STORE_USER_NAME")
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			testAccPreCheckInstances(ctx, t)
+			testAccPreCheckIdentityStoreUserName(t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, ssoadmin.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckAccountAssignmentDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				// We assign a policy called rName on the assumption it doesn't exist due to being randomly generated, hoping to generate an error
+				Config:      testAccAccountAssignmentConfig_withCustomerPolicy(userName, "/", rName, rName),
+				ExpectError: regexache.MustCompile(fmt.Sprintf(`Received a 404 status error: Not supported policy.*%s`, rName)),
+			},
+		},
+	})
+}
+
 func TestAccSSOAdminAccountAssignment_disappears(t *testing.T) {
 	ctx := acctest.Context(t)
 	resourceName := "aws_ssoadmin_account_assignment.test"
@@ -123,97 +150,82 @@ func testAccCheckAccountAssignmentDestroy(ctx context.Context) resource.TestChec
 			}
 
 			idParts, err := tfssoadmin.ParseAccountAssignmentID(rs.Primary.ID)
-
 			if err != nil {
-				return fmt.Errorf("error parsing SSO Account Assignment ID (%s): %w", rs.Primary.ID, err)
+				return err
 			}
 
 			principalID := idParts[0]
 			principalType := idParts[1]
 			targetID := idParts[2]
-			permissionSetArn := idParts[4]
-			instanceArn := idParts[5]
+			permissionSetARN := idParts[4]
+			instanceARN := idParts[5]
 
-			accountAssignment, err := tfssoadmin.FindAccountAssignment(ctx, conn, principalID, principalType, targetID, permissionSetArn, instanceArn)
+			_, err = tfssoadmin.FindAccountAssignment(ctx, conn, principalID, principalType, targetID, permissionSetARN, instanceARN)
 
-			if tfawserr.ErrCodeEquals(err, ssoadmin.ErrCodeResourceNotFoundException) {
+			if tfresource.NotFound(err) {
 				continue
 			}
 
 			if err != nil {
-				return fmt.Errorf("error reading SSO Account Assignment for Principal (%s): %w", principalID, err)
+				return err
 			}
 
-			if accountAssignment != nil {
-				return fmt.Errorf("SSO Account Assignment for Principal (%s) still exists", principalID)
-			}
+			return fmt.Errorf("SSO Account Assignment for Principal (%s) still exists", principalID)
 		}
 
 		return nil
 	}
 }
 
-func testAccCheckAccountAssignmentExists(ctx context.Context, resourceName string) resource.TestCheckFunc {
+func testAccCheckAccountAssignmentExists(ctx context.Context, n string) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		rs, ok := s.RootModule().Resources[resourceName]
+		rs, ok := s.RootModule().Resources[n]
 		if !ok {
-			return fmt.Errorf("Not found: %s", resourceName)
-		}
-
-		if rs.Primary.ID == "" {
-			return fmt.Errorf("Resource (%s) ID not set", resourceName)
+			return fmt.Errorf("Not found: %s", n)
 		}
 
 		conn := acctest.Provider.Meta().(*conns.AWSClient).SSOAdminConn(ctx)
 
 		idParts, err := tfssoadmin.ParseAccountAssignmentID(rs.Primary.ID)
-
 		if err != nil {
-			return fmt.Errorf("error parsing SSO Account Assignment ID (%s): %w", rs.Primary.ID, err)
+			return err
 		}
 
 		principalID := idParts[0]
 		principalType := idParts[1]
 		targetID := idParts[2]
-		permissionSetArn := idParts[4]
-		instanceArn := idParts[5]
-
-		accountAssignment, err := tfssoadmin.FindAccountAssignment(ctx, conn, principalID, principalType, targetID, permissionSetArn, instanceArn)
-
-		if err != nil {
-			return err
-		}
+		permissionSetARN := idParts[4]
+		instanceARN := idParts[5]
 
-		if accountAssignment == nil {
-			return fmt.Errorf("Account Assignment for Principal (%s) not found", principalID)
-		}
+		_, err = tfssoadmin.FindAccountAssignment(ctx, conn, principalID, principalType, targetID, permissionSetARN, instanceARN)
 
-		return nil
+		return err
 	}
 }
 
-func testAccAccountAssignmentBaseConfig(rName string) string {
+func testAccAccountAssignmentConfig_base(rName string) string {
 	return fmt.Sprintf(`
 data "aws_ssoadmin_instances" "test" {}
 
 data "aws_caller_identity" "current" {}
 
 resource "aws_ssoadmin_permission_set" "test" {
-  name         = %q
+  name         = %[1]q
   instance_arn = tolist(data.aws_ssoadmin_instances.test.arns)[0]
 }
 `, rName)
 }
 
 func testAccAccountAssignmentConfig_basicGroup(groupName, rName string) string {
-	return acctest.ConfigCompose(
-		testAccAccountAssignmentBaseConfig(rName),
-		fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccAccountAssignmentConfig_base(rName), fmt.Sprintf(`
 data "aws_identitystore_group" "test" {
   identity_store_id = tolist(data.aws_ssoadmin_instances.test.identity_store_ids)[0]
-  filter {
-    attribute_path  = "DisplayName"
-    attribute_value = %q
+
+  alternate_identifier {
+    unique_attribute {
+      attribute_path  = "DisplayName"
+      attribute_value = %[1]q
+    }
   }
 }
 
@@ -229,14 +241,15 @@ resource "aws_ssoadmin_account_assignment" "test" {
 }
 
 func testAccAccountAssignmentConfig_basicUser(userName, rName string) string {
-	return acctest.ConfigCompose(
-		testAccAccountAssignmentBaseConfig(rName),
-		fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccAccountAssignmentConfig_base(rName), fmt.Sprintf(`
 data "aws_identitystore_user" "test" {
   identity_store_id = tolist(data.aws_ssoadmin_instances.test.identity_store_ids)[0]
-  filter {
-    attribute_path  = "UserName"
-    attribute_value = %q
+
+  alternate_identifier {
+    unique_attribute {
+      attribute_path  = "UserName"
+      attribute_value = %[1]q
+    }
   }
 }
 
@@ -264,3 +277,19 @@ func testAccPreCheckIdentityStoreUserName(t *testing.T) {
 			"This is required until ListUsers API returns results without filtering by name.")
 	}
 }
+
+func testAccAccountAssignmentConfig_withCustomerPolicy(userName, policyPath, policyName, rName string) string {
+	return acctest.ConfigCompose(
+		testAccAccountAssignmentConfig_basicUser(userName, rName),
+		fmt.Sprintf(`
+resource "aws_ssoadmin_customer_managed_policy_attachment" "test" {
+  instance_arn       = aws_ssoadmin_permission_set.test.instance_arn
+  permission_set_arn = aws_ssoadmin_permission_set.test.arn
+
+  customer_managed_policy_reference {
+    name = %[1]q
+    path = %[2]q
+  }
+}
+`, policyName, policyPath))
+}
diff --git a/internal/service/ssoadmin/customer_managed_policy_attachment.go b/internal/service/ssoadmin/customer_managed_policy_attachment.go
index 46d4ac76663..ce78d027385 100644
--- a/internal/service/ssoadmin/customer_managed_policy_attachment.go
+++ b/internal/service/ssoadmin/customer_managed_policy_attachment.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssoadmin
 
 import (
@@ -11,18 +14,16 @@ import (
 	"github.com/aws/aws-sdk-go/service/ssoadmin"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
+	tfslices "github.com/hashicorp/terraform-provider-aws/internal/slices"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
 )
 
-const (
-	customerPolicyAttachmentTimeout = 5 * time.Minute
-)
-
 // @SDKResource("aws_ssoadmin_customer_managed_policy_attachment")
 func ResourceCustomerManagedPolicyAttachment() *schema.Resource {
 	return &schema.Resource{
@@ -34,6 +35,11 @@ func ResourceCustomerManagedPolicyAttachment() *schema.Resource {
 			StateContext: schema.ImportStatePassthroughContext,
 		},
 
+		Timeouts: &schema.ResourceTimeout{
+			Create: schema.DefaultTimeout(10 * time.Minute),
+			Delete: schema.DefaultTimeout(10 * time.Minute),
+		},
+
 		Schema: map[string]*schema.Schema{
 			"customer_managed_policy_reference": {
 				Type:     schema.TypeList,
@@ -90,10 +96,7 @@ func resourceCustomerManagedPolicyAttachmentCreate(ctx context.Context, d *schem
 		PermissionSetArn:               aws.String(permissionSetARN),
 	}
 
-	log.Printf("[INFO] Attaching customer managed policy reference to permission set: %s", input)
-	_, err := tfresource.RetryWhenAWSErrCodeEquals(ctx, customerPolicyAttachmentTimeout, func() (interface{}, error) {
-		return conn.AttachCustomerManagedPolicyReferenceToPermissionSetWithContext(ctx, input)
-	}, ssoadmin.ErrCodeConflictException, ssoadmin.ErrCodeThrottlingException)
+	_, err := conn.AttachCustomerManagedPolicyReferenceToPermissionSetWithContext(ctx, input)
 
 	if err != nil {
 		return sdkdiag.AppendErrorf(diags, "creating SSO Customer Managed Policy Attachment (%s): %s", id, err)
@@ -102,8 +105,8 @@ func resourceCustomerManagedPolicyAttachmentCreate(ctx context.Context, d *schem
 	d.SetId(id)
 
 	// After the policy has been attached to the permission set, provision in all accounts that use this permission set.
-	if err := provisionPermissionSet(ctx, conn, permissionSetARN, instanceARN); err != nil {
-		return sdkdiag.AppendErrorf(diags, "creating SSO Customer Managed Policy Attachment (%s): %s", d.Id(), err)
+	if err := provisionPermissionSet(ctx, conn, permissionSetARN, instanceARN, d.Timeout(schema.TimeoutCreate)); err != nil {
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
 	return append(diags, resourceCustomerManagedPolicyAttachmentRead(ctx, d, meta)...)
@@ -114,9 +117,8 @@ func resourceCustomerManagedPolicyAttachmentRead(ctx context.Context, d *schema.
 	conn := meta.(*conns.AWSClient).SSOAdminConn(ctx)
 
 	policyName, policyPath, permissionSetARN, instanceARN, err := CustomerManagedPolicyAttachmentParseResourceID(d.Id())
-
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "reading SSO Customer Managed Policy Attachment (%s): %s", d.Id(), err)
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
 	policy, err := FindCustomerManagedPolicy(ctx, conn, policyName, policyPath, permissionSetARN, instanceARN)
@@ -145,9 +147,8 @@ func resourceCustomerManagedPolicyAttachmentDelete(ctx context.Context, d *schem
 	conn := meta.(*conns.AWSClient).SSOAdminConn(ctx)
 
 	policyName, policyPath, permissionSetARN, instanceARN, err := CustomerManagedPolicyAttachmentParseResourceID(d.Id())
-
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "deleting SSO Customer Managed Policy Attachment (%s): %s", d.Id(), err)
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
 	input := &ssoadmin.DetachCustomerManagedPolicyReferenceFromPermissionSetInput{
@@ -159,10 +160,8 @@ func resourceCustomerManagedPolicyAttachmentDelete(ctx context.Context, d *schem
 		PermissionSetArn: aws.String(permissionSetARN),
 	}
 
-	log.Printf("[INFO] Detaching customer managed policy reference from permission set: %s", input)
-	_, err = tfresource.RetryWhenAWSErrCodeEquals(ctx, customerPolicyAttachmentTimeout, func() (interface{}, error) {
-		return conn.DetachCustomerManagedPolicyReferenceFromPermissionSetWithContext(ctx, input)
-	}, ssoadmin.ErrCodeConflictException, ssoadmin.ErrCodeThrottlingException)
+	log.Printf("[INFO] Deleting SSO Customer Managed Policy Attachment: %s", d.Id())
+	_, err = conn.DetachCustomerManagedPolicyReferenceFromPermissionSetWithContext(ctx, input)
 
 	if tfawserr.ErrCodeEquals(err, ssoadmin.ErrCodeResourceNotFoundException) {
 		return diags
@@ -173,8 +172,8 @@ func resourceCustomerManagedPolicyAttachmentDelete(ctx context.Context, d *schem
 	}
 
 	// After the policy has been detached from the permission set, provision in all accounts that use this permission set.
-	if err := provisionPermissionSet(ctx, conn, permissionSetARN, instanceARN); err != nil {
-		return sdkdiag.AppendErrorf(diags, "deleting SSO Customer Managed Policy Attachment (%s): %s", d.Id(), err)
+	if err := provisionPermissionSet(ctx, conn, permissionSetARN, instanceARN, d.Timeout(schema.TimeoutDelete)); err != nil {
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
 	return diags
@@ -199,6 +198,59 @@ func CustomerManagedPolicyAttachmentParseResourceID(id string) (string, string,
 	return "", "", "", "", fmt.Errorf("unexpected format for ID (%[1]s), expected CUSTOMER_MANAGED_POLICY_NAME%[2]sCUSTOMER_MANAGED_POLICY_PATH%[2]sPERMISSION_SET_ARN%[2]sINSTANCE_ARN", id, customerManagedPolicyAttachmentIDSeparator)
 }
 
+func FindCustomerManagedPolicy(ctx context.Context, conn *ssoadmin.SSOAdmin, policyName, policyPath, permissionSetARN, instanceARN string) (*ssoadmin.CustomerManagedPolicyReference, error) {
+	input := &ssoadmin.ListCustomerManagedPolicyReferencesInPermissionSetInput{
+		InstanceArn:      aws.String(instanceARN),
+		PermissionSetArn: aws.String(permissionSetARN),
+	}
+	filter := func(c *ssoadmin.CustomerManagedPolicyReference) bool {
+		return aws.StringValue(c.Name) == policyName && aws.StringValue(c.Path) == policyPath
+	}
+
+	return findCustomerManagedPolicyReference(ctx, conn, input, filter)
+}
+
+func findCustomerManagedPolicyReference(ctx context.Context, conn *ssoadmin.SSOAdmin, input *ssoadmin.ListCustomerManagedPolicyReferencesInPermissionSetInput, filter tfslices.Predicate[*ssoadmin.CustomerManagedPolicyReference]) (*ssoadmin.CustomerManagedPolicyReference, error) {
+	output, err := findCustomerManagedPolicyReferences(ctx, conn, input, filter)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return tfresource.AssertSinglePtrResult(output)
+}
+
+func findCustomerManagedPolicyReferences(ctx context.Context, conn *ssoadmin.SSOAdmin, input *ssoadmin.ListCustomerManagedPolicyReferencesInPermissionSetInput, filter tfslices.Predicate[*ssoadmin.CustomerManagedPolicyReference]) ([]*ssoadmin.CustomerManagedPolicyReference, error) {
+	var output []*ssoadmin.CustomerManagedPolicyReference
+
+	err := conn.ListCustomerManagedPolicyReferencesInPermissionSetPagesWithContext(ctx, input, func(page *ssoadmin.ListCustomerManagedPolicyReferencesInPermissionSetOutput, lastPage bool) bool {
+		if page == nil {
+			return !lastPage
+		}
+
+		for _, v := range page.CustomerManagedPolicyReferences {
+			if v != nil && filter(v) {
+				output = append(output, v)
+			}
+		}
+
+		return !lastPage
+	})
+
+	if tfawserr.ErrCodeEquals(err, ssoadmin.ErrCodeResourceNotFoundException) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	return output, nil
+}
+
 func expandCustomerManagedPolicyReference(tfMap map[string]interface{}) *ssoadmin.CustomerManagedPolicyReference {
 	if tfMap == nil {
 		return nil
diff --git a/internal/service/ssoadmin/customer_managed_policy_attachment_test.go b/internal/service/ssoadmin/customer_managed_policy_attachment_test.go
index 8a7dbcbf616..c37196eb665 100644
--- a/internal/service/ssoadmin/customer_managed_policy_attachment_test.go
+++ b/internal/service/ssoadmin/customer_managed_policy_attachment_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssoadmin_test
 
 import (
@@ -187,7 +190,6 @@ func testAccCheckCustomerManagedPolicyAttachmentDestroy(ctx context.Context) res
 			}
 
 			policyName, policyPath, permissionSetARN, instanceARN, err := tfssoadmin.CustomerManagedPolicyAttachmentParseResourceID(rs.Primary.ID)
-
 			if err != nil {
 				return err
 			}
@@ -221,7 +223,6 @@ func testAccCheckCustomerManagedPolicyAttachmentExists(ctx context.Context, n st
 		}
 
 		policyName, policyPath, permissionSetARN, instanceARN, err := tfssoadmin.CustomerManagedPolicyAttachmentParseResourceID(rs.Primary.ID)
-
 		if err != nil {
 			return err
 		}
diff --git a/internal/service/ssoadmin/find.go b/internal/service/ssoadmin/find.go
deleted file mode 100644
index 11bedb37d06..00000000000
--- a/internal/service/ssoadmin/find.go
+++ /dev/null
@@ -1,145 +0,0 @@
-package ssoadmin
-
-import (
-	"context"
-
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/ssoadmin"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
-	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
-)
-
-// FindAccountAssignment returns the account assigned to a permission set within a specified SSO instance.
-// Returns an error if no account assignment is found.
-func FindAccountAssignment(ctx context.Context, conn *ssoadmin.SSOAdmin, principalId, principalType, accountId, permissionSetArn, instanceArn string) (*ssoadmin.AccountAssignment, error) {
-	input := &ssoadmin.ListAccountAssignmentsInput{
-		AccountId:        aws.String(accountId),
-		InstanceArn:      aws.String(instanceArn),
-		PermissionSetArn: aws.String(permissionSetArn),
-	}
-
-	var accountAssignment *ssoadmin.AccountAssignment
-	err := conn.ListAccountAssignmentsPagesWithContext(ctx, input, func(page *ssoadmin.ListAccountAssignmentsOutput, lastPage bool) bool {
-		if page == nil {
-			return !lastPage
-		}
-
-		for _, a := range page.AccountAssignments {
-			if a == nil {
-				continue
-			}
-
-			if aws.StringValue(a.PrincipalType) != principalType {
-				continue
-			}
-			if aws.StringValue(a.PrincipalId) == principalId {
-				accountAssignment = a
-				return false
-			}
-		}
-
-		return !lastPage
-	})
-
-	return accountAssignment, err
-}
-
-// FindManagedPolicy returns the managed policy attached to a permission set within a specified SSO instance.
-// Returns an error if no managed policy is found.
-func FindManagedPolicy(ctx context.Context, conn *ssoadmin.SSOAdmin, managedPolicyArn, permissionSetArn, instanceArn string) (*ssoadmin.AttachedManagedPolicy, error) {
-	input := &ssoadmin.ListManagedPoliciesInPermissionSetInput{
-		PermissionSetArn: aws.String(permissionSetArn),
-		InstanceArn:      aws.String(instanceArn),
-	}
-
-	var attachedPolicy *ssoadmin.AttachedManagedPolicy
-	err := conn.ListManagedPoliciesInPermissionSetPagesWithContext(ctx, input, func(page *ssoadmin.ListManagedPoliciesInPermissionSetOutput, lastPage bool) bool {
-		if page == nil {
-			return !lastPage
-		}
-
-		for _, policy := range page.AttachedManagedPolicies {
-			if policy == nil {
-				continue
-			}
-
-			if aws.StringValue(policy.Arn) == managedPolicyArn {
-				attachedPolicy = policy
-				return false
-			}
-		}
-		return !lastPage
-	})
-
-	return attachedPolicy, err
-}
-
-// FindCustomerManagedPolicy returns the customer managed policy attached to a permission set within a specified SSO instance.
-// Returns an error if no customer managed policy is found.
-func FindCustomerManagedPolicy(ctx context.Context, conn *ssoadmin.SSOAdmin, policyName, policyPath, permissionSetArn, instanceArn string) (*ssoadmin.CustomerManagedPolicyReference, error) {
-	input := &ssoadmin.ListCustomerManagedPolicyReferencesInPermissionSetInput{
-		PermissionSetArn: aws.String(permissionSetArn),
-		InstanceArn:      aws.String(instanceArn),
-	}
-
-	var attachedPolicy *ssoadmin.CustomerManagedPolicyReference
-	err := conn.ListCustomerManagedPolicyReferencesInPermissionSetPagesWithContext(ctx, input, func(page *ssoadmin.ListCustomerManagedPolicyReferencesInPermissionSetOutput, lastPage bool) bool {
-		if page == nil {
-			return !lastPage
-		}
-
-		for _, policy := range page.CustomerManagedPolicyReferences {
-			if policy == nil {
-				continue
-			}
-
-			if aws.StringValue(policy.Name) == policyName && aws.StringValue(policy.Path) == policyPath {
-				attachedPolicy = policy
-				return false
-			}
-		}
-		return !lastPage
-	})
-
-	if tfawserr.ErrCodeEquals(err, ssoadmin.ErrCodeResourceNotFoundException) {
-		return nil, &retry.NotFoundError{
-			LastError:   err,
-			LastRequest: input,
-		}
-	}
-
-	if err != nil {
-		return nil, err
-	}
-
-	if attachedPolicy == nil {
-		return nil, tfresource.NewEmptyResultError(input)
-	}
-
-	return attachedPolicy, nil
-}
-
-// FindPermissionsBoundary returns the permissions boundary attached to a permission set within a specified SSO instance.
-// Returns an error if no permissions boundary is found.
-func FindPermissionsBoundary(ctx context.Context, conn *ssoadmin.SSOAdmin, permissionSetArn, instanceArn string) (*ssoadmin.PermissionsBoundary, error) {
-	input := &ssoadmin.GetPermissionsBoundaryForPermissionSetInput{
-		PermissionSetArn: aws.String(permissionSetArn),
-		InstanceArn:      aws.String(instanceArn),
-	}
-
-	output, err := conn.GetPermissionsBoundaryForPermissionSetWithContext(ctx, input)
-
-	if tfawserr.ErrCodeEquals(err, ssoadmin.ErrCodeResourceNotFoundException) {
-		return nil, &retry.NotFoundError{
-			LastError:   err,
-			LastRequest: input,
-		}
-	}
-
-	if err != nil {
-		return nil, err
-	}
-
-	return output.PermissionsBoundary, nil
-}
diff --git a/internal/service/ssoadmin/generate.go b/internal/service/ssoadmin/generate.go
index 76c4c583dd7..6ba7cb154cb 100644
--- a/internal/service/ssoadmin/generate.go
+++ b/internal/service/ssoadmin/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTags -ServiceTagsSlice -TagResTypeElem=InstanceArn -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/ssoadmin/instance_access_control_attributes.go b/internal/service/ssoadmin/instance_access_control_attributes.go
index 238c065c40c..4df0c8e69f1 100644
--- a/internal/service/ssoadmin/instance_access_control_attributes.go
+++ b/internal/service/ssoadmin/instance_access_control_attributes.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssoadmin
 
 import (
diff --git a/internal/service/ssoadmin/instance_access_control_attributes_test.go b/internal/service/ssoadmin/instance_access_control_attributes_test.go
index c0df69fb217..9abc8f2cf11 100644
--- a/internal/service/ssoadmin/instance_access_control_attributes_test.go
+++ b/internal/service/ssoadmin/instance_access_control_attributes_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssoadmin_test
 
 import (
diff --git a/internal/service/ssoadmin/instances_data_source.go b/internal/service/ssoadmin/instances_data_source.go
index 503f61f5eb9..7be220da16a 100644
--- a/internal/service/ssoadmin/instances_data_source.go
+++ b/internal/service/ssoadmin/instances_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssoadmin
 
 import (
diff --git a/internal/service/ssoadmin/instances_data_source_test.go b/internal/service/ssoadmin/instances_data_source_test.go
index 2a5caea1129..bb91a53c6a1 100644
--- a/internal/service/ssoadmin/instances_data_source_test.go
+++ b/internal/service/ssoadmin/instances_data_source_test.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssoadmin_test
 
 import (
 	"context"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/ssoadmin"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
@@ -52,8 +55,8 @@ func TestAccSSOAdminInstancesDataSource_basic(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr(dataSourceName, "arns.#", "1"),
 					resource.TestCheckResourceAttr(dataSourceName, "identity_store_ids.#", "1"),
-					acctest.MatchResourceAttrGlobalARNNoAccount(dataSourceName, "arns.0", "sso", regexp.MustCompile("instance/(sso)?ins-[a-zA-Z0-9-.]{16}")),
-					resource.TestMatchResourceAttr(dataSourceName, "identity_store_ids.0", regexp.MustCompile("^[a-zA-Z0-9-]*")),
+					acctest.MatchResourceAttrGlobalARNNoAccount(dataSourceName, "arns.0", "sso", regexache.MustCompile("instance/(sso)?ins-[0-9A-Za-z.-]{16}")),
+					resource.TestMatchResourceAttr(dataSourceName, "identity_store_ids.0", regexache.MustCompile("^[0-9A-Za-z-]*")),
 				),
 			},
 		},
diff --git a/internal/service/ssoadmin/managed_policy_attachment.go b/internal/service/ssoadmin/managed_policy_attachment.go
index 3c4650b2d04..0c3918365c3 100644
--- a/internal/service/ssoadmin/managed_policy_attachment.go
+++ b/internal/service/ssoadmin/managed_policy_attachment.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssoadmin
 
 import (
@@ -5,14 +8,18 @@ import (
 	"fmt"
 	"log"
 	"strings"
+	"time"
 
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ssoadmin"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
+	tfslices "github.com/hashicorp/terraform-provider-aws/internal/slices"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
 )
 
@@ -22,9 +29,16 @@ func ResourceManagedPolicyAttachment() *schema.Resource {
 		CreateWithoutTimeout: resourceManagedPolicyAttachmentCreate,
 		ReadWithoutTimeout:   resourceManagedPolicyAttachmentRead,
 		DeleteWithoutTimeout: resourceManagedPolicyAttachmentDelete,
+
 		Importer: &schema.ResourceImporter{
 			StateContext: schema.ImportStatePassthroughContext,
 		},
+
+		Timeouts: &schema.ResourceTimeout{
+			Create: schema.DefaultTimeout(10 * time.Minute),
+			Delete: schema.DefaultTimeout(10 * time.Minute),
+		},
+
 		Schema: map[string]*schema.Schema{
 			"instance_arn": {
 				Type:         schema.TypeString,
@@ -32,19 +46,16 @@ func ResourceManagedPolicyAttachment() *schema.Resource {
 				ForceNew:     true,
 				ValidateFunc: verify.ValidARN,
 			},
-
 			"managed_policy_arn": {
 				Type:         schema.TypeString,
 				Required:     true,
 				ForceNew:     true,
 				ValidateFunc: verify.ValidARN,
 			},
-
 			"managed_policy_name": {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
-
 			"permission_set_arn": {
 				Type:         schema.TypeString,
 				Required:     true,
@@ -59,27 +70,36 @@ func resourceManagedPolicyAttachmentCreate(ctx context.Context, d *schema.Resour
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).SSOAdminConn(ctx)
 
-	instanceArn := d.Get("instance_arn").(string)
-	managedPolicyArn := d.Get("managed_policy_arn").(string)
-	permissionSetArn := d.Get("permission_set_arn").(string)
+	instanceARN := d.Get("instance_arn").(string)
+	managedPolicyARN := d.Get("managed_policy_arn").(string)
+	permissionSetARN := d.Get("permission_set_arn").(string)
+
+	// Check for duplicates.
+	_, err := FindManagedPolicy(ctx, conn, managedPolicyARN, permissionSetARN, instanceARN)
+
+	if err == nil {
+		return sdkdiag.AppendErrorf(diags, "attaching Managed Policy (%s) to SSO Permission Set (%s): already attached", managedPolicyARN, permissionSetARN)
+	} else if !tfresource.NotFound(err) {
+		return sdkdiag.AppendErrorf(diags, "reading SSO Managed Policy (%s) Attachment (%s): %s", managedPolicyARN, permissionSetARN, err)
+	}
 
 	input := &ssoadmin.AttachManagedPolicyToPermissionSetInput{
-		InstanceArn:      aws.String(instanceArn),
-		ManagedPolicyArn: aws.String(managedPolicyArn),
-		PermissionSetArn: aws.String(permissionSetArn),
+		InstanceArn:      aws.String(instanceARN),
+		ManagedPolicyArn: aws.String(managedPolicyARN),
+		PermissionSetArn: aws.String(permissionSetARN),
 	}
 
-	_, err := conn.AttachManagedPolicyToPermissionSetWithContext(ctx, input)
+	_, err = conn.AttachManagedPolicyToPermissionSetWithContext(ctx, input)
 
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "attaching Managed Policy to SSO Permission Set (%s): %s", permissionSetArn, err)
+		return sdkdiag.AppendErrorf(diags, "attaching Managed Policy (%s) to SSO Permission Set (%s): %s", managedPolicyARN, permissionSetARN, err)
 	}
 
-	d.SetId(fmt.Sprintf("%s,%s,%s", managedPolicyArn, permissionSetArn, instanceArn))
+	d.SetId(fmt.Sprintf("%s,%s,%s", managedPolicyARN, permissionSetARN, instanceARN))
 
-	// Provision ALL accounts after attaching the managed policy
-	if err := provisionPermissionSet(ctx, conn, permissionSetArn, instanceArn); err != nil {
-		return sdkdiag.AppendErrorf(diags, "provisioning SSO Permission Set (%s): %s", permissionSetArn, err)
+	// Provision ALL accounts after attaching the managed policy.
+	if err := provisionPermissionSet(ctx, conn, permissionSetARN, instanceARN, d.Timeout(schema.TimeoutCreate)); err != nil {
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
 	return append(diags, resourceManagedPolicyAttachmentRead(ctx, d, meta)...)
@@ -89,33 +109,27 @@ func resourceManagedPolicyAttachmentRead(ctx context.Context, d *schema.Resource
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).SSOAdminConn(ctx)
 
-	managedPolicyArn, permissionSetArn, instanceArn, err := ParseManagedPolicyAttachmentID(d.Id())
+	managedPolicyARN, permissionSetARN, instanceARN, err := ParseManagedPolicyAttachmentID(d.Id())
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "parsing SSO Managed Policy Attachment ID: %s", err)
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
-	policy, err := FindManagedPolicy(ctx, conn, managedPolicyArn, permissionSetArn, instanceArn)
+	policy, err := FindManagedPolicy(ctx, conn, managedPolicyARN, permissionSetARN, instanceARN)
 
-	if !d.IsNewResource() && tfawserr.ErrCodeEquals(err, ssoadmin.ErrCodeResourceNotFoundException) {
-		log.Printf("[WARN] Managed Policy (%s) for SSO Permission Set (%s) not found, removing from state", managedPolicyArn, permissionSetArn)
+	if !d.IsNewResource() && tfresource.NotFound(err) {
+		log.Printf("[WARN] SSO Managed Policy Attachment (%s) not found, removing from state", d.Id())
 		d.SetId("")
 		return diags
 	}
 
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "reading Managed Policy (%s) for SSO Permission Set (%s): %s", managedPolicyArn, permissionSetArn, err)
+		return sdkdiag.AppendErrorf(diags, "reading SSO Managed Policy Attachment (%s): %s", d.Id(), err)
 	}
 
-	if policy == nil {
-		log.Printf("[WARN] Managed Policy (%s) for SSO Permission Set (%s) not found, removing from state", managedPolicyArn, permissionSetArn)
-		d.SetId("")
-		return diags
-	}
-
-	d.Set("instance_arn", instanceArn)
+	d.Set("instance_arn", instanceARN)
 	d.Set("managed_policy_arn", policy.Arn)
 	d.Set("managed_policy_name", policy.Name)
-	d.Set("permission_set_arn", permissionSetArn)
+	d.Set("permission_set_arn", permissionSetARN)
 
 	return diags
 }
@@ -124,29 +138,30 @@ func resourceManagedPolicyAttachmentDelete(ctx context.Context, d *schema.Resour
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).SSOAdminConn(ctx)
 
-	managedPolicyArn, permissionSetArn, instanceArn, err := ParseManagedPolicyAttachmentID(d.Id())
+	managedPolicyARN, permissionSetARN, instanceARN, err := ParseManagedPolicyAttachmentID(d.Id())
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "parsing SSO Managed Policy Attachment ID: %s", err)
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
 	input := &ssoadmin.DetachManagedPolicyFromPermissionSetInput{
-		InstanceArn:      aws.String(instanceArn),
-		PermissionSetArn: aws.String(permissionSetArn),
-		ManagedPolicyArn: aws.String(managedPolicyArn),
+		InstanceArn:      aws.String(instanceARN),
+		ManagedPolicyArn: aws.String(managedPolicyARN),
+		PermissionSetArn: aws.String(permissionSetARN),
 	}
 
 	_, err = conn.DetachManagedPolicyFromPermissionSetWithContext(ctx, input)
 
+	if tfawserr.ErrCodeEquals(err, ssoadmin.ErrCodeResourceNotFoundException) {
+		return diags
+	}
+
 	if err != nil {
-		if tfawserr.ErrCodeEquals(err, ssoadmin.ErrCodeResourceNotFoundException) {
-			return diags
-		}
-		return sdkdiag.AppendErrorf(diags, "detaching Managed Policy (%s) from SSO Permission Set (%s): %s", managedPolicyArn, permissionSetArn, err)
+		return sdkdiag.AppendErrorf(diags, "detaching Managed Policy (%s) from SSO Permission Set (%s): %s", managedPolicyARN, permissionSetARN, err)
 	}
 
-	// Provision ALL accounts after detaching the managed policy
-	if err := provisionPermissionSet(ctx, conn, permissionSetArn, instanceArn); err != nil {
-		return sdkdiag.AppendErrorf(diags, "provisioning SSO Permission Set (%s): %s", permissionSetArn, err)
+	// Provision ALL accounts after detaching the managed policy.
+	if err := provisionPermissionSet(ctx, conn, permissionSetARN, instanceARN, d.Timeout(schema.TimeoutDelete)); err != nil {
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
 	return diags
@@ -159,3 +174,56 @@ func ParseManagedPolicyAttachmentID(id string) (string, string, string, error) {
 	}
 	return idParts[0], idParts[1], idParts[2], nil
 }
+
+func FindManagedPolicy(ctx context.Context, conn *ssoadmin.SSOAdmin, managedPolicyARN, permissionSetARN, instanceARN string) (*ssoadmin.AttachedManagedPolicy, error) {
+	input := &ssoadmin.ListManagedPoliciesInPermissionSetInput{
+		InstanceArn:      aws.String(instanceARN),
+		PermissionSetArn: aws.String(permissionSetARN),
+	}
+	filter := func(a *ssoadmin.AttachedManagedPolicy) bool {
+		return aws.StringValue(a.Arn) == managedPolicyARN
+	}
+
+	return findAttachedManagedPolicy(ctx, conn, input, filter)
+}
+
+func findAttachedManagedPolicy(ctx context.Context, conn *ssoadmin.SSOAdmin, input *ssoadmin.ListManagedPoliciesInPermissionSetInput, filter tfslices.Predicate[*ssoadmin.AttachedManagedPolicy]) (*ssoadmin.AttachedManagedPolicy, error) {
+	output, err := findAttachedManagedPolicies(ctx, conn, input, filter)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return tfresource.AssertSinglePtrResult(output)
+}
+
+func findAttachedManagedPolicies(ctx context.Context, conn *ssoadmin.SSOAdmin, input *ssoadmin.ListManagedPoliciesInPermissionSetInput, filter tfslices.Predicate[*ssoadmin.AttachedManagedPolicy]) ([]*ssoadmin.AttachedManagedPolicy, error) {
+	var output []*ssoadmin.AttachedManagedPolicy
+
+	err := conn.ListManagedPoliciesInPermissionSetPagesWithContext(ctx, input, func(page *ssoadmin.ListManagedPoliciesInPermissionSetOutput, lastPage bool) bool {
+		if page == nil {
+			return !lastPage
+		}
+
+		for _, v := range page.AttachedManagedPolicies {
+			if v != nil && filter(v) {
+				output = append(output, v)
+			}
+		}
+
+		return !lastPage
+	})
+
+	if tfawserr.ErrCodeEquals(err, ssoadmin.ErrCodeResourceNotFoundException) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	return output, nil
+}
diff --git a/internal/service/ssoadmin/managed_policy_attachment_test.go b/internal/service/ssoadmin/managed_policy_attachment_test.go
index acab79bbd87..d4037de204f 100644
--- a/internal/service/ssoadmin/managed_policy_attachment_test.go
+++ b/internal/service/ssoadmin/managed_policy_attachment_test.go
@@ -1,19 +1,22 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssoadmin_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/ssoadmin"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	tfssoadmin "github.com/hashicorp/terraform-provider-aws/internal/service/ssoadmin"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
 func TestAccSSOAdminManagedPolicyAttachment_basic(t *testing.T) {
@@ -33,7 +36,7 @@ func TestAccSSOAdminManagedPolicyAttachment_basic(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckManagedPolicyAttachmentExists(ctx, resourceName),
 					//lintignore:AWSAT001
-					resource.TestMatchResourceAttr(resourceName, "managed_policy_arn", regexp.MustCompile(`policy/AlexaForBusinessDeviceSetup`)),
+					resource.TestMatchResourceAttr(resourceName, "managed_policy_arn", regexache.MustCompile(`policy/AlexaForBusinessDeviceSetup`)),
 					resource.TestCheckResourceAttr(resourceName, "managed_policy_name", "AlexaForBusinessDeviceSetup"),
 					resource.TestCheckResourceAttrPair(resourceName, "instance_arn", permissionSetResourceName, "instance_arn"),
 					resource.TestCheckResourceAttrPair(resourceName, "permission_set_arn", permissionSetResourceName, "arn"),
@@ -71,7 +74,7 @@ func TestAccSSOAdminManagedPolicyAttachment_forceNew(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckManagedPolicyAttachmentExists(ctx, resourceName),
 					//lintignore:AWSAT001
-					resource.TestMatchResourceAttr(resourceName, "managed_policy_arn", regexp.MustCompile(`policy/AmazonCognitoReadOnly`)),
+					resource.TestMatchResourceAttr(resourceName, "managed_policy_arn", regexache.MustCompile(`policy/AmazonCognitoReadOnly`)),
 					resource.TestCheckResourceAttr(resourceName, "managed_policy_name", "AmazonCognitoReadOnly"),
 					resource.TestCheckResourceAttrPair(resourceName, "instance_arn", permissionSetResourceName, "instance_arn"),
 					resource.TestCheckResourceAttrPair(resourceName, "permission_set_arn", permissionSetResourceName, "arn"),
@@ -158,7 +161,7 @@ func TestAccSSOAdminManagedPolicyAttachment_multipleManagedPolicies(t *testing.T
 					testAccCheckManagedPolicyAttachmentExists(ctx, resourceName),
 					testAccCheckManagedPolicyAttachmentExists(ctx, otherResourceName),
 					//lintignore:AWSAT001
-					resource.TestMatchResourceAttr(otherResourceName, "managed_policy_arn", regexp.MustCompile(`policy/AmazonDynamoDBReadOnlyAccess`)),
+					resource.TestMatchResourceAttr(otherResourceName, "managed_policy_arn", regexache.MustCompile(`policy/AmazonDynamoDBReadOnlyAccess`)),
 					resource.TestCheckResourceAttr(otherResourceName, "managed_policy_name", "AmazonDynamoDBReadOnlyAccess"),
 					resource.TestCheckResourceAttrPair(otherResourceName, "instance_arn", permissionSetResourceName, "instance_arn"),
 					resource.TestCheckResourceAttrPair(otherResourceName, "permission_set_arn", permissionSetResourceName, "arn"),
@@ -182,14 +185,14 @@ func testAccCheckManagedPolicyAttachmentDestroy(ctx context.Context) resource.Te
 				continue
 			}
 
-			managedPolicyArn, permissionSetArn, instanceArn, err := tfssoadmin.ParseManagedPolicyAttachmentID(rs.Primary.ID)
+			managedPolicyARN, permissionSetARN, instanceARN, err := tfssoadmin.ParseManagedPolicyAttachmentID(rs.Primary.ID)
 			if err != nil {
-				return fmt.Errorf("error parsing SSO Managed Policy Attachment ID (%s): %w", rs.Primary.ID, err)
+				return err
 			}
 
-			policy, err := tfssoadmin.FindManagedPolicy(ctx, conn, managedPolicyArn, permissionSetArn, instanceArn)
+			_, err = tfssoadmin.FindManagedPolicy(ctx, conn, managedPolicyARN, permissionSetARN, instanceARN)
 
-			if tfawserr.ErrCodeEquals(err, ssoadmin.ErrCodeResourceNotFoundException) {
+			if tfresource.NotFound(err) {
 				continue
 			}
 
@@ -197,67 +200,48 @@ func testAccCheckManagedPolicyAttachmentDestroy(ctx context.Context) resource.Te
 				return err
 			}
 
-			if policy == nil {
-				continue
-			}
-
-			return fmt.Errorf("Managed Policy (%s) for SSO Permission Set (%s) still exists", managedPolicyArn, permissionSetArn)
+			return fmt.Errorf("SSO Managed Policy Attachment %s still exists", rs.Primary.ID)
 		}
 
 		return nil
 	}
 }
 
-func testAccCheckManagedPolicyAttachmentExists(ctx context.Context, resourceName string) resource.TestCheckFunc {
+func testAccCheckManagedPolicyAttachmentExists(ctx context.Context, n string) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		rs, ok := s.RootModule().Resources[resourceName]
+		rs, ok := s.RootModule().Resources[n]
 		if !ok {
-			return fmt.Errorf("Not found: %s", resourceName)
-		}
-
-		if rs.Primary.ID == "" {
-			return fmt.Errorf("Resource (%s) ID not set", resourceName)
+			return fmt.Errorf("Not found: %s", n)
 		}
 
-		managedPolicyArn, permissionSetArn, instanceArn, err := tfssoadmin.ParseManagedPolicyAttachmentID(rs.Primary.ID)
-
+		managedPolicyARN, permissionSetARN, instanceARN, err := tfssoadmin.ParseManagedPolicyAttachmentID(rs.Primary.ID)
 		if err != nil {
-			return fmt.Errorf("error parsing SSO Managed Policy Attachment ID (%s): %w", rs.Primary.ID, err)
+			return err
 		}
 
 		conn := acctest.Provider.Meta().(*conns.AWSClient).SSOAdminConn(ctx)
 
-		policy, err := tfssoadmin.FindManagedPolicy(ctx, conn, managedPolicyArn, permissionSetArn, instanceArn)
-
-		if err != nil {
-			return err
-		}
-
-		if policy == nil {
-			return fmt.Errorf("Managed Policy (%s) for SSO Permission Set (%s) not found", managedPolicyArn, permissionSetArn)
-		}
+		_, err = tfssoadmin.FindManagedPolicy(ctx, conn, managedPolicyARN, permissionSetARN, instanceARN)
 
-		return nil
+		return err
 	}
 }
 
-func testAccManagedPolicyAttachmentBaseConfig(rName string) string {
+func testAccManagedPolicyAttachmentConfig_base(rName string) string {
 	return fmt.Sprintf(`
 data "aws_partition" "current" {}
 
 data "aws_ssoadmin_instances" "test" {}
 
 resource "aws_ssoadmin_permission_set" "test" {
-  name         = %q
+  name         = %[1]q
   instance_arn = tolist(data.aws_ssoadmin_instances.test.arns)[0]
 }
 `, rName)
 }
 
 func testAccManagedPolicyAttachmentConfig_basic(rName string) string {
-	return acctest.ConfigCompose(
-		testAccManagedPolicyAttachmentBaseConfig(rName),
-		`
+	return acctest.ConfigCompose(testAccManagedPolicyAttachmentConfig_base(rName), `
 resource "aws_ssoadmin_managed_policy_attachment" "test" {
   instance_arn       = aws_ssoadmin_permission_set.test.instance_arn
   managed_policy_arn = "arn:${data.aws_partition.current.partition}:iam::aws:policy/AlexaForBusinessDeviceSetup"
@@ -267,9 +251,7 @@ resource "aws_ssoadmin_managed_policy_attachment" "test" {
 }
 
 func testAccManagedPolicyAttachmentConfig_forceNew(rName string) string {
-	return acctest.ConfigCompose(
-		testAccManagedPolicyAttachmentBaseConfig(rName),
-		`
+	return acctest.ConfigCompose(testAccManagedPolicyAttachmentConfig_base(rName), `
 resource "aws_ssoadmin_managed_policy_attachment" "test" {
   instance_arn       = aws_ssoadmin_permission_set.test.instance_arn
   managed_policy_arn = "arn:${data.aws_partition.current.partition}:iam::aws:policy/AmazonCognitoReadOnly"
@@ -279,9 +261,7 @@ resource "aws_ssoadmin_managed_policy_attachment" "test" {
 }
 
 func testAccManagedPolicyAttachmentConfig_multiple(rName string) string {
-	return acctest.ConfigCompose(
-		testAccManagedPolicyAttachmentConfig_basic(rName),
-		`
+	return acctest.ConfigCompose(testAccManagedPolicyAttachmentConfig_basic(rName), `
 resource "aws_ssoadmin_managed_policy_attachment" "other" {
   instance_arn       = tolist(data.aws_ssoadmin_instances.test.arns)[0]
   managed_policy_arn = "arn:${data.aws_partition.current.partition}:iam::aws:policy/AmazonDynamoDBReadOnlyAccess"
diff --git a/internal/service/ssoadmin/permission_set.go b/internal/service/ssoadmin/permission_set.go
index dc9cebb5024..f12a576bce0 100644
--- a/internal/service/ssoadmin/permission_set.go
+++ b/internal/service/ssoadmin/permission_set.go
@@ -1,13 +1,17 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssoadmin
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"log"
-	"regexp"
 	"strings"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ssoadmin"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -36,6 +40,10 @@ func ResourcePermissionSet() *schema.Resource {
 			StateContext: schema.ImportStatePassthroughContext,
 		},
 
+		Timeouts: &schema.ResourceTimeout{
+			Update: schema.DefaultTimeout(10 * time.Minute),
+		},
+
 		Schema: map[string]*schema.Schema{
 			"arn": {
 				Type:     schema.TypeString,
@@ -50,7 +58,7 @@ func ResourcePermissionSet() *schema.Resource {
 				Optional: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 700),
-					validation.StringMatch(regexp.MustCompile(`[\p{L}\p{M}\p{Z}\p{S}\p{N}\p{P}]*`), "must match [\\p{L}\\p{M}\\p{Z}\\p{S}\\p{N}\\p{P}]"),
+					validation.StringMatch(regexache.MustCompile(`[\p{L}\p{M}\p{Z}\p{S}\p{N}\p{P}]*`), "must match [\\p{L}\\p{M}\\p{Z}\\p{S}\\p{N}\\p{P}]"),
 				),
 			},
 			"instance_arn": {
@@ -65,7 +73,7 @@ func ResourcePermissionSet() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 32),
-					validation.StringMatch(regexp.MustCompile(`[\w+=,.@-]+`), "must match [\\w+=,.@-]"),
+					validation.StringMatch(regexache.MustCompile(`[\w+=,.@-]+`), "must match [\\w+=,.@-]"),
 				),
 			},
 			"relay_state": {
@@ -73,7 +81,7 @@ func ResourcePermissionSet() *schema.Resource {
 				Optional: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 240),
-					validation.StringMatch(regexp.MustCompile(`[a-zA-Z0-9&$@#\\\/%?=~\-_'"|!:,.;*+\[\]\ \(\)\{\}]+`), "must match [a-zA-Z0-9&$@#\\\\\\/%?=~\\-_'\"|!:,.;*+\\[\\]\\(\\)\\{\\}]"),
+					validation.StringMatch(regexache.MustCompile(`[0-9A-Za-z&$@#\\\/%?=~\-_'"|!:,.;*+\[\]\ \(\)\{\}]+`), "must match [0-9A-Za-z&$@#\\\\\\/%?=~\\-_'\"|!:,.;*+\\[\\]\\(\\)\\{\\}]"),
 				),
 			},
 			"session_duration": {
@@ -129,32 +137,23 @@ func resourcePermissionSetRead(ctx context.Context, d *schema.ResourceData, meta
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).SSOAdminConn(ctx)
 
-	arn, instanceARN, err := ParseResourceID(d.Id())
-
+	permissionSetARN, instanceARN, err := ParseResourceID(d.Id())
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "parsing resource ID: %s", err)
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
-	output, err := conn.DescribePermissionSetWithContext(ctx, &ssoadmin.DescribePermissionSetInput{
-		InstanceArn:      aws.String(instanceARN),
-		PermissionSetArn: aws.String(arn),
-	})
+	permissionSet, err := FindPermissionSet(ctx, conn, permissionSetARN, instanceARN)
 
-	if !d.IsNewResource() && tfawserr.ErrCodeEquals(err, ssoadmin.ErrCodeResourceNotFoundException) {
-		log.Printf("[WARN] SSO Permission Set (%s) not found, removing from state", arn)
+	if !d.IsNewResource() && tfresource.NotFound(err) {
+		log.Printf("[WARN] SSO Permission Set (%s) not found, removing from state", d.Id())
 		d.SetId("")
 		return diags
 	}
 
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "reading SSO Permission Set: %s", err)
-	}
-
-	if output == nil || output.PermissionSet == nil {
-		return sdkdiag.AppendErrorf(diags, "reading SSO Permission Set (%s): empty output", arn)
+		return sdkdiag.AppendErrorf(diags, "reading SSO Permission Set (%s): %s", d.Id(), err)
 	}
 
-	permissionSet := output.PermissionSet
 	d.Set("arn", permissionSet.PermissionSetArn)
 	d.Set("created_date", permissionSet.CreatedDate.Format(time.RFC3339))
 	d.Set("description", permissionSet.Description)
@@ -163,10 +162,10 @@ func resourcePermissionSetRead(ctx context.Context, d *schema.ResourceData, meta
 	d.Set("relay_state", permissionSet.RelayState)
 	d.Set("session_duration", permissionSet.SessionDuration)
 
-	tags, err := listTags(ctx, conn, arn, instanceARN)
+	tags, err := listTags(ctx, conn, permissionSetARN, instanceARN)
 
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "listing tags for SSO Permission Set (%s): %s", arn, err)
+		return sdkdiag.AppendErrorf(diags, "listing tags for SSO Permission Set (%s): %s", permissionSetARN, err)
 	}
 
 	setTagsOut(ctx, Tags(tags))
@@ -178,16 +177,15 @@ func resourcePermissionSetUpdate(ctx context.Context, d *schema.ResourceData, me
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).SSOAdminConn(ctx)
 
-	arn, instanceARN, err := ParseResourceID(d.Id())
-
+	permissionSetARN, instanceARN, err := ParseResourceID(d.Id())
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "parsing resource ID: %s", err)
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
 	if d.HasChanges("description", "relay_state", "session_duration") {
 		input := &ssoadmin.UpdatePermissionSetInput{
 			InstanceArn:      aws.String(instanceARN),
-			PermissionSetArn: aws.String(arn),
+			PermissionSetArn: aws.String(permissionSetARN),
 		}
 
 		// The AWS SSO API requires we send the RelayState value regardless if it's unchanged
@@ -208,23 +206,24 @@ func resourcePermissionSetUpdate(ctx context.Context, d *schema.ResourceData, me
 		}
 
 		_, err := conn.UpdatePermissionSetWithContext(ctx, input)
+
 		if err != nil {
-			return sdkdiag.AppendErrorf(diags, "updating SSO Permission Set (%s): %s", arn, err)
+			return sdkdiag.AppendErrorf(diags, "updating SSO Permission Set (%s): %s", d.Id(), err)
+		}
+
+		// Re-provision ALL accounts after making the above changes
+		if err := provisionPermissionSet(ctx, conn, permissionSetARN, instanceARN, d.Timeout(schema.TimeoutUpdate)); err != nil {
+			return sdkdiag.AppendFromErr(diags, err)
 		}
 	}
 
 	if d.HasChange("tags_all") {
 		o, n := d.GetChange("tags_all")
-		if err := updateTags(ctx, conn, arn, instanceARN, o, n); err != nil {
+		if err := updateTags(ctx, conn, permissionSetARN, instanceARN, o, n); err != nil {
 			return sdkdiag.AppendErrorf(diags, "updating tags: %s", err)
 		}
 	}
 
-	// Re-provision ALL accounts after making the above changes
-	if err := provisionPermissionSet(ctx, conn, arn, instanceARN); err != nil {
-		return sdkdiag.AppendErrorf(diags, "provisioning SSO Permission Set (%s): %s", arn, err)
-	}
-
 	return append(diags, resourcePermissionSetRead(ctx, d, meta)...)
 }
 
@@ -232,16 +231,15 @@ func resourcePermissionSetDelete(ctx context.Context, d *schema.ResourceData, me
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).SSOAdminConn(ctx)
 
-	arn, instanceARN, err := ParseResourceID(d.Id())
-
+	permissionSetARN, instanceARN, err := ParseResourceID(d.Id())
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "parsing resource ID: %s", err)
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
 	log.Printf("[INFO] Deleting SSO Permission Set: %s", d.Id())
 	_, err = conn.DeletePermissionSetWithContext(ctx, &ssoadmin.DeletePermissionSetInput{
 		InstanceArn:      aws.String(instanceARN),
-		PermissionSetArn: aws.String(arn),
+		PermissionSetArn: aws.String(permissionSetARN),
 	})
 
 	if tfawserr.ErrCodeEquals(err, ssoadmin.ErrCodeResourceNotFoundException) {
@@ -249,7 +247,7 @@ func resourcePermissionSetDelete(ctx context.Context, d *schema.ResourceData, me
 	}
 
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "deleting SSO Permission Set (%s): %s", arn, err)
+		return sdkdiag.AppendErrorf(diags, "deleting SSO Permission Set (%s): %s", permissionSetARN, err)
 	}
 
 	return diags
@@ -263,47 +261,110 @@ func ParseResourceID(id string) (string, string, error) {
 	return idParts[0], idParts[1], nil
 }
 
-func provisionPermissionSet(ctx context.Context, conn *ssoadmin.SSOAdmin, arn, instanceArn string) error {
+func FindPermissionSet(ctx context.Context, conn *ssoadmin.SSOAdmin, permissionSetARN, instanceARN string) (*ssoadmin.PermissionSet, error) {
+	input := &ssoadmin.DescribePermissionSetInput{
+		InstanceArn:      aws.String(instanceARN),
+		PermissionSetArn: aws.String(permissionSetARN),
+	}
+
+	output, err := conn.DescribePermissionSetWithContext(ctx, input)
+
+	if tfawserr.ErrCodeEquals(err, ssoadmin.ErrCodeResourceNotFoundException) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	if output == nil || output.PermissionSet == nil {
+		return nil, tfresource.NewEmptyResultError(input)
+	}
+
+	return output.PermissionSet, nil
+}
+
+func provisionPermissionSet(ctx context.Context, conn *ssoadmin.SSOAdmin, permissionSetARN, instanceARN string, timeout time.Duration) error {
 	input := &ssoadmin.ProvisionPermissionSetInput{
-		InstanceArn:      aws.String(instanceArn),
-		PermissionSetArn: aws.String(arn),
+		InstanceArn:      aws.String(instanceARN),
+		PermissionSetArn: aws.String(permissionSetARN),
 		TargetType:       aws.String(ssoadmin.ProvisionTargetTypeAllProvisionedAccounts),
 	}
 
-	var output *ssoadmin.ProvisionPermissionSetOutput
-	err := retry.RetryContext(ctx, permissionSetProvisionTimeout, func() *retry.RetryError {
-		var err error
-		output, err = conn.ProvisionPermissionSetWithContext(ctx, input)
+	output, err := conn.ProvisionPermissionSetWithContext(ctx, input)
 
-		if err != nil {
-			if tfawserr.ErrCodeEquals(err, ssoadmin.ErrCodeConflictException) {
-				return retry.RetryableError(err)
-			}
-			if tfawserr.ErrCodeEquals(err, ssoadmin.ErrCodeThrottlingException) {
-				return retry.RetryableError(err)
-			}
-			return retry.NonRetryableError(err)
-		}
+	if err != nil {
+		return fmt.Errorf("provisioning SSO Permission Set (%s): %w", permissionSetARN, err)
+	}
 
-		return nil
-	})
+	if _, err := waitPermissionSetProvisioned(ctx, conn, instanceARN, aws.StringValue(output.PermissionSetProvisioningStatus.RequestId), timeout); err != nil {
+		return fmt.Errorf("waiting for SSO Permission Set (%s) provision: %w", permissionSetARN, err)
+	}
+
+	return nil
+}
+
+func findPermissionSetProvisioningStatus(ctx context.Context, conn *ssoadmin.SSOAdmin, instanceARN, requestID string) (*ssoadmin.PermissionSetProvisioningStatus, error) {
+	input := &ssoadmin.DescribePermissionSetProvisioningStatusInput{
+		InstanceArn:                     aws.String(instanceARN),
+		ProvisionPermissionSetRequestId: aws.String(requestID),
+	}
 
-	if tfresource.TimedOut(err) {
-		output, err = conn.ProvisionPermissionSetWithContext(ctx, input)
+	output, err := conn.DescribePermissionSetProvisioningStatusWithContext(ctx, input)
+
+	if tfawserr.ErrCodeEquals(err, ssoadmin.ErrCodeResourceNotFoundException) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
 	}
 
 	if err != nil {
-		return fmt.Errorf("provisioning SSO Permission Set (%s): %w", arn, err)
+		return nil, err
 	}
 
 	if output == nil || output.PermissionSetProvisioningStatus == nil {
-		return fmt.Errorf("provisioning SSO Permission Set (%s): empty output", arn)
+		return nil, tfresource.NewEmptyResultError(input)
 	}
 
-	_, err = waitPermissionSetProvisioned(ctx, conn, instanceArn, aws.StringValue(output.PermissionSetProvisioningStatus.RequestId))
-	if err != nil {
-		return fmt.Errorf("waiting for SSO Permission Set (%s) to provision: %w", arn, err)
+	return output.PermissionSetProvisioningStatus, nil
+}
+
+func statusPermissionSetProvisioning(ctx context.Context, conn *ssoadmin.SSOAdmin, instanceARN, requestID string) retry.StateRefreshFunc {
+	return func() (interface{}, string, error) {
+		output, err := findPermissionSetProvisioningStatus(ctx, conn, instanceARN, requestID)
+
+		if tfresource.NotFound(err) {
+			return nil, "", nil
+		}
+
+		if err != nil {
+			return nil, "", err
+		}
+
+		return output, aws.StringValue(output.Status), nil
 	}
+}
 
-	return nil
+func waitPermissionSetProvisioned(ctx context.Context, conn *ssoadmin.SSOAdmin, instanceARN, requestID string, timeout time.Duration) (*ssoadmin.PermissionSetProvisioningStatus, error) {
+	stateConf := retry.StateChangeConf{
+		Pending: []string{ssoadmin.StatusValuesInProgress},
+		Target:  []string{ssoadmin.StatusValuesSucceeded},
+		Refresh: statusPermissionSetProvisioning(ctx, conn, instanceARN, requestID),
+		Timeout: timeout,
+		Delay:   5 * time.Second,
+	}
+
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+
+	if output, ok := outputRaw.(*ssoadmin.PermissionSetProvisioningStatus); ok {
+		tfresource.SetLastError(err, errors.New(aws.StringValue(output.FailureReason)))
+
+		return output, err
+	}
+
+	return nil, err
 }
diff --git a/internal/service/ssoadmin/permission_set_data_source.go b/internal/service/ssoadmin/permission_set_data_source.go
index eb3907dfe89..4f3840751fe 100644
--- a/internal/service/ssoadmin/permission_set_data_source.go
+++ b/internal/service/ssoadmin/permission_set_data_source.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssoadmin
 
 import (
 	"context"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ssoadmin"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
@@ -52,7 +55,7 @@ func DataSourcePermissionSet() *schema.Resource {
 				Computed: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 32),
-					validation.StringMatch(regexp.MustCompile(`[\w+=,.@-]+`), "must match [\\w+=,.@-]"),
+					validation.StringMatch(regexache.MustCompile(`[\w+=,.@-]+`), "must match [\\w+=,.@-]"),
 				),
 				ExactlyOneOf: []string{"name", "arn"},
 			},
diff --git a/internal/service/ssoadmin/permission_set_data_source_test.go b/internal/service/ssoadmin/permission_set_data_source_test.go
index 21dfe85a192..f584802de3c 100644
--- a/internal/service/ssoadmin/permission_set_data_source_test.go
+++ b/internal/service/ssoadmin/permission_set_data_source_test.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssoadmin_test
 
 import (
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/ssoadmin"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -72,7 +75,7 @@ func TestAccSSOAdminPermissionSetDataSource_nonExistent(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccPermissionSetDataSourceConfig_ssoByNameNonExistent,
-				ExpectError: regexp.MustCompile(`not found`),
+				ExpectError: regexache.MustCompile(`not found`),
 			},
 		},
 	})
diff --git a/internal/service/ssoadmin/permission_set_inline_policy.go b/internal/service/ssoadmin/permission_set_inline_policy.go
index 4a3a9d28981..f89731fcd53 100644
--- a/internal/service/ssoadmin/permission_set_inline_policy.go
+++ b/internal/service/ssoadmin/permission_set_inline_policy.go
@@ -1,18 +1,24 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssoadmin
 
 import (
 	"context"
 	"fmt"
 	"log"
+	"time"
 
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ssoadmin"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/structure"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
 )
 
@@ -23,28 +29,34 @@ func ResourcePermissionSetInlinePolicy() *schema.Resource {
 		ReadWithoutTimeout:   resourcePermissionSetInlinePolicyRead,
 		UpdateWithoutTimeout: resourcePermissionSetInlinePolicyPut,
 		DeleteWithoutTimeout: resourcePermissionSetInlinePolicyDelete,
+
 		Importer: &schema.ResourceImporter{
 			StateContext: schema.ImportStatePassthroughContext,
 		},
+
+		Timeouts: &schema.ResourceTimeout{
+			Create: schema.DefaultTimeout(10 * time.Minute),
+			Delete: schema.DefaultTimeout(10 * time.Minute),
+		},
+
 		Schema: map[string]*schema.Schema{
 			"inline_policy": {
-				Type:             schema.TypeString,
-				Required:         true,
-				ValidateFunc:     verify.ValidIAMPolicyJSON,
-				DiffSuppressFunc: verify.SuppressEquivalentJSONDiffs,
+				Type:                  schema.TypeString,
+				Required:              true,
+				ValidateFunc:          verify.ValidIAMPolicyJSON,
+				DiffSuppressFunc:      verify.SuppressEquivalentPolicyDiffs,
+				DiffSuppressOnRefresh: true,
 				StateFunc: func(v interface{}) string {
 					json, _ := structure.NormalizeJsonString(v)
 					return json
 				},
 			},
-
 			"instance_arn": {
 				Type:         schema.TypeString,
 				Required:     true,
 				ForceNew:     true,
 				ValidateFunc: verify.ValidARN,
 			},
-
 			"permission_set_arn": {
 				Type:         schema.TypeString,
 				Required:     true,
@@ -59,31 +71,30 @@ func resourcePermissionSetInlinePolicyPut(ctx context.Context, d *schema.Resourc
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).SSOAdminConn(ctx)
 
-	instanceArn := d.Get("instance_arn").(string)
-	permissionSetArn := d.Get("permission_set_arn").(string)
-
 	policy, err := structure.NormalizeJsonString(d.Get("inline_policy").(string))
-
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "policy (%s) is invalid JSON: %s", d.Get("inline_policy").(string), err)
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
+	instanceARN := d.Get("instance_arn").(string)
+	permissionSetARN := d.Get("permission_set_arn").(string)
 	input := &ssoadmin.PutInlinePolicyToPermissionSetInput{
 		InlinePolicy:     aws.String(policy),
-		InstanceArn:      aws.String(instanceArn),
-		PermissionSetArn: aws.String(permissionSetArn),
+		InstanceArn:      aws.String(instanceARN),
+		PermissionSetArn: aws.String(permissionSetARN),
 	}
 
 	_, err = conn.PutInlinePolicyToPermissionSetWithContext(ctx, input)
+
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "putting Inline Policy for SSO Permission Set (%s): %s", permissionSetArn, err)
+		return sdkdiag.AppendErrorf(diags, "putting SSO Permission Set (%s) Inline Policy: %s", permissionSetARN, err)
 	}
 
-	d.SetId(fmt.Sprintf("%s,%s", permissionSetArn, instanceArn))
+	d.SetId(fmt.Sprintf("%s,%s", permissionSetARN, instanceARN))
 
-	// (Re)provision ALL accounts after making the above changes
-	if err := provisionPermissionSet(ctx, conn, permissionSetArn, instanceArn); err != nil {
-		return sdkdiag.AppendErrorf(diags, "provisioning SSO Permission Set (%s): %s", permissionSetArn, err)
+	// (Re)provision ALL accounts after making the above changes.
+	if err := provisionPermissionSet(ctx, conn, permissionSetARN, instanceARN, d.Timeout(schema.TimeoutCreate)); err != nil {
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
 	return append(diags, resourcePermissionSetInlinePolicyRead(ctx, d, meta)...)
@@ -93,42 +104,31 @@ func resourcePermissionSetInlinePolicyRead(ctx context.Context, d *schema.Resour
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).SSOAdminConn(ctx)
 
-	permissionSetArn, instanceArn, err := ParseResourceID(d.Id())
+	permissionSetARN, instanceARN, err := ParseResourceID(d.Id())
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "parsing SSO Permission Set Inline Policy ID: %s", err)
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
-	input := &ssoadmin.GetInlinePolicyForPermissionSetInput{
-		InstanceArn:      aws.String(instanceArn),
-		PermissionSetArn: aws.String(permissionSetArn),
-	}
+	policy, err := FindPermissionSetInlinePolicy(ctx, conn, permissionSetARN, instanceARN)
 
-	output, err := conn.GetInlinePolicyForPermissionSetWithContext(ctx, input)
-
-	if !d.IsNewResource() && tfawserr.ErrCodeEquals(err, ssoadmin.ErrCodeResourceNotFoundException) {
-		log.Printf("[WARN] Inline Policy for SSO Permission Set (%s) not found, removing from state", permissionSetArn)
+	if !d.IsNewResource() && tfresource.NotFound(err) {
+		log.Printf("[WARN] SSO Permission Set Inline Policy (%s) not found, removing from state", d.Id())
 		d.SetId("")
 		return diags
 	}
 
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "reading Inline Policy for SSO Permission Set (%s): %s", permissionSetArn, err)
-	}
-
-	if output == nil {
-		return sdkdiag.AppendErrorf(diags, "reading Inline Policy for SSO Permission Set (%s): empty output", permissionSetArn)
+		return sdkdiag.AppendErrorf(diags, "reading SSO Permission Set Inline Policy (%s): %s", d.Id(), err)
 	}
 
-	policyToSet, err := verify.PolicyToSet(d.Get("inline_policy").(string), aws.StringValue(output.InlinePolicy))
-
+	policyToSet, err := verify.PolicyToSet(d.Get("inline_policy").(string), policy)
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "reading Inline Policy for SSO Permission Set (%s): %s", permissionSetArn, err)
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
 	d.Set("inline_policy", policyToSet)
-
-	d.Set("instance_arn", instanceArn)
-	d.Set("permission_set_arn", permissionSetArn)
+	d.Set("instance_arn", instanceARN)
+	d.Set("permission_set_arn", permissionSetARN)
 
 	return diags
 }
@@ -137,24 +137,56 @@ func resourcePermissionSetInlinePolicyDelete(ctx context.Context, d *schema.Reso
 	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).SSOAdminConn(ctx)
 
-	permissionSetArn, instanceArn, err := ParseResourceID(d.Id())
+	permissionSetARN, instanceARN, err := ParseResourceID(d.Id())
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "parsing SSO Permission Set Inline Policy ID: %s", err)
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
 	input := &ssoadmin.DeleteInlinePolicyFromPermissionSetInput{
-		InstanceArn:      aws.String(instanceArn),
-		PermissionSetArn: aws.String(permissionSetArn),
+		InstanceArn:      aws.String(instanceARN),
+		PermissionSetArn: aws.String(permissionSetARN),
 	}
 
 	_, err = conn.DeleteInlinePolicyFromPermissionSetWithContext(ctx, input)
 
+	if tfawserr.ErrCodeEquals(err, ssoadmin.ErrCodeResourceNotFoundException) {
+		return diags
+	}
+
 	if err != nil {
-		if tfawserr.ErrCodeEquals(err, ssoadmin.ErrCodeResourceNotFoundException) {
-			return diags
-		}
-		return sdkdiag.AppendErrorf(diags, "detaching Inline Policy from SSO Permission Set (%s): %s", permissionSetArn, err)
+		return sdkdiag.AppendErrorf(diags, "deleting SSO Permission Set (%s) Inline Policy: %s", permissionSetARN, err)
+	}
+
+	// (Re)provision ALL accounts after making the above changes.
+	if err := provisionPermissionSet(ctx, conn, permissionSetARN, instanceARN, d.Timeout(schema.TimeoutDelete)); err != nil {
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
 	return diags
 }
+
+func FindPermissionSetInlinePolicy(ctx context.Context, conn *ssoadmin.SSOAdmin, permissionSetARN, instanceARN string) (string, error) {
+	input := &ssoadmin.GetInlinePolicyForPermissionSetInput{
+		InstanceArn:      aws.String(instanceARN),
+		PermissionSetArn: aws.String(permissionSetARN),
+	}
+
+	output, err := conn.GetInlinePolicyForPermissionSetWithContext(ctx, input)
+
+	if tfawserr.ErrCodeEquals(err, ssoadmin.ErrCodeResourceNotFoundException) {
+		return "", &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+
+	if err != nil {
+		return "", err
+	}
+
+	if output == nil || aws.StringValue(output.InlinePolicy) == "" {
+		return "", tfresource.NewEmptyResultError(input)
+	}
+
+	return aws.StringValue(output.InlinePolicy), nil
+}
diff --git a/internal/service/ssoadmin/permission_set_inline_policy_test.go b/internal/service/ssoadmin/permission_set_inline_policy_test.go
index efe27872110..2d5b61aa41d 100644
--- a/internal/service/ssoadmin/permission_set_inline_policy_test.go
+++ b/internal/service/ssoadmin/permission_set_inline_policy_test.go
@@ -1,20 +1,22 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssoadmin_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/aws"
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/ssoadmin"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	tfssoadmin "github.com/hashicorp/terraform-provider-aws/internal/service/ssoadmin"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
 func TestAccSSOAdminPermissionSetInlinePolicy_basic(t *testing.T) {
@@ -35,8 +37,8 @@ func TestAccSSOAdminPermissionSetInlinePolicy_basic(t *testing.T) {
 					testAccCheckPermissionSetInlinePolicyExists(ctx, resourceName),
 					resource.TestCheckResourceAttrPair(resourceName, "instance_arn", permissionSetResourceName, "instance_arn"),
 					resource.TestCheckResourceAttrPair(resourceName, "permission_set_arn", permissionSetResourceName, "arn"),
-					resource.TestMatchResourceAttr(resourceName, "inline_policy", regexp.MustCompile("s3:ListAllMyBuckets")),
-					resource.TestMatchResourceAttr(resourceName, "inline_policy", regexp.MustCompile("s3:GetBucketLocation")),
+					resource.TestMatchResourceAttr(resourceName, "inline_policy", regexache.MustCompile("s3:ListAllMyBuckets")),
+					resource.TestMatchResourceAttr(resourceName, "inline_policy", regexache.MustCompile("s3:GetBucketLocation")),
 				),
 			},
 			{
@@ -69,7 +71,7 @@ func TestAccSSOAdminPermissionSetInlinePolicy_update(t *testing.T) {
 				Config: testAccPermissionSetInlinePolicyConfig_update(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckPermissionSetInlinePolicyExists(ctx, resourceName),
-					resource.TestMatchResourceAttr(resourceName, "inline_policy", regexp.MustCompile("s3:ListAllMyBuckets")),
+					resource.TestMatchResourceAttr(resourceName, "inline_policy", regexache.MustCompile("s3:ListAllMyBuckets")),
 				),
 			},
 			{
@@ -137,19 +139,14 @@ func testAccCheckPermissionSetInlinePolicyDestroy(ctx context.Context) resource.
 				continue
 			}
 
-			permissionSetArn, instanceArn, err := tfssoadmin.ParseResourceID(rs.Primary.ID)
-
+			permissionSetARN, instanceARN, err := tfssoadmin.ParseResourceID(rs.Primary.ID)
 			if err != nil {
-				return fmt.Errorf("error parsing SSO Permission Set Inline Policy ID (%s): %w", rs.Primary.ID, err)
+				return err
 			}
 
-			input := &ssoadmin.GetInlinePolicyForPermissionSetInput{
-				InstanceArn:      aws.String(instanceArn),
-				PermissionSetArn: aws.String(permissionSetArn),
-			}
+			_, err = tfssoadmin.FindPermissionSetInlinePolicy(ctx, conn, permissionSetARN, instanceARN)
 
-			output, err := conn.GetInlinePolicyForPermissionSetWithContext(ctx, input)
-			if tfawserr.ErrCodeEquals(err, ssoadmin.ErrCodeResourceNotFoundException) {
+			if tfresource.NotFound(err) {
 				continue
 			}
 
@@ -157,56 +154,30 @@ func testAccCheckPermissionSetInlinePolicyDestroy(ctx context.Context) resource.
 				return err
 			}
 
-			if output == nil {
-				continue
-			}
-
-			// SSO API returns empty string when removed from Permission Set
-			if aws.StringValue(output.InlinePolicy) == "" {
-				continue
-			}
-
-			return fmt.Errorf("Inline Policy for SSO PermissionSet (%s) still exists", permissionSetArn)
+			return fmt.Errorf("SSO Permission Set Inline Policy %s still exists", rs.Primary.ID)
 		}
 
 		return nil
 	}
 }
 
-func testAccCheckPermissionSetInlinePolicyExists(ctx context.Context, resourceName string) resource.TestCheckFunc {
+func testAccCheckPermissionSetInlinePolicyExists(ctx context.Context, n string) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		rs, ok := s.RootModule().Resources[resourceName]
+		rs, ok := s.RootModule().Resources[n]
 		if !ok {
-			return fmt.Errorf("Not found: %s", resourceName)
-		}
-
-		if rs.Primary.ID == "" {
-			return fmt.Errorf("Resource (%s) ID not set", resourceName)
+			return fmt.Errorf("Not found: %s", n)
 		}
 
-		permissionSetArn, instanceArn, err := tfssoadmin.ParseResourceID(rs.Primary.ID)
-
+		permissionSetARN, instanceARN, err := tfssoadmin.ParseResourceID(rs.Primary.ID)
 		if err != nil {
-			return fmt.Errorf("error parsing SSO Permission Set Inline Policy ID (%s): %w", rs.Primary.ID, err)
+			return err
 		}
 
 		conn := acctest.Provider.Meta().(*conns.AWSClient).SSOAdminConn(ctx)
 
-		input := &ssoadmin.GetInlinePolicyForPermissionSetInput{
-			InstanceArn:      aws.String(instanceArn),
-			PermissionSetArn: aws.String(permissionSetArn),
-		}
+		_, err = tfssoadmin.FindPermissionSetInlinePolicy(ctx, conn, permissionSetARN, instanceARN)
 
-		output, err := conn.GetInlinePolicyForPermissionSetWithContext(ctx, input)
-		if err != nil {
-			return err
-		}
-
-		if output == nil || output.InlinePolicy == nil {
-			return fmt.Errorf("Inline Policy for SSO Permission Set (%s) not found", permissionSetArn)
-		}
-
-		return nil
+		return err
 	}
 }
 
@@ -232,7 +203,7 @@ data "aws_iam_policy_document" "test" {
 }
 
 resource "aws_ssoadmin_permission_set" "test" {
-  name         = %q
+  name         = %[1]q
   instance_arn = tolist(data.aws_ssoadmin_instances.test.arns)[0]
 }
 
@@ -265,7 +236,7 @@ data "aws_iam_policy_document" "test" {
 }
 
 resource "aws_ssoadmin_permission_set" "test" {
-  name         = %q
+  name         = %[1]q
   instance_arn = tolist(data.aws_ssoadmin_instances.test.arns)[0]
 }
 
diff --git a/internal/service/ssoadmin/permission_set_test.go b/internal/service/ssoadmin/permission_set_test.go
index c658e1a7838..3de22399db5 100644
--- a/internal/service/ssoadmin/permission_set_test.go
+++ b/internal/service/ssoadmin/permission_set_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssoadmin_test
 
 import (
@@ -5,15 +8,14 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ssoadmin"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	tfssoadmin "github.com/hashicorp/terraform-provider-aws/internal/service/ssoadmin"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
 func TestAccSSOAdminPermissionSet_basic(t *testing.T) {
@@ -284,20 +286,14 @@ func testAccCheckPermissionSetDestroy(ctx context.Context) resource.TestCheckFun
 				continue
 			}
 
-			arn, instanceArn, err := tfssoadmin.ParseResourceID(rs.Primary.ID)
-
+			permissionSetARN, instanceARN, err := tfssoadmin.ParseResourceID(rs.Primary.ID)
 			if err != nil {
-				return fmt.Errorf("error parsing SSO Permission Set ID (%s): %w", rs.Primary.ID, err)
-			}
-
-			input := &ssoadmin.DescribePermissionSetInput{
-				InstanceArn:      aws.String(instanceArn),
-				PermissionSetArn: aws.String(arn),
+				return err
 			}
 
-			_, err = conn.DescribePermissionSetWithContext(ctx, input)
+			_, err = tfssoadmin.FindPermissionSet(ctx, conn, permissionSetARN, instanceARN)
 
-			if tfawserr.ErrCodeEquals(err, ssoadmin.ErrCodeResourceNotFoundException) {
+			if tfresource.NotFound(err) {
 				continue
 			}
 
@@ -305,36 +301,28 @@ func testAccCheckPermissionSetDestroy(ctx context.Context) resource.TestCheckFun
 				return err
 			}
 
-			return fmt.Errorf("SSO Permission Set (%s) still exists", arn)
+			return fmt.Errorf("SSO Permission Set %s still exists", rs.Primary.ID)
 		}
 
 		return nil
 	}
 }
 
-func testAccCheckSOAdminPermissionSetExists(ctx context.Context, resourceName string) resource.TestCheckFunc {
+func testAccCheckSOAdminPermissionSetExists(ctx context.Context, n string) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		rs, ok := s.RootModule().Resources[resourceName]
+		rs, ok := s.RootModule().Resources[n]
 		if !ok {
-			return fmt.Errorf("Not found: %s", resourceName)
+			return fmt.Errorf("Not found: %s", n)
 		}
 
-		if rs.Primary.ID == "" {
-			return fmt.Errorf("Resource (%s) ID not set", resourceName)
+		permissionSetARN, instanceARN, err := tfssoadmin.ParseResourceID(rs.Primary.ID)
+		if err != nil {
+			return err
 		}
 
 		conn := acctest.Provider.Meta().(*conns.AWSClient).SSOAdminConn(ctx)
 
-		arn, instanceArn, err := tfssoadmin.ParseResourceID(rs.Primary.ID)
-
-		if err != nil {
-			return fmt.Errorf("error parsing SSO Permission Set ID (%s): %w", rs.Primary.ID, err)
-		}
-
-		_, err = conn.DescribePermissionSetWithContext(ctx, &ssoadmin.DescribePermissionSetInput{
-			InstanceArn:      aws.String(instanceArn),
-			PermissionSetArn: aws.String(arn),
-		})
+		_, err = tfssoadmin.FindPermissionSet(ctx, conn, permissionSetARN, instanceARN)
 
 		return err
 	}
@@ -345,7 +333,7 @@ func testAccPermissionSetConfig_basic(rName string) string {
 data "aws_ssoadmin_instances" "test" {}
 
 resource "aws_ssoadmin_permission_set" "test" {
-  name         = %q
+  name         = %[1]q
   instance_arn = tolist(data.aws_ssoadmin_instances.test.arns)[0]
 }
 `, rName)
@@ -420,7 +408,7 @@ func testAccPermissionSetConfig_tags1(rName, tagKey1, tagValue1 string) string {
 data "aws_ssoadmin_instances" "test" {}
 
 resource "aws_ssoadmin_permission_set" "test" {
-  name         = %q
+  name         = %[1]q
   instance_arn = tolist(data.aws_ssoadmin_instances.test.arns)[0]
 
   tags = {
@@ -435,7 +423,7 @@ func testAccPermissionSetConfig_tags2(rName, tagKey1, tagValue1, tagKey2, tagVal
 data "aws_ssoadmin_instances" "test" {}
 
 resource "aws_ssoadmin_permission_set" "test" {
-  name         = %q
+  name         = %[1]q
   instance_arn = tolist(data.aws_ssoadmin_instances.test.arns)[0]
 
   tags = {
@@ -453,7 +441,7 @@ data "aws_partition" "current" {}
 data "aws_ssoadmin_instances" "test" {}
 
 resource "aws_ssoadmin_permission_set" "test" {
-  name         = %q
+  name         = %[1]q
   instance_arn = tolist(data.aws_ssoadmin_instances.test.arns)[0]
 }
 
diff --git a/internal/service/ssoadmin/permissions_boundary_attachment.go b/internal/service/ssoadmin/permissions_boundary_attachment.go
index 7452f8998ec..92d798699c6 100644
--- a/internal/service/ssoadmin/permissions_boundary_attachment.go
+++ b/internal/service/ssoadmin/permissions_boundary_attachment.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssoadmin
 
 import (
@@ -11,6 +14,7 @@ import (
 	"github.com/aws/aws-sdk-go/service/ssoadmin"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
@@ -19,10 +23,6 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
 )
 
-const (
-	permissionsBoundaryAttachmentTimeout = 5 * time.Minute
-)
-
 // @SDKResource("aws_ssoadmin_permissions_boundary_attachment")
 func ResourcePermissionsBoundaryAttachment() *schema.Resource {
 	return &schema.Resource{
@@ -34,6 +34,11 @@ func ResourcePermissionsBoundaryAttachment() *schema.Resource {
 			StateContext: schema.ImportStatePassthroughContext,
 		},
 
+		Timeouts: &schema.ResourceTimeout{
+			Create: schema.DefaultTimeout(10 * time.Minute),
+			Delete: schema.DefaultTimeout(10 * time.Minute),
+		},
+
 		Schema: map[string]*schema.Schema{
 			"instance_arn": {
 				Type:         schema.TypeString,
@@ -100,15 +105,12 @@ func resourcePermissionsBoundaryAttachmentCreate(ctx context.Context, d *schema.
 	permissionSetARN := d.Get("permission_set_arn").(string)
 	id := PermissionsBoundaryAttachmentCreateResourceID(permissionSetARN, instanceARN)
 	input := &ssoadmin.PutPermissionsBoundaryToPermissionSetInput{
-		PermissionsBoundary: expandPermissionsBoundary(tfMap),
 		InstanceArn:         aws.String(instanceARN),
 		PermissionSetArn:    aws.String(permissionSetARN),
+		PermissionsBoundary: expandPermissionsBoundary(tfMap),
 	}
 
-	log.Printf("[INFO] Attaching permissions boundary to permission set: %s", input)
-	_, err := tfresource.RetryWhenAWSErrCodeEquals(ctx, permissionsBoundaryAttachmentTimeout, func() (interface{}, error) {
-		return conn.PutPermissionsBoundaryToPermissionSetWithContext(ctx, input)
-	}, ssoadmin.ErrCodeConflictException, ssoadmin.ErrCodeThrottlingException)
+	_, err := conn.PutPermissionsBoundaryToPermissionSetWithContext(ctx, input)
 
 	if err != nil {
 		return sdkdiag.AppendErrorf(diags, "creating SSO Permissions Boundary Attachment (%s): %s", id, err)
@@ -117,8 +119,8 @@ func resourcePermissionsBoundaryAttachmentCreate(ctx context.Context, d *schema.
 	d.SetId(id)
 
 	// After the policy has been attached to the permission set, provision in all accounts that use this permission set.
-	if err := provisionPermissionSet(ctx, conn, permissionSetARN, instanceARN); err != nil {
-		return sdkdiag.AppendErrorf(diags, "provisioning SSO Permission Set (%s): %s", permissionSetARN, err)
+	if err := provisionPermissionSet(ctx, conn, permissionSetARN, instanceARN, d.Timeout(schema.TimeoutCreate)); err != nil {
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
 	return append(diags, resourcePermissionsBoundaryAttachmentRead(ctx, d, meta)...)
@@ -129,9 +131,8 @@ func resourcePermissionsBoundaryAttachmentRead(ctx context.Context, d *schema.Re
 	conn := meta.(*conns.AWSClient).SSOAdminConn(ctx)
 
 	permissionSetARN, instanceARN, err := PermissionsBoundaryAttachmentParseResourceID(d.Id())
-
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "reading SSO Permissions Boundary Attachment (%s): %s", d.Id(), err)
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
 	policy, err := FindPermissionsBoundary(ctx, conn, permissionSetARN, instanceARN)
@@ -146,11 +147,11 @@ func resourcePermissionsBoundaryAttachmentRead(ctx context.Context, d *schema.Re
 		return sdkdiag.AppendErrorf(diags, "reading SSO Permissions Boundary Attachment (%s): %s", d.Id(), err)
 	}
 
+	d.Set("instance_arn", instanceARN)
+	d.Set("permission_set_arn", permissionSetARN)
 	if err := d.Set("permissions_boundary", []interface{}{flattenPermissionsBoundary(policy)}); err != nil {
 		return sdkdiag.AppendErrorf(diags, "setting permissions_boundary: %s", err)
 	}
-	d.Set("instance_arn", instanceARN)
-	d.Set("permission_set_arn", permissionSetARN)
 
 	return diags
 }
@@ -160,9 +161,8 @@ func resourcePermissionsBoundaryAttachmentDelete(ctx context.Context, d *schema.
 	conn := meta.(*conns.AWSClient).SSOAdminConn(ctx)
 
 	permissionSetARN, instanceARN, err := PermissionsBoundaryAttachmentParseResourceID(d.Id())
-
 	if err != nil {
-		return sdkdiag.AppendErrorf(diags, "deleting SSO Permissions Boundary Attachment (%s): %s", d.Id(), err)
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
 	input := &ssoadmin.DeletePermissionsBoundaryFromPermissionSetInput{
@@ -170,10 +170,7 @@ func resourcePermissionsBoundaryAttachmentDelete(ctx context.Context, d *schema.
 		PermissionSetArn: aws.String(permissionSetARN),
 	}
 
-	log.Printf("[INFO] Detaching permissions boundary from permission set: %s", input)
-	_, err = tfresource.RetryWhenAWSErrCodeEquals(ctx, permissionsBoundaryAttachmentTimeout, func() (interface{}, error) {
-		return conn.DeletePermissionsBoundaryFromPermissionSetWithContext(ctx, input)
-	}, ssoadmin.ErrCodeConflictException, ssoadmin.ErrCodeThrottlingException)
+	_, err = conn.DeletePermissionsBoundaryFromPermissionSetWithContext(ctx, input)
 
 	if tfawserr.ErrCodeEquals(err, ssoadmin.ErrCodeResourceNotFoundException) {
 		return diags
@@ -184,8 +181,8 @@ func resourcePermissionsBoundaryAttachmentDelete(ctx context.Context, d *schema.
 	}
 
 	// After the policy has been detached from the permission set, provision in all accounts that use this permission set.
-	if err := provisionPermissionSet(ctx, conn, permissionSetARN, instanceARN); err != nil {
-		return sdkdiag.AppendErrorf(diags, "provisioning SSO Permission Set (%s): %s", permissionSetARN, err)
+	if err := provisionPermissionSet(ctx, conn, permissionSetARN, instanceARN, d.Timeout(schema.TimeoutDelete)); err != nil {
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
 	return diags
@@ -210,6 +207,32 @@ func PermissionsBoundaryAttachmentParseResourceID(id string) (string, string, er
 	return "", "", fmt.Errorf("unexpected format for ID (%[1]s), expected PERMISSION_SET_ARN%[2]sINSTANCE_ARN", id, permissionsBoundaryAttachmentIDSeparator)
 }
 
+func FindPermissionsBoundary(ctx context.Context, conn *ssoadmin.SSOAdmin, permissionSetARN, instanceARN string) (*ssoadmin.PermissionsBoundary, error) {
+	input := &ssoadmin.GetPermissionsBoundaryForPermissionSetInput{
+		InstanceArn:      aws.String(instanceARN),
+		PermissionSetArn: aws.String(permissionSetARN),
+	}
+
+	output, err := conn.GetPermissionsBoundaryForPermissionSetWithContext(ctx, input)
+
+	if tfawserr.ErrCodeEquals(err, ssoadmin.ErrCodeResourceNotFoundException) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	if output == nil || output.PermissionsBoundary == nil {
+		return nil, tfresource.NewEmptyResultError(input)
+	}
+
+	return output.PermissionsBoundary, nil
+}
+
 func expandPermissionsBoundary(tfMap map[string]interface{}) *ssoadmin.PermissionsBoundary {
 	if tfMap == nil {
 		return nil
diff --git a/internal/service/ssoadmin/permissions_boundary_attachment_test.go b/internal/service/ssoadmin/permissions_boundary_attachment_test.go
index 3746d2dd481..cd6e9c1d52e 100644
--- a/internal/service/ssoadmin/permissions_boundary_attachment_test.go
+++ b/internal/service/ssoadmin/permissions_boundary_attachment_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssoadmin_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/ssoadmin"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -151,7 +154,7 @@ func TestAccSSOAdminPermissionsBoundaryAttachment_managedPolicyAndCustomerManage
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccPermissionsBoundaryAttachmentConfig_managedPolicyAndCustomerManagedPolicyRefBothDefined(rName, rNamePolicy1, rNamePolicy2),
-				ExpectError: regexp.MustCompile(".*ValidationException: Only ManagedPolicyArn or CustomerManagedPolicyReference should be given.*"),
+				ExpectError: regexache.MustCompile(".*ValidationException: Only ManagedPolicyArn or CustomerManagedPolicyReference should be given.*"),
 			},
 		},
 	})
@@ -167,7 +170,6 @@ func testAccCheckPermissionsBoundaryAttachmentDestroy(ctx context.Context) resou
 			}
 
 			permissionSetARN, instanceARN, err := tfssoadmin.PermissionsBoundaryAttachmentParseResourceID(rs.Primary.ID)
-
 			if err != nil {
 				return err
 			}
@@ -196,12 +198,7 @@ func testAccCheckPermissionsBoundaryAttachmentExists(ctx context.Context, n stri
 			return fmt.Errorf("Not found: %s", n)
 		}
 
-		if rs.Primary.ID == "" {
-			return fmt.Errorf("No SSO Permissions Boundary Attachment ID is set")
-		}
-
 		permissionSetARN, instanceARN, err := tfssoadmin.PermissionsBoundaryAttachmentParseResourceID(rs.Primary.ID)
-
 		if err != nil {
 			return err
 		}
diff --git a/internal/service/ssoadmin/service_package.go b/internal/service/ssoadmin/service_package.go
index 2efee91bf26..82bd75183b1 100644
--- a/internal/service/ssoadmin/service_package.go
+++ b/internal/service/ssoadmin/service_package.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package ssoadmin
 
 import (
@@ -13,8 +16,12 @@ import (
 func (p *servicePackage) CustomizeConn(ctx context.Context, conn *ssoadmin_sdkv1.SSOAdmin) (*ssoadmin_sdkv1.SSOAdmin, error) {
 	// Reference: https://github.com/hashicorp/terraform-provider-aws/issues/19215.
 	conn.Handlers.Retry.PushBack(func(r *request_sdkv1.Request) {
-		if r.Operation.Name == "AttachManagedPolicyToPermissionSet" || r.Operation.Name == "DetachManagedPolicyFromPermissionSet" {
-			if tfawserr.ErrCodeEquals(r.Error, ssoadmin_sdkv1.ErrCodeConflictException) {
+		switch err := r.Error; r.Operation.Name {
+		case "AttachCustomerManagedPolicyReferenceToPermissionSet", "DetachCustomerManagedPolicyReferenceFromPermissionSet",
+			"AttachManagedPolicyToPermissionSet", "DetachManagedPolicyFromPermissionSet",
+			"PutPermissionsBoundaryToPermissionSet", "DeletePermissionsBoundaryFromPermissionSet",
+			"ProvisionPermissionSet":
+			if tfawserr.ErrCodeEquals(err, ssoadmin_sdkv1.ErrCodeConflictException, ssoadmin_sdkv1.ErrCodeThrottlingException) {
 				r.Retryable = aws_sdkv1.Bool(true)
 			}
 		}
diff --git a/internal/service/ssoadmin/service_package_gen.go b/internal/service/ssoadmin/service_package_gen.go
index e197309cb6a..449c444a0ef 100644
--- a/internal/service/ssoadmin/service_package_gen.go
+++ b/internal/service/ssoadmin/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	ssoadmin_sdkv1 "github.com/aws/aws-sdk-go/service/ssoadmin"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -81,4 +82,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*s
 	return ssoadmin_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/ssoadmin/status.go b/internal/service/ssoadmin/status.go
deleted file mode 100644
index 4e1b5ac2d19..00000000000
--- a/internal/service/ssoadmin/status.go
+++ /dev/null
@@ -1,79 +0,0 @@
-package ssoadmin
-
-import (
-	"context"
-
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/ssoadmin"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
-)
-
-const (
-	accountAssignmentStatusUnknown          = "Unknown"
-	accountAssignmentStatusNotFound         = "NotFound"
-	permissionSetProvisioningStatusUnknown  = "Unknown"
-	permissionSetProvisioningStatusNotFound = "NotFound"
-)
-
-func statusAccountAssignmentCreation(ctx context.Context, conn *ssoadmin.SSOAdmin, instanceArn, requestID string) retry.StateRefreshFunc {
-	return func() (interface{}, string, error) {
-		input := &ssoadmin.DescribeAccountAssignmentCreationStatusInput{
-			AccountAssignmentCreationRequestId: aws.String(requestID),
-			InstanceArn:                        aws.String(instanceArn),
-		}
-
-		resp, err := conn.DescribeAccountAssignmentCreationStatusWithContext(ctx, input)
-
-		if err != nil {
-			return nil, accountAssignmentStatusUnknown, err
-		}
-
-		if resp == nil || resp.AccountAssignmentCreationStatus == nil {
-			return nil, accountAssignmentStatusNotFound, nil
-		}
-
-		return resp.AccountAssignmentCreationStatus, aws.StringValue(resp.AccountAssignmentCreationStatus.Status), nil
-	}
-}
-
-func statusAccountAssignmentDeletion(ctx context.Context, conn *ssoadmin.SSOAdmin, instanceArn, requestID string) retry.StateRefreshFunc {
-	return func() (interface{}, string, error) {
-		input := &ssoadmin.DescribeAccountAssignmentDeletionStatusInput{
-			AccountAssignmentDeletionRequestId: aws.String(requestID),
-			InstanceArn:                        aws.String(instanceArn),
-		}
-
-		resp, err := conn.DescribeAccountAssignmentDeletionStatusWithContext(ctx, input)
-
-		if err != nil {
-			return nil, accountAssignmentStatusUnknown, err
-		}
-
-		if resp == nil || resp.AccountAssignmentDeletionStatus == nil {
-			return nil, accountAssignmentStatusNotFound, nil
-		}
-
-		return resp.AccountAssignmentDeletionStatus, aws.StringValue(resp.AccountAssignmentDeletionStatus.Status), nil
-	}
-}
-
-func statusPermissionSetProvisioning(ctx context.Context, conn *ssoadmin.SSOAdmin, instanceArn, requestID string) retry.StateRefreshFunc {
-	return func() (interface{}, string, error) {
-		input := &ssoadmin.DescribePermissionSetProvisioningStatusInput{
-			InstanceArn:                     aws.String(instanceArn),
-			ProvisionPermissionSetRequestId: aws.String(requestID),
-		}
-
-		resp, err := conn.DescribePermissionSetProvisioningStatusWithContext(ctx, input)
-
-		if err != nil {
-			return nil, permissionSetProvisioningStatusUnknown, err
-		}
-
-		if resp == nil || resp.PermissionSetProvisioningStatus == nil {
-			return nil, permissionSetProvisioningStatusNotFound, nil
-		}
-
-		return resp.PermissionSetProvisioningStatus, aws.StringValue(resp.PermissionSetProvisioningStatus.Status), nil
-	}
-}
diff --git a/internal/service/ssoadmin/sweep.go b/internal/service/ssoadmin/sweep.go
index 6b2b1a8125b..ce6c6b5305c 100644
--- a/internal/service/ssoadmin/sweep.go
+++ b/internal/service/ssoadmin/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package ssoadmin
 
@@ -7,17 +7,17 @@ import (
 	"fmt"
 	"log"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ssoadmin"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	"github.com/hashicorp/go-multierror"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep/sdk"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_ssoadmin_account_assignment", &resource.Sweeper{
 		Name: "aws_ssoadmin_account_assignment",
 		F:    sweepAccountAssignments,
@@ -34,7 +34,7 @@ func init() {
 
 func sweepAccountAssignments(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
@@ -43,23 +43,22 @@ func sweepAccountAssignments(region string) error {
 	sweepResources := make([]sweep.Sweepable, 0)
 	var sweeperErrs *multierror.Error
 
+	accessDenied := regexache.MustCompile(`AccessDeniedException: .+ is not authorized to perform:`)
+
 	// Need to Read the SSO Instance first; assumes the first instance returned
 	// is where the permission sets exist as AWS SSO currently supports only 1 instance
 	ds := DataSourceInstances()
 	dsData := ds.Data(nil)
 
-	err = sdk.ReadResource(ctx, ds, dsData, client)
-
-	if tfawserr.ErrCodeContains(err, "AccessDenied") {
-		log.Printf("[WARN] Skipping SSO Account Assignment sweep for %s: %s", region, err)
-		return nil
-	}
-
-	if err != nil {
+	if err := sdk.ReadResource(ctx, ds, dsData, client); err != nil {
+		if accessDenied.MatchString(err.Error()) {
+			log.Printf("[WARN] Skipping SSO Account Assignment sweep for %s: %s", region, err)
+			return nil
+		}
 		return err
 	}
 
-	instanceArn := dsData.Get("arns").(*schema.Set).List()[0].(string)
+	instanceArn := dsData.Get("arns").([]interface{})[0].(string)
 
 	// To sweep account assignments, we need to first determine which Permission Sets
 	// are available and then search for their respective assignments
@@ -110,7 +109,7 @@ func sweepAccountAssignments(region string) error {
 				return !lastPage
 			})
 
-			if sweep.SkipSweepError(err) {
+			if awsv1.SkipSweepError(err) {
 				log.Printf("[WARN] Skipping SSO Account Assignment sweep (PermissionSet %s) for %s: %s", permissionSetArn, region, err)
 				continue
 			}
@@ -122,7 +121,7 @@ func sweepAccountAssignments(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping SSO Account Assignment sweep for %s: %s", region, err)
 		return sweeperErrs.ErrorOrNil() // In case we have completed some pages, but had errors
 	}
@@ -130,7 +129,7 @@ func sweepAccountAssignments(region string) error {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error retrieving SSO Permission Sets for Account Assignment sweep: %w", err))
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error sweeping SSO Account Assignments: %w", err))
 	}
 
@@ -139,7 +138,7 @@ func sweepAccountAssignments(region string) error {
 
 func sweepPermissionSets(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
@@ -148,23 +147,22 @@ func sweepPermissionSets(region string) error {
 	sweepResources := make([]sweep.Sweepable, 0)
 	var sweeperErrs *multierror.Error
 
+	accessDenied := regexache.MustCompile(`AccessDeniedException: .+ is not authorized to perform:`)
+
 	// Need to Read the SSO Instance first; assumes the first instance returned
 	// is where the permission sets exist as AWS SSO currently supports only 1 instance
 	ds := DataSourceInstances()
 	dsData := ds.Data(nil)
 
-	err = sdk.ReadResource(ctx, ds, dsData, client)
-
-	if tfawserr.ErrCodeContains(err, "AccessDenied") {
-		log.Printf("[WARN] Skipping SSO Permission Set sweep for %s: %s", region, err)
-		return nil
-	}
-
-	if err != nil {
+	if err := sdk.ReadResource(ctx, ds, dsData, client); err != nil {
+		if accessDenied.MatchString(err.Error()) {
+			log.Printf("[WARN] Skipping SSO Permission Set sweep for %s: %s", region, err)
+			return nil
+		}
 		return err
 	}
 
-	instanceArn := dsData.Get("arns").(*schema.Set).List()[0].(string)
+	instanceArn := dsData.Get("arns").([]interface{})[0].(string)
 
 	input := &ssoadmin.ListPermissionSetsInput{
 		InstanceArn: aws.String(instanceArn),
@@ -194,7 +192,7 @@ func sweepPermissionSets(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping SSO Permission Set sweep for %s: %s", region, err)
 		return sweeperErrs.ErrorOrNil() // In case we have completed some pages, but had errors
 	}
@@ -202,7 +200,7 @@ func sweepPermissionSets(region string) error {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error retrieving SSO Permission Sets: %w", err))
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error sweeping SSO Permission Sets: %w", err))
 	}
 
diff --git a/internal/service/ssoadmin/tags_gen.go b/internal/service/ssoadmin/tags_gen.go
index e7835f9ecbf..39b9e71ef35 100644
--- a/internal/service/ssoadmin/tags_gen.go
+++ b/internal/service/ssoadmin/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ssoadmin"
 	"github.com/aws/aws-sdk-go/service/ssoadmin/ssoadminiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -103,6 +105,8 @@ func updateTags(ctx context.Context, conn ssoadminiface.SSOAdminAPI, identifier,
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.SSOAdmin)
 	if len(removedTags) > 0 {
diff --git a/internal/service/ssoadmin/wait.go b/internal/service/ssoadmin/wait.go
deleted file mode 100644
index e7e711e4ae7..00000000000
--- a/internal/service/ssoadmin/wait.go
+++ /dev/null
@@ -1,69 +0,0 @@
-package ssoadmin
-
-import (
-	"context"
-	"time"
-
-	"github.com/aws/aws-sdk-go/service/ssoadmin"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
-)
-
-const (
-	accountAssignmentCreateTimeout      = 5 * time.Minute
-	accountAssignmentDeleteTimeout      = 5 * time.Minute
-	accountAssignmentDelay              = 10 * time.Second
-	accountAssignmentMinTimeout         = 5 * time.Second
-	permissionSetProvisioningRetryDelay = 5 * time.Second
-	permissionSetProvisionTimeout       = 10 * time.Minute
-)
-
-func waitAccountAssignmentCreated(ctx context.Context, conn *ssoadmin.SSOAdmin, instanceArn, requestID string) (*ssoadmin.AccountAssignmentOperationStatus, error) {
-	stateConf := &retry.StateChangeConf{
-		Pending:    []string{ssoadmin.StatusValuesInProgress},
-		Target:     []string{ssoadmin.StatusValuesSucceeded},
-		Refresh:    statusAccountAssignmentCreation(ctx, conn, instanceArn, requestID),
-		Timeout:    accountAssignmentCreateTimeout,
-		Delay:      accountAssignmentDelay,
-		MinTimeout: accountAssignmentMinTimeout,
-	}
-
-	outputRaw, err := stateConf.WaitForStateContext(ctx)
-	if v, ok := outputRaw.(*ssoadmin.AccountAssignmentOperationStatus); ok {
-		return v, err
-	}
-
-	return nil, err
-}
-
-func waitAccountAssignmentDeleted(ctx context.Context, conn *ssoadmin.SSOAdmin, instanceArn, requestID string) (*ssoadmin.AccountAssignmentOperationStatus, error) {
-	stateConf := &retry.StateChangeConf{
-		Pending:    []string{ssoadmin.StatusValuesInProgress},
-		Target:     []string{ssoadmin.StatusValuesSucceeded},
-		Refresh:    statusAccountAssignmentDeletion(ctx, conn, instanceArn, requestID),
-		Timeout:    accountAssignmentDeleteTimeout,
-		Delay:      accountAssignmentDelay,
-		MinTimeout: accountAssignmentMinTimeout,
-	}
-
-	outputRaw, err := stateConf.WaitForStateContext(ctx)
-	if v, ok := outputRaw.(*ssoadmin.AccountAssignmentOperationStatus); ok {
-		return v, err
-	}
-
-	return nil, err
-}
-
-func waitPermissionSetProvisioned(ctx context.Context, conn *ssoadmin.SSOAdmin, instanceArn, requestID string) (*ssoadmin.PermissionSetProvisioningStatus, error) {
-	stateConf := retry.StateChangeConf{
-		Delay:   permissionSetProvisioningRetryDelay,
-		Pending: []string{ssoadmin.StatusValuesInProgress},
-		Target:  []string{ssoadmin.StatusValuesSucceeded},
-		Refresh: statusPermissionSetProvisioning(ctx, conn, instanceArn, requestID),
-		Timeout: permissionSetProvisionTimeout,
-	}
-	outputRaw, err := stateConf.WaitForStateContext(ctx)
-	if v, ok := outputRaw.(*ssoadmin.PermissionSetProvisioningStatus); ok {
-		return v, err
-	}
-	return nil, err
-}
diff --git a/internal/service/storagegateway/cache.go b/internal/service/storagegateway/cache.go
index 985a80b12ae..24fa56c78e6 100644
--- a/internal/service/storagegateway/cache.go
+++ b/internal/service/storagegateway/cache.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package storagegateway
 
 import (
diff --git a/internal/service/storagegateway/cache_test.go b/internal/service/storagegateway/cache_test.go
index 79c474d7acf..c2367a24b24 100644
--- a/internal/service/storagegateway/cache_test.go
+++ b/internal/service/storagegateway/cache_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package storagegateway_test
 
 import (
diff --git a/internal/service/storagegateway/cached_iscsi_volume.go b/internal/service/storagegateway/cached_iscsi_volume.go
index fd52e268d2d..0e3bbd7751d 100644
--- a/internal/service/storagegateway/cached_iscsi_volume.go
+++ b/internal/service/storagegateway/cached_iscsi_volume.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package storagegateway
 
 import (
diff --git a/internal/service/storagegateway/cached_iscsi_volume_test.go b/internal/service/storagegateway/cached_iscsi_volume_test.go
index 4379cfcec7e..02af919d68d 100644
--- a/internal/service/storagegateway/cached_iscsi_volume_test.go
+++ b/internal/service/storagegateway/cached_iscsi_volume_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package storagegateway_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/storagegateway"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -91,17 +94,17 @@ func TestAccStorageGatewayCachediSCSIVolume_basic(t *testing.T) {
 				Config: testAccCachediSCSIVolumeConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckCachediSCSIVolumeExists(ctx, resourceName, &cachedIscsiVolume),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "storagegateway", regexp.MustCompile(`gateway/sgw-.+/volume/vol-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "storagegateway", regexache.MustCompile(`gateway/sgw-.+/volume/vol-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "chap_enabled", "false"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "gateway_arn", "storagegateway", regexp.MustCompile(`gateway/sgw-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "gateway_arn", "storagegateway", regexache.MustCompile(`gateway/sgw-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "lun_number", "0"),
-					resource.TestMatchResourceAttr(resourceName, "network_interface_id", regexp.MustCompile(`^\d+\.\d+\.\d+\.\d+$`)),
-					resource.TestMatchResourceAttr(resourceName, "network_interface_port", regexp.MustCompile(`^\d+$`)),
+					resource.TestMatchResourceAttr(resourceName, "network_interface_id", regexache.MustCompile(`^\d+\.\d+\.\d+\.\d+$`)),
+					resource.TestMatchResourceAttr(resourceName, "network_interface_port", regexache.MustCompile(`^\d+$`)),
 					resource.TestCheckResourceAttr(resourceName, "snapshot_id", ""),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "target_arn", "storagegateway", regexp.MustCompile(fmt.Sprintf(`gateway/sgw-.+/target/iqn.1997-05.com.amazon:%s`, rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "target_arn", "storagegateway", regexache.MustCompile(fmt.Sprintf(`gateway/sgw-.+/target/iqn.1997-05.com.amazon:%s`, rName))),
 					resource.TestCheckResourceAttr(resourceName, "target_name", rName),
-					resource.TestMatchResourceAttr(resourceName, "volume_id", regexp.MustCompile(`^vol-.+$`)),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "volume_arn", "storagegateway", regexp.MustCompile(`gateway/sgw-.+/volume/vol-.`)),
+					resource.TestMatchResourceAttr(resourceName, "volume_id", regexache.MustCompile(`^vol-.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "volume_arn", "storagegateway", regexache.MustCompile(`gateway/sgw-.+/volume/vol-.`)),
 					resource.TestCheckResourceAttr(resourceName, "volume_size_in_bytes", "5368709120"),
 					resource.TestCheckResourceAttr(resourceName, "kms_encrypted", "false"),
 				),
@@ -161,7 +164,7 @@ func TestAccStorageGatewayCachediSCSIVolume_tags(t *testing.T) {
 				Config: testAccCachediSCSIVolumeConfig_tags1(rName, "key1", "value1"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckCachediSCSIVolumeExists(ctx, resourceName, &cachedIscsiVolume),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "storagegateway", regexp.MustCompile(`gateway/sgw-.+/volume/vol-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "storagegateway", regexache.MustCompile(`gateway/sgw-.+/volume/vol-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
 				),
@@ -175,7 +178,7 @@ func TestAccStorageGatewayCachediSCSIVolume_tags(t *testing.T) {
 				Config: testAccCachediSCSIVolumeConfig_tags2(rName, "key1", "value1updated", "key2", "value2"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckCachediSCSIVolumeExists(ctx, resourceName, &cachedIscsiVolume),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "storagegateway", regexp.MustCompile(`gateway/sgw-.+/volume/vol-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "storagegateway", regexache.MustCompile(`gateway/sgw-.+/volume/vol-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1updated"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
@@ -185,7 +188,7 @@ func TestAccStorageGatewayCachediSCSIVolume_tags(t *testing.T) {
 				Config: testAccCachediSCSIVolumeConfig_tags1(rName, "key2", "value2"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckCachediSCSIVolumeExists(ctx, resourceName, &cachedIscsiVolume),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "storagegateway", regexp.MustCompile(`gateway/sgw-.+/volume/vol-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "storagegateway", regexache.MustCompile(`gateway/sgw-.+/volume/vol-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
 				),
@@ -210,17 +213,17 @@ func TestAccStorageGatewayCachediSCSIVolume_snapshotID(t *testing.T) {
 				Config: testAccCachediSCSIVolumeConfig_snapshotID(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckCachediSCSIVolumeExists(ctx, resourceName, &cachedIscsiVolume),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "storagegateway", regexp.MustCompile(`gateway/sgw-.+/volume/vol-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "storagegateway", regexache.MustCompile(`gateway/sgw-.+/volume/vol-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "chap_enabled", "false"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "gateway_arn", "storagegateway", regexp.MustCompile(`gateway/sgw-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "gateway_arn", "storagegateway", regexache.MustCompile(`gateway/sgw-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "lun_number", "0"),
-					resource.TestMatchResourceAttr(resourceName, "network_interface_id", regexp.MustCompile(`^\d+\.\d+\.\d+\.\d+$`)),
-					resource.TestMatchResourceAttr(resourceName, "network_interface_port", regexp.MustCompile(`^\d+$`)),
-					resource.TestMatchResourceAttr(resourceName, "snapshot_id", regexp.MustCompile(`^snap-.+$`)),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "target_arn", "storagegateway", regexp.MustCompile(fmt.Sprintf(`gateway/sgw-.+/target/iqn.1997-05.com.amazon:%s`, rName))),
+					resource.TestMatchResourceAttr(resourceName, "network_interface_id", regexache.MustCompile(`^\d+\.\d+\.\d+\.\d+$`)),
+					resource.TestMatchResourceAttr(resourceName, "network_interface_port", regexache.MustCompile(`^\d+$`)),
+					resource.TestMatchResourceAttr(resourceName, "snapshot_id", regexache.MustCompile(`^snap-.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "target_arn", "storagegateway", regexache.MustCompile(fmt.Sprintf(`gateway/sgw-.+/target/iqn.1997-05.com.amazon:%s`, rName))),
 					resource.TestCheckResourceAttr(resourceName, "target_name", rName),
-					resource.TestMatchResourceAttr(resourceName, "volume_id", regexp.MustCompile(`^vol-.+$`)),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "volume_arn", "storagegateway", regexp.MustCompile(`gateway/sgw-.+/volume/vol-.`)),
+					resource.TestMatchResourceAttr(resourceName, "volume_id", regexache.MustCompile(`^vol-.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "volume_arn", "storagegateway", regexache.MustCompile(`gateway/sgw-.+/volume/vol-.`)),
 					resource.TestCheckResourceAttr(resourceName, "volume_size_in_bytes", "5368709120"),
 				),
 			},
@@ -250,16 +253,16 @@ func TestAccStorageGatewayCachediSCSIVolume_sourceVolumeARN(t *testing.T) {
 				Config: testAccCachediSCSIVolumeConfig_sourceARN(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckCachediSCSIVolumeExists(ctx, resourceName, &cachedIscsiVolume),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "storagegateway", regexp.MustCompile(`gateway/sgw-.+/volume/vol-.+`)),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "gateway_arn", "storagegateway", regexp.MustCompile(`gateway/sgw-.+`)),
-					resource.TestMatchResourceAttr(resourceName, "network_interface_id", regexp.MustCompile(`^\d+\.\d+\.\d+\.\d+$`)),
-					resource.TestMatchResourceAttr(resourceName, "network_interface_port", regexp.MustCompile(`^\d+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "storagegateway", regexache.MustCompile(`gateway/sgw-.+/volume/vol-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "gateway_arn", "storagegateway", regexache.MustCompile(`gateway/sgw-.+`)),
+					resource.TestMatchResourceAttr(resourceName, "network_interface_id", regexache.MustCompile(`^\d+\.\d+\.\d+\.\d+$`)),
+					resource.TestMatchResourceAttr(resourceName, "network_interface_port", regexache.MustCompile(`^\d+$`)),
 					resource.TestCheckResourceAttr(resourceName, "snapshot_id", ""),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "source_volume_arn", "storagegateway", regexp.MustCompile(`gateway/sgw-.+/volume/vol-.+`)),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "target_arn", "storagegateway", regexp.MustCompile(fmt.Sprintf(`gateway/sgw-.+/target/iqn.1997-05.com.amazon:%s`, rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "source_volume_arn", "storagegateway", regexache.MustCompile(`gateway/sgw-.+/volume/vol-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "target_arn", "storagegateway", regexache.MustCompile(fmt.Sprintf(`gateway/sgw-.+/target/iqn.1997-05.com.amazon:%s`, rName))),
 					resource.TestCheckResourceAttr(resourceName, "target_name", rName),
-					resource.TestMatchResourceAttr(resourceName, "volume_id", regexp.MustCompile(`^vol-.+$`)),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "volume_arn", "storagegateway", regexp.MustCompile(`gateway/sgw-.+/volume/vol-.`)),
+					resource.TestMatchResourceAttr(resourceName, "volume_id", regexache.MustCompile(`^vol-.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "volume_arn", "storagegateway", regexache.MustCompile(`gateway/sgw-.+/volume/vol-.`)),
 					resource.TestCheckResourceAttr(resourceName, "volume_size_in_bytes", "1073741824"),
 				),
 			},
diff --git a/internal/service/storagegateway/enum.go b/internal/service/storagegateway/enum.go
index a3fc16f57a5..de7e6d2d97d 100644
--- a/internal/service/storagegateway/enum.go
+++ b/internal/service/storagegateway/enum.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package storagegateway
 
 import (
diff --git a/internal/service/storagegateway/errors.go b/internal/service/storagegateway/errors.go
index 33bc7e35d50..39fc3395971 100644
--- a/internal/service/storagegateway/errors.go
+++ b/internal/service/storagegateway/errors.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package storagegateway
 
 import (
diff --git a/internal/service/storagegateway/file_system_association.go b/internal/service/storagegateway/file_system_association.go
index ca9bd561188..3bb5bed4b3a 100644
--- a/internal/service/storagegateway/file_system_association.go
+++ b/internal/service/storagegateway/file_system_association.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package storagegateway
 
 import (
 	"context"
 	"log"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/storagegateway"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
@@ -79,7 +82,7 @@ func ResourceFileSystemAssociation() *schema.Resource {
 				Required:  true,
 				Sensitive: true,
 				ValidateFunc: validation.All(
-					validation.StringMatch(regexp.MustCompile(`^[ -~]+$`), ""),
+					validation.StringMatch(regexache.MustCompile(`^[ -~]+$`), ""),
 					validation.StringLenBetween(1, 1024),
 				),
 			},
@@ -89,7 +92,7 @@ func ResourceFileSystemAssociation() *schema.Resource {
 				Type:     schema.TypeString,
 				Required: true,
 				ValidateFunc: validation.All(
-					validation.StringMatch(regexp.MustCompile(`^\w[\w\.\- ]*$`), ""),
+					validation.StringMatch(regexache.MustCompile(`^\w[\w\.\- ]*$`), ""),
 					validation.StringLenBetween(1, 1024),
 				),
 			},
diff --git a/internal/service/storagegateway/file_system_association_test.go b/internal/service/storagegateway/file_system_association_test.go
index 30cdfb4ba06..b99a5233f4f 100644
--- a/internal/service/storagegateway/file_system_association_test.go
+++ b/internal/service/storagegateway/file_system_association_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package storagegateway_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/storagegateway"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -37,7 +40,7 @@ func TestAccStorageGatewayFileSystemAssociation_basic(t *testing.T) {
 				Config: testAccFileSystemAssociationConfig_required(rName, domainName, username),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckFileSystemAssociationExists(ctx, resourceName, &fileSystemAssociation),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "storagegateway", regexp.MustCompile(`fs-association/fsa-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "storagegateway", regexache.MustCompile(`fs-association/fsa-.+`)),
 					resource.TestCheckResourceAttrPair(resourceName, "gateway_arn", gatewayResourceName, "arn"),
 					resource.TestCheckResourceAttrPair(resourceName, "location_arn", fsxResourceName, "arn"),
 					resource.TestCheckResourceAttr(resourceName, "username", username),
@@ -73,7 +76,7 @@ func TestAccStorageGatewayFileSystemAssociation_tags(t *testing.T) {
 				Config: testAccFileSystemAssociationConfig_tags1(rName, domainName, username, "key1", "value1"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckFileSystemAssociationExists(ctx, resourceName, &fileSystemAssociation),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "storagegateway", regexp.MustCompile(`fs-association/fsa-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "storagegateway", regexache.MustCompile(`fs-association/fsa-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
 				),
@@ -88,7 +91,7 @@ func TestAccStorageGatewayFileSystemAssociation_tags(t *testing.T) {
 				Config: testAccFileSystemAssociationConfig_tags2(rName, domainName, username, "key1", "value1updated", "key2", "value2"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckFileSystemAssociationExists(ctx, resourceName, &fileSystemAssociation),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "storagegateway", regexp.MustCompile(`fs-association/fsa-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "storagegateway", regexache.MustCompile(`fs-association/fsa-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1updated"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
@@ -98,7 +101,7 @@ func TestAccStorageGatewayFileSystemAssociation_tags(t *testing.T) {
 				Config: testAccFileSystemAssociationConfig_tags1(rName, domainName, username, "key2", "value2"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckFileSystemAssociationExists(ctx, resourceName, &fileSystemAssociation),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "storagegateway", regexp.MustCompile(`fs-association/fsa-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "storagegateway", regexache.MustCompile(`fs-association/fsa-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
 				),
diff --git a/internal/service/storagegateway/find.go b/internal/service/storagegateway/find.go
index 24959947767..24c86c5252b 100644
--- a/internal/service/storagegateway/find.go
+++ b/internal/service/storagegateway/find.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package storagegateway
 
 import (
diff --git a/internal/service/storagegateway/gateway.go b/internal/service/storagegateway/gateway.go
index 28b60cdf6e0..a0f57ec47b8 100644
--- a/internal/service/storagegateway/gateway.go
+++ b/internal/service/storagegateway/gateway.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package storagegateway
 
 import (
@@ -6,10 +9,10 @@ import (
 	"log"
 	"net"
 	"net/http"
-	"regexp"
 	"strconv"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/storagegateway"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -21,10 +24,10 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
-	"github.com/hashicorp/terraform-provider-aws/internal/experimental/nullable"
 	"github.com/hashicorp/terraform-provider-aws/internal/flex"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/internal/types/nullable"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -97,7 +100,7 @@ func ResourceGateway() *schema.Resource {
 				Type:     schema.TypeString,
 				Required: true,
 				ValidateFunc: validation.All(
-					validation.StringMatch(regexp.MustCompile(`^[ -\.0-\[\]-~]*[!-\.0-\[\]-~][ -\.0-\[\]-~]*$`), ""),
+					validation.StringMatch(regexache.MustCompile(`^[ -\.0-\[\]-~]*[!-\.0-\[\]-~][ -\.0-\[\]-~]*$`), ""),
 					validation.StringLenBetween(2, 255),
 				),
 			},
@@ -117,8 +120,8 @@ func ResourceGateway() *schema.Resource {
 				Type:     schema.TypeString,
 				Required: true,
 				ValidateFunc: validation.Any(
-					validation.StringMatch(regexp.MustCompile(`^GMT[+-][0-9]{1,2}:[0-9]{2}$`), ""),
-					validation.StringMatch(regexp.MustCompile(`^GMT$`), ""),
+					validation.StringMatch(regexache.MustCompile(`^GMT[+-][0-9]{1,2}:[0-9]{2}$`), ""),
+					validation.StringMatch(regexache.MustCompile(`^GMT$`), ""),
 				),
 			},
 			"gateway_type": {
@@ -189,7 +192,7 @@ func ResourceGateway() *schema.Resource {
 							Elem: &schema.Schema{
 								Type: schema.TypeString,
 								ValidateFunc: validation.All(
-									validation.StringMatch(regexp.MustCompile(`^(([a-zA-Z0-9\-]*[a-zA-Z0-9])\.)*([A-Za-z0-9\-]*[A-Za-z0-9])(:(\d+))?$`), ""),
+									validation.StringMatch(regexache.MustCompile(`^(([0-9A-Za-z-]*[0-9A-Za-z])\.)*([0-9A-Za-z-]*[0-9A-Za-z])(:(\d+))?$`), ""),
 									validation.StringLenBetween(6, 1024),
 								),
 							},
@@ -198,7 +201,7 @@ func ResourceGateway() *schema.Resource {
 							Type:     schema.TypeString,
 							Required: true,
 							ValidateFunc: validation.All(
-								validation.StringMatch(regexp.MustCompile(`^([a-z0-9]+(-[a-z0-9]+)*\.)+[a-z]{2,}$`), ""),
+								validation.StringMatch(regexache.MustCompile(`^([0-9a-z]+(-[0-9a-z]+)*\.)+[a-z]{2,}$`), ""),
 								validation.StringLenBetween(1, 1024),
 							),
 						},
@@ -212,7 +215,7 @@ func ResourceGateway() *schema.Resource {
 							Required:  true,
 							Sensitive: true,
 							ValidateFunc: validation.All(
-								validation.StringMatch(regexp.MustCompile(`^[ -~]+$`), ""),
+								validation.StringMatch(regexache.MustCompile(`^[ -~]+$`), ""),
 								validation.StringLenBetween(1, 1024),
 							),
 						},
@@ -226,7 +229,7 @@ func ResourceGateway() *schema.Resource {
 							Type:     schema.TypeString,
 							Required: true,
 							ValidateFunc: validation.All(
-								validation.StringMatch(regexp.MustCompile(`^\w[\w\.\- ]*$`), ""),
+								validation.StringMatch(regexache.MustCompile(`^\w[\w\.\- ]*$`), ""),
 								validation.StringLenBetween(1, 1024),
 							),
 						},
@@ -242,7 +245,7 @@ func ResourceGateway() *schema.Resource {
 				Optional:  true,
 				Sensitive: true,
 				ValidateFunc: validation.All(
-					validation.StringMatch(regexp.MustCompile(`^[ -~]+$`), ""),
+					validation.StringMatch(regexache.MustCompile(`^[ -~]+$`), ""),
 					validation.StringLenBetween(6, 512),
 				),
 			},
@@ -865,7 +868,7 @@ func expandUpdateMaintenanceStartTimeInput(tfMap map[string]interface{}) *storag
 		apiObject.DayOfMonth = aws.Int64(v)
 	}
 
-	if v, null, _ := nullable.Int(tfMap["day_of_week"].(string)).Value(); !null && v > 0 {
+	if v, null, _ := nullable.Int(tfMap["day_of_week"].(string)).Value(); !null {
 		apiObject.DayOfWeek = aws.Int64(v)
 	}
 
diff --git a/internal/service/storagegateway/gateway_test.go b/internal/service/storagegateway/gateway_test.go
index 89b974b4ede..b30d580e7ec 100644
--- a/internal/service/storagegateway/gateway_test.go
+++ b/internal/service/storagegateway/gateway_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package storagegateway_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"strconv"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/storagegateway"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -33,7 +36,7 @@ func TestAccStorageGatewayGateway_GatewayType_cached(t *testing.T) {
 				Config: testAccGatewayConfig_typeCached(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckGatewayExists(ctx, resourceName, &gateway),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "storagegateway", regexp.MustCompile(`gateway/sgw-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "storagegateway", regexache.MustCompile(`gateway/sgw-.+`)),
 					resource.TestCheckResourceAttrPair(resourceName, "ec2_instance_id", "aws_instance.test", "id"),
 					resource.TestCheckResourceAttr(resourceName, "endpoint_type", "STANDARD"),
 					resource.TestCheckResourceAttrSet(resourceName, "gateway_id"),
@@ -77,7 +80,7 @@ func TestAccStorageGatewayGateway_GatewayType_fileFSxSMB(t *testing.T) {
 				Config: testAccGatewayConfig_typeFileFSxSMB(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckGatewayExists(ctx, resourceName, &gateway),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "storagegateway", regexp.MustCompile(`gateway/sgw-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "storagegateway", regexache.MustCompile(`gateway/sgw-.+`)),
 					resource.TestCheckResourceAttrPair(resourceName, "ec2_instance_id", "aws_instance.test", "id"),
 					resource.TestCheckResourceAttr(resourceName, "endpoint_type", "STANDARD"),
 					resource.TestCheckResourceAttrSet(resourceName, "gateway_id"),
@@ -120,7 +123,7 @@ func TestAccStorageGatewayGateway_GatewayType_fileS3(t *testing.T) {
 				Config: testAccGatewayConfig_typeFileS3(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckGatewayExists(ctx, resourceName, &gateway),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "storagegateway", regexp.MustCompile(`gateway/sgw-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "storagegateway", regexache.MustCompile(`gateway/sgw-.+`)),
 					resource.TestCheckResourceAttrPair(resourceName, "ec2_instance_id", "aws_instance.test", "id"),
 					resource.TestCheckResourceAttr(resourceName, "endpoint_type", "STANDARD"),
 					resource.TestCheckResourceAttrSet(resourceName, "gateway_id"),
@@ -163,7 +166,7 @@ func TestAccStorageGatewayGateway_GatewayType_stored(t *testing.T) {
 				Config: testAccGatewayConfig_typeStored(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckGatewayExists(ctx, resourceName, &gateway),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "storagegateway", regexp.MustCompile(`gateway/sgw-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "storagegateway", regexache.MustCompile(`gateway/sgw-.+`)),
 					resource.TestCheckResourceAttrPair(resourceName, "ec2_instance_id", "aws_instance.test", "id"),
 					resource.TestCheckResourceAttr(resourceName, "endpoint_type", "STANDARD"),
 					resource.TestCheckResourceAttrSet(resourceName, "gateway_id"),
@@ -206,7 +209,7 @@ func TestAccStorageGatewayGateway_GatewayType_vtl(t *testing.T) {
 				Config: testAccGatewayConfig_typeVtl(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckGatewayExists(ctx, resourceName, &gateway),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "storagegateway", regexp.MustCompile(`gateway/sgw-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "storagegateway", regexache.MustCompile(`gateway/sgw-.+`)),
 					resource.TestCheckResourceAttrPair(resourceName, "ec2_instance_id", "aws_instance.test", "id"),
 					resource.TestCheckResourceAttr(resourceName, "endpoint_type", "STANDARD"),
 					resource.TestCheckResourceAttrSet(resourceName, "gateway_id"),
@@ -247,7 +250,7 @@ func TestAccStorageGatewayGateway_tags(t *testing.T) {
 				Config: testAccGatewayConfig_tags1(rName, "key1", "value1"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckGatewayExists(ctx, resourceName, &gateway),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "storagegateway", regexp.MustCompile(`gateway/sgw-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "storagegateway", regexache.MustCompile(`gateway/sgw-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
 				),
@@ -854,6 +857,16 @@ func TestAccStorageGatewayGateway_maintenanceStartTime(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "maintenance_start_time.0.day_of_month", "12"),
 				),
 			},
+			{
+				Config: testAccGatewayConfig_maintenanceStartTime(rName, 21, 10, "0", ""),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckGatewayExists(ctx, resourceName, &gateway),
+					resource.TestCheckResourceAttr(resourceName, "maintenance_start_time.0.hour_of_day", "21"),
+					resource.TestCheckResourceAttr(resourceName, "maintenance_start_time.0.minute_of_hour", "10"),
+					resource.TestCheckResourceAttr(resourceName, "maintenance_start_time.0.day_of_week", "0"),
+					resource.TestCheckResourceAttr(resourceName, "maintenance_start_time.0.day_of_month", ""),
+				),
+			},
 		},
 	})
 }
diff --git a/internal/service/storagegateway/generate.go b/internal/service/storagegateway/generate.go
index ffdde4df9ec..81f7facca18 100644
--- a/internal/service/storagegateway/generate.go
+++ b/internal/service/storagegateway/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTags -ListTagsInIDElem=ResourceARN -ServiceTagsSlice -TagOp=AddTagsToResource -TagInIDElem=ResourceARN -UntagOp=RemoveTagsFromResource -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/storagegateway/local_disk_data_source.go b/internal/service/storagegateway/local_disk_data_source.go
index d2f7b4f0c47..5491285a5a4 100644
--- a/internal/service/storagegateway/local_disk_data_source.go
+++ b/internal/service/storagegateway/local_disk_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package storagegateway
 
 import (
diff --git a/internal/service/storagegateway/local_disk_data_source_test.go b/internal/service/storagegateway/local_disk_data_source_test.go
index af778ee07a6..e4cc7edcea6 100644
--- a/internal/service/storagegateway/local_disk_data_source_test.go
+++ b/internal/service/storagegateway/local_disk_data_source_test.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package storagegateway_test
 
 import (
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/storagegateway"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -25,15 +28,15 @@ func TestAccStorageGatewayLocalDiskDataSource_diskNode(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccLocalDiskDataSourceConfig_nodeNonExistent(rName),
-				ExpectError: regexp.MustCompile(`no results found`),
+				ExpectError: regexache.MustCompile(`no results found`),
 			},
 			{
 				Config: testAccLocalDiskDataSourceConfig_node(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccLocalDiskExistsDataSource(dataSourceName),
-					resource.TestMatchResourceAttr(dataSourceName, "disk_id", regexp.MustCompile(`.+`)),
-					resource.TestMatchResourceAttr(dataSourceName, "disk_node", regexp.MustCompile(`.+`)),
-					resource.TestMatchResourceAttr(dataSourceName, "disk_path", regexp.MustCompile(`.+`)),
+					resource.TestMatchResourceAttr(dataSourceName, "disk_id", regexache.MustCompile(`.+`)),
+					resource.TestMatchResourceAttr(dataSourceName, "disk_node", regexache.MustCompile(`.+`)),
+					resource.TestMatchResourceAttr(dataSourceName, "disk_path", regexache.MustCompile(`.+`)),
 				),
 			},
 		},
@@ -53,15 +56,15 @@ func TestAccStorageGatewayLocalDiskDataSource_diskPath(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccLocalDiskDataSourceConfig_pathNonExistent(rName),
-				ExpectError: regexp.MustCompile(`no results found`),
+				ExpectError: regexache.MustCompile(`no results found`),
 			},
 			{
 				Config: testAccLocalDiskDataSourceConfig_path(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccLocalDiskExistsDataSource(dataSourceName),
-					resource.TestMatchResourceAttr(dataSourceName, "disk_id", regexp.MustCompile(`.+`)),
-					resource.TestMatchResourceAttr(dataSourceName, "disk_node", regexp.MustCompile(`.+`)),
-					resource.TestMatchResourceAttr(dataSourceName, "disk_path", regexp.MustCompile(`.+`)),
+					resource.TestMatchResourceAttr(dataSourceName, "disk_id", regexache.MustCompile(`.+`)),
+					resource.TestMatchResourceAttr(dataSourceName, "disk_node", regexache.MustCompile(`.+`)),
+					resource.TestMatchResourceAttr(dataSourceName, "disk_path", regexache.MustCompile(`.+`)),
 				),
 			},
 		},
diff --git a/internal/service/storagegateway/nfs_file_share.go b/internal/service/storagegateway/nfs_file_share.go
index 1be851249f1..3371be99403 100644
--- a/internal/service/storagegateway/nfs_file_share.go
+++ b/internal/service/storagegateway/nfs_file_share.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package storagegateway
 
 import (
 	"context"
 	"log"
-	"regexp"
 	"strconv"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/storagegateway"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
@@ -165,7 +168,7 @@ func ResourceNFSFileShare() *schema.Resource {
 				Optional: true,
 				Default:  "{}",
 				ValidateFunc: validation.All(
-					validation.StringMatch(regexp.MustCompile(`^\{[\w\s:\{\}\[\]"]*}$`), ""),
+					validation.StringMatch(regexache.MustCompile(`^\{[\w\s:\{\}\[\]"]*}$`), ""),
 					validation.StringLenBetween(2, 100),
 				),
 			},
diff --git a/internal/service/storagegateway/nfs_file_share_test.go b/internal/service/storagegateway/nfs_file_share_test.go
index 1afebb7bbf6..676810d8430 100644
--- a/internal/service/storagegateway/nfs_file_share_test.go
+++ b/internal/service/storagegateway/nfs_file_share_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package storagegateway_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/storagegateway"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -35,14 +38,14 @@ func TestAccStorageGatewayNFSFileShare_basic(t *testing.T) {
 				Config: testAccNFSFileShareConfig_required(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckNFSFileShareExists(ctx, resourceName, &nfsFileShare),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "storagegateway", regexp.MustCompile(`share/share-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "storagegateway", regexache.MustCompile(`share/share-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "bucket_region", ""),
 					resource.TestCheckResourceAttr(resourceName, "cache_attributes.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "client_list.#", "1"),
 					resource.TestCheckTypeSetElemAttr(resourceName, "client_list.*", "0.0.0.0/0"),
 					resource.TestCheckResourceAttr(resourceName, "default_storage_class", "S3_STANDARD"),
 					resource.TestCheckResourceAttr(resourceName, "file_share_name", rName),
-					resource.TestMatchResourceAttr(resourceName, "fileshare_id", regexp.MustCompile(`^share-`)),
+					resource.TestMatchResourceAttr(resourceName, "fileshare_id", regexache.MustCompile(`^share-`)),
 					resource.TestCheckResourceAttrPair(resourceName, "gateway_arn", gatewayResourceName, "arn"),
 					resource.TestCheckResourceAttr(resourceName, "guess_mime_type_enabled", "true"),
 					resource.TestCheckResourceAttr(resourceName, "kms_encrypted", "false"),
@@ -51,7 +54,7 @@ func TestAccStorageGatewayNFSFileShare_basic(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "nfs_file_share_defaults.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "notification_policy", "{}"),
 					resource.TestCheckResourceAttr(resourceName, "object_acl", storagegateway.ObjectACLPrivate),
-					resource.TestMatchResourceAttr(resourceName, "path", regexp.MustCompile(`^/.+`)),
+					resource.TestMatchResourceAttr(resourceName, "path", regexache.MustCompile(`^/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "read_only", "false"),
 					resource.TestCheckResourceAttr(resourceName, "requester_pays", "false"),
 					resource.TestCheckResourceAttrPair(resourceName, "role_arn", iamResourceName, "arn"),
@@ -122,7 +125,7 @@ func TestAccStorageGatewayNFSFileShare_tags(t *testing.T) {
 				Config: testAccNFSFileShareConfig_tags1(rName, "key1", "value1"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckNFSFileShareExists(ctx, resourceName, &nfsFileShare),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "storagegateway", regexp.MustCompile(`share/share-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "storagegateway", regexache.MustCompile(`share/share-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
 				),
@@ -136,7 +139,7 @@ func TestAccStorageGatewayNFSFileShare_tags(t *testing.T) {
 				Config: testAccNFSFileShareConfig_tags2(rName, "key1", "value1updated", "key2", "value2"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckNFSFileShareExists(ctx, resourceName, &nfsFileShare),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "storagegateway", regexp.MustCompile(`share/share-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "storagegateway", regexache.MustCompile(`share/share-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1updated"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
@@ -146,7 +149,7 @@ func TestAccStorageGatewayNFSFileShare_tags(t *testing.T) {
 				Config: testAccNFSFileShareConfig_tags1(rName, "key2", "value2"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckNFSFileShareExists(ctx, resourceName, &nfsFileShare),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "storagegateway", regexp.MustCompile(`share/share-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "storagegateway", regexache.MustCompile(`share/share-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
 				),
@@ -320,7 +323,7 @@ func TestAccStorageGatewayNFSFileShare_kmsEncrypted(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccNFSFileShareConfig_kmsEncrypted(rName, true),
-				ExpectError: regexp.MustCompile(`KMSKey is missing`),
+				ExpectError: regexache.MustCompile(`KMSKey is missing`),
 			},
 			{
 				Config: testAccNFSFileShareConfig_kmsEncrypted(rName, false),
diff --git a/internal/service/storagegateway/service_package.go b/internal/service/storagegateway/service_package.go
index 5f8f917bd42..94d404b25ea 100644
--- a/internal/service/storagegateway/service_package.go
+++ b/internal/service/storagegateway/service_package.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package storagegateway
 
 import (
diff --git a/internal/service/storagegateway/service_package_gen.go b/internal/service/storagegateway/service_package_gen.go
index 855d9d391ee..0cf1748bd0d 100644
--- a/internal/service/storagegateway/service_package_gen.go
+++ b/internal/service/storagegateway/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	storagegateway_sdkv1 "github.com/aws/aws-sdk-go/service/storagegateway"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -115,4 +116,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*s
 	return storagegateway_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/storagegateway/smb_file_share.go b/internal/service/storagegateway/smb_file_share.go
index fe92065db52..db4bf1b3e11 100644
--- a/internal/service/storagegateway/smb_file_share.go
+++ b/internal/service/storagegateway/smb_file_share.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package storagegateway
 
 import (
 	"context"
 	"log"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/storagegateway"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
@@ -158,7 +161,7 @@ func ResourceSMBFileShare() *schema.Resource {
 				Optional: true,
 				Default:  "{}",
 				ValidateFunc: validation.All(
-					validation.StringMatch(regexp.MustCompile(`^\{[\w\s:\{\}\[\]"]*}$`), ""),
+					validation.StringMatch(regexache.MustCompile(`^\{[\w\s:\{\}\[\]"]*}$`), ""),
 					validation.StringLenBetween(2, 100),
 				),
 			},
@@ -402,6 +405,8 @@ func resourceSMBFileShareUpdate(ctx context.Context, d *schema.ResourceData, met
 		// This value can only be set when KMSEncrypted is true.
 		if d.HasChange("kms_key_arn") && d.Get("kms_encrypted").(bool) {
 			input.KMSKey = aws.String(d.Get("kms_key_arn").(string))
+		} else if d.Get("kms_encrypted").(bool) && d.Get("kms_key_arn").(string) != "" {
+			input.KMSKey = aws.String(d.Get("kms_key_arn").(string))
 		}
 
 		if d.HasChange("notification_policy") {
diff --git a/internal/service/storagegateway/smb_file_share_test.go b/internal/service/storagegateway/smb_file_share_test.go
index af56abe1858..8b39af32d0e 100644
--- a/internal/service/storagegateway/smb_file_share_test.go
+++ b/internal/service/storagegateway/smb_file_share_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package storagegateway_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/storagegateway"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -36,11 +39,11 @@ func TestAccStorageGatewaySMBFileShare_Authentication_activeDirectory(t *testing
 				Config: testAccSMBFileShareConfig_authenticationActiveDirectory(rName, domainName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckSMBFileShareExists(ctx, resourceName, &smbFileShare),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "storagegateway", regexp.MustCompile(`share/share-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "storagegateway", regexache.MustCompile(`share/share-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "authentication", "ActiveDirectory"),
 					resource.TestCheckResourceAttr(resourceName, "default_storage_class", "S3_STANDARD"),
-					resource.TestMatchResourceAttr(resourceName, "fileshare_id", regexp.MustCompile(`^share-`)),
-					resource.TestMatchResourceAttr(resourceName, "file_share_name", regexp.MustCompile(`^tf-acc-test-`)),
+					resource.TestMatchResourceAttr(resourceName, "fileshare_id", regexache.MustCompile(`^share-`)),
+					resource.TestMatchResourceAttr(resourceName, "file_share_name", regexache.MustCompile(`^tf-acc-test-`)),
 					resource.TestCheckResourceAttrPair(resourceName, "gateway_arn", gatewayResourceName, "arn"),
 					resource.TestCheckResourceAttr(resourceName, "guess_mime_type_enabled", "true"),
 					resource.TestCheckResourceAttr(resourceName, "invalid_user_list.#", "0"),
@@ -48,7 +51,7 @@ func TestAccStorageGatewaySMBFileShare_Authentication_activeDirectory(t *testing
 					resource.TestCheckResourceAttr(resourceName, "kms_key_arn", ""),
 					resource.TestCheckResourceAttrPair(resourceName, "location_arn", bucketResourceName, "arn"),
 					resource.TestCheckResourceAttr(resourceName, "object_acl", storagegateway.ObjectACLPrivate),
-					resource.TestMatchResourceAttr(resourceName, "path", regexp.MustCompile(`^/.+`)),
+					resource.TestMatchResourceAttr(resourceName, "path", regexache.MustCompile(`^/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "read_only", "false"),
 					resource.TestCheckResourceAttr(resourceName, "requester_pays", "false"),
 					resource.TestCheckResourceAttrPair(resourceName, "role_arn", iamResourceName, "arn"),
@@ -87,13 +90,13 @@ func TestAccStorageGatewaySMBFileShare_Authentication_guestAccess(t *testing.T)
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckSMBFileShareExists(ctx, resourceName, &smbFileShare),
 					resource.TestCheckResourceAttr(resourceName, "admin_user_list.#", "0"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "storagegateway", regexp.MustCompile(`share/share-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "storagegateway", regexache.MustCompile(`share/share-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "authentication", "GuestAccess"),
 					resource.TestCheckResourceAttr(resourceName, "cache_attributes.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "case_sensitivity", "ClientSpecified"),
 					resource.TestCheckResourceAttr(resourceName, "default_storage_class", "S3_STANDARD"),
-					resource.TestMatchResourceAttr(resourceName, "fileshare_id", regexp.MustCompile(`^share-`)),
-					resource.TestMatchResourceAttr(resourceName, "file_share_name", regexp.MustCompile(`^tf-acc-test-`)),
+					resource.TestMatchResourceAttr(resourceName, "fileshare_id", regexache.MustCompile(`^share-`)),
+					resource.TestMatchResourceAttr(resourceName, "file_share_name", regexache.MustCompile(`^tf-acc-test-`)),
 					resource.TestCheckResourceAttrPair(resourceName, "gateway_arn", gatewayResourceName, "arn"),
 					resource.TestCheckResourceAttr(resourceName, "guess_mime_type_enabled", "true"),
 					resource.TestCheckResourceAttr(resourceName, "invalid_user_list.#", "0"),
@@ -237,6 +240,38 @@ func TestAccStorageGatewaySMBFileShare_defaultStorageClass(t *testing.T) {
 	})
 }
 
+func TestAccStorageGatewaySMBFileShare_encryptedUpdate(t *testing.T) {
+	ctx := acctest.Context(t)
+	var smbFileShare storagegateway.SMBFileShareInfo
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_storagegateway_smb_file_share.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, storagegateway.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckSMBFileShareDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccSMBFileShareConfig_encryptedUpdate(rName, false),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckSMBFileShareExists(ctx, resourceName, &smbFileShare),
+					resource.TestCheckResourceAttr(resourceName, "read_only", "false"),
+					resource.TestCheckResourceAttr(resourceName, "kms_encrypted", "true"),
+				),
+			},
+			{
+				Config: testAccSMBFileShareConfig_encryptedUpdate(rName, true),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckSMBFileShareExists(ctx, resourceName, &smbFileShare),
+					resource.TestCheckResourceAttr(resourceName, "read_only", "true"),
+					resource.TestCheckResourceAttr(resourceName, "kms_encrypted", "true"),
+				),
+			},
+		},
+	})
+}
+
 func TestAccStorageGatewaySMBFileShare_fileShareName(t *testing.T) {
 	ctx := acctest.Context(t)
 	var smbFileShare storagegateway.SMBFileShareInfo
@@ -463,7 +498,7 @@ func TestAccStorageGatewaySMBFileShare_kmsEncrypted(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccSMBFileShareConfig_kmsEncrypted(rName, true),
-				ExpectError: regexp.MustCompile(`KMSKey is missing`),
+				ExpectError: regexache.MustCompile(`KMSKey is missing`),
 			},
 			{
 				Config: testAccSMBFileShareConfig_kmsEncrypted(rName, false),
@@ -1117,6 +1152,26 @@ resource "aws_storagegateway_smb_file_share" "test" {
 `, defaultStorageClass))
 }
 
+func testAccSMBFileShareConfig_encryptedUpdate(rName string, readOnly bool) string {
+	return acctest.ConfigCompose(testAcc_SMBFileShare_GuestAccessBase(rName), fmt.Sprintf(`
+resource "aws_kms_key" "test" {
+  deletion_window_in_days = 7
+  description             = "Terraform Acceptance Testing"
+}
+
+resource "aws_storagegateway_smb_file_share" "test" {
+  # Use GuestAccess to simplify testing
+  authentication = "GuestAccess"
+  gateway_arn    = aws_storagegateway_gateway.test.arn
+  kms_encrypted  = true
+  kms_key_arn    = aws_kms_key.test.arn
+  location_arn   = aws_s3_bucket.test.arn
+  role_arn       = aws_iam_role.test.arn
+  read_only      = %[1]t
+}
+`, readOnly))
+}
+
 func testAccSMBFileShareConfig_name(rName, fileShareName string) string {
 	return acctest.ConfigCompose(testAcc_SMBFileShare_GuestAccessBase(rName), fmt.Sprintf(`
 resource "aws_storagegateway_smb_file_share" "test" {
diff --git a/internal/service/storagegateway/status.go b/internal/service/storagegateway/status.go
index 65dc49499c8..c2cd9a1b339 100644
--- a/internal/service/storagegateway/status.go
+++ b/internal/service/storagegateway/status.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package storagegateway
 
 import (
diff --git a/internal/service/storagegateway/stored_iscsi_volume.go b/internal/service/storagegateway/stored_iscsi_volume.go
index b7c6e071e51..3a5d783ca86 100644
--- a/internal/service/storagegateway/stored_iscsi_volume.go
+++ b/internal/service/storagegateway/stored_iscsi_volume.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package storagegateway
 
 import (
diff --git a/internal/service/storagegateway/stored_iscsi_volume_test.go b/internal/service/storagegateway/stored_iscsi_volume_test.go
index b8e50a223b6..29084e21c62 100644
--- a/internal/service/storagegateway/stored_iscsi_volume_test.go
+++ b/internal/service/storagegateway/stored_iscsi_volume_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package storagegateway_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/storagegateway"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -35,16 +38,16 @@ func TestAccStorageGatewayStorediSCSIVolume_basic(t *testing.T) {
 					testAccCheckStorediSCSIVolumeExists(ctx, resourceName, &storedIscsiVolume),
 					resource.TestCheckResourceAttr(resourceName, "preserve_existing_data", "false"),
 					resource.TestCheckResourceAttrPair(resourceName, "disk_id", "data.aws_storagegateway_local_disk.test", "id"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "storagegateway", regexp.MustCompile(`gateway/sgw-.+/volume/vol-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "storagegateway", regexache.MustCompile(`gateway/sgw-.+/volume/vol-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "chap_enabled", "false"),
 					resource.TestCheckResourceAttrPair(resourceName, "gateway_arn", "aws_storagegateway_gateway.test", "arn"),
 					resource.TestCheckResourceAttr(resourceName, "lun_number", "0"),
 					resource.TestCheckResourceAttrPair(resourceName, "network_interface_id", "aws_instance.test", "private_ip"),
-					resource.TestMatchResourceAttr(resourceName, "network_interface_port", regexp.MustCompile(`^\d+$`)),
+					resource.TestMatchResourceAttr(resourceName, "network_interface_port", regexache.MustCompile(`^\d+$`)),
 					resource.TestCheckResourceAttr(resourceName, "snapshot_id", ""),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "target_arn", "storagegateway", regexp.MustCompile(fmt.Sprintf(`gateway/sgw-.+/target/iqn.1997-05.com.amazon:%s`, rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "target_arn", "storagegateway", regexache.MustCompile(fmt.Sprintf(`gateway/sgw-.+/target/iqn.1997-05.com.amazon:%s`, rName))),
 					resource.TestCheckResourceAttr(resourceName, "target_name", rName),
-					resource.TestMatchResourceAttr(resourceName, "volume_id", regexp.MustCompile(`^vol-+`)),
+					resource.TestMatchResourceAttr(resourceName, "volume_id", regexache.MustCompile(`^vol-+`)),
 					resource.TestCheckResourceAttr(resourceName, "volume_size_in_bytes", "10737418240"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 					resource.TestCheckResourceAttr(resourceName, "kms_encrypted", "false"),
@@ -105,7 +108,7 @@ func TestAccStorageGatewayStorediSCSIVolume_tags(t *testing.T) {
 				Config: testAccStorediSCSIVolumeConfig_tags1(rName, "key1", "value1"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckStorediSCSIVolumeExists(ctx, resourceName, &storedIscsiVolume),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "storagegateway", regexp.MustCompile(`gateway/sgw-.+/volume/vol-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "storagegateway", regexache.MustCompile(`gateway/sgw-.+/volume/vol-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
 				),
@@ -119,7 +122,7 @@ func TestAccStorageGatewayStorediSCSIVolume_tags(t *testing.T) {
 				Config: testAccStorediSCSIVolumeConfig_tags2(rName, "key1", "value1updated", "key2", "value2"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckStorediSCSIVolumeExists(ctx, resourceName, &storedIscsiVolume),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "storagegateway", regexp.MustCompile(`gateway/sgw-.+/volume/vol-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "storagegateway", regexache.MustCompile(`gateway/sgw-.+/volume/vol-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1updated"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
@@ -129,7 +132,7 @@ func TestAccStorageGatewayStorediSCSIVolume_tags(t *testing.T) {
 				Config: testAccStorediSCSIVolumeConfig_tags1(rName, "key2", "value2"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckStorediSCSIVolumeExists(ctx, resourceName, &storedIscsiVolume),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "storagegateway", regexp.MustCompile(`gateway/sgw-.+/volume/vol-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "storagegateway", regexache.MustCompile(`gateway/sgw-.+/volume/vol-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
 				),
@@ -154,16 +157,16 @@ func TestAccStorageGatewayStorediSCSIVolume_snapshotID(t *testing.T) {
 				Config: testAccStorediSCSIVolumeConfig_snapshotID(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckStorediSCSIVolumeExists(ctx, resourceName, &storedIscsiVolume),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "storagegateway", regexp.MustCompile(`gateway/sgw-.+/volume/vol-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "storagegateway", regexache.MustCompile(`gateway/sgw-.+/volume/vol-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "chap_enabled", "false"),
 					resource.TestCheckResourceAttrPair(resourceName, "gateway_arn", "aws_storagegateway_gateway.test", "arn"),
 					resource.TestCheckResourceAttr(resourceName, "lun_number", "0"),
 					resource.TestCheckResourceAttrPair(resourceName, "network_interface_id", "aws_instance.test", "private_ip"),
-					resource.TestMatchResourceAttr(resourceName, "network_interface_port", regexp.MustCompile(`^\d+$`)),
+					resource.TestMatchResourceAttr(resourceName, "network_interface_port", regexache.MustCompile(`^\d+$`)),
 					resource.TestCheckResourceAttrPair(resourceName, "snapshot_id", "aws_ebs_snapshot.test", "id"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "target_arn", "storagegateway", regexp.MustCompile(fmt.Sprintf(`gateway/sgw-.+/target/iqn.1997-05.com.amazon:%s`, rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "target_arn", "storagegateway", regexache.MustCompile(fmt.Sprintf(`gateway/sgw-.+/target/iqn.1997-05.com.amazon:%s`, rName))),
 					resource.TestCheckResourceAttr(resourceName, "target_name", rName),
-					resource.TestMatchResourceAttr(resourceName, "volume_id", regexp.MustCompile(`^vol-+`)),
+					resource.TestMatchResourceAttr(resourceName, "volume_id", regexache.MustCompile(`^vol-+`)),
 					resource.TestCheckResourceAttr(resourceName, "volume_size_in_bytes", "10737418240"),
 				),
 			},
diff --git a/internal/service/storagegateway/sweep.go b/internal/service/storagegateway/sweep.go
index ddf94c8ab9a..f5d0b7c9954 100644
--- a/internal/service/storagegateway/sweep.go
+++ b/internal/service/storagegateway/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package storagegateway
 
@@ -11,9 +11,10 @@ import (
 	"github.com/aws/aws-sdk-go/service/storagegateway"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_storagegateway_gateway", &resource.Sweeper{
 		Name: "aws_storagegateway_gateway",
 		F:    sweepGateways,
@@ -35,7 +36,7 @@ func init() {
 
 func sweepGateways(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -59,7 +60,7 @@ func sweepGateways(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Storage Gateway Gateway sweep for %s: %s", region, err)
 		return nil
 	}
@@ -68,7 +69,7 @@ func sweepGateways(region string) error {
 		return fmt.Errorf("error listing Storage Gateway Gateways (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping Storage Gateway Gateways (%s): %w", region, err)
@@ -79,7 +80,7 @@ func sweepGateways(region string) error {
 
 func sweepTapePools(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -103,7 +104,7 @@ func sweepTapePools(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Storage Gateway Tape Pool sweep for %s: %s", region, err)
 		return nil
 	}
@@ -112,7 +113,7 @@ func sweepTapePools(region string) error {
 		return fmt.Errorf("error listing Storage Gateway Tape Pools (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping Storage Gateway Gateways (%s): %w", region, err)
@@ -123,7 +124,7 @@ func sweepTapePools(region string) error {
 
 func sweepFileSystemAssociations(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -147,7 +148,7 @@ func sweepFileSystemAssociations(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Storage Gateway File System Association sweep for %s: %s", region, err)
 		return nil
 	}
@@ -156,7 +157,7 @@ func sweepFileSystemAssociations(region string) error {
 		return fmt.Errorf("error listing Storage Gateway File System Associations (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping Storage Gateway File System Associations (%s): %w", region, err)
diff --git a/internal/service/storagegateway/tags_gen.go b/internal/service/storagegateway/tags_gen.go
index c39265634c2..d92eba0c188 100644
--- a/internal/service/storagegateway/tags_gen.go
+++ b/internal/service/storagegateway/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/storagegateway"
 	"github.com/aws/aws-sdk-go/service/storagegateway/storagegatewayiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -102,6 +104,8 @@ func updateTags(ctx context.Context, conn storagegatewayiface.StorageGatewayAPI,
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.StorageGateway)
 	if len(removedTags) > 0 {
diff --git a/internal/service/storagegateway/tape_pool.go b/internal/service/storagegateway/tape_pool.go
index 25a68b858e3..0c8052dde99 100644
--- a/internal/service/storagegateway/tape_pool.go
+++ b/internal/service/storagegateway/tape_pool.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package storagegateway
 
 import (
diff --git a/internal/service/storagegateway/tape_pool_test.go b/internal/service/storagegateway/tape_pool_test.go
index b1c4843abc6..dae57979b27 100644
--- a/internal/service/storagegateway/tape_pool_test.go
+++ b/internal/service/storagegateway/tape_pool_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package storagegateway_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/storagegateway"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -32,7 +35,7 @@ func TestAccStorageGatewayTapePool_basic(t *testing.T) {
 				Config: testAccTapePoolConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckTapePoolExists(ctx, resourceName, &TapePool),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "storagegateway", regexp.MustCompile(`tapepool/pool-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "storagegateway", regexache.MustCompile(`tapepool/pool-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "pool_name", rName),
 					resource.TestCheckResourceAttr(resourceName, "storage_class", "GLACIER"),
 					resource.TestCheckResourceAttr(resourceName, "retention_lock_type", "NONE"),
@@ -64,7 +67,7 @@ func TestAccStorageGatewayTapePool_retention(t *testing.T) {
 				Config: testAccTapePoolConfig_retention(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckTapePoolExists(ctx, resourceName, &TapePool),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "storagegateway", regexp.MustCompile(`tapepool/pool-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "storagegateway", regexache.MustCompile(`tapepool/pool-.+`)),
 					resource.TestCheckResourceAttr(resourceName, "pool_name", rName),
 					resource.TestCheckResourceAttr(resourceName, "storage_class", "GLACIER"),
 					resource.TestCheckResourceAttr(resourceName, "retention_lock_type", "GOVERNANCE"),
diff --git a/internal/service/storagegateway/upload_buffer.go b/internal/service/storagegateway/upload_buffer.go
index 3d33bea6ad4..db89b463e07 100644
--- a/internal/service/storagegateway/upload_buffer.go
+++ b/internal/service/storagegateway/upload_buffer.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package storagegateway
 
 import (
diff --git a/internal/service/storagegateway/upload_buffer_test.go b/internal/service/storagegateway/upload_buffer_test.go
index b9f9702df32..18bac637115 100644
--- a/internal/service/storagegateway/upload_buffer_test.go
+++ b/internal/service/storagegateway/upload_buffer_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package storagegateway_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/storagegateway"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -126,7 +129,7 @@ func TestAccStorageGatewayUploadBuffer_diskPath(t *testing.T) {
 				Config: testAccUploadBufferConfig_diskPath(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckUploadBufferExists(ctx, resourceName),
-					resource.TestMatchResourceAttr(resourceName, "disk_id", regexp.MustCompile(`.+`)),
+					resource.TestMatchResourceAttr(resourceName, "disk_id", regexache.MustCompile(`.+`)),
 					resource.TestCheckResourceAttrPair(resourceName, "disk_path", localDiskDataSourceName, "disk_path"),
 					resource.TestCheckResourceAttrPair(resourceName, "gateway_arn", gatewayResourceName, "arn"),
 				),
diff --git a/internal/service/storagegateway/validate.go b/internal/service/storagegateway/validate.go
index fea400d7477..4b3a7ca69e2 100644
--- a/internal/service/storagegateway/validate.go
+++ b/internal/service/storagegateway/validate.go
@@ -1,9 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package storagegateway
 
 import (
 	"fmt"
-	"regexp"
 	"strconv"
+
+	"github.com/YakDriver/regexache"
 )
 
 func valid4ByteASN(v interface{}, k string) (ws []string, errors []error) {
@@ -23,7 +27,7 @@ func valid4ByteASN(v interface{}, k string) (ws []string, errors []error) {
 
 func validLinuxFileMode(v interface{}, k string) (ws []string, errors []error) {
 	value := v.(string)
-	if !regexp.MustCompile(`^[0-7]{4}$`).MatchString(value) {
+	if !regexache.MustCompile(`^[0-7]{4}$`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"only valid linux mode is allowed in %q", k))
 	}
diff --git a/internal/service/storagegateway/validate_test.go b/internal/service/storagegateway/validate_test.go
index ca9dcef54be..8658b8c8e45 100644
--- a/internal/service/storagegateway/validate_test.go
+++ b/internal/service/storagegateway/validate_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package storagegateway
 
 import (
diff --git a/internal/service/storagegateway/wait.go b/internal/service/storagegateway/wait.go
index 5fe91090ef2..4ecd5eecce9 100644
--- a/internal/service/storagegateway/wait.go
+++ b/internal/service/storagegateway/wait.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package storagegateway
 
 import (
diff --git a/internal/service/storagegateway/working_storage.go b/internal/service/storagegateway/working_storage.go
index 7eb0b463856..eb854ef452e 100644
--- a/internal/service/storagegateway/working_storage.go
+++ b/internal/service/storagegateway/working_storage.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package storagegateway
 
 import (
diff --git a/internal/service/storagegateway/working_storage_test.go b/internal/service/storagegateway/working_storage_test.go
index 6280cbf1019..b47278df58d 100644
--- a/internal/service/storagegateway/working_storage_test.go
+++ b/internal/service/storagegateway/working_storage_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package storagegateway_test
 
 import (
diff --git a/internal/service/sts/caller_identity_data_source.go b/internal/service/sts/caller_identity_data_source.go
index 8414ab53761..f19339cc9e0 100644
--- a/internal/service/sts/caller_identity_data_source.go
+++ b/internal/service/sts/caller_identity_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sts
 
 import (
@@ -7,8 +10,8 @@ import (
 	"github.com/hashicorp/terraform-plugin-framework/datasource"
 	"github.com/hashicorp/terraform-plugin-framework/datasource/schema"
 	"github.com/hashicorp/terraform-plugin-framework/types"
-	"github.com/hashicorp/terraform-provider-aws/internal/flex"
 	"github.com/hashicorp/terraform-provider-aws/internal/framework"
+	"github.com/hashicorp/terraform-provider-aws/internal/framework/flex"
 )
 
 // @FrameworkDataSource
diff --git a/internal/service/sts/caller_identity_data_source_test.go b/internal/service/sts/caller_identity_data_source_test.go
index df528cb7426..bafd5132283 100644
--- a/internal/service/sts/caller_identity_data_source_test.go
+++ b/internal/service/sts/caller_identity_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sts_test
 
 import (
diff --git a/internal/service/sts/find.go b/internal/service/sts/find.go
index 25a02ecf302..7c66d2fac90 100644
--- a/internal/service/sts/find.go
+++ b/internal/service/sts/find.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sts
 
 import (
diff --git a/internal/service/sts/generate.go b/internal/service/sts/generate.go
index dfe3c91f0ff..13d93447bc2 100644
--- a/internal/service/sts/generate.go
+++ b/internal/service/sts/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
 
diff --git a/internal/service/sts/service_package.go b/internal/service/sts/service_package.go
index 6270e6fb27e..43d41ed0710 100644
--- a/internal/service/sts/service_package.go
+++ b/internal/service/sts/service_package.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sts
 
 import (
diff --git a/internal/service/sts/service_package_gen.go b/internal/service/sts/service_package_gen.go
index 295656d10f8..87d193deb30 100644
--- a/internal/service/sts/service_package_gen.go
+++ b/internal/service/sts/service_package_gen.go
@@ -5,6 +5,7 @@ package sts
 import (
 	"context"
 
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -35,4 +36,6 @@ func (p *servicePackage) ServicePackageName() string {
 	return names.STS
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/swf/domain.go b/internal/service/swf/domain.go
index 6e87e7153ee..e854bbeae49 100644
--- a/internal/service/swf/domain.go
+++ b/internal/service/swf/domain.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package swf
 
 import (
diff --git a/internal/service/swf/domain_test.go b/internal/service/swf/domain_test.go
index 94136f9b3df..8b6816ac7a4 100644
--- a/internal/service/swf/domain_test.go
+++ b/internal/service/swf/domain_test.go
@@ -1,13 +1,16 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package swf_test
 
 import (
 	"context"
 	"fmt"
 	"os"
-	"regexp"
 	"testing"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -46,7 +49,7 @@ func TestAccSWFDomain_basic(t *testing.T) {
 				Config: testAccDomainConfig_basic(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckDomainExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "swf", regexp.MustCompile(`/domain/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "swf", regexache.MustCompile(`/domain/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "name_prefix", ""),
diff --git a/internal/service/swf/exports_test.go b/internal/service/swf/exports_test.go
index a24b163e706..eeeb6a6782c 100644
--- a/internal/service/swf/exports_test.go
+++ b/internal/service/swf/exports_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package swf
 
 // Exports for use in tests only.
diff --git a/internal/service/swf/generate.go b/internal/service/swf/generate.go
index 231e0d57de2..88fd0126292 100644
--- a/internal/service/swf/generate.go
+++ b/internal/service/swf/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -AWSSDKVersion=2 -ListTags -ServiceTagsSlice -TagType=ResourceTag -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/swf/service_package_gen.go b/internal/service/swf/service_package_gen.go
index 75794904ce8..7349602a24c 100644
--- a/internal/service/swf/service_package_gen.go
+++ b/internal/service/swf/service_package_gen.go
@@ -7,6 +7,7 @@ import (
 
 	aws_sdkv2 "github.com/aws/aws-sdk-go-v2/aws"
 	swf_sdkv2 "github.com/aws/aws-sdk-go-v2/service/swf"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -48,9 +49,11 @@ func (p *servicePackage) NewClient(ctx context.Context, config map[string]any) (
 
 	return swf_sdkv2.NewFromConfig(cfg, func(o *swf_sdkv2.Options) {
 		if endpoint := config["endpoint"].(string); endpoint != "" {
-			o.EndpointResolver = swf_sdkv2.EndpointResolverFromURL(endpoint)
+			o.BaseEndpoint = aws_sdkv2.String(endpoint)
 		}
 	}), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/swf/sweep.go b/internal/service/swf/sweep.go
index 8a0e08f791c..470fa832b3c 100644
--- a/internal/service/swf/sweep.go
+++ b/internal/service/swf/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package swf
 
@@ -12,9 +12,10 @@ import (
 	"github.com/aws/aws-sdk-go-v2/service/swf/types"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv2"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_swf_domain", &resource.Sweeper{
 		Name: "aws_swf_domain",
 		F:    sweepDomains,
@@ -23,7 +24,7 @@ func init() {
 
 func sweepDomains(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -37,7 +38,7 @@ func sweepDomains(region string) error {
 	for pages.HasMorePages() {
 		page, err := pages.NextPage(ctx)
 
-		if sweep.SkipSweepError(err) {
+		if awsv2.SkipSweepError(err) {
 			log.Printf("[WARN] Skipping SWF Domain sweep for %s: %s", region, err)
 			return nil
 		}
@@ -55,7 +56,7 @@ func sweepDomains(region string) error {
 		}
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping SWF Domains (%s): %w", region, err)
diff --git a/internal/service/swf/tags_gen.go b/internal/service/swf/tags_gen.go
index 0931f4b2e44..634dbbed3aa 100644
--- a/internal/service/swf/tags_gen.go
+++ b/internal/service/swf/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/swf"
 	awstypes "github.com/aws/aws-sdk-go-v2/service/swf/types"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -102,6 +104,8 @@ func updateTags(ctx context.Context, conn *swf.Client, identifier string, oldTag
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.SWF)
 	if len(removedTags) > 0 {
diff --git a/internal/service/synthetics/canary.go b/internal/service/synthetics/canary.go
index 80f324e1292..b674d9669b8 100644
--- a/internal/service/synthetics/canary.go
+++ b/internal/service/synthetics/canary.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package synthetics
 
 import (
@@ -5,10 +8,10 @@ import (
 	"fmt"
 	"log"
 	"os"
-	"regexp"
 	"strings"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/aws/aws-sdk-go/service/synthetics"
@@ -110,7 +113,7 @@ func ResourceCanary() *schema.Resource {
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(1, 21),
-					validation.StringMatch(regexp.MustCompile(`^[0-9a-z_\-]+$`), "must contain only lowercase alphanumeric, hyphen, or underscore."),
+					validation.StringMatch(regexache.MustCompile(`^[0-9a-z_\-]+$`), "must contain only lowercase alphanumeric, hyphen, or underscore."),
 				),
 			},
 			"run_config": {
diff --git a/internal/service/synthetics/canary_test.go b/internal/service/synthetics/canary_test.go
index f6280595a75..249efbcc1b6 100644
--- a/internal/service/synthetics/canary_test.go
+++ b/internal/service/synthetics/canary_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package synthetics_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/synthetics"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -32,7 +35,7 @@ func TestAccSyntheticsCanary_basic(t *testing.T) {
 				Config: testAccCanaryConfig_basic(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckCanaryExists(ctx, resourceName, &conf1),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", synthetics.ServiceName, regexp.MustCompile(`canary:.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", synthetics.ServiceName, regexache.MustCompile(`canary:.+`)),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "runtime_version", "syn-nodejs-puppeteer-3.9"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
@@ -44,8 +47,8 @@ func TestAccSyntheticsCanary_basic(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "vpc_config.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "schedule.0.duration_in_seconds", "0"),
 					resource.TestCheckResourceAttr(resourceName, "schedule.0.expression", "rate(0 hour)"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "engine_arn", "lambda", regexp.MustCompile(fmt.Sprintf(`function:cwsyn-%s.+`, rName))),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "source_location_arn", "lambda", regexp.MustCompile(fmt.Sprintf(`layer:cwsyn-%s.+`, rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "engine_arn", "lambda", regexache.MustCompile(fmt.Sprintf(`function:cwsyn-%s.+`, rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "source_location_arn", "lambda", regexache.MustCompile(fmt.Sprintf(`layer:cwsyn-%s.+`, rName))),
 					resource.TestCheckResourceAttrPair(resourceName, "execution_role_arn", "aws_iam_role.test", "arn"),
 					resource.TestCheckResourceAttr(resourceName, "artifact_s3_location", fmt.Sprintf("%s/", rName)),
 					resource.TestCheckResourceAttr(resourceName, "timeline.#", "1"),
@@ -64,7 +67,7 @@ func TestAccSyntheticsCanary_basic(t *testing.T) {
 				Config: testAccCanaryConfig_zipUpdated(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckCanaryExists(ctx, resourceName, &conf2),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", synthetics.ServiceName, regexp.MustCompile(`canary:.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", synthetics.ServiceName, regexache.MustCompile(`canary:.+`)),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "runtime_version", "syn-nodejs-puppeteer-3.9"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
@@ -76,8 +79,8 @@ func TestAccSyntheticsCanary_basic(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "vpc_config.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "schedule.0.duration_in_seconds", "0"),
 					resource.TestCheckResourceAttr(resourceName, "schedule.0.expression", "rate(0 hour)"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "engine_arn", "lambda", regexp.MustCompile(fmt.Sprintf(`function:cwsyn-%s.+`, rName))),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "source_location_arn", "lambda", regexp.MustCompile(fmt.Sprintf(`layer:cwsyn-%s.+`, rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "engine_arn", "lambda", regexache.MustCompile(fmt.Sprintf(`function:cwsyn-%s.+`, rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "source_location_arn", "lambda", regexache.MustCompile(fmt.Sprintf(`layer:cwsyn-%s.+`, rName))),
 					resource.TestCheckResourceAttrPair(resourceName, "execution_role_arn", "aws_iam_role.test", "arn"),
 					resource.TestCheckResourceAttr(resourceName, "artifact_s3_location", fmt.Sprintf("%s/test/", rName)),
 					resource.TestCheckResourceAttr(resourceName, "timeline.#", "1"),
@@ -275,7 +278,7 @@ func TestAccSyntheticsCanary_s3(t *testing.T) {
 				Config: testAccCanaryConfig_basicS3Code(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckCanaryExists(ctx, resourceName, &conf),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", synthetics.ServiceName, regexp.MustCompile(`canary:.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", synthetics.ServiceName, regexache.MustCompile(`canary:.+`)),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "runtime_version", "syn-nodejs-puppeteer-3.9"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
@@ -288,8 +291,8 @@ func TestAccSyntheticsCanary_s3(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "vpc_config.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "schedule.0.duration_in_seconds", "0"),
 					resource.TestCheckResourceAttr(resourceName, "schedule.0.expression", "rate(0 hour)"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "engine_arn", "lambda", regexp.MustCompile(fmt.Sprintf(`function:cwsyn-%s.+`, rName))),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "source_location_arn", "lambda", regexp.MustCompile(fmt.Sprintf(`layer:cwsyn-%s.+`, rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "engine_arn", "lambda", regexache.MustCompile(fmt.Sprintf(`function:cwsyn-%s.+`, rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "source_location_arn", "lambda", regexache.MustCompile(fmt.Sprintf(`layer:cwsyn-%s.+`, rName))),
 					resource.TestCheckResourceAttrPair(resourceName, "execution_role_arn", "aws_iam_role.test", "arn"),
 					resource.TestCheckResourceAttr(resourceName, "artifact_s3_location", fmt.Sprintf("%s/", rName)),
 				),
diff --git a/internal/service/synthetics/consts.go b/internal/service/synthetics/consts.go
index a52d31bbd77..c3d4b7a4b85 100644
--- a/internal/service/synthetics/consts.go
+++ b/internal/service/synthetics/consts.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package synthetics
 
 import (
diff --git a/internal/service/synthetics/find.go b/internal/service/synthetics/find.go
index d4a5555d185..d4af7e238fa 100644
--- a/internal/service/synthetics/find.go
+++ b/internal/service/synthetics/find.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package synthetics
 
 import (
diff --git a/internal/service/synthetics/generate.go b/internal/service/synthetics/generate.go
index 3a3a66b434f..dbf96f1556d 100644
--- a/internal/service/synthetics/generate.go
+++ b/internal/service/synthetics/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ServiceTagsMap -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/synthetics/group.go b/internal/service/synthetics/group.go
index 5fe795da86f..56cab5bc09a 100644
--- a/internal/service/synthetics/group.go
+++ b/internal/service/synthetics/group.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package synthetics
 
 import (
diff --git a/internal/service/synthetics/group_association.go b/internal/service/synthetics/group_association.go
index c37c318d76c..f6926e0f7aa 100644
--- a/internal/service/synthetics/group_association.go
+++ b/internal/service/synthetics/group_association.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package synthetics
 
 import (
diff --git a/internal/service/synthetics/group_association_test.go b/internal/service/synthetics/group_association_test.go
index 87081d1ab91..028d759e2ef 100644
--- a/internal/service/synthetics/group_association_test.go
+++ b/internal/service/synthetics/group_association_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package synthetics_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/synthetics"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -32,8 +35,8 @@ func TestAccSyntheticsGroupAssociation_basic(t *testing.T) {
 				Config: testAccGroupAssociationConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckGroupAssociationExists(ctx, resourceName, &groupSummary),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "canary_arn", synthetics.ServiceName, regexp.MustCompile(`canary:.+`)),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "group_arn", synthetics.ServiceName, regexp.MustCompile(`group:.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "canary_arn", synthetics.ServiceName, regexache.MustCompile(`canary:.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "group_arn", synthetics.ServiceName, regexache.MustCompile(`group:.+`)),
 					resource.TestCheckResourceAttr(resourceName, "group_name", rName),
 					resource.TestCheckResourceAttrSet(resourceName, "group_id"),
 				),
diff --git a/internal/service/synthetics/group_test.go b/internal/service/synthetics/group_test.go
index e03b02e0aa7..47b584bf5e8 100644
--- a/internal/service/synthetics/group_test.go
+++ b/internal/service/synthetics/group_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package synthetics_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/synthetics"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -32,7 +35,7 @@ func TestAccSyntheticsGroup_basic(t *testing.T) {
 				Config: testAccGroupConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckGroupExists(ctx, resourceName, &group),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", synthetics.ServiceName, regexp.MustCompile(`group:.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", synthetics.ServiceName, regexache.MustCompile(`group:.+`)),
 					resource.TestCheckResourceAttrSet(resourceName, "group_id"),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 				),
diff --git a/internal/service/synthetics/retry.go b/internal/service/synthetics/retry.go
index 3902ea21afc..52575aa7ad2 100644
--- a/internal/service/synthetics/retry.go
+++ b/internal/service/synthetics/retry.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package synthetics
 
 import (
diff --git a/internal/service/synthetics/service_package_gen.go b/internal/service/synthetics/service_package_gen.go
index 3b2d1ed037b..4e14ba3a5f1 100644
--- a/internal/service/synthetics/service_package_gen.go
+++ b/internal/service/synthetics/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	synthetics_sdkv1 "github.com/aws/aws-sdk-go/service/synthetics"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -63,4 +64,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*s
 	return synthetics_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/synthetics/status.go b/internal/service/synthetics/status.go
index 16bd489a6f0..ce34b8e61fd 100644
--- a/internal/service/synthetics/status.go
+++ b/internal/service/synthetics/status.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package synthetics
 
 import (
diff --git a/internal/service/synthetics/sweep.go b/internal/service/synthetics/sweep.go
index ae2e98a25ef..59c2813b911 100644
--- a/internal/service/synthetics/sweep.go
+++ b/internal/service/synthetics/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package synthetics
 
@@ -12,9 +12,10 @@ import (
 	"github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_synthetics_canary", &resource.Sweeper{
 		Name: "aws_synthetics_canary",
 		F:    sweepCanaries,
@@ -28,7 +29,7 @@ func init() {
 
 func sweepCanaries(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -40,7 +41,7 @@ func sweepCanaries(region string) error {
 	input := &synthetics.DescribeCanariesInput{}
 	for {
 		output, err := conn.DescribeCanariesWithContext(ctx, input)
-		if sweep.SkipSweepError(err) {
+		if awsv1.SkipSweepError(err) {
 			log.Printf("[WARN] Skipping Synthetics Canary sweep for %s: %s", region, err)
 			return nil
 		}
@@ -65,7 +66,7 @@ func sweepCanaries(region string) error {
 		input.NextToken = output.NextToken
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		sweeperErrs = multierror.Append(sweeperErrs, fmt.Errorf("error sweeping Synthetics Canaries: %w", err))
 	}
 
diff --git a/internal/service/synthetics/tags_gen.go b/internal/service/synthetics/tags_gen.go
index d035f37a0fd..509a6d11d19 100644
--- a/internal/service/synthetics/tags_gen.go
+++ b/internal/service/synthetics/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/synthetics"
 	"github.com/aws/aws-sdk-go/service/synthetics/syntheticsiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -21,7 +23,7 @@ func Tags(tags tftags.KeyValueTags) map[string]*string {
 	return aws.StringMap(tags.Map())
 }
 
-// KeyValueTags creates KeyValueTags from synthetics service tags.
+// KeyValueTags creates tftags.KeyValueTags from synthetics service tags.
 func KeyValueTags(ctx context.Context, tags map[string]*string) tftags.KeyValueTags {
 	return tftags.New(ctx, tags)
 }
@@ -52,6 +54,8 @@ func updateTags(ctx context.Context, conn syntheticsiface.SyntheticsAPI, identif
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.Synthetics)
 	if len(removedTags) > 0 {
diff --git a/internal/service/synthetics/wait.go b/internal/service/synthetics/wait.go
index 6b223479a97..54f61f1a8fd 100644
--- a/internal/service/synthetics/wait.go
+++ b/internal/service/synthetics/wait.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package synthetics
 
 import (
diff --git a/internal/service/timestreamwrite/database.go b/internal/service/timestreamwrite/database.go
index 93dc87f39c2..d5285305454 100644
--- a/internal/service/timestreamwrite/database.go
+++ b/internal/service/timestreamwrite/database.go
@@ -1,25 +1,31 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package timestreamwrite
 
 import (
 	"context"
 	"log"
-	"regexp"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/timestreamwrite"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/YakDriver/regexache"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/timestreamwrite"
+	"github.com/aws/aws-sdk-go-v2/service/timestreamwrite/types"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
 // @SDKResource("aws_timestreamwrite_database", name="Database")
 // @Tags(identifierAttribute="arn")
-func ResourceDatabase() *schema.Resource {
+func resourceDatabase() *schema.Resource {
 	return &schema.Resource{
 		CreateWithoutTimeout: resourceDatabaseCreate,
 		ReadWithoutTimeout:   resourceDatabaseRead,
@@ -35,17 +41,15 @@ func ResourceDatabase() *schema.Resource {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
-
 			"database_name": {
 				Type:     schema.TypeString,
 				Required: true,
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(3, 64),
-					validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9_.-]+$`), "must only include alphanumeric, underscore, period, or hyphen characters"),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_.-]+$`), "must only include alphanumeric, underscore, period, or hyphen characters"),
 				),
 			},
-
 			"kms_key_id": {
 				Type:     schema.TypeString,
 				Optional: true,
@@ -56,7 +60,6 @@ func ResourceDatabase() *schema.Resource {
 				// To avoid importing an extra service in this resource, input here is restricted to only ARNs.
 				ValidateFunc: verify.ValidARN,
 			},
-
 			"table_count": {
 				Type:     schema.TypeInt,
 				Computed: true,
@@ -70,11 +73,11 @@ func ResourceDatabase() *schema.Resource {
 }
 
 func resourceDatabaseCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).TimestreamWriteConn(ctx)
+	conn := meta.(*conns.AWSClient).TimestreamWriteClient(ctx)
 
-	dbName := d.Get("database_name").(string)
+	name := d.Get("database_name").(string)
 	input := &timestreamwrite.CreateDatabaseInput{
-		DatabaseName: aws.String(dbName),
+		DatabaseName: aws.String(name),
 		Tags:         getTagsIn(ctx),
 	}
 
@@ -82,31 +85,23 @@ func resourceDatabaseCreate(ctx context.Context, d *schema.ResourceData, meta in
 		input.KmsKeyId = aws.String(v.(string))
 	}
 
-	resp, err := conn.CreateDatabaseWithContext(ctx, input)
+	output, err := conn.CreateDatabase(ctx, input)
 
 	if err != nil {
-		return diag.Errorf("creating Timestream Database (%s): %s", dbName, err)
+		return diag.Errorf("creating Timestream Database (%s): %s", name, err)
 	}
 
-	if resp == nil || resp.Database == nil {
-		return diag.Errorf("creating Timestream Database (%s): empty output", dbName)
-	}
-
-	d.SetId(aws.StringValue(resp.Database.DatabaseName))
+	d.SetId(aws.ToString(output.Database.DatabaseName))
 
 	return resourceDatabaseRead(ctx, d, meta)
 }
 
 func resourceDatabaseRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).TimestreamWriteConn(ctx)
-
-	input := &timestreamwrite.DescribeDatabaseInput{
-		DatabaseName: aws.String(d.Id()),
-	}
+	conn := meta.(*conns.AWSClient).TimestreamWriteClient(ctx)
 
-	resp, err := conn.DescribeDatabaseWithContext(ctx, input)
+	db, err := findDatabaseByName(ctx, conn, d.Id())
 
-	if !d.IsNewResource() && tfawserr.ErrCodeEquals(err, timestreamwrite.ErrCodeResourceNotFoundException) {
+	if !d.IsNewResource() && tfresource.NotFound(err) {
 		log.Printf("[WARN] Timestream Database %s not found, removing from state", d.Id())
 		d.SetId("")
 		return nil
@@ -116,14 +111,7 @@ func resourceDatabaseRead(ctx context.Context, d *schema.ResourceData, meta inte
 		return diag.Errorf("reading Timestream Database (%s): %s", d.Id(), err)
 	}
 
-	if resp == nil || resp.Database == nil {
-		return diag.Errorf("reading Timestream Database (%s): empty output", d.Id())
-	}
-
-	db := resp.Database
-	arn := aws.StringValue(db.Arn)
-
-	d.Set("arn", arn)
+	d.Set("arn", db.Arn)
 	d.Set("database_name", db.DatabaseName)
 	d.Set("kms_key_id", db.KmsKeyId)
 	d.Set("table_count", db.TableCount)
@@ -132,7 +120,7 @@ func resourceDatabaseRead(ctx context.Context, d *schema.ResourceData, meta inte
 }
 
 func resourceDatabaseUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).TimestreamWriteConn(ctx)
+	conn := meta.(*conns.AWSClient).TimestreamWriteClient(ctx)
 
 	if d.HasChange("kms_key_id") {
 		input := &timestreamwrite.UpdateDatabaseInput{
@@ -140,7 +128,7 @@ func resourceDatabaseUpdate(ctx context.Context, d *schema.ResourceData, meta in
 			KmsKeyId:     aws.String(d.Get("kms_key_id").(string)),
 		}
 
-		_, err := conn.UpdateDatabaseWithContext(ctx, input)
+		_, err := conn.UpdateDatabase(ctx, input)
 
 		if err != nil {
 			return diag.Errorf("updating Timestream Database (%s): %s", d.Id(), err)
@@ -151,14 +139,14 @@ func resourceDatabaseUpdate(ctx context.Context, d *schema.ResourceData, meta in
 }
 
 func resourceDatabaseDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).TimestreamWriteConn(ctx)
+	conn := meta.(*conns.AWSClient).TimestreamWriteClient(ctx)
 
 	log.Printf("[INFO] Deleting Timestream Database: %s", d.Id())
-	_, err := conn.DeleteDatabaseWithContext(ctx, &timestreamwrite.DeleteDatabaseInput{
+	_, err := conn.DeleteDatabase(ctx, &timestreamwrite.DeleteDatabaseInput{
 		DatabaseName: aws.String(d.Id()),
 	})
 
-	if tfawserr.ErrCodeEquals(err, timestreamwrite.ErrCodeResourceNotFoundException) {
+	if errs.IsA[*types.ResourceNotFoundException](err) {
 		return nil
 	}
 
@@ -168,3 +156,28 @@ func resourceDatabaseDelete(ctx context.Context, d *schema.ResourceData, meta in
 
 	return nil
 }
+
+func findDatabaseByName(ctx context.Context, conn *timestreamwrite.Client, name string) (*types.Database, error) {
+	input := &timestreamwrite.DescribeDatabaseInput{
+		DatabaseName: aws.String(name),
+	}
+
+	output, err := conn.DescribeDatabase(ctx, input)
+
+	if errs.IsA[*types.ResourceNotFoundException](err) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	if output == nil || output.Database == nil {
+		return nil, tfresource.NewEmptyResultError(input)
+	}
+
+	return output.Database, nil
+}
diff --git a/internal/service/timestreamwrite/database_test.go b/internal/service/timestreamwrite/database_test.go
index f1dae1f127c..84fe50df2c0 100644
--- a/internal/service/timestreamwrite/database_test.go
+++ b/internal/service/timestreamwrite/database_test.go
@@ -1,20 +1,23 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package timestreamwrite_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/timestreamwrite"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/YakDriver/regexache"
+	"github.com/aws/aws-sdk-go-v2/service/timestreamwrite"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	tftimestreamwrite "github.com/hashicorp/terraform-provider-aws/internal/service/timestreamwrite"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
 func TestAccTimestreamWriteDatabase_basic(t *testing.T) {
@@ -24,7 +27,7 @@ func TestAccTimestreamWriteDatabase_basic(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, timestreamwrite.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.TimestreamWriteEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckDatabaseDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -34,7 +37,7 @@ func TestAccTimestreamWriteDatabase_basic(t *testing.T) {
 					testAccCheckDatabaseExists(ctx, resourceName),
 					acctest.CheckResourceAttrRegionalARN(resourceName, "arn", "timestream", fmt.Sprintf("database/%s", rName)),
 					resource.TestCheckResourceAttr(resourceName, "database_name", rName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "kms_key_id", "kms", regexp.MustCompile(`key/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "kms_key_id", "kms", regexache.MustCompile(`key/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 				),
 			},
@@ -54,7 +57,7 @@ func TestAccTimestreamWriteDatabase_disappears(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, timestreamwrite.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.TimestreamWriteEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckDatabaseDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -78,7 +81,7 @@ func TestAccTimestreamWriteDatabase_kmsKey(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, timestreamwrite.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.TimestreamWriteEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckDatabaseDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -107,7 +110,7 @@ func TestAccTimestreamWriteDatabase_updateKMSKey(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, timestreamwrite.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.TimestreamWriteEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckDatabaseDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -115,7 +118,7 @@ func TestAccTimestreamWriteDatabase_updateKMSKey(t *testing.T) {
 				Config: testAccDatabaseConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDatabaseExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "kms_key_id", "kms", regexp.MustCompile(`key/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "kms_key_id", "kms", regexache.MustCompile(`key/.+`)),
 				),
 			},
 			{
@@ -134,7 +137,7 @@ func TestAccTimestreamWriteDatabase_updateKMSKey(t *testing.T) {
 				Config: testAccDatabaseConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckDatabaseExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "kms_key_id", "kms", regexp.MustCompile(`key/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "kms_key_id", "kms", regexache.MustCompile(`key/.+`)),
 				),
 			},
 		},
@@ -148,7 +151,7 @@ func TestAccTimestreamWriteDatabase_tags(t *testing.T) {
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, timestreamwrite.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.TimestreamWriteEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckDatabaseDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -195,18 +198,16 @@ func TestAccTimestreamWriteDatabase_tags(t *testing.T) {
 
 func testAccCheckDatabaseDestroy(ctx context.Context) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		conn := acctest.Provider.Meta().(*conns.AWSClient).TimestreamWriteConn(ctx)
+		conn := acctest.Provider.Meta().(*conns.AWSClient).TimestreamWriteClient(ctx)
 
 		for _, rs := range s.RootModule().Resources {
 			if rs.Type != "aws_timestreamwrite_database" {
 				continue
 			}
 
-			output, err := conn.DescribeDatabaseWithContext(ctx, &timestreamwrite.DescribeDatabaseInput{
-				DatabaseName: aws.String(rs.Primary.ID),
-			})
+			_, err := tftimestreamwrite.FindDatabaseByName(ctx, conn, rs.Primary.ID)
 
-			if tfawserr.ErrCodeEquals(err, timestreamwrite.ErrCodeResourceNotFoundException) {
+			if tfresource.NotFound(err) {
 				continue
 			}
 
@@ -214,9 +215,7 @@ func testAccCheckDatabaseDestroy(ctx context.Context) resource.TestCheckFunc {
 				return err
 			}
 
-			if output != nil && output.Database != nil {
-				return fmt.Errorf("Timestream Database (%s) still exists", rs.Primary.ID)
-			}
+			return fmt.Errorf("Timestream Database %s still exists", rs.Primary.ID)
 		}
 
 		return nil
@@ -230,34 +229,20 @@ func testAccCheckDatabaseExists(ctx context.Context, n string) resource.TestChec
 			return fmt.Errorf("Not found: %s", n)
 		}
 
-		if rs.Primary.ID == "" {
-			return fmt.Errorf("no resource ID is set")
-		}
+		conn := acctest.Provider.Meta().(*conns.AWSClient).TimestreamWriteClient(ctx)
 
-		conn := acctest.Provider.Meta().(*conns.AWSClient).TimestreamWriteConn(ctx)
+		_, err := tftimestreamwrite.FindDatabaseByName(ctx, conn, rs.Primary.ID)
 
-		output, err := conn.DescribeDatabaseWithContext(ctx, &timestreamwrite.DescribeDatabaseInput{
-			DatabaseName: aws.String(rs.Primary.ID),
-		})
-
-		if err != nil {
-			return err
-		}
-
-		if output == nil || output.Database == nil {
-			return fmt.Errorf("Timestream Database (%s) not found", rs.Primary.ID)
-		}
-
-		return nil
+		return err
 	}
 }
 
 func testAccPreCheck(ctx context.Context, t *testing.T) {
-	conn := acctest.Provider.Meta().(*conns.AWSClient).TimestreamWriteConn(ctx)
+	conn := acctest.Provider.Meta().(*conns.AWSClient).TimestreamWriteClient(ctx)
 
 	input := &timestreamwrite.ListDatabasesInput{}
 
-	_, err := conn.ListDatabasesWithContext(ctx, input)
+	_, err := conn.ListDatabases(ctx, input)
 
 	if acctest.PreCheckSkipError(err) {
 		t.Skipf("skipping acceptance testing: %s", err)
diff --git a/internal/service/timestreamwrite/export_test.go b/internal/service/timestreamwrite/export_test.go
new file mode 100644
index 00000000000..ca5ac4f150e
--- /dev/null
+++ b/internal/service/timestreamwrite/export_test.go
@@ -0,0 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package timestreamwrite
+
+// Exports for use in tests only.
+var (
+	ResourceDatabase = resourceDatabase
+	ResourceTable    = resourceTable
+
+	FindDatabaseByName    = findDatabaseByName
+	FindTableByTwoPartKey = findTableByTwoPartKey
+
+	TableParseResourceID = tableParseResourceID
+)
diff --git a/internal/service/timestreamwrite/generate.go b/internal/service/timestreamwrite/generate.go
index 015c6b8c2a9..dc4fbf7160b 100644
--- a/internal/service/timestreamwrite/generate.go
+++ b/internal/service/timestreamwrite/generate.go
@@ -1,4 +1,7 @@
-//go:generate go run ../../generate/tags/main.go -ListTags -ListTagsInIDElem=ResourceARN -ServiceTagsSlice -TagInIDElem=ResourceARN -UpdateTags
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+//go:generate go run ../../generate/tags/main.go -AWSSDKVersion=2 -ListTags -ListTagsInIDElem=ResourceARN -ServiceTagsSlice -TagInIDElem=ResourceARN -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
 
diff --git a/internal/service/timestreamwrite/service_package_gen.go b/internal/service/timestreamwrite/service_package_gen.go
index 5017c5dc648..d3e2de87b7d 100644
--- a/internal/service/timestreamwrite/service_package_gen.go
+++ b/internal/service/timestreamwrite/service_package_gen.go
@@ -5,9 +5,9 @@ package timestreamwrite
 import (
 	"context"
 
-	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
-	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
-	timestreamwrite_sdkv1 "github.com/aws/aws-sdk-go/service/timestreamwrite"
+	aws_sdkv2 "github.com/aws/aws-sdk-go-v2/aws"
+	timestreamwrite_sdkv2 "github.com/aws/aws-sdk-go-v2/service/timestreamwrite"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -29,7 +29,7 @@ func (p *servicePackage) SDKDataSources(ctx context.Context) []*types.ServicePac
 func (p *servicePackage) SDKResources(ctx context.Context) []*types.ServicePackageSDKResource {
 	return []*types.ServicePackageSDKResource{
 		{
-			Factory:  ResourceDatabase,
+			Factory:  resourceDatabase,
 			TypeName: "aws_timestreamwrite_database",
 			Name:     "Database",
 			Tags: &types.ServicePackageResourceTags{
@@ -37,7 +37,7 @@ func (p *servicePackage) SDKResources(ctx context.Context) []*types.ServicePacka
 			},
 		},
 		{
-			Factory:  ResourceTable,
+			Factory:  resourceTable,
 			TypeName: "aws_timestreamwrite_table",
 			Name:     "Table",
 			Tags: &types.ServicePackageResourceTags{
@@ -51,11 +51,17 @@ func (p *servicePackage) ServicePackageName() string {
 	return names.TimestreamWrite
 }
 
-// NewConn returns a new AWS SDK for Go v1 client for this service package's AWS API.
-func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*timestreamwrite_sdkv1.TimestreamWrite, error) {
-	sess := config["session"].(*session_sdkv1.Session)
+// NewClient returns a new AWS SDK for Go v2 client for this service package's AWS API.
+func (p *servicePackage) NewClient(ctx context.Context, config map[string]any) (*timestreamwrite_sdkv2.Client, error) {
+	cfg := *(config["aws_sdkv2_config"].(*aws_sdkv2.Config))
 
-	return timestreamwrite_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
+	return timestreamwrite_sdkv2.NewFromConfig(cfg, func(o *timestreamwrite_sdkv2.Options) {
+		if endpoint := config["endpoint"].(string); endpoint != "" {
+			o.BaseEndpoint = aws_sdkv2.String(endpoint)
+		}
+	}), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/timestreamwrite/sweep.go b/internal/service/timestreamwrite/sweep.go
index 03b25c985da..e74f59bff90 100644
--- a/internal/service/timestreamwrite/sweep.go
+++ b/internal/service/timestreamwrite/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package timestreamwrite
 
@@ -7,13 +7,14 @@ import (
 	"fmt"
 	"log"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/timestreamwrite"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/timestreamwrite"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv2"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_timestreamwrite_database", &resource.Sweeper{
 		Name:         "aws_timestreamwrite_database",
 		F:            sweepDatabases,
@@ -28,40 +29,37 @@ func init() {
 
 func sweepDatabases(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
 	input := &timestreamwrite.ListDatabasesInput{}
-	conn := client.TimestreamWriteConn(ctx)
+	conn := client.TimestreamWriteClient(ctx)
 	sweepResources := make([]sweep.Sweepable, 0)
 
-	err = conn.ListDatabasesPagesWithContext(ctx, input, func(page *timestreamwrite.ListDatabasesOutput, lastPage bool) bool {
-		if page == nil {
-			return !lastPage
+	pages := timestreamwrite.NewListDatabasesPaginator(conn, input)
+	for pages.HasMorePages() {
+		page, err := pages.NextPage(ctx)
+
+		if awsv2.SkipSweepError(err) {
+			log.Printf("[WARN] Skipping Timestream Database sweep for %s: %s", region, err)
+			return nil
+		}
+
+		if err != nil {
+			return fmt.Errorf("error listing Timestream Databases (%s): %w", region, err)
 		}
 
 		for _, v := range page.Databases {
-			r := ResourceDatabase()
+			r := resourceDatabase()
 			d := r.Data(nil)
-			d.SetId(aws.StringValue(v.DatabaseName))
+			d.SetId(aws.ToString(v.DatabaseName))
 
 			sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
 		}
-
-		return !lastPage
-	})
-
-	if sweep.SkipSweepError(err) {
-		log.Printf("[WARN] Skipping Timestream Database sweep for %s: %s", region, err)
-		return nil
-	}
-
-	if err != nil {
-		return fmt.Errorf("error listing Timestream Databases (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping Timestream Databases (%s): %w", region, err)
@@ -72,40 +70,37 @@ func sweepDatabases(region string) error {
 
 func sweepTables(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
 	input := &timestreamwrite.ListTablesInput{}
-	conn := client.TimestreamWriteConn(ctx)
+	conn := client.TimestreamWriteClient(ctx)
 	sweepResources := make([]sweep.Sweepable, 0)
 
-	err = conn.ListTablesPagesWithContext(ctx, input, func(page *timestreamwrite.ListTablesOutput, lastPage bool) bool {
-		if page == nil {
-			return !lastPage
+	pages := timestreamwrite.NewListTablesPaginator(conn, input)
+	for pages.HasMorePages() {
+		page, err := pages.NextPage(ctx)
+
+		if awsv2.SkipSweepError(err) {
+			log.Printf("[WARN] Skipping Timestream Table sweep for %s: %s", region, err)
+			return nil
+		}
+
+		if err != nil {
+			return fmt.Errorf("error listing Timestream Tables (%s): %w", region, err)
 		}
 
 		for _, v := range page.Tables {
-			r := ResourceTable()
+			r := resourceTable()
 			d := r.Data(nil)
-			d.SetId(fmt.Sprintf("%s:%s", aws.StringValue(v.TableName), aws.StringValue(v.DatabaseName)))
+			d.SetId(tableCreateResourceID(aws.ToString(v.TableName), aws.ToString(v.DatabaseName)))
 
 			sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
 		}
-
-		return !lastPage
-	})
-
-	if sweep.SkipSweepError(err) {
-		log.Printf("[WARN] Skipping Timestream Table sweep for %s: %s", region, err)
-		return nil
-	}
-
-	if err != nil {
-		return fmt.Errorf("error listing Timestream Tables (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping Timestream Tables (%s): %w", region, err)
diff --git a/internal/service/timestreamwrite/table.go b/internal/service/timestreamwrite/table.go
index 817a87fd7df..aca1e2521a5 100644
--- a/internal/service/timestreamwrite/table.go
+++ b/internal/service/timestreamwrite/table.go
@@ -1,27 +1,34 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package timestreamwrite
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"strings"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/timestreamwrite"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/YakDriver/regexache"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/timestreamwrite"
+	"github.com/aws/aws-sdk-go-v2/service/timestreamwrite/types"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/enum"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
 // @SDKResource("aws_timestreamwrite_table", name="Table")
 // @Tags(identifierAttribute="arn")
-func ResourceTable() *schema.Resource {
+func resourceTable() *schema.Resource {
 	return &schema.Resource{
 		CreateWithoutTimeout: resourceTableCreate,
 		ReadWithoutTimeout:   resourceTableRead,
@@ -37,14 +44,13 @@ func ResourceTable() *schema.Resource {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
-
 			"database_name": {
 				Type:     schema.TypeString,
 				Required: true,
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(3, 64),
-					validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9_.-]+$`), "must only include alphanumeric, underscore, period, or hyphen characters"),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_.-]+$`), "must only include alphanumeric, underscore, period, or hyphen characters"),
 				),
 			},
 			"magnetic_store_write_properties": {
@@ -76,9 +82,9 @@ func ResourceTable() *schema.Resource {
 													Optional: true,
 												},
 												"encryption_option": {
-													Type:         schema.TypeString,
-													Optional:     true,
-													ValidateFunc: validation.StringInSlice(timestreamwrite.S3EncryptionOption_Values(), false),
+													Type:             schema.TypeString,
+													Optional:         true,
+													ValidateDiagFunc: enum.Validate[types.S3EncryptionOption](),
 												},
 												"kms_key_id": {
 													Type:         schema.TypeString,
@@ -98,7 +104,6 @@ func ResourceTable() *schema.Resource {
 					},
 				},
 			},
-
 			"retention_properties": {
 				Type:     schema.TypeList,
 				Optional: true,
@@ -111,7 +116,6 @@ func ResourceTable() *schema.Resource {
 							Required:     true,
 							ValidateFunc: validation.IntBetween(1, 73000),
 						},
-
 						"memory_store_retention_period_in_hours": {
 							Type:         schema.TypeInt,
 							Required:     true,
@@ -120,14 +124,51 @@ func ResourceTable() *schema.Resource {
 					},
 				},
 			},
-
+			"schema": {
+				Type:     schema.TypeList,
+				Optional: true,
+				Computed: true,
+				ForceNew: true,
+				MaxItems: 1,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"composite_partition_key": {
+							Type:     schema.TypeList,
+							Optional: true,
+							Computed: true,
+							ForceNew: true,
+							MaxItems: 1,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"enforcement_in_record": {
+										Type:             schema.TypeString,
+										Optional:         true,
+										ValidateDiagFunc: enum.Validate[types.PartitionKeyEnforcementLevel](),
+									},
+									"name": {
+										Type:     schema.TypeString,
+										Optional: true,
+										ForceNew: true,
+									},
+									"type": {
+										Type:             schema.TypeString,
+										Required:         true,
+										ForceNew:         true,
+										ValidateDiagFunc: enum.Validate[types.PartitionKeyType](),
+									},
+								},
+							},
+						},
+					},
+				},
+			},
 			"table_name": {
 				Type:     schema.TypeString,
 				Required: true,
 				ForceNew: true,
 				ValidateFunc: validation.All(
 					validation.StringLenBetween(3, 64),
-					validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9_.-]+$`), "must only include alphanumeric, underscore, period, or hyphen characters"),
+					validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_.-]+$`), "must only include alphanumeric, underscore, period, or hyphen characters"),
 				),
 			},
 			names.AttrTags:    tftags.TagsSchema(),
@@ -139,89 +180,81 @@ func ResourceTable() *schema.Resource {
 }
 
 func resourceTableCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).TimestreamWriteConn(ctx)
+	conn := meta.(*conns.AWSClient).TimestreamWriteClient(ctx)
 
+	databaseName := d.Get("database_name").(string)
 	tableName := d.Get("table_name").(string)
+	id := tableCreateResourceID(tableName, databaseName)
 	input := &timestreamwrite.CreateTableInput{
-		DatabaseName: aws.String(d.Get("database_name").(string)),
+		DatabaseName: aws.String(databaseName),
 		TableName:    aws.String(tableName),
 		Tags:         getTagsIn(ctx),
 	}
 
+	if v, ok := d.GetOk("magnetic_store_write_properties"); ok && len(v.([]interface{})) > 0 && v.([]interface{}) != nil {
+		input.MagneticStoreWriteProperties = expandMagneticStoreWriteProperties(v.([]interface{}))
+	}
+
 	if v, ok := d.GetOk("retention_properties"); ok && len(v.([]interface{})) > 0 && v.([]interface{}) != nil {
 		input.RetentionProperties = expandRetentionProperties(v.([]interface{}))
 	}
 
-	if v, ok := d.GetOk("magnetic_store_write_properties"); ok && len(v.([]interface{})) > 0 && v.([]interface{}) != nil {
-		input.MagneticStoreWriteProperties = expandMagneticStoreWriteProperties(v.([]interface{}))
+	if v, ok := d.GetOk("schema"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
+		input.Schema = expandSchema(v.([]interface{})[0].(map[string]interface{}))
 	}
 
-	output, err := conn.CreateTableWithContext(ctx, input)
+	_, err := conn.CreateTable(ctx, input)
 
 	if err != nil {
-		return diag.Errorf("creating Timestream Table (%s): %s", tableName, err)
-	}
-
-	if output == nil || output.Table == nil {
-		return diag.Errorf("creating Timestream Table (%s): empty output", tableName)
+		return diag.Errorf("creating Timestream Table (%s): %s", id, err)
 	}
 
-	d.SetId(fmt.Sprintf("%s:%s", aws.StringValue(output.Table.TableName), aws.StringValue(output.Table.DatabaseName)))
+	d.SetId(id)
 
 	return resourceTableRead(ctx, d, meta)
 }
 
 func resourceTableRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).TimestreamWriteConn(ctx)
-
-	tableName, databaseName, err := TableParseID(d.Id())
+	conn := meta.(*conns.AWSClient).TimestreamWriteClient(ctx)
 
+	tableName, databaseName, err := tableParseResourceID(d.Id())
 	if err != nil {
 		return diag.FromErr(err)
 	}
 
-	input := &timestreamwrite.DescribeTableInput{
-		DatabaseName: aws.String(databaseName),
-		TableName:    aws.String(tableName),
-	}
-
-	output, err := conn.DescribeTableWithContext(ctx, input)
+	table, err := findTableByTwoPartKey(ctx, conn, databaseName, tableName)
 
-	if !d.IsNewResource() && tfawserr.ErrCodeEquals(err, timestreamwrite.ErrCodeResourceNotFoundException) {
+	if !d.IsNewResource() && tfresource.NotFound(err) {
 		log.Printf("[WARN] Timestream Table %s not found, removing from state", d.Id())
 		d.SetId("")
 		return nil
 	}
 
-	if output == nil || output.Table == nil {
-		return diag.Errorf("reading Timestream Table (%s): empty output", d.Id())
-	}
-
-	table := output.Table
-	arn := aws.StringValue(table.Arn)
-
-	d.Set("arn", arn)
+	d.Set("arn", table.Arn)
 	d.Set("database_name", table.DatabaseName)
-
+	if err := d.Set("magnetic_store_write_properties", flattenMagneticStoreWriteProperties(table.MagneticStoreWriteProperties)); err != nil {
+		return diag.Errorf("setting magnetic_store_write_properties: %s", err)
+	}
 	if err := d.Set("retention_properties", flattenRetentionProperties(table.RetentionProperties)); err != nil {
 		return diag.Errorf("setting retention_properties: %s", err)
 	}
-
-	if err := d.Set("magnetic_store_write_properties", flattenMagneticStoreWriteProperties(table.MagneticStoreWriteProperties)); err != nil {
-		return diag.Errorf("setting magnetic_store_write_properties: %s", err)
+	if table.Schema != nil {
+		if err := d.Set("schema", []interface{}{flattenSchema(table.Schema)}); err != nil {
+			return diag.Errorf("setting schema: %s", err)
+		}
+	} else {
+		d.Set("schema", nil)
 	}
-
 	d.Set("table_name", table.TableName)
 
 	return nil
 }
 
 func resourceTableUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).TimestreamWriteConn(ctx)
+	conn := meta.(*conns.AWSClient).TimestreamWriteClient(ctx)
 
 	if d.HasChangesExcept("tags", "tags_all") {
-		tableName, databaseName, err := TableParseID(d.Id())
-
+		tableName, databaseName, err := tableParseResourceID(d.Id())
 		if err != nil {
 			return diag.FromErr(err)
 		}
@@ -231,15 +264,21 @@ func resourceTableUpdate(ctx context.Context, d *schema.ResourceData, meta inter
 			TableName:    aws.String(tableName),
 		}
 
+		if d.HasChange("magnetic_store_write_properties") {
+			input.MagneticStoreWriteProperties = expandMagneticStoreWriteProperties(d.Get("magnetic_store_write_properties").([]interface{}))
+		}
+
 		if d.HasChange("retention_properties") {
 			input.RetentionProperties = expandRetentionProperties(d.Get("retention_properties").([]interface{}))
 		}
 
-		if d.HasChange("magnetic_store_write_properties") {
-			input.MagneticStoreWriteProperties = expandMagneticStoreWriteProperties(d.Get("magnetic_store_write_properties").([]interface{}))
+		if d.HasChange("schema") {
+			if v, ok := d.GetOk("schema"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
+				input.Schema = expandSchema(v.([]interface{})[0].(map[string]interface{}))
+			}
 		}
 
-		_, err = conn.UpdateTableWithContext(ctx, input)
+		_, err = conn.UpdateTable(ctx, input)
 
 		if err != nil {
 			return diag.Errorf("updating Timestream Table (%s): %s", d.Id(), err)
@@ -250,21 +289,20 @@ func resourceTableUpdate(ctx context.Context, d *schema.ResourceData, meta inter
 }
 
 func resourceTableDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	conn := meta.(*conns.AWSClient).TimestreamWriteConn(ctx)
-
-	tableName, databaseName, err := TableParseID(d.Id())
+	conn := meta.(*conns.AWSClient).TimestreamWriteClient(ctx)
 
+	tableName, databaseName, err := tableParseResourceID(d.Id())
 	if err != nil {
 		return diag.FromErr(err)
 	}
 
 	log.Printf("[INFO] Deleting Timestream Table: %s", d.Id())
-	_, err = conn.DeleteTableWithContext(ctx, &timestreamwrite.DeleteTableInput{
+	_, err = conn.DeleteTable(ctx, &timestreamwrite.DeleteTableInput{
 		DatabaseName: aws.String(databaseName),
 		TableName:    aws.String(tableName),
 	})
 
-	if tfawserr.ErrCodeEquals(err, timestreamwrite.ErrCodeResourceNotFoundException) {
+	if errs.IsA[*types.ResourceNotFoundException](err) {
 		return nil
 	}
 
@@ -275,161 +313,305 @@ func resourceTableDelete(ctx context.Context, d *schema.ResourceData, meta inter
 	return nil
 }
 
-func expandRetentionProperties(l []interface{}) *timestreamwrite.RetentionProperties {
-	if len(l) == 0 || l[0] == nil {
+func findTableByTwoPartKey(ctx context.Context, conn *timestreamwrite.Client, databaseName, tableName string) (*types.Table, error) {
+	input := &timestreamwrite.DescribeTableInput{
+		DatabaseName: aws.String(databaseName),
+		TableName:    aws.String(tableName),
+	}
+
+	output, err := conn.DescribeTable(ctx, input)
+
+	if errs.IsA[*types.ResourceNotFoundException](err) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	if output == nil || output.Table == nil {
+		return nil, tfresource.NewEmptyResultError(input)
+	}
+
+	return output.Table, nil
+}
+
+func expandRetentionProperties(tfList []interface{}) *types.RetentionProperties {
+	if len(tfList) == 0 || tfList[0] == nil {
 		return nil
 	}
 
-	tfMap, ok := l[0].(map[string]interface{})
+	tfMap, ok := tfList[0].(map[string]interface{})
 
 	if !ok {
 		return nil
 	}
 
-	rp := &timestreamwrite.RetentionProperties{}
+	apiObject := &types.RetentionProperties{}
 
 	if v, ok := tfMap["magnetic_store_retention_period_in_days"].(int); ok {
-		rp.MagneticStoreRetentionPeriodInDays = aws.Int64(int64(v))
+		apiObject.MagneticStoreRetentionPeriodInDays = aws.Int64(int64(v))
 	}
 
 	if v, ok := tfMap["memory_store_retention_period_in_hours"].(int); ok {
-		rp.MemoryStoreRetentionPeriodInHours = aws.Int64(int64(v))
+		apiObject.MemoryStoreRetentionPeriodInHours = aws.Int64(int64(v))
 	}
 
-	return rp
+	return apiObject
 }
 
-func flattenRetentionProperties(rp *timestreamwrite.RetentionProperties) []interface{} {
-	if rp == nil {
+func flattenRetentionProperties(apiObject *types.RetentionProperties) []interface{} {
+	if apiObject == nil {
 		return []interface{}{}
 	}
 
-	m := map[string]interface{}{
-		"magnetic_store_retention_period_in_days": aws.Int64Value(rp.MagneticStoreRetentionPeriodInDays),
-		"memory_store_retention_period_in_hours":  aws.Int64Value(rp.MemoryStoreRetentionPeriodInHours),
+	tfMap := map[string]interface{}{
+		"magnetic_store_retention_period_in_days": aws.ToInt64(apiObject.MagneticStoreRetentionPeriodInDays),
+		"memory_store_retention_period_in_hours":  aws.ToInt64(apiObject.MemoryStoreRetentionPeriodInHours),
 	}
 
-	return []interface{}{m}
+	return []interface{}{tfMap}
 }
 
-func expandMagneticStoreWriteProperties(l []interface{}) *timestreamwrite.MagneticStoreWriteProperties {
-	if len(l) == 0 || l[0] == nil {
+func expandMagneticStoreWriteProperties(tfList []interface{}) *types.MagneticStoreWriteProperties {
+	if len(tfList) == 0 || tfList[0] == nil {
 		return nil
 	}
 
-	tfMap, ok := l[0].(map[string]interface{})
+	tfMap, ok := tfList[0].(map[string]interface{})
 
 	if !ok {
 		return nil
 	}
 
-	rp := &timestreamwrite.MagneticStoreWriteProperties{
+	apiObject := &types.MagneticStoreWriteProperties{
 		EnableMagneticStoreWrites: aws.Bool(tfMap["enable_magnetic_store_writes"].(bool)),
 	}
 
 	if v, ok := tfMap["magnetic_store_rejected_data_location"].([]interface{}); ok && len(v) > 0 {
-		rp.MagneticStoreRejectedDataLocation = expandMagneticStoreRejectedDataLocation(v)
+		apiObject.MagneticStoreRejectedDataLocation = expandMagneticStoreRejectedDataLocation(v)
 	}
 
-	return rp
+	return apiObject
 }
 
-func flattenMagneticStoreWriteProperties(rp *timestreamwrite.MagneticStoreWriteProperties) []interface{} {
-	if rp == nil {
+func flattenMagneticStoreWriteProperties(apiObject *types.MagneticStoreWriteProperties) []interface{} {
+	if apiObject == nil {
 		return []interface{}{}
 	}
 
-	m := map[string]interface{}{
-		"enable_magnetic_store_writes":          aws.BoolValue(rp.EnableMagneticStoreWrites),
-		"magnetic_store_rejected_data_location": flattenMagneticStoreRejectedDataLocation(rp.MagneticStoreRejectedDataLocation),
+	tfMap := map[string]interface{}{
+		"enable_magnetic_store_writes":          aws.ToBool(apiObject.EnableMagneticStoreWrites),
+		"magnetic_store_rejected_data_location": flattenMagneticStoreRejectedDataLocation(apiObject.MagneticStoreRejectedDataLocation),
 	}
 
-	return []interface{}{m}
+	return []interface{}{tfMap}
 }
 
-func expandMagneticStoreRejectedDataLocation(l []interface{}) *timestreamwrite.MagneticStoreRejectedDataLocation {
-	if len(l) == 0 || l[0] == nil {
+func expandMagneticStoreRejectedDataLocation(tfList []interface{}) *types.MagneticStoreRejectedDataLocation {
+	if len(tfList) == 0 || tfList[0] == nil {
 		return nil
 	}
 
-	tfMap, ok := l[0].(map[string]interface{})
+	tfMap, ok := tfList[0].(map[string]interface{})
 
 	if !ok {
 		return nil
 	}
 
-	rp := &timestreamwrite.MagneticStoreRejectedDataLocation{}
+	apiObject := &types.MagneticStoreRejectedDataLocation{}
 
 	if v, ok := tfMap["s3_configuration"].([]interface{}); ok && len(v) > 0 {
-		rp.S3Configuration = expandS3Configuration(v)
+		apiObject.S3Configuration = expandS3Configuration(v)
 	}
 
-	return rp
+	return apiObject
 }
 
-func flattenMagneticStoreRejectedDataLocation(rp *timestreamwrite.MagneticStoreRejectedDataLocation) []interface{} {
-	if rp == nil {
+func flattenMagneticStoreRejectedDataLocation(apiObject *types.MagneticStoreRejectedDataLocation) []interface{} {
+	if apiObject == nil {
 		return []interface{}{}
 	}
 
-	m := map[string]interface{}{
-		"s3_configuration": flattenS3Configuration(rp.S3Configuration),
+	tfMap := map[string]interface{}{
+		"s3_configuration": flattenS3Configuration(apiObject.S3Configuration),
 	}
 
-	return []interface{}{m}
+	return []interface{}{tfMap}
 }
 
-func expandS3Configuration(l []interface{}) *timestreamwrite.S3Configuration {
-	if len(l) == 0 || l[0] == nil {
+func expandS3Configuration(tfList []interface{}) *types.S3Configuration {
+	if len(tfList) == 0 || tfList[0] == nil {
 		return nil
 	}
 
-	tfMap, ok := l[0].(map[string]interface{})
+	tfMap, ok := tfList[0].(map[string]interface{})
 
 	if !ok {
 		return nil
 	}
 
-	rp := &timestreamwrite.S3Configuration{}
+	apiObject := &types.S3Configuration{}
 
 	if v, ok := tfMap["bucket_name"].(string); ok && v != "" {
-		rp.BucketName = aws.String(v)
+		apiObject.BucketName = aws.String(v)
 	}
 
-	if v, ok := tfMap["object_key_prefix"].(string); ok && v != "" {
-		rp.ObjectKeyPrefix = aws.String(v)
+	if v, ok := tfMap["encryption_option"].(string); ok && v != "" {
+		apiObject.EncryptionOption = types.S3EncryptionOption(v)
 	}
 
 	if v, ok := tfMap["kms_key_id"].(string); ok && v != "" {
-		rp.KmsKeyId = aws.String(v)
+		apiObject.KmsKeyId = aws.String(v)
 	}
 
-	if v, ok := tfMap["encryption_option"].(string); ok && v != "" {
-		rp.EncryptionOption = aws.String(v)
+	if v, ok := tfMap["object_key_prefix"].(string); ok && v != "" {
+		apiObject.ObjectKeyPrefix = aws.String(v)
 	}
 
-	return rp
+	return apiObject
 }
 
-func flattenS3Configuration(rp *timestreamwrite.S3Configuration) []interface{} {
-	if rp == nil {
+func flattenS3Configuration(apiObject *types.S3Configuration) []interface{} {
+	if apiObject == nil {
 		return []interface{}{}
 	}
 
-	m := map[string]interface{}{
-		"bucket_name":       aws.StringValue(rp.BucketName),
-		"object_key_prefix": aws.StringValue(rp.ObjectKeyPrefix),
-		"kms_key_id":        aws.StringValue(rp.KmsKeyId),
-		"encryption_option": aws.StringValue(rp.EncryptionOption),
+	tfMap := map[string]interface{}{
+		"bucket_name":       aws.ToString(apiObject.BucketName),
+		"encryption_option": string(apiObject.EncryptionOption),
+		"kms_key_id":        aws.ToString(apiObject.KmsKeyId),
+		"object_key_prefix": aws.ToString(apiObject.ObjectKeyPrefix),
+	}
+
+	return []interface{}{tfMap}
+}
+
+func expandSchema(tfMap map[string]interface{}) *types.Schema {
+	if tfMap == nil {
+		return nil
+	}
+
+	apiObject := &types.Schema{}
+
+	if v, ok := tfMap["composite_partition_key"].([]interface{}); ok && len(v) > 0 {
+		apiObject.CompositePartitionKey = expandPartitionKeys(v)
+	}
+
+	return apiObject
+}
+
+func expandPartitionKey(tfMap map[string]interface{}) *types.PartitionKey {
+	if tfMap == nil {
+		return nil
+	}
+
+	apiObject := &types.PartitionKey{}
+
+	if v, ok := tfMap["enforcement_in_record"].(string); ok && v != "" {
+		apiObject.EnforcementInRecord = types.PartitionKeyEnforcementLevel(v)
+	}
+
+	if v, ok := tfMap["name"].(string); ok && v != "" {
+		apiObject.Name = aws.String(v)
+	}
+
+	if v, ok := tfMap["type"].(string); ok && v != "" {
+		apiObject.Type = types.PartitionKeyType(v)
+	}
+
+	return apiObject
+}
+
+func expandPartitionKeys(tfList []interface{}) []types.PartitionKey {
+	if len(tfList) == 0 {
+		return nil
+	}
+
+	var apiObjects []types.PartitionKey
+
+	for _, tfMapRaw := range tfList {
+		tfMap, ok := tfMapRaw.(map[string]interface{})
+
+		if !ok {
+			continue
+		}
+
+		apiObject := expandPartitionKey(tfMap)
+
+		if apiObject == nil {
+			continue
+		}
+
+		apiObjects = append(apiObjects, *apiObject)
+	}
+
+	return apiObjects
+}
+
+func flattenSchema(apiObject *types.Schema) map[string]interface{} {
+	if apiObject == nil {
+		return nil
+	}
+
+	tfMap := map[string]interface{}{}
+
+	if v := apiObject.CompositePartitionKey; v != nil {
+		tfMap["composite_partition_key"] = flattenPartitionKeys(v)
+	}
+
+	return tfMap
+}
+
+func flattenPartitionKey(apiObject *types.PartitionKey) map[string]interface{} {
+	if apiObject == nil {
+		return nil
+	}
+
+	tfMap := map[string]interface{}{
+		"enforcement_in_record": apiObject.EnforcementInRecord,
+		"type":                  apiObject.Type,
+	}
+
+	if v := apiObject.Name; v != nil {
+		tfMap["name"] = aws.ToString(v)
 	}
 
-	return []interface{}{m}
+	return tfMap
 }
 
-func TableParseID(id string) (string, string, error) {
-	idParts := strings.SplitN(id, ":", 2)
-	if len(idParts) != 2 || idParts[0] == "" || idParts[1] == "" {
-		return "", "", fmt.Errorf("unexpected format of ID (%s), expected table_name:database_name", id)
+func flattenPartitionKeys(apiObjects []types.PartitionKey) []interface{} {
+	if len(apiObjects) == 0 {
+		return nil
 	}
-	return idParts[0], idParts[1], nil
+
+	var tfList []interface{}
+
+	for _, apiObject := range apiObjects {
+		tfList = append(tfList, flattenPartitionKey(&apiObject))
+	}
+
+	return tfList
+}
+
+const tableIDSeparator = ":"
+
+func tableCreateResourceID(tableName, databaseName string) string {
+	parts := []string{tableName, databaseName}
+	id := strings.Join(parts, tableIDSeparator)
+
+	return id
+}
+
+func tableParseResourceID(id string) (string, string, error) {
+	parts := strings.SplitN(id, tableIDSeparator, 2)
+
+	if len(parts) != 2 || parts[0] == "" || parts[1] == "" {
+		return "", "", fmt.Errorf("unexpected format of ID (%[1]s), expected table_name%[2]sdatabase_name", id, tableIDSeparator)
+	}
+
+	return parts[0], parts[1], nil
 }
diff --git a/internal/service/timestreamwrite/table_test.go b/internal/service/timestreamwrite/table_test.go
index c9f1a2c2ca3..776452dcccc 100644
--- a/internal/service/timestreamwrite/table_test.go
+++ b/internal/service/timestreamwrite/table_test.go
@@ -1,43 +1,54 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package timestreamwrite_test
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/timestreamwrite"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/timestreamwrite/types"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	tftimestreamwrite "github.com/hashicorp/terraform-provider-aws/internal/service/timestreamwrite"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
 func TestAccTimestreamWriteTable_basic(t *testing.T) {
 	ctx := acctest.Context(t)
+	var table types.Table
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_timestreamwrite_table.test"
 	dbResourceName := "aws_timestreamwrite_database.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, timestreamwrite.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.TimestreamWriteEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckTableDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccTableConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckTableExists(ctx, resourceName),
+					testAccCheckTableExists(ctx, resourceName, &table),
 					acctest.CheckResourceAttrRegionalARN(resourceName, "arn", "timestream", fmt.Sprintf("database/%[1]s/table/%[1]s", rName)),
 					resource.TestCheckResourceAttrPair(resourceName, "database_name", dbResourceName, "database_name"),
-					resource.TestCheckResourceAttr(resourceName, "retention_properties.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "magnetic_store_write_properties.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "magnetic_store_write_properties.0.enable_magnetic_store_writes", "false"),
 					resource.TestCheckResourceAttr(resourceName, "magnetic_store_write_properties.0.magnetic_store_rejected_data_location.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "retention_properties.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "schema.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "schema.0.composite_partition_key.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "schema.0.composite_partition_key.0.enforcement_in_record", ""),
+					resource.TestCheckResourceAttr(resourceName, "schema.0.composite_partition_key.0.name", ""),
+					resource.TestCheckResourceAttr(resourceName, "schema.0.composite_partition_key.0.type", "MEASURE"),
 					resource.TestCheckResourceAttr(resourceName, "table_name", rName),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 				),
@@ -53,19 +64,20 @@ func TestAccTimestreamWriteTable_basic(t *testing.T) {
 
 func TestAccTimestreamWriteTable_magneticStoreWriteProperties(t *testing.T) {
 	ctx := acctest.Context(t)
+	var table types.Table
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_timestreamwrite_table.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, timestreamwrite.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.TimestreamWriteEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckTableDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccTableConfig_magneticStoreWriteProperties(rName, true),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckTableExists(ctx, resourceName),
+					testAccCheckTableExists(ctx, resourceName, &table),
 					resource.TestCheckResourceAttr(resourceName, "magnetic_store_write_properties.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "magnetic_store_write_properties.0.enable_magnetic_store_writes", "true"),
 					resource.TestCheckResourceAttr(resourceName, "magnetic_store_write_properties.0.magnetic_store_rejected_data_location.#", "0"),
@@ -79,7 +91,7 @@ func TestAccTimestreamWriteTable_magneticStoreWriteProperties(t *testing.T) {
 			{
 				Config: testAccTableConfig_magneticStoreWriteProperties(rName, false),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckTableExists(ctx, resourceName),
+					testAccCheckTableExists(ctx, resourceName, &table),
 					resource.TestCheckResourceAttr(resourceName, "magnetic_store_write_properties.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "magnetic_store_write_properties.0.enable_magnetic_store_writes", "false"),
 				),
@@ -87,7 +99,7 @@ func TestAccTimestreamWriteTable_magneticStoreWriteProperties(t *testing.T) {
 			{
 				Config: testAccTableConfig_magneticStoreWriteProperties(rName, true),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckTableExists(ctx, resourceName),
+					testAccCheckTableExists(ctx, resourceName, &table),
 					resource.TestCheckResourceAttr(resourceName, "magnetic_store_write_properties.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "magnetic_store_write_properties.0.enable_magnetic_store_writes", "true"),
 				),
@@ -98,6 +110,7 @@ func TestAccTimestreamWriteTable_magneticStoreWriteProperties(t *testing.T) {
 
 func TestAccTimestreamWriteTable_magneticStoreWriteProperties_s3Config(t *testing.T) {
 	ctx := acctest.Context(t)
+	var table types.Table
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	rNameUpdated := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
@@ -105,14 +118,14 @@ func TestAccTimestreamWriteTable_magneticStoreWriteProperties_s3Config(t *testin
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, timestreamwrite.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.TimestreamWriteEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckTableDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccTableConfig_magneticStoreWritePropertiesS3(rName, rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckTableExists(ctx, resourceName),
+					testAccCheckTableExists(ctx, resourceName, &table),
 					resource.TestCheckResourceAttr(resourceName, "magnetic_store_write_properties.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "magnetic_store_write_properties.0.enable_magnetic_store_writes", "true"),
 					resource.TestCheckResourceAttr(resourceName, "magnetic_store_write_properties.0.magnetic_store_rejected_data_location.#", "1"),
@@ -129,7 +142,7 @@ func TestAccTimestreamWriteTable_magneticStoreWriteProperties_s3Config(t *testin
 			{
 				Config: testAccTableConfig_magneticStoreWritePropertiesS3(rName, rNameUpdated),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckTableExists(ctx, resourceName),
+					testAccCheckTableExists(ctx, resourceName, &table),
 					resource.TestCheckResourceAttr(resourceName, "magnetic_store_write_properties.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "magnetic_store_write_properties.0.enable_magnetic_store_writes", "true"),
 					resource.TestCheckResourceAttr(resourceName, "magnetic_store_write_properties.0.magnetic_store_rejected_data_location.#", "1"),
@@ -144,20 +157,21 @@ func TestAccTimestreamWriteTable_magneticStoreWriteProperties_s3Config(t *testin
 
 func TestAccTimestreamWriteTable_magneticStoreWriteProperties_s3KMSConfig(t *testing.T) {
 	ctx := acctest.Context(t)
+	var table types.Table
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resourceName := "aws_timestreamwrite_table.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, timestreamwrite.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.TimestreamWriteEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckTableDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccTableConfig_magneticStoreWritePropertiesS3KMS(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckTableExists(ctx, resourceName),
+					testAccCheckTableExists(ctx, resourceName, &table),
 					resource.TestCheckResourceAttr(resourceName, "magnetic_store_write_properties.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "magnetic_store_write_properties.0.enable_magnetic_store_writes", "true"),
 					resource.TestCheckResourceAttr(resourceName, "magnetic_store_write_properties.0.magnetic_store_rejected_data_location.#", "1"),
@@ -179,19 +193,20 @@ func TestAccTimestreamWriteTable_magneticStoreWriteProperties_s3KMSConfig(t *tes
 
 func TestAccTimestreamWriteTable_disappears(t *testing.T) {
 	ctx := acctest.Context(t)
+	var table types.Table
 	resourceName := "aws_timestreamwrite_table.test"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, timestreamwrite.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.TimestreamWriteEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckTableDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccTableConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckTableExists(ctx, resourceName),
+					testAccCheckTableExists(ctx, resourceName, &table),
 					acctest.CheckResourceDisappears(ctx, acctest.Provider, tftimestreamwrite.ResourceTable(), resourceName),
 					acctest.CheckResourceDisappears(ctx, acctest.Provider, tftimestreamwrite.ResourceTable(), resourceName),
 				),
@@ -203,19 +218,20 @@ func TestAccTimestreamWriteTable_disappears(t *testing.T) {
 
 func TestAccTimestreamWriteTable_retentionProperties(t *testing.T) {
 	ctx := acctest.Context(t)
+	var table types.Table
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_timestreamwrite_table.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, timestreamwrite.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.TimestreamWriteEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckTableDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccTableConfig_retentionProperties(rName, 30, 120),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckTableExists(ctx, resourceName),
+					testAccCheckTableExists(ctx, resourceName, &table),
 					resource.TestCheckResourceAttr(resourceName, "retention_properties.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "retention_properties.0.magnetic_store_retention_period_in_days", "30"),
 					resource.TestCheckResourceAttr(resourceName, "retention_properties.0.memory_store_retention_period_in_hours", "120"),
@@ -229,7 +245,7 @@ func TestAccTimestreamWriteTable_retentionProperties(t *testing.T) {
 			{
 				Config: testAccTableConfig_retentionProperties(rName, 300, 7),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckTableExists(ctx, resourceName),
+					testAccCheckTableExists(ctx, resourceName, &table),
 					resource.TestCheckResourceAttr(resourceName, "retention_properties.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "retention_properties.0.magnetic_store_retention_period_in_days", "300"),
 					resource.TestCheckResourceAttr(resourceName, "retention_properties.0.memory_store_retention_period_in_hours", "7"),
@@ -243,7 +259,7 @@ func TestAccTimestreamWriteTable_retentionProperties(t *testing.T) {
 			{
 				Config: testAccTableConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckTableExists(ctx, resourceName),
+					testAccCheckTableExists(ctx, resourceName, &table),
 					resource.TestCheckResourceAttr(resourceName, "retention_properties.#", "1"),
 				),
 			},
@@ -253,19 +269,20 @@ func TestAccTimestreamWriteTable_retentionProperties(t *testing.T) {
 
 func TestAccTimestreamWriteTable_tags(t *testing.T) {
 	ctx := acctest.Context(t)
+	var table types.Table
 	resourceName := "aws_timestreamwrite_table.test"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, timestreamwrite.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, names.TimestreamWriteEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckTableDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccTableConfig_tags1(rName, "key1", "value1"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckTableExists(ctx, resourceName),
+					testAccCheckTableExists(ctx, resourceName, &table),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
 					resource.TestCheckResourceAttr(resourceName, "tags_all.%", "1"),
@@ -275,7 +292,7 @@ func TestAccTimestreamWriteTable_tags(t *testing.T) {
 			{
 				Config: testAccTableConfig_tags2(rName, "key1", "value1updated", "key2", "value2"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckTableExists(ctx, resourceName),
+					testAccCheckTableExists(ctx, resourceName, &table),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1updated"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
@@ -287,7 +304,7 @@ func TestAccTimestreamWriteTable_tags(t *testing.T) {
 			{
 				Config: testAccTableConfig_tags1(rName, "key2", "value2"),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckTableExists(ctx, resourceName),
+					testAccCheckTableExists(ctx, resourceName, &table),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
 					resource.TestCheckResourceAttr(resourceName, "tags_all.%", "1"),
@@ -303,29 +320,68 @@ func TestAccTimestreamWriteTable_tags(t *testing.T) {
 	})
 }
 
+func TestAccTimestreamWriteTable_schema(t *testing.T) {
+	ctx := acctest.Context(t)
+	var table1, table2 types.Table
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_timestreamwrite_table.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, names.TimestreamWriteEndpointID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckTableDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccTableConfig_schema(rName, "OPTIONAL"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckTableExists(ctx, resourceName, &table1),
+					resource.TestCheckResourceAttr(resourceName, "schema.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "schema.0.composite_partition_key.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "schema.0.composite_partition_key.0.enforcement_in_record", "OPTIONAL"),
+					resource.TestCheckResourceAttr(resourceName, "schema.0.composite_partition_key.0.name", "attr1"),
+					resource.TestCheckResourceAttr(resourceName, "schema.0.composite_partition_key.0.type", "DIMENSION"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				Config: testAccTableConfig_schema(rName, "REQUIRED"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckTableExists(ctx, resourceName, &table2),
+					testAccCheckTableNotRecreated(&table2, &table1),
+					resource.TestCheckResourceAttr(resourceName, "schema.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "schema.0.composite_partition_key.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "schema.0.composite_partition_key.0.enforcement_in_record", "REQUIRED"),
+					resource.TestCheckResourceAttr(resourceName, "schema.0.composite_partition_key.0.name", "attr1"),
+					resource.TestCheckResourceAttr(resourceName, "schema.0.composite_partition_key.0.type", "DIMENSION"),
+				),
+			},
+		},
+	})
+}
+
 func testAccCheckTableDestroy(ctx context.Context) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		conn := acctest.Provider.Meta().(*conns.AWSClient).TimestreamWriteConn(ctx)
+		conn := acctest.Provider.Meta().(*conns.AWSClient).TimestreamWriteClient(ctx)
 
 		for _, rs := range s.RootModule().Resources {
 			if rs.Type != "aws_timestreamwrite_table" {
 				continue
 			}
 
-			tableName, dbName, err := tftimestreamwrite.TableParseID(rs.Primary.ID)
+			tableName, databaseName, err := tftimestreamwrite.TableParseResourceID(rs.Primary.ID)
 
 			if err != nil {
 				return err
 			}
 
-			input := &timestreamwrite.DescribeTableInput{
-				DatabaseName: aws.String(dbName),
-				TableName:    aws.String(tableName),
-			}
-
-			output, err := conn.DescribeTableWithContext(ctx, input)
+			_, err = tftimestreamwrite.FindTableByTwoPartKey(ctx, conn, databaseName, tableName)
 
-			if tfawserr.ErrCodeEquals(err, timestreamwrite.ErrCodeResourceNotFoundException) {
+			if tfresource.NotFound(err) {
 				continue
 			}
 
@@ -333,91 +389,82 @@ func testAccCheckTableDestroy(ctx context.Context) resource.TestCheckFunc {
 				return err
 			}
 
-			if output != nil && output.Table != nil {
-				return fmt.Errorf("Timestream Table (%s) still exists", rs.Primary.ID)
-			}
+			return fmt.Errorf("Timestream Table %s still exists", rs.Primary.ID)
 		}
 
 		return nil
 	}
 }
 
-func testAccCheckTableExists(ctx context.Context, n string) resource.TestCheckFunc {
+func testAccCheckTableExists(ctx context.Context, n string, v *types.Table) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		rs, ok := s.RootModule().Resources[n]
 		if !ok {
 			return fmt.Errorf("Not found: %s", n)
 		}
 
-		if rs.Primary.ID == "" {
-			return fmt.Errorf("no resource ID is set")
-		}
-
-		tableName, dbName, err := tftimestreamwrite.TableParseID(rs.Primary.ID)
+		tableName, databaseName, err := tftimestreamwrite.TableParseResourceID(rs.Primary.ID)
 
 		if err != nil {
 			return err
 		}
 
-		conn := acctest.Provider.Meta().(*conns.AWSClient).TimestreamWriteConn(ctx)
+		conn := acctest.Provider.Meta().(*conns.AWSClient).TimestreamWriteClient(ctx)
 
-		input := &timestreamwrite.DescribeTableInput{
-			DatabaseName: aws.String(dbName),
-			TableName:    aws.String(tableName),
-		}
-
-		output, err := conn.DescribeTableWithContext(ctx, input)
+		output, err := tftimestreamwrite.FindTableByTwoPartKey(ctx, conn, databaseName, tableName)
 
 		if err != nil {
 			return err
 		}
 
-		if output == nil || output.Table == nil {
-			return fmt.Errorf("Timestream Table (%s) not found", rs.Primary.ID)
+		*v = *output
+
+		return err
+	}
+}
+
+func testAccCheckTableNotRecreated(i, j *types.Table) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		if !aws.ToTime(i.CreationTime).Equal(aws.ToTime(j.CreationTime)) {
+			return errors.New("Timestream Table was recreated")
 		}
 
 		return nil
 	}
 }
 
-func testAccTableBaseConfig(rName string) string {
+func testAccTableConfig_base(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_timestreamwrite_database" "test" {
-  database_name = %q
+  database_name = %[1]q
 }
 `, rName)
 }
 
 func testAccTableConfig_basic(rName string) string {
-	return acctest.ConfigCompose(
-		testAccTableBaseConfig(rName),
-		fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccTableConfig_base(rName), fmt.Sprintf(`
 resource "aws_timestreamwrite_table" "test" {
   database_name = aws_timestreamwrite_database.test.database_name
-  table_name    = %q
+  table_name    = %[1]q
 }
 `, rName))
 }
 
 func testAccTableConfig_magneticStoreWriteProperties(rName string, enable bool) string {
-	return acctest.ConfigCompose(
-		testAccTableBaseConfig(rName),
-		fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccTableConfig_base(rName), fmt.Sprintf(`
 resource "aws_timestreamwrite_table" "test" {
   database_name = aws_timestreamwrite_database.test.database_name
-  table_name    = %q
+  table_name    = %[1]q
 
   magnetic_store_write_properties {
-    enable_magnetic_store_writes = %t
+    enable_magnetic_store_writes = %[2]t
   }
 }
 `, rName, enable))
 }
 
 func testAccTableConfig_magneticStoreWritePropertiesS3(rName, prefix string) string {
-	return acctest.ConfigCompose(
-		testAccTableBaseConfig(rName),
-		fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccTableConfig_base(rName), fmt.Sprintf(`
 resource "aws_s3_bucket" "test" {
   bucket        = %[1]q
   force_destroy = true
@@ -442,9 +489,7 @@ resource "aws_timestreamwrite_table" "test" {
 }
 
 func testAccTableConfig_magneticStoreWritePropertiesS3KMS(rName string) string {
-	return acctest.ConfigCompose(
-		testAccTableBaseConfig(rName),
-		fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccTableConfig_base(rName), fmt.Sprintf(`
 resource "aws_s3_bucket" "test" {
   bucket        = %[1]q
   force_destroy = true
@@ -476,25 +521,21 @@ resource "aws_timestreamwrite_table" "test" {
 }
 
 func testAccTableConfig_retentionProperties(rName string, magneticStoreDays, memoryStoreHours int) string {
-	return acctest.ConfigCompose(
-		testAccTableBaseConfig(rName),
-		fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccTableConfig_base(rName), fmt.Sprintf(`
 resource "aws_timestreamwrite_table" "test" {
   database_name = aws_timestreamwrite_database.test.database_name
-  table_name    = %q
+  table_name    = %[1]q
 
   retention_properties {
-    magnetic_store_retention_period_in_days = %d
-    memory_store_retention_period_in_hours  = %d
+    magnetic_store_retention_period_in_days = %[2]d
+    memory_store_retention_period_in_hours  = %[3]d
   }
 }
 `, rName, magneticStoreDays, memoryStoreHours))
 }
 
 func testAccTableConfig_tags1(rName, tagKey1, tagValue1 string) string {
-	return acctest.ConfigCompose(
-		testAccTableBaseConfig(rName),
-		fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccTableConfig_base(rName), fmt.Sprintf(`
 resource "aws_timestreamwrite_table" "test" {
   database_name = aws_timestreamwrite_database.test.database_name
   table_name    = %[1]q
@@ -507,9 +548,7 @@ resource "aws_timestreamwrite_table" "test" {
 }
 
 func testAccTableConfig_tags2(rName, tagKey1, tagValue1, tagKey2, tagValue2 string) string {
-	return acctest.ConfigCompose(
-		testAccTableBaseConfig(rName),
-		fmt.Sprintf(`
+	return acctest.ConfigCompose(testAccTableConfig_base(rName), fmt.Sprintf(`
 resource "aws_timestreamwrite_table" "test" {
   database_name = aws_timestreamwrite_database.test.database_name
   table_name    = %[1]q
@@ -521,3 +560,20 @@ resource "aws_timestreamwrite_table" "test" {
 }
 `, rName, tagKey1, tagValue1, tagKey2, tagValue2))
 }
+
+func testAccTableConfig_schema(rName, enforcementInRecord string) string {
+	return acctest.ConfigCompose(testAccTableConfig_base(rName), fmt.Sprintf(`
+resource "aws_timestreamwrite_table" "test" {
+  database_name = aws_timestreamwrite_database.test.database_name
+  table_name    = %[1]q
+
+  schema {
+    composite_partition_key {
+      enforcement_in_record = %[2]q
+      name                  = "attr1"
+      type                  = "DIMENSION"
+    }
+  }
+}
+`, rName, enforcementInRecord))
+}
diff --git a/internal/service/timestreamwrite/tags_gen.go b/internal/service/timestreamwrite/tags_gen.go
index e0c5c73943e..c82409dc899 100644
--- a/internal/service/timestreamwrite/tags_gen.go
+++ b/internal/service/timestreamwrite/tags_gen.go
@@ -5,10 +5,12 @@ import (
 	"context"
 	"fmt"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/timestreamwrite"
-	"github.com/aws/aws-sdk-go/service/timestreamwrite/timestreamwriteiface"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/timestreamwrite"
+	awstypes "github.com/aws/aws-sdk-go-v2/service/timestreamwrite/types"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -17,12 +19,12 @@ import (
 // listTags lists timestreamwrite service tags.
 // The identifier is typically the Amazon Resource Name (ARN), although
 // it may also be a different identifier depending on the service.
-func listTags(ctx context.Context, conn timestreamwriteiface.TimestreamWriteAPI, identifier string) (tftags.KeyValueTags, error) {
+func listTags(ctx context.Context, conn *timestreamwrite.Client, identifier string) (tftags.KeyValueTags, error) {
 	input := &timestreamwrite.ListTagsForResourceInput{
 		ResourceARN: aws.String(identifier),
 	}
 
-	output, err := conn.ListTagsForResourceWithContext(ctx, input)
+	output, err := conn.ListTagsForResource(ctx, input)
 
 	if err != nil {
 		return tftags.New(ctx, nil), err
@@ -34,7 +36,7 @@ func listTags(ctx context.Context, conn timestreamwriteiface.TimestreamWriteAPI,
 // ListTags lists timestreamwrite service tags and set them in Context.
 // It is called from outside this package.
 func (p *servicePackage) ListTags(ctx context.Context, meta any, identifier string) error {
-	tags, err := listTags(ctx, meta.(*conns.AWSClient).TimestreamWriteConn(ctx), identifier)
+	tags, err := listTags(ctx, meta.(*conns.AWSClient).TimestreamWriteClient(ctx), identifier)
 
 	if err != nil {
 		return err
@@ -50,11 +52,11 @@ func (p *servicePackage) ListTags(ctx context.Context, meta any, identifier stri
 // []*SERVICE.Tag handling
 
 // Tags returns timestreamwrite service tags.
-func Tags(tags tftags.KeyValueTags) []*timestreamwrite.Tag {
-	result := make([]*timestreamwrite.Tag, 0, len(tags))
+func Tags(tags tftags.KeyValueTags) []awstypes.Tag {
+	result := make([]awstypes.Tag, 0, len(tags))
 
 	for k, v := range tags.Map() {
-		tag := &timestreamwrite.Tag{
+		tag := awstypes.Tag{
 			Key:   aws.String(k),
 			Value: aws.String(v),
 		}
@@ -66,11 +68,11 @@ func Tags(tags tftags.KeyValueTags) []*timestreamwrite.Tag {
 }
 
 // KeyValueTags creates tftags.KeyValueTags from timestreamwrite service tags.
-func KeyValueTags(ctx context.Context, tags []*timestreamwrite.Tag) tftags.KeyValueTags {
+func KeyValueTags(ctx context.Context, tags []awstypes.Tag) tftags.KeyValueTags {
 	m := make(map[string]*string, len(tags))
 
 	for _, tag := range tags {
-		m[aws.StringValue(tag.Key)] = tag.Value
+		m[aws.ToString(tag.Key)] = tag.Value
 	}
 
 	return tftags.New(ctx, m)
@@ -78,7 +80,7 @@ func KeyValueTags(ctx context.Context, tags []*timestreamwrite.Tag) tftags.KeyVa
 
 // getTagsIn returns timestreamwrite service tags from Context.
 // nil is returned if there are no input tags.
-func getTagsIn(ctx context.Context) []*timestreamwrite.Tag {
+func getTagsIn(ctx context.Context) []awstypes.Tag {
 	if inContext, ok := tftags.FromContext(ctx); ok {
 		if tags := Tags(inContext.TagsIn.UnwrapOrDefault()); len(tags) > 0 {
 			return tags
@@ -89,7 +91,7 @@ func getTagsIn(ctx context.Context) []*timestreamwrite.Tag {
 }
 
 // setTagsOut sets timestreamwrite service tags in Context.
-func setTagsOut(ctx context.Context, tags []*timestreamwrite.Tag) {
+func setTagsOut(ctx context.Context, tags []awstypes.Tag) {
 	if inContext, ok := tftags.FromContext(ctx); ok {
 		inContext.TagsOut = types.Some(KeyValueTags(ctx, tags))
 	}
@@ -98,19 +100,21 @@ func setTagsOut(ctx context.Context, tags []*timestreamwrite.Tag) {
 // updateTags updates timestreamwrite service tags.
 // The identifier is typically the Amazon Resource Name (ARN), although
 // it may also be a different identifier depending on the service.
-func updateTags(ctx context.Context, conn timestreamwriteiface.TimestreamWriteAPI, identifier string, oldTagsMap, newTagsMap any) error {
+func updateTags(ctx context.Context, conn *timestreamwrite.Client, identifier string, oldTagsMap, newTagsMap any) error {
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.TimestreamWrite)
 	if len(removedTags) > 0 {
 		input := &timestreamwrite.UntagResourceInput{
 			ResourceARN: aws.String(identifier),
-			TagKeys:     aws.StringSlice(removedTags.Keys()),
+			TagKeys:     removedTags.Keys(),
 		}
 
-		_, err := conn.UntagResourceWithContext(ctx, input)
+		_, err := conn.UntagResource(ctx, input)
 
 		if err != nil {
 			return fmt.Errorf("untagging resource (%s): %w", identifier, err)
@@ -125,7 +129,7 @@ func updateTags(ctx context.Context, conn timestreamwriteiface.TimestreamWriteAP
 			Tags:        Tags(updatedTags),
 		}
 
-		_, err := conn.TagResourceWithContext(ctx, input)
+		_, err := conn.TagResource(ctx, input)
 
 		if err != nil {
 			return fmt.Errorf("tagging resource (%s): %w", identifier, err)
@@ -138,5 +142,5 @@ func updateTags(ctx context.Context, conn timestreamwriteiface.TimestreamWriteAP
 // UpdateTags updates timestreamwrite service tags.
 // It is called from outside this package.
 func (p *servicePackage) UpdateTags(ctx context.Context, meta any, identifier string, oldTags, newTags any) error {
-	return updateTags(ctx, meta.(*conns.AWSClient).TimestreamWriteConn(ctx), identifier, oldTags, newTags)
+	return updateTags(ctx, meta.(*conns.AWSClient).TimestreamWriteClient(ctx), identifier, oldTags, newTags)
 }
diff --git a/internal/service/transcribe/generate.go b/internal/service/transcribe/generate.go
index d4b60336a81..26a51406962 100644
--- a/internal/service/transcribe/generate.go
+++ b/internal/service/transcribe/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -AWSSDKVersion=2 -TagInIDElem=ResourceArn -ListTags -ListTagsInIDElem=ResourceArn -ServiceTagsSlice -UpdateTags -UntagInTagsElem=TagKeys
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/transcribe/language_model.go b/internal/service/transcribe/language_model.go
index 5f6b854746a..3e1d6028580 100644
--- a/internal/service/transcribe/language_model.go
+++ b/internal/service/transcribe/language_model.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package transcribe
 
 import (
diff --git a/internal/service/transcribe/language_model_test.go b/internal/service/transcribe/language_model_test.go
index b1b9fc8dfb1..c3157dfd8f9 100644
--- a/internal/service/transcribe/language_model_test.go
+++ b/internal/service/transcribe/language_model_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package transcribe_test
 
 import (
diff --git a/internal/service/transcribe/medical_vocabulary.go b/internal/service/transcribe/medical_vocabulary.go
index 0a8ac430607..7ed117a44bd 100644
--- a/internal/service/transcribe/medical_vocabulary.go
+++ b/internal/service/transcribe/medical_vocabulary.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package transcribe
 
 import (
diff --git a/internal/service/transcribe/medical_vocabulary_test.go b/internal/service/transcribe/medical_vocabulary_test.go
index 627671fb9c9..dec05ad9857 100644
--- a/internal/service/transcribe/medical_vocabulary_test.go
+++ b/internal/service/transcribe/medical_vocabulary_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package transcribe_test
 
 import (
diff --git a/internal/service/transcribe/service_package_gen.go b/internal/service/transcribe/service_package_gen.go
index bafbaa72c0d..3f1aabf7f47 100644
--- a/internal/service/transcribe/service_package_gen.go
+++ b/internal/service/transcribe/service_package_gen.go
@@ -7,6 +7,7 @@ import (
 
 	aws_sdkv2 "github.com/aws/aws-sdk-go-v2/aws"
 	transcribe_sdkv2 "github.com/aws/aws-sdk-go-v2/service/transcribe"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -72,9 +73,11 @@ func (p *servicePackage) NewClient(ctx context.Context, config map[string]any) (
 
 	return transcribe_sdkv2.NewFromConfig(cfg, func(o *transcribe_sdkv2.Options) {
 		if endpoint := config["endpoint"].(string); endpoint != "" {
-			o.EndpointResolver = transcribe_sdkv2.EndpointResolverFromURL(endpoint)
+			o.BaseEndpoint = aws_sdkv2.String(endpoint)
 		}
 	}), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/transcribe/sweep.go b/internal/service/transcribe/sweep.go
index 53eba2397b3..6ab1591ae9c 100644
--- a/internal/service/transcribe/sweep.go
+++ b/internal/service/transcribe/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package transcribe
 
@@ -9,12 +9,12 @@ import (
 
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/transcribe"
-	"github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv2"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_transcribe_language_model", &resource.Sweeper{
 		Name: "aws_transcribe_language_model",
 		F:    sweepLanguageModels,
@@ -51,23 +51,22 @@ func init() {
 
 func sweepLanguageModels(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
-		fmt.Errorf("error getting client: %s", err)
+		return fmt.Errorf("error getting client: %s", err)
 	}
 
 	conn := client.TranscribeClient(ctx)
 	sweepResources := make([]sweep.Sweepable, 0)
 	in := &transcribe.ListLanguageModelsInput{}
-	var errs *multierror.Error
 
 	pages := transcribe.NewListLanguageModelsPaginator(conn, in)
 
 	for pages.HasMorePages() {
 		page, err := pages.NextPage(ctx)
 
-		if sweep.SkipSweepError(err) {
-			log.Println("[WARN] Skipping Transcribe Language Models sweep for %s: %s", region, err)
+		if awsv2.SkipSweepError(err) {
+			log.Printf("[WARN] Skipping Transcribe Language Models sweep for %s: %s", region, err)
 			return nil
 		}
 
@@ -87,34 +86,28 @@ func sweepLanguageModels(region string) error {
 		}
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
-		errs = multierror.Append(errs, fmt.Errorf("error sweeping Transcribe Language Models for %s: %w", region, err))
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
+		return fmt.Errorf("error sweeping Transcribe Language Models for %s: %w", region, err)
 	}
 
-	if sweep.SkipSweepError(err) {
-		log.Printf("[WARN] Skipping Transcribe Language Models sweep for %s: %s", region, errs)
-		return nil
-	}
-
-	return errs.ErrorOrNil()
+	return nil
 }
 
 func sweepMedicalVocabularies(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
-		fmt.Errorf("error getting client: %s", err)
+		return fmt.Errorf("error getting client: %s", err)
 	}
 
 	conn := client.TranscribeClient(ctx)
 	sweepResources := make([]sweep.Sweepable, 0)
 	in := &transcribe.ListMedicalVocabulariesInput{}
-	var errs *multierror.Error
 
 	for {
 		out, err := conn.ListMedicalVocabularies(ctx, in)
-		if sweep.SkipSweepError(err) {
-			log.Println("[WARN] Skipping Transcribe Medical Vocabularies sweep for %s: %s", region, err)
+		if awsv2.SkipSweepError(err) {
+			log.Printf("[WARN] Skipping Transcribe Medical Vocabularies sweep for %s: %s", region, err)
 			return nil
 		}
 		if err != nil {
@@ -138,34 +131,28 @@ func sweepMedicalVocabularies(region string) error {
 		in.NextToken = out.NextToken
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
-		errs = multierror.Append(errs, fmt.Errorf("error sweeping Transcribe Medical Vocabularies for %s: %w", region, err))
-	}
-
-	if sweep.SkipSweepError(err) {
-		log.Printf("[WARN] Skipping Transcribe Medical Vocabularies sweep for %s: %s", region, errs)
-		return nil
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
+		return fmt.Errorf("error sweeping Transcribe Medical Vocabularies for %s: %w", region, err)
 	}
 
-	return errs.ErrorOrNil()
+	return nil
 }
 
 func sweepVocabularies(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
-		fmt.Errorf("error getting client: %s", err)
+		return fmt.Errorf("error getting client: %s", err)
 	}
 
 	conn := client.TranscribeClient(ctx)
 	sweepResources := make([]sweep.Sweepable, 0)
 	in := &transcribe.ListVocabulariesInput{}
-	var errs *multierror.Error
 
 	for {
 		out, err := conn.ListVocabularies(ctx, in)
-		if sweep.SkipSweepError(err) {
-			log.Println("[WARN] Skipping Transcribe Vocabularies sweep for %s: %s", region, err)
+		if awsv2.SkipSweepError(err) {
+			log.Printf("[WARN] Skipping Transcribe Vocabularies sweep for %s: %s", region, err)
 			return nil
 		}
 		if err != nil {
@@ -189,41 +176,34 @@ func sweepVocabularies(region string) error {
 		in.NextToken = out.NextToken
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
-		errs = multierror.Append(errs, fmt.Errorf("error sweeping Transcribe Vocabularies for %s: %w", region, err))
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
+		return fmt.Errorf("error sweeping Transcribe Vocabularies for %s: %w", region, err)
 	}
 
-	if sweep.SkipSweepError(err) {
-		log.Printf("[WARN] Skipping Transcribe Vocabularies sweep for %s: %s", region, errs)
-		return nil
-	}
-
-	return errs.ErrorOrNil()
+	return nil
 }
 
 func sweepVocabularyFilters(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
-		fmt.Errorf("error getting client: %s", err)
+		return fmt.Errorf("error getting client: %s", err)
 	}
 
 	conn := client.TranscribeClient(ctx)
 	sweepResources := make([]sweep.Sweepable, 0)
 	in := &transcribe.ListVocabularyFiltersInput{}
-	var errs *multierror.Error
 
 	for {
 		out, err := conn.ListVocabularyFilters(ctx, in)
-		if sweep.SkipSweepError(err) {
-			log.Println("[WARN] Skipping Transcribe Vocabulary Filter sweep for %s: %s", region, err)
+		if awsv2.SkipSweepError(err) {
+			log.Printf("[WARN] Skipping Transcribe Vocabulary Filter sweep for %s: %s", region, err)
 			return nil
 		}
 		if err != nil {
 			return fmt.Errorf("error retrieving Transcribe Vocabulary Filters: %w", err)
 		}
 
-		log.Println(out)
 		for _, filter := range out.VocabularyFilters {
 			name := aws.ToString(filter.VocabularyFilterName)
 			log.Printf("[INFO] Deleting Transcribe Vocabulary Filter: %s", name)
@@ -241,14 +221,9 @@ func sweepVocabularyFilters(region string) error {
 		in.NextToken = out.NextToken
 	}
 
-	if err := sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
-		errs = multierror.Append(errs, fmt.Errorf("error sweeping Transcribe Vocabulary Filters for %s: %w", region, err))
-	}
-
-	if sweep.SkipSweepError(err) {
-		log.Printf("[WARN] Skipping Transcribe Vocabulary Filters sweep for %s: %s", region, errs)
-		return nil
+	if err := sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
+		return fmt.Errorf("error sweeping Transcribe Vocabulary Filters for %s: %w", region, err)
 	}
 
-	return errs.ErrorOrNil()
+	return nil
 }
diff --git a/internal/service/transcribe/tags_gen.go b/internal/service/transcribe/tags_gen.go
index 464e577ef68..b31d47c808d 100644
--- a/internal/service/transcribe/tags_gen.go
+++ b/internal/service/transcribe/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/transcribe"
 	awstypes "github.com/aws/aws-sdk-go-v2/service/transcribe/types"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -102,6 +104,8 @@ func updateTags(ctx context.Context, conn *transcribe.Client, identifier string,
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.Transcribe)
 	if len(removedTags) > 0 {
diff --git a/internal/service/transcribe/validate.go b/internal/service/transcribe/validate.go
index 8b17fa74b2a..33e3765b6d1 100644
--- a/internal/service/transcribe/validate.go
+++ b/internal/service/transcribe/validate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package transcribe
 
 import (
diff --git a/internal/service/transcribe/vocabulary.go b/internal/service/transcribe/vocabulary.go
index 5c3a1c1eda9..41d1847d42c 100644
--- a/internal/service/transcribe/vocabulary.go
+++ b/internal/service/transcribe/vocabulary.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package transcribe
 
 import (
diff --git a/internal/service/transcribe/vocabulary_filter.go b/internal/service/transcribe/vocabulary_filter.go
index c7dee58f9db..14409313a77 100644
--- a/internal/service/transcribe/vocabulary_filter.go
+++ b/internal/service/transcribe/vocabulary_filter.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package transcribe
 
 import (
diff --git a/internal/service/transcribe/vocabulary_filter_test.go b/internal/service/transcribe/vocabulary_filter_test.go
index f3d55f7b686..e98511dd49b 100644
--- a/internal/service/transcribe/vocabulary_filter_test.go
+++ b/internal/service/transcribe/vocabulary_filter_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package transcribe_test
 
 import (
diff --git a/internal/service/transcribe/vocabulary_test.go b/internal/service/transcribe/vocabulary_test.go
index 4b64fd3135c..dd591f78b95 100644
--- a/internal/service/transcribe/vocabulary_test.go
+++ b/internal/service/transcribe/vocabulary_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package transcribe_test
 
 import (
diff --git a/internal/service/transfer/acc_test.go b/internal/service/transfer/acc_test.go
index c64d95208f1..9012979df87 100644
--- a/internal/service/transfer/acc_test.go
+++ b/internal/service/transfer/acc_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package transfer_test
 
 import (
diff --git a/internal/service/transfer/access.go b/internal/service/transfer/access.go
index 073e1b96e5e..7d299a2befd 100644
--- a/internal/service/transfer/access.go
+++ b/internal/service/transfer/access.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package transfer
 
 import (
@@ -185,7 +188,7 @@ func resourceAccessRead(ctx context.Context, d *schema.ResourceData, meta interf
 		return sdkdiag.AppendErrorf(diags, "parsing Transfer Access ID: %s", err)
 	}
 
-	access, err := FindAccessByServerIDAndExternalID(ctx, conn, serverID, externalID)
+	access, err := FindAccessByTwoPartKey(ctx, conn, serverID, externalID)
 
 	if !d.IsNewResource() && tfresource.NotFound(err) {
 		log.Printf("[WARN] Transfer Access (%s) not found, removing from state", d.Id())
diff --git a/internal/service/transfer/access_test.go b/internal/service/transfer/access_test.go
index 03089da92f9..b3743025b67 100644
--- a/internal/service/transfer/access_test.go
+++ b/internal/service/transfer/access_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package transfer_test
 
 import (
@@ -184,7 +187,7 @@ func testAccCheckAccessExists(ctx context.Context, n string, v *transfer.Describ
 
 		conn := acctest.Provider.Meta().(*conns.AWSClient).TransferConn(ctx)
 
-		output, err := tftransfer.FindAccessByServerIDAndExternalID(ctx, conn, serverID, externalID)
+		output, err := tftransfer.FindAccessByTwoPartKey(ctx, conn, serverID, externalID)
 
 		if err != nil {
 			return err
@@ -210,7 +213,7 @@ func testAccCheckAccessDestroy(ctx context.Context) resource.TestCheckFunc {
 			if err != nil {
 				return fmt.Errorf("error parsing Transfer Access ID: %w", err)
 			}
-			_, err = tftransfer.FindAccessByServerIDAndExternalID(ctx, conn, serverID, externalID)
+			_, err = tftransfer.FindAccessByTwoPartKey(ctx, conn, serverID, externalID)
 
 			if tfresource.NotFound(err) {
 				continue
@@ -317,11 +320,6 @@ resource "aws_s3_bucket" "test" {
   bucket = %[1]q
 }
 
-resource "aws_s3_bucket_acl" "test" {
-  bucket = aws_s3_bucket.test.id
-  acl    = "private"
-}
-
 resource "aws_iam_role_policy" "test" {
   name = %[1]q
   role = aws_iam_role.test.id
diff --git a/internal/service/transfer/agreement.go b/internal/service/transfer/agreement.go
new file mode 100644
index 00000000000..2964c696aaa
--- /dev/null
+++ b/internal/service/transfer/agreement.go
@@ -0,0 +1,215 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package transfer
+
+import (
+	"context"
+	"log"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/transfer"
+	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
+	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/internal/verify"
+	"github.com/hashicorp/terraform-provider-aws/names"
+)
+
+// @SDKResource("aws_transfer_agreement", name="Agreement")
+// @Tags(identifierAttribute="arn")
+func ResourceAgreement() *schema.Resource {
+	return &schema.Resource{
+		CreateWithoutTimeout: resourceAgreementCreate,
+		ReadWithoutTimeout:   resourceAgreementRead,
+		UpdateWithoutTimeout: resourceAgreementUpdate,
+		DeleteWithoutTimeout: resourceAgreementDelete,
+
+		Importer: &schema.ResourceImporter{
+			StateContext: schema.ImportStatePassthroughContext,
+		},
+
+		Schema: map[string]*schema.Schema{
+			"access_role": {
+				Type:         schema.TypeString,
+				Required:     true,
+				ValidateFunc: verify.ValidARN,
+			},
+			"agreement_id": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"arn": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"base_directory": {
+				Type:     schema.TypeString,
+				Required: true,
+			},
+			"description": {
+				Type:     schema.TypeString,
+				Optional: true,
+			},
+			"local_profile_id": {
+				Type:     schema.TypeString,
+				Required: true,
+			},
+			"partner_profile_id": {
+				Type:     schema.TypeString,
+				Required: true,
+			},
+			"server_id": {
+				Type:     schema.TypeString,
+				Required: true,
+			},
+			"status": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			names.AttrTags:    tftags.TagsSchema(),
+			names.AttrTagsAll: tftags.TagsSchemaComputed(),
+		},
+		CustomizeDiff: verify.SetTagsDiff,
+	}
+}
+
+func resourceAgreementCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).TransferConn(ctx)
+
+	serverID := d.Get("server_id").(string)
+	input := &transfer.CreateAgreementInput{
+		AccessRole:       aws.String(d.Get("access_role").(string)),
+		BaseDirectory:    aws.String(d.Get("base_directory").(string)),
+		LocalProfileId:   aws.String(d.Get("local_profile_id").(string)),
+		PartnerProfileId: aws.String(d.Get("partner_profile_id").(string)),
+		ServerId:         aws.String(serverID),
+		Tags:             getTagsIn(ctx),
+	}
+
+	if v, ok := d.GetOk("description"); ok {
+		input.Description = aws.String(v.(string))
+	}
+
+	output, err := conn.CreateAgreementWithContext(ctx, input)
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "creating Transfer Agreement: %s", err)
+	}
+
+	d.SetId(AgreementCreateResourceID(serverID, aws.StringValue(output.AgreementId)))
+
+	return append(diags, resourceAgreementRead(ctx, d, meta)...)
+}
+
+func resourceAgreementRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).TransferConn(ctx)
+
+	serverID, agreementID, err := AgreementParseResourceID(d.Id())
+	if err != nil {
+		return sdkdiag.AppendFromErr(diags, err)
+	}
+
+	output, err := FindAgreementByTwoPartKey(ctx, conn, serverID, agreementID)
+
+	if !d.IsNewResource() && tfresource.NotFound(err) {
+		log.Printf("[WARN] Transfer Agreement (%s) not found, removing from state", d.Id())
+		d.SetId("")
+		return diags
+	}
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "reading Transfer Agreement (%s): %s", d.Id(), err)
+	}
+
+	d.Set("access_role", output.AccessRole)
+	d.Set("agreement_id", output.AgreementId)
+	d.Set("arn", output.Arn)
+	d.Set("base_directory", output.BaseDirectory)
+	d.Set("description", output.Description)
+	d.Set("local_profile_id", output.LocalProfileId)
+	d.Set("partner_profile_id", output.PartnerProfileId)
+	d.Set("server_id", output.ServerId)
+	d.Set("status", output.Status)
+	setTagsOut(ctx, output.Tags)
+
+	return diags
+}
+
+func resourceAgreementUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).TransferConn(ctx)
+
+	serverID, agreementID, err := AgreementParseResourceID(d.Id())
+	if err != nil {
+		return sdkdiag.AppendFromErr(diags, err)
+	}
+
+	if d.HasChangesExcept("tags", "tags_all") {
+		input := &transfer.UpdateAgreementInput{
+			AgreementId: aws.String(agreementID),
+			ServerId:    aws.String(serverID),
+		}
+
+		if d.HasChange("access_role") {
+			input.AccessRole = aws.String(d.Get("access_role").(string))
+		}
+
+		if d.HasChange("base_directory") {
+			input.BaseDirectory = aws.String(d.Get("base_directory").(string))
+		}
+
+		if d.HasChange("description") {
+			input.Description = aws.String(d.Get("description").(string))
+		}
+
+		if d.HasChange("local_profile_id") {
+			input.LocalProfileId = aws.String(d.Get("local_profile_id").(string))
+		}
+
+		if d.HasChange("partner_profile_id") {
+			input.PartnerProfileId = aws.String(d.Get("partner_profile_id").(string))
+		}
+
+		_, err := conn.UpdateAgreementWithContext(ctx, input)
+
+		if err != nil {
+			return sdkdiag.AppendErrorf(diags, "updating Transfer Agreement (%s): %s", d.Id(), err)
+		}
+	}
+
+	return append(diags, resourceAgreementRead(ctx, d, meta)...)
+}
+
+func resourceAgreementDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).TransferConn(ctx)
+
+	serverID, agreementID, err := AgreementParseResourceID(d.Id())
+
+	if err != nil {
+		return sdkdiag.AppendFromErr(diags, err)
+	}
+
+	log.Printf("[DEBUG] Deleting Transfer Agreement: %s", d.Id())
+	_, err = conn.DeleteAgreementWithContext(ctx, &transfer.DeleteAgreementInput{
+		AgreementId: aws.String(agreementID),
+		ServerId:    aws.String(serverID),
+	})
+
+	if tfawserr.ErrCodeEquals(err, transfer.ErrCodeResourceNotFoundException) {
+		return diags
+	}
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "deleting Transfer Agreement (%s): %s", d.Id(), err)
+	}
+
+	return diags
+}
diff --git a/internal/service/transfer/agreement_test.go b/internal/service/transfer/agreement_test.go
new file mode 100644
index 00000000000..093fa4ffa95
--- /dev/null
+++ b/internal/service/transfer/agreement_test.go
@@ -0,0 +1,308 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package transfer_test
+
+import (
+	"context"
+	"fmt"
+	"testing"
+
+	"github.com/aws/aws-sdk-go/service/transfer"
+	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
+	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	tftransfer "github.com/hashicorp/terraform-provider-aws/internal/service/transfer"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+)
+
+func testAccAgreement_basic(t *testing.T) {
+	ctx := acctest.Context(t)
+	var conf transfer.DescribedAgreement
+	baseDirectory1 := "/DOC-EXAMPLE-BUCKET/home/mydirectory1"
+	baseDirectory2 := "/DOC-EXAMPLE-BUCKET/home/mydirectory2"
+	resourceName := "aws_transfer_agreement.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+
+	resource.Test(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, transfer.EndpointsID)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, transfer.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckAgreementDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccAgreementConfig_basic(rName, baseDirectory1),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckAgreementExists(ctx, resourceName, &conf),
+					resource.TestCheckResourceAttrSet(resourceName, "arn"),
+					resource.TestCheckResourceAttr(resourceName, "base_directory", baseDirectory1),
+					resource.TestCheckResourceAttr(resourceName, "description", ""),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
+				),
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"status"},
+			},
+			{
+				Config: testAccAgreementConfig_basic(rName, baseDirectory2),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckAgreementExists(ctx, resourceName, &conf),
+					resource.TestCheckResourceAttr(resourceName, "base_directory", baseDirectory2),
+					resource.TestCheckResourceAttr(resourceName, "description", ""),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
+				),
+			},
+		},
+	})
+}
+
+func testAccAgreement_disappears(t *testing.T) {
+	ctx := acctest.Context(t)
+	var conf transfer.DescribedAgreement
+	resourceName := "aws_transfer_agreement.test"
+	baseDirectory := "/DOC-EXAMPLE-BUCKET/home/mydirectory"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+
+	resource.Test(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, transfer.EndpointsID)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, transfer.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckAgreementDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccAgreementConfig_basic(rName, baseDirectory),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAgreementExists(ctx, resourceName, &conf),
+					acctest.CheckResourceDisappears(ctx, acctest.Provider, tftransfer.ResourceAgreement(), resourceName),
+				),
+				ExpectNonEmptyPlan: true,
+			},
+		},
+	})
+}
+
+func testAccAgreement_tags(t *testing.T) {
+	ctx := acctest.Context(t)
+	var conf transfer.DescribedAgreement
+	baseDirectory := "/DOC-EXAMPLE-BUCKET/home/mydirectory"
+	resourceName := "aws_transfer_agreement.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+
+	resource.Test(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, transfer.EndpointsID)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, transfer.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckAgreementDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccAgreementConfig_tags1(rName, baseDirectory, "key1", "value1"),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckAgreementExists(ctx, resourceName, &conf),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
+				),
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"status"},
+			},
+			{
+				Config: testAccAgreementConfig_tags2(rName, baseDirectory, "key1", "value1updated", "key2", "value2"),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckAgreementExists(ctx, resourceName, &conf),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1updated"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
+				),
+			},
+			{
+				Config: testAccAgreementConfig_tags1(rName, baseDirectory, "key2", "value2"),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckAgreementExists(ctx, resourceName, &conf),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckAgreementExists(ctx context.Context, n string, v *transfer.DescribedAgreement) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		if rs.Primary.ID == "" {
+			return fmt.Errorf("No Transfer Agreement ID is set")
+		}
+
+		serverID, agreementID, err := tftransfer.AgreementParseResourceID(rs.Primary.ID)
+
+		if err != nil {
+			return err
+		}
+
+		conn := acctest.Provider.Meta().(*conns.AWSClient).TransferConn(ctx)
+
+		output, err := tftransfer.FindAgreementByTwoPartKey(ctx, conn, serverID, agreementID)
+
+		if err != nil {
+			return err
+		}
+
+		*v = *output
+
+		return nil
+	}
+}
+
+func testAccCheckAgreementDestroy(ctx context.Context) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		conn := acctest.Provider.Meta().(*conns.AWSClient).TransferConn(ctx)
+
+		for _, rs := range s.RootModule().Resources {
+			if rs.Type != "aws_transfer_agreement" {
+				continue
+			}
+
+			serverID, agreementID, err := tftransfer.AgreementParseResourceID(rs.Primary.ID)
+
+			if err != nil {
+				return err
+			}
+
+			_, err = tftransfer.FindAgreementByTwoPartKey(ctx, conn, serverID, agreementID)
+
+			if tfresource.NotFound(err) {
+				continue
+			}
+
+			if err != nil {
+				return err
+			}
+
+			return fmt.Errorf("Transfer Agreement %s still exists", rs.Primary.ID)
+		}
+
+		return nil
+	}
+}
+
+func testAccAgreementConfig_base(rName string) string {
+	return fmt.Sprintf(`
+resource "aws_iam_role" "test" {
+  name               = %[1]q
+  assume_role_policy = <<EOF
+  {
+	"Version": "2012-10-17",
+	"Statement": [{
+	  "Effect": "Allow",
+	  "Principal": {
+		"Service": "transfer.amazonaws.com"
+	  },
+	  "Action": "sts:AssumeRole"
+	}]
+  }
+EOF
+}
+
+resource "aws_iam_role_policy" "test" {
+  name = %[1]q
+  role = aws_iam_role.test.id
+
+  policy = <<POLICY
+{
+	 "Version":"2012-10-17",
+	 "Statement":[
+		{
+		   "Sid":"AllowFullAccesstoS3",
+		   "Effect":"Allow",
+		   "Action":[
+			  "s3:*"
+		   ],
+		   "Resource":"*"
+		}
+	 ]
+}
+POLICY
+}
+
+resource "aws_transfer_profile" "local" {
+  as2_id       = %[1]q
+  profile_type = "LOCAL"
+}
+
+resource "aws_transfer_profile" "partner" {
+  as2_id       = %[1]q
+  profile_type = "PARTNER"
+}
+
+resource "aws_transfer_server" "test" {}
+`, rName)
+}
+
+func testAccAgreementConfig_basic(rName, baseDirectory string) string {
+	return acctest.ConfigCompose(testAccAgreementConfig_base(rName), fmt.Sprintf(`
+resource "aws_transfer_agreement" "test" {
+  access_role        = aws_iam_role.test.arn
+  base_directory     = %[1]q
+  local_profile_id   = aws_transfer_profile.local.profile_id
+  partner_profile_id = aws_transfer_profile.partner.profile_id
+  server_id          = aws_transfer_server.test.id
+}
+`, baseDirectory))
+}
+
+func testAccAgreementConfig_tags1(rName, baseDirectory, tagKey1, tagValue1 string) string {
+	return acctest.ConfigCompose(testAccAgreementConfig_base(rName), fmt.Sprintf(`
+resource "aws_transfer_agreement" "test" {
+  access_role        = aws_iam_role.test.arn
+  base_directory     = %[1]q
+  local_profile_id   = aws_transfer_profile.local.profile_id
+  partner_profile_id = aws_transfer_profile.partner.profile_id
+  server_id          = aws_transfer_server.test.id
+
+  tags = {
+    %[2]q = %[3]q
+  }
+}
+`, baseDirectory, tagKey1, tagValue1))
+}
+
+func testAccAgreementConfig_tags2(rName, baseDirectory, tagKey1, tagValue1, tagKey2, tagValue2 string) string {
+	return acctest.ConfigCompose(testAccAgreementConfig_base(rName), fmt.Sprintf(`
+resource "aws_transfer_agreement" "test" {
+  access_role        = aws_iam_role.test.arn
+  base_directory     = %[1]q
+  local_profile_id   = aws_transfer_profile.local.profile_id
+  partner_profile_id = aws_transfer_profile.partner.profile_id
+  server_id          = aws_transfer_server.test.id
+
+  tags = {
+    %[2]q = %[3]q
+    %[4]q = %[5]q
+  }
+}
+`, baseDirectory, tagKey1, tagValue1, tagKey2, tagValue2))
+}
diff --git a/internal/service/transfer/certificate.go b/internal/service/transfer/certificate.go
new file mode 100644
index 00000000000..274519a2f9b
--- /dev/null
+++ b/internal/service/transfer/certificate.go
@@ -0,0 +1,196 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package transfer
+
+import (
+	"context"
+	"log"
+	"time"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go/service/transfer"
+	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
+	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/internal/verify"
+	"github.com/hashicorp/terraform-provider-aws/names"
+)
+
+// @SDKResource("aws_transfer_certificate", name="Certificate")
+// @Tags(identifierAttribute="arn")
+func ResourceCertificate() *schema.Resource {
+	return &schema.Resource{
+		CreateWithoutTimeout: resourceCertificateCreate,
+		ReadWithoutTimeout:   resourceCertificateRead,
+		UpdateWithoutTimeout: resourceCertificateUpdate,
+		DeleteWithoutTimeout: resourceCertificateDelete,
+
+		Importer: &schema.ResourceImporter{
+			StateContext: schema.ImportStatePassthroughContext,
+		},
+
+		Schema: map[string]*schema.Schema{
+			"active_date": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"arn": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"certificate": {
+				Type:         schema.TypeString,
+				Required:     true,
+				ForceNew:     true,
+				Sensitive:    true,
+				ValidateFunc: validation.StringLenBetween(0, 16384),
+			},
+			"certificate_chain": {
+				Type:         schema.TypeString,
+				Optional:     true,
+				ForceNew:     true,
+				Sensitive:    true,
+				ValidateFunc: validation.StringLenBetween(0, 2097152),
+			},
+			"certificate_id": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"description": {
+				Type:         schema.TypeString,
+				Optional:     true,
+				ValidateFunc: validation.StringLenBetween(0, 200),
+			},
+			"inactive_date": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"private_key": {
+				Type:         schema.TypeString,
+				Optional:     true,
+				ForceNew:     true,
+				Sensitive:    true,
+				ValidateFunc: validation.StringLenBetween(0, 16384),
+				//ExactlyOneOf: []string{"certificate_chain", "private_key"},
+			},
+			names.AttrTags:    tftags.TagsSchema(),
+			names.AttrTagsAll: tftags.TagsSchemaComputed(),
+			"usage": {
+				Type:         schema.TypeString,
+				Required:     true,
+				ForceNew:     true,
+				ValidateFunc: validation.StringInSlice(transfer.CertificateUsageType_Values(), false),
+			},
+		},
+
+		CustomizeDiff: verify.SetTagsDiff,
+	}
+}
+
+func resourceCertificateCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).TransferConn(ctx)
+
+	input := &transfer.ImportCertificateInput{
+		Certificate: aws.String(d.Get("certificate").(string)),
+		Tags:        getTagsIn(ctx),
+		Usage:       aws.String(d.Get("usage").(string)),
+	}
+
+	if v, ok := d.GetOk("certificate_chain"); ok {
+		input.CertificateChain = aws.String(v.(string))
+	}
+
+	if v, ok := d.GetOk("description"); ok {
+		input.Description = aws.String(v.(string))
+	}
+
+	if v, ok := d.GetOk("private_key"); ok {
+		input.PrivateKey = aws.String(v.(string))
+	}
+
+	output, err := conn.ImportCertificateWithContext(ctx, input)
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "importing Transfer Certificate: %s", err)
+	}
+
+	d.SetId(aws.ToString(output.CertificateId))
+
+	return append(diags, resourceCertificateRead(ctx, d, meta)...)
+}
+
+func resourceCertificateRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).TransferConn(ctx)
+
+	output, err := FindCertificateByID(ctx, conn, d.Id())
+
+	if !d.IsNewResource() && tfresource.NotFound(err) {
+		log.Printf("[WARN] Transfer Certificate (%s) not found, removing from state", d.Id())
+		d.SetId("")
+		return diags
+	}
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "reading Transfer Certificate (%s): %s", d.Id(), err)
+	}
+
+	d.Set("active_date", aws.ToTime(output.ActiveDate).Format(time.RFC3339))
+	d.Set("arn", output.Arn)
+	d.Set("certificate", output.Certificate)
+	d.Set("certificate_chain", output.CertificateChain)
+	d.Set("certificate_id", output.CertificateId)
+	d.Set("description", output.Description)
+	d.Set("inactive_date", aws.ToTime(output.InactiveDate).Format(time.RFC3339))
+	d.Set("usage", output.Usage)
+	setTagsOut(ctx, output.Tags)
+
+	return diags
+}
+
+func resourceCertificateUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).TransferConn(ctx)
+
+	if d.HasChange("description") {
+		input := &transfer.UpdateCertificateInput{
+			CertificateId: aws.String(d.Id()),
+			Description:   aws.String(d.Get("description").(string)),
+		}
+
+		_, err := conn.UpdateCertificateWithContext(ctx, input)
+
+		if err != nil {
+			return sdkdiag.AppendErrorf(diags, "updating Transfer Certificate (%s): %s", d.Id(), err)
+		}
+	}
+
+	return append(diags, resourceCertificateRead(ctx, d, meta)...)
+}
+
+func resourceCertificateDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).TransferConn(ctx)
+
+	log.Printf("[DEBUG] Deleting Transfer Certificate: %s", d.Id())
+	_, err := conn.DeleteCertificateWithContext(ctx, &transfer.DeleteCertificateInput{
+		CertificateId: aws.String(d.Id()),
+	})
+
+	if tfawserr.ErrCodeEquals(err, transfer.ErrCodeResourceNotFoundException) {
+		return diags
+	}
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "deleting Transfer Certificate (%s): %s", d.Id(), err)
+	}
+
+	return diags
+}
diff --git a/internal/service/transfer/certificate_test.go b/internal/service/transfer/certificate_test.go
new file mode 100644
index 00000000000..36378239170
--- /dev/null
+++ b/internal/service/transfer/certificate_test.go
@@ -0,0 +1,425 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package transfer_test
+
+import (
+	"context"
+	"fmt"
+	"testing"
+
+	"github.com/aws/aws-sdk-go/service/transfer"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
+	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	tftransfer "github.com/hashicorp/terraform-provider-aws/internal/service/transfer"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+)
+
+func TestAccTransferCertificate_basic(t *testing.T) {
+	ctx := acctest.Context(t)
+	var conf transfer.DescribedCertificate
+	resourceName := "aws_transfer_certificate.test"
+	domain := acctest.RandomDomainName()
+	domainWildcard := fmt.Sprintf("*.%s", domain)
+	caKey := acctest.TLSRSAPrivateKeyPEM(t, 2048)
+	caCertificate := acctest.TLSRSAX509SelfSignedCACertificatePEM(t, caKey)
+	key := acctest.TLSRSAPrivateKeyPEM(t, 2048)
+	certificate := acctest.TLSRSAX509LocallySignedCertificatePEM(t, caKey, caCertificate, key, domainWildcard)
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, transfer.EndpointsID)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, transfer.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckCertificateDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccCertificateConfig_basic(certificate, key, caCertificate),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckCertificateExists(ctx, resourceName, &conf),
+					acctest.CheckResourceAttrRFC3339(resourceName, "active_date"),
+					resource.TestCheckResourceAttrSet(resourceName, "arn"),
+					acctest.CheckResourceAttrRFC3339(resourceName, "inactive_date"),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
+					resource.TestCheckResourceAttr(resourceName, "usage", "SIGNING"),
+				),
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"private_key", "certificate", "certificate_chain"},
+			},
+		},
+	})
+}
+
+func TestAccTransferCertificate_certificate(t *testing.T) {
+	ctx := acctest.Context(t)
+	var conf transfer.DescribedCertificate
+	resourceName := "aws_transfer_certificate.test"
+	caKey := acctest.TLSRSAPrivateKeyPEM(t, 2048)
+	caCertificate := acctest.TLSRSAX509SelfSignedCACertificatePEM(t, caKey)
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, transfer.EndpointsID)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, transfer.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckCertificateDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccCertificateConfig_certificate(caCertificate),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckCertificateExists(ctx, resourceName, &conf),
+					acctest.CheckResourceAttrRFC3339(resourceName, "active_date"),
+					acctest.CheckResourceAttrRFC3339(resourceName, "inactive_date"),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
+					resource.TestCheckResourceAttr(resourceName, "usage", "SIGNING"),
+				),
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"private_key", "certificate", "certificate_chain"},
+			},
+		},
+	})
+}
+
+func TestAccTransferCertificate_certificateChain(t *testing.T) {
+	ctx := acctest.Context(t)
+	var conf transfer.DescribedCertificate
+	resourceName := "aws_transfer_certificate.test"
+	domain := acctest.RandomDomainName()
+	domainWildcard := fmt.Sprintf("*.%s", domain)
+	key := acctest.TLSRSAPrivateKeyPEM(t, 2048)
+	caKey := acctest.TLSRSAPrivateKeyPEM(t, 2048)
+	caCertificate := acctest.TLSRSAX509SelfSignedCACertificatePEM(t, caKey)
+	certificate := acctest.TLSRSAX509LocallySignedCertificatePEM(t, caKey, caCertificate, key, domainWildcard)
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, transfer.EndpointsID)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, transfer.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckCertificateDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccCertificateConfig_certificateChain(certificate, caCertificate),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckCertificateExists(ctx, resourceName, &conf),
+					acctest.CheckResourceAttrRFC3339(resourceName, "active_date"),
+					acctest.CheckResourceAttrRFC3339(resourceName, "inactive_date"),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
+					resource.TestCheckResourceAttr(resourceName, "usage", "SIGNING"),
+				),
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"private_key", "certificate", "certificate_chain"},
+			},
+		},
+	})
+}
+
+func TestAccTransferCertificate_certificateKey(t *testing.T) {
+	ctx := acctest.Context(t)
+	var conf transfer.DescribedCertificate
+	resourceName := "aws_transfer_certificate.test"
+	key := acctest.TLSRSAPrivateKeyPEM(t, 2048)
+	certificate := acctest.TLSRSAX509SelfSignedCertificatePEM(t, key, acctest.RandomSubdomain())
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, transfer.EndpointsID)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, transfer.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckCertificateDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccCertificateConfig_certificatePrivateKey(certificate, key),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckCertificateExists(ctx, resourceName, &conf),
+					acctest.CheckResourceAttrRFC3339(resourceName, "active_date"),
+					acctest.CheckResourceAttrRFC3339(resourceName, "inactive_date"),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
+					resource.TestCheckResourceAttr(resourceName, "usage", "SIGNING"),
+				),
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"private_key", "certificate", "certificate_chain"},
+			},
+		},
+	})
+}
+
+func TestAccTransferCertificate_disappears(t *testing.T) {
+	ctx := acctest.Context(t)
+	var conf transfer.DescribedCertificate
+	resourceName := "aws_transfer_certificate.test"
+	key := acctest.TLSRSAPrivateKeyPEM(t, 2048)
+	certificate := acctest.TLSRSAX509SelfSignedCertificatePEM(t, key, acctest.RandomSubdomain())
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, transfer.EndpointsID)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, transfer.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckCertificateDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccCertificateConfig_certificate(certificate),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckCertificateExists(ctx, resourceName, &conf),
+					acctest.CheckResourceDisappears(ctx, acctest.Provider, tftransfer.ResourceCertificate(), resourceName),
+				),
+				ExpectNonEmptyPlan: true,
+			},
+		},
+	})
+}
+
+func TestAccTransferCertificate_tags(t *testing.T) {
+	ctx := acctest.Context(t)
+	var conf transfer.DescribedCertificate
+	resourceName := "aws_transfer_certificate.test"
+	key := acctest.TLSRSAPrivateKeyPEM(t, 2048)
+	certificate := acctest.TLSRSAX509SelfSignedCertificatePEM(t, key, acctest.RandomSubdomain())
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, transfer.EndpointsID)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, transfer.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckCertificateDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccCertificateConfig_tags1(certificate, "key1", "value1"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckCertificateExists(ctx, resourceName, &conf),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
+				),
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"private_key", "certificate", "certificate_chain"},
+			},
+			{
+				Config: testAccCertificateConfig_tags2(certificate, "key1", "value1updated", "key2", "value2"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckCertificateExists(ctx, resourceName, &conf),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1updated"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
+				),
+			},
+			{
+				Config: testAccCertificateConfig_tags1(certificate, "key2", "value2"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckCertificateExists(ctx, resourceName, &conf),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccTransferCertificate_description(t *testing.T) {
+	ctx := acctest.Context(t)
+	var conf transfer.DescribedCertificate
+	resourceName := "aws_transfer_certificate.test"
+	key := acctest.TLSRSAPrivateKeyPEM(t, 2048)
+	certificate := acctest.TLSRSAX509SelfSignedCertificatePEM(t, key, acctest.RandomSubdomain())
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, transfer.EndpointsID)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, transfer.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckCertificateDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccCertificateConfig_description(certificate, "desc1"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckCertificateExists(ctx, resourceName, &conf),
+					resource.TestCheckResourceAttr(resourceName, "description", "desc1"),
+				),
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"private_key", "certificate", "certificate_chain"},
+			},
+			{
+				Config: testAccCertificateConfig_description(certificate, "desc2"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckCertificateExists(ctx, resourceName, &conf),
+					resource.TestCheckResourceAttr(resourceName, "description", "desc2"),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckCertificateExists(ctx context.Context, n string, v *transfer.DescribedCertificate) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		if rs.Primary.ID == "" {
+			return fmt.Errorf("No Transfer Certificate ID is set")
+		}
+
+		conn := acctest.Provider.Meta().(*conns.AWSClient).TransferConn(ctx)
+
+		output, err := tftransfer.FindCertificateByID(ctx, conn, rs.Primary.ID)
+
+		if err != nil {
+			return err
+		}
+
+		*v = *output
+
+		return nil
+	}
+}
+
+func testAccCheckCertificateDestroy(ctx context.Context) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		conn := acctest.Provider.Meta().(*conns.AWSClient).TransferConn(ctx)
+
+		for _, rs := range s.RootModule().Resources {
+			if rs.Type != "aws_transfer_certificate" {
+				continue
+			}
+
+			_, err := tftransfer.FindCertificateByID(ctx, conn, rs.Primary.ID)
+
+			if tfresource.NotFound(err) {
+				continue
+			}
+
+			if err != nil {
+				return err
+			}
+
+			return fmt.Errorf("Transfer Certificate %s still exists", rs.Primary.ID)
+		}
+
+		return nil
+	}
+}
+
+func testAccCertificateConfig_basic(certificate, privateKey, caCertificate string) string {
+	return fmt.Sprintf(`
+resource "aws_transfer_certificate" "test" {
+  certificate       = %[1]q
+  private_key       = %[2]q
+  certificate_chain = %[3]q
+  usage             = "SIGNING"
+}
+`, certificate, privateKey, caCertificate)
+}
+
+func testAccCertificateConfig_certificate(certificate string) string {
+	return fmt.Sprintf(`
+resource "aws_transfer_certificate" "test" {
+  certificate = %[1]q
+  usage       = "SIGNING"
+}
+`, certificate)
+}
+
+func testAccCertificateConfig_certificateChain(certificate, caCertificate string) string {
+	return fmt.Sprintf(`
+resource "aws_transfer_certificate" "test" {
+  certificate       = %[1]q
+  certificate_chain = %[2]q
+  usage             = "SIGNING"
+}
+`, certificate, caCertificate)
+}
+
+func testAccCertificateConfig_certificatePrivateKey(certificate, privateKey string) string {
+	return fmt.Sprintf(`
+resource "aws_transfer_certificate" "test" {
+  certificate = %[1]q
+  private_key = %[2]q
+  usage       = "SIGNING"
+}
+`, certificate, privateKey)
+}
+
+func testAccCertificateConfig_tags1(certificate, tagKey1, tagValue1 string) string {
+	return fmt.Sprintf(`
+resource "aws_transfer_certificate" "test" {
+  certificate = %[1]q
+  usage       = "SIGNING"
+
+  tags = {
+    %[2]q = %[3]q
+  }
+}
+`, certificate, tagKey1, tagValue1)
+}
+
+func testAccCertificateConfig_tags2(certificate, tagKey1, tagValue1, tagKey2, tagValue2 string) string {
+	return fmt.Sprintf(`
+resource "aws_transfer_certificate" "test" {
+  certificate = %[1]q
+  usage       = "SIGNING"
+
+  tags = {
+    %[2]q = %[3]q
+    %[4]q = %[5]q
+  }
+}
+`, certificate, tagKey1, tagValue1, tagKey2, tagValue2)
+}
+
+func testAccCertificateConfig_description(certificate, description string) string {
+	return fmt.Sprintf(`
+resource "aws_transfer_certificate" "test" {
+  certificate = %[1]q
+  usage       = "SIGNING"
+  description = %[2]q
+}
+`, certificate, description)
+}
diff --git a/internal/service/transfer/connector.go b/internal/service/transfer/connector.go
new file mode 100644
index 00000000000..602065e2aae
--- /dev/null
+++ b/internal/service/transfer/connector.go
@@ -0,0 +1,353 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package transfer
+
+import (
+	"context"
+	"log"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/transfer"
+	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
+	"github.com/hashicorp/terraform-provider-aws/internal/flex"
+	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/internal/verify"
+	"github.com/hashicorp/terraform-provider-aws/names"
+)
+
+// @SDKResource("aws_transfer_connector", name="Connector")
+// @Tags(identifierAttribute="arn")
+func ResourceConnector() *schema.Resource {
+	return &schema.Resource{
+		CreateWithoutTimeout: resourceConnectorCreate,
+		ReadWithoutTimeout:   resourceConnectorRead,
+		UpdateWithoutTimeout: resourceConnectorUpdate,
+		DeleteWithoutTimeout: resourceConnectorDelete,
+
+		Importer: &schema.ResourceImporter{
+			StateContext: schema.ImportStatePassthroughContext,
+		},
+
+		Schema: map[string]*schema.Schema{
+			"access_role": {
+				Type:     schema.TypeString,
+				Required: true,
+			},
+			"arn": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"as2_config": {
+				Type:     schema.TypeList,
+				Optional: true,
+				MaxItems: 1,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"compression": {
+							Type:         schema.TypeString,
+							Required:     true,
+							ValidateFunc: validation.StringInSlice(transfer.CompressionEnum_Values(), false),
+						},
+						"encryption_algorithm": {
+							Type:         schema.TypeString,
+							Required:     true,
+							ValidateFunc: validation.StringInSlice(transfer.EncryptionAlg_Values(), false),
+						},
+						"local_profile_id": {
+							Type:     schema.TypeString,
+							Required: true,
+						},
+						"mdn_response": {
+							Type:         schema.TypeString,
+							Required:     true,
+							ValidateFunc: validation.StringInSlice(transfer.MdnResponse_Values(), false),
+						},
+						"mdn_signing_algorithm": {
+							Type:         schema.TypeString,
+							Optional:     true,
+							ValidateFunc: validation.StringInSlice(transfer.MdnSigningAlg_Values(), false),
+						},
+						"message_subject": {
+							Type:     schema.TypeString,
+							Optional: true,
+						},
+						"partner_profile_id": {
+							Type:     schema.TypeString,
+							Required: true,
+						},
+						"signing_algorithm": {
+							Type:         schema.TypeString,
+							Required:     true,
+							ValidateFunc: validation.StringInSlice(transfer.SigningAlg_Values(), false),
+						},
+					},
+				},
+			},
+			"connector_id": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"logging_role": {
+				Type:     schema.TypeString,
+				Optional: true,
+			},
+			"sftp_config": {
+				Type:     schema.TypeList,
+				MaxItems: 1,
+				Optional: true,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"trusted_host_keys": {
+							Type:     schema.TypeSet,
+							Optional: true,
+							MinItems: 1,
+							MaxItems: 10,
+							Elem: &schema.Schema{
+								Type:         schema.TypeString,
+								ValidateFunc: validation.StringLenBetween(1, 2028),
+							},
+						},
+						"user_secret_id": {
+							Type:         schema.TypeString,
+							Optional:     true,
+							ValidateFunc: validation.StringLenBetween(1, 2028),
+						},
+					},
+				},
+			},
+			names.AttrTags:    tftags.TagsSchema(),
+			names.AttrTagsAll: tftags.TagsSchemaComputed(),
+			"url": {
+				Type:     schema.TypeString,
+				Required: true,
+			},
+		},
+
+		CustomizeDiff: verify.SetTagsDiff,
+	}
+}
+
+func resourceConnectorCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).TransferConn(ctx)
+
+	input := &transfer.CreateConnectorInput{
+		AccessRole: aws.String(d.Get("access_role").(string)),
+		Tags:       getTagsIn(ctx),
+		Url:        aws.String(d.Get("url").(string)),
+	}
+
+	if v, ok := d.GetOk("as2_config"); ok {
+		input.As2Config = expandAs2Config(v.([]interface{}))
+	}
+
+	if v, ok := d.GetOk("logging_role"); ok {
+		input.LoggingRole = aws.String(v.(string))
+	}
+
+	if v, ok := d.GetOk("sftp_config"); ok {
+		input.SftpConfig = expandSftpConfig(v.([]interface{}))
+	}
+
+	output, err := conn.CreateConnectorWithContext(ctx, input)
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "creating Transfer Connector: %s", err)
+	}
+
+	d.SetId(aws.StringValue(output.ConnectorId))
+
+	return append(diags, resourceConnectorRead(ctx, d, meta)...)
+}
+
+func resourceConnectorRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).TransferConn(ctx)
+
+	output, err := FindConnectorByID(ctx, conn, d.Id())
+
+	if !d.IsNewResource() && tfresource.NotFound(err) {
+		log.Printf("[WARN] Transfer Connector (%s) not found, removing from state", d.Id())
+		d.SetId("")
+		return diags
+	}
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "reading Transfer Connector (%s): %s", d.Id(), err)
+	}
+
+	d.Set("access_role", output.AccessRole)
+	d.Set("arn", output.Arn)
+	if err := d.Set("as2_config", flattenAs2Config(output.As2Config)); err != nil {
+		return sdkdiag.AppendErrorf(diags, "setting as2_config: %s", err)
+	}
+	d.Set("connector_id", output.ConnectorId)
+	d.Set("logging_role", output.LoggingRole)
+	if err := d.Set("sftp_config", flattenSftpConfig(output.SftpConfig)); err != nil {
+		return sdkdiag.AppendErrorf(diags, "setting sftp_config: %s", err)
+	}
+	d.Set("url", output.Url)
+	setTagsOut(ctx, output.Tags)
+
+	return diags
+}
+
+func resourceConnectorUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).TransferConn(ctx)
+
+	if d.HasChangesExcept("tags", "tags_all") {
+		input := &transfer.UpdateConnectorInput{
+			ConnectorId: aws.String(d.Id()),
+		}
+
+		if d.HasChange("access_role") {
+			input.AccessRole = aws.String(d.Get("access_role").(string))
+		}
+
+		if d.HasChange("as2_config") {
+			input.As2Config = expandAs2Config(d.Get("as2_config").([]interface{}))
+		}
+
+		if d.HasChange("logging_role") {
+			input.LoggingRole = aws.String(d.Get("logging_role").(string))
+		}
+
+		if d.HasChange("sftp_config") {
+			input.SftpConfig = expandSftpConfig(d.Get("sftp_config").([]interface{}))
+		}
+
+		if d.HasChange("url") {
+			input.Url = aws.String(d.Get("url").(string))
+		}
+
+		_, err := conn.UpdateConnectorWithContext(ctx, input)
+
+		if err != nil {
+			return sdkdiag.AppendErrorf(diags, "updating Transfer Connector (%s): %s", d.Id(), err)
+		}
+	}
+
+	return append(diags, resourceConnectorRead(ctx, d, meta)...)
+}
+
+func resourceConnectorDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).TransferConn(ctx)
+
+	log.Printf("[DEBUG] Deleting Transfer Connector: %s", d.Id())
+	_, err := conn.DeleteConnectorWithContext(ctx, &transfer.DeleteConnectorInput{
+		ConnectorId: aws.String(d.Id()),
+	})
+
+	if tfawserr.ErrCodeEquals(err, transfer.ErrCodeResourceNotFoundException) {
+		return diags
+	}
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "deleting Transfer Connector (%s): %s", d.Id(), err)
+	}
+
+	return diags
+}
+
+func expandAs2Config(pUser []interface{}) *transfer.As2ConnectorConfig {
+	if len(pUser) < 1 || pUser[0] == nil {
+		return nil
+	}
+
+	m := pUser[0].(map[string]interface{})
+
+	as2Config := &transfer.As2ConnectorConfig{
+		Compression:         aws.String(m["compression"].(string)),
+		EncryptionAlgorithm: aws.String(m["encryption_algorithm"].(string)),
+		LocalProfileId:      aws.String(m["local_profile_id"].(string)),
+		MdnResponse:         aws.String(m["mdn_response"].(string)),
+		MdnSigningAlgorithm: aws.String(m["mdn_signing_algorithm"].(string)),
+		MessageSubject:      aws.String(m["message_subject"].(string)),
+		PartnerProfileId:    aws.String(m["partner_profile_id"].(string)),
+		SigningAlgorithm:    aws.String(m["signing_algorithm"].(string)),
+	}
+
+	return as2Config
+}
+
+func expandSftpConfig(pUser []interface{}) *transfer.SftpConnectorConfig {
+	if len(pUser) < 1 || pUser[0] == nil {
+		return nil
+	}
+
+	m := pUser[0].(map[string]interface{})
+
+	sftpConfig := &transfer.SftpConnectorConfig{
+		UserSecretId: aws.String(m["user_secret_id"].(string)),
+	}
+
+	if v, ok := m["trusted_host_keys"].(*schema.Set); ok && len(v.List()) > 0 {
+		sftpConfig.TrustedHostKeys = flex.ExpandStringSet(v)
+	}
+
+	return sftpConfig
+}
+
+func flattenAs2Config(apiObject *transfer.As2ConnectorConfig) []interface{} {
+	if apiObject == nil {
+		return nil
+	}
+
+	tfMap := map[string]interface{}{}
+
+	if v := apiObject.Compression; v != nil {
+		tfMap["compression"] = aws.StringValue(v)
+	}
+
+	if v := apiObject.EncryptionAlgorithm; v != nil {
+		tfMap["encryption_algorithm"] = aws.StringValue(v)
+	}
+
+	if v := apiObject.LocalProfileId; v != nil {
+		tfMap["local_profile_id"] = aws.StringValue(v)
+	}
+
+	if v := apiObject.MdnResponse; v != nil {
+		tfMap["mdn_response"] = aws.StringValue(v)
+	}
+
+	if v := apiObject.MdnSigningAlgorithm; v != nil {
+		tfMap["mdn_signing_algorithm"] = aws.StringValue(v)
+	}
+
+	if v := apiObject.MessageSubject; v != nil {
+		tfMap["message_subject"] = aws.StringValue(v)
+	}
+
+	if v := apiObject.PartnerProfileId; v != nil {
+		tfMap["partner_profile_id"] = aws.StringValue(v)
+	}
+
+	if v := apiObject.SigningAlgorithm; v != nil {
+		tfMap["signing_algorithm"] = aws.StringValue(v)
+	}
+
+	return []interface{}{tfMap}
+}
+
+func flattenSftpConfig(posixUser *transfer.SftpConnectorConfig) []interface{} {
+	if posixUser == nil {
+		return []interface{}{}
+	}
+
+	m := map[string]interface{}{
+		"trusted_host_keys": aws.StringValueSlice(posixUser.TrustedHostKeys),
+		"user_secret_id":    aws.StringValue(posixUser.UserSecretId),
+	}
+
+	return []interface{}{m}
+}
diff --git a/internal/service/transfer/connector_test.go b/internal/service/transfer/connector_test.go
new file mode 100644
index 00000000000..a795baa3b69
--- /dev/null
+++ b/internal/service/transfer/connector_test.go
@@ -0,0 +1,367 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package transfer_test
+
+import (
+	"context"
+	"fmt"
+	"testing"
+
+	"github.com/aws/aws-sdk-go/service/transfer"
+	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
+	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	tftransfer "github.com/hashicorp/terraform-provider-aws/internal/service/transfer"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+)
+
+func TestAccTransferConnector_basic(t *testing.T) {
+	ctx := acctest.Context(t)
+	var conf transfer.DescribedConnector
+	resourceName := "aws_transfer_connector.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+
+	resource.Test(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, transfer.EndpointsID)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, transfer.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckConnectorDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccConnectorConfig_basic(rName, "http://www.example.com"),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckConnectorExists(ctx, resourceName, &conf),
+					resource.TestCheckResourceAttrSet(resourceName, "arn"),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
+					resource.TestCheckResourceAttr(resourceName, "url", "http://www.example.com"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				Config: testAccConnectorConfig_basic(rName, "http://www.example.net"),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckConnectorExists(ctx, resourceName, &conf),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
+					resource.TestCheckResourceAttr(resourceName, "url", "http://www.example.net"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccTransferConnector_sftpConfig(t *testing.T) {
+	ctx := acctest.Context(t)
+	var conf transfer.DescribedConnector
+	resourceName := "aws_transfer_connector.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	publicKey := "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDNt3kA/dBkS6ZyU/sVDiGMuWJQaRPmLNbs/25K/e/fIl07ZWUgqqsFkcycLLMNFGD30Cmgp6XCXfNlIjzFWhNam+4cBb4DPpvieUw44VgsHK5JQy3JKlUfglmH5rs4G5pLiVfZpFU6jqvTsu4mE1CHCP0sXJlJhGxMG3QbsqYWNKiqGFEhuzGMs6fQlMkNiXsFoDmh33HAcXCbaFSC7V7xIqT1hlKu0iOL+GNjMj4R3xy0o3jafhO4MG2s3TwCQQCyaa5oyjL8iP8p3L9yp6cbIcXaS72SIgbCSGCyrcQPIKP2lJJHvE1oVWzLVBhR4eSzrlFDv7K4IErzaJmHqdiz" // nosemgrep:ci.ssh-key
+
+	resource.Test(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, transfer.EndpointsID)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, transfer.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckConnectorDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccConnectorConfig_sftpConfig(rName, "sftp://s-fakeserver.server.transfer.test.amazonaws.com", publicKey),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckConnectorExists(ctx, resourceName, &conf),
+					resource.TestCheckResourceAttrSet(resourceName, "arn"),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
+					resource.TestCheckResourceAttr(resourceName, "url", "sftp://s-fakeserver.server.transfer.test.amazonaws.com"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
+func TestAccTransferConnector_disappears(t *testing.T) {
+	ctx := acctest.Context(t)
+	var conf transfer.DescribedConnector
+	resourceName := "aws_transfer_connector.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+
+	resource.Test(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, transfer.EndpointsID)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, transfer.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckConnectorDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccConnectorConfig_basic(rName, "http://www.example.com"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckConnectorExists(ctx, resourceName, &conf),
+					acctest.CheckResourceDisappears(ctx, acctest.Provider, tftransfer.ResourceConnector(), resourceName),
+				),
+				ExpectNonEmptyPlan: true,
+			},
+		},
+	})
+}
+
+func TestAccTransferConnector_tags(t *testing.T) {
+	ctx := acctest.Context(t)
+	var conf transfer.DescribedConnector
+	resourceName := "aws_transfer_connector.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+
+	resource.Test(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, transfer.EndpointsID)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, transfer.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckConnectorDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccConnectorConfig_tags1(rName, "http://www.example.com", "key1", "value1"),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckConnectorExists(ctx, resourceName, &conf),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				Config: testAccConnectorConfig_tags2(rName, "http://www.example.com", "key1", "value1updated", "key2", "value2"),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckConnectorExists(ctx, resourceName, &conf),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1updated"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
+				),
+			},
+			{
+				Config: testAccConnectorConfig_tags1(rName, "http://www.example.com", "key2", "value2"),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckConnectorExists(ctx, resourceName, &conf),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckConnectorExists(ctx context.Context, n string, v *transfer.DescribedConnector) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		if rs.Primary.ID == "" {
+			return fmt.Errorf("No Transfer Connector ID is set")
+		}
+
+		conn := acctest.Provider.Meta().(*conns.AWSClient).TransferConn(ctx)
+
+		output, err := tftransfer.FindConnectorByID(ctx, conn, rs.Primary.ID)
+
+		if err != nil {
+			return err
+		}
+
+		*v = *output
+
+		return nil
+	}
+}
+
+func testAccCheckConnectorDestroy(ctx context.Context) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		conn := acctest.Provider.Meta().(*conns.AWSClient).TransferConn(ctx)
+
+		for _, rs := range s.RootModule().Resources {
+			if rs.Type != "aws_transfer_connector" {
+				continue
+			}
+
+			_, err := tftransfer.FindConnectorByID(ctx, conn, rs.Primary.ID)
+
+			if tfresource.NotFound(err) {
+				continue
+			}
+
+			if err != nil {
+				return err
+			}
+
+			return fmt.Errorf("Transfer Connector %s still exists", rs.Primary.ID)
+		}
+
+		return nil
+	}
+}
+
+func testAccConnectorConfig_base(rName string) string {
+	return fmt.Sprintf(`
+resource "aws_iam_role" "test" {
+  name               = %[1]q
+  assume_role_policy = <<EOF
+  {
+	"Version": "2012-10-17",
+	"Statement": [{
+	  "Effect": "Allow",
+	  "Principal": {
+		"Service": "transfer.amazonaws.com"
+	  },
+	  "Action": "sts:AssumeRole"
+	}]
+  }
+EOF
+}
+
+resource "aws_iam_role_policy" "test" {
+  name = %[1]q
+  role = aws_iam_role.test.id
+
+  policy = <<POLICY
+{
+	 "Version":"2012-10-17",
+	 "Statement":[
+		{
+		   "Sid":"AllowFullAccesstoS3",
+		   "Effect":"Allow",
+		   "Action":[
+			  "s3:*"
+		   ],
+		   "Resource":"*"
+		}
+	 ]
+}
+POLICY
+}
+
+resource "aws_transfer_profile" "local" {
+  as2_id       = %[1]q
+  profile_type = "LOCAL"
+}
+
+resource "aws_transfer_profile" "partner" {
+  as2_id       = %[1]q
+  profile_type = "PARTNER"
+}
+`, rName)
+}
+
+func testAccConnectorConfig_basic(rName, url string) string {
+	return acctest.ConfigCompose(testAccConnectorConfig_base(rName), fmt.Sprintf(`
+resource "aws_transfer_connector" "test" {
+  access_role = aws_iam_role.test.arn
+
+  as2_config {
+    compression           = "DISABLED"
+    encryption_algorithm  = "AES128_CBC"
+    message_subject       = %[1]q
+    local_profile_id      = aws_transfer_profile.local.profile_id
+    mdn_response          = "NONE"
+    mdn_signing_algorithm = "NONE"
+    partner_profile_id    = aws_transfer_profile.partner.profile_id
+    signing_algorithm     = "NONE"
+  }
+
+  url = %[2]q
+}
+`, rName, url))
+}
+
+func testAccConnectorConfig_sftpConfig(rName, url, publickey string) string {
+	return acctest.ConfigCompose(testAccConnectorConfig_base(rName), fmt.Sprintf(`
+resource "aws_transfer_connector" "test" {
+  access_role = aws_iam_role.test.arn
+
+  sftp_config {
+    trusted_host_keys = [%[3]q]
+    user_secret_id    = aws_secretsmanager_secret.test.id
+  }
+
+  url = %[2]q
+}
+
+resource "aws_secretsmanager_secret" "test" {
+  name = %[1]q
+}
+`, rName, url, publickey))
+}
+
+func testAccConnectorConfig_tags1(rName, url, tagKey1, tagValue1 string) string {
+	return acctest.ConfigCompose(testAccConnectorConfig_base(rName), fmt.Sprintf(`
+resource "aws_transfer_connector" "test" {
+  access_role = aws_iam_role.test.arn
+
+  as2_config {
+    compression           = "DISABLED"
+    encryption_algorithm  = "AES128_CBC"
+    message_subject       = %[1]q
+    local_profile_id      = aws_transfer_profile.local.profile_id
+    mdn_response          = "NONE"
+    mdn_signing_algorithm = "NONE"
+    partner_profile_id    = aws_transfer_profile.partner.profile_id
+    signing_algorithm     = "NONE"
+  }
+
+  url = %[2]q
+
+  tags = {
+    %[3]q = %[4]q
+  }
+}
+`, rName, url, tagKey1, tagValue1))
+}
+
+func testAccConnectorConfig_tags2(rName, url, tagKey1, tagValue1, tagKey2, tagValue2 string) string {
+	return acctest.ConfigCompose(testAccConnectorConfig_base(rName), fmt.Sprintf(`
+resource "aws_transfer_connector" "test" {
+  access_role = aws_iam_role.test.arn
+
+  as2_config {
+    compression           = "DISABLED"
+    encryption_algorithm  = "AES128_CBC"
+    message_subject       = %[1]q
+    local_profile_id      = aws_transfer_profile.local.profile_id
+    mdn_response          = "NONE"
+    mdn_signing_algorithm = "NONE"
+    partner_profile_id    = aws_transfer_profile.partner.profile_id
+    signing_algorithm     = "NONE"
+  }
+
+  url = %[2]q
+
+  tags = {
+    %[3]q = %[4]q
+    %[5]q = %[6]q
+  }
+}
+`, rName, url, tagKey1, tagValue1, tagKey2, tagValue2))
+}
diff --git a/internal/service/transfer/enum.go b/internal/service/transfer/enum.go
index 6caabbdf2e6..ef8645b1df6 100644
--- a/internal/service/transfer/enum.go
+++ b/internal/service/transfer/enum.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package transfer
 
 const (
diff --git a/internal/service/transfer/find.go b/internal/service/transfer/find.go
index 78edea36ca6..cbf51a9a6ec 100644
--- a/internal/service/transfer/find.go
+++ b/internal/service/transfer/find.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package transfer
 
 import (
@@ -10,7 +13,7 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
-func FindAccessByServerIDAndExternalID(ctx context.Context, conn *transfer.Transfer, serverID, externalID string) (*transfer.DescribedAccess, error) {
+func FindAccessByTwoPartKey(ctx context.Context, conn *transfer.Transfer, serverID, externalID string) (*transfer.DescribedAccess, error) {
 	input := &transfer.DescribeAccessInput{
 		ExternalId: aws.String(externalID),
 		ServerId:   aws.String(serverID),
@@ -36,6 +39,107 @@ func FindAccessByServerIDAndExternalID(ctx context.Context, conn *transfer.Trans
 	return output.Access, nil
 }
 
+func FindAgreementByTwoPartKey(ctx context.Context, conn *transfer.Transfer, serverID, agreementID string) (*transfer.DescribedAgreement, error) {
+	input := &transfer.DescribeAgreementInput{
+		AgreementId: aws.String(agreementID),
+		ServerId:    aws.String(serverID),
+	}
+
+	output, err := conn.DescribeAgreementWithContext(ctx, input)
+
+	if tfawserr.ErrCodeEquals(err, transfer.ErrCodeResourceNotFoundException) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	if output == nil || output.Agreement == nil {
+		return nil, tfresource.NewEmptyResultError(input)
+	}
+
+	return output.Agreement, nil
+}
+
+func FindCertificateByID(ctx context.Context, conn *transfer.Transfer, id string) (*transfer.DescribedCertificate, error) {
+	input := &transfer.DescribeCertificateInput{
+		CertificateId: aws.String(id),
+	}
+
+	output, err := conn.DescribeCertificateWithContext(ctx, input)
+
+	if tfawserr.ErrCodeEquals(err, transfer.ErrCodeResourceNotFoundException) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	if output == nil || output.Certificate == nil {
+		return nil, tfresource.NewEmptyResultError(input)
+	}
+
+	return output.Certificate, nil
+}
+
+func FindConnectorByID(ctx context.Context, conn *transfer.Transfer, id string) (*transfer.DescribedConnector, error) {
+	input := &transfer.DescribeConnectorInput{
+		ConnectorId: aws.String(id),
+	}
+
+	output, err := conn.DescribeConnectorWithContext(ctx, input)
+
+	if tfawserr.ErrCodeEquals(err, transfer.ErrCodeResourceNotFoundException) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	if output == nil || output.Connector == nil {
+		return nil, tfresource.NewEmptyResultError(input)
+	}
+
+	return output.Connector, nil
+}
+
+func FindProfileByID(ctx context.Context, conn *transfer.Transfer, id string) (*transfer.DescribedProfile, error) {
+	input := &transfer.DescribeProfileInput{
+		ProfileId: aws.String(id),
+	}
+
+	output, err := conn.DescribeProfileWithContext(ctx, input)
+
+	if tfawserr.ErrCodeEquals(err, transfer.ErrCodeResourceNotFoundException) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: input,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	if output == nil || output.Profile == nil {
+		return nil, tfresource.NewEmptyResultError(input)
+	}
+
+	return output.Profile, nil
+}
+
 func FindServerByID(ctx context.Context, conn *transfer.Transfer, id string) (*transfer.DescribedServer, error) {
 	input := &transfer.DescribeServerInput{
 		ServerId: aws.String(id),
diff --git a/internal/service/transfer/generate.go b/internal/service/transfer/generate.go
index a9a054cb33c..91cda162715 100644
--- a/internal/service/transfer/generate.go
+++ b/internal/service/transfer/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tagresource/main.go -UpdateTagsFunc=updateTagsNoIgnoreSystem
 //go:generate go run ../../generate/tags/main.go -GetTag -ListTags -ListTagsInIDElem=Arn -ServiceTagsSlice -TagInIDElem=Arn -UpdateTags
 //go:generate go run ../../generate/tags/main.go -TagInIDElem=Arn -UpdateTags -UpdateTagsFunc=updateTagsNoIgnoreSystem -UpdateTagsNoIgnoreSystem -SkipNamesImp -- update_tags_no_system_ignore_gen.go
diff --git a/internal/service/transfer/id.go b/internal/service/transfer/id.go
index 53d2e5b498b..a95e9e8d5e4 100644
--- a/internal/service/transfer/id.go
+++ b/internal/service/transfer/id.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package transfer
 
 import (
@@ -42,3 +45,22 @@ func AccessParseResourceID(id string) (string, string, error) {
 
 	return "", "", fmt.Errorf("unexpected format for ID (%[1]s), expected SERVERID%[2]sEXTERNALID", id, accessResourceIDSeparator)
 }
+
+const agreementResourceIDSeparator = "/"
+
+func AgreementCreateResourceID(serverID, agreementID string) string {
+	parts := []string{serverID, agreementID}
+	id := strings.Join(parts, agreementResourceIDSeparator)
+
+	return id
+}
+
+func AgreementParseResourceID(id string) (string, string, error) {
+	parts := strings.Split(id, agreementResourceIDSeparator)
+
+	if len(parts) == 2 && parts[0] != "" && parts[1] != "" {
+		return parts[0], parts[1], nil
+	}
+
+	return "", "", fmt.Errorf("unexpected format for ID (%[1]s), expected SERVERID%[2]sAGREEMENTID", id, agreementResourceIDSeparator)
+}
diff --git a/internal/service/transfer/profile.go b/internal/service/transfer/profile.go
new file mode 100644
index 00000000000..e01569c1993
--- /dev/null
+++ b/internal/service/transfer/profile.go
@@ -0,0 +1,163 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package transfer
+
+import (
+	"context"
+	"log"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/transfer"
+	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
+	"github.com/hashicorp/terraform-provider-aws/internal/flex"
+	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/internal/verify"
+	"github.com/hashicorp/terraform-provider-aws/names"
+)
+
+// @SDKResource("aws_transfer_profile", name="Profile")
+// @Tags(identifierAttribute="arn")
+func ResourceProfile() *schema.Resource {
+	return &schema.Resource{
+		CreateWithoutTimeout: resourceProfileCreate,
+		ReadWithoutTimeout:   resourceProfileRead,
+		UpdateWithoutTimeout: resourceProfileUpdate,
+		DeleteWithoutTimeout: resourceProfileDelete,
+
+		Importer: &schema.ResourceImporter{
+			StateContext: schema.ImportStatePassthroughContext,
+		},
+
+		Schema: map[string]*schema.Schema{
+			"arn": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"as2_id": {
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+			"certificate_ids": {
+				Type:     schema.TypeSet,
+				Optional: true,
+				Elem:     &schema.Schema{Type: schema.TypeString},
+			},
+			"profile_id": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"profile_type": {
+				Type:         schema.TypeString,
+				Required:     true,
+				ForceNew:     true,
+				ValidateFunc: validation.StringInSlice(transfer.ProfileType_Values(), false),
+			},
+			names.AttrTags:    tftags.TagsSchema(),
+			names.AttrTagsAll: tftags.TagsSchemaComputed(),
+		},
+
+		CustomizeDiff: verify.SetTagsDiff,
+	}
+}
+
+func resourceProfileCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).TransferConn(ctx)
+
+	input := &transfer.CreateProfileInput{
+		As2Id:       aws.String(d.Get("as2_id").(string)),
+		ProfileType: aws.String(d.Get("profile_type").(string)),
+		Tags:        getTagsIn(ctx),
+	}
+
+	if v, ok := d.GetOk("certificate_ids"); ok && v.(*schema.Set).Len() > 0 {
+		input.CertificateIds = flex.ExpandStringSet(v.(*schema.Set))
+	}
+
+	output, err := conn.CreateProfileWithContext(ctx, input)
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "creating Transfer Profile: %s", err)
+	}
+
+	d.SetId(aws.StringValue(output.ProfileId))
+
+	return append(diags, resourceProfileRead(ctx, d, meta)...)
+}
+
+func resourceProfileRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).TransferConn(ctx)
+
+	output, err := FindProfileByID(ctx, conn, d.Id())
+
+	if !d.IsNewResource() && tfresource.NotFound(err) {
+		log.Printf("[WARN] Transfer Profile (%s) not found, removing from state", d.Id())
+		d.SetId("")
+		return diags
+	}
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "reading Transfer Profile (%s): %s", d.Id(), err)
+	}
+
+	d.Set("arn", output.Arn)
+	d.Set("as2_id", output.As2Id)
+	d.Set("certificate_ids", aws.StringValueSlice(output.CertificateIds))
+	d.Set("profile_id", output.ProfileId)
+	d.Set("profile_type", output.ProfileType)
+	setTagsOut(ctx, output.Tags)
+
+	return diags
+}
+
+func resourceProfileUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).TransferConn(ctx)
+
+	if d.HasChangesExcept("tags", "tags_all") {
+		input := &transfer.UpdateProfileInput{
+			ProfileId: aws.String(d.Id()),
+		}
+
+		if d.HasChange("certificate_ids") {
+			input.CertificateIds = flex.ExpandStringSet(d.Get("certificate_ids").(*schema.Set))
+		}
+
+		_, err := conn.UpdateProfileWithContext(ctx, input)
+
+		if err != nil {
+			return sdkdiag.AppendErrorf(diags, "updating Transfer Profile (%s): %s", d.Id(), err)
+		}
+	}
+
+	return append(diags, resourceProfileRead(ctx, d, meta)...)
+}
+
+func resourceProfileDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	conn := meta.(*conns.AWSClient).TransferConn(ctx)
+
+	log.Printf("[DEBUG] Deleting Transfer Profile: %s", d.Id())
+	_, err := conn.DeleteProfileWithContext(ctx, &transfer.DeleteProfileInput{
+		ProfileId: aws.String(d.Id()),
+	})
+
+	if tfawserr.ErrCodeEquals(err, transfer.ErrCodeResourceNotFoundException) {
+		return diags
+	}
+
+	if err != nil {
+		return sdkdiag.AppendErrorf(diags, "deleting Transfer Profile (%s): %s", d.Id(), err)
+	}
+
+	return diags
+}
diff --git a/internal/service/transfer/profile_test.go b/internal/service/transfer/profile_test.go
new file mode 100644
index 00000000000..2c050273c4d
--- /dev/null
+++ b/internal/service/transfer/profile_test.go
@@ -0,0 +1,271 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package transfer_test
+
+import (
+	"context"
+	"fmt"
+	"testing"
+
+	"github.com/aws/aws-sdk-go/service/transfer"
+	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
+	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	tftransfer "github.com/hashicorp/terraform-provider-aws/internal/service/transfer"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+)
+
+func TestAccTransferProfile_basic(t *testing.T) {
+	ctx := acctest.Context(t)
+	var conf transfer.DescribedProfile
+	resourceName := "aws_transfer_profile.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, transfer.EndpointsID)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, transfer.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckProfileDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccProfileConfig_basic(rName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckProfileExists(ctx, resourceName, &conf),
+					resource.TestCheckResourceAttrSet(resourceName, "arn"),
+					resource.TestCheckResourceAttr(resourceName, "as2_id", rName),
+					resource.TestCheckResourceAttr(resourceName, "certificate_ids.#", "0"),
+					resource.TestCheckResourceAttrSet(resourceName, "profile_id"),
+					resource.TestCheckResourceAttr(resourceName, "profile_type", "LOCAL"),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
+func TestAccTransferProfile_certificateIDs(t *testing.T) {
+	ctx := acctest.Context(t)
+	var conf transfer.DescribedProfile
+	resourceName := "aws_transfer_profile.test"
+	key := acctest.TLSRSAPrivateKeyPEM(t, 2048)
+	certificate := acctest.TLSRSAX509SelfSignedCertificatePEM(t, key, acctest.RandomSubdomain())
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, transfer.EndpointsID)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, transfer.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckProfileDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccProfileConfig_certificateIDs(rName, certificate, key),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckProfileExists(ctx, resourceName, &conf),
+					resource.TestCheckResourceAttr(resourceName, "certificate_ids.#", "1"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
+func TestAccTransferProfile_disappears(t *testing.T) {
+	ctx := acctest.Context(t)
+	var conf transfer.DescribedProfile
+	resourceName := "aws_transfer_profile.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, transfer.EndpointsID)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, transfer.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckProfileDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccProfileConfig_basic(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckProfileExists(ctx, resourceName, &conf),
+					acctest.CheckResourceDisappears(ctx, acctest.Provider, tftransfer.ResourceProfile(), resourceName),
+				),
+				ExpectNonEmptyPlan: true,
+			},
+		},
+	})
+}
+
+func TestAccTransferProfile_tags(t *testing.T) {
+	ctx := acctest.Context(t)
+	var conf transfer.DescribedProfile
+	resourceName := "aws_transfer_profile.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, transfer.EndpointsID)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, transfer.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckProfileDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccProfileConfig_tags1(rName, "key1", "value1"),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckProfileExists(ctx, resourceName, &conf),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				Config: testAccProfileConfig_tags2(rName, "key1", "value1updated", "key2", "value2"),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckProfileExists(ctx, resourceName, &conf),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1updated"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
+				),
+			},
+			{
+				Config: testAccProfileConfig_tags1(rName, "key2", "value2"),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckProfileExists(ctx, resourceName, &conf),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckProfileExists(ctx context.Context, n string, v *transfer.DescribedProfile) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		if rs.Primary.ID == "" {
+			return fmt.Errorf("No Transfer Profile ID is set")
+		}
+
+		conn := acctest.Provider.Meta().(*conns.AWSClient).TransferConn(ctx)
+
+		output, err := tftransfer.FindProfileByID(ctx, conn, rs.Primary.ID)
+
+		if err != nil {
+			return err
+		}
+
+		*v = *output
+
+		return nil
+	}
+}
+
+func testAccCheckProfileDestroy(ctx context.Context) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		conn := acctest.Provider.Meta().(*conns.AWSClient).TransferConn(ctx)
+
+		for _, rs := range s.RootModule().Resources {
+			if rs.Type != "aws_transfer_profile" {
+				continue
+			}
+
+			_, err := tftransfer.FindProfileByID(ctx, conn, rs.Primary.ID)
+
+			if tfresource.NotFound(err) {
+				continue
+			}
+
+			if err != nil {
+				return err
+			}
+
+			return fmt.Errorf("Transfer Profile %s still exists", rs.Primary.ID)
+		}
+
+		return nil
+	}
+}
+
+func testAccProfileConfig_basic(rName string) string {
+	return fmt.Sprintf(`
+resource "aws_transfer_profile" "test" {
+  as2_id       = %[1]q
+  profile_type = "LOCAL"
+}
+`, rName)
+}
+
+func testAccProfileConfig_certificateIDs(rName, certificate, privateKey string) string {
+	return fmt.Sprintf(`
+resource "aws_transfer_certificate" "test" {
+  certificate = %[2]q
+  private_key = %[3]q
+  usage       = "SIGNING"
+}
+
+resource "aws_transfer_profile" "test" {
+  as2_id          = %[1]q
+  certificate_ids = [aws_transfer_certificate.test.certificate_id]
+  profile_type    = "LOCAL"
+}
+`, rName, certificate, privateKey)
+}
+
+func testAccProfileConfig_tags1(rName, tagKey1, tagValue1 string) string {
+	return fmt.Sprintf(`
+resource "aws_transfer_profile" "test" {
+  as2_id       = %[1]q
+  profile_type = "LOCAL"
+
+  tags = {
+    %[2]q = %[3]q
+  }
+}
+`, rName, tagKey1, tagValue1)
+}
+
+func testAccProfileConfig_tags2(rName, tagKey1, tagValue1, tagKey2, tagValue2 string) string {
+	return fmt.Sprintf(`
+resource "aws_transfer_profile" "test" {
+  as2_id       = %[1]q
+  profile_type = "LOCAL"
+
+  tags = {
+    %[2]q = %[3]q
+    %[4]q = %[5]q
+  }
+}
+`, rName, tagKey1, tagValue1, tagKey2, tagValue2)
+}
diff --git a/internal/service/transfer/server.go b/internal/service/transfer/server.go
index 1f62ac177ff..8151e636b2e 100644
--- a/internal/service/transfer/server.go
+++ b/internal/service/transfer/server.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package transfer
 
 import ( // nosemgrep:ci.semgrep.aws.multiple-service-imports
@@ -162,13 +165,13 @@ func ResourceServer() *schema.Resource {
 				Type:         schema.TypeString,
 				Optional:     true,
 				Sensitive:    true,
-				ValidateFunc: validation.StringLenBetween(0, 512),
+				ValidateFunc: validation.StringLenBetween(0, 4096),
 			},
 			"pre_authentication_login_banner": {
 				Type:         schema.TypeString,
 				Optional:     true,
 				Sensitive:    true,
-				ValidateFunc: validation.StringLenBetween(0, 512),
+				ValidateFunc: validation.StringLenBetween(0, 4096),
 			},
 			"protocol_details": {
 				Type:     schema.TypeList,
@@ -224,6 +227,15 @@ func ResourceServer() *schema.Resource {
 				Default:      SecurityPolicyName2018_11,
 				ValidateFunc: validation.StringInSlice(SecurityPolicyName_Values(), false),
 			},
+			"structured_log_destinations": {
+				Type: schema.TypeSet,
+				Elem: &schema.Schema{
+					Type:         schema.TypeString,
+					ValidateFunc: verify.ValidARN,
+				},
+				Description: "This is a set of arns of destinations that will receive structured logs from the transfer server",
+				Optional:    true,
+			},
 			names.AttrTags:    tftags.TagsSchema(),
 			names.AttrTagsAll: tftags.TagsSchemaComputed(),
 			"url": {
@@ -368,6 +380,10 @@ func resourceServerCreate(ctx context.Context, d *schema.ResourceData, meta inte
 		input.SecurityPolicyName = aws.String(v.(string))
 	}
 
+	if v, ok := d.GetOk("structured_log_destinations"); ok && v.(*schema.Set).Len() > 0 {
+		input.StructuredLogDestinations = flex.ExpandStringSet(v.(*schema.Set))
+	}
+
 	if v, ok := d.GetOk("url"); ok {
 		if input.IdentityProviderDetails == nil {
 			input.IdentityProviderDetails = &transfer.IdentityProviderDetails{}
@@ -486,6 +502,7 @@ func resourceServerRead(ctx context.Context, d *schema.ResourceData, meta interf
 	}
 	d.Set("protocols", aws.StringValueSlice(output.Protocols))
 	d.Set("security_policy_name", output.SecurityPolicyName)
+	d.Set("structured_log_destinations", aws.StringValueSlice(output.StructuredLogDestinations))
 	if output.IdentityProviderDetails != nil {
 		d.Set("url", output.IdentityProviderDetails.Url)
 	} else {
@@ -663,6 +680,11 @@ func resourceServerUpdate(ctx context.Context, d *schema.ResourceData, meta inte
 			input.SecurityPolicyName = aws.String(d.Get("security_policy_name").(string))
 		}
 
+		// Per the docs it does not matter if this field has changed,
+		// if the update passes this as empty the structured logging will be turned off,
+		// so we need to always pass the new.
+		input.StructuredLogDestinations = flex.ExpandStringSet(d.Get("structured_log_destinations").(*schema.Set))
+
 		if d.HasChange("workflow_details") {
 			input.WorkflowDetails = expandWorkflowDetails(d.Get("workflow_details").([]interface{}))
 		}
diff --git a/internal/service/transfer/server_data_source.go b/internal/service/transfer/server_data_source.go
index 7d2a376684c..e1d76cf649e 100644
--- a/internal/service/transfer/server_data_source.go
+++ b/internal/service/transfer/server_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package transfer
 
 import (
@@ -19,7 +22,6 @@ func DataSourceServer() *schema.Resource {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
-
 			"certificate": {
 				Type:     schema.TypeString,
 				Computed: true,
@@ -28,32 +30,26 @@ func DataSourceServer() *schema.Resource {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
-
 			"endpoint": {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
-
 			"endpoint_type": {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
-
 			"identity_provider_type": {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
-
 			"invocation_role": {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
-
 			"logging_role": {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
-
 			"protocols": {
 				Type:     schema.TypeList,
 				Computed: true,
@@ -61,17 +57,21 @@ func DataSourceServer() *schema.Resource {
 					Type: schema.TypeString,
 				},
 			},
-
 			"security_policy_name": {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
-
 			"server_id": {
 				Type:     schema.TypeString,
 				Required: true,
 			},
-
+			"structured_log_destinations": {
+				Type:     schema.TypeList,
+				Computed: true,
+				Elem: &schema.Schema{
+					Type: schema.TypeString,
+				},
+			},
 			"url": {
 				Type:     schema.TypeString,
 				Computed: true,
@@ -109,6 +109,7 @@ func dataSourceServerRead(ctx context.Context, d *schema.ResourceData, meta inte
 	d.Set("logging_role", output.LoggingRole)
 	d.Set("protocols", aws.StringValueSlice(output.Protocols))
 	d.Set("security_policy_name", output.SecurityPolicyName)
+	d.Set("structured_log_destinations", aws.StringValueSlice(output.StructuredLogDestinations))
 	if output.IdentityProviderDetails != nil {
 		d.Set("url", output.IdentityProviderDetails.Url)
 	} else {
diff --git a/internal/service/transfer/server_data_source_test.go b/internal/service/transfer/server_data_source_test.go
index ce4f094f8d0..cf17032c184 100644
--- a/internal/service/transfer/server_data_source_test.go
+++ b/internal/service/transfer/server_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package transfer_test
 
 import (
@@ -28,6 +31,7 @@ func testAccServerDataSource_basic(t *testing.T) {
 					resource.TestCheckResourceAttrPair(datasourceName, "endpoint", resourceName, "endpoint"),
 					resource.TestCheckResourceAttrPair(datasourceName, "identity_provider_type", resourceName, "identity_provider_type"),
 					resource.TestCheckResourceAttrPair(datasourceName, "logging_role", resourceName, "logging_role"),
+					resource.TestCheckResourceAttrPair(datasourceName, "structured_log_destinations.#", resourceName, "structured_log_destinations.#"),
 				),
 			},
 		},
diff --git a/internal/service/transfer/server_test.go b/internal/service/transfer/server_test.go
index f49a21eef29..158baf35beb 100644
--- a/internal/service/transfer/server_test.go
+++ b/internal/service/transfer/server_test.go
@@ -1,11 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package transfer_test
 
 import (
 	"context"
+	"errors"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws/endpoints"
 	"github.com/aws/aws-sdk-go/service/acmpca"
 	"github.com/aws/aws-sdk-go/service/transfer"
@@ -46,9 +50,9 @@ func testAccServer_basic(t *testing.T) {
 				Config: testAccServerConfig_basic,
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckServerExists(ctx, resourceName, &conf),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "transfer", regexp.MustCompile(`server/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "transfer", regexache.MustCompile(`server/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "certificate", ""),
-					acctest.MatchResourceAttrRegionalHostname(resourceName, "endpoint", "server.transfer", regexp.MustCompile(`s-[a-z0-9]+`)),
+					acctest.MatchResourceAttrRegionalHostname(resourceName, "endpoint", "server.transfer", regexache.MustCompile(`s-[0-9a-z]+`)),
 					resource.TestCheckResourceAttr(resourceName, "endpoint_details.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "endpoint_type", "PUBLIC"),
 					resource.TestCheckResourceAttr(resourceName, "force_destroy", "false"),
@@ -68,6 +72,7 @@ func testAccServer_basic(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "protocols.#", "1"),
 					resource.TestCheckTypeSetElemAttr(resourceName, "protocols.*", "SFTP"),
 					resource.TestCheckResourceAttr(resourceName, "security_policy_name", "TransferSecurityPolicy-2018-11"),
+					resource.TestCheckResourceAttr(resourceName, "structured_log_destinations.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 					resource.TestCheckResourceAttr(resourceName, "url", ""),
 					resource.TestCheckResourceAttr(resourceName, "workflow_details.#", "0"),
@@ -83,10 +88,10 @@ func testAccServer_basic(t *testing.T) {
 				Config: testAccServerConfig_updated(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckServerExists(ctx, resourceName, &conf),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "transfer", regexp.MustCompile(`server/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "transfer", regexache.MustCompile(`server/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "certificate", ""),
 					resource.TestCheckResourceAttr(resourceName, "domain", "S3"),
-					acctest.MatchResourceAttrRegionalHostname(resourceName, "endpoint", "server.transfer", regexp.MustCompile(`s-[a-z0-9]+`)),
+					acctest.MatchResourceAttrRegionalHostname(resourceName, "endpoint", "server.transfer", regexache.MustCompile(`s-[0-9a-z]+`)),
 					resource.TestCheckResourceAttr(resourceName, "endpoint_details.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "endpoint_type", "PUBLIC"),
 					resource.TestCheckResourceAttr(resourceName, "force_destroy", "false"),
@@ -737,6 +742,46 @@ func testAccServer_updateEndpointType_vpcToPublic(t *testing.T) {
 	})
 }
 
+func testAccServer_structuredLogDestinations(t *testing.T) {
+	ctx := acctest.Context(t)
+	var s transfer.DescribedServer
+	resourceName := "aws_transfer_server.test"
+	cloudwatchLogGroupName := "aws_cloudwatch_log_group.test"
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheck(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, transfer.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckServerDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccServerConfig_structuredLogDestinations(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckServerExists(ctx, resourceName, &s),
+					// resource.TestCheckTypeSetElemAttr(resourceName, "structured_logging_destinations.*", *s.StructuredLogDestinations[0]),
+					resource.ComposeTestCheckFunc(testAccServerCheck_structuredLogDestinations(resourceName, cloudwatchLogGroupName)),
+				),
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"force_destroy"},
+			},
+			{
+				Config: testAccServerConfig_structuredLogDestinationsUpdate(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckServerExists(ctx, resourceName, &s),
+					// resource.TestCheckTypeSetElemAttr(resourceName, "structured_logging_destinations.*", *s.StructuredLogDestinations[0]),
+					// resource.TestCheckTypeSetElemAttr(resourceName, "structured_logging_destinations.*", fmt.Sprintf("\"${%s.arn}:*\"", cloudwatchLogGroupName)),
+					resource.ComposeTestCheckFunc(testAccServerCheck_structuredLogDestinations(resourceName, cloudwatchLogGroupName)),
+				),
+			},
+		},
+	})
+}
+
 func testAccServer_protocols(t *testing.T) {
 	ctx := acctest.Context(t)
 	var s transfer.DescribedServer
@@ -1216,6 +1261,32 @@ func testAccCheckServerDestroy(ctx context.Context) resource.TestCheckFunc {
 	}
 }
 
+func testAccServerCheck_structuredLogDestinations(resourceName, cloudwatchLogGroupName string) func(s *terraform.State) error {
+	return func(s *terraform.State) error {
+		cwResource, ok := s.RootModule().Resources[cloudwatchLogGroupName]
+		if !ok {
+			return fmt.Errorf("resource not found: %s", cloudwatchLogGroupName)
+		}
+		cwARN, ok := cwResource.Primary.Attributes["arn"]
+		if !ok {
+			return errors.New("cloudwatch group arn missing")
+		}
+		expectedSLD := fmt.Sprintf("%s:*", cwARN)
+		transferServerResource, ok := s.RootModule().Resources[resourceName]
+		if !ok {
+			return fmt.Errorf("resource not found: %s", resourceName)
+		}
+		slds, ok := transferServerResource.Primary.Attributes["structured_log_destinations.0"]
+		if !ok {
+			return errors.New("transfer server structured logging destinations missing")
+		}
+		if expectedSLD != slds {
+			return fmt.Errorf("'%s' != '%s'", expectedSLD, slds)
+		}
+		return nil
+	}
+}
+
 func testAccServerConfig_vpcBase(rName string) string {
 	return acctest.ConfigCompose(acctest.ConfigAvailableAZsNoOptIn(), fmt.Sprintf(`
 resource "aws_vpc" "test" {
@@ -1781,6 +1852,92 @@ resource "aws_transfer_server" "test" {
 `, rName, hostKey)
 }
 
+func testAccServerConfig_structuredLogDestinationsBase(rName string) string {
+	return fmt.Sprintf(`
+resource "aws_cloudwatch_log_group" "test" {
+  name = %[1]q
+}
+
+data "aws_iam_policy_document" "test" {
+  statement {
+    effect = "Allow"
+    principals {
+      type        = "Service"
+      identifiers = ["transfer.amazonaws.com"]
+    }
+    actions = ["sts:AssumeRole"]
+  }
+}
+
+resource "aws_iam_policy" "test" {
+  name = %[1]q
+
+  policy = jsonencode({
+    "Version" : "2012-10-17",
+    "Statement" : [
+      {
+        "Effect" : "Allow",
+        "Action" : [
+          "logs:CreateLogStream",
+          "logs:DescribeLogStreams",
+          "logs:CreateLogGroup",
+          "logs:PutLogEvents"
+        ],
+        "Resource" : "*"
+      }
+    ]
+  })
+}
+
+resource "aws_iam_role" "test" {
+  name               = %[1]q
+  assume_role_policy = data.aws_iam_policy_document.test.json
+}
+
+resource "aws_iam_role_policy_attachment" "test" {
+  role       = aws_iam_role.test.name
+  policy_arn = aws_iam_policy.test.arn
+}
+`, rName)
+}
+
+func testAccServerConfig_structuredLogDestinations(rName string) string {
+	return acctest.ConfigCompose(testAccServerConfig_structuredLogDestinationsBase(rName), fmt.Sprintf(`
+resource "aws_transfer_server" "test" {
+  endpoint_type = "PUBLIC"
+  logging_role  = aws_iam_role.test.arn
+  protocols     = ["SFTP"]
+  structured_log_destinations = [
+    "${aws_cloudwatch_log_group.test.arn}:*"
+  ]
+
+  tags = {
+    Name = %[1]q
+  }
+}
+`, rName))
+}
+
+func testAccServerConfig_structuredLogDestinationsUpdate(rName string) string {
+	return acctest.ConfigCompose(testAccServerConfig_structuredLogDestinationsBase(rName), fmt.Sprintf(`
+resource "aws_transfer_server" "test" {
+  endpoint_type = "PUBLIC"
+  logging_role  = aws_iam_role.test.arn
+  protocols     = ["SFTP"]
+  structured_log_destinations = [
+    "${aws_cloudwatch_log_group.test.arn}:*"
+  ]
+
+  pre_authentication_login_banner  = "This system is for the use of authorized users only - pre"
+  post_authentication_login_banner = "This system is for the use of authorized users only - post"
+
+  tags = {
+    Name = %[1]q
+  }
+}
+`, rName))
+}
+
 func testAccServerConfig_protocols(rName string) string {
 	return acctest.ConfigCompose(
 		testAccServerConfig_vpcBase(rName),
diff --git a/internal/service/transfer/service_package_gen.go b/internal/service/transfer/service_package_gen.go
index 8807cb6d878..ec5c4e36c07 100644
--- a/internal/service/transfer/service_package_gen.go
+++ b/internal/service/transfer/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	transfer_sdkv1 "github.com/aws/aws-sdk-go/service/transfer"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -37,6 +38,38 @@ func (p *servicePackage) SDKResources(ctx context.Context) []*types.ServicePacka
 			Factory:  ResourceAccess,
 			TypeName: "aws_transfer_access",
 		},
+		{
+			Factory:  ResourceAgreement,
+			TypeName: "aws_transfer_agreement",
+			Name:     "Agreement",
+			Tags: &types.ServicePackageResourceTags{
+				IdentifierAttribute: "arn",
+			},
+		},
+		{
+			Factory:  ResourceCertificate,
+			TypeName: "aws_transfer_certificate",
+			Name:     "Certificate",
+			Tags: &types.ServicePackageResourceTags{
+				IdentifierAttribute: "arn",
+			},
+		},
+		{
+			Factory:  ResourceConnector,
+			TypeName: "aws_transfer_connector",
+			Name:     "Connector",
+			Tags: &types.ServicePackageResourceTags{
+				IdentifierAttribute: "arn",
+			},
+		},
+		{
+			Factory:  ResourceProfile,
+			TypeName: "aws_transfer_profile",
+			Name:     "Profile",
+			Tags: &types.ServicePackageResourceTags{
+				IdentifierAttribute: "arn",
+			},
+		},
 		{
 			Factory:  ResourceServer,
 			TypeName: "aws_transfer_server",
@@ -83,4 +116,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*t
 	return transfer_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/transfer/ssh_key.go b/internal/service/transfer/ssh_key.go
index 902ce0cb3c2..7f8c166e9d3 100644
--- a/internal/service/transfer/ssh_key.go
+++ b/internal/service/transfer/ssh_key.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package transfer
 
 import (
diff --git a/internal/service/transfer/ssh_key_test.go b/internal/service/transfer/ssh_key_test.go
index 26603a984b6..c5eb228f99d 100644
--- a/internal/service/transfer/ssh_key_test.go
+++ b/internal/service/transfer/ssh_key_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package transfer_test
 
 import (
diff --git a/internal/service/transfer/status.go b/internal/service/transfer/status.go
index 4c20fc7b45d..94582a24da2 100644
--- a/internal/service/transfer/status.go
+++ b/internal/service/transfer/status.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package transfer
 
 import (
diff --git a/internal/service/transfer/sweep.go b/internal/service/transfer/sweep.go
index abbf546ece5..8d358527536 100644
--- a/internal/service/transfer/sweep.go
+++ b/internal/service/transfer/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package transfer
 
@@ -11,9 +11,10 @@ import (
 	"github.com/aws/aws-sdk-go/service/transfer"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_transfer_server", &resource.Sweeper{
 		Name: "aws_transfer_server",
 		F:    sweepServers,
@@ -30,7 +31,7 @@ func init() {
 
 func sweepServers(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -56,7 +57,7 @@ func sweepServers(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Transfer Server sweep for %s: %s", region, err)
 		return nil
 	}
@@ -65,7 +66,7 @@ func sweepServers(region string) error {
 		return fmt.Errorf("error listing Transfer Servers (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping Transfer Servers (%s): %w", region, err)
@@ -76,7 +77,7 @@ func sweepServers(region string) error {
 
 func sweepWorkflows(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -100,7 +101,7 @@ func sweepWorkflows(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping Transfer Workflow sweep for %s: %s", region, err)
 		return nil
 	}
@@ -109,7 +110,7 @@ func sweepWorkflows(region string) error {
 		return fmt.Errorf("error listing Transfer Workflows (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping Transfer Workflows (%s): %w", region, err)
diff --git a/internal/service/transfer/tag_test.go b/internal/service/transfer/tag_test.go
index 9bdf0336e56..eb46bcfcc81 100644
--- a/internal/service/transfer/tag_test.go
+++ b/internal/service/transfer/tag_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package transfer_test
 
 import (
diff --git a/internal/service/transfer/tags_gen.go b/internal/service/transfer/tags_gen.go
index 35258c080e6..bc053b180e4 100644
--- a/internal/service/transfer/tags_gen.go
+++ b/internal/service/transfer/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/transfer"
 	"github.com/aws/aws-sdk-go/service/transfer/transferiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
@@ -122,6 +124,8 @@ func updateTags(ctx context.Context, conn transferiface.TransferAPI, identifier
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.Transfer)
 	if len(removedTags) > 0 {
diff --git a/internal/service/transfer/transfer_test.go b/internal/service/transfer/transfer_test.go
index 0ffc497d03f..c9a016d5d44 100644
--- a/internal/service/transfer/transfer_test.go
+++ b/internal/service/transfer/transfer_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package transfer_test
 
 import (
@@ -16,6 +19,11 @@ func TestAccTransfer_serial(t *testing.T) {
 			"S3Basic":    testAccAccess_s3_basic,
 			"S3Policy":   testAccAccess_s3_policy,
 		},
+		"Agreement": {
+			"basic":      testAccAgreement_basic,
+			"disappears": testAccAgreement_disappears,
+			"tags":       testAccAgreement_tags,
+		},
 		"Server": {
 			"basic":                         testAccServer_basic,
 			"disappears":                    testAccServer_disappears,
@@ -34,6 +42,7 @@ func TestAccTransfer_serial(t *testing.T) {
 			"Protocols":                     testAccServer_protocols,
 			"ProtocolDetails":               testAccServer_protocolDetails,
 			"SecurityPolicy":                testAccServer_securityPolicy,
+			"StructuredLogDestinations":     testAccServer_structuredLogDestinations,
 			"UpdateEndpointTypePublicToVPC": testAccServer_updateEndpointType_publicToVPC,
 			"UpdateEndpointTypePublicToVPCAddressAllocationIDs":      testAccServer_updateEndpointType_publicToVPC_addressAllocationIDs,
 			"UpdateEndpointTypeVPCEndpointToVPC":                     testAccServer_updateEndpointType_vpcEndpointToVPC,
diff --git a/internal/service/transfer/update_tags_no_system_ignore_gen.go b/internal/service/transfer/update_tags_no_system_ignore_gen.go
index 40c81fc7041..081ff3e7510 100644
--- a/internal/service/transfer/update_tags_no_system_ignore_gen.go
+++ b/internal/service/transfer/update_tags_no_system_ignore_gen.go
@@ -8,6 +8,8 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/transfer"
 	"github.com/aws/aws-sdk-go/service/transfer/transferiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 )
 
@@ -18,6 +20,8 @@ func updateTagsNoIgnoreSystem(ctx context.Context, conn transferiface.TransferAP
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	if len(removedTags) > 0 {
 		input := &transfer.UntagResourceInput{
diff --git a/internal/service/transfer/user.go b/internal/service/transfer/user.go
index 4c0d3db32f6..d144a995969 100644
--- a/internal/service/transfer/user.go
+++ b/internal/service/transfer/user.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package transfer
 
 import (
diff --git a/internal/service/transfer/user_test.go b/internal/service/transfer/user_test.go
index 98b97b7bd81..2a01e334aa1 100644
--- a/internal/service/transfer/user_test.go
+++ b/internal/service/transfer/user_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package transfer_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/transfer"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -32,7 +35,7 @@ func testAccUser_basic(t *testing.T) {
 				Config: testAccUserConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckUserExists(ctx, resourceName, &conf),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "transfer", regexp.MustCompile(`user/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "transfer", regexache.MustCompile(`user/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "posix_profile.#", "0"),
 					resource.TestCheckResourceAttrPair(resourceName, "role", "aws_iam_role.test", "arn"),
 					resource.TestCheckResourceAttrPair(resourceName, "server_id", "aws_transfer_server.test", "id"),
@@ -211,11 +214,11 @@ func testAccUser_UserName_Validation(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccUserConfig_nameValidation(rName, "!@#$%^"),
-				ExpectError: regexp.MustCompile(`Invalid "user_name": `),
+				ExpectError: regexache.MustCompile(`Invalid "user_name": `),
 			},
 			{
 				Config:      testAccUserConfig_nameValidation(rName, sdkacctest.RandString(2)),
-				ExpectError: regexp.MustCompile(`Invalid "user_name": `),
+				ExpectError: regexache.MustCompile(`Invalid "user_name": `),
 			},
 			{
 				Config:             testAccUserConfig_nameValidation(rName, sdkacctest.RandString(33)),
@@ -224,11 +227,11 @@ func testAccUser_UserName_Validation(t *testing.T) {
 			},
 			{
 				Config:      testAccUserConfig_nameValidation(rName, sdkacctest.RandString(101)),
-				ExpectError: regexp.MustCompile(`Invalid "user_name": `),
+				ExpectError: regexache.MustCompile(`Invalid "user_name": `),
 			},
 			{
 				Config:      testAccUserConfig_nameValidation(rName, "-abcdef"),
-				ExpectError: regexp.MustCompile(`Invalid "user_name": `),
+				ExpectError: regexache.MustCompile(`Invalid "user_name": `),
 			},
 			{
 				Config:             testAccUserConfig_nameValidation(rName, "valid_username"),
diff --git a/internal/service/transfer/validate.go b/internal/service/transfer/validate.go
index 562af6e33d3..56ef86a9972 100644
--- a/internal/service/transfer/validate.go
+++ b/internal/service/transfer/validate.go
@@ -1,8 +1,12 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package transfer
 
 import (
 	"fmt"
-	"regexp"
+
+	"github.com/YakDriver/regexache"
 )
 
 func validServerID(v interface{}, k string) (ws []string, errors []error) {
@@ -10,7 +14,7 @@ func validServerID(v interface{}, k string) (ws []string, errors []error) {
 
 	// https://docs.aws.amazon.com/transfer/latest/userguide/API_CreateUser.html
 	pattern := `^s-([0-9a-f]{17})$`
-	if !regexp.MustCompile(pattern).MatchString(value) {
+	if !regexache.MustCompile(pattern).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"%q isn't a valid transfer server id (only lowercase alphanumeric characters are allowed): %q",
 			k, value))
@@ -22,7 +26,7 @@ func validServerID(v interface{}, k string) (ws []string, errors []error) {
 func validUserName(v interface{}, k string) (ws []string, errors []error) {
 	value := v.(string)
 	// https://docs.aws.amazon.com/transfer/latest/userguide/API_CreateUser.html
-	if !regexp.MustCompile(`^[\w][\w@.-]{2,99}$`).MatchString(value) {
+	if !regexache.MustCompile(`^[\w][\w@.-]{2,99}$`).MatchString(value) {
 		errors = append(errors, fmt.Errorf("Invalid %q: must be between 3 and 100 alphanumeric characters, special characters, hyphens, or underscores. However, it cannot begin with a hyphen, period, or at sign", k))
 	}
 	return
diff --git a/internal/service/transfer/wait.go b/internal/service/transfer/wait.go
index 1de840b2d7f..dcf1766ee72 100644
--- a/internal/service/transfer/wait.go
+++ b/internal/service/transfer/wait.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package transfer
 
 import (
diff --git a/internal/service/transfer/workflow.go b/internal/service/transfer/workflow.go
index 4d99a0427a9..0c5ec585621 100644
--- a/internal/service/transfer/workflow.go
+++ b/internal/service/transfer/workflow.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package transfer
 
 import (
 	"context"
 	"log"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/transfer"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -119,7 +122,7 @@ func ResourceWorkflow() *schema.Resource {
 										ForceNew: true,
 										ValidateFunc: validation.All(
 											validation.StringLenBetween(0, 30),
-											validation.StringMatch(regexp.MustCompile(`^[\w-]*$`), "Must be of the pattern ^[\\w-]*$"),
+											validation.StringMatch(regexache.MustCompile(`^[\w-]*$`), "Must be of the pattern ^[\\w-]*$"),
 										),
 									},
 									"overwrite_existing": {
@@ -135,7 +138,7 @@ func ResourceWorkflow() *schema.Resource {
 										ForceNew: true,
 										ValidateFunc: validation.All(
 											validation.StringLenBetween(0, 256),
-											validation.StringMatch(regexp.MustCompile(`^\$\{(\w+.)+\w+\}$`), "Must be of the pattern ^\\$\\{(\\w+.)+\\w+\\}$"),
+											validation.StringMatch(regexache.MustCompile(`^\$\{(\w+.)+\w+\}$`), "Must be of the pattern ^\\$\\{(\\w+.)+\\w+\\}$"),
 										),
 									},
 								},
@@ -154,7 +157,7 @@ func ResourceWorkflow() *schema.Resource {
 										ForceNew: true,
 										ValidateFunc: validation.All(
 											validation.StringLenBetween(0, 30),
-											validation.StringMatch(regexp.MustCompile(`^[\w-]*$`), "Must be of the pattern ^[\\w-]*$"),
+											validation.StringMatch(regexache.MustCompile(`^[\w-]*$`), "Must be of the pattern ^[\\w-]*$"),
 										),
 									},
 									"source_file_location": {
@@ -163,7 +166,7 @@ func ResourceWorkflow() *schema.Resource {
 										ForceNew: true,
 										ValidateFunc: validation.All(
 											validation.StringLenBetween(0, 256),
-											validation.StringMatch(regexp.MustCompile(`^\$\{(\w+.)+\w+\}$`), "Must be of the pattern ^\\$\\{(\\w+.)+\\w+\\}$"),
+											validation.StringMatch(regexache.MustCompile(`^\$\{(\w+.)+\w+\}$`), "Must be of the pattern ^\\$\\{(\\w+.)+\\w+\\}$"),
 										),
 									},
 									"target": {
@@ -245,7 +248,7 @@ func ResourceWorkflow() *schema.Resource {
 										ForceNew: true,
 										ValidateFunc: validation.All(
 											validation.StringLenBetween(0, 30),
-											validation.StringMatch(regexp.MustCompile(`^[\w-]*$`), "Must be of the pattern ^[\\w-]*$"),
+											validation.StringMatch(regexache.MustCompile(`^[\w-]*$`), "Must be of the pattern ^[\\w-]*$"),
 										),
 									},
 									"overwrite_existing": {
@@ -261,7 +264,7 @@ func ResourceWorkflow() *schema.Resource {
 										ForceNew: true,
 										ValidateFunc: validation.All(
 											validation.StringLenBetween(0, 256),
-											validation.StringMatch(regexp.MustCompile(`^\$\{(\w+.)+\w+\}$`), "Must be of the pattern ^\\$\\{(\\w+.)+\\w+\\}$"),
+											validation.StringMatch(regexache.MustCompile(`^\$\{(\w+.)+\w+\}$`), "Must be of the pattern ^\\$\\{(\\w+.)+\\w+\\}$"),
 										),
 									},
 									"type": {
@@ -286,7 +289,7 @@ func ResourceWorkflow() *schema.Resource {
 										ForceNew: true,
 										ValidateFunc: validation.All(
 											validation.StringLenBetween(0, 30),
-											validation.StringMatch(regexp.MustCompile(`^[\w-]*$`), "Must be of the pattern ^[\\w-]*$"),
+											validation.StringMatch(regexache.MustCompile(`^[\w-]*$`), "Must be of the pattern ^[\\w-]*$"),
 										),
 									},
 									"source_file_location": {
@@ -295,7 +298,7 @@ func ResourceWorkflow() *schema.Resource {
 										ForceNew: true,
 										ValidateFunc: validation.All(
 											validation.StringLenBetween(0, 256),
-											validation.StringMatch(regexp.MustCompile(`^\$\{(\w+.)+\w+\}$`), "Must be of the pattern ^\\$\\{(\\w+.)+\\w+\\}$"),
+											validation.StringMatch(regexache.MustCompile(`^\$\{(\w+.)+\w+\}$`), "Must be of the pattern ^\\$\\{(\\w+.)+\\w+\\}$"),
 										),
 									},
 								},
@@ -314,7 +317,7 @@ func ResourceWorkflow() *schema.Resource {
 										ForceNew: true,
 										ValidateFunc: validation.All(
 											validation.StringLenBetween(0, 30),
-											validation.StringMatch(regexp.MustCompile(`^[\w-]*$`), "Must be of the pattern ^[\\w-]*$"),
+											validation.StringMatch(regexache.MustCompile(`^[\w-]*$`), "Must be of the pattern ^[\\w-]*$"),
 										),
 									},
 									"source_file_location": {
@@ -323,7 +326,7 @@ func ResourceWorkflow() *schema.Resource {
 										ForceNew: true,
 										ValidateFunc: validation.All(
 											validation.StringLenBetween(0, 256),
-											validation.StringMatch(regexp.MustCompile(`^\$\{(\w+.)+\w+\}$`), "Must be of the pattern ^\\$\\{(\\w+.)+\\w+\\}$"),
+											validation.StringMatch(regexache.MustCompile(`^\$\{(\w+.)+\w+\}$`), "Must be of the pattern ^\\$\\{(\\w+.)+\\w+\\}$"),
 										),
 									},
 									"tags": {
@@ -432,7 +435,7 @@ func ResourceWorkflow() *schema.Resource {
 										ForceNew: true,
 										ValidateFunc: validation.All(
 											validation.StringLenBetween(0, 30),
-											validation.StringMatch(regexp.MustCompile(`^[\w-]*$`), "Must be of the pattern ^[\\w-]*$"),
+											validation.StringMatch(regexache.MustCompile(`^[\w-]*$`), "Must be of the pattern ^[\\w-]*$"),
 										),
 									},
 									"overwrite_existing": {
@@ -448,7 +451,7 @@ func ResourceWorkflow() *schema.Resource {
 										ForceNew: true,
 										ValidateFunc: validation.All(
 											validation.StringLenBetween(0, 256),
-											validation.StringMatch(regexp.MustCompile(`^\$\{(\w+.)+\w+\}$`), "Must be of the pattern ^\\$\\{(\\w+.)+\\w+\\}$"),
+											validation.StringMatch(regexache.MustCompile(`^\$\{(\w+.)+\w+\}$`), "Must be of the pattern ^\\$\\{(\\w+.)+\\w+\\}$"),
 										),
 									},
 								},
@@ -467,7 +470,7 @@ func ResourceWorkflow() *schema.Resource {
 										ForceNew: true,
 										ValidateFunc: validation.All(
 											validation.StringLenBetween(0, 30),
-											validation.StringMatch(regexp.MustCompile(`^[\w-]*$`), "Must be of the pattern ^[\\w-]*$"),
+											validation.StringMatch(regexache.MustCompile(`^[\w-]*$`), "Must be of the pattern ^[\\w-]*$"),
 										),
 									},
 									"source_file_location": {
@@ -476,7 +479,7 @@ func ResourceWorkflow() *schema.Resource {
 										ForceNew: true,
 										ValidateFunc: validation.All(
 											validation.StringLenBetween(0, 256),
-											validation.StringMatch(regexp.MustCompile(`^\$\{(\w+.)+\w+\}$`), "Must be of the pattern ^\\$\\{(\\w+.)+\\w+\\}$"),
+											validation.StringMatch(regexache.MustCompile(`^\$\{(\w+.)+\w+\}$`), "Must be of the pattern ^\\$\\{(\\w+.)+\\w+\\}$"),
 										),
 									},
 									"target": {
@@ -559,7 +562,7 @@ func ResourceWorkflow() *schema.Resource {
 										ForceNew: true,
 										ValidateFunc: validation.All(
 											validation.StringLenBetween(0, 30),
-											validation.StringMatch(regexp.MustCompile(`^[\w-]*$`), "Must be of the pattern ^[\\w-]*$"),
+											validation.StringMatch(regexache.MustCompile(`^[\w-]*$`), "Must be of the pattern ^[\\w-]*$"),
 										),
 									},
 									"overwrite_existing": {
@@ -575,7 +578,7 @@ func ResourceWorkflow() *schema.Resource {
 										ForceNew: true,
 										ValidateFunc: validation.All(
 											validation.StringLenBetween(0, 256),
-											validation.StringMatch(regexp.MustCompile(`^\$\{(\w+.)+\w+\}$`), "Must be of the pattern ^\\$\\{(\\w+.)+\\w+\\}$"),
+											validation.StringMatch(regexache.MustCompile(`^\$\{(\w+.)+\w+\}$`), "Must be of the pattern ^\\$\\{(\\w+.)+\\w+\\}$"),
 										),
 									},
 									"type": {
@@ -600,7 +603,7 @@ func ResourceWorkflow() *schema.Resource {
 										ForceNew: true,
 										ValidateFunc: validation.All(
 											validation.StringLenBetween(0, 30),
-											validation.StringMatch(regexp.MustCompile(`^[\w-]*$`), "Must be of the pattern ^[\\w-]*$"),
+											validation.StringMatch(regexache.MustCompile(`^[\w-]*$`), "Must be of the pattern ^[\\w-]*$"),
 										),
 									},
 									"source_file_location": {
@@ -609,7 +612,7 @@ func ResourceWorkflow() *schema.Resource {
 										ForceNew: true,
 										ValidateFunc: validation.All(
 											validation.StringLenBetween(0, 256),
-											validation.StringMatch(regexp.MustCompile(`^\$\{(\w+.)+\w+\}$`), "Must be of the pattern ^\\$\\{(\\w+.)+\\w+\\}$"),
+											validation.StringMatch(regexache.MustCompile(`^\$\{(\w+.)+\w+\}$`), "Must be of the pattern ^\\$\\{(\\w+.)+\\w+\\}$"),
 										),
 									},
 								},
@@ -628,7 +631,7 @@ func ResourceWorkflow() *schema.Resource {
 										ForceNew: true,
 										ValidateFunc: validation.All(
 											validation.StringLenBetween(0, 30),
-											validation.StringMatch(regexp.MustCompile(`^[\w-]*$`), "Must be of the pattern ^[\\w-]*$"),
+											validation.StringMatch(regexache.MustCompile(`^[\w-]*$`), "Must be of the pattern ^[\\w-]*$"),
 										),
 									},
 									"source_file_location": {
@@ -637,7 +640,7 @@ func ResourceWorkflow() *schema.Resource {
 										ForceNew: true,
 										ValidateFunc: validation.All(
 											validation.StringLenBetween(0, 256),
-											validation.StringMatch(regexp.MustCompile(`^\$\{(\w+.)+\w+\}$`), "Must be of the pattern ^\\$\\{(\\w+.)+\\w+\\}$"),
+											validation.StringMatch(regexache.MustCompile(`^\$\{(\w+.)+\w+\}$`), "Must be of the pattern ^\\$\\{(\\w+.)+\\w+\\}$"),
 										),
 									},
 									"tags": {
diff --git a/internal/service/transfer/workflow_test.go b/internal/service/transfer/workflow_test.go
index fb67b4ebadf..a31e1a5fba3 100644
--- a/internal/service/transfer/workflow_test.go
+++ b/internal/service/transfer/workflow_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package transfer_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/transfer"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -32,7 +35,7 @@ func TestAccTransferWorkflow_basic(t *testing.T) {
 				Config: testAccWorkflowConfig_basic(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckWorkflowExists(ctx, resourceName, &conf),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "transfer", regexp.MustCompile(`workflow/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "transfer", regexache.MustCompile(`workflow/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
 					resource.TestCheckResourceAttr(resourceName, "on_exception_steps.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "steps.#", "1"),
@@ -72,7 +75,7 @@ func TestAccTransferWorkflow_onExceptionSteps(t *testing.T) {
 				Config: testAccWorkflowConfig_onExceptionSteps(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckWorkflowExists(ctx, resourceName, &conf),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "transfer", regexp.MustCompile(`workflow/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "transfer", regexache.MustCompile(`workflow/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "on_exception_steps.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "on_exception_steps.0.copy_step_details.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "on_exception_steps.0.custom_step_details.#", "0"),
@@ -217,7 +220,7 @@ func TestAccTransferWorkflow_allSteps(t *testing.T) {
 				Config: testAccWorkflowConfig_allSteps(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckWorkflowExists(ctx, resourceName, &conf),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "transfer", regexp.MustCompile(`workflow/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "transfer", regexache.MustCompile(`workflow/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "on_exception_steps.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "steps.#", "5"),
 					resource.TestCheckResourceAttr(resourceName, "steps.0.copy_step_details.#", "1"),
diff --git a/internal/service/verifiedpermissions/README.md b/internal/service/verifiedpermissions/README.md
new file mode 100644
index 00000000000..51fe3fcb9e8
--- /dev/null
+++ b/internal/service/verifiedpermissions/README.md
@@ -0,0 +1,10 @@
+# Terraform AWS Provider VerifiedPermissions Package
+
+This area is primarily for AWS provider contributors and maintainers. For information on _using_ Terraform and the AWS provider, see the links below.
+
+## Handy Links
+
+* [Find out about contributing](https://hashicorp.github.io/terraform-provider-aws/#contribute) to the AWS provider!
+* AWS Provider Docs: [Home](https://registry.terraform.io/providers/hashicorp/aws/latest/docs)
+* AWS Provider Docs: [One of the VerifiedPermissions resources](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/verifiedpermissions_policy_store)
+* AWS Docs: [AWS SDK for Go VerifiedPermissions](https://docs.aws.amazon.com/sdk-for-go/api/service/verifiedpermissions/)
diff --git a/internal/service/verifiedpermissions/generate.go b/internal/service/verifiedpermissions/generate.go
new file mode 100644
index 00000000000..6ea5165dc1f
--- /dev/null
+++ b/internal/service/verifiedpermissions/generate.go
@@ -0,0 +1,7 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+//go:generate go run ../../generate/servicepackage/main.go
+// ONLY generate directives and package declaration! Do not add anything else to this file.
+
+package verifiedpermissions
diff --git a/internal/service/verifiedpermissions/service_package_gen.go b/internal/service/verifiedpermissions/service_package_gen.go
new file mode 100644
index 00000000000..39166c46f0d
--- /dev/null
+++ b/internal/service/verifiedpermissions/service_package_gen.go
@@ -0,0 +1,50 @@
+// Code generated by internal/generate/servicepackages/main.go; DO NOT EDIT.
+
+package verifiedpermissions
+
+import (
+	"context"
+
+	aws_sdkv2 "github.com/aws/aws-sdk-go-v2/aws"
+	verifiedpermissions_sdkv2 "github.com/aws/aws-sdk-go-v2/service/verifiedpermissions"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/types"
+	"github.com/hashicorp/terraform-provider-aws/names"
+)
+
+type servicePackage struct{}
+
+func (p *servicePackage) FrameworkDataSources(ctx context.Context) []*types.ServicePackageFrameworkDataSource {
+	return []*types.ServicePackageFrameworkDataSource{}
+}
+
+func (p *servicePackage) FrameworkResources(ctx context.Context) []*types.ServicePackageFrameworkResource {
+	return []*types.ServicePackageFrameworkResource{}
+}
+
+func (p *servicePackage) SDKDataSources(ctx context.Context) []*types.ServicePackageSDKDataSource {
+	return []*types.ServicePackageSDKDataSource{}
+}
+
+func (p *servicePackage) SDKResources(ctx context.Context) []*types.ServicePackageSDKResource {
+	return []*types.ServicePackageSDKResource{}
+}
+
+func (p *servicePackage) ServicePackageName() string {
+	return names.VerifiedPermissions
+}
+
+// NewClient returns a new AWS SDK for Go v2 client for this service package's AWS API.
+func (p *servicePackage) NewClient(ctx context.Context, config map[string]any) (*verifiedpermissions_sdkv2.Client, error) {
+	cfg := *(config["aws_sdkv2_config"].(*aws_sdkv2.Config))
+
+	return verifiedpermissions_sdkv2.NewFromConfig(cfg, func(o *verifiedpermissions_sdkv2.Options) {
+		if endpoint := config["endpoint"].(string); endpoint != "" {
+			o.BaseEndpoint = aws_sdkv2.String(endpoint)
+		}
+	}), nil
+}
+
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/vpclattice/access_log_subscription.go b/internal/service/vpclattice/access_log_subscription.go
index 6a287e6575d..60cb7b6d7e8 100644
--- a/internal/service/vpclattice/access_log_subscription.go
+++ b/internal/service/vpclattice/access_log_subscription.go
@@ -1,9 +1,12 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package vpclattice
 
 import (
 	"context"
-	"errors"
 	"log"
+	"strings"
 
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/vpclattice"
@@ -14,6 +17,7 @@ import (
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/create"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
@@ -22,7 +26,7 @@ import (
 
 // @SDKResource("aws_vpclattice_access_log_subscription", name="Access Log Subscription")
 // @Tags(identifierAttribute="arn")
-func ResourceAccessLogSubscription() *schema.Resource {
+func resourceAccessLogSubscription() *schema.Resource {
 	return &schema.Resource{
 		CreateWithoutTimeout: resourceAccessLogSubscriptionCreate,
 		ReadWithoutTimeout:   resourceAccessLogSubscriptionRead,
@@ -39,19 +43,21 @@ func ResourceAccessLogSubscription() *schema.Resource {
 				Computed: true,
 			},
 			"destination_arn": {
-				Type:         schema.TypeString,
-				Required:     true,
-				ForceNew:     true,
-				ValidateFunc: verify.ValidARN,
+				Type:             schema.TypeString,
+				Required:         true,
+				ForceNew:         true,
+				ValidateFunc:     verify.ValidARN,
+				DiffSuppressFunc: suppressEquivalentCloudWatchLogsLogGroupARN,
 			},
 			"resource_arn": {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
 			"resource_identifier": {
-				Type:     schema.TypeString,
-				Required: true,
-				ForceNew: true,
+				Type:             schema.TypeString,
+				Required:         true,
+				ForceNew:         true,
+				DiffSuppressFunc: suppressEquivalentIDOrARN,
 			},
 			names.AttrTags:    tftags.TagsSchema(),
 			names.AttrTagsAll: tftags.TagsSchemaComputed(),
@@ -122,12 +128,11 @@ func resourceAccessLogSubscriptionDelete(ctx context.Context, d *schema.Resource
 		AccessLogSubscriptionIdentifier: aws.String(d.Id()),
 	})
 
-	if err != nil {
-		var nfe *types.ResourceNotFoundException
-		if errors.As(err, &nfe) {
-			return nil
-		}
+	if errs.IsA[*types.ResourceNotFoundException](err) {
+		return nil
+	}
 
+	if err != nil {
 		return create.DiagError(names.VPCLattice, create.ErrActionDeleting, ResNameAccessLogSubscription, d.Id(), err)
 	}
 
@@ -139,15 +144,15 @@ func findAccessLogSubscriptionByID(ctx context.Context, conn *vpclattice.Client,
 		AccessLogSubscriptionIdentifier: aws.String(id),
 	}
 	out, err := conn.GetAccessLogSubscription(ctx, in)
-	if err != nil {
-		var nfe *types.ResourceNotFoundException
-		if errors.As(err, &nfe) {
-			return nil, &retry.NotFoundError{
-				LastError:   err,
-				LastRequest: in,
-			}
+
+	if errs.IsA[*types.ResourceNotFoundException](err) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: in,
 		}
+	}
 
+	if err != nil {
 		return nil, err
 	}
 
@@ -157,3 +162,9 @@ func findAccessLogSubscriptionByID(ctx context.Context, conn *vpclattice.Client,
 
 	return out, nil
 }
+
+// suppressEquivalentCloudWatchLogsLogGroupARN provides custom difference suppression
+// for strings that represent equal CloudWatch Logs log group ARNs.
+func suppressEquivalentCloudWatchLogsLogGroupARN(_, old, new string, _ *schema.ResourceData) bool {
+	return strings.TrimSuffix(old, ":*") == strings.TrimSuffix(new, ":*")
+}
diff --git a/internal/service/vpclattice/access_log_subscription_test.go b/internal/service/vpclattice/access_log_subscription_test.go
index f96b641c02f..6e72391dab0 100644
--- a/internal/service/vpclattice/access_log_subscription_test.go
+++ b/internal/service/vpclattice/access_log_subscription_test.go
@@ -1,15 +1,17 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package vpclattice_test
 
 import (
 	"context"
 	"errors"
 	"fmt"
-	"regexp"
+	"strings"
 	"testing"
 
-	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/service/vpclattice"
-	"github.com/aws/aws-sdk-go-v2/service/vpclattice/types"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
@@ -17,9 +19,56 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/create"
 	tfvpclattice "github.com/hashicorp/terraform-provider-aws/internal/service/vpclattice"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
+func TestSuppressEquivalentCloudWatchLogsLogGroupARN(t *testing.T) {
+	t.Parallel()
+
+	testCases := []struct {
+		old  string
+		new  string
+		want bool
+	}{
+		{
+			old:  "arn:aws:s3:::tf-acc-test-3740243764086645346", //lintignore:AWSAT003,AWSAT005
+			new:  "arn:aws:s3:::tf-acc-test-3740243764086645346", //lintignore:AWSAT003,AWSAT005
+			want: true,
+		},
+		{
+			old:  "arn:aws:s3:::tf-acc-test-3740243764086645346",                                                    //lintignore:AWSAT003,AWSAT005
+			new:  "arn:aws:logs:us-west-2:123456789012:log-group:/aws/vpclattice/tf-acc-test-3740243764086645346:*", //lintignore:AWSAT003,AWSAT005
+			want: false,
+		},
+		{
+			old:  "arn:aws:logs:us-west-2:123456789012:log-group:/aws/vpclattice/tf-acc-test-3740243764086645346:*", //lintignore:AWSAT003,AWSAT005
+			new:  "arn:aws:logs:us-west-2:123456789012:log-group:/aws/vpclattice/tf-acc-test-3740243764086645346:*", //lintignore:AWSAT003,AWSAT005
+			want: true,
+		},
+		{
+			old:  "arn:aws:logs:us-west-2:123456789012:log-group:/aws/vpclattice/tf-acc-test-3740243764086645346",   //lintignore:AWSAT003,AWSAT005
+			new:  "arn:aws:logs:us-west-2:123456789012:log-group:/aws/vpclattice/tf-acc-test-3740243764086645346:*", //lintignore:AWSAT003,AWSAT005
+			want: true,
+		},
+		{
+			old:  "arn:aws:logs:us-west-2:123456789012:log-group:/aws/vpclattice/tf-acc-test-3740243764086645346:*", //lintignore:AWSAT003,AWSAT005
+			new:  "arn:aws:logs:us-west-2:123456789012:log-group:/aws/vpclattice/tf-acc-test-3740243764086645347:*", //lintignore:AWSAT003,AWSAT005
+			want: false,
+		},
+		{
+			old:  "arn:aws:logs:us-west-2:123456789012:log-group:/aws/vpclattice/tf-acc-test-3740243764086645346:*", //lintignore:AWSAT003,AWSAT005
+			new:  "arn:aws:logs:us-west-2:123456789012:log-group:/aws/vpclattice/tf-acc-test-3740243764086645347",   //lintignore:AWSAT003,AWSAT005
+			want: false,
+		},
+	}
+	for _, testCase := range testCases {
+		if got, want := tfvpclattice.SuppressEquivalentCloudWatchLogsLogGroupARN("test_property", testCase.old, testCase.new, nil), testCase.want; got != want {
+			t.Errorf("SuppressEquivalentCloudWatchLogsLogGroupARN(%q, %q) = %v, want %v", testCase.old, testCase.new, got, want)
+		}
+	}
+}
+
 func TestAccVPCLatticeAccessLogSubscription_basic(t *testing.T) {
 	ctx := acctest.Context(t)
 	var accesslogsubscription vpclattice.GetAccessLogSubscriptionOutput
@@ -40,11 +89,12 @@ func TestAccVPCLatticeAccessLogSubscription_basic(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config: testAccAccessLogSubscriptionConfig_basicS3(rName),
-				Check: resource.ComposeTestCheckFunc(
+				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckAccessLogSubscriptionExists(ctx, resourceName, &accesslogsubscription),
-					resource.TestCheckResourceAttrPair(resourceName, "resource_identifier", serviceNetworkResourceName, "id"),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", names.VPCLatticeEndpointID, regexache.MustCompile(`accesslogsubscription/.+$`)),
 					resource.TestCheckResourceAttrPair(resourceName, "destination_arn", s3BucketResourceName, "arn"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", names.VPCLatticeEndpointID, regexp.MustCompile(`accesslogsubscription/.+$`)),
+					resource.TestCheckResourceAttrPair(resourceName, "resource_arn", serviceNetworkResourceName, "arn"),
+					resource.TestCheckResourceAttrPair(resourceName, "resource_identifier", serviceNetworkResourceName, "id"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 				),
 			},
@@ -85,6 +135,40 @@ func TestAccVPCLatticeAccessLogSubscription_disappears(t *testing.T) {
 	})
 }
 
+func TestAccVPCLatticeAccessLogSubscription_arn(t *testing.T) {
+	ctx := acctest.Context(t)
+	var accesslogsubscription vpclattice.GetAccessLogSubscriptionOutput
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_vpclattice_access_log_subscription.test"
+	serviceNetworkResourceName := "aws_vpclattice_service_network.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, names.VPCLatticeEndpointID)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, names.VPCLatticeEndpointID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckAccessLogSubscriptionDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccAccessLogSubscriptionConfig_arn(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAccessLogSubscriptionExists(ctx, resourceName, &accesslogsubscription),
+					resource.TestCheckResourceAttrPair(resourceName, "resource_arn", serviceNetworkResourceName, "arn"),
+					resource.TestCheckResourceAttrPair(resourceName, "resource_identifier", serviceNetworkResourceName, "id"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
 func TestAccVPCLatticeAccessLogSubscription_tags(t *testing.T) {
 	ctx := acctest.Context(t)
 	var accesslogsubscription1, accesslogsubscription2, accesslogsubscription3 vpclattice.GetAccessLogSubscriptionOutput
@@ -135,6 +219,75 @@ func TestAccVPCLatticeAccessLogSubscription_tags(t *testing.T) {
 	})
 }
 
+func TestAccVPCLatticeAccessLogSubscription_cloudwatchNoWildcard(t *testing.T) {
+	ctx := acctest.Context(t)
+	var accesslogsubscription vpclattice.GetAccessLogSubscriptionOutput
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_vpclattice_access_log_subscription.test"
+	serviceResourceName := "aws_vpclattice_service.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, names.VPCLatticeEndpointID)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, names.VPCLatticeEndpointID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckAccessLogSubscriptionDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccAccessLogSubscriptionConfig_cloudwatchNoWildcard(rName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckAccessLogSubscriptionExists(ctx, resourceName, &accesslogsubscription),
+					resource.TestCheckResourceAttrWith(resourceName, "destination_arn", func(value string) error {
+						if !strings.HasSuffix(value, ":*") {
+							return fmt.Errorf("%s is not a wildcard ARN", value)
+						}
+
+						return nil
+					}),
+					resource.TestCheckResourceAttrPair(resourceName, "resource_arn", serviceResourceName, "arn"),
+					resource.TestCheckResourceAttrPair(resourceName, "resource_identifier", serviceResourceName, "id"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccVPCLatticeAccessLogSubscription_cloudwatchWildcard(t *testing.T) {
+	ctx := acctest.Context(t)
+	var accesslogsubscription vpclattice.GetAccessLogSubscriptionOutput
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_vpclattice_access_log_subscription.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, names.VPCLatticeEndpointID)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, names.VPCLatticeEndpointID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckAccessLogSubscriptionDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccAccessLogSubscriptionConfig_cloudwatchWildcard(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAccessLogSubscriptionExists(ctx, resourceName, &accesslogsubscription),
+					resource.TestCheckResourceAttrWith(resourceName, "destination_arn", func(value string) error {
+						if !strings.HasSuffix(value, ":*") {
+							return fmt.Errorf("%s is not a wildcard ARN", value)
+						}
+
+						return nil
+					}),
+				),
+			},
+		},
+	})
+}
+
 func testAccCheckAccessLogSubscriptionDestroy(ctx context.Context) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		conn := acctest.Provider.Meta().(*conns.AWSClient).VPCLatticeClient(ctx)
@@ -144,18 +297,17 @@ func testAccCheckAccessLogSubscriptionDestroy(ctx context.Context) resource.Test
 				continue
 			}
 
-			_, err := conn.GetAccessLogSubscription(ctx, &vpclattice.GetAccessLogSubscriptionInput{
-				AccessLogSubscriptionIdentifier: aws.String(rs.Primary.ID),
-			})
+			_, err := tfvpclattice.FindAccessLogSubscriptionByID(ctx, conn, rs.Primary.ID)
+
+			if tfresource.NotFound(err) {
+				continue
+			}
+
 			if err != nil {
-				var nfe *types.ResourceNotFoundException
-				if errors.As(err, &nfe) {
-					return nil
-				}
 				return err
 			}
 
-			return create.Error(names.VPCLattice, create.ErrActionCheckingDestroyed, tfvpclattice.ResNameAccessLogSubscription, rs.Primary.ID, errors.New("not destroyed"))
+			return fmt.Errorf("VPC Lattice Access Log Subscription %s still exists", rs.Primary.ID)
 		}
 
 		return nil
@@ -174,12 +326,10 @@ func testAccCheckAccessLogSubscriptionExists(ctx context.Context, name string, a
 		}
 
 		conn := acctest.Provider.Meta().(*conns.AWSClient).VPCLatticeClient(ctx)
-		resp, err := conn.GetAccessLogSubscription(ctx, &vpclattice.GetAccessLogSubscriptionInput{
-			AccessLogSubscriptionIdentifier: aws.String(rs.Primary.ID),
-		})
+		resp, err := tfvpclattice.FindAccessLogSubscriptionByID(ctx, conn, rs.Primary.ID)
 
 		if err != nil {
-			return create.Error(names.VPCLattice, create.ErrActionCheckingExistence, tfvpclattice.ResNameAccessLogSubscription, rs.Primary.ID, err)
+			return err
 		}
 
 		*accesslogsubscription = *resp
@@ -188,7 +338,7 @@ func testAccCheckAccessLogSubscriptionExists(ctx context.Context, name string, a
 	}
 }
 
-func testAccAccessLogSubscriptionConfig_basicS3(rName string) string {
+func testAccAccessLogSubscriptionConfig_baseS3(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_vpclattice_service_network" "test" {
   name = %[1]q
@@ -198,55 +348,80 @@ resource "aws_s3_bucket" "test" {
   bucket        = %[1]q
   force_destroy = true
 }
+`, rName)
+}
+
+func testAccAccessLogSubscriptionConfig_baseCloudWatch(rName string) string {
+	return fmt.Sprintf(`
+resource "aws_vpclattice_service" "test" {
+  name = %[1]q
+}
 
+resource "aws_cloudwatch_log_group" "test" {
+  name = "/aws/vpclattice/%[1]s"
+}
+`, rName)
+}
+
+func testAccAccessLogSubscriptionConfig_basicS3(rName string) string {
+	return acctest.ConfigCompose(testAccAccessLogSubscriptionConfig_baseS3(rName), `
 resource "aws_vpclattice_access_log_subscription" "test" {
   resource_identifier = aws_vpclattice_service_network.test.id
   destination_arn     = aws_s3_bucket.test.arn
 }
-`, rName)
+`)
 }
 
-func testAccAccessLogSubscriptionConfig_tags1(rName, tagKey1, tagValue1 string) string {
-	return fmt.Sprintf(`
-resource "aws_vpclattice_service_network" "test" {
-  name = %[1]q
+func testAccAccessLogSubscriptionConfig_arn(rName string) string {
+	return acctest.ConfigCompose(testAccAccessLogSubscriptionConfig_baseS3(rName), `
+resource "aws_vpclattice_access_log_subscription" "test" {
+  resource_identifier = aws_vpclattice_service_network.test.arn
+  destination_arn     = aws_s3_bucket.test.arn
 }
-
-resource "aws_s3_bucket" "test" {
-  bucket        = %[1]q
-  force_destroy = true
+`)
 }
 
+func testAccAccessLogSubscriptionConfig_tags1(rName, tagKey1, tagValue1 string) string {
+	return acctest.ConfigCompose(testAccAccessLogSubscriptionConfig_baseS3(rName), fmt.Sprintf(`
 resource "aws_vpclattice_access_log_subscription" "test" {
   resource_identifier = aws_vpclattice_service_network.test.id
   destination_arn     = aws_s3_bucket.test.arn
 
   tags = {
-    %[2]q = %[3]q
+    %[1]q = %[2]q
   }
 }
-`, rName, tagKey1, tagValue1)
+`, tagKey1, tagValue1))
 }
 
 func testAccAccessLogSubscriptionConfig_tags2(rName, tagKey1, tagValue1, tagKey2, tagValue2 string) string {
-	return fmt.Sprintf(`
-resource "aws_vpclattice_service_network" "test" {
-  name = %[1]q
-}
-
-resource "aws_s3_bucket" "test" {
-  bucket        = %[1]q
-  force_destroy = true
-}
-
+	return acctest.ConfigCompose(testAccAccessLogSubscriptionConfig_baseS3(rName), fmt.Sprintf(`
 resource "aws_vpclattice_access_log_subscription" "test" {
   resource_identifier = aws_vpclattice_service_network.test.id
   destination_arn     = aws_s3_bucket.test.arn
 
   tags = {
-    %[2]q = %[3]q
-    %[4]q = %[5]q
+    %[1]q = %[2]q
+    %[3]q = %[4]q
   }
 }
-`, rName, tagKey1, tagValue1, tagKey2, tagValue2)
+`, tagKey1, tagValue1, tagKey2, tagValue2))
+}
+
+func testAccAccessLogSubscriptionConfig_cloudwatchNoWildcard(rName string) string {
+	return acctest.ConfigCompose(testAccAccessLogSubscriptionConfig_baseCloudWatch(rName), `
+resource "aws_vpclattice_access_log_subscription" "test" {
+  resource_identifier = aws_vpclattice_service.test.id
+  destination_arn     = aws_cloudwatch_log_group.test.arn
+}
+`)
+}
+
+func testAccAccessLogSubscriptionConfig_cloudwatchWildcard(rName string) string {
+	return acctest.ConfigCompose(testAccAccessLogSubscriptionConfig_baseCloudWatch(rName), `
+resource "aws_vpclattice_access_log_subscription" "test" {
+  resource_identifier = aws_vpclattice_service.test.id
+  destination_arn     = "${aws_cloudwatch_log_group.test.arn}:*"
+}
+`)
 }
diff --git a/internal/service/vpclattice/auth_policy.go b/internal/service/vpclattice/auth_policy.go
index 0bb856a8a7c..c2efd14ab1e 100644
--- a/internal/service/vpclattice/auth_policy.go
+++ b/internal/service/vpclattice/auth_policy.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package vpclattice
 
 import (
diff --git a/internal/service/vpclattice/auth_policy_data_source.go b/internal/service/vpclattice/auth_policy_data_source.go
index 661ba17abb4..394ce89d479 100644
--- a/internal/service/vpclattice/auth_policy_data_source.go
+++ b/internal/service/vpclattice/auth_policy_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package vpclattice
 
 import (
diff --git a/internal/service/vpclattice/auth_policy_data_source_test.go b/internal/service/vpclattice/auth_policy_data_source_test.go
index b38103eafb1..281f3e6aa3f 100644
--- a/internal/service/vpclattice/auth_policy_data_source_test.go
+++ b/internal/service/vpclattice/auth_policy_data_source_test.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package vpclattice_test
 
 import (
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
@@ -34,7 +37,7 @@ func TestAccVPCLatticeAuthPolicyDataSource_basic(t *testing.T) {
 			{
 				Config: testAccAuthPolicyDataSourceConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
-					resource.TestMatchResourceAttr(dataSourceName, "policy", regexp.MustCompile(`"Action":"*"`)),
+					resource.TestMatchResourceAttr(dataSourceName, "policy", regexache.MustCompile(`"Action":"*"`)),
 					resource.TestCheckResourceAttrPair(dataSourceName, "resource_identifier", "aws_vpclattice_service.test", "arn"),
 				),
 			},
diff --git a/internal/service/vpclattice/auth_policy_test.go b/internal/service/vpclattice/auth_policy_test.go
index 76423b08b4e..eedb4673c76 100644
--- a/internal/service/vpclattice/auth_policy_test.go
+++ b/internal/service/vpclattice/auth_policy_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package vpclattice_test
 
 import (
 	"context"
 	"errors"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/vpclattice"
 	"github.com/aws/aws-sdk-go-v2/service/vpclattice/types"
@@ -41,7 +44,7 @@ func TestAccVPCLatticeAuthPolicy_basic(t *testing.T) {
 				Config: testAccAuthPolicyConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckAuthPolicyExists(ctx, resourceName, &authpolicy),
-					resource.TestMatchResourceAttr(resourceName, "policy", regexp.MustCompile(`"Action":"*"`)),
+					resource.TestMatchResourceAttr(resourceName, "policy", regexache.MustCompile(`"Action":"*"`)),
 					resource.TestCheckResourceAttrPair(resourceName, "resource_identifier", "aws_vpclattice_service.test", "arn"),
 				),
 			},
diff --git a/internal/service/vpclattice/exports_test.go b/internal/service/vpclattice/exports_test.go
index de5ad314c18..09446138ae1 100644
--- a/internal/service/vpclattice/exports_test.go
+++ b/internal/service/vpclattice/exports_test.go
@@ -1,8 +1,25 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package vpclattice
 
 // Exports for use in tests only.
 var (
-	FindTargetByThreePartKey = findTargetByThreePartKey
+	FindAccessLogSubscriptionByID            = findAccessLogSubscriptionByID
+	FindServiceByID                          = findServiceByID
+	FindServiceNetworkByID                   = findServiceNetworkByID
+	FindServiceNetworkServiceAssociationByID = findServiceNetworkServiceAssociationByID
+	FindServiceNetworkVPCAssociationByID     = findServiceNetworkVPCAssociationByID
+	FindTargetByThreePartKey                 = findTargetByThreePartKey
+
+	IDFromIDOrARN                               = idFromIDOrARN
+	SuppressEquivalentCloudWatchLogsLogGroupARN = suppressEquivalentCloudWatchLogsLogGroupARN
+	SuppressEquivalentIDOrARN                   = suppressEquivalentIDOrARN
 
-	ResourceTargetGroupAttachment = resourceTargetGroupAttachment
+	ResourceAccessLogSubscription            = resourceAccessLogSubscription
+	ResourceService                          = resourceService
+	ResourceServiceNetwork                   = resourceServiceNetwork
+	ResourceServiceNetworkServiceAssociation = resourceServiceNetworkServiceAssociation
+	ResourceServiceNetworkVPCAssociation     = resourceServiceNetworkVPCAssociation
+	ResourceTargetGroupAttachment            = resourceTargetGroupAttachment
 )
diff --git a/internal/service/vpclattice/generate.go b/internal/service/vpclattice/generate.go
index 5a0791f317f..d6eb39aaa62 100644
--- a/internal/service/vpclattice/generate.go
+++ b/internal/service/vpclattice/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -AWSSDKVersion=2 -ServiceTagsMap -KVTValues -SkipTypesImp -ListTags -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/vpclattice/listener.go b/internal/service/vpclattice/listener.go
index 05d7628a00f..bc25e839b18 100644
--- a/internal/service/vpclattice/listener.go
+++ b/internal/service/vpclattice/listener.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package vpclattice
 
 import (
diff --git a/internal/service/vpclattice/listener_data_source.go b/internal/service/vpclattice/listener_data_source.go
index 2db5ecb663b..0f64b6fdc4b 100644
--- a/internal/service/vpclattice/listener_data_source.go
+++ b/internal/service/vpclattice/listener_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package vpclattice
 
 import (
diff --git a/internal/service/vpclattice/listener_data_source_test.go b/internal/service/vpclattice/listener_data_source_test.go
index db76a740393..2ab8a54bb86 100644
--- a/internal/service/vpclattice/listener_data_source_test.go
+++ b/internal/service/vpclattice/listener_data_source_test.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package vpclattice_test
 
 import (
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
@@ -35,7 +38,7 @@ func TestAccVPCLatticeListenerDataSource_basic(t *testing.T) {
 					resource.TestCheckResourceAttr(dataSourceName, "name", rName),
 					resource.TestCheckResourceAttr(dataSourceName, "protocol", "HTTP"),
 					resource.TestCheckResourceAttr(dataSourceName, "default_action.0.fixed_response.0.status_code", "404"),
-					acctest.MatchResourceAttrRegionalARN(dataSourceName, "arn", "vpc-lattice", regexp.MustCompile(`service/svc-.*/listener/listener-.+`)),
+					acctest.MatchResourceAttrRegionalARN(dataSourceName, "arn", "vpc-lattice", regexache.MustCompile(`service/svc-.*/listener/listener-.+`)),
 				),
 			},
 		},
@@ -66,7 +69,7 @@ func TestAccVPCLatticeListenerDataSource_tags(t *testing.T) {
 				Config: testAccListenerDataSourceConfig_one_tag(rName, tag_name, tag_value),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr(dataSourceName, "tags.tag0", "value0"),
-					acctest.MatchResourceAttrRegionalARN(dataSourceName, "arn", "vpc-lattice", regexp.MustCompile(`service/svc-.*/listener/listener-.+`)),
+					acctest.MatchResourceAttrRegionalARN(dataSourceName, "arn", "vpc-lattice", regexache.MustCompile(`service/svc-.*/listener/listener-.+`)),
 				),
 			},
 		},
@@ -102,7 +105,7 @@ func TestAccVPCLatticeListenerDataSource_forwardMultiTargetGroupHTTP(t *testing.
 					resource.TestCheckResourceAttr(dataSourceName, "default_action.0.forward.0.target_groups.0.weight", "80"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "default_action.0.forward.0.target_groups.1.target_group_identifier", targetGroup1ResourceName, "id"),
 					resource.TestCheckResourceAttr(dataSourceName, "default_action.0.forward.0.target_groups.1.weight", "20"),
-					acctest.MatchResourceAttrRegionalARN(dataSourceName, "arn", "vpc-lattice", regexp.MustCompile(`service/svc-.*/listener/listener-.+`)),
+					acctest.MatchResourceAttrRegionalARN(dataSourceName, "arn", "vpc-lattice", regexache.MustCompile(`service/svc-.*/listener/listener-.+`)),
 				),
 			},
 		},
diff --git a/internal/service/vpclattice/listener_rule.go b/internal/service/vpclattice/listener_rule.go
index 695c35634f0..e14b2f6b8e8 100644
--- a/internal/service/vpclattice/listener_rule.go
+++ b/internal/service/vpclattice/listener_rule.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package vpclattice
 
 import (
diff --git a/internal/service/vpclattice/listener_rule_test.go b/internal/service/vpclattice/listener_rule_test.go
index 2f0e75fcf18..d192996081d 100644
--- a/internal/service/vpclattice/listener_rule_test.go
+++ b/internal/service/vpclattice/listener_rule_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package vpclattice_test
 
 import (
 	"context"
 	"errors"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/vpclattice"
 	"github.com/aws/aws-sdk-go-v2/service/vpclattice/types"
@@ -41,7 +44,7 @@ func TestAccVPCLatticeListenerRule_basic(t *testing.T) {
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckListenerRuleExists(ctx, resourceName, &listenerRule),
 					resource.TestCheckResourceAttr(resourceName, "priority", "20"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "vpc-lattice", regexp.MustCompile(`service/svc-.*/listener/listener-.*/rule/rule.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "vpc-lattice", regexache.MustCompile(`service/svc-.*/listener/listener-.*/rule/rule.+`)),
 				),
 			},
 			{
diff --git a/internal/service/vpclattice/listener_test.go b/internal/service/vpclattice/listener_test.go
index 671233f5ab7..a0705d34b04 100644
--- a/internal/service/vpclattice/listener_test.go
+++ b/internal/service/vpclattice/listener_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package vpclattice_test
 
 import (
 	"context"
 	"errors"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/vpclattice"
 	"github.com/aws/aws-sdk-go-v2/service/vpclattice/types"
@@ -48,7 +51,7 @@ func TestAccVPCLatticeListener_defaultActionUpdate(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "protocol", "HTTPS"),
 					resource.TestCheckResourceAttrPair(resourceName, "service_identifier", serviceName, "id"),
 					resource.TestCheckResourceAttr(resourceName, "default_action.0.fixed_response.0.status_code", "404"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "vpc-lattice", regexp.MustCompile(`service/svc-.*/listener/listener-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "vpc-lattice", regexache.MustCompile(`service/svc-.*/listener/listener-.+`)),
 				),
 			},
 			{
@@ -61,7 +64,7 @@ func TestAccVPCLatticeListener_defaultActionUpdate(t *testing.T) {
 					resource.TestCheckResourceAttrPair(resourceName, "service_identifier", serviceName, "id"),
 					resource.TestCheckResourceAttrPair(resourceName, "default_action.0.forward.0.target_groups.0.target_group_identifier", targetGroupResourceName, "id"),
 					resource.TestCheckResourceAttr(resourceName, "default_action.0.forward.0.target_groups.0.weight", "100"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "vpc-lattice", regexp.MustCompile(`service/svc-.*/listener/listener-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "vpc-lattice", regexache.MustCompile(`service/svc-.*/listener/listener-.+`)),
 				),
 			},
 			{
@@ -100,7 +103,7 @@ func TestAccVPCLatticeListener_fixedResponseHTTP(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "protocol", "HTTP"),
 					resource.TestCheckResourceAttrPair(resourceName, "service_identifier", serviceName, "id"),
 					resource.TestCheckResourceAttr(resourceName, "default_action.0.fixed_response.0.status_code", "404"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "vpc-lattice", regexp.MustCompile(`service/svc-.*/listener/listener-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "vpc-lattice", regexache.MustCompile(`service/svc-.*/listener/listener-.+`)),
 				),
 			},
 			{
@@ -139,7 +142,7 @@ func TestAccVPCLatticeListener_fixedResponseHTTPS(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "protocol", "HTTPS"),
 					resource.TestCheckResourceAttrPair(resourceName, "service_identifier", serviceName, "id"),
 					resource.TestCheckResourceAttr(resourceName, "default_action.0.fixed_response.0.status_code", "404"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "vpc-lattice", regexp.MustCompile(`service/svc-.*/listener/listener-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "vpc-lattice", regexache.MustCompile(`service/svc-.*/listener/listener-.+`)),
 				),
 			},
 			{
@@ -180,7 +183,7 @@ func TestAccVPCLatticeListener_forwardHTTPTargetGroup(t *testing.T) {
 					resource.TestCheckResourceAttrPair(resourceName, "service_identifier", serviceName, "id"),
 					resource.TestCheckResourceAttrPair(resourceName, "default_action.0.forward.0.target_groups.0.target_group_identifier", targetGroupResourceName, "id"),
 					resource.TestCheckResourceAttr(resourceName, "default_action.0.forward.0.target_groups.0.weight", "100"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "vpc-lattice", regexp.MustCompile(`service\/svc-.*\/listener\/listener-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "vpc-lattice", regexache.MustCompile(`service\/svc-.*\/listener\/listener-.+`)),
 				),
 			},
 			{
@@ -221,7 +224,7 @@ func TestAccVPCLatticeListener_forwardHTTPTargetGroupCustomPort(t *testing.T) {
 					resource.TestCheckResourceAttrPair(resourceName, "service_identifier", serviceName, "id"),
 					resource.TestCheckResourceAttrPair(resourceName, "default_action.0.forward.0.target_groups.0.target_group_identifier", targetGroupResourceName, "id"),
 					resource.TestCheckResourceAttr(resourceName, "default_action.0.forward.0.target_groups.0.weight", "100"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "vpc-lattice", regexp.MustCompile(`service\/svc-.*\/listener\/listener-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "vpc-lattice", regexache.MustCompile(`service\/svc-.*\/listener\/listener-.+`)),
 				),
 			},
 			{
@@ -263,7 +266,7 @@ func TestAccVPCLatticeListener_forwardHTTPSTargetGroupARN(t *testing.T) {
 					resource.TestCheckResourceAttrPair(resourceName, "service_identifier", serviceName, "id"),
 					resource.TestCheckResourceAttrPair(resourceName, "default_action.0.forward.0.target_groups.0.target_group_identifier", targetGroupResourceName, "id"),
 					resource.TestCheckResourceAttr(resourceName, "default_action.0.forward.0.target_groups.0.weight", "100"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "vpc-lattice", regexp.MustCompile(`service\/svc-.*\/listener\/listener-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "vpc-lattice", regexache.MustCompile(`service\/svc-.*\/listener\/listener-.+`)),
 				),
 			},
 			{
@@ -305,7 +308,7 @@ func TestAccVPCLatticeListener_forwardHTTPSTargetGroupCustomPort(t *testing.T) {
 					resource.TestCheckResourceAttrPair(resourceName, "service_identifier", serviceName, "id"),
 					resource.TestCheckResourceAttrPair(resourceName, "default_action.0.forward.0.target_groups.0.target_group_identifier", targetGroupResourceName, "id"),
 					resource.TestCheckResourceAttr(resourceName, "default_action.0.forward.0.target_groups.0.weight", "100"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "vpc-lattice", regexp.MustCompile(`service\/svc-.*\/listener\/listener-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "vpc-lattice", regexache.MustCompile(`service\/svc-.*\/listener\/listener-.+`)),
 				),
 			},
 			{
@@ -350,7 +353,7 @@ func TestAccVPCLatticeListener_forwardHTTPMultipleTargetGroups(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "default_action.0.forward.0.target_groups.0.weight", "80"),
 					resource.TestCheckResourceAttrPair(resourceName, "default_action.0.forward.0.target_groups.1.target_group_identifier", targetGroup1ResourceName, "id"),
 					resource.TestCheckResourceAttr(resourceName, "default_action.0.forward.0.target_groups.1.weight", "20"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "vpc-lattice", regexp.MustCompile(`service\/svc-.*\/listener\/listener-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "vpc-lattice", regexache.MustCompile(`service\/svc-.*\/listener\/listener-.+`)),
 				),
 			},
 			{
@@ -417,7 +420,7 @@ func TestAccVPCLatticeListener_tags(t *testing.T) {
 					testAccCheckListenerExists(ctx, resourceName, &listener),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key0", "value0"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "vpc-lattice", regexp.MustCompile(`service\/svc-.*\/listener\/listener-.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "vpc-lattice", regexache.MustCompile(`service\/svc-.*\/listener\/listener-.+`)),
 				),
 			},
 			{
diff --git a/internal/service/vpclattice/resource_policy.go b/internal/service/vpclattice/resource_policy.go
index cee68e2d86c..822a420d8fd 100644
--- a/internal/service/vpclattice/resource_policy.go
+++ b/internal/service/vpclattice/resource_policy.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package vpclattice
 
 import (
diff --git a/internal/service/vpclattice/resource_policy_data_source.go b/internal/service/vpclattice/resource_policy_data_source.go
index 58094b2bd2f..2518e830226 100644
--- a/internal/service/vpclattice/resource_policy_data_source.go
+++ b/internal/service/vpclattice/resource_policy_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package vpclattice
 
 import (
diff --git a/internal/service/vpclattice/resource_policy_data_source_test.go b/internal/service/vpclattice/resource_policy_data_source_test.go
index a68a7500711..1c42332f51d 100644
--- a/internal/service/vpclattice/resource_policy_data_source_test.go
+++ b/internal/service/vpclattice/resource_policy_data_source_test.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package vpclattice_test
 
 import (
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
@@ -30,7 +33,7 @@ func TestAccVPCLatticeResourcePolicyDataSource_basic(t *testing.T) {
 			{
 				Config: testAccResourcePolicyDataSourceConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
-					resource.TestMatchResourceAttr(dataSourceName, "policy", regexp.MustCompile(`"vpc-lattice:CreateServiceNetworkVpcAssociation","vpc-lattice:CreateServiceNetworkServiceAssociation","vpc-lattice:GetServiceNetwork"`)),
+					resource.TestMatchResourceAttr(dataSourceName, "policy", regexache.MustCompile(`"vpc-lattice:CreateServiceNetworkVpcAssociation","vpc-lattice:CreateServiceNetworkServiceAssociation","vpc-lattice:GetServiceNetwork"`)),
 					resource.TestCheckResourceAttrPair(dataSourceName, "resource_arn", "aws_vpclattice_service_network.test", "arn"),
 				),
 			},
diff --git a/internal/service/vpclattice/resource_policy_test.go b/internal/service/vpclattice/resource_policy_test.go
index 4e0a0794a9f..0d74fb5647f 100644
--- a/internal/service/vpclattice/resource_policy_test.go
+++ b/internal/service/vpclattice/resource_policy_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package vpclattice_test
 
 import (
 	"context"
 	"errors"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/vpclattice"
 	"github.com/aws/aws-sdk-go-v2/service/vpclattice/types"
@@ -41,7 +44,7 @@ func TestAccVPCLatticeResourcePolicy_basic(t *testing.T) {
 				Config: testAccResourcePolicyConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckResourcePolicyExists(ctx, resourceName, &resourcepolicy),
-					resource.TestMatchResourceAttr(resourceName, "policy", regexp.MustCompile(`"vpc-lattice:CreateServiceNetworkVpcAssociation","vpc-lattice:CreateServiceNetworkServiceAssociation","vpc-lattice:GetServiceNetwork"`)),
+					resource.TestMatchResourceAttr(resourceName, "policy", regexache.MustCompile(`"vpc-lattice:CreateServiceNetworkVpcAssociation","vpc-lattice:CreateServiceNetworkServiceAssociation","vpc-lattice:GetServiceNetwork"`)),
 					resource.TestCheckResourceAttrPair(resourceName, "resource_arn", "aws_vpclattice_service_network.test", "arn"),
 				),
 			},
diff --git a/internal/service/vpclattice/service.go b/internal/service/vpclattice/service.go
index 7f96bacef5e..b1477e9a642 100644
--- a/internal/service/vpclattice/service.go
+++ b/internal/service/vpclattice/service.go
@@ -1,8 +1,10 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package vpclattice
 
 import (
 	"context"
-	"errors"
 	"log"
 	"time"
 
@@ -17,6 +19,8 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/create"
 	"github.com/hashicorp/terraform-provider-aws/internal/enum"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs"
+	tfslices "github.com/hashicorp/terraform-provider-aws/internal/slices"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
@@ -25,7 +29,7 @@ import (
 
 // @SDKResource("aws_vpclattice_service", name="Service")
 // @Tags(identifierAttribute="arn")
-func ResourceService() *schema.Resource {
+func resourceService() *schema.Resource {
 	return &schema.Resource{
 		CreateWithoutTimeout: resourceServiceCreate,
 		ReadWithoutTimeout:   resourceServiceRead,
@@ -124,14 +128,11 @@ func resourceServiceCreate(ctx context.Context, d *schema.ResourceData, meta int
 	}
 
 	out, err := conn.CreateService(ctx, in)
+
 	if err != nil {
 		return create.DiagError(names.VPCLattice, create.ErrActionCreating, ResNameService, d.Get("name").(string), err)
 	}
 
-	if out == nil {
-		return create.DiagError(names.VPCLattice, create.ErrActionCreating, ResNameService, d.Get("name").(string), errors.New("empty output"))
-	}
-
 	d.SetId(aws.ToString(out.Id))
 
 	if _, err := waitServiceCreated(ctx, conn, d.Id(), d.Timeout(schema.TimeoutCreate)); err != nil {
@@ -189,8 +190,8 @@ func resourceServiceUpdate(ctx context.Context, d *schema.ResourceData, meta int
 			in.CertificateArn = aws.String(d.Get("certificate_arn").(string))
 		}
 
-		log.Printf("[DEBUG] Updating VPCLattice Service (%s): %#v", d.Id(), in)
 		_, err := conn.UpdateService(ctx, in)
+
 		if err != nil {
 			return create.DiagError(names.VPCLattice, create.ErrActionUpdating, ResNameService, d.Id(), err)
 		}
@@ -207,12 +208,11 @@ func resourceServiceDelete(ctx context.Context, d *schema.ResourceData, meta int
 		ServiceIdentifier: aws.String(d.Id()),
 	})
 
-	if err != nil {
-		var nfe *types.ResourceNotFoundException
-		if errors.As(err, &nfe) {
-			return nil
-		}
+	if errs.IsA[*types.ResourceNotFoundException](err) {
+		return nil
+	}
 
+	if err != nil {
 		return create.DiagError(names.VPCLattice, create.ErrActionDeleting, ResNameService, d.Id(), err)
 	}
 
@@ -260,6 +260,7 @@ func waitServiceDeleted(ctx context.Context, conn *vpclattice.Client, id string,
 func statusService(ctx context.Context, conn *vpclattice.Client, id string) retry.StateRefreshFunc {
 	return func() (interface{}, string, error) {
 		out, err := findServiceByID(ctx, conn, id)
+
 		if tfresource.NotFound(err) {
 			return nil, "", nil
 		}
@@ -277,15 +278,15 @@ func findServiceByID(ctx context.Context, conn *vpclattice.Client, id string) (*
 		ServiceIdentifier: aws.String(id),
 	}
 	out, err := conn.GetService(ctx, in)
-	if err != nil {
-		var nfe *types.ResourceNotFoundException
-		if errors.As(err, &nfe) {
-			return nil, &retry.NotFoundError{
-				LastError:   err,
-				LastRequest: in,
-			}
+
+	if errs.IsA[*types.ResourceNotFoundException](err) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: in,
 		}
+	}
 
+	if err != nil {
 		return nil, err
 	}
 
@@ -296,6 +297,40 @@ func findServiceByID(ctx context.Context, conn *vpclattice.Client, id string) (*
 	return out, nil
 }
 
+func findService(ctx context.Context, conn *vpclattice.Client, filter tfslices.Predicate[types.ServiceSummary]) (*types.ServiceSummary, error) {
+	output, err := findServices(ctx, conn, filter)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return tfresource.AssertSingleValueResult(output)
+}
+
+func findServices(ctx context.Context, conn *vpclattice.Client, filter tfslices.Predicate[types.ServiceSummary]) ([]types.ServiceSummary, error) {
+	input := &vpclattice.ListServicesInput{}
+	var output []types.ServiceSummary
+	paginator := vpclattice.NewListServicesPaginator(conn, input, func(options *vpclattice.ListServicesPaginatorOptions) {
+		options.Limit = 100
+	})
+
+	for paginator.HasMorePages() {
+		page, err := paginator.NextPage(ctx)
+
+		if err != nil {
+			return nil, err
+		}
+
+		for _, v := range page.Items {
+			if filter(v) {
+				output = append(output, v)
+			}
+		}
+	}
+
+	return output, nil
+}
+
 func flattenDNSEntry(apiObject *types.DnsEntry) map[string]interface{} {
 	if apiObject == nil {
 		return nil
diff --git a/internal/service/vpclattice/service_data_source.go b/internal/service/vpclattice/service_data_source.go
index d191367a774..512df19eee5 100644
--- a/internal/service/vpclattice/service_data_source.go
+++ b/internal/service/vpclattice/service_data_source.go
@@ -1,19 +1,26 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package vpclattice
 
 import (
 	"context"
 
-	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/vpclattice"
+	"github.com/aws/aws-sdk-go-v2/service/vpclattice/types"
+	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
-	"github.com/hashicorp/terraform-provider-aws/internal/create"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
 // @SDKDataSource("aws_vpclattice_service")
-func DataSourceService() *schema.Resource {
+// @Tags
+func dataSourceService() *schema.Resource {
 	return &schema.Resource{
 		ReadWithoutTimeout: dataSourceServiceRead,
 
@@ -51,12 +58,16 @@ func DataSourceService() *schema.Resource {
 				},
 			},
 			"name": {
-				Type:     schema.TypeString,
-				Computed: true,
+				Type:         schema.TypeString,
+				Optional:     true,
+				Computed:     true,
+				ExactlyOneOf: []string{"name", "service_identifier"},
 			},
 			"service_identifier": {
-				Type:     schema.TypeString,
-				Required: true,
+				Type:         schema.TypeString,
+				Optional:     true,
+				Computed:     true,
+				ExactlyOneOf: []string{"name", "service_identifier"},
 			},
 			"status": {
 				Type:     schema.TypeString,
@@ -67,29 +78,42 @@ func DataSourceService() *schema.Resource {
 	}
 }
 
-const (
-	DSNameService = "Service Data Source"
-)
-
 func dataSourceServiceRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).VPCLatticeClient(ctx)
 
-	service_id := d.Get("service_identifier").(string)
-	out, err := findServiceByID(ctx, conn, service_id)
-	if err != nil {
-		return create.DiagError(names.VPCLattice, create.ErrActionReading, DSNameService, service_id, err)
-	}
+	var out *vpclattice.GetServiceOutput
+	if v, ok := d.GetOk("service_identifier"); ok {
+		serviceID := v.(string)
+		service, err := findServiceByID(ctx, conn, serviceID)
+
+		if err != nil {
+			return sdkdiag.AppendFromErr(diags, err)
+		}
+
+		out = service
+	} else if v, ok := d.GetOk("name"); ok {
+		filter := func(x types.ServiceSummary) bool {
+			return aws.ToString(x.Name) == v.(string)
+		}
+		output, err := findService(ctx, conn, filter)
+
+		if err != nil {
+			return sdkdiag.AppendFromErr(diags, err)
+		}
+
+		service, err := findServiceByID(ctx, conn, aws.ToString(output.Id))
 
-	//
-	// If you don't set the ID, the data source will not be stored in state. In
-	// fact, that's how a resource can be removed from state - clearing its ID.
-	//
-	// If this data source is a companion to a resource, often both will use the
-	// same ID. Otherwise, the ID will be a unique identifier such as an AWS
-	// identifier, ARN, or name.
-	d.SetId(aws.StringValue(out.Id))
+		if err != nil {
+			return sdkdiag.AppendFromErr(diags, err)
+		}
 
-	d.Set("arn", out.Arn)
+		out = service
+	}
+
+	d.SetId(aws.ToString(out.Id))
+	serviceARN := aws.ToString(out.Arn)
+	d.Set("arn", serviceARN)
 	d.Set("auth_type", out.AuthType)
 	d.Set("certificate_arn", out.CertificateArn)
 	d.Set("custom_domain_name", out.CustomDomainName)
@@ -101,7 +125,26 @@ func dataSourceServiceRead(ctx context.Context, d *schema.ResourceData, meta int
 		d.Set("dns_entry", nil)
 	}
 	d.Set("name", out.Name)
+	d.Set("service_identifier", out.Id)
 	d.Set("status", out.Status)
 
+	// https://docs.aws.amazon.com/vpc-lattice/latest/ug/sharing.html#sharing-perms
+	// Owners and consumers can list tags and can tag/untag resources in a service network that the account created.
+	// They can't list tags and tag/untag resources in a service network that aren't created by the account.
+	parsedARN, err := arn.Parse(serviceARN)
+	if err != nil {
+		return sdkdiag.AppendFromErr(diags, err)
+	}
+
+	if parsedARN.AccountID == meta.(*conns.AWSClient).AccountID {
+		tags, err := listTags(ctx, conn, serviceARN)
+
+		if err != nil {
+			return sdkdiag.AppendErrorf(diags, "listing tags for VPC Lattice Service (%s): %s", serviceARN, err)
+		}
+
+		setTagsOut(ctx, Tags(tags))
+	}
+
 	return nil
 }
diff --git a/internal/service/vpclattice/service_data_source_test.go b/internal/service/vpclattice/service_data_source_test.go
index 5963b1e3d00..b32c5e162e6 100644
--- a/internal/service/vpclattice/service_data_source_test.go
+++ b/internal/service/vpclattice/service_data_source_test.go
@@ -1,11 +1,12 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package vpclattice_test
 
 import (
 	"fmt"
-	"regexp"
 	"testing"
 
-	"github.com/aws/aws-sdk-go-v2/service/vpclattice"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
@@ -14,9 +15,8 @@ import (
 
 func TestAccVPCLatticeServiceDataSource_basic(t *testing.T) {
 	ctx := acctest.Context(t)
-
-	var service vpclattice.GetServiceOutput
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_vpclattice_service.test"
 	dataSourceName := "data.aws_vpclattice_service.test"
 
 	resource.ParallelTest(t, resource.TestCase{
@@ -27,15 +27,84 @@ func TestAccVPCLatticeServiceDataSource_basic(t *testing.T) {
 		},
 		ErrorCheck:               acctest.ErrorCheck(t, names.VPCLatticeEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckServiceDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccServiceDataSourceConfig_basic(rName),
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckServiceExists(ctx, dataSourceName, &service),
-					resource.TestCheckResourceAttr(dataSourceName, "name", rName),
-					resource.TestCheckResourceAttr(dataSourceName, "auth_type", "NONE"),
-					acctest.MatchResourceAttrRegionalARN(dataSourceName, "arn", "vpc-lattice", regexp.MustCompile(`service/.+$`)),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					resource.TestCheckResourceAttrPair(resourceName, "arn", dataSourceName, "arn"),
+					resource.TestCheckResourceAttrPair(resourceName, "auth_type", dataSourceName, "auth_type"),
+					resource.TestCheckResourceAttrPair(resourceName, "certificate_arn", dataSourceName, "certificate_arn"),
+					resource.TestCheckResourceAttrPair(resourceName, "custom_domain_name", dataSourceName, "custom_domain_name"),
+					resource.TestCheckResourceAttrPair(resourceName, "dns_entry.#", dataSourceName, "dns_entry.#"),
+					resource.TestCheckResourceAttrPair(resourceName, "name", dataSourceName, "name"),
+					resource.TestCheckResourceAttrPair(resourceName, "status", dataSourceName, "status"),
+					resource.TestCheckResourceAttrPair(resourceName, "tags.%", dataSourceName, "tags.%"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccVPCLatticeServiceDataSource_byName(t *testing.T) {
+	ctx := acctest.Context(t)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_vpclattice_service.test"
+	dataSourceName := "data.aws_vpclattice_service.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, names.VPCLatticeEndpointID)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, names.VPCLatticeEndpointID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccServiceDataSourceConfig_byName(rName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					resource.TestCheckResourceAttrPair(resourceName, "arn", dataSourceName, "arn"),
+					resource.TestCheckResourceAttrPair(resourceName, "auth_type", dataSourceName, "auth_type"),
+					resource.TestCheckResourceAttrPair(resourceName, "certificate_arn", dataSourceName, "certificate_arn"),
+					resource.TestCheckResourceAttrPair(resourceName, "custom_domain_name", dataSourceName, "custom_domain_name"),
+					resource.TestCheckResourceAttrPair(resourceName, "dns_entry.#", dataSourceName, "dns_entry.#"),
+					resource.TestCheckResourceAttrPair(resourceName, "name", dataSourceName, "name"),
+					resource.TestCheckResourceAttrSet(dataSourceName, "service_identifier"),
+					resource.TestCheckResourceAttrPair(resourceName, "status", dataSourceName, "status"),
+					resource.TestCheckResourceAttrPair(resourceName, "tags.%", dataSourceName, "tags.%"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccVPCLatticeServiceDataSource_shared(t *testing.T) {
+	ctx := acctest.Context(t)
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_vpclattice_service.test"
+	dataSourceName := "data.aws_vpclattice_service.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckAlternateAccount(t)
+			acctest.PreCheckPartitionHasService(t, names.VPCLatticeEndpointID)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, names.VPCLatticeEndpointID),
+		ProtoV5ProviderFactories: acctest.ProtoV5FactoriesAlternate(ctx, t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccServiceDataSourceConfig_shared(rName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					resource.TestCheckResourceAttrPair(resourceName, "arn", dataSourceName, "arn"),
+					resource.TestCheckResourceAttrPair(resourceName, "auth_type", dataSourceName, "auth_type"),
+					resource.TestCheckResourceAttrPair(resourceName, "certificate_arn", dataSourceName, "certificate_arn"),
+					resource.TestCheckResourceAttrPair(resourceName, "custom_domain_name", dataSourceName, "custom_domain_name"),
+					resource.TestCheckResourceAttrPair(resourceName, "dns_entry.#", dataSourceName, "dns_entry.#"),
+					resource.TestCheckResourceAttrPair(resourceName, "name", dataSourceName, "name"),
+					resource.TestCheckResourceAttrPair(resourceName, "status", dataSourceName, "status"),
+					resource.TestCheckNoResourceAttr(dataSourceName, "tags.%"),
 				),
 			},
 		},
@@ -46,6 +115,10 @@ func testAccServiceDataSourceConfig_basic(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_vpclattice_service" "test" {
   name = %[1]q
+
+  tags = {
+    Name = %[1]q
+  }
 }
 
 data "aws_vpclattice_service" "test" {
@@ -53,3 +126,60 @@ data "aws_vpclattice_service" "test" {
 }
 `, rName)
 }
+
+func testAccServiceDataSourceConfig_byName(rName string) string {
+	return fmt.Sprintf(`
+resource "aws_vpclattice_service" "test" {
+  name = %[1]q
+
+  tags = {
+    Name = %[1]q
+  }
+}
+
+data "aws_vpclattice_service" "test" {
+  name = aws_vpclattice_service.test.name
+}
+`, rName)
+}
+
+func testAccServiceDataSourceConfig_shared(rName string) string {
+	return acctest.ConfigCompose(acctest.ConfigAlternateAccountProvider(), fmt.Sprintf(`
+data "aws_caller_identity" "source" {}
+
+data "aws_caller_identity" "target" {
+  provider = "awsalternate"
+}
+
+resource "aws_vpclattice_service" "test" {
+  name = %[1]q
+
+  tags = {
+    Name = %[1]q
+  }
+}
+
+resource "aws_ram_resource_share" "test" {
+  name                      = %[1]q
+  allow_external_principals = false
+}
+
+resource "aws_ram_resource_association" "test" {
+  resource_arn       = aws_vpclattice_service.test.arn
+  resource_share_arn = aws_ram_resource_share.test.arn
+}
+
+resource "aws_ram_principal_association" "test" {
+  principal          = data.aws_caller_identity.target.arn
+  resource_share_arn = aws_ram_resource_share.test.arn
+}
+
+data "aws_vpclattice_service" "test" {
+  provider = "awsalternate"
+
+  service_identifier = aws_vpclattice_service.test.id
+
+  depends_on = [aws_ram_resource_association.test, aws_ram_principal_association.test]
+}
+`, rName))
+}
diff --git a/internal/service/vpclattice/service_network.go b/internal/service/vpclattice/service_network.go
index c5500d0fadb..2ec8e2b5311 100644
--- a/internal/service/vpclattice/service_network.go
+++ b/internal/service/vpclattice/service_network.go
@@ -1,9 +1,12 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package vpclattice
 
 import (
 	"context"
-	"errors"
 	"log"
+	"strings"
 
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/vpclattice"
@@ -16,15 +19,16 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/create"
 	"github.com/hashicorp/terraform-provider-aws/internal/enum"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
-// @SDKResource("aws_vpclattice_service_network", name="ServiceNetwork")
+// @SDKResource("aws_vpclattice_service_network", name="Service Network")
 // @Tags(identifierAttribute="arn")
-func ResourceServiceNetwork() *schema.Resource {
+func resourceServiceNetwork() *schema.Resource {
 	return &schema.Resource{
 		CreateWithoutTimeout: resourceServiceNetworkCreate,
 		ReadWithoutTimeout:   resourceServiceNetworkRead,
@@ -78,14 +82,11 @@ func resourceServiceNetworkCreate(ctx context.Context, d *schema.ResourceData, m
 	}
 
 	out, err := conn.CreateServiceNetwork(ctx, in)
+
 	if err != nil {
 		return create.DiagError(names.VPCLattice, create.ErrActionCreating, ResNameServiceNetwork, d.Get("name").(string), err)
 	}
 
-	if out == nil {
-		return create.DiagError(names.VPCLattice, create.ErrActionCreating, ResNameServiceNetwork, d.Get("name").(string), errors.New("empty output"))
-	}
-
 	d.SetId(aws.ToString(out.Id))
 
 	return resourceServiceNetworkRead(ctx, d, meta)
@@ -125,8 +126,8 @@ func resourceServiceNetworkUpdate(ctx context.Context, d *schema.ResourceData, m
 			in.AuthType = types.AuthType(d.Get("auth_type").(string))
 		}
 
-		log.Printf("[DEBUG] Updating VPCLattice ServiceNetwork (%s): %#v", d.Id(), in)
 		_, err := conn.UpdateServiceNetwork(ctx, in)
+
 		if err != nil {
 			return create.DiagError(names.VPCLattice, create.ErrActionUpdating, ResNameServiceNetwork, d.Id(), err)
 		}
@@ -143,12 +144,11 @@ func resourceServiceNetworkDelete(ctx context.Context, d *schema.ResourceData, m
 		ServiceNetworkIdentifier: aws.String(d.Id()),
 	})
 
-	if err != nil {
-		var nfe *types.ResourceNotFoundException
-		if errors.As(err, &nfe) {
-			return nil
-		}
+	if errs.IsA[*types.ResourceNotFoundException](err) {
+		return nil
+	}
 
+	if err != nil {
 		return create.DiagError(names.VPCLattice, create.ErrActionDeleting, ResNameServiceNetwork, d.Id(), err)
 	}
 
@@ -160,15 +160,15 @@ func findServiceNetworkByID(ctx context.Context, conn *vpclattice.Client, id str
 		ServiceNetworkIdentifier: aws.String(id),
 	}
 	out, err := conn.GetServiceNetwork(ctx, in)
-	if err != nil {
-		var nfe *types.ResourceNotFoundException
-		if errors.As(err, &nfe) {
-			return nil, &retry.NotFoundError{
-				LastError:   err,
-				LastRequest: in,
-			}
+
+	if errs.IsA[*types.ResourceNotFoundException](err) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: in,
 		}
+	}
 
+	if err != nil {
 		return nil, err
 	}
 
@@ -178,3 +178,16 @@ func findServiceNetworkByID(ctx context.Context, conn *vpclattice.Client, id str
 
 	return out, nil
 }
+
+// idFromIDOrARN return a resource ID from an ID or ARN.
+func idFromIDOrARN(idOrARN string) string {
+	// e.g. "sn-1234567890abcdefg" or
+	// "arn:aws:vpc-lattice:us-east-1:123456789012:servicenetwork/sn-1234567890abcdefg".
+	return idOrARN[strings.LastIndex(idOrARN, "/")+1:]
+}
+
+// suppressEquivalentIDOrARN provides custom difference suppression
+// for strings that represent equal resource IDs or ARNs.
+func suppressEquivalentIDOrARN(_, old, new string, _ *schema.ResourceData) bool {
+	return idFromIDOrARN(old) == idFromIDOrARN(new)
+}
diff --git a/internal/service/vpclattice/service_network_data_source.go b/internal/service/vpclattice/service_network_data_source.go
index 773b6b2f8b7..5fccd6c39a9 100644
--- a/internal/service/vpclattice/service_network_data_source.go
+++ b/internal/service/vpclattice/service_network_data_source.go
@@ -1,24 +1,24 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package vpclattice
 
 import (
 	"context"
-	"errors"
 
 	"github.com/aws/aws-sdk-go-v2/aws"
-	"github.com/aws/aws-sdk-go-v2/service/vpclattice"
-	"github.com/aws/aws-sdk-go-v2/service/vpclattice/types"
+	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
-	"github.com/hashicorp/terraform-provider-aws/internal/create"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
-	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
 // @SDKDataSource("aws_vpclattice_service_network")
-func DataSourceServiceNetwork() *schema.Resource {
+// @Tags
+func dataSourceServiceNetwork() *schema.Resource {
 	return &schema.Resource{
 		ReadWithoutTimeout: dataSourceServiceNetworkRead,
 
@@ -35,10 +35,6 @@ func DataSourceServiceNetwork() *schema.Resource {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
-			"id": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
 			"last_updated_at": {
 				Type:     schema.TypeString,
 				Computed: true,
@@ -59,72 +55,50 @@ func DataSourceServiceNetwork() *schema.Resource {
 				Type:     schema.TypeString,
 				Required: true,
 			},
-			"tags": tftags.TagsSchemaComputed(), // TIP: Many, but not all, data sources have `tags` attributes.
+			names.AttrTags: tftags.TagsSchemaComputed(),
 		},
 	}
 }
 
-const (
-	DSNameServiceNetwork = "Service Network Data Source"
-)
-
 func dataSourceServiceNetworkRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
 	conn := meta.(*conns.AWSClient).VPCLatticeClient(ctx)
 
 	serviceNetworkID := d.Get("service_network_identifier").(string)
+	out, err := findServiceNetworkByID(ctx, conn, serviceNetworkID)
 
-	out, err := findServiceNetworkById(ctx, conn, serviceNetworkID)
 	if err != nil {
-		return create.DiagError(names.VPCLattice, create.ErrActionReading, DSNameServiceNetwork, serviceNetworkID, err)
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
 	d.SetId(aws.ToString(out.Id))
-	d.Set("arn", out.Arn)
+	serviceNetworkARN := aws.ToString(out.Arn)
+	d.Set("arn", serviceNetworkARN)
 	d.Set("auth_type", out.AuthType)
 	d.Set("created_at", aws.ToTime(out.CreatedAt).String())
-	d.Set("id", out.Id)
 	d.Set("last_updated_at", aws.ToTime(out.LastUpdatedAt).String())
 	d.Set("name", out.Name)
 	d.Set("number_of_associated_services", out.NumberOfAssociatedServices)
 	d.Set("number_of_associated_vpcs", out.NumberOfAssociatedVPCs)
+	d.Set("service_network_identifier", out.Id)
 
-	ignoreTagsConfig := meta.(*conns.AWSClient).IgnoreTagsConfig
-	tags, err := listTags(ctx, conn, aws.ToString(out.Arn))
-
+	// https://docs.aws.amazon.com/vpc-lattice/latest/ug/sharing.html#sharing-perms
+	// Owners and consumers can list tags and can tag/untag resources in a service network that the account created.
+	// They can't list tags and tag/untag resources in a service network that aren't created by the account.
+	parsedARN, err := arn.Parse(serviceNetworkARN)
 	if err != nil {
-		return create.DiagError(names.VPCLattice, create.ErrActionReading, DSNameServiceNetwork, serviceNetworkID, err)
-	}
-
-	//lintignore:AWSR002
-	if err := d.Set("tags", tags.IgnoreAWS().IgnoreConfig(ignoreTagsConfig).Map()); err != nil {
-		return create.DiagError(names.VPCLattice, create.ErrActionSetting, DSNameServiceNetwork, d.Id(), err)
-	}
-
-	return nil
-}
-
-func findServiceNetworkById(ctx context.Context, conn *vpclattice.Client, service_network_identifier string) (*vpclattice.GetServiceNetworkOutput, error) {
-	in := &vpclattice.GetServiceNetworkInput{
-		ServiceNetworkIdentifier: aws.String(service_network_identifier),
+		return sdkdiag.AppendFromErr(diags, err)
 	}
 
-	out, err := conn.GetServiceNetwork(ctx, in)
+	if parsedARN.AccountID == meta.(*conns.AWSClient).AccountID {
+		tags, err := listTags(ctx, conn, serviceNetworkARN)
 
-	if err != nil {
-		var nfe *types.ResourceNotFoundException
-		if errors.As(err, &nfe) {
-			return nil, &retry.NotFoundError{
-				LastError:   err,
-				LastRequest: in,
-			}
+		if err != nil {
+			return sdkdiag.AppendErrorf(diags, "listing tags for VPC Lattice Service Network (%s): %s", serviceNetworkARN, err)
 		}
 
-		return nil, err
-	}
-
-	if out == nil || out.Id == nil {
-		return nil, tfresource.NewEmptyResultError(in)
+		setTagsOut(ctx, Tags(tags))
 	}
 
-	return out, nil
+	return diags
 }
diff --git a/internal/service/vpclattice/service_network_data_source_test.go b/internal/service/vpclattice/service_network_data_source_test.go
index ffbf96df29b..ef9be3c580d 100644
--- a/internal/service/vpclattice/service_network_data_source_test.go
+++ b/internal/service/vpclattice/service_network_data_source_test.go
@@ -1,8 +1,10 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package vpclattice_test
 
 import (
 	"fmt"
-	"regexp"
 	"testing"
 
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -13,13 +15,8 @@ import (
 
 func TestAccVPCLatticeServiceNetworkDataSource_basic(t *testing.T) {
 	ctx := acctest.Context(t)
-	// TIP: This is a long-running test guard for tests that run longer than
-	// 300s (5 min) generally.
-	if testing.Short() {
-		t.Skip("skipping long-running test in short mode")
-	}
-
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_vpclattice_service_network.test"
 	dataSourceName := "data.aws_vpclattice_service_network.test"
 
 	resource.ParallelTest(t, resource.TestCase{
@@ -30,48 +27,51 @@ func TestAccVPCLatticeServiceNetworkDataSource_basic(t *testing.T) {
 		},
 		ErrorCheck:               acctest.ErrorCheck(t, names.VPCLatticeEndpointID),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckServiceNetworkDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccServiceNetworkDataSourceConfig_basic(rName),
-				Check: resource.ComposeTestCheckFunc(
-					resource.TestCheckResourceAttr(dataSourceName, "name", rName),
-					acctest.MatchResourceAttrRegionalARN(dataSourceName, "arn", "vpc-lattice", regexp.MustCompile(`servicenetwork/sn-.+`)),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					resource.TestCheckResourceAttrPair(resourceName, "arn", dataSourceName, "arn"),
+					resource.TestCheckResourceAttrPair(resourceName, "auth_type", dataSourceName, "auth_type"),
+					resource.TestCheckResourceAttrSet(dataSourceName, "created_at"),
+					resource.TestCheckResourceAttrSet(dataSourceName, "last_updated_at"),
+					resource.TestCheckResourceAttrPair(resourceName, "name", dataSourceName, "name"),
+					resource.TestCheckResourceAttr(dataSourceName, "number_of_associated_services", "0"),
+					resource.TestCheckResourceAttr(dataSourceName, "number_of_associated_vpcs", "0"),
+					resource.TestCheckResourceAttrPair(resourceName, "tags.%", dataSourceName, "tags.%"),
 				),
 			},
 		},
 	})
 }
 
-func TestAccVPCLatticeServiceNetworkDataSource_tags(t *testing.T) {
+func TestAccVPCLatticeServiceNetworkDataSource_shared(t *testing.T) {
 	ctx := acctest.Context(t)
-	// TIP: This is a long-running test guard for tests that run longer than
-	// 300s (5 min) generally.
-	if testing.Short() {
-		t.Skip("skipping long-running test in short mode")
-	}
-
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
-	tagKey := "tag1"
-	tagValue := "value1"
-	dataSourceName := "data.aws_vpclattice_service_network.test_tags"
+	resourceName := "aws_vpclattice_service_network.test"
+	dataSourceName := "data.aws_vpclattice_service_network.test"
 
 	resource.ParallelTest(t, resource.TestCase{
 		PreCheck: func() {
 			acctest.PreCheck(ctx, t)
+			acctest.PreCheckAlternateAccount(t)
 			acctest.PreCheckPartitionHasService(t, names.VPCLatticeEndpointID)
 			testAccPreCheck(ctx, t)
 		},
 		ErrorCheck:               acctest.ErrorCheck(t, names.VPCLatticeEndpointID),
-		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
-		CheckDestroy:             testAccCheckServiceNetworkDestroy(ctx),
+		ProtoV5ProviderFactories: acctest.ProtoV5FactoriesAlternate(ctx, t),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccServiceNetworkDataSourceConfig_tags(rName, tagKey, tagValue),
-				Check: resource.ComposeTestCheckFunc(
-					resource.TestCheckResourceAttr(dataSourceName, "name", rName),
-					resource.TestCheckResourceAttr(dataSourceName, "tags.tag1", "value1"),
-					acctest.MatchResourceAttrRegionalARN(dataSourceName, "arn", "vpc-lattice", regexp.MustCompile(`servicenetwork/sn-.+`)),
+				Config: testAccServiceNetworkDataSourceConfig_shared(rName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					resource.TestCheckResourceAttrPair(resourceName, "arn", dataSourceName, "arn"),
+					resource.TestCheckResourceAttrPair(resourceName, "auth_type", dataSourceName, "auth_type"),
+					resource.TestCheckResourceAttrSet(dataSourceName, "created_at"),
+					resource.TestCheckResourceAttrSet(dataSourceName, "last_updated_at"),
+					resource.TestCheckResourceAttrPair(resourceName, "name", dataSourceName, "name"),
+					resource.TestCheckResourceAttr(dataSourceName, "number_of_associated_services", "0"),
+					resource.TestCheckResourceAttr(dataSourceName, "number_of_associated_vpcs", "0"),
+					resource.TestCheckNoResourceAttr(dataSourceName, "tags.%"),
 				),
 			},
 		},
@@ -82,6 +82,10 @@ func testAccServiceNetworkDataSourceConfig_basic(rName string) string {
 	return fmt.Sprintf(`  
 resource "aws_vpclattice_service_network" "test" {
   name = %[1]q
+
+  tags = {
+    Name = %[1]q
+  }
 }
 
 data "aws_vpclattice_service_network" "test" {
@@ -90,18 +94,43 @@ data "aws_vpclattice_service_network" "test" {
 `, rName)
 }
 
-func testAccServiceNetworkDataSourceConfig_tags(rName string, tagKey string, tagValue string) string {
-	return fmt.Sprintf(`
-resource "aws_vpclattice_service_network" "test_tags" {
+func testAccServiceNetworkDataSourceConfig_shared(rName string) string {
+	return acctest.ConfigCompose(acctest.ConfigAlternateAccountProvider(), fmt.Sprintf(`
+data "aws_caller_identity" "source" {}
+
+data "aws_caller_identity" "target" {
+  provider = "awsalternate"
+}
+
+resource "aws_vpclattice_service_network" "test" {
   name = %[1]q
 
   tags = {
-    %[2]q = %[3]q
+    Name = %[1]q
   }
 }
 
-data "aws_vpclattice_service_network" "test_tags" {
-  service_network_identifier = aws_vpclattice_service_network.test_tags.id
+resource "aws_ram_resource_share" "test" {
+  name                      = %[1]q
+  allow_external_principals = false
+}
+
+resource "aws_ram_resource_association" "test" {
+  resource_arn       = aws_vpclattice_service_network.test.arn
+  resource_share_arn = aws_ram_resource_share.test.arn
+}
+
+resource "aws_ram_principal_association" "test" {
+  principal          = data.aws_caller_identity.target.arn
+  resource_share_arn = aws_ram_resource_share.test.arn
+}
+
+data "aws_vpclattice_service_network" "test" {
+  provider = "awsalternate"
+
+  service_network_identifier = aws_vpclattice_service_network.test.id
+
+  depends_on = [aws_ram_resource_association.test, aws_ram_principal_association.test]
 }
-`, rName, tagKey, tagValue)
+`, rName))
 }
diff --git a/internal/service/vpclattice/service_network_service_association.go b/internal/service/vpclattice/service_network_service_association.go
index 9dffc81d09b..4e07c7568f2 100644
--- a/internal/service/vpclattice/service_network_service_association.go
+++ b/internal/service/vpclattice/service_network_service_association.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package vpclattice
 
 import (
@@ -16,6 +19,7 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/create"
 	"github.com/hashicorp/terraform-provider-aws/internal/enum"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
@@ -24,7 +28,7 @@ import (
 
 // @SDKResource("aws_vpclattice_service_network_service_association", name="Service Network Service Association")
 // @Tags(identifierAttribute="arn")
-func ResourceServiceNetworkServiceAssociation() *schema.Resource {
+func resourceServiceNetworkServiceAssociation() *schema.Resource {
 	return &schema.Resource{
 		CreateWithoutTimeout: resourceServiceNetworkServiceAssociationCreate,
 		ReadWithoutTimeout:   resourceServiceNetworkServiceAssociationRead,
@@ -71,14 +75,16 @@ func ResourceServiceNetworkServiceAssociation() *schema.Resource {
 				},
 			},
 			"service_identifier": {
-				Type:     schema.TypeString,
-				Required: true,
-				ForceNew: true,
+				Type:             schema.TypeString,
+				Required:         true,
+				ForceNew:         true,
+				DiffSuppressFunc: suppressEquivalentIDOrARN,
 			},
 			"service_network_identifier": {
-				Type:     schema.TypeString,
-				Required: true,
-				ForceNew: true,
+				Type:             schema.TypeString,
+				Required:         true,
+				ForceNew:         true,
+				DiffSuppressFunc: suppressEquivalentIDOrARN,
 			},
 			"status": {
 				Type:     schema.TypeString,
@@ -170,12 +176,11 @@ func resourceServiceNetworkServiceAssociationDelete(ctx context.Context, d *sche
 		ServiceNetworkServiceAssociationIdentifier: aws.String(d.Id()),
 	})
 
-	if err != nil {
-		var nfe *types.ResourceNotFoundException
-		if errors.As(err, &nfe) {
-			return nil
-		}
+	if errs.IsA[*types.ResourceNotFoundException](err) {
+		return nil
+	}
 
+	if err != nil {
 		return create.DiagError(names.VPCLattice, create.ErrActionDeleting, ResNameServiceNetworkAssociation, d.Id(), err)
 	}
 
@@ -191,15 +196,15 @@ func findServiceNetworkServiceAssociationByID(ctx context.Context, conn *vpclatt
 		ServiceNetworkServiceAssociationIdentifier: aws.String(id),
 	}
 	out, err := conn.GetServiceNetworkServiceAssociation(ctx, in)
-	if err != nil {
-		var nfe *types.ResourceNotFoundException
-		if errors.As(err, &nfe) {
-			return nil, &retry.NotFoundError{
-				LastError:   err,
-				LastRequest: in,
-			}
+
+	if errs.IsA[*types.ResourceNotFoundException](err) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: in,
 		}
+	}
 
+	if err != nil {
 		return nil, err
 	}
 
diff --git a/internal/service/vpclattice/service_network_service_association_test.go b/internal/service/vpclattice/service_network_service_association_test.go
index 48ff0d7cbfa..6cc8da82487 100644
--- a/internal/service/vpclattice/service_network_service_association_test.go
+++ b/internal/service/vpclattice/service_network_service_association_test.go
@@ -1,15 +1,16 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package vpclattice_test
 
 import (
 	"context"
 	"errors"
 	"fmt"
-	"regexp"
 	"testing"
 
-	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/service/vpclattice"
-	"github.com/aws/aws-sdk-go-v2/service/vpclattice/types"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
@@ -17,6 +18,7 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/create"
 	tfvpclattice "github.com/hashicorp/terraform-provider-aws/internal/service/vpclattice"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
@@ -41,7 +43,40 @@ func TestAccVPCLatticeServiceNetworkServiceAssociation_basic(t *testing.T) {
 				Config: testAccServiceNetworkServiceAssociationConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckServiceNetworkServiceAssociationExists(ctx, resourceName, &servicenetworkasc),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "vpc-lattice", regexp.MustCompile("servicenetworkserviceassociation/.+$")),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "vpc-lattice", regexache.MustCompile("servicenetworkserviceassociation/.+$")),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
+func TestAccVPCLatticeServiceNetworkServiceAssociation_arn(t *testing.T) {
+	ctx := acctest.Context(t)
+
+	var servicenetworkasc vpclattice.GetServiceNetworkServiceAssociationOutput
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_vpclattice_service_network_service_association.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, names.VPCLatticeEndpointID)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, names.VPCLatticeEndpointID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckServiceNetworkServiceAssociationDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccServiceNetworkServiceAssociationConfig_arn(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckServiceNetworkServiceAssociationExists(ctx, resourceName, &servicenetworkasc),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "vpc-lattice", regexache.MustCompile("servicenetworkserviceassociation/.+$")),
 				),
 			},
 			{
@@ -141,18 +176,17 @@ func testAccCheckServiceNetworkServiceAssociationDestroy(ctx context.Context) re
 				continue
 			}
 
-			_, err := conn.GetServiceNetworkServiceAssociation(ctx, &vpclattice.GetServiceNetworkServiceAssociationInput{
-				ServiceNetworkServiceAssociationIdentifier: aws.String(rs.Primary.ID),
-			})
+			_, err := tfvpclattice.FindServiceNetworkServiceAssociationByID(ctx, conn, rs.Primary.ID)
+
+			if tfresource.NotFound(err) {
+				continue
+			}
+
 			if err != nil {
-				var nfe *types.ResourceNotFoundException
-				if errors.As(err, &nfe) {
-					return nil
-				}
 				return err
 			}
 
-			return create.Error(names.VPCLattice, create.ErrActionCheckingDestroyed, tfvpclattice.ResNameService, rs.Primary.ID, errors.New("not destroyed"))
+			return fmt.Errorf("VPC Lattice Service Network Service Association %s still exists", rs.Primary.ID)
 		}
 
 		return nil
@@ -171,12 +205,10 @@ func testAccCheckServiceNetworkServiceAssociationExists(ctx context.Context, nam
 		}
 
 		conn := acctest.Provider.Meta().(*conns.AWSClient).VPCLatticeClient(ctx)
-		resp, err := conn.GetServiceNetworkServiceAssociation(ctx, &vpclattice.GetServiceNetworkServiceAssociationInput{
-			ServiceNetworkServiceAssociationIdentifier: aws.String(rs.Primary.ID),
-		})
+		resp, err := tfvpclattice.FindServiceNetworkServiceAssociationByID(ctx, conn, rs.Primary.ID)
 
 		if err != nil {
-			return create.Error(names.VPCLattice, create.ErrActionCheckingExistence, tfvpclattice.ResNameService, rs.Primary.ID, err)
+			return err
 		}
 
 		*service = *resp
@@ -185,7 +217,7 @@ func testAccCheckServiceNetworkServiceAssociationExists(ctx context.Context, nam
 	}
 }
 
-func testAccServiceNetworkServiceAssociationConfig_basic(rName string) string {
+func testAccServiceNetworkServiceAssociationConfig_base(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_vpclattice_service" "test" {
   name = %[1]q
@@ -194,53 +226,50 @@ resource "aws_vpclattice_service" "test" {
 resource "aws_vpclattice_service_network" "test" {
   name = %[1]q
 }
+`, rName)
+}
 
+func testAccServiceNetworkServiceAssociationConfig_basic(rName string) string {
+	return acctest.ConfigCompose(testAccServiceNetworkServiceAssociationConfig_base(rName), `
 resource "aws_vpclattice_service_network_service_association" "test" {
   service_identifier         = aws_vpclattice_service.test.id
   service_network_identifier = aws_vpclattice_service_network.test.id
 }
-`, rName)
+`)
 }
 
-func testAccServiceNetworkServiceAssociationConfig_tags1(rName, tagKey1, tagValue1 string) string {
-	return fmt.Sprintf(`
-resource "aws_vpclattice_service" "test" {
-  name = %[1]q
+func testAccServiceNetworkServiceAssociationConfig_arn(rName string) string {
+	return acctest.ConfigCompose(testAccServiceNetworkServiceAssociationConfig_base(rName), `
+resource "aws_vpclattice_service_network_service_association" "test" {
+  service_identifier         = aws_vpclattice_service.test.arn
+  service_network_identifier = aws_vpclattice_service_network.test.arn
 }
-
-resource "aws_vpclattice_service_network" "test" {
-  name = %[1]q
+`)
 }
 
+func testAccServiceNetworkServiceAssociationConfig_tags1(rName, tagKey1, tagValue1 string) string {
+	return acctest.ConfigCompose(testAccServiceNetworkServiceAssociationConfig_base(rName), fmt.Sprintf(`
 resource "aws_vpclattice_service_network_service_association" "test" {
   service_identifier         = aws_vpclattice_service.test.id
   service_network_identifier = aws_vpclattice_service_network.test.id
 
   tags = {
-    %[2]q = %[3]q
+    %[1]q = %[2]q
   }
 }
-`, rName, tagKey1, tagValue1)
+`, tagKey1, tagValue1))
 }
 
 func testAccServiceNetworkServiceAssociationConfig_tags2(rName, tagKey1, tagValue1, tagKey2, tagValue2 string) string {
-	return fmt.Sprintf(`
-resource "aws_vpclattice_service" "test" {
-  name = %[1]q
-}
-
-resource "aws_vpclattice_service_network" "test" {
-  name = %[1]q
-}
-
+	return acctest.ConfigCompose(testAccServiceNetworkServiceAssociationConfig_base(rName), fmt.Sprintf(`
 resource "aws_vpclattice_service_network_service_association" "test" {
   service_identifier         = aws_vpclattice_service.test.id
   service_network_identifier = aws_vpclattice_service_network.test.id
 
   tags = {
-    %[2]q = %[3]q
-    %[4]q = %[5]q
+    %[1]q = %[2]q
+    %[3]q = %[4]q
   }
 }
-`, rName, tagKey1, tagValue1, tagKey2, tagValue2)
+`, tagKey1, tagValue1, tagKey2, tagValue2))
 }
diff --git a/internal/service/vpclattice/service_network_test.go b/internal/service/vpclattice/service_network_test.go
index 4beb6dd80a3..fa5db43ba29 100644
--- a/internal/service/vpclattice/service_network_test.go
+++ b/internal/service/vpclattice/service_network_test.go
@@ -1,15 +1,16 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package vpclattice_test
 
 import (
 	"context"
 	"errors"
 	"fmt"
-	"regexp"
 	"testing"
 
-	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/service/vpclattice"
-	"github.com/aws/aws-sdk-go-v2/service/vpclattice/types"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
@@ -17,12 +18,80 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/create"
 	tfvpclattice "github.com/hashicorp/terraform-provider-aws/internal/service/vpclattice"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
+func TestIDFromIDOrARN(t *testing.T) {
+	t.Parallel()
+
+	testCases := []struct {
+		idOrARN string
+		want    string
+	}{
+		{
+			idOrARN: "",
+			want:    "",
+		},
+		{
+			idOrARN: "sn-1234567890abcdefg",
+			want:    "sn-1234567890abcdefg",
+		},
+		{
+			idOrARN: "arn:aws:vpc-lattice:us-east-1:123456789012:servicenetwork/sn-1234567890abcdefg", //lintignore:AWSAT003,AWSAT005
+			want:    "sn-1234567890abcdefg",
+		},
+	}
+	for _, testCase := range testCases {
+		if got, want := tfvpclattice.IDFromIDOrARN(testCase.idOrARN), testCase.want; got != want {
+			t.Errorf("IDFromIDOrARN(%q) = %v, want %v", testCase.idOrARN, got, want)
+		}
+	}
+}
+
+func TestSuppressEquivalentIDOrARN(t *testing.T) {
+	t.Parallel()
+
+	testCases := []struct {
+		old  string
+		new  string
+		want bool
+	}{
+		{
+			old:  "sn-1234567890abcdefg",
+			new:  "sn-1234567890abcdefg",
+			want: true,
+		},
+		{
+			old:  "sn-1234567890abcdefg",
+			new:  "sn-1234567890abcdefh",
+			want: false,
+		},
+		{
+			old:  "arn:aws:vpc-lattice:us-east-1:123456789012:servicenetwork/sn-1234567890abcdefg", //lintignore:AWSAT003,AWSAT005
+			new:  "sn-1234567890abcdefg",
+			want: true,
+		},
+		{
+			old:  "sn-1234567890abcdefg",
+			new:  "arn:aws:vpc-lattice:us-east-1:123456789012:servicenetwork/sn-1234567890abcdefg", //lintignore:AWSAT003,AWSAT005
+			want: true,
+		},
+		{
+			old:  "arn:aws:vpc-lattice:us-east-1:123456789012:servicenetwork/sn-1234567890abcdefg", //lintignore:AWSAT003,AWSAT005
+			new:  "sn-1234567890abcdefh",
+			want: false,
+		},
+	}
+	for _, testCase := range testCases {
+		if got, want := tfvpclattice.SuppressEquivalentIDOrARN("test_property", testCase.old, testCase.new, nil), testCase.want; got != want {
+			t.Errorf("SuppressEquivalentIDOrARN(%q, %q) = %v, want %v", testCase.old, testCase.new, got, want)
+		}
+	}
+}
+
 func TestAccVPCLatticeServiceNetwork_basic(t *testing.T) {
 	ctx := acctest.Context(t)
-
 	var servicenetwork vpclattice.GetServiceNetworkOutput
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_vpclattice_service_network.test"
@@ -42,7 +111,7 @@ func TestAccVPCLatticeServiceNetwork_basic(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckServiceNetworkExists(ctx, resourceName, &servicenetwork),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "vpc-lattice", regexp.MustCompile("servicenetwork/.+$")),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "vpc-lattice", regexache.MustCompile("servicenetwork/.+$")),
 				),
 			},
 			{
@@ -56,7 +125,6 @@ func TestAccVPCLatticeServiceNetwork_basic(t *testing.T) {
 
 func TestAccVPCLatticeServiceNetwork_disappears(t *testing.T) {
 	ctx := acctest.Context(t)
-
 	var servicenetwork vpclattice.GetServiceNetworkOutput
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_vpclattice_service_network.test"
@@ -85,7 +153,6 @@ func TestAccVPCLatticeServiceNetwork_disappears(t *testing.T) {
 
 func TestAccVPCLatticeServiceNetwork_full(t *testing.T) {
 	ctx := acctest.Context(t)
-
 	var servicenetwork vpclattice.GetServiceNetworkOutput
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_vpclattice_service_network.test"
@@ -106,7 +173,7 @@ func TestAccVPCLatticeServiceNetwork_full(t *testing.T) {
 					testAccCheckServiceNetworkExists(ctx, resourceName, &servicenetwork),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "auth_type", "AWS_IAM"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "vpc-lattice", regexp.MustCompile("servicenetwork/.+$")),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "vpc-lattice", regexache.MustCompile("servicenetwork/.+$")),
 				),
 			},
 			{
@@ -173,18 +240,17 @@ func testAccCheckServiceNetworkDestroy(ctx context.Context) resource.TestCheckFu
 				continue
 			}
 
-			_, err := conn.GetServiceNetwork(ctx, &vpclattice.GetServiceNetworkInput{
-				ServiceNetworkIdentifier: aws.String(rs.Primary.ID),
-			})
+			_, err := tfvpclattice.FindServiceNetworkByID(ctx, conn, rs.Primary.ID)
+
+			if tfresource.NotFound(err) {
+				continue
+			}
+
 			if err != nil {
-				var nfe *types.ResourceNotFoundException
-				if errors.As(err, &nfe) {
-					return nil
-				}
 				return err
 			}
 
-			return create.Error(names.VPCLattice, create.ErrActionCheckingDestroyed, tfvpclattice.ResNameServiceNetwork, rs.Primary.ID, errors.New("not destroyed"))
+			return fmt.Errorf("VPC Lattice Service Network %s still exists", rs.Primary.ID)
 		}
 
 		return nil
@@ -203,12 +269,10 @@ func testAccCheckServiceNetworkExists(ctx context.Context, name string, servicen
 		}
 
 		conn := acctest.Provider.Meta().(*conns.AWSClient).VPCLatticeClient(ctx)
-		resp, err := conn.GetServiceNetwork(ctx, &vpclattice.GetServiceNetworkInput{
-			ServiceNetworkIdentifier: aws.String(rs.Primary.ID),
-		})
+		resp, err := tfvpclattice.FindServiceNetworkByID(ctx, conn, rs.Primary.ID)
 
 		if err != nil {
-			return create.Error(names.VPCLattice, create.ErrActionCheckingExistence, tfvpclattice.ResNameServiceNetwork, rs.Primary.ID, err)
+			return err
 		}
 
 		*servicenetwork = *resp
diff --git a/internal/service/vpclattice/service_network_vpc_association.go b/internal/service/vpclattice/service_network_vpc_association.go
index 42d6e0e26ec..6337a621865 100644
--- a/internal/service/vpclattice/service_network_vpc_association.go
+++ b/internal/service/vpclattice/service_network_vpc_association.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package vpclattice
 
 import (
@@ -16,6 +19,7 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/create"
 	"github.com/hashicorp/terraform-provider-aws/internal/enum"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs"
 	"github.com/hashicorp/terraform-provider-aws/internal/flex"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
@@ -25,7 +29,7 @@ import (
 
 // @SDKResource("aws_vpclattice_service_network_vpc_association", name="Service Network VPC Association")
 // @Tags(identifierAttribute="arn")
-func ResourceServiceNetworkVPCAssociation() *schema.Resource {
+func resourceServiceNetworkVPCAssociation() *schema.Resource {
 	return &schema.Resource{
 		CreateWithoutTimeout: resourceServiceNetworkVPCAssociationCreate,
 		ReadWithoutTimeout:   resourceServiceNetworkVPCAssociationRead,
@@ -58,9 +62,10 @@ func ResourceServiceNetworkVPCAssociation() *schema.Resource {
 				Elem:     &schema.Schema{Type: schema.TypeString},
 			},
 			"service_network_identifier": {
-				Type:     schema.TypeString,
-				Required: true,
-				ForceNew: true,
+				Type:             schema.TypeString,
+				Required:         true,
+				ForceNew:         true,
+				DiffSuppressFunc: suppressEquivalentIDOrARN,
 			},
 			"status": {
 				Type:     schema.TypeString,
@@ -170,12 +175,11 @@ func resourceServiceNetworkVPCAssociationDelete(ctx context.Context, d *schema.R
 		ServiceNetworkVpcAssociationIdentifier: aws.String(d.Id()),
 	})
 
-	if err != nil {
-		var nfe *types.ResourceNotFoundException
-		if errors.As(err, &nfe) {
-			return nil
-		}
+	if errs.IsA[*types.ResourceNotFoundException](err) {
+		return nil
+	}
 
+	if err != nil {
 		return create.DiagError(names.VPCLattice, create.ErrActionDeleting, ResNameServiceNetworkVPCAssociation, d.Id(), err)
 	}
 
@@ -191,15 +195,15 @@ func findServiceNetworkVPCAssociationByID(ctx context.Context, conn *vpclattice.
 		ServiceNetworkVpcAssociationIdentifier: aws.String(id),
 	}
 	out, err := conn.GetServiceNetworkVpcAssociation(ctx, in)
-	if err != nil {
-		var nfe *types.ResourceNotFoundException
-		if errors.As(err, &nfe) {
-			return nil, &retry.NotFoundError{
-				LastError:   err,
-				LastRequest: in,
-			}
+
+	if errs.IsA[*types.ResourceNotFoundException](err) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: in,
 		}
+	}
 
+	if err != nil {
 		return nil, err
 	}
 
diff --git a/internal/service/vpclattice/service_network_vpc_association_test.go b/internal/service/vpclattice/service_network_vpc_association_test.go
index 3c9c22b9b34..3ef2106083b 100644
--- a/internal/service/vpclattice/service_network_vpc_association_test.go
+++ b/internal/service/vpclattice/service_network_vpc_association_test.go
@@ -1,15 +1,16 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package vpclattice_test
 
 import (
 	"context"
 	"errors"
 	"fmt"
-	"regexp"
 	"testing"
 
-	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/service/vpclattice"
-	"github.com/aws/aws-sdk-go-v2/service/vpclattice/types"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
@@ -17,6 +18,7 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/create"
 	tfvpclattice "github.com/hashicorp/terraform-provider-aws/internal/service/vpclattice"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
@@ -41,7 +43,41 @@ func TestAccVPCLatticeServiceNetworkVPCAssociation_basic(t *testing.T) {
 				Config: testAccServiceNetworkVPCAssociationConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckServiceNetworkVPCAssociationExists(ctx, resourceName, &servicenetworkvpcasc),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "vpc-lattice", regexp.MustCompile("servicenetworkvpcassociation/.+$")),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "vpc-lattice", regexache.MustCompile("servicenetworkvpcassociation/.+$")),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
+func TestAccVPCLatticeServiceNetworkVPCAssociation_arn(t *testing.T) {
+	ctx := acctest.Context(t)
+
+	var servicenetworkvpcasc vpclattice.GetServiceNetworkVpcAssociationOutput
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_vpclattice_service_network_vpc_association.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, names.VPCLatticeEndpointID)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, names.VPCLatticeEndpointID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckServiceNetworkVPCAssociationDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccServiceNetworkVPCAssociationConfig_arn(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckServiceNetworkVPCAssociationExists(ctx, resourceName, &servicenetworkvpcasc),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "vpc-lattice", regexache.MustCompile("servicenetworkvpcassociation/.+$")),
+					resource.TestCheckResourceAttrSet(resourceName, "service_network_identifier"),
 				),
 			},
 			{
@@ -103,7 +139,7 @@ func TestAccVPCLatticeServiceNetworkVPCAssociation_full(t *testing.T) {
 				Config: testAccServiceNetworkVPCAssociationConfig_full(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckServiceNetworkVPCAssociationExists(ctx, resourceName, &servicenetworkvpcasc),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "vpc-lattice", regexp.MustCompile("servicenetworkvpcassociation/.+$")),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "vpc-lattice", regexache.MustCompile("servicenetworkvpcassociation/.+$")),
 					resource.TestCheckResourceAttrSet(resourceName, "service_network_identifier"),
 					resource.TestCheckResourceAttrSet(resourceName, "vpc_identifier"),
 					resource.TestCheckResourceAttr(resourceName, "security_group_ids.#", "1"),
@@ -177,18 +213,17 @@ func testAccCheckServiceNetworkVPCAssociationDestroy(ctx context.Context) resour
 				continue
 			}
 
-			_, err := conn.GetServiceNetworkVpcAssociation(ctx, &vpclattice.GetServiceNetworkVpcAssociationInput{
-				ServiceNetworkVpcAssociationIdentifier: aws.String(rs.Primary.ID),
-			})
+			_, err := tfvpclattice.FindServiceNetworkVPCAssociationByID(ctx, conn, rs.Primary.ID)
+
+			if tfresource.NotFound(err) {
+				continue
+			}
+
 			if err != nil {
-				var nfe *types.ResourceNotFoundException
-				if errors.As(err, &nfe) {
-					return nil
-				}
 				return err
 			}
 
-			return create.Error(names.VPCLattice, create.ErrActionCheckingDestroyed, tfvpclattice.ResNameService, rs.Primary.ID, errors.New("not destroyed"))
+			return fmt.Errorf("VPC Lattice Service Network VPC Association %s still exists", rs.Primary.ID)
 		}
 
 		return nil
@@ -207,12 +242,10 @@ func testAccCheckServiceNetworkVPCAssociationExists(ctx context.Context, name st
 		}
 
 		conn := acctest.Provider.Meta().(*conns.AWSClient).VPCLatticeClient(ctx)
-		resp, err := conn.GetServiceNetworkVpcAssociation(ctx, &vpclattice.GetServiceNetworkVpcAssociationInput{
-			ServiceNetworkVpcAssociationIdentifier: aws.String(rs.Primary.ID),
-		})
+		resp, err := tfvpclattice.FindServiceNetworkVPCAssociationByID(ctx, conn, rs.Primary.ID)
 
 		if err != nil {
-			return create.Error(names.VPCLattice, create.ErrActionCheckingExistence, tfvpclattice.ResNameService, rs.Primary.ID, err)
+			return err
 		}
 
 		*service = *resp
@@ -221,35 +254,41 @@ func testAccCheckServiceNetworkVPCAssociationExists(ctx context.Context, name st
 	}
 }
 
-func testAccServiceNetworkVPCAssociationConfig_basic(rName string) string {
-	return fmt.Sprintf(`
-resource "aws_vpc" "test" {
-  cidr_block = "10.0.0.0/16"
-}
-
+func testAccServiceNetworkVPCAssociationConfig_base(rName string) string {
+	return acctest.ConfigCompose(acctest.ConfigVPCWithSubnets(rName, 0), fmt.Sprintf(`
 resource "aws_vpclattice_service_network" "test" {
   name = %[1]q
 }
+`, rName))
+}
 
+func testAccServiceNetworkVPCAssociationConfig_basic(rName string) string {
+	return acctest.ConfigCompose(testAccServiceNetworkVPCAssociationConfig_base(rName), `
 resource "aws_vpclattice_service_network_vpc_association" "test" {
   vpc_identifier             = aws_vpc.test.id
   service_network_identifier = aws_vpclattice_service_network.test.id
 }
-`, rName)
+`)
 }
 
-func testAccServiceNetworkVPCAssociationConfig_full(rName string) string {
-	return fmt.Sprintf(`
-resource "aws_vpc" "test" {
-  cidr_block = "10.0.0.0/16"
+func testAccServiceNetworkVPCAssociationConfig_arn(rName string) string {
+	return acctest.ConfigCompose(testAccServiceNetworkVPCAssociationConfig_base(rName), `
+resource "aws_vpclattice_service_network_vpc_association" "test" {
+  vpc_identifier             = aws_vpc.test.id
+  service_network_identifier = aws_vpclattice_service_network.test.arn
+}
+`)
 }
 
+func testAccServiceNetworkVPCAssociationConfig_full(rName string) string {
+	return acctest.ConfigCompose(testAccServiceNetworkVPCAssociationConfig_base(rName), fmt.Sprintf(`
 resource "aws_security_group" "test" {
+  name   = %[1]q
   vpc_id = aws_vpc.test.id
-}
 
-resource "aws_vpclattice_service_network" "test" {
-  name = %[1]q
+  tags = {
+    Name = %[1]q
+  }
 }
 
 resource "aws_vpclattice_service_network_vpc_association" "test" {
@@ -257,48 +296,32 @@ resource "aws_vpclattice_service_network_vpc_association" "test" {
   security_group_ids         = [aws_security_group.test.id]
   service_network_identifier = aws_vpclattice_service_network.test.id
 }
-`, rName)
+`, rName))
 }
 
 func testAccServiceNetworkVPCAssociationConfig_tags1(rName, tagKey1, tagValue1 string) string {
-	return fmt.Sprintf(`
-resource "aws_vpc" "test" {
-  cidr_block = "10.0.0.0/16"
-}
-
-resource "aws_vpclattice_service_network" "test" {
-  name = %[1]q
-}
-
+	return acctest.ConfigCompose(testAccServiceNetworkVPCAssociationConfig_base(rName), fmt.Sprintf(`
 resource "aws_vpclattice_service_network_vpc_association" "test" {
   vpc_identifier             = aws_vpc.test.id
   service_network_identifier = aws_vpclattice_service_network.test.id
 
   tags = {
-    %[2]q = %[3]q
+    %[1]q = %[2]q
   }
 }
-`, rName, tagKey1, tagValue1)
+`, tagKey1, tagValue1))
 }
 
 func testAccServiceNetworkVPCAssociationConfig_tags2(rName, tagKey1, tagValue1, tagKey2, tagValue2 string) string {
-	return fmt.Sprintf(`
-resource "aws_vpc" "test" {
-  cidr_block = "10.0.0.0/16"
-}
-
-resource "aws_vpclattice_service_network" "test" {
-  name = %[1]q
-}
-
+	return acctest.ConfigCompose(testAccServiceNetworkVPCAssociationConfig_base(rName), fmt.Sprintf(`
 resource "aws_vpclattice_service_network_vpc_association" "test" {
   vpc_identifier             = aws_vpc.test.id
   service_network_identifier = aws_vpclattice_service_network.test.id
 
   tags = {
-    %[2]q = %[3]q
-    %[4]q = %[5]q
+    %[1]q = %[2]q
+    %[3]q = %[4]q
   }
 }
-`, rName, tagKey1, tagValue1, tagKey2, tagValue2)
+`, tagKey1, tagValue1, tagKey2, tagValue2))
 }
diff --git a/internal/service/vpclattice/service_package_gen.go b/internal/service/vpclattice/service_package_gen.go
index 1416cc260c2..5e5efdc0377 100644
--- a/internal/service/vpclattice/service_package_gen.go
+++ b/internal/service/vpclattice/service_package_gen.go
@@ -7,6 +7,7 @@ import (
 
 	aws_sdkv2 "github.com/aws/aws-sdk-go-v2/aws"
 	vpclattice_sdkv2 "github.com/aws/aws-sdk-go-v2/service/vpclattice"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -39,12 +40,14 @@ func (p *servicePackage) SDKDataSources(ctx context.Context) []*types.ServicePac
 			Name:     "Resource Policy",
 		},
 		{
-			Factory:  DataSourceService,
+			Factory:  dataSourceService,
 			TypeName: "aws_vpclattice_service",
+			Tags:     &types.ServicePackageResourceTags{},
 		},
 		{
-			Factory:  DataSourceServiceNetwork,
+			Factory:  dataSourceServiceNetwork,
 			TypeName: "aws_vpclattice_service_network",
+			Tags:     &types.ServicePackageResourceTags{},
 		},
 	}
 }
@@ -52,7 +55,7 @@ func (p *servicePackage) SDKDataSources(ctx context.Context) []*types.ServicePac
 func (p *servicePackage) SDKResources(ctx context.Context) []*types.ServicePackageSDKResource {
 	return []*types.ServicePackageSDKResource{
 		{
-			Factory:  ResourceAccessLogSubscription,
+			Factory:  resourceAccessLogSubscription,
 			TypeName: "aws_vpclattice_access_log_subscription",
 			Name:     "Access Log Subscription",
 			Tags: &types.ServicePackageResourceTags{
@@ -85,7 +88,7 @@ func (p *servicePackage) SDKResources(ctx context.Context) []*types.ServicePacka
 			Name:     "Resource Policy",
 		},
 		{
-			Factory:  ResourceService,
+			Factory:  resourceService,
 			TypeName: "aws_vpclattice_service",
 			Name:     "Service",
 			Tags: &types.ServicePackageResourceTags{
@@ -93,15 +96,15 @@ func (p *servicePackage) SDKResources(ctx context.Context) []*types.ServicePacka
 			},
 		},
 		{
-			Factory:  ResourceServiceNetwork,
+			Factory:  resourceServiceNetwork,
 			TypeName: "aws_vpclattice_service_network",
-			Name:     "ServiceNetwork",
+			Name:     "Service Network",
 			Tags: &types.ServicePackageResourceTags{
 				IdentifierAttribute: "arn",
 			},
 		},
 		{
-			Factory:  ResourceServiceNetworkServiceAssociation,
+			Factory:  resourceServiceNetworkServiceAssociation,
 			TypeName: "aws_vpclattice_service_network_service_association",
 			Name:     "Service Network Service Association",
 			Tags: &types.ServicePackageResourceTags{
@@ -109,7 +112,7 @@ func (p *servicePackage) SDKResources(ctx context.Context) []*types.ServicePacka
 			},
 		},
 		{
-			Factory:  ResourceServiceNetworkVPCAssociation,
+			Factory:  resourceServiceNetworkVPCAssociation,
 			TypeName: "aws_vpclattice_service_network_vpc_association",
 			Name:     "Service Network VPC Association",
 			Tags: &types.ServicePackageResourceTags{
@@ -142,9 +145,11 @@ func (p *servicePackage) NewClient(ctx context.Context, config map[string]any) (
 
 	return vpclattice_sdkv2.NewFromConfig(cfg, func(o *vpclattice_sdkv2.Options) {
 		if endpoint := config["endpoint"].(string); endpoint != "" {
-			o.EndpointResolver = vpclattice_sdkv2.EndpointResolverFromURL(endpoint)
+			o.BaseEndpoint = aws_sdkv2.String(endpoint)
 		}
 	}), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/vpclattice/service_test.go b/internal/service/vpclattice/service_test.go
index 85f3fa01cf6..4b29e58a1fd 100644
--- a/internal/service/vpclattice/service_test.go
+++ b/internal/service/vpclattice/service_test.go
@@ -1,15 +1,16 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package vpclattice_test
 
 import (
 	"context"
 	"errors"
 	"fmt"
-	"regexp"
 	"testing"
 
-	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/service/vpclattice"
-	"github.com/aws/aws-sdk-go-v2/service/vpclattice/types"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
@@ -17,6 +18,7 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/create"
 	tfvpclattice "github.com/hashicorp/terraform-provider-aws/internal/service/vpclattice"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
@@ -42,7 +44,7 @@ func TestAccVPCLatticeService_basic(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckServiceExists(ctx, resourceName, &service),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "vpc-lattice", regexp.MustCompile("service/.+$")),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "vpc-lattice", regexache.MustCompile("service/.+$")),
 				),
 			},
 			{
@@ -107,7 +109,7 @@ func TestAccVPCLatticeService_full(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "auth_type", "AWS_IAM"),
 					resource.TestCheckResourceAttr(resourceName, "custom_domain_name", "example.com"),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "vpc-lattice", regexp.MustCompile("service/.+$")),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "vpc-lattice", regexache.MustCompile("service/.+$")),
 				),
 			},
 			{
@@ -173,18 +175,17 @@ func testAccCheckServiceDestroy(ctx context.Context) resource.TestCheckFunc {
 				continue
 			}
 
-			_, err := conn.GetService(ctx, &vpclattice.GetServiceInput{
-				ServiceIdentifier: aws.String(rs.Primary.ID),
-			})
+			_, err := tfvpclattice.FindServiceByID(ctx, conn, rs.Primary.ID)
+
+			if tfresource.NotFound(err) {
+				continue
+			}
+
 			if err != nil {
-				var nfe *types.ResourceNotFoundException
-				if errors.As(err, &nfe) {
-					return nil
-				}
 				return err
 			}
 
-			return create.Error(names.VPCLattice, create.ErrActionCheckingDestroyed, tfvpclattice.ResNameService, rs.Primary.ID, errors.New("not destroyed"))
+			return fmt.Errorf("VPC Lattice Service %s still exists", rs.Primary.ID)
 		}
 
 		return nil
@@ -203,12 +204,10 @@ func testAccCheckServiceExists(ctx context.Context, name string, service *vpclat
 		}
 
 		conn := acctest.Provider.Meta().(*conns.AWSClient).VPCLatticeClient(ctx)
-		resp, err := conn.GetService(ctx, &vpclattice.GetServiceInput{
-			ServiceIdentifier: aws.String(rs.Primary.ID),
-		})
+		resp, err := tfvpclattice.FindServiceByID(ctx, conn, rs.Primary.ID)
 
 		if err != nil {
-			return create.Error(names.VPCLattice, create.ErrActionCheckingExistence, tfvpclattice.ResNameService, rs.Primary.ID, err)
+			return err
 		}
 
 		*service = *resp
diff --git a/internal/service/vpclattice/sweep.go b/internal/service/vpclattice/sweep.go
index 567de32b3e0..a14adfc46b6 100644
--- a/internal/service/vpclattice/sweep.go
+++ b/internal/service/vpclattice/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package vpclattice
 
@@ -9,11 +9,13 @@ import (
 
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/vpclattice"
+	"github.com/hashicorp/aws-sdk-go-base/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv2"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_vpclattice_service", &resource.Sweeper{
 		Name: "aws_vpclattice_service",
 		F:    sweepServices,
@@ -26,11 +28,16 @@ func init() {
 			"aws_vpclattice_service",
 		},
 	})
+
+	resource.AddTestSweepers("aws_vpclattice_target_group", &resource.Sweeper{
+		Name: "aws_vpclattice_target_group",
+		F:    sweepTargetGroups,
+	})
 }
 
 func sweepServices(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -42,7 +49,7 @@ func sweepServices(region string) error {
 	for pages.HasMorePages() {
 		page, err := pages.NextPage(ctx)
 
-		if sweep.SkipSweepError(err) {
+		if awsv2.SkipSweepError(err) || skipSweepErr(err) {
 			log.Printf("[WARN] Skipping VPC Lattice Service sweep for %s: %s", region, err)
 			return nil
 		}
@@ -52,7 +59,7 @@ func sweepServices(region string) error {
 		}
 
 		for _, v := range page.Items {
-			r := ResourceService()
+			r := resourceService()
 			d := r.Data(nil)
 			d.SetId(aws.ToString(v.Id))
 
@@ -60,7 +67,7 @@ func sweepServices(region string) error {
 		}
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping VPC Lattice Services (%s): %w", region, err)
@@ -71,7 +78,7 @@ func sweepServices(region string) error {
 
 func sweepServiceNetworks(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -83,7 +90,7 @@ func sweepServiceNetworks(region string) error {
 	for pages.HasMorePages() {
 		page, err := pages.NextPage(ctx)
 
-		if sweep.SkipSweepError(err) {
+		if awsv2.SkipSweepError(err) || skipSweepErr(err) {
 			log.Printf("[WARN] Skipping VPC Lattice Service Network sweep for %s: %s", region, err)
 			return nil
 		}
@@ -93,7 +100,7 @@ func sweepServiceNetworks(region string) error {
 		}
 
 		for _, v := range page.Items {
-			r := ResourceServiceNetwork()
+			r := resourceServiceNetwork()
 			d := r.Data(nil)
 			d.SetId(aws.ToString(v.Id))
 
@@ -101,7 +108,7 @@ func sweepServiceNetworks(region string) error {
 		}
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping VPC Lattice Service Networks (%s): %w", region, err)
@@ -109,3 +116,48 @@ func sweepServiceNetworks(region string) error {
 
 	return nil
 }
+
+func sweepTargetGroups(region string) error {
+	ctx := sweep.Context(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
+	if err != nil {
+		return fmt.Errorf("error getting client: %s", err)
+	}
+	conn := client.VPCLatticeClient(ctx)
+	input := &vpclattice.ListTargetGroupsInput{}
+	sweepResources := make([]sweep.Sweepable, 0)
+
+	pages := vpclattice.NewListTargetGroupsPaginator(conn, input)
+	for pages.HasMorePages() {
+		page, err := pages.NextPage(ctx)
+
+		if awsv2.SkipSweepError(err) || skipSweepErr(err) {
+			log.Printf("[WARN] Skipping VPC Lattice Target Group sweep for %s: %s", region, err)
+			return nil
+		}
+
+		if err != nil {
+			return fmt.Errorf("error listing VPC Lattice Target Groups (%s): %w", region, err)
+		}
+
+		for _, v := range page.Items {
+			r := ResourceTargetGroup()
+			d := r.Data(nil)
+			d.SetId(aws.ToString(v.Id))
+
+			sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
+		}
+	}
+
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
+
+	if err != nil {
+		return fmt.Errorf("error sweeping VPC Lattice Target Groups (%s): %w", region, err)
+	}
+
+	return nil
+}
+
+func skipSweepErr(err error) bool {
+	return tfawserr.ErrCodeEquals(err, "AccessDeniedException")
+}
diff --git a/internal/service/vpclattice/tags_gen.go b/internal/service/vpclattice/tags_gen.go
index 55b250ca419..9d71fbbd6e6 100644
--- a/internal/service/vpclattice/tags_gen.go
+++ b/internal/service/vpclattice/tags_gen.go
@@ -7,7 +7,9 @@ import (
 
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/vpclattice"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -53,7 +55,7 @@ func Tags(tags tftags.KeyValueTags) map[string]string {
 	return tags.Map()
 }
 
-// KeyValueTags creates KeyValueTags from vpclattice service tags.
+// KeyValueTags creates tftags.KeyValueTags from vpclattice service tags.
 func KeyValueTags(ctx context.Context, tags map[string]string) tftags.KeyValueTags {
 	return tftags.New(ctx, tags)
 }
@@ -84,6 +86,8 @@ func updateTags(ctx context.Context, conn *vpclattice.Client, identifier string,
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.VPCLattice)
 	if len(removedTags) > 0 {
diff --git a/internal/service/vpclattice/target_group.go b/internal/service/vpclattice/target_group.go
index ed39ce928b6..adde587216e 100644
--- a/internal/service/vpclattice/target_group.go
+++ b/internal/service/vpclattice/target_group.go
@@ -1,9 +1,11 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package vpclattice
 
 import (
 	"context"
 	"errors"
-	"fmt"
 	"log"
 	"strings"
 	"time"
@@ -12,7 +14,6 @@ import (
 	"github.com/aws/aws-sdk-go-v2/service/vpclattice"
 	"github.com/aws/aws-sdk-go-v2/service/vpclattice/types"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/customdiff"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
@@ -143,23 +144,32 @@ func ResourceTargetGroup() *schema.Resource {
 							ForceNew:         true,
 							ValidateDiagFunc: enum.Validate[types.IpAddressType](),
 						},
+						"lambda_event_structure_version": {
+							Type:             schema.TypeString,
+							Optional:         true,
+							Computed:         true,
+							ForceNew:         true,
+							ValidateDiagFunc: enum.Validate[types.LambdaEventStructureVersion](),
+						},
 						"port": {
 							Type:         schema.TypeInt,
-							Required:     true,
+							Optional:     true,
+							Computed:     true,
 							ForceNew:     true,
 							ValidateFunc: validation.IsPortNumber,
 						},
 						"protocol": {
 							Type:             schema.TypeString,
-							Required:         true,
+							Optional:         true,
+							Computed:         true,
 							ForceNew:         true,
 							ValidateDiagFunc: enum.Validate[types.TargetGroupProtocol](),
 						},
 						"protocol_version": {
 							Type:     schema.TypeString,
 							Optional: true,
+							Computed: true,
 							ForceNew: true,
-							Default:  types.TargetGroupProtocolVersionHttp1,
 							StateFunc: func(v interface{}) string {
 								return strings.ToUpper(v.(string))
 							},
@@ -167,11 +177,12 @@ func ResourceTargetGroup() *schema.Resource {
 						},
 						"vpc_identifier": {
 							Type:     schema.TypeString,
-							Required: true,
+							Optional: true,
 							ForceNew: true,
 						},
 					},
 				},
+				DiffSuppressFunc: verify.SuppressMissingOptionalConfigurationBlock,
 			},
 			"name": {
 				Type:         schema.TypeString,
@@ -193,24 +204,7 @@ func ResourceTargetGroup() *schema.Resource {
 			names.AttrTagsAll: tftags.TagsSchemaComputed(),
 		},
 
-		CustomizeDiff: customdiff.All(
-			verify.SetTagsDiff,
-			func(ctx context.Context, d *schema.ResourceDiff, meta interface{}) error {
-				targetGroupType := types.TargetGroupType(d.Get("type").(string))
-
-				if v, ok := d.GetOk("config"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
-					if targetGroupType == types.TargetGroupTypeLambda {
-						return fmt.Errorf(`config not supported for type = %q`, targetGroupType)
-					}
-				} else {
-					if targetGroupType != types.TargetGroupTypeLambda {
-						return fmt.Errorf(`config required for type = %q`, targetGroupType)
-					}
-				}
-
-				return nil
-			},
-		),
+		CustomizeDiff: verify.SetTagsDiff,
 	}
 }
 
@@ -435,9 +429,10 @@ func flattenTargetGroupConfig(apiObject *types.TargetGroupConfig) map[string]int
 	}
 
 	tfMap := map[string]interface{}{
-		"ip_address_type":  apiObject.IpAddressType,
-		"protocol":         apiObject.Protocol,
-		"protocol_version": apiObject.ProtocolVersion,
+		"ip_address_type":                apiObject.IpAddressType,
+		"lambda_event_structure_version": apiObject.LambdaEventStructureVersion,
+		"protocol":                       apiObject.Protocol,
+		"protocol_version":               apiObject.ProtocolVersion,
 	}
 
 	if v := apiObject.HealthCheck; v != nil {
@@ -527,6 +522,10 @@ func expandTargetGroupConfig(tfMap map[string]interface{}) *types.TargetGroupCon
 		apiObject.IpAddressType = types.IpAddressType(v)
 	}
 
+	if v, ok := tfMap["lambda_event_structure_version"].(string); ok && v != "" {
+		apiObject.LambdaEventStructureVersion = types.LambdaEventStructureVersion(v)
+	}
+
 	if v, ok := tfMap["port"].(int); ok && v != 0 {
 		apiObject.Port = aws.Int32(int32(v))
 	}
@@ -535,14 +534,14 @@ func expandTargetGroupConfig(tfMap map[string]interface{}) *types.TargetGroupCon
 		apiObject.Protocol = types.TargetGroupProtocol(v)
 	}
 
-	if v, ok := tfMap["vpc_identifier"].(string); ok && v != "" {
-		apiObject.VpcIdentifier = aws.String(v)
-	}
-
 	if v, ok := tfMap["protocol_version"].(string); ok && v != "" {
 		apiObject.ProtocolVersion = types.TargetGroupProtocolVersion(v)
 	}
 
+	if v, ok := tfMap["vpc_identifier"].(string); ok && v != "" {
+		apiObject.VpcIdentifier = aws.String(v)
+	}
+
 	return apiObject
 }
 
diff --git a/internal/service/vpclattice/target_group_attachment.go b/internal/service/vpclattice/target_group_attachment.go
index f6aae925c58..d0de3998257 100644
--- a/internal/service/vpclattice/target_group_attachment.go
+++ b/internal/service/vpclattice/target_group_attachment.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package vpclattice
 
 import (
diff --git a/internal/service/vpclattice/target_group_attachment_test.go b/internal/service/vpclattice/target_group_attachment_test.go
index c8b7f38c00d..d20d401e0d7 100644
--- a/internal/service/vpclattice/target_group_attachment_test.go
+++ b/internal/service/vpclattice/target_group_attachment_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package vpclattice_test
 
 import (
diff --git a/internal/service/vpclattice/target_group_test.go b/internal/service/vpclattice/target_group_test.go
index aa6087345f9..4739df09574 100644
--- a/internal/service/vpclattice/target_group_test.go
+++ b/internal/service/vpclattice/target_group_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package vpclattice_test
 
 import (
 	"context"
 	"errors"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/vpclattice"
 	"github.com/aws/aws-sdk-go-v2/service/vpclattice/types"
@@ -40,7 +43,7 @@ func TestAccVPCLatticeTargetGroup_basic(t *testing.T) {
 				Config: testAccTargetGroupConfig_basic(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckTargetGroupExists(ctx, resourceName, &targetGroup),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "vpc-lattice", regexp.MustCompile("targetgroup/.+$")),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "vpc-lattice", regexache.MustCompile("targetgroup/.+$")),
 					resource.TestCheckResourceAttr(resourceName, "config.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "config.0.health_check.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "config.0.health_check.0.enabled", "true"),
@@ -55,6 +58,7 @@ func TestAccVPCLatticeTargetGroup_basic(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "config.0.health_check.0.protocol_version", "HTTP1"),
 					resource.TestCheckResourceAttr(resourceName, "config.0.health_check.0.unhealthy_threshold_count", "2"),
 					resource.TestCheckResourceAttr(resourceName, "config.0.ip_address_type", ""),
+					resource.TestCheckResourceAttr(resourceName, "config.0.lambda_event_structure_version", ""),
 					resource.TestCheckResourceAttr(resourceName, "config.0.port", "80"),
 					resource.TestCheckResourceAttr(resourceName, "config.0.protocol", "HTTP"),
 					resource.TestCheckResourceAttr(resourceName, "config.0.protocol_version", "HTTP1"),
@@ -167,8 +171,46 @@ func TestAccVPCLatticeTargetGroup_lambda(t *testing.T) {
 				Config: testAccTargetGroupConfig_lambda(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckTargetGroupExists(ctx, resourceName, &targetGroup),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "vpc-lattice", regexp.MustCompile("targetgroup/.+$")),
-					resource.TestCheckResourceAttr(resourceName, "config.#", "0"),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "vpc-lattice", regexache.MustCompile("targetgroup/.+$")),
+					resource.TestCheckResourceAttr(resourceName, "config.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "name", rName),
+					resource.TestCheckResourceAttr(resourceName, "status", "ACTIVE"),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
+					resource.TestCheckResourceAttr(resourceName, "type", "LAMBDA"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
+func TestAccVPCLatticeTargetGroup_lambdaEventStructureVersion(t *testing.T) {
+	ctx := acctest.Context(t)
+	var targetGroup vpclattice.GetTargetGroupOutput
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_vpclattice_target_group.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, names.VPCLatticeEndpointID)
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, names.VPCLatticeEndpointID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckTargetGroupDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccTargetGroupConfig_lambdaEventStructureVersion(rName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckTargetGroupExists(ctx, resourceName, &targetGroup),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "vpc-lattice", regexache.MustCompile("targetgroup/.+$")),
+					resource.TestCheckResourceAttr(resourceName, "config.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "config.0.lambda_event_structure_version", "V2"),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "status", "ACTIVE"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
@@ -203,7 +245,7 @@ func TestAccVPCLatticeTargetGroup_ip(t *testing.T) {
 				Config: testAccTargetGroupConfig_ip(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckTargetGroupExists(ctx, resourceName, &targetGroup),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "vpc-lattice", regexp.MustCompile("targetgroup/.+$")),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "vpc-lattice", regexache.MustCompile("targetgroup/.+$")),
 					resource.TestCheckResourceAttr(resourceName, "config.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "config.0.health_check.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "config.0.health_check.0.enabled", "true"),
@@ -236,7 +278,7 @@ func TestAccVPCLatticeTargetGroup_ip(t *testing.T) {
 				Config: testAccTargetGroupConfig_ipUpdated(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckTargetGroupExists(ctx, resourceName, &targetGroup),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "vpc-lattice", regexp.MustCompile("targetgroup/.+$")),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "vpc-lattice", regexache.MustCompile("targetgroup/.+$")),
 					resource.TestCheckResourceAttr(resourceName, "config.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "config.0.health_check.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "config.0.health_check.0.enabled", "true"),
@@ -284,7 +326,7 @@ func TestAccVPCLatticeTargetGroup_alb(t *testing.T) {
 				Config: testAccTargetGroupConfig_alb(rName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckTargetGroupExists(ctx, resourceName, &targetGroup),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "vpc-lattice", regexp.MustCompile("targetgroup/.+$")),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "vpc-lattice", regexache.MustCompile("targetgroup/.+$")),
 					resource.TestCheckResourceAttr(resourceName, "config.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "config.0.health_check.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "config.0.ip_address_type", ""),
@@ -410,6 +452,19 @@ resource "aws_vpclattice_target_group" "test" {
 `, rName)
 }
 
+func testAccTargetGroupConfig_lambdaEventStructureVersion(rName string) string {
+	return fmt.Sprintf(`
+resource "aws_vpclattice_target_group" "test" {
+  name = %[1]q
+  type = "LAMBDA"
+
+  config {
+    lambda_event_structure_version = "V2"
+  }
+}
+`, rName)
+}
+
 func testAccTargetGroupConfig_ip(rName string) string {
 	return acctest.ConfigCompose(acctest.ConfigVPCWithSubnets(rName, 0), fmt.Sprintf(`
 resource "aws_vpclattice_target_group" "test" {
diff --git a/internal/service/waf/byte_match_set.go b/internal/service/waf/byte_match_set.go
index 92e38da972c..91493a7ae29 100644
--- a/internal/service/waf/byte_match_set.go
+++ b/internal/service/waf/byte_match_set.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package waf
 
 import (
diff --git a/internal/service/waf/byte_match_set_test.go b/internal/service/waf/byte_match_set_test.go
index f7cc8d77378..909f6435ef5 100644
--- a/internal/service/waf/byte_match_set_test.go
+++ b/internal/service/waf/byte_match_set_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package waf_test
 
 import (
diff --git a/internal/service/waf/find.go b/internal/service/waf/find.go
index 55625a0a182..dcbb162f998 100644
--- a/internal/service/waf/find.go
+++ b/internal/service/waf/find.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package waf
 
 import (
diff --git a/internal/service/waf/flex.go b/internal/service/waf/flex.go
index a97d86b6bbf..2d7a014b05b 100644
--- a/internal/service/waf/flex.go
+++ b/internal/service/waf/flex.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package waf
 
 import (
diff --git a/internal/service/waf/generate.go b/internal/service/waf/generate.go
index ad089665360..fd5dcd8f21d 100644
--- a/internal/service/waf/generate.go
+++ b/internal/service/waf/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/listpages/main.go -ListOps=ListByteMatchSets,ListGeoMatchSets,ListIPSets,ListRateBasedRules,ListRegexMatchSets,ListRegexPatternSets,ListRuleGroups,ListRules,ListSizeConstraintSets,ListSqlInjectionMatchSets,ListWebACLs,ListXssMatchSets -Paginator=NextMarker
 //go:generate go run ../../generate/tags/main.go -ListTags -ListTagsInIDElem=ResourceARN -ListTagsOutTagsElem=TagInfoForResource.TagList -ServiceTagsSlice -TagInIDElem=ResourceARN -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
diff --git a/internal/service/waf/geo_match_set.go b/internal/service/waf/geo_match_set.go
index a4a089ec81f..5acd3b72faf 100644
--- a/internal/service/waf/geo_match_set.go
+++ b/internal/service/waf/geo_match_set.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package waf
 
 import (
diff --git a/internal/service/waf/geo_match_set_test.go b/internal/service/waf/geo_match_set_test.go
index 38778276eb3..72cd914c4c3 100644
--- a/internal/service/waf/geo_match_set_test.go
+++ b/internal/service/waf/geo_match_set_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package waf_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/waf"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -33,7 +36,7 @@ func TestAccWAFGeoMatchSet_basic(t *testing.T) {
 				Config: testAccGeoMatchSetConfig_basic(geoMatchSet),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckGeoMatchSetExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "waf", regexp.MustCompile(`geomatchset/.+`)),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "waf", regexache.MustCompile(`geomatchset/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "name", geoMatchSet),
 					resource.TestCheckResourceAttr(resourceName, "geo_match_constraint.#", "2"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "geo_match_constraint.*", map[string]string{
diff --git a/internal/service/waf/helpers.go b/internal/service/waf/helpers.go
index daf54d562e0..d1918ac991d 100644
--- a/internal/service/waf/helpers.go
+++ b/internal/service/waf/helpers.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package waf
 
 import (
diff --git a/internal/service/waf/ipset.go b/internal/service/waf/ipset.go
index 328674badef..94dabbc8c86 100644
--- a/internal/service/waf/ipset.go
+++ b/internal/service/waf/ipset.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package waf
 
 import (
diff --git a/internal/service/waf/ipset_data_source.go b/internal/service/waf/ipset_data_source.go
index 86be420ae42..196ae31efd0 100644
--- a/internal/service/waf/ipset_data_source.go
+++ b/internal/service/waf/ipset_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package waf
 
 import (
diff --git a/internal/service/waf/ipset_data_source_test.go b/internal/service/waf/ipset_data_source_test.go
index 1ec7fa5d1d8..a9647e46057 100644
--- a/internal/service/waf/ipset_data_source_test.go
+++ b/internal/service/waf/ipset_data_source_test.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package waf_test
 
 import (
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/waf"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -24,7 +27,7 @@ func TestAccWAFIPSetDataSource_basic(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccIPSetDataSourceConfig_nonExistent,
-				ExpectError: regexp.MustCompile(`WAF IP Set not found`),
+				ExpectError: regexache.MustCompile(`WAF IP Set not found`),
 			},
 			{
 				Config: testAccIPSetDataSourceConfig_name(name),
diff --git a/internal/service/waf/ipset_test.go b/internal/service/waf/ipset_test.go
index 9a5ba2b7894..76844d8723e 100644
--- a/internal/service/waf/ipset_test.go
+++ b/internal/service/waf/ipset_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package waf_test
 
 import (
@@ -5,10 +8,10 @@ import (
 	"fmt"
 	"net"
 	"reflect"
-	"regexp"
 	"strings"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/waf"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -41,7 +44,7 @@ func TestAccWAFIPSet_basic(t *testing.T) {
 						"type":  "IPV4",
 						"value": "192.0.7.0/24",
 					}),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "waf", regexp.MustCompile("ipset/.+$")),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "waf", regexache.MustCompile("ipset/.+$")),
 				),
 			},
 			{
diff --git a/internal/service/waf/rate_based_rule.go b/internal/service/waf/rate_based_rule.go
index 2ad8026e2b6..4d2a274df4e 100644
--- a/internal/service/waf/rate_based_rule.go
+++ b/internal/service/waf/rate_based_rule.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package waf
 
 import (
diff --git a/internal/service/waf/rate_based_rule_data_source.go b/internal/service/waf/rate_based_rule_data_source.go
index 2a42c7327c3..5d946ccda32 100644
--- a/internal/service/waf/rate_based_rule_data_source.go
+++ b/internal/service/waf/rate_based_rule_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package waf
 
 import (
diff --git a/internal/service/waf/rate_based_rule_data_source_test.go b/internal/service/waf/rate_based_rule_data_source_test.go
index 3d546ceeae3..a2b30eb1fab 100644
--- a/internal/service/waf/rate_based_rule_data_source_test.go
+++ b/internal/service/waf/rate_based_rule_data_source_test.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package waf_test
 
 import (
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/waf"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -24,7 +27,7 @@ func testAccWAFRateBasedRuleDataSource_basic(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccRateBasedRuleDataSourceConfig_nonExistent,
-				ExpectError: regexp.MustCompile(`WAF Rate Based Rules not found`),
+				ExpectError: regexache.MustCompile(`WAF Rate Based Rules not found`),
 			},
 			{
 				Config: testAccRateBasedRuleDataSourceConfig_name(name),
diff --git a/internal/service/waf/rate_based_rule_test.go b/internal/service/waf/rate_based_rule_test.go
index ad5dfcc91a9..7fa0c2b3ec2 100644
--- a/internal/service/waf/rate_based_rule_test.go
+++ b/internal/service/waf/rate_based_rule_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package waf_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/waf"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -52,7 +55,7 @@ func testAccWAFRateBasedRule_basic(t *testing.T) {
 				Config: testAccRateBasedRuleConfig_basic(wafRuleName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRateBasedRuleExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "waf", regexp.MustCompile(`ratebasedrule/.+`)),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "waf", regexache.MustCompile(`ratebasedrule/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "name", wafRuleName),
 					resource.TestCheckResourceAttr(resourceName, "predicates.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "metric_name", wafRuleName),
@@ -277,7 +280,7 @@ func testAccWAFRateBasedRule_tags(t *testing.T) {
 				Config: testAccRateBasedRuleConfig_tags1(ruleName, "key1", "value1"),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckRateBasedRuleExists(ctx, resourceName, &rule),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "waf", regexp.MustCompile(`ratebasedrule/.+`)),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "waf", regexache.MustCompile(`ratebasedrule/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "name", ruleName),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
diff --git a/internal/service/waf/regex_match_set.go b/internal/service/waf/regex_match_set.go
index f688cb55d2d..009583fb618 100644
--- a/internal/service/waf/regex_match_set.go
+++ b/internal/service/waf/regex_match_set.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package waf
 
 import (
diff --git a/internal/service/waf/regex_match_set_test.go b/internal/service/waf/regex_match_set_test.go
index 4bf621a1ba9..d4d62d6b01e 100644
--- a/internal/service/waf/regex_match_set_test.go
+++ b/internal/service/waf/regex_match_set_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package waf_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/waf"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -58,7 +61,7 @@ func testAccRegexMatchSet_basic(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRegexMatchSetExists(ctx, resourceName, &matchSet),
 					testAccCheckRegexPatternSetExists(ctx, "aws_waf_regex_pattern_set.test", &patternSet),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "waf", regexp.MustCompile(`regexmatchset/.+`)),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "waf", regexache.MustCompile(`regexmatchset/.+`)),
 					computeRegexMatchSetTuple(&patternSet, &fieldToMatch, "NONE", &idx),
 					resource.TestCheckResourceAttr(resourceName, "name", matchSetName),
 					resource.TestCheckResourceAttr(resourceName, "regex_match_tuple.#", "1"),
diff --git a/internal/service/waf/regex_pattern_set.go b/internal/service/waf/regex_pattern_set.go
index e8290471533..cbdbdd61057 100644
--- a/internal/service/waf/regex_pattern_set.go
+++ b/internal/service/waf/regex_pattern_set.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package waf
 
 import (
diff --git a/internal/service/waf/regex_pattern_set_test.go b/internal/service/waf/regex_pattern_set_test.go
index 91ec61c03b7..4f0b41f4a88 100644
--- a/internal/service/waf/regex_pattern_set_test.go
+++ b/internal/service/waf/regex_pattern_set_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package waf_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/waf"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -48,7 +51,7 @@ func testAccRegexPatternSet_basic(t *testing.T) {
 				Config: testAccRegexPatternSetConfig_basic(patternSetName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRegexPatternSetExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "waf", regexp.MustCompile(`regexpatternset/.+`)),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "waf", regexache.MustCompile(`regexpatternset/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "name", patternSetName),
 					resource.TestCheckResourceAttr(resourceName, "regex_pattern_strings.#", "2"),
 					resource.TestCheckTypeSetElemAttr(resourceName, "regex_pattern_strings.*", "one"),
diff --git a/internal/service/waf/rule.go b/internal/service/waf/rule.go
index 47cf50dadc1..09acb98ee86 100644
--- a/internal/service/waf/rule.go
+++ b/internal/service/waf/rule.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package waf
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/aws/aws-sdk-go/service/waf"
@@ -49,7 +52,7 @@ func ResourceRule() *schema.Resource {
 				Type:         schema.TypeString,
 				Required:     true,
 				ForceNew:     true,
-				ValidateFunc: validation.StringMatch(regexp.MustCompile(`^[0-9A-Za-z]+$`), "must contain only alphanumeric characters"),
+				ValidateFunc: validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z]+$`), "must contain only alphanumeric characters"),
 			},
 			"predicates": {
 				Type:     schema.TypeSet,
diff --git a/internal/service/waf/rule_data_source.go b/internal/service/waf/rule_data_source.go
index 40660cda1b6..6278f727e6d 100644
--- a/internal/service/waf/rule_data_source.go
+++ b/internal/service/waf/rule_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package waf
 
 import (
diff --git a/internal/service/waf/rule_data_source_test.go b/internal/service/waf/rule_data_source_test.go
index 59a71a956f9..b676b5ed87c 100644
--- a/internal/service/waf/rule_data_source_test.go
+++ b/internal/service/waf/rule_data_source_test.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package waf_test
 
 import (
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/waf"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -24,7 +27,7 @@ func TestAccWAFRuleDataSource_basic(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccRuleDataSourceConfig_nonExistent,
-				ExpectError: regexp.MustCompile(`WAF Rules not found`),
+				ExpectError: regexache.MustCompile(`WAF Rules not found`),
 			},
 			{
 				Config: testAccRuleDataSourceConfig_name(name),
diff --git a/internal/service/waf/rule_group.go b/internal/service/waf/rule_group.go
index 08564c4e73f..181ae17403c 100644
--- a/internal/service/waf/rule_group.go
+++ b/internal/service/waf/rule_group.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package waf
 
 import (
diff --git a/internal/service/waf/rule_group_test.go b/internal/service/waf/rule_group_test.go
index 81a2f87f8da..5bdf204a393 100644
--- a/internal/service/waf/rule_group_test.go
+++ b/internal/service/waf/rule_group_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package waf_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/waf"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -48,7 +51,7 @@ func TestAccWAFRuleGroup_basic(t *testing.T) {
 						"priority":      "50",
 						"type":          waf.WafRuleTypeRegular,
 					}),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "waf", regexp.MustCompile(`rulegroup/.+`)),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "waf", regexache.MustCompile(`rulegroup/.+`)),
 				),
 			},
 			{
@@ -205,7 +208,7 @@ func TestAccWAFRuleGroup_changeActivatedRules(t *testing.T) {
 // which isn't static because ruleId is generated as part of the test
 func computeActivatedRuleWithRuleId(rule *waf.Rule, actionType string, priority int, idx *int) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		ruleResource := tfwaf.ResourceRuleGroup().Schema["activated_rule"].Elem.(*schema.Resource)
+		ruleResource := tfwaf.ResourceRuleGroup().SchemaMap()["activated_rule"].Elem.(*schema.Resource)
 
 		m := map[string]interface{}{
 			"action": []interface{}{
diff --git a/internal/service/waf/rule_test.go b/internal/service/waf/rule_test.go
index 05221b562ec..6f5d3ab66b4 100644
--- a/internal/service/waf/rule_test.go
+++ b/internal/service/waf/rule_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package waf_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/waf"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -35,7 +38,7 @@ func TestAccWAFRule_basic(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "name", wafRuleName),
 					resource.TestCheckResourceAttr(resourceName, "predicates.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "metric_name", wafRuleName),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "waf", regexp.MustCompile(`rule/.+`)),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "waf", regexache.MustCompile(`rule/.+`)),
 				),
 			},
 			{
diff --git a/internal/service/waf/service_package_gen.go b/internal/service/waf/service_package_gen.go
index 32b49f0454b..215fcb2c743 100644
--- a/internal/service/waf/service_package_gen.go
+++ b/internal/service/waf/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	waf_sdkv1 "github.com/aws/aws-sdk-go/service/waf"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -127,4 +128,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*w
 	return waf_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/waf/size_constraint_set.go b/internal/service/waf/size_constraint_set.go
index 5772377a249..76f296c542c 100644
--- a/internal/service/waf/size_constraint_set.go
+++ b/internal/service/waf/size_constraint_set.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package waf
 
 import (
diff --git a/internal/service/waf/size_constraint_set_test.go b/internal/service/waf/size_constraint_set_test.go
index 7c742dbc5c8..bc1626b3b05 100644
--- a/internal/service/waf/size_constraint_set_test.go
+++ b/internal/service/waf/size_constraint_set_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package waf_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/waf"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -32,7 +35,7 @@ func TestAccWAFSizeConstraintSet_basic(t *testing.T) {
 				Config: testAccSizeConstraintSetConfig_basic(sizeConstraintSet),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckSizeConstraintSetExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "waf", regexp.MustCompile(`sizeconstraintset/.+`)),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "waf", regexache.MustCompile(`sizeconstraintset/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "name", sizeConstraintSet),
 					resource.TestCheckResourceAttr(resourceName, "size_constraints.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "size_constraints.*", map[string]string{
diff --git a/internal/service/waf/sql_injection_match_set.go b/internal/service/waf/sql_injection_match_set.go
index e71cf9da4f1..ccb653be6bb 100644
--- a/internal/service/waf/sql_injection_match_set.go
+++ b/internal/service/waf/sql_injection_match_set.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package waf
 
 import (
diff --git a/internal/service/waf/sql_injection_match_set_test.go b/internal/service/waf/sql_injection_match_set_test.go
index 8aa34b2db24..119385c1410 100644
--- a/internal/service/waf/sql_injection_match_set_test.go
+++ b/internal/service/waf/sql_injection_match_set_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package waf_test
 
 import (
diff --git a/internal/service/waf/subscribed_rule_group.go b/internal/service/waf/subscribed_rule_group.go
index bca527e2099..5ff045e59dc 100644
--- a/internal/service/waf/subscribed_rule_group.go
+++ b/internal/service/waf/subscribed_rule_group.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package waf
 
 import (
diff --git a/internal/service/waf/subscribed_rule_group_test.go b/internal/service/waf/subscribed_rule_group_test.go
index e7ba6af199c..7909f5a0636 100644
--- a/internal/service/waf/subscribed_rule_group_test.go
+++ b/internal/service/waf/subscribed_rule_group_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package waf_test
 
 import (
 	"fmt"
 	"os"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/waf"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
@@ -35,7 +38,7 @@ func TestAccWAFSubscribedRuleGroupDataSource_basic(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccSubscribedRuleGroupDataSourceConfig_nonexistent,
-				ExpectError: regexp.MustCompile(`no matches found`),
+				ExpectError: regexache.MustCompile(`no matches found`),
 			},
 			{
 				Config: testAccSubscribedRuleGroupDataSourceConfig_name(ruleGroupName),
@@ -60,7 +63,7 @@ func TestAccWAFSubscribedRuleGroupDataSource_basic(t *testing.T) {
 			},
 			{
 				Config:      testAccSubscribedRuleGroupDataSourceConfig_nameAndMismatchingMetricName(ruleGroupName),
-				ExpectError: regexp.MustCompile(`no matches found`),
+				ExpectError: regexache.MustCompile(`no matches found`),
 			},
 		},
 	})
diff --git a/internal/service/waf/sweep.go b/internal/service/waf/sweep.go
index fcdb8dd7298..d8b02bff816 100644
--- a/internal/service/waf/sweep.go
+++ b/internal/service/waf/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package waf
 
@@ -13,10 +13,11 @@ import (
 	"github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep/sdk"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_waf_byte_match_set", &resource.Sweeper{
 		Name: "aws_waf_byte_match_set",
 		F:    sweepByteMatchSet,
@@ -131,7 +132,7 @@ func init() {
 
 func sweepByteMatchSet(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
@@ -192,11 +193,11 @@ func sweepByteMatchSet(region string) error {
 		errs = multierror.Append(errs, fmt.Errorf("error concurrently reading WAF Byte Match Sets: %w", err))
 	}
 
-	if err = sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err = sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("error sweeping WAF Byte Match Set for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
+	if awsv1.SkipSweepError(errs.ErrorOrNil()) {
 		log.Printf("[WARN] Skipping WAF Byte Match Set sweep for %s: %s", region, errs)
 		return nil
 	}
@@ -206,7 +207,7 @@ func sweepByteMatchSet(region string) error {
 
 func sweepGeoMatchSet(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
@@ -267,11 +268,11 @@ func sweepGeoMatchSet(region string) error {
 		errs = multierror.Append(errs, fmt.Errorf("error concurrently reading WAF Geo Match Sets: %w", err))
 	}
 
-	if err = sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err = sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("error sweeping WAF Geo Match Set for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
+	if awsv1.SkipSweepError(errs.ErrorOrNil()) {
 		log.Printf("[WARN] Skipping WAF Geo Match Set sweep for %s: %s", region, errs)
 		return nil
 	}
@@ -281,7 +282,7 @@ func sweepGeoMatchSet(region string) error {
 
 func sweepIPSet(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
@@ -342,11 +343,11 @@ func sweepIPSet(region string) error {
 		errs = multierror.Append(errs, fmt.Errorf("error concurrently reading WAF IP Sets: %w", err))
 	}
 
-	if err = sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err = sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("error sweeping WAF IP Set for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
+	if awsv1.SkipSweepError(errs.ErrorOrNil()) {
 		log.Printf("[WARN] Skipping WAF IP Set sweep for %s: %s", region, errs)
 		return nil
 	}
@@ -356,7 +357,7 @@ func sweepIPSet(region string) error {
 
 func sweepRateBasedRules(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
@@ -417,11 +418,11 @@ func sweepRateBasedRules(region string) error {
 		errs = multierror.Append(errs, fmt.Errorf("error concurrently reading WAF Rate Based Rules: %w", err))
 	}
 
-	if err = sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err = sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("error sweeping WAF Rate Based Rule for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
+	if awsv1.SkipSweepError(errs.ErrorOrNil()) {
 		log.Printf("[WARN] Skipping WAF Rate Based Rule sweep for %s: %s", region, errs)
 		return nil
 	}
@@ -431,7 +432,7 @@ func sweepRateBasedRules(region string) error {
 
 func sweepRegexMatchSet(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
@@ -492,11 +493,11 @@ func sweepRegexMatchSet(region string) error {
 		errs = multierror.Append(errs, fmt.Errorf("error concurrently reading WAF Regex Match Sets: %w", err))
 	}
 
-	if err = sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err = sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("error sweeping WAF Regex Match Set for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
+	if awsv1.SkipSweepError(errs.ErrorOrNil()) {
 		log.Printf("[WARN] Skipping WAF Regex Match Set sweep for %s: %s", region, errs)
 		return nil
 	}
@@ -506,7 +507,7 @@ func sweepRegexMatchSet(region string) error {
 
 func sweepRegexPatternSet(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
@@ -567,11 +568,11 @@ func sweepRegexPatternSet(region string) error {
 		errs = multierror.Append(errs, fmt.Errorf("error concurrently reading WAF Regex Pattern Sets: %w", err))
 	}
 
-	if err = sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err = sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("error sweeping WAF Regex Pattern Set for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
+	if awsv1.SkipSweepError(errs.ErrorOrNil()) {
 		log.Printf("[WARN] Skipping WAF Regex Pattern Set sweep for %s: %s", region, errs)
 		return nil
 	}
@@ -581,7 +582,7 @@ func sweepRegexPatternSet(region string) error {
 
 func sweepRuleGroups(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
@@ -642,11 +643,11 @@ func sweepRuleGroups(region string) error {
 		errs = multierror.Append(errs, fmt.Errorf("error concurrently reading WAF Rule Groups: %w", err))
 	}
 
-	if err = sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err = sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("error sweeping WAF Rule Group for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
+	if awsv1.SkipSweepError(errs.ErrorOrNil()) {
 		log.Printf("[WARN] Skipping WAF Rule Group sweep for %s: %s", region, errs)
 		return nil
 	}
@@ -656,7 +657,7 @@ func sweepRuleGroups(region string) error {
 
 func sweepRules(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
@@ -721,11 +722,11 @@ func sweepRules(region string) error {
 		errs = multierror.Append(errs, fmt.Errorf("error concurrently reading WAF Rules: %w", err))
 	}
 
-	if err = sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err = sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("error sweeping WAF Rules for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
+	if awsv1.SkipSweepError(errs.ErrorOrNil()) {
 		log.Printf("[WARN] Skipping WAF Rule sweep for %s: %s", region, errs)
 		return nil
 	}
@@ -735,7 +736,7 @@ func sweepRules(region string) error {
 
 func sweepSizeConstraintSet(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
@@ -796,11 +797,11 @@ func sweepSizeConstraintSet(region string) error {
 		errs = multierror.Append(errs, fmt.Errorf("error concurrently reading WAF Size Constraint Sets: %w", err))
 	}
 
-	if err = sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err = sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("error sweeping WAF Size Constraint Sets for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
+	if awsv1.SkipSweepError(errs.ErrorOrNil()) {
 		log.Printf("[WARN] Skipping WAF Size Constraint Set sweep for %s: %s", region, errs)
 		return nil
 	}
@@ -810,7 +811,7 @@ func sweepSizeConstraintSet(region string) error {
 
 func sweepSQLInjectionMatchSet(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
@@ -871,11 +872,11 @@ func sweepSQLInjectionMatchSet(region string) error {
 		errs = multierror.Append(errs, fmt.Errorf("error concurrently reading WAF SQL Injection Matches: %w", err))
 	}
 
-	if err = sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err = sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("error sweeping WAF SQL Injection Matches for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
+	if awsv1.SkipSweepError(errs.ErrorOrNil()) {
 		log.Printf("[WARN] Skipping WAF SQL Injection Match sweep for %s: %s", region, errs)
 		return nil
 	}
@@ -885,7 +886,7 @@ func sweepSQLInjectionMatchSet(region string) error {
 
 func sweepWebACLs(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
@@ -950,11 +951,11 @@ func sweepWebACLs(region string) error {
 		errs = multierror.Append(errs, fmt.Errorf("error concurrently reading WAF Web ACLs: %w", err))
 	}
 
-	if err = sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err = sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("error sweeping WAF Web ACLs for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
+	if awsv1.SkipSweepError(errs.ErrorOrNil()) {
 		log.Printf("[WARN] Skipping WAF Web ACL sweep for %s: %s", region, errs)
 		return nil
 	}
@@ -964,7 +965,7 @@ func sweepWebACLs(region string) error {
 
 func sweepXSSMatchSet(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
@@ -1025,11 +1026,11 @@ func sweepXSSMatchSet(region string) error {
 		errs = multierror.Append(errs, fmt.Errorf("error concurrently reading WAF XSS Match Sets: %w", err))
 	}
 
-	if err = sweep.SweepOrchestratorWithContext(ctx, sweepResources); err != nil {
+	if err = sweep.SweepOrchestrator(ctx, sweepResources); err != nil {
 		errs = multierror.Append(errs, fmt.Errorf("error sweeping WAF XSS Match Sets for %s: %w", region, err))
 	}
 
-	if sweep.SkipSweepError(errs.ErrorOrNil()) {
+	if awsv1.SkipSweepError(errs.ErrorOrNil()) {
 		log.Printf("[WARN] Skipping WAF XSS Match Set sweep for %s: %s", region, errs)
 		return nil
 	}
diff --git a/internal/service/waf/tags_gen.go b/internal/service/waf/tags_gen.go
index 39708c7e35d..32d8eaa151c 100644
--- a/internal/service/waf/tags_gen.go
+++ b/internal/service/waf/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/waf"
 	"github.com/aws/aws-sdk-go/service/waf/wafiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -102,6 +104,8 @@ func updateTags(ctx context.Context, conn wafiface.WAFAPI, identifier string, ol
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.WAF)
 	if len(removedTags) > 0 {
diff --git a/internal/service/waf/token_handlers.go b/internal/service/waf/token_handlers.go
index 8254cb538e7..eaa7820d10a 100644
--- a/internal/service/waf/token_handlers.go
+++ b/internal/service/waf/token_handlers.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package waf
 
 import (
diff --git a/internal/service/waf/validate.go b/internal/service/waf/validate.go
index 93b969194ad..5efa1b4cc3c 100644
--- a/internal/service/waf/validate.go
+++ b/internal/service/waf/validate.go
@@ -1,14 +1,18 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package waf
 
 import (
 	"fmt"
 	"reflect"
-	"regexp"
+
+	"github.com/YakDriver/regexache"
 )
 
 func validMetricName(v interface{}, k string) (ws []string, errors []error) {
 	value := v.(string)
-	if !regexp.MustCompile(`^[0-9A-Za-z]+$`).MatchString(value) {
+	if !regexache.MustCompile(`^[0-9A-Za-z]+$`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"Only alphanumeric characters allowed in %q: %q",
 			k, value))
diff --git a/internal/service/waf/validate_test.go b/internal/service/waf/validate_test.go
index c886971fd33..cf6eca68b44 100644
--- a/internal/service/waf/validate_test.go
+++ b/internal/service/waf/validate_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package waf
 
 import (
diff --git a/internal/service/waf/web_acl.go b/internal/service/waf/web_acl.go
index abddeaaba4e..6122d8638a6 100644
--- a/internal/service/waf/web_acl.go
+++ b/internal/service/waf/web_acl.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package waf
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/aws/aws-sdk-go/service/waf"
@@ -59,7 +62,7 @@ func ResourceWebACL() *schema.Resource {
 				Type:         schema.TypeString,
 				Required:     true,
 				ForceNew:     true,
-				ValidateFunc: validation.StringMatch(regexp.MustCompile(`^[0-9A-Za-z]+$`), "must contain only alphanumeric characters"),
+				ValidateFunc: validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z]+$`), "must contain only alphanumeric characters"),
 			},
 			"logging_configuration": {
 				Type:     schema.TypeList,
diff --git a/internal/service/waf/web_acl_data_source.go b/internal/service/waf/web_acl_data_source.go
index c1e993ca6dc..537e5285384 100644
--- a/internal/service/waf/web_acl_data_source.go
+++ b/internal/service/waf/web_acl_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package waf
 
 import (
diff --git a/internal/service/waf/web_acl_data_source_test.go b/internal/service/waf/web_acl_data_source_test.go
index 4eb64848a5f..baf34adfe7b 100644
--- a/internal/service/waf/web_acl_data_source_test.go
+++ b/internal/service/waf/web_acl_data_source_test.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package waf_test
 
 import (
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/waf"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -24,7 +27,7 @@ func TestAccWAFWebACLDataSource_basic(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccWebACLDataSourceConfig_nonExistent,
-				ExpectError: regexp.MustCompile(`web ACLs not found`),
+				ExpectError: regexache.MustCompile(`web ACLs not found`),
 			},
 			{
 				Config: testAccWebACLDataSourceConfig_name(name),
diff --git a/internal/service/waf/web_acl_test.go b/internal/service/waf/web_acl_test.go
index 8a01aae97be..15849b5ee2b 100644
--- a/internal/service/waf/web_acl_test.go
+++ b/internal/service/waf/web_acl_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package waf_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/endpoints"
 	"github.com/aws/aws-sdk-go/service/waf"
@@ -40,7 +43,7 @@ func TestAccWAFWebACL_basic(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
 					resource.TestCheckResourceAttr(resourceName, "rules.#", "0"),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "waf", regexp.MustCompile(`webacl/.+`)),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "waf", regexache.MustCompile(`webacl/.+`)),
 				),
 			},
 			{
diff --git a/internal/service/waf/xss_match_set.go b/internal/service/waf/xss_match_set.go
index 0cb05286fa8..9455219ab6b 100644
--- a/internal/service/waf/xss_match_set.go
+++ b/internal/service/waf/xss_match_set.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package waf
 
 import (
diff --git a/internal/service/waf/xss_match_set_test.go b/internal/service/waf/xss_match_set_test.go
index dedb61715e9..90dfb7cb24c 100644
--- a/internal/service/waf/xss_match_set_test.go
+++ b/internal/service/waf/xss_match_set_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package waf_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/waf"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -33,7 +36,7 @@ func TestAccWAFXSSMatchSet_basic(t *testing.T) {
 				Config: testAccXSSMatchSetConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckXSSMatchSetExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "waf", regexp.MustCompile(`xssmatchset/.+`)),
+					acctest.MatchResourceAttrGlobalARN(resourceName, "arn", "waf", regexache.MustCompile(`xssmatchset/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "xss_match_tuples.#", "2"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "xss_match_tuples.*", map[string]string{
diff --git a/internal/service/wafregional/byte_match_set.go b/internal/service/wafregional/byte_match_set.go
index 4356a30e0eb..92d042b2f19 100644
--- a/internal/service/wafregional/byte_match_set.go
+++ b/internal/service/wafregional/byte_match_set.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package wafregional
 
 import (
diff --git a/internal/service/wafregional/byte_match_set_test.go b/internal/service/wafregional/byte_match_set_test.go
index 03f1025675c..0fafcf21a3d 100644
--- a/internal/service/wafregional/byte_match_set_test.go
+++ b/internal/service/wafregional/byte_match_set_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package wafregional_test
 
 import (
diff --git a/internal/service/wafregional/find.go b/internal/service/wafregional/find.go
index 48a08e2bdd3..a46a57ffb7b 100644
--- a/internal/service/wafregional/find.go
+++ b/internal/service/wafregional/find.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package wafregional
 
 import (
diff --git a/internal/service/wafregional/generate.go b/internal/service/wafregional/generate.go
index b020002b513..0db74f64561 100644
--- a/internal/service/wafregional/generate.go
+++ b/internal/service/wafregional/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTags -ListTagsInIDElem=ResourceARN -ListTagsOutTagsElem=TagInfoForResource.TagList -ServiceTagsSlice -TagInIDElem=ResourceARN -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/wafregional/geo_match_set.go b/internal/service/wafregional/geo_match_set.go
index e8a3cc2ca79..b364b547b6a 100644
--- a/internal/service/wafregional/geo_match_set.go
+++ b/internal/service/wafregional/geo_match_set.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package wafregional
 
 import (
diff --git a/internal/service/wafregional/geo_match_set_test.go b/internal/service/wafregional/geo_match_set_test.go
index 9fb30ded885..cba3704ccbd 100644
--- a/internal/service/wafregional/geo_match_set_test.go
+++ b/internal/service/wafregional/geo_match_set_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package wafregional_test
 
 import (
diff --git a/internal/service/wafregional/ipset.go b/internal/service/wafregional/ipset.go
index 2abcf33061f..0c853db80f5 100644
--- a/internal/service/wafregional/ipset.go
+++ b/internal/service/wafregional/ipset.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package wafregional
 
 import (
diff --git a/internal/service/wafregional/ipset_data_source.go b/internal/service/wafregional/ipset_data_source.go
index 0ceb41bee00..f0da1915479 100644
--- a/internal/service/wafregional/ipset_data_source.go
+++ b/internal/service/wafregional/ipset_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package wafregional
 
 import (
diff --git a/internal/service/wafregional/ipset_data_source_test.go b/internal/service/wafregional/ipset_data_source_test.go
index 0f393796d2f..1396670ffc1 100644
--- a/internal/service/wafregional/ipset_data_source_test.go
+++ b/internal/service/wafregional/ipset_data_source_test.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package wafregional_test
 
 import (
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/wafregional"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -24,7 +27,7 @@ func TestAccWAFRegionalIPSetDataSource_basic(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccIPSetDataSourceConfig_nonExistent,
-				ExpectError: regexp.MustCompile(`WAF Regional IP Set not found`),
+				ExpectError: regexache.MustCompile(`WAF Regional IP Set not found`),
 			},
 			{
 				Config: testAccIPSetDataSourceConfig_name(name),
diff --git a/internal/service/wafregional/ipset_test.go b/internal/service/wafregional/ipset_test.go
index b10d10403ab..504569919bc 100644
--- a/internal/service/wafregional/ipset_test.go
+++ b/internal/service/wafregional/ipset_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package wafregional_test
 
 import (
@@ -5,10 +8,10 @@ import (
 	"fmt"
 	"net"
 	"reflect"
-	"regexp"
 	"strings"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/waf"
 	"github.com/aws/aws-sdk-go/service/wafregional"
@@ -42,7 +45,7 @@ func TestAccWAFRegionalIPSet_basic(t *testing.T) {
 						"type":  "IPV4",
 						"value": "192.0.7.0/24",
 					}),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "waf-regional", regexp.MustCompile("ipset/.+$")),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "waf-regional", regexache.MustCompile("ipset/.+$")),
 				),
 			},
 			{
diff --git a/internal/service/wafregional/rate_based_rule.go b/internal/service/wafregional/rate_based_rule.go
index f2620f19c66..7f58e5f2438 100644
--- a/internal/service/wafregional/rate_based_rule.go
+++ b/internal/service/wafregional/rate_based_rule.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package wafregional
 
 import (
diff --git a/internal/service/wafregional/rate_based_rule_data_source.go b/internal/service/wafregional/rate_based_rule_data_source.go
index 06aac3e1537..2212dcc33ee 100644
--- a/internal/service/wafregional/rate_based_rule_data_source.go
+++ b/internal/service/wafregional/rate_based_rule_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package wafregional
 
 import (
diff --git a/internal/service/wafregional/rate_based_rule_data_source_test.go b/internal/service/wafregional/rate_based_rule_data_source_test.go
index 5ae82b8ada7..73fb79eeccb 100644
--- a/internal/service/wafregional/rate_based_rule_data_source_test.go
+++ b/internal/service/wafregional/rate_based_rule_data_source_test.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package wafregional_test
 
 import (
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/wafregional"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -24,7 +27,7 @@ func TestAccWAFRegionalRateBasedRuleDataSource_basic(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccRateBasedRuleDataSourceConfig_nonExistent,
-				ExpectError: regexp.MustCompile(`WAF Rate Based Rules not found`),
+				ExpectError: regexache.MustCompile(`WAF Rate Based Rules not found`),
 			},
 			{
 				Config: testAccRateBasedRuleDataSourceConfig_name(name),
diff --git a/internal/service/wafregional/rate_based_rule_test.go b/internal/service/wafregional/rate_based_rule_test.go
index 653f59479dd..5ba7e07078e 100644
--- a/internal/service/wafregional/rate_based_rule_test.go
+++ b/internal/service/wafregional/rate_based_rule_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package wafregional_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/waf"
 	"github.com/aws/aws-sdk-go/service/wafregional"
@@ -33,7 +36,7 @@ func TestAccWAFRegionalRateBasedRule_basic(t *testing.T) {
 				Config: testAccRateBasedRuleConfig_basic(wafRuleName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRateBasedRuleExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "waf-regional", regexp.MustCompile(`ratebasedrule/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "waf-regional", regexache.MustCompile(`ratebasedrule/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "name", wafRuleName),
 					resource.TestCheckResourceAttr(resourceName, "predicate.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "metric_name", wafRuleName),
diff --git a/internal/service/wafregional/regex_match_set.go b/internal/service/wafregional/regex_match_set.go
index c3d04a973db..9f533d4fa56 100644
--- a/internal/service/wafregional/regex_match_set.go
+++ b/internal/service/wafregional/regex_match_set.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package wafregional
 
 import (
diff --git a/internal/service/wafregional/regex_match_set_test.go b/internal/service/wafregional/regex_match_set_test.go
index 05dd5bf1882..2d2224fdae3 100644
--- a/internal/service/wafregional/regex_match_set_test.go
+++ b/internal/service/wafregional/regex_match_set_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package wafregional_test
 
 import (
diff --git a/internal/service/wafregional/regex_pattern_set.go b/internal/service/wafregional/regex_pattern_set.go
index f8fb1b52f05..cc359469169 100644
--- a/internal/service/wafregional/regex_pattern_set.go
+++ b/internal/service/wafregional/regex_pattern_set.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package wafregional
 
 import (
diff --git a/internal/service/wafregional/regex_pattern_set_test.go b/internal/service/wafregional/regex_pattern_set_test.go
index a98377e245c..28fa75d0b23 100644
--- a/internal/service/wafregional/regex_pattern_set_test.go
+++ b/internal/service/wafregional/regex_pattern_set_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package wafregional_test
 
 import (
diff --git a/internal/service/wafregional/rule.go b/internal/service/wafregional/rule.go
index 371dc9aefcd..b6712fddb2f 100644
--- a/internal/service/wafregional/rule.go
+++ b/internal/service/wafregional/rule.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package wafregional
 
 import (
diff --git a/internal/service/wafregional/rule_data_source.go b/internal/service/wafregional/rule_data_source.go
index 7c58e99febc..66fc4ff73a7 100644
--- a/internal/service/wafregional/rule_data_source.go
+++ b/internal/service/wafregional/rule_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package wafregional
 
 import (
diff --git a/internal/service/wafregional/rule_data_source_test.go b/internal/service/wafregional/rule_data_source_test.go
index 35f5868bcf9..c3f1f67cd7d 100644
--- a/internal/service/wafregional/rule_data_source_test.go
+++ b/internal/service/wafregional/rule_data_source_test.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package wafregional_test
 
 import (
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/wafregional"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -24,7 +27,7 @@ func TestAccWAFRegionalRuleDataSource_basic(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccRuleDataSourceConfig_nonExistent,
-				ExpectError: regexp.MustCompile(`WAF Rule not found`),
+				ExpectError: regexache.MustCompile(`WAF Rule not found`),
 			},
 			{
 				Config: testAccRuleDataSourceConfig_name(name),
diff --git a/internal/service/wafregional/rule_group.go b/internal/service/wafregional/rule_group.go
index 6dfa7fb809d..23f52009aa1 100644
--- a/internal/service/wafregional/rule_group.go
+++ b/internal/service/wafregional/rule_group.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package wafregional
 
 import (
diff --git a/internal/service/wafregional/rule_group_test.go b/internal/service/wafregional/rule_group_test.go
index 476dacc8461..613827196c8 100644
--- a/internal/service/wafregional/rule_group_test.go
+++ b/internal/service/wafregional/rule_group_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package wafregional_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/waf"
 	"github.com/aws/aws-sdk-go/service/wafregional"
@@ -40,7 +43,7 @@ func TestAccWAFRegionalRuleGroup_basic(t *testing.T) {
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRuleExists(ctx, "aws_wafregional_rule.test", &rule),
 					testAccCheckRuleGroupExists(ctx, resourceName, &group),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "waf-regional", regexp.MustCompile(`rulegroup/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "waf-regional", regexache.MustCompile(`rulegroup/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "name", groupName),
 					resource.TestCheckResourceAttr(resourceName, "activated_rule.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "metric_name", groupName),
@@ -525,7 +528,7 @@ resource "aws_wafregional_rule_group" "test" {
 // which isn't static because ruleId is generated as part of the test
 func computeActivatedRuleWithRuleId(rule *waf.Rule, actionType string, priority int, idx *int) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		ruleResource := tfwafregional.ResourceRuleGroup().Schema["activated_rule"].Elem.(*schema.Resource)
+		ruleResource := tfwafregional.ResourceRuleGroup().SchemaMap()["activated_rule"].Elem.(*schema.Resource)
 
 		m := map[string]interface{}{
 			"action": []interface{}{
diff --git a/internal/service/wafregional/rule_test.go b/internal/service/wafregional/rule_test.go
index e6c4fcb6735..d042c02a708 100644
--- a/internal/service/wafregional/rule_test.go
+++ b/internal/service/wafregional/rule_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package wafregional_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/waf"
 	"github.com/aws/aws-sdk-go/service/wafregional"
@@ -35,7 +38,7 @@ func TestAccWAFRegionalRule_basic(t *testing.T) {
 				Config: testAccRuleConfig_basic(wafRuleName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRuleExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "waf-regional", regexp.MustCompile(`rule/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "waf-regional", regexache.MustCompile(`rule/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "name", wafRuleName),
 					resource.TestCheckResourceAttr(resourceName, "predicate.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "metric_name", wafRuleName),
@@ -250,7 +253,7 @@ func TestAccWAFRegionalRule_changePredicates(t *testing.T) {
 // Calculates the index which isn't static because dataId is generated as part of the test
 func computeRulePredicate(dataId **string, negated bool, pType string, idx *int) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		predicateResource := tfwafregional.ResourceRule().Schema["predicate"].Elem.(*schema.Resource)
+		predicateResource := tfwafregional.ResourceRule().SchemaMap()["predicate"].Elem.(*schema.Resource)
 		m := map[string]interface{}{
 			"data_id": **dataId,
 			"negated": negated,
diff --git a/internal/service/wafregional/service_package_gen.go b/internal/service/wafregional/service_package_gen.go
index 92b484e9012..2fc3536c951 100644
--- a/internal/service/wafregional/service_package_gen.go
+++ b/internal/service/wafregional/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	wafregional_sdkv1 "github.com/aws/aws-sdk-go/service/wafregional"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -131,4 +132,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*w
 	return wafregional_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/wafregional/size_constraint_set.go b/internal/service/wafregional/size_constraint_set.go
index 59d88fb3a30..68631524cb2 100644
--- a/internal/service/wafregional/size_constraint_set.go
+++ b/internal/service/wafregional/size_constraint_set.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package wafregional
 
 import (
diff --git a/internal/service/wafregional/size_constraint_set_test.go b/internal/service/wafregional/size_constraint_set_test.go
index c6ad9250a64..d616b49f9f9 100644
--- a/internal/service/wafregional/size_constraint_set_test.go
+++ b/internal/service/wafregional/size_constraint_set_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package wafregional_test
 
 import (
diff --git a/internal/service/wafregional/sql_injection_match_set.go b/internal/service/wafregional/sql_injection_match_set.go
index 43b9fb5b25c..08b4eb9e71c 100644
--- a/internal/service/wafregional/sql_injection_match_set.go
+++ b/internal/service/wafregional/sql_injection_match_set.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package wafregional
 
 import (
diff --git a/internal/service/wafregional/sql_injection_match_set_test.go b/internal/service/wafregional/sql_injection_match_set_test.go
index f16e8b95968..0081e7fec43 100644
--- a/internal/service/wafregional/sql_injection_match_set_test.go
+++ b/internal/service/wafregional/sql_injection_match_set_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package wafregional_test
 
 import (
diff --git a/internal/service/wafregional/subscribed_rule_group.go b/internal/service/wafregional/subscribed_rule_group.go
index c89d9efdac1..85090f20636 100644
--- a/internal/service/wafregional/subscribed_rule_group.go
+++ b/internal/service/wafregional/subscribed_rule_group.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package wafregional
 
 import (
diff --git a/internal/service/wafregional/subscribed_rule_group_test.go b/internal/service/wafregional/subscribed_rule_group_test.go
index 8b51e83fc10..42ad0966bb1 100644
--- a/internal/service/wafregional/subscribed_rule_group_test.go
+++ b/internal/service/wafregional/subscribed_rule_group_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package wafregional_test
 
 import (
 	"fmt"
 	"os"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/wafregional"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
@@ -35,7 +38,7 @@ func TestAccWAFRegionalSubscribedRuleGroupDataSource_basic(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccSubscribedRuleGroupDataSourceConfig_nonexistent,
-				ExpectError: regexp.MustCompile(`no matches found`),
+				ExpectError: regexache.MustCompile(`no matches found`),
 			},
 			{
 				Config: testAccSubscribedRuleGroupDataSourceConfig_name(ruleGroupName),
@@ -60,7 +63,7 @@ func TestAccWAFRegionalSubscribedRuleGroupDataSource_basic(t *testing.T) {
 			},
 			{
 				Config:      testAccDataSourceSubscribedRuleGroupDataSourceConfig_nameAndMismatchingMetricName(ruleGroupName),
-				ExpectError: regexp.MustCompile(`no matches found`),
+				ExpectError: regexache.MustCompile(`no matches found`),
 			},
 		},
 	})
diff --git a/internal/service/wafregional/sweep.go b/internal/service/wafregional/sweep.go
index a6a6221472d..8214c2cc63d 100644
--- a/internal/service/wafregional/sweep.go
+++ b/internal/service/wafregional/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package wafregional
 
@@ -16,9 +16,10 @@ import (
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	tfwaf "github.com/hashicorp/terraform-provider-aws/internal/service/waf"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_wafregional_rate_based_rule", &resource.Sweeper{
 		Name: "aws_wafregional_rate_based_rule",
 		F:    sweepRateBasedRules,
@@ -53,7 +54,7 @@ func init() {
 
 func sweepRateBasedRules(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -64,7 +65,7 @@ func sweepRateBasedRules(region string) error {
 	for {
 		output, err := conn.ListRateBasedRulesWithContext(ctx, input)
 
-		if sweep.SkipSweepError(err) {
+		if awsv1.SkipSweepError(err) {
 			log.Printf("[WARN] Skipping WAF Regional Rate-Based Rule sweep for %s: %s", region, err)
 			return nil
 		}
@@ -147,7 +148,7 @@ func sweepRateBasedRules(region string) error {
 
 func sweepRegexMatchSet(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -181,7 +182,7 @@ func sweepRegexMatchSet(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping WAF Regional Regex Match Set sweep for %s: %s", region, err)
 		return sweeperErrs.ErrorOrNil() // In case we have completed some pages, but had errors
 	}
@@ -194,7 +195,7 @@ func sweepRegexMatchSet(region string) error {
 
 func sweepRuleGroups(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -203,7 +204,7 @@ func sweepRuleGroups(region string) error {
 	req := &waf.ListRuleGroupsInput{}
 	resp, err := conn.ListRuleGroupsWithContext(ctx, req)
 	if err != nil {
-		if sweep.SkipSweepError(err) {
+		if awsv1.SkipSweepError(err) {
 			log.Printf("[WARN] Skipping WAF Regional Rule Group sweep for %s: %s", region, err)
 			return nil
 		}
@@ -234,7 +235,7 @@ func sweepRuleGroups(region string) error {
 
 func sweepRules(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -245,7 +246,7 @@ func sweepRules(region string) error {
 	for {
 		output, err := conn.ListRulesWithContext(ctx, input)
 
-		if sweep.SkipSweepError(err) {
+		if awsv1.SkipSweepError(err) {
 			log.Printf("[WARN] Skipping WAF Regional Rule sweep for %s: %s", region, err)
 			return nil
 		}
@@ -327,7 +328,7 @@ func sweepRules(region string) error {
 
 func sweepWebACLs(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -338,7 +339,7 @@ func sweepWebACLs(region string) error {
 	for {
 		output, err := conn.ListWebACLsWithContext(ctx, input)
 
-		if sweep.SkipSweepError(err) {
+		if awsv1.SkipSweepError(err) {
 			log.Printf("[WARN] Skipping WAF Regional Web ACL sweep for %s: %s", region, err)
 			return nil
 		}
diff --git a/internal/service/wafregional/tags_gen.go b/internal/service/wafregional/tags_gen.go
index 6ffcab4b19a..b38eb8154b5 100644
--- a/internal/service/wafregional/tags_gen.go
+++ b/internal/service/wafregional/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/waf"
 	"github.com/aws/aws-sdk-go/service/wafregional/wafregionaliface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -102,6 +104,8 @@ func updateTags(ctx context.Context, conn wafregionaliface.WAFRegionalAPI, ident
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.WAFRegional)
 	if len(removedTags) > 0 {
diff --git a/internal/service/wafregional/token_handlers.go b/internal/service/wafregional/token_handlers.go
index 2a4a2d8f9e6..67e4c9906a6 100644
--- a/internal/service/wafregional/token_handlers.go
+++ b/internal/service/wafregional/token_handlers.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package wafregional
 
 import (
diff --git a/internal/service/wafregional/validate.go b/internal/service/wafregional/validate.go
index 7a7198b709d..950025db21c 100644
--- a/internal/service/wafregional/validate.go
+++ b/internal/service/wafregional/validate.go
@@ -1,14 +1,18 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package wafregional
 
 import (
 	"fmt"
 	"reflect"
-	"regexp"
+
+	"github.com/YakDriver/regexache"
 )
 
 func validMetricName(v interface{}, k string) (ws []string, errors []error) {
 	value := v.(string)
-	if !regexp.MustCompile(`^[0-9A-Za-z]+$`).MatchString(value) {
+	if !regexache.MustCompile(`^[0-9A-Za-z]+$`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"Only alphanumeric characters allowed in %q: %q",
 			k, value))
diff --git a/internal/service/wafregional/validate_test.go b/internal/service/wafregional/validate_test.go
index 2b9da3bc418..0f4c857067a 100644
--- a/internal/service/wafregional/validate_test.go
+++ b/internal/service/wafregional/validate_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package wafregional
 
 import (
diff --git a/internal/service/wafregional/web_acl.go b/internal/service/wafregional/web_acl.go
index edd924b0496..c0b5465ba4f 100644
--- a/internal/service/wafregional/web_acl.go
+++ b/internal/service/wafregional/web_acl.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package wafregional
 
 import (
diff --git a/internal/service/wafregional/web_acl_association.go b/internal/service/wafregional/web_acl_association.go
index cbefa527376..a5160606b32 100644
--- a/internal/service/wafregional/web_acl_association.go
+++ b/internal/service/wafregional/web_acl_association.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package wafregional
 
 import (
@@ -60,7 +63,7 @@ func resourceWebACLAssociationCreate(ctx context.Context, d *schema.ResourceData
 	// create association and wait on retryable error
 	// no response body
 	var err error
-	err = retry.RetryContext(ctx, 2*time.Minute, func() *retry.RetryError {
+	err = retry.RetryContext(ctx, 5*time.Minute, func() *retry.RetryError {
 		_, err = conn.AssociateWebACLWithContext(ctx, params)
 		if err != nil {
 			if tfawserr.ErrCodeEquals(err, wafregional.ErrCodeWAFUnavailableEntityException) {
diff --git a/internal/service/wafregional/web_acl_association_test.go b/internal/service/wafregional/web_acl_association_test.go
index 91ac95446d3..6a4572779ba 100644
--- a/internal/service/wafregional/web_acl_association_test.go
+++ b/internal/service/wafregional/web_acl_association_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package wafregional_test
 
 import (
diff --git a/internal/service/wafregional/web_acl_data_source.go b/internal/service/wafregional/web_acl_data_source.go
index 165ec3e73e3..3e8d2c9e4df 100644
--- a/internal/service/wafregional/web_acl_data_source.go
+++ b/internal/service/wafregional/web_acl_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package wafregional
 
 import (
diff --git a/internal/service/wafregional/web_acl_data_source_test.go b/internal/service/wafregional/web_acl_data_source_test.go
index 4da507873c3..e4f038ca6c7 100644
--- a/internal/service/wafregional/web_acl_data_source_test.go
+++ b/internal/service/wafregional/web_acl_data_source_test.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package wafregional_test
 
 import (
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/wafregional"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -24,7 +27,7 @@ func TestAccWAFRegionalWebACLDataSource_basic(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccWebACLDataSourceConfig_nonExistent,
-				ExpectError: regexp.MustCompile(`web ACLs not found`),
+				ExpectError: regexache.MustCompile(`web ACLs not found`),
 			},
 			{
 				Config: testAccWebACLDataSourceConfig_name(name),
diff --git a/internal/service/wafregional/web_acl_test.go b/internal/service/wafregional/web_acl_test.go
index 07c02ee5388..a2b7d7625e9 100644
--- a/internal/service/wafregional/web_acl_test.go
+++ b/internal/service/wafregional/web_acl_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package wafregional_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/waf"
 	"github.com/aws/aws-sdk-go/service/wafregional"
@@ -35,7 +38,7 @@ func TestAccWAFRegionalWebACL_basic(t *testing.T) {
 				Config: testAccWebACLConfig_basic(wafAclName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckWebACLExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "waf-regional", regexp.MustCompile(`webacl/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "waf-regional", regexache.MustCompile(`webacl/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "default_action.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "default_action.0.type", "ALLOW"),
 					resource.TestCheckResourceAttr(resourceName, "name", wafAclName),
@@ -404,7 +407,7 @@ func TestAccWAFRegionalWebACL_logging(t *testing.T) {
 // Calculates the index which isn't static because ruleId is generated as part of the test
 func computeWebACLRuleIndex(ruleId **string, priority int, ruleType string, actionType string, idx *int) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		ruleResource := tfwafregional.ResourceWebACL().Schema["rule"].Elem.(*schema.Resource)
+		ruleResource := tfwafregional.ResourceWebACL().SchemaMap()["rule"].Elem.(*schema.Resource)
 		actionMap := map[string]interface{}{
 			"type": actionType,
 		}
diff --git a/internal/service/wafregional/xss_match_set.go b/internal/service/wafregional/xss_match_set.go
index ef2d74cf61b..1459036c8a5 100644
--- a/internal/service/wafregional/xss_match_set.go
+++ b/internal/service/wafregional/xss_match_set.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package wafregional
 
 import (
diff --git a/internal/service/wafregional/xss_match_set_test.go b/internal/service/wafregional/xss_match_set_test.go
index deb979218da..117643827b7 100644
--- a/internal/service/wafregional/xss_match_set_test.go
+++ b/internal/service/wafregional/xss_match_set_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package wafregional_test
 
 import (
diff --git a/internal/service/wafv2/consts.go b/internal/service/wafv2/consts.go
index 8a8e5ea9d85..a60ea16dbe1 100644
--- a/internal/service/wafv2/consts.go
+++ b/internal/service/wafv2/consts.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package wafv2
 
 const (
diff --git a/internal/service/wafv2/exports_test.go b/internal/service/wafv2/exports_test.go
new file mode 100644
index 00000000000..c5eda66392e
--- /dev/null
+++ b/internal/service/wafv2/exports_test.go
@@ -0,0 +1,10 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package wafv2
+
+// Exports for use in tests only.
+var (
+	ListRuleGroupsPages = listRuleGroupsPages
+	ListWebACLsPages    = listWebACLsPages
+)
diff --git a/internal/service/wafv2/flex.go b/internal/service/wafv2/flex.go
index d9458fe3eb6..ed64fead136 100644
--- a/internal/service/wafv2/flex.go
+++ b/internal/service/wafv2/flex.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package wafv2
 
 import (
@@ -71,6 +74,51 @@ func expandCaptchaConfig(l []interface{}) *wafv2.CaptchaConfig {
 	return configuration
 }
 
+func expandAssociationConfig(l []interface{}) *wafv2.AssociationConfig {
+	if len(l) == 0 || l[0] == nil {
+		return nil
+	}
+
+	configuration := &wafv2.AssociationConfig{}
+
+	m := l[0].(map[string]interface{})
+	if v, ok := m["request_body"]; ok {
+		inner := v.([]interface{})
+		if len(inner) == 0 || inner[0] == nil {
+			return configuration
+		}
+
+		m = inner[0].(map[string]interface{})
+		if len(m) > 0 {
+			configuration.RequestBody = make(map[string]*wafv2.RequestBodyAssociatedResourceTypeConfig)
+		}
+
+		if v, ok := m["cloudfront"]; ok {
+			inner = v.([]interface{})
+			configuration.RequestBody[wafv2.AssociatedResourceTypeCloudfront] = expandRequestBodyConfigItem(inner)
+		}
+	}
+
+	return configuration
+}
+
+func expandRequestBodyConfigItem(l []interface{}) *wafv2.RequestBodyAssociatedResourceTypeConfig {
+	configuration := &wafv2.RequestBodyAssociatedResourceTypeConfig{}
+
+	if len(l) == 0 || l[0] == nil {
+		return configuration
+	}
+
+	m := l[0].(map[string]interface{})
+	if v, ok := m["default_size_inspection_limit"]; ok {
+		if v != "" {
+			configuration.DefaultSizeInspectionLimit = aws.String(v.(string))
+		}
+	}
+
+	return configuration
+}
+
 func expandRuleLabels(l []interface{}) []*wafv2.Label {
 	if len(l) == 0 || l[0] == nil {
 		return nil
@@ -477,6 +525,10 @@ func expandFieldToMatch(l []interface{}) *wafv2.FieldToMatch {
 		f.SingleHeader = expandSingleHeader(m["single_header"].([]interface{}))
 	}
 
+	if v, ok := m["ja3_fingerprint"]; ok && len(v.([]interface{})) > 0 {
+		f.JA3Fingerprint = expandJA3Fingerprint(v.([]interface{}))
+	}
+
 	if v, ok := m["single_query_argument"]; ok && len(v.([]interface{})) > 0 {
 		f.SingleQueryArgument = expandSingleQueryArgument(m["single_query_argument"].([]interface{}))
 	}
@@ -593,6 +645,20 @@ func expandBody(l []interface{}) *wafv2.Body {
 	return body
 }
 
+func expandJA3Fingerprint(l []interface{}) *wafv2.JA3Fingerprint {
+	if len(l) == 0 || l[0] == nil {
+		return nil
+	}
+
+	m := l[0].(map[string]interface{})
+
+	ja3fingerprint := &wafv2.JA3Fingerprint{
+		FallbackBehavior: aws.String(m["fallback_behavior"].(string)),
+	}
+
+	return ja3fingerprint
+}
+
 func expandJSONMatchPattern(l []interface{}) *wafv2.JsonMatchPattern {
 	if len(l) == 0 || l[0] == nil {
 		return nil
@@ -1051,6 +1117,9 @@ func expandManagedRuleGroupConfigs(tfList []interface{}) []*wafv2.ManagedRuleGro
 		if v, ok := m["aws_managed_rules_bot_control_rule_set"].([]interface{}); ok && len(v) > 0 {
 			r.AWSManagedRulesBotControlRuleSet = expandManagedRulesBotControlRuleSet(v)
 		}
+		if v, ok := m["aws_managed_rules_acfp_rule_set"].([]interface{}); ok && len(v) > 0 {
+			r.AWSManagedRulesACFPRuleSet = expandManagedRulesACFPRuleSet(v)
+		}
 		if v, ok := m["aws_managed_rules_atp_rule_set"].([]interface{}); ok && len(v) > 0 {
 			r.AWSManagedRulesATPRuleSet = expandManagedRulesATPRuleSet(v)
 		}
@@ -1073,6 +1142,19 @@ func expandManagedRuleGroupConfigs(tfList []interface{}) []*wafv2.ManagedRuleGro
 	return out
 }
 
+func expandEmailField(tfList []interface{}) *wafv2.EmailField {
+	if len(tfList) == 0 || tfList[0] == nil {
+		return nil
+	}
+
+	m := tfList[0].(map[string]interface{})
+	out := wafv2.EmailField{
+		Identifier: aws.String(m["identifier"].(string)),
+	}
+
+	return &out
+}
+
 func expandPasswordField(tfList []interface{}) *wafv2.PasswordField {
 	if len(tfList) == 0 || tfList[0] == nil {
 		return nil
@@ -1112,6 +1194,30 @@ func expandManagedRulesBotControlRuleSet(tfList []interface{}) *wafv2.AWSManaged
 	return &out
 }
 
+func expandManagedRulesACFPRuleSet(tfList []interface{}) *wafv2.AWSManagedRulesACFPRuleSet {
+	if len(tfList) == 0 || tfList[0] == nil {
+		return nil
+	}
+
+	m := tfList[0].(map[string]interface{})
+	out := wafv2.AWSManagedRulesACFPRuleSet{
+		CreationPath:         aws.String(m["creation_path"].(string)),
+		RegistrationPagePath: aws.String(m["registration_page_path"].(string)),
+	}
+
+	if v, ok := m["enable_regex_in_path"].(bool); ok {
+		out.EnableRegexInPath = aws.Bool(v)
+	}
+	if v, ok := m["request_inspection"].([]interface{}); ok && len(v) > 0 {
+		out.RequestInspection = expandRequestInspectionACFP(v)
+	}
+	if v, ok := m["response_inspection"].([]interface{}); ok && len(v) > 0 {
+		out.ResponseInspection = expandResponseInspection(v)
+	}
+
+	return &out
+}
+
 func expandManagedRulesATPRuleSet(tfList []interface{}) *wafv2.AWSManagedRulesATPRuleSet {
 	if len(tfList) == 0 || tfList[0] == nil {
 		return nil
@@ -1122,6 +1228,9 @@ func expandManagedRulesATPRuleSet(tfList []interface{}) *wafv2.AWSManagedRulesAT
 		LoginPath: aws.String(m["login_path"].(string)),
 	}
 
+	if v, ok := m["enable_regex_in_path"].(bool); ok {
+		out.EnableRegexInPath = aws.Bool(v)
+	}
 	if v, ok := m["request_inspection"].([]interface{}); ok && len(v) > 0 {
 		out.RequestInspection = expandRequestInspection(v)
 	}
@@ -1147,6 +1256,22 @@ func expandRequestInspection(tfList []interface{}) *wafv2.RequestInspection {
 	return &out
 }
 
+func expandRequestInspectionACFP(tfList []interface{}) *wafv2.RequestInspectionACFP {
+	if len(tfList) == 0 || tfList[0] == nil {
+		return nil
+	}
+
+	m := tfList[0].(map[string]interface{})
+	out := wafv2.RequestInspectionACFP{
+		EmailField:    expandEmailField(m["email_field"].([]interface{})),
+		PasswordField: expandPasswordField(m["password_field"].([]interface{})),
+		PayloadType:   aws.String(m["payload_type"].(string)),
+		UsernameField: expandUsernameField(m["username_field"].([]interface{})),
+	}
+
+	return &out
+}
+
 func expandResponseInspection(tfList []interface{}) *wafv2.ResponseInspection {
 	if len(tfList) == 0 || tfList[0] == nil {
 		return nil
@@ -1228,6 +1353,109 @@ func expandStatusCode(tfList []interface{}) *wafv2.ResponseInspectionStatusCode
 	return &out
 }
 
+func expandRateLimitCookie(l []interface{}) *wafv2.RateLimitCookie {
+	if len(l) == 0 || l[0] == nil {
+		return nil
+	}
+	m := l[0].(map[string]interface{})
+	return &wafv2.RateLimitCookie{
+		Name:                aws.String(m["name"].(string)),
+		TextTransformations: expandTextTransformations(m["text_transformation"].(*schema.Set).List()),
+	}
+}
+
+func expandRateLimitHeader(l []interface{}) *wafv2.RateLimitHeader {
+	if len(l) == 0 || l[0] == nil {
+		return nil
+	}
+	m := l[0].(map[string]interface{})
+	return &wafv2.RateLimitHeader{
+		Name:                aws.String(m["name"].(string)),
+		TextTransformations: expandTextTransformations(m["text_transformation"].(*schema.Set).List()),
+	}
+}
+
+func expandRateLimitLabelNamespace(l []interface{}) *wafv2.RateLimitLabelNamespace {
+	if len(l) == 0 || l[0] == nil {
+		return nil
+	}
+	m := l[0].(map[string]interface{})
+	return &wafv2.RateLimitLabelNamespace{
+		Namespace: aws.String(m["namespace"].(string)),
+	}
+}
+
+func expandRateLimitQueryArgument(l []interface{}) *wafv2.RateLimitQueryArgument {
+	if len(l) == 0 || l[0] == nil {
+		return nil
+	}
+	m := l[0].(map[string]interface{})
+	return &wafv2.RateLimitQueryArgument{
+		Name:                aws.String(m["name"].(string)),
+		TextTransformations: expandTextTransformations(m["text_transformation"].(*schema.Set).List()),
+	}
+}
+
+func expandRateLimitQueryString(l []interface{}) *wafv2.RateLimitQueryString {
+	if len(l) == 0 || l[0] == nil {
+		return nil
+	}
+	m := l[0].(map[string]interface{})
+	return &wafv2.RateLimitQueryString{
+		TextTransformations: expandTextTransformations(m["text_transformation"].(*schema.Set).List()),
+	}
+}
+
+func expandRateLimitURIPath(l []interface{}) *wafv2.RateLimitUriPath {
+	if len(l) == 0 || l[0] == nil {
+		return nil
+	}
+	m := l[0].(map[string]interface{})
+	return &wafv2.RateLimitUriPath{
+		TextTransformations: expandTextTransformations(m["text_transformation"].(*schema.Set).List()),
+	}
+}
+
+func expandRateBasedStatementCustomKeys(l []interface{}) []*wafv2.RateBasedStatementCustomKey {
+	if len(l) == 0 {
+		return nil
+	}
+	out := make([]*wafv2.RateBasedStatementCustomKey, 0)
+	for _, ck := range l {
+		r := &wafv2.RateBasedStatementCustomKey{}
+		m := ck.(map[string]interface{})
+		if v, ok := m["cookie"]; ok {
+			r.Cookie = expandRateLimitCookie(v.([]interface{}))
+		}
+		if v, ok := m["forwarded_ip"]; ok && len(v.([]interface{})) > 0 {
+			r.ForwardedIP = &wafv2.RateLimitForwardedIP{}
+		}
+		if v, ok := m["http_method"]; ok && len(v.([]interface{})) > 0 {
+			r.HTTPMethod = &wafv2.RateLimitHTTPMethod{}
+		}
+		if v, ok := m["header"]; ok {
+			r.Header = expandRateLimitHeader(v.([]interface{}))
+		}
+		if v, ok := m["ip"]; ok && len(v.([]interface{})) > 0 {
+			r.IP = &wafv2.RateLimitIP{}
+		}
+		if v, ok := m["label_namespace"]; ok {
+			r.LabelNamespace = expandRateLimitLabelNamespace(v.([]interface{}))
+		}
+		if v, ok := m["query_argument"]; ok {
+			r.QueryArgument = expandRateLimitQueryArgument(v.([]interface{}))
+		}
+		if v, ok := m["query_string"]; ok {
+			r.QueryString = expandRateLimitQueryString(v.([]interface{}))
+		}
+		if v, ok := m["uri_path"]; ok {
+			r.UriPath = expandRateLimitURIPath(v.([]interface{}))
+		}
+		out = append(out, r)
+	}
+	return out
+}
+
 func expandRateBasedStatement(l []interface{}) *wafv2.RateBasedStatement {
 	if len(l) == 0 || l[0] == nil {
 		return nil
@@ -1243,6 +1471,10 @@ func expandRateBasedStatement(l []interface{}) *wafv2.RateBasedStatement {
 		r.ForwardedIPConfig = expandForwardedIPConfig(v.([]interface{}))
 	}
 
+	if v, ok := m["custom_key"]; ok {
+		r.CustomKeys = expandRateBasedStatementCustomKeys(v.([]interface{}))
+	}
+
 	s := m["scope_down_statement"].([]interface{})
 	if len(s) > 0 && s[0] != nil {
 		r.ScopeDownStatement = expandStatement(s[0].(map[string]interface{}))
@@ -1423,6 +1655,29 @@ func flattenCaptchaConfig(config *wafv2.CaptchaConfig) interface{} {
 	return []interface{}{m}
 }
 
+func flattenAssociationConfig(config *wafv2.AssociationConfig) interface{} {
+	associationConfig := []interface{}{}
+	if config == nil {
+		return associationConfig
+	}
+	if config.RequestBody == nil {
+		return associationConfig
+	}
+
+	cloudfrontRequestBodyConfig := config.RequestBody[wafv2.AssociatedResourceTypeCloudfront]
+	if cloudfrontRequestBodyConfig != nil {
+		associationConfig = append(associationConfig, map[string]interface{}{
+			"request_body": []map[string]interface{}{{
+				"cloudfront": []map[string]interface{}{{
+					"default_size_inspection_limit": aws.StringValue(cloudfrontRequestBodyConfig.DefaultSizeInspectionLimit),
+				}},
+			}},
+		})
+	}
+
+	return associationConfig
+}
+
 func flattenChallenge(a *wafv2.ChallengeAction) []interface{} {
 	if a == nil {
 		return []interface{}{}
@@ -1664,6 +1919,10 @@ func flattenFieldToMatch(f *wafv2.FieldToMatch) interface{} {
 		m["headers"] = flattenHeaders(f.Headers)
 	}
 
+	if f.JA3Fingerprint != nil {
+		m["ja3_fingerprint"] = flattenJA3Fingerprint(f.JA3Fingerprint)
+	}
+
 	if f.JsonBody != nil {
 		m["json_body"] = flattenJSONBody(f.JsonBody)
 	}
@@ -1749,6 +2008,18 @@ func flattenCookiesMatchPattern(c *wafv2.CookieMatchPattern) interface{} {
 	return []interface{}{m}
 }
 
+func flattenJA3Fingerprint(j *wafv2.JA3Fingerprint) interface{} {
+	if j == nil {
+		return []interface{}{}
+	}
+
+	m := map[string]interface{}{
+		"fallback_behavior": aws.StringValue(j.FallbackBehavior),
+	}
+
+	return []interface{}{m}
+}
+
 func flattenJSONBody(b *wafv2.JsonBody) interface{} {
 	if b == nil {
 		return []interface{}{}
@@ -2184,6 +2455,9 @@ func flattenManagedRuleGroupConfigs(c []*wafv2.ManagedRuleGroupConfig) []interfa
 
 	for _, config := range c {
 		m := make(map[string]interface{})
+		if config.AWSManagedRulesACFPRuleSet != nil {
+			m["aws_managed_rules_acfp_rule_set"] = flattenManagedRulesACFPRuleSet(config.AWSManagedRulesACFPRuleSet)
+		}
 		if config.AWSManagedRulesBotControlRuleSet != nil {
 			m["aws_managed_rules_bot_control_rule_set"] = flattenManagedRulesBotControlRuleSet(config.AWSManagedRulesBotControlRuleSet)
 		}
@@ -2209,6 +2483,18 @@ func flattenManagedRuleGroupConfigs(c []*wafv2.ManagedRuleGroupConfig) []interfa
 	return out
 }
 
+func flattenEmailField(apiObject *wafv2.EmailField) []interface{} {
+	if apiObject == nil {
+		return nil
+	}
+
+	m := map[string]interface{}{
+		"identifier": aws.StringValue(apiObject.Identifier),
+	}
+
+	return []interface{}{m}
+}
+
 func flattenPasswordField(apiObject *wafv2.PasswordField) []interface{} {
 	if apiObject == nil {
 		return nil
@@ -2245,13 +2531,34 @@ func flattenManagedRulesBotControlRuleSet(apiObject *wafv2.AWSManagedRulesBotCon
 	return []interface{}{m}
 }
 
+func flattenManagedRulesACFPRuleSet(apiObject *wafv2.AWSManagedRulesACFPRuleSet) []interface{} {
+	if apiObject == nil {
+		return nil
+	}
+
+	m := map[string]interface{}{
+		"enable_regex_in_path":   aws.BoolValue(apiObject.EnableRegexInPath),
+		"creation_path":          aws.StringValue(apiObject.CreationPath),
+		"registration_page_path": aws.StringValue(apiObject.RegistrationPagePath),
+	}
+	if apiObject.RequestInspection != nil {
+		m["request_inspection"] = flattenRequestInspectionACFP(apiObject.RequestInspection)
+	}
+	if apiObject.ResponseInspection != nil {
+		m["response_inspection"] = flattenResponseInspection(apiObject.ResponseInspection)
+	}
+
+	return []interface{}{m}
+}
+
 func flattenManagedRulesATPRuleSet(apiObject *wafv2.AWSManagedRulesATPRuleSet) []interface{} {
 	if apiObject == nil {
 		return nil
 	}
 
 	m := map[string]interface{}{
-		"login_path": aws.StringValue(apiObject.LoginPath),
+		"enable_regex_in_path": aws.BoolValue(apiObject.EnableRegexInPath),
+		"login_path":           aws.StringValue(apiObject.LoginPath),
 	}
 	if apiObject.RequestInspection != nil {
 		m["request_inspection"] = flattenRequestInspection(apiObject.RequestInspection)
@@ -2263,6 +2570,21 @@ func flattenManagedRulesATPRuleSet(apiObject *wafv2.AWSManagedRulesATPRuleSet) [
 	return []interface{}{m}
 }
 
+func flattenRequestInspectionACFP(apiObject *wafv2.RequestInspectionACFP) []interface{} {
+	if apiObject == nil {
+		return nil
+	}
+
+	m := map[string]interface{}{
+		"email_field":    flattenEmailField(apiObject.EmailField),
+		"password_field": flattenPasswordField(apiObject.PasswordField),
+		"payload_type":   aws.StringValue(apiObject.PayloadType),
+		"username_field": flattenUsernameField(apiObject.UsernameField),
+	}
+
+	return []interface{}{m}
+}
+
 func flattenRequestInspection(apiObject *wafv2.RequestInspection) []interface{} {
 	if apiObject == nil {
 		return nil
@@ -2306,7 +2628,7 @@ func flattenBodyContains(apiObject *wafv2.ResponseInspectionBodyContains) []inte
 
 	m := map[string]interface{}{
 		"failure_strings": flex.FlattenStringSet(apiObject.FailureStrings),
-		"succeed_strings": flex.FlattenStringSet(apiObject.SuccessStrings),
+		"success_strings": flex.FlattenStringSet(apiObject.SuccessStrings),
 	}
 
 	return []interface{}{m}
@@ -2319,7 +2641,7 @@ func flattenHeader(apiObject *wafv2.ResponseInspectionHeader) []interface{} {
 
 	m := map[string]interface{}{
 		"failure_values": flex.FlattenStringSet(apiObject.FailureValues),
-		"succeed_values": flex.FlattenStringSet(apiObject.SuccessValues),
+		"success_values": flex.FlattenStringSet(apiObject.SuccessValues),
 	}
 
 	return []interface{}{m}
@@ -2333,7 +2655,7 @@ func flattenResponseInspectionJSON(apiObject *wafv2.ResponseInspectionJson) []in
 	m := map[string]interface{}{
 		"failure_values": flex.FlattenStringSet(apiObject.FailureValues),
 		"identifier":     aws.StringValue(apiObject.Identifier),
-		"succeed_values": flex.FlattenStringSet(apiObject.SuccessValues),
+		"success_values": flex.FlattenStringSet(apiObject.SuccessValues),
 	}
 
 	return []interface{}{m}
@@ -2352,6 +2674,122 @@ func flattenStatusCode(apiObject *wafv2.ResponseInspectionStatusCode) []interfac
 	return []interface{}{m}
 }
 
+func flattenRateLimitCookie(apiObject *wafv2.RateLimitCookie) []interface{} {
+	if apiObject == nil {
+		return nil
+	}
+	return []interface{}{
+		map[string]interface{}{
+			"name":                aws.StringValue(apiObject.Name),
+			"text_transformation": flattenTextTransformations(apiObject.TextTransformations),
+		},
+	}
+}
+
+func flattenRateLimitHeader(apiObject *wafv2.RateLimitHeader) []interface{} {
+	if apiObject == nil {
+		return nil
+	}
+	return []interface{}{
+		map[string]interface{}{
+			"name":                aws.StringValue(apiObject.Name),
+			"text_transformation": flattenTextTransformations(apiObject.TextTransformations),
+		},
+	}
+}
+
+func flattenRateLimitLabelNamespace(apiObject *wafv2.RateLimitLabelNamespace) []interface{} {
+	if apiObject == nil {
+		return nil
+	}
+	return []interface{}{
+		map[string]interface{}{
+			"namespace": aws.StringValue(apiObject.Namespace),
+		},
+	}
+}
+
+func flattenRateLimitQueryArgument(apiObject *wafv2.RateLimitQueryArgument) []interface{} {
+	if apiObject == nil {
+		return nil
+	}
+	return []interface{}{
+		map[string]interface{}{
+			"name":                aws.StringValue(apiObject.Name),
+			"text_transformation": flattenTextTransformations(apiObject.TextTransformations),
+		},
+	}
+}
+
+func flattenRateLimitQueryString(apiObject *wafv2.RateLimitQueryString) []interface{} {
+	if apiObject == nil {
+		return nil
+	}
+	return []interface{}{
+		map[string]interface{}{
+			"text_transformation": flattenTextTransformations(apiObject.TextTransformations),
+		},
+	}
+}
+
+func flattenRateLimitURIPath(apiObject *wafv2.RateLimitUriPath) []interface{} {
+	if apiObject == nil {
+		return nil
+	}
+	return []interface{}{
+		map[string]interface{}{
+			"text_transformation": flattenTextTransformations(apiObject.TextTransformations),
+		},
+	}
+}
+
+func flattenRateBasedStatementCustomKeys(apiObject []*wafv2.RateBasedStatementCustomKey) []interface{} {
+	if apiObject == nil {
+		return nil
+	}
+
+	out := make([]interface{}, len(apiObject))
+	for i, o := range apiObject {
+		tfMap := map[string]interface{}{}
+
+		if o.Cookie != nil {
+			tfMap["cookie"] = flattenRateLimitCookie(o.Cookie)
+		}
+		if o.ForwardedIP != nil {
+			tfMap["forwarded_ip"] = []interface{}{
+				map[string]interface{}{},
+			}
+		}
+		if o.HTTPMethod != nil {
+			tfMap["http_method"] = []interface{}{
+				map[string]interface{}{},
+			}
+		}
+		if o.Header != nil {
+			tfMap["header"] = flattenRateLimitHeader(o.Header)
+		}
+		if o.IP != nil {
+			tfMap["ip"] = []interface{}{
+				map[string]interface{}{},
+			}
+		}
+		if o.LabelNamespace != nil {
+			tfMap["label_namespace"] = flattenRateLimitLabelNamespace(o.LabelNamespace)
+		}
+		if o.QueryArgument != nil {
+			tfMap["query_argument"] = flattenRateLimitQueryArgument(o.QueryArgument)
+		}
+		if o.QueryString != nil {
+			tfMap["query_string"] = flattenRateLimitQueryString(o.QueryString)
+		}
+		if o.UriPath != nil {
+			tfMap["uri_path"] = flattenRateLimitURIPath(o.UriPath)
+		}
+		out[i] = tfMap
+	}
+	return out
+}
+
 func flattenRateBasedStatement(apiObject *wafv2.RateBasedStatement) interface{} {
 	if apiObject == nil {
 		return []interface{}{}
@@ -2367,6 +2805,10 @@ func flattenRateBasedStatement(apiObject *wafv2.RateBasedStatement) interface{}
 		tfMap["forwarded_ip_config"] = flattenForwardedIPConfig(apiObject.ForwardedIPConfig)
 	}
 
+	if apiObject.CustomKeys != nil {
+		tfMap["custom_key"] = flattenRateBasedStatementCustomKeys(apiObject.CustomKeys)
+	}
+
 	if apiObject.Limit != nil {
 		tfMap["limit"] = int(aws.Int64Value(apiObject.Limit))
 	}
diff --git a/internal/service/wafv2/generate.go b/internal/service/wafv2/generate.go
index 40307f5b272..640e200ab1e 100644
--- a/internal/service/wafv2/generate.go
+++ b/internal/service/wafv2/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/listpages/main.go -ListOps=ListIPSets,ListRegexPatternSets,ListRuleGroups,ListWebACLs -Paginator=NextMarker
 //go:generate go run ../../generate/tags/main.go -ListTags -ListTagsInIDElem=ResourceARN -ListTagsOutTagsElem=TagInfoForResource.TagList -ServiceTagsSlice -TagInIDElem=ResourceARN -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
diff --git a/internal/service/wafv2/ip_set.go b/internal/service/wafv2/ip_set.go
index 51a7742cd2e..3595c224ab1 100644
--- a/internal/service/wafv2/ip_set.go
+++ b/internal/service/wafv2/ip_set.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package wafv2
 
 import (
@@ -18,6 +21,7 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/flex"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	itypes "github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -51,69 +55,71 @@ func ResourceIPSet() *schema.Resource {
 			},
 		},
 
-		Schema: map[string]*schema.Schema{
-			"addresses": {
-				Type:     schema.TypeSet,
-				Optional: true,
-				MaxItems: 10000,
-				Elem:     &schema.Schema{Type: schema.TypeString},
-				DiffSuppressFunc: func(k, old, new string, d *schema.ResourceData) bool {
-					if d.GetRawPlan().GetAttr("addresses").IsWhollyKnown() {
-						o, n := d.GetChange("addresses")
-						oldAddresses := o.(*schema.Set).List()
-						newAddresses := n.(*schema.Set).List()
-						if len(oldAddresses) == len(newAddresses) {
-							for _, ov := range oldAddresses {
-								hasAddress := false
-								for _, nv := range newAddresses {
-									if verify.CIDRBlocksEqual(ov.(string), nv.(string)) {
-										hasAddress = true
-										break
+		SchemaFunc: func() map[string]*schema.Schema {
+			return map[string]*schema.Schema{
+				"addresses": {
+					Type:     schema.TypeSet,
+					Optional: true,
+					MaxItems: 10000,
+					Elem:     &schema.Schema{Type: schema.TypeString},
+					DiffSuppressFunc: func(k, old, new string, d *schema.ResourceData) bool {
+						if d.GetRawPlan().GetAttr("addresses").IsWhollyKnown() {
+							o, n := d.GetChange("addresses")
+							oldAddresses := o.(*schema.Set).List()
+							newAddresses := n.(*schema.Set).List()
+							if len(oldAddresses) == len(newAddresses) {
+								for _, ov := range oldAddresses {
+									hasAddress := false
+									for _, nv := range newAddresses {
+										if itypes.CIDRBlocksEqual(ov.(string), nv.(string)) {
+											hasAddress = true
+											break
+										}
+									}
+									if !hasAddress {
+										return false
 									}
 								}
-								if !hasAddress {
-									return false
-								}
+								return true
 							}
-							return true
 						}
-					}
-					return false
+						return false
+					},
 				},
-			},
-			"arn": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
-			"description": {
-				Type:         schema.TypeString,
-				Optional:     true,
-				ValidateFunc: validation.StringLenBetween(1, 256),
-			},
-			"ip_address_version": {
-				Type:         schema.TypeString,
-				Required:     true,
-				ForceNew:     true,
-				ValidateFunc: validation.StringInSlice(wafv2.IPAddressVersion_Values(), false),
-			},
-			"lock_token": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
-			"name": {
-				Type:         schema.TypeString,
-				Required:     true,
-				ForceNew:     true,
-				ValidateFunc: validation.StringLenBetween(1, 128),
-			},
-			"scope": {
-				Type:         schema.TypeString,
-				Required:     true,
-				ForceNew:     true,
-				ValidateFunc: validation.StringInSlice(wafv2.Scope_Values(), false),
-			},
-			names.AttrTags:    tftags.TagsSchema(),
-			names.AttrTagsAll: tftags.TagsSchemaComputed(),
+				"arn": {
+					Type:     schema.TypeString,
+					Computed: true,
+				},
+				"description": {
+					Type:         schema.TypeString,
+					Optional:     true,
+					ValidateFunc: validation.StringLenBetween(1, 256),
+				},
+				"ip_address_version": {
+					Type:         schema.TypeString,
+					Required:     true,
+					ForceNew:     true,
+					ValidateFunc: validation.StringInSlice(wafv2.IPAddressVersion_Values(), false),
+				},
+				"lock_token": {
+					Type:     schema.TypeString,
+					Computed: true,
+				},
+				"name": {
+					Type:         schema.TypeString,
+					Required:     true,
+					ForceNew:     true,
+					ValidateFunc: validation.StringLenBetween(1, 128),
+				},
+				"scope": {
+					Type:         schema.TypeString,
+					Required:     true,
+					ForceNew:     true,
+					ValidateFunc: validation.StringInSlice(wafv2.Scope_Values(), false),
+				},
+				names.AttrTags:    tftags.TagsSchema(),
+				names.AttrTagsAll: tftags.TagsSchemaComputed(),
+			}
 		},
 
 		CustomizeDiff: verify.SetTagsDiff,
diff --git a/internal/service/wafv2/ip_set_data_source.go b/internal/service/wafv2/ip_set_data_source.go
index bb064259011..fecabb3d9fe 100644
--- a/internal/service/wafv2/ip_set_data_source.go
+++ b/internal/service/wafv2/ip_set_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package wafv2
 
 import (
@@ -18,33 +21,35 @@ func DataSourceIPSet() *schema.Resource {
 	return &schema.Resource{
 		ReadWithoutTimeout: dataSourceIPSetRead,
 
-		Schema: map[string]*schema.Schema{
-			"addresses": {
-				Type:     schema.TypeSet,
-				Computed: true,
-				Elem:     &schema.Schema{Type: schema.TypeString},
-			},
-			"arn": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
-			"description": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
-			"ip_address_version": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
-			"name": {
-				Type:     schema.TypeString,
-				Required: true,
-			},
-			"scope": {
-				Type:         schema.TypeString,
-				Required:     true,
-				ValidateFunc: validation.StringInSlice(wafv2.Scope_Values(), false),
-			},
+		SchemaFunc: func() map[string]*schema.Schema {
+			return map[string]*schema.Schema{
+				"addresses": {
+					Type:     schema.TypeSet,
+					Computed: true,
+					Elem:     &schema.Schema{Type: schema.TypeString},
+				},
+				"arn": {
+					Type:     schema.TypeString,
+					Computed: true,
+				},
+				"description": {
+					Type:     schema.TypeString,
+					Computed: true,
+				},
+				"ip_address_version": {
+					Type:     schema.TypeString,
+					Computed: true,
+				},
+				"name": {
+					Type:     schema.TypeString,
+					Required: true,
+				},
+				"scope": {
+					Type:         schema.TypeString,
+					Required:     true,
+					ValidateFunc: validation.StringInSlice(wafv2.Scope_Values(), false),
+				},
+			}
 		},
 	}
 }
diff --git a/internal/service/wafv2/ip_set_data_source_test.go b/internal/service/wafv2/ip_set_data_source_test.go
index 7bfdce319bd..18cc7e3d3c8 100644
--- a/internal/service/wafv2/ip_set_data_source_test.go
+++ b/internal/service/wafv2/ip_set_data_source_test.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package wafv2_test
 
 import (
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/wafv2"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -24,14 +27,14 @@ func TestAccWAFV2IPSetDataSource_basic(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccIPSetDataSourceConfig_nonExistent(name),
-				ExpectError: regexp.MustCompile(`WAFv2 IPSet not found`),
+				ExpectError: regexache.MustCompile(`WAFv2 IPSet not found`),
 			},
 			{
 				Config: testAccIPSetDataSourceConfig_name(name),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttrPair(datasourceName, "addresses", resourceName, "addresses"),
 					resource.TestCheckResourceAttrPair(datasourceName, "arn", resourceName, "arn"),
-					acctest.MatchResourceAttrRegionalARN(datasourceName, "arn", "wafv2", regexp.MustCompile(fmt.Sprintf("regional/ipset/%v/.+$", name))),
+					acctest.MatchResourceAttrRegionalARN(datasourceName, "arn", "wafv2", regexache.MustCompile(fmt.Sprintf("regional/ipset/%v/.+$", name))),
 					resource.TestCheckResourceAttrPair(datasourceName, "description", resourceName, "description"),
 					resource.TestCheckResourceAttrPair(datasourceName, "id", resourceName, "id"),
 					resource.TestCheckResourceAttrPair(datasourceName, "ip_address_version", resourceName, "ip_address_version"),
diff --git a/internal/service/wafv2/ip_set_test.go b/internal/service/wafv2/ip_set_test.go
index 82a427cb70e..8094ffe5d28 100644
--- a/internal/service/wafv2/ip_set_test.go
+++ b/internal/service/wafv2/ip_set_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package wafv2_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/wafv2"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -32,7 +35,7 @@ func TestAccWAFV2IPSet_basic(t *testing.T) {
 				Config: testAccIPSetConfig_basic(ipSetName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckIPSetExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/ipset/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/ipset/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "name", ipSetName),
 					resource.TestCheckResourceAttr(resourceName, "description", ipSetName),
 					resource.TestCheckResourceAttr(resourceName, "scope", wafv2.ScopeRegional),
@@ -47,7 +50,7 @@ func TestAccWAFV2IPSet_basic(t *testing.T) {
 				Config: testAccIPSetConfig_update(ipSetName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckIPSetExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/ipset/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/ipset/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "name", ipSetName),
 					resource.TestCheckResourceAttr(resourceName, "description", "Updated"),
 					resource.TestCheckResourceAttr(resourceName, "scope", wafv2.ScopeRegional),
@@ -105,7 +108,7 @@ func TestAccWAFV2IPSet_ipv6(t *testing.T) {
 				Config: testAccIPSetConfig_v6(ipSetName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckIPSetExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/ipset/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/ipset/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "name", ipSetName),
 					resource.TestCheckResourceAttr(resourceName, "description", ipSetName),
 					resource.TestCheckResourceAttr(resourceName, "scope", wafv2.ScopeRegional),
@@ -142,7 +145,7 @@ func TestAccWAFV2IPSet_minimal(t *testing.T) {
 				Config: testAccIPSetConfig_minimal(ipSetName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckIPSetExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/ipset/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/ipset/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "name", ipSetName),
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
 					resource.TestCheckResourceAttr(resourceName, "scope", wafv2.ScopeRegional),
@@ -177,7 +180,7 @@ func TestAccWAFV2IPSet_changeNameForceNew(t *testing.T) {
 				Config: testAccIPSetConfig_basic(ipSetName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckIPSetExists(ctx, resourceName, &before),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/ipset/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/ipset/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "name", ipSetName),
 					resource.TestCheckResourceAttr(resourceName, "description", ipSetName),
 					resource.TestCheckResourceAttr(resourceName, "scope", wafv2.ScopeRegional),
@@ -189,7 +192,7 @@ func TestAccWAFV2IPSet_changeNameForceNew(t *testing.T) {
 				Config: testAccIPSetConfig_basic(ipSetNewName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckIPSetExists(ctx, resourceName, &after),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/ipset/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/ipset/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "name", ipSetNewName),
 					resource.TestCheckResourceAttr(resourceName, "description", ipSetNewName),
 					resource.TestCheckResourceAttr(resourceName, "scope", wafv2.ScopeRegional),
@@ -240,7 +243,7 @@ func TestAccWAFV2IPSet_tags(t *testing.T) {
 				Config: testAccIPSetConfig_oneTag(ipSetName, "Tag1", "Value1"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckIPSetExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/ipset/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/ipset/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags.Tag1", "Value1"),
 				),
@@ -255,7 +258,7 @@ func TestAccWAFV2IPSet_tags(t *testing.T) {
 				Config: testAccIPSetConfig_twoTags(ipSetName, "Tag1", "Value1Updated", "Tag2", "Value2"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckIPSetExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/ipset/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/ipset/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
 					resource.TestCheckResourceAttr(resourceName, "tags.Tag1", "Value1Updated"),
 					resource.TestCheckResourceAttr(resourceName, "tags.Tag2", "Value2"),
@@ -265,7 +268,7 @@ func TestAccWAFV2IPSet_tags(t *testing.T) {
 				Config: testAccIPSetConfig_oneTag(ipSetName, "Tag2", "Value2"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckIPSetExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/ipset/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/ipset/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags.Tag2", "Value2"),
 				),
@@ -290,7 +293,7 @@ func TestAccWAFV2IPSet_large(t *testing.T) {
 				Config: testAccIPSetConfig_large(ipSetName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckIPSetExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/ipset/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/ipset/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "name", ipSetName),
 					resource.TestCheckResourceAttr(resourceName, "description", ipSetName),
 					resource.TestCheckResourceAttr(resourceName, "scope", wafv2.ScopeRegional),
diff --git a/internal/service/wafv2/regex_pattern_set.go b/internal/service/wafv2/regex_pattern_set.go
index 0569eebd036..8c2a86d8ea0 100644
--- a/internal/service/wafv2/regex_pattern_set.go
+++ b/internal/service/wafv2/regex_pattern_set.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package wafv2
 
 import (
@@ -50,51 +53,53 @@ func ResourceRegexPatternSet() *schema.Resource {
 			},
 		},
 
-		Schema: map[string]*schema.Schema{
-			"arn": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
-			"description": {
-				Type:         schema.TypeString,
-				Optional:     true,
-				ValidateFunc: validation.StringLenBetween(1, 256),
-			},
-			"lock_token": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
-			"name": {
-				Type:         schema.TypeString,
-				Required:     true,
-				ForceNew:     true,
-				ValidateFunc: validation.StringLenBetween(1, 128),
-			},
-			"regular_expression": {
-				Type:     schema.TypeSet,
-				Optional: true,
-				MaxItems: 10,
-				Elem: &schema.Resource{
-					Schema: map[string]*schema.Schema{
-						"regex_string": {
-							Type:     schema.TypeString,
-							Required: true,
-							ValidateFunc: validation.All(
-								validation.StringLenBetween(1, 200),
-								validation.StringIsValidRegExp,
-							),
+		SchemaFunc: func() map[string]*schema.Schema {
+			return map[string]*schema.Schema{
+				"arn": {
+					Type:     schema.TypeString,
+					Computed: true,
+				},
+				"description": {
+					Type:         schema.TypeString,
+					Optional:     true,
+					ValidateFunc: validation.StringLenBetween(1, 256),
+				},
+				"lock_token": {
+					Type:     schema.TypeString,
+					Computed: true,
+				},
+				"name": {
+					Type:         schema.TypeString,
+					Required:     true,
+					ForceNew:     true,
+					ValidateFunc: validation.StringLenBetween(1, 128),
+				},
+				"regular_expression": {
+					Type:     schema.TypeSet,
+					Optional: true,
+					MaxItems: 10,
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"regex_string": {
+								Type:     schema.TypeString,
+								Required: true,
+								ValidateFunc: validation.All(
+									validation.StringLenBetween(1, 200),
+									validation.StringIsValidRegExp,
+								),
+							},
 						},
 					},
 				},
-			},
-			"scope": {
-				Type:         schema.TypeString,
-				Required:     true,
-				ForceNew:     true,
-				ValidateFunc: validation.StringInSlice(wafv2.Scope_Values(), false),
-			},
-			names.AttrTags:    tftags.TagsSchema(),
-			names.AttrTagsAll: tftags.TagsSchemaComputed(),
+				"scope": {
+					Type:         schema.TypeString,
+					Required:     true,
+					ForceNew:     true,
+					ValidateFunc: validation.StringInSlice(wafv2.Scope_Values(), false),
+				},
+				names.AttrTags:    tftags.TagsSchema(),
+				names.AttrTagsAll: tftags.TagsSchemaComputed(),
+			}
 		},
 
 		CustomizeDiff: verify.SetTagsDiff,
diff --git a/internal/service/wafv2/regex_pattern_set_data_source.go b/internal/service/wafv2/regex_pattern_set_data_source.go
index 14f9d8f055c..b0965ff8134 100644
--- a/internal/service/wafv2/regex_pattern_set_data_source.go
+++ b/internal/service/wafv2/regex_pattern_set_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package wafv2
 
 import (
@@ -17,36 +20,38 @@ func DataSourceRegexPatternSet() *schema.Resource {
 	return &schema.Resource{
 		ReadWithoutTimeout: dataSourceRegexPatternSetRead,
 
-		Schema: map[string]*schema.Schema{
-			"arn": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
-			"description": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
-			"name": {
-				Type:     schema.TypeString,
-				Required: true,
-			},
-			"regular_expression": {
-				Type:     schema.TypeSet,
-				Computed: true,
-				Elem: &schema.Resource{
-					Schema: map[string]*schema.Schema{
-						"regex_string": {
-							Type:     schema.TypeString,
-							Computed: true,
+		SchemaFunc: func() map[string]*schema.Schema {
+			return map[string]*schema.Schema{
+				"arn": {
+					Type:     schema.TypeString,
+					Computed: true,
+				},
+				"description": {
+					Type:     schema.TypeString,
+					Computed: true,
+				},
+				"name": {
+					Type:     schema.TypeString,
+					Required: true,
+				},
+				"regular_expression": {
+					Type:     schema.TypeSet,
+					Computed: true,
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"regex_string": {
+								Type:     schema.TypeString,
+								Computed: true,
+							},
 						},
 					},
 				},
-			},
-			"scope": {
-				Type:         schema.TypeString,
-				Required:     true,
-				ValidateFunc: validation.StringInSlice(wafv2.Scope_Values(), false),
-			},
+				"scope": {
+					Type:         schema.TypeString,
+					Required:     true,
+					ValidateFunc: validation.StringInSlice(wafv2.Scope_Values(), false),
+				},
+			}
 		},
 	}
 }
diff --git a/internal/service/wafv2/regex_pattern_set_data_source_test.go b/internal/service/wafv2/regex_pattern_set_data_source_test.go
index fbb067123e4..3f52da10a38 100644
--- a/internal/service/wafv2/regex_pattern_set_data_source_test.go
+++ b/internal/service/wafv2/regex_pattern_set_data_source_test.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package wafv2_test
 
 import (
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/wafv2"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -24,13 +27,13 @@ func TestAccWAFV2RegexPatternSetDataSource_basic(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccRegexPatternSetDataSourceConfig_nonExistent(name),
-				ExpectError: regexp.MustCompile(`WAFv2 RegexPatternSet not found`),
+				ExpectError: regexache.MustCompile(`WAFv2 RegexPatternSet not found`),
 			},
 			{
 				Config: testAccRegexPatternSetDataSourceConfig_name(name),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttrPair(datasourceName, "arn", resourceName, "arn"),
-					acctest.MatchResourceAttrRegionalARN(datasourceName, "arn", "wafv2", regexp.MustCompile(fmt.Sprintf("regional/regexpatternset/%v/.+$", name))),
+					acctest.MatchResourceAttrRegionalARN(datasourceName, "arn", "wafv2", regexache.MustCompile(fmt.Sprintf("regional/regexpatternset/%v/.+$", name))),
 					resource.TestCheckResourceAttrPair(datasourceName, "description", resourceName, "description"),
 					resource.TestCheckResourceAttrPair(datasourceName, "id", resourceName, "id"),
 					resource.TestCheckResourceAttrPair(datasourceName, "name", resourceName, "name"),
diff --git a/internal/service/wafv2/regex_pattern_set_test.go b/internal/service/wafv2/regex_pattern_set_test.go
index 9fe335b3d01..eed3da0c43c 100644
--- a/internal/service/wafv2/regex_pattern_set_test.go
+++ b/internal/service/wafv2/regex_pattern_set_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package wafv2_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/wafv2"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -32,7 +35,7 @@ func TestAccWAFV2RegexPatternSet_basic(t *testing.T) {
 				Config: testAccRegexPatternSetConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRegexPatternSetExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/regexpatternset/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/regexpatternset/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "description", rName),
 					resource.TestCheckResourceAttr(resourceName, "scope", wafv2.ScopeRegional),
@@ -50,7 +53,7 @@ func TestAccWAFV2RegexPatternSet_basic(t *testing.T) {
 				Config: testAccRegexPatternSetConfig_update(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRegexPatternSetExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/regexpatternset/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/regexpatternset/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "description", "Updated"),
 					resource.TestCheckResourceAttr(resourceName, "scope", wafv2.ScopeRegional),
@@ -117,7 +120,7 @@ func TestAccWAFV2RegexPatternSet_minimal(t *testing.T) {
 				Config: testAccRegexPatternSetConfig_minimal(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRegexPatternSetExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/regexpatternset/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/regexpatternset/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
 					resource.TestCheckResourceAttr(resourceName, "scope", wafv2.ScopeRegional),
@@ -145,7 +148,7 @@ func TestAccWAFV2RegexPatternSet_changeNameForceNew(t *testing.T) {
 				Config: testAccRegexPatternSetConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRegexPatternSetExists(ctx, resourceName, &before),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/regexpatternset/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/regexpatternset/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "name", rName),
 					resource.TestCheckResourceAttr(resourceName, "description", rName),
 					resource.TestCheckResourceAttr(resourceName, "scope", wafv2.ScopeRegional),
@@ -156,7 +159,7 @@ func TestAccWAFV2RegexPatternSet_changeNameForceNew(t *testing.T) {
 				Config: testAccRegexPatternSetConfig_basic(rNewName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRegexPatternSetExists(ctx, resourceName, &after),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/regexpatternset/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/regexpatternset/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "name", rNewName),
 					resource.TestCheckResourceAttr(resourceName, "description", rNewName),
 					resource.TestCheckResourceAttr(resourceName, "scope", wafv2.ScopeRegional),
@@ -183,7 +186,7 @@ func TestAccWAFV2RegexPatternSet_tags(t *testing.T) {
 				Config: testAccRegexPatternSetConfig_oneTag(rName, "Tag1", "Value1"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRegexPatternSetExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/regexpatternset/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/regexpatternset/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags.Tag1", "Value1"),
 				),
@@ -198,7 +201,7 @@ func TestAccWAFV2RegexPatternSet_tags(t *testing.T) {
 				Config: testAccRegexPatternSetConfig_twoTags(rName, "Tag1", "Value1Updated", "Tag2", "Value2"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRegexPatternSetExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/regexpatternset/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/regexpatternset/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
 					resource.TestCheckResourceAttr(resourceName, "tags.Tag1", "Value1Updated"),
 					resource.TestCheckResourceAttr(resourceName, "tags.Tag2", "Value2"),
@@ -208,7 +211,7 @@ func TestAccWAFV2RegexPatternSet_tags(t *testing.T) {
 				Config: testAccRegexPatternSetConfig_oneTag(rName, "Tag2", "Value2"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRegexPatternSetExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/regexpatternset/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/regexpatternset/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
 					resource.TestCheckResourceAttr(resourceName, "tags.Tag2", "Value2"),
 				),
diff --git a/internal/service/wafv2/rule_group.go b/internal/service/wafv2/rule_group.go
index 4e839aeb935..bf0a0440edd 100644
--- a/internal/service/wafv2/rule_group.go
+++ b/internal/service/wafv2/rule_group.go
@@ -1,21 +1,26 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package wafv2
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"strings"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/wafv2"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/create"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
@@ -53,80 +58,95 @@ func ResourceRuleGroup() *schema.Resource {
 			},
 		},
 
-		Schema: map[string]*schema.Schema{
-			"arn": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
-			"capacity": {
-				Type:         schema.TypeInt,
-				Required:     true,
-				ForceNew:     true,
-				ValidateFunc: validation.IntAtLeast(1),
-			},
-			"custom_response_body": customResponseBodySchema(),
-			"description": {
-				Type:         schema.TypeString,
-				Optional:     true,
-				ValidateFunc: validation.StringLenBetween(1, 256),
-			},
-			"lock_token": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
-			"name": {
-				Type:     schema.TypeString,
-				Required: true,
-				ForceNew: true,
-				ValidateFunc: validation.All(
-					validation.StringLenBetween(1, 128),
-					validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9-_]+$`), "must contain only alphanumeric hyphen and underscore characters"),
-				),
-			},
-			"rule": {
-				Type:     schema.TypeSet,
-				Optional: true,
-				Elem: &schema.Resource{
-					Schema: map[string]*schema.Schema{
-						"action": {
-							Type:     schema.TypeList,
-							Required: true,
-							MaxItems: 1,
-							Elem: &schema.Resource{
-								Schema: map[string]*schema.Schema{
-									"allow":     allowConfigSchema(),
-									"block":     blockConfigSchema(),
-									"captcha":   captchaConfigSchema(),
-									"challenge": challengeConfigSchema(),
-									"count":     countConfigSchema(),
+		SchemaFunc: func() map[string]*schema.Schema {
+			return map[string]*schema.Schema{
+				"arn": {
+					Type:     schema.TypeString,
+					Computed: true,
+				},
+				"capacity": {
+					Type:         schema.TypeInt,
+					Required:     true,
+					ForceNew:     true,
+					ValidateFunc: validation.IntAtLeast(1),
+				},
+				"custom_response_body": customResponseBodySchema(),
+				"description": {
+					Type:         schema.TypeString,
+					Optional:     true,
+					ValidateFunc: validation.StringLenBetween(1, 256),
+				},
+				"lock_token": {
+					Type:     schema.TypeString,
+					Computed: true,
+				},
+				"name": {
+					Type:          schema.TypeString,
+					Optional:      true,
+					Computed:      true,
+					ForceNew:      true,
+					ConflictsWith: []string{"name_prefix"},
+					ValidateFunc: validation.All(
+						validation.StringLenBetween(1, 128),
+						validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_-]+$`), "must contain only alphanumeric hyphen and underscore characters"),
+					),
+				},
+				"name_prefix": {
+					Type:          schema.TypeString,
+					Optional:      true,
+					Computed:      true,
+					ForceNew:      true,
+					ConflictsWith: []string{"name"},
+					ValidateFunc: validation.All(
+						validation.StringLenBetween(1, 128-id.UniqueIDSuffixLength),
+						validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_-]+$`), "must contain only alphanumeric hyphen and underscore characters"),
+					),
+				},
+				"rule": {
+					Type:     schema.TypeSet,
+					Optional: true,
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"action": {
+								Type:     schema.TypeList,
+								Required: true,
+								MaxItems: 1,
+								Elem: &schema.Resource{
+									Schema: map[string]*schema.Schema{
+										"allow":     allowConfigSchema(),
+										"block":     blockConfigSchema(),
+										"captcha":   captchaConfigSchema(),
+										"challenge": challengeConfigSchema(),
+										"count":     countConfigSchema(),
+									},
 								},
 							},
+							"captcha_config": outerCaptchaConfigSchema(),
+							"name": {
+								Type:         schema.TypeString,
+								Required:     true,
+								ValidateFunc: validation.StringLenBetween(1, 128),
+							},
+							"priority": {
+								Type:     schema.TypeInt,
+								Required: true,
+							},
+							"rule_label":        ruleLabelsSchema(),
+							"statement":         ruleGroupRootStatementSchema(ruleGroupRootStatementSchemaLevel),
+							"visibility_config": visibilityConfigSchema(),
 						},
-						"captcha_config": outerCaptchaConfigSchema(),
-						"name": {
-							Type:         schema.TypeString,
-							Required:     true,
-							ValidateFunc: validation.StringLenBetween(1, 128),
-						},
-						"priority": {
-							Type:     schema.TypeInt,
-							Required: true,
-						},
-						"rule_label":        ruleLabelsSchema(),
-						"statement":         ruleGroupRootStatementSchema(ruleGroupRootStatementSchemaLevel),
-						"visibility_config": visibilityConfigSchema(),
 					},
 				},
-			},
-			"scope": {
-				Type:         schema.TypeString,
-				Required:     true,
-				ForceNew:     true,
-				ValidateFunc: validation.StringInSlice(wafv2.Scope_Values(), false),
-			},
-			names.AttrTags:      tftags.TagsSchema(),
-			names.AttrTagsAll:   tftags.TagsSchemaComputed(),
-			"visibility_config": visibilityConfigSchema(),
+				"scope": {
+					Type:         schema.TypeString,
+					Required:     true,
+					ForceNew:     true,
+					ValidateFunc: validation.StringInSlice(wafv2.Scope_Values(), false),
+				},
+				names.AttrTags:      tftags.TagsSchema(),
+				names.AttrTagsAll:   tftags.TagsSchemaComputed(),
+				"visibility_config": visibilityConfigSchema(),
+			}
 		},
 
 		CustomizeDiff: verify.SetTagsDiff,
@@ -136,7 +156,7 @@ func ResourceRuleGroup() *schema.Resource {
 func resourceRuleGroupCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	conn := meta.(*conns.AWSClient).WAFV2Conn(ctx)
 
-	name := d.Get("name").(string)
+	name := create.Name(d.Get("name").(string), d.Get("name_prefix").(string))
 	input := &wafv2.CreateRuleGroupInput{
 		Capacity:         aws.Int64(int64(d.Get("capacity").(int))),
 		Name:             aws.String(name),
@@ -162,9 +182,8 @@ func resourceRuleGroupCreate(ctx context.Context, d *schema.ResourceData, meta i
 		return diag.Errorf("creating WAFv2 RuleGroup (%s): %s", name, err)
 	}
 
-	output := outputRaw.(*wafv2.CreateRuleGroupOutput)
-
-	d.SetId(aws.StringValue(output.Summary.Id))
+	d.SetId(aws.StringValue(outputRaw.(*wafv2.CreateRuleGroupOutput).Summary.Id))
+	d.Set("name", name) // Required in Read.
 
 	return resourceRuleGroupRead(ctx, d, meta)
 }
@@ -193,6 +212,7 @@ func resourceRuleGroupRead(ctx context.Context, d *schema.ResourceData, meta int
 	d.Set("description", ruleGroup.Description)
 	d.Set("lock_token", output.LockToken)
 	d.Set("name", ruleGroup.Name)
+	d.Set("name_prefix", create.NamePrefixFromName(aws.StringValue(ruleGroup.Name)))
 	if err := d.Set("rule", flattenRules(ruleGroup.Rules)); err != nil {
 		return diag.Errorf("setting rule: %s", err)
 	}
@@ -224,7 +244,6 @@ func resourceRuleGroupUpdate(ctx context.Context, d *schema.ResourceData, meta i
 			input.Description = aws.String(v.(string))
 		}
 
-		log.Printf("[INFO] Updating WAFv2 RuleGroup: %s", input)
 		_, err := tfresource.RetryWhenAWSErrCodeEquals(ctx, ruleGroupUpdateTimeout, func() (interface{}, error) {
 			return conn.UpdateRuleGroupWithContext(ctx, input)
 		}, wafv2.ErrCodeWAFUnavailableEntityException)
diff --git a/internal/service/wafv2/rule_group_data_source.go b/internal/service/wafv2/rule_group_data_source.go
index 615ef6939e3..df3c50c5f92 100644
--- a/internal/service/wafv2/rule_group_data_source.go
+++ b/internal/service/wafv2/rule_group_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package wafv2
 
 import (
@@ -17,24 +20,26 @@ func DataSourceRuleGroup() *schema.Resource {
 	return &schema.Resource{
 		ReadWithoutTimeout: dataSourceRuleGroupRead,
 
-		Schema: map[string]*schema.Schema{
-			"arn": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
-			"description": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
-			"name": {
-				Type:     schema.TypeString,
-				Required: true,
-			},
-			"scope": {
-				Type:         schema.TypeString,
-				Required:     true,
-				ValidateFunc: validation.StringInSlice(wafv2.Scope_Values(), false),
-			},
+		SchemaFunc: func() map[string]*schema.Schema {
+			return map[string]*schema.Schema{
+				"arn": {
+					Type:     schema.TypeString,
+					Computed: true,
+				},
+				"description": {
+					Type:     schema.TypeString,
+					Computed: true,
+				},
+				"name": {
+					Type:     schema.TypeString,
+					Required: true,
+				},
+				"scope": {
+					Type:         schema.TypeString,
+					Required:     true,
+					ValidateFunc: validation.StringInSlice(wafv2.Scope_Values(), false),
+				},
+			}
 		},
 	}
 }
diff --git a/internal/service/wafv2/rule_group_data_source_test.go b/internal/service/wafv2/rule_group_data_source_test.go
index 34b23867be1..5aea4cfec0d 100644
--- a/internal/service/wafv2/rule_group_data_source_test.go
+++ b/internal/service/wafv2/rule_group_data_source_test.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package wafv2_test
 
 import (
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/wafv2"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -24,13 +27,13 @@ func TestAccWAFV2RuleGroupDataSource_basic(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccRuleGroupDataSourceConfig_nonExistent(name),
-				ExpectError: regexp.MustCompile(`WAFv2 RuleGroup not found`),
+				ExpectError: regexache.MustCompile(`WAFv2 RuleGroup not found`),
 			},
 			{
 				Config: testAccRuleGroupDataSourceConfig_name(name),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttrPair(datasourceName, "arn", resourceName, "arn"),
-					acctest.MatchResourceAttrRegionalARN(datasourceName, "arn", "wafv2", regexp.MustCompile(fmt.Sprintf("regional/rulegroup/%v/.+$", name))),
+					acctest.MatchResourceAttrRegionalARN(datasourceName, "arn", "wafv2", regexache.MustCompile(fmt.Sprintf("regional/rulegroup/%v/.+$", name))),
 					resource.TestCheckResourceAttrPair(datasourceName, "description", resourceName, "description"),
 					resource.TestCheckResourceAttrPair(datasourceName, "id", resourceName, "id"),
 					resource.TestCheckResourceAttrPair(datasourceName, "name", resourceName, "name"),
diff --git a/internal/service/wafv2/rule_group_test.go b/internal/service/wafv2/rule_group_test.go
index cf0834abac3..44ccd43a608 100644
--- a/internal/service/wafv2/rule_group_test.go
+++ b/internal/service/wafv2/rule_group_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package wafv2_test
 
 import (
@@ -6,8 +9,10 @@ import (
 	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/wafv2"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
@@ -33,7 +38,7 @@ func TestAccWAFV2RuleGroup_basic(t *testing.T) {
 				Config: testAccRuleGroupConfig_basic(ruleGroupName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRuleGroupExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/rulegroup/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/rulegroup/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "capacity", "2"),
 					resource.TestCheckResourceAttr(resourceName, "name", ruleGroupName),
 					resource.TestCheckResourceAttr(resourceName, "description", ruleGroupName),
@@ -56,6 +61,64 @@ func TestAccWAFV2RuleGroup_basic(t *testing.T) {
 	})
 }
 
+func TestAccWAFV2RuleGroup_nameGenerated(t *testing.T) {
+	ctx := acctest.Context(t)
+	var v wafv2.RuleGroup
+	resourceName := "aws_wafv2_rule_group.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheckScopeRegional(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, wafv2.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckRuleGroupDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccRuleGroupConfig_nameGenerated(),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckRuleGroupExists(ctx, resourceName, &v),
+					acctest.CheckResourceAttrNameGenerated(resourceName, "name"),
+					resource.TestCheckResourceAttr(resourceName, "name_prefix", id.UniqueIdPrefix),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+				ImportStateIdFunc: testAccRuleGroupImportStateIdFunc(resourceName),
+			},
+		},
+	})
+}
+
+func TestAccWAFV2RuleGroup_namePrefix(t *testing.T) {
+	ctx := acctest.Context(t)
+	var v wafv2.RuleGroup
+	resourceName := "aws_wafv2_rule_group.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheckScopeRegional(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, wafv2.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckRuleGroupDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccRuleGroupConfig_namePrefix("tf-acc-test-prefix-"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckRuleGroupExists(ctx, resourceName, &v),
+					acctest.CheckResourceAttrNameFromPrefix(resourceName, "name", "tf-acc-test-prefix-"),
+					resource.TestCheckResourceAttr(resourceName, "name_prefix", "tf-acc-test-prefix-"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+				ImportStateIdFunc: testAccRuleGroupImportStateIdFunc(resourceName),
+			},
+		},
+	})
+}
+
 func TestAccWAFV2RuleGroup_updateRule(t *testing.T) {
 	ctx := acctest.Context(t)
 	var v wafv2.RuleGroup
@@ -72,7 +135,7 @@ func TestAccWAFV2RuleGroup_updateRule(t *testing.T) {
 				Config: testAccRuleGroupConfig_basic(ruleGroupName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRuleGroupExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/rulegroup/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/rulegroup/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "capacity", "2"),
 					resource.TestCheckResourceAttr(resourceName, "name", ruleGroupName),
 					resource.TestCheckResourceAttr(resourceName, "description", ruleGroupName),
@@ -89,7 +152,7 @@ func TestAccWAFV2RuleGroup_updateRule(t *testing.T) {
 				Config: testAccRuleGroupConfig_basicUpdate(ruleGroupName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRuleGroupExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/rulegroup/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/rulegroup/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "capacity", "50"),
 					resource.TestCheckResourceAttr(resourceName, "name", ruleGroupName),
 					resource.TestCheckResourceAttr(resourceName, "description", "Updated"),
@@ -142,7 +205,7 @@ func TestAccWAFV2RuleGroup_updateRuleProperties(t *testing.T) {
 				Config: testAccRuleGroupConfig_basicUpdate(ruleGroupName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRuleGroupExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/rulegroup/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/rulegroup/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "capacity", "50"),
 					resource.TestCheckResourceAttr(resourceName, "name", ruleGroupName),
 					resource.TestCheckResourceAttr(resourceName, "description", "Updated"),
@@ -176,7 +239,7 @@ func TestAccWAFV2RuleGroup_updateRuleProperties(t *testing.T) {
 				Config: testAccRuleGroupConfig_updateMultiples(ruleGroupName, "rule-1", ruleName2, 1, 2),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRuleGroupExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/rulegroup/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/rulegroup/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "capacity", "50"),
 					resource.TestCheckResourceAttr(resourceName, "name", ruleGroupName),
 					resource.TestCheckResourceAttr(resourceName, "description", "Updated"),
@@ -240,7 +303,7 @@ func TestAccWAFV2RuleGroup_updateRuleProperties(t *testing.T) {
 				Config: testAccRuleGroupConfig_updateMultiples(ruleGroupName, "rule-1", "updated", 5, 10),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRuleGroupExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/rulegroup/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/rulegroup/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "capacity", "50"),
 					resource.TestCheckResourceAttr(resourceName, "name", ruleGroupName),
 					resource.TestCheckResourceAttr(resourceName, "description", "Updated"),
@@ -325,7 +388,7 @@ func TestAccWAFV2RuleGroup_byteMatchStatement(t *testing.T) {
 				Config: testAccRuleGroupConfig_byteMatchStatement(ruleGroupName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRuleGroupExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/rulegroup/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/rulegroup/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
 						"statement.#":                        "1",
@@ -348,7 +411,7 @@ func TestAccWAFV2RuleGroup_byteMatchStatement(t *testing.T) {
 				Config: testAccRuleGroupConfig_byteMatchStatementUpdate(ruleGroupName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRuleGroupExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/rulegroup/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/rulegroup/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
 						"statement.#":                        "1",
@@ -389,7 +452,7 @@ func TestAccWAFV2RuleGroup_ByteMatchStatement_fieldToMatch(t *testing.T) {
 				Config: testAccRuleGroupConfig_byteMatchStatementFieldToMatchAllQueryArguments(ruleGroupName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRuleGroupExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/rulegroup/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/rulegroup/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
 						"statement.#":                                         "1",
@@ -412,7 +475,7 @@ func TestAccWAFV2RuleGroup_ByteMatchStatement_fieldToMatch(t *testing.T) {
 				Config: testAccRuleGroupConfig_byteMatchStatementFieldToMatchBody(ruleGroupName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRuleGroupExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/rulegroup/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/rulegroup/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
 						"statement.#":                                         "1",
@@ -435,7 +498,7 @@ func TestAccWAFV2RuleGroup_ByteMatchStatement_fieldToMatch(t *testing.T) {
 				Config: testAccRuleGroupConfig_byteMatchStatementFieldToMatchCookies(ruleGroupName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRuleGroupExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/rulegroup/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/rulegroup/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
 						"statement.#":                                         "1",
@@ -463,7 +526,7 @@ func TestAccWAFV2RuleGroup_ByteMatchStatement_fieldToMatch(t *testing.T) {
 				Config: testAccRuleGroupConfig_byteMatchStatementFieldToMatchJSONBody(ruleGroupName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRuleGroupExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/rulegroup/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/rulegroup/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
 						"statement.#":                                                                                      "1",
@@ -484,7 +547,7 @@ func TestAccWAFV2RuleGroup_ByteMatchStatement_fieldToMatch(t *testing.T) {
 				Config: testAccRuleGroupConfig_byteMatchStatementFieldToMatchHeadersMatchPatternAll(ruleGroupName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRuleGroupExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/rulegroup/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/rulegroup/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
 						"statement.#":                                         "1",
@@ -513,7 +576,7 @@ func TestAccWAFV2RuleGroup_ByteMatchStatement_fieldToMatch(t *testing.T) {
 				Config: testAccRuleGroupConfig_byteMatchStatementFieldToMatchHeadersMatchPatternIncludedHeaders(ruleGroupName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRuleGroupExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/rulegroup/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/rulegroup/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
 						"statement.#":                                         "1",
@@ -544,7 +607,7 @@ func TestAccWAFV2RuleGroup_ByteMatchStatement_fieldToMatch(t *testing.T) {
 				Config: testAccRuleGroupConfig_byteMatchStatementFieldToMatchHeadersMatchPatternExcludedHeaders(ruleGroupName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRuleGroupExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/rulegroup/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/rulegroup/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
 						"statement.#":                                         "1",
@@ -573,13 +636,13 @@ func TestAccWAFV2RuleGroup_ByteMatchStatement_fieldToMatch(t *testing.T) {
 			},
 			{
 				Config:      testAccRuleGroupConfig_byteMatchStatementFieldToMatchHeadersInvalidConfiguration(ruleGroupName),
-				ExpectError: regexp.MustCompile(`argument "oversize_handling" is required`),
+				ExpectError: regexache.MustCompile(`argument "oversize_handling" is required`),
 			},
 			{
 				Config: testAccRuleGroupConfig_byteMatchStatementFieldToMatchMethod(ruleGroupName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRuleGroupExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/rulegroup/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/rulegroup/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
 						"statement.#":                                         "1",
@@ -602,7 +665,7 @@ func TestAccWAFV2RuleGroup_ByteMatchStatement_fieldToMatch(t *testing.T) {
 				Config: testAccRuleGroupConfig_byteMatchStatementFieldToMatchQueryString(ruleGroupName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRuleGroupExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/rulegroup/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/rulegroup/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
 						"statement.#":                                         "1",
@@ -625,7 +688,7 @@ func TestAccWAFV2RuleGroup_ByteMatchStatement_fieldToMatch(t *testing.T) {
 				Config: testAccRuleGroupConfig_byteMatchStatementFieldToMatchSingleHeader(ruleGroupName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRuleGroupExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/rulegroup/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/rulegroup/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
 						"statement.#":                                         "1",
@@ -649,7 +712,7 @@ func TestAccWAFV2RuleGroup_ByteMatchStatement_fieldToMatch(t *testing.T) {
 				Config: testAccRuleGroupConfig_byteMatchStatementFieldToMatchSingleQueryArgument(ruleGroupName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRuleGroupExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/rulegroup/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/rulegroup/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
 						"statement.#":                                         "1",
@@ -673,7 +736,7 @@ func TestAccWAFV2RuleGroup_ByteMatchStatement_fieldToMatch(t *testing.T) {
 				Config: testAccRuleGroupConfig_byteMatchStatementFieldToMatchURIPath(ruleGroupName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRuleGroupExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/rulegroup/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/rulegroup/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
 						"statement.#":                                         "1",
@@ -719,7 +782,7 @@ func TestAccWAFV2RuleGroup_changeNameForceNew(t *testing.T) {
 				Config: testAccRuleGroupConfig_basic(ruleGroupName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRuleGroupExists(ctx, resourceName, &before),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/rulegroup/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/rulegroup/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "capacity", "2"),
 					resource.TestCheckResourceAttr(resourceName, "name", ruleGroupName),
 					resource.TestCheckResourceAttr(resourceName, "description", ruleGroupName),
@@ -735,7 +798,7 @@ func TestAccWAFV2RuleGroup_changeNameForceNew(t *testing.T) {
 				Config: testAccRuleGroupConfig_basic(ruleGroupNewName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRuleGroupExists(ctx, resourceName, &after),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/rulegroup/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/rulegroup/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "capacity", "2"),
 					resource.TestCheckResourceAttr(resourceName, "name", ruleGroupNewName),
 					resource.TestCheckResourceAttr(resourceName, "description", ruleGroupNewName),
@@ -767,7 +830,7 @@ func TestAccWAFV2RuleGroup_changeCapacityForceNew(t *testing.T) {
 				Config: testAccRuleGroupConfig_basic(ruleGroupName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRuleGroupExists(ctx, resourceName, &before),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/rulegroup/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/rulegroup/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "capacity", "2"),
 					resource.TestCheckResourceAttr(resourceName, "name", ruleGroupName),
 					resource.TestCheckResourceAttr(resourceName, "description", ruleGroupName),
@@ -783,7 +846,7 @@ func TestAccWAFV2RuleGroup_changeCapacityForceNew(t *testing.T) {
 				Config: testAccRuleGroupConfig_updateCapacity(ruleGroupName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRuleGroupExists(ctx, resourceName, &after),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/rulegroup/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/rulegroup/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "capacity", "3"),
 					resource.TestCheckResourceAttr(resourceName, "name", ruleGroupName),
 					resource.TestCheckResourceAttr(resourceName, "description", ruleGroupName),
@@ -815,7 +878,7 @@ func TestAccWAFV2RuleGroup_changeMetricNameForceNew(t *testing.T) {
 				Config: testAccRuleGroupConfig_basic(ruleGroupName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRuleGroupExists(ctx, resourceName, &before),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/rulegroup/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/rulegroup/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "capacity", "2"),
 					resource.TestCheckResourceAttr(resourceName, "name", ruleGroupName),
 					resource.TestCheckResourceAttr(resourceName, "description", ruleGroupName),
@@ -831,7 +894,7 @@ func TestAccWAFV2RuleGroup_changeMetricNameForceNew(t *testing.T) {
 				Config: testAccRuleGroupConfig_updateMetricName(ruleGroupName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRuleGroupExists(ctx, resourceName, &after),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/rulegroup/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/rulegroup/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "capacity", "2"),
 					resource.TestCheckResourceAttr(resourceName, "name", ruleGroupName),
 					resource.TestCheckResourceAttr(resourceName, "description", ruleGroupName),
@@ -887,7 +950,7 @@ func TestAccWAFV2RuleGroup_RuleLabels(t *testing.T) {
 				Config: testAccRuleGroupConfig_labels(ruleGroupName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRuleGroupExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/rulegroup/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/rulegroup/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
 						"rule_label.#":      "2",
@@ -900,7 +963,7 @@ func TestAccWAFV2RuleGroup_RuleLabels(t *testing.T) {
 				Config: testAccRuleGroupConfig_noLabels(ruleGroupName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRuleGroupExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/rulegroup/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/rulegroup/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
 						"rule_label.#": "0",
@@ -933,7 +996,7 @@ func TestAccWAFV2RuleGroup_geoMatchStatement(t *testing.T) {
 				Config: testAccRuleGroupConfig_geoMatchStatement(ruleGroupName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRuleGroupExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/rulegroup/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/rulegroup/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
 						"statement.#":                                             "1",
@@ -949,7 +1012,7 @@ func TestAccWAFV2RuleGroup_geoMatchStatement(t *testing.T) {
 				Config: testAccRuleGroupConfig_geoMatchStatementUpdate(ruleGroupName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRuleGroupExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/rulegroup/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/rulegroup/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
 						"statement.#":                                             "1",
@@ -988,7 +1051,7 @@ func TestAccWAFV2RuleGroup_GeoMatchStatement_forwardedIP(t *testing.T) {
 				Config: testAccRuleGroupConfig_geoMatchStatementForwardedIP(ruleGroupName, "MATCH", "X-Forwarded-For"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRuleGroupExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/rulegroup/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/rulegroup/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
 						"statement.#":                                                               "1",
@@ -1006,7 +1069,7 @@ func TestAccWAFV2RuleGroup_GeoMatchStatement_forwardedIP(t *testing.T) {
 				Config: testAccRuleGroupConfig_geoMatchStatementForwardedIP(ruleGroupName, "NO_MATCH", "Updated"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRuleGroupExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/rulegroup/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/rulegroup/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
 						"statement.#":                                                               "1",
@@ -1046,7 +1109,7 @@ func TestAccWAFV2RuleGroup_LabelMatchStatement(t *testing.T) {
 				Config: testAccRuleGroupConfig_labelMatchStatement(ruleGroupName, "LABEL", "Hashicorp:Test:Label1"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRuleGroupExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/rulegroup/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/rulegroup/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
 						"statement.#":                               "1",
@@ -1060,7 +1123,7 @@ func TestAccWAFV2RuleGroup_LabelMatchStatement(t *testing.T) {
 				Config: testAccRuleGroupConfig_labelMatchStatement(ruleGroupName, "NAMESPACE", "awswaf:managed:aws:bot-control:"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRuleGroupExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/rulegroup/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/rulegroup/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
 						"statement.#":                               "1",
@@ -1096,7 +1159,7 @@ func TestAccWAFV2RuleGroup_ipSetReferenceStatement(t *testing.T) {
 				Config: testAccRuleGroupConfig_ipsetReferenceStatement(ruleGroupName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRuleGroupExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/rulegroup/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/rulegroup/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
 						"statement.#": "1",
@@ -1104,7 +1167,7 @@ func TestAccWAFV2RuleGroup_ipSetReferenceStatement(t *testing.T) {
 						"statement.0.ip_set_reference_statement.0.ip_set_forwarded_ip_config.#": "0",
 					}),
 					resource.TestMatchTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]*regexp.Regexp{
-						"statement.0.ip_set_reference_statement.0.arn": regexp.MustCompile(`regional/ipset/.+$`),
+						"statement.0.ip_set_reference_statement.0.arn": regexache.MustCompile(`regional/ipset/.+$`),
 					}),
 				),
 			},
@@ -1134,14 +1197,14 @@ func TestAccWAFV2RuleGroup_IPSetReferenceStatement_ipsetForwardedIP(t *testing.T
 				Config: testAccRuleGroupConfig_ipsetReferenceStatementIPSetForwardedIP(ruleGroupName, "MATCH", "X-Forwarded-For", "FIRST"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRuleGroupExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/rulegroup/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/rulegroup/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
 						"statement.#": "1",
 						"statement.0.ip_set_reference_statement.#": "1",
 					}),
 					resource.TestMatchTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]*regexp.Regexp{
-						"statement.0.ip_set_reference_statement.0.arn": regexp.MustCompile(`regional/ipset/.+$`),
+						"statement.0.ip_set_reference_statement.0.arn": regexache.MustCompile(`regional/ipset/.+$`),
 					}),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
 						"statement.0.ip_set_reference_statement.0.ip_set_forwarded_ip_config.#":                   "1",
@@ -1155,14 +1218,14 @@ func TestAccWAFV2RuleGroup_IPSetReferenceStatement_ipsetForwardedIP(t *testing.T
 				Config: testAccRuleGroupConfig_ipsetReferenceStatementIPSetForwardedIP(ruleGroupName, "NO_MATCH", "X-Forwarded-For", "LAST"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRuleGroupExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/rulegroup/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/rulegroup/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
 						"statement.#": "1",
 						"statement.0.ip_set_reference_statement.#": "1",
 					}),
 					resource.TestMatchTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]*regexp.Regexp{
-						"statement.0.ip_set_reference_statement.0.arn": regexp.MustCompile(`regional/ipset/.+$`),
+						"statement.0.ip_set_reference_statement.0.arn": regexache.MustCompile(`regional/ipset/.+$`),
 					}),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
 						"statement.0.ip_set_reference_statement.0.ip_set_forwarded_ip_config.#":                   "1",
@@ -1176,14 +1239,14 @@ func TestAccWAFV2RuleGroup_IPSetReferenceStatement_ipsetForwardedIP(t *testing.T
 				Config: testAccRuleGroupConfig_ipsetReferenceStatementIPSetForwardedIP(ruleGroupName, "MATCH", "Updated", "ANY"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRuleGroupExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/rulegroup/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/rulegroup/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
 						"statement.#": "1",
 						"statement.0.ip_set_reference_statement.#": "1",
 					}),
 					resource.TestMatchTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]*regexp.Regexp{
-						"statement.0.ip_set_reference_statement.0.arn": regexp.MustCompile(`regional/ipset/.+$`),
+						"statement.0.ip_set_reference_statement.0.arn": regexache.MustCompile(`regional/ipset/.+$`),
 					}),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
 						"statement.0.ip_set_reference_statement.0.ip_set_forwarded_ip_config.#":                   "1",
@@ -1197,7 +1260,7 @@ func TestAccWAFV2RuleGroup_IPSetReferenceStatement_ipsetForwardedIP(t *testing.T
 				Config: testAccRuleGroupConfig_ipsetReferenceStatement(ruleGroupName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRuleGroupExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/rulegroup/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/rulegroup/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
 						"statement.#": "1",
@@ -1205,7 +1268,7 @@ func TestAccWAFV2RuleGroup_IPSetReferenceStatement_ipsetForwardedIP(t *testing.T
 						"statement.0.ip_set_reference_statement.0.ip_set_forwarded_ip_config.#": "0",
 					}),
 					resource.TestMatchTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]*regexp.Regexp{
-						"statement.0.ip_set_reference_statement.0.arn": regexp.MustCompile(`regional/ipset/.+$`),
+						"statement.0.ip_set_reference_statement.0.arn": regexache.MustCompile(`regional/ipset/.+$`),
 					}),
 				),
 			},
@@ -1235,7 +1298,7 @@ func TestAccWAFV2RuleGroup_logicalRuleStatements(t *testing.T) {
 				Config: testAccRuleGroupConfig_logicalStatementAnd(ruleGroupName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRuleGroupExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/rulegroup/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/rulegroup/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
 						"statement.#":                             "1",
@@ -1250,7 +1313,7 @@ func TestAccWAFV2RuleGroup_logicalRuleStatements(t *testing.T) {
 				Config: testAccRuleGroupConfig_logicalStatementNotAnd(ruleGroupName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRuleGroupExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/rulegroup/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/rulegroup/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
 						"statement.#":                                                         "1",
@@ -1267,7 +1330,7 @@ func TestAccWAFV2RuleGroup_logicalRuleStatements(t *testing.T) {
 				Config: testAccRuleGroupConfig_logicalStatementOrNotAnd(ruleGroupName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRuleGroupExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/rulegroup/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/rulegroup/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
 						"statement.#":                                                        "1",
@@ -1309,7 +1372,7 @@ func TestAccWAFV2RuleGroup_minimal(t *testing.T) {
 				Config: testAccRuleGroupConfig_minimal(ruleGroupName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRuleGroupExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/rulegroup/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/rulegroup/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "capacity", "2"),
 					resource.TestCheckResourceAttr(resourceName, "name", ruleGroupName),
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
@@ -1341,7 +1404,7 @@ func TestAccWAFV2RuleGroup_regexMatchStatement(t *testing.T) {
 				Config: testAccRuleGroupConfig_regexMatchStatement(ruleGroupName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRuleGroupExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/rulegroup/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/rulegroup/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
 						"statement.#":                                               "1",
@@ -1378,7 +1441,7 @@ func TestAccWAFV2RuleGroup_regexPatternSetReferenceStatement(t *testing.T) {
 				Config: testAccRuleGroupConfig_regexPatternSetReferenceStatement(ruleGroupName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRuleGroupExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/rulegroup/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/rulegroup/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
 						"statement.#": "1",
@@ -1387,7 +1450,7 @@ func TestAccWAFV2RuleGroup_regexPatternSetReferenceStatement(t *testing.T) {
 						"statement.0.regex_pattern_set_reference_statement.0.text_transformation.#": "1",
 					}),
 					resource.TestMatchTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]*regexp.Regexp{
-						"statement.0.regex_pattern_set_reference_statement.0.arn": regexp.MustCompile(`regional/regexpatternset/.+$`),
+						"statement.0.regex_pattern_set_reference_statement.0.arn": regexache.MustCompile(`regional/regexpatternset/.+$`),
 					}),
 				),
 			},
@@ -1417,7 +1480,7 @@ func TestAccWAFV2RuleGroup_ruleAction(t *testing.T) {
 				Config: testAccRuleGroupConfig_actionAllow(ruleGroupName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRuleGroupExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/rulegroup/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/rulegroup/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "capacity", "2"),
 					resource.TestCheckResourceAttr(resourceName, "name", ruleGroupName),
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
@@ -1439,7 +1502,7 @@ func TestAccWAFV2RuleGroup_ruleAction(t *testing.T) {
 				Config: testAccRuleGroupConfig_actionBlock(ruleGroupName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRuleGroupExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/rulegroup/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/rulegroup/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "capacity", "2"),
 					resource.TestCheckResourceAttr(resourceName, "name", ruleGroupName),
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
@@ -1461,7 +1524,7 @@ func TestAccWAFV2RuleGroup_ruleAction(t *testing.T) {
 				Config: testAccRuleGroupConfig_actionCount(ruleGroupName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRuleGroupExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/rulegroup/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/rulegroup/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "capacity", "2"),
 					resource.TestCheckResourceAttr(resourceName, "name", ruleGroupName),
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
@@ -1505,7 +1568,7 @@ func TestAccWAFV2RuleGroup_RuleAction_customRequestHandling(t *testing.T) {
 				Config: testAccRuleGroupConfig_actionAllowCustomRequestHandling(ruleGroupName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRuleGroupExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/rulegroup/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/rulegroup/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "capacity", "2"),
 					resource.TestCheckResourceAttr(resourceName, "name", ruleGroupName),
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
@@ -1532,7 +1595,7 @@ func TestAccWAFV2RuleGroup_RuleAction_customRequestHandling(t *testing.T) {
 				Config: testAccRuleGroupConfig_actionCountCustomRequestHandling(ruleGroupName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRuleGroupExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/rulegroup/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/rulegroup/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "capacity", "2"),
 					resource.TestCheckResourceAttr(resourceName, "name", ruleGroupName),
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
@@ -1581,7 +1644,7 @@ func TestAccWAFV2RuleGroup_RuleAction_customResponse(t *testing.T) {
 				Config: testAccRuleGroupConfig_actionBlockCustomResponse(ruleGroupName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRuleGroupExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/rulegroup/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/rulegroup/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "capacity", "2"),
 					resource.TestCheckResourceAttr(resourceName, "name", ruleGroupName),
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
@@ -1609,7 +1672,7 @@ func TestAccWAFV2RuleGroup_RuleAction_customResponse(t *testing.T) {
 				Config: testAccRuleGroupConfig_actionBlockCustomResponseBody(ruleGroupName, "test_body_1"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRuleGroupExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/rulegroup/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/rulegroup/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "capacity", "2"),
 					resource.TestCheckResourceAttr(resourceName, "name", ruleGroupName),
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
@@ -1643,7 +1706,7 @@ func TestAccWAFV2RuleGroup_RuleAction_customResponse(t *testing.T) {
 				Config: testAccRuleGroupConfig_actionBlockCustomResponseBody(ruleGroupName, "test_body_2"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRuleGroupExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/rulegroup/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/rulegroup/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "capacity", "2"),
 					resource.TestCheckResourceAttr(resourceName, "name", ruleGroupName),
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
@@ -1700,7 +1763,7 @@ func TestAccWAFV2RuleGroup_sizeConstraintStatement(t *testing.T) {
 				Config: testAccRuleGroupConfig_sizeConstraintStatement(ruleGroupName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRuleGroupExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/rulegroup/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/rulegroup/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
 						"statement.#": "1",
@@ -1717,7 +1780,7 @@ func TestAccWAFV2RuleGroup_sizeConstraintStatement(t *testing.T) {
 				Config: testAccRuleGroupConfig_sizeConstraintStatementUpdate(ruleGroupName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRuleGroupExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/rulegroup/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/rulegroup/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
 						"statement.#": "1",
@@ -1756,7 +1819,7 @@ func TestAccWAFV2RuleGroup_sqliMatchStatement(t *testing.T) {
 				Config: testAccRuleGroupConfig_sqliMatchStatement(ruleGroupName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRuleGroupExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/rulegroup/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/rulegroup/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
 						"statement.#":                                         "1",
@@ -1779,7 +1842,7 @@ func TestAccWAFV2RuleGroup_sqliMatchStatement(t *testing.T) {
 				Config: testAccRuleGroupConfig_sqliMatchStatementUpdate(ruleGroupName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRuleGroupExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/rulegroup/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/rulegroup/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
 						"statement.#":                                                "1",
@@ -1825,12 +1888,11 @@ func TestAccWAFV2RuleGroup_tags(t *testing.T) {
 		CheckDestroy:             testAccCheckRuleGroupDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccRuleGroupConfig_oneTag(ruleGroupName, "Tag1", "Value1"),
+				Config: testAccRuleGroupConfig_tags1(ruleGroupName, "key1", "value1"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRuleGroupExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/rulegroup/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
-					resource.TestCheckResourceAttr(resourceName, "tags.Tag1", "Value1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
 				),
 			},
 			{
@@ -1840,22 +1902,20 @@ func TestAccWAFV2RuleGroup_tags(t *testing.T) {
 				ImportStateIdFunc: testAccRuleGroupImportStateIdFunc(resourceName),
 			},
 			{
-				Config: testAccRuleGroupConfig_twoTags(ruleGroupName, "Tag1", "Value1Updated", "Tag2", "Value2"),
+				Config: testAccRuleGroupConfig_tags2(ruleGroupName, "key1", "value1updated", "key2", "value2"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRuleGroupExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/rulegroup/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
-					resource.TestCheckResourceAttr(resourceName, "tags.Tag1", "Value1Updated"),
-					resource.TestCheckResourceAttr(resourceName, "tags.Tag2", "Value2"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1updated"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
 				),
 			},
 			{
-				Config: testAccRuleGroupConfig_oneTag(ruleGroupName, "Tag2", "Value2"),
+				Config: testAccRuleGroupConfig_tags1(ruleGroupName, "key2", "value2"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRuleGroupExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/rulegroup/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
-					resource.TestCheckResourceAttr(resourceName, "tags.Tag2", "Value2"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
 				),
 			},
 		},
@@ -1878,7 +1938,7 @@ func TestAccWAFV2RuleGroup_xssMatchStatement(t *testing.T) {
 				Config: testAccRuleGroupConfig_xssMatchStatement(ruleGroupName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRuleGroupExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/rulegroup/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/rulegroup/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
 						"statement.#":                                               "1",
@@ -1897,7 +1957,7 @@ func TestAccWAFV2RuleGroup_xssMatchStatement(t *testing.T) {
 				Config: testAccRuleGroupConfig_xssMatchStatementUpdate(ruleGroupName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRuleGroupExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/rulegroup/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/rulegroup/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
 						"statement.#":                                               "1",
@@ -1938,10 +1998,11 @@ func TestAccWAFV2RuleGroup_rateBasedStatement(t *testing.T) {
 				Config: testAccRuleGroupConfig_rateBasedStatement(ruleGroupName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRuleGroupExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/rulegroup/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/rulegroup/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
 						"statement.#": "1",
+						"statement.0.rate_based_statement.0.custom_key.#":           "0",
 						"statement.0.rate_based_statement.0.aggregate_key_type":     "IP",
 						"statement.0.rate_based_statement.0.forwarded_ip_config.#":  "0",
 						"statement.0.rate_based_statement.0.limit":                  "50000",
@@ -1953,11 +2014,12 @@ func TestAccWAFV2RuleGroup_rateBasedStatement(t *testing.T) {
 				Config: testAccRuleGroupConfig_rateBasedStatement_forwardedIPConfig(ruleGroupName, "MATCH", "X-Forwarded-For"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRuleGroupExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/rulegroup/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/rulegroup/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
-						"statement.#":                        "1",
-						"statement.0.rate_based_statement.#": "1",
+						"statement.#":                                                                "1",
+						"statement.0.rate_based_statement.#":                                         "1",
+						"statement.0.rate_based_statement.0.custom_key.#":                            "0",
 						"statement.0.rate_based_statement.0.aggregate_key_type":                      "FORWARDED_IP",
 						"statement.0.rate_based_statement.0.forwarded_ip_config.#":                   "1",
 						"statement.0.rate_based_statement.0.forwarded_ip_config.0.fallback_behavior": "MATCH",
@@ -1971,11 +2033,12 @@ func TestAccWAFV2RuleGroup_rateBasedStatement(t *testing.T) {
 				Config: testAccRuleGroupConfig_rateBasedStatement_forwardedIPConfig(ruleGroupName, "NO_MATCH", "Updated"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRuleGroupExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/rulegroup/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/rulegroup/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
-						"statement.#":                        "1",
-						"statement.0.rate_based_statement.#": "1",
+						"statement.#":                                                                "1",
+						"statement.0.rate_based_statement.#":                                         "1",
+						"statement.0.rate_based_statement.0.custom_key.#":                            "0",
 						"statement.0.rate_based_statement.0.aggregate_key_type":                      "FORWARDED_IP",
 						"statement.0.rate_based_statement.0.forwarded_ip_config.#":                   "1",
 						"statement.0.rate_based_statement.0.forwarded_ip_config.0.fallback_behavior": "NO_MATCH",
@@ -1985,15 +2048,248 @@ func TestAccWAFV2RuleGroup_rateBasedStatement(t *testing.T) {
 					}),
 				),
 			},
+			{
+				Config: testAccRuleGroupConfig_rateBasedStatement_customKeysBasic(ruleGroupName, "cookie", "testcookie"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckRuleGroupExists(ctx, resourceName, &v),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/rulegroup/.+$`)),
+					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
+						"statement.#":                                                                    "1",
+						"statement.0.rate_based_statement.#":                                             "1",
+						"statement.0.rate_based_statement.0.custom_key.#":                                "1",
+						"statement.0.rate_based_statement.0.aggregate_key_type":                          "CUSTOM_KEYS",
+						"statement.0.rate_based_statement.0.forwarded_ip_config.#":                       "0",
+						"statement.0.rate_based_statement.0.limit":                                       "50000",
+						"statement.0.rate_based_statement.0.scope_down_statement.#":                      "0",
+						"statement.0.rate_based_statement.0.custom_key.0.cookie.#":                       "1",
+						"statement.0.rate_based_statement.0.custom_key.0.forwarded_ip.#":                 "0",
+						"statement.0.rate_based_statement.0.custom_key.0.http_method.#":                  "0",
+						"statement.0.rate_based_statement.0.custom_key.0.header.#":                       "0",
+						"statement.0.rate_based_statement.0.custom_key.0.ip.#":                           "0",
+						"statement.0.rate_based_statement.0.custom_key.0.label_namespace.#":              "0",
+						"statement.0.rate_based_statement.0.custom_key.0.query_argument.#":               "0",
+						"statement.0.rate_based_statement.0.custom_key.0.query_string.#":                 "0",
+						"statement.0.rate_based_statement.0.custom_key.0.uri_path.#":                     "0",
+						"statement.0.rate_based_statement.0.custom_key.0.cookie.0.text_transformation.#": "1",
+					}),
+				),
+			},
+			{
+				Config: testAccRuleGroupConfig_rateBasedStatement_customKeysForwardedIP(ruleGroupName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckRuleGroupExists(ctx, resourceName, &v),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/rulegroup/.+$`)),
+					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
+						"statement.#":                                                       "1",
+						"statement.0.rate_based_statement.#":                                "1",
+						"statement.0.rate_based_statement.0.custom_key.#":                   "2",
+						"statement.0.rate_based_statement.0.aggregate_key_type":             "CUSTOM_KEYS",
+						"statement.0.rate_based_statement.0.forwarded_ip_config.#":          "1",
+						"statement.0.rate_based_statement.0.limit":                          "50000",
+						"statement.0.rate_based_statement.0.scope_down_statement.#":         "0",
+						"statement.0.rate_based_statement.0.custom_key.0.cookie.#":          "1",
+						"statement.0.rate_based_statement.0.custom_key.0.forwarded_ip.#":    "0",
+						"statement.0.rate_based_statement.0.custom_key.0.http_method.#":     "0",
+						"statement.0.rate_based_statement.0.custom_key.0.header.#":          "0",
+						"statement.0.rate_based_statement.0.custom_key.0.ip.#":              "0",
+						"statement.0.rate_based_statement.0.custom_key.0.label_namespace.#": "0",
+						"statement.0.rate_based_statement.0.custom_key.0.query_argument.#":  "0",
+						"statement.0.rate_based_statement.0.custom_key.0.query_string.#":    "0",
+						"statement.0.rate_based_statement.0.custom_key.0.uri_path.#":        "0",
+						"statement.0.rate_based_statement.0.custom_key.1.forwarded_ip.#":    "1",
+					}),
+				),
+			},
+			{
+				Config: testAccRuleGroupConfig_rateBasedStatement_customKeysHTTPMethod(ruleGroupName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckRuleGroupExists(ctx, resourceName, &v),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/rulegroup/.+$`)),
+					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
+						"statement.#":                                                       "1",
+						"statement.0.rate_based_statement.#":                                "1",
+						"statement.0.rate_based_statement.0.custom_key.#":                   "1",
+						"statement.0.rate_based_statement.0.aggregate_key_type":             "CUSTOM_KEYS",
+						"statement.0.rate_based_statement.0.forwarded_ip_config.#":          "0",
+						"statement.0.rate_based_statement.0.limit":                          "50000",
+						"statement.0.rate_based_statement.0.scope_down_statement.#":         "0",
+						"statement.0.rate_based_statement.0.custom_key.0.cookie.#":          "0",
+						"statement.0.rate_based_statement.0.custom_key.0.forwarded_ip.#":    "0",
+						"statement.0.rate_based_statement.0.custom_key.0.http_method.#":     "1",
+						"statement.0.rate_based_statement.0.custom_key.0.header.#":          "0",
+						"statement.0.rate_based_statement.0.custom_key.0.ip.#":              "0",
+						"statement.0.rate_based_statement.0.custom_key.0.label_namespace.#": "0",
+						"statement.0.rate_based_statement.0.custom_key.0.query_argument.#":  "0",
+						"statement.0.rate_based_statement.0.custom_key.0.query_string.#":    "0",
+						"statement.0.rate_based_statement.0.custom_key.0.uri_path.#":        "0",
+					}),
+				),
+			},
+			{
+				Config: testAccRuleGroupConfig_rateBasedStatement_customKeysBasic(ruleGroupName, "header", "x-forwrded-for"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckRuleGroupExists(ctx, resourceName, &v),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/rulegroup/.+$`)),
+					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
+						"statement.#":                                                                    "1",
+						"statement.0.rate_based_statement.#":                                             "1",
+						"statement.0.rate_based_statement.0.custom_key.#":                                "1",
+						"statement.0.rate_based_statement.0.aggregate_key_type":                          "CUSTOM_KEYS",
+						"statement.0.rate_based_statement.0.forwarded_ip_config.#":                       "0",
+						"statement.0.rate_based_statement.0.limit":                                       "50000",
+						"statement.0.rate_based_statement.0.scope_down_statement.#":                      "0",
+						"statement.0.rate_based_statement.0.custom_key.0.cookie.#":                       "0",
+						"statement.0.rate_based_statement.0.custom_key.0.forwarded_ip.#":                 "0",
+						"statement.0.rate_based_statement.0.custom_key.0.http_method.#":                  "0",
+						"statement.0.rate_based_statement.0.custom_key.0.header.#":                       "1",
+						"statement.0.rate_based_statement.0.custom_key.0.ip.#":                           "0",
+						"statement.0.rate_based_statement.0.custom_key.0.label_namespace.#":              "0",
+						"statement.0.rate_based_statement.0.custom_key.0.query_argument.#":               "0",
+						"statement.0.rate_based_statement.0.custom_key.0.query_string.#":                 "0",
+						"statement.0.rate_based_statement.0.custom_key.0.uri_path.#":                     "0",
+						"statement.0.rate_based_statement.0.custom_key.0.header.0.text_transformation.#": "1",
+					}),
+				),
+			},
+			{
+				Config: testAccRuleGroupConfig_rateBasedStatement_customKeysIP(ruleGroupName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckRuleGroupExists(ctx, resourceName, &v),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/rulegroup/.+$`)),
+					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
+						"statement.#":                                                       "1",
+						"statement.0.rate_based_statement.#":                                "1",
+						"statement.0.rate_based_statement.0.custom_key.#":                   "2",
+						"statement.0.rate_based_statement.0.aggregate_key_type":             "CUSTOM_KEYS",
+						"statement.0.rate_based_statement.0.forwarded_ip_config.#":          "0",
+						"statement.0.rate_based_statement.0.limit":                          "50000",
+						"statement.0.rate_based_statement.0.scope_down_statement.#":         "0",
+						"statement.0.rate_based_statement.0.custom_key.0.cookie.#":          "1",
+						"statement.0.rate_based_statement.0.custom_key.0.forwarded_ip.#":    "0",
+						"statement.0.rate_based_statement.0.custom_key.0.http_method.#":     "0",
+						"statement.0.rate_based_statement.0.custom_key.0.header.#":          "0",
+						"statement.0.rate_based_statement.0.custom_key.0.ip.#":              "0",
+						"statement.0.rate_based_statement.0.custom_key.0.label_namespace.#": "0",
+						"statement.0.rate_based_statement.0.custom_key.0.query_argument.#":  "0",
+						"statement.0.rate_based_statement.0.custom_key.0.query_string.#":    "0",
+						"statement.0.rate_based_statement.0.custom_key.0.uri_path.#":        "0",
+						"statement.0.rate_based_statement.0.custom_key.1.ip.#":              "1",
+					}),
+				),
+			},
+			{
+				Config: testAccRuleGroupConfig_rateBasedStatement_customKeysBasic(ruleGroupName, "query_argument", "key"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckRuleGroupExists(ctx, resourceName, &v),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/rulegroup/.+$`)),
+					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
+						"statement.#":                                                                            "1",
+						"statement.0.rate_based_statement.#":                                                     "1",
+						"statement.0.rate_based_statement.0.custom_key.#":                                        "1",
+						"statement.0.rate_based_statement.0.aggregate_key_type":                                  "CUSTOM_KEYS",
+						"statement.0.rate_based_statement.0.forwarded_ip_config.#":                               "0",
+						"statement.0.rate_based_statement.0.limit":                                               "50000",
+						"statement.0.rate_based_statement.0.scope_down_statement.#":                              "0",
+						"statement.0.rate_based_statement.0.custom_key.0.cookie.#":                               "0",
+						"statement.0.rate_based_statement.0.custom_key.0.forwarded_ip.#":                         "0",
+						"statement.0.rate_based_statement.0.custom_key.0.http_method.#":                          "0",
+						"statement.0.rate_based_statement.0.custom_key.0.header.#":                               "0",
+						"statement.0.rate_based_statement.0.custom_key.0.ip.#":                                   "0",
+						"statement.0.rate_based_statement.0.custom_key.0.label_namespace.#":                      "0",
+						"statement.0.rate_based_statement.0.custom_key.0.query_argument.#":                       "1",
+						"statement.0.rate_based_statement.0.custom_key.0.query_string.#":                         "0",
+						"statement.0.rate_based_statement.0.custom_key.0.uri_path.#":                             "0",
+						"statement.0.rate_based_statement.0.custom_key.0.query_argument.0.text_transformation.#": "1",
+					}),
+				),
+			},
+			{
+				Config: testAccRuleGroupConfig_rateBasedStatement_customKeysMinimal(ruleGroupName, "query_string"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckRuleGroupExists(ctx, resourceName, &v),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/rulegroup/.+$`)),
+					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
+						"statement.#":                                                                          "1",
+						"statement.0.rate_based_statement.#":                                                   "1",
+						"statement.0.rate_based_statement.0.custom_key.#":                                      "1",
+						"statement.0.rate_based_statement.0.aggregate_key_type":                                "CUSTOM_KEYS",
+						"statement.0.rate_based_statement.0.forwarded_ip_config.#":                             "0",
+						"statement.0.rate_based_statement.0.limit":                                             "50000",
+						"statement.0.rate_based_statement.0.scope_down_statement.#":                            "0",
+						"statement.0.rate_based_statement.0.custom_key.0.cookie.#":                             "0",
+						"statement.0.rate_based_statement.0.custom_key.0.forwarded_ip.#":                       "0",
+						"statement.0.rate_based_statement.0.custom_key.0.http_method.#":                        "0",
+						"statement.0.rate_based_statement.0.custom_key.0.header.#":                             "0",
+						"statement.0.rate_based_statement.0.custom_key.0.ip.#":                                 "0",
+						"statement.0.rate_based_statement.0.custom_key.0.label_namespace.#":                    "0",
+						"statement.0.rate_based_statement.0.custom_key.0.query_argument.#":                     "0",
+						"statement.0.rate_based_statement.0.custom_key.0.query_string.#":                       "1",
+						"statement.0.rate_based_statement.0.custom_key.0.uri_path.#":                           "0",
+						"statement.0.rate_based_statement.0.custom_key.0.query_string.0.text_transformation.#": "1",
+					}),
+				),
+			},
+			{
+				Config: testAccRuleGroupConfig_rateBasedStatement_customKeysMinimal(ruleGroupName, "uri_path"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckRuleGroupExists(ctx, resourceName, &v),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/rulegroup/.+$`)),
+					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
+						"statement.#":                                                                      "1",
+						"statement.0.rate_based_statement.#":                                               "1",
+						"statement.0.rate_based_statement.0.custom_key.#":                                  "1",
+						"statement.0.rate_based_statement.0.aggregate_key_type":                            "CUSTOM_KEYS",
+						"statement.0.rate_based_statement.0.forwarded_ip_config.#":                         "0",
+						"statement.0.rate_based_statement.0.limit":                                         "50000",
+						"statement.0.rate_based_statement.0.scope_down_statement.#":                        "0",
+						"statement.0.rate_based_statement.0.custom_key.0.cookie.#":                         "0",
+						"statement.0.rate_based_statement.0.custom_key.0.forwarded_ip.#":                   "0",
+						"statement.0.rate_based_statement.0.custom_key.0.http_method.#":                    "0",
+						"statement.0.rate_based_statement.0.custom_key.0.header.#":                         "0",
+						"statement.0.rate_based_statement.0.custom_key.0.ip.#":                             "0",
+						"statement.0.rate_based_statement.0.custom_key.0.label_namespace.#":                "0",
+						"statement.0.rate_based_statement.0.custom_key.0.query_argument.#":                 "0",
+						"statement.0.rate_based_statement.0.custom_key.0.query_string.#":                   "0",
+						"statement.0.rate_based_statement.0.custom_key.0.uri_path.#":                       "1",
+						"statement.0.rate_based_statement.0.custom_key.0.uri_path.0.text_transformation.#": "1",
+					}),
+				),
+			},
+			{
+				Config: testAccRuleGroupConfig_rateBasedStatement_customKeysMaxKeys(ruleGroupName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckRuleGroupExists(ctx, resourceName, &v),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/rulegroup/.+$`)),
+					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
+						"statement.#":                                               "1",
+						"statement.0.rate_based_statement.#":                        "1",
+						"statement.0.rate_based_statement.0.custom_key.#":           "5",
+						"statement.0.rate_based_statement.0.aggregate_key_type":     "CUSTOM_KEYS",
+						"statement.0.rate_based_statement.0.forwarded_ip_config.#":  "0",
+						"statement.0.rate_based_statement.0.limit":                  "50000",
+						"statement.0.rate_based_statement.0.scope_down_statement.#": "0",
+					}),
+				),
+			},
 			{
 				Config: testAccRuleGroupConfig_rateBasedStatement_update(ruleGroupName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRuleGroupExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/rulegroup/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/rulegroup/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
-						"statement.#":                        "1",
-						"statement.0.rate_based_statement.#": "1",
+						"statement.#":                                                                                     "1",
+						"statement.0.rate_based_statement.#":                                                              "1",
+						"statement.0.rate_based_statement.0.custom_key.#":                                                 "0",
 						"statement.0.rate_based_statement.0.aggregate_key_type":                                           "IP",
 						"statement.0.rate_based_statement.0.forwarded_ip_config.#":                                        "0",
 						"statement.0.rate_based_statement.0.limit":                                                        "10000",
@@ -2031,7 +2327,7 @@ func TestAccWAFV2RuleGroup_RateBased_maxNested(t *testing.T) {
 				Config: testAccRuleGroupConfig_multipleNestedRateBasedStatements(ruleGroupName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRuleGroupExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/rulegroup/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/rulegroup/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "name", ruleGroupName),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
@@ -2076,7 +2372,7 @@ func TestAccWAFV2RuleGroup_Operators_maxNested(t *testing.T) {
 				Config: testAccRuleGroupConfig_multipleNestedOperatorStatements(ruleGroupName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRuleGroupExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/rulegroup/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/rulegroup/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "name", ruleGroupName),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
@@ -2156,10 +2452,6 @@ func testAccCheckRuleGroupExists(ctx context.Context, n string, v *wafv2.RuleGro
 			return fmt.Errorf("Not found: %s", n)
 		}
 
-		if rs.Primary.ID == "" {
-			return fmt.Errorf("No WAFv2 RuleGroup ID is set")
-		}
-
 		conn := acctest.Provider.Meta().(*conns.AWSClient).WAFV2Conn(ctx)
 
 		output, err := tfwafv2.FindRuleGroupByThreePartKey(ctx, conn, rs.Primary.ID, rs.Primary.Attributes["name"], rs.Primary.Attributes["scope"])
@@ -2174,12 +2466,23 @@ func testAccCheckRuleGroupExists(ctx context.Context, n string, v *wafv2.RuleGro
 	}
 }
 
-func testAccRuleGroupConfig_basic(name string) string {
+func testAccRuleGroupImportStateIdFunc(resourceName string) resource.ImportStateIdFunc {
+	return func(s *terraform.State) (string, error) {
+		rs, ok := s.RootModule().Resources[resourceName]
+		if !ok {
+			return "", fmt.Errorf("Not found: %s", resourceName)
+		}
+
+		return fmt.Sprintf("%s/%s/%s", rs.Primary.ID, rs.Primary.Attributes["name"], rs.Primary.Attributes["scope"]), nil
+	}
+}
+
+func testAccRuleGroupConfig_basic(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_rule_group" "test" {
   capacity    = 2
-  name        = "%s"
-  description = "%s"
+  name        = %[1]q
+  description = %[1]q
   scope       = "REGIONAL"
 
   visibility_config {
@@ -2188,14 +2491,47 @@ resource "aws_wafv2_rule_group" "test" {
     sampled_requests_enabled   = false
   }
 }
-`, name, name)
+`, rName)
 }
 
-func testAccRuleGroupConfig_basicUpdate(name string) string {
+func testAccRuleGroupConfig_namePrefix(namePrefix string) string {
+	return fmt.Sprintf(`
+resource "aws_wafv2_rule_group" "test" {
+  capacity    = 2
+  name_prefix = %[1]q
+  description = "test"
+  scope       = "REGIONAL"
+
+  visibility_config {
+    cloudwatch_metrics_enabled = false
+    metric_name                = "friendly-metric-name"
+    sampled_requests_enabled   = false
+  }
+}
+`, namePrefix)
+}
+
+func testAccRuleGroupConfig_nameGenerated() string {
+	return `
+resource "aws_wafv2_rule_group" "test" {
+  capacity    = 2
+  description = "test"
+  scope       = "REGIONAL"
+
+  visibility_config {
+    cloudwatch_metrics_enabled = false
+    metric_name                = "friendly-metric-name"
+    sampled_requests_enabled   = false
+  }
+}
+`
+}
+
+func testAccRuleGroupConfig_basicUpdate(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_rule_group" "test" {
   capacity    = 50
-  name        = "%s"
+  name        = %[1]q
   description = "Updated"
   scope       = "REGIONAL"
 
@@ -2226,19 +2562,19 @@ resource "aws_wafv2_rule_group" "test" {
     sampled_requests_enabled   = false
   }
 }
-`, name)
+`, rName)
 }
 
-func testAccRuleGroupConfig_updateMultiples(name string, ruleName1, ruleName2 string, priority1, priority2 int) string {
+func testAccRuleGroupConfig_updateMultiples(rName string, ruleName1, ruleName2 string, priority1, priority2 int) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_rule_group" "test" {
   capacity    = 50
-  name        = "%[1]s"
+  name        = %[1]q
   description = "Updated"
   scope       = "REGIONAL"
 
   rule {
-    name     = "%[2]s"
+    name     = %[2]q
     priority = %[3]d
 
     action {
@@ -2253,13 +2589,13 @@ resource "aws_wafv2_rule_group" "test" {
 
     visibility_config {
       cloudwatch_metrics_enabled = false
-      metric_name                = "%[2]s"
+      metric_name                = %[2]q
       sampled_requests_enabled   = false
     }
   }
 
   rule {
-    name     = "%[4]s"
+    name     = %[4]q
     priority = %[5]d
 
     action {
@@ -2289,7 +2625,7 @@ resource "aws_wafv2_rule_group" "test" {
 
     visibility_config {
       cloudwatch_metrics_enabled = false
-      metric_name                = "%[4]s"
+      metric_name                = %[4]q
       sampled_requests_enabled   = false
     }
   }
@@ -2300,15 +2636,15 @@ resource "aws_wafv2_rule_group" "test" {
     sampled_requests_enabled   = false
   }
 }
-`, name, ruleName1, priority1, ruleName2, priority2)
+`, rName, ruleName1, priority1, ruleName2, priority2)
 }
 
-func testAccRuleGroupConfig_updateCapacity(name string) string {
+func testAccRuleGroupConfig_updateCapacity(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_rule_group" "test" {
   capacity    = 3
-  name        = "%s"
-  description = "%s"
+  name        = %[1]q
+  description = %[1]q
   scope       = "REGIONAL"
 
   visibility_config {
@@ -2317,15 +2653,15 @@ resource "aws_wafv2_rule_group" "test" {
     sampled_requests_enabled   = false
   }
 }
-`, name, name)
+`, rName)
 }
 
-func testAccRuleGroupConfig_updateMetricName(name string) string {
+func testAccRuleGroupConfig_updateMetricName(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_rule_group" "test" {
   capacity    = 2
-  name        = "%s"
-  description = "%s"
+  name        = %[1]q
+  description = %[1]q
   scope       = "REGIONAL"
 
   visibility_config {
@@ -2334,14 +2670,14 @@ resource "aws_wafv2_rule_group" "test" {
     sampled_requests_enabled   = false
   }
 }
-`, name, name)
+`, rName)
 }
 
-func testAccRuleGroupConfig_minimal(name string) string {
+func testAccRuleGroupConfig_minimal(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_rule_group" "test" {
   capacity = 2
-  name     = "%s"
+  name     = %[1]q
   scope    = "REGIONAL"
 
   visibility_config {
@@ -2350,14 +2686,14 @@ resource "aws_wafv2_rule_group" "test" {
     sampled_requests_enabled   = false
   }
 }
-`, name)
+`, rName)
 }
 
-func testAccRuleGroupConfig_actionAllow(name string) string {
+func testAccRuleGroupConfig_actionAllow(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_rule_group" "test" {
   capacity = 2
-  name     = "%s"
+  name     = %[1]q
   scope    = "REGIONAL"
 
   rule {
@@ -2387,14 +2723,14 @@ resource "aws_wafv2_rule_group" "test" {
     sampled_requests_enabled   = false
   }
 }
-`, name)
+`, rName)
 }
 
-func testAccRuleGroupConfig_actionAllowCustomRequestHandling(name string) string {
+func testAccRuleGroupConfig_actionAllowCustomRequestHandling(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_rule_group" "test" {
   capacity = 2
-  name     = "%s"
+  name     = %[1]q
   scope    = "REGIONAL"
 
   rule {
@@ -2436,14 +2772,14 @@ resource "aws_wafv2_rule_group" "test" {
     sampled_requests_enabled   = false
   }
 }
-`, name)
+`, rName)
 }
 
-func testAccRuleGroupConfig_actionBlock(name string) string {
+func testAccRuleGroupConfig_actionBlock(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_rule_group" "test" {
   capacity = 2
-  name     = "%s"
+  name     = %[1]q
   scope    = "REGIONAL"
 
   rule {
@@ -2473,14 +2809,14 @@ resource "aws_wafv2_rule_group" "test" {
     sampled_requests_enabled   = false
   }
 }
-`, name)
+`, rName)
 }
 
-func testAccRuleGroupConfig_actionBlockCustomResponse(name string) string {
+func testAccRuleGroupConfig_actionBlockCustomResponse(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_rule_group" "test" {
   capacity = 2
-  name     = "%s"
+  name     = %[1]q
   scope    = "REGIONAL"
 
   rule {
@@ -2523,14 +2859,14 @@ resource "aws_wafv2_rule_group" "test" {
     sampled_requests_enabled   = false
   }
 }
-`, name)
+`, rName)
 }
 
-func testAccRuleGroupConfig_actionBlockCustomResponseBody(name string, customBodyKey string) string {
+func testAccRuleGroupConfig_actionBlockCustomResponseBody(rName string, customBodyKey string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_rule_group" "test" {
   capacity = 2
-  name     = "%[1]s"
+  name     = %[1]q
   scope    = "REGIONAL"
   custom_response_body {
     key          = "test_body_1"
@@ -2549,7 +2885,7 @@ resource "aws_wafv2_rule_group" "test" {
       block {
         custom_response {
           response_code            = 429
-          custom_response_body_key = "%[2]s"
+          custom_response_body_key = %[2]q
         }
       }
     }
@@ -2570,14 +2906,14 @@ resource "aws_wafv2_rule_group" "test" {
     sampled_requests_enabled   = false
   }
 }
-`, name, customBodyKey)
+`, rName, customBodyKey)
 }
 
-func testAccRuleGroupConfig_actionCount(name string) string {
+func testAccRuleGroupConfig_actionCount(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_rule_group" "test" {
   capacity = 2
-  name     = "%s"
+  name     = %[1]q
   scope    = "REGIONAL"
 
   rule {
@@ -2607,14 +2943,14 @@ resource "aws_wafv2_rule_group" "test" {
     sampled_requests_enabled   = false
   }
 }
-`, name)
+`, rName)
 }
 
-func testAccRuleGroupConfig_actionCountCustomRequestHandling(name string) string {
+func testAccRuleGroupConfig_actionCountCustomRequestHandling(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_rule_group" "test" {
   capacity = 2
-  name     = "%s"
+  name     = %[1]q
   scope    = "REGIONAL"
 
   rule {
@@ -2656,14 +2992,14 @@ resource "aws_wafv2_rule_group" "test" {
     sampled_requests_enabled   = false
   }
 }
-`, name)
+`, rName)
 }
 
-func testAccRuleGroupConfig_byteMatchStatement(name string) string {
+func testAccRuleGroupConfig_byteMatchStatement(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_rule_group" "test" {
   capacity = 300
-  name     = "%s"
+  name     = %[1]q
   scope    = "REGIONAL"
 
   rule {
@@ -2708,14 +3044,14 @@ resource "aws_wafv2_rule_group" "test" {
     sampled_requests_enabled   = false
   }
 }
-`, name)
+`, rName)
 }
 
-func testAccRuleGroupConfig_byteMatchStatementUpdate(name string) string {
+func testAccRuleGroupConfig_byteMatchStatementUpdate(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_rule_group" "test" {
   capacity = 30
-  name     = "%s"
+  name     = %[1]q
   scope    = "REGIONAL"
 
   rule {
@@ -2755,14 +3091,14 @@ resource "aws_wafv2_rule_group" "test" {
     sampled_requests_enabled   = false
   }
 }
-`, name)
+`, rName)
 }
 
-func testAccRuleGroupConfig_byteMatchStatementFieldToMatchAllQueryArguments(name string) string {
+func testAccRuleGroupConfig_byteMatchStatementFieldToMatchAllQueryArguments(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_rule_group" "test" {
   capacity = 30
-  name     = "%s"
+  name     = %[1]q
   scope    = "REGIONAL"
 
   rule {
@@ -2802,14 +3138,14 @@ resource "aws_wafv2_rule_group" "test" {
     sampled_requests_enabled   = false
   }
 }
-`, name)
+`, rName)
 }
 
-func testAccRuleGroupConfig_byteMatchStatementFieldToMatchBody(name string) string {
+func testAccRuleGroupConfig_byteMatchStatementFieldToMatchBody(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_rule_group" "test" {
   capacity = 15
-  name     = "%s"
+  name     = %[1]q
   scope    = "REGIONAL"
 
   rule {
@@ -2849,14 +3185,14 @@ resource "aws_wafv2_rule_group" "test" {
     sampled_requests_enabled   = false
   }
 }
-`, name)
+`, rName)
 }
 
-func testAccRuleGroupConfig_byteMatchStatementFieldToMatchJSONBody(name string) string {
+func testAccRuleGroupConfig_byteMatchStatementFieldToMatchJSONBody(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_rule_group" "test" {
   capacity = 20
-  name     = "%s"
+  name     = %[1]q
   scope    = "REGIONAL"
 
   rule {
@@ -2903,14 +3239,14 @@ resource "aws_wafv2_rule_group" "test" {
     sampled_requests_enabled   = false
   }
 }
-`, name)
+`, rName)
 }
 
-func testAccRuleGroupConfig_byteMatchStatementFieldToMatchHeadersInvalidConfiguration(name string) string {
+func testAccRuleGroupConfig_byteMatchStatementFieldToMatchHeadersInvalidConfiguration(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_rule_group" "test" {
   capacity = 50
-  name     = "%s"
+  name     = %[1]q
   scope    = "REGIONAL"
 
   rule {
@@ -2955,14 +3291,14 @@ resource "aws_wafv2_rule_group" "test" {
     sampled_requests_enabled   = false
   }
 }
-`, name)
+`, rName)
 }
 
-func testAccRuleGroupConfig_byteMatchStatementFieldToMatchHeadersMatchPatternAll(name string) string {
+func testAccRuleGroupConfig_byteMatchStatementFieldToMatchHeadersMatchPatternAll(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_rule_group" "test" {
   capacity = 50
-  name     = "%s"
+  name     = %[1]q
   scope    = "REGIONAL"
 
   rule {
@@ -3008,14 +3344,14 @@ resource "aws_wafv2_rule_group" "test" {
     sampled_requests_enabled   = false
   }
 }
-`, name)
+`, rName)
 }
 
-func testAccRuleGroupConfig_byteMatchStatementFieldToMatchHeadersMatchPatternIncludedHeaders(name string) string {
+func testAccRuleGroupConfig_byteMatchStatementFieldToMatchHeadersMatchPatternIncludedHeaders(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_rule_group" "test" {
   capacity = 50
-  name     = "%s"
+  name     = %[1]q
   scope    = "REGIONAL"
 
   rule {
@@ -3061,14 +3397,14 @@ resource "aws_wafv2_rule_group" "test" {
     sampled_requests_enabled   = false
   }
 }
-`, name)
+`, rName)
 }
 
-func testAccRuleGroupConfig_byteMatchStatementFieldToMatchHeadersMatchPatternExcludedHeaders(name string) string {
+func testAccRuleGroupConfig_byteMatchStatementFieldToMatchHeadersMatchPatternExcludedHeaders(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_rule_group" "test" {
   capacity = 50
-  name     = "%s"
+  name     = %[1]q
   scope    = "REGIONAL"
 
   rule {
@@ -3114,14 +3450,14 @@ resource "aws_wafv2_rule_group" "test" {
     sampled_requests_enabled   = false
   }
 }
-`, name)
+`, rName)
 }
 
-func testAccRuleGroupConfig_byteMatchStatementFieldToMatchMethod(name string) string {
+func testAccRuleGroupConfig_byteMatchStatementFieldToMatchMethod(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_rule_group" "test" {
   capacity = 15
-  name     = "%s"
+  name     = %[1]q
   scope    = "REGIONAL"
 
   rule {
@@ -3161,14 +3497,14 @@ resource "aws_wafv2_rule_group" "test" {
     sampled_requests_enabled   = false
   }
 }
-`, name)
+`, rName)
 }
 
-func testAccRuleGroupConfig_byteMatchStatementFieldToMatchQueryString(name string) string {
+func testAccRuleGroupConfig_byteMatchStatementFieldToMatchQueryString(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_rule_group" "test" {
   capacity = 15
-  name     = "%s"
+  name     = %[1]q
   scope    = "REGIONAL"
 
   rule {
@@ -3208,14 +3544,14 @@ resource "aws_wafv2_rule_group" "test" {
     sampled_requests_enabled   = false
   }
 }
-`, name)
+`, rName)
 }
 
-func testAccRuleGroupConfig_byteMatchStatementFieldToMatchCookies(name string) string {
+func testAccRuleGroupConfig_byteMatchStatementFieldToMatchCookies(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_rule_group" "test" {
   capacity = 15
-  name     = "%s"
+  name     = %[1]q
   scope    = "REGIONAL"
 
   rule {
@@ -3261,14 +3597,14 @@ resource "aws_wafv2_rule_group" "test" {
     sampled_requests_enabled   = false
   }
 }
-`, name)
+`, rName)
 }
 
-func testAccRuleGroupConfig_byteMatchStatementFieldToMatchSingleHeader(name string) string {
+func testAccRuleGroupConfig_byteMatchStatementFieldToMatchSingleHeader(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_rule_group" "test" {
   capacity = 15
-  name     = "%s"
+  name     = %[1]q
   scope    = "REGIONAL"
 
   rule {
@@ -3310,14 +3646,14 @@ resource "aws_wafv2_rule_group" "test" {
     sampled_requests_enabled   = false
   }
 }
-`, name)
+`, rName)
 }
 
-func testAccRuleGroupConfig_byteMatchStatementFieldToMatchSingleQueryArgument(name string) string {
+func testAccRuleGroupConfig_byteMatchStatementFieldToMatchSingleQueryArgument(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_rule_group" "test" {
   capacity = 30
-  name     = "%s"
+  name     = %[1]q
   scope    = "REGIONAL"
 
   rule {
@@ -3359,14 +3695,14 @@ resource "aws_wafv2_rule_group" "test" {
     sampled_requests_enabled   = false
   }
 }
-`, name)
+`, rName)
 }
 
-func testAccRuleGroupConfig_byteMatchStatementFieldToMatchURIPath(name string) string {
+func testAccRuleGroupConfig_byteMatchStatementFieldToMatchURIPath(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_rule_group" "test" {
   capacity = 15
-  name     = "%s"
+  name     = %[1]q
   scope    = "REGIONAL"
 
   rule {
@@ -3406,13 +3742,13 @@ resource "aws_wafv2_rule_group" "test" {
     sampled_requests_enabled   = false
   }
 }
-`, name)
+`, rName)
 }
 
-func testAccRuleGroupConfig_ipsetReferenceStatement(name string) string {
+func testAccRuleGroupConfig_ipsetReferenceStatement(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_ip_set" "test" {
-  name               = "ip-set-%s"
+  name               = "ip-set-%[1]s"
   scope              = "REGIONAL"
   ip_address_version = "IPV4"
   addresses          = ["1.1.1.1/32", "2.2.2.2/32"]
@@ -3420,7 +3756,7 @@ resource "aws_wafv2_ip_set" "test" {
 
 resource "aws_wafv2_rule_group" "test" {
   capacity = 2
-  name     = "%s"
+  name     = %[1]q
   scope    = "REGIONAL"
 
   rule {
@@ -3450,10 +3786,10 @@ resource "aws_wafv2_rule_group" "test" {
     sampled_requests_enabled   = false
   }
 }
-`, name, name)
+`, rName)
 }
 
-func testAccRuleGroupConfig_ipsetReferenceStatementIPSetForwardedIP(name, fallbackBehavior, headerName, position string) string {
+func testAccRuleGroupConfig_ipsetReferenceStatementIPSetForwardedIP(rName, fallbackBehavior, headerName, position string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_ip_set" "test" {
   name               = "ip-set-%[1]s"
@@ -3464,7 +3800,7 @@ resource "aws_wafv2_ip_set" "test" {
 
 resource "aws_wafv2_rule_group" "test" {
   capacity = 5
-  name     = "%[1]s"
+  name     = %[1]q
   scope    = "REGIONAL"
 
   rule {
@@ -3479,9 +3815,9 @@ resource "aws_wafv2_rule_group" "test" {
       ip_set_reference_statement {
         arn = aws_wafv2_ip_set.test.arn
         ip_set_forwarded_ip_config {
-          fallback_behavior = "%[2]s"
-          header_name       = "%[3]s"
-          position          = "%[4]s"
+          fallback_behavior = %[2]q
+          header_name       = %[3]q
+          position          = %[4]q
         }
       }
     }
@@ -3499,14 +3835,14 @@ resource "aws_wafv2_rule_group" "test" {
     sampled_requests_enabled   = false
   }
 }
-`, name, fallbackBehavior, headerName, position)
+`, rName, fallbackBehavior, headerName, position)
 }
 
-func testAccRuleGroupConfig_geoMatchStatement(name string) string {
+func testAccRuleGroupConfig_geoMatchStatement(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_rule_group" "test" {
   capacity = 2
-  name     = "%s"
+  name     = %[1]q
   scope    = "REGIONAL"
 
   rule {
@@ -3536,14 +3872,14 @@ resource "aws_wafv2_rule_group" "test" {
     sampled_requests_enabled   = false
   }
 }
-`, name)
+`, rName)
 }
 
-func testAccRuleGroupConfig_geoMatchStatementForwardedIP(name, fallbackBehavior, headerName string) string {
+func testAccRuleGroupConfig_geoMatchStatementForwardedIP(rName, fallbackBehavior, headerName string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_rule_group" "test" {
   capacity = 2
-  name     = "%s"
+  name     = %[1]q
   scope    = "REGIONAL"
 
   rule {
@@ -3558,8 +3894,8 @@ resource "aws_wafv2_rule_group" "test" {
       geo_match_statement {
         country_codes = ["US", "NL"]
         forwarded_ip_config {
-          fallback_behavior = "%s"
-          header_name       = "%s"
+          fallback_behavior = %[2]q
+          header_name       = %[3]q
         }
       }
     }
@@ -3577,14 +3913,14 @@ resource "aws_wafv2_rule_group" "test" {
     sampled_requests_enabled   = false
   }
 }
-`, name, fallbackBehavior, headerName)
+`, rName, fallbackBehavior, headerName)
 }
 
-func testAccRuleGroupConfig_geoMatchStatementUpdate(name string) string {
+func testAccRuleGroupConfig_geoMatchStatementUpdate(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_rule_group" "test" {
   capacity = 2
-  name     = "%s"
+  name     = %[1]q
   scope    = "REGIONAL"
 
   rule {
@@ -3614,14 +3950,14 @@ resource "aws_wafv2_rule_group" "test" {
     sampled_requests_enabled   = false
   }
 }
-`, name)
+`, rName)
 }
 
-func testAccRuleGroupConfig_labelMatchStatement(name string, scope string, key string) string {
+func testAccRuleGroupConfig_labelMatchStatement(rName string, scope string, key string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_rule_group" "test" {
   capacity = 2
-  name     = "%[1]s"
+  name     = %[1]q
   scope    = "REGIONAL"
   rule {
     name     = "rule-1"
@@ -3631,8 +3967,8 @@ resource "aws_wafv2_rule_group" "test" {
     }
     statement {
       label_match_statement {
-        scope = "%[2]s"
-        key   = "%[3]s"
+        scope = %[2]q
+        key   = %[3]q
       }
     }
     visibility_config {
@@ -3647,14 +3983,14 @@ resource "aws_wafv2_rule_group" "test" {
     sampled_requests_enabled   = false
   }
 }
-`, name, scope, key)
+`, rName, scope, key)
 }
 
-func testAccRuleGroupConfig_labels(name string) string {
+func testAccRuleGroupConfig_labels(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_rule_group" "test" {
   capacity = 2
-  name     = "%s"
+  name     = %[1]q
   scope    = "REGIONAL"
   rule {
     name     = "rule-1"
@@ -3685,14 +4021,14 @@ resource "aws_wafv2_rule_group" "test" {
     sampled_requests_enabled   = false
   }
 }
-`, name)
+`, rName)
 }
 
-func testAccRuleGroupConfig_noLabels(name string) string {
+func testAccRuleGroupConfig_noLabels(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_rule_group" "test" {
   capacity = 2
-  name     = "%s"
+  name     = %[1]q
   scope    = "REGIONAL"
   rule {
     name     = "rule-1"
@@ -3717,14 +4053,14 @@ resource "aws_wafv2_rule_group" "test" {
     sampled_requests_enabled   = false
   }
 }
-`, name)
+`, rName)
 }
 
-func testAccRuleGroupConfig_logicalStatementAnd(name string) string {
+func testAccRuleGroupConfig_logicalStatementAnd(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_rule_group" "test" {
   capacity = 2
-  name     = "%s"
+  name     = %[1]q
   scope    = "REGIONAL"
 
   rule {
@@ -3764,14 +4100,14 @@ resource "aws_wafv2_rule_group" "test" {
     sampled_requests_enabled   = false
   }
 }
-`, name)
+`, rName)
 }
 
-func testAccRuleGroupConfig_logicalStatementNotAnd(name string) string {
+func testAccRuleGroupConfig_logicalStatementNotAnd(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_rule_group" "test" {
   capacity = 2
-  name     = "%s"
+  name     = %[1]q
   scope    = "REGIONAL"
 
   rule {
@@ -3815,14 +4151,14 @@ resource "aws_wafv2_rule_group" "test" {
     sampled_requests_enabled   = false
   }
 }
-`, name)
+`, rName)
 }
 
-func testAccRuleGroupConfig_logicalStatementOrNotAnd(name string) string {
+func testAccRuleGroupConfig_logicalStatementOrNotAnd(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_rule_group" "test" {
   capacity = 3
-  name     = "%s"
+  name     = %[1]q
   scope    = "REGIONAL"
 
   rule {
@@ -3876,14 +4212,14 @@ resource "aws_wafv2_rule_group" "test" {
     sampled_requests_enabled   = false
   }
 }
-`, name)
+`, rName)
 }
 
-func testAccRuleGroupConfig_regexMatchStatement(name string) string {
+func testAccRuleGroupConfig_regexMatchStatement(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_rule_group" "test" {
   capacity = 50
-  name     = "%s"
+  name     = %[1]q
   scope    = "REGIONAL"
 
   rule {
@@ -3922,13 +4258,13 @@ resource "aws_wafv2_rule_group" "test" {
     sampled_requests_enabled   = false
   }
 }
-`, name)
+`, rName)
 }
 
-func testAccRuleGroupConfig_regexPatternSetReferenceStatement(name string) string {
+func testAccRuleGroupConfig_regexPatternSetReferenceStatement(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_regex_pattern_set" "test" {
-  name  = "regex-pattern-set-%s"
+  name  = "regex-pattern-set-%[1]s"
   scope = "REGIONAL"
 
   regular_expression {
@@ -3938,7 +4274,7 @@ resource "aws_wafv2_regex_pattern_set" "test" {
 
 resource "aws_wafv2_rule_group" "test" {
   capacity = 50
-  name     = "%s"
+  name     = %[1]q
   scope    = "REGIONAL"
 
   rule {
@@ -3977,14 +4313,14 @@ resource "aws_wafv2_rule_group" "test" {
     sampled_requests_enabled   = false
   }
 }
-`, name, name)
+`, rName)
 }
 
-func testAccRuleGroupConfig_sizeConstraintStatement(name string) string {
+func testAccRuleGroupConfig_sizeConstraintStatement(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_rule_group" "test" {
   capacity = 30
-  name     = "%s"
+  name     = %[1]q
   scope    = "REGIONAL"
 
   rule {
@@ -4024,14 +4360,14 @@ resource "aws_wafv2_rule_group" "test" {
     sampled_requests_enabled   = false
   }
 }
-`, name)
+`, rName)
 }
 
-func testAccRuleGroupConfig_sizeConstraintStatementUpdate(name string) string {
+func testAccRuleGroupConfig_sizeConstraintStatementUpdate(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_rule_group" "test" {
   capacity = 30
-  name     = "%s"
+  name     = %[1]q
   scope    = "REGIONAL"
 
   rule {
@@ -4076,14 +4412,14 @@ resource "aws_wafv2_rule_group" "test" {
     sampled_requests_enabled   = false
   }
 }
-`, name)
+`, rName)
 }
 
-func testAccRuleGroupConfig_sqliMatchStatement(name string) string {
+func testAccRuleGroupConfig_sqliMatchStatement(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_rule_group" "test" {
   capacity = 300
-  name     = "%s"
+  name     = %[1]q
   scope    = "REGIONAL"
 
   rule {
@@ -4125,14 +4461,14 @@ resource "aws_wafv2_rule_group" "test" {
     sampled_requests_enabled   = false
   }
 }
-`, name)
+`, rName)
 }
 
-func testAccRuleGroupConfig_sqliMatchStatementUpdate(name string) string {
+func testAccRuleGroupConfig_sqliMatchStatementUpdate(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_rule_group" "test" {
   capacity = 300
-  name     = "%s"
+  name     = %[1]q
   scope    = "REGIONAL"
 
   rule {
@@ -4179,14 +4515,14 @@ resource "aws_wafv2_rule_group" "test" {
     sampled_requests_enabled   = false
   }
 }
-`, name)
+`, rName)
 }
 
-func testAccRuleGroupConfig_xssMatchStatement(name string) string {
+func testAccRuleGroupConfig_xssMatchStatement(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_rule_group" "test" {
   capacity = 300
-  name     = "%s"
+  name     = %[1]q
   scope    = "REGIONAL"
 
   rule {
@@ -4223,14 +4559,14 @@ resource "aws_wafv2_rule_group" "test" {
     sampled_requests_enabled   = false
   }
 }
-`, name)
+`, rName)
 }
 
-func testAccRuleGroupConfig_xssMatchStatementUpdate(name string) string {
+func testAccRuleGroupConfig_xssMatchStatementUpdate(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_rule_group" "test" {
   capacity = 300
-  name     = "%s"
+  name     = %[1]q
   scope    = "REGIONAL"
 
   rule {
@@ -4267,14 +4603,14 @@ resource "aws_wafv2_rule_group" "test" {
     sampled_requests_enabled   = false
   }
 }
-`, name)
+`, rName)
 }
 
-func testAccRuleGroupConfig_rateBasedStatement(name string) string {
+func testAccRuleGroupConfig_rateBasedStatement(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_rule_group" "test" {
-  capacity = 3
-  name     = "%s"
+  capacity = 100
+  name     = %[1]q
   scope    = "REGIONAL"
 
   rule {
@@ -4304,14 +4640,14 @@ resource "aws_wafv2_rule_group" "test" {
     sampled_requests_enabled   = false
   }
 }
-`, name)
+`, rName)
 }
 
-func testAccRuleGroupConfig_rateBasedStatement_forwardedIPConfig(name, fallbackBehavior, headerName string) string {
+func testAccRuleGroupConfig_rateBasedStatement_forwardedIPConfig(rName, fallbackBehavior, headerName string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_rule_group" "test" {
-  capacity = 3
-  name     = "%s"
+  capacity = 100
+  name     = %[1]q
   scope    = "REGIONAL"
 
   rule {
@@ -4346,14 +4682,345 @@ resource "aws_wafv2_rule_group" "test" {
     sampled_requests_enabled   = false
   }
 }
-`, name, fallbackBehavior, headerName)
+`, rName, fallbackBehavior, headerName)
 }
 
-func testAccRuleGroupConfig_rateBasedStatement_update(name string) string {
+func testAccRuleGroupConfig_rateBasedStatement_customKeysBasic(rName, customKey, customKeyName string) string {
+	return fmt.Sprintf(`
+resource "aws_wafv2_rule_group" "test" {
+  capacity = 100
+  name     = %[1]q
+  scope    = "REGIONAL"
+
+  rule {
+    name     = "rule-1"
+    priority = 1
+
+    action {
+      count {}
+    }
+
+    statement {
+      rate_based_statement {
+        aggregate_key_type = "CUSTOM_KEYS"
+        limit              = 50000
+
+        custom_key {
+          %[2]s {
+            name = %[3]q
+
+            text_transformation {
+              type     = "NONE"
+              priority = 0
+            }
+          }
+        }
+      }
+    }
+
+    visibility_config {
+      cloudwatch_metrics_enabled = false
+      metric_name                = "friendly-rule-metric-name"
+      sampled_requests_enabled   = false
+    }
+  }
+
+  visibility_config {
+    cloudwatch_metrics_enabled = false
+    metric_name                = "friendly-metric-name"
+    sampled_requests_enabled   = false
+  }
+}
+`, rName, customKey, customKeyName)
+}
+
+func testAccRuleGroupConfig_rateBasedStatement_customKeysMinimal(rName, customKey string) string {
+	return fmt.Sprintf(`
+resource "aws_wafv2_rule_group" "test" {
+  capacity = 100
+  name     = %[1]q
+  scope    = "REGIONAL"
+
+  rule {
+    name     = "rule-1"
+    priority = 1
+
+    action {
+      count {}
+    }
+
+    statement {
+      rate_based_statement {
+        aggregate_key_type = "CUSTOM_KEYS"
+        limit              = 50000
+
+        custom_key {
+          %[2]s {
+            text_transformation {
+              type     = "NONE"
+              priority = 0
+            }
+          }
+        }
+      }
+    }
+
+    visibility_config {
+      cloudwatch_metrics_enabled = false
+      metric_name                = "friendly-rule-metric-name"
+      sampled_requests_enabled   = false
+    }
+  }
+
+  visibility_config {
+    cloudwatch_metrics_enabled = false
+    metric_name                = "friendly-metric-name"
+    sampled_requests_enabled   = false
+  }
+}
+`, rName, customKey)
+}
+
+func testAccRuleGroupConfig_rateBasedStatement_customKeysIP(rName string) string {
+	return fmt.Sprintf(`
+resource "aws_wafv2_rule_group" "test" {
+  capacity = 100
+  name     = %[1]q
+  scope    = "REGIONAL"
+
+  rule {
+    name     = "rule-1"
+    priority = 1
+
+    action {
+      count {}
+    }
+
+    statement {
+      rate_based_statement {
+        aggregate_key_type = "CUSTOM_KEYS"
+        limit              = 50000
+
+        custom_key {
+          cookie {
+            name = "cookie-name"
+
+            text_transformation {
+              type     = "NONE"
+              priority = 0
+            }
+          }
+        }
+
+        custom_key {
+          ip {}
+        }
+      }
+    }
+
+    visibility_config {
+      cloudwatch_metrics_enabled = false
+      metric_name                = "friendly-rule-metric-name"
+      sampled_requests_enabled   = false
+    }
+  }
+
+  visibility_config {
+    cloudwatch_metrics_enabled = false
+    metric_name                = "friendly-metric-name"
+    sampled_requests_enabled   = false
+  }
+}
+`, rName)
+}
+
+func testAccRuleGroupConfig_rateBasedStatement_customKeysForwardedIP(rName string) string {
+	return fmt.Sprintf(`
+resource "aws_wafv2_rule_group" "test" {
+  capacity = 100
+  name     = %[1]q
+  scope    = "REGIONAL"
+
+  rule {
+    name     = "rule-1"
+    priority = 1
+
+    action {
+      count {}
+    }
+
+    statement {
+      rate_based_statement {
+        aggregate_key_type = "CUSTOM_KEYS"
+        limit              = 50000
+
+        forwarded_ip_config {
+          fallback_behavior = "MATCH"
+          header_name       = "x-forwarded-for"
+        }
+
+        custom_key {
+          cookie {
+            name = "cookie-name"
+
+            text_transformation {
+              type     = "NONE"
+              priority = 0
+            }
+          }
+        }
+
+        custom_key {
+          forwarded_ip {}
+        }
+      }
+    }
+
+    visibility_config {
+      cloudwatch_metrics_enabled = false
+      metric_name                = "friendly-rule-metric-name"
+      sampled_requests_enabled   = false
+    }
+  }
+
+  visibility_config {
+    cloudwatch_metrics_enabled = false
+    metric_name                = "friendly-metric-name"
+    sampled_requests_enabled   = false
+  }
+}
+`, rName)
+}
+
+func testAccRuleGroupConfig_rateBasedStatement_customKeysHTTPMethod(rName string) string {
+	return fmt.Sprintf(`
+resource "aws_wafv2_rule_group" "test" {
+  capacity = 100
+  name     = %[1]q
+  scope    = "REGIONAL"
+
+  rule {
+    name     = "rule-1"
+    priority = 1
+
+    action {
+      count {}
+    }
+
+    statement {
+      rate_based_statement {
+        aggregate_key_type = "CUSTOM_KEYS"
+        limit              = 50000
+
+        custom_key {
+          http_method {}
+        }
+      }
+    }
+
+    visibility_config {
+      cloudwatch_metrics_enabled = false
+      metric_name                = "friendly-rule-metric-name"
+      sampled_requests_enabled   = false
+    }
+  }
+
+  visibility_config {
+    cloudwatch_metrics_enabled = false
+    metric_name                = "friendly-metric-name"
+    sampled_requests_enabled   = false
+  }
+}
+`, rName)
+}
+
+func testAccRuleGroupConfig_rateBasedStatement_customKeysMaxKeys(rName string) string {
+	return fmt.Sprintf(`
+resource "aws_wafv2_rule_group" "test" {
+  capacity = 200
+  name     = %[1]q
+  scope    = "REGIONAL"
+
+  rule {
+    name     = "rule-1"
+    priority = 1
+
+    action {
+      count {}
+    }
+
+    statement {
+      rate_based_statement {
+        aggregate_key_type = "CUSTOM_KEYS"
+        limit              = 50000
+
+        custom_key {
+          cookie {
+            name = "cookie-name"
+
+            text_transformation {
+              type     = "NONE"
+              priority = 0
+            }
+          }
+        }
+
+        custom_key {
+          header {
+            name = "x-api-key"
+
+            text_transformation {
+              type     = "NONE"
+              priority = 0
+            }
+          }
+        }
+
+        custom_key {
+          query_string {
+            text_transformation {
+              type     = "NONE"
+              priority = 0
+            }
+          }
+        }
+
+        custom_key {
+          uri_path {
+            text_transformation {
+              type     = "NONE"
+              priority = 0
+            }
+          }
+        }
+
+        custom_key {
+          http_method {}
+        }
+      }
+    }
+
+    visibility_config {
+      cloudwatch_metrics_enabled = false
+      metric_name                = "friendly-rule-metric-name"
+      sampled_requests_enabled   = false
+    }
+  }
+
+  visibility_config {
+    cloudwatch_metrics_enabled = false
+    metric_name                = "friendly-metric-name"
+    sampled_requests_enabled   = false
+  }
+}
+`, rName)
+}
+
+func testAccRuleGroupConfig_rateBasedStatement_update(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_rule_group" "test" {
   capacity = 3
-  name     = "%s"
+  name     = %[1]q
   scope    = "REGIONAL"
 
   rule {
@@ -4390,15 +5057,15 @@ resource "aws_wafv2_rule_group" "test" {
     sampled_requests_enabled   = false
   }
 }
-`, name)
+`, rName)
 }
 
-func testAccRuleGroupConfig_oneTag(name, tagKey, tagValue string) string {
+func testAccRuleGroupConfig_tags1(rName, tagKey1, tagValue1 string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_rule_group" "test" {
   capacity    = 2
-  name        = "%s"
-  description = "%s"
+  name        = %[1]q
+  description = %[1]q
   scope       = "REGIONAL"
 
   visibility_config {
@@ -4408,18 +5075,18 @@ resource "aws_wafv2_rule_group" "test" {
   }
 
   tags = {
-    "%s" = "%s"
+    %[2]q = %[3]q
   }
 }
-`, name, name, tagKey, tagValue)
+`, rName, tagKey1, tagValue1)
 }
 
-func testAccRuleGroupConfig_twoTags(name, tag1Key, tag1Value, tag2Key, tag2Value string) string {
+func testAccRuleGroupConfig_tags2(rName, tagKey1, tagValue1, tagKey2, tagValue2 string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_rule_group" "test" {
   capacity    = 2
-  name        = "%s"
-  description = "%s"
+  name        = %[1]q
+  description = %[1]q
   scope       = "REGIONAL"
 
   visibility_config {
@@ -4429,14 +5096,14 @@ resource "aws_wafv2_rule_group" "test" {
   }
 
   tags = {
-    "%s" = "%s"
-    "%s" = "%s"
+    %[2]q = %[3]q
+    %[4]q = %[5]q
   }
 }
-`, name, name, tag1Key, tag1Value, tag2Key, tag2Value)
+`, rName, tagKey1, tagValue1, tagKey2, tagValue2)
 }
 
-func testAccRuleGroupConfig_multipleNestedRateBasedStatements(name string) string {
+func testAccRuleGroupConfig_multipleNestedRateBasedStatements(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_regex_pattern_set" "test" {
   name  = %[1]q
@@ -4532,10 +5199,10 @@ resource "aws_wafv2_rule_group" "test" {
     sampled_requests_enabled   = false
   }
 }
-`, name)
+`, rName)
 }
 
-func testAccRuleGroupConfig_multipleNestedOperatorStatements(name string) string {
+func testAccRuleGroupConfig_multipleNestedOperatorStatements(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_regex_pattern_set" "test" {
   name  = %[1]q
@@ -4634,16 +5301,5 @@ resource "aws_wafv2_rule_group" "test" {
     sampled_requests_enabled   = false
   }
 }
-`, name)
-}
-
-func testAccRuleGroupImportStateIdFunc(resourceName string) resource.ImportStateIdFunc {
-	return func(s *terraform.State) (string, error) {
-		rs, ok := s.RootModule().Resources[resourceName]
-		if !ok {
-			return "", fmt.Errorf("Not found: %s", resourceName)
-		}
-
-		return fmt.Sprintf("%s/%s/%s", rs.Primary.ID, rs.Primary.Attributes["name"], rs.Primary.Attributes["scope"]), nil
-	}
+`, rName)
 }
diff --git a/internal/service/wafv2/schemas.go b/internal/service/wafv2/schemas.go
index 9145715012c..ec60542b345 100644
--- a/internal/service/wafv2/schemas.go
+++ b/internal/service/wafv2/schemas.go
@@ -1,24 +1,29 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package wafv2
 
 import (
 	"math"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/wafv2"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
 )
 
+var listOfEmptyObjectSchema *schema.Schema = &schema.Schema{
+	Type:     schema.TypeList,
+	Optional: true,
+	MaxItems: 1,
+	Elem: &schema.Resource{
+		Schema: map[string]*schema.Schema{},
+	},
+}
+
 func emptySchema() *schema.Schema {
-	return &schema.Schema{
-		Type:     schema.TypeList,
-		Optional: true,
-		MaxItems: 1,
-		Elem: &schema.Resource{
-			Schema: map[string]*schema.Schema{},
-		},
-	}
+	return listOfEmptyObjectSchema
 }
 
 func ruleLabelsSchema() *schema.Schema {
@@ -32,7 +37,7 @@ func ruleLabelsSchema() *schema.Schema {
 					Required: true,
 					ValidateFunc: validation.All(
 						validation.StringLenBetween(1, 1024),
-						validation.StringMatch(regexp.MustCompile(`^[0-9A-Za-z_\-:]+$`), "must contain only alphanumeric, underscore, hyphen, and colon characters"),
+						validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_\-:]+$`), "must contain only alphanumeric, underscore, hyphen, and colon characters"),
 					),
 				},
 			},
@@ -197,7 +202,7 @@ func ipSetReferenceStatementSchema() *schema.Schema {
 								Required: true,
 								ValidateFunc: validation.All(
 									validation.StringLenBetween(1, 255),
-									validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9-]+$`), "must contain only alphanumeric and hyphen characters"),
+									validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z-]+$`), "must contain only alphanumeric and hyphen characters"),
 								),
 							},
 							"position": {
@@ -225,7 +230,7 @@ func labelMatchStatementSchema() *schema.Schema {
 					Required: true,
 					ValidateFunc: validation.All(
 						validation.StringLenBetween(1, 1024),
-						validation.StringMatch(regexp.MustCompile(`^[0-9A-Za-z_\-:]+$`), "must contain only alphanumeric, underscore, hyphen, and colon characters"),
+						validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_\-:]+$`), "must contain only alphanumeric, underscore, hyphen, and colon characters"),
 					),
 				},
 				"scope": {
@@ -338,6 +343,7 @@ func fieldToMatchBaseSchema() *schema.Resource {
 			"body":                bodySchema(),
 			"cookies":             cookiesSchema(),
 			"headers":             headersSchema(),
+			"ja3_fingerprint":     ja3fingerprintSchema(),
 			"json_body":           jsonBodySchema(),
 			"method":              emptySchema(),
 			"query_string":        emptySchema(),
@@ -354,7 +360,7 @@ func fieldToMatchBaseSchema() *schema.Resource {
 								validation.StringLenBetween(1, 40),
 								// The value is returned in lower case by the API.
 								// Trying to solve it with StateFunc and/or DiffSuppressFunc resulted in hash problem of the rule field or didn't work.
-								validation.StringMatch(regexp.MustCompile(`^[a-z0-9-_]+$`), "must contain only lowercase alphanumeric characters, underscores, and hyphens"),
+								validation.StringMatch(regexache.MustCompile(`^[0-9a-z_-]+$`), "must contain only lowercase alphanumeric characters, underscores, and hyphens"),
 							),
 						},
 					},
@@ -373,7 +379,7 @@ func fieldToMatchBaseSchema() *schema.Resource {
 								validation.StringLenBetween(1, 30),
 								// The value is returned in lower case by the API.
 								// Trying to solve it with StateFunc and/or DiffSuppressFunc resulted in hash problem of the rule field or didn't work.
-								validation.StringMatch(regexp.MustCompile(`^[a-z0-9-_]+$`), "must contain only lowercase alphanumeric characters, underscores, and hyphens"),
+								validation.StringMatch(regexache.MustCompile(`^[0-9a-z_-]+$`), "must contain only lowercase alphanumeric characters, underscores, and hyphens"),
 							),
 						},
 					},
@@ -433,7 +439,7 @@ func jsonBodyMatchPatternSchema() *schema.Schema {
 						Type: schema.TypeString,
 						ValidateFunc: validation.All(
 							validation.StringLenBetween(1, 512),
-							validation.StringMatch(regexp.MustCompile(`(/)|(/(([^~])|(~[01]))+)`), "must be a valid JSON pointer")),
+							validation.StringMatch(regexache.MustCompile(`(/)|(/(([^~])|(~[01]))+)`), "must be a valid JSON pointer")),
 					},
 				},
 			},
@@ -499,7 +505,7 @@ func visibilityConfigSchema() *schema.Schema {
 					Required: true,
 					ValidateFunc: validation.All(
 						validation.StringLenBetween(1, 128),
-						validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9-_]+$`), "must contain only alphanumeric hyphen and underscore characters"),
+						validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_-]+$`), "must contain only alphanumeric hyphen and underscore characters"),
 					),
 				},
 				"sampled_requests_enabled": {
@@ -511,6 +517,43 @@ func visibilityConfigSchema() *schema.Schema {
 	}
 }
 
+func associationConfigSchema() *schema.Schema {
+	return &schema.Schema{
+		Type:     schema.TypeList,
+		Optional: true,
+		MaxItems: 1,
+		Elem: &schema.Resource{
+			Schema: map[string]*schema.Schema{
+				"request_body": requestBodySchema(),
+			},
+		},
+	}
+}
+
+func requestBodySchema() *schema.Schema {
+	return &schema.Schema{
+		Type:     schema.TypeList,
+		Optional: true,
+		Elem: &schema.Resource{
+			Schema: map[string]*schema.Schema{
+				"cloudfront": {
+					Type:     schema.TypeList,
+					Optional: true,
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"default_size_inspection_limit": {
+								Type:         schema.TypeString,
+								Required:     true,
+								ValidateFunc: validation.StringInSlice(wafv2.SizeInspectionLimit_Values(), false),
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+}
+
 func allowConfigSchema() *schema.Schema {
 	return &schema.Schema{
 		Type:     schema.TypeList,
@@ -619,7 +662,7 @@ func customRequestHandlingSchema() *schema.Schema {
 								Required: true,
 								ValidateFunc: validation.All(
 									validation.StringLenBetween(1, 64),
-									validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9._$-]+$`), "must contain only alphanumeric, hyphen, underscore, dot and $ characters"),
+									validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_$.-]+$`), "must contain only alphanumeric, hyphen, underscore, dot and $ characters"),
 								),
 							},
 							"value": {
@@ -647,7 +690,7 @@ func customResponseSchema() *schema.Schema {
 					Optional: true,
 					ValidateFunc: validation.All(
 						validation.StringLenBetween(1, 128),
-						validation.StringMatch(regexp.MustCompile(`^[\w\-]+$`), "must contain only alphanumeric, hyphen, and underscore characters"),
+						validation.StringMatch(regexache.MustCompile(`^[\w\-]+$`), "must contain only alphanumeric, hyphen, and underscore characters"),
 					),
 				},
 				"response_code": {
@@ -665,7 +708,7 @@ func customResponseSchema() *schema.Schema {
 								Required: true,
 								ValidateFunc: validation.All(
 									validation.StringLenBetween(1, 64),
-									validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9._$-]+$`), "must contain only alphanumeric, hyphen, underscore, dot and $ characters"),
+									validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_$.-]+$`), "must contain only alphanumeric, hyphen, underscore, dot and $ characters"),
 								),
 							},
 							"value": {
@@ -692,7 +735,7 @@ func customResponseBodySchema() *schema.Schema {
 					Required: true,
 					ValidateFunc: validation.All(
 						validation.StringLenBetween(1, 128),
-						validation.StringMatch(regexp.MustCompile(`^[\w\-]+$`), "must contain only alphanumeric, hyphen, and underscore characters"),
+						validation.StringMatch(regexache.MustCompile(`^[\w\-]+$`), "must contain only alphanumeric, hyphen, and underscore characters"),
 					),
 				},
 				"content": {
@@ -747,6 +790,23 @@ func cookiesMatchPatternSchema() *schema.Schema {
 	}
 }
 
+func ja3fingerprintSchema() *schema.Schema {
+	return &schema.Schema{
+		Type:     schema.TypeList,
+		Optional: true,
+		MaxItems: 1,
+		Elem: &schema.Resource{
+			Schema: map[string]*schema.Schema{
+				"fallback_behavior": {
+					Type:         schema.TypeString,
+					Required:     true,
+					ValidateFunc: validation.StringInSlice(wafv2.FallbackBehavior_Values(), false),
+				},
+			},
+		},
+	}
+}
+
 func bodySchema() *schema.Schema {
 	return &schema.Schema{
 		Type:     schema.TypeList,
@@ -821,7 +881,7 @@ func headersMatchPatternBaseSchema() *schema.Schema {
 			Type: schema.TypeString,
 			ValidateFunc: validation.All(
 				validation.StringLenBetween(1, 64),
-				validation.StringMatch(regexp.MustCompile(`.*\S.*`), ""),
+				validation.StringMatch(regexache.MustCompile(`.*\S.*`), ""),
 			),
 		},
 	}
@@ -897,6 +957,101 @@ func rateBasedStatementSchema(level int) *schema.Schema {
 					Default:      wafv2.RateBasedStatementAggregateKeyTypeIp,
 					ValidateFunc: validation.StringInSlice(wafv2.RateBasedStatementAggregateKeyType_Values(), false),
 				},
+				"custom_key": {
+					Type:     schema.TypeList,
+					Optional: true,
+					MinItems: 1,
+					MaxItems: 5,
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"cookie": {
+								Type:     schema.TypeList,
+								Optional: true,
+								MaxItems: 1,
+								Elem: &schema.Resource{
+									Schema: map[string]*schema.Schema{
+										"name": {
+											Type:         schema.TypeString,
+											Required:     true,
+											ValidateFunc: validation.StringLenBetween(1, 64),
+										},
+										"text_transformation": textTransformationSchema(),
+									},
+								},
+							},
+							"forwarded_ip": emptySchema(),
+							"http_method":  emptySchema(),
+							"header": {
+								Type:     schema.TypeList,
+								Optional: true,
+								MaxItems: 1,
+								Elem: &schema.Resource{
+									Schema: map[string]*schema.Schema{
+										"name": {
+											Type:         schema.TypeString,
+											Required:     true,
+											ValidateFunc: validation.StringLenBetween(1, 64),
+										},
+										"text_transformation": textTransformationSchema(),
+									},
+								},
+							},
+							"ip": emptySchema(),
+							"label_namespace": {
+								Type:     schema.TypeList,
+								Optional: true,
+								MaxItems: 1,
+								Elem: &schema.Resource{
+									Schema: map[string]*schema.Schema{
+										"namespace": {
+											Type:     schema.TypeString,
+											Required: true,
+											ValidateFunc: validation.All(
+												validation.StringLenBetween(1, 1024),
+												validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_\-:]+$`), "must contain only alphanumeric, underscore, hyphen, and colon characters"),
+											),
+										},
+									},
+								},
+							},
+							"query_argument": {
+								Type:     schema.TypeList,
+								Optional: true,
+								MaxItems: 1,
+								Elem: &schema.Resource{
+									Schema: map[string]*schema.Schema{
+										"name": {
+											Type:         schema.TypeString,
+											Required:     true,
+											ValidateFunc: validation.StringLenBetween(1, 64),
+										},
+										"text_transformation": textTransformationSchema(),
+									},
+								},
+							},
+							"query_string": {
+								Type:     schema.TypeList,
+								Optional: true,
+								MaxItems: 1,
+								Elem: &schema.Resource{
+									Schema: map[string]*schema.Schema{
+										"text_transformation": textTransformationSchema(),
+									},
+								},
+							},
+							"uri_path": {
+								Type:     schema.TypeList,
+								Optional: true,
+								MaxItems: 1,
+								Elem: &schema.Resource{
+									Schema: map[string]*schema.Schema{
+										"text_transformation": textTransformationSchema(),
+									},
+								},
+							},
+						},
+					},
+				},
 				"forwarded_ip_config": forwardedIPConfigSchema(),
 				"limit": {
 					Type:         schema.TypeInt,
@@ -957,17 +1112,34 @@ func managedRuleGroupConfigSchema() *schema.Schema {
 		Optional: true,
 		Elem: &schema.Resource{
 			Schema: map[string]*schema.Schema{
-				"aws_managed_rules_bot_control_rule_set": {
+				"aws_managed_rules_acfp_rule_set": {
 					Type:     schema.TypeList,
 					Optional: true,
 					MaxItems: 1,
 					Elem: &schema.Resource{
 						Schema: map[string]*schema.Schema{
-							"inspection_level": {
-								Type:         schema.TypeString,
-								Required:     true,
-								ValidateFunc: validation.StringInSlice(wafv2.InspectionLevel_Values(), false),
+							"enable_regex_in_path": {
+								Type:     schema.TypeBool,
+								Optional: true,
 							},
+							"creation_path": {
+								Type:     schema.TypeString,
+								Required: true,
+								ValidateFunc: validation.All(
+									validation.StringLenBetween(1, 256),
+									validation.StringMatch(regexache.MustCompile(`.*\S.*`), `must conform to pattern .*\S.* `),
+								),
+							},
+							"registration_page_path": {
+								Type:     schema.TypeString,
+								Required: true,
+								ValidateFunc: validation.All(
+									validation.StringLenBetween(1, 256),
+									validation.StringMatch(regexache.MustCompile(`.*\S.*`), `must conform to pattern .*\S.* `),
+								),
+							},
+							"request_inspection":  managedRuleGroupConfigACFPRequestInspectionSchema(),
+							"response_inspection": managedRuleGroupConfigATPResponseInspectionSchema(),
 						},
 					},
 				},
@@ -977,12 +1149,16 @@ func managedRuleGroupConfigSchema() *schema.Schema {
 					MaxItems: 1,
 					Elem: &schema.Resource{
 						Schema: map[string]*schema.Schema{
+							"enable_regex_in_path": {
+								Type:     schema.TypeBool,
+								Optional: true,
+							},
 							"login_path": {
 								Type:     schema.TypeString,
 								Required: true,
 								ValidateFunc: validation.All(
 									validation.StringLenBetween(1, 256),
-									validation.StringMatch(regexp.MustCompile(`.*\S.*`), `must conform to pattern .*\S.* `),
+									validation.StringMatch(regexache.MustCompile(`.*\S.*`), `must conform to pattern .*\S.* `),
 								),
 							},
 							"request_inspection":  managedRuleGroupConfigATPRequestInspectionSchema(),
@@ -990,12 +1166,26 @@ func managedRuleGroupConfigSchema() *schema.Schema {
 						},
 					},
 				},
+				"aws_managed_rules_bot_control_rule_set": {
+					Type:     schema.TypeList,
+					Optional: true,
+					MaxItems: 1,
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"inspection_level": {
+								Type:         schema.TypeString,
+								Required:     true,
+								ValidateFunc: validation.StringInSlice(wafv2.InspectionLevel_Values(), false),
+							},
+						},
+					},
+				},
 				"login_path": {
 					Type:     schema.TypeString,
 					Optional: true,
 					ValidateFunc: validation.All(
 						validation.StringLenBetween(1, 256),
-						validation.StringMatch(regexp.MustCompile(`.*\S.*`), `must conform to pattern .*\S.* `),
+						validation.StringMatch(regexache.MustCompile(`.*\S.*`), `must conform to pattern .*\S.* `),
 					),
 				},
 				"password_field": {
@@ -1009,7 +1199,7 @@ func managedRuleGroupConfigSchema() *schema.Schema {
 								Required: true,
 								ValidateFunc: validation.All(
 									validation.StringLenBetween(1, 512),
-									validation.StringMatch(regexp.MustCompile(`.*\S.*`), `must conform to pattern .*\S.* `),
+									validation.StringMatch(regexache.MustCompile(`.*\S.*`), `must conform to pattern .*\S.* `),
 								),
 							},
 						},
@@ -1031,7 +1221,7 @@ func managedRuleGroupConfigSchema() *schema.Schema {
 								Required: true,
 								ValidateFunc: validation.All(
 									validation.StringLenBetween(1, 512),
-									validation.StringMatch(regexp.MustCompile(`.*\S.*`), `must conform to pattern .*\S.* `),
+									validation.StringMatch(regexache.MustCompile(`.*\S.*`), `must conform to pattern .*\S.* `),
 								),
 							},
 						},
@@ -1049,10 +1239,11 @@ func actionToUseSchema() *schema.Schema {
 		MaxItems: 1,
 		Elem: &schema.Resource{
 			Schema: map[string]*schema.Schema{
-				"allow":   allowConfigSchema(),
-				"block":   blockConfigSchema(),
-				"captcha": captchaConfigSchema(),
-				"count":   countConfigSchema(),
+				"allow":     allowConfigSchema(),
+				"block":     blockConfigSchema(),
+				"captcha":   captchaConfigSchema(),
+				"challenge": challengeConfigSchema(),
+				"count":     countConfigSchema(),
 			},
 		},
 	}
@@ -1076,6 +1267,74 @@ func ruleGroupReferenceStatementSchema() *schema.Schema {
 	}
 }
 
+func managedRuleGroupConfigACFPRequestInspectionSchema() *schema.Schema {
+	return &schema.Schema{
+		Type:     schema.TypeList,
+		Required: true,
+		MaxItems: 1,
+		Elem: &schema.Resource{
+			Schema: map[string]*schema.Schema{
+				"email_field": {
+					Type:     schema.TypeList,
+					Optional: true,
+					MaxItems: 1,
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"identifier": {
+								Type:     schema.TypeString,
+								Required: true,
+								ValidateFunc: validation.All(
+									validation.StringLenBetween(1, 512),
+									validation.StringMatch(regexache.MustCompile(`.*\S.*`), `must conform to pattern .*\S.* `),
+								),
+							},
+						},
+					},
+				},
+				"password_field": {
+					Type:     schema.TypeList,
+					Optional: true,
+					MaxItems: 1,
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"identifier": {
+								Type:     schema.TypeString,
+								Required: true,
+								ValidateFunc: validation.All(
+									validation.StringLenBetween(1, 512),
+									validation.StringMatch(regexache.MustCompile(`.*\S.*`), `must conform to pattern .*\S.* `),
+								),
+							},
+						},
+					},
+				},
+				"payload_type": {
+					Type:         schema.TypeString,
+					Required:     true,
+					ValidateFunc: validation.StringInSlice(wafv2.PayloadType_Values(), false),
+				},
+				"username_field": {
+					Type:     schema.TypeList,
+					Optional: true,
+					MaxItems: 1,
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"identifier": {
+								Type:     schema.TypeString,
+								Required: true,
+								ValidateFunc: validation.All(
+									validation.StringLenBetween(1, 512),
+									validation.StringMatch(regexache.MustCompile(`.*\S.*`), `must conform to pattern .*\S.* `),
+								),
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+}
+
 func managedRuleGroupConfigATPRequestInspectionSchema() *schema.Schema {
 	return &schema.Schema{
 		Type:     schema.TypeList,
@@ -1094,7 +1353,7 @@ func managedRuleGroupConfigATPRequestInspectionSchema() *schema.Schema {
 								Required: true,
 								ValidateFunc: validation.All(
 									validation.StringLenBetween(1, 512),
-									validation.StringMatch(regexp.MustCompile(`.*\S.*`), `must conform to pattern .*\S.* `),
+									validation.StringMatch(regexache.MustCompile(`.*\S.*`), `must conform to pattern .*\S.* `),
 								),
 							},
 						},
@@ -1116,7 +1375,7 @@ func managedRuleGroupConfigATPRequestInspectionSchema() *schema.Schema {
 								Required: true,
 								ValidateFunc: validation.All(
 									validation.StringLenBetween(1, 512),
-									validation.StringMatch(regexp.MustCompile(`.*\S.*`), `must conform to pattern .*\S.* `),
+									validation.StringMatch(regexache.MustCompile(`.*\S.*`), `must conform to pattern .*\S.* `),
 								),
 							},
 						},
diff --git a/internal/service/wafv2/service_package.go b/internal/service/wafv2/service_package.go
index 799ae45effb..159a4ff06f9 100644
--- a/internal/service/wafv2/service_package.go
+++ b/internal/service/wafv2/service_package.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package wafv2
 
 import (
diff --git a/internal/service/wafv2/service_package_gen.go b/internal/service/wafv2/service_package_gen.go
index 9a041c3add0..e9ce0dfe4cd 100644
--- a/internal/service/wafv2/service_package_gen.go
+++ b/internal/service/wafv2/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	wafv2_sdkv1 "github.com/aws/aws-sdk-go/service/wafv2"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -99,4 +100,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*w
 	return wafv2_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/wafv2/sweep.go b/internal/service/wafv2/sweep.go
index 0cbd152821f..24fc4e33698 100644
--- a/internal/service/wafv2/sweep.go
+++ b/internal/service/wafv2/sweep.go
@@ -1,5 +1,5 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package wafv2
 
@@ -12,9 +12,10 @@ import (
 	"github.com/aws/aws-sdk-go/service/wafv2"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_wafv2_ip_set", &resource.Sweeper{
 		Name: "aws_wafv2_ip_set",
 		F:    sweepIPSets,
@@ -49,7 +50,7 @@ func init() {
 
 func sweepIPSets(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -78,7 +79,7 @@ func sweepIPSets(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping WAFv2 IPSet sweep for %s: %s", region, err)
 		return nil
 	}
@@ -87,7 +88,7 @@ func sweepIPSets(region string) error {
 		return fmt.Errorf("error listing WAFv2 IPSets (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping WAFv2 IPSets (%s): %w", region, err)
@@ -98,7 +99,7 @@ func sweepIPSets(region string) error {
 
 func sweepRegexPatternSets(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -127,7 +128,7 @@ func sweepRegexPatternSets(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping WAFv2 RegexPatternSet sweep for %s: %s", region, err)
 		return nil
 	}
@@ -136,7 +137,7 @@ func sweepRegexPatternSets(region string) error {
 		return fmt.Errorf("error listing WAFv2 RegexPatternSets (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping WAFv2 RegexPatternSets (%s): %w", region, err)
@@ -147,7 +148,7 @@ func sweepRegexPatternSets(region string) error {
 
 func sweepRuleGroups(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -176,7 +177,7 @@ func sweepRuleGroups(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping WAFv2 RuleGroup sweep for %s: %s", region, err)
 		return nil
 	}
@@ -185,7 +186,7 @@ func sweepRuleGroups(region string) error {
 		return fmt.Errorf("error listing WAFv2 RuleGroups (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping WAFv2 RuleGroups (%s): %w", region, err)
@@ -196,7 +197,7 @@ func sweepRuleGroups(region string) error {
 
 func sweepWebACLs(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
@@ -235,7 +236,7 @@ func sweepWebACLs(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
+	if awsv1.SkipSweepError(err) {
 		log.Printf("[WARN] Skipping WAFv2 WebACL sweep for %s: %s", region, err)
 		return nil
 	}
@@ -244,7 +245,7 @@ func sweepWebACLs(region string) error {
 		return fmt.Errorf("error listing WAFv2 WebACLs (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping WAFv2 WebACLs (%s): %w", region, err)
diff --git a/internal/service/wafv2/tags_gen.go b/internal/service/wafv2/tags_gen.go
index 673213b475b..1f097716177 100644
--- a/internal/service/wafv2/tags_gen.go
+++ b/internal/service/wafv2/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/wafv2"
 	"github.com/aws/aws-sdk-go/service/wafv2/wafv2iface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -102,6 +104,8 @@ func updateTags(ctx context.Context, conn wafv2iface.WAFV2API, identifier string
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.WAFV2)
 	if len(removedTags) > 0 {
diff --git a/internal/service/wafv2/web_acl.go b/internal/service/wafv2/web_acl.go
index f6d8adb1266..41f4911602f 100644
--- a/internal/service/wafv2/web_acl.go
+++ b/internal/service/wafv2/web_acl.go
@@ -1,13 +1,16 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package wafv2
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"strings"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/wafv2"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -54,112 +57,115 @@ func ResourceWebACL() *schema.Resource {
 			},
 		},
 
-		Schema: map[string]*schema.Schema{
-			"arn": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
-			"capacity": {
-				Type:     schema.TypeInt,
-				Computed: true,
-			},
-			"captcha_config":       outerCaptchaConfigSchema(),
-			"custom_response_body": customResponseBodySchema(),
-			"default_action": {
-				Type:     schema.TypeList,
-				Required: true,
-				MaxItems: 1,
-				Elem: &schema.Resource{
-					Schema: map[string]*schema.Schema{
-						"allow": allowConfigSchema(),
-						"block": blockConfigSchema(),
+		SchemaFunc: func() map[string]*schema.Schema {
+			return map[string]*schema.Schema{
+				"arn": {
+					Type:     schema.TypeString,
+					Computed: true,
+				},
+				"association_config": associationConfigSchema(),
+				"capacity": {
+					Type:     schema.TypeInt,
+					Computed: true,
+				},
+				"captcha_config":       outerCaptchaConfigSchema(),
+				"custom_response_body": customResponseBodySchema(),
+				"default_action": {
+					Type:     schema.TypeList,
+					Required: true,
+					MaxItems: 1,
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"allow": allowConfigSchema(),
+							"block": blockConfigSchema(),
+						},
 					},
 				},
-			},
-			"description": {
-				Type:         schema.TypeString,
-				Optional:     true,
-				ValidateFunc: validation.StringLenBetween(1, 256),
-			},
-			"lock_token": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
-			"name": {
-				Type:     schema.TypeString,
-				Required: true,
-				ForceNew: true,
-				ValidateFunc: validation.All(
-					validation.StringLenBetween(1, 128),
-					validation.StringMatch(regexp.MustCompile(`^[a-zA-Z0-9-_]+$`), "must contain only alphanumeric hyphen and underscore characters"),
-				),
-			},
-			"rule": {
-				Type:     schema.TypeSet,
-				Optional: true,
-				Elem: &schema.Resource{
-					Schema: map[string]*schema.Schema{
-						"action": {
-							Type:     schema.TypeList,
-							Optional: true,
-							MaxItems: 1,
-							Elem: &schema.Resource{
-								Schema: map[string]*schema.Schema{
-									"allow":     allowConfigSchema(),
-									"block":     blockConfigSchema(),
-									"captcha":   captchaConfigSchema(),
-									"challenge": challengeConfigSchema(),
-									"count":     countConfigSchema(),
+				"description": {
+					Type:         schema.TypeString,
+					Optional:     true,
+					ValidateFunc: validation.StringLenBetween(1, 256),
+				},
+				"lock_token": {
+					Type:     schema.TypeString,
+					Computed: true,
+				},
+				"name": {
+					Type:     schema.TypeString,
+					Required: true,
+					ForceNew: true,
+					ValidateFunc: validation.All(
+						validation.StringLenBetween(1, 128),
+						validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_-]+$`), "must contain only alphanumeric hyphen and underscore characters"),
+					),
+				},
+				"rule": {
+					Type:     schema.TypeSet,
+					Optional: true,
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"action": {
+								Type:     schema.TypeList,
+								Optional: true,
+								MaxItems: 1,
+								Elem: &schema.Resource{
+									Schema: map[string]*schema.Schema{
+										"allow":     allowConfigSchema(),
+										"block":     blockConfigSchema(),
+										"captcha":   captchaConfigSchema(),
+										"challenge": challengeConfigSchema(),
+										"count":     countConfigSchema(),
+									},
 								},
 							},
-						},
-						"captcha_config": outerCaptchaConfigSchema(),
-						"name": {
-							Type:         schema.TypeString,
-							Required:     true,
-							ValidateFunc: validation.StringLenBetween(1, 128),
-						},
-						"override_action": {
-							Type:     schema.TypeList,
-							Optional: true,
-							MaxItems: 1,
-							Elem: &schema.Resource{
-								Schema: map[string]*schema.Schema{
-									"count": emptySchema(),
-									"none":  emptySchema(),
+							"captcha_config": outerCaptchaConfigSchema(),
+							"name": {
+								Type:         schema.TypeString,
+								Required:     true,
+								ValidateFunc: validation.StringLenBetween(1, 128),
+							},
+							"override_action": {
+								Type:     schema.TypeList,
+								Optional: true,
+								MaxItems: 1,
+								Elem: &schema.Resource{
+									Schema: map[string]*schema.Schema{
+										"count": emptySchema(),
+										"none":  emptySchema(),
+									},
 								},
 							},
+							"priority": {
+								Type:     schema.TypeInt,
+								Required: true,
+							},
+							"rule_label":        ruleLabelsSchema(),
+							"statement":         webACLRootStatementSchema(webACLRootStatementSchemaLevel),
+							"visibility_config": visibilityConfigSchema(),
 						},
-						"priority": {
-							Type:     schema.TypeInt,
-							Required: true,
-						},
-						"rule_label":        ruleLabelsSchema(),
-						"statement":         webACLRootStatementSchema(webACLRootStatementSchemaLevel),
-						"visibility_config": visibilityConfigSchema(),
 					},
 				},
-			},
-			"scope": {
-				Type:         schema.TypeString,
-				Required:     true,
-				ForceNew:     true,
-				ValidateFunc: validation.StringInSlice(wafv2.Scope_Values(), false),
-			},
-			names.AttrTags:    tftags.TagsSchema(),
-			names.AttrTagsAll: tftags.TagsSchemaComputed(),
-			"token_domains": {
-				Type:     schema.TypeSet,
-				Optional: true,
-				Elem: &schema.Schema{
-					Type: schema.TypeString,
-					ValidateFunc: validation.All(
-						validation.StringLenBetween(1, 253),
-						validation.StringMatch(regexp.MustCompile(`^[\w\.\-/]+$`), "must contain only alphanumeric, hyphen, dot, underscore and forward-slash characters"),
-					),
+				"scope": {
+					Type:         schema.TypeString,
+					Required:     true,
+					ForceNew:     true,
+					ValidateFunc: validation.StringInSlice(wafv2.Scope_Values(), false),
 				},
-			},
-			"visibility_config": visibilityConfigSchema(),
+				names.AttrTags:    tftags.TagsSchema(),
+				names.AttrTagsAll: tftags.TagsSchemaComputed(),
+				"token_domains": {
+					Type:     schema.TypeSet,
+					Optional: true,
+					Elem: &schema.Schema{
+						Type: schema.TypeString,
+						ValidateFunc: validation.All(
+							validation.StringLenBetween(1, 253),
+							validation.StringMatch(regexache.MustCompile(`^[\w\.\-/]+$`), "must contain only alphanumeric, hyphen, dot, underscore and forward-slash characters"),
+						),
+					},
+				},
+				"visibility_config": visibilityConfigSchema(),
+			}
 		},
 
 		CustomizeDiff: verify.SetTagsDiff,
@@ -171,13 +177,14 @@ func resourceWebACLCreate(ctx context.Context, d *schema.ResourceData, meta inte
 
 	name := d.Get("name").(string)
 	input := &wafv2.CreateWebACLInput{
-		CaptchaConfig:    expandCaptchaConfig(d.Get("captcha_config").([]interface{})),
-		DefaultAction:    expandDefaultAction(d.Get("default_action").([]interface{})),
-		Name:             aws.String(name),
-		Rules:            expandWebACLRules(d.Get("rule").(*schema.Set).List()),
-		Scope:            aws.String(d.Get("scope").(string)),
-		Tags:             getTagsIn(ctx),
-		VisibilityConfig: expandVisibilityConfig(d.Get("visibility_config").([]interface{})),
+		AssociationConfig: expandAssociationConfig(d.Get("association_config").([]interface{})),
+		CaptchaConfig:     expandCaptchaConfig(d.Get("captcha_config").([]interface{})),
+		DefaultAction:     expandDefaultAction(d.Get("default_action").([]interface{})),
+		Name:              aws.String(name),
+		Rules:             expandWebACLRules(d.Get("rule").(*schema.Set).List()),
+		Scope:             aws.String(d.Get("scope").(string)),
+		Tags:              getTagsIn(ctx),
+		VisibilityConfig:  expandVisibilityConfig(d.Get("visibility_config").([]interface{})),
 	}
 
 	if v, ok := d.GetOk("custom_response_body"); ok && v.(*schema.Set).Len() > 0 {
@@ -226,6 +233,9 @@ func resourceWebACLRead(ctx context.Context, d *schema.ResourceData, meta interf
 	arn := aws.StringValue(webACL.ARN)
 	d.Set("arn", arn)
 	d.Set("capacity", webACL.Capacity)
+	if err := d.Set("association_config", flattenAssociationConfig(webACL.AssociationConfig)); err != nil {
+		return diag.Errorf("setting association_config: %s", err)
+	}
 	if err := d.Set("captcha_config", flattenCaptchaConfig(webACL.CaptchaConfig)); err != nil {
 		return diag.Errorf("setting captcha_config: %s", err)
 	}
@@ -254,15 +264,31 @@ func resourceWebACLUpdate(ctx context.Context, d *schema.ResourceData, meta inte
 	conn := meta.(*conns.AWSClient).WAFV2Conn(ctx)
 
 	if d.HasChangesExcept("tags", "tags_all") {
+		aclID := d.Id()
+		aclName := d.Get("name").(string)
+		aclScope := d.Get("scope").(string)
+		aclLockToken := d.Get("lock_token").(string)
+		// Find the AWS managed ShieldMitigationRuleGroup group rule if existent and add it into the set of rules to update
+		// so that the provider will not remove the Shield rule when changes are applied to the WebACL.
+		rules := expandWebACLRules(d.Get("rule").(*schema.Set).List())
+		if sr := findShieldRule(rules); len(sr) == 0 {
+			output, err := FindWebACLByThreePartKey(ctx, conn, aclID, aclName, aclScope)
+			if err != nil {
+				return diag.Errorf("reading WAFv2 WebACL (%s): %s", aclID, err)
+			}
+			rules = append(rules, findShieldRule(output.WebACL.Rules)...)
+		}
+
 		input := &wafv2.UpdateWebACLInput{
-			CaptchaConfig:    expandCaptchaConfig(d.Get("captcha_config").([]interface{})),
-			DefaultAction:    expandDefaultAction(d.Get("default_action").([]interface{})),
-			Id:               aws.String(d.Id()),
-			LockToken:        aws.String(d.Get("lock_token").(string)),
-			Name:             aws.String(d.Get("name").(string)),
-			Rules:            expandWebACLRules(d.Get("rule").(*schema.Set).List()),
-			Scope:            aws.String(d.Get("scope").(string)),
-			VisibilityConfig: expandVisibilityConfig(d.Get("visibility_config").([]interface{})),
+			AssociationConfig: expandAssociationConfig(d.Get("association_config").([]interface{})),
+			CaptchaConfig:     expandCaptchaConfig(d.Get("captcha_config").([]interface{})),
+			DefaultAction:     expandDefaultAction(d.Get("default_action").([]interface{})),
+			Id:                aws.String(aclID),
+			LockToken:         aws.String(aclLockToken),
+			Name:              aws.String(aclName),
+			Rules:             rules,
+			Scope:             aws.String(aclScope),
+			VisibilityConfig:  expandVisibilityConfig(d.Get("visibility_config").([]interface{})),
 		}
 
 		if v, ok := d.GetOk("custom_response_body"); ok && v.(*schema.Set).Len() > 0 {
@@ -282,7 +308,7 @@ func resourceWebACLUpdate(ctx context.Context, d *schema.ResourceData, meta inte
 		}, wafv2.ErrCodeWAFUnavailableEntityException)
 
 		if tfawserr.ErrCodeEquals(err, wafv2.ErrCodeWAFOptimisticLockException) {
-			return diag.Errorf("updating WAFv2 WebACL (%s), resource has changed since last refresh please run a new plan before applying again: %s", d.Id(), err)
+			return retryResourceWebACLUpdateOptmisticLockFailure(ctx, conn, aclID, aclName, aclScope, aclLockToken, input)
 		}
 
 		if err != nil {
@@ -293,14 +319,38 @@ func resourceWebACLUpdate(ctx context.Context, d *schema.ResourceData, meta inte
 	return resourceWebACLRead(ctx, d, meta)
 }
 
+func retryResourceWebACLUpdateOptmisticLockFailure(ctx context.Context, conn *wafv2.WAFV2, id, name, scope, lockToken string, input *wafv2.UpdateWebACLInput) diag.Diagnostics {
+	webAcl, err := FindWebACLByThreePartKey(ctx, conn, id, name, scope)
+	if err != nil {
+		return diag.Errorf("refreshing WAFv2 WebACL (%s), attempting to refresh WAFv2 WebACL to retrieve new LockToken: %s", id, err)
+	} else if aws.StringValue(webAcl.LockToken) != lockToken {
+		// Retrieved a new lock token, retry due to other processes modifying the web acl out of band (See: https://docs.aws.amazon.com/sdk-for-go/api/service/shield/#Shield.EnableApplicationLayerAutomaticResponse)
+		input.LockToken = webAcl.LockToken
+		_, err := tfresource.RetryWhenAWSErrCodeEquals(ctx, webACLDeleteTimeout, func() (interface{}, error) {
+			return conn.UpdateWebACLWithContext(ctx, input)
+		}, wafv2.ErrCodeWAFAssociatedItemException, wafv2.ErrCodeWAFUnavailableEntityException)
+
+		if tfawserr.ErrCodeEquals(err, wafv2.ErrCodeWAFOptimisticLockException) {
+			return diag.Errorf("updating WAFv2 WebACL (%s), resource has changed since last refresh please run a new plan before applying again: %s", id, err)
+		}
+		return nil
+	}
+	return nil
+}
+
 func resourceWebACLDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	conn := meta.(*conns.AWSClient).WAFV2Conn(ctx)
 
+	aclId := d.Id()
+	aclName := d.Get("name").(string)
+	aclScope := d.Get("scope").(string)
+	aclLockToken := d.Get("lock_token").(string)
+
 	input := &wafv2.DeleteWebACLInput{
-		Id:        aws.String(d.Id()),
-		LockToken: aws.String(d.Get("lock_token").(string)),
-		Name:      aws.String(d.Get("name").(string)),
-		Scope:     aws.String(d.Get("scope").(string)),
+		Id:        aws.String(aclId),
+		LockToken: aws.String(aclLockToken),
+		Name:      aws.String(aclName),
+		Scope:     aws.String(aclScope),
 	}
 
 	log.Printf("[INFO] Deleting WAFv2 WebACL: %s", d.Id())
@@ -308,6 +358,10 @@ func resourceWebACLDelete(ctx context.Context, d *schema.ResourceData, meta inte
 		return conn.DeleteWebACLWithContext(ctx, input)
 	}, wafv2.ErrCodeWAFAssociatedItemException, wafv2.ErrCodeWAFUnavailableEntityException)
 
+	if tfawserr.ErrCodeEquals(err, wafv2.ErrCodeWAFOptimisticLockException) {
+		return retryResourceWebACLDeleteOptmisticLockFailure(ctx, conn, aclId, aclName, aclScope, aclLockToken)
+	}
+
 	if tfawserr.ErrCodeEquals(err, wafv2.ErrCodeWAFNonexistentItemException) {
 		return nil
 	}
@@ -319,6 +373,30 @@ func resourceWebACLDelete(ctx context.Context, d *schema.ResourceData, meta inte
 	return nil
 }
 
+func retryResourceWebACLDeleteOptmisticLockFailure(ctx context.Context, conn *wafv2.WAFV2, id, name, scope, lockToken string) diag.Diagnostics {
+	webAcl, err := FindWebACLByThreePartKey(ctx, conn, id, name, scope)
+	if err != nil {
+		return diag.Errorf("refreshing WAFv2 WebACL (%s), attempting to refresh WAFv2 WebACL to retrieve new LockToken: %s", id, err)
+	} else if aws.StringValue(webAcl.LockToken) != lockToken {
+		// got a new lock token, retry due to other processes modifying the web acl out of band (See: https://docs.aws.amazon.com/sdk-for-go/api/service/shield/#Shield.EnableApplicationLayerAutomaticResponse)
+		retryInput := &wafv2.DeleteWebACLInput{
+			Id:        aws.String(id),
+			LockToken: webAcl.LockToken,
+			Name:      aws.String(name),
+			Scope:     aws.String(scope),
+		}
+		_, err := tfresource.RetryWhenAWSErrCodeEquals(ctx, webACLDeleteTimeout, func() (interface{}, error) {
+			return conn.DeleteWebACLWithContext(ctx, retryInput)
+		}, wafv2.ErrCodeWAFAssociatedItemException, wafv2.ErrCodeWAFUnavailableEntityException)
+
+		if tfawserr.ErrCodeEquals(err, wafv2.ErrCodeWAFOptimisticLockException) {
+			return diag.Errorf("deleting WAFv2 WebACL (%s), resource has changed since last refresh please run a new plan before applying again: %s", id, err)
+		}
+		return nil
+	}
+	return nil
+}
+
 func FindWebACLByThreePartKey(ctx context.Context, conn *wafv2.WAFV2, id, name, scope string) (*wafv2.GetWebACLOutput, error) {
 	input := &wafv2.GetWebACLInput{
 		Id:    aws.String(id),
@@ -353,9 +431,14 @@ func FindWebACLByThreePartKey(ctx context.Context, conn *wafv2.WAFV2, id, name,
 // See https://docs.aws.amazon.com/waf/latest/developerguide/ddos-automatic-app-layer-response-rg.html
 func filterWebACLRules(rules, configRules []*wafv2.Rule) []*wafv2.Rule {
 	var fr []*wafv2.Rule
-	pattern := `^ShieldMitigationRuleGroup_\d{12}_[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}_.*`
+	sr := findShieldRule(rules)
+
+	if len(sr) == 0 {
+		return rules
+	}
+
 	for _, r := range rules {
-		if regexp.MustCompile(pattern).MatchString(aws.StringValue(r.Name)) {
+		if aws.StringValue(r.Name) == aws.StringValue(sr[0].Name) {
 			filter := true
 			for _, cr := range configRules {
 				if aws.StringValue(cr.Name) == aws.StringValue(r.Name) {
@@ -372,3 +455,14 @@ func filterWebACLRules(rules, configRules []*wafv2.Rule) []*wafv2.Rule {
 	}
 	return fr
 }
+
+func findShieldRule(rules []*wafv2.Rule) []*wafv2.Rule {
+	pattern := `^ShieldMitigationRuleGroup_\d{12}_[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}_.*`
+	var sr []*wafv2.Rule
+	for _, r := range rules {
+		if regexache.MustCompile(pattern).MatchString(aws.StringValue(r.Name)) {
+			sr = append(sr, r)
+		}
+	}
+	return sr
+}
diff --git a/internal/service/wafv2/web_acl_association.go b/internal/service/wafv2/web_acl_association.go
index 669a5157552..705d1357429 100644
--- a/internal/service/wafv2/web_acl_association.go
+++ b/internal/service/wafv2/web_acl_association.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package wafv2
 
 import (
@@ -33,19 +36,21 @@ func ResourceWebACLAssociation() *schema.Resource {
 			Create: schema.DefaultTimeout(5 * time.Minute),
 		},
 
-		Schema: map[string]*schema.Schema{
-			"resource_arn": {
-				Type:         schema.TypeString,
-				ForceNew:     true,
-				Required:     true,
-				ValidateFunc: verify.ValidARN,
-			},
-			"web_acl_arn": {
-				Type:         schema.TypeString,
-				ForceNew:     true,
-				Required:     true,
-				ValidateFunc: verify.ValidARN,
-			},
+		SchemaFunc: func() map[string]*schema.Schema {
+			return map[string]*schema.Schema{
+				"resource_arn": {
+					Type:         schema.TypeString,
+					ForceNew:     true,
+					Required:     true,
+					ValidateFunc: verify.ValidARN,
+				},
+				"web_acl_arn": {
+					Type:         schema.TypeString,
+					ForceNew:     true,
+					Required:     true,
+					ValidateFunc: verify.ValidARN,
+				},
+			}
 		},
 	}
 }
diff --git a/internal/service/wafv2/web_acl_association_test.go b/internal/service/wafv2/web_acl_association_test.go
index 894fc076ce4..98833f4b4ac 100644
--- a/internal/service/wafv2/web_acl_association_test.go
+++ b/internal/service/wafv2/web_acl_association_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package wafv2_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/wafv2"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -36,8 +39,8 @@ func TestAccWAFV2WebACLAssociation_basic(t *testing.T) {
 				Config: testAccWebACLAssociationConfig_basic(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckWebACLAssociationExists(ctx, resourceName),
-					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "resource_arn", "apigateway", regexp.MustCompile(fmt.Sprintf("/restapis/.*/stages/%s", rName))),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "web_acl_arn", "wafv2", regexp.MustCompile(fmt.Sprintf("regional/webacl/%s/.*", rName))),
+					acctest.MatchResourceAttrRegionalARNNoAccount(resourceName, "resource_arn", "apigateway", regexache.MustCompile(fmt.Sprintf("/restapis/.*/stages/%s", rName))),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "web_acl_arn", "wafv2", regexache.MustCompile(fmt.Sprintf("regional/webacl/%s/.*", rName))),
 				),
 			},
 			{
diff --git a/internal/service/wafv2/web_acl_data_source.go b/internal/service/wafv2/web_acl_data_source.go
index caaf5fbbb03..f4a4bf9d39f 100644
--- a/internal/service/wafv2/web_acl_data_source.go
+++ b/internal/service/wafv2/web_acl_data_source.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package wafv2
 
 import (
@@ -17,24 +20,26 @@ func DataSourceWebACL() *schema.Resource {
 	return &schema.Resource{
 		ReadWithoutTimeout: dataSourceWebACLRead,
 
-		Schema: map[string]*schema.Schema{
-			"arn": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
-			"description": {
-				Type:     schema.TypeString,
-				Computed: true,
-			},
-			"name": {
-				Type:     schema.TypeString,
-				Required: true,
-			},
-			"scope": {
-				Type:         schema.TypeString,
-				Required:     true,
-				ValidateFunc: validation.StringInSlice(wafv2.Scope_Values(), false),
-			},
+		SchemaFunc: func() map[string]*schema.Schema {
+			return map[string]*schema.Schema{
+				"arn": {
+					Type:     schema.TypeString,
+					Computed: true,
+				},
+				"description": {
+					Type:     schema.TypeString,
+					Computed: true,
+				},
+				"name": {
+					Type:     schema.TypeString,
+					Required: true,
+				},
+				"scope": {
+					Type:         schema.TypeString,
+					Required:     true,
+					ValidateFunc: validation.StringInSlice(wafv2.Scope_Values(), false),
+				},
+			}
 		},
 	}
 }
diff --git a/internal/service/wafv2/web_acl_data_source_test.go b/internal/service/wafv2/web_acl_data_source_test.go
index c29785e75c8..296a4e5f30e 100644
--- a/internal/service/wafv2/web_acl_data_source_test.go
+++ b/internal/service/wafv2/web_acl_data_source_test.go
@@ -1,10 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package wafv2_test
 
 import (
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/service/wafv2"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -24,13 +27,13 @@ func TestAccWAFV2WebACLDataSource_basic(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccWebACLDataSourceConfig_nonExistent(name),
-				ExpectError: regexp.MustCompile(`WAFv2 WebACL not found`),
+				ExpectError: regexache.MustCompile(`WAFv2 WebACL not found`),
 			},
 			{
 				Config: testAccWebACLDataSourceConfig_name(name),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttrPair(datasourceName, "arn", resourceName, "arn"),
-					acctest.MatchResourceAttrRegionalARN(datasourceName, "arn", "wafv2", regexp.MustCompile(fmt.Sprintf("regional/webacl/%v/.+$", name))),
+					acctest.MatchResourceAttrRegionalARN(datasourceName, "arn", "wafv2", regexache.MustCompile(fmt.Sprintf("regional/webacl/%v/.+$", name))),
 					resource.TestCheckResourceAttrPair(datasourceName, "description", resourceName, "description"),
 					resource.TestCheckResourceAttrPair(datasourceName, "id", resourceName, "id"),
 					resource.TestCheckResourceAttrPair(datasourceName, "name", resourceName, "name"),
diff --git a/internal/service/wafv2/web_acl_logging_configuration.go b/internal/service/wafv2/web_acl_logging_configuration.go
index 6d1a25f8d0c..368b7b8a7f6 100644
--- a/internal/service/wafv2/web_acl_logging_configuration.go
+++ b/internal/service/wafv2/web_acl_logging_configuration.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package wafv2
 
 import (
@@ -5,8 +8,8 @@ import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/wafv2"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -34,135 +37,137 @@ func ResourceWebACLLoggingConfiguration() *schema.Resource {
 			StateContext: schema.ImportStatePassthroughContext,
 		},
 
-		Schema: map[string]*schema.Schema{
-			"log_destination_configs": {
-				Type:     schema.TypeSet,
-				Required: true,
-				ForceNew: true,
-				MinItems: 1,
-				MaxItems: 100,
-				Elem: &schema.Schema{
-					Type:         schema.TypeString,
-					ValidateFunc: verify.ValidARN,
+		SchemaFunc: func() map[string]*schema.Schema {
+			return map[string]*schema.Schema{
+				"log_destination_configs": {
+					Type:     schema.TypeSet,
+					Required: true,
+					ForceNew: true,
+					MinItems: 1,
+					MaxItems: 100,
+					Elem: &schema.Schema{
+						Type:         schema.TypeString,
+						ValidateFunc: verify.ValidARN,
+					},
+					Description: "AWS Kinesis Firehose Delivery Stream ARNs",
 				},
-				Description: "AWS Kinesis Firehose Delivery Stream ARNs",
-			},
-			"logging_filter": {
-				Type:     schema.TypeList,
-				Optional: true,
-				MaxItems: 1,
-				Elem: &schema.Resource{
-					Schema: map[string]*schema.Schema{
-						"default_behavior": {
-							Type:         schema.TypeString,
-							Required:     true,
-							ValidateFunc: validation.StringInSlice(wafv2.FilterBehavior_Values(), false),
-						},
-						"filter": {
-							Type:     schema.TypeSet,
-							Required: true,
-							Elem: &schema.Resource{
-								Schema: map[string]*schema.Schema{
-									"behavior": {
-										Type:         schema.TypeString,
-										Required:     true,
-										ValidateFunc: validation.StringInSlice(wafv2.FilterBehavior_Values(), false),
-									},
-									"condition": {
-										Type:     schema.TypeSet,
-										Required: true,
-										MinItems: 1,
-										Elem: &schema.Resource{
-											Schema: map[string]*schema.Schema{
-												"action_condition": {
-													Type:     schema.TypeList,
-													Optional: true,
-													MaxItems: 1,
-													Elem: &schema.Resource{
-														Schema: map[string]*schema.Schema{
-															"action": {
-																Type:         schema.TypeString,
-																Required:     true,
-																ValidateFunc: validation.StringInSlice(wafv2.ActionValue_Values(), false),
+				"logging_filter": {
+					Type:     schema.TypeList,
+					Optional: true,
+					MaxItems: 1,
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"default_behavior": {
+								Type:         schema.TypeString,
+								Required:     true,
+								ValidateFunc: validation.StringInSlice(wafv2.FilterBehavior_Values(), false),
+							},
+							"filter": {
+								Type:     schema.TypeSet,
+								Required: true,
+								Elem: &schema.Resource{
+									Schema: map[string]*schema.Schema{
+										"behavior": {
+											Type:         schema.TypeString,
+											Required:     true,
+											ValidateFunc: validation.StringInSlice(wafv2.FilterBehavior_Values(), false),
+										},
+										"condition": {
+											Type:     schema.TypeSet,
+											Required: true,
+											MinItems: 1,
+											Elem: &schema.Resource{
+												Schema: map[string]*schema.Schema{
+													"action_condition": {
+														Type:     schema.TypeList,
+														Optional: true,
+														MaxItems: 1,
+														Elem: &schema.Resource{
+															Schema: map[string]*schema.Schema{
+																"action": {
+																	Type:         schema.TypeString,
+																	Required:     true,
+																	ValidateFunc: validation.StringInSlice(wafv2.ActionValue_Values(), false),
+																},
 															},
 														},
 													},
-												},
-												"label_name_condition": {
-													Type:     schema.TypeList,
-													Optional: true,
-													MaxItems: 1,
-													Elem: &schema.Resource{
-														Schema: map[string]*schema.Schema{
-															"label_name": {
-																Type:     schema.TypeString,
-																Required: true,
-																ValidateFunc: validation.All(
-																	validation.StringLenBetween(1, 1024),
-																	validation.StringMatch(regexp.MustCompile(`^[0-9A-Za-z_\-:]+$`), "must contain only alphanumeric characters, underscores, hyphens, and colons"),
-																),
+													"label_name_condition": {
+														Type:     schema.TypeList,
+														Optional: true,
+														MaxItems: 1,
+														Elem: &schema.Resource{
+															Schema: map[string]*schema.Schema{
+																"label_name": {
+																	Type:     schema.TypeString,
+																	Required: true,
+																	ValidateFunc: validation.All(
+																		validation.StringLenBetween(1, 1024),
+																		validation.StringMatch(regexache.MustCompile(`^[0-9A-Za-z_\-:]+$`), "must contain only alphanumeric characters, underscores, hyphens, and colons"),
+																	),
+																},
 															},
 														},
 													},
 												},
 											},
 										},
-									},
-									"requirement": {
-										Type:         schema.TypeString,
-										Required:     true,
-										ValidateFunc: validation.StringInSlice(wafv2.FilterRequirement_Values(), false),
+										"requirement": {
+											Type:         schema.TypeString,
+											Required:     true,
+											ValidateFunc: validation.StringInSlice(wafv2.FilterRequirement_Values(), false),
+										},
 									},
 								},
 							},
 						},
 					},
 				},
-			},
-			"redacted_fields": {
-				// To allow this argument and its nested fields with Empty Schemas (e.g. "method")
-				// to be correctly interpreted, this argument must be of type List,
-				// otherwise, at apply-time a field configured as an empty block
-				// (e.g. body {}) will result in a nil redacted_fields attribute
-				Type:     schema.TypeList,
-				Optional: true,
-				MaxItems: 100,
-				Elem: &schema.Resource{
-					Schema: map[string]*schema.Schema{
-						"method":       emptySchema(),
-						"query_string": emptySchema(),
-						"single_header": {
-							Type:     schema.TypeList,
-							Optional: true,
-							MaxItems: 1,
-							Elem: &schema.Resource{
-								Schema: map[string]*schema.Schema{
-									"name": {
-										Type:     schema.TypeString,
-										Required: true,
-										ValidateFunc: validation.All(
-											validation.StringLenBetween(1, 40),
-											// The value is returned in lower case by the API.
-											// Trying to solve it with StateFunc and/or DiffSuppressFunc resulted in hash problem of the rule field or didn't work.
-											validation.StringMatch(regexp.MustCompile(`^[a-z0-9-_]+$`), "must contain only lowercase alphanumeric characters, underscores, and hyphens"),
-										),
+				"redacted_fields": {
+					// To allow this argument and its nested fields with Empty Schemas (e.g. "method")
+					// to be correctly interpreted, this argument must be of type List,
+					// otherwise, at apply-time a field configured as an empty block
+					// (e.g. body {}) will result in a nil redacted_fields attribute
+					Type:     schema.TypeList,
+					Optional: true,
+					MaxItems: 100,
+					Elem: &schema.Resource{
+						Schema: map[string]*schema.Schema{
+							"method":       emptySchema(),
+							"query_string": emptySchema(),
+							"single_header": {
+								Type:     schema.TypeList,
+								Optional: true,
+								MaxItems: 1,
+								Elem: &schema.Resource{
+									Schema: map[string]*schema.Schema{
+										"name": {
+											Type:     schema.TypeString,
+											Required: true,
+											ValidateFunc: validation.All(
+												validation.StringLenBetween(1, 40),
+												// The value is returned in lower case by the API.
+												// Trying to solve it with StateFunc and/or DiffSuppressFunc resulted in hash problem of the rule field or didn't work.
+												validation.StringMatch(regexache.MustCompile(`^[0-9a-z_-]+$`), "must contain only lowercase alphanumeric characters, underscores, and hyphens"),
+											),
+										},
 									},
 								},
 							},
+							"uri_path": emptySchema(),
 						},
-						"uri_path": emptySchema(),
 					},
+					Description:      "Parts of the request to exclude from logs",
+					DiffSuppressFunc: suppressRedactedFieldsDiff,
 				},
-				Description:      "Parts of the request to exclude from logs",
-				DiffSuppressFunc: suppressRedactedFieldsDiff,
-			},
-			"resource_arn": {
-				Type:         schema.TypeString,
-				Required:     true,
-				ForceNew:     true,
-				ValidateFunc: verify.ValidARN,
-				Description:  "AWS WebACL ARN",
-			},
+				"resource_arn": {
+					Type:         schema.TypeString,
+					Required:     true,
+					ForceNew:     true,
+					ValidateFunc: verify.ValidARN,
+					Description:  "AWS WebACL ARN",
+				},
+			}
 		},
 	}
 }
diff --git a/internal/service/wafv2/web_acl_logging_configuration_test.go b/internal/service/wafv2/web_acl_logging_configuration_test.go
index 7b8b4bbdce3..a24b0047699 100644
--- a/internal/service/wafv2/web_acl_logging_configuration_test.go
+++ b/internal/service/wafv2/web_acl_logging_configuration_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package wafv2_test
 
 import (
diff --git a/internal/service/wafv2/web_acl_test.go b/internal/service/wafv2/web_acl_test.go
index dca56866877..ae394f97c5f 100644
--- a/internal/service/wafv2/web_acl_test.go
+++ b/internal/service/wafv2/web_acl_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package wafv2_test
 
 import (
@@ -7,6 +10,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/wafv2"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
@@ -25,6 +29,7 @@ func init() {
 func testAccErrorCheckSkip(t *testing.T) resource.ErrorCheckFunc {
 	return acctest.ErrorCheckSkipMessagesContaining(t,
 		"Your request contains fields that belong to a feature you are not allowed to use",
+		"The scope is not valid., field: SCOPE_VALUE, parameter: CLOUDFRONT",
 	)
 }
 
@@ -44,7 +49,8 @@ func TestAccWAFV2WebACL_basic(t *testing.T) {
 				Config: testAccWebACLConfig_basic(webACLName),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckWebACLExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/webacl/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/webacl/.+$`)),
+					resource.TestCheckResourceAttr(resourceName, "association_config.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "captcha_config.#", "0"),
 					resource.TestCheckResourceAttr(resourceName, "default_action.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "default_action.0.allow.#", "1"),
@@ -89,7 +95,7 @@ func TestAccWAFV2WebACL_Update_rule(t *testing.T) {
 				Config: testAccWebACLConfig_basicRule(webACLName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckWebACLExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/webacl/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/webacl/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "name", webACLName),
 					resource.TestCheckResourceAttr(resourceName, "description", "Updated"),
 					resource.TestCheckResourceAttr(resourceName, "scope", wafv2.ScopeRegional),
@@ -143,7 +149,7 @@ func TestAccWAFV2WebACL_Update_rule(t *testing.T) {
 				Config: testAccWebACLConfig_updateRuleNamePriorityMetric(webACLName, ruleName1, ruleName2, 10, 5),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckWebACLExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/webacl/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/webacl/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "name", webACLName),
 					resource.TestCheckResourceAttr(resourceName, "description", "Updated"),
 					resource.TestCheckResourceAttr(resourceName, "scope", wafv2.ScopeRegional),
@@ -228,7 +234,7 @@ func TestAccWAFV2WebACL_Update_ruleProperties(t *testing.T) {
 				Config: testAccWebACLConfig_updateRuleNamePriorityMetric(webACLName, ruleName1, ruleName2, 5, 10),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckWebACLExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/webacl/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/webacl/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "name", webACLName),
 					resource.TestCheckResourceAttr(resourceName, "description", "Updated"),
 					resource.TestCheckResourceAttr(resourceName, "scope", wafv2.ScopeRegional),
@@ -289,7 +295,7 @@ func TestAccWAFV2WebACL_Update_ruleProperties(t *testing.T) {
 				Config: testAccWebACLConfig_updateRuleNamePriorityMetric(webACLName, ruleName1, ruleName2, 10, 5),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckWebACLExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/webacl/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/webacl/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "name", webACLName),
 					resource.TestCheckResourceAttr(resourceName, "description", "Updated"),
 					resource.TestCheckResourceAttr(resourceName, "scope", wafv2.ScopeRegional),
@@ -350,7 +356,7 @@ func TestAccWAFV2WebACL_Update_ruleProperties(t *testing.T) {
 				Config: testAccWebACLConfig_updateRuleNamePriorityMetric(webACLName, ruleName1, "updated", 10, 5),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckWebACLExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/webacl/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/webacl/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "name", webACLName),
 					resource.TestCheckResourceAttr(resourceName, "description", "Updated"),
 					resource.TestCheckResourceAttr(resourceName, "scope", wafv2.ScopeRegional),
@@ -434,7 +440,7 @@ func TestAccWAFV2WebACL_Update_nameForceNew(t *testing.T) {
 				Config: testAccWebACLConfig_basic(webACLName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckWebACLExists(ctx, resourceName, &before),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/webacl/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/webacl/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "name", webACLName),
 					resource.TestCheckResourceAttr(resourceName, "description", webACLName),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "0"),
@@ -452,7 +458,7 @@ func TestAccWAFV2WebACL_Update_nameForceNew(t *testing.T) {
 				Config: testAccWebACLConfig_basic(ruleGroupNewName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckWebACLExists(ctx, resourceName, &after),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/webacl/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/webacl/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "name", ruleGroupNewName),
 					resource.TestCheckResourceAttr(resourceName, "description", ruleGroupNewName),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "0"),
@@ -510,7 +516,7 @@ func TestAccWAFV2WebACL_ManagedRuleGroup_basic(t *testing.T) {
 				Config: testAccWebACLConfig_managedRuleGroupStatement(webACLName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckWebACLExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/webacl/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/webacl/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "name", webACLName),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
@@ -532,7 +538,7 @@ func TestAccWAFV2WebACL_ManagedRuleGroup_basic(t *testing.T) {
 				Config: testAccWebACLConfig_managedRuleGroupStatementUpdate(webACLName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckWebACLExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/webacl/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/webacl/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "name", webACLName),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
@@ -560,7 +566,7 @@ func TestAccWAFV2WebACL_ManagedRuleGroup_basic(t *testing.T) {
 				Config: testAccWebACLConfig_managedRuleGroupStatementRuleActionOverrides(webACLName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckWebACLExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/webacl/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/webacl/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "name", webACLName),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
@@ -578,12 +584,14 @@ func TestAccWAFV2WebACL_ManagedRuleGroup_basic(t *testing.T) {
 						"statement.0.managed_rule_group_statement.0.rule_action_override.0.action_to_use.0.allow.#":               "0",
 						"statement.0.managed_rule_group_statement.0.rule_action_override.0.action_to_use.0.block.#":               "0",
 						"statement.0.managed_rule_group_statement.0.rule_action_override.0.action_to_use.0.captcha.#":             "0",
+						"statement.0.managed_rule_group_statement.0.rule_action_override.0.action_to_use.0.challenge.#":           "0",
 						"statement.0.managed_rule_group_statement.0.rule_action_override.0.action_to_use.0.count.#":               "1",
 						"statement.0.managed_rule_group_statement.0.rule_action_override.0.name":                                  "SizeRestrictions_QUERYSTRING",
 						"statement.0.managed_rule_group_statement.0.rule_action_override.1.action_to_use.#":                       "1",
 						"statement.0.managed_rule_group_statement.0.rule_action_override.1.action_to_use.0.allow.#":               "0",
 						"statement.0.managed_rule_group_statement.0.rule_action_override.1.action_to_use.0.block.#":               "0",
 						"statement.0.managed_rule_group_statement.0.rule_action_override.1.action_to_use.0.captcha.#":             "0",
+						"statement.0.managed_rule_group_statement.0.rule_action_override.1.action_to_use.0.challenge.#":           "0",
 						"statement.0.managed_rule_group_statement.0.rule_action_override.1.action_to_use.0.count.#":               "1",
 						"statement.0.managed_rule_group_statement.0.rule_action_override.1.name":                                  "NoUserAgent_HEADER",
 						"statement.0.managed_rule_group_statement.0.scope_down_statement.#":                                       "1",
@@ -598,7 +606,7 @@ func TestAccWAFV2WebACL_ManagedRuleGroup_basic(t *testing.T) {
 				Config: testAccWebACLConfig_managedRuleGroupStatementVersionVersion10(webACLName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckWebACLExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/webacl/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/webacl/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "name", webACLName),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
@@ -643,7 +651,7 @@ func TestAccWAFV2WebACL_ManagedRuleGroup_ManagedRuleGroupConfig(t *testing.T) {
 				Config: testAccWebACLConfig_managedRuleGroupStatementManagedRuleGroupConfig(webACLName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckWebACLExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/webacl/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/webacl/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "name", webACLName),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
@@ -668,7 +676,7 @@ func TestAccWAFV2WebACL_ManagedRuleGroup_ManagedRuleGroupConfig(t *testing.T) {
 				Config: testAccWebACLConfig_managedRuleGroupStatementManagedRuleGroupConfigUpdate(webACLName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckWebACLExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/webacl/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/webacl/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "name", webACLName),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
@@ -700,6 +708,98 @@ func TestAccWAFV2WebACL_ManagedRuleGroup_ManagedRuleGroupConfig(t *testing.T) {
 	})
 }
 
+func TestAccWAFV2WebACL_ManagedRuleGroup_ManagedRuleGroupConfig_ACFPRuleSet(t *testing.T) {
+	ctx := acctest.Context(t)
+	var v wafv2.WebACL
+	webACLName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_wafv2_web_acl.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheckScopeRegional(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, wafv2.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckWebACLDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccWebACLConfig_managedRuleGroupStatementManagedRuleGroupConfig_acfpRuleSet(webACLName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckWebACLExists(ctx, resourceName, &v),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/webacl/.+$`)),
+					resource.TestCheckResourceAttr(resourceName, "name", webACLName),
+					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
+						"name":                      "rule-1",
+						"action.#":                  "0",
+						"override_action.#":         "1",
+						"override_action.0.count.#": "0",
+						"override_action.0.none.#":  "1",
+						"statement.#":               "1",
+						"statement.0.managed_rule_group_statement.#":                                                                "1",
+						"statement.0.managed_rule_group_statement.0.managed_rule_group_configs.0.aws_managed_rules_acfp_rule_set.#": "1",
+						// "statement.0.managed_rule_group_statement.0.managed_rule_group_configs.0.aws_managed_rules_acfp_rule_set.0.enable_regex_in_path":                             "false",
+						"statement.0.managed_rule_group_statement.0.managed_rule_group_configs.0.aws_managed_rules_acfp_rule_set.0.creation_path":                                    "/creation",
+						"statement.0.managed_rule_group_statement.0.managed_rule_group_configs.0.aws_managed_rules_acfp_rule_set.0.registration_page_path":                           "/registration",
+						"statement.0.managed_rule_group_statement.0.managed_rule_group_configs.0.aws_managed_rules_acfp_rule_set.0.request_inspection.#":                             "1",
+						"statement.0.managed_rule_group_statement.0.managed_rule_group_configs.0.aws_managed_rules_acfp_rule_set.0.request_inspection.0.email_field.#":               "1",
+						"statement.0.managed_rule_group_statement.0.managed_rule_group_configs.0.aws_managed_rules_acfp_rule_set.0.request_inspection.0.email_field.0.identifier":    "/email",
+						"statement.0.managed_rule_group_statement.0.managed_rule_group_configs.0.aws_managed_rules_acfp_rule_set.0.request_inspection.0.password_field.#":            "1",
+						"statement.0.managed_rule_group_statement.0.managed_rule_group_configs.0.aws_managed_rules_acfp_rule_set.0.request_inspection.0.password_field.0.identifier": "/password",
+						"statement.0.managed_rule_group_statement.0.managed_rule_group_configs.0.aws_managed_rules_acfp_rule_set.0.request_inspection.0.payload_type":                "JSON",
+						"statement.0.managed_rule_group_statement.0.managed_rule_group_configs.0.aws_managed_rules_acfp_rule_set.0.request_inspection.0.username_field.#":            "1",
+						"statement.0.managed_rule_group_statement.0.managed_rule_group_configs.0.aws_managed_rules_acfp_rule_set.0.request_inspection.0.username_field.0.identifier": "/username",
+						"statement.0.managed_rule_group_statement.0.managed_rule_group_configs.0.aws_managed_rules_acfp_rule_set.0.response_inspection.#":                            "0",
+						"statement.0.managed_rule_group_statement.0.name":                   "AWSManagedRulesACFPRuleSet",
+						"statement.0.managed_rule_group_statement.0.rule_action_override.#": "0",
+						"statement.0.managed_rule_group_statement.0.scope_down_statement.#": "0",
+						"statement.0.managed_rule_group_statement.0.vendor_name":            "AWS",
+					}),
+				),
+			},
+			{
+				Config: testAccWebACLConfig_managedRuleGroupStatementManagedRuleGroupConfig_acfpRuleSetUpdate(webACLName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckWebACLExists(ctx, resourceName, &v),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/webacl/.+$`)),
+					resource.TestCheckResourceAttr(resourceName, "name", webACLName),
+					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
+						"name":                      "rule-1",
+						"action.#":                  "0",
+						"override_action.#":         "1",
+						"override_action.0.count.#": "0",
+						"override_action.0.none.#":  "1",
+						"statement.#":               "1",
+						"statement.0.managed_rule_group_statement.#":                                                                                                                 "1",
+						"statement.0.managed_rule_group_statement.0.managed_rule_group_configs.0.aws_managed_rules_acfp_rule_set.#":                                                  "1",
+						"statement.0.managed_rule_group_statement.0.managed_rule_group_configs.0.aws_managed_rules_acfp_rule_set.0.enable_regex_in_path":                             "true",
+						"statement.0.managed_rule_group_statement.0.managed_rule_group_configs.0.aws_managed_rules_acfp_rule_set.0.creation_path":                                    "/creation",
+						"statement.0.managed_rule_group_statement.0.managed_rule_group_configs.0.aws_managed_rules_acfp_rule_set.0.registration_page_path":                           "/registration",
+						"statement.0.managed_rule_group_statement.0.managed_rule_group_configs.0.aws_managed_rules_acfp_rule_set.0.request_inspection.#":                             "1",
+						"statement.0.managed_rule_group_statement.0.managed_rule_group_configs.0.aws_managed_rules_acfp_rule_set.0.request_inspection.0.email_field.#":               "1",
+						"statement.0.managed_rule_group_statement.0.managed_rule_group_configs.0.aws_managed_rules_acfp_rule_set.0.request_inspection.0.email_field.0.identifier":    "/email",
+						"statement.0.managed_rule_group_statement.0.managed_rule_group_configs.0.aws_managed_rules_acfp_rule_set.0.request_inspection.0.password_field.#":            "1",
+						"statement.0.managed_rule_group_statement.0.managed_rule_group_configs.0.aws_managed_rules_acfp_rule_set.0.request_inspection.0.password_field.0.identifier": "/pass",
+						"statement.0.managed_rule_group_statement.0.managed_rule_group_configs.0.aws_managed_rules_acfp_rule_set.0.request_inspection.0.payload_type":                "JSON",
+						"statement.0.managed_rule_group_statement.0.managed_rule_group_configs.0.aws_managed_rules_acfp_rule_set.0.request_inspection.0.username_field.#":            "1",
+						"statement.0.managed_rule_group_statement.0.managed_rule_group_configs.0.aws_managed_rules_acfp_rule_set.0.request_inspection.0.username_field.0.identifier": "/user",
+						"statement.0.managed_rule_group_statement.0.managed_rule_group_configs.0.aws_managed_rules_acfp_rule_set.0.response_inspection.#":                            "0",
+						"statement.0.managed_rule_group_statement.0.name":                   "AWSManagedRulesACFPRuleSet",
+						"statement.0.managed_rule_group_statement.0.rule_action_override.#": "0",
+						"statement.0.managed_rule_group_statement.0.scope_down_statement.#": "0",
+						"statement.0.managed_rule_group_statement.0.vendor_name":            "AWS",
+					}),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+				ImportStateIdFunc: testAccWebACLImportStateIdFunc(resourceName),
+			},
+		},
+	})
+}
+
 func TestAccWAFV2WebACL_ManagedRuleGroup_ManagedRuleGroupConfig_ATPRuleSet(t *testing.T) {
 	ctx := acctest.Context(t)
 	var v wafv2.WebACL
@@ -716,7 +816,7 @@ func TestAccWAFV2WebACL_ManagedRuleGroup_ManagedRuleGroupConfig_ATPRuleSet(t *te
 				Config: testAccWebACLConfig_managedRuleGroupStatementManagedRuleGroupConfig_atpRuleSet(webACLName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckWebACLExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/webacl/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/webacl/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "name", webACLName),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
@@ -726,8 +826,9 @@ func TestAccWAFV2WebACL_ManagedRuleGroup_ManagedRuleGroupConfig_ATPRuleSet(t *te
 						"override_action.0.count.#": "0",
 						"override_action.0.none.#":  "1",
 						"statement.#":               "1",
-						"statement.0.managed_rule_group_statement.#":                                                                                                                "1",
-						"statement.0.managed_rule_group_statement.0.managed_rule_group_configs.0.aws_managed_rules_atp_rule_set.#":                                                  "1",
+						"statement.0.managed_rule_group_statement.#":                                                               "1",
+						"statement.0.managed_rule_group_statement.0.managed_rule_group_configs.0.aws_managed_rules_atp_rule_set.#": "1",
+						// "statement.0.managed_rule_group_statement.0.managed_rule_group_configs.0.aws_managed_rules_atp_rule_set.0.enable_regex_in_path":                             "false",
 						"statement.0.managed_rule_group_statement.0.managed_rule_group_configs.0.aws_managed_rules_atp_rule_set.0.login_path":                                       "/api/1/signin",
 						"statement.0.managed_rule_group_statement.0.managed_rule_group_configs.0.aws_managed_rules_atp_rule_set.0.request_inspection.#":                             "1",
 						"statement.0.managed_rule_group_statement.0.managed_rule_group_configs.0.aws_managed_rules_atp_rule_set.0.request_inspection.0.password_field.#":            "1",
@@ -736,10 +837,10 @@ func TestAccWAFV2WebACL_ManagedRuleGroup_ManagedRuleGroupConfig_ATPRuleSet(t *te
 						"statement.0.managed_rule_group_statement.0.managed_rule_group_configs.0.aws_managed_rules_atp_rule_set.0.request_inspection.0.username_field.#":            "1",
 						"statement.0.managed_rule_group_statement.0.managed_rule_group_configs.0.aws_managed_rules_atp_rule_set.0.request_inspection.0.username_field.0.identifier": "/username",
 						"statement.0.managed_rule_group_statement.0.managed_rule_group_configs.0.aws_managed_rules_atp_rule_set.0.response_inspection.#":                            "0",
-						"statement.0.managed_rule_group_statement.0.name":                                                                                                           "AWSManagedRulesATPRuleSet",
-						"statement.0.managed_rule_group_statement.0.rule_action_override.#":                                                                                         "0",
-						"statement.0.managed_rule_group_statement.0.scope_down_statement.#":                                                                                         "0",
-						"statement.0.managed_rule_group_statement.0.vendor_name":                                                                                                    "AWS",
+						"statement.0.managed_rule_group_statement.0.name":                   "AWSManagedRulesATPRuleSet",
+						"statement.0.managed_rule_group_statement.0.rule_action_override.#": "0",
+						"statement.0.managed_rule_group_statement.0.scope_down_statement.#": "0",
+						"statement.0.managed_rule_group_statement.0.vendor_name":            "AWS",
 					}),
 				),
 			},
@@ -747,7 +848,7 @@ func TestAccWAFV2WebACL_ManagedRuleGroup_ManagedRuleGroupConfig_ATPRuleSet(t *te
 				Config: testAccWebACLConfig_managedRuleGroupStatementManagedRuleGroupConfig_atpRuleSetUpdate(webACLName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckWebACLExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/webacl/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/webacl/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "name", webACLName),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
@@ -759,6 +860,7 @@ func TestAccWAFV2WebACL_ManagedRuleGroup_ManagedRuleGroupConfig_ATPRuleSet(t *te
 						"statement.#":               "1",
 						"statement.0.managed_rule_group_statement.#":                                                                                                                "1",
 						"statement.0.managed_rule_group_statement.0.managed_rule_group_configs.0.aws_managed_rules_atp_rule_set.#":                                                  "1",
+						"statement.0.managed_rule_group_statement.0.managed_rule_group_configs.0.aws_managed_rules_atp_rule_set.0.enable_regex_in_path":                             "true",
 						"statement.0.managed_rule_group_statement.0.managed_rule_group_configs.0.aws_managed_rules_atp_rule_set.0.login_path":                                       "/api/2/signin",
 						"statement.0.managed_rule_group_statement.0.managed_rule_group_configs.0.aws_managed_rules_atp_rule_set.0.request_inspection.#":                             "1",
 						"statement.0.managed_rule_group_statement.0.managed_rule_group_configs.0.aws_managed_rules_atp_rule_set.0.request_inspection.0.password_field.#":            "1",
@@ -800,7 +902,7 @@ func TestAccWAFV2WebACL_ManagedRuleGroup_ManagedRuleGroupConfig_BotControl(t *te
 				Config: testAccWebACLConfig_managedRuleGroupStatementManagedRuleGroupConfig_botControl(webACLName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckWebACLExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/webacl/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/webacl/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "name", webACLName),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
@@ -837,7 +939,7 @@ func TestAccWAFV2WebACL_ManagedRuleGroup_specifyVersion(t *testing.T) {
 				Config: testAccWebACLConfig_managedRuleGroupStatementVersionVersion10(webACLName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckWebACLExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/webacl/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/webacl/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "name", webACLName),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
@@ -860,7 +962,7 @@ func TestAccWAFV2WebACL_ManagedRuleGroup_specifyVersion(t *testing.T) {
 				Config: testAccWebACLConfig_managedRuleGroupStatement(webACLName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckWebACLExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/webacl/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/webacl/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "name", webACLName),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
@@ -904,7 +1006,7 @@ func TestAccWAFV2WebACL_minimal(t *testing.T) {
 				Config: testAccWebACLConfig_minimal(webACLName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckWebACLExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/webacl/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/webacl/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "name", webACLName),
 					resource.TestCheckResourceAttr(resourceName, "description", ""),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "0"),
@@ -938,7 +1040,7 @@ func TestAccWAFV2WebACL_RateBased_basic(t *testing.T) {
 				Config: testAccWebACLConfig_rateBasedStatement(webACLName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckWebACLExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/webacl/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/webacl/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "name", webACLName),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
@@ -960,7 +1062,7 @@ func TestAccWAFV2WebACL_RateBased_basic(t *testing.T) {
 				Config: testAccWebACLConfig_rateBasedStatementUpdate(webACLName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckWebACLExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/webacl/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/webacl/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "name", webACLName),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
@@ -1008,7 +1110,7 @@ func TestAccWAFV2WebACL_ByteMatchStatement_basic(t *testing.T) {
 				Config: testAccWebACLConfig_byteMatchStatement(webACLName, wafv2.PositionalConstraintContainsWord, "value1"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckWebACLExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/webacl/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/webacl/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "name", webACLName),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
@@ -1028,7 +1130,7 @@ func TestAccWAFV2WebACL_ByteMatchStatement_basic(t *testing.T) {
 				Config: testAccWebACLConfig_byteMatchStatement(webACLName, wafv2.PositionalConstraintExactly, "value2"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckWebACLExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/webacl/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/webacl/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "name", webACLName),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
@@ -1054,6 +1156,54 @@ func TestAccWAFV2WebACL_ByteMatchStatement_basic(t *testing.T) {
 	})
 }
 
+func TestAccWAFV2WebACL_ByteMatchStatement_ja3fingerprint(t *testing.T) {
+	ctx := acctest.Context(t)
+	var v wafv2.WebACL
+	webACLName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_wafv2_web_acl.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheckScopeRegional(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, wafv2.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckWebACLDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccWebACLConfig_byteMatchStatementJA3Fingerprint(webACLName, wafv2.FallbackBehaviorMatch),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckWebACLExists(ctx, resourceName, &v),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/webacl/.+$`)),
+					resource.TestCheckResourceAttr(resourceName, "name", webACLName),
+					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
+						"statement.0.byte_match_statement.0.field_to_match.0.ja3_fingerprint.#":                   "1",
+						"statement.0.byte_match_statement.0.field_to_match.0.ja3_fingerprint.0.fallback_behavior": "MATCH",
+					}),
+				),
+			},
+			{
+				Config: testAccWebACLConfig_byteMatchStatementJA3Fingerprint(webACLName, wafv2.FallbackBehaviorNoMatch),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckWebACLExists(ctx, resourceName, &v),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/webacl/.+$`)),
+					resource.TestCheckResourceAttr(resourceName, "name", webACLName),
+					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
+						"statement.0.byte_match_statement.0.field_to_match.0.ja3_fingerprint.#":                   "1",
+						"statement.0.byte_match_statement.0.field_to_match.0.ja3_fingerprint.0.fallback_behavior": "NO_MATCH",
+					}),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+				ImportStateIdFunc: testAccWebACLImportStateIdFunc(resourceName),
+			},
+		},
+	})
+}
+
 func TestAccWAFV2WebACL_ByteMatchStatement_jsonBody(t *testing.T) {
 	ctx := acctest.Context(t)
 	var v wafv2.WebACL
@@ -1070,7 +1220,7 @@ func TestAccWAFV2WebACL_ByteMatchStatement_jsonBody(t *testing.T) {
 				Config: testAccWebACLConfig_byteMatchStatementJSONBody(webACLName, wafv2.JsonMatchScopeValue, wafv2.FallbackBehaviorMatch, wafv2.OversizeHandlingNoMatch, `included_paths = ["/dogs/0/name", "/dogs/1/name"]`),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckWebACLExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/webacl/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/webacl/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "name", webACLName),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
@@ -1090,7 +1240,7 @@ func TestAccWAFV2WebACL_ByteMatchStatement_jsonBody(t *testing.T) {
 				Config: testAccWebACLConfig_byteMatchStatementJSONBody(webACLName, wafv2.JsonMatchScopeAll, wafv2.FallbackBehaviorNoMatch, wafv2.OversizeHandlingContinue, "all {}"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckWebACLExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/webacl/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/webacl/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "name", webACLName),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
@@ -1130,7 +1280,7 @@ func TestAccWAFV2WebACL_ByteMatchStatement_body(t *testing.T) {
 				Config: testAccWebACLConfig_byteMatchStatementBody(webACLName, wafv2.OversizeHandlingNoMatch),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckWebACLExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/webacl/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/webacl/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "name", webACLName),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
@@ -1143,7 +1293,7 @@ func TestAccWAFV2WebACL_ByteMatchStatement_body(t *testing.T) {
 				Config: testAccWebACLConfig_byteMatchStatementBody(webACLName, wafv2.OversizeHandlingContinue),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckWebACLExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/webacl/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/webacl/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "name", webACLName),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
@@ -1180,7 +1330,7 @@ func TestAccWAFV2WebACL_GeoMatch_basic(t *testing.T) {
 				Config: testAccWebACLConfig_geoMatchStatement(webACLName, countryCode),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckWebACLExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/webacl/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/webacl/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "name", webACLName),
 					resource.TestCheckResourceAttr(resourceName, "default_action.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "default_action.0.allow.#", "1"),
@@ -1214,7 +1364,7 @@ func TestAccWAFV2WebACL_GeoMatch_basic(t *testing.T) {
 				Config: testAccWebACLConfig_geoMatchStatement(webACLName, countryCodes),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckWebACLExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/webacl/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/webacl/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "name", webACLName),
 					resource.TestCheckResourceAttr(resourceName, "default_action.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "default_action.0.allow.#", "1"),
@@ -1271,7 +1421,7 @@ func TestAccWAFV2WebACL_GeoMatch_forwardedIP(t *testing.T) {
 				Config: testAccWebACLConfig_geoMatchStatementForwardedIP(webACLName, "MATCH", "X-Forwarded-For"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckWebACLExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/webacl/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/webacl/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "name", webACLName),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
@@ -1293,7 +1443,7 @@ func TestAccWAFV2WebACL_GeoMatch_forwardedIP(t *testing.T) {
 				Config: testAccWebACLConfig_geoMatchStatementForwardedIP(webACLName, "NO_MATCH", "Updated"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckWebACLExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/webacl/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/webacl/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "name", webACLName),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
@@ -1337,7 +1487,7 @@ func TestAccWAFV2WebACL_LabelMatchStatement(t *testing.T) {
 				Config: testAccWebACLConfig_labelMatchStatement(webACLName, "LABEL", "Hashicorp:Test:Label1"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckWebACLExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/webacl/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/webacl/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "name", webACLName),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
@@ -1352,7 +1502,7 @@ func TestAccWAFV2WebACL_LabelMatchStatement(t *testing.T) {
 				Config: testAccWebACLConfig_labelMatchStatement(webACLName, "NAMESPACE", "awswaf:managed:aws:bot-control:"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckWebACLExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/webacl/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/webacl/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "name", webACLName),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
@@ -1389,7 +1539,7 @@ func TestAccWAFV2WebACL_RuleLabels(t *testing.T) {
 				Config: testAccWebACLConfig_ruleLabels(webACLName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckWebACLExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/webacl/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/webacl/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "name", webACLName),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
@@ -1403,7 +1553,7 @@ func TestAccWAFV2WebACL_RuleLabels(t *testing.T) {
 				Config: testAccWebACLConfig_noRuleLabels(webACLName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckWebACLExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/webacl/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/webacl/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "name", webACLName),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
@@ -1437,7 +1587,7 @@ func TestAccWAFV2WebACL_IPSetReference_basic(t *testing.T) {
 				Config: testAccWebACLConfig_ipsetReference(webACLName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckWebACLExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/webacl/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/webacl/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "name", webACLName),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
@@ -1450,7 +1600,7 @@ func TestAccWAFV2WebACL_IPSetReference_basic(t *testing.T) {
 						"visibility_config.0.sampled_requests_enabled":   "false",
 					}),
 					resource.TestMatchTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]*regexp.Regexp{
-						"statement.0.ip_set_reference_statement.0.arn": regexp.MustCompile(`regional/ipset/.+$`),
+						"statement.0.ip_set_reference_statement.0.arn": regexache.MustCompile(`regional/ipset/.+$`),
 					}),
 					resource.TestCheckResourceAttr(resourceName, "visibility_config.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "visibility_config.0.cloudwatch_metrics_enabled", "false"),
@@ -1484,7 +1634,7 @@ func TestAccWAFV2WebACL_IPSetReference_forwardedIP(t *testing.T) {
 				Config: testAccWebACLConfig_ipsetReferenceForwardedIP(webACLName, "MATCH", "X-Forwarded-For", "FIRST"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckWebACLExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/webacl/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/webacl/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "name", webACLName),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
@@ -1492,7 +1642,7 @@ func TestAccWAFV2WebACL_IPSetReference_forwardedIP(t *testing.T) {
 						"statement.0.ip_set_reference_statement.#": "1",
 					}),
 					resource.TestMatchTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]*regexp.Regexp{
-						"statement.0.ip_set_reference_statement.0.arn": regexp.MustCompile(`regional/ipset/.+$`),
+						"statement.0.ip_set_reference_statement.0.arn": regexache.MustCompile(`regional/ipset/.+$`),
 					}),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
 						"statement.0.ip_set_reference_statement.0.ip_set_forwarded_ip_config.#":                   "1",
@@ -1506,7 +1656,7 @@ func TestAccWAFV2WebACL_IPSetReference_forwardedIP(t *testing.T) {
 				Config: testAccWebACLConfig_ipsetReferenceForwardedIP(webACLName, "NO_MATCH", "X-Forwarded-For", "LAST"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckWebACLExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/webacl/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/webacl/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "name", webACLName),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
@@ -1514,7 +1664,7 @@ func TestAccWAFV2WebACL_IPSetReference_forwardedIP(t *testing.T) {
 						"statement.0.ip_set_reference_statement.#": "1",
 					}),
 					resource.TestMatchTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]*regexp.Regexp{
-						"statement.0.ip_set_reference_statement.0.arn": regexp.MustCompile(`regional/ipset/.+$`),
+						"statement.0.ip_set_reference_statement.0.arn": regexache.MustCompile(`regional/ipset/.+$`),
 					}),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
 						"statement.0.ip_set_reference_statement.0.ip_set_forwarded_ip_config.#":                   "1",
@@ -1528,7 +1678,7 @@ func TestAccWAFV2WebACL_IPSetReference_forwardedIP(t *testing.T) {
 				Config: testAccWebACLConfig_ipsetReferenceForwardedIP(webACLName, "MATCH", "Updated", "ANY"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckWebACLExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/webacl/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/webacl/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "name", webACLName),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
@@ -1536,7 +1686,7 @@ func TestAccWAFV2WebACL_IPSetReference_forwardedIP(t *testing.T) {
 						"statement.0.ip_set_reference_statement.#": "1",
 					}),
 					resource.TestMatchTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]*regexp.Regexp{
-						"statement.0.ip_set_reference_statement.0.arn": regexp.MustCompile(`regional/ipset/.+$`),
+						"statement.0.ip_set_reference_statement.0.arn": regexache.MustCompile(`regional/ipset/.+$`),
 					}),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
 						"statement.0.ip_set_reference_statement.0.ip_set_forwarded_ip_config.#":                   "1",
@@ -1550,7 +1700,7 @@ func TestAccWAFV2WebACL_IPSetReference_forwardedIP(t *testing.T) {
 				Config: testAccWebACLConfig_ipsetReference(webACLName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckWebACLExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/webacl/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/webacl/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "name", webACLName),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
@@ -1559,7 +1709,270 @@ func TestAccWAFV2WebACL_IPSetReference_forwardedIP(t *testing.T) {
 						"statement.0.ip_set_reference_statement.0.ip_set_forwarded_ip_config.#": "0",
 					}),
 					resource.TestMatchTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]*regexp.Regexp{
-						"statement.0.ip_set_reference_statement.0.arn": regexp.MustCompile(`regional/ipset/.+$`),
+						"statement.0.ip_set_reference_statement.0.arn": regexache.MustCompile(`regional/ipset/.+$`),
+					}),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+				ImportStateIdFunc: testAccWebACLImportStateIdFunc(resourceName),
+			},
+		},
+	})
+}
+
+func TestAccWAFV2WebACL_RateBased_customKeys(t *testing.T) {
+	ctx := acctest.Context(t)
+	var v wafv2.WebACL
+	webACLName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_wafv2_web_acl.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(ctx, t); testAccPreCheckScopeRegional(ctx, t) },
+		ErrorCheck:               acctest.ErrorCheck(t, wafv2.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckWebACLDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccWebACLConfig_rateBasedStatement_customKeysBasic(webACLName, "cookie", "testcookie"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckWebACLExists(ctx, resourceName, &v),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/webacl/.+$`)),
+					resource.TestCheckResourceAttr(resourceName, "name", webACLName),
+					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
+						"statement.#":                                                                    "1",
+						"statement.0.rate_based_statement.#":                                             "1",
+						"statement.0.rate_based_statement.0.custom_key.#":                                "1",
+						"statement.0.rate_based_statement.0.aggregate_key_type":                          "CUSTOM_KEYS",
+						"statement.0.rate_based_statement.0.forwarded_ip_config.#":                       "0",
+						"statement.0.rate_based_statement.0.limit":                                       "50000",
+						"statement.0.rate_based_statement.0.scope_down_statement.#":                      "0",
+						"statement.0.rate_based_statement.0.custom_key.0.cookie.#":                       "1",
+						"statement.0.rate_based_statement.0.custom_key.0.forwarded_ip.#":                 "0",
+						"statement.0.rate_based_statement.0.custom_key.0.http_method.#":                  "0",
+						"statement.0.rate_based_statement.0.custom_key.0.header.#":                       "0",
+						"statement.0.rate_based_statement.0.custom_key.0.ip.#":                           "0",
+						"statement.0.rate_based_statement.0.custom_key.0.label_namespace.#":              "0",
+						"statement.0.rate_based_statement.0.custom_key.0.query_argument.#":               "0",
+						"statement.0.rate_based_statement.0.custom_key.0.query_string.#":                 "0",
+						"statement.0.rate_based_statement.0.custom_key.0.uri_path.#":                     "0",
+						"statement.0.rate_based_statement.0.custom_key.0.cookie.0.text_transformation.#": "1",
+					}),
+				),
+			},
+			{
+				Config: testAccWebACLConfig_rateBasedStatement_customKeysForwardedIP(webACLName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckWebACLExists(ctx, resourceName, &v),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/webacl/.+$`)),
+					resource.TestCheckResourceAttr(resourceName, "name", webACLName),
+					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
+						"statement.#":                                                       "1",
+						"statement.0.rate_based_statement.#":                                "1",
+						"statement.0.rate_based_statement.0.custom_key.#":                   "2",
+						"statement.0.rate_based_statement.0.aggregate_key_type":             "CUSTOM_KEYS",
+						"statement.0.rate_based_statement.0.forwarded_ip_config.#":          "1",
+						"statement.0.rate_based_statement.0.limit":                          "50000",
+						"statement.0.rate_based_statement.0.scope_down_statement.#":         "0",
+						"statement.0.rate_based_statement.0.custom_key.0.cookie.#":          "1",
+						"statement.0.rate_based_statement.0.custom_key.0.forwarded_ip.#":    "0",
+						"statement.0.rate_based_statement.0.custom_key.0.http_method.#":     "0",
+						"statement.0.rate_based_statement.0.custom_key.0.header.#":          "0",
+						"statement.0.rate_based_statement.0.custom_key.0.ip.#":              "0",
+						"statement.0.rate_based_statement.0.custom_key.0.label_namespace.#": "0",
+						"statement.0.rate_based_statement.0.custom_key.0.query_argument.#":  "0",
+						"statement.0.rate_based_statement.0.custom_key.0.query_string.#":    "0",
+						"statement.0.rate_based_statement.0.custom_key.0.uri_path.#":        "0",
+						"statement.0.rate_based_statement.0.custom_key.1.forwarded_ip.#":    "1",
+					}),
+				),
+			},
+			{
+				Config: testAccWebACLConfig_rateBasedStatement_customKeysHTTPMethod(webACLName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckWebACLExists(ctx, resourceName, &v),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/webacl/.+$`)),
+					resource.TestCheckResourceAttr(resourceName, "name", webACLName),
+					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
+						"statement.#":                                                       "1",
+						"statement.0.rate_based_statement.#":                                "1",
+						"statement.0.rate_based_statement.0.custom_key.#":                   "1",
+						"statement.0.rate_based_statement.0.aggregate_key_type":             "CUSTOM_KEYS",
+						"statement.0.rate_based_statement.0.forwarded_ip_config.#":          "0",
+						"statement.0.rate_based_statement.0.limit":                          "50000",
+						"statement.0.rate_based_statement.0.scope_down_statement.#":         "0",
+						"statement.0.rate_based_statement.0.custom_key.0.cookie.#":          "0",
+						"statement.0.rate_based_statement.0.custom_key.0.forwarded_ip.#":    "0",
+						"statement.0.rate_based_statement.0.custom_key.0.http_method.#":     "1",
+						"statement.0.rate_based_statement.0.custom_key.0.header.#":          "0",
+						"statement.0.rate_based_statement.0.custom_key.0.ip.#":              "0",
+						"statement.0.rate_based_statement.0.custom_key.0.label_namespace.#": "0",
+						"statement.0.rate_based_statement.0.custom_key.0.query_argument.#":  "0",
+						"statement.0.rate_based_statement.0.custom_key.0.query_string.#":    "0",
+						"statement.0.rate_based_statement.0.custom_key.0.uri_path.#":        "0",
+					}),
+				),
+			},
+			{
+				Config: testAccWebACLConfig_rateBasedStatement_customKeysBasic(webACLName, "header", "x-forwrded-for"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckWebACLExists(ctx, resourceName, &v),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/webacl/.+$`)),
+					resource.TestCheckResourceAttr(resourceName, "name", webACLName),
+					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
+						"statement.#":                                                                    "1",
+						"statement.0.rate_based_statement.#":                                             "1",
+						"statement.0.rate_based_statement.0.custom_key.#":                                "1",
+						"statement.0.rate_based_statement.0.aggregate_key_type":                          "CUSTOM_KEYS",
+						"statement.0.rate_based_statement.0.forwarded_ip_config.#":                       "0",
+						"statement.0.rate_based_statement.0.limit":                                       "50000",
+						"statement.0.rate_based_statement.0.scope_down_statement.#":                      "0",
+						"statement.0.rate_based_statement.0.custom_key.0.cookie.#":                       "0",
+						"statement.0.rate_based_statement.0.custom_key.0.forwarded_ip.#":                 "0",
+						"statement.0.rate_based_statement.0.custom_key.0.http_method.#":                  "0",
+						"statement.0.rate_based_statement.0.custom_key.0.header.#":                       "1",
+						"statement.0.rate_based_statement.0.custom_key.0.ip.#":                           "0",
+						"statement.0.rate_based_statement.0.custom_key.0.label_namespace.#":              "0",
+						"statement.0.rate_based_statement.0.custom_key.0.query_argument.#":               "0",
+						"statement.0.rate_based_statement.0.custom_key.0.query_string.#":                 "0",
+						"statement.0.rate_based_statement.0.custom_key.0.uri_path.#":                     "0",
+						"statement.0.rate_based_statement.0.custom_key.0.header.0.text_transformation.#": "1",
+					}),
+				),
+			},
+			{
+				Config: testAccWebACLConfig_rateBasedStatement_customKeysIP(webACLName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckWebACLExists(ctx, resourceName, &v),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/webacl/.+$`)),
+					resource.TestCheckResourceAttr(resourceName, "name", webACLName),
+					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
+						"statement.#":                                                       "1",
+						"statement.0.rate_based_statement.#":                                "1",
+						"statement.0.rate_based_statement.0.custom_key.#":                   "2",
+						"statement.0.rate_based_statement.0.aggregate_key_type":             "CUSTOM_KEYS",
+						"statement.0.rate_based_statement.0.forwarded_ip_config.#":          "0",
+						"statement.0.rate_based_statement.0.limit":                          "50000",
+						"statement.0.rate_based_statement.0.scope_down_statement.#":         "0",
+						"statement.0.rate_based_statement.0.custom_key.0.cookie.#":          "1",
+						"statement.0.rate_based_statement.0.custom_key.0.forwarded_ip.#":    "0",
+						"statement.0.rate_based_statement.0.custom_key.0.http_method.#":     "0",
+						"statement.0.rate_based_statement.0.custom_key.0.header.#":          "0",
+						"statement.0.rate_based_statement.0.custom_key.0.ip.#":              "0",
+						"statement.0.rate_based_statement.0.custom_key.0.label_namespace.#": "0",
+						"statement.0.rate_based_statement.0.custom_key.0.query_argument.#":  "0",
+						"statement.0.rate_based_statement.0.custom_key.0.query_string.#":    "0",
+						"statement.0.rate_based_statement.0.custom_key.0.uri_path.#":        "0",
+						"statement.0.rate_based_statement.0.custom_key.1.ip.#":              "1",
+					}),
+				),
+			},
+			{
+				Config: testAccWebACLConfig_rateBasedStatement_customKeysBasic(webACLName, "query_argument", "key"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckWebACLExists(ctx, resourceName, &v),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/webacl/.+$`)),
+					resource.TestCheckResourceAttr(resourceName, "name", webACLName),
+					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
+						"statement.#":                                                                            "1",
+						"statement.0.rate_based_statement.#":                                                     "1",
+						"statement.0.rate_based_statement.0.custom_key.#":                                        "1",
+						"statement.0.rate_based_statement.0.aggregate_key_type":                                  "CUSTOM_KEYS",
+						"statement.0.rate_based_statement.0.forwarded_ip_config.#":                               "0",
+						"statement.0.rate_based_statement.0.limit":                                               "50000",
+						"statement.0.rate_based_statement.0.scope_down_statement.#":                              "0",
+						"statement.0.rate_based_statement.0.custom_key.0.cookie.#":                               "0",
+						"statement.0.rate_based_statement.0.custom_key.0.forwarded_ip.#":                         "0",
+						"statement.0.rate_based_statement.0.custom_key.0.http_method.#":                          "0",
+						"statement.0.rate_based_statement.0.custom_key.0.header.#":                               "0",
+						"statement.0.rate_based_statement.0.custom_key.0.ip.#":                                   "0",
+						"statement.0.rate_based_statement.0.custom_key.0.label_namespace.#":                      "0",
+						"statement.0.rate_based_statement.0.custom_key.0.query_argument.#":                       "1",
+						"statement.0.rate_based_statement.0.custom_key.0.query_string.#":                         "0",
+						"statement.0.rate_based_statement.0.custom_key.0.uri_path.#":                             "0",
+						"statement.0.rate_based_statement.0.custom_key.0.query_argument.0.text_transformation.#": "1",
+					}),
+				),
+			},
+			{
+				Config: testAccWebACLConfig_rateBasedStatement_customKeysMinimal(webACLName, "query_string"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckWebACLExists(ctx, resourceName, &v),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/webacl/.+$`)),
+					resource.TestCheckResourceAttr(resourceName, "name", webACLName),
+					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
+						"statement.#":                                                                          "1",
+						"statement.0.rate_based_statement.#":                                                   "1",
+						"statement.0.rate_based_statement.0.custom_key.#":                                      "1",
+						"statement.0.rate_based_statement.0.aggregate_key_type":                                "CUSTOM_KEYS",
+						"statement.0.rate_based_statement.0.forwarded_ip_config.#":                             "0",
+						"statement.0.rate_based_statement.0.limit":                                             "50000",
+						"statement.0.rate_based_statement.0.scope_down_statement.#":                            "0",
+						"statement.0.rate_based_statement.0.custom_key.0.cookie.#":                             "0",
+						"statement.0.rate_based_statement.0.custom_key.0.forwarded_ip.#":                       "0",
+						"statement.0.rate_based_statement.0.custom_key.0.http_method.#":                        "0",
+						"statement.0.rate_based_statement.0.custom_key.0.header.#":                             "0",
+						"statement.0.rate_based_statement.0.custom_key.0.ip.#":                                 "0",
+						"statement.0.rate_based_statement.0.custom_key.0.label_namespace.#":                    "0",
+						"statement.0.rate_based_statement.0.custom_key.0.query_argument.#":                     "0",
+						"statement.0.rate_based_statement.0.custom_key.0.query_string.#":                       "1",
+						"statement.0.rate_based_statement.0.custom_key.0.uri_path.#":                           "0",
+						"statement.0.rate_based_statement.0.custom_key.0.query_string.0.text_transformation.#": "1",
+					}),
+				),
+			},
+			{
+				Config: testAccWebACLConfig_rateBasedStatement_customKeysMinimal(webACLName, "uri_path"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckWebACLExists(ctx, resourceName, &v),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/webacl/.+$`)),
+					resource.TestCheckResourceAttr(resourceName, "name", webACLName),
+					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
+						"statement.#":                                                                      "1",
+						"statement.0.rate_based_statement.#":                                               "1",
+						"statement.0.rate_based_statement.0.custom_key.#":                                  "1",
+						"statement.0.rate_based_statement.0.aggregate_key_type":                            "CUSTOM_KEYS",
+						"statement.0.rate_based_statement.0.forwarded_ip_config.#":                         "0",
+						"statement.0.rate_based_statement.0.limit":                                         "50000",
+						"statement.0.rate_based_statement.0.scope_down_statement.#":                        "0",
+						"statement.0.rate_based_statement.0.custom_key.0.cookie.#":                         "0",
+						"statement.0.rate_based_statement.0.custom_key.0.forwarded_ip.#":                   "0",
+						"statement.0.rate_based_statement.0.custom_key.0.http_method.#":                    "0",
+						"statement.0.rate_based_statement.0.custom_key.0.header.#":                         "0",
+						"statement.0.rate_based_statement.0.custom_key.0.ip.#":                             "0",
+						"statement.0.rate_based_statement.0.custom_key.0.label_namespace.#":                "0",
+						"statement.0.rate_based_statement.0.custom_key.0.query_argument.#":                 "0",
+						"statement.0.rate_based_statement.0.custom_key.0.query_string.#":                   "0",
+						"statement.0.rate_based_statement.0.custom_key.0.uri_path.#":                       "1",
+						"statement.0.rate_based_statement.0.custom_key.0.uri_path.0.text_transformation.#": "1",
+					}),
+				),
+			},
+			{
+				Config: testAccWebACLConfig_rateBasedStatement_customKeysMaxKeys(webACLName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckWebACLExists(ctx, resourceName, &v),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/webacl/.+$`)),
+					resource.TestCheckResourceAttr(resourceName, "name", webACLName),
+					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
+						"statement.#":                                               "1",
+						"statement.0.rate_based_statement.#":                        "1",
+						"statement.0.rate_based_statement.0.custom_key.#":           "5",
+						"statement.0.rate_based_statement.0.aggregate_key_type":     "CUSTOM_KEYS",
+						"statement.0.rate_based_statement.0.forwarded_ip_config.#":  "0",
+						"statement.0.rate_based_statement.0.limit":                  "50000",
+						"statement.0.rate_based_statement.0.scope_down_statement.#": "0",
 					}),
 				),
 			},
@@ -1589,7 +2002,7 @@ func TestAccWAFV2WebACL_RateBased_forwardedIP(t *testing.T) {
 				Config: testAccWebACLConfig_rateBasedStatementForwardedIP(webACLName, "MATCH", "X-Forwarded-For"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckWebACLExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/webacl/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/webacl/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "name", webACLName),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
@@ -1613,7 +2026,7 @@ func TestAccWAFV2WebACL_RateBased_forwardedIP(t *testing.T) {
 				Config: testAccWebACLConfig_rateBasedStatementForwardedIP(webACLName, "NO_MATCH", "Updated"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckWebACLExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/webacl/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/webacl/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "name", webACLName),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
@@ -1659,7 +2072,7 @@ func TestAccWAFV2WebACL_RuleGroupReference_basic(t *testing.T) {
 				Config: testAccWebACLConfig_ruleGroupReferenceStatement(webACLName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckWebACLExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/webacl/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/webacl/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "name", webACLName),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
@@ -1672,7 +2085,7 @@ func TestAccWAFV2WebACL_RuleGroupReference_basic(t *testing.T) {
 						"statement.0.rule_group_reference_statement.0.rule_action_override.#": "0",
 					}),
 					resource.TestMatchTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]*regexp.Regexp{
-						"statement.0.rule_group_reference_statement.0.arn": regexp.MustCompile(`regional/rulegroup/.+$`),
+						"statement.0.rule_group_reference_statement.0.arn": regexache.MustCompile(`regional/rulegroup/.+$`),
 					}),
 				),
 			},
@@ -1680,7 +2093,7 @@ func TestAccWAFV2WebACL_RuleGroupReference_basic(t *testing.T) {
 				Config: testAccWebACLConfig_ruleGroupReferenceStatementUpdate(webACLName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckWebACLExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/webacl/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/webacl/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "name", webACLName),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
@@ -1695,7 +2108,7 @@ func TestAccWAFV2WebACL_RuleGroupReference_basic(t *testing.T) {
 						"statement.0.rule_group_reference_statement.0.rule_action_override.1.name": "rule-to-exclude-a",
 					}),
 					resource.TestMatchTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]*regexp.Regexp{
-						"statement.0.rule_group_reference_statement.0.arn": regexp.MustCompile(`regional/rulegroup/.+$`),
+						"statement.0.rule_group_reference_statement.0.arn": regexache.MustCompile(`regional/rulegroup/.+$`),
 					}),
 				),
 			},
@@ -1725,11 +2138,10 @@ func TestAccWAFV2WebACL_RuleGroupReference_shieldMitigation(t *testing.T) {
 		CheckDestroy:             testAccCheckWebACLDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccWebACLConfig_ruleGroupForShieldMitigation(webACLName),
+				Config: testAccWebACLConfig_ruleGroupForShieldMitigation(webACLName, "desc1"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckWebACLExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/webacl/.+$`)),
-					resource.TestCheckResourceAttr(resourceName, "name", webACLName),
+					resource.TestCheckResourceAttr(resourceName, "description", "desc1"),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "0"),
 				),
 			},
@@ -1747,7 +2159,7 @@ func TestAccWAFV2WebACL_RuleGroupReference_shieldMitigation(t *testing.T) {
 					aclID := ""
 					lockToken := ""
 
-					err := webACLsPages(ctx, conn, input, func(page *wafv2.ListWebACLsOutput, lastPage bool) bool {
+					err := tfwafv2.ListWebACLsPages(ctx, conn, input, func(page *wafv2.ListWebACLsOutput, lastPage bool) bool {
 						if page == nil {
 							return !lastPage
 						}
@@ -1778,7 +2190,7 @@ func TestAccWAFV2WebACL_RuleGroupReference_shieldMitigation(t *testing.T) {
 
 					rgARN := ""
 
-					err = ruleGroupPages(ctx, conn, in, func(page *wafv2.ListRuleGroupsOutput, lastPage bool) bool {
+					err = tfwafv2.ListRuleGroupsPages(ctx, conn, in, func(page *wafv2.ListRuleGroupsOutput, lastPage bool) bool {
 						if page == nil {
 							return !lastPage
 						}
@@ -1848,11 +2260,18 @@ func TestAccWAFV2WebACL_RuleGroupReference_shieldMitigation(t *testing.T) {
 						t.Fatalf("out-of-band added rule (%s) not found, cannot test handling of rule", webACLName)
 					}
 				},
-				Config: testAccWebACLConfig_ruleGroupForShieldMitigation(webACLName),
+				Config: testAccWebACLConfig_ruleGroupForShieldMitigation(webACLName, "desc1"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckWebACLExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/webacl/.+$`)),
-					resource.TestCheckResourceAttr(resourceName, "name", webACLName),
+					resource.TestCheckResourceAttr(resourceName, "description", "desc1"),
+					resource.TestCheckResourceAttr(resourceName, "rule.#", "0"),
+				),
+			},
+			{
+				Config: testAccWebACLConfig_ruleGroupForShieldMitigation(webACLName, "desc2"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckWebACLExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "description", "desc2"),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "0"),
 				),
 			},
@@ -1860,40 +2279,6 @@ func TestAccWAFV2WebACL_RuleGroupReference_shieldMitigation(t *testing.T) {
 	})
 }
 
-func webACLsPages(ctx context.Context, conn *wafv2.WAFV2, input *wafv2.ListWebACLsInput, fn func(*wafv2.ListWebACLsOutput, bool) bool) error {
-	for {
-		output, err := conn.ListWebACLsWithContext(ctx, input)
-		if err != nil {
-			return err
-		}
-
-		lastPage := aws.StringValue(output.NextMarker) == ""
-		if !fn(output, lastPage) || lastPage {
-			break
-		}
-
-		input.NextMarker = output.NextMarker
-	}
-	return nil
-}
-
-func ruleGroupPages(ctx context.Context, conn *wafv2.WAFV2, input *wafv2.ListRuleGroupsInput, fn func(*wafv2.ListRuleGroupsOutput, bool) bool) error {
-	for {
-		output, err := conn.ListRuleGroupsWithContext(ctx, input)
-		if err != nil {
-			return err
-		}
-
-		lastPage := aws.StringValue(output.NextMarker) == ""
-		if !fn(output, lastPage) || lastPage {
-			break
-		}
-
-		input.NextMarker = output.NextMarker
-	}
-	return nil
-}
-
 // Ensure magically-added (i.e., AWS-added) rule for Shield with CF distribution DDoS auto
 // mitigation does not cause diff and provider doesn't attempt to remove.
 // See https://github.com/hashicorp/terraform-provider-aws/issues/22869
@@ -1910,16 +2295,27 @@ func TestAccWAFV2WebACL_RuleGroupReference_manageShieldMitigationRule(t *testing
 		CheckDestroy:             testAccCheckWebACLDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccWebACLConfig_ruleGroupShieldMitigation(webACLName),
+				Config: testAccWebACLConfig_ruleGroupShieldMitigation(webACLName, "desc1"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckWebACLExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/webacl/.+$`)),
-					resource.TestCheckResourceAttr(resourceName, "name", webACLName),
+					resource.TestCheckResourceAttr(resourceName, "description", "desc1"),
+					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
+				),
+			},
+			{
+				Config:   testAccWebACLConfig_ruleGroupShieldMitigation(webACLName, "desc1"),
+				PlanOnly: true,
+			},
+			{
+				Config: testAccWebACLConfig_ruleGroupShieldMitigation(webACLName, "desc2"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckWebACLExists(ctx, resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "description", "desc2"),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 				),
 			},
 			{
-				Config:   testAccWebACLConfig_ruleGroupShieldMitigation(webACLName),
+				Config:   testAccWebACLConfig_ruleGroupShieldMitigation(webACLName, "desc2"),
 				PlanOnly: true,
 			},
 		},
@@ -1942,7 +2338,7 @@ func TestAccWAFV2WebACL_Custom_requestHandling(t *testing.T) {
 				Config: testAccWebACLConfig_customRequestHandlingAllow(webACLName, "x-hdr1", "x-hdr2"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckWebACLExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/webacl/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/webacl/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "name", webACLName),
 					resource.TestCheckResourceAttr(resourceName, "default_action.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "default_action.0.allow.#", "1"),
@@ -1981,7 +2377,7 @@ func TestAccWAFV2WebACL_Custom_requestHandling(t *testing.T) {
 				Config: testAccWebACLConfig_customRequestHandlingCount(webACLName, "x-hdr1", "x-hdr2"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckWebACLExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/webacl/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/webacl/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "name", webACLName),
 					resource.TestCheckResourceAttr(resourceName, "default_action.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "default_action.0.allow.#", "1"),
@@ -2014,7 +2410,7 @@ func TestAccWAFV2WebACL_Custom_requestHandling(t *testing.T) {
 				Config: testAccWebACLConfig_customRequestHandlingCaptcha(webACLName, "x-hdr1", "x-hdr2"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckWebACLExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/webacl/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/webacl/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "name", webACLName),
 					resource.TestCheckResourceAttr(resourceName, "default_action.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "default_action.0.allow.#", "1"),
@@ -2051,7 +2447,7 @@ func TestAccWAFV2WebACL_Custom_requestHandling(t *testing.T) {
 				Config: testAccWebACLConfig_customRequestHandlingChallenge(webACLName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckWebACLExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/webacl/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/webacl/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "name", webACLName),
 					resource.TestCheckResourceAttr(resourceName, "default_action.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "default_action.0.allow.#", "1"),
@@ -2094,7 +2490,7 @@ func TestAccWAFV2WebACL_Custom_response(t *testing.T) {
 				Config: testAccWebACLConfig_customResponse(webACLName, 401, 403, "x-hdr1"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckWebACLExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/webacl/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/webacl/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "name", webACLName),
 					resource.TestCheckResourceAttr(resourceName, "default_action.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "default_action.0.allow.#", "0"),
@@ -2126,7 +2522,7 @@ func TestAccWAFV2WebACL_Custom_response(t *testing.T) {
 				Config: testAccWebACLConfig_customResponse(webACLName, 404, 429, "x-hdr2"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckWebACLExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/webacl/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/webacl/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "name", webACLName),
 					resource.TestCheckResourceAttr(resourceName, "default_action.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "default_action.0.allow.#", "0"),
@@ -2158,7 +2554,7 @@ func TestAccWAFV2WebACL_Custom_response(t *testing.T) {
 				Config: testAccWebACLConfig_customResponseBody(webACLName, 404, 429),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckWebACLExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/webacl/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/webacl/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "name", webACLName),
 					resource.TestCheckResourceAttr(resourceName, "custom_response_body.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "custom_response_body.0.key", "test_body"),
@@ -2211,12 +2607,11 @@ func TestAccWAFV2WebACL_tags(t *testing.T) {
 		CheckDestroy:             testAccCheckWebACLDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccWebACLConfig_oneTag(webACLName, "Tag1", "Value1"),
+				Config: testAccWebACLConfig_tags1(webACLName, "key1", "value1"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckWebACLExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/webacl/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
-					resource.TestCheckResourceAttr(resourceName, "tags.Tag1", "Value1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
 				),
 			},
 			{
@@ -2226,22 +2621,20 @@ func TestAccWAFV2WebACL_tags(t *testing.T) {
 				ImportStateIdFunc: testAccWebACLImportStateIdFunc(resourceName),
 			},
 			{
-				Config: testAccWebACLConfig_twoTags(webACLName, "Tag1", "Value1Updated", "Tag2", "Value2"),
+				Config: testAccWebACLConfig_tags2(webACLName, "key1", "value1updated", "key2", "value2"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckWebACLExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/webacl/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
-					resource.TestCheckResourceAttr(resourceName, "tags.Tag1", "Value1Updated"),
-					resource.TestCheckResourceAttr(resourceName, "tags.Tag2", "Value2"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1updated"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
 				),
 			},
 			{
-				Config: testAccWebACLConfig_oneTag(webACLName, "Tag2", "Value2"),
+				Config: testAccWebACLConfig_tags1(webACLName, "key2", "value2"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckWebACLExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/webacl/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
-					resource.TestCheckResourceAttr(resourceName, "tags.Tag2", "Value2"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
 				),
 			},
 		},
@@ -2265,7 +2658,7 @@ func TestAccWAFV2WebACL_RateBased_maxNested(t *testing.T) {
 				Config: testAccWebACLConfig_multipleNestedRateBasedStatements(webACLName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckWebACLExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/webacl/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/webacl/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "name", webACLName),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
@@ -2310,7 +2703,7 @@ func TestAccWAFV2WebACL_Operators_maxNested(t *testing.T) {
 				Config: testAccWebACLConfig_multipleNestedOperatorStatements(webACLName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckWebACLExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/webacl/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/webacl/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "name", webACLName),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
 					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
@@ -2357,7 +2750,7 @@ func TestAccWAFV2WebACL_tokenDomains(t *testing.T) {
 				Config: testAccWebACLConfig_tokenDomains(webACLName, domain1, domain2),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckWebACLExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/webacl/.+$`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`regional/webacl/.+$`)),
 					resource.TestCheckResourceAttr(resourceName, "name", webACLName),
 					resource.TestCheckResourceAttr(resourceName, "description", webACLName),
 					resource.TestCheckResourceAttr(resourceName, "rule.#", "0"),
@@ -2385,16 +2778,116 @@ func TestAccWAFV2WebACL_tokenDomains(t *testing.T) {
 	})
 }
 
-func testAccCheckWebACLDestroy(ctx context.Context) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		for _, rs := range s.RootModule().Resources {
-			if rs.Type != "aws_wafv2_web_acl" {
-				continue
-			}
-
-			conn := acctest.Provider.Meta().(*conns.AWSClient).WAFV2Conn(ctx)
-
-			_, err := tfwafv2.FindWebACLByThreePartKey(ctx, conn, rs.Primary.ID, rs.Primary.Attributes["name"], rs.Primary.Attributes["scope"])
+func TestAccWAFV2WebACL_associationConfig(t *testing.T) {
+	ctx := acctest.Context(t)
+	var v wafv2.WebACL
+	webACLName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_wafv2_web_acl.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckWAFV2CloudFrontScope(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, wafv2.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckWebACLDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccWebACLConfig_associationConfig(webACLName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckWebACLExists(ctx, resourceName, &v),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`global/webacl/.+$`)),
+					resource.TestCheckResourceAttr(resourceName, "association_config.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "association_config.0.request_body.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "association_config.0.request_body.0.cloudfront.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "association_config.0.request_body.0.cloudfront.0.default_size_inspection_limit", "KB_64"),
+					resource.TestCheckResourceAttr(resourceName, "default_action.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "default_action.0.allow.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "default_action.0.block.#", "0"),
+					resource.TestCheckResourceAttr(resourceName, "description", webACLName),
+					resource.TestCheckResourceAttr(resourceName, "name", webACLName),
+					resource.TestCheckResourceAttr(resourceName, "scope", wafv2.ScopeCloudfront),
+					resource.TestCheckResourceAttr(resourceName, "visibility_config.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "visibility_config.0.cloudwatch_metrics_enabled", "false"),
+					resource.TestCheckResourceAttr(resourceName, "visibility_config.0.metric_name", "friendly-metric-name"),
+					resource.TestCheckResourceAttr(resourceName, "visibility_config.0.sampled_requests_enabled", "false"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+				ImportStateIdFunc: testAccWebACLImportStateIdFunc(resourceName),
+			},
+		},
+	})
+}
+
+func TestAccWAFV2WebACL_CloudFrontScope(t *testing.T) {
+	ctx := acctest.Context(t)
+	var v wafv2.WebACL
+	webACLName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_wafv2_web_acl.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckWAFV2CloudFrontScope(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, wafv2.EndpointsID),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckWebACLDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccWebACLConfig_CloudFrontScope(webACLName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckWebACLExists(ctx, resourceName, &v),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexache.MustCompile(`global/webacl/.+$`)),
+					resource.TestCheckResourceAttr(resourceName, "name", webACLName),
+					resource.TestCheckResourceAttr(resourceName, "scope", wafv2.ScopeCloudfront),
+					resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
+					resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
+						"name":        "rule-1",
+						"statement.#": "1",
+						"statement.0.managed_rule_group_statement.#":                                                                                                                       "1",
+						"statement.0.managed_rule_group_statement.0.managed_rule_group_configs.0.aws_managed_rules_atp_rule_set.#":                                                         "1",
+						"statement.0.managed_rule_group_statement.0.managed_rule_group_configs.0.aws_managed_rules_atp_rule_set.0.login_path":                                              "/api/1/signin",
+						"statement.0.managed_rule_group_statement.0.managed_rule_group_configs.0.aws_managed_rules_atp_rule_set.0.request_inspection.#":                                    "1",
+						"statement.0.managed_rule_group_statement.0.managed_rule_group_configs.0.aws_managed_rules_atp_rule_set.0.request_inspection.0.password_field.#":                   "1",
+						"statement.0.managed_rule_group_statement.0.managed_rule_group_configs.0.aws_managed_rules_atp_rule_set.0.request_inspection.0.password_field.0.identifier":        "/password",
+						"statement.0.managed_rule_group_statement.0.managed_rule_group_configs.0.aws_managed_rules_atp_rule_set.0.request_inspection.0.payload_type":                       "JSON",
+						"statement.0.managed_rule_group_statement.0.managed_rule_group_configs.0.aws_managed_rules_atp_rule_set.0.request_inspection.0.username_field.#":                   "1",
+						"statement.0.managed_rule_group_statement.0.managed_rule_group_configs.0.aws_managed_rules_atp_rule_set.0.request_inspection.0.username_field.0.identifier":        "/username",
+						"statement.0.managed_rule_group_statement.0.managed_rule_group_configs.0.aws_managed_rules_atp_rule_set.0.response_inspection.#":                                   "1",
+						"statement.0.managed_rule_group_statement.0.managed_rule_group_configs.0.aws_managed_rules_atp_rule_set.0.response_inspection.0.body_contains.#":                   "1",
+						"statement.0.managed_rule_group_statement.0.managed_rule_group_configs.0.aws_managed_rules_atp_rule_set.0.response_inspection.0.body_contains.0.success_strings.#": "1",
+						"statement.0.managed_rule_group_statement.0.managed_rule_group_configs.0.aws_managed_rules_atp_rule_set.0.response_inspection.0.body_contains.0.success_strings.0": "Login successful",
+						"statement.0.managed_rule_group_statement.0.managed_rule_group_configs.0.aws_managed_rules_atp_rule_set.0.response_inspection.0.body_contains.0.failure_strings.#": "1",
+						"statement.0.managed_rule_group_statement.0.managed_rule_group_configs.0.aws_managed_rules_atp_rule_set.0.response_inspection.0.body_contains.0.failure_strings.0": "Login failed",
+					}),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+				ImportStateIdFunc: testAccWebACLImportStateIdFunc(resourceName),
+			},
+		},
+	})
+}
+
+func testAccCheckWebACLDestroy(ctx context.Context) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		conn := acctest.Provider.Meta().(*conns.AWSClient).WAFV2Conn(ctx)
+
+		for _, rs := range s.RootModule().Resources {
+			if rs.Type != "aws_wafv2_web_acl" {
+				continue
+			}
+
+			_, err := tfwafv2.FindWebACLByThreePartKey(ctx, conn, rs.Primary.ID, rs.Primary.Attributes["name"], rs.Primary.Attributes["scope"])
 
 			if tfresource.NotFound(err) {
 				continue
@@ -2418,10 +2911,6 @@ func testAccCheckWebACLExists(ctx context.Context, n string, v *wafv2.WebACL) re
 			return fmt.Errorf("Not found: %s", n)
 		}
 
-		if rs.Primary.ID == "" {
-			return fmt.Errorf("No WAFv2 WebACL ID is set")
-		}
-
 		conn := acctest.Provider.Meta().(*conns.AWSClient).WAFV2Conn(ctx)
 
 		output, err := tfwafv2.FindWebACLByThreePartKey(ctx, conn, rs.Primary.ID, rs.Primary.Attributes["name"], rs.Primary.Attributes["scope"])
@@ -2436,7 +2925,18 @@ func testAccCheckWebACLExists(ctx context.Context, n string, v *wafv2.WebACL) re
 	}
 }
 
-func testAccWebACLConfig_basic(name string) string {
+func testAccWebACLImportStateIdFunc(resourceName string) resource.ImportStateIdFunc {
+	return func(s *terraform.State) (string, error) {
+		rs, ok := s.RootModule().Resources[resourceName]
+		if !ok {
+			return "", fmt.Errorf("Not found: %s", resourceName)
+		}
+
+		return fmt.Sprintf("%s/%s/%s", rs.Primary.ID, rs.Primary.Attributes["name"], rs.Primary.Attributes["scope"]), nil
+	}
+}
+
+func testAccWebACLConfig_basic(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_web_acl" "test" {
   name        = %[1]q
@@ -2453,10 +2953,10 @@ resource "aws_wafv2_web_acl" "test" {
     sampled_requests_enabled   = false
   }
 }
-`, name)
+`, rName)
 }
 
-func testAccWebACLConfig_basicRule(name string) string {
+func testAccWebACLConfig_basicRule(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_web_acl" "test" {
   name        = %[1]q
@@ -2509,10 +3009,10 @@ resource "aws_wafv2_web_acl" "test" {
     sampled_requests_enabled   = false
   }
 }
-`, name)
+`, rName)
 }
 
-func testAccWebACLConfig_updateRuleNamePriorityMetric(name, ruleName1, ruleName2 string, priority1, priority2 int) string {
+func testAccWebACLConfig_updateRuleNamePriorityMetric(rName, ruleName1, ruleName2 string, priority1, priority2 int) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_web_acl" "test" {
   name        = %[1]q
@@ -2586,14 +3086,14 @@ resource "aws_wafv2_web_acl" "test" {
     sampled_requests_enabled   = false
   }
 }
-`, name, ruleName1, priority1, ruleName2, priority2)
+`, rName, ruleName1, priority1, ruleName2, priority2)
 }
 
-func testAccWebACLConfig_byteMatchStatement(name, positionalConstraint, searchString string) string {
+func testAccWebACLConfig_byteMatchStatement(rName, positionalConstraint, searchString string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_web_acl" "test" {
-  name        = "%[1]s"
-  description = "%[1]s"
+  name        = %[1]q
+  description = %[1]q
   scope       = "REGIONAL"
 
   default_action {
@@ -2613,8 +3113,59 @@ resource "aws_wafv2_web_acl" "test" {
         field_to_match {
           all_query_arguments {}
         }
-        positional_constraint = "%[2]s"
-        search_string         = "%[3]s"
+        positional_constraint = %[2]q
+        search_string         = %[3]q
+        text_transformation {
+          priority = 0
+          type     = "NONE"
+        }
+      }
+    }
+
+    visibility_config {
+      cloudwatch_metrics_enabled = false
+      metric_name                = "friendly-rule-metric-name"
+      sampled_requests_enabled   = false
+    }
+  }
+
+  visibility_config {
+    cloudwatch_metrics_enabled = false
+    metric_name                = "friendly-metric-name"
+    sampled_requests_enabled   = false
+  }
+}
+`, rName, positionalConstraint, searchString)
+}
+
+func testAccWebACLConfig_byteMatchStatementJA3Fingerprint(rName, fallbackBehavior string) string {
+	return fmt.Sprintf(`
+resource "aws_wafv2_web_acl" "test" {
+  name        = %[1]q
+  description = %[1]q
+  scope       = "REGIONAL"
+
+  default_action {
+    allow {}
+  }
+
+  rule {
+    name     = "rule-1"
+    priority = 1
+
+    action {
+      count {}
+    }
+
+    statement {
+      byte_match_statement {
+        field_to_match {
+          ja3_fingerprint {
+            fallback_behavior = %[2]q
+          }
+        }
+        positional_constraint = "EXACTLY"
+        search_string         = "abcdef1234567890abcdef1234567890"
         text_transformation {
           priority = 0
           type     = "NONE"
@@ -2635,14 +3186,14 @@ resource "aws_wafv2_web_acl" "test" {
     sampled_requests_enabled   = false
   }
 }
-`, name, positionalConstraint, searchString)
+`, rName, fallbackBehavior)
 }
 
-func testAccWebACLConfig_byteMatchStatementJSONBody(name, matchScope, invalidFallbackBehavior, oversizeHandling, matchPattern string) string {
+func testAccWebACLConfig_byteMatchStatementJSONBody(rName, matchScope, invalidFallbackBehavior, oversizeHandling, matchPattern string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_web_acl" "test" {
-  name        = "%[1]s"
-  description = "%[1]s"
+  name        = %[1]q
+  description = %[1]q
   scope       = "REGIONAL"
 
   default_action {
@@ -2661,9 +3212,9 @@ resource "aws_wafv2_web_acl" "test" {
       byte_match_statement {
         field_to_match {
           json_body {
-            match_scope               = "%[2]s"
-            invalid_fallback_behavior = "%[3]s"
-            oversize_handling         = "%[4]s"
+            match_scope               = %[2]q
+            invalid_fallback_behavior = %[3]q
+            oversize_handling         = %[4]q
             match_pattern {
               %[5]s
             }
@@ -2691,14 +3242,14 @@ resource "aws_wafv2_web_acl" "test" {
     sampled_requests_enabled   = false
   }
 }
-`, name, matchScope, invalidFallbackBehavior, oversizeHandling, matchPattern)
+`, rName, matchScope, invalidFallbackBehavior, oversizeHandling, matchPattern)
 }
 
-func testAccWebACLConfig_byteMatchStatementBody(name, oversizeHandling string) string {
+func testAccWebACLConfig_byteMatchStatementBody(rName, oversizeHandling string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_web_acl" "test" {
-  name        = "%[1]s"
-  description = "%[1]s"
+  name        = %[1]q
+  description = %[1]q
   scope       = "REGIONAL"
 
   default_action {
@@ -2717,7 +3268,7 @@ resource "aws_wafv2_web_acl" "test" {
       byte_match_statement {
         field_to_match {
           body {
-            oversize_handling = "%[2]s"
+            oversize_handling = %[2]q
           }
         }
         positional_constraint = "CONTAINS_WORD"
@@ -2742,10 +3293,10 @@ resource "aws_wafv2_web_acl" "test" {
     sampled_requests_enabled   = false
   }
 }
-`, name, oversizeHandling)
+`, rName, oversizeHandling)
 }
 
-func testAccWebACLConfig_geoMatchStatement(name, countryCodes string) string {
+func testAccWebACLConfig_geoMatchStatement(rName, countryCodes string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_web_acl" "test" {
   name        = %[1]q
@@ -2788,14 +3339,14 @@ resource "aws_wafv2_web_acl" "test" {
     sampled_requests_enabled   = false
   }
 }
-`, name, countryCodes)
+`, rName, countryCodes)
 }
 
-func testAccWebACLConfig_labelMatchStatement(name, labelScope string, labelKey string) string {
+func testAccWebACLConfig_labelMatchStatement(rName, labelScope string, labelKey string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_web_acl" "test" {
-  name        = "%[1]s"
-  description = "%[1]s"
+  name        = %[1]q
+  description = %[1]q
   scope       = "REGIONAL"
   default_action {
     allow {}
@@ -2808,8 +3359,8 @@ resource "aws_wafv2_web_acl" "test" {
     }
     statement {
       label_match_statement {
-        scope = "%[2]s"
-        key   = "%[3]s"
+        scope = %[2]q
+        key   = %[3]q
       }
     }
     visibility_config {
@@ -2828,14 +3379,14 @@ resource "aws_wafv2_web_acl" "test" {
     sampled_requests_enabled   = false
   }
 }
-`, name, labelScope, labelKey)
+`, rName, labelScope, labelKey)
 }
 
-func testAccWebACLConfig_ruleLabels(name string) string {
+func testAccWebACLConfig_ruleLabels(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_web_acl" "test" {
-  name        = "%[1]s"
-  description = "%[1]s"
+  name        = %[1]q
+  description = %[1]q
   scope       = "REGIONAL"
   default_action {
     allow {}
@@ -2869,14 +3420,14 @@ resource "aws_wafv2_web_acl" "test" {
     sampled_requests_enabled   = false
   }
 }
-`, name)
+`, rName)
 }
 
-func testAccWebACLConfig_noRuleLabels(name string) string {
+func testAccWebACLConfig_noRuleLabels(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_web_acl" "test" {
-  name        = "%[1]s"
-  description = "%[1]s"
+  name        = %[1]q
+  description = %[1]q
   scope       = "REGIONAL"
   default_action {
     allow {}
@@ -2904,10 +3455,10 @@ resource "aws_wafv2_web_acl" "test" {
     sampled_requests_enabled   = false
   }
 }
-`, name)
+`, rName)
 }
 
-func testAccWebACLConfig_customRequestHandlingAllow(name, firstHeader string, secondHeader string) string {
+func testAccWebACLConfig_customRequestHandlingAllow(rName, firstHeader string, secondHeader string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_web_acl" "test" {
   name        = %[1]q
@@ -2957,10 +3508,10 @@ resource "aws_wafv2_web_acl" "test" {
     sampled_requests_enabled   = false
   }
 }
-`, name, firstHeader, secondHeader)
+`, rName, firstHeader, secondHeader)
 }
 
-func testAccWebACLConfig_customRequestHandlingCaptcha(name, firstHeader string, secondHeader string) string {
+func testAccWebACLConfig_customRequestHandlingCaptcha(rName, firstHeader string, secondHeader string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_web_acl" "test" {
   name        = %[1]q
@@ -3022,10 +3573,10 @@ resource "aws_wafv2_web_acl" "test" {
     }
   }
 }
-`, name, firstHeader, secondHeader)
+`, rName, firstHeader, secondHeader)
 }
 
-func testAccWebACLConfig_customRequestHandlingChallenge(name string) string {
+func testAccWebACLConfig_customRequestHandlingChallenge(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_web_acl" "test" {
   name        = %[1]q
@@ -3063,10 +3614,10 @@ resource "aws_wafv2_web_acl" "test" {
     sampled_requests_enabled   = false
   }
 }
-`, name)
+`, rName)
 }
 
-func testAccWebACLConfig_customRequestHandlingCount(name, firstHeader string, secondHeader string) string {
+func testAccWebACLConfig_customRequestHandlingCount(rName, firstHeader string, secondHeader string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_web_acl" "test" {
   name        = %[1]q
@@ -3116,10 +3667,10 @@ resource "aws_wafv2_web_acl" "test" {
     sampled_requests_enabled   = false
   }
 }
-`, name, firstHeader, secondHeader)
+`, rName, firstHeader, secondHeader)
 }
 
-func testAccWebACLConfig_customResponse(name string, defaultStatusCode int, countryBlockStatusCode int, countryHeaderName string) string {
+func testAccWebACLConfig_customResponse(rName string, defaultStatusCode int, countryBlockStatusCode int, countryHeaderName string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_web_acl" "test" {
   name        = %[1]q
@@ -3170,14 +3721,14 @@ resource "aws_wafv2_web_acl" "test" {
     sampled_requests_enabled   = false
   }
 }
-`, name, defaultStatusCode, countryBlockStatusCode, countryHeaderName)
+`, rName, defaultStatusCode, countryBlockStatusCode, countryHeaderName)
 }
 
-func testAccWebACLConfig_customResponseBody(name string, defaultStatusCode int, countryBlockStatusCode int) string {
+func testAccWebACLConfig_customResponseBody(rName string, defaultStatusCode int, countryBlockStatusCode int) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_web_acl" "test" {
-  name        = "%[1]s"
-  description = "%[1]s"
+  name        = %[1]q
+  description = %[1]q
   scope       = "REGIONAL"
   default_action {
     block {
@@ -3219,10 +3770,10 @@ resource "aws_wafv2_web_acl" "test" {
     sampled_requests_enabled   = false
   }
 }
-`, name, defaultStatusCode, countryBlockStatusCode)
+`, rName, defaultStatusCode, countryBlockStatusCode)
 }
 
-func testAccWebACLConfig_geoMatchStatementForwardedIP(name, fallbackBehavior, headerName string) string {
+func testAccWebACLConfig_geoMatchStatementForwardedIP(rName, fallbackBehavior, headerName string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_web_acl" "test" {
   name        = %[1]q
@@ -3274,10 +3825,10 @@ resource "aws_wafv2_web_acl" "test" {
     sampled_requests_enabled   = false
   }
 }
-`, name, fallbackBehavior, headerName)
+`, rName, fallbackBehavior, headerName)
 }
 
-func testAccWebACLConfig_ipsetReference(name string) string {
+func testAccWebACLConfig_ipsetReference(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_ip_set" "test" {
   name               = "ip-set-%[1]s"
@@ -3322,10 +3873,10 @@ resource "aws_wafv2_web_acl" "test" {
     sampled_requests_enabled   = false
   }
 }
-`, name)
+`, rName)
 }
 
-func testAccWebACLConfig_ipsetReferenceForwardedIP(name, fallbackBehavior, headerName, position string) string {
+func testAccWebACLConfig_ipsetReferenceForwardedIP(rName, fallbackBehavior, headerName, position string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_ip_set" "test" {
   name               = "ip-set-%[1]s"
@@ -3375,10 +3926,10 @@ resource "aws_wafv2_web_acl" "test" {
     sampled_requests_enabled   = false
   }
 }
-`, name, fallbackBehavior, headerName, position)
+`, rName, fallbackBehavior, headerName, position)
 }
 
-func testAccWebACLConfig_managedRuleGroupStatement(name string) string {
+func testAccWebACLConfig_managedRuleGroupStatement(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_web_acl" "test" {
   name        = %[1]q
@@ -3422,10 +3973,10 @@ resource "aws_wafv2_web_acl" "test" {
     sampled_requests_enabled   = false
   }
 }
-`, name)
+`, rName)
 }
 
-func testAccWebACLConfig_managedRuleGroupStatementManagedRuleGroupConfig(name string) string {
+func testAccWebACLConfig_managedRuleGroupStatementManagedRuleGroupConfig(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_web_acl" "test" {
   name        = %[1]q
@@ -3486,10 +4037,10 @@ resource "aws_wafv2_web_acl" "test" {
     sampled_requests_enabled   = false
   }
 }
-`, name)
+`, rName)
 }
 
-func testAccWebACLConfig_managedRuleGroupStatementManagedRuleGroupConfigUpdate(name string) string {
+func testAccWebACLConfig_managedRuleGroupStatementManagedRuleGroupConfigUpdate(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_web_acl" "test" {
   name        = %[1]q
@@ -3550,10 +4101,10 @@ resource "aws_wafv2_web_acl" "test" {
     sampled_requests_enabled   = false
   }
 }
-`, name)
+`, rName)
 }
 
-func testAccWebACLConfig_managedRuleGroupStatementManagedRuleGroupConfig_atpRuleSet(name string) string {
+func testAccWebACLConfig_managedRuleGroupStatementManagedRuleGroupConfig_acfpRuleSet(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_web_acl" "test" {
   name        = %[1]q
@@ -3574,13 +4125,17 @@ resource "aws_wafv2_web_acl" "test" {
 
     statement {
       managed_rule_group_statement {
-        name        = "AWSManagedRulesATPRuleSet"
+        name        = "AWSManagedRulesACFPRuleSet"
         vendor_name = "AWS"
 
         managed_rule_group_configs {
-          aws_managed_rules_atp_rule_set {
-            login_path = "/api/1/signin"
+          aws_managed_rules_acfp_rule_set {
+            creation_path          = "/creation"
+            registration_page_path = "/registration"
             request_inspection {
+              email_field {
+                identifier = "/email"
+              }
               password_field {
                 identifier = "/password"
               }
@@ -3612,10 +4167,10 @@ resource "aws_wafv2_web_acl" "test" {
     sampled_requests_enabled   = false
   }
 }
-`, name)
+`, rName)
 }
 
-func testAccWebACLConfig_managedRuleGroupStatementManagedRuleGroupConfig_atpRuleSetUpdate(name string) string {
+func testAccWebACLConfig_managedRuleGroupStatementManagedRuleGroupConfig_atpRuleSet(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_web_acl" "test" {
   name        = %[1]q
@@ -3641,14 +4196,14 @@ resource "aws_wafv2_web_acl" "test" {
 
         managed_rule_group_configs {
           aws_managed_rules_atp_rule_set {
-            login_path = "/api/2/signin"
+            login_path = "/api/1/signin"
             request_inspection {
               password_field {
-                identifier = "/pass"
+                identifier = "/password"
               }
               payload_type = "JSON"
               username_field {
-                identifier = "/user"
+                identifier = "/username"
               }
             }
           }
@@ -3674,10 +4229,10 @@ resource "aws_wafv2_web_acl" "test" {
     sampled_requests_enabled   = false
   }
 }
-`, name)
+`, rName)
 }
 
-func testAccWebACLConfig_managedRuleGroupStatementManagedRuleGroupConfig_botControl(name string) string {
+func testAccWebACLConfig_managedRuleGroupStatementManagedRuleGroupConfig_acfpRuleSetUpdate(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_web_acl" "test" {
   name        = %[1]q
@@ -3698,12 +4253,27 @@ resource "aws_wafv2_web_acl" "test" {
 
     statement {
       managed_rule_group_statement {
-        name        = "AWSManagedRulesBotControlRuleSet"
+        name        = "AWSManagedRulesACFPRuleSet"
         vendor_name = "AWS"
 
         managed_rule_group_configs {
-          aws_managed_rules_bot_control_rule_set {
-            inspection_level = "TARGETED"
+          aws_managed_rules_acfp_rule_set {
+            enable_regex_in_path   = true
+            creation_path          = "/creation"
+            registration_page_path = "/registration"
+
+            request_inspection {
+              email_field {
+                identifier = "/email"
+              }
+              password_field {
+                identifier = "/pass"
+              }
+              payload_type = "JSON"
+              username_field {
+                identifier = "/user"
+              }
+            }
           }
         }
       }
@@ -3727,10 +4297,10 @@ resource "aws_wafv2_web_acl" "test" {
     sampled_requests_enabled   = false
   }
 }
-`, name)
+`, rName)
 }
 
-func testAccWebACLConfig_managedRuleGroupStatementUpdate(name string) string {
+func testAccWebACLConfig_managedRuleGroupStatementManagedRuleGroupConfig_atpRuleSetUpdate(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_web_acl" "test" {
   name        = %[1]q
@@ -3746,33 +4316,28 @@ resource "aws_wafv2_web_acl" "test" {
     priority = 1
 
     override_action {
-      count {}
+      none {}
     }
 
     statement {
       managed_rule_group_statement {
-        name        = "AWSManagedRulesCommonRuleSet"
+        name        = "AWSManagedRulesATPRuleSet"
         vendor_name = "AWS"
 
-        rule_action_override {
-          action_to_use {
-            count {}
-          }
-
-          name = "SizeRestrictions_QUERYSTRING"
-        }
-
-        rule_action_override {
-          action_to_use {
-            count {}
-          }
-
-          name = "NoUserAgent_HEADER"
-        }
+        managed_rule_group_configs {
+          aws_managed_rules_atp_rule_set {
+            enable_regex_in_path = true
+            login_path           = "/api/2/signin"
 
-        scope_down_statement {
-          geo_match_statement {
-            country_codes = ["US", "NL"]
+            request_inspection {
+              password_field {
+                identifier = "/pass"
+              }
+              payload_type = "JSON"
+              username_field {
+                identifier = "/user"
+              }
+            }
           }
         }
       }
@@ -3796,10 +4361,10 @@ resource "aws_wafv2_web_acl" "test" {
     sampled_requests_enabled   = false
   }
 }
-`, name)
+`, rName)
 }
 
-func testAccWebACLConfig_managedRuleGroupStatementRuleActionOverrides(name string) string {
+func testAccWebACLConfig_managedRuleGroupStatementManagedRuleGroupConfig_botControl(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_web_acl" "test" {
   name        = %[1]q
@@ -3815,33 +4380,17 @@ resource "aws_wafv2_web_acl" "test" {
     priority = 1
 
     override_action {
-      count {}
+      none {}
     }
 
     statement {
       managed_rule_group_statement {
-        name        = "AWSManagedRulesCommonRuleSet"
+        name        = "AWSManagedRulesBotControlRuleSet"
         vendor_name = "AWS"
 
-        rule_action_override {
-          action_to_use {
-            count {}
-          }
-
-          name = "SizeRestrictions_QUERYSTRING"
-        }
-
-        rule_action_override {
-          action_to_use {
-            count {}
-          }
-
-          name = "NoUserAgent_HEADER"
-        }
-
-        scope_down_statement {
-          geo_match_statement {
-            country_codes = ["US", "NL"]
+        managed_rule_group_configs {
+          aws_managed_rules_bot_control_rule_set {
+            inspection_level = "TARGETED"
           }
         }
       }
@@ -3865,10 +4414,10 @@ resource "aws_wafv2_web_acl" "test" {
     sampled_requests_enabled   = false
   }
 }
-`, name)
+`, rName)
 }
 
-func testAccWebACLConfig_managedRuleGroupStatementVersionVersion10(name string) string {
+func testAccWebACLConfig_managedRuleGroupStatementUpdate(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_web_acl" "test" {
   name        = %[1]q
@@ -3884,14 +4433,35 @@ resource "aws_wafv2_web_acl" "test" {
     priority = 1
 
     override_action {
-      none {}
+      count {}
     }
 
     statement {
       managed_rule_group_statement {
         name        = "AWSManagedRulesCommonRuleSet"
         vendor_name = "AWS"
-        version     = "Version_1.0"
+
+        rule_action_override {
+          action_to_use {
+            count {}
+          }
+
+          name = "SizeRestrictions_QUERYSTRING"
+        }
+
+        rule_action_override {
+          action_to_use {
+            count {}
+          }
+
+          name = "NoUserAgent_HEADER"
+        }
+
+        scope_down_statement {
+          geo_match_statement {
+            country_codes = ["US", "NL"]
+          }
+        }
       }
     }
 
@@ -3913,10 +4483,10 @@ resource "aws_wafv2_web_acl" "test" {
     sampled_requests_enabled   = false
   }
 }
-`, name)
+`, rName)
 }
 
-func testAccWebACLConfig_rateBasedStatement(name string) string {
+func testAccWebACLConfig_managedRuleGroupStatementRuleActionOverrides(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_web_acl" "test" {
   name        = %[1]q
@@ -3924,7 +4494,124 @@ resource "aws_wafv2_web_acl" "test" {
   scope       = "REGIONAL"
 
   default_action {
-    block {}
+    allow {}
+  }
+
+  rule {
+    name     = "rule-1"
+    priority = 1
+
+    override_action {
+      count {}
+    }
+
+    statement {
+      managed_rule_group_statement {
+        name        = "AWSManagedRulesCommonRuleSet"
+        vendor_name = "AWS"
+
+        rule_action_override {
+          action_to_use {
+            count {}
+          }
+
+          name = "SizeRestrictions_QUERYSTRING"
+        }
+
+        rule_action_override {
+          action_to_use {
+            count {}
+          }
+
+          name = "NoUserAgent_HEADER"
+        }
+
+        scope_down_statement {
+          geo_match_statement {
+            country_codes = ["US", "NL"]
+          }
+        }
+      }
+    }
+
+    visibility_config {
+      cloudwatch_metrics_enabled = false
+      metric_name                = "friendly-rule-metric-name"
+      sampled_requests_enabled   = false
+    }
+  }
+
+  tags = {
+    Tag1 = "Value1"
+    Tag2 = "Value2"
+  }
+
+  visibility_config {
+    cloudwatch_metrics_enabled = false
+    metric_name                = "friendly-metric-name"
+    sampled_requests_enabled   = false
+  }
+}
+`, rName)
+}
+
+func testAccWebACLConfig_managedRuleGroupStatementVersionVersion10(rName string) string {
+	return fmt.Sprintf(`
+resource "aws_wafv2_web_acl" "test" {
+  name        = %[1]q
+  description = %[1]q
+  scope       = "REGIONAL"
+
+  default_action {
+    allow {}
+  }
+
+  rule {
+    name     = "rule-1"
+    priority = 1
+
+    override_action {
+      none {}
+    }
+
+    statement {
+      managed_rule_group_statement {
+        name        = "AWSManagedRulesCommonRuleSet"
+        vendor_name = "AWS"
+        version     = "Version_1.0"
+      }
+    }
+
+    visibility_config {
+      cloudwatch_metrics_enabled = false
+      metric_name                = "friendly-rule-metric-name"
+      sampled_requests_enabled   = false
+    }
+  }
+
+  tags = {
+    Tag1 = "Value1"
+    Tag2 = "Value2"
+  }
+
+  visibility_config {
+    cloudwatch_metrics_enabled = false
+    metric_name                = "friendly-metric-name"
+    sampled_requests_enabled   = false
+  }
+}
+`, rName)
+}
+
+func testAccWebACLConfig_rateBasedStatement(rName string) string {
+	return fmt.Sprintf(`
+resource "aws_wafv2_web_acl" "test" {
+  name        = %[1]q
+  description = %[1]q
+  scope       = "REGIONAL"
+
+  default_action {
+    block {}
   }
 
   rule {
@@ -3959,10 +4646,10 @@ resource "aws_wafv2_web_acl" "test" {
     sampled_requests_enabled   = false
   }
 }
-`, name)
+`, rName)
 }
 
-func testAccWebACLConfig_rateBasedStatementForwardedIP(name, fallbackBehavior, headerName string) string {
+func testAccWebACLConfig_rateBasedStatementForwardedIP(rName, fallbackBehavior, headerName string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_web_acl" "test" {
   name        = %[1]q
@@ -4010,10 +4697,396 @@ resource "aws_wafv2_web_acl" "test" {
     sampled_requests_enabled   = false
   }
 }
-`, name, fallbackBehavior, headerName)
+`, rName, fallbackBehavior, headerName)
+}
+
+func testAccWebACLConfig_rateBasedStatement_customKeysBasic(rName, customKey, customKeyName string) string {
+	return fmt.Sprintf(`
+resource "aws_wafv2_web_acl" "test" {
+  name        = %[1]q
+  description = %[1]q
+  scope       = "REGIONAL"
+
+  default_action {
+    allow {}
+  }
+
+  rule {
+    name     = "rule-1"
+    priority = 1
+
+    action {
+      count {}
+    }
+
+    statement {
+      rate_based_statement {
+        aggregate_key_type = "CUSTOM_KEYS"
+        limit              = 50000
+
+        custom_key {
+          %[2]s {
+            name = %[3]q
+
+            text_transformation {
+              type     = "NONE"
+              priority = 0
+            }
+          }
+        }
+      }
+    }
+
+    visibility_config {
+      cloudwatch_metrics_enabled = false
+      metric_name                = "friendly-rule-metric-name"
+      sampled_requests_enabled   = false
+    }
+  }
+
+  tags = {
+    Tag1 = "Value1"
+    Tag2 = "Value2"
+  }
+
+  visibility_config {
+    cloudwatch_metrics_enabled = false
+    metric_name                = "friendly-metric-name"
+    sampled_requests_enabled   = false
+  }
+}
+`, rName, customKey, customKeyName)
+}
+
+func testAccWebACLConfig_rateBasedStatement_customKeysMinimal(rName, customKey string) string {
+	return fmt.Sprintf(`
+resource "aws_wafv2_web_acl" "test" {
+  name        = %[1]q
+  description = %[1]q
+  scope       = "REGIONAL"
+
+  default_action {
+    allow {}
+  }
+
+  rule {
+    name     = "rule-1"
+    priority = 1
+
+    action {
+      count {}
+    }
+
+    statement {
+      rate_based_statement {
+        aggregate_key_type = "CUSTOM_KEYS"
+        limit              = 50000
+
+        custom_key {
+          %[2]s {
+            text_transformation {
+              type     = "NONE"
+              priority = 0
+            }
+          }
+        }
+      }
+    }
+
+    visibility_config {
+      cloudwatch_metrics_enabled = false
+      metric_name                = "friendly-rule-metric-name"
+      sampled_requests_enabled   = false
+    }
+  }
+
+  tags = {
+    Tag1 = "Value1"
+    Tag2 = "Value2"
+  }
+
+  visibility_config {
+    cloudwatch_metrics_enabled = false
+    metric_name                = "friendly-metric-name"
+    sampled_requests_enabled   = false
+  }
+}
+`, rName, customKey)
+}
+
+func testAccWebACLConfig_rateBasedStatement_customKeysIP(rName string) string {
+	return fmt.Sprintf(`
+resource "aws_wafv2_web_acl" "test" {
+  name        = %[1]q
+  description = %[1]q
+  scope       = "REGIONAL"
+
+  default_action {
+    allow {}
+  }
+
+  rule {
+    name     = "rule-1"
+    priority = 1
+
+    action {
+      count {}
+    }
+
+    statement {
+      rate_based_statement {
+        aggregate_key_type = "CUSTOM_KEYS"
+        limit              = 50000
+
+        custom_key {
+          cookie {
+            name = "cookie-name"
+
+            text_transformation {
+              type     = "NONE"
+              priority = 0
+            }
+          }
+        }
+
+        custom_key {
+          ip {}
+        }
+      }
+    }
+
+    visibility_config {
+      cloudwatch_metrics_enabled = false
+      metric_name                = "friendly-rule-metric-name"
+      sampled_requests_enabled   = false
+    }
+  }
+
+  tags = {
+    Tag1 = "Value1"
+    Tag2 = "Value2"
+  }
+
+
+  visibility_config {
+    cloudwatch_metrics_enabled = false
+    metric_name                = "friendly-metric-name"
+    sampled_requests_enabled   = false
+  }
+}
+`, rName)
+}
+
+func testAccWebACLConfig_rateBasedStatement_customKeysForwardedIP(rName string) string {
+	return fmt.Sprintf(`
+resource "aws_wafv2_web_acl" "test" {
+  name        = %[1]q
+  description = %[1]q
+  scope       = "REGIONAL"
+
+  default_action {
+    allow {}
+  }
+
+  rule {
+    name     = "rule-1"
+    priority = 1
+
+    action {
+      count {}
+    }
+
+    statement {
+      rate_based_statement {
+        aggregate_key_type = "CUSTOM_KEYS"
+        limit              = 50000
+
+        forwarded_ip_config {
+          fallback_behavior = "MATCH"
+          header_name       = "x-forwarded-for"
+        }
+
+        custom_key {
+          cookie {
+            name = "cookie-name"
+
+            text_transformation {
+              type     = "NONE"
+              priority = 0
+            }
+          }
+        }
+
+        custom_key {
+          forwarded_ip {}
+        }
+      }
+    }
+
+    visibility_config {
+      cloudwatch_metrics_enabled = false
+      metric_name                = "friendly-rule-metric-name"
+      sampled_requests_enabled   = false
+    }
+  }
+
+  tags = {
+    Tag1 = "Value1"
+    Tag2 = "Value2"
+  }
+
+  visibility_config {
+    cloudwatch_metrics_enabled = false
+    metric_name                = "friendly-metric-name"
+    sampled_requests_enabled   = false
+  }
+}
+`, rName)
+}
+
+func testAccWebACLConfig_rateBasedStatement_customKeysHTTPMethod(rName string) string {
+	return fmt.Sprintf(`
+resource "aws_wafv2_web_acl" "test" {
+  name        = %[1]q
+  description = %[1]q
+  scope       = "REGIONAL"
+
+  default_action {
+    allow {}
+  }
+
+  rule {
+    name     = "rule-1"
+    priority = 1
+
+    action {
+      count {}
+    }
+
+    statement {
+      rate_based_statement {
+        aggregate_key_type = "CUSTOM_KEYS"
+        limit              = 50000
+
+        custom_key {
+          http_method {}
+        }
+      }
+    }
+
+    visibility_config {
+      cloudwatch_metrics_enabled = false
+      metric_name                = "friendly-rule-metric-name"
+      sampled_requests_enabled   = false
+    }
+  }
+
+  tags = {
+    Tag1 = "Value1"
+    Tag2 = "Value2"
+  }
+
+  visibility_config {
+    cloudwatch_metrics_enabled = false
+    metric_name                = "friendly-metric-name"
+    sampled_requests_enabled   = false
+  }
+}
+`, rName)
+}
+
+func testAccWebACLConfig_rateBasedStatement_customKeysMaxKeys(rName string) string {
+	return fmt.Sprintf(`
+resource "aws_wafv2_web_acl" "test" {
+  name        = %[1]q
+  description = %[1]q
+  scope       = "REGIONAL"
+
+  default_action {
+    allow {}
+  }
+
+  rule {
+    name     = "rule-1"
+    priority = 1
+
+    action {
+      count {}
+    }
+
+    statement {
+      rate_based_statement {
+        aggregate_key_type = "CUSTOM_KEYS"
+        limit              = 50000
+
+        custom_key {
+          cookie {
+            name = "cookie-name"
+
+            text_transformation {
+              type     = "NONE"
+              priority = 0
+            }
+          }
+        }
+
+        custom_key {
+          header {
+            name = "x-api-key"
+
+            text_transformation {
+              type     = "NONE"
+              priority = 0
+            }
+          }
+        }
+
+        custom_key {
+          query_string {
+            text_transformation {
+              type     = "NONE"
+              priority = 0
+            }
+          }
+        }
+
+        custom_key {
+          uri_path {
+            text_transformation {
+              type     = "NONE"
+              priority = 0
+            }
+          }
+        }
+
+        custom_key {
+          http_method {}
+        }
+      }
+    }
+
+    visibility_config {
+      cloudwatch_metrics_enabled = false
+      metric_name                = "friendly-rule-metric-name"
+      sampled_requests_enabled   = false
+    }
+  }
+
+  tags = {
+    Tag1 = "Value1"
+    Tag2 = "Value2"
+  }
+
+  visibility_config {
+    cloudwatch_metrics_enabled = false
+    metric_name                = "friendly-metric-name"
+    sampled_requests_enabled   = false
+  }
+}
+`, rName)
 }
 
-func testAccWebACLConfig_rateBasedStatementUpdate(name string) string {
+func testAccWebACLConfig_rateBasedStatementUpdate(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_web_acl" "test" {
   name        = %[1]q
@@ -4063,10 +5136,10 @@ resource "aws_wafv2_web_acl" "test" {
     sampled_requests_enabled   = false
   }
 }
-`, name)
+`, rName)
 }
 
-func testAccWebACLConfig_ruleGroupReferenceStatement(name string) string {
+func testAccWebACLConfig_ruleGroupReferenceStatement(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_rule_group" "test" {
   capacity = 10
@@ -4120,10 +5193,10 @@ resource "aws_wafv2_web_acl" "test" {
     sampled_requests_enabled   = false
   }
 }
-`, name)
+`, rName)
 }
 
-func testAccWebACLConfig_ruleGroupReferenceStatementUpdate(name string) string {
+func testAccWebACLConfig_ruleGroupReferenceStatementUpdate(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_rule_group" "test" {
   capacity = 10
@@ -4256,10 +5329,10 @@ resource "aws_wafv2_web_acl" "test" {
     sampled_requests_enabled   = false
   }
 }
-`, name)
+`, rName)
 }
 
-func testAccWebACLConfig_minimal(name string) string {
+func testAccWebACLConfig_minimal(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_web_acl" "test" {
   name  = %[1]q
@@ -4275,10 +5348,10 @@ resource "aws_wafv2_web_acl" "test" {
     sampled_requests_enabled   = false
   }
 }
-`, name)
+`, rName)
 }
 
-func testAccWebACLConfig_oneTag(name, tagKey, tagValue string) string {
+func testAccWebACLConfig_tags1(rName, tagKey1, tagValue1 string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_web_acl" "test" {
   name        = %[1]q
@@ -4299,10 +5372,10 @@ resource "aws_wafv2_web_acl" "test" {
     %[2]q = %[3]q
   }
 }
-`, name, tagKey, tagValue)
+`, rName, tagKey1, tagValue1)
 }
 
-func testAccWebACLConfig_twoTags(name, tag1Key, tag1Value, tag2Key, tag2Value string) string {
+func testAccWebACLConfig_tags2(rName, tagKey1, tagValue1, tagKey2, tagValue2 string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_web_acl" "test" {
   name        = %[1]q
@@ -4324,10 +5397,10 @@ resource "aws_wafv2_web_acl" "test" {
     %[4]q = %[5]q
   }
 }
-`, name, tag1Key, tag1Value, tag2Key, tag2Value)
+`, rName, tagKey1, tagValue1, tagKey2, tagValue2)
 }
 
-func testAccWebACLConfig_multipleNestedRateBasedStatements(name string) string {
+func testAccWebACLConfig_multipleNestedRateBasedStatements(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_regex_pattern_set" "test" {
   name  = %[1]q
@@ -4426,10 +5499,10 @@ resource "aws_wafv2_web_acl" "test" {
     sampled_requests_enabled   = false
   }
 }
-`, name)
+`, rName)
 }
 
-func testAccWebACLConfig_multipleNestedOperatorStatements(name string) string {
+func testAccWebACLConfig_multipleNestedOperatorStatements(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_regex_pattern_set" "test" {
   name  = %[1]q
@@ -4531,21 +5604,10 @@ resource "aws_wafv2_web_acl" "test" {
     sampled_requests_enabled   = false
   }
 }
-`, name)
-}
-
-func testAccWebACLImportStateIdFunc(resourceName string) resource.ImportStateIdFunc {
-	return func(s *terraform.State) (string, error) {
-		rs, ok := s.RootModule().Resources[resourceName]
-		if !ok {
-			return "", fmt.Errorf("Not found: %s", resourceName)
-		}
-
-		return fmt.Sprintf("%s/%s/%s", rs.Primary.ID, rs.Primary.Attributes["name"], rs.Primary.Attributes["scope"]), nil
-	}
+`, rName)
 }
 
-func testAccWebACLConfig_ruleGroupShieldMitigation(name string) string {
+func testAccWebACLConfig_ruleGroupShieldMitigation(rName, description string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_rule_group" "test" {
   capacity = 10
@@ -4569,6 +5631,8 @@ resource "aws_wafv2_web_acl" "test" {
     block {}
   }
 
+  description = %[2]q
+
   rule {
     name     = "ShieldMitigationRuleGroup_${data.aws_caller_identity.current.account_id}_5e665b1c-1641-4b7a-8db1-567871a18b2a_uniqueid"
     priority = 11
@@ -4596,10 +5660,10 @@ resource "aws_wafv2_web_acl" "test" {
     sampled_requests_enabled   = false
   }
 }
-`, name)
+`, rName, description)
 }
 
-func testAccWebACLConfig_ruleGroupForShieldMitigation(name string) string {
+func testAccWebACLConfig_ruleGroupForShieldMitigation(rName, description string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_rule_group" "test" {
   capacity = 10
@@ -4621,16 +5685,18 @@ resource "aws_wafv2_web_acl" "test" {
     block {}
   }
 
+  description = %[2]q
+
   visibility_config {
     cloudwatch_metrics_enabled = true
     metric_name                = "friendly-metric-name"
     sampled_requests_enabled   = false
   }
 }
-`, name)
+`, rName, description)
 }
 
-func testAccWebACLConfig_tokenDomains(name, domain1, domain2 string) string {
+func testAccWebACLConfig_tokenDomains(rName, domain1, domain2 string) string {
 	return fmt.Sprintf(`
 resource "aws_wafv2_web_acl" "test" {
   name        = %[1]q
@@ -4648,5 +5714,95 @@ resource "aws_wafv2_web_acl" "test" {
     sampled_requests_enabled   = false
   }
 }
-`, name, domain1, domain2)
+`, rName, domain1, domain2)
+}
+
+func testAccWebACLConfig_CloudFrontScope(rName string) string {
+	return fmt.Sprintf(`
+resource "aws_wafv2_web_acl" "test" {
+  name        = %[1]q
+  description = %[1]q
+  scope       = "CLOUDFRONT"
+
+  default_action {
+    allow {}
+  }
+
+  rule {
+    name     = "rule-1"
+    priority = 1
+
+    override_action {
+      count {}
+    }
+
+    statement {
+      managed_rule_group_statement {
+        name        = "AWSManagedRulesATPRuleSet"
+        vendor_name = "AWS"
+
+        managed_rule_group_configs {
+          aws_managed_rules_atp_rule_set {
+            login_path = "/api/1/signin"
+            request_inspection {
+              password_field {
+                identifier = "/password"
+              }
+              payload_type = "JSON"
+              username_field {
+                identifier = "/username"
+              }
+            }
+            response_inspection {
+              body_contains {
+                success_strings = ["Login successful"]
+                failure_strings = ["Login failed"]
+              }
+            }
+          }
+        }
+      }
+    }
+    visibility_config {
+      cloudwatch_metrics_enabled = true
+      metric_name                = "AWSManagedRulesATPRuleSet_json"
+      sampled_requests_enabled   = true
+    }
+  }
+
+  visibility_config {
+    cloudwatch_metrics_enabled = false
+    metric_name                = "friendly-metric-name"
+    sampled_requests_enabled   = false
+  }
+}
+`, rName)
+}
+
+func testAccWebACLConfig_associationConfig(rName string) string {
+	return fmt.Sprintf(`
+resource "aws_wafv2_web_acl" "test" {
+  name        = %[1]q
+  description = %[1]q
+  scope       = "CLOUDFRONT"
+
+  default_action {
+    allow {}
+  }
+
+  association_config {
+    request_body {
+      cloudfront {
+        default_size_inspection_limit = "KB_64"
+      }
+    }
+  }
+
+  visibility_config {
+    cloudwatch_metrics_enabled = false
+    metric_name                = "friendly-metric-name"
+    sampled_requests_enabled   = false
+  }
+}
+`, rName)
 }
diff --git a/internal/service/worklink/fleet.go b/internal/service/worklink/fleet.go
index 171ff858dfe..5ef424e683a 100644
--- a/internal/service/worklink/fleet.go
+++ b/internal/service/worklink/fleet.go
@@ -1,13 +1,16 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package worklink
 
 import (
 	"context"
 	"fmt"
 	"log"
-	"regexp"
 	"strings"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/worklink"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -42,7 +45,7 @@ func ResourceFleet() *schema.Resource {
 				Required: true,
 				ForceNew: true,
 				ValidateFunc: validation.All(
-					validation.StringMatch(regexp.MustCompile(`^[a-z0-9](?:[a-z0-9\-]{0,46}[a-z0-9])?$`), "must contain only alphanumeric characters"),
+					validation.StringMatch(regexache.MustCompile(`^[0-9a-z](?:[0-9a-z\-]{0,46}[0-9a-z])?$`), "must contain only alphanumeric characters"),
 					validation.StringLenBetween(1, 48),
 				),
 			},
diff --git a/internal/service/worklink/fleet_test.go b/internal/service/worklink/fleet_test.go
index 080ff77e92d..7c604350eca 100644
--- a/internal/service/worklink/fleet_test.go
+++ b/internal/service/worklink/fleet_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package worklink_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/worklink"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -181,7 +184,7 @@ func TestAccWorkLinkFleet_network(t *testing.T) {
 			},
 			{
 				Config:      testAccFleetConfig_basic(rName),
-				ExpectError: regexp.MustCompile(`Company Network Configuration cannot be removed`),
+				ExpectError: regexache.MustCompile(`Company Network Configuration cannot be removed`),
 			},
 		},
 	})
@@ -202,7 +205,7 @@ func TestAccWorkLinkFleet_deviceCaCertificate(t *testing.T) {
 				Config: testAccFleetConfig_deviceCaCertificate(rName),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckFleetExists(ctx, resourceName),
-					resource.TestMatchResourceAttr(resourceName, "device_ca_certificate", regexp.MustCompile("^-----BEGIN CERTIFICATE-----")),
+					resource.TestMatchResourceAttr(resourceName, "device_ca_certificate", regexache.MustCompile("^-----BEGIN CERTIFICATE-----")),
 				),
 			},
 			{
@@ -248,7 +251,7 @@ func TestAccWorkLinkFleet_identityProvider(t *testing.T) {
 			},
 			{
 				Config:      testAccFleetConfig_basic(rName),
-				ExpectError: regexp.MustCompile(`Identity Provider Configuration cannot be removed`),
+				ExpectError: regexache.MustCompile(`Identity Provider Configuration cannot be removed`),
 			},
 		},
 	})
diff --git a/internal/service/worklink/flex.go b/internal/service/worklink/flex.go
index 61af0d6df4f..b6c0dadf379 100644
--- a/internal/service/worklink/flex.go
+++ b/internal/service/worklink/flex.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package worklink
 
 import (
diff --git a/internal/service/worklink/generate.go b/internal/service/worklink/generate.go
index 394d7ec2096..f28424a6372 100644
--- a/internal/service/worklink/generate.go
+++ b/internal/service/worklink/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -ListTags -ServiceTagsMap -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/worklink/service_package_gen.go b/internal/service/worklink/service_package_gen.go
index ad7119b0d96..5c5e8b0041b 100644
--- a/internal/service/worklink/service_package_gen.go
+++ b/internal/service/worklink/service_package_gen.go
@@ -8,6 +8,7 @@ import (
 	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
 	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
 	worklink_sdkv1 "github.com/aws/aws-sdk-go/service/worklink"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -50,4 +51,6 @@ func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*w
 	return worklink_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/worklink/tags_gen.go b/internal/service/worklink/tags_gen.go
index a6a44819f0f..e7ccf2d6064 100644
--- a/internal/service/worklink/tags_gen.go
+++ b/internal/service/worklink/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/worklink"
 	"github.com/aws/aws-sdk-go/service/worklink/worklinkiface"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -54,7 +56,7 @@ func Tags(tags tftags.KeyValueTags) map[string]*string {
 	return aws.StringMap(tags.Map())
 }
 
-// KeyValueTags creates KeyValueTags from worklink service tags.
+// KeyValueTags creates tftags.KeyValueTags from worklink service tags.
 func KeyValueTags(ctx context.Context, tags map[string]*string) tftags.KeyValueTags {
 	return tftags.New(ctx, tags)
 }
@@ -85,6 +87,8 @@ func updateTags(ctx context.Context, conn worklinkiface.WorkLinkAPI, identifier
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.WorkLink)
 	if len(removedTags) > 0 {
diff --git a/internal/service/worklink/website_certificate_authority_association.go b/internal/service/worklink/website_certificate_authority_association.go
index 48eb1a0d72f..98f80d3a66d 100644
--- a/internal/service/worklink/website_certificate_authority_association.go
+++ b/internal/service/worklink/website_certificate_authority_association.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package worklink
 
 import (
diff --git a/internal/service/worklink/website_certificate_authority_association_test.go b/internal/service/worklink/website_certificate_authority_association_test.go
index 41274912fc6..0cdbef1ce7a 100644
--- a/internal/service/worklink/website_certificate_authority_association_test.go
+++ b/internal/service/worklink/website_certificate_authority_association_test.go
@@ -1,12 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package worklink_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/worklink"
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
@@ -37,7 +40,7 @@ func TestAccWorkLinkWebsiteCertificateAuthorityAssociation_basic(t *testing.T) {
 					resource.TestCheckResourceAttrPair(
 						resourceName, "fleet_arn",
 						"aws_worklink_fleet.test", "arn"),
-					resource.TestMatchResourceAttr(resourceName, "certificate", regexp.MustCompile("^-----BEGIN CERTIFICATE-----")),
+					resource.TestMatchResourceAttr(resourceName, "certificate", regexache.MustCompile("^-----BEGIN CERTIFICATE-----")),
 				),
 			},
 			{
diff --git a/internal/service/workspaces/bundle_data_source.go b/internal/service/workspaces/bundle_data_source.go
index 0b9c5dfe6ed..8b423e1518e 100644
--- a/internal/service/workspaces/bundle_data_source.go
+++ b/internal/service/workspaces/bundle_data_source.go
@@ -1,11 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package workspaces
 
 import (
 	"context"
 	"fmt"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/workspaces"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/workspaces"
+	"github.com/aws/aws-sdk-go-v2/service/workspaces/types"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
@@ -79,13 +83,13 @@ func DataSourceBundle() *schema.Resource {
 
 func dataSourceWorkspaceBundleRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).WorkSpacesConn(ctx)
+	conn := meta.(*conns.AWSClient).WorkSpacesClient(ctx)
 
-	var bundle *workspaces.WorkspaceBundle
+	var bundle types.WorkspaceBundle
 
 	if bundleID, ok := d.GetOk("bundle_id"); ok {
-		resp, err := conn.DescribeWorkspaceBundlesWithContext(ctx, &workspaces.DescribeWorkspaceBundlesInput{
-			BundleIds: []*string{aws.String(bundleID.(string))},
+		resp, err := conn.DescribeWorkspaceBundles(ctx, &workspaces.DescribeWorkspaceBundlesInput{
+			BundleIds: []string{bundleID.(string)},
 		})
 		if err != nil {
 			return sdkdiag.AppendErrorf(diags, "reading WorkSpaces Workspace Bundle (%s): %s", bundleID, err)
@@ -95,11 +99,11 @@ func dataSourceWorkspaceBundleRead(ctx context.Context, d *schema.ResourceData,
 			return sdkdiag.AppendErrorf(diags, "expected 1 result for WorkSpaces Workspace Bundle %q, found %d", bundleID, len(resp.Bundles))
 		}
 
-		bundle = resp.Bundles[0]
-
-		if bundle == nil {
+		if len(resp.Bundles) <= 0 {
 			return sdkdiag.AppendErrorf(diags, "no WorkSpaces Workspace Bundle with ID %q found", bundleID)
 		}
+
+		bundle = resp.Bundles[0]
 	}
 
 	if name, ok := d.GetOk("name"); ok {
@@ -112,26 +116,31 @@ func dataSourceWorkspaceBundleRead(ctx context.Context, d *schema.ResourceData,
 		}
 
 		name := name.(string)
-		err := conn.DescribeWorkspaceBundlesPagesWithContext(ctx, input, func(out *workspaces.DescribeWorkspaceBundlesOutput, lastPage bool) bool {
+
+		paginator := workspaces.NewDescribeWorkspaceBundlesPaginator(conn, input, func(out *workspaces.DescribeWorkspaceBundlesPaginatorOptions) {})
+
+		entryNotFound := true
+		for paginator.HasMorePages() && entryNotFound {
+			out, err := paginator.NextPage(ctx)
+
+			if err != nil {
+				return sdkdiag.AppendErrorf(diags, "reading WorkSpaces Workspace Bundle (%s): %s", id, err)
+			}
+
 			for _, b := range out.Bundles {
-				if aws.StringValue(b.Name) == name {
+				if aws.ToString(b.Name) == name {
 					bundle = b
-					return true
+					entryNotFound = false
 				}
 			}
-
-			return !lastPage
-		})
-		if err != nil {
-			return sdkdiag.AppendErrorf(diags, "reading WorkSpaces Workspace Bundle (%s): %s", id, err)
 		}
 
-		if bundle == nil {
+		if entryNotFound {
 			return sdkdiag.AppendErrorf(diags, "no WorkSpaces Workspace Bundle with name %q found", name)
 		}
 	}
 
-	d.SetId(aws.StringValue(bundle.BundleId))
+	d.SetId(aws.ToString(bundle.BundleId))
 	d.Set("bundle_id", bundle.BundleId)
 	d.Set("description", bundle.Description)
 	d.Set("name", bundle.Name)
@@ -140,7 +149,7 @@ func dataSourceWorkspaceBundleRead(ctx context.Context, d *schema.ResourceData,
 	computeType := make([]map[string]interface{}, 1)
 	if bundle.ComputeType != nil {
 		computeType[0] = map[string]interface{}{
-			"name": aws.StringValue(bundle.ComputeType.Name),
+			"name": string(bundle.ComputeType.Name),
 		}
 	}
 	if err := d.Set("compute_type", computeType); err != nil {
@@ -150,7 +159,7 @@ func dataSourceWorkspaceBundleRead(ctx context.Context, d *schema.ResourceData,
 	rootStorage := make([]map[string]interface{}, 1)
 	if bundle.RootStorage != nil {
 		rootStorage[0] = map[string]interface{}{
-			"capacity": aws.StringValue(bundle.RootStorage.Capacity),
+			"capacity": aws.ToString(bundle.RootStorage.Capacity),
 		}
 	}
 	if err := d.Set("root_storage", rootStorage); err != nil {
@@ -160,7 +169,7 @@ func dataSourceWorkspaceBundleRead(ctx context.Context, d *schema.ResourceData,
 	userStorage := make([]map[string]interface{}, 1)
 	if bundle.UserStorage != nil {
 		userStorage[0] = map[string]interface{}{
-			"capacity": aws.StringValue(bundle.UserStorage.Capacity),
+			"capacity": aws.ToString(bundle.UserStorage.Capacity),
 		}
 	}
 	if err := d.Set("user_storage", userStorage); err != nil {
diff --git a/internal/service/workspaces/bundle_data_source_test.go b/internal/service/workspaces/bundle_data_source_test.go
index e01fa3a4081..9da13bc6368 100644
--- a/internal/service/workspaces/bundle_data_source_test.go
+++ b/internal/service/workspaces/bundle_data_source_test.go
@@ -1,12 +1,16 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package workspaces_test
 
 import (
 	"fmt"
 	"os"
-	"regexp"
+	"strings"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/service/workspaces"
+	"github.com/YakDriver/regexache"
+	"github.com/aws/aws-sdk-go-v2/service/workspaces"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
 )
@@ -17,7 +21,7 @@ func testAccWorkspaceBundleDataSource_basic(t *testing.T) {
 
 	resource.Test(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, workspaces.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, strings.ToLower(workspaces.ServiceID)),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		Steps: []resource.TestStep{
 			{
@@ -45,7 +49,7 @@ func testAccWorkspaceBundleDataSource_byOwnerName(t *testing.T) {
 
 	resource.Test(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, workspaces.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, strings.ToLower(workspaces.ServiceID)),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		Steps: []resource.TestStep{
 			{
@@ -71,12 +75,12 @@ func testAccWorkspaceBundleDataSource_bundleIDAndNameConflict(t *testing.T) {
 	ctx := acctest.Context(t)
 	resource.Test(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, workspaces.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, strings.ToLower(workspaces.ServiceID)),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccBundleDataSourceConfig_idAndOwnerNameConflict("wsb-df76rqys9", "AMAZON", "Value with Windows 10 and Office 2016"),
-				ExpectError: regexp.MustCompile("\"bundle_id\": conflicts with owner"),
+				ExpectError: regexache.MustCompile("\"bundle_id\": conflicts with owner"),
 			},
 		},
 	})
@@ -92,7 +96,7 @@ func testAccWorkspaceBundleDataSource_privateOwner(t *testing.T) {
 			acctest.PreCheck(ctx, t)
 			testAccBundlePreCheck(t)
 		},
-		ErrorCheck:               acctest.ErrorCheck(t, workspaces.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, strings.ToLower(workspaces.ServiceID)),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		Steps: []resource.TestStep{
 			{
diff --git a/internal/service/workspaces/connection_alias.go b/internal/service/workspaces/connection_alias.go
new file mode 100644
index 00000000000..33d374f4e27
--- /dev/null
+++ b/internal/service/workspaces/connection_alias.go
@@ -0,0 +1,313 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package workspaces
+
+import (
+	"context"
+	"errors"
+	"time"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/workspaces"
+	awstypes "github.com/aws/aws-sdk-go-v2/service/workspaces/types"
+	"github.com/hashicorp/terraform-plugin-framework-timeouts/resource/timeouts"
+	"github.com/hashicorp/terraform-plugin-framework/path"
+	"github.com/hashicorp/terraform-plugin-framework/resource"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema/planmodifier"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema/stringplanmodifier"
+	"github.com/hashicorp/terraform-plugin-framework/types"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
+	"github.com/hashicorp/terraform-provider-aws/internal/create"
+	"github.com/hashicorp/terraform-provider-aws/internal/enum"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs"
+	"github.com/hashicorp/terraform-provider-aws/internal/framework"
+	"github.com/hashicorp/terraform-provider-aws/internal/framework/flex"
+	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/names"
+)
+
+var ResourceConnectionAlias = newResourceConnectionAlias
+
+// @FrameworkResource(name="Connection Alias")
+// @Tags(identifierAttribute="id")
+func newResourceConnectionAlias(_ context.Context) (resource.ResourceWithConfigure, error) {
+	r := &resourceConnectionAlias{}
+
+	r.SetDefaultCreateTimeout(30 * time.Minute)
+	r.SetDefaultUpdateTimeout(30 * time.Minute)
+	r.SetDefaultDeleteTimeout(30 * time.Minute)
+
+	return r, nil
+}
+
+const (
+	ResNameConnectionAlias = "Connection Alias"
+)
+
+type resourceConnectionAlias struct {
+	framework.ResourceWithConfigure
+	framework.WithTimeouts
+}
+
+func (r *resourceConnectionAlias) Metadata(_ context.Context, req resource.MetadataRequest, resp *resource.MetadataResponse) {
+	resp.TypeName = "aws_workspaces_connection_alias"
+}
+
+func (r *resourceConnectionAlias) Schema(ctx context.Context, req resource.SchemaRequest, resp *resource.SchemaResponse) {
+	resp.Schema = schema.Schema{
+		Attributes: map[string]schema.Attribute{
+			"id": framework.IDAttribute(),
+			"connection_string": schema.StringAttribute{
+				Required: true,
+				PlanModifiers: []planmodifier.String{
+					stringplanmodifier.RequiresReplace(),
+				},
+				Description: "The connection string specified for the connection alias. The connection string must be in the form of a fully qualified domain name (FQDN), such as www.example.com.",
+			},
+			"owner_account_id": schema.StringAttribute{
+				Computed:    true,
+				Description: "The identifier of the Amazon Web Services account that owns the connection alias.",
+				PlanModifiers: []planmodifier.String{
+					stringplanmodifier.UseStateForUnknown(),
+				},
+			},
+			"state": schema.StringAttribute{
+				Computed:    true,
+				Description: "The current state of the connection alias.",
+				PlanModifiers: []planmodifier.String{
+					stringplanmodifier.UseStateForUnknown(),
+				},
+			},
+			names.AttrTags:    tftags.TagsAttribute(),
+			names.AttrTagsAll: tftags.TagsAttributeComputedOnly(),
+		},
+		Blocks: map[string]schema.Block{
+			"timeouts": timeouts.Block(ctx, timeouts.Opts{
+				Create: true,
+				Update: true,
+				Delete: true,
+			}),
+		},
+	}
+}
+
+func (r *resourceConnectionAlias) Create(ctx context.Context, req resource.CreateRequest, resp *resource.CreateResponse) {
+	conn := r.Meta().WorkSpacesClient(ctx)
+
+	var plan resourceConnectionAliasData
+	resp.Diagnostics.Append(req.Plan.Get(ctx, &plan)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	in := &workspaces.CreateConnectionAliasInput{
+		ConnectionString: aws.String(plan.ConnectionString.ValueString()),
+		Tags:             getTagsIn(ctx),
+	}
+
+	out, err := conn.CreateConnectionAlias(ctx, in)
+	if err != nil {
+		resp.Diagnostics.AddError(
+			create.ProblemStandardMessage(names.WorkSpaces, create.ErrActionCreating, ResNameConnectionAlias, plan.ConnectionString.String(), err),
+			err.Error(),
+		)
+		return
+	}
+	if out == nil || out.AliasId == nil {
+		resp.Diagnostics.AddError(
+			create.ProblemStandardMessage(names.WorkSpaces, create.ErrActionCreating, ResNameConnectionAlias, plan.ConnectionString.String(), nil),
+			errors.New("empty output").Error(),
+		)
+		return
+	}
+
+	plan.ID = flex.StringToFramework(ctx, out.AliasId)
+
+	createTimeout := r.CreateTimeout(ctx, plan.Timeouts)
+	alias, err := waitConnectionAliasCreated(ctx, conn, plan.ID.ValueString(), createTimeout)
+	if err != nil {
+		resp.Diagnostics.AddError(
+			create.ProblemStandardMessage(names.WorkSpaces, create.ErrActionWaitingForCreation, ResNameConnectionAlias, plan.ID.String(), err),
+			err.Error(),
+		)
+		return
+	}
+
+	plan.update(ctx, alias)
+	resp.Diagnostics.Append(resp.State.Set(ctx, plan)...)
+}
+
+func (r *resourceConnectionAlias) Read(ctx context.Context, req resource.ReadRequest, resp *resource.ReadResponse) {
+	conn := r.Meta().WorkSpacesClient(ctx)
+
+	var state resourceConnectionAliasData
+	resp.Diagnostics.Append(req.State.Get(ctx, &state)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	out, err := FindConnectionAliasByID(ctx, conn, state.ID.ValueString())
+	if tfresource.NotFound(err) {
+		resp.State.RemoveResource(ctx)
+		return
+	}
+	if err != nil {
+		resp.Diagnostics.AddError(
+			create.ProblemStandardMessage(names.WorkSpaces, create.ErrActionSetting, ResNameConnectionAlias, state.ID.String(), err),
+			err.Error(),
+		)
+		return
+	}
+
+	state.update(ctx, out)
+
+	resp.Diagnostics.Append(resp.State.Set(ctx, &state)...)
+}
+
+func (r *resourceConnectionAlias) Update(ctx context.Context, req resource.UpdateRequest, resp *resource.UpdateResponse) {
+	var plan, state resourceConnectionAliasData
+	resp.Diagnostics.Append(req.Plan.Get(ctx, &plan)...)
+	resp.Diagnostics.Append(req.State.Get(ctx, &state)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	resp.Diagnostics.Append(resp.State.Set(ctx, &plan)...)
+}
+
+func (r *resourceConnectionAlias) Delete(ctx context.Context, req resource.DeleteRequest, resp *resource.DeleteResponse) {
+	conn := r.Meta().WorkSpacesClient(ctx)
+
+	var state resourceConnectionAliasData
+	resp.Diagnostics.Append(req.State.Get(ctx, &state)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	in := &workspaces.DeleteConnectionAliasInput{
+		AliasId: aws.String(state.ID.ValueString()),
+	}
+
+	_, err := conn.DeleteConnectionAlias(ctx, in)
+	if err != nil {
+		if errs.IsA[*awstypes.ResourceNotFoundException](err) {
+			return
+		}
+		resp.Diagnostics.AddError(
+			create.ProblemStandardMessage(names.WorkSpaces, create.ErrActionDeleting, ResNameConnectionAlias, state.ID.String(), err),
+			err.Error(),
+		)
+		return
+	}
+
+	deleteTimeout := r.DeleteTimeout(ctx, state.Timeouts)
+	_, err = waitConnectionAliasDeleted(ctx, conn, state.ID.ValueString(), deleteTimeout)
+	if err != nil {
+		resp.Diagnostics.AddError(
+			create.ProblemStandardMessage(names.WorkSpaces, create.ErrActionWaitingForDeletion, ResNameConnectionAlias, state.ID.String(), err),
+			err.Error(),
+		)
+		return
+	}
+}
+
+func (r *resourceConnectionAlias) ImportState(ctx context.Context, req resource.ImportStateRequest, resp *resource.ImportStateResponse) {
+	resource.ImportStatePassthroughID(ctx, path.Root("id"), req, resp)
+}
+
+func (r *resourceConnectionAlias) ModifyPlan(ctx context.Context, request resource.ModifyPlanRequest, response *resource.ModifyPlanResponse) {
+	r.SetTagsAll(ctx, request, response)
+}
+
+func (data *resourceConnectionAliasData) update(ctx context.Context, in *awstypes.ConnectionAlias) {
+	data.ConnectionString = flex.StringToFramework(ctx, in.ConnectionString)
+	data.OwnerAccountId = flex.StringToFramework(ctx, in.OwnerAccountId)
+	data.State = flex.StringValueToFramework(ctx, in.State)
+}
+
+func waitConnectionAliasCreated(ctx context.Context, conn *workspaces.Client, id string, timeout time.Duration) (*awstypes.ConnectionAlias, error) {
+	stateConf := &retry.StateChangeConf{
+		Pending:                   enum.Slice(awstypes.ConnectionAliasStateCreating),
+		Target:                    enum.Slice(awstypes.ConnectionAliasStateCreated),
+		Refresh:                   statusConnectionAlias(ctx, conn, id),
+		Timeout:                   timeout,
+		NotFoundChecks:            20,
+		ContinuousTargetOccurence: 2,
+	}
+
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+	if out, ok := outputRaw.(*awstypes.ConnectionAlias); ok {
+		return out, err
+	}
+
+	return nil, err
+}
+
+func waitConnectionAliasDeleted(ctx context.Context, conn *workspaces.Client, id string, timeout time.Duration) (*awstypes.ConnectionAlias, error) {
+	stateConf := &retry.StateChangeConf{
+		Pending: enum.Slice(awstypes.ConnectionAliasStateDeleting),
+		Target:  []string{},
+		Refresh: statusConnectionAlias(ctx, conn, id),
+		Timeout: timeout,
+	}
+
+	outputRaw, err := stateConf.WaitForStateContext(ctx)
+	if out, ok := outputRaw.(*awstypes.ConnectionAlias); ok {
+		return out, err
+	}
+
+	return nil, err
+}
+
+func statusConnectionAlias(ctx context.Context, conn *workspaces.Client, id string) retry.StateRefreshFunc {
+	return func() (interface{}, string, error) {
+		out, err := FindConnectionAliasByID(ctx, conn, id)
+		if tfresource.NotFound(err) {
+			return nil, "", nil
+		}
+
+		if err != nil {
+			return nil, "", err
+		}
+
+		return out, string(out.State), nil
+	}
+}
+
+func FindConnectionAliasByID(ctx context.Context, conn *workspaces.Client, id string) (*awstypes.ConnectionAlias, error) {
+	in := &workspaces.DescribeConnectionAliasesInput{
+		AliasIds: []string{id},
+	}
+
+	out, err := conn.DescribeConnectionAliases(ctx, in)
+
+	if errs.IsA[*awstypes.ResourceNotFoundException](err) {
+		return nil, &retry.NotFoundError{
+			LastError:   err,
+			LastRequest: in,
+		}
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	if out == nil || len(out.ConnectionAliases) == 0 {
+		return nil, tfresource.NewEmptyResultError(in)
+	}
+
+	return &out.ConnectionAliases[0], nil
+}
+
+type resourceConnectionAliasData struct {
+	ID               types.String   `tfsdk:"id"`
+	ConnectionString types.String   `tfsdk:"connection_string"`
+	OwnerAccountId   types.String   `tfsdk:"owner_account_id"`
+	State            types.String   `tfsdk:"state"`
+	Tags             types.Map      `tfsdk:"tags"`
+	TagsAll          types.Map      `tfsdk:"tags_all"`
+	Timeouts         timeouts.Value `tfsdk:"timeouts"`
+}
diff --git a/internal/service/workspaces/connection_alias_test.go b/internal/service/workspaces/connection_alias_test.go
new file mode 100644
index 00000000000..0ee49b5cca9
--- /dev/null
+++ b/internal/service/workspaces/connection_alias_test.go
@@ -0,0 +1,235 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package workspaces_test
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"strings"
+	"testing"
+
+	"github.com/aws/aws-sdk-go-v2/service/workspaces"
+	awstypes "github.com/aws/aws-sdk-go-v2/service/workspaces/types"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
+	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/create"
+	tfworkspaces "github.com/hashicorp/terraform-provider-aws/internal/service/workspaces"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
+	"github.com/hashicorp/terraform-provider-aws/names"
+)
+
+func TestAccWorkSpacesConnectionAlias_basic(t *testing.T) {
+	ctx := acctest.Context(t)
+
+	var connectionalias awstypes.ConnectionAlias
+	rName := acctest.RandomFQDomainName()
+	resourceName := "aws_workspaces_connection_alias.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, strings.ToLower(workspaces.ServiceID))
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, strings.ToLower(workspaces.ServiceID)),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckConnectionAliasDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccConnectionAliasConfig_basic(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckConnectionAliasExists(ctx, resourceName, &connectionalias),
+					resource.TestCheckResourceAttr(resourceName, "connection_string", rName),
+					resource.TestCheckResourceAttrSet(resourceName, "owner_account_id"),
+					resource.TestCheckResourceAttrSet(resourceName, "state"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
+func TestAccWorkSpacesConnectionAlias_disappears(t *testing.T) {
+	ctx := acctest.Context(t)
+
+	var connectionalias awstypes.ConnectionAlias
+	rName := acctest.RandomFQDomainName()
+	resourceName := "aws_workspaces_connection_alias.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, strings.ToLower(workspaces.ServiceID))
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, strings.ToLower(workspaces.ServiceID)),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckConnectionAliasDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccConnectionAliasConfig_basic(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckConnectionAliasExists(ctx, resourceName, &connectionalias),
+					acctest.CheckFrameworkResourceDisappears(ctx, acctest.Provider, tfworkspaces.ResourceConnectionAlias, resourceName),
+				),
+				ExpectNonEmptyPlan: true,
+			},
+		},
+	})
+}
+
+func TestAccWorkSpacesConnectionAlias_tags(t *testing.T) {
+	ctx := acctest.Context(t)
+
+	var connectionalias awstypes.ConnectionAlias
+	rName := acctest.RandomFQDomainName()
+	resourceName := "aws_workspaces_connection_alias.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckPartitionHasService(t, strings.ToLower(workspaces.ServiceID))
+			testAccPreCheck(ctx, t)
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, strings.ToLower(workspaces.ServiceID)),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
+		CheckDestroy:             testAccCheckConnectionAliasDestroy(ctx),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccConnectionAliasConfig_tags1(rName, "key1", "value1"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckConnectionAliasExists(ctx, resourceName, &connectionalias),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				Config: testAccConnectionAliasConfig_tags2(rName, "key1", "value1updated", "key2", "value2"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckConnectionAliasExists(ctx, resourceName, &connectionalias),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "2"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key1", "value1updated"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
+				),
+			},
+			{
+				Config: testAccConnectionAliasConfig_tags1(rName, "key2", "value2"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckConnectionAliasExists(ctx, resourceName, &connectionalias),
+					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
+					resource.TestCheckResourceAttr(resourceName, "tags.key2", "value2"),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckConnectionAliasDestroy(ctx context.Context) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		conn := acctest.Provider.Meta().(*conns.AWSClient).WorkSpacesClient(ctx)
+
+		for _, rs := range s.RootModule().Resources {
+			if rs.Type != "aws_workspaces_connection_alias" {
+				continue
+			}
+
+			_, err := tfworkspaces.FindConnectionAliasByID(ctx, conn, rs.Primary.ID)
+
+			if tfresource.NotFound(err) {
+				return nil
+			}
+
+			if err != nil {
+				return err
+			}
+
+			return create.Error(names.WorkSpaces, create.ErrActionCheckingDestroyed, tfworkspaces.ResNameConnectionAlias, rs.Primary.ID, errors.New("not destroyed"))
+		}
+
+		return nil
+	}
+}
+
+func testAccCheckConnectionAliasExists(ctx context.Context, name string, connectionalias *awstypes.ConnectionAlias) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[name]
+		if !ok {
+			return create.Error(names.WorkSpaces, create.ErrActionCheckingExistence, tfworkspaces.ResNameConnectionAlias, name, errors.New("not found"))
+		}
+
+		if rs.Primary.ID == "" {
+			return create.Error(names.WorkSpaces, create.ErrActionCheckingExistence, tfworkspaces.ResNameConnectionAlias, name, errors.New("not set"))
+		}
+
+		conn := acctest.Provider.Meta().(*conns.AWSClient).WorkSpacesClient(ctx)
+		out, err := tfworkspaces.FindConnectionAliasByID(ctx, conn, rs.Primary.ID)
+
+		if err != nil {
+			return create.Error(names.WorkSpaces, create.ErrActionCheckingExistence, tfworkspaces.ResNameConnectionAlias, rs.Primary.ID, err)
+		}
+
+		*connectionalias = *out
+
+		return nil
+	}
+}
+
+func testAccPreCheck(ctx context.Context, t *testing.T) {
+	conn := acctest.Provider.Meta().(*conns.AWSClient).WorkSpacesClient(ctx)
+
+	input := &workspaces.DescribeConnectionAliasesInput{}
+	_, err := conn.DescribeConnectionAliases(ctx, input)
+
+	if acctest.PreCheckSkipError(err) {
+		t.Skipf("skipping acceptance testing: %s", err)
+	}
+	if err != nil {
+		t.Fatalf("unexpected PreCheck error: %s", err)
+	}
+}
+
+func testAccConnectionAliasConfig_basic(rName string) string {
+	return fmt.Sprintf(`
+resource "aws_workspaces_connection_alias" "test" {
+  connection_string = %[1]q
+}
+`, rName)
+}
+
+func testAccConnectionAliasConfig_tags1(rName, tagKey1, tagValue1 string) string {
+	return fmt.Sprintf(`
+resource "aws_workspaces_connection_alias" "test" {
+  connection_string = %[1]q
+
+  tags = {
+    %[2]q = %[3]q
+  }
+}
+`, rName, tagKey1, tagValue1)
+}
+
+func testAccConnectionAliasConfig_tags2(rName, tagKey1, tagValue1, tagKey2, tagValue2 string) string {
+	return fmt.Sprintf(`
+resource "aws_workspaces_connection_alias" "test" {
+  connection_string = %[1]q
+
+  tags = {
+    %[2]q = %[3]q
+    %[4]q = %[5]q
+  }
+}
+`, rName, tagKey1, tagValue1, tagKey2, tagValue2)
+}
diff --git a/internal/service/workspaces/directory.go b/internal/service/workspaces/directory.go
index 933d19f379b..5a9c8f164b3 100644
--- a/internal/service/workspaces/directory.go
+++ b/internal/service/workspaces/directory.go
@@ -1,16 +1,20 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package workspaces
 
 import (
 	"context"
 	"log"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/workspaces"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/workspaces"
+	"github.com/aws/aws-sdk-go-v2/service/workspaces/types"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/errs"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
 	"github.com/hashicorp/terraform-provider-aws/internal/flex"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
@@ -127,42 +131,42 @@ func ResourceDirectory() *schema.Resource {
 						"device_type_android": {
 							Type:         schema.TypeString,
 							Optional:     true,
-							ValidateFunc: validation.StringInSlice(workspaces.AccessPropertyValue_Values(), false),
+							ValidateFunc: validation.StringInSlice(flattenAccessPropertyEnumValues(types.AccessPropertyValue("").Values()), false),
 						},
 						"device_type_chromeos": {
 							Type:         schema.TypeString,
 							Optional:     true,
-							ValidateFunc: validation.StringInSlice(workspaces.AccessPropertyValue_Values(), false),
+							ValidateFunc: validation.StringInSlice(flattenAccessPropertyEnumValues(types.AccessPropertyValue("").Values()), false),
 						},
 						"device_type_ios": {
 							Type:         schema.TypeString,
 							Optional:     true,
-							ValidateFunc: validation.StringInSlice(workspaces.AccessPropertyValue_Values(), false),
+							ValidateFunc: validation.StringInSlice(flattenAccessPropertyEnumValues(types.AccessPropertyValue("").Values()), false),
 						},
 						"device_type_linux": {
 							Type:         schema.TypeString,
 							Optional:     true,
-							ValidateFunc: validation.StringInSlice(workspaces.AccessPropertyValue_Values(), false),
+							ValidateFunc: validation.StringInSlice(flattenAccessPropertyEnumValues(types.AccessPropertyValue("").Values()), false),
 						},
 						"device_type_osx": {
 							Type:         schema.TypeString,
 							Optional:     true,
-							ValidateFunc: validation.StringInSlice(workspaces.AccessPropertyValue_Values(), false),
+							ValidateFunc: validation.StringInSlice(flattenAccessPropertyEnumValues(types.AccessPropertyValue("").Values()), false),
 						},
 						"device_type_web": {
 							Type:         schema.TypeString,
 							Optional:     true,
-							ValidateFunc: validation.StringInSlice(workspaces.AccessPropertyValue_Values(), false),
+							ValidateFunc: validation.StringInSlice(flattenAccessPropertyEnumValues(types.AccessPropertyValue("").Values()), false),
 						},
 						"device_type_windows": {
 							Type:         schema.TypeString,
 							Optional:     true,
-							ValidateFunc: validation.StringInSlice(workspaces.AccessPropertyValue_Values(), false),
+							ValidateFunc: validation.StringInSlice(flattenAccessPropertyEnumValues(types.AccessPropertyValue("").Values()), false),
 						},
 						"device_type_zeroclient": {
 							Type:         schema.TypeString,
 							Optional:     true,
-							ValidateFunc: validation.StringInSlice(workspaces.AccessPropertyValue_Values(), false),
+							ValidateFunc: validation.StringInSlice(flattenAccessPropertyEnumValues(types.AccessPropertyValue("").Values()), false),
 						},
 					},
 				},
@@ -212,29 +216,25 @@ func ResourceDirectory() *schema.Resource {
 
 func resourceDirectoryCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).WorkSpacesConn(ctx)
+	conn := meta.(*conns.AWSClient).WorkSpacesClient(ctx)
 
 	directoryID := d.Get("directory_id").(string)
 	input := &workspaces.RegisterWorkspaceDirectoryInput{
 		DirectoryId:       aws.String(directoryID),
 		EnableSelfService: aws.Bool(false), // this is handled separately below
 		EnableWorkDocs:    aws.Bool(false),
-		Tenancy:           aws.String(workspaces.TenancyShared),
+		Tenancy:           types.TenancyShared,
 		Tags:              getTagsIn(ctx),
 	}
 
 	if v, ok := d.GetOk("subnet_ids"); ok {
-		input.SubnetIds = flex.ExpandStringSet(v.(*schema.Set))
+		input.SubnetIds = flex.ExpandStringValueSet(v.(*schema.Set))
 	}
 
-	log.Printf("[DEBUG] Registering WorkSpaces Directory: %s", input)
-	_, err := tfresource.RetryWhenAWSErrCodeEquals(ctx, DirectoryRegisterInvalidResourceStateTimeout,
+	_, err := tfresource.RetryWhenIsA[*types.InvalidResourceStateException](ctx, DirectoryRegisterInvalidResourceStateTimeout,
 		func() (interface{}, error) {
-			return conn.RegisterWorkspaceDirectoryWithContext(ctx, input)
-		},
-		// "error registering WorkSpaces Directory (d-000000000000): InvalidResourceStateException: The specified directory is not in a valid state. Confirm that the directory has a status of Active, and try again."
-		workspaces.ErrCodeInvalidResourceStateException,
-	)
+			return conn.RegisterWorkspaceDirectory(ctx, input)
+		})
 
 	if err != nil {
 		return sdkdiag.AppendErrorf(diags, "registering WorkSpaces Directory (%s): %s", directoryID, err)
@@ -250,7 +250,7 @@ func resourceDirectoryCreate(ctx context.Context, d *schema.ResourceData, meta i
 
 	if v, ok := d.GetOk("self_service_permissions"); ok {
 		log.Printf("[DEBUG] Modifying WorkSpaces Directory (%s) self-service permissions", directoryID)
-		_, err := conn.ModifySelfservicePermissionsWithContext(ctx, &workspaces.ModifySelfservicePermissionsInput{
+		_, err := conn.ModifySelfservicePermissions(ctx, &workspaces.ModifySelfservicePermissionsInput{
 			ResourceId:             aws.String(directoryID),
 			SelfservicePermissions: ExpandSelfServicePermissions(v.([]interface{})),
 		})
@@ -262,7 +262,7 @@ func resourceDirectoryCreate(ctx context.Context, d *schema.ResourceData, meta i
 
 	if v, ok := d.GetOk("workspace_access_properties"); ok {
 		log.Printf("[DEBUG] Modifying WorkSpaces Directory (%s) access properties", directoryID)
-		_, err := conn.ModifyWorkspaceAccessPropertiesWithContext(ctx, &workspaces.ModifyWorkspaceAccessPropertiesInput{
+		_, err := conn.ModifyWorkspaceAccessProperties(ctx, &workspaces.ModifyWorkspaceAccessPropertiesInput{
 			ResourceId:                aws.String(directoryID),
 			WorkspaceAccessProperties: ExpandWorkspaceAccessProperties(v.([]interface{})),
 		})
@@ -274,7 +274,7 @@ func resourceDirectoryCreate(ctx context.Context, d *schema.ResourceData, meta i
 
 	if v, ok := d.GetOk("workspace_creation_properties"); ok {
 		log.Printf("[DEBUG] Modifying WorkSpaces Directory (%s) creation properties", directoryID)
-		_, err := conn.ModifyWorkspaceCreationPropertiesWithContext(ctx, &workspaces.ModifyWorkspaceCreationPropertiesInput{
+		_, err := conn.ModifyWorkspaceCreationProperties(ctx, &workspaces.ModifyWorkspaceCreationPropertiesInput{
 			ResourceId:                  aws.String(directoryID),
 			WorkspaceCreationProperties: ExpandWorkspaceCreationProperties(v.([]interface{})),
 		})
@@ -287,9 +287,9 @@ func resourceDirectoryCreate(ctx context.Context, d *schema.ResourceData, meta i
 	if v, ok := d.GetOk("ip_group_ids"); ok && v.(*schema.Set).Len() > 0 {
 		ipGroupIds := v.(*schema.Set)
 		log.Printf("[DEBUG] Associating WorkSpaces Directory (%s) with IP Groups %s", directoryID, ipGroupIds.List())
-		_, err := conn.AssociateIpGroupsWithContext(ctx, &workspaces.AssociateIpGroupsInput{
+		_, err := conn.AssociateIpGroups(ctx, &workspaces.AssociateIpGroupsInput{
 			DirectoryId: aws.String(directoryID),
-			GroupIds:    flex.ExpandStringSet(ipGroupIds),
+			GroupIds:    flex.ExpandStringValueSet(ipGroupIds),
 		})
 		if err != nil {
 			return sdkdiag.AppendErrorf(diags, "asassociating WorkSpaces Directory (%s) ip groups: %s", directoryID, err)
@@ -302,7 +302,7 @@ func resourceDirectoryCreate(ctx context.Context, d *schema.ResourceData, meta i
 
 func resourceDirectoryRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).WorkSpacesConn(ctx)
+	conn := meta.(*conns.AWSClient).WorkSpacesClient(ctx)
 
 	directory, err := FindDirectoryByID(ctx, conn, d.Id())
 
@@ -317,7 +317,7 @@ func resourceDirectoryRead(ctx context.Context, d *schema.ResourceData, meta int
 	}
 
 	d.Set("directory_id", directory.DirectoryId)
-	if err := d.Set("subnet_ids", flex.FlattenStringSet(directory.SubnetIds)); err != nil {
+	if err := d.Set("subnet_ids", flex.FlattenStringValueSet(directory.SubnetIds)); err != nil {
 		return sdkdiag.AppendErrorf(diags, "setting subnet_ids: %s", err)
 	}
 	d.Set("workspace_security_group_id", directory.WorkspaceSecurityGroupId)
@@ -339,11 +339,11 @@ func resourceDirectoryRead(ctx context.Context, d *schema.ResourceData, meta int
 		return sdkdiag.AppendErrorf(diags, "setting workspace_creation_properties: %s", err)
 	}
 
-	if err := d.Set("ip_group_ids", flex.FlattenStringSet(directory.IpGroupIds)); err != nil {
+	if err := d.Set("ip_group_ids", flex.FlattenStringValueSet(directory.IpGroupIds)); err != nil {
 		return sdkdiag.AppendErrorf(diags, "setting ip_group_ids: %s", err)
 	}
 
-	if err := d.Set("dns_ip_addresses", flex.FlattenStringSet(directory.DnsIpAddresses)); err != nil {
+	if err := d.Set("dns_ip_addresses", flex.FlattenStringValueSet(directory.DnsIpAddresses)); err != nil {
 		return sdkdiag.AppendErrorf(diags, "setting dns_ip_addresses: %s", err)
 	}
 
@@ -352,13 +352,13 @@ func resourceDirectoryRead(ctx context.Context, d *schema.ResourceData, meta int
 
 func resourceDirectoryUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).WorkSpacesConn(ctx)
+	conn := meta.(*conns.AWSClient).WorkSpacesClient(ctx)
 
 	if d.HasChange("self_service_permissions") {
 		log.Printf("[DEBUG] Modifying WorkSpaces Directory (%s) self-service permissions", d.Id())
 		permissions := d.Get("self_service_permissions").([]interface{})
 
-		_, err := conn.ModifySelfservicePermissionsWithContext(ctx, &workspaces.ModifySelfservicePermissionsInput{
+		_, err := conn.ModifySelfservicePermissions(ctx, &workspaces.ModifySelfservicePermissionsInput{
 			ResourceId:             aws.String(d.Id()),
 			SelfservicePermissions: ExpandSelfServicePermissions(permissions),
 		})
@@ -372,7 +372,7 @@ func resourceDirectoryUpdate(ctx context.Context, d *schema.ResourceData, meta i
 		log.Printf("[DEBUG] Modifying WorkSpaces Directory (%s) access properties", d.Id())
 		properties := d.Get("workspace_access_properties").([]interface{})
 
-		_, err := conn.ModifyWorkspaceAccessPropertiesWithContext(ctx, &workspaces.ModifyWorkspaceAccessPropertiesInput{
+		_, err := conn.ModifyWorkspaceAccessProperties(ctx, &workspaces.ModifyWorkspaceAccessPropertiesInput{
 			ResourceId:                aws.String(d.Id()),
 			WorkspaceAccessProperties: ExpandWorkspaceAccessProperties(properties),
 		})
@@ -386,7 +386,7 @@ func resourceDirectoryUpdate(ctx context.Context, d *schema.ResourceData, meta i
 		log.Printf("[DEBUG] Modifying WorkSpaces Directory (%s) creation properties", d.Id())
 		properties := d.Get("workspace_creation_properties").([]interface{})
 
-		_, err := conn.ModifyWorkspaceCreationPropertiesWithContext(ctx, &workspaces.ModifyWorkspaceCreationPropertiesInput{
+		_, err := conn.ModifyWorkspaceCreationProperties(ctx, &workspaces.ModifyWorkspaceCreationPropertiesInput{
 			ResourceId:                  aws.String(d.Id()),
 			WorkspaceCreationProperties: ExpandWorkspaceCreationProperties(properties),
 		})
@@ -404,18 +404,18 @@ func resourceDirectoryUpdate(ctx context.Context, d *schema.ResourceData, meta i
 		removed := old.Difference(new)
 
 		log.Printf("[DEBUG] Associating WorkSpaces Directory (%s) with IP Groups %s", d.Id(), added.GoString())
-		_, err := conn.AssociateIpGroupsWithContext(ctx, &workspaces.AssociateIpGroupsInput{
+		_, err := conn.AssociateIpGroups(ctx, &workspaces.AssociateIpGroupsInput{
 			DirectoryId: aws.String(d.Id()),
-			GroupIds:    flex.ExpandStringSet(added),
+			GroupIds:    flex.ExpandStringValueSet(added),
 		})
 		if err != nil {
 			return sdkdiag.AppendErrorf(diags, "asassociating WorkSpaces Directory (%s) IP Groups: %s", d.Id(), err)
 		}
 
 		log.Printf("[DEBUG] Disassociating WorkSpaces Directory (%s) with IP Groups %s", d.Id(), removed.GoString())
-		_, err = conn.DisassociateIpGroupsWithContext(ctx, &workspaces.DisassociateIpGroupsInput{
+		_, err = conn.DisassociateIpGroups(ctx, &workspaces.DisassociateIpGroupsInput{
 			DirectoryId: aws.String(d.Id()),
-			GroupIds:    flex.ExpandStringSet(removed),
+			GroupIds:    flex.ExpandStringValueSet(removed),
 		})
 		if err != nil {
 			return sdkdiag.AppendErrorf(diags, "disasassociating WorkSpaces Directory (%s) IP Groups: %s", d.Id(), err)
@@ -429,20 +429,17 @@ func resourceDirectoryUpdate(ctx context.Context, d *schema.ResourceData, meta i
 
 func resourceDirectoryDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).WorkSpacesConn(ctx)
+	conn := meta.(*conns.AWSClient).WorkSpacesClient(ctx)
 
 	log.Printf("[DEBUG] Deregistering WorkSpaces Directory: %s", d.Id())
-	_, err := tfresource.RetryWhenAWSErrCodeEquals(ctx, DirectoryDeregisterInvalidResourceStateTimeout,
+	_, err := tfresource.RetryWhenIsA[*types.InvalidResourceStateException](ctx, DirectoryRegisterInvalidResourceStateTimeout,
 		func() (interface{}, error) {
-			return conn.DeregisterWorkspaceDirectoryWithContext(ctx, &workspaces.DeregisterWorkspaceDirectoryInput{
+			return conn.DeregisterWorkspaceDirectory(ctx, &workspaces.DeregisterWorkspaceDirectoryInput{
 				DirectoryId: aws.String(d.Id()),
 			})
-		},
-		// "error deregistering WorkSpaces Directory (d-000000000000): InvalidResourceStateException: The specified directory is not in a valid state. Confirm that the directory has a status of Active, and try again."
-		workspaces.ErrCodeInvalidResourceStateException,
-	)
+		})
 
-	if tfawserr.ErrCodeEquals(err, workspaces.ErrCodeResourceNotFoundException) {
+	if errs.IsA[*types.ResourceNotFoundException](err) {
 		return diags
 	}
 
@@ -459,100 +456,100 @@ func resourceDirectoryDelete(ctx context.Context, d *schema.ResourceData, meta i
 	return diags
 }
 
-func ExpandWorkspaceAccessProperties(properties []interface{}) *workspaces.WorkspaceAccessProperties {
+func ExpandWorkspaceAccessProperties(properties []interface{}) *types.WorkspaceAccessProperties {
 	if len(properties) == 0 || properties[0] == nil {
 		return nil
 	}
 
-	result := &workspaces.WorkspaceAccessProperties{}
+	result := &types.WorkspaceAccessProperties{}
 
 	p := properties[0].(map[string]interface{})
 
 	if p["device_type_android"].(string) != "" {
-		result.DeviceTypeAndroid = aws.String(p["device_type_android"].(string))
+		result.DeviceTypeAndroid = types.AccessPropertyValue(p["device_type_android"].(string))
 	}
 
 	if p["device_type_chromeos"].(string) != "" {
-		result.DeviceTypeChromeOs = aws.String(p["device_type_chromeos"].(string))
+		result.DeviceTypeChromeOs = types.AccessPropertyValue(p["device_type_chromeos"].(string))
 	}
 
 	if p["device_type_ios"].(string) != "" {
-		result.DeviceTypeIos = aws.String(p["device_type_ios"].(string))
+		result.DeviceTypeIos = types.AccessPropertyValue(p["device_type_ios"].(string))
 	}
 
 	if p["device_type_linux"].(string) != "" {
-		result.DeviceTypeLinux = aws.String(p["device_type_linux"].(string))
+		result.DeviceTypeLinux = types.AccessPropertyValue(p["device_type_linux"].(string))
 	}
 
 	if p["device_type_osx"].(string) != "" {
-		result.DeviceTypeOsx = aws.String(p["device_type_osx"].(string))
+		result.DeviceTypeOsx = types.AccessPropertyValue(p["device_type_osx"].(string))
 	}
 
 	if p["device_type_web"].(string) != "" {
-		result.DeviceTypeWeb = aws.String(p["device_type_web"].(string))
+		result.DeviceTypeWeb = types.AccessPropertyValue(p["device_type_web"].(string))
 	}
 
 	if p["device_type_windows"].(string) != "" {
-		result.DeviceTypeWindows = aws.String(p["device_type_windows"].(string))
+		result.DeviceTypeWindows = types.AccessPropertyValue(p["device_type_windows"].(string))
 	}
 
 	if p["device_type_zeroclient"].(string) != "" {
-		result.DeviceTypeZeroClient = aws.String(p["device_type_zeroclient"].(string))
+		result.DeviceTypeZeroClient = types.AccessPropertyValue(p["device_type_zeroclient"].(string))
 	}
 
 	return result
 }
 
-func ExpandSelfServicePermissions(permissions []interface{}) *workspaces.SelfservicePermissions {
+func ExpandSelfServicePermissions(permissions []interface{}) *types.SelfservicePermissions {
 	if len(permissions) == 0 || permissions[0] == nil {
 		return nil
 	}
 
-	result := &workspaces.SelfservicePermissions{}
+	result := &types.SelfservicePermissions{}
 
 	p := permissions[0].(map[string]interface{})
 
 	if p["change_compute_type"].(bool) {
-		result.ChangeComputeType = aws.String(workspaces.ReconnectEnumEnabled)
+		result.ChangeComputeType = types.ReconnectEnumEnabled
 	} else {
-		result.ChangeComputeType = aws.String(workspaces.ReconnectEnumDisabled)
+		result.ChangeComputeType = types.ReconnectEnumDisabled
 	}
 
 	if p["increase_volume_size"].(bool) {
-		result.IncreaseVolumeSize = aws.String(workspaces.ReconnectEnumEnabled)
+		result.IncreaseVolumeSize = types.ReconnectEnumEnabled
 	} else {
-		result.IncreaseVolumeSize = aws.String(workspaces.ReconnectEnumDisabled)
+		result.IncreaseVolumeSize = types.ReconnectEnumDisabled
 	}
 
 	if p["rebuild_workspace"].(bool) {
-		result.RebuildWorkspace = aws.String(workspaces.ReconnectEnumEnabled)
+		result.RebuildWorkspace = types.ReconnectEnumEnabled
 	} else {
-		result.RebuildWorkspace = aws.String(workspaces.ReconnectEnumDisabled)
+		result.RebuildWorkspace = types.ReconnectEnumDisabled
 	}
 
 	if p["restart_workspace"].(bool) {
-		result.RestartWorkspace = aws.String(workspaces.ReconnectEnumEnabled)
+		result.RestartWorkspace = types.ReconnectEnumEnabled
 	} else {
-		result.RestartWorkspace = aws.String(workspaces.ReconnectEnumDisabled)
+		result.RestartWorkspace = types.ReconnectEnumDisabled
 	}
 
 	if p["switch_running_mode"].(bool) {
-		result.SwitchRunningMode = aws.String(workspaces.ReconnectEnumEnabled)
+		result.SwitchRunningMode = types.ReconnectEnumEnabled
 	} else {
-		result.SwitchRunningMode = aws.String(workspaces.ReconnectEnumDisabled)
+		result.SwitchRunningMode = types.ReconnectEnumDisabled
 	}
 
 	return result
 }
 
-func ExpandWorkspaceCreationProperties(properties []interface{}) *workspaces.WorkspaceCreationProperties {
+func ExpandWorkspaceCreationProperties(properties []interface{}) *types.WorkspaceCreationProperties {
 	if len(properties) == 0 || properties[0] == nil {
 		return nil
 	}
 
 	p := properties[0].(map[string]interface{})
 
-	result := &workspaces.WorkspaceCreationProperties{
+	result := &types.WorkspaceCreationProperties{
 		EnableInternetAccess:            aws.Bool(p["enable_internet_access"].(bool)),
 		EnableMaintenanceMode:           aws.Bool(p["enable_maintenance_mode"].(bool)),
 		UserEnabledAsLocalAdministrator: aws.Bool(p["user_enabled_as_local_administrator"].(bool)),
@@ -569,72 +566,72 @@ func ExpandWorkspaceCreationProperties(properties []interface{}) *workspaces.Wor
 	return result
 }
 
-func FlattenWorkspaceAccessProperties(properties *workspaces.WorkspaceAccessProperties) []interface{} {
+func FlattenWorkspaceAccessProperties(properties *types.WorkspaceAccessProperties) []interface{} {
 	if properties == nil {
 		return []interface{}{}
 	}
 
 	return []interface{}{
 		map[string]interface{}{
-			"device_type_android":    aws.StringValue(properties.DeviceTypeAndroid),
-			"device_type_chromeos":   aws.StringValue(properties.DeviceTypeChromeOs),
-			"device_type_ios":        aws.StringValue(properties.DeviceTypeIos),
-			"device_type_linux":      aws.StringValue(properties.DeviceTypeLinux),
-			"device_type_osx":        aws.StringValue(properties.DeviceTypeOsx),
-			"device_type_web":        aws.StringValue(properties.DeviceTypeWeb),
-			"device_type_windows":    aws.StringValue(properties.DeviceTypeWindows),
-			"device_type_zeroclient": aws.StringValue(properties.DeviceTypeZeroClient),
+			"device_type_android":    string(properties.DeviceTypeAndroid),
+			"device_type_chromeos":   string(properties.DeviceTypeChromeOs),
+			"device_type_ios":        string(properties.DeviceTypeIos),
+			"device_type_linux":      string(properties.DeviceTypeLinux),
+			"device_type_osx":        string(properties.DeviceTypeOsx),
+			"device_type_web":        string(properties.DeviceTypeWeb),
+			"device_type_windows":    string(properties.DeviceTypeWindows),
+			"device_type_zeroclient": string(properties.DeviceTypeZeroClient),
 		},
 	}
 }
 
-func FlattenSelfServicePermissions(permissions *workspaces.SelfservicePermissions) []interface{} {
+func FlattenSelfServicePermissions(permissions *types.SelfservicePermissions) []interface{} {
 	if permissions == nil {
 		return []interface{}{}
 	}
 
 	result := map[string]interface{}{}
 
-	switch *permissions.ChangeComputeType {
-	case workspaces.ReconnectEnumEnabled:
+	switch permissions.ChangeComputeType {
+	case types.ReconnectEnumEnabled:
 		result["change_compute_type"] = true
-	case workspaces.ReconnectEnumDisabled:
+	case types.ReconnectEnumDisabled:
 		result["change_compute_type"] = false
 	default:
 		result["change_compute_type"] = nil
 	}
 
-	switch *permissions.IncreaseVolumeSize {
-	case workspaces.ReconnectEnumEnabled:
+	switch permissions.IncreaseVolumeSize {
+	case types.ReconnectEnumEnabled:
 		result["increase_volume_size"] = true
-	case workspaces.ReconnectEnumDisabled:
+	case types.ReconnectEnumDisabled:
 		result["increase_volume_size"] = false
 	default:
 		result["increase_volume_size"] = nil
 	}
 
-	switch *permissions.RebuildWorkspace {
-	case workspaces.ReconnectEnumEnabled:
+	switch permissions.RebuildWorkspace {
+	case types.ReconnectEnumEnabled:
 		result["rebuild_workspace"] = true
-	case workspaces.ReconnectEnumDisabled:
+	case types.ReconnectEnumDisabled:
 		result["rebuild_workspace"] = false
 	default:
 		result["rebuild_workspace"] = nil
 	}
 
-	switch *permissions.RestartWorkspace {
-	case workspaces.ReconnectEnumEnabled:
+	switch permissions.RestartWorkspace {
+	case types.ReconnectEnumEnabled:
 		result["restart_workspace"] = true
-	case workspaces.ReconnectEnumDisabled:
+	case types.ReconnectEnumDisabled:
 		result["restart_workspace"] = false
 	default:
 		result["restart_workspace"] = nil
 	}
 
-	switch *permissions.SwitchRunningMode {
-	case workspaces.ReconnectEnumEnabled:
+	switch permissions.SwitchRunningMode {
+	case types.ReconnectEnumEnabled:
 		result["switch_running_mode"] = true
-	case workspaces.ReconnectEnumDisabled:
+	case types.ReconnectEnumDisabled:
 		result["switch_running_mode"] = false
 	default:
 		result["switch_running_mode"] = nil
@@ -643,18 +640,28 @@ func FlattenSelfServicePermissions(permissions *workspaces.SelfservicePermission
 	return []interface{}{result}
 }
 
-func FlattenWorkspaceCreationProperties(properties *workspaces.DefaultWorkspaceCreationProperties) []interface{} {
+func FlattenWorkspaceCreationProperties(properties *types.DefaultWorkspaceCreationProperties) []interface{} {
 	if properties == nil {
 		return []interface{}{}
 	}
 
 	return []interface{}{
 		map[string]interface{}{
-			"custom_security_group_id":            aws.StringValue(properties.CustomSecurityGroupId),
-			"default_ou":                          aws.StringValue(properties.DefaultOu),
-			"enable_internet_access":              aws.BoolValue(properties.EnableInternetAccess),
-			"enable_maintenance_mode":             aws.BoolValue(properties.EnableMaintenanceMode),
-			"user_enabled_as_local_administrator": aws.BoolValue(properties.UserEnabledAsLocalAdministrator),
+			"custom_security_group_id":            aws.ToString(properties.CustomSecurityGroupId),
+			"default_ou":                          aws.ToString(properties.DefaultOu),
+			"enable_internet_access":              aws.ToBool(properties.EnableInternetAccess),
+			"enable_maintenance_mode":             aws.ToBool(properties.EnableMaintenanceMode),
+			"user_enabled_as_local_administrator": aws.ToBool(properties.UserEnabledAsLocalAdministrator),
 		},
 	}
 }
+
+func flattenAccessPropertyEnumValues(t []types.AccessPropertyValue) []string {
+	var out []string
+
+	for _, v := range t {
+		out = append(out, string(v))
+	}
+
+	return out
+}
diff --git a/internal/service/workspaces/directory_data_source.go b/internal/service/workspaces/directory_data_source.go
index 1b11ccf669d..e25a65221ad 100644
--- a/internal/service/workspaces/directory_data_source.go
+++ b/internal/service/workspaces/directory_data_source.go
@@ -1,9 +1,12 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package workspaces
 
 import (
 	"context"
 
-	"github.com/aws/aws-sdk-go/service/workspaces"
+	"github.com/aws/aws-sdk-go-v2/service/workspaces/types"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
@@ -168,7 +171,7 @@ func DataSourceDirectory() *schema.Resource {
 
 func dataSourceDirectoryRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).WorkSpacesConn(ctx)
+	conn := meta.(*conns.AWSClient).WorkSpacesClient(ctx)
 	ignoreTagsConfig := meta.(*conns.AWSClient).IgnoreTagsConfig
 
 	directoryID := d.Get("directory_id").(string)
@@ -177,13 +180,13 @@ func dataSourceDirectoryRead(ctx context.Context, d *schema.ResourceData, meta i
 	if err != nil {
 		return sdkdiag.AppendErrorf(diags, "getting WorkSpaces Directory (%s): %s", directoryID, err)
 	}
-	if state == workspaces.WorkspaceDirectoryStateDeregistered {
+	if state == string(types.WorkspaceDirectoryStateDeregistered) {
 		return sdkdiag.AppendErrorf(diags, "WorkSpaces directory %s was not found", directoryID)
 	}
 
 	d.SetId(directoryID)
 
-	directory := rawOutput.(*workspaces.WorkspaceDirectory)
+	directory := rawOutput.(*types.WorkspaceDirectory)
 	d.Set("directory_id", directory.DirectoryId)
 	d.Set("workspace_security_group_id", directory.WorkspaceSecurityGroupId)
 	d.Set("iam_role_id", directory.IamRoleId)
@@ -192,7 +195,7 @@ func dataSourceDirectoryRead(ctx context.Context, d *schema.ResourceData, meta i
 	d.Set("directory_type", directory.DirectoryType)
 	d.Set("alias", directory.Alias)
 
-	if err := d.Set("subnet_ids", flex.FlattenStringSet(directory.SubnetIds)); err != nil {
+	if err := d.Set("subnet_ids", flex.FlattenStringValueSet(directory.SubnetIds)); err != nil {
 		return sdkdiag.AppendErrorf(diags, "setting subnet_ids: %s", err)
 	}
 
@@ -208,11 +211,11 @@ func dataSourceDirectoryRead(ctx context.Context, d *schema.ResourceData, meta i
 		return sdkdiag.AppendErrorf(diags, "setting workspace_creation_properties: %s", err)
 	}
 
-	if err := d.Set("ip_group_ids", flex.FlattenStringSet(directory.IpGroupIds)); err != nil {
+	if err := d.Set("ip_group_ids", flex.FlattenStringValueSet(directory.IpGroupIds)); err != nil {
 		return sdkdiag.AppendErrorf(diags, "setting ip_group_ids: %s", err)
 	}
 
-	if err := d.Set("dns_ip_addresses", flex.FlattenStringSet(directory.DnsIpAddresses)); err != nil {
+	if err := d.Set("dns_ip_addresses", flex.FlattenStringValueSet(directory.DnsIpAddresses)); err != nil {
 		return sdkdiag.AppendErrorf(diags, "setting dns_ip_addresses: %s", err)
 	}
 
diff --git a/internal/service/workspaces/directory_data_source_test.go b/internal/service/workspaces/directory_data_source_test.go
index d12f7d6d19d..411eb23a665 100644
--- a/internal/service/workspaces/directory_data_source_test.go
+++ b/internal/service/workspaces/directory_data_source_test.go
@@ -1,10 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package workspaces_test
 
 import (
 	"fmt"
+	"strings"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/service/workspaces"
+	"github.com/aws/aws-sdk-go-v2/service/workspaces"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
@@ -25,7 +29,7 @@ func testAccDirectoryDataSource_basic(t *testing.T) {
 			acctest.PreCheckDirectoryServiceSimpleDirectory(ctx, t)
 			acctest.PreCheckHasIAMRole(ctx, t, "workspaces_DefaultRole")
 		},
-		ErrorCheck:               acctest.ErrorCheck(t, workspaces.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, strings.ToLower(workspaces.ServiceID)),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		Steps: []resource.TestStep{
 			{
diff --git a/internal/service/workspaces/directory_test.go b/internal/service/workspaces/directory_test.go
index 8276c7ce521..f196394ba6e 100644
--- a/internal/service/workspaces/directory_test.go
+++ b/internal/service/workspaces/directory_test.go
@@ -1,13 +1,18 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package workspaces_test
 
 import (
 	"context"
 	"fmt"
 	"reflect"
+	"strings"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/workspaces"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/workspaces"
+	"github.com/aws/aws-sdk-go-v2/service/workspaces/types"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
@@ -19,7 +24,7 @@ import (
 
 func testAccDirectory_basic(t *testing.T) {
 	ctx := acctest.Context(t)
-	var v workspaces.WorkspaceDirectory
+	var v types.WorkspaceDirectory
 	rName := sdkacctest.RandString(8)
 
 	resourceName := "aws_workspaces_directory.main"
@@ -35,7 +40,7 @@ func testAccDirectory_basic(t *testing.T) {
 			acctest.PreCheckDirectoryServiceSimpleDirectory(ctx, t)
 			acctest.PreCheckHasIAMRole(ctx, t, "workspaces_DefaultRole")
 		},
-		ErrorCheck:               acctest.ErrorCheck(t, workspaces.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, strings.ToLower(workspaces.ServiceID)),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckDirectoryDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -46,7 +51,7 @@ func testAccDirectory_basic(t *testing.T) {
 					resource.TestCheckResourceAttrPair(resourceName, "alias", directoryResourceName, "alias"),
 					resource.TestCheckResourceAttrPair(resourceName, "directory_id", directoryResourceName, "id"),
 					resource.TestCheckResourceAttrPair(resourceName, "directory_name", directoryResourceName, "name"),
-					resource.TestCheckResourceAttr(resourceName, "directory_type", workspaces.WorkspaceDirectoryTypeSimpleAd),
+					resource.TestCheckResourceAttr(resourceName, "directory_type", string(types.WorkspaceDirectoryTypeSimpleAd)),
 					resource.TestCheckResourceAttr(resourceName, "dns_ip_addresses.#", "2"),
 					resource.TestCheckResourceAttrPair(resourceName, "iam_role_id", iamRoleDataSourceName, "arn"),
 					resource.TestCheckResourceAttr(resourceName, "ip_group_ids.#", "0"),
@@ -89,7 +94,7 @@ func testAccDirectory_basic(t *testing.T) {
 
 func testAccDirectory_disappears(t *testing.T) {
 	ctx := acctest.Context(t)
-	var v workspaces.WorkspaceDirectory
+	var v types.WorkspaceDirectory
 	rName := sdkacctest.RandString(8)
 
 	resourceName := "aws_workspaces_directory.main"
@@ -103,7 +108,7 @@ func testAccDirectory_disappears(t *testing.T) {
 			acctest.PreCheckDirectoryServiceSimpleDirectory(ctx, t)
 			acctest.PreCheckHasIAMRole(ctx, t, "workspaces_DefaultRole")
 		},
-		ErrorCheck:               acctest.ErrorCheck(t, workspaces.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, strings.ToLower(workspaces.ServiceID)),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckDirectoryDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -121,7 +126,7 @@ func testAccDirectory_disappears(t *testing.T) {
 
 func testAccDirectory_subnetIDs(t *testing.T) {
 	ctx := acctest.Context(t)
-	var v workspaces.WorkspaceDirectory
+	var v types.WorkspaceDirectory
 	rName := sdkacctest.RandString(8)
 
 	resourceName := "aws_workspaces_directory.main"
@@ -135,7 +140,7 @@ func testAccDirectory_subnetIDs(t *testing.T) {
 			acctest.PreCheckDirectoryServiceSimpleDirectory(ctx, t)
 			acctest.PreCheckHasIAMRole(ctx, t, "workspaces_DefaultRole")
 		},
-		ErrorCheck:               acctest.ErrorCheck(t, workspaces.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, strings.ToLower(workspaces.ServiceID)),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckDirectoryDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -157,7 +162,7 @@ func testAccDirectory_subnetIDs(t *testing.T) {
 
 func testAccDirectory_tags(t *testing.T) {
 	ctx := acctest.Context(t)
-	var v workspaces.WorkspaceDirectory
+	var v types.WorkspaceDirectory
 	rName := sdkacctest.RandString(8)
 
 	resourceName := "aws_workspaces_directory.main"
@@ -171,7 +176,7 @@ func testAccDirectory_tags(t *testing.T) {
 			acctest.PreCheckDirectoryServiceSimpleDirectory(ctx, t)
 			acctest.PreCheckHasIAMRole(ctx, t, "workspaces_DefaultRole")
 		},
-		ErrorCheck:               acctest.ErrorCheck(t, workspaces.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, strings.ToLower(workspaces.ServiceID)),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckDirectoryDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -211,7 +216,7 @@ func testAccDirectory_tags(t *testing.T) {
 
 func testAccDirectory_selfServicePermissions(t *testing.T) {
 	ctx := acctest.Context(t)
-	var v workspaces.WorkspaceDirectory
+	var v types.WorkspaceDirectory
 	rName := sdkacctest.RandString(8)
 
 	resourceName := "aws_workspaces_directory.main"
@@ -225,7 +230,7 @@ func testAccDirectory_selfServicePermissions(t *testing.T) {
 			acctest.PreCheckDirectoryServiceSimpleDirectory(ctx, t)
 			acctest.PreCheckHasIAMRole(ctx, t, "workspaces_DefaultRole")
 		},
-		ErrorCheck:               acctest.ErrorCheck(t, workspaces.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, strings.ToLower(workspaces.ServiceID)),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckDirectoryDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -247,7 +252,7 @@ func testAccDirectory_selfServicePermissions(t *testing.T) {
 
 func testAccDirectory_workspaceAccessProperties(t *testing.T) {
 	ctx := acctest.Context(t)
-	var v workspaces.WorkspaceDirectory
+	var v types.WorkspaceDirectory
 	rName := sdkacctest.RandString(8)
 
 	resourceName := "aws_workspaces_directory.main"
@@ -261,7 +266,7 @@ func testAccDirectory_workspaceAccessProperties(t *testing.T) {
 			acctest.PreCheckDirectoryServiceSimpleDirectory(ctx, t)
 			acctest.PreCheckHasIAMRole(ctx, t, "workspaces_DefaultRole")
 		},
-		ErrorCheck:               acctest.ErrorCheck(t, workspaces.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, strings.ToLower(workspaces.ServiceID)),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckDirectoryDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -286,7 +291,7 @@ func testAccDirectory_workspaceAccessProperties(t *testing.T) {
 
 func testAccDirectory_workspaceCreationProperties(t *testing.T) {
 	ctx := acctest.Context(t)
-	var v workspaces.WorkspaceDirectory
+	var v types.WorkspaceDirectory
 	rName := sdkacctest.RandString(8)
 
 	resourceName := "aws_workspaces_directory.main"
@@ -301,7 +306,7 @@ func testAccDirectory_workspaceCreationProperties(t *testing.T) {
 			acctest.PreCheckDirectoryServiceSimpleDirectory(ctx, t)
 			acctest.PreCheckHasIAMRole(ctx, t, "workspaces_DefaultRole")
 		},
-		ErrorCheck:               acctest.ErrorCheck(t, workspaces.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, strings.ToLower(workspaces.ServiceID)),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckDirectoryDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -323,7 +328,7 @@ func testAccDirectory_workspaceCreationProperties(t *testing.T) {
 
 func testAccDirectory_workspaceCreationProperties_customSecurityGroupId_defaultOu(t *testing.T) {
 	ctx := acctest.Context(t)
-	var v workspaces.WorkspaceDirectory
+	var v types.WorkspaceDirectory
 	rName := sdkacctest.RandString(8)
 
 	resourceName := "aws_workspaces_directory.main"
@@ -338,7 +343,7 @@ func testAccDirectory_workspaceCreationProperties_customSecurityGroupId_defaultO
 			acctest.PreCheckDirectoryServiceSimpleDirectory(ctx, t)
 			acctest.PreCheckHasIAMRole(ctx, t, "workspaces_DefaultRole")
 		},
-		ErrorCheck:               acctest.ErrorCheck(t, workspaces.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, strings.ToLower(workspaces.ServiceID)),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckDirectoryDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -376,7 +381,7 @@ func testAccDirectory_workspaceCreationProperties_customSecurityGroupId_defaultO
 
 func testAccDirectory_ipGroupIDs(t *testing.T) {
 	ctx := acctest.Context(t)
-	var v workspaces.WorkspaceDirectory
+	var v types.WorkspaceDirectory
 	rName := sdkacctest.RandString(8)
 
 	resourceName := "aws_workspaces_directory.test"
@@ -385,7 +390,7 @@ func testAccDirectory_ipGroupIDs(t *testing.T) {
 
 	resource.Test(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckHasIAMRole(ctx, t, "workspaces_DefaultRole") },
-		ErrorCheck:               acctest.ErrorCheck(t, workspaces.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, strings.ToLower(workspaces.ServiceID)),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckDirectoryDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -425,7 +430,7 @@ func TestExpandSelfServicePermissions(t *testing.T) {
 
 	cases := []struct {
 		input    []interface{}
-		expected *workspaces.SelfservicePermissions
+		expected *types.SelfservicePermissions
 	}{
 		// Empty
 		{
@@ -443,12 +448,12 @@ func TestExpandSelfServicePermissions(t *testing.T) {
 					"switch_running_mode":  true,
 				},
 			},
-			expected: &workspaces.SelfservicePermissions{
-				ChangeComputeType:  aws.String(workspaces.ReconnectEnumDisabled),
-				IncreaseVolumeSize: aws.String(workspaces.ReconnectEnumDisabled),
-				RebuildWorkspace:   aws.String(workspaces.ReconnectEnumEnabled),
-				RestartWorkspace:   aws.String(workspaces.ReconnectEnumEnabled),
-				SwitchRunningMode:  aws.String(workspaces.ReconnectEnumEnabled),
+			expected: &types.SelfservicePermissions{
+				ChangeComputeType:  types.ReconnectEnumDisabled,
+				IncreaseVolumeSize: types.ReconnectEnumDisabled,
+				RebuildWorkspace:   types.ReconnectEnumEnabled,
+				RestartWorkspace:   types.ReconnectEnumEnabled,
+				SwitchRunningMode:  types.ReconnectEnumEnabled,
 			},
 		},
 	}
@@ -465,7 +470,7 @@ func TestFlattenSelfServicePermissions(t *testing.T) {
 	t.Parallel()
 
 	cases := []struct {
-		input    *workspaces.SelfservicePermissions
+		input    *types.SelfservicePermissions
 		expected []interface{}
 	}{
 		// Empty
@@ -475,12 +480,12 @@ func TestFlattenSelfServicePermissions(t *testing.T) {
 		},
 		// Full
 		{
-			input: &workspaces.SelfservicePermissions{
-				ChangeComputeType:  aws.String(workspaces.ReconnectEnumDisabled),
-				IncreaseVolumeSize: aws.String(workspaces.ReconnectEnumDisabled),
-				RebuildWorkspace:   aws.String(workspaces.ReconnectEnumEnabled),
-				RestartWorkspace:   aws.String(workspaces.ReconnectEnumEnabled),
-				SwitchRunningMode:  aws.String(workspaces.ReconnectEnumEnabled),
+			input: &types.SelfservicePermissions{
+				ChangeComputeType:  types.ReconnectEnumDisabled,
+				IncreaseVolumeSize: types.ReconnectEnumDisabled,
+				RebuildWorkspace:   types.ReconnectEnumEnabled,
+				RestartWorkspace:   types.ReconnectEnumEnabled,
+				SwitchRunningMode:  types.ReconnectEnumEnabled,
 			},
 			expected: []interface{}{
 				map[string]interface{}{
@@ -507,7 +512,7 @@ func TestExpandWorkspaceAccessProperties(t *testing.T) {
 
 	cases := []struct {
 		input    []interface{}
-		expected *workspaces.WorkspaceAccessProperties
+		expected *types.WorkspaceAccessProperties
 	}{
 		// Empty
 		{
@@ -528,15 +533,15 @@ func TestExpandWorkspaceAccessProperties(t *testing.T) {
 					"device_type_zeroclient": "DENY",
 				},
 			},
-			expected: &workspaces.WorkspaceAccessProperties{
-				DeviceTypeAndroid:    aws.String("ALLOW"),
-				DeviceTypeChromeOs:   aws.String("ALLOW"),
-				DeviceTypeIos:        aws.String("ALLOW"),
-				DeviceTypeLinux:      aws.String("DENY"),
-				DeviceTypeOsx:        aws.String("ALLOW"),
-				DeviceTypeWeb:        aws.String("DENY"),
-				DeviceTypeWindows:    aws.String("DENY"),
-				DeviceTypeZeroClient: aws.String("DENY"),
+			expected: &types.WorkspaceAccessProperties{
+				DeviceTypeAndroid:    types.AccessPropertyValue("ALLOW"),
+				DeviceTypeChromeOs:   types.AccessPropertyValue("ALLOW"),
+				DeviceTypeIos:        types.AccessPropertyValue("ALLOW"),
+				DeviceTypeLinux:      types.AccessPropertyValue("DENY"),
+				DeviceTypeOsx:        types.AccessPropertyValue("ALLOW"),
+				DeviceTypeWeb:        types.AccessPropertyValue("DENY"),
+				DeviceTypeWindows:    types.AccessPropertyValue("DENY"),
+				DeviceTypeZeroClient: types.AccessPropertyValue("DENY"),
 			},
 		},
 	}
@@ -553,7 +558,7 @@ func TestFlattenWorkspaceAccessProperties(t *testing.T) {
 	t.Parallel()
 
 	cases := []struct {
-		input    *workspaces.WorkspaceAccessProperties
+		input    *types.WorkspaceAccessProperties
 		expected []interface{}
 	}{
 		// Empty
@@ -563,15 +568,15 @@ func TestFlattenWorkspaceAccessProperties(t *testing.T) {
 		},
 		// Full
 		{
-			input: &workspaces.WorkspaceAccessProperties{
-				DeviceTypeAndroid:    aws.String("ALLOW"),
-				DeviceTypeChromeOs:   aws.String("ALLOW"),
-				DeviceTypeIos:        aws.String("ALLOW"),
-				DeviceTypeLinux:      aws.String("DENY"),
-				DeviceTypeOsx:        aws.String("ALLOW"),
-				DeviceTypeWeb:        aws.String("DENY"),
-				DeviceTypeWindows:    aws.String("DENY"),
-				DeviceTypeZeroClient: aws.String("DENY"),
+			input: &types.WorkspaceAccessProperties{
+				DeviceTypeAndroid:    types.AccessPropertyValue("ALLOW"),
+				DeviceTypeChromeOs:   types.AccessPropertyValue("ALLOW"),
+				DeviceTypeIos:        types.AccessPropertyValue("ALLOW"),
+				DeviceTypeLinux:      types.AccessPropertyValue("DENY"),
+				DeviceTypeOsx:        types.AccessPropertyValue("ALLOW"),
+				DeviceTypeWeb:        types.AccessPropertyValue("DENY"),
+				DeviceTypeWindows:    types.AccessPropertyValue("DENY"),
+				DeviceTypeZeroClient: types.AccessPropertyValue("DENY"),
 			},
 			expected: []interface{}{
 				map[string]interface{}{
@@ -601,7 +606,7 @@ func TestExpandWorkspaceCreationProperties(t *testing.T) {
 
 	cases := []struct {
 		input    []interface{}
-		expected *workspaces.WorkspaceCreationProperties
+		expected *types.WorkspaceCreationProperties
 	}{
 		// Empty
 		{
@@ -619,7 +624,7 @@ func TestExpandWorkspaceCreationProperties(t *testing.T) {
 					"user_enabled_as_local_administrator": true,
 				},
 			},
-			expected: &workspaces.WorkspaceCreationProperties{
+			expected: &types.WorkspaceCreationProperties{
 				CustomSecurityGroupId:           aws.String("sg-123456789012"),
 				DefaultOu:                       aws.String("OU=AWS,DC=Workgroup,DC=Example,DC=com"),
 				EnableInternetAccess:            aws.Bool(true),
@@ -638,7 +643,7 @@ func TestExpandWorkspaceCreationProperties(t *testing.T) {
 					"user_enabled_as_local_administrator": true,
 				},
 			},
-			expected: &workspaces.WorkspaceCreationProperties{
+			expected: &types.WorkspaceCreationProperties{
 				CustomSecurityGroupId:           nil,
 				DefaultOu:                       nil,
 				EnableInternetAccess:            aws.Bool(true),
@@ -660,7 +665,7 @@ func TestFlattenWorkspaceCreationProperties(t *testing.T) {
 	t.Parallel()
 
 	cases := []struct {
-		input    *workspaces.DefaultWorkspaceCreationProperties
+		input    *types.DefaultWorkspaceCreationProperties
 		expected []interface{}
 	}{
 		// Empty
@@ -670,7 +675,7 @@ func TestFlattenWorkspaceCreationProperties(t *testing.T) {
 		},
 		// Full
 		{
-			input: &workspaces.DefaultWorkspaceCreationProperties{
+			input: &types.DefaultWorkspaceCreationProperties{
 				CustomSecurityGroupId:           aws.String("sg-123456789012"),
 				DefaultOu:                       aws.String("OU=AWS,DC=Workgroup,DC=Example,DC=com"),
 				EnableInternetAccess:            aws.Bool(true),
@@ -699,7 +704,7 @@ func TestFlattenWorkspaceCreationProperties(t *testing.T) {
 
 func testAccCheckDirectoryDestroy(ctx context.Context) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		conn := acctest.Provider.Meta().(*conns.AWSClient).WorkSpacesConn(ctx)
+		conn := acctest.Provider.Meta().(*conns.AWSClient).WorkSpacesClient(ctx)
 
 		for _, rs := range s.RootModule().Resources {
 			if rs.Type != "aws_workspaces_directory" {
@@ -723,7 +728,7 @@ func testAccCheckDirectoryDestroy(ctx context.Context) resource.TestCheckFunc {
 	}
 }
 
-func testAccCheckDirectoryExists(ctx context.Context, n string, v *workspaces.WorkspaceDirectory) resource.TestCheckFunc {
+func testAccCheckDirectoryExists(ctx context.Context, n string, v *types.WorkspaceDirectory) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		rs, ok := s.RootModule().Resources[n]
 		if !ok {
@@ -734,7 +739,7 @@ func testAccCheckDirectoryExists(ctx context.Context, n string, v *workspaces.Wo
 			return fmt.Errorf("No WorkSpaces Directory ID is set")
 		}
 
-		conn := acctest.Provider.Meta().(*conns.AWSClient).WorkSpacesConn(ctx)
+		conn := acctest.Provider.Meta().(*conns.AWSClient).WorkSpacesClient(ctx)
 
 		output, err := tfworkspaces.FindDirectoryByID(ctx, conn, rs.Primary.ID)
 
@@ -749,11 +754,11 @@ func testAccCheckDirectoryExists(ctx context.Context, n string, v *workspaces.Wo
 }
 
 func testAccPreCheckDirectory(ctx context.Context, t *testing.T) {
-	conn := acctest.Provider.Meta().(*conns.AWSClient).WorkSpacesConn(ctx)
+	conn := acctest.Provider.Meta().(*conns.AWSClient).WorkSpacesClient(ctx)
 
 	input := &workspaces.DescribeWorkspaceDirectoriesInput{}
 
-	_, err := conn.DescribeWorkspaceDirectoriesWithContext(ctx, input)
+	_, err := conn.DescribeWorkspaceDirectories(ctx, input)
 
 	if acctest.PreCheckSkipError(err) {
 		t.Skipf("skipping acceptance testing: %s", err)
diff --git a/internal/service/workspaces/find.go b/internal/service/workspaces/find.go
index 91027bdb338..2e2e891fc10 100644
--- a/internal/service/workspaces/find.go
+++ b/internal/service/workspaces/find.go
@@ -1,25 +1,29 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package workspaces
 
 import (
 	"context"
+	"reflect"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/workspaces"
+	"github.com/aws/aws-sdk-go-v2/service/workspaces"
+	"github.com/aws/aws-sdk-go-v2/service/workspaces/types"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 )
 
-func FindDirectoryByID(ctx context.Context, conn *workspaces.WorkSpaces, id string) (*workspaces.WorkspaceDirectory, error) {
+func FindDirectoryByID(ctx context.Context, conn *workspaces.Client, id string) (*types.WorkspaceDirectory, error) {
 	input := &workspaces.DescribeWorkspaceDirectoriesInput{
-		DirectoryIds: aws.StringSlice([]string{id}),
+		DirectoryIds: []string{id},
 	}
 
-	output, err := conn.DescribeWorkspaceDirectoriesWithContext(ctx, input)
+	output, err := conn.DescribeWorkspaceDirectories(ctx, input)
 
 	if err != nil {
 		return nil, err
 	}
 
-	if output == nil || len(output.Directories) == 0 || output.Directories[0] == nil {
+	if output == nil || len(output.Directories) == 0 || reflect.DeepEqual(output.Directories[0], (types.WorkspaceDirectory{})) {
 		return nil, &retry.NotFoundError{
 			Message:     "Empty result",
 			LastRequest: input,
@@ -31,12 +35,12 @@ func FindDirectoryByID(ctx context.Context, conn *workspaces.WorkSpaces, id stri
 
 	directory := output.Directories[0]
 
-	if state := aws.StringValue(directory.State); state == workspaces.WorkspaceDirectoryStateDeregistered {
+	if state := string(directory.State); state == string(types.WorkspaceDirectoryStateDeregistered) {
 		return nil, &retry.NotFoundError{
 			Message:     state,
 			LastRequest: input,
 		}
 	}
 
-	return directory, nil
+	return &directory, nil
 }
diff --git a/internal/service/workspaces/generate.go b/internal/service/workspaces/generate.go
index 6e03d9eab9b..623b9952b0f 100644
--- a/internal/service/workspaces/generate.go
+++ b/internal/service/workspaces/generate.go
@@ -1,5 +1,7 @@
-//go:generate go run ../../generate/listpages/main.go -ListOps=DescribeIpGroups
-//go:generate go run ../../generate/tags/main.go -ListTags -ListTagsOp=DescribeTags -ListTagsInIDElem=ResourceId -ListTagsOutTagsElem=TagList -ServiceTagsSlice -TagOp=CreateTags -TagInIDElem=ResourceId -UntagOp=DeleteTags -UpdateTags
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+//go:generate go run ../../generate/tags/main.go -AWSSDKVersion=2 -ListTags -ListTagsOp=DescribeTags -ListTagsInIDElem=ResourceId -ListTagsOutTagsElem=TagList -ServiceTagsSlice -TagOp=CreateTags -TagInIDElem=ResourceId -UntagOp=DeleteTags -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
 
diff --git a/internal/service/workspaces/image_data_source.go b/internal/service/workspaces/image_data_source.go
index ccde2fe10c0..fe24acecc4a 100644
--- a/internal/service/workspaces/image_data_source.go
+++ b/internal/service/workspaces/image_data_source.go
@@ -1,10 +1,12 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package workspaces
 
 import (
 	"context"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/workspaces"
+	"github.com/aws/aws-sdk-go-v2/service/workspaces"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
@@ -47,14 +49,14 @@ func DataSourceImage() *schema.Resource {
 
 func dataSourceImageRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).WorkSpacesConn(ctx)
+	conn := meta.(*conns.AWSClient).WorkSpacesClient(ctx)
 
 	imageID := d.Get("image_id").(string)
 	input := &workspaces.DescribeWorkspaceImagesInput{
-		ImageIds: []*string{aws.String(imageID)},
+		ImageIds: []string{imageID},
 	}
 
-	resp, err := conn.DescribeWorkspaceImagesWithContext(ctx, input)
+	resp, err := conn.DescribeWorkspaceImages(ctx, input)
 	if err != nil {
 		return sdkdiag.AppendErrorf(diags, "describe workspaces images: %s", err)
 	}
diff --git a/internal/service/workspaces/image_data_source_test.go b/internal/service/workspaces/image_data_source_test.go
index 065b83f9d93..3bb87a26c12 100644
--- a/internal/service/workspaces/image_data_source_test.go
+++ b/internal/service/workspaces/image_data_source_test.go
@@ -1,13 +1,19 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package workspaces_test
 
 import (
 	"context"
 	"fmt"
 	"os"
+	"reflect"
+	"strings"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/workspaces"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/workspaces"
+	"github.com/aws/aws-sdk-go-v2/service/workspaces/types"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
@@ -16,7 +22,7 @@ import (
 
 func testAccImageDataSource_basic(t *testing.T) {
 	ctx := acctest.Context(t)
-	var image workspaces.WorkspaceImage
+	var image types.WorkspaceImage
 	imageID := os.Getenv("AWS_WORKSPACES_IMAGE_ID")
 	dataSourceName := "data.aws_workspaces_image.test"
 
@@ -25,7 +31,7 @@ func testAccImageDataSource_basic(t *testing.T) {
 			acctest.PreCheck(ctx, t)
 			testAccImagePreCheck(t)
 		},
-		ErrorCheck:               acctest.ErrorCheck(t, workspaces.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, strings.ToLower(workspaces.ServiceID)),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		Steps: []resource.TestStep{
 			{
@@ -55,34 +61,34 @@ data aws_workspaces_image test {
 `, imageID)
 }
 
-func testAccCheckImageExists(ctx context.Context, n string, image *workspaces.WorkspaceImage) resource.TestCheckFunc {
+func testAccCheckImageExists(ctx context.Context, n string, image *types.WorkspaceImage) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		rs, ok := s.RootModule().Resources[n]
 		if !ok {
 			return fmt.Errorf("Not found: %s", n)
 		}
 
-		conn := acctest.Provider.Meta().(*conns.AWSClient).WorkSpacesConn(ctx)
-		resp, err := conn.DescribeWorkspaceImagesWithContext(ctx, &workspaces.DescribeWorkspaceImagesInput{
-			ImageIds: []*string{aws.String(rs.Primary.ID)},
+		conn := acctest.Provider.Meta().(*conns.AWSClient).WorkSpacesClient(ctx)
+		resp, err := conn.DescribeWorkspaceImages(ctx, &workspaces.DescribeWorkspaceImagesInput{
+			ImageIds: []string{rs.Primary.ID},
 		})
 		if err != nil {
 			return fmt.Errorf("Failed describe workspaces images: %w", err)
 		}
-		if resp == nil || len(resp.Images) == 0 || resp.Images[0] == nil {
+		if resp == nil || len(resp.Images) == 0 || reflect.DeepEqual(resp.Images[0], (types.WorkspaceImage{})) {
 			return fmt.Errorf("Workspace image %s was not found", rs.Primary.ID)
 		}
-		if aws.StringValue(resp.Images[0].ImageId) != rs.Primary.ID {
+		if aws.ToString(resp.Images[0].ImageId) != rs.Primary.ID {
 			return fmt.Errorf("Workspace image ID mismatch - existing: %q, state: %q", *resp.Images[0].ImageId, rs.Primary.ID)
 		}
 
-		*image = *resp.Images[0]
+		*image = resp.Images[0]
 
 		return nil
 	}
 }
 
-func testAccCheckImageAttributes(n string, image *workspaces.WorkspaceImage) resource.TestCheckFunc {
+func testAccCheckImageAttributes(n string, image *types.WorkspaceImage) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		_, ok := s.RootModule().Resources[n]
 		if !ok {
@@ -101,15 +107,15 @@ func testAccCheckImageAttributes(n string, image *workspaces.WorkspaceImage) res
 			return err
 		}
 
-		if err := resource.TestCheckResourceAttr(n, "operating_system_type", *image.OperatingSystem.Type)(s); err != nil {
+		if err := resource.TestCheckResourceAttr(n, "operating_system_type", string(image.OperatingSystem.Type))(s); err != nil {
 			return err
 		}
 
-		if err := resource.TestCheckResourceAttr(n, "required_tenancy", *image.RequiredTenancy)(s); err != nil {
+		if err := resource.TestCheckResourceAttr(n, "required_tenancy", string(image.RequiredTenancy))(s); err != nil {
 			return err
 		}
 
-		if err := resource.TestCheckResourceAttr(n, "state", *image.State)(s); err != nil {
+		if err := resource.TestCheckResourceAttr(n, "state", string(image.State))(s); err != nil {
 			return err
 		}
 
diff --git a/internal/service/workspaces/ip_group.go b/internal/service/workspaces/ip_group.go
index 6476890a937..eb00917c7b5 100644
--- a/internal/service/workspaces/ip_group.go
+++ b/internal/service/workspaces/ip_group.go
@@ -1,11 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package workspaces
 
 import (
 	"context"
 	"log"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/workspaces"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/workspaces"
+	"github.com/aws/aws-sdk-go-v2/service/workspaces/types"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
@@ -66,10 +70,10 @@ func ResourceIPGroup() *schema.Resource {
 
 func resourceIPGroupCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).WorkSpacesConn(ctx)
+	conn := meta.(*conns.AWSClient).WorkSpacesClient(ctx)
 
 	rules := d.Get("rules").(*schema.Set).List()
-	resp, err := conn.CreateIpGroupWithContext(ctx, &workspaces.CreateIpGroupInput{
+	resp, err := conn.CreateIpGroup(ctx, &workspaces.CreateIpGroupInput{
 		GroupName: aws.String(d.Get("name").(string)),
 		GroupDesc: aws.String(d.Get("description").(string)),
 		UserRules: expandIPGroupRules(rules),
@@ -80,17 +84,17 @@ func resourceIPGroupCreate(ctx context.Context, d *schema.ResourceData, meta int
 		return sdkdiag.AppendErrorf(diags, "creating WorkSpaces IP Group: %s", err)
 	}
 
-	d.SetId(aws.StringValue(resp.GroupId))
+	d.SetId(aws.ToString(resp.GroupId))
 
 	return append(diags, resourceIPGroupRead(ctx, d, meta)...)
 }
 
 func resourceIPGroupRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).WorkSpacesConn(ctx)
+	conn := meta.(*conns.AWSClient).WorkSpacesClient(ctx)
 
-	resp, err := conn.DescribeIpGroupsWithContext(ctx, &workspaces.DescribeIpGroupsInput{
-		GroupIds: []*string{aws.String(d.Id())},
+	resp, err := conn.DescribeIpGroups(ctx, &workspaces.DescribeIpGroupsInput{
+		GroupIds: []string{d.Id()},
 	})
 	if err != nil {
 		if len(resp.Result) == 0 {
@@ -121,12 +125,12 @@ func resourceIPGroupRead(ctx context.Context, d *schema.ResourceData, meta inter
 
 func resourceIPGroupUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).WorkSpacesConn(ctx)
+	conn := meta.(*conns.AWSClient).WorkSpacesClient(ctx)
 
 	if d.HasChange("rules") {
 		rules := d.Get("rules").(*schema.Set).List()
 
-		_, err := conn.UpdateRulesOfIpGroupWithContext(ctx, &workspaces.UpdateRulesOfIpGroupInput{
+		_, err := conn.UpdateRulesOfIpGroup(ctx, &workspaces.UpdateRulesOfIpGroupInput{
 			GroupId:   aws.String(d.Id()),
 			UserRules: expandIPGroupRules(rules),
 		})
@@ -140,34 +144,38 @@ func resourceIPGroupUpdate(ctx context.Context, d *schema.ResourceData, meta int
 
 func resourceIPGroupDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).WorkSpacesConn(ctx)
+	conn := meta.(*conns.AWSClient).WorkSpacesClient(ctx)
 
 	var found bool
 	log.Printf("[DEBUG] Finding directories associated with WorkSpaces IP Group (%s)", d.Id())
-	err := conn.DescribeWorkspaceDirectoriesPagesWithContext(ctx, nil, func(page *workspaces.DescribeWorkspaceDirectoriesOutput, lastPage bool) bool {
-		for _, dir := range page.Directories {
+	paginator := workspaces.NewDescribeWorkspaceDirectoriesPaginator(conn, &workspaces.DescribeWorkspaceDirectoriesInput{}, func(out *workspaces.DescribeWorkspaceDirectoriesPaginatorOptions) {})
+
+	for paginator.HasMorePages() {
+		out, err := paginator.NextPage(ctx)
+
+		if err != nil {
+			diags = sdkdiag.AppendErrorf(diags, "describing WorkSpaces Directories: %s", err)
+		}
+		for _, dir := range out.Directories {
 			for _, ipg := range dir.IpGroupIds {
-				groupID := aws.StringValue(ipg)
+				groupID := ipg
 				if groupID == d.Id() {
 					found = true
-					log.Printf("[DEBUG] WorkSpaces IP Group (%s) associated with WorkSpaces Directory (%s), disassociating", groupID, aws.StringValue(dir.DirectoryId))
-					_, err := conn.DisassociateIpGroupsWithContext(ctx, &workspaces.DisassociateIpGroupsInput{
+					log.Printf("[DEBUG] WorkSpaces IP Group (%s) associated with WorkSpaces Directory (%s), disassociating", groupID, aws.ToString(dir.DirectoryId))
+					_, err := conn.DisassociateIpGroups(ctx, &workspaces.DisassociateIpGroupsInput{
 						DirectoryId: dir.DirectoryId,
-						GroupIds:    aws.StringSlice([]string{d.Id()}),
+						GroupIds:    []string{d.Id()},
 					})
 					if err != nil {
-						diags = sdkdiag.AppendErrorf(diags, "disassociating WorkSpaces IP Group (%s) from WorkSpaces Directory (%s): %s", d.Id(), aws.StringValue(dir.DirectoryId), err)
+						diags = sdkdiag.AppendErrorf(diags, "disassociating WorkSpaces IP Group (%s) from WorkSpaces Directory (%s): %s", d.Id(), aws.ToString(dir.DirectoryId), err)
 						continue
 					}
-					log.Printf("[INFO] WorkSpaces IP Group (%s) disassociated from WorkSpaces Directory (%s)", d.Id(), aws.StringValue(dir.DirectoryId))
+					log.Printf("[INFO] WorkSpaces IP Group (%s) disassociated from WorkSpaces Directory (%s)", d.Id(), aws.ToString(dir.DirectoryId))
 				}
 			}
 		}
-		return !lastPage
-	})
-	if err != nil {
-		diags = sdkdiag.AppendErrorf(diags, "describing WorkSpaces Directories: %s", err)
 	}
+
 	if diags.HasError() {
 		return diags
 	}
@@ -177,7 +185,7 @@ func resourceIPGroupDelete(ctx context.Context, d *schema.ResourceData, meta int
 	}
 
 	log.Printf("[DEBUG] Deleting WorkSpaces IP Group (%s)", d.Id())
-	_, err = conn.DeleteIpGroupWithContext(ctx, &workspaces.DeleteIpGroupInput{
+	_, err := conn.DeleteIpGroup(ctx, &workspaces.DeleteIpGroupInput{
 		GroupId: aws.String(d.Id()),
 	})
 	if err != nil {
@@ -188,12 +196,12 @@ func resourceIPGroupDelete(ctx context.Context, d *schema.ResourceData, meta int
 	return diags
 }
 
-func expandIPGroupRules(rules []interface{}) []*workspaces.IpRuleItem {
-	var result []*workspaces.IpRuleItem
+func expandIPGroupRules(rules []interface{}) []types.IpRuleItem {
+	var result []types.IpRuleItem
 	for _, rule := range rules {
 		r := rule.(map[string]interface{})
 
-		result = append(result, &workspaces.IpRuleItem{
+		result = append(result, types.IpRuleItem{
 			IpRule:   aws.String(r["source"].(string)),
 			RuleDesc: aws.String(r["description"].(string)),
 		})
@@ -201,17 +209,17 @@ func expandIPGroupRules(rules []interface{}) []*workspaces.IpRuleItem {
 	return result
 }
 
-func flattenIPGroupRules(rules []*workspaces.IpRuleItem) []map[string]interface{} {
+func flattenIPGroupRules(rules []types.IpRuleItem) []map[string]interface{} {
 	result := make([]map[string]interface{}, 0, len(rules))
 	for _, rule := range rules {
 		r := map[string]interface{}{}
 
 		if v := rule.IpRule; v != nil {
-			r["source"] = aws.StringValue(v)
+			r["source"] = aws.ToString(v)
 		}
 
 		if v := rule.RuleDesc; v != nil {
-			r["description"] = aws.StringValue(rule.RuleDesc)
+			r["description"] = aws.ToString(rule.RuleDesc)
 		}
 
 		result = append(result, r)
diff --git a/internal/service/workspaces/ip_group_test.go b/internal/service/workspaces/ip_group_test.go
index d5d17ca3355..f0a3af93fa5 100644
--- a/internal/service/workspaces/ip_group_test.go
+++ b/internal/service/workspaces/ip_group_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package workspaces_test
 
 import (
@@ -6,8 +9,8 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/workspaces"
+	"github.com/aws/aws-sdk-go-v2/service/workspaces"
+	"github.com/aws/aws-sdk-go-v2/service/workspaces/types"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
@@ -18,7 +21,7 @@ import (
 
 func testAccIPGroup_basic(t *testing.T) {
 	ctx := acctest.Context(t)
-	var v workspaces.IpGroup
+	var v types.WorkspacesIpGroup
 	ipGroupName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	ipGroupNewName := sdkacctest.RandomWithPrefix("tf-acc-test-upd")
 	ipGroupDescription := fmt.Sprintf("Terraform Acceptance Test %s", strings.Title(sdkacctest.RandString(20)))
@@ -26,7 +29,7 @@ func testAccIPGroup_basic(t *testing.T) {
 
 	resource.Test(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, workspaces.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, strings.ToLower(workspaces.ServiceID)),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckIPGroupDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -65,13 +68,13 @@ func testAccIPGroup_basic(t *testing.T) {
 
 func testAccIPGroup_tags(t *testing.T) {
 	ctx := acctest.Context(t)
-	var v workspaces.IpGroup
+	var v types.WorkspacesIpGroup
 	resourceName := "aws_workspaces_ip_group.test"
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 
 	resource.Test(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, workspaces.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, strings.ToLower(workspaces.ServiceID)),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckIPGroupDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -111,14 +114,14 @@ func testAccIPGroup_tags(t *testing.T) {
 
 func testAccIPGroup_disappears(t *testing.T) {
 	ctx := acctest.Context(t)
-	var v workspaces.IpGroup
+	var v types.WorkspacesIpGroup
 	ipGroupName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	ipGroupDescription := fmt.Sprintf("Terraform Acceptance Test %s", strings.Title(sdkacctest.RandString(20)))
 	resourceName := "aws_workspaces_ip_group.test"
 
 	resource.Test(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, workspaces.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, strings.ToLower(workspaces.ServiceID)),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckIPGroupDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -136,8 +139,8 @@ func testAccIPGroup_disappears(t *testing.T) {
 
 func testAccIPGroup_MultipleDirectories(t *testing.T) {
 	ctx := acctest.Context(t)
-	var v workspaces.IpGroup
-	var d1, d2 workspaces.WorkspaceDirectory
+	var v types.WorkspacesIpGroup
+	var d1, d2 types.WorkspaceDirectory
 
 	ipGroupName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	domain := acctest.RandomDomainName()
@@ -147,8 +150,11 @@ func testAccIPGroup_MultipleDirectories(t *testing.T) {
 	directoryResourceName2 := "aws_workspaces_directory.test2"
 
 	resource.Test(t, resource.TestCase{
-		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, workspaces.EndpointsID),
+		PreCheck: func() {
+			acctest.PreCheck(ctx, t)
+			acctest.PreCheckHasIAMRole(ctx, t, "workspaces_DefaultRole")
+		},
+		ErrorCheck:               acctest.ErrorCheck(t, strings.ToLower(workspaces.ServiceID)),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckIPGroupDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -173,9 +179,9 @@ func testAccCheckIPGroupDestroy(ctx context.Context) resource.TestCheckFunc {
 				continue
 			}
 
-			conn := acctest.Provider.Meta().(*conns.AWSClient).WorkSpacesConn(ctx)
-			resp, err := conn.DescribeIpGroupsWithContext(ctx, &workspaces.DescribeIpGroupsInput{
-				GroupIds: []*string{aws.String(rs.Primary.ID)},
+			conn := acctest.Provider.Meta().(*conns.AWSClient).WorkSpacesClient(ctx)
+			resp, err := conn.DescribeIpGroups(ctx, &workspaces.DescribeIpGroupsInput{
+				GroupIds: []string{rs.Primary.ID},
 			})
 
 			if err != nil {
@@ -196,7 +202,7 @@ func testAccCheckIPGroupDestroy(ctx context.Context) resource.TestCheckFunc {
 	}
 }
 
-func testAccCheckIPGroupExists(ctx context.Context, n string, v *workspaces.IpGroup) resource.TestCheckFunc {
+func testAccCheckIPGroupExists(ctx context.Context, n string, v *types.WorkspacesIpGroup) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		rs, ok := s.RootModule().Resources[n]
 		if !ok {
@@ -207,16 +213,16 @@ func testAccCheckIPGroupExists(ctx context.Context, n string, v *workspaces.IpGr
 			return fmt.Errorf("No Workpsaces IP Group ID is set")
 		}
 
-		conn := acctest.Provider.Meta().(*conns.AWSClient).WorkSpacesConn(ctx)
-		resp, err := conn.DescribeIpGroupsWithContext(ctx, &workspaces.DescribeIpGroupsInput{
-			GroupIds: []*string{aws.String(rs.Primary.ID)},
+		conn := acctest.Provider.Meta().(*conns.AWSClient).WorkSpacesClient(ctx)
+		resp, err := conn.DescribeIpGroups(ctx, &workspaces.DescribeIpGroupsInput{
+			GroupIds: []string{rs.Primary.ID},
 		})
 		if err != nil {
 			return err
 		}
 
 		if *resp.Result[0].GroupId == rs.Primary.ID {
-			*v = *resp.Result[0]
+			*v = resp.Result[0]
 			return nil
 		}
 
diff --git a/internal/service/workspaces/list_pages_gen.go b/internal/service/workspaces/list_pages_gen.go
deleted file mode 100644
index 8295ec77b90..00000000000
--- a/internal/service/workspaces/list_pages_gen.go
+++ /dev/null
@@ -1,28 +0,0 @@
-// Code generated by "internal/generate/listpages/main.go -ListOps=DescribeIpGroups"; DO NOT EDIT.
-
-package workspaces
-
-import (
-	"context"
-
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/workspaces"
-	"github.com/aws/aws-sdk-go/service/workspaces/workspacesiface"
-)
-
-func describeIPGroupsPages(ctx context.Context, conn workspacesiface.WorkSpacesAPI, input *workspaces.DescribeIpGroupsInput, fn func(*workspaces.DescribeIpGroupsOutput, bool) bool) error {
-	for {
-		output, err := conn.DescribeIpGroupsWithContext(ctx, input)
-		if err != nil {
-			return err
-		}
-
-		lastPage := aws.StringValue(output.NextToken) == ""
-		if !fn(output, lastPage) || lastPage {
-			break
-		}
-
-		input.NextToken = output.NextToken
-	}
-	return nil
-}
diff --git a/internal/service/workspaces/service_package_gen.go b/internal/service/workspaces/service_package_gen.go
index ef701f6e5f1..97017c8d8cd 100644
--- a/internal/service/workspaces/service_package_gen.go
+++ b/internal/service/workspaces/service_package_gen.go
@@ -5,9 +5,9 @@ package workspaces
 import (
 	"context"
 
-	aws_sdkv1 "github.com/aws/aws-sdk-go/aws"
-	session_sdkv1 "github.com/aws/aws-sdk-go/aws/session"
-	workspaces_sdkv1 "github.com/aws/aws-sdk-go/service/workspaces"
+	aws_sdkv2 "github.com/aws/aws-sdk-go-v2/aws"
+	workspaces_sdkv2 "github.com/aws/aws-sdk-go-v2/service/workspaces"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -19,7 +19,15 @@ func (p *servicePackage) FrameworkDataSources(ctx context.Context) []*types.Serv
 }
 
 func (p *servicePackage) FrameworkResources(ctx context.Context) []*types.ServicePackageFrameworkResource {
-	return []*types.ServicePackageFrameworkResource{}
+	return []*types.ServicePackageFrameworkResource{
+		{
+			Factory: newResourceConnectionAlias,
+			Name:    "Connection Alias",
+			Tags: &types.ServicePackageResourceTags{
+				IdentifierAttribute: "id",
+			},
+		},
+	}
 }
 
 func (p *servicePackage) SDKDataSources(ctx context.Context) []*types.ServicePackageSDKDataSource {
@@ -76,11 +84,17 @@ func (p *servicePackage) ServicePackageName() string {
 	return names.WorkSpaces
 }
 
-// NewConn returns a new AWS SDK for Go v1 client for this service package's AWS API.
-func (p *servicePackage) NewConn(ctx context.Context, config map[string]any) (*workspaces_sdkv1.WorkSpaces, error) {
-	sess := config["session"].(*session_sdkv1.Session)
+// NewClient returns a new AWS SDK for Go v2 client for this service package's AWS API.
+func (p *servicePackage) NewClient(ctx context.Context, config map[string]any) (*workspaces_sdkv2.Client, error) {
+	cfg := *(config["aws_sdkv2_config"].(*aws_sdkv2.Config))
 
-	return workspaces_sdkv1.New(sess.Copy(&aws_sdkv1.Config{Endpoint: aws_sdkv1.String(config["endpoint"].(string))})), nil
+	return workspaces_sdkv2.NewFromConfig(cfg, func(o *workspaces_sdkv2.Options) {
+		if endpoint := config["endpoint"].(string); endpoint != "" {
+			o.BaseEndpoint = aws_sdkv2.String(endpoint)
+		}
+	}), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/workspaces/status.go b/internal/service/workspaces/status.go
index 847812dfb03..5601ba964d2 100644
--- a/internal/service/workspaces/status.go
+++ b/internal/service/workspaces/status.go
@@ -1,15 +1,18 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package workspaces
 
 import (
 	"context"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/workspaces"
+	"github.com/aws/aws-sdk-go-v2/service/workspaces"
+	"github.com/aws/aws-sdk-go-v2/service/workspaces/types"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
-func StatusDirectoryState(ctx context.Context, conn *workspaces.WorkSpaces, id string) retry.StateRefreshFunc {
+func StatusDirectoryState(ctx context.Context, conn *workspaces.Client, id string) retry.StateRefreshFunc {
 	return func() (interface{}, string, error) {
 		output, err := FindDirectoryByID(ctx, conn, id)
 
@@ -21,32 +24,32 @@ func StatusDirectoryState(ctx context.Context, conn *workspaces.WorkSpaces, id s
 			return nil, "", err
 		}
 
-		return output, aws.StringValue(output.State), nil
+		return output, string(output.State), nil
 	}
 }
 
 // nosemgrep:ci.workspaces-in-func-name
-func StatusWorkspaceState(ctx context.Context, conn *workspaces.WorkSpaces, workspaceID string) retry.StateRefreshFunc {
+func StatusWorkspaceState(ctx context.Context, conn *workspaces.Client, workspaceID string) retry.StateRefreshFunc {
 	return func() (interface{}, string, error) {
-		output, err := conn.DescribeWorkspacesWithContext(ctx, &workspaces.DescribeWorkspacesInput{
-			WorkspaceIds: aws.StringSlice([]string{workspaceID}),
+		output, err := conn.DescribeWorkspaces(ctx, &workspaces.DescribeWorkspacesInput{
+			WorkspaceIds: []string{workspaceID},
 		})
 		if err != nil {
-			return nil, workspaces.WorkspaceStateError, err
+			return nil, string(types.WorkspaceStateError), err
 		}
 
 		if len(output.Workspaces) == 0 {
-			return output, workspaces.WorkspaceStateTerminated, nil
+			return output, string(types.WorkspaceStateTerminated), nil
 		}
 
 		workspace := output.Workspaces[0]
 
 		// https://docs.aws.amazon.com/workspaces/latest/api/API_TerminateWorkspaces.html
 		// State TERMINATED is overridden with TERMINATING to catch up directory metadata clean up.
-		if aws.StringValue(workspace.State) == workspaces.WorkspaceStateTerminated {
-			return workspace, workspaces.WorkspaceStateTerminating, nil
+		if workspace.State == types.WorkspaceStateTerminated {
+			return workspace, string(types.WorkspaceStateTerminating), nil
 		}
 
-		return workspace, aws.StringValue(workspace.State), nil
+		return workspace, string(workspace.State), nil
 	}
 }
diff --git a/internal/service/workspaces/sweep.go b/internal/service/workspaces/sweep.go
index dddb5c41c56..8c96169bdb1 100644
--- a/internal/service/workspaces/sweep.go
+++ b/internal/service/workspaces/sweep.go
@@ -1,24 +1,28 @@
-//go:build sweep
-// +build sweep
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package workspaces
 
 import (
+	"context"
 	"fmt"
 	"log"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/workspaces"
-	"github.com/hashicorp/go-multierror"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/workspaces"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv2"
 )
 
-func init() {
+func RegisterSweepers() {
 	resource.AddTestSweepers("aws_workspaces_directory", &resource.Sweeper{
-		Name:         "aws_workspaces_directory",
-		F:            sweepDirectories,
-		Dependencies: []string{"aws_workspaces_workspace", "aws_workspaces_ip_group"},
+		Name: "aws_workspaces_directory",
+		F:    sweepDirectories,
+		Dependencies: []string{
+			"aws_workspaces_workspace",
+			"aws_workspaces_ip_group",
+		},
 	})
 
 	resource.AddTestSweepers("aws_workspaces_ip_group", &resource.Sweeper{
@@ -34,40 +38,37 @@ func init() {
 
 func sweepDirectories(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
-	conn := client.WorkSpacesConn(ctx)
 	input := &workspaces.DescribeWorkspaceDirectoriesInput{}
+	conn := client.WorkSpacesClient(ctx)
 	sweepResources := make([]sweep.Sweepable, 0)
 
-	err = conn.DescribeWorkspaceDirectoriesPagesWithContext(ctx, input, func(page *workspaces.DescribeWorkspaceDirectoriesOutput, lastPage bool) bool {
-		if page == nil {
-			return !lastPage
+	paginator := workspaces.NewDescribeWorkspaceDirectoriesPaginator(conn, input)
+	for paginator.HasMorePages() {
+		page, err := paginator.NextPage(ctx)
+
+		if awsv2.SkipSweepError(err) {
+			log.Printf("[WARN] Skipping WorkSpaces Directory sweep for %s: %s", region, err)
+			return nil
+		}
+
+		if err != nil {
+			return fmt.Errorf("error listing WorkSpaces Directories (%s): %w", region, err)
 		}
 
-		for _, directory := range page.Directories {
+		for _, v := range page.Directories {
 			r := ResourceDirectory()
 			d := r.Data(nil)
-			d.SetId(aws.StringValue(directory.DirectoryId))
+			d.SetId(aws.ToString(v.DirectoryId))
 
 			sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
 		}
-
-		return !lastPage
-	})
-
-	if sweep.SkipSweepError(err) {
-		log.Printf("[WARN] Skipping WorkSpaces Directory sweep for %s: %s", region, err)
-		return nil
 	}
 
-	if err != nil {
-		return fmt.Errorf("error listing WorkSpaces Directories (%s): %w", region, err)
-	}
-
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
 		return fmt.Errorf("error sweeping WorkSpaces Directories (%s): %w", region, err)
@@ -78,11 +79,11 @@ func sweepDirectories(region string) error {
 
 func sweepIPGroups(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %s", err)
 	}
-	conn := client.WorkSpacesConn(ctx)
+	conn := client.WorkSpacesClient(ctx)
 	input := &workspaces.DescribeIpGroupsInput{}
 	sweepResources := make([]sweep.Sweepable, 0)
 
@@ -91,10 +92,10 @@ func sweepIPGroups(region string) error {
 			return !lastPage
 		}
 
-		for _, ipGroup := range page.Result {
+		for _, v := range page.Result {
 			r := ResourceIPGroup()
 			d := r.Data(nil)
-			d.SetId(aws.StringValue(ipGroup.GroupId))
+			d.SetId(aws.ToString(v.GroupId))
 
 			sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
 		}
@@ -102,51 +103,78 @@ func sweepIPGroups(region string) error {
 		return !lastPage
 	})
 
-	if sweep.SkipSweepError(err) {
-		log.Printf("[WARN] Skipping WorkSpaces Ip Group sweep for %s: %s", region, err)
+	if awsv2.SkipSweepError(err) {
+		log.Printf("[WARN] Skipping WorkSpaces IP Group sweep for %s: %s", region, err)
 		return nil
 	}
 
 	if err != nil {
-		return fmt.Errorf("error listing WorkSpaces Ip Groups (%s): %w", region, err)
+		return fmt.Errorf("error listing WorkSpaces IP Groups (%s): %w", region, err)
 	}
 
-	err = sweep.SweepOrchestratorWithContext(ctx, sweepResources)
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
 
 	if err != nil {
-		return fmt.Errorf("error sweeping WorkSpaces Ip Groups (%s): %w", region, err)
+		return fmt.Errorf("error sweeping WorkSpaces IP Groups (%s): %w", region, err)
 	}
 
 	return nil
 }
 
+func describeIPGroupsPages(ctx context.Context, conn *workspaces.Client, input *workspaces.DescribeIpGroupsInput, fn func(*workspaces.DescribeIpGroupsOutput, bool) bool) error {
+	for {
+		output, err := conn.DescribeIpGroups(ctx, input)
+		if err != nil {
+			return err
+		}
+
+		lastPage := aws.ToString(output.NextToken) == ""
+		if !fn(output, lastPage) || lastPage {
+			break
+		}
+
+		input.NextToken = output.NextToken
+	}
+	return nil
+}
+
 func sweepWorkspace(region string) error {
 	ctx := sweep.Context(region)
-	client, err := sweep.SharedRegionalSweepClient(region)
+	client, err := sweep.SharedRegionalSweepClient(ctx, region)
 	if err != nil {
 		return fmt.Errorf("error getting client: %w", err)
 	}
-	conn := client.WorkSpacesConn(ctx)
-
-	var errors error
 	input := &workspaces.DescribeWorkspacesInput{}
-	err = conn.DescribeWorkspacesPagesWithContext(ctx, input, func(resp *workspaces.DescribeWorkspacesOutput, _ bool) bool {
-		for _, workspace := range resp.Workspaces {
-			err := WorkspaceDelete(ctx, conn, aws.StringValue(workspace.WorkspaceId), WorkspaceTerminatedTimeout)
-			if err != nil {
-				errors = multierror.Append(errors, err)
-			}
+	conn := client.WorkSpacesClient(ctx)
+	sweepResources := make([]sweep.Sweepable, 0)
 
+	paginator := workspaces.NewDescribeWorkspacesPaginator(conn, input)
+	for paginator.HasMorePages() {
+		page, err := paginator.NextPage(ctx)
+
+		if awsv2.SkipSweepError(err) {
+			log.Printf("[WARN] Skipping WorkSpaces Workspace sweep for %s: %s", region, err)
+			return nil
+		}
+
+		if err != nil {
+			return fmt.Errorf("error listing WorkSpaces Workspaces (%s): %w", region, err)
+		}
+
+		for _, v := range page.Workspaces {
+			r := ResourceWorkspace()
+			d := r.Data(nil)
+			d.SetId(aws.ToString(v.WorkspaceId))
+
+			sweepResources = append(sweepResources, sweep.NewSweepResource(r, d, client))
 		}
-		return true
-	})
-	if sweep.SkipSweepError(err) {
-		log.Printf("[WARN] Skipping workspaces sweep for %s: %s", region, err)
-		return errors // In case we have completed some pages, but had errors
 	}
+
+	err = sweep.SweepOrchestrator(ctx, sweepResources)
+
 	if err != nil {
-		errors = multierror.Append(errors, fmt.Errorf("error listing workspaces: %s", err))
+		return fmt.Errorf("error sweeping WorkSpaces Workspaces (%s): %w", region, err)
 	}
 
-	return errors
+	return nil
 }
diff --git a/internal/service/workspaces/tags_gen.go b/internal/service/workspaces/tags_gen.go
index 5008be5c69e..98e55ab750c 100644
--- a/internal/service/workspaces/tags_gen.go
+++ b/internal/service/workspaces/tags_gen.go
@@ -5,10 +5,12 @@ import (
 	"context"
 	"fmt"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/workspaces"
-	"github.com/aws/aws-sdk-go/service/workspaces/workspacesiface"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/workspaces"
+	awstypes "github.com/aws/aws-sdk-go-v2/service/workspaces/types"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -17,12 +19,12 @@ import (
 // listTags lists workspaces service tags.
 // The identifier is typically the Amazon Resource Name (ARN), although
 // it may also be a different identifier depending on the service.
-func listTags(ctx context.Context, conn workspacesiface.WorkSpacesAPI, identifier string) (tftags.KeyValueTags, error) {
+func listTags(ctx context.Context, conn *workspaces.Client, identifier string) (tftags.KeyValueTags, error) {
 	input := &workspaces.DescribeTagsInput{
 		ResourceId: aws.String(identifier),
 	}
 
-	output, err := conn.DescribeTagsWithContext(ctx, input)
+	output, err := conn.DescribeTags(ctx, input)
 
 	if err != nil {
 		return tftags.New(ctx, nil), err
@@ -34,7 +36,7 @@ func listTags(ctx context.Context, conn workspacesiface.WorkSpacesAPI, identifie
 // ListTags lists workspaces service tags and set them in Context.
 // It is called from outside this package.
 func (p *servicePackage) ListTags(ctx context.Context, meta any, identifier string) error {
-	tags, err := listTags(ctx, meta.(*conns.AWSClient).WorkSpacesConn(ctx), identifier)
+	tags, err := listTags(ctx, meta.(*conns.AWSClient).WorkSpacesClient(ctx), identifier)
 
 	if err != nil {
 		return err
@@ -50,11 +52,11 @@ func (p *servicePackage) ListTags(ctx context.Context, meta any, identifier stri
 // []*SERVICE.Tag handling
 
 // Tags returns workspaces service tags.
-func Tags(tags tftags.KeyValueTags) []*workspaces.Tag {
-	result := make([]*workspaces.Tag, 0, len(tags))
+func Tags(tags tftags.KeyValueTags) []awstypes.Tag {
+	result := make([]awstypes.Tag, 0, len(tags))
 
 	for k, v := range tags.Map() {
-		tag := &workspaces.Tag{
+		tag := awstypes.Tag{
 			Key:   aws.String(k),
 			Value: aws.String(v),
 		}
@@ -66,11 +68,11 @@ func Tags(tags tftags.KeyValueTags) []*workspaces.Tag {
 }
 
 // KeyValueTags creates tftags.KeyValueTags from workspaces service tags.
-func KeyValueTags(ctx context.Context, tags []*workspaces.Tag) tftags.KeyValueTags {
+func KeyValueTags(ctx context.Context, tags []awstypes.Tag) tftags.KeyValueTags {
 	m := make(map[string]*string, len(tags))
 
 	for _, tag := range tags {
-		m[aws.StringValue(tag.Key)] = tag.Value
+		m[aws.ToString(tag.Key)] = tag.Value
 	}
 
 	return tftags.New(ctx, m)
@@ -78,7 +80,7 @@ func KeyValueTags(ctx context.Context, tags []*workspaces.Tag) tftags.KeyValueTa
 
 // getTagsIn returns workspaces service tags from Context.
 // nil is returned if there are no input tags.
-func getTagsIn(ctx context.Context) []*workspaces.Tag {
+func getTagsIn(ctx context.Context) []awstypes.Tag {
 	if inContext, ok := tftags.FromContext(ctx); ok {
 		if tags := Tags(inContext.TagsIn.UnwrapOrDefault()); len(tags) > 0 {
 			return tags
@@ -89,7 +91,7 @@ func getTagsIn(ctx context.Context) []*workspaces.Tag {
 }
 
 // setTagsOut sets workspaces service tags in Context.
-func setTagsOut(ctx context.Context, tags []*workspaces.Tag) {
+func setTagsOut(ctx context.Context, tags []awstypes.Tag) {
 	if inContext, ok := tftags.FromContext(ctx); ok {
 		inContext.TagsOut = types.Some(KeyValueTags(ctx, tags))
 	}
@@ -98,19 +100,21 @@ func setTagsOut(ctx context.Context, tags []*workspaces.Tag) {
 // updateTags updates workspaces service tags.
 // The identifier is typically the Amazon Resource Name (ARN), although
 // it may also be a different identifier depending on the service.
-func updateTags(ctx context.Context, conn workspacesiface.WorkSpacesAPI, identifier string, oldTagsMap, newTagsMap any) error {
+func updateTags(ctx context.Context, conn *workspaces.Client, identifier string, oldTagsMap, newTagsMap any) error {
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.WorkSpaces)
 	if len(removedTags) > 0 {
 		input := &workspaces.DeleteTagsInput{
 			ResourceId: aws.String(identifier),
-			TagKeys:    aws.StringSlice(removedTags.Keys()),
+			TagKeys:    removedTags.Keys(),
 		}
 
-		_, err := conn.DeleteTagsWithContext(ctx, input)
+		_, err := conn.DeleteTags(ctx, input)
 
 		if err != nil {
 			return fmt.Errorf("untagging resource (%s): %w", identifier, err)
@@ -125,7 +129,7 @@ func updateTags(ctx context.Context, conn workspacesiface.WorkSpacesAPI, identif
 			Tags:       Tags(updatedTags),
 		}
 
-		_, err := conn.CreateTagsWithContext(ctx, input)
+		_, err := conn.CreateTags(ctx, input)
 
 		if err != nil {
 			return fmt.Errorf("tagging resource (%s): %w", identifier, err)
@@ -138,5 +142,5 @@ func updateTags(ctx context.Context, conn workspacesiface.WorkSpacesAPI, identif
 // UpdateTags updates workspaces service tags.
 // It is called from outside this package.
 func (p *servicePackage) UpdateTags(ctx context.Context, meta any, identifier string, oldTags, newTags any) error {
-	return updateTags(ctx, meta.(*conns.AWSClient).WorkSpacesConn(ctx), identifier, oldTags, newTags)
+	return updateTags(ctx, meta.(*conns.AWSClient).WorkSpacesClient(ctx), identifier, oldTags, newTags)
 }
diff --git a/internal/service/workspaces/wait.go b/internal/service/workspaces/wait.go
index c0bbbfb200b..820305d6cd9 100644
--- a/internal/service/workspaces/wait.go
+++ b/internal/service/workspaces/wait.go
@@ -1,11 +1,16 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package workspaces
 
 import (
 	"context"
 	"time"
 
-	"github.com/aws/aws-sdk-go/service/workspaces"
+	"github.com/aws/aws-sdk-go-v2/service/workspaces"
+	"github.com/aws/aws-sdk-go-v2/service/workspaces/types"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
+	"github.com/hashicorp/terraform-provider-aws/internal/enum"
 )
 
 const (
@@ -31,30 +36,30 @@ const (
 	WorkspaceTerminatedTimeout = 10 * time.Minute
 )
 
-func WaitDirectoryRegistered(ctx context.Context, conn *workspaces.WorkSpaces, directoryID string) (*workspaces.WorkspaceDirectory, error) {
+func WaitDirectoryRegistered(ctx context.Context, conn *workspaces.Client, directoryID string) (*types.WorkspaceDirectory, error) {
 	stateConf := &retry.StateChangeConf{
-		Pending: []string{workspaces.WorkspaceDirectoryStateRegistering},
-		Target:  []string{workspaces.WorkspaceDirectoryStateRegistered},
+		Pending: enum.Slice(types.WorkspaceDirectoryStateRegistering),
+		Target:  enum.Slice(types.WorkspaceDirectoryStateRegistered),
 		Refresh: StatusDirectoryState(ctx, conn, directoryID),
 		Timeout: DirectoryRegisteredTimeout,
 	}
 
 	outputRaw, err := stateConf.WaitForStateContext(ctx)
 
-	if v, ok := outputRaw.(*workspaces.WorkspaceDirectory); ok {
+	if v, ok := outputRaw.(*types.WorkspaceDirectory); ok {
 		return v, err
 	}
 
 	return nil, err
 }
 
-func WaitDirectoryDeregistered(ctx context.Context, conn *workspaces.WorkSpaces, directoryID string) (*workspaces.WorkspaceDirectory, error) {
+func WaitDirectoryDeregistered(ctx context.Context, conn *workspaces.Client, directoryID string) (*types.WorkspaceDirectory, error) {
 	stateConf := &retry.StateChangeConf{
-		Pending: []string{
-			workspaces.WorkspaceDirectoryStateRegistering,
-			workspaces.WorkspaceDirectoryStateRegistered,
-			workspaces.WorkspaceDirectoryStateDeregistering,
-		},
+		Pending: enum.Slice(
+			types.WorkspaceDirectoryStateRegistering,
+			types.WorkspaceDirectoryStateRegistered,
+			types.WorkspaceDirectoryStateDeregistering,
+		),
 		Target:  []string{},
 		Refresh: StatusDirectoryState(ctx, conn, directoryID),
 		Timeout: DirectoryDeregisteredTimeout,
@@ -62,78 +67,78 @@ func WaitDirectoryDeregistered(ctx context.Context, conn *workspaces.WorkSpaces,
 
 	outputRaw, err := stateConf.WaitForStateContext(ctx)
 
-	if v, ok := outputRaw.(*workspaces.WorkspaceDirectory); ok {
+	if v, ok := outputRaw.(*types.WorkspaceDirectory); ok {
 		return v, err
 	}
 
 	return nil, err
 }
 
-func WaitWorkspaceAvailable(ctx context.Context, conn *workspaces.WorkSpaces, workspaceID string, timeout time.Duration) (*workspaces.Workspace, error) {
+func WaitWorkspaceAvailable(ctx context.Context, conn *workspaces.Client, workspaceID string, timeout time.Duration) (*types.Workspace, error) {
 	stateConf := &retry.StateChangeConf{
-		Pending: []string{
-			workspaces.WorkspaceStatePending,
-			workspaces.WorkspaceStateStarting,
-		},
-		Target:  []string{workspaces.WorkspaceStateAvailable},
+		Pending: enum.Slice(
+			types.WorkspaceStatePending,
+			types.WorkspaceStateStarting,
+		),
+		Target:  enum.Slice(types.WorkspaceStateAvailable),
 		Refresh: StatusWorkspaceState(ctx, conn, workspaceID),
 		Timeout: timeout,
 	}
 
 	outputRaw, err := stateConf.WaitForStateContext(ctx)
 
-	if v, ok := outputRaw.(*workspaces.Workspace); ok {
+	if v, ok := outputRaw.(*types.Workspace); ok {
 		return v, err
 	}
 
 	return nil, err
 }
 
-func WaitWorkspaceTerminated(ctx context.Context, conn *workspaces.WorkSpaces, workspaceID string, timeout time.Duration) (*workspaces.Workspace, error) {
+func WaitWorkspaceTerminated(ctx context.Context, conn *workspaces.Client, workspaceID string, timeout time.Duration) (*types.Workspace, error) {
 	stateConf := &retry.StateChangeConf{
-		Pending: []string{
-			workspaces.WorkspaceStatePending,
-			workspaces.WorkspaceStateAvailable,
-			workspaces.WorkspaceStateImpaired,
-			workspaces.WorkspaceStateUnhealthy,
-			workspaces.WorkspaceStateRebooting,
-			workspaces.WorkspaceStateStarting,
-			workspaces.WorkspaceStateRebuilding,
-			workspaces.WorkspaceStateRestoring,
-			workspaces.WorkspaceStateMaintenance,
-			workspaces.WorkspaceStateAdminMaintenance,
-			workspaces.WorkspaceStateSuspended,
-			workspaces.WorkspaceStateUpdating,
-			workspaces.WorkspaceStateStopping,
-			workspaces.WorkspaceStateStopped,
-			workspaces.WorkspaceStateTerminating,
-			workspaces.WorkspaceStateError,
-		},
-		Target:  []string{workspaces.WorkspaceStateTerminated},
+		Pending: enum.Slice(
+			types.WorkspaceStatePending,
+			types.WorkspaceStateAvailable,
+			types.WorkspaceStateImpaired,
+			types.WorkspaceStateUnhealthy,
+			types.WorkspaceStateRebooting,
+			types.WorkspaceStateStarting,
+			types.WorkspaceStateRebuilding,
+			types.WorkspaceStateRestoring,
+			types.WorkspaceStateMaintenance,
+			types.WorkspaceStateAdminMaintenance,
+			types.WorkspaceStateSuspended,
+			types.WorkspaceStateUpdating,
+			types.WorkspaceStateStopping,
+			types.WorkspaceStateStopped,
+			types.WorkspaceStateTerminating,
+			types.WorkspaceStateError,
+		),
+		Target:  enum.Slice(types.WorkspaceStateTerminated),
 		Refresh: StatusWorkspaceState(ctx, conn, workspaceID),
 		Timeout: timeout,
 	}
 
 	outputRaw, err := stateConf.WaitForStateContext(ctx)
 
-	if v, ok := outputRaw.(*workspaces.Workspace); ok {
+	if v, ok := outputRaw.(*types.Workspace); ok {
 		return v, err
 	}
 
 	return nil, err
 }
 
-func WaitWorkspaceUpdated(ctx context.Context, conn *workspaces.WorkSpaces, workspaceID string, timeout time.Duration) (*workspaces.Workspace, error) {
+func WaitWorkspaceUpdated(ctx context.Context, conn *workspaces.Client, workspaceID string, timeout time.Duration) (*types.Workspace, error) {
 	// OperationInProgressException: The properties of this WorkSpace are currently under modification. Please try again in a moment.
 	// AWS Workspaces service doesn't change instance status to "Updating" during property modification. Respective AWS Support feature request has been created. Meanwhile, artificial delay is placed here as a workaround.
 	stateConf := &retry.StateChangeConf{
-		Pending: []string{
-			workspaces.WorkspaceStateUpdating,
-		},
-		Target: []string{
-			workspaces.WorkspaceStateAvailable,
-			workspaces.WorkspaceStateStopped,
-		},
+		Pending: enum.Slice(
+			types.WorkspaceStateUpdating,
+		),
+		Target: enum.Slice(
+			types.WorkspaceStateAvailable,
+			types.WorkspaceStateStopped,
+		),
 		Refresh: StatusWorkspaceState(ctx, conn, workspaceID),
 		Delay:   WorkspaceUpdatingDelay,
 		Timeout: timeout,
@@ -141,7 +146,7 @@ func WaitWorkspaceUpdated(ctx context.Context, conn *workspaces.WorkSpaces, work
 
 	outputRaw, err := stateConf.WaitForStateContext(ctx)
 
-	if v, ok := outputRaw.(*workspaces.Workspace); ok {
+	if v, ok := outputRaw.(*types.Workspace); ok {
 		return v, err
 	}
 
diff --git a/internal/service/workspaces/workspace.go b/internal/service/workspaces/workspace.go
index 281875c0059..f15207b4379 100644
--- a/internal/service/workspaces/workspace.go
+++ b/internal/service/workspaces/workspace.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package workspaces
 
 import (
@@ -6,12 +9,14 @@ import (
 	"log"
 	"time"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/workspaces"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/workspaces"
+	"github.com/aws/aws-sdk-go-v2/service/workspaces/types"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/enum"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
@@ -84,8 +89,8 @@ func ResourceWorkspace() *schema.Resource {
 						"compute_type_name": {
 							Type:         schema.TypeString,
 							Optional:     true,
-							Default:      workspaces.ComputeValue,
-							ValidateFunc: validation.StringInSlice(workspaces.Compute_Values(), false),
+							Default:      string(types.ComputeValue),
+							ValidateFunc: validation.StringInSlice(flattenComputeEnumValues(types.Compute("").Values()), false),
 						},
 						"root_volume_size_gib": {
 							Type:     schema.TypeInt,
@@ -99,11 +104,11 @@ func ResourceWorkspace() *schema.Resource {
 						"running_mode": {
 							Type:     schema.TypeString,
 							Optional: true,
-							Default:  workspaces.RunningModeAlwaysOn,
-							ValidateFunc: validation.StringInSlice([]string{
-								workspaces.RunningModeAlwaysOn,
-								workspaces.RunningModeAutoStop,
-							}, false),
+							Default:  string(types.RunningModeAlwaysOn),
+							ValidateFunc: validation.StringInSlice(enum.Slice(
+								types.RunningModeAlwaysOn,
+								types.RunningModeAutoStop,
+							), false),
 						},
 						"running_mode_auto_stop_timeout_in_minutes": {
 							Type:     schema.TypeInt,
@@ -145,9 +150,9 @@ func ResourceWorkspace() *schema.Resource {
 
 func resourceWorkspaceCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).WorkSpacesConn(ctx)
+	conn := meta.(*conns.AWSClient).WorkSpacesClient(ctx)
 
-	input := &workspaces.WorkspaceRequest{
+	input := types.WorkspaceRequest{
 		BundleId:                    aws.String(d.Get("bundle_id").(string)),
 		DirectoryId:                 aws.String(d.Get("directory_id").(string)),
 		UserName:                    aws.String(d.Get("user_name").(string)),
@@ -162,8 +167,8 @@ func resourceWorkspaceCreate(ctx context.Context, d *schema.ResourceData, meta i
 
 	input.WorkspaceProperties = ExpandWorkspaceProperties(d.Get("workspace_properties").([]interface{}))
 
-	resp, err := conn.CreateWorkspacesWithContext(ctx, &workspaces.CreateWorkspacesInput{
-		Workspaces: []*workspaces.WorkspaceRequest{input},
+	resp, err := conn.CreateWorkspaces(ctx, &workspaces.CreateWorkspacesInput{
+		Workspaces: []types.WorkspaceRequest{input},
 	})
 	if err != nil {
 		return sdkdiag.AppendErrorf(diags, "creating WorkSpaces Workspace: %s", err)
@@ -171,10 +176,10 @@ func resourceWorkspaceCreate(ctx context.Context, d *schema.ResourceData, meta i
 
 	wsFail := resp.FailedRequests
 	if len(wsFail) > 0 {
-		return sdkdiag.AppendErrorf(diags, "creating WorkSpaces Workspace: %s: %s", aws.StringValue(wsFail[0].ErrorCode), aws.StringValue(wsFail[0].ErrorMessage))
+		return sdkdiag.AppendErrorf(diags, "creating WorkSpaces Workspace: %s: %s", aws.ToString(wsFail[0].ErrorCode), aws.ToString(wsFail[0].ErrorMessage))
 	}
 
-	workspaceID := aws.StringValue(resp.PendingRequests[0].WorkspaceId)
+	workspaceID := aws.ToString(resp.PendingRequests[0].WorkspaceId)
 	d.SetId(workspaceID)
 
 	_, err = WaitWorkspaceAvailable(ctx, conn, workspaceID, d.Timeout(schema.TimeoutCreate))
@@ -187,19 +192,19 @@ func resourceWorkspaceCreate(ctx context.Context, d *schema.ResourceData, meta i
 
 func resourceWorkspaceRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).WorkSpacesConn(ctx)
+	conn := meta.(*conns.AWSClient).WorkSpacesClient(ctx)
 
 	rawOutput, state, err := StatusWorkspaceState(ctx, conn, d.Id())()
 	if err != nil {
 		return sdkdiag.AppendErrorf(diags, "reading WorkSpaces Workspace (%s): %s", d.Id(), err)
 	}
-	if state == workspaces.WorkspaceStateTerminated {
+	if state == string(types.WorkspaceStateTerminated) {
 		log.Printf("[WARN] WorkSpaces Workspace (%s) not found, removing from state", d.Id())
 		d.SetId("")
 		return diags
 	}
 
-	workspace := rawOutput.(*workspaces.Workspace)
+	workspace := rawOutput.(types.Workspace)
 	d.Set("bundle_id", workspace.BundleId)
 	d.Set("directory_id", workspace.DirectoryId)
 	d.Set("ip_address", workspace.IpAddress)
@@ -218,7 +223,7 @@ func resourceWorkspaceRead(ctx context.Context, d *schema.ResourceData, meta int
 
 func resourceWorkspaceUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).WorkSpacesConn(ctx)
+	conn := meta.(*conns.AWSClient).WorkSpacesClient(ctx)
 
 	// IMPORTANT: Only one workspace property could be changed in a time.
 	// I've create AWS Support feature request to allow multiple properties modification in a time.
@@ -259,7 +264,7 @@ func resourceWorkspaceUpdate(ctx context.Context, d *schema.ResourceData, meta i
 
 func resourceWorkspaceDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).WorkSpacesConn(ctx)
+	conn := meta.(*conns.AWSClient).WorkSpacesClient(ctx)
 
 	if err := WorkspaceDelete(ctx, conn, d.Id(), d.Timeout(schema.TimeoutDelete)); err != nil {
 		return sdkdiag.AppendFromErr(diags, err)
@@ -267,9 +272,9 @@ func resourceWorkspaceDelete(ctx context.Context, d *schema.ResourceData, meta i
 	return diags
 }
 
-func WorkspaceDelete(ctx context.Context, conn *workspaces.WorkSpaces, id string, timeout time.Duration) error {
-	resp, err := conn.TerminateWorkspacesWithContext(ctx, &workspaces.TerminateWorkspacesInput{
-		TerminateWorkspaceRequests: []*workspaces.TerminateRequest{
+func WorkspaceDelete(ctx context.Context, conn *workspaces.Client, id string, timeout time.Duration) error {
+	resp, err := conn.TerminateWorkspaces(ctx, &workspaces.TerminateWorkspacesInput{
+		TerminateWorkspaceRequests: []types.TerminateRequest{
 			{
 				WorkspaceId: aws.String(id),
 			},
@@ -281,7 +286,7 @@ func WorkspaceDelete(ctx context.Context, conn *workspaces.WorkSpaces, id string
 
 	wsFail := resp.FailedRequests
 	if len(wsFail) > 0 {
-		return fmt.Errorf("deleting WorkSpaces Workspace (%s): %s: %s", id, aws.StringValue(wsFail[0].ErrorCode), aws.StringValue(wsFail[0].ErrorMessage))
+		return fmt.Errorf("deleting WorkSpaces Workspace (%s): %s: %s", id, aws.ToString(wsFail[0].ErrorCode), aws.ToString(wsFail[0].ErrorMessage))
 	}
 
 	_, err = WaitWorkspaceTerminated(ctx, conn, id, timeout)
@@ -292,40 +297,40 @@ func WorkspaceDelete(ctx context.Context, conn *workspaces.WorkSpaces, id string
 	return nil
 }
 
-func workspacePropertyUpdate(ctx context.Context, p string, conn *workspaces.WorkSpaces, d *schema.ResourceData) error {
+func workspacePropertyUpdate(ctx context.Context, p string, conn *workspaces.Client, d *schema.ResourceData) error {
 	id := d.Id()
 
-	var wsp *workspaces.WorkspaceProperties
+	var wsp *types.WorkspaceProperties
 
 	switch p {
 	case "compute_type_name":
-		wsp = &workspaces.WorkspaceProperties{
-			ComputeTypeName: aws.String(d.Get("workspace_properties.0.compute_type_name").(string)),
+		wsp = &types.WorkspaceProperties{
+			ComputeTypeName: types.Compute(d.Get("workspace_properties.0.compute_type_name").(string)),
 		}
 	case "root_volume_size_gib":
-		wsp = &workspaces.WorkspaceProperties{
-			RootVolumeSizeGib: aws.Int64(int64(d.Get("workspace_properties.0.root_volume_size_gib").(int))),
+		wsp = &types.WorkspaceProperties{
+			RootVolumeSizeGib: aws.Int32(int32(d.Get("workspace_properties.0.root_volume_size_gib").(int))),
 		}
 	case "running_mode":
-		wsp = &workspaces.WorkspaceProperties{
-			RunningMode: aws.String(d.Get("workspace_properties.0.running_mode").(string)),
+		wsp = &types.WorkspaceProperties{
+			RunningMode: types.RunningMode(d.Get("workspace_properties.0.running_mode").(string)),
 		}
 	case "running_mode_auto_stop_timeout_in_minutes":
-		if d.Get("workspace_properties.0.running_mode") != workspaces.RunningModeAutoStop {
+		if d.Get("workspace_properties.0.running_mode") != types.RunningModeAutoStop {
 			log.Printf("[DEBUG] Property running_mode_auto_stop_timeout_in_minutes makes sense only for AUTO_STOP running mode")
 			return nil
 		}
 
-		wsp = &workspaces.WorkspaceProperties{
-			RunningModeAutoStopTimeoutInMinutes: aws.Int64(int64(d.Get("workspace_properties.0.running_mode_auto_stop_timeout_in_minutes").(int))),
+		wsp = &types.WorkspaceProperties{
+			RunningModeAutoStopTimeoutInMinutes: aws.Int32(int32(d.Get("workspace_properties.0.running_mode_auto_stop_timeout_in_minutes").(int))),
 		}
 	case "user_volume_size_gib":
-		wsp = &workspaces.WorkspaceProperties{
-			UserVolumeSizeGib: aws.Int64(int64(d.Get("workspace_properties.0.user_volume_size_gib").(int))),
+		wsp = &types.WorkspaceProperties{
+			UserVolumeSizeGib: aws.Int32(int32(d.Get("workspace_properties.0.user_volume_size_gib").(int))),
 		}
 	}
 
-	_, err := conn.ModifyWorkspacePropertiesWithContext(ctx, &workspaces.ModifyWorkspacePropertiesInput{
+	_, err := conn.ModifyWorkspaceProperties(ctx, &workspaces.ModifyWorkspacePropertiesInput{
 		WorkspaceId:         aws.String(id),
 		WorkspaceProperties: wsp,
 	})
@@ -341,7 +346,7 @@ func workspacePropertyUpdate(ctx context.Context, p string, conn *workspaces.Wor
 	return nil
 }
 
-func ExpandWorkspaceProperties(properties []interface{}) *workspaces.WorkspaceProperties {
+func ExpandWorkspaceProperties(properties []interface{}) *types.WorkspaceProperties {
 	log.Printf("[DEBUG] Expand Workspace properties: %+v ", properties)
 
 	if len(properties) == 0 || properties[0] == nil {
@@ -350,21 +355,21 @@ func ExpandWorkspaceProperties(properties []interface{}) *workspaces.WorkspacePr
 
 	p := properties[0].(map[string]interface{})
 
-	workspaceProperties := &workspaces.WorkspaceProperties{
-		ComputeTypeName:   aws.String(p["compute_type_name"].(string)),
-		RootVolumeSizeGib: aws.Int64(int64(p["root_volume_size_gib"].(int))),
-		RunningMode:       aws.String(p["running_mode"].(string)),
-		UserVolumeSizeGib: aws.Int64(int64(p["user_volume_size_gib"].(int))),
+	workspaceProperties := &types.WorkspaceProperties{
+		ComputeTypeName:   types.Compute(p["compute_type_name"].(string)),
+		RootVolumeSizeGib: aws.Int32(int32(p["root_volume_size_gib"].(int))),
+		RunningMode:       types.RunningMode(p["running_mode"].(string)),
+		UserVolumeSizeGib: aws.Int32(int32(p["user_volume_size_gib"].(int))),
 	}
 
-	if p["running_mode"].(string) == workspaces.RunningModeAutoStop {
-		workspaceProperties.RunningModeAutoStopTimeoutInMinutes = aws.Int64(int64(p["running_mode_auto_stop_timeout_in_minutes"].(int)))
+	if p["running_mode"].(string) == string(types.RunningModeAutoStop) {
+		workspaceProperties.RunningModeAutoStopTimeoutInMinutes = aws.Int32(int32(p["running_mode_auto_stop_timeout_in_minutes"].(int)))
 	}
 
 	return workspaceProperties
 }
 
-func FlattenWorkspaceProperties(properties *workspaces.WorkspaceProperties) []map[string]interface{} {
+func FlattenWorkspaceProperties(properties *types.WorkspaceProperties) []map[string]interface{} {
 	log.Printf("[DEBUG] Flatten workspace properties: %+v ", properties)
 
 	if properties == nil {
@@ -373,11 +378,21 @@ func FlattenWorkspaceProperties(properties *workspaces.WorkspaceProperties) []ma
 
 	return []map[string]interface{}{
 		{
-			"compute_type_name":                         aws.StringValue(properties.ComputeTypeName),
-			"root_volume_size_gib":                      int(aws.Int64Value(properties.RootVolumeSizeGib)),
-			"running_mode":                              aws.StringValue(properties.RunningMode),
-			"running_mode_auto_stop_timeout_in_minutes": int(aws.Int64Value(properties.RunningModeAutoStopTimeoutInMinutes)),
-			"user_volume_size_gib":                      int(aws.Int64Value(properties.UserVolumeSizeGib)),
+			"compute_type_name":                         string(properties.ComputeTypeName),
+			"root_volume_size_gib":                      int(aws.ToInt32(properties.RootVolumeSizeGib)),
+			"running_mode":                              string(properties.RunningMode),
+			"running_mode_auto_stop_timeout_in_minutes": int(aws.ToInt32(properties.RunningModeAutoStopTimeoutInMinutes)),
+			"user_volume_size_gib":                      int(aws.ToInt32(properties.UserVolumeSizeGib)),
 		},
 	}
 }
+
+func flattenComputeEnumValues(t []types.Compute) []string {
+	var out []string
+
+	for _, v := range t {
+		out = append(out, string(v))
+	}
+
+	return out
+}
diff --git a/internal/service/workspaces/workspace_data_source.go b/internal/service/workspaces/workspace_data_source.go
index c29457e19c1..dca2e5eaaac 100644
--- a/internal/service/workspaces/workspace_data_source.go
+++ b/internal/service/workspaces/workspace_data_source.go
@@ -1,10 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package workspaces
 
 import (
 	"context"
+	"reflect"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/workspaces"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/workspaces"
+	"github.com/aws/aws-sdk-go-v2/service/workspaces/types"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
@@ -101,14 +106,14 @@ func DataSourceWorkspace() *schema.Resource {
 
 func dataSourceWorkspaceRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	var diags diag.Diagnostics
-	conn := meta.(*conns.AWSClient).WorkSpacesConn(ctx)
+	conn := meta.(*conns.AWSClient).WorkSpacesClient(ctx)
 	ignoreTagsConfig := meta.(*conns.AWSClient).IgnoreTagsConfig
 
-	var workspace *workspaces.Workspace
+	var workspace types.Workspace
 
 	if workspaceID, ok := d.GetOk("workspace_id"); ok {
-		resp, err := conn.DescribeWorkspacesWithContext(ctx, &workspaces.DescribeWorkspacesInput{
-			WorkspaceIds: aws.StringSlice([]string{workspaceID.(string)}),
+		resp, err := conn.DescribeWorkspaces(ctx, &workspaces.DescribeWorkspacesInput{
+			WorkspaceIds: []string{workspaceID.(string)},
 		})
 		if err != nil {
 			return sdkdiag.AppendErrorf(diags, "reading WorkSpaces Workspace (%s): %s", workspaceID, err)
@@ -120,14 +125,14 @@ func dataSourceWorkspaceRead(ctx context.Context, d *schema.ResourceData, meta i
 
 		workspace = resp.Workspaces[0]
 
-		if workspace == nil {
+		if reflect.DeepEqual(workspace, (types.Workspace{})) {
 			return sdkdiag.AppendErrorf(diags, "no WorkSpaces Workspace with ID %q found", workspaceID)
 		}
 	}
 
 	if directoryID, ok := d.GetOk("directory_id"); ok {
 		userName := d.Get("user_name").(string)
-		resp, err := conn.DescribeWorkspacesWithContext(ctx, &workspaces.DescribeWorkspacesInput{
+		resp, err := conn.DescribeWorkspaces(ctx, &workspaces.DescribeWorkspacesInput{
 			DirectoryId: aws.String(directoryID.(string)),
 			UserName:    aws.String(userName),
 		})
@@ -141,12 +146,12 @@ func dataSourceWorkspaceRead(ctx context.Context, d *schema.ResourceData, meta i
 
 		workspace = resp.Workspaces[0]
 
-		if workspace == nil {
+		if reflect.DeepEqual(workspace, (types.Workspace{})) {
 			return sdkdiag.AppendErrorf(diags, "no %q Workspace in %q directory found", userName, directoryID)
 		}
 	}
 
-	d.SetId(aws.StringValue(workspace.WorkspaceId))
+	d.SetId(aws.ToString(workspace.WorkspaceId))
 	d.Set("bundle_id", workspace.BundleId)
 	d.Set("directory_id", workspace.DirectoryId)
 	d.Set("ip_address", workspace.IpAddress)
diff --git a/internal/service/workspaces/workspace_data_source_test.go b/internal/service/workspaces/workspace_data_source_test.go
index 4a9b3078050..e95c32e8e4c 100644
--- a/internal/service/workspaces/workspace_data_source_test.go
+++ b/internal/service/workspaces/workspace_data_source_test.go
@@ -1,10 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package workspaces_test
 
 import (
-	"regexp"
+	"strings"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/service/workspaces"
+	"github.com/YakDriver/regexache"
+	"github.com/aws/aws-sdk-go-v2/service/workspaces"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
@@ -19,7 +23,7 @@ func testAccWorkspaceDataSource_byWorkspaceID(t *testing.T) {
 
 	resource.Test(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckHasIAMRole(ctx, t, "workspaces_DefaultRole") },
-		ErrorCheck:               acctest.ErrorCheck(t, workspaces.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, strings.ToLower(workspaces.ServiceID)),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		Steps: []resource.TestStep{
 			{
@@ -54,7 +58,7 @@ func testAccWorkspaceDataSource_byDirectoryID_userName(t *testing.T) {
 
 	resource.Test(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckHasIAMRole(ctx, t, "workspaces_DefaultRole") },
-		ErrorCheck:               acctest.ErrorCheck(t, workspaces.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, strings.ToLower(workspaces.ServiceID)),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		Steps: []resource.TestStep{
 			{
@@ -85,12 +89,12 @@ func testAccWorkspaceDataSource_workspaceIDAndDirectoryIDConflict(t *testing.T)
 
 	resource.Test(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t); acctest.PreCheckHasIAMRole(ctx, t, "workspaces_DefaultRole") },
-		ErrorCheck:               acctest.ErrorCheck(t, workspaces.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, strings.ToLower(workspaces.ServiceID)),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccWorkspaceDataSourceConfig_idAndDirectoryIDConflict(),
-				ExpectError: regexp.MustCompile("\"workspace_id\": conflicts with directory_id"),
+				ExpectError: regexache.MustCompile("\"workspace_id\": conflicts with directory_id"),
 			},
 		},
 	})
diff --git a/internal/service/workspaces/workspace_test.go b/internal/service/workspaces/workspace_test.go
index 2b32e7eff77..863b402d86a 100644
--- a/internal/service/workspaces/workspace_test.go
+++ b/internal/service/workspaces/workspace_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package workspaces_test
 
 import (
@@ -5,10 +8,13 @@ import (
 	"fmt"
 	"reflect"
 	"regexp"
+	"strings"
 	"testing"
 
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/service/workspaces"
+	"github.com/YakDriver/regexache"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/workspaces"
+	"github.com/aws/aws-sdk-go-v2/service/workspaces/types"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/terraform"
@@ -19,7 +25,7 @@ import (
 
 func testAccWorkspace_basic(t *testing.T) {
 	ctx := acctest.Context(t)
-	var v workspaces.Workspace
+	var v types.Workspace
 	rName := sdkacctest.RandString(8)
 	domain := acctest.RandomDomainName()
 
@@ -34,7 +40,7 @@ func testAccWorkspace_basic(t *testing.T) {
 			acctest.PreCheckDirectoryServiceSimpleDirectory(ctx, t)
 			acctest.PreCheckHasIAMRole(ctx, t, "workspaces_DefaultRole")
 		},
-		ErrorCheck:               acctest.ErrorCheck(t, workspaces.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, strings.ToLower(workspaces.ServiceID)),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckWorkspaceDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -45,15 +51,15 @@ func testAccWorkspace_basic(t *testing.T) {
 					testAccCheckWorkspaceExists(ctx, resourceName, &v),
 					resource.TestCheckResourceAttrPair(resourceName, "directory_id", directoryResourceName, "id"),
 					resource.TestCheckResourceAttrPair(resourceName, "bundle_id", bundleDataSourceName, "id"),
-					resource.TestMatchResourceAttr(resourceName, "ip_address", regexp.MustCompile(`\d+\.\d+\.\d+\.\d+`)),
-					resource.TestCheckResourceAttr(resourceName, "state", workspaces.WorkspaceStateAvailable),
+					resource.TestMatchResourceAttr(resourceName, "ip_address", regexache.MustCompile(`\d+\.\d+\.\d+\.\d+`)),
+					resource.TestCheckResourceAttr(resourceName, "state", string(types.WorkspaceStateAvailable)),
 					resource.TestCheckResourceAttr(resourceName, "root_volume_encryption_enabled", "false"),
 					resource.TestCheckResourceAttr(resourceName, "user_name", "Administrator"),
 					resource.TestCheckResourceAttr(resourceName, "volume_encryption_key", ""),
 					resource.TestCheckResourceAttr(resourceName, "workspace_properties.#", "1"),
-					resource.TestCheckResourceAttr(resourceName, "workspace_properties.0.compute_type_name", workspaces.ComputeValue),
+					resource.TestCheckResourceAttr(resourceName, "workspace_properties.0.compute_type_name", string(types.ComputeValue)),
 					resource.TestCheckResourceAttr(resourceName, "workspace_properties.0.root_volume_size_gib", "80"),
-					resource.TestCheckResourceAttr(resourceName, "workspace_properties.0.running_mode", workspaces.RunningModeAlwaysOn),
+					resource.TestCheckResourceAttr(resourceName, "workspace_properties.0.running_mode", string(types.RunningModeAlwaysOn)),
 					resource.TestCheckResourceAttr(resourceName, "workspace_properties.0.running_mode_auto_stop_timeout_in_minutes", "0"),
 					resource.TestCheckResourceAttr(resourceName, "workspace_properties.0.user_volume_size_gib", "10"),
 					resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
@@ -71,7 +77,7 @@ func testAccWorkspace_basic(t *testing.T) {
 
 func testAccWorkspace_tags(t *testing.T) {
 	ctx := acctest.Context(t)
-	var v1, v2, v3 workspaces.Workspace
+	var v1, v2, v3 types.Workspace
 	rName := sdkacctest.RandString(8)
 	domain := acctest.RandomDomainName()
 
@@ -84,7 +90,7 @@ func testAccWorkspace_tags(t *testing.T) {
 			acctest.PreCheckDirectoryServiceSimpleDirectory(ctx, t)
 			acctest.PreCheckHasIAMRole(ctx, t, "workspaces_DefaultRole")
 		},
-		ErrorCheck:               acctest.ErrorCheck(t, workspaces.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, strings.ToLower(workspaces.ServiceID)),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckWorkspaceDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -125,7 +131,7 @@ func testAccWorkspace_tags(t *testing.T) {
 
 func testAccWorkspace_workspaceProperties(t *testing.T) {
 	ctx := acctest.Context(t)
-	var v1, v2, v3 workspaces.Workspace
+	var v1, v2, v3 types.Workspace
 	rName := sdkacctest.RandString(8)
 	domain := acctest.RandomDomainName()
 
@@ -138,7 +144,7 @@ func testAccWorkspace_workspaceProperties(t *testing.T) {
 			acctest.PreCheckDirectoryServiceSimpleDirectory(ctx, t)
 			acctest.PreCheckHasIAMRole(ctx, t, "workspaces_DefaultRole")
 		},
-		ErrorCheck:               acctest.ErrorCheck(t, workspaces.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, strings.ToLower(workspaces.ServiceID)),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckWorkspaceDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -148,9 +154,9 @@ func testAccWorkspace_workspaceProperties(t *testing.T) {
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckWorkspaceExists(ctx, resourceName, &v1),
 					resource.TestCheckResourceAttr(resourceName, "workspace_properties.#", "1"),
-					resource.TestCheckResourceAttr(resourceName, "workspace_properties.0.compute_type_name", workspaces.ComputeValue),
+					resource.TestCheckResourceAttr(resourceName, "workspace_properties.0.compute_type_name", string(types.ComputeValue)),
 					resource.TestCheckResourceAttr(resourceName, "workspace_properties.0.root_volume_size_gib", "80"),
-					resource.TestCheckResourceAttr(resourceName, "workspace_properties.0.running_mode", workspaces.RunningModeAutoStop),
+					resource.TestCheckResourceAttr(resourceName, "workspace_properties.0.running_mode", string(types.RunningModeAutoStop)),
 					resource.TestCheckResourceAttr(resourceName, "workspace_properties.0.running_mode_auto_stop_timeout_in_minutes", "120"),
 					resource.TestCheckResourceAttr(resourceName, "workspace_properties.0.user_volume_size_gib", "10"),
 				),
@@ -165,9 +171,9 @@ func testAccWorkspace_workspaceProperties(t *testing.T) {
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckWorkspaceExists(ctx, resourceName, &v2),
 					resource.TestCheckResourceAttr(resourceName, "workspace_properties.#", "1"),
-					resource.TestCheckResourceAttr(resourceName, "workspace_properties.0.compute_type_name", workspaces.ComputeValue),
+					resource.TestCheckResourceAttr(resourceName, "workspace_properties.0.compute_type_name", string(types.ComputeValue)),
 					resource.TestCheckResourceAttr(resourceName, "workspace_properties.0.root_volume_size_gib", "80"),
-					resource.TestCheckResourceAttr(resourceName, "workspace_properties.0.running_mode", workspaces.RunningModeAlwaysOn),
+					resource.TestCheckResourceAttr(resourceName, "workspace_properties.0.running_mode", string(types.RunningModeAlwaysOn)),
 					resource.TestCheckResourceAttr(resourceName, "workspace_properties.0.running_mode_auto_stop_timeout_in_minutes", "0"),
 					resource.TestCheckResourceAttr(resourceName, "workspace_properties.0.user_volume_size_gib", "10"),
 				),
@@ -177,9 +183,9 @@ func testAccWorkspace_workspaceProperties(t *testing.T) {
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckWorkspaceExists(ctx, resourceName, &v3),
 					resource.TestCheckResourceAttr(resourceName, "workspace_properties.#", "1"),
-					resource.TestCheckResourceAttr(resourceName, "workspace_properties.0.compute_type_name", workspaces.ComputeValue),
+					resource.TestCheckResourceAttr(resourceName, "workspace_properties.0.compute_type_name", string(types.ComputeValue)),
 					resource.TestCheckResourceAttr(resourceName, "workspace_properties.0.root_volume_size_gib", "80"),
-					resource.TestCheckResourceAttr(resourceName, "workspace_properties.0.running_mode", workspaces.RunningModeAlwaysOn),
+					resource.TestCheckResourceAttr(resourceName, "workspace_properties.0.running_mode", string(types.RunningModeAlwaysOn)),
 					resource.TestCheckResourceAttr(resourceName, "workspace_properties.0.running_mode_auto_stop_timeout_in_minutes", "0"),
 					resource.TestCheckResourceAttr(resourceName, "workspace_properties.0.user_volume_size_gib", "10"),
 				),
@@ -193,7 +199,7 @@ func testAccWorkspace_workspaceProperties(t *testing.T) {
 // Reference: https://github.com/hashicorp/terraform-provider-aws/issues/13558
 func testAccWorkspace_workspaceProperties_runningModeAlwaysOn(t *testing.T) {
 	ctx := acctest.Context(t)
-	var v1 workspaces.Workspace
+	var v1 types.Workspace
 	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
 	resourceName := "aws_workspaces_workspace.test"
 	domain := acctest.RandomDomainName()
@@ -205,7 +211,7 @@ func testAccWorkspace_workspaceProperties_runningModeAlwaysOn(t *testing.T) {
 			acctest.PreCheckDirectoryServiceSimpleDirectory(ctx, t)
 			acctest.PreCheckHasIAMRole(ctx, t, "workspaces_DefaultRole")
 		},
-		ErrorCheck:               acctest.ErrorCheck(t, workspaces.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, strings.ToLower(workspaces.ServiceID)),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckWorkspaceDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -214,9 +220,9 @@ func testAccWorkspace_workspaceProperties_runningModeAlwaysOn(t *testing.T) {
 				Check: resource.ComposeAggregateTestCheckFunc(
 					testAccCheckWorkspaceExists(ctx, resourceName, &v1),
 					resource.TestCheckResourceAttr(resourceName, "workspace_properties.#", "1"),
-					resource.TestCheckResourceAttr(resourceName, "workspace_properties.0.compute_type_name", workspaces.ComputeValue),
+					resource.TestCheckResourceAttr(resourceName, "workspace_properties.0.compute_type_name", string(types.ComputeValue)),
 					resource.TestCheckResourceAttr(resourceName, "workspace_properties.0.root_volume_size_gib", "80"),
-					resource.TestCheckResourceAttr(resourceName, "workspace_properties.0.running_mode", workspaces.RunningModeAlwaysOn),
+					resource.TestCheckResourceAttr(resourceName, "workspace_properties.0.running_mode", string(types.RunningModeAlwaysOn)),
 					resource.TestCheckResourceAttr(resourceName, "workspace_properties.0.running_mode_auto_stop_timeout_in_minutes", "0"),
 					resource.TestCheckResourceAttr(resourceName, "workspace_properties.0.user_volume_size_gib", "10"),
 				),
@@ -237,13 +243,13 @@ func testAccWorkspace_validateRootVolumeSize(t *testing.T) {
 
 	resource.Test(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, workspaces.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, strings.ToLower(workspaces.ServiceID)),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckWorkspaceDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccWorkspaceConfig_validateRootVolumeSize(rName, domain),
-				ExpectError: regexp.MustCompile(regexp.QuoteMeta("expected workspace_properties.0.root_volume_size_gib to be one of [80], got 90")),
+				ExpectError: regexache.MustCompile(regexp.QuoteMeta("expected workspace_properties.0.root_volume_size_gib to be one of [80], got 90")),
 			},
 		},
 	})
@@ -256,13 +262,13 @@ func testAccWorkspace_validateUserVolumeSize(t *testing.T) {
 
 	resource.Test(t, resource.TestCase{
 		PreCheck:                 func() { acctest.PreCheck(ctx, t) },
-		ErrorCheck:               acctest.ErrorCheck(t, workspaces.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, strings.ToLower(workspaces.ServiceID)),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckWorkspaceDestroy(ctx),
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccWorkspaceConfig_validateUserVolumeSize(rName, domain),
-				ExpectError: regexp.MustCompile(regexp.QuoteMeta("workspace_properties.0.user_volume_size_gib to be one of [10 50], got 60")),
+				ExpectError: regexache.MustCompile(regexp.QuoteMeta("workspace_properties.0.user_volume_size_gib to be one of [10 50], got 60")),
 			},
 		},
 	})
@@ -270,7 +276,7 @@ func testAccWorkspace_validateUserVolumeSize(t *testing.T) {
 
 func testAccWorkspace_recreate(t *testing.T) {
 	ctx := acctest.Context(t)
-	var v workspaces.Workspace
+	var v types.Workspace
 	rName := sdkacctest.RandString(8)
 	domain := acctest.RandomDomainName()
 
@@ -283,7 +289,7 @@ func testAccWorkspace_recreate(t *testing.T) {
 			acctest.PreCheckDirectoryServiceSimpleDirectory(ctx, t)
 			acctest.PreCheckHasIAMRole(ctx, t, "workspaces_DefaultRole")
 		},
-		ErrorCheck:               acctest.ErrorCheck(t, workspaces.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, strings.ToLower(workspaces.ServiceID)),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckWorkspaceDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -306,7 +312,7 @@ func testAccWorkspace_recreate(t *testing.T) {
 
 func testAccWorkspace_timeout(t *testing.T) {
 	ctx := acctest.Context(t)
-	var v workspaces.Workspace
+	var v types.Workspace
 	rName := sdkacctest.RandString(8)
 	domain := acctest.RandomDomainName()
 
@@ -319,7 +325,7 @@ func testAccWorkspace_timeout(t *testing.T) {
 			acctest.PreCheckDirectoryServiceSimpleDirectory(ctx, t)
 			acctest.PreCheckHasIAMRole(ctx, t, "workspaces_DefaultRole")
 		},
-		ErrorCheck:               acctest.ErrorCheck(t, workspaces.EndpointsID),
+		ErrorCheck:               acctest.ErrorCheck(t, strings.ToLower(workspaces.ServiceID)),
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckWorkspaceDestroy(ctx),
 		Steps: []resource.TestStep{
@@ -336,15 +342,15 @@ func testAccWorkspace_timeout(t *testing.T) {
 
 func testAccCheckWorkspaceDestroy(ctx context.Context) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		conn := acctest.Provider.Meta().(*conns.AWSClient).WorkSpacesConn(ctx)
+		conn := acctest.Provider.Meta().(*conns.AWSClient).WorkSpacesClient(ctx)
 
 		for _, rs := range s.RootModule().Resources {
 			if rs.Type != "aws_workspaces_workspace" {
 				continue
 			}
 
-			resp, err := conn.DescribeWorkspacesWithContext(ctx, &workspaces.DescribeWorkspacesInput{
-				WorkspaceIds: []*string{aws.String(rs.Primary.ID)},
+			resp, err := conn.DescribeWorkspaces(ctx, &workspaces.DescribeWorkspacesInput{
+				WorkspaceIds: []string{rs.Primary.ID},
 			})
 			if err != nil {
 				return err
@@ -355,7 +361,7 @@ func testAccCheckWorkspaceDestroy(ctx context.Context) resource.TestCheckFunc {
 			}
 			ws := resp.Workspaces[0]
 
-			if *ws.State != workspaces.WorkspaceStateTerminating && *ws.State != workspaces.WorkspaceStateTerminated {
+			if ws.State != types.WorkspaceStateTerminating && ws.State != types.WorkspaceStateTerminated {
 				return fmt.Errorf("workspace %q was not terminated", rs.Primary.ID)
 			}
 		}
@@ -364,24 +370,24 @@ func testAccCheckWorkspaceDestroy(ctx context.Context) resource.TestCheckFunc {
 	}
 }
 
-func testAccCheckWorkspaceExists(ctx context.Context, n string, v *workspaces.Workspace) resource.TestCheckFunc {
+func testAccCheckWorkspaceExists(ctx context.Context, n string, v *types.Workspace) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		rs, ok := s.RootModule().Resources[n]
 		if !ok {
 			return fmt.Errorf("Not found: %s", n)
 		}
 
-		conn := acctest.Provider.Meta().(*conns.AWSClient).WorkSpacesConn(ctx)
+		conn := acctest.Provider.Meta().(*conns.AWSClient).WorkSpacesClient(ctx)
 
-		output, err := conn.DescribeWorkspacesWithContext(ctx, &workspaces.DescribeWorkspacesInput{
-			WorkspaceIds: []*string{aws.String(rs.Primary.ID)},
+		output, err := conn.DescribeWorkspaces(ctx, &workspaces.DescribeWorkspacesInput{
+			WorkspaceIds: []string{rs.Primary.ID},
 		})
 		if err != nil {
 			return err
 		}
 
 		if *output.Workspaces[0].WorkspaceId == rs.Primary.ID {
-			*v = *output.Workspaces[0]
+			*v = output.Workspaces[0]
 			return nil
 		}
 
@@ -634,7 +640,7 @@ func TestExpandWorkspaceProperties(t *testing.T) {
 
 	cases := []struct {
 		input    []interface{}
-		expected *workspaces.WorkspaceProperties
+		expected *types.WorkspaceProperties
 	}{
 		// Empty
 		{
@@ -645,19 +651,19 @@ func TestExpandWorkspaceProperties(t *testing.T) {
 		{
 			input: []interface{}{
 				map[string]interface{}{
-					"compute_type_name":                         workspaces.ComputeValue,
+					"compute_type_name":                         string(types.ComputeValue),
 					"root_volume_size_gib":                      80,
-					"running_mode":                              workspaces.RunningModeAutoStop,
+					"running_mode":                              string(types.RunningModeAutoStop),
 					"running_mode_auto_stop_timeout_in_minutes": 60,
 					"user_volume_size_gib":                      10,
 				},
 			},
-			expected: &workspaces.WorkspaceProperties{
-				ComputeTypeName:                     aws.String(workspaces.ComputeValue),
-				RootVolumeSizeGib:                   aws.Int64(80),
-				RunningMode:                         aws.String(workspaces.RunningModeAutoStop),
-				RunningModeAutoStopTimeoutInMinutes: aws.Int64(60),
-				UserVolumeSizeGib:                   aws.Int64(10),
+			expected: &types.WorkspaceProperties{
+				ComputeTypeName:                     types.ComputeValue,
+				RootVolumeSizeGib:                   aws.Int32(80),
+				RunningMode:                         types.RunningModeAutoStop,
+				RunningModeAutoStopTimeoutInMinutes: aws.Int32(60),
+				UserVolumeSizeGib:                   aws.Int32(10),
 			},
 		},
 	}
@@ -674,7 +680,7 @@ func TestFlattenWorkspaceProperties(t *testing.T) {
 	t.Parallel()
 
 	cases := []struct {
-		input    *workspaces.WorkspaceProperties
+		input    *types.WorkspaceProperties
 		expected []map[string]interface{}
 	}{
 		// Empty
@@ -684,18 +690,18 @@ func TestFlattenWorkspaceProperties(t *testing.T) {
 		},
 		// Full
 		{
-			input: &workspaces.WorkspaceProperties{
-				ComputeTypeName:                     aws.String(workspaces.ComputeValue),
-				RootVolumeSizeGib:                   aws.Int64(80),
-				RunningMode:                         aws.String(workspaces.RunningModeAutoStop),
-				RunningModeAutoStopTimeoutInMinutes: aws.Int64(60),
-				UserVolumeSizeGib:                   aws.Int64(10),
+			input: &types.WorkspaceProperties{
+				ComputeTypeName:                     types.ComputeValue,
+				RootVolumeSizeGib:                   aws.Int32(80),
+				RunningMode:                         types.RunningModeAutoStop,
+				RunningModeAutoStopTimeoutInMinutes: aws.Int32(60),
+				UserVolumeSizeGib:                   aws.Int32(10),
 			},
 			expected: []map[string]interface{}{
 				{
-					"compute_type_name":                         workspaces.ComputeValue,
+					"compute_type_name":                         string(types.ComputeValue),
 					"root_volume_size_gib":                      80,
-					"running_mode":                              workspaces.RunningModeAutoStop,
+					"running_mode":                              string(types.RunningModeAutoStop),
 					"running_mode_auto_stop_timeout_in_minutes": 60,
 					"user_volume_size_gib":                      10,
 				},
diff --git a/internal/service/workspaces/workspaces_data_source_test.go b/internal/service/workspaces/workspaces_data_source_test.go
index 10b08592c9c..da39971e975 100644
--- a/internal/service/workspaces/workspaces_data_source_test.go
+++ b/internal/service/workspaces/workspaces_data_source_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package workspaces_test
 
 import (
diff --git a/internal/service/workspaces/workspaces_test.go b/internal/service/workspaces/workspaces_test.go
index 3f31e51b2c8..808d1d589af 100644
--- a/internal/service/workspaces/workspaces_test.go
+++ b/internal/service/workspaces/workspaces_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package workspaces_test
 
 import (
diff --git a/internal/service/xray/encryption_config.go b/internal/service/xray/encryption_config.go
index dd3afececa6..4d85729313e 100644
--- a/internal/service/xray/encryption_config.go
+++ b/internal/service/xray/encryption_config.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package xray
 
 import (
diff --git a/internal/service/xray/encryption_config_test.go b/internal/service/xray/encryption_config_test.go
index 70b37139852..baa998aae38 100644
--- a/internal/service/xray/encryption_config_test.go
+++ b/internal/service/xray/encryption_config_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package xray_test
 
 import (
diff --git a/internal/service/xray/exports_test.go b/internal/service/xray/exports_test.go
index 6c8fa8febe3..a93ae442f2a 100644
--- a/internal/service/xray/exports_test.go
+++ b/internal/service/xray/exports_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package xray
 
 // Exports for use in tests only.
diff --git a/internal/service/xray/generate.go b/internal/service/xray/generate.go
index 512a541eeb8..b4b94e80f91 100644
--- a/internal/service/xray/generate.go
+++ b/internal/service/xray/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../../generate/tags/main.go -AWSSDKVersion=2 -ListTags -ListTagsInIDElem=ResourceARN -ServiceTagsSlice -TagInIDElem=ResourceARN -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
diff --git a/internal/service/xray/group.go b/internal/service/xray/group.go
index 52364619f1a..3aadd90c9c4 100644
--- a/internal/service/xray/group.go
+++ b/internal/service/xray/group.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package xray
 
 import (
diff --git a/internal/service/xray/group_test.go b/internal/service/xray/group_test.go
index 721ea2625fe..42488b2db70 100644
--- a/internal/service/xray/group_test.go
+++ b/internal/service/xray/group_test.go
@@ -1,11 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package xray_test
 
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go-v2/service/xray/types"
 	sdkacctest "github.com/hashicorp/terraform-plugin-testing/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -33,7 +36,7 @@ func TestAccXRayGroup_basic(t *testing.T) {
 				Config: testAccGroupConfig_basic(rName, "responsetime > 5"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckGroupExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "xray", regexp.MustCompile(`group/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "xray", regexache.MustCompile(`group/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "group_name", rName),
 					resource.TestCheckResourceAttr(resourceName, "filter_expression", "responsetime > 5"),
 					resource.TestCheckResourceAttr(resourceName, "insights_configuration.#", "1"), // Computed.
@@ -48,7 +51,7 @@ func TestAccXRayGroup_basic(t *testing.T) {
 				Config: testAccGroupConfig_basic(rName, "responsetime > 10"),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckGroupExists(ctx, resourceName, &v),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "xray", regexp.MustCompile(`group/.+`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "xray", regexache.MustCompile(`group/.+`)),
 					resource.TestCheckResourceAttr(resourceName, "group_name", rName),
 					resource.TestCheckResourceAttr(resourceName, "filter_expression", "responsetime > 10"),
 					resource.TestCheckResourceAttr(resourceName, "insights_configuration.#", "1"),
diff --git a/internal/service/xray/sampling_rule.go b/internal/service/xray/sampling_rule.go
index d7bb5515c70..fefdc6ceba0 100644
--- a/internal/service/xray/sampling_rule.go
+++ b/internal/service/xray/sampling_rule.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package xray
 
 import (
@@ -119,14 +122,14 @@ func resourceSamplingRuleCreate(ctx context.Context, d *schema.ResourceData, met
 		FixedRate:     d.Get("fixed_rate").(float64),
 		Host:          aws.String(d.Get("host").(string)),
 		HTTPMethod:    aws.String(d.Get("http_method").(string)),
-		Priority:      int32(d.Get("priority").(int)),
+		Priority:      aws.Int32(int32(d.Get("priority").(int))),
 		ReservoirSize: int32(d.Get("reservoir_size").(int)),
 		ResourceARN:   aws.String(d.Get("resource_arn").(string)),
 		RuleName:      aws.String(name),
 		ServiceName:   aws.String(d.Get("service_name").(string)),
 		ServiceType:   aws.String(d.Get("service_type").(string)),
 		URLPath:       aws.String(d.Get("url_path").(string)),
-		Version:       int32(d.Get("version").(int)),
+		Version:       aws.Int32(int32(d.Get("version").(int))),
 	}
 
 	if v, ok := d.GetOk("attributes"); ok && len(v.(map[string]interface{})) > 0 {
diff --git a/internal/service/xray/sampling_rule_test.go b/internal/service/xray/sampling_rule_test.go
index 25cdd33e9b8..19d01b9f4d9 100644
--- a/internal/service/xray/sampling_rule_test.go
+++ b/internal/service/xray/sampling_rule_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package xray_test
 
 import (
diff --git a/internal/service/xray/service_package_gen.go b/internal/service/xray/service_package_gen.go
index 6ff2a4a43cf..70b7b2c815e 100644
--- a/internal/service/xray/service_package_gen.go
+++ b/internal/service/xray/service_package_gen.go
@@ -7,6 +7,7 @@ import (
 
 	aws_sdkv2 "github.com/aws/aws-sdk-go-v2/aws"
 	xray_sdkv2 "github.com/aws/aws-sdk-go-v2/service/xray"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -60,9 +61,11 @@ func (p *servicePackage) NewClient(ctx context.Context, config map[string]any) (
 
 	return xray_sdkv2.NewFromConfig(cfg, func(o *xray_sdkv2.Options) {
 		if endpoint := config["endpoint"].(string); endpoint != "" {
-			o.EndpointResolver = xray_sdkv2.EndpointResolverFromURL(endpoint)
+			o.BaseEndpoint = aws_sdkv2.String(endpoint)
 		}
 	}), nil
 }
 
-var ServicePackage = &servicePackage{}
+func ServicePackage(ctx context.Context) conns.ServicePackage {
+	return &servicePackage{}
+}
diff --git a/internal/service/xray/tags_gen.go b/internal/service/xray/tags_gen.go
index 6353fb5aa31..dbcf4f715f5 100644
--- a/internal/service/xray/tags_gen.go
+++ b/internal/service/xray/tags_gen.go
@@ -8,7 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/xray"
 	awstypes "github.com/aws/aws-sdk-go-v2/service/xray/types"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/logging"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
 	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -102,6 +104,8 @@ func updateTags(ctx context.Context, conn *xray.Client, identifier string, oldTa
 	oldTags := tftags.New(ctx, oldTagsMap)
 	newTags := tftags.New(ctx, newTagsMap)
 
+	ctx = tflog.SetField(ctx, logging.KeyResourceId, identifier)
+
 	removedTags := oldTags.Removed(newTags)
 	removedTags = removedTags.IgnoreSystem(names.XRay)
 	if len(removedTags) > 0 {
diff --git a/internal/slices/filters.go b/internal/slices/filters.go
deleted file mode 100644
index bdb62aedea7..00000000000
--- a/internal/slices/filters.go
+++ /dev/null
@@ -1,7 +0,0 @@
-package slices
-
-func FilterEquals[T comparable](v T) FilterFunc[T] {
-	return func(x T) bool {
-		return x == v
-	}
-}
diff --git a/internal/slices/predicates.go b/internal/slices/predicates.go
new file mode 100644
index 00000000000..b184e6237d7
--- /dev/null
+++ b/internal/slices/predicates.go
@@ -0,0 +1,18 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package slices
+
+// PredicateEquals returns a Predicate that evaluates to true if the predicate's argument equals `v`.
+func PredicateEquals[T comparable](v T) Predicate[T] {
+	return func(x T) bool {
+		return x == v
+	}
+}
+
+// PredicateTrue returns a Predicate that always evaluates to true.
+func PredicateTrue[T any]() Predicate[T] {
+	return func(T) bool {
+		return true
+	}
+}
diff --git a/internal/slices/slices.go b/internal/slices/slices.go
index 8d4089d7109..7124fdacc26 100644
--- a/internal/slices/slices.go
+++ b/internal/slices/slices.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package slices
 
 import "golang.org/x/exp/slices"
@@ -38,10 +41,11 @@ func ApplyToAll[T, U any](s []T, f func(T) U) []U {
 	return v
 }
 
-type FilterFunc[T any] func(T) bool
+// Predicate represents a predicate (boolean-valued function) of one argument.
+type Predicate[T any] func(T) bool
 
 // Filter returns a new slice containing all values that return `true` for the filter function `f`
-func Filter[T any](s []T, f FilterFunc[T]) []T {
+func Filter[T any](s []T, f Predicate[T]) []T {
 	v := make([]T, 0, len(s))
 
 	for _, e := range s {
@@ -54,7 +58,7 @@ func Filter[T any](s []T, f FilterFunc[T]) []T {
 }
 
 // All returns `true` if the filter function `f` retruns `true` for all items
-func All[T any](s []T, f FilterFunc[T]) bool {
+func All[T any](s []T, f Predicate[T]) bool {
 	for _, e := range s {
 		if !f(e) {
 			return false
@@ -64,7 +68,7 @@ func All[T any](s []T, f FilterFunc[T]) bool {
 }
 
 // Any returns `true` if the filter function `f` retruns `true` for any item
-func Any[T any](s []T, f FilterFunc[T]) bool {
+func Any[T any](s []T, f Predicate[T]) bool {
 	for _, e := range s {
 		if f(e) {
 			return true
@@ -89,3 +93,23 @@ func Chunks[S ~[]E, E any](s S, size int) []S {
 
 	return chunks
 }
+
+// AppendUnique appends unique (not already in the slice) values to a slice.
+func AppendUnique[T comparable](s []T, vs ...T) []T {
+	for _, v := range vs {
+		var exists bool
+
+		for _, e := range s {
+			if e == v {
+				exists = true
+				break
+			}
+		}
+
+		if !exists {
+			s = append(s, v)
+		}
+	}
+
+	return s
+}
diff --git a/internal/slices/slices_test.go b/internal/slices/slices_test.go
index 1d34fb3dad6..2599a23608c 100644
--- a/internal/slices/slices_test.go
+++ b/internal/slices/slices_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package slices
 
 import (
@@ -166,3 +169,96 @@ func TestChunk(t *testing.T) {
 		})
 	}
 }
+
+func TestFilter(t *testing.T) {
+	t.Parallel()
+
+	type testCase struct {
+		input    []string
+		expected []string
+	}
+	tests := map[string]testCase{
+		"three elements": {
+			input:    []string{"one", "two", "3", "a0"},
+			expected: []string{"a0"},
+		},
+		"one element": {
+			input:    []string{"abcdEFGH"},
+			expected: []string{"abcdEFGH"},
+		},
+		"zero elements": {
+			input:    []string{},
+			expected: []string{},
+		},
+	}
+
+	for name, test := range tests {
+		name, test := name, test
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			got := Filter(test.input, func(v string) bool {
+				return strings.HasPrefix(v, "a")
+			})
+
+			if diff := cmp.Diff(got, test.expected); diff != "" {
+				t.Errorf("unexpected diff (+wanted, -got): %s", diff)
+			}
+		})
+	}
+}
+
+func TestAppendUnique(t *testing.T) {
+	t.Parallel()
+
+	type testCase struct {
+		input    []string
+		append   []string
+		expected []string
+	}
+	tests := map[string]testCase{
+		"all nil": {},
+		"all empty": {
+			input:    []string{},
+			append:   []string{},
+			expected: []string{},
+		},
+		"append to nil": {
+			append:   []string{"alpha", "beta", "alpha"},
+			expected: []string{"alpha", "beta"},
+		},
+		"append nothing": {
+			input:    []string{"alpha", "beta"},
+			append:   []string{},
+			expected: []string{"alpha", "beta"},
+		},
+		"append no unique": {
+			input:    []string{"alpha", "beta", "gamma"},
+			append:   []string{"beta", "gamma", "alpha"},
+			expected: []string{"alpha", "beta", "gamma"},
+		},
+		"append one unique": {
+			input:    []string{"alpha", "beta", "gamma"},
+			append:   []string{"beta", "delta"},
+			expected: []string{"alpha", "beta", "gamma", "delta"},
+		},
+		"append three unique": {
+			input:    []string{"alpha", "beta", "gamma"},
+			append:   []string{"delta", "gamma", "epsilon", "alpha", "epsilon", "zeta"},
+			expected: []string{"alpha", "beta", "gamma", "delta", "epsilon", "zeta"},
+		},
+	}
+
+	for name, test := range tests {
+		name, test := name, test
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			got := AppendUnique(test.input, test.append...)
+
+			if diff := cmp.Diff(got, test.expected); diff != "" {
+				t.Errorf("unexpected diff (+wanted, -got): %s", diff)
+			}
+		})
+	}
+}
diff --git a/internal/sweep/awsv1/skip.go b/internal/sweep/awsv1/skip.go
new file mode 100644
index 00000000000..b7d63eeef90
--- /dev/null
+++ b/internal/sweep/awsv1/skip.go
@@ -0,0 +1,79 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package awsv1
+
+import (
+	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+)
+
+// Check sweeper API call error for reasons to skip sweeping
+// These include missing API endpoints and unsupported API calls
+func SkipSweepError(err error) bool {
+	// Ignore missing API endpoints for AWS SDK for Go v1
+	if tfawserr.ErrMessageContains(err, "RequestError", "send request failed") {
+		return true
+	}
+	// Ignore unsupported API calls
+	if tfawserr.ErrCodeEquals(err, "UnsupportedOperation") {
+		return true
+	}
+	// Ignore more unsupported API calls
+	// InvalidParameterValue: Use of cache security groups is not permitted in this API version for your account.
+	if tfawserr.ErrMessageContains(err, "InvalidParameterValue", "not permitted in this API version for your account") {
+		return true
+	}
+	// InvalidParameterValue: Access Denied to API Version: APIGlobalDatabases
+	if tfawserr.ErrMessageContains(err, "InvalidParameterValue", "Access Denied to API Version") {
+		return true
+	}
+	// GovCloud has endpoints that respond with (no message provided):
+	// AccessDeniedException:
+	// Since acceptance test sweepers are best effort and this response is very common,
+	// we allow bypassing this error globally instead of individual test sweeper fixes.
+	if tfawserr.ErrCodeEquals(err, "AccessDeniedException") {
+		return true
+	}
+	// Example: BadRequestException: vpc link not supported for region us-gov-west-1
+	if tfawserr.ErrMessageContains(err, "BadRequestException", "not supported") {
+		return true
+	}
+	// Example: InvalidAction: InvalidAction: Operation (ListPlatformApplications) is not supported in this region
+	if tfawserr.ErrMessageContains(err, "InvalidAction", "is not supported") {
+		return true
+	}
+	// Example: InvalidAction: The action DescribeTransitGatewayAttachments is not valid for this web service
+	if tfawserr.ErrMessageContains(err, "InvalidAction", "is not valid") {
+		return true
+	}
+	// For example from GovCloud SES.SetActiveReceiptRuleSet.
+	if tfawserr.ErrMessageContains(err, "InvalidAction", "Unavailable Operation") {
+		return true
+	}
+	// For example from us-west-2 Route53 key signing key
+	if tfawserr.ErrMessageContains(err, "InvalidKeySigningKeyStatus", "cannot be deleted because") {
+		return true
+	}
+	// For example from us-west-2 Route53 zone
+	if tfawserr.ErrMessageContains(err, "KeySigningKeyInParentDSRecord", "Due to DNS lookup failure") {
+		return true
+	}
+	// For example from us-gov-west-1 EventBridge archive
+	if tfawserr.ErrMessageContains(err, "UnknownOperationException", "Operation is disabled in this region") {
+		return true
+	}
+	// For example from us-east-1 SageMaker
+	if tfawserr.ErrMessageContains(err, "UnknownOperationException", "The requested operation is not supported in the called region") {
+		return true
+	}
+	// For example from us-west-2 ECR public repository
+	if tfawserr.ErrMessageContains(err, "UnsupportedCommandException", "command is only supported in") {
+		return true
+	}
+	// For example from us-west-1 EMR studio
+	if tfawserr.ErrMessageContains(err, "ValidationException", "Account is not whitelisted to use this feature") {
+		return true
+	}
+
+	return false
+}
diff --git a/internal/sweep/awsv2/skip.go b/internal/sweep/awsv2/skip.go
new file mode 100644
index 00000000000..f4dc0ca0181
--- /dev/null
+++ b/internal/sweep/awsv2/skip.go
@@ -0,0 +1,20 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package awsv2
+
+import (
+	"net"
+
+	"github.com/hashicorp/terraform-provider-aws/internal/errs"
+)
+
+// Check sweeper API call error for reasons to skip sweeping
+// These include missing API endpoints and unsupported API calls
+func SkipSweepError(err error) bool {
+	// Ignore missing API endpoints
+	if dnsErr, ok := errs.As[*net.DNSError](err); ok {
+		return dnsErr.IsNotFound
+	}
+	return false
+}
diff --git a/internal/sweep/context.go b/internal/sweep/context.go
index e636b0c5118..fc83fb29506 100644
--- a/internal/sweep/context.go
+++ b/internal/sweep/context.go
@@ -1,7 +1,33 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sweep
 
-import "context"
+import (
+	"context"
+
+	"github.com/hashicorp/go-hclog"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
+	"github.com/hashicorp/terraform-plugin-log/tfsdklog"
+)
 
 func Context(region string) context.Context {
-	return context.Background()
+	ctx := context.Background()
+
+	ctx = tfsdklog.RegisterStdlogSink(ctx)
+
+	ctx = logger(ctx, "sweeper", region)
+
+	return ctx
+}
+
+func logger(ctx context.Context, loggerName, region string) context.Context {
+	ctx = tfsdklog.NewRootProviderLogger(ctx,
+		tfsdklog.WithLevel(hclog.Debug),
+		tfsdklog.WithLogName(loggerName),
+		tfsdklog.WithoutLocation(),
+	)
+	ctx = tflog.SetField(ctx, "sweeper_region", region)
+
+	return ctx
 }
diff --git a/internal/sweep/framework/resource.go b/internal/sweep/framework/resource.go
index 95b8c71ca5a..85706495a52 100644
--- a/internal/sweep/framework/resource.go
+++ b/internal/sweep/framework/resource.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package framework
 
 import (
diff --git a/internal/sweep/generate_test.go b/internal/sweep/generate_test.go
new file mode 100644
index 00000000000..3ed957b5bc4
--- /dev/null
+++ b/internal/sweep/generate_test.go
@@ -0,0 +1,8 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+//go:generate go run ../generate/servicepackages/main.go -- service_packages_gen_test.go
+//go:generate go run ../generate/sweeperregistration/main.go
+// ONLY generate directives and package declaration! Do not add anything else to this file.
+
+package sweep_test
diff --git a/internal/sweep/register_gen_test.go b/internal/sweep/register_gen_test.go
new file mode 100644
index 00000000000..775c1c14361
--- /dev/null
+++ b/internal/sweep/register_gen_test.go
@@ -0,0 +1,297 @@
+// Code generated by internal/generate/sweeperregistration/main.go; DO NOT EDIT.
+
+package sweep_test
+
+import (
+	"github.com/hashicorp/terraform-provider-aws/internal/service/accessanalyzer"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/acm"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/acmpca"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/amplify"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/apigateway"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/apigatewayv2"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/appconfig"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/applicationinsights"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/appmesh"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/apprunner"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/appstream"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/appsync"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/athena"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/auditmanager"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/autoscaling"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/autoscalingplans"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/backup"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/batch"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/budgets"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/cloud9"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/cloudformation"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/cloudfront"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/cloudhsmv2"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/cloudsearch"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/cloudtrail"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/cloudwatch"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/codeartifact"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/codebuild"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/codegurureviewer"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/codepipeline"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/codestarconnections"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/codestarnotifications"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/cognitoidp"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/configservice"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/connect"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/cur"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/dataexchange"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/datasync"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/dax"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/deploy"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/devicefarm"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/directconnect"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/dlm"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/dms"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/docdb"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/ds"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/dynamodb"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/ec2"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/ecr"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/ecrpublic"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/ecs"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/efs"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/eks"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/elasticache"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/elasticbeanstalk"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/elasticsearch"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/elb"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/elbv2"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/emr"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/emrcontainers"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/emrserverless"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/events"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/evidently"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/finspace"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/firehose"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/fis"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/fsx"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/gamelift"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/glacier"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/globalaccelerator"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/glue"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/grafana"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/guardduty"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/iam"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/imagebuilder"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/internetmonitor"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/iot"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/kafka"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/kafkaconnect"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/kendra"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/keyspaces"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/kinesis"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/kinesisanalytics"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/kinesisanalyticsv2"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/kms"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/lambda"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/lexmodels"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/licensemanager"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/lightsail"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/location"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/logs"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/medialive"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/mediapackage"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/memorydb"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/mq"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/mwaa"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/neptune"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/networkfirewall"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/networkmanager"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/opensearch"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/opensearchserverless"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/opsworks"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/pinpoint"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/pipes"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/qldb"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/quicksight"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/ram"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/rds"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/redshift"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/redshiftserverless"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/resourceexplorer2"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/resourcegroups"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/route53"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/route53recoverycontrolconfig"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/route53resolver"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/rum"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/s3"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/s3control"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/sagemaker"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/scheduler"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/schemas"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/secretsmanager"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/servicecatalog"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/servicediscovery"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/ses"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/sesv2"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/sfn"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/signer"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/simpledb"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/sns"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/sqs"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/ssm"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/ssoadmin"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/storagegateway"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/swf"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/synthetics"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/timestreamwrite"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/transcribe"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/transfer"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/vpclattice"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/waf"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/wafregional"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/wafv2"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/workspaces"
+)
+
+func registerSweepers() {
+	accessanalyzer.RegisterSweepers()
+	acm.RegisterSweepers()
+	acmpca.RegisterSweepers()
+	amplify.RegisterSweepers()
+	apigateway.RegisterSweepers()
+	apigatewayv2.RegisterSweepers()
+	appconfig.RegisterSweepers()
+	applicationinsights.RegisterSweepers()
+	appmesh.RegisterSweepers()
+	apprunner.RegisterSweepers()
+	appstream.RegisterSweepers()
+	appsync.RegisterSweepers()
+	athena.RegisterSweepers()
+	auditmanager.RegisterSweepers()
+	autoscaling.RegisterSweepers()
+	autoscalingplans.RegisterSweepers()
+	backup.RegisterSweepers()
+	batch.RegisterSweepers()
+	budgets.RegisterSweepers()
+	cloud9.RegisterSweepers()
+	cloudformation.RegisterSweepers()
+	cloudfront.RegisterSweepers()
+	cloudhsmv2.RegisterSweepers()
+	cloudsearch.RegisterSweepers()
+	cloudtrail.RegisterSweepers()
+	cloudwatch.RegisterSweepers()
+	codeartifact.RegisterSweepers()
+	codebuild.RegisterSweepers()
+	codegurureviewer.RegisterSweepers()
+	codepipeline.RegisterSweepers()
+	codestarconnections.RegisterSweepers()
+	codestarnotifications.RegisterSweepers()
+	cognitoidp.RegisterSweepers()
+	configservice.RegisterSweepers()
+	connect.RegisterSweepers()
+	cur.RegisterSweepers()
+	dataexchange.RegisterSweepers()
+	datasync.RegisterSweepers()
+	dax.RegisterSweepers()
+	deploy.RegisterSweepers()
+	devicefarm.RegisterSweepers()
+	directconnect.RegisterSweepers()
+	dlm.RegisterSweepers()
+	dms.RegisterSweepers()
+	docdb.RegisterSweepers()
+	ds.RegisterSweepers()
+	dynamodb.RegisterSweepers()
+	ec2.RegisterSweepers()
+	ecr.RegisterSweepers()
+	ecrpublic.RegisterSweepers()
+	ecs.RegisterSweepers()
+	efs.RegisterSweepers()
+	eks.RegisterSweepers()
+	elasticache.RegisterSweepers()
+	elasticbeanstalk.RegisterSweepers()
+	elasticsearch.RegisterSweepers()
+	elb.RegisterSweepers()
+	elbv2.RegisterSweepers()
+	emr.RegisterSweepers()
+	emrcontainers.RegisterSweepers()
+	emrserverless.RegisterSweepers()
+	events.RegisterSweepers()
+	evidently.RegisterSweepers()
+	finspace.RegisterSweepers()
+	firehose.RegisterSweepers()
+	fis.RegisterSweepers()
+	fsx.RegisterSweepers()
+	gamelift.RegisterSweepers()
+	glacier.RegisterSweepers()
+	globalaccelerator.RegisterSweepers()
+	glue.RegisterSweepers()
+	grafana.RegisterSweepers()
+	guardduty.RegisterSweepers()
+	iam.RegisterSweepers()
+	imagebuilder.RegisterSweepers()
+	internetmonitor.RegisterSweepers()
+	iot.RegisterSweepers()
+	kafka.RegisterSweepers()
+	kafkaconnect.RegisterSweepers()
+	kendra.RegisterSweepers()
+	keyspaces.RegisterSweepers()
+	kinesis.RegisterSweepers()
+	kinesisanalytics.RegisterSweepers()
+	kinesisanalyticsv2.RegisterSweepers()
+	kms.RegisterSweepers()
+	lambda.RegisterSweepers()
+	lexmodels.RegisterSweepers()
+	licensemanager.RegisterSweepers()
+	lightsail.RegisterSweepers()
+	location.RegisterSweepers()
+	logs.RegisterSweepers()
+	medialive.RegisterSweepers()
+	mediapackage.RegisterSweepers()
+	memorydb.RegisterSweepers()
+	mq.RegisterSweepers()
+	mwaa.RegisterSweepers()
+	neptune.RegisterSweepers()
+	networkfirewall.RegisterSweepers()
+	networkmanager.RegisterSweepers()
+	opensearch.RegisterSweepers()
+	opensearchserverless.RegisterSweepers()
+	opsworks.RegisterSweepers()
+	pinpoint.RegisterSweepers()
+	pipes.RegisterSweepers()
+	qldb.RegisterSweepers()
+	quicksight.RegisterSweepers()
+	ram.RegisterSweepers()
+	rds.RegisterSweepers()
+	redshift.RegisterSweepers()
+	redshiftserverless.RegisterSweepers()
+	resourceexplorer2.RegisterSweepers()
+	resourcegroups.RegisterSweepers()
+	route53.RegisterSweepers()
+	route53recoverycontrolconfig.RegisterSweepers()
+	route53resolver.RegisterSweepers()
+	rum.RegisterSweepers()
+	s3.RegisterSweepers()
+	s3control.RegisterSweepers()
+	sagemaker.RegisterSweepers()
+	scheduler.RegisterSweepers()
+	schemas.RegisterSweepers()
+	secretsmanager.RegisterSweepers()
+	servicecatalog.RegisterSweepers()
+	servicediscovery.RegisterSweepers()
+	ses.RegisterSweepers()
+	sesv2.RegisterSweepers()
+	sfn.RegisterSweepers()
+	signer.RegisterSweepers()
+	simpledb.RegisterSweepers()
+	sns.RegisterSweepers()
+	sqs.RegisterSweepers()
+	ssm.RegisterSweepers()
+	ssoadmin.RegisterSweepers()
+	storagegateway.RegisterSweepers()
+	swf.RegisterSweepers()
+	synthetics.RegisterSweepers()
+	timestreamwrite.RegisterSweepers()
+	transcribe.RegisterSweepers()
+	transfer.RegisterSweepers()
+	vpclattice.RegisterSweepers()
+	waf.RegisterSweepers()
+	wafregional.RegisterSweepers()
+	wafv2.RegisterSweepers()
+	workspaces.RegisterSweepers()
+}
diff --git a/internal/sweep/sdk/resource.go b/internal/sweep/sdk/resource.go
index 020c47829b2..7eb29c329f2 100644
--- a/internal/sweep/sdk/resource.go
+++ b/internal/sweep/sdk/resource.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sdk
 
 import (
@@ -21,7 +24,12 @@ type sweepResource struct {
 }
 
 func NewSweepResource(resource *schema.Resource, d *schema.ResourceData, meta *conns.AWSClient) *sweepResource {
-	return &sweepResource{
+	s := newSweepResource(resource, d, meta)
+	return &s
+}
+
+func newSweepResource(resource *schema.Resource, d *schema.ResourceData, meta *conns.AWSClient) sweepResource {
+	return sweepResource{
 		d:        d,
 		meta:     meta,
 		resource: resource,
@@ -55,6 +63,22 @@ func (sr *sweepResource) Delete(ctx context.Context, timeout time.Duration, optF
 	return err
 }
 
+type readerSweepResource struct {
+	sweepResource
+}
+
+func NewReaderSweepResource(resource *schema.Resource, d *schema.ResourceData, meta *conns.AWSClient) *readerSweepResource {
+	return &readerSweepResource{
+		sweepResource: newSweepResource(resource, d, meta),
+	}
+}
+
+func (rsr *readerSweepResource) Read(ctx context.Context) error {
+	ctx = tflog.SetField(ctx, "id", rsr.d.Id())
+
+	return ReadResource(ctx, rsr.resource, rsr.d, rsr.meta)
+}
+
 func deleteResource(ctx context.Context, resource *schema.Resource, d *schema.ResourceData, meta *conns.AWSClient) error {
 	if resource.DeleteContext != nil || resource.DeleteWithoutTimeout != nil {
 		var diags diag.Diagnostics
@@ -71,11 +95,6 @@ func deleteResource(ctx context.Context, resource *schema.Resource, d *schema.Re
 	return resource.Delete(d, meta)
 }
 
-// Deprecated: Create a list of Sweepables and pass them to SweepOrchestratorWithContext instead
-func DeleteResource(ctx context.Context, resource *schema.Resource, d *schema.ResourceData, meta *conns.AWSClient) error {
-	return deleteResource(ctx, resource, d, meta)
-}
-
 func ReadResource(ctx context.Context, resource *schema.Resource, d *schema.ResourceData, meta *conns.AWSClient) error {
 	if resource.ReadContext != nil || resource.ReadWithoutTimeout != nil {
 		var diags diag.Diagnostics
diff --git a/internal/sweep/sdk_resource.go b/internal/sweep/sdk_resource.go
index c2228ac4631..1bf42c0099e 100644
--- a/internal/sweep/sdk_resource.go
+++ b/internal/sweep/sdk_resource.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sweep
 
 import (
diff --git a/internal/sweep/service_packages_gen_test.go b/internal/sweep/service_packages_gen_test.go
new file mode 100644
index 00000000000..098b30fb110
--- /dev/null
+++ b/internal/sweep/service_packages_gen_test.go
@@ -0,0 +1,429 @@
+// Code generated by internal/generate/servicepackages/main.go; DO NOT EDIT.
+
+package sweep_test
+
+import (
+	"context"
+
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/accessanalyzer"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/account"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/acm"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/acmpca"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/amp"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/amplify"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/apigateway"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/apigatewayv2"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/appautoscaling"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/appconfig"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/appflow"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/appintegrations"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/applicationinsights"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/appmesh"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/apprunner"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/appstream"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/appsync"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/athena"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/auditmanager"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/autoscaling"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/autoscalingplans"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/backup"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/batch"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/bedrock"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/budgets"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/ce"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/chime"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/chimesdkmediapipelines"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/chimesdkvoice"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/cleanrooms"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/cloud9"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/cloudcontrol"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/cloudformation"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/cloudfront"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/cloudhsmv2"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/cloudsearch"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/cloudtrail"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/cloudwatch"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/codeartifact"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/codebuild"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/codecatalyst"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/codecommit"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/codegurureviewer"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/codepipeline"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/codestarconnections"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/codestarnotifications"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/cognitoidentity"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/cognitoidp"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/comprehend"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/computeoptimizer"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/configservice"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/connect"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/controltower"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/cur"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/dataexchange"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/datapipeline"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/datasync"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/dax"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/deploy"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/detective"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/devicefarm"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/directconnect"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/dlm"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/dms"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/docdb"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/docdbelastic"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/ds"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/dynamodb"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/ec2"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/ecr"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/ecrpublic"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/ecs"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/efs"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/eks"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/elasticache"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/elasticbeanstalk"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/elasticsearch"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/elastictranscoder"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/elb"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/elbv2"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/emr"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/emrcontainers"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/emrserverless"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/events"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/evidently"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/finspace"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/firehose"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/fis"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/fms"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/fsx"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/gamelift"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/glacier"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/globalaccelerator"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/glue"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/grafana"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/greengrass"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/guardduty"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/healthlake"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/iam"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/identitystore"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/imagebuilder"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/inspector"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/inspector2"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/internetmonitor"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/iot"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/iotanalytics"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/iotevents"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/ivs"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/ivschat"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/kafka"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/kafkaconnect"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/kendra"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/keyspaces"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/kinesis"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/kinesisanalytics"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/kinesisanalyticsv2"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/kinesisvideo"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/kms"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/lakeformation"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/lambda"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/lexmodels"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/lexv2models"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/licensemanager"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/lightsail"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/location"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/logs"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/macie2"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/mediaconnect"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/mediaconvert"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/medialive"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/mediapackage"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/mediastore"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/memorydb"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/meta"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/mq"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/mwaa"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/neptune"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/networkfirewall"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/networkmanager"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/oam"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/opensearch"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/opensearchserverless"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/opsworks"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/organizations"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/outposts"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/pinpoint"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/pipes"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/pricing"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/qldb"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/quicksight"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/ram"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/rbin"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/rds"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/redshift"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/redshiftdata"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/redshiftserverless"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/resourceexplorer2"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/resourcegroups"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/resourcegroupstaggingapi"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/rolesanywhere"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/route53"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/route53domains"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/route53recoverycontrolconfig"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/route53recoveryreadiness"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/route53resolver"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/rum"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/s3"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/s3control"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/s3outposts"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/sagemaker"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/scheduler"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/schemas"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/secretsmanager"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/securityhub"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/securitylake"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/serverlessrepo"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/servicecatalog"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/servicediscovery"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/servicequotas"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/ses"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/sesv2"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/sfn"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/shield"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/signer"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/simpledb"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/sns"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/sqs"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/ssm"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/ssmcontacts"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/ssmincidents"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/ssoadmin"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/storagegateway"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/sts"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/swf"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/synthetics"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/timestreamwrite"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/transcribe"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/transfer"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/verifiedpermissions"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/vpclattice"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/waf"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/wafregional"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/wafv2"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/worklink"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/workspaces"
+	"github.com/hashicorp/terraform-provider-aws/internal/service/xray"
+	"golang.org/x/exp/slices"
+)
+
+func servicePackages(ctx context.Context) []conns.ServicePackage {
+	v := []conns.ServicePackage{
+		accessanalyzer.ServicePackage(ctx),
+		account.ServicePackage(ctx),
+		acm.ServicePackage(ctx),
+		acmpca.ServicePackage(ctx),
+		amp.ServicePackage(ctx),
+		amplify.ServicePackage(ctx),
+		apigateway.ServicePackage(ctx),
+		apigatewayv2.ServicePackage(ctx),
+		appautoscaling.ServicePackage(ctx),
+		appconfig.ServicePackage(ctx),
+		appflow.ServicePackage(ctx),
+		appintegrations.ServicePackage(ctx),
+		applicationinsights.ServicePackage(ctx),
+		appmesh.ServicePackage(ctx),
+		apprunner.ServicePackage(ctx),
+		appstream.ServicePackage(ctx),
+		appsync.ServicePackage(ctx),
+		athena.ServicePackage(ctx),
+		auditmanager.ServicePackage(ctx),
+		autoscaling.ServicePackage(ctx),
+		autoscalingplans.ServicePackage(ctx),
+		backup.ServicePackage(ctx),
+		batch.ServicePackage(ctx),
+		bedrock.ServicePackage(ctx),
+		budgets.ServicePackage(ctx),
+		ce.ServicePackage(ctx),
+		chime.ServicePackage(ctx),
+		chimesdkmediapipelines.ServicePackage(ctx),
+		chimesdkvoice.ServicePackage(ctx),
+		cleanrooms.ServicePackage(ctx),
+		cloud9.ServicePackage(ctx),
+		cloudcontrol.ServicePackage(ctx),
+		cloudformation.ServicePackage(ctx),
+		cloudfront.ServicePackage(ctx),
+		cloudhsmv2.ServicePackage(ctx),
+		cloudsearch.ServicePackage(ctx),
+		cloudtrail.ServicePackage(ctx),
+		cloudwatch.ServicePackage(ctx),
+		codeartifact.ServicePackage(ctx),
+		codebuild.ServicePackage(ctx),
+		codecatalyst.ServicePackage(ctx),
+		codecommit.ServicePackage(ctx),
+		codegurureviewer.ServicePackage(ctx),
+		codepipeline.ServicePackage(ctx),
+		codestarconnections.ServicePackage(ctx),
+		codestarnotifications.ServicePackage(ctx),
+		cognitoidentity.ServicePackage(ctx),
+		cognitoidp.ServicePackage(ctx),
+		comprehend.ServicePackage(ctx),
+		computeoptimizer.ServicePackage(ctx),
+		configservice.ServicePackage(ctx),
+		connect.ServicePackage(ctx),
+		controltower.ServicePackage(ctx),
+		cur.ServicePackage(ctx),
+		dataexchange.ServicePackage(ctx),
+		datapipeline.ServicePackage(ctx),
+		datasync.ServicePackage(ctx),
+		dax.ServicePackage(ctx),
+		deploy.ServicePackage(ctx),
+		detective.ServicePackage(ctx),
+		devicefarm.ServicePackage(ctx),
+		directconnect.ServicePackage(ctx),
+		dlm.ServicePackage(ctx),
+		dms.ServicePackage(ctx),
+		docdb.ServicePackage(ctx),
+		docdbelastic.ServicePackage(ctx),
+		ds.ServicePackage(ctx),
+		dynamodb.ServicePackage(ctx),
+		ec2.ServicePackage(ctx),
+		ecr.ServicePackage(ctx),
+		ecrpublic.ServicePackage(ctx),
+		ecs.ServicePackage(ctx),
+		efs.ServicePackage(ctx),
+		eks.ServicePackage(ctx),
+		elasticache.ServicePackage(ctx),
+		elasticbeanstalk.ServicePackage(ctx),
+		elasticsearch.ServicePackage(ctx),
+		elastictranscoder.ServicePackage(ctx),
+		elb.ServicePackage(ctx),
+		elbv2.ServicePackage(ctx),
+		emr.ServicePackage(ctx),
+		emrcontainers.ServicePackage(ctx),
+		emrserverless.ServicePackage(ctx),
+		events.ServicePackage(ctx),
+		evidently.ServicePackage(ctx),
+		finspace.ServicePackage(ctx),
+		firehose.ServicePackage(ctx),
+		fis.ServicePackage(ctx),
+		fms.ServicePackage(ctx),
+		fsx.ServicePackage(ctx),
+		gamelift.ServicePackage(ctx),
+		glacier.ServicePackage(ctx),
+		globalaccelerator.ServicePackage(ctx),
+		glue.ServicePackage(ctx),
+		grafana.ServicePackage(ctx),
+		greengrass.ServicePackage(ctx),
+		guardduty.ServicePackage(ctx),
+		healthlake.ServicePackage(ctx),
+		iam.ServicePackage(ctx),
+		identitystore.ServicePackage(ctx),
+		imagebuilder.ServicePackage(ctx),
+		inspector.ServicePackage(ctx),
+		inspector2.ServicePackage(ctx),
+		internetmonitor.ServicePackage(ctx),
+		iot.ServicePackage(ctx),
+		iotanalytics.ServicePackage(ctx),
+		iotevents.ServicePackage(ctx),
+		ivs.ServicePackage(ctx),
+		ivschat.ServicePackage(ctx),
+		kafka.ServicePackage(ctx),
+		kafkaconnect.ServicePackage(ctx),
+		kendra.ServicePackage(ctx),
+		keyspaces.ServicePackage(ctx),
+		kinesis.ServicePackage(ctx),
+		kinesisanalytics.ServicePackage(ctx),
+		kinesisanalyticsv2.ServicePackage(ctx),
+		kinesisvideo.ServicePackage(ctx),
+		kms.ServicePackage(ctx),
+		lakeformation.ServicePackage(ctx),
+		lambda.ServicePackage(ctx),
+		lexmodels.ServicePackage(ctx),
+		lexv2models.ServicePackage(ctx),
+		licensemanager.ServicePackage(ctx),
+		lightsail.ServicePackage(ctx),
+		location.ServicePackage(ctx),
+		logs.ServicePackage(ctx),
+		macie2.ServicePackage(ctx),
+		mediaconnect.ServicePackage(ctx),
+		mediaconvert.ServicePackage(ctx),
+		medialive.ServicePackage(ctx),
+		mediapackage.ServicePackage(ctx),
+		mediastore.ServicePackage(ctx),
+		memorydb.ServicePackage(ctx),
+		meta.ServicePackage(ctx),
+		mq.ServicePackage(ctx),
+		mwaa.ServicePackage(ctx),
+		neptune.ServicePackage(ctx),
+		networkfirewall.ServicePackage(ctx),
+		networkmanager.ServicePackage(ctx),
+		oam.ServicePackage(ctx),
+		opensearch.ServicePackage(ctx),
+		opensearchserverless.ServicePackage(ctx),
+		opsworks.ServicePackage(ctx),
+		organizations.ServicePackage(ctx),
+		outposts.ServicePackage(ctx),
+		pinpoint.ServicePackage(ctx),
+		pipes.ServicePackage(ctx),
+		pricing.ServicePackage(ctx),
+		qldb.ServicePackage(ctx),
+		quicksight.ServicePackage(ctx),
+		ram.ServicePackage(ctx),
+		rbin.ServicePackage(ctx),
+		rds.ServicePackage(ctx),
+		redshift.ServicePackage(ctx),
+		redshiftdata.ServicePackage(ctx),
+		redshiftserverless.ServicePackage(ctx),
+		resourceexplorer2.ServicePackage(ctx),
+		resourcegroups.ServicePackage(ctx),
+		resourcegroupstaggingapi.ServicePackage(ctx),
+		rolesanywhere.ServicePackage(ctx),
+		route53.ServicePackage(ctx),
+		route53domains.ServicePackage(ctx),
+		route53recoverycontrolconfig.ServicePackage(ctx),
+		route53recoveryreadiness.ServicePackage(ctx),
+		route53resolver.ServicePackage(ctx),
+		rum.ServicePackage(ctx),
+		s3.ServicePackage(ctx),
+		s3control.ServicePackage(ctx),
+		s3outposts.ServicePackage(ctx),
+		sagemaker.ServicePackage(ctx),
+		scheduler.ServicePackage(ctx),
+		schemas.ServicePackage(ctx),
+		secretsmanager.ServicePackage(ctx),
+		securityhub.ServicePackage(ctx),
+		securitylake.ServicePackage(ctx),
+		serverlessrepo.ServicePackage(ctx),
+		servicecatalog.ServicePackage(ctx),
+		servicediscovery.ServicePackage(ctx),
+		servicequotas.ServicePackage(ctx),
+		ses.ServicePackage(ctx),
+		sesv2.ServicePackage(ctx),
+		sfn.ServicePackage(ctx),
+		shield.ServicePackage(ctx),
+		signer.ServicePackage(ctx),
+		simpledb.ServicePackage(ctx),
+		sns.ServicePackage(ctx),
+		sqs.ServicePackage(ctx),
+		ssm.ServicePackage(ctx),
+		ssmcontacts.ServicePackage(ctx),
+		ssmincidents.ServicePackage(ctx),
+		ssoadmin.ServicePackage(ctx),
+		storagegateway.ServicePackage(ctx),
+		sts.ServicePackage(ctx),
+		swf.ServicePackage(ctx),
+		synthetics.ServicePackage(ctx),
+		timestreamwrite.ServicePackage(ctx),
+		transcribe.ServicePackage(ctx),
+		transfer.ServicePackage(ctx),
+		verifiedpermissions.ServicePackage(ctx),
+		vpclattice.ServicePackage(ctx),
+		waf.ServicePackage(ctx),
+		wafregional.ServicePackage(ctx),
+		wafv2.ServicePackage(ctx),
+		worklink.ServicePackage(ctx),
+		workspaces.ServicePackage(ctx),
+		xray.ServicePackage(ctx),
+	}
+
+	return slices.Clone(v)
+}
diff --git a/internal/sweep/sweep.go b/internal/sweep/sweep.go
index 6c9087248ab..21a35495487 100644
--- a/internal/sweep/sweep.go
+++ b/internal/sweep/sweep.go
@@ -1,19 +1,22 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package sweep
 
 import (
 	"context"
-	"errors"
 	"fmt"
-	"net"
 	"os"
 	"strconv"
 	"time"
 
 	"github.com/aws/aws-sdk-go/aws/endpoints"
-	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
 	multierror "github.com/hashicorp/go-multierror"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/envvar"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep/awsv1"
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 )
 
@@ -25,17 +28,15 @@ const (
 
 const defaultSweeperAssumeRoleDurationSeconds = 3600
 
+// ServicePackages is set in TestMain in order to break an import cycle.
+var ServicePackages []conns.ServicePackage
+
 // sweeperClients is a shared cache of regional conns.AWSClient
 // This prevents client re-initialization for every resource with no benefit.
 var sweeperClients map[string]*conns.AWSClient = make(map[string]*conns.AWSClient)
 
-// SharedRegionalSweepClient returns a common conns.AWSClient setup needed for the sweeper
-// functions for a given region
-func SharedRegionalSweepClient(region string) (*conns.AWSClient, error) {
-	return SharedRegionalSweepClientWithContext(Context(region), region)
-}
-
-func SharedRegionalSweepClientWithContext(ctx context.Context, region string) (*conns.AWSClient, error) {
+// SharedRegionalSweepClient returns a common conns.AWSClient setup needed for the sweeper functions for a given Region.
+func SharedRegionalSweepClient(ctx context.Context, region string) (*conns.AWSClient, error) {
 	if client, ok := sweeperClients[region]; ok {
 		return client, nil
 	}
@@ -52,8 +53,15 @@ func SharedRegionalSweepClientWithContext(ctx context.Context, region string) (*
 		}
 	}
 
+	meta := new(conns.AWSClient)
+	servicePackageMap := make(map[string]conns.ServicePackage)
+	for _, sp := range ServicePackages {
+		servicePackageName := sp.ServicePackageName()
+		servicePackageMap[servicePackageName] = sp
+	}
+	meta.ServicePackages = servicePackageMap
+
 	conf := &conns.Config{
-		MaxRetries:       5,
 		Region:           region,
 		SuppressDebugLog: true,
 	}
@@ -80,7 +88,7 @@ func SharedRegionalSweepClientWithContext(ctx context.Context, region string) (*
 	}
 
 	// configures a default client for the region, using the above env vars
-	client, diags := conf.ConfigureProvider(ctx, &conns.AWSClient{})
+	client, diags := conf.ConfigureProvider(ctx, meta)
 
 	if diags.HasError() {
 		return nil, fmt.Errorf("getting AWS client: %#v", diags)
@@ -95,7 +103,11 @@ type Sweepable interface {
 	Delete(ctx context.Context, timeout time.Duration, optFns ...tfresource.OptionsFunc) error
 }
 
-func SweepOrchestratorWithContext(ctx context.Context, sweepables []Sweepable, optFns ...tfresource.OptionsFunc) error {
+func SweepOrchestrator(ctx context.Context, sweepables []Sweepable, optFns ...tfresource.OptionsFunc) error {
+	if len(sweepables) == 0 {
+		tflog.Info(ctx, "No resources to sweep")
+	}
+
 	var g multierror.Group
 
 	for _, sweepable := range sweepables {
@@ -109,81 +121,10 @@ func SweepOrchestratorWithContext(ctx context.Context, sweepables []Sweepable, o
 	return g.Wait().ErrorOrNil()
 }
 
-// Check sweeper API call error for reasons to skip sweeping
-// These include missing API endpoints and unsupported API calls
-func SkipSweepError(err error) bool {
-	// Ignore missing API endpoints for AWS SDK for Go v1
-	if tfawserr.ErrMessageContains(err, "RequestError", "send request failed") {
-		return true
-	}
-	// Ignore unsupported API calls
-	if tfawserr.ErrCodeEquals(err, "UnsupportedOperation") {
-		return true
-	}
-	// Ignore more unsupported API calls
-	// InvalidParameterValue: Use of cache security groups is not permitted in this API version for your account.
-	if tfawserr.ErrMessageContains(err, "InvalidParameterValue", "not permitted in this API version for your account") {
-		return true
-	}
-	// InvalidParameterValue: Access Denied to API Version: APIGlobalDatabases
-	if tfawserr.ErrMessageContains(err, "InvalidParameterValue", "Access Denied to API Version") {
-		return true
-	}
-	// GovCloud has endpoints that respond with (no message provided):
-	// AccessDeniedException:
-	// Since acceptance test sweepers are best effort and this response is very common,
-	// we allow bypassing this error globally instead of individual test sweeper fixes.
-	if tfawserr.ErrCodeEquals(err, "AccessDeniedException") {
-		return true
-	}
-	// Example: BadRequestException: vpc link not supported for region us-gov-west-1
-	if tfawserr.ErrMessageContains(err, "BadRequestException", "not supported") {
-		return true
-	}
-	// Example: InvalidAction: InvalidAction: Operation (ListPlatformApplications) is not supported in this region
-	if tfawserr.ErrMessageContains(err, "InvalidAction", "is not supported in this region") {
-		return true
-	}
-	// Example: InvalidAction: The action DescribeTransitGatewayAttachments is not valid for this web service
-	if tfawserr.ErrMessageContains(err, "InvalidAction", "is not valid") {
-		return true
-	}
-	// For example from GovCloud SES.SetActiveReceiptRuleSet.
-	if tfawserr.ErrMessageContains(err, "InvalidAction", "Unavailable Operation") {
-		return true
-	}
-	// For example from us-west-2 Route53 key signing key
-	if tfawserr.ErrMessageContains(err, "InvalidKeySigningKeyStatus", "cannot be deleted because") {
-		return true
-	}
-	// For example from us-west-2 Route53 zone
-	if tfawserr.ErrMessageContains(err, "KeySigningKeyInParentDSRecord", "Due to DNS lookup failure") {
-		return true
-	}
-	// For example from us-gov-west-1 EventBridge archive
-	if tfawserr.ErrMessageContains(err, "UnknownOperationException", "Operation is disabled in this region") {
-		return true
-	}
-	// For example from us-east-1 SageMaker
-	if tfawserr.ErrMessageContains(err, "UnknownOperationException", "The requested operation is not supported in the called region") {
-		return true
-	}
-	// For example from us-west-2 ECR public repository
-	if tfawserr.ErrMessageContains(err, "UnsupportedCommandException", "command is only supported in") {
-		return true
-	}
-	// For example from us-west-1 EMR studio
-	if tfawserr.ErrMessageContains(err, "ValidationException", "Account is not whitelisted to use this feature") {
-		return true
-	}
-
-	// Ignore missing API endpoints for AWS SDK for Go v2
-	var dnsErr *net.DNSError
-	if errors.As(err, &dnsErr) {
-		return dnsErr.IsNotFound
-	}
-	return false
-}
+// Deprecated: Usse awsv1.SkipSweepError
+//
+//nolint:stylecheck // It's not required for functions, so why for variables?
+var SkipSweepError = awsv1.SkipSweepError
 
 func Partition(region string) string {
 	if partition, ok := endpoints.PartitionForRegion(endpoints.DefaultPartitions(), region); ok {
@@ -198,3 +139,38 @@ func PartitionDNSSuffix(region string) string {
 	}
 	return "amazonaws.com"
 }
+
+type SweeperFn func(ctx context.Context, client *conns.AWSClient) ([]Sweepable, error)
+
+func Register(name string, f SweeperFn, dependencies ...string) {
+	resource.AddTestSweepers(name, &resource.Sweeper{
+		Name: name,
+		F: func(region string) error {
+			ctx := Context(region)
+			ctx = tflog.SetField(ctx, "sweeper_name", name)
+
+			client, err := SharedRegionalSweepClient(ctx, region)
+			if err != nil {
+				return fmt.Errorf("getting client: %w", err)
+			}
+			sweepResources, err := f(ctx, client)
+
+			if SkipSweepError(err) {
+				tflog.Warn(ctx, "Skipping sweeper", map[string]any{
+					"error": err.Error(),
+				})
+				return nil
+			}
+			if err != nil {
+				return fmt.Errorf("listing %q (%s): %w", name, region, err)
+			}
+
+			err = SweepOrchestrator(ctx, sweepResources)
+			if err != nil {
+				return fmt.Errorf("sweeping %q (%s): %w", name, region, err)
+			}
+
+			return nil
+		},
+	})
+}
diff --git a/internal/sweep/sweep_test.go b/internal/sweep/sweep_test.go
index 560700e34c3..e2808928cfe 100644
--- a/internal/sweep/sweep_test.go
+++ b/internal/sweep/sweep_test.go
@@ -1,154 +1,22 @@
-// Code generated by internal/generate/sweepimp/main.go; DO NOT EDIT.
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
 
 package sweep_test
 
 import (
+	"context"
 	"testing"
 
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/accessanalyzer"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/acm"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/acmpca"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/amplify"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/apigateway"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/apigatewayv2"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/appconfig"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/applicationinsights"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/appmesh"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/apprunner"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/appstream"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/appsync"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/athena"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/auditmanager"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/autoscaling"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/autoscalingplans"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/backup"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/batch"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/budgets"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/cloud9"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/cloudformation"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/cloudfront"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/cloudhsmv2"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/cloudsearch"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/cloudtrail"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/cloudwatch"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/codeartifact"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/codebuild"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/codegurureviewer"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/codepipeline"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/codestarconnections"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/cognitoidp"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/configservice"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/connect"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/cur"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/dataexchange"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/datasync"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/dax"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/deploy"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/devicefarm"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/directconnect"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/dlm"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/dms"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/docdb"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/ds"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/dynamodb"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/ec2"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/ecr"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/ecrpublic"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/ecs"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/efs"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/eks"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/elasticache"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/elasticbeanstalk"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/elasticsearch"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/elb"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/elbv2"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/emr"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/emrcontainers"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/emrserverless"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/events"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/evidently"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/firehose"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/fis"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/fsx"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/gamelift"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/glacier"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/globalaccelerator"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/glue"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/grafana"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/guardduty"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/healthlake"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/iam"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/imagebuilder"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/internetmonitor"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/iot"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/kafka"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/kafkaconnect"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/kendra"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/keyspaces"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/kinesis"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/kinesisanalytics"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/kinesisanalyticsv2"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/kms"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/lambda"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/lexmodels"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/licensemanager"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/lightsail"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/location"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/logs"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/medialive"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/memorydb"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/mq"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/mwaa"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/neptune"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/networkfirewall"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/networkmanager"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/oam"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/opensearch"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/opensearchserverless"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/opsworks"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/pinpoint"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/pipes"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/qldb"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/quicksight"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/ram"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/rds"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/redshift"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/redshiftserverless"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/resourceexplorer2"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/route53"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/route53recoverycontrolconfig"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/route53resolver"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/rum"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/s3"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/s3control"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/sagemaker"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/scheduler"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/schemas"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/secretsmanager"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/servicecatalog"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/servicediscovery"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/ses"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/sesv2"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/sfn"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/simpledb"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/sns"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/sqs"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/ssm"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/ssoadmin"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/storagegateway"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/swf"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/synthetics"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/timestreamwrite"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/transcribe"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/transfer"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/vpclattice"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/waf"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/wafregional"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/wafv2"
-	_ "github.com/hashicorp/terraform-provider-aws/internal/service/workspaces"
+	"github.com/hashicorp/terraform-provider-aws/internal/sweep"
 )
 
 func TestMain(m *testing.M) {
+	ctx := context.Background()
+
+	sweep.ServicePackages = servicePackages(ctx)
+
+	registerSweepers()
+
 	resource.TestMain(m)
 }
diff --git a/internal/tags/context.go b/internal/tags/context.go
index 9b1329f061b..71663164895 100644
--- a/internal/tags/context.go
+++ b/internal/tags/context.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tags
 
 import (
diff --git a/internal/tags/framework.go b/internal/tags/framework.go
index 297b69347ea..733e300cacd 100644
--- a/internal/tags/framework.go
+++ b/internal/tags/framework.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tags
 
 import (
diff --git a/internal/tags/key_value_tags.go b/internal/tags/key_value_tags.go
index 372e5e70613..f07839f7fe3 100644
--- a/internal/tags/key_value_tags.go
+++ b/internal/tags/key_value_tags.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tags
 
 import (
@@ -5,18 +8,18 @@ import (
 	"fmt"
 	"net/url"
 	"reflect"
-	"regexp"
 	"sort"
 	"strconv"
 	"strings"
 
+	"github.com/YakDriver/regexache"
 	"github.com/hashicorp/go-cty/cty"
 	fwdiag "github.com/hashicorp/terraform-plugin-framework/diag"
 	"github.com/hashicorp/terraform-plugin-framework/path"
 	"github.com/hashicorp/terraform-plugin-framework/resource"
 	"github.com/hashicorp/terraform-plugin-framework/types"
 	"github.com/hashicorp/terraform-provider-aws/internal/create"
-	"github.com/hashicorp/terraform-provider-aws/internal/flex"
+	"github.com/hashicorp/terraform-provider-aws/internal/framework/flex"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
@@ -174,7 +177,7 @@ func (tags KeyValueTags) IgnoreServerlessApplicationRepository() KeyValueTags {
 	return result
 }
 
-// IgnoreAWS returns non-system tag keys.
+// IgnoreSystem returns non-system tag keys.
 // The ignored keys vary on the specified service.
 func (tags KeyValueTags) IgnoreSystem(serviceName string) KeyValueTags {
 	switch serviceName {
@@ -871,8 +874,8 @@ func (tags KeyValueTags) ResolveDuplicatesFramework(ctx context.Context, default
 // For example, AWS Go SDK field names are in PascalCase,
 // while Terraform schema attribute names are in snake_case.
 func ToSnakeCase(str string) string {
-	result := regexp.MustCompile("(.)([A-Z][a-z]+)").ReplaceAllString(str, "${1}_${2}")
-	result = regexp.MustCompile("([a-z0-9])([A-Z])").ReplaceAllString(result, "${1}_${2}")
+	result := regexache.MustCompile("(.)([A-Z][a-z]+)").ReplaceAllString(str, "${1}_${2}")
+	result = regexache.MustCompile("([0-9a-z])([A-Z])").ReplaceAllString(result, "${1}_${2}")
 	return strings.ToLower(result)
 }
 
diff --git a/internal/tags/key_value_tags_test.go b/internal/tags/key_value_tags_test.go
index 99dc555a7d4..ea7981fc9ef 100644
--- a/internal/tags/key_value_tags_test.go
+++ b/internal/tags/key_value_tags_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tags
 
 import (
diff --git a/internal/tags/tag_resources.go b/internal/tags/tag_resources.go
index cc9971cd41f..25e2e73ddf3 100644
--- a/internal/tags/tag_resources.go
+++ b/internal/tags/tag_resources.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tags
 
 import (
diff --git a/internal/tags/tag_resources_test.go b/internal/tags/tag_resources_test.go
index 7f781b20534..40b6190d7b3 100644
--- a/internal/tags/tag_resources_test.go
+++ b/internal/tags/tag_resources_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tags
 
 import (
diff --git a/internal/tags/tags.go b/internal/tags/tags.go
index fbe5fe2385a..12d3b9013eb 100644
--- a/internal/tags/tags.go
+++ b/internal/tags/tags.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tags
 
 import (
diff --git a/internal/tfresource/errors.go b/internal/tfresource/errors.go
index 84e54a85187..e470df026f0 100644
--- a/internal/tfresource/errors.go
+++ b/internal/tfresource/errors.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tfresource
 
 import (
diff --git a/internal/tfresource/errors_test.go b/internal/tfresource/errors_test.go
index bcca4d5cdbf..ccd602328d5 100644
--- a/internal/tfresource/errors_test.go
+++ b/internal/tfresource/errors_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tfresource_test
 
 import (
diff --git a/internal/tfresource/not_found_error.go b/internal/tfresource/not_found_error.go
index c942e01d201..92013689c82 100644
--- a/internal/tfresource/not_found_error.go
+++ b/internal/tfresource/not_found_error.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tfresource
 
 import (
@@ -24,7 +27,7 @@ func (e *EmptyResultError) Error() string {
 }
 
 func (e *EmptyResultError) Is(err error) bool {
-	_, ok := err.(*EmptyResultError) //nolint:errorlint // Explicitly does *not* match down the error tree
+	_, ok := err.(*EmptyResultError)
 	return ok
 }
 
@@ -61,7 +64,7 @@ func (e *TooManyResultsError) Error() string {
 }
 
 func (e *TooManyResultsError) Is(err error) bool {
-	_, ok := err.(*TooManyResultsError) //nolint:errorlint // Explicitly does *not* match down the error tree
+	_, ok := err.(*TooManyResultsError)
 	return ok
 }
 
diff --git a/internal/tfresource/not_found_error_test.go b/internal/tfresource/not_found_error_test.go
index af16647c8f4..d10f603529d 100644
--- a/internal/tfresource/not_found_error_test.go
+++ b/internal/tfresource/not_found_error_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tfresource
 
 import (
diff --git a/internal/tfresource/retry.go b/internal/tfresource/retry.go
index 764462f9b27..fed9daaea01 100644
--- a/internal/tfresource/retry.go
+++ b/internal/tfresource/retry.go
@@ -1,13 +1,18 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tfresource
 
 import (
 	"context"
 	"errors"
+	"fmt"
 	"math/rand"
 	"sync"
 	"time"
 
 	"github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2/tfawserr"
+	tfawserr_sdkv2 "github.com/hashicorp/aws-sdk-go-base/v2/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs"
 )
@@ -52,10 +57,10 @@ func RetryWhen(ctx context.Context, timeout time.Duration, f func() (interface{}
 	return output, nil
 }
 
-// RetryWhenAWSErrCodeEquals retries the specified function when it returns one of the specified AWS error code.
+// RetryWhenAWSErrCodeEquals retries the specified function when it returns one of the specified AWS error codes.
 func RetryWhenAWSErrCodeEquals(ctx context.Context, timeout time.Duration, f func() (interface{}, error), codes ...string) (interface{}, error) { // nosemgrep:ci.aws-in-func-name
 	return RetryWhen(ctx, timeout, f, func(err error) (bool, error) {
-		if tfawserr.ErrCodeEquals(err, codes...) {
+		if tfawserr.ErrCodeEquals(err, codes...) || tfawserr_sdkv2.ErrCodeEquals(err, codes...) {
 			return true, err
 		}
 
@@ -66,7 +71,7 @@ func RetryWhenAWSErrCodeEquals(ctx context.Context, timeout time.Duration, f fun
 // RetryWhenAWSErrMessageContains retries the specified function when it returns an AWS error containing the specified message.
 func RetryWhenAWSErrMessageContains(ctx context.Context, timeout time.Duration, f func() (interface{}, error), code, message string) (interface{}, error) { // nosemgrep:ci.aws-in-func-name
 	return RetryWhen(ctx, timeout, f, func(err error) (bool, error) {
-		if tfawserr.ErrMessageContains(err, code, message) {
+		if tfawserr.ErrMessageContains(err, code, message) || tfawserr_sdkv2.ErrMessageContains(err, code, message) {
 			return true, err
 		}
 
@@ -94,6 +99,53 @@ func RetryWhenIsAErrorMessageContains[T errs.ErrorWithErrorMessage](ctx context.
 	})
 }
 
+// RetryUntilEqual retries the specified function until it returns a value equal to `t`.
+func RetryUntilEqual[T comparable](ctx context.Context, timeout time.Duration, t T, f func() (T, error)) (T, error) {
+	var output T
+
+	err := Retry(ctx, timeout, func() *retry.RetryError {
+		var err error
+
+		output, err = f()
+
+		if err != nil {
+			return retry.NonRetryableError(err)
+		}
+
+		if output != t {
+			return retry.RetryableError(fmt.Errorf("output = %v, want %v", output, t))
+		}
+
+		return nil
+	})
+
+	if TimedOut(err) {
+		output, err = f()
+
+		if err == nil && output != t {
+			err = fmt.Errorf("output = %v, want %v", output, t)
+		}
+	}
+
+	if err != nil {
+		var zero T
+		return zero, err
+	}
+
+	return output, nil
+}
+
+// RetryWhenHTTPStatusCodeEquals retries the specified function when it returns one of the specified HTTP status codes.
+func RetryWhenHTTPStatusCodeEquals(ctx context.Context, timeout time.Duration, f func() (interface{}, error), statusCodes ...int) (interface{}, error) { // nosemgrep:ci.aws-in-func-name
+	return RetryWhen(ctx, timeout, f, func(err error) (bool, error) {
+		if tfawserr_sdkv2.ErrHTTPStatusCodeEquals(err, statusCodes...) {
+			return true, err
+		}
+
+		return false, err
+	})
+}
+
 var ErrFoundResource = errors.New(`found resource`)
 
 // RetryUntilNotFound retries the specified function until it returns a retry.NotFoundError.
diff --git a/internal/tfresource/retry_test.go b/internal/tfresource/retry_test.go
index 2a6cf64c39a..fe10a6c48b1 100644
--- a/internal/tfresource/retry_test.go
+++ b/internal/tfresource/retry_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tfresource_test
 
 import (
diff --git a/internal/tfresource/wait.go b/internal/tfresource/wait.go
index a6f0150863c..c84e65831c9 100644
--- a/internal/tfresource/wait.go
+++ b/internal/tfresource/wait.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tfresource
 
 import (
diff --git a/internal/tfresource/wait_test.go b/internal/tfresource/wait_test.go
index ac5ff19983d..4867625a630 100644
--- a/internal/tfresource/wait_test.go
+++ b/internal/tfresource/wait_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package tfresource_test
 
 import (
diff --git a/internal/types/cidr_block.go b/internal/types/cidr_block.go
new file mode 100644
index 00000000000..ecdc58ee93e
--- /dev/null
+++ b/internal/types/cidr_block.go
@@ -0,0 +1,54 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package types
+
+import (
+	"fmt"
+	"net"
+)
+
+// ValidateCIDRBlock validates that the specified CIDR block is valid:
+// - The CIDR block parses to an IP address and network
+// - The CIDR block is the CIDR block for the network
+func ValidateCIDRBlock(cidr string) error {
+	_, ipnet, err := net.ParseCIDR(cidr)
+	if err != nil {
+		return fmt.Errorf("%q is not a valid CIDR block: %w", cidr, err)
+	}
+
+	if !CIDRBlocksEqual(cidr, ipnet.String()) {
+		return fmt.Errorf("%q is not a valid CIDR block; did you mean %q?", cidr, ipnet)
+	}
+
+	return nil
+}
+
+// CIDRBlocksEqual returns whether or not two CIDR blocks are equal:
+// - Both CIDR blocks parse to an IP address and network
+// - The string representation of the IP addresses are equal
+// - The string representation of the networks are equal
+// This function is especially useful for IPv6 CIDR blocks which have multiple valid representations.
+func CIDRBlocksEqual(cidr1, cidr2 string) bool {
+	ip1, ipnet1, err := net.ParseCIDR(cidr1)
+	if err != nil {
+		return false
+	}
+	ip2, ipnet2, err := net.ParseCIDR(cidr2)
+	if err != nil {
+		return false
+	}
+
+	return ip2.String() == ip1.String() && ipnet2.String() == ipnet1.String()
+}
+
+// CanonicalCIDRBlock returns the canonical representation of a CIDR block.
+// This function is especially useful for hash functions for sets which include IPv6 CIDR blocks.
+func CanonicalCIDRBlock(cidr string) string {
+	_, ipnet, err := net.ParseCIDR(cidr)
+	if err != nil {
+		return cidr
+	}
+
+	return ipnet.String()
+}
diff --git a/internal/types/cidr_block_test.go b/internal/types/cidr_block_test.go
new file mode 100644
index 00000000000..e153aa3eb8f
--- /dev/null
+++ b/internal/types/cidr_block_test.go
@@ -0,0 +1,74 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package types
+
+import "testing"
+
+func TestValidateCIDRBlock(t *testing.T) {
+	t.Parallel()
+
+	for _, ts := range []struct {
+		cidr  string
+		valid bool
+	}{
+		{"10.2.2.0/24", true},
+		{"10.2.2.0/1234", false},
+		{"10.2.2.2/24", false},
+		{"::/0", true},
+		{"::0/0", true},
+		{"2000::/15", true},
+		{"2001::/15", false},
+		{"", false},
+	} {
+		err := ValidateCIDRBlock(ts.cidr)
+		if !ts.valid && err == nil {
+			t.Fatalf("Input '%s' should error but didn't!", ts.cidr)
+		}
+		if ts.valid && err != nil {
+			t.Fatalf("Got unexpected error for '%s' input: %s", ts.cidr, err)
+		}
+	}
+}
+
+func TestCIDRBlocksEqual(t *testing.T) {
+	t.Parallel()
+
+	for _, ts := range []struct {
+		cidr1 string
+		cidr2 string
+		equal bool
+	}{
+		{"10.2.2.0/24", "10.2.2.0/24", true},
+		{"10.2.2.0/1234", "10.2.2.0/24", false},
+		{"10.2.2.0/24", "10.2.2.0/1234", false},
+		{"2001::/15", "2001::/15", true},
+		{"::/0", "2001::/15", false},
+		{"::/0", "::0/0", true},
+		{"", "", false},
+	} {
+		equal := CIDRBlocksEqual(ts.cidr1, ts.cidr2)
+		if ts.equal != equal {
+			t.Fatalf("CIDRBlocksEqual(%q, %q) should be: %t", ts.cidr1, ts.cidr2, ts.equal)
+		}
+	}
+}
+
+func TestCanonicalCIDRBlock(t *testing.T) {
+	t.Parallel()
+
+	for _, ts := range []struct {
+		cidr     string
+		expected string
+	}{
+		{"10.2.2.0/24", "10.2.2.0/24"},
+		{"::/0", "::/0"},
+		{"::0/0", "::/0"},
+		{"", ""},
+	} {
+		got := CanonicalCIDRBlock(ts.cidr)
+		if ts.expected != got {
+			t.Fatalf("CanonicalCIDRBlock(%q) should be: %q, got: %q", ts.cidr, ts.expected, got)
+		}
+	}
+}
diff --git a/internal/types/duration/duration.go b/internal/types/duration/duration.go
index ae8eae6bf7a..c282862b186 100644
--- a/internal/types/duration/duration.go
+++ b/internal/types/duration/duration.go
@@ -1,12 +1,16 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package duration
 
 import (
 	"errors"
 	"fmt"
-	"regexp"
 	"strconv"
 	"strings"
 	"time"
+
+	"github.com/YakDriver/regexache"
 )
 
 var ErrSyntax = errors.New("invalid syntax")
@@ -28,7 +32,7 @@ func Parse(s string) (Duration, error) {
 		return Duration{}, ErrSyntax
 	}
 
-	re := regexp.MustCompile(pattern)
+	re := regexache.MustCompile(pattern)
 	match := re.FindStringSubmatch(s)
 	if match == nil {
 		return Duration{}, ErrSyntax
diff --git a/internal/types/duration/duration_test.go b/internal/types/duration/duration_test.go
index 06049067e02..b3469890bc4 100644
--- a/internal/types/duration/duration_test.go
+++ b/internal/types/duration/duration_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package duration
 
 import (
diff --git a/internal/types/nullable/bool.go b/internal/types/nullable/bool.go
new file mode 100644
index 00000000000..0f2a8f815ad
--- /dev/null
+++ b/internal/types/nullable/bool.go
@@ -0,0 +1,88 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package nullable
+
+import (
+	"fmt"
+	"strconv"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+)
+
+const (
+	TypeNullableBool = schema.TypeString
+)
+
+type Bool string
+
+func (b Bool) IsNull() bool {
+	return b == ""
+}
+
+func (b Bool) Value() (bool, bool, error) {
+	if b.IsNull() {
+		return false, true, nil
+	}
+
+	value, err := strconv.ParseBool(string(b))
+	if err != nil {
+		return false, false, err
+	}
+	return value, false, nil
+}
+
+func NewBool(v bool) Bool {
+	return Bool(strconv.FormatBool(v))
+}
+
+// ValidateTypeStringNullableBool provides custom error messaging for TypeString booleans
+// Some arguments require a boolean value or unspecified, empty field.
+func ValidateTypeStringNullableBool(v interface{}, k string) (ws []string, es []error) {
+	value, ok := v.(string)
+	if !ok {
+		es = append(es, fmt.Errorf("expected type of %s to be string", k))
+		return
+	}
+
+	if value == "" {
+		return
+	}
+
+	if _, err := strconv.ParseBool(value); err != nil {
+		es = append(es, fmt.Errorf("%s: cannot parse '%s' as boolean: %w", k, value, err))
+		return
+	}
+
+	if value != "true" && value != "false" {
+		ws = append(ws, fmt.Sprintf(`%s: the use of values other than "true" and "false" is deprecated and will be removed in a future version of the provider`, k))
+	}
+
+	return
+}
+
+func DiffSuppressNullableBool(k, o, n string, d *schema.ResourceData) bool {
+	ov, onull, _ := Bool(o).Value()
+	nv, nnull, _ := Bool(n).Value()
+	if onull && nnull {
+		return true
+	}
+	if !onull && !nnull {
+		return ov == nv
+	}
+	return false
+}
+
+// DiffSuppressNullableBoolFalseAsNull allows false to be treated equivalently to null.
+// This can be used to allow a practitioner to set false when the API requires a null value,
+// as a convenience.
+// This is typically not what you want: it is indended for cases where a parameter is optional
+// in some cases and must be set in others.
+func DiffSuppressNullableBoolFalseAsNull(k, o, n string, d *schema.ResourceData) bool {
+	ov, onull, _ := Bool(o).Value()
+	nv, nnull, _ := Bool(n).Value()
+	if !ov && nnull || onull && !nv {
+		return true
+	}
+	return false
+}
diff --git a/internal/types/nullable/bool_test.go b/internal/types/nullable/bool_test.go
new file mode 100644
index 00000000000..e3edc4733c8
--- /dev/null
+++ b/internal/types/nullable/bool_test.go
@@ -0,0 +1,393 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package nullable
+
+import (
+	"errors"
+	"strconv"
+	"testing"
+
+	"github.com/YakDriver/regexache"
+)
+
+func TestNullableBool(t *testing.T) {
+	t.Parallel()
+
+	cases := []struct {
+		val           string
+		expectNull    bool
+		expectedValue bool
+		expectedErr   error
+	}{
+		{
+			val:           "true",
+			expectNull:    false,
+			expectedValue: true,
+		},
+		{
+			val:           "false",
+			expectNull:    false,
+			expectedValue: false,
+		},
+		{
+			val:           "1",
+			expectNull:    false,
+			expectedValue: true,
+		},
+		{
+			val:           "0",
+			expectNull:    false,
+			expectedValue: false,
+		},
+		{
+			val:           "",
+			expectNull:    true,
+			expectedValue: false,
+		},
+		{
+			val:           "A",
+			expectNull:    false,
+			expectedValue: false,
+			expectedErr:   strconv.ErrSyntax,
+		},
+	}
+
+	for i, tc := range cases {
+		v := Bool(tc.val)
+
+		if null := v.IsNull(); null != tc.expectNull {
+			t.Fatalf("expected test case %d IsNull to return %t, got %t", i, null, tc.expectNull)
+		}
+
+		value, null, err := v.Value()
+		if value != tc.expectedValue {
+			t.Fatalf("expected test case %d Value to be %t, got %t", i, tc.expectedValue, value)
+		}
+		if null != tc.expectNull {
+			t.Fatalf("expected test case %d Value null flag to be %t, got %t", i, tc.expectNull, null)
+		}
+		if tc.expectedErr == nil && err != nil {
+			t.Fatalf("expected test case %d to succeed, got error %s", i, err)
+		}
+		if tc.expectedErr != nil {
+			if !errors.Is(err, tc.expectedErr) {
+				t.Fatalf("expected test case %d to have error matching \"%s\", got %s", i, tc.expectedErr, err)
+			}
+		}
+	}
+}
+
+func TestValidationBool(t *testing.T) {
+	t.Parallel()
+
+	runValidationTestCases(t, []testCase{
+		{
+			val: "true",
+			f:   ValidateTypeStringNullableBool,
+		},
+		{
+			val:             "1",
+			f:               ValidateTypeStringNullableBool,
+			expectedWarning: regexache.MustCompile(`^\w+: the use of values other than "true" and "false" is deprecated and will be removed in a future version of the provider$`),
+		},
+		{
+			val:         "A",
+			f:           ValidateTypeStringNullableBool,
+			expectedErr: regexache.MustCompile(`^\w+: cannot parse 'A' as boolean: .+$`),
+		},
+		{
+			val:         1,
+			f:           ValidateTypeStringNullableBool,
+			expectedErr: regexache.MustCompile(`^expected type of \w+ to be string$`),
+		},
+	})
+}
+
+func TestDiffSuppressBool(t *testing.T) {
+	t.Parallel()
+
+	cases := []struct {
+		old, new   string
+		equivalent bool
+	}{
+		// Truthy values
+		{
+			old:        "true",
+			new:        "1",
+			equivalent: true,
+		},
+		{
+			old:        "1",
+			new:        "true",
+			equivalent: true,
+		},
+
+		// Falsey values
+		{
+			old:        "false",
+			new:        "0",
+			equivalent: true,
+		},
+		{
+			old:        "0",
+			new:        "false",
+			equivalent: true,
+		},
+
+		// Truthy -> Falsey
+		{
+			old:        "true",
+			new:        "false",
+			equivalent: false,
+		},
+		{
+			old:        "true",
+			new:        "0",
+			equivalent: false,
+		},
+		{
+			old:        "1",
+			new:        "false",
+			equivalent: false,
+		},
+		{
+			old:        "1",
+			new:        "0",
+			equivalent: false,
+		},
+
+		// Falsey -> Truthy
+		{
+			old:        "false",
+			new:        "true",
+			equivalent: false,
+		},
+		{
+			old:        "false",
+			new:        "1",
+			equivalent: false,
+		},
+		{
+			old:        "0",
+			new:        "true",
+			equivalent: false,
+		},
+		{
+			old:        "0",
+			new:        "1",
+			equivalent: false,
+		},
+
+		// Null -> Truthy
+		{
+			old:        "",
+			new:        "true",
+			equivalent: false,
+		},
+		{
+			old:        "",
+			new:        "1",
+			equivalent: false,
+		},
+
+		// Null -> Falsey
+		{
+			old:        "",
+			new:        "false",
+			equivalent: false,
+		},
+		{
+			old:        "",
+			new:        "0",
+			equivalent: false,
+		},
+
+		// Truthy -> Null
+		{
+			old:        "true",
+			new:        "",
+			equivalent: false,
+		},
+		{
+			old:        "1",
+			new:        "",
+			equivalent: false,
+		},
+
+		// Falsey -> Null
+		{
+			old:        "false",
+			new:        "",
+			equivalent: false,
+		},
+		{
+			old:        "0",
+			new:        "",
+			equivalent: false,
+		},
+
+		// Null => Null
+		{
+			old:        "",
+			new:        "",
+			equivalent: true,
+		},
+	}
+
+	for i, tc := range cases {
+		v := DiffSuppressNullableBool("test_property", tc.old, tc.new, nil)
+
+		if tc.equivalent && !v {
+			t.Fatalf("expected test case %d to be equivalent", i)
+		}
+
+		if !tc.equivalent && v {
+			t.Fatalf("expected test case %d to not be equivalent", i)
+		}
+	}
+}
+
+func TestDiffSuppressBoolFalseAsNull(t *testing.T) {
+	t.Parallel()
+
+	cases := []struct {
+		old, new   string
+		equivalent bool
+	}{
+		// Falsey -> Null
+		{
+			old:        "false",
+			new:        "",
+			equivalent: true,
+		},
+		{
+			old:        "0",
+			new:        "",
+			equivalent: true,
+		},
+
+		// Null -> Falsey
+		{
+			old:        "",
+			new:        "false",
+			equivalent: true,
+		},
+		{
+			old:        "",
+			new:        "0",
+			equivalent: true,
+		},
+
+		// Null => Null
+		{
+			old:        "",
+			new:        "",
+			equivalent: true,
+		},
+
+		// Truthy values
+		{
+			old:        "true",
+			new:        "1",
+			equivalent: false,
+		},
+		{
+			old:        "1",
+			new:        "true",
+			equivalent: false,
+		},
+
+		// Falsey values
+		{
+			old:        "false",
+			new:        "0",
+			equivalent: false,
+		},
+		{
+			old:        "0",
+			new:        "false",
+			equivalent: false,
+		},
+
+		// Truthy -> Falsey
+		{
+			old:        "true",
+			new:        "false",
+			equivalent: false,
+		},
+		{
+			old:        "true",
+			new:        "0",
+			equivalent: false,
+		},
+		{
+			old:        "1",
+			new:        "false",
+			equivalent: false,
+		},
+		{
+			old:        "1",
+			new:        "0",
+			equivalent: false,
+		},
+
+		// Falsey -> Truthy
+		{
+			old:        "false",
+			new:        "true",
+			equivalent: false,
+		},
+		{
+			old:        "false",
+			new:        "1",
+			equivalent: false,
+		},
+		{
+			old:        "0",
+			new:        "true",
+			equivalent: false,
+		},
+		{
+			old:        "0",
+			new:        "1",
+			equivalent: false,
+		},
+
+		// Null -> Truthy
+		{
+			old:        "",
+			new:        "true",
+			equivalent: false,
+		},
+		{
+			old:        "",
+			new:        "1",
+			equivalent: false,
+		},
+
+		// Truthy -> Null
+		{
+			old:        "true",
+			new:        "",
+			equivalent: false,
+		},
+		{
+			old:        "1",
+			new:        "",
+			equivalent: false,
+		},
+	}
+
+	for i, tc := range cases {
+		v := DiffSuppressNullableBoolFalseAsNull("test_property", tc.old, tc.new, nil)
+
+		if tc.equivalent && !v {
+			t.Fatalf("expected test case %d to be equivalent", i)
+		}
+
+		if !tc.equivalent && v {
+			t.Fatalf("expected test case %d to not be equivalent", i)
+		}
+	}
+}
diff --git a/internal/types/nullable/float.go b/internal/types/nullable/float.go
new file mode 100644
index 00000000000..d7de0e61ed1
--- /dev/null
+++ b/internal/types/nullable/float.go
@@ -0,0 +1,53 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package nullable
+
+import (
+	"fmt"
+	"strconv"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+)
+
+const (
+	TypeNullableFloat = schema.TypeString
+)
+
+type Float string
+
+func (i Float) IsNull() bool {
+	return i == ""
+}
+
+func (i Float) Value() (float64, bool, error) {
+	if i.IsNull() {
+		return 0, true, nil
+	}
+
+	value, err := strconv.ParseFloat(string(i), 64)
+	if err != nil {
+		return 0, false, err
+	}
+	return value, false, nil
+}
+
+// ValidateTypeStringNullableFloat provides custom error messaging for TypeString floats
+// Some arguments require an float value or unspecified, empty field.
+func ValidateTypeStringNullableFloat(v interface{}, k string) (ws []string, es []error) {
+	value, ok := v.(string)
+	if !ok {
+		es = append(es, fmt.Errorf("expected type of %s to be string", k))
+		return
+	}
+
+	if value == "" {
+		return
+	}
+
+	if _, err := strconv.ParseFloat(value, 64); err != nil {
+		es = append(es, fmt.Errorf("%s: cannot parse '%s' as float: %w", k, value, err))
+	}
+
+	return
+}
diff --git a/internal/types/nullable/float_test.go b/internal/types/nullable/float_test.go
new file mode 100644
index 00000000000..5448b15a7d1
--- /dev/null
+++ b/internal/types/nullable/float_test.go
@@ -0,0 +1,103 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package nullable
+
+import (
+	"errors"
+	"strconv"
+	"testing"
+
+	"github.com/YakDriver/regexache"
+)
+
+func TestNullableFloat(t *testing.T) {
+	t.Parallel()
+
+	cases := []struct {
+		val           string
+		expectNull    bool
+		expectedValue float64
+		expectedErr   error
+	}{
+		{
+			val:           "1",
+			expectNull:    false,
+			expectedValue: 1,
+		},
+		{
+			val:           "1.1",
+			expectNull:    false,
+			expectedValue: 1.1,
+		},
+		{
+			val:           "0",
+			expectNull:    false,
+			expectedValue: 0,
+		},
+		{
+			val:           "",
+			expectNull:    true,
+			expectedValue: 0,
+		},
+		{
+			val:           "A",
+			expectNull:    false,
+			expectedValue: 0,
+			expectedErr:   strconv.ErrSyntax,
+		},
+	}
+
+	for i, tc := range cases {
+		v := Float(tc.val)
+
+		if null := v.IsNull(); null != tc.expectNull {
+			t.Fatalf("expected test case %d IsNull to return %t, got %t", i, null, tc.expectNull)
+		}
+
+		value, null, err := v.Value()
+		if value != tc.expectedValue {
+			t.Fatalf("expected test case %d Value to be %f, got %f", i, tc.expectedValue, value)
+		}
+		if null != tc.expectNull {
+			t.Fatalf("expected test case %d Value null flag to be %t, got %t", i, tc.expectNull, null)
+		}
+		if tc.expectedErr == nil && err != nil {
+			t.Fatalf("expected test case %d to succeed, got error %s", i, err)
+		}
+		if tc.expectedErr != nil {
+			if !errors.Is(err, tc.expectedErr) {
+				t.Fatalf("expected test case %d to have error matching \"%s\", got %s", i, tc.expectedErr, err)
+			}
+		}
+	}
+}
+
+func TestValidationFloat(t *testing.T) {
+	t.Parallel()
+
+	runValidationTestCases(t, []testCase{
+		{
+			val: "1",
+			f:   ValidateTypeStringNullableFloat,
+		},
+		{
+			val: "1.1",
+			f:   ValidateTypeStringNullableFloat,
+		},
+		{
+			val: "0",
+			f:   ValidateTypeStringNullableFloat,
+		},
+		{
+			val:         "A",
+			f:           ValidateTypeStringNullableFloat,
+			expectedErr: regexache.MustCompile(`^\w+: cannot parse 'A' as float: .+$`),
+		},
+		{
+			val:         1,
+			f:           ValidateTypeStringNullableFloat,
+			expectedErr: regexache.MustCompile(`^expected type of \w+ to be string$`),
+		},
+	})
+}
diff --git a/internal/types/nullable/int.go b/internal/types/nullable/int.go
new file mode 100644
index 00000000000..da00af0dbda
--- /dev/null
+++ b/internal/types/nullable/int.go
@@ -0,0 +1,109 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package nullable
+
+import (
+	"fmt"
+	"strconv"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+)
+
+const (
+	TypeNullableInt = schema.TypeString
+)
+
+type Int string
+
+func (i Int) IsNull() bool {
+	return i == ""
+}
+
+func (i Int) Value() (int64, bool, error) {
+	if i.IsNull() {
+		return 0, true, nil
+	}
+
+	value, err := strconv.ParseInt(string(i), 10, 64)
+	if err != nil {
+		return 0, false, err
+	}
+	return value, false, nil
+}
+
+// ValidateTypeStringNullableInt provides custom error messaging for TypeString ints
+// Some arguments require an int value or unspecified, empty field.
+func ValidateTypeStringNullableInt(v interface{}, k string) (ws []string, es []error) {
+	value, ok := v.(string)
+	if !ok {
+		es = append(es, fmt.Errorf("expected type of %s to be string", k))
+		return
+	}
+
+	if value == "" {
+		return
+	}
+
+	if _, err := strconv.ParseInt(value, 10, 64); err != nil {
+		es = append(es, fmt.Errorf("%s: cannot parse '%s' as int: %w", k, value, err))
+	}
+
+	return
+}
+
+// ValidateTypeStringNullableIntAtLeast provides custom error messaging for TypeString ints
+// Some arguments require an int value or unspecified, empty field.
+func ValidateTypeStringNullableIntAtLeast(min int) schema.SchemaValidateFunc {
+	return func(i interface{}, k string) (ws []string, es []error) {
+		value, ok := i.(string)
+		if !ok {
+			es = append(es, fmt.Errorf("expected type of %s to be string", k))
+			return
+		}
+
+		if value == "" {
+			return
+		}
+
+		v, err := strconv.ParseInt(value, 10, 64)
+		if err != nil {
+			es = append(es, fmt.Errorf("%s: cannot parse '%s' as int: %w", k, value, err))
+			return
+		}
+
+		if v < int64(min) {
+			es = append(es, fmt.Errorf("expected %s to be at least (%d), got %d", k, min, v))
+		}
+
+		return
+	}
+}
+
+// ValidateTypeStringNullableIntBetween provides custom error messaging for TypeString ints
+// Some arguments require an int value or unspecified, empty field.
+func ValidateTypeStringNullableIntBetween(min int, max int) schema.SchemaValidateFunc {
+	return func(i interface{}, k string) (ws []string, es []error) {
+		value, ok := i.(string)
+		if !ok {
+			es = append(es, fmt.Errorf("expected type of %s to be string", k))
+			return
+		}
+
+		if value == "" {
+			return
+		}
+
+		v, err := strconv.ParseInt(value, 10, 64)
+		if err != nil {
+			es = append(es, fmt.Errorf("%s: cannot parse '%s' as int: %w", k, value, err))
+			return
+		}
+
+		if v < int64(min) || v > int64(max) {
+			es = append(es, fmt.Errorf("expected %s to be at between (%d) and (%d), got %d", k, min, max, v))
+		}
+
+		return
+	}
+}
diff --git a/internal/types/nullable/int_test.go b/internal/types/nullable/int_test.go
new file mode 100644
index 00000000000..99534388899
--- /dev/null
+++ b/internal/types/nullable/int_test.go
@@ -0,0 +1,110 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package nullable
+
+import (
+	"errors"
+	"strconv"
+	"testing"
+
+	"github.com/YakDriver/regexache"
+)
+
+func TestNullableInt(t *testing.T) {
+	t.Parallel()
+
+	cases := []struct {
+		val           string
+		expectNull    bool
+		expectedValue int64
+		expectedErr   error
+	}{
+		{
+			val:           "1",
+			expectNull:    false,
+			expectedValue: 1,
+		},
+		{
+			val:           "",
+			expectNull:    true,
+			expectedValue: 0,
+		},
+		{
+			val:           "A",
+			expectNull:    false,
+			expectedValue: 0,
+			expectedErr:   strconv.ErrSyntax,
+		},
+	}
+
+	for i, tc := range cases {
+		v := Int(tc.val)
+
+		if null := v.IsNull(); null != tc.expectNull {
+			t.Fatalf("expected test case %d IsNull to return %t, got %t", i, null, tc.expectNull)
+		}
+
+		value, null, err := v.Value()
+		if value != tc.expectedValue {
+			t.Fatalf("expected test case %d Value to be %d, got %d", i, tc.expectedValue, value)
+		}
+		if null != tc.expectNull {
+			t.Fatalf("expected test case %d Value null flag to be %t, got %t", i, tc.expectNull, null)
+		}
+		if tc.expectedErr == nil && err != nil {
+			t.Fatalf("expected test case %d to succeed, got error %s", i, err)
+		}
+		if tc.expectedErr != nil {
+			if !errors.Is(err, tc.expectedErr) {
+				t.Fatalf("expected test case %d to have error matching \"%s\", got %s", i, tc.expectedErr, err)
+			}
+		}
+	}
+}
+
+func TestValidationInt(t *testing.T) {
+	t.Parallel()
+
+	runValidationTestCases(t, []testCase{
+		{
+			val: "1",
+			f:   ValidateTypeStringNullableInt,
+		},
+		{
+			val:         "A",
+			f:           ValidateTypeStringNullableInt,
+			expectedErr: regexache.MustCompile(`^\w+: cannot parse 'A' as int: .*`),
+		},
+		{
+			val:         1,
+			f:           ValidateTypeStringNullableInt,
+			expectedErr: regexache.MustCompile(`^expected type of \w+ to be string`),
+		},
+	})
+}
+
+func TestValidationIntAtLeast(t *testing.T) {
+	t.Parallel()
+
+	runValidationTestCases(t, []testCase{
+		{
+			val: "1",
+			f:   ValidateTypeStringNullableIntAtLeast(1),
+		},
+		{
+			val: "1",
+			f:   ValidateTypeStringNullableIntAtLeast(0),
+		},
+		{
+			val:         "1",
+			f:           ValidateTypeStringNullableIntAtLeast(2),
+			expectedErr: regexache.MustCompile(`expected \w+ to be at least \(2\), got 1`),
+		},
+		{
+			val:         1,
+			f:           ValidateTypeStringNullableIntAtLeast(2),
+			expectedErr: regexache.MustCompile(`expected type of \w+ to be string`),
+		},
+	})
+}
diff --git a/internal/experimental/nullable/testing.go b/internal/types/nullable/testing.go
similarity index 95%
rename from internal/experimental/nullable/testing.go
rename to internal/types/nullable/testing.go
index 365e3eec3ee..e1e14ea1104 100644
--- a/internal/experimental/nullable/testing.go
+++ b/internal/types/nullable/testing.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package nullable
 
 import (
diff --git a/internal/types/option.go b/internal/types/option.go
index 5ad1cc8d89d..77d07ec500f 100644
--- a/internal/types/option.go
+++ b/internal/types/option.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package types
 
 type Option[T any] []T
diff --git a/internal/types/option_test.go b/internal/types/option_test.go
index 7d3d04ce271..7b4abb51280 100644
--- a/internal/types/option_test.go
+++ b/internal/types/option_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package types
 
 import (
diff --git a/internal/types/service_package.go b/internal/types/service_package.go
index be3273eafab..ada3a89ca99 100644
--- a/internal/types/service_package.go
+++ b/internal/types/service_package.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package types
 
 import (
diff --git a/internal/types/timestamp/timestamp.go b/internal/types/timestamp/timestamp.go
index 454cf8f4f1c..e33b72f2d57 100644
--- a/internal/types/timestamp/timestamp.go
+++ b/internal/types/timestamp/timestamp.go
@@ -1,10 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package timestamp
 
 import (
 	"fmt"
-	"regexp"
 	"strings"
 	"time"
+
+	"github.com/YakDriver/regexache"
 )
 
 // Timestamp is a timestamp string type
@@ -24,7 +28,7 @@ func (t Timestamp) ValidateOnceADayWindowFormat() error {
 	validTimeFormat := "([0-1][0-9]|2[0-3]):([0-5][0-9])"
 	validTimeFormatConsolidated := "^(" + validTimeFormat + "-" + validTimeFormat + "|)$"
 
-	if !regexp.MustCompile(validTimeFormatConsolidated).MatchString(t.String()) {
+	if !regexache.MustCompile(validTimeFormatConsolidated).MatchString(t.String()) {
 		return fmt.Errorf("(%s) must satisfy the format of \"hh24:mi-hh24:mi\"", t.String())
 	}
 
@@ -38,7 +42,7 @@ func (t Timestamp) ValidateOnceAWeekWindowFormat() error {
 	validTimeFormatConsolidated := "^(" + validTimeFormat + "-" + validTimeFormat + "|)$"
 
 	val := strings.ToLower(t.String())
-	if !regexp.MustCompile(validTimeFormatConsolidated).MatchString(val) {
+	if !regexache.MustCompile(validTimeFormatConsolidated).MatchString(val) {
 		return fmt.Errorf("(%s) must satisfy the format of \"ddd:hh24:mi-ddd:hh24:mi\"", val)
 	}
 
diff --git a/internal/types/timestamp/timestamp_test.go b/internal/types/timestamp/timestamp_test.go
index 76d6b0401c0..8f7ac80ac45 100644
--- a/internal/types/timestamp/timestamp_test.go
+++ b/internal/types/timestamp/timestamp_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package timestamp
 
 import "testing"
diff --git a/internal/types/zero.go b/internal/types/zero.go
new file mode 100644
index 00000000000..ba7b61f15ad
--- /dev/null
+++ b/internal/types/zero.go
@@ -0,0 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package types
+
+import (
+	"reflect"
+)
+
+// IsZero returns true if `v` is `nil` or points to the zero value of `T`.
+func IsZero[T any](v *T) bool {
+	return v == nil || reflect.ValueOf(*v).IsZero()
+}
diff --git a/internal/types/zero_test.go b/internal/types/zero_test.go
new file mode 100644
index 00000000000..f90df68dbdf
--- /dev/null
+++ b/internal/types/zero_test.go
@@ -0,0 +1,55 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package types
+
+import (
+	"testing"
+)
+
+type AIsZero struct {
+	Key   string
+	Value int
+}
+
+func TestIsZero(t *testing.T) {
+	t.Parallel()
+
+	testCases := []struct {
+		Name     string
+		Ptr      *AIsZero
+		Expected bool
+	}{
+		{
+			Name:     "nil pointer",
+			Expected: true,
+		},
+		{
+			Name:     "pointer to zero value",
+			Ptr:      &AIsZero{},
+			Expected: true,
+		},
+		{
+			Name: "pointer to non-zero value Key",
+			Ptr:  &AIsZero{Key: "test"},
+		},
+		{
+			Name: "pointer to non-zero value Value",
+			Ptr:  &AIsZero{Value: 42},
+		},
+	}
+
+	for _, testCase := range testCases {
+		testCase := testCase
+
+		t.Run(testCase.Name, func(t *testing.T) {
+			t.Parallel()
+
+			got := IsZero(testCase.Ptr)
+
+			if got != testCase.Expected {
+				t.Errorf("got %t, expected %t", got, testCase.Expected)
+			}
+		})
+	}
+}
diff --git a/internal/vault/helper/pgpkeys/encrypt_decrypt.go b/internal/vault/helper/pgpkeys/encrypt_decrypt.go
index 788401d5790..bde3f749599 100644
--- a/internal/vault/helper/pgpkeys/encrypt_decrypt.go
+++ b/internal/vault/helper/pgpkeys/encrypt_decrypt.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package pgpkeys
 
 import (
diff --git a/internal/vault/helper/pgpkeys/keybase.go b/internal/vault/helper/pgpkeys/keybase.go
index c54ccc32d08..06c13c4ddd9 100644
--- a/internal/vault/helper/pgpkeys/keybase.go
+++ b/internal/vault/helper/pgpkeys/keybase.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package pgpkeys
 
 import (
diff --git a/internal/vault/helper/pgpkeys/keybase_test.go b/internal/vault/helper/pgpkeys/keybase_test.go
index 52d3b67a3a8..554e3279160 100644
--- a/internal/vault/helper/pgpkeys/keybase_test.go
+++ b/internal/vault/helper/pgpkeys/keybase_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package pgpkeys
 
 import (
diff --git a/internal/vault/sdk/helper/jsonutil/json.go b/internal/vault/sdk/helper/jsonutil/json.go
index 51cca5f2643..11dde9bae2d 100644
--- a/internal/vault/sdk/helper/jsonutil/json.go
+++ b/internal/vault/sdk/helper/jsonutil/json.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package jsonutil
 
 import (
diff --git a/internal/vault/sdk/helper/jsonutil/json_test.go b/internal/vault/sdk/helper/jsonutil/json_test.go
index fde05295c36..6b73c798534 100644
--- a/internal/vault/sdk/helper/jsonutil/json_test.go
+++ b/internal/vault/sdk/helper/jsonutil/json_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package jsonutil
 
 import (
diff --git a/internal/verify/base64.go b/internal/verify/base64.go
index 766e5c984bc..9927d226da9 100644
--- a/internal/verify/base64.go
+++ b/internal/verify/base64.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package verify
 
 import (
diff --git a/internal/verify/base64_test.go b/internal/verify/base64_test.go
index 69b485c5121..7e5284db0ba 100644
--- a/internal/verify/base64_test.go
+++ b/internal/verify/base64_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package verify
 
 import (
diff --git a/internal/verify/cidr.go b/internal/verify/cidr.go
deleted file mode 100644
index e115f56b7c6..00000000000
--- a/internal/verify/cidr.go
+++ /dev/null
@@ -1,34 +0,0 @@
-package verify
-
-import (
-	"net"
-)
-
-// CIDRBlocksEqual returns whether or not two CIDR blocks are equal:
-// - Both CIDR blocks parse to an IP address and network
-// - The string representation of the IP addresses are equal
-// - The string representation of the networks are equal
-// This function is especially useful for IPv6 CIDR blocks which have multiple valid representations.
-func CIDRBlocksEqual(cidr1, cidr2 string) bool {
-	ip1, ipnet1, err := net.ParseCIDR(cidr1)
-	if err != nil {
-		return false
-	}
-	ip2, ipnet2, err := net.ParseCIDR(cidr2)
-	if err != nil {
-		return false
-	}
-
-	return ip2.String() == ip1.String() && ipnet2.String() == ipnet1.String()
-}
-
-// CanonicalCIDRBlock returns the canonical representation of a CIDR block.
-// This function is especially useful for hash functions for sets which include IPv6 CIDR blocks.
-func CanonicalCIDRBlock(cidr string) string {
-	_, ipnet, err := net.ParseCIDR(cidr)
-	if err != nil {
-		return cidr
-	}
-
-	return ipnet.String()
-}
diff --git a/internal/verify/cidr_test.go b/internal/verify/cidr_test.go
deleted file mode 100644
index fd22d383a64..00000000000
--- a/internal/verify/cidr_test.go
+++ /dev/null
@@ -1,47 +0,0 @@
-package verify
-
-import (
-	"testing"
-)
-
-func TestCIDRBlocksEqual(t *testing.T) {
-	t.Parallel()
-
-	for _, ts := range []struct {
-		cidr1 string
-		cidr2 string
-		equal bool
-	}{
-		{"10.2.2.0/24", "10.2.2.0/24", true},
-		{"10.2.2.0/1234", "10.2.2.0/24", false},
-		{"10.2.2.0/24", "10.2.2.0/1234", false},
-		{"2001::/15", "2001::/15", true},
-		{"::/0", "2001::/15", false},
-		{"::/0", "::0/0", true},
-		{"", "", false},
-	} {
-		equal := CIDRBlocksEqual(ts.cidr1, ts.cidr2)
-		if ts.equal != equal {
-			t.Fatalf("CIDRBlocksEqual(%q, %q) should be: %t", ts.cidr1, ts.cidr2, ts.equal)
-		}
-	}
-}
-
-func TestCanonicalCIDRBlock(t *testing.T) {
-	t.Parallel()
-
-	for _, ts := range []struct {
-		cidr     string
-		expected string
-	}{
-		{"10.2.2.0/24", "10.2.2.0/24"},
-		{"::/0", "::/0"},
-		{"::0/0", "::/0"},
-		{"", ""},
-	} {
-		got := CanonicalCIDRBlock(ts.cidr)
-		if ts.expected != got {
-			t.Fatalf("CanonicalCIDRBlock(%q) should be: %q, got: %q", ts.cidr, ts.expected, got)
-		}
-	}
-}
diff --git a/internal/verify/diff.go b/internal/verify/diff.go
index b39badbed14..5e9c779a285 100644
--- a/internal/verify/diff.go
+++ b/internal/verify/diff.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package verify
 
 import (
diff --git a/internal/verify/diff_test.go b/internal/verify/diff_test.go
index 96c365850e4..3ddc36b4c3e 100644
--- a/internal/verify/diff_test.go
+++ b/internal/verify/diff_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package verify
 
 import (
diff --git a/internal/verify/json.go b/internal/verify/json.go
index 23646e134e1..e8201011177 100644
--- a/internal/verify/json.go
+++ b/internal/verify/json.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package verify
 
 import (
@@ -6,9 +9,9 @@ import (
 	"fmt"
 	"log"
 	"reflect"
-	"regexp"
 	"strings"
 
+	"github.com/YakDriver/regexache"
 	awspolicy "github.com/hashicorp/awspolicyequivalence"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/structure"
@@ -70,7 +73,7 @@ func NormalizeJSONOrYAMLString(templateString interface{}) (string, error) {
 }
 
 func looksLikeJSONString(s interface{}) bool {
-	return regexp.MustCompile(`^\s*{`).MatchString(s.(string))
+	return regexache.MustCompile(`^\s*{`).MatchString(s.(string))
 }
 
 func JSONStringsEqual(s1, s2 string) bool {
@@ -159,7 +162,7 @@ func LegacyPolicyNormalize(policy interface{}) (string, error) {
 		return policy.(string), fmt.Errorf("legacy policy (%s) is invalid JSON: %w", policy, err)
 	}
 
-	m := regexp.MustCompile(`(?s)^(\{\n?)(.*?)(,\s*)?(  )?("Version":\s*"2012-10-17")(,)?(\n)?(.*?)(\})`)
+	m := regexache.MustCompile(`(?s)^(\{\n?)(.*?)(,\s*)?(  )?("Version":\s*"2012-10-17")(,)?(\n)?(.*?)(\})`)
 
 	n := m.ReplaceAllString(np, `$1$4$5$3$2$6$7$8$9`)
 
diff --git a/internal/verify/json_test.go b/internal/verify/json_test.go
index daa4d52256d..e759971fd77 100644
--- a/internal/verify/json_test.go
+++ b/internal/verify/json_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package verify
 
 import (
diff --git a/internal/verify/resource_differ.go b/internal/verify/resource_differ.go
index 2ce5b84738d..20977039f0b 100644
--- a/internal/verify/resource_differ.go
+++ b/internal/verify/resource_differ.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package verify
 
 // ResourceDiffer exposes the interface for accessing changes in a resource
diff --git a/internal/verify/semver.go b/internal/verify/semver.go
index 30225036a6f..898d3c78e7a 100644
--- a/internal/verify/semver.go
+++ b/internal/verify/semver.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package verify
 
 import (
diff --git a/internal/verify/semver_test.go b/internal/verify/semver_test.go
index ab734bcad3c..5bac5020062 100644
--- a/internal/verify/semver_test.go
+++ b/internal/verify/semver_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package verify
 
 import (
diff --git a/internal/verify/validate.go b/internal/verify/validate.go
index 170846dd01d..f8408784fcd 100644
--- a/internal/verify/validate.go
+++ b/internal/verify/validate.go
@@ -1,27 +1,33 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package verify
 
 import (
 	"encoding/json"
 	"fmt"
 	"net"
-	"regexp"
 	"strconv"
 	"strings"
 	"time"
 
+	"github.com/YakDriver/regexache"
 	"github.com/aws/aws-sdk-go/aws/arn"
-	"github.com/hashicorp/go-cty/cty"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	basevalidation "github.com/hashicorp/aws-sdk-go-base/v2/validation"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/structure"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs"
+	"github.com/hashicorp/terraform-provider-aws/internal/types"
 	"github.com/hashicorp/terraform-provider-aws/internal/types/timestamp"
 )
 
-var accountIDRegexp = regexp.MustCompile(`^(aws|aws-managed|third-party|\d{12}|cw.{10})$`)
-var partitionRegexp = regexp.MustCompile(`^aws(-[a-z]+)*$`)
-var regionRegexp = regexp.MustCompile(`^[a-z]{2}(-[a-z]+)+-\d$`)
+var accountIDRegexp = regexache.MustCompile(`^(aws|aws-managed|third-party|\d{12}|cw.{10})$`)
+var partitionRegexp = regexache.MustCompile(`^aws(-[a-z]+)*$`)
+var regionRegexp = regexache.MustCompile(`^[a-z]{2}(-[a-z]+)+-\d$`)
+
+// validates all listed in https://gist.github.com/shortjared/4c1e3fe52bdfa47522cfe5b41e5d6f22
+var servicePrincipalRegexp = regexache.MustCompile(`^([0-9a-z-]+\.){1,4}(amazonaws|amazon)\.com$`)
 
 func Valid4ByteASN(v interface{}, k string) (ws []string, errors []error) {
 	value := v.(string)
@@ -124,7 +130,7 @@ func ValidAccountID(v interface{}, k string) (ws []string, errors []error) {
 
 	// http://docs.aws.amazon.com/lambda/latest/dg/API_AddPermission.html
 	pattern := `^\d{12}$`
-	if !regexp.MustCompile(pattern).MatchString(value) {
+	if !regexache.MustCompile(pattern).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"%q doesn't look like AWS Account ID (exactly 12 digits): %q",
 			k, value))
@@ -133,26 +139,10 @@ func ValidAccountID(v interface{}, k string) (ws []string, errors []error) {
 	return
 }
 
-// ValidateCIDRBlock validates that the specified CIDR block is valid:
-// - The CIDR block parses to an IP address and network
-// - The CIDR block is the CIDR block for the network
-func ValidateCIDRBlock(cidr string) error {
-	_, ipnet, err := net.ParseCIDR(cidr)
-	if err != nil {
-		return fmt.Errorf("%q is not a valid CIDR block: %w", cidr, err)
-	}
-
-	if !CIDRBlocksEqual(cidr, ipnet.String()) {
-		return fmt.Errorf("%q is not a valid CIDR block; did you mean %q?", cidr, ipnet)
-	}
-
-	return nil
-}
-
 // ValidCIDRNetworkAddress ensures that the string value is a valid CIDR that
 // represents a network address - it adds an error otherwise
 func ValidCIDRNetworkAddress(v interface{}, k string) (ws []string, errors []error) {
-	if err := ValidateCIDRBlock(v.(string)); err != nil {
+	if err := types.ValidateCIDRBlock(v.(string)); err != nil {
 		errors = append(errors, err)
 		return
 	}
@@ -197,6 +187,8 @@ func ValidIAMPolicyJSON(v interface{}, k string) (ws []string, errors []error) {
 			errStr = fmt.Sprintf("%s, at byte offset %d", errStr, err.Offset)
 		}
 		errors = append(errors, fmt.Errorf("%q contains an invalid JSON policy: %s", k, errStr))
+	} else if err := basevalidation.JSONNoDuplicateKeys(value); err != nil {
+		errors = append(errors, fmt.Errorf("%q contains duplicate JSON keys: %s", k, err))
 	}
 
 	return //nolint:nakedret // Just a long function.
@@ -217,7 +209,7 @@ func ValidateIPv4CIDRBlock(cidr string) error {
 		return fmt.Errorf("%q is not a valid IPv4 CIDR block", cidr)
 	}
 
-	if !CIDRBlocksEqual(cidr, ipnet.String()) {
+	if !types.CIDRBlocksEqual(cidr, ipnet.String()) {
 		return fmt.Errorf("%q is not a valid IPv4 CIDR block; did you mean %q?", cidr, ipnet)
 	}
 
@@ -239,7 +231,7 @@ func ValidateIPv6CIDRBlock(cidr string) error {
 		return fmt.Errorf("%q is not a valid IPv6 CIDR block", cidr)
 	}
 
-	if !CIDRBlocksEqual(cidr, ipnet.String()) {
+	if !types.CIDRBlocksEqual(cidr, ipnet.String()) {
 		return fmt.Errorf("%q is not a valid IPv6 CIDR block; did you mean %q?", cidr, ipnet)
 	}
 
@@ -299,7 +291,7 @@ func ValidLaunchTemplateID(v interface{}, k string) (ws []string, errors []error
 		errors = append(errors, fmt.Errorf("%q cannot be shorter than 1 character", k))
 	} else if len(value) > 255 {
 		errors = append(errors, fmt.Errorf("%q cannot be longer than 255 characters", k))
-	} else if !regexp.MustCompile(`^lt\-[a-z0-9]+$`).MatchString(value) {
+	} else if !regexache.MustCompile(`^lt\-[0-9a-z]+$`).MatchString(value) {
 		errors = append(errors, fmt.Errorf(
 			"%q must begin with 'lt-' and be comprised of only alphanumeric characters: %v", k, value))
 	}
@@ -314,7 +306,7 @@ func ValidLaunchTemplateName(v interface{}, k string) (ws []string, errors []err
 		errors = append(errors, fmt.Errorf("%q cannot be longer than 99 characters, name is limited to 125", k))
 	} else if !strings.HasSuffix(k, "prefix") && len(value) > 125 {
 		errors = append(errors, fmt.Errorf("%q cannot be longer than 125 characters", k))
-	} else if !regexp.MustCompile(`^[0-9a-zA-Z()./_\-]+$`).MatchString(value) {
+	} else if !regexache.MustCompile(`^[0-9A-Za-z()./_\-]+$`).MatchString(value) {
 		errors = append(errors, fmt.Errorf("%q can only alphanumeric characters and ()./_- symbols", k))
 	}
 	return
@@ -432,7 +424,7 @@ func ValidUTCTimestamp(v interface{}, k string) (ws []string, errors []error) {
 
 var ValidStringDateOrPositiveInt = validation.Any(
 	validation.IsRFC3339Time,
-	validation.StringMatch(regexp.MustCompile(`^\d+$`), "must be a positive integer value"),
+	validation.StringMatch(regexache.MustCompile(`^\d+$`), "must be a positive integer value"),
 )
 
 func ValidDuration(v interface{}, k string) (ws []string, errors []error) {
@@ -466,28 +458,20 @@ func FloatGreaterThan(threshold float64) schema.SchemaValidateFunc {
 	}
 }
 
-// https://github.com/hashicorp/terraform-plugin-sdk/issues/780.
-func ValidAllDiag(validators ...schema.SchemaValidateDiagFunc) schema.SchemaValidateDiagFunc {
-	return func(i any, path cty.Path) diag.Diagnostics {
-		var results diag.Diagnostics
-		for _, validator := range validators {
-			results = append(results, validator(i, path)...)
-		}
-		return results
+func ValidServicePrincipal(v interface{}, k string) (ws []string, errors []error) {
+	value := v.(string)
+
+	if value == "" {
+		return ws, errors
 	}
-}
 
-// https://github.com/hashicorp/terraform-plugin-sdk/issues/780.
-func ValidAnyDiag(validators ...schema.SchemaValidateDiagFunc) schema.SchemaValidateDiagFunc {
-	return func(i any, path cty.Path) diag.Diagnostics {
-		var results diag.Diagnostics
-		for _, validator := range validators {
-			diags := validator(i, path)
-			if len(diags) == 0 {
-				return diag.Diagnostics{}
-			}
-			results = append(results, diags...)
-		}
-		return results
+	if !IsServicePrincipal(value) {
+		errors = append(errors, fmt.Errorf("%q (%s) is an invalid Service Principal: invalid prefix value (expecting to match regular expression: %s)", k, value, servicePrincipalRegexp))
 	}
+
+	return ws, errors
+}
+
+func IsServicePrincipal(value string) (valid bool) {
+	return servicePrincipalRegexp.MatchString(value)
 }
diff --git a/internal/verify/validate_test.go b/internal/verify/validate_test.go
index d3db084ee9f..198d2ca076d 100644
--- a/internal/verify/validate_test.go
+++ b/internal/verify/validate_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package verify
 
 import (
@@ -5,6 +8,7 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/YakDriver/regexache"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 )
@@ -109,7 +113,7 @@ func TestValidTypeStringNullableFloat(t *testing.T) {
 		},
 		{
 			val:         "threeve",
-			expectedErr: regexp.MustCompile(`cannot parse`),
+			expectedErr: regexache.MustCompile(`cannot parse`),
 		},
 	}
 
@@ -220,32 +224,6 @@ func TestValidARN(t *testing.T) {
 	}
 }
 
-func TestValidateCIDRBlock(t *testing.T) {
-	t.Parallel()
-
-	for _, ts := range []struct {
-		cidr  string
-		valid bool
-	}{
-		{"10.2.2.0/24", true},
-		{"10.2.2.0/1234", false},
-		{"10.2.2.2/24", false},
-		{"::/0", true},
-		{"::0/0", true},
-		{"2000::/15", true},
-		{"2001::/15", false},
-		{"", false},
-	} {
-		err := ValidateCIDRBlock(ts.cidr)
-		if !ts.valid && err == nil {
-			t.Fatalf("Input '%s' should error but didn't!", ts.cidr)
-		}
-		if ts.valid && err != nil {
-			t.Fatalf("Got unexpected error for '%s' input: %s", ts.cidr, err)
-		}
-	}
-}
-
 func TestValidCIDRNetworkAddress(t *testing.T) {
 	t.Parallel()
 
@@ -432,6 +410,10 @@ func TestValidIAMPolicyJSONString(t *testing.T) {
 			Value:     `[{}]`,
 			WantError: `"json" contains an invalid JSON policy: contains a JSON array, not a JSON object`,
 		},
+		{
+			Value:     `{"a":"foo","a":"bar"}`,
+			WantError: `"json" contains duplicate JSON keys: duplicate key "a"`,
+		},
 	}
 	for _, test := range tests {
 		test := test
@@ -760,3 +742,41 @@ func TestFloatGreaterThan(t *testing.T) {
 		}
 	}
 }
+
+func TestValidServicePrincipal(t *testing.T) {
+	t.Parallel()
+
+	v := ""
+	_, errors := ValidServicePrincipal(v, "test.google.com")
+	if len(errors) != 0 {
+		t.Fatalf("%q should not be validated as an Service Principal name: %q", v, errors)
+	}
+
+	validNames := []string{
+		"a4b.amazonaws.com",
+		"appstream.application-autoscaling.amazonaws.com",
+		"alexa-appkit.amazon.com",
+		"member.org.stacksets.cloudformation.amazonaws.com",
+		"vpc-flow-logs.amazonaws.com",
+		"logs.eu-central-1.amazonaws.com",
+	}
+	for _, v := range validNames {
+		_, errors := ValidServicePrincipal(v, "arn")
+		if len(errors) != 0 {
+			t.Fatalf("%q should be a valid Service Principal: %q", v, errors)
+		}
+	}
+
+	invalidNames := []string{
+		"test.google.com",
+		"transfer.amz.com",
+		"test",
+		"testwithwildcard*",
+	}
+	for _, v := range invalidNames {
+		_, errors := ValidServicePrincipal(v, "arn")
+		if len(errors) == 0 {
+			t.Fatalf("%q should be an invalid Service Principal", v)
+		}
+	}
+}
diff --git a/internal/verify/verify.go b/internal/verify/verify.go
index 701aa6a5cef..f0bc95de42a 100644
--- a/internal/verify/verify.go
+++ b/internal/verify/verify.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package verify
 
 import (
@@ -6,7 +9,7 @@ import (
 	"gopkg.in/yaml.v2"
 )
 
-const UUIDRegexPattern = `[a-f0-9]{8}-[a-f0-9]{4}-[1-5][a-f0-9]{3}-[ab89][a-f0-9]{3}-[a-f0-9]{12}`
+const UUIDRegexPattern = `[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[ab89][0-9a-f]{3}-[0-9a-f]{12}`
 
 func SliceContainsString(slice []interface{}, s string) (int, bool) {
 	for idx, value := range slice {
diff --git a/internal/verify/verify_test.go b/internal/verify/verify_test.go
index 0f15051bb3d..d210f4498db 100644
--- a/internal/verify/verify_test.go
+++ b/internal/verify/verify_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package verify
 
 import (
diff --git a/main.go b/main.go
index b40c75d2eb2..b73cae18c64 100644
--- a/main.go
+++ b/main.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package main
 
 import (
diff --git a/mkdocs.yml b/mkdocs.yml
index 451bc548058..30a3eccae9f 100644
--- a/mkdocs.yml
+++ b/mkdocs.yml
@@ -29,15 +29,18 @@ nav:
   - Developer Reference:
       - Acceptance Test Environment Variables: acc-test-environment-variables.md
       - Data Handling and Conversion: data-handling-and-conversion.md
+      - Debugging: debugging.md
+      - Design Decision Log: design-decision-log.md
       - Dependency Updates: dependency-updates.md
       - AWS SDK for Go Versions: aws-go-sdk-versions.md
-      - Terraform Plugin Versions: terraform-plugin-versions.md
+      - Terraform Plugin Development Packages: terraform-plugin-development-packages.md
       - AWS Go SDK Base: aws-go-sdk-base.md
       - Error Handling: error-handling.md
       - Provider Design: provider-design.md
       - Provider Scaffolding (skaff): skaff.md
       - Naming Standards: naming.md
       - Retries and Waiters: retries-and-waiters.md
+      - Regular Expressions: regular-expressions.md
   - Submit an Issue: issue-reporting-and-lifecycle.md
   - FAQ: faq.md
 
@@ -55,6 +58,7 @@ theme:
   features:
     - navigation.instant
     - content.tabs.link
+    - content.code.copy
 
 plugins:
   - search:
@@ -62,8 +66,11 @@ plugins:
         - en
 
 markdown_extensions:
+  - admonition
   - pymdownx.highlight
   - pymdownx.superfences
+  - pymdownx.tabbed:
+      alternate_style: true
   - pymdownx.inlinehilite
   - toc:
       permalink: "#"
diff --git a/names/attr_consts.go b/names/attr_consts.go
index 91bf443e703..a6bcf5b960d 100644
--- a/names/attr_consts.go
+++ b/names/attr_consts.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package names
 
 const (
diff --git a/names/columns.go b/names/columns.go
index 73071386695..acb527a80d8 100644
--- a/names/columns.go
+++ b/names/columns.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package names
 
 const (
@@ -20,9 +23,10 @@ const (
 	ColDocPrefix               = 16
 	ColHumanFriendly           = 17
 	ColBrand                   = 18
-	ColExclude                 = 19
-	ColAllowedSubcategory      = 20
-	ColDeprecatedEnvVar        = 21
-	ColEnvVar                  = 22
-	ColNote                    = 23
+	ColExclude                 = 19 // If set, the service is completely ignored
+	ColNotImplemented          = 20 // If set, the service will be included in, e.g. labels, but not have a service client
+	ColAllowedSubcategory      = 21
+	ColDeprecatedEnvVar        = 22
+	ColEnvVar                  = 23
+	ColNote                    = 24
 )
diff --git a/names/consts_gen.go b/names/consts_gen.go
index c58019cbe79..7ff7287d2f5 100644
--- a/names/consts_gen.go
+++ b/names/consts_gen.go
@@ -6,97 +6,71 @@ const (
 	ACMPCA                       = "acmpca"
 	AMP                          = "amp"
 	APIGateway                   = "apigateway"
-	APIGatewayManagementAPI      = "apigatewaymanagementapi"
 	APIGatewayV2                 = "apigatewayv2"
 	AccessAnalyzer               = "accessanalyzer"
 	Account                      = "account"
-	AlexaForBusiness             = "alexaforbusiness"
 	Amplify                      = "amplify"
-	AmplifyBackend               = "amplifybackend"
-	AmplifyUIBuilder             = "amplifyuibuilder"
 	AppAutoScaling               = "appautoscaling"
 	AppConfig                    = "appconfig"
-	AppConfigData                = "appconfigdata"
 	AppFlow                      = "appflow"
 	AppIntegrations              = "appintegrations"
 	AppMesh                      = "appmesh"
 	AppRunner                    = "apprunner"
 	AppStream                    = "appstream"
 	AppSync                      = "appsync"
-	ApplicationCostProfiler      = "applicationcostprofiler"
 	ApplicationInsights          = "applicationinsights"
 	Athena                       = "athena"
 	AuditManager                 = "auditmanager"
 	AutoScaling                  = "autoscaling"
 	AutoScalingPlans             = "autoscalingplans"
 	Backup                       = "backup"
-	BackupGateway                = "backupgateway"
 	Batch                        = "batch"
-	BillingConductor             = "billingconductor"
-	Braket                       = "braket"
+	Bedrock                      = "bedrock"
 	Budgets                      = "budgets"
 	CE                           = "ce"
 	CUR                          = "cur"
 	Chime                        = "chime"
-	ChimeSDKIdentity             = "chimesdkidentity"
 	ChimeSDKMediaPipelines       = "chimesdkmediapipelines"
-	ChimeSDKMeetings             = "chimesdkmeetings"
-	ChimeSDKMessaging            = "chimesdkmessaging"
 	ChimeSDKVoice                = "chimesdkvoice"
 	CleanRooms                   = "cleanrooms"
 	Cloud9                       = "cloud9"
 	CloudControl                 = "cloudcontrol"
-	CloudDirectory               = "clouddirectory"
 	CloudFormation               = "cloudformation"
 	CloudFront                   = "cloudfront"
 	CloudHSMV2                   = "cloudhsmv2"
 	CloudSearch                  = "cloudsearch"
-	CloudSearchDomain            = "cloudsearchdomain"
 	CloudTrail                   = "cloudtrail"
 	CloudWatch                   = "cloudwatch"
 	CodeArtifact                 = "codeartifact"
 	CodeBuild                    = "codebuild"
+	CodeCatalyst                 = "codecatalyst"
 	CodeCommit                   = "codecommit"
-	CodeGuruProfiler             = "codeguruprofiler"
 	CodeGuruReviewer             = "codegurureviewer"
 	CodePipeline                 = "codepipeline"
-	CodeStar                     = "codestar"
 	CodeStarConnections          = "codestarconnections"
 	CodeStarNotifications        = "codestarnotifications"
 	CognitoIDP                   = "cognitoidp"
 	CognitoIdentity              = "cognitoidentity"
-	CognitoSync                  = "cognitosync"
 	Comprehend                   = "comprehend"
-	ComprehendMedical            = "comprehendmedical"
 	ComputeOptimizer             = "computeoptimizer"
 	ConfigService                = "configservice"
 	Connect                      = "connect"
-	ConnectContactLens           = "connectcontactlens"
-	ConnectParticipant           = "connectparticipant"
 	ControlTower                 = "controltower"
-	CustomerProfiles             = "customerprofiles"
 	DAX                          = "dax"
 	DLM                          = "dlm"
 	DMS                          = "dms"
-	DRS                          = "drs"
 	DS                           = "ds"
-	DataBrew                     = "databrew"
 	DataExchange                 = "dataexchange"
 	DataPipeline                 = "datapipeline"
 	DataSync                     = "datasync"
 	Deploy                       = "deploy"
 	Detective                    = "detective"
-	DevOpsGuru                   = "devopsguru"
 	DeviceFarm                   = "devicefarm"
 	DirectConnect                = "directconnect"
-	Discovery                    = "discovery"
 	DocDB                        = "docdb"
 	DocDBElastic                 = "docdbelastic"
 	DynamoDB                     = "dynamodb"
-	DynamoDBStreams              = "dynamodbstreams"
-	EBS                          = "ebs"
 	EC2                          = "ec2"
-	EC2InstanceConnect           = "ec2instanceconnect"
 	ECR                          = "ecr"
 	ECRPublic                    = "ecrpublic"
 	ECS                          = "ecs"
@@ -109,7 +83,6 @@ const (
 	EMRServerless                = "emrserverless"
 	ElastiCache                  = "elasticache"
 	ElasticBeanstalk             = "elasticbeanstalk"
-	ElasticInference             = "elasticinference"
 	ElasticTranscoder            = "elastictranscoder"
 	Elasticsearch                = "elasticsearch"
 	Events                       = "events"
@@ -118,23 +91,15 @@ const (
 	FMS                          = "fms"
 	FSx                          = "fsx"
 	FinSpace                     = "finspace"
-	FinSpaceData                 = "finspacedata"
 	Firehose                     = "firehose"
-	Forecast                     = "forecast"
-	ForecastQuery                = "forecastquery"
-	FraudDetector                = "frauddetector"
 	GameLift                     = "gamelift"
 	Glacier                      = "glacier"
 	GlobalAccelerator            = "globalaccelerator"
 	Glue                         = "glue"
 	Grafana                      = "grafana"
 	Greengrass                   = "greengrass"
-	GreengrassV2                 = "greengrassv2"
-	GroundStation                = "groundstation"
 	GuardDuty                    = "guardduty"
-	Health                       = "health"
 	HealthLake                   = "healthlake"
-	Honeycode                    = "honeycode"
 	IAM                          = "iam"
 	IVS                          = "ivs"
 	IVSChat                      = "ivschat"
@@ -144,20 +109,8 @@ const (
 	Inspector2                   = "inspector2"
 	InternetMonitor              = "internetmonitor"
 	IoT                          = "iot"
-	IoT1ClickDevices             = "iot1clickdevices"
-	IoT1ClickProjects            = "iot1clickprojects"
 	IoTAnalytics                 = "iotanalytics"
-	IoTData                      = "iotdata"
-	IoTDeviceAdvisor             = "iotdeviceadvisor"
 	IoTEvents                    = "iotevents"
-	IoTEventsData                = "ioteventsdata"
-	IoTFleetHub                  = "iotfleethub"
-	IoTJobsData                  = "iotjobsdata"
-	IoTSecureTunneling           = "iotsecuretunneling"
-	IoTSiteWise                  = "iotsitewise"
-	IoTThingsGraph               = "iotthingsgraph"
-	IoTTwinMaker                 = "iottwinmaker"
-	IoTWireless                  = "iotwireless"
 	KMS                          = "kms"
 	Kafka                        = "kafka"
 	KafkaConnect                 = "kafkaconnect"
@@ -167,92 +120,50 @@ const (
 	KinesisAnalytics             = "kinesisanalytics"
 	KinesisAnalyticsV2           = "kinesisanalyticsv2"
 	KinesisVideo                 = "kinesisvideo"
-	KinesisVideoArchivedMedia    = "kinesisvideoarchivedmedia"
-	KinesisVideoMedia            = "kinesisvideomedia"
-	KinesisVideoSignaling        = "kinesisvideosignaling"
 	LakeFormation                = "lakeformation"
 	Lambda                       = "lambda"
 	LexModels                    = "lexmodels"
-	LexModelsV2                  = "lexmodelsv2"
-	LexRuntime                   = "lexruntime"
-	LexRuntimeV2                 = "lexruntimev2"
+	LexV2Models                  = "lexv2models"
 	LicenseManager               = "licensemanager"
 	Lightsail                    = "lightsail"
 	Location                     = "location"
 	Logs                         = "logs"
-	LookoutEquipment             = "lookoutequipment"
-	LookoutMetrics               = "lookoutmetrics"
-	LookoutVision                = "lookoutvision"
 	MQ                           = "mq"
-	MTurk                        = "mturk"
 	MWAA                         = "mwaa"
-	MachineLearning              = "machinelearning"
-	Macie                        = "macie"
 	Macie2                       = "macie2"
-	ManagedBlockchain            = "managedblockchain"
-	MarketplaceCatalog           = "marketplacecatalog"
-	MarketplaceCommerceAnalytics = "marketplacecommerceanalytics"
-	MarketplaceEntitlement       = "marketplaceentitlement"
-	MarketplaceMetering          = "marketplacemetering"
 	MediaConnect                 = "mediaconnect"
 	MediaConvert                 = "mediaconvert"
 	MediaLive                    = "medialive"
 	MediaPackage                 = "mediapackage"
-	MediaPackageVOD              = "mediapackagevod"
 	MediaStore                   = "mediastore"
-	MediaStoreData               = "mediastoredata"
-	MediaTailor                  = "mediatailor"
 	MemoryDB                     = "memorydb"
-	MgH                          = "mgh"
-	Mgn                          = "mgn"
-	MigrationHubConfig           = "migrationhubconfig"
-	MigrationHubRefactorSpaces   = "migrationhubrefactorspaces"
-	MigrationHubStrategy         = "migrationhubstrategy"
-	Mobile                       = "mobile"
 	Neptune                      = "neptune"
 	NetworkFirewall              = "networkfirewall"
 	NetworkManager               = "networkmanager"
-	Nimble                       = "nimble"
 	ObservabilityAccessManager   = "oam"
 	OpenSearch                   = "opensearch"
 	OpenSearchServerless         = "opensearchserverless"
 	OpsWorks                     = "opsworks"
-	OpsWorksCM                   = "opsworkscm"
 	Organizations                = "organizations"
 	Outposts                     = "outposts"
-	PI                           = "pi"
-	Panorama                     = "panorama"
-	Personalize                  = "personalize"
-	PersonalizeEvents            = "personalizeevents"
-	PersonalizeRuntime           = "personalizeruntime"
 	Pinpoint                     = "pinpoint"
-	PinpointEmail                = "pinpointemail"
-	PinpointSMSVoice             = "pinpointsmsvoice"
 	Pipes                        = "pipes"
-	Polly                        = "polly"
 	Pricing                      = "pricing"
-	Proton                       = "proton"
 	QLDB                         = "qldb"
-	QLDBSession                  = "qldbsession"
 	QuickSight                   = "quicksight"
 	RAM                          = "ram"
 	RBin                         = "rbin"
 	RDS                          = "rds"
-	RDSData                      = "rdsdata"
 	RUM                          = "rum"
 	Redshift                     = "redshift"
 	RedshiftData                 = "redshiftdata"
 	RedshiftServerless           = "redshiftserverless"
-	Rekognition                  = "rekognition"
-	ResilienceHub                = "resiliencehub"
 	ResourceExplorer2            = "resourceexplorer2"
 	ResourceGroups               = "resourcegroups"
 	ResourceGroupsTaggingAPI     = "resourcegroupstaggingapi"
-	RoboMaker                    = "robomaker"
 	RolesAnywhere                = "rolesanywhere"
 	Route53                      = "route53"
 	Route53Domains               = "route53domains"
-	Route53RecoveryCluster       = "route53recoverycluster"
 	Route53RecoveryControlConfig = "route53recoverycontrolconfig"
 	Route53RecoveryReadiness     = "route53recoveryreadiness"
 	Route53Resolver              = "route53resolver"
@@ -262,23 +173,15 @@ const (
 	SES                          = "ses"
 	SESV2                        = "sesv2"
 	SFN                          = "sfn"
-	SMS                          = "sms"
 	SNS                          = "sns"
 	SQS                          = "sqs"
 	SSM                          = "ssm"
 	SSMContacts                  = "ssmcontacts"
 	SSMIncidents                 = "ssmincidents"
-	SSO                          = "sso"
 	SSOAdmin                     = "ssoadmin"
-	SSOOIDC                      = "ssooidc"
 	STS                          = "sts"
 	SWF                          = "swf"
 	SageMaker                    = "sagemaker"
-	SageMakerA2IRuntime          = "sagemakera2iruntime"
-	SageMakerEdge                = "sagemakeredge"
-	SageMakerFeatureStoreRuntime = "sagemakerfeaturestoreruntime"
-	SageMakerRuntime             = "sagemakerruntime"
-	SavingsPlans                 = "savingsplans"
 	Scheduler                    = "scheduler"
 	Schemas                      = "schemas"
 	SecretsManager               = "secretsmanager"
@@ -286,36 +189,22 @@ const (
 	SecurityLake                 = "securitylake"
 	ServerlessRepo               = "serverlessrepo"
 	ServiceCatalog               = "servicecatalog"
-	ServiceCatalogAppRegistry    = "servicecatalogappregistry"
 	ServiceDiscovery             = "servicediscovery"
 	ServiceQuotas                = "servicequotas"
 	Shield                       = "shield"
 	Signer                       = "signer"
 	SimpleDB                     = "simpledb"
-	SnowDeviceManagement         = "snowdevicemanagement"
-	Snowball                     = "snowball"
 	StorageGateway               = "storagegateway"
-	Support                      = "support"
 	Synthetics                   = "synthetics"
-	Textract                     = "textract"
-	TimestreamQuery              = "timestreamquery"
 	TimestreamWrite              = "timestreamwrite"
 	Transcribe                   = "transcribe"
-	TranscribeStreaming          = "transcribestreaming"
 	Transfer                     = "transfer"
-	Translate                    = "translate"
 	VPCLattice                   = "vpclattice"
-	VoiceID                      = "voiceid"
+	VerifiedPermissions          = "verifiedpermissions"
 	WAF                          = "waf"
 	WAFRegional                  = "wafregional"
 	WAFV2                        = "wafv2"
-	WellArchitected              = "wellarchitected"
-	Wisdom                       = "wisdom"
-	WorkDocs                     = "workdocs"
 	WorkLink                     = "worklink"
-	WorkMail                     = "workmail"
-	WorkMailMessageFlow          = "workmailmessageflow"
 	WorkSpaces                   = "workspaces"
-	WorkSpacesWeb                = "workspacesweb"
 	XRay                         = "xray"
 )
diff --git a/names/generate.go b/names/generate.go
index 5108487e594..3344ae3ce54 100644
--- a/names/generate.go
+++ b/names/generate.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 //go:generate go run ../internal/generate/namesconsts/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
 
diff --git a/names/names.go b/names/names.go
index 4a6c9c23925..8fb3da91a0c 100644
--- a/names/names.go
+++ b/names/names.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 // Package names provides constants for AWS service names that are used as keys
 // for the endpoints slice in internal/conns/conns.go. The package also exposes
 // access to data found in the names_data.csv file, which provides additional
@@ -20,40 +23,72 @@ import (
 	"strings"
 )
 
-// This "should" be defined by the AWS Go SDK v2, but currently isn't.
+// These "should" be defined by the AWS Go SDK v2, but currently aren't.
 const (
 	AccessAnalyzerEndpointID             = "access-analyzer"
 	AccountEndpointID                    = "account"
 	ACMEndpointID                        = "acm"
 	AuditManagerEndpointID               = "auditmanager"
+	CleanRoomsEndpointID                 = "cleanrooms"
 	CloudWatchLogsEndpointID             = "logs"
+	CodeStarConnectionsEndpointID        = "codestar-connections"
+	CodeStarNotificationsEndpointID      = "codestar-notifications"
 	ComprehendEndpointID                 = "comprehend"
 	ComputeOptimizerEndpointID           = "computeoptimizer"
 	DSEndpointID                         = "ds"
+	EMRServerlessEndpointID              = "emrserverless"
 	GlacierEndpointID                    = "glacier"
 	IdentityStoreEndpointID              = "identitystore"
 	Inspector2EndpointID                 = "inspector2"
+	InternetMonitorEndpointID            = "internetmonitor"
 	IVSChatEndpointID                    = "ivschat"
 	KendraEndpointID                     = "kendra"
+	KeyspacesEndpointID                  = "keyspaces"
 	LambdaEndpointID                     = "lambda"
+	LexV2ModelsEndpointID                = "models-v2-lex"
 	MediaLiveEndpointID                  = "medialive"
 	ObservabilityAccessManagerEndpointID = "oam"
 	OpenSearchServerlessEndpointID       = "aoss"
 	PipesEndpointID                      = "pipes"
+	PricingEndpointID                    = "pricing"
+	QLDBEndpointID                       = "qldb"
+	RedshiftDataEndpointID               = "redshift-data"
 	ResourceExplorer2EndpointID          = "resource-explorer-2"
+	ResourceGroupsEndpointID             = "resource-groups"
+	ResourceGroupsTaggingAPIEndpointID   = "tagging"
 	RolesAnywhereEndpointID              = "rolesanywhere"
 	Route53DomainsEndpointID             = "route53domains"
 	SchedulerEndpointID                  = "scheduler"
+	ServiceQuotasEndpointID              = "servicequotas"
+	S3EndpointID                         = "s3"
+	S3ControlEndpointID                  = "s3-control"
 	SESV2EndpointID                      = "sesv2"
 	SSMEndpointID                        = "ssm"
 	SSMContactsEndpointID                = "ssm-contacts"
 	SSMIncidentsEndpointID               = "ssm-incidents"
 	SWFEndpointID                        = "swf"
+	TimestreamWriteEndpointID            = "ingest.timestream"
 	TranscribeEndpointID                 = "transcribe"
 	VPCLatticeEndpointID                 = "vpc-lattice"
 	XRayEndpointID                       = "xray"
 )
 
+// These should move to aws-sdk-go-base.
+// See https://github.com/hashicorp/aws-sdk-go-base/issues/649.
+const (
+	StandardPartitionID   = "aws"        // AWS Standard partition.
+	USGovCloudPartitionID = "aws-us-gov" // AWS GovCloud (US) partition.
+)
+
+const (
+	USEast1RegionID = "us-east-1" // US East (N. Virginia).
+	USWest1RegionID = "us-west-1" // US West (N. California).
+	USWest2RegionID = "us-west-2" // US West (Oregon).
+
+	USGovEast1RegionID = "us-gov-east-1" // AWS GovCloud (US-East).
+	USGovWest1RegionID = "us-gov-west-1" // AWS GovCloud (US-West).
+)
+
 // Type ServiceDatum corresponds closely to columns in `names_data.csv` and are
 // described in detail in README.md.
 type ServiceDatum struct {
@@ -103,6 +138,10 @@ func readCSVIntoServiceData() error {
 			continue
 		}
 
+		if l[ColNotImplemented] != "" {
+			continue
+		}
+
 		if l[ColProviderPackageActual] == "" && l[ColProviderPackageCorrect] == "" {
 			continue
 		}
diff --git a/names/names_data.csv b/names/names_data.csv
index c2e804bb39f..e0fbae874eb 100644
--- a/names/names_data.csv
+++ b/names/names_data.csv
@@ -1,379 +1,382 @@
-AWSCLIV2Command,AWSCLIV2CommandNoDashes,GoV1Package,GoV2Package,ProviderPackageActual,ProviderPackageCorrect,SplitPackageRealPackage,Aliases,ProviderNameUpper,GoV1ClientTypeName,SkipClientGenerate,ClientSDKV1,ClientSDKV2,ResourcePrefixActual,ResourcePrefixCorrect,FilePrefix,DocPrefix,HumanFriendly,Brand,Exclude,AllowedSubcategory,DeprecatedEnvVar,EnvVar,Note
-accessanalyzer,accessanalyzer,accessanalyzer,accessanalyzer,,accessanalyzer,,,AccessAnalyzer,AccessAnalyzer,,,2,,aws_accessanalyzer_,,accessanalyzer_,IAM Access Analyzer,AWS,,,,,
-account,account,account,account,,account,,,Account,Account,,,2,,aws_account_,,account_,Account Management,AWS,,,,,
-acm,acm,acm,acm,,acm,,,ACM,ACM,,,2,,aws_acm_,,acm_,ACM (Certificate Manager),AWS,,,,,
-acm-pca,acmpca,acmpca,acmpca,,acmpca,,,ACMPCA,ACMPCA,,1,,,aws_acmpca_,,acmpca_,ACM PCA (Certificate Manager Private Certificate Authority),AWS,,,,,
-alexaforbusiness,alexaforbusiness,alexaforbusiness,alexaforbusiness,,alexaforbusiness,,,AlexaForBusiness,AlexaForBusiness,,1,,,aws_alexaforbusiness_,,alexaforbusiness_,Alexa for Business,,,,,,
-amp,amp,prometheusservice,amp,,amp,,prometheus;prometheusservice,AMP,PrometheusService,,1,,aws_prometheus_,aws_amp_,,prometheus_,AMP (Managed Prometheus),Amazon,,,,,
-amplify,amplify,amplify,amplify,,amplify,,,Amplify,Amplify,,1,,,aws_amplify_,,amplify_,Amplify,AWS,,,,,
-amplifybackend,amplifybackend,amplifybackend,amplifybackend,,amplifybackend,,,AmplifyBackend,AmplifyBackend,,1,,,aws_amplifybackend_,,amplifybackend_,Amplify Backend,AWS,,,,,
-amplifyuibuilder,amplifyuibuilder,amplifyuibuilder,amplifyuibuilder,,amplifyuibuilder,,,AmplifyUIBuilder,AmplifyUIBuilder,,1,,,aws_amplifyuibuilder_,,amplifyuibuilder_,Amplify UI Builder,AWS,,,,,
-,,,,,,,,,,,,,,,,,Apache MXNet on AWS,AWS,x,,,,Documentation
-apigateway,apigateway,apigateway,apigateway,,apigateway,,,APIGateway,APIGateway,,1,,aws_api_gateway_,aws_apigateway_,,api_gateway_,API Gateway,Amazon,,,,,
-apigatewaymanagementapi,apigatewaymanagementapi,apigatewaymanagementapi,apigatewaymanagementapi,,apigatewaymanagementapi,,,APIGatewayManagementAPI,ApiGatewayManagementApi,,1,,,aws_apigatewaymanagementapi_,,apigatewaymanagementapi_,API Gateway Management API,Amazon,,,,,
-apigatewayv2,apigatewayv2,apigatewayv2,apigatewayv2,,apigatewayv2,,,APIGatewayV2,ApiGatewayV2,,1,,,aws_apigatewayv2_,,apigatewayv2_,API Gateway V2,Amazon,,,,,
-appmesh,appmesh,appmesh,appmesh,,appmesh,,,AppMesh,AppMesh,,1,,,aws_appmesh_,,appmesh_,App Mesh,AWS,,,,,
-apprunner,apprunner,apprunner,apprunner,,apprunner,,,AppRunner,AppRunner,,1,,,aws_apprunner_,,apprunner_,App Runner,AWS,,,,,
-,,,,,,,,,,,,,,,,,App2Container,AWS,x,,,,No SDK support
-appconfig,appconfig,appconfig,appconfig,,appconfig,,,AppConfig,AppConfig,,1,2,,aws_appconfig_,,appconfig_,AppConfig,AWS,,,,,
-appconfigdata,appconfigdata,appconfigdata,appconfigdata,,appconfigdata,,,AppConfigData,AppConfigData,,1,,,aws_appconfigdata_,,appconfigdata_,AppConfig Data,AWS,,,,,
-appflow,appflow,appflow,appflow,,appflow,,,AppFlow,Appflow,,1,,,aws_appflow_,,appflow_,AppFlow,Amazon,,,,,
-appintegrations,appintegrations,appintegrationsservice,appintegrations,,appintegrations,,appintegrationsservice,AppIntegrations,AppIntegrationsService,,1,,,aws_appintegrations_,,appintegrations_,AppIntegrations,Amazon,,,,,
-application-autoscaling,applicationautoscaling,applicationautoscaling,applicationautoscaling,appautoscaling,applicationautoscaling,,applicationautoscaling,AppAutoScaling,ApplicationAutoScaling,,1,,aws_appautoscaling_,aws_applicationautoscaling_,,appautoscaling_,Application Auto Scaling,,,,,,
-applicationcostprofiler,applicationcostprofiler,applicationcostprofiler,applicationcostprofiler,,applicationcostprofiler,,,ApplicationCostProfiler,ApplicationCostProfiler,,1,,,aws_applicationcostprofiler_,,applicationcostprofiler_,Application Cost Profiler,AWS,,,,,
-discovery,discovery,applicationdiscoveryservice,applicationdiscoveryservice,,discovery,,applicationdiscovery;applicationdiscoveryservice,Discovery,ApplicationDiscoveryService,,1,,,aws_discovery_,,discovery_,Application Discovery,AWS,,,,,
-mgn,mgn,mgn,mgn,,mgn,,,Mgn,Mgn,,1,,,aws_mgn_,,mgn_,Application Migration (Mgn),AWS,,,,,
-appstream,appstream,appstream,appstream,,appstream,,,AppStream,AppStream,,1,,,aws_appstream_,,appstream_,AppStream 2.0,Amazon,,,,,
-appsync,appsync,appsync,appsync,,appsync,,,AppSync,AppSync,,1,,,aws_appsync_,,appsync_,AppSync,AWS,,,,,
-,,,,,,,,,,,,,,,,,Artifact,AWS,x,,,,No SDK support
-athena,athena,athena,athena,,athena,,,Athena,Athena,,1,,,aws_athena_,,athena_,Athena,Amazon,,,,,
-auditmanager,auditmanager,auditmanager,auditmanager,,auditmanager,,,AuditManager,AuditManager,,,2,,aws_auditmanager_,,auditmanager_,Audit Manager,AWS,,,,,
-autoscaling,autoscaling,autoscaling,autoscaling,,autoscaling,,,AutoScaling,AutoScaling,,1,,aws_(autoscaling_|launch_configuration),aws_autoscaling_,,autoscaling_;launch_configuration,Auto Scaling,,,,,,
-autoscaling-plans,autoscalingplans,autoscalingplans,autoscalingplans,,autoscalingplans,,,AutoScalingPlans,AutoScalingPlans,,1,,,aws_autoscalingplans_,,autoscalingplans_,Auto Scaling Plans,,,,,,
-,,,,,,,,,,,,,,,,,Backint Agent for SAP HANA,AWS,x,,,,No SDK support
-backup,backup,backup,backup,,backup,,,Backup,Backup,,1,,,aws_backup_,,backup_,Backup,AWS,,,,,
-backup-gateway,backupgateway,backupgateway,backupgateway,,backupgateway,,,BackupGateway,BackupGateway,,1,,,aws_backupgateway_,,backupgateway_,Backup Gateway,AWS,,,,,
-batch,batch,batch,batch,,batch,,,Batch,Batch,,1,,,aws_batch_,,batch_,Batch,AWS,,,,,
-billingconductor,billingconductor,billingconductor,,,billingconductor,,,BillingConductor,BillingConductor,,1,,,aws_billingconductor_,,billingconductor_,Billing Conductor,AWS,,,,,
-braket,braket,braket,braket,,braket,,,Braket,Braket,,1,,,aws_braket_,,braket_,Braket,Amazon,,,,,
-ce,ce,costexplorer,costexplorer,,ce,,costexplorer,CE,CostExplorer,,1,,,aws_ce_,,ce_,CE (Cost Explorer),AWS,,,,,
-,,,,,,,,,,,,,,,,,Chatbot,AWS,x,,,,No SDK support
-chime,chime,chime,chime,,chime,,,Chime,Chime,,1,,,aws_chime_,,chime_,Chime,Amazon,,,,,
-chime-sdk-identity,chimesdkidentity,chimesdkidentity,chimesdkidentity,,chimesdkidentity,,,ChimeSDKIdentity,ChimeSDKIdentity,,1,,,aws_chimesdkidentity_,,chimesdkidentity_,Chime SDK Identity,Amazon,,,,,
-chime-sdk-mediapipelines,chimesdkmediapipelines,chimesdkmediapipelines,chimesdkmediapipelines,,chimesdkmediapipelines,,,ChimeSDKMediaPipelines,ChimeSDKMediaPipelines,,1,,,aws_chimesdkmediapipelines_,,chimesdkmediapipelines_,Chime SDK Media Pipelines,Amazon,,,,,
-chime-sdk-meetings,chimesdkmeetings,chimesdkmeetings,chimesdkmeetings,,chimesdkmeetings,,,ChimeSDKMeetings,ChimeSDKMeetings,,1,,,aws_chimesdkmeetings_,,chimesdkmeetings_,Chime SDK Meetings,Amazon,,,,,
-chime-sdk-messaging,chimesdkmessaging,chimesdkmessaging,chimesdkmessaging,,chimesdkmessaging,,,ChimeSDKMessaging,ChimeSDKMessaging,,1,,,aws_chimesdkmessaging_,,chimesdkmessaging_,Chime SDK Messaging,Amazon,,,,,
-chime-sdk-voice,chimesdkvoice,chimesdkvoice,chimesdkvoice,,chimesdkvoice,,,ChimeSDKVoice,ChimeSDKVoice,,1,,,aws_chimesdkvoice_,,chimesdkvoice_,Chime SDK Voice,Amazon,,,,,
-cleanrooms,cleanrooms,cleanrooms,cleanrooms,,cleanrooms,,,CleanRooms,CleanRooms,,,2,,aws_cleanrooms_,,cleanrooms_,Clean Rooms,AWS,,,,,
-,,,,,,,,,,,,,,,,,CLI (Command Line Interface),AWS,x,,,,No SDK support
-configure,configure,,,,,,,,,,,,,,,,CLI Configure options,AWS,x,,,,CLI only
-ddb,ddb,,,,,,,,,,,,,,,,CLI High-level DynamoDB commands,AWS,x,,,,Part of DynamoDB
-s3,s3,,,,,,,,,,,,,,,,CLI High-level S3 commands,AWS,x,,,,CLI only
-history,history,,,,,,,,,,,,,,,,CLI History of commands,AWS,x,,,,CLI only
-importexport,importexport,,,,,,,,,,,,,,,,CLI Import/Export,AWS,x,,,,CLI only
-cli-dev,clidev,,,,,,,,,,,,,,,,CLI Internal commands for development,AWS,x,,,,CLI only
-cloudcontrol,cloudcontrol,cloudcontrolapi,cloudcontrol,,cloudcontrol,,cloudcontrolapi,CloudControl,CloudControlApi,,,2,aws_cloudcontrolapi_,aws_cloudcontrol_,,cloudcontrolapi_,Cloud Control API,AWS,,,,,
-,,,,,,,,,,,,,,,,,Cloud Digital Interface SDK,AWS,x,,,,No SDK support
-clouddirectory,clouddirectory,clouddirectory,clouddirectory,,clouddirectory,,,CloudDirectory,CloudDirectory,,1,,,aws_clouddirectory_,,clouddirectory_,Cloud Directory,Amazon,,,,,
-servicediscovery,servicediscovery,servicediscovery,servicediscovery,,servicediscovery,,,ServiceDiscovery,ServiceDiscovery,,1,,aws_service_discovery_,aws_servicediscovery_,,service_discovery_,Cloud Map,AWS,,,,,
-cloud9,cloud9,cloud9,cloud9,,cloud9,,,Cloud9,Cloud9,,1,,,aws_cloud9_,,cloud9_,Cloud9,AWS,,,,,
-cloudformation,cloudformation,cloudformation,cloudformation,,cloudformation,,,CloudFormation,CloudFormation,,1,,,aws_cloudformation_,,cloudformation_,CloudFormation,AWS,,,,,
-cloudfront,cloudfront,cloudfront,cloudfront,,cloudfront,,,CloudFront,CloudFront,,1,,,aws_cloudfront_,,cloudfront_,CloudFront,Amazon,,,,,
-cloudhsm,cloudhsm,cloudhsm,cloudhsm,,,,,,,,,,,,,,CloudHSM,AWS,x,,,,Legacy
-cloudhsmv2,cloudhsmv2,cloudhsmv2,cloudhsmv2,,cloudhsmv2,,cloudhsm,CloudHSMV2,CloudHSMV2,,1,,aws_cloudhsm_v2_,aws_cloudhsmv2_,,cloudhsm,CloudHSM,AWS,,,,,
-cloudsearch,cloudsearch,cloudsearch,cloudsearch,,cloudsearch,,,CloudSearch,CloudSearch,,1,,,aws_cloudsearch_,,cloudsearch_,CloudSearch,Amazon,,,,,
-cloudsearchdomain,cloudsearchdomain,cloudsearchdomain,cloudsearchdomain,,cloudsearchdomain,,,CloudSearchDomain,CloudSearchDomain,,1,,,aws_cloudsearchdomain_,,cloudsearchdomain_,CloudSearch Domain,Amazon,,,,,
-,,,,,,,,,,,,,,,,,CloudShell,AWS,x,,,,No SDK support
-cloudtrail,cloudtrail,cloudtrail,cloudtrail,,cloudtrail,,,CloudTrail,CloudTrail,,1,,aws_cloudtrail,aws_cloudtrail_,,cloudtrail,CloudTrail,AWS,,,,,
-cloudwatch,cloudwatch,cloudwatch,cloudwatch,,cloudwatch,,,CloudWatch,CloudWatch,,1,,aws_cloudwatch_(?!(event_|log_|query_)),aws_cloudwatch_,,cloudwatch_dashboard;cloudwatch_metric_;cloudwatch_composite_,CloudWatch,Amazon,,,,,
-application-insights,applicationinsights,applicationinsights,applicationinsights,,applicationinsights,,,ApplicationInsights,ApplicationInsights,,1,,,aws_applicationinsights_,,applicationinsights_,CloudWatch Application Insights,Amazon,,,,,
-evidently,evidently,cloudwatchevidently,evidently,,evidently,,cloudwatchevidently,Evidently,CloudWatchEvidently,,1,,,aws_evidently_,,evidently_,CloudWatch Evidently,Amazon,,,,,
-internetmonitor,internetmonitor,internetmonitor,internetmonitor,,internetmonitor,,,InternetMonitor,InternetMonitor,,1,,,aws_internetmonitor_,,internetmonitor_,CloudWatch Internet Monitor,Amazon,,,,,
-logs,logs,cloudwatchlogs,cloudwatchlogs,,logs,,cloudwatchlog;cloudwatchlogs,Logs,CloudWatchLogs,,1,2,aws_cloudwatch_(log_|query_),aws_logs_,,cloudwatch_log_;cloudwatch_query_,CloudWatch Logs,Amazon,,,,,
-rum,rum,cloudwatchrum,rum,,rum,,cloudwatchrum,RUM,CloudWatchRUM,,1,,,aws_rum_,,rum_,CloudWatch RUM,Amazon,,,,,
-synthetics,synthetics,synthetics,synthetics,,synthetics,,,Synthetics,Synthetics,,1,,,aws_synthetics_,,synthetics_,CloudWatch Synthetics,Amazon,,,,,
-codeartifact,codeartifact,codeartifact,codeartifact,,codeartifact,,,CodeArtifact,CodeArtifact,,1,,,aws_codeartifact_,,codeartifact_,CodeArtifact,AWS,,,,,
-codebuild,codebuild,codebuild,codebuild,,codebuild,,,CodeBuild,CodeBuild,,1,,,aws_codebuild_,,codebuild_,CodeBuild,AWS,,,,,
-codecommit,codecommit,codecommit,codecommit,,codecommit,,,CodeCommit,CodeCommit,,1,,,aws_codecommit_,,codecommit_,CodeCommit,AWS,,,,,
-deploy,deploy,codedeploy,codedeploy,,deploy,,codedeploy,Deploy,CodeDeploy,,1,,aws_codedeploy_,aws_deploy_,,codedeploy_,CodeDeploy,AWS,,,,,
-codeguruprofiler,codeguruprofiler,codeguruprofiler,codeguruprofiler,,codeguruprofiler,,,CodeGuruProfiler,CodeGuruProfiler,,1,,,aws_codeguruprofiler_,,codeguruprofiler_,CodeGuru Profiler,Amazon,,,,,
-codeguru-reviewer,codegurureviewer,codegurureviewer,codegurureviewer,,codegurureviewer,,,CodeGuruReviewer,CodeGuruReviewer,,1,,,aws_codegurureviewer_,,codegurureviewer_,CodeGuru Reviewer,Amazon,,,,,
-codepipeline,codepipeline,codepipeline,codepipeline,,codepipeline,,,CodePipeline,CodePipeline,,1,,aws_codepipeline,aws_codepipeline_,,codepipeline,CodePipeline,AWS,,,,,
-codestar,codestar,codestar,codestar,,codestar,,,CodeStar,CodeStar,,1,,,aws_codestar_,,codestar_,CodeStar,AWS,,,,,
-codestar-connections,codestarconnections,codestarconnections,codestarconnections,,codestarconnections,,,CodeStarConnections,CodeStarConnections,,1,,,aws_codestarconnections_,,codestarconnections_,CodeStar Connections,AWS,,,,,
-codestar-notifications,codestarnotifications,codestarnotifications,codestarnotifications,,codestarnotifications,,,CodeStarNotifications,CodeStarNotifications,,1,,,aws_codestarnotifications_,,codestarnotifications_,CodeStar Notifications,AWS,,,,,
-cognito-identity,cognitoidentity,cognitoidentity,cognitoidentity,,cognitoidentity,,,CognitoIdentity,CognitoIdentity,,1,,aws_cognito_identity_(?!provider),aws_cognitoidentity_,,cognito_identity_pool,Cognito Identity,Amazon,,,,,
-cognito-idp,cognitoidp,cognitoidentityprovider,cognitoidentityprovider,,cognitoidp,,cognitoidentityprovider,CognitoIDP,CognitoIdentityProvider,,1,,aws_cognito_(identity_provider|resource|user|risk),aws_cognitoidp_,,cognito_identity_provider;cognito_managed_user;cognito_resource_;cognito_user;cognito_risk,Cognito IDP (Identity Provider),Amazon,,,,,
-cognito-sync,cognitosync,cognitosync,cognitosync,,cognitosync,,,CognitoSync,CognitoSync,,1,,,aws_cognitosync_,,cognitosync_,Cognito Sync,Amazon,,,,,
-comprehend,comprehend,comprehend,comprehend,,comprehend,,,Comprehend,Comprehend,,,2,,aws_comprehend_,,comprehend_,Comprehend,Amazon,,,,,
-comprehendmedical,comprehendmedical,comprehendmedical,comprehendmedical,,comprehendmedical,,,ComprehendMedical,ComprehendMedical,,1,,,aws_comprehendmedical_,,comprehendmedical_,Comprehend Medical,Amazon,,,,,
-compute-optimizer,computeoptimizer,computeoptimizer,computeoptimizer,,computeoptimizer,,,ComputeOptimizer,ComputeOptimizer,,,2,,aws_computeoptimizer_,,computeoptimizer_,Compute Optimizer,AWS,,,,,
-configservice,configservice,configservice,configservice,,configservice,,config,ConfigService,ConfigService,,1,,aws_config_,aws_configservice_,,config_,Config,AWS,,,,,
-connect,connect,connect,connect,,connect,,,Connect,Connect,,1,,,aws_connect_,,connect_,Connect,Amazon,,,,,
-connect-contact-lens,connectcontactlens,connectcontactlens,connectcontactlens,,connectcontactlens,,,ConnectContactLens,ConnectContactLens,,1,,,aws_connectcontactlens_,,connectcontactlens_,Connect Contact Lens,Amazon,,,,,
-customer-profiles,customerprofiles,customerprofiles,customerprofiles,,customerprofiles,,,CustomerProfiles,CustomerProfiles,,1,,,aws_customerprofiles_,,customerprofiles_,Connect Customer Profiles,Amazon,,,,,
-connectparticipant,connectparticipant,connectparticipant,connectparticipant,,connectparticipant,,,ConnectParticipant,ConnectParticipant,,1,,,aws_connectparticipant_,,connectparticipant_,Connect Participant,Amazon,,,,,
-voice-id,voiceid,voiceid,voiceid,,voiceid,,,VoiceID,VoiceID,,1,,,aws_voiceid_,,voiceid_,Connect Voice ID,Amazon,,,,,
-wisdom,wisdom,connectwisdomservice,wisdom,,wisdom,,connectwisdomservice,Wisdom,ConnectWisdomService,,1,,,aws_wisdom_,,wisdom_,Connect Wisdom,Amazon,,,,,
-,,,,,,,,,,,,,,,,,Console Mobile Application,AWS,x,,,,No SDK support
-controltower,controltower,controltower,controltower,,controltower,,,ControlTower,ControlTower,,1,,,aws_controltower_,,controltower_,Control Tower,AWS,,,,,
-cur,cur,costandusagereportservice,costandusagereportservice,,cur,,costandusagereportservice,CUR,CostandUsageReportService,,1,,,aws_cur_,,cur_,Cost and Usage Report,AWS,,,,,
-,,,,,,,,,,,,,,,,,Crypto Tools,AWS,x,,,,No SDK support
-,,,,,,,,,,,,,,,,,Cryptographic Services Overview,AWS,x,,,,No SDK support
-dataexchange,dataexchange,dataexchange,dataexchange,,dataexchange,,,DataExchange,DataExchange,,1,,,aws_dataexchange_,,dataexchange_,Data Exchange,AWS,,,,,
-datapipeline,datapipeline,datapipeline,datapipeline,,datapipeline,,,DataPipeline,DataPipeline,,1,,,aws_datapipeline_,,datapipeline_,Data Pipeline,AWS,,,,,
-datasync,datasync,datasync,datasync,,datasync,,,DataSync,DataSync,,1,,,aws_datasync_,,datasync_,DataSync,AWS,,,,,
-,,,,,,,,,,,,,,,,,Deep Learning AMIs,AWS,x,,,,No SDK support
-,,,,,,,,,,,,,,,,,Deep Learning Containers,AWS,x,,,,No SDK support
-,,,,,,,,,,,,,,,,,DeepComposer,AWS,x,,,,No SDK support
-,,,,,,,,,,,,,,,,,DeepLens,AWS,x,,,,No SDK support
-,,,,,,,,,,,,,,,,,DeepRacer,AWS,x,,,,No SDK support
-detective,detective,detective,detective,,detective,,,Detective,Detective,,1,,,aws_detective_,,detective_,Detective,Amazon,,,,,
-devicefarm,devicefarm,devicefarm,devicefarm,,devicefarm,,,DeviceFarm,DeviceFarm,,1,,,aws_devicefarm_,,devicefarm_,Device Farm,AWS,,,,,
-devops-guru,devopsguru,devopsguru,devopsguru,,devopsguru,,,DevOpsGuru,DevOpsGuru,,1,,,aws_devopsguru_,,devopsguru_,DevOps Guru,Amazon,,,,,
-directconnect,directconnect,directconnect,directconnect,,directconnect,,,DirectConnect,DirectConnect,,1,,aws_dx_,aws_directconnect_,,dx_,Direct Connect,AWS,,,,,
-dlm,dlm,dlm,dlm,,dlm,,,DLM,DLM,,1,,,aws_dlm_,,dlm_,DLM (Data Lifecycle Manager),Amazon,,,,,
-dms,dms,databasemigrationservice,databasemigrationservice,,dms,,databasemigration;databasemigrationservice,DMS,DatabaseMigrationService,,1,,,aws_dms_,,dms_,DMS (Database Migration),AWS,,,,,
-docdb,docdb,docdb,docdb,,docdb,,,DocDB,DocDB,,1,,,aws_docdb_,,docdb_,DocumentDB,Amazon,,,,,
-docdb-elastic,docdbelastic,docdbelastic,docdbelastic,,docdbelastic,,,DocDBElastic,DocDBElastic,,,2,,aws_docdbelastic_,,docdbelastic_,DocumentDB Elastic,Amazon,,,,,
-drs,drs,drs,drs,,drs,,,DRS,Drs,,1,,,aws_drs_,,drs_,DRS (Elastic Disaster Recovery),AWS,,,,,
-ds,ds,directoryservice,directoryservice,,ds,,directoryservice,DS,DirectoryService,,1,2,aws_directory_service_,aws_ds_,,directory_service_,Directory Service,AWS,,,,,
-dynamodb,dynamodb,dynamodb,dynamodb,,dynamodb,,,DynamoDB,DynamoDB,,1,,,aws_dynamodb_,,dynamodb_,DynamoDB,Amazon,,,AWS_DYNAMODB_ENDPOINT,TF_AWS_DYNAMODB_ENDPOINT,
-dax,dax,dax,dax,,dax,,,DAX,DAX,,1,,,aws_dax_,,dax_,DynamoDB Accelerator (DAX),Amazon,,,,,
-dynamodbstreams,dynamodbstreams,dynamodbstreams,dynamodbstreams,,dynamodbstreams,,,DynamoDBStreams,DynamoDBStreams,,1,,,aws_dynamodbstreams_,,dynamodbstreams_,DynamoDB Streams,Amazon,,,,,
-,,,,,ec2ebs,ec2,,EC2EBS,,,,,aws_(ebs_|volume_attach|snapshot_create),aws_ec2ebs_,ebs_,ebs_;volume_attachment;snapshot_,EBS (EC2),Amazon,x,x,,,Part of EC2
-ebs,ebs,ebs,ebs,,ebs,,,EBS,EBS,,1,,,aws_ebs_,,changewhenimplemented,EBS (Elastic Block Store),Amazon,,,,,
-ec2,ec2,ec2,ec2,,ec2,ec2,,EC2,EC2,,1,2,aws_(ami|availability_zone|ec2_(availability|capacity|fleet|host|instance|public_ipv4_pool|serial|spot|tag)|eip|instance|key_pair|launch_template|placement_group|spot),aws_ec2_,ec2_,ami;availability_zone;ec2_availability_;ec2_capacity_;ec2_fleet;ec2_host;ec2_instance_;ec2_public_ipv4_pool;ec2_serial_;ec2_spot_;ec2_tag;eip;instance;key_pair;launch_template;placement_group;spot_,EC2 (Elastic Compute Cloud),Amazon,,,,,
-imagebuilder,imagebuilder,imagebuilder,imagebuilder,,imagebuilder,,,ImageBuilder,Imagebuilder,,1,,,aws_imagebuilder_,,imagebuilder_,EC2 Image Builder,Amazon,,,,,
-ec2-instance-connect,ec2instanceconnect,ec2instanceconnect,ec2instanceconnect,,ec2instanceconnect,,,EC2InstanceConnect,EC2InstanceConnect,,1,,,aws_ec2instanceconnect_,,ec2instanceconnect_,EC2 Instance Connect,AWS,,,,,
-ecr,ecr,ecr,ecr,,ecr,,,ECR,ECR,,1,,,aws_ecr_,,ecr_,ECR (Elastic Container Registry),Amazon,,,,,
-ecr-public,ecrpublic,ecrpublic,ecrpublic,,ecrpublic,,,ECRPublic,ECRPublic,,1,,,aws_ecrpublic_,,ecrpublic_,ECR Public,Amazon,,,,,
-ecs,ecs,ecs,ecs,,ecs,,,ECS,ECS,,1,,,aws_ecs_,,ecs_,ECS (Elastic Container),Amazon,,,,,
-efs,efs,efs,efs,,efs,,,EFS,EFS,,1,,,aws_efs_,,efs_,EFS (Elastic File System),Amazon,,,,,
-eks,eks,eks,eks,,eks,,,EKS,EKS,,1,,,aws_eks_,,eks_,EKS (Elastic Kubernetes),Amazon,,,,,
-elasticbeanstalk,elasticbeanstalk,elasticbeanstalk,elasticbeanstalk,,elasticbeanstalk,,beanstalk,ElasticBeanstalk,ElasticBeanstalk,,1,,aws_elastic_beanstalk_,aws_elasticbeanstalk_,,elastic_beanstalk_,Elastic Beanstalk,AWS,,,,,
-elastic-inference,elasticinference,elasticinference,elasticinference,,elasticinference,,,ElasticInference,ElasticInference,,1,,,aws_elasticinference_,,elasticinference_,Elastic Inference,Amazon,,,,,
-elastictranscoder,elastictranscoder,elastictranscoder,elastictranscoder,,elastictranscoder,,,ElasticTranscoder,ElasticTranscoder,,1,,,aws_elastictranscoder_,,elastictranscoder_,Elastic Transcoder,Amazon,,,,,
-elasticache,elasticache,elasticache,elasticache,,elasticache,,,ElastiCache,ElastiCache,,1,,,aws_elasticache_,,elasticache_,ElastiCache,Amazon,,,,,
-es,es,elasticsearchservice,elasticsearchservice,elasticsearch,es,,es;elasticsearchservice,Elasticsearch,ElasticsearchService,,1,,aws_elasticsearch_,aws_es_,,elasticsearch_,Elasticsearch,Amazon,,,,,
-elbv2,elbv2,elbv2,elasticloadbalancingv2,,elbv2,,elasticloadbalancingv2,ELBV2,ELBV2,,1,,aws_a?lb(\b|_listener|_target_group|s),aws_elbv2_,,lbs?\.;lb_listener;lb_target_group;lb_hosted,ELB (Elastic Load Balancing),,,,,,
-elb,elb,elb,elasticloadbalancing,,elb,,elasticloadbalancing,ELB,ELB,,1,,aws_(app_cookie_stickiness_policy|elb|lb_cookie_stickiness_policy|lb_ssl_negotiation_policy|load_balancer_|proxy_protocol_policy),aws_elb_,,app_cookie_stickiness_policy;elb;lb_cookie_stickiness_policy;lb_ssl_negotiation_policy;load_balancer;proxy_protocol_policy,ELB Classic,,,,,,
-mediaconnect,mediaconnect,mediaconnect,mediaconnect,,mediaconnect,,,MediaConnect,MediaConnect,,1,,,aws_mediaconnect_,,media_connect_,Elemental MediaConnect,AWS,,,,,
-mediaconvert,mediaconvert,mediaconvert,mediaconvert,,mediaconvert,,,MediaConvert,MediaConvert,,1,,aws_media_convert_,aws_mediaconvert_,,media_convert_,Elemental MediaConvert,AWS,,,,,
-medialive,medialive,medialive,medialive,,medialive,,,MediaLive,MediaLive,,,2,,aws_medialive_,,medialive_,Elemental MediaLive,AWS,,,,,
-mediapackage,mediapackage,mediapackage,mediapackage,,mediapackage,,,MediaPackage,MediaPackage,,1,,aws_media_package_,aws_mediapackage_,,media_package_,Elemental MediaPackage,AWS,,,,,
-mediapackage-vod,mediapackagevod,mediapackagevod,mediapackagevod,,mediapackagevod,,,MediaPackageVOD,MediaPackageVod,,1,,,aws_mediapackagevod_,,mediapackagevod_,Elemental MediaPackage VOD,AWS,,,,,
-mediastore,mediastore,mediastore,mediastore,,mediastore,,,MediaStore,MediaStore,,1,,aws_media_store_,aws_mediastore_,,media_store_,Elemental MediaStore,AWS,,,,,
-mediastore-data,mediastoredata,mediastoredata,mediastoredata,,mediastoredata,,,MediaStoreData,MediaStoreData,,1,,,aws_mediastoredata_,,mediastoredata_,Elemental MediaStore Data,AWS,,,,,
-mediatailor,mediatailor,mediatailor,mediatailor,,mediatailor,,,MediaTailor,MediaTailor,,1,,,aws_mediatailor_,,media_tailor_,Elemental MediaTailor,AWS,,,,,
-,,,,,,,,,,,,,,,,,Elemental On-Premises,AWS,x,,,,No SDK support
-emr,emr,emr,emr,,emr,,,EMR,EMR,,1,,,aws_emr_,,emr_,EMR,Amazon,,,,,
-emr-containers,emrcontainers,emrcontainers,emrcontainers,,emrcontainers,,,EMRContainers,EMRContainers,,1,,,aws_emrcontainers_,,emrcontainers_,EMR Containers,Amazon,,,,,
-emr-serverless,emrserverless,emrserverless,emrserverless,,emrserverless,,,EMRServerless,EMRServerless,,1,,,aws_emrserverless_,,emrserverless_,EMR Serverless,Amazon,,,,,
-,,,,,,,,,,,,,,,,,End-of-Support Migration Program (EMP) for Windows Server,AWS,x,,,,No SDK support
-events,events,eventbridge,eventbridge,,events,,eventbridge;cloudwatchevents,Events,EventBridge,,1,,aws_cloudwatch_event_,aws_events_,,cloudwatch_event_,EventBridge,Amazon,,,,,
-schemas,schemas,schemas,schemas,,schemas,,,Schemas,Schemas,,1,,,aws_schemas_,,schemas_,EventBridge Schemas,Amazon,,,,,
-fis,fis,fis,fis,,fis,,,FIS,FIS,,,2,,aws_fis_,,fis_,FIS (Fault Injection Simulator),AWS,,,,,
-finspace,finspace,finspace,finspace,,finspace,,,FinSpace,Finspace,,,2,,aws_finspace_,,finspace_,FinSpace,Amazon,,,,,
-finspace-data,finspacedata,finspacedata,finspacedata,,finspacedata,,,FinSpaceData,FinSpaceData,,1,,,aws_finspacedata_,,finspacedata_,FinSpace Data,Amazon,,,,,
-fms,fms,fms,fms,,fms,,,FMS,FMS,,1,,,aws_fms_,,fms_,FMS (Firewall Manager),AWS,,,,,
-forecast,forecast,forecastservice,forecast,,forecast,,forecastservice,Forecast,ForecastService,,1,,,aws_forecast_,,forecast_,Forecast,Amazon,,,,,
-forecastquery,forecastquery,forecastqueryservice,forecastquery,,forecastquery,,forecastqueryservice,ForecastQuery,ForecastQueryService,,1,,,aws_forecastquery_,,forecastquery_,Forecast Query,Amazon,,,,,
-frauddetector,frauddetector,frauddetector,frauddetector,,frauddetector,,,FraudDetector,FraudDetector,,1,,,aws_frauddetector_,,frauddetector_,Fraud Detector,Amazon,,,,,
-,,,,,,,,,,,,,,,,,FreeRTOS,,x,,,,No SDK support
-fsx,fsx,fsx,fsx,,fsx,,,FSx,FSx,,1,,,aws_fsx_,,fsx_,FSx,Amazon,,,,,
-gamelift,gamelift,gamelift,gamelift,,gamelift,,,GameLift,GameLift,,1,,,aws_gamelift_,,gamelift_,GameLift,Amazon,,,,,
-globalaccelerator,globalaccelerator,globalaccelerator,globalaccelerator,,globalaccelerator,,,GlobalAccelerator,GlobalAccelerator,x,1,,,aws_globalaccelerator_,,globalaccelerator_,Global Accelerator,AWS,,,,,
-glue,glue,glue,glue,,glue,,,Glue,Glue,,1,,,aws_glue_,,glue_,Glue,AWS,,,,,
-databrew,databrew,gluedatabrew,databrew,,databrew,,gluedatabrew,DataBrew,GlueDataBrew,,1,,,aws_databrew_,,databrew_,Glue DataBrew,AWS,,,,,
-groundstation,groundstation,groundstation,groundstation,,groundstation,,,GroundStation,GroundStation,,1,,,aws_groundstation_,,groundstation_,Ground Station,AWS,,,,,
-guardduty,guardduty,guardduty,guardduty,,guardduty,,,GuardDuty,GuardDuty,,1,,,aws_guardduty_,,guardduty_,GuardDuty,Amazon,,,,,
-health,health,health,health,,health,,,Health,Health,,1,,,aws_health_,,health_,Health,AWS,,,,,
-healthlake,healthlake,healthlake,healthlake,,healthlake,,,HealthLake,HealthLake,,,2,,aws_healthlake_,,healthlake_,HealthLake,Amazon,,,,,
-honeycode,honeycode,honeycode,honeycode,,honeycode,,,Honeycode,Honeycode,,1,,,aws_honeycode_,,honeycode_,Honeycode,Amazon,,,,,
-iam,iam,iam,iam,,iam,,,IAM,IAM,,1,,,aws_iam_,,iam_,IAM (Identity & Access Management),AWS,,,AWS_IAM_ENDPOINT,TF_AWS_IAM_ENDPOINT,
-inspector,inspector,inspector,inspector,,inspector,,,Inspector,Inspector,,1,,,aws_inspector_,,inspector_,Inspector Classic,Amazon,,,,,
-inspector2,inspector2,inspector2,inspector2,,inspector2,,inspectorv2,Inspector2,Inspector2,,,2,,aws_inspector2_,,inspector2_,Inspector,Amazon,,,,,
-iot1click-devices,iot1clickdevices,iot1clickdevicesservice,iot1clickdevicesservice,,iot1clickdevices,,iot1clickdevicesservice,IoT1ClickDevices,IoT1ClickDevicesService,,1,,,aws_iot1clickdevices_,,iot1clickdevices_,IoT 1-Click Devices,AWS,,,,,
-iot1click-projects,iot1clickprojects,iot1clickprojects,iot1clickprojects,,iot1clickprojects,,,IoT1ClickProjects,IoT1ClickProjects,,1,,,aws_iot1clickprojects_,,iot1clickprojects_,IoT 1-Click Projects,AWS,,,,,
-iotanalytics,iotanalytics,iotanalytics,iotanalytics,,iotanalytics,,,IoTAnalytics,IoTAnalytics,,1,,,aws_iotanalytics_,,iotanalytics_,IoT Analytics,AWS,,,,,
-iot,iot,iot,iot,,iot,,,IoT,IoT,,1,,,aws_iot_,,iot_,IoT Core,AWS,,,,,
-iot-data,iotdata,iotdataplane,iotdataplane,,iotdata,,iotdataplane,IoTData,IoTDataPlane,,1,,,aws_iotdata_,,iotdata_,IoT Data Plane,AWS,,,,,
-,,,,,,,,,,,,,,,,,IoT Device Defender,AWS,x,,,,Part of IoT
-iotdeviceadvisor,iotdeviceadvisor,iotdeviceadvisor,iotdeviceadvisor,,iotdeviceadvisor,,,IoTDeviceAdvisor,IoTDeviceAdvisor,,1,,,aws_iotdeviceadvisor_,,iotdeviceadvisor_,IoT Device Management,AWS,,,,,
-iotevents,iotevents,iotevents,iotevents,,iotevents,,,IoTEvents,IoTEvents,,1,,,aws_iotevents_,,iotevents_,IoT Events,AWS,,,,,
-iotevents-data,ioteventsdata,ioteventsdata,ioteventsdata,,ioteventsdata,,,IoTEventsData,IoTEventsData,,1,,,aws_ioteventsdata_,,ioteventsdata_,IoT Events Data,AWS,,,,,
-,,,,,,,,,,,,,,,,,IoT ExpressLink,AWS,x,,,,No SDK support
-iotfleethub,iotfleethub,iotfleethub,iotfleethub,,iotfleethub,,,IoTFleetHub,IoTFleetHub,,1,,,aws_iotfleethub_,,iotfleethub_,IoT Fleet Hub,AWS,,,,,
-,,,,,,,,,,,,,,,,,IoT FleetWise,AWS,x,,,,No SDK support
-greengrass,greengrass,greengrass,greengrass,,greengrass,,,Greengrass,Greengrass,,1,,,aws_greengrass_,,greengrass_,IoT Greengrass,AWS,,,,,
-greengrassv2,greengrassv2,greengrassv2,greengrassv2,,greengrassv2,,,GreengrassV2,GreengrassV2,,1,,,aws_greengrassv2_,,greengrassv2_,IoT Greengrass V2,AWS,,,,,
-iot-jobs-data,iotjobsdata,iotjobsdataplane,iotjobsdataplane,,iotjobsdata,,iotjobsdataplane,IoTJobsData,IoTJobsDataPlane,,1,,,aws_iotjobsdata_,,iotjobsdata_,IoT Jobs Data Plane,AWS,,,,,
-,,,,,,,,,,,,,,,,,IoT RoboRunner,AWS,x,,,,No SDK support
-iotsecuretunneling,iotsecuretunneling,iotsecuretunneling,iotsecuretunneling,,iotsecuretunneling,,,IoTSecureTunneling,IoTSecureTunneling,,1,,,aws_iotsecuretunneling_,,iotsecuretunneling_,IoT Secure Tunneling,AWS,,,,,
-iotsitewise,iotsitewise,iotsitewise,iotsitewise,,iotsitewise,,,IoTSiteWise,IoTSiteWise,,1,,,aws_iotsitewise_,,iotsitewise_,IoT SiteWise,AWS,,,,,
-iotthingsgraph,iotthingsgraph,iotthingsgraph,iotthingsgraph,,iotthingsgraph,,,IoTThingsGraph,IoTThingsGraph,,1,,,aws_iotthingsgraph_,,iotthingsgraph_,IoT Things Graph,AWS,,,,,
-iottwinmaker,iottwinmaker,iottwinmaker,iottwinmaker,,iottwinmaker,,,IoTTwinMaker,IoTTwinMaker,,1,,,aws_iottwinmaker_,,iottwinmaker_,IoT TwinMaker,AWS,,,,,
-iotwireless,iotwireless,iotwireless,iotwireless,,iotwireless,,,IoTWireless,IoTWireless,,1,,,aws_iotwireless_,,iotwireless_,IoT Wireless,AWS,,,,,
-,,,,,,,,,,,,,,,,,IQ,AWS,x,,,,No SDK support
-ivs,ivs,ivs,ivs,,ivs,,,IVS,IVS,,1,,,aws_ivs_,,ivs_,IVS (Interactive Video),Amazon,,,,,
-ivschat,ivschat,ivschat,ivschat,,ivschat,,,IVSChat,Ivschat,,,2,,aws_ivschat_,,ivschat_,IVS (Interactive Video) Chat,Amazon,,,,,
-kendra,kendra,kendra,kendra,,kendra,,,Kendra,Kendra,,,2,,aws_kendra_,,kendra_,Kendra,Amazon,,,,,
-keyspaces,keyspaces,keyspaces,,,keyspaces,,,Keyspaces,Keyspaces,,1,,,aws_keyspaces_,,keyspaces_,Keyspaces (for Apache Cassandra),Amazon,,,,,
-kinesis,kinesis,kinesis,kinesis,,kinesis,,,Kinesis,Kinesis,,1,,aws_kinesis_stream,aws_kinesis_,,kinesis_stream,Kinesis,Amazon,,,,,
-kinesisanalytics,kinesisanalytics,kinesisanalytics,kinesisanalytics,,kinesisanalytics,,,KinesisAnalytics,KinesisAnalytics,,1,,aws_kinesis_analytics_,aws_kinesisanalytics_,,kinesis_analytics_,Kinesis Analytics,Amazon,,,,,
-kinesisanalyticsv2,kinesisanalyticsv2,kinesisanalyticsv2,kinesisanalyticsv2,,kinesisanalyticsv2,,,KinesisAnalyticsV2,KinesisAnalyticsV2,,1,,,aws_kinesisanalyticsv2_,,kinesisanalyticsv2_,Kinesis Analytics V2,Amazon,,,,,
-firehose,firehose,firehose,firehose,,firehose,,,Firehose,Firehose,,1,,aws_kinesis_firehose_,aws_firehose_,,kinesis_firehose_,Kinesis Firehose,Amazon,,,,,
-kinesisvideo,kinesisvideo,kinesisvideo,kinesisvideo,,kinesisvideo,,,KinesisVideo,KinesisVideo,,1,,,aws_kinesisvideo_,,kinesis_video_,Kinesis Video,Amazon,,,,,
-kinesis-video-archived-media,kinesisvideoarchivedmedia,kinesisvideoarchivedmedia,kinesisvideoarchivedmedia,,kinesisvideoarchivedmedia,,,KinesisVideoArchivedMedia,KinesisVideoArchivedMedia,,1,,,aws_kinesisvideoarchivedmedia_,,kinesisvideoarchivedmedia_,Kinesis Video Archived Media,Amazon,,,,,
-kinesis-video-media,kinesisvideomedia,kinesisvideomedia,kinesisvideomedia,,kinesisvideomedia,,,KinesisVideoMedia,KinesisVideoMedia,,1,,,aws_kinesisvideomedia_,,kinesisvideomedia_,Kinesis Video Media,Amazon,,,,,
-kinesis-video-signaling,kinesisvideosignaling,kinesisvideosignalingchannels,kinesisvideosignaling,,kinesisvideosignaling,,kinesisvideosignalingchannels,KinesisVideoSignaling,KinesisVideoSignalingChannels,,1,,,aws_kinesisvideosignaling_,,kinesisvideosignaling_,Kinesis Video Signaling,Amazon,,,,,
-kms,kms,kms,kms,,kms,,,KMS,KMS,,1,,,aws_kms_,,kms_,KMS (Key Management),AWS,,,,,
-lakeformation,lakeformation,lakeformation,lakeformation,,lakeformation,,,LakeFormation,LakeFormation,,1,,,aws_lakeformation_,,lakeformation_,Lake Formation,AWS,,,,,
-lambda,lambda,lambda,lambda,,lambda,,,Lambda,Lambda,,1,2,,aws_lambda_,,lambda_,Lambda,AWS,,,,,
-,,,,,,,,,,,,,,,,,Launch Wizard,AWS,x,,,,No SDK support
-lex-models,lexmodels,lexmodelbuildingservice,lexmodelbuildingservice,,lexmodels,,lexmodelbuilding;lexmodelbuildingservice;lex,LexModels,LexModelBuildingService,,1,,aws_lex_,aws_lexmodels_,,lex_,Lex Model Building,Amazon,,,,,
-lexv2-models,lexv2models,lexmodelsv2,lexmodelsv2,,lexmodelsv2,,lexv2models,LexModelsV2,LexModelsV2,,1,,,aws_lexmodelsv2_,,lexmodelsv2_,Lex Models V2,Amazon,,,,,
-lex-runtime,lexruntime,lexruntimeservice,lexruntimeservice,,lexruntime,,lexruntimeservice,LexRuntime,LexRuntimeService,,1,,,aws_lexruntime_,,lexruntime_,Lex Runtime,Amazon,,,,,
-lexv2-runtime,lexv2runtime,lexruntimev2,lexruntimev2,,lexruntimev2,,lexv2runtime,LexRuntimeV2,LexRuntimeV2,,1,,,aws_lexruntimev2_,,lexruntimev2_,Lex Runtime V2,Amazon,,,,,
-license-manager,licensemanager,licensemanager,licensemanager,,licensemanager,,,LicenseManager,LicenseManager,,1,,,aws_licensemanager_,,licensemanager_,License Manager,AWS,,,,,
-lightsail,lightsail,lightsail,lightsail,,lightsail,,,Lightsail,Lightsail,x,,2,,aws_lightsail_,,lightsail_,Lightsail,Amazon,,,,,
-location,location,locationservice,location,,location,,locationservice,Location,LocationService,,1,,,aws_location_,,location_,Location,Amazon,,,,,
-lookoutequipment,lookoutequipment,lookoutequipment,lookoutequipment,,lookoutequipment,,,LookoutEquipment,LookoutEquipment,,1,,,aws_lookoutequipment_,,lookoutequipment_,Lookout for Equipment,Amazon,,,,,
-lookoutmetrics,lookoutmetrics,lookoutmetrics,lookoutmetrics,,lookoutmetrics,,,LookoutMetrics,LookoutMetrics,,1,,,aws_lookoutmetrics_,,lookoutmetrics_,Lookout for Metrics,Amazon,,,,,
-lookoutvision,lookoutvision,lookoutforvision,lookoutvision,,lookoutvision,,lookoutforvision,LookoutVision,LookoutForVision,,1,,,aws_lookoutvision_,,lookoutvision_,Lookout for Vision,Amazon,,,,,
-,,,,,,,,,,,,,,,,,Lumberyard,Amazon,x,,,,No SDK support
-machinelearning,machinelearning,machinelearning,machinelearning,,machinelearning,,,MachineLearning,MachineLearning,,1,,,aws_machinelearning_,,machinelearning_,Machine Learning,Amazon,,,,,
-macie2,macie2,macie2,macie2,,macie2,,,Macie2,Macie2,,1,,,aws_macie2_,,macie2_,Macie,Amazon,,,,,
-macie,macie,macie,macie,,macie,,,Macie,Macie,,1,,,aws_macie_,,macie_,Macie Classic,Amazon,,,,,
-,,,,,,,,,,,,,,,,,Mainframe Modernization,AWS,x,,,,No SDK support
-managedblockchain,managedblockchain,managedblockchain,managedblockchain,,managedblockchain,,,ManagedBlockchain,ManagedBlockchain,,1,,,aws_managedblockchain_,,managedblockchain_,Managed Blockchain,Amazon,,,,,
-grafana,grafana,managedgrafana,grafana,,grafana,,managedgrafana;amg,Grafana,ManagedGrafana,,1,,,aws_grafana_,,grafana_,Managed Grafana,Amazon,,,,,
-kafka,kafka,kafka,kafka,,kafka,,msk,Kafka,Kafka,,1,,aws_msk_,aws_kafka_,,msk_,Managed Streaming for Kafka,Amazon,,,,,
-kafkaconnect,kafkaconnect,kafkaconnect,kafkaconnect,,kafkaconnect,,,KafkaConnect,KafkaConnect,,1,,aws_mskconnect_,aws_kafkaconnect_,,mskconnect_,Managed Streaming for Kafka Connect,Amazon,,,,,
-,,,,,,,,,,,,,,,,,Management Console,AWS,x,,,,No SDK support
-marketplace-catalog,marketplacecatalog,marketplacecatalog,marketplacecatalog,,marketplacecatalog,,,MarketplaceCatalog,MarketplaceCatalog,,1,,,aws_marketplacecatalog_,,marketplace_catalog_,Marketplace Catalog,AWS,,,,,
-marketplacecommerceanalytics,marketplacecommerceanalytics,marketplacecommerceanalytics,marketplacecommerceanalytics,,marketplacecommerceanalytics,,,MarketplaceCommerceAnalytics,MarketplaceCommerceAnalytics,,1,,,aws_marketplacecommerceanalytics_,,marketplacecommerceanalytics_,Marketplace Commerce Analytics,AWS,,,,,
-marketplace-entitlement,marketplaceentitlement,marketplaceentitlementservice,marketplaceentitlementservice,,marketplaceentitlement,,marketplaceentitlementservice,MarketplaceEntitlement,MarketplaceEntitlementService,,1,,,aws_marketplaceentitlement_,,marketplaceentitlement_,Marketplace Entitlement,AWS,,,,,
-meteringmarketplace,meteringmarketplace,marketplacemetering,marketplacemetering,,marketplacemetering,,meteringmarketplace,MarketplaceMetering,MarketplaceMetering,,1,,,aws_marketplacemetering_,,marketplacemetering_,Marketplace Metering,AWS,,,,,
-memorydb,memorydb,memorydb,memorydb,,memorydb,,,MemoryDB,MemoryDB,,1,,,aws_memorydb_,,memorydb_,MemoryDB for Redis,Amazon,,,,,
-,,,,,meta,,,Meta,,,,,aws_(arn|billing_service_account|default_tags|ip_ranges|partition|regions?|service)$,aws_meta_,,arn;ip_ranges;billing_service_account;default_tags;partition;region;service\.,Meta Data Sources,,x,x,,,Not an AWS service (metadata)
-mgh,mgh,migrationhub,migrationhub,,mgh,,migrationhub,MgH,MigrationHub,,1,,,aws_mgh_,,mgh_,MgH (Migration Hub),AWS,,,,,
-,,,,,,,,,,,,,,,,,Microservice Extractor for .NET,AWS,x,,,,No SDK support
-migrationhub-config,migrationhubconfig,migrationhubconfig,migrationhubconfig,,migrationhubconfig,,,MigrationHubConfig,MigrationHubConfig,,1,,,aws_migrationhubconfig_,,migrationhubconfig_,Migration Hub Config,AWS,,,,,
-migration-hub-refactor-spaces,migrationhubrefactorspaces,migrationhubrefactorspaces,migrationhubrefactorspaces,,migrationhubrefactorspaces,,,MigrationHubRefactorSpaces,MigrationHubRefactorSpaces,,1,,,aws_migrationhubrefactorspaces_,,migrationhubrefactorspaces_,Migration Hub Refactor Spaces,AWS,,,,,
-migrationhubstrategy,migrationhubstrategy,migrationhubstrategyrecommendations,migrationhubstrategy,,migrationhubstrategy,,migrationhubstrategyrecommendations,MigrationHubStrategy,MigrationHubStrategyRecommendations,,1,,,aws_migrationhubstrategy_,,migrationhubstrategy_,Migration Hub Strategy,AWS,,,,,
-mobile,mobile,mobile,mobile,,mobile,,,Mobile,Mobile,,1,,,aws_mobile_,,mobile_,Mobile,AWS,,,,,
-,,mobileanalytics,,,,,,MobileAnalytics,MobileAnalytics,,,,,,,,Mobile Analytics,AWS,x,,,,Only in Go SDK v1
-,,,,,,,,,,,,,,,,,Mobile SDK for Unity,AWS,x,,,,No SDK support
-,,,,,,,,,,,,,,,,,Mobile SDK for Xamarin,AWS,x,,,,No SDK support
-,,,,,,,,,,,,,,,,,Monitron,Amazon,x,,,,No SDK support
-mq,mq,mq,mq,,mq,,,MQ,MQ,,1,,,aws_mq_,,mq_,MQ,Amazon,,,,,
-mturk,mturk,mturk,mturk,,mturk,,,MTurk,MTurk,,1,,,aws_mturk_,,mturk_,MTurk (Mechanical Turk),Amazon,,,,,
-mwaa,mwaa,mwaa,mwaa,,mwaa,,,MWAA,MWAA,,1,,,aws_mwaa_,,mwaa_,MWAA (Managed Workflows for Apache Airflow),Amazon,,,,,
-neptune,neptune,neptune,neptune,,neptune,,,Neptune,Neptune,,1,,,aws_neptune_,,neptune_,Neptune,Amazon,,,,,
-network-firewall,networkfirewall,networkfirewall,networkfirewall,,networkfirewall,,,NetworkFirewall,NetworkFirewall,,1,,,aws_networkfirewall_,,networkfirewall_,Network Firewall,AWS,,,,,
-networkmanager,networkmanager,networkmanager,networkmanager,,networkmanager,,,NetworkManager,NetworkManager,,1,,,aws_networkmanager_,,networkmanager_,Network Manager,AWS,,,,,
-,,,,,,,,,,,,,,,,,NICE DCV,,x,,,,No SDK support
-nimble,nimble,nimblestudio,nimble,,nimble,,nimblestudio,Nimble,NimbleStudio,,1,,,aws_nimble_,,nimble_,Nimble Studio,Amazon,,,,,
-oam,oam,oam,oam,,oam,,cloudwatchobservabilityaccessmanager,ObservabilityAccessManager,OAM,,,2,,aws_oam_,,oam_,CloudWatch Observability Access Manager,Amazon,,,,,
-opensearch,opensearch,opensearchservice,opensearch,,opensearch,,opensearchservice,OpenSearch,OpenSearchService,,1,,,aws_opensearch_,,opensearch_,OpenSearch,Amazon,,,,,
-opensearchserverless,opensearchserverless,opensearchserverless,opensearchserverless,,opensearchserverless,,,OpenSearchServerless,OpenSearchServerless,,,2,,aws_opensearchserverless_,,opensearchserverless_,OpenSearch Serverless,Amazon,,,,,
-opsworks,opsworks,opsworks,opsworks,,opsworks,,,OpsWorks,OpsWorks,,1,,,aws_opsworks_,,opsworks_,OpsWorks,AWS,,,,,
-opsworks-cm,opsworkscm,opsworkscm,opsworkscm,,opsworkscm,,,OpsWorksCM,OpsWorksCM,,1,,,aws_opsworkscm_,,opsworkscm_,OpsWorks CM,AWS,,,,,
-organizations,organizations,organizations,organizations,,organizations,,,Organizations,Organizations,,1,,,aws_organizations_,,organizations_,Organizations,AWS,,,,,
-outposts,outposts,outposts,outposts,,outposts,,,Outposts,Outposts,,1,,,aws_outposts_,,outposts_,Outposts,AWS,,,,,
-,,,,,ec2outposts,ec2,,EC2Outposts,,,,,aws_ec2_(coip_pool|local_gateway),aws_ec2outposts_,outposts_,ec2_coip_pool;ec2_local_gateway,Outposts (EC2),AWS,x,x,,,Part of EC2
-panorama,panorama,panorama,panorama,,panorama,,,Panorama,Panorama,,1,,,aws_panorama_,,panorama_,Panorama,AWS,,,,,
-,,,,,,,,,,,,,,,,,ParallelCluster,AWS,x,,,,No SDK support
-personalize,personalize,personalize,personalize,,personalize,,,Personalize,Personalize,,1,,,aws_personalize_,,personalize_,Personalize,Amazon,,,,,
-personalize-events,personalizeevents,personalizeevents,personalizeevents,,personalizeevents,,,PersonalizeEvents,PersonalizeEvents,,1,,,aws_personalizeevents_,,personalizeevents_,Personalize Events,Amazon,,,,,
-personalize-runtime,personalizeruntime,personalizeruntime,personalizeruntime,,personalizeruntime,,,PersonalizeRuntime,PersonalizeRuntime,,1,,,aws_personalizeruntime_,,personalizeruntime_,Personalize Runtime,Amazon,,,,,
-pinpoint,pinpoint,pinpoint,pinpoint,,pinpoint,,,Pinpoint,Pinpoint,,1,,,aws_pinpoint_,,pinpoint_,Pinpoint,Amazon,,,,,
-pinpoint-email,pinpointemail,pinpointemail,pinpointemail,,pinpointemail,,,PinpointEmail,PinpointEmail,,1,,,aws_pinpointemail_,,pinpointemail_,Pinpoint Email,Amazon,,,,,
-pinpoint-sms-voice,pinpointsmsvoice,pinpointsmsvoice,pinpointsmsvoice,,pinpointsmsvoice,,,PinpointSMSVoice,PinpointSMSVoice,,1,,,aws_pinpointsmsvoice_,,pinpointsmsvoice_,Pinpoint SMS and Voice,Amazon,,,,,
-pipes,pipes,pipes,pipes,,pipes,,,Pipes,Pipes,,,2,,aws_pipes_,,pipes_,EventBridge Pipes,Amazon,,,,,
-polly,polly,polly,polly,,polly,,,Polly,Polly,,1,,,aws_polly_,,polly_,Polly,Amazon,,,,,
-,,,,,,,,,,,,,,,,,Porting Assistant for .NET,,x,,,,No SDK support
-pricing,pricing,pricing,pricing,,pricing,,,Pricing,Pricing,,1,,,aws_pricing_,,pricing_,Pricing Calculator,AWS,,,,,
-proton,proton,proton,proton,,proton,,,Proton,Proton,,1,,,aws_proton_,,proton_,Proton,AWS,,,,,
-qldb,qldb,qldb,qldb,,qldb,,,QLDB,QLDB,,1,,,aws_qldb_,,qldb_,QLDB (Quantum Ledger Database),Amazon,,,,,
-qldb-session,qldbsession,qldbsession,qldbsession,,qldbsession,,,QLDBSession,QLDBSession,,1,,,aws_qldbsession_,,qldbsession_,QLDB Session,Amazon,,,,,
-quicksight,quicksight,quicksight,quicksight,,quicksight,,,QuickSight,QuickSight,,1,,,aws_quicksight_,,quicksight_,QuickSight,Amazon,,,,,
-ram,ram,ram,ram,,ram,,,RAM,RAM,,1,,,aws_ram_,,ram_,RAM (Resource Access Manager),AWS,,,,,
-rds,rds,rds,rds,,rds,,,RDS,RDS,,1,2,aws_(db_|rds_),aws_rds_,,rds_;db_,RDS (Relational Database),Amazon,,,,,
-rds-data,rdsdata,rdsdataservice,rdsdata,,rdsdata,,rdsdataservice,RDSData,RDSDataService,,1,,,aws_rdsdata_,,rdsdata_,RDS Data,Amazon,,,,,
-pi,pi,pi,pi,,pi,,,PI,PI,,1,,,aws_pi_,,pi_,RDS Performance Insights (PI),Amazon,,,,,
-rbin,rbin,recyclebin,rbin,,rbin,,recyclebin,RBin,RecycleBin,,,2,,aws_rbin_,,rbin_,Recycle Bin (RBin),Amazon,,,,,
-,,,,,,,,,,,,,,,,,Red Hat OpenShift Service on AWS (ROSA),AWS,x,,,,No SDK support
-redshift,redshift,redshift,redshift,,redshift,,,Redshift,Redshift,,1,,,aws_redshift_,,redshift_,Redshift,Amazon,,,,,
-redshift-data,redshiftdata,redshiftdataapiservice,redshiftdata,,redshiftdata,,redshiftdataapiservice,RedshiftData,RedshiftDataAPIService,,1,,,aws_redshiftdata_,,redshiftdata_,Redshift Data,Amazon,,,,,
-redshift-serverless,redshiftserverless,redshiftserverless,redshiftserverless,,redshiftserverless,,,RedshiftServerless,RedshiftServerless,,1,,,aws_redshiftserverless_,,redshiftserverless_,Redshift Serverless,Amazon,,,,,
-rekognition,rekognition,rekognition,rekognition,,rekognition,,,Rekognition,Rekognition,,1,,,aws_rekognition_,,rekognition_,Rekognition,Amazon,,,,,
-resiliencehub,resiliencehub,resiliencehub,resiliencehub,,resiliencehub,,,ResilienceHub,ResilienceHub,,1,,,aws_resiliencehub_,,resiliencehub_,Resilience Hub,AWS,,,,,
-resource-explorer-2,resourceexplorer2,resourceexplorer2,resourceexplorer2,,resourceexplorer2,,,ResourceExplorer2,ResourceExplorer2,,,2,,aws_resourceexplorer2_,,resourceexplorer2_,Resource Explorer,AWS,,,,,
-resource-groups,resourcegroups,resourcegroups,resourcegroups,,resourcegroups,,,ResourceGroups,ResourceGroups,,1,,,aws_resourcegroups_,,resourcegroups_,Resource Groups,AWS,,,,,
-resourcegroupstaggingapi,resourcegroupstaggingapi,resourcegroupstaggingapi,resourcegroupstaggingapi,,resourcegroupstaggingapi,,resourcegroupstagging,ResourceGroupsTaggingAPI,ResourceGroupsTaggingAPI,,1,,,aws_resourcegroupstaggingapi_,,resourcegroupstaggingapi_,Resource Groups Tagging,AWS,,,,,
-robomaker,robomaker,robomaker,robomaker,,robomaker,,,RoboMaker,RoboMaker,,1,,,aws_robomaker_,,robomaker_,RoboMaker,AWS,,,,,
-rolesanywhere,rolesanywhere,rolesanywhere,rolesanywhere,,rolesanywhere,,,RolesAnywhere,RolesAnywhere,,,2,,aws_rolesanywhere_,,rolesanywhere_,Roles Anywhere,AWS,,,,,
-route53,route53,route53,route53,,route53,,,Route53,Route53,x,1,,aws_route53_(?!resolver_),aws_route53_,,route53_cidr_;route53_delegation_;route53_health_;route53_hosted_;route53_key_;route53_query_;route53_record;route53_traffic_;route53_vpc_;route53_zone,Route 53,Amazon,,,,,
-route53domains,route53domains,route53domains,route53domains,,route53domains,,,Route53Domains,Route53Domains,x,,2,,aws_route53domains_,,route53domains_,Route 53 Domains,Amazon,,,,,
-route53-recovery-cluster,route53recoverycluster,route53recoverycluster,route53recoverycluster,,route53recoverycluster,,,Route53RecoveryCluster,Route53RecoveryCluster,,1,,,aws_route53recoverycluster_,,route53recoverycluster_,Route 53 Recovery Cluster,Amazon,,,,,
-route53-recovery-control-config,route53recoverycontrolconfig,route53recoverycontrolconfig,route53recoverycontrolconfig,,route53recoverycontrolconfig,,,Route53RecoveryControlConfig,Route53RecoveryControlConfig,x,1,,,aws_route53recoverycontrolconfig_,,route53recoverycontrolconfig_,Route 53 Recovery Control Config,Amazon,,,,,
-route53-recovery-readiness,route53recoveryreadiness,route53recoveryreadiness,route53recoveryreadiness,,route53recoveryreadiness,,,Route53RecoveryReadiness,Route53RecoveryReadiness,x,1,,,aws_route53recoveryreadiness_,,route53recoveryreadiness_,Route 53 Recovery Readiness,Amazon,,,,,
-route53resolver,route53resolver,route53resolver,route53resolver,,route53resolver,,,Route53Resolver,Route53Resolver,,1,,aws_route53_resolver_,aws_route53resolver_,,route53_resolver_,Route 53 Resolver,Amazon,,,,,
-s3api,s3api,s3,s3,,s3,,s3api,S3,S3,x,1,,aws_(canonical_user_id|s3_bucket|s3_object),aws_s3_,,s3_bucket;s3_object;canonical_user_id,S3 (Simple Storage),Amazon,,,AWS_S3_ENDPOINT,TF_AWS_S3_ENDPOINT,
-s3control,s3control,s3control,s3control,,s3control,,,S3Control,S3Control,,1,2,aws_(s3_account_|s3control_|s3_access_),aws_s3control_,,s3control;s3_account_;s3_access_,S3 Control,Amazon,,,,,
-glacier,glacier,glacier,glacier,,glacier,,,Glacier,Glacier,,,2,,aws_glacier_,,glacier_,S3 Glacier,Amazon,,,,,
-s3outposts,s3outposts,s3outposts,s3outposts,,s3outposts,,,S3Outposts,S3Outposts,,1,,,aws_s3outposts_,,s3outposts_,S3 on Outposts,Amazon,,,,,
-sagemaker,sagemaker,sagemaker,sagemaker,,sagemaker,,,SageMaker,SageMaker,,1,,,aws_sagemaker_,,sagemaker_,SageMaker,Amazon,,,,,
-sagemaker-a2i-runtime,sagemakera2iruntime,augmentedairuntime,sagemakera2iruntime,,sagemakera2iruntime,,augmentedairuntime,SageMakerA2IRuntime,AugmentedAIRuntime,,1,,,aws_sagemakera2iruntime_,,sagemakera2iruntime_,SageMaker A2I (Augmented AI),Amazon,,,,,
-sagemaker-edge,sagemakeredge,sagemakeredgemanager,sagemakeredge,,sagemakeredge,,sagemakeredgemanager,SageMakerEdge,SagemakerEdgeManager,,1,,,aws_sagemakeredge_,,sagemakeredge_,SageMaker Edge Manager,Amazon,,,,,
-sagemaker-featurestore-runtime,sagemakerfeaturestoreruntime,sagemakerfeaturestoreruntime,sagemakerfeaturestoreruntime,,sagemakerfeaturestoreruntime,,,SageMakerFeatureStoreRuntime,SageMakerFeatureStoreRuntime,,1,,,aws_sagemakerfeaturestoreruntime_,,sagemakerfeaturestoreruntime_,SageMaker Feature Store Runtime,Amazon,,,,,
-sagemaker-runtime,sagemakerruntime,sagemakerruntime,sagemakerruntime,,sagemakerruntime,,,SageMakerRuntime,SageMakerRuntime,,1,,,aws_sagemakerruntime_,,sagemakerruntime_,SageMaker Runtime,Amazon,,,,,
-,,,,,,,,,,,,,,,,,SAM (Serverless Application Model),AWS,x,,,,No SDK support
-savingsplans,savingsplans,savingsplans,savingsplans,,savingsplans,,,SavingsPlans,SavingsPlans,,1,,,aws_savingsplans_,,savingsplans_,Savings Plans,AWS,,,,,
-,,,,,,,,,,,,,,,,,Schema Conversion Tool,AWS,x,,,,No SDK support
-sdb,sdb,simpledb,,simpledb,sdb,,sdb,SimpleDB,SimpleDB,,1,,aws_simpledb_,aws_sdb_,,simpledb_,SDB (SimpleDB),Amazon,,,,,
-scheduler,scheduler,scheduler,scheduler,,scheduler,,,Scheduler,Scheduler,,,2,,aws_scheduler_,,scheduler_,EventBridge Scheduler,Amazon,,,,,
-secretsmanager,secretsmanager,secretsmanager,secretsmanager,,secretsmanager,,,SecretsManager,SecretsManager,,1,,,aws_secretsmanager_,,secretsmanager_,Secrets Manager,AWS,,,,,
-securityhub,securityhub,securityhub,securityhub,,securityhub,,,SecurityHub,SecurityHub,,1,,,aws_securityhub_,,securityhub_,Security Hub,AWS,,,,,
-securitylake,securitylake,securitylake,securitylake,,securitylake,,,SecurityLake,SecurityLake,,,2,,aws_securitylake_,,securitylake_,Security Lake,Amazon,,,,,
-serverlessrepo,serverlessrepo,serverlessapplicationrepository,serverlessapplicationrepository,,serverlessrepo,,serverlessapprepo;serverlessapplicationrepository,ServerlessRepo,ServerlessApplicationRepository,,1,,aws_serverlessapplicationrepository_,aws_serverlessrepo_,,serverlessapplicationrepository_,Serverless Application Repository,AWS,,,,,
-servicecatalog,servicecatalog,servicecatalog,servicecatalog,,servicecatalog,,,ServiceCatalog,ServiceCatalog,,1,,,aws_servicecatalog_,,servicecatalog_,Service Catalog,AWS,,,,,
-servicecatalog-appregistry,servicecatalogappregistry,appregistry,servicecatalogappregistry,,servicecatalogappregistry,,appregistry,ServiceCatalogAppRegistry,AppRegistry,,1,,,aws_servicecatalogappregistry_,,servicecatalogappregistry_,Service Catalog AppRegistry,AWS,,,,,
-service-quotas,servicequotas,servicequotas,servicequotas,,servicequotas,,,ServiceQuotas,ServiceQuotas,,1,,,aws_servicequotas_,,servicequotas_,Service Quotas,,,,,,
-ses,ses,ses,ses,,ses,,,SES,SES,,1,,,aws_ses_,,ses_,SES (Simple Email),Amazon,,,,,
-sesv2,sesv2,sesv2,sesv2,,sesv2,,,SESV2,SESV2,,,2,,aws_sesv2_,,sesv2_,SESv2 (Simple Email V2),Amazon,,,,,
-stepfunctions,stepfunctions,sfn,sfn,,sfn,,stepfunctions,SFN,SFN,,1,,,aws_sfn_,,sfn_,SFN (Step Functions),AWS,,,,,
-shield,shield,shield,shield,,shield,,,Shield,Shield,x,1,,,aws_shield_,,shield_,Shield,AWS,,,,,
-signer,signer,signer,signer,,signer,,,Signer,Signer,,1,,,aws_signer_,,signer_,Signer,AWS,,,,,
-sms,sms,sms,sms,,sms,,,SMS,SMS,,1,,,aws_sms_,,sms_,SMS (Server Migration),AWS,,,,,
-snow-device-management,snowdevicemanagement,snowdevicemanagement,snowdevicemanagement,,snowdevicemanagement,,,SnowDeviceManagement,SnowDeviceManagement,,1,,,aws_snowdevicemanagement_,,snowdevicemanagement_,Snow Device Management,AWS,,,,,
-snowball,snowball,snowball,snowball,,snowball,,,Snowball,Snowball,,1,,,aws_snowball_,,snowball_,Snow Family,AWS,,,,,
-sns,sns,sns,sns,,sns,,,SNS,SNS,,1,,,aws_sns_,,sns_,SNS (Simple Notification),Amazon,,,,,
-sqs,sqs,sqs,sqs,,sqs,,,SQS,SQS,,1,,,aws_sqs_,,sqs_,SQS (Simple Queue),Amazon,,,,,
-ssm,ssm,ssm,ssm,,ssm,,,SSM,SSM,,1,2,,aws_ssm_,,ssm_,SSM (Systems Manager),AWS,,,,,
-ssm-contacts,ssmcontacts,ssmcontacts,ssmcontacts,,ssmcontacts,,,SSMContacts,SSMContacts,,,2,,aws_ssmcontacts_,,ssmcontacts_,SSM Contacts,AWS,,,,,
-ssm-incidents,ssmincidents,ssmincidents,ssmincidents,,ssmincidents,,,SSMIncidents,SSMIncidents,,,2,,aws_ssmincidents_,,ssmincidents_,SSM Incident Manager Incidents,AWS,,,,,
-sso,sso,sso,sso,,sso,,,SSO,SSO,,1,,,aws_sso_,,sso_,SSO (Single Sign-On),AWS,,,,,
-sso-admin,ssoadmin,ssoadmin,ssoadmin,,ssoadmin,,,SSOAdmin,SSOAdmin,,1,,,aws_ssoadmin_,,ssoadmin_,SSO Admin,AWS,,,,,
-identitystore,identitystore,identitystore,identitystore,,identitystore,,,IdentityStore,IdentityStore,,,2,,aws_identitystore_,,identitystore_,SSO Identity Store,AWS,,,,,
-sso-oidc,ssooidc,ssooidc,ssooidc,,ssooidc,,,SSOOIDC,SSOOIDC,,1,,,aws_ssooidc_,,ssooidc_,SSO OIDC,AWS,,,,,
-storagegateway,storagegateway,storagegateway,storagegateway,,storagegateway,,,StorageGateway,StorageGateway,,1,,,aws_storagegateway_,,storagegateway_,Storage Gateway,AWS,,,,,
-sts,sts,sts,sts,,sts,,,STS,STS,x,1,,aws_caller_identity,aws_sts_,,caller_identity,STS (Security Token),AWS,,,AWS_STS_ENDPOINT,TF_AWS_STS_ENDPOINT,
-,,,,,,,,,,,,,,,,,Sumerian,Amazon,x,,,,No SDK support
-support,support,support,support,,support,,,Support,Support,,1,,,aws_support_,,support_,Support,AWS,,,,,
-swf,swf,swf,swf,,swf,,,SWF,SWF,,,2,,aws_swf_,,swf_,SWF (Simple Workflow),Amazon,,,,,
-,,,,,,,,,,,,,,,,,Tag Editor,AWS,x,,,,Part of Resource Groups Tagging
-textract,textract,textract,textract,,textract,,,Textract,Textract,,1,,,aws_textract_,,textract_,Textract,Amazon,,,,,
-timestream-query,timestreamquery,timestreamquery,timestreamquery,,timestreamquery,,,TimestreamQuery,TimestreamQuery,,1,,,aws_timestreamquery_,,timestreamquery_,Timestream Query,Amazon,,,,,
-timestream-write,timestreamwrite,timestreamwrite,timestreamwrite,,timestreamwrite,,,TimestreamWrite,TimestreamWrite,,1,,,aws_timestreamwrite_,,timestreamwrite_,Timestream Write,Amazon,,,,,
-,,,,,,,,,,,,,,,,,Tools for PowerShell,AWS,x,,,,No SDK support
-,,,,,,,,,,,,,,,,,Training and Certification,AWS,x,,,,No SDK support
-transcribe,transcribe,transcribeservice,transcribe,,transcribe,,transcribeservice,Transcribe,TranscribeService,,,2,,aws_transcribe_,,transcribe_,Transcribe,Amazon,,,,,
-,,transcribestreamingservice,transcribestreaming,,transcribestreaming,,transcribestreamingservice,TranscribeStreaming,TranscribeStreamingService,,1,,,aws_transcribestreaming_,,transcribestreaming_,Transcribe Streaming,Amazon,,,,,
-transfer,transfer,transfer,transfer,,transfer,,,Transfer,Transfer,,1,,,aws_transfer_,,transfer_,Transfer Family,AWS,,,,,
-,,,,,transitgateway,ec2,,TransitGateway,,,,,aws_ec2_transit_gateway,aws_transitgateway_,transitgateway_,ec2_transit_gateway,Transit Gateway,AWS,x,x,,,Part of EC2
-translate,translate,translate,translate,,translate,,,Translate,Translate,,1,,,aws_translate_,,translate_,Translate,Amazon,,,,,
-,,,,,,,,,,,,,,,,,Trusted Advisor,AWS,x,,,,Part of Support
-,,,,,verifiedaccess,ec2,,VerifiedAccess,,,,,aws_verifiedaccess,aws_verifiedaccess_,verifiedaccess_,verifiedaccess,Verified Access,AWS,x,x,,,Part of EC2
-,,,,,vpc,ec2,,VPC,,,,,aws_((default_)?(network_acl|route_table|security_group|subnet|vpc(?!_ipam))|ec2_(managed|network|subnet|traffic)|egress_only_internet|flow_log|internet_gateway|main_route_table_association|nat_gateway|network_interface|prefix_list|route\b),aws_vpc_,vpc_,default_network_;default_route_;default_security_;default_subnet;default_vpc;ec2_managed_;ec2_network_;ec2_subnet_;ec2_traffic_;egress_only_;flow_log;internet_gateway;main_route_;nat_;network_;prefix_list;route_;route\.;security_group;subnet;vpc_dhcp_;vpc_endpoint;vpc_ipv;vpc_network_performance;vpc_peering_;vpc_security_group_;vpc\.;vpcs\.,VPC (Virtual Private Cloud),Amazon,x,x,,,Part of EC2
-vpc-lattice,vpclattice,vpclattice,vpclattice,,vpclattice,,,VPCLattice,VPCLattice,,,2,,aws_vpclattice_,,vpclattice_,VPC Lattice,Amazon,,,,,
-,,,,,ipam,ec2,,IPAM,,,,,aws_vpc_ipam,aws_ipam_,ipam_,vpc_ipam,VPC IPAM (IP Address Manager),Amazon,x,x,,,Part of EC2
-,,,,,vpnclient,ec2,,ClientVPN,,,,,aws_ec2_client_vpn,aws_vpnclient_,vpnclient_,ec2_client_vpn_,VPN (Client),AWS,x,x,,,Part of EC2
-,,,,,vpnsite,ec2,,SiteVPN,,,,,aws_(customer_gateway|vpn_),aws_vpnsite_,vpnsite_,customer_gateway;vpn_,VPN (Site-to-Site),AWS,x,x,,,Part of EC2
-wafv2,wafv2,wafv2,wafv2,,wafv2,,,WAFV2,WAFV2,,1,,,aws_wafv2_,,wafv2_,WAF,AWS,,,,,
-waf,waf,waf,waf,,waf,,,WAF,WAF,,1,,,aws_waf_,,waf_,WAF Classic,AWS,,,,,
-waf-regional,wafregional,wafregional,wafregional,,wafregional,,,WAFRegional,WAFRegional,,1,,,aws_wafregional_,,wafregional_,WAF Classic Regional,AWS,,,,,
-,,,,,,,,,,,,,,,,,WAM (WorkSpaces Application Manager),Amazon,x,,,,No SDK support
-,,,,,wavelength,ec2,,Wavelength,,,,,aws_ec2_carrier_gateway,aws_wavelength_,wavelength_,ec2_carrier_,Wavelength,AWS,x,x,,,Part of EC2
-budgets,budgets,budgets,budgets,,budgets,,,Budgets,Budgets,,1,,,aws_budgets_,,budgets_,Web Services Budgets,Amazon,,,,,
-wellarchitected,wellarchitected,wellarchitected,wellarchitected,,wellarchitected,,,WellArchitected,WellArchitected,,1,,,aws_wellarchitected_,,wellarchitected_,Well-Architected Tool,AWS,,,,,
-workdocs,workdocs,workdocs,workdocs,,workdocs,,,WorkDocs,WorkDocs,,1,,,aws_workdocs_,,workdocs_,WorkDocs,Amazon,,,,,
-worklink,worklink,worklink,worklink,,worklink,,,WorkLink,WorkLink,,1,,,aws_worklink_,,worklink_,WorkLink,Amazon,,,,,
-workmail,workmail,workmail,workmail,,workmail,,,WorkMail,WorkMail,,1,,,aws_workmail_,,workmail_,WorkMail,Amazon,,,,,
-workmailmessageflow,workmailmessageflow,workmailmessageflow,workmailmessageflow,,workmailmessageflow,,,WorkMailMessageFlow,WorkMailMessageFlow,,1,,,aws_workmailmessageflow_,,workmailmessageflow_,WorkMail Message Flow,Amazon,,,,,
-workspaces,workspaces,workspaces,workspaces,,workspaces,,,WorkSpaces,WorkSpaces,,1,,,aws_workspaces_,,workspaces_,WorkSpaces,Amazon,,,,,
-workspaces-web,workspacesweb,workspacesweb,workspacesweb,,workspacesweb,,,WorkSpacesWeb,WorkSpacesWeb,,1,,,aws_workspacesweb_,,workspacesweb_,WorkSpaces Web,Amazon,,,,,
-xray,xray,xray,xray,,xray,,,XRay,XRay,,,2,,aws_xray_,,xray_,X-Ray,AWS,,,,,
+AWSCLIV2Command,AWSCLIV2CommandNoDashes,GoV1Package,GoV2Package,ProviderPackageActual,ProviderPackageCorrect,SplitPackageRealPackage,Aliases,ProviderNameUpper,GoV1ClientTypeName,SkipClientGenerate,ClientSDKV1,ClientSDKV2,ResourcePrefixActual,ResourcePrefixCorrect,FilePrefix,DocPrefix,HumanFriendly,Brand,Exclude,NotImplemented,AllowedSubcategory,DeprecatedEnvVar,EnvVar,Note
+accessanalyzer,accessanalyzer,accessanalyzer,accessanalyzer,,accessanalyzer,,,AccessAnalyzer,AccessAnalyzer,,,2,,aws_accessanalyzer_,,accessanalyzer_,IAM Access Analyzer,AWS,,,,,,
+account,account,account,account,,account,,,Account,Account,,,2,,aws_account_,,account_,Account Management,AWS,,,,,,
+acm,acm,acm,acm,,acm,,,ACM,ACM,,,2,,aws_acm_,,acm_,ACM (Certificate Manager),AWS,,,,,,
+acm-pca,acmpca,acmpca,acmpca,,acmpca,,,ACMPCA,ACMPCA,,1,,,aws_acmpca_,,acmpca_,ACM PCA (Certificate Manager Private Certificate Authority),AWS,,,,,,
+alexaforbusiness,alexaforbusiness,alexaforbusiness,alexaforbusiness,,alexaforbusiness,,,AlexaForBusiness,AlexaForBusiness,,1,,,aws_alexaforbusiness_,,alexaforbusiness_,Alexa for Business,,,x,,,,
+amp,amp,prometheusservice,amp,,amp,,prometheus;prometheusservice,AMP,PrometheusService,,1,,aws_prometheus_,aws_amp_,,prometheus_,AMP (Managed Prometheus),Amazon,,,,,,
+amplify,amplify,amplify,amplify,,amplify,,,Amplify,Amplify,,1,,,aws_amplify_,,amplify_,Amplify,AWS,,,,,,
+amplifybackend,amplifybackend,amplifybackend,amplifybackend,,amplifybackend,,,AmplifyBackend,AmplifyBackend,,1,,,aws_amplifybackend_,,amplifybackend_,Amplify Backend,AWS,,x,,,,
+amplifyuibuilder,amplifyuibuilder,amplifyuibuilder,amplifyuibuilder,,amplifyuibuilder,,,AmplifyUIBuilder,AmplifyUIBuilder,,1,,,aws_amplifyuibuilder_,,amplifyuibuilder_,Amplify UI Builder,AWS,,x,,,,
+,,,,,,,,,,,,,,,,,Apache MXNet on AWS,AWS,x,,,,,Documentation
+apigateway,apigateway,apigateway,apigateway,,apigateway,,,APIGateway,APIGateway,,1,,aws_api_gateway_,aws_apigateway_,,api_gateway_,API Gateway,Amazon,,,,,,
+apigatewaymanagementapi,apigatewaymanagementapi,apigatewaymanagementapi,apigatewaymanagementapi,,apigatewaymanagementapi,,,APIGatewayManagementAPI,ApiGatewayManagementApi,,1,,,aws_apigatewaymanagementapi_,,apigatewaymanagementapi_,API Gateway Management API,Amazon,,x,,,,
+apigatewayv2,apigatewayv2,apigatewayv2,apigatewayv2,,apigatewayv2,,,APIGatewayV2,ApiGatewayV2,,1,,,aws_apigatewayv2_,,apigatewayv2_,API Gateway V2,Amazon,,,,,,
+appmesh,appmesh,appmesh,appmesh,,appmesh,,,AppMesh,AppMesh,,1,,,aws_appmesh_,,appmesh_,App Mesh,AWS,,,,,,
+apprunner,apprunner,apprunner,apprunner,,apprunner,,,AppRunner,AppRunner,,1,,,aws_apprunner_,,apprunner_,App Runner,AWS,,,,,,
+,,,,,,,,,,,,,,,,,App2Container,AWS,x,,,,,No SDK support
+appconfig,appconfig,appconfig,appconfig,,appconfig,,,AppConfig,AppConfig,,1,2,,aws_appconfig_,,appconfig_,AppConfig,AWS,,,,,,
+appconfigdata,appconfigdata,appconfigdata,appconfigdata,,appconfigdata,,,AppConfigData,AppConfigData,,1,,,aws_appconfigdata_,,appconfigdata_,AppConfig Data,AWS,,x,,,,
+appflow,appflow,appflow,appflow,,appflow,,,AppFlow,Appflow,,1,,,aws_appflow_,,appflow_,AppFlow,Amazon,,,,,,
+appintegrations,appintegrations,appintegrationsservice,appintegrations,,appintegrations,,appintegrationsservice,AppIntegrations,AppIntegrationsService,,1,,,aws_appintegrations_,,appintegrations_,AppIntegrations,Amazon,,,,,,
+application-autoscaling,applicationautoscaling,applicationautoscaling,applicationautoscaling,appautoscaling,applicationautoscaling,,applicationautoscaling,AppAutoScaling,ApplicationAutoScaling,,1,,aws_appautoscaling_,aws_applicationautoscaling_,,appautoscaling_,Application Auto Scaling,,,,,,,
+applicationcostprofiler,applicationcostprofiler,applicationcostprofiler,applicationcostprofiler,,applicationcostprofiler,,,ApplicationCostProfiler,ApplicationCostProfiler,,1,,,aws_applicationcostprofiler_,,applicationcostprofiler_,Application Cost Profiler,AWS,,x,,,,
+discovery,discovery,applicationdiscoveryservice,applicationdiscoveryservice,,discovery,,applicationdiscovery;applicationdiscoveryservice,Discovery,ApplicationDiscoveryService,,1,,,aws_discovery_,,discovery_,Application Discovery,AWS,,x,,,,
+mgn,mgn,mgn,mgn,,mgn,,,Mgn,Mgn,,1,,,aws_mgn_,,mgn_,Application Migration (Mgn),AWS,,x,,,,
+appstream,appstream,appstream,appstream,,appstream,,,AppStream,AppStream,,1,,,aws_appstream_,,appstream_,AppStream 2.0,Amazon,,,,,,
+appsync,appsync,appsync,appsync,,appsync,,,AppSync,AppSync,,1,,,aws_appsync_,,appsync_,AppSync,AWS,,,,,,
+,,,,,,,,,,,,,,,,,Artifact,AWS,x,,,,,No SDK support
+athena,athena,athena,athena,,athena,,,Athena,Athena,,1,,,aws_athena_,,athena_,Athena,Amazon,,,,,,
+auditmanager,auditmanager,auditmanager,auditmanager,,auditmanager,,,AuditManager,AuditManager,,,2,,aws_auditmanager_,,auditmanager_,Audit Manager,AWS,,,,,,
+autoscaling,autoscaling,autoscaling,autoscaling,,autoscaling,,,AutoScaling,AutoScaling,,1,,aws_(autoscaling_|launch_configuration),aws_autoscaling_,,autoscaling_;launch_configuration,Auto Scaling,,,,,,,
+autoscaling-plans,autoscalingplans,autoscalingplans,autoscalingplans,,autoscalingplans,,,AutoScalingPlans,AutoScalingPlans,,1,,,aws_autoscalingplans_,,autoscalingplans_,Auto Scaling Plans,,,,,,,
+,,,,,,,,,,,,,,,,,Backint Agent for SAP HANA,AWS,x,,,,,No SDK support
+backup,backup,backup,backup,,backup,,,Backup,Backup,,1,,,aws_backup_,,backup_,Backup,AWS,,,,,,
+backup-gateway,backupgateway,backupgateway,backupgateway,,backupgateway,,,BackupGateway,BackupGateway,,1,,,aws_backupgateway_,,backupgateway_,Backup Gateway,AWS,,x,,,,
+batch,batch,batch,batch,,batch,,,Batch,Batch,,1,,,aws_batch_,,batch_,Batch,AWS,,,,,,
+bedrock,bedrock,bedrock,,,bedrock,,,Bedrock,Bedrock,,1,,,aws_bedrock_,,bedrock_,Amazon Bedrock,Amazon,,,,,,
+billingconductor,billingconductor,billingconductor,,,billingconductor,,,BillingConductor,BillingConductor,,1,,,aws_billingconductor_,,billingconductor_,Billing Conductor,AWS,,x,,,,
+braket,braket,braket,braket,,braket,,,Braket,Braket,,1,,,aws_braket_,,braket_,Braket,Amazon,,x,,,,
+ce,ce,costexplorer,costexplorer,,ce,,costexplorer,CE,CostExplorer,,1,,,aws_ce_,,ce_,CE (Cost Explorer),AWS,,,,,,
+,,,,,,,,,,,,,,,,,Chatbot,AWS,x,,,,,No SDK support
+chime,chime,chime,chime,,chime,,,Chime,Chime,,1,,,aws_chime_,,chime_,Chime,Amazon,,,,,,
+chime-sdk-identity,chimesdkidentity,chimesdkidentity,chimesdkidentity,,chimesdkidentity,,,ChimeSDKIdentity,ChimeSDKIdentity,,1,,,aws_chimesdkidentity_,,chimesdkidentity_,Chime SDK Identity,Amazon,,x,,,,
+chime-sdk-mediapipelines,chimesdkmediapipelines,chimesdkmediapipelines,chimesdkmediapipelines,,chimesdkmediapipelines,,,ChimeSDKMediaPipelines,ChimeSDKMediaPipelines,,1,,,aws_chimesdkmediapipelines_,,chimesdkmediapipelines_,Chime SDK Media Pipelines,Amazon,,,,,,
+chime-sdk-meetings,chimesdkmeetings,chimesdkmeetings,chimesdkmeetings,,chimesdkmeetings,,,ChimeSDKMeetings,ChimeSDKMeetings,,1,,,aws_chimesdkmeetings_,,chimesdkmeetings_,Chime SDK Meetings,Amazon,,x,,,,
+chime-sdk-messaging,chimesdkmessaging,chimesdkmessaging,chimesdkmessaging,,chimesdkmessaging,,,ChimeSDKMessaging,ChimeSDKMessaging,,1,,,aws_chimesdkmessaging_,,chimesdkmessaging_,Chime SDK Messaging,Amazon,,x,,,,
+chime-sdk-voice,chimesdkvoice,chimesdkvoice,chimesdkvoice,,chimesdkvoice,,,ChimeSDKVoice,ChimeSDKVoice,,1,,,aws_chimesdkvoice_,,chimesdkvoice_,Chime SDK Voice,Amazon,,,,,,
+cleanrooms,cleanrooms,cleanrooms,cleanrooms,,cleanrooms,,,CleanRooms,CleanRooms,,,2,,aws_cleanrooms_,,cleanrooms_,Clean Rooms,AWS,,,,,,
+,,,,,,,,,,,,,,,,,CLI (Command Line Interface),AWS,x,,,,,No SDK support
+configure,configure,,,,,,,,,,,,,,,,CLI Configure options,AWS,x,,,,,CLI only
+ddb,ddb,,,,,,,,,,,,,,,,CLI High-level DynamoDB commands,AWS,x,,,,,Part of DynamoDB
+s3,s3,,,,,,,,,,,,,,,,CLI High-level S3 commands,AWS,x,,,,,CLI only
+history,history,,,,,,,,,,,,,,,,CLI History of commands,AWS,x,,,,,CLI only
+importexport,importexport,,,,,,,,,,,,,,,,CLI Import/Export,AWS,x,,,,,CLI only
+cli-dev,clidev,,,,,,,,,,,,,,,,CLI Internal commands for development,AWS,x,,,,,CLI only
+cloudcontrol,cloudcontrol,cloudcontrolapi,cloudcontrol,,cloudcontrol,,cloudcontrolapi,CloudControl,CloudControlApi,,,2,aws_cloudcontrolapi_,aws_cloudcontrol_,,cloudcontrolapi_,Cloud Control API,AWS,,,,,,
+,,,,,,,,,,,,,,,,,Cloud Digital Interface SDK,AWS,x,,,,,No SDK support
+clouddirectory,clouddirectory,clouddirectory,clouddirectory,,clouddirectory,,,CloudDirectory,CloudDirectory,,1,,,aws_clouddirectory_,,clouddirectory_,Cloud Directory,Amazon,,x,,,,
+servicediscovery,servicediscovery,servicediscovery,servicediscovery,,servicediscovery,,,ServiceDiscovery,ServiceDiscovery,,1,,aws_service_discovery_,aws_servicediscovery_,,service_discovery_,Cloud Map,AWS,,,,,,
+cloud9,cloud9,cloud9,cloud9,,cloud9,,,Cloud9,Cloud9,,1,,,aws_cloud9_,,cloud9_,Cloud9,AWS,,,,,,
+cloudformation,cloudformation,cloudformation,cloudformation,,cloudformation,,,CloudFormation,CloudFormation,,1,,,aws_cloudformation_,,cloudformation_,CloudFormation,AWS,,,,,,
+cloudfront,cloudfront,cloudfront,cloudfront,,cloudfront,,,CloudFront,CloudFront,,1,,,aws_cloudfront_,,cloudfront_,CloudFront,Amazon,,,,,,
+cloudhsm,cloudhsm,cloudhsm,cloudhsm,,,,,,,,,,,,,,CloudHSM,AWS,x,,,,,Legacy
+cloudhsmv2,cloudhsmv2,cloudhsmv2,cloudhsmv2,,cloudhsmv2,,cloudhsm,CloudHSMV2,CloudHSMV2,,1,,aws_cloudhsm_v2_,aws_cloudhsmv2_,,cloudhsm,CloudHSM,AWS,,,,,,
+cloudsearch,cloudsearch,cloudsearch,cloudsearch,,cloudsearch,,,CloudSearch,CloudSearch,,1,,,aws_cloudsearch_,,cloudsearch_,CloudSearch,Amazon,,,,,,
+cloudsearchdomain,cloudsearchdomain,cloudsearchdomain,cloudsearchdomain,,cloudsearchdomain,,,CloudSearchDomain,CloudSearchDomain,,1,,,aws_cloudsearchdomain_,,cloudsearchdomain_,CloudSearch Domain,Amazon,,x,,,,
+,,,,,,,,,,,,,,,,,CloudShell,AWS,x,,,,,No SDK support
+cloudtrail,cloudtrail,cloudtrail,cloudtrail,,cloudtrail,,,CloudTrail,CloudTrail,,1,,aws_cloudtrail,aws_cloudtrail_,,cloudtrail,CloudTrail,AWS,,,,,,
+cloudwatch,cloudwatch,cloudwatch,cloudwatch,,cloudwatch,,,CloudWatch,CloudWatch,,1,,aws_cloudwatch_(?!(event_|log_|query_)),aws_cloudwatch_,,cloudwatch_dashboard;cloudwatch_metric_;cloudwatch_composite_,CloudWatch,Amazon,,,,,,
+application-insights,applicationinsights,applicationinsights,applicationinsights,,applicationinsights,,,ApplicationInsights,ApplicationInsights,,1,,,aws_applicationinsights_,,applicationinsights_,CloudWatch Application Insights,Amazon,,,,,,
+evidently,evidently,cloudwatchevidently,evidently,,evidently,,cloudwatchevidently,Evidently,CloudWatchEvidently,,1,,,aws_evidently_,,evidently_,CloudWatch Evidently,Amazon,,,,,,
+internetmonitor,internetmonitor,internetmonitor,internetmonitor,,internetmonitor,,,InternetMonitor,InternetMonitor,,,2,,aws_internetmonitor_,,internetmonitor_,CloudWatch Internet Monitor,Amazon,,,,,,
+logs,logs,cloudwatchlogs,cloudwatchlogs,,logs,,cloudwatchlog;cloudwatchlogs,Logs,CloudWatchLogs,,1,2,aws_cloudwatch_(log_|query_),aws_logs_,,cloudwatch_log_;cloudwatch_query_,CloudWatch Logs,Amazon,,,,,,
+rum,rum,cloudwatchrum,rum,,rum,,cloudwatchrum,RUM,CloudWatchRUM,,1,,,aws_rum_,,rum_,CloudWatch RUM,Amazon,,,,,,
+synthetics,synthetics,synthetics,synthetics,,synthetics,,,Synthetics,Synthetics,,1,,,aws_synthetics_,,synthetics_,CloudWatch Synthetics,Amazon,,,,,,
+codeartifact,codeartifact,codeartifact,codeartifact,,codeartifact,,,CodeArtifact,CodeArtifact,,1,,,aws_codeartifact_,,codeartifact_,CodeArtifact,AWS,,,,,,
+codebuild,codebuild,codebuild,codebuild,,codebuild,,,CodeBuild,CodeBuild,,1,,,aws_codebuild_,,codebuild_,CodeBuild,AWS,,,,,,
+codecommit,codecommit,codecommit,codecommit,,codecommit,,,CodeCommit,CodeCommit,,1,,,aws_codecommit_,,codecommit_,CodeCommit,AWS,,,,,,
+deploy,deploy,codedeploy,codedeploy,,deploy,,codedeploy,Deploy,CodeDeploy,,1,,aws_codedeploy_,aws_deploy_,,codedeploy_,CodeDeploy,AWS,,,,,,
+codeguruprofiler,codeguruprofiler,codeguruprofiler,codeguruprofiler,,codeguruprofiler,,,CodeGuruProfiler,CodeGuruProfiler,,1,,,aws_codeguruprofiler_,,codeguruprofiler_,CodeGuru Profiler,Amazon,,x,,,,
+codeguru-reviewer,codegurureviewer,codegurureviewer,codegurureviewer,,codegurureviewer,,,CodeGuruReviewer,CodeGuruReviewer,,1,,,aws_codegurureviewer_,,codegurureviewer_,CodeGuru Reviewer,Amazon,,,,,,
+codepipeline,codepipeline,codepipeline,codepipeline,,codepipeline,,,CodePipeline,CodePipeline,,1,,aws_codepipeline,aws_codepipeline_,,codepipeline,CodePipeline,AWS,,,,,,
+codestar,codestar,codestar,codestar,,codestar,,,CodeStar,CodeStar,,1,,,aws_codestar_,,codestar_,CodeStar,AWS,,x,,,,
+codestar-connections,codestarconnections,codestarconnections,codestarconnections,,codestarconnections,,,CodeStarConnections,CodeStarConnections,,,2,,aws_codestarconnections_,,codestarconnections_,CodeStar Connections,AWS,,,,,,
+codestar-notifications,codestarnotifications,codestarnotifications,codestarnotifications,,codestarnotifications,,,CodeStarNotifications,CodeStarNotifications,,,2,,aws_codestarnotifications_,,codestarnotifications_,CodeStar Notifications,AWS,,,,,,
+cognito-identity,cognitoidentity,cognitoidentity,cognitoidentity,,cognitoidentity,,,CognitoIdentity,CognitoIdentity,,1,,aws_cognito_identity_(?!provider),aws_cognitoidentity_,,cognito_identity_pool,Cognito Identity,Amazon,,,,,,
+cognito-idp,cognitoidp,cognitoidentityprovider,cognitoidentityprovider,,cognitoidp,,cognitoidentityprovider,CognitoIDP,CognitoIdentityProvider,,1,,aws_cognito_(identity_provider|resource|user|risk),aws_cognitoidp_,,cognito_identity_provider;cognito_managed_user;cognito_resource_;cognito_user;cognito_risk,Cognito IDP (Identity Provider),Amazon,,,,,,
+cognito-sync,cognitosync,cognitosync,cognitosync,,cognitosync,,,CognitoSync,CognitoSync,,1,,,aws_cognitosync_,,cognitosync_,Cognito Sync,Amazon,,x,,,,
+comprehend,comprehend,comprehend,comprehend,,comprehend,,,Comprehend,Comprehend,,,2,,aws_comprehend_,,comprehend_,Comprehend,Amazon,,,,,,
+comprehendmedical,comprehendmedical,comprehendmedical,comprehendmedical,,comprehendmedical,,,ComprehendMedical,ComprehendMedical,,1,,,aws_comprehendmedical_,,comprehendmedical_,Comprehend Medical,Amazon,,x,,,,
+compute-optimizer,computeoptimizer,computeoptimizer,computeoptimizer,,computeoptimizer,,,ComputeOptimizer,ComputeOptimizer,,,2,,aws_computeoptimizer_,,computeoptimizer_,Compute Optimizer,AWS,,,,,,
+configservice,configservice,configservice,configservice,,configservice,,config,ConfigService,ConfigService,,1,,aws_config_,aws_configservice_,,config_,Config,AWS,,,,,,
+connect,connect,connect,connect,,connect,,,Connect,Connect,,1,,,aws_connect_,,connect_,Connect,Amazon,,,,,,
+connect-contact-lens,connectcontactlens,connectcontactlens,connectcontactlens,,connectcontactlens,,,ConnectContactLens,ConnectContactLens,,1,,,aws_connectcontactlens_,,connectcontactlens_,Connect Contact Lens,Amazon,,x,,,,
+customer-profiles,customerprofiles,customerprofiles,customerprofiles,,customerprofiles,,,CustomerProfiles,CustomerProfiles,,1,,,aws_customerprofiles_,,customerprofiles_,Connect Customer Profiles,Amazon,,x,,,,
+connectparticipant,connectparticipant,connectparticipant,connectparticipant,,connectparticipant,,,ConnectParticipant,ConnectParticipant,,1,,,aws_connectparticipant_,,connectparticipant_,Connect Participant,Amazon,,x,,,,
+voice-id,voiceid,voiceid,voiceid,,voiceid,,,VoiceID,VoiceID,,1,,,aws_voiceid_,,voiceid_,Connect Voice ID,Amazon,,x,,,,
+wisdom,wisdom,connectwisdomservice,wisdom,,wisdom,,connectwisdomservice,Wisdom,ConnectWisdomService,,1,,,aws_wisdom_,,wisdom_,Connect Wisdom,Amazon,,x,,,,
+,,,,,,,,,,,,,,,,,Console Mobile Application,AWS,x,,,,,No SDK support
+controltower,controltower,controltower,controltower,,controltower,,,ControlTower,ControlTower,,1,,,aws_controltower_,,controltower_,Control Tower,AWS,,,,,,
+cur,cur,costandusagereportservice,costandusagereportservice,,cur,,costandusagereportservice,CUR,CostandUsageReportService,,1,,,aws_cur_,,cur_,Cost and Usage Report,AWS,,,,,,
+,,,,,,,,,,,,,,,,,Crypto Tools,AWS,x,,,,,No SDK support
+,,,,,,,,,,,,,,,,,Cryptographic Services Overview,AWS,x,,,,,No SDK support
+dataexchange,dataexchange,dataexchange,dataexchange,,dataexchange,,,DataExchange,DataExchange,,1,,,aws_dataexchange_,,dataexchange_,Data Exchange,AWS,,,,,,
+datapipeline,datapipeline,datapipeline,datapipeline,,datapipeline,,,DataPipeline,DataPipeline,,1,,,aws_datapipeline_,,datapipeline_,Data Pipeline,AWS,,,,,,
+datasync,datasync,datasync,datasync,,datasync,,,DataSync,DataSync,,1,,,aws_datasync_,,datasync_,DataSync,AWS,,,,,,
+,,,,,,,,,,,,,,,,,Deep Learning AMIs,AWS,x,,,,,No SDK support
+,,,,,,,,,,,,,,,,,Deep Learning Containers,AWS,x,,,,,No SDK support
+,,,,,,,,,,,,,,,,,DeepComposer,AWS,x,,,,,No SDK support
+,,,,,,,,,,,,,,,,,DeepLens,AWS,x,,,,,No SDK support
+,,,,,,,,,,,,,,,,,DeepRacer,AWS,x,,,,,No SDK support
+detective,detective,detective,detective,,detective,,,Detective,Detective,,1,,,aws_detective_,,detective_,Detective,Amazon,,,,,,
+devicefarm,devicefarm,devicefarm,devicefarm,,devicefarm,,,DeviceFarm,DeviceFarm,,1,,,aws_devicefarm_,,devicefarm_,Device Farm,AWS,,,,,,
+devops-guru,devopsguru,devopsguru,devopsguru,,devopsguru,,,DevOpsGuru,DevOpsGuru,,1,,,aws_devopsguru_,,devopsguru_,DevOps Guru,Amazon,,x,,,,
+directconnect,directconnect,directconnect,directconnect,,directconnect,,,DirectConnect,DirectConnect,,1,,aws_dx_,aws_directconnect_,,dx_,Direct Connect,AWS,,,,,,
+dlm,dlm,dlm,dlm,,dlm,,,DLM,DLM,,1,,,aws_dlm_,,dlm_,DLM (Data Lifecycle Manager),Amazon,,,,,,
+dms,dms,databasemigrationservice,databasemigrationservice,,dms,,databasemigration;databasemigrationservice,DMS,DatabaseMigrationService,,1,,,aws_dms_,,dms_,DMS (Database Migration),AWS,,,,,,
+docdb,docdb,docdb,docdb,,docdb,,,DocDB,DocDB,,1,,,aws_docdb_,,docdb_,DocumentDB,Amazon,,,,,,
+docdb-elastic,docdbelastic,docdbelastic,docdbelastic,,docdbelastic,,,DocDBElastic,DocDBElastic,,,2,,aws_docdbelastic_,,docdbelastic_,DocumentDB Elastic,Amazon,,,,,,
+drs,drs,drs,drs,,drs,,,DRS,Drs,,1,,,aws_drs_,,drs_,DRS (Elastic Disaster Recovery),AWS,,x,,,,
+ds,ds,directoryservice,directoryservice,,ds,,directoryservice,DS,DirectoryService,,1,2,aws_directory_service_,aws_ds_,,directory_service_,Directory Service,AWS,,,,,,
+dynamodb,dynamodb,dynamodb,dynamodb,,dynamodb,,,DynamoDB,DynamoDB,,1,,,aws_dynamodb_,,dynamodb_,DynamoDB,Amazon,,,,AWS_DYNAMODB_ENDPOINT,TF_AWS_DYNAMODB_ENDPOINT,
+dax,dax,dax,dax,,dax,,,DAX,DAX,,1,,,aws_dax_,,dax_,DynamoDB Accelerator (DAX),Amazon,,,,,,
+dynamodbstreams,dynamodbstreams,dynamodbstreams,dynamodbstreams,,dynamodbstreams,,,DynamoDBStreams,DynamoDBStreams,,1,,,aws_dynamodbstreams_,,dynamodbstreams_,DynamoDB Streams,Amazon,,x,,,,
+,,,,,ec2ebs,ec2,,EC2EBS,,,,,aws_(ebs_|volume_attach|snapshot_create),aws_ec2ebs_,ebs_,ebs_;volume_attachment;snapshot_,EBS (EC2),Amazon,x,,x,,,Part of EC2
+ebs,ebs,ebs,ebs,,ebs,,,EBS,EBS,,1,,,aws_ebs_,,changewhenimplemented,EBS (Elastic Block Store),Amazon,,x,,,,
+ec2,ec2,ec2,ec2,,ec2,ec2,,EC2,EC2,,1,2,aws_(ami|availability_zone|ec2_(availability|capacity|fleet|host|instance|public_ipv4_pool|serial|spot|tag)|eip|instance|key_pair|launch_template|placement_group|spot),aws_ec2_,ec2_,ami;availability_zone;ec2_availability_;ec2_capacity_;ec2_fleet;ec2_host;ec2_image_;ec2_instance_;ec2_public_ipv4_pool;ec2_serial_;ec2_spot_;ec2_tag;eip;instance;key_pair;launch_template;placement_group;spot_,EC2 (Elastic Compute Cloud),Amazon,,,,,,
+imagebuilder,imagebuilder,imagebuilder,imagebuilder,,imagebuilder,,,ImageBuilder,Imagebuilder,,1,,,aws_imagebuilder_,,imagebuilder_,EC2 Image Builder,Amazon,,,,,,
+ec2-instance-connect,ec2instanceconnect,ec2instanceconnect,ec2instanceconnect,,ec2instanceconnect,,,EC2InstanceConnect,EC2InstanceConnect,,1,,,aws_ec2instanceconnect_,,ec2instanceconnect_,EC2 Instance Connect,AWS,,x,,,,
+ecr,ecr,ecr,ecr,,ecr,,,ECR,ECR,,1,,,aws_ecr_,,ecr_,ECR (Elastic Container Registry),Amazon,,,,,,
+ecr-public,ecrpublic,ecrpublic,ecrpublic,,ecrpublic,,,ECRPublic,ECRPublic,,1,,,aws_ecrpublic_,,ecrpublic_,ECR Public,Amazon,,,,,,
+ecs,ecs,ecs,ecs,,ecs,,,ECS,ECS,,1,,,aws_ecs_,,ecs_,ECS (Elastic Container),Amazon,,,,,,
+efs,efs,efs,efs,,efs,,,EFS,EFS,,1,,,aws_efs_,,efs_,EFS (Elastic File System),Amazon,,,,,,
+eks,eks,eks,eks,,eks,,,EKS,EKS,,1,,,aws_eks_,,eks_,EKS (Elastic Kubernetes),Amazon,,,,,,
+elasticbeanstalk,elasticbeanstalk,elasticbeanstalk,elasticbeanstalk,,elasticbeanstalk,,beanstalk,ElasticBeanstalk,ElasticBeanstalk,,1,,aws_elastic_beanstalk_,aws_elasticbeanstalk_,,elastic_beanstalk_,Elastic Beanstalk,AWS,,,,,,
+elastic-inference,elasticinference,elasticinference,elasticinference,,elasticinference,,,ElasticInference,ElasticInference,,1,,,aws_elasticinference_,,elasticinference_,Elastic Inference,Amazon,,x,,,,
+elastictranscoder,elastictranscoder,elastictranscoder,elastictranscoder,,elastictranscoder,,,ElasticTranscoder,ElasticTranscoder,,1,,,aws_elastictranscoder_,,elastictranscoder_,Elastic Transcoder,Amazon,,,,,,
+elasticache,elasticache,elasticache,elasticache,,elasticache,,,ElastiCache,ElastiCache,,1,,,aws_elasticache_,,elasticache_,ElastiCache,Amazon,,,,,,
+es,es,elasticsearchservice,elasticsearchservice,elasticsearch,es,,es;elasticsearchservice,Elasticsearch,ElasticsearchService,,1,,aws_elasticsearch_,aws_es_,,elasticsearch_,Elasticsearch,Amazon,,,,,,
+elbv2,elbv2,elbv2,elasticloadbalancingv2,,elbv2,,elasticloadbalancingv2,ELBV2,ELBV2,,1,,aws_a?lb(\b|_listener|_target_group|s),aws_elbv2_,,lbs?\.;lb_listener;lb_target_group;lb_hosted,ELB (Elastic Load Balancing),,,,,,,
+elb,elb,elb,elasticloadbalancing,,elb,,elasticloadbalancing,ELB,ELB,,1,,aws_(app_cookie_stickiness_policy|elb|lb_cookie_stickiness_policy|lb_ssl_negotiation_policy|load_balancer_|proxy_protocol_policy),aws_elb_,,app_cookie_stickiness_policy;elb;lb_cookie_stickiness_policy;lb_ssl_negotiation_policy;load_balancer;proxy_protocol_policy,ELB Classic,,,,,,,
+mediaconnect,mediaconnect,mediaconnect,mediaconnect,,mediaconnect,,,MediaConnect,MediaConnect,,,2,,aws_mediaconnect_,,mediaconnect_,Elemental MediaConnect,AWS,,,,,,
+mediaconvert,mediaconvert,mediaconvert,mediaconvert,,mediaconvert,,,MediaConvert,MediaConvert,,1,,aws_media_convert_,aws_mediaconvert_,,media_convert_,Elemental MediaConvert,AWS,,,,,,
+medialive,medialive,medialive,medialive,,medialive,,,MediaLive,MediaLive,,,2,,aws_medialive_,,medialive_,Elemental MediaLive,AWS,,,,,,
+mediapackage,mediapackage,mediapackage,mediapackage,,mediapackage,,,MediaPackage,MediaPackage,,,2,aws_media_package_,aws_mediapackage_,,media_package_,Elemental MediaPackage,AWS,,,,,,
+mediapackage-vod,mediapackagevod,mediapackagevod,mediapackagevod,,mediapackagevod,,,MediaPackageVOD,MediaPackageVod,,1,,,aws_mediapackagevod_,,mediapackagevod_,Elemental MediaPackage VOD,AWS,,x,,,,
+mediastore,mediastore,mediastore,mediastore,,mediastore,,,MediaStore,MediaStore,,1,,aws_media_store_,aws_mediastore_,,media_store_,Elemental MediaStore,AWS,,,,,,
+mediastore-data,mediastoredata,mediastoredata,mediastoredata,,mediastoredata,,,MediaStoreData,MediaStoreData,,1,,,aws_mediastoredata_,,mediastoredata_,Elemental MediaStore Data,AWS,,x,,,,
+mediatailor,mediatailor,mediatailor,mediatailor,,mediatailor,,,MediaTailor,MediaTailor,,1,,,aws_mediatailor_,,media_tailor_,Elemental MediaTailor,AWS,,x,,,,
+,,,,,,,,,,,,,,,,,Elemental On-Premises,AWS,x,,,,,No SDK support
+emr,emr,emr,emr,,emr,,,EMR,EMR,,1,,,aws_emr_,,emr_,EMR,Amazon,,,,,,
+emr-containers,emrcontainers,emrcontainers,emrcontainers,,emrcontainers,,,EMRContainers,EMRContainers,,1,,,aws_emrcontainers_,,emrcontainers_,EMR Containers,Amazon,,,,,,
+emr-serverless,emrserverless,emrserverless,emrserverless,,emrserverless,,,EMRServerless,EMRServerless,,,2,,aws_emrserverless_,,emrserverless_,EMR Serverless,Amazon,,,,,,
+,,,,,,,,,,,,,,,,,End-of-Support Migration Program (EMP) for Windows Server,AWS,x,,,,,No SDK support
+events,events,eventbridge,eventbridge,,events,,eventbridge;cloudwatchevents,Events,EventBridge,,1,,aws_cloudwatch_event_,aws_events_,,cloudwatch_event_,EventBridge,Amazon,,,,,,
+schemas,schemas,schemas,schemas,,schemas,,,Schemas,Schemas,,1,,,aws_schemas_,,schemas_,EventBridge Schemas,Amazon,,,,,,
+fis,fis,fis,fis,,fis,,,FIS,FIS,,,2,,aws_fis_,,fis_,FIS (Fault Injection Simulator),AWS,,,,,,
+finspace,finspace,finspace,finspace,,finspace,,,FinSpace,Finspace,,,2,,aws_finspace_,,finspace_,FinSpace,Amazon,,,,,,
+finspace-data,finspacedata,finspacedata,finspacedata,,finspacedata,,,FinSpaceData,FinSpaceData,,1,,,aws_finspacedata_,,finspacedata_,FinSpace Data,Amazon,,x,,,,
+fms,fms,fms,fms,,fms,,,FMS,FMS,,1,,,aws_fms_,,fms_,FMS (Firewall Manager),AWS,,,,,,
+forecast,forecast,forecastservice,forecast,,forecast,,forecastservice,Forecast,ForecastService,,1,,,aws_forecast_,,forecast_,Forecast,Amazon,,x,,,,
+forecastquery,forecastquery,forecastqueryservice,forecastquery,,forecastquery,,forecastqueryservice,ForecastQuery,ForecastQueryService,,1,,,aws_forecastquery_,,forecastquery_,Forecast Query,Amazon,,x,,,,
+frauddetector,frauddetector,frauddetector,frauddetector,,frauddetector,,,FraudDetector,FraudDetector,,1,,,aws_frauddetector_,,frauddetector_,Fraud Detector,Amazon,,x,,,,
+,,,,,,,,,,,,,,,,,FreeRTOS,,x,,,,,No SDK support
+fsx,fsx,fsx,fsx,,fsx,,,FSx,FSx,,1,,,aws_fsx_,,fsx_,FSx,Amazon,,,,,,
+gamelift,gamelift,gamelift,gamelift,,gamelift,,,GameLift,GameLift,,1,,,aws_gamelift_,,gamelift_,GameLift,Amazon,,,,,,
+globalaccelerator,globalaccelerator,globalaccelerator,globalaccelerator,,globalaccelerator,,,GlobalAccelerator,GlobalAccelerator,x,1,,,aws_globalaccelerator_,,globalaccelerator_,Global Accelerator,AWS,,,,,,
+glue,glue,glue,glue,,glue,,,Glue,Glue,,1,,,aws_glue_,,glue_,Glue,AWS,,,,,,
+databrew,databrew,gluedatabrew,databrew,,databrew,,gluedatabrew,DataBrew,GlueDataBrew,,1,,,aws_databrew_,,databrew_,Glue DataBrew,AWS,,x,,,,
+groundstation,groundstation,groundstation,groundstation,,groundstation,,,GroundStation,GroundStation,,1,,,aws_groundstation_,,groundstation_,Ground Station,AWS,,x,,,,
+guardduty,guardduty,guardduty,guardduty,,guardduty,,,GuardDuty,GuardDuty,,1,,,aws_guardduty_,,guardduty_,GuardDuty,Amazon,,,,,,
+health,health,health,health,,health,,,Health,Health,,1,,,aws_health_,,health_,Health,AWS,,x,,,,
+healthlake,healthlake,healthlake,healthlake,,healthlake,,,HealthLake,HealthLake,,,2,,aws_healthlake_,,healthlake_,HealthLake,Amazon,,,,,,
+honeycode,honeycode,honeycode,honeycode,,honeycode,,,Honeycode,Honeycode,,1,,,aws_honeycode_,,honeycode_,Honeycode,Amazon,,x,,,,
+iam,iam,iam,iam,,iam,,,IAM,IAM,,1,,,aws_iam_,,iam_,IAM (Identity & Access Management),AWS,,,,AWS_IAM_ENDPOINT,TF_AWS_IAM_ENDPOINT,
+inspector,inspector,inspector,inspector,,inspector,,,Inspector,Inspector,,1,,,aws_inspector_,,inspector_,Inspector Classic,Amazon,,,,,,
+inspector2,inspector2,inspector2,inspector2,,inspector2,,inspectorv2,Inspector2,Inspector2,,,2,,aws_inspector2_,,inspector2_,Inspector,Amazon,,,,,,
+iot1click-devices,iot1clickdevices,iot1clickdevicesservice,iot1clickdevicesservice,,iot1clickdevices,,iot1clickdevicesservice,IoT1ClickDevices,IoT1ClickDevicesService,,1,,,aws_iot1clickdevices_,,iot1clickdevices_,IoT 1-Click Devices,AWS,,x,,,,
+iot1click-projects,iot1clickprojects,iot1clickprojects,iot1clickprojects,,iot1clickprojects,,,IoT1ClickProjects,IoT1ClickProjects,,1,,,aws_iot1clickprojects_,,iot1clickprojects_,IoT 1-Click Projects,AWS,,x,,,,
+iotanalytics,iotanalytics,iotanalytics,iotanalytics,,iotanalytics,,,IoTAnalytics,IoTAnalytics,,1,,,aws_iotanalytics_,,iotanalytics_,IoT Analytics,AWS,,,,,,
+iot,iot,iot,iot,,iot,,,IoT,IoT,,1,,,aws_iot_,,iot_,IoT Core,AWS,,,,,,
+iot-data,iotdata,iotdataplane,iotdataplane,,iotdata,,iotdataplane,IoTData,IoTDataPlane,,1,,,aws_iotdata_,,iotdata_,IoT Data Plane,AWS,,x,,,,
+,,,,,,,,,,,,,,,,,IoT Device Defender,AWS,x,,,,,Part of IoT
+iotdeviceadvisor,iotdeviceadvisor,iotdeviceadvisor,iotdeviceadvisor,,iotdeviceadvisor,,,IoTDeviceAdvisor,IoTDeviceAdvisor,,1,,,aws_iotdeviceadvisor_,,iotdeviceadvisor_,IoT Device Management,AWS,,x,,,,
+iotevents,iotevents,iotevents,iotevents,,iotevents,,,IoTEvents,IoTEvents,,1,,,aws_iotevents_,,iotevents_,IoT Events,AWS,,,,,,
+iotevents-data,ioteventsdata,ioteventsdata,ioteventsdata,,ioteventsdata,,,IoTEventsData,IoTEventsData,,1,,,aws_ioteventsdata_,,ioteventsdata_,IoT Events Data,AWS,,x,,,,
+,,,,,,,,,,,,,,,,,IoT ExpressLink,AWS,x,,,,,No SDK support
+iotfleethub,iotfleethub,iotfleethub,iotfleethub,,iotfleethub,,,IoTFleetHub,IoTFleetHub,,1,,,aws_iotfleethub_,,iotfleethub_,IoT Fleet Hub,AWS,,x,,,,
+,,,,,,,,,,,,,,,,,IoT FleetWise,AWS,x,,,,,No SDK support
+greengrass,greengrass,greengrass,greengrass,,greengrass,,,Greengrass,Greengrass,,1,,,aws_greengrass_,,greengrass_,IoT Greengrass,AWS,,,,,,
+greengrassv2,greengrassv2,greengrassv2,greengrassv2,,greengrassv2,,,GreengrassV2,GreengrassV2,,1,,,aws_greengrassv2_,,greengrassv2_,IoT Greengrass V2,AWS,,x,,,,
+iot-jobs-data,iotjobsdata,iotjobsdataplane,iotjobsdataplane,,iotjobsdata,,iotjobsdataplane,IoTJobsData,IoTJobsDataPlane,,1,,,aws_iotjobsdata_,,iotjobsdata_,IoT Jobs Data Plane,AWS,,x,,,,
+,,,,,,,,,,,,,,,,,IoT RoboRunner,AWS,x,,,,,No SDK support
+iotsecuretunneling,iotsecuretunneling,iotsecuretunneling,iotsecuretunneling,,iotsecuretunneling,,,IoTSecureTunneling,IoTSecureTunneling,,1,,,aws_iotsecuretunneling_,,iotsecuretunneling_,IoT Secure Tunneling,AWS,,x,,,,
+iotsitewise,iotsitewise,iotsitewise,iotsitewise,,iotsitewise,,,IoTSiteWise,IoTSiteWise,,1,,,aws_iotsitewise_,,iotsitewise_,IoT SiteWise,AWS,,x,,,,
+iotthingsgraph,iotthingsgraph,iotthingsgraph,iotthingsgraph,,iotthingsgraph,,,IoTThingsGraph,IoTThingsGraph,,1,,,aws_iotthingsgraph_,,iotthingsgraph_,IoT Things Graph,AWS,,x,,,,
+iottwinmaker,iottwinmaker,iottwinmaker,iottwinmaker,,iottwinmaker,,,IoTTwinMaker,IoTTwinMaker,,1,,,aws_iottwinmaker_,,iottwinmaker_,IoT TwinMaker,AWS,,x,,,,
+iotwireless,iotwireless,iotwireless,iotwireless,,iotwireless,,,IoTWireless,IoTWireless,,1,,,aws_iotwireless_,,iotwireless_,IoT Wireless,AWS,,x,,,,
+,,,,,,,,,,,,,,,,,IQ,AWS,x,,,,,No SDK support
+ivs,ivs,ivs,ivs,,ivs,,,IVS,IVS,,1,,,aws_ivs_,,ivs_,IVS (Interactive Video),Amazon,,,,,,
+ivschat,ivschat,ivschat,ivschat,,ivschat,,,IVSChat,Ivschat,,,2,,aws_ivschat_,,ivschat_,IVS (Interactive Video) Chat,Amazon,,,,,,
+kendra,kendra,kendra,kendra,,kendra,,,Kendra,Kendra,,,2,,aws_kendra_,,kendra_,Kendra,Amazon,,,,,,
+keyspaces,keyspaces,keyspaces,keyspaces,,keyspaces,,,Keyspaces,Keyspaces,,,2,,aws_keyspaces_,,keyspaces_,Keyspaces (for Apache Cassandra),Amazon,,,,,,
+kinesis,kinesis,kinesis,kinesis,,kinesis,,,Kinesis,Kinesis,,1,,aws_kinesis_stream,aws_kinesis_,,kinesis_stream,Kinesis,Amazon,,,,,,
+kinesisanalytics,kinesisanalytics,kinesisanalytics,kinesisanalytics,,kinesisanalytics,,,KinesisAnalytics,KinesisAnalytics,,1,,aws_kinesis_analytics_,aws_kinesisanalytics_,,kinesis_analytics_,Kinesis Analytics,Amazon,,,,,,
+kinesisanalyticsv2,kinesisanalyticsv2,kinesisanalyticsv2,kinesisanalyticsv2,,kinesisanalyticsv2,,,KinesisAnalyticsV2,KinesisAnalyticsV2,,1,,,aws_kinesisanalyticsv2_,,kinesisanalyticsv2_,Kinesis Analytics V2,Amazon,,,,,,
+firehose,firehose,firehose,firehose,,firehose,,,Firehose,Firehose,,1,,aws_kinesis_firehose_,aws_firehose_,,kinesis_firehose_,Kinesis Firehose,Amazon,,,,,,
+kinesisvideo,kinesisvideo,kinesisvideo,kinesisvideo,,kinesisvideo,,,KinesisVideo,KinesisVideo,,1,,,aws_kinesisvideo_,,kinesis_video_,Kinesis Video,Amazon,,,,,,
+kinesis-video-archived-media,kinesisvideoarchivedmedia,kinesisvideoarchivedmedia,kinesisvideoarchivedmedia,,kinesisvideoarchivedmedia,,,KinesisVideoArchivedMedia,KinesisVideoArchivedMedia,,1,,,aws_kinesisvideoarchivedmedia_,,kinesisvideoarchivedmedia_,Kinesis Video Archived Media,Amazon,,x,,,,
+kinesis-video-media,kinesisvideomedia,kinesisvideomedia,kinesisvideomedia,,kinesisvideomedia,,,KinesisVideoMedia,KinesisVideoMedia,,1,,,aws_kinesisvideomedia_,,kinesisvideomedia_,Kinesis Video Media,Amazon,,x,,,,
+kinesis-video-signaling,kinesisvideosignaling,kinesisvideosignalingchannels,kinesisvideosignaling,,kinesisvideosignaling,,kinesisvideosignalingchannels,KinesisVideoSignaling,KinesisVideoSignalingChannels,,1,,,aws_kinesisvideosignaling_,,kinesisvideosignaling_,Kinesis Video Signaling,Amazon,,x,,,,
+kms,kms,kms,kms,,kms,,,KMS,KMS,,1,,,aws_kms_,,kms_,KMS (Key Management),AWS,,,,,,
+lakeformation,lakeformation,lakeformation,lakeformation,,lakeformation,,,LakeFormation,LakeFormation,,1,,,aws_lakeformation_,,lakeformation_,Lake Formation,AWS,,,,,,
+lambda,lambda,lambda,lambda,,lambda,,,Lambda,Lambda,,1,2,,aws_lambda_,,lambda_,Lambda,AWS,,,,,,
+,,,,,,,,,,,,,,,,,Launch Wizard,AWS,x,,,,,No SDK support
+lex-models,lexmodels,lexmodelbuildingservice,lexmodelbuildingservice,,lexmodels,,lexmodelbuilding;lexmodelbuildingservice;lex,LexModels,LexModelBuildingService,,1,,aws_lex_,aws_lexmodels_,,lex_,Lex Model Building,Amazon,,,,,,
+lexv2-models,lexv2models,lexmodelsv2,lexmodelsv2,,lexv2models,,lexmodelsv2,LexV2Models,LexModelsV2,,,2,,aws_lexv2models_,,lexv2models_,Lex V2 Models,Amazon,,,,,,
+lex-runtime,lexruntime,lexruntimeservice,lexruntimeservice,,lexruntime,,lexruntimeservice,LexRuntime,LexRuntimeService,,1,,,aws_lexruntime_,,lexruntime_,Lex Runtime,Amazon,,x,,,,
+lexv2-runtime,lexv2runtime,lexruntimev2,lexruntimev2,,lexruntimev2,,lexv2runtime,LexRuntimeV2,LexRuntimeV2,,1,,,aws_lexruntimev2_,,lexruntimev2_,Lex Runtime V2,Amazon,,x,,,,
+license-manager,licensemanager,licensemanager,licensemanager,,licensemanager,,,LicenseManager,LicenseManager,,1,,,aws_licensemanager_,,licensemanager_,License Manager,AWS,,,,,,
+lightsail,lightsail,lightsail,lightsail,,lightsail,,,Lightsail,Lightsail,x,,2,,aws_lightsail_,,lightsail_,Lightsail,Amazon,,,,,,
+location,location,locationservice,location,,location,,locationservice,Location,LocationService,,1,,,aws_location_,,location_,Location,Amazon,,,,,,
+lookoutequipment,lookoutequipment,lookoutequipment,lookoutequipment,,lookoutequipment,,,LookoutEquipment,LookoutEquipment,,1,,,aws_lookoutequipment_,,lookoutequipment_,Lookout for Equipment,Amazon,,x,,,,
+lookoutmetrics,lookoutmetrics,lookoutmetrics,lookoutmetrics,,lookoutmetrics,,,LookoutMetrics,LookoutMetrics,,1,,,aws_lookoutmetrics_,,lookoutmetrics_,Lookout for Metrics,Amazon,,x,,,,
+lookoutvision,lookoutvision,lookoutforvision,lookoutvision,,lookoutvision,,lookoutforvision,LookoutVision,LookoutForVision,,1,,,aws_lookoutvision_,,lookoutvision_,Lookout for Vision,Amazon,,x,,,,
+,,,,,,,,,,,,,,,,,Lumberyard,Amazon,x,,,,,No SDK support
+machinelearning,machinelearning,machinelearning,machinelearning,,machinelearning,,,MachineLearning,MachineLearning,,1,,,aws_machinelearning_,,machinelearning_,Machine Learning,Amazon,,x,,,,
+macie2,macie2,macie2,macie2,,macie2,,,Macie2,Macie2,,1,,,aws_macie2_,,macie2_,Macie,Amazon,,,,,,
+macie,macie,macie,macie,,macie,,,Macie,Macie,,1,,,aws_macie_,,macie_,Macie Classic,Amazon,,x,,,,
+,,,,,,,,,,,,,,,,,Mainframe Modernization,AWS,x,,,,,No SDK support
+managedblockchain,managedblockchain,managedblockchain,managedblockchain,,managedblockchain,,,ManagedBlockchain,ManagedBlockchain,,1,,,aws_managedblockchain_,,managedblockchain_,Managed Blockchain,Amazon,,x,,,,
+grafana,grafana,managedgrafana,grafana,,grafana,,managedgrafana;amg,Grafana,ManagedGrafana,,1,,,aws_grafana_,,grafana_,Managed Grafana,Amazon,,,,,,
+kafka,kafka,kafka,kafka,,kafka,,msk,Kafka,Kafka,,1,2,aws_msk_,aws_kafka_,,msk_,Managed Streaming for Kafka,Amazon,,,,,,
+kafkaconnect,kafkaconnect,kafkaconnect,kafkaconnect,,kafkaconnect,,,KafkaConnect,KafkaConnect,,1,,aws_mskconnect_,aws_kafkaconnect_,,mskconnect_,Managed Streaming for Kafka Connect,Amazon,,,,,,
+,,,,,,,,,,,,,,,,,Management Console,AWS,x,,,,,No SDK support
+marketplace-catalog,marketplacecatalog,marketplacecatalog,marketplacecatalog,,marketplacecatalog,,,MarketplaceCatalog,MarketplaceCatalog,,1,,,aws_marketplacecatalog_,,marketplace_catalog_,Marketplace Catalog,AWS,,x,,,,
+marketplacecommerceanalytics,marketplacecommerceanalytics,marketplacecommerceanalytics,marketplacecommerceanalytics,,marketplacecommerceanalytics,,,MarketplaceCommerceAnalytics,MarketplaceCommerceAnalytics,,1,,,aws_marketplacecommerceanalytics_,,marketplacecommerceanalytics_,Marketplace Commerce Analytics,AWS,,x,,,,
+marketplace-entitlement,marketplaceentitlement,marketplaceentitlementservice,marketplaceentitlementservice,,marketplaceentitlement,,marketplaceentitlementservice,MarketplaceEntitlement,MarketplaceEntitlementService,,1,,,aws_marketplaceentitlement_,,marketplaceentitlement_,Marketplace Entitlement,AWS,,x,,,,
+meteringmarketplace,meteringmarketplace,marketplacemetering,marketplacemetering,,marketplacemetering,,meteringmarketplace,MarketplaceMetering,MarketplaceMetering,,1,,,aws_marketplacemetering_,,marketplacemetering_,Marketplace Metering,AWS,,x,,,,
+memorydb,memorydb,memorydb,memorydb,,memorydb,,,MemoryDB,MemoryDB,,1,,,aws_memorydb_,,memorydb_,MemoryDB for Redis,Amazon,,,,,,
+,,,,,meta,,,Meta,,,,,aws_(arn|billing_service_account|default_tags|ip_ranges|partition|regions?|service)$,aws_meta_,,arn;ip_ranges;billing_service_account;default_tags;partition;region;service\.,Meta Data Sources,,x,,x,,,Not an AWS service (metadata)
+mgh,mgh,migrationhub,migrationhub,,mgh,,migrationhub,MgH,MigrationHub,,1,,,aws_mgh_,,mgh_,MgH (Migration Hub),AWS,,x,,,,
+,,,,,,,,,,,,,,,,,Microservice Extractor for .NET,AWS,x,,,,,No SDK support
+migrationhub-config,migrationhubconfig,migrationhubconfig,migrationhubconfig,,migrationhubconfig,,,MigrationHubConfig,MigrationHubConfig,,1,,,aws_migrationhubconfig_,,migrationhubconfig_,Migration Hub Config,AWS,,x,,,,
+migration-hub-refactor-spaces,migrationhubrefactorspaces,migrationhubrefactorspaces,migrationhubrefactorspaces,,migrationhubrefactorspaces,,,MigrationHubRefactorSpaces,MigrationHubRefactorSpaces,,1,,,aws_migrationhubrefactorspaces_,,migrationhubrefactorspaces_,Migration Hub Refactor Spaces,AWS,,x,,,,
+migrationhubstrategy,migrationhubstrategy,migrationhubstrategyrecommendations,migrationhubstrategy,,migrationhubstrategy,,migrationhubstrategyrecommendations,MigrationHubStrategy,MigrationHubStrategyRecommendations,,1,,,aws_migrationhubstrategy_,,migrationhubstrategy_,Migration Hub Strategy,AWS,,x,,,,
+mobile,mobile,mobile,mobile,,mobile,,,Mobile,Mobile,,1,,,aws_mobile_,,mobile_,Mobile,AWS,,x,,,,
+,,mobileanalytics,,,,,,MobileAnalytics,MobileAnalytics,,,,,,,,Mobile Analytics,AWS,x,,,,,Only in Go SDK v1
+,,,,,,,,,,,,,,,,,Mobile SDK for Unity,AWS,x,,,,,No SDK support
+,,,,,,,,,,,,,,,,,Mobile SDK for Xamarin,AWS,x,,,,,No SDK support
+,,,,,,,,,,,,,,,,,Monitron,Amazon,x,,,,,No SDK support
+mq,mq,mq,mq,,mq,,,MQ,MQ,,1,,,aws_mq_,,mq_,MQ,Amazon,,,,,,
+mturk,mturk,mturk,mturk,,mturk,,,MTurk,MTurk,,1,,,aws_mturk_,,mturk_,MTurk (Mechanical Turk),Amazon,,x,,,,
+mwaa,mwaa,mwaa,mwaa,,mwaa,,,MWAA,MWAA,,1,,,aws_mwaa_,,mwaa_,MWAA (Managed Workflows for Apache Airflow),Amazon,,,,,,
+neptune,neptune,neptune,neptune,,neptune,,,Neptune,Neptune,,1,,,aws_neptune_,,neptune_,Neptune,Amazon,,,,,,
+network-firewall,networkfirewall,networkfirewall,networkfirewall,,networkfirewall,,,NetworkFirewall,NetworkFirewall,,1,,,aws_networkfirewall_,,networkfirewall_,Network Firewall,AWS,,,,,,
+networkmanager,networkmanager,networkmanager,networkmanager,,networkmanager,,,NetworkManager,NetworkManager,,1,,,aws_networkmanager_,,networkmanager_,Network Manager,AWS,,,,,,
+,,,,,,,,,,,,,,,,,NICE DCV,,x,,,,,No SDK support
+nimble,nimble,nimblestudio,nimble,,nimble,,nimblestudio,Nimble,NimbleStudio,,1,,,aws_nimble_,,nimble_,Nimble Studio,Amazon,,x,,,,
+oam,oam,oam,oam,,oam,,cloudwatchobservabilityaccessmanager,ObservabilityAccessManager,OAM,,,2,,aws_oam_,,oam_,CloudWatch Observability Access Manager,Amazon,,,,,,
+opensearch,opensearch,opensearchservice,opensearch,,opensearch,,opensearchservice,OpenSearch,OpenSearchService,,1,,,aws_opensearch_,,opensearch_,OpenSearch,Amazon,,,,,,
+opensearchserverless,opensearchserverless,opensearchserverless,opensearchserverless,,opensearchserverless,,,OpenSearchServerless,OpenSearchServerless,,,2,,aws_opensearchserverless_,,opensearchserverless_,OpenSearch Serverless,Amazon,,,,,,
+opsworks,opsworks,opsworks,opsworks,,opsworks,,,OpsWorks,OpsWorks,,1,,,aws_opsworks_,,opsworks_,OpsWorks,AWS,,,,,,
+opsworks-cm,opsworkscm,opsworkscm,opsworkscm,,opsworkscm,,,OpsWorksCM,OpsWorksCM,,1,,,aws_opsworkscm_,,opsworkscm_,OpsWorks CM,AWS,,x,,,,
+organizations,organizations,organizations,organizations,,organizations,,,Organizations,Organizations,,1,,,aws_organizations_,,organizations_,Organizations,AWS,,,,,,
+outposts,outposts,outposts,outposts,,outposts,,,Outposts,Outposts,,1,,,aws_outposts_,,outposts_,Outposts,AWS,,,,,,
+,,,,,ec2outposts,ec2,,EC2Outposts,,,,,aws_ec2_(coip_pool|local_gateway),aws_ec2outposts_,outposts_,ec2_coip_pool;ec2_local_gateway,Outposts (EC2),AWS,x,,x,,,Part of EC2
+panorama,panorama,panorama,panorama,,panorama,,,Panorama,Panorama,,1,,,aws_panorama_,,panorama_,Panorama,AWS,,x,,,,
+,,,,,,,,,,,,,,,,,ParallelCluster,AWS,x,,,,,No SDK support
+personalize,personalize,personalize,personalize,,personalize,,,Personalize,Personalize,,1,,,aws_personalize_,,personalize_,Personalize,Amazon,,x,,,,
+personalize-events,personalizeevents,personalizeevents,personalizeevents,,personalizeevents,,,PersonalizeEvents,PersonalizeEvents,,1,,,aws_personalizeevents_,,personalizeevents_,Personalize Events,Amazon,,x,,,,
+personalize-runtime,personalizeruntime,personalizeruntime,personalizeruntime,,personalizeruntime,,,PersonalizeRuntime,PersonalizeRuntime,,1,,,aws_personalizeruntime_,,personalizeruntime_,Personalize Runtime,Amazon,,x,,,,
+pinpoint,pinpoint,pinpoint,pinpoint,,pinpoint,,,Pinpoint,Pinpoint,,1,,,aws_pinpoint_,,pinpoint_,Pinpoint,Amazon,,,,,,
+pinpoint-email,pinpointemail,pinpointemail,pinpointemail,,pinpointemail,,,PinpointEmail,PinpointEmail,,1,,,aws_pinpointemail_,,pinpointemail_,Pinpoint Email,Amazon,,x,,,,
+pinpoint-sms-voice,pinpointsmsvoice,pinpointsmsvoice,pinpointsmsvoice,,pinpointsmsvoice,,,PinpointSMSVoice,PinpointSMSVoice,,1,,,aws_pinpointsmsvoice_,,pinpointsmsvoice_,Pinpoint SMS and Voice,Amazon,,x,,,,
+pipes,pipes,pipes,pipes,,pipes,,,Pipes,Pipes,,,2,,aws_pipes_,,pipes_,EventBridge Pipes,Amazon,,,,,,
+polly,polly,polly,polly,,polly,,,Polly,Polly,,1,,,aws_polly_,,polly_,Polly,Amazon,,x,,,,
+,,,,,,,,,,,,,,,,,Porting Assistant for .NET,,x,,,,,No SDK support
+pricing,pricing,pricing,pricing,,pricing,,,Pricing,Pricing,,,2,,aws_pricing_,,pricing_,Pricing Calculator,AWS,,,,,,
+proton,proton,proton,proton,,proton,,,Proton,Proton,,1,,,aws_proton_,,proton_,Proton,AWS,,x,,,,
+qldb,qldb,qldb,qldb,,qldb,,,QLDB,QLDB,,,2,,aws_qldb_,,qldb_,QLDB (Quantum Ledger Database),Amazon,,,,,,
+qldb-session,qldbsession,qldbsession,qldbsession,,qldbsession,,,QLDBSession,QLDBSession,,1,,,aws_qldbsession_,,qldbsession_,QLDB Session,Amazon,,x,,,,
+quicksight,quicksight,quicksight,quicksight,,quicksight,,,QuickSight,QuickSight,,1,,,aws_quicksight_,,quicksight_,QuickSight,Amazon,,,,,,
+ram,ram,ram,ram,,ram,,,RAM,RAM,,1,,,aws_ram_,,ram_,RAM (Resource Access Manager),AWS,,,,,,
+rds,rds,rds,rds,,rds,,,RDS,RDS,,1,2,aws_(db_|rds_),aws_rds_,,rds_;db_,RDS (Relational Database),Amazon,,,,,,
+rds-data,rdsdata,rdsdataservice,rdsdata,,rdsdata,,rdsdataservice,RDSData,RDSDataService,,1,,,aws_rdsdata_,,rdsdata_,RDS Data,Amazon,,x,,,,
+pi,pi,pi,pi,,pi,,,PI,PI,,1,,,aws_pi_,,pi_,RDS Performance Insights (PI),Amazon,,x,,,,
+rbin,rbin,recyclebin,rbin,,rbin,,recyclebin,RBin,RecycleBin,,,2,,aws_rbin_,,rbin_,Recycle Bin (RBin),Amazon,,,,,,
+,,,,,,,,,,,,,,,,,Red Hat OpenShift Service on AWS (ROSA),AWS,x,,,,,No SDK support
+redshift,redshift,redshift,redshift,,redshift,,,Redshift,Redshift,,1,,,aws_redshift_,,redshift_,Redshift,Amazon,,,,,,
+redshift-data,redshiftdata,redshiftdataapiservice,redshiftdata,,redshiftdata,,redshiftdataapiservice,RedshiftData,RedshiftDataAPIService,,,2,,aws_redshiftdata_,,redshiftdata_,Redshift Data,Amazon,,,,,,
+redshift-serverless,redshiftserverless,redshiftserverless,redshiftserverless,,redshiftserverless,,,RedshiftServerless,RedshiftServerless,,1,,,aws_redshiftserverless_,,redshiftserverless_,Redshift Serverless,Amazon,,,,,,
+rekognition,rekognition,rekognition,rekognition,,rekognition,,,Rekognition,Rekognition,,1,,,aws_rekognition_,,rekognition_,Rekognition,Amazon,,x,,,,
+resiliencehub,resiliencehub,resiliencehub,resiliencehub,,resiliencehub,,,ResilienceHub,ResilienceHub,,1,,,aws_resiliencehub_,,resiliencehub_,Resilience Hub,AWS,,x,,,,
+resource-explorer-2,resourceexplorer2,resourceexplorer2,resourceexplorer2,,resourceexplorer2,,,ResourceExplorer2,ResourceExplorer2,,,2,,aws_resourceexplorer2_,,resourceexplorer2_,Resource Explorer,AWS,,,,,,
+resource-groups,resourcegroups,resourcegroups,resourcegroups,,resourcegroups,,,ResourceGroups,ResourceGroups,,,2,,aws_resourcegroups_,,resourcegroups_,Resource Groups,AWS,,,,,,
+resourcegroupstaggingapi,resourcegroupstaggingapi,resourcegroupstaggingapi,resourcegroupstaggingapi,,resourcegroupstaggingapi,,resourcegroupstagging,ResourceGroupsTaggingAPI,ResourceGroupsTaggingAPI,,,2,,aws_resourcegroupstaggingapi_,,resourcegroupstaggingapi_,Resource Groups Tagging,AWS,,,,,,
+robomaker,robomaker,robomaker,robomaker,,robomaker,,,RoboMaker,RoboMaker,,1,,,aws_robomaker_,,robomaker_,RoboMaker,AWS,,x,,,,
+rolesanywhere,rolesanywhere,rolesanywhere,rolesanywhere,,rolesanywhere,,,RolesAnywhere,RolesAnywhere,,,2,,aws_rolesanywhere_,,rolesanywhere_,Roles Anywhere,AWS,,,,,,
+route53,route53,route53,route53,,route53,,,Route53,Route53,x,1,,aws_route53_(?!resolver_),aws_route53_,,route53_cidr_;route53_delegation_;route53_health_;route53_hosted_;route53_key_;route53_query_;route53_record;route53_traffic_;route53_vpc_;route53_zone,Route 53,Amazon,,,,,,
+route53domains,route53domains,route53domains,route53domains,,route53domains,,,Route53Domains,Route53Domains,x,,2,,aws_route53domains_,,route53domains_,Route 53 Domains,Amazon,,,,,,
+route53-recovery-cluster,route53recoverycluster,route53recoverycluster,route53recoverycluster,,route53recoverycluster,,,Route53RecoveryCluster,Route53RecoveryCluster,,1,,,aws_route53recoverycluster_,,route53recoverycluster_,Route 53 Recovery Cluster,Amazon,,x,,,,
+route53-recovery-control-config,route53recoverycontrolconfig,route53recoverycontrolconfig,route53recoverycontrolconfig,,route53recoverycontrolconfig,,,Route53RecoveryControlConfig,Route53RecoveryControlConfig,x,1,,,aws_route53recoverycontrolconfig_,,route53recoverycontrolconfig_,Route 53 Recovery Control Config,Amazon,,,,,,
+route53-recovery-readiness,route53recoveryreadiness,route53recoveryreadiness,route53recoveryreadiness,,route53recoveryreadiness,,,Route53RecoveryReadiness,Route53RecoveryReadiness,x,1,,,aws_route53recoveryreadiness_,,route53recoveryreadiness_,Route 53 Recovery Readiness,Amazon,,,,,,
+route53resolver,route53resolver,route53resolver,route53resolver,,route53resolver,,,Route53Resolver,Route53Resolver,,1,,aws_route53_resolver_,aws_route53resolver_,,route53_resolver_,Route 53 Resolver,Amazon,,,,,,
+s3api,s3api,s3,s3,,s3,,s3api,S3,S3,x,1,2,aws_(canonical_user_id|s3_bucket|s3_object),aws_s3_,,s3_bucket;s3_object;canonical_user_id,S3 (Simple Storage),Amazon,,,,AWS_S3_ENDPOINT,TF_AWS_S3_ENDPOINT,
+s3control,s3control,s3control,s3control,,s3control,,,S3Control,S3Control,,1,2,aws_(s3_account_|s3control_|s3_access_),aws_s3control_,,s3control;s3_account_;s3_access_,S3 Control,Amazon,,,,,,
+glacier,glacier,glacier,glacier,,glacier,,,Glacier,Glacier,,,2,,aws_glacier_,,glacier_,S3 Glacier,Amazon,,,,,,
+s3outposts,s3outposts,s3outposts,s3outposts,,s3outposts,,,S3Outposts,S3Outposts,,1,,,aws_s3outposts_,,s3outposts_,S3 on Outposts,Amazon,,,,,,
+sagemaker,sagemaker,sagemaker,sagemaker,,sagemaker,,,SageMaker,SageMaker,,1,,,aws_sagemaker_,,sagemaker_,SageMaker,Amazon,,,,,,
+sagemaker-a2i-runtime,sagemakera2iruntime,augmentedairuntime,sagemakera2iruntime,,sagemakera2iruntime,,augmentedairuntime,SageMakerA2IRuntime,AugmentedAIRuntime,,1,,,aws_sagemakera2iruntime_,,sagemakera2iruntime_,SageMaker A2I (Augmented AI),Amazon,,x,,,,
+sagemaker-edge,sagemakeredge,sagemakeredgemanager,sagemakeredge,,sagemakeredge,,sagemakeredgemanager,SageMakerEdge,SagemakerEdgeManager,,1,,,aws_sagemakeredge_,,sagemakeredge_,SageMaker Edge Manager,Amazon,,x,,,,
+sagemaker-featurestore-runtime,sagemakerfeaturestoreruntime,sagemakerfeaturestoreruntime,sagemakerfeaturestoreruntime,,sagemakerfeaturestoreruntime,,,SageMakerFeatureStoreRuntime,SageMakerFeatureStoreRuntime,,1,,,aws_sagemakerfeaturestoreruntime_,,sagemakerfeaturestoreruntime_,SageMaker Feature Store Runtime,Amazon,,x,,,,
+sagemaker-runtime,sagemakerruntime,sagemakerruntime,sagemakerruntime,,sagemakerruntime,,,SageMakerRuntime,SageMakerRuntime,,1,,,aws_sagemakerruntime_,,sagemakerruntime_,SageMaker Runtime,Amazon,,x,,,,
+,,,,,,,,,,,,,,,,,SAM (Serverless Application Model),AWS,x,,,,,No SDK support
+savingsplans,savingsplans,savingsplans,savingsplans,,savingsplans,,,SavingsPlans,SavingsPlans,,1,,,aws_savingsplans_,,savingsplans_,Savings Plans,AWS,,x,,,,
+,,,,,,,,,,,,,,,,,Schema Conversion Tool,AWS,x,,,,,No SDK support
+sdb,sdb,simpledb,,simpledb,sdb,,sdb,SimpleDB,SimpleDB,,1,,aws_simpledb_,aws_sdb_,,simpledb_,SDB (SimpleDB),Amazon,,,,,,
+scheduler,scheduler,scheduler,scheduler,,scheduler,,,Scheduler,Scheduler,,,2,,aws_scheduler_,,scheduler_,EventBridge Scheduler,Amazon,,,,,,
+secretsmanager,secretsmanager,secretsmanager,secretsmanager,,secretsmanager,,,SecretsManager,SecretsManager,,1,,,aws_secretsmanager_,,secretsmanager_,Secrets Manager,AWS,,,,,,
+securityhub,securityhub,securityhub,securityhub,,securityhub,,,SecurityHub,SecurityHub,,1,,,aws_securityhub_,,securityhub_,Security Hub,AWS,,,,,,
+securitylake,securitylake,securitylake,securitylake,,securitylake,,,SecurityLake,SecurityLake,,,2,,aws_securitylake_,,securitylake_,Security Lake,Amazon,,,,,,
+serverlessrepo,serverlessrepo,serverlessapplicationrepository,serverlessapplicationrepository,,serverlessrepo,,serverlessapprepo;serverlessapplicationrepository,ServerlessRepo,ServerlessApplicationRepository,,1,,aws_serverlessapplicationrepository_,aws_serverlessrepo_,,serverlessapplicationrepository_,Serverless Application Repository,AWS,,,,,,
+servicecatalog,servicecatalog,servicecatalog,servicecatalog,,servicecatalog,,,ServiceCatalog,ServiceCatalog,,1,,,aws_servicecatalog_,,servicecatalog_,Service Catalog,AWS,,,,,,
+servicecatalog-appregistry,servicecatalogappregistry,appregistry,servicecatalogappregistry,,servicecatalogappregistry,,appregistry,ServiceCatalogAppRegistry,AppRegistry,,1,,,aws_servicecatalogappregistry_,,servicecatalogappregistry_,Service Catalog AppRegistry,AWS,,x,,,,
+service-quotas,servicequotas,servicequotas,servicequotas,,servicequotas,,,ServiceQuotas,ServiceQuotas,,,2,,aws_servicequotas_,,servicequotas_,Service Quotas,,,,,,,
+ses,ses,ses,ses,,ses,,,SES,SES,,1,,,aws_ses_,,ses_,SES (Simple Email),Amazon,,,,,,
+sesv2,sesv2,sesv2,sesv2,,sesv2,,,SESV2,SESV2,,,2,,aws_sesv2_,,sesv2_,SESv2 (Simple Email V2),Amazon,,,,,,
+stepfunctions,stepfunctions,sfn,sfn,,sfn,,stepfunctions,SFN,SFN,,1,,,aws_sfn_,,sfn_,SFN (Step Functions),AWS,,,,,,
+shield,shield,shield,shield,,shield,,,Shield,Shield,x,1,,,aws_shield_,,shield_,Shield,AWS,,,,,,
+signer,signer,signer,signer,,signer,,,Signer,Signer,,,2,,aws_signer_,,signer_,Signer,AWS,,,,,,
+sms,sms,sms,sms,,sms,,,SMS,SMS,,1,,,aws_sms_,,sms_,SMS (Server Migration),AWS,,x,,,,
+snow-device-management,snowdevicemanagement,snowdevicemanagement,snowdevicemanagement,,snowdevicemanagement,,,SnowDeviceManagement,SnowDeviceManagement,,1,,,aws_snowdevicemanagement_,,snowdevicemanagement_,Snow Device Management,AWS,,x,,,,
+snowball,snowball,snowball,snowball,,snowball,,,Snowball,Snowball,,1,,,aws_snowball_,,snowball_,Snow Family,AWS,,x,,,,
+sns,sns,sns,sns,,sns,,,SNS,SNS,,1,,,aws_sns_,,sns_,SNS (Simple Notification),Amazon,,,,,,
+sqs,sqs,sqs,sqs,,sqs,,,SQS,SQS,,1,,,aws_sqs_,,sqs_,SQS (Simple Queue),Amazon,,,,,,
+ssm,ssm,ssm,ssm,,ssm,,,SSM,SSM,,1,2,,aws_ssm_,,ssm_,SSM (Systems Manager),AWS,,,,,,
+ssm-contacts,ssmcontacts,ssmcontacts,ssmcontacts,,ssmcontacts,,,SSMContacts,SSMContacts,,,2,,aws_ssmcontacts_,,ssmcontacts_,SSM Contacts,AWS,,,,,,
+ssm-incidents,ssmincidents,ssmincidents,ssmincidents,,ssmincidents,,,SSMIncidents,SSMIncidents,,,2,,aws_ssmincidents_,,ssmincidents_,SSM Incident Manager Incidents,AWS,,,,,,
+sso,sso,sso,sso,,sso,,,SSO,SSO,,1,,,aws_sso_,,sso_,SSO (Single Sign-On),AWS,,x,,,,
+sso-admin,ssoadmin,ssoadmin,ssoadmin,,ssoadmin,,,SSOAdmin,SSOAdmin,,1,,,aws_ssoadmin_,,ssoadmin_,SSO Admin,AWS,,,,,,
+identitystore,identitystore,identitystore,identitystore,,identitystore,,,IdentityStore,IdentityStore,,,2,,aws_identitystore_,,identitystore_,SSO Identity Store,AWS,,,,,,
+sso-oidc,ssooidc,ssooidc,ssooidc,,ssooidc,,,SSOOIDC,SSOOIDC,,1,,,aws_ssooidc_,,ssooidc_,SSO OIDC,AWS,,x,,,,
+storagegateway,storagegateway,storagegateway,storagegateway,,storagegateway,,,StorageGateway,StorageGateway,,1,,,aws_storagegateway_,,storagegateway_,Storage Gateway,AWS,,,,,,
+sts,sts,sts,sts,,sts,,,STS,STS,x,1,,aws_caller_identity,aws_sts_,,caller_identity,STS (Security Token),AWS,,,,AWS_STS_ENDPOINT,TF_AWS_STS_ENDPOINT,
+,,,,,,,,,,,,,,,,,Sumerian,Amazon,x,,,,,No SDK support
+support,support,support,support,,support,,,Support,Support,,1,,,aws_support_,,support_,Support,AWS,,x,,,,
+swf,swf,swf,swf,,swf,,,SWF,SWF,,,2,,aws_swf_,,swf_,SWF (Simple Workflow),Amazon,,,,,,
+,,,,,,,,,,,,,,,,,Tag Editor,AWS,x,,,,,Part of Resource Groups Tagging
+textract,textract,textract,textract,,textract,,,Textract,Textract,,1,,,aws_textract_,,textract_,Textract,Amazon,,x,,,,
+timestream-query,timestreamquery,timestreamquery,timestreamquery,,timestreamquery,,,TimestreamQuery,TimestreamQuery,,1,,,aws_timestreamquery_,,timestreamquery_,Timestream Query,Amazon,,x,,,,
+timestream-write,timestreamwrite,timestreamwrite,timestreamwrite,,timestreamwrite,,,TimestreamWrite,TimestreamWrite,,,2,,aws_timestreamwrite_,,timestreamwrite_,Timestream Write,Amazon,,,,,,
+,,,,,,,,,,,,,,,,,Tools for PowerShell,AWS,x,,,,,No SDK support
+,,,,,,,,,,,,,,,,,Training and Certification,AWS,x,,,,,No SDK support
+transcribe,transcribe,transcribeservice,transcribe,,transcribe,,transcribeservice,Transcribe,TranscribeService,,,2,,aws_transcribe_,,transcribe_,Transcribe,Amazon,,,,,,
+,,transcribestreamingservice,transcribestreaming,,transcribestreaming,,transcribestreamingservice,TranscribeStreaming,TranscribeStreamingService,,1,,,aws_transcribestreaming_,,transcribestreaming_,Transcribe Streaming,Amazon,,x,,,,
+transfer,transfer,transfer,transfer,,transfer,,,Transfer,Transfer,,1,,,aws_transfer_,,transfer_,Transfer Family,AWS,,,,,,
+,,,,,transitgateway,ec2,,TransitGateway,,,,,aws_ec2_transit_gateway,aws_transitgateway_,transitgateway_,ec2_transit_gateway,Transit Gateway,AWS,x,,x,,,Part of EC2
+translate,translate,translate,translate,,translate,,,Translate,Translate,,1,,,aws_translate_,,translate_,Translate,Amazon,,x,,,,
+,,,,,,,,,,,,,,,,,Trusted Advisor,AWS,x,,,,,Part of Support
+,,,,,verifiedaccess,ec2,,VerifiedAccess,,,,,aws_verifiedaccess,aws_verifiedaccess_,verifiedaccess_,verifiedaccess_,Verified Access,AWS,x,,x,,,Part of EC2
+,,,,,vpc,ec2,,VPC,,,,,aws_((default_)?(network_acl|route_table|security_group|subnet|vpc(?!_ipam))|ec2_(managed|network|subnet|traffic)|egress_only_internet|flow_log|internet_gateway|main_route_table_association|nat_gateway|network_interface|prefix_list|route\b),aws_vpc_,vpc_,default_network_;default_route_;default_security_;default_subnet;default_vpc;ec2_managed_;ec2_network_;ec2_subnet_;ec2_traffic_;egress_only_;flow_log;internet_gateway;main_route_;nat_;network_;prefix_list;route_;route\.;security_group;subnet;vpc_dhcp_;vpc_endpoint;vpc_ipv;vpc_network_performance;vpc_peering_;vpc_security_group_;vpc\.;vpcs\.,VPC (Virtual Private Cloud),Amazon,x,,x,,,Part of EC2
+vpc-lattice,vpclattice,vpclattice,vpclattice,,vpclattice,,,VPCLattice,VPCLattice,,,2,,aws_vpclattice_,,vpclattice_,VPC Lattice,Amazon,,,,,,
+,,,,,ipam,ec2,,IPAM,,,,,aws_vpc_ipam,aws_ipam_,ipam_,vpc_ipam,VPC IPAM (IP Address Manager),Amazon,x,,x,,,Part of EC2
+,,,,,vpnclient,ec2,,ClientVPN,,,,,aws_ec2_client_vpn,aws_vpnclient_,vpnclient_,ec2_client_vpn_,VPN (Client),AWS,x,,x,,,Part of EC2
+,,,,,vpnsite,ec2,,SiteVPN,,,,,aws_(customer_gateway|vpn_),aws_vpnsite_,vpnsite_,customer_gateway;vpn_,VPN (Site-to-Site),AWS,x,,x,,,Part of EC2
+wafv2,wafv2,wafv2,wafv2,,wafv2,,,WAFV2,WAFV2,,1,,,aws_wafv2_,,wafv2_,WAF,AWS,,,,,,
+waf,waf,waf,waf,,waf,,,WAF,WAF,,1,,,aws_waf_,,waf_,WAF Classic,AWS,,,,,,
+waf-regional,wafregional,wafregional,wafregional,,wafregional,,,WAFRegional,WAFRegional,,1,,,aws_wafregional_,,wafregional_,WAF Classic Regional,AWS,,,,,,
+,,,,,,,,,,,,,,,,,WAM (WorkSpaces Application Manager),Amazon,x,,,,,No SDK support
+,,,,,wavelength,ec2,,Wavelength,,,,,aws_ec2_carrier_gateway,aws_wavelength_,wavelength_,ec2_carrier_,Wavelength,AWS,x,,x,,,Part of EC2
+budgets,budgets,budgets,budgets,,budgets,,,Budgets,Budgets,,1,,,aws_budgets_,,budgets_,Web Services Budgets,Amazon,,,,,,
+wellarchitected,wellarchitected,wellarchitected,wellarchitected,,wellarchitected,,,WellArchitected,WellArchitected,,1,,,aws_wellarchitected_,,wellarchitected_,Well-Architected Tool,AWS,,x,,,,
+workdocs,workdocs,workdocs,workdocs,,workdocs,,,WorkDocs,WorkDocs,,1,,,aws_workdocs_,,workdocs_,WorkDocs,Amazon,,x,,,,
+worklink,worklink,worklink,worklink,,worklink,,,WorkLink,WorkLink,,1,,,aws_worklink_,,worklink_,WorkLink,Amazon,,,,,,
+workmail,workmail,workmail,workmail,,workmail,,,WorkMail,WorkMail,,1,,,aws_workmail_,,workmail_,WorkMail,Amazon,,x,,,,
+workmailmessageflow,workmailmessageflow,workmailmessageflow,workmailmessageflow,,workmailmessageflow,,,WorkMailMessageFlow,WorkMailMessageFlow,,1,,,aws_workmailmessageflow_,,workmailmessageflow_,WorkMail Message Flow,Amazon,,x,,,,
+workspaces,workspaces,workspaces,workspaces,,workspaces,,,WorkSpaces,WorkSpaces,,,2,,aws_workspaces_,,workspaces_,WorkSpaces,Amazon,,,,,,
+workspaces-web,workspacesweb,workspacesweb,workspacesweb,,workspacesweb,,,WorkSpacesWeb,WorkSpacesWeb,,1,,,aws_workspacesweb_,,workspacesweb_,WorkSpaces Web,Amazon,,x,,,,
+xray,xray,xray,xray,,xray,,,XRay,XRay,,,2,,aws_xray_,,xray_,X-Ray,AWS,,,,,,
+verifiedpermissions,verifiedpermissions,verifiedpermissions,verifiedpermissions,,verifiedpermissions,,,VerifiedPermissions,VerifiedPermissions,,,2,,aws_verifiedpermissions_,,verifiedpermissions_,Verified Permissions,Amazon,,,,,,
+codecatalyst,codecatalyst,codecatalyst,codecatalyst,,codecatalyst,,,CodeCatalyst,CodeCatalyst,,,2,,aws_codecatalyst_,,codecatalyst_,CodeCatalyst,Amazon,,,,,,
diff --git a/names/names_test.go b/names/names_test.go
index 637f9cd4f2b..b7f96f593fd 100644
--- a/names/names_test.go
+++ b/names/names_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package names
 
 import (
@@ -312,12 +315,6 @@ func TestFullHumanFriendly(t *testing.T) {
 			Expected: "Amazon CloudWatch Evidently",
 			Error:    false,
 		},
-		{
-			TestName: DRS,
-			Input:    DRS,
-			Expected: "AWS DRS (Elastic Disaster Recovery)",
-			Error:    false,
-		},
 		{
 			TestName: "doesnotexist",
 			Input:    "doesnotexist",
@@ -365,8 +362,8 @@ func TestAWSGoV1Package(t *testing.T) {
 		},
 		{
 			TestName: "same as AWS",
-			Input:    Translate,
-			Expected: Translate,
+			Input:    CloudTrail,
+			Expected: CloudTrail,
 			Error:    false,
 		},
 		{
diff --git a/skaff/cmd/datasource.go b/skaff/cmd/datasource.go
index 5a2efdf99a6..19b03a07fe9 100644
--- a/skaff/cmd/datasource.go
+++ b/skaff/cmd/datasource.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cmd
 
 import (
@@ -9,7 +12,7 @@ var datasourceCmd = &cobra.Command{
 	Use:   "datasource",
 	Short: "Create scaffolding for a data source",
 	RunE: func(cmd *cobra.Command, args []string) error {
-		return datasource.Create(name, snakeName, !clearComments, force, !v1, pluginFramework)
+		return datasource.Create(name, snakeName, !clearComments, force, !v1, !pluginSDKV2, includeTags)
 	},
 }
 
@@ -20,5 +23,6 @@ func init() {
 	datasourceCmd.Flags().StringVarP(&name, "name", "n", "", "name of the entity")
 	datasourceCmd.Flags().BoolVarP(&force, "force", "f", false, "force creation, overwriting existing files")
 	datasourceCmd.Flags().BoolVarP(&v1, "v1", "o", false, "generate for AWS Go SDK v1 (some existing services)")
-	datasourceCmd.Flags().BoolVarP(&pluginFramework, "plugin-framework", "p", false, "generate for Terraform Plugin-Framework")
+	datasourceCmd.Flags().BoolVarP(&pluginSDKV2, "plugin-sdkv2", "p", false, "generate for Terraform Plugin SDK V2")
+	datasourceCmd.Flags().BoolVarP(&includeTags, "include-tags", "t", false, "Indicate that this resource has tags and the code for tagging should be generated")
 }
diff --git a/skaff/cmd/resource.go b/skaff/cmd/resource.go
index e38094b399c..3d07a069267 100644
--- a/skaff/cmd/resource.go
+++ b/skaff/cmd/resource.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cmd
 
 import (
@@ -6,19 +9,20 @@ import (
 )
 
 var (
-	snakeName       string
-	clearComments   bool
-	name            string
-	force           bool
-	v1              bool
-	pluginFramework bool
+	snakeName     string
+	clearComments bool
+	name          string
+	force         bool
+	v1            bool
+	pluginSDKV2   bool
+	includeTags   bool
 )
 
 var resourceCmd = &cobra.Command{
 	Use:   "resource",
 	Short: "Create scaffolding for a resource",
 	RunE: func(cmd *cobra.Command, args []string) error {
-		return resource.Create(name, snakeName, !clearComments, force, !v1, pluginFramework)
+		return resource.Create(name, snakeName, !clearComments, force, !v1, !pluginSDKV2, includeTags)
 	},
 }
 
@@ -29,5 +33,6 @@ func init() {
 	resourceCmd.Flags().StringVarP(&name, "name", "n", "", "name of the entity")
 	resourceCmd.Flags().BoolVarP(&force, "force", "f", false, "force creation, overwriting existing files")
 	resourceCmd.Flags().BoolVarP(&v1, "v1", "o", false, "generate for AWS Go SDK v1 (some existing services)")
-	resourceCmd.Flags().BoolVarP(&pluginFramework, "plugin-framework", "p", false, "generate for Terraform Plugin-Framework")
+	resourceCmd.Flags().BoolVarP(&pluginSDKV2, "plugin-sdkv2", "p", false, "generate for Terraform Plugin SDK V2")
+	resourceCmd.Flags().BoolVarP(&includeTags, "include-tags", "t", false, "Indicate that this resource has tags and the code for tagging should be generated")
 }
diff --git a/skaff/cmd/root.go b/skaff/cmd/root.go
index b7082283d2e..34c3a9b6395 100644
--- a/skaff/cmd/root.go
+++ b/skaff/cmd/root.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package cmd
 
 import (
diff --git a/skaff/datasource/datasource.go b/skaff/datasource/datasource.go
index baaf3a97491..a3923999b9d 100644
--- a/skaff/datasource/datasource.go
+++ b/skaff/datasource/datasource.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package datasource
 
 import (
@@ -32,6 +35,7 @@ type TemplateData struct {
 	DataSourceLower      string
 	DataSourceSnake      string
 	IncludeComments      bool
+	IncludeTags          bool
 	HumanFriendlyService string
 	ServicePackage       string
 	Service              string
@@ -43,7 +47,7 @@ type TemplateData struct {
 	ProviderResourceName string
 }
 
-func Create(dsName, snakeName string, comments, force, v2, pluginFramework bool) error {
+func Create(dsName, snakeName string, comments, force, v2, pluginFramework, tags bool) error {
 	wd, err := os.Getwd() // os.Getenv("GOPACKAGE") not available since this is not run with go generate
 	if err != nil {
 		return fmt.Errorf("error reading working directory: %s", err)
@@ -86,6 +90,7 @@ func Create(dsName, snakeName string, comments, force, v2, pluginFramework bool)
 		DataSourceSnake:      snakeName,
 		HumanFriendlyService: hf,
 		IncludeComments:      comments,
+		IncludeTags:          tags,
 		ServicePackage:       servicePackage,
 		Service:              s,
 		ServiceLower:         strings.ToLower(s),
diff --git a/skaff/datasource/datasource.tmpl b/skaff/datasource/datasource.tmpl
index c3eb17c04ab..1e1e3c90298 100644
--- a/skaff/datasource/datasource.tmpl
+++ b/skaff/datasource/datasource.tmpl
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package {{ .ServicePackage }}
 
 {{- if .IncludeComments }}
@@ -60,7 +63,9 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/create"
 	"github.com/hashicorp/terraform-provider-aws/internal/flex"
+{{- if .IncludeTags }}
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
+{{- end }}
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -138,7 +143,9 @@ func DataSource{{ .DataSource }}() *schema.Resource {
 					},
 				},
 			},
+			{{- if .IncludeTags }}
 			"tags":         tftags.TagsSchemaComputed(), {{- if .IncludeComments }} // TIP: Many, but not all, data sources have `tags` attributes.{{- end }}
+			{{- end }}
 		},
 	}
 }
@@ -237,12 +244,14 @@ func dataSource{{ .DataSource }}Read(ctx context.Context, d *schema.ResourceData
 	// below. Many data sources do include tags so this a reminder to include them
 	// where possible.
 	{{- end }}
+	{{- if .IncludeTags }}
 	ignoreTagsConfig := meta.(*conns.AWSClient).IgnoreTagsConfig
 
 	//lintignore:AWSR002
 	if err := d.Set("tags", KeyValueTags(out.Tags).IgnoreAWS().IgnoreConfig(ignoreTagsConfig).Map()); err != nil {
 		return append(diags, create.DiagError(names.{{ .Service }}, create.ErrActionSetting, DSName{{ .DataSource }}, d.Id(), err)...)
 	}
+	{{- end }}
 	{{ if .IncludeComments }}
 	// TIP: -- 6. Return diags
 	{{- end }}
diff --git a/skaff/datasource/datasource_test.go b/skaff/datasource/datasource_test.go
index 0d7172bf8db..41a59b2efda 100644
--- a/skaff/datasource/datasource_test.go
+++ b/skaff/datasource/datasource_test.go
@@ -1 +1,4 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package datasource
diff --git a/skaff/datasource/datasourcefw.tmpl b/skaff/datasource/datasourcefw.tmpl
index 718a1e36862..69d9a4e31ed 100644
--- a/skaff/datasource/datasourcefw.tmpl
+++ b/skaff/datasource/datasourcefw.tmpl
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package {{ .ServicePackage }}
 
 {{- if .IncludeComments }}
@@ -48,9 +51,11 @@ import (
 	"github.com/hashicorp/terraform-plugin-framework/datasource/schema"
 	"github.com/hashicorp/terraform-plugin-framework/types"
 	"github.com/hashicorp/terraform-provider-aws/internal/create"
-	"github.com/hashicorp/terraform-provider-aws/internal/flex"
 	"github.com/hashicorp/terraform-provider-aws/internal/framework"
+	"github.com/hashicorp/terraform-provider-aws/internal/framework/flex"
+{{- if .IncludeTags }}
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
+{{- end }}
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
 {{ if .IncludeComments }}
@@ -118,7 +123,9 @@ func (d *dataSource{{ .DataSource }}) Schema(ctx context.Context, req datasource
 			"name": schema.StringAttribute{
 				Required: true,
 			},
-			names.AttrTags: tftags.TagsAttribute(),
+			{{- if .IncludeTags }}
+			names.AttrTags: tftags.TagsAttributeComputedOnly(),
+			{{- end }}
 			"type": schema.StringAttribute{
 				Computed: true,
 			},
@@ -212,9 +219,11 @@ func (d *dataSource{{ .DataSource }}) Read(ctx context.Context, req datasource.R
 	{{ if .IncludeComments }}
 	// TIP: -- 5. Set the tags
 	{{- end }}
+	{{- if .IncludeTags }}
 	ignoreTagsConfig := d.Meta().IgnoreTagsConfig
 	tags := KeyValueTags(ctx, out.Tags).IgnoreAWS().IgnoreConfig(ignoreTagsConfig)
 	data.Tags = flex.FlattenFrameworkStringValueMapLegacy(ctx, tags.Map())
+	{{- end }}
 	{{ if .IncludeComments }}
 	// TIP: -- 6. Set the state
 	{{- end }}
@@ -241,7 +250,9 @@ type dataSource{{ .DataSource }}Data struct {
 	Description     types.String   `tfsdk:"description"`
 	ID              types.String   `tfsdk:"id"`
 	Name            types.String   `tfsdk:"name"`
+	{{- if .IncludeTags }}
 	Tags            types.Map      `tfsdk:"tags"`
+	{{- end }}
 	Type            types.String   `tfsdk:"type"`
 }
 
diff --git a/skaff/datasource/datasourcetest.tmpl b/skaff/datasource/datasourcetest.tmpl
index 87db51f1df7..e834fcfd9d5 100644
--- a/skaff/datasource/datasourcetest.tmpl
+++ b/skaff/datasource/datasourcetest.tmpl
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package {{ .ServicePackage }}_test
 
 {{- if .IncludeComments }}
@@ -37,9 +40,10 @@ import (
 	// types.<Type Name>.
 {{- end }}
 	"fmt"
-	"regexp"
 	"strings"
 	"testing"
+
+	"github.com/YakDriver/regexache"
 {{ if .AWSGoSDKV2 }}
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/{{ .ServicePackage }}"
@@ -99,6 +103,8 @@ import (
 // intricate, they should be unit tested.
 {{- end }}
 func Test{{ .DataSource }}ExampleUnitTest(t *testing.T) {
+	t.Parallel()
+
 	testCases := []struct {
 		TestName string
 		Input    string
@@ -126,7 +132,9 @@ func Test{{ .DataSource }}ExampleUnitTest(t *testing.T) {
 	}
 
 	for _, testCase := range testCases {
+		testCase := testCase
 		t.Run(testCase.TestName, func(t *testing.T) {
+			t.Parallel()
 			got, err := tf{{ .ServicePackage }}.FunctionFromDataSource(testCase.Input)
 
 			if err != nil && !testCase.Error {
@@ -193,7 +201,7 @@ func TestAcc{{ .Service }}{{ .DataSource }}DataSource_basic(t *testing.T) {
 						"username":       "Test",
 						"password":       "TestTest1234",
 					}),
-					acctest.MatchResourceAttrRegionalARN(dataSourceName, "arn", "{{ .ServicePackage }}", regexp.MustCompile(`{{ .DataSourceLower }}:+.`)),
+					acctest.MatchResourceAttrRegionalARN(dataSourceName, "arn", "{{ .ServicePackage }}", regexache.MustCompile(`{{ .DataSourceLower }}:+.`)),
 				),
 			},
 		},
diff --git a/skaff/datasource/websitedoc.tmpl b/skaff/datasource/websitedoc.tmpl
index bbb3d88c851..5e72e4c89ad 100644
--- a/skaff/datasource/websitedoc.tmpl
+++ b/skaff/datasource/websitedoc.tmpl
@@ -40,9 +40,12 @@ The following arguments are optional:
 
 * `optional_arg` - (Optional) Concise argument description. Do not begin the description with "An", "The", "Defines", "Indicates", or "Specifies," as these are verbose. In other words, "Indicates the amount of storage," can be rewritten as "Amount of storage," without losing any information.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the {{ .HumanDataSourceName }}. Do not begin the description with "An", "The", "Defines", "Indicates", or "Specifies," as these are verbose. In other words, "Indicates the amount of storage," can be rewritten as "Amount of storage," without losing any information.
 * `example_attribute` - Concise description. Do not begin the description with "An", "The", "Defines", "Indicates", or "Specifies," as these are verbose. In other words, "Indicates the amount of storage," can be rewritten as "Amount of storage," without losing any information.
+{{- if .IncludeTags }}
+* `tags` - Mapping of Key-Value tags for the resource.
+{{- end }}
\ No newline at end of file
diff --git a/skaff/go.mod b/skaff/go.mod
index 84b82c0c3c1..f049310a246 100644
--- a/skaff/go.mod
+++ b/skaff/go.mod
@@ -1,13 +1,15 @@
 module github.com/hashicorp/terraform-provider-aws/skaff
 
-go 1.19
+go 1.20
 
 require (
+	github.com/YakDriver/regexache v0.23.0
 	github.com/hashicorp/terraform-provider-aws v1.60.1-0.20220322001452-8f7a597d0c24
 	github.com/spf13/cobra v1.7.0
 )
 
 require (
+	github.com/google/uuid v1.3.1 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/spf13/pflag v1.0.5 // indirect
 )
diff --git a/skaff/go.sum b/skaff/go.sum
index f3366a91aa3..e5538bc59d3 100644
--- a/skaff/go.sum
+++ b/skaff/go.sum
@@ -1,4 +1,8 @@
+github.com/YakDriver/regexache v0.23.0 h1:kv3j4XKhbx/vqUilSBgizXDUXHvvH1KdYekdmGwz4C4=
+github.com/YakDriver/regexache v0.23.0/go.mod h1:K4BZ3MYKAqSFbYWqmbsG+OzYUDyJjnMEr27DJEsVG3U=
 github.com/cpuguy83/go-md2man/v2 v2.0.2/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
+github.com/google/uuid v1.3.1 h1:KjJaJ9iWZ3jOFZIf1Lqf4laDRCasjl0BCmnEGxkdLb4=
+github.com/google/uuid v1.3.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
diff --git a/skaff/main.go b/skaff/main.go
index eaefc257384..68a0e29bd38 100644
--- a/skaff/main.go
+++ b/skaff/main.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package main
 
 import "github.com/hashicorp/terraform-provider-aws/skaff/cmd"
diff --git a/skaff/resource/resource.go b/skaff/resource/resource.go
index 5df8b712db8..18b6c07e6ec 100644
--- a/skaff/resource/resource.go
+++ b/skaff/resource/resource.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package resource
 
 import (
@@ -8,10 +11,10 @@ import (
 	"io/fs"
 	"os"
 	"path/filepath"
-	"regexp"
 	"strings"
 	"text/template"
 
+	"github.com/YakDriver/regexache"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
 
@@ -33,6 +36,7 @@ type TemplateData struct {
 	ResourceSnake        string
 	HumanFriendlyService string
 	IncludeComments      bool
+	IncludeTags          bool
 	ServicePackage       string
 	Service              string
 	ServiceLower         string
@@ -48,18 +52,18 @@ func ToSnakeCase(upper string, snakeName string) string {
 		return snakeName
 	}
 
-	re := regexp.MustCompile(`([a-z])([A-Z]{2,})`)
+	re := regexache.MustCompile(`([a-z])([A-Z]{2,})`)
 	upper = re.ReplaceAllString(upper, `${1}_${2}`)
 
-	re2 := regexp.MustCompile(`([A-Z][a-z])`)
+	re2 := regexache.MustCompile(`([A-Z][a-z])`)
 	return strings.TrimPrefix(strings.ToLower(re2.ReplaceAllString(upper, `_$1`)), "_")
 }
 
 func HumanResName(upper string) string {
-	re := regexp.MustCompile(`([a-z])([A-Z]{2,})`)
+	re := regexache.MustCompile(`([a-z])([A-Z]{2,})`)
 	upper = re.ReplaceAllString(upper, `${1} ${2}`)
 
-	re2 := regexp.MustCompile(`([A-Z][a-z])`)
+	re2 := regexache.MustCompile(`([A-Z][a-z])`)
 	return strings.TrimPrefix(re2.ReplaceAllString(upper, ` $1`), " ")
 }
 
@@ -67,7 +71,7 @@ func ProviderResourceName(servicePackage, snakeName string) string {
 	return fmt.Sprintf("aws_%s_%s", servicePackage, snakeName)
 }
 
-func Create(resName, snakeName string, comments, force, v2, pluginFramework bool) error {
+func Create(resName, snakeName string, comments, force, v2, pluginFramework, tags bool) error {
 	wd, err := os.Getwd() // os.Getenv("GOPACKAGE") not available since this is not run with go generate
 	if err != nil {
 		return fmt.Errorf("error reading working directory: %s", err)
@@ -110,6 +114,7 @@ func Create(resName, snakeName string, comments, force, v2, pluginFramework bool
 		ResourceSnake:        snakeName,
 		HumanFriendlyService: hf,
 		IncludeComments:      comments,
+		IncludeTags:          tags,
 		ServicePackage:       servicePackage,
 		Service:              s,
 		ServiceLower:         strings.ToLower(s),
diff --git a/skaff/resource/resource.tmpl b/skaff/resource/resource.tmpl
index d0ba353acce..fe5f33e8433 100644
--- a/skaff/resource/resource.tmpl
+++ b/skaff/resource/resource.tmpl
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package {{ .ServicePackage }}
 
 {{- if .IncludeComments }}
@@ -62,7 +65,9 @@ import (
 	"github.com/hashicorp/terraform-provider-aws/internal/create"
 	"github.com/hashicorp/terraform-provider-aws/internal/errs"
 	"github.com/hashicorp/terraform-provider-aws/internal/flex"
+{{- if .IncludeTags }}
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
+{{- end }}
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
 	"github.com/hashicorp/terraform-provider-aws/names"
@@ -81,9 +86,11 @@ import (
 
 // Function annotations are used for resource registration to the Provider. DO NOT EDIT.
 // @SDKResource("{{ .ProviderResourceName }}", name="{{ .HumanResourceName }}")
+{{- if .IncludeTags }}
 // Tagging annotations are used for "transparent tagging".
 // Change the "identifierAttribute" value to the name of the attribute used in ListTags and UpdateTags calls (e.g. "arn").
 // @Tags(identifierAttribute="id")
+{{- end }}
 func Resource{{ .Resource }}() *schema.Resource {
 	return &schema.Resource{
 		{{- if .IncludeComments }}
@@ -190,11 +197,14 @@ func Resource{{ .Resource }}() *schema.Resource {
 					},
 				},
 			},
+			{{- if .IncludeTags }}
 			names.AttrTags:    tftags.TagsSchema(), {{- if .IncludeComments }} // TIP: Many, but not all, resources have `tags` and `tags_all` attributes.{{- end }}
 			names.AttrTagsAll: tftags.TagsSchemaComputed(),
+			{{- end }}
 		},
-
+		{{- if .IncludeTags }}
 		CustomizeDiff: verify.SetTagsDiff,
+		{{- end }}
 	}
 }
 
@@ -239,7 +249,9 @@ func resource{{ .Resource }}Create(ctx context.Context, d *schema.ResourceData,
 		// below. Many resources do include tags so this a reminder to include them
 		// where possible.
 		{{- end }}
+		{{- if .IncludeTags }}
 		Tags: getTagsIn(ctx),
+		{{- end }}
 	}
 
 	if v, ok := d.GetOk("max_size"); ok {
diff --git a/skaff/resource/resource_test.go b/skaff/resource/resource_test.go
index 6f8b9fce615..7fc60594929 100644
--- a/skaff/resource/resource_test.go
+++ b/skaff/resource/resource_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package resource
 
 import (
diff --git a/skaff/resource/resourcefw.tmpl b/skaff/resource/resourcefw.tmpl
index 5dac8bf2eac..178193e0441 100644
--- a/skaff/resource/resourcefw.tmpl
+++ b/skaff/resource/resourcefw.tmpl
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package {{ .ServicePackage }}
 
 {{- if .IncludeComments }}
@@ -60,9 +63,11 @@ import (
 	"github.com/hashicorp/terraform-plugin-framework/types"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-provider-aws/internal/create"
-	"github.com/hashicorp/terraform-provider-aws/internal/flex"
 	"github.com/hashicorp/terraform-provider-aws/internal/framework"
+	"github.com/hashicorp/terraform-provider-aws/internal/framework/flex"
+{{- if .IncludeTags }}
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
+{{- end }}
 	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/names"
 )
@@ -80,7 +85,9 @@ import (
 
 // Function annotations are used for resource registration to the Provider. DO NOT EDIT.
 // @FrameworkResource(name="{{ .HumanResourceName }}")
+{{- if .IncludeTags }}
 // @Tags(identifierAttribute="arn")
+{{- end }}
 func newResource{{ .Resource }}(_ context.Context) (resource.ResourceWithConfigure, error) {
 	r := &resource{{ .Resource }}{}
 	{{ if .IncludeComments }}
@@ -177,8 +184,10 @@ func (r *resource{{ .Resource }}) Schema(ctx context.Context, req resource.Schem
 					stringplanmodifier.RequiresReplace(),
 				},
 			},
+			{{- if .IncludeTags }}
 			names.AttrTags:    tftags.TagsAttribute(),
 			names.AttrTagsAll: tftags.TagsAttributeComputedOnly(),
+			{{- end }}
 			"type": schema.StringAttribute{
 				Required: true,
 			},
@@ -261,6 +270,9 @@ func (r *resource{{ .Resource }}) Create(ctx context.Context, req resource.Creat
 		{{- end }}
 		{{ .Resource }}Name: aws.String(plan.Name.ValueString()),
 		{{ .Resource }}Type: aws.String(plan.Type.ValueString()),
+		{{- if .IncludeTags }}
+		Tags:             getTagsIn(ctx),
+		{{- end }}
 	}
 
 	if !plan.Description.IsNull() {
@@ -621,6 +633,13 @@ func (r *resource{{ .Resource }}) Delete(ctx context.Context, req resource.Delet
 func (r *resource{{ .Resource }}) ImportState(ctx context.Context, req resource.ImportStateRequest, resp *resource.ImportStateResponse) {
 	resource.ImportStatePassthroughID(ctx, path.Root("id"), req, resp)
 }
+
+{{- if .IncludeTags }}
+func (r *resource{{ .Resource }}) ModifyPlan(ctx context.Context, request resource.ModifyPlanRequest, response *resource.ModifyPlanResponse) {
+	r.SetTagsAll(ctx, request, response)
+}
+{{- end }}
+
 {{ if .IncludeComments }}
 // TIP: ==== STATUS CONSTANTS ====
 // Create constants for states and statuses if the service does not
@@ -954,8 +973,10 @@ type resource{{ .Resource }}Data struct {
 	Description     types.String   `tfsdk:"description"`
 	ID              types.String   `tfsdk:"id"`
 	Name            types.String   `tfsdk:"name"`
+	{{- if .IncludeTags }}
 	Tags            types.Map      `tfsdk:"tags"`
 	TagsAll         types.Map      `tfsdk:"tags_all"`
+	{{- end }}
 	Timeouts        timeouts.Value `tfsdk:"timeouts"`
 	Type            types.String   `tfsdk:"type"`
 }
diff --git a/skaff/resource/resourcetest.tmpl b/skaff/resource/resourcetest.tmpl
index c593091740d..0eeae9484b3 100644
--- a/skaff/resource/resourcetest.tmpl
+++ b/skaff/resource/resourcetest.tmpl
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package {{ .ServicePackage }}_test
 
 {{- if .IncludeComments }}
@@ -37,10 +40,11 @@ import (
 	// types.<Type Name>.
 {{- end }}
 	"context"
+	"errors"
 	"fmt"
-	"regexp"
-	"strings"
 	"testing"
+
+	"github.com/YakDriver/regexache"
 {{ if .AWSGoSDKV2 }}
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/{{ .ServicePackage }}"
@@ -98,6 +102,8 @@ import (
 // intricate, they should be unit tested.
 {{- end }}
 func Test{{ .Resource }}ExampleUnitTest(t *testing.T) {
+	t.Parallel()
+
 	testCases := []struct {
 		TestName string
 		Input    string
@@ -125,7 +131,9 @@ func Test{{ .Resource }}ExampleUnitTest(t *testing.T) {
 	}
 
 	for _, testCase := range testCases {
+		testCase := testCase
 		t.Run(testCase.TestName, func(t *testing.T) {
+			t.Parallel()
 			got, err := tf{{ .ServicePackage }}.FunctionFromResource(testCase.Input)
 
 			if err != nil && !testCase.Error {
@@ -195,7 +203,7 @@ func TestAcc{{ .Service }}{{ .Resource }}_basic(t *testing.T) {
 						"username":       "Test",
 						"password":       "TestTest1234",
 					}),
-					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "{{ .ServicePackage }}", regexp.MustCompile(`{{ .ResourceLower }}:+.`)),
+					acctest.MatchResourceAttrRegionalARN(resourceName, "arn", "{{ .ServicePackage }}", regexache.MustCompile(`{{ .ResourceLower }}:+.`)),
 				),
 			},
 			{
@@ -292,7 +300,7 @@ func testAccCheck{{ .Resource }}Destroy(ctx context.Context) resource.TestCheckF
 			}
 			{{ end -}}
 			if err != nil {
-				return nil
+			        return create.Error(names.{{ .Service }}, create.ErrActionCheckingDestroyed, tf{{ .ServicePackage }}.ResName{{ .Resource }}, rs.Primary.ID, err)
 			}
 
 			return create.Error(names.{{ .Service }}, create.ErrActionCheckingDestroyed, tf{{ .ServicePackage }}.ResName{{ .Resource }}, rs.Primary.ID, errors.New("not destroyed"))
diff --git a/skaff/resource/websitedoc.tmpl b/skaff/resource/websitedoc.tmpl
index e4121155fc3..44269d7cd09 100644
--- a/skaff/resource/websitedoc.tmpl
+++ b/skaff/resource/websitedoc.tmpl
@@ -38,13 +38,19 @@ The following arguments are required:
 The following arguments are optional:
 
 * `optional_arg` - (Optional) Concise argument description. Do not begin the description with "An", "The", "Defines", "Indicates", or "Specifies," as these are verbose. In other words, "Indicates the amount of storage," can be rewritten as "Amount of storage," without losing any information.
+{{- if .IncludeTags }}
+* `tags` - (Optional) A map of tags assigned to the WorkSpaces Connection Alias. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+{{- end }}
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the {{ .HumanResourceName }}. Do not begin the description with "An", "The", "Defines", "Indicates", or "Specifies," as these are verbose. In other words, "Indicates the amount of storage," can be rewritten as "Amount of storage," without losing any information.
 * `example_attribute` - Concise description. Do not begin the description with "An", "The", "Defines", "Indicates", or "Specifies," as these are verbose. In other words, "Indicates the amount of storage," can be rewritten as "Amount of storage," without losing any information.
+{{- if .IncludeTags }}
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+{{- end }}
 
 ## Timeouts
 
@@ -56,8 +62,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-{{ .HumanFriendlyService }} {{ .HumanResourceName }} can be imported using the `example_id_arg`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import {{ .HumanFriendlyService }} {{ .HumanResourceName }} using the `example_id_arg`. For example:
 
+```terraform
+import {
+  to = aws_{{ .ServicePackage }}_{{ .ResourceSnake }}.example
+  id = "{{ .ResourceSnake }}-id-12345678"
+}
 ```
-$ terraform import aws_{{ .ServicePackage }}_{{ .ResourceSnake }}.example rft-8012925589
+
+Using `terraform import`, import {{ .HumanFriendlyService }} {{ .HumanResourceName }} using the `example_id_arg`. For example:
+
+```console
+% terraform import aws_{{ .ServicePackage }}_{{ .ResourceSnake }}.example {{ .ResourceSnake }}-id-12345678
 ```
diff --git a/tools/tfsdk2fw/go.mod b/tools/tfsdk2fw/go.mod
index a3396c67343..8525e8d8884 100644
--- a/tools/tfsdk2fw/go.mod
+++ b/tools/tfsdk2fw/go.mod
@@ -1,89 +1,119 @@
 module github.com/hashicorp/terraform-provider-aws/tools/tfsdk2fw
 
-go 1.19
+go 1.20
 
 require (
-	github.com/hashicorp/terraform-plugin-sdk/v2 v2.26.1
+	github.com/hashicorp/terraform-plugin-sdk/v2 v2.29.0
 	github.com/hashicorp/terraform-provider-aws v1.60.1-0.20220322001452-8f7a597d0c24
-	golang.org/x/exp v0.0.0-20230206171751-46f607a40771
+	golang.org/x/exp v0.0.0-20231006140011-7918f672742d
 )
 
 require (
 	github.com/Masterminds/goutils v1.1.1 // indirect
-	github.com/Masterminds/semver/v3 v3.1.1 // indirect
-	github.com/Masterminds/sprig/v3 v3.2.1 // indirect
-	github.com/ProtonMail/go-crypto v0.0.0-20230201104953-d1d05f4e2bfb // indirect
+	github.com/Masterminds/semver/v3 v3.2.1 // indirect
+	github.com/Masterminds/sprig/v3 v3.2.3 // indirect
+	github.com/ProtonMail/go-crypto v0.0.0-20230717121422-5aa5874ade95 // indirect
+	github.com/YakDriver/regexache v0.23.0 // indirect
 	github.com/agext/levenshtein v1.2.3 // indirect
-	github.com/apparentlymart/go-textseg/v13 v13.0.0 // indirect
-	github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310 // indirect
-	github.com/aws/aws-sdk-go v1.44.280 // indirect
-	github.com/aws/aws-sdk-go-v2 v1.18.0 // indirect
-	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.4.10 // indirect
-	github.com/aws/aws-sdk-go-v2/config v1.18.25 // indirect
-	github.com/aws/aws-sdk-go-v2/credentials v1.13.24 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.13.3 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.33 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.27 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/ini v1.3.34 // indirect
-	github.com/aws/aws-sdk-go-v2/service/accessanalyzer v1.19.12 // indirect
-	github.com/aws/aws-sdk-go-v2/service/account v1.10.6 // indirect
-	github.com/aws/aws-sdk-go-v2/service/acm v1.17.11 // indirect
-	github.com/aws/aws-sdk-go-v2/service/auditmanager v1.24.7 // indirect
-	github.com/aws/aws-sdk-go-v2/service/cleanrooms v1.1.4 // indirect
-	github.com/aws/aws-sdk-go-v2/service/cloudcontrol v1.11.12 // indirect
-	github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.21.0 // indirect
-	github.com/aws/aws-sdk-go-v2/service/comprehend v1.24.2 // indirect
-	github.com/aws/aws-sdk-go-v2/service/computeoptimizer v1.24.0 // indirect
-	github.com/aws/aws-sdk-go-v2/service/directoryservice v1.17.1 // indirect
-	github.com/aws/aws-sdk-go-v2/service/docdbelastic v1.1.10 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ec2 v1.99.0 // indirect
-	github.com/aws/aws-sdk-go-v2/service/finspace v1.10.0 // indirect
-	github.com/aws/aws-sdk-go-v2/service/fis v1.14.10 // indirect
-	github.com/aws/aws-sdk-go-v2/service/glacier v1.14.11 // indirect
-	github.com/aws/aws-sdk-go-v2/service/healthlake v1.16.0 // indirect
-	github.com/aws/aws-sdk-go-v2/service/iam v1.20.0 // indirect
-	github.com/aws/aws-sdk-go-v2/service/identitystore v1.16.11 // indirect
-	github.com/aws/aws-sdk-go-v2/service/inspector2 v1.14.0 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.27 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.14.2 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ivschat v1.4.5 // indirect
-	github.com/aws/aws-sdk-go-v2/service/kendra v1.40.2 // indirect
-	github.com/aws/aws-sdk-go-v2/service/lambda v1.35.0 // indirect
-	github.com/aws/aws-sdk-go-v2/service/lightsail v1.26.6 // indirect
-	github.com/aws/aws-sdk-go-v2/service/medialive v1.31.4 // indirect
-	github.com/aws/aws-sdk-go-v2/service/oam v1.1.11 // indirect
-	github.com/aws/aws-sdk-go-v2/service/opensearchserverless v1.2.4 // indirect
-	github.com/aws/aws-sdk-go-v2/service/pipes v1.2.6 // indirect
-	github.com/aws/aws-sdk-go-v2/service/rbin v1.8.12 // indirect
-	github.com/aws/aws-sdk-go-v2/service/rds v1.45.0 // indirect
-	github.com/aws/aws-sdk-go-v2/service/resourceexplorer2 v1.2.13 // indirect
-	github.com/aws/aws-sdk-go-v2/service/rolesanywhere v1.2.0 // indirect
-	github.com/aws/aws-sdk-go-v2/service/route53domains v1.14.10 // indirect
-	github.com/aws/aws-sdk-go-v2/service/s3control v1.31.5 // indirect
-	github.com/aws/aws-sdk-go-v2/service/scheduler v1.1.11 // indirect
-	github.com/aws/aws-sdk-go-v2/service/securitylake v1.4.1 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sesv2 v1.18.0 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ssm v1.36.4 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ssmcontacts v1.15.4 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ssmincidents v1.21.4 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sso v1.12.10 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.14.10 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sts v1.19.0 // indirect
-	github.com/aws/aws-sdk-go-v2/service/swf v1.15.0 // indirect
-	github.com/aws/aws-sdk-go-v2/service/transcribe v1.26.6 // indirect
-	github.com/aws/aws-sdk-go-v2/service/vpclattice v1.0.5 // indirect
-	github.com/aws/aws-sdk-go-v2/service/xray v1.16.11 // indirect
-	github.com/aws/smithy-go v1.13.5 // indirect
+	github.com/apparentlymart/go-textseg/v15 v15.0.0 // indirect
+	github.com/armon/go-radix v1.0.0 // indirect
+	github.com/aws/aws-sdk-go v1.45.24 // indirect
+	github.com/aws/aws-sdk-go-v2 v1.21.1 // indirect
+	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.4.14 // indirect
+	github.com/aws/aws-sdk-go-v2/config v1.18.44 // indirect
+	github.com/aws/aws-sdk-go-v2/credentials v1.13.42 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.13.12 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.11.89 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.42 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.36 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/ini v1.3.44 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/v4a v1.1.5 // indirect
+	github.com/aws/aws-sdk-go-v2/service/accessanalyzer v1.21.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/account v1.11.6 // indirect
+	github.com/aws/aws-sdk-go-v2/service/acm v1.19.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/appconfig v1.21.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/auditmanager v1.26.6 // indirect
+	github.com/aws/aws-sdk-go-v2/service/cleanrooms v1.4.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/cloudcontrol v1.12.6 // indirect
+	github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.24.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/codecatalyst v1.5.6 // indirect
+	github.com/aws/aws-sdk-go-v2/service/codestarconnections v1.15.7 // indirect
+	github.com/aws/aws-sdk-go-v2/service/codestarnotifications v1.16.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/comprehend v1.25.6 // indirect
+	github.com/aws/aws-sdk-go-v2/service/computeoptimizer v1.27.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/directoryservice v1.18.6 // indirect
+	github.com/aws/aws-sdk-go-v2/service/docdbelastic v1.3.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/dynamodb v1.22.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ec2 v1.124.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/emrserverless v1.11.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/finspace v1.12.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/fis v1.16.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/glacier v1.16.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/healthlake v1.17.6 // indirect
+	github.com/aws/aws-sdk-go-v2/service/iam v1.22.6 // indirect
+	github.com/aws/aws-sdk-go-v2/service/identitystore v1.18.3 // indirect
+	github.com/aws/aws-sdk-go-v2/service/inspector2 v1.16.8 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.9.15 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.1.37 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/endpoint-discovery v1.7.36 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.36 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.15.5 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internetmonitor v1.6.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ivschat v1.6.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/kafka v1.22.7 // indirect
+	github.com/aws/aws-sdk-go-v2/service/kendra v1.43.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/keyspaces v1.4.6 // indirect
+	github.com/aws/aws-sdk-go-v2/service/lambda v1.39.6 // indirect
+	github.com/aws/aws-sdk-go-v2/service/lexmodelsv2 v1.32.6 // indirect
+	github.com/aws/aws-sdk-go-v2/service/lightsail v1.28.6 // indirect
+	github.com/aws/aws-sdk-go-v2/service/mediaconnect v1.20.6 // indirect
+	github.com/aws/aws-sdk-go-v2/service/medialive v1.37.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/mediapackage v1.23.4 // indirect
+	github.com/aws/aws-sdk-go-v2/service/oam v1.4.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/opensearchserverless v1.5.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/pipes v1.4.2 // indirect
+	github.com/aws/aws-sdk-go-v2/service/pricing v1.21.8 // indirect
+	github.com/aws/aws-sdk-go-v2/service/qldb v1.16.6 // indirect
+	github.com/aws/aws-sdk-go-v2/service/rbin v1.10.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/rds v1.55.2 // indirect
+	github.com/aws/aws-sdk-go-v2/service/redshiftdata v1.20.6 // indirect
+	github.com/aws/aws-sdk-go-v2/service/resourceexplorer2 v1.4.2 // indirect
+	github.com/aws/aws-sdk-go-v2/service/rolesanywhere v1.3.7 // indirect
+	github.com/aws/aws-sdk-go-v2/service/route53domains v1.17.4 // indirect
+	github.com/aws/aws-sdk-go-v2/service/s3 v1.40.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/s3control v1.33.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/scheduler v1.3.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/securitylake v1.7.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/servicequotas v1.16.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sesv2 v1.20.2 // indirect
+	github.com/aws/aws-sdk-go-v2/service/signer v1.16.6 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sqs v1.24.6 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssm v1.38.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssmcontacts v1.17.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssmincidents v1.23.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.15.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.17.2 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.23.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/swf v1.17.4 // indirect
+	github.com/aws/aws-sdk-go-v2/service/timestreamwrite v1.19.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/transcribe v1.28.6 // indirect
+	github.com/aws/aws-sdk-go-v2/service/verifiedpermissions v1.2.2 // indirect
+	github.com/aws/aws-sdk-go-v2/service/vpclattice v1.2.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/workspaces v1.31.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/xray v1.18.1 // indirect
+	github.com/aws/smithy-go v1.15.0 // indirect
 	github.com/beevik/etree v1.2.0 // indirect
 	github.com/bgentry/speakeasy v0.1.0 // indirect
 	github.com/cloudflare/circl v1.3.3 // indirect
-	github.com/fatih/color v1.14.1 // indirect
-	github.com/golang/protobuf v1.5.2 // indirect
-	github.com/google/go-cmp v0.5.9 // indirect
-	github.com/google/uuid v1.3.0 // indirect
-	github.com/hashicorp/aws-cloudformation-resource-schema-sdk-go v0.20.0 // indirect
-	github.com/hashicorp/aws-sdk-go-base/v2 v2.0.0-beta.29 // indirect
-	github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2 v2.0.0-beta.30 // indirect
+	github.com/fatih/color v1.15.0 // indirect
+	github.com/go-logr/logr v1.2.4 // indirect
+	github.com/go-logr/stdr v1.2.2 // indirect
+	github.com/golang/protobuf v1.5.3 // indirect
+	github.com/google/go-cmp v0.6.0 // indirect
+	github.com/google/uuid v1.3.1 // indirect
+	github.com/hashicorp/aws-cloudformation-resource-schema-sdk-go v0.21.0 // indirect
+	github.com/hashicorp/aws-sdk-go-base/v2 v2.0.0-beta.37 // indirect
+	github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2 v2.0.0-beta.38 // indirect
 	github.com/hashicorp/awspolicyequivalence v1.6.0 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-checkpoint v0.5.0 // indirect
@@ -91,30 +121,30 @@ require (
 	github.com/hashicorp/go-cty v1.4.1-0.20200414143053-d3edf31b6320 // indirect
 	github.com/hashicorp/go-hclog v1.5.0 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
-	github.com/hashicorp/go-plugin v1.4.9 // indirect
+	github.com/hashicorp/go-plugin v1.5.1 // indirect
 	github.com/hashicorp/go-uuid v1.0.3 // indirect
 	github.com/hashicorp/go-version v1.6.0 // indirect
-	github.com/hashicorp/hc-install v0.5.0 // indirect
-	github.com/hashicorp/hcl/v2 v2.16.2 // indirect
+	github.com/hashicorp/hc-install v0.6.0 // indirect
+	github.com/hashicorp/hcl/v2 v2.18.0 // indirect
 	github.com/hashicorp/logutils v1.0.0 // indirect
-	github.com/hashicorp/terraform-exec v0.18.1 // indirect
-	github.com/hashicorp/terraform-json v0.16.0 // indirect
-	github.com/hashicorp/terraform-plugin-framework v1.3.0 // indirect
-	github.com/hashicorp/terraform-plugin-framework-timeouts v0.3.1 // indirect
-	github.com/hashicorp/terraform-plugin-framework-validators v0.10.0 // indirect
-	github.com/hashicorp/terraform-plugin-go v0.15.0 // indirect
+	github.com/hashicorp/terraform-exec v0.19.0 // indirect
+	github.com/hashicorp/terraform-json v0.17.1 // indirect
+	github.com/hashicorp/terraform-plugin-framework v1.4.1 // indirect
+	github.com/hashicorp/terraform-plugin-framework-timeouts v0.4.1 // indirect
+	github.com/hashicorp/terraform-plugin-framework-validators v0.12.0 // indirect
+	github.com/hashicorp/terraform-plugin-go v0.19.0 // indirect
 	github.com/hashicorp/terraform-plugin-log v0.9.0 // indirect
-	github.com/hashicorp/terraform-plugin-mux v0.10.0 // indirect
-	github.com/hashicorp/terraform-plugin-testing v1.2.0 // indirect
-	github.com/hashicorp/terraform-registry-address v0.2.0 // indirect
-	github.com/hashicorp/terraform-svchost v0.1.0 // indirect
+	github.com/hashicorp/terraform-plugin-mux v0.12.0 // indirect
+	github.com/hashicorp/terraform-plugin-testing v1.5.1 // indirect
+	github.com/hashicorp/terraform-registry-address v0.2.2 // indirect
+	github.com/hashicorp/terraform-svchost v0.1.1 // indirect
 	github.com/hashicorp/yamux v0.1.1 // indirect
-	github.com/huandu/xstrings v1.3.2 // indirect
-	github.com/imdario/mergo v0.3.12 // indirect
+	github.com/huandu/xstrings v1.4.0 // indirect
+	github.com/imdario/mergo v0.3.15 // indirect
 	github.com/jmespath/go-jmespath v0.4.0 // indirect
-	github.com/mattbaird/jsonpatch v0.0.0-20200820163806-098863c1fc24 // indirect
+	github.com/mattbaird/jsonpatch v0.0.0-20230413205102-771768614e91 // indirect
 	github.com/mattn/go-colorable v0.1.13 // indirect
-	github.com/mattn/go-isatty v0.0.17 // indirect
+	github.com/mattn/go-isatty v0.0.19 // indirect
 	github.com/mitchellh/cli v1.1.5 // indirect
 	github.com/mitchellh/copystructure v1.2.0 // indirect
 	github.com/mitchellh/go-homedir v1.1.0 // indirect
@@ -123,27 +153,29 @@ require (
 	github.com/mitchellh/mapstructure v1.5.0 // indirect
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
 	github.com/oklog/run v1.1.0 // indirect
-	github.com/posener/complete v1.1.1 // indirect
+	github.com/posener/complete v1.2.3 // indirect
 	github.com/shopspring/decimal v1.3.1 // indirect
-	github.com/spf13/cast v1.3.1 // indirect
+	github.com/spf13/cast v1.5.1 // indirect
 	github.com/vmihailenco/msgpack v4.0.4+incompatible // indirect
 	github.com/vmihailenco/msgpack/v5 v5.3.5 // indirect
 	github.com/vmihailenco/tagparser/v2 v2.0.0 // indirect
 	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
 	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
 	github.com/xeipuuv/gojsonschema v1.2.0 // indirect
-	github.com/zclconf/go-cty v1.13.1 // indirect
-	go.opentelemetry.io/otel v1.15.1 // indirect
-	go.opentelemetry.io/otel/trace v1.15.1 // indirect
-	golang.org/x/crypto v0.9.0 // indirect
-	golang.org/x/mod v0.8.0 // indirect
-	golang.org/x/net v0.10.0 // indirect
-	golang.org/x/sys v0.8.0 // indirect
-	golang.org/x/text v0.9.0 // indirect
+	github.com/zclconf/go-cty v1.14.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/github.com/aws/aws-sdk-go-v2/otelaws v0.45.0 // indirect
+	go.opentelemetry.io/otel v1.19.0 // indirect
+	go.opentelemetry.io/otel/metric v1.19.0 // indirect
+	go.opentelemetry.io/otel/trace v1.19.0 // indirect
+	golang.org/x/crypto v0.14.0 // indirect
+	golang.org/x/mod v0.13.0 // indirect
+	golang.org/x/net v0.17.0 // indirect
+	golang.org/x/sys v0.13.0 // indirect
+	golang.org/x/text v0.13.0 // indirect
 	google.golang.org/appengine v1.6.7 // indirect
-	google.golang.org/genproto v0.0.0-20230202175211-008b39050e57 // indirect
-	google.golang.org/grpc v1.54.0 // indirect
-	google.golang.org/protobuf v1.30.0 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20230807174057-1744710a1577 // indirect
+	google.golang.org/grpc v1.57.0 // indirect
+	google.golang.org/protobuf v1.31.0 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 )
 
diff --git a/tools/tfsdk2fw/go.sum b/tools/tfsdk2fw/go.sum
index 11390782738..5bc16fdadb2 100644
--- a/tools/tfsdk2fw/go.sum
+++ b/tools/tfsdk2fw/go.sum
@@ -1,194 +1,246 @@
+dario.cat/mergo v1.0.0 h1:AGCNq9Evsj31mOgNPcLyXc+4PNABt905YmuqPYYpBWk=
 github.com/Masterminds/goutils v1.1.1 h1:5nUrii3FMTL5diU80unEVvNevw1nH4+ZV4DSLVJLSYI=
 github.com/Masterminds/goutils v1.1.1/go.mod h1:8cTjp+g8YejhMuvIA5y2vz3BpJxksy863GQaJW2MFNU=
-github.com/Masterminds/semver/v3 v3.1.1 h1:hLg3sBzpNErnxhQtUy/mmLR2I9foDujNK030IGemrRc=
 github.com/Masterminds/semver/v3 v3.1.1/go.mod h1:VPu/7SZ7ePZ3QOrcuXROw5FAcLl4a0cBrbBpGY/8hQs=
-github.com/Masterminds/sprig/v3 v3.2.1 h1:n6EPaDyLSvCEa3frruQvAiHuNp2dhBlMSmkEr+HuzGc=
+github.com/Masterminds/semver/v3 v3.2.0/go.mod h1:qvl/7zhW3nngYb5+80sSMF+FG2BjYrf8m9wsX0PNOMQ=
+github.com/Masterminds/semver/v3 v3.2.1 h1:RN9w6+7QoMeJVGyfmbcgs28Br8cvmnucEXnY0rYXWg0=
+github.com/Masterminds/semver/v3 v3.2.1/go.mod h1:qvl/7zhW3nngYb5+80sSMF+FG2BjYrf8m9wsX0PNOMQ=
 github.com/Masterminds/sprig/v3 v3.2.1/go.mod h1:UoaO7Yp8KlPnJIYWTFkMaqPUYKTfGFPhxNuwnnxkKlk=
-github.com/Microsoft/go-winio v0.4.14/go.mod h1:qXqCSQ3Xa7+6tgxaGTIe4Kpcdsi+P8jBhyzoq1bpyYA=
-github.com/Microsoft/go-winio v0.4.16 h1:FtSW/jqD+l4ba5iPBj9CODVtgfYAD8w2wS923g/cFDk=
-github.com/Microsoft/go-winio v0.4.16/go.mod h1:XB6nPKklQyQ7GC9LdcBEcBl8PF76WugXOPRXwdLnMv0=
-github.com/ProtonMail/go-crypto v0.0.0-20210428141323-04723f9f07d7/go.mod h1:z4/9nQmJSSwwds7ejkxaJwO37dru3geImFUdJlaLzQo=
-github.com/ProtonMail/go-crypto v0.0.0-20230201104953-d1d05f4e2bfb h1:Vx1Bw/nGULx+FuY7Sw+8ZDpOx9XOdA+mOfo678SqkbU=
-github.com/ProtonMail/go-crypto v0.0.0-20230201104953-d1d05f4e2bfb/go.mod h1:I0gYDMZ6Z5GRU7l58bNFSkPTFN6Yl12dsUlAZ8xy98g=
-github.com/acomagu/bufpipe v1.0.3 h1:fxAGrHZTgQ9w5QqVItgzwj235/uYZYgbXitB+dLupOk=
-github.com/acomagu/bufpipe v1.0.3/go.mod h1:mxdxdup/WdsKVreO5GpW4+M/1CE2sMG4jeGJ2sYmHc4=
+github.com/Masterminds/sprig/v3 v3.2.3 h1:eL2fZNezLomi0uOLqjQoN6BfsDD+fyLtgbJMAj9n6YA=
+github.com/Masterminds/sprig/v3 v3.2.3/go.mod h1:rXcFaZ2zZbLRJv/xSysmlgIM1u11eBaRMhvYXJNkGuM=
+github.com/Microsoft/go-winio v0.6.1 h1:9/kr64B9VUZrLm5YYwbGtUJnMgqWVOdUAXu6Migciow=
+github.com/ProtonMail/go-crypto v0.0.0-20230717121422-5aa5874ade95 h1:KLq8BE0KwCL+mmXnjLWEAOYO+2l2AE4YMmqG1ZpZHBs=
+github.com/ProtonMail/go-crypto v0.0.0-20230717121422-5aa5874ade95/go.mod h1:EjAoLdwvbIOoOQr3ihjnSoLZRtE8azugULFRteWMNc0=
+github.com/YakDriver/regexache v0.23.0 h1:kv3j4XKhbx/vqUilSBgizXDUXHvvH1KdYekdmGwz4C4=
+github.com/YakDriver/regexache v0.23.0/go.mod h1:K4BZ3MYKAqSFbYWqmbsG+OzYUDyJjnMEr27DJEsVG3U=
+github.com/acomagu/bufpipe v1.0.4 h1:e3H4WUzM3npvo5uv95QuJM3cQspFNtFBzvJ2oNjKIDQ=
 github.com/agext/levenshtein v1.2.3 h1:YB2fHEn0UJagG8T1rrWknE3ZQzWM06O8AMAatNn7lmo=
 github.com/agext/levenshtein v1.2.3/go.mod h1:JEDfjyjHDjOF/1e4FlBE/PkbqA9OfWu2ki2W0IB5558=
-github.com/anmitsu/go-shlex v0.0.0-20161002113705-648efa622239/go.mod h1:2FmKhYUyUczH0OGQWaF5ceTx0UBShxjsH6f8oGKYe2c=
 github.com/apparentlymart/go-textseg/v12 v12.0.0/go.mod h1:S/4uRK2UtaQttw1GenVJEynmyUenKwP++x/+DdGV/Ec=
-github.com/apparentlymart/go-textseg/v13 v13.0.0 h1:Y+KvPE1NYz0xl601PVImeQfFyEy6iT90AvPUL1NNfNw=
-github.com/apparentlymart/go-textseg/v13 v13.0.0/go.mod h1:ZK2fH7c4NqDTLtiYLvIkEghdlcqw7yxLeM89kiTRPUo=
-github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310 h1:BUAU3CGlLvorLI26FmByPp2eC2qla6E1Tw+scpcg/to=
+github.com/apparentlymart/go-textseg/v15 v15.0.0 h1:uYvfpb3DyLSCGWnctWKGj857c6ew1u1fNQOlOtuGxQY=
+github.com/apparentlymart/go-textseg/v15 v15.0.0/go.mod h1:K8XmNZdhEBkdlyDdvbmmsvpAG721bKi0joRfFdHIWJ4=
 github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
-github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs=
-github.com/aws/aws-sdk-go v1.44.280 h1:UYl/yxhDxP8naok6ftWyQ9/9ZzNwjC9dvEs/j8BkGhw=
-github.com/aws/aws-sdk-go v1.44.280/go.mod h1:aVsgQcEevwlmQ7qHE9I3h+dtQgpqhFB+i8Phjh7fkwI=
-github.com/aws/aws-sdk-go-v2 v1.18.0 h1:882kkTpSFhdgYRKVZ/VCgf7sd0ru57p2JCxz4/oN5RY=
-github.com/aws/aws-sdk-go-v2 v1.18.0/go.mod h1:uzbQtefpm44goOPmdKyAlXSNcwlRgF3ePWVW6EtJvvw=
-github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.4.10 h1:dK82zF6kkPeCo8J1e+tGx4JdvDIQzj7ygIoLg8WMuGs=
-github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.4.10/go.mod h1:VeTZetY5KRJLuD/7fkQXMU6Mw7H5m/KP2J5Iy9osMno=
-github.com/aws/aws-sdk-go-v2/config v1.18.25 h1:JuYyZcnMPBiFqn87L2cRppo+rNwgah6YwD3VuyvaW6Q=
-github.com/aws/aws-sdk-go-v2/config v1.18.25/go.mod h1:dZnYpD5wTW/dQF0rRNLVypB396zWCcPiBIvdvSWHEg4=
-github.com/aws/aws-sdk-go-v2/credentials v1.13.24 h1:PjiYyls3QdCrzqUN35jMWtUK1vqVZ+zLfdOa/UPFDp0=
-github.com/aws/aws-sdk-go-v2/credentials v1.13.24/go.mod h1:jYPYi99wUOPIFi0rhiOvXeSEReVOzBqFNOX5bXYoG2o=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.13.3 h1:jJPgroehGvjrde3XufFIJUZVK5A2L9a3KwSFgKy9n8w=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.13.3/go.mod h1:4Q0UFP0YJf0NrsEuEYHpM9fTSEVnD16Z3uyEF7J9JGM=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.33 h1:kG5eQilShqmJbv11XL1VpyDbaEJzWxd4zRiCG30GSn4=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.33/go.mod h1:7i0PF1ME/2eUPFcjkVIwq+DOygHEoK92t5cDqNgYbIw=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.27 h1:vFQlirhuM8lLlpI7imKOMsjdQLuN9CPi+k44F/OFVsk=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.27/go.mod h1:UrHnn3QV/d0pBZ6QBAEQcqFLf8FAzLmoUfPVIueOvoM=
-github.com/aws/aws-sdk-go-v2/internal/ini v1.3.34 h1:gGLG7yKaXG02/jBlg210R7VgQIotiQntNhsCFejawx8=
-github.com/aws/aws-sdk-go-v2/internal/ini v1.3.34/go.mod h1:Etz2dj6UHYuw+Xw830KfzCfWGMzqvUTCjUj5b76GVDc=
-github.com/aws/aws-sdk-go-v2/service/accessanalyzer v1.19.12 h1:4jgaIiXEPwMogu89ah7MGeYZA8niMwH3KxymzSpAIkw=
-github.com/aws/aws-sdk-go-v2/service/accessanalyzer v1.19.12/go.mod h1:05NIzmwCjR1k1Hhx3RPSkKFRdO9AyHuEJCEgTZG8Ta4=
-github.com/aws/aws-sdk-go-v2/service/account v1.10.6 h1:u1B79rnwVrbXUvPXHz42GYq29/U/5TV/H6Fb5Ie4leM=
-github.com/aws/aws-sdk-go-v2/service/account v1.10.6/go.mod h1:sxLUXrqYXCfOBPBBk0azv+UOoFsnrQ9G1ZcICrb9O+0=
-github.com/aws/aws-sdk-go-v2/service/acm v1.17.11 h1:n/iAVMTf0VN8m0APSXKlTIFnpumXCrZNUiiVHb74z+w=
-github.com/aws/aws-sdk-go-v2/service/acm v1.17.11/go.mod h1:DPf8lxAWIM/y21N36FGUUoG7KH5dzW20sk/l1yGsLt8=
-github.com/aws/aws-sdk-go-v2/service/auditmanager v1.24.7 h1:QKbTGDu2xnH4YVN9soA2V4PJqbbv7lp5rXgSgw1u/nc=
-github.com/aws/aws-sdk-go-v2/service/auditmanager v1.24.7/go.mod h1:HtY67X+mN8oq2UMidOuIcXn+XWFyGYnpTvEoNGQBxc0=
-github.com/aws/aws-sdk-go-v2/service/cleanrooms v1.1.4 h1:rUKIsoew72A/gZkBrSApQSjvksEKLRWkUE7jlK7YkpE=
-github.com/aws/aws-sdk-go-v2/service/cleanrooms v1.1.4/go.mod h1:B+j10S5V7q7VfEAMYAfCTHYJg2e6AVG/wDYkTo6nE4s=
-github.com/aws/aws-sdk-go-v2/service/cloudcontrol v1.11.12 h1:59THEz/itGCgkCb5WQ8Gd+aVMCLP+Pk5moNOtTgtirA=
-github.com/aws/aws-sdk-go-v2/service/cloudcontrol v1.11.12/go.mod h1:/hg0Z2APD1zFe758rOTwIuIQEe7ohaodrhY906f4ISs=
-github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.21.0 h1:XSDT81zGBjXjREGWkMXX5p6nBd5/wQGZ/OuxTriJ2sE=
-github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.21.0/go.mod h1:5k59EsYR4orIPOQrGAKtQjIsM4Yw9qfxMeSs6+/UVN0=
-github.com/aws/aws-sdk-go-v2/service/comprehend v1.24.2 h1:l2X9ym1JpVOhqr6lKFQ3Bf/94f8KnTCJz99nBob9J9g=
-github.com/aws/aws-sdk-go-v2/service/comprehend v1.24.2/go.mod h1:YDZOE9XpbohvywpWpxDCPIEWlpALTsR+o6Ny6UgHXeE=
-github.com/aws/aws-sdk-go-v2/service/computeoptimizer v1.24.0 h1:r7auFMhvMUJO8V51ID3MwD/hqLUv0V2x2ea2nUYFTLA=
-github.com/aws/aws-sdk-go-v2/service/computeoptimizer v1.24.0/go.mod h1:5kTfX+bDwent5HUSiSwMtYSDw57gZ7hkQSv+x2jJmtg=
-github.com/aws/aws-sdk-go-v2/service/directoryservice v1.17.1 h1:aBrA5bDK3ou4JqoHUCp01FaBPLgHQalQr1w0mTBQXyk=
-github.com/aws/aws-sdk-go-v2/service/directoryservice v1.17.1/go.mod h1:tjEH79gyftglvYJMPGSachjqhthFaVYjco94mJ5ANcY=
-github.com/aws/aws-sdk-go-v2/service/docdbelastic v1.1.10 h1:b9yLKuY9L43WOJOHAj6OApgNTgze8D4akNbFhCnXUQQ=
-github.com/aws/aws-sdk-go-v2/service/docdbelastic v1.1.10/go.mod h1:PjV/8ElvXTf1jbcjaGvUphvb8Sz4/lTP87GFhQrZGbk=
-github.com/aws/aws-sdk-go-v2/service/ec2 v1.99.0 h1:NXi4pNJWjAaiI56P1Rl8DC9A4jMNRE00WNBsDua5WRg=
-github.com/aws/aws-sdk-go-v2/service/ec2 v1.99.0/go.mod h1:L3ZT0N/vBsw77mOAawXmRnREpEjcHd2v5Hzf7AkIH8M=
-github.com/aws/aws-sdk-go-v2/service/finspace v1.10.0 h1:vZczEtJSs8HEkZ9JuxkKIHgiQwtXdDim+X3R7Ppt7c8=
-github.com/aws/aws-sdk-go-v2/service/finspace v1.10.0/go.mod h1:y9XeW3Hxtkh+Sled61taaqOk1Lk7wdGpLRBx9Z/twOk=
-github.com/aws/aws-sdk-go-v2/service/fis v1.14.10 h1:uDfGkU0W6mO34XFbXgc9sFjOXTNA6IRoeeoPkCnZnx4=
-github.com/aws/aws-sdk-go-v2/service/fis v1.14.10/go.mod h1:UFu/qHPW17t5CcwChAc76mSq3v/bRyzhqjwiTcqlwLI=
-github.com/aws/aws-sdk-go-v2/service/glacier v1.14.11 h1:dTa4Macg5HxqrQfauBnhpx5cDU9S17mpMI/++BuG/2g=
-github.com/aws/aws-sdk-go-v2/service/glacier v1.14.11/go.mod h1:7RgtFQVsN4MpvQieAJkHSUuvPTiMcEZO57tAnpzlM1I=
-github.com/aws/aws-sdk-go-v2/service/healthlake v1.16.0 h1:8CXnXojAdCTtFhrJn2Ez6DDFFykbd9lWOu0Frs1zoqk=
-github.com/aws/aws-sdk-go-v2/service/healthlake v1.16.0/go.mod h1:n1IxBDIRdNPVLrEDqwDSZSF60FkFIO43gWVMZo4Y/Rk=
-github.com/aws/aws-sdk-go-v2/service/iam v1.20.0 h1:ywXSXkssdnuPlJyCZVO5kAUQhFm/RhsbvWRHklJ0uH4=
-github.com/aws/aws-sdk-go-v2/service/iam v1.20.0/go.mod h1:kAnokExGCYs7zfvZEZdFHvQ/x4ZKIci0Raps6mZI1Ag=
-github.com/aws/aws-sdk-go-v2/service/identitystore v1.16.11 h1:lXvr+mWzICOdOWQAKGPpAgSuA3lw3XEnzuCUMBVFjgs=
-github.com/aws/aws-sdk-go-v2/service/identitystore v1.16.11/go.mod h1:q1wr4mV/OaSB53lfrCL4al7J4ApwOZcy2F8nQ2iTTlw=
-github.com/aws/aws-sdk-go-v2/service/inspector2 v1.14.0 h1:NKiE3bgx2O74zQdH6Fs9SRt8QImO3kEPeOVMr1DBzn4=
-github.com/aws/aws-sdk-go-v2/service/inspector2 v1.14.0/go.mod h1:DVqRsK8FPNPZmd6XIITp+vakn0DwcfqO/Luo9fdMUZk=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.27 h1:0iKliEXAcCa2qVtRs7Ot5hItA2MsufrphbRFlz1Owxo=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.27/go.mod h1:EOwBD4J4S5qYszS5/3DpkejfuK+Z5/1uzICfPaZLtqw=
-github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.14.2 h1:NbWkRxEEIRSCqxhsHQuMiTH7yo+JZW1gp8v3elSVMTQ=
-github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.14.2/go.mod h1:4tfW5l4IAB32VWCDEBxCRtR9T4BWy4I4kr1spr8NgZM=
-github.com/aws/aws-sdk-go-v2/service/ivschat v1.4.5 h1:oaAviqCkBc/azk44qUP+w0ZkiNsfFHq+7sdH8N7bKUY=
-github.com/aws/aws-sdk-go-v2/service/ivschat v1.4.5/go.mod h1:hUIzI/1VZP15FYdPE7tBFI/gk9iD1LlEOFMSJTrJZN8=
-github.com/aws/aws-sdk-go-v2/service/kendra v1.40.2 h1:4oiWp0Y9BnBh0x7V4/h3u/qnagKgl5eofYi3bANQWbk=
-github.com/aws/aws-sdk-go-v2/service/kendra v1.40.2/go.mod h1:00b/aokrZ0r4fUsMP9RSOL9bvxTCCRCOeUy5o0lyqrA=
-github.com/aws/aws-sdk-go-v2/service/lambda v1.35.0 h1:iNLsDIOju/bbqw0mNaEXh+9Ms6Mm0RjcHPP9z4k9lUY=
-github.com/aws/aws-sdk-go-v2/service/lambda v1.35.0/go.mod h1:i23nHcGEyswthctBfhEO1agGpM5Uyh83aSmSB6DmdCk=
-github.com/aws/aws-sdk-go-v2/service/lightsail v1.26.6 h1:QQE/ZcXSrPFGprrG8VFblHiMpenvzICT09YnaMmQEwk=
-github.com/aws/aws-sdk-go-v2/service/lightsail v1.26.6/go.mod h1:L+JqH2pSCvKnCVJNKnU/8TTUfuNuTXSmXiS3F0zMvzQ=
-github.com/aws/aws-sdk-go-v2/service/medialive v1.31.4 h1:EMIWrz5dNgkqAKUPe6xTLvzwLt2RIRN1P5D8Nrl4XkQ=
-github.com/aws/aws-sdk-go-v2/service/medialive v1.31.4/go.mod h1:3Ttv/NVxQ8CitwL/sZdxSJHzStb75XQO+gvBwOC3Sj8=
-github.com/aws/aws-sdk-go-v2/service/oam v1.1.11 h1:dRgn7qpyEtXcP0prnPyaTUTiCQsowO++Cu9B5wlZRtI=
-github.com/aws/aws-sdk-go-v2/service/oam v1.1.11/go.mod h1:4y8cA064jS3qZpi0UJbWi7oYVK/2r+i19WzZKbVc984=
-github.com/aws/aws-sdk-go-v2/service/opensearchserverless v1.2.4 h1:ghpmRvcyW4vkWAEn2rPHafqAmCvxrEBSo1lMN0XgTH0=
-github.com/aws/aws-sdk-go-v2/service/opensearchserverless v1.2.4/go.mod h1:LMAikx29Mp71h/luaesJvO3//aeMPWu6MRE4eFfbWOU=
-github.com/aws/aws-sdk-go-v2/service/pipes v1.2.6 h1:dSXPRQShC1+i/d7k0w8hHZWX/44Z/hfWgIYq5MSLajA=
-github.com/aws/aws-sdk-go-v2/service/pipes v1.2.6/go.mod h1:tkKKTXm4WD7VCL5yUDvtvGZ8xaqbjk2WMJZLLetbJ0o=
-github.com/aws/aws-sdk-go-v2/service/rbin v1.8.12 h1:fNxEf+LXsuisrVIFAK9ZqNYaQM0ZByv73rDzxsHe52s=
-github.com/aws/aws-sdk-go-v2/service/rbin v1.8.12/go.mod h1:kdlIXWL9Akk4tj/u9GMnO17ImBEvrhQmb0OnJ7LokQY=
-github.com/aws/aws-sdk-go-v2/service/rds v1.45.0 h1:Yi23UNiGidNfT7tIW0lbE6JtRR1ZN+cNZGRTKLB+opk=
-github.com/aws/aws-sdk-go-v2/service/rds v1.45.0/go.mod h1:rS6T0DrjdZ5LDr8ZC/J9iZdD1oSbie5reWWzqv5zLOw=
-github.com/aws/aws-sdk-go-v2/service/resourceexplorer2 v1.2.13 h1:9uj47asgRDlwNqZIlzDt5HjnD2wakHy4yUXSz3e9V0M=
-github.com/aws/aws-sdk-go-v2/service/resourceexplorer2 v1.2.13/go.mod h1:2nZFXAepd6OTyH90JTsgjdgq4K6+jVh/5nXtiEpjHtw=
-github.com/aws/aws-sdk-go-v2/service/rolesanywhere v1.2.0 h1:2T9nMoFYotUEyaNTSALQm7OOlzmHWM5DIxZ8zE9nYEg=
-github.com/aws/aws-sdk-go-v2/service/rolesanywhere v1.2.0/go.mod h1:BeRwkhH4kXGCbloxpE5tApOhFa8O8Mn12m5onxV3mEY=
-github.com/aws/aws-sdk-go-v2/service/route53domains v1.14.10 h1:BSgJnMWjJtrnZeRnJIMt+YheRxNESIenlZL/xP2Xtt4=
-github.com/aws/aws-sdk-go-v2/service/route53domains v1.14.10/go.mod h1:ZCAB0DgknPFchQTI0rWjWlLe6U/2eDBqPMzVAjkZuzQ=
-github.com/aws/aws-sdk-go-v2/service/s3control v1.31.5 h1:2kBpC4G+0TURGBtHcUin60QgD1pegxxZVFd7mTw8Hx0=
-github.com/aws/aws-sdk-go-v2/service/s3control v1.31.5/go.mod h1:+J0Qiu0bVEAUOZWMa1fhnviElPPkyCNDJ7jy55YlXrw=
-github.com/aws/aws-sdk-go-v2/service/scheduler v1.1.11 h1:i3skYUCdrSYnX2oaO+tIMHocL0K9PedV6giheTlhH+U=
-github.com/aws/aws-sdk-go-v2/service/scheduler v1.1.11/go.mod h1:83KK/1JoGYanQ37zK6n4BMUr1jyBAgrYingKvg+iipA=
-github.com/aws/aws-sdk-go-v2/service/securitylake v1.4.1 h1:Mi+yCqhsUHiliV3djaKE719X01td+mJ8VyjcIwyTZJ0=
-github.com/aws/aws-sdk-go-v2/service/securitylake v1.4.1/go.mod h1:shJshCeJ7y5gV4oxRZDjTCdDLFq7TeTbvVKaGIPDtz8=
-github.com/aws/aws-sdk-go-v2/service/sesv2 v1.18.0 h1:ciNaY39VCcHGyMYXYG/WVWQ0hYZFmZmAjWp8Vl1hIG4=
-github.com/aws/aws-sdk-go-v2/service/sesv2 v1.18.0/go.mod h1:3d0bMRIeTba1O79ZBgYJXBMLu7IWaGDAki1QfqNKIYo=
-github.com/aws/aws-sdk-go-v2/service/ssm v1.36.4 h1:3AjvCuRS8OnNVRC/UBagp1Jo2feR94+VAIKO4lz8gOQ=
-github.com/aws/aws-sdk-go-v2/service/ssm v1.36.4/go.mod h1:p6MaesK9061w6NTiFmZpUzEkKUY5blKlwD2zYyErxKA=
-github.com/aws/aws-sdk-go-v2/service/ssmcontacts v1.15.4 h1:pax0tO/C4sBZ2nd6QsFGDssGVAMHQO5owbClakttX84=
-github.com/aws/aws-sdk-go-v2/service/ssmcontacts v1.15.4/go.mod h1:1LFRcVC7L8JhAlNHwc+KihmC0naHTRA+0ldK+qFh2w4=
-github.com/aws/aws-sdk-go-v2/service/ssmincidents v1.21.4 h1:7hO9021AxJ0pnnXOMRrwhZwV/jh7YR1OE0xZ/YgKhUc=
-github.com/aws/aws-sdk-go-v2/service/ssmincidents v1.21.4/go.mod h1:Q7T6TJnkts22esEfdhktumcr7YhcFMWUCQ9OvZXHdCQ=
-github.com/aws/aws-sdk-go-v2/service/sso v1.12.10 h1:UBQjaMTCKwyUYwiVnUt6toEJwGXsLBI6al083tpjJzY=
-github.com/aws/aws-sdk-go-v2/service/sso v1.12.10/go.mod h1:ouy2P4z6sJN70fR3ka3wD3Ro3KezSxU6eKGQI2+2fjI=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.14.10 h1:PkHIIJs8qvq0e5QybnZoG1K/9QTrLr9OsqCIo59jOBA=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.14.10/go.mod h1:AFvkxc8xfBe8XA+5St5XIHHrQQtkxqrRincx4hmMHOk=
-github.com/aws/aws-sdk-go-v2/service/sts v1.19.0 h1:2DQLAKDteoEDI8zpCzqBMaZlJuoE9iTYD0gFmXVax9E=
-github.com/aws/aws-sdk-go-v2/service/sts v1.19.0/go.mod h1:BgQOMsg8av8jset59jelyPW7NoZcZXLVpDsXunGDrk8=
-github.com/aws/aws-sdk-go-v2/service/swf v1.15.0 h1:ZcQ8IYzUhmiVZ7lV4E0lttk+Tei/RZk/Oko8+G34cWI=
-github.com/aws/aws-sdk-go-v2/service/swf v1.15.0/go.mod h1:p5K3luEySutRPjMsXcmoc9dumbUus6ZOj4XBYC3XMII=
-github.com/aws/aws-sdk-go-v2/service/transcribe v1.26.6 h1:I2Y2Y8V+uq2ZoD+yTxjKYuPOTtScHMXUWdbuCdjNZy4=
-github.com/aws/aws-sdk-go-v2/service/transcribe v1.26.6/go.mod h1:VgAk4W80KzgqmBdm1jk+FjqiD5VgAz0FGvqECq7q79I=
-github.com/aws/aws-sdk-go-v2/service/vpclattice v1.0.5 h1:ZQizySv5AeKbYYtkDiUcxSnwTqAJ4URIxdoLWfZ7rhw=
-github.com/aws/aws-sdk-go-v2/service/vpclattice v1.0.5/go.mod h1:1F8VKjH2cx/t6iY//vQvuVI4jD9hJrxbEcCjUmJqlyQ=
-github.com/aws/aws-sdk-go-v2/service/xray v1.16.11 h1:mYQ9hVlxQgd37r8evKvCUo+ny3AfKbFYvUQaD48LSbs=
-github.com/aws/aws-sdk-go-v2/service/xray v1.16.11/go.mod h1:EK5gjZWl5j6ttgiEaU++Y63VQ0TjiCWkl9wd0S+MjNM=
-github.com/aws/smithy-go v1.13.5 h1:hgz0X/DX0dGqTYpGALqXJoRKRj5oQ7150i5FdTePzO8=
-github.com/aws/smithy-go v1.13.5/go.mod h1:Tg+OJXh4MB2R/uN61Ko2f6hTZwB/ZYGOtib8J3gBHzA=
+github.com/armon/go-radix v1.0.0 h1:F4z6KzEeeQIMeLFa97iZU6vupzoecKdU5TX24SNppXI=
+github.com/armon/go-radix v1.0.0/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
+github.com/aws/aws-sdk-go v1.45.24 h1:TZx/CizkmCQn8Rtsb11iLYutEQVGK5PK9wAhwouELBo=
+github.com/aws/aws-sdk-go v1.45.24/go.mod h1:aVsgQcEevwlmQ7qHE9I3h+dtQgpqhFB+i8Phjh7fkwI=
+github.com/aws/aws-sdk-go-v2 v1.21.1 h1:wjHYshtPpYOZm+/mu3NhVgRRc0baM6LJZOmxPZ5Cwzs=
+github.com/aws/aws-sdk-go-v2 v1.21.1/go.mod h1:ErQhvNuEMhJjweavOYhxVkn2RUx7kQXVATHrjKtxIpM=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.4.14 h1:Sc82v7tDQ/vdU1WtuSyzZ1I7y/68j//HJ6uozND1IDs=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.4.14/go.mod h1:9NCTOURS8OpxvoAVHq79LK81/zC78hfRWFn+aL0SPcY=
+github.com/aws/aws-sdk-go-v2/config v1.18.44 h1:U10NQ3OxiY0dGGozmVIENIDnCT0W432PWxk2VO8wGnY=
+github.com/aws/aws-sdk-go-v2/config v1.18.44/go.mod h1:pHxnQBldd0heEdJmolLBk78D1Bf69YnKLY3LOpFImlU=
+github.com/aws/aws-sdk-go-v2/credentials v1.13.42 h1:KMkjpZqcMOwtRHChVlHdNxTUUAC6NC/b58mRZDIdcRg=
+github.com/aws/aws-sdk-go-v2/credentials v1.13.42/go.mod h1:7ltKclhvEB8305sBhrpls24HGxORl6qgnQqSJ314Uw8=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.13.12 h1:3j5lrl9kVQrJ1BU4O0z7MQ8sa+UXdiLuo4j0V+odNI8=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.13.12/go.mod h1:JbFpcHDBdsex1zpIKuVRorZSQiZEyc3MykNCcjgz174=
+github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.11.89 h1:XPqSyw8SBSLMRrF9Oip6tQpivXWJLMn8sdRoAsUCQQA=
+github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.11.89/go.mod h1:OkYwM7gYm9HieL6emYtkg7Pb7Jd8FFM5Pl5uAZ1h2jo=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.42 h1:817VqVe6wvwE46xXy6YF5RywvjOX6U2zRQQ6IbQFK0s=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.42/go.mod h1:oDfgXoBBmj+kXnqxDDnIDnC56QBosglKp8ftRCTxR+0=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.36 h1:7ZApaXzWbo8slc+W5TynuUlB4z66g44h7uqa3/d/BsY=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.36/go.mod h1:rwr4WnmFi3RJO0M4dxbJtgi9BPLMpVBMX1nUte5ha9U=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.3.44 h1:quOJOqlbSfeJTboXLjYXM1M9T52LBXqLoTPlmsKLpBo=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.3.44/go.mod h1:LNy+P1+1LiRcCsVYr/4zG5n8zWFL0xsvZkOybjbftm8=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.1.5 h1:8JG9ny0BqBDzmtIzbpaN+eke152ZNsYKApFJ/q29Hxo=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.1.5/go.mod h1:kEDHQApP/ukMO9natNftgUN3NaTsMxK6jb2jjpSMX7Y=
+github.com/aws/aws-sdk-go-v2/service/accessanalyzer v1.21.1 h1:3fWAJsw4dLG4eYKHL9lygUWbE0lD+/gkqQC1zmmdAig=
+github.com/aws/aws-sdk-go-v2/service/accessanalyzer v1.21.1/go.mod h1:thg9BfQH96QsZg9BMe30WS2av72ZAo7/lTfvUJqjK4s=
+github.com/aws/aws-sdk-go-v2/service/account v1.11.6 h1:rLJgSm0IiJfY0X/J0GdwcOneke/OzbDWBNzdXdfOhkE=
+github.com/aws/aws-sdk-go-v2/service/account v1.11.6/go.mod h1:AXOYHxUCLGx7OPK/cnYRK1tBXNENTyQ25YxS4Fm60Mg=
+github.com/aws/aws-sdk-go-v2/service/acm v1.19.1 h1:xcrvCNWIb4uzlVVFjjDVvNeRvKPMcT0vPb3ezwNzH7w=
+github.com/aws/aws-sdk-go-v2/service/acm v1.19.1/go.mod h1:KptofjTaHq44E4heGaSacYmmi2Hya/arRcyzw5Oy6ZI=
+github.com/aws/aws-sdk-go-v2/service/appconfig v1.21.1 h1:ioS2SwCT3cNA6y0KKEozBJ+IoinrBiWuNbU6oGHpk6o=
+github.com/aws/aws-sdk-go-v2/service/appconfig v1.21.1/go.mod h1:3hIsAH76MSJuhdbCI/axMDGDlXruT0r6Swo3/vtUAoo=
+github.com/aws/aws-sdk-go-v2/service/auditmanager v1.26.6 h1:wodMSnced6g4nzZzioDnA8htdEq/dReyyZBTQFGWx2I=
+github.com/aws/aws-sdk-go-v2/service/auditmanager v1.26.6/go.mod h1:xbR4FPxBw7W+POjVCu2hIO4t2Hv7/B3R6YXyGLKAXqw=
+github.com/aws/aws-sdk-go-v2/service/cleanrooms v1.4.1 h1:raBk0al+3nOOn/cF70/qebleYfWuWw2WDy37CLd2mYA=
+github.com/aws/aws-sdk-go-v2/service/cleanrooms v1.4.1/go.mod h1:tEPIXZTTCrnZDQQ0EaMVYSovQgVhyCGP03yilX6zjNI=
+github.com/aws/aws-sdk-go-v2/service/cloudcontrol v1.12.6 h1:atzpgSRdPS07BD0dUbScjXw5AsM8ncb1hwHrao38NTY=
+github.com/aws/aws-sdk-go-v2/service/cloudcontrol v1.12.6/go.mod h1:RMuRe6BfB79pUHdMg19y4v9K+AG01KWVvNZuriuOTyw=
+github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.24.1 h1:NL2HEgcchk/QTa9/8GgrZvmfvCwqCDknvzAOMuvANnU=
+github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.24.1/go.mod h1:ZD/6Xew+gqhnRBg9iRXNYZOhp4BXKfqe7JRrtOnIh8s=
+github.com/aws/aws-sdk-go-v2/service/codecatalyst v1.5.6 h1:FT5dlg2yptwtvZvvgRymO/hO4zpkCZzuGJqkhASQNDk=
+github.com/aws/aws-sdk-go-v2/service/codecatalyst v1.5.6/go.mod h1:S+nhWbA1j7u+BUJUOzDB0gvzRtCePnnRmeLo+Jq4H58=
+github.com/aws/aws-sdk-go-v2/service/codestarconnections v1.15.7 h1:IErCL7+1POimitUbC+Pi1cSHN6woitjJUJJG/u96WVg=
+github.com/aws/aws-sdk-go-v2/service/codestarconnections v1.15.7/go.mod h1:t2eYkluO3K1dKdlfJElyq0ndHCJGozstu7XCB67+qrw=
+github.com/aws/aws-sdk-go-v2/service/codestarnotifications v1.16.1 h1:1zhuU/Adbs12tX2BOEnthjxh7yLAJvpUKx+4HMQosuI=
+github.com/aws/aws-sdk-go-v2/service/codestarnotifications v1.16.1/go.mod h1:iIpU0KfZVYtYG3toK8hXIo8dBGXKpL8O55OUpa/qRR4=
+github.com/aws/aws-sdk-go-v2/service/comprehend v1.25.6 h1:GuOorggN3yzbxYzUN+Zw1zaWZqbPQ/cQeEqdVFmkp/s=
+github.com/aws/aws-sdk-go-v2/service/comprehend v1.25.6/go.mod h1:DEwx85ig5tB4SRd6ctG7XbM9m+DYQOjezaxYOmmWmO8=
+github.com/aws/aws-sdk-go-v2/service/computeoptimizer v1.27.1 h1:nf1PaOiAkEEA4tqv+JSOEKO3fzAUoNGDV7HngPU8EQE=
+github.com/aws/aws-sdk-go-v2/service/computeoptimizer v1.27.1/go.mod h1:KpDYz9nyWhAP6y4c7xO2chvdF2Ax3wUHIK58VW4K9vc=
+github.com/aws/aws-sdk-go-v2/service/directoryservice v1.18.6 h1:LkWkBy2/jTexo+s9E+sc2YwaakyCy5iBhrihHk9OyZk=
+github.com/aws/aws-sdk-go-v2/service/directoryservice v1.18.6/go.mod h1:dz9teMP8i6dur+rcfmM4XnUCjz/HIKtDPomWugbLJvY=
+github.com/aws/aws-sdk-go-v2/service/docdbelastic v1.3.1 h1:0T2cQq8v/CkGJMHdtBe18qAWRDNZD9jB0pr8Ly+UQGE=
+github.com/aws/aws-sdk-go-v2/service/docdbelastic v1.3.1/go.mod h1:9Q9f9ST4lEaDFJfPIeGRj2rzgR3Phq+OcA+Xun9u4kI=
+github.com/aws/aws-sdk-go-v2/service/dynamodb v1.22.1 h1:TYq4EU2vEEluoaBG0RCPnbibSndTQSzlpbZdmT/YRcs=
+github.com/aws/aws-sdk-go-v2/service/dynamodb v1.22.1/go.mod h1:1EJb9/tJwI7iqiStZBcmHijQxcgp7dlPuD2YgoZIrJQ=
+github.com/aws/aws-sdk-go-v2/service/ec2 v1.124.0 h1:3VsdIKjFmyXFkKV21tgn49/dxSziWhjnx3YbqrDofXc=
+github.com/aws/aws-sdk-go-v2/service/ec2 v1.124.0/go.mod h1:f2AJtWtbonV7cSBVdxfs6e68cponNukbBDvzc4WIASo=
+github.com/aws/aws-sdk-go-v2/service/emrserverless v1.11.1 h1:F6e5phPOifW0qc+w4J6PnaIlxyEzOip+NyeVG/iRij8=
+github.com/aws/aws-sdk-go-v2/service/emrserverless v1.11.1/go.mod h1:exMBYUp/JqcvnvfVn0bbImCqoTydKkDy/fPtUtO7sNs=
+github.com/aws/aws-sdk-go-v2/service/finspace v1.12.1 h1:CIA2kTKWTYppKLJhmVnx3v30YVe/jBYCPykKS1LPRJo=
+github.com/aws/aws-sdk-go-v2/service/finspace v1.12.1/go.mod h1:ErVuad9auI7UEavsc0D+PVLxWTuOSAcj4TytdfviG/w=
+github.com/aws/aws-sdk-go-v2/service/fis v1.16.1 h1:BH0erAhqfybRTXGP7McZ+nKfA8l/jtH4Kf4gGDQpN0I=
+github.com/aws/aws-sdk-go-v2/service/fis v1.16.1/go.mod h1:LZ0kH2huy9e8YU/PZY63VcvyPyPX/AMiBxSXp2PkDe4=
+github.com/aws/aws-sdk-go-v2/service/glacier v1.16.1 h1:nLEuWOegNCDMzwNTHjZObRtBZpD6m0l+0LCULvr4AyM=
+github.com/aws/aws-sdk-go-v2/service/glacier v1.16.1/go.mod h1:pZ02Flgy0T5GaNL5b1Qq9PYcaVAX6RY13+V7HF3iuHk=
+github.com/aws/aws-sdk-go-v2/service/healthlake v1.17.6 h1:Y3M3R/oZeHUhzcIdv69ZH+cOrzLKJhVV/P2UfJ5n2ZI=
+github.com/aws/aws-sdk-go-v2/service/healthlake v1.17.6/go.mod h1:z8dLyRwaqMxZRVh3kXtcE5XhJ6EODOge768oN/JVAJg=
+github.com/aws/aws-sdk-go-v2/service/iam v1.22.6 h1:AL1fgN3/LHI7WJMKx63Osvsmk3f+EyHIJme0DQFasog=
+github.com/aws/aws-sdk-go-v2/service/iam v1.22.6/go.mod h1:GM5AHRAQGBgA3U6n7HwpWZGCPyxKLCgM7JSSAuoUWU8=
+github.com/aws/aws-sdk-go-v2/service/identitystore v1.18.3 h1:69H4rSAWb2ri/sMPfXK8Kkbqz/oO6DdM8vRiHziRXDc=
+github.com/aws/aws-sdk-go-v2/service/identitystore v1.18.3/go.mod h1:JpmHPTBvVoZnVLzmhMpQZEzqnrZ5BvN5cgSeyWKDxQA=
+github.com/aws/aws-sdk-go-v2/service/inspector2 v1.16.8 h1:Em1eX4kFWSNvdwVBoDGFwMR2+S9AJhdPi9veiunw2Co=
+github.com/aws/aws-sdk-go-v2/service/inspector2 v1.16.8/go.mod h1:Y8wiIOrs8SCUVP0fqexWCu06br9jiaqugazQN/oAsYQ=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.9.15 h1:7R8uRYyXzdD71KWVCL78lJZltah6VVznXBazvKjfH58=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.9.15/go.mod h1:26SQUPcTNgV1Tapwdt4a1rOsYRsnBsJHLMPoxK2b0d8=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.1.37 h1:Mx1zJlYbiUQANWT40koevLvxawGFolmkaP4m+LuyG7M=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.1.37/go.mod h1:PjKIAMFthKPgG/B8bbRpo3F8jfr2q2L+w3u78jJ12a0=
+github.com/aws/aws-sdk-go-v2/service/internal/endpoint-discovery v1.7.36 h1:0ZzowXTZABVqnJnwDMlTDP3eeEkuP1r6RYnhSBmgK2o=
+github.com/aws/aws-sdk-go-v2/service/internal/endpoint-discovery v1.7.36/go.mod h1:zAE5h/4VanzBpqyWoCZX/nJImdsqjjsGt2r3MtbKSFA=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.36 h1:YXlm7LxwNlauqb2OrinWlcvtsflTzP8GaMvYfQBhoT4=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.36/go.mod h1:ou9ffqJ9hKOVZmjlC6kQ6oROAyG1M4yBKzR+9BKbDwk=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.15.5 h1:sAAz28SeA7YZl8Yaphjs9tlLsflhdniQPjf3X2cqr4s=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.15.5/go.mod h1:HC7gNz3VH0p+RvLKK+HqNQv/gHy+1Os3ko/F41s3+aw=
+github.com/aws/aws-sdk-go-v2/service/internetmonitor v1.6.1 h1:4lgcY0bJwDlR+/EORGqFN0fQgxZRt7zfS4lFp2WqiNA=
+github.com/aws/aws-sdk-go-v2/service/internetmonitor v1.6.1/go.mod h1:boJ8FNGtNY1pV+ktzjkk76MNR6JIhy9pNHOuiciqHVk=
+github.com/aws/aws-sdk-go-v2/service/ivschat v1.6.1 h1:AENFPXfGAMysoJ2y0D4NzxWcaWBChfQLI1KiVe9gyXw=
+github.com/aws/aws-sdk-go-v2/service/ivschat v1.6.1/go.mod h1:vpYM6NUGUdeNYoBfsN1qjVWQIB/k6nE8AqnPl+mxolw=
+github.com/aws/aws-sdk-go-v2/service/kafka v1.22.7 h1:NGrznOGbuAvTpHsrbH9OijoBEiDyr+KmQ1loLLMfCm0=
+github.com/aws/aws-sdk-go-v2/service/kafka v1.22.7/go.mod h1:Uk2AOsWjBQyFTb8gPh+MoCM55OKOq3fwt+OiO/0Jj54=
+github.com/aws/aws-sdk-go-v2/service/kendra v1.43.1 h1:W/0LQFNfBq+WlEEYTYLjGYBoTC6BXkzlIN+eCKNfBTA=
+github.com/aws/aws-sdk-go-v2/service/kendra v1.43.1/go.mod h1:Pf36PEiaoeLF4xSlfqWR8ZTS5kpuKvyn/IAZLZO8DPk=
+github.com/aws/aws-sdk-go-v2/service/keyspaces v1.4.6 h1:Px2IPr9lLGLaxcWYtTKQS6Uq7a7+mXO1gNdwdzRQkcM=
+github.com/aws/aws-sdk-go-v2/service/keyspaces v1.4.6/go.mod h1:180DaekP6ebtSjEgH9CwLChl9dTf3ppnZB0hbjGH/XY=
+github.com/aws/aws-sdk-go-v2/service/lambda v1.39.6 h1:7FEmwTkDkDE/kwG2zMLAsbtT9dqoSLMagQbHlj1jn9Y=
+github.com/aws/aws-sdk-go-v2/service/lambda v1.39.6/go.mod h1:knjlM/w5B2waA8ajK5Wjgr4CDDung+XPhq4mX0Lnuog=
+github.com/aws/aws-sdk-go-v2/service/lexmodelsv2 v1.32.6 h1:z+jd+zmp4yOy4NXnf1BafF4z3+nh4/hJDfUMvAYkODI=
+github.com/aws/aws-sdk-go-v2/service/lexmodelsv2 v1.32.6/go.mod h1:x77ANQLWCCovl9Bh5ErxN40j3CSsOiHWCnuCBRstAk4=
+github.com/aws/aws-sdk-go-v2/service/lightsail v1.28.6 h1:DeOKrIWI8M9noiLqs6iN82go1wQvAEreqBhlfeTy8e4=
+github.com/aws/aws-sdk-go-v2/service/lightsail v1.28.6/go.mod h1:WJyI7A91cJsTNCgMWabnbAffHi1lv98JB6YM3kNqNJQ=
+github.com/aws/aws-sdk-go-v2/service/mediaconnect v1.20.6 h1:egi5EkmnxHBgS17lHO/vnp25fNWJr2czdKRWoCpyqGE=
+github.com/aws/aws-sdk-go-v2/service/mediaconnect v1.20.6/go.mod h1:CEwzxzOcMNP3yBh3AmPq8GuDTVucXBiSlhUNYNUvL2I=
+github.com/aws/aws-sdk-go-v2/service/medialive v1.37.1 h1:V35Jr6Aker94WCzlchrHV62oRHrmHyulUlulutQKjoQ=
+github.com/aws/aws-sdk-go-v2/service/medialive v1.37.1/go.mod h1:R1OMa2V11Ji2bTZz4Bw4YPKKR3iAmsIdRS9GEalq3Uk=
+github.com/aws/aws-sdk-go-v2/service/mediapackage v1.23.4 h1:C8zcX+aPVNrri+MRBGkjjnRteisedgN1oYUJ9XFCcsY=
+github.com/aws/aws-sdk-go-v2/service/mediapackage v1.23.4/go.mod h1:CrIAMXAFICTbRZIymSYgMvCPiEx99WgckvKuJcYjMaA=
+github.com/aws/aws-sdk-go-v2/service/oam v1.4.1 h1:BhLpb87aByUWX1x5ERmkXMa6p/bqE05ZwLkg6YxB6RY=
+github.com/aws/aws-sdk-go-v2/service/oam v1.4.1/go.mod h1:F7D1NA9s0hR9NP2vZuh8RIUeRQlLtt7qbJsDY6DDkD0=
+github.com/aws/aws-sdk-go-v2/service/opensearchserverless v1.5.1 h1:+cbGcCXbXpHgGlvdyYDUhyQrXiRXV1Uxny4lE5fxPEI=
+github.com/aws/aws-sdk-go-v2/service/opensearchserverless v1.5.1/go.mod h1:Fq5Mxljf6cxQvepxkRXjhvJkEFS1o294bkI808Kk+pM=
+github.com/aws/aws-sdk-go-v2/service/pipes v1.4.2 h1:H2QURTJp7FrE87DnBalEEjJR4ed01LVIrg6E5zlNQUk=
+github.com/aws/aws-sdk-go-v2/service/pipes v1.4.2/go.mod h1:YISOhMmTXx73RosmN0IrtpUGyz+juRa8wiFlxBavufc=
+github.com/aws/aws-sdk-go-v2/service/pricing v1.21.8 h1:PMCSEyjOW81psvvcD9wRtScE/hzJNxBITJ32o42CUQg=
+github.com/aws/aws-sdk-go-v2/service/pricing v1.21.8/go.mod h1:Wz6ZULBcnjnHO59Br87w8I+W9HQSiu3VJ9tuI7DrzB8=
+github.com/aws/aws-sdk-go-v2/service/qldb v1.16.6 h1:FkGz9hoAU2J+EOgo6HZSSkorngoBA4cnVUaKivlgFXE=
+github.com/aws/aws-sdk-go-v2/service/qldb v1.16.6/go.mod h1:fgUIUS1lzEA2aXf3Av9Pr8LEZJ1mSQBDNA2EBXS4Wz4=
+github.com/aws/aws-sdk-go-v2/service/rbin v1.10.1 h1:auLeIKOX51YwB6sqYZYde1hgLqAecOQaQryRZSJ4fvY=
+github.com/aws/aws-sdk-go-v2/service/rbin v1.10.1/go.mod h1:i07AjvSm32uDSVmW5qQ3e82XnRivq4RlFgBd4Lbox3Y=
+github.com/aws/aws-sdk-go-v2/service/rds v1.55.2 h1:dje4c9cNZY5bokl0YfT/xdXRg0mja1pUWijXLhab9y8=
+github.com/aws/aws-sdk-go-v2/service/rds v1.55.2/go.mod h1:SKANU6tKVhn1wHbTSF0Bo6LFrAENtPfXG1DHyahqFyE=
+github.com/aws/aws-sdk-go-v2/service/redshiftdata v1.20.6 h1:UpIGzyKcKqNsAAE+H57o4FxYn1lwkTkQCa7mc5euTFE=
+github.com/aws/aws-sdk-go-v2/service/redshiftdata v1.20.6/go.mod h1:GM3w954QkzEAlPd0A1FS5514eNOzHx5z6uwJV+ncCow=
+github.com/aws/aws-sdk-go-v2/service/resourceexplorer2 v1.4.2 h1:2mfEZP1NEn+NryKAYp9lt3LGnR2KCZ9gdes4mwBVQ2E=
+github.com/aws/aws-sdk-go-v2/service/resourceexplorer2 v1.4.2/go.mod h1:02/O8Hp60veJmFEIePpMPwar604TqH2tv4JXtWodJPM=
+github.com/aws/aws-sdk-go-v2/service/rolesanywhere v1.3.7 h1:dRO8PxJbiaJeH9ahqrFUlZyJlVuk7ekxKjet53EUNYs=
+github.com/aws/aws-sdk-go-v2/service/rolesanywhere v1.3.7/go.mod h1:tcAxdUvNUGuQt/yCJsGc9wYdlOrFOOLp6TbepZp8k84=
+github.com/aws/aws-sdk-go-v2/service/route53domains v1.17.4 h1:1uA3FBoMAcAPqb/TqI4dm9QgxmOJGXc8jnf3eaSgu9I=
+github.com/aws/aws-sdk-go-v2/service/route53domains v1.17.4/go.mod h1:hxqmMdnrGjnzRY2has/lmletY1Exs/iKmzOLjvpMy/c=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.40.1 h1:FqIaVPbs2W8U3fszl2PCL1IDKeRdM7TssjWamL6b2mg=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.40.1/go.mod h1:X0e0NCAx4GjOrKro7s9QYy+YEIFhgCkt6gYKVKhZB5Y=
+github.com/aws/aws-sdk-go-v2/service/s3control v1.33.1 h1:et+tylt0R4X5jGq++egvYrv2u7JCuB0ZhSlzHYdOwtw=
+github.com/aws/aws-sdk-go-v2/service/s3control v1.33.1/go.mod h1:/qC7aNeoLJcZu2a90OnclO8VMz9QClZTDpG4AFLDSMA=
+github.com/aws/aws-sdk-go-v2/service/scheduler v1.3.1 h1:Z1XsWjViyQrF7+VK4JECRdn/R6i1v6EsrBMEmzB0rf4=
+github.com/aws/aws-sdk-go-v2/service/scheduler v1.3.1/go.mod h1:bcdKaS8+sUoa39w9x93KjohdT/TGdvJb/N+FFbYIcuI=
+github.com/aws/aws-sdk-go-v2/service/securitylake v1.7.1 h1:z/tG3vLlp7n1Ce2ZlJOiN3kd22JHqdkY4FYDrlfeA0k=
+github.com/aws/aws-sdk-go-v2/service/securitylake v1.7.1/go.mod h1:GQnvIQbeFVfBbjrJ+K6r330ev3/XVD7Hy15byeiOkWo=
+github.com/aws/aws-sdk-go-v2/service/servicequotas v1.16.1 h1:Wzs47z3I1AOiUFZ2VvGw0tm1hChyO8BvYizXD4Tlcjs=
+github.com/aws/aws-sdk-go-v2/service/servicequotas v1.16.1/go.mod h1:xi6ausBg+Nd+0RNiVIcMCD4xoVV+VXyv/bZKEmMYDuE=
+github.com/aws/aws-sdk-go-v2/service/sesv2 v1.20.2 h1:3qYTIrsGBaxD8F6N+B0rx8OJSoS15GfT12UuhCTAumI=
+github.com/aws/aws-sdk-go-v2/service/sesv2 v1.20.2/go.mod h1:NrZAizsqYf7fIXZP6sAcjV+jbW8yYwNDtHAxRC+mEMQ=
+github.com/aws/aws-sdk-go-v2/service/signer v1.16.6 h1:df3gIYF9ViDrg5aUXDcey8x+r20GnVZUcp+MCmxIREA=
+github.com/aws/aws-sdk-go-v2/service/signer v1.16.6/go.mod h1:qJTvAvexUNd2qquSHqdsH8nvcF7LdbQsdri0BuIiwxM=
+github.com/aws/aws-sdk-go-v2/service/sqs v1.24.6 h1:gOp27f7sRnebYZmBTEU9SshxNmUSZpLxwhEbR4B7IG0=
+github.com/aws/aws-sdk-go-v2/service/sqs v1.24.6/go.mod h1:hG0BRoUOVHMQDcMWnZx4rC0NBbxxvYa4zMPdh7kxI/w=
+github.com/aws/aws-sdk-go-v2/service/ssm v1.38.1 h1:jkHph1+6MkoWuccP79ITWu8BsiH2RIFiviLoJOrS3+I=
+github.com/aws/aws-sdk-go-v2/service/ssm v1.38.1/go.mod h1:8SQhWZMknHq72Fr4HifgriuZszL0EQRohngHgGgRfyY=
+github.com/aws/aws-sdk-go-v2/service/ssmcontacts v1.17.1 h1:LkzaII/E99ZTc48TfZ178n6QgUUe2OpLPNx6vF2DnL4=
+github.com/aws/aws-sdk-go-v2/service/ssmcontacts v1.17.1/go.mod h1:fXUA6xdu9Ar+ZUS/SUKNXmREnJGJd+ct78FFS/WidqM=
+github.com/aws/aws-sdk-go-v2/service/ssmincidents v1.23.1 h1:6Oy7VwSfEPch7wxBRSdJk60e9uBz+uUIi0KvsilAYA8=
+github.com/aws/aws-sdk-go-v2/service/ssmincidents v1.23.1/go.mod h1:hFK9kL+6cX4M3KXoQXOCCnQP/iQ/ZjOUDiseQZWUD9c=
+github.com/aws/aws-sdk-go-v2/service/sso v1.15.1 h1:ZN3bxw9OYC5D6umLw6f57rNJfGfhg1DIAAcKpzyUTOE=
+github.com/aws/aws-sdk-go-v2/service/sso v1.15.1/go.mod h1:PieckvBoT5HtyB9AsJRrYZFY2Z+EyfVM/9zG6gbV8DQ=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.17.2 h1:fSCCJuT5i6ht8TqGdZc5Q5K9pz/atrf7qH4iK5C9XzU=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.17.2/go.mod h1:5eNtr+vNc5vVd92q7SJ+U/HszsIdhZBEyi9dkMRKsp8=
+github.com/aws/aws-sdk-go-v2/service/sts v1.23.1 h1:ASNYk1ypWAxRhJjKS0jBnTUeDl7HROOpeSMu1xDA/I8=
+github.com/aws/aws-sdk-go-v2/service/sts v1.23.1/go.mod h1:2cnsAhVT3mqusovc2stUSUrSBGTcX9nh8Tu6xh//2eI=
+github.com/aws/aws-sdk-go-v2/service/swf v1.17.4 h1:C9kYSI8M4s4nWGqyLLVjappbBuf9ckY49f9p/3t6nwY=
+github.com/aws/aws-sdk-go-v2/service/swf v1.17.4/go.mod h1:gKxgDhvUcMktase1gvNt4EdWl9uzSnUsqgwwhfUGkPE=
+github.com/aws/aws-sdk-go-v2/service/timestreamwrite v1.19.1 h1:vR4rTWTQkzqDqnYbafOdKxSEpoTPtMpU4ga83nMgdAY=
+github.com/aws/aws-sdk-go-v2/service/timestreamwrite v1.19.1/go.mod h1:085nMFR23/NB91pGEOxJeNJsgk2tIu/CbBxPQJXDBuw=
+github.com/aws/aws-sdk-go-v2/service/transcribe v1.28.6 h1:b3v0V0bS8VX0YCg+NcVZYJtBwJJFELwtJtcvKeWwOCk=
+github.com/aws/aws-sdk-go-v2/service/transcribe v1.28.6/go.mod h1:jB3ccZlCktNZaK4Db1RUxgPsieWWqd4FxFidaJvrmRY=
+github.com/aws/aws-sdk-go-v2/service/verifiedpermissions v1.2.2 h1:9xtkwhrvGMgIYuyO2tYrnRH979MgVQj17K1YFZSKgMA=
+github.com/aws/aws-sdk-go-v2/service/verifiedpermissions v1.2.2/go.mod h1:t3lH38by/71ZUuMH8Q29yxSr2sbiSvUyylQ/pvDnLD0=
+github.com/aws/aws-sdk-go-v2/service/vpclattice v1.2.1 h1:maF3kTtf7OolW7IPTbpzJbCK31O3KIro9UpgEVZkBz0=
+github.com/aws/aws-sdk-go-v2/service/vpclattice v1.2.1/go.mod h1:LDJAbHPeQVxIV5PahqSQ+8SdLX8qAOp8h1aMSBZU8F4=
+github.com/aws/aws-sdk-go-v2/service/workspaces v1.31.1 h1:+gN/oR6jT53ggl+jd/7wO4A7u9r1GLCpMiRiatD79WQ=
+github.com/aws/aws-sdk-go-v2/service/workspaces v1.31.1/go.mod h1:56TIMTOeThR8Ep+O82yxpTuGzCOzZuo3XmsJXxukgUo=
+github.com/aws/aws-sdk-go-v2/service/xray v1.18.1 h1:uyEzztY4I3q5es2Lm6Qyo0PjhOFDgO1o0V25Zv/yKIU=
+github.com/aws/aws-sdk-go-v2/service/xray v1.18.1/go.mod h1:8M2/Dnh7fUkO7K5V70JHuFH5mp70Y2q0cbfbppj0TzI=
+github.com/aws/smithy-go v1.15.0 h1:PS/durmlzvAFpQHDs4wi4sNNP9ExsqZh6IlfdHXgKK8=
+github.com/aws/smithy-go v1.15.0/go.mod h1:Tg+OJXh4MB2R/uN61Ko2f6hTZwB/ZYGOtib8J3gBHzA=
 github.com/beevik/etree v1.2.0 h1:l7WETslUG/T+xOPs47dtd6jov2Ii/8/OjCldk5fYfQw=
 github.com/beevik/etree v1.2.0/go.mod h1:aiPf89g/1k3AShMVAzriilpcE4R/Vuor90y83zVZWFc=
 github.com/bgentry/speakeasy v0.1.0 h1:ByYyxL9InA1OWqxJqqp2A5pYHUrCiAL6K3J+LKSsQkY=
 github.com/bgentry/speakeasy v0.1.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs=
-github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc h1:biVzkmvwrH8WK8raXaxBx6fRVTlJILwEwQGL1I/ByEI=
-github.com/bwesterb/go-ristretto v1.2.0/go.mod h1:fUIoIZaG73pV5biE2Blr2xEzDoMj7NFEuV9ekS419A0=
-github.com/cloudflare/circl v1.1.0/go.mod h1:prBCrKB9DV4poKZY1l9zBXg2QJY7mvgRvtMxxK7fi4I=
+github.com/boombuler/barcode v1.0.1 h1:NDBbPmhS+EqABEs5Kg3n/5ZNjy73Pz7SIV+KCeqyXcs=
+github.com/bufbuild/protocompile v0.6.0 h1:Uu7WiSQ6Yj9DbkdnOe7U4mNKp58y9WDMKDn28/ZlunY=
+github.com/bwesterb/go-ristretto v1.2.3/go.mod h1:fUIoIZaG73pV5biE2Blr2xEzDoMj7NFEuV9ekS419A0=
 github.com/cloudflare/circl v1.3.3 h1:fE/Qz0QdIGqeWfnwq0RE0R7MI51s0M2E4Ga9kq5AEMs=
 github.com/cloudflare/circl v1.3.3/go.mod h1:5XYMA4rFBvNIrhs50XuiBJ15vF2pZn4nnUKZrLbUZFA=
-github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/emirpasic/gods v1.12.0 h1:QAUIPSaCu4G+POclxeqb3F+WPpdKqFGlw36+yOzGlrg=
-github.com/emirpasic/gods v1.12.0/go.mod h1:YfzfFFoVP/catgzJb4IKIqXjX78Ha8FMSDh3ymbK86o=
+github.com/emirpasic/gods v1.18.1 h1:FXtiHYKDGKCW2KzwZKx0iC0PQmdlorYgdFG9jPXJ1Bc=
 github.com/evanphx/json-patch v0.5.2 h1:xVCHIVMUu1wtM/VkR9jVZ45N3FhZfYMMYGorLCR8P3k=
 github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
 github.com/fatih/color v1.13.0/go.mod h1:kLAiJbzzSOZDVNGyDpeOxJ47H46qBXwg5ILebYFFOfk=
-github.com/fatih/color v1.14.1 h1:qfhVLaG5s+nCROl1zJsZRxFeYrHLqWroPOQ8BWiNb4w=
-github.com/fatih/color v1.14.1/go.mod h1:2oHN61fhTpgcxD3TSWCgKDiH1+x4OiDVVGH8WlgGZGg=
-github.com/flynn/go-shlex v0.0.0-20150515145356-3f9db97f8568/go.mod h1:xEzjJPgXI435gkrCt3MPfRiAkVrwSbHsst4LCFVfpJc=
-github.com/gliderlabs/ssh v0.2.2/go.mod h1:U7qILu1NlMHj9FlMhZLlkCdDnU1DBEAqr0aevW3Awn0=
-github.com/go-git/gcfg v1.5.0 h1:Q5ViNfGF8zFgyJWPqYwA7qGFoMTEiBmdlkcfRmpIMa4=
-github.com/go-git/gcfg v1.5.0/go.mod h1:5m20vg6GwYabIxaOonVkTdrILxQMpEShl1xiMF4ua+E=
-github.com/go-git/go-billy/v5 v5.2.0/go.mod h1:pmpqyWchKfYfrkb/UVH4otLvyi/5gJlGI4Hb3ZqZ3W0=
-github.com/go-git/go-billy/v5 v5.3.1 h1:CPiOUAzKtMRvolEKw+bG1PLRpT7D3LIs3/3ey4Aiu34=
-github.com/go-git/go-billy/v5 v5.3.1/go.mod h1:pmpqyWchKfYfrkb/UVH4otLvyi/5gJlGI4Hb3ZqZ3W0=
-github.com/go-git/go-git-fixtures/v4 v4.2.1/go.mod h1:K8zd3kDUAykwTdDCr+I0per6Y6vMiRR/nnVTBtavnB0=
-github.com/go-git/go-git/v5 v5.4.2 h1:BXyZu9t0VkbiHtqrsvdq39UDhGJTl1h55VW6CSC4aY4=
-github.com/go-git/go-git/v5 v5.4.2/go.mod h1:gQ1kArt6d+n+BGd+/B/I74HwRTLhth2+zti4ihgckDc=
-github.com/go-test/deep v1.0.3 h1:ZrJSEWsXzPOxaZnFteGEfooLba+ju3FYIbOrS+rQd68=
+github.com/fatih/color v1.15.0 h1:kOqh6YHBtK8aywxGerMG2Eq3H6Qgoqeo13Bk2Mv/nBs=
+github.com/fatih/color v1.15.0/go.mod h1:0h5ZqXfHYED7Bhv2ZJamyIOUej9KtShiJESRwBDUSsw=
+github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
+github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 h1:+zs/tPmkDkHx3U66DAb0lQFJrpS6731Oaa12ikc+DiI=
+github.com/go-git/go-billy/v5 v5.4.1 h1:Uwp5tDRkPr+l/TnbHOQzp+tmJfLceOlbVucgpTz8ix4=
+github.com/go-git/go-git/v5 v5.8.1 h1:Zo79E4p7TRk0xoRgMq0RShiTHGKcKI4+DI6BfJc/Q+A=
+github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
+github.com/go-logr/logr v1.2.4 h1:g01GSCwiDw2xSZfjJ2/T9M+S6pFdcNtFYsp+Y43HYDQ=
+github.com/go-logr/logr v1.2.4/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
+github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
+github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
+github.com/go-test/deep v1.1.0 h1:WOcxcdHcvdgThNXjw0t76K42FXTU7HpNQWHpA2HHNlg=
+github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da h1:oI5xCqsCo564l8iNU+DwB5epxmsaqB+rhGL0m5jtYqE=
 github.com/golang/protobuf v1.1.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
-github.com/golang/protobuf v1.5.2 h1:ROPKBNFfQgOUMifHyP+KYbvpjbdoFNs+aK7DXlji0Tw=
-github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
-github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
+github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg=
+github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
 github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.8/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
-github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
-github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
+github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/google/uuid v1.3.0 h1:t6JiXgmwXMjEs8VusXIJk2BXHsn+wx8BZdTaoZ5fu7I=
-github.com/google/uuid v1.3.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/hashicorp/aws-cloudformation-resource-schema-sdk-go v0.20.0 h1:xc1OYpWvNo6dhnzemfjwtbNxeu3Ag4Wr6yT8BOo0/q0=
-github.com/hashicorp/aws-cloudformation-resource-schema-sdk-go v0.20.0/go.mod h1:cdTE6F2pCKQobug+RqRaQp7Kz9hIEqiSvpPmb6E5G1w=
-github.com/hashicorp/aws-sdk-go-base/v2 v2.0.0-beta.29 h1:O1xB5BlSr57lDLgc6v+G+BBRr4HlkQKpapjmkJLCS4c=
-github.com/hashicorp/aws-sdk-go-base/v2 v2.0.0-beta.29/go.mod h1:eBFMtEbjCseWKRv5/M6SONGS0mSbMjxAeVMjCuDLGYE=
-github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2 v2.0.0-beta.30 h1:if38Z0xWEOR7MzmahrM3gCZDRSlc03Lc2x+hPEdpdnk=
-github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2 v2.0.0-beta.30/go.mod h1:RcKwhAC0Xu+i2/A7MYVKwhzvGt4KUvonf0IKHyfXYtw=
+github.com/google/uuid v1.3.1 h1:KjJaJ9iWZ3jOFZIf1Lqf4laDRCasjl0BCmnEGxkdLb4=
+github.com/google/uuid v1.3.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/hashicorp/aws-cloudformation-resource-schema-sdk-go v0.21.0 h1:IUypt/TbXiJBkBbE3926CgnjD8IltAitdn7Yive61DY=
+github.com/hashicorp/aws-cloudformation-resource-schema-sdk-go v0.21.0/go.mod h1:cdTE6F2pCKQobug+RqRaQp7Kz9hIEqiSvpPmb6E5G1w=
+github.com/hashicorp/aws-sdk-go-base/v2 v2.0.0-beta.37 h1:cpyObAk6869M/kROO/b9F14d8zyLbO3H7Fxqxn8J7DI=
+github.com/hashicorp/aws-sdk-go-base/v2 v2.0.0-beta.37/go.mod h1:9OxAOakW2pTtcX5bQMIEXwKjSJbpTNhumMCppJ4EaGw=
+github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2 v2.0.0-beta.38 h1:eTdtMVp6z9iqxsh9yvWFM4I+a/cy2c4BQgqnx0JSL08=
+github.com/hashicorp/aws-sdk-go-base/v2/awsv1shim/v2 v2.0.0-beta.38/go.mod h1:AOrVL7s+my9fpdDiFmkRZw5FPeY6GNiqApco3d53e7Y=
 github.com/hashicorp/awspolicyequivalence v1.6.0 h1:7aadmkalbc5ewStC6g3rljx1iNvP4QyAhg2KsHx8bU8=
 github.com/hashicorp/awspolicyequivalence v1.6.0/go.mod h1:9IOaIHx+a7C0NfUNk1A93M7kHd5rJ19aoUx37LZGC14=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
@@ -206,73 +258,68 @@ github.com/hashicorp/go-hclog v1.5.0/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVH
 github.com/hashicorp/go-multierror v1.0.0/go.mod h1:dHtQlpGsu+cZNNAkkCN/P3hoUDHhCYQXV3UM06sGGrk=
 github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
-github.com/hashicorp/go-plugin v1.4.9 h1:ESiK220/qE0aGxWdzKIvRH69iLiuN/PjoLTm69RoWtU=
-github.com/hashicorp/go-plugin v1.4.9/go.mod h1:viDMjcLJuDui6pXb8U4HVfb8AamCWhHGUjr2IrTF67s=
+github.com/hashicorp/go-plugin v1.5.1 h1:oGm7cWBaYIp3lJpx1RUEfLWophprE2EV/KUeqBYo+6k=
+github.com/hashicorp/go-plugin v1.5.1/go.mod h1:w1sAEES3g3PuV/RzUrgow20W2uErMly84hhD3um1WL4=
 github.com/hashicorp/go-uuid v1.0.0/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
 github.com/hashicorp/go-uuid v1.0.3 h1:2gKiV6YVmrJ1i2CKKa9obLvRieoRGviZFL26PcT/Co8=
 github.com/hashicorp/go-uuid v1.0.3/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
 github.com/hashicorp/go-version v1.6.0 h1:feTTfFNnjP967rlCxM/I9g701jU+RN74YKx2mOkIeek=
 github.com/hashicorp/go-version v1.6.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
-github.com/hashicorp/hc-install v0.5.0 h1:D9bl4KayIYKEeJ4vUDe9L5huqxZXczKaykSRcmQ0xY0=
-github.com/hashicorp/hc-install v0.5.0/go.mod h1:JyzMfbzfSBSjoDCRPna1vi/24BEDxFaCPfdHtM5SCdo=
-github.com/hashicorp/hcl/v2 v2.16.2 h1:mpkHZh/Tv+xet3sy3F9Ld4FyI2tUpWe9x3XtPx9f1a0=
-github.com/hashicorp/hcl/v2 v2.16.2/go.mod h1:JRmR89jycNkrrqnMmvPDMd56n1rQJ2Q6KocSLCMCXng=
+github.com/hashicorp/hc-install v0.6.0 h1:fDHnU7JNFNSQebVKYhHZ0va1bC6SrPQ8fpebsvNr2w4=
+github.com/hashicorp/hc-install v0.6.0/go.mod h1:10I912u3nntx9Umo1VAeYPUUuehk0aRQJYpMwbX5wQA=
+github.com/hashicorp/hcl/v2 v2.18.0 h1:wYnG7Lt31t2zYkcquwgKo6MWXzRUDIeIVU5naZwHLl8=
+github.com/hashicorp/hcl/v2 v2.18.0/go.mod h1:ThLC89FV4p9MPW804KVbe/cEXoQ8NZEh+JtMeeGErHE=
 github.com/hashicorp/logutils v1.0.0 h1:dLEQVugN8vlakKOUE3ihGLTZJRB4j+M2cdTm/ORI65Y=
 github.com/hashicorp/logutils v1.0.0/go.mod h1:QIAnNjmIWmVIIkWDTG1z5v++HQmx9WQRO+LraFDTW64=
-github.com/hashicorp/terraform-exec v0.18.1 h1:LAbfDvNQU1l0NOQlTuudjczVhHj061fNX5H8XZxHlH4=
-github.com/hashicorp/terraform-exec v0.18.1/go.mod h1:58wg4IeuAJ6LVsLUeD2DWZZoc/bYi6dzhLHzxM41980=
-github.com/hashicorp/terraform-json v0.16.0 h1:UKkeWRWb23do5LNAFlh/K3N0ymn1qTOO8c+85Albo3s=
-github.com/hashicorp/terraform-json v0.16.0/go.mod h1:v0Ufk9jJnk6tcIZvScHvetlKfiNTC+WS21mnXIlc0B0=
-github.com/hashicorp/terraform-plugin-framework v1.3.0 h1:WtP1CIaWAfbzME17xoUXvJcyh5Ewu9attdhbfWNnYLs=
-github.com/hashicorp/terraform-plugin-framework v1.3.0/go.mod h1:A1WD3Ry7FhrThViUTbkx4ZDsMq9oaAv4U9oTI8bBzCU=
-github.com/hashicorp/terraform-plugin-framework-timeouts v0.3.1 h1:5GhozvHUsrqxqku+yd0UIRTkmDLp2QPX5paL1Kq5uUA=
-github.com/hashicorp/terraform-plugin-framework-timeouts v0.3.1/go.mod h1:ThtYDU8p6sJ9+SI+TYxXrw28vXxgBwYOpoPv1EojSJI=
-github.com/hashicorp/terraform-plugin-framework-validators v0.10.0 h1:4L0tmy/8esP6OcvocVymw52lY0HyQ5OxB7VNl7k4bS0=
-github.com/hashicorp/terraform-plugin-framework-validators v0.10.0/go.mod h1:qdQJCdimB9JeX2YwOpItEu+IrfoJjWQ5PhLpAOMDQAE=
-github.com/hashicorp/terraform-plugin-go v0.15.0 h1:1BJNSUFs09DS8h/XNyJNJaeusQuWc/T9V99ylU9Zwp0=
-github.com/hashicorp/terraform-plugin-go v0.15.0/go.mod h1:tk9E3/Zx4RlF/9FdGAhwxHExqIHHldqiQGt20G6g+nQ=
+github.com/hashicorp/terraform-exec v0.19.0 h1:FpqZ6n50Tk95mItTSS9BjeOVUb4eg81SpgVtZNNtFSM=
+github.com/hashicorp/terraform-exec v0.19.0/go.mod h1:tbxUpe3JKruE9Cuf65mycSIT8KiNPZ0FkuTE3H4urQg=
+github.com/hashicorp/terraform-json v0.17.1 h1:eMfvh/uWggKmY7Pmb3T85u86E2EQg6EQHgyRwf3RkyA=
+github.com/hashicorp/terraform-json v0.17.1/go.mod h1:Huy6zt6euxaY9knPAFKjUITn8QxUFIe9VuSzb4zn/0o=
+github.com/hashicorp/terraform-plugin-framework v1.4.1 h1:ZC29MoB3Nbov6axHdgPbMz7799pT5H8kIrM8YAsaVrs=
+github.com/hashicorp/terraform-plugin-framework v1.4.1/go.mod h1:XC0hPcQbBvlbxwmjxuV/8sn8SbZRg4XwGMs22f+kqV0=
+github.com/hashicorp/terraform-plugin-framework-timeouts v0.4.1 h1:gm5b1kHgFFhaKFhm4h2TgvMUlNzFAtUqlcOWnWPm+9E=
+github.com/hashicorp/terraform-plugin-framework-timeouts v0.4.1/go.mod h1:MsjL1sQ9L7wGwzJ5RjcI6FzEMdyoBnw+XK8ZnOvQOLY=
+github.com/hashicorp/terraform-plugin-framework-validators v0.12.0 h1:HOjBuMbOEzl7snOdOoUfE2Jgeto6JOjLVQ39Ls2nksc=
+github.com/hashicorp/terraform-plugin-framework-validators v0.12.0/go.mod h1:jfHGE/gzjxYz6XoUwi/aYiiKrJDeutQNUtGQXkaHklg=
+github.com/hashicorp/terraform-plugin-go v0.19.0 h1:BuZx/6Cp+lkmiG0cOBk6Zps0Cb2tmqQpDM3iAtnhDQU=
+github.com/hashicorp/terraform-plugin-go v0.19.0/go.mod h1:EhRSkEPNoylLQntYsk5KrDHTZJh9HQoumZXbOGOXmec=
 github.com/hashicorp/terraform-plugin-log v0.9.0 h1:i7hOA+vdAItN1/7UrfBqBwvYPQ9TFvymaRGZED3FCV0=
 github.com/hashicorp/terraform-plugin-log v0.9.0/go.mod h1:rKL8egZQ/eXSyDqzLUuwUYLVdlYeamldAHSxjUFADow=
-github.com/hashicorp/terraform-plugin-mux v0.10.0 h1:VejY1BffxGy2iYOaa8DDHavY4k9jbvAE8F3lhruspKY=
-github.com/hashicorp/terraform-plugin-mux v0.10.0/go.mod h1:9sdnpmY20xIsl4ItsfODZYE+MgpSy/osXpSf+RwaZCY=
-github.com/hashicorp/terraform-plugin-sdk/v2 v2.26.1 h1:G9WAfb8LHeCxu7Ae8nc1agZlQOSCUWsb610iAogBhCs=
-github.com/hashicorp/terraform-plugin-sdk/v2 v2.26.1/go.mod h1:xcOSYlRVdPLmDUoqPhO9fiO/YCN/l6MGYeTzGt5jgkQ=
-github.com/hashicorp/terraform-plugin-testing v1.2.0 h1:pASRAe6BOZFO4xSGQr9WzitXit0nrQAYDk8ziuRfn9E=
-github.com/hashicorp/terraform-plugin-testing v1.2.0/go.mod h1:+8bp3O7xUb1UtBcdknrGdVRIuTw4b62TYSIgXHqlyew=
-github.com/hashicorp/terraform-registry-address v0.2.0 h1:92LUg03NhfgZv44zpNTLBGIbiyTokQCDcdH5BhVHT3s=
-github.com/hashicorp/terraform-registry-address v0.2.0/go.mod h1:478wuzJPzdmqT6OGbB/iH82EDcI8VFM4yujknh/1nIs=
-github.com/hashicorp/terraform-svchost v0.1.0 h1:0+RcgZdZYNd81Vw7tu62g9JiLLvbOigp7QtyNh6CjXk=
-github.com/hashicorp/terraform-svchost v0.1.0/go.mod h1:ut8JaH0vumgdCfJaihdcZULqkAwHdQNwNH7taIDdsZM=
+github.com/hashicorp/terraform-plugin-mux v0.12.0 h1:TJlmeslQ11WlQtIFAfth0vXx+gSNgvMEng2Rn9z3WZY=
+github.com/hashicorp/terraform-plugin-mux v0.12.0/go.mod h1:8MR0AgmV+Q03DIjyrAKxXyYlq2EUnYBQP8gxAAA0zeM=
+github.com/hashicorp/terraform-plugin-sdk/v2 v2.29.0 h1:wcOKYwPI9IorAJEBLzgclh3xVolO7ZorYd6U1vnok14=
+github.com/hashicorp/terraform-plugin-sdk/v2 v2.29.0/go.mod h1:qH/34G25Ugdj5FcM95cSoXzUgIbgfhVLXCcEcYaMwq8=
+github.com/hashicorp/terraform-plugin-testing v1.5.1 h1:T4aQh9JAhmWo4+t1A7x+rnxAJHCDIYW9kXyo4sVO92c=
+github.com/hashicorp/terraform-plugin-testing v1.5.1/go.mod h1:dg8clO6K59rZ8w9EshBmDp1CxTIPu3yA4iaDpX1h5u0=
+github.com/hashicorp/terraform-registry-address v0.2.2 h1:lPQBg403El8PPicg/qONZJDC6YlgCVbWDtNmmZKtBno=
+github.com/hashicorp/terraform-registry-address v0.2.2/go.mod h1:LtwNbCihUoUZ3RYriyS2wF/lGPB6gF9ICLRtuDk7hSo=
+github.com/hashicorp/terraform-svchost v0.1.1 h1:EZZimZ1GxdqFRinZ1tpJwVxxt49xc/S52uzrw4x0jKQ=
+github.com/hashicorp/terraform-svchost v0.1.1/go.mod h1:mNsjQfZyf/Jhz35v6/0LWcv26+X7JPS+buii2c9/ctc=
 github.com/hashicorp/yamux v0.1.1 h1:yrQxtgseBDrq9Y652vSRDvsKCJKOUD+GzTS4Y0Y8pvE=
 github.com/hashicorp/yamux v0.1.1/go.mod h1:CtWFDAQgb7dxtzFs4tWbplKIe2jSi3+5vKbgIO0SLnQ=
 github.com/huandu/xstrings v1.3.1/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE=
-github.com/huandu/xstrings v1.3.2 h1:L18LIDzqlW6xN2rEkpdV8+oL/IXWJ1APd+vsdYy4Wdw=
 github.com/huandu/xstrings v1.3.2/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE=
+github.com/huandu/xstrings v1.3.3/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE=
+github.com/huandu/xstrings v1.4.0 h1:D17IlohoQq4UcpqD7fDk80P7l+lwAmlFaBHgOipl2FU=
+github.com/huandu/xstrings v1.4.0/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE=
 github.com/imdario/mergo v0.3.11/go.mod h1:jmQim1M+e3UYxmgPu/WyfjB3N3VflVyUjjjwH0dnCYA=
-github.com/imdario/mergo v0.3.12 h1:b6R2BslTbIEToALKP7LxUvijTsNI9TAe80pLWN2g/HU=
-github.com/imdario/mergo v0.3.12/go.mod h1:jmQim1M+e3UYxmgPu/WyfjB3N3VflVyUjjjwH0dnCYA=
+github.com/imdario/mergo v0.3.15 h1:M8XP7IuFNsqUx6VPK2P9OSmsYsI/YFaGil0uD21V3dM=
+github.com/imdario/mergo v0.3.15/go.mod h1:WBLT9ZmE3lPoWsEzCh9LPo3TiwVN+ZKEjmz+hD27ysY=
 github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 h1:BQSFePA1RWJOlocH6Fxy8MmwDt+yVQYULKfN0RoTN8A=
-github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99/go.mod h1:1lJo3i6rXxKeerYnT8Nvf0QmHCRC1n8sfWVwXF2Frvo=
-github.com/jessevdk/go-flags v1.5.0/go.mod h1:Fw0T6WPc1dYxT4mKEZRfG5kJhaTDP9pj1c2EWnYs/m4=
-github.com/jhump/protoreflect v1.6.0 h1:h5jfMVslIg6l29nsMs0D8Wj17RDVdNYti0vDN/PZZoE=
+github.com/jhump/protoreflect v1.15.1 h1:HUMERORf3I3ZdX05WaQ6MIpd/NJ434hTp5YiKgfCL6c=
 github.com/jmespath/go-jmespath v0.4.0 h1:BEgLn5cpjn8UN1mAw4NjwDrS35OdebyEtFe+9YPoQUg=
 github.com/jmespath/go-jmespath v0.4.0/go.mod h1:T8mJZnbsbmF+m6zOOFylbeCJqk5+pHWvzYPziyZiYoo=
 github.com/jmespath/go-jmespath/internal/testify v1.5.1 h1:shLQSRRSCCPj3f2gpwzGwWFoC7ycTf1rcQZHOlsJ6N8=
 github.com/jmespath/go-jmespath/internal/testify v1.5.1/go.mod h1:L3OGu8Wl2/fWfCI6z80xFu9LTZmf1ZRjMHUOPmWr69U=
-github.com/kevinburke/ssh_config v0.0.0-20201106050909-4977a11b4351 h1:DowS9hvgyYSX4TO5NpyC606/Z4SxnNYbT+WX27or6Ck=
-github.com/kevinburke/ssh_config v0.0.0-20201106050909-4977a11b4351/go.mod h1:CT57kijsi8u/K/BOFA39wgDQJ9CxiF4nAY/ojJ6r6mM=
-github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
+github.com/kevinburke/ssh_config v1.2.0 h1:x584FjTGwHzMwvHx18PXxbBVzfnxogHaAReU4gf13a4=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
-github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
-github.com/kr/pretty v0.3.0 h1:WgNl7dwNpEZ6jJ9k1snq4pZsg7DOEN8hP9Xw0Tsjwk0=
+github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
-github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
-github.com/matryer/is v1.2.0/go.mod h1:2fLPjFQM9rhQ15aVEtbuwhJinnOqrmgXPNdZsdwlWXA=
-github.com/mattbaird/jsonpatch v0.0.0-20200820163806-098863c1fc24 h1:uYuGXJBAi1umT+ZS4oQJUgKtfXCAYTR+n9zw1ViT0vA=
-github.com/mattbaird/jsonpatch v0.0.0-20200820163806-098863c1fc24/go.mod h1:M1qoD/MqPgTZIk0EWKB38wE28ACRfVcn+cU08jyArI0=
+github.com/mattbaird/jsonpatch v0.0.0-20230413205102-771768614e91 h1:JnZSkFP1/GLwKCEuuWVhsacvbDQIVa5BRwAwd+9k2Vw=
+github.com/mattbaird/jsonpatch v0.0.0-20230413205102-771768614e91/go.mod h1:M1qoD/MqPgTZIk0EWKB38wE28ACRfVcn+cU08jyArI0=
 github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU=
 github.com/mattn/go-colorable v0.1.9/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
 github.com/mattn/go-colorable v0.1.12/go.mod h1:u5H1YNBxpqRaxsYJYSkiCWKzEfiAb1Gb520KVy5xxl4=
@@ -282,8 +329,8 @@ github.com/mattn/go-isatty v0.0.3/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNx
 github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU=
 github.com/mattn/go-isatty v0.0.14/go.mod h1:7GGIvUiUoEMVVmxf/4nioHXj79iQHKdU27kJ6hsGG94=
 github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
-github.com/mattn/go-isatty v0.0.17 h1:BTarxUcIeDqL27Mc+vyvdWYSL28zpIhv3RoTdsLMPng=
-github.com/mattn/go-isatty v0.0.17/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
+github.com/mattn/go-isatty v0.0.19 h1:JITubQf0MOLdlGRuRq+jtsDlekdYPia9ZFsB8h/APPA=
+github.com/mattn/go-isatty v0.0.19/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
 github.com/mitchellh/cli v1.1.5 h1:OxRIeJXpAMztws/XHlN2vu6imG5Dpq+j61AzAX5fLng=
 github.com/mitchellh/cli v1.1.5/go.mod h1:v8+iFts2sPIKUV1ltktPXMCC8fumSKFItNcD2cLtRR4=
 github.com/mitchellh/copystructure v1.0.0/go.mod h1:SNtv71yrdKgLRyLFxmLdkAbkKEFWgYaq1OVrnRcwhnw=
@@ -300,36 +347,34 @@ github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RR
 github.com/mitchellh/reflectwalk v1.0.0/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
 github.com/mitchellh/reflectwalk v1.0.2 h1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zxSIeXaQ=
 github.com/mitchellh/reflectwalk v1.0.2/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
-github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno=
 github.com/oklog/run v1.1.0 h1:GEenZ1cK0+q0+wsJew9qUg/DyD8k3JzYsZAi5gYi2mA=
 github.com/oklog/run v1.1.0/go.mod h1:sVPdnTZT1zYwAJeCMu2Th4T21pA3FPOQRfWjQlk7DVU=
-github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pjbgf/sha1cd v0.3.0 h1:4D5XXmUUBUl/xQ6IjCkEAbqXskkq/4O7LmGn0AqMDs4=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/posener/complete v1.1.1 h1:ccV59UEOTzVDnDUEFdT95ZzHVZ+5+158q8+SJb2QV5w=
 github.com/posener/complete v1.1.1/go.mod h1:em0nMJCgc9GFtwrmVmEMR/ZL6WyhyjMBndrE9hABlRI=
+github.com/posener/complete v1.2.3 h1:NP0eAhjcjImqslEwo/1hq7gpajME0fTLTezBKDqfXqo=
+github.com/posener/complete v1.2.3/go.mod h1:WZIdtGGp+qx0sLrYKtIRAruyNpv6hFCicSgv7Sy7s/s=
 github.com/pquerna/otp v1.4.0 h1:wZvl1TIVxKRThZIBiwOOHOGP/1+nZyWBil9Y2XNEDzg=
-github.com/rogpeppe/go-internal v1.9.0 h1:73kH8U+JUqXU8lRuOHeVHaa/SZPifC7BkcraZVejAe8=
-github.com/sergi/go-diff v1.1.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
-github.com/sergi/go-diff v1.2.0 h1:XU+rvMAioB0UC3q1MFrIQy4Vo5/4VsRDQQXHsEya6xQ=
+github.com/rogpeppe/go-internal v1.11.0 h1:cWPaGQEPrBb5/AsnsZesgZZ9yb1OQ+GOISoDNXVBh4M=
+github.com/sergi/go-diff v1.3.1 h1:xkr+Oxo4BOQKmkn/B9eMK0g5Kg/983T9DqqPHwYqD+8=
 github.com/shopspring/decimal v1.2.0/go.mod h1:DKyhrW/HYNuLGql+MJL6WCR6knT2jwCFRcu2hWCYk4o=
 github.com/shopspring/decimal v1.3.1 h1:2Usl1nmF/WZucqkFZhnfFYxxxu8LG21F6nPQBE5gKV8=
 github.com/shopspring/decimal v1.3.1/go.mod h1:DKyhrW/HYNuLGql+MJL6WCR6knT2jwCFRcu2hWCYk4o=
-github.com/sirupsen/logrus v1.4.1/go.mod h1:ni0Sbl8bgC9z8RoU9G6nDWqqs/fq4eDPysMBDgk/93Q=
-github.com/spf13/cast v1.3.1 h1:nFm6S0SMdyzrzcmThSipiEubIDy8WEXKNZ0UOgiRpng=
+github.com/skeema/knownhosts v1.2.0 h1:h9r9cf0+u7wSE+M183ZtMGgOJKiL96brpaz5ekfJCpM=
 github.com/spf13/cast v1.3.1/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE=
+github.com/spf13/cast v1.5.1 h1:R+kOtfhWQE6TVQzY+4D7wJLBgkdVasCEFxSUBYBYIlA=
+github.com/spf13/cast v1.5.1/go.mod h1:b9PdjNptOpzXr7Rq1q9gJML/2cdGQAo69NKzQ10KN48=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
 github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
 github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.2/go.mod h1:R6va5+xMeoiuVRoj+gSkQ7d3FALtqAAGI1FQKckRals=
-github.com/stretchr/testify v1.8.2 h1:+h33VjcLVPDHtOdpUCuF+7gSuG3yGIftsP1YvFihtJ8=
+github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
 github.com/vmihailenco/msgpack v3.3.3+incompatible/go.mod h1:fy3FlTQTDXWkZ7Bh6AcGMlsjHatGryHQYUTf1ShIgkk=
 github.com/vmihailenco/msgpack v4.0.4+incompatible h1:dSLoQfGFAo3F6OoNhwUmLwVgaUXK79GlxNBwueZn0xI=
 github.com/vmihailenco/msgpack v4.0.4+incompatible/go.mod h1:fy3FlTQTDXWkZ7Bh6AcGMlsjHatGryHQYUTf1ShIgkk=
@@ -337,8 +382,7 @@ github.com/vmihailenco/msgpack/v5 v5.3.5 h1:5gO0H1iULLWGhs2H5tbAHIZTV8/cYafcFOr9
 github.com/vmihailenco/msgpack/v5 v5.3.5/go.mod h1:7xyJ9e+0+9SaZT0Wt1RGleJXzli6Q/V5KbhBonMG9jc=
 github.com/vmihailenco/tagparser/v2 v2.0.0 h1:y09buUbR+b5aycVFQs/g70pqKVZNBmxwAhO7/IwNM9g=
 github.com/vmihailenco/tagparser/v2 v2.0.0/go.mod h1:Wri+At7QHww0WTrCBeu4J6bNtoV6mEfg5OIWRZA9qds=
-github.com/xanzy/ssh-agent v0.3.0 h1:wUMzuKtKilRgBAD1sUb8gOwwRr2FGoBVumcjoOACClI=
-github.com/xanzy/ssh-agent v0.3.0/go.mod h1:3s9xbODqPuuhK9JV1R321M/FlMZSBvE5aY6eAcqrDh0=
+github.com/xanzy/ssh-agent v0.3.3 h1:+/15pJfg/RsTxqYcX6fHqOXZwwMP+2VyYWJeWM2qQFM=
 github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU=
 github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb h1:zGWFAtiMcyryUHoUjUJX0/lt1H2+i2Ka2n+D3DImSNo=
 github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU=
@@ -347,110 +391,109 @@ github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415/go.mod h1:
 github.com/xeipuuv/gojsonschema v1.2.0 h1:LhYJRs+L4fBtjZUfuSZIKGeVu0QRy8e5Xi7D17UxZ74=
 github.com/xeipuuv/gojsonschema v1.2.0/go.mod h1:anYRn/JVcOK2ZgGU+IjEV4nwlhoK5sQluxsYJ78Id3Y=
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
-github.com/zclconf/go-cty v1.13.1 h1:0a6bRwuiSHtAmqCqNOE+c2oHgepv0ctoxU4FUe43kwc=
-github.com/zclconf/go-cty v1.13.1/go.mod h1:YKQzy/7pZ7iq2jNFzy5go57xdxdWoLLpaEp4u238AE0=
-go.opentelemetry.io/otel v1.15.1 h1:3Iwq3lfRByPaws0f6bU3naAqOR1n5IeDWd9390kWHa8=
-go.opentelemetry.io/otel v1.15.1/go.mod h1:mHHGEHVDLal6YrKMmk9LqC4a3sF5g+fHfrttQIB1NTc=
-go.opentelemetry.io/otel/trace v1.15.1 h1:uXLo6iHJEzDfrNC0L0mNjItIp06SyaBQxu5t3xMlngY=
-go.opentelemetry.io/otel/trace v1.15.1/go.mod h1:IWdQG/5N1x7f6YUlmdLeJvH9yxtuJAfc4VW5Agv9r/8=
-golang.org/x/crypto v0.0.0-20190219172222-a4c6cb3142f2/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
+github.com/zclconf/go-cty v1.14.0 h1:/Xrd39K7DXbHzlisFP9c4pHao4yyf+/Ug9LEz+Y/yhc=
+github.com/zclconf/go-cty v1.14.0/go.mod h1:VvMs5i0vgZdhYawQNq5kePSpLAoz8u1xvZgrPIxfnZE=
+go.opentelemetry.io/contrib/instrumentation/github.com/aws/aws-sdk-go-v2/otelaws v0.45.0 h1:IheWOjAlqLJB0oRsfy640dvUy4T5ARTohgUKR23705U=
+go.opentelemetry.io/contrib/instrumentation/github.com/aws/aws-sdk-go-v2/otelaws v0.45.0/go.mod h1:uJGvUG+4OT1N41mbAgng0iNdOTvv9chnfavACM2z2DA=
+go.opentelemetry.io/otel v1.19.0 h1:MuS/TNf4/j4IXsZuJegVzI1cwut7Qc00344rgH7p8bs=
+go.opentelemetry.io/otel v1.19.0/go.mod h1:i0QyjOq3UPoTzff0PJB2N66fb4S0+rSbSB15/oyH9fY=
+go.opentelemetry.io/otel/metric v1.19.0 h1:aTzpGtV0ar9wlV4Sna9sdJyII5jTVJEvKETPiOKwvpE=
+go.opentelemetry.io/otel/metric v1.19.0/go.mod h1:L5rUsV9kM1IxCj1MmSdS+JQAcVm319EUrDVLrt7jqt8=
+go.opentelemetry.io/otel/trace v1.19.0 h1:DFVQmlVbfVeOuBRrwdtaehRrWiL1JoVs9CPIQ1Dzxpg=
+go.opentelemetry.io/otel/trace v1.19.0/go.mod h1:mfaSyvGyEJEI0nyV2I4qhNQnbBOUUmYZpYojqMnX2vo=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20200414173820-0848c9571904/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20200820211705-5c72a883971a/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.0.0-20210322153248-0c34fe9e7dc2/go.mod h1:T9bdIzuCu7OtxOm1hfPfRQxPLYneinmdGuTeoZ9dtd4=
-golang.org/x/crypto v0.0.0-20210421170649-83a5a9bb288b/go.mod h1:T9bdIzuCu7OtxOm1hfPfRQxPLYneinmdGuTeoZ9dtd4=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/crypto v0.5.0/go.mod h1:NK/OQwhpMQP3MwtdjgLlYHnH9ebylxKWv3e0fK+mkQU=
-golang.org/x/crypto v0.9.0 h1:LF6fAI+IutBocDJ2OT0Q1g8plpYljMZ4+lty+dsqw3g=
-golang.org/x/crypto v0.9.0/go.mod h1:yrmDGqONDYtNj3tH8X9dzUun2m2lzPa9ngI6/RUPGR0=
-golang.org/x/exp v0.0.0-20230206171751-46f607a40771 h1:xP7rWLUr1e1n2xkK5YB4LI0hPEy3LJC6Wk+D4pGlOJg=
-golang.org/x/exp v0.0.0-20230206171751-46f607a40771/go.mod h1:CxIveKay+FTh1D0yPZemJVgC/95VzuuOLq5Qi4xnoYc=
+golang.org/x/crypto v0.3.0/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
+golang.org/x/crypto v0.3.1-0.20221117191849-2c476679df9a/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
+golang.org/x/crypto v0.7.0/go.mod h1:pYwdfH91IfpZVANVyUOhSIPZaFoJGxTFbZhFTx+dXZU=
+golang.org/x/crypto v0.14.0 h1:wBqGXzWJW6m1XrIKlAH0Hs1JJ7+9KBwnIO8v66Q9cHc=
+golang.org/x/crypto v0.14.0/go.mod h1:MVFd36DqK4CsrnJYDkBA3VC4m2GkXAM0PvzMCn4JQf4=
+golang.org/x/exp v0.0.0-20231006140011-7918f672742d h1:jtJma62tbqLibJ5sFQz8bKtEM8rJBtfilJ2qTU199MI=
+golang.org/x/exp v0.0.0-20231006140011-7918f672742d/go.mod h1:ldy0pHrwJyGW56pPQzzkH36rKxoZW1tw7ZJpeKx+hdo=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
-golang.org/x/mod v0.7.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/mod v0.8.0 h1:LUYupSeNrTNCGzR/hVBk2NHZO4hXcVaW1k4Qx7rjPx8=
 golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/mod v0.13.0 h1:I/DsJXRlw/8l/0c24sM9yb0T4z9liZTduXvdAWYiysY=
+golang.org/x/mod v0.13.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/net v0.0.0-20210326060303-6b1517762897/go.mod h1:uSPa2vr4CLtc/ILN5odXGNXS6mhrKVzTaCXzk9m6W3k=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.1.0/go.mod h1:Cx3nUiGt4eDBEyega/BKRp+/AlGL8hYe7U9odMt2Cco=
-golang.org/x/net v0.5.0/go.mod h1:DivGGAXEgPSlEBzxGzZI+ZLohi+xUj054jfeKui00ws=
-golang.org/x/net v0.10.0 h1:X2//UzNDwYmtCLn7To6G58Wr6f5ahEAQgKNzv9Y951M=
-golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
+golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY=
+golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
+golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc=
+golang.org/x/net v0.17.0 h1:pVaXccu2ozPjCXewfr1S7xza/zcXTity9cCdXQYSjIM=
+golang.org/x/net v0.17.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190507160741-ecd444e8653b/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200116001909-b77594299b42/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200302150141-5c8b2ff67527/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210320140829-1e4c9ba3b0c4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210324051608-47abb6519492/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210502180810-71e4cd670f79/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210927094055-39ccf1dd6fa6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20211007075335-d3039528d8ac/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220503163025-988cb79eb6c6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.4.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.8.0 h1:EBmGv8NaZBZTWvrbjNoL6HVt+IVy3QDQpJs7VRIw3tU=
-golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.3.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.13.0 h1:Af8nKPmuFypiUBjVoU9V20FiaFXOcuZI21p0ycVYYGE=
+golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.1.0/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.4.0/go.mod h1:9P2UbLfCdcvo3p/nzKvsmas4TnlujnuoV9hGgYzW1lQ=
-golang.org/x/term v0.8.0 h1:n5xxQn2i3PC0yLAbjTpNT85q/Kgzcr2gIoX9OrJUols=
+golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
+golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
+golang.org/x/term v0.6.0/go.mod h1:m6U89DPEgQRMq3DNkDClhWw02AUbt2daBVO4cn4Hv9U=
+golang.org/x/term v0.13.0 h1:bb+I9cTfFazGW51MZqBVmZy7+JEJMouUHTUSKVQLBek=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.6.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.9.0 h1:2sjJmO8cDvYveuX97RDLsxlyUxLl+GHoLxBiRdHllBE=
-golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
+golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
+golang.org/x/text v0.8.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
+golang.org/x/text v0.13.0 h1:ablQoSUd0tRdKxZewP80B+BaqeKJuVhuRxj/dkrun3k=
+golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
+golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
+golang.org/x/tools v0.14.0 h1:jvNa2pY0M4r62jkRQ6RwEZZyPcymeL9XZMLBbV7U2nc=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.6.7 h1:FZR1q0exgwxzPzp/aF+VccGrSfxfPpkBqjIIEq3ru6c=
 google.golang.org/appengine v1.6.7/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
-google.golang.org/genproto v0.0.0-20230202175211-008b39050e57 h1:vArvWooPH749rNHpBGgVl+U9B9dATjiEhJzcWGlovNs=
-google.golang.org/genproto v0.0.0-20230202175211-008b39050e57/go.mod h1:RGgjbofJ8xD9Sq1VVhDM1Vok1vRONV+rg+CjzG4SZKM=
-google.golang.org/grpc v1.54.0 h1:EhTqbhiYeixwWQtAEZAxmV9MGqcjEU2mFx52xCzNyag=
-google.golang.org/grpc v1.54.0/go.mod h1:PUSEXI6iWghWaB6lXM4knEgpJNu2qUcKfDtNci3EC2g=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20230807174057-1744710a1577 h1:wukfNtZmZUurLN/atp2hiIeTKn7QJWIQdHzqmsOnAOk=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20230807174057-1744710a1577/go.mod h1:+Bk1OCOj40wS2hwAMA+aCW9ypzm63QTBBHp6lQ3p+9M=
+google.golang.org/grpc v1.57.0 h1:kfzNeI/klCGD2YPMUlaGNT3pxvYfga7smW3Vth8Zsiw=
+google.golang.org/grpc v1.57.0/go.mod h1:Sd+9RMTACXwmub0zcNY2c4arhtrbBYD1AUHI/dt16Mo=
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.30.0 h1:kPPoIgf3TsEvrm0PFe15JQ+570QVxYzEvvHqChK+cng=
-google.golang.org/protobuf v1.30.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
+google.golang.org/protobuf v1.31.0 h1:g0LDEJHgrBl9N9r17Ru3sqWhkIx2NB67okBHPwC7hs8=
+google.golang.org/protobuf v1.31.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
-gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
 gopkg.in/dnaeon/go-vcr.v3 v3.1.2 h1:F1smfXBqQqwpVifDfUBQG6zzaGjzT+EnVZakrOdr5wA=
 gopkg.in/warnings.v0 v0.1.2 h1:wFXVbFY8DY5/xOe1ECiWdKCzZlxgshcYVNkBHstARME=
-gopkg.in/warnings.v0 v0.1.2/go.mod h1:jksf8JmL6Qr/oQM2OXTHunEvvTAsrWBLb6OOjuVWRNI=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
 gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
diff --git a/tools/tfsdk2fw/main.go b/tools/tfsdk2fw/main.go
index 75ff8b29cb4..41bec03ec99 100644
--- a/tools/tfsdk2fw/main.go
+++ b/tools/tfsdk2fw/main.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package main
 
 import (
diff --git a/tools/tfsdk2fw/naming/camel.go b/tools/tfsdk2fw/naming/camel.go
index 09d88b0959f..7adb3b0b64a 100644
--- a/tools/tfsdk2fw/naming/camel.go
+++ b/tools/tfsdk2fw/naming/camel.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package naming
 
 import (
diff --git a/tools/tfsdk2fw/naming/camel_test.go b/tools/tfsdk2fw/naming/camel_test.go
index 0f743838c06..d6803409df9 100644
--- a/tools/tfsdk2fw/naming/camel_test.go
+++ b/tools/tfsdk2fw/naming/camel_test.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package naming_test
 
 import (
diff --git a/version/version.go b/version/version.go
index 081f1948ffe..19de2550b44 100644
--- a/version/version.go
+++ b/version/version.go
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package version
 
 // ProviderVersion is set during the release process to the release version of the binary
diff --git a/website/allowed-subcategories.txt b/website/allowed-subcategories.txt
index 09921f32f4d..595a376b35b 100644
--- a/website/allowed-subcategories.txt
+++ b/website/allowed-subcategories.txt
@@ -3,51 +3,36 @@ ACM (Certificate Manager)
 ACM PCA (Certificate Manager Private Certificate Authority)
 AMP (Managed Prometheus)
 API Gateway
-API Gateway Management API
 API Gateway V2
 Account Management
-Alexa for Business
+Amazon Bedrock
 Amplify
-Amplify Backend
-Amplify UI Builder
 App Mesh
 App Runner
 AppConfig
-AppConfig Data
 AppFlow
 AppIntegrations
 AppStream 2.0
 AppSync
 Application Auto Scaling
-Application Cost Profiler
-Application Discovery
-Application Migration (Mgn)
 Athena
 Audit Manager
 Auto Scaling
 Auto Scaling Plans
 Backup
-Backup Gateway
 Batch
-Billing Conductor
-Braket
 CE (Cost Explorer)
 Chime
-Chime SDK Identity
 Chime SDK Media Pipelines
-Chime SDK Meetings
-Chime SDK Messaging
 Chime SDK Voice
 Clean Rooms
 Cloud Control API
-Cloud Directory
 Cloud Map
 Cloud9
 CloudFormation
 CloudFront
 CloudHSM
 CloudSearch
-CloudSearch Domain
 CloudTrail
 CloudWatch
 CloudWatch Application Insights
@@ -59,37 +44,27 @@ CloudWatch RUM
 CloudWatch Synthetics
 CodeArtifact
 CodeBuild
+CodeCatalyst
 CodeCommit
 CodeDeploy
-CodeGuru Profiler
 CodeGuru Reviewer
 CodePipeline
-CodeStar
 CodeStar Connections
 CodeStar Notifications
 Cognito IDP (Identity Provider)
 Cognito Identity
-Cognito Sync
 Comprehend
-Comprehend Medical
 Compute Optimizer
 Config
 Connect
-Connect Contact Lens
-Connect Customer Profiles
-Connect Participant
-Connect Voice ID
-Connect Wisdom
 Control Tower
 Cost and Usage Report
 DLM (Data Lifecycle Manager)
 DMS (Database Migration)
-DRS (Elastic Disaster Recovery)
 Data Exchange
 Data Pipeline
 DataSync
 Detective
-DevOps Guru
 Device Farm
 Direct Connect
 Directory Service
@@ -97,12 +72,9 @@ DocumentDB
 DocumentDB Elastic
 DynamoDB
 DynamoDB Accelerator (DAX)
-DynamoDB Streams
 EBS (EC2)
-EBS (Elastic Block Store)
 EC2 (Elastic Compute Cloud)
 EC2 Image Builder
-EC2 Instance Connect
 ECR (Elastic Container Registry)
 ECR Public
 ECS (Elastic Container)
@@ -115,17 +87,13 @@ EMR Containers
 EMR Serverless
 ElastiCache
 Elastic Beanstalk
-Elastic Inference
 Elastic Transcoder
 Elasticsearch
 Elemental MediaConnect
 Elemental MediaConvert
 Elemental MediaLive
 Elemental MediaPackage
-Elemental MediaPackage VOD
 Elemental MediaStore
-Elemental MediaStore Data
-Elemental MediaTailor
 EventBridge
 EventBridge Pipes
 EventBridge Scheduler
@@ -134,42 +102,21 @@ FIS (Fault Injection Simulator)
 FMS (Firewall Manager)
 FSx
 FinSpace
-FinSpace Data
-Forecast
-Forecast Query
-Fraud Detector
 GameLift
 Global Accelerator
 Glue
-Glue DataBrew
-Ground Station
 GuardDuty
-Health
 HealthLake
-Honeycode
 IAM (Identity & Access Management)
 IAM Access Analyzer
 IVS (Interactive Video)
 IVS (Interactive Video) Chat
 Inspector
 Inspector Classic
-IoT 1-Click Devices
-IoT 1-Click Projects
 IoT Analytics
 IoT Core
-IoT Data Plane
-IoT Device Management
 IoT Events
-IoT Events Data
-IoT Fleet Hub
 IoT Greengrass
-IoT Greengrass V2
-IoT Jobs Data Plane
-IoT Secure Tunneling
-IoT SiteWise
-IoT Things Graph
-IoT TwinMaker
-IoT Wireless
 KMS (Key Management)
 Kendra
 Keyspaces (for Apache Cassandra)
@@ -178,84 +125,46 @@ Kinesis Analytics
 Kinesis Analytics V2
 Kinesis Firehose
 Kinesis Video
-Kinesis Video Archived Media
-Kinesis Video Media
-Kinesis Video Signaling
 Lake Formation
 Lambda
 Lex Model Building
-Lex Models V2
-Lex Runtime
-Lex Runtime V2
+Lex V2 Models
 License Manager
 Lightsail
 Location
-Lookout for Equipment
-Lookout for Metrics
-Lookout for Vision
 MQ
-MTurk (Mechanical Turk)
 MWAA (Managed Workflows for Apache Airflow)
-Machine Learning
 Macie
-Macie Classic
-Managed Blockchain
 Managed Grafana
 Managed Streaming for Kafka
 Managed Streaming for Kafka Connect
-Marketplace Catalog
-Marketplace Commerce Analytics
-Marketplace Entitlement
-Marketplace Metering
 MemoryDB for Redis
 Meta Data Sources
-MgH (Migration Hub)
-Migration Hub Config
-Migration Hub Refactor Spaces
-Migration Hub Strategy
-Mobile
 Neptune
 Network Firewall
 Network Manager
-Nimble Studio
 OpenSearch
 OpenSearch Serverless
 OpsWorks
-OpsWorks CM
 Organizations
 Outposts
 Outposts (EC2)
-Panorama
-Personalize
-Personalize Events
-Personalize Runtime
 Pinpoint
-Pinpoint Email
-Pinpoint SMS and Voice
-Polly
 Pricing Calculator
-Proton
 QLDB (Quantum Ledger Database)
-QLDB Session
 QuickSight
 RAM (Resource Access Manager)
 RDS (Relational Database)
-RDS Data
-RDS Performance Insights (PI)
 Recycle Bin (RBin)
 Redshift
 Redshift Data
 Redshift Serverless
-Rekognition
-Resilience Hub
 Resource Explorer
 Resource Groups
 Resource Groups Tagging
-RoboMaker
 Roles Anywhere
 Route 53
 Route 53 Domains
-Route 53 Recovery Cluster
 Route 53 Recovery Control Config
 Route 53 Recovery Readiness
 Route 53 Resolver
@@ -267,61 +176,41 @@ SDB (SimpleDB)
 SES (Simple Email)
 SESv2 (Simple Email V2)
 SFN (Step Functions)
-SMS (Server Migration)
 SNS (Simple Notification)
 SQS (Simple Queue)
 SSM (Systems Manager)
 SSM Contacts
 SSM Incident Manager Incidents
-SSO (Single Sign-On)
 SSO Admin
 SSO Identity Store
-SSO OIDC
 STS (Security Token)
 SWF (Simple Workflow)
 SageMaker
-SageMaker A2I (Augmented AI)
-SageMaker Edge Manager
-SageMaker Feature Store Runtime
-SageMaker Runtime
-Savings Plans
 Secrets Manager
 Security Hub
 Security Lake
 Serverless Application Repository
 Service Catalog
-Service Catalog AppRegistry
 Service Quotas
 Shield
 Signer
-Snow Device Management
-Snow Family
 Storage Gateway
-Support
-Textract
-Timestream Query
 Timestream Write
 Transcribe
-Transcribe Streaming
 Transfer Family
 Transit Gateway
-Translate
 VPC (Virtual Private Cloud)
 VPC IPAM (IP Address Manager)
 VPC Lattice
 VPN (Client)
 VPN (Site-to-Site)
 Verified Access
+Verified Permissions
 WAF
 WAF Classic
 WAF Classic Regional
 Wavelength
 Web Services Budgets
-Well-Architected Tool
-WorkDocs
 WorkLink
-WorkMail
-WorkMail Message Flow
 WorkSpaces
-WorkSpaces Web
 X-Ray
diff --git a/website/docs/cdktf/python/d/acm_certificate.html.markdown b/website/docs/cdktf/python/d/acm_certificate.html.markdown
new file mode 100644
index 00000000000..b9ca22a4914
--- /dev/null
+++ b/website/docs/cdktf/python/d/acm_certificate.html.markdown
@@ -0,0 +1,67 @@
+---
+subcategory: "ACM (Certificate Manager)"
+layout: "aws"
+page_title: "AWS: aws_acm_certificate"
+description: |-
+  Get information on a Amazon Certificate Manager (ACM) Certificate
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_acm_certificate
+
+Use this data source to get the ARN of a certificate in AWS Certificate
+Manager (ACM), you can reference
+it by domain without having to hard code the ARNs as input.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_acm_certificate import DataAwsAcmCertificate
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsAcmCertificate(self, "amazon_issued",
+            domain="tf.example.com",
+            most_recent=True,
+            types=["AMAZON_ISSUED"]
+        )
+        DataAwsAcmCertificate(self, "issued",
+            domain="tf.example.com",
+            statuses=["ISSUED"]
+        )
+        DataAwsAcmCertificate(self, "rsa_4096",
+            domain="tf.example.com",
+            key_types=["RSA_4096"]
+        )
+```
+
+## Argument Reference
+
+* `domain` - (Required) Domain of the certificate to look up. If no certificate is found with this name, an error will be returned.
+* `key_types` - (Optional) List of key algorithms to filter certificates. By default, ACM does not return all certificate types when searching. See the [ACM API Reference](https://docs.aws.amazon.com/acm/latest/APIReference/API_CertificateDetail.html#ACM-Type-CertificateDetail-KeyAlgorithm) for supported key algorithms.
+* `statuses` - (Optional) List of statuses on which to filter the returned list. Valid values are `PENDING_VALIDATION`, `ISSUED`,
+   `INACTIVE`, `EXPIRED`, `VALIDATION_TIMED_OUT`, `REVOKED` and `FAILED`. If no value is specified, only certificates in the `ISSUED` state
+   are returned.
+* `types` - (Optional) List of types on which to filter the returned list. Valid values are `AMAZON_ISSUED`, `PRIVATE`, and `IMPORTED`.
+* `most_recent` - (Optional) If set to true, it sorts the certificates matched by previous criteria by the NotBefore field, returning only the most recent one. If set to false, it returns an error if more than one certificate is found. Defaults to false.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the found certificate, suitable for referencing in other resources that support ACM certificates.
+* `id` - ARN of the found certificate, suitable for referencing in other resources that support ACM certificates.
+* `status` - Status of the found certificate.
+* `certificate` - ACM-issued certificate.
+* `certificate_chain` - Certificates forming the requested ACM-issued certificate's chain of trust. The chain consists of the certificate of the issuing CA and the intermediate certificates of any other subordinate CAs.
+* `tags` - Mapping of tags for the resource.
+
+<!-- cache-key: cdktf-0.18.0 input-0827f19734f2b9d26e0cb7f069a9c6094d49e933890f68cd0c6364c65af42e86 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/acmpca_certificate.html.markdown b/website/docs/cdktf/python/d/acmpca_certificate.html.markdown
new file mode 100644
index 00000000000..a950685f6dd
--- /dev/null
+++ b/website/docs/cdktf/python/d/acmpca_certificate.html.markdown
@@ -0,0 +1,49 @@
+---
+subcategory: "ACM PCA (Certificate Manager Private Certificate Authority)"
+layout: "aws"
+page_title: "AWS: aws_acmpca_certificate"
+description: |-
+  Get information on a Certificate issued by a AWS Certificate Manager Private Certificate Authority
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_acmpca_certificate
+
+Get information on a Certificate issued by a AWS Certificate Manager Private Certificate Authority.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_acmpca_certificate import DataAwsAcmpcaCertificate
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsAcmpcaCertificate(self, "example",
+            arn="arn:aws:acm-pca:us-east-1:123456789012:certificate-authority/12345678-1234-1234-1234-123456789012/certificate/1234b4a0d73e2056789bdbe77d5b1a23",
+            certificate_authority_arn="arn:aws:acm-pca:us-east-1:123456789012:certificate-authority/12345678-1234-1234-1234-123456789012"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `arn` - (Required) ARN of the certificate issued by the private certificate authority.
+* `certificate_authority_arn` - (Required) ARN of the certificate authority.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `certificate` - PEM-encoded certificate value.
+* `certificate_chain` - PEM-encoded certificate chain that includes any intermediate certificates and chains up to root CA.
+
+<!-- cache-key: cdktf-0.18.0 input-f7804d061124fc6489bcc7d11d155c5a561ad1fe6aac3da7e0bdce8a5bdbf606 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/acmpca_certificate_authority.html.markdown b/website/docs/cdktf/python/d/acmpca_certificate_authority.html.markdown
new file mode 100644
index 00000000000..7e6e334471d
--- /dev/null
+++ b/website/docs/cdktf/python/d/acmpca_certificate_authority.html.markdown
@@ -0,0 +1,65 @@
+---
+subcategory: "ACM PCA (Certificate Manager Private Certificate Authority)"
+layout: "aws"
+page_title: "AWS: aws_acmpca_certificate_authority"
+description: |-
+  Get information on a AWS Certificate Manager Private Certificate Authority
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_acmpca_certificate_authority
+
+Get information on a AWS Certificate Manager Private Certificate Authority (ACM PCA Certificate Authority).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_acmpca_certificate_authority import DataAwsAcmpcaCertificateAuthority
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsAcmpcaCertificateAuthority(self, "example",
+            arn="arn:aws:acm-pca:us-east-1:123456789012:certificate-authority/12345678-1234-1234-1234-123456789012"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `arn` - (Required) ARN of the certificate authority.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - ARN of the certificate authority.
+* `certificate` - Base64-encoded certificate authority (CA) certificate. Only available after the certificate authority certificate has been imported.
+* `certificate_chain` - Base64-encoded certificate chain that includes any intermediate certificates and chains up to root on-premises certificate that you used to sign your private CA certificate. The chain does not include your private CA certificate. Only available after the certificate authority certificate has been imported.
+* `certificate_signing_request` - The base64 PEM-encoded certificate signing request (CSR) for your private CA certificate.
+* `usage_mode` - Specifies whether the CA issues general-purpose certificates that typically require a revocation mechanism, or short-lived certificates that may optionally omit revocation because they expire quickly.
+* `not_after` - Date and time after which the certificate authority is not valid. Only available after the certificate authority certificate has been imported.
+* `not_before` - Date and time before which the certificate authority is not valid. Only available after the certificate authority certificate has been imported.
+* `revocation_configuration` - Nested attribute containing revocation configuration.
+    * `revocation_configuration.0.crl_configuration` - Nested attribute containing configuration of the certificate revocation list (CRL), if any, maintained by the certificate authority.
+        * `revocation_configuration.0.crl_configuration.0.custom_cname` - Name inserted into the certificate CRL Distribution Points extension that enables the use of an alias for the CRL distribution point.
+        * `revocation_configuration.0.crl_configuration.0.enabled` - Boolean value that specifies whether certificate revocation lists (CRLs) are enabled.
+        * `revocation_configuration.0.crl_configuration.0.expiration_in_days` - Number of days until a certificate expires.
+        * `revocation_configuration.0.crl_configuration.0.s3_bucket_name` - Name of the S3 bucket that contains the CRL.
+        * `revocation_configuration.0.crl_configuration.0.s3_object_acl` - Whether the CRL is publicly readable or privately held in the CRL Amazon S3 bucket.
+        * `revocation_configuration.0.ocsp_configuration.0.enabled` - Boolean value that specifies whether a custom OCSP responder is enabled.
+        * `revocation_configuration.0.ocsp_configuration.0.ocsp_custom_cname` - A CNAME specifying a customized OCSP domain.
+* `serial` - Serial number of the certificate authority. Only available after the certificate authority certificate has been imported.
+* `status` - Status of the certificate authority.
+* `tags` - Key-value map of user-defined tags that are attached to the certificate authority.
+* `type` - Type of the certificate authority.
+
+<!-- cache-key: cdktf-0.18.0 input-bc455641e95958e404dd0619abf86e9d1dc1b0604b9b489c29ed39db56a62037 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/ami.html.markdown b/website/docs/cdktf/python/d/ami.html.markdown
new file mode 100644
index 00000000000..75121ee05b1
--- /dev/null
+++ b/website/docs/cdktf/python/d/ami.html.markdown
@@ -0,0 +1,142 @@
+---
+subcategory: "EC2 (Elastic Compute Cloud)"
+layout: "aws"
+page_title: "AWS: aws_ami"
+description: |-
+  Get information on an Amazon Machine Image (AMI).
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_ami
+
+Use this data source to get the ID of a registered AMI for use in other
+resources.
+
+## Example Usage
+
+```terraform
+data "aws_ami" "example" {
+  executable_users = ["self"]
+  most_recent      = true
+  name_regex       = "^myami-\\d{3}"
+  owners           = ["self"]
+
+  filter {
+    name   = "name"
+    values = ["myami-*"]
+  }
+
+  filter {
+    name   = "root-device-type"
+    values = ["ebs"]
+  }
+
+  filter {
+    name   = "virtualization-type"
+    values = ["hvm"]
+  }
+}
+```
+
+## Argument Reference
+
+* `owners` - (Optional) List of AMI owners to limit search. Valid values: an AWS account ID, `self` (the current account), or an AWS owner alias (e.g., `amazon`, `aws-marketplace`, `microsoft`).
+
+* `most_recent` - (Optional) If more than one result is returned, use the most
+recent AMI.
+
+* `executable_users` - (Optional) Limit search to users with *explicit* launch permission on
+ the image. Valid items are the numeric account ID or `self`.
+
+* `include_deprecated` - (Optional) If true, all deprecated AMIs are included in the response. If false, no deprecated AMIs are included in the response. If no value is specified, the default value is false.
+
+* `filter` - (Optional) One or more name/value pairs to filter off of. There are
+several valid keys, for a full reference, check out
+[describe-images in the AWS CLI reference][1].
+
+* `name_regex` - (Optional) Regex string to apply to the AMI list returned
+by AWS. This allows more advanced filtering not supported from the AWS API. This
+filtering is done locally on what AWS returns, and could have a performance
+impact if the result is large. Combine this with other
+options to narrow down the list AWS returns.
+
+~> **NOTE:** If more or less than a single match is returned by the search,
+Terraform will fail. Ensure that your search is specific enough to return
+a single AMI ID only, or use `most_recent` to choose the most recent one. If
+you want to match multiple AMIs, use the `aws_ami_ids` data source instead.
+
+## Attribute Reference
+
+`id` is set to the ID of the found AMI. In addition, the following attributes
+are exported:
+
+~> **NOTE:** Some values are not always set and may not be available for
+interpolation.
+
+* `arn` - ARN of the AMI.
+* `architecture` - OS architecture of the AMI (ie: `i386` or `x86_64`).
+* `boot_mode` - Boot mode of the image.
+* `block_device_mappings` - Set of objects with block device mappings of the AMI.
+    * `device_name` - Physical name of the device.
+    * `ebs` - Map containing EBS information, if the device is EBS based. Unlike most object attributes, these are accessed directly (e.g., `ebs.volume_size` or `ebs["volume_size"]`) rather than accessed through the first element of a list (e.g., `ebs[0].volume_size`).
+        * `delete_on_termination` - `true` if the EBS volume will be deleted on termination.
+        * `encrypted` - `true` if the EBS volume is encrypted.
+        * `iops` - `0` if the EBS volume is not a provisioned IOPS image, otherwise the supported IOPS count.
+        * `snapshot_id` - The ID of the snapshot.
+        * `volume_size` - The size of the volume, in GiB.
+        * `throughput` - The throughput that the EBS volume supports, in MiB/s.
+        * `volume_type` - The volume type.
+    * `no_device` - Suppresses the specified device included in the block device mapping of the AMI.
+    * `virtual_name` - Virtual device name (for instance stores).
+* `creation_date` - Date and time the image was created.
+* `deprecation_time` - Date and time when the image will be deprecated.
+* `description` - Description of the AMI that was provided during image
+  creation.
+* `hypervisor` - Hypervisor type of the image.
+* `image_id` - ID of the AMI. Should be the same as the resource `id`.
+* `image_location` - Location of the AMI.
+* `image_owner_alias` - AWS account alias (for example, `amazon`, `self`) or
+  the AWS account ID of the AMI owner.
+* `image_type` - Type of image.
+* `imds_support` - Instance Metadata Service (IMDS) support mode for the image. Set to `v2.0` if instances ran from this image enforce IMDSv2.
+* `kernel_id` - Kernel associated with the image, if any. Only applicable
+  for machine images.
+* `name` - Name of the AMI that was provided during image creation.
+* `owner_id` - AWS account ID of the image owner.
+* `platform` - Value is Windows for `Windows` AMIs; otherwise blank.
+* `product_codes` - Any product codes associated with the AMI.
+    * `product_codes.#.product_code_id` - The product code.
+    * `product_codes.#.product_code_type` - The type of product code.
+* `public` - `true` if the image has public launch permissions.
+* `ramdisk_id` - RAM disk associated with the image, if any. Only applicable
+  for machine images.
+* `root_device_name` - Device name of the root device.
+* `root_device_type` - Type of root device (ie: `ebs` or `instance-store`).
+* `root_snapshot_id` - Snapshot id associated with the root device, if any
+  (only applies to `ebs` root devices).
+* `sriov_net_support` - Whether enhanced networking is enabled.
+* `state` - Current state of the AMI. If the state is `available`, the image
+  is successfully registered and can be used to launch an instance.
+* `state_reason` - Describes a state change. Fields are `UNSET` if not available.
+    * `state_reason.code` - The reason code for the state change.
+    * `state_reason.message` - The message for the state change.
+* `tags` - Any tags assigned to the image.
+    * `tags.#.key` - Key name of the tag.
+    * `tags.#.value` - Value of the tag.
+* `tpm_support` - If the image is configured for NitroTPM support, the value is `v2.0`.
+* `virtualization_type` - Type of virtualization of the AMI (ie: `hvm` or
+  `paravirtual`).
+* `usage_operation` - Operation of the Amazon EC2 instance and the billing code that is associated with the AMI.
+* `platform_details` - Platform details associated with the billing code of the AMI.
+* `ena_support` - Whether enhanced networking with ENA is enabled.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `20m`)
+
+[1]: http://docs.aws.amazon.com/cli/latest/reference/ec2/describe-images.html
+
+<!-- cache-key: cdktf-0.18.0 input-b27379b47e46b092af0eb0d0592f4690caa729d66535c1d3f2706e8aa24bff38 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/ami_ids.html.markdown b/website/docs/cdktf/python/d/ami_ids.html.markdown
new file mode 100644
index 00000000000..969dba19422
--- /dev/null
+++ b/website/docs/cdktf/python/d/ami_ids.html.markdown
@@ -0,0 +1,74 @@
+---
+subcategory: "EC2 (Elastic Compute Cloud)"
+layout: "aws"
+page_title: "AWS: aws_ami_ids"
+description: |-
+  Provides a list of AMI IDs.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_ami_ids
+
+Use this data source to get a list of AMI IDs matching the specified criteria.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_ami_ids import DataAwsAmiIds
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsAmiIds(self, "ubuntu",
+            filter=[DataAwsAmiIdsFilter(
+                name="name",
+                values=["ubuntu/images/ubuntu-*-*-amd64-server-*"]
+            )
+            ],
+            owners=["099720109477"]
+        )
+```
+
+## Argument Reference
+
+* `owners` - (Required) List of AMI owners to limit search. At least 1 value must be specified. Valid values: an AWS account ID, `self` (the current account), or an AWS owner alias (e.g., `amazon`, `aws-marketplace`, `microsoft`).
+
+* `executable_users` - (Optional) Limit search to users with *explicit* launch
+permission on  the image. Valid items are the numeric account ID or `self`.
+
+* `filter` - (Optional) One or more name/value pairs to filter off of. There
+are several valid keys, for a full reference, check out
+[describe-images in the AWS CLI reference][1].
+
+* `name_regex` - (Optional) Regex string to apply to the AMI list returned
+by AWS. This allows more advanced filtering not supported from the AWS API.
+This filtering is done locally on what AWS returns, and could have a performance
+impact if the result is large. Combine this with other
+options to narrow down the list AWS returns.
+
+* `sort_ascending` - (Optional) Used to sort AMIs by creation time.
+If no value is specified, the default value is `false`.
+
+* `include_deprecated` - (Optional) If true, all deprecated AMIs are included in the response.
+If false, no deprecated AMIs are included in the response. If no value is specified, the default value is `false`.
+
+## Attribute Reference
+
+`ids` is set to the list of AMI IDs, sorted by creation time according to `sort_ascending`.
+
+[1]: http://docs.aws.amazon.com/cli/latest/reference/ec2/describe-images.html
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `20m`)
+
+<!-- cache-key: cdktf-0.18.0 input-df8435503c645904f83640627b35c5031003b38da5f178afcb6e456e7076b481 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/api_gateway_api_key.html.markdown b/website/docs/cdktf/python/d/api_gateway_api_key.html.markdown
new file mode 100644
index 00000000000..365de61e983
--- /dev/null
+++ b/website/docs/cdktf/python/d/api_gateway_api_key.html.markdown
@@ -0,0 +1,53 @@
+---
+subcategory: "API Gateway"
+layout: "aws"
+page_title: "AWS: aws_api_gateway_api_key"
+description: |-
+  Get information on an API Gateway REST API Key
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_api_gateway_api_key
+
+Use this data source to get the name and value of a pre-existing API Key, for
+example to supply credentials for a dependency microservice.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_api_gateway_api_key import DataAwsApiGatewayApiKey
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsApiGatewayApiKey(self, "my_api_key",
+            id="ru3mpjgse6"
+        )
+```
+
+## Argument Reference
+
+* `id` - (Required) ID of the API Key to look up.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - Set to the ID of the API Key.
+* `name` - Set to the name of the API Key.
+* `value` - Set to the value of the API Key.
+* `created_date` - Date and time when the API Key was created.
+* `last_updated_date` - Date and time when the API Key was last updated.
+* `customer_id` - Amazon Web Services Marketplace customer identifier, when integrating with the Amazon Web Services SaaS Marketplace.
+* `description` - Description of the API Key.
+* `enabled` - Whether the API Key is enabled.
+* `tags` - Map of tags for the resource.
+
+<!-- cache-key: cdktf-0.18.0 input-a00d9aabc0922f53098450b1d3c7279484b52526cb4756e4cbbf4ebf71cc4ed2 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/api_gateway_authorizer.html.markdown b/website/docs/cdktf/python/d/api_gateway_authorizer.html.markdown
new file mode 100644
index 00000000000..df48303005a
--- /dev/null
+++ b/website/docs/cdktf/python/d/api_gateway_authorizer.html.markdown
@@ -0,0 +1,57 @@
+---
+subcategory: "API Gateway"
+layout: "aws"
+page_title: "AWS: aws_api_gateway_authorizer"
+description: |-
+  Provides details about a specific API Gateway Authorizer.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_api_gateway_authorizer
+
+Provides details about a specific API Gateway Authorizer.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_api_gateway_authorizer import DataAwsApiGatewayAuthorizer
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsApiGatewayAuthorizer(self, "example",
+            authorizer_id=Token.as_string(
+                Fn.lookup_nested(data_aws_api_gateway_authorizers_example.ids, ["0"])),
+            rest_api_id=Token.as_string(aws_api_gateway_rest_api_example.id)
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `authorizer_id` - (Required) Authorizer identifier.
+* `rest_api_id` - (Required) ID of the associated REST API.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the API Gateway Authorizer.
+* `authorizer_credentials` - Credentials required for the authorizer.
+* `authorizer_result_ttl_in_seconds` - TTL of cached authorizer results in seconds.
+* `authorizer_uri` - Authorizer's Uniform Resource Identifier (URI).
+* `identity_source` - Source of the identity in an incoming request.
+* `identity_validation_expression` - Validation expression for the incoming identity.
+* `name` - Name of the authorizer.
+* `provider_arns` - List of the Amazon Cognito user pool ARNs.
+* `type` - Type of the authorizer.
+
+<!-- cache-key: cdktf-0.18.0 input-7c505056a62ecddc8f4337cf059da361268167b1838c9f6ea4a6d78a7e84dfe3 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/api_gateway_authorizers.html.markdown b/website/docs/cdktf/python/d/api_gateway_authorizers.html.markdown
new file mode 100644
index 00000000000..3ed3542a09e
--- /dev/null
+++ b/website/docs/cdktf/python/d/api_gateway_authorizers.html.markdown
@@ -0,0 +1,46 @@
+---
+subcategory: "API Gateway"
+layout: "aws"
+page_title: "AWS: aws_api_gateway_authorizers"
+description: |-
+  Provides details about multiple API Gateway Authorizers.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_api_gateway_authorizers
+
+Provides details about multiple API Gateway Authorizers.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_api_gateway_authorizers import DataAwsApiGatewayAuthorizers
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsApiGatewayAuthorizers(self, "example",
+            rest_api_id=Token.as_string(aws_api_gateway_rest_api_example.id)
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `rest_api_id` - (Required) ID of the associated REST API.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `ids` - List of Authorizer identifiers.
+
+<!-- cache-key: cdktf-0.18.0 input-c3a17d70af9b0ac8d5e391a543335f1243e9dec902c7497cf1df2083482e833c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/api_gateway_domain_name.html.markdown b/website/docs/cdktf/python/d/api_gateway_domain_name.html.markdown
new file mode 100644
index 00000000000..a4f784822a1
--- /dev/null
+++ b/website/docs/cdktf/python/d/api_gateway_domain_name.html.markdown
@@ -0,0 +1,57 @@
+---
+subcategory: "API Gateway"
+layout: "aws"
+page_title: "AWS: aws_api_gateway_domain_name"
+description: |-
+ Get information on a custom domain name for use with AWS API Gateway.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_api_gateway_domain_name
+
+Use this data source to get the custom domain name for use with AWS API Gateway.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_api_gateway_domain_name import DataAwsApiGatewayDomainName
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsApiGatewayDomainName(self, "example",
+            domain_name="api.example.com"
+        )
+```
+
+## Argument Reference
+
+* `domain_name` - (Required) Fully-qualified domain name to look up. If no domain name is found, an error will be returned.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the found custom domain name.
+* `certificate_arn` - ARN for an AWS-managed certificate that is used by edge-optimized endpoint for this domain name.
+* `certificate_name` - Name of the certificate that is used by edge-optimized endpoint for this domain name.
+* `certificate_upload_date` - Upload date associated with the domain certificate.
+* `cloudfront_domain_name` - Hostname created by Cloudfront to represent the distribution that implements this domain name mapping.
+* `cloudfront_zone_id` - For convenience, the hosted zone ID (`Z2FDTNDATAQYW2`) that can be used to create a Route53 alias record for the distribution.
+* `endpoint_configuration` - List of objects with the endpoint configuration of this domain name.
+    * `types` - List of endpoint types.
+* `regional_certificate_arn` - ARN for an AWS-managed certificate that is used for validating the regional domain name.
+* `regional_certificate_name` - User-friendly name of the certificate that is used by regional endpoint for this domain name.
+* `regional_domain_name` - Hostname for the custom domain's regional endpoint.
+* `regional_zone_id` - Hosted zone ID that can be used to create a Route53 alias record for the regional endpoint.
+* `security_policy` - Security policy for the domain name.
+* `tags` - Key-value map of tags for the resource.
+
+<!-- cache-key: cdktf-0.18.0 input-ec3ad0e8dda61e42fd75917952379778e983a6bf94a2c3f251ea482b57cbc3ed -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/api_gateway_export.html.markdown b/website/docs/cdktf/python/d/api_gateway_export.html.markdown
new file mode 100644
index 00000000000..3cb6be3e1d5
--- /dev/null
+++ b/website/docs/cdktf/python/d/api_gateway_export.html.markdown
@@ -0,0 +1,51 @@
+---
+subcategory: "API Gateway"
+layout: "aws"
+page_title: "AWS: aws_api_gateway_export"
+description: |-
+  Get information on an API Gateway REST API Key
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_api_gateway_export
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_api_gateway_export import DataAwsApiGatewayExport
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsApiGatewayExport(self, "example",
+            export_type="oas30",
+            rest_api_id=Token.as_string(aws_api_gateway_stage_example.rest_api_id),
+            stage_name=Token.as_string(aws_api_gateway_stage_example.stage_name)
+        )
+```
+
+## Argument Reference
+
+* `export_type` - (Required) Type of export. Acceptable values are `oas30` for OpenAPI 3.0.x and `swagger` for Swagger/OpenAPI 2.0.
+* `rest_api_id` - (Required) Identifier of the associated REST API.
+* `stage_name` - (Required) Name of the Stage that will be exported.
+* `accepts` - (Optional) Content-type of the export. Valid values are `application/json` and `application/yaml` are supported for `export_type` `ofoas30` and `swagger`.
+* `parameters` - (Optional) Key-value map of query string parameters that specify properties of the export. the following parameters are supported: `extensions='integrations'` or `extensions='apigateway'` will export the API with x-amazon-apigateway-integration extensions. `extensions='authorizers'` will export the API with x-amazon-apigateway-authorizer extensions.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - The `REST-API-ID:STAGE-NAME`
+* `body` - API Spec.
+* `content_type` - Content-type header value in the HTTP response.
+* `content_disposition` - Content-disposition header value in the HTTP response.
+
+<!-- cache-key: cdktf-0.18.0 input-c510075eea42189371d3ef965a6842b44146a7635515b8e6bc3e2af00098b481 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/api_gateway_resource.html.markdown b/website/docs/cdktf/python/d/api_gateway_resource.html.markdown
new file mode 100644
index 00000000000..2eebfb420ab
--- /dev/null
+++ b/website/docs/cdktf/python/d/api_gateway_resource.html.markdown
@@ -0,0 +1,53 @@
+---
+subcategory: "API Gateway"
+layout: "aws"
+page_title: "AWS: aws_api_gateway_resource"
+description: |-
+  Get information on a API Gateway Resource
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_api_gateway_resource
+
+Use this data source to get the id of a Resource in API Gateway.
+To fetch the Resource, you must provide the REST API id as well as the full path.  
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_api_gateway_resource import DataAwsApiGatewayResource
+from imports.aws.data_aws_api_gateway_rest_api import DataAwsApiGatewayRestApi
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        my_rest_api = DataAwsApiGatewayRestApi(self, "my_rest_api",
+            name="my-rest-api"
+        )
+        DataAwsApiGatewayResource(self, "my_resource",
+            path="/endpoint/path",
+            rest_api_id=Token.as_string(my_rest_api.id)
+        )
+```
+
+## Argument Reference
+
+* `rest_api_id` - (Required) REST API id that owns the resource. If no REST API is found, an error will be returned.
+* `path` - (Required) Full path of the resource.  If no path is found, an error will be returned.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - Set to the ID of the found Resource.
+* `parent_id` - Set to the ID of the parent Resource.
+* `path_part` - Set to the path relative to the parent Resource.
+
+<!-- cache-key: cdktf-0.18.0 input-de42d4fd9ee5838ea57bf49335869fd7bec10ba3cea3b7e525af92359ab7bd14 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/api_gateway_rest_api.html.markdown b/website/docs/cdktf/python/d/api_gateway_rest_api.html.markdown
new file mode 100644
index 00000000000..d7173e012ba
--- /dev/null
+++ b/website/docs/cdktf/python/d/api_gateway_rest_api.html.markdown
@@ -0,0 +1,57 @@
+---
+subcategory: "API Gateway"
+layout: "aws"
+page_title: "AWS: aws_api_gateway_rest_api"
+description: |-
+  Get information on a API Gateway REST API
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_api_gateway_rest_api
+
+Use this data source to get the id and root_resource_id of a REST API in
+API Gateway. To fetch the REST API you must provide a name to match against.
+As there is no unique name constraint on REST APIs this data source will
+error if there is more than one match.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_api_gateway_rest_api import DataAwsApiGatewayRestApi
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsApiGatewayRestApi(self, "my_rest_api",
+            name="my-rest-api"
+        )
+```
+
+## Argument Reference
+
+* `name` - (Required) Name of the REST API to look up. If no REST API is found with this name, an error will be returned. If multiple REST APIs are found with this name, an error will be returned.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `api_key_source` - Source of the API key for requests.
+* `arn` - ARN of the REST API.
+* `binary_media_types` - List of binary media types supported by the REST API.
+* `description` - Description of the REST API.
+* `endpoint_configuration` - The endpoint configuration of this RestApi showing the endpoint types of the API.
+* `execution_arn` - Execution ARN part to be used in [`lambda_permission`](/docs/providers/aws/r/lambda_permission.html)'s `source_arn` when allowing API Gateway to invoke a Lambda function, e.g., `arn:aws:execute-api:eu-west-2:123456789012:z4675bid1j`, which can be concatenated with allowed stage, method and resource path.
+* `id` - Set to the ID of the found REST API.
+* `minimum_compression_size` - Minimum response size to compress for the REST API.
+* `policy` - JSON formatted policy document that controls access to the API Gateway.
+* `root_resource_id` - Set to the ID of the API Gateway Resource on the found REST API where the route matches '/'.
+* `tags` - Key-value map of resource tags.
+
+<!-- cache-key: cdktf-0.18.0 input-f58dd0e8318def3e704471e581c407920560534f1c0b60ba367ee144e50a3888 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/api_gateway_sdk.html.markdown b/website/docs/cdktf/python/d/api_gateway_sdk.html.markdown
new file mode 100644
index 00000000000..ee6f56ec485
--- /dev/null
+++ b/website/docs/cdktf/python/d/api_gateway_sdk.html.markdown
@@ -0,0 +1,56 @@
+---
+subcategory: "API Gateway"
+layout: "aws"
+page_title: "AWS: aws_api_gateway_sdk"
+description: |-
+  Gets an API Gateway client SDK
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_api_gateway_sdk
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_api_gateway_sdk import DataAwsApiGatewaySdk
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsApiGatewaySdk(self, "example",
+            parameters={
+                "artifact_id": "example",
+                "artifact_version": "example",
+                "group_id": "example",
+                "invoker_package": "example"
+            },
+            rest_api_id=Token.as_string(aws_api_gateway_stage_example.rest_api_id),
+            sdk_type="android",
+            stage_name=Token.as_string(aws_api_gateway_stage_example.stage_name)
+        )
+```
+
+## Argument Reference
+
+* `rest_api_id` - (Required) Identifier of the associated REST API.
+* `stage_name` - (Required) Name of the Stage that will be exported.
+* `sdk_type` - (Required) Language for the generated SDK. Currently `java`, `javascript`, `android`, `objectivec` (for iOS), `swift` (for iOS), and `ruby` are supported.
+* `parameters` - (Optional) Key-value map of query string parameters `sdk_type` properties of the SDK. For SDK Type of `objectivec` or `swift`, a parameter named `classPrefix` is required. For SDK Type of `android`, parameters named `groupId`, `artifactId`, `artifactVersion`, and `invokerPackage` are required. For SDK Type of `java`, parameters named `serviceName` and `javaPackageName` are required.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - The `REST-API-ID:STAGE-NAME`
+* `body` - SDK as a string.
+* `content_type` - Content-type header value in the HTTP response.
+* `content_disposition` - Content-disposition header value in the HTTP response.
+
+<!-- cache-key: cdktf-0.18.0 input-ed1f26956d947879c351283b69f137259d03aa3d3365cfd1ed2dbc55a4d3774e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/api_gateway_vpc_link.html.markdown b/website/docs/cdktf/python/d/api_gateway_vpc_link.html.markdown
new file mode 100644
index 00000000000..6b5ee5ade68
--- /dev/null
+++ b/website/docs/cdktf/python/d/api_gateway_vpc_link.html.markdown
@@ -0,0 +1,53 @@
+---
+subcategory: "API Gateway"
+layout: "aws"
+page_title: "AWS: aws_api_gateway_vpc_link"
+description: |-
+  Get information on a API Gateway VPC Link
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_api_gateway_vpc_link
+
+Use this data source to get the id of a VPC Link in
+API Gateway. To fetch the VPC Link you must provide a name to match against.
+As there is no unique name constraint on API Gateway VPC Links this data source will
+error if there is more than one match.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_api_gateway_vpc_link import DataAwsApiGatewayVpcLink
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsApiGatewayVpcLink(self, "my_api_gateway_vpc_link",
+            name="my-vpc-link"
+        )
+```
+
+## Argument Reference
+
+* `name` - (Required) Name of the API Gateway VPC Link to look up. If no API Gateway VPC Link is found with this name, an error will be returned.
+ If multiple API Gateway VPC Links are found with this name, an error will be returned.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - Set to the ID of the found API Gateway VPC Link.
+* `description` - Description of the VPC link.
+* `status` - Status of the VPC link.
+* `status_message` - Status message of the VPC link.
+* `target_arns` - List of network load balancer arns in the VPC targeted by the VPC link. Currently AWS only supports 1 target.
+* `tags` - Key-value map of resource tags
+
+<!-- cache-key: cdktf-0.18.0 input-b5278dc46deda6987341a0eea118c91f7f9e8d4ab7dbcf2deaf2fce3bb8b0ca2 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/apigatewayv2_api.html.markdown b/website/docs/cdktf/python/d/apigatewayv2_api.html.markdown
new file mode 100644
index 00000000000..361389a1629
--- /dev/null
+++ b/website/docs/cdktf/python/d/apigatewayv2_api.html.markdown
@@ -0,0 +1,73 @@
+---
+subcategory: "API Gateway V2"
+layout: "aws"
+page_title: "AWS: aws_apigatewayv2_api"
+description: |-
+  Provides details about a specific Amazon API Gateway Version 2 API.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_apigatewayv2_api
+
+Provides details about a specific Amazon API Gateway Version 2 API.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_apigatewayv2_api import DataAwsApigatewayv2Api
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsApigatewayv2Api(self, "example",
+            api_id="aabbccddee"
+        )
+```
+
+## Argument Reference
+
+The arguments of this data source act as filters for querying the available APIs in the current region.
+The given filters must match exactly one API whose data will be exported as attributes.
+
+This argument supports the following arguments:
+
+* `api_id` - (Required) API identifier.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `api_endpoint` - URI of the API, of the form `https://{api-id}.execute-api.{region}.amazonaws.com` for HTTP APIs and `wss://{api-id}.execute-api.{region}.amazonaws.com` for WebSocket APIs.
+* `api_key_selection_expression` - An [API key selection expression](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-websocket-api-selection-expressions.html#apigateway-websocket-api-apikey-selection-expressions).
+Applicable for WebSocket APIs.
+* `arn` - ARN of the API.
+* `cors_configuration` - Cross-origin resource sharing (CORS) [configuration](https://docs.aws.amazon.com/apigateway/latest/developerguide/http-api-cors.html).
+Applicable for HTTP APIs.
+* `description` - Description of the API.
+* `disable_execute_api_endpoint` - Whether clients can invoke the API by using the default `execute-api` endpoint.
+* `execution_arn` - ARN prefix to be used in an [`aws_lambda_permission`](/docs/providers/aws/r/lambda_permission.html)'s `source_arn` attribute
+or in an [`aws_iam_policy`](/docs/providers/aws/r/iam_policy.html) to authorize access to the [`@connections` API](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-how-to-call-websocket-api-connections.html).
+See the [Amazon API Gateway Developer Guide](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-websocket-control-access-iam.html) for details.
+* `name` - Name of the API.
+* `protocol_type` - API protocol.
+* `route_selection_expression` - The [route selection expression](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-websocket-api-selection-expressions.html#apigateway-websocket-api-route-selection-expressions) for the API.
+* `tags` - Map of resource tags.
+* `version` - Version identifier for the API.
+
+The `cors_configuration` object supports the following:
+
+* `allow_credentials` - Whether credentials are included in the CORS request.
+* `allow_headers` - Set of allowed HTTP headers.
+* `allow_methods` - Set of allowed HTTP methods.
+* `allow_origins` - Set of allowed origins.
+* `expose_headers` - Set of exposed HTTP headers.
+* `max_age` - Number of seconds that the browser should cache preflight request results.
+
+<!-- cache-key: cdktf-0.18.0 input-476586bb733fc0bcc5e9d7e9c2f79656a99a92d47ca1c6953fdfd3eeeab546d6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/apigatewayv2_apis.html.markdown b/website/docs/cdktf/python/d/apigatewayv2_apis.html.markdown
new file mode 100644
index 00000000000..4260a1675a7
--- /dev/null
+++ b/website/docs/cdktf/python/d/apigatewayv2_apis.html.markdown
@@ -0,0 +1,49 @@
+---
+subcategory: "API Gateway V2"
+layout: "aws"
+page_title: "AWS: aws_apigatewayv2_apis"
+description: |-
+  Provides details about multiple Amazon API Gateway Version 2 APIs.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_apigatewayv2_apis
+
+Provides details about multiple Amazon API Gateway Version 2 APIs.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_apigatewayv2_apis import DataAwsApigatewayv2Apis
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsApigatewayv2Apis(self, "example",
+            protocol_type="HTTP"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Optional) API name.
+* `protocol_type` - (Optional) API protocol.
+* `tags` - (Optional) Map of tags, each pair of which must exactly match
+  a pair on the desired APIs.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `ids` - Set of API identifiers.
+
+<!-- cache-key: cdktf-0.18.0 input-a7653185a80a5e9399fb3e9d08f770ad4a08a7d1b822a172fdc6e2674fc1dd03 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/apigatewayv2_export.html.markdown b/website/docs/cdktf/python/d/apigatewayv2_export.html.markdown
new file mode 100644
index 00000000000..d8ef6c3e6f1
--- /dev/null
+++ b/website/docs/cdktf/python/d/apigatewayv2_export.html.markdown
@@ -0,0 +1,54 @@
+---
+subcategory: "API Gateway V2"
+layout: "aws"
+page_title: "AWS: aws_apigatewayv2_export"
+description: |-
+  Exports a definition of an API in a particular output format and specification.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_apigatewayv2_export
+
+Exports a definition of an API in a particular output format and specification.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_apigatewayv2_export import DataAwsApigatewayv2Export
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsApigatewayv2Export(self, "test",
+            api_id=Token.as_string(aws_apigatewayv2_route_test.api_id),
+            output_type="JSON",
+            specification="OAS30"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `api_id` - (Required) API identifier.
+* `specification` - (Required) Version of the API specification to use. `OAS30`, for OpenAPI 3.0, is the only supported value.
+* `output_type` - (Required) Output type of the exported definition file. Valid values are `JSON` and `YAML`.
+* `export_version` - (Optional) Version of the API Gateway export algorithm. API Gateway uses the latest version by default. Currently, the only supported version is `1.0`.
+* `include_extensions` - (Optional) Whether to include API Gateway extensions in the exported API definition. API Gateway extensions are included by default.
+* `stage_name` - (Optional) Name of the API stage to export. If you don't specify this property, a representation of the latest API configuration is exported.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - API identifier.
+* `body` - ID of the API.
+
+<!-- cache-key: cdktf-0.18.0 input-6480a64e749693f83cf73592ca35d58ca5a49b6e975099c338b5341415898a74 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/appconfig_configuration_profile.html.markdown b/website/docs/cdktf/python/d/appconfig_configuration_profile.html.markdown
new file mode 100644
index 00000000000..ce4ccfc5ee9
--- /dev/null
+++ b/website/docs/cdktf/python/d/appconfig_configuration_profile.html.markdown
@@ -0,0 +1,59 @@
+---
+subcategory: "AppConfig"
+layout: "aws"
+page_title: "AWS: aws_appconfig_configuration_profile"
+description: |-
+  Terraform data source for managing an AWS AppConfig Configuration Profile.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_appconfig_configuration_profile
+
+Provides access to an AppConfig Configuration Profile.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_appconfig_configuration_profile import DataAwsAppconfigConfigurationProfile
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsAppconfigConfigurationProfile(self, "example",
+            application_id="b5d5gpj",
+            configuration_profile_id="qrbb1c1"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `application_id` - (Required) ID of the AppConfig application to which this configuration profile belongs.
+* `configuration_profile_id` - (Required) ID of the Configuration Profile.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Configuration Profile.
+* `description` - Description of the Configuration Profile.
+* `id` - AppConfig Configuration Profile ID and Application ID separated by a colon `(:)`.
+* `location_uri` - Location URI of the Configuration Profile.
+* `name` - Name of the Configuration Profile.
+* `retrieval_role_arn` - ARN of an IAM role with permission to access the configuration at the specified location_uri.
+* `tags` - Map of tags for the resource.
+* `validator` - Nested list of methods for validating the configuration.
+    * `content` - Either the JSON Schema content or the ARN of an AWS Lambda function.
+    * `type` - Type of validator. Valid values: JSON_SCHEMA and LAMBDA.
+
+<!-- cache-key: cdktf-0.18.0 input-812d16f674999964ab6b67e20ad1395ac161f98caaa88682a62205246057f321 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/appconfig_configuration_profiles.html.markdown b/website/docs/cdktf/python/d/appconfig_configuration_profiles.html.markdown
new file mode 100644
index 00000000000..0cc3ae861b7
--- /dev/null
+++ b/website/docs/cdktf/python/d/appconfig_configuration_profiles.html.markdown
@@ -0,0 +1,64 @@
+---
+subcategory: "AppConfig"
+layout: "aws"
+page_title: "AWS: aws_appconfig_configuration_profiles"
+description: |-
+    Terraform data source for managing an AWS AppConfig Configuration Profiles.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_appconfig_configuration_profiles
+
+Provides access to all Configuration Properties for an AppConfig Application. This will allow you to pass Configuration
+Profile IDs to another resource.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformIterator, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_appconfig_configuration_profile import DataAwsAppconfigConfigurationProfile
+from imports.aws.data_aws_appconfig_configuration_profiles import DataAwsAppconfigConfigurationProfiles
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = DataAwsAppconfigConfigurationProfiles(self, "example",
+            application_id="a1d3rpe"
+        )
+        # In most cases loops should be handled in the programming language context and
+        #     not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+        #     you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+        #     you need to keep this like it is.
+        example_for_each_iterator = TerraformIterator.from_list(
+            Token.as_any(example.configuration_profile_ids))
+        data_aws_appconfig_configuration_profile_example =
+        DataAwsAppconfigConfigurationProfile(self, "example_1",
+            application_id=Token.as_string(aws_appconfig_application_example.id),
+            configuration_profile_id=Token.as_string(example_for_each_iterator.value),
+            for_each=example_for_each_iterator
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_appconfig_configuration_profile_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `application_id` - (Required) ID of the AppConfig Application.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `configuration_profile_ids` - Set of Configuration Profile IDs associated with the AppConfig Application.
+
+<!-- cache-key: cdktf-0.18.0 input-b4fc2e385f4cf8f2b77339adbebe9e03369792e3c761bb5599667ff5bad6268d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/appconfig_environment.html.markdown b/website/docs/cdktf/python/d/appconfig_environment.html.markdown
new file mode 100644
index 00000000000..ad976c9e2db
--- /dev/null
+++ b/website/docs/cdktf/python/d/appconfig_environment.html.markdown
@@ -0,0 +1,58 @@
+---
+subcategory: "AppConfig"
+layout: "aws"
+page_title: "AWS: aws_appconfig_environment"
+description: |-
+  Terraform data source for managing an AWS AppConfig Environment.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_appconfig_environment
+
+Provides access to an AppConfig Environment.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_appconfig_environment import DataAwsAppconfigEnvironment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsAppconfigEnvironment(self, "example",
+            application_id="b5d5gpj",
+            environment_id="qrbb1c1"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `application_id` - (Required) ID of the AppConfig Application to which this Environment belongs.
+* `environment_id` - (Required) ID of the AppConfig Environment.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the environment.
+* `name` - Name of the environment.
+* `description` - Name of the environment.
+* `monitor` - Set of Amazon CloudWatch alarms to monitor during the deployment process.
+    * `alarm_arn` - ARN of the Amazon CloudWatch alarm.
+    * `alarm_role_arn` - ARN of an IAM role for AWS AppConfig to monitor.
+* `state` - State of the environment. Possible values are `READY_FOR_DEPLOYMENT`, `DEPLOYING`, `ROLLING_BACK`
+  or `ROLLED_BACK`.
+* `tags` - Map of tags for the resource.
+
+<!-- cache-key: cdktf-0.18.0 input-2536eae28938ccf1a8bf0a1e33718611d0fbfe4294f71a133d77dbe21bc83180 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/appconfig_environments.html.markdown b/website/docs/cdktf/python/d/appconfig_environments.html.markdown
new file mode 100644
index 00000000000..64574b32062
--- /dev/null
+++ b/website/docs/cdktf/python/d/appconfig_environments.html.markdown
@@ -0,0 +1,49 @@
+---
+subcategory: "AppConfig"
+layout: "aws"
+page_title: "AWS: aws_appconfig_environments"
+description: |-
+    Terraform data source for managing an AWS AppConfig Environments.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_appconfig_environments
+
+Provides access to all Environments for an AppConfig Application. This will allow you to pass Environment IDs to another
+resource.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_appconfig_environments import DataAwsAppconfigEnvironments
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsAppconfigEnvironments(self, "example",
+            application_id="a1d3rpe"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `application_id` - (Required) ID of the AppConfig Application.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `environment_ids` - Set of Environment IDs associated with this AppConfig Application.
+
+<!-- cache-key: cdktf-0.18.0 input-b2458ae100264c5acfd0fedda3d10f3ece761d168943b6b933cee8edcda8140a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/appintegrations_event_integration.html.markdown b/website/docs/cdktf/python/d/appintegrations_event_integration.html.markdown
new file mode 100644
index 00000000000..9232ee93164
--- /dev/null
+++ b/website/docs/cdktf/python/d/appintegrations_event_integration.html.markdown
@@ -0,0 +1,57 @@
+---
+subcategory: "AppIntegrations"
+layout: "aws"
+page_title: "AWS: aws_appintegrations_event_integration"
+description: |-
+  Provides details about an Amazon AppIntegrations Event Integration
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_appintegrations_event_integration
+
+Use this data source to get information on an existing AppIntegrations Event Integration.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_appintegrations_event_integration import DataAwsAppintegrationsEventIntegration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsAppintegrationsEventIntegration(self, "example",
+            name="example"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) The AppIntegrations Event Integration name.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the AppIntegrations Event Integration.
+* `description` - The description of the Event Integration.
+* `eventbridge_bus` - The EventBridge bus.
+* `event_filter` - A block that defines the configuration information for the event filter. The Event Filter block is documented below.
+* `id` - The identifier of the Event Integration which is the name of the Event Integration.
+* `tags` - Metadata that you can assign to help organize the report plans you create.
+
+### Event Filter Attributes
+
+`event_filter` has the following attributes:
+
+* `source` - The source of the events.
+
+<!-- cache-key: cdktf-0.18.0 input-a2b07db4d9622e0a173d852d4b149d44bf0fa8466934be1d6bb261c76d08e4c8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/appmesh_gateway_route.html.markdown b/website/docs/cdktf/python/d/appmesh_gateway_route.html.markdown
new file mode 100644
index 00000000000..7635ef29606
--- /dev/null
+++ b/website/docs/cdktf/python/d/appmesh_gateway_route.html.markdown
@@ -0,0 +1,56 @@
+---
+subcategory: "App Mesh"
+layout: "aws"
+page_title: "AWS: aws_appmesh_gateway_route"
+description: |-
+    Terraform data source for managing an AWS App Mesh Gateway Route.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_appmesh_gateway_route
+
+The App Mesh Gateway Route data source allows details of an App Mesh Gateway Route to be retrieved by its name, mesh_name, virtual_gateway_name, and optionally the mesh_owner.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_appmesh_gateway_route import DataAwsAppmeshGatewayRoute
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsAppmeshGatewayRoute(self, "test",
+            mesh_name="test-mesh",
+            name="test-route",
+            virtual_gateway_name="test-gateway"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name of the gateway route.
+* `mesh_name` - (Required) Name of the service mesh in which the virtual gateway exists.
+* `virtual_gateway_name` - (Required) Name of the virtual gateway in which the route exists.
+* `mesh_owner` - (Optional) AWS account ID of the service mesh's owner.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the gateway route.
+* `created_date` - Creation date of the gateway route.
+* `last_updated_date` - Last update date of the gateway route.
+* `resource_owner` - Resource owner's AWS account ID.
+* `spec` - Gateway route specification. See the [`aws_appmesh_gateway_route`](/docs/providers/aws/r/appmesh_gateway_route.html#spec) resource for details.
+* `tags` - Map of tags.
+
+<!-- cache-key: cdktf-0.18.0 input-a279c1138eda25f1a8fb5b8ea47e76c0ee2a8f2f9f4074a26d68a453bf070c31 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/appmesh_mesh.html.markdown b/website/docs/cdktf/python/d/appmesh_mesh.html.markdown
new file mode 100644
index 00000000000..dc947173bf2
--- /dev/null
+++ b/website/docs/cdktf/python/d/appmesh_mesh.html.markdown
@@ -0,0 +1,72 @@
+---
+subcategory: "App Mesh"
+layout: "aws"
+page_title: "AWS: aws_appmesh_mesh"
+description: |-
+    Terraform data source for managing an AWS App Mesh Mesh.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_appmesh_mesh
+
+The App Mesh Mesh data source allows details of an App Mesh Mesh to be retrieved by its name and optionally the mesh_owner.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_appmesh_mesh import DataAwsAppmeshMesh
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsAppmeshMesh(self, "simple",
+            name="simpleapp"
+        )
+```
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_appmesh_mesh import DataAwsAppmeshMesh
+from imports.aws.data_aws_caller_identity import DataAwsCallerIdentity
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        current = DataAwsCallerIdentity(self, "current")
+        DataAwsAppmeshMesh(self, "simple",
+            mesh_owner=Token.as_string(current.account_id),
+            name="simpleapp"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name of the service mesh.
+* `mesh_owner` - (Optional) AWS account ID of the service mesh's owner.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the service mesh.
+* `created_date` - Creation date of the service mesh.
+* `last_updated_date` - Last update date of the service mesh.
+* `resource_owner` - Resource owner's AWS account ID.
+* `spec` - Service mesh specification. See the [`aws_appmesh_mesh`](/docs/providers/aws/r/appmesh_mesh.html#spec) resource for details.
+* `tags` - Map of tags.
+
+<!-- cache-key: cdktf-0.18.0 input-d7824d065f1b548e8cd5d250543a8080d2008466f819e3d452bc45287fb64d1d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/appmesh_route.html.markdown b/website/docs/cdktf/python/d/appmesh_route.html.markdown
new file mode 100644
index 00000000000..eae2e018917
--- /dev/null
+++ b/website/docs/cdktf/python/d/appmesh_route.html.markdown
@@ -0,0 +1,56 @@
+---
+subcategory: "App Mesh"
+layout: "aws"
+page_title: "AWS: aws_appmesh_route"
+description: |-
+    Terraform data source for managing an AWS App Mesh Route.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_appmesh_route
+
+The App Mesh Route data source allows details of an App Mesh Route to be retrieved by its name, mesh_name, virtual_router_name, and optionally the mesh_owner.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_appmesh_virtual_service import DataAwsAppmeshVirtualService
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsAppmeshVirtualService(self, "test",
+            mesh_name="test-mesh",
+            name="test-route",
+            virtual_router_name="test-router"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name of the route.
+* `mesh_name` - (Required) Name of the service mesh in which the virtual router exists.
+* `virtual_router_name` - (Required) Name of the virtual router in which the route exists.
+* `mesh_owner` - (Optional) AWS account ID of the service mesh's owner.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the route.
+* `created_date` - Creation date of the route.
+* `last_updated_date` - Last update date of the route.
+* `resource_owner` - Resource owner's AWS account ID.
+* `spec` - Route specification. See the [`aws_appmesh_route`](/docs/providers/aws/r/appmesh_route.html#spec) resource for details.
+* `tags` - Map of tags.
+
+<!-- cache-key: cdktf-0.18.0 input-61db8b34997ce89b5e11e05c9df80c6e3a3a0f5ad3176a86fce3a94bba27ce62 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/appmesh_virtual_gateway.html.markdown b/website/docs/cdktf/python/d/appmesh_virtual_gateway.html.markdown
new file mode 100644
index 00000000000..3f79c25d922
--- /dev/null
+++ b/website/docs/cdktf/python/d/appmesh_virtual_gateway.html.markdown
@@ -0,0 +1,77 @@
+---
+subcategory: "App Mesh"
+layout: "aws"
+page_title: "AWS: aws_appmesh_virtual_gateway"
+description: |-
+  Terraform data source for managing an AWS App Mesh Virtual Gateway.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_appmesh_virtual_gateway
+
+Terraform data source for managing an AWS App Mesh Virtual Gateway.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_appmesh_virtual_gateway import DataAwsAppmeshVirtualGateway
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsAppmeshVirtualGateway(self, "example",
+            mesh_name="mesh-gateway",
+            name="example-mesh"
+        )
+```
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_appmesh_virtual_gateway import DataAwsAppmeshVirtualGateway
+from imports.aws.data_aws_caller_identity import DataAwsCallerIdentity
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        current = DataAwsCallerIdentity(self, "current")
+        DataAwsAppmeshVirtualGateway(self, "test",
+            mesh_name="example-mesh",
+            mesh_owner=Token.as_string(current.account_id),
+            name="example.mesh.local"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) Name of the virtual gateway.
+* `mesh_name` - (Required) Name of the service mesh in which the virtual gateway exists.
+* `mesh_owner` - (Optional) AWS account ID of the service mesh's owner.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the virtual gateway.
+* `created_date` - Creation date of the virtual gateway.
+* `last_updated_date` - Last update date of the virtual gateway.
+* `resource_owner` - Resource owner's AWS account ID.
+* `spec` - Virtual gateway specification. See the [`aws_appmesh_virtual_gateway`](/docs/providers/aws/r/appmesh_virtual_gateway.html#spec) resource for details.
+* `tags` - Map of tags.
+
+<!-- cache-key: cdktf-0.18.0 input-a538bcbf642443121e211852f127911c6109e4baf18bd72f5915c80b62936a13 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/appmesh_virtual_node.html.markdown b/website/docs/cdktf/python/d/appmesh_virtual_node.html.markdown
new file mode 100644
index 00000000000..755542cecaf
--- /dev/null
+++ b/website/docs/cdktf/python/d/appmesh_virtual_node.html.markdown
@@ -0,0 +1,54 @@
+---
+subcategory: "App Mesh"
+layout: "aws"
+page_title: "AWS: aws_appmesh_virtual_node"
+description: |-
+    Terraform data source for managing an AWS App Mesh Virtual Node.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_appmesh_virtual_node
+
+Terraform data source for managing an AWS App Mesh Virtual Node.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_appmesh_virtual_node import DataAwsAppmeshVirtualNode
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsAppmeshVirtualNode(self, "test",
+            mesh_name="example-mesh",
+            name="serviceBv1"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name of the virtual node.
+* `mesh_name` - (Required) Name of the service mesh in which the virtual node exists.
+* `mesh_owner` - (Optional) AWS account ID of the service mesh's owner.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the virtual node.
+* `created_date` - Creation date of the virtual node.
+* `last_updated_date` - Last update date of the virtual node.
+* `resource_owner` - Resource owner's AWS account ID.
+* `spec` - Virtual node specification. See the [`aws_appmesh_virtual_node`](/docs/providers/aws/r/appmesh_virtual_node.html#spec) resource for details.
+* `tags` - Map of tags.
+
+<!-- cache-key: cdktf-0.18.0 input-0af250ec57ad7c06ff9123a832f3205783a39694eff720e32b0655ce7952fa68 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/appmesh_virtual_router.html.markdown b/website/docs/cdktf/python/d/appmesh_virtual_router.html.markdown
new file mode 100644
index 00000000000..72b0c5ae896
--- /dev/null
+++ b/website/docs/cdktf/python/d/appmesh_virtual_router.html.markdown
@@ -0,0 +1,53 @@
+---
+subcategory: "App Mesh"
+layout: "aws"
+page_title: "AWS: aws_appmesh_virtual_router"
+description: |-
+    Terraform data source for managing an AWS App Mesh Virtual Router.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_appmesh_virtual_router
+
+The App Mesh Virtual Router data source allows details of an App Mesh Virtual Service to be retrieved by its name and mesh_name.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_appmesh_virtual_router import DataAwsAppmeshVirtualRouter
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsAppmeshVirtualRouter(self, "test",
+            mesh_name="example-mesh-name",
+            name="example-router-name"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name of the virtual router.
+* `mesh_name` - (Required) Name of the mesh in which the virtual router exists
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the virtual router.
+* `created_date` - Creation date of the virtual router.
+* `last_updated_date` - Last update date of the virtual router.
+* `resource_owner` - Resource owner's AWS account ID.
+* `spec` - Virtual routers specification. See the [`aws_appmesh_virtual_router`](/docs/providers/aws/r/appmesh_virtual_router.html#spec) resource for details.
+* `tags` - Map of tags.
+
+<!-- cache-key: cdktf-0.18.0 input-09267d7d4084baeb433ba4250023e9410012cd2645c2c7f14eb2ee7f754980ad -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/appmesh_virtual_service.html.markdown b/website/docs/cdktf/python/d/appmesh_virtual_service.html.markdown
new file mode 100644
index 00000000000..fce41dc3ffb
--- /dev/null
+++ b/website/docs/cdktf/python/d/appmesh_virtual_service.html.markdown
@@ -0,0 +1,75 @@
+---
+subcategory: "App Mesh"
+layout: "aws"
+page_title: "AWS: aws_appmesh_virtual_service"
+description: |-
+    Terraform data source for managing an AWS App Mesh Virtual Service.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_appmesh_virtual_service
+
+The App Mesh Virtual Service data source allows details of an App Mesh Virtual Service to be retrieved by its name, mesh_name, and optionally the mesh_owner.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_appmesh_virtual_service import DataAwsAppmeshVirtualService
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsAppmeshVirtualService(self, "test",
+            mesh_name="example-mesh",
+            name="example.mesh.local"
+        )
+```
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_appmesh_virtual_service import DataAwsAppmeshVirtualService
+from imports.aws.data_aws_caller_identity import DataAwsCallerIdentity
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        current = DataAwsCallerIdentity(self, "current")
+        DataAwsAppmeshVirtualService(self, "test",
+            mesh_name="example-mesh",
+            mesh_owner=Token.as_string(current.account_id),
+            name="example.mesh.local"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name of the virtual service.
+* `mesh_name` - (Required) Name of the service mesh in which the virtual service exists.
+* `mesh_owner` - (Optional) AWS account ID of the service mesh's owner.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the virtual service.
+* `created_date` - Creation date of the virtual service.
+* `last_updated_date` - Last update date of the virtual service.
+* `resource_owner` - Resource owner's AWS account ID.
+* `spec` - Virtual service specification. See the [`aws_appmesh_virtual_service`](/docs/providers/aws/r/appmesh_virtual_service.html#spec) resource for details.
+* `tags` - Map of tags.
+
+<!-- cache-key: cdktf-0.18.0 input-a9e88eca01bcb0655a9491489c66102bdf389f472af4c3044e98fbafbd11d67d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/arn.html.markdown b/website/docs/cdktf/python/d/arn.html.markdown
new file mode 100644
index 00000000000..c938428fd8f
--- /dev/null
+++ b/website/docs/cdktf/python/d/arn.html.markdown
@@ -0,0 +1,56 @@
+---
+subcategory: "Meta Data Sources"
+layout: "aws"
+page_title: "AWS: aws_arn"
+description: |-
+    Parses an ARN into its constituent parts.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_arn
+
+Parses an ARN into its constituent parts.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_arn import DataAwsArn
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsArn(self, "db_instance",
+            arn="arn:aws:rds:eu-west-1:123456789012:db:mysql-db"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `arn` - (Required) ARN to parse.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `partition` - Partition that the resource is in.
+
+* `service` - The [service namespace](https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html#genref-aws-service-namespaces) that identifies the AWS product.
+
+* `region` - Region the resource resides in.
+Note that the ARNs for some resources do not require a region, so this component might be omitted.
+
+* `account` - The [ID](https://docs.aws.amazon.com/general/latest/gr/acct-identifiers.html) of the AWS account that owns the resource, without the hyphens.
+
+* `resource` - Content of this part of the ARN varies by service.
+It often includes an indicator of the type of resource—for example, an IAM user or Amazon RDS database —followed by a slash (/) or a colon (:), followed by the resource name itself.
+
+<!-- cache-key: cdktf-0.18.0 input-440ccf3a9b006a55df02867b675efa529ed16c151a5b0875e321f0dd97d87344 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/auditmanager_control.html.markdown b/website/docs/cdktf/python/d/auditmanager_control.html.markdown
new file mode 100644
index 00000000000..2d9aa2718f4
--- /dev/null
+++ b/website/docs/cdktf/python/d/auditmanager_control.html.markdown
@@ -0,0 +1,92 @@
+---
+subcategory: "Audit Manager"
+layout: "aws"
+page_title: "AWS: aws_auditmanager_control"
+description: |-
+  Terraform data source for managing an AWS Audit Manager Control.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_auditmanager_control
+
+Terraform data source for managing an AWS Audit Manager Control.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_auditmanager_control import DataAwsAuditmanagerControl
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsAuditmanagerControl(self, "example",
+            name="1. Risk Management",
+            type="Standard"
+        )
+```
+
+### With Framework Resource
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.auditmanager_framework import AuditmanagerFramework
+from imports.aws.data_aws_auditmanager_control import DataAwsAuditmanagerControl
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = DataAwsAuditmanagerControl(self, "example",
+            name="1. Risk Management",
+            type="Standard"
+        )
+        example2 = DataAwsAuditmanagerControl(self, "example2",
+            name="2. Personnel",
+            type="Standard"
+        )
+        aws_auditmanager_framework_example = AuditmanagerFramework(self, "example_2",
+            control_sets=[AuditmanagerFrameworkControlSets(
+                controls=[AuditmanagerFrameworkControlSetsControls(
+                    id=Token.as_string(example.id)
+                )
+                ],
+                name="example"
+            ), AuditmanagerFrameworkControlSets(
+                controls=[AuditmanagerFrameworkControlSetsControls(
+                    id=Token.as_string(example2.id)
+                )
+                ],
+                name="example2"
+            )
+            ],
+            name="example"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_auditmanager_framework_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) Name of the control.
+* `type` - (Required) Type of control. Valid values are `Custom` and `Standard`.
+
+## Attribute Reference
+
+See the [`aws_auditmanager_control` resource](/docs/providers/aws/r/auditmanager_control.html) for details on the returned attributes - they are identical.
+
+<!-- cache-key: cdktf-0.18.0 input-3db48c85023c8e29684006da94ab0858a40f92b8fb222869b34399953eba3333 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/auditmanager_framework.html.markdown b/website/docs/cdktf/python/d/auditmanager_framework.html.markdown
new file mode 100644
index 00000000000..f7e16d85ac3
--- /dev/null
+++ b/website/docs/cdktf/python/d/auditmanager_framework.html.markdown
@@ -0,0 +1,48 @@
+---
+subcategory: "Audit Manager"
+layout: "aws"
+page_title: "AWS: aws_auditmanager_framework"
+description: |-
+  Terraform data source for managing an AWS Audit Manager Framework.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_auditmanager_framework
+
+Terraform data source for managing an AWS Audit Manager Framework.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_auditmanager_framework import DataAwsAuditmanagerFramework
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsAuditmanagerFramework(self, "example",
+            framework_type="Standard",
+            name="Essential Eight"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) Name of the framework.
+* `type` - (Required) Type of framework. Valid values are `Custom` and `Standard`.
+
+## Attribute Reference
+
+See the [`aws_auditmanager_framework` resource](/docs/providers/aws/r/auditmanager_framework.html) for details on the returned attributes - they are identical.
+
+<!-- cache-key: cdktf-0.18.0 input-e12a3dc3cc7a030af0ee05ef605e7ae0ed5532ec722427fc48f953a615499bf2 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/autoscaling_group.html.markdown b/website/docs/cdktf/python/d/autoscaling_group.html.markdown
new file mode 100644
index 00000000000..1e558515f6b
--- /dev/null
+++ b/website/docs/cdktf/python/d/autoscaling_group.html.markdown
@@ -0,0 +1,144 @@
+---
+subcategory: "Auto Scaling"
+layout: "aws"
+page_title: "AWS: aws_autoscaling_group"
+description: |-
+  Get information on an Amazon EC2 Autoscaling Group.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_autoscaling_group
+
+Use this data source to get information on an existing autoscaling group.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_autoscaling_group import DataAwsAutoscalingGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsAutoscalingGroup(self, "foo",
+            name="foo"
+        )
+```
+
+## Argument Reference
+
+* `name` - Specify the exact name of the desired autoscaling group.
+
+## Attribute Reference
+
+~> **NOTE:** Some values are not always set and may not be available for
+interpolation.
+
+* `arn` - ARN of the Auto Scaling group.
+* `availability_zones` - One or more Availability Zones for the group.
+* `default_cool_down` - Amount of time, in seconds, after a scaling activity completes before another scaling activity can start.
+* `desired_capacity` - Desired size of the group.
+* `desired_capacity_type` - The unit of measurement for the value returned for `desired_capacity`.
+* `enabled_metrics` - List of metrics enabled for collection.
+* `health_check_grace_period` - The amount of time, in seconds, that Amazon EC2 Auto Scaling waits before checking the health status of an EC2 instance that has come into service.
+* `health_check_type` - Service to use for the health checks. The valid values are EC2 and ELB.
+* `id` - Name of the Auto Scaling Group.
+* `launch_configuration` - The name of the associated launch configuration.
+* `launch_template` - List of launch templates for the group.
+    * `id` - ID of the launch template.
+    * `name` - Name of the launch template.
+    * `version` - Template version.
+* `load_balancers` - One or more load balancers associated with the group.
+* `max_instance_lifetime` - Maximum amount of time, in seconds, that an instance can be in service.
+* `max_size` - Maximum size of the group.
+* `min_size` - Minimum size of the group.
+* `mixed_instances_policy` - List of mixed instances policy objects for the group.
+    * `instances_distribution` - List of instances distribution objects.
+        * `on_demand_allocation_strategy` - Strategy used when launching on-demand instances.
+        * `on_demand_base_capacity` -  Absolute minimum amount of desired capacity that must be fulfilled by on-demand instances.
+        * `spot_allocation_strategy` - Strategy used when launching Spot instances.
+        * `spot_instance_pools` - Number of Spot pools per availability zone to allocate capacity.
+        * `spot_max_price` - Maximum price per unit hour that the user is willing to pay for the Spot instances.
+    * `launch_template` - List of launch templates along with the overrides.
+        * `launch_template_specification` - List of launch template specification objects.
+            * `launch_template_id` - ID of the launch template.
+            * `launch_template_name` - Name of the launch template.
+            * `version` - Template version.
+        * `override` - List of properties overriding the same properties in the launch template.
+            * `instance_requirements` - List of instance requirements objects.
+                * `accelerator_count - List of objects describing the minimum and maximum number of accelerators for an instance type.
+                    * `min` - Minimum.
+                    * `max` - Maximum.
+                * `accelerator_manufacturers` - List of accelerator manufacturer names.
+                * `accelerator_names` - List of accelerator names.
+                * `accelerator_total_memory_mib` - List of objects describing the minimum and maximum total memory of the accelerators.
+                * `accelerator_types` - List of accelerator types.
+                * `allowed_instance_types` - List of instance types to apply the specified attributes against.
+                * `bare_metal` - Indicates whether bare metal instances are included, excluded, or required.
+                * `baseline_ebs_bandwidth_mbps` - List of objects describing the minimum and maximum baseline EBS bandwidth (Mbps).
+                    * `min` - Minimum.
+                    * `max` - Maximum.
+                * `burstable_performance` - Indicates whether burstable performance instance types are included, excluded, or required.
+                * `cpu_manufacturers` - List of CPU manufacturer names.
+                * `excluded_instance_types` - List of excluded instance types.
+                * `instance_generations` - List of instance generation names.
+                * `local_storage` - Indicates whether instance types with instance store volumes are included, excluded, or required.
+                * `local_storage_types` - List of local storage type names.
+                * `memory_gib_per_vcpu` - List of objects describing the minimum and maximum amount of memory (GiB) per vCPU.
+                    * `min` - Minimum.
+                    * `max` - Maximum.
+                * `memory_mib` - List of objects describing the minimum and maximum amount of memory (MiB).
+                    * `min` - Minimum.
+                    * `max` - Maximum.
+                * `network_bandwidth_gbps` - List of objects describing the minimum and maximum amount of network bandwidth (Gbps).
+                    * `min` - Minimum.
+                    * `max`- Maximum.
+                * `network_interface_count` - List of objects describing the minimum and maximum amount of network interfaces.
+                    * `min` - Minimum.
+                    * `max` - Maximum.
+                * `on_demand_max_price_percentage_over_lowest_price` - Price protection threshold for On-Demand Instances.
+                * `require_hibernate_support` - Indicates whether instance types must support On-Demand Instance Hibernation.
+                * `spot_max_price_percentage_over_lowest_price` - Price protection threshold for Spot Instances.
+                * `total_local_storage_gb` - List of objects describing the minimum and maximum total storage (GB).
+                    * `min` - Minimum.
+                    * `max` - Maximum.
+                * `vcpu_count` - List of objects describing the minimum and maximum number of vCPUs.
+                    * `min` - Minimum.
+                    * `max` - Maximum.
+            * `instance_type` - Overriding instance type.
+            * `launch_template_specification` - List of overriding launch template specification objects.
+                * `launch_template_id` - ID of the launch template.
+                * `launch_template_name` - Name of the launch template.
+                * `version` - Template version.
+            * `weighted_capacity` - Number of capacity units, which gives the instance type a proportional weight to other instance types.
+* `name` - Name of the Auto Scaling Group.
+* `placement_group` - Name of the placement group into which to launch your instances, if any. For more information, see Placement Groups (http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/placement-groups.html) in the Amazon Elastic Compute Cloud User Guide.
+* `predicted_capacity` - Predicted capacity of the group.
+* `service_linked_role_arn` - ARN of the service-linked role that the Auto Scaling group uses to call other AWS services on your behalf.
+* `status` - Current state of the group when DeleteAutoScalingGroup is in progress.
+* `suspended_processes` - List of processes suspended processes for the Auto Scaling Group.
+* `tag` - List of tags for the group.
+    * `key` - Key.
+    * `value` - Value.
+    * `propagate_at_launch` - Whether the tag is propagated to Amazon EC2 instances launched via this ASG.
+* `target_group_arns` - ARNs of the target groups for your load balancer.
+* `termination_policies` - The termination policies for the group.
+* `traffic_source` -Traffic sources.
+    * `identifier` - Identifies the traffic source. For Application Load Balancers, Gateway Load Balancers, Network Load Balancers, and VPC Lattice, this will be the Amazon Resource Name (ARN) for a target group in this account and Region. For Classic Load Balancers, this will be the name of the Classic Load Balancer in this account and Region.
+    * `type` - Traffic source type.
+* `vpc_zone_identifier` - VPC ID for the group.
+* `warm_pool` - List of warm pool configuration objects.
+    * `instance_reuse_policy` - List of instance reuse policy objects.
+        * `reuse_on_scale_in` - Indicates whether instances in the Auto Scaling group can be returned to the warm pool on scale in.
+    * `max_group_prepared_policy` - Total maximum number of instances that are allowed to be in the warm pool or in any state except Terminated for the Auto Scaling group.
+    * `min_size` - Minimum number of instances to maintain in the warm pool.
+    * `pool_state` - Instance state to transition to after the lifecycle actions are complete.
+* `warm_pool_size` - Current size of the warm pool.
+
+<!-- cache-key: cdktf-0.18.0 input-99dec3ec98ed7de1189a2c55151981d1b50b501480be637bbbe4a2b5d7102172 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/autoscaling_groups.html.markdown b/website/docs/cdktf/python/d/autoscaling_groups.html.markdown
new file mode 100644
index 00000000000..9d47f960f4a
--- /dev/null
+++ b/website/docs/cdktf/python/d/autoscaling_groups.html.markdown
@@ -0,0 +1,64 @@
+---
+subcategory: "Auto Scaling"
+layout: "aws"
+page_title: "AWS: aws_autoscaling_groups"
+description: |-
+    Provides a list of Autoscaling Groups within a specific region.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_autoscaling_groups
+
+The Autoscaling Groups data source allows access to the list of AWS
+ASGs within a specific region. This will allow you to pass a list of AutoScaling Groups to other resources.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.autoscaling_notification import AutoscalingNotification
+from imports.aws.data_aws_autoscaling_groups import DataAwsAutoscalingGroups
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        groups = DataAwsAutoscalingGroups(self, "groups",
+            filter=[DataAwsAutoscalingGroupsFilter(
+                name="tag:Team",
+                values=["Pets"]
+            ), DataAwsAutoscalingGroupsFilter(
+                name="tag-key",
+                values=["Environment"]
+            )
+            ]
+        )
+        AutoscalingNotification(self, "slack_notifications",
+            group_names=Token.as_list(groups.names),
+            notifications=["autoscaling:EC2_INSTANCE_LAUNCH", "autoscaling:EC2_INSTANCE_TERMINATE", "autoscaling:EC2_INSTANCE_LAUNCH_ERROR", "autoscaling:EC2_INSTANCE_TERMINATE_ERROR"
+            ],
+            topic_arn="TOPIC ARN"
+        )
+```
+
+## Argument Reference
+
+* `names` - (Optional) List of autoscaling group names
+* `filter` - (Optional) Filter used to scope the list e.g., by tags. See [related docs](http://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_Filter.html).
+    * `name` - (Required) Name of the DescribeAutoScalingGroup filter. The recommended values are: `tag-key`, `tag-value`, and `tag:<tag name>`
+    * `values` - (Required) Value of the filter.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arns` - List of the Autoscaling Groups Arns in the current region.
+* `id` - AWS Region.
+* `names` - List of the Autoscaling Groups in the current region.
+
+<!-- cache-key: cdktf-0.18.0 input-20b7e19884e3bc895f27ed095f08d88d8a126a02daa27f2150766b85f3e730ed -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/availability_zone.html.markdown b/website/docs/cdktf/python/d/availability_zone.html.markdown
new file mode 100644
index 00000000000..987917847c0
--- /dev/null
+++ b/website/docs/cdktf/python/d/availability_zone.html.markdown
@@ -0,0 +1,128 @@
+---
+subcategory: "EC2 (Elastic Compute Cloud)"
+layout: "aws"
+page_title: "AWS: aws_availability_zone"
+description: |-
+    Provides details about a specific availability zone
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_availability_zone
+
+`aws_availability_zone` provides details about a specific availability zone (AZ)
+in the current region.
+
+This can be used both to validate an availability zone given in a variable
+and to split the AZ name into its component parts of an AWS region and an
+AZ identifier letter. The latter may be useful e.g., for implementing a
+consistent subnet numbering scheme across several regions by mapping both
+the region and the subnet letter to network numbers.
+
+This is different from the `aws_availability_zones` (plural) data source,
+which provides a list of the available zones.
+
+## Example Usage
+
+The following example shows how this data source might be used to derive
+VPC and subnet CIDR prefixes systematically for an availability zone.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformVariable, Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_availability_zone import DataAwsAvailabilityZone
+from imports.aws.subnet import Subnet
+from imports.aws.vpc import Vpc
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        # Terraform Variables are not always the best fit for getting inputs in the context of Terraform CDK.
+        #     You can read more about this at https://cdk.tf/variables
+        az_number = TerraformVariable(self, "az_number",
+            default=[{
+                "a": 1,
+                "b": 2,
+                "c": 3,
+                "d": 4,
+                "e": 5,
+                "f": 6
+            }
+            ]
+        )
+        region_number = TerraformVariable(self, "region_number",
+            default=[{
+                "ap-northeast-1": 5,
+                "eu-central-1": 4,
+                "us-east-1": 1,
+                "us-west-1": 2,
+                "us-west-2": 3
+            }
+            ]
+        )
+        example = DataAwsAvailabilityZone(self, "example",
+            name="eu-central-1a"
+        )
+        aws_vpc_example = Vpc(self, "example_3",
+            cidr_block=Token.as_string(
+                Fn.cidrsubnet("10.0.0.0/8", 4,
+                    Token.as_number(Fn.lookup_nested(region_number.value, [example.region]))))
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_vpc_example.override_logical_id("example")
+        aws_subnet_example = Subnet(self, "example_4",
+            cidr_block=Token.as_string(
+                Fn.cidrsubnet(
+                    Token.as_string(aws_vpc_example.cidr_block), 4,
+                    Token.as_number(Fn.lookup_nested(az_number.value, [example.name_suffix])))),
+            vpc_id=Token.as_string(aws_vpc_example.id)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_subnet_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+The arguments of this data source act as filters for querying the available
+availability zones. The given filters must match exactly one availability
+zone whose data will be exported as attributes.
+
+* `all_availability_zones` - (Optional) Set to `true` to include all Availability Zones and Local Zones regardless of your opt in status.
+* `filter` - (Optional) Configuration block(s) for filtering. Detailed below.
+* `name` - (Optional) Full name of the availability zone to select.
+* `state` - (Optional) Specific availability zone state to require. May be any of `"available"`, `"information"` or `"impaired"`.
+* `zone_id` - (Optional) Zone ID of the availability zone to select.
+
+### filter Configuration Block
+
+The `filter` configuration block supports the following arguments:
+
+* `name` - (Required) Name of the filter field. Valid values can be found in the [EC2 DescribeAvailabilityZones API Reference](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeAvailabilityZones.html).
+* `values` - (Required) Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `group_name` - For Availability Zones, this is the same value as the Region name. For Local Zones, the name of the associated group, for example `us-west-2-lax-1`.
+* `name_suffix` - Part of the AZ name that appears after the region name, uniquely identifying the AZ within its region.
+For Availability Zones this is usually a single letter, for example `a` for the `us-west-2a` zone.
+For Local and Wavelength Zones this is a longer string, for example `wl1-sfo-wlz-1` for the `us-west-2-wl1-sfo-wlz-1` zone.
+* `network_border_group` - The name of the location from which the address is advertised.
+* `opt_in_status` - For Availability Zones, this always has the value of `opt-in-not-required`. For Local Zones, this is the opt in status. The possible values are `opted-in` and `not-opted-in`.
+* `parent_zone_id` - ID of the zone that handles some of the Local Zone or Wavelength Zone control plane operations, such as API calls.
+* `parent_zone_name` - Name of the zone that handles some of the Local Zone or Wavelength Zone control plane operations, such as API calls.
+* `region` - Region where the selected availability zone resides. This is always the region selected on the provider, since this data source searches only within that region.
+* `zone_type` - Type of zone. Values are `availability-zone`, `local-zone`, and `wavelength-zone`.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `20m`)
+
+<!-- cache-key: cdktf-0.18.0 input-862d7a30e7b7fec1243f9a3afe7925988e240b4d36970fb4f9743ee1e9a647b3 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/availability_zones.html.markdown b/website/docs/cdktf/python/d/availability_zones.html.markdown
new file mode 100644
index 00000000000..13a093bdff8
--- /dev/null
+++ b/website/docs/cdktf/python/d/availability_zones.html.markdown
@@ -0,0 +1,138 @@
+---
+subcategory: "EC2 (Elastic Compute Cloud)"
+layout: "aws"
+page_title: "AWS: aws_availability_zones"
+description: |-
+    Provides a list of Availability Zones which can be used by an AWS account.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_availability_zones
+
+The Availability Zones data source allows access to the list of AWS
+Availability Zones which can be accessed by an AWS account within the region
+configured in the provider.
+
+This is different from the `aws_availability_zone` (singular) data source,
+which provides some details about a specific availability zone.
+
+-> When [Local Zones](https://aws.amazon.com/about-aws/global-infrastructure/localzones/) are enabled in a region, by default the API and this data source include both Local Zones and Availability Zones. To return only Availability Zones, see the example section below.
+
+## Example Usage
+
+### By State
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_availability_zones import DataAwsAvailabilityZones
+from imports.aws.subnet import Subnet
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, vpcId, vpcId1):
+        super().__init__(scope, name)
+        available = DataAwsAvailabilityZones(self, "available",
+            state="available"
+        )
+        Subnet(self, "primary",
+            availability_zone=Token.as_string(Fn.lookup_nested(available.names, ["0"])),
+            vpc_id=vpc_id
+        )
+        Subnet(self, "secondary",
+            availability_zone=Token.as_string(Fn.lookup_nested(available.names, ["1"])),
+            vpc_id=vpc_id1
+        )
+```
+
+### By Filter
+
+All Local Zones (regardless of opt-in status):
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_availability_zones import DataAwsAvailabilityZones
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsAvailabilityZones(self, "example",
+            all_availability_zones=True,
+            filter=[DataAwsAvailabilityZonesFilter(
+                name="opt-in-status",
+                values=["not-opted-in", "opted-in"]
+            )
+            ]
+        )
+```
+
+Only Availability Zones (no Local Zones):
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_availability_zones import DataAwsAvailabilityZones
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsAvailabilityZones(self, "example",
+            filter=[DataAwsAvailabilityZonesFilter(
+                name="opt-in-status",
+                values=["opt-in-not-required"]
+            )
+            ]
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `all_availability_zones` - (Optional) Set to `true` to include all Availability Zones and Local Zones regardless of your opt in status.
+* `filter` - (Optional) Configuration block(s) for filtering. Detailed below.
+* `exclude_names` - (Optional) List of Availability Zone names to exclude.
+* `exclude_zone_ids` - (Optional) List of Availability Zone IDs to exclude.
+* `state` - (Optional) Allows to filter list of Availability Zones based on their
+current state. Can be either `"available"`, `"information"`, `"impaired"` or
+`"unavailable"`. By default the list includes a complete set of Availability Zones
+to which the underlying AWS account has access, regardless of their state.
+
+### filter Configuration Block
+
+The `filter` configuration block supports the following arguments:
+
+* `name` - (Required) Name of the filter field. Valid values can be found in the [EC2 DescribeAvailabilityZones API Reference](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeAvailabilityZones.html).
+* `values` - (Required) Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `group_names` A set of the Availability Zone Group names. For Availability Zones, this is the same value as the Region name. For Local Zones, the name of the associated group, for example `us-west-2-lax-1`.
+* `id` - Region of the Availability Zones.
+* `names` - List of the Availability Zone names available to the account.
+* `zone_ids` - List of the Availability Zone IDs available to the account.
+
+Note that the indexes of Availability Zone names and IDs correspond.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `20m`)
+
+<!-- cache-key: cdktf-0.18.0 input-4fb56543535b24bb1a7db337e55d8060de419403eb0a490892cf3a3900602758 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/backup_framework.html.markdown b/website/docs/cdktf/python/d/backup_framework.html.markdown
new file mode 100644
index 00000000000..105d672367f
--- /dev/null
+++ b/website/docs/cdktf/python/d/backup_framework.html.markdown
@@ -0,0 +1,76 @@
+---
+subcategory: "Backup"
+layout: "aws"
+page_title: "AWS: aws_backup_framework"
+description: |-
+  Provides details about an AWS Backup Framework.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_backup_framework
+
+Use this data source to get information on an existing backup framework.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_backup_framework import DataAwsBackupFramework
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsBackupFramework(self, "example",
+            name="tf_example_backup_framework_name"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Backup framework name.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the backup framework.
+* `control` - One or more control blocks that make up the framework. Each control in the list has a name, input parameters, and scope. Detailed below.
+* `creation_time` - Date and time that a framework is created, in Unix format and Coordinated Universal Time (UTC).
+* `deployment_status` - Deployment status of a framework. The statuses are: `CREATE_IN_PROGRESS` | `UPDATE_IN_PROGRESS` | `DELETE_IN_PROGRESS` | `COMPLETED`| `FAILED`.
+* `description` - Description of the framework.
+* `id` - ID of the framework.
+* `status` - Framework consists of one or more controls. Each control governs a resource, such as backup plans, backup selections, backup vaults, or recovery points. You can also turn AWS Config recording on or off for each resource. The statuses are: `ACTIVE`, `PARTIALLY_ACTIVE`, `INACTIVE`, `UNAVAILABLE`. For more information refer to the [AWS documentation for Framework Status](https://docs.aws.amazon.com/aws-backup/latest/devguide/API_DescribeFramework.html#Backup-DescribeFramework-response-FrameworkStatus)
+* `tags` - Metadata that helps organize the frameworks you create.
+
+### Control Attributes
+
+`control` has the following attributes:
+
+* `input_parameter` - One or more input parameter blocks. An example of a control with two parameters is: "backup plan frequency is at least daily and the retention period is at least 1 year". The first parameter is daily. The second parameter is 1 year. Detailed below.
+* `name` - Name of a control.
+* `scope` - Scope of a control. The control scope defines what the control will evaluate. Three examples of control scopes are: a specific backup plan, all backup plans with a specific tag, or all backup plans. Detailed below.
+
+### Input Parameter Attributes
+
+`input_parameter` has the following attributes:
+
+* `name` - Name of a parameter, for example, BackupPlanFrequency.
+* `value` - Value of parameter, for example, hourly.
+
+### Scope Attributes
+
+`scope` has the following attributes:
+
+* `compliance_resource_ids` - The ID of the only AWS resource that you want your control scope to contain.
+* `compliance_resource_types` - Describes whether the control scope includes one or more types of resources, such as EFS or RDS.
+* `tags` - Tag key-value pair applied to those AWS resources that you want to trigger an evaluation for a rule. A maximum of one key-value pair can be provided.
+
+<!-- cache-key: cdktf-0.18.0 input-070382f6ead1d1cc0b69de2f856a82f41ed348235bed7c03c3b9216ebaf43096 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/backup_plan.html.markdown b/website/docs/cdktf/python/d/backup_plan.html.markdown
new file mode 100644
index 00000000000..bf97bfcaed4
--- /dev/null
+++ b/website/docs/cdktf/python/d/backup_plan.html.markdown
@@ -0,0 +1,49 @@
+---
+subcategory: "Backup"
+layout: "aws"
+page_title: "AWS: aws_backup_plan"
+description: |-
+  Provides details about an AWS Backup plan.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_backup_plan
+
+Use this data source to get information on an existing backup plan.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_backup_plan import DataAwsBackupPlan
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsBackupPlan(self, "example",
+            plan_id="tf_example_backup_plan_id"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `plan_id` - (Required) Backup plan ID.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the backup plan.
+* `name` - Display name of a backup plan.
+* `tags` - Metadata that you can assign to help organize the plans you create.
+* `version` - Unique, randomly generated, Unicode, UTF-8 encoded string that serves as the version ID of the backup plan.
+
+<!-- cache-key: cdktf-0.18.0 input-57458a8d2ad23e0db1998b3c24bffe8d7a9e84c173a10afd8dcf9f9009620a99 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/backup_report_plan.html.markdown b/website/docs/cdktf/python/d/backup_report_plan.html.markdown
new file mode 100644
index 00000000000..135ed10d5af
--- /dev/null
+++ b/website/docs/cdktf/python/d/backup_report_plan.html.markdown
@@ -0,0 +1,72 @@
+---
+subcategory: "Backup"
+layout: "aws"
+page_title: "AWS: aws_backup_report_plan"
+description: |-
+  Provides details about an AWS Backup Report Plan.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_backup_report_plan
+
+Use this data source to get information on an existing backup report plan.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_backup_report_plan import DataAwsBackupReportPlan
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsBackupReportPlan(self, "example",
+            name="tf_example_backup_report_plan_name"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Backup report plan name.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the backup report plan.
+* `creation_time` - Date and time that a report plan is created, in Unix format and Coordinated Universal Time (UTC).
+* `deployment_status` - Deployment status of a report plan. The statuses are: `CREATE_IN_PROGRESS` | `UPDATE_IN_PROGRESS` | `DELETE_IN_PROGRESS` | `COMPLETED`.
+* `description` - Description of the report plan.
+* `id` - ID of the report plan.
+* `report_delivery_channel` - An object that contains information about where and how to deliver your reports, specifically your Amazon S3 bucket name, S3 key prefix, and the formats of your reports. Detailed below.
+* `report_setting` - An object that identifies the report template for the report. Reports are built using a report template. Detailed below.
+* `tags` - Metadata that you can assign to help organize the report plans you create.
+
+### Report Delivery Channel Attributes
+
+`report_delivery_channel` has the following attributes:
+
+* `formats` - List of the format of your reports: CSV, JSON, or both.
+* `s3_bucket_name` - Unique name of the S3 bucket that receives your reports.
+* `s3_key_prefix` - Prefix for where Backup Audit Manager delivers your reports to Amazon S3. The prefix is this part of the following path: s3://your-bucket-name/prefix/Backup/us-west-2/year/month/day/report-name.
+
+### Report Setting Attributes
+
+`report_setting` has the following attributes:
+
+* `accounts` - (Optional) Specifies the list of accounts a report covers.
+* `framework_arns` - ARNs of the frameworks a report covers.
+* `number_of_frameworks` - Specifies the number of frameworks a report covers.
+* `organization_units` - (Optional) Specifies the list of Organizational Units a report covers.
+* `regions` - (Optional) Specifies the list of regions a report covers.
+* `report_template` - Identifies the report template for the report. Reports are built using a report template.
+
+<!-- cache-key: cdktf-0.18.0 input-bb9ee564d7e610ad5a515bf5d6d41add676ed63ed91647947ed5d6fcd34dde46 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/backup_selection.html.markdown b/website/docs/cdktf/python/d/backup_selection.html.markdown
new file mode 100644
index 00000000000..7c563062ce4
--- /dev/null
+++ b/website/docs/cdktf/python/d/backup_selection.html.markdown
@@ -0,0 +1,50 @@
+---
+subcategory: "Backup"
+layout: "aws"
+page_title: "AWS: aws_backup_selection"
+description: |-
+  Provides details about an AWS Backup selection.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_backup_selection
+
+Use this data source to get information on an existing backup selection.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_backup_selection import DataAwsBackupSelection
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsBackupSelection(self, "example",
+            plan_id=Token.as_string(data_aws_backup_plan_example.id),
+            selection_id="selection-id-example"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `plan_id` - (Required) Backup plan ID associated with the selection of resources.
+* `selection_id` - (Required) Backup selection ID.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `name` - Display name of a resource selection document.
+* `iam_role_arn` - ARN of the IAM role that AWS Backup uses to authenticate when restoring and backing up the target resource. See the [AWS Backup Developer Guide](https://docs.aws.amazon.com/aws-backup/latest/devguide/access-control.html#managed-policies) for additional information about using AWS managed policies or creating custom policies attached to the IAM role.
+* `resources` - An array of strings that either contain Amazon Resource Names (ARNs) or match patterns of resources to assign to a backup plan..
+
+<!-- cache-key: cdktf-0.18.0 input-534dba699166fbe14df06754eebf249c7a81db83aae51d2b3269662e6cd9a9bd -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/backup_vault.html.markdown b/website/docs/cdktf/python/d/backup_vault.html.markdown
new file mode 100644
index 00000000000..82da1c2edb7
--- /dev/null
+++ b/website/docs/cdktf/python/d/backup_vault.html.markdown
@@ -0,0 +1,49 @@
+---
+subcategory: "Backup"
+layout: "aws"
+page_title: "AWS: aws_backup_vault"
+description: |-
+  Provides details about an AWS Backup vault.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_backup_vault
+
+Use this data source to get information on an existing backup vault.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_backup_vault import DataAwsBackupVault
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsBackupVault(self, "example",
+            name="example_backup_vault"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name of the backup vault.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the vault.
+* `kms_key_arn` - Server-side encryption key that is used to protect your backups.
+* `recovery_points` - Number of recovery points that are stored in a backup vault.
+* `tags` - Metadata that you can assign to help organize the resources that you create.
+
+<!-- cache-key: cdktf-0.18.0 input-75bcf13abdcd543599d4af41c0a3cd4883e1f1ea69bf45b112f8908ac5682ba7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/batch_compute_environment.html.markdown b/website/docs/cdktf/python/d/batch_compute_environment.html.markdown
new file mode 100644
index 00000000000..7b3dd71140b
--- /dev/null
+++ b/website/docs/cdktf/python/d/batch_compute_environment.html.markdown
@@ -0,0 +1,54 @@
+---
+subcategory: "Batch"
+layout: "aws"
+page_title: "AWS: aws_batch_compute_environment"
+description: |-
+    Provides details about a batch compute environment
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_batch_compute_environment
+
+The Batch Compute Environment data source allows access to details of a specific
+compute environment within AWS Batch.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_batch_compute_environment import DataAwsBatchComputeEnvironment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsBatchComputeEnvironment(self, "batch-mongo",
+            compute_environment_name="batch-mongo-production"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `compute_environment_name` - (Required) Name of the Batch Compute Environment
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the compute environment.
+* `ecs_cluster_arn` - ARN of the underlying Amazon ECS cluster used by the compute environment.
+* `service_role` - ARN of the IAM role that allows AWS Batch to make calls to other AWS services on your behalf.
+* `type` - Type of the compute environment (for example, `MANAGED` or `UNMANAGED`).
+* `status` - Current status of the compute environment (for example, `CREATING` or `VALID`).
+* `status_reason` - Short, human-readable string to provide additional details about the current status of the compute environment.
+* `state` - State of the compute environment (for example, `ENABLED` or `DISABLED`). If the state is `ENABLED`, then the compute environment accepts jobs from a queue and can scale out automatically based on queues.
+* `tags` - Key-value map of resource tags
+
+<!-- cache-key: cdktf-0.18.0 input-40ea513f9e96b190b76debe79cd7a41eb8991b1bc0efea47e7c5e257dd7f3f34 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/batch_job_queue.html.markdown b/website/docs/cdktf/python/d/batch_job_queue.html.markdown
new file mode 100644
index 00000000000..09b4fa9c1ce
--- /dev/null
+++ b/website/docs/cdktf/python/d/batch_job_queue.html.markdown
@@ -0,0 +1,59 @@
+---
+subcategory: "Batch"
+layout: "aws"
+page_title: "AWS: aws_batch_job_queue"
+description: |-
+    Provides details about a batch job queue
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_batch_job_queue
+
+The Batch Job Queue data source allows access to details of a specific
+job queue within AWS Batch.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_batch_job_queue import DataAwsBatchJobQueue
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsBatchJobQueue(self, "test-queue",
+            name="tf-test-batch-job-queue"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name of the job queue.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the job queue.
+* `scheduling_policy_arn` - The ARN of the fair share scheduling policy. If this attribute has a value, the job queue uses a fair share scheduling policy. If this attribute does not have a value, the job queue uses a first in, first out (FIFO) scheduling policy.
+* `status` - Current status of the job queue (for example, `CREATING` or `VALID`).
+* `status_reason` - Short, human-readable string to provide additional details about the current status
+    of the job queue.
+* `state` - Describes the ability of the queue to accept new jobs (for example, `ENABLED` or `DISABLED`).
+* `tags` - Key-value map of resource tags
+* `priority` - Priority of the job queue. Job queues with a higher priority are evaluated first when
+    associated with the same compute environment.
+* `compute_environment_order` - The compute environments that are attached to the job queue and the order in
+    which job placement is preferred. Compute environments are selected for job placement in ascending order.
+    * `compute_environment_order.#.order` - The order of the compute environment.
+    * `compute_environment_order.#.compute_environment` - The ARN of the compute environment.
+
+<!-- cache-key: cdktf-0.18.0 input-458fa4c54b7533c202af979978ce3bfb9fac6c2e69a836bcfd612403c16fe74e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/batch_scheduling_policy.html.markdown b/website/docs/cdktf/python/d/batch_scheduling_policy.html.markdown
new file mode 100644
index 00000000000..e0c80856269
--- /dev/null
+++ b/website/docs/cdktf/python/d/batch_scheduling_policy.html.markdown
@@ -0,0 +1,59 @@
+---
+subcategory: "Batch"
+layout: "aws"
+page_title: "AWS: aws_batch_scheduling_policy"
+description: |-
+    Provides details about a Batch Scheduling Policy
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_batch_scheduling_policy
+
+The Batch Scheduling Policy data source allows access to details of a specific Scheduling Policy within AWS Batch.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_batch_scheduling_policy import DataAwsBatchSchedulingPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsBatchSchedulingPolicy(self, "test",
+            arn="arn:aws:batch:us-east-1:012345678910:scheduling-policy/example"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `arn` - (Required) ARN of the scheduling policy.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `fairshare_policy` - Fairshare policy block specifies the `compute_reservation`, `share_delay_seconds`, and `share_distribution` of the scheduling policy. The `fairshare_policy` block is documented below.
+* `name` - Name of the scheduling policy.
+* `tags` - Key-value map of resource tags
+
+A `fairshare_policy` block supports the following arguments:
+
+* `compute_reservation` - Value used to reserve some of the available maximum vCPU for fair share identifiers that have not yet been used. For more information, see [FairsharePolicy](https://docs.aws.amazon.com/batch/latest/APIReference/API_FairsharePolicy.html).
+* `share_delay_seconds` - Time period to use to calculate a fair share percentage for each fair share identifier in use, in seconds. For more information, see [FairsharePolicy](https://docs.aws.amazon.com/batch/latest/APIReference/API_FairsharePolicy.html).
+* `share_distribution` - One or more share distribution blocks which define the weights for the fair share identifiers for the fair share policy. For more information, see [FairsharePolicy](https://docs.aws.amazon.com/batch/latest/APIReference/API_FairsharePolicy.html). The `share_distribution` block is documented below.
+
+A `share_distribution` block supports the following arguments:
+
+* `share_identifier` - Fair share identifier or fair share identifier prefix. For more information, see [ShareAttributes](https://docs.aws.amazon.com/batch/latest/APIReference/API_ShareAttributes.html).
+* `weight_factor` - Weight factor for the fair share identifier. For more information, see [ShareAttributes](https://docs.aws.amazon.com/batch/latest/APIReference/API_ShareAttributes.html).
+
+<!-- cache-key: cdktf-0.18.0 input-a3c940bd9dab02eb61feff7643ca700cbd6562b5e25eb6379d0c7a0bc4618bc4 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/billing_service_account.html.markdown b/website/docs/cdktf/python/d/billing_service_account.html.markdown
new file mode 100644
index 00000000000..dc32beaafbc
--- /dev/null
+++ b/website/docs/cdktf/python/d/billing_service_account.html.markdown
@@ -0,0 +1,78 @@
+---
+subcategory: "Meta Data Sources"
+layout: "aws"
+page_title: "AWS: aws_billing_service_account"
+description: |-
+  Get AWS Billing Service Account
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_billing_service_account
+
+Use this data source to get the Account ID of the [AWS Billing and Cost Management Service Account](http://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-getting-started.html#step-2) for the purpose of permitting in S3 bucket policy.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_billing_service_account import DataAwsBillingServiceAccount
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_acl import S3BucketAcl
+from imports.aws.s3_bucket_policy import S3BucketPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        billing_logs = S3Bucket(self, "billing_logs",
+            bucket="my-billing-tf-test-bucket"
+        )
+        S3BucketAcl(self, "billing_logs_acl",
+            acl="private",
+            bucket=billing_logs.id
+        )
+        main = DataAwsBillingServiceAccount(self, "main")
+        allow_billing_logging = DataAwsIamPolicyDocument(self, "allow_billing_logging",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["s3:GetBucketAcl", "s3:GetBucketPolicy"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=[Token.as_string(main.arn)],
+                    type="AWS"
+                )
+                ],
+                resources=[billing_logs.arn]
+            ), DataAwsIamPolicyDocumentStatement(
+                actions=["s3:PutObject"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=[Token.as_string(main.arn)],
+                    type="AWS"
+                )
+                ],
+                resources=["${" + billing_logs.arn + "}/*"]
+            )
+            ]
+        )
+        aws_s3_bucket_policy_allow_billing_logging = S3BucketPolicy(self, "allow_billing_logging_4",
+            bucket=billing_logs.id,
+            policy=Token.as_string(allow_billing_logging.json)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_policy_allow_billing_logging.override_logical_id("allow_billing_logging")
+```
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the AWS billing service account.
+* `arn` - ARN of the AWS billing service account.
+
+<!-- cache-key: cdktf-0.18.0 input-8925e83aaf4808ed4c7dc3e71d2003c1129f36ec86722b8b5095c47d2188bd28 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/budgets_budget.html.markdown b/website/docs/cdktf/python/d/budgets_budget.html.markdown
new file mode 100644
index 00000000000..d6dcc31e41c
--- /dev/null
+++ b/website/docs/cdktf/python/d/budgets_budget.html.markdown
@@ -0,0 +1,149 @@
+---
+subcategory: "Web Services Budgets"
+layout: "aws"
+page_title: "AWS: aws_budgets_budget"
+description: |-
+  Terraform data source for managing an AWS Web Services Budgets Budget.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_budgets_budget
+
+Terraform data source for managing an AWS Web Services Budgets Budget.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_budgets_budget import DataAwsBudgetsBudget
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsBudgetsBudget(self, "test",
+            name=Token.as_string(aws_budgets_budget_test.name)
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - The name of a budget. Unique within accounts.
+
+The following arguments are optional:
+
+* `account_id` - The ID of the target account for budget. Will use current user's account_id by default if omitted.
+* `name_prefix` - The prefix of the name of a budget. Unique within accounts.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `auto_adjust_data` - Object containing [AutoAdjustData] which determines the budget amount for an auto-adjusting budget.
+* `budget_exceeded` - Boolean indicating whether this budget has been exceeded.
+* `budget_limit` - The total amount of cost, usage, RI utilization, RI coverage, Savings Plans utilization, or Savings Plans coverage that you want to track with your budget. Contains object [Spend](#spend).
+* `budget_type` - Whether this budget tracks monetary cost or usage.
+* `calculated_spend` - The spend objects that are associated with this budget. The [actualSpend](#actual-spend) tracks how much you've used, cost, usage, RI units, or Savings Plans units and the [forecastedSpend](#forecasted-spend) tracks how much that you're predicted to spend based on your historical usage profile.
+* `cost_filter` - A list of [CostFilter](#cost-filter) name/values pair to apply to budget.
+* `cost_types` - Object containing [CostTypes](#cost-types) The types of cost included in a budget, such as tax and subscriptions.
+* `notification` - Object containing [Budget Notifications](#budget-notification). Can be used multiple times to define more than one budget notification.
+* `planned_limit` - Object containing [Planned Budget Limits](#planned-budget-limits). Can be used multiple times to plan more than one budget limit. See [PlannedBudgetLimits](https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_budgets_Budget.html#awscostmanagement-Type-budgets_Budget-PlannedBudgetLimits) documentation.
+* `time_period_end` - The end of the time period covered by the budget. There are no restrictions on the end date. Format: `2017-01-01_12:00`.
+* `time_period_start` - The start of the time period covered by the budget. If you don't specify a start date, AWS defaults to the start of your chosen time period. The start date must come before the end date. Format: `2017-01-01_12:00`.
+* `time_unit` - The length of time until a budget resets the actual and forecasted spend. Valid values: `MONTHLY`, `QUARTERLY`, `ANNUALLY`, and `DAILY`.
+
+### Actual Spend
+
+The amount of cost, usage, RI units, or Savings Plans units that you used. Type is [Spend](#spend)
+
+### Auto Adjust Data
+
+The parameters that determine the budget amount for an auto-adjusting budget.
+
+* `auto_adjust_type` (Required) - The string that defines whether your budget auto-adjusts based on historical or forecasted data. Valid values: `FORECAST`,`HISTORICAL`.
+* `historical_options` (Optional) - Configuration block of [Historical Options](#historical-options). Required for `auto_adjust_type` of `HISTORICAL` Configuration block that defines the historical data that your auto-adjusting budget is based on.
+* `last_auto_adjust_time` (Optional) - The last time that your budget was auto-adjusted.
+
+### Budget Notification
+
+Valid keys for `notification` parameter.
+
+* `comparison_operator` - (Required) Comparison operator to use to evaluate the condition. Can be `LESS_THAN`, `EQUAL_TO` or `GREATER_THAN`.
+* `threshold` - (Required) Threshold when the notification should be sent.
+* `threshold_type` - (Required) What kind of threshold is defined. Can be `PERCENTAGE` OR `ABSOLUTE_VALUE`.
+* `notification_type` - (Required) What kind of budget value to notify on. Can be `ACTUAL` or `FORECASTED`.
+* `subscriber_email_addresses` - (Optional) E-Mail addresses to notify. Either this or `subscriber_sns_topic_arns` is required.
+* `subscriber_sns_topic_arns` - (Optional) SNS topics to notify. Either this or `subscriber_email_addresses` is required.
+
+### Cost Filter
+
+Based on your choice of budget type, you can choose one or more of the available budget filters.
+
+* `PurchaseType`
+* `UsageTypeGroup`
+* `Service`
+* `Operation`
+* `UsageType`
+* `BillingEntity`
+* `CostCategory`
+* `LinkedAccount`
+* `TagKeyValue`
+* `LegalEntityName`
+* `InvoicingEntity`
+* `AZ`
+* `Region`
+* `InstanceType`
+
+Refer to [AWS CostFilter documentation](https://docs.aws.amazon.com/cost-management/latest/userguide/budgets-create-filters.html) for further detail.
+
+### Cost Types
+
+Valid keys for `cost_types` parameter.
+
+* `include_credit` - A boolean value whether to include credits in the cost budget. Defaults to `true`.
+* `include_discount` - Whether a budget includes discounts. Defaults to `true`.
+* `include_other_subscription` - A boolean value whether to include other subscription costs in the cost budget. Defaults to `true`.
+* `include_recurring` - A boolean value whether to include recurring costs in the cost budget. Defaults to `true`.
+* `include_refund` - A boolean value whether to include refunds in the cost budget. Defaults to `true`.
+* `include_subscription` - A boolean value whether to include subscriptions in the cost budget. Defaults to `true`.
+* `include_support` - A boolean value whether to include support costs in the cost budget. Defaults to `true`.
+* `include_tax` - A boolean value whether to include tax in the cost budget. Defaults to `true`.
+* `include_upfront` - A boolean value whether to include upfront costs in the cost budget. Defaults to `true`.
+* `use_amortized` - Whether a budget uses the amortized rate. Defaults to `false`.
+* `use_blended` - A boolean value whether to use blended costs in the cost budget. Defaults to `false`.
+
+Refer to [AWS CostTypes documentation](https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_budgets_CostTypes.html) for further detail.
+
+### Forecasted Spend
+
+The amount of cost, usage, RI units, or Savings Plans units that you're forecasted to use.
+Type is [Spend](#spend)
+
+### Historical Options
+
+* `budget_adjustment_period` (Required) - The number of budget periods included in the moving-average calculation that determines your auto-adjusted budget amount.
+* `lookback_available_periods` (Optional) - The integer that describes how many budget periods in your BudgetAdjustmentPeriod are included in the calculation of your current budget limit. If the first budget period in your BudgetAdjustmentPeriod has no cost data, then that budget period isn’t included in the average that determines your budget limit. You can’t set your own LookBackAvailablePeriods. The value is automatically calculated from the `budget_adjustment_period` and your historical cost data.
+
+### Planned Budget Limits
+
+Valid keys for `planned_limit` parameter.
+
+* `amount` - (Required) The amount of cost or usage being measured for a budget.
+* `start_time` - (Required) The start time of the budget limit. Format: `2017-01-01_12:00`. See [PlannedBudgetLimits](https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_budgets_Budget.html#awscostmanagement-Type-budgets_Budget-PlannedBudgetLimits) documentation.
+* `unit` - (Required) The unit of measurement used for the budget forecast, actual spend, or budget threshold, such as dollars or GB. See [Spend](http://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/data-type-spend.html) documentation.
+
+### Spend
+
+* `amount` - The cost or usage amount that's associated with a budget forecast, actual spend, or budget threshold. Length Constraints: Minimum length of `1`. Maximum length of `2147483647`.
+* `unit` - The unit of measurement that's used for the budget forecast, actual spend, or budget threshold, such as USD or GBP. Length Constraints: Minimum length of `1`. Maximum length of `2147483647`.
+
+<!-- cache-key: cdktf-0.18.0 input-b7c31c3ad39479e59da06d0c3fe09f56627948373042fa6519f4be932fdc9787 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/caller_identity.html.markdown b/website/docs/cdktf/python/d/caller_identity.html.markdown
new file mode 100644
index 00000000000..262760ddf84
--- /dev/null
+++ b/website/docs/cdktf/python/d/caller_identity.html.markdown
@@ -0,0 +1,56 @@
+---
+subcategory: "STS (Security Token)"
+layout: "aws"
+page_title: "AWS: aws_caller_identity"
+description: |-
+  Get information about the identity of the caller for the provider
+  connection to AWS.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_caller_identity
+
+Use this data source to get the access to the effective Account ID, User ID, and ARN in
+which Terraform is authorized.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformOutput, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_caller_identity import DataAwsCallerIdentity
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        current = DataAwsCallerIdentity(self, "current")
+        TerraformOutput(self, "account_id",
+            value=current.account_id
+        )
+        TerraformOutput(self, "caller_arn",
+            value=current.arn
+        )
+        TerraformOutput(self, "caller_user",
+            value=current.user_id
+        )
+```
+
+## Argument Reference
+
+There are no arguments available for this data source.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `account_id` - AWS Account ID number of the account that owns or contains the calling entity.
+* `arn` - ARN associated with the calling entity.
+* `id` - Account ID number of the account that owns or contains the calling entity.
+* `user_id` - Unique identifier of the calling entity.
+
+<!-- cache-key: cdktf-0.18.0 input-00a75824635dd096c73d792ee6588548d7424d85ce15eeacc898c5211b3f1527 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/canonical_user_id.html.markdown b/website/docs/cdktf/python/d/canonical_user_id.html.markdown
new file mode 100644
index 00000000000..7ac252629ad
--- /dev/null
+++ b/website/docs/cdktf/python/d/canonical_user_id.html.markdown
@@ -0,0 +1,51 @@
+---
+subcategory: "S3 (Simple Storage)"
+layout: "aws"
+page_title: "AWS: aws_canonical_user_id"
+description: |-
+  Provides the canonical user ID for the AWS account associated with the provider
+  connection to AWS.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_canonical_user_id
+
+The Canonical User ID data source allows access to the [canonical user ID](http://docs.aws.amazon.com/general/latest/gr/acct-identifiers.html)
+for the effective account in which Terraform is working.  
+
+~> **NOTE:** To use this data source, you must have the `s3:ListAllMyBuckets` permission.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformOutput, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_canonical_user_id import DataAwsCanonicalUserId
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        current = DataAwsCanonicalUserId(self, "current")
+        TerraformOutput(self, "canonical_user_id",
+            value=current.id
+        )
+```
+
+## Argument Reference
+
+There are no arguments available for this data source.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - Canonical user ID associated with the AWS account.
+
+* `display_name` - Human-friendly name linked to the canonical user ID. The bucket owner's display name. **NOTE:** [This value](https://docs.aws.amazon.com/AmazonS3/latest/API/RESTServiceGET.html) is only included in the response in the US East (N. Virginia), US West (N. California), US West (Oregon), Asia Pacific (Singapore), Asia Pacific (Sydney), Asia Pacific (Tokyo), EU (Ireland), and South America (São Paulo) regions.
+
+<!-- cache-key: cdktf-0.18.0 input-db8220f51071b9966f2634f970bb7fc28053743696bb94d88dcc12f05f864080 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/ce_cost_category.html.markdown b/website/docs/cdktf/python/d/ce_cost_category.html.markdown
new file mode 100644
index 00000000000..c26daa31c22
--- /dev/null
+++ b/website/docs/cdktf/python/d/ce_cost_category.html.markdown
@@ -0,0 +1,105 @@
+---
+subcategory: "CE (Cost Explorer)"
+layout: "aws"
+page_title: "AWS: aws_ce_cost_category"
+description: |-
+  Provides details about a specific CostExplorer Cost Category Definition
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ce_cost_category
+
+Provides details about a specific CostExplorer Cost Category.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_ce_cost_category import DataAwsCeCostCategory
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsCeCostCategory(self, "example",
+            cost_category_arn="costCategoryARN"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `cost_category_arn` - (Required) Unique name for the Cost Category.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the cost category.
+* `default_value` - Default value for the cost category.
+* `effective_end` - Effective end data of your Cost Category.
+* `effective_start` - Effective state data of your Cost Category.
+* `id` - Unique ID of the cost category.
+* `rule` - Configuration block for the Cost Category rules used to categorize costs. See below.
+* `rule_version` - Rule schema version in this particular Cost Category.
+* `split_charge_rule` - Configuration block for the split charge rules used to allocate your charges between your Cost Category values. See below.
+* `tags` - Resource tags.
+
+### `rule`
+
+* `inherited_value` - Configuration block for the value the line item is categorized as if the line item contains the matched dimension. See below.
+* `rule` - Configuration block for the `Expression` object used to categorize costs. See below.
+* `type` - You can define the CostCategoryRule rule type as either `REGULAR` or `INHERITED_VALUE`.
+* `value` - Default value for the cost category.
+
+### `inherited_value`
+
+* `dimension_key` - Key to extract cost category values.
+* `dimension_name` - Name of the dimension that's used to group costs. If you specify `LINKED_ACCOUNT_NAME`, the cost category value is based on account name. If you specify `TAG`, the cost category value will be based on the value of the specified tag key. Valid values are `LINKED_ACCOUNT_NAME`, `TAG`
+
+### `rule`
+
+* `and` - Return results that match both `Dimension` objects.
+* `cost_category` - Configuration block for the filter that's based on `CostCategory` values. See below.
+* `dimension` - Configuration block for the specific `Dimension` to use for `Expression`. See below.
+* `not` - Return results that do not match the `Dimension` object.
+* `or` - Return results that match either `Dimension` object.
+* `tags` - Configuration block for the specific `Tag` to use for `Expression`. See below.
+
+### `cost_category`
+
+* `key` - Unique name of the Cost Category.
+* `match_options` - Match options that you can use to filter your results. MatchOptions is only applicable for actions related to cost category. The default values for MatchOptions is `EQUALS` and `CASE_SENSITIVE`. Valid values are: `EQUALS`,  `ABSENT`, `STARTS_WITH`, `ENDS_WITH`, `CONTAINS`, `CASE_SENSITIVE`, `CASE_INSENSITIVE`.
+* `values` - Specific value of the Cost Category.
+
+### `dimension`
+
+* `key` - Unique name of the Cost Category.
+* `match_options` - Match options that you can use to filter your results. MatchOptions is only applicable for actions related to cost category. The default values for MatchOptions is `EQUALS` and `CASE_SENSITIVE`. Valid values are: `EQUALS`,  `ABSENT`, `STARTS_WITH`, `ENDS_WITH`, `CONTAINS`, `CASE_SENSITIVE`, `CASE_INSENSITIVE`.
+* `values` - Specific value of the Cost Category.
+
+### `tags`
+
+* `key` - Key for the tag.
+* `match_options` - Match options that you can use to filter your results. MatchOptions is only applicable for actions related to cost category. The default values for MatchOptions is `EQUALS` and `CASE_SENSITIVE`. Valid values are: `EQUALS`,  `ABSENT`, `STARTS_WITH`, `ENDS_WITH`, `CONTAINS`, `CASE_SENSITIVE`, `CASE_INSENSITIVE`.
+* `values` - Specific value of the Cost Category.
+
+### `split_charge_rule`
+
+* `method` - Method that's used to define how to split your source costs across your targets. Valid values are `FIXED`, `PROPORTIONAL`, `EVEN`
+* `parameter` - Configuration block for the parameters for a split charge method. This is only required for the `FIXED` method. See below.
+* `source` - Cost Category value that you want to split.
+* `targets` - Cost Category values that you want to split costs across. These values can't be used as a source in other split charge rules.
+
+### `parameter`
+
+* `type` - Parameter type.
+* `values` - Parameter values.
+
+<!-- cache-key: cdktf-0.18.0 input-4cb2fbc95adf79676205ba698e97a322301998e777b3e00de5567e2938e38ac6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/ce_tags.html.markdown b/website/docs/cdktf/python/d/ce_tags.html.markdown
new file mode 100644
index 00000000000..4085bf482e4
--- /dev/null
+++ b/website/docs/cdktf/python/d/ce_tags.html.markdown
@@ -0,0 +1,94 @@
+---
+subcategory: "CE (Cost Explorer)"
+layout: "aws"
+page_title: "AWS: aws_ce_tags"
+description: |-
+  Provides details about a specific CE Tags
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ce_tags
+
+Provides details about a specific CE Tags.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_ce_tags import DataAwsCeTags
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsCeTags(self, "test",
+            time_period=DataAwsCeTagsTimePeriod(
+                end="2022-12-01",
+                start="2021-01-01"
+            )
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `time_period` - (Required) Configuration block for the start and end dates for retrieving the dimension values.
+
+The following arguments are optional:
+
+* `filter` - (Optional) Configuration block for the `Expression` object used to categorize costs. See below.
+* `search_string` - (Optional) Value that you want to search for.
+* `sort_by` - (Optional) Configuration block for the value by which you want to sort the data. See below.
+* `tag_key` - (Optional) Key of the tag that you want to return values for.
+
+### `time_period`
+
+* `start` - (Required) End of the time period.
+* `end` - (Required) Beginning of the time period.
+
+### `filter`
+
+* `and` - (Optional) Return results that match both `Dimension` objects.
+* `cost_category` - (Optional) Configuration block for the filter that's based on `CostCategory` values. See below.
+* `dimension` - (Optional) Configuration block for the specific `Dimension` to use for `Expression`. See below.
+* `not` - (Optional) Return results that match both `Dimension` object.
+* `or` - (Optional) Return results that match both `Dimension` object.
+* `tag` - (Optional) Configuration block for the specific `Tag` to use for `Expression`. See below.
+
+### `cost_category`
+
+* `key` - (Optional) Unique name of the Cost Category.
+* `match_options` - (Optional) Match options that you can use to filter your results. MatchOptions is only applicable for actions related to cost category. The default values for MatchOptions is `EQUALS` and `CASE_SENSITIVE`. Valid values are: `EQUALS`,  `ABSENT`, `STARTS_WITH`, `ENDS_WITH`, `CONTAINS`, `CASE_SENSITIVE`, `CASE_INSENSITIVE`.
+* `values` - (Optional) Specific value of the Cost Category.
+
+### `dimension`
+
+* `key` - (Optional) Unique name of the Cost Category.
+* `match_options` - (Optional) Match options that you can use to filter your results. MatchOptions is only applicable for actions related to cost category. The default values for MatchOptions is `EQUALS` and `CASE_SENSITIVE`. Valid values are: `EQUALS`,  `ABSENT`, `STARTS_WITH`, `ENDS_WITH`, `CONTAINS`, `CASE_SENSITIVE`, `CASE_INSENSITIVE`.
+* `values` - (Optional) Specific value of the Cost Category.
+
+### `tag`
+
+* `key` - (Optional) Key for the tag.
+* `match_options` - (Optional) Match options that you can use to filter your results. MatchOptions is only applicable for actions related to cost category. The default values for MatchOptions is `EQUALS` and `CASE_SENSITIVE`. Valid values are: `EQUALS`,  `ABSENT`, `STARTS_WITH`, `ENDS_WITH`, `CONTAINS`, `CASE_SENSITIVE`, `CASE_INSENSITIVE`.
+* `values` - (Optional) Specific value of the Cost Category.
+
+### `sort_by`
+
+* `key` - (Required) key that's used to sort the data. Valid values are: `BlendedCost`,  `UnblendedCost`, `AmortizedCost`, `NetAmortizedCost`, `NetUnblendedCost`, `UsageQuantity`, `NormalizedUsageAmount`.
+* `sort_order` - (Optional) order that's used to sort the data. Valid values are: `ASCENDING`,  `DESCENDING`.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - Unique ID of the tag.
+* `tags` - Tags that match your request.
+
+<!-- cache-key: cdktf-0.18.0 input-9527a8a7806958858a1fefa9886293028fd6d96e84f71de91cdd7a28d03de47b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/cloudcontrolapi_resource.html.markdown b/website/docs/cdktf/python/d/cloudcontrolapi_resource.html.markdown
new file mode 100644
index 00000000000..ca2d4aa8663
--- /dev/null
+++ b/website/docs/cdktf/python/d/cloudcontrolapi_resource.html.markdown
@@ -0,0 +1,53 @@
+---
+subcategory: "Cloud Control API"
+layout: "aws"
+page_title: "AWS: aws_cloudcontrolapi_resource"
+description: |-
+    Provides details for a Cloud Control API Resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_cloudcontrolapi_resource
+
+Provides details for a Cloud Control API Resource. The reading of these resources is proxied through Cloud Control API handlers to the backend service.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_cloudcontrolapi_resource import DataAwsCloudcontrolapiResource
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsCloudcontrolapiResource(self, "example",
+            identifier="example",
+            type_name="AWS::ECS::Cluster"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `identifier` - (Required) Identifier of the CloudFormation resource type. For example, `vpc-12345678`.
+* `type_name` - (Required) CloudFormation resource type name. For example, `AWS::EC2::VPC`.
+
+The following arguments are optional:
+
+* `role_arn` - (Optional) ARN of the IAM Role to assume for operations.
+* `type_version_id` - (Optional) Identifier of the CloudFormation resource type version.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `properties` - JSON string matching the CloudFormation resource type schema with current configuration. Underlying attributes can be referenced via the [`jsondecode()` function](https://www.terraform.io/docs/language/functions/jsondecode.html), for example, `jsondecode(data.aws_cloudcontrolapi_resource.example.properties)["example"]`.
+
+<!-- cache-key: cdktf-0.18.0 input-619243038d5099b2d587f9f52a10ce00ce779e82bd95bb840d0d03a6570a1a61 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/cloudformation_export.html.markdown b/website/docs/cdktf/python/d/cloudformation_export.html.markdown
new file mode 100644
index 00000000000..10a01c4e38d
--- /dev/null
+++ b/website/docs/cdktf/python/d/cloudformation_export.html.markdown
@@ -0,0 +1,54 @@
+---
+subcategory: "CloudFormation"
+layout: "aws"
+page_title: "AWS: aws_cloudformation_export"
+description: |-
+    Provides metadata of a CloudFormation Export (e.g., Cross Stack References)
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_cloudformation_export
+
+The CloudFormation Export data source allows access to stack
+exports specified in the [Output](http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/outputs-section-structure.html) section of the Cloudformation Template using the optional Export Property.
+
+ -> Note: If you are trying to use a value from a Cloudformation Stack in the same Terraform run please use normal interpolation or Cloudformation Outputs.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_cloudformation_export import DataAwsCloudformationExport
+from imports.aws.instance import Instance
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        subnet_id = DataAwsCloudformationExport(self, "subnet_id",
+            name="mySubnetIdExportName"
+        )
+        Instance(self, "web",
+            ami="ami-abb07bcb",
+            instance_type="t2.micro",
+            subnet_id=Token.as_string(subnet_id.value)
+        )
+```
+
+## Argument Reference
+
+* `name` - (Required) Name of the export as it appears in the console or from [list-exports](http://docs.aws.amazon.com/cli/latest/reference/cloudformation/list-exports.html)
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `value` - Value from Cloudformation export identified by the export name found from [list-exports](http://docs.aws.amazon.com/cli/latest/reference/cloudformation/list-exports.html)
+* `exporting_stack_id` - ARN of stack that contains the exported output name and value.
+
+<!-- cache-key: cdktf-0.18.0 input-ea221c8f2e1fb315847f21fd305282c9ac5244739898e9391797602940e42bd3 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/cloudformation_stack.html.markdown b/website/docs/cdktf/python/d/cloudformation_stack.html.markdown
new file mode 100644
index 00000000000..6c764de9e48
--- /dev/null
+++ b/website/docs/cdktf/python/d/cloudformation_stack.html.markdown
@@ -0,0 +1,66 @@
+---
+subcategory: "CloudFormation"
+layout: "aws"
+page_title: "AWS: aws_cloudformation_stack"
+description: |-
+    Provides metadata of a CloudFormation stack (e.g., outputs)
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_cloudformation_stack
+
+The CloudFormation Stack data source allows access to stack
+outputs and other useful data including the template body.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_cloudformation_stack import DataAwsCloudformationStack
+from imports.aws.instance import Instance
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        network = DataAwsCloudformationStack(self, "network",
+            name="my-network-stack"
+        )
+        Instance(self, "web",
+            ami="ami-abb07bcb",
+            instance_type="t2.micro",
+            subnet_id=Token.as_string(
+                Fn.lookup_nested(network.outputs, ["\"SubnetId\""])),
+            tags={
+                "Name": "HelloWorld"
+            }
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name of the stack
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `capabilities` - List of capabilities
+* `description` - Description of the stack
+* `disable_rollback` - Whether the rollback of the stack is disabled when stack creation fails
+* `notification_arns` - List of SNS topic ARNs to publish stack related events
+* `outputs` - Map of outputs from the stack.
+* `parameters` - Map of parameters that specify input parameters for the stack.
+* `tags` - Map of tags associated with this stack.
+* `template_body` - Structure containing the template body.
+* `iam_role_arn` - ARN of the IAM role used to create the stack.
+* `timeout_in_minutes` - Amount of time that can pass before the stack status becomes `CREATE_FAILED`
+
+<!-- cache-key: cdktf-0.18.0 input-a9acea3392c4b01ef5f2a16da219c4a26f63291cbb995f3f40b2de0113d12c7d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/cloudformation_type.html.markdown b/website/docs/cdktf/python/d/cloudformation_type.html.markdown
new file mode 100644
index 00000000000..307a2aa99b3
--- /dev/null
+++ b/website/docs/cdktf/python/d/cloudformation_type.html.markdown
@@ -0,0 +1,62 @@
+---
+subcategory: "CloudFormation"
+layout: "aws"
+page_title: "AWS: aws_cloudformation_type"
+description: |-
+    Provides details about a CloudFormation Type.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_cloudformation_type
+
+Provides details about a CloudFormation Type.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_cloudformation_type import DataAwsCloudformationType
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsCloudformationType(self, "example",
+            type="RESOURCE",
+            type_name="AWS::Athena::WorkGroup"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `arn` - (Optional) ARN of the CloudFormation Type. For example, `arn:aws:cloudformation:us-west-2::type/resource/AWS-EC2-VPC`.
+* `type` - (Optional) CloudFormation Registry Type. For example, `RESOURCE`.
+* `type_name` - (Optional) CloudFormation Type name. For example, `AWS::EC2::VPC`.
+* `version_id` - (Optional) Identifier of the CloudFormation Type version.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `default_version_id` - Identifier of the CloudFormation Type default version.
+* `deprecated_status` - Deprecation status of the CloudFormation Type.
+* `description` - Description of the CloudFormation Type.
+* `documentation_url` - URL of the documentation for the CloudFormation Type.
+* `execution_role_arn` - ARN of the IAM Role used to register the CloudFormation Type.
+* `is_default_version` - Whether the CloudFormation Type version is the default version.
+* `logging_config` - List of objects containing logging configuration.
+    * `log_group_name` - Name of the CloudWatch Log Group where CloudFormation sends error logging information when invoking the type's handlers.
+    * `log_role_arn` - ARN of the IAM Role CloudFormation assumes when sending error logging information to CloudWatch Logs.
+* `provisioning_type` - Provisioning behavior of the CloudFormation Type.
+* `schema` - JSON document of the CloudFormation Type schema.
+* `source_url` - URL of the source code for the CloudFormation Type.
+* `visibility` - Scope of the CloudFormation Type.
+
+<!-- cache-key: cdktf-0.18.0 input-dbfea51aa26b3fcf5acdfa155004e8f1f27058ce9b62acf8eba0a37e7a8775f5 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/cloudfront_cache_policy.html.markdown b/website/docs/cdktf/python/d/cloudfront_cache_policy.html.markdown
new file mode 100644
index 00000000000..adcb46b9e9c
--- /dev/null
+++ b/website/docs/cdktf/python/d/cloudfront_cache_policy.html.markdown
@@ -0,0 +1,102 @@
+---
+subcategory: "CloudFront"
+layout: "aws"
+page_title: "AWS: aws_cloudfront_cache_policy"
+description: |-
+  Use this data source to retrieve information about a CloudFront cache policy.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_cloudfront_cache_policy
+
+Use this data source to retrieve information about a CloudFront cache policy.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_cloudfront_cache_policy import DataAwsCloudfrontCachePolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsCloudfrontCachePolicy(self, "example",
+            name="example-policy"
+        )
+```
+
+### AWS-Managed Policies
+
+AWS managed cache policy names are prefixed with `Managed-`:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_cloudfront_cache_policy import DataAwsCloudfrontCachePolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsCloudfrontCachePolicy(self, "example",
+            name="Managed-CachingOptimized"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Optional) Unique name to identify the cache policy.
+* `id` - (Optional) Identifier for the cache policy.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `etag` - Current version of the cache policy.
+* `min_ttl` - Minimum amount of time, in seconds, that you want objects to stay in the CloudFront cache before CloudFront sends another request to the origin to see if the object has been updated.
+* `max_ttl` - Maximum amount of time, in seconds, that objects stay in the CloudFront cache before CloudFront sends another request to the origin to see if the object has been updated.
+* `default_ttl` - Default amount of time, in seconds, that you want objects to stay in the CloudFront cache before CloudFront sends another request to the origin to see if the object has been updated.
+* `comment` - Comment to describe the cache policy.
+* `parameters_in_cache_key_and_forwarded_to_origin` - The HTTP headers, cookies, and URL query strings to include in the cache key. See [Parameters In Cache Key And Forwarded To Origin](#parameters-in-cache-key-and-forwarded-to-origin) for more information.
+
+### Parameters In Cache Key And Forwarded To Origin
+
+* `cookies_config` - Object that determines whether any cookies in viewer requests (and if so, which cookies) are included in the cache key and automatically included in requests that CloudFront sends to the origin. See [Cookies Config](#cookies-config) for more information.
+* `headers_config` - Object that determines whether any HTTP headers (and if so, which headers) are included in the cache key and automatically included in requests that CloudFront sends to the origin. See [Headers Config](#headers-config) for more information.
+* `query_strings_config` - Object that determines whether any URL query strings in viewer requests (and if so, which query strings) are included in the cache key and automatically included in requests that CloudFront sends to the origin. See [Query String Config](#query-string-config) for more information.
+* `enable_accept_encoding_brotli` - A flag that can affect whether the Accept-Encoding HTTP header is included in the cache key and included in requests that CloudFront sends to the origin.
+* `enable_accept_encoding_gzip` - A flag that can affect whether the Accept-Encoding HTTP header is included in the cache key and included in requests that CloudFront sends to the origin.
+
+### Cookies Config
+
+* `cookie_behavior` - Determines whether any cookies in viewer requests are included in the cache key and automatically included in requests that CloudFront sends to the origin. Valid values are `none`, `whitelist`, `allExcept`, `all`.
+* `cookies` - Object that contains a list of cookie names. See [Items](#items) for more information.
+
+### Headers Config
+
+* `header_behavior` - Determines whether any HTTP headers are included in the cache key and automatically included in requests that CloudFront sends to the origin. Valid values are `none`, `whitelist`.
+* `headers` - Object that contains a list of header names. See [Items](#items) for more information.
+
+### Query String Config
+
+* `query_string_behavior` - Determines whether any URL query strings in viewer requests are included in the cache key and automatically included in requests that CloudFront sends to the origin. Valid values are `none`, `whitelist`, `allExcept`, `all`.
+* `query_strings` - Object that contains a list of query string names. See [Items](#items) for more information.
+
+### Items
+
+* `items` - List of item names (`cookies`, `headers`, or `query_strings`).
+
+<!-- cache-key: cdktf-0.18.0 input-d2206ba916ee923999c55171522950c705c9bfd904c6382e709e850f3e24144f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/cloudfront_distribution.html.markdown b/website/docs/cdktf/python/d/cloudfront_distribution.html.markdown
new file mode 100644
index 00000000000..269892df73c
--- /dev/null
+++ b/website/docs/cdktf/python/d/cloudfront_distribution.html.markdown
@@ -0,0 +1,68 @@
+---
+subcategory: "CloudFront"
+layout: "aws"
+page_title: "AWS: aws_cloudfront_distribution"
+description: |-
+  Provides a CloudFront web distribution data source.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_cloudfront_distribution
+
+Use this data source to retrieve information about a CloudFront distribution.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_cloudfront_distribution import DataAwsCloudfrontDistribution
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsCloudfrontDistribution(self, "test",
+            id="EDFDVBD632BHDS5"
+        )
+```
+
+## Argument Reference
+
+* `id` - Identifier for the distribution. For example: `EDFDVBD632BHDS5`.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - Identifier for the distribution. For example: `EDFDVBD632BHDS5`.
+
+* `aliases` - List that contains information about CNAMEs (alternate domain names), if any, for this distribution.
+
+* `arn` - ARN (Amazon Resource Name) for the distribution. For example: arn:aws:cloudfront::123456789012:distribution/EDFDVBD632BHDS5, where 123456789012 is your AWS account ID.
+
+* `status` - Current status of the distribution. `Deployed` if the
+    distribution's information is fully propagated throughout the Amazon
+    CloudFront system.
+
+* `domain_name` - Domain name corresponding to the distribution. For
+    example: `d604721fxaaqy9.cloudfront.net`.
+
+* `last_modified_time` - Date and time the distribution was last modified.
+
+* `in_progress_validation_batches` - The number of invalidation batches
+    currently in progress.
+
+* `etag` - Current version of the distribution's information. For example:
+    `E2QWRUHAPOMQZL`.
+
+* `hosted_zone_id` - CloudFront Route 53 zone ID that can be used to
+     route an [Alias Resource Record Set][7] to. This attribute is simply an
+     alias for the zone ID `Z2FDTNDATAQYW2`.
+* `web_acl_id` AWS WAF web ACL associated with this distribution.
+
+<!-- cache-key: cdktf-0.18.0 input-76fd4092d64caf3eb602d2f1b7554e0601ea2cb2c116df5092f91bc933e23c48 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/cloudfront_function.html.markdown b/website/docs/cdktf/python/d/cloudfront_function.html.markdown
new file mode 100644
index 00000000000..5c92ce52875
--- /dev/null
+++ b/website/docs/cdktf/python/d/cloudfront_function.html.markdown
@@ -0,0 +1,59 @@
+---
+subcategory: "CloudFront"
+layout: "aws"
+page_title: "AWS: aws_cloudfront_function"
+description: |-
+  Provides a CloudFront Function data source.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# aws_cloudfront_function
+
+Provides information about a CloudFront Function.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import VariableType, TerraformVariable, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_cloudfront_function import DataAwsCloudfrontFunction
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, stage):
+        super().__init__(scope, name)
+        # Terraform Variables are not always the best fit for getting inputs in the context of Terraform CDK.
+        #     You can read more about this at https://cdk.tf/variables
+        function_name = TerraformVariable(self, "function_name",
+            type=VariableType.STRING
+        )
+        DataAwsCloudfrontFunction(self, "existing",
+            name=function_name.string_value,
+            stage=stage
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name of the CloudFront function.
+* `stage` - (Required) Function’s stage, either `DEVELOPMENT` or `LIVE`.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN identifying your CloudFront Function.
+* `code` - Source code of the function
+* `comment` - Comment.
+* `etag` - ETag hash of the function
+* `last_modified_time` - When this resource was last modified.
+* `runtime` - Identifier of the function's runtime.
+* `status` - Status of the function. Can be `UNPUBLISHED`, `UNASSOCIATED` or `ASSOCIATED`.
+
+<!-- cache-key: cdktf-0.18.0 input-91b978e70ce3fa4778a1e7fadb7052748a3a704504ddaff849ccb10b0b522561 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/cloudfront_log_delivery_canonical_user_id.html.markdown b/website/docs/cdktf/python/d/cloudfront_log_delivery_canonical_user_id.html.markdown
new file mode 100644
index 00000000000..64a507c0b14
--- /dev/null
+++ b/website/docs/cdktf/python/d/cloudfront_log_delivery_canonical_user_id.html.markdown
@@ -0,0 +1,69 @@
+---
+subcategory: "CloudFront"
+layout: "aws"
+page_title: "AWS: aws_cloudfront_log_delivery_canonical_user_id"
+description: |-
+  Provides the canonical user ID of the AWS `awslogsdelivery` account for CloudFront bucket logging.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_cloudfront_log_delivery_canonical_user_id
+
+The CloudFront Log Delivery Canonical User ID data source allows access to the [canonical user ID](http://docs.aws.amazon.com/general/latest/gr/acct-identifiers.html) of the AWS `awslogsdelivery` account for CloudFront bucket logging.
+See the [Amazon CloudFront Developer Guide](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/AccessLogs.html) for more information.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_cloudfront_log_delivery_canonical_user_id import DataAwsCloudfrontLogDeliveryCanonicalUserId
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_acl import S3BucketAcl
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, owner):
+        super().__init__(scope, name)
+        example = S3Bucket(self, "example",
+            bucket="example"
+        )
+        data_aws_cloudfront_log_delivery_canonical_user_id_example =
+        DataAwsCloudfrontLogDeliveryCanonicalUserId(self, "example_1")
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_cloudfront_log_delivery_canonical_user_id_example.override_logical_id("example")
+        aws_s3_bucket_acl_example = S3BucketAcl(self, "example_2",
+            access_control_policy=S3BucketAclAccessControlPolicy(
+                grant=[S3BucketAclAccessControlPolicyGrant(
+                    grantee=S3BucketAclAccessControlPolicyGrantGrantee(
+                        id=Token.as_string(data_aws_cloudfront_log_delivery_canonical_user_id_example.id),
+                        type="CanonicalUser"
+                    ),
+                    permission="FULL_CONTROL"
+                )
+                ],
+                owner=owner
+            ),
+            bucket=example.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_acl_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `region` - (Optional) Region you'd like the zone for. By default, fetches the current region.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - Canonical user ID for the AWS `awslogsdelivery` account in the region.
+
+<!-- cache-key: cdktf-0.18.0 input-2559298f99f82c97aa9ed9f52ecdd43d146cf2ecbc440cc80cecd164b8e630dc -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/cloudfront_origin_access_identities.html.markdown b/website/docs/cdktf/python/d/cloudfront_origin_access_identities.html.markdown
new file mode 100644
index 00000000000..2a9baf7a126
--- /dev/null
+++ b/website/docs/cdktf/python/d/cloudfront_origin_access_identities.html.markdown
@@ -0,0 +1,67 @@
+---
+subcategory: "CloudFront"
+layout: "aws"
+page_title: "AWS: aws_cloudfront_origin_access_identities"
+description: |-
+  Use this data source to retrieve information about a set of Amazon CloudFront origin access identities.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_cloudfront_origin_access_identities
+
+Use this data source to get ARNs, ids and S3 canonical user IDs of Amazon CloudFront origin access identities.
+
+## Example Usage
+
+### All origin access identities in the account
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_cloudfront_origin_access_identities import DataAwsCloudfrontOriginAccessIdentities
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsCloudfrontOriginAccessIdentities(self, "example")
+```
+
+### Origin access identities filtered by comment/name
+
+Origin access identities whose comments are `example-comment1`, `example-comment2`
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_cloudfront_origin_access_identities import DataAwsCloudfrontOriginAccessIdentities
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsCloudfrontOriginAccessIdentities(self, "example",
+            comments=["example-comment1", "example-comment2"]
+        )
+```
+
+## Argument Reference
+
+* `comments` (Optional) - Filter origin access identities by comment.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `iam_arns` - Set of ARNs of the matched origin access identities.
+* `ids` - Set of ids of the matched origin access identities.
+* `s3_canonical_user_ids` - Set of S3 canonical user IDs of the matched origin access identities.
+
+<!-- cache-key: cdktf-0.18.0 input-34f1ec8ef8003291bf6fbe0ad774299d58060f6ff187f903aecfd73ee7ad4efc -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/cloudfront_origin_access_identity.html.markdown b/website/docs/cdktf/python/d/cloudfront_origin_access_identity.html.markdown
new file mode 100644
index 00000000000..cd8a458c1e6
--- /dev/null
+++ b/website/docs/cdktf/python/d/cloudfront_origin_access_identity.html.markdown
@@ -0,0 +1,58 @@
+---
+subcategory: "CloudFront"
+layout: "aws"
+page_title: "AWS: aws_cloudfront_origin_access_identity"
+description: |-
+  Use this data source to retrieve information for an Amazon CloudFront origin access identity.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_cloudfront_origin_access_identity
+
+Use this data source to retrieve information for an Amazon CloudFront origin access identity.
+
+## Example Usage
+
+The following example below creates a CloudFront origin access identity.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_cloudfront_origin_access_identity import DataAwsCloudfrontOriginAccessIdentity
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsCloudfrontOriginAccessIdentity(self, "example",
+            id="EDFDVBD632BHDS5"
+        )
+```
+
+## Argument Reference
+
+* `id` (Required) -  The identifier for the distribution. For example: `EDFDVBD632BHDS5`.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `caller_reference` - Internal value used by CloudFront to allow future
+   updates to the origin access identity.
+* `cloudfront_access_identity_path` - A shortcut to the full path for the
+   origin access identity to use in CloudFront, see below.
+* `comment` - An optional comment for the origin access identity.
+* `etag` - Current version of the origin access identity's information.
+   For example: `E2QWRUHAPOMQZL`.
+* `iam_arn` - Pre-generated ARN for use in S3 bucket policies (see below).
+   Example: `arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity
+ E2QWRUHAPOMQZL`.
+* `s3_canonical_user_id` - The Amazon S3 canonical user ID for the origin
+   access identity, which you use when giving the origin access identity read
+   permission to an object in Amazon S3.
+
+<!-- cache-key: cdktf-0.18.0 input-6ee07d67e88c83135a682bc01ecae9a6413d07992377fed93295e34cd1b0ceec -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/cloudfront_origin_request_policy.html.markdown b/website/docs/cdktf/python/d/cloudfront_origin_request_policy.html.markdown
new file mode 100644
index 00000000000..a462b764ef3
--- /dev/null
+++ b/website/docs/cdktf/python/d/cloudfront_origin_request_policy.html.markdown
@@ -0,0 +1,91 @@
+---
+subcategory: "CloudFront"
+layout: "aws"
+page_title: "AWS: aws_cloudfront_origin_request_policy"
+description: |-
+  Determines the values that CloudFront includes in requests that it sends to the origin.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_cloudfront_origin_request_policy
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_cloudfront_origin_request_policy import DataAwsCloudfrontOriginRequestPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsCloudfrontOriginRequestPolicy(self, "example",
+            name="example-policy"
+        )
+```
+
+### AWS-Managed Policies
+
+AWS managed origin request policy names are prefixed with `Managed-`:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_cloudfront_origin_request_policy import DataAwsCloudfrontOriginRequestPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsCloudfrontOriginRequestPolicy(self, "ua_referer",
+            name="Managed-UserAgentRefererHeaders"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - Unique name to identify the origin request policy.
+* `id` - Identifier for the origin request policy.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `comment` - Comment to describe the origin request policy.
+* `cookies_config` - Object that determines whether any cookies in viewer requests (and if so, which cookies) are included in the origin request key and automatically included in requests that CloudFront sends to the origin. See [Cookies Config](#cookies-config) for more information.
+* `etag` - Current version of the origin request policy.
+* `headers_config` - Object that determines whether any HTTP headers (and if so, which headers) are included in the origin request key and automatically included in requests that CloudFront sends to the origin. See [Headers Config](#headers-config) for more information.
+* `query_strings_config` - Object that determines whether any URL query strings in viewer requests (and if so, which query strings) are included in the origin request key and automatically included in requests that CloudFront sends to the origin. See [Query String Config](#query-string-config) for more information.
+
+### Cookies Config
+
+`cookie_behavior` - Determines whether any cookies in viewer requests are included in the origin request key and automatically included in requests that CloudFront sends to the origin. Valid values are `none`, `whitelist` `all`.
+`cookies` - Object that contains a list of cookie names. See [Items](#items) for more information.
+
+### Headers Config
+
+`header_behavior` - Determines whether any HTTP headers are included in the origin request key and automatically included in requests that CloudFront sends to the origin. Valid values are `none`, `whitelist`, `allViewer`, `allViewerAndWhitelistCloudFront`.
+`headers` - Object that contains a list of header names. See [Items](#items) for more information.
+
+### Query String Config
+
+`query_string_behavior` - Determines whether any URL query strings in viewer requests are included in the origin request key and automatically included in requests that CloudFront sends to the origin. Valid values are `none`, `whitelist`, `all`.
+`query_strings` - Object that contains a list of query string names. See [Items](#items) for more information.
+
+### Items
+
+`items` - List of item names (cookies, headers, or query strings).
+
+<!-- cache-key: cdktf-0.18.0 input-302109f4c0fde1e60aeb00b2aa87f0426e0944c3dc7969f58b1b182e3ccb56a1 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/cloudfront_realtime_log_config.html.markdown b/website/docs/cdktf/python/d/cloudfront_realtime_log_config.html.markdown
new file mode 100644
index 00000000000..f7012e5c58b
--- /dev/null
+++ b/website/docs/cdktf/python/d/cloudfront_realtime_log_config.html.markdown
@@ -0,0 +1,60 @@
+---
+subcategory: "CloudFront"
+layout: "aws"
+page_title: "AWS: aws_cloudfront_realtime_log_config"
+description: |-
+  Provides a CloudFront real-time log configuration resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_cloudfront_realtime_log_config
+
+Provides a CloudFront real-time log configuration resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_cloudfront_realtime_log_config import DataAwsCloudfrontRealtimeLogConfig
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsCloudfrontRealtimeLogConfig(self, "example",
+            name="example"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Unique name to identify this real-time log configuration.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN (Amazon Resource Name) of the CloudFront real-time log configuration.
+* `endpoint` - (Required) Amazon Kinesis data streams where real-time log data is sent.
+* `fields` - (Required) Fields that are included in each real-time log record. See the [AWS documentation](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/real-time-logs.html#understand-real-time-log-config-fields) for supported values.
+* `sampling_rate` - (Required) Sampling rate for this real-time log configuration. The sampling rate determines the percentage of viewer requests that are represented in the real-time log data. An integer between `1` and `100`, inclusive.
+
+The `endpoint` object supports the following:
+
+* `kinesis_stream_config` - (Required) Amazon Kinesis data stream configuration.
+* `stream_type` - (Required) Type of data stream where real-time log data is sent. The only valid value is `Kinesis`.
+
+The `kinesis_stream_config` object supports the following:
+
+* `role_arn` - (Required) ARN of an [IAM role](iam_role.html) that CloudFront can use to send real-time log data to the Kinesis data stream.
+See the [AWS documentation](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/real-time-logs.html#understand-real-time-log-config-iam-role) for more information.
+* `stream_arn` - (Required) ARN of the [Kinesis data stream](kinesis_stream.html).
+
+<!-- cache-key: cdktf-0.18.0 input-6e46dcbfc5e16d8ff6f2789ee3bd99879502463156b4531588dacfee314c12ca -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/cloudfront_response_headers_policy.html.markdown b/website/docs/cdktf/python/d/cloudfront_response_headers_policy.html.markdown
new file mode 100644
index 00000000000..03f6d826e6b
--- /dev/null
+++ b/website/docs/cdktf/python/d/cloudfront_response_headers_policy.html.markdown
@@ -0,0 +1,142 @@
+---
+subcategory: "CloudFront"
+layout: "aws"
+page_title: "AWS: aws_cloudfront_response_headers_policy"
+description: |-
+  Use this data source to retrieve information about a CloudFront response headers policy.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_cloudfront_response_headers_policy
+
+Use this data source to retrieve information about a CloudFront cache policy.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_cloudfront_response_headers_policy import DataAwsCloudfrontResponseHeadersPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsCloudfrontResponseHeadersPolicy(self, "example",
+            name="example-policy"
+        )
+```
+
+### AWS-Managed Policies
+
+AWS managed response header policy names are prefixed with `Managed-`:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_cloudfront_response_headers_policy import DataAwsCloudfrontResponseHeadersPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsCloudfrontResponseHeadersPolicy(self, "example",
+            name="Managed-SimpleCORS"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Optional) Unique name to identify the response headers policy.
+* `id` - (Optional) Identifier for the response headers policy.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `comment` - Comment to describe the response headers policy. The comment cannot be longer than 128 characters.
+* `etag` - Current version of the response headers policy.
+* `cors_config` - Configuration for a set of HTTP response headers that are used for Cross-Origin Resource Sharing (CORS). See [Cors Config](#cors-config) for more information.
+* `custom_headers_config` - Object that contains an attribute `items` that contains a list of Custom Headers. See [Custom Header](#custom-header) for more information.
+* `remove_headers_config` - Object that contains an attribute `items` that contains a list of Remove Headers. See [Remove Header](#remove-header) for more information.
+* `security_headers_config` - A configuration for a set of security-related HTTP response headers. See [Security Headers Config](#security-headers-config) for more information.
+* `server_timing_headers_config` - (Optional) Configuration for enabling the Server-Timing header in HTTP responses sent from CloudFront. See [Server Timing Headers Config](#server-timing-headers-config) for more information.
+
+### Cors Config
+
+* `access_control_allow_credentials` - A Boolean value that CloudFront uses as the value for the Access-Control-Allow-Credentials HTTP response header.
+* `access_control_allow_headers` - Object that contains an attribute `items` that contains a list of HTTP header names that CloudFront includes as values for the Access-Control-Allow-Headers HTTP response header.
+* `access_control_allow_methods` - Object that contains an attribute `items` that contains a list of HTTP methods that CloudFront includes as values for the Access-Control-Allow-Methods HTTP response header. Valid values: `GET` | `POST` | `OPTIONS` | `PUT` | `DELETE` | `HEAD` | `ALL`
+* `access_control_allow_origins` - Object that contains an attribute `items` that contains a list of origins that CloudFront can use as the value for the Access-Control-Allow-Origin HTTP response header.
+* `access_control_expose_headers` - Object that contains an attribute `items` that contains a list of HTTP headers that CloudFront includes as values for the Access-Control-Expose-Headers HTTP response header.
+* `access_control_max_age_sec` - A number that CloudFront uses as the value for the Access-Control-Max-Age HTTP response header.
+
+### Custom Header
+
+* `header` - HTTP response header name.
+* `override` - Whether CloudFront overrides a response header with the same name received from the origin with the header specifies here.
+* `value` - Value for the HTTP response header.
+
+### Remove Header
+
+* `header` - The HTTP header name.
+
+### Security Headers Config
+
+* `content_security_policy` - The policy directives and their values that CloudFront includes as values for the Content-Security-Policy HTTP response header. See [Content Security Policy](#content-security-policy) for more information.
+* `content_type_options` - A setting that determines whether CloudFront includes the X-Content-Type-Options HTTP response header with its value set to nosniff. See [Content Type Options](#content-type-options) for more information.
+* `frame_options` - Setting that determines whether CloudFront includes the X-Frame-Options HTTP response header and the header’s value. See [Frame Options](#frame-options) for more information.
+* `referrer_policy` - Setting that determines whether CloudFront includes the Referrer-Policy HTTP response header and the header’s value. See [Referrer Policy](#referrer-policy) for more information.
+* `strict_transport_security` - Settings that determine whether CloudFront includes the Strict-Transport-Security HTTP response header and the header’s value. See [Strict Transport Security](#strict-transport-security) for more information.
+* `xss_protection` - Settings that determine whether CloudFront includes the X-XSS-Protection HTTP response header and the header’s value. See [XSS Protection](#xss-protection) for more information.
+
+### Content Security Policy
+
+* `content_security_policy` - The policy directives and their values that CloudFront includes as values for the Content-Security-Policy HTTP response header.
+* `override` - Whether CloudFront overrides the Content-Security-Policy HTTP response header received from the origin with the one specified in this response headers policy.
+
+### Content Type Options
+
+* `override` - Whether CloudFront overrides the X-Content-Type-Options HTTP response header received from the origin with the one specified in this response headers policy.
+
+### Frame Options
+
+* `frame_option` - Value of the X-Frame-Options HTTP response header. Valid values: `DENY` | `SAMEORIGIN`
+* `override` - Whether CloudFront overrides the X-Frame-Options HTTP response header received from the origin with the one specified in this response headers policy.
+
+### Referrer Policy
+
+* `referrer_policy` - Value of the Referrer-Policy HTTP response header. Valid Values: `no-referrer` | `no-referrer-when-downgrade` | `origin` | `origin-when-cross-origin` | `same-origin` | `strict-origin` | `strict-origin-when-cross-origin` | `unsafe-url`
+* `override` - Whether CloudFront overrides the Referrer-Policy HTTP response header received from the origin with the one specified in this response headers policy.
+
+### Strict Transport Security
+
+* `access_control_max_age_sec` - A number that CloudFront uses as the value for the max-age directive in the Strict-Transport-Security HTTP response header.
+* `include_subdomains` - Whether CloudFront includes the includeSubDomains directive in the Strict-Transport-Security HTTP response header.
+* `override` - Whether CloudFront overrides the Strict-Transport-Security HTTP response header received from the origin with the one specified in this response headers policy.
+* `preload` - Whether CloudFront includes the preload directive in the Strict-Transport-Security HTTP response header.
+
+### XSS Protection
+
+* `mode_block` - Whether CloudFront includes the mode=block directive in the X-XSS-Protection header.
+* `override` - Whether CloudFront overrides the X-XSS-Protection HTTP response header received from the origin with the one specified in this response headers policy.
+* `protection` - Boolean value that determines the value of the X-XSS-Protection HTTP response header. When this setting is true, the value of the X-XSS-Protection header is 1. When this setting is false, the value of the X-XSS-Protection header is 0.
+* `report_uri` - Whether CloudFront sets a reporting URI in the X-XSS-Protection header.
+
+### Server Timing Headers Config
+
+* `enabled` - Whether CloudFront adds the `Server-Timing` header to HTTP responses that it sends in response to requests that match a cache behavior that's associated with this response headers policy.
+* `sampling_rate` - Number 0–100 (inclusive) that specifies the percentage of responses that you want CloudFront to add the Server-Timing header to.
+
+<!-- cache-key: cdktf-0.18.0 input-72a56289982ff99c5a8915f5f70bc400c310b4c8325a6846d6c8b892d3eab9cb -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/cloudhsm_v2_cluster.html.markdown b/website/docs/cdktf/python/d/cloudhsm_v2_cluster.html.markdown
new file mode 100644
index 00000000000..0d81dca3b3d
--- /dev/null
+++ b/website/docs/cdktf/python/d/cloudhsm_v2_cluster.html.markdown
@@ -0,0 +1,56 @@
+---
+subcategory: "CloudHSM"
+layout: "aws"
+page_title: "AWS: aws_cloudhsm_v2_cluster"
+description: |-
+  Get information on a CloudHSM v2 cluster.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_cloudhsm_v2_cluster
+
+Use this data source to get information about a CloudHSM v2 cluster
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_cloudhsm_v2_cluster import DataAwsCloudhsmV2Cluster
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsCloudhsmV2Cluster(self, "cluster",
+            cluster_id="cluster-testclusterid"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `cluster_id` - (Required) ID of Cloud HSM v2 cluster.
+* `cluster_state` - (Optional) State of the cluster to be found.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `vpc_id` - ID of the VPC that the CloudHSM cluster resides in.
+* `security_group_id` - ID of the security group associated with the CloudHSM cluster.
+* `subnet_ids` - IDs of subnets in which cluster operates.
+* `cluster_certificates` - The list of cluster certificates.
+    * `cluster_certificates.0.cluster_certificate` - The cluster certificate issued (signed) by the issuing certificate authority (CA) of the cluster's owner.
+    * `cluster_certificates.0.cluster_csr` - The certificate signing request (CSR). Available only in UNINITIALIZED state.
+    * `cluster_certificates.0.aws_hardware_certificate` - The HSM hardware certificate issued (signed) by AWS CloudHSM.
+    * `cluster_certificates.0.hsm_certificate` - The HSM certificate issued (signed) by the HSM hardware.
+    * `cluster_certificates.0.manufacturer_hardware_certificate` - The HSM hardware certificate issued (signed) by the hardware manufacturer.
+The number of available cluster certificates may vary depending on state of the cluster.
+
+<!-- cache-key: cdktf-0.18.0 input-cafc753026d5e76ff2fae8fcd6781f60ca5e79de76e720cef8a6975659131495 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/cloudtrail_service_account.html.markdown b/website/docs/cdktf/python/d/cloudtrail_service_account.html.markdown
new file mode 100644
index 00000000000..cf791f3a563
--- /dev/null
+++ b/website/docs/cdktf/python/d/cloudtrail_service_account.html.markdown
@@ -0,0 +1,82 @@
+---
+subcategory: "CloudTrail"
+layout: "aws"
+page_title: "AWS: aws_cloudtrail_service_account"
+description: |-
+  Get AWS CloudTrail Service Account ID for storing trail data in S3.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_cloudtrail_service_account
+
+Use this data source to get the Account ID of the [AWS CloudTrail Service Account](http://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-supported-regions.html)
+in a given region for the purpose of allowing CloudTrail to store trail data in S3.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_cloudtrail_service_account import DataAwsCloudtrailServiceAccount
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_policy import S3BucketPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        bucket = S3Bucket(self, "bucket",
+            bucket="tf-cloudtrail-logging-test-bucket",
+            force_destroy=True
+        )
+        main = DataAwsCloudtrailServiceAccount(self, "main")
+        allow_cloudtrail_logging = DataAwsIamPolicyDocument(self, "allow_cloudtrail_logging",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["s3:PutObject"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=[Token.as_string(main.arn)],
+                    type="AWS"
+                )
+                ],
+                resources=["${" + bucket.arn + "}/*"],
+                sid="Put bucket policy needed for trails"
+            ), DataAwsIamPolicyDocumentStatement(
+                actions=["s3:GetBucketAcl"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=[Token.as_string(main.arn)],
+                    type="AWS"
+                )
+                ],
+                resources=[bucket.arn],
+                sid="Get bucket policy needed for trails"
+            )
+            ]
+        )
+        aws_s3_bucket_policy_allow_cloudtrail_logging = S3BucketPolicy(self, "allow_cloudtrail_logging_3",
+            bucket=bucket.id,
+            policy=Token.as_string(allow_cloudtrail_logging.json)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_policy_allow_cloudtrail_logging.override_logical_id("allow_cloudtrail_logging")
+```
+
+## Argument Reference
+
+* `region` - (Optional) Name of the region whose AWS CloudTrail account ID is desired.
+Defaults to the region from the AWS provider configuration.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the AWS CloudTrail service account in the selected region.
+* `arn` - ARN of the AWS CloudTrail service account in the selected region.
+
+<!-- cache-key: cdktf-0.18.0 input-c5f519c52875128e9a18f748579bb40b5819ba4da9ebe83e2a9cb71b3becf3ad -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/cloudwatch_event_bus.html.markdown b/website/docs/cdktf/python/d/cloudwatch_event_bus.html.markdown
new file mode 100644
index 00000000000..14b6138de9c
--- /dev/null
+++ b/website/docs/cdktf/python/d/cloudwatch_event_bus.html.markdown
@@ -0,0 +1,46 @@
+---
+subcategory: "EventBridge"
+layout: "aws"
+page_title: "AWS: aws_cloudwatch_event_bus"
+description: |-
+  Get information on an EventBridge (Cloudwatch) Event Bus.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_cloudwatch_event_bus
+
+This data source can be used to fetch information about a specific
+EventBridge event bus. Use this data source to compute the ARN of
+an event bus, given the name of the bus.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_cloudwatch_event_bus import DataAwsCloudwatchEventBus
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsCloudwatchEventBus(self, "example",
+            name="example-bus-name"
+        )
+```
+
+## Argument Reference
+
+* `name` - (Required) Friendly EventBridge event bus name.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN.
+
+<!-- cache-key: cdktf-0.18.0 input-6d48ebb9d36b6f8a656ed8f66550b6d3efee3a308c32d635751c6d385e62d112 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/cloudwatch_event_connection.html.markdown b/website/docs/cdktf/python/d/cloudwatch_event_connection.html.markdown
new file mode 100644
index 00000000000..6a95b355dbe
--- /dev/null
+++ b/website/docs/cdktf/python/d/cloudwatch_event_connection.html.markdown
@@ -0,0 +1,52 @@
+---
+subcategory: "EventBridge"
+layout: "aws"
+page_title: "AWS: aws_cloudwatch_event_connection"
+description: |-
+  Provides an EventBridge connection data source.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_cloudwatch_event_connection
+
+Use this data source to retrieve information about an EventBridge connection.
+
+~> **Note:** EventBridge was formerly known as CloudWatch Events. The functionality is identical.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_cloudwatch_event_connection import DataAwsCloudwatchEventConnection
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsCloudwatchEventConnection(self, "test",
+            name="test"
+        )
+```
+
+## Argument Reference
+
+* `name` - Name of the connection.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `name` - Name of the connection.
+
+* `arn` - ARN (Amazon Resource Name) for the connection.
+
+* `secret_arn` - ARN (Amazon Resource Name) for the secret created from the authorization parameters specified for the connection.
+
+* `authorization_type` - Type of authorization to use to connect. One of `API_KEY`,`BASIC`,`OAUTH_CLIENT_CREDENTIALS`.
+
+<!-- cache-key: cdktf-0.18.0 input-c28a6e87c62c9016e5553ac80ba81f240b8c76ab8a07aa2ea802508e58427f58 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/cloudwatch_event_source.html.markdown b/website/docs/cdktf/python/d/cloudwatch_event_source.html.markdown
new file mode 100644
index 00000000000..7eae3fdf90d
--- /dev/null
+++ b/website/docs/cdktf/python/d/cloudwatch_event_source.html.markdown
@@ -0,0 +1,51 @@
+---
+subcategory: "EventBridge"
+layout: "aws"
+page_title: "AWS: aws_cloudwatch_event_source"
+description: |-
+  Get information on an EventBridge (Cloudwatch) Event Source.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_cloudwatch_event_source
+
+Use this data source to get information about an EventBridge Partner Event Source. This data source will only return one partner event source. An error will be returned if multiple sources match the same name prefix.
+
+~> **Note:** EventBridge was formerly known as CloudWatch Events. The functionality is identical.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_cloudwatch_event_source import DataAwsCloudwatchEventSource
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsCloudwatchEventSource(self, "examplepartner",
+            name_prefix="aws.partner/examplepartner.com"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name_prefix` - (Optional) Specifying this limits the results to only those partner event sources with names that start with the specified prefix
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the partner event source
+* `created_by` - Name of the SaaS partner that created the event source
+* `name` - Name of the event source
+* `state` - State of the event source (`ACTIVE` or `PENDING`)
+
+<!-- cache-key: cdktf-0.18.0 input-7fea3094a9236a42f149275c2bbaa33e18c22a2111ac12ba23865c087753c6e6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/cloudwatch_log_data_protection_policy_document.html.markdown b/website/docs/cdktf/python/d/cloudwatch_log_data_protection_policy_document.html.markdown
new file mode 100644
index 00000000000..190aab95cba
--- /dev/null
+++ b/website/docs/cdktf/python/d/cloudwatch_log_data_protection_policy_document.html.markdown
@@ -0,0 +1,133 @@
+---
+subcategory: "CloudWatch Logs"
+layout: "aws"
+page_title: "AWS: aws_cloudwatch_log_data_protection_policy_document"
+description: |-
+  Generates a CloudWatch Log Group Data Protection Policy document in JSON format
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_cloudwatch_log_data_protection_policy_document
+
+Generates a CloudWatch Log Group Data Protection Policy document in JSON format for use with the `aws_cloudwatch_log_data_protection_policy` resource.
+
+-> For more information about data protection policies, see the [Help protect sensitive log data with masking](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/mask-sensitive-log-data.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudwatch_log_data_protection_policy import CloudwatchLogDataProtectionPolicy
+from imports.aws.data_aws_cloudwatch_log_data_protection_policy_document import DataAwsCloudwatchLogDataProtectionPolicyDocument
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = DataAwsCloudwatchLogDataProtectionPolicyDocument(self, "example",
+            name="Example",
+            statement=[DataAwsCloudwatchLogDataProtectionPolicyDocumentStatement(
+                data_identifiers=["arn:aws:dataprotection::aws:data-identifier/EmailAddress", "arn:aws:dataprotection::aws:data-identifier/DriversLicense-US"
+                ],
+                operation=DataAwsCloudwatchLogDataProtectionPolicyDocumentStatementOperation(
+                    audit=DataAwsCloudwatchLogDataProtectionPolicyDocumentStatementOperationAudit(
+                        findings_destination=DataAwsCloudwatchLogDataProtectionPolicyDocumentStatementOperationAuditFindingsDestination(
+                            cloudwatch_logs=DataAwsCloudwatchLogDataProtectionPolicyDocumentStatementOperationAuditFindingsDestinationCloudwatchLogs(
+                                log_group=audit.name
+                            ),
+                            firehose=DataAwsCloudwatchLogDataProtectionPolicyDocumentStatementOperationAuditFindingsDestinationFirehose(
+                                delivery_stream=Token.as_string(aws_kinesis_firehose_delivery_stream_audit.name)
+                            ),
+                            s3=DataAwsCloudwatchLogDataProtectionPolicyDocumentStatementOperationAuditFindingsDestinationS3(
+                                bucket=Token.as_string(aws_s3_bucket_audit.bucket)
+                            )
+                        )
+                    )
+                ),
+                sid="Audit"
+            ), DataAwsCloudwatchLogDataProtectionPolicyDocumentStatement(
+                data_identifiers=["arn:aws:dataprotection::aws:data-identifier/EmailAddress", "arn:aws:dataprotection::aws:data-identifier/DriversLicense-US"
+                ],
+                operation=DataAwsCloudwatchLogDataProtectionPolicyDocumentStatementOperation(
+                    deidentify=DataAwsCloudwatchLogDataProtectionPolicyDocumentStatementOperationDeidentify(
+                        mask_config=DataAwsCloudwatchLogDataProtectionPolicyDocumentStatementOperationDeidentifyMaskConfig()
+                    )
+                ),
+                sid="Deidentify"
+            )
+            ]
+        )
+        aws_cloudwatch_log_data_protection_policy_example =
+        CloudwatchLogDataProtectionPolicy(self, "example_1",
+            log_group_name=Token.as_string(aws_cloudwatch_log_group_example.name),
+            policy_document=Token.as_string(example.json)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_cloudwatch_log_data_protection_policy_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) The name of the data protection policy document.
+* `statement` - (Required) Configures the data protection policy.
+
+-> There must be exactly two statements: the first with an `audit` operation, and the second with a `deidentify` operation.
+
+The following arguments are optional:
+
+* `description` - (Optional)
+* `version` - (Optional)
+
+### statement Configuration Block
+
+* `data_identifiers` - (Required) Set of at least 1 sensitive data identifiers that you want to mask. Read more in [Types of data that you can protect](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/protect-sensitive-log-data-types.html).
+* `operation` - (Required) Configures the data protection operation applied by this statement.
+* `sid` - (Optional) Name of this statement.
+
+#### operation Configuration Block
+
+* `audit` - (Optional) Configures the detection of sensitive data.
+* `deidentify` - (Optional) Configures the masking of sensitive data.
+
+-> Every policy statement must specify exactly one operation.
+
+##### audit Configuration Block
+
+* `findings_destination` - (Required) Configures destinations to send audit findings to.
+
+##### findings_destination Configuration Block
+
+* `cloudwatch_logs` - (Optional) Configures CloudWatch Logs as a findings destination.
+* `firehose` - (Optional) Configures Kinesis Firehose as a findings destination.
+* `s3` - (Optional) Configures S3 as a findings destination.
+
+###### cloudwatch_logs Configuration Block
+
+* `log_group` - (Required) Name of the CloudWatch Log Group to send findings to.
+
+###### firehose Configuration Block
+
+* `delivery_stream` - (Required) Name of the Kinesis Firehose Delivery Stream to send findings to.
+
+###### s3 Configuration Block
+
+* `bucket` - (Required) Name of the S3 Bucket to send findings to.
+
+##### deidentify Configuration Block
+
+* `mask_config` - (Required) An empty object that configures masking.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `json` - Standard JSON policy document rendered based on the arguments above.
+
+<!-- cache-key: cdktf-0.18.0 input-f0c94e0aa8a0da473585431ea622f8f0cfd32bb09136ae337369c54288ff6f27 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/cloudwatch_log_group.html.markdown b/website/docs/cdktf/python/d/cloudwatch_log_group.html.markdown
new file mode 100644
index 00000000000..0afdc9b5ca8
--- /dev/null
+++ b/website/docs/cdktf/python/d/cloudwatch_log_group.html.markdown
@@ -0,0 +1,50 @@
+---
+subcategory: "CloudWatch Logs"
+layout: "aws"
+page_title: "AWS: aws_cloudwatch_log_group"
+description: |-
+  Get information on a Cloudwatch Log Group.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_cloudwatch_log_group
+
+Use this data source to get information about an AWS Cloudwatch Log Group
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_cloudwatch_log_group import DataAwsCloudwatchLogGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsCloudwatchLogGroup(self, "example",
+            name="MyImportantLogs"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name of the Cloudwatch log group
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Cloudwatch log group. Any `:*` suffix added by the API, denoting all CloudWatch Log Streams under the CloudWatch Log Group, is removed for greater compatibility with other AWS services that do not accept the suffix.
+* `creation_time` - Creation time of the log group, expressed as the number of milliseconds after Jan 1, 1970 00:00:00 UTC.
+* `retention_in_days` - Number of days log events retained in the specified log group.
+* `kms_key_id` - ARN of the KMS Key to use when encrypting log data.
+* `tags` - Map of tags to assign to the resource.
+
+<!-- cache-key: cdktf-0.18.0 input-98c67f629213b5447fa03395fb5fb657973411cf76bb2bdbeae232bee8c64098 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/cloudwatch_log_groups.html.markdown b/website/docs/cdktf/python/d/cloudwatch_log_groups.html.markdown
new file mode 100644
index 00000000000..7aaf9187e03
--- /dev/null
+++ b/website/docs/cdktf/python/d/cloudwatch_log_groups.html.markdown
@@ -0,0 +1,47 @@
+---
+subcategory: "CloudWatch Logs"
+layout: "aws"
+page_title: "AWS: aws_cloudwatch_log_groups"
+description: |-
+  Get list of Cloudwatch Log Groups.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_cloudwatch_log_groups
+
+Use this data source to get a list of AWS Cloudwatch Log Groups
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_cloudwatch_log_groups import DataAwsCloudwatchLogGroups
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsCloudwatchLogGroups(self, "example",
+            log_group_name_prefix="/MyImportantLogs"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `log_group_name_prefix` - (Optional) Group prefix of the Cloudwatch log groups to list
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arns` - Set of ARNs of the Cloudwatch log groups
+* `log_group_names` - Set of names of the Cloudwatch log groups
+
+<!-- cache-key: cdktf-0.18.0 input-de8e9f02351b1211d18fc68d49088b86a691dbdbd63e91089bb0ce365508019e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/codeartifact_authorization_token.html.markdown b/website/docs/cdktf/python/d/codeartifact_authorization_token.html.markdown
new file mode 100644
index 00000000000..be11cda48bf
--- /dev/null
+++ b/website/docs/cdktf/python/d/codeartifact_authorization_token.html.markdown
@@ -0,0 +1,49 @@
+---
+subcategory: "CodeArtifact"
+layout: "aws"
+page_title: "AWS: aws_codeartifact_authorization_token"
+description: |-
+    Provides details about a CodeArtifact Authorization Token
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_codeartifact_authorization_token
+
+The CodeArtifact Authorization Token data source generates a temporary authentication token for accessing repositories in a CodeArtifact domain.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_codeartifact_authorization_token import DataAwsCodeartifactAuthorizationToken
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsCodeartifactAuthorizationToken(self, "test",
+            domain=Token.as_string(aws_codeartifact_domain_test.domain)
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `domain` - (Required) Name of the domain that is in scope for the generated authorization token.
+* `domain_owner` - (Optional) Account number of the AWS account that owns the domain.
+* `duration_seconds` - (Optional) Time, in seconds, that the generated authorization token is valid. Valid values are `0` and between `900` and `43200`.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `authorization_token` - Temporary authorization token.
+* `expiration` - Time in UTC RFC3339 format when the authorization token expires.
+
+<!-- cache-key: cdktf-0.18.0 input-35ae5dc1307055f4be42f0268b760c21da97017124c46086e4dc01079119728a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/codeartifact_repository_endpoint.html.markdown b/website/docs/cdktf/python/d/codeartifact_repository_endpoint.html.markdown
new file mode 100644
index 00000000000..00a263a1fdf
--- /dev/null
+++ b/website/docs/cdktf/python/d/codeartifact_repository_endpoint.html.markdown
@@ -0,0 +1,51 @@
+---
+subcategory: "CodeArtifact"
+layout: "aws"
+page_title: "AWS: aws_codeartifact_repository_endpoint"
+description: |-
+    Provides details about a CodeArtifact Repository Endpoint
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_codeartifact_repository_endpoint
+
+The CodeArtifact Repository Endpoint data source returns the endpoint of a repository for a specific package format.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_codeartifact_repository_endpoint import DataAwsCodeartifactRepositoryEndpoint
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsCodeartifactRepositoryEndpoint(self, "test",
+            domain=Token.as_string(aws_codeartifact_domain_test.domain),
+            format="npm",
+            repository=Token.as_string(aws_codeartifact_repository_test.repository)
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `domain` - (Required) Name of the domain that contains the repository.
+* `repository` - (Required) Name of the repository.
+* `format` - (Required) Which endpoint of a repository to return. A repository has one endpoint for each package format: `npm`, `pypi`, `maven`, and `nuget`.
+* `domain_owner` - (Optional) Account number of the AWS account that owns the domain.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `repository_endpoint` - URL of the returned endpoint.
+
+<!-- cache-key: cdktf-0.18.0 input-845ec7d27ada856d0ad7aca19277d5091cd5696d048ed754b76ab9909399306c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/codecatalyst_dev_environment.html.markdown b/website/docs/cdktf/python/d/codecatalyst_dev_environment.html.markdown
new file mode 100644
index 00000000000..c5101757130
--- /dev/null
+++ b/website/docs/cdktf/python/d/codecatalyst_dev_environment.html.markdown
@@ -0,0 +1,60 @@
+---
+subcategory: "CodeCatalyst"
+layout: "aws"
+page_title: "AWS: aws_codecatalyst_dev_environment"
+description: |-
+  Terraform data source for managing an AWS CodeCatalyst Dev Environment.
+---
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_codecatalyst_dev_environment
+
+Terraform data source for managing an AWS CodeCatalyst Dev Environment.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_codecatalyst_dev_environment import DataAwsCodecatalystDevEnvironment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsCodecatalystDevEnvironment(self, "example",
+            env_id=Token.as_string(aws_codecatalyst_dev_environment_example.id),
+            project_name="myproject",
+            space_name="myspace"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `env_id` - - (Required) The system-generated unique ID of the Dev Environment for which you want to view information. To retrieve a list of Dev Environment IDs, use [ListDevEnvironments](https://docs.aws.amazon.com/codecatalyst/latest/APIReference/API_ListDevEnvironments.html).
+* `project_name` - (Required) The name of the project in the space.
+* `space_name` - (Required) The name of the space.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `alias` - The user-specified alias for the Dev Environment.
+* `creator_id` - The system-generated unique ID of the user who created the Dev Environment.
+* `ides` - Information about the integrated development environment (IDE) configured for a Dev Environment.
+* `inactivity_timeout_minutes` - The amount of time the Dev Environment will run without any activity detected before stopping, in minutes. Only whole integers are allowed. Dev Environments consume compute minutes when running.
+* `instance_type` - The Amazon EC2 instace type to use for the Dev Environment.
+* `last_updated_time` - The time when the Dev Environment was last updated, in coordinated universal time (UTC) timestamp format as specified in [RFC 3339](https://www.rfc-editor.org/rfc/rfc3339#section-5.6).
+* `persistent_storage` - Information about the amount of storage allocated to the Dev Environment.
+* `repositories` - The source repository that contains the branch to clone into the Dev Environment.
+* `status` - The current status of the Dev Environment. From: PENDING | RUNNING | STARTING | STOPPING | STOPPED | FAILED | DELETING | DELETED.
+* `status_reason` - The reason for the status.
+
+<!-- cache-key: cdktf-0.18.0 input-c61bba638996c2149ec91b8cd25afae8ff1fa5829987e15f55f2b47440b45e86 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/codecommit_approval_rule_template.html.markdown b/website/docs/cdktf/python/d/codecommit_approval_rule_template.html.markdown
new file mode 100644
index 00000000000..44ba51adbc4
--- /dev/null
+++ b/website/docs/cdktf/python/d/codecommit_approval_rule_template.html.markdown
@@ -0,0 +1,52 @@
+---
+subcategory: "CodeCommit"
+layout: "aws"
+page_title: "AWS: aws_codecommit_approval_rule_template"
+description: |-
+  Provides details about a specific CodeCommit Approval Rule Template.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_codecommit_approval_rule_template
+
+Provides details about a specific CodeCommit Approval Rule Template.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_codecommit_approval_rule_template import DataAwsCodecommitApprovalRuleTemplate
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsCodecommitApprovalRuleTemplate(self, "example",
+            name="MyExampleApprovalRuleTemplate"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name for the approval rule template. This needs to be less than 100 characters.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `approval_rule_template_id` - The ID of the approval rule template.
+* `content` - Content of the approval rule template.
+* `creation_date` - Date the approval rule template was created, in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8).
+* `description` - Description of the approval rule template.
+* `last_modified_date` - Date the approval rule template was most recently changed, in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8).
+* `last_modified_user` - ARN of the user who made the most recent changes to the approval rule template.
+* `rule_content_sha256` - SHA-256 hash signature for the content of the approval rule template.
+
+<!-- cache-key: cdktf-0.18.0 input-98231bebffea86eca15b51adc087fc2f29b27084e6d362ae00eb79cfb0b83130 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/codecommit_repository.html.markdown b/website/docs/cdktf/python/d/codecommit_repository.html.markdown
new file mode 100644
index 00000000000..e2ce15ddc63
--- /dev/null
+++ b/website/docs/cdktf/python/d/codecommit_repository.html.markdown
@@ -0,0 +1,49 @@
+---
+subcategory: "CodeCommit"
+layout: "aws"
+page_title: "AWS: aws_codecommit_repository"
+description: |-
+  Provides details about CodeCommit Repository.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_codecommit_repository
+
+The CodeCommit Repository data source allows the ARN, Repository ID, Repository URL for HTTP and Repository URL for SSH to be retrieved for an CodeCommit repository.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_codecommit_repository import DataAwsCodecommitRepository
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsCodecommitRepository(self, "test",
+            repository_name="MyTestRepository"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `repository_name` - (Required) Name for the repository. This needs to be less than 100 characters.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `repository_id` - ID of the repository
+* `arn` - ARN of the repository
+* `clone_url_http` - URL to use for cloning the repository over HTTPS.
+* `clone_url_ssh` - URL to use for cloning the repository over SSH.
+
+<!-- cache-key: cdktf-0.18.0 input-5f322aa9e58ade376d26a7bc7fcca823f5fc4c32d9a5916f862aea8c60b99b90 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/codestarconnections_connection.html.markdown b/website/docs/cdktf/python/d/codestarconnections_connection.html.markdown
new file mode 100644
index 00000000000..b4f03b51542
--- /dev/null
+++ b/website/docs/cdktf/python/d/codestarconnections_connection.html.markdown
@@ -0,0 +1,75 @@
+---
+subcategory: "CodeStar Connections"
+layout: "aws"
+page_title: "AWS: aws_codestarconnections_connection"
+description: |-
+  Provides details about CodeStar Connection
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_codestarconnections_connection
+
+Provides details about CodeStar Connection.
+
+## Example Usage
+
+### By ARN
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_codestarconnections_connection import DataAwsCodestarconnectionsConnection
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsCodestarconnectionsConnection(self, "example",
+            arn=Token.as_string(aws_codestarconnections_connection_example.arn)
+        )
+```
+
+### By Name
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_codestarconnections_connection import DataAwsCodestarconnectionsConnection
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsCodestarconnectionsConnection(self, "example",
+            name=Token.as_string(aws_codestarconnections_connection_example.name)
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `arn` - (Optional) CodeStar Connection ARN.
+* `name` - (Optional) CodeStar Connection name.
+
+~> **NOTE:** When both `arn` and `name` are specified, `arn` takes precedence.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `connection_status` - CodeStar Connection status. Possible values are `PENDING`, `AVAILABLE` and `ERROR`.
+* `id` - CodeStar Connection ARN.
+* `host_arn` - ARN of the host associated with the connection.
+* `name` - Name of the CodeStar Connection. The name is unique in the calling AWS account.
+* `provider_type` - Name of the external provider where your third-party code repository is configured. Possible values are `Bitbucket` and `GitHub`. For connections to a GitHub Enterprise Server instance, you must create an [aws_codestarconnections_host](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/codestarconnections_host) resource and use `host_arn` instead.
+* `tags` - Map of key-value resource tags to associate with the resource.
+
+<!-- cache-key: cdktf-0.18.0 input-ab1b1d204990cc42834998f3ea8aaf072f9c3accf6d33f73782ae59f7304b4b6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/cognito_identity_pool.html.markdown b/website/docs/cdktf/python/d/cognito_identity_pool.html.markdown
new file mode 100644
index 00000000000..7e489476a77
--- /dev/null
+++ b/website/docs/cdktf/python/d/cognito_identity_pool.html.markdown
@@ -0,0 +1,57 @@
+---
+subcategory: "Cognito Identity"
+layout: "aws"
+page_title: "AWS: aws_cognito_identity_pool"
+description: |-
+  Terraform data source for managing an AWS Cognito Identity Pool.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_cognito_identity_pool
+
+Terraform data source for managing an AWS Cognito Identity Pool.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_cognito_identity_pool import DataAwsCognitoIdentityPool
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsCognitoIdentityPool(self, "example",
+            identity_pool_name="test pool"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `identity_pool_name` - (Required)  The Cognito Identity Pool name.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - An identity pool ID, e.g. `us-west-2:1a234567-8901-234b-5cde-f6789g01h2i3`.
+* `arn` - ARN of the Pool.
+* `allow_unauthenticated_identities` - Whether the identity pool supports unauthenticated logins or not.
+* `allow_classic_flow` - Whether the classic / basic authentication flow is enabled.
+* `developer_provider_name` - The "domain" by which Cognito will refer to your users.
+* `cognito_identity_providers` - An array of Amazon Cognito Identity user pools and their client IDs.
+* `openid_connect_provider_arns` - Set of OpendID Connect provider ARNs.
+* `saml_provider_arns` - An array of Amazon Resource Names (ARNs) of the SAML provider for your identity.
+* `supported_login_providers` - Key-Value pairs mapping provider names to provider app IDs.
+* `tags` - A map of tags to assigned to the Identity Pool.
+
+<!-- cache-key: cdktf-0.18.0 input-6bbe3d8309c3b6b61d82ed31432b903fb83ab96fbd1ea591aba2ca68e658f68f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/cognito_user_pool_client.html.markdown b/website/docs/cdktf/python/d/cognito_user_pool_client.html.markdown
new file mode 100644
index 00000000000..b024b61c77a
--- /dev/null
+++ b/website/docs/cdktf/python/d/cognito_user_pool_client.html.markdown
@@ -0,0 +1,84 @@
+---
+subcategory: "Cognito IDP (Identity Provider)"
+layout: "aws"
+page_title: "AWS: aws_cognito_user_pool_client"
+description: |-
+  Provides a Cognito User Pool Client
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_cognito_user_pool_client
+
+Provides a Cognito User Pool Client resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_cognito_user_pool_client import DataAwsCognitoUserPoolClient
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsCognitoUserPoolClient(self, "client",
+            client_id="38fjsnc484p94kpqsnet7mpld0",
+            user_pool_id="us-west-2_aaaaaaaaa"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `client_id` - (Required) Client Id of the user pool.
+* `user_pool_id` - (Required) User pool the client belongs to.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `access_token_validity` - (Optional) Time limit, between 5 minutes and 1 day, after which the access token is no longer valid and cannot be used. This value will be overridden if you have entered a value in `token_validity_units`.
+* `allowed_oauth_flows_user_pool_client` - (Optional) Whether the client is allowed to follow the OAuth protocol when interacting with Cognito user pools.
+* `allowed_oauth_flows` - (Optional) List of allowed OAuth flows (code, implicit, client_credentials).
+* `allowed_oauth_scopes` - (Optional) List of allowed OAuth scopes (phone, email, openid, profile, and aws.cognito.signin.user.admin).
+* `analytics_configuration` - (Optional) Configuration block for Amazon Pinpoint analytics for collecting metrics for this user pool. [Detailed below](#analytics_configuration).
+* `callback_urls` - (Optional) List of allowed callback URLs for the identity providers.
+* `client_secret` - Client secret of the user pool client.
+* `default_redirect_uri` - (Optional) Default redirect URI. Must be in the list of callback URLs.
+* `enable_token_revocation` - (Optional) Enables or disables token revocation.
+* `explicit_auth_flows` - (Optional) List of authentication flows (ADMIN_NO_SRP_AUTH, CUSTOM_AUTH_FLOW_ONLY, USER_PASSWORD_AUTH, ALLOW_ADMIN_USER_PASSWORD_AUTH, ALLOW_CUSTOM_AUTH, ALLOW_USER_PASSWORD_AUTH, ALLOW_USER_SRP_AUTH, ALLOW_REFRESH_TOKEN_AUTH).
+* `generate_secret` - (Optional) Should an application secret be generated.
+* `id_token_validity` - (Optional) Time limit, between 5 minutes and 1 day, after which the ID token is no longer valid and cannot be used. This value will be overridden if you have entered a value in `token_validity_units`.
+* `logout_urls` - (Optional) List of allowed logout URLs for the identity providers.
+* `prevent_user_existence_errors` - (Optional) Choose which errors and responses are returned by Cognito APIs during authentication, account confirmation, and password recovery when the user does not exist in the user pool. When set to `ENABLED` and the user does not exist, authentication returns an error indicating either the username or password was incorrect, and account confirmation and password recovery return a response indicating a code was sent to a simulated destination. When set to `LEGACY`, those APIs will return a `UserNotFoundException` exception if the user does not exist in the user pool.
+* `read_attributes` - (Optional) List of user pool attributes the application client can read from.
+* `refresh_token_validity` - (Optional) Time limit in days refresh tokens are valid for.
+* `supported_identity_providers` - (Optional) List of provider names for the identity providers that are supported on this client. Uses the `provider_name` attribute of `aws_cognito_identity_provider` resource(s), or the equivalent string(s).
+* `token_validity_units` - (Optional) Configuration block for units in which the validity times are represented in. [Detailed below](#token_validity_units).
+* `write_attributes` - (Optional) List of user pool attributes the application client can write to.
+
+### analytics_configuration
+
+Either `application_arn` or `application_id` is required.
+
+* `application_arn` - (Optional) Application ARN for an Amazon Pinpoint application. Conflicts with `external_id` and `role_arn`.
+* `application_id` - (Optional) Application ID for an Amazon Pinpoint application.
+* `external_id` - (Optional) ID for the Analytics Configuration. Conflicts with `application_arn`.
+* `role_arn` - (Optional) ARN of an IAM role that authorizes Amazon Cognito to publish events to Amazon Pinpoint analytics. Conflicts with `application_arn`.
+* `user_data_shared` (Optional) If set to `true`, Amazon Cognito will include user data in the events it publishes to Amazon Pinpoint analytics.
+
+### token_validity_units
+
+Valid values for the following arguments are: `seconds`, `minutes`, `hours` or `days`.
+
+* `access_token` - (Optional) Time unit in for the value in `access_token_validity`, defaults to `hours`.
+* `id_token` - (Optional) Time unit in for the value in `id_token_validity`, defaults to `hours`.
+* `refresh_token` - (Optional) Time unit in for the value in `refresh_token_validity`, defaults to `days`.
+
+<!-- cache-key: cdktf-0.18.0 input-804400abfbd53cd25621680ec5f1657976bea849d7c8272f9f3b774f5cc1e05b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/cognito_user_pool_client.markdown b/website/docs/cdktf/python/d/cognito_user_pool_client.markdown
new file mode 100644
index 00000000000..b024b61c77a
--- /dev/null
+++ b/website/docs/cdktf/python/d/cognito_user_pool_client.markdown
@@ -0,0 +1,84 @@
+---
+subcategory: "Cognito IDP (Identity Provider)"
+layout: "aws"
+page_title: "AWS: aws_cognito_user_pool_client"
+description: |-
+  Provides a Cognito User Pool Client
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_cognito_user_pool_client
+
+Provides a Cognito User Pool Client resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_cognito_user_pool_client import DataAwsCognitoUserPoolClient
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsCognitoUserPoolClient(self, "client",
+            client_id="38fjsnc484p94kpqsnet7mpld0",
+            user_pool_id="us-west-2_aaaaaaaaa"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `client_id` - (Required) Client Id of the user pool.
+* `user_pool_id` - (Required) User pool the client belongs to.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `access_token_validity` - (Optional) Time limit, between 5 minutes and 1 day, after which the access token is no longer valid and cannot be used. This value will be overridden if you have entered a value in `token_validity_units`.
+* `allowed_oauth_flows_user_pool_client` - (Optional) Whether the client is allowed to follow the OAuth protocol when interacting with Cognito user pools.
+* `allowed_oauth_flows` - (Optional) List of allowed OAuth flows (code, implicit, client_credentials).
+* `allowed_oauth_scopes` - (Optional) List of allowed OAuth scopes (phone, email, openid, profile, and aws.cognito.signin.user.admin).
+* `analytics_configuration` - (Optional) Configuration block for Amazon Pinpoint analytics for collecting metrics for this user pool. [Detailed below](#analytics_configuration).
+* `callback_urls` - (Optional) List of allowed callback URLs for the identity providers.
+* `client_secret` - Client secret of the user pool client.
+* `default_redirect_uri` - (Optional) Default redirect URI. Must be in the list of callback URLs.
+* `enable_token_revocation` - (Optional) Enables or disables token revocation.
+* `explicit_auth_flows` - (Optional) List of authentication flows (ADMIN_NO_SRP_AUTH, CUSTOM_AUTH_FLOW_ONLY, USER_PASSWORD_AUTH, ALLOW_ADMIN_USER_PASSWORD_AUTH, ALLOW_CUSTOM_AUTH, ALLOW_USER_PASSWORD_AUTH, ALLOW_USER_SRP_AUTH, ALLOW_REFRESH_TOKEN_AUTH).
+* `generate_secret` - (Optional) Should an application secret be generated.
+* `id_token_validity` - (Optional) Time limit, between 5 minutes and 1 day, after which the ID token is no longer valid and cannot be used. This value will be overridden if you have entered a value in `token_validity_units`.
+* `logout_urls` - (Optional) List of allowed logout URLs for the identity providers.
+* `prevent_user_existence_errors` - (Optional) Choose which errors and responses are returned by Cognito APIs during authentication, account confirmation, and password recovery when the user does not exist in the user pool. When set to `ENABLED` and the user does not exist, authentication returns an error indicating either the username or password was incorrect, and account confirmation and password recovery return a response indicating a code was sent to a simulated destination. When set to `LEGACY`, those APIs will return a `UserNotFoundException` exception if the user does not exist in the user pool.
+* `read_attributes` - (Optional) List of user pool attributes the application client can read from.
+* `refresh_token_validity` - (Optional) Time limit in days refresh tokens are valid for.
+* `supported_identity_providers` - (Optional) List of provider names for the identity providers that are supported on this client. Uses the `provider_name` attribute of `aws_cognito_identity_provider` resource(s), or the equivalent string(s).
+* `token_validity_units` - (Optional) Configuration block for units in which the validity times are represented in. [Detailed below](#token_validity_units).
+* `write_attributes` - (Optional) List of user pool attributes the application client can write to.
+
+### analytics_configuration
+
+Either `application_arn` or `application_id` is required.
+
+* `application_arn` - (Optional) Application ARN for an Amazon Pinpoint application. Conflicts with `external_id` and `role_arn`.
+* `application_id` - (Optional) Application ID for an Amazon Pinpoint application.
+* `external_id` - (Optional) ID for the Analytics Configuration. Conflicts with `application_arn`.
+* `role_arn` - (Optional) ARN of an IAM role that authorizes Amazon Cognito to publish events to Amazon Pinpoint analytics. Conflicts with `application_arn`.
+* `user_data_shared` (Optional) If set to `true`, Amazon Cognito will include user data in the events it publishes to Amazon Pinpoint analytics.
+
+### token_validity_units
+
+Valid values for the following arguments are: `seconds`, `minutes`, `hours` or `days`.
+
+* `access_token` - (Optional) Time unit in for the value in `access_token_validity`, defaults to `hours`.
+* `id_token` - (Optional) Time unit in for the value in `id_token_validity`, defaults to `hours`.
+* `refresh_token` - (Optional) Time unit in for the value in `refresh_token_validity`, defaults to `days`.
+
+<!-- cache-key: cdktf-0.18.0 input-804400abfbd53cd25621680ec5f1657976bea849d7c8272f9f3b774f5cc1e05b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/cognito_user_pool_clients.html.markdown b/website/docs/cdktf/python/d/cognito_user_pool_clients.html.markdown
new file mode 100644
index 00000000000..cc97b675468
--- /dev/null
+++ b/website/docs/cdktf/python/d/cognito_user_pool_clients.html.markdown
@@ -0,0 +1,45 @@
+---
+subcategory: "Cognito IDP (Identity Provider)"
+layout: "aws"
+page_title: "AWS: aws_cognito_user_pool_clients"
+description: |-
+  Get list of cognito user pool clients connected to user pool.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_cognito_user_pool_clients
+
+Use this data source to get a list of Cognito user pools clients for a Cognito IdP user pool.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_cognito_user_pool_clients import DataAwsCognitoUserPoolClients
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsCognitoUserPoolClients(self, "main",
+            user_pool_id=Token.as_string(aws_cognito_user_pool_main.id)
+        )
+```
+
+## Argument Reference
+
+* `user_pool_id` - (Required) Cognito user pool ID.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `client_ids` - List of Cognito user pool client IDs.
+* `client_names` - List of Cognito user pool client names.
+
+<!-- cache-key: cdktf-0.18.0 input-0fe61149f327af030714ff2a7ce38b01d25e4ce678ca724c3e6bcaa54b7f9201 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/cognito_user_pool_clients.markdown b/website/docs/cdktf/python/d/cognito_user_pool_clients.markdown
new file mode 100644
index 00000000000..cc97b675468
--- /dev/null
+++ b/website/docs/cdktf/python/d/cognito_user_pool_clients.markdown
@@ -0,0 +1,45 @@
+---
+subcategory: "Cognito IDP (Identity Provider)"
+layout: "aws"
+page_title: "AWS: aws_cognito_user_pool_clients"
+description: |-
+  Get list of cognito user pool clients connected to user pool.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_cognito_user_pool_clients
+
+Use this data source to get a list of Cognito user pools clients for a Cognito IdP user pool.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_cognito_user_pool_clients import DataAwsCognitoUserPoolClients
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsCognitoUserPoolClients(self, "main",
+            user_pool_id=Token.as_string(aws_cognito_user_pool_main.id)
+        )
+```
+
+## Argument Reference
+
+* `user_pool_id` - (Required) Cognito user pool ID.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `client_ids` - List of Cognito user pool client IDs.
+* `client_names` - List of Cognito user pool client names.
+
+<!-- cache-key: cdktf-0.18.0 input-0fe61149f327af030714ff2a7ce38b01d25e4ce678ca724c3e6bcaa54b7f9201 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/cognito_user_pool_signing_certificate.html.markdown b/website/docs/cdktf/python/d/cognito_user_pool_signing_certificate.html.markdown
new file mode 100644
index 00000000000..52d87ca28ee
--- /dev/null
+++ b/website/docs/cdktf/python/d/cognito_user_pool_signing_certificate.html.markdown
@@ -0,0 +1,44 @@
+---
+subcategory: "Cognito IDP (Identity Provider)"
+layout: "aws"
+page_title: "AWS: aws_cognito_user_pool_signing_certificate"
+description: |-
+  Get signing certificate of user pool
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_cognito_user_pool_signing_certificate
+
+Use this data source to get the signing certificate for a Cognito IdP user pool.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_cognito_user_pool_signing_certificate import DataAwsCognitoUserPoolSigningCertificate
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsCognitoUserPoolSigningCertificate(self, "sc",
+            user_pool_id=my_pool.id
+        )
+```
+
+## Argument Reference
+
+* `user_pool_id` - (Required) Cognito user pool ID.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `certificate` - Certificate string
+
+<!-- cache-key: cdktf-0.18.0 input-841008061a82572c40fa11d3c10bc7dfd40e9bb58c679fe5f8e62188a7dcffb2 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/cognito_user_pool_signing_certificate.markdown b/website/docs/cdktf/python/d/cognito_user_pool_signing_certificate.markdown
new file mode 100644
index 00000000000..52d87ca28ee
--- /dev/null
+++ b/website/docs/cdktf/python/d/cognito_user_pool_signing_certificate.markdown
@@ -0,0 +1,44 @@
+---
+subcategory: "Cognito IDP (Identity Provider)"
+layout: "aws"
+page_title: "AWS: aws_cognito_user_pool_signing_certificate"
+description: |-
+  Get signing certificate of user pool
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_cognito_user_pool_signing_certificate
+
+Use this data source to get the signing certificate for a Cognito IdP user pool.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_cognito_user_pool_signing_certificate import DataAwsCognitoUserPoolSigningCertificate
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsCognitoUserPoolSigningCertificate(self, "sc",
+            user_pool_id=my_pool.id
+        )
+```
+
+## Argument Reference
+
+* `user_pool_id` - (Required) Cognito user pool ID.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `certificate` - Certificate string
+
+<!-- cache-key: cdktf-0.18.0 input-841008061a82572c40fa11d3c10bc7dfd40e9bb58c679fe5f8e62188a7dcffb2 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/cognito_user_pools.html.markdown b/website/docs/cdktf/python/d/cognito_user_pools.html.markdown
new file mode 100644
index 00000000000..d3d5de913d4
--- /dev/null
+++ b/website/docs/cdktf/python/d/cognito_user_pools.html.markdown
@@ -0,0 +1,58 @@
+---
+subcategory: "Cognito IDP (Identity Provider)"
+layout: "aws"
+page_title: "AWS: aws_cognito_user_pools"
+description: |-
+  Get list of cognito user pools.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_cognito_user_pools
+
+Use this data source to get a list of cognito user pools.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.api_gateway_authorizer import ApiGatewayAuthorizer
+from imports.aws.data_aws_api_gateway_rest_api import DataAwsApiGatewayRestApi
+from imports.aws.data_aws_cognito_user_pools import DataAwsCognitoUserPools
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        selected = DataAwsApiGatewayRestApi(self, "selected",
+            name=api_gateway_name.string_value
+        )
+        data_aws_cognito_user_pools_selected = DataAwsCognitoUserPools(self, "selected_1",
+            name=cognito_user_pool_name.string_value
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_cognito_user_pools_selected.override_logical_id("selected")
+        ApiGatewayAuthorizer(self, "cognito",
+            name="cognito",
+            provider_arns=Token.as_list(data_aws_cognito_user_pools_selected.arns),
+            rest_api_id=Token.as_string(selected.id),
+            type="COGNITO_USER_POOLS"
+        )
+```
+
+## Argument Reference
+
+* `name` - (Required) Name of the cognito user pools. Name is not a unique attribute for cognito user pool, so multiple pools might be returned with given name. If the pool name is expected to be unique, you can reference the pool id via `tolist(data.aws_cognito_user_pools.selected.ids)[0]`
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `ids` - Set of cognito user pool ids.
+* `arns` - Set of cognito user pool Amazon Resource Names (ARNs).
+
+<!-- cache-key: cdktf-0.18.0 input-75e710379276dd4b4879fdf870f90225a6aad57dec06cd592a215bcaab891f06 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/cognito_user_pools.markdown b/website/docs/cdktf/python/d/cognito_user_pools.markdown
new file mode 100644
index 00000000000..d3d5de913d4
--- /dev/null
+++ b/website/docs/cdktf/python/d/cognito_user_pools.markdown
@@ -0,0 +1,58 @@
+---
+subcategory: "Cognito IDP (Identity Provider)"
+layout: "aws"
+page_title: "AWS: aws_cognito_user_pools"
+description: |-
+  Get list of cognito user pools.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_cognito_user_pools
+
+Use this data source to get a list of cognito user pools.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.api_gateway_authorizer import ApiGatewayAuthorizer
+from imports.aws.data_aws_api_gateway_rest_api import DataAwsApiGatewayRestApi
+from imports.aws.data_aws_cognito_user_pools import DataAwsCognitoUserPools
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        selected = DataAwsApiGatewayRestApi(self, "selected",
+            name=api_gateway_name.string_value
+        )
+        data_aws_cognito_user_pools_selected = DataAwsCognitoUserPools(self, "selected_1",
+            name=cognito_user_pool_name.string_value
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_cognito_user_pools_selected.override_logical_id("selected")
+        ApiGatewayAuthorizer(self, "cognito",
+            name="cognito",
+            provider_arns=Token.as_list(data_aws_cognito_user_pools_selected.arns),
+            rest_api_id=Token.as_string(selected.id),
+            type="COGNITO_USER_POOLS"
+        )
+```
+
+## Argument Reference
+
+* `name` - (Required) Name of the cognito user pools. Name is not a unique attribute for cognito user pool, so multiple pools might be returned with given name. If the pool name is expected to be unique, you can reference the pool id via `tolist(data.aws_cognito_user_pools.selected.ids)[0]`
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `ids` - Set of cognito user pool ids.
+* `arns` - Set of cognito user pool Amazon Resource Names (ARNs).
+
+<!-- cache-key: cdktf-0.18.0 input-75e710379276dd4b4879fdf870f90225a6aad57dec06cd592a215bcaab891f06 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/connect_bot_association.html.markdown b/website/docs/cdktf/python/d/connect_bot_association.html.markdown
new file mode 100644
index 00000000000..d05316cc39a
--- /dev/null
+++ b/website/docs/cdktf/python/d/connect_bot_association.html.markdown
@@ -0,0 +1,53 @@
+---
+subcategory: "Connect"
+layout: "aws"
+page_title: "AWS: aws_connect_bot_association"
+description: |-
+  Provides details about a specific Lex (V1) Bot associated with an Amazon Connect instance
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_connect_bot_association
+
+Provides details about a specific Lex (V1) Bot associated with an Amazon Connect instance.
+
+## Example Usage
+
+### By name
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_connect_bot_association import DataAwsConnectBotAssociation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsConnectBotAssociation(self, "example",
+            instance_id="aaaaaaaa-bbbb-cccc-dddd-111111111111",
+            lex_bot=DataAwsConnectBotAssociationLexBot(
+                name="Test"
+            )
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `instance_id` - (Required) Identifier of the Amazon Connect instance. You can find the instanceId in the ARN of the instance.
+* `lex_bot` - (Required) Configuration information of an Amazon Lex (V1) bot. Detailed below.
+
+### lex_bot
+
+The `lex_bot` configuration block supports the following:
+
+* `name` - (Required) Name of the Amazon Lex (V1) bot.
+* `lex_region` - (Optional) Region that the Amazon Lex (V1) bot was created in.
+
+<!-- cache-key: cdktf-0.18.0 input-404504bb11b568903bd8a32e96212172ac650fcf502c3c69fa40dbe6b2b93e17 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/connect_bot_association.markdown b/website/docs/cdktf/python/d/connect_bot_association.markdown
new file mode 100644
index 00000000000..d05316cc39a
--- /dev/null
+++ b/website/docs/cdktf/python/d/connect_bot_association.markdown
@@ -0,0 +1,53 @@
+---
+subcategory: "Connect"
+layout: "aws"
+page_title: "AWS: aws_connect_bot_association"
+description: |-
+  Provides details about a specific Lex (V1) Bot associated with an Amazon Connect instance
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_connect_bot_association
+
+Provides details about a specific Lex (V1) Bot associated with an Amazon Connect instance.
+
+## Example Usage
+
+### By name
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_connect_bot_association import DataAwsConnectBotAssociation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsConnectBotAssociation(self, "example",
+            instance_id="aaaaaaaa-bbbb-cccc-dddd-111111111111",
+            lex_bot=DataAwsConnectBotAssociationLexBot(
+                name="Test"
+            )
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `instance_id` - (Required) Identifier of the Amazon Connect instance. You can find the instanceId in the ARN of the instance.
+* `lex_bot` - (Required) Configuration information of an Amazon Lex (V1) bot. Detailed below.
+
+### lex_bot
+
+The `lex_bot` configuration block supports the following:
+
+* `name` - (Required) Name of the Amazon Lex (V1) bot.
+* `lex_region` - (Optional) Region that the Amazon Lex (V1) bot was created in.
+
+<!-- cache-key: cdktf-0.18.0 input-404504bb11b568903bd8a32e96212172ac650fcf502c3c69fa40dbe6b2b93e17 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/connect_contact_flow.html.markdown b/website/docs/cdktf/python/d/connect_contact_flow.html.markdown
new file mode 100644
index 00000000000..23d4f7d4e6c
--- /dev/null
+++ b/website/docs/cdktf/python/d/connect_contact_flow.html.markdown
@@ -0,0 +1,77 @@
+---
+subcategory: "Connect"
+layout: "aws"
+page_title: "AWS: aws_connect_contact_flow"
+description: |-
+  Provides details about a specific Amazon Connect Contact Flow.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_connect_contact_flow
+
+Provides details about a specific Amazon Connect Contact Flow.
+
+## Example Usage
+
+By name
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_connect_contact_flow import DataAwsConnectContactFlow
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsConnectContactFlow(self, "test",
+            instance_id="aaaaaaaa-bbbb-cccc-dddd-111111111111",
+            name="Test"
+        )
+```
+
+By contact_flow_id
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_connect_contact_flow import DataAwsConnectContactFlow
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsConnectContactFlow(self, "test",
+            contact_flow_id="cccccccc-bbbb-cccc-dddd-111111111111",
+            instance_id="aaaaaaaa-bbbb-cccc-dddd-111111111111"
+        )
+```
+
+## Argument Reference
+
+~> **NOTE:** `instance_id` and one of either `name` or `contact_flow_id` is required.
+
+This argument supports the following arguments:
+
+* `contact_flow_id` - (Optional) Returns information on a specific Contact Flow by contact flow id
+* `instance_id` - (Required) Reference to the hosting Amazon Connect Instance
+* `name` - (Optional) Returns information on a specific Contact Flow by name
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Contact Flow.
+* `content` - Logic of the Contact Flow.
+* `description` - Description of the Contact Flow.
+* `tags` - Tags to assign to the Contact Flow.
+* `type` - Type of Contact Flow.
+
+<!-- cache-key: cdktf-0.18.0 input-4e365316c40b7e767d366a9457c4aad07059bd09524a478619ae11bc584d56dc -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/connect_contact_flow_module.html.markdown b/website/docs/cdktf/python/d/connect_contact_flow_module.html.markdown
new file mode 100644
index 00000000000..0aa18357f5a
--- /dev/null
+++ b/website/docs/cdktf/python/d/connect_contact_flow_module.html.markdown
@@ -0,0 +1,78 @@
+---
+subcategory: "Connect"
+layout: "aws"
+page_title: "AWS: aws_connect_contact_flow_module"
+description: |-
+  Provides details about a specific Amazon Connect Contact Flow Module.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_connect_contact_flow_module
+
+Provides details about a specific Amazon Connect Contact Flow Module.
+
+## Example Usage
+
+By `name`
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_connect_contact_flow_module import DataAwsConnectContactFlowModule
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsConnectContactFlowModule(self, "example",
+            instance_id="aaaaaaaa-bbbb-cccc-dddd-111111111111",
+            name="example"
+        )
+```
+
+By `contact_flow_module_id`
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_connect_contact_flow_module import DataAwsConnectContactFlowModule
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsConnectContactFlowModule(self, "example",
+            contact_flow_module_id="cccccccc-bbbb-cccc-dddd-111111111111",
+            instance_id="aaaaaaaa-bbbb-cccc-dddd-111111111111"
+        )
+```
+
+## Argument Reference
+
+~> **NOTE:** `instance_id` and one of either `name` or `contact_flow_module_id` is required.
+
+This argument supports the following arguments:
+
+* `contact_flow_module_id` - (Optional) Returns information on a specific Contact Flow Module by contact flow module id
+* `instance_id` - (Required) Reference to the hosting Amazon Connect Instance
+* `name` - (Optional) Returns information on a specific Contact Flow Module by name
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Contact Flow Module.
+* `content` - Logic of the Contact Flow Module.
+* `description` - Description of the Contact Flow Module.
+* `tags` - Map of tags to assign to the Contact Flow Module.
+* `state` - Type of Contact Flow Module Module. Values are either `ACTIVE` or `ARCHIVED`.
+* `status` - Status of the Contact Flow Module Module. Values are either `PUBLISHED` or `SAVED`.
+
+<!-- cache-key: cdktf-0.18.0 input-42ad4b40afc50837380755e739270bff09e741210205ca792850ed7cbdd2d210 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/connect_hours_of_operation.html.markdown b/website/docs/cdktf/python/d/connect_hours_of_operation.html.markdown
new file mode 100644
index 00000000000..6d041bd6fa7
--- /dev/null
+++ b/website/docs/cdktf/python/d/connect_hours_of_operation.html.markdown
@@ -0,0 +1,96 @@
+---
+subcategory: "Connect"
+layout: "aws"
+page_title: "AWS: aws_connect_hours_of_operation"
+description: |-
+  Provides details about a specific Amazon Connect Hours of Operation.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_connect_hours_of_operation
+
+Provides details about a specific Amazon Connect Hours of Operation.
+
+## Example Usage
+
+By `name`
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_connect_hours_of_operation import DataAwsConnectHoursOfOperation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsConnectHoursOfOperation(self, "test",
+            instance_id="aaaaaaaa-bbbb-cccc-dddd-111111111111",
+            name="Test"
+        )
+```
+
+By `hours_of_operation_id`
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_connect_hours_of_operation import DataAwsConnectHoursOfOperation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsConnectHoursOfOperation(self, "test",
+            hours_of_operation_id="cccccccc-bbbb-cccc-dddd-111111111111",
+            instance_id="aaaaaaaa-bbbb-cccc-dddd-111111111111"
+        )
+```
+
+## Argument Reference
+
+~> **NOTE:** `instance_id` and one of either `name` or `hours_of_operation_id` is required.
+
+This argument supports the following arguments:
+
+* `hours_of_operation_id` - (Optional) Returns information on a specific Hours of Operation by hours of operation id
+* `instance_id` - (Required) Reference to the hosting Amazon Connect Instance
+* `name` - (Optional) Returns information on a specific Hours of Operation by name
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Hours of Operation.
+* `config` - Configuration information for the hours of operation: day, start time, and end time . Config blocks are documented below. Config blocks are documented below.
+* `description` - Description of the Hours of Operation.
+* `hours_of_operation_id` - The identifier for the hours of operation.
+* `instance_id` - Identifier of the hosting Amazon Connect Instance.
+* `name` - Name of the Hours of Operation.
+* `tags` - Map of tags to assign to the Hours of Operation.
+* `time_zone` - Time zone of the Hours of Operation.
+
+A `config` block supports the following arguments:
+
+* `day` - Day that the hours of operation applies to.
+* `end_time` - End time block specifies the time that your contact center closes. The `end_time` is documented below.
+* `start_time` - Start time block specifies the time that your contact center opens. The `start_time` is documented below.
+
+A `end_time` block supports the following arguments:
+
+* `hours` - Hour of closing.
+* `minutes` - Minute of closing.
+
+A `start_time` block supports the following arguments:
+
+* `hours` - Hour of opening.
+* `minutes` - Minute of opening.
+
+<!-- cache-key: cdktf-0.18.0 input-69f2eddaf1ae71ae8b2382f108eed67e1baf19a25a016f4a6cd6db210fa55e83 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/connect_instance.html.markdown b/website/docs/cdktf/python/d/connect_instance.html.markdown
new file mode 100644
index 00000000000..ac72b1de190
--- /dev/null
+++ b/website/docs/cdktf/python/d/connect_instance.html.markdown
@@ -0,0 +1,83 @@
+---
+subcategory: "Connect"
+layout: "aws"
+page_title: "AWS: aws_connect_instance"
+description: |-
+  Provides details about a specific Connect Instance.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_connect_instance
+
+Provides details about a specific Amazon Connect Instance.
+
+## Example Usage
+
+By instance_alias
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_connect_instance import DataAwsConnectInstance
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsConnectInstance(self, "foo",
+            instance_alias="foo"
+        )
+```
+
+By instance_id
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_connect_instance import DataAwsConnectInstance
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsConnectInstance(self, "foo",
+            instance_id="97afc98d-101a-ba98-ab97-ae114fc115ec"
+        )
+```
+
+## Argument Reference
+
+~> **NOTE:** One of either `instance_id` or `instance_alias` is required.
+
+This argument supports the following arguments:
+
+* `instance_id` - (Optional) Returns information on a specific connect instance by id
+
+* `instance_alias` - (Optional) Returns information on a specific connect instance by alias
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `created_time` - When the instance was created.
+* `arn` - ARN of the instance.
+* `identity_management_type` - Specifies The identity management type attached to the instance.
+* `inbound_calls_enabled` - Whether inbound calls are enabled.
+* `outbound_calls_enabled` - Whether outbound calls are enabled.
+* `early_media_enabled` - Whether early media for outbound calls is enabled .
+* `contact_flow_logs_enabled` - Whether contact flow logs are enabled.
+* `contact_lens_enabled` - Whether contact lens is enabled.
+* `auto_resolve_best_voices` - Whether auto resolve best voices is enabled.
+* `multi_party_conference_enabled` - Whether multi-party calls/conference is enabled.
+* `use_custom_tts_voices` - Whether use custom tts voices is enabled.
+* `status` - State of the instance.
+* `service_role` - Service role of the instance.
+
+<!-- cache-key: cdktf-0.18.0 input-f348847518408d57a1b3c05acaebc2f7c353201d2c00301debc08e5c4c84bccc -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/connect_instance_storage_config.html.markdown b/website/docs/cdktf/python/d/connect_instance_storage_config.html.markdown
new file mode 100644
index 00000000000..cba955fdc3f
--- /dev/null
+++ b/website/docs/cdktf/python/d/connect_instance_storage_config.html.markdown
@@ -0,0 +1,96 @@
+---
+subcategory: "Connect"
+layout: "aws"
+page_title: "AWS: aws_connect_instance_storage_config"
+description: |-
+  Provides details about a specific Amazon Connect Instance Storage Config.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_connect_instance_storage_config
+
+Provides details about a specific Amazon Connect Instance Storage Config.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_connect_instance_storage_config import DataAwsConnectInstanceStorageConfig
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsConnectInstanceStorageConfig(self, "example",
+            association_id="1234567890123456789012345678901234567890123456789012345678901234",
+            instance_id="aaaaaaaa-bbbb-cccc-dddd-111111111111",
+            resource_type="CONTACT_TRACE_RECORDS"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `association_id` - (Required) The existing association identifier that uniquely identifies the resource type and storage config for the given instance ID.
+* `instance_id` - (Required) Reference to the hosting Amazon Connect Instance
+* `resource_type` - (Required) A valid resource type. Valid Values: `AGENT_EVENTS` | `ATTACHMENTS` | `CALL_RECORDINGS` | `CHAT_TRANSCRIPTS` | `CONTACT_EVALUATIONS` | `CONTACT_TRACE_RECORDS` | `MEDIA_STREAMS` | `REAL_TIME_CONTACT_ANALYSIS_SEGMENTS` | `SCHEDULED_REPORTS` |  `SCREEN_RECORDINGS`.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - The identifier of the hosting Amazon Connect Instance, `association_id`, and `resource_type` separated by a colon (`:`).
+* `storage_config` - Specifies the storage configuration options for the Connect Instance. [Documented below](#storage_config).
+
+### `storage_config`
+
+The `storage_config` configuration block supports the following arguments:
+
+* `kinesis_firehose_config` - A block that specifies the configuration of the Kinesis Firehose delivery stream. [Documented below](#kinesis_firehose_config).
+* `kinesis_stream_config` - A block that specifies the configuration of the Kinesis data stream. [Documented below](#kinesis_stream_config).
+* `kinesis_video_stream_config` - A block that specifies the configuration of the Kinesis video stream. [Documented below](#kinesis_video_stream_config).
+* `s3_config` - A block that specifies the configuration of S3 Bucket. [Documented below](#s3_config).
+* `storage_type` - A valid storage type. Valid Values: `S3` | `KINESIS_VIDEO_STREAM` | `KINESIS_STREAM` | `KINESIS_FIREHOSE`.
+
+#### `kinesis_firehose_config`
+
+The `kinesis_firehose_config` configuration block supports the following arguments:
+
+* `firehose_arn` - The Amazon Resource Name (ARN) of the delivery stream.
+
+#### `kinesis_stream_config`
+
+The `kinesis_stream_config` configuration block supports the following arguments:
+
+* `stream_arn` - The Amazon Resource Name (ARN) of the data stream.
+
+#### `kinesis_video_stream_config`
+
+The `kinesis_video_stream_config` configuration block supports the following arguments:
+
+* `encryption_config` - The encryption configuration. [Documented below](#encryption_config).
+* `prefix` - The prefix of the video stream. Minimum length of `1`. Maximum length of `128`. When read from the state, the value returned is `<prefix>-connect-<connect_instance_alias>-contact-` since the API appends additional details to the `prefix`.
+* `retention_period_hours` - The number of hours to retain the data in a data store associated with the stream. Minimum value of `0`. Maximum value of `87600`. A value of `0` indicates that the stream does not persist data.
+
+#### `s3_config`
+
+The `s3_config` configuration block supports the following arguments:
+
+* `bucket_name` - The S3 bucket name.
+* `bucket_prefix` - The S3 bucket prefix.
+* `encryption_config` - The encryption configuration. [Documented below](#encryption_config).
+
+#### `encryption_config`
+
+The `encryption_config` configuration block supports the following arguments:
+
+* `encryption_type` - The type of encryption. Valid Values: `KMS`.
+* `key_id` - The full ARN of the encryption key. Be sure to provide the full ARN of the encryption key, not just the ID.
+
+<!-- cache-key: cdktf-0.18.0 input-0a371661b1d38e2710e935ff6991b75943c6ddc01dc786ffa90e9554a47badeb -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/connect_lambda_function_association.html.markdown b/website/docs/cdktf/python/d/connect_lambda_function_association.html.markdown
new file mode 100644
index 00000000000..8818fcd0e49
--- /dev/null
+++ b/website/docs/cdktf/python/d/connect_lambda_function_association.html.markdown
@@ -0,0 +1,48 @@
+---
+subcategory: "Connect"
+layout: "aws"
+page_title: "AWS: aws_connect_lambda_function_association"
+description: |-
+  Provides details about a specific Connect Lambda Function Association.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_connect_lambda_function_association
+
+Provides details about a specific Connect Lambda Function Association.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_connect_lambda_function_association import DataAwsConnectLambdaFunctionAssociation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsConnectLambdaFunctionAssociation(self, "example",
+            function_arn="arn:aws:lambda:us-west-2:123456789123:function:abcdefg",
+            instance_id="aaaaaaaa-bbbb-cccc-dddd-111111111111"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `function_arn` - (Required) ARN of the Lambda Function, omitting any version or alias qualifier.
+* `instance_id` - (Required) Identifier of the Amazon Connect instance. You can find the instanceId in the ARN of the instance.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - AWS Region.
+
+<!-- cache-key: cdktf-0.18.0 input-c1d2d9bab41d5c50f6cd1ef56d9cd79787374ce4ee8749c6691de4b6f052c798 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/connect_lambda_function_association.markdown b/website/docs/cdktf/python/d/connect_lambda_function_association.markdown
new file mode 100644
index 00000000000..8818fcd0e49
--- /dev/null
+++ b/website/docs/cdktf/python/d/connect_lambda_function_association.markdown
@@ -0,0 +1,48 @@
+---
+subcategory: "Connect"
+layout: "aws"
+page_title: "AWS: aws_connect_lambda_function_association"
+description: |-
+  Provides details about a specific Connect Lambda Function Association.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_connect_lambda_function_association
+
+Provides details about a specific Connect Lambda Function Association.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_connect_lambda_function_association import DataAwsConnectLambdaFunctionAssociation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsConnectLambdaFunctionAssociation(self, "example",
+            function_arn="arn:aws:lambda:us-west-2:123456789123:function:abcdefg",
+            instance_id="aaaaaaaa-bbbb-cccc-dddd-111111111111"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `function_arn` - (Required) ARN of the Lambda Function, omitting any version or alias qualifier.
+* `instance_id` - (Required) Identifier of the Amazon Connect instance. You can find the instanceId in the ARN of the instance.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - AWS Region.
+
+<!-- cache-key: cdktf-0.18.0 input-c1d2d9bab41d5c50f6cd1ef56d9cd79787374ce4ee8749c6691de4b6f052c798 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/connect_prompt.html.markdown b/website/docs/cdktf/python/d/connect_prompt.html.markdown
new file mode 100644
index 00000000000..bf17548f447
--- /dev/null
+++ b/website/docs/cdktf/python/d/connect_prompt.html.markdown
@@ -0,0 +1,51 @@
+---
+subcategory: "Connect"
+layout: "aws"
+page_title: "AWS: aws_connect_prompt"
+description: |-
+  Provides details about a specific Amazon Connect Prompt.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_connect_prompt
+
+Provides details about a specific Amazon Connect Prompt.
+
+## Example Usage
+
+By `name`
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_connect_prompt import DataAwsConnectPrompt
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsConnectPrompt(self, "example",
+            instance_id="aaaaaaaa-bbbb-cccc-dddd-111111111111",
+            name="Beep.wav"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `instance_id` - (Required) Reference to the hosting Amazon Connect Instance
+* `name` - (Required) Returns information on a specific Prompt by name
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Prompt.
+* `prompt_id` - Identifier for the prompt.
+
+<!-- cache-key: cdktf-0.18.0 input-58177347a81170a254def5388f5a6e011293a60f34e502cfd48782224da8174b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/connect_queue.html.markdown b/website/docs/cdktf/python/d/connect_queue.html.markdown
new file mode 100644
index 00000000000..0f7880e4991
--- /dev/null
+++ b/website/docs/cdktf/python/d/connect_queue.html.markdown
@@ -0,0 +1,87 @@
+---
+subcategory: "Connect"
+layout: "aws"
+page_title: "AWS: aws_connect_queue"
+description: |-
+  Provides details about a specific Amazon Connect Queue.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_connect_queue
+
+Provides details about a specific Amazon Connect Queue.
+
+## Example Usage
+
+By `name`
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_connect_queue import DataAwsConnectQueue
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsConnectQueue(self, "example",
+            instance_id="aaaaaaaa-bbbb-cccc-dddd-111111111111",
+            name="Example"
+        )
+```
+
+By `queue_id`
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_connect_queue import DataAwsConnectQueue
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsConnectQueue(self, "example",
+            instance_id="aaaaaaaa-bbbb-cccc-dddd-111111111111",
+            queue_id="cccccccc-bbbb-cccc-dddd-111111111111"
+        )
+```
+
+## Argument Reference
+
+~> **NOTE:** `instance_id` and one of either `name` or `queue_id` is required.
+
+This argument supports the following arguments:
+
+* `queue_id` - (Optional) Returns information on a specific Queue by Queue id
+* `instance_id` - (Required) Reference to the hosting Amazon Connect Instance
+* `name` - (Optional) Returns information on a specific Queue by name
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Queue.
+* `description` - Description of the Queue.
+* `hours_of_operation_id` - Specifies the identifier of the Hours of Operation.
+* `id` - Identifier of the hosting Amazon Connect Instance and identifier of the Queue separated by a colon (`:`).
+* `max_contacts` - Maximum number of contacts that can be in the queue before it is considered full. Minimum value of 0.
+* `outbound_caller_config` - A block that defines the outbound caller ID name, number, and outbound whisper flow. The Outbound Caller Config block is documented below.
+* `queue_id` - Identifier for the Queue.
+* `status` - Description of the Queue. Values are `ENABLED` or `DISABLED`.
+* `tags` - Map of tags assigned to the Queue.
+
+A `outbound_caller_config` block supports the following arguments:
+
+* `outbound_caller_id_name` - Specifies the caller ID name.
+* `outbound_caller_id_number_id` - Specifies the caller ID number.
+* `outbound_flow_id` - Outbound whisper flow to be used during an outbound call.
+
+<!-- cache-key: cdktf-0.18.0 input-d0262a3c29b46b8dbb30b2ae9f8094c5a65be92283024cb87ab840ae200c1772 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/connect_queue.markdown b/website/docs/cdktf/python/d/connect_queue.markdown
new file mode 100644
index 00000000000..0f7880e4991
--- /dev/null
+++ b/website/docs/cdktf/python/d/connect_queue.markdown
@@ -0,0 +1,87 @@
+---
+subcategory: "Connect"
+layout: "aws"
+page_title: "AWS: aws_connect_queue"
+description: |-
+  Provides details about a specific Amazon Connect Queue.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_connect_queue
+
+Provides details about a specific Amazon Connect Queue.
+
+## Example Usage
+
+By `name`
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_connect_queue import DataAwsConnectQueue
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsConnectQueue(self, "example",
+            instance_id="aaaaaaaa-bbbb-cccc-dddd-111111111111",
+            name="Example"
+        )
+```
+
+By `queue_id`
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_connect_queue import DataAwsConnectQueue
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsConnectQueue(self, "example",
+            instance_id="aaaaaaaa-bbbb-cccc-dddd-111111111111",
+            queue_id="cccccccc-bbbb-cccc-dddd-111111111111"
+        )
+```
+
+## Argument Reference
+
+~> **NOTE:** `instance_id` and one of either `name` or `queue_id` is required.
+
+This argument supports the following arguments:
+
+* `queue_id` - (Optional) Returns information on a specific Queue by Queue id
+* `instance_id` - (Required) Reference to the hosting Amazon Connect Instance
+* `name` - (Optional) Returns information on a specific Queue by name
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Queue.
+* `description` - Description of the Queue.
+* `hours_of_operation_id` - Specifies the identifier of the Hours of Operation.
+* `id` - Identifier of the hosting Amazon Connect Instance and identifier of the Queue separated by a colon (`:`).
+* `max_contacts` - Maximum number of contacts that can be in the queue before it is considered full. Minimum value of 0.
+* `outbound_caller_config` - A block that defines the outbound caller ID name, number, and outbound whisper flow. The Outbound Caller Config block is documented below.
+* `queue_id` - Identifier for the Queue.
+* `status` - Description of the Queue. Values are `ENABLED` or `DISABLED`.
+* `tags` - Map of tags assigned to the Queue.
+
+A `outbound_caller_config` block supports the following arguments:
+
+* `outbound_caller_id_name` - Specifies the caller ID name.
+* `outbound_caller_id_number_id` - Specifies the caller ID number.
+* `outbound_flow_id` - Outbound whisper flow to be used during an outbound call.
+
+<!-- cache-key: cdktf-0.18.0 input-d0262a3c29b46b8dbb30b2ae9f8094c5a65be92283024cb87ab840ae200c1772 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/connect_quick_connect.html.markdown b/website/docs/cdktf/python/d/connect_quick_connect.html.markdown
new file mode 100644
index 00000000000..43eed9f36e5
--- /dev/null
+++ b/website/docs/cdktf/python/d/connect_quick_connect.html.markdown
@@ -0,0 +1,99 @@
+---
+subcategory: "Connect"
+layout: "aws"
+page_title: "AWS: aws_connect_quick_connect"
+description: |-
+  Provides details about a specific Amazon Connect Quick Connect.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_connect_quick_connect
+
+Provides details about a specific Amazon Connect Quick Connect.
+
+## Example Usage
+
+By `name`
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_connect_quick_connect import DataAwsConnectQuickConnect
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsConnectQuickConnect(self, "example",
+            instance_id="aaaaaaaa-bbbb-cccc-dddd-111111111111",
+            name="Example"
+        )
+```
+
+By `quick_connect_id`
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_connect_quick_connect import DataAwsConnectQuickConnect
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsConnectQuickConnect(self, "example",
+            instance_id="aaaaaaaa-bbbb-cccc-dddd-111111111111",
+            quick_connect_id="cccccccc-bbbb-cccc-dddd-111111111111"
+        )
+```
+
+## Argument Reference
+
+~> **NOTE:** `instance_id` and one of either `name` or `quick_connect_id` is required.
+
+This argument supports the following arguments:
+
+* `quick_connect_id` - (Optional) Returns information on a specific Quick Connect by Quick Connect id
+* `instance_id` - (Required) Reference to the hosting Amazon Connect Instance
+* `name` - (Optional) Returns information on a specific Quick Connect by name
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Quick Connect.
+* `description` - Description of the Quick Connect.
+* `id` - Identifier of the hosting Amazon Connect Instance and identifier of the Quick Connect separated by a colon (`:`).
+* `quick_connect_config` - A block that defines the configuration information for the Quick Connect: `quick_connect_type` and one of `phone_config`, `queue_config`, `user_config` . The Quick Connect Config block is documented below.
+* `quick_connect_id` - Identifier for the Quick Connect.
+* `tags` - Map of tags to assign to the Quick Connect.
+
+A `quick_connect_config` block contains the following arguments:
+
+* `quick_connect_type` - Configuration type of the Quick Connect. Valid values are `PHONE_NUMBER`, `QUEUE`, `USER`.
+* `phone_config` - Phone configuration of the Quick Connect. This is returned only if `quick_connect_type` is `PHONE_NUMBER`. The `phone_config` block is documented below.
+* `queue_config` - Queue configuration of the Quick Connect. This is returned only if `quick_connect_type` is `QUEUE`. The `queue_config` block is documented below.
+* `user_config` - User configuration of the Quick Connect. This is returned only if `quick_connect_type` is `USER`. The `user_config` block is documented below.
+
+A `phone_config` block contains the following arguments:
+
+* `phone_number` - Phone number in in E.164 format.
+
+A `queue_config` block contains the following arguments:
+
+* `contact_flow_id` - Identifier of the contact flow.
+* `queue_id` - Identifier for the queue.
+
+A `user_config` block contains the following arguments:
+
+* `contact_flow_id` - Identifier of the contact flow.
+* `user_id` - Identifier for the user.
+
+<!-- cache-key: cdktf-0.18.0 input-47e113eb2f3ca472b6251d59440456f77334d6f7906ea4bbe83c661c839f9048 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/connect_quick_connect.markdown b/website/docs/cdktf/python/d/connect_quick_connect.markdown
new file mode 100644
index 00000000000..43eed9f36e5
--- /dev/null
+++ b/website/docs/cdktf/python/d/connect_quick_connect.markdown
@@ -0,0 +1,99 @@
+---
+subcategory: "Connect"
+layout: "aws"
+page_title: "AWS: aws_connect_quick_connect"
+description: |-
+  Provides details about a specific Amazon Connect Quick Connect.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_connect_quick_connect
+
+Provides details about a specific Amazon Connect Quick Connect.
+
+## Example Usage
+
+By `name`
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_connect_quick_connect import DataAwsConnectQuickConnect
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsConnectQuickConnect(self, "example",
+            instance_id="aaaaaaaa-bbbb-cccc-dddd-111111111111",
+            name="Example"
+        )
+```
+
+By `quick_connect_id`
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_connect_quick_connect import DataAwsConnectQuickConnect
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsConnectQuickConnect(self, "example",
+            instance_id="aaaaaaaa-bbbb-cccc-dddd-111111111111",
+            quick_connect_id="cccccccc-bbbb-cccc-dddd-111111111111"
+        )
+```
+
+## Argument Reference
+
+~> **NOTE:** `instance_id` and one of either `name` or `quick_connect_id` is required.
+
+This argument supports the following arguments:
+
+* `quick_connect_id` - (Optional) Returns information on a specific Quick Connect by Quick Connect id
+* `instance_id` - (Required) Reference to the hosting Amazon Connect Instance
+* `name` - (Optional) Returns information on a specific Quick Connect by name
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Quick Connect.
+* `description` - Description of the Quick Connect.
+* `id` - Identifier of the hosting Amazon Connect Instance and identifier of the Quick Connect separated by a colon (`:`).
+* `quick_connect_config` - A block that defines the configuration information for the Quick Connect: `quick_connect_type` and one of `phone_config`, `queue_config`, `user_config` . The Quick Connect Config block is documented below.
+* `quick_connect_id` - Identifier for the Quick Connect.
+* `tags` - Map of tags to assign to the Quick Connect.
+
+A `quick_connect_config` block contains the following arguments:
+
+* `quick_connect_type` - Configuration type of the Quick Connect. Valid values are `PHONE_NUMBER`, `QUEUE`, `USER`.
+* `phone_config` - Phone configuration of the Quick Connect. This is returned only if `quick_connect_type` is `PHONE_NUMBER`. The `phone_config` block is documented below.
+* `queue_config` - Queue configuration of the Quick Connect. This is returned only if `quick_connect_type` is `QUEUE`. The `queue_config` block is documented below.
+* `user_config` - User configuration of the Quick Connect. This is returned only if `quick_connect_type` is `USER`. The `user_config` block is documented below.
+
+A `phone_config` block contains the following arguments:
+
+* `phone_number` - Phone number in in E.164 format.
+
+A `queue_config` block contains the following arguments:
+
+* `contact_flow_id` - Identifier of the contact flow.
+* `queue_id` - Identifier for the queue.
+
+A `user_config` block contains the following arguments:
+
+* `contact_flow_id` - Identifier of the contact flow.
+* `user_id` - Identifier for the user.
+
+<!-- cache-key: cdktf-0.18.0 input-47e113eb2f3ca472b6251d59440456f77334d6f7906ea4bbe83c661c839f9048 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/connect_routing_profile.html.markdown b/website/docs/cdktf/python/d/connect_routing_profile.html.markdown
new file mode 100644
index 00000000000..01dc4c81641
--- /dev/null
+++ b/website/docs/cdktf/python/d/connect_routing_profile.html.markdown
@@ -0,0 +1,93 @@
+---
+subcategory: "Connect"
+layout: "aws"
+page_title: "AWS: aws_connect_routing_profile"
+description: |-
+  Provides details about a specific Amazon Connect Routing Profile.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_connect_routing_profile
+
+Provides details about a specific Amazon Connect Routing Profile.
+
+## Example Usage
+
+By `name`
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_connect_routing_profile import DataAwsConnectRoutingProfile
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsConnectRoutingProfile(self, "example",
+            instance_id="aaaaaaaa-bbbb-cccc-dddd-111111111111",
+            name="Example"
+        )
+```
+
+By `routing_profile_id`
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_connect_routing_profile import DataAwsConnectRoutingProfile
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsConnectRoutingProfile(self, "example",
+            instance_id="aaaaaaaa-bbbb-cccc-dddd-111111111111",
+            routing_profile_id="cccccccc-bbbb-cccc-dddd-111111111111"
+        )
+```
+
+## Argument Reference
+
+~> **NOTE:** `instance_id` and one of either `name` or `routing_profile_id` is required.
+
+This argument supports the following arguments:
+
+* `instance_id` - Reference to the hosting Amazon Connect Instance
+* `name` - (Optional) Returns information on a specific Routing Profile by name
+* `routing_profile_id` - (Optional) Returns information on a specific Routing Profile by Routing Profile id
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Routing Profile.
+* `default_outbound_queue_id` - Specifies the default outbound queue for the Routing Profile.
+* `description` - Description of the Routing Profile.
+* `id` - Identifier of the hosting Amazon Connect Instance and identifier of the Routing Profile separated by a colon (`:`).
+* `media_concurrencies` - One or more `media_concurrencies` blocks that specify the channels that agents can handle in the Contact Control Panel (CCP) for this Routing Profile. The `media_concurrencies` block is documented below.
+* `queue_configs` - One or more `queue_configs` blocks that specify the inbound queues associated with the routing profile. If no queue is added, the agent only can make outbound calls. The `queue_configs` block is documented below.
+* `tags` - Map of tags to assign to the Routing Profile.
+
+A `media_concurrencies` block supports the following attributes:
+
+* `channel` - Channels that agents can handle in the Contact Control Panel (CCP). Valid values are `VOICE`, `CHAT`, `TASK`.
+* `concurrency` - Number of contacts an agent can have on a channel simultaneously. Valid Range for `VOICE`: Minimum value of 1. Maximum value of 1. Valid Range for `CHAT`: Minimum value of 1. Maximum value of 10. Valid Range for `TASK`: Minimum value of 1. Maximum value of 10.
+
+A `queue_configs` block supports the following attributes:
+
+* `channel` - Channels agents can handle in the Contact Control Panel (CCP) for this routing profile. Valid values are `VOICE`, `CHAT`, `TASK`.
+* `delay` - Delay, in seconds, that a contact should be in the queue before they are routed to an available agent
+* `priority` - Order in which contacts are to be handled for the queue.
+* `queue_arn` - ARN for the queue.
+* `queue_id` - Identifier for the queue.
+* `queue_name` - Name for the queue.
+
+<!-- cache-key: cdktf-0.18.0 input-7ae68b75fdca27a8760c4c164d2158714999272950916b7bd000a215ec569cf2 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/connect_security_profile.html.markdown b/website/docs/cdktf/python/d/connect_security_profile.html.markdown
new file mode 100644
index 00000000000..a76b410e537
--- /dev/null
+++ b/website/docs/cdktf/python/d/connect_security_profile.html.markdown
@@ -0,0 +1,78 @@
+---
+subcategory: "Connect"
+layout: "aws"
+page_title: "AWS: aws_connect_security_profile"
+description: |-
+  Provides details about a specific Amazon Connect Security Profile.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_connect_security_profile
+
+Provides details about a specific Amazon Connect Security Profile.
+
+## Example Usage
+
+By `name`
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_connect_security_profile import DataAwsConnectSecurityProfile
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsConnectSecurityProfile(self, "example",
+            instance_id="aaaaaaaa-bbbb-cccc-dddd-111111111111",
+            name="Example"
+        )
+```
+
+By `security_profile_id`
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_connect_security_profile import DataAwsConnectSecurityProfile
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsConnectSecurityProfile(self, "example",
+            instance_id="aaaaaaaa-bbbb-cccc-dddd-111111111111",
+            security_profile_id="cccccccc-bbbb-cccc-dddd-111111111111"
+        )
+```
+
+## Argument Reference
+
+~> **NOTE:** `instance_id` and one of either `name` or `security_profile_id` is required.
+
+This argument supports the following arguments:
+
+* `security_profile_id` - (Optional) Returns information on a specific Security Profile by Security Profile id
+* `instance_id` - (Required) Reference to the hosting Amazon Connect Instance
+* `name` - (Optional) Returns information on a specific Security Profile by name
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Security Profile.
+* `description` - Description of the Security Profile.
+* `id` - Identifier of the hosting Amazon Connect Instance and identifier of the Security Profile separated by a colon (`:`).
+* `organization_resource_id` - The organization resource identifier for the security profile.
+* `permissions` - List of permissions assigned to the security profile.
+* `tags` - Map of tags to assign to the Security Profile.
+
+<!-- cache-key: cdktf-0.18.0 input-ca6061431d187a32ef698b08c7464880ab9e5cbcb8ba86414cce0d19a1515ff1 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/connect_user.html.markdown b/website/docs/cdktf/python/d/connect_user.html.markdown
new file mode 100644
index 00000000000..4c0fe0af40f
--- /dev/null
+++ b/website/docs/cdktf/python/d/connect_user.html.markdown
@@ -0,0 +1,99 @@
+---
+subcategory: "Connect"
+layout: "aws"
+page_title: "AWS: aws_connect_user"
+description: |-
+  Provides details about a specific Amazon Connect User.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_connect_user
+
+Provides details about a specific Amazon Connect User.
+
+## Example Usage
+
+By `name`
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_connect_user import DataAwsConnectUser
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsConnectUser(self, "example",
+            instance_id="aaaaaaaa-bbbb-cccc-dddd-111111111111",
+            name="Example"
+        )
+```
+
+By `user_id`
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_connect_user import DataAwsConnectUser
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsConnectUser(self, "example",
+            instance_id="aaaaaaaa-bbbb-cccc-dddd-111111111111",
+            user_id="cccccccc-bbbb-cccc-dddd-111111111111"
+        )
+```
+
+## Argument Reference
+
+~> **NOTE:** `instance_id` and one of either `name` or `user_id` is required.
+
+This argument supports the following arguments:
+
+* `instance_id` - (Required) Reference to the hosting Amazon Connect Instance
+* `name` - (Optional) Returns information on a specific User by name
+* `user_id` - (Optional) Returns information on a specific User by User id
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the User.
+* `directory_user_id` - The identifier of the user account in the directory used for identity management.
+* `hierarchy_group_id` - The identifier of the hierarchy group for the user.
+* `id` - The identifier of the hosting Amazon Connect Instance and identifier of the User separated by a colon (`:`).
+* `identity_info` - A block that contains information about the identity of the user. [Documented below](#identity_info).
+* `instance_id` - Specifies the identifier of the hosting Amazon Connect Instance.
+* `phone_config` - A block that contains information about the phone settings for the user. [Documented below](#phone_config).
+* `routing_profile_id` - The identifier of the routing profile for the user.
+* `security_profile_ids` - A list of identifiers for the security profiles for the user.
+* `tags` - A map of tags to assign to the User.
+
+### `identity_info`
+
+An `identity_info` block supports the following attributes:
+
+* `email` - The email address.
+* `first_name` - The first name.
+* `last_name` - The last name.
+
+### `phone_config`
+
+A `phone_config` block supports the following attributes:
+
+* `after_contact_work_time_limit` - The After Call Work (ACW) timeout setting, in seconds.
+* `auto_accept` - When Auto-Accept Call is enabled for an available agent, the agent connects to contacts automatically.
+* `desk_phone_number` - The phone number for the user's desk phone.
+* `phone_type` - The phone type. Valid values are `DESK_PHONE` and `SOFT_PHONE`.
+
+<!-- cache-key: cdktf-0.18.0 input-6533a2d44318a8db1711f9e310a73d30328d1503d85cb50973ba8962241bc227 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/connect_user_hierarchy_group.html.markdown b/website/docs/cdktf/python/d/connect_user_hierarchy_group.html.markdown
new file mode 100644
index 00000000000..e506df559df
--- /dev/null
+++ b/website/docs/cdktf/python/d/connect_user_hierarchy_group.html.markdown
@@ -0,0 +1,91 @@
+---
+subcategory: "Connect"
+layout: "aws"
+page_title: "AWS: aws_connect_user_hierarchy_group"
+description: |-
+  Provides details about a specific Amazon Connect User Hierarchy Group.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_connect_user_hierarchy_group
+
+Provides details about a specific Amazon Connect User Hierarchy Group.
+
+## Example Usage
+
+By `name`
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_connect_user_hierarchy_group import DataAwsConnectUserHierarchyGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsConnectUserHierarchyGroup(self, "example",
+            instance_id="aaaaaaaa-bbbb-cccc-dddd-111111111111",
+            name="Example"
+        )
+```
+
+By `hierarchy_group_id`
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_connect_user_hierarchy_group import DataAwsConnectUserHierarchyGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsConnectUserHierarchyGroup(self, "example",
+            hierarchy_group_id="cccccccc-bbbb-cccc-dddd-111111111111",
+            instance_id="aaaaaaaa-bbbb-cccc-dddd-111111111111"
+        )
+```
+
+## Argument Reference
+
+~> **NOTE:** `instance_id` and one of either `name` or `hierarchy_group_id` is required.
+
+This argument supports the following arguments:
+
+* `hierarchy_group_id` - (Optional) Returns information on a specific hierarchy group by hierarchy group id
+* `instance_id` - (Required) Reference to the hosting Amazon Connect Instance
+* `name` - (Optional) Returns information on a specific hierarchy group by name
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the hierarchy group.
+* `hierarchy_path` - Block that contains information about the levels in the hierarchy group. The `hierarchy_path` block is documented below.
+* `level_id` - Identifier of the level in the hierarchy group.
+* `id` - Identifier of the hosting Amazon Connect Instance and identifier of the hierarchy group separated by a colon (`:`).
+* `tags` - Map of tags to assign to the hierarchy group.
+
+A `hierarchy_path` block supports the following attributes:
+
+* `level_one` - Details of level one. See below.
+* `level_two` - Details of level two. See below.
+* `level_three` - Details of level three. See below.
+* `level_four` - Details of level four. See below.
+* `level_five` - Details of level five. See below.
+
+A level block supports the following attributes:
+
+* `arn` -  ARN of the hierarchy group.
+* `id` -  The identifier of the hierarchy group.
+* `name` - Name of the hierarchy group.
+
+<!-- cache-key: cdktf-0.18.0 input-4a65e86f5180790b93c832a3ed14333f7e6e9c245f4c8eef60843f34eedef36c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/connect_user_hierarchy_structure.html.markdown b/website/docs/cdktf/python/d/connect_user_hierarchy_structure.html.markdown
new file mode 100644
index 00000000000..8aa0c399c4b
--- /dev/null
+++ b/website/docs/cdktf/python/d/connect_user_hierarchy_structure.html.markdown
@@ -0,0 +1,60 @@
+---
+subcategory: "Connect"
+layout: "aws"
+page_title: "AWS: aws_connect_user_hierarchy_structure"
+description: |-
+  Provides details about a specific Amazon Connect User Hierarchy Structure
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_connect_user_hierarchy_structure
+
+Provides details about a specific Amazon Connect User Hierarchy Structure
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_connect_user_hierarchy_structure import DataAwsConnectUserHierarchyStructure
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsConnectUserHierarchyStructure(self, "test",
+            instance_id=Token.as_string(aws_connect_instance_test.id)
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `instance_id` - (Required) Reference to the hosting Amazon Connect Instance
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `hierarchy_structure` - Block that defines the hierarchy structure's levels. The `hierarchy_structure` block is documented below.
+
+A `hierarchy_structure` block supports the following attributes:
+
+* `level_one` - Details of level one. See below.
+* `level_two` - Details of level two. See below.
+* `level_three` - Details of level three. See below.
+* `level_four` - Details of level four. See below.
+* `level_five` - Details of level five. See below.
+
+Each level block supports the following attributes:
+
+* `arn` -  ARN of the hierarchy level.
+* `id` -  The identifier of the hierarchy level.
+* `name` - Name of the user hierarchy level. Must not be more than 50 characters.
+
+<!-- cache-key: cdktf-0.18.0 input-67c7477b2b97d10d20fdb501a7e53bda8c43d8444a8ca3ea500fed342e44089c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/connect_vocabulary.html.markdown b/website/docs/cdktf/python/d/connect_vocabulary.html.markdown
new file mode 100644
index 00000000000..a4447b95d23
--- /dev/null
+++ b/website/docs/cdktf/python/d/connect_vocabulary.html.markdown
@@ -0,0 +1,82 @@
+---
+subcategory: "Connect"
+layout: "aws"
+page_title: "AWS: aws_connect_vocabulary"
+description: |-
+  Provides details about a specific Amazon Connect Vocabulary.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_connect_vocabulary
+
+Provides details about a specific Amazon Connect Vocabulary.
+
+## Example Usage
+
+By `name`
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_connect_vocabulary import DataAwsConnectVocabulary
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsConnectVocabulary(self, "example",
+            instance_id="aaaaaaaa-bbbb-cccc-dddd-111111111111",
+            name="Example"
+        )
+```
+
+By `vocabulary_id`
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_connect_vocabulary import DataAwsConnectVocabulary
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsConnectVocabulary(self, "example",
+            instance_id="aaaaaaaa-bbbb-cccc-dddd-111111111111",
+            vocabulary_id="cccccccc-bbbb-cccc-dddd-111111111111"
+        )
+```
+
+## Argument Reference
+
+~> **NOTE:** `instance_id` and one of either `name` or `vocabulary_id` is required.
+
+This argument supports the following arguments:
+
+* `instance_id` - (Required) Reference to the hosting Amazon Connect Instance
+* `name` - (Optional) Returns information on a specific Vocabulary by name
+* `vocabulary_id` - (Optional) Returns information on a specific Vocabulary by Vocabulary id
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the Vocabulary.
+* `content` - The content of the custom vocabulary in plain-text format with a table of values. Each row in the table represents a word or a phrase, described with Phrase, IPA, SoundsLike, and DisplayAs fields. Separate the fields with TAB characters. For more information, see [Create a custom vocabulary using a table](https://docs.aws.amazon.com/transcribe/latest/dg/custom-vocabulary.html#create-vocabulary-table).
+* `failure_reason` - The reason why the custom vocabulary was not created.
+* `id` - The identifier of the hosting Amazon Connect Instance and identifier of the vocabulary
+separated by a colon (`:`).
+* `language_code` - The language code of the vocabulary entries. For a list of languages and their corresponding language codes, see [What is Amazon Transcribe?](https://docs.aws.amazon.com/transcribe/latest/dg/transcribe-whatis.html). Valid Values are `ar-AE`, `de-CH`, `de-DE`, `en-AB`, `en-AU`, `en-GB`, `en-IE`, `en-IN`, `en-US`, `en-WL`, `es-ES`, `es-US`, `fr-CA`, `fr-FR`, `hi-IN`, `it-IT`, `ja-JP`, `ko-KR`, `pt-BR`, `pt-PT`, `zh-CN`.
+* `last_modified_time` - The timestamp when the custom vocabulary was last modified.
+* `state` - The current state of the custom vocabulary. Valid values are `CREATION_IN_PROGRESS`, `ACTIVE`, `CREATION_FAILED`, `DELETE_IN_PROGRESS`.
+* `tags` - A map of tags to assign to the Vocabulary.
+* `vocabulary_id` - The identifier of the custom vocabulary.
+
+<!-- cache-key: cdktf-0.18.0 input-28dff9533e7ed6f8274af7c06c44ac3737d4ee8b41560fc884b0ffe019a6221f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/controltower_controls.html.markdown b/website/docs/cdktf/python/d/controltower_controls.html.markdown
new file mode 100644
index 00000000000..4f0011d775a
--- /dev/null
+++ b/website/docs/cdktf/python/d/controltower_controls.html.markdown
@@ -0,0 +1,58 @@
+---
+subcategory: "Control Tower"
+layout: "aws"
+page_title: "AWS: aws_controltower_controls"
+description: |-
+  List of Control Tower controls applied to an OU.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_controltower_controls
+
+List of Control Tower controls applied to an OU.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_controltower_controls import DataAwsControltowerControls
+from imports.aws.data_aws_organizations_organization import DataAwsOrganizationsOrganization
+from imports.aws.data_aws_organizations_organizational_units import DataAwsOrganizationsOrganizationalUnits
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        this_var = DataAwsOrganizationsOrganization(self, "this")
+        data_aws_organizations_organizational_units_this =
+        DataAwsOrganizationsOrganizationalUnits(self, "this_1",
+            parent_id=Token.as_string(Fn.lookup_nested(this_var.roots, ["0", "id"]))
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_organizations_organizational_units_this.override_logical_id("this")
+        data_aws_controltower_controls_this = DataAwsControltowerControls(self, "this_2",
+            target_identifier=Token.as_string(
+                Fn.lookup_nested("${[ for x in ${" + data_aws_organizations_organizational_units_this.children + "} : x.arn if x.name == \"Security\"]}", ["0"]))
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_controltower_controls_this.override_logical_id("this")
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `target_identifier` - (Required) The ARN of the organizational unit.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `enabled_controls` - List of all the ARNs for the controls applied to the `target_identifier`.
+
+<!-- cache-key: cdktf-0.18.0 input-5d64cbccc4ebc5f5b040cdf645dfc1895e2df0f54863b642aeb0024d4372f827 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/cur_report_definition.html.markdown b/website/docs/cdktf/python/d/cur_report_definition.html.markdown
new file mode 100644
index 00000000000..ad78cda9888
--- /dev/null
+++ b/website/docs/cdktf/python/d/cur_report_definition.html.markdown
@@ -0,0 +1,59 @@
+---
+subcategory: "Cost and Usage Report"
+layout: "aws"
+page_title: "AWS: aws_cur_report_definition"
+description: |-
+  Get information on an AWS Cost and Usage Report Definition.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_cur_report_definition
+
+Use this data source to get information on an AWS Cost and Usage Report Definition.
+
+~> *NOTE:* The AWS Cost and Usage Report service is only available in `us-east-1` currently.
+
+~> *NOTE:* If AWS Organizations is enabled, only the master account can use this resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_cur_report_definition import DataAwsCurReportDefinition
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsCurReportDefinition(self, "report_definition",
+            report_name="example"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `report_name` - (Required) Name of the report definition to match.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `time_unit` - Frequency on which report data are measured and displayed.
+* `format` - Preferred compression format for report.
+* `compression` - Preferred format for report.
+* `additional_schema_elements` - A list of schema elements.
+* `s3_bucket` - Name of customer S3 bucket.
+* `s3_prefix` - Preferred report path prefix.
+* `s3_region` - Region of customer S3 bucket.
+* `additional_artifacts` - A list of additional artifacts.
+* `refresh_closed_reports` - If true reports are updated after they have been finalized.
+* `report_versioning` - Overwrite the previous version of each report or to deliver the report in addition to the previous versions.
+
+<!-- cache-key: cdktf-0.18.0 input-7c41a2bcbec1b1838d1888c217040322a9f0e0110b3b20e4772db0809292f796 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/customer_gateway.html.markdown b/website/docs/cdktf/python/d/customer_gateway.html.markdown
new file mode 100644
index 00000000000..0ed526c1830
--- /dev/null
+++ b/website/docs/cdktf/python/d/customer_gateway.html.markdown
@@ -0,0 +1,77 @@
+---
+subcategory: "VPN (Site-to-Site)"
+layout: "aws"
+page_title: "AWS: aws_customer_gateway"
+description: |-
+  Get an existing AWS Customer Gateway.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_customer_gateway
+
+Get an existing AWS Customer Gateway.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_customer_gateway import DataAwsCustomerGateway
+from imports.aws.vpn_connection import VpnConnection
+from imports.aws.vpn_gateway import VpnGateway
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        main = VpnGateway(self, "main",
+            amazon_side_asn=Token.as_string(7224),
+            vpc_id=Token.as_string(aws_vpc_main.id)
+        )
+        foo = DataAwsCustomerGateway(self, "foo",
+            filter=[DataAwsCustomerGatewayFilter(
+                name="tag:Name",
+                values=["foo-prod"]
+            )
+            ]
+        )
+        VpnConnection(self, "transit",
+            customer_gateway_id=Token.as_string(foo.id),
+            static_routes_only=False,
+            type=Token.as_string(foo.type),
+            vpn_gateway_id=main.id
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `id` - (Optional) ID of the gateway.
+* `filter` - (Optional) One or more [name-value pairs][dcg-filters] to filter by.
+
+[dcg-filters]: https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeCustomerGateways.html
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the customer gateway.
+* `bgp_asn` - Gateway's Border Gateway Protocol (BGP) Autonomous System Number (ASN).
+* `certificate_arn` - ARN for the customer gateway certificate.
+* `device_name` - Name for the customer gateway device.
+* `ip_address` - IP address of the gateway's Internet-routable external interface.
+* `tags` - Map of key-value pairs assigned to the gateway.
+* `type` - Type of customer gateway. The only type AWS supports at this time is "ipsec.1".
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `20m`)
+
+<!-- cache-key: cdktf-0.18.0 input-e72280e509c2817731cdebdb6406a3889d39f235f042905746f02db00e556305 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/datapipeline_pipeline.html.markdown b/website/docs/cdktf/python/d/datapipeline_pipeline.html.markdown
new file mode 100644
index 00000000000..b6ad12af576
--- /dev/null
+++ b/website/docs/cdktf/python/d/datapipeline_pipeline.html.markdown
@@ -0,0 +1,48 @@
+---
+subcategory: "Data Pipeline"
+layout: "aws"
+page_title: "AWS: aws_datapipeline_pipeline"
+description: |-
+  Provides details about a specific DataPipeline.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Source: aws_datapipeline_pipeline
+
+Provides details about a specific DataPipeline Pipeline.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_datapipeline_pipeline import DataAwsDatapipelinePipeline
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsDatapipelinePipeline(self, "example",
+            pipeline_id="pipelineID"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `pipeline_id` - (Required) ID of the pipeline.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `name` - Name of Pipeline.
+* `description` - Description of Pipeline.
+* `tags` - Map of tags assigned to the resource.
+
+<!-- cache-key: cdktf-0.18.0 input-0154aec5cfe5e0d42b7c7722943a7cf0f57208c6d4b146fcddb0cb3fda0c9cc9 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/datapipeline_pipeline_definition.html.markdown b/website/docs/cdktf/python/d/datapipeline_pipeline_definition.html.markdown
new file mode 100644
index 00000000000..014fc262f11
--- /dev/null
+++ b/website/docs/cdktf/python/d/datapipeline_pipeline_definition.html.markdown
@@ -0,0 +1,75 @@
+---
+subcategory: "Data Pipeline"
+layout: "aws"
+page_title: "AWS: aws_datapipeline_pipeline_definition"
+description: |-
+  Provides details about a specific DataPipeline Definition.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Source: aws_datapipeline_pipeline_definition
+
+Provides details about a specific DataPipeline Pipeline Definition.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_datapipeline_pipeline_definition import DataAwsDatapipelinePipelineDefinition
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsDatapipelinePipelineDefinition(self, "example",
+            pipeline_id="pipelineID"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `pipeline_id` - (Required) ID of the pipeline.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `parameter_object` - Parameter objects used in the pipeline definition. See below
+* `parameter_value` - Parameter values used in the pipeline definition. See below
+* `pipeline_object` - Objects defined in the pipeline. See below
+
+### `parameter_object`
+
+* `attributes` - Attributes of the parameter object. See below
+* `id` - ID of the parameter object.
+
+### `attributes`
+
+* `key` - Field identifier.
+* `string_value` - Field value, expressed as a String.
+
+### `parameter_value`
+
+* `id` - ID of the parameter value.
+* `string_value` - Field value, expressed as a String.
+
+### `pipeline_object`
+
+* `field` - Key-value pairs that define the properties of the object. See below
+* `id` - ID of the object.
+* `name` - ARN of the storage connector.
+
+### `field`
+
+* `key` - Field identifier.
+* `ref_value` - Field value, expressed as the identifier of another object
+* `string_value` - Field value, expressed as a String.
+
+<!-- cache-key: cdktf-0.18.0 input-75cbddaa4bd420bfb5a031b922347a505b58350e72121e00d8808da4c3ad03ca -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/db_cluster_snapshot.html.markdown b/website/docs/cdktf/python/d/db_cluster_snapshot.html.markdown
new file mode 100644
index 00000000000..09a4f2848b6
--- /dev/null
+++ b/website/docs/cdktf/python/d/db_cluster_snapshot.html.markdown
@@ -0,0 +1,97 @@
+---
+subcategory: "RDS (Relational Database)"
+layout: "aws"
+page_title: "AWS: aws_db_cluster_snapshot"
+description: |-
+  Get information on a DB Cluster Snapshot.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_db_cluster_snapshot
+
+Use this data source to get information about a DB Cluster Snapshot for use when provisioning DB clusters.
+
+~> **NOTE:** This data source does not apply to snapshots created on DB Instances.
+See the [`aws_db_snapshot` data source](/docs/providers/aws/d/db_snapshot.html) for DB Instance snapshots.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from cdktf import TerraformResourceLifecycle
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_db_cluster_snapshot import DataAwsDbClusterSnapshot
+from imports.aws.rds_cluster import RdsCluster
+from imports.aws.rds_cluster_instance import RdsClusterInstance
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, engine, engine1):
+        super().__init__(scope, name)
+        development_final_snapshot = DataAwsDbClusterSnapshot(self, "development_final_snapshot",
+            db_cluster_identifier="development_cluster",
+            most_recent=True
+        )
+        aurora = RdsCluster(self, "aurora",
+            cluster_identifier="development_cluster",
+            db_subnet_group_name="my_db_subnet_group",
+            lifecycle=TerraformResourceLifecycle(
+                ignore_changes=[snapshot_identifier]
+            ),
+            snapshot_identifier=Token.as_string(development_final_snapshot.id),
+            engine=engine
+        )
+        aws_rds_cluster_instance_aurora = RdsClusterInstance(self, "aurora_2",
+            cluster_identifier=aurora.id,
+            db_subnet_group_name="my_db_subnet_group",
+            instance_class="db.t2.small",
+            engine=engine1
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_rds_cluster_instance_aurora.override_logical_id("aurora")
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `most_recent` - (Optional) If more than one result is returned, use the most recent Snapshot.
+* `db_cluster_identifier` - (Optional) Returns the list of snapshots created by the specific db_cluster
+* `db_cluster_snapshot_identifier` - (Optional) Returns information on a specific snapshot_id.
+* `snapshot_type` - (Optional) Type of snapshots to be returned. If you don't specify a SnapshotType
+value, then both automated and manual DB cluster snapshots are returned. Shared and public DB Cluster Snapshots are not
+included in the returned results by default. Possible values are, `automated`, `manual`, `shared`, `public` and `awsbackup`.
+* `include_shared` - (Optional) Set this value to true to include shared manual DB Cluster Snapshots from other
+AWS accounts that this AWS account has been given permission to copy or restore, otherwise set this value to false.
+The default is `false`.
+* `include_public` - (Optional) Set this value to true to include manual DB Cluster Snapshots that are public and can be
+copied or restored by any AWS account, otherwise set this value to false. The default is `false`.
+* `tags` - (Optional) Mapping of tags, each pair of which must exactly match
+  a pair on the desired DB cluster snapshot.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `allocated_storage` - Allocated storage size in gigabytes (GB).
+* `availability_zones` - List of EC2 Availability Zones that instances in the DB cluster snapshot can be restored in.
+* `db_cluster_identifier` - Specifies the DB cluster identifier of the DB cluster that this DB cluster snapshot was created from.
+* `db_cluster_snapshot_arn` - The ARN for the DB Cluster Snapshot.
+* `engine_version` - Version of the database engine for this DB cluster snapshot.
+* `engine` - Name of the database engine.
+* `id` - Snapshot ID.
+* `kms_key_id` - If storage_encrypted is true, the AWS KMS key identifier for the encrypted DB cluster snapshot.
+* `license_model` - License model information for the restored DB cluster.
+* `port` - Port that the DB cluster was listening on at the time of the snapshot.
+* `snapshot_create_time` - Time when the snapshot was taken, in Universal Coordinated Time (UTC).
+* `source_db_cluster_snapshot_identifier` - DB Cluster Snapshot ARN that the DB Cluster Snapshot was copied from. It only has value in case of cross customer or cross region copy.
+* `status` - Status of this DB Cluster Snapshot.
+* `storage_encrypted` - Whether the DB cluster snapshot is encrypted.
+* `vpc_id` - VPC ID associated with the DB cluster snapshot.
+* `tags` - Map of tags for the resource.
+
+<!-- cache-key: cdktf-0.18.0 input-a5847b6b7894b8bc81d561012d77e63802b11d4802ee1f24e4c51067e98ce60e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/db_event_categories.html.markdown b/website/docs/cdktf/python/d/db_event_categories.html.markdown
new file mode 100644
index 00000000000..14604c7796c
--- /dev/null
+++ b/website/docs/cdktf/python/d/db_event_categories.html.markdown
@@ -0,0 +1,74 @@
+---
+subcategory: "RDS (Relational Database)"
+layout: "aws"
+page_title: "AWS: aws_db_event_categories"
+description: |-
+    Provides a list of DB Event Categories which can be used to pass values into DB Event Subscription.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_db_event_categories
+
+## Example Usage
+
+List the event categories of all the RDS resources.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformOutput, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_db_event_categories import DataAwsDbEventCategories
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = DataAwsDbEventCategories(self, "example")
+        cdktf_terraform_output_example = TerraformOutput(self, "example_1",
+            value=example.event_categories
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        cdktf_terraform_output_example.override_logical_id("example")
+```
+
+List the event categories specific to the RDS resource `db-snapshot`.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformOutput, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_db_event_categories import DataAwsDbEventCategories
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = DataAwsDbEventCategories(self, "example",
+            source_type="db-snapshot"
+        )
+        cdktf_terraform_output_example = TerraformOutput(self, "example_1",
+            value=example.event_categories
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        cdktf_terraform_output_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `source_type` - (Optional) Type of source that will be generating the events. Valid options are db-instance, db-security-group, db-parameter-group, db-snapshot, db-cluster or db-cluster-snapshot.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `event_categories` - List of the event categories.
+* `id` - Region of the event categories.
+
+<!-- cache-key: cdktf-0.18.0 input-d1d5b27d77d80317092ac76176fc6ee08cb96d448e528e2d6bdc53e0d6fff300 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/db_instance.html.markdown b/website/docs/cdktf/python/d/db_instance.html.markdown
new file mode 100644
index 00000000000..6110398bb0d
--- /dev/null
+++ b/website/docs/cdktf/python/d/db_instance.html.markdown
@@ -0,0 +1,96 @@
+---
+subcategory: "RDS (Relational Database)"
+layout: "aws"
+page_title: "AWS: aws_db_instance"
+description: |-
+  Get information on an RDS Database Instance.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_db_instance
+
+Use this data source to get information about an RDS instance
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_db_instance import DataAwsDbInstance
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsDbInstance(self, "database",
+            db_instance_identifier="my-test-database"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `db_instance_identifier` - (Optional) Name of the RDS instance.
+* `tags` - (Optional) Map of tags, each pair of which must exactly match a pair on the desired instance.
+
+## Attribute Reference
+
+~> **NOTE:** The `port` field may be empty while an Aurora cluster is still in the process of being created. This can occur if the cluster was initiated with the [AWS CLI `create-db-cluster`](https://docs.aws.amazon.com/cli/latest/reference/rds/create-db-cluster.html) command, but no DB instance has yet been added to it.
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `address` - Hostname of the RDS instance. See also `endpoint` and `port`.
+* `allocated_storage` - Allocated storage size specified in gigabytes.
+* `auto_minor_version_upgrade` - Indicates that minor version patches are applied automatically.
+* `availability_zone` - Name of the Availability Zone the DB instance is located in.
+* `backup_retention_period` - Specifies the number of days for which automatic DB snapshots are retained.
+* `db_cluster_identifier` - If the DB instance is a member of a DB cluster, contains the name of the DB cluster that the DB instance is a member of.
+* `db_instance_arn` - ARN for the DB instance.
+* `db_instance_class` - Contains the name of the compute and memory capacity class of the DB instance.
+* `db_name` - Contains the name of the initial database of this instance that was provided at create time, if one was specified when the DB instance was created. This same name is returned for the life of the DB instance.
+* `db_parameter_groups` - Provides the list of DB parameter groups applied to this DB instance.
+* `db_subnet_group` - Name of the subnet group associated with the DB instance.
+* `db_instance_port` - Port that the DB instance listens on.
+* `enabled_cloudwatch_logs_exports` - List of log types to export to cloudwatch.
+* `endpoint` - Connection endpoint in `address:port` format.
+* `engine` - Provides the name of the database engine to be used for this DB instance.
+* `engine_version` - Database engine version.
+* `hosted_zone_id` - Canonical hosted zone ID of the DB instance (to be used in a Route 53 Alias record).
+* `iops` - Provisioned IOPS (I/O operations per second) value.
+* `kms_key_id` - If StorageEncrypted is true, the KMS key identifier for the encrypted DB instance.
+* `license_model` - License model information for this DB instance.
+* `master_username` - Contains the master username for the DB instance.
+* `master_user_secret` - Provides the master user secret. Only available when `manage_master_user_password` is set to true. [Documented below](#master_user_secret).
+* `max_allocated_storage` - The upper limit to which Amazon RDS can automatically scale the storage of the DB instance.
+* `monitoring_interval` - Interval, in seconds, between points when Enhanced Monitoring metrics are collected for the DB instance.
+* `monitoring_role_arn` - ARN for the IAM role that permits RDS to send Enhanced Monitoring metrics to CloudWatch Logs.
+* `multi_az` - If the DB instance is a Multi-AZ deployment.
+* `network_type` - Network type of the DB instance.
+* `option_group_memberships` - Provides the list of option group memberships for this DB instance.
+* `port` - Database endpoint port, primarily used by an Aurora DB cluster. For a conventional RDS DB instance, the `db_instance_port` is typically the preferred choice.
+* `preferred_backup_window` - Specifies the daily time range during which automated backups are created.
+* `preferred_maintenance_window` -  Specifies the weekly time range during which system maintenance can occur in UTC.
+* `publicly_accessible` - Accessibility options for the DB instance.
+* `resource_id` - RDS Resource ID of this instance.
+* `storage_encrypted` - Whether the DB instance is encrypted.
+* `storage_throughput` - Storage throughput value for the DB instance.
+* `storage_type` - Storage type associated with DB instance.
+* `timezone` - Time zone of the DB instance.
+* `vpc_security_groups` - Provides a list of VPC security group elements that the DB instance belongs to.
+* `replicate_source_db` - Identifier of the source DB that this is a replica of.
+* `ca_cert_identifier` - Identifier of the CA certificate for the DB instance.
+
+### master_user_secret
+
+The `master_user_secret` configuration block supports the following attributes:
+
+* `kms_key_id` - The Amazon Web Services KMS key identifier that is used to encrypt the secret.
+* `secret_arn` - The Amazon Resource Name (ARN) of the secret.
+* `secret_status` - The status of the secret. Valid Values: `creating` | `active` | `rotating` | `impaired`.
+
+<!-- cache-key: cdktf-0.18.0 input-156ff5865fbb8f8d95843d45c98755bb49f6b9ca52d29fab4979c7c7d124577a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/db_instances.html.markdown b/website/docs/cdktf/python/d/db_instances.html.markdown
new file mode 100644
index 00000000000..50cdc6b2a1f
--- /dev/null
+++ b/website/docs/cdktf/python/d/db_instances.html.markdown
@@ -0,0 +1,82 @@
+---
+subcategory: "RDS (Relational Database)"
+layout: "aws"
+page_title: "AWS: aws_db_instances"
+description: |-
+  Terraform data source for listing RDS Database Instances.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_db_instances
+
+Terraform data source for listing RDS Database Instances.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_db_instances import DataAwsDbInstances
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsDbInstances(self, "example",
+            filter=[DataAwsDbInstancesFilter(
+                name="db-instance-id",
+                values=["my-database-id"]
+            )
+            ]
+        )
+```
+
+### Using tags
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_db_instances import DataAwsDbInstances
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsDbInstances(self, "example",
+            tags={
+                "Env": "test"
+            }
+        )
+```
+
+## Argument Reference
+
+The following arguments are optional:
+
+* `filter` - (Optional) Configuration block(s) used to filter instances with AWS supported attributes, such as `engine`, `db-cluster-id` or `db-instance-id` for example. Detailed below.
+* `tags` - (Optional) Map of tags, each pair of which must exactly match a pair on the desired instances.
+
+### filter Configuration block
+
+The `filter` configuration block supports the following arguments:
+
+* `name` - (Required) Name of the filter field. Valid values can be found in the [RDS DescribeDBClusters API Reference](https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeDBClusters.html) or [RDS DescribeDBInstances API Reference](https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeDBInstances.html).
+* `values` - (Required) Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `instance_arns` - ARNs of the matched RDS instances.
+* `instance_identifiers` - Identifiers of the matched RDS instances.
+
+<!-- cache-key: cdktf-0.18.0 input-759327832e7c9698cbc6e9a3c77063f37e9ca19af1429332b64a60ca9d471f64 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/db_proxy.html.markdown b/website/docs/cdktf/python/d/db_proxy.html.markdown
new file mode 100644
index 00000000000..228e56b9638
--- /dev/null
+++ b/website/docs/cdktf/python/d/db_proxy.html.markdown
@@ -0,0 +1,56 @@
+---
+subcategory: "RDS (Relational Database)"
+layout: "aws"
+page_title: "AWS: aws_db_proxy"
+description: |-
+  Get information on a DB Proxy.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_db_proxy
+
+Use this data source to get information about a DB Proxy.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_db_proxy import DataAwsDbProxy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsDbProxy(self, "proxy",
+            name="my-test-db-proxy"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name of the DB proxy.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the DB Proxy.
+* `auth` - Configuration(s) with authorization mechanisms to connect to the associated instance or cluster.
+* `debug_logging` - Whether the proxy includes detailed information about SQL statements in its logs.
+* `endpoint` - Endpoint that you can use to connect to the DB proxy.
+* `engine_family` - Kinds of databases that the proxy can connect to.
+* `idle_client_timeout` - Number of seconds a connection to the proxy can have no activity before the proxy drops the client connection.
+* `require_tls` - Whether Transport Layer Security (TLS) encryption is required for connections to the proxy.
+* `role_arn` - ARN for the IAM role that the proxy uses to access Amazon Secrets Manager.
+* `vpc_id` - Provides the VPC ID of the DB proxy.
+* `vpc_security_group_ids` - Provides a list of VPC security groups that the proxy belongs to.
+* `vpc_subnet_ids` - EC2 subnet IDs for the proxy.
+
+<!-- cache-key: cdktf-0.18.0 input-40613dad61f863b46258986380665de6148f37458b6c3dc04b218f3d733ebd72 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/db_snapshot.html.markdown b/website/docs/cdktf/python/d/db_snapshot.html.markdown
new file mode 100644
index 00000000000..ff4b5362e54
--- /dev/null
+++ b/website/docs/cdktf/python/d/db_snapshot.html.markdown
@@ -0,0 +1,102 @@
+---
+subcategory: "RDS (Relational Database)"
+layout: "aws"
+page_title: "AWS: aws_db_snapshot"
+description: |-
+  Get information on a DB Snapshot.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_db_snapshot
+
+Use this data source to get information about a DB Snapshot for use when provisioning DB instances
+
+~> **NOTE:** This data source does not apply to snapshots created on Aurora DB clusters.
+See the [`aws_db_cluster_snapshot` data source](/docs/providers/aws/d/db_cluster_snapshot.html) for DB Cluster snapshots.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from cdktf import TerraformResourceLifecycle
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_db_snapshot import DataAwsDbSnapshot
+from imports.aws.db_instance import DbInstance
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        prod = DbInstance(self, "prod",
+            allocated_storage=10,
+            db_name="mydb",
+            db_subnet_group_name="my_database_subnet_group",
+            engine="mysql",
+            engine_version="5.6.17",
+            instance_class="db.t2.micro",
+            parameter_group_name="default.mysql5.6",
+            password="bar",
+            username="foo"
+        )
+        latest_prod_snapshot = DataAwsDbSnapshot(self, "latest_prod_snapshot",
+            db_instance_identifier=prod.identifier,
+            most_recent=True
+        )
+        DbInstance(self, "dev",
+            db_name="mydbdev",
+            instance_class="db.t2.micro",
+            lifecycle=TerraformResourceLifecycle(
+                ignore_changes=[snapshot_identifier]
+            ),
+            snapshot_identifier=Token.as_string(latest_prod_snapshot.id)
+        )
+```
+
+## Argument Reference
+
+~> **NOTE:** One of either `db_instance_identifier` or `db_snapshot_identifier` is required.
+
+This argument supports the following arguments:
+
+* `most_recent` - (Optional) If more than one result is returned, use the most
+recent Snapshot.
+* `db_instance_identifier` - (Optional) Returns the list of snapshots created by the specific db_instance
+* `db_snapshot_identifier` - (Optional) Returns information on a specific snapshot_id.
+* `snapshot_type` - (Optional) Type of snapshots to be returned. If you don't specify a SnapshotType
+value, then both automated and manual snapshots are returned. Shared and public DB snapshots are not
+included in the returned results by default. Possible values are, `automated`, `manual`, `shared`, `public` and `awsbackup`.
+* `include_shared` - (Optional) Set this value to true to include shared manual DB snapshots from other
+AWS accounts that this AWS account has been given permission to copy or restore, otherwise set this value to false.
+The default is `false`.
+* `include_public` - (Optional) Set this value to true to include manual DB snapshots that are public and can be
+copied or restored by any AWS account, otherwise set this value to false. The default is `false`.
+`tags` - (Optional) Mapping of tags, each pair of which must exactly match
+  a pair on the desired DB snapshot.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - Snapshot ID.
+* `allocated_storage` - Allocated storage size in gigabytes (GB).
+* `availability_zone` - Name of the Availability Zone the DB instance was located in at the time of the DB snapshot.
+* `db_snapshot_arn` - ARN for the DB snapshot.
+* `encrypted` - Whether the DB snapshot is encrypted.
+* `engine` - Name of the database engine.
+* `engine_version` - Version of the database engine.
+* `iops` - Provisioned IOPS (I/O operations per second) value of the DB instance at the time of the snapshot.
+* `kms_key_id` - ARN for the KMS encryption key.
+* `license_model` - License model information for the restored DB instance.
+* `option_group_name` - Provides the option group name for the DB snapshot.
+* `source_db_snapshot_identifier` - DB snapshot ARN that the DB snapshot was copied from. It only has value in case of cross customer or cross region copy.
+* `source_region` - Region that the DB snapshot was created in or copied from.
+* `status` - Status of this DB snapshot.
+* `storage_type` - Storage type associated with DB snapshot.
+* `vpc_id` - ID of the VPC associated with the DB snapshot.
+* `snapshot_create_time` - Provides the time when the snapshot was taken, in Universal Coordinated Time (UTC).
+
+<!-- cache-key: cdktf-0.18.0 input-453c07311432431ff619a675fedc77cdb7b11651f38957e4c10480c9e5d7bb31 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/db_subnet_group.html.markdown b/website/docs/cdktf/python/d/db_subnet_group.html.markdown
new file mode 100644
index 00000000000..715bb194597
--- /dev/null
+++ b/website/docs/cdktf/python/d/db_subnet_group.html.markdown
@@ -0,0 +1,51 @@
+---
+subcategory: "RDS (Relational Database)"
+layout: "aws"
+page_title: "AWS: aws_db_subnet_group"
+description: |-
+  Get information on an RDS Database Subnet Group.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_db_subnet_group
+
+Use this data source to get information about an RDS subnet group.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_db_subnet_group import DataAwsDbSubnetGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsDbSubnetGroup(self, "database",
+            name="my-test-database-subnet-group"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name of the RDS database subnet group.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN for the DB subnet group.
+* `description` - Provides the description of the DB subnet group.
+* `status` - Provides the status of the DB subnet group.
+* `subnet_ids` - Contains a list of subnet identifiers.
+* `supported_network_types` - The network type of the DB subnet group.
+* `vpc_id` - Provides the VPC ID of the DB subnet group.
+
+<!-- cache-key: cdktf-0.18.0 input-c8c709e17391d65123c921a8b10fb4fd4c29d0c36a2dcc845c526ef3b4b3fda7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/default_tags.html.markdown b/website/docs/cdktf/python/d/default_tags.html.markdown
new file mode 100644
index 00000000000..021461b3f74
--- /dev/null
+++ b/website/docs/cdktf/python/d/default_tags.html.markdown
@@ -0,0 +1,96 @@
+---
+subcategory: "Meta Data Sources"
+layout: "aws"
+page_title: "AWS: aws_default_tags"
+description: |-
+  Access the default tags configured on the provider.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_default_tags
+
+Use this data source to get the default tags configured on the provider.
+
+With this data source, you can apply default tags to resources not _directly_ managed by a Terraform resource, such as the instances underneath an Auto Scaling group or the volumes created for an EC2 instance.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_default_tags import DataAwsDefaultTags
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsDefaultTags(self, "example")
+```
+
+### Dynamically Apply Default Tags to Auto Scaling Group
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformIterator, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.autoscaling_group import AutoscalingGroup
+from imports.aws.data_aws_default_tags import DataAwsDefaultTags
+from imports.aws.provider import AwsProvider
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, maxSize, minSize):
+        super().__init__(scope, name)
+        AwsProvider(self, "aws",
+            default_tags=[AwsProviderDefaultTags(
+                tags={
+                    "Environment": "Test",
+                    "Name": "Provider Tag"
+                }
+            )
+            ]
+        )
+        example = DataAwsDefaultTags(self, "example")
+        # In most cases loops should be handled in the programming language context and
+        #     not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+        #     you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+        #     you need to keep this like it is.
+        example_dynamic_iterator0 = TerraformIterator.from_list(
+            Token.as_any(example.tags))
+        aws_autoscaling_group_example = AutoscalingGroup(self, "example_2",
+            tag=example_dynamic_iterator0.dynamic({
+                "key": example_dynamic_iterator0.key,
+                "propagate_at_launch": True,
+                "value": example_dynamic_iterator0.value
+            }),
+            max_size=max_size,
+            min_size=min_size
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_autoscaling_group_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This data source has no arguments.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `tags` - Blocks of default tags set on the provider. See details below.
+
+### tags
+
+* `key` - Key name of the tag (i.e., `tags.#.key`).
+* `value` - Value of the tag (i.e., `tags.#.value`).
+
+<!-- cache-key: cdktf-0.18.0 input-4241b507ba8cc2f145c5ca347d447ee201ff9625e2d883dc7fc4ea765952c336 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/default_tags.markdown b/website/docs/cdktf/python/d/default_tags.markdown
new file mode 100644
index 00000000000..021461b3f74
--- /dev/null
+++ b/website/docs/cdktf/python/d/default_tags.markdown
@@ -0,0 +1,96 @@
+---
+subcategory: "Meta Data Sources"
+layout: "aws"
+page_title: "AWS: aws_default_tags"
+description: |-
+  Access the default tags configured on the provider.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_default_tags
+
+Use this data source to get the default tags configured on the provider.
+
+With this data source, you can apply default tags to resources not _directly_ managed by a Terraform resource, such as the instances underneath an Auto Scaling group or the volumes created for an EC2 instance.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_default_tags import DataAwsDefaultTags
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsDefaultTags(self, "example")
+```
+
+### Dynamically Apply Default Tags to Auto Scaling Group
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformIterator, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.autoscaling_group import AutoscalingGroup
+from imports.aws.data_aws_default_tags import DataAwsDefaultTags
+from imports.aws.provider import AwsProvider
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, maxSize, minSize):
+        super().__init__(scope, name)
+        AwsProvider(self, "aws",
+            default_tags=[AwsProviderDefaultTags(
+                tags={
+                    "Environment": "Test",
+                    "Name": "Provider Tag"
+                }
+            )
+            ]
+        )
+        example = DataAwsDefaultTags(self, "example")
+        # In most cases loops should be handled in the programming language context and
+        #     not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+        #     you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+        #     you need to keep this like it is.
+        example_dynamic_iterator0 = TerraformIterator.from_list(
+            Token.as_any(example.tags))
+        aws_autoscaling_group_example = AutoscalingGroup(self, "example_2",
+            tag=example_dynamic_iterator0.dynamic({
+                "key": example_dynamic_iterator0.key,
+                "propagate_at_launch": True,
+                "value": example_dynamic_iterator0.value
+            }),
+            max_size=max_size,
+            min_size=min_size
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_autoscaling_group_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This data source has no arguments.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `tags` - Blocks of default tags set on the provider. See details below.
+
+### tags
+
+* `key` - Key name of the tag (i.e., `tags.#.key`).
+* `value` - Value of the tag (i.e., `tags.#.value`).
+
+<!-- cache-key: cdktf-0.18.0 input-4241b507ba8cc2f145c5ca347d447ee201ff9625e2d883dc7fc4ea765952c336 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/directory_service_directory.html.markdown b/website/docs/cdktf/python/d/directory_service_directory.html.markdown
new file mode 100644
index 00000000000..bfde575bbf3
--- /dev/null
+++ b/website/docs/cdktf/python/d/directory_service_directory.html.markdown
@@ -0,0 +1,79 @@
+---
+subcategory: "Directory Service"
+layout: "aws"
+page_title: "AWS: aws_directory_service_directory"
+description: |-
+  AWS Directory Service Directory
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_directory_service_directory
+
+Get attributes of AWS Directory Service directory (SimpleAD, Managed AD, AD Connector). It's especially useful to refer AWS Managed AD or on-premise AD in AD Connector configuration.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_directory_service_directory import DataAwsDirectoryServiceDirectory
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsDirectoryServiceDirectory(self, "example",
+            directory_id=main.id
+        )
+```
+
+## Argument Reference
+
+* `directory_id` - (Required) ID of the directory.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `type` - Directory type (`SimpleAD`, `ADConnector` or `MicrosoftAD`).
+* `edition` - (for `MicrosoftAD`) Microsoft AD edition (`Standard` or `Enterprise`).
+* `name` - Fully qualified name for the directory/connector.
+* `password` - Password for the directory administrator or connector user.
+* `size` - (for `SimpleAD` and `ADConnector`) Size of the directory/connector (`Small` or `Large`).
+* `alias` - Alias for the directory/connector, such as `d-991708b282.awsapps.com`.
+* `description` - Textual description for the directory/connector.
+* `short_name` - Short name of the directory/connector, such as `CORP`.
+* `enable_sso` - Directory/connector single-sign on status.
+* `access_url` - Access URL for the directory/connector, such as http://alias.awsapps.com.
+* `dns_ip_addresses` - List of IP addresses of the DNS servers for the directory/connector.
+* `security_group_id` - ID of the security group created by the directory/connector.
+* `tags` – A map of tags assigned to the directory/connector.
+
+ `vpc_settings` (for `SimpleAD` and `MicrosoftAD`) is also exported with the following attributes:
+
+* `subnet_ids` - Identifiers of the subnets for the directory servers (2 subnets in 2 different AZs).
+* `vpc_id` - ID of the VPC that the directory is in.
+
+`connect_settings` (for `ADConnector`) is also exported with the following attributes:
+
+* `connect_ips` - IP addresses of the AD Connector servers.
+* `customer_username` - Username corresponding to the password provided.
+* `customer_dns_ips` - DNS IP addresses of the domain to connect to.
+* `subnet_ids` - Identifiers of the subnets for the connector servers (2 subnets in 2 different AZs).
+* `vpc_id` - ID of the VPC that the connector is in.
+
+`radius_settings` is also exported with the following attributes:
+
+* `authentication_protocol` - The protocol specified for your RADIUS endpoints.
+* `display_label` - Display label.
+* `radius_port` - Port that your RADIUS server is using for communications.
+* `radius_retries` - Maximum number of times that communication with the RADIUS server is attempted.
+* `radius_servers` - Set of strings that contains the fully qualified domain name (FQDN) or IP addresses of the RADIUS server endpoints, or the FQDN or IP addresses of your RADIUS server load balancer.
+* `radius_timeout` - Amount of time, in seconds, to wait for the RADIUS server to respond.
+* `use_same_username` - Not currently used.
+
+<!-- cache-key: cdktf-0.18.0 input-a0542c4af1900563814b75f11b6b9079e80d58db377a8603ef5e97154a0bd43f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/dms_certificate.html.markdown b/website/docs/cdktf/python/d/dms_certificate.html.markdown
new file mode 100644
index 00000000000..1c006036c89
--- /dev/null
+++ b/website/docs/cdktf/python/d/dms_certificate.html.markdown
@@ -0,0 +1,56 @@
+---
+subcategory: "DMS (Database Migration)"
+layout: "aws"
+page_title: "AWS: aws_dms_certificate"
+description: |-
+  Terraform data source for managing an AWS DMS (Database Migration) Certificate.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_dms_certificate
+
+Terraform data source for managing an AWS DMS (Database Migration) Certificate.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_dms_certificate import DataAwsDmsCertificate
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsDmsCertificate(self, "example",
+            certificate_id=test.certificate_id
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `certificate_id` - (Required) A customer-assigned name for the certificate. Identifiers must begin with a letter and must contain only ASCII letters, digits, and hyphens. They can't end with a hyphen or contain two consecutive hyphens.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `certificate_creation_date` - The date that the certificate was created.
+* `certificate_pem` - The contents of a .pem file, which contains an X.509 certificate.
+* `certificate_owner` - The owner of the certificate.
+* `certificate_arn` - The Amazon Resource Name (ARN) for the certificate.
+* `certificate_wallet` - The owner of the certificate.
+* `key_length` - The key length of the cryptographic algorithm being used.
+* `signing_algorithm` - The algorithm for the certificate.
+* `valid_from_date` - The beginning date that the certificate is valid.
+* `valid_to_date` - The final date that the certificate is valid.
+
+<!-- cache-key: cdktf-0.18.0 input-8c90e07fbf9734b9fd8c20ee7cebf074bf4b7702ec8ddca26d7eea974d6a74a0 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/dms_endpoint.html.markdown b/website/docs/cdktf/python/d/dms_endpoint.html.markdown
new file mode 100644
index 00000000000..ed3d44c89f0
--- /dev/null
+++ b/website/docs/cdktf/python/d/dms_endpoint.html.markdown
@@ -0,0 +1,46 @@
+---
+subcategory: "DMS (Database Migration)"
+layout: "aws"
+page_title: "AWS: aws_dms_endpoint"
+description: |-
+  Terraform data source for managing an AWS DMS (Database Migration) Endpoint.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_dms_endpoint
+
+Terraform data source for managing an AWS DMS (Database Migration) Endpoint.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_dms_endpoint import DataAwsDmsEndpoint
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsDmsEndpoint(self, "test",
+            endpoint_id="test_id"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `endpoint_id` - (Required) Database endpoint identifier. Identifiers must contain from 1 to 255 alphanumeric characters or hyphens, begin with a letter, contain only ASCII letters, digits, and hyphens, not end with a hyphen, and not contain two consecutive hyphens.
+
+## Attribute Reference
+
+See the [`aws_dms_endpoint` resource](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/dms_endpoint) for details on the returned attributes - they are identical.
+
+<!-- cache-key: cdktf-0.18.0 input-998a5893daed445684f6f9e1f26e5c03b27e3ac275e8cdebccf3ef05a470a1a7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/dms_replication_instance.html.markdown b/website/docs/cdktf/python/d/dms_replication_instance.html.markdown
new file mode 100644
index 00000000000..2ea4fce8834
--- /dev/null
+++ b/website/docs/cdktf/python/d/dms_replication_instance.html.markdown
@@ -0,0 +1,60 @@
+---
+subcategory: "DMS (Database Migration)"
+layout: "aws"
+page_title: "AWS: aws_dms_replication_instance"
+description: |-
+  Terraform data source for managing an AWS DMS (Database Migration) Replication Instance.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_dms_replication_instance
+
+Terraform data source for managing an AWS DMS (Database Migration) Replication Instance.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_dms_replication_instance import DataAwsDmsReplicationInstance
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsDmsReplicationInstance(self, "test",
+            replication_instance_id=Token.as_string(aws_dms_replication_instance_test.replication_instance_id)
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `replication_instance_id` - (Required) The replication instance identifier.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `allocated_storage` - The amount of storage (in gigabytes) to be initially allocated for the replication instance.
+* `auto_minor_version_upgrade` - Indicates that minor engine upgrades will be applied automatically to the replication instance during the maintenance window.
+* `availability_zone` - The EC2 Availability Zone that the replication instance will be created in.
+* `engine_version` - The engine version number of the replication instance.
+* `kms_key_arn` - The Amazon Resource Name (ARN) for the KMS key used to encrypt the connection parameters.
+* `multi_az` - Specifies if the replication instance is a multi-az deployment.
+* `network_type` - The type of IP address protocol used by the replication instance.
+* `preferred_maintenance_window` - The weekly time range during which system maintenance can occur, in Universal Coordinated Time (UTC).
+* `publicly_accessible` - Specifies the accessibility options for the replication instance. A value of true represents an instance with a public IP address. A value of false represents an instance with a private IP address.
+* `replication_instance_arn` - The Amazon Resource Name (ARN) of the replication instance.
+* `replication_instance_class` - The compute and memory capacity of the replication instance as specified by the replication instance class. See [AWS DMS User Guide](https://docs.aws.amazon.com/dms/latest/userguide/CHAP_ReplicationInstance.Types.html) for information on instance classes.
+* `replication_instance_private_ips` - A list of the private IP addresses of the replication instance.
+* `replication_instance_public_ips` - A list of the public IP addresses of the replication instance.
+* `replication_subnet_group_id` - A subnet group to associate with the replication instance.
+* `vpc_security_group_ids` - A set of VPC security group IDs that are used with the replication instance.
+
+<!-- cache-key: cdktf-0.18.0 input-5aba05f196697c06b58151a68778040ed73677e99368add1ba52d699e7516fbc -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/dms_replication_subnet_group.html.markdown b/website/docs/cdktf/python/d/dms_replication_subnet_group.html.markdown
new file mode 100644
index 00000000000..c075a211d6a
--- /dev/null
+++ b/website/docs/cdktf/python/d/dms_replication_subnet_group.html.markdown
@@ -0,0 +1,50 @@
+---
+subcategory: "DMS (Database Migration)"
+layout: "aws"
+page_title: "AWS: aws_dms_replication_subnet_group"
+description: |-
+  Terraform data source for managing an AWS DMS (Database Migration) Replication Subnet Group.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_dms_replication_subnet_group
+
+Terraform data source for managing an AWS DMS (Database Migration) Replication Subnet Group.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_dms_replication_subnet_group import DataAwsDmsReplicationSubnetGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsDmsReplicationSubnetGroup(self, "test",
+            replication_subnet_group_id=Token.as_string(aws_dms_replication_subnet_group_test.replication_subnet_group_id)
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `replication_subnet_group_id` - (Required) Name for the replication subnet group. This value is stored as a lowercase string. It must contain no more than 255 alphanumeric characters, periods, spaces, underscores, or hyphens and cannot be `default`.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `replication_subnet_group_description` - Description for the subnet group.
+* `subnet_ids` - List of at least 2 EC2 subnet IDs for the subnet group. The subnets must cover at least 2 availability zones.
+* `vpc_id` - The ID of the VPC the subnet group is in.
+
+<!-- cache-key: cdktf-0.18.0 input-5a351e6983e13ca8ab53ae0b1934dd0149e708010440ee07aeef9d923642a6da -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/dms_replication_task.html.markdown b/website/docs/cdktf/python/d/dms_replication_task.html.markdown
new file mode 100644
index 00000000000..0186b731053
--- /dev/null
+++ b/website/docs/cdktf/python/d/dms_replication_task.html.markdown
@@ -0,0 +1,63 @@
+---
+subcategory: "DMS (Database Migration)"
+layout: "aws"
+page_title: "AWS: aws_dms_replication_task"
+description: |-
+  Terraform data source for managing an AWS DMS (Database Migration) Replication Task.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_dms_replication_task
+
+Terraform data source for managing an AWS DMS (Database Migration) Replication Task.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_dms_replication_task import DataAwsDmsReplicationTask
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsDmsReplicationTask(self, "test",
+            replication_task_id=Token.as_string(aws_dms_replication_task_test.replication_task_id)
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `replication_task_id` - (Required) The replication task identifier.
+
+    - Must contain from 1 to 255 alphanumeric characters or hyphens.
+    - First character must be a letter.
+    - Cannot end with a hyphen.
+    - Cannot contain two consecutive hyphens.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `cdc_start_position` - (Conflicts with `cdc_start_time`) Indicates when you want a change data capture (CDC) operation to start. The value can be in date, checkpoint, or LSN/SCN format depending on the source engine. For more information, see [Determining a CDC native start point](https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Task.CDC.html#CHAP_Task.CDC.StartPoint.Native).
+* `cdc_start_time` - (Conflicts with `cdc_start_position`) The Unix timestamp integer for the start of the Change Data Capture (CDC) operation.
+* `migration_type` - The migration type. Can be one of `full-load | cdc | full-load-and-cdc`.
+* `replication_instance_arn` - The Amazon Resource Name (ARN) of the replication instance.
+* `replication_task_settings` - An escaped JSON string that contains the task settings. For a complete list of task settings, see [Task Settings for AWS Database Migration Service Tasks](http://docs.aws.amazon.com/dms/latest/userguide/CHAP_Tasks.CustomizingTasks.TaskSettings.html).
+* `source_endpoint_arn` - The Amazon Resource Name (ARN) string that uniquely identifies the source endpoint.
+* `start_replication_task` -  Whether to run or stop the replication task.
+* `status` - Replication Task status.
+* `table_mappings` - An escaped JSON string that contains the table mappings. For information on table mapping see [Using Table Mapping with an AWS Database Migration Service Task to Select and Filter Data](http://docs.aws.amazon.com/dms/latest/userguide/CHAP_Tasks.CustomizingTasks.TableMapping.html)
+* `target_endpoint_arn` - The Amazon Resource Name (ARN) string that uniquely identifies the target endpoint.
+* `replication_task_arn` - The Amazon Resource Name (ARN) for the replication task.
+
+<!-- cache-key: cdktf-0.18.0 input-fa1a1915aa39f86d68f0c890bf2884e184e4111a8bb8bbe6b38fd7c6c992b063 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/docdb_engine_version.html.markdown b/website/docs/cdktf/python/d/docdb_engine_version.html.markdown
new file mode 100644
index 00000000000..9d2ff48d43f
--- /dev/null
+++ b/website/docs/cdktf/python/d/docdb_engine_version.html.markdown
@@ -0,0 +1,53 @@
+---
+subcategory: "DocumentDB"
+layout: "aws"
+page_title: "AWS: aws_docdb_engine_version"
+description: |-
+  Information about a DocumentDB engine version.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_docdb_engine_version
+
+Information about a DocumentDB engine version.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_docdb_engine_version import DataAwsDocdbEngineVersion
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsDocdbEngineVersion(self, "test",
+            version="3.6.0"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `engine` - (Optional) DB engine. (Default: `docdb`)
+* `parameter_group_family` - (Optional) Name of a specific DB parameter group family. An example parameter group family is `docdb3.6`.
+* `preferred_versions` - (Optional) Ordered list of preferred engine versions. The first match in this list will be returned. If no preferred matches are found and the original search returned more than one result, an error is returned. If both the `version` and `preferred_versions` arguments are not configured, the data source will return the default version for the engine.
+* `version` - (Optional) Version of the DB engine. For example, `3.6.0`. If `version` and `preferred_versions` are not set, the data source will provide information for the AWS-defined default version. If both the `version` and `preferred_versions` arguments are not configured, the data source will return the default version for the engine.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `engine_description` - Description of the database engine.
+* `exportable_log_types` - Set of log types that the database engine has available for export to CloudWatch Logs.
+* `supports_log_exports_to_cloudwatch` - Indicates whether the engine version supports exporting the log types specified by `exportable_log_types` to CloudWatch Logs.
+* `valid_upgrade_targets` - A set of engine versions that this database engine version can be upgraded to.
+* `version_description` - Description of the database engine version.
+
+<!-- cache-key: cdktf-0.18.0 input-551f8c39da9e4704102d050a7505855d613f3511c6df64ebd9c88d0d5533b8f5 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/docdb_engine_version.markdown b/website/docs/cdktf/python/d/docdb_engine_version.markdown
new file mode 100644
index 00000000000..9d2ff48d43f
--- /dev/null
+++ b/website/docs/cdktf/python/d/docdb_engine_version.markdown
@@ -0,0 +1,53 @@
+---
+subcategory: "DocumentDB"
+layout: "aws"
+page_title: "AWS: aws_docdb_engine_version"
+description: |-
+  Information about a DocumentDB engine version.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_docdb_engine_version
+
+Information about a DocumentDB engine version.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_docdb_engine_version import DataAwsDocdbEngineVersion
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsDocdbEngineVersion(self, "test",
+            version="3.6.0"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `engine` - (Optional) DB engine. (Default: `docdb`)
+* `parameter_group_family` - (Optional) Name of a specific DB parameter group family. An example parameter group family is `docdb3.6`.
+* `preferred_versions` - (Optional) Ordered list of preferred engine versions. The first match in this list will be returned. If no preferred matches are found and the original search returned more than one result, an error is returned. If both the `version` and `preferred_versions` arguments are not configured, the data source will return the default version for the engine.
+* `version` - (Optional) Version of the DB engine. For example, `3.6.0`. If `version` and `preferred_versions` are not set, the data source will provide information for the AWS-defined default version. If both the `version` and `preferred_versions` arguments are not configured, the data source will return the default version for the engine.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `engine_description` - Description of the database engine.
+* `exportable_log_types` - Set of log types that the database engine has available for export to CloudWatch Logs.
+* `supports_log_exports_to_cloudwatch` - Indicates whether the engine version supports exporting the log types specified by `exportable_log_types` to CloudWatch Logs.
+* `valid_upgrade_targets` - A set of engine versions that this database engine version can be upgraded to.
+* `version_description` - Description of the database engine version.
+
+<!-- cache-key: cdktf-0.18.0 input-551f8c39da9e4704102d050a7505855d613f3511c6df64ebd9c88d0d5533b8f5 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/docdb_orderable_db_instance.html.markdown b/website/docs/cdktf/python/d/docdb_orderable_db_instance.html.markdown
new file mode 100644
index 00000000000..b097fb6ea5a
--- /dev/null
+++ b/website/docs/cdktf/python/d/docdb_orderable_db_instance.html.markdown
@@ -0,0 +1,54 @@
+---
+subcategory: "DocumentDB"
+layout: "aws"
+page_title: "AWS: aws_docdb_orderable_db_instance"
+description: |-
+  Information about DocumentDB orderable DB instances.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_docdb_orderable_db_instance
+
+Information about DocumentDB orderable DB instances.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_docdb_orderable_db_instance import DataAwsDocdbOrderableDbInstance
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsDocdbOrderableDbInstance(self, "test",
+            engine="docdb",
+            engine_version="3.6.0",
+            license_model="na",
+            preferred_instance_classes=["db.r5.large", "db.r4.large", "db.t3.medium"]
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `engine` - (Optional) DB engine. Default: `docdb`
+* `engine_version` - (Optional) Version of the DB engine.
+* `instance_class` - (Optional) DB instance class. Examples of classes are `db.r5.12xlarge`, `db.r5.24xlarge`, `db.r5.2xlarge`, `db.r5.4xlarge`, `db.r5.large`, `db.r5.xlarge`, and `db.t3.medium`. (Conflicts with `preferred_instance_classes`.)
+* `license_model` - (Optional) License model. Default: `na`
+* `preferred_instance_classes` - (Optional) Ordered list of preferred DocumentDB DB instance classes. The first match in this list will be returned. If no preferred matches are found and the original search returned more than one result, an error is returned. (Conflicts with `instance_class`.)
+* `vpc` - (Optional) Enable to show only VPC.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `availability_zones` - Availability zones where the instance is available.
+
+<!-- cache-key: cdktf-0.18.0 input-e0d401d073f27bb9d79b27ff7639257efd1b7f3f54817d94de7fdf271020db6f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/docdb_orderable_db_instance.markdown b/website/docs/cdktf/python/d/docdb_orderable_db_instance.markdown
new file mode 100644
index 00000000000..b097fb6ea5a
--- /dev/null
+++ b/website/docs/cdktf/python/d/docdb_orderable_db_instance.markdown
@@ -0,0 +1,54 @@
+---
+subcategory: "DocumentDB"
+layout: "aws"
+page_title: "AWS: aws_docdb_orderable_db_instance"
+description: |-
+  Information about DocumentDB orderable DB instances.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_docdb_orderable_db_instance
+
+Information about DocumentDB orderable DB instances.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_docdb_orderable_db_instance import DataAwsDocdbOrderableDbInstance
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsDocdbOrderableDbInstance(self, "test",
+            engine="docdb",
+            engine_version="3.6.0",
+            license_model="na",
+            preferred_instance_classes=["db.r5.large", "db.r4.large", "db.t3.medium"]
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `engine` - (Optional) DB engine. Default: `docdb`
+* `engine_version` - (Optional) Version of the DB engine.
+* `instance_class` - (Optional) DB instance class. Examples of classes are `db.r5.12xlarge`, `db.r5.24xlarge`, `db.r5.2xlarge`, `db.r5.4xlarge`, `db.r5.large`, `db.r5.xlarge`, and `db.t3.medium`. (Conflicts with `preferred_instance_classes`.)
+* `license_model` - (Optional) License model. Default: `na`
+* `preferred_instance_classes` - (Optional) Ordered list of preferred DocumentDB DB instance classes. The first match in this list will be returned. If no preferred matches are found and the original search returned more than one result, an error is returned. (Conflicts with `instance_class`.)
+* `vpc` - (Optional) Enable to show only VPC.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `availability_zones` - Availability zones where the instance is available.
+
+<!-- cache-key: cdktf-0.18.0 input-e0d401d073f27bb9d79b27ff7639257efd1b7f3f54817d94de7fdf271020db6f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/dx_connection.html.markdown b/website/docs/cdktf/python/d/dx_connection.html.markdown
new file mode 100644
index 00000000000..a54f2729830
--- /dev/null
+++ b/website/docs/cdktf/python/d/dx_connection.html.markdown
@@ -0,0 +1,53 @@
+---
+subcategory: "Direct Connect"
+layout: "aws"
+page_title: "AWS: aws_dx_connection"
+description: |-
+  Retrieve information about a Direct Connect Connection.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_dx_connection
+
+Retrieve information about a Direct Connect Connection.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_dx_connection import DataAwsDxConnection
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsDxConnection(self, "example",
+            name="tf-dx-connection"
+        )
+```
+
+## Argument Reference
+
+* `name` - (Required) Name of the connection to retrieve.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the connection.
+* `aws_device` - Direct Connect endpoint on which the physical connection terminates.
+* `bandwidth` - Bandwidth of the connection.
+* `id` - ID of the connection.
+* `location` - AWS Direct Connect location where the connection is located.
+* `owner_account_id` - ID of the AWS account that owns the connection.
+* `partner_name` - The name of the AWS Direct Connect service provider associated with the connection.
+* `provider_name` - Name of the service provider associated with the connection.
+* `tags` - Map of tags for the resource.
+* `vlan_id` - The VLAN ID.
+
+<!-- cache-key: cdktf-0.18.0 input-192e94cc169312d4fa902eb3bcc5d1de027e5be4fe92fdaf9fdbeefc124a32a8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/dx_gateway.html.markdown b/website/docs/cdktf/python/d/dx_gateway.html.markdown
new file mode 100644
index 00000000000..99858516892
--- /dev/null
+++ b/website/docs/cdktf/python/d/dx_gateway.html.markdown
@@ -0,0 +1,46 @@
+---
+subcategory: "Direct Connect"
+layout: "aws"
+page_title: "AWS: aws_dx_gateway"
+description: |-
+  Retrieve information about a Direct Connect Gateway
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_dx_gateway
+
+Retrieve information about a Direct Connect Gateway.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_dx_gateway import DataAwsDxGateway
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsDxGateway(self, "example",
+            name="example"
+        )
+```
+
+## Argument Reference
+
+* `name` - (Required) Name of the gateway to retrieve.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `amazon_side_asn` - ASN on the Amazon side of the connection.
+* `id` - ID of the gateway.
+* `owner_account_id` - AWS Account ID of the gateway.
+
+<!-- cache-key: cdktf-0.18.0 input-3127f300941d7e2a8378ebe59e0ac105a1d12fbec8c4b114a8a16614047676a0 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/dx_location.html.markdown b/website/docs/cdktf/python/d/dx_location.html.markdown
new file mode 100644
index 00000000000..55318cb0056
--- /dev/null
+++ b/website/docs/cdktf/python/d/dx_location.html.markdown
@@ -0,0 +1,50 @@
+---
+subcategory: "Direct Connect"
+layout: "aws"
+page_title: "AWS: aws_dx_location"
+description: |-
+  Retrieve information about a specific AWS Direct Connect location in the current AWS Region.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_dx_location
+
+Retrieve information about a specific AWS Direct Connect location in the current AWS Region.
+These are the locations that can be specified when configuring [`aws_dx_connection`](/docs/providers/aws/r/dx_connection.html) or [`aws_dx_lag`](/docs/providers/aws/r/dx_lag.html) resources.
+
+~> **Note:** This data source is different from the [`aws_dx_locations`](/docs/providers/aws/d/dx_locations.html) data source which retrieves information about all the AWS Direct Connect locations in the current AWS Region.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_dx_location import DataAwsDxLocation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsDxLocation(self, "example",
+            location_code="CS32A-24FL"
+        )
+```
+
+## Argument Reference
+
+* `location_code` - (Required) Code for the location to retrieve.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `available_macsec_port_speeds` - The available MAC Security (MACsec) port speeds for the location.
+* `available_port_speeds` - The available port speeds for the location.
+* `available_providers` - Names of the service providers for the location.
+* `location_name` - Name of the location. This includes the name of the colocation partner and the physical site of the building.
+
+<!-- cache-key: cdktf-0.18.0 input-d889468623dfe6cc7e6edbb487338f8e41ba42d426b71ce13bb577672f6b08e4 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/dx_locations.html.markdown b/website/docs/cdktf/python/d/dx_locations.html.markdown
new file mode 100644
index 00000000000..4dd9d3539ba
--- /dev/null
+++ b/website/docs/cdktf/python/d/dx_locations.html.markdown
@@ -0,0 +1,45 @@
+---
+subcategory: "Direct Connect"
+layout: "aws"
+page_title: "AWS: aws_dx_locations"
+description: |-
+  Retrieve information about the AWS Direct Connect locations in the current AWS Region.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_dx_locations
+
+Retrieve information about the AWS Direct Connect locations in the current AWS Region.
+These are the locations that can be specified when configuring [`aws_dx_connection`](/docs/providers/aws/r/dx_connection.html) or [`aws_dx_lag`](/docs/providers/aws/r/dx_lag.html) resources.
+
+~> **Note:** This data source is different from the [`aws_dx_location`](/docs/providers/aws/d/dx_location.html) data source which retrieves information about a specific AWS Direct Connect location in the current AWS Region.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_dx_locations import DataAwsDxLocations
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsDxLocations(self, "available")
+```
+
+## Argument Reference
+
+There are no arguments available for this data source.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `location_codes` - Code for the locations.
+
+<!-- cache-key: cdktf-0.18.0 input-edf9691bbd1000b72a448faca5fe847d9e9f887f6e0151e1dd14c6adec8f3ca6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/dx_router_configuration.html.markdown b/website/docs/cdktf/python/d/dx_router_configuration.html.markdown
new file mode 100644
index 00000000000..1c5d3775fab
--- /dev/null
+++ b/website/docs/cdktf/python/d/dx_router_configuration.html.markdown
@@ -0,0 +1,77 @@
+---
+subcategory: "Direct Connect"
+layout: "aws"
+page_title: "AWS: aws_dx_router_configuration"
+description: |-
+  Terraform data source for managing an AWS Direct Connect Router Configuration.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_dx_router_configuration
+
+Terraform data source for retrieving Router Configuration instructions for a given AWS Direct Connect Virtual Interface and Router Type.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_dx_router_configuration import DataAwsDxRouterConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsDxRouterConfiguration(self, "example",
+            router_type_identifier="CiscoSystemsInc-2900SeriesRouters-IOS124",
+            virtual_interface_id="dxvif-abcde123"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `virtual_interface_id` - (Required) ID of the Direct Connect Virtual Interface
+* `router_type_identifier` - (Required) ID of the Router Type. For example: `CiscoSystemsInc-2900SeriesRouters-IOS124`
+
+There is currently no AWS API to retrieve the full list of `router_type_identifier` values. Here is a list of known `RouterType` objects that can be used:
+
+```json
+{
+  "routerTypes": [
+    {"platform":"2900 Series Routers","routerTypeIdentifier":"CiscoSystemsInc-2900SeriesRouters-IOS124","software":"IOS 12.4+","vendor":"Cisco Systems, Inc.","xsltTemplateName":"customer-router-cisco-generic.xslt","xsltTemplateNameForMacSec":""},
+    {"platform":"3700 Series Routers","routerTypeIdentifier":"CiscoSystemsInc-3700SeriesRouters-IOS124","software":"IOS 12.4+","vendor":"Cisco Systems, Inc.","xsltTemplateName":"customer-router-cisco-generic.xslt","xsltTemplateNameForMacSec":""},
+    {"platform":"7200 Series Routers","routerTypeIdentifier":"CiscoSystemsInc-7200SeriesRouters-IOS124","software":"IOS 12.4+","vendor":"Cisco Systems, Inc.","xsltTemplateName":"customer-router-cisco-generic.xslt","xsltTemplateNameForMacSec":""},
+    {"platform":"Nexus 7000 Series Switches","routerTypeIdentifier":"CiscoSystemsInc-Nexus7000SeriesSwitches-NXOS51","software":"NX-OS 5.1+","vendor":"Cisco Systems, Inc.","xsltTemplateName":"customer-switch-cisco-nexus-generic.xslt","xsltTemplateNameForMacSec":""},
+    {"platform":"Nexus 9K+ Series Switches","routerTypeIdentifier":"CiscoSystemsInc-Nexus9KSeriesSwitches-NXOS93","software":"NX-OS 9.3+","vendor":"Cisco Systems, Inc.","xsltTemplateName":"customer-switch-cisco-nexus-generic.xslt","xsltTemplateNameForMacSec":"customer-switch-cisco-nexus-generic-macsec.xslt"},
+    {"platform":"M/MX Series Routers","routerTypeIdentifier":"JuniperNetworksInc-MMXSeriesRouters-JunOS95","software":"JunOS 9.5+","vendor":"Juniper Networks, Inc.","xsltTemplateName":"customer-router-juniper-generic.xslt","xsltTemplateNameForMacSec":"customer-router-juniper-generic-macsec.xslt"},
+    {"platform":"SRX Series Routers","routerTypeIdentifier":"JuniperNetworksInc-SRXSeriesRouters-JunOS95","software":"JunOS 9.5+","vendor":"Juniper Networks, Inc.","xsltTemplateName":"customer-router-juniper-generic.xslt","xsltTemplateNameForMacSec":""},
+    {"platform":"T Series Routers","routerTypeIdentifier":"JuniperNetworksInc-TSeriesRouters-JunOS95","software":"JunOS 9.5+","vendor":"Juniper Networks, Inc.","xsltTemplateName":"customer-router-juniper-generic.xslt","xsltTemplateNameForMacSec":""},
+    {"platform":"PA-3000+ and 5000+ series","routerTypeIdentifier":"PaloAltoNetworks-PA3000and5000series-PANOS803","software":"PAN-OS 8.0.3+","vendor":"Palo Alto Networks","xsltTemplateName":"customer-router-palo-alto-generic.xslt","xsltTemplateNameForMacSec":""}]
+}
+```
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `customer_router_config` - Instructions for configuring your router
+* `router` - Block of the router type details
+
+A `router` block supports the following attributes:
+
+* `platform` - Router platform
+* `router_type_identifier` - Router type identifier
+* `software` - Router operating system
+* `vendor` - Router vendor
+* `xslt_template_name` - Router XSLT Template Name
+* `xslt_template_name_for_mac` - Router XSLT Template Name for MacSec
+
+<!-- cache-key: cdktf-0.18.0 input-9678217d6fec10b383267202e6ceb5509d81e5095d37ada2c2523269c07135c5 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/dynamodb_table.html.markdown b/website/docs/cdktf/python/d/dynamodb_table.html.markdown
new file mode 100644
index 00000000000..e7c659824e5
--- /dev/null
+++ b/website/docs/cdktf/python/d/dynamodb_table.html.markdown
@@ -0,0 +1,45 @@
+---
+subcategory: "DynamoDB"
+layout: "aws"
+page_title: "AWS: aws_dynamodb_table"
+description: |-
+  Provides a DynamoDB table data source.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_dynamodb_table
+
+Provides information about a DynamoDB table.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_dynamodb_table import DataAwsDynamodbTable
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsDynamodbTable(self, "tableName",
+            name="tableName"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name of the DynamoDB table.
+
+## Attribute Reference
+
+See the [DynamoDB Table Resource](/docs/providers/aws/r/dynamodb_table.html) for details on the
+returned attributes - they are identical.
+
+<!-- cache-key: cdktf-0.18.0 input-1f59fb72cfbdb2e6f0ab733246fe01d5f9b99e7b551e1073e5c40c8c404bd9ef -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/dynamodb_table_item.html.markdown b/website/docs/cdktf/python/d/dynamodb_table_item.html.markdown
new file mode 100644
index 00000000000..2d6d850d987
--- /dev/null
+++ b/website/docs/cdktf/python/d/dynamodb_table_item.html.markdown
@@ -0,0 +1,62 @@
+---
+subcategory: "DynamoDB"
+layout: "aws"
+page_title: "AWS: aws_dynamodb_table_item"
+description: |-
+  Terraform data source for retrieving a value from an AWS DynamoDB table.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_dynamodb_table_item
+
+Terraform data source for retrieving a value from an AWS DynamoDB table.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_dynamodb_table_item import DataAwsDynamodbTableItem
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsDynamodbTableItem(self, "test",
+            depends_on=[example],
+            expression_attribute_names={
+                "#P": "Percentile"
+            },
+            key="{\n\t\"hashKey\": {\"S\": \"example\"}\n}\n\n",
+            projection_expression="#P",
+            table_name=Token.as_string(aws_dynamodb_table_example.name)
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `table_name` - (Required) The name of the table containing the requested item.
+* `key` - (Required) A map of attribute names to AttributeValue objects, representing the primary key of the item to retrieve.
+  For the primary key, you must provide all of the attributes. For example, with a simple primary key, you only need to provide a value for the partition key. For a composite primary key, you must provide values for both the partition key and the sort key.
+
+The following arguments are optional:
+
+* `expression_attribute_name` - (Optional) - One or more substitution tokens for attribute names in an expression. Use the `#` character in an expression to dereference an attribute name.
+* `projection_expression` - (Optional) A string that identifies one or more attributes to retrieve from the table. These attributes can include scalars, sets, or elements of a JSON document. The attributes in the expression must be separated by commas.
+If no attribute names are specified, then all attributes are returned. If any of the requested attributes are not found, they do not appear in the result.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `item` - JSON representation of a map of attribute names to [AttributeValue](https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_AttributeValue.html) objects, as specified by ProjectionExpression.
+
+<!-- cache-key: cdktf-0.18.0 input-15763bbf01ce37024fe77596ac5996501c9715c0941ce02a4eab1115436c2219 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/ebs_default_kms_key.html.markdown b/website/docs/cdktf/python/d/ebs_default_kms_key.html.markdown
new file mode 100644
index 00000000000..ef941dd124f
--- /dev/null
+++ b/website/docs/cdktf/python/d/ebs_default_kms_key.html.markdown
@@ -0,0 +1,51 @@
+---
+subcategory: "EBS (EC2)"
+layout: "aws"
+page_title: "AWS: aws_ebs_default_kms_key"
+description: |-
+  Provides metadata about the KMS key set for EBS default encryption
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_ebs_default_kms_key
+
+Use this data source to get the default EBS encryption KMS key in the current region.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_ebs_default_kms_key import DataAwsEbsDefaultKmsKey
+from imports.aws.ebs_volume import EbsVolume
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        current = DataAwsEbsDefaultKmsKey(self, "current")
+        EbsVolume(self, "example",
+            availability_zone="us-west-2a",
+            encrypted=True,
+            kms_key_id=Token.as_string(current.key_arn)
+        )
+```
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `key_arn` - ARN of the default KMS key uses to encrypt an EBS volume in this region when no key is specified in an API call that creates the volume and encryption by default is enabled.
+* `id` - Region of the default KMS Key.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `20m`)
+
+<!-- cache-key: cdktf-0.18.0 input-2ea61958e162ad0b2b3b242ab8cd3395fe46d2bce086890134212bd6f12284d6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/ebs_encryption_by_default.html.markdown b/website/docs/cdktf/python/d/ebs_encryption_by_default.html.markdown
new file mode 100644
index 00000000000..fcb1411fa0f
--- /dev/null
+++ b/website/docs/cdktf/python/d/ebs_encryption_by_default.html.markdown
@@ -0,0 +1,45 @@
+---
+subcategory: "EBS (EC2)"
+layout: "aws"
+page_title: "AWS: aws_ebs_encryption_by_default"
+description: |-
+  Checks whether default EBS encryption is enabled for your AWS account in the current AWS region.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_ebs_encryption_by_default
+
+Provides a way to check whether default EBS encryption is enabled for your AWS account in the current AWS region.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_ebs_encryption_by_default import DataAwsEbsEncryptionByDefault
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsEbsEncryptionByDefault(self, "current")
+```
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `enabled` - Whether or not default EBS encryption is enabled. Returns as `true` or `false`.
+* `id` - Region of default EBS encryption.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `20m`)
+
+<!-- cache-key: cdktf-0.18.0 input-2606f9f1f57c452981b17146b7983251b10e31c6aeb74dfd9e1ac4d8fab6d7ad -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/ebs_snapshot.html.markdown b/website/docs/cdktf/python/d/ebs_snapshot.html.markdown
new file mode 100644
index 00000000000..35db7ca5347
--- /dev/null
+++ b/website/docs/cdktf/python/d/ebs_snapshot.html.markdown
@@ -0,0 +1,87 @@
+---
+subcategory: "EBS (EC2)"
+layout: "aws"
+page_title: "AWS: aws_ebs_snapshot"
+description: |-
+  Get information on an EBS Snapshot.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_ebs_snapshot
+
+Use this data source to get information about an EBS Snapshot for use when provisioning EBS Volumes
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_ebs_snapshot import DataAwsEbsSnapshot
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsEbsSnapshot(self, "ebs_volume",
+            filter=[DataAwsEbsSnapshotFilter(
+                name="volume-size",
+                values=["40"]
+            ), DataAwsEbsSnapshotFilter(
+                name="tag:Name",
+                values=["Example"]
+            )
+            ],
+            most_recent=True,
+            owners=["self"]
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `most_recent` - (Optional) If more than one result is returned, use the most recent snapshot.
+
+* `owners` - (Optional) Returns the snapshots owned by the specified owner id. Multiple owners can be specified.
+
+* `snapshot_ids` - (Optional) Returns information on a specific snapshot_id.
+
+* `restorable_by_user_ids` - (Optional) One or more AWS accounts IDs that can create volumes from the snapshot.
+
+* `filter` - (Optional) One or more name/value pairs to filter off of. There are
+several valid keys, for a full reference, check out
+[describe-snapshots in the AWS CLI reference][1].
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the EBS Snapshot.
+* `id` - Snapshot ID (e.g., snap-59fcb34e).
+* `snapshot_id` - Snapshot ID (e.g., snap-59fcb34e).
+* `description` - Description for the snapshot
+* `owner_id` - AWS account ID of the EBS snapshot owner.
+* `owner_alias` - Value from an Amazon-maintained list (`amazon`, `aws-marketplace`, `microsoft`) of snapshot owners.
+* `volume_id` - Volume ID (e.g., vol-59fcb34e).
+* `encrypted` - Whether the snapshot is encrypted.
+* `volume_size` - Size of the drive in GiBs.
+* `kms_key_id` - ARN for the KMS encryption key.
+* `data_encryption_key_id` - The data encryption key identifier for the snapshot.
+* `state` - Snapshot state.
+* `storage_tier` - Storage tier in which the snapshot is stored.
+* `outpost_arn` - ARN of the Outpost on which the snapshot is stored.
+* `tags` - Map of tags for the resource.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `20m`)
+
+[1]: http://docs.aws.amazon.com/cli/latest/reference/ec2/describe-snapshots.html
+
+<!-- cache-key: cdktf-0.18.0 input-c8ad520ee1902fdd4beb1d909dcc090edcec79bd99fe9a2e9d973ce88eeefa44 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/ebs_snapshot_ids.html.markdown b/website/docs/cdktf/python/d/ebs_snapshot_ids.html.markdown
new file mode 100644
index 00000000000..affce3cc02e
--- /dev/null
+++ b/website/docs/cdktf/python/d/ebs_snapshot_ids.html.markdown
@@ -0,0 +1,70 @@
+---
+subcategory: "EBS (EC2)"
+layout: "aws"
+page_title: "AWS: aws_ebs_snapshot_ids"
+description: |-
+  Provides a list of EBS snapshot IDs.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_ebs_snapshot_ids
+
+Use this data source to get a list of EBS Snapshot IDs matching the specified
+criteria.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_ebs_snapshot_ids import DataAwsEbsSnapshotIds
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsEbsSnapshotIds(self, "ebs_volumes",
+            filter=[DataAwsEbsSnapshotIdsFilter(
+                name="volume-size",
+                values=["40"]
+            ), DataAwsEbsSnapshotIdsFilter(
+                name="tag:Name",
+                values=["Example"]
+            )
+            ],
+            owners=["self"]
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `owners` - (Optional) Returns the snapshots owned by the specified owner id. Multiple owners can be specified.
+
+* `restorable_by_user_ids` - (Optional) One or more AWS accounts IDs that can create volumes from the snapshot.
+
+* `filter` - (Optional) One or more name/value pairs to filter off of. There are
+several valid keys, for a full reference, check out
+[describe-volumes in the AWS CLI reference][1].
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - AWS Region.
+* `ids` - Set of EBS snapshot IDs, sorted by creation time in descending order.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `20m`)
+
+[1]: http://docs.aws.amazon.com/cli/latest/reference/ec2/describe-snapshots.html
+
+<!-- cache-key: cdktf-0.18.0 input-39c8fd3ed01de7a4c5bbc663b2dbb6a16897ac65078b21e1f01a11f41abab5e1 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/ebs_volume.html.markdown b/website/docs/cdktf/python/d/ebs_volume.html.markdown
new file mode 100644
index 00000000000..4d486d31aa6
--- /dev/null
+++ b/website/docs/cdktf/python/d/ebs_volume.html.markdown
@@ -0,0 +1,80 @@
+---
+subcategory: "EBS (EC2)"
+layout: "aws"
+page_title: "AWS: aws_ebs_volume"
+description: |-
+  Get information on an EBS volume.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_ebs_volume
+
+Use this data source to get information about an EBS volume for use in other
+resources.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_ebs_volume import DataAwsEbsVolume
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsEbsVolume(self, "ebs_volume",
+            filter=[DataAwsEbsVolumeFilter(
+                name="volume-type",
+                values=["gp2"]
+            ), DataAwsEbsVolumeFilter(
+                name="tag:Name",
+                values=["Example"]
+            )
+            ],
+            most_recent=True
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `most_recent` - (Optional) If more than one result is returned, use the most
+recent Volume.
+* `filter` - (Optional) One or more name/value pairs to filter off of. There are
+several valid keys, for a full reference, check out
+[describe-volumes in the AWS CLI reference][1].
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - Volume ID (e.g., vol-59fcb34e).
+* `volume_id` - Volume ID (e.g., vol-59fcb34e).
+* `arn` - Volume ARN (e.g., arn:aws:ec2:us-east-1:0123456789012:volume/vol-59fcb34e).
+* `availability_zone` - AZ where the EBS volume exists.
+* `encrypted` - Whether the disk is encrypted.
+* `iops` - Amount of IOPS for the disk.
+* `multi_attach_enabled` - (Optional) Specifies whether Amazon EBS Multi-Attach is enabled.
+* `size` - Size of the drive in GiBs.
+* `snapshot_id` - Snapshot_id the EBS volume is based off.
+* `outpost_arn` - ARN of the Outpost.
+* `volume_type` - Type of EBS volume.
+* `kms_key_id` - ARN for the KMS encryption key.
+* `tags` - Map of tags for the resource.
+* `throughput` - Throughput that the volume supports, in MiB/s.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `20m`)
+
+[1]: http://docs.aws.amazon.com/cli/latest/reference/ec2/describe-volumes.html
+
+<!-- cache-key: cdktf-0.18.0 input-00c94bacdc21ca1f9f8c3f77dac8c937947e9644a5d93fbb88f378a86ec1420e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/ebs_volumes.html.markdown b/website/docs/cdktf/python/d/ebs_volumes.html.markdown
new file mode 100644
index 00000000000..6dd7fb07aed
--- /dev/null
+++ b/website/docs/cdktf/python/d/ebs_volumes.html.markdown
@@ -0,0 +1,112 @@
+---
+subcategory: "EBS (EC2)"
+layout: "aws"
+page_title: "AWS: aws_ebs_volumes"
+description: |-
+    Provides identifying information for EBS volumes matching given criteria
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_ebs_volumes
+
+`aws_ebs_volumes` provides identifying information for EBS volumes matching given criteria.
+
+This data source can be useful for getting a list of volume IDs with (for example) matching tags.
+
+## Example Usage
+
+The following demonstrates obtaining a map of availability zone to EBS volume ID for volumes with a given tag value.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformIterator, TerraformOutput, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_ebs_volume import DataAwsEbsVolume
+from imports.aws.data_aws_ebs_volumes import DataAwsEbsVolumes
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = DataAwsEbsVolumes(self, "example",
+            tags={
+                "VolumeSet": "TestVolumeSet"
+            }
+        )
+        # In most cases loops should be handled in the programming language context and
+        #     not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+        #     you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+        #     you need to keep this like it is.
+        example_for_each_iterator = TerraformIterator.from_list(
+            Token.as_any(example.ids))
+        data_aws_ebs_volume_example = DataAwsEbsVolume(self, "example_1",
+            filter=[DataAwsEbsVolumeFilter(
+                name="volume-id",
+                values=[Token.as_string(example_for_each_iterator.value)]
+            )
+            ],
+            for_each=example_for_each_iterator
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_ebs_volume_example.override_logical_id("example")
+        TerraformOutput(self, "availability_zone_to_volume_id",
+            value="${{ for s in ${" + data_aws_ebs_volume_example.fqn + "} : s.id => s.availability_zone}}"
+        )
+```
+
+## Argument Reference
+
+* `filter` - (Optional) Custom filter block as described below.
+
+* `tags` - (Optional) Map of tags, each pair of which must exactly match
+  a pair on the desired volumes.
+
+More complex filters can be expressed using one or more `filter` sub-blocks,
+which take the following arguments:
+
+* `name` - (Required) Name of the field to filter by, as defined by
+  [the underlying AWS API](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeVolumes.html).
+  For example, if matching against the `size` filter, use:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_ebs_volumes import DataAwsEbsVolumes
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsEbsVolumes(self, "ten_or_twenty_gb_volumes",
+            filter=[DataAwsEbsVolumesFilter(
+                name="size",
+                values=["10", "20"]
+            )
+            ]
+        )
+```
+
+* `values` - (Required) Set of values that are accepted for the given field.
+  EBS Volume IDs will be selected if any one of the given values match.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - AWS Region.
+* `ids` - Set of all the EBS Volume IDs found. This data source will fail if
+  no volumes match the provided criteria.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `20m`)
+
+<!-- cache-key: cdktf-0.18.0 input-2fdb43d70c3e01df69142bb8e512eb860b7308eecd84dfa0aec0a61b89c10a96 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/ec2_client_vpn_endpoint.html.markdown b/website/docs/cdktf/python/d/ec2_client_vpn_endpoint.html.markdown
index 964c619ccc9..6e868384b12 100644
--- a/website/docs/cdktf/python/d/ec2_client_vpn_endpoint.html.markdown
+++ b/website/docs/cdktf/python/d/ec2_client_vpn_endpoint.html.markdown
@@ -6,6 +6,8 @@ description: |-
   Get information on an EC2 Client VPN endpoint
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Data Source: aws_ec2_client_vpn_endpoint
 
 Get information on an EC2 Client VPN endpoint.
@@ -15,15 +17,18 @@ Get information on an EC2 Client VPN endpoint.
 ### By Filter
 
 ```python
-import constructs as constructs
-import cdktf as cdktf
-# Provider bindings are generated by running cdktf get.
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
 # See https://cdk.tf/provider-generation for more details.
-import ...gen.providers.aws as aws
-class MyConvertedCode(cdktf.TerraformStack):
+#
+from imports.aws.data_aws_ec2_client_vpn_endpoint import DataAwsEc2ClientVpnEndpoint
+class MyConvertedCode(TerraformStack):
     def __init__(self, scope, name):
         super().__init__(scope, name)
-        aws.data_aws_ec2_client_vpn_endpoint.DataAwsEc2ClientVpnEndpoint(self, "example",
+        DataAwsEc2ClientVpnEndpoint(self, "example",
             filter=[DataAwsEc2ClientVpnEndpointFilter(
                 name="tag:Name",
                 values=["ExampleVpn"]
@@ -35,22 +40,25 @@ class MyConvertedCode(cdktf.TerraformStack):
 ### By Identifier
 
 ```python
-import constructs as constructs
-import cdktf as cdktf
-# Provider bindings are generated by running cdktf get.
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
 # See https://cdk.tf/provider-generation for more details.
-import ...gen.providers.aws as aws
-class MyConvertedCode(cdktf.TerraformStack):
+#
+from imports.aws.data_aws_ec2_client_vpn_endpoint import DataAwsEc2ClientVpnEndpoint
+class MyConvertedCode(TerraformStack):
     def __init__(self, scope, name):
         super().__init__(scope, name)
-        aws.data_aws_ec2_client_vpn_endpoint.DataAwsEc2ClientVpnEndpoint(self, "example",
+        DataAwsEc2ClientVpnEndpoint(self, "example",
             client_vpn_endpoint_id="cvpn-endpoint-083cf50d6eb314f21"
         )
 ```
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `client_vpn_endpoint_id` - (Optional) ID of the Client VPN endpoint.
 * `filter` - (Optional) One or more configuration blocks containing name-values filters. Detailed below.
@@ -67,7 +75,7 @@ The following arguments are required:
 
 ## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` -  The ARN of the Client VPN endpoint.
 * `authentication_options` - Information about the authentication method used by the Client VPN endpoint.
@@ -80,6 +88,7 @@ In addition to all arguments above, the following attributes are exported:
 * `dns_servers` - Information about the DNS servers to be used for DNS resolution.
 * `security_group_ids` - IDs of the security groups for the target network associated with the Client VPN endpoint.
 * `self_service_portal` - Whether the self-service portal for the Client VPN endpoint is enabled.
+* `self_service_portal_url` - The URL of the self-service portal.
 * `server_certificate_arn` - The ARN of the server certificate.
 * `session_timeout_hours` - The maximum VPN session duration time in hours.
 * `split_tunnel` - Whether split-tunnel is enabled in the AWS Client VPN endpoint.
@@ -93,4 +102,4 @@ In addition to all arguments above, the following attributes are exported:
 
 - `read` - (Default `20m`)
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-86166d26a95ae3c88a4d4e7f8804306d48860395f262b9f351921ba97ba82ccc -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-bc05f6bb24f9086ff19f5d3ed7d1f4948088a83b4e318db8a86fe506a18104cf -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/ec2_coip_pool.html.markdown b/website/docs/cdktf/python/d/ec2_coip_pool.html.markdown
index 7e892b484f3..00db70f4d1e 100644
--- a/website/docs/cdktf/python/d/ec2_coip_pool.html.markdown
+++ b/website/docs/cdktf/python/d/ec2_coip_pool.html.markdown
@@ -6,6 +6,8 @@ description: |-
     Provides details about a specific EC2 Customer-Owned IP Pool
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Data Source: aws_ec2_coip_pool
 
 Provides details about a specific EC2 Customer-Owned IP Pool.
@@ -18,12 +20,24 @@ COIP Pool.
 
 The following example returns a specific coip pool ID
 
-```terraform
-variable "coip_pool_id" {}
-
-data "aws_ec2_coip_pool" "selected" {
-  id = var.coip_pool_id
-}
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformVariable, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_ec2_coip_pool import DataAwsEc2CoipPool
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        # Terraform Variables are not always the best fit for getting inputs in the context of Terraform CDK.
+        #     You can read more about this at https://cdk.tf/variables
+        coip_pool_id = TerraformVariable(self, "coip_pool_id")
+        DataAwsEc2CoipPool(self, "selected",
+            id=coip_pool_id.string_value
+        )
 ```
 
 ## Argument Reference
@@ -48,14 +62,14 @@ which take the following arguments:
 * `values` - (Required) Set of values that are accepted for the given field.
   A COIP Pool will be selected if any one of the given values matches.
 
-## Attributes Reference
+## Attribute Reference
 
 All of the argument attributes except `filter` blocks are also exported as
 result attributes. This data source will complete the data by populating
 any fields that are not included in the configuration with the data for
 the selected COIP Pool.
 
-In addition, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the COIP pool
 * `pool_cidrs` - Set of CIDR blocks in pool
@@ -66,4 +80,4 @@ In addition, the following attributes are exported:
 
 - `read` - (Default `20m`)
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-4018a02fb3e3ba399170a12145e567c04dd4dcf3d3de820650bd0da4b7852ab7 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-9daefdcf6a9406d85608497b3074a6f9c1cdbfdb9d671dde53dad6ac78ca710e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/ec2_coip_pools.html.markdown b/website/docs/cdktf/python/d/ec2_coip_pools.html.markdown
index 26216a83d79..42a938ad303 100644
--- a/website/docs/cdktf/python/d/ec2_coip_pools.html.markdown
+++ b/website/docs/cdktf/python/d/ec2_coip_pools.html.markdown
@@ -6,6 +6,8 @@ description: |-
     Provides information for multiple EC2 Customer-Owned IP Pools
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Data Source: aws_ec2_coip_pools
 
 Provides information for multiple EC2 Customer-Owned IP Pools, such as their identifiers.
@@ -14,12 +16,24 @@ Provides information for multiple EC2 Customer-Owned IP Pools, such as their ide
 
 The following shows outputting all COIP Pool Ids.
 
-```terraform
-data "aws_ec2_coip_pools" "foo" {}
-
-output "foo" {
-  value = data.aws_ec2_coip_pools.foo.ids
-}
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformOutput, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_ec2_coip_pools import DataAwsEc2CoipPools
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        foo = DataAwsEc2CoipPools(self, "foo")
+        cdktf_terraform_output_foo = TerraformOutput(self, "foo_1",
+            value=foo.ids
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        cdktf_terraform_output_foo.override_logical_id("foo")
 ```
 
 ## Argument Reference
@@ -38,7 +52,9 @@ which take the following arguments:
 * `values` - (Required) Set of values that are accepted for the given field.
   A COIP Pool will be selected if any one of the given values matches.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - AWS Region.
 * `pool_ids` - Set of COIP Pool Identifiers
@@ -49,4 +65,4 @@ which take the following arguments:
 
 - `read` - (Default `20m`)
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-c1c9a426e16105b7a02e1c1b1adc831132ac241239b921ea8b6a60157547ed64 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-b91d2cae592ac5bf459745fca131316d289583f055df2569fd13d50a3ac7f511 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/ec2_host.html.markdown b/website/docs/cdktf/python/d/ec2_host.html.markdown
index 7764d71aa1f..24f1e88b4bb 100644
--- a/website/docs/cdktf/python/d/ec2_host.html.markdown
+++ b/website/docs/cdktf/python/d/ec2_host.html.markdown
@@ -6,6 +6,8 @@ description: |-
   Get information on an EC2 Host.
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Data Source: aws_ec2_host
 
 Use this data source to get information about an EC2 Dedicated Host.
@@ -13,20 +15,24 @@ Use this data source to get information about an EC2 Dedicated Host.
 ## Example Usage
 
 ```python
-import constructs as constructs
-import cdktf as cdktf
-# Provider bindings are generated by running cdktf get.
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
 # See https://cdk.tf/provider-generation for more details.
-import ...gen.providers.aws as aws
-class MyConvertedCode(cdktf.TerraformStack):
+#
+from imports.aws.data_aws_ec2_host import DataAwsEc2Host
+from imports.aws.ec2_host import Ec2Host
+class MyConvertedCode(TerraformStack):
     def __init__(self, scope, name):
         super().__init__(scope, name)
-        aws_ec2_host_test = aws.ec2_host.Ec2Host(self, "test",
+        test = Ec2Host(self, "test",
             availability_zone="us-west-2a",
             instance_type="c5.18xlarge"
         )
-        data_aws_ec2_host_test = aws.data_aws_ec2_host.DataAwsEc2Host(self, "test_1",
-            host_id=cdktf.Token.as_string(aws_ec2_host_test.id)
+        data_aws_ec2_host_test = DataAwsEc2Host(self, "test_1",
+            host_id=test.id
         )
         # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
         data_aws_ec2_host_test.override_logical_id("test")
@@ -35,15 +41,18 @@ class MyConvertedCode(cdktf.TerraformStack):
 ### Filter Example
 
 ```python
-import constructs as constructs
-import cdktf as cdktf
-# Provider bindings are generated by running cdktf get.
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
 # See https://cdk.tf/provider-generation for more details.
-import ...gen.providers.aws as aws
-class MyConvertedCode(cdktf.TerraformStack):
+#
+from imports.aws.data_aws_ec2_host import DataAwsEc2Host
+class MyConvertedCode(TerraformStack):
     def __init__(self, scope, name):
         super().__init__(scope, name)
-        aws.data_aws_ec2_host.DataAwsEc2Host(self, "test",
+        DataAwsEc2Host(self, "test",
             filter=[DataAwsEc2HostFilter(
                 name="instance-type",
                 values=["c5.18xlarge"]
@@ -69,12 +78,13 @@ The following arguments are required:
 * `name` - (Required) Name of the field to filter by, as defined by [the underlying AWS API](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeHosts.html).
 * `values` - (Required) Set of values that are accepted for the given field. A host will be selected if any one of the given values matches.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to the attributes above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - ID of the Dedicated Host.
 * `arn` - ARN of the Dedicated Host.
+* `asset_id` - The ID of the Outpost hardware asset on which the Dedicated Host is allocated.
 * `auto_placement` - Whether auto-placement is on or off.
 * `availability_zone` - Availability Zone of the Dedicated Host.
 * `cores` - Number of cores on the Dedicated Host.
@@ -92,4 +102,4 @@ In addition to the attributes above, the following attributes are exported:
 
 - `read` - (Default `20m`)
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-9b4c91c8afc4637faf1832c061bf67a14ccd6dddf8ee04ebb2ecd4958b912e50 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-2c0dd059868ed5217fac4aec77aa468bafc9f69b8de0b12d682d6625c1850767 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/ec2_instance_type.html.markdown b/website/docs/cdktf/python/d/ec2_instance_type.html.markdown
index e0d9e62703d..6c8f1871220 100644
--- a/website/docs/cdktf/python/d/ec2_instance_type.html.markdown
+++ b/website/docs/cdktf/python/d/ec2_instance_type.html.markdown
@@ -7,6 +7,8 @@ description: |-
 ---
 
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Data Source: aws_ec2_instance_type
 
 Get characteristics for a single EC2 Instance Type.
@@ -14,28 +16,31 @@ Get characteristics for a single EC2 Instance Type.
 ## Example Usage
 
 ```python
-import constructs as constructs
-import cdktf as cdktf
-# Provider bindings are generated by running cdktf get.
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
 # See https://cdk.tf/provider-generation for more details.
-import ...gen.providers.aws as aws
-class MyConvertedCode(cdktf.TerraformStack):
+#
+from imports.aws.data_aws_ec2_instance_type import DataAwsEc2InstanceType
+class MyConvertedCode(TerraformStack):
     def __init__(self, scope, name):
         super().__init__(scope, name)
-        aws.data_aws_ec2_instance_type.DataAwsEc2InstanceType(self, "example",
+        DataAwsEc2InstanceType(self, "example",
             instance_type="t2.micro"
         )
 ```
 
 ## Argument Reference
 
-The following argument is supported:
+This data source supports the following arguments:
 
 * `instance_type` - (Required) Instance
 
 ## Attribute Reference
 
-In addition to the argument above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 ~> **NOTE:** Not all attributes are set for every instance type.
 
@@ -105,4 +110,4 @@ In addition to the argument above, the following attributes are exported:
 
 - `read` - (Default `20m`)
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-2b636f57a79c9545305113d01a6f8b0a344a9f774db0d6a467fd46c35a6802c0 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-b7277db3a541ce0f8fed6f01d3571ab61e9905732dcb0c8ed05bebf2a1116184 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/ec2_instance_type_offering.html.markdown b/website/docs/cdktf/python/d/ec2_instance_type_offering.html.markdown
index 95edfae440f..2e2d8cb489a 100644
--- a/website/docs/cdktf/python/d/ec2_instance_type_offering.html.markdown
+++ b/website/docs/cdktf/python/d/ec2_instance_type_offering.html.markdown
@@ -6,6 +6,8 @@ description: |-
   Information about single EC2 Instance Type Offering.
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Data Source: aws_ec2_instance_type_offering
 
 Information about single EC2 Instance Type Offering.
@@ -13,15 +15,18 @@ Information about single EC2 Instance Type Offering.
 ## Example Usage
 
 ```python
-import constructs as constructs
-import cdktf as cdktf
-# Provider bindings are generated by running cdktf get.
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
 # See https://cdk.tf/provider-generation for more details.
-import ...gen.providers.aws as aws
-class MyConvertedCode(cdktf.TerraformStack):
+#
+from imports.aws.data_aws_ec2_instance_type_offering import DataAwsEc2InstanceTypeOffering
+class MyConvertedCode(TerraformStack):
     def __init__(self, scope, name):
         super().__init__(scope, name)
-        aws.data_aws_ec2_instance_type_offering.DataAwsEc2InstanceTypeOffering(self, "example",
+        DataAwsEc2InstanceTypeOffering(self, "example",
             filter=[DataAwsEc2InstanceTypeOfferingFilter(
                 name="instance-type",
                 values=["t2.micro", "t3.micro"]
@@ -33,7 +38,7 @@ class MyConvertedCode(cdktf.TerraformStack):
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `filter` - (Optional) One or more configuration blocks containing name-values filters. See the [EC2 API Reference](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeInstanceTypeOfferings.html) for supported filters. Detailed below.
 * `location_type` - (Optional) Location type. Defaults to `region`. Valid values: `availability-zone`, `availability-zone-id`, and `region`.
@@ -46,7 +51,7 @@ The following arguments are supported:
 
 ## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - EC2 Instance Type.
 * `instance_type` - EC2 Instance Type.
@@ -57,4 +62,4 @@ In addition to all arguments above, the following attributes are exported:
 
 - `read` - (Default `20m`)
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-b9a0baa6d38287dcfdc6f70833e23287a617a652af798b75206cc22860a785e7 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-ee92204428b1ac2c8a41c289f70dd6ba1bc0d940110fee2c372c0684d819b847 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/ec2_instance_type_offerings.html.markdown b/website/docs/cdktf/python/d/ec2_instance_type_offerings.html.markdown
index 02bcc7bf2bb..ddb01027325 100644
--- a/website/docs/cdktf/python/d/ec2_instance_type_offerings.html.markdown
+++ b/website/docs/cdktf/python/d/ec2_instance_type_offerings.html.markdown
@@ -6,6 +6,8 @@ description: |-
   Information about EC2 Instance Type Offerings.
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Data Source: aws_ec2_instance_type_offerings
 
 Information about EC2 Instance Type Offerings.
@@ -13,15 +15,18 @@ Information about EC2 Instance Type Offerings.
 ## Example Usage
 
 ```python
-import constructs as constructs
-import cdktf as cdktf
-# Provider bindings are generated by running cdktf get.
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
 # See https://cdk.tf/provider-generation for more details.
-import ...gen.providers.aws as aws
-class MyConvertedCode(cdktf.TerraformStack):
+#
+from imports.aws.data_aws_ec2_instance_type_offerings import DataAwsEc2InstanceTypeOfferings
+class MyConvertedCode(TerraformStack):
     def __init__(self, scope, name):
         super().__init__(scope, name)
-        aws.data_aws_ec2_instance_type_offerings.DataAwsEc2InstanceTypeOfferings(self, "example",
+        DataAwsEc2InstanceTypeOfferings(self, "example",
             filter=[DataAwsEc2InstanceTypeOfferingsFilter(
                 name="instance-type",
                 values=["t2.micro", "t3.micro"]
@@ -36,7 +41,7 @@ class MyConvertedCode(cdktf.TerraformStack):
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `filter` - (Optional) One or more configuration blocks containing name-values filters. See the [EC2 API Reference](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeInstanceTypeOfferings.html) for supported filters. Detailed below.
 * `location_type` - (Optional) Location type. Defaults to `region`. Valid values: `availability-zone`, `availability-zone-id`, and `region`.
@@ -48,7 +53,7 @@ The following arguments are supported:
 
 ## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - AWS Region.
 * `instance_types` - List of EC2 Instance Types.
@@ -63,4 +68,4 @@ Note that the indexes of Instance Type Offering instance types, locations and lo
 
 - `read` - (Default `20m`)
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-1ee018a194cbf08b7beed7fc665daba2fd81f7b8d3a928d9e68977514ac22388 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-b0fad9c4702cf5f0efa96a6a41ce0782d77f7dd1b5e2e01addf5aacedb2df2ba -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/ec2_instance_types.html.markdown b/website/docs/cdktf/python/d/ec2_instance_types.html.markdown
index 4fcf7bedeb8..ca9329cf8cb 100644
--- a/website/docs/cdktf/python/d/ec2_instance_types.html.markdown
+++ b/website/docs/cdktf/python/d/ec2_instance_types.html.markdown
@@ -6,6 +6,8 @@ description: |-
   Information about EC2 Instance Types.
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Data Source: aws_ec2_instance_types
 
 Information about EC2 Instance Types.
@@ -13,15 +15,18 @@ Information about EC2 Instance Types.
 ## Example Usage
 
 ```python
-import constructs as constructs
-import cdktf as cdktf
-# Provider bindings are generated by running cdktf get.
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
 # See https://cdk.tf/provider-generation for more details.
-import ...gen.providers.aws as aws
-class MyConvertedCode(cdktf.TerraformStack):
+#
+from imports.aws.data_aws_ec2_instance_types import DataAwsEc2InstanceTypes
+class MyConvertedCode(TerraformStack):
     def __init__(self, scope, name):
         super().__init__(scope, name)
-        aws.data_aws_ec2_instance_types.DataAwsEc2InstanceTypes(self, "test",
+        DataAwsEc2InstanceTypes(self, "test",
             filter=[DataAwsEc2InstanceTypesFilter(
                 name="auto-recovery-supported",
                 values=["true"]
@@ -41,7 +46,7 @@ class MyConvertedCode(cdktf.TerraformStack):
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `filter` - (Optional) One or more configuration blocks containing name-values filters. See the [EC2 API Reference](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeInstanceTypes.html) for supported filters. Detailed below.
 
@@ -52,7 +57,7 @@ The following arguments are supported:
 
 ## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - AWS Region.
 * `instance_types` - List of EC2 Instance Types.
@@ -63,4 +68,4 @@ In addition to all arguments above, the following attributes are exported:
 
 - `read` - (Default `20m`)
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-5948af49a7b80d2c68167a564344d97e7d0a4780fb7397e6ec5945e26f7c7f9a -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-03e38077d0e2af0e80115aa30d25c82dfe7e6f8b184cc0e1b4e0116655ad11fb -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/ec2_local_gateway.html.markdown b/website/docs/cdktf/python/d/ec2_local_gateway.html.markdown
index cd328f6e6c0..af95537da0b 100644
--- a/website/docs/cdktf/python/d/ec2_local_gateway.html.markdown
+++ b/website/docs/cdktf/python/d/ec2_local_gateway.html.markdown
@@ -6,6 +6,8 @@ description: |-
     Provides details about an EC2 Local Gateway
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Data Source: aws_ec2_local_gateway
 
 Provides details about an EC2 Local Gateway.
@@ -15,18 +17,21 @@ Provides details about an EC2 Local Gateway.
 The following example shows how one might accept a local gateway id as a variable.
 
 ```python
-import constructs as constructs
-import cdktf as cdktf
-# Provider bindings are generated by running cdktf get.
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformVariable, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
 # See https://cdk.tf/provider-generation for more details.
-import ...gen.providers.aws as aws
-class MyConvertedCode(cdktf.TerraformStack):
+#
+from imports.aws.data_aws_ec2_local_gateway import DataAwsEc2LocalGateway
+class MyConvertedCode(TerraformStack):
     def __init__(self, scope, name):
         super().__init__(scope, name)
         # Terraform Variables are not always the best fit for getting inputs in the context of Terraform CDK.
         #     You can read more about this at https://cdk.tf/variables
-        local_gateway_id = cdktf.TerraformVariable(self, "local_gateway_id")
-        aws.data_aws_ec2_local_gateway.DataAwsEc2LocalGateway(self, "selected",
+        local_gateway_id = TerraformVariable(self, "local_gateway_id")
+        DataAwsEc2LocalGateway(self, "selected",
             id=local_gateway_id.string_value
         )
 ```
@@ -56,7 +61,7 @@ which take the following arguments:
 * `values` - (Required) Set of values that are accepted for the given field.
   A Local Gateway will be selected if any one of the given values matches.
 
-## Attributes Reference
+## Attribute Reference
 
 All of the argument attributes except `filter` blocks are also exported as
 result attributes. This data source will complete the data by populating
@@ -75,4 +80,4 @@ The following attributes are additionally exported:
 
 - `read` - (Default `20m`)
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-56eb53c0592b4dcc9d2d5a1f358fef5265a9b459052c09b2a04aaa3623ccf1be -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-e9224792e92736687e2ac8179a6512547c5aaa4078c6bb91db11fd714268b0ee -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/ec2_local_gateway_route_table.html.markdown b/website/docs/cdktf/python/d/ec2_local_gateway_route_table.html.markdown
index acbc0a2581b..929805b6a2b 100644
--- a/website/docs/cdktf/python/d/ec2_local_gateway_route_table.html.markdown
+++ b/website/docs/cdktf/python/d/ec2_local_gateway_route_table.html.markdown
@@ -6,6 +6,8 @@ description: |-
     Provides details about an EC2 Local Gateway Route Table
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Data Source: aws_ec2_local_gateway_route_table
 
 Provides details about an EC2 Local Gateway Route Table.
@@ -18,18 +20,21 @@ an input variable and needs to, for example, find the associated Outpost or Loca
 The following example returns a specific local gateway route table ID
 
 ```python
-import constructs as constructs
-import cdktf as cdktf
-# Provider bindings are generated by running cdktf get.
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformVariable, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
 # See https://cdk.tf/provider-generation for more details.
-import ...gen.providers.aws as aws
-class MyConvertedCode(cdktf.TerraformStack):
+#
+from imports.aws.data_aws_ec2_local_gateway_route_table import DataAwsEc2LocalGatewayRouteTable
+class MyConvertedCode(TerraformStack):
     def __init__(self, scope, name):
         super().__init__(scope, name)
         # Terraform Variables are not always the best fit for getting inputs in the context of Terraform CDK.
         #     You can read more about this at https://cdk.tf/variables
-        aws_ec2_local_gateway_route_table = cdktf.TerraformVariable(self, "aws_ec2_local_gateway_route_table")
-        aws.data_aws_ec2_local_gateway_route_table.DataAwsEc2LocalGatewayRouteTable(self, "selected",
+        aws_ec2_local_gateway_route_table = TerraformVariable(self, "aws_ec2_local_gateway_route_table")
+        DataAwsEc2LocalGatewayRouteTable(self, "selected",
             local_gateway_route_table_id=aws_ec2_local_gateway_route_table.string_value
         )
 ```
@@ -66,4 +71,4 @@ which take the following arguments:
 
 - `read` - (Default `20m`)
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-659f40a3728960d4574b77039ecbc60a549c25ba6a774b2467023fef557a755a -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-659f40a3728960d4574b77039ecbc60a549c25ba6a774b2467023fef557a755a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/ec2_local_gateway_route_tables.html.markdown b/website/docs/cdktf/python/d/ec2_local_gateway_route_tables.html.markdown
index df9d201f1ab..0455a850bf5 100644
--- a/website/docs/cdktf/python/d/ec2_local_gateway_route_tables.html.markdown
+++ b/website/docs/cdktf/python/d/ec2_local_gateway_route_tables.html.markdown
@@ -6,6 +6,8 @@ description: |-
     Provides information for multiple EC2 Local Gateway Route Tables
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Data Source: aws_ec2_local_gateway_route_tables
 
 Provides information for multiple EC2 Local Gateway Route Tables, such as their identifiers.
@@ -15,18 +17,20 @@ Provides information for multiple EC2 Local Gateway Route Tables, such as their
 The following shows outputting all Local Gateway Route Table Ids.
 
 ```python
-import constructs as constructs
-import cdktf as cdktf
-# Provider bindings are generated by running cdktf get.
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformOutput, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
 # See https://cdk.tf/provider-generation for more details.
-import ...gen.providers.aws as aws
-class MyConvertedCode(cdktf.TerraformStack):
+#
+from imports.aws.data_aws_ec2_local_gateway_route_tables import DataAwsEc2LocalGatewayRouteTables
+class MyConvertedCode(TerraformStack):
     def __init__(self, scope, name):
         super().__init__(scope, name)
-        data_aws_ec2_local_gateway_route_tables_foo =
-        aws.data_aws_ec2_local_gateway_route_tables.DataAwsEc2LocalGatewayRouteTables(self, "foo")
-        cdktf_terraform_output_foo = cdktf.TerraformOutput(self, "foo_1",
-            value=data_aws_ec2_local_gateway_route_tables_foo.ids
+        foo = DataAwsEc2LocalGatewayRouteTables(self, "foo")
+        cdktf_terraform_output_foo = TerraformOutput(self, "foo_1",
+            value=foo.ids
         )
         # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
         cdktf_terraform_output_foo.override_logical_id("foo")
@@ -48,7 +52,9 @@ which take the following arguments:
 * `values` - (Required) Set of values that are accepted for the given field.
   A Local Gateway Route Table will be selected if any one of the given values matches.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - AWS Region.
 * `ids` - Set of Local Gateway Route Table identifiers
@@ -59,4 +65,4 @@ which take the following arguments:
 
 - `read` - (Default `20m`)
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-6cee9559daa21ba439753064a3a6eb96fd5b6326abef88de2b9f66f02ac0770e -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-a7fa07e5df9221f1a1960ea3ec891c58f8a438a9471e6be0d1a428fa3ee9bed1 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/ec2_local_gateway_virtual_interface.html.markdown b/website/docs/cdktf/python/d/ec2_local_gateway_virtual_interface.html.markdown
index 6e7f86766be..b7512f2fbbf 100644
--- a/website/docs/cdktf/python/d/ec2_local_gateway_virtual_interface.html.markdown
+++ b/website/docs/cdktf/python/d/ec2_local_gateway_virtual_interface.html.markdown
@@ -6,18 +6,36 @@ description: |-
     Provides details about an EC2 Local Gateway Virtual Interface
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Data Source: aws_ec2_local_gateway_virtual_interface
 
 Provides details about an EC2 Local Gateway Virtual Interface. More information can be found in the [Outposts User Guide](https://docs.aws.amazon.com/outposts/latest/userguide/outposts-networking-components.html#routing).
 
 ## Example Usage
 
-```terraform
-data "aws_ec2_local_gateway_virtual_interface" "example" {
-  for_each = data.aws_ec2_local_gateway_virtual_interface_group.example.local_gateway_virtual_interface_ids
-
-  id = each.value
-}
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformIterator, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_ec2_local_gateway_virtual_interface import DataAwsEc2LocalGatewayVirtualInterface
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        # In most cases loops should be handled in the programming language context and
+        #     not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+        #     you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+        #     you need to keep this like it is.
+        example_for_each_iterator = TerraformIterator.from_list(
+            Token.as_any(data_aws_ec2_local_gateway_virtual_interface_group_example.local_gateway_virtual_interface_ids))
+        DataAwsEc2LocalGatewayVirtualInterface(self, "example",
+            id=Token.as_string(example_for_each_iterator.value),
+            for_each=example_for_each_iterator
+        )
 ```
 
 ## Argument Reference
@@ -37,7 +55,7 @@ The `filter` configuration block supports the following arguments:
 
 ## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `local_address` - Local address.
 * `local_bgp_asn` - Border Gateway Protocol (BGP) Autonomous System Number (ASN) of the EC2 Local Gateway.
@@ -52,4 +70,4 @@ In addition to all arguments above, the following attributes are exported:
 
 - `read` - (Default `20m`)
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-8e096e1216ac507f824ce02a9ba18794bf5791c0f496d83b673af9b7c193c051 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-84b19b85b29b524237f0dba8dd0b0098f8acc444d8a902be6fcf51bfed3a262a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/ec2_local_gateway_virtual_interface_group.html.markdown b/website/docs/cdktf/python/d/ec2_local_gateway_virtual_interface_group.html.markdown
index e20f807a803..921b71113fb 100644
--- a/website/docs/cdktf/python/d/ec2_local_gateway_virtual_interface_group.html.markdown
+++ b/website/docs/cdktf/python/d/ec2_local_gateway_virtual_interface_group.html.markdown
@@ -6,16 +6,29 @@ description: |-
     Provides details about an EC2 Local Gateway Virtual Interface Group
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Data Source: aws_ec2_local_gateway_virtual_interface_group
 
 Provides details about an EC2 Local Gateway Virtual Interface Group. More information can be found in the [Outposts User Guide](https://docs.aws.amazon.com/outposts/latest/userguide/outposts-networking-components.html#routing).
 
 ## Example Usage
 
-```terraform
-data "aws_ec2_local_gateway_virtual_interface_group" "example" {
-  local_gateway_id = data.aws_ec2_local_gateway.example.id
-}
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_ec2_local_gateway_virtual_interface_group import DataAwsEc2LocalGatewayVirtualInterfaceGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsEc2LocalGatewayVirtualInterfaceGroup(self, "example",
+            local_gateway_id=Token.as_string(data_aws_ec2_local_gateway_example.id)
+        )
 ```
 
 ## Argument Reference
@@ -36,7 +49,7 @@ The `filter` configuration block supports the following arguments:
 
 ## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `local_gateway_virtual_interface_ids` - Set of EC2 Local Gateway Virtual Interface identifiers.
 
@@ -46,4 +59,4 @@ In addition to all arguments above, the following attributes are exported:
 
 - `read` - (Default `20m`)
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-540e4780997710333dc225582410f2a266ebddd6e5fe16521de29c067a33a32d -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-5e2411b5d41b817a4357d5f458ca79618899e731412cbe0aaf57de8040137661 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/ec2_local_gateway_virtual_interface_groups.html.markdown b/website/docs/cdktf/python/d/ec2_local_gateway_virtual_interface_groups.html.markdown
index 4578304cdc6..31387b8191e 100644
--- a/website/docs/cdktf/python/d/ec2_local_gateway_virtual_interface_groups.html.markdown
+++ b/website/docs/cdktf/python/d/ec2_local_gateway_virtual_interface_groups.html.markdown
@@ -6,6 +6,8 @@ description: |-
     Provides details about multiple EC2 Local Gateway Virtual Interface Groups
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Data Source: aws_ec2_local_gateway_virtual_interface_groups
 
 Provides details about multiple EC2 Local Gateway Virtual Interface Groups, such as identifiers. More information can be found in the [Outposts User Guide](https://docs.aws.amazon.com/outposts/latest/userguide/outposts-networking-components.html#routing).
@@ -13,15 +15,18 @@ Provides details about multiple EC2 Local Gateway Virtual Interface Groups, such
 ## Example Usage
 
 ```python
-import constructs as constructs
-import cdktf as cdktf
-# Provider bindings are generated by running cdktf get.
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
 # See https://cdk.tf/provider-generation for more details.
-import ...gen.providers.aws as aws
-class MyConvertedCode(cdktf.TerraformStack):
+#
+from imports.aws.data_aws_ec2_local_gateway_virtual_interface_groups import DataAwsEc2LocalGatewayVirtualInterfaceGroups
+class MyConvertedCode(TerraformStack):
     def __init__(self, scope, name):
         super().__init__(scope, name)
-        aws.data_aws_ec2_local_gateway_virtual_interface_groups.DataAwsEc2LocalGatewayVirtualInterfaceGroups(self, "all")
+        DataAwsEc2LocalGatewayVirtualInterfaceGroups(self, "all")
 ```
 
 ## Argument Reference
@@ -40,7 +45,7 @@ The `filter` configuration block supports the following arguments:
 
 ## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - AWS Region.
 * `ids` - Set of EC2 Local Gateway Virtual Interface Group identifiers.
@@ -52,4 +57,4 @@ In addition to all arguments above, the following attributes are exported:
 
 - `read` - (Default `20m`)
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-c7ad9cd4b80f965d2bf2e4d0d094399cc47edf44b5a28085f45c0ac3949e454a -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-cd5323f4e3c93b1fcf956785701876e0cd9b44a0db7f8464b46be04b9eacf2f4 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/ec2_local_gateways.html.markdown b/website/docs/cdktf/python/d/ec2_local_gateways.html.markdown
index abda280ec16..83745d363d2 100644
--- a/website/docs/cdktf/python/d/ec2_local_gateways.html.markdown
+++ b/website/docs/cdktf/python/d/ec2_local_gateways.html.markdown
@@ -6,6 +6,8 @@ description: |-
     Provides information for multiple EC2 Local Gateways
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Data Source: aws_ec2_local_gateways
 
 Provides information for multiple EC2 Local Gateways, such as their identifiers.
@@ -15,22 +17,24 @@ Provides information for multiple EC2 Local Gateways, such as their identifiers.
 The following example retrieves Local Gateways with a resource tag of `service` set to `production`.
 
 ```python
-import constructs as constructs
-import cdktf as cdktf
-# Provider bindings are generated by running cdktf get.
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformOutput, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
 # See https://cdk.tf/provider-generation for more details.
-import ...gen.providers.aws as aws
-class MyConvertedCode(cdktf.TerraformStack):
+#
+from imports.aws.data_aws_ec2_local_gateways import DataAwsEc2LocalGateways
+class MyConvertedCode(TerraformStack):
     def __init__(self, scope, name):
         super().__init__(scope, name)
-        data_aws_ec2_local_gateways_foo =
-        aws.data_aws_ec2_local_gateways.DataAwsEc2LocalGateways(self, "foo",
+        foo = DataAwsEc2LocalGateways(self, "foo",
             tags={
                 "service": "production"
             }
         )
-        cdktf_terraform_output_foo = cdktf.TerraformOutput(self, "foo_1",
-            value=data_aws_ec2_local_gateways_foo.ids
+        cdktf_terraform_output_foo = TerraformOutput(self, "foo_1",
+            value=foo.ids
         )
         # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
         cdktf_terraform_output_foo.override_logical_id("foo")
@@ -52,7 +56,9 @@ which take the following arguments:
 * `values` - (Required) Set of values that are accepted for the given field.
   A Local Gateway will be selected if any one of the given values matches.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - AWS Region.
 * `ids` - Set of all the Local Gateway identifiers
@@ -63,4 +69,4 @@ which take the following arguments:
 
 - `read` - (Default `20m`)
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-9165a57396230ff8a87e9418dc7e8806ac85629eb83283b59445620f46a229c8 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-194cd66e7dae043fd6ed1ab7524f3a069880d0040e7bff6c2c060f60274071f5 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/ec2_managed_prefix_list.html.markdown b/website/docs/cdktf/python/d/ec2_managed_prefix_list.html.markdown
index 086ae45d916..de98ef23bf1 100644
--- a/website/docs/cdktf/python/d/ec2_managed_prefix_list.html.markdown
+++ b/website/docs/cdktf/python/d/ec2_managed_prefix_list.html.markdown
@@ -6,6 +6,8 @@ description: |-
     Provides details about a specific managed prefix list
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Data Source: aws_ec2_managed_prefix_list
 
 `aws_ec2_managed_prefix_list` provides details about a specific AWS prefix list or
@@ -16,32 +18,39 @@ customer-managed prefix list in the current region.
 ### Find the regional DynamoDB prefix list
 
 ```python
-import constructs as constructs
-import cdktf as cdktf
-# Provider bindings are generated by running cdktf get.
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
 # See https://cdk.tf/provider-generation for more details.
-import ...gen.providers.aws as aws
-class MyConvertedCode(cdktf.TerraformStack):
+#
+from imports.aws.data_aws_ec2_managed_prefix_list import DataAwsEc2ManagedPrefixList
+from imports.aws.data_aws_region import DataAwsRegion
+class MyConvertedCode(TerraformStack):
     def __init__(self, scope, name):
         super().__init__(scope, name)
-        data_aws_region_current = aws.data_aws_region.DataAwsRegion(self, "current")
-        aws.data_aws_ec2_managed_prefix_list.DataAwsEc2ManagedPrefixList(self, "example",
-            name="com.amazonaws.${" + data_aws_region_current.name + "}.dynamodb"
+        current = DataAwsRegion(self, "current")
+        DataAwsEc2ManagedPrefixList(self, "example",
+            name="com.amazonaws.${" + current.name + "}.dynamodb"
         )
 ```
 
 ### Find a managed prefix list using filters
 
 ```python
-import constructs as constructs
-import cdktf as cdktf
-# Provider bindings are generated by running cdktf get.
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
 # See https://cdk.tf/provider-generation for more details.
-import ...gen.providers.aws as aws
-class MyConvertedCode(cdktf.TerraformStack):
+#
+from imports.aws.data_aws_ec2_managed_prefix_list import DataAwsEc2ManagedPrefixList
+class MyConvertedCode(TerraformStack):
     def __init__(self, scope, name):
         super().__init__(scope, name)
-        aws.data_aws_ec2_managed_prefix_list.DataAwsEc2ManagedPrefixList(self, "example",
+        DataAwsEc2ManagedPrefixList(self, "example",
             filter=[DataAwsEc2ManagedPrefixListFilter(
                 name="prefix-list-name",
                 values=["my-prefix-list"]
@@ -62,14 +71,14 @@ whose data will be exported as attributes.
 
 ### filter Configuration Block
 
-The following arguments are supported by the `filter` configuration block:
+The `filter` configuration block supports the following arguments:
 
 * `name` - (Required) Name of the filter field. Valid values can be found in the EC2 [DescribeManagedPrefixLists](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeManagedPrefixLists.html) API Reference.
 * `values` - (Required) Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - ID of the selected prefix list.
 * `arn` - ARN of the selected prefix list.
@@ -86,4 +95,4 @@ In addition to all arguments above, the following attributes are exported:
 
 - `read` - (Default `20m`)
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-3e3c72b875acdabeff222d7efc6381624218bdc684c16b8ec1c38859e1e80f26 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-cdbf4a9d93a044622eb9a1f8a3e9a7b0a043366fdd2b0bae53faf5879d45c641 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/ec2_managed_prefix_lists.html.markdown b/website/docs/cdktf/python/d/ec2_managed_prefix_lists.html.markdown
index dc7c5d0e364..51a2b8fee85 100644
--- a/website/docs/cdktf/python/d/ec2_managed_prefix_lists.html.markdown
+++ b/website/docs/cdktf/python/d/ec2_managed_prefix_lists.html.markdown
@@ -6,6 +6,8 @@ description: |-
     Get information on managed prefix lists
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Data Source: aws_ec2_managed_prefix_lists
 
 This resource can be useful for getting back a list of managed prefix list ids to be referenced elsewhere.
@@ -15,16 +17,19 @@ This resource can be useful for getting back a list of managed prefix list ids t
 The following returns all managed prefix lists filtered by tags
 
 ```python
-import constructs as constructs
-import cdktf as cdktf
-# Provider bindings are generated by running cdktf get.
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformCount, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
 # See https://cdk.tf/provider-generation for more details.
-import ...gen.providers.aws as aws
-class MyConvertedCode(cdktf.TerraformStack):
+#
+from imports.aws.data_aws_ec2_managed_prefix_list import DataAwsEc2ManagedPrefixList
+from imports.aws.data_aws_ec2_managed_prefix_lists import DataAwsEc2ManagedPrefixLists
+class MyConvertedCode(TerraformStack):
     def __init__(self, scope, name):
         super().__init__(scope, name)
-        data_aws_ec2_managed_prefix_lists_test_env =
-        aws.data_aws_ec2_managed_prefix_lists.DataAwsEc2ManagedPrefixLists(self, "test_env",
+        test_env = DataAwsEc2ManagedPrefixLists(self, "test_env",
             tags={
                 "Env": "test"
             }
@@ -33,14 +38,12 @@ class MyConvertedCode(cdktf.TerraformStack):
         #     not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
         #     you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
         #     you need to keep this like it is.
-        data_aws_ec2_managed_prefix_list_test_env_count = cdktf.TerraformCount.of(
-            cdktf.Fn.length_of(data_aws_ec2_managed_prefix_lists_test_env.ids))
-        data_aws_ec2_managed_prefix_list_test_env =
-        aws.data_aws_ec2_managed_prefix_list.DataAwsEc2ManagedPrefixList(self, "test_env_1",
-            id=cdktf.Token.as_string(
-                cdktf.property_access(
-                    cdktf.Fn.tolist(data_aws_ec2_managed_prefix_lists_test_env.ids), [data_aws_ec2_managed_prefix_list_test_env_count.index])),
-            count=data_aws_ec2_managed_prefix_list_test_env_count
+        test_env_count = TerraformCount.of(
+            Token.as_number(Fn.length_of(test_env.ids)))
+        data_aws_ec2_managed_prefix_list_test_env = DataAwsEc2ManagedPrefixList(self, "test_env_1",
+            id=Token.as_string(
+                Fn.lookup_nested(Fn.tolist(test_env.ids), [test_env_count.index])),
+            count=test_env_count
         )
         # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
         data_aws_ec2_managed_prefix_list_test_env.override_logical_id("test_env")
@@ -60,7 +63,9 @@ which take the following arguments:
 * `values` - (Required) Set of values that are accepted for the given field.
   A managed prefix list will be selected if any one of the given values matches.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - AWS Region.
 * `ids` - List of all the managed prefix list ids found.
@@ -71,4 +76,4 @@ which take the following arguments:
 
 - `read` - (Default `20m`)
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-34b67ee42a5e4e01675b0661ae691e66cc897092214d5887d7cc8ea40ac77b4a -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-145158f6b1f653afe1f39eba16c020b3a0c007043249f21a1109df310923bf6a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/ec2_network_insights_analysis.html.markdown b/website/docs/cdktf/python/d/ec2_network_insights_analysis.html.markdown
index eed346f74e5..0e62a08f9f1 100644
--- a/website/docs/cdktf/python/d/ec2_network_insights_analysis.html.markdown
+++ b/website/docs/cdktf/python/d/ec2_network_insights_analysis.html.markdown
@@ -6,16 +6,29 @@ description: |-
     Provides details about a specific Network Insights Analysis.
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Data Source: aws_ec2_network_insights_analysis
 
 `aws_ec2_network_insights_analysis` provides details about a specific Network Insights Analysis.
 
 ## Example Usage
 
-```terraform
-data "aws_ec2_network_insights_analysis" "example" {
-  network_insights_analysis_id = aws_ec2_network_insights_analysis.example.id
-}
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_ec2_network_insights_analysis import DataAwsEc2NetworkInsightsAnalysis
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsEc2NetworkInsightsAnalysis(self, "example",
+            network_insights_analysis_id=Token.as_string(aws_ec2_network_insights_analysis_example.id)
+        )
 ```
 
 ## Argument Reference
@@ -29,14 +42,14 @@ whose data will be exported as attributes.
 
 ### filter Configuration Block
 
-The following arguments are supported by the `filter` configuration block:
+The `filter` configuration block supports the following arguments:
 
 * `name` - (Required) Name of the filter field. Valid values can be found in the EC2 [`DescribeNetworkInsightsAnalyses`](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeNetworkInsightsAnalyses.html) API Reference.
 * `values` - (Required) Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `alternate_path_hints` - Potential intermediate components of a feasible path.
 * `arn` - ARN of the selected Network Insights Analysis.
@@ -51,4 +64,4 @@ In addition to all arguments above, the following attributes are exported:
 * `status_message` - Message to provide more context when the `status` is `failed`.
 * `warning_message` - Warning message.
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-56159c91965c21fbdc8ca0c6f12ca5f32b05dec8d3bf96c00e582befed10c93b -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-d7f40f52a0f576e9ad55308a3c0b7c20a1611a5a4641eb6f08ff3a89153793e8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/ec2_network_insights_path.html.markdown b/website/docs/cdktf/python/d/ec2_network_insights_path.html.markdown
index d55516021a1..36d0592fb84 100644
--- a/website/docs/cdktf/python/d/ec2_network_insights_path.html.markdown
+++ b/website/docs/cdktf/python/d/ec2_network_insights_path.html.markdown
@@ -6,16 +6,29 @@ description: |-
     Provides details about a specific Network Insights Path.
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Data Source: aws_ec2_network_insights_path
 
 `aws_ec2_network_insights_path` provides details about a specific Network Insights Path.
 
 ## Example Usage
 
-```terraform
-data "aws_ec2_network_insights_path" "example" {
-  network_insights_path_id = aws_ec2_network_insights_path.example.id
-}
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_ec2_network_insights_path import DataAwsEc2NetworkInsightsPath
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsEc2NetworkInsightsPath(self, "example",
+            network_insights_path_id=Token.as_string(aws_ec2_network_insights_path_example.id)
+        )
 ```
 
 ## Argument Reference
@@ -29,22 +42,24 @@ whose data will be exported as attributes.
 
 ### filter Configuration Block
 
-The following arguments are supported by the `filter` configuration block:
+The `filter` configuration block supports the following arguments:
 
 * `name` - (Required) Name of the filter field. Valid values can be found in the EC2 [`DescribeNetworkInsightsPaths`](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeNetworkInsightsPaths.html) API Reference.
 * `values` - (Required) Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the selected Network Insights Path.
 * `destination` - AWS resource that is the destination of the path.
+* `destination_arn` - ARN of the destination.
 * `destination_ip` - IP address of the AWS resource that is the destination of the path.
 * `destination_port` - Destination port.
 * `protocol` - Protocol.
 * `source` - AWS resource that is the source of the path.
+* `source_arn` - ARN of the source.
 * `source_ip` - IP address of the AWS resource that is the source of the path.
 * `tags` - Map of tags assigned to the resource.
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-017e47b8511c6e75a1a988c666c67e3fd15177c1f172912ddd91034adf7a15dc -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-445b5efe4c93146386518473af01d6da2f1f20f20f9a688cc7349f4a0720df0a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/ec2_public_ipv4_pool.html.markdown b/website/docs/cdktf/python/d/ec2_public_ipv4_pool.html.markdown
index ed3037f5406..82ef5650ac9 100644
--- a/website/docs/cdktf/python/d/ec2_public_ipv4_pool.html.markdown
+++ b/website/docs/cdktf/python/d/ec2_public_ipv4_pool.html.markdown
@@ -6,6 +6,8 @@ description: |-
   Provides details about a specific AWS EC2 Public IPv4 Pool.
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Data Source: aws_ec2_public_ipv4_pool
 
 Provides details about a specific AWS EC2 Public IPv4 Pool.
@@ -15,15 +17,18 @@ Provides details about a specific AWS EC2 Public IPv4 Pool.
 ### Basic Usage
 
 ```python
-import constructs as constructs
-import cdktf as cdktf
-# Provider bindings are generated by running cdktf get.
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
 # See https://cdk.tf/provider-generation for more details.
-import ...gen.providers.aws as aws
-class MyConvertedCode(cdktf.TerraformStack):
+#
+from imports.aws.data_aws_ec2_public_ipv4_pool import DataAwsEc2PublicIpv4Pool
+class MyConvertedCode(TerraformStack):
     def __init__(self, scope, name):
         super().__init__(scope, name)
-        aws.data_aws_ec2_public_ipv4_pool.DataAwsEc2PublicIpv4Pool(self, "example",
+        DataAwsEc2PublicIpv4Pool(self, "example",
             pool_id="ipv4pool-ec2-000df99cff0c1ec10"
         )
 ```
@@ -34,9 +39,9 @@ The following arguments are required:
 
 * `pool_id` - (Required) AWS resource IDs of a public IPv4 pool (as a string) for which this data source will fetch detailed information.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `description` - Description of the pool, if any.
 * `network_border_group` - Name of the location from which the address pool is advertised.
@@ -49,4 +54,4 @@ In addition to all arguments above, the following attributes are exported:
 * `total_address_count` - Total number of addresses in the pool.
 * `total_available_address_count` - Total number of available addresses in the pool.
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-6aa34590ccc7e3d0622ca88ec8ec1e0690413e3549fd336def6464c101e07acf -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-48bacd43b83d45d6042e5adf0821e82fae16e4191784bc09d4af47b05ff7cf8b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/ec2_public_ipv4_pools.html.markdown b/website/docs/cdktf/python/d/ec2_public_ipv4_pools.html.markdown
index f2e779ba37b..22c49b5486a 100644
--- a/website/docs/cdktf/python/d/ec2_public_ipv4_pools.html.markdown
+++ b/website/docs/cdktf/python/d/ec2_public_ipv4_pools.html.markdown
@@ -6,6 +6,8 @@ description: |-
   Terraform data source for getting information about AWS EC2 Public IPv4 Pools.
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Data Source: aws_ec2_public_ipv4_pools
 
 Terraform data source for getting information about AWS EC2 Public IPv4 Pools.
@@ -15,29 +17,35 @@ Terraform data source for getting information about AWS EC2 Public IPv4 Pools.
 ### Basic Usage
 
 ```python
-import constructs as constructs
-import cdktf as cdktf
-# Provider bindings are generated by running cdktf get.
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
 # See https://cdk.tf/provider-generation for more details.
-import ...gen.providers.aws as aws
-class MyConvertedCode(cdktf.TerraformStack):
+#
+from imports.aws.data_aws_ec2_public_ipv4_pools import DataAwsEc2PublicIpv4Pools
+class MyConvertedCode(TerraformStack):
     def __init__(self, scope, name):
         super().__init__(scope, name)
-        aws.data_aws_ec2_public_ipv4_pools.DataAwsEc2PublicIpv4Pools(self, "example")
+        DataAwsEc2PublicIpv4Pools(self, "example")
 ```
 
 ### Usage with Filter
 
 ```python
-import constructs as constructs
-import cdktf as cdktf
-# Provider bindings are generated by running cdktf get.
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
 # See https://cdk.tf/provider-generation for more details.
-import ...gen.providers.aws as aws
-class MyConvertedCode(cdktf.TerraformStack):
+#
+from imports.aws.data_aws_ec2_public_ipv4_pools import DataAwsEc2PublicIpv4Pools
+class MyConvertedCode(TerraformStack):
     def __init__(self, scope, name):
         super().__init__(scope, name)
-        aws.data_aws_ec2_public_ipv4_pools.DataAwsEc2PublicIpv4Pools(self, "example",
+        DataAwsEc2PublicIpv4Pools(self, "example",
             filter=[DataAwsEc2PublicIpv4PoolsFilter(
                 name="tag-key",
                 values=["ExampleTagKey"]
@@ -59,8 +67,10 @@ which take the following arguments:
 * `name` - (Required) Name of the field to filter by, as defined by [the underlying AWS API](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribePublicIpv4Pools.html).
 * `values` - (Required) Set of values that are accepted for the given field. Pool IDs will be selected if any one of the given values match.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `pool_ids` - List of all the pool IDs found.
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-497fd23718e9c3019ac0aba9d1ed2938cf04039c3919e0576a2f4fa8b45cc047 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-422bc757fd116f1b140b124c51e19d025c4072d60b8ea9e265213b729b246ca5 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/ec2_serial_console_access.html.markdown b/website/docs/cdktf/python/d/ec2_serial_console_access.html.markdown
index b3bd01b034d..d554614310c 100644
--- a/website/docs/cdktf/python/d/ec2_serial_console_access.html.markdown
+++ b/website/docs/cdktf/python/d/ec2_serial_console_access.html.markdown
@@ -6,6 +6,8 @@ description: |-
   Checks whether serial console access is enabled for your AWS account in the current AWS region.
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Data Source: aws_ec2_serial_console_access
 
 Provides a way to check whether serial console access is enabled for your AWS account in the current AWS region.
@@ -13,20 +15,23 @@ Provides a way to check whether serial console access is enabled for your AWS ac
 ## Example Usage
 
 ```python
-import constructs as constructs
-import cdktf as cdktf
-# Provider bindings are generated by running cdktf get.
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
 # See https://cdk.tf/provider-generation for more details.
-import ...gen.providers.aws as aws
-class MyConvertedCode(cdktf.TerraformStack):
+#
+from imports.aws.data_aws_ec2_serial_console_access import DataAwsEc2SerialConsoleAccess
+class MyConvertedCode(TerraformStack):
     def __init__(self, scope, name):
         super().__init__(scope, name)
-        aws.data_aws_ec2_serial_console_access.DataAwsEc2SerialConsoleAccess(self, "current")
+        DataAwsEc2SerialConsoleAccess(self, "current")
 ```
 
-## Attributes Reference
+## Attribute Reference
 
-The following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `enabled` - Whether or not serial console access is enabled. Returns as `true` or `false`.
 * `id` - Region of serial console access.
@@ -37,4 +42,4 @@ The following attributes are exported:
 
 - `read` - (Default `20m`)
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-fd8b4f696d0f003aee2404884112394191a210b2ad4bf6aac54e22a791bee4ed -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-7d21124aaffd09332def089cd0e6c69fdfa0c5c94678ee766395bb6fc343430d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/ec2_spot_price.html.markdown b/website/docs/cdktf/python/d/ec2_spot_price.html.markdown
index 6ec7e3ee99b..c10d86d2ad1 100644
--- a/website/docs/cdktf/python/d/ec2_spot_price.html.markdown
+++ b/website/docs/cdktf/python/d/ec2_spot_price.html.markdown
@@ -6,6 +6,8 @@ description: |-
   Information about most recent Spot Price for a given EC2 instance.
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Data Source: aws_ec2_spot_price
 
 Information about most recent Spot Price for a given EC2 instance.
@@ -13,15 +15,18 @@ Information about most recent Spot Price for a given EC2 instance.
 ## Example Usage
 
 ```python
-import constructs as constructs
-import cdktf as cdktf
-# Provider bindings are generated by running cdktf get.
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
 # See https://cdk.tf/provider-generation for more details.
-import ...gen.providers.aws as aws
-class MyConvertedCode(cdktf.TerraformStack):
+#
+from imports.aws.data_aws_ec2_spot_price import DataAwsEc2SpotPrice
+class MyConvertedCode(TerraformStack):
     def __init__(self, scope, name):
         super().__init__(scope, name)
-        aws.data_aws_ec2_spot_price.DataAwsEc2SpotPrice(self, "example",
+        DataAwsEc2SpotPrice(self, "example",
             availability_zone="us-west-2a",
             filter=[DataAwsEc2SpotPriceFilter(
                 name="product-description",
@@ -34,7 +39,7 @@ class MyConvertedCode(cdktf.TerraformStack):
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `instance_type` - (Optional) Type of instance for which to query Spot Price information.
 * `availability_zone` - (Optional) Availability zone in which to query Spot price information.
@@ -47,7 +52,7 @@ The following arguments are supported:
 
 ## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - AWS Region.
 * `spot_price` - Most recent Spot Price value for the given instance type and AZ.
@@ -59,4 +64,4 @@ In addition to all arguments above, the following attributes are exported:
 
 - `read` - (Default `20m`)
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-5f57429f9fe1e4ba33e515d8d643d119473ff58bb60dd4d219c499ffaa02b9c9 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-84288ca39edef310f32dba7504a9418ce015393e96eb2b8cc8a803eca06e4db4 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/ec2_transit_gateway.html.markdown b/website/docs/cdktf/python/d/ec2_transit_gateway.html.markdown
index db3fcdb43ce..62aaa1285e3 100644
--- a/website/docs/cdktf/python/d/ec2_transit_gateway.html.markdown
+++ b/website/docs/cdktf/python/d/ec2_transit_gateway.html.markdown
@@ -6,6 +6,8 @@ description: |-
   Get information on an EC2 Transit Gateway
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Data Source: aws_ec2_transit_gateway
 
 Get information on an EC2 Transit Gateway.
@@ -15,15 +17,18 @@ Get information on an EC2 Transit Gateway.
 ### By Filter
 
 ```python
-import constructs as constructs
-import cdktf as cdktf
-# Provider bindings are generated by running cdktf get.
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
 # See https://cdk.tf/provider-generation for more details.
-import ...gen.providers.aws as aws
-class MyConvertedCode(cdktf.TerraformStack):
+#
+from imports.aws.data_aws_ec2_transit_gateway import DataAwsEc2TransitGateway
+class MyConvertedCode(TerraformStack):
     def __init__(self, scope, name):
         super().__init__(scope, name)
-        aws.data_aws_ec2_transit_gateway.DataAwsEc2TransitGateway(self, "example",
+        DataAwsEc2TransitGateway(self, "example",
             filter=[DataAwsEc2TransitGatewayFilter(
                 name="options.amazon-side-asn",
                 values=["64512"]
@@ -35,22 +40,25 @@ class MyConvertedCode(cdktf.TerraformStack):
 ### By Identifier
 
 ```python
-import constructs as constructs
-import cdktf as cdktf
-# Provider bindings are generated by running cdktf get.
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
 # See https://cdk.tf/provider-generation for more details.
-import ...gen.providers.aws as aws
-class MyConvertedCode(cdktf.TerraformStack):
+#
+from imports.aws.data_aws_ec2_transit_gateway import DataAwsEc2TransitGateway
+class MyConvertedCode(TerraformStack):
     def __init__(self, scope, name):
         super().__init__(scope, name)
-        aws.data_aws_ec2_transit_gateway.DataAwsEc2TransitGateway(self, "example",
+        DataAwsEc2TransitGateway(self, "example",
             id="tgw-12345678"
         )
 ```
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `filter` - (Optional) One or more configuration blocks containing name-values filters. Detailed below.
 * `id` - (Optional) Identifier of the EC2 Transit Gateway.
@@ -62,7 +70,7 @@ The following arguments are supported:
 
 ## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `amazon_side_asn` - Private Autonomous System Number (ASN) for the Amazon side of a BGP session
 * `arn` - EC2 Transit Gateway ARN
@@ -86,4 +94,4 @@ In addition to all arguments above, the following attributes are exported:
 
 - `read` - (Default `20m`)
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-e24eaaf1aa0b28a091689ddfaeaf01ceb3851faa3d8dd0eefba334e1fd10a072 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-ffa9ee3ddd9d388f5e2e15cbd5dbf081b080b3ce321303e9a320db13aad75c6f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/ec2_transit_gateway_attachment.html.markdown b/website/docs/cdktf/python/d/ec2_transit_gateway_attachment.html.markdown
index 62925f85bd4..d1fc03b915b 100644
--- a/website/docs/cdktf/python/d/ec2_transit_gateway_attachment.html.markdown
+++ b/website/docs/cdktf/python/d/ec2_transit_gateway_attachment.html.markdown
@@ -6,29 +6,41 @@ description: |-
   Get information on an EC2 Transit Gateway's attachment to a resource
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Data Source: aws_ec2_transit_gateway_attachment
 
 Get information on an EC2 Transit Gateway's attachment to a resource.
 
 ## Example Usage
 
-```terraform
-data "aws_ec2_transit_gateway_attachment" "example" {
-  filter {
-    name   = "transit-gateway-id"
-    values = [aws_ec2_transit_gateway.example.id]
-  }
-
-  filter {
-    name   = "resource-type"
-    values = ["peering"]
-  }
-}
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_ec2_transit_gateway_attachment import DataAwsEc2TransitGatewayAttachment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsEc2TransitGatewayAttachment(self, "example",
+            filter=[DataAwsEc2TransitGatewayAttachmentFilter(
+                name="transit-gateway-id",
+                values=[Token.as_string(aws_ec2_transit_gateway_example.id)]
+            ), DataAwsEc2TransitGatewayAttachmentFilter(
+                name="resource-type",
+                values=["peering"]
+            )
+            ]
+        )
 ```
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `filter` - (Optional) One or more configuration blocks containing name-values filters. Detailed below.
 * `transit_gateway_attachment_id` - (Optional) ID of the attachment.
@@ -40,7 +52,7 @@ The following arguments are supported:
 
 ## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the attachment.
 * `association_state` - The state of the association (see [the underlying AWS API](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_TransitGatewayAttachmentAssociation.html) for valid values).
@@ -53,4 +65,4 @@ In addition to all arguments above, the following attributes are exported:
 * `transit_gateway_id` - ID of the transit gateway.
 * `transit_gateway_owner_id` - The ID of the AWS account that owns the transit gateway.
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-1d6871537e0fdef0517b26c6418ac11cc1adeef6a7e98b29bb413da70c0a8517 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-855174ba9f5d7c6a547c955bd66cf3e3934a1b368d1480c66e0d166837fd5797 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/ec2_transit_gateway_attachments.html.markdown b/website/docs/cdktf/python/d/ec2_transit_gateway_attachments.html.markdown
index 5cf23027ab9..3c0682766ec 100644
--- a/website/docs/cdktf/python/d/ec2_transit_gateway_attachments.html.markdown
+++ b/website/docs/cdktf/python/d/ec2_transit_gateway_attachments.html.markdown
@@ -6,6 +6,8 @@ description: |-
   Get information on EC2 Transit Gateway Attachments
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Data Source: aws_ec2_transit_gateway_attachments
 
 Get information on EC2 Transit Gateway Attachments.
@@ -14,28 +16,44 @@ Get information on EC2 Transit Gateway Attachments.
 
 ### By Filter
 
-```hcl
-data "aws_ec2_transit_gateway_attachments" "filtered" {
-  filter {
-    name   = "state"
-    values = ["pendingAcceptance"]
-  }
-
-  filter {
-    name   = "resource-type"
-    values = ["vpc"]
-  }
-}
-
-data "aws_ec2_transit_gateway_attachment" "unit" {
-  count = length(data.aws_ec2_transit_gateway_attachments.filtered.ids)
-  id    = data.aws_ec2_transit_gateway_attachments.filtered.ids[count.index]
-}
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformCount, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_ec2_transit_gateway_attachment import DataAwsEc2TransitGatewayAttachment
+from imports.aws.data_aws_ec2_transit_gateway_attachments import DataAwsEc2TransitGatewayAttachments
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        filtered = DataAwsEc2TransitGatewayAttachments(self, "filtered",
+            filter=[DataAwsEc2TransitGatewayAttachmentsFilter(
+                name="state",
+                values=["pendingAcceptance"]
+            ), DataAwsEc2TransitGatewayAttachmentsFilter(
+                name="resource-type",
+                values=["vpc"]
+            )
+            ]
+        )
+        # In most cases loops should be handled in the programming language context and
+        #     not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+        #     you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+        #     you need to keep this like it is.
+        unit_count = TerraformCount.of(
+            Token.as_number(Fn.length_of(filtered.ids)))
+        DataAwsEc2TransitGatewayAttachment(self, "unit",
+            id=Token.as_string(Fn.lookup_nested(filtered.ids, [unit_count.index])),
+            count=unit_count
+        )
 ```
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `filter` - (Optional) One or more configuration blocks containing name-values filters. Detailed below.
 
@@ -46,7 +64,7 @@ The following arguments are supported:
 
 ## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `ids` A list of all attachments ids matching the filter. You can retrieve more information about the attachment using the [aws_ec2_transit_gateway_attachment][2] data source, searching by identifier.
 
@@ -59,4 +77,4 @@ In addition to all arguments above, the following attributes are exported:
 
 - `read` - (Default `20m`)
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-5aab4b9996d301d85a81444ffb46bbaa0a94e492c4d5d3b1c1df96c4c03b5905 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-d711b87a1b40869313a118f25c07038992c92b0b5b1accc3b33147f75288e032 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/ec2_transit_gateway_connect.html.markdown b/website/docs/cdktf/python/d/ec2_transit_gateway_connect.html.markdown
index 77a2acc4f3e..81267315cbf 100644
--- a/website/docs/cdktf/python/d/ec2_transit_gateway_connect.html.markdown
+++ b/website/docs/cdktf/python/d/ec2_transit_gateway_connect.html.markdown
@@ -6,6 +6,8 @@ description: |-
   Get information on an EC2 Transit Gateway Connect
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Data Source: aws_ec2_transit_gateway_connect
 
 Get information on an EC2 Transit Gateway Connect.
@@ -15,15 +17,18 @@ Get information on an EC2 Transit Gateway Connect.
 ### By Filter
 
 ```python
-import constructs as constructs
-import cdktf as cdktf
-# Provider bindings are generated by running cdktf get.
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
 # See https://cdk.tf/provider-generation for more details.
-import ...gen.providers.aws as aws
-class MyConvertedCode(cdktf.TerraformStack):
+#
+from imports.aws.data_aws_ec2_transit_gateway_connect import DataAwsEc2TransitGatewayConnect
+class MyConvertedCode(TerraformStack):
     def __init__(self, scope, name):
         super().__init__(scope, name)
-        aws.data_aws_ec2_transit_gateway_connect.DataAwsEc2TransitGatewayConnect(self, "example",
+        DataAwsEc2TransitGatewayConnect(self, "example",
             filter=[DataAwsEc2TransitGatewayConnectFilter(
                 name="transport-transit-gateway-attachment-id",
                 values=["tgw-attach-12345678"]
@@ -35,22 +40,25 @@ class MyConvertedCode(cdktf.TerraformStack):
 ### By Identifier
 
 ```python
-import constructs as constructs
-import cdktf as cdktf
-# Provider bindings are generated by running cdktf get.
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
 # See https://cdk.tf/provider-generation for more details.
-import ...gen.providers.aws as aws
-class MyConvertedCode(cdktf.TerraformStack):
+#
+from imports.aws.data_aws_ec2_transit_gateway_connect import DataAwsEc2TransitGatewayConnect
+class MyConvertedCode(TerraformStack):
     def __init__(self, scope, name):
         super().__init__(scope, name)
-        aws.data_aws_ec2_transit_gateway_connect.DataAwsEc2TransitGatewayConnect(self, "example",
+        DataAwsEc2TransitGatewayConnect(self, "example",
             transit_gateway_connect_id="tgw-attach-12345678"
         )
 ```
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `filter` - (Optional) One or more configuration blocks containing name-values filters. Detailed below.
 * `transit_gateway_connect_id` - (Optional) Identifier of the EC2 Transit Gateway Connect.
@@ -62,7 +70,7 @@ The following arguments are supported:
 
 ## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `protocol` - Tunnel protocol
 * `tags` - Key-value tags for the EC2 Transit Gateway Connect
@@ -75,4 +83,4 @@ In addition to all arguments above, the following attributes are exported:
 
 - `read` - (Default `20m`)
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-e8f48ffb39a79e25f21e27492ff83b8d5204dffc24108324f1f587842ad3aa9e -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-9d1721683744b25e4682599f551444c6d51b4984d022443ff5e7b4565ef4e5bd -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/ec2_transit_gateway_connect_peer.html.markdown b/website/docs/cdktf/python/d/ec2_transit_gateway_connect_peer.html.markdown
index 7f82e400e85..d2d6965db44 100644
--- a/website/docs/cdktf/python/d/ec2_transit_gateway_connect_peer.html.markdown
+++ b/website/docs/cdktf/python/d/ec2_transit_gateway_connect_peer.html.markdown
@@ -6,6 +6,8 @@ description: |-
   Get information on an EC2 Transit Gateway Connect Peer
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Data Source: aws_ec2_transit_gateway_connect_peer
 
 Get information on an EC2 Transit Gateway Connect Peer.
@@ -15,15 +17,18 @@ Get information on an EC2 Transit Gateway Connect Peer.
 ### By Filter
 
 ```python
-import constructs as constructs
-import cdktf as cdktf
-# Provider bindings are generated by running cdktf get.
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
 # See https://cdk.tf/provider-generation for more details.
-import ...gen.providers.aws as aws
-class MyConvertedCode(cdktf.TerraformStack):
+#
+from imports.aws.data_aws_ec2_transit_gateway_connect_peer import DataAwsEc2TransitGatewayConnectPeer
+class MyConvertedCode(TerraformStack):
     def __init__(self, scope, name):
         super().__init__(scope, name)
-        aws.data_aws_ec2_transit_gateway_connect_peer.DataAwsEc2TransitGatewayConnectPeer(self, "example",
+        DataAwsEc2TransitGatewayConnectPeer(self, "example",
             filter=[DataAwsEc2TransitGatewayConnectPeerFilter(
                 name="transit-gateway-attachment-id",
                 values=["tgw-attach-12345678"]
@@ -35,22 +40,25 @@ class MyConvertedCode(cdktf.TerraformStack):
 ### By Identifier
 
 ```python
-import constructs as constructs
-import cdktf as cdktf
-# Provider bindings are generated by running cdktf get.
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
 # See https://cdk.tf/provider-generation for more details.
-import ...gen.providers.aws as aws
-class MyConvertedCode(cdktf.TerraformStack):
+#
+from imports.aws.data_aws_ec2_transit_gateway_connect_peer import DataAwsEc2TransitGatewayConnectPeer
+class MyConvertedCode(TerraformStack):
     def __init__(self, scope, name):
         super().__init__(scope, name)
-        aws.data_aws_ec2_transit_gateway_connect_peer.DataAwsEc2TransitGatewayConnectPeer(self, "example",
+        DataAwsEc2TransitGatewayConnectPeer(self, "example",
             transit_gateway_connect_peer_id="tgw-connect-peer-12345678"
         )
 ```
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `filter` - (Optional) One or more configuration blocks containing name-values filters. Detailed below.
 * `transit_gateway_connect_peer_id` - (Optional) Identifier of the EC2 Transit Gateway Connect Peer.
@@ -62,10 +70,12 @@ The following arguments are supported:
 
 ## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - EC2 Transit Gateway Connect Peer ARN
 * `bgp_asn` - BGP ASN number assigned customer device
+* `bgp_peer_address` - The IP address assigned to customer device, which is used as BGP IP address.
+* `bgp_transit_gateway_addresses` - The IP addresses assigned to Transit Gateway, which are used as BGP IP addresses.
 * `inside_cidr_blocks` - CIDR blocks that will be used for addressing within the tunnel.
 * `peer_address` - IP addressed assigned to customer device, which is used as tunnel endpoint
 * `tags` - Key-value tags for the EC2 Transit Gateway Connect Peer
@@ -78,4 +88,4 @@ In addition to all arguments above, the following attributes are exported:
 
 - `read` - (Default `20m`)
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-8222b615e033f6fd67548f593586fe3af7c94748dd48b5242ba15bf81d464fe3 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-3bd4c9e7e6f26191e1ea71278ee4046a31a2441aa9d86a38639bf000e83931d8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/ec2_transit_gateway_dx_gateway_attachment.html.markdown b/website/docs/cdktf/python/d/ec2_transit_gateway_dx_gateway_attachment.html.markdown
index 76ccb6872d5..6821d0f468a 100644
--- a/website/docs/cdktf/python/d/ec2_transit_gateway_dx_gateway_attachment.html.markdown
+++ b/website/docs/cdktf/python/d/ec2_transit_gateway_dx_gateway_attachment.html.markdown
@@ -6,6 +6,8 @@ description: |-
   Get information on an EC2 Transit Gateway's attachment to a Direct Connect Gateway
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Data Source: aws_ec2_transit_gateway_dx_gateway_attachment
 
 Get information on an EC2 Transit Gateway's attachment to a Direct Connect Gateway.
@@ -14,16 +16,27 @@ Get information on an EC2 Transit Gateway's attachment to a Direct Connect Gatew
 
 ### By Transit Gateway and Direct Connect Gateway Identifiers
 
-```terraform
-data "aws_ec2_transit_gateway_dx_gateway_attachment" "example" {
-  transit_gateway_id = aws_ec2_transit_gateway.example.id
-  dx_gateway_id      = aws_dx_gateway.example.id
-}
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_ec2_transit_gateway_dx_gateway_attachment import DataAwsEc2TransitGatewayDxGatewayAttachment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsEc2TransitGatewayDxGatewayAttachment(self, "example",
+            dx_gateway_id=Token.as_string(aws_dx_gateway_example.id),
+            transit_gateway_id=Token.as_string(aws_ec2_transit_gateway_example.id)
+        )
 ```
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `transit_gateway_id` - (Optional) Identifier of the EC2 Transit Gateway.
 * `dx_gateway_id` - (Optional) Identifier of the Direct Connect Gateway.
@@ -32,14 +45,14 @@ The following arguments are supported:
 
 ### filter Configuration Block
 
-The following arguments are supported by the `filter` configuration block:
+The `filter` configuration block supports the following arguments:
 
 * `name` - (Required) Name of the filter field. Valid values can be found in the [EC2 DescribeTransitGatewayAttachments API Reference](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeTransitGatewayAttachments.html).
 * `values` - (Required) Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
 
 ## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - EC2 Transit Gateway Attachment identifier
 * `tags` - Key-value tags for the EC2 Transit Gateway Attachment
@@ -50,4 +63,4 @@ In addition to all arguments above, the following attributes are exported:
 
 - `read` - (Default `20m`)
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-24342787a3ce635e686cc7f106a91787a880dd41a77e294e579c6c74e8174823 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-b7236cdedf33b2a2beaa76c047f8a0d2b5a1cc86432e1675ff18f61961098d3d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/ec2_transit_gateway_multicast_domain.html.markdown b/website/docs/cdktf/python/d/ec2_transit_gateway_multicast_domain.html.markdown
index 6bcf5d5f5a4..09662befda5 100644
--- a/website/docs/cdktf/python/d/ec2_transit_gateway_multicast_domain.html.markdown
+++ b/website/docs/cdktf/python/d/ec2_transit_gateway_multicast_domain.html.markdown
@@ -6,6 +6,8 @@ description: |-
   Get information on an EC2 Transit Gateway Multicast Domain
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Data Source: aws_ec2_transit_gateway_multicast_domain
 
 Get information on an EC2 Transit Gateway Multicast Domain.
@@ -15,15 +17,18 @@ Get information on an EC2 Transit Gateway Multicast Domain.
 ### By Filter
 
 ```python
-import constructs as constructs
-import cdktf as cdktf
-# Provider bindings are generated by running cdktf get.
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
 # See https://cdk.tf/provider-generation for more details.
-import ...gen.providers.aws as aws
-class MyConvertedCode(cdktf.TerraformStack):
+#
+from imports.aws.data_aws_ec2_transit_gateway_multicast_domain import DataAwsEc2TransitGatewayMulticastDomain
+class MyConvertedCode(TerraformStack):
     def __init__(self, scope, name):
         super().__init__(scope, name)
-        aws.data_aws_ec2_transit_gateway_multicast_domain.DataAwsEc2TransitGatewayMulticastDomain(self, "example",
+        DataAwsEc2TransitGatewayMulticastDomain(self, "example",
             filter=[DataAwsEc2TransitGatewayMulticastDomainFilter(
                 name="transit-gateway-multicast-domain-id",
                 values=["tgw-mcast-domain-12345678"]
@@ -35,22 +40,25 @@ class MyConvertedCode(cdktf.TerraformStack):
 ### By Identifier
 
 ```python
-import constructs as constructs
-import cdktf as cdktf
-# Provider bindings are generated by running cdktf get.
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
 # See https://cdk.tf/provider-generation for more details.
-import ...gen.providers.aws as aws
-class MyConvertedCode(cdktf.TerraformStack):
+#
+from imports.aws.data_aws_ec2_transit_gateway_multicast_domain import DataAwsEc2TransitGatewayMulticastDomain
+class MyConvertedCode(TerraformStack):
     def __init__(self, scope, name):
         super().__init__(scope, name)
-        aws.data_aws_ec2_transit_gateway_multicast_domain.DataAwsEc2TransitGatewayMulticastDomain(self, "example",
+        DataAwsEc2TransitGatewayMulticastDomain(self, "example",
             transit_gateway_multicast_domain_id="tgw-mcast-domain-12345678"
         )
 ```
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `filter` - (Optional) One or more configuration blocks containing name-values filters. Detailed below.
 * `transit_gateway_multicast_domain_id` - (Optional) Identifier of the EC2 Transit Gateway Multicast Domain.
@@ -66,7 +74,7 @@ The following arguments are required:
 
 ## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - EC2 Transit Gateway Multicast Domain identifier.
 * `arn` - EC2 Transit Gateway Multicast Domain ARN.
@@ -92,4 +100,4 @@ In addition to all arguments above, the following attributes are exported:
 
 - `read` - (Default `20m`)
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-7fcf121a6afa9b103a4a9aa8daf6635896a64eb12f56c34cc8bd881e1042d110 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-854de9a7e77b920dc2a59508efed1e997a904be759a67e383d582356d4c4d937 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/ec2_transit_gateway_peering_attachment.html.markdown b/website/docs/cdktf/python/d/ec2_transit_gateway_peering_attachment.html.markdown
index 51d5ad58170..3777dace03e 100644
--- a/website/docs/cdktf/python/d/ec2_transit_gateway_peering_attachment.html.markdown
+++ b/website/docs/cdktf/python/d/ec2_transit_gateway_peering_attachment.html.markdown
@@ -6,6 +6,8 @@ description: |-
   Get information on an EC2 Transit Gateway Peering Attachment
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Data Source: aws_ec2_transit_gateway_peering_attachment
 
 Get information on an EC2 Transit Gateway Peering Attachment.
@@ -15,15 +17,18 @@ Get information on an EC2 Transit Gateway Peering Attachment.
 ### By Filter
 
 ```python
-import constructs as constructs
-import cdktf as cdktf
-# Provider bindings are generated by running cdktf get.
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
 # See https://cdk.tf/provider-generation for more details.
-import ...gen.providers.aws as aws
-class MyConvertedCode(cdktf.TerraformStack):
+#
+from imports.aws.data_aws_ec2_transit_gateway_peering_attachment import DataAwsEc2TransitGatewayPeeringAttachment
+class MyConvertedCode(TerraformStack):
     def __init__(self, scope, name):
         super().__init__(scope, name)
-        aws.data_aws_ec2_transit_gateway_peering_attachment.DataAwsEc2TransitGatewayPeeringAttachment(self, "example",
+        DataAwsEc2TransitGatewayPeeringAttachment(self, "example",
             filter=[DataAwsEc2TransitGatewayPeeringAttachmentFilter(
                 name="transit-gateway-attachment-id",
                 values=["tgw-attach-12345678"]
@@ -35,22 +40,25 @@ class MyConvertedCode(cdktf.TerraformStack):
 ### By Identifier
 
 ```python
-import constructs as constructs
-import cdktf as cdktf
-# Provider bindings are generated by running cdktf get.
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
 # See https://cdk.tf/provider-generation for more details.
-import ...gen.providers.aws as aws
-class MyConvertedCode(cdktf.TerraformStack):
+#
+from imports.aws.data_aws_ec2_transit_gateway_peering_attachment import DataAwsEc2TransitGatewayPeeringAttachment
+class MyConvertedCode(TerraformStack):
     def __init__(self, scope, name):
         super().__init__(scope, name)
-        aws.data_aws_ec2_transit_gateway_peering_attachment.DataAwsEc2TransitGatewayPeeringAttachment(self, "attachment",
+        DataAwsEc2TransitGatewayPeeringAttachment(self, "attachment",
             id="tgw-attach-12345678"
         )
 ```
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `filter` - (Optional) One or more configuration blocks containing name-values filters. Detailed below.
 * `id` - (Optional) Identifier of the EC2 Transit Gateway Peering Attachment.
@@ -67,7 +75,7 @@ which take the following arguments:
 
 ## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `peer_account_id` - Identifier of the peer AWS account
 * `peer_region` - Identifier of the peer AWS region
@@ -80,4 +88,4 @@ In addition to all arguments above, the following attributes are exported:
 
 - `read` - (Default `20m`)
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-070f687dc6ea215734d45f7c1eda427968f4bc99d8b79e65dcd8d643efb5d83c -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-64a386696c78ec2309a46c70c800259471a55f51d87aca95430609381da1032a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/ec2_transit_gateway_route_table.html.markdown b/website/docs/cdktf/python/d/ec2_transit_gateway_route_table.html.markdown
index fd856512692..4d0506aadc9 100644
--- a/website/docs/cdktf/python/d/ec2_transit_gateway_route_table.html.markdown
+++ b/website/docs/cdktf/python/d/ec2_transit_gateway_route_table.html.markdown
@@ -6,6 +6,8 @@ description: |-
   Get information on an EC2 Transit Gateway Route Table
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Data Source: aws_ec2_transit_gateway_route_table
 
 Get information on an EC2 Transit Gateway Route Table.
@@ -15,15 +17,18 @@ Get information on an EC2 Transit Gateway Route Table.
 ### By Filter
 
 ```python
-import constructs as constructs
-import cdktf as cdktf
-# Provider bindings are generated by running cdktf get.
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
 # See https://cdk.tf/provider-generation for more details.
-import ...gen.providers.aws as aws
-class MyConvertedCode(cdktf.TerraformStack):
+#
+from imports.aws.data_aws_ec2_transit_gateway_route_table import DataAwsEc2TransitGatewayRouteTable
+class MyConvertedCode(TerraformStack):
     def __init__(self, scope, name):
         super().__init__(scope, name)
-        aws.data_aws_ec2_transit_gateway_route_table.DataAwsEc2TransitGatewayRouteTable(self, "example",
+        DataAwsEc2TransitGatewayRouteTable(self, "example",
             filter=[DataAwsEc2TransitGatewayRouteTableFilter(
                 name="default-association-route-table",
                 values=["true"]
@@ -38,22 +43,25 @@ class MyConvertedCode(cdktf.TerraformStack):
 ### By Identifier
 
 ```python
-import constructs as constructs
-import cdktf as cdktf
-# Provider bindings are generated by running cdktf get.
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
 # See https://cdk.tf/provider-generation for more details.
-import ...gen.providers.aws as aws
-class MyConvertedCode(cdktf.TerraformStack):
+#
+from imports.aws.data_aws_ec2_transit_gateway_route_table import DataAwsEc2TransitGatewayRouteTable
+class MyConvertedCode(TerraformStack):
     def __init__(self, scope, name):
         super().__init__(scope, name)
-        aws.data_aws_ec2_transit_gateway_route_table.DataAwsEc2TransitGatewayRouteTable(self, "example",
+        DataAwsEc2TransitGatewayRouteTable(self, "example",
             id="tgw-rtb-12345678"
         )
 ```
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `filter` - (Optional) One or more configuration blocks containing name-values filters. Detailed below.
 * `id` - (Optional) Identifier of the EC2 Transit Gateway Route Table.
@@ -65,7 +73,7 @@ The following arguments are supported:
 
 ## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - EC2 Transit Gateway Route Table ARN.
 * `default_association_route_table` - Boolean whether this is the default association route table for the EC2 Transit Gateway
@@ -80,4 +88,4 @@ In addition to all arguments above, the following attributes are exported:
 
 - `read` - (Default `20m`)
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-1208f03f1c84c0e2ce61d9b6b1a78aed169974d74a04009ae9e848da55024189 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-64c18727eda903f3fe0bc6e70c5f6f2c068e6f4cc7b9427d36d59676ca309a0a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/ec2_transit_gateway_route_table_associations.html.markdown b/website/docs/cdktf/python/d/ec2_transit_gateway_route_table_associations.html.markdown
index 7f8572ce6b2..f342f158979 100644
--- a/website/docs/cdktf/python/d/ec2_transit_gateway_route_table_associations.html.markdown
+++ b/website/docs/cdktf/python/d/ec2_transit_gateway_route_table_associations.html.markdown
@@ -6,6 +6,8 @@ description: |-
    Provides information for multiple EC2 Transit Gateway Route Table Associations
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Data Source: aws_ec2_transit_gateway_route_table_associations
 
 Provides information for multiple EC2 Transit Gateway Route Table Associations, such as their identifiers.
@@ -14,10 +16,21 @@ Provides information for multiple EC2 Transit Gateway Route Table Associations,
 
 ### By Transit Gateway Identifier
 
-```terraform
-data "aws_ec2_transit_gateway_route_table_associations" "example" {
-  transit_gateway_route_table_id = aws_ec2_transit_gateway_route_table.example.id
-}
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_ec2_transit_gateway_route_table_associations import DataAwsEc2TransitGatewayRouteTableAssociations
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsEc2TransitGatewayRouteTableAssociations(self, "example",
+            transit_gateway_route_table_id=Token.as_string(aws_ec2_transit_gateway_route_table_example.id)
+        )
 ```
 
 ## Argument Reference
@@ -39,11 +52,11 @@ which take the following arguments:
 * `values` - (Required) Set of values that are accepted for the given field.
   A Transit Gateway Route Table will be selected if any one of the given values matches.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - AWS Region.
 * `ids` - Set of Transit Gateway Route Table Association identifiers.
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-f5431c712bc460939eff4f13ee315f6c314d3bbb3a79a668ec2278449b7548b6 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-bfa58264f45212830b07dd741569d6e94ca91a2bd3663b4e9cf46da0d1431ddd -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/ec2_transit_gateway_route_table_propagations.html.markdown b/website/docs/cdktf/python/d/ec2_transit_gateway_route_table_propagations.html.markdown
index 957a13f48bc..c44b371f8ed 100644
--- a/website/docs/cdktf/python/d/ec2_transit_gateway_route_table_propagations.html.markdown
+++ b/website/docs/cdktf/python/d/ec2_transit_gateway_route_table_propagations.html.markdown
@@ -6,6 +6,8 @@ description: |-
    Provides information for multiple EC2 Transit Gateway Route Table Propagations
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Data Source: aws_ec2_transitgateway_route_table_propagations
 
 Provides information for multiple EC2 Transit Gateway Route Table Propagations, such as their identifiers.
@@ -14,10 +16,21 @@ Provides information for multiple EC2 Transit Gateway Route Table Propagations,
 
 ### By Transit Gateway Identifier
 
-```terraform
-data "aws_ec2_transit_gateway_route_table_propagations" "example" {
-  transit_gateway_route_table_id = aws_ec2_transit_gateway_route_table.example.id
-}
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_ec2_transit_gateway_route_table_propagations import DataAwsEc2TransitGatewayRouteTablePropagations
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsEc2TransitGatewayRouteTablePropagations(self, "example",
+            transit_gateway_route_table_id=Token.as_string(aws_ec2_transit_gateway_route_table_example.id)
+        )
 ```
 
 ## Argument Reference
@@ -39,11 +52,11 @@ which take the following arguments:
 * `values` - (Required) Set of values that are accepted for the given field.
   A Transit Gateway Route Table will be selected if any one of the given values matches.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - AWS Region.
 * `ids` - Set of Transit Gateway Route Table Association identifiers.
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-a62abe28e531fd8e1af6114d984180c2997a6bff69c0a5c03d6e3a0644a3e17c -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-7e2c8e286fe68a0b28268b36f5ee1907ae2dd7e9634ec2582746d0b7fe00b544 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/ec2_transit_gateway_route_table_routes.html.markdown b/website/docs/cdktf/python/d/ec2_transit_gateway_route_table_routes.html.markdown
new file mode 100644
index 00000000000..08cc0872c94
--- /dev/null
+++ b/website/docs/cdktf/python/d/ec2_transit_gateway_route_table_routes.html.markdown
@@ -0,0 +1,283 @@
+---
+subcategory: "Transit Gateway"
+layout: "aws"
+page_title: "AWS: aws_ec2_transit_gateway_route_table_routes"
+description: |-
+   Provides informations for routes of a specific transit gateway
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_ec2_transit_gateway_route_table_routes
+
+Provides informations for routes of a specific transit gateway, such as state, type, cidr
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_ec2_transit_gateway_route_table_routes import DataAwsEc2TransitGatewayRouteTableRoutes
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsEc2TransitGatewayRouteTableRoutes(self, "test",
+            filter=[DataAwsEc2TransitGatewayRouteTableRoutesFilter(
+                name="type",
+                values=["propagated"]
+            )
+            ],
+            transit_gateway_route_table_id=example.id
+        )
+```
+
+### Complexe use case with transit gateway peering
+
+This example allow to create a mesh of transit gateway for différent regions routing all traffic to on-prem VPN
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from cdktf import TerraformResourceLifecycle
+from constructs import Construct
+from cdktf import Token, Fn, TerraformIterator, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_ec2_transit_gateway_route_table_routes import DataAwsEc2TransitGatewayRouteTableRoutes
+from imports.aws.data_aws_ec2_transit_gateway_vpc_attachment import DataAwsEc2TransitGatewayVpcAttachment
+from imports.aws.data_aws_ec2_transit_gateway_vpc_attachments import DataAwsEc2TransitGatewayVpcAttachments
+from imports.aws.ec2_transit_gateway import Ec2TransitGateway
+from imports.aws.ec2_transit_gateway_peering_attachment import Ec2TransitGatewayPeeringAttachment
+from imports.aws.ec2_transit_gateway_peering_attachment_accepter import Ec2TransitGatewayPeeringAttachmentAccepter
+from imports.aws.ec2_transit_gateway_route import Ec2TransitGatewayRoute
+from imports.aws.ec2_transit_gateway_route_table import Ec2TransitGatewayRouteTable
+from imports.aws.ec2_transit_gateway_route_table_association import Ec2TransitGatewayRouteTableAssociation
+from imports.aws.ec2_transit_gateway_route_table_propagation import Ec2TransitGatewayRouteTablePropagation
+from imports.aws.ec2_transit_gateway_vpc_attachment import Ec2TransitGatewayVpcAttachment
+from imports.aws.ec2_transit_gateway_vpc_attachment_accepter import Ec2TransitGatewayVpcAttachmentAccepter
+from imports.aws.provider import AwsProvider
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        eu_central1 = AwsProvider(self, "aws",
+            alias="eu-central-1",
+            region="eu-central-1"
+        )
+        aws_ec2_transit_gateway_eu_central1 = Ec2TransitGateway(self, "eu-central-1",
+            default_route_table_association="disable",
+            default_route_table_propagation="disable",
+            provider=eu_central1
+        )
+        this_var = Ec2TransitGateway(self, "this",
+            default_route_table_association="disable",
+            default_route_table_propagation="disable"
+        )
+        aws_ec2_transit_gateway_peering_attachment_eu_central1 =
+        Ec2TransitGatewayPeeringAttachment(self, "eu-central-1_3",
+            peer_region="eu-central-1",
+            peer_transit_gateway_id=Token.as_string(aws_ec2_transit_gateway_eu_central1.id),
+            tags={
+                "Name": "TGW mesh from eu-central-1"
+            },
+            transit_gateway_id=Token.as_string(Fn.lookup_nested(this_var, ["0", "id"]))
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_ec2_transit_gateway_peering_attachment_eu_central1.override_logical_id("eu-central-1")
+        aws_ec2_transit_gateway_peering_attachment_accepter_eu_central1 =
+        Ec2TransitGatewayPeeringAttachmentAccepter(self, "eu-central-1_4",
+            provider=eu_central1,
+            tags={
+                "Name": "Accepter TGW peering eu-central-1"
+            },
+            transit_gateway_attachment_id=Token.as_string(aws_ec2_transit_gateway_peering_attachment_eu_central1.id)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_ec2_transit_gateway_peering_attachment_accepter_eu_central1.override_logical_id("eu-central-1")
+        aws_ec2_transit_gateway_route_table_eu_central1 =
+        Ec2TransitGatewayRouteTable(self, "eu-central-1_5",
+            provider=eu_central1,
+            tags=Token.as_string_map(
+                Fn.merge([{
+                    "Name": "wl-transit-gateway-routetable-eu-central-1"
+                }, global_tags
+                ])),
+            transit_gateway_id=Token.as_string(aws_ec2_transit_gateway_eu_central1.id)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_ec2_transit_gateway_route_table_eu_central1.override_logical_id("eu-central-1")
+        aws_ec2_transit_gateway_route_table_this = Ec2TransitGatewayRouteTable(self, "this_6",
+            transit_gateway_id=my_transit_gateway_id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_ec2_transit_gateway_route_table_this.override_logical_id("this")
+        Ec2TransitGatewayRouteTableAssociation(self, "vpn",
+            transit_gateway_attachment_id=Token.as_string(
+                Fn.lookup_nested(aws_vpn_connection_this, ["0", "transit_gateway_attachment_id"
+                ])),
+            transit_gateway_route_table_id=my_transit_gateway_id_route_table
+        )
+        aws_ec2_transit_gateway_route_table_propagation_vpn =
+        Ec2TransitGatewayRouteTablePropagation(self, "vpn_8",
+            transit_gateway_attachment_id=Token.as_string(
+                Fn.lookup_nested(aws_vpn_connection_this, ["0", "transit_gateway_attachment_id"
+                ])),
+            transit_gateway_route_table_id=Token.as_string(aws_ec2_transit_gateway_route_table_this.id)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_ec2_transit_gateway_route_table_propagation_vpn.override_logical_id("vpn")
+        aws_ec2_transit_gateway_vpc_attachment_this =
+        Ec2TransitGatewayVpcAttachment(self, "this_9",
+            depends_on=[private, public],
+            subnet_ids=Token.as_list("${[ for s in ${" + private.fqn + "} : s.id]}"),
+            transit_gateway_default_route_table_association=False,
+            transit_gateway_default_route_table_propagation=False,
+            transit_gateway_id=Token.as_string(Fn.lookup_nested(this_var, ["0", "id"])),
+            vpc_id=Token.as_string(aws_vpc_this.id)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_ec2_transit_gateway_vpc_attachment_this.override_logical_id("this")
+        filtered_eu_central1 = DataAwsEc2TransitGatewayVpcAttachments(self, "filtered-eu-central-1",
+            filter=[DataAwsEc2TransitGatewayVpcAttachmentsFilter(
+                name="state",
+                values=["pendingAcceptance", "available"]
+            )
+            ],
+            provider=eu_central1
+        )
+        Ec2TransitGatewayRouteTableAssociation(self, "vpc",
+            transit_gateway_attachment_id=Token.as_string(aws_ec2_transit_gateway_vpc_attachment_this.id),
+            transit_gateway_route_table_id=my_transit_gateway_id_route_table
+        )
+        aws_ec2_transit_gateway_route_table_propagation_vpc =
+        Ec2TransitGatewayRouteTablePropagation(self, "vpc_12",
+            transit_gateway_attachment_id=Token.as_string(aws_ec2_transit_gateway_vpc_attachment_this.id),
+            transit_gateway_route_table_id=Token.as_string(aws_ec2_transit_gateway_route_table_this.id)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_ec2_transit_gateway_route_table_propagation_vpc.override_logical_id("vpc")
+        # In most cases loops should be handled in the programming language context and
+        #     not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+        #     you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+        #     you need to keep this like it is.
+        unit_eu_central1_for_each_iterator = TerraformIterator.from_list(
+            Token.as_any(Fn.toset(filtered_eu_central1.ids)))
+        unit_eu_central1 = DataAwsEc2TransitGatewayVpcAttachment(self, "unit-eu-central-1",
+            id=Token.as_string(unit_eu_central1_for_each_iterator.value),
+            provider=eu_central1,
+            for_each=unit_eu_central1_for_each_iterator
+        )
+        trusted_vpc_attachments_list_eu_central1 = Fn.compact(
+            Token.as_list("${[ for k, tva in ${" + unit_eu_central1.fqn + "} : contains(local.trusted_aws_accounts_ids, lookup(tva, \"vpc_owner_id\", \"\")) ? tva.id : \"\"]}"))
+        trusted_vpc_attachements_eu_central1 = Fn.toset(
+            Fn.sort(Token.as_list(trusted_vpc_attachments_list_eu_central1)))
+        # In most cases loops should be handled in the programming language context and
+        #     not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+        #     you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+        #     you need to keep this like it is.
+        trusted_accounts_eu_central1_tgw_for_each_iterator =
+        TerraformIterator.from_list(Token.as_any(trusted_vpc_attachements_eu_central1))
+        trusted_accounts_eu_central1_tgw =
+        Ec2TransitGatewayVpcAttachmentAccepter(self, "trusted_accounts_eu-central-1_tgw",
+            lifecycle=TerraformResourceLifecycle(
+                ignore_changes=[subnet_ids, id, dns_support, ipv6_support, transit_gateway_id, vpc_id, vpc_owner_id
+                ],
+                prevent_destroy=False
+            ),
+            provider=eu_central1,
+            tags=Token.as_string_map(global_tags),
+            transit_gateway_attachment_id=Token.as_string(trusted_accounts_eu_central1_tgw_for_each_iterator.value),
+            transit_gateway_default_route_table_association=False,
+            transit_gateway_default_route_table_propagation=False,
+            for_each=trusted_accounts_eu_central1_tgw_for_each_iterator
+        )
+        # In most cases loops should be handled in the programming language context and
+        #     not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+        #     you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+        #     you need to keep this like it is.
+        trusted_accounts_eu_central1_for_each_iterator = TerraformIterator.from_list(
+            Token.as_any(trusted_accounts_eu_central1_tgw))
+        Ec2TransitGatewayRouteTableAssociation(self, "trusted_accounts_eu-central-1",
+            provider=eu_central1,
+            transit_gateway_attachment_id=Token.as_string(
+                Fn.lookup_nested(trusted_accounts_eu_central1_for_each_iterator.value, ["transit_gateway_attachment_id"
+                ])),
+            transit_gateway_route_table_id=Token.as_string(aws_ec2_transit_gateway_route_table_eu_central1.id),
+            for_each=trusted_accounts_eu_central1_for_each_iterator
+        )
+        # In most cases loops should be handled in the programming language context and
+        #     not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+        #     you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+        #     you need to keep this like it is.
+        aws_ec2_transit_gateway_route_table_propagation_trusted_accounts_eu_central1_for_each_iterator =
+        TerraformIterator.from_list(Token.as_any(trusted_accounts_eu_central1_tgw))
+        aws_ec2_transit_gateway_route_table_propagation_trusted_accounts_eu_central1 =
+        Ec2TransitGatewayRouteTablePropagation(self, "trusted_accounts_eu-central-1_16",
+            provider=eu_central1,
+            transit_gateway_attachment_id=Token.as_string(
+                Fn.lookup_nested(aws_ec2_transit_gateway_route_table_propagation_trusted_accounts_eu_central1_for_each_iterator.value, ["transit_gateway_attachment_id"])),
+            transit_gateway_route_table_id=Token.as_string(aws_ec2_transit_gateway_route_table_eu_central1.id),
+            for_each=aws_ec2_transit_gateway_route_table_propagation_trusted_accounts_eu_central1_for_each_iterator
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_ec2_transit_gateway_route_table_propagation_trusted_accounts_eu_central1.override_logical_id("trusted_accounts_eu-central-1")
+        test = DataAwsEc2TransitGatewayRouteTableRoutes(self, "test",
+            depends_on=[aws_ec2_transit_gateway_route_table_propagation_trusted_accounts_eu_central1
+            ],
+            filter=[DataAwsEc2TransitGatewayRouteTableRoutesFilter(
+                name="type",
+                values=["propagated"]
+            )
+            ],
+            provider=eu_central1,
+            transit_gateway_route_table_id=Token.as_string(aws_ec2_transit_gateway_route_table_eu_central1.id)
+        )
+        # In most cases loops should be handled in the programming language context and
+        #     not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+        #     you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+        #     you need to keep this like it is.
+        default_region_to_eu_central1_for_each_iterator = TerraformIterator.from_list(
+            Token.as_any("${{ for r in ${" + test.routes + "} : r.destination_cidr_block => r}}"))
+        Ec2TransitGatewayRoute(self, "default-region-to-eu-central-1",
+            destination_cidr_block=Token.as_string(default_region_to_eu_central1_for_each_iterator.key),
+            transit_gateway_attachment_id=Token.as_string(aws_ec2_transit_gateway_peering_attachment_eu_central1.id),
+            transit_gateway_route_table_id=Token.as_string(aws_ec2_transit_gateway_route_table_this.id),
+            for_each=default_region_to_eu_central1_for_each_iterator
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `filter` - (Required) Custom filter block as described below.
+* `transit_gateway_route_table_id` - (Required) Identifier of EC2 Transit Gateway Route Table.
+
+More complex filters can be expressed using one or more `filter` sub-blocks,
+which take the following arguments:
+
+* `name` - (Required) Name of the field to filter by, as defined by
+  [the underlying AWS API](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_SearchTransitGatewayRoutes.html).
+* `values` - (Required) Set of values that are accepted for the given field.
+
+## Attributes Reference
+
+In addition to all arguments above, the following attributes are exported:
+
+* `id` - The transit gateway route table id suffixed by `-routes`
+* `routes` - List of Transit Gateway Routes.
+
+#### Routes list Attributes Reference
+
+* `destination_cidr_block` - The CIDR used for route destination matches.
+* `prefix_list_id` - The ID of the prefix list used for destination matches.
+* `state` - The current state of the route, can be `active`, `deleted`, `pending`, `blackhole`, `deleting`.
+* `transit_gateway_route_table_announcement_id` - The id of the transit gateway route table announcement, most of the time it is an empty string.
+* `type` - The type of the route, can be `propagated` or `static`.
+
+<!-- cache-key: cdktf-0.18.0 input-5fba265cc145ada0235efec26c10c79f01ec5384ee918cc84a3f6d087ffa07e0 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/ec2_transit_gateway_route_tables.html.markdown b/website/docs/cdktf/python/d/ec2_transit_gateway_route_tables.html.markdown
index d00ff15c5f7..3249980cf57 100644
--- a/website/docs/cdktf/python/d/ec2_transit_gateway_route_tables.html.markdown
+++ b/website/docs/cdktf/python/d/ec2_transit_gateway_route_tables.html.markdown
@@ -6,6 +6,8 @@ description: |-
    Provides information for multiple EC2 Transit Gateway Route Tables
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Data Source: aws_ec2_transit_gateway_route_tables
 
 Provides information for multiple EC2 Transit Gateway Route Tables, such as their identifiers.
@@ -14,17 +16,29 @@ Provides information for multiple EC2 Transit Gateway Route Tables, such as thei
 
 The following shows outputting all Transit Gateway Route Table Ids.
 
-```terraform
-data "aws_ec2_transit_gateway_route_tables" "example" {}
-
-output "example" {
-  value = data.aws_ec2_transit_gateway_route_table.example.ids
-}
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformOutput, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_ec2_transit_gateway_route_tables import DataAwsEc2TransitGatewayRouteTables
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = DataAwsEc2TransitGatewayRouteTables(self, "example")
+        cdktf_terraform_output_example = TerraformOutput(self, "example_1",
+            value=example.ids
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        cdktf_terraform_output_example.override_logical_id("example")
 ```
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `filter` - (Optional) Custom filter block as described below.
 
@@ -40,9 +54,9 @@ which take the following arguments:
 * `values` - (Required) Set of values that are accepted for the given field.
   A Transit Gateway Route Table will be selected if any one of the given values matches.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - AWS Region.
 * `ids` - Set of Transit Gateway Route Table identifiers.
@@ -53,4 +67,4 @@ In addition to all arguments above, the following attributes are exported:
 
 - `read` - (Default `20m`)
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-21b354be5ff1a820230b37a47d13e1da6f5225ba42571d63d85a355c468318aa -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-dd6ce3b8d03c97c0be1c62a1eb6f7e48e7f33a7530f057628e07baf248805ae7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/ec2_transit_gateway_vpc_attachment.html.markdown b/website/docs/cdktf/python/d/ec2_transit_gateway_vpc_attachment.html.markdown
index c113fcf3487..2134f20614f 100644
--- a/website/docs/cdktf/python/d/ec2_transit_gateway_vpc_attachment.html.markdown
+++ b/website/docs/cdktf/python/d/ec2_transit_gateway_vpc_attachment.html.markdown
@@ -6,6 +6,8 @@ description: |-
   Get information on an EC2 Transit Gateway VPC Attachment
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Data Source: aws_ec2_transit_gateway_vpc_attachment
 
 Get information on an EC2 Transit Gateway VPC Attachment.
@@ -15,15 +17,18 @@ Get information on an EC2 Transit Gateway VPC Attachment.
 ### By Filter
 
 ```python
-import constructs as constructs
-import cdktf as cdktf
-# Provider bindings are generated by running cdktf get.
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
 # See https://cdk.tf/provider-generation for more details.
-import ...gen.providers.aws as aws
-class MyConvertedCode(cdktf.TerraformStack):
+#
+from imports.aws.data_aws_ec2_transit_gateway_vpc_attachment import DataAwsEc2TransitGatewayVpcAttachment
+class MyConvertedCode(TerraformStack):
     def __init__(self, scope, name):
         super().__init__(scope, name)
-        aws.data_aws_ec2_transit_gateway_vpc_attachment.DataAwsEc2TransitGatewayVpcAttachment(self, "example",
+        DataAwsEc2TransitGatewayVpcAttachment(self, "example",
             filter=[DataAwsEc2TransitGatewayVpcAttachmentFilter(
                 name="vpc-id",
                 values=["vpc-12345678"]
@@ -35,22 +40,25 @@ class MyConvertedCode(cdktf.TerraformStack):
 ### By Identifier
 
 ```python
-import constructs as constructs
-import cdktf as cdktf
-# Provider bindings are generated by running cdktf get.
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
 # See https://cdk.tf/provider-generation for more details.
-import ...gen.providers.aws as aws
-class MyConvertedCode(cdktf.TerraformStack):
+#
+from imports.aws.data_aws_ec2_transit_gateway_vpc_attachment import DataAwsEc2TransitGatewayVpcAttachment
+class MyConvertedCode(TerraformStack):
     def __init__(self, scope, name):
         super().__init__(scope, name)
-        aws.data_aws_ec2_transit_gateway_vpc_attachment.DataAwsEc2TransitGatewayVpcAttachment(self, "example",
+        DataAwsEc2TransitGatewayVpcAttachment(self, "example",
             id="tgw-attach-12345678"
         )
 ```
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `filter` - (Optional) One or more configuration blocks containing name-values filters. Detailed below.
 * `id` - (Optional) Identifier of the EC2 Transit Gateway VPC Attachment.
@@ -62,7 +70,7 @@ The following arguments are supported:
 
 ## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `appliance_mode_support` - Whether Appliance Mode support is enabled.
 * `dns_support` - Whether DNS support is enabled.
@@ -80,4 +88,4 @@ In addition to all arguments above, the following attributes are exported:
 
 - `read` - (Default `20m`)
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-d9a7b3de207778ae6262226683d82d8cf55a2755353a69faa2211b11f09ae695 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-1163f41ecbd71e0e8d7980fd48db7828f6a894bd96414a472ab369bf6fdfcc81 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/ec2_transit_gateway_vpc_attachments.html.markdown b/website/docs/cdktf/python/d/ec2_transit_gateway_vpc_attachments.html.markdown
index 009c280d325..3fd1732a0bd 100644
--- a/website/docs/cdktf/python/d/ec2_transit_gateway_vpc_attachments.html.markdown
+++ b/website/docs/cdktf/python/d/ec2_transit_gateway_vpc_attachments.html.markdown
@@ -6,6 +6,8 @@ description: |-
   Get information on EC2 Transit Gateway VPC Attachments
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Data Source: aws_ec2_transit_gateway_vpc_attachments
 
 Get information on EC2 Transit Gateway VPC Attachments.
@@ -15,16 +17,19 @@ Get information on EC2 Transit Gateway VPC Attachments.
 ### By Filter
 
 ```python
-import constructs as constructs
-import cdktf as cdktf
-# Provider bindings are generated by running cdktf get.
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformCount, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
 # See https://cdk.tf/provider-generation for more details.
-import ...gen.providers.aws as aws
-class MyConvertedCode(cdktf.TerraformStack):
+#
+from imports.aws.data_aws_ec2_transit_gateway_vpc_attachment import DataAwsEc2TransitGatewayVpcAttachment
+from imports.aws.data_aws_ec2_transit_gateway_vpc_attachments import DataAwsEc2TransitGatewayVpcAttachments
+class MyConvertedCode(TerraformStack):
     def __init__(self, scope, name):
         super().__init__(scope, name)
-        data_aws_ec2_transit_gateway_vpc_attachments_filtered =
-        aws.data_aws_ec2_transit_gateway_vpc_attachments.DataAwsEc2TransitGatewayVpcAttachments(self, "filtered",
+        filtered = DataAwsEc2TransitGatewayVpcAttachments(self, "filtered",
             filter=[DataAwsEc2TransitGatewayVpcAttachmentsFilter(
                 name="state",
                 values=["pendingAcceptance"]
@@ -35,19 +40,17 @@ class MyConvertedCode(cdktf.TerraformStack):
         #     not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
         #     you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
         #     you need to keep this like it is.
-        data_aws_ec2_transit_gateway_vpc_attachment_unit_count =
-        cdktf.TerraformCount.of(
-            cdktf.Fn.length_of(data_aws_ec2_transit_gateway_vpc_attachments_filtered.ids))
-        aws.data_aws_ec2_transit_gateway_vpc_attachment.DataAwsEc2TransitGatewayVpcAttachment(self, "unit",
-            id=cdktf.Token.as_string(
-                cdktf.property_access(data_aws_ec2_transit_gateway_vpc_attachments_filtered.ids, [data_aws_ec2_transit_gateway_vpc_attachment_unit_count.index])),
-            count=data_aws_ec2_transit_gateway_vpc_attachment_unit_count
+        unit_count = TerraformCount.of(
+            Token.as_number(Fn.length_of(filtered.ids)))
+        DataAwsEc2TransitGatewayVpcAttachment(self, "unit",
+            id=Token.as_string(Fn.lookup_nested(filtered.ids, [unit_count.index])),
+            count=unit_count
         )
 ```
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `filter` - (Optional) One or more configuration blocks containing name-values filters. Detailed below.
 
@@ -58,7 +61,7 @@ The following arguments are supported:
 
 ## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `ids` A list of all attachments ids matching the filter. You can retrieve more information about the attachment using the [aws_ec2_transit_gateway_vpc_attachment][2] data source, searching by identifier.
 
@@ -71,4 +74,4 @@ In addition to all arguments above, the following attributes are exported:
 
 - `read` - (Default `20m`)
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-94a4a5c01262f3d0b0040f40dfcbae5974b17c833a028dce6e27bdcd796da76f -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-2d39ff132acd3771e1ec4fad107a8e23d40412d978b10bdbac6f691914bd45b7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/ec2_transit_gateway_vpn_attachment.html.markdown b/website/docs/cdktf/python/d/ec2_transit_gateway_vpn_attachment.html.markdown
index 4f3dde31294..1079363471d 100644
--- a/website/docs/cdktf/python/d/ec2_transit_gateway_vpn_attachment.html.markdown
+++ b/website/docs/cdktf/python/d/ec2_transit_gateway_vpn_attachment.html.markdown
@@ -6,6 +6,8 @@ description: |-
   Get information on an EC2 Transit Gateway VPN Attachment
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Data Source: aws_ec2_transit_gateway_vpn_attachment
 
 Get information on an EC2 Transit Gateway VPN Attachment.
@@ -16,25 +18,39 @@ Get information on an EC2 Transit Gateway VPN Attachment.
 
 ### By Transit Gateway and VPN Connection Identifiers
 
-```terraform
-data "aws_ec2_transit_gateway_vpn_attachment" "example" {
-  transit_gateway_id = aws_ec2_transit_gateway.example.id
-  vpn_connection_id  = aws_vpn_connection.example.id
-}
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_ec2_transit_gateway_vpn_attachment import DataAwsEc2TransitGatewayVpnAttachment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsEc2TransitGatewayVpnAttachment(self, "example",
+            transit_gateway_id=Token.as_string(aws_ec2_transit_gateway_example.id),
+            vpn_connection_id=Token.as_string(aws_vpn_connection_example.id)
+        )
 ```
 
 ### Filter
 
 ```python
-import constructs as constructs
-import cdktf as cdktf
-# Provider bindings are generated by running cdktf get.
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
 # See https://cdk.tf/provider-generation for more details.
-import ...gen.providers.aws as aws
-class MyConvertedCode(cdktf.TerraformStack):
+#
+from imports.aws.data_aws_ec2_transit_gateway_vpn_attachment import DataAwsEc2TransitGatewayVpnAttachment
+class MyConvertedCode(TerraformStack):
     def __init__(self, scope, name):
         super().__init__(scope, name)
-        aws.data_aws_ec2_transit_gateway_vpn_attachment.DataAwsEc2TransitGatewayVpnAttachment(self, "test",
+        DataAwsEc2TransitGatewayVpnAttachment(self, "test",
             filter=[DataAwsEc2TransitGatewayVpnAttachmentFilter(
                 name="resource-id",
                 values=["some-resource"]
@@ -45,7 +61,7 @@ class MyConvertedCode(cdktf.TerraformStack):
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `transit_gateway_id` - (Optional) Identifier of the EC2 Transit Gateway.
 * `vpn_connection_id` - (Optional) Identifier of the EC2 VPN Connection.
@@ -54,14 +70,14 @@ The following arguments are supported:
 
 ### filter Configuration Block
 
-The following arguments are supported by the `filter` configuration block:
+The `filter` configuration block supports the following arguments:
 
 * `name` - (Required) Name of the filter field. Valid values can be found in the [EC2 DescribeTransitGatewayAttachments API Reference](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeTransitGatewayAttachments.html).
 * `values` - (Required) Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
 
 ## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - EC2 Transit Gateway VPN Attachment identifier
 * `tags` - Key-value tags for the EC2 Transit Gateway VPN Attachment
@@ -72,4 +88,4 @@ In addition to all arguments above, the following attributes are exported:
 
 - `read` - (Default `20m`)
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-2149138dd4a425dc46526663f1027084972afb2d6643d8f1be249b8702bebeb1 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-88b75ea1f3920ded56d1eddbe0d74b036502601096fcc354c6675666bea832df -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/ecr_authorization_token.html.markdown b/website/docs/cdktf/python/d/ecr_authorization_token.html.markdown
new file mode 100644
index 00000000000..4d95f5d84af
--- /dev/null
+++ b/website/docs/cdktf/python/d/ecr_authorization_token.html.markdown
@@ -0,0 +1,49 @@
+---
+subcategory: "ECR (Elastic Container Registry)"
+layout: "aws"
+page_title: "AWS: aws_ecr_authorization_token"
+description: |-
+    Provides details about an ECR Authorization Token
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_ecr_authorization_token
+
+The ECR Authorization Token data source allows the authorization token, proxy endpoint, token expiration date, user name and password to be retrieved for an ECR repository.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_ecr_authorization_token import DataAwsEcrAuthorizationToken
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsEcrAuthorizationToken(self, "token")
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `registry_id` - (Optional) AWS account ID of the ECR Repository. If not specified the default account is assumed.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `authorization_token` - Temporary IAM authentication credentials to access the ECR repository encoded in base64 in the form of `user_name:password`.
+* `expires_at` - Time in UTC RFC3339 format when the authorization token expires.
+* `id` - Region of the authorization token.
+* `password` - Password decoded from the authorization token.
+* `proxy_endpoint` - Registry URL to use in the docker login command.
+* `user_name` - User name decoded from the authorization token.
+
+<!-- cache-key: cdktf-0.18.0 input-d34a382e4ced5a92cb958e15e5c5a33471a37b0250050f1b1a0f69eb8326fece -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/ecr_image.html.markdown b/website/docs/cdktf/python/d/ecr_image.html.markdown
new file mode 100644
index 00000000000..5df8e0ea6ca
--- /dev/null
+++ b/website/docs/cdktf/python/d/ecr_image.html.markdown
@@ -0,0 +1,54 @@
+---
+subcategory: "ECR (Elastic Container Registry)"
+layout: "aws"
+page_title: "AWS: aws_ecr_image"
+description: |-
+    Provides details about an ECR Image
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_ecr_image
+
+The ECR Image data source allows the details of an image with a particular tag or digest to be retrieved.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_ecr_image import DataAwsEcrImage
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsEcrImage(self, "service_image",
+            image_tag="latest",
+            repository_name="my/service"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `registry_id` - (Optional) ID of the Registry where the repository resides.
+* `repository_name` - (Required) Name of the ECR Repository.
+* `image_digest` - (Optional) Sha256 digest of the image manifest. At least one of `image_digest`, `image_tag`, or `most_recent` must be specified.
+* `image_tag` - (Optional) Tag associated with this image. At least one of `image_digest`, `image_tag`, or `most_recent` must be specified.
+* `most_recent` - (Optional) Return the most recently pushed image. At least one of `image_digest`, `image_tag`, or `most_recent` must be specified.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - SHA256 digest of the image manifest.
+* `image_pushed_at` - Date and time, expressed as a unix timestamp, at which the current image was pushed to the repository.
+* `image_size_in_bytes` - Size, in bytes, of the image in the repository.
+* `image_tags` - List of tags associated with this image.
+
+<!-- cache-key: cdktf-0.18.0 input-eb75c0a7672b4cf7c02f9b64096974ed3f209abe2c9c03438c3aa07107bc2b28 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/ecr_pull_through_cache_rule.html.markdown b/website/docs/cdktf/python/d/ecr_pull_through_cache_rule.html.markdown
new file mode 100644
index 00000000000..fb7b7bf3d70
--- /dev/null
+++ b/website/docs/cdktf/python/d/ecr_pull_through_cache_rule.html.markdown
@@ -0,0 +1,48 @@
+---
+subcategory: "ECR (Elastic Container Registry)"
+layout: "aws"
+page_title: "AWS: aws_ecr_pull_through_cache_rule"
+description: |-
+  Provides details about an ECR Pull Through Cache Rule
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_ecr_pull_through_cache_rule
+
+The ECR Pull Through Cache Rule data source allows the upstream registry URL and registry ID to be retrieved for a Pull Through Cache Rule.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_ecr_pull_through_cache_rule import DataAwsEcrPullThroughCacheRule
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsEcrPullThroughCacheRule(self, "ecr_public",
+            ecr_repository_prefix="ecr-public"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+- `ecr_repository_prefix` - (Required) The repository name prefix to use when caching images from the source registry.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+- `id` - The repository name prefix.
+- `upstream_registry_url` - The registry URL of the upstream public registry to use as the source.
+- `registry_id` - The registry ID where the repository was created.
+
+<!-- cache-key: cdktf-0.18.0 input-3ee2ad3b6b1782465fd57fc7a664c3cb24f3d2959a61a327dc70b472c5eb08e8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/ecr_repository.html.markdown b/website/docs/cdktf/python/d/ecr_repository.html.markdown
new file mode 100644
index 00000000000..7b450eb30ad
--- /dev/null
+++ b/website/docs/cdktf/python/d/ecr_repository.html.markdown
@@ -0,0 +1,62 @@
+---
+subcategory: "ECR (Elastic Container Registry)"
+layout: "aws"
+page_title: "AWS: aws_ecr_repository"
+description: |-
+    Provides details about an ECR Repository
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_ecr_repository
+
+The ECR Repository data source allows the ARN, Repository URI and Registry ID to be retrieved for an ECR repository.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_ecr_repository import DataAwsEcrRepository
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsEcrRepository(self, "service",
+            name="ecr-repository"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name of the ECR Repository.
+* `registry_id` - (Optional) Registry ID where the repository was created.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - Full ARN of the repository.
+* `encryption_configuration` - Encryption configuration for the repository. See [Encryption Configuration](#encryption-configuration) below.
+* `image_scanning_configuration` - Configuration block that defines image scanning configuration for the repository. See [Image Scanning Configuration](#image-scanning-configuration) below.
+* `image_tag_mutability` - The tag mutability setting for the repository.
+* `most_recent_image_tags` - List of image tags associated with the most recently pushed image in the repository.
+* `repository_url` - URL of the repository (in the form `aws_account_id.dkr.ecr.region.amazonaws.com/repositoryName`).
+* `tags` - Map of tags assigned to the resource.
+
+### Encryption Configuration
+
+* `encryption_type` - Encryption type to use for the repository, either `AES256` or `KMS`.
+* `kms_key` - If `encryption_type` is `KMS`, the ARN of the KMS key used.
+
+### Image Scanning Configuration
+
+* `scan_on_push` - Whether images are scanned after being pushed to the repository.
+
+<!-- cache-key: cdktf-0.18.0 input-dca647d04d11f3277efe49d65bb6183e2b5b2ad799294faa6fdd90156a3bfee3 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/ecrpublic_authorization_token.html.markdown b/website/docs/cdktf/python/d/ecrpublic_authorization_token.html.markdown
new file mode 100644
index 00000000000..8526e39bfb2
--- /dev/null
+++ b/website/docs/cdktf/python/d/ecrpublic_authorization_token.html.markdown
@@ -0,0 +1,44 @@
+---
+subcategory: "ECR Public"
+layout: "aws"
+page_title: "AWS: aws_ecrpublic_authorization_token"
+description: |-
+    Provides details about a Public ECR Authorization Token
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_ecrpublic_authorization_token
+
+The Public ECR Authorization Token data source allows the authorization token, token expiration date, user name, and password to be retrieved for a Public ECR repository.
+
+~> **NOTE:** This data source can only be used in the `us-east-1` region.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_ecrpublic_authorization_token import DataAwsEcrpublicAuthorizationToken
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsEcrpublicAuthorizationToken(self, "token")
+```
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `authorization_token` - Temporary IAM authentication credentials to access the ECR repository encoded in base64 in the form of `user_name:password`.
+* `expires_at` - Time in UTC RFC3339 format when the authorization token expires.
+* `id` - Region of the authorization token.
+* `password` - Password decoded from the authorization token.
+* `user_name` - User name decoded from the authorization token.
+
+<!-- cache-key: cdktf-0.18.0 input-fc553185b1ad0893b42035538b008c8015883bff0b2f28b28094a5ed72a8fc63 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/ecs_cluster.html.markdown b/website/docs/cdktf/python/d/ecs_cluster.html.markdown
new file mode 100644
index 00000000000..1f0efe569c4
--- /dev/null
+++ b/website/docs/cdktf/python/d/ecs_cluster.html.markdown
@@ -0,0 +1,54 @@
+---
+subcategory: "ECS (Elastic Container)"
+layout: "aws"
+page_title: "AWS: aws_ecs_cluster"
+description: |-
+    Provides details about an ecs cluster
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_ecs_cluster
+
+The ECS Cluster data source allows access to details of a specific
+cluster within an AWS ECS service.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_ecs_cluster import DataAwsEcsCluster
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsEcsCluster(self, "ecs-mongo",
+            cluster_name="ecs-mongo-production"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `cluster_name` - (Required) Name of the ECS Cluster
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the ECS Cluster
+* `status` - Status of the ECS Cluster
+* `pending_tasks_count` - Number of pending tasks for the ECS Cluster
+* `running_tasks_count` - Number of running tasks for the ECS Cluster
+* `registered_container_instances_count` - The number of registered container instances for the ECS Cluster
+* `service_connect_defaults` - The default Service Connect namespace
+* `setting` - Settings associated with the ECS Cluster
+* `tags` - Key-value map of resource tags
+
+<!-- cache-key: cdktf-0.18.0 input-34810e42d3b55e16f7f6d3afebb0129a5abba1001be099dab6e734c0ce5c7341 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/ecs_container_definition.html.markdown b/website/docs/cdktf/python/d/ecs_container_definition.html.markdown
new file mode 100644
index 00000000000..ef13fc77057
--- /dev/null
+++ b/website/docs/cdktf/python/d/ecs_container_definition.html.markdown
@@ -0,0 +1,56 @@
+---
+subcategory: "ECS (Elastic Container)"
+layout: "aws"
+page_title: "AWS: aws_ecs_container_definition"
+description: |-
+    Provides details about a single container within an ecs task definition
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_ecs_container_definition
+
+The ECS container definition data source allows access to details of
+a specific container within an AWS ECS service.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_ecs_container_definition import DataAwsEcsContainerDefinition
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsEcsContainerDefinition(self, "ecs-mongo",
+            container_name="mongodb",
+            task_definition=mongo.id
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `task_definition` - (Required) ARN of the task definition which contains the container
+* `container_name` - (Required) Name of the container definition
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `image` - Docker image in use, including the digest
+* `image_digest` - Digest of the docker image in use
+* `cpu` - CPU limit for this container definition
+* `memory` - Memory limit for this container definition
+* `memory_reservation` - Soft limit (in MiB) of memory to reserve for the container. When system memory is under contention, Docker attempts to keep the container memory to this soft limit
+* `environment` - Environment in use
+* `disable_networking` - Indicator if networking is disabled
+* `docker_labels` - Set docker labels
+
+<!-- cache-key: cdktf-0.18.0 input-6aeb7bcd3d9ef0fd16650027ff7ee1fa1b9bdd2ab011e720f74e5b141ebf8c21 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/ecs_service.html.markdown b/website/docs/cdktf/python/d/ecs_service.html.markdown
new file mode 100644
index 00000000000..05a79ccbeec
--- /dev/null
+++ b/website/docs/cdktf/python/d/ecs_service.html.markdown
@@ -0,0 +1,54 @@
+---
+subcategory: "ECS (Elastic Container)"
+layout: "aws"
+page_title: "AWS: aws_ecs_service"
+description: |-
+    Provides details about an ecs service
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_ecs_service
+
+The ECS Service data source allows access to details of a specific
+Service within a AWS ECS Cluster.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_ecs_service import DataAwsEcsService
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsEcsService(self, "example",
+            cluster_arn=Token.as_string(data_aws_ecs_cluster_example.arn),
+            service_name="example"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `service_name` - (Required) Name of the ECS Service
+* `cluster_arn` - (Required) ARN of the ECS Cluster
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the ECS Service
+* `desired_count` - Number of tasks for the ECS Service
+* `launch_type` - Launch type for the ECS Service
+* `scheduling_strategy` - Scheduling strategy for the ECS Service
+* `task_definition` - Family for the latest ACTIVE revision or full ARN of the task definition.
+* `tags` - Resource tags.
+
+<!-- cache-key: cdktf-0.18.0 input-342c81cf26422fd2c4195d60a2096623c39f08ed2e906f31b634d44bbdc3ee9c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/ecs_task_definition.html.markdown b/website/docs/cdktf/python/d/ecs_task_definition.html.markdown
new file mode 100644
index 00000000000..0d12b555ae2
--- /dev/null
+++ b/website/docs/cdktf/python/d/ecs_task_definition.html.markdown
@@ -0,0 +1,75 @@
+---
+subcategory: "ECS (Elastic Container)"
+layout: "aws"
+page_title: "AWS: aws_ecs_task_definition"
+description: |-
+    Provides details about an ecs task definition
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_ecs_task_definition
+
+The ECS task definition data source allows access to details of
+a specific AWS ECS task definition.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_ecs_task_definition import DataAwsEcsTaskDefinition
+from imports.aws.ecs_cluster import EcsCluster
+from imports.aws.ecs_service import EcsService
+from imports.aws.ecs_task_definition import EcsTaskDefinition
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        foo = EcsCluster(self, "foo",
+            name="foo"
+        )
+        mongo = EcsTaskDefinition(self, "mongo",
+            container_definitions="[\n  {\n    \"cpu\": 128,\n    \"environment\": [{\n      \"name\": \"SECRET\",\n      \"value\": \"KEY\"\n    }],\n    \"essential\": true,\n    \"image\": \"mongo:latest\",\n    \"memory\": 128,\n    \"memoryReservation\": 64,\n    \"name\": \"mongodb\"\n  }\n]\n\n",
+            family="mongodb"
+        )
+        data_aws_ecs_task_definition_mongo = DataAwsEcsTaskDefinition(self, "mongo_2",
+            task_definition=mongo.family
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_ecs_task_definition_mongo.override_logical_id("mongo")
+        aws_ecs_service_mongo = EcsService(self, "mongo_3",
+            cluster=foo.id,
+            desired_count=2,
+            name="mongo",
+            task_definition=Token.as_string(data_aws_ecs_task_definition_mongo.arn)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_ecs_service_mongo.override_logical_id("mongo")
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `task_definition` - (Required) Family for the latest ACTIVE revision, family and revision (family:revision) for a specific revision in the family, the ARN of the task definition to access to.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - ARN of the task definition.
+* `arn` - ARN of the task definition.
+* `arn_without_revision` - ARN of the Task Definition with the trailing `revision` removed. This may be useful for situations where the latest task definition is always desired. If a revision isn't specified, the latest ACTIVE revision is used. See the [AWS documentation](https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_StartTask.html#ECS-StartTask-request-taskDefinition) for details.
+* `execution_role_arn` - ARN of the task execution role that the Amazon ECS container agent and the Docker.
+* `family` - Family of this task definition.
+* `network_mode` - Docker networking mode to use for the containers in this task.
+* `revision` - Revision of this task definition.
+* `status` - Status of this task definition.
+* `task_role_arn` - ARN of the IAM role that containers in this task can assume.
+
+<!-- cache-key: cdktf-0.18.0 input-4a4502052fe5e4b3b606605c68760b5b4032e8f1ed7a3c177b5d6a07c7731b9c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/ecs_task_execution.html.markdown b/website/docs/cdktf/python/d/ecs_task_execution.html.markdown
new file mode 100644
index 00000000000..6f6b3955e53
--- /dev/null
+++ b/website/docs/cdktf/python/d/ecs_task_execution.html.markdown
@@ -0,0 +1,138 @@
+---
+subcategory: "ECS (Elastic Container)"
+layout: "aws"
+page_title: "AWS: aws_ecs_task_execution"
+description: |-
+  Terraform data source for managing an AWS ECS (Elastic Container) Task Execution.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_ecs_task_execution
+
+Terraform data source for managing an AWS ECS (Elastic Container) Task Execution. This data source calls the [RunTask](https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_RunTask.html) API, allowing execution of one-time tasks that don't fit a standard resource lifecycle. See the [feature request issue](https://github.com/hashicorp/terraform-provider-aws/issues/1703) for additional context.
+
+~> **NOTE on plan operations:** This data source calls the `RunTask` API on every read operation, which means new task(s) may be created from a `terraform plan` command if all attributes are known. Placing this functionality behind a data source is an intentional trade off to enable use cases requiring a one-time task execution without relying on [provisioners](https://developer.hashicorp.com/terraform/language/resources/provisioners/syntax). Caution should be taken to ensure the data source is only executed once, or that the resulting tasks can safely run in parallel.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, Fn, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_ecs_task_execution import DataAwsEcsTaskExecution
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsEcsTaskExecution(self, "example",
+            cluster=Token.as_string(aws_ecs_cluster_example.id),
+            desired_count=1,
+            launch_type="FARGATE",
+            network_configuration=DataAwsEcsTaskExecutionNetworkConfiguration(
+                assign_public_ip=False,
+                security_groups=[Token.as_string(aws_security_group_example.id)],
+                subnets=Token.as_list(Fn.lookup_nested(aws_subnet_example, ["*", "id"]))
+            ),
+            task_definition=Token.as_string(aws_ecs_task_definition_example.arn)
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `cluster` - (Required) Short name or full Amazon Resource Name (ARN) of the cluster to run the task on.
+* `task_definition` - (Required) The `family` and `revision` (`family:revision`) or full ARN of the task definition to run. If a revision isn't specified, the latest `ACTIVE` revision is used.
+
+The following arguments are optional:
+
+* `capacity_provider_strategy` - (Optional) Set of capacity provider strategies to use for the cluster. See below.
+* `desired_count` - (Optional) Number of instantiations of the specified task to place on your cluster. You can specify up to 10 tasks for each call.
+* `enable_ecs_managed_tags` - (Optional) Specifies whether to enable Amazon ECS managed tags for the tasks within the service.
+* `enable_execute_command` - (Optional) Specifies whether to enable Amazon ECS Exec for the tasks within the service.
+* `group` - (Optional) Name of the task group to associate with the task. The default value is the family name of the task definition.
+* `launch_type` - (Optional) Launch type on which to run your service. Valid values are `EC2`, `FARGATE`, and `EXTERNAL`.
+* `network_configuration` - (Optional) Network configuration for the service. This parameter is required for task definitions that use the `awsvpc` network mode to receive their own Elastic Network Interface, and it is not supported for other network modes. See below.
+* `overrides` - (Optional) A list of container overrides that specify the name of a container in the specified task definition and the overrides it should receive.
+* `placement_constraints` - (Optional) An array of placement constraint objects to use for the task. You can specify up to 10 constraints for each task. See below.
+* `placement_strategy` - (Optional) The placement strategy objects to use for the task. You can specify a maximum of 5 strategy rules for each task. See below.
+* `platform_version` - (Optional) The platform version the task uses. A platform version is only specified for tasks hosted on Fargate. If one isn't specified, the `LATEST` platform version is used.
+* `propagate_tags` - (Optional) Specifies whether to propagate the tags from the task definition to the task. If no value is specified, the tags aren't propagated. An error will be received if you specify the `SERVICE` option when running a task. Valid values are `TASK_DEFINITION` or `NONE`.
+* `reference_id` - (Optional) The reference ID to use for the task.
+* `started_by` - (Optional) An optional tag specified when a task is started.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### capacity_provider_strategy
+
+* `capacity_provider` - (Required) Name of the capacity provider.
+* `base` - (Optional) The number of tasks, at a minimum, to run on the specified capacity provider. Only one capacity provider in a capacity provider strategy can have a base defined. Defaults to `0`.
+* `weight` - (Optional) The relative percentage of the total number of launched tasks that should use the specified capacity provider. The `weight` value is taken into consideration after the `base` count of tasks has been satisfied. Defaults to `0`.
+
+### network_configuration
+
+* `subnets` - (Required) Subnets associated with the task or service.
+* `security_groups` - (Optional) Security groups associated with the task or service. If you do not specify a security group, the default security group for the VPC is used.
+* `assign_public_ip` - (Optional) Assign a public IP address to the ENI (Fargate launch type only). Valid values are `true` or `false`. Default `false`.
+
+For more information, see the [Task Networking](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-networking.html) documentation.
+
+### overrides
+
+* `container_overrides` - (Optional) One or more container overrides that are sent to a task. See below.
+* `cpu` - (Optional) The CPU override for the task.
+* `execution_role_arn` - (Optional) Amazon Resource Name (ARN) of the task execution role override for the task.
+* `inference_accelerator_overrides` - (Optional) Elastic Inference accelerator override for the task. See below.
+* `memory` - (Optional) The memory override for the task.
+* `task_role_arn` - (Optional) Amazon Resource Name (ARN) of the role that containers in this task can assume.
+
+### container_overrides
+
+* `command` - (Optional) The command to send to the container that overrides the default command from the Docker image or the task definition.
+* `cpu` - (Optional) The number of cpu units reserved for the container, instead of the default value from the task definition.
+* `environment` - (Optional) The environment variables to send to the container. You can add new environment variables, which are added to the container at launch, or you can override the existing environment variables from the Docker image or the task definition. See below.
+* `memory` - (Optional) The hard limit (in MiB) of memory to present to the container, instead of the default value from the task definition. If your container attempts to exceed the memory specified here, the container is killed.
+* `memory_reservation` - (Optional) The soft limit (in MiB) of memory to reserve for the container, instead of the default value from the task definition.
+* `name` - (Optional) The name of the container that receives the override. This parameter is required if any override is specified.
+* `resource_requirements` - (Optional) The type and amount of a resource to assign to a container, instead of the default value from the task definition. The only supported resource is a GPU. See below.
+
+### environment
+
+* `key` - (Required) The name of the key-value pair. For environment variables, this is the name of the environment variable.
+* `value` - (Required) The value of the key-value pair. For environment variables, this is the value of the environment variable.
+
+### resource_requirements
+
+* `type` - (Required) The type of resource to assign to a container. Valid values are `GPU` or `InferenceAccelerator`.
+* `value` - (Required) The value for the specified resource type. If the `GPU` type is used, the value is the number of physical GPUs the Amazon ECS container agent reserves for the container. The number of GPUs that's reserved for all containers in a task can't exceed the number of available GPUs on the container instance that the task is launched on. If the `InferenceAccelerator` type is used, the value matches the `deviceName` for an InferenceAccelerator specified in a task definition.
+
+### inference_accelerator_overrides
+
+* `device_name` - (Optional) The Elastic Inference accelerator device name to override for the task. This parameter must match a deviceName specified in the task definition.
+* `device_type` - (Optional) The Elastic Inference accelerator type to use.
+
+### placement_constraints
+
+* `expression` - (Optional) A cluster query language expression to apply to the constraint. The expression can have a maximum length of 2000 characters. You can't specify an expression if the constraint type is `distinctInstance`.
+* `type` - (Optional) The type of constraint. Valid values are `distinctInstance` or `memberOf`. Use `distinctInstance` to ensure that each task in a particular group is running on a different container instance. Use `memberOf` to restrict the selection to a group of valid candidates.
+
+### placement_strategy
+
+* `field` - (Optional) The field to apply the placement strategy against.
+* `type` - (Optional) The type of placement strategy. Valid values are `random`, `spread`, and `binpack`.
+
+For more information, see the [Placement Strategy](https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_PlacementStrategy.html) documentation.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `task_arns` - A list of the provisioned task ARNs.
+* `id` - The unique identifier, which is a comma-delimited string joining the `cluster` and `task_definition` attributes.
+
+<!-- cache-key: cdktf-0.18.0 input-43e278c1402adce6a7fc73f884efc857a1ca139e84ad68f7ea78a5f8b607b74c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/efs_access_point.html.markdown b/website/docs/cdktf/python/d/efs_access_point.html.markdown
new file mode 100644
index 00000000000..d20e2646333
--- /dev/null
+++ b/website/docs/cdktf/python/d/efs_access_point.html.markdown
@@ -0,0 +1,60 @@
+---
+subcategory: "EFS (Elastic File System)"
+layout: "aws"
+page_title: "AWS: aws_efs_access_point"
+description: |-
+  Provides an Elastic File System (EFS) Access Point data source.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_efs_access_point
+
+Provides information about an Elastic File System (EFS) Access Point.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_efs_access_point import DataAwsEfsAccessPoint
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsEfsAccessPoint(self, "test",
+            access_point_id="fsap-12345678"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `access_point_id` - (Required) ID that identifies the file system.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the access point.
+* `arn` - Amazon Resource Name of the file system.
+* `file_system_arn` - Amazon Resource Name of the file system.
+* `file_system_id` - ID of the file system for which the access point is intended.
+* `posix_user` - Single element list containing operating system user and group applied to all file system requests made using the access point.
+    * `gid` - Group ID
+    * `secondary_gids` - Secondary group IDs
+    * `uid` - User Id
+* `root_directory`- Single element list containing information on the directory on the Amazon EFS file system that the access point provides access to.
+    * `creation_info` - Single element list containing information on the creation permissions of the directory
+        * `owner_gid` - POSIX owner group ID
+        * `owner_uid` - POSIX owner user ID
+        * `permissions` - POSIX permissions mode
+    * `path` - Path exposed as the root directory
+* `tags` - Key-value mapping of resource tags.
+
+<!-- cache-key: cdktf-0.18.0 input-0a6eb33b78fe37cb122bdb76da99c518922b10eb75fae54fd07c18509d2e4a50 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/efs_access_points.html.markdown b/website/docs/cdktf/python/d/efs_access_points.html.markdown
new file mode 100644
index 00000000000..216bfbed791
--- /dev/null
+++ b/website/docs/cdktf/python/d/efs_access_points.html.markdown
@@ -0,0 +1,48 @@
+---
+subcategory: "EFS (Elastic File System)"
+layout: "aws"
+page_title: "AWS: aws_efs_access_points"
+description: |-
+  Provides information about multiple Elastic File System (EFS) Access Points.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_efs_access_points
+
+Provides information about multiple Elastic File System (EFS) Access Points.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_efs_access_points import DataAwsEfsAccessPoints
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsEfsAccessPoints(self, "test",
+            file_system_id="fs-12345678"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `file_system_id` - (Required) EFS File System identifier.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arns` - Set of Amazon Resource Names (ARNs).
+* `id` - EFS File System identifier.
+* `ids` - Set of identifiers.
+
+<!-- cache-key: cdktf-0.18.0 input-6411c7528e305530b4e30c020a220acea9846dec4899a48198364c9069f2fbcd -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/efs_file_system.html.markdown b/website/docs/cdktf/python/d/efs_file_system.html.markdown
new file mode 100644
index 00000000000..022df43a898
--- /dev/null
+++ b/website/docs/cdktf/python/d/efs_file_system.html.markdown
@@ -0,0 +1,71 @@
+---
+subcategory: "EFS (Elastic File System)"
+layout: "aws"
+page_title: "AWS: aws_efs_file_system"
+description: |-
+  Provides an Elastic File System (EFS) File System data source.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_efs_file_system
+
+Provides information about an Elastic File System (EFS) File System.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import VariableType, TerraformVariable, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_efs_file_system import DataAwsEfsFileSystem
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        # Terraform Variables are not always the best fit for getting inputs in the context of Terraform CDK.
+        #     You can read more about this at https://cdk.tf/variables
+        file_system_id = TerraformVariable(self, "file_system_id",
+            default="",
+            type=VariableType.STRING
+        )
+        DataAwsEfsFileSystem(self, "by_id",
+            file_system_id=file_system_id.string_value
+        )
+        DataAwsEfsFileSystem(self, "by_tag",
+            tags={
+                "Environment": "dev"
+            }
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `file_system_id` - (Optional) ID that identifies the file system (e.g., fs-ccfc0d65).
+* `creation_token` - (Optional) Restricts the list to the file system with this creation token.
+* `tags` - (Optional) Restricts the list to the file system with these tags.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name of the file system.
+* `availability_zone_name` - The Availability Zone name in which the file system's One Zone storage classes exist.
+* `availability_zone_id` - The identifier of the Availability Zone in which the file system's One Zone storage classes exist.
+* `dns_name` - DNS name for the filesystem per [documented convention](http://docs.aws.amazon.com/efs/latest/ug/mounting-fs-mount-cmd-dns-name.html).
+* `encrypted` - Whether EFS is encrypted.
+* `kms_key_id` - ARN for the KMS encryption key.
+* `lifecycle_policy` - File system [lifecycle policy](https://docs.aws.amazon.com/efs/latest/ug/API_LifecyclePolicy.html) object.
+* `name` - The value of the file system's `Name` tag.
+* `performance_mode` - File system performance mode.
+* `provisioned_throughput_in_mibps` - The throughput, measured in MiB/s, that you want to provision for the file system.
+* `tags` -A map of tags to assign to the file system.
+* `throughput_mode` - Throughput mode for the file system.
+* `size_in_bytes` - Current byte count used by the file system.
+
+<!-- cache-key: cdktf-0.18.0 input-91848697481eb0959ef949486e3ade78e73077540a9a38720f250c99edbeced7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/efs_mount_target.html.markdown b/website/docs/cdktf/python/d/efs_mount_target.html.markdown
new file mode 100644
index 00000000000..ecf9fe72fb4
--- /dev/null
+++ b/website/docs/cdktf/python/d/efs_mount_target.html.markdown
@@ -0,0 +1,63 @@
+---
+subcategory: "EFS (Elastic File System)"
+layout: "aws"
+page_title: "AWS: aws_efs_mount_target"
+description: |-
+  Provides an Elastic File System Mount Target (EFS) data source.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_efs_mount_target
+
+Provides information about an Elastic File System Mount Target (EFS).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import VariableType, TerraformVariable, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_efs_mount_target import DataAwsEfsMountTarget
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        # Terraform Variables are not always the best fit for getting inputs in the context of Terraform CDK.
+        #     You can read more about this at https://cdk.tf/variables
+        mount_target_id = TerraformVariable(self, "mount_target_id",
+            default="",
+            type=VariableType.STRING
+        )
+        DataAwsEfsMountTarget(self, "by_id",
+            mount_target_id=mount_target_id.string_value
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `access_point_id` - (Optional) ID or ARN of the access point whose mount target that you want to find. It must be included if a `file_system_id` and `mount_target_id` are not included.
+* `file_system_id` - (Optional) ID or ARN of the file system whose mount target that you want to find. It must be included if an `access_point_id` and `mount_target_id` are not included.
+* `mount_target_id` - (Optional) ID or ARN of the mount target that you want to find. It must be included in your request if an `access_point_id` and `file_system_id` are not included.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `file_system_arn` - Amazon Resource Name of the file system for which the mount target is intended.
+* `subnet_id` - ID of the mount target's subnet.
+* `ip_address` - Address at which the file system may be mounted via the mount target.
+* `security_groups` - List of VPC security group IDs attached to the mount target.
+* `dns_name` - DNS name for the EFS file system.
+* `mount_target_dns_name` - The DNS name for the given subnet/AZ per [documented convention](http://docs.aws.amazon.com/efs/latest/ug/mounting-fs-mount-cmd-dns-name.html).
+* `network_interface_id` - The ID of the network interface that Amazon EFS created when it created the mount target.
+* `availability_zone_name` - The name of the Availability Zone (AZ) that the mount target resides in.
+* `availability_zone_id` - The unique and consistent identifier of the Availability Zone (AZ) that the mount target resides in.
+* `owner_id` - AWS account ID that owns the resource.
+
+<!-- cache-key: cdktf-0.18.0 input-241585ed69289317f2541ca35ef78442a4e59e0d0ccb4b15a56966c7604251c8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/eip.html.markdown b/website/docs/cdktf/python/d/eip.html.markdown
new file mode 100644
index 00000000000..3f9099e134f
--- /dev/null
+++ b/website/docs/cdktf/python/d/eip.html.markdown
@@ -0,0 +1,138 @@
+---
+subcategory: "EC2 (Elastic Compute Cloud)"
+layout: "aws"
+page_title: "AWS: aws_eip"
+description: |-
+    Provides details about a specific Elastic IP
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_eip
+
+`aws_eip` provides details about a specific Elastic IP.
+
+## Example Usage
+
+### Search By Allocation ID (VPC only)
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_eip import DataAwsEip
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsEip(self, "by_allocation_id",
+            id="eipalloc-12345678"
+        )
+```
+
+### Search By Filters (EC2-Classic or VPC)
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_eip import DataAwsEip
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsEip(self, "by_filter",
+            filter=[DataAwsEipFilter(
+                name="tag:Name",
+                values=["exampleNameTagValue"]
+            )
+            ]
+        )
+```
+
+### Search By Public IP (EC2-Classic or VPC)
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_eip import DataAwsEip
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsEip(self, "by_public_ip",
+            public_ip="1.2.3.4"
+        )
+```
+
+### Search By Tags (EC2-Classic or VPC)
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_eip import DataAwsEip
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsEip(self, "by_tags",
+            tags={
+                "Name": "exampleNameTagValue"
+            }
+        )
+```
+
+## Argument Reference
+
+The arguments of this data source act as filters for querying the available
+Elastic IPs in the current region. The given filters must match exactly one
+Elastic IP whose data will be exported as attributes.
+
+* `filter` - (Optional) One or more name/value pairs to use as filters. There are several valid keys, for a full reference, check out the [EC2 API Reference](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeAddresses.html).
+* `id` - (Optional) Allocation ID of the specific VPC EIP to retrieve. If a classic EIP is required, do NOT set `id`, only set `public_ip`
+* `public_ip` - (Optional) Public IP of the specific EIP to retrieve.
+* `tags` - (Optional) Map of tags, each pair of which must exactly match a pair on the desired Elastic IP
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `association_id` - ID representing the association of the address with an instance in a VPC.
+* `domain` - Whether the address is for use in EC2-Classic (standard) or in a VPC (vpc).
+* `id` - If VPC Elastic IP, the allocation identifier. If EC2-Classic Elastic IP, the public IP address.
+* `instance_id` - ID of the instance that the address is associated with (if any).
+* `network_interface_id` - The ID of the network interface.
+* `network_interface_owner_id` - The ID of the AWS account that owns the network interface.
+* `private_ip` - Private IP address associated with the Elastic IP address.
+* `private_dns` - Private DNS associated with the Elastic IP address.
+* `public_ip` - Public IP address of Elastic IP.
+* `public_dns` - Public DNS associated with the Elastic IP address.
+* `public_ipv4_pool` - ID of an address pool.
+* `carrier_ip` - Carrier IP address.
+* `customer_owned_ipv4_pool` - The ID of a Customer Owned IP Pool. For more on customer owned IP addressed check out [Customer-owned IP addresses guide](https://docs.aws.amazon.com/outposts/latest/userguide/outposts-networking-components.html#ip-addressing)
+* `customer_owned_ip` - Customer Owned IP.
+* `tags` - Key-value map of tags associated with Elastic IP.
+
+~> **Note:** The data source computes the `public_dns` and `private_dns` attributes according to the [VPC DNS Guide](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-dns.html#vpc-dns-hostnames) as they are not available with the EC2 API.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `20m`)
+
+<!-- cache-key: cdktf-0.18.0 input-7688d5e50a2996c50fe0c8917540205326f787fcf7c961bd9d79ba635401f620 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/eips.html.markdown b/website/docs/cdktf/python/d/eips.html.markdown
new file mode 100644
index 00000000000..2b3ebec2123
--- /dev/null
+++ b/website/docs/cdktf/python/d/eips.html.markdown
@@ -0,0 +1,69 @@
+---
+subcategory: "EC2 (Elastic Compute Cloud)"
+layout: "aws"
+page_title: "AWS: aws_eips"
+description: |-
+    Provides a list of Elastic IPs in a region
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_eips
+
+Provides a list of Elastic IPs in a region.
+
+## Example Usage
+
+The following shows outputting all Elastic IPs with the a specific tag value.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformOutput, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_eips import DataAwsEips
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = DataAwsEips(self, "example",
+            tags={
+                "Env": "dev"
+            }
+        )
+        TerraformOutput(self, "allocation_ids",
+            value=example.allocation_ids
+        )
+        TerraformOutput(self, "public_ips",
+            value=example.public_ips
+        )
+```
+
+## Argument Reference
+
+* `filter` - (Optional) Custom filter block as described below.
+* `tags` - (Optional) Map of tags, each pair of which must exactly match a pair on the desired Elastic IPs.
+
+More complex filters can be expressed using one or more `filter` sub-blocks, which take the following arguments:
+
+* `name` - (Required) Name of the field to filter by, as defined by
+  [the underlying AWS API](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeAddresses.html).
+* `values` - (Required) Set of values that are accepted for the given field. An Elastic IP will be selected if any one of the given values matches.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - AWS Region.
+* `allocation_ids` - List of all the allocation IDs for address for use with EC2-VPC.
+* `public_ips` - List of all the Elastic IP addresses.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `20m`)
+
+<!-- cache-key: cdktf-0.18.0 input-ed0c009504a829c5af380a752739119e64fcc7c1f90f4ad49fc2af34458d3af3 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/eks_addon.html.markdown b/website/docs/cdktf/python/d/eks_addon.html.markdown
new file mode 100644
index 00000000000..18f592b3eaa
--- /dev/null
+++ b/website/docs/cdktf/python/d/eks_addon.html.markdown
@@ -0,0 +1,57 @@
+---
+subcategory: "EKS (Elastic Kubernetes)"
+layout: "aws"
+page_title: "AWS: aws_eks_addon"
+description: |-
+  Retrieve information about an EKS add-on
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_eks_addon
+
+Retrieve information about an EKS add-on.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformOutput, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_eks_addon import DataAwsEksAddon
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        TerraformOutput(self, "eks_addon_outputs",
+            value=example
+        )
+        DataAwsEksAddon(self, "example",
+            addon_name="vpc-cni",
+            cluster_name=Token.as_string(aws_eks_cluster_example.name)
+        )
+```
+
+## Argument Reference
+
+* `addon_name` – (Required) Name of the EKS add-on. The name must match one of
+  the names returned by [list-addon](https://docs.aws.amazon.com/cli/latest/reference/eks/list-addons.html).
+* `cluster_name` – (Required) Name of the EKS Cluster. Must be between 1-100 characters in length. Must begin with an alphanumeric character, and must only contain alphanumeric characters, dashes and underscores (`^[0-9A-Za-z][A-Za-z0-9\-_]+$`).
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the EKS add-on.
+* `addon_version` - Version of EKS add-on.
+* `configuration_values` - Configuration values for the addon with a single JSON string.
+* `service_account_role_arn` - ARN of IAM role used for EKS add-on. If value is empty -
+  then add-on uses the IAM role assigned to the EKS Cluster node.
+* `id` - EKS Cluster name and EKS add-on name separated by a colon (`:`).
+* `created_at` - Date and time in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8) that the EKS add-on was created.
+* `modified_at` - Date and time in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8) that the EKS add-on was updated.
+
+<!-- cache-key: cdktf-0.18.0 input-553bc4808c728491b5414f2d688994a4b0a80d9290f35e4271bd6e2834213ffb -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/eks_addon_version.html.markdown b/website/docs/cdktf/python/d/eks_addon_version.html.markdown
new file mode 100644
index 00000000000..f8b589a20b7
--- /dev/null
+++ b/website/docs/cdktf/python/d/eks_addon_version.html.markdown
@@ -0,0 +1,70 @@
+---
+subcategory: "EKS (Elastic Kubernetes)"
+layout: "aws"
+page_title: "AWS: aws_eks_addon_version"
+description: |-
+  Retrieve information about versions of an EKS add-on
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_eks_addon_version
+
+Retrieve information about a specific EKS add-on version compatible with an EKS cluster version.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformOutput, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_eks_addon_version import DataAwsEksAddonVersion
+from imports.aws.eks_addon import EksAddon
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        default_var = DataAwsEksAddonVersion(self, "default",
+            addon_name="vpc-cni",
+            kubernetes_version=example.version
+        )
+        latest = DataAwsEksAddonVersion(self, "latest",
+            addon_name="vpc-cni",
+            kubernetes_version=example.version,
+            most_recent=True
+        )
+        cdktf_terraform_output_default = TerraformOutput(self, "default_2",
+            value=default_var.version
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        cdktf_terraform_output_default.override_logical_id("default")
+        cdktf_terraform_output_latest = TerraformOutput(self, "latest_3",
+            value=latest.version
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        cdktf_terraform_output_latest.override_logical_id("latest")
+        EksAddon(self, "vpc_cni",
+            addon_name="vpc-cni",
+            addon_version=Token.as_string(latest.version),
+            cluster_name=example.name
+        )
+```
+
+## Argument Reference
+
+* `addon_name` – (Required) Name of the EKS add-on. The name must match one of
+  the names returned by [list-addon](https://docs.aws.amazon.com/cli/latest/reference/eks/list-addons.html).
+* `kubernetes_version` – (Required) Version of the EKS Cluster. Must be between 1-100 characters in length. Must begin with an alphanumeric character, and must only contain alphanumeric characters, dashes and underscores (`^[0-9A-Za-z][A-Za-z0-9\-_]+$`).
+* `most_recent` - (Optional) Determines if the most recent or default version of the addon should be returned.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - Name of the add-on
+* `version` - Version of the EKS add-on.
+
+<!-- cache-key: cdktf-0.18.0 input-6bea559fed867c091f7f8ce8ca24a017cb6af1e256023fe4160201c7d3a8800c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/eks_cluster.html.markdown b/website/docs/cdktf/python/d/eks_cluster.html.markdown
new file mode 100644
index 00000000000..e581a038fca
--- /dev/null
+++ b/website/docs/cdktf/python/d/eks_cluster.html.markdown
@@ -0,0 +1,85 @@
+---
+subcategory: "EKS (Elastic Kubernetes)"
+layout: "aws"
+page_title: "AWS: aws_eks_cluster"
+description: |-
+  Retrieve information about an EKS Cluster
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_eks_cluster
+
+Retrieve information about an EKS Cluster.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformOutput, Fn, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_eks_cluster import DataAwsEksCluster
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = DataAwsEksCluster(self, "example",
+            name="example"
+        )
+        TerraformOutput(self, "endpoint",
+            value=example.endpoint
+        )
+        TerraformOutput(self, "identity-oidc-issuer",
+            value=Fn.lookup_nested(example.identity, ["0", "oidc", "0", "issuer"])
+        )
+        TerraformOutput(self, "kubeconfig-certificate-authority-data",
+            value=Fn.lookup_nested(example.certificate_authority, ["0", "data"])
+        )
+```
+
+## Argument Reference
+
+* `name` - (Required) Name of the cluster. Must be between 1-100 characters in length. Must begin with an alphanumeric character, and must only contain alphanumeric characters, dashes and underscores (`^[0-9A-Za-z][A-Za-z0-9\-_]+$`).
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - Name of the cluster
+* `arn` - ARN of the cluster.
+* `certificate_authority` - Nested attribute containing `certificate-authority-data` for your cluster.
+    * `data` - The base64 encoded certificate data required to communicate with your cluster. Add this to the `certificate-authority-data` section of the `kubeconfig` file for your cluster.
+* `cluster_id` - The ID of your local Amazon EKS cluster on the AWS Outpost. This attribute isn't available for an AWS EKS cluster on AWS cloud.
+* `created_at` - Unix epoch time stamp in seconds for when the cluster was created.
+* `enabled_cluster_log_types` - The enabled control plane logs.
+* `endpoint` - Endpoint for your Kubernetes API server.
+* `identity` - Nested attribute containing identity provider information for your cluster. Only available on Kubernetes version 1.13 and 1.14 clusters created or upgraded on or after September 3, 2019. For an example using this information to enable IAM Roles for Service Accounts, see the [`aws_eks_cluster` resource documentation](/docs/providers/aws/r/eks_cluster.html).
+    * `oidc` - Nested attribute containing [OpenID Connect](https://openid.net/connect/) identity provider information for the cluster.
+        * `issuer` - Issuer URL for the OpenID Connect identity provider.
+* `kubernetes_network_config` - Nested list containing Kubernetes Network Configuration.
+    * `ip_family` - `ipv4` or `ipv6`.
+    * `service_ipv4_cidr` - The CIDR block to assign Kubernetes pod and service IP addresses from if `ipv4` was specified when the cluster was created.
+    * `service_ipv6_cidr` - The CIDR block to assign Kubernetes pod and service IP addresses from if `ipv6` was specified when the cluster was created. Kubernetes assigns service addresses from the unique local address range (fc00::/7) because you can't specify a custom IPv6 CIDR block when you create the cluster.
+* `outpost_config` - Contains Outpost Configuration.
+    * `control_plane_instance_type` - The Amazon EC2 instance type for all Kubernetes control plane instances.
+    * `control_plane_placement` - An object representing the placement configuration for all the control plane instances of your local Amazon EKS cluster on AWS Outpost.
+        * `group_name` - The name of the placement group for the Kubernetes control plane instances.
+    * `outpost_arns` - List of ARNs of the Outposts hosting the EKS cluster. Only a single ARN is supported currently.
+* `platform_version` - Platform version for the cluster.
+* `role_arn` - ARN of the IAM role that provides permissions for the Kubernetes control plane to make calls to AWS API operations on your behalf.
+* `status` - Status of the EKS cluster. One of `CREATING`, `ACTIVE`, `DELETING`, `FAILED`.
+* `tags` - Key-value map of resource tags.
+* `version` - Kubernetes server version for the cluster.
+* `vpc_config` - Nested list containing VPC configuration for the cluster.
+    * `cluster_security_group_id` - The cluster security group that was created by Amazon EKS for the cluster.
+    * `endpoint_private_access` - Indicates whether or not the Amazon EKS private API server endpoint is enabled.
+    * `endpoint_public_access` - Indicates whether or not the Amazon EKS public API server endpoint is enabled.
+    * `public_access_cidrs` - List of CIDR blocks. Indicates which CIDR blocks can access the Amazon EKS public API server endpoint.
+    * `security_group_ids` – List of security group IDs
+    * `subnet_ids` – List of subnet IDs
+    * `vpc_id` – The VPC associated with your cluster.
+
+<!-- cache-key: cdktf-0.18.0 input-c6c973609d8849dfdbe288511dbb8b53a13192e5d23e4a6f41498b65a5c39508 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/eks_cluster_auth.html.markdown b/website/docs/cdktf/python/d/eks_cluster_auth.html.markdown
new file mode 100644
index 00000000000..b24f842234f
--- /dev/null
+++ b/website/docs/cdktf/python/d/eks_cluster_auth.html.markdown
@@ -0,0 +1,68 @@
+---
+subcategory: "EKS (Elastic Kubernetes)"
+layout: "aws"
+page_title: "AWS: aws_eks_cluster_auth"
+description: |-
+  Get an authentication token to communicate with an EKS Cluster
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_eks_cluster_auth
+
+Get an authentication token to communicate with an EKS cluster.
+
+Uses IAM credentials from the AWS provider to generate a temporary token that is compatible with
+[AWS IAM Authenticator](https://github.com/kubernetes-sigs/aws-iam-authenticator) authentication.
+This can be used to authenticate to an EKS cluster or to a cluster that has the AWS IAM Authenticator
+server configured.
+
+~> **NOTE:** Dynamically configuring a Terraform Provider via data sources currently has implications on [resource import support](https://github.com/hashicorp/terraform/issues/13018) on Terraform `<1.3.0`.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_eks_cluster import DataAwsEksCluster
+from imports.aws.data_aws_eks_cluster_auth import DataAwsEksClusterAuth
+from imports.kubernetes.provider import KubernetesProvider
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        # The following providers are missing schema information and might need manual adjustments to synthesize correctly: kubernetes.
+        #     For a more precise conversion please use the --provider flag in convert.
+        example = DataAwsEksCluster(self, "example",
+            name="example"
+        )
+        data_aws_eks_cluster_auth_example = DataAwsEksClusterAuth(self, "example_1",
+            name="example"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_eks_cluster_auth_example.override_logical_id("example")
+        KubernetesProvider(self, "kubernetes",
+            cluster_ca_certificate=Fn.base64decode(
+                Token.as_string(
+                    Fn.lookup_nested(example.certificate_authority, ["0", "data"]))),
+            host=example.endpoint,
+            token=data_aws_eks_cluster_auth_example.token
+        )
+```
+
+## Argument Reference
+
+* `name` - (Required) Name of the cluster
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - Name of the cluster.
+* `token` - Token to use to authenticate with the cluster.
+
+<!-- cache-key: cdktf-0.18.0 input-45d83dddba9412e716f03bde08f7185de087e8a46407d442260f7b0e6e29f02a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/eks_clusters.html.markdown b/website/docs/cdktf/python/d/eks_clusters.html.markdown
new file mode 100644
index 00000000000..9f93a2e57c4
--- /dev/null
+++ b/website/docs/cdktf/python/d/eks_clusters.html.markdown
@@ -0,0 +1,52 @@
+---
+subcategory: "EKS (Elastic Kubernetes)"
+layout: "aws"
+page_title: "AWS: aws_eks_clusters"
+description: |-
+  Retrieve EKS Clusters list
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_eks_clusters
+
+Retrieve EKS Clusters list
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformIterator, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_eks_cluster import DataAwsEksCluster
+from imports.aws.data_aws_eks_clusters import DataAwsEksClusters
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = DataAwsEksClusters(self, "example")
+        # In most cases loops should be handled in the programming language context and
+        #     not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+        #     you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+        #     you need to keep this like it is.
+        example_for_each_iterator = TerraformIterator.from_list(
+            Token.as_any(Fn.toset(example.names)))
+        data_aws_eks_cluster_example = DataAwsEksCluster(self, "example_1",
+            name=Token.as_string(example_for_each_iterator.value),
+            for_each=example_for_each_iterator
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_eks_cluster_example.override_logical_id("example")
+```
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - AWS Region.
+* `names` - Set of EKS clusters names
+
+<!-- cache-key: cdktf-0.18.0 input-dcfc76e9158933045e252a7c855e58231f5ae7d708f1bbdd9026d8d93182a8f3 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/eks_node_group.html.markdown b/website/docs/cdktf/python/d/eks_node_group.html.markdown
new file mode 100644
index 00000000000..5d83e2e9f58
--- /dev/null
+++ b/website/docs/cdktf/python/d/eks_node_group.html.markdown
@@ -0,0 +1,77 @@
+---
+subcategory: "EKS (Elastic Kubernetes)"
+layout: "aws"
+page_title: "AWS: aws_eks_node_group"
+description: |-
+  Retrieve information about an EKS Node Group
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_eks_node_group
+
+Retrieve information about an EKS Node Group.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_eks_node_group import DataAwsEksNodeGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsEksNodeGroup(self, "example",
+            cluster_name="example",
+            node_group_name="example"
+        )
+```
+
+## Argument Reference
+
+* `cluster_name` - (Required) Name of the cluster.
+* `node_group_name` - (Required) Name of the node group.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - EKS Cluster name and EKS Node Group name separated by a colon (`:`).
+* `ami_type` - Type of Amazon Machine Image (AMI) associated with the EKS Node Group.
+* `arn` - ARN of the EKS Node Group.
+* `capacity_type` - Type of capacity associated with the EKS Node Group. Valid values: `ON_DEMAND`, `SPOT`.
+* `disk_size` - Disk size in GiB for worker nodes.
+* `instance_types` - Set of instance types associated with the EKS Node Group.
+* `labels` - Key-value map of Kubernetes labels. Only labels that are applied with the EKS API are managed by this argument. Other Kubernetes labels applied to the EKS Node Group will not be managed.
+* `launch_template` - Nested attribute containing information about the launch template used to create the EKS Node Group.
+    * `id` - The ID of the launch template.
+    * `name` - The name of the launch template.
+    * `version` - The version number of the launch template.
+* `node_role_arn` – ARN of the IAM Role that provides permissions for the EKS Node Group.
+* `release_version` – AMI version of the EKS Node Group.
+* `remote_access` - Configuration block with remote access settings.
+    * `ec2_ssh_key` - EC2 Key Pair name that provides access for SSH communication with the worker nodes in the EKS Node Group.
+    * `source_security_group_ids` - Set of EC2 Security Group IDs to allow SSH access (port 22) from on the worker nodes.
+* `resources` - List of objects containing information about underlying resources.
+    * `autoscaling_groups` - List of objects containing information about AutoScaling Groups.
+        * `name` - Name of the AutoScaling Group.
+    * `remote_access_security_group_id` - Identifier of the remote access EC2 Security Group.
+* `scaling_config` - Configuration block with scaling settings.
+    * `desired_size` - Desired number of worker nodes.
+    * `max_size` - Maximum number of worker nodes.
+    * `min_size` - Minimum number of worker nodes.
+* `status` - Status of the EKS Node Group.
+* `subnet_ids` – Identifiers of EC2 Subnets to associate with the EKS Node Group.
+* `taints` - List of objects containing information about taints applied to the nodes in the EKS Node Group.
+    * `key` - The key of the taint.
+    * `value` - The value of the taint.
+    * `effect` - The effect of the taint.
+* `tags` - Key-value map of resource tags.
+* `version` – Kubernetes version.
+
+<!-- cache-key: cdktf-0.18.0 input-455f97b7456c88e1697131f0d9d93c38151b37400a9cfe93bcaa3f2bceee01a2 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/eks_node_groups.html.markdown b/website/docs/cdktf/python/d/eks_node_groups.html.markdown
new file mode 100644
index 00000000000..149e3ff7f21
--- /dev/null
+++ b/website/docs/cdktf/python/d/eks_node_groups.html.markdown
@@ -0,0 +1,59 @@
+---
+subcategory: "EKS (Elastic Kubernetes)"
+layout: "aws"
+page_title: "AWS: aws_eks_node_groups"
+description: |-
+  Provides a set of node groups for an EKS Cluster
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_eks_node_groups
+
+Retrieve the EKS Node Groups associated with a named EKS cluster. This will allow you to pass a list of Node Group names to other resources.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformIterator, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_eks_node_group import DataAwsEksNodeGroup
+from imports.aws.data_aws_eks_node_groups import DataAwsEksNodeGroups
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = DataAwsEksNodeGroups(self, "example",
+            cluster_name="example"
+        )
+        # In most cases loops should be handled in the programming language context and
+        #     not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+        #     you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+        #     you need to keep this like it is.
+        example_for_each_iterator = TerraformIterator.from_list(
+            Token.as_any(example.names))
+        data_aws_eks_node_group_example = DataAwsEksNodeGroup(self, "example_1",
+            cluster_name="example",
+            node_group_name=Token.as_string(example_for_each_iterator.value),
+            for_each=example_for_each_iterator
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_eks_node_group_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+* `cluster_name` - (Required) Name of the cluster.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - Cluster name.
+* `names` - Set of all node group names in an EKS Cluster.
+
+<!-- cache-key: cdktf-0.18.0 input-247b947784562fdc28bdbed2be700b3594988bb4a6202ca8641a02a2b58e0633 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/elastic_beanstalk_application.html.markdown b/website/docs/cdktf/python/d/elastic_beanstalk_application.html.markdown
new file mode 100644
index 00000000000..9f372be7307
--- /dev/null
+++ b/website/docs/cdktf/python/d/elastic_beanstalk_application.html.markdown
@@ -0,0 +1,59 @@
+---
+subcategory: "Elastic Beanstalk"
+layout: "aws"
+page_title: "AWS: aws_elastic_beanstalk_application"
+description: |-
+  Retrieve information about an Elastic Beanstalk Application
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_elastic_beanstalk_application
+
+Retrieve information about an Elastic Beanstalk Application.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformOutput, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_elastic_beanstalk_application import DataAwsElasticBeanstalkApplication
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = DataAwsElasticBeanstalkApplication(self, "example",
+            name="example"
+        )
+        TerraformOutput(self, "arn",
+            value=example.arn
+        )
+        TerraformOutput(self, "description",
+            value=example.description
+        )
+```
+
+## Argument Reference
+
+* `name` - (Required) Name of the application
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - Name of the application
+* `arn` - ARN of the application.
+* `description` - Short description of the application
+
+Application version lifecycle (`appversion_lifecycle`) supports the nested attribute containing.
+
+* `service_role` - ARN of an IAM service role under which the application version is deleted.  Elastic Beanstalk must have permission to assume this role.
+* `max_count` - Maximum number of application versions to retain.
+* `max_age_in_days` - Number of days to retain an application version.
+* `delete_source_from_s3` - Specifies whether delete a version's source bundle from S3 when the application version is deleted.
+
+<!-- cache-key: cdktf-0.18.0 input-91e8e35e02809b1291798f560a469b0ee44ac2ca2072d3eb5b99110f092216bf -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/elastic_beanstalk_hosted_zone.html.markdown b/website/docs/cdktf/python/d/elastic_beanstalk_hosted_zone.html.markdown
new file mode 100644
index 00000000000..81e360e0a21
--- /dev/null
+++ b/website/docs/cdktf/python/d/elastic_beanstalk_hosted_zone.html.markdown
@@ -0,0 +1,44 @@
+---
+subcategory: "Elastic Beanstalk"
+layout: "aws"
+page_title: "AWS: aws_elastic_beanstalk_hosted_zone"
+description: |-
+  Get an elastic beanstalk hosted zone.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_elastic_beanstalk_hosted_zone
+
+Use this data source to get the ID of an [elastic beanstalk hosted zone](http://docs.aws.amazon.com/general/latest/gr/rande.html#elasticbeanstalk_region).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_elastic_beanstalk_hosted_zone import DataAwsElasticBeanstalkHostedZone
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsElasticBeanstalkHostedZone(self, "current")
+```
+
+## Argument Reference
+
+* `region` - (Optional) Region you'd like the zone for. By default, fetches the current region.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the hosted zone.
+
+* `region` - Region of the hosted zone.
+
+<!-- cache-key: cdktf-0.18.0 input-289a7d0916600ca4fb2e9823e5d274b3fded6da1f72c678b3ea3c8ecc0af826c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/elastic_beanstalk_solution_stack.html.markdown b/website/docs/cdktf/python/d/elastic_beanstalk_solution_stack.html.markdown
new file mode 100644
index 00000000000..14d3d7be154
--- /dev/null
+++ b/website/docs/cdktf/python/d/elastic_beanstalk_solution_stack.html.markdown
@@ -0,0 +1,56 @@
+---
+subcategory: "Elastic Beanstalk"
+layout: "aws"
+page_title: "AWS: aws_elastic_beanstalk_solution_stack"
+description: |-
+  Get an elastic beanstalk solution stack.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_elastic_beanstalk_solution_stack
+
+Use this data source to get the name of a elastic beanstalk solution stack.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_elastic_beanstalk_solution_stack import DataAwsElasticBeanstalkSolutionStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsElasticBeanstalkSolutionStack(self, "multi_docker",
+            most_recent=True,
+            name_regex="^64bit Amazon Linux (.*) Multi-container Docker (.*)$"
+        )
+```
+
+## Argument Reference
+
+* `most_recent` - (Optional) If more than one result is returned, use the most
+recent solution stack.
+
+* `name_regex` - Regex string to apply to the solution stack list returned
+by AWS. See [Elastic Beanstalk Supported Platforms][beanstalk-platforms] from
+AWS documentation for reference solution stack names.
+
+~> **NOTE:** If more or less than a single match is returned by the search,
+Terraform will fail. Ensure that your search is specific enough to return
+a single solution stack, or use `most_recent` to choose the most recent one.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `name` - Name of the solution stack.
+
+[beanstalk-platforms]: http://docs.aws.amazon.com/elasticbeanstalk/latest/dg/concepts.platforms.html "AWS Elastic Beanstalk Supported Platforms documentation"
+
+<!-- cache-key: cdktf-0.18.0 input-bc5855ffbad2c3da05d523f3dafaef60d18324e30f798e90fe32639ded015eeb -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/elasticache_cluster.html.markdown b/website/docs/cdktf/python/d/elasticache_cluster.html.markdown
new file mode 100644
index 00000000000..e15586fe33f
--- /dev/null
+++ b/website/docs/cdktf/python/d/elasticache_cluster.html.markdown
@@ -0,0 +1,73 @@
+---
+subcategory: "ElastiCache"
+layout: "aws"
+page_title: "AWS: aws_elasticache_cluster"
+description: |-
+  Get information on an ElastiCache Cluster resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_elasticache_cluster
+
+Use this data source to get information about an ElastiCache Cluster
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_elasticache_cluster import DataAwsElasticacheCluster
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsElasticacheCluster(self, "my_cluster",
+            cluster_id="my-cluster-id"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `cluster_id` – (Required) Group identifier.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `node_type` – The cluster node type.
+* `num_cache_nodes` – The number of cache nodes that the cache cluster has.
+* `engine` – Name of the cache engine.
+* `engine_version` – Version number of the cache engine.
+* `ip_discovery` - The IP version advertised in the discovery protocol.
+* `network_type` - The IP versions for cache cluster connections.
+* `subnet_group_name` – Name of the subnet group associated to the cache cluster.
+* `security_group_ids` – List VPC security groups associated with the cache cluster.
+* `parameter_group_name` – Name of the parameter group associated with this cache cluster.
+* `replication_group_id` - The replication group to which this cache cluster belongs.
+* `log_delivery_configuration` - Redis [SLOWLOG](https://redis.io/commands/slowlog) or Redis [Engine Log](https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/Log_Delivery.html#Log_contents-engine-log) delivery settings.
+* `maintenance_window` – Specifies the weekly time range for when maintenance
+on the cache cluster is performed.
+* `snapshot_window` - Daily time range (in UTC) during which ElastiCache will
+begin taking a daily snapshot of the cache cluster.
+* `snapshot_retention_limit` - The number of days for which ElastiCache will
+retain automatic cache cluster snapshots before deleting them.
+* `availability_zone` - Availability Zone for the cache cluster.
+* `notification_topic_arn` – An ARN of an
+SNS topic that ElastiCache notifications get sent to.
+* `port` – The port number on which each of the cache nodes will
+accept connections.
+* `configuration_endpoint` - (Memcached only) Configuration endpoint to allow host discovery.
+* `cluster_address` - (Memcached only) DNS name of the cache cluster without the port appended.
+* `preferred_outpost_arn` - The outpost ARN in which the cache cluster was created if created in outpost.
+* `cache_nodes` - List of node objects including `id`, `address`, `port`, `availability_zone` and `outpost_arn`.
+   Referenceable e.g., as `${data.aws_elasticache_cluster.bar.cache_nodes.0.address}`
+* `tags` - Tags assigned to the resource
+
+<!-- cache-key: cdktf-0.18.0 input-1e3ac11eb5023a5844f4de255a62edd6fa79961694900996bd0798736ae27445 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/elasticache_replication_group.html.markdown b/website/docs/cdktf/python/d/elasticache_replication_group.html.markdown
new file mode 100644
index 00000000000..d80e8fa4544
--- /dev/null
+++ b/website/docs/cdktf/python/d/elasticache_replication_group.html.markdown
@@ -0,0 +1,62 @@
+---
+subcategory: "ElastiCache"
+layout: "aws"
+page_title: "AWS: aws_elasticache_replication_group"
+description: |-
+  Get information on an ElastiCache Replication Group resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_elasticache_replication_group
+
+Use this data source to get information about an ElastiCache Replication Group.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_elasticache_replication_group import DataAwsElasticacheReplicationGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsElasticacheReplicationGroup(self, "bar",
+            replication_group_id="example"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `replication_group_id` – (Required) Identifier for the replication group.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `description` - Description of the replication group.
+* `arn` - ARN of the created ElastiCache Replication Group.
+* `auth_token_enabled` - Whether an AuthToken (password) is enabled.
+* `automatic_failover_enabled` - A flag whether a read-only replica will be automatically promoted to read/write primary if the existing primary fails.
+* `node_type` – The cluster node type.
+* `num_cache_clusters` – The number of cache clusters that the replication group has.
+* `num_node_groups` - Number of node groups (shards) for the replication group.
+* `member_clusters` - Identifiers of all the nodes that are part of this replication group.
+* `multi_az_enabled` - Whether Multi-AZ Support is enabled for the replication group.
+* `replicas_per_node_group` - Number of replica nodes in each node group.
+* `log_delivery_configuration` - Redis [SLOWLOG](https://redis.io/commands/slowlog) or Redis [Engine Log](https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/Log_Delivery.html#Log_contents-engine-log) delivery settings.
+* `snapshot_window` - Daily time range (in UTC) during which ElastiCache begins taking a daily snapshot of your node group (shard).
+* `snapshot_retention_limit` - The number of days for which ElastiCache retains automatic cache cluster snapshots before deleting them.
+* `port` – The port number on which the configuration endpoint will accept connections.
+* `configuration_endpoint_address` - The configuration endpoint address to allow host discovery.
+* `primary_endpoint_address` - The endpoint of the primary node in this node group (shard).
+* `reader_endpoint_address` - The endpoint of the reader node in this node group (shard).
+
+<!-- cache-key: cdktf-0.18.0 input-88b0ad58e7a5f900fe3b48cf41ab1eb422b27cf6f91b31132f855aea899008d0 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/elasticache_subnet_group.html.markdown b/website/docs/cdktf/python/d/elasticache_subnet_group.html.markdown
new file mode 100644
index 00000000000..ea56fc4fab4
--- /dev/null
+++ b/website/docs/cdktf/python/d/elasticache_subnet_group.html.markdown
@@ -0,0 +1,50 @@
+---
+subcategory: "ElastiCache"
+layout: "aws"
+page_title: "AWS: aws_elasticache_subnet_group"
+description: |-
+  Provides information about a ElastiCache Subnet Group.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_elasticache_subnet_group
+
+Provides information about a ElastiCache Subnet Group.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_elasticache_subnet_group import DataAwsElasticacheSubnetGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsElasticacheSubnetGroup(self, "example",
+            name="my-subnet-group"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) Name of the subnet group.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - Name of the subnet group.
+* `arn` - ARN of the subnet group.
+* `description` - Description of the subnet group.
+* `subnet_ids` - Set of VPC Subnet ID-s of the subnet group.
+* `tags` - Map of tags assigned to the subnet group.
+
+<!-- cache-key: cdktf-0.18.0 input-a10cc3d3cb3b8626a11dcf295b29f911836bff7d00ed1bca0e896ee84c058643 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/elasticache_user.html.markdown b/website/docs/cdktf/python/d/elasticache_user.html.markdown
new file mode 100644
index 00000000000..e53a572189a
--- /dev/null
+++ b/website/docs/cdktf/python/d/elasticache_user.html.markdown
@@ -0,0 +1,48 @@
+---
+subcategory: "ElastiCache"
+layout: "aws"
+page_title: "AWS: aws_elasticache_user"
+description: |-
+  Get information on an ElastiCache User resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_elasticache_user
+
+Use this data source to get information about an ElastiCache User.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_elasticache_user import DataAwsElasticacheUser
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsElasticacheUser(self, "bar",
+            user_id="example"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `user_id` – (Required) Identifier for the user.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `user_id` - Identifier for the user.
+* `user_name` - User name of the user.
+* `access_string` - String for what access a user possesses within the associated ElastiCache replication groups or clusters.
+
+<!-- cache-key: cdktf-0.18.0 input-64eebcc31de3d79926a950f1207062bdd9ae37c2badee3ea0ae9ce16d2cd8d16 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/elasticsearch_domain.html.markdown b/website/docs/cdktf/python/d/elasticsearch_domain.html.markdown
new file mode 100644
index 00000000000..b19ed22667c
--- /dev/null
+++ b/website/docs/cdktf/python/d/elasticsearch_domain.html.markdown
@@ -0,0 +1,109 @@
+---
+subcategory: "Elasticsearch"
+layout: "aws"
+page_title: "AWS: aws_elasticsearch_domain"
+description: |-
+  Get information on an Elasticsearch Domain resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_elasticsearch_domain
+
+Use this data source to get information about an Elasticsearch Domain
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_elasticsearch_domain import DataAwsElasticsearchDomain
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsElasticsearchDomain(self, "my_domain",
+            domain_name="my-domain-name"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `domain_name` – (Required) Name of the domain.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `access_policies` – The policy document attached to the domain.
+* `advanced_options` - Key-value string pairs to specify advanced configuration options.
+* `advanced_security_options` - Status of the Elasticsearch domain's advanced security options. The block consists of the following attributes:
+    * `enabled` - Whether advanced security is enabled.
+    * `internal_user_database_enabled` - Whether the internal user database is enabled.
+* `arn` – The ARN of the domain.
+* `auto_tune_options` - Configuration of the Auto-Tune options of the domain.
+    * `desired_state` - The Auto-Tune desired state for the domain.
+    * `maintenance_schedule` - A list of the nested configurations for the Auto-Tune maintenance windows of the domain.
+        * `start_at` - Date and time at which the Auto-Tune maintenance schedule starts in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8).
+        * `duration` - Configuration block for the duration of the Auto-Tune maintenance window.
+            * `value` - Duration of an Auto-Tune maintenance window.
+            * `unit` - Unit of time.
+        * `cron_expression_for_recurrence` - Cron expression for an Auto-Tune maintenance schedule.
+    * `rollback_on_disable` - Whether the domain is set to roll back to default Auto-Tune settings when disabling Auto-Tune.
+* `cluster_config` - Cluster configuration of the domain.
+    * `cold_storage_options` - Configuration block containing cold storage configuration.
+        * `enabled` - Indicates  cold storage is enabled.
+    * `instance_type` - Instance type of data nodes in the cluster.
+    * `instance_count` - Number of instances in the cluster.
+    * `dedicated_master_enabled` - Indicates whether dedicated master nodes are enabled for the cluster.
+    * `dedicated_master_type` - Instance type of the dedicated master nodes in the cluster.
+    * `dedicated_master_count` - Number of dedicated master nodes in the cluster.
+    * `zone_awareness_enabled` - Indicates whether zone awareness is enabled.
+    * `zone_awareness_config` - Configuration block containing zone awareness settings.
+        * `availability_zone_count` - Number of availability zones used.
+    * `warm_enabled` - Warm storage is enabled.
+    * `warm_count` - The number of warm nodes in the cluster.
+    * `warm_type` - The instance type for the Elasticsearch cluster's warm nodes.
+* `cognito_options` - Domain Amazon Cognito Authentication options for Kibana.
+    * `enabled` - Whether Amazon Cognito Authentication is enabled.
+    * `user_pool_id` - The Cognito User pool used by the domain.
+    * `identity_pool_id` - The Cognito Identity pool used by the domain.
+    * `role_arn` - The IAM Role with the AmazonESCognitoAccess policy attached.
+* `created` – Status of the creation of the domain.
+* `deleted` – Status of the deletion of the domain.
+* `domain_id` – Unique identifier for the domain.
+* `ebs_options` - EBS Options for the instances in the domain.
+    * `ebs_enabled` - Whether EBS volumes are attached to data nodes in the domain.
+    * `throughput` - The throughput (in MiB/s) of the EBS volumes attached to data nodes.
+    * `volume_type` - The type of EBS volumes attached to data nodes.
+    * `volume_size` - The size of EBS volumes attached to data nodes (in GB).
+    * `iops` - The baseline input/output (I/O) performance of EBS volumes attached to data nodes.
+* `elasticsearch_version` – Elasticsearch version for the domain.
+* `encryption_at_rest` - Domain encryption at rest related options.
+    * `enabled` - Whether encryption at rest is enabled in the domain.
+    * `kms_key_id` - The KMS key id used to encrypt data at rest.
+* `endpoint` – Domain-specific endpoint used to submit index, search, and data upload requests.
+* `kibana_endpoint` - Domain-specific endpoint used to access the Kibana application.
+* `log_publishing_options` - Domain log publishing related options.
+    * `log_type` - The type of Elasticsearch log being published.
+    * `cloudwatch_log_group_arn` - The CloudWatch Log Group where the logs are published.
+    * `enabled` - Whether log publishing is enabled.
+* `node_to_node_encryption` - Domain in transit encryption related options.
+    * `enabled` - Whether node to node encryption is enabled.
+* `processing` – Status of a configuration change in the domain.
+* `snapshot_options` – Domain snapshot related options.
+    * `automated_snapshot_start_hour` - Hour during which the service takes an automated daily snapshot of the indices in the domain.
+* `tags` - Tags assigned to the domain.
+* `vpc_options` - VPC Options for private Elasticsearch domains.
+    * `availability_zones` - The availability zones used by the domain.
+    * `security_group_ids` - The security groups used by the domain.
+    * `subnet_ids` - The subnets used by the domain.
+    * `vpc_id` - The VPC used by the domain.
+
+<!-- cache-key: cdktf-0.18.0 input-7feb15d47a2d190cb607bbd9038a049ea8b0ea44a4960e578dae2f2fe8f04a38 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/elb.html.markdown b/website/docs/cdktf/python/d/elb.html.markdown
new file mode 100644
index 00000000000..a2baa3a03d6
--- /dev/null
+++ b/website/docs/cdktf/python/d/elb.html.markdown
@@ -0,0 +1,57 @@
+---
+subcategory: "ELB Classic"
+layout: "aws"
+page_title: "AWS: aws_elb"
+description: |-
+  Provides a classic Elastic Load Balancer data source.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# aws_elb
+
+Provides information about a "classic" Elastic Load Balancer (ELB).
+See [LB Data Source](/docs/providers/aws/d/lb.html) if you are looking for "v2"
+Application Load Balancer (ALB) or Network Load Balancer (NLB).
+
+This data source can prove useful when a module accepts an LB as an input
+variable and needs to, for example, determine the security groups associated
+with it, etc.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import VariableType, TerraformVariable, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_elb import DataAwsElb
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        # Terraform Variables are not always the best fit for getting inputs in the context of Terraform CDK.
+        #     You can read more about this at https://cdk.tf/variables
+        lb_name = TerraformVariable(self, "lb_name",
+            default="",
+            type=VariableType.STRING
+        )
+        DataAwsElb(self, "test",
+            name=lb_name.string_value
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Unique name of the load balancer.
+
+## Attribute Reference
+
+See the [ELB Resource](/docs/providers/aws/r/elb.html) for details on the
+returned attributes - they are identical.
+
+<!-- cache-key: cdktf-0.18.0 input-82d29b709dd7359897c580a20647f7da354bd7d44a7d5f92c310d80cad1259b8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/elb_hosted_zone_id.html.markdown b/website/docs/cdktf/python/d/elb_hosted_zone_id.html.markdown
new file mode 100644
index 00000000000..2658e05b8b4
--- /dev/null
+++ b/website/docs/cdktf/python/d/elb_hosted_zone_id.html.markdown
@@ -0,0 +1,55 @@
+---
+subcategory: "ELB Classic"
+layout: "aws"
+page_title: "AWS: aws_elb_hosted_zone_id"
+description: |-
+  Get AWS Elastic Load Balancing Hosted Zone Id
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_elb_hosted_zone_id
+
+Use this data source to get the HostedZoneId of the AWS Elastic Load Balancing HostedZoneId
+in a given region for the purpose of using in an AWS Route53 Alias.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_elb_hosted_zone_id import DataAwsElbHostedZoneId
+from imports.aws.route53_record import Route53Record
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        main = DataAwsElbHostedZoneId(self, "main")
+        Route53Record(self, "www",
+            alias=Route53RecordAlias(
+                evaluate_target_health=True,
+                name=Token.as_string(aws_elb_main.dns_name),
+                zone_id=Token.as_string(main.id)
+            ),
+            name="example.com",
+            type="A",
+            zone_id=primary.zone_id
+        )
+```
+
+## Argument Reference
+
+* `region` - (Optional) Name of the region whose AWS ELB HostedZoneId is desired.
+  Defaults to the region from the AWS provider configuration.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the AWS ELB HostedZoneId in the selected region.
+
+<!-- cache-key: cdktf-0.18.0 input-c2a71897abaf8ebad957ebc450a6e6db3c22c6c5e61e688eccadc3e3e3d48143 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/elb_service_account.html.markdown b/website/docs/cdktf/python/d/elb_service_account.html.markdown
new file mode 100644
index 00000000000..d75971f2e3d
--- /dev/null
+++ b/website/docs/cdktf/python/d/elb_service_account.html.markdown
@@ -0,0 +1,93 @@
+---
+subcategory: "ELB Classic"
+layout: "aws"
+page_title: "AWS: aws_elb_service_account"
+description: |-
+  Get AWS Elastic Load Balancing Service Account
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_elb_service_account
+
+Use this data source to get the Account ID of the [AWS Elastic Load Balancing Service Account](http://docs.aws.amazon.com/elasticloadbalancing/latest/classic/enable-access-logs.html#attach-bucket-policy)
+in a given region for the purpose of permitting in S3 bucket policy.
+
+~> **Note:** For AWS Regions opened since Jakarta (`ap-southeast-3`) in December 2021, AWS [documents that](https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/enable-access-logs.html#attach-bucket-policy) a [service principal name](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html#principal-services) should be used instead of an AWS account ID in any relevant IAM policy.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_elb_service_account import DataAwsElbServiceAccount
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.elb import Elb
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_acl import S3BucketAcl
+from imports.aws.s3_bucket_policy import S3BucketPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        elb_logs = S3Bucket(self, "elb_logs",
+            bucket="my-elb-tf-test-bucket"
+        )
+        S3BucketAcl(self, "elb_logs_acl",
+            acl="private",
+            bucket=elb_logs.id
+        )
+        main = DataAwsElbServiceAccount(self, "main")
+        allow_elb_logging = DataAwsIamPolicyDocument(self, "allow_elb_logging",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["s3:PutObject"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=[Token.as_string(main.arn)],
+                    type="AWS"
+                )
+                ],
+                resources=["${" + elb_logs.arn + "}/AWSLogs/*"]
+            )
+            ]
+        )
+        Elb(self, "bar",
+            access_logs=ElbAccessLogs(
+                bucket=elb_logs.id,
+                interval=5
+            ),
+            availability_zones=["us-west-2a"],
+            listener=[ElbListener(
+                instance_port=8000,
+                instance_protocol="http",
+                lb_port=80,
+                lb_protocol="http"
+            )
+            ],
+            name="my-foobar-terraform-elb"
+        )
+        aws_s3_bucket_policy_allow_elb_logging = S3BucketPolicy(self, "allow_elb_logging_5",
+            bucket=elb_logs.id,
+            policy=Token.as_string(allow_elb_logging.json)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_policy_allow_elb_logging.override_logical_id("allow_elb_logging")
+```
+
+## Argument Reference
+
+* `region` - (Optional) Name of the region whose AWS ELB account ID is desired.
+  Defaults to the region from the AWS provider configuration.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the AWS ELB service account in the selected region.
+* `arn` - ARN of the AWS ELB service account in the selected region.
+
+<!-- cache-key: cdktf-0.18.0 input-5c1a0a2f00d960e1eac9847050597712fa9715a5b915ce4e9af9ffb2813ec3ab -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/emr_release_labels.html.markdown b/website/docs/cdktf/python/d/emr_release_labels.html.markdown
new file mode 100644
index 00000000000..3e293529ce5
--- /dev/null
+++ b/website/docs/cdktf/python/d/emr_release_labels.html.markdown
@@ -0,0 +1,52 @@
+---
+subcategory: "EMR"
+layout: "aws"
+page_title: "AWS: aws_emr_release_labels"
+description: |-
+  Retrieve information about EMR Release Labels
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_emr_release_labels
+
+Retrieve information about EMR Release Labels.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_emr_release_labels import DataAwsEmrReleaseLabels
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsEmrReleaseLabels(self, "example",
+            filters=DataAwsEmrReleaseLabelsFilters(
+                application="spark@2.1.0",
+                prefix="emr-5"
+            )
+        )
+```
+
+## Argument Reference
+
+* `filters` – (Optional) Filters the results of the request. Prefix specifies the prefix of release labels to return. Application specifies the application (with/without version) of release labels to return. See [Filters](#filters).
+
+### Filters
+
+* `application` - (Optional) Optional release label application filter. For example, `Spark@2.1.0` or `Spark`.
+* `prefix` - (Optional) Optional release label version prefix filter. For example, `emr-5`.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `release_labels` - Returned release labels.
+
+<!-- cache-key: cdktf-0.18.0 input-caff30a437585dca8d53271b57c03d47d50046916f1661780cb3a6963d53b86c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/emr_release_labels.markdown b/website/docs/cdktf/python/d/emr_release_labels.markdown
new file mode 100644
index 00000000000..3e293529ce5
--- /dev/null
+++ b/website/docs/cdktf/python/d/emr_release_labels.markdown
@@ -0,0 +1,52 @@
+---
+subcategory: "EMR"
+layout: "aws"
+page_title: "AWS: aws_emr_release_labels"
+description: |-
+  Retrieve information about EMR Release Labels
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_emr_release_labels
+
+Retrieve information about EMR Release Labels.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_emr_release_labels import DataAwsEmrReleaseLabels
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsEmrReleaseLabels(self, "example",
+            filters=DataAwsEmrReleaseLabelsFilters(
+                application="spark@2.1.0",
+                prefix="emr-5"
+            )
+        )
+```
+
+## Argument Reference
+
+* `filters` – (Optional) Filters the results of the request. Prefix specifies the prefix of release labels to return. Application specifies the application (with/without version) of release labels to return. See [Filters](#filters).
+
+### Filters
+
+* `application` - (Optional) Optional release label application filter. For example, `Spark@2.1.0` or `Spark`.
+* `prefix` - (Optional) Optional release label version prefix filter. For example, `emr-5`.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `release_labels` - Returned release labels.
+
+<!-- cache-key: cdktf-0.18.0 input-caff30a437585dca8d53271b57c03d47d50046916f1661780cb3a6963d53b86c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/emrcontainers_virtual_cluster.html.markdown b/website/docs/cdktf/python/d/emrcontainers_virtual_cluster.html.markdown
new file mode 100644
index 00000000000..97e73ba735b
--- /dev/null
+++ b/website/docs/cdktf/python/d/emrcontainers_virtual_cluster.html.markdown
@@ -0,0 +1,61 @@
+---
+subcategory: "EMR Containers"
+layout: "aws"
+page_title: "AWS: aws_emrcontainers_virtual_cluster"
+description: |-
+  Retrieve information about an EMR Containers (EMR on EKS) Virtual Cluster
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_emrcontainers_virtual_cluster
+
+Retrieve information about an EMR Containers (EMR on EKS) Virtual Cluster.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformOutput, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_emrcontainers_virtual_cluster import DataAwsEmrcontainersVirtualCluster
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = DataAwsEmrcontainersVirtualCluster(self, "example",
+            virtual_cluster_id="example id"
+        )
+        TerraformOutput(self, "arn",
+            value=example.arn
+        )
+        TerraformOutput(self, "name",
+            value=example.name
+        )
+```
+
+## Argument Reference
+
+* `virtual_cluster_id` - (Required) ID of the cluster.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the cluster.
+* `name` - Name of the cluster.
+* `arn` - ARN of the cluster.
+* `container_provider` - Nested attribute containing information about the underlying container provider (EKS cluster) for your EMR Containers cluster.
+    * `id` - The name of the container provider that is running your EMR Containers cluster
+    * `info` - Nested list containing information about the configuration of the container provider
+        * `eks_info` - Nested list containing EKS-specific information about the cluster where the EMR Containers cluster is running
+            * `namespace` - The namespace where the EMR Containers cluster is running
+    * `type` - The type of the container provider
+* `created_at` - Unix epoch time stamp in seconds for when the cluster was created.
+* `state` - Status of the EKS cluster. One of `RUNNING`, `TERMINATING`, `TERMINATED`, `ARRESTED`.
+* `tags` - Key-value mapping of resource tags.
+
+<!-- cache-key: cdktf-0.18.0 input-b68b876212554fb1c28230029578a838320e08a00b6bc270b81195566fe1902f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/emrcontainers_virtual_cluster.markdown b/website/docs/cdktf/python/d/emrcontainers_virtual_cluster.markdown
new file mode 100644
index 00000000000..97e73ba735b
--- /dev/null
+++ b/website/docs/cdktf/python/d/emrcontainers_virtual_cluster.markdown
@@ -0,0 +1,61 @@
+---
+subcategory: "EMR Containers"
+layout: "aws"
+page_title: "AWS: aws_emrcontainers_virtual_cluster"
+description: |-
+  Retrieve information about an EMR Containers (EMR on EKS) Virtual Cluster
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_emrcontainers_virtual_cluster
+
+Retrieve information about an EMR Containers (EMR on EKS) Virtual Cluster.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformOutput, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_emrcontainers_virtual_cluster import DataAwsEmrcontainersVirtualCluster
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = DataAwsEmrcontainersVirtualCluster(self, "example",
+            virtual_cluster_id="example id"
+        )
+        TerraformOutput(self, "arn",
+            value=example.arn
+        )
+        TerraformOutput(self, "name",
+            value=example.name
+        )
+```
+
+## Argument Reference
+
+* `virtual_cluster_id` - (Required) ID of the cluster.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the cluster.
+* `name` - Name of the cluster.
+* `arn` - ARN of the cluster.
+* `container_provider` - Nested attribute containing information about the underlying container provider (EKS cluster) for your EMR Containers cluster.
+    * `id` - The name of the container provider that is running your EMR Containers cluster
+    * `info` - Nested list containing information about the configuration of the container provider
+        * `eks_info` - Nested list containing EKS-specific information about the cluster where the EMR Containers cluster is running
+            * `namespace` - The namespace where the EMR Containers cluster is running
+    * `type` - The type of the container provider
+* `created_at` - Unix epoch time stamp in seconds for when the cluster was created.
+* `state` - Status of the EKS cluster. One of `RUNNING`, `TERMINATING`, `TERMINATED`, `ARRESTED`.
+* `tags` - Key-value mapping of resource tags.
+
+<!-- cache-key: cdktf-0.18.0 input-b68b876212554fb1c28230029578a838320e08a00b6bc270b81195566fe1902f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/fsx_ontap_file_system.html.markdown b/website/docs/cdktf/python/d/fsx_ontap_file_system.html.markdown
new file mode 100644
index 00000000000..2cdd1621b1f
--- /dev/null
+++ b/website/docs/cdktf/python/d/fsx_ontap_file_system.html.markdown
@@ -0,0 +1,83 @@
+---
+subcategory: "FSx"
+layout: "aws"
+page_title: "AWS: aws_fsx_ontap_file_system"
+description: |-
+  Retrieve information on FSx ONTAP File System.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_fsx_ontap_file_system
+
+Retrieve information on FSx ONTAP File System.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_fsx_ontap_file_system import DataAwsFsxOntapFileSystem
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsFsxOntapFileSystem(self, "example",
+            id="fs-12345678"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `id` - (Required) Identifier of the file system (e.g. `fs-12345678`).
+
+## Attributes Reference
+
+In addition to all arguments above, the following attributes are exported:
+
+* `arn` - Amazon Resource Name of the file system.
+* `automatic_backup_retention_days` - The number of days to retain automatic backups.
+* `daily_automatic_backup_start_time` - The preferred time (in `HH:MM` format) to take daily automatic backups, in the UTC time zone.
+* `deployment_type` - The file system deployment type.
+* `disk_iops_configuration` - The SSD IOPS configuration for the Amazon FSx for NetApp ONTAP file system, specifying the number of provisioned IOPS and the provision mode. See [Disk IOPS](#disk-iops) Below.
+* `dns_name` - DNS name for the file system (e.g. `fs-12345678.corp.example.com`).
+* `endpoint_ip_address_range` - (Multi-AZ only) Specifies the IP address range in which the endpoints to access your file system exist.
+* `endpoints` - The Management and Intercluster FileSystemEndpoints that are used to access data or to manage the file system using the NetApp ONTAP CLI, REST API, or NetApp SnapMirror. See [FileSystemEndpoints](#file-system-endpoints) below.
+* `id` - Identifier of the file system (e.g. `fs-12345678`).
+* `kms_key_id` - ARN for the KMS Key to encrypt the file system at rest.
+* `network_interface_ids` - The IDs of the elastic network interfaces from which a specific file system is accessible.
+* `owner_id` - AWS account identifier that created the file system.
+* `preferred_subnet_id` - Specifies the subnet in which you want the preferred file server to be located.
+* `route_table_ids` - (Multi-AZ only) The VPC route tables in which your file system's endpoints exist.
+* `storage_capacity` - The storage capacity of the file system in gibibytes (GiB).
+* `storage_type` - The type of storage the file system is using. If set to `SSD`, the file system uses solid state drive storage. If set to `HDD`, the file system uses hard disk drive storage.
+* `subnet_ids` - Specifies the IDs of the subnets that the file system is accessible from. For the MULTI_AZ_1 file system deployment type, there are two subnet IDs, one for the preferred file server and one for the standby file server. The preferred file server subnet identified in the `preferred_subnet_id` property.
+* `tags` - The tags associated with the file system.
+* `throughput_capacity` - The sustained throughput of an Amazon FSx file system in Megabytes per second (MBps).
+* `vpc_id` - The ID of the primary virtual private cloud (VPC) for the file system.
+* `weekly_maintenance_start_time` - The preferred start time (in `D:HH:MM` format) to perform weekly maintenance, in the UTC time zone.
+
+### Disk IOPS
+
+* `iops` - The total number of SSD IOPS provisioned for the file system.
+* `mode` - Specifies whether the file system is using the `AUTOMATIC` setting of SSD IOPS of 3 IOPS per GB of storage capacity, or if it using a `USER_PROVISIONED` value.
+
+### File System Endpoints
+
+* `intercluster` - A FileSystemEndpoint for managing your file system by setting up NetApp SnapMirror with other ONTAP systems. See [FileSystemEndpoint](#file-system-endpoint) below.
+* `management` - A FileSystemEndpoint for managing your file system using the NetApp ONTAP CLI and NetApp ONTAP API. See [FileSystemEndpoint](#file-system-endpoint) below.
+
+### File System Endpoint
+
+* `DNSName` - The file system's DNS name. You can mount your file system using its DNS name.
+* `IpAddresses` - IP addresses of the file system endpoint.
+
+<!-- cache-key: cdktf-0.18.0 input-459fa001b98c16cffb882c5412b5d97d3d6335c21e394631f65f1e2eade0cc2d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/fsx_ontap_storage_virtual_machine.html.markdown b/website/docs/cdktf/python/d/fsx_ontap_storage_virtual_machine.html.markdown
new file mode 100644
index 00000000000..95bbf1411e7
--- /dev/null
+++ b/website/docs/cdktf/python/d/fsx_ontap_storage_virtual_machine.html.markdown
@@ -0,0 +1,124 @@
+---
+subcategory: "FSx"
+layout: "aws"
+page_title: "AWS: aws_fsx_ontap_storage_virtual_machine"
+description: |-
+  Retrieve information on FSx ONTAP Storage Virtual Machine (SVM).
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_fsx_ontap_storage_virtual_machine
+
+Retrieve information on FSx ONTAP Storage Virtual Machine (SVM).
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_fsx_ontap_storage_virtual_machine import DataAwsFsxOntapStorageVirtualMachine
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsFsxOntapStorageVirtualMachine(self, "example",
+            id="svm-12345678"
+        )
+```
+
+### Filter Example
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_fsx_ontap_storage_virtual_machine import DataAwsFsxOntapStorageVirtualMachine
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsFsxOntapStorageVirtualMachine(self, "example",
+            filter=[DataAwsFsxOntapStorageVirtualMachineFilter(
+                name="file-system-id",
+                values=["fs-12345678"]
+            )
+            ]
+        )
+```
+
+## Argument Reference
+
+The arguments of this data source act as filters for querying the available ONTAP Storage Virtual Machines in the current region. The given filters must match exactly one Storage Virtual Machine whose data will be exported as attributes.
+
+The following arguments are optional:
+
+* `filter` - (Optional) Configuration block. Detailed below.
+* `id` - (Optional) Identifier of the storage virtual machine (e.g. `svm-12345678`).
+
+### filter
+
+This block allows for complex filters.
+
+The following arguments are required:
+
+* `name` - (Required) Name of the field to filter by, as defined by [the underlying AWS API](https://docs.aws.amazon.com/fsx/latest/APIReference/API_StorageVirtualMachineFilter.html).
+* `values` - (Required) Set of values that are accepted for the given field. An SVM will be selected if any one of the given values matches.
+
+## Attributes Reference
+
+In addition to all arguments above, the following attributes are exported:
+
+* `arn` - Amazon Resource Name of the SVM.
+* `active_directory_configuration` - The Microsoft Active Directory configuration to which the SVM is joined, if applicable. See [Active Directory Configuration](#active-directory-configuration) below.
+* `creation_time` - The time that the SVM was created.
+* `endpoints` - The endpoints that are used to access data or to manage the SVM using the NetApp ONTAP CLI, REST API, or NetApp CloudManager. They are the Iscsi, Management, Nfs, and Smb endpoints. See [SVM Endpoints](#svm-endpoints) below.
+* `file_system_id` - Identifier of the file system (e.g. `fs-12345678`).
+* `id` - The SVM's system generated unique ID.
+* `lifecycle_status` - The SVM's lifecycle status.
+* `lifecycle_transition_reason` - Describes why the SVM lifecycle state changed. See [Lifecycle Transition Reason](#lifecycle-transition-reason) below.
+* `name` - The name of the SVM, if provisioned.
+* `subtype` - The SVM's subtype.
+* `uuid` - The SVM's UUID.
+
+### Active Directory Configuration
+
+The following arguments are supported for `active_directory_configuration` configuration block:
+
+* `netbios_name` - The NetBIOS name of the AD computer object to which the SVM is joined.
+* `self_managed_active_directory` - The configuration of the self-managed Microsoft Active Directory (AD) directory to which the Windows File Server or ONTAP storage virtual machine (SVM) instance is joined. See [Self Managed Active Directory](#self-managed-active-directory) below.
+
+### Self Managed Active Directory
+
+* `dns_ips` - A list of up to three IP addresses of DNS servers or domain controllers in the self-managed AD directory.
+* `domain_name` - The fully qualified domain name of the self-managed AD directory.
+* `file_system_administrators_group` - The name of the domain group whose members have administrative privileges for the FSx file system.
+* `organizational_unit_distinguished_name` - The fully qualified distinguished name of the organizational unit within the self-managed AD directory to which the Windows File Server or ONTAP storage virtual machine (SVM) instance is joined.
+* `username` - The user name for the service account on your self-managed AD domain that FSx uses to join to your AD domain.
+
+### Lifecycle Transition Reason
+
+* `message` - A detailed message.
+
+### SVM Endpoints
+
+* `Iscsi` - An endpoint for connecting using the Internet Small Computer Systems Interface (iSCSI) protocol. See [SVM Endpoint](#svm-endpoint) below.
+* `management` - An endpoint for managing SVMs using the NetApp ONTAP CLI, NetApp ONTAP API, or NetApp CloudManager. See [SVM Endpoint](#svm-endpoint) below.
+* `nfs` - An endpoint for connecting using the Network File System (NFS) protocol. See [SVM Endpoint](#svm-endpoint) below.
+* `smb` - An endpoint for connecting using the Server Message Block (SMB) protocol. See [SVM Endpoint](#svm-endpoint) below.
+
+### SVM Endpoint
+
+* `DNSName` - The file system's DNS name. You can mount your file system using its DNS name.
+* `IpAddresses` - The SVM endpoint's IP addresses.
+
+<!-- cache-key: cdktf-0.18.0 input-f6cea127fecc9fef03f1751e79c3dcabeee15d54d55425580842b9e868758d48 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/fsx_ontap_storage_virtual_machines.html.markdown b/website/docs/cdktf/python/d/fsx_ontap_storage_virtual_machines.html.markdown
new file mode 100644
index 00000000000..c5418f98420
--- /dev/null
+++ b/website/docs/cdktf/python/d/fsx_ontap_storage_virtual_machines.html.markdown
@@ -0,0 +1,57 @@
+---
+subcategory: "FSx"
+layout: "aws"
+page_title: "AWS: aws_fsx_ontap_storage_virtual_machines"
+description: |-
+  This resource can be useful for getting back a set of FSx ONTAP Storage Virtual Machine (SVM) IDs.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_fsx_ontap_storage_virtual_machines
+
+This resource can be useful for getting back a set of FSx ONTAP Storage Virtual Machine (SVM) IDs.
+
+## Example Usage
+
+The following shows outputting all SVM IDs for a given FSx ONTAP File System.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_fsx_ontap_storage_virtual_machines import DataAwsFsxOntapStorageVirtualMachines
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsFsxOntapStorageVirtualMachines(self, "example",
+            filter=[DataAwsFsxOntapStorageVirtualMachinesFilter(
+                name="file-system-id",
+                values=["fs-12345678"]
+            )
+            ]
+        )
+```
+
+## Argument Reference
+
+* `filter` - (Optional) Configuration block. Detailed below.
+
+### filter
+
+This block allows for complex filters.
+
+The following arguments are required:
+
+* `name` - (Required) Name of the field to filter by, as defined by [the underlying AWS API](https://docs.aws.amazon.com/fsx/latest/APIReference/API_StorageVirtualMachineFilter.html).
+* `values` - (Required) Set of values that are accepted for the given field. An SVM will be selected if any one of the given values matches.
+
+## Attributes Reference
+
+* `ids` - List of all SVM IDs found.
+
+<!-- cache-key: cdktf-0.18.0 input-fe65afdf53d4c09b7ace920dfb5af1c86aa9ada3e1dee3a6a467d53273829e75 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/fsx_openzfs_snapshot.html.markdown b/website/docs/cdktf/python/d/fsx_openzfs_snapshot.html.markdown
new file mode 100644
index 00000000000..3559f3df5c6
--- /dev/null
+++ b/website/docs/cdktf/python/d/fsx_openzfs_snapshot.html.markdown
@@ -0,0 +1,64 @@
+---
+subcategory: "FSx"
+layout: "aws"
+page_title: "AWS: aws_fsx_openzfs_snapshot"
+description: |-
+  Get information on an Amazon FSx for OpenZFS snapshot.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_fsx_openzfs_snapshot
+
+Use this data source to get information about an Amazon FSx for OpenZFS Snapshot for use when provisioning new Volumes.
+
+## Example Usage
+
+### Root volume Example
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_fsx_openzfs_snapshot import DataAwsFsxOpenzfsSnapshot
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsFsxOpenzfsSnapshot(self, "example",
+            filter=[DataAwsFsxOpenzfsSnapshotFilter(
+                name="volume-id",
+                values=["fsvol-073a32b6098a73feb"]
+            )
+            ],
+            most_recent=True
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `most_recent` - (Optional) If more than one result is returned, use the most recent snapshot.
+
+* `snapshot_ids` - (Optional) Returns information on a specific snapshot_id.
+
+* `filter` - (Optional) One or more name/value pairs to filter off of. The
+supported names are file-system-id or volume-id.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name of the snapshot.
+* `creation_time` - Time that the resource was created.
+* `id` - Identifier of the snapshot, e.g., `fsvolsnap-12345678`
+* `name` - Name of the snapshot.
+* `snapshot_id` - ID of the snapshot.
+* `tags` - List of Tag values, with a maximum of 50 elements.
+* `volume_id` - ID of the volume that the snapshot is of.
+
+<!-- cache-key: cdktf-0.18.0 input-8de9bd583ae91dc99a2426809f4ba7a76d20e95064b4a418a3d285d9bb3c459b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/fsx_windows_file_system.html.markdown b/website/docs/cdktf/python/d/fsx_windows_file_system.html.markdown
new file mode 100644
index 00000000000..a80981a9ca9
--- /dev/null
+++ b/website/docs/cdktf/python/d/fsx_windows_file_system.html.markdown
@@ -0,0 +1,69 @@
+---
+subcategory: "FSx"
+layout: "aws"
+page_title: "AWS: aws_fsx_windows_file_system"
+description: |-
+  Retrieve information on FSx Windows File System.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_fsx_windows_file_system
+
+Retrieve information on FSx Windows File System.
+
+## Example Usage
+
+### Root volume Example
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_fsx_windows_file_system import DataAwsFsxWindowsFileSystem
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsFsxWindowsFileSystem(self, "example",
+            id="fs-12345678"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `id` - (Required) Identifier of the file system (e.g. `fs-12345678`).
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `active_directory_id` - The ID for Microsoft Active Directory instance that the file system is join to.
+* `aliases` - An array DNS alias names associated with the Amazon FSx file system.
+* `arn` - Amazon Resource Name of the file system.
+* `audit_log_configuration` - The configuration that Amazon FSx for Windows File Server uses to audit and log user accesses of files, folders, and file shares on the Amazon FSx for Windows File Server file system.
+* `automatic_backup_retention_days` - The number of days to retain automatic backups.
+* `copy_tags_to_backups` - A boolean flag indicating whether tags on the file system should be copied to backups.
+* `daily_automatic_backup_start_time` - The preferred time (in `HH:MM` format) to take daily automatic backups, in the UTC time zone.
+* `deployment_type` - The file system deployment type.
+* `disk_iops_configuration` - The SSD IOPS configuration for the file system.
+* `dns_name` - DNS name for the file system (e.g. `fs-12345678.corp.example.com`).
+* `id` - Identifier of the file system (e.g. `fs-12345678`).
+* `kms_key_id` - ARN for the KMS Key to encrypt the file system at rest.
+* `owner_id` - AWS account identifier that created the file system.
+* `preferred_subnet_id` - Specifies the subnet in which you want the preferred file server to be located.
+* `preferred_file_server_ip` - The IP address of the primary, or preferred, file server.
+* `storage_capacity` - The storage capacity of the file system in gibibytes (GiB).
+* `storage_type` - The type of storage the file system is using. If set to `SSD`, the file system uses solid state drive storage. If set to `HDD`, the file system uses hard disk drive storage.
+* `subnet_ids` - Specifies the IDs of the subnets that the file system is accessible from.
+* `tags` - The tags to associate with the file system.
+* `throughput_capacity` - Throughput (megabytes per second) of the file system in power of 2 increments. Minimum of `8` and maximum of `2048`.
+* `vpc_id` - The ID of the primary virtual private cloud (VPC) for the file system.
+* `weekly_maintenance_start_time` - The preferred start time (in `d:HH:MM` format) to perform weekly maintenance, in the UTC time zone.
+
+<!-- cache-key: cdktf-0.18.0 input-7198016fdc5b76faa665d2e4a51c953549b6306de9af8ea688a7e3e2494a16d6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/globalaccelerator_accelerator.html.markdown b/website/docs/cdktf/python/d/globalaccelerator_accelerator.html.markdown
new file mode 100644
index 00000000000..6aea569a5e4
--- /dev/null
+++ b/website/docs/cdktf/python/d/globalaccelerator_accelerator.html.markdown
@@ -0,0 +1,59 @@
+---
+subcategory: "Global Accelerator"
+layout: "aws"
+page_title: "AWS: aws_globalaccelerator_accelerator"
+description: |-
+  Provides a Global Accelerator accelerator data source.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_globalaccelerator_accelerator
+
+Provides information about a Global Accelerator accelerator.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import VariableType, TerraformVariable, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_globalaccelerator_accelerator import DataAwsGlobalacceleratorAccelerator
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        # Terraform Variables are not always the best fit for getting inputs in the context of Terraform CDK.
+        #     You can read more about this at https://cdk.tf/variables
+        accelerator_arn = TerraformVariable(self, "accelerator_arn",
+            default="",
+            type=VariableType.STRING
+        )
+        accelerator_name = TerraformVariable(self, "accelerator_name",
+            default="",
+            type=VariableType.STRING
+        )
+        DataAwsGlobalacceleratorAccelerator(self, "example",
+            arn=accelerator_arn.string_value,
+            name=accelerator_name.string_value
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `arn` - (Optional) Full ARN of the Global Accelerator.
+* `name` - (Optional) Unique name of the Global Accelerator.
+
+~> **NOTE:** When both `arn` and `name` are specified, `arn` takes precedence.
+
+## Attribute Reference
+
+See the [`aws_globalaccelerator_accelerator` resource](/docs/providers/aws/r/globalaccelerator_accelerator.html) for details on the
+returned attributes - they are identical.
+
+<!-- cache-key: cdktf-0.18.0 input-cb1337cef607f58a3c97dc590b01ec464124ea11b4eae120be4bb79fd188c55c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/globalaccelerator_custom_routing_accelerator.html.markdown b/website/docs/cdktf/python/d/globalaccelerator_custom_routing_accelerator.html.markdown
new file mode 100644
index 00000000000..b3e68808d90
--- /dev/null
+++ b/website/docs/cdktf/python/d/globalaccelerator_custom_routing_accelerator.html.markdown
@@ -0,0 +1,59 @@
+---
+subcategory: "Global Accelerator"
+layout: "aws"
+page_title: "AWS: aws_globalaccelerator_custom_routing_accelerator"
+description: |-
+  Provides a Global Accelerator custom routing accelerator data source.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_globalaccelerator_custom_routing_accelerator
+
+Provides information about a Global Accelerator custom routing accelerator.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import VariableType, TerraformVariable, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_globalaccelerator_custom_routing_accelerator import DataAwsGlobalacceleratorCustomRoutingAccelerator
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        # Terraform Variables are not always the best fit for getting inputs in the context of Terraform CDK.
+        #     You can read more about this at https://cdk.tf/variables
+        accelerator_arn = TerraformVariable(self, "accelerator_arn",
+            default="",
+            type=VariableType.STRING
+        )
+        accelerator_name = TerraformVariable(self, "accelerator_name",
+            default="",
+            type=VariableType.STRING
+        )
+        DataAwsGlobalacceleratorCustomRoutingAccelerator(self, "example",
+            arn=accelerator_arn.string_value,
+            name=accelerator_name.string_value
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `arn` - (Optional) Full ARN of the custom routing accelerator.
+* `name` - (Optional) Unique name of the custom routing accelerator.
+
+~> **NOTE:** When both `arn` and `name` are specified, `arn` takes precedence.
+
+## Attribute Reference
+
+See the [`aws_globalaccelerator_custom_routing_accelerator` resource](/docs/providers/aws/r/globalaccelerator_custom_routing_accelerator.html) for details on the
+returned attributes - they are identical.
+
+<!-- cache-key: cdktf-0.18.0 input-fb49b3a4aad72882bbe051a5e4ad191bf14607b4e514940f142786757b6b692c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/glue_catalog_table.html.markdown b/website/docs/cdktf/python/d/glue_catalog_table.html.markdown
new file mode 100644
index 00000000000..eefdd04e967
--- /dev/null
+++ b/website/docs/cdktf/python/d/glue_catalog_table.html.markdown
@@ -0,0 +1,132 @@
+---
+subcategory: "Glue"
+layout: "aws"
+page_title: "AWS: aws_glue_catalog_table"
+description: |-
+  Get information on AWS Glue Data Catalog Table
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_glue_catalog_table
+
+This data source can be used to fetch information about an AWS Glue Data Catalog Table.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_glue_catalog_table import DataAwsGlueCatalogTable
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsGlueCatalogTable(self, "example",
+            database_name="MyCatalogDatabase",
+            name="MyCatalogTable"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name of the table.
+* `database_name` - (Required) Name of the metadata database where the table metadata resides.
+* `catalog_id` - (Optional) ID of the Glue Catalog and database where the table metadata resides. If omitted, this defaults to the current AWS Account ID.
+* `query_as_of_time`- (Optional) The time as of when to read the table contents. If not set, the most recent transaction commit time will be used. Cannot be specified along with `transaction_id`. Specified in RFC 3339 format, e.g. `2006-01-02T15:04:05Z07:00`.
+* `transaction_id` - (Optional) The transaction ID at which to read the table contents.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - Catalog ID, Database name and of the name table.
+* `arn` - The ARN of the Glue Table.
+* `description` - Description of the table.
+* `owner` - Owner of the table.
+* `parameters` - Properties associated with this table, as a list of key-value pairs.
+* `partition_index` - Configuration block for a maximum of 3 partition indexes. See [`partition_index`](#partition_index) below.
+* `partition_keys` - Configuration block of columns by which the table is partitioned. Only primitive types are supported as partition keys. See [`partition_keys`](#partition_keys) below.
+* `retention` - Retention time for this table.
+* `storage_descriptor` - Configuration block for information about the physical storage of this table. For more information, refer to the [Glue Developer Guide](https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-tables.html#aws-glue-api-catalog-tables-StorageDescriptor). See [`storage_descriptor`](#storage_descriptor) below.
+* `table_type` - Type of this table (EXTERNAL_TABLE, VIRTUAL_VIEW, etc.). While optional, some Athena DDL queries such as `ALTER TABLE` and `SHOW CREATE TABLE` will fail if this argument is empty.
+* `target_table` - Configuration block of a target table for resource linking. See [`target_table`](#target_table) below.
+* `view_expanded_text` - If the table is a view, the expanded text of the view; otherwise null.
+* `view_original_text` - If the table is a view, the original text of the view; otherwise null.
+
+### partition_index
+
+* `index_name` - Name of the partition index.
+* `keys` - Keys for the partition index.
+
+### partition_keys
+
+* `comment` - Free-form text comment.
+* `name` - Name of the Partition Key.
+* `type` - Datatype of data in the Partition Key.
+
+### storage_descriptor
+
+* `bucket_columns` - List of reducer grouping columns, clustering columns, and bucketing columns in the table.
+* `columns` - Configuration block for columns in the table. See [`columns`](#columns) below.
+* `compressed` - Whether the data in the table is compressed.
+* `input_format` - Input format: SequenceFileInputFormat (binary), or TextInputFormat, or a custom format.
+* `location` - Physical location of the table. By default, this takes the form of the warehouse location, followed by the database location in the warehouse, followed by the table name.
+* `number_of_buckets` - Is if the table contains any dimension columns.
+* `output_format` - Output format: SequenceFileOutputFormat (binary), or IgnoreKeyTextOutputFormat, or a custom format.
+* `parameters` - User-supplied properties in key-value form.
+* `schema_reference` - Object that references a schema stored in the AWS Glue Schema Registry. See [`schema_reference`](#schema_reference) below.
+* `ser_de_info` - Configuration block for serialization and deserialization ("SerDe") information. See [`ser_de_info`](#ser_de_info) below.
+* `skewed_info` - Configuration block with information about values that appear very frequently in a column (skewed values). See [`skewed_info`](#skewed_info) below.
+* `sort_columns` - Configuration block for the sort order of each bucket in the table. See [`sort_columns`](#sort_columns) below.
+* `stored_as_sub_directories` - Whether the table data is stored in subdirectories.
+
+#### columns
+
+* `comment` - Free-form text comment.
+* `name` - Name of the Column.
+* `parameters` - Key-value pairs defining properties associated with the column.
+* `type` - Datatype of data in the Column.
+
+#### schema_reference
+
+* `schema_id` - Configuration block that contains schema identity fields. See [`schema_id`](#schema_id) below.
+* `schema_version_id` - Unique ID assigned to a version of the schema.
+* `schema_version_number` - Version number of the schema.
+
+##### schema_id
+
+* `registry_name` - Name of the schema registry that contains the schema.
+* `schema_arn` - ARN of the schema.
+* `schema_name` - Name of the schema.
+
+#### ser_de_info
+
+* `name` - Name of the SerDe.
+* `parameters` - Map of initialization parameters for the SerDe, in key-value form.
+* `serialization_library` - Usually the class that implements the SerDe. An example is `org.apache.hadoop.hive.serde2.columnar.ColumnarSerDe`.
+
+#### sort_columns
+
+* `column` - Name of the column.
+* `sort_order` - Whether the column is sorted in ascending (`1`) or descending order (`0`).
+
+#### skewed_info
+
+* `skewed_column_names` - List of names of columns that contain skewed values.
+* `skewed_column_value_location_maps` - List of values that appear so frequently as to be considered skewed.
+* `skewed_column_values` - Map of skewed values to the columns that contain them.
+
+### target_table
+
+* `catalog_id` - ID of the Data Catalog in which the table resides.
+* `database_name` - Name of the catalog database that contains the target table.
+* `name` - Name of the target table.
+
+<!-- cache-key: cdktf-0.18.0 input-e15edcd6d033b5edb19b2c2cba94f792949b55bd9f5265620f634af7b6c959a4 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/glue_connection.html.markdown b/website/docs/cdktf/python/d/glue_connection.html.markdown
new file mode 100644
index 00000000000..85234424e4d
--- /dev/null
+++ b/website/docs/cdktf/python/d/glue_connection.html.markdown
@@ -0,0 +1,52 @@
+---
+subcategory: "Glue"
+layout: "aws"
+page_title: "AWS: aws_glue_connection"
+description: |-
+  Get information on an AWS Glue Connection
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_glue_connection
+
+This data source can be used to fetch information about a specific Glue Connection.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_glue_connection import DataAwsGlueConnection
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsGlueConnection(self, "example",
+            id="123456789123:connection"
+        )
+```
+
+## Argument Reference
+
+* `id` - (Required) Concatenation of the catalog ID and connection name. For example, if your account ID is
+`123456789123` and the connection name is `conn` then the ID is `123456789123:conn`.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Glue Connection.
+* `catalog_id` - Catalog ID of the Glue Connection.
+* `connection_type` - Type of Glue Connection.
+* `description` – Description of the connection.
+* `match_criteria` – A list of criteria that can be used in selecting this connection.
+* `name` - Name of the Glue Connection.
+* `physical_connection_requirements` - A map of physical connection requirements, such as VPC and SecurityGroup.
+* `tags` - Tags assigned to the resource
+
+<!-- cache-key: cdktf-0.18.0 input-c3a54c13f6d1584c4b355be148ce4f3063077b22c8de52485229079b8245ad9c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/glue_data_catalog_encryption_settings.html.markdown b/website/docs/cdktf/python/d/glue_data_catalog_encryption_settings.html.markdown
new file mode 100644
index 00000000000..c1dffe6f35a
--- /dev/null
+++ b/website/docs/cdktf/python/d/glue_data_catalog_encryption_settings.html.markdown
@@ -0,0 +1,61 @@
+---
+subcategory: "Glue"
+layout: "aws"
+page_title: "AWS: aws_glue_data_catalog_encryption_settings"
+description: |-
+  Get information on AWS Glue Data Catalog Encryption Settings
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_glue_data_catalog_encryption_settings
+
+This data source can be used to fetch information about AWS Glue Data Catalog Encryption Settings.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_glue_data_catalog_encryption_settings import DataAwsGlueDataCatalogEncryptionSettings
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, catalogId):
+        super().__init__(scope, name)
+        DataAwsGlueDataCatalogEncryptionSettings(self, "example",
+            id="123456789123",
+            catalog_id=catalog_id
+        )
+```
+
+## Argument Reference
+
+* `catalog_id` - (Required) ID of the Data Catalog. This is typically the AWS account ID.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `data_catalog_encryption_settings` – The security configuration to set. see [Data Catalog Encryption Settings](#data_catalog_encryption_settings).
+* `id` – The ID of the Data Catalog to set the security configuration for.
+
+### data_catalog_encryption_settings
+
+* `connection_password_encryption` - When connection password protection is enabled, the Data Catalog uses a customer-provided key to encrypt the password as part of CreateConnection or UpdateConnection and store it in the ENCRYPTED_PASSWORD field in the connection properties. You can enable catalog encryption or only password encryption. see [Connection Password Encryption](#connection_password_encryption).
+* `encryption_at_rest` - Encryption-at-rest configuration for the Data Catalog. see [Encryption At Rest](#encryption_at_rest).
+
+### connection_password_encryption
+
+* `return_connection_password_encrypted` - When set to `true`, passwords remain encrypted in the responses of GetConnection and GetConnections. This encryption takes effect independently of the catalog encryption.
+* `aws_kms_key_id` - KMS key ARN that is used to encrypt the connection password.
+
+### encryption_at_rest
+
+* `catalog_encryption_mode` - The encryption-at-rest mode for encrypting Data Catalog data.
+* `sse_aws_kms_key_id` - ARN of the AWS KMS key to use for encryption at rest.
+
+<!-- cache-key: cdktf-0.18.0 input-e959f72d2bff30ad397e7c3f8e5c026335f7731049187b56bb28d0f687ba62fd -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/glue_script.html.markdown b/website/docs/cdktf/python/d/glue_script.html.markdown
new file mode 100644
index 00000000000..3e4d61468ea
--- /dev/null
+++ b/website/docs/cdktf/python/d/glue_script.html.markdown
@@ -0,0 +1,254 @@
+---
+subcategory: "Glue"
+layout: "aws"
+page_title: "AWS: aws_glue_script"
+description: |-
+  Generate Glue script from Directed Acyclic Graph
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_glue_script
+
+Use this data source to generate a Glue script from a Directed Acyclic Graph (DAG).
+
+## Example Usage
+
+### Generate Python Script
+
+```terraform
+data "aws_glue_script" "example" {
+  language = "PYTHON"
+
+  dag_edge {
+    source = "datasource0"
+    target = "applymapping1"
+  }
+
+  dag_edge {
+    source = "applymapping1"
+    target = "selectfields2"
+  }
+
+  dag_edge {
+    source = "selectfields2"
+    target = "resolvechoice3"
+  }
+
+  dag_edge {
+    source = "resolvechoice3"
+    target = "datasink4"
+  }
+
+  dag_node {
+    id        = "datasource0"
+    node_type = "DataSource"
+
+    args {
+      name  = "database"
+      value = "\"${aws_glue_catalog_database.source.name}\""
+    }
+
+    args {
+      name  = "table_name"
+      value = "\"${aws_glue_catalog_table.source.name}\""
+    }
+  }
+
+  dag_node {
+    id        = "applymapping1"
+    node_type = "ApplyMapping"
+
+    args {
+      name  = "mapping"
+      value = "[(\"column1\", \"string\", \"column1\", \"string\")]"
+    }
+  }
+
+  dag_node {
+    id        = "selectfields2"
+    node_type = "SelectFields"
+
+    args {
+      name  = "paths"
+      value = "[\"column1\"]"
+    }
+  }
+
+  dag_node {
+    id        = "resolvechoice3"
+    node_type = "ResolveChoice"
+
+    args {
+      name  = "choice"
+      value = "\"MATCH_CATALOG\""
+    }
+
+    args {
+      name  = "database"
+      value = "\"${aws_glue_catalog_database.destination.name}\""
+    }
+
+    args {
+      name  = "table_name"
+      value = "\"${aws_glue_catalog_table.destination.name}\""
+    }
+  }
+
+  dag_node {
+    id        = "datasink4"
+    node_type = "DataSink"
+
+    args {
+      name  = "database"
+      value = "\"${aws_glue_catalog_database.destination.name}\""
+    }
+
+    args {
+      name  = "table_name"
+      value = "\"${aws_glue_catalog_table.destination.name}\""
+    }
+  }
+}
+
+output "python_script" {
+  value = data.aws_glue_script.example.python_script
+}
+```
+
+### Generate Scala Code
+
+```terraform
+data "aws_glue_script" "example" {
+  language = "SCALA"
+
+  dag_edge {
+    source = "datasource0"
+    target = "applymapping1"
+  }
+
+  dag_edge {
+    source = "applymapping1"
+    target = "selectfields2"
+  }
+
+  dag_edge {
+    source = "selectfields2"
+    target = "resolvechoice3"
+  }
+
+  dag_edge {
+    source = "resolvechoice3"
+    target = "datasink4"
+  }
+
+  dag_node {
+    id        = "datasource0"
+    node_type = "DataSource"
+
+    args {
+      name  = "database"
+      value = "\"${aws_glue_catalog_database.source.name}\""
+    }
+
+    args {
+      name  = "table_name"
+      value = "\"${aws_glue_catalog_table.source.name}\""
+    }
+  }
+
+  dag_node {
+    id        = "applymapping1"
+    node_type = "ApplyMapping"
+
+    args {
+      name  = "mappings"
+      value = "[(\"column1\", \"string\", \"column1\", \"string\")]"
+    }
+  }
+
+  dag_node {
+    id        = "selectfields2"
+    node_type = "SelectFields"
+
+    args {
+      name  = "paths"
+      value = "[\"column1\"]"
+    }
+  }
+
+  dag_node {
+    id        = "resolvechoice3"
+    node_type = "ResolveChoice"
+
+    args {
+      name  = "choice"
+      value = "\"MATCH_CATALOG\""
+    }
+
+    args {
+      name  = "database"
+      value = "\"${aws_glue_catalog_database.destination.name}\""
+    }
+
+    args {
+      name  = "table_name"
+      value = "\"${aws_glue_catalog_table.destination.name}\""
+    }
+  }
+
+  dag_node {
+    id        = "datasink4"
+    node_type = "DataSink"
+
+    args {
+      name  = "database"
+      value = "\"${aws_glue_catalog_database.destination.name}\""
+    }
+
+    args {
+      name  = "table_name"
+      value = "\"${aws_glue_catalog_table.destination.name}\""
+    }
+  }
+}
+
+output "scala_code" {
+  value = data.aws_glue_script.example.scala_code
+}
+```
+
+## Argument Reference
+
+* `dag_edge` - (Required) List of the edges in the DAG. Defined below.
+* `dag_node` - (Required) List of the nodes in the DAG. Defined below.
+* `language` - (Optional) Programming language of the resulting code from the DAG. Defaults to `PYTHON`. Valid values are `PYTHON` and `SCALA`.
+
+### dag_edge Argument Reference
+
+* `source` - (Required) ID of the node at which the edge starts.
+* `target` - (Required) ID of the node at which the edge ends.
+* `target_parameter` - (Optional) Target of the edge.
+
+### dag_node Argument Reference
+
+* `args` - (Required) Nested configuration an argument or property of a node. Defined below.
+* `id` - (Required) Node identifier that is unique within the node's graph.
+* `node_type` - (Required) Type of node this is.
+* `line_number` - (Optional) Line number of the node.
+
+#### args Argument Reference
+
+* `name` - (Required) Name of the argument or property.
+* `value` - (Required) Value of the argument or property.
+* `param` - (Optional) Boolean if the value is used as a parameter. Defaults to `false`.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - AWS Region.
+* `python_script` - Python script generated from the DAG when the `language` argument is set to `PYTHON`.
+* `scala_code` - Scala code generated from the DAG when the `language` argument is set to `SCALA`.
+
+<!-- cache-key: cdktf-0.18.0 input-be24758996e8a89722ff26b1265bf9700176ddfdb291cd62471cea079785dce2 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/grafana_workspace.html.markdown b/website/docs/cdktf/python/d/grafana_workspace.html.markdown
new file mode 100644
index 00000000000..1c0bf7dea3a
--- /dev/null
+++ b/website/docs/cdktf/python/d/grafana_workspace.html.markdown
@@ -0,0 +1,65 @@
+---
+subcategory: "Managed Grafana"
+layout: "aws"
+page_title: "AWS: aws_grafana_workspace"
+description: |-
+  Gets information on an Amazon Managed Grafana workspace.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_grafana_workspace
+
+Provides an Amazon Managed Grafana workspace data source.
+
+## Example Usage
+
+### Basic configuration
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_grafana_workspace import DataAwsGrafanaWorkspace
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsGrafanaWorkspace(self, "example",
+            workspace_id="g-2054c75a02"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `workspace_id` - (Required) Grafana workspace ID.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `account_access_type` - (Required) Type of account access for the workspace. Valid values are `CURRENT_ACCOUNT` and `ORGANIZATION`. If `ORGANIZATION` is specified, then `organizational_units` must also be present.
+* `authentication_providers` - (Required) Authentication providers for the workspace. Valid values are `AWS_SSO`, `SAML`, or both.
+* `arn` - ARN of the Grafana workspace.
+* `created_date` - Creation date of the Grafana workspace.
+* `data_sources` - Data sources for the workspace.
+* `description` - Workspace description.
+* `endpoint` - Endpoint of the Grafana workspace.
+* `grafana_version` - Version of Grafana running on the workspace.
+* `last_updated_date` - Last updated date of the Grafana workspace.
+* `name` - Grafana workspace name.
+* `notification_destinations` - The notification destinations.
+* `organization_role_name` - The role name that the workspace uses to access resources through Amazon Organizations.
+* `organizational_units` - The Amazon Organizations organizational units that the workspace is authorized to use data sources from.
+* `permission_type` - Permission type of the workspace.
+* `role_arn` - IAM role ARN that the workspace assumes.
+* `stack_set_name` - AWS CloudFormation stack set name that provisions IAM roles to be used by the workspace.
+* `status` - Status of the Grafana workspace.
+* `tags` - Tags assigned to the resource
+
+<!-- cache-key: cdktf-0.18.0 input-22d8f7cb4cb1f894ad0c40dec87b3b5711ec96e9e1e76be61286f5e1e2493124 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/guardduty_detector.html.markdown b/website/docs/cdktf/python/d/guardduty_detector.html.markdown
new file mode 100644
index 00000000000..d17a3c7ac0f
--- /dev/null
+++ b/website/docs/cdktf/python/d/guardduty_detector.html.markdown
@@ -0,0 +1,50 @@
+---
+subcategory: "GuardDuty"
+layout: "aws"
+page_title: "AWS: aws_guardduty_detector"
+description: |-
+  Retrieve information about a GuardDuty detector.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_guardduty_detector
+
+Retrieve information about a GuardDuty detector.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_guardduty_detector import DataAwsGuarddutyDetector
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsGuarddutyDetector(self, "example")
+```
+
+## Argument Reference
+
+* `id` - (Optional) ID of the detector.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `features` - Current configuration of the detector features.
+    * `additional_configuration` - Additional feature configuration.
+        * `name` - The name of the additional configuration.
+        * `status` - The status of the additional configuration.
+    * `name` - The name of the detector feature.
+    * `status` - The status of the detector feature.
+* `finding_publishing_frequency` - The frequency of notifications sent about subsequent finding occurrences.
+* `service_role_arn` - Service-linked role that grants GuardDuty access to the resources in the AWS account.
+* `status` - Current status of the detector.
+
+<!-- cache-key: cdktf-0.18.0 input-07755259e17c1389ef594d13cf31fa96fecc80102f8edf0b3ec9e035aef6985e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/guardduty_finding_ids.html.markdown b/website/docs/cdktf/python/d/guardduty_finding_ids.html.markdown
new file mode 100644
index 00000000000..9f845afdf14
--- /dev/null
+++ b/website/docs/cdktf/python/d/guardduty_finding_ids.html.markdown
@@ -0,0 +1,49 @@
+---
+subcategory: "GuardDuty"
+layout: "aws"
+page_title: "AWS: aws_guardduty_finding_ids"
+description: |-
+  Terraform data source for managing an AWS GuardDuty Finding Ids.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_guardduty_finding_ids
+
+Terraform data source for managing an AWS GuardDuty Finding Ids.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_guardduty_finding_ids import DataAwsGuarddutyFindingIds
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsGuarddutyFindingIds(self, "example",
+            detector_id=Token.as_string(aws_guardduty_detector_example.id)
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `detector_id` - (Required) ID of the GuardDuty detector.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `has_findings` - Indicates whether findings are present for the specified detector.
+* `finding_ids` - A list of finding IDs for the specified detector.
+
+<!-- cache-key: cdktf-0.18.0 input-639e9057ccf47998ef50f3f122bf6e2e0a603648cc0ea1e6bdfe980be55cceb6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/iam_access_keys.html.markdown b/website/docs/cdktf/python/d/iam_access_keys.html.markdown
new file mode 100644
index 00000000000..15e45e0da5d
--- /dev/null
+++ b/website/docs/cdktf/python/d/iam_access_keys.html.markdown
@@ -0,0 +1,53 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_access_keys"
+description: |-
+  Get information on IAM access keys associated with the specified IAM user.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_iam_access_keys
+
+This data source can be used to fetch information about IAM access keys of a
+specific IAM user.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_access_keys import DataAwsIamAccessKeys
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsIamAccessKeys(self, "example",
+            user="an_example_user_name"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `user` - (Required) Name of the IAM user associated with the access keys.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `access_keys` - List of the IAM access keys associated with the specified user. See below.
+
+The elements of the `access_keys` are exported with the following attributes:
+
+* `access_key_id` - Access key ID.
+* `create_date` - Date and time in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8) that the access key was created.
+* `status` - Access key status. Possible values are `Active` and `Inactive`.
+
+<!-- cache-key: cdktf-0.18.0 input-e240b2f1389af80ddb006ba0dd0c7ec511aa61dd50acb41a405183fb70ef28d8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/iam_account_alias.html.markdown b/website/docs/cdktf/python/d/iam_account_alias.html.markdown
new file mode 100644
index 00000000000..126dd7ae913
--- /dev/null
+++ b/website/docs/cdktf/python/d/iam_account_alias.html.markdown
@@ -0,0 +1,48 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_account_alias"
+description: |-
+  Provides the account alias for the AWS account associated with the provider
+  connection to AWS.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_iam_account_alias
+
+The IAM Account Alias data source allows access to the account alias
+for the effective account in which Terraform is working.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformOutput, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_account_alias import DataAwsIamAccountAlias
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        current = DataAwsIamAccountAlias(self, "current")
+        TerraformOutput(self, "account_id",
+            value=current.account_alias
+        )
+```
+
+## Argument Reference
+
+There are no arguments available for this data source.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `account_alias` - Alias associated with the AWS account.
+* `id` - Alias associated with the AWS account.
+
+<!-- cache-key: cdktf-0.18.0 input-efa6f2304fc0569176238ebf28fc4c9ec839c206f798e565d2b074c39fb9dfb0 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/iam_group.html.markdown b/website/docs/cdktf/python/d/iam_group.html.markdown
new file mode 100644
index 00000000000..f89a041cddf
--- /dev/null
+++ b/website/docs/cdktf/python/d/iam_group.html.markdown
@@ -0,0 +1,56 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_group"
+description: |-
+  Get information on a Amazon IAM group
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_iam_group
+
+This data source can be used to fetch information about a specific
+IAM group. By using this data source, you can reference IAM group
+properties without having to hard code ARNs as input.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_group import DataAwsIamGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsIamGroup(self, "example",
+            group_name="an_example_group_name"
+        )
+```
+
+## Argument Reference
+
+* `group_name` - (Required) Friendly IAM group name to match.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - Group ARN.
+* `group_id` - Stable and unique string identifying the group.
+* `path` - Path to the group.
+* `users` - List of objects containing group member information. See below.
+
+### `users`
+
+* `arn` - User ARN.
+* `path` - Path to the IAM user.
+* `user_id` - Stable and unique string identifying the IAM user.
+* `user_name` - Name of the IAM user.
+
+<!-- cache-key: cdktf-0.18.0 input-b5b8d72dc7fc469d3b2d85b15798edaab2e9d2691ebb4b01603e4de702a19c97 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/iam_instance_profile.html.markdown b/website/docs/cdktf/python/d/iam_instance_profile.html.markdown
new file mode 100644
index 00000000000..530e8d43d55
--- /dev/null
+++ b/website/docs/cdktf/python/d/iam_instance_profile.html.markdown
@@ -0,0 +1,51 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_instance_profile"
+description: |-
+  Get information on a Amazon IAM Instance Profile
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_iam_instance_profile
+
+This data source can be used to fetch information about a specific
+IAM instance profile. By using this data source, you can reference IAM
+instance profile properties without having to hard code ARNs as input.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_instance_profile import DataAwsIamInstanceProfile
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsIamInstanceProfile(self, "example",
+            name="an_example_instance_profile_name"
+        )
+```
+
+## Argument Reference
+
+* `name` - (Required) Friendly IAM instance profile name to match.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN.
+* `create_date` - String representation of the date the instance profile was created.
+* `path` - Path to the instance profile.
+* `role_arn` - Role ARN associated with this instance profile.
+* `role_id` - Role ID associated with this instance profile.
+* `role_name` - Role name associated with this instance profile.
+
+<!-- cache-key: cdktf-0.18.0 input-5e845773261432b358ba5aad381e509f7458709c0eda7705643bdfff5097226a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/iam_instance_profiles.html.markdown b/website/docs/cdktf/python/d/iam_instance_profiles.html.markdown
new file mode 100644
index 00000000000..14f4bd31ddd
--- /dev/null
+++ b/website/docs/cdktf/python/d/iam_instance_profiles.html.markdown
@@ -0,0 +1,48 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_instance_profiles"
+description: |-
+  Get information on a Amazon IAM Instance Profiles from IAM role
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_iam_instance_profiles
+
+This data source can be used to fetch information about all
+IAM instance profiles under a role. By using this data source, you can reference IAM
+instance profile properties without having to hard code ARNs as input.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_instance_profiles import DataAwsIamInstanceProfiles
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsIamInstanceProfiles(self, "example",
+            role_name="an_example_iam_role_name"
+        )
+```
+
+## Argument Reference
+
+* `role_name` - (Required) IAM role name.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arns` - Set of ARNs of instance profiles.
+* `names` - Set of IAM instance profile names.
+* `paths` - Set of IAM instance profile paths.
+
+<!-- cache-key: cdktf-0.18.0 input-fdf4537f5bc24d70dba8df68e238853fd99393192e43f6e525a475fe964ee287 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/iam_openid_connect_provider.html.markdown b/website/docs/cdktf/python/d/iam_openid_connect_provider.html.markdown
new file mode 100644
index 00000000000..ebbcaa2e0dc
--- /dev/null
+++ b/website/docs/cdktf/python/d/iam_openid_connect_provider.html.markdown
@@ -0,0 +1,66 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_openid_connect_provider"
+description: |-
+  Get information on a Amazon IAM OpenID Connect provider.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_iam_openid_connect_provider
+
+This data source can be used to fetch information about a specific
+IAM OpenID Connect provider. By using this data source, you can retrieve the
+the resource information by either its `arn` or `url`.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_openid_connect_provider import DataAwsIamOpenidConnectProvider
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsIamOpenidConnectProvider(self, "example",
+            arn="arn:aws:iam::123456789012:oidc-provider/accounts.google.com"
+        )
+```
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_openid_connect_provider import DataAwsIamOpenidConnectProvider
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsIamOpenidConnectProvider(self, "example",
+            url="https://accounts.google.com"
+        )
+```
+
+## Argument Reference
+
+* `arn` - (Optional) ARN of the OpenID Connect provider.
+* `url` - (Optional) URL of the OpenID Connect provider.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `client_id_list` - List of client IDs (also known as audiences). When a mobile or web app registers with an OpenID Connect provider, they establish a value that identifies the application. (This is the value that's sent as the client_id parameter on OAuth requests.)
+* `thumbprint_list` - List of server certificate thumbprints for the OpenID Connect (OIDC) identity provider's server certificate(s).
+* `tags` - Map of resource tags for the IAM OIDC provider.
+
+<!-- cache-key: cdktf-0.18.0 input-642346d1cceb7b38df3f8226fec2a77e31214afb1bcf46792639e9604b9060a4 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/iam_policy.html.markdown b/website/docs/cdktf/python/d/iam_policy.html.markdown
new file mode 100644
index 00000000000..29a54f1cd4f
--- /dev/null
+++ b/website/docs/cdktf/python/d/iam_policy.html.markdown
@@ -0,0 +1,77 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_policy"
+description: |-
+  Get information on a Amazon IAM policy
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_iam_policy
+
+This data source can be used to fetch information about a specific
+IAM policy.
+
+## Example Usage
+
+### By ARN
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_policy import DataAwsIamPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsIamPolicy(self, "example",
+            arn="arn:aws:iam::123456789012:policy/UsersManageOwnCredentials"
+        )
+```
+
+### By Name
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_policy import DataAwsIamPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsIamPolicy(self, "example",
+            name="test_policy"
+        )
+```
+
+## Argument Reference
+
+* `arn` - (Optional) ARN of the IAM policy.
+  Conflicts with `name` and `path_prefix`.
+* `name` - (Optional) Name of the IAM policy.
+  Conflicts with `arn`.
+* `path_prefix` - (Optional) Prefix of the path to the IAM policy.
+  Defaults to a slash (`/`).
+  Conflicts with `arn`.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the policy.
+* `path` - Path to the policy.
+* `description` - Description of the policy.
+* `policy` - Policy document of the policy.
+* `policy_id` - Policy's ID.
+* `tags` - Key-value mapping of tags for the IAM Policy.
+
+<!-- cache-key: cdktf-0.18.0 input-0cf487c395058c7c9cab5e17ab81c86989934f0f0479c2c2af73d9be73409f10 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/iam_policy_document.html.markdown b/website/docs/cdktf/python/d/iam_policy_document.html.markdown
new file mode 100644
index 00000000000..8276e72e158
--- /dev/null
+++ b/website/docs/cdktf/python/d/iam_policy_document.html.markdown
@@ -0,0 +1,570 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_policy_document"
+description: |-
+  Generates an IAM policy document in JSON format
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_iam_policy_document
+
+Generates an IAM policy document in JSON format for use with resources that expect policy documents such as [`aws_iam_policy`](/docs/providers/aws/r/iam_policy.html).
+
+Using this data source to generate policy documents is *optional*. It is also valid to use literal JSON strings in your configuration or to use the `file` interpolation function to read a raw JSON policy document from a file.
+
+~> **NOTE:** AWS's IAM policy document syntax allows for replacement of [policy variables](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_variables.html) within a statement using `${...}`-style notation, which conflicts with Terraform's interpolation syntax. In order to use AWS policy variables with this data source, use `&{...}` notation for interpolations that should be processed by AWS rather than by Terraform.
+
+-> For more information about building AWS IAM policy documents with Terraform, see the [AWS IAM Policy Document Guide](https://learn.hashicorp.com/terraform/aws/iam-policy).
+
+## Example Usage
+
+### Basic Example
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.iam_policy import IamPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = DataAwsIamPolicyDocument(self, "example",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["s3:ListAllMyBuckets", "s3:GetBucketLocation"],
+                resources=["arn:aws:s3:::*"],
+                sid="1"
+            ), DataAwsIamPolicyDocumentStatement(
+                actions=["s3:ListBucket"],
+                condition=[DataAwsIamPolicyDocumentStatementCondition(
+                    test="StringLike",
+                    values=["", "home/", "home/&{aws:username}/"],
+                    variable="s3:prefix"
+                )
+                ],
+                resources=["arn:aws:s3:::${" + s3_bucket_name.value + "}"]
+            ), DataAwsIamPolicyDocumentStatement(
+                actions=["s3:*"],
+                resources=["arn:aws:s3:::${" + s3_bucket_name.value + "}/home/&{aws:username}", "arn:aws:s3:::${" + s3_bucket_name.value + "}/home/&{aws:username}/*"
+                ]
+            )
+            ]
+        )
+        aws_iam_policy_example = IamPolicy(self, "example_1",
+            name="example_policy",
+            path="/",
+            policy=Token.as_string(example.json)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_policy_example.override_logical_id("example")
+```
+
+### Example Multiple Condition Keys and Values
+
+You can specify a [condition with multiple keys and values](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_multi-value-conditions.html) by supplying multiple `condition` blocks with the same `test` value, but differing `variable` and `values` values.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsIamPolicyDocument(self, "example_multiple_condition_keys_and_values",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["kms:Decrypt", "kms:GenerateDataKey"],
+                condition=[DataAwsIamPolicyDocumentStatementCondition(
+                    test="ForAnyValue:StringEquals",
+                    values=["pi"],
+                    variable="kms:EncryptionContext:service"
+                ), DataAwsIamPolicyDocumentStatementCondition(
+                    test="ForAnyValue:StringEquals",
+                    values=["rds"],
+                    variable="kms:EncryptionContext:aws:pi:service"
+                ), DataAwsIamPolicyDocumentStatementCondition(
+                    test="ForAnyValue:StringEquals",
+                    values=["db-AAAAABBBBBCCCCCDDDDDEEEEE", "db-EEEEEDDDDDCCCCCBBBBBAAAAA"
+                    ],
+                    variable="kms:EncryptionContext:aws:rds:db-id"
+                )
+                ],
+                resources=["*"]
+            )
+            ]
+        )
+```
+
+`data.aws_iam_policy_document.example_multiple_condition_keys_and_values.json` will evaluate to:
+
+```json
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Sid": "",
+      "Effect": "Allow",
+      "Action": [
+        "kms:GenerateDataKey",
+        "kms:Decrypt"
+      ],
+      "Resource": "*",
+      "Condition": {
+        "ForAnyValue:StringEquals": {
+          "kms:EncryptionContext:aws:pi:service": "rds",
+          "kms:EncryptionContext:aws:rds:db-id": [
+            "db-AAAAABBBBBCCCCCDDDDDEEEEE",
+            "db-EEEEEDDDDDCCCCCBBBBBAAAAA"
+          ],
+          "kms:EncryptionContext:service": "pi"
+        }
+      }
+    }
+  ]
+}
+```
+
+### Example Assume-Role Policy with Multiple Principals
+
+You can specify multiple principal blocks with different types. You can also use this data source to generate an assume-role policy.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsIamPolicyDocument(self, "event_stream_bucket_role_assume_role_policy",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["sts:AssumeRole"],
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["firehose.amazonaws.com"],
+                    type="Service"
+                ), DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=[trusted_role_arn.string_value],
+                    type="AWS"
+                ), DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["arn:aws:iam::${" + account_id.value + "}:saml-provider/${" + provider_name.value + "}", "cognito-identity.amazonaws.com"
+                    ],
+                    type="Federated"
+                )
+                ]
+            )
+            ]
+        )
+```
+
+### Example Using A Source Document
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        source = DataAwsIamPolicyDocument(self, "source",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["ec2:*"],
+                resources=["*"]
+            ), DataAwsIamPolicyDocumentStatement(
+                actions=["s3:*"],
+                resources=["*"],
+                sid="SidToOverride"
+            )
+            ]
+        )
+        DataAwsIamPolicyDocument(self, "source_document_example",
+            source_policy_documents=[Token.as_string(source.json)],
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["s3:*"],
+                resources=["arn:aws:s3:::somebucket", "arn:aws:s3:::somebucket/*"],
+                sid="SidToOverride"
+            )
+            ]
+        )
+```
+
+`data.aws_iam_policy_document.source_document_example.json` will evaluate to:
+
+```json
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Sid": "",
+      "Effect": "Allow",
+      "Action": "ec2:*",
+      "Resource": "*"
+    },
+    {
+      "Sid": "SidToOverride",
+      "Effect": "Allow",
+      "Action": "s3:*",
+      "Resource": [
+        "arn:aws:s3:::somebucket/*",
+        "arn:aws:s3:::somebucket"
+      ]
+    }
+  ]
+}
+```
+
+### Example Using An Override Document
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        override = DataAwsIamPolicyDocument(self, "override",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["s3:*"],
+                resources=["*"],
+                sid="SidToOverride"
+            )
+            ]
+        )
+        DataAwsIamPolicyDocument(self, "override_policy_document_example",
+            override_policy_documents=[Token.as_string(override.json)],
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["ec2:*"],
+                resources=["*"]
+            ), DataAwsIamPolicyDocumentStatement(
+                actions=["s3:*"],
+                resources=["arn:aws:s3:::somebucket", "arn:aws:s3:::somebucket/*"],
+                sid="SidToOverride"
+            )
+            ]
+        )
+```
+
+`data.aws_iam_policy_document.override_policy_document_example.json` will evaluate to:
+
+```json
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Sid": "",
+      "Effect": "Allow",
+      "Action": "ec2:*",
+      "Resource": "*"
+    },
+    {
+      "Sid": "SidToOverride",
+      "Effect": "Allow",
+      "Action": "s3:*",
+      "Resource": "*"
+    }
+  ]
+}
+```
+
+### Example with Both Source and Override Documents
+
+You can also combine `source_policy_documents` and `override_policy_documents` in the same document.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        override = DataAwsIamPolicyDocument(self, "override",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["s3:GetObject"],
+                resources=["*"],
+                sid="OverridePlaceholder"
+            )
+            ]
+        )
+        source = DataAwsIamPolicyDocument(self, "source",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["ec2:DescribeAccountAttributes"],
+                resources=["*"],
+                sid="OverridePlaceholder"
+            )
+            ]
+        )
+        DataAwsIamPolicyDocument(self, "politik",
+            override_policy_documents=[Token.as_string(override.json)],
+            source_policy_documents=[Token.as_string(source.json)]
+        )
+```
+
+`data.aws_iam_policy_document.politik.json` will evaluate to:
+
+```json
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Sid": "OverridePlaceholder",
+      "Effect": "Allow",
+      "Action": "s3:GetObject",
+      "Resource": "*"
+    }
+  ]
+}
+```
+
+### Example of Merging Source Documents
+
+Multiple documents can be combined using the `source_policy_documents` or `override_policy_documents` attributes. `source_policy_documents` requires that all documents have unique Sids, while `override_policy_documents` will iteratively override matching Sids.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        source_one = DataAwsIamPolicyDocument(self, "source_one",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["ec2:*"],
+                resources=["*"]
+            ), DataAwsIamPolicyDocumentStatement(
+                actions=["s3:*"],
+                resources=["*"],
+                sid="UniqueSidOne"
+            )
+            ]
+        )
+        source_two = DataAwsIamPolicyDocument(self, "source_two",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["iam:*"],
+                resources=["*"],
+                sid="UniqueSidTwo"
+            ), DataAwsIamPolicyDocumentStatement(
+                actions=["lambda:*"],
+                resources=["*"]
+            )
+            ]
+        )
+        DataAwsIamPolicyDocument(self, "combined",
+            source_policy_documents=[
+                Token.as_string(source_one.json),
+                Token.as_string(source_two.json)
+            ]
+        )
+```
+
+`data.aws_iam_policy_document.combined.json` will evaluate to:
+
+```json
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Sid": "",
+      "Effect": "Allow",
+      "Action": "ec2:*",
+      "Resource": "*"
+    },
+    {
+      "Sid": "UniqueSidOne",
+      "Effect": "Allow",
+      "Action": "s3:*",
+      "Resource": "*"
+    },
+    {
+      "Sid": "UniqueSidTwo",
+      "Effect": "Allow",
+      "Action": "iam:*",
+      "Resource": "*"
+    },
+    {
+      "Sid": "",
+      "Effect": "Allow",
+      "Action": "lambda:*",
+      "Resource": "*"
+    }
+  ]
+}
+```
+
+### Example of Merging Override Documents
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        policy_one = DataAwsIamPolicyDocument(self, "policy_one",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["s3:*"],
+                effect="Allow",
+                resources=["*"],
+                sid="OverridePlaceHolderOne"
+            )
+            ]
+        )
+        policy_three = DataAwsIamPolicyDocument(self, "policy_three",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["logs:*"],
+                effect="Deny",
+                resources=["*"],
+                sid="OverridePlaceHolderOne"
+            )
+            ]
+        )
+        policy_two = DataAwsIamPolicyDocument(self, "policy_two",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["ec2:*"],
+                effect="Allow",
+                resources=["*"]
+            ), DataAwsIamPolicyDocumentStatement(
+                actions=["iam:*"],
+                effect="Allow",
+                resources=["*"],
+                sid="OverridePlaceHolderTwo"
+            )
+            ]
+        )
+        DataAwsIamPolicyDocument(self, "combined",
+            override_policy_documents=[
+                Token.as_string(policy_one.json),
+                Token.as_string(policy_two.json),
+                Token.as_string(policy_three.json)
+            ],
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["*"],
+                effect="Deny",
+                resources=["*"],
+                sid="OverridePlaceHolderTwo"
+            )
+            ]
+        )
+```
+
+`data.aws_iam_policy_document.combined.json` will evaluate to:
+
+```json
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Sid": "OverridePlaceholderTwo",
+      "Effect": "Allow",
+      "Action": "iam:*",
+      "Resource": "*"
+    },
+    {
+      "Sid": "OverridePlaceholderOne",
+      "Effect": "Deny",
+      "Action": "logs:*",
+      "Resource": "*"
+    },
+    {
+      "Sid": "",
+      "Effect": "Allow",
+      "Action": "ec2:*",
+      "Resource": "*"
+    },
+  ]
+}
+```
+
+## Argument Reference
+
+The following arguments are optional:
+
+~> **NOTE:** Statements without a `sid` cannot be overridden. In other words, a statement without a `sid` from `source_policy_documents` cannot be overridden by statements from `override_policy_documents`.
+
+* `override_policy_documents` (Optional) - List of IAM policy documents that are merged together into the exported document. In merging, statements with non-blank `sid`s will override statements with the same `sid` from earlier documents in the list. Statements with non-blank `sid`s will also override statements with the same `sid` from `source_policy_documents`.  Non-overriding statements will be added to the exported document.
+* `policy_id` (Optional) - ID for the policy document.
+* `source_policy_documents` (Optional) - List of IAM policy documents that are merged together into the exported document. Statements defined in `source_policy_documents` must have unique `sid`s. Statements with the same `sid` from `override_policy_documents` will override source statements.
+* `statement` (Optional) - Configuration block for a policy statement. Detailed below.
+* `version` (Optional) - IAM policy document version. Valid values are `2008-10-17` and `2012-10-17`. Defaults to `2012-10-17`. For more information, see the [AWS IAM User Guide](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_version.html).
+
+### `statement`
+
+The following arguments are optional:
+
+* `actions` (Optional) - List of actions that this statement either allows or denies. For example, `["ec2:RunInstances", "s3:*"]`.
+* `condition` (Optional) - Configuration block for a condition. Detailed below.
+* `effect` (Optional) - Whether this statement allows or denies the given actions. Valid values are `Allow` and `Deny`. Defaults to `Allow`.
+* `not_actions` (Optional) - List of actions that this statement does *not* apply to. Use to apply a policy statement to all actions *except* those listed.
+* `not_principals` (Optional) - Like `principals` except these are principals that the statement does *not* apply to.
+* `not_resources` (Optional) - List of resource ARNs that this statement does *not* apply to. Use to apply a policy statement to all resources *except* those listed. Conflicts with `resources`.
+* `principals` (Optional) - Configuration block for principals. Detailed below.
+* `resources` (Optional) - List of resource ARNs that this statement applies to. This is required by AWS if used for an IAM policy. Conflicts with `not_resources`.
+* `sid` (Optional) - Sid (statement ID) is an identifier for a policy statement.
+
+### `condition`
+
+A `condition` constrains whether a statement applies in a particular situation. Conditions can be specific to an AWS service. When using multiple `condition` blocks, they must *all* evaluate to true for the policy statement to apply. In other words, AWS evaluates the conditions as though with an "AND" boolean operation.
+
+The following arguments are required:
+
+* `test` (Required) Name of the [IAM condition operator](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html) to evaluate.
+* `values` (Required) Values to evaluate the condition against. If multiple values are provided, the condition matches if at least one of them applies. That is, AWS evaluates multiple values as though using an "OR" boolean operation.
+* `variable` (Required) Name of a [Context Variable](http://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements.html#AvailableKeys) to apply the condition to. Context variables may either be standard AWS variables starting with `aws:` or service-specific variables prefixed with the service name.
+
+### `principals` and `not_principals`
+
+The `principals` and `not_principals` arguments define to whom a statement applies or does not apply, respectively.
+
+~> **NOTE:** Even though the [IAM Documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html) states that `"Principal": "*"` and `"Principal": {"AWS": "*"}` are equivalent, those principal elements have different behavior in some situations, e.g., IAM Role Trust Policy. To have Terraform render JSON containing `"Principal": "*"`, use `type = "*"` and `identifiers = ["*"]`. To have Terraform render JSON containing `"Principal": {"AWS": "*"}`, use `type = "AWS"` and `identifiers = ["*"]`.
+
+-> For more information about AWS principals, refer to the [AWS Identity and Access Management User Guide: AWS JSON policy elements: Principal](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html).
+
+The following arguments are required:
+
+* `identifiers` (Required) List of identifiers for principals. When `type` is `AWS`, these are IAM principal ARNs, e.g., `arn:aws:iam::12345678901:role/yak-role`.  When `type` is `Service`, these are AWS Service roles, e.g., `lambda.amazonaws.com`. When `type` is `Federated`, these are web identity users or SAML provider ARNs, e.g., `accounts.google.com` or `arn:aws:iam::12345678901:saml-provider/yak-saml-provider`. When `type` is `CanonicalUser`, these are [canonical user IDs](https://docs.aws.amazon.com/general/latest/gr/acct-identifiers.html#FindingCanonicalId), e.g., `79a59df900b949e55d96a1e698fbacedfd6e09d98eacf8f8d5218e7cd47ef2be`.
+* `type` (Required) Type of principal. Valid values include `AWS`, `Service`, `Federated`, `CanonicalUser` and `*`.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `json` - Standard JSON policy document rendered based on the arguments above.
+
+<!-- cache-key: cdktf-0.18.0 input-c602f06a4415d21639bfb95fc6d2eb21bd336984864688c93e5e0c70aab27794 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/iam_principal_policy_simulation.html.markdown b/website/docs/cdktf/python/d/iam_principal_policy_simulation.html.markdown
new file mode 100644
index 00000000000..cd3434cef75
--- /dev/null
+++ b/website/docs/cdktf/python/d/iam_principal_policy_simulation.html.markdown
@@ -0,0 +1,239 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_principal_policy_simulation"
+description: |-
+  Runs a simulation of the IAM policies of a particular principal against a given hypothetical request.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_iam_principal_policy_simulation
+
+Runs a simulation of the IAM policies of a particular principal against a given hypothetical request.
+
+You can use this data source in conjunction with
+[Preconditions and Postconditions](https://www.terraform.io/language/expressions/custom-conditions#preconditions-and-postconditions) so that your configuration can test either whether it should have sufficient access to do its own work, or whether policies your configuration declares itself are sufficient for their intended use elsewhere.
+
+-> **Note:** Correctly using this data source requires familiarity with various details of AWS Identity and Access Management, and how various AWS services integrate with it. For general information on the AWS IAM policy simulator, see [Testing IAM policies with the IAM policy simulator](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_testing-policies.html). This data source wraps the `iam:SimulatePrincipalPolicy` API action described on that page.
+
+## Example Usage
+
+### Self Access-checking Example
+
+The following example raises an error if the credentials passed to the AWS provider do not have access to perform the three actions `s3:GetObject`, `s3:PutObject`, and `s3:DeleteObject` on the S3 bucket with the given ARN. It combines `aws_iam_principal_policy_simulation` with the core Terraform postconditions feature.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from cdktf import TerraformResourceLifecycle, Postcondition
+from constructs import Construct
+from cdktf import TerraformSelf, Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_caller_identity import DataAwsCallerIdentity
+from imports.aws.data_aws_iam_principal_policy_simulation import DataAwsIamPrincipalPolicySimulation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        current = DataAwsCallerIdentity(self, "current")
+        DataAwsIamPrincipalPolicySimulation(self, "s3_object_access",
+            action_names=["s3:GetObject", "s3:PutObject", "s3:DeleteObject"],
+            lifecycle=TerraformResourceLifecycle(
+                postcondition=[Postcondition(
+                    condition=TerraformSelf.get_any("all_allowed"),
+                    error_message="        Given AWS credentials do not have sufficient access to manage " +
+                    Token.as_string(
+                        Fn.join(", ",
+                            Token.as_list(TerraformSelf.get_any("resource_arns")))) + ".\n\n"
+                )
+                ]
+            ),
+            policy_source_arn=Token.as_string(current.arn),
+            resource_arns=["arn:aws:s3:::my-test-bucket"]
+        )
+```
+
+If you intend to use this data source to quickly raise an error when the given credentials are insufficient then you must use [`depends_on`](https://www.terraform.io/language/meta-arguments/depends_on) inside any resource which would require those credentials, to ensure that the policy check will run first:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket_object import S3BucketObject
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, key):
+        super().__init__(scope, name)
+        S3BucketObject(self, "example",
+            bucket="my-test-bucket",
+            depends_on=[s3_object_access],
+            key=key
+        )
+```
+
+### Testing the Effect of a Declared Policy
+
+The following example declares an S3 bucket and a user that should have access to the bucket, and then uses `aws_iam_principal_policy_simulation` to verify that the user does indeed have access to perform needed operations against the bucket.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from cdktf import TerraformResourceLifecycle, Postcondition
+from constructs import Construct
+from cdktf import Fn, Token, TerraformSelf, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_caller_identity import DataAwsCallerIdentity
+from imports.aws.data_aws_iam_principal_policy_simulation import DataAwsIamPrincipalPolicySimulation
+from imports.aws.iam_user import IamUser
+from imports.aws.iam_user_policy import IamUserPolicy
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_policy import S3BucketPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = IamUser(self, "example",
+            name="example"
+        )
+        aws_s3_bucket_example = S3Bucket(self, "example_1",
+            bucket="my-test-bucket"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_example.override_logical_id("example")
+        current = DataAwsCallerIdentity(self, "current")
+        s3_access = IamUserPolicy(self, "s3_access",
+            name="example_s3_access",
+            policy=Token.as_string(
+                Fn.jsonencode({
+                    "Statement": [{
+                        "Action": "s3:GetObject",
+                        "Effect": "Allow",
+                        "Resource": aws_s3_bucket_example.arn
+                    }
+                    ],
+                    "Version": "2012-10-17"
+                })),
+            user=example.name
+        )
+        account_access = S3BucketPolicy(self, "account_access",
+            bucket=Token.as_string(aws_s3_bucket_example.bucket),
+            policy=Token.as_string(
+                Fn.jsonencode({
+                    "Statement": [{
+                        "Action": "s3:*",
+                        "Effect": "Allow",
+                        "Principal": {
+                            "AWS": current.account_id
+                        },
+                        "Resource": [aws_s3_bucket_example.arn, "${" + aws_s3_bucket_example.arn + "}/*"
+                        ]
+                    }
+                    ],
+                    "Version": "2012-10-17"
+                }))
+        )
+        DataAwsIamPrincipalPolicySimulation(self, "s3_object_access",
+            action_names=["s3:GetObject"],
+            depends_on=[s3_access],
+            lifecycle=TerraformResourceLifecycle(
+                postcondition=[Postcondition(
+                    condition=TerraformSelf.get_any("all_allowed"),
+                    error_message="        " +
+                    Token.as_string(TerraformSelf.get_any("policy_source_arn")) + " does not have the expected access to " +
+                    Token.as_string(
+                        Fn.join(", ",
+                            Token.as_list(TerraformSelf.get_any("resource_arns")))) + ".\n\n"
+                )
+                ]
+            ),
+            policy_source_arn=example.arn,
+            resource_arns=[Token.as_string(aws_s3_bucket_example.arn)],
+            resource_policy_json=account_access.policy
+        )
+```
+
+When using `aws_iam_principal_policy_simulation` to test the effect of a policy declared elsewhere in the same configuration, it's important to use [`depends_on`](https://www.terraform.io/language/meta-arguments/depends_on) to make sure that the needed policy has been fully created or updated before running the simulation.
+
+## Argument Reference
+
+The following arguments are required for any principal policy simulation:
+
+* `action_names` (Required) - A set of IAM action names to run simulations for. Each entry in this set adds an additional hypothetical request to the simulation.
+
+    Action names consist of a service prefix and an action verb separated by a colon, such as `s3:GetObject`. Refer to [Actions, resources, and condition keys for AWS services](https://docs.aws.amazon.com/service-authorization/latest/reference/reference_policies_actions-resources-contextkeys.html) to see the full set of possible IAM action names across all AWS services.
+
+* `policy_source_arn` (Required) - The [ARN](https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html) of the IAM user, group, or role whose policies will be included in the simulation.
+
+You must closely match the form of the real service request you are simulating in order to achieve a realistic result. You can use the following additional arguments to specify other characteristics of the simulated requests:
+
+* `caller_arn` (Optional) - The ARN of an user that will appear as the "caller" of the simulated requests. If you do not specify `caller_arn` then the simulation will use the `policy_source_arn` instead, if it contains a user ARN.
+
+* `context` (Optional) - Each [`context` block](#context-block-arguments) defines an entry in the table of additional context keys in the simulated request.
+
+    IAM uses context keys for both custom conditions and for interpolating dynamic request-specific values into policy values. If you use policies that include those features then you will need to provide suitable example values for those keys to achieve a realistic simulation.
+
+* `additional_policies_json` (Optional) - A set of additional principal policy documents to include in the simulation. The simulator will behave as if each of these policies were associated with the object specified in `policy_source_arn`, allowing you to test the effect of hypothetical policies not yet created.
+
+* `permissions_boundary_policies_json` (Optional) - A set of [permissions boundary policy documents](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html) to include in the simulation.
+
+* `resource_arns` (Optional) - A set of ARNs of resources to include in the simulation.
+
+    This argument is important for actions that have either required or optional resource types listed in [Actions, resources, and condition keys for AWS services](https://docs.aws.amazon.com/service-authorization/latest/reference/reference_policies_actions-resources-contextkeys.html), and you must provide ARNs that identify AWS objects of the appropriate types for the chosen actions.
+
+    The policy simulator only automatically loads policies associated with the `policy_source_arn`, so if your given resources have their own resource-level policy then you'll also need to provide that explicitly using the `resource_policy_json` argument to achieve a realistic simulation.
+
+* `resource_handling_option` (Optional) - Specifies a special simulation type to run. Some EC2 actions require special simulation behaviors and a particular set of resource ARNs to achieve a realistic result.
+
+    For more details, see the `ResourceHandlingOption` request parameter for [the underlying `iam:SimulatePrincipalPolicy` action](https://docs.aws.amazon.com/IAM/latest/APIReference/API_SimulatePrincipalPolicy.html).
+
+* `resource_owner_account_id` (Optional) - An AWS account ID to use for any resource ARN in `resource_arns` that doesn't include its own AWS account ID. If unspecified, the simulator will use the account ID from the `caller_arn` argument as a placeholder.
+
+* `resource_policy_json` (Optional) - An IAM policy document representing the resource-level policy of all of the resources specified in `resource_arns`.
+
+    The policy simulator cannot automatically load policies that are associated with individual resources, as described in the documentation for `resource_arns` above.
+
+### `context` block arguments
+
+The following arguments are all required in each `context` block:
+
+* `key` (Required) - The context _condition key_ to set.
+
+    If you have policies containing `Condition` elements or using dynamic interpolations then you will need to provide suitable values for each condition key your policies use. See [Actions, resources, and condition keys for AWS services](https://docs.aws.amazon.com/service-authorization/latest/reference/reference_policies_actions-resources-contextkeys.html) to find the various condition keys that are normally provided for real requests to each action of each AWS service.
+
+* `type` (Required) - An IAM value type that determines how the policy simulator will interpret the strings given in `values`.
+
+    For more information, see the `ContextKeyType` field of [`iam.ContextEntry`](https://docs.aws.amazon.com/IAM/latest/APIReference/API_ContextEntry.html) in the underlying API.
+
+* `values` (Required) - A set of one or more values for this context entry.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `all_allowed` - `true` if all of the simulation results have decision "allowed", or `false` otherwise.
+
+    This is a convenient shorthand for the common case of requiring that all of the simulated requests passed in a postcondition associated with the data source. If you need to describe a more granular condition, use the `results` attribute instead.
+
+* `results` - A set of result objects, one for each of the simulated requests, with the following nested attributes:
+
+    * `action_name` - The name of the single IAM action used for this particular request.
+
+    * `decision` - The raw decision determined from all of the policies in scope; either "allowed", "explicitDeny", or "implicitDeny".
+
+    * `allowed` - `true` if `decision` is "allowed", and `false` otherwise.
+
+    * `decision_details` - A map of arbitrary metadata entries returned by the policy simulator for this request.
+
+    * `resource_arn` - ARN of the resource that was used for this particular request. When you specify multiple actions and multiple resource ARNs, that causes a separate policy request for each combination of unique action and resource.
+
+    * `matched_statements` - A nested set of objects describing which policies contained statements that were relevant to this simulation request. Each object has attributes `source_policy_id` and `source_policy_type` to identify one of the policies.
+
+    * `missing_context_keys` - A set of context keys (or condition keys) that were needed by some of the policies contributing to this result but not specified using a `context` block in the configuration. Missing or incorrect context keys will typically cause a simulated request to be disallowed.
+
+<!-- cache-key: cdktf-0.18.0 input-6271bf4e5593c485a454ee1fc263b036e5a42e08cc910da3ee1ceb0f0495dce4 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/iam_role.html.markdown b/website/docs/cdktf/python/d/iam_role.html.markdown
new file mode 100644
index 00000000000..c021a5a5d55
--- /dev/null
+++ b/website/docs/cdktf/python/d/iam_role.html.markdown
@@ -0,0 +1,61 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_role"
+description: |-
+  Get information on a Amazon IAM role
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_iam_role
+
+This data source can be used to fetch information about a specific
+IAM role. By using this data source, you can reference IAM role
+properties without having to hard code ARNs as input.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_role import DataAwsIamRole
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsIamRole(self, "example",
+            name="an_example_role_name"
+        )
+```
+
+## Argument Reference
+
+* `name` - (Required) Friendly IAM role name to match.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - Friendly IAM role name to match.
+* `arn` - ARN of the role.
+* `assume_role_policy` - Policy document associated with the role.
+* `create_date` - Creation date of the role in RFC 3339 format.
+* `description` - Description for the role.
+* `max_session_duration` - Maximum session duration.
+* `path` - Path to the role.
+* `permissions_boundary` - The ARN of the policy that is used to set the permissions boundary for the role.
+* `role_last_used` - Contains information about the last time that an IAM role was used. See [`role_last_used`](#role_last_used) for details.
+* `unique_id` - Stable and unique string identifying the role.
+* `tags` - Tags attached to the role.
+
+### role_last_used
+
+* `region` - The name of the AWS Region in which the role was last used.
+* `last_used_date` - The date and time, in RFC 3339 format, that the role was last used.
+
+<!-- cache-key: cdktf-0.18.0 input-f419dd0c81b1d5dcbc960f11de5335c9a815a56c17e6d9214e419f0ce6cd1165 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/iam_roles.html.markdown b/website/docs/cdktf/python/d/iam_roles.html.markdown
new file mode 100644
index 00000000000..5bbcb883e78
--- /dev/null
+++ b/website/docs/cdktf/python/d/iam_roles.html.markdown
@@ -0,0 +1,155 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_roles"
+description: |-
+  Get information about a set of IAM Roles.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_iam_roles
+
+Use this data source to get the ARNs and Names of IAM Roles.
+
+## Example Usage
+
+### All roles in an account
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_roles import DataAwsIamRoles
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsIamRoles(self, "roles")
+```
+
+### Roles filtered by name regex
+
+Roles whose role-name contains `project`
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_roles import DataAwsIamRoles
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsIamRoles(self, "roles",
+            name_regex=".*project.*"
+        )
+```
+
+### Roles filtered by path prefix
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_roles import DataAwsIamRoles
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsIamRoles(self, "roles",
+            path_prefix="/custom-path"
+        )
+```
+
+### Roles provisioned by AWS SSO
+
+Roles in the account filtered by path prefix
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_roles import DataAwsIamRoles
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsIamRoles(self, "roles",
+            path_prefix="/aws-reserved/sso.amazonaws.com/"
+        )
+```
+
+Specific role in the account filtered by name regex and path prefix
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_roles import DataAwsIamRoles
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsIamRoles(self, "roles",
+            name_regex="AWSReservedSSO_permission_set_name_.*",
+            path_prefix="/aws-reserved/sso.amazonaws.com/"
+        )
+```
+
+### Role ARNs with paths removed
+
+For services like Amazon EKS that do not permit a path in the role ARN when used in a cluster's configuration map
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformOutput, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_roles import DataAwsIamRoles
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        roles = DataAwsIamRoles(self, "roles",
+            path_prefix="/aws-reserved/sso.amazonaws.com/"
+        )
+        TerraformOutput(self, "arns",
+            value="${[ for parts in ${" + ("${[ for arn in ${" + roles.arns + "} : split(\"/\", arn)]}") + "} : format(\"%s/%s\", parts[0], element(parts, length(parts) - 1))]}"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name_regex` - (Optional) Regex string to apply to the IAM roles list returned by AWS. This allows more advanced filtering not supported from the AWS API. This filtering is done locally on what AWS returns, and could have a performance impact if the result is large. Combine this with other options to narrow down the list AWS returns.
+* `path_prefix` - (Optional) Path prefix for filtering the results. For example, the prefix `/application_abc/component_xyz/` gets all roles whose path starts with `/application_abc/component_xyz/`. If it is not included, it defaults to a slash (`/`), listing all roles. For more details, check out [list-roles in the AWS CLI reference][1].
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arns` - Set of ARNs of the matched IAM roles.
+* `names` - Set of Names of the matched IAM roles.
+
+[1]: https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/list-roles.html
+
+<!-- cache-key: cdktf-0.18.0 input-2f1510756a6120b958db2271379136537f759d5e9afbe12b5fb117e5c9014d63 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/iam_saml_provider.html.markdown b/website/docs/cdktf/python/d/iam_saml_provider.html.markdown
new file mode 100644
index 00000000000..51d66b7e5d2
--- /dev/null
+++ b/website/docs/cdktf/python/d/iam_saml_provider.html.markdown
@@ -0,0 +1,50 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_saml_provider"
+description: |-
+  Get information on an IAM SAML provider.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_saml_provider
+
+This data source can be used to fetch information about a specific
+IAM SAML provider. This will allow you to easily retrieve the metadata
+document of an existing SAML provider.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_saml_provider import DataAwsIamSamlProvider
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsIamSamlProvider(self, "example",
+            arn="arn:aws:iam::123456789:saml-provider/myprovider"
+        )
+```
+
+## Argument Reference
+
+* `arn` - (Required) ARN assigned by AWS for the provider.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `create_date` - Creation date of the SAML provider in RFC1123 format, e.g. `Mon, 02 Jan 2006 15:04:05 MST`.
+* `name` - Name of the provider.
+* `saml_metadata_document` - The XML document generated by an identity provider that supports SAML 2.0.
+* `tags` - Tags attached to the SAML provider.
+* `valid_until` - Expiration date and time for the SAML provider in RFC1123 format, e.g. `Mon, 02 Jan 2007 15:04:05 MST`.
+
+<!-- cache-key: cdktf-0.18.0 input-3075ed53262e7e26eb19f6b6608bbaed885c6c93fe9dcf1a0139a8fe7f5d0d23 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/iam_server_certificate.html.markdown b/website/docs/cdktf/python/d/iam_server_certificate.html.markdown
new file mode 100644
index 00000000000..381eefa81e8
--- /dev/null
+++ b/website/docs/cdktf/python/d/iam_server_certificate.html.markdown
@@ -0,0 +1,87 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_server_certificate"
+description: |-
+  Get information about a server certificate
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_iam_server_certificate
+
+Use this data source to lookup information about IAM Server Certificates.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_server_certificate import DataAwsIamServerCertificate
+from imports.aws.elb import Elb
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        my_domain = DataAwsIamServerCertificate(self, "my-domain",
+            latest=True,
+            name_prefix="my-domain.org"
+        )
+        Elb(self, "elb",
+            listener=[ElbListener(
+                instance_port=8000,
+                instance_protocol="https",
+                lb_port=443,
+                lb_protocol="https",
+                ssl_certificate_id=Token.as_string(my_domain.arn)
+            )
+            ],
+            name="my-domain-elb"
+        )
+```
+
+## Argument Reference
+
+* `name_prefix` - prefix of cert to filter by
+* `path_prefix` - prefix of path to filter by
+* `name` - exact name of the cert to lookup
+* `latest` - sort results by expiration date. returns the certificate with expiration date in furthest in the future.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` is set to the unique id of the IAM Server Certificate
+* `arn` is set to the ARN of the IAM Server Certificate
+* `path` is set to the path of the IAM Server Certificate
+* `expiration_date` is set to the expiration date of the IAM Server Certificate
+* `upload_date` is the date when the server certificate was uploaded
+* `certificate_body` is the public key certificate (PEM-encoded). This is useful when [configuring back-end instance authentication](http://docs.aws.amazon.com/elasticloadbalancing/latest/classic/elb-create-https-ssl-load-balancer.html) policy for load balancer
+* `certificate_chain` is the public key certificate chain (PEM-encoded) if exists, empty otherwise
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import an IAM server certificate using `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import an IAM server certificate using `name`. For example:
+
+```console
+% terraform import aws_iam_server_certificate.example example
+```
+
+Import will read in the certificate body, certificate chain (if it exists), ID, name, path, and ARN. It will not retrieve the private key which is not available through the AWS API.
+
+<!-- cache-key: cdktf-0.18.0 input-15f20b097eebaf3145f26a098ba793c65fab18858f84e06d6eb664e0785a5cdd -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/iam_session_context.html.markdown b/website/docs/cdktf/python/d/iam_session_context.html.markdown
new file mode 100644
index 00000000000..2ec7b3ec77d
--- /dev/null
+++ b/website/docs/cdktf/python/d/iam_session_context.html.markdown
@@ -0,0 +1,76 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_session_context"
+description: |-
+  Get information on the IAM source role of an STS assumed role
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_iam_session_context
+
+This data source provides information on the IAM source role of an STS assumed role. For non-role ARNs, this data source simply passes the ARN through in `issuer_arn`.
+
+For some AWS resources, multiple types of principals are allowed in the same argument (e.g., IAM users and IAM roles). However, these arguments often do not allow assumed-role (i.e., STS, temporary credential) principals. Given an STS ARN, this data source provides the ARN for the source IAM role.
+
+## Example Usage
+
+### Basic Example
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_session_context import DataAwsIamSessionContext
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsIamSessionContext(self, "example",
+            arn="arn:aws:sts::123456789012:assumed-role/Audien-Heaven/MatyNoyes"
+        )
+```
+
+### Find the Terraform Runner's Source Role
+
+Combined with `aws_caller_identity`, you can get the current user's source IAM role ARN (`issuer_arn`) if you're using an assumed role. If you're not using an assumed role, the caller's (e.g., an IAM user's) ARN will simply be passed through. In environments where both IAM users and individuals using assumed roles need to apply the same configurations, this data source enables seamless use.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_caller_identity import DataAwsCallerIdentity
+from imports.aws.data_aws_iam_session_context import DataAwsIamSessionContext
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        current = DataAwsCallerIdentity(self, "current")
+        DataAwsIamSessionContext(self, "example",
+            arn=Token.as_string(current.arn)
+        )
+```
+
+## Argument Reference
+
+* `arn` - (Required) ARN for an assumed role.
+
+~> If `arn` is a non-role ARN, Terraform gives no error and `issuer_arn` will be equal to the `arn` value. For STS assumed-role ARNs, Terraform gives an error if the identified IAM role does not exist.
+
+## Attribute Reference
+
+~> With the exception of `issuer_arn`, the attributes will not be populated unless the `arn` corresponds to an STS assumed role.
+
+* `issuer_arn` - IAM source role ARN if `arn` corresponds to an STS assumed role. Otherwise, `issuer_arn` is equal to `arn`.
+* `issuer_id` - Unique identifier of the IAM role that issues the STS assumed role.
+* `issuer_name` - Name of the source role. Only available if `arn` corresponds to an STS assumed role.
+* `session_name` - Name of the STS session. Only available if `arn` corresponds to an STS assumed role.
+
+<!-- cache-key: cdktf-0.18.0 input-2e84cd322ad745896d1da57edd8c38897f3e2a4e912db65dea1fc036c7a5e65a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/iam_session_context.markdown b/website/docs/cdktf/python/d/iam_session_context.markdown
new file mode 100644
index 00000000000..2ec7b3ec77d
--- /dev/null
+++ b/website/docs/cdktf/python/d/iam_session_context.markdown
@@ -0,0 +1,76 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_session_context"
+description: |-
+  Get information on the IAM source role of an STS assumed role
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_iam_session_context
+
+This data source provides information on the IAM source role of an STS assumed role. For non-role ARNs, this data source simply passes the ARN through in `issuer_arn`.
+
+For some AWS resources, multiple types of principals are allowed in the same argument (e.g., IAM users and IAM roles). However, these arguments often do not allow assumed-role (i.e., STS, temporary credential) principals. Given an STS ARN, this data source provides the ARN for the source IAM role.
+
+## Example Usage
+
+### Basic Example
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_session_context import DataAwsIamSessionContext
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsIamSessionContext(self, "example",
+            arn="arn:aws:sts::123456789012:assumed-role/Audien-Heaven/MatyNoyes"
+        )
+```
+
+### Find the Terraform Runner's Source Role
+
+Combined with `aws_caller_identity`, you can get the current user's source IAM role ARN (`issuer_arn`) if you're using an assumed role. If you're not using an assumed role, the caller's (e.g., an IAM user's) ARN will simply be passed through. In environments where both IAM users and individuals using assumed roles need to apply the same configurations, this data source enables seamless use.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_caller_identity import DataAwsCallerIdentity
+from imports.aws.data_aws_iam_session_context import DataAwsIamSessionContext
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        current = DataAwsCallerIdentity(self, "current")
+        DataAwsIamSessionContext(self, "example",
+            arn=Token.as_string(current.arn)
+        )
+```
+
+## Argument Reference
+
+* `arn` - (Required) ARN for an assumed role.
+
+~> If `arn` is a non-role ARN, Terraform gives no error and `issuer_arn` will be equal to the `arn` value. For STS assumed-role ARNs, Terraform gives an error if the identified IAM role does not exist.
+
+## Attribute Reference
+
+~> With the exception of `issuer_arn`, the attributes will not be populated unless the `arn` corresponds to an STS assumed role.
+
+* `issuer_arn` - IAM source role ARN if `arn` corresponds to an STS assumed role. Otherwise, `issuer_arn` is equal to `arn`.
+* `issuer_id` - Unique identifier of the IAM role that issues the STS assumed role.
+* `issuer_name` - Name of the source role. Only available if `arn` corresponds to an STS assumed role.
+* `session_name` - Name of the STS session. Only available if `arn` corresponds to an STS assumed role.
+
+<!-- cache-key: cdktf-0.18.0 input-2e84cd322ad745896d1da57edd8c38897f3e2a4e912db65dea1fc036c7a5e65a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/iam_user.html.markdown b/website/docs/cdktf/python/d/iam_user.html.markdown
new file mode 100644
index 00000000000..4c51f59461e
--- /dev/null
+++ b/website/docs/cdktf/python/d/iam_user.html.markdown
@@ -0,0 +1,51 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_user"
+description: |-
+  Get information on a Amazon IAM user
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_iam_user
+
+This data source can be used to fetch information about a specific
+IAM user. By using this data source, you can reference IAM user
+properties without having to hard code ARNs or unique IDs as input.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_user import DataAwsIamUser
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsIamUser(self, "example",
+            user_name="an_example_user_name"
+        )
+```
+
+## Argument Reference
+
+* `user_name` - (Required) Friendly IAM user name to match.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN assigned by AWS for this user.
+* `path` - Path in which this user was created.
+* `permissions_boundary` - The ARN of the policy that is used to set the permissions boundary for the user.
+* `user_id` - Unique ID assigned by AWS for this user.
+* `user_name` - Name associated to this User
+* `tags` - Map of key-value pairs associated with the user.
+
+<!-- cache-key: cdktf-0.18.0 input-311b2756445d8c90d21040b26efe2adc4c762ad5827739191b5f65d550f8435c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/iam_user_ssh_key.html.markdown b/website/docs/cdktf/python/d/iam_user_ssh_key.html.markdown
new file mode 100644
index 00000000000..b1c4bd76d4e
--- /dev/null
+++ b/website/docs/cdktf/python/d/iam_user_ssh_key.html.markdown
@@ -0,0 +1,50 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_user_ssh_key"
+description: |-
+  Get information on a SSH public key associated with the specified IAM user.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_iam_user_ssh_key
+
+Use this data source to get information about a SSH public key associated with the specified IAM user.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_user_ssh_key import DataAwsIamUserSshKey
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsIamUserSshKey(self, "example",
+            encoding="SSH",
+            ssh_public_key_id="APKARUZ32GUTKIGARLXE",
+            username="test-user"
+        )
+```
+
+## Argument Reference
+
+* `encoding` - (Required) Specifies the public key encoding format to use in the response. To retrieve the public key in ssh-rsa format, use `SSH`. To retrieve the public key in PEM format, use `PEM`.
+* `ssh_public_key_id` - (Required) Unique identifier for the SSH public key.
+* `username` - (Required) Name of the IAM user associated with the SSH public key.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `fingerprint` - MD5 message digest of the SSH public key.
+* `public_key` - SSH public key.
+* `status` - Status of the SSH public key. Active means that the key can be used for authentication with an CodeCommit repository. Inactive means that the key cannot be used.
+
+<!-- cache-key: cdktf-0.18.0 input-4ee22ff1f5e0f080cab2c8697a1be23a25df9c75fdd5dc34b8ea78d65f92f801 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/iam_users.html.markdown b/website/docs/cdktf/python/d/iam_users.html.markdown
new file mode 100644
index 00000000000..af4a4baf0ab
--- /dev/null
+++ b/website/docs/cdktf/python/d/iam_users.html.markdown
@@ -0,0 +1,90 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_users"
+description: |-
+  Get information about a set of IAM Users.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_iam_users
+
+Use this data source to get the ARNs and Names of IAM Users.
+
+## Example Usage
+
+### All users in an account
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_users import DataAwsIamUsers
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsIamUsers(self, "users")
+```
+
+### Users filtered by name regex
+
+Users whose username contains `abc`
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_users import DataAwsIamUsers
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsIamUsers(self, "users",
+            name_regex=".*abc.*"
+        )
+```
+
+### Users filtered by path prefix
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_users import DataAwsIamUsers
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsIamUsers(self, "users",
+            path_prefix="/custom-path"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name_regex` - (Optional) Regex string to apply to the IAM users list returned by AWS. This allows more advanced filtering not supported from the AWS API. This filtering is done locally on what AWS returns, and could have a performance impact if the result is large. Combine this with other options to narrow down the list AWS returns.
+* `path_prefix` - (Optional) Path prefix for filtering the results. For example, the prefix `/division_abc/subdivision_xyz/` gets all users whose path starts with `/division_abc/subdivision_xyz/`. If it is not included, it defaults to a slash (`/`), listing all users. For more details, check out [list-users in the AWS CLI reference][1].
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arns` - Set of ARNs of the matched IAM users.
+* `names` - Set of Names of the matched IAM users.
+
+[1]: https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/list-users.html
+
+<!-- cache-key: cdktf-0.18.0 input-5428d23c52ab8bd43ff4dfbb46d01c355df0ab280bbe08b24005df157e030403 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/identitystore_group.html.markdown b/website/docs/cdktf/python/d/identitystore_group.html.markdown
new file mode 100644
index 00000000000..3a98a9957a7
--- /dev/null
+++ b/website/docs/cdktf/python/d/identitystore_group.html.markdown
@@ -0,0 +1,105 @@
+---
+subcategory: "SSO Identity Store"
+layout: "aws"
+page_title: "AWS: aws_identitystore_group"
+description: |-
+  Get information on an Identity Store Group
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_identitystore_group
+
+Use this data source to get an Identity Store Group.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformOutput, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_identitystore_group import DataAwsIdentitystoreGroup
+from imports.aws.data_aws_ssoadmin_instances import DataAwsSsoadminInstances
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = DataAwsSsoadminInstances(self, "example")
+        data_aws_identitystore_group_example = DataAwsIdentitystoreGroup(self, "example_1",
+            alternate_identifier=DataAwsIdentitystoreGroupAlternateIdentifier(
+                unique_attribute=DataAwsIdentitystoreGroupAlternateIdentifierUniqueAttribute(
+                    attribute_path="DisplayName",
+                    attribute_value="ExampleGroup"
+                )
+            ),
+            identity_store_id=Token.as_string(
+                Fn.lookup_nested(Fn.tolist(example.identity_store_ids), ["0"]))
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_identitystore_group_example.override_logical_id("example")
+        TerraformOutput(self, "group_id",
+            value=data_aws_identitystore_group_example.group_id
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `identity_store_id` - (Required) Identity Store ID associated with the Single Sign-On Instance.
+
+The following arguments are optional:
+
+* `alternate_identifier` (Optional) A unique identifier for the group that is not the primary identifier. Conflicts with `group_id` and `filter`. Detailed below.
+* `filter` - (Optional, **Deprecated** use the `alternate_identifier` attribute instead) Configuration block for filtering by a unique attribute of the group. Detailed below.
+* `group_id` - (Optional) The identifier for a group in the Identity Store.
+
+-> Exactly one of the above arguments must be provided. Passing both `filter` and `group_id` is allowed for backwards compatibility.
+
+### `alternate_identifier` Configuration Block
+
+The `alternate_identifier` configuration block supports the following arguments:
+
+* `external_id` - (Optional) Configuration block for filtering by the identifier issued by an external identity provider. Detailed below.
+* `unique_attribute` - (Optional) An entity attribute that's unique to a specific entity. Detailed below.
+
+-> Exactly one of the above arguments must be provided.
+
+### `external_id` Configuration Block
+
+The `external_id` configuration block supports the following arguments:
+
+* `id` - (Required) The identifier issued to this resource by an external identity provider.
+* `issuer` - (Required) The issuer for an external identifier.
+
+### `filter` Configuration Block
+
+~> The `filter` configuration block has been deprecated. Use `alternate_identifier` instead.
+
+The following arguments are supported by the `filter` configuration block:
+
+* `attribute_path` - (Required) Attribute path that is used to specify which attribute name to search. Currently, `DisplayName` is the only valid attribute path.
+* `attribute_value` - (Required) Value for an attribute.
+
+### `unique_attribute` Configuration Block
+
+The `unique_attribute` configuration block supports the following arguments:
+
+* `attribute_path` - (Required) Attribute path that is used to specify which attribute name to search. For example: `DisplayName`. Refer to the [Group data type](https://docs.aws.amazon.com/singlesignon/latest/IdentityStoreAPIReference/API_Group.html).
+* `attribute_value` - (Required) Value for an attribute.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - Identifier of the group in the Identity Store.
+* `description` - Description of the specified group.
+* `display_name` - Group's display name value.
+* `external_ids` - List of identifiers issued to this resource by an external identity provider.
+    * `id` - The identifier issued to this resource by an external identity provider.
+    * `issuer` - The issuer for an external identifier.
+
+<!-- cache-key: cdktf-0.18.0 input-e2ee8a1f184076e4923473e811d8cdcd0bbfa4b31daf2855f308b2e41de9934b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/identitystore_user.html.markdown b/website/docs/cdktf/python/d/identitystore_user.html.markdown
new file mode 100644
index 00000000000..96aba38fa9d
--- /dev/null
+++ b/website/docs/cdktf/python/d/identitystore_user.html.markdown
@@ -0,0 +1,136 @@
+---
+subcategory: "SSO Identity Store"
+layout: "aws"
+page_title: "AWS: aws_identitystore_user"
+description: |-
+  Get information on an Identity Store User
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_identitystore_user
+
+Use this data source to get an Identity Store User.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformOutput, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_identitystore_user import DataAwsIdentitystoreUser
+from imports.aws.data_aws_ssoadmin_instances import DataAwsSsoadminInstances
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = DataAwsSsoadminInstances(self, "example")
+        data_aws_identitystore_user_example = DataAwsIdentitystoreUser(self, "example_1",
+            alternate_identifier=DataAwsIdentitystoreUserAlternateIdentifier(
+                unique_attribute=DataAwsIdentitystoreUserAlternateIdentifierUniqueAttribute(
+                    attribute_path="UserName",
+                    attribute_value="ExampleUser"
+                )
+            ),
+            identity_store_id=Token.as_string(
+                Fn.lookup_nested(Fn.tolist(example.identity_store_ids), ["0"]))
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_identitystore_user_example.override_logical_id("example")
+        TerraformOutput(self, "user_id",
+            value=data_aws_identitystore_user_example.user_id
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `identity_store_id` - (Required) Identity Store ID associated with the Single Sign-On Instance.
+
+The following arguments are optional:
+
+* `alternate_identifier` (Optional) A unique identifier for a user or group that is not the primary identifier. Conflicts with `user_id` and `filter`. Detailed below.
+* `filter` - (Optional, **Deprecated** use the `alternate_identifier` attribute instead) Configuration block for filtering by a unique attribute of the user. Detailed below.
+* `user_id` - (Optional) The identifier for a user in the Identity Store.
+
+-> Exactly one of the above arguments must be provided. Passing both `filter` and `user_id` is allowed for backwards compatibility.
+
+### `alternate_identifier` Configuration Block
+
+The `alternate_identifier` configuration block supports the following arguments:
+
+* `external_id` - (Optional) Configuration block for filtering by the identifier issued by an external identity provider. Detailed below.
+* `unique_attribute` - (Optional) An entity attribute that's unique to a specific entity. Detailed below.
+
+-> Exactly one of the above arguments must be provided.
+
+### `external_id` Configuration Block
+
+The `external_id` configuration block supports the following arguments:
+
+* `id` - (Required) The identifier issued to this resource by an external identity provider.
+* `issuer` - (Required) The issuer for an external identifier.
+
+### `filter` Configuration Block
+
+~> The `filter` configuration block has been deprecated. Use `alternate_identifier` instead.
+
+The following arguments are supported by the `filter` configuration block:
+
+* `attribute_path` - (Required) Attribute path that is used to specify which attribute name to search. Currently, `UserName` is the only valid attribute path.
+* `attribute_value` - (Required) Value for an attribute.
+
+### `unique_attribute` Configuration Block
+
+The `unique_attribute` configuration block supports the following arguments:
+
+* `attribute_path` - (Required) Attribute path that is used to specify which attribute name to search. For example: `UserName`. Refer to the [User data type](https://docs.aws.amazon.com/singlesignon/latest/IdentityStoreAPIReference/API_User.html).
+* `attribute_value` - (Required) Value for an attribute.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - Identifier of the user in the Identity Store.
+* `addresses` - List of details about the user's address.
+    * `country` - The country that this address is in.
+    * `formatted` - The name that is typically displayed when the address is shown for display.
+    * `locality` - The address locality.
+    * `postal_code` - The postal code of the address.
+    * `primary` - When `true`, this is the primary address associated with the user.
+    * `region` - The region of the address.
+    * `street_address` - The street of the address.
+    * `type` - The type of address.
+* `display_name` - The name that is typically displayed when the user is referenced.
+* `emails` - List of details about the user's email.
+    * `primary` - When `true`, this is the primary email associated with the user.
+    * `type` - The type of email.
+    * `value` - The email address. This value must be unique across the identity store.
+* `external_ids` - List of identifiers issued to this resource by an external identity provider.
+    * `id` - The identifier issued to this resource by an external identity provider.
+    * `issuer` - The issuer for an external identifier.
+* `locale` - The user's geographical region or location.
+* `name` - Details about the user's full name.
+    * `family_name` - The family name of the user.
+    * `formatted` - The name that is typically displayed when the name is shown for display.
+    * `given_name` - The given name of the user.
+    * `honorific_prefix` - The honorific prefix of the user.
+    * `honorific_suffix` - The honorific suffix of the user.
+    * `middle_name` - The middle name of the user.
+* `nickname` - An alternate name for the user.
+* `phone_numbers` - List of details about the user's phone number.
+    * `primary` - When `true`, this is the primary phone number associated with the user.
+    * `type` - The type of phone number.
+    * `value` - The user's phone number.
+* `preferred_language` - The preferred language of the user.
+* `profile_url` - An URL that may be associated with the user.
+* `timezone` - The user's time zone.
+* `title` - The user's title.
+* `user_name` - User's user name value.
+* `user_type` - The user type.
+
+<!-- cache-key: cdktf-0.18.0 input-8c28f2f52361f5a36e7b173700680cb27d3254e1fd37a8faf2c90f48b32a9d09 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/imagebuilder_component.html.markdown b/website/docs/cdktf/python/d/imagebuilder_component.html.markdown
new file mode 100644
index 00000000000..820bedbc532
--- /dev/null
+++ b/website/docs/cdktf/python/d/imagebuilder_component.html.markdown
@@ -0,0 +1,56 @@
+---
+subcategory: "EC2 Image Builder"
+layout: "aws"
+page_title: "AWS: aws_imagebuilder_component"
+description: |-
+    Provides details about an Image Builder Component
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_imagebuilder_component
+
+Provides details about an Image Builder Component.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_imagebuilder_component import DataAwsImagebuilderComponent
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsImagebuilderComponent(self, "example",
+            arn="arn:aws:imagebuilder:us-west-2:aws:component/amazon-cloudwatch-agent-linux/1.0.0"
+        )
+```
+
+## Argument Reference
+
+* `arn` - (Required) ARN of the component.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `change_description` - Change description of the component.
+* `data` - Data of the component.
+* `date_created` - Date the component was created.
+* `description` - Description of the component.
+* `encrypted` - Encryption status of the component.
+* `kms_key_id` - ARN of the Key Management Service (KMS) Key used to encrypt the component.
+* `name` - Name of the component.
+* `owner` - Owner of the component.
+* `platform` - Platform of the component.
+* `supported_os_versions` - Operating Systems (OSes) supported by the component.
+* `tags` - Key-value map of resource tags for the component.
+* `type` - Type of the component.
+* `version` - Version of the component.
+
+<!-- cache-key: cdktf-0.18.0 input-a1dc867971bb73f35e057b5eef73912cb2d3c40d9fe01c02820500754033afa8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/imagebuilder_components.html.markdown b/website/docs/cdktf/python/d/imagebuilder_components.html.markdown
new file mode 100644
index 00000000000..427589b2fdb
--- /dev/null
+++ b/website/docs/cdktf/python/d/imagebuilder_components.html.markdown
@@ -0,0 +1,58 @@
+---
+subcategory: "EC2 Image Builder"
+layout: "aws"
+page_title: "AWS: aws_imagebuilder_components"
+description: |-
+    Get information on Image Builder Components.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_imagebuilder_components
+
+Use this data source to get the ARNs and names of Image Builder Components matching the specified criteria.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_imagebuilder_components import DataAwsImagebuilderComponents
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsImagebuilderComponents(self, "example",
+            filter=[DataAwsImagebuilderComponentsFilter(
+                name="platform",
+                values=["Linux"]
+            )
+            ],
+            owner="Self"
+        )
+```
+
+## Argument Reference
+
+* `owner` - (Optional) Owner of the image recipes. Valid values are `Self`, `Shared` and `Amazon`. Defaults to `Self`.
+* `filter` - (Optional) Configuration block(s) for filtering. Detailed below.
+
+### filter Configuration Block
+
+The `filter` configuration block supports the following arguments:
+
+* `name` - (Required) Name of the filter field. Valid values can be found in the [Image Builder ListComponents API Reference](https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_ListComponents.html).
+* `values` - (Required) Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arns` - Set of ARNs of the matched Image Builder Components.
+* `names` - Set of names of the matched Image Builder Components.
+
+<!-- cache-key: cdktf-0.18.0 input-a8148cb67f010a061547e1729a4d73bbc09bfc19d0e0e931cf5f0ffd14e2da9f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/imagebuilder_container_recipe.html.markdown b/website/docs/cdktf/python/d/imagebuilder_container_recipe.html.markdown
new file mode 100644
index 00000000000..3e22713298c
--- /dev/null
+++ b/website/docs/cdktf/python/d/imagebuilder_container_recipe.html.markdown
@@ -0,0 +1,81 @@
+---
+subcategory: "EC2 Image Builder"
+layout: "aws"
+page_title: "AWS: aws_imagebuilder_container_recipe"
+description: |-
+    Provides details about an Image Builder Container Recipe
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_imagebuilder_container_recipe
+
+Provides details about an Image builder Container Recipe.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_imagebuilder_container_recipe import DataAwsImagebuilderContainerRecipe
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsImagebuilderContainerRecipe(self, "example",
+            arn="arn:aws:imagebuilder:us-east-1:aws:container-recipe/example/1.0.0"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `arn` - (Required) ARN of the container recipe.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `component` - List of objects with components for the container recipe.
+    * `component_arn` - ARN of the Image Builder Component.
+    * `parameter` - Set of parameters that are used to configure the component.
+        * `name` - Name of the component parameter.
+        * `value` - Value of the component parameter.
+* `container_type` - Type of the container.
+* `date_created` - Date the container recipe was created.
+* `description` - Description of the container recipe.
+* `dockerfile_template_data` - Dockerfile template used to build the image.
+* `encrypted` - Flag that indicates if the target container is encrypted.
+* `instance_configuration` - List of objects with instance configurations for building and testing container images.
+    * `block_device_mapping` - Set of objects with block device mappings for the instance configuration.
+        * `device_name` - Name of the device. For example, `/dev/sda` or `/dev/xvdb`.
+        * `ebs` - Single list of object with Elastic Block Storage (EBS) block device mapping settings.
+            * `delete_on_termination` - Whether to delete the volume on termination. Defaults to unset, which is the value inherited from the parent image.
+            * `encrypted` - Whether to encrypt the volume. Defaults to unset, which is the value inherited from the parent image.
+            * `iops` - Number of Input/Output (I/O) operations per second to provision for an `io1` or `io2` volume.
+            * `kms_key_id` - ARN of the Key Management Service (KMS) Key for encryption.
+            * `snapshot_id` - Identifier of the EC2 Volume Snapshot.
+            * `throughput` - For GP3 volumes only. The throughput in MiB/s that the volume supports.
+            * `volume_size` - Size of the volume, in GiB.
+            * `volume_type` - Type of the volume. For example, `gp2` or `io2`.
+        * `no_device` - Whether to remove a mapping from the parent image.
+        * `virtual_name` - Virtual device name. For example, `ephemeral0`. Instance store volumes are numbered starting from 0.
+    * `image` - AMI ID of the base image for container build and test instance.
+* `kms_key_id` - KMS key used to encrypt the container image.
+* `name` - Name of the container recipe.
+* `owner` - Owner of the container recipe.
+* `parent_image` - Base image for the container recipe.
+* `platform` - Platform of the container recipe.
+* `tags` - Key-value map of resource tags for the container recipe.
+* `target_repository` - Destination repository for the container image.
+    * `repository_name` - Name of the container repository where the output container image is stored. The name is prefixed by the repository location.
+    * `service` - Service in which this image is registered.
+* `version` - Version of the container recipe.
+* `working_directory` - Working directory used during build and test workflows.
+
+<!-- cache-key: cdktf-0.18.0 input-4e22e11f15936a7e4695ac2bfd8c64e0718ffb1c7fab1ad5ef07d652ffab46f0 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/imagebuilder_container_recipes.html.markdown b/website/docs/cdktf/python/d/imagebuilder_container_recipes.html.markdown
new file mode 100644
index 00000000000..031aab4eeab
--- /dev/null
+++ b/website/docs/cdktf/python/d/imagebuilder_container_recipes.html.markdown
@@ -0,0 +1,58 @@
+---
+subcategory: "EC2 Image Builder"
+layout: "aws"
+page_title: "AWS: aws_imagebuilder_container_recipes"
+description: |-
+    Get information on Image Builder Container Recipes.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_imagebuilder_container_recipes
+
+Use this data source to get the ARNs and names of Image Builder Container Recipes matching the specified criteria.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_imagebuilder_container_recipes import DataAwsImagebuilderContainerRecipes
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsImagebuilderContainerRecipes(self, "example",
+            filter=[DataAwsImagebuilderContainerRecipesFilter(
+                name="platform",
+                values=["Linux"]
+            )
+            ],
+            owner="Self"
+        )
+```
+
+## Argument Reference
+
+* `owner` - (Optional) Owner of the container recipes. Valid values are `Self`, `Shared` and `Amazon`. Defaults to `Self`.
+* `filter` - (Optional) Configuration block(s) for filtering. Detailed below.
+
+### filter Configuration Block
+
+The `filter` configuration block supports the following arguments:
+
+* `name` - (Required) Name of the filter field. Valid values can be found in the [Image Builder ListContainerRecipes API Reference](https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_ListContainerRecipes.html).
+* `values` - (Required) Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arns` - Set of ARNs of the matched Image Builder Container Recipes.
+* `names` - Set of names of the matched Image Builder Container Recipes.
+
+<!-- cache-key: cdktf-0.18.0 input-d055befea2d338072390ae3d9a57f66a449f452a3151ae51419f72bb83057800 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/imagebuilder_distribution_configuration.html.markdown b/website/docs/cdktf/python/d/imagebuilder_distribution_configuration.html.markdown
new file mode 100644
index 00000000000..c77eeefe4a3
--- /dev/null
+++ b/website/docs/cdktf/python/d/imagebuilder_distribution_configuration.html.markdown
@@ -0,0 +1,81 @@
+---
+subcategory: "EC2 Image Builder"
+layout: "aws"
+page_title: "AWS: aws_imagebuilder_distribution_configuration"
+description: |-
+    Provides details about an Image Builder Distribution Configuration
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_imagebuilder_distribution_configuration
+
+Provides details about an Image Builder Distribution Configuration.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_imagebuilder_distribution_configuration import DataAwsImagebuilderDistributionConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsImagebuilderDistributionConfiguration(self, "example",
+            arn="arn:aws:imagebuilder:us-west-2:aws:distribution-configuration/example"
+        )
+```
+
+## Argument Reference
+
+* `arn` - (Required) ARN of the distribution configuration.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `date_created` - Date the distribution configuration was created.
+* `date_updated` - Date the distribution configuration was updated.
+* `description` - Description of the distribution configuration.
+* `distribution` - Set of distributions.
+    * `ami_distribution_configuration` - Nested list of AMI distribution configuration.
+        * `ami_tags` - Key-value map of tags to apply to distributed AMI.
+        * `description` - Description to apply to distributed AMI.
+        * `kms_key_id` - ARN of Key Management Service (KMS) Key to encrypt AMI.
+        * `launch_permission` - Nested list of EC2 launch permissions.
+            * `organization_arns` - Set of AWS Organization ARNs.
+            * `organizational_unit_arns` - Set of AWS Organizational Unit ARNs.
+            * `user_groups` - Set of EC2 launch permission user groups.
+            * `user_ids` - Set of AWS Account identifiers.
+        * `target_account_ids` - Set of target AWS Account identifiers.
+    * `container_distribution_configuration` - Nested list of container distribution configurations.
+        * `container_tags` - Set of tags that are attached to the container distribution configuration.
+        * `description` - Description of the container distribution configuration.
+        * `target_repository` - Set of destination repositories for the container distribution configuration.
+            * `repository_name` - Name of the container repository where the output container image is stored.
+            * `service` - Service in which the image is registered.
+    * `fast_launch_configuration` - Nested list of Windows faster-launching configurations to use for AMI distribution.
+        * `account_id` - The owner account ID for the fast-launch enabled Windows AMI.
+        * `enabled` - A Boolean that represents the current state of faster launching for the Windows AMI.
+        * `launch_template` - Nested list of launch templates that the fast-launch enabled Windows AMI uses when it launches Windows instances to create pre-provisioned snapshots.
+            * `launch_template_id` - The ID of the launch template to use for faster launching for a Windows AMI.
+            * `launch_template_name` - The name of the launch template to use for faster launching for a Windows AMI.
+            * `launch_template_version` - The version of the launch template to use for faster launching for a Windows AMI.
+        * `max_parallel_launches` - The maximum number of parallel instances that are launched for creating resources.
+        * `snapshot_configuration` - Nested list of configurations for managing the number of snapshots that are created from pre-provisioned instances for the Windows AMI when faster launching is enabled.
+            * `target_resource_count` - The number of pre-provisioned snapshots to keep on hand for a fast-launch enabled Windows AMI.
+    * `launch_template_configuration` - Nested list of launch template configurations.
+        * `default` - Whether the specified Amazon EC2 launch template is set as the default launch template.
+        * `launch_template_id` - ID of the Amazon EC2 launch template.
+        * `account_id` - The account ID that this configuration applies to.
+    * `license_configuration_arns` - Set of Amazon Resource Names (ARNs) of License Manager License Configurations.
+    * `region` - AWS Region of distribution.
+* `name` - Name of the distribution configuration.
+* `tags` - Key-value map of resource tags for the distribution configuration.
+
+<!-- cache-key: cdktf-0.18.0 input-7b28680ba5fe3c06481414befe6f2cb9eb821dae2ff9137702f5a2483f24bb91 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/imagebuilder_distribution_configurations.html.markdown b/website/docs/cdktf/python/d/imagebuilder_distribution_configurations.html.markdown
new file mode 100644
index 00000000000..cf9d7a0bb02
--- /dev/null
+++ b/website/docs/cdktf/python/d/imagebuilder_distribution_configurations.html.markdown
@@ -0,0 +1,56 @@
+---
+subcategory: "EC2 Image Builder"
+layout: "aws"
+page_title: "AWS: aws_imagebuilder_distribution_configurations"
+description: |-
+    Get information on Image Builder Distribution Configurations.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_imagebuilder_distribution_configurations
+
+Use this data source to get the ARNs and names of Image Builder Distribution Configurations matching the specified criteria.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_imagebuilder_distribution_configurations import DataAwsImagebuilderDistributionConfigurations
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsImagebuilderDistributionConfigurations(self, "example",
+            filter=[DataAwsImagebuilderDistributionConfigurationsFilter(
+                name="name",
+                values=["example"]
+            )
+            ]
+        )
+```
+
+## Argument Reference
+
+* `filter` - (Optional) Configuration block(s) for filtering. Detailed below.
+
+## filter Configuration Block
+
+The `filter` configuration block supports the following arguments:
+
+* `name` - (Required) Name of the filter field. Valid values can be found in the [Image Builder ListDistributionConfigurations API Reference](https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_ListDistributionConfigurations.html).
+* `values` - (Required) Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arns` - Set of ARNs of the matched Image Builder Distribution Configurations.
+* `names` - Set of names of the matched Image Builder Distribution Configurations.
+
+<!-- cache-key: cdktf-0.18.0 input-fe0fb4ac2236aa97b321cc03ad0312343b5b0954825802e0f33e19eb3eabf16e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/imagebuilder_image.html.markdown b/website/docs/cdktf/python/d/imagebuilder_image.html.markdown
new file mode 100644
index 00000000000..55e25ad978f
--- /dev/null
+++ b/website/docs/cdktf/python/d/imagebuilder_image.html.markdown
@@ -0,0 +1,75 @@
+---
+subcategory: "EC2 Image Builder"
+layout: "aws"
+page_title: "AWS: aws_imagebuilder_image"
+description: |-
+    Provides details about an Image Builder Image
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_imagebuilder_image
+
+Provides details about an Image Builder Image.
+
+## Example Usage
+
+### Latest
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_imagebuilder_image import DataAwsImagebuilderImage
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsImagebuilderImage(self, "example",
+            arn="arn:aws:imagebuilder:us-west-2:aws:image/amazon-linux-2-x86/x.x.x"
+        )
+```
+
+## Argument Reference
+
+* `arn` - (Required) ARN of the image. The suffix can either be specified with wildcards (`x.x.x`) to fetch the latest build version or a full build version (e.g., `2020.11.26/1`) to fetch an exact version.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `build_version_arn` - Build version ARN of the image. This will always have the `#.#.#/#` suffix.
+* `container_recipe_arn` - ARN of the container recipe.
+* `date_created` - Date the image was created.
+* `distribution_configuration_arn` - ARN of the Image Builder Distribution Configuration.
+* `enhanced_image_metadata_enabled` - Whether additional information about the image being created is collected.
+* `image_recipe_arn` - ARN of the image recipe.
+* `image_scanning_configuration` - List of an object with image scanning configuration fields.
+    * `image_scanning_enabled` - Indicates whether Image Builder keeps a snapshot of the vulnerability scans that Amazon Inspector runs against the build instance when you create a new image.
+    * `ecr_configuration` - Configuration block with ECR configuration.
+        * `repository_name` - The name of the container repository that Amazon Inspector scans to identify findings for your container images.
+        * `container_tags` - Set of tags for Image Builder to apply to the output container image that that Amazon Inspector scans.
+* `image_tests_configuration` - List of an object with image tests configuration.
+    * `image_tests_enabled` - Whether image tests are enabled.
+    * `timeout_minutes` - Number of minutes before image tests time out.
+* `infrastructure_configuration_arn` - ARN of the Image Builder Infrastructure Configuration.
+* `name` - Name of the image.
+* `platform` - Platform of the image.
+* `os_version` - Operating System version of the image.
+* `output_resources` - List of objects with resources created by the image.
+    * `amis` - Set of objects with each Amazon Machine Image (AMI) created.
+        * `account_id` - Account identifier of the AMI.
+        * `description` - Description of the AMI.
+        * `image` - Identifier of the AMI.
+        * `name` - Name of the AMI.
+        * `region` - Region of the AMI.
+    * `containers` - Set of objects with each container image created and stored in the output repository.
+        * `image_uris` - Set of URIs for created containers.
+        * `region` - Region of the container image.
+* `tags` - Key-value map of resource tags for the image.
+* `version` - Version of the image.
+
+<!-- cache-key: cdktf-0.18.0 input-c16581cc1f73d4143d3834e3f16be4e4ace35e8a4c70a0907ae9057adf65efee -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/imagebuilder_image_pipeline.html.markdown b/website/docs/cdktf/python/d/imagebuilder_image_pipeline.html.markdown
new file mode 100644
index 00000000000..3e0cc07b9ea
--- /dev/null
+++ b/website/docs/cdktf/python/d/imagebuilder_image_pipeline.html.markdown
@@ -0,0 +1,68 @@
+---
+subcategory: "EC2 Image Builder"
+layout: "aws"
+page_title: "AWS: aws_imagebuilder_image_pipeline"
+description: |-
+    Provides details about an Image Builder Image Pipeline
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_imagebuilder_image_pipeline
+
+Provides details about an Image Builder Image Pipeline.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_imagebuilder_image_pipeline import DataAwsImagebuilderImagePipeline
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsImagebuilderImagePipeline(self, "example",
+            arn="arn:aws:imagebuilder:us-west-2:aws:image-pipeline/example"
+        )
+```
+
+## Argument Reference
+
+* `arn` - (Required) ARN of the image pipeline.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `container_recipe_arn` - ARN of the container recipe.
+* `date_created` - Date the image pipeline was created.
+* `date_last_run` - Date the image pipeline was last run.
+* `date_next_run` - Date the image pipeline will run next.
+* `date_updated` - Date the image pipeline was updated.
+* `description` - Description of the image pipeline.
+* `distribution_configuration_arn` - ARN of the Image Builder Distribution Configuration.
+* `enhanced_image_metadata_enabled` - Whether additional information about the image being created is collected.
+* `image_recipe_arn` - ARN of the image recipe.
+* `image_tests_configuration` - List of an object with image scanning configuration.
+    * `image_scanning_enabled`  - Whether image scanning is enabled.
+    * `ecr_configuration`  - List if an object with ecr configuration for image scanning
+        * `container_tags`  - Tags that are added to the output containers that are scanned
+        * `repository_name`  - The name of the container repository that Amazon Inspector scans
+* `image_tests_configuration` - List of an object with image tests configuration.
+    * `image_tests_enabled` - Whether image tests are enabled.
+    * `timeout_minutes` - Number of minutes before image tests time out.
+* `infrastructure_configuration_arn` - ARN of the Image Builder Infrastructure Configuration.
+* `name` - Name of the image pipeline.
+* `platform` - Platform of the image pipeline.
+* `schedule` - List of an object with schedule settings.
+    * `pipeline_execution_start_condition` - Condition when the pipeline should trigger a new image build.
+    * `schedule_expression` - Cron expression of how often the pipeline start condition is evaluated.
+* `status` - Status of the image pipeline.
+* `tags` - Key-value map of resource tags for the image pipeline.
+
+<!-- cache-key: cdktf-0.18.0 input-86d00bfacbf8211ac391b618aacd3783f3887b1dc59f3fa49b15ed84f7aa629d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/imagebuilder_image_pipelines.html.markdown b/website/docs/cdktf/python/d/imagebuilder_image_pipelines.html.markdown
new file mode 100644
index 00000000000..997c6ff81f9
--- /dev/null
+++ b/website/docs/cdktf/python/d/imagebuilder_image_pipelines.html.markdown
@@ -0,0 +1,56 @@
+---
+subcategory: "EC2 Image Builder"
+layout: "aws"
+page_title: "AWS: aws_imagebuilder_image_pipelines"
+description: |-
+    Get information on Image Builder Image Pipelines.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_imagebuilder_image_pipelines
+
+Use this data source to get the ARNs and names of Image Builder Image Pipelines matching the specified criteria.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_imagebuilder_image_pipelines import DataAwsImagebuilderImagePipelines
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsImagebuilderImagePipelines(self, "example",
+            filter=[DataAwsImagebuilderImagePipelinesFilter(
+                name="name",
+                values=["example"]
+            )
+            ]
+        )
+```
+
+## Argument Reference
+
+* `filter` - (Optional) Configuration block(s) for filtering. Detailed below.
+
+### filter Configuration Block
+
+The `filter` configuration block supports the following arguments:
+
+* `name` - (Required) Name of the filter field. Valid values can be found in the [Image Builder ListImagePipelines API Reference](https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_ListImagePipelines.html).
+* `values` - (Required) Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arns` - Set of ARNs of the matched Image Builder Image Pipelines.
+* `names` - Set of names of the matched Image Builder Image Pipelines.
+
+<!-- cache-key: cdktf-0.18.0 input-9aa1a817b341dd2fe9ffacd11d32c26b3c20e350b371b04907e37c56aa311d03 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/imagebuilder_image_recipe.html.markdown b/website/docs/cdktf/python/d/imagebuilder_image_recipe.html.markdown
new file mode 100644
index 00000000000..d05681cf9de
--- /dev/null
+++ b/website/docs/cdktf/python/d/imagebuilder_image_recipe.html.markdown
@@ -0,0 +1,73 @@
+---
+subcategory: "EC2 Image Builder"
+layout: "aws"
+page_title: "AWS: aws_imagebuilder_image_recipe"
+description: |-
+    Provides details about an Image Builder Image Recipe
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_imagebuilder_image_recipe
+
+Provides details about an Image Builder Image Recipe.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_imagebuilder_image_recipe import DataAwsImagebuilderImageRecipe
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsImagebuilderImageRecipe(self, "example",
+            arn="arn:aws:imagebuilder:us-east-1:aws:image-recipe/example/1.0.0"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `arn` - (Required) ARN of the image recipe.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `block_device_mapping` - Set of objects with block device mappings for the image recipe.
+    * `device_name` - Name of the device. For example, `/dev/sda` or `/dev/xvdb`.
+    * `ebs` - Single list of object with Elastic Block Storage (EBS) block device mapping settings.
+        * `delete_on_termination` - Whether to delete the volume on termination. Defaults to unset, which is the value inherited from the parent image.
+        * `encrypted` - Whether to encrypt the volume. Defaults to unset, which is the value inherited from the parent image.
+        * `iops` - Number of Input/Output (I/O) operations per second to provision for an `io1` or `io2` volume.
+        * `kms_key_id` - ARN of the Key Management Service (KMS) Key for encryption.
+        * `snapshot_id` - Identifier of the EC2 Volume Snapshot.
+        * `throughput` - For GP3 volumes only. The throughput in MiB/s that the volume supports.
+        * `volume_size` - Size of the volume, in GiB.
+        * `volume_type` - Type of the volume. For example, `gp2` or `io2`.
+    * `no_device` - Whether to remove a mapping from the parent image.
+    * `virtual_name` - Virtual device name. For example, `ephemeral0`. Instance store volumes are numbered starting from 0.
+* `component` - List of objects with components for the image recipe.
+    * `component_arn` - ARN of the Image Builder Component.
+    * `parameter` - Set of parameters that are used to configure the component.
+        * `name` - Name of the component parameter.
+        * `value` - Value of the component parameter.
+* `date_created` - Date the image recipe was created.
+* `description` - Description of the image recipe.
+* `name` - Name of the image recipe.
+* `owner` - Owner of the image recipe.
+* `parent_image` - Base image of the image recipe.
+* `platform` - Platform of the image recipe.
+* `tags` - Key-value map of resource tags for the image recipe.
+* `user_data_base64` - Base64 encoded contents of user data. Commands or a command script to run when build instance is launched.
+* `version` - Version of the image recipe.
+* `working_directory` - Working directory used during build and test workflows.
+
+<!-- cache-key: cdktf-0.18.0 input-03811fbdc954ff54a22086b82658d8b2b187a94c5c0090a064a40b03c615a004 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/imagebuilder_image_recipes.html.markdown b/website/docs/cdktf/python/d/imagebuilder_image_recipes.html.markdown
new file mode 100644
index 00000000000..ee94f30f56a
--- /dev/null
+++ b/website/docs/cdktf/python/d/imagebuilder_image_recipes.html.markdown
@@ -0,0 +1,58 @@
+---
+subcategory: "EC2 Image Builder"
+layout: "aws"
+page_title: "AWS: aws_imagebuilder_image_recipes"
+description: |-
+    Get information on Image Builder Image Recipes.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_imagebuilder_image_recipes
+
+Use this data source to get the ARNs and names of Image Builder Image Recipes matching the specified criteria.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_imagebuilder_image_recipes import DataAwsImagebuilderImageRecipes
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsImagebuilderImageRecipes(self, "example",
+            filter=[DataAwsImagebuilderImageRecipesFilter(
+                name="platform",
+                values=["Linux"]
+            )
+            ],
+            owner="Self"
+        )
+```
+
+## Argument Reference
+
+* `owner` - (Optional) Owner of the image recipes. Valid values are `Self`, `Shared` and `Amazon`. Defaults to `Self`.
+* `filter` - (Optional) Configuration block(s) for filtering. Detailed below.
+
+### filter Configuration Block
+
+The `filter` configuration block supports the following arguments:
+
+* `name` - (Required) Name of the filter field. Valid values can be found in the [Image Builder ListImageRecipes API Reference](https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_ListImageRecipes.html).
+* `values` - (Required) Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arns` - Set of ARNs of the matched Image Builder Image Recipes.
+* `names` - Set of names of the matched Image Builder Image Recipes.
+
+<!-- cache-key: cdktf-0.18.0 input-04bcd0a54deab227cba64be4a5e7a163ec84c3bcb003ab2dd8917c78ca18178b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/imagebuilder_infrastructure_configuration.html.markdown b/website/docs/cdktf/python/d/imagebuilder_infrastructure_configuration.html.markdown
new file mode 100644
index 00000000000..4218ee6218c
--- /dev/null
+++ b/website/docs/cdktf/python/d/imagebuilder_infrastructure_configuration.html.markdown
@@ -0,0 +1,65 @@
+---
+subcategory: "EC2 Image Builder"
+layout: "aws"
+page_title: "AWS: aws_imagebuilder_infrastructure_configuration"
+description: |-
+    Provides details about an Image Builder Infrastructure Configuration
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_imagebuilder_infrastructure_configuration
+
+Provides details about an Image Builder Infrastructure Configuration.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_imagebuilder_infrastructure_configuration import DataAwsImagebuilderInfrastructureConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsImagebuilderInfrastructureConfiguration(self, "example",
+            arn="arn:aws:imagebuilder:us-west-2:aws:infrastructure-configuration/example"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `arn` - (Required) ARN of the infrastructure configuration.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `date_created` - Date the infrastructure configuration was created.
+* `date_created` - Date the infrastructure configuration was updated.
+* `description` - Description of the infrastructure configuration.
+* `instance_metadata_options` - Nested list of instance metadata options for the HTTP requests that pipeline builds use to launch EC2 build and test instances.
+    * `http_put_response_hop_limit` - Number of hops that an instance can traverse to reach its destonation.
+    * `http_tokens` - Whether a signed token is required for instance metadata retrieval requests.
+* `instance_profile_name` - Name of the IAM Instance Profile associated with the configuration.
+* `instance_types` - Set of EC2 Instance Types associated with the configuration.
+* `key_pair` - Name of the EC2 Key Pair associated with the configuration.
+* `logging` - Nested list of logging settings.
+    * `s3_logs` - Nested list of S3 logs settings.
+        * `s3_bucket_name` - Name of the S3 Bucket for logging.
+        * `s3_key_prefix` - Key prefix for S3 Bucket logging.
+* `name` - Name of the infrastructure configuration.
+* `resource_tags` - Key-value map of resource tags for the infrastructure created by the infrastructure configuration.
+* `security_group_ids` - Set of EC2 Security Group identifiers associated with the configuration.
+* `sns_topic_arn` - ARN of the SNS Topic associated with the configuration.
+* `subnet_id` - Identifier of the EC2 Subnet associated with the configuration.
+* `tags` - Key-value map of resource tags for the infrastructure configuration.
+* `terminate_instance_on_failure` - Whether instances are terminated on failure.
+
+<!-- cache-key: cdktf-0.18.0 input-7380cb5d85c6d7849e3a07a0e4591a1b51c24389729b623e1b3ca40a6eea581e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/imagebuilder_infrastructure_configurations.html.markdown b/website/docs/cdktf/python/d/imagebuilder_infrastructure_configurations.html.markdown
new file mode 100644
index 00000000000..bdbe8387d5a
--- /dev/null
+++ b/website/docs/cdktf/python/d/imagebuilder_infrastructure_configurations.html.markdown
@@ -0,0 +1,56 @@
+---
+subcategory: "EC2 Image Builder"
+layout: "aws"
+page_title: "AWS: aws_imagebuilder_infrastructure_configurations"
+description: |-
+    Get information on Image Builder Infrastructure Configurations.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_imagebuilder_infrastructure_configurations
+
+Use this data source to get the ARNs and names of Image Builder Infrastructure Configurations matching the specified criteria.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_imagebuilder_infrastructure_configurations import DataAwsImagebuilderInfrastructureConfigurations
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsImagebuilderInfrastructureConfigurations(self, "example",
+            filter=[DataAwsImagebuilderInfrastructureConfigurationsFilter(
+                name="name",
+                values=["example"]
+            )
+            ]
+        )
+```
+
+## Argument Reference
+
+* `filter` - (Optional) Configuration block(s) for filtering. Detailed below.
+
+## filter Configuration Block
+
+The `filter` configuration block supports the following arguments:
+
+* `name` - (Required) Name of the filter field. Valid values can be found in the [Image Builder ListInfrastructureConfigurations API Reference](https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_ListInfrastructureConfigurations.html).
+* `values` - (Required) Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arns` - Set of ARNs of the matched Image Builder Infrastructure Configurations.
+* `names` - Set of names of the matched Image Builder Infrastructure Configurations.
+
+<!-- cache-key: cdktf-0.18.0 input-83d3086f6077a26f6422506516e6b719a5fbe82fb8b50beb21985166498185d9 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/inspector_rules_packages.html.markdown b/website/docs/cdktf/python/d/inspector_rules_packages.html.markdown
new file mode 100644
index 00000000000..066b13b2d9d
--- /dev/null
+++ b/website/docs/cdktf/python/d/inspector_rules_packages.html.markdown
@@ -0,0 +1,62 @@
+---
+subcategory: "Inspector Classic"
+layout: "aws"
+page_title: "AWS: aws_inspector_rules_packages"
+description: |-
+    Provides a list of Amazon Inspector Classic Rules packages which can be used by Amazon Inspector Classic.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_inspector_rules_packages
+
+The Amazon Inspector Classic Rules Packages data source allows access to the list of AWS
+Inspector Rules Packages which can be used by Amazon Inspector Classic within the region
+configured in the provider.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_inspector_rules_packages import DataAwsInspectorRulesPackages
+from imports.aws.inspector_assessment_target import InspectorAssessmentTarget
+from imports.aws.inspector_assessment_template import InspectorAssessmentTemplate
+from imports.aws.inspector_resource_group import InspectorResourceGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        group = InspectorResourceGroup(self, "group",
+            tags={
+                "test": "test"
+            }
+        )
+        rules = DataAwsInspectorRulesPackages(self, "rules")
+        assessment = InspectorAssessmentTarget(self, "assessment",
+            name="test",
+            resource_group_arn=group.arn
+        )
+        aws_inspector_assessment_template_assessment =
+        InspectorAssessmentTemplate(self, "assessment_3",
+            duration=Token.as_number("60"),
+            name="Test",
+            rules_package_arns=Token.as_list(rules.arns),
+            target_arn=assessment.arn
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_inspector_assessment_template_assessment.override_logical_id("assessment")
+```
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - AWS Region.
+* `arns` - List of the Amazon Inspector Classic Rules Packages arns available in the AWS region.
+
+<!-- cache-key: cdktf-0.18.0 input-b55f49ddc9bd6ffd45988906833e0338e052589bc49023e7487f89772927ed30 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/instance.html.markdown b/website/docs/cdktf/python/d/instance.html.markdown
new file mode 100644
index 00000000000..829c63ce58a
--- /dev/null
+++ b/website/docs/cdktf/python/d/instance.html.markdown
@@ -0,0 +1,151 @@
+---
+subcategory: "EC2 (Elastic Compute Cloud)"
+layout: "aws"
+page_title: "AWS: aws_instance"
+description: |-
+  Get information on an Amazon EC2 Instance.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_instance
+
+Use this data source to get the ID of an Amazon EC2 Instance for use in other resources.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_instance import DataAwsInstance
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsInstance(self, "foo",
+            filter=[DataAwsInstanceFilter(
+                name="image-id",
+                values=["ami-xxxxxxxx"]
+            ), DataAwsInstanceFilter(
+                name="tag:Name",
+                values=["instance-name-tag"]
+            )
+            ],
+            instance_id="i-instanceid"
+        )
+```
+
+## Argument Reference
+
+* `instance_id` - (Optional) Specify the exact Instance ID with which to populate the data source.
+
+* `instance_tags` - (Optional) Map of tags, each pair of which must
+exactly match a pair on the desired Instance.
+
+* `filter` - (Optional) One or more name/value pairs to use as filters. There are
+several valid keys, for a full reference, check out
+[describe-instances in the AWS CLI reference][1].
+
+* `get_password_data` - (Optional) If true, wait for password data to become available and retrieve it. Useful for getting the administrator password for instances running Microsoft Windows. The password data is exported to the `password_data` attribute. See [GetPasswordData](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_GetPasswordData.html) for more information.
+
+* `get_user_data` - (Optional) Retrieve Base64 encoded User Data contents into the `user_data_base64` attribute. A SHA-1 hash of the User Data contents will always be present in the `user_data` attribute. Defaults to `false`.
+
+~> **NOTE:** At least one of `filter`, `instance_tags`, or `instance_id` must be specified.
+
+~> **NOTE:** If anything other than a single match is returned by the search,
+Terraform will fail. Ensure that your search is specific enough to return
+a single Instance ID only.
+
+## Attribute Reference
+
+`id` is set to the ID of the found Instance. In addition, the following attributes
+are exported:
+
+~> **NOTE:** Some values are not always set and may not be available for
+interpolation.
+
+* `ami` - ID of the AMI used to launch the instance.
+* `arn` - ARN of the instance.
+* `associate_public_ip_address` - Whether or not the Instance is associated with a public IP address or not (Boolean).
+* `availability_zone` - Availability zone of the Instance.
+* `credit_specification` - Credit specification of the Instance.
+* `disable_api_stop` - Whether or not EC2 Instance Stop Protection](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Stop_Start.html#Using_StopProtection) is enabled (Boolean).
+* `disable_api_termination` - Whether or not [EC2 Instance Termination Protection](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/terminating-instances.html#Using_ChangingDisableAPITermination) is enabled (Boolean).
+* `ebs_block_device` - EBS block device mappings of the Instance.
+    * `delete_on_termination` - If the EBS volume will be deleted on termination.
+    * `device_name` - Physical name of the device.
+    * `encrypted` - If the EBS volume is encrypted.
+    * `iops` - `0` If the EBS volume is not a provisioned IOPS image, otherwise the supported IOPS count.
+    * `kms_key_arn` - ARN of KMS Key, if EBS volume is encrypted.
+    * `snapshot_id` - ID of the snapshot.
+    * `throughput` - Throughput of the volume, in MiB/s.
+    * `volume_size` - Size of the volume, in GiB.
+    * `volume_type` - Volume type.
+* `ebs_optimized` - Whether the Instance is EBS optimized or not (Boolean).
+* `enclave_options` - Enclave options of the instance.
+    * `enabled` - Whether Nitro Enclaves are enabled.
+* `ephemeral_block_device` - Ephemeral block device mappings of the Instance.
+    * `device_name` - Physical name of the device.
+    * `no_device` - Whether the specified device included in the device mapping was suppressed or not (Boolean).
+    * `virtual_name` - Virtual device name.
+* `host_id` - ID of the dedicated host the instance will be assigned to.
+* `host_resource_group_arn` - ARN of the host resource group the instance is associated with.
+* `iam_instance_profile` - Name of the instance profile associated with the Instance.
+* `instance_state` - State of the instance. One of: `pending`, `running`, `shutting-down`, `terminated`, `stopping`, `stopped`. See [Instance Lifecycle](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-lifecycle.html) for more information.
+* `instance_type` - Type of the Instance.
+* `ipv6_addresses` - IPv6 addresses associated to the Instance, if applicable. **NOTE**: Unlike the IPv4 address, this doesn't change if you attach an EIP to the instance.
+* `key_name` - Key name of the Instance.
+* `maintenance_options` - Maintenance and recovery options for the instance.
+    * `auto_recovery` - Automatic recovery behavior of the instance.
+* `metadata_options` - Metadata options of the Instance.
+    * `http_endpoint` - State of the metadata service: `enabled`, `disabled`.
+    * `http_protocol_ipv6` - Whether the IPv6 endpoint for the instance metadata service is `enabled` or `disabled`
+    * `http_tokens` - If session tokens are required: `optional`, `required`.
+    * `http_put_response_hop_limit` - Desired HTTP PUT response hop limit for instance metadata requests.
+    * `instance_metadata_tags` - If access to instance tags is allowed from the metadata service: `enabled`, `disabled`.
+* `monitoring` - Whether detailed monitoring is enabled or disabled for the Instance (Boolean).
+* `network_interface_id` - ID of the network interface that was created with the Instance.
+* `outpost_arn` - ARN of the Outpost.
+* `password_data` - Base-64 encoded encrypted password data for the instance. Useful for getting the administrator password for instances running Microsoft Windows. This attribute is only exported if `get_password_data` is true. See [GetPasswordData](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_GetPasswordData.html) for more information.
+* `placement_group` - Placement group of the Instance.
+* `placement_partition_number` - Number of the partition the instance is in.
+* `private_dns` - Private DNS name assigned to the Instance. Can only be used inside the Amazon EC2, and only available if you've enabled DNS hostnames for your VPC.
+* `private_dns_name_options` - Options for the instance hostname.
+    * `enable_resource_name_dns_aaaa_record` - Indicates whether to respond to DNS queries for instance hostnames with DNS AAAA records.
+    * `enable_resource_name_dns_a_record` - Indicates whether to respond to DNS queries for instance hostnames with DNS A records.
+    * `hostname_type` - Type of hostname for EC2 instances.
+* `private_ip` - Private IP address assigned to the Instance.
+* `public_dns` - Public DNS name assigned to the Instance. For EC2-VPC, this is only available if you've enabled DNS hostnames for your VPC.
+* `public_ip` - Public IP address assigned to the Instance, if applicable. **NOTE**: If you are using an [`aws_eip`](/docs/providers/aws/r/eip.html) with your instance, you should refer to the EIP's address directly and not use `public_ip`, as this field will change after the EIP is attached.
+* `root_block_device` - Root block device mappings of the Instance
+    * `device_name` - Physical name of the device.
+    * `delete_on_termination` - If the root block device will be deleted on termination.
+    * `encrypted` - If the EBS volume is encrypted.
+    * `iops` - `0` If the volume is not a provisioned IOPS image, otherwise the supported IOPS count.
+    * `kms_key_arn` - ARN of KMS Key, if EBS volume is encrypted.
+    * `throughput` - Throughput of the volume, in MiB/s.
+    * `volume_size` - Size of the volume, in GiB.
+    * `volume_type` - Type of the volume.
+* `secondary_private_ips` - Secondary private IPv4 addresses assigned to the instance's primary network interface (eth0) in a VPC.
+* `security_groups` - Associated security groups.
+* `source_dest_check` - Whether the network interface performs source/destination checking (Boolean).
+* `subnet_id` - VPC subnet ID.
+* `tags` - Map of tags assigned to the Instance.
+* `tenancy` - Tenancy of the instance: `dedicated`, `default`, `host`.
+* `user_data` - SHA-1 hash of User Data supplied to the Instance.
+* `user_data_base64` - Base64 encoded contents of User Data supplied to the Instance. Valid UTF-8 contents can be decoded with the [`base64decode` function](https://www.terraform.io/docs/configuration/functions/base64decode.html). This attribute is only exported if `get_user_data` is true.
+* `vpc_security_group_ids` - Associated security groups in a non-default VPC.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `20m`)
+
+[1]: http://docs.aws.amazon.com/cli/latest/reference/ec2/describe-instances.html
+
+<!-- cache-key: cdktf-0.18.0 input-58a6dcf6b973aceef047b6a5f4da20044aa0391cf4a6935de6e8bdc7dc78ba4c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/instances.html.markdown b/website/docs/cdktf/python/d/instances.html.markdown
new file mode 100644
index 00000000000..7380e68f17e
--- /dev/null
+++ b/website/docs/cdktf/python/d/instances.html.markdown
@@ -0,0 +1,94 @@
+---
+subcategory: "EC2 (Elastic Compute Cloud)"
+layout: "aws"
+page_title: "AWS: aws_instances"
+description: |-
+  Get information on an Amazon EC2 instances.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_instances
+
+Use this data source to get IDs or IPs of Amazon EC2 instances to be referenced elsewhere,
+e.g., to allow easier migration from another management solution
+or to make it easier for an operator to connect through bastion host(s).
+
+-> **Note:** It's a best practice to expose instance details via [outputs](https://www.terraform.io/docs/configuration/outputs.html)
+and [remote state](https://www.terraform.io/docs/state/remote.html) and
+**use [`terraform_remote_state`](https://www.terraform.io/docs/providers/terraform/d/remote_state.html)
+data source instead** if you manage referenced instances via Terraform.
+
+~> **Note:** It's strongly discouraged to use this data source for querying ephemeral
+instances (e.g., managed via autoscaling group), as the output may change at any time
+and you'd need to re-run `apply` every time an instance comes up or dies.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformCount, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_instances import DataAwsInstances
+from imports.aws.eip import Eip
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        test = DataAwsInstances(self, "test",
+            filter=[DataAwsInstancesFilter(
+                name="instance.group-id",
+                values=["sg-12345678"]
+            )
+            ],
+            instance_state_names=["running", "stopped"],
+            instance_tags={
+                "Role": "HardWorker"
+            }
+        )
+        # In most cases loops should be handled in the programming language context and
+        #     not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+        #     you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+        #     you need to keep this like it is.
+        test_count = TerraformCount.of(Token.as_number(Fn.length_of(test.ids)))
+        aws_eip_test = Eip(self, "test_1",
+            instance=Token.as_string(Fn.lookup_nested(test.ids, [test_count.index])),
+            count=test_count
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_eip_test.override_logical_id("test")
+```
+
+## Argument Reference
+
+* `instance_tags` - (Optional) Map of tags, each pair of which must
+exactly match a pair on desired instances.
+
+* `instance_state_names` - (Optional) List of instance states that should be applicable to the desired instances. The permitted values are: `pending, running, shutting-down, stopped, stopping, terminated`. The default value is `running`.
+
+* `filter` - (Optional) One or more name/value pairs to use as filters. There are
+several valid keys, for a full reference, check out
+[describe-instances in the AWS CLI reference][1].
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - AWS Region.
+* `ids` - IDs of instances found through the filter
+* `private_ips` - Private IP addresses of instances found through the filter
+* `public_ips` - Public IP addresses of instances found through the filter
+* `ipv6_addresses` - IPv6 addresses of instances found through the filter
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `20m`)
+
+[1]: http://docs.aws.amazon.com/cli/latest/reference/ec2/describe-instances.html
+
+<!-- cache-key: cdktf-0.18.0 input-b32a570916ee4ab91b69b22089fb9eae9d1e369af64f851ec6954b99768d43fd -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/internet_gateway.html.markdown b/website/docs/cdktf/python/d/internet_gateway.html.markdown
new file mode 100644
index 00000000000..c9530c086f2
--- /dev/null
+++ b/website/docs/cdktf/python/d/internet_gateway.html.markdown
@@ -0,0 +1,87 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_internet_gateway"
+description: |-
+    Provides details about a specific Internet Gateway
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_internet_gateway
+
+`aws_internet_gateway` provides details about a specific Internet Gateway.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformVariable, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_internet_gateway import DataAwsInternetGateway
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        # Terraform Variables are not always the best fit for getting inputs in the context of Terraform CDK.
+        #     You can read more about this at https://cdk.tf/variables
+        vpc_id = TerraformVariable(self, "vpc_id")
+        DataAwsInternetGateway(self, "default",
+            filter=[DataAwsInternetGatewayFilter(
+                name="attachment.vpc-id",
+                values=[vpc_id.string_value]
+            )
+            ]
+        )
+```
+
+## Argument Reference
+
+The arguments of this data source act as filters for querying the available
+Internet Gateway in the current region. The given filters must match exactly one
+Internet Gateway whose data will be exported as attributes.
+
+* `internet_gateway_id` - (Optional) ID of the specific Internet Gateway to retrieve.
+
+* `tags` - (Optional) Map of tags, each pair of which must exactly match
+  a pair on the desired Internet Gateway.
+
+* `filter` - (Optional) Custom filter block as described below.
+
+More complex filters can be expressed using one or more `filter` sub-blocks,
+which take the following arguments:
+
+* `name` - (Required) Name of the field to filter by, as defined by
+  [the underlying AWS API](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeInternetGateways.html).
+
+* `values` - (Required) Set of values that are accepted for the given field.
+  An Internet Gateway will be selected if any one of the given values matches.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Internet Gateway.
+
+All of the argument attributes except `filter` block are also exported as
+result attributes. This data source will complete the data by populating
+any fields that are not included in the configuration with the data for
+the selected Internet Gateway.
+
+`attachments` are also exported with the following attributes, when there are relevants:
+Each attachment supports the following:
+
+* `owner_id` - ID of the AWS account that owns the internet gateway.
+* `state` - Current state of the attachment between the gateway and the VPC. Present only if a VPC is attached
+* `vpc_id` - ID of an attached VPC.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `20m`)
+
+<!-- cache-key: cdktf-0.18.0 input-96bb0aae58e9cc1f5627406db250b52752c3ca32ef3d0817dccae2e569d8a45c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/iot_endpoint.html.markdown b/website/docs/cdktf/python/d/iot_endpoint.html.markdown
new file mode 100644
index 00000000000..b3d4b27d9df
--- /dev/null
+++ b/website/docs/cdktf/python/d/iot_endpoint.html.markdown
@@ -0,0 +1,69 @@
+---
+subcategory: "IoT Core"
+layout: "aws"
+page_title: "AWS: aws_iot_endpoint"
+description: |-
+  Get the unique IoT endpoint
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_iot_endpoint
+
+Returns a unique endpoint specific to the AWS account making the call.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iot_endpoint import DataAwsIotEndpoint
+from imports.kubernetes.pod import Pod
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        # The following providers are missing schema information and might need manual adjustments to synthesize correctly: kubernetes.
+        #     For a more precise conversion please use the --provider flag in convert.
+        example = DataAwsIotEndpoint(self, "example")
+        Pod(self, "agent",
+            metadata=[{
+                "name": "my-device"
+            }
+            ],
+            spec=[{
+                "container": [{
+                    "env": [{
+                        "name": "IOT_ENDPOINT",
+                        "value": example.endpoint_address
+                    }
+                    ],
+                    "image": "gcr.io/my-project/image-name",
+                    "name": "image-name"
+                }
+                ]
+            }
+            ]
+        )
+```
+
+## Argument Reference
+
+* `endpoint_type` - (Optional) Endpoint type. Valid values: `iot:CredentialProvider`, `iot:Data`, `iot:Data-ATS`, `iot:Jobs`.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `endpoint_address` - Endpoint based on `endpoint_type`:
+    * No `endpoint_type`: Either `iot:Data` or `iot:Data-ATS` [depending on region](https://aws.amazon.com/blogs/iot/aws-iot-core-ats-endpoints/)
+    * `iot:CredentialsProvider`: `IDENTIFIER.credentials.iot.REGION.amazonaws.com`
+    * `iot:Data`: `IDENTIFIER.iot.REGION.amazonaws.com`
+    * `iot:Data-ATS`: `IDENTIFIER-ats.iot.REGION.amazonaws.com`
+    * `iot:Jobs`: `IDENTIFIER.jobs.iot.REGION.amazonaws.com`
+
+<!-- cache-key: cdktf-0.18.0 input-56c8383801b044a75be3c89aa515472690d24408a38b21081a32c8735b9a3414 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/ip_ranges.html.markdown b/website/docs/cdktf/python/d/ip_ranges.html.markdown
new file mode 100644
index 00000000000..4c0926c46e8
--- /dev/null
+++ b/website/docs/cdktf/python/d/ip_ranges.html.markdown
@@ -0,0 +1,81 @@
+---
+subcategory: "Meta Data Sources"
+layout: "aws"
+page_title: "AWS: aws_ip_ranges"
+description: |-
+  Get information on AWS IP ranges.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_ip_ranges
+
+Use this data source to get the IP ranges of various AWS products and services. For more information about the contents of this data source and required JSON syntax if referencing a custom URL, see the [AWS IP Address Ranges documentation][1].
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_ip_ranges import DataAwsIpRanges
+from imports.aws.security_group import SecurityGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        european_ec2 = DataAwsIpRanges(self, "european_ec2",
+            regions=["eu-west-1", "eu-central-1"],
+            services=["ec2"]
+        )
+        SecurityGroup(self, "from_europe",
+            ingress=[SecurityGroupIngress(
+                cidr_blocks=Token.as_list(european_ec2.cidr_blocks),
+                from_port=Token.as_number("443"),
+                ipv6_cidr_blocks=Token.as_list(european_ec2.ipv6_cidr_blocks),
+                protocol="tcp",
+                to_port=Token.as_number("443")
+            )
+            ],
+            name="from_europe",
+            tags={
+                "CreateDate": Token.as_string(european_ec2.create_date),
+                "SyncToken": Token.as_string(european_ec2.sync_token)
+            }
+        )
+```
+
+## Argument Reference
+
+* `regions` - (Optional) Filter IP ranges by regions (or include all regions, if
+omitted). Valid items are `global` (for `cloudfront`) as well as all AWS regions
+(e.g., `eu-central-1`)
+
+* `services` - (Required) Filter IP ranges by services. Valid items are `amazon`
+(for amazon.com), `amazon_connect`, `api_gateway`, `cloud9`, `cloudfront`,
+`codebuild`, `dynamodb`, `ec2`, `ec2_instance_connect`, `globalaccelerator`,
+`route53`, `route53_healthchecks`, `s3` and `workspaces_gateways`. See the
+[`service` attribute][2] documentation for other possible values.
+
+~> **NOTE:** If the specified combination of regions and services does not yield any
+CIDR blocks, Terraform will fail.
+
+* `url` - (Optional) Custom URL for source JSON file. Syntax must match [AWS IP Address Ranges documentation][1]. Defaults to `https://ip-ranges.amazonaws.com/ip-ranges.json`.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `cidr_blocks` - Lexically ordered list of CIDR blocks.
+* `ipv6_cidr_blocks` - Lexically ordered list of IPv6 CIDR blocks.
+* `create_date` - Publication time of the IP ranges (e.g., `2016-08-03-23-46-05`).
+* `sync_token` - Publication time of the IP ranges, in Unix epoch time format
+  (e.g., `1470267965`).
+
+[1]: https://docs.aws.amazon.com/general/latest/gr/aws-ip-ranges.html
+[2]: https://docs.aws.amazon.com/general/latest/gr/aws-ip-ranges.html#aws-ip-syntax
+
+<!-- cache-key: cdktf-0.18.0 input-73d6997abbb59dd921b8bcd692995e1403416e2fa26a744feb3a7bbef5d83b63 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/ivs_stream_key.html.markdown b/website/docs/cdktf/python/d/ivs_stream_key.html.markdown
new file mode 100644
index 00000000000..4fde2d252bd
--- /dev/null
+++ b/website/docs/cdktf/python/d/ivs_stream_key.html.markdown
@@ -0,0 +1,50 @@
+---
+subcategory: "IVS (Interactive Video)"
+layout: "aws"
+page_title: "AWS: aws_ivs_stream_key"
+description: |-
+  Terraform data source for managing an AWS IVS (Interactive Video) Stream Key.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_ivs_stream_key
+
+Terraform data source for managing an AWS IVS (Interactive Video) Stream Key.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_ivs_stream_key import DataAwsIvsStreamKey
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsIvsStreamKey(self, "example",
+            channel_arn="arn:aws:ivs:us-west-2:326937407773:channel/0Y1lcs4U7jk5"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `channel_arn` - (Required) ARN of the Channel.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Stream Key.
+* `tags` - Map of tags assigned to the resource.
+* `value` - Stream Key value.
+
+<!-- cache-key: cdktf-0.18.0 input-07ea21d8ae54ff1a061e2ce5f7053d91f4807ee4e6b32e670b8c70e8582e5c98 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/kendra_experience.html.markdown b/website/docs/cdktf/python/d/kendra_experience.html.markdown
new file mode 100644
index 00000000000..1905ef635eb
--- /dev/null
+++ b/website/docs/cdktf/python/d/kendra_experience.html.markdown
@@ -0,0 +1,78 @@
+---
+subcategory: "Kendra"
+layout: "aws"
+page_title: "AWS: aws_kendra_experience"
+description: |-
+  Provides details about a specific Amazon Kendra Experience.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_kendra_experience
+
+Provides details about a specific Amazon Kendra Experience.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_kendra_experience import DataAwsKendraExperience
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsKendraExperience(self, "example",
+            experience_id="87654321-1234-4321-4321-321987654321",
+            index_id="12345678-1234-1234-1234-123456789123"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `experience_id` - (Required) Identifier of the Experience.
+* `index_id` - (Required) Identifier of the index that contains the Experience.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Experience.
+* `configuration` - Block that specifies the configuration information for your Amazon Kendra Experience. This includes `content_source_configuration`, which specifies the data source IDs and/or FAQ IDs, and `user_identity_configuration`, which specifies the user or group information to grant access to your Amazon Kendra Experience. Documented below.
+* `created_at` - Unix datetime that the Experience was created.
+* `description` - Description of the Experience.
+* `endpoints` - Shows the endpoint URLs for your Amazon Kendra Experiences. The URLs are unique and fully hosted by AWS. Documented below.
+* `error_message` - Reason your Amazon Kendra Experience could not properly process.
+* `id` - Unique identifiers of the Experience and index separated by a slash (`/`).
+* `name` - Name of the Experience.
+* `role_arn` - Shows the ARN of a role with permission to access `Query` API, `QuerySuggestions` API, `SubmitFeedback` API, and AWS SSO that stores your user and group information.
+* `status` - Current processing status of your Amazon Kendra Experience. When the status is `ACTIVE`, your Amazon Kendra Experience is ready to use. When the status is `FAILED`, the `error_message` field contains the reason that this failed.
+* `updated_at` - Date and time that the Experience was last updated.
+
+The `configuration` block supports the following attributes:
+
+* `content_source_configuration` - The identifiers of your data sources and FAQs. This is the content you want to use for your Amazon Kendra Experience. Documented below.
+* `user_identity_configuration` - The AWS SSO field name that contains the identifiers of your users, such as their emails. Documented below.
+
+The `content_source_configuration` block supports the following attributes:
+
+* `data_source_ids` - Identifiers of the data sources you want to use for your Amazon Kendra Experience.
+* `direct_put_content` - Whether to use documents you indexed directly using the `BatchPutDocument API`.
+* `faq_ids` - Identifier of the FAQs that you want to use for your Amazon Kendra Experience.
+
+The `user_identity_configuration` block supports the following attributes:
+
+* `identity_attribute_name` - The AWS SSO field name that contains the identifiers of your users, such as their emails.
+
+The `endpoints` block supports the following attributes:
+
+* `endpoint` - Endpoint of your Amazon Kendra Experience.
+* `endpoint_type` - Type of endpoint for your Amazon Kendra Experience.
+
+<!-- cache-key: cdktf-0.18.0 input-f5305d893052c413022095c12ac4f6b75a23e499dbe8ec02edd79a5c7abd6c01 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/kendra_faq.html.markdown b/website/docs/cdktf/python/d/kendra_faq.html.markdown
new file mode 100644
index 00000000000..21c68191f50
--- /dev/null
+++ b/website/docs/cdktf/python/d/kendra_faq.html.markdown
@@ -0,0 +1,65 @@
+---
+subcategory: "Kendra"
+layout: "aws"
+page_title: "AWS: aws_kendra_faq"
+description: |-
+  Provides details about a specific Amazon Kendra Faq.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_kendra_faq
+
+Provides details about a specific Amazon Kendra Faq.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_kendra_faq import DataAwsKendraFaq
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsKendraFaq(self, "test",
+            faq_id="87654321-1234-4321-4321-321987654321",
+            index_id="12345678-1234-1234-1234-123456789123"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `faq_id` - (Required) Identifier of the FAQ.
+* `index_id` - (Required) Identifier of the index that contains the FAQ.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the FAQ.
+* `created_at` - Unix datetime that the faq was created.
+* `description` - Description of the FAQ.
+* `error_message` - When the `status` field value is `FAILED`, this contains a message that explains why.
+* `file_format` - File format used by the input files for the FAQ. Valid Values are `CSV`, `CSV_WITH_HEADER`, `JSON`.
+* `id` - Unique identifiers of the FAQ and index separated by a slash (`/`).
+* `language_code` - Code for a language. This shows a supported language for the FAQ document. For more information on supported languages, including their codes, see [Adding documents in languages other than English](https://docs.aws.amazon.com/kendra/latest/dg/in-adding-languages.html).
+* `name` - Name of the FAQ.
+* `role_arn` - ARN of a role with permission to access the S3 bucket that contains the FAQs. For more information, see [IAM Roles for Amazon Kendra](https://docs.aws.amazon.com/kendra/latest/dg/iam-roles.html).
+* `s3_path` - S3 location of the FAQ input data. Detailed below.
+* `status` - Status of the FAQ. It is ready to use when the status is ACTIVE.
+* `updated_at` - Date and time that the FAQ was last updated.
+* `tags` - Metadata that helps organize the FAQs you create.
+
+The `s3_path` configuration block supports the following attributes:
+
+* `bucket` - Name of the S3 bucket that contains the file.
+* `key` - Name of the file.
+
+<!-- cache-key: cdktf-0.18.0 input-e521c2de099004f9800122d251b7adbf8d33a85b59c414cf1d1afcea0967b75a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/kendra_index.html.markdown b/website/docs/cdktf/python/d/kendra_index.html.markdown
new file mode 100644
index 00000000000..31b2a9d2b62
--- /dev/null
+++ b/website/docs/cdktf/python/d/kendra_index.html.markdown
@@ -0,0 +1,132 @@
+---
+subcategory: "Kendra"
+layout: "aws"
+page_title: "AWS: aws_kendra_index"
+description: |-
+  Provides details about a specific Amazon Kendra Index.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_kendra_index
+
+Provides details about a specific Amazon Kendra Index.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_kendra_index import DataAwsKendraIndex
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsKendraIndex(self, "example",
+            id="12345678-1234-1234-1234-123456789123"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `id` - (Required) Returns information on a specific Index by id.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Index.
+* `capacity_units` - Block that sets the number of additional document storage and query capacity units that should be used by the index. Documented below.
+* `created_at` - Unix datetime that the index was created.
+* `description` - Description of the Index.
+* `document_metadata_configuration_updates` - One or more blocks that specify the configuration settings for any metadata applied to the documents in the index. Documented below.
+* `edition` - Amazon Kendra edition for the index.
+* `error_message` - When the Status field value is `FAILED`, this contains a message that explains why.
+* `id` - Identifier of the Index.
+* `index_statistics` - Block that provides information about the number of FAQ questions and answers and the number of text documents indexed. Documented below.
+* `name` - Name of the Index.
+* `role_arn` - An AWS Identity and Access Management (IAM) role that gives Amazon Kendra permissions to access your Amazon CloudWatch logs and metrics. This is also the role you use when you call the `BatchPutDocument` API to index documents from an Amazon S3 bucket.
+* `server_side_encryption_configuration` - A block that specifies the identifier of the AWS KMS customer managed key (CMK) that's used to encrypt data indexed by Amazon Kendra. Amazon Kendra doesn't support asymmetric CMKs. Documented below.
+* `status` - Current status of the index. When the value is `ACTIVE`, the index is ready for use. If the Status field value is `FAILED`, the `error_message` field contains a message that explains why.
+* `updated_at` - Unix datetime that the index was last updated.
+* `user_context_policy` - User context policy. Valid values are `ATTRIBUTE_FILTER` or `USER_TOKEN`. For more information, refer to [UserContextPolicy](https://docs.aws.amazon.com/kendra/latest/APIReference/API_CreateIndex.html#kendra-CreateIndex-request-UserContextPolicy).
+* `user_group_resolution_configuration` - A block that enables fetching access levels of groups and users from an AWS Single Sign-On identity source. Documented below.
+* `user_token_configurations` - A block that specifies the user token configuration. Documented below.
+* `tags` - Metadata that helps organize the Indices you create.
+
+A `capacity_units` block supports the following attributes:
+
+* `query_capacity_units` - The amount of extra query capacity for an index and GetQuerySuggestions capacity. For more information, refer to [QueryCapacityUnits](https://docs.aws.amazon.com/kendra/latest/APIReference/API_CapacityUnitsConfiguration.html#Kendra-Type-CapacityUnitsConfiguration-QueryCapacityUnits).
+* `storage_capacity_units` - The amount of extra storage capacity for an index. A single capacity unit provides 30 GB of storage space or 100,000 documents, whichever is reached first. Minimum value of 0.
+
+A `document_metadata_configuration_updates` block supports the following attributes:
+
+* `name` - Name of the index field. Minimum length of 1. Maximum length of 30.
+* `relevance` - Block that provides manual tuning parameters to determine how the field affects the search results. Documented below.
+* `search` - Block that provides information about how the field is used during a search. Documented below.
+* `type` - Data type of the index field. Valid values are `STRING_VALUE`, `STRING_LIST_VALUE`, `LONG_VALUE`, `DATE_VALUE`.
+
+A `relevance` block supports the following attributes:
+
+* `duration` - Time period that the boost applies to. For more information, refer to [Duration](https://docs.aws.amazon.com/kendra/latest/APIReference/API_Relevance.html#Kendra-Type-Relevance-Duration).
+* `freshness` - How "fresh" a document is. For more information, refer to [Freshness](https://docs.aws.amazon.com/kendra/latest/APIReference/API_Relevance.html#Kendra-Type-Relevance-Freshness).
+* `importance` - Relative importance of the field in the search. Larger numbers provide more of a boost than smaller numbers. Minimum value of 1. Maximum value of 10.
+* `rank_order` - Determines how values should be interpreted. For more information, refer to [RankOrder](https://docs.aws.amazon.com/kendra/latest/APIReference/API_Relevance.html#Kendra-Type-Relevance-RankOrder).
+* `values_importance_map` - A list of values that should be given a different boost when they appear in the result list. For more information, refer to [ValueImportanceMap](https://docs.aws.amazon.com/kendra/latest/APIReference/API_Relevance.html#Kendra-Type-Relevance-ValueImportanceMap).
+
+A `search` block supports the following attributes:
+
+* `displayable` - Determines whether the field is returned in the query response. The default is `true`.
+* `facetable` - Whether the field can be used to create search facets, a count of results for each value in the field. The default is `false`.
+* `searchable` - Determines whether the field is used in the search. If the Searchable field is true, you can use relevance tuning to manually tune how Amazon Kendra weights the field in the search. The default is `true` for `string` fields and `false` for `number` and `date` fields.
+* `sortable` - Determines whether the field can be used to sort the results of a query. If you specify sorting on a field that does not have Sortable set to true, Amazon Kendra returns an exception. The default is `false`.
+
+A `index_statistics` block supports the following attributes:
+
+* `faq_statistics` - Block that specifies the number of question and answer topics in the index. Documented below.
+* `text_document_statistics` - A block that specifies the number of text documents indexed.
+
+A `faq_statistics` block supports the following attributes:
+
+* `indexed_question_answers_count` - The total number of FAQ questions and answers contained in the index.
+
+A `text_document_statistics` block supports the following attributes:
+
+* `indexed_text_bytes` - Total size, in bytes, of the indexed documents.
+* `indexed_text_documents_count` - The number of text documents indexed.
+
+A `server_side_encryption_configuration` block supports the following attributes:
+
+* `kms_key_id` - Identifier of the AWS KMScustomer master key (CMK). Amazon Kendra doesn't support asymmetric CMKs.
+
+A `user_group_resolution_configuration` block supports the following attributes:
+
+* `user_group_resolution_mode` - The identity store provider (mode) you want to use to fetch access levels of groups and users. AWS Single Sign-On is currently the only available mode. Your users and groups must exist in an AWS SSO identity source in order to use this mode. Valid Values are `AWS_SSO` or `NONE`.
+
+A `user_token_configurations` block supports the following attributes:
+
+* `json_token_type_configuration` - A block that specifies the information about the JSON token type configuration.
+* `jwt_token_type_configuration` - A block that specifies the information about the JWT token type configuration.
+
+A `json_token_type_configuration` block supports the following attributes:
+
+* `group_attribute_field` - The group attribute field.
+* `user_name_attribute_field` - The user name attribute field.
+
+A `jwt_token_type_configuration` block supports the following attributes:
+
+* `claim_regex` - Regular expression that identifies the claim.
+* `group_attribute_field` - The group attribute field.
+* `issuer` - Issuer of the token.
+* `key_location` - Location of the key. Valid values are `URL` or `SECRET_MANAGER`
+* `secrets_manager_arn` - ARN of the secret.
+* `url` - Signing key URL.
+* `user_name_attribute_field` - The user name attribute field.
+
+<!-- cache-key: cdktf-0.18.0 input-e76a9b0bb218897eea66052e6f4809ec4cf76d678314db182219fa620bdbe4a4 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/kendra_query_suggestions_block_list.html.markdown b/website/docs/cdktf/python/d/kendra_query_suggestions_block_list.html.markdown
new file mode 100644
index 00000000000..3d104e573d4
--- /dev/null
+++ b/website/docs/cdktf/python/d/kendra_query_suggestions_block_list.html.markdown
@@ -0,0 +1,65 @@
+---
+subcategory: "Kendra"
+layout: "aws"
+page_title: "AWS: aws_kendra_query_suggestions_block_list"
+description: |-
+  Provides details about a specific Amazon Kendra block list used for query suggestions for an index.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_kendra_query_suggestions_block_list
+
+Provides details about a specific Amazon Kendra block list used for query suggestions for an index.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_kendra_query_suggestions_block_list import DataAwsKendraQuerySuggestionsBlockList
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsKendraQuerySuggestionsBlockList(self, "example",
+            index_id="12345678-1234-1234-1234-123456789123",
+            query_suggestions_block_list_id="87654321-1234-4321-4321-321987654321"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `index_id` - (Required) Identifier of the index that contains the block list.
+* `query_suggestions_block_list_id` - (Required) Identifier of the block list.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the block list.
+* `created_at` - Date-time a block list was created.
+* `description` - Description for the block list.
+* `error_message` - Error message containing details if there are issues processing the block list.
+* `file_size_bytes` - Current size of the block list text file in S3.
+* `id` - Unique identifiers of the block list and index separated by a slash (`/`).
+* `item_count` - Current number of valid, non-empty words or phrases in the block list text file.
+* `name` - Name of the block list.
+* `role_arn` - ARN of a role with permission to access the S3 bucket that contains the block list. For more information, see [IAM Roles for Amazon Kendra](https://docs.aws.amazon.com/kendra/latest/dg/iam-roles.html).
+* `source_s3_path` - S3 location of the block list input data. Detailed below.
+* `status` - Current status of the block list. When the value is `ACTIVE`, the block list is ready for use.
+* `updated_at` - Date and time that the block list was last updated.
+* `tags` - Metadata that helps organize the block list you create.
+
+The `source_s3_path` configuration block supports the following attributes:
+
+* `bucket` - Name of the S3 bucket that contains the file.
+* `key` - Name of the file.
+
+<!-- cache-key: cdktf-0.18.0 input-58c35b9645175484541533f7e8f00ee84fdfe37d2326bf35c9f952899e44f7a6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/kendra_thesaurus.html.markdown b/website/docs/cdktf/python/d/kendra_thesaurus.html.markdown
new file mode 100644
index 00000000000..4258d543fe0
--- /dev/null
+++ b/website/docs/cdktf/python/d/kendra_thesaurus.html.markdown
@@ -0,0 +1,66 @@
+---
+subcategory: "Kendra"
+layout: "aws"
+page_title: "AWS: aws_kendra_thesaurus"
+description: |-
+  Provides details about a specific Amazon Kendra Thesaurus.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_kendra_thesaurus
+
+Provides details about a specific Amazon Kendra Thesaurus.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_kendra_thesaurus import DataAwsKendraThesaurus
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsKendraThesaurus(self, "example",
+            index_id="12345678-1234-1234-1234-123456789123",
+            thesaurus_id="87654321-1234-4321-4321-321987654321"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `index_id` - (Required) Identifier of the index that contains the Thesaurus.
+* `thesaurus_id` - (Required) Identifier of the Thesaurus.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Thesaurus.
+* `created_at` - Unix datetime that the Thesaurus was created.
+* `description` - Description of the Thesaurus.
+* `error_message` - When the `status` field value is `FAILED`, this contains a message that explains why.
+* `file_size_bytes` - Size of the Thesaurus file in bytes.
+* `id` - Unique identifiers of the Thesaurus and index separated by a slash (`/`).
+* `name` - Name of the Thesaurus.
+* `role_arn` - ARN of a role with permission to access the S3 bucket that contains the Thesaurus. For more information, see [IAM Roles for Amazon Kendra](https://docs.aws.amazon.com/kendra/latest/dg/iam-roles.html).
+* `source_s3_path` - S3 location of the Thesaurus input data. Detailed below.
+* `status` - Status of the Thesaurus. It is ready to use when the status is `ACTIVE`.
+* `synonym_rule_count` - Number of synonym rules in the Thesaurus file.
+* `term_count` - Number of unique terms in the Thesaurus file. For example, the synonyms `a,b,c` and `a=>d`, the term count would be 4.
+* `updated_at` - Date and time that the Thesaurus was last updated.
+* `tags` - Metadata that helps organize the Thesaurus you create.
+
+The `source_s3_path` configuration block supports the following attributes:
+
+* `bucket` - Name of the S3 bucket that contains the file.
+* `key` - Name of the file.
+
+<!-- cache-key: cdktf-0.18.0 input-29125b244608b6530d208362c4905e204c473f5f814e8bb91d9775dec645232b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/key_pair.html.markdown b/website/docs/cdktf/python/d/key_pair.html.markdown
new file mode 100644
index 00000000000..a335e12e8f1
--- /dev/null
+++ b/website/docs/cdktf/python/d/key_pair.html.markdown
@@ -0,0 +1,87 @@
+---
+subcategory: "EC2 (Elastic Compute Cloud)"
+layout: "aws"
+page_title: "AWS: aws_key_pair"
+description: |-
+    Provides details about a specific EC2 Key Pair.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_key_pair
+
+Use this data source to get information about a specific EC2 Key Pair.
+
+## Example Usage
+
+The following example shows how to get a EC2 Key Pair including the public key material from its name.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformOutput, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_key_pair import DataAwsKeyPair
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = DataAwsKeyPair(self, "example",
+            filter=[DataAwsKeyPairFilter(
+                name="tag:Component",
+                values=["web"]
+            )
+            ],
+            include_public_key=True,
+            key_name="test"
+        )
+        TerraformOutput(self, "fingerprint",
+            value=example.fingerprint
+        )
+        TerraformOutput(self, "id",
+            value=example.id
+        )
+        TerraformOutput(self, "name",
+            value=example.key_name
+        )
+```
+
+## Argument Reference
+
+The arguments of this data source act as filters for querying the available
+Key Pairs. The given filters must match exactly one Key Pair
+whose data will be exported as attributes.
+
+* `key_pair_id` - (Optional) Key Pair ID.
+* `key_name` - (Optional) Key Pair name.
+* `include_public_key` - (Optional) Whether to include the public key material in the response.
+* `filter` -  (Optional) Custom filter block as described below.
+
+### filter Configuration Block
+
+The `filter` configuration block supports the following arguments:
+
+* `name` - (Required) Name of the filter field. Valid values can be found in the [EC2 DescribeKeyPairs API Reference](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeKeyPairs.html).
+* `values` - (Required) Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the Key Pair.
+* `arn` - ARN of the Key Pair.
+* `create_time` - Timestamp for when the key pair was created in ISO 8601 format.
+* `fingerprint` - SHA-1 digest of the DER encoded private key.
+* `key_type` - Type of key pair.
+* `public_key` - Public key material.
+* `tags` - Any tags assigned to the Key Pair.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `20m`)
+
+<!-- cache-key: cdktf-0.18.0 input-0d9f224b71bac4257ab9450b7b4225c2db875e803084b43d495dc85927c709ee -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/kinesis_firehose_delivery_stream.html.markdown b/website/docs/cdktf/python/d/kinesis_firehose_delivery_stream.html.markdown
new file mode 100644
index 00000000000..7c65bb1d96f
--- /dev/null
+++ b/website/docs/cdktf/python/d/kinesis_firehose_delivery_stream.html.markdown
@@ -0,0 +1,49 @@
+---
+subcategory: "Kinesis Firehose"
+layout: "aws"
+page_title: "AWS: aws_kinesis_firehose_delivery_stream"
+description: |-
+  Provides an AWS Kinesis Firehose Delivery Stream data source.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_kinesis_firehose_delivery_stream
+
+Use this data source to get information about a Kinesis Firehose Delivery Stream for use in other resources.
+
+For more details, see the [Amazon Kinesis Firehose Documentation][1].
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_kinesis_firehose_delivery_stream import DataAwsKinesisFirehoseDeliveryStream
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsKinesisFirehoseDeliveryStream(self, "stream",
+            name="stream-name"
+        )
+```
+
+## Argument Reference
+
+* `name` - (Required) Name of the Kinesis Stream.
+
+## Attribute Reference
+
+`id` is set to the ARN of the Kinesis Stream. In addition, the following attributes
+are exported:
+
+* `arn` - ARN of the Kinesis Stream (same as id).
+
+[1]: https://aws.amazon.com/documentation/firehose/
+
+<!-- cache-key: cdktf-0.18.0 input-1dd963295de26dc82ebe6970ff79c68f651a64142b5fe860bf5803000337b30e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/kinesis_stream.html.markdown b/website/docs/cdktf/python/d/kinesis_stream.html.markdown
new file mode 100644
index 00000000000..38ee354b0e1
--- /dev/null
+++ b/website/docs/cdktf/python/d/kinesis_stream.html.markdown
@@ -0,0 +1,66 @@
+---
+subcategory: "Kinesis"
+layout: "aws"
+page_title: "AWS: aws_kinesis_stream"
+description: |-
+  Provides a Kinesis Stream data source.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_kinesis_stream
+
+Use this data source to get information about a Kinesis Stream for use in other
+resources.
+
+For more details, see the [Amazon Kinesis Documentation][1].
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_kinesis_stream import DataAwsKinesisStream
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsKinesisStream(self, "stream",
+            name="stream-name"
+        )
+```
+
+## Argument Reference
+
+* `name` - (Required) Name of the Kinesis Stream.
+
+## Attribute Reference
+
+`id` is set to the ARN of the Kinesis Stream. In addition, the following attributes
+are exported:
+
+* `arn` - ARN of the Kinesis Stream (same as id).
+* `name` - Name of the Kinesis Stream.
+* `creation_timestamp` - Approximate UNIX timestamp that the stream was created.
+* `status` - Current status of the stream. The stream status is one of CREATING, DELETING, ACTIVE, or UPDATING.
+* `retention_period` - Length of time (in hours) data records are accessible after they are added to the stream.
+* `open_shards` - List of shard ids in the OPEN state. See [Shard State][2] for more.
+* `closed_shards` - List of shard ids in the CLOSED state. See [Shard State][2] for more.
+* `shard_level_metrics` - List of shard-level CloudWatch metrics which are enabled for the stream. See [Monitoring with CloudWatch][3] for more.
+* `stream_mode_details` - [Capacity mode][4] of the data stream. Detailed below.
+* `tags` - Map of tags to assigned to the stream.
+
+### stream_mode_details Configuration Block
+
+* `stream_mode` - Capacity mode of the stream. Either `ON_DEMAND` or `PROVISIONED`.
+
+[1]: https://aws.amazon.com/documentation/kinesis/
+[2]: https://docs.aws.amazon.com/streams/latest/dev/kinesis-using-sdk-java-after-resharding.html#kinesis-using-sdk-java-resharding-data-routing
+[3]: https://docs.aws.amazon.com/streams/latest/dev/monitoring-with-cloudwatch.html
+[4]: https://docs.aws.amazon.com/streams/latest/dev/how-do-i-size-a-stream.html
+
+<!-- cache-key: cdktf-0.18.0 input-d035d44fea77906534614187920d80dfcb1210dd3b168e9a8322ca2eeaffb5f5 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/kinesis_stream_consumer.html.markdown b/website/docs/cdktf/python/d/kinesis_stream_consumer.html.markdown
new file mode 100644
index 00000000000..b310625c23f
--- /dev/null
+++ b/website/docs/cdktf/python/d/kinesis_stream_consumer.html.markdown
@@ -0,0 +1,53 @@
+---
+subcategory: "Kinesis"
+layout: "aws"
+page_title: "AWS: aws_kinesis_stream_consumer"
+description: |-
+  Provides details about a Kinesis Stream Consumer.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_kinesis_stream_consumer
+
+Provides details about a Kinesis Stream Consumer.
+
+For more details, see the [Amazon Kinesis Stream Consumer Documentation][1].
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_kinesis_stream_consumer import DataAwsKinesisStreamConsumer
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsKinesisStreamConsumer(self, "example",
+            name="example-consumer",
+            stream_arn=Token.as_string(aws_kinesis_stream_example.arn)
+        )
+```
+
+## Argument Reference
+
+* `arn` - (Optional) ARN of the stream consumer.
+* `name` - (Optional) Name of the stream consumer.
+* `stream_arn` - (Required) ARN of the data stream the consumer is registered with.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `creation_timestamp` - Approximate timestamp in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8) of when the stream consumer was created.
+* `id` - ARN of the stream consumer.
+* `status` - Current status of the stream consumer.
+
+[1]: https://docs.aws.amazon.com/streams/latest/dev/amazon-kinesis-consumers.html
+
+<!-- cache-key: cdktf-0.18.0 input-482a972e99b29826e09a6b01244884263ba57e5574eae706e0c8646f0c88959b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/kms_alias.html.markdown b/website/docs/cdktf/python/d/kms_alias.html.markdown
new file mode 100644
index 00000000000..9293cc74ff2
--- /dev/null
+++ b/website/docs/cdktf/python/d/kms_alias.html.markdown
@@ -0,0 +1,49 @@
+---
+subcategory: "KMS (Key Management)"
+layout: "aws"
+page_title: "AWS: aws_kms_alias"
+description: |-
+  Get information on a AWS Key Management Service (KMS) Alias
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_kms_alias
+
+Use this data source to get the ARN of a KMS key alias.
+By using this data source, you can reference key alias
+without having to hard code the ARN as input.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_kms_alias import DataAwsKmsAlias
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsKmsAlias(self, "s3",
+            name="alias/aws/s3"
+        )
+```
+
+## Argument Reference
+
+* `name` - (Required) Display name of the alias. The name must start with the word "alias" followed by a forward slash (alias/)
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name(ARN) of the key alias.
+* `id` - Amazon Resource Name(ARN) of the key alias.
+* `target_key_id` - Key identifier pointed to by the alias.
+* `target_key_arn` - ARN pointed to by the alias.
+
+<!-- cache-key: cdktf-0.18.0 input-a26328bd3bb7108ab75996766b208d1cd2fdaf417bd2555aa1588956c0544b01 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/kms_ciphertext.html.markdown b/website/docs/cdktf/python/d/kms_ciphertext.html.markdown
new file mode 100644
index 00000000000..b2fc59ae75d
--- /dev/null
+++ b/website/docs/cdktf/python/d/kms_ciphertext.html.markdown
@@ -0,0 +1,61 @@
+---
+subcategory: "KMS (Key Management)"
+layout: "aws"
+page_title: "AWS: aws_kms_ciphertext"
+description: |-
+    Provides ciphertext encrypted using a KMS key
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_kms_ciphertext
+
+The KMS ciphertext data source allows you to encrypt plaintext into ciphertext
+by using an AWS KMS customer master key. The value returned by this data source
+changes every apply. For a stable ciphertext value, see the [`aws_kms_ciphertext`
+resource](/docs/providers/aws/r/kms_ciphertext.html).
+
+~> **Note:** All arguments including the plaintext be stored in the raw state as plain-text.
+[Read more about sensitive data in state](https://www.terraform.io/docs/state/sensitive-data.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_kms_ciphertext import DataAwsKmsCiphertext
+from imports.aws.kms_key import KmsKey
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        oauth_config = KmsKey(self, "oauth_config",
+            description="oauth config",
+            is_enabled=True
+        )
+        DataAwsKmsCiphertext(self, "oauth",
+            key_id=oauth_config.key_id,
+            plaintext="{\n  \"client_id\": \"e587dbae22222f55da22\",\n  \"client_secret\": \"8289575d00000ace55e1815ec13673955721b8a5\"\n}\n\n"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `plaintext` - (Required) Data to be encrypted. Note that this may show up in logs, and it will be stored in the state file.
+* `key_id` - (Required) Globally unique key ID for the customer master key.
+* `context` - (Optional) An optional mapping that makes up the encryption context.
+
+## Attribute Reference
+
+All of the argument attributes are also exported as result attributes.
+
+* `id` - Globally unique key ID for the customer master key.
+* `ciphertext_blob` - Base64 encoded ciphertext
+
+<!-- cache-key: cdktf-0.18.0 input-b95133cf0e6d636d0e7e0bba6f81265bceaccd42767260a7c1b7aa55fb5a81e8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/kms_custom_key_store.html.markdown b/website/docs/cdktf/python/d/kms_custom_key_store.html.markdown
new file mode 100644
index 00000000000..243256d4c22
--- /dev/null
+++ b/website/docs/cdktf/python/d/kms_custom_key_store.html.markdown
@@ -0,0 +1,51 @@
+---
+subcategory: "KMS (Key Management)"
+layout: "aws"
+page_title: "AWS: aws_kms_custom_key_store"
+description: |-
+  Get information on a AWS Key Management Service (KMS) Custom Key Store
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_kms_custom_key_store
+
+Use this data source to get the metadata KMS custom key store.
+By using this data source, you can reference KMS custom key store
+without having to hard code the ID as input.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_kms_custom_key_store import DataAwsKmsCustomKeyStore
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsKmsCustomKeyStore(self, "keystore",
+            custom_key_store_name="my_cloudhsm"
+        )
+```
+
+## Argument Reference
+
+* `custom_key_store_id` - (Optional) The ID for the custom key store.
+* `custom_key_store_name` - (Optional) The user-specified friendly name for the custom key store.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - The ID for the custom key store.
+* `cloudhsm_cluster_id` - ID for the CloudHSM cluster that is associated with the custom key store.
+* `connection_state` - Indicates whether the custom key store is connected to its CloudHSM cluster.
+* `creation_date` - The date and time when the custom key store was created.
+* `trust_anchor_certificate` - The trust anchor certificate of the associated CloudHSM cluster.
+
+<!-- cache-key: cdktf-0.18.0 input-c99ed837841abb6fb88fc77efec11deea74fe80e9ca93d91eb217568414d6862 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/kms_key.html.markdown b/website/docs/cdktf/python/d/kms_key.html.markdown
new file mode 100644
index 00000000000..12696b8bb3c
--- /dev/null
+++ b/website/docs/cdktf/python/d/kms_key.html.markdown
@@ -0,0 +1,92 @@
+---
+subcategory: "KMS (Key Management)"
+layout: "aws"
+page_title: "AWS: aws_kms_key"
+description: |-
+  Get information on a AWS Key Management Service (KMS) Key
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# aws_kms_key
+
+Use this data source to get detailed information about
+the specified KMS Key with flexible key id input.
+This can be useful to reference key alias
+without having to hard code the ARN as input.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_kms_key import DataAwsKmsKey
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsKmsKey(self, "by_alias",
+            key_id="alias/my-key"
+        )
+        DataAwsKmsKey(self, "by_alias_arn",
+            key_id="arn:aws:kms:us-east-1:111122223333:alias/my-key"
+        )
+        DataAwsKmsKey(self, "by_id",
+            key_id="1234abcd-12ab-34cd-56ef-1234567890ab"
+        )
+        DataAwsKmsKey(self, "by_key_arn",
+            key_id="arn:aws:kms:us-east-1:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
+        )
+```
+
+## Argument Reference
+
+* `key_id` - (Required) Key identifier which can be one of the following format:
+    * Key ID. E.g: `1234abcd-12ab-34cd-56ef-1234567890ab`
+    * Key ARN. E.g.: `arn:aws:kms:us-east-1:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab`
+    * Alias name. E.g.: `alias/my-key`
+    * Alias ARN: E.g.: `arn:aws:kms:us-east-1:111122223333:alias/my-key`
+* `grant_tokens` - (Optional) List of grant tokens
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id`: The globally unique identifier for the key
+* `arn`: The ARN of the key
+* `aws_account_id`: The twelve-digit account ID of the AWS account that owns the key
+* `cloud_hsm_cluster_id`: The cluster ID of the AWS CloudHSM cluster that contains the key material for the KMS key.
+* `creation_date`: The date and time when the key was created
+* `custom_key_store_id`: A unique identifier for the custom key store that contains the KMS key.
+* `customer_master_key_spec`: Specifies whether the key contains a symmetric key or an asymmetric key pair and the encryption algorithms or signing algorithms that the key supports
+* `deletion_date`: The date and time after which AWS KMS deletes the key. This value is present only when `key_state` is `PendingDeletion`, otherwise this value is 0
+* `description`: The description of the key.
+* `enabled`: Specifies whether the key is enabled. When `key_state` is `Enabled` this value is true, otherwise it is false
+* `expiration_model`: Specifies whether the Key's key material expires. This value is present only when `origin` is `EXTERNAL`, otherwise this value is empty
+* `key_manager`: The key's manager
+* `key_spec`: Describes the type of key material in the KMS key.
+* `key_state`: The state of the key
+* `key_usage`: Specifies the intended use of the key
+* `multi_region`: Indicates whether the KMS key is a multi-Region (`true`) or regional (`false`) key.
+* `multi_region_configuration`: Lists the primary and replica keys in same multi-Region key. Present only when the value of `multi_region` is `true`.
+* `origin`: When this value is `AWS_KMS`, AWS KMS created the key material. When this value is `EXTERNAL`, the key material was imported from your existing key management infrastructure or the CMK lacks key material
+* `pending_deletion_window_in_days`: The waiting period before the primary key in a multi-Region key is deleted.
+* `valid_to`: The time at which the imported key material expires. This value is present only when `origin` is `EXTERNAL` and whose `expiration_model` is `KEY_MATERIAL_EXPIRES`, otherwise this value is 0
+* `xks_key_configuration`: Information about the external key that is associated with a KMS key in an external key store.
+
+The `multi_region_configuration` object supports the following:
+
+* `multi_region_key_type`: Indicates whether the KMS key is a `PRIMARY` or `REPLICA` key.
+* `primary_key`: The key ARN and Region of the primary key. This is the current KMS key if it is the primary key.
+* `replica_keys`: The key ARNs and Regions of all replica keys. Includes the current KMS key if it is a replica key.
+
+The `primary_key` and `replica_keys` objects support the following:
+
+* `arn`: The key ARN of a primary or replica key of a multi-Region key.
+* `region`: The AWS Region of a primary or replica key in a multi-Region key.
+
+<!-- cache-key: cdktf-0.18.0 input-ea7621c22f20905a0de28c0a03b164a5da43b21e2d3bdf0913f29e827818698b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/kms_public_key.html.markdown b/website/docs/cdktf/python/d/kms_public_key.html.markdown
new file mode 100644
index 00000000000..376cd628311
--- /dev/null
+++ b/website/docs/cdktf/python/d/kms_public_key.html.markdown
@@ -0,0 +1,67 @@
+---
+subcategory: "KMS (Key Management)"
+layout: "aws"
+page_title: "AWS: aws_kms_public_key"
+description: |-
+  Get information on a KMS public key
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# aws_kms_public_key
+
+Use this data source to get the public key about the specified KMS Key with flexible key id input. This can be useful to reference key alias without having to hard code the ARN as input.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_kms_public_key import DataAwsKmsPublicKey
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsKmsPublicKey(self, "by_alias",
+            key_id="alias/my-key"
+        )
+        DataAwsKmsPublicKey(self, "by_alias_arn",
+            key_id="arn:aws:kms:us-east-1:111122223333:alias/my-key"
+        )
+        DataAwsKmsPublicKey(self, "by_id",
+            key_id="1234abcd-12ab-34cd-56ef-1234567890ab"
+        )
+        DataAwsKmsPublicKey(self, "by_key_arn",
+            key_id="arn:aws:kms:us-east-1:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `key_id` - (Required) Key identifier which can be one of the following format:
+    * Key ID. E.g - `1234abcd-12ab-34cd-56ef-1234567890ab`
+    * Key ARN. E.g. - `arn:aws:kms:us-east-1:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab`
+    * Alias name. E.g. - `alias/my-key`
+    * Alias ARN - E.g. - `arn:aws:kms:us-east-1:111122223333:alias/my-key`
+* `grant_tokens` - (Optional) List of grant tokens
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - Key ARN of the asymmetric CMK from which the public key was downloaded.
+* `customer_master_key_spec` - Type of the public key that was downloaded.
+* `encryption_algorithms` - Encryption algorithms that AWS KMS supports for this key. Only set when the `key_usage` of the public key is `ENCRYPT_DECRYPT`.
+* `id` - Key ARN of the asymmetric CMK from which the public key was downloaded.
+* `key_usage` - Permitted use of the public key. Valid values are `ENCRYPT_DECRYPT` or `SIGN_VERIFY`
+* `public_key` - Exported public key. The value is a DER-encoded X.509 public key, also known as SubjectPublicKeyInfo (SPKI), as defined in [RFC 5280](https://tools.ietf.org/html/rfc5280). The value is Base64-encoded.
+* `public_key_pem` - Exported public key. The value is Privacy Enhanced Mail (PEM) encoded.
+* `signing_algorithms` - Signing algorithms that AWS KMS supports for this key. Only set when the `key_usage` of the public key is `SIGN_VERIFY`.
+
+<!-- cache-key: cdktf-0.18.0 input-12b3af34b0a1b4d66a4ded239c7cec5e42bb02e7dbdeb474700393154476f950 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/kms_secret.html.markdown b/website/docs/cdktf/python/d/kms_secret.html.markdown
new file mode 100644
index 00000000000..c7cba24d8bd
--- /dev/null
+++ b/website/docs/cdktf/python/d/kms_secret.html.markdown
@@ -0,0 +1,15 @@
+---
+subcategory: "KMS (Key Management)"
+layout: "aws"
+page_title: "AWS: aws_kms_secret"
+description: |-
+    Provides secret data encrypted with the KMS service
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_kms_secret
+
+!> **WARNING:** This data source was removed in version 2.0.0 of the Terraform AWS Provider. You can migrate existing configurations to the [`aws_kms_secrets` data source](/docs/providers/aws/d/kms_secrets.html) following instructions available in the [Version 2 Upgrade Guide](../guides/version-2-upgrade.html#data-source-aws_kms_secret).
+
+<!-- cache-key: cdktf-0.18.0 input-fcfeaaa83a200a1ed43647d46ae1fe5be1d50d9ede7fb6ba139fb2957f734790 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/kms_secrets.html.markdown b/website/docs/cdktf/python/d/kms_secrets.html.markdown
new file mode 100644
index 00000000000..2283ddb3c22
--- /dev/null
+++ b/website/docs/cdktf/python/d/kms_secrets.html.markdown
@@ -0,0 +1,97 @@
+---
+subcategory: "KMS (Key Management)"
+layout: "aws"
+page_title: "AWS: aws_kms_secrets"
+description: |-
+    Decrypt multiple secrets from data encrypted with the AWS KMS service
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_kms_secrets
+
+Decrypt multiple secrets from data encrypted with the AWS KMS service.
+
+~> **NOTE:** Using this data provider will allow you to conceal secret data within your resource definitions but does not take care of protecting that data in all Terraform logging and state output. Please take care to secure your secret data beyond just the Terraform configuration.
+
+## Example Usage
+
+If you do not already have a `CiphertextBlob` from encrypting a KMS secret, you can use the below commands to obtain one using the [AWS CLI kms encrypt](https://docs.aws.amazon.com/cli/latest/reference/kms/encrypt.html) command. This requires you to have your AWS CLI setup correctly and replace the `--key-id` with your own. Alternatively you can use `--plaintext 'master-password'` (CLIv1) or `--plaintext fileb://<(echo -n 'master-password')` (CLIv2) instead of reading from a file.
+
+-> If you have a newline character at the end of your file, it will be decrypted with this newline character intact. For most use cases this is undesirable and leads to incorrect passwords or invalid values, as well as possible changes in the plan. Be sure to use `echo -n` if necessary.
+-> If you are using asymmetric keys ensure you are using the right encryption algorithm when you encrypt and decrypt else you will get IncorrectKeyException during the decrypt phase.
+
+```console
+% echo -n 'master-password' > plaintext-password
+% aws kms encrypt --key-id ab123456-c012-4567-890a-deadbeef123 --plaintext fileb://plaintext-password --encryption-context foo=bar --output text --query CiphertextBlob
+AQECAHgaPa0J8WadplGCqqVAr4HNvDaFSQ+NaiwIBhmm6qDSFwAAAGIwYAYJKoZIhvcNAQcGoFMwUQIBADBMBgkqhkiG9w0BBwEwHgYJYIZIAWUDBAEuMBEEDI+LoLdvYv8l41OhAAIBEIAfx49FFJCLeYrkfMfAw6XlnxP23MmDBdqP8dPp28OoAQ==
+% aws kms encrypt --key-id ab123456-c012-4567-890a-deadbeef123 --plaintext fileb://plaintext-password --encryption-algorithm RSAES_OAEP_SHA_256 --output text --query CiphertextBlob
+AQECAHgaPa0J8WadplGCqqVAr4HNvDaFSQ+NaiwIBhmm6qDSFwAAAGIwYAYJKoZIhvcNAQcGoFMwUQIBADBMBgkqhkiG9w0BBwEwHgYJYIZIAWUDBAEuMBEEDI+LoLdvYv8l41OhAAIBEIAfx49FFJCLeYrkfMfAw6XlnxP23MmDBdqP8dPp28OoAQ==
+```
+
+That encrypted output can now be inserted into Terraform configurations without exposing the plaintext secret directly.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_kms_secrets import DataAwsKmsSecrets
+from imports.aws.rds_cluster import RdsCluster
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, engine):
+        super().__init__(scope, name)
+        example = DataAwsKmsSecrets(self, "example",
+            secret=[DataAwsKmsSecretsSecret(
+                context={
+                    "foo": "bar"
+                },
+                name="master_password",
+                payload="AQECAHgaPa0J8WadplGCqqVAr4HNvDaFSQ+NaiwIBhmm6qDSFwAAAGIwYAYJKoZIhvcNAQcGoFMwUQIBADBMBgkqhkiG9w0BBwEwHgYJYIZIAWUDBAEuMBEEDI+LoLdvYv8l41OhAAIBEIAfx49FFJCLeYrkfMfAw6XlnxP23MmDBdqP8dPp28OoAQ=="
+            ), DataAwsKmsSecretsSecret(
+                name="master_username",
+                payload="AQECAHgaPa0J8WadplGCqqVAr4HNvDaFSQ+NaiwIBhmm6qDSFwAAAGIwYAYJKoZIhvcNAQcGoFMwUQIBADBMBgkqhkiG9w0BBwEwHgYJYIZIAWUDBAEuMBEEDI+LoLdvYv8l41OhAAIBEIAfx49FFJCLeYrkfMfAw6XlnxP23MmDBdqP8dPp28OoAQ=="
+            )
+            ]
+        )
+        aws_rds_cluster_example = RdsCluster(self, "example_1",
+            master_password=Token.as_string(
+                Fn.lookup_nested(example.plaintext, ["\"master_password\""])),
+            master_username=Token.as_string(
+                Fn.lookup_nested(example.plaintext, ["\"master_username\""])),
+            engine=engine
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_rds_cluster_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `secret` - (Required) One or more encrypted payload definitions from the KMS service. See the Secret Definitions below.
+
+### Secret Definitions
+
+Each `secret` supports the following arguments:
+
+* `name` - (Required) Name to export this secret under in the attributes.
+* `payload` - (Required) Base64 encoded payload, as returned from a KMS encrypt operation.
+* `context` - (Optional) An optional mapping that makes up the Encryption Context for the secret.
+* `grant_tokens` (Optional) An optional list of Grant Tokens for the secret.
+* `encryption_algorithm` - (Optional) The encryption algorithm that will be used to decrypt the ciphertext. This parameter is required only when the ciphertext was encrypted under an asymmetric KMS key. Valid Values: SYMMETRIC_DEFAULT | RSAES_OAEP_SHA_1 | RSAES_OAEP_SHA_256 | SM2PKE
+* `key_id` (Optional) Specifies the KMS key that AWS KMS uses to decrypt the ciphertext. This parameter is required only when the ciphertext was encrypted under an asymmetric KMS key.
+
+For more information on `context` and `grant_tokens` see the [KMS
+Concepts](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html)
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `plaintext` - Map containing each `secret` `name` as the key with its decrypted plaintext value
+
+<!-- cache-key: cdktf-0.18.0 input-163ab67c377949aee00b00e3a19b28f529fc14cff02471ea6c0bd31a209a5b1d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/lakeformation_data_lake_settings.html.markdown b/website/docs/cdktf/python/d/lakeformation_data_lake_settings.html.markdown
new file mode 100644
index 00000000000..7f87d890c5d
--- /dev/null
+++ b/website/docs/cdktf/python/d/lakeformation_data_lake_settings.html.markdown
@@ -0,0 +1,63 @@
+---
+subcategory: "Lake Formation"
+layout: "aws"
+page_title: "AWS: aws_lakeformation_data_lake_settings"
+description: |-
+    Get data lake administrators and default database and table permissions
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_lakeformation_data_lake_settings
+
+Get Lake Formation principals designated as data lake administrators and lists of principal permission entries for default create database and default create table permissions.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_lakeformation_data_lake_settings import DataAwsLakeformationDataLakeSettings
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsLakeformationDataLakeSettings(self, "example",
+            catalog_id="14916253649"
+        )
+```
+
+## Argument Reference
+
+The following arguments are optional:
+
+* `catalog_id` – (Optional) Identifier for the Data Catalog. By default, the account ID.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `admins` – List of ARNs of AWS Lake Formation principals (IAM users or roles).
+* `read_only_admins` – List of ARNs of AWS Lake Formation principals (IAM users or roles) with only view access to the resources.
+* `create_database_default_permissions` - Up to three configuration blocks of principal permissions for default create database permissions. Detailed below.
+* `create_table_default_permissions` - Up to three configuration blocks of principal permissions for default create table permissions. Detailed below.
+* `trusted_resource_owners` – List of the resource-owning account IDs that the caller's account can use to share their user access details (user ARNs).
+* `allow_external_data_filtering` - Whether to allow Amazon EMR clusters to access data managed by Lake Formation.
+* `external_data_filtering_allow_list` - A list of the account IDs of Amazon Web Services accounts with Amazon EMR clusters that are to perform data filtering.
+* `authorized_session_tag_value_list` - Lake Formation relies on a privileged process secured by Amazon EMR or the third party integrator to tag the user's role while assuming it.
+
+### create_database_default_permissions
+
+* `permissions` - List of permissions granted to the principal.
+* `principal` - Principal who is granted permissions.
+
+### create_table_default_permissions
+
+* `permissions` - List of permissions granted to the principal.
+* `principal` - Principal who is granted permissions.
+
+<!-- cache-key: cdktf-0.18.0 input-f9ed67609f11fe3dc75d11e8316427f119ef11af97f179f341207047f1fe3023 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/lakeformation_permissions.html.markdown b/website/docs/cdktf/python/d/lakeformation_permissions.html.markdown
new file mode 100644
index 00000000000..ba2e16c5044
--- /dev/null
+++ b/website/docs/cdktf/python/d/lakeformation_permissions.html.markdown
@@ -0,0 +1,193 @@
+---
+subcategory: "Lake Formation"
+layout: "aws"
+page_title: "AWS: aws_lakeformation_permissions"
+description: |-
+    Get permissions for a principal to access metadata in the Data Catalog and data organized in underlying data storage such as Amazon S3.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_lakeformation_permissions
+
+Get permissions for a principal to access metadata in the Data Catalog and data organized in underlying data storage such as Amazon S3. Permissions are granted to a principal, in a Data Catalog, relative to a Lake Formation resource, which includes the Data Catalog, databases, tables, LF-tags, and LF-tag policies. For more information, see [Security and Access Control to Metadata and Data in Lake Formation](https://docs.aws.amazon.com/lake-formation/latest/dg/security-data-access.html).
+
+~> **NOTE:** This data source deals with explicitly granted permissions. Lake Formation grants implicit permissions to data lake administrators, database creators, and table creators. For more information, see [Implicit Lake Formation Permissions](https://docs.aws.amazon.com/lake-formation/latest/dg/implicit-permissions.html).
+
+## Example Usage
+
+### Permissions For A Lake Formation S3 Resource
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_lakeformation_permissions import DataAwsLakeformationPermissions
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsLakeformationPermissions(self, "test",
+            data_location=DataAwsLakeformationPermissionsDataLocation(
+                arn=Token.as_string(aws_lakeformation_resource_test.arn)
+            ),
+            principal=workflow_role.arn
+        )
+```
+
+### Permissions For A Glue Catalog Database
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_lakeformation_permissions import DataAwsLakeformationPermissions
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsLakeformationPermissions(self, "test",
+            database=DataAwsLakeformationPermissionsDatabase(
+                catalog_id="110376042874",
+                name=Token.as_string(aws_glue_catalog_database_test.name)
+            ),
+            principal=workflow_role.arn
+        )
+```
+
+### Permissions For Tag-Based Access Control
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_lakeformation_permissions import DataAwsLakeformationPermissions
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsLakeformationPermissions(self, "test",
+            lf_tag_policy=DataAwsLakeformationPermissionsLfTagPolicy(
+                expression=[DataAwsLakeformationPermissionsLfTagPolicyExpression(
+                    key="Team",
+                    values=["Sales"]
+                ), DataAwsLakeformationPermissionsLfTagPolicyExpression(
+                    key="Environment",
+                    values=["Dev", "Production"]
+                )
+                ],
+                resource_type="DATABASE"
+            ),
+            principal=workflow_role.arn
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `principal` – (Required) Principal to be granted the permissions on the resource. Supported principals are IAM users or IAM roles.
+
+One of the following is required:
+
+* `catalog_resource` - Whether the permissions are to be granted for the Data Catalog. Defaults to `false`.
+* `data_location` - Configuration block for a data location resource. Detailed below.
+* `database` - Configuration block for a database resource. Detailed below.
+* `lf_tag` - (Optional) Configuration block for an LF-tag resource. Detailed below.
+* `lf_tag_policy` - (Optional) Configuration block for an LF-tag policy resource. Detailed below.
+* `table` - Configuration block for a table resource. Detailed below.
+* `table_with_columns` - Configuration block for a table with columns resource. Detailed below.
+
+The following arguments are optional:
+
+* `catalog_id` – (Optional) Identifier for the Data Catalog. By default, the account ID. The Data Catalog is the persistent metadata store. It contains database definitions, table definitions, and other control information to manage your Lake Formation environment.
+
+### data_location
+
+The following argument is required:
+
+* `arn` – (Required) ARN that uniquely identifies the data location resource.
+
+The following argument is optional:
+
+* `catalog_id` - (Optional) Identifier for the Data Catalog where the location is registered with Lake Formation. By default, it is the account ID of the caller.
+
+### database
+
+The following argument is required:
+
+* `name` – (Required) Name of the database resource. Unique to the Data Catalog.
+
+The following argument is optional:
+
+* `catalog_id` - (Optional) Identifier for the Data Catalog. By default, it is the account ID of the caller.
+
+### lf_tag
+
+The following arguments are required:
+
+* `key` – (Required) Key-name for the tag.
+* `values` - (Required) List of possible values an attribute can take.
+
+The following argument is optional:
+
+* `catalog_id` - (Optional) Identifier for the Data Catalog. By default, it is the account ID of the caller.
+
+### lf_tag_policy
+
+The following arguments are required:
+
+* `resource_type` – (Required) Resource type for which the tag policy applies. Valid values are `DATABASE` and `TABLE`.
+* `expression` - (Required) List of tag conditions that apply to the resource's tag policy. Configuration block for tag conditions that apply to the policy. See [`expression`](#expression) below.
+
+The following argument is optional:
+
+* `catalog_id` - (Optional) Identifier for the Data Catalog. By default, it is the account ID of the caller.
+
+#### expression
+
+* `key` – (Required) Key-name of an LF-Tag.
+* `values` - (Required) List of possible values of an LF-Tag.
+
+### table
+
+The following argument is required:
+
+* `database_name` – (Required) Name of the database for the table. Unique to a Data Catalog.
+
+The following arguments are optional:
+
+* `catalog_id` - (Optional) Identifier for the Data Catalog. By default, it is the account ID of the caller.
+* `name` - (Optional) Name of the table. At least one of `name` or `wildcard` is required.
+* `wildcard` - (Optional) Whether to use a wildcard representing every table under a database. At least one of `name` or `wildcard` is required. Defaults to `false`.
+
+### table_with_columns
+
+The following arguments are required:
+
+* `database_name` – (Required) Name of the database for the table with columns resource. Unique to the Data Catalog.
+* `name` – (Required) Name of the table resource.
+
+The following arguments are optional:
+
+* `catalog_id` - (Optional) Identifier for the Data Catalog. By default, it is the account ID of the caller.
+* `column_names` - (Optional) Set of column names for the table. At least one of `column_names` or `excluded_column_names` is required.
+* `excluded_column_names` - (Optional) Set of column names for the table to exclude. At least one of `column_names` or `excluded_column_names` is required.
+
+## Attribute Reference
+
+In addition to the above arguments, the following attribute is exported:
+
+* `permissions` – List of permissions granted to the principal. For details on permissions, see [Lake Formation Permissions Reference](https://docs.aws.amazon.com/lake-formation/latest/dg/lf-permissions-reference.html).
+* `permissions_with_grant_option` - Subset of `permissions` which the principal can pass.
+
+<!-- cache-key: cdktf-0.18.0 input-f820afbcf35bc80d4121f086cb449534cf9844817817f907e94a928ec49659fd -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/lakeformation_resource.html.markdown b/website/docs/cdktf/python/d/lakeformation_resource.html.markdown
new file mode 100644
index 00000000000..d07010a8448
--- /dev/null
+++ b/website/docs/cdktf/python/d/lakeformation_resource.html.markdown
@@ -0,0 +1,45 @@
+---
+subcategory: "Lake Formation"
+layout: "aws"
+page_title: "AWS: aws_lakeformation_resource"
+description: |-
+    Provides details about a Lake Formation resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_lakeformation_resource
+
+Provides details about a Lake Formation resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_lakeformation_resource import DataAwsLakeformationResource
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsLakeformationResource(self, "example",
+            arn="arn:aws:s3:::tf-acc-test-9151654063908211878"
+        )
+```
+
+## Argument Reference
+
+* `arn` – (Required) ARN of the resource, an S3 path.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `last_modified` - Date and time the resource was last modified in [RFC 3339 format](https://tools.ietf.org/html/rfc3339#section-5.8).
+* `role_arn` – Role that the resource was registered with.
+
+<!-- cache-key: cdktf-0.18.0 input-0185c301ec1158bbafdd7e87d6616f71b92a457425fc4fc6e43f33335ee107a8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/lambda_alias.html.markdown b/website/docs/cdktf/python/d/lambda_alias.html.markdown
new file mode 100644
index 00000000000..e62a14dbc8a
--- /dev/null
+++ b/website/docs/cdktf/python/d/lambda_alias.html.markdown
@@ -0,0 +1,51 @@
+---
+subcategory: "Lambda"
+layout: "aws"
+page_title: "AWS: aws_lambda_alias"
+description: |-
+  Provides a Lambda Alias data source.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_lambda_alias
+
+Provides information about a Lambda Alias.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_lambda_alias import DataAwsLambdaAlias
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsLambdaAlias(self, "production",
+            function_name="my-lambda-func",
+            name="production"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `function_name` - (Required) Name of the aliased Lambda function.
+* `name` - (Required) Name of the Lambda alias.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN identifying the Lambda function alias.
+* `description` - Description of alias.
+* `function_version` - Lambda function version which the alias uses.
+* `invoke_arn` - ARN to be used for invoking Lambda Function from API Gateway - to be used in aws_api_gateway_integration's `uri`.
+
+<!-- cache-key: cdktf-0.18.0 input-9a9ef3f242a9fa98f2fce5f412613b9059a876ab618fe7d6d35642bfb3e5874d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/lambda_code_signing_config.html.markdown b/website/docs/cdktf/python/d/lambda_code_signing_config.html.markdown
new file mode 100644
index 00000000000..e0848490b5d
--- /dev/null
+++ b/website/docs/cdktf/python/d/lambda_code_signing_config.html.markdown
@@ -0,0 +1,62 @@
+---
+subcategory: "Lambda"
+layout: "aws"
+page_title: "AWS: aws_lambda_code_signing_config"
+description: |-
+  Provides a Lambda Code Signing Config data source.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_lambda_code_signing_config
+
+Provides information about a Lambda Code Signing Config. A code signing configuration defines a list of allowed signing profiles and defines the code-signing validation policy (action to be taken if deployment validation checks fail).
+
+For information about Lambda code signing configurations and how to use them, see [configuring code signing for Lambda functions][1]
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_lambda_code_signing_config import DataAwsLambdaCodeSigningConfig
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsLambdaCodeSigningConfig(self, "existing_csc",
+            arn="arn:aws:lambda:${" + aws_region.value + "}:${" + aws_account.value + "}:code-signing-config:csc-0f6c334abcdea4d8b"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `arn` - (Required) ARN of the code signing configuration.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `allowed_publishers` - List of allowed publishers as signing profiles for this code signing configuration.
+* `config_id` - Unique identifier for the code signing configuration.
+* `description` - Code signing configuration description.
+* `last_modified` - Date and time that the code signing configuration was last modified.
+* `policies` - List of code signing policies that control the validation failure action for signature mismatch or expiry.
+
+`allowed_publishers` is exported with the following attribute:
+
+* `signing_profile_version_arns` - The ARN for each of the signing profiles. A signing profile defines a trusted user who can sign a code package.
+
+`policies` is exported with the following attribute:
+
+* `untrusted_artifact_on_deployment` - Code signing configuration policy for deployment validation failure.
+
+[1]: https://docs.aws.amazon.com/lambda/latest/dg/configuration-codesigning.html
+
+<!-- cache-key: cdktf-0.18.0 input-7579a58de49284320a865ba064d26b395888e4b37e0c54bd6bcef30caa65b6ed -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/lambda_function.html.markdown b/website/docs/cdktf/python/d/lambda_function.html.markdown
new file mode 100644
index 00000000000..268f47092ef
--- /dev/null
+++ b/website/docs/cdktf/python/d/lambda_function.html.markdown
@@ -0,0 +1,79 @@
+---
+subcategory: "Lambda"
+layout: "aws"
+page_title: "AWS: aws_lambda_function"
+description: |-
+  Provides a Lambda Function data source.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# aws_lambda_function
+
+Provides information about a Lambda Function.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import VariableType, TerraformVariable, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_lambda_function import DataAwsLambdaFunction
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        # Terraform Variables are not always the best fit for getting inputs in the context of Terraform CDK.
+        #     You can read more about this at https://cdk.tf/variables
+        function_name = TerraformVariable(self, "function_name",
+            type=VariableType.STRING
+        )
+        DataAwsLambdaFunction(self, "existing",
+            function_name=function_name.string_value
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `function_name` - (Required) Name of the lambda function.
+* `qualifier` - (Optional) Alias name or version number of the lambda functionE.g., `$LATEST`, `my-alias`, or `1`. When not included: the data source resolves to the most recent published version; if no published version exists: it resolves to the most recent unpublished version.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `architectures` - Instruction set architecture for the Lambda function.
+* `arn` - Unqualified (no `:QUALIFIER` or `:VERSION` suffix) ARN identifying your Lambda Function. See also `qualified_arn`.
+* `code_signing_config_arn` - ARN for a Code Signing Configuration.
+* `dead_letter_config` - Configure the function's *dead letter queue*.
+* `description` - Description of what your Lambda Function does.
+* `environment` - Lambda environment's configuration settings.
+* `ephemeral_storage` - Amount of Ephemeral storage(`/tmp`) allocated for the Lambda Function.
+* `file_system_config` - Connection settings for an Amazon EFS file system.
+* `handler` - Function entrypoint in your code.
+* `image_uri` - URI of the container image.
+* `invoke_arn` - ARN to be used for invoking Lambda Function from API Gateway. **NOTE:** Starting with `v4.51.0` of the provider, this will *not* include the qualifier.
+* `kms_key_arn` - ARN for the KMS encryption key.
+* `last_modified` - Date this resource was last modified.
+* `layers` - List of Lambda Layer ARNs attached to your Lambda Function.
+* `memory_size` - Amount of memory in MB your Lambda Function can use at runtime.
+* `qualified_arn` - Qualified (`:QUALIFIER` or `:VERSION` suffix) ARN identifying your Lambda Function. See also `arn`.
+* `qualified_invoke_arn` - Qualified (`:QUALIFIER` or `:VERSION` suffix) ARN to be used for invoking Lambda Function from API Gateway. See also `invoke_arn`.
+* `reserved_concurrent_executions` - The amount of reserved concurrent executions for this lambda function or `-1` if unreserved.
+* `role` - IAM role attached to the Lambda Function.
+* `runtime` - Runtime environment for the Lambda function.
+* `signing_job_arn` - ARN of a signing job.
+* `signing_profile_version_arn` - The ARN for a signing profile version.
+* `source_code_hash` - Base64-encoded representation of raw SHA-256 sum of the zip file.
+* `source_code_size` - Size in bytes of the function .zip file.
+* `timeout` - Function execution time at which Lambda should terminate the function.
+* `tracing_config` - Tracing settings of the function.
+* `version` - The version of the Lambda function returned. If `qualifier` is not set, this will resolve to the most recent published version. If no published version of the function exists, `version` will resolve to `$LATEST`.
+* `vpc_config` - VPC configuration associated with your Lambda function.
+
+<!-- cache-key: cdktf-0.18.0 input-aa23743032adbbcb3971ecbe81f2b393d5995f92cb64512014ac1d8c97a94023 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/lambda_function_url.html.markdown b/website/docs/cdktf/python/d/lambda_function_url.html.markdown
new file mode 100644
index 00000000000..f52696108f3
--- /dev/null
+++ b/website/docs/cdktf/python/d/lambda_function_url.html.markdown
@@ -0,0 +1,59 @@
+---
+subcategory: "Lambda"
+layout: "aws"
+page_title: "AWS: aws_lambda_function_url"
+description: |-
+  Provides a Lambda function URL data source.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# aws_lambda_function_url
+
+Provides information about a Lambda function URL.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import VariableType, TerraformVariable, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_lambda_function_url import DataAwsLambdaFunctionUrl
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        # Terraform Variables are not always the best fit for getting inputs in the context of Terraform CDK.
+        #     You can read more about this at https://cdk.tf/variables
+        function_name = TerraformVariable(self, "function_name",
+            type=VariableType.STRING
+        )
+        DataAwsLambdaFunctionUrl(self, "existing",
+            function_name=function_name.string_value
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `function_name` - (Required) The name (or ARN) of the Lambda function.
+* `qualifier` - (Optional) Alias name or `"$LATEST"`.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `authorization_type` - Type of authentication that the function URL uses.
+* `cors` - The [cross-origin resource sharing (CORS)](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS) settings for the function URL. See the [`aws_lambda_function_url` resource](/docs/providers/aws/r/lambda_function_url.html) documentation for more details.
+* `creation_time` - When the function URL was created, in [ISO-8601 format](https://www.w3.org/TR/NOTE-datetime).
+* `function_arn` - ARN of the function.
+* `function_url` - HTTP URL endpoint for the function in the format `https://<url_id>.lambda-url.<region>.on.aws`.
+* `invoke_mode` - Whether the Lambda function responds in `BUFFERED` or `RESPONSE_STREAM` mode.
+* `last_modified_time` - When the function URL configuration was last updated, in [ISO-8601 format](https://www.w3.org/TR/NOTE-datetime).
+* `url_id` - Generated ID for the endpoint.
+
+<!-- cache-key: cdktf-0.18.0 input-0a5c606b8160ad05d35175dbe2ca99c3d1ab9ce2b9e1e2ff92b850ec19ea50b9 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/lambda_functions.html.markdown b/website/docs/cdktf/python/d/lambda_functions.html.markdown
new file mode 100644
index 00000000000..525cfbd1f82
--- /dev/null
+++ b/website/docs/cdktf/python/d/lambda_functions.html.markdown
@@ -0,0 +1,43 @@
+---
+subcategory: "Lambda"
+layout: "aws"
+page_title: "AWS: aws_lambda_functions"
+description: |-
+  Terraform data resource to get a list of Lambda Functions.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# aws_lambda_functions
+
+Terraform data resource to get a list of Lambda Functions.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_lambda_functions import DataAwsLambdaFunctions
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsLambdaFunctions(self, "all")
+```
+
+## Argument Reference
+
+The resource does not support any arguments.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `function_names` - A list of Lambda Function names.
+* `function_arns` - A list of Lambda Function ARNs.
+
+<!-- cache-key: cdktf-0.18.0 input-9ccb856a004c433861654de03521b43801920ad0f1aab4468643725a2469eb74 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/lambda_invocation.html.markdown b/website/docs/cdktf/python/d/lambda_invocation.html.markdown
new file mode 100644
index 00000000000..a407e5247b1
--- /dev/null
+++ b/website/docs/cdktf/python/d/lambda_invocation.html.markdown
@@ -0,0 +1,56 @@
+---
+subcategory: "Lambda"
+layout: "aws"
+page_title: "AWS: aws_lambda_invocation"
+description: |-
+  Invoke AWS Lambda Function as data source
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_lambda_invocation
+
+Use this data source to invoke custom lambda functions as data source.
+The lambda function is invoked with [RequestResponse](https://docs.aws.amazon.com/lambda/latest/dg/API_Invoke.html#API_Invoke_RequestSyntax)
+invocation type.
+
+~> **NOTE:** If you get a `KMSAccessDeniedException: Lambda was unable to decrypt the environment variables because KMS access was denied` error when invoking an [`aws_lambda_function`](/docs/providers/aws/r/lambda_function.html) with environment variables, the IAM role associated with the function may have been deleted and recreated _after_ the function was created. You can fix the problem two ways: 1) updating the function's role to another role and then updating it back again to the recreated role, or 2) by using Terraform to `taint` the function and `apply` your configuration again to recreate the function. (When you create a function, Lambda grants permissions on the KMS key to the function's IAM role. If the IAM role is recreated, the grant is no longer valid. Changing the function's role or recreating the function causes Lambda to update the grant.)
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformOutput, Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_lambda_invocation import DataAwsLambdaInvocation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = DataAwsLambdaInvocation(self, "example",
+            function_name=lambda_function_test.function_name,
+            input="{\n  \"key1\": \"value1\",\n  \"key2\": \"value2\"\n}\n\n"
+        )
+        TerraformOutput(self, "result_entry",
+            value=Fn.lookup_nested(Fn.jsondecode(Token.as_string(example.result)), ["\"key1\""
+            ])
+        )
+```
+
+## Argument Reference
+
+* `function_name` - (Required) Name of the lambda function.
+* `input` - (Required) String in JSON format that is passed as payload to the lambda function.
+* `qualifier` - (Optional) Qualifier (a.k.a version) of the lambda function. Defaults
+ to `$LATEST`.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `result` - String result of the lambda function invocation.
+
+<!-- cache-key: cdktf-0.18.0 input-858416cde9289de24a6c4454bdaf3179b1c69d4515be797eefce2b9c352ef2b3 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/lambda_layer_version.html.markdown b/website/docs/cdktf/python/d/lambda_layer_version.html.markdown
new file mode 100644
index 00000000000..35d5f9872cc
--- /dev/null
+++ b/website/docs/cdktf/python/d/lambda_layer_version.html.markdown
@@ -0,0 +1,68 @@
+---
+subcategory: "Lambda"
+layout: "aws"
+page_title: "AWS: aws_lambda_layer_version"
+description: |-
+  Provides a Lambda Layer Version data source.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# aws_lambda_layer_version
+
+Provides information about a Lambda Layer Version.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import VariableType, TerraformVariable, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_lambda_layer_version import DataAwsLambdaLayerVersion
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        # Terraform Variables are not always the best fit for getting inputs in the context of Terraform CDK.
+        #     You can read more about this at https://cdk.tf/variables
+        layer_name = TerraformVariable(self, "layer_name",
+            type=VariableType.STRING
+        )
+        DataAwsLambdaLayerVersion(self, "existing",
+            layer_name=layer_name.string_value
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `layer_name` - (Required) Name of the lambda layer.
+* `version` - (Optional) Specific layer version. Conflicts with `compatible_runtime` and `compatible_architecture`. If omitted, the latest available layer version will be used.
+* `compatible_runtime` (Optional) Specific runtime the layer version must support. Conflicts with `version`. If specified, the latest available layer version supporting the provided runtime will be used.
+* `compatible_architecture` (Optional) Specific architecture the layer version could support. Conflicts with `version`. If specified, the latest available layer version supporting the provided architecture will be used.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `description` - Description of the specific Lambda Layer version.
+* `license_info` - License info associated with the specific Lambda Layer version.
+* `compatible_runtimes` - List of [Runtimes][1] the specific Lambda Layer version is compatible with.
+* `compatible_architectures` - A list of [Architectures][2] the specific Lambda Layer version is compatible with.
+* `arn` - ARN of the Lambda Layer with version.
+* `layer_arn` - ARN of the Lambda Layer without version.
+* `created_date` - Date this resource was created.
+* `signing_job_arn` - ARN of a signing job.
+* `signing_profile_version_arn` - The ARN for a signing profile version.
+* `source_code_hash` - Base64-encoded representation of raw SHA-256 sum of the zip file.
+* `source_code_size` - Size in bytes of the function .zip file.
+* `version` - This Lamba Layer version.
+
+[1]: https://docs.aws.amazon.com/lambda/latest/dg/API_GetLayerVersion.html#SSS-GetLayerVersion-response-CompatibleRuntimes
+[2]: https://docs.aws.amazon.com/lambda/latest/dg/API_GetLayerVersion.html#SSS-GetLayerVersion-response-CompatibleArchitectures
+
+<!-- cache-key: cdktf-0.18.0 input-69ef06c57b86008a1c6e25d93dabac271b612b904a1a89dbe3fd5507d10e6742 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/launch_configuration.html.markdown b/website/docs/cdktf/python/d/launch_configuration.html.markdown
new file mode 100644
index 00000000000..a11750ebf8e
--- /dev/null
+++ b/website/docs/cdktf/python/d/launch_configuration.html.markdown
@@ -0,0 +1,92 @@
+---
+subcategory: "Auto Scaling"
+layout: "aws"
+page_title: "AWS: aws_launch_configuration"
+description: |-
+  Provides a Launch Configuration data source.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_launch_configuration
+
+Provides information about a Launch Configuration.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_launch_configuration import DataAwsLaunchConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsLaunchConfiguration(self, "ubuntu",
+            name="test-launch-config"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name of the launch configuration.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the launch configuration.
+* `arn` - Amazon Resource Name of the launch configuration.
+* `name` - Name of the launch configuration.
+* `image_id` - EC2 Image ID of the instance.
+* `instance_type` - Instance Type of the instance to launch.
+* `iam_instance_profile` - The IAM Instance Profile to associate with launched instances.
+* `key_name` - Key Name that should be used for the instance.
+* `metadata_options` - Metadata options for the instance.
+    * `http_endpoint` - State of the metadata service: `enabled`, `disabled`.
+    * `http_tokens` - If session tokens are required: `optional`, `required`.
+    * `http_put_response_hop_limit` - The desired HTTP PUT response hop limit for instance metadata requests.
+* `security_groups` - List of associated Security Group IDS.
+* `associate_public_ip_address` - Whether a Public IP address is associated with the instance.
+* `user_data` - User Data of the instance.
+* `enable_monitoring` - Whether Detailed Monitoring is Enabled.
+* `ebs_optimized` - Whether the launched EC2 instance will be EBS-optimized.
+* `root_block_device` - Root Block Device of the instance.
+* `ebs_block_device` - EBS Block Devices attached to the instance.
+* `ephemeral_block_device` - The Ephemeral volumes on the instance.
+* `spot_price` - Price to use for reserving Spot instances.
+* `placement_tenancy` - Tenancy of the instance.
+
+`root_block_device` is exported with the following attributes:
+
+* `delete_on_termination` - Whether the EBS Volume will be deleted on instance termination.
+* `encrypted` - Whether the volume is Encrypted.
+* `iops` - Provisioned IOPs of the volume.
+* `throughput` - Throughput of the volume.
+* `volume_size` - Size of the volume.
+* `volume_type` - Type of the volume.
+
+`ebs_block_device` is exported with the following attributes:
+
+* `delete_on_termination` - Whether the EBS Volume will be deleted on instance termination.
+* `device_name` - Name of the device.
+* `encrypted` - Whether the volume is Encrypted.
+* `iops` - Provisioned IOPs of the volume.
+* `no_device` - Whether the device in the block device mapping of the AMI is suppressed.
+* `snapshot_id` - Snapshot ID of the mount.
+* `throughput` - Throughput of the volume.
+* `volume_size` - Size of the volume.
+* `volume_type` - Type of the volume.
+
+`ephemeral_block_device` is exported with the following attributes:
+
+* `device_name` - Name of the device.
+* `virtual_name` - Virtual Name of the device.
+
+<!-- cache-key: cdktf-0.18.0 input-e1cd93bfea359bae7e967acc82a26e1a08ef38531f91dbee6e143392ac081f6b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/launch_template.html.markdown b/website/docs/cdktf/python/d/launch_template.html.markdown
new file mode 100644
index 00000000000..1356cb2fbf2
--- /dev/null
+++ b/website/docs/cdktf/python/d/launch_template.html.markdown
@@ -0,0 +1,87 @@
+---
+subcategory: "EC2 (Elastic Compute Cloud)"
+layout: "aws"
+page_title: "AWS: aws_launch_template"
+description: |-
+  Provides a Launch Template data source.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_launch_template
+
+Provides information about a Launch Template.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_launch_template import DataAwsLaunchTemplate
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsLaunchTemplate(self, "default",
+            name="my-launch-template"
+        )
+```
+
+### Filter
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_launch_template import DataAwsLaunchTemplate
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsLaunchTemplate(self, "test",
+            filter=[DataAwsLaunchTemplateFilter(
+                name="launch-template-name",
+                values=["some-template"]
+            )
+            ]
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `filter` - (Optional) Configuration block(s) for filtering. Detailed below.
+* `id` - (Optional) ID of the specific launch template to retrieve.
+* `name` - (Optional) Name of the launch template.
+* `tags` - (Optional) Map of tags, each pair of which must exactly match a pair on the desired Launch Template.
+
+### filter Configuration Block
+
+The `filter` configuration block supports the following arguments:
+
+* `name` - (Required) Name of the filter field. Valid values can be found in the [EC2 DescribeLaunchTemplates API Reference](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeLaunchTemplates.html).
+* `values` - (Required) Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the launch template.
+
+This resource also exports a full set of attributes corresponding to the arguments of the [`aws_launch_template`](/docs/providers/aws/r/launch_template.html) resource.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `20m`)
+
+<!-- cache-key: cdktf-0.18.0 input-ac085ab2a2118f2f53ba9bc1952c11c28381c52f43860ff26cbf46d376ef67e8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/lb.html.markdown b/website/docs/cdktf/python/d/lb.html.markdown
new file mode 100644
index 00000000000..de1f2beae86
--- /dev/null
+++ b/website/docs/cdktf/python/d/lb.html.markdown
@@ -0,0 +1,72 @@
+---
+subcategory: "ELB (Elastic Load Balancing)"
+layout: "aws"
+page_title: "AWS: aws_lb"
+description: |-
+  Provides a Load Balancer data source.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_lb
+
+~> **Note:** `aws_alb` is known as `aws_lb`. The functionality is identical.
+
+Provides information about a Load Balancer.
+
+This data source can prove useful when a module accepts an LB as an input
+variable and needs to, for example, determine the security groups associated
+with it, etc.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import VariableType, TerraformVariable, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_lb import DataAwsLb
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        # Terraform Variables are not always the best fit for getting inputs in the context of Terraform CDK.
+        #     You can read more about this at https://cdk.tf/variables
+        lb_arn = TerraformVariable(self, "lb_arn",
+            default="",
+            type=VariableType.STRING
+        )
+        lb_name = TerraformVariable(self, "lb_name",
+            default="",
+            type=VariableType.STRING
+        )
+        DataAwsLb(self, "test",
+            arn=lb_arn.string_value,
+            name=lb_name.string_value
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `arn` - (Optional) Full ARN of the load balancer.
+* `name` - (Optional) Unique name of the load balancer.
+* `tags` - (Optional) Mapping of tags, each pair of which must exactly match a pair on the desired load balancer.
+
+~> **NOTE:** When both `arn` and `name` are specified, `arn` takes precedence. `tags` has lowest precedence.
+
+## Attribute Reference
+
+See the [LB Resource](/docs/providers/aws/r/lb.html) for details on the
+returned attributes - they are identical.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `20m`)
+
+<!-- cache-key: cdktf-0.18.0 input-d467ed08bca93285eac24021220c51e2af88e8f7994426dedafb4e67c7ce3e5a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/lb_hosted_zone_id.html.markdown b/website/docs/cdktf/python/d/lb_hosted_zone_id.html.markdown
new file mode 100644
index 00000000000..c9a7a7e9fe0
--- /dev/null
+++ b/website/docs/cdktf/python/d/lb_hosted_zone_id.html.markdown
@@ -0,0 +1,56 @@
+---
+subcategory: "ELB (Elastic Load Balancing)"
+layout: "aws"
+page_title: "AWS: aws_lb_hosted_zone_id"
+description: |-
+  Provides AWS Elastic Load Balancing Hosted Zone Id
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_lb_hosted_zone_id
+
+Use this data source to get the HostedZoneId of the AWS Elastic Load Balancing (ELB) in a given region for the purpose of using in an AWS Route53 Alias. Specify the ELB type (`network` or `application`) to return the relevant the associated HostedZoneId. Ref: [ELB service endpoints](https://docs.aws.amazon.com/general/latest/gr/elb.html#elb_region)
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_lb_hosted_zone_id import DataAwsLbHostedZoneId
+from imports.aws.route53_record import Route53Record
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        main = DataAwsLbHostedZoneId(self, "main")
+        Route53Record(self, "www",
+            alias=Route53RecordAlias(
+                evaluate_target_health=True,
+                name=Token.as_string(aws_lb_main.dns_name),
+                zone_id=Token.as_string(main.id)
+            ),
+            name="example.com",
+            type="A",
+            zone_id=primary.zone_id
+        )
+```
+
+## Argument Reference
+
+* `region` - (Optional) Name of the region whose AWS ELB HostedZoneId is desired.
+  Defaults to the region from the AWS provider configuration.
+
+* `load_balancer_type` - (Optional) Type of load balancer to create. Possible values are `application` or `network`. The default value is `application`.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the AWS ELB HostedZoneId in the selected region.
+
+<!-- cache-key: cdktf-0.18.0 input-20d3ff7ccd02c50f477bfaf817b623cdbb551c7595c79a649d2e2c4d5256df5a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/lb_listener.html.markdown b/website/docs/cdktf/python/d/lb_listener.html.markdown
new file mode 100644
index 00000000000..402732bf3f8
--- /dev/null
+++ b/website/docs/cdktf/python/d/lb_listener.html.markdown
@@ -0,0 +1,69 @@
+---
+subcategory: "ELB (Elastic Load Balancing)"
+layout: "aws"
+page_title: "AWS: aws_lb_listener"
+description: |-
+  Provides a Load Balancer Listener data source.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_lb_listener
+
+~> **Note:** `aws_alb_listener` is known as `aws_lb_listener`. The functionality is identical.
+
+Provides information about a Load Balancer Listener.
+
+This data source can prove useful when a module accepts an LB Listener as an input variable and needs to know the LB it is attached to, or other information specific to the listener in question.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import VariableType, TerraformVariable, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_lb import DataAwsLb
+from imports.aws.data_aws_lb_listener import DataAwsLbListener
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        # Terraform Variables are not always the best fit for getting inputs in the context of Terraform CDK.
+        #     You can read more about this at https://cdk.tf/variables
+        listener_arn = TerraformVariable(self, "listener_arn",
+            type=VariableType.STRING
+        )
+        selected = DataAwsLb(self, "selected",
+            name="default-public"
+        )
+        DataAwsLbListener(self, "listener",
+            arn=listener_arn.string_value
+        )
+        DataAwsLbListener(self, "selected443",
+            load_balancer_arn=Token.as_string(selected.arn),
+            port=443
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `arn` - (Optional) ARN of the listener. Required if `load_balancer_arn` and `port` is not set.
+* `load_balancer_arn` - (Optional) ARN of the load balancer. Required if `arn` is not set.
+* `port` - (Optional) Port of the listener. Required if `arn` is not set.
+
+## Attribute Reference
+
+See the [LB Listener Resource](/docs/providers/aws/r/lb_listener.html) for details on the returned attributes - they are identical.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `20m`)
+
+<!-- cache-key: cdktf-0.18.0 input-211bbf8f48d3f19292f3ee8b224115fe3e52e8fa4345ea857f3fb1459aff8016 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/lb_target_group.html.markdown b/website/docs/cdktf/python/d/lb_target_group.html.markdown
new file mode 100644
index 00000000000..3ec18805b2a
--- /dev/null
+++ b/website/docs/cdktf/python/d/lb_target_group.html.markdown
@@ -0,0 +1,72 @@
+---
+subcategory: "ELB (Elastic Load Balancing)"
+layout: "aws"
+page_title: "AWS: aws_lb_target_group"
+description: |-
+  Provides a Load Balancer Target Group data source.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_lb_target_group
+
+~> **Note:** `aws_alb_target_group` is known as `aws_lb_target_group`. The functionality is identical.
+
+Provides information about a Load Balancer Target Group.
+
+This data source can prove useful when a module accepts an LB Target Group as an
+input variable and needs to know its attributes. It can also be used to get the ARN of
+an LB Target Group for use in other resources, given LB Target Group name.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import VariableType, TerraformVariable, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_lb_target_group import DataAwsLbTargetGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        # Terraform Variables are not always the best fit for getting inputs in the context of Terraform CDK.
+        #     You can read more about this at https://cdk.tf/variables
+        lb_tg_arn = TerraformVariable(self, "lb_tg_arn",
+            default="",
+            type=VariableType.STRING
+        )
+        lb_tg_name = TerraformVariable(self, "lb_tg_name",
+            default="",
+            type=VariableType.STRING
+        )
+        DataAwsLbTargetGroup(self, "test",
+            arn=lb_tg_arn.string_value,
+            name=lb_tg_name.string_value
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `arn` - (Optional) Full ARN of the target group.
+* `name` - (Optional) Unique name of the target group.
+* `tags` - (Optional) Mapping of tags, each pair of which must exactly match a pair on the desired target group.
+
+~> **NOTE:** When both `arn` and `name` are specified, `arn` takes precedence. `tags` has the lowest precedence.
+
+## Attribute Reference
+
+See the [LB Target Group Resource](/docs/providers/aws/r/lb_target_group.html) for details
+on the returned attributes - they are identical.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `20m`)
+
+<!-- cache-key: cdktf-0.18.0 input-18d6438e76c4e840091b23075a92bb955f78f2636fef33c88e5dc205c842a9c5 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/lbs.html.markdown b/website/docs/cdktf/python/d/lbs.html.markdown
new file mode 100644
index 00000000000..365bf7613eb
--- /dev/null
+++ b/website/docs/cdktf/python/d/lbs.html.markdown
@@ -0,0 +1,52 @@
+---
+subcategory: "ELB (Elastic Load Balancing)"
+layout: "aws"
+page_title: "AWS: aws_lbs"
+description: |-
+    Data source for managing an AWS ELB (Elastic Load Balancing) Load Balancers.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_lbs
+
+Use this data source to get a list of Load Balancer ARNs matching the specified criteria. Useful for passing to other
+resources.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_lbs import DataAwsLbs
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsLbs(self, "example",
+            tags={
+                "elbv2.k8s.aws/cluster": "my-cluster"
+            }
+        )
+```
+
+## Argument Reference
+
+The following arguments are optional:
+
+* `tags` - (Optional) Map of tags, each pair of which must exactly match
+   a pair on the desired Load Balancers.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arns` - Set of Load Balancer ARNs.
+
+<!-- cache-key: cdktf-0.18.0 input-2b2d69eb4a83af0e4fd4598a4f15f892a66e64c59168aa5e187aabae838abca7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/lex_bot.html.markdown b/website/docs/cdktf/python/d/lex_bot.html.markdown
new file mode 100644
index 00000000000..943febf9c1e
--- /dev/null
+++ b/website/docs/cdktf/python/d/lex_bot.html.markdown
@@ -0,0 +1,63 @@
+---
+subcategory: "Lex Model Building"
+layout: "aws"
+page_title: "AWS: aws_lex_bot"
+description: |-
+  Provides details about a specific Lex Bot
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_lex_bot
+
+Provides details about a specific Amazon Lex Bot.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_lex_bot import DataAwsLexBot
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsLexBot(self, "order_flowers_bot",
+            name="OrderFlowers",
+            version="$LATEST"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name of the bot. The name is case sensitive.
+* `version` - (Optional) Version or alias of the bot.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the bot.
+* `checksum` - Checksum of the bot used to identify a specific revision of the bot's `$LATEST` version.
+* `child_directed` - If this Amazon Lex Bot is related to a website, program, or other application that is directed or targeted, in whole or in part, to children under age 13 and subject to COPPA.
+* `created_date` - Date that the bot was created.
+* `description` - Description of the bot.
+* `detect_sentiment` - When set to true user utterances are sent to Amazon Comprehend for sentiment analysis.
+* `enable_model_improvements` - Set to true if natural language understanding improvements are enabled.
+* `failure_reason` - If the `status` is `FAILED`, the reason why the bot failed to build.
+* `idle_session_ttl_in_seconds` - The maximum time in seconds that Amazon Lex retains the data gathered in a conversation.
+* `last_updated_date` - Date that the bot was updated.
+* `locale` - Target locale for the bot. Any intent used in the bot must be compatible with the locale of the bot.
+* `name` - Name of the bot, case sensitive.
+* `nlu_intent_confidence_threshold` - The threshold where Amazon Lex will insert the AMAZON.FallbackIntent, AMAZON.KendraSearchIntent, or both when returning alternative intents in a PostContent or PostText response. AMAZON.FallbackIntent and AMAZON.KendraSearchIntent are only inserted if they are configured for the bot.
+* `status` - Status of the bot.
+* `version` - Version of the bot. For a new bot, the version is always `$LATEST`.
+* `voice_id` - Amazon Polly voice ID that the Amazon Lex Bot uses for voice interactions with the user.
+
+<!-- cache-key: cdktf-0.18.0 input-5ef089ea17f3e167b9e877fe3394478af9b492a4da2e1d52a05076e5bbbba4a7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/lex_bot_alias.html.markdown b/website/docs/cdktf/python/d/lex_bot_alias.html.markdown
new file mode 100644
index 00000000000..a383d082a5a
--- /dev/null
+++ b/website/docs/cdktf/python/d/lex_bot_alias.html.markdown
@@ -0,0 +1,55 @@
+---
+subcategory: "Lex Model Building"
+layout: "aws"
+page_title: "AWS: aws_lex_bot_alias"
+description: |-
+  Provides details about a specific Lex Bot Alias
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_lex_bot_alias
+
+Provides details about a specific Amazon Lex Bot Alias.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_lex_bot_alias import DataAwsLexBotAlias
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsLexBotAlias(self, "order_flowers_prod",
+            bot_name="OrderFlowers",
+            name="OrderFlowersProd"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `bot_name` - (Required) Name of the bot.
+* `name` - (Required) Name of the bot alias. The name is case sensitive.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the bot alias.
+* `bot_name` - Name of the bot.
+* `bot_version` - Version of the bot that the alias points to.
+* `checksum` - Checksum of the bot alias.
+* `created_date` - Date that the bot alias was created.
+* `description` - Description of the alias.
+* `last_updated_date` - Date that the bot alias was updated. When you create a resource, the creation date and the last updated date are the same.
+* `name` - Name of the alias. The name is not case sensitive.
+
+<!-- cache-key: cdktf-0.18.0 input-d573a0e146ccf354bee54f1fcff29eb5da0fe86b28b2cac76717ab2331d57f06 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/lex_intent.html.markdown b/website/docs/cdktf/python/d/lex_intent.html.markdown
new file mode 100644
index 00000000000..3f3a4ec2e57
--- /dev/null
+++ b/website/docs/cdktf/python/d/lex_intent.html.markdown
@@ -0,0 +1,59 @@
+---
+subcategory: "Lex Model Building"
+layout: "aws"
+page_title: "AWS: aws_lex_intent"
+description: |-
+  Provides details about a specific Amazon Lex Intent
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_lex_intent
+
+Provides details about a specific Amazon Lex Intent.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_lex_intent import DataAwsLexIntent
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsLexIntent(self, "order_flowers",
+            name="OrderFlowers",
+            version="$LATEST"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name of the intent. The name is case sensitive.
+* `version` - (Optional) Version of the intent.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Lex intent.
+* `checksum` - Checksum identifying the version of the intent that was created. The checksum is not
+included as an argument because the resource will add it automatically when updating the intent.
+* `created_date` - Date when the intent version was created.
+* `description` - Description of the intent.
+* `last_updated_date` - Date when the $LATEST version of this intent was updated.
+* `name` - Name of the intent, not case sensitive.
+* `parent_intent_signature` - A unique identifier for the built-in intent to base this
+intent on. To find the signature for an intent, see
+[Standard Built-in Intents](https://developer.amazon.com/public/solutions/alexa/alexa-skills-kit/docs/built-in-intent-ref/standard-intents)
+in the Alexa Skills Kit.
+* `version` - Version of the bot.
+
+<!-- cache-key: cdktf-0.18.0 input-394febf4c4d3edc4f0f324ec428dd4c71cb4d4a42df62b636f04fd735f6f2cf7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/lex_slot_type.html.markdown b/website/docs/cdktf/python/d/lex_slot_type.html.markdown
new file mode 100644
index 00000000000..ca4234964dc
--- /dev/null
+++ b/website/docs/cdktf/python/d/lex_slot_type.html.markdown
@@ -0,0 +1,61 @@
+---
+subcategory: "Lex Model Building"
+layout: "aws"
+page_title: "AWS: aws_lex_slot_type"
+description: |-
+  Provides details about a specific Amazon Lex Slot Type
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_lex_slot_type
+
+Provides details about a specific Amazon Lex Slot Type.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_lex_slot_type import DataAwsLexSlotType
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsLexSlotType(self, "flower_types",
+            name="FlowerTypes",
+            version="1"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name of the slot type. The name is case sensitive.
+* `version` - (Optional) Version of the slot type.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `checksum` - Checksum identifying the version of the slot type that was created. The checksum is
+not included as an argument because the resource will add it automatically when updating the slot type.
+* `created_date` - Date when the slot type version was created.
+* `description` - Description of the slot type.
+* `enumeration_value` - Set of EnumerationValue objects that defines the values that
+the slot type can take. Each value can have a set of synonyms, which are additional values that help
+train the machine learning model about the values that it resolves for a slot.
+* `last_updated_date` - Date when the $LATEST version of this slot type was updated.
+* `name` - Name of the slot type. The name is not case sensitive.
+* `value_selection_strategy` - Determines the slot resolution strategy that Amazon Lex
+uses to return slot type values. `ORIGINAL_VALUE` returns the value entered by the user if the user
+value is similar to the slot value. `TOP_RESOLUTION` returns the first value in the resolution list
+if there is a resolution list for the slot, otherwise null is returned.
+* `version` - Version of the slot type.
+
+<!-- cache-key: cdktf-0.18.0 input-49d6a5803a0366ff33a06d9d299d17bb3b22f57aa09b8faad79c4b2c1781df65 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/licensemanager_grants.html.markdown b/website/docs/cdktf/python/d/licensemanager_grants.html.markdown
new file mode 100644
index 00000000000..1a7631d8538
--- /dev/null
+++ b/website/docs/cdktf/python/d/licensemanager_grants.html.markdown
@@ -0,0 +1,82 @@
+---
+subcategory: "License Manager"
+layout: "aws"
+page_title: "AWS: aws_licensemanager_grants"
+description: |-
+    Get information about a set of license manager grant licenses
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_licensemanager_grants
+
+This resource can be used to get a set of license grant ARNs matching a filter.
+
+## Example Usage
+
+The following shows getting all license grant ARNs granted to your account.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_caller_identity import DataAwsCallerIdentity
+from imports.aws.data_aws_licensemanager_grants import DataAwsLicensemanagerGrants
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        current = DataAwsCallerIdentity(self, "current")
+        DataAwsLicensemanagerGrants(self, "test",
+            filter=[DataAwsLicensemanagerGrantsFilter(
+                name="GranteePrincipalARN",
+                values=["arn:aws:iam::${" + current.account_id + "}:root"]
+            )
+            ]
+        )
+```
+
+## Argument Reference
+
+* `filter` - (Optional) Custom filter block as described below.
+
+More complex filters can be expressed using one or more `filter` sub-blocks,
+which take the following arguments:
+
+* `name` - (Required) Name of the field to filter by, as defined by
+  [the underlying AWS API](https://docs.aws.amazon.com/license-manager/latest/APIReference/API_ListReceivedGrants.html#API_ListReceivedGrants_RequestSyntax).
+  For example, if filtering using `ProductSKU`, use:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_licensemanager_grants import DataAwsLicensemanagerGrants
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsLicensemanagerGrants(self, "selected",
+            filter=[DataAwsLicensemanagerGrantsFilter(
+                name="ProductSKU",
+                values=[""]
+            )
+            ]
+        )
+```
+
+* `values` - (Required) Set of values that are accepted for the given field.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arns` - List of all the license grant ARNs found.
+
+<!-- cache-key: cdktf-0.18.0 input-9865dc418cc55462aa5e6fc80f9e8a92e3c35a931c3b06a21d23c361cfa3f823 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/licensemanager_received_license.html.markdown b/website/docs/cdktf/python/d/licensemanager_received_license.html.markdown
new file mode 100644
index 00000000000..70bc3781878
--- /dev/null
+++ b/website/docs/cdktf/python/d/licensemanager_received_license.html.markdown
@@ -0,0 +1,121 @@
+---
+subcategory: "License Manager"
+layout: "aws"
+page_title: "AWS: aws_licensemanager_received_license"
+description: |-
+    Get information about a set of license manager received license
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_licensemanager_received_license
+
+This resource can be used to get data on a received license using an ARN. This can be helpful for pulling in data on a license from the AWS marketplace and sharing that license with another account.
+
+## Example Usage
+
+The following shows getting the received license data using and ARN.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_licensemanager_received_license import DataAwsLicensemanagerReceivedLicense
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsLicensemanagerReceivedLicense(self, "test",
+            license_arn="arn:aws:license-manager::111111111111:license:l-ecbaa94eb71a4830b6d7e49268fecaa0"
+        )
+```
+
+## Argument Reference
+
+* `license_arn` - (Required) The ARN of the received license you want data for.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - The received license ARN (Same as: `license_arn`).
+* `beneficiary` - Granted license beneficiary. This is in the form of the ARN of the root user of the account.
+* `consumption_configuration` - Configuration for consumption of the license. [Detailed below](#consumption_configuration)
+* `create_time` - Creation time of the granted license in RFC 3339 format.
+* `entitlements` - License entitlements. [Detailed below](#entitlements)
+* `home_region` - Home Region of the granted license.
+* `issuer` - Granted license issuer. [Detailed below](#issuer)
+* `license_arn` - Amazon Resource Name (ARN) of the license.
+* `license_metadata`- Granted license metadata. This is in the form of a set of all meta data. [Detailed below](#license_metadata)
+* `license_name` - License name.
+* `product_name` - Product name.
+* `product_sku ` - Product SKU.
+* `received_metadata` - Granted license received metadata. [Detailed below](#received_metadata)
+* `status` - Granted license status.
+* `validity` - Date and time range during which the granted license is valid, in ISO8601-UTC format. [Detailed below](#validity)
+* `version` - Version of the granted license.
+
+### consumption_configuration
+
+* `borrow_configuration` - Details about a borrow configuration. [Detailed below](#borrow_configuration)
+* `provisional_configuration` - Details about a provisional configuration. [Detailed below](#provisional_configuration)
+* `renewal_frequency` - Renewal frequency.
+
+#### borrow_configuration
+
+A list with a single map.
+
+* `allow_early_check_in` - Indicates whether early check-ins are allowed.
+* `max_time_to_live_in_minutes` - Maximum time for the borrow configuration, in minutes.
+
+#### provisional_configuration
+
+A list with a single map.
+
+* `max_time_to_live_in_minutes` - Maximum time for the provisional configuration, in minutes.
+
+### entitlements
+
+A list with a single map.
+
+* `allow_check_in` - Indicates whether check-ins are allowed.
+* `max_count` - Maximum entitlement count. Use if the unit is not None.
+* `name` - Entitlement name.
+* `overage` - Indicates whether overages are allowed.
+* `unit` - Entitlement unit.
+* `value` - Entitlement resource. Use only if the unit is None.
+
+### issuer
+
+A list with a single map.
+
+* `key_fingerprint` - Issuer key fingerprint.
+* `name` - Issuer name.
+* `sign_key` - Asymmetric KMS key from AWS Key Management Service. The KMS key must have a key usage of sign and verify, and support the RSASSA-PSS SHA-256 signing algorithm.
+
+### license_metadata
+
+Each metadata item will have the following attributes.
+
+* `name` - The key name.
+* `value` - The value.
+
+### received_metadata
+
+A list with a single map.
+
+* `allowed_operations` - A list of allowed operations.
+* `received_status` - Received status.
+* `received_status_reason` - Received status reason.
+
+### validity
+
+A list with a single map.
+
+* `begin` - Start of the validity time range.
+* `end` - End of the validity time range.
+
+<!-- cache-key: cdktf-0.18.0 input-8e7789e1a13e838a8446f36566c96cb32c65c9068530cd596b7f17f7e9d88382 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/licensemanager_received_licenses.html.markdown b/website/docs/cdktf/python/d/licensemanager_received_licenses.html.markdown
new file mode 100644
index 00000000000..ad274a625c9
--- /dev/null
+++ b/website/docs/cdktf/python/d/licensemanager_received_licenses.html.markdown
@@ -0,0 +1,80 @@
+---
+subcategory: "License Manager"
+layout: "aws"
+page_title: "AWS: aws_licensemanager_received_licenses"
+description: |-
+    Get information about a set of license manager received licenses
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_licensemanager_received_licenses
+
+This resource can be used to get a set of license ARNs matching a filter.
+
+## Example Usage
+
+The following shows getting all license ARNs issued from the AWS marketplace. Providing no filter, would provide all license ARNs for the entire account.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_licensemanager_received_licenses import DataAwsLicensemanagerReceivedLicenses
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsLicensemanagerReceivedLicenses(self, "test",
+            filter=[DataAwsLicensemanagerReceivedLicensesFilter(
+                name="IssuerName",
+                values=["AWS/Marketplace"]
+            )
+            ]
+        )
+```
+
+## Argument Reference
+
+* `filter` - (Optional) Custom filter block as described below.
+
+More complex filters can be expressed using one or more `filter` sub-blocks,
+which take the following arguments:
+
+* `name` - (Required) Name of the field to filter by, as defined by
+  [the underlying AWS API](https://docs.aws.amazon.com/license-manager/latest/APIReference/API_ListReceivedLicenses.html#API_ListReceivedLicenses_RequestSyntax).
+  For example, if filtering using `ProductSKU`, use:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_licensemanager_received_licenses import DataAwsLicensemanagerReceivedLicenses
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsLicensemanagerReceivedLicenses(self, "selected",
+            filter=[DataAwsLicensemanagerReceivedLicensesFilter(
+                name="ProductSKU",
+                values=[""]
+            )
+            ]
+        )
+```
+
+* `values` - (Required) Set of values that are accepted for the given field.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arns` - List of all the license ARNs found.
+
+<!-- cache-key: cdktf-0.18.0 input-9e7d7fb591954c8a5486067c8e8ee9eec8da84299f8bb0a76f259725c8df90f0 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/location_geofence_collection.html.markdown b/website/docs/cdktf/python/d/location_geofence_collection.html.markdown
new file mode 100644
index 00000000000..979468d45b4
--- /dev/null
+++ b/website/docs/cdktf/python/d/location_geofence_collection.html.markdown
@@ -0,0 +1,53 @@
+---
+subcategory: "Location"
+layout: "aws"
+page_title: "AWS: aws_location_geofence_collection"
+description: |-
+    Retrieve information about a Location Service Geofence Collection.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_location_geofence_collection
+
+Retrieve information about a Location Service Geofence Collection.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_location_geofence_collection import DataAwsLocationGeofenceCollection
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsLocationGeofenceCollection(self, "example",
+            collection_name="example"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `collection_name` - (Required) Name of the geofence collection.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `collection_arn` - ARN for the geofence collection resource. Used when you need to specify a resource across all AWS.
+* `create_time` - Timestamp for when the geofence collection resource was created in ISO 8601 format.
+* `description` - Optional description of the geofence collection resource.
+* `kms_key_id` - Key identifier for an AWS KMS customer managed key assigned to the Amazon Location resource.
+* `tags` - Key-value map of resource tags for the geofence collection.
+* `update_time` - Timestamp for when the geofence collection resource was last updated in ISO 8601 format.
+
+<!-- cache-key: cdktf-0.18.0 input-412ec3161f32c61f58d8cc16f05d87cad980bf218e02a4e45e733843b249c8a5 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/location_map.html.markdown b/website/docs/cdktf/python/d/location_map.html.markdown
new file mode 100644
index 00000000000..1e61c59e578
--- /dev/null
+++ b/website/docs/cdktf/python/d/location_map.html.markdown
@@ -0,0 +1,50 @@
+---
+subcategory: "Location"
+layout: "aws"
+page_title: "AWS: aws_location_map"
+description: |-
+    Retrieve information about a Location Service Map.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_location_map
+
+Retrieve information about a Location Service Map.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_location_map import DataAwsLocationMap
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsLocationMap(self, "example",
+            map_name="example"
+        )
+```
+
+## Argument Reference
+
+* `map_name` - (Required) Name of the map resource.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `configuration` - List of configurations that specify the map tile style selected from a partner data provider.
+    * `style` - The map style selected from an available data provider.
+* `create_time` - Timestamp for when the map resource was created in ISO 8601 format.
+* `description` - Optional description for the map resource.
+* `map_arn` - ARN for the map resource.
+* `tags` - Key-value map of resource tags for the map.
+* `update_time` - Timestamp for when the map resource was last updated in ISO 8601 format.
+
+<!-- cache-key: cdktf-0.18.0 input-0b7e671677f6b40d5b7e281bcc7a2f6d4c9948b32cc48282e4c534b54ca5d4c4 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/location_place_index.html.markdown b/website/docs/cdktf/python/d/location_place_index.html.markdown
new file mode 100644
index 00000000000..7bc575a4398
--- /dev/null
+++ b/website/docs/cdktf/python/d/location_place_index.html.markdown
@@ -0,0 +1,50 @@
+---
+subcategory: "Location"
+layout: "aws"
+page_title: "AWS: aws_location_place_index"
+description: |-
+    Retrieve information about a Location Service Place Index.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_location_place_index
+
+Retrieve information about a Location Service Place Index.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_location_place_index import DataAwsLocationPlaceIndex
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsLocationPlaceIndex(self, "example",
+            index_name="example"
+        )
+```
+
+## Argument Reference
+
+* `index_name` - (Required) Name of the place index resource.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `create_time` - Timestamp for when the place index resource was created in ISO 8601 format.
+* `data_source` - Data provider of geospatial data.
+* `data_source_configuration` - List of configurations that specify data storage option for requesting Places.
+* `description` - Optional description for the place index resource.
+* `index_arn` - ARN for the place index resource.
+* `tags` - Key-value map of resource tags for the place index.
+* `update_time` - Timestamp for when the place index resource was last updated in ISO 8601 format.
+
+<!-- cache-key: cdktf-0.18.0 input-6bb9def3cfd4a1197d25303ba5cc4f3cedb296a92274d37e9697b77dc7cadbf8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/location_route_calculator.html.markdown b/website/docs/cdktf/python/d/location_route_calculator.html.markdown
new file mode 100644
index 00000000000..5c985548db4
--- /dev/null
+++ b/website/docs/cdktf/python/d/location_route_calculator.html.markdown
@@ -0,0 +1,49 @@
+---
+subcategory: "Location"
+layout: "aws"
+page_title: "AWS: aws_location_route_calculator"
+description: |-
+    Retrieve information about a Location Service Route Calculator.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_location_route_calculator
+
+Retrieve information about a Location Service Route Calculator.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_location_route_calculator import DataAwsLocationRouteCalculator
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsLocationRouteCalculator(self, "example",
+            calculator_name="example"
+        )
+```
+
+## Argument Reference
+
+* `calculator_name` - (Required) Name of the route calculator resource.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `calculator_arn` - ARN for the Route calculator resource. Use the ARN when you specify a resource across AWS.
+* `create_time` - Timestamp for when the route calculator resource was created in ISO 8601 format.
+* `data_source` - Data provider of traffic and road network data.
+* `description` - Optional description of the route calculator resource.
+* `tags` - Key-value map of resource tags for the route calculator.
+* `update_time` - Timestamp for when the route calculator resource was last updated in ISO 8601 format.
+
+<!-- cache-key: cdktf-0.18.0 input-dbfd8c367adb84b100d0300c89a12d823bcce0e79dfac69eed691750faab5b7b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/location_tracker.html.markdown b/website/docs/cdktf/python/d/location_tracker.html.markdown
new file mode 100644
index 00000000000..9dd9ecf7a92
--- /dev/null
+++ b/website/docs/cdktf/python/d/location_tracker.html.markdown
@@ -0,0 +1,50 @@
+---
+subcategory: "Location"
+layout: "aws"
+page_title: "AWS: aws_location_tracker"
+description: |-
+    Retrieve information about a Location Service Tracker.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_location_tracker
+
+Retrieve information about a Location Service Tracker.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_location_tracker import DataAwsLocationTracker
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsLocationTracker(self, "example",
+            tracker_name="example"
+        )
+```
+
+## Argument Reference
+
+* `tracker_name` - (Required) Name of the tracker resource.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `create_time` - Timestamp for when the tracker resource was created in ISO 8601 format.
+* `description` - Optional description for the tracker resource.
+* `kms_key_id` - Key identifier for an AWS KMS customer managed key assigned to the Amazon Location resource.
+* `position_filtering` - Position filtering method of the tracker resource.
+* `tags` - Key-value map of resource tags for the tracker.
+* `tracker_arn` - ARN for the tracker resource. Used when you need to specify a resource across all AWS.
+* `update_time` - Timestamp for when the tracker resource was last updated in ISO 8601 format.
+
+<!-- cache-key: cdktf-0.18.0 input-2209c57d7bd3b53aad44711d9b9e303cfc1662ea048bfb66d4abc6ef0052fc42 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/location_tracker_association.html.markdown b/website/docs/cdktf/python/d/location_tracker_association.html.markdown
new file mode 100644
index 00000000000..d441bd6afb3
--- /dev/null
+++ b/website/docs/cdktf/python/d/location_tracker_association.html.markdown
@@ -0,0 +1,48 @@
+---
+subcategory: "Location"
+layout: "aws"
+page_title: "AWS: aws_location_tracker_association"
+description: |-
+    Retrieve information about a Location Service Tracker Association.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_location_tracker_association
+
+Retrieve information about a Location Service Tracker Association.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_location_tracker_association import DataAwsLocationTrackerAssociation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsLocationTrackerAssociation(self, "example",
+            consumer_arn="arn:aws:geo:region:account-id:geofence-collection/ExampleGeofenceCollectionConsumer",
+            tracker_name="example"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `consumer_arn` - (Required) ARN of the geofence collection associated to tracker resource.
+* `tracker_name` - (Required) Name of the tracker resource associated with a geofence collection.
+
+## Attribute Reference
+
+This data source exports no additional attributes.
+
+<!-- cache-key: cdktf-0.18.0 input-6af42e44615a0ca8da0850e3473b78cfb0b5edd6184e26e8d3695a1276214a1c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/location_tracker_associations.html.markdown b/website/docs/cdktf/python/d/location_tracker_associations.html.markdown
new file mode 100644
index 00000000000..07423d98977
--- /dev/null
+++ b/website/docs/cdktf/python/d/location_tracker_associations.html.markdown
@@ -0,0 +1,48 @@
+---
+subcategory: "Location"
+layout: "aws"
+page_title: "AWS: aws_location_tracker_associations"
+description: |-
+    Retrieve information about Location Service Tracker Associations.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_location_tracker_associations
+
+Retrieve information about Location Service Tracker Associations.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_location_tracker_associations import DataAwsLocationTrackerAssociations
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsLocationTrackerAssociations(self, "example",
+            tracker_name="example"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `tracker_name` - (Required) Name of the tracker resource associated with a geofence collection.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `consumer_arns` - List of geofence collection ARNs associated to the tracker resource.
+
+<!-- cache-key: cdktf-0.18.0 input-985e01b9b103d7b11889f5262870dbe1204cdfd00040b816e3dccd74a599b9b9 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/media_convert_queue.html.markdown b/website/docs/cdktf/python/d/media_convert_queue.html.markdown
new file mode 100644
index 00000000000..b63681f29de
--- /dev/null
+++ b/website/docs/cdktf/python/d/media_convert_queue.html.markdown
@@ -0,0 +1,47 @@
+---
+subcategory: "Elemental MediaConvert"
+layout: "aws"
+page_title: "AWS: aws_media_convert_queue"
+description: |-
+  Retrieve information about a AWS Elemental MediaConvert Queue.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_media_convert_queue
+
+Retrieve information about a AWS Elemental MediaConvert Queue.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_media_convert_queue import DataAwsMediaConvertQueue
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsMediaConvertQueue(self, "example",
+            id="tf-example-queue"
+        )
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `id` - (Required) Unique identifier of the queue. The same as `name`.
+
+## Attributes Reference
+
+* `arn` - The Arn of the queue.
+* `name` - The same as `id`.
+* `status` - The status of the queue.
+* `tags` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+<!-- cache-key: cdktf-0.18.0 input-cea02305ec5fbfab04de63ece53105b1232b24f60ce5c0d4c7c6b87963855d23 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/memorydb_acl.html.markdown b/website/docs/cdktf/python/d/memorydb_acl.html.markdown
new file mode 100644
index 00000000000..0c75fa885e1
--- /dev/null
+++ b/website/docs/cdktf/python/d/memorydb_acl.html.markdown
@@ -0,0 +1,50 @@
+---
+subcategory: "MemoryDB for Redis"
+layout: "aws"
+page_title: "AWS: aws_memorydb_acl"
+description: |-
+  Provides information about a MemoryDB ACL.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_memorydb_acl
+
+Provides information about a MemoryDB ACL.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_memorydb_acl import DataAwsMemorydbAcl
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsMemorydbAcl(self, "example",
+            name="my-acl"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) Name of the ACL.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - Name of the ACL.
+* `arn` - ARN of the ACL.
+* `minimum_engine_version` - The minimum engine version supported by the ACL.
+* `tags` - Map of tags assigned to the ACL.
+* `user_names` - Set of MemoryDB user names included in this ACL.
+
+<!-- cache-key: cdktf-0.18.0 input-dae65be976707896a0ccf5394e359974398040d0921bfad084e1f4c241a2a529 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/memorydb_cluster.html.markdown b/website/docs/cdktf/python/d/memorydb_cluster.html.markdown
new file mode 100644
index 00000000000..e5fd5a85fea
--- /dev/null
+++ b/website/docs/cdktf/python/d/memorydb_cluster.html.markdown
@@ -0,0 +1,82 @@
+---
+subcategory: "MemoryDB for Redis"
+layout: "aws"
+page_title: "AWS: aws_memorydb_cluster"
+description: |-
+  Provides information about a MemoryDB Cluster.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_memorydb_cluster
+
+Provides information about a MemoryDB Cluster.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_memorydb_cluster import DataAwsMemorydbCluster
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsMemorydbCluster(self, "example",
+            name="my-cluster"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) Name of the cluster.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - Same as `name`.
+* `arn` - ARN of the cluster.
+* `acl_name` - Name of the Access Control List associated with the cluster.
+* `auto_minor_version_upgrade` - True when the cluster allows automatic minor version upgrades.
+* `cluster_endpoint`
+    * `address` - DNS hostname of the cluster configuration endpoint.
+    * `port` - Port number that the cluster configuration endpoint is listening on.
+* `data_tiering` - True when data tiering is enabled.
+* `description` - Description for the cluster.
+* `engine_patch_version` - Patch version number of the Redis engine used by the cluster.
+* `engine_version` - Version number of the Redis engine used by the cluster.
+* `final_snapshot_name` - Name of the final cluster snapshot to be created when this resource is deleted. If omitted, no final snapshot will be made.
+* `kms_key_arn` - ARN of the KMS key used to encrypt the cluster at rest.
+* `maintenance_window` - Weekly time range during which maintenance on the cluster is performed. Specify as a range in the format `ddd:hh24:mi-ddd:hh24:mi` (24H Clock UTC). Example: `sun:23:00-mon:01:30`.
+* `node_type` - Compute and memory capacity of the nodes in the cluster.
+* `num_replicas_per_shard` - The number of replicas to apply to each shard.
+* `num_shards` - Number of shards in the cluster.
+* `parameter_group_name` - The name of the parameter group associated with the cluster.
+* `port` - Port number on which each of the nodes accepts connections.
+* `security_group_ids` - Set of VPC Security Group ID-s associated with this cluster.
+* `shards` - Set of shards in this cluster.
+    * `name` - Name of this shard.
+    * `num_nodes` - Number of individual nodes in this shard.
+    * `slots` - Keyspace for this shard. Example: `0-16383`.
+    * `nodes` - Set of nodes in this shard.
+        * `availability_zone` - The Availability Zone in which the node resides.
+        * `create_time` - The date and time when the node was created. Example: `2022-01-01T21:00:00Z`.
+        * `name` - Name of this node.
+        * `endpoint`
+            * `address` - DNS hostname of the node.
+            * `port` - Port number that this node is listening on.
+* `snapshot_retention_limit` - The number of days for which MemoryDB retains automatic snapshots before deleting them. When set to `0`, automatic backups are disabled.
+* `snapshot_window` - Daily time range (in UTC) during which MemoryDB begins taking a daily snapshot of your shard. Example: `05:00-09:00`.
+* `sns_topic_arn` - ARN of the SNS topic to which cluster notifications are sent.
+* `subnet_group_name` -The name of the subnet group used for the cluster.
+* `tls_enabled` - When true, in-transit encryption is enabled for the cluster.
+* `tags` - Map of tags assigned to the cluster.
+
+<!-- cache-key: cdktf-0.18.0 input-60661a32615a44866629e2e9ffadb0c1a33a84edf7060e982e9bec51eec4491d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/memorydb_parameter_group.html.markdown b/website/docs/cdktf/python/d/memorydb_parameter_group.html.markdown
new file mode 100644
index 00000000000..77fa96f09fa
--- /dev/null
+++ b/website/docs/cdktf/python/d/memorydb_parameter_group.html.markdown
@@ -0,0 +1,53 @@
+---
+subcategory: "MemoryDB for Redis"
+layout: "aws"
+page_title: "AWS: aws_memorydb_parameter_group"
+description: |-
+  Provides information about a MemoryDB Parameter Group.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_memorydb_parameter_group
+
+Provides information about a MemoryDB Parameter Group.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_memorydb_parameter_group import DataAwsMemorydbParameterGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsMemorydbParameterGroup(self, "example",
+            name="my-parameter-group"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) Name of the parameter group.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - Name of the parameter group.
+* `arn` - ARN of the parameter group.
+* `description` - Description of the parameter group.
+* `family` - Engine version that the parameter group can be used with.
+* `parameter` - Set of user-defined MemoryDB parameters applied by the parameter group.
+    * `name` - Name of the parameter.
+    * `value` - Value of the parameter.
+* `tags` - Map of tags assigned to the parameter group.
+
+<!-- cache-key: cdktf-0.18.0 input-6ec5269ca86a0a1f8a702b357b9c477514195db733966e31d166353ba6ee15e5 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/memorydb_snapshot.html.markdown b/website/docs/cdktf/python/d/memorydb_snapshot.html.markdown
new file mode 100644
index 00000000000..7cb01b9177c
--- /dev/null
+++ b/website/docs/cdktf/python/d/memorydb_snapshot.html.markdown
@@ -0,0 +1,65 @@
+---
+subcategory: "MemoryDB for Redis"
+layout: "aws"
+page_title: "AWS: aws_memorydb_snapshot"
+description: |-
+  Provides information about a MemoryDB Snapshot.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_memorydb_snapshot
+
+Provides information about a MemoryDB Snapshot.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_memorydb_snapshot import DataAwsMemorydbSnapshot
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsMemorydbSnapshot(self, "example",
+            name="my-snapshot"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) Name of the snapshot.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - Name of the snapshot.
+* `arn` - ARN of the snapshot.
+* `cluster_configuration` - The configuration of the cluster from which the snapshot was taken.
+    * `description` - Description for the cluster.
+    * `engine_version` - Version number of the Redis engine used by the cluster.
+    * `maintenance_window` - The weekly time range during which maintenance on the cluster is performed.
+    * `name` - Name of the cluster.
+    * `node_type` - Compute and memory capacity of the nodes in the cluster.
+    * `num_shards` - Number of shards in the cluster.
+    * `parameter_group_name` - Name of the parameter group associated with the cluster.
+    * `port` - Port number on which the cluster accepts connections.
+    * `snapshot_retention_limit` - Number of days for which MemoryDB retains automatic snapshots before deleting them.
+    * `snapshot_window` - The daily time range (in UTC) during which MemoryDB begins taking a daily snapshot of the shard.
+    * `subnet_group_name` - Name of the subnet group used by the cluster.
+    * `topic_arn` - ARN of the SNS topic to which cluster notifications are sent.
+    * `vpc_id` - The VPC in which the cluster exists.
+* `cluster_name` - Name of the MemoryDB cluster that this snapshot was taken from.
+* `kms_key_arn` - ARN of the KMS key used to encrypt the snapshot at rest.
+* `source` - Whether the snapshot is from an automatic backup (`automated`) or was created manually (`manual`).
+* `tags` - Map of tags assigned to the snapshot.
+
+<!-- cache-key: cdktf-0.18.0 input-62f791c7099ad6e3e06f89ea492109f2285d5d4a23f2005bec9ce21b57cd5349 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/memorydb_subnet_group.html.markdown b/website/docs/cdktf/python/d/memorydb_subnet_group.html.markdown
new file mode 100644
index 00000000000..65098cce284
--- /dev/null
+++ b/website/docs/cdktf/python/d/memorydb_subnet_group.html.markdown
@@ -0,0 +1,51 @@
+---
+subcategory: "MemoryDB for Redis"
+layout: "aws"
+page_title: "AWS: aws_memorydb_subnet_group"
+description: |-
+  Provides information about a MemoryDB Subnet Group.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_memorydb_subnet_group
+
+Provides information about a MemoryDB Subnet Group.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_memorydb_subnet_group import DataAwsMemorydbSubnetGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsMemorydbSubnetGroup(self, "example",
+            name="my-subnet-group"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) Name of the subnet group.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - Name of the subnet group.
+* `arn` - ARN of the subnet group.
+* `description` - Description of the subnet group.
+* `subnet_ids` - Set of VPC Subnet ID-s of the subnet group.
+* `vpc_id` - VPC in which the subnet group exists.
+* `tags` - Map of tags assigned to the subnet group.
+
+<!-- cache-key: cdktf-0.18.0 input-a2199a4dfc692ac39b45aee765d1dc366111874bffd60dc24a73443b21e9d7d0 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/memorydb_user.html.markdown b/website/docs/cdktf/python/d/memorydb_user.html.markdown
new file mode 100644
index 00000000000..b90946b8c86
--- /dev/null
+++ b/website/docs/cdktf/python/d/memorydb_user.html.markdown
@@ -0,0 +1,53 @@
+---
+subcategory: "MemoryDB for Redis"
+layout: "aws"
+page_title: "AWS: aws_memorydb_user"
+description: |-
+  Provides information about a MemoryDB User.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_memorydb_user
+
+Provides information about a MemoryDB User.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_memorydb_user import DataAwsMemorydbUser
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsMemorydbUser(self, "example",
+            user_name="my-user"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `user_name` - (Required) Name of the user.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - Name of the user.
+* `access_string` - Access permissions string used for this user.
+* `arn` - ARN of the user.
+* `authentication_mode` - Denotes the user's authentication properties.
+    * `password_count` - The number of passwords belonging to the user.
+    * `type` - Whether the user requires a password to authenticate.
+* `minimum_engine_version` - The minimum engine version supported for the user.
+* `tags` - Map of tags assigned to the subnet group.
+
+<!-- cache-key: cdktf-0.18.0 input-c6f19bc84dfa577edf03fcc5ca3f615821c417f424a780c64de232dacc41af5a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/mq_broker.html.markdown b/website/docs/cdktf/python/d/mq_broker.html.markdown
new file mode 100644
index 00000000000..49b0547b054
--- /dev/null
+++ b/website/docs/cdktf/python/d/mq_broker.html.markdown
@@ -0,0 +1,59 @@
+---
+subcategory: "MQ"
+layout: "aws"
+page_title: "AWS: aws_mq_broker"
+description: |-
+  Provides a MQ Broker data source.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_mq_broker
+
+Provides information about a MQ Broker.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import VariableType, TerraformVariable, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_mq_broker import DataAwsMqBroker
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        # Terraform Variables are not always the best fit for getting inputs in the context of Terraform CDK.
+        #     You can read more about this at https://cdk.tf/variables
+        broker_id = TerraformVariable(self, "broker_id",
+            default="",
+            type=VariableType.STRING
+        )
+        broker_name = TerraformVariable(self, "broker_name",
+            default="",
+            type=VariableType.STRING
+        )
+        DataAwsMqBroker(self, "by_id",
+            broker_id=broker_id.string_value
+        )
+        DataAwsMqBroker(self, "by_name",
+            broker_name=broker_name.string_value
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `broker_id` - (Optional) Unique id of the mq broker.
+* `broker_name` - (Optional) Unique name of the mq broker.
+
+## Attribute Reference
+
+See the [`aws_mq_broker` resource](/docs/providers/aws/r/mq_broker.html) for details on the returned attributes.
+They are identical except for user password, which is not returned when describing broker.
+
+<!-- cache-key: cdktf-0.18.0 input-0e3d67694c8c62cd91f39eb11d121ea946f8feb6536315ac989e72cb171c80c6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/mq_broker_instance_type_offerings.html.markdown b/website/docs/cdktf/python/d/mq_broker_instance_type_offerings.html.markdown
new file mode 100644
index 00000000000..946a15e44da
--- /dev/null
+++ b/website/docs/cdktf/python/d/mq_broker_instance_type_offerings.html.markdown
@@ -0,0 +1,73 @@
+---
+subcategory: "MQ"
+layout: "aws"
+page_title: "AWS: aws_mq_broker_instance_type_offerings"
+description: |-
+  Provides a MQ Broker Instance Offerings data source.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_mq_broker_instance_type_offerings
+
+Provides information about a MQ Broker Instance Offerings.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_mq_broker_instance_type_offerings import DataAwsMqBrokerInstanceTypeOfferings
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsMqBrokerInstanceTypeOfferings(self, "all",
+            engine_type="ACTIVEMQ",
+            host_instance_type="mq.m5.large",
+            storage_type="EBS"
+        )
+        DataAwsMqBrokerInstanceTypeOfferings(self, "empty")
+        DataAwsMqBrokerInstanceTypeOfferings(self, "engine",
+            engine_type="ACTIVEMQ"
+        )
+        DataAwsMqBrokerInstanceTypeOfferings(self, "instance",
+            host_instance_type="mq.m5.large"
+        )
+        DataAwsMqBrokerInstanceTypeOfferings(self, "storage",
+            storage_type="EBS"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `engine_type` - (Optional) Filter response by engine type.
+* `host_instance_type` - (Optional) Filter response by host instance type.
+* `storage_type` - (Optional) Filter response by storage type.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `broker_instance_options` -  Option for host instance type. See Broker Instance Options below.
+
+### Broker Instance Options
+
+* `availability_zones` - List of available AZs. See Availability Zones. below
+* `engine_type` - Broker's engine type.
+* `host_instance_type` - Broker's instance type.
+* `storage_type` - Broker's storage type.
+* `supported_deployment_modes` - The list of supported deployment modes.
+* `supported_engine_versions` - The list of supported engine versions.
+
+### Availability Zones
+
+* `name` - Name of the Availability Zone.
+
+<!-- cache-key: cdktf-0.18.0 input-af7521896e903be08788f223edcfd27a267b313cdf4f21d6ea836a2e3f3e7984 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/mq_broker_instance_type_offerings.markdown b/website/docs/cdktf/python/d/mq_broker_instance_type_offerings.markdown
new file mode 100644
index 00000000000..946a15e44da
--- /dev/null
+++ b/website/docs/cdktf/python/d/mq_broker_instance_type_offerings.markdown
@@ -0,0 +1,73 @@
+---
+subcategory: "MQ"
+layout: "aws"
+page_title: "AWS: aws_mq_broker_instance_type_offerings"
+description: |-
+  Provides a MQ Broker Instance Offerings data source.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_mq_broker_instance_type_offerings
+
+Provides information about a MQ Broker Instance Offerings.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_mq_broker_instance_type_offerings import DataAwsMqBrokerInstanceTypeOfferings
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsMqBrokerInstanceTypeOfferings(self, "all",
+            engine_type="ACTIVEMQ",
+            host_instance_type="mq.m5.large",
+            storage_type="EBS"
+        )
+        DataAwsMqBrokerInstanceTypeOfferings(self, "empty")
+        DataAwsMqBrokerInstanceTypeOfferings(self, "engine",
+            engine_type="ACTIVEMQ"
+        )
+        DataAwsMqBrokerInstanceTypeOfferings(self, "instance",
+            host_instance_type="mq.m5.large"
+        )
+        DataAwsMqBrokerInstanceTypeOfferings(self, "storage",
+            storage_type="EBS"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `engine_type` - (Optional) Filter response by engine type.
+* `host_instance_type` - (Optional) Filter response by host instance type.
+* `storage_type` - (Optional) Filter response by storage type.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `broker_instance_options` -  Option for host instance type. See Broker Instance Options below.
+
+### Broker Instance Options
+
+* `availability_zones` - List of available AZs. See Availability Zones. below
+* `engine_type` - Broker's engine type.
+* `host_instance_type` - Broker's instance type.
+* `storage_type` - Broker's storage type.
+* `supported_deployment_modes` - The list of supported deployment modes.
+* `supported_engine_versions` - The list of supported engine versions.
+
+### Availability Zones
+
+* `name` - Name of the Availability Zone.
+
+<!-- cache-key: cdktf-0.18.0 input-af7521896e903be08788f223edcfd27a267b313cdf4f21d6ea836a2e3f3e7984 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/msk_broker_nodes.html.markdown b/website/docs/cdktf/python/d/msk_broker_nodes.html.markdown
new file mode 100644
index 00000000000..558e32188ce
--- /dev/null
+++ b/website/docs/cdktf/python/d/msk_broker_nodes.html.markdown
@@ -0,0 +1,55 @@
+---
+subcategory: "Managed Streaming for Kafka"
+layout: "aws"
+page_title: "AWS: aws_msk_broker_nodes"
+description: |-
+  Get information on an Amazon MSK Broker Nodes
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_msk_broker_nodes
+
+Get information on an Amazon MSK Broker Nodes.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_msk_broker_nodes import DataAwsMskBrokerNodes
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsMskBrokerNodes(self, "example",
+            cluster_arn=Token.as_string(aws_msk_cluster_example.arn)
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `cluster_arn` - (Required) ARN of the cluster the nodes belong to.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* [`node_info_list`](#nodes) - List of MSK Broker Nodes, sorted by broker ID in ascending order.
+
+### Nodes
+
+* `attached_eni_id` - Attached elastic network interface of the broker
+* `broker_id` - ID of the broker
+* `client_subnet` - Client subnet to which this broker node belongs
+* `client_vpc_ip_address` - The client virtual private cloud (VPC) IP address
+* `endpoints` - Set of endpoints for accessing the broker. This does not include ports
+* `node_arn` - ARN of the node
+
+<!-- cache-key: cdktf-0.18.0 input-bff2642a3e21e8b608fc7f2ec749ea4dc2c86d2f7735aae811865faa68478e8c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/msk_cluster.html.markdown b/website/docs/cdktf/python/d/msk_cluster.html.markdown
new file mode 100644
index 00000000000..31959b7638a
--- /dev/null
+++ b/website/docs/cdktf/python/d/msk_cluster.html.markdown
@@ -0,0 +1,61 @@
+---
+subcategory: "Managed Streaming for Kafka"
+layout: "aws"
+page_title: "AWS: aws_msk_cluster"
+description: |-
+  Get information on an Amazon MSK Cluster
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_msk_cluster
+
+Get information on an Amazon MSK Cluster.
+
+-> **Note:** This data sources returns information on _provisioned_ clusters.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_msk_cluster import DataAwsMskCluster
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsMskCluster(self, "example",
+            cluster_name="example"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `cluster_name` - (Required) Name of the cluster.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the MSK cluster.
+* `bootstrap_brokers` - Comma separated list of one or more hostname:port pairs of kafka brokers suitable to bootstrap connectivity to the kafka cluster. Contains a value if `encryption_info.0.encryption_in_transit.0.client_broker` is set to `PLAINTEXT` or `TLS_PLAINTEXT`. The resource sorts values alphabetically. AWS may not always return all endpoints so this value is not guaranteed to be stable across applies.
+* `bootstrap_brokers_public_sasl_iam` - One or more DNS names (or IP addresses) and SASL IAM port pairs. For example, `b-1-public.exampleClusterName.abcde.c2.kafka.us-east-1.amazonaws.com:9198,b-2-public.exampleClusterName.abcde.c2.kafka.us-east-1.amazonaws.com:9198,b-3-public.exampleClusterName.abcde.c2.kafka.us-east-1.amazonaws.com:9198`. This attribute will have a value if `encryption_info.0.encryption_in_transit.0.client_broker` is set to `TLS_PLAINTEXT` or `TLS` and `client_authentication.0.sasl.0.iam` is set to `true` and `broker_node_group_info.0.connectivity_info.0.public_access.0.type` is set to `SERVICE_PROVIDED_EIPS` and the cluster fulfill all other requirements for public access. The resource sorts the list alphabetically. AWS may not always return all endpoints so the values may not be stable across applies.
+* `bootstrap_brokers_public_sasl_scram` - One or more DNS names (or IP addresses) and SASL SCRAM port pairs. For example, `b-1-public.exampleClusterName.abcde.c2.kafka.us-east-1.amazonaws.com:9196,b-2-public.exampleClusterName.abcde.c2.kafka.us-east-1.amazonaws.com:9196,b-3-public.exampleClusterName.abcde.c2.kafka.us-east-1.amazonaws.com:9196`. This attribute will have a value if `encryption_info.0.encryption_in_transit.0.client_broker` is set to `TLS_PLAINTEXT` or `TLS` and `client_authentication.0.sasl.0.scram` is set to `true` and `broker_node_group_info.0.connectivity_info.0.public_access.0.type` is set to `SERVICE_PROVIDED_EIPS` and the cluster fulfill all other requirements for public access. The resource sorts the list alphabetically. AWS may not always return all endpoints so the values may not be stable across applies.
+* `bootstrap_brokers_public_tls` - One or more DNS names (or IP addresses) and TLS port pairs. For example, `b-1-public.exampleClusterName.abcde.c2.kafka.us-east-1.amazonaws.com:9194,b-2-public.exampleClusterName.abcde.c2.kafka.us-east-1.amazonaws.com:9194,b-3-public.exampleClusterName.abcde.c2.kafka.us-east-1.amazonaws.com:9194`. This attribute will have a value if `encryption_info.0.encryption_in_transit.0.client_broker` is set to `TLS_PLAINTEXT` or `TLS` and `broker_node_group_info.0.connectivity_info.0.public_access.0.type` is set to `SERVICE_PROVIDED_EIPS` and the cluster fulfill all other requirements for public access. The resource sorts the list alphabetically. AWS may not always return all endpoints so the values may not be stable across applies.
+* `bootstrap_brokers_sasl_iam` - One or more DNS names (or IP addresses) and SASL IAM port pairs. For example, `b-1.exampleClusterName.abcde.c2.kafka.us-east-1.amazonaws.com:9098,b-2.exampleClusterName.abcde.c2.kafka.us-east-1.amazonaws.com:9098,b-3.exampleClusterName.abcde.c2.kafka.us-east-1.amazonaws.com:9098`. This attribute will have a value if `encryption_info.0.encryption_in_transit.0.client_broker` is set to `TLS_PLAINTEXT` or `TLS` and `client_authentication.0.sasl.0.iam` is set to `true`. The resource sorts the list alphabetically. AWS may not always return all endpoints so the values may not be stable across applies.
+* `bootstrap_brokers_sasl_scram` - One or more DNS names (or IP addresses) and SASL SCRAM port pairs. For example, `b-1.exampleClusterName.abcde.c2.kafka.us-east-1.amazonaws.com:9096,b-2.exampleClusterName.abcde.c2.kafka.us-east-1.amazonaws.com:9096,b-3.exampleClusterName.abcde.c2.kafka.us-east-1.amazonaws.com:9096`. This attribute will have a value if `encryption_info.0.encryption_in_transit.0.client_broker` is set to `TLS_PLAINTEXT` or `TLS` and `client_authentication.0.sasl.0.scram` is set to `true`. The resource sorts the list alphabetically. AWS may not always return all endpoints so the values may not be stable across applies.
+* `bootstrap_brokers_tls` - One or more DNS names (or IP addresses) and TLS port pairs. For example, `b-1.exampleClusterName.abcde.c2.kafka.us-east-1.amazonaws.com:9094,b-2.exampleClusterName.abcde.c2.kafka.us-east-1.amazonaws.com:9094,b-3.exampleClusterName.abcde.c2.kafka.us-east-1.amazonaws.com:9094`. This attribute will have a value if `encryption_info.0.encryption_in_transit.0.client_broker` is set to `TLS_PLAINTEXT` or `TLS`. The resource sorts the list alphabetically. AWS may not always return all endpoints so the values may not be stable across applies.
+* `cluster_uuid` - UUID of the MSK cluster, for use in IAM policies.
+* `kafka_version` - Apache Kafka version.
+* `number_of_broker_nodes` - Number of broker nodes in the cluster.
+* `tags` - Map of key-value pairs assigned to the cluster.
+* `zookeeper_connect_string` - A comma separated list of one or more hostname:port pairs to use to connect to the Apache Zookeeper cluster. The returned values are sorted alphbetically. The AWS API may not return all endpoints, so this value is not guaranteed to be stable across applies.
+* `zookeeper_connect_string_tls` - A comma separated list of one or more hostname:port pairs to use to connect to the Apache Zookeeper cluster via TLS. The returned values are sorted alphabetically. The AWS API may not return all endpoints, so this value is not guaranteed to be stable across applies.
+
+<!-- cache-key: cdktf-0.18.0 input-acca35726c6c16c1d6bfaa3e60dcf9807ddf74bb084f85ee17a4170824050504 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/msk_configuration.html.markdown b/website/docs/cdktf/python/d/msk_configuration.html.markdown
new file mode 100644
index 00000000000..77dee9badec
--- /dev/null
+++ b/website/docs/cdktf/python/d/msk_configuration.html.markdown
@@ -0,0 +1,50 @@
+---
+subcategory: "Managed Streaming for Kafka"
+layout: "aws"
+page_title: "AWS: aws_msk_configuration"
+description: |-
+  Get information on an Amazon MSK Configuration
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_msk_configuration
+
+Get information on an Amazon MSK Configuration.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_msk_configuration import DataAwsMskConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsMskConfiguration(self, "example",
+            name="example"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name of the configuration.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the configuration.
+* `latest_revision` - Latest revision of the configuration.
+* `description` - Description of the configuration.
+* `kafka_versions` - List of Apache Kafka versions which can use this configuration.
+* `server_properties` - Contents of the server.properties file.
+
+<!-- cache-key: cdktf-0.18.0 input-a4d86b249f9d4af6d96814d6f29e2a202f807b86ac9fffd8815b7aa4931e1636 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/msk_kafka_version.html.markdown b/website/docs/cdktf/python/d/msk_kafka_version.html.markdown
new file mode 100644
index 00000000000..ce98f5c3c83
--- /dev/null
+++ b/website/docs/cdktf/python/d/msk_kafka_version.html.markdown
@@ -0,0 +1,50 @@
+---
+subcategory: "Managed Streaming for Kafka"
+layout: "aws"
+page_title: "AWS: aws_msk_kafka_version"
+description: |-
+  Get information on a Amazon MSK Kafka Version
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_msk_cluster
+
+Get information on a Amazon MSK Kafka Version
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_msk_kafka_version import DataAwsMskKafkaVersion
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsMskKafkaVersion(self, "example",
+            version="2.8.0"
+        )
+        DataAwsMskKafkaVersion(self, "preferred",
+            preferred_versions=["2.4.1.1", "2.4.1", "2.2.1"]
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `preferred_versions` - (Optional) Ordered list of preferred Kafka versions. The first match in this list will be returned. Either `preferred_versions` or `version` must be set.
+* `version` - (Optional) Version of MSK Kafka. For example 2.4.1.1 or "2.2.1" etc. Either `preferred_versions` or `version` must be set.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `status` - Status of the MSK Kafka version eg. `ACTIVE` or `DEPRECATED`.
+
+<!-- cache-key: cdktf-0.18.0 input-6852054bc10e6a7e97a90613e2c215b051bd57037bfb23fddf1aebb0c8d4f92d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/msk_vpc_connection.html.markdown b/website/docs/cdktf/python/d/msk_vpc_connection.html.markdown
new file mode 100644
index 00000000000..9944f8aeb06
--- /dev/null
+++ b/website/docs/cdktf/python/d/msk_vpc_connection.html.markdown
@@ -0,0 +1,50 @@
+---
+subcategory: "Managed Streaming for Kafka"
+layout: "aws"
+page_title: "AWS: aws_msk_vpc_connection"
+description: |-
+  Get information on an Amazon MSK VPC Connection.
+---
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_msk_vpc_connection
+
+Get information on an Amazon MSK VPC Connection.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_msk_vpc_connection import DataAwsMskVpcConnection
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsMskVpcConnection(self, "example",
+            arn=Token.as_string(aws_msk_vpc_connection_example.arn)
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `arn` - (Required) ARN of the VPC Connection.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `authentication` - The authentication type for the client VPC Connection.
+* `client_subnets` - The list of subnets in the client VPC.
+* `security_groups` - The security groups attached to the ENIs for the broker nodes.
+* `tags` - Map of key-value pairs assigned to the VPC Connection.
+* `target_cluster_arn` - The Amazon Resource Name (ARN) of the cluster.
+* `vpc_id` - The VPC ID of the remote client.
+
+<!-- cache-key: cdktf-0.18.0 input-01122677f9ba30620563040b95b6c51a240e709b7fc3bc03683cde0b35bb7e29 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/mskconnect_connector.html.markdown b/website/docs/cdktf/python/d/mskconnect_connector.html.markdown
new file mode 100644
index 00000000000..90f834a4e39
--- /dev/null
+++ b/website/docs/cdktf/python/d/mskconnect_connector.html.markdown
@@ -0,0 +1,48 @@
+---
+subcategory: "Managed Streaming for Kafka Connect"
+layout: "aws"
+page_title: "AWS: aws_mskconnect_connector"
+description: |-
+  Get information on an Amazon MSK Connect Connector.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_mskconnect_connector
+
+Get information on an Amazon MSK Connect Connector.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_mskconnect_connector import DataAwsMskconnectConnector
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsMskconnectConnector(self, "example",
+            name="example-mskconnector"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name of the connector.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the connector.
+* `description` - Summary description of the connector.
+* `version` - Current version of the connector.
+
+<!-- cache-key: cdktf-0.18.0 input-95d0c19f97dab5d0efafc846bda415a3a1bd7527693cac6b19d936ae768634cf -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/mskconnect_custom_plugin.html.markdown b/website/docs/cdktf/python/d/mskconnect_custom_plugin.html.markdown
new file mode 100644
index 00000000000..bebe9370672
--- /dev/null
+++ b/website/docs/cdktf/python/d/mskconnect_custom_plugin.html.markdown
@@ -0,0 +1,49 @@
+---
+subcategory: "Managed Streaming for Kafka Connect"
+layout: "aws"
+page_title: "AWS: aws_mskconnect_custom_plugin"
+description: |-
+  Get information on an Amazon MSK Connect custom plugin.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_mskconnect_custom_plugin
+
+Get information on an Amazon MSK Connect custom plugin.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_mskconnect_custom_plugin import DataAwsMskconnectCustomPlugin
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsMskconnectCustomPlugin(self, "example",
+            name="example-debezium-1"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name of the custom plugin.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - the ARN of the custom plugin.
+* `description` - a summary description of the custom plugin.
+* `latest_revision` - an ID of the latest successfully created revision of the custom plugin.
+* `state` - the state of the custom plugin.
+
+<!-- cache-key: cdktf-0.18.0 input-69d528a4e92608d40820215e21637edad56d0cf8bd42eb304519e5181a028a94 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/mskconnect_worker_configuration.html.markdown b/website/docs/cdktf/python/d/mskconnect_worker_configuration.html.markdown
new file mode 100644
index 00000000000..8a44ff5774b
--- /dev/null
+++ b/website/docs/cdktf/python/d/mskconnect_worker_configuration.html.markdown
@@ -0,0 +1,49 @@
+---
+subcategory: "Managed Streaming for Kafka Connect"
+layout: "aws"
+page_title: "AWS: aws_mskconnect_worker_configuration"
+description: |-
+  Get information on an Amazon MSK Connect worker configuration.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_mskconnect_worker_configuration
+
+Get information on an Amazon MSK Connect Worker Configuration.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_mskconnect_worker_configuration import DataAwsMskconnectWorkerConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsMskconnectWorkerConfiguration(self, "example",
+            name="example"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name of the worker configuration.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - the ARN of the worker configuration.
+* `description` - a summary description of the worker configuration.
+* `latest_revision` - an ID of the latest successfully created revision of the worker configuration.
+* `properties_file_content` - contents of connect-distributed.properties file.
+
+<!-- cache-key: cdktf-0.18.0 input-a4a19bc8bace9a17fd9c5067fbaf9f50bdef230bacb36537455d33cae493f587 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/nat_gateway.html.markdown b/website/docs/cdktf/python/d/nat_gateway.html.markdown
new file mode 100644
index 00000000000..e853d3002ae
--- /dev/null
+++ b/website/docs/cdktf/python/d/nat_gateway.html.markdown
@@ -0,0 +1,101 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_nat_gateway"
+description: |-
+    Provides details about a specific VPC NAT Gateway.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_nat_gateway
+
+Provides details about a specific VPC NAT Gateway.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_nat_gateway import DataAwsNatGateway
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsNatGateway(self, "default",
+            subnet_id=public.id
+        )
+```
+
+### With tags
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_nat_gateway import DataAwsNatGateway
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsNatGateway(self, "default",
+            subnet_id=public.id,
+            tags={
+                "Name": "gw NAT"
+            }
+        )
+```
+
+## Argument Reference
+
+The arguments of this data source act as filters for querying the available
+NAT Gateways in the current Region. The given filters must match exactly one
+NAT Gateway whose data will be exported as attributes.
+
+* `id` - (Optional) ID of the specific NAT Gateway to retrieve.
+* `subnet_id` - (Optional) ID of subnet that the NAT Gateway resides in.
+* `vpc_id` - (Optional) ID of the VPC that the NAT Gateway resides in.
+* `state` - (Optional) State of the NAT Gateway (pending | failed | available | deleting | deleted ).
+* `tags` - (Optional) Map of tags, each pair of which must exactly match
+  a pair on the desired NAT Gateway.
+* `filter` - (Optional) Custom filter block as described below.
+
+More complex filters can be expressed using one or more `filter` sub-blocks,
+which take the following arguments:
+
+* `name` - (Required) Name of the field to filter by, as defined by
+  [the underlying AWS API](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeNatGateways.html).
+* `values` - (Required) Set of values that are accepted for the given field.
+  An Nat Gateway will be selected if any one of the given values matches.
+
+## Attribute Reference
+
+All of the argument attributes except `filter` block are also exported as
+result attributes. This data source will complete the data by populating
+any fields that are not included in the configuration with the data for
+the selected Nat Gateway.
+
+* `allocation_id` - ID of the EIP allocated to the selected NAT Gateway.
+* `association_id` - The association ID of the Elastic IP address that's associated with the NAT Gateway. Only available when `connectivity_type` is `public`.
+* `connectivity_type` - Connectivity type of the NAT Gateway.
+* `network_interface_id` - The ID of the ENI allocated to the selected NAT Gateway.
+* `private_ip` - Private IP address of the selected NAT Gateway.
+* `public_ip` - Public IP (EIP) address of the selected NAT Gateway.
+* `secondary_allocation_ids` - Secondary allocation EIP IDs for the selected NAT Gateway.
+* `secondary_private_ip_address_count` - The number of secondary private IPv4 addresses assigned to the selected NAT Gateway.
+* `secondary_private_ip_addresses` - Secondary private IPv4 addresses assigned to the selected NAT Gateway.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `20m`)
+
+<!-- cache-key: cdktf-0.18.0 input-4030116e2abe81b3824dc015b0bf174d688531f1ad8692b89eca913c4b816418 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/nat_gateways.html.markdown b/website/docs/cdktf/python/d/nat_gateways.html.markdown
new file mode 100644
index 00000000000..168697624fb
--- /dev/null
+++ b/website/docs/cdktf/python/d/nat_gateways.html.markdown
@@ -0,0 +1,80 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_nat_gateways"
+description: |-
+    Get information on Amazon NAT Gateways.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_nat_gateways
+
+This resource can be useful for getting back a list of NAT gateway ids to be referenced elsewhere.
+
+## Example Usage
+
+The following returns all NAT gateways in a specified VPC that are marked as available
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformCount, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_nat_gateway import DataAwsNatGateway
+from imports.aws.data_aws_nat_gateways import DataAwsNatGateways
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ngws = DataAwsNatGateways(self, "ngws",
+            filter=[DataAwsNatGatewaysFilter(
+                name="state",
+                values=["available"]
+            )
+            ],
+            vpc_id=vpc_id.string_value
+        )
+        # In most cases loops should be handled in the programming language context and
+        #     not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+        #     you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+        #     you need to keep this like it is.
+        ngw_count = TerraformCount.of(Token.as_number(Fn.length_of(ngws.ids)))
+        DataAwsNatGateway(self, "ngw",
+            id=Token.as_string(
+                Fn.lookup_nested(Fn.tolist(ngws.ids), [ngw_count.index])),
+            count=ngw_count
+        )
+```
+
+## Argument Reference
+
+* `filter` - (Optional) Custom filter block as described below.
+* `vpc_id` - (Optional) VPC ID that you want to filter from.
+* `tags` - (Optional) Map of tags, each pair of which must exactly match
+  a pair on the desired NAT Gateways.
+
+More complex filters can be expressed using one or more `filter` sub-blocks,
+which take the following arguments:
+
+* `name` - (Required) Name of the field to filter by, as defined by
+  [the underlying AWS API](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeNatGateways.html).
+* `values` - (Required) Set of values that are accepted for the given field.
+  A Nat Gateway will be selected if any one of the given values matches.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - AWS Region.
+* `ids` - List of all the NAT gateway ids found.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `20m`)
+
+<!-- cache-key: cdktf-0.18.0 input-3dfcb9644adaffbf7b3a6ffb1c20821b6b1308407d55040b08b25e3a1307ee56 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/neptune_engine_version.html.markdown b/website/docs/cdktf/python/d/neptune_engine_version.html.markdown
new file mode 100644
index 00000000000..1ebc39b339d
--- /dev/null
+++ b/website/docs/cdktf/python/d/neptune_engine_version.html.markdown
@@ -0,0 +1,55 @@
+---
+subcategory: "Neptune"
+layout: "aws"
+page_title: "AWS: aws_neptune_engine_version"
+description: |-
+  Information about a Neptune engine version.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_neptune_engine_version
+
+Information about a Neptune engine version.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_neptune_engine_version import DataAwsNeptuneEngineVersion
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsNeptuneEngineVersion(self, "test",
+            preferred_versions=["1.0.3.0", "1.0.2.2", "1.0.2.1"]
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `engine` - (Optional) DB engine. (Default: `neptune`)
+* `parameter_group_family` - (Optional) Name of a specific DB parameter group family. An example parameter group family is `neptune1`.
+* `preferred_versions` - (Optional) Ordered list of preferred engine versions. The first match in this list will be returned. If no preferred matches are found and the original search returned more than one result, an error is returned. If both the `version` and `preferred_versions` arguments are not configured, the data source will return the default version for the engine.
+* `version` - (Optional) Version of the DB engine. For example, `1.0.1.0`, `1.0.2.2`, and `1.0.3.0`. If both the `version` and `preferred_versions` arguments are not configured, the data source will return the default version for the engine.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `engine_description` - Description of the database engine.
+* `exportable_log_types` - Set of log types that the database engine has available for export to CloudWatch Logs.
+* `supported_timezones` - Set of the time zones supported by this engine.
+* `supports_log_exports_to_cloudwatch` - Indicates whether the engine version supports exporting the log types specified by `exportable_log_types` to CloudWatch Logs.
+* `supports_read_replica` - Indicates whether the database engine version supports read replicas.
+* `valid_upgrade_targets` - Set of engine versions that this database engine version can be upgraded to.
+* `version_description` - Description of the database engine version.
+
+<!-- cache-key: cdktf-0.18.0 input-95a44d0ef7849262a188ffdb9a5ba6d99336bcbafcda87d6d4674964f3cbe7d9 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/neptune_engine_version.markdown b/website/docs/cdktf/python/d/neptune_engine_version.markdown
new file mode 100644
index 00000000000..1ebc39b339d
--- /dev/null
+++ b/website/docs/cdktf/python/d/neptune_engine_version.markdown
@@ -0,0 +1,55 @@
+---
+subcategory: "Neptune"
+layout: "aws"
+page_title: "AWS: aws_neptune_engine_version"
+description: |-
+  Information about a Neptune engine version.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_neptune_engine_version
+
+Information about a Neptune engine version.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_neptune_engine_version import DataAwsNeptuneEngineVersion
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsNeptuneEngineVersion(self, "test",
+            preferred_versions=["1.0.3.0", "1.0.2.2", "1.0.2.1"]
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `engine` - (Optional) DB engine. (Default: `neptune`)
+* `parameter_group_family` - (Optional) Name of a specific DB parameter group family. An example parameter group family is `neptune1`.
+* `preferred_versions` - (Optional) Ordered list of preferred engine versions. The first match in this list will be returned. If no preferred matches are found and the original search returned more than one result, an error is returned. If both the `version` and `preferred_versions` arguments are not configured, the data source will return the default version for the engine.
+* `version` - (Optional) Version of the DB engine. For example, `1.0.1.0`, `1.0.2.2`, and `1.0.3.0`. If both the `version` and `preferred_versions` arguments are not configured, the data source will return the default version for the engine.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `engine_description` - Description of the database engine.
+* `exportable_log_types` - Set of log types that the database engine has available for export to CloudWatch Logs.
+* `supported_timezones` - Set of the time zones supported by this engine.
+* `supports_log_exports_to_cloudwatch` - Indicates whether the engine version supports exporting the log types specified by `exportable_log_types` to CloudWatch Logs.
+* `supports_read_replica` - Indicates whether the database engine version supports read replicas.
+* `valid_upgrade_targets` - Set of engine versions that this database engine version can be upgraded to.
+* `version_description` - Description of the database engine version.
+
+<!-- cache-key: cdktf-0.18.0 input-95a44d0ef7849262a188ffdb9a5ba6d99336bcbafcda87d6d4674964f3cbe7d9 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/neptune_orderable_db_instance.html.markdown b/website/docs/cdktf/python/d/neptune_orderable_db_instance.html.markdown
new file mode 100644
index 00000000000..a0846de0a96
--- /dev/null
+++ b/website/docs/cdktf/python/d/neptune_orderable_db_instance.html.markdown
@@ -0,0 +1,66 @@
+---
+subcategory: "Neptune"
+layout: "aws"
+page_title: "AWS: aws_neptune_orderable_db_instance"
+description: |-
+  Information about Neptune orderable DB instances.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_neptune_orderable_db_instance
+
+Information about Neptune orderable DB instances.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_neptune_orderable_db_instance import DataAwsNeptuneOrderableDbInstance
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsNeptuneOrderableDbInstance(self, "test",
+            engine_version="1.0.3.0",
+            preferred_instance_classes=["db.r5.large", "db.r4.large", "db.t3.medium"]
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `engine` - (Optional) DB engine. (Default: `neptune`)
+* `engine_version` - (Optional) Version of the DB engine. For example, `1.0.1.0`, `1.0.1.2`, `1.0.2.2`, and `1.0.3.0`.
+* `instance_class` - (Optional) DB instance class. Examples of classes are `db.r5.large`, `db.r5.xlarge`, `db.r4.large`, `db.r5.4xlarge`, `db.r5.12xlarge`, `db.r4.xlarge`, and `db.t3.medium`.
+* `license_model` - (Optional) License model. (Default: `amazon-license`)
+* `preferred_instance_classes` - (Optional) Ordered list of preferred Neptune DB instance classes. The first match in this list will be returned. If no preferred matches are found and the original search returned more than one result, an error is returned.
+* `vpc` - (Optional) Enable to show only VPC offerings.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `availability_zones` - Availability zones where the instance is available.
+* `max_iops_per_db_instance` - Maximum total provisioned IOPS for a DB instance.
+* `max_iops_per_gib` - Maximum provisioned IOPS per GiB for a DB instance.
+* `max_storage_size` - Maximum storage size for a DB instance.
+* `min_iops_per_db_instance` - Minimum total provisioned IOPS for a DB instance.
+* `min_iops_per_gib` - Minimum provisioned IOPS per GiB for a DB instance.
+* `min_storage_size` - Minimum storage size for a DB instance.
+* `multi_az_capable` - Whether a DB instance is Multi-AZ capable.
+* `read_replica_capable` - Whether a DB instance can have a read replica.
+* `storage_type` - Storage type for a DB instance.
+* `supports_enhanced_monitoring` - Whether a DB instance supports Enhanced Monitoring at intervals from 1 to 60 seconds.
+* `supports_iam_database_authentication` - Whether a DB instance supports IAM database authentication.
+* `supports_iops` - Whether a DB instance supports provisioned IOPS.
+* `supports_performance_insights` - Whether a DB instance supports Performance Insights.
+* `supports_storage_encryption` - Whether a DB instance supports encrypted storage.
+
+<!-- cache-key: cdktf-0.18.0 input-96ed319d4f21711473bbe2040090bbe88fe63b3c2315bc78386e18d098f01431 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/neptune_orderable_db_instance.markdown b/website/docs/cdktf/python/d/neptune_orderable_db_instance.markdown
new file mode 100644
index 00000000000..a0846de0a96
--- /dev/null
+++ b/website/docs/cdktf/python/d/neptune_orderable_db_instance.markdown
@@ -0,0 +1,66 @@
+---
+subcategory: "Neptune"
+layout: "aws"
+page_title: "AWS: aws_neptune_orderable_db_instance"
+description: |-
+  Information about Neptune orderable DB instances.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_neptune_orderable_db_instance
+
+Information about Neptune orderable DB instances.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_neptune_orderable_db_instance import DataAwsNeptuneOrderableDbInstance
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsNeptuneOrderableDbInstance(self, "test",
+            engine_version="1.0.3.0",
+            preferred_instance_classes=["db.r5.large", "db.r4.large", "db.t3.medium"]
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `engine` - (Optional) DB engine. (Default: `neptune`)
+* `engine_version` - (Optional) Version of the DB engine. For example, `1.0.1.0`, `1.0.1.2`, `1.0.2.2`, and `1.0.3.0`.
+* `instance_class` - (Optional) DB instance class. Examples of classes are `db.r5.large`, `db.r5.xlarge`, `db.r4.large`, `db.r5.4xlarge`, `db.r5.12xlarge`, `db.r4.xlarge`, and `db.t3.medium`.
+* `license_model` - (Optional) License model. (Default: `amazon-license`)
+* `preferred_instance_classes` - (Optional) Ordered list of preferred Neptune DB instance classes. The first match in this list will be returned. If no preferred matches are found and the original search returned more than one result, an error is returned.
+* `vpc` - (Optional) Enable to show only VPC offerings.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `availability_zones` - Availability zones where the instance is available.
+* `max_iops_per_db_instance` - Maximum total provisioned IOPS for a DB instance.
+* `max_iops_per_gib` - Maximum provisioned IOPS per GiB for a DB instance.
+* `max_storage_size` - Maximum storage size for a DB instance.
+* `min_iops_per_db_instance` - Minimum total provisioned IOPS for a DB instance.
+* `min_iops_per_gib` - Minimum provisioned IOPS per GiB for a DB instance.
+* `min_storage_size` - Minimum storage size for a DB instance.
+* `multi_az_capable` - Whether a DB instance is Multi-AZ capable.
+* `read_replica_capable` - Whether a DB instance can have a read replica.
+* `storage_type` - Storage type for a DB instance.
+* `supports_enhanced_monitoring` - Whether a DB instance supports Enhanced Monitoring at intervals from 1 to 60 seconds.
+* `supports_iam_database_authentication` - Whether a DB instance supports IAM database authentication.
+* `supports_iops` - Whether a DB instance supports provisioned IOPS.
+* `supports_performance_insights` - Whether a DB instance supports Performance Insights.
+* `supports_storage_encryption` - Whether a DB instance supports encrypted storage.
+
+<!-- cache-key: cdktf-0.18.0 input-96ed319d4f21711473bbe2040090bbe88fe63b3c2315bc78386e18d098f01431 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/network_acls.html.markdown b/website/docs/cdktf/python/d/network_acls.html.markdown
new file mode 100644
index 00000000000..6805be43ccd
--- /dev/null
+++ b/website/docs/cdktf/python/d/network_acls.html.markdown
@@ -0,0 +1,118 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_network_acls"
+description: |-
+    Provides a list of network ACL ids for a VPC
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_network_acls
+
+## Example Usage
+
+The following shows outputting all network ACL ids in a vpc.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformOutput, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_network_acls import DataAwsNetworkAcls
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = DataAwsNetworkAcls(self, "example",
+            vpc_id=vpc_id.string_value
+        )
+        cdktf_terraform_output_example = TerraformOutput(self, "example_1",
+            value=example.ids
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        cdktf_terraform_output_example.override_logical_id("example")
+```
+
+The following example retrieves a list of all network ACL ids in a VPC with a custom
+tag of `Tier` set to a value of "Private".
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_network_acls import DataAwsNetworkAcls
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsNetworkAcls(self, "example",
+            tags={
+                "Tier": "Private"
+            },
+            vpc_id=vpc_id.string_value
+        )
+```
+
+The following example retrieves a network ACL id in a VPC which associated
+with specific subnet.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_network_acls import DataAwsNetworkAcls
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsNetworkAcls(self, "example",
+            filter=[DataAwsNetworkAclsFilter(
+                name="association.subnet-id",
+                values=[test.id]
+            )
+            ],
+            vpc_id=vpc_id.string_value
+        )
+```
+
+## Argument Reference
+
+* `vpc_id` - (Optional) VPC ID that you want to filter from.
+
+* `tags` - (Optional) Map of tags, each pair of which must exactly match
+  a pair on the desired network ACLs.
+
+* `filter` - (Optional) Custom filter block as described below.
+
+More complex filters can be expressed using one or more `filter` sub-blocks,
+which take the following arguments:
+
+* `name` - (Required) Name of the field to filter by, as defined by
+  [the underlying AWS API](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeNetworkAcls.html).
+
+* `values` - (Required) Set of values that are accepted for the given field.
+  A VPC will be selected if any one of the given values matches.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - AWS Region.
+* `ids` - List of all the network ACL ids found.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `20m`)
+
+<!-- cache-key: cdktf-0.18.0 input-9e00033620073e117ff35c3a96437d5e582bff32daaefd9214f39ae3299dcbdb -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/network_interface.html.markdown b/website/docs/cdktf/python/d/network_interface.html.markdown
new file mode 100644
index 00000000000..b38fe433506
--- /dev/null
+++ b/website/docs/cdktf/python/d/network_interface.html.markdown
@@ -0,0 +1,81 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_network_interface"
+description: |-
+  Get information on a Network Interface resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# aws_network_interface
+
+Use this data source to get information about a Network Interface.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_network_interface import DataAwsNetworkInterface
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsNetworkInterface(self, "bar",
+            id="eni-01234567"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `id` – (Optional) Identifier for the network interface.
+* `filter` – (Optional) One or more name/value pairs to filter off of. There are several valid keys, for a full reference, check out [describe-network-interfaces](https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-network-interfaces.html) in the AWS CLI reference.
+
+## Attribute Reference
+
+See the [Network Interface](/docs/providers/aws/r/network_interface.html) for details on the returned attributes.
+
+Additionally, the following attributes are exported:
+
+* `arn` - ARN of the network interface.
+* `association` - Association information for an Elastic IP address (IPv4) associated with the network interface. See supported fields below.
+* `availability_zone` - Availability Zone.
+* `description` - Description of the network interface.
+* `interface_type` - Type of interface.
+* `ipv6_addresses` - List of IPv6 addresses to assign to the ENI.
+* `mac_address` - MAC address.
+* `owner_id` - AWS account ID of the owner of the network interface.
+* `private_dns_name` - Private DNS name.
+* `private_ip` - Private IPv4 address of the network interface within the subnet.
+* `private_ips` - Private IPv4 addresses associated with the network interface.
+* `requester_id` - ID of the entity that launched the instance on your behalf.
+* `security_groups` - List of security groups for the network interface.
+* `subnet_id` - ID of the subnet.
+* `outpost_arn` - ARN of the Outpost.
+* `tags` - Any tags assigned to the network interface.
+* `vpc_id` - ID of the VPC.
+
+### `association`
+
+* `allocation_id` - Allocation ID.
+* `association_id` - Association ID.
+* `carrier_ip` - Carrier IP address associated with the network interface. This attribute is only set when the network interface is in a subnet which is associated with a Wavelength Zone.
+* `customer_owned_ip` - Customer-owned IP address.
+* `ip_owner_id` - ID of the Elastic IP address owner.
+* `public_dns_name` - Public DNS name.
+* `public_ip` - Address of the Elastic IP address bound to the network interface.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `20m`)
+
+<!-- cache-key: cdktf-0.18.0 input-2076fd1e9228c52725c01e9ff2e4ab23d3afe4ebaba78ef4fa3e8e525341ba1e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/network_interfaces.html.markdown b/website/docs/cdktf/python/d/network_interfaces.html.markdown
new file mode 100644
index 00000000000..6b4bf9ccb93
--- /dev/null
+++ b/website/docs/cdktf/python/d/network_interfaces.html.markdown
@@ -0,0 +1,118 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_network_interfaces"
+description: |-
+    Provides a list of network interface ids
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_network_interfaces
+
+## Example Usage
+
+The following shows outputting all network interface ids in a region.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformOutput, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_network_interfaces import DataAwsNetworkInterfaces
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = DataAwsNetworkInterfaces(self, "example")
+        cdktf_terraform_output_example = TerraformOutput(self, "example_1",
+            value=example.ids
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        cdktf_terraform_output_example.override_logical_id("example")
+```
+
+The following example retrieves a list of all network interface ids with a custom tag of `Name` set to a value of `test`.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformOutput, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_network_interfaces import DataAwsNetworkInterfaces
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = DataAwsNetworkInterfaces(self, "example",
+            tags={
+                "Name": "test"
+            }
+        )
+        TerraformOutput(self, "example1",
+            value=example.ids
+        )
+```
+
+The following example retrieves a network interface ids which associated
+with specific subnet.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformOutput, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_network_interfaces import DataAwsNetworkInterfaces
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = DataAwsNetworkInterfaces(self, "example",
+            filter=[DataAwsNetworkInterfacesFilter(
+                name="subnet-id",
+                values=[test.id]
+            )
+            ]
+        )
+        cdktf_terraform_output_example = TerraformOutput(self, "example_1",
+            value=example.ids
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        cdktf_terraform_output_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+* `tags` - (Optional) Map of tags, each pair of which must exactly match
+  a pair on the desired network interfaces.
+
+* `filter` - (Optional) Custom filter block as described below.
+
+More complex filters can be expressed using one or more `filter` sub-blocks,
+which take the following arguments:
+
+* `name` - (Required) Name of the field to filter by, as defined by
+  [the underlying AWS API](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeNetworkInterfaces.html).
+
+* `values` - (Required) Set of values that are accepted for the given field.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - AWS Region.
+* `ids` - List of all the network interface ids found.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `20m`)
+
+<!-- cache-key: cdktf-0.18.0 input-646906c0bd9fc7099554a6f7a7360e6017e0671ce35dd9034461a10e627366dc -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/networkfirewall_firewall.html.markdown b/website/docs/cdktf/python/d/networkfirewall_firewall.html.markdown
new file mode 100644
index 00000000000..8b950b564f8
--- /dev/null
+++ b/website/docs/cdktf/python/d/networkfirewall_firewall.html.markdown
@@ -0,0 +1,116 @@
+---
+subcategory: "Network Firewall"
+layout: "aws"
+page_title: "AWS: aws_networkfirewall_firewall"
+description: |-
+  Retrieve information about an AWS Network Firewall Firewall resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_networkfirewall_firewall
+
+Retrieve information about a firewall.
+
+## Example Usage
+
+### Find firewall policy by ARN
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_networkfirewall_firewall import DataAwsNetworkfirewallFirewall
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsNetworkfirewallFirewall(self, "example",
+            arn=arn
+        )
+```
+
+### Find firewall policy by Name
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_networkfirewall_firewall import DataAwsNetworkfirewallFirewall
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsNetworkfirewallFirewall(self, "example",
+            name="Test"
+        )
+```
+
+### Find firewall policy by ARN and Name
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_networkfirewall_firewall import DataAwsNetworkfirewallFirewall
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsNetworkfirewallFirewall(self, "example",
+            arn=arn,
+            name="Test"
+        )
+```
+
+## Argument Reference
+
+One or more of the following arguments are required:
+
+* `arn` - ARN of the firewall.
+* `name` - Descriptive name of the firewall.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the firewall.
+* `delete_protection` - Boolean flag indicating whether it is possible to delete the firewall.
+* `description` - Description of the firewall.
+* `encryption_configuration` - AWS Key Management Service (AWS KMS) encryption settings for the firewall.
+    * `key_id` - The ID of the AWS Key Management Service (AWS KMS) customer managed key.
+    * `type` - The type of the AWS Key Management Service (AWS KMS) key use by the firewall.
+* `firewall_policy_arn` - ARN of the VPC Firewall policy.
+* `firewall_policy_change_protection` - A boolean flag indicating whether it is possible to change the associated firewall policy.
+* `firewall_status` - Nested list of information about the current status of the firewall.
+    * `sync_states` - Set of subnets configured for use by the firewall.
+        * `attachment` - Nested list describing the attachment status of the firewall's association with a single VPC subnet.
+            * `endpoint_id` - The identifier of the firewall endpoint that AWS Network Firewall has instantiated in the subnet. You use this to identify the firewall endpoint in the VPC route tables, when you redirect the VPC traffic through the endpoint.
+            * `subnet_id` - The unique identifier of the subnet that you've specified to be used for a firewall endpoint.
+        * `availability_zone` - The Availability Zone where the subnet is configured.
+    * `capacity_usage_summary` - Aggregated count of all resources used by reference sets in a firewall.
+        * `cidrs` - Capacity usage of CIDR blocks used by IP set references in a firewall.
+            * `available_cidr_count` - Available number of CIDR blocks available for use by the IP set references in a firewall.
+            * `ip_set_references` - The list of IP set references used by a firewall.
+                * `resolved_cidr_count` - Total number of CIDR blocks used by the IP set references in a firewall.
+            * `utilized_cidr_count` - Number of CIDR blocks used by the IP set references in a firewall.
+    * `configuration_sync_state_summary` - Summary of sync states for all availability zones in which the firewall is configured.
+* `id` - ARN that identifies the firewall.
+* `name` - Descriptive name of the firewall.
+* `subnet_change_protection` - A boolean flag indicating whether it is possible to change the associated subnet(s).
+* `subnet_mapping` - Set of configuration blocks describing the public subnets. Each subnet must belong to a different Availability Zone in the VPC. AWS Network Firewall creates a firewall endpoint in each subnet.
+    * `subnet_id` - The unique identifier for the subnet.
+* `tags` - Map of resource tags to associate with the resource. If configured with a provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `update_token` - String token used when updating a firewall.
+* `vpc_id` - Unique identifier of the VPC where AWS Network Firewall should create the firewall.
+
+<!-- cache-key: cdktf-0.18.0 input-24e5c2406618e6513cfbf45303a085d913cb2cabcf2e44e12fc1f263b2a91298 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/networkfirewall_firewall_policy.html.markdown b/website/docs/cdktf/python/d/networkfirewall_firewall_policy.html.markdown
new file mode 100644
index 00000000000..953f4fd4310
--- /dev/null
+++ b/website/docs/cdktf/python/d/networkfirewall_firewall_policy.html.markdown
@@ -0,0 +1,98 @@
+---
+subcategory: "Network Firewall"
+layout: "aws"
+page_title: "AWS: aws_networkfirewall_firewall_policy"
+description: |-
+  Retrieve information about a firewall policy.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_networkfirewall_firewall_policy
+
+Retrieve information about a firewall policy.
+
+## Example Usage
+
+### Find firewall policy by name
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_networkfirewall_firewall_policy import DataAwsNetworkfirewallFirewallPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsNetworkfirewallFirewallPolicy(self, "example",
+            name=firewall_policy_name.string_value
+        )
+```
+
+### Find firewall policy by ARN
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_networkfirewall_firewall_policy import DataAwsNetworkfirewallFirewallPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsNetworkfirewallFirewallPolicy(self, "example",
+            arn=firewall_policy_arn.string_value
+        )
+```
+
+### Find firewall policy by name and ARN
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_networkfirewall_firewall_policy import DataAwsNetworkfirewallFirewallPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsNetworkfirewallFirewallPolicy(self, "example",
+            arn=firewall_policy_arn.string_value,
+            name=firewall_policy_name.string_value
+        )
+```
+
+AWS Network Firewall does not allow multiple firewall policies with the same name to be created in an account. It is possible, however, to have multiple firewall policies available in a single account with identical `name` values but distinct `arn` values, e.g. firewall policies shared via a [Resource Access Manager (RAM) share][1]. In that case specifying `arn`, or `name` and `arn`, is recommended.
+
+~> **Note:** If there are multiple firewall policies in an account with the same `name`, and `arn` is not specified, the default behavior will return the firewall policy with `name` that was created in the account.
+
+## Argument Reference
+
+One or more of the following arguments are required:
+
+* `arn` - ARN of the firewall policy.
+* `name` - Descriptive name of the firewall policy.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `description` - Description of the firewall policy.
+* `firewall_policy` - The [policy][2] for the specified firewall policy.
+* `tags` - Key-value tags for the firewall policy.
+* `update_token` - Token used for optimistic locking.
+
+[1]: https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ram_resource_share
+[2]: https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/networkfirewall_firewall_policy
+
+<!-- cache-key: cdktf-0.18.0 input-4989affff53c19ef7e5645a5518e7b1231c05395a155119b6668ad481fded458 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/networkfirewall_resource_policy.html.markdown b/website/docs/cdktf/python/d/networkfirewall_resource_policy.html.markdown
new file mode 100644
index 00000000000..28e996ff89b
--- /dev/null
+++ b/website/docs/cdktf/python/d/networkfirewall_resource_policy.html.markdown
@@ -0,0 +1,47 @@
+---
+subcategory: "Network Firewall"
+layout: "aws"
+page_title: "AWS: aws_networkfirewall_resource_policy"
+description: |-
+  Retrieve information about a Network Firewall resource policy.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_networkfirewall_resource_policy
+
+Retrieve information about a Network Firewall resource policy.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_networkfirewall_resource_policy import DataAwsNetworkfirewallResourcePolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsNetworkfirewallResourcePolicy(self, "example",
+            resource_arn=resource_policy_arn.string_value
+        )
+```
+
+## Argument Reference
+
+* `resource_arn` - (Required) The Amazon Resource Name (ARN) that identifies the resource policy.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - The Amazon Resource Name (ARN) that identifies the resource policy.
+* `policy` - The [policy][1] for the resource.
+
+[1]: https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/networkfirewall_resource_policy
+
+<!-- cache-key: cdktf-0.18.0 input-107f955d750a5b8827c396d72211b79ae4ad8c3cde0654c3353f405a454c633b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/networkmanager_connection.html.markdown b/website/docs/cdktf/python/d/networkmanager_connection.html.markdown
new file mode 100644
index 00000000000..cac5fcbea82
--- /dev/null
+++ b/website/docs/cdktf/python/d/networkmanager_connection.html.markdown
@@ -0,0 +1,52 @@
+---
+subcategory: "Network Manager"
+layout: "aws"
+page_title: "AWS: aws_networkmanager_connection"
+description: |-
+  Retrieve information about a connection.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source:  aws_networkmanager_connection
+
+Retrieve information about a connection.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_networkmanager_connection import DataAwsNetworkmanagerConnection
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsNetworkmanagerConnection(self, "example",
+            connection_id=connection_id.string_value,
+            global_network_id=global_network_id.string_value
+        )
+```
+
+## Argument Reference
+
+* `global_network_id` - (Required) ID of the Global Network of the connection to retrieve.
+* `connection_id` - (Required) ID of the specific connection to retrieve.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the connection.
+* `connected_device_id` - ID of the second device in the connection.
+* `connected_link_id` - ID of the link for the second device.
+* `description` - Description of the connection.
+* `device_id` - ID of the first device in the connection.
+* `link_id` - ID of the link for the first device.
+* `tags` - Key-value tags for the connection.
+
+<!-- cache-key: cdktf-0.18.0 input-a0cbd17186f4f009da616a66e54bfb81cbdebd2f6465c7c104a1c2b92433b010 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/networkmanager_connections.html.markdown b/website/docs/cdktf/python/d/networkmanager_connections.html.markdown
new file mode 100644
index 00000000000..76d5b2613fb
--- /dev/null
+++ b/website/docs/cdktf/python/d/networkmanager_connections.html.markdown
@@ -0,0 +1,49 @@
+---
+subcategory: "Network Manager"
+layout: "aws"
+page_title: "AWS: aws_networkmanager_connections"
+description: |-
+  Retrieve information about connections.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_networkmanager_connections
+
+Retrieve information about connections.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_networkmanager_connections import DataAwsNetworkmanagerConnections
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsNetworkmanagerConnections(self, "example",
+            global_network_id=global_network_id.string_value,
+            tags={
+                "Env": "test"
+            }
+        )
+```
+
+## Argument Reference
+
+* `device_id` - (Optional) ID of the device of the connections to retrieve.
+* `global_network_id` - (Required) ID of the Global Network of the connections to retrieve.
+* `tags` - (Optional) Restricts the list to the connections with these tags.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `ids` - IDs of the connections.
+
+<!-- cache-key: cdktf-0.18.0 input-aa7aa02ec1ffacee6041a548fe2c103f68bb508973cfffa5c9959d6c28550226 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/networkmanager_core_network_policy_document.html.markdown b/website/docs/cdktf/python/d/networkmanager_core_network_policy_document.html.markdown
new file mode 100644
index 00000000000..643e801c41e
--- /dev/null
+++ b/website/docs/cdktf/python/d/networkmanager_core_network_policy_document.html.markdown
@@ -0,0 +1,268 @@
+---
+subcategory: "Network Manager"
+layout: "aws"
+page_title: "AWS: aws_networkmanager_core_network_policy_document"
+description: |-
+  Generates an Core Network policy document in JSON format
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_networkmanager_core_network_policy_document
+
+Generates a Core Network policy document in JSON format for use with resources that expect core network policy documents such as `awscc_networkmanager_core_network`. It follows the API definition from the [core-network-policy documentation](https://docs.aws.amazon.com/vpc/latest/cloudwan/cloudwan-policies-json.html).
+
+Using this data source to generate policy documents is *optional*. It is also valid to use literal JSON strings in your configuration or to use the `file` interpolation function to read a raw JSON policy document from a file.
+
+-> For more information about building AWS Core Network policy documents with Terraform, see the [Using AWS & AWSCC Provider Together Guide](/docs/providers/aws/guides/using-aws-with-awscc-provider.html)
+
+## Example Usage
+
+### Basic Example
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_networkmanager_core_network_policy_document import DataAwsNetworkmanagerCoreNetworkPolicyDocument
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsNetworkmanagerCoreNetworkPolicyDocument(self, "test",
+            attachment_policies=[DataAwsNetworkmanagerCoreNetworkPolicyDocumentAttachmentPolicies(
+                action=DataAwsNetworkmanagerCoreNetworkPolicyDocumentAttachmentPoliciesAction(
+                    association_method="constant",
+                    segment="shared"
+                ),
+                condition_logic="or",
+                conditions=[DataAwsNetworkmanagerCoreNetworkPolicyDocumentAttachmentPoliciesConditions(
+                    key="segment",
+                    operator="equals",
+                    type="tag-value",
+                    value="shared"
+                )
+                ],
+                rule_number=100
+            ), DataAwsNetworkmanagerCoreNetworkPolicyDocumentAttachmentPolicies(
+                action=DataAwsNetworkmanagerCoreNetworkPolicyDocumentAttachmentPoliciesAction(
+                    association_method="constant",
+                    segment="prod"
+                ),
+                condition_logic="or",
+                conditions=[DataAwsNetworkmanagerCoreNetworkPolicyDocumentAttachmentPoliciesConditions(
+                    key="segment",
+                    operator="equals",
+                    type="tag-value",
+                    value="prod"
+                )
+                ],
+                rule_number=200
+            )
+            ],
+            core_network_configuration=[DataAwsNetworkmanagerCoreNetworkPolicyDocumentCoreNetworkConfiguration(
+                asn_ranges=["64512-64555"],
+                edge_locations=[DataAwsNetworkmanagerCoreNetworkPolicyDocumentCoreNetworkConfigurationEdgeLocations(
+                    asn=Token.as_string(64512),
+                    location="us-east-1"
+                ), DataAwsNetworkmanagerCoreNetworkPolicyDocumentCoreNetworkConfigurationEdgeLocations(
+                    asn=Token.as_string(64513),
+                    location="eu-central-1"
+                )
+                ],
+                vpn_ecmp_support=False
+            )
+            ],
+            segment_actions=[DataAwsNetworkmanagerCoreNetworkPolicyDocumentSegmentActions(
+                action="share",
+                mode="attachment-route",
+                segment="shared",
+                share_with=["*"]
+            )
+            ],
+            segments=[DataAwsNetworkmanagerCoreNetworkPolicyDocumentSegments(
+                description="Segment for shared services",
+                name="shared",
+                require_attachment_acceptance=True
+            ), DataAwsNetworkmanagerCoreNetworkPolicyDocumentSegments(
+                description="Segment for prod services",
+                name="prod",
+                require_attachment_acceptance=True
+            )
+            ]
+        )
+```
+
+`data.aws_networkmanager_core_network_policy_document.test.json` will evaluate to:
+
+```json
+{
+  "version": "2021.12",
+  "core-network-configuration": {
+    "asn-ranges": [
+      "64512-64555"
+    ],
+    "vpn-ecmp-support": false,
+    "edge-locations": [
+      {
+        "location": "us-east-1",
+        "asn": 64512
+      },
+      {
+        "location": "eu-central-1",
+        "asn": 64513
+      }
+    ]
+  },
+  "segments": [
+    {
+      "name": "shared",
+      "description": "Segment for shared services",
+      "require-attachment-acceptance": true
+    },
+    {
+      "name": "prod",
+      "description": "Segment for prod services",
+      "require-attachment-acceptance": true
+    }
+  ],
+  "attachment-policies": [
+    {
+      "rule-number": 100,
+      "action": {
+        "association-method": "constant",
+        "segment": "shared"
+      },
+      "conditions": [
+        {
+          "type": "tag-value",
+          "operator": "equals",
+          "key": "segment",
+          "value": "shared"
+        }
+      ],
+      "condition-logic": "or"
+    },
+    {
+      "rule-number": 200,
+      "action": {
+        "association-method": "constant",
+        "segment": "prod"
+      },
+      "conditions": [
+        {
+          "type": "tag-value",
+          "operator": "equals",
+          "key": "segment",
+          "value": "prod"
+        }
+      ],
+      "condition-logic": "or"
+    }
+  ],
+  "segment-actions": [
+    {
+      "action": "share",
+      "mode": "attachment-route",
+      "segment": "shared",
+      "share-with": "*"
+    }
+  ]
+}
+```
+
+## Argument Reference
+
+The following arguments are available:
+
+* `attachment_policies` (Optional) - In a core network, all attachments use the block argument `attachment_policies` section to map an attachment to a segment. Instead of manually associating a segment to each attachment, attachments use tags, and then the tags are used to associate the attachment to the specified segment. Detailed below.
+* `core_network_configuration` (Required) - The core network configuration section defines the Regions where a core network should operate. For AWS Regions that are defined in the policy, the core network creates a Core Network Edge where you can connect attachments. After it's created, each Core Network Edge is peered with every other defined Region and is configured with consistent segment and routing across all Regions. Regions cannot be removed until the associated attachments are deleted. Detailed below.
+* `segments` (Required) - Block argument that defines the different segments in the network. Here you can provide descriptions, change defaults, and provide explicit Regional operational and route filters. The names defined for each segment are used in the `segment_actions` and `attachment_policies` section. Each segment is created, and operates, as a completely separated routing domain. By default, attachments can only communicate with other attachments in the same segment. Detailed below.
+* `segment_actions` (Optional) - A block argument, `segment_actions` define how routing works between segments. By default, attachments can only communicate with other attachments in the same segment. Detailed below.
+
+### `attachment_policies`
+
+The following arguments are available:
+
+* `action` (Required) - Action to take when a condition is true. Detailed Below.
+* `condition_logic` (Optional) - Valid values include `and` or `or`. This is a mandatory parameter only if you have more than one condition. The `condition_logic` apply to all of the conditions for a rule, which also means nested conditions of `and` or `or` are not supported. Use `or` if you want to associate the attachment with the segment by either the segment name or attachment tag value, or by the chosen conditions. Use `and` if you want to associate the attachment with the segment by either the segment name or attachment tag value and by the chosen conditions. Detailed Below.
+* `conditions` (Required) - A block argument. Detailed Below.
+* `description` (Optional) - A user-defined description that further helps identify the rule.
+* `rule_number` (Required) - An integer from `1` to `65535` indicating the rule's order number. Rules are processed in order from the lowest numbered rule to the highest. Rules stop processing when a rule is matched. It's important to make sure that you number your rules in the exact order that you want them processed.
+
+### `action`
+
+The following arguments are available:
+
+* `association_method` (Required) - Defines how a segment is mapped. Values can be `constant` or `tag`. `constant` statically defines the segment to associate the attachment to. `tag` uses the value of a tag to dynamically try to map to a segment.reference_policies_elements_condition_operators.html) to evaluate.
+* `segment` (Optional) - Name of the `segment` to share as defined in the `segments` section. This is used only when the `association_method` is `constant`.
+* `tag_value_of_key` (Optional) - Maps the attachment to the value of a known key. This is used with the `association_method` is `tag`. For example a `tag` of `stage = “test”`, will map to a segment named `test`. The value must exactly match the name of a segment. This allows you to have many segments, but use only a single rule without having to define multiple nearly identical conditions. This prevents creating many similar conditions that all use the same keys to map to segments.
+* `require_acceptance` (Optional) - Determines if this mapping should override the segment value for `require_attachment_acceptance`. You can only set this to `true`, indicating that this setting applies only to segments that have `require_attachment_acceptance` set to `false`. If the segment already has the default `require_attachment_acceptance`, you can set this to inherit segment’s acceptance value.
+
+### `conditions`
+
+The conditions block has 4 arguments `type`, `operator`, `key`, `value`. Setting or omitting each argument requires a combination of logic based on the value set to `type`. For that reason, please refer to the [AWS documentation](https://docs.aws.amazon.com/vpc/latest/cloudwan/cloudwan-policies-json.html) for complete usage docs.
+
+The following arguments are available:
+
+* `type` (Required) - Valid values include: `account-id`, `any`, `tag-value`, `tag-exists`, `resource-id`, `region`, `attachment-type`.
+* `operator` (Optional) - Valid values include: `equals`, `not-equals`, `contains`, `begins-with`.
+* `key` (Optional) - string value
+* `value` (Optional) - string value
+
+### `core_network_configuration`
+
+The following arguments are available:
+
+* `asn_ranges` (Required) - List of strings containing Autonomous System Numbers (ASNs) to assign to Core Network Edges. By default, the core network automatically assigns an ASN for each Core Network Edge but you can optionally define the ASN in the edge-locations for each Region. The ASN uses an array of integer ranges only from `64512` to `65534` and `4200000000` to `4294967294` expressed as a string like `"64512-65534"`. No other ASN ranges can be used.
+* `inside_cidr_blocks` (Optional) - The Classless Inter-Domain Routing (CIDR) block range used to create tunnels for AWS Transit Gateway Connect. The format is standard AWS CIDR range (for example, `10.0.1.0/24`). You can optionally define the inside CIDR in the Core Network Edges section per Region. The minimum is a `/24` for IPv4 or `/64` for IPv6. You can provide multiple `/24` subnets or a larger CIDR range. If you define a larger CIDR range, new Core Network Edges will be automatically assigned `/24` and `/64` subnets from the larger CIDR. an Inside CIDR block is required for attaching Connect attachments to a Core Network Edge.
+* `vpn_ecmp_support` (Optional) - Indicates whether the core network forwards traffic over multiple equal-cost routes using VPN. The value can be either `true` or `false`. The default is `true`.
+* `edge_locations` (Required) - A block value of AWS Region locations where you're creating Core Network Edges. Detailed below.
+
+### `edge_locations`
+
+The following arguments are available:
+
+* `locations` (Required) - An AWS Region code, such as `us-east-1`.
+* `asn` (Optional) - ASN of the Core Network Edge in an AWS Region. By default, the ASN will be a single integer automatically assigned from `asn_ranges`
+* `inside_cidr_blocks` (Optional) - The local CIDR blocks for this Core Network Edge for AWS Transit Gateway Connect attachments. By default, this CIDR block will be one or more optional IPv4 and IPv6 CIDR prefixes auto-assigned from `inside_cidr_blocks`.
+
+### `segments`
+
+The following arguments are available:
+
+* `allow_filter` (Optional) -  List of strings of segment names that explicitly allows only routes from the segments that are listed in the array. Use the `allow_filter` setting if a segment has a well-defined group of other segments that connectivity should be restricted to. It is applied after routes have been shared in `segment_actions`. If a segment is listed in `allow_filter`, attachments between the two segments will have routes if they are also shared in the segment-actions area. For example, you might have a segment named "video-producer" that should only ever share routes with a "video-distributor" segment, no matter how many other share statements are created.
+* `deny_filter` (Optional) - An array of segments that disallows routes from the segments listed in the array. It is applied only after routes have been shared in `segment_actions`. If a segment is listed in the `deny_filter`, attachments between the two segments will never have routes shared across them. For example, you might have a "financial" payment segment that should never share routes with a "development" segment, regardless of how many other share statements are created. Adding the payments segment to the deny-filter parameter prevents any shared routes from being created with other segments.
+* `description` (Optional) - A user-defined string describing the segment.
+* `edge_locations` (Optional) - A list of strings of AWS Region names. Allows you to define a more restrictive set of Regions for a segment. The edge location must be a subset of the locations that are defined for `edge_locations` in the `core_network_configuration`.
+* `isolate_attachments` (Optional) - This Boolean setting determines whether attachments on the same segment can communicate with each other. If set to `true`, the only routes available will be either shared routes through the share actions, which are attachments in other segments, or static routes. The default value is `false`. For example, you might have a segment dedicated to "development" that should never allow VPCs to talk to each other, even if they’re on the same segment. In this example, you would keep the default parameter of `false`.
+* `name` (Required) - Unique name for a segment. The name is a string used in other parts of the policy document, as well as in the console for metrics and other reference points. Valid characters are a–z, and 0–9.
+* `require_attachment_acceptance` (Optional) - This Boolean setting determines whether attachment requests are automatically approved or require acceptance. The default is `true`, indicating that attachment requests require acceptance. For example, you might use this setting to allow a "sandbox" segment to allow any attachment request so that a core network or attachment administrator does not need to review and approve attachment requests. In this example, `require_attachment_acceptance` is set to `false`.
+
+### `segment_actions`
+
+`segment_actions` have differnet outcomes based on their `action` argument value. There are 2 valid values for `action`: `create-route` & `share`. Behaviors of the below arguments changed depending on the `action` you specify. For more details on their use see the [AWS documentation](https://docs.aws.amazon.com/vpc/latest/cloudwan/cloudwan-policies-json.html#cloudwan-segment-actions-json).
+
+~> **NOTE:** `share_with` and `share_with_except` break from the AWS API specification. The API has 1 argument `share-with` and it can accept 3 input types as valid (`"*"`, `["<segment-name>"]`, or `{ except: ["<segment-name>"]}`). To emulate this behavior, `share_with` is always a list that can accept the argument `["*"]` as valid for `"*"` and `share_with_except` is a that can accept `["<segment-name>"]` as valid for `{ except: ["<segment-name>"]}`. You may only specify one of: `share_with` or `share_with_except`.
+
+The following arguments are available:
+
+* `action` (Required) - Action to take for the chosen segment. Valid values `create-route` or `share`.
+* `description` (Optional) - A user-defined string describing the segment action.
+* `destination_cidr_blocks` (Optional) - List of strings containing CIDRs. You can define the IPv4 and IPv6 CIDR notation for each AWS Region. For example, `10.1.0.0/16` or `2001:db8::/56`. This is an array of CIDR notation strings.
+* `destinations` (Optional) - A list of strings. Valid values include `["blackhole"]` or a list of attachment ids.
+* `mode` (Optional) - String. This mode places the attachment and return routes in each of the `share_with` segments. Valid values include: `attachment-route`.
+* `segment` (Optional) - Name of the segment.
+* `share_with` (Optional) - A list of strings to share with. Must be a substring is all segments. Valid values include: `["*"]` or `["<segment-names>"]`.
+* `share_with_except` (Optional) - A set subtraction of segments to not share with.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `json` - Standard JSON policy document rendered based on the arguments above.
+
+<!-- cache-key: cdktf-0.18.0 input-2d3a246690051cddc4eb7a0126e5c94a805d1a1904d829fcafd01fc1ad9efb5b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/networkmanager_device.html.markdown b/website/docs/cdktf/python/d/networkmanager_device.html.markdown
new file mode 100644
index 00000000000..5fd026c917a
--- /dev/null
+++ b/website/docs/cdktf/python/d/networkmanager_device.html.markdown
@@ -0,0 +1,67 @@
+---
+subcategory: "Network Manager"
+layout: "aws"
+page_title: "AWS: aws_networkmanager_device"
+description: |-
+  Retrieve information about a device.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_networkmanager_device
+
+Retrieve information about a device.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_networkmanager_device import DataAwsNetworkmanagerDevice
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, globalNetworkId):
+        super().__init__(scope, name)
+        DataAwsNetworkmanagerDevice(self, "example",
+            device_id=device_id.string_value,
+            global_network_id_id=global_network_id.value,
+            global_network_id=global_network_id
+        )
+```
+
+## Argument Reference
+
+* `device_id` - (Required) ID of the device.
+* `global_network_id` - (Required) ID of the global network.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the device.
+* `aws_location` - AWS location of the device. Documented below.
+* `description` - Description of the device.
+* `location` - Location of the device. Documented below.
+* `model` - Model of device.
+* `serial_number` - Serial number of the device.
+* `site_id` - ID of the site.
+* `tags` - Key-value tags for the device.
+* `type` - Type of device.
+* `vendor` - Vendor of the device.
+
+The `aws_location` object supports the following:
+
+* `subnet_arn` - ARN of the subnet that the device is located in.
+* `zone` - Zone that the device is located in.
+
+The `location` object supports the following:
+
+* `address` - Physical address.
+* `latitude` - Latitude.
+* `longitude` - Longitude.
+
+<!-- cache-key: cdktf-0.18.0 input-76a048bd410df03a668e6600981e43b447b543ed4c21486482b217e2964dea85 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/networkmanager_devices.html.markdown b/website/docs/cdktf/python/d/networkmanager_devices.html.markdown
new file mode 100644
index 00000000000..8aa6f635661
--- /dev/null
+++ b/website/docs/cdktf/python/d/networkmanager_devices.html.markdown
@@ -0,0 +1,49 @@
+---
+subcategory: "Network Manager"
+layout: "aws"
+page_title: "AWS: aws_networkmanager_devices"
+description: |-
+  Retrieve information about devices.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_networkmanager_devices
+
+Retrieve information about devices.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_networkmanager_devices import DataAwsNetworkmanagerDevices
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsNetworkmanagerDevices(self, "example",
+            global_network_id=global_network_id.string_value,
+            tags={
+                "Env": "test"
+            }
+        )
+```
+
+## Argument Reference
+
+* `global_network_id` - (Required) ID of the Global Network of the devices to retrieve.
+* `site_id` - (Optional) ID of the site of the devices to retrieve.
+* `tags` - (Optional) Restricts the list to the devices with these tags.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `ids` - IDs of the devices.
+
+<!-- cache-key: cdktf-0.18.0 input-9df9546ef10dcce363950ea6c2c54dab55158382413f15d47a541efaeb75a8bb -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/networkmanager_global_network.html.markdown b/website/docs/cdktf/python/d/networkmanager_global_network.html.markdown
new file mode 100644
index 00000000000..885bbb0e50f
--- /dev/null
+++ b/website/docs/cdktf/python/d/networkmanager_global_network.html.markdown
@@ -0,0 +1,46 @@
+---
+subcategory: "Network Manager"
+layout: "aws"
+page_title: "AWS: aws_networkmanager_global_network"
+description: |-
+  Retrieve information about a global network.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_networkmanager_global_network
+
+Retrieve information about a global network.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_networkmanager_global_network import DataAwsNetworkmanagerGlobalNetwork
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsNetworkmanagerGlobalNetwork(self, "example",
+            global_network_id=global_network_id.string_value
+        )
+```
+
+## Argument Reference
+
+* `global_network_id` - (Required) ID of the specific global network to retrieve.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the global network.
+* `description` - Description of the global network.
+* `tags` - Map of resource tags.
+
+<!-- cache-key: cdktf-0.18.0 input-2beedb9058cb6af0278a82e6f6239295f59bb32ff22d4cf013144823c528e416 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/networkmanager_global_networks.html.markdown b/website/docs/cdktf/python/d/networkmanager_global_networks.html.markdown
new file mode 100644
index 00000000000..ac75a7cec8c
--- /dev/null
+++ b/website/docs/cdktf/python/d/networkmanager_global_networks.html.markdown
@@ -0,0 +1,46 @@
+---
+subcategory: "Network Manager"
+layout: "aws"
+page_title: "AWS: aws_networkmanager_global_networks"
+description: |-
+  Retrieve information about global networks.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_networkmanager_global_networks
+
+Retrieve information about global networks.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_networkmanager_global_networks import DataAwsNetworkmanagerGlobalNetworks
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsNetworkmanagerGlobalNetworks(self, "example",
+            tags={
+                "Env": "test"
+            }
+        )
+```
+
+## Argument Reference
+
+* `tags` - (Optional) Restricts the list to the global networks with these tags.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `ids` - IDs of the global networks.
+
+<!-- cache-key: cdktf-0.18.0 input-caac60dd34c0be6b782428c6a470c9e4f07734555611246ab87a27c694b566de -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/networkmanager_link.html.markdown b/website/docs/cdktf/python/d/networkmanager_link.html.markdown
new file mode 100644
index 00000000000..10afaf9db9a
--- /dev/null
+++ b/website/docs/cdktf/python/d/networkmanager_link.html.markdown
@@ -0,0 +1,57 @@
+---
+subcategory: "Network Manager"
+layout: "aws"
+page_title: "AWS: aws_networkmanager_link"
+description: |-
+  Retrieve information about a link.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source:  aws_networkmanager_link
+
+Retrieve information about a link.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_networkmanager_link import DataAwsNetworkmanagerLink
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsNetworkmanagerLink(self, "example",
+            global_network_id=global_network_id.string_value,
+            link_id=link_id.string_value
+        )
+```
+
+## Argument Reference
+
+* `global_network_id` - (Required) ID of the Global Network of the link to retrieve.
+* `link_id` - (Required) ID of the specific link to retrieve.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the link.
+* `bandwidth` - Upload speed and download speed of the link as documented below
+* `description` - Description of the link.
+* `provider_name` - Provider of the link.
+* `site_id` - ID of the site.
+* `tags` - Key-value tags for the link.
+* `type` - Type of the link.
+
+The `bandwidth` object supports the following:
+
+* `download_speed` - Download speed in Mbps.
+* `upload_speed` - Upload speed in Mbps.
+
+<!-- cache-key: cdktf-0.18.0 input-1bb44c97d9c2c1eb71096f7293f01a1e8423d9ada68f26d6602f08c19b25554d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/networkmanager_links.html.markdown b/website/docs/cdktf/python/d/networkmanager_links.html.markdown
new file mode 100644
index 00000000000..f81014c970c
--- /dev/null
+++ b/website/docs/cdktf/python/d/networkmanager_links.html.markdown
@@ -0,0 +1,51 @@
+---
+subcategory: "Network Manager"
+layout: "aws"
+page_title: "AWS: aws_networkmanager_links"
+description: |-
+  Retrieve information about links.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_networkmanager_links
+
+Retrieve information about link.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_networkmanager_links import DataAwsNetworkmanagerLinks
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsNetworkmanagerLinks(self, "example",
+            global_network_id=global_network_id.string_value,
+            tags={
+                "Env": "test"
+            }
+        )
+```
+
+## Argument Reference
+
+* `global_network_id` - (Required) ID of the Global Network of the links to retrieve.
+* `provider_name` - (Optional) Link provider to retrieve.
+* `site_id` - (Optional) ID of the site of the links to retrieve.
+* `tags` - (Optional) Restricts the list to the links with these tags.
+* `type` - (Optional) Link type to retrieve.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `ids` - IDs of the links.
+
+<!-- cache-key: cdktf-0.18.0 input-1487eb3f5d87d6cd23f55d505c7f05610224dba8734fb0a6bb26595cb48f7494 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/networkmanager_site.html.markdown b/website/docs/cdktf/python/d/networkmanager_site.html.markdown
new file mode 100644
index 00000000000..5cf81cf32e6
--- /dev/null
+++ b/website/docs/cdktf/python/d/networkmanager_site.html.markdown
@@ -0,0 +1,55 @@
+---
+subcategory: "Network Manager"
+layout: "aws"
+page_title: "AWS: aws_networkmanager_site"
+description: |-
+  Retrieve information about a site.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source:  aws_networkmanager_site
+
+Retrieve information about a site.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_networkmanager_site import DataAwsNetworkmanagerSite
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsNetworkmanagerSite(self, "example",
+            global_network_id=global_network_id.string_value,
+            site_id=site_id.string_value
+        )
+```
+
+## Argument Reference
+
+* `global_network_id` - (Required) ID of the Global Network of the site to retrieve.
+* `site_id` - (Required) ID of the specific site to retrieve.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the site.
+* `description` - Description of the site.
+* `location` - Site location as documented below.
+* `tags` - Key-value tags for the Site.
+
+The `location` object supports the following:
+
+* `address` - Address of the location.
+* `latitude` - Latitude of the location.
+* `longitude` - Longitude of the location.
+
+<!-- cache-key: cdktf-0.18.0 input-2cbfc4283cdeeff2ae18f90ca3f052f344762564bd54bf48bd929558cd8d2825 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/networkmanager_sites.html.markdown b/website/docs/cdktf/python/d/networkmanager_sites.html.markdown
new file mode 100644
index 00000000000..047706398c7
--- /dev/null
+++ b/website/docs/cdktf/python/d/networkmanager_sites.html.markdown
@@ -0,0 +1,48 @@
+---
+subcategory: "Network Manager"
+layout: "aws"
+page_title: "AWS: aws_networkmanager_sites"
+description: |-
+  Retrieve information about sites.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_networkmanager_sites
+
+Retrieve information about sites.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_networkmanager_sites import DataAwsNetworkmanagerSites
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsNetworkmanagerSites(self, "example",
+            global_network_id=global_network_id.string_value,
+            tags={
+                "Env": "test"
+            }
+        )
+```
+
+## Argument Reference
+
+* `global_network_id` - (Required) ID of the Global Network of the sites to retrieve.
+* `tags` - (Optional) Restricts the list to the sites with these tags.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `ids` - IDs of the sites.
+
+<!-- cache-key: cdktf-0.18.0 input-08e4f00d2370cfd3791e0040e3d3ac4c38eb5a633f54bd737b6c7bfb36230318 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/oam_link.html.markdown b/website/docs/cdktf/python/d/oam_link.html.markdown
new file mode 100644
index 00000000000..56404c758da
--- /dev/null
+++ b/website/docs/cdktf/python/d/oam_link.html.markdown
@@ -0,0 +1,53 @@
+---
+subcategory: "CloudWatch Observability Access Manager"
+layout: "aws"
+page_title: "AWS: aws_oam_link"
+description: |-
+  Terraform data source for managing an AWS CloudWatch Observability Access Manager Link.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_oam_link
+
+Terraform data source for managing an AWS CloudWatch Observability Access Manager Link.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_oam_link import DataAwsOamLink
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsOamLink(self, "example",
+            link_identifier="arn:aws:oam:us-west-1:111111111111:link/abcd1234-a123-456a-a12b-a123b456c789"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `link_identifier` - (Required) ARN of the link.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the link.
+* `label` - Label that is assigned to this link.
+* `label_template` - Human-readable name used to identify this source account when you are viewing data from it in the monitoring account.
+* `link_id` - ID string that AWS generated as part of the link ARN.
+* `resource_types` - Types of data that the source account shares with the monitoring account.
+* `sink_arn` - ARN of the sink that is used for this link.
+
+<!-- cache-key: cdktf-0.18.0 input-26fcd6d6196bf524f0cfb96d5f07e971f686ef152091f112f43b672b61693a13 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/oam_links.html.markdown b/website/docs/cdktf/python/d/oam_links.html.markdown
new file mode 100644
index 00000000000..810bfdbed98
--- /dev/null
+++ b/website/docs/cdktf/python/d/oam_links.html.markdown
@@ -0,0 +1,40 @@
+---
+subcategory: "CloudWatch Observability Access Manager"
+layout: "aws"
+page_title: "AWS: aws_oam_links"
+description: |-
+  Terraform data source for managing an AWS CloudWatch Observability Access Manager Links.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_oam_links
+
+Terraform data source for managing an AWS CloudWatch Observability Access Manager Links.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_oam_links import DataAwsOamLinks
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsOamLinks(self, "example")
+```
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arns` - Set of ARN of the Links.
+
+<!-- cache-key: cdktf-0.18.0 input-a7fb5ca672e8b3f4688abaeffd562fa606b998eadee65b1f1a1a5566b670b2db -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/oam_sink.html.markdown b/website/docs/cdktf/python/d/oam_sink.html.markdown
new file mode 100644
index 00000000000..e821292bf1c
--- /dev/null
+++ b/website/docs/cdktf/python/d/oam_sink.html.markdown
@@ -0,0 +1,51 @@
+---
+subcategory: "CloudWatch Observability Access Manager"
+layout: "aws"
+page_title: "AWS: aws_oam_sink"
+description: |-
+  Terraform data source for managing an AWS CloudWatch Observability Access Manager Sink.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_oam_sink
+
+Terraform data source for managing an AWS CloudWatch Observability Access Manager Sink.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_oam_sink import DataAwsOamSink
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsOamSink(self, "example",
+            sink_identifier="arn:aws:oam:us-west-1:111111111111:sink/abcd1234-a123-456a-a12b-a123b456c789"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `sink_identifier` - (Required) ARN of the sink.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the sink.
+* `name` - Name of the sink.
+* `sink_id` - Random ID string that AWS generated as part of the sink ARN.
+* `tags` - Tags assigned to the sink.
+
+<!-- cache-key: cdktf-0.18.0 input-a4f5dba9c965dac580e8ea80924e17cc8d99e843f54e4829277a40c5b1d4e297 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/oam_sinks.html.markdown b/website/docs/cdktf/python/d/oam_sinks.html.markdown
new file mode 100644
index 00000000000..18a0aeae8dc
--- /dev/null
+++ b/website/docs/cdktf/python/d/oam_sinks.html.markdown
@@ -0,0 +1,40 @@
+---
+subcategory: "CloudWatch Observability Access Manager"
+layout: "aws"
+page_title: "AWS: aws_oam_sinks"
+description: |-
+  Terraform data source for managing an AWS CloudWatch Observability Access Manager Sinks.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_oam_sinks
+
+Terraform data source for managing an AWS CloudWatch Observability Access Manager Sinks.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_oam_sinks import DataAwsOamSinks
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsOamSinks(self, "example")
+```
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arns` - Set of ARN of the Sinks.
+
+<!-- cache-key: cdktf-0.18.0 input-b46f5566657905f2a09bc4770daf56461626b99543a0e965bfb54b6891ad7156 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/opensearch_domain.html.markdown b/website/docs/cdktf/python/d/opensearch_domain.html.markdown
new file mode 100644
index 00000000000..ef8307ae348
--- /dev/null
+++ b/website/docs/cdktf/python/d/opensearch_domain.html.markdown
@@ -0,0 +1,118 @@
+---
+subcategory: "OpenSearch"
+layout: "aws"
+page_title: "AWS: aws_opensearch_domain"
+description: |-
+  Get information on an OpenSearch Domain resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_opensearch_domain
+
+Use this data source to get information about an OpenSearch Domain
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_opensearch_domain import DataAwsOpensearchDomain
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsOpensearchDomain(self, "my_domain",
+            domain_name="my-domain-name"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `domain_name` – (Required) Name of the domain.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `access_policies` – Policy document attached to the domain.
+* `advanced_options` - Key-value string pairs to specify advanced configuration options.
+* `advanced_security_options` - Status of the OpenSearch domain's advanced security options. The block consists of the following attributes:
+    * `enabled` - Whether advanced security is enabled.
+    * `internal_user_database_enabled` - Whether the internal user database is enabled.
+* `arn` – ARN of the domain.
+* `auto_tune_options` - Configuration of the Auto-Tune options of the domain.
+    * `desired_state` - Auto-Tune desired state for the domain.
+    * `maintenance_schedule` - A list of the nested configurations for the Auto-Tune maintenance windows of the domain.
+        * `start_at` - Date and time at which the Auto-Tune maintenance schedule starts in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8).
+        * `duration` - Configuration block for the duration of the Auto-Tune maintenance window.
+            * `value` - Duration of an Auto-Tune maintenance window.
+            * `unit` - Unit of time.
+        * `cron_expression_for_recurrence` - Cron expression for an Auto-Tune maintenance schedule.
+    * `rollback_on_disable` - Whether the domain is set to roll back to default Auto-Tune settings when disabling Auto-Tune.
+* `cluster_config` - Cluster configuration of the domain.
+    * `cold_storage_options` - Configuration block containing cold storage configuration.
+        * `enabled` - Indicates  cold storage is enabled.
+    * `instance_type` - Instance type of data nodes in the cluster.
+    * `instance_count` - Number of instances in the cluster.
+    * `dedicated_master_enabled` - Indicates whether dedicated master nodes are enabled for the cluster.
+    * `dedicated_master_type` - Instance type of the dedicated master nodes in the cluster.
+    * `dedicated_master_count` - Number of dedicated master nodes in the cluster.
+    * `zone_awareness_enabled` - Indicates whether zone awareness is enabled.
+    * `zone_awareness_config` - Configuration block containing zone awareness settings.
+        * `availability_zone_count` - Number of availability zones used.
+    * `warm_enabled` - Warm storage is enabled.
+    * `warm_count` - Number of warm nodes in the cluster.
+    * `warm_type` - Instance type for the OpenSearch cluster's warm nodes.
+* `cognito_options` - Domain Amazon Cognito Authentication options for Dashboard.
+    * `enabled` - Whether Amazon Cognito Authentication is enabled.
+    * `user_pool_id` - Cognito User pool used by the domain.
+    * `identity_pool_id` - Cognito Identity pool used by the domain.
+    * `role_arn` - IAM Role with the AmazonOpenSearchServiceCognitoAccess policy attached.
+* `created` – Status of the creation of the domain.
+* `deleted` – Status of the deletion of the domain.
+* `domain_id` – Unique identifier for the domain.
+* `ebs_options` - EBS Options for the instances in the domain.
+    * `ebs_enabled` - Whether EBS volumes are attached to data nodes in the domain.
+    * `throughput` - The throughput (in MiB/s) of the EBS volumes attached to data nodes.
+    * `volume_type` - Type of EBS volumes attached to data nodes.
+    * `volume_size` - Size of EBS volumes attached to data nodes (in GB).
+    * `iops` - Baseline input/output (I/O) performance of EBS volumes attached to data nodes.
+* `engine_version` – OpenSearch version for the domain.
+* `encryption_at_rest` - Domain encryption at rest related options.
+    * `enabled` - Whether encryption at rest is enabled in the domain.
+    * `kms_key_id` - KMS key id used to encrypt data at rest.
+* `endpoint` – Domain-specific endpoint used to submit index, search, and data upload requests.
+* `dashboard_endpoint` - Domain-specific endpoint used to access the [Dashboard application](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/dashboards.html).
+* `kibana_endpoint` - (**Deprecated**) Domain-specific endpoint for kibana without https scheme. Use the `dashboard_endpoint` attribute instead.
+* `log_publishing_options` - Domain log publishing related options.
+    * `log_type` - Type of OpenSearch log being published.
+    * `cloudwatch_log_group_arn` - CloudWatch Log Group where the logs are published.
+    * `enabled` - Whether log publishing is enabled.
+* `node_to_node_encryption` - Domain in transit encryption related options.
+    * `enabled` - Whether node to node encryption is enabled.
+* `off_peak_window_options` - Off Peak update options
+    * `enabled` - Enabled disabled toggle for off-peak update window
+    * `off_peak_window`
+        * `window_start_time` - 10h window for updates
+            * `hours` - Starting hour of the 10-hour window for updates
+            * `minutes` - Starting minute of the 10-hour window for updates
+* `processing` – Status of a configuration change in the domain.
+* `snapshot_options` – Domain snapshot related options.
+    * `automated_snapshot_start_hour` - Hour during which the service takes an automated daily snapshot of the indices in the domain.
+* `software_update_options` - Software update options for the domain
+    * `auto_software_update_enabled` - Enabled or disabled.
+* `tags` - Tags assigned to the domain.
+* `vpc_options` - VPC Options for private OpenSearch domains.
+    * `availability_zones` - Availability zones used by the domain.
+    * `security_group_ids` - Security groups used by the domain.
+    * `subnet_ids` - Subnets used by the domain.
+    * `vpc_id` - VPC used by the domain.
+
+<!-- cache-key: cdktf-0.18.0 input-4b1000ae383db531a922afd36d146f59e8c9e92158fd3664a1e082f23a890d8d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/opensearchserverless_access_policy.html.markdown b/website/docs/cdktf/python/d/opensearchserverless_access_policy.html.markdown
new file mode 100644
index 00000000000..48cf606636f
--- /dev/null
+++ b/website/docs/cdktf/python/d/opensearchserverless_access_policy.html.markdown
@@ -0,0 +1,52 @@
+---
+subcategory: "OpenSearch Serverless"
+layout: "aws"
+page_title: "AWS: aws_opensearchserverless_access_policy"
+description: |-
+  Terraform data source for managing an AWS OpenSearch Serverless Access Policy.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_opensearchserverless_access_policy
+
+Terraform data source for managing an AWS OpenSearch Serverless Access Policy.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_opensearchserverless_access_policy import DataAwsOpensearchserverlessAccessPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsOpensearchserverlessAccessPolicy(self, "example",
+            name=Token.as_string(aws_opensearchserverless_access_policy_example.name),
+            type=Token.as_string(aws_opensearchserverless_access_policy_example.type)
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) Name of the policy.
+* `type` - (Required) Type of access policy. Must be `data`.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `description` - Description of the policy. Typically used to store information about the permissions defined in the policy.
+* `policy` - JSON policy document to use as the content for the new policy.
+* `policy_version` - Version of the policy.
+
+<!-- cache-key: cdktf-0.18.0 input-ac35c9dc57ef1f9e36ad182e014949ca30f6f5bc2316c4bcf6e057aee396e895 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/opensearchserverless_collection.html.markdown b/website/docs/cdktf/python/d/opensearchserverless_collection.html.markdown
new file mode 100644
index 00000000000..e0607edbb2f
--- /dev/null
+++ b/website/docs/cdktf/python/d/opensearchserverless_collection.html.markdown
@@ -0,0 +1,57 @@
+---
+subcategory: "OpenSearch Serverless"
+layout: "aws"
+page_title: "AWS: aws_opensearchserverless_collection"
+description: |-
+  Terraform data source for managing an AWS OpenSearch Serverless Collection.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_opensearchserverless_collection
+
+Terraform data source for managing an AWS OpenSearch Serverless Collection.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_opensearchserverless_collection import DataAwsOpensearchserverlessCollection
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsOpensearchserverlessCollection(self, "example",
+            name="example"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `id` - (Required) ID of the collection. Either `id` or `name` must be provided.
+* `name` - (Required) Name of the collection. Either `name` or `id` must be provided.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the collection.
+* `collection_endpoint` - Collection-specific endpoint used to submit index, search, and data upload requests to an OpenSearch Serverless collection.
+* `created_date` - Date the Collection was created.
+* `dashboard_endpoint` - Collection-specific endpoint used to access OpenSearch Dashboards.
+* `description` - Description of the collection.
+* `kms_key_arn` - The ARN of the Amazon Web Services KMS key used to encrypt the collection.
+* `last_modified_date` - Date the Collection was last modified.
+* `tags` - A map of tags to assign to the collection.
+* `type` - Type of collection.
+
+<!-- cache-key: cdktf-0.18.0 input-c332ac6004d40b1ef96d276212bcda57926844a7182625fd0fc4322010b56bb6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/opensearchserverless_security_config.html.markdown b/website/docs/cdktf/python/d/opensearchserverless_security_config.html.markdown
new file mode 100644
index 00000000000..e2f17cec692
--- /dev/null
+++ b/website/docs/cdktf/python/d/opensearchserverless_security_config.html.markdown
@@ -0,0 +1,62 @@
+---
+subcategory: "OpenSearch Serverless"
+layout: "aws"
+page_title: "AWS: aws_opensearchserverless_security_config"
+description: |-
+  Terraform data source for managing an AWS OpenSearch Serverless Security Config.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_opensearchserverless_security_config
+
+Terraform data source for managing an AWS OpenSearch Serverless Security Config.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_opensearchserverless_security_config import DataAwsOpensearchserverlessSecurityConfig
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsOpensearchserverlessSecurityConfig(self, "example",
+            id="saml/12345678912/example"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `id` - (Required) The unique identifier of the security configuration.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `config_version` - The version of the security configuration.
+* `created_date` - The date the configuration was created.
+* `description` - The description of the security configuration.
+* `last_modified_date` - The date the configuration was last modified.
+* `saml_options` - SAML options for the security configuration.
+* `type` - The type of security configuration.
+
+### saml_options
+
+SAML options for the security configuration.
+
+* `group_attribute` - Group attribute for this SAML integration.
+* `metadata` - The XML IdP metadata file generated from your identity provider.
+* `session_timeout` - Session timeout, in minutes. Minimum is 5 minutes and maximum is 720 minutes (12 hours). Default is 60 minutes.
+* `user_attribute` - User attribute for this SAML integration.
+
+<!-- cache-key: cdktf-0.18.0 input-8187974261e12b138d3a7e197de7ca26b20f843eafab8ec86b4f5a9e972ddaa6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/opensearchserverless_security_policy.html.markdown b/website/docs/cdktf/python/d/opensearchserverless_security_policy.html.markdown
new file mode 100644
index 00000000000..040d94f2b7a
--- /dev/null
+++ b/website/docs/cdktf/python/d/opensearchserverless_security_policy.html.markdown
@@ -0,0 +1,52 @@
+---
+subcategory: "OpenSearch Serverless"
+layout: "aws"
+page_title: "AWS: aws_opensearchserverless_security_policy"
+description: |-
+  Get information on an OpenSearch Serverless Security Policy.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_opensearchserverless_security_policy
+
+Use this data source to get information about an AWS OpenSearch Serverless Security Policy.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_opensearchserverless_security_policy import DataAwsOpensearchserverlessSecurityPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsOpensearchserverlessSecurityPolicy(self, "example",
+            name="example-security-policy",
+            type="encryption"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name of the policy
+* `type` - (Required) Type of security policy. One of `encryption` or `network`.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `created_date` - The date the security policy was created.
+* `description` - Description of the security policy.
+* `last_modified_date` - The date the security policy was last modified.
+* `policy` - The JSON policy document without any whitespaces.
+* `policy_version` - Version of the policy.
+
+<!-- cache-key: cdktf-0.18.0 input-ad99e2a9f8c79ed6569c0fb0eb9b7ab2fea24fd51596cfcf3c67bf8b48f6cd78 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/opensearchserverless_vpc_endpoint.html.markdown b/website/docs/cdktf/python/d/opensearchserverless_vpc_endpoint.html.markdown
new file mode 100644
index 00000000000..4c9b9904b51
--- /dev/null
+++ b/website/docs/cdktf/python/d/opensearchserverless_vpc_endpoint.html.markdown
@@ -0,0 +1,50 @@
+---
+subcategory: "OpenSearch Serverless"
+layout: "aws"
+page_title: "AWS: aws_opensearchserverless_vpc_endpoint"
+description: |-
+  Terraform data source for managing an AWS OpenSearch Serverless VPC Endpoint.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_opensearchserverless_vpc_endpoint
+
+Terraform data source for managing an AWS OpenSearch Serverless VPC Endpoint.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_opensearchserverless_vpc_endpoint import DataAwsOpensearchserverlessVpcEndpoint
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsOpensearchserverlessVpcEndpoint(self, "example",
+            vpc_endpoint_id="vpce-829a4487959e2a839"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `vpc_endpoint_id` - (Required) The unique identifier of the endpoint.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `created_date` - The date the endpoint was created.
+* `name` - The name of the endpoint.
+* `security_group_ids` - The IDs of the security groups that define the ports, protocols, and sources for inbound traffic that you are authorizing into your endpoint.
+* `subnet_ids` - The IDs of the subnets from which you access OpenSearch Serverless.
+* `vpc_id` - The ID of the VPC from which you access OpenSearch Serverless.
+
+<!-- cache-key: cdktf-0.18.0 input-2c446629971d0d10ff448173c283856675b8628bf661beac57c916ae51592d6d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/organizations_delegated_administrators.html.markdown b/website/docs/cdktf/python/d/organizations_delegated_administrators.html.markdown
new file mode 100644
index 00000000000..eed2e06cf24
--- /dev/null
+++ b/website/docs/cdktf/python/d/organizations_delegated_administrators.html.markdown
@@ -0,0 +1,52 @@
+---
+subcategory: "Organizations"
+layout: "aws"
+page_title: "AWS: aws_organizations_delegated_administrators"
+description: |-
+  Get a list of AWS accounts that are designated as delegated administrators in this organization 
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_organizations_delegated_administrators
+
+Get a list of AWS accounts that are designated as delegated administrators in this organization
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_organizations_delegated_administrators import DataAwsOrganizationsDelegatedAdministrators
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsOrganizationsDelegatedAdministrators(self, "example",
+            service_principal="SERVICE PRINCIPAL"
+        )
+```
+
+## Argument Reference
+
+* `service_principal` - (Optional) Specifies a service principal name. If specified, then the operation lists the delegated administrators only for the specified service. If you don't specify a service principal, the operation lists all delegated administrators for all services in your organization.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `delegated_administrators` - The list of delegated administrators in your organization, which have the following attributes:
+    * `arn` - The ARN of the delegated administrator's account.
+    * `delegation_enabled_date` - The date when the account was made a delegated administrator.
+    * `email` - The email address that is associated with the delegated administrator's AWS account.
+    * `id` - The unique identifier (ID) of the delegated administrator's account.
+    * `joined_method` - The method by which the delegated administrator's account joined the organization.
+    * `joined_timestamp` - The date when the delegated administrator's account became a part of the organization.
+    * `name` - The friendly name of the delegated administrator's account.
+    * `status` - The status of the delegated administrator's account in the organization.
+
+<!-- cache-key: cdktf-0.18.0 input-109c5f762c0d10ecbb15ab59b2bb18f8653bf89c01823c41fe23ae6036327116 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/organizations_delegated_services.html.markdown b/website/docs/cdktf/python/d/organizations_delegated_services.html.markdown
new file mode 100644
index 00000000000..dab8190488e
--- /dev/null
+++ b/website/docs/cdktf/python/d/organizations_delegated_services.html.markdown
@@ -0,0 +1,46 @@
+---
+subcategory: "Organizations"
+layout: "aws"
+page_title: "AWS: aws_organizations_delegated_services"
+description: |-
+  Get a list the AWS services for which the specified account is a delegated administrator 
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_organizations_delegated_services
+
+Get a list the AWS services for which the specified account is a delegated administrator
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_organizations_delegated_services import DataAwsOrganizationsDelegatedServices
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsOrganizationsDelegatedServices(self, "example",
+            account_id="AWS ACCOUNT ID"
+        )
+```
+
+## Argument Reference
+
+* `account_id` - (Required) Account ID number of a delegated administrator account in the organization.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `delegated_services` - Services for which the account is a delegated administrator, which have the following attributes:
+    * `delegation_enabled_date` - The date that the account became a delegated administrator for this service.
+    * `service_principal` - The name of an AWS service that can request an operation for the specified service.
+
+<!-- cache-key: cdktf-0.18.0 input-75948a55ba6b06c24be13238e2f8b8e4a682a05352b790ab2e35e7f82c3c8577 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/organizations_organization.html.markdown b/website/docs/cdktf/python/d/organizations_organization.html.markdown
new file mode 100644
index 00000000000..de39b809eb3
--- /dev/null
+++ b/website/docs/cdktf/python/d/organizations_organization.html.markdown
@@ -0,0 +1,126 @@
+---
+subcategory: "Organizations"
+layout: "aws"
+page_title: "AWS: aws_organizations_organization"
+description: |-
+  Get information about the organization that the user's account belongs to
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_organizations_organization
+
+Get information about the organization that the user's account belongs to
+
+## Example Usage
+
+### List all account IDs for the organization
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformOutput, Fn, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_organizations_organization import DataAwsOrganizationsOrganization
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = DataAwsOrganizationsOrganization(self, "example")
+        TerraformOutput(self, "account_ids",
+            value=Fn.lookup_nested(example.accounts, ["*", "id"])
+        )
+```
+
+### SNS topic that can be interacted by the organization only
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.data_aws_organizations_organization import DataAwsOrganizationsOrganization
+from imports.aws.sns_topic import SnsTopic
+from imports.aws.sns_topic_policy import SnsTopicPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        sns_topic = SnsTopic(self, "sns_topic",
+            name="my-sns-topic"
+        )
+        example = DataAwsOrganizationsOrganization(self, "example")
+        sns_topic_policy = DataAwsIamPolicyDocument(self, "sns_topic_policy",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["SNS:Subscribe", "SNS:Publish"],
+                condition=[DataAwsIamPolicyDocumentStatementCondition(
+                    test="StringEquals",
+                    values=[Token.as_string(example.id)],
+                    variable="aws:PrincipalOrgID"
+                )
+                ],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["*"],
+                    type="AWS"
+                )
+                ],
+                resources=[sns_topic.arn]
+            )
+            ]
+        )
+        aws_sns_topic_policy_sns_topic_policy = SnsTopicPolicy(self, "sns_topic_policy_3",
+            arn=sns_topic.arn,
+            policy=Token.as_string(sns_topic_policy.json)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_sns_topic_policy_sns_topic_policy.override_logical_id("sns_topic_policy")
+```
+
+## Argument Reference
+
+There are no arguments available for this data source.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the organization.
+* `feature_set` - FeatureSet of the organization.
+* `id` - ID of the organization.
+* `master_account_arn` - ARN of the account that is designated as the master account for the organization.
+* `master_account_email` - The email address that is associated with the AWS account that is designated as the master account for the organization.
+* `master_account_id` - Unique identifier (ID) of the master account of an organization.
+
+### Master Account or Delegated Administrator Attribute Reference
+
+If the account is the master account or a delegated administrator for the organization, the following attributes are also exported:
+
+* `accounts` - List of organization accounts including the master account. For a list excluding the master account, see the `non_master_accounts` attribute. All elements have these attributes:
+    * `arn` - ARN of the account
+    * `email` - Email of the account
+    * `id` - Identifier of the account
+    * `name` - Name of the account
+    * `status` - Status of the account
+* `aws_service_access_principals` - A list of AWS service principal names that have integration enabled with your organization. Organization must have `feature_set` set to `ALL`. For additional information, see the [AWS Organizations User Guide](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_integrate_services.html).
+* `enabled_policy_types` - A list of Organizations policy types that are enabled in the Organization Root. Organization must have `feature_set` set to `ALL`. For additional information about valid policy types (e.g., `SERVICE_CONTROL_POLICY`), see the [AWS Organizations API Reference](https://docs.aws.amazon.com/organizations/latest/APIReference/API_EnablePolicyType.html).
+* `non_master_accounts` - List of organization accounts excluding the master account. For a list including the master account, see the `accounts` attribute. All elements have these attributes:
+    * `arn` - ARN of the account
+    * `email` - Email of the account
+    * `id` - Identifier of the account
+    * `name` - Name of the account
+    * `status` - Status of the account
+* `roots` - List of organization roots. All elements have these attributes:
+    * `arn` - ARN of the root
+    * `id` - Identifier of the root
+    * `name` - Name of the root
+    * `policy_types` - List of policy types enabled for this root. All elements have these attributes:
+        * `name` - The name of the policy type
+        * `status` - The status of the policy type as it relates to the associated root
+
+<!-- cache-key: cdktf-0.18.0 input-4e6e30bcec5e05a330427cb7ef2a21c714b5908caa1af760eadc9537632c8f92 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/organizations_organizational_unit.html.markdown b/website/docs/cdktf/python/d/organizations_organizational_unit.html.markdown
new file mode 100644
index 00000000000..3e246e75a78
--- /dev/null
+++ b/website/docs/cdktf/python/d/organizations_organizational_unit.html.markdown
@@ -0,0 +1,55 @@
+---
+subcategory: "Organizations"
+layout: "aws"
+page_title: "AWS: aws_organizations_organizational_unit"
+description: |-
+  Terraform data source for getting an AWS Organizations Organizational Unit.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_organizations_organizational_unit
+
+Terraform data source for getting an AWS Organizations Organizational Unit.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_organizations_organization import DataAwsOrganizationsOrganization
+from imports.aws.data_aws_organizations_organizational_unit import DataAwsOrganizationsOrganizationalUnit
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        org = DataAwsOrganizationsOrganization(self, "org")
+        DataAwsOrganizationsOrganizationalUnit(self, "ou",
+            name="dev",
+            parent_id=Token.as_string(Fn.lookup_nested(org.roots, ["0", "id"]))
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `parent_id` - (Required) Parent ID of the organizational unit.
+
+* `name` - (Required) Name of the organizational unit
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the organizational unit
+
+* `id` - ID of the organizational unit
+
+<!-- cache-key: cdktf-0.18.0 input-e56dc041babcb69fcbea16355a3a2d9d89e93f6d8fb748bce77dcff633eefa4b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/organizations_organizational_unit_child_accounts.html.markdown b/website/docs/cdktf/python/d/organizations_organizational_unit_child_accounts.html.markdown
new file mode 100644
index 00000000000..9b82263b40f
--- /dev/null
+++ b/website/docs/cdktf/python/d/organizations_organizational_unit_child_accounts.html.markdown
@@ -0,0 +1,52 @@
+---
+subcategory: "Organizations"
+layout: "aws"
+page_title: "AWS: aws_organizations_organizational_unit_child_accounts"
+description: |-
+  Get all direct child accounts under a parent organizational unit. This only provides immediate children, not all children.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_organizations_organizational_unit_child_accounts
+
+Get all direct child accounts under a parent organizational unit. This only provides immediate children, not all children.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_organizations_organization import DataAwsOrganizationsOrganization
+from imports.aws.data_aws_organizations_organizational_unit_child_accounts import DataAwsOrganizationsOrganizationalUnitChildAccounts
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        org = DataAwsOrganizationsOrganization(self, "org")
+        DataAwsOrganizationsOrganizationalUnitChildAccounts(self, "accounts",
+            parent_id=Token.as_string(Fn.lookup_nested(org.roots, ["0", "id"]))
+        )
+```
+
+## Argument Reference
+
+* `parent_id` - (Required) The parent ID of the accounts.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `accounts` - List of child accounts, which have the following attributes:
+    * `arn` - The Amazon Resource Name (ARN) of the account.
+    * `email` - The email address associated with the AWS account.
+    * `id` - The unique identifier (ID) of the account.
+    * `name` - The friendly name of the account.
+    * `status` - The status of the account in the organization.
+* `id` - Parent identifier of the organizational units.
+
+<!-- cache-key: cdktf-0.18.0 input-76dc172a797ae2e6f20b12434b37314ffa18984dde0049de9f69d083f89caebb -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/organizations_organizational_unit_descendant_accounts.html.markdown b/website/docs/cdktf/python/d/organizations_organizational_unit_descendant_accounts.html.markdown
new file mode 100644
index 00000000000..2a3b46ed32f
--- /dev/null
+++ b/website/docs/cdktf/python/d/organizations_organizational_unit_descendant_accounts.html.markdown
@@ -0,0 +1,52 @@
+---
+subcategory: "Organizations"
+layout: "aws"
+page_title: "AWS: aws_organizations_organizational_unit_descendant_accounts"
+description: |-
+  Get all child accounts under a parent organizational unit. This provides all children.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_organizations_organizational_unit_descendant_accounts
+
+Get all direct child accounts under a parent organizational unit. This provides all children.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_organizations_organization import DataAwsOrganizationsOrganization
+from imports.aws.data_aws_organizations_organizational_unit_descendant_accounts import DataAwsOrganizationsOrganizationalUnitDescendantAccounts
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        org = DataAwsOrganizationsOrganization(self, "org")
+        DataAwsOrganizationsOrganizationalUnitDescendantAccounts(self, "accounts",
+            parent_id=Token.as_string(Fn.lookup_nested(org.roots, ["0", "id"]))
+        )
+```
+
+## Argument Reference
+
+* `parent_id` - (Required) The parent ID of the accounts.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `accounts` - List of child accounts, which have the following attributes:
+    * `arn` - The Amazon Resource Name (ARN) of the account.
+    * `email` - The email address associated with the AWS account.
+    * `id` - The unique identifier (ID) of the account.
+    * `name` - The friendly name of the account.
+    * `status` - The status of the account in the organization.
+* `id` - Parent identifier of the organizational units.
+
+<!-- cache-key: cdktf-0.18.0 input-83df36a9fecfe145252f01dc2fe86a6a203da74dd32b47b2a49d6433c732079d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/organizations_organizational_units.html.markdown b/website/docs/cdktf/python/d/organizations_organizational_units.html.markdown
new file mode 100644
index 00000000000..0a4b18df4ce
--- /dev/null
+++ b/website/docs/cdktf/python/d/organizations_organizational_units.html.markdown
@@ -0,0 +1,50 @@
+---
+subcategory: "Organizations"
+layout: "aws"
+page_title: "AWS: aws_organizations_organizational_units"
+description: |-
+  Get all direct child organizational units under a parent organizational unit. This only provides immediate children, not all children
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_organizations_organizational_units
+
+Get all direct child organizational units under a parent organizational unit. This only provides immediate children, not all children.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_organizations_organization import DataAwsOrganizationsOrganization
+from imports.aws.data_aws_organizations_organizational_units import DataAwsOrganizationsOrganizationalUnits
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        org = DataAwsOrganizationsOrganization(self, "org")
+        DataAwsOrganizationsOrganizationalUnits(self, "ou",
+            parent_id=Token.as_string(Fn.lookup_nested(org.roots, ["0", "id"]))
+        )
+```
+
+## Argument Reference
+
+* `parent_id` - (Required) Parent ID of the organizational unit.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `children` - List of child organizational units, which have the following attributes:
+    * `arn` - ARN of the organizational unit
+    * `name` - Name of the organizational unit
+    * `id` - ID of the organizational unit
+* `id` - Parent identifier of the organizational units.
+
+<!-- cache-key: cdktf-0.18.0 input-e8fba2e2a32deeaa9d34df7261c8bf4531104d7bb0b8f26e9a73581b276185d7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/organizations_policies.html.markdown b/website/docs/cdktf/python/d/organizations_policies.html.markdown
new file mode 100644
index 00000000000..79bca20b5b3
--- /dev/null
+++ b/website/docs/cdktf/python/d/organizations_policies.html.markdown
@@ -0,0 +1,61 @@
+---
+subcategory: "Organizations"
+layout: "aws"
+page_title: "AWS: aws_organizations_policies"
+description: |-
+  Terraform data source for managing an AWS Organizations Policies.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_organizations_policies
+
+Terraform data source for managing an AWS Organizations Policies.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformIterator, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_organizations_policies import DataAwsOrganizationsPolicies
+from imports.aws.data_aws_organizations_policy import DataAwsOrganizationsPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = DataAwsOrganizationsPolicies(self, "example",
+            filter="SERVICE_CONTROL_POLICY"
+        )
+        # In most cases loops should be handled in the programming language context and
+        #     not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+        #     you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+        #     you need to keep this like it is.
+        example_for_each_iterator = TerraformIterator.from_list(
+            Token.as_any(Fn.toset(example.ids)))
+        data_aws_organizations_policy_example = DataAwsOrganizationsPolicy(self, "example_1",
+            policy_id=Token.as_string(example_for_each_iterator.value),
+            for_each=example_for_each_iterator
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_organizations_policy_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `filter` - (Required) The type of policies to be returned in the response. Valid values are `SERVICE_CONTROL_POLICY | TAG_POLICY | BACKUP_POLICY | AISERVICES_OPT_OUT_POLICY`
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `ids` - List of all the policy ids found.
+
+<!-- cache-key: cdktf-0.18.0 input-bbb6107986f3a23baa5c573e84c2c0fd4ada189187325e46cc5d67b60df963bd -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/organizations_policies_for_target.html.markdown b/website/docs/cdktf/python/d/organizations_policies_for_target.html.markdown
new file mode 100644
index 00000000000..d3345c5cb73
--- /dev/null
+++ b/website/docs/cdktf/python/d/organizations_policies_for_target.html.markdown
@@ -0,0 +1,68 @@
+---
+subcategory: "Organizations"
+layout: "aws"
+page_title: "AWS: aws_organizations_policies_for_target"
+description: |-
+  Terraform data source for managing an AWS Organizations Policies For Target.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_organizations_policies_for_target
+
+Terraform data source for managing an AWS Organizations Policies For Target.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformIterator, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_organizations_organization import DataAwsOrganizationsOrganization
+from imports.aws.data_aws_organizations_policies_for_target import DataAwsOrganizationsPoliciesForTarget
+from imports.aws.data_aws_organizations_policy import DataAwsOrganizationsPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = DataAwsOrganizationsOrganization(self, "example")
+        data_aws_organizations_policies_for_target_example =
+        DataAwsOrganizationsPoliciesForTarget(self, "example_1",
+            filter="SERVICE_CONTROL_POLICY",
+            target_id=Token.as_string(Fn.lookup_nested(example.roots, ["0", "id"]))
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_organizations_policies_for_target_example.override_logical_id("example")
+        # In most cases loops should be handled in the programming language context and
+        #     not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+        #     you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+        #     you need to keep this like it is.
+        example_for_each_iterator = TerraformIterator.from_list(
+            Token.as_any(Fn.toset(data_aws_organizations_policies_for_target_example.ids)))
+        data_aws_organizations_policy_example = DataAwsOrganizationsPolicy(self, "example_2",
+            policy_id=Token.as_string(example_for_each_iterator.value),
+            for_each=example_for_each_iterator
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_organizations_policy_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `target_id` - (Required) The root (string that begins with "r-" followed by 4-32 lowercase letters or digits), account (12 digit string), or Organizational Unit (string starting with "ou-" followed by 4-32 lowercase letters or digits. This string is followed by a second "-" dash and from 8-32 additional lowercase letters or digits.)
+* `filter` - (Required) Must supply one of the 4 different policy filters for a target (SERVICE_CONTROL_POLICY | TAG_POLICY | BACKUP_POLICY | AISERVICES_OPT_OUT_POLICY)
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `ids` - List of all the policy ids found.
+
+<!-- cache-key: cdktf-0.18.0 input-7436628b3d5183c757aca388e0440d856a1c75b4b189df46ab759d8bf24e7ed5 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/organizations_policy.html.markdown b/website/docs/cdktf/python/d/organizations_policy.html.markdown
new file mode 100644
index 00000000000..0c3788dfe25
--- /dev/null
+++ b/website/docs/cdktf/python/d/organizations_policy.html.markdown
@@ -0,0 +1,66 @@
+---
+subcategory: "Organizations"
+layout: "aws"
+page_title: "AWS: aws_organizations_policy"
+description: |-
+  Terraform data source for managing an AWS Organizations Policy.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_organizations_policy
+
+Terraform data source for managing an AWS Organizations Policy.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws. import DataAwsOrganizationalPolicies
+from imports.aws.data_aws_organizations_organization import DataAwsOrganizationsOrganization
+from imports.aws.data_aws_organizations_policies_for_target import DataAwsOrganizationsPoliciesForTarget
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsOrganizationalPolicies(self, "test",
+            policy_id=Fn.lookup_nested(current.policies, ["0", "id"])
+        )
+        data_aws_organizations_organization_current =
+        DataAwsOrganizationsOrganization(self, "current")
+        data_aws_organizations_policies_for_target_current =
+        DataAwsOrganizationsPoliciesForTarget(self, "current_2",
+            filter="SERVICE_CONTROL_POLICY",
+            target_id=Token.as_string(
+                Fn.lookup_nested(data_aws_organizations_organization_current.roots, ["0", "id"
+                ]))
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_organizations_policies_for_target_current.override_logical_id("current")
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `policy_id` - (Required) The unique identifier (ID) of the policy that you want more details on. Policy id starts with a "p-" followed by 8-28 lowercase or uppercase letters, digits, and underscores.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name of the policy.
+* `aws_managed` - Indicates if a policy is an AWS managed policy.
+* `content` - The text content of the policy.
+* `description` - The description of the policy.
+* `name` - The friendly name of the policy.
+* `type` - The type of policy values can be `SERVICE_CONTROL_POLICY | TAG_POLICY | BACKUP_POLICY | AISERVICES_OPT_OUT_POLICY`
+
+<!-- cache-key: cdktf-0.18.0 input-64f486a6cfb19466cfa54daa60bbce856a5f3e8a11f79a4bf1dce126e773a631 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/organizations_resource_tags.html.markdown b/website/docs/cdktf/python/d/organizations_resource_tags.html.markdown
new file mode 100644
index 00000000000..9c962efb355
--- /dev/null
+++ b/website/docs/cdktf/python/d/organizations_resource_tags.html.markdown
@@ -0,0 +1,53 @@
+---
+subcategory: "Organizations"
+layout: "aws"
+page_title: "AWS: aws_organizations_resource_tags"
+description: |-
+  Get tags attached to the specified AWS Organizations resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_organizations_resource_tags
+
+Get tags attached to the specified AWS Organizations resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_organizations_resource_tags import DataAwsOrganizationsResourceTags
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsOrganizationsResourceTags(self, "account",
+            resource_id="123456123846"
+        )
+```
+
+## Argument Reference
+
+* `resource_id` - (Required) ID of the resource with the tags to list. See details below.
+
+### resource_id
+
+You can specify any of the following taggable resources.
+
+* AWS account – specify the account ID number.
+* Organizational unit – specify the OU ID that begins with `ou-` and looks similar to: `ou-1a2b-34uvwxyz`
+* Root – specify the root ID that begins with `r-` and looks similar to: `r-1a2b`
+* Policy – specify the policy ID that begins with `p-` and looks similar to: `p-12abcdefg3`
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `tags` - Map of key=value pairs for each tag set on the resource.
+
+<!-- cache-key: cdktf-0.18.0 input-9e1e646d2fbb671bf1b3448756c03ac6bb18b017208c1205580374b81a907e14 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/outposts_asset.html.markdown b/website/docs/cdktf/python/d/outposts_asset.html.markdown
new file mode 100644
index 00000000000..bdd9902ec35
--- /dev/null
+++ b/website/docs/cdktf/python/d/outposts_asset.html.markdown
@@ -0,0 +1,65 @@
+---
+subcategory: "Outposts"
+layout: "aws"
+page_title: "AWS: aws_outposts_asset"
+description: |-
+  Information about hardware assets in an Outpost.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_outposts_asset
+
+Information about a specific hardware asset in an Outpost.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, Fn, TerraformCount, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_outposts_asset import DataAwsOutpostsAsset
+from imports.aws.data_aws_outposts_assets import DataAwsOutpostsAssets
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = DataAwsOutpostsAssets(self, "example",
+            arn=Token.as_string(data_aws_outposts_outpost_example.arn)
+        )
+        # In most cases loops should be handled in the programming language context and
+        #     not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+        #     you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+        #     you need to keep this like it is.
+        example_count = TerraformCount.of(
+            Token.as_number(Fn.length_of(example.asset_ids)))
+        data_aws_outposts_asset_example = DataAwsOutpostsAsset(self, "example_1",
+            arn=Token.as_string(data_aws_outposts_outpost_example.arn),
+            asset_id=Token.as_string(
+                Fn.element(this_var.asset_ids, Token.as_number(example_count.index))),
+            count=example_count
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_outposts_asset_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `arn` - (Required) Outpost ARN.
+* `asset_id` - (Required) ID of the asset.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `asset_type` - Type of the asset.
+* `host_id` - Host ID of the Dedicated Hosts on the asset, if a Dedicated Host is provisioned.
+* `rack_elevation` - Position of an asset in a rack measured in rack units.
+* `rack_id` - Rack ID of the asset.
+
+<!-- cache-key: cdktf-0.18.0 input-8f6a07737f519ffaadeaca6364717f481098718bcbccdc2303dde41b73d75ac9 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/outposts_assets.html.markdown b/website/docs/cdktf/python/d/outposts_assets.html.markdown
new file mode 100644
index 00000000000..6226d34f458
--- /dev/null
+++ b/website/docs/cdktf/python/d/outposts_assets.html.markdown
@@ -0,0 +1,90 @@
+---
+subcategory: "Outposts"
+layout: "aws"
+page_title: "AWS: aws_outposts_assets"
+description: |-
+  Information about hardware assets in an Outpost.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_outposts_assets
+
+Information about hardware assets in an Outpost.
+
+## Example Usage
+
+### Basic
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_outposts_assets import DataAwsOutpostsAssets
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsOutpostsAssets(self, "example",
+            arn=Token.as_string(data_aws_outposts_outpost_example.arn)
+        )
+```
+
+### With Host ID Filter
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_outposts_assets import DataAwsOutpostsAssets
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsOutpostsAssets(self, "example",
+            arn=Token.as_string(data_aws_outposts_outpost_example.arn),
+            host_id_filter=["h-x38g5n0yd2a0ueb61"]
+        )
+```
+
+### With Status ID Filter
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_outposts_assets import DataAwsOutpostsAssets
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsOutpostsAssets(self, "example",
+            arn=Token.as_string(data_aws_outposts_outpost_example.arn),
+            status_id_filter=["ACTIVE"]
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `arn` - (Required) Outpost ARN.
+* `host_id_filter` - (Optional) Filters by list of Host IDs of a Dedicated Host.
+* `status_id_filter` - (Optional) Filters by list of state status. Valid values: "ACTIVE", "RETIRING".
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `asset_ids` - List of all the asset ids found. This data source will fail if none are found.
+
+<!-- cache-key: cdktf-0.18.0 input-99ccb47ab4f9ad99dcd20220176ab80d7d2a523ce444c488ada1146d9922821b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/outposts_outpost.html.markdown b/website/docs/cdktf/python/d/outposts_outpost.html.markdown
new file mode 100644
index 00000000000..8ddc7564de3
--- /dev/null
+++ b/website/docs/cdktf/python/d/outposts_outpost.html.markdown
@@ -0,0 +1,56 @@
+---
+subcategory: "Outposts"
+layout: "aws"
+page_title: "AWS: aws_outposts_outpost"
+description: |-
+  Provides details about an Outposts Outpost
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_outposts_outpost
+
+Provides details about an Outposts Outpost.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_outposts_outpost import DataAwsOutpostsOutpost
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsOutpostsOutpost(self, "example",
+            name="example"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `id` - (Optional) Identifier of the Outpost.
+* `name` - (Optional) Name of the Outpost.
+* `arn` - (Optional) ARN.
+* `owner_id` - (Optional) AWS Account identifier of the Outpost owner.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `availability_zone` - Availability Zone name.
+* `availability_zone_id` - Availability Zone identifier.
+* `description` - The description of the Outpost.
+* `lifecycle_status` - The life cycle status.
+* `site_arn` - The Amazon Resource Name (ARN) of the site.
+* `site_id` - The ID of the site.
+* `supported_hardware_type` - The hardware type.
+* `tags` - The Outpost tags.
+
+<!-- cache-key: cdktf-0.18.0 input-35f3fde745d0b61be013964ef1d616fef90704512a6afea84fcf8f9bf3c2acd5 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/outposts_outpost_instance_type.html.markdown b/website/docs/cdktf/python/d/outposts_outpost_instance_type.html.markdown
new file mode 100644
index 00000000000..b23d6366fdf
--- /dev/null
+++ b/website/docs/cdktf/python/d/outposts_outpost_instance_type.html.markdown
@@ -0,0 +1,58 @@
+---
+subcategory: "Outposts"
+layout: "aws"
+page_title: "AWS: aws_outposts_outpost_instance_type"
+description: |-
+  Information about single Outpost Instance Type.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_outposts_outpost_instance_type
+
+Information about single Outpost Instance Type.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws. import Ec2Instance
+from imports.aws.data_aws_outposts_outpost_instance_type import DataAwsOutpostsOutpostInstanceType
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = DataAwsOutpostsOutpostInstanceType(self, "example",
+            arn=Token.as_string(data_aws_outposts_outpost_example.arn),
+            preferred_instance_types=["m5.large", "m5.4xlarge"]
+        )
+        aws_ec2_instance_example = Ec2Instance(self, "example_1",
+            instance_type=example.instance_type
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_ec2_instance_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `arn` - (Required) Outpost ARN.
+
+The following arguments are optional:
+
+* `instance_type` - (Optional) Desired instance type. Conflicts with `preferred_instance_types`.
+* `preferred_instance_types` - (Optional) Ordered list of preferred instance types. The first match in this list will be returned. If no preferred matches are found and the original search returned more than one result, an error is returned. Conflicts with `instance_type`.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - Outpost identifier.
+
+<!-- cache-key: cdktf-0.18.0 input-bdb4cb1efd03c682353c33d56fbb0c15999ee4c0eda85c05b04d636ffab6f3a8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/outposts_outpost_instance_types.html.markdown b/website/docs/cdktf/python/d/outposts_outpost_instance_types.html.markdown
new file mode 100644
index 00000000000..5114c55da13
--- /dev/null
+++ b/website/docs/cdktf/python/d/outposts_outpost_instance_types.html.markdown
@@ -0,0 +1,46 @@
+---
+subcategory: "Outposts"
+layout: "aws"
+page_title: "AWS: aws_outposts_outpost_instance_types"
+description: |-
+  Information about Outpost Instance Types.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_outposts_outpost_instance_types
+
+Information about Outposts Instance Types.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_outposts_outpost_instance_types import DataAwsOutpostsOutpostInstanceTypes
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsOutpostsOutpostInstanceTypes(self, "example",
+            arn=Token.as_string(data_aws_outposts_outpost_example.arn)
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `arn` - (Required) Outpost ARN.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `instance_types` - Set of instance types.
+
+<!-- cache-key: cdktf-0.18.0 input-3dcd4d42109b60dec29ef5ce3754b18b70307fc52baa1c511a6b236d274c3d89 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/outposts_outposts.html.markdown b/website/docs/cdktf/python/d/outposts_outposts.html.markdown
new file mode 100644
index 00000000000..34161d684ea
--- /dev/null
+++ b/website/docs/cdktf/python/d/outposts_outposts.html.markdown
@@ -0,0 +1,51 @@
+---
+subcategory: "Outposts"
+layout: "aws"
+page_title: "AWS: aws_outposts_outposts"
+description: |-
+  Provides details about multiple Outposts
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_outposts_outposts
+
+Provides details about multiple Outposts.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_outposts_outposts import DataAwsOutpostsOutposts
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsOutpostsOutposts(self, "example",
+            site_id=id
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `availability_zone` - (Optional) Availability Zone name.
+* `availability_zone_id` - (Optional) Availability Zone identifier.
+* `site_id` - (Optional) Site identifier.
+* `owner_id` - (Optional) AWS Account identifier of the Outpost owner.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arns` - Set of Amazon Resource Names (ARNs).
+* `id` - AWS Region.
+* `ids` - Set of identifiers.
+
+<!-- cache-key: cdktf-0.18.0 input-02cae365ee7d67e7341963b741e8f66fba4ba35af6c45fb037892e4ed7c91bbe -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/outposts_site.html.markdown b/website/docs/cdktf/python/d/outposts_site.html.markdown
new file mode 100644
index 00000000000..5e85395b5dd
--- /dev/null
+++ b/website/docs/cdktf/python/d/outposts_site.html.markdown
@@ -0,0 +1,48 @@
+---
+subcategory: "Outposts"
+layout: "aws"
+page_title: "AWS: aws_outposts_site"
+description: |-
+  Provides details about an Outposts Site
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_outposts_site
+
+Provides details about an Outposts Site.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_outposts_site import DataAwsOutpostsSite
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsOutpostsSite(self, "example",
+            name="example"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `id` - (Optional) Identifier of the Site.
+* `name` - (Optional) Name of the Site.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `account_id` - AWS Account identifier.
+* `description` - Description.
+
+<!-- cache-key: cdktf-0.18.0 input-35136b0820f723be3d4e35e80bb8abd4839b40210fd445ddc0cbd77d3cf4f75f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/outposts_sites.html.markdown b/website/docs/cdktf/python/d/outposts_sites.html.markdown
new file mode 100644
index 00000000000..d34c3ecdfef
--- /dev/null
+++ b/website/docs/cdktf/python/d/outposts_sites.html.markdown
@@ -0,0 +1,43 @@
+---
+subcategory: "Outposts"
+layout: "aws"
+page_title: "AWS: aws_outposts_sites"
+description: |-
+  Provides details about multiple Outposts Sites.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_outposts_sites
+
+Provides details about multiple Outposts Sites.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_outposts_sites import DataAwsOutpostsSites
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsOutpostsSites(self, "all")
+```
+
+## Argument Reference
+
+There are no arguments available for this data source.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - AWS Region.
+* `ids` - Set of Outposts Site identifiers.
+
+<!-- cache-key: cdktf-0.18.0 input-33f8249a08c1a9e061aad127e234ad70eb79b16ee48652025b3daa5b7b81e2c1 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/partition.html.markdown b/website/docs/cdktf/python/d/partition.html.markdown
new file mode 100644
index 00000000000..55619457d50
--- /dev/null
+++ b/website/docs/cdktf/python/d/partition.html.markdown
@@ -0,0 +1,55 @@
+---
+subcategory: "Meta Data Sources"
+layout: "aws"
+page_title: "AWS: aws_partition"
+description: |-
+  Get AWS partition identifier
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_partition
+
+Use this data source to lookup information about the current AWS partition in
+which Terraform is working.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.data_aws_partition import DataAwsPartition
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        current = DataAwsPartition(self, "current")
+        DataAwsIamPolicyDocument(self, "s3_policy",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["s3:ListBucket"],
+                resources=["arn:${" + current.partition + "}:s3:::my-bucket"],
+                sid="1"
+            )
+            ]
+        )
+```
+
+## Argument Reference
+
+There are no arguments available for this data source.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `dns_suffix` - Base DNS domain name for the current partition (e.g., `amazonaws.com` in AWS Commercial, `amazonaws.com.cn` in AWS China).
+* `id` - Identifier of the current partition (e.g., `aws` in AWS Commercial, `aws-cn` in AWS China).
+* `partition` - Identifier of the current partition (e.g., `aws` in AWS Commercial, `aws-cn` in AWS China).
+* `reverse_dns_prefix` - Prefix of service names (e.g., `com.amazonaws` in AWS Commercial, `cn.com.amazonaws` in AWS China).
+
+<!-- cache-key: cdktf-0.18.0 input-c447a01a61c27aee6e9e0f866a2c423555ed2688482ef36f154476b5b7d14505 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/prefix_list.html.markdown b/website/docs/cdktf/python/d/prefix_list.html.markdown
new file mode 100644
index 00000000000..4e160664a5f
--- /dev/null
+++ b/website/docs/cdktf/python/d/prefix_list.html.markdown
@@ -0,0 +1,121 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_prefix_list"
+description: |-
+    Provides details about a specific prefix list
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_prefix_list
+
+`aws_prefix_list` provides details about a specific AWS prefix list (PL)
+in the current region.
+
+This can be used both to validate a prefix list given in a variable
+and to obtain the CIDR blocks (IP address ranges) for the associated
+AWS service. The latter may be useful e.g., for adding network ACL
+rules.
+
+The [aws_ec2_managed_prefix_list](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ec2_managed_prefix_list) data source is normally more appropriate to use given it can return customer-managed prefix list info, as well as additional attributes.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_prefix_list import DataAwsPrefixList
+from imports.aws.network_acl import NetworkAcl
+from imports.aws.network_acl_rule import NetworkAclRule
+from imports.aws.vpc_endpoint import VpcEndpoint
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        bar = NetworkAcl(self, "bar",
+            vpc_id=foo.id
+        )
+        private_s3 = VpcEndpoint(self, "private_s3",
+            service_name="com.amazonaws.us-west-2.s3",
+            vpc_id=foo.id
+        )
+        data_aws_prefix_list_private_s3 = DataAwsPrefixList(self, "private_s3_2",
+            prefix_list_id=private_s3.prefix_list_id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_prefix_list_private_s3.override_logical_id("private_s3")
+        aws_network_acl_rule_private_s3 = NetworkAclRule(self, "private_s3_3",
+            cidr_block=Token.as_string(
+                Fn.lookup_nested(data_aws_prefix_list_private_s3.cidr_blocks, ["0"])),
+            egress=False,
+            from_port=443,
+            network_acl_id=bar.id,
+            protocol="tcp",
+            rule_action="allow",
+            rule_number=200,
+            to_port=443
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_network_acl_rule_private_s3.override_logical_id("private_s3")
+```
+
+### Filter
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_prefix_list import DataAwsPrefixList
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsPrefixList(self, "test",
+            filter=[DataAwsPrefixListFilter(
+                name="prefix-list-id",
+                values=["pl-68a54001"]
+            )
+            ]
+        )
+```
+
+## Argument Reference
+
+The arguments of this data source act as filters for querying the available
+prefix lists. The given filters must match exactly one prefix list
+whose data will be exported as attributes.
+
+* `prefix_list_id` - (Optional) ID of the prefix list to select.
+* `name` - (Optional) Name of the prefix list to select.
+* `filter` - (Optional) Configuration block(s) for filtering. Detailed below.
+
+### filter Configuration Block
+
+The `filter` configuration block supports the following arguments:
+
+* `name` - (Required) Name of the filter field. Valid values can be found in the [EC2 DescribePrefixLists API Reference](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribePrefixLists.html).
+* `values` - (Required) Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the selected prefix list.
+* `name` - Name of the selected prefix list.
+* `cidr_blocks` - List of CIDR blocks for the AWS service associated with the prefix list.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `20m`)
+
+<!-- cache-key: cdktf-0.18.0 input-38cb83359a964cd4db19c88b875057b8276925ffe06c011b53a477d4b113a5ad -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/pricing_product.html.markdown b/website/docs/cdktf/python/d/pricing_product.html.markdown
new file mode 100644
index 00000000000..5feb611c8a1
--- /dev/null
+++ b/website/docs/cdktf/python/d/pricing_product.html.markdown
@@ -0,0 +1,99 @@
+---
+subcategory: "Pricing Calculator"
+layout: "aws"
+page_title: "AWS: aws_pricing_product"
+description: |-
+  Get information regarding the pricing of an Amazon product
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_pricing_product
+
+Use this data source to get the pricing information of all products in AWS.
+This data source is only available in a us-east-1 or ap-south-1 provider.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_pricing_product import DataAwsPricingProduct
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsPricingProduct(self, "example",
+            filters=[DataAwsPricingProductFilters(
+                field="instanceType",
+                value="c5.xlarge"
+            ), DataAwsPricingProductFilters(
+                field="operatingSystem",
+                value="Linux"
+            ), DataAwsPricingProductFilters(
+                field="location",
+                value="US East (N. Virginia)"
+            ), DataAwsPricingProductFilters(
+                field="preInstalledSw",
+                value="NA"
+            ), DataAwsPricingProductFilters(
+                field="licenseModel",
+                value="No License required"
+            ), DataAwsPricingProductFilters(
+                field="tenancy",
+                value="Shared"
+            ), DataAwsPricingProductFilters(
+                field="capacitystatus",
+                value="Used"
+            )
+            ],
+            service_code="AmazonEC2"
+        )
+```
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_pricing_product import DataAwsPricingProduct
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsPricingProduct(self, "example",
+            filters=[DataAwsPricingProductFilters(
+                field="instanceType",
+                value="ds1.xlarge"
+            ), DataAwsPricingProductFilters(
+                field="location",
+                value="US East (N. Virginia)"
+            )
+            ],
+            service_code="AmazonRedshift"
+        )
+```
+
+## Argument Reference
+
+* `service_code` - (Required) Code of the service. Available service codes can be fetched using the DescribeServices pricing API call.
+* `filters` - (Required) List of filters. Passed directly to the API (see GetProducts API reference). These filters must describe a single product, this resource will fail if more than one product is returned by the API.
+
+### filters
+
+* `field` (Required) Product attribute name that you want to filter on.
+* `value` (Required) Product attribute value that you want to filter on.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `result` - Set to the product returned from the API.
+
+<!-- cache-key: cdktf-0.18.0 input-7877cd39e468d078f53a2d4c542f1bf6ce9960ac9589794b8c81ab30b32ff42b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/prometheus_workspace.html.markdown b/website/docs/cdktf/python/d/prometheus_workspace.html.markdown
new file mode 100644
index 00000000000..4a837700cc7
--- /dev/null
+++ b/website/docs/cdktf/python/d/prometheus_workspace.html.markdown
@@ -0,0 +1,53 @@
+---
+subcategory: "AMP (Managed Prometheus)"
+layout: "aws"
+page_title: "AWS: aws_prometheus_workspace"
+description: |-
+  Gets information on an Amazon Managed Prometheus workspace.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_prometheus_workspace
+
+Provides an Amazon Managed Prometheus workspace data source.
+
+## Example Usage
+
+### Basic configuration
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_prometheus_workspace import DataAwsPrometheusWorkspace
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsPrometheusWorkspace(self, "example",
+            workspace_id="ws-41det8a1-2c67-6a1a-9381-9b83d3d78ef7"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `workspace_id` - (Required) Prometheus workspace ID.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Prometheus workspace.
+* `created_date` - Creation date of the Prometheus workspace.
+* `prometheus_endpoint` - Endpoint of the Prometheus workspace.
+* `alias` - Prometheus workspace alias.
+* `status` - Status of the Prometheus workspace.
+* `tags` - Tags assigned to the resource.
+
+<!-- cache-key: cdktf-0.18.0 input-2dd7010a4197a27a819b72ee32cf460519cbeffe970609f02714d302a749d6c2 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/prometheus_workspaces.html.markdown b/website/docs/cdktf/python/d/prometheus_workspaces.html.markdown
new file mode 100644
index 00000000000..83e70cd12b5
--- /dev/null
+++ b/website/docs/cdktf/python/d/prometheus_workspaces.html.markdown
@@ -0,0 +1,68 @@
+---
+subcategory: "AMP (Managed Prometheus)"
+layout: "aws"
+page_title: "AWS: aws_prometheus_workspaces"
+description: |-
+  Gets the aliases, ARNs, and workspace IDs of Amazon Prometheus workspaces.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_prometheus_workspaces
+
+Provides the aliases, ARNs, and workspace IDs of Amazon Prometheus workspaces.
+
+## Example Usage
+
+The following example returns all of the workspaces in a region:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_prometheus_workspaces import DataAwsPrometheusWorkspaces
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsPrometheusWorkspaces(self, "example")
+```
+
+The following example filters the workspaces by alias. Only the workspaces with
+aliases that begin with the value of `alias_prefix` will be returned:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_prometheus_workspaces import DataAwsPrometheusWorkspaces
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsPrometheusWorkspaces(self, "example",
+            alias_prefix="example"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `alias_prefix` - (Optional) Limits results to workspaces with aliases that begin with this value.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `aliases` - List of aliases of the matched Prometheus workspaces.
+* `arns` - List of ARNs of the matched Prometheus workspaces.
+* `workspace_ids` - List of workspace IDs of the matched Prometheus workspaces.
+
+<!-- cache-key: cdktf-0.18.0 input-80acf7908c27226d8c0361ef362e87dbc25d3955952bacb62b20968912d47d8e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/qldb_ledger.html.markdown b/website/docs/cdktf/python/d/qldb_ledger.html.markdown
new file mode 100644
index 00000000000..b089dfad21d
--- /dev/null
+++ b/website/docs/cdktf/python/d/qldb_ledger.html.markdown
@@ -0,0 +1,43 @@
+---
+subcategory: "QLDB (Quantum Ledger Database)"
+layout: "aws"
+page_title: "AWS: aws_qldb_ledger"
+description: |-
+  Get information on a Amazon Quantum Ledger Database (QLDB)
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_qldb_ledger
+
+Use this data source to fetch information about a Quantum Ledger Database.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_qldb_ledger import DataAwsQldbLedger
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsQldbLedger(self, "example",
+            name="an_example_ledger"
+        )
+```
+
+## Argument Reference
+
+* `name` - (Required) Friendly name of the ledger to match.
+
+## Attribute Reference
+
+See the [QLDB Ledger Resource](/docs/providers/aws/r/qldb_ledger.html) for details on the
+returned attributes - they are identical.
+
+<!-- cache-key: cdktf-0.18.0 input-0a3bcd75f129ece3016f3577ca775df98dda0b448d78fa027251b4d8bf803822 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/quicksight_data_set.html.markdown b/website/docs/cdktf/python/d/quicksight_data_set.html.markdown
new file mode 100644
index 00000000000..b89bd616810
--- /dev/null
+++ b/website/docs/cdktf/python/d/quicksight_data_set.html.markdown
@@ -0,0 +1,51 @@
+---
+subcategory: "QuickSight"
+layout: "aws"
+page_title: "AWS: aws_quicksight_data_set"
+description: |-
+  Use this data source to fetch information about a QuickSight Data Set.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_quicksight_data_set
+
+Data source for managing a QuickSight Data Set.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_quicksight_data_set import DataAwsQuicksightDataSet
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsQuicksightDataSet(self, "example",
+            data_set_id="example-id"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `data_set_id` - (Required) Identifier for the data set.
+
+The following arguments are optional:
+
+* `aws_account_id` - (Optional) AWS account ID.
+
+## Attribute Reference
+
+See the [Data Set Resource](/docs/providers/aws/r/quicksight_data_set.html) for details on the
+returned attributes - they are identical.
+
+<!-- cache-key: cdktf-0.18.0 input-8492869a248e84e19ddd16f07980df52ef0e93e1c422dbbba08a0d3de40e4ec1 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/quicksight_group.html.markdown b/website/docs/cdktf/python/d/quicksight_group.html.markdown
new file mode 100644
index 00000000000..ed9d181ba97
--- /dev/null
+++ b/website/docs/cdktf/python/d/quicksight_group.html.markdown
@@ -0,0 +1,57 @@
+---
+subcategory: "QuickSight"
+layout: "aws"
+page_title: "AWS: aws_quicksight_group"
+description: |-
+  Use this data source to fetch information about a QuickSight Group.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_quicksight_group
+
+This data source can be used to fetch information about a specific
+QuickSight group. By using this data source, you can reference QuickSight group
+properties without having to hard code ARNs or unique IDs as input.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_quicksight_group import DataAwsQuicksightGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsQuicksightGroup(self, "example",
+            group_name="example"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `group_name` - (Required) The name of the group that you want to match.
+
+The following arguments are optional:
+
+* `aws_account_id` - (Optional) AWS account ID.
+* `namespace` - (Optional) QuickSight namespace. Defaults to `default`.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) for the group.
+* `description` - The group description.
+* `principal_id` - The principal ID of the group.
+
+<!-- cache-key: cdktf-0.18.0 input-2c348640ef79405d8a0bd0ed47ae13ff12c796f3ad5a7922552ef44e21969deb -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/quicksight_theme.html.markdown b/website/docs/cdktf/python/d/quicksight_theme.html.markdown
new file mode 100644
index 00000000000..341509a0726
--- /dev/null
+++ b/website/docs/cdktf/python/d/quicksight_theme.html.markdown
@@ -0,0 +1,134 @@
+---
+subcategory: "QuickSight"
+layout: "aws"
+page_title: "AWS: aws_quicksight_theme"
+description: |-
+  Use this data source to fetch information about a QuickSight Theme.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_quicksight_theme
+
+Terraform data source for managing an AWS QuickSight Theme.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_quicksight_theme import DataAwsQuicksightTheme
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsQuicksightTheme(self, "example",
+            theme_id="example"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `theme_id` - Identifier of the theme.
+
+The following arguments are optional:
+
+* `aws_account_id` - AWS account ID.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the theme.
+* `base_theme_id` - The ID of the theme that a custom theme will inherit from. All themes inherit from one of the starting themes defined by Amazon QuickSight.
+* `configuration` - The theme configuration, which contains the theme display properties. See [configuration](#configuration).
+* `created_time` - The time that the theme was created.
+* `id` - A comma-delimited string joining AWS account ID and theme ID.
+* `last_updated_time` - The time that the theme was last updated.
+* `name` - Display name of the theme.
+* `permissions` - A set of resource permissions on the theme. See [permissions](#permissions).
+* `status` - The theme creation status.
+* `tags` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block).
+* `version_description` - A description of the current theme version being created/updated.
+* `version_number` - The version number of the theme version.
+
+### permissions
+
+* `actions` - List of IAM actions to grant or revoke permissions on.
+* `principal` - ARN of the principal. See the [ResourcePermission documentation](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_ResourcePermission.html) for the applicable ARN values.
+
+### configuration
+
+* `data_color_palette` - Color properties that apply to chart data colors. See [data_color_palette](#data_color_palette).
+* `sheet` - Display options related to sheets. See [sheet](#sheet).
+* `typography` - Determines the typography options. See [typography](#typography).
+* `ui_color_palette` - Color properties that apply to the UI and to charts, excluding the colors that apply to data. See [ui_color_palette](#ui_color_palette).
+
+### data_color_palette
+
+* `colors` - List of hexadecimal codes for the colors. Minimum of 8 items and maximum of 20 items.
+* `empty_fill_color` - The hexadecimal code of a color that applies to charts where a lack of data is highlighted.
+* `min_max_gradient` - The minimum and maximum hexadecimal codes that describe a color gradient. List of exactly 2 items.
+
+### sheet
+
+* `tile` - The display options for tiles. See [tile](#tile).
+* `tile_layout` - The layout options for tiles. See [tile_layout](#tile_layout).
+
+### tile
+
+* `border` - The border around a tile. See [border](#border).
+
+### border
+
+* `show` - The option to enable display of borders for visuals.
+
+### tile_layout
+
+* `gutter` - The gutter settings that apply between tiles. See [gutter](#gutter).
+* `margin` - The margin settings that apply around the outside edge of sheets. See [margin](#margin).
+
+### gutter
+
+* `show` - This Boolean value controls whether to display a gutter space between sheet tiles.
+
+### margin
+
+* `show` - This Boolean value controls whether to display sheet margins.
+
+### typography
+
+* `font_families` - Determines the list of font families. Maximum number of 5 items. See [font_families](#font_families).
+
+### font_families
+
+* `font_family` - Font family name.
+
+### ui_color_palette
+
+* `accent` - Color (hexadecimal) that applies to selected states and buttons.
+* `accent_foreground` - Color (hexadecimal) that applies to any text or other elements that appear over the accent color.
+* `danger` - Color (hexadecimal) that applies to error messages.
+* `danger_foreground` - Color (hexadecimal) that applies to any text or other elements that appear over the error color.
+* `dimension` - Color (hexadecimal) that applies to the names of fields that are identified as dimensions.
+* `dimension_foreground` - Color (hexadecimal) that applies to any text or other elements that appear over the dimension color.
+* `measure` - Color (hexadecimal) that applies to the names of fields that are identified as measures.
+* `measure_foreground` - Color (hexadecimal) that applies to any text or other elements that appear over the measure color.
+* `primary_background` - Color (hexadecimal) that applies to visuals and other high emphasis UI.
+* `primary_foreground` - Color (hexadecimal) of text and other foreground elements that appear over the primary background regions, such as grid lines, borders, table banding, icons, and so on.
+* `secondary_background` - Color (hexadecimal) that applies to the sheet background and sheet controls.
+* `secondary_foreground` - Color (hexadecimal) that applies to any sheet title, sheet control text, or UI that appears over the secondary background.
+* `success` - Color (hexadecimal) that applies to success messages, for example the check mark for a successful download.
+* `success_foreground` - Color (hexadecimal) that applies to any text or other elements that appear over the success color.
+* `warning` - Color (hexadecimal) that applies to warning and informational messages.
+* `warning_foreground` - Color (hexadecimal) that applies to any text or other elements that appear over the warning color.
+
+<!-- cache-key: cdktf-0.18.0 input-2daca04fcd76a4ea2ca17ad1ba924c5d29610a6687a891e20570267c4f9bd850 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/quicksight_user.html.markdown b/website/docs/cdktf/python/d/quicksight_user.html.markdown
new file mode 100644
index 00000000000..0d2f707249d
--- /dev/null
+++ b/website/docs/cdktf/python/d/quicksight_user.html.markdown
@@ -0,0 +1,63 @@
+---
+subcategory: "QuickSight"
+layout: "aws"
+page_title: "AWS: aws_quicksight_user"
+description: |-
+  Use this data source to fetch information about a QuickSight User.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_quicksight_user
+
+This data source can be used to fetch information about a specific
+QuickSight user. By using this data source, you can reference QuickSight user
+properties without having to hard code ARNs or unique IDs as input.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_quicksight_user import DataAwsQuicksightUser
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsQuicksightUser(self, "example",
+            user_name="example"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `user_name` - (Required) The name of the user that you want to match.
+
+The following arguments are optional:
+
+* `aws_account_id` - (Optional) AWS account ID.
+* `namespace` - (Optional) QuickSight namespace. Defaults to `default`.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `active` - The active status of user. When you create an Amazon QuickSight user that’s not an IAM user or an Active Directory user, that user is inactive until they sign in and provide a password.
+* `arn` - The Amazon Resource Name (ARN) for the user.
+* `email` - The user's email address.
+* `identity_type` - The type of identity authentication used by the user.
+* `principal_id` - The principal ID of the user.
+* `user_role` - The Amazon QuickSight role for the user. The user role can be one of the following:.
+    - `READER`: A user who has read-only access to dashboards.
+    - `AUTHOR`: A user who can create data sources, datasets, analyses, and dashboards.
+    - `ADMIN`: A user who is an author, who can also manage Amazon QuickSight settings.
+
+<!-- cache-key: cdktf-0.18.0 input-8a09e3c69e880b414f66924d3def015ce6ed48913a9a062d5f17590c11a6327c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/ram_resource_share.html.markdown b/website/docs/cdktf/python/d/ram_resource_share.html.markdown
new file mode 100644
index 00000000000..1a4d740070f
--- /dev/null
+++ b/website/docs/cdktf/python/d/ram_resource_share.html.markdown
@@ -0,0 +1,83 @@
+---
+subcategory: "RAM (Resource Access Manager)"
+layout: "aws"
+page_title: "AWS: aws_ram_resource_share"
+description: |-
+  Retrieve information about a RAM Resource Share
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_ram_resource_share
+
+`aws_ram_resource_share` Retrieve information about a RAM Resource Share.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_ram_resource_share import DataAwsRamResourceShare
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsRamResourceShare(self, "example",
+            name="example",
+            resource_owner="SELF"
+        )
+```
+
+## Search by filters
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_ram_resource_share import DataAwsRamResourceShare
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsRamResourceShare(self, "tag_filter",
+            filter=[DataAwsRamResourceShareFilter(
+                name="NameOfTag",
+                values=["exampleNameTagValue"]
+            )
+            ],
+            name="MyResourceName",
+            resource_owner="SELF"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name of the resource share to retrieve.
+* `resource_owner` (Required) Owner of the resource share. Valid values are `SELF` or `OTHER-ACCOUNTS`.
+
+* `resource_share_status` (Optional) Specifies that you want to retrieve details of only those resource shares that have this status. Valid values are `PENDING`, `ACTIVE`, `FAILED`, `DELETING`, and `DELETED`.
+* `filter` - (Optional) Filter used to scope the list e.g., by tags. See [related docs] (https://docs.aws.amazon.com/ram/latest/APIReference/API_TagFilter.html).
+    * `name` - (Required) Name of the tag key to filter on.
+    * `values` - (Required) Value of the tag key.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the resource share.
+* `id` - ARN of the resource share.
+* `owning_account_id` - ID of the AWS account that owns the resource share.
+* `resource_arns` - A list of resource ARNs associated with the resource share.
+* `status` - Status of the resource share.
+* `tags` - Tags attached to the resource share.
+
+<!-- cache-key: cdktf-0.18.0 input-54b4387b44c971bb05b58963626019234ab54bc7c441c150cb6b20fbb4f024fc -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/rds_certificate.html.markdown b/website/docs/cdktf/python/d/rds_certificate.html.markdown
new file mode 100644
index 00000000000..057082811d4
--- /dev/null
+++ b/website/docs/cdktf/python/d/rds_certificate.html.markdown
@@ -0,0 +1,53 @@
+---
+subcategory: "RDS (Relational Database)"
+layout: "aws"
+page_title: "AWS: aws_rds_certificate"
+description: |-
+  Information about an RDS Certificate.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_rds_certificate
+
+Information about an RDS Certificate.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_rds_certificate import DataAwsRdsCertificate
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsRdsCertificate(self, "example",
+            latest_valid_till=True
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `id` - (Optional) Certificate identifier. For example, `rds-ca-2019`.
+* `latest_valid_till` - (Optional) When enabled, returns the certificate with the latest `ValidTill`.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the certificate.
+* `certificate_type` - Type of certificate. For example, `CA`.
+* `customer_override` - Boolean whether there is an override for the default certificate identifier.
+* `customer_override_valid_till` - If there is an override for the default certificate identifier, when the override expires.
+* `thumbprint` - Thumbprint of the certificate.
+* `valid_from` - [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8) of certificate starting validity date.
+* `valid_till` - [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8) of certificate ending validity date.
+
+<!-- cache-key: cdktf-0.18.0 input-11fac79b0d201c3f0e3fe5f7ce9e1273fd98f100c84dc2f6a4a3f5286bb6b1dd -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/rds_cluster.html.markdown b/website/docs/cdktf/python/d/rds_cluster.html.markdown
new file mode 100644
index 00000000000..6f842b52631
--- /dev/null
+++ b/website/docs/cdktf/python/d/rds_cluster.html.markdown
@@ -0,0 +1,47 @@
+---
+subcategory: "RDS (Relational Database)"
+layout: "aws"
+page_title: "AWS: aws_rds_cluster"
+description: |-
+  Provides an RDS cluster data source.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_rds_cluster
+
+Provides information about an RDS cluster.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_rds_cluster import DataAwsRdsCluster
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsRdsCluster(self, "clusterName",
+            cluster_identifier="clusterName"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `cluster_identifier` - (Required) Cluster identifier of the RDS cluster.
+
+## Attribute Reference
+
+See the [RDS Cluster Resource](/docs/providers/aws/r/rds_cluster.html) for details on the
+returned attributes - they are identical for all attributes, except the `tags_all`. If you need to get the tags for this resource, use the attribute `tags` as described below.
+
+* `tags` - A map of tags assigned to the resource.
+
+<!-- cache-key: cdktf-0.18.0 input-c73b6ed9b7618d5c8808fa4b51f8b555a3290543f06a5030843096caf98e0ba8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/rds_clusters.html.markdown b/website/docs/cdktf/python/d/rds_clusters.html.markdown
new file mode 100644
index 00000000000..9419d5083da
--- /dev/null
+++ b/website/docs/cdktf/python/d/rds_clusters.html.markdown
@@ -0,0 +1,60 @@
+---
+subcategory: "RDS (Relational Database)"
+layout: "aws"
+page_title: "AWS: aws_rds_clusters"
+description: |-
+  Terraform data source for managing an AWS RDS (Relational Database) Clusters.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_rds_clusters
+
+Terraform data source for managing an AWS RDS (Relational Database) Clusters.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_rds_clusters import DataAwsRdsClusters
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsRdsClusters(self, "example",
+            filter=[DataAwsRdsClustersFilter(
+                name="engine",
+                values=["aurora-postgresql"]
+            )
+            ]
+        )
+```
+
+## Argument Reference
+
+The following arguments are optional:
+
+* `filter` - (Optional) Configuration block(s) for filtering. Detailed below.
+
+### filter Configuration block
+
+The `filter` configuration block supports the following arguments:
+
+* `name` - (Required) Name of the filter field. Valid values can be found in the [RDS DescribeDBClusters API Reference](https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeDBClusters.html).
+* `values` - (Required) Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `cluster_arns` - Set of cluster ARNs of the matched RDS clusters.
+* `cluster_identifiers` - Set of ARNs of cluster identifiers of the matched RDS clusters.
+
+<!-- cache-key: cdktf-0.18.0 input-68d8e0fc72c3359db6eb2f1e2e9009c536890e2e4f69c85c40a8c65401ddc632 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/rds_engine_version.html.markdown b/website/docs/cdktf/python/d/rds_engine_version.html.markdown
new file mode 100644
index 00000000000..a9b17c77b6c
--- /dev/null
+++ b/website/docs/cdktf/python/d/rds_engine_version.html.markdown
@@ -0,0 +1,94 @@
+---
+subcategory: "RDS (Relational Database)"
+layout: "aws"
+page_title: "AWS: aws_rds_engine_version"
+description: |-
+  Information about an RDS engine version.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_rds_engine_version
+
+Information about an RDS engine version.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_rds_engine_version import DataAwsRdsEngineVersion
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsRdsEngineVersion(self, "test",
+            engine="mysql",
+            preferred_versions=["8.0.27", "8.0.26"]
+        )
+```
+
+### With `filter`
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_rds_engine_version import DataAwsRdsEngineVersion
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsRdsEngineVersion(self, "test",
+            engine="aurora-postgresql",
+            filter=[DataAwsRdsEngineVersionFilter(
+                name="engine-mode",
+                values=["serverless"]
+            )
+            ],
+            include_all=True,
+            version="10.14"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `engine` - (Required) DB engine. Engine values include `aurora`, `aurora-mysql`, `aurora-postgresql`, `docdb`, `mariadb`, `mysql`, `neptune`, `oracle-ee`, `oracle-se`, `oracle-se1`, `oracle-se2`, `postgres`, `sqlserver-ee`, `sqlserver-ex`, `sqlserver-se`, and `sqlserver-web`.
+* `default_only` - (Optional) When set to `true`, the default version for the specified `engine` or combination of `engine` and major `version` will be returned. Can be used to limit responses to a single version when they would otherwise fail for returning multiple versions.
+* `filter` - (Optional) One or more name/value pairs to filter off of. There are several valid keys; for a full reference, check out [describe-db-engine-versions in the AWS CLI reference](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/rds/describe-db-engine-versions.html).
+* `include_all` - (Optional) When set to `true`, the specified `version` or member of `preferred_versions` will be returned even if it is `deprecated`. Otherwise, only `available` versions will be returned.
+* `parameter_group_family` - (Optional) Name of a specific DB parameter group family. Examples of parameter group families are `mysql8.0`, `mariadb10.4`, and `postgres12`.
+* `preferred_versions` - (Optional) Ordered list of preferred engine versions. The first match in this list will be returned. If no preferred matches are found and the original search returned more than one result, an error is returned. If both the `version` and `preferred_versions` arguments are not configured, the data source will return the default version for the engine.
+* `version` - (Optional) Version of the DB engine. For example, `5.7.22`, `10.1.34`, and `12.3`. If both the `version` and `preferred_versions` arguments are not configured, the data source will return the default version for the engine.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `default_character_set` - The default character set for new instances of this engine version.
+* `engine_description` - Description of the database engine.
+* `exportable_log_types` - Set of log types that the database engine has available for export to CloudWatch Logs.
+* `status` - Status of the DB engine version, either available or deprecated.
+* `supported_character_sets` - Set of the character sets supported by this engine.
+* `supported_feature_names` - Set of features supported by the DB engine.
+* `supported_modes` - Set of the supported DB engine modes.
+* `supported_timezones` - Set of the time zones supported by this engine.
+* `supports_global_databases` - Indicates whether you can use Aurora global databases with a specific DB engine version.
+* `supports_log_exports_to_cloudwatch` - Indicates whether the engine version supports exporting the log types specified by `exportable_log_types` to CloudWatch Logs.
+* `supports_parallel_query` - Indicates whether you can use Aurora parallel query with a specific DB engine version.
+* `supports_read_replica` - Indicates whether the database engine version supports read replicas.
+* `valid_upgrade_targets` - Set of engine versions that this database engine version can be upgraded to.
+* `version_description` - Description of the database engine version.
+
+<!-- cache-key: cdktf-0.18.0 input-fa55a0405ca9fc58a5c4381651f7bc42f18362fa5a2253efb0a727fa8fb51c93 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/rds_engine_version.markdown b/website/docs/cdktf/python/d/rds_engine_version.markdown
new file mode 100644
index 00000000000..a9b17c77b6c
--- /dev/null
+++ b/website/docs/cdktf/python/d/rds_engine_version.markdown
@@ -0,0 +1,94 @@
+---
+subcategory: "RDS (Relational Database)"
+layout: "aws"
+page_title: "AWS: aws_rds_engine_version"
+description: |-
+  Information about an RDS engine version.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_rds_engine_version
+
+Information about an RDS engine version.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_rds_engine_version import DataAwsRdsEngineVersion
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsRdsEngineVersion(self, "test",
+            engine="mysql",
+            preferred_versions=["8.0.27", "8.0.26"]
+        )
+```
+
+### With `filter`
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_rds_engine_version import DataAwsRdsEngineVersion
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsRdsEngineVersion(self, "test",
+            engine="aurora-postgresql",
+            filter=[DataAwsRdsEngineVersionFilter(
+                name="engine-mode",
+                values=["serverless"]
+            )
+            ],
+            include_all=True,
+            version="10.14"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `engine` - (Required) DB engine. Engine values include `aurora`, `aurora-mysql`, `aurora-postgresql`, `docdb`, `mariadb`, `mysql`, `neptune`, `oracle-ee`, `oracle-se`, `oracle-se1`, `oracle-se2`, `postgres`, `sqlserver-ee`, `sqlserver-ex`, `sqlserver-se`, and `sqlserver-web`.
+* `default_only` - (Optional) When set to `true`, the default version for the specified `engine` or combination of `engine` and major `version` will be returned. Can be used to limit responses to a single version when they would otherwise fail for returning multiple versions.
+* `filter` - (Optional) One or more name/value pairs to filter off of. There are several valid keys; for a full reference, check out [describe-db-engine-versions in the AWS CLI reference](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/rds/describe-db-engine-versions.html).
+* `include_all` - (Optional) When set to `true`, the specified `version` or member of `preferred_versions` will be returned even if it is `deprecated`. Otherwise, only `available` versions will be returned.
+* `parameter_group_family` - (Optional) Name of a specific DB parameter group family. Examples of parameter group families are `mysql8.0`, `mariadb10.4`, and `postgres12`.
+* `preferred_versions` - (Optional) Ordered list of preferred engine versions. The first match in this list will be returned. If no preferred matches are found and the original search returned more than one result, an error is returned. If both the `version` and `preferred_versions` arguments are not configured, the data source will return the default version for the engine.
+* `version` - (Optional) Version of the DB engine. For example, `5.7.22`, `10.1.34`, and `12.3`. If both the `version` and `preferred_versions` arguments are not configured, the data source will return the default version for the engine.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `default_character_set` - The default character set for new instances of this engine version.
+* `engine_description` - Description of the database engine.
+* `exportable_log_types` - Set of log types that the database engine has available for export to CloudWatch Logs.
+* `status` - Status of the DB engine version, either available or deprecated.
+* `supported_character_sets` - Set of the character sets supported by this engine.
+* `supported_feature_names` - Set of features supported by the DB engine.
+* `supported_modes` - Set of the supported DB engine modes.
+* `supported_timezones` - Set of the time zones supported by this engine.
+* `supports_global_databases` - Indicates whether you can use Aurora global databases with a specific DB engine version.
+* `supports_log_exports_to_cloudwatch` - Indicates whether the engine version supports exporting the log types specified by `exportable_log_types` to CloudWatch Logs.
+* `supports_parallel_query` - Indicates whether you can use Aurora parallel query with a specific DB engine version.
+* `supports_read_replica` - Indicates whether the database engine version supports read replicas.
+* `valid_upgrade_targets` - Set of engine versions that this database engine version can be upgraded to.
+* `version_description` - Description of the database engine version.
+
+<!-- cache-key: cdktf-0.18.0 input-fa55a0405ca9fc58a5c4381651f7bc42f18362fa5a2253efb0a727fa8fb51c93 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/rds_orderable_db_instance.html.markdown b/website/docs/cdktf/python/d/rds_orderable_db_instance.html.markdown
new file mode 100644
index 00000000000..8c5d8880d52
--- /dev/null
+++ b/website/docs/cdktf/python/d/rds_orderable_db_instance.html.markdown
@@ -0,0 +1,99 @@
+---
+subcategory: "RDS (Relational Database)"
+layout: "aws"
+page_title: "AWS: aws_rds_orderable_db_instance"
+description: |-
+  Information about RDS orderable DB instances.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_rds_orderable_db_instance
+
+Information about RDS orderable DB instances and valid parameter combinations.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_rds_orderable_db_instance import DataAwsRdsOrderableDbInstance
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsRdsOrderableDbInstance(self, "test",
+            engine="mysql",
+            engine_version="5.7.22",
+            license_model="general-public-license",
+            preferred_instance_classes=["db.r6.xlarge", "db.m4.large", "db.t3.small"],
+            storage_type="standard"
+        )
+```
+
+Valid parameter combinations can also be found with `preferred_engine_versions` and/or `preferred_instance_classes`.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_rds_orderable_db_instance import DataAwsRdsOrderableDbInstance
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsRdsOrderableDbInstance(self, "test",
+            engine="mysql",
+            license_model="general-public-license",
+            preferred_engine_versions=["5.6.35", "5.6.41", "5.6.44"],
+            preferred_instance_classes=["db.t2.small", "db.t3.medium", "db.t3.large"]
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `availability_zone_group` - (Optional) Availability zone group.
+* `engine` - (Required) DB engine. Engine values include `aurora`, `aurora-mysql`, `aurora-postgresql`, `docdb`, `mariadb`, `mysql`, `neptune`, `oracle-ee`, `oracle-se`, `oracle-se1`, `oracle-se2`, `postgres`, `sqlserver-ee`, `sqlserver-ex`, `sqlserver-se`, and `sqlserver-web`.
+* `engine_version` - (Optional) Version of the DB engine. If none is provided, the AWS-defined default version will be used.
+* `instance_class` - (Optional) DB instance class. Examples of classes are `db.m3.2xlarge`, `db.t2.small`, and `db.m3.medium`.
+* `license_model` - (Optional) License model. Examples of license models are `general-public-license`, `bring-your-own-license`, and `amazon-license`.
+* `preferred_instance_classes` - (Optional) Ordered list of preferred RDS DB instance classes. The first match in this list will be returned. If no preferred matches are found and the original search returned more than one result, an error is returned.
+* `preferred_engine_versions` - (Optional) Ordered list of preferred RDS DB instance engine versions. The first match in this list will be returned. If no preferred matches are found and the original search returned more than one result, an error is returned.
+* `storage_type` - (Optional) Storage types. Examples of storage types are `standard`, `io1`, `gp2`, and `aurora`.
+* `supports_enhanced_monitoring` - (Optional) Enable this to ensure a DB instance supports Enhanced Monitoring at intervals from 1 to 60 seconds.
+* `supports_global_databases` - (Optional) Enable this to ensure a DB instance supports Aurora global databases with a specific combination of other DB engine attributes.
+* `supports_iam_database_authentication` - (Optional) Enable this to ensure a DB instance supports IAM database authentication.
+* `supports_iops` - (Optional) Enable this to ensure a DB instance supports provisioned IOPS.
+* `supports_kerberos_authentication` - (Optional) Enable this to ensure a DB instance supports Kerberos Authentication.
+* `supports_performance_insights` - (Optional) Enable this to ensure a DB instance supports Performance Insights.
+* `supports_storage_autoscaling` - (Optional) Enable this to ensure Amazon RDS can automatically scale storage for DB instances that use the specified DB instance class.
+* `supports_storage_encryption` - (Optional) Enable this to ensure a DB instance supports encrypted storage.
+* `vpc` - (Optional) Boolean that indicates whether to show only VPC or non-VPC offerings.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `availability_zones` - Availability zones where the instance is available.
+* `max_iops_per_db_instance` - Maximum total provisioned IOPS for a DB instance.
+* `max_iops_per_gib` - Maximum provisioned IOPS per GiB for a DB instance.
+* `max_storage_size` - Maximum storage size for a DB instance.
+* `min_iops_per_db_instance` - Minimum total provisioned IOPS for a DB instance.
+* `min_iops_per_gib` - Minimum provisioned IOPS per GiB for a DB instance.
+* `min_storage_size` - Minimum storage size for a DB instance.
+* `multi_az_capable` - Whether a DB instance is Multi-AZ capable.
+* `outpost_capable` - Whether a DB instance supports RDS on Outposts.
+* `read_replica_capable` - Whether a DB instance can have a read replica.
+* `supported_engine_modes` - A list of the supported DB engine modes.
+* `supported_network_types` - The network types supported by the DB instance (`IPV4` or `DUAL`).
+
+<!-- cache-key: cdktf-0.18.0 input-d3074786a5def42976852645afdb8943af9aab3562de935df98229e60b04c7e9 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/rds_orderable_db_instance.markdown b/website/docs/cdktf/python/d/rds_orderable_db_instance.markdown
new file mode 100644
index 00000000000..8c5d8880d52
--- /dev/null
+++ b/website/docs/cdktf/python/d/rds_orderable_db_instance.markdown
@@ -0,0 +1,99 @@
+---
+subcategory: "RDS (Relational Database)"
+layout: "aws"
+page_title: "AWS: aws_rds_orderable_db_instance"
+description: |-
+  Information about RDS orderable DB instances.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_rds_orderable_db_instance
+
+Information about RDS orderable DB instances and valid parameter combinations.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_rds_orderable_db_instance import DataAwsRdsOrderableDbInstance
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsRdsOrderableDbInstance(self, "test",
+            engine="mysql",
+            engine_version="5.7.22",
+            license_model="general-public-license",
+            preferred_instance_classes=["db.r6.xlarge", "db.m4.large", "db.t3.small"],
+            storage_type="standard"
+        )
+```
+
+Valid parameter combinations can also be found with `preferred_engine_versions` and/or `preferred_instance_classes`.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_rds_orderable_db_instance import DataAwsRdsOrderableDbInstance
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsRdsOrderableDbInstance(self, "test",
+            engine="mysql",
+            license_model="general-public-license",
+            preferred_engine_versions=["5.6.35", "5.6.41", "5.6.44"],
+            preferred_instance_classes=["db.t2.small", "db.t3.medium", "db.t3.large"]
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `availability_zone_group` - (Optional) Availability zone group.
+* `engine` - (Required) DB engine. Engine values include `aurora`, `aurora-mysql`, `aurora-postgresql`, `docdb`, `mariadb`, `mysql`, `neptune`, `oracle-ee`, `oracle-se`, `oracle-se1`, `oracle-se2`, `postgres`, `sqlserver-ee`, `sqlserver-ex`, `sqlserver-se`, and `sqlserver-web`.
+* `engine_version` - (Optional) Version of the DB engine. If none is provided, the AWS-defined default version will be used.
+* `instance_class` - (Optional) DB instance class. Examples of classes are `db.m3.2xlarge`, `db.t2.small`, and `db.m3.medium`.
+* `license_model` - (Optional) License model. Examples of license models are `general-public-license`, `bring-your-own-license`, and `amazon-license`.
+* `preferred_instance_classes` - (Optional) Ordered list of preferred RDS DB instance classes. The first match in this list will be returned. If no preferred matches are found and the original search returned more than one result, an error is returned.
+* `preferred_engine_versions` - (Optional) Ordered list of preferred RDS DB instance engine versions. The first match in this list will be returned. If no preferred matches are found and the original search returned more than one result, an error is returned.
+* `storage_type` - (Optional) Storage types. Examples of storage types are `standard`, `io1`, `gp2`, and `aurora`.
+* `supports_enhanced_monitoring` - (Optional) Enable this to ensure a DB instance supports Enhanced Monitoring at intervals from 1 to 60 seconds.
+* `supports_global_databases` - (Optional) Enable this to ensure a DB instance supports Aurora global databases with a specific combination of other DB engine attributes.
+* `supports_iam_database_authentication` - (Optional) Enable this to ensure a DB instance supports IAM database authentication.
+* `supports_iops` - (Optional) Enable this to ensure a DB instance supports provisioned IOPS.
+* `supports_kerberos_authentication` - (Optional) Enable this to ensure a DB instance supports Kerberos Authentication.
+* `supports_performance_insights` - (Optional) Enable this to ensure a DB instance supports Performance Insights.
+* `supports_storage_autoscaling` - (Optional) Enable this to ensure Amazon RDS can automatically scale storage for DB instances that use the specified DB instance class.
+* `supports_storage_encryption` - (Optional) Enable this to ensure a DB instance supports encrypted storage.
+* `vpc` - (Optional) Boolean that indicates whether to show only VPC or non-VPC offerings.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `availability_zones` - Availability zones where the instance is available.
+* `max_iops_per_db_instance` - Maximum total provisioned IOPS for a DB instance.
+* `max_iops_per_gib` - Maximum provisioned IOPS per GiB for a DB instance.
+* `max_storage_size` - Maximum storage size for a DB instance.
+* `min_iops_per_db_instance` - Minimum total provisioned IOPS for a DB instance.
+* `min_iops_per_gib` - Minimum provisioned IOPS per GiB for a DB instance.
+* `min_storage_size` - Minimum storage size for a DB instance.
+* `multi_az_capable` - Whether a DB instance is Multi-AZ capable.
+* `outpost_capable` - Whether a DB instance supports RDS on Outposts.
+* `read_replica_capable` - Whether a DB instance can have a read replica.
+* `supported_engine_modes` - A list of the supported DB engine modes.
+* `supported_network_types` - The network types supported by the DB instance (`IPV4` or `DUAL`).
+
+<!-- cache-key: cdktf-0.18.0 input-d3074786a5def42976852645afdb8943af9aab3562de935df98229e60b04c7e9 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/rds_reserved_instance_offering.html.markdown b/website/docs/cdktf/python/d/rds_reserved_instance_offering.html.markdown
new file mode 100644
index 00000000000..c87e831dd95
--- /dev/null
+++ b/website/docs/cdktf/python/d/rds_reserved_instance_offering.html.markdown
@@ -0,0 +1,57 @@
+---
+subcategory: "RDS (Relational Database)"
+layout: "aws"
+page_title: "AWS: aws_rds_reserved_instance_offering"
+description: |-
+  Information about a single RDS Reserved Instance Offering.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_rds_reserved_instance_offering
+
+Information about a single RDS Reserved Instance Offering.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_rds_reserved_instance_offering import DataAwsRdsReservedInstanceOffering
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsRdsReservedInstanceOffering(self, "test",
+            db_instance_class="db.t2.micro",
+            duration=31536000,
+            multi_az=False,
+            offering_type="All Upfront",
+            product_description="mysql"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `db_instance_class` - (Required) DB instance class for the reserved DB instance.
+* `duration` - (Required) Duration of the reservation in years or seconds. Valid values are `1`, `3`, `31536000`, `94608000`
+* `multi_az` - (Required) Whether the reservation applies to Multi-AZ deployments.
+* `offering_type` - (Required) Offering type of this reserved DB instance. Valid values are `No Upfront`, `Partial Upfront`, `All Upfront`.
+* `product_description` - (Required) Description of the reserved DB instance.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - Unique identifier for the reservation. Same as `offering_id`.
+* `currency_code` - Currency code for the reserved DB instance.
+* `fixed_price` - Fixed price charged for this reserved DB instance.
+* `offering_id` - Unique identifier for the reservation.
+
+<!-- cache-key: cdktf-0.18.0 input-a71cd524be029d3d53583d22786d99a97f23ac7fc0880861778d7b20d3ece4a7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/redshift_cluster.html.markdown b/website/docs/cdktf/python/d/redshift_cluster.html.markdown
new file mode 100644
index 00000000000..46c21933150
--- /dev/null
+++ b/website/docs/cdktf/python/d/redshift_cluster.html.markdown
@@ -0,0 +1,110 @@
+---
+subcategory: "Redshift"
+layout: "aws"
+page_title: "AWS: aws_redshift_cluster"
+description: |-
+    Provides details about a specific redshift cluster
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_redshift_cluster
+
+Provides details about a specific redshift cluster.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_redshift_cluster import DataAwsRedshiftCluster
+from imports.aws.kinesis_firehose_delivery_stream import KinesisFirehoseDeliveryStream
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = DataAwsRedshiftCluster(self, "example",
+            cluster_identifier="example-cluster"
+        )
+        KinesisFirehoseDeliveryStream(self, "example_stream",
+            destination="redshift",
+            name="terraform-kinesis-firehose-example-stream",
+            redshift_configuration=KinesisFirehoseDeliveryStreamRedshiftConfiguration(
+                cluster_jdbcurl="jdbc:redshift://${" + example.endpoint + "}/${" + example.database_name + "}",
+                copy_options="delimiter '|'",
+                data_table_columns="example-col",
+                data_table_name="example-table",
+                password="Exampl3Pass",
+                role_arn=firehose_role.arn,
+                s3_configuration=KinesisFirehoseDeliveryStreamRedshiftConfigurationS3Configuration(
+                    bucket_arn=bucket.arn,
+                    buffer_interval=400,
+                    buffer_size=10,
+                    compression_format="GZIP",
+                    role_arn=firehose_role.arn
+                ),
+                username="exampleuser"
+            )
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `cluster_identifier` - (Required) Cluster identifier
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of cluster.
+* `allow_version_upgrade` - Whether major version upgrades can be applied during maintenance period
+* `automated_snapshot_retention_period` - The backup retention period
+* `aqua_configuration_status` - The value represents how the cluster is configured to use AQUA.
+* `availability_zone` - Availability zone of the cluster
+* `availability_zone_relocation_enabled` - Indicates whether the cluster is able to be relocated to another availability zone.
+* `bucket_name` - Name of the S3 bucket where the log files are to be stored
+* `cluster_identifier` - Cluster identifier
+* `cluster_nodes` - Nodes in the cluster. Cluster node blocks are documented below
+* `cluster_parameter_group_name` - The name of the parameter group to be associated with this cluster
+* `cluster_public_key` - Public key for the cluster
+* `cluster_revision_number` - The cluster revision number
+* `cluster_subnet_group_name` - The name of a cluster subnet group to be associated with this cluster
+* `cluster_type` - Cluster type
+* `cluster_namespace_arn` - The namespace Amazon Resource Name (ARN) of the cluster
+* `database_name` - Name of the default database in the cluster
+* `default_iam_role_arn` - The ARN for the IAM role that was set as default for the cluster when the cluster was created.
+* `elastic_ip` - Elastic IP of the cluster
+* `enable_logging` - Whether cluster logging is enabled
+* `encrypted` - Whether the cluster data is encrypted
+* `endpoint` - Cluster endpoint
+* `enhanced_vpc_routing` - Whether enhanced VPC routing is enabled
+* `iam_roles` - IAM roles associated to the cluster
+* `kms_key_id` - KMS encryption key associated to the cluster
+* `master_username` - Username for the master DB user
+* `node_type` - Cluster node type
+* `number_of_nodes` - Number of nodes in the cluster
+* `maintenance_track_name` - The name of the maintenance track for the restored cluster.
+* `manual_snapshot_retention_period` - (Optional)  The default number of days to retain a manual snapshot.
+* `port` - Port the cluster responds on
+* `preferred_maintenance_window` - The maintenance window
+* `publicly_accessible` - Whether the cluster is publicly accessible
+* `s3_key_prefix` - Folder inside the S3 bucket where the log files are stored
+* `log_destination_type` - The log destination type.
+* `log_exports` - Collection of exported log types. Log types include the connection log, user log and user activity log.
+* `tags` - Tags associated to the cluster
+* `vpc_id` - VPC Id associated with the cluster
+* `vpc_security_group_ids` - The VPC security group Ids associated with the cluster
+
+Cluster nodes (for `cluster_nodes`) support the following attributes:
+
+* `node_role` - Whether the node is a leader node or a compute node
+* `private_ip_address` - Private IP address of a node within a cluster
+* `public_ip_address` - Public IP address of a node within a cluster
+
+<!-- cache-key: cdktf-0.18.0 input-b688cc951fcaa53d0c385e11d05c939768ec5145c1f1ba9b8e2ae85e93a68c87 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/redshift_cluster_credentials.html.markdown b/website/docs/cdktf/python/d/redshift_cluster_credentials.html.markdown
new file mode 100644
index 00000000000..e2f2d3e431c
--- /dev/null
+++ b/website/docs/cdktf/python/d/redshift_cluster_credentials.html.markdown
@@ -0,0 +1,53 @@
+---
+subcategory: "Redshift"
+layout: "aws"
+page_title: "AWS: aws_redshift_cluster_credentials"
+description: |-
+  Provides redshift cluster credentials
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_redshift_cluster_credentials
+
+Provides redshift cluster temporary credentials.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_redshift_cluster_credentials import DataAwsRedshiftClusterCredentials
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsRedshiftClusterCredentials(self, "example",
+            cluster_identifier=Token.as_string(aws_redshift_cluster_example.cluster_identifier),
+            db_user=Token.as_string(aws_redshift_cluster_example.master_username)
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `auto_create` - (Optional)  Create a database user with the name specified for the user named in `db_user` if one does not exist.
+* `cluster_identifier` - (Required) Unique identifier of the cluster that contains the database for which your are requesting credentials.
+* `db_name` - (Optional) Name of a database that DbUser is authorized to log on to. If `db_name` is not specified, `db_user` can log on to any existing database.
+* `db_user` - (Required) Name of a database user. If a user name matching `db_user` exists in the database, the temporary user credentials have the same permissions as the  existing user. If `db_user` doesn't exist in the database and `auto_create` is `True`, a new user is created using the value for `db_user` with `PUBLIC` permissions.  If a database user matching the value for `db_user` doesn't exist and `not` is `False`, then the command succeeds but the connection attempt will fail because the user doesn't exist in the database.
+* `db_groups` - (Optional) List of the names of existing database groups that the user named in `db_user` will join for the current session, in addition to any group memberships for an existing user. If not specified, a new user is added only to `PUBLIC`.
+* `duration_seconds` - (Optional) The number of seconds until the returned temporary password expires. Valid values are between `900` and `3600`. Default value is `900`.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `db_password` - Temporary password that authorizes the user name returned by `db_user` to log on to the database `db_name`.
+* `expiration` - Date and time the password in `db_password` expires.
+
+<!-- cache-key: cdktf-0.18.0 input-213149af130486a765c70a3136e8b43c8007a43f9271c0b532f89e893f1f207c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/redshift_orderable_cluster.html.markdown b/website/docs/cdktf/python/d/redshift_orderable_cluster.html.markdown
new file mode 100644
index 00000000000..80a897e125a
--- /dev/null
+++ b/website/docs/cdktf/python/d/redshift_orderable_cluster.html.markdown
@@ -0,0 +1,50 @@
+---
+subcategory: "Redshift"
+layout: "aws"
+page_title: "AWS: aws_redshift_orderable_cluster"
+description: |-
+  Information about RDS orderable DB instances.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_redshift_orderable_cluster
+
+Information about Redshift Orderable Clusters and valid parameter combinations.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_redshift_orderable_cluster import DataAwsRedshiftOrderableCluster
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsRedshiftOrderableCluster(self, "test",
+            cluster_type="multi-node",
+            preferred_node_types=["dc2.large", "ds2.xlarge"]
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `cluster_type` - (Optional) Reshift Cluster typeE.g., `multi-node` or `single-node`
+* `cluster_version` - (Optional) Redshift Cluster versionE.g., `1.0`
+* `node_type` - (Optional) Redshift Cluster node typeE.g., `dc2.8xlarge`
+* `preferred_node_types` - (Optional) Ordered list of preferred Redshift Cluster node types. The first match in this list will be returned. If no preferred matches are found and the original search returned more than one result, an error is returned.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `availability_zones` - List of Availability Zone names where the Redshift Cluster is available.
+
+<!-- cache-key: cdktf-0.18.0 input-e0fdf3575794ac21787874dcbc817842b5e948d938752511869f169f7c1ca44e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/redshift_service_account.html.markdown b/website/docs/cdktf/python/d/redshift_service_account.html.markdown
new file mode 100644
index 00000000000..863052624c0
--- /dev/null
+++ b/website/docs/cdktf/python/d/redshift_service_account.html.markdown
@@ -0,0 +1,85 @@
+---
+subcategory: "Redshift"
+layout: "aws"
+page_title: "AWS: aws_redshift_service_account"
+description: |-
+  Get AWS Redshift Service Account for storing audit data in S3.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_redshift_service_account
+
+Use this data source to get the Account ID of the [AWS Redshift Service Account](http://docs.aws.amazon.com/redshift/latest/mgmt/db-auditing.html#db-auditing-enable-logging)
+in a given region for the purpose of allowing Redshift to store audit data in S3.
+
+~> **Note:** AWS documentation [states that](https://docs.aws.amazon.com/redshift/latest/mgmt/db-auditing.html#db-auditing-bucket-permissions) a [service principal name](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html#principal-services) should be used instead of an AWS account ID in any relevant IAM policy.
+The `aws_redshift_service_account` data source has been deprecated and will be removed in a future version.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.data_aws_redshift_service_account import DataAwsRedshiftServiceAccount
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_policy import S3BucketPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        bucket = S3Bucket(self, "bucket",
+            bucket="tf-redshift-logging-test-bucket",
+            force_destroy=True
+        )
+        main = DataAwsRedshiftServiceAccount(self, "main")
+        allow_audit_logging = DataAwsIamPolicyDocument(self, "allow_audit_logging",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["s3:PutObject"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=[Token.as_string(main.arn)],
+                    type="AWS"
+                )
+                ],
+                resources=["${" + bucket.arn + "}/*"],
+                sid="Put bucket policy needed for audit logging"
+            ), DataAwsIamPolicyDocumentStatement(
+                actions=["s3:GetBucketAcl"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=[Token.as_string(main.arn)],
+                    type="AWS"
+                )
+                ],
+                resources=Token.as_list(data_aws_s3_bucket_bucket.arn),
+                sid="Get bucket policy needed for audit logging"
+            )
+            ]
+        )
+        aws_s3_bucket_policy_allow_audit_logging = S3BucketPolicy(self, "allow_audit_logging_3",
+            bucket=bucket.id,
+            policy=Token.as_string(allow_audit_logging.json)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_policy_allow_audit_logging.override_logical_id("allow_audit_logging")
+```
+
+## Argument Reference
+
+* `region` - (Optional) Name of the region whose AWS Redshift account ID is desired.
+Defaults to the region from the AWS provider configuration.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the AWS Redshift service account in the selected region.
+* `arn` - ARN of the AWS Redshift service account in the selected region.
+
+<!-- cache-key: cdktf-0.18.0 input-e94000569ef4938913b2e5c8ffc6e76ff71e3d14063c879ff153df1bb864e656 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/redshift_subnet_group.html.markdown b/website/docs/cdktf/python/d/redshift_subnet_group.html.markdown
new file mode 100644
index 00000000000..ac02ff8c2c9
--- /dev/null
+++ b/website/docs/cdktf/python/d/redshift_subnet_group.html.markdown
@@ -0,0 +1,50 @@
+---
+subcategory: "Redshift"
+layout: "aws"
+page_title: "AWS: aws_redshift_subnet_group"
+description: |-
+  Provides details about a specific redshift subnet_group
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_redshift_subnet_group
+
+Provides details about a specific redshift subnet group.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_redshift_subnet_group import DataAwsRedshiftSubnetGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsRedshiftSubnetGroup(self, "example",
+            name=Token.as_string(aws_redshift_subnet_group_example.name)
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name of the cluster subnet group for which information is requested.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Redshift Subnet Group name.
+* `description` - Description of the Redshift Subnet group.
+* `id` - Redshift Subnet group Name.
+* `subnet_ids` - An array of VPC subnet IDs.
+* `tags` - Tags associated to the Subnet Group
+
+<!-- cache-key: cdktf-0.18.0 input-1814cef40fea2151683ed9925569f34cf19ac6b05b2de4b553e90c473dc2df91 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/redshiftserverless_credentials.html.markdown b/website/docs/cdktf/python/d/redshiftserverless_credentials.html.markdown
new file mode 100644
index 00000000000..0c21e106eb2
--- /dev/null
+++ b/website/docs/cdktf/python/d/redshiftserverless_credentials.html.markdown
@@ -0,0 +1,50 @@
+---
+subcategory: "Redshift Serverless"
+layout: "aws"
+page_title: "AWS: aws_redshiftserverless_credentials"
+description: |-
+  Provides redshift serverless credentials
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_redshiftserverless_credentials
+
+Provides redshift serverless temporary credentials for a workgroup.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_redshiftserverless_credentials import DataAwsRedshiftserverlessCredentials
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsRedshiftserverlessCredentials(self, "example",
+            workgroup_name=Token.as_string(aws_redshiftserverless_workgroup_example.workgroup_name)
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `workgroup_name` - (Required) The name of the workgroup associated with the database.
+* `db_name` - (Optional) The name of the database to get temporary authorization to log on to.
+* `duration_seconds` - (Optional) The number of seconds until the returned temporary password expires. The minimum is 900 seconds, and the maximum is 3600 seconds.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `db_password` - Temporary password that authorizes the user name returned by `db_user` to log on to the database `db_name`.
+* `db_user` - A database user name that is authorized to log on to the database `db_name` using the password `db_password` . If the specified `db_user` exists in the database, the new user name has the same database privileges as the user named in `db_user` . By default, the user is added to PUBLIC. the user doesn't exist in the database.
+* `expiration` - Date and time the password in `db_password` expires.
+
+<!-- cache-key: cdktf-0.18.0 input-34a2bbcfc773ba4d89d7b456bbb05f8a84bac33ed819e86e9a4b29600cb82b59 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/redshiftserverless_namespace.html.markdown b/website/docs/cdktf/python/d/redshiftserverless_namespace.html.markdown
new file mode 100644
index 00000000000..8854295aa2b
--- /dev/null
+++ b/website/docs/cdktf/python/d/redshiftserverless_namespace.html.markdown
@@ -0,0 +1,53 @@
+---
+subcategory: "Redshift Serverless"
+layout: "aws"
+page_title: "AWS: aws_redshiftserverless_namespace"
+description: |-
+  Terraform data source for managing an AWS Redshift Serverless Namespace.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_redshiftserverless_namespace
+
+Terraform data source for managing an AWS Redshift Serverless Namespace.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_redshiftserverless_namespace import DataAwsRedshiftserverlessNamespace
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsRedshiftserverlessNamespace(self, "example",
+            namespace_name="example-namespace"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `namespace_name` - (Required) The name of the namespace.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `admin_username` - The username of the administrator for the first database created in the namespace.
+* `arn` - Amazon Resource Name (ARN) of the Redshift Serverless Namespace.
+* `db_name` - The name of the first database created in the namespace.
+* `default_iam_role_arn` - The Amazon Resource Name (ARN) of the IAM role to set as a default in the namespace. When specifying `default_iam_role_arn`, it also must be part of `iam_roles`.
+* `iam_roles` - A list of IAM roles to associate with the namespace.
+* `kms_key_id` - The ARN of the Amazon Web Services Key Management Service key used to encrypt your data.
+* `log_exports` - The types of logs the namespace can export. Available export types are `userlog`, `connectionlog`, and `useractivitylog`.
+* `namespace_id` - The Redshift Namespace ID.
+
+<!-- cache-key: cdktf-0.18.0 input-353587d87083acd6cf58b7bf04d05a60c67f4c8fc0953c115222a623d6c4455b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/redshiftserverless_workgroup.html.markdown b/website/docs/cdktf/python/d/redshiftserverless_workgroup.html.markdown
new file mode 100644
index 00000000000..f493c46682a
--- /dev/null
+++ b/website/docs/cdktf/python/d/redshiftserverless_workgroup.html.markdown
@@ -0,0 +1,74 @@
+---
+subcategory: "Redshift Serverless"
+layout: "aws"
+page_title: "AWS: aws_redshiftserverless_workgroup"
+description: |-
+  Terraform data source for managing an AWS Redshift Serverless Workgroup.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_redshiftserverless_workgroup
+
+Terraform data source for managing an AWS Redshift Serverless Workgroup.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_redshiftserverless_workgroup import DataAwsRedshiftserverlessWorkgroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsRedshiftserverlessWorkgroup(self, "example",
+            workgroup_name=Token.as_string(aws_redshiftserverless_workgroup_example.workgroup_name)
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `workgroup_name` - (Required) The name of the workgroup associated with the database.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the Redshift Serverless Workgroup.
+* `id` - The Redshift Workgroup Name.
+* `endpoint` - The endpoint that is created from the workgroup. See `Endpoint` below.
+* `enhanced_vpc_routing` - The value that specifies whether to turn on enhanced virtual private cloud (VPC) routing, which forces Amazon Redshift Serverless to route traffic through your VPC instead of over the internet.
+* `publicly_accessible` - A value that specifies whether the workgroup can be accessed from a public network.
+* `security_group_ids` - An array of security group IDs to associate with the workgroup.
+* `subnet_ids` - An array of VPC subnet IDs to associate with the workgroup. When set, must contain at least three subnets spanning three Availability Zones. A minimum number of IP addresses is required and scales with the Base Capacity. For more information, see the following [AWS document](https://docs.aws.amazon.com/redshift/latest/mgmt/serverless-known-issues.html).
+* `workgroup_id` - The Redshift Workgroup ID.
+
+### Endpoint
+
+* `address` - The DNS address of the VPC endpoint.
+* `port` - The port that Amazon Redshift Serverless listens on.
+* `vpc_endpoint` - The VPC endpoint or the Redshift Serverless workgroup. See `VPC Endpoint` below.
+
+#### VPC Endpoint
+
+* `vpc_endpoint_id` - The DNS address of the VPC endpoint.
+* `vpc_id` - The port that Amazon Redshift Serverless listens on.
+* `network_interface` - The network interfaces of the endpoint.. See `Network Interface` below.
+
+##### Network Interface
+
+* `availability_zone` - The availability Zone.
+* `network_interface_id` - The unique identifier of the network interface.
+* `private_ip_address` - The IPv4 address of the network interface within the subnet.
+* `subnet_id` - The unique identifier of the subnet.
+
+<!-- cache-key: cdktf-0.18.0 input-374d27f8fbd13cb2f6821046b5a1fe85a8500dfa779b30e1ffd4cad3110ce132 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/region.html.markdown b/website/docs/cdktf/python/d/region.html.markdown
new file mode 100644
index 00000000000..fbade2a6f42
--- /dev/null
+++ b/website/docs/cdktf/python/d/region.html.markdown
@@ -0,0 +1,60 @@
+---
+subcategory: "Meta Data Sources"
+layout: "aws"
+page_title: "AWS: aws_region"
+description: |-
+    Provides details about a specific service region
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_region
+
+`aws_region` provides details about a specific AWS region.
+
+As well as validating a given region name this resource can be used to
+discover the name of the region configured within the provider. The latter
+can be useful in a child module which is inheriting an AWS provider
+configuration from its parent module.
+
+## Example Usage
+
+The following example shows how the resource might be used to obtain
+the name of the AWS region configured on the provider.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_region import DataAwsRegion
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsRegion(self, "current")
+```
+
+## Argument Reference
+
+The arguments of this data source act as filters for querying the available
+regions. The given filters must match exactly one region whose data will be
+exported as attributes.
+
+* `name` - (Optional) Full name of the region to select.
+
+* `endpoint` - (Optional) EC2 endpoint of the region to select.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `name` - Name of the selected region.
+
+* `endpoint` - EC2 endpoint for the selected region.
+
+* `description` - Region's description in this format: "Location (Region name)".
+
+<!-- cache-key: cdktf-0.18.0 input-aa7c9151f3a0b19e57d6cc253b49c17fa63fbcf513e80e2ad30986f51d764653 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/regions.html.markdown b/website/docs/cdktf/python/d/regions.html.markdown
new file mode 100644
index 00000000000..bf35c54a7a0
--- /dev/null
+++ b/website/docs/cdktf/python/d/regions.html.markdown
@@ -0,0 +1,101 @@
+---
+subcategory: "Meta Data Sources"
+layout: "aws"
+page_title: "AWS: aws_regions"
+description: |-
+    Provides information about AWS Regions.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_regions
+
+Provides information about AWS Regions. Can be used to filter regions i.e., by Opt-In status or only regions enabled for current account. To get details like endpoint and description of each region the data source can be combined with the [`aws_region` data source](/docs/providers/aws/d/region.html).
+
+## Example Usage
+
+Enabled AWS Regions:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_regions import DataAwsRegions
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsRegions(self, "current")
+```
+
+All the regions regardless of the availability
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_regions import DataAwsRegions
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsRegions(self, "current",
+            all_regions=True
+        )
+```
+
+To see regions that are filtered by `"not-opted-in"`, the `all_regions` argument needs to be set to `true` or no results will be returned.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_regions import DataAwsRegions
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsRegions(self, "current",
+            all_regions=True,
+            filter=[DataAwsRegionsFilter(
+                name="opt-in-status",
+                values=["not-opted-in"]
+            )
+            ]
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `all_regions` - (Optional) If true the source will query all regions regardless of availability.
+
+* `filter` - (Optional) Configuration block(s) to use as filters. Detailed below.
+
+### filter Configuration Block
+
+The `filter` configuration block supports the following arguments:
+
+* `name` - (Required) Name of the filter field. Valid values can be found in the [describe-regions AWS CLI Reference][1].
+* `values` - (Required) Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - Identifier of the current partition (e.g., `aws` in AWS Commercial, `aws-cn` in AWS China).
+* `names` - Names of regions that meets the criteria.
+
+[1]: https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-regions.html
+
+<!-- cache-key: cdktf-0.18.0 input-729936980236c90d4bfd49d088a65b256dd691594554c0abd78aef71806ddd45 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/resourcegroupstaggingapi_resources.html.markdown b/website/docs/cdktf/python/d/resourcegroupstaggingapi_resources.html.markdown
new file mode 100644
index 00000000000..a7dfa90fc45
--- /dev/null
+++ b/website/docs/cdktf/python/d/resourcegroupstaggingapi_resources.html.markdown
@@ -0,0 +1,108 @@
+---
+subcategory: "Resource Groups Tagging"
+layout: "aws"
+page_title: "AWS: aws_resourcegroupstaggingapi_resources"
+description: |-
+  Provides details about resource tagging.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_resourcegroupstaggingapi_resources
+
+Provides details about resource tagging.
+
+## Example Usage
+
+### Get All Resource Tag Mappings
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_resourcegroupstaggingapi_resources import DataAwsResourcegroupstaggingapiResources
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsResourcegroupstaggingapiResources(self, "test")
+```
+
+### Filter By Tag Key and Value
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_resourcegroupstaggingapi_resources import DataAwsResourcegroupstaggingapiResources
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsResourcegroupstaggingapiResources(self, "test",
+            tag_filter=[DataAwsResourcegroupstaggingapiResourcesTagFilter(
+                key="tag-key",
+                values=["tag-value-1", "tag-value-2"]
+            )
+            ]
+        )
+```
+
+### Filter By Resource Type
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_resourcegroupstaggingapi_resources import DataAwsResourcegroupstaggingapiResources
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsResourcegroupstaggingapiResources(self, "test",
+            resource_type_filters=["ec2:instance"]
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `exclude_compliant_resources` - (Optional) Specifies whether to exclude resources that are compliant with the tag policy. You can use this parameter only if the `include_compliance_details` argument is also set to `true`.
+* `include_compliance_details` - (Optional) Specifies whether to include details regarding the compliance with the effective tag policy.
+* `tag_filter` - (Optional) Specifies a list of Tag Filters (keys and values) to restrict the output to only those resources that have the specified tag and, if included, the specified value. See [Tag Filter](#tag-filter) below. Conflicts with `resource_arn_list`.
+* `resource_type_filters` - (Optional) Constraints on the resources that you want returned. The format of each resource type is `service:resourceType`. For example, specifying a resource type of `ec2` returns all Amazon EC2 resources (which includes EC2 instances). Specifying a resource type of `ec2:instance` returns only EC2 instances.
+* `resource_arn_list` - (Optional) Specifies a list of ARNs of resources for which you want to retrieve tag data. Conflicts with `filter`.
+
+### Tag Filter
+
+A `tag_filter` block supports the following arguments:
+
+If you do specify `tag_filter`, the response returns only those resources that are currently associated with the specified tag.
+If you don't specify a `tag_filter`, the response includes all resources that were ever associated with tags. Resources that currently don't have associated tags are shown with an empty tag set.
+
+* `key` - (Required) One part of a key-value pair that makes up a tag.
+* `values` - (Optional) Optional part of a key-value pair that make up a tag.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `resource_tag_mapping_list` - List of objects matching the search criteria.
+    * `compliance_details` - List of objects with information that shows whether a resource is compliant with the effective tag policy, including details on any noncompliant tag keys.
+        * `compliance_status` - Whether the resource is compliant.
+        * `keys_with_noncompliant_values ` - Set of tag keys with non-compliant tag values.
+        * `non_compliant_keys ` - Set of non-compliant tag keys.
+    * `resource_arn` - ARN of the resource.
+    * `tags` - Map of tags assigned to the resource.
+
+<!-- cache-key: cdktf-0.18.0 input-dfacd28e615a77cfbad3e63cc2c0fab691bf6f824574bd266ed9fe2b81be6bdc -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/route.html.markdown b/website/docs/cdktf/python/d/route.html.markdown
new file mode 100644
index 00000000000..0777ea08c7e
--- /dev/null
+++ b/website/docs/cdktf/python/d/route.html.markdown
@@ -0,0 +1,84 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_route"
+description: |-
+    Provides details about a specific Route
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_route
+
+`aws_route` provides details about a specific Route.
+
+This resource can prove useful when finding the resource associated with a CIDR. For example, finding the peering connection associated with a CIDR value.
+
+## Example Usage
+
+The following example shows how one might use a CIDR value to find a network interface id and use this to create a data source of that network interface.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformVariable, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_network_interface import DataAwsNetworkInterface
+from imports.aws.data_aws_route import DataAwsRoute
+from imports.aws.data_aws_route_table import DataAwsRouteTable
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        # Terraform Variables are not always the best fit for getting inputs in the context of Terraform CDK.
+        #     You can read more about this at https://cdk.tf/variables
+        subnet_id = TerraformVariable(self, "subnet_id")
+        route = DataAwsRoute(self, "route",
+            destination_cidr_block="10.0.1.0/24",
+            route_table_id=selected.id
+        )
+        DataAwsRouteTable(self, "selected",
+            subnet_id=subnet_id.string_value
+        )
+        DataAwsNetworkInterface(self, "interface",
+            id=Token.as_string(route.network_interface_id)
+        )
+```
+
+## Argument Reference
+
+The arguments of this data source act as filters for querying the available Route in the current region. The given filters must match exactly oneRoute whose data will be exported as attributes.
+
+The following arguments are required:
+
+* `route_table_id` - (Required) ID of the specific Route Table containing the Route entry.
+
+The following arguments are optional:
+
+* `carrier_gateway_id` - (Optional) EC2 Carrier Gateway ID of the Route belonging to the Route Table.
+* `core_network_arn` - (Optional) Core network ARN of the Route belonging to the Route Table.
+* `destination_cidr_block` - (Optional) CIDR block of the Route belonging to the Route Table.
+* `destination_ipv6_cidr_block` - (Optional) IPv6 CIDR block of the Route belonging to the Route Table.
+* `destination_prefix_list_id` - (Optional) ID of a [managed prefix list](ec2_managed_prefix_list.html) destination of the Route belonging to the Route Table.
+* `egress_only_gateway_id` - (Optional) Egress Only Gateway ID of the Route belonging to the Route Table.
+* `gateway_id` - (Optional) Gateway ID of the Route belonging to the Route Table.
+* `instance_id` - (Optional) Instance ID of the Route belonging to the Route Table.
+* `local_gateway_id` - (Optional) Local Gateway ID of the Route belonging to the Route Table.
+* `nat_gateway_id` - (Optional) NAT Gateway ID of the Route belonging to the Route Table.
+* `network_interface_id` - (Optional) Network Interface ID of the Route belonging to the Route Table.
+* `transit_gateway_id` - (Optional) EC2 Transit Gateway ID of the Route belonging to the Route Table.
+* `vpc_peering_connection_id` - (Optional) VPC Peering Connection ID of the Route belonging to the Route Table.
+
+## Attribute Reference
+
+All of the argument attributes are also exported as result attributes when there is data available. For example, the `vpc_peering_connection_id` field will be empty when the route is attached to a Network Interface.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `20m`)
+
+<!-- cache-key: cdktf-0.18.0 input-33a69cd7bf58da7db6b0a1e84dd1601b625d3a9040a0150ad517559d95d9622f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/route53_delegation_set.html.markdown b/website/docs/cdktf/python/d/route53_delegation_set.html.markdown
new file mode 100644
index 00000000000..54c1274e112
--- /dev/null
+++ b/website/docs/cdktf/python/d/route53_delegation_set.html.markdown
@@ -0,0 +1,48 @@
+---
+subcategory: "Route 53"
+layout: "aws"
+page_title: "AWS: aws_route53_delegation_set"
+description: |-
+    Provides details about a specific Route 53 Delegation Set
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_route53_delegation_set
+
+`aws_route53_delegation_set` provides details about a specific Route 53 Delegation Set.
+
+This data source allows to find a list of name servers associated with a specific delegation set.
+
+## Example Usage
+
+The following example shows how to get a delegation set from its id.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_route53_delegation_set import DataAwsRoute53DelegationSet
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsRoute53DelegationSet(self, "dset",
+            id="MQWGHCBFAKEID"
+        )
+```
+
+## Argument Reference
+
+* `id` - (Required) Delegation set ID.
+
+The following attribute is additionally exported:
+
+* `arn` - ARN of the Delegation Set.
+* `caller_reference` - Caller Reference of the delegation set.
+* `name_servers` - List of DNS name servers for the delegation set.
+
+<!-- cache-key: cdktf-0.18.0 input-40fcc3d8081992110595bf5da825dc8f40806338d89694588a485216d94caf0d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/route53_resolver_endpoint.html.markdown b/website/docs/cdktf/python/d/route53_resolver_endpoint.html.markdown
new file mode 100644
index 00000000000..84bb828dfb8
--- /dev/null
+++ b/website/docs/cdktf/python/d/route53_resolver_endpoint.html.markdown
@@ -0,0 +1,74 @@
+---
+subcategory: "Route 53 Resolver"
+layout: "aws"
+page_title: "AWS: aws_route53_resolver_endpoint"
+description: |-
+    Provides details about a specific Route 53 Resolver Endpoint
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_route53_resolver_endpoint
+
+`aws_route53_resolver_endpoint` provides details about a specific Route53 Resolver Endpoint.
+
+This data source allows to find a list of IPaddresses associated with a specific Route53 Resolver Endpoint.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_route53_resolver_endpoint import DataAwsRoute53ResolverEndpoint
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsRoute53ResolverEndpoint(self, "example",
+            resolver_endpoint_id="rslvr-in-1abc2345ef678g91h"
+        )
+```
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_route53_resolver_endpoint import DataAwsRoute53ResolverEndpoint
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsRoute53ResolverEndpoint(self, "example",
+            filter=[DataAwsRoute53ResolverEndpointFilter(
+                name="NAME",
+                values=["MyResolverExampleName"]
+            )
+            ]
+        )
+```
+
+## Argument Reference
+
+* `resolver_endpoint_id` - (Optional) ID of the Route53 Resolver Endpoint.
+* `filter` - (Optional) One or more name/value pairs to use as filters. There are
+several valid keys, for a full reference, check out
+[Route53resolver Filter value in the AWS API reference][1].
+
+In addition to all arguments above, the following attributes are exported:
+
+* `arn` - Computed ARN of the Route53 Resolver Endpoint.
+* `direction` - Direction of the queries to or from the Resolver Endpoint .
+* `ip_addresses` - List of IPaddresses that have been associated with the Resolver Endpoint.
+* `status` - Current status of the Resolver Endpoint.
+* `vpc_id` - ID of the Host VPC that the Resolver Endpoint resides in.
+
+[1]: https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_Filter.html
+
+<!-- cache-key: cdktf-0.18.0 input-c09fe4f13b65e731e041218940aaae0128be2c19aef275c15d677ea4e550c621 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/route53_resolver_firewall_config.html.markdown b/website/docs/cdktf/python/d/route53_resolver_firewall_config.html.markdown
new file mode 100644
index 00000000000..7fae6ce1a99
--- /dev/null
+++ b/website/docs/cdktf/python/d/route53_resolver_firewall_config.html.markdown
@@ -0,0 +1,48 @@
+---
+subcategory: "Route 53 Resolver"
+layout: "aws"
+page_title: "AWS: aws_route53_resolver_firewall_config"
+description: |-
+    Provides details about a specific a Route 53 Resolver DNS Firewall config.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_route53_resolver_firewall_config
+
+`aws_route53_resolver_firewall_config` provides details about a specific a Route 53 Resolver DNS Firewall config.
+
+This data source allows to find a details about a specific a Route 53 Resolver DNS Firewall config.
+
+## Example Usage
+
+The following example shows how to get a firewall config using the VPC ID.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_route53_resolver_firewall_config import DataAwsRoute53ResolverFirewallConfig
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsRoute53ResolverFirewallConfig(self, "example",
+            resource_id="vpc-exampleid"
+        )
+```
+
+## Argument Reference
+
+* `resource_id` - (Required) The ID of the VPC from Amazon VPC that the configuration is for.
+
+The following attribute is additionally exported:
+
+* `firewall_fail_open` - Determines how DNS Firewall operates during failures, for example when all traffic that is sent to DNS Firewall fails to receive a reply.
+* `id` - The ID of the firewall configuration.
+* `owner_id` - The Amazon Web Services account ID of the owner of the VPC that this firewall configuration applies to.
+
+<!-- cache-key: cdktf-0.18.0 input-b0f09d7efd8e098bbc579593a822c42d9bc95461129ab91f2ff09be220ad7bf4 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/route53_resolver_firewall_domain_list.html.markdown b/website/docs/cdktf/python/d/route53_resolver_firewall_domain_list.html.markdown
new file mode 100644
index 00000000000..a9d145a4e9a
--- /dev/null
+++ b/website/docs/cdktf/python/d/route53_resolver_firewall_domain_list.html.markdown
@@ -0,0 +1,54 @@
+---
+subcategory: "Route 53 Resolver"
+layout: "aws"
+page_title: "AWS: aws_route53_resolver_firewall_domain_list"
+description: |-
+    Retrieves the specified firewall domain list.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_route53_resolver_firewall_domain_list
+
+`aws_route53_resolver_firewall_domain_list` Retrieves the specified firewall domain list.
+
+This data source allows to retrieve details about a specific a Route 53 Resolver DNS Firewall domain list.
+
+## Example Usage
+
+The following example shows how to get a firewall domain list from its ID.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_route53_resolver_firewall_domain_list import DataAwsRoute53ResolverFirewallDomainList
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsRoute53ResolverFirewallDomainList(self, "example",
+            firewall_domain_list_id="rslvr-fdl-example"
+        )
+```
+
+## Argument Reference
+
+* `firewall_domain_list_id` - (Required) The ID of the domain list.
+
+The following attribute is additionally exported:
+
+* `arn` - The Amazon Resource Name (ARN) of the firewall domain list.
+* `creation_time` - The date and time that the domain list was created, in Unix time format and Coordinated Universal Time (UTC).
+* `creator_request_id` - A unique string defined by you to identify the request.
+* `domain_count` - The number of domain names that are specified in the domain list.
+* `name` - The name of the domain list.
+* `managed_owner_name` - The owner of the list, used only for lists that are not managed by you.
+* `modification_time` - The date and time that the domain list was last modified, in Unix time format and Coordinated Universal Time (UTC).
+* `status` - The status of the domain list.
+* `status_message` - Additional information about the status of the list, if available.
+
+<!-- cache-key: cdktf-0.18.0 input-35c900f0c4e3cc253efbb2bda21a0b76720a28ec58c6061e8c2afed4134cbbea -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/route53_resolver_firewall_rule_group.html.markdown b/website/docs/cdktf/python/d/route53_resolver_firewall_rule_group.html.markdown
new file mode 100644
index 00000000000..33a7af89904
--- /dev/null
+++ b/website/docs/cdktf/python/d/route53_resolver_firewall_rule_group.html.markdown
@@ -0,0 +1,55 @@
+---
+subcategory: "Route 53 Resolver"
+layout: "aws"
+page_title: "AWS: aws_route53_resolver_firewall_rule_group"
+description: |-
+    Retrieves the specified firewall rule group.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_route53_resolver_firewall_rule_group
+
+`aws_route53_resolver_firewall_rule_group` Retrieves the specified firewall rule group.
+
+This data source allows to retrieve details about a specific a Route 53 Resolver DNS Firewall rule group.
+
+## Example Usage
+
+The following example shows how to get a firewall rule group from its ID.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_route53_resolver_firewall_rule_group import DataAwsRoute53ResolverFirewallRuleGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsRoute53ResolverFirewallRuleGroup(self, "example",
+            firewall_rule_group_id="rslvr-frg-example"
+        )
+```
+
+## Argument Reference
+
+* `firewall_rule_group_id` - (Required) The ID of the rule group.
+
+The following attribute is additionally exported:
+
+* `arn` - The ARN (Amazon Resource Name) of the rule group.
+* `creation_time` - The date and time that the rule group was created, in Unix time format and Coordinated Universal Time (UTC).
+* `creator_request_id` - A unique string defined by you to identify the request.
+* `name` - The name of the rule group.
+* `modification_time` - The date and time that the rule group was last modified, in Unix time format and Coordinated Universal Time (UTC).
+* `owner_id` - The Amazon Web Services account ID for the account that created the rule group. When a rule group is shared with your account, this is the account that has shared the rule group with you.
+* `rule_count` - The number of rules in the rule group.
+* `share_status` - Whether the rule group is shared with other Amazon Web Services accounts, or was shared with the current account by another Amazon Web Services account.
+* `status` - The status of the rule group.
+* `status_message` - Additional information about the status of the rule group, if available.
+
+<!-- cache-key: cdktf-0.18.0 input-472d18e53a4acc66b8fb9f05bea99d5b96b2b4c83c2cdc01e472235760993460 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/route53_resolver_firewall_rule_group_association.html.markdown b/website/docs/cdktf/python/d/route53_resolver_firewall_rule_group_association.html.markdown
new file mode 100644
index 00000000000..63d10442858
--- /dev/null
+++ b/website/docs/cdktf/python/d/route53_resolver_firewall_rule_group_association.html.markdown
@@ -0,0 +1,57 @@
+---
+subcategory: "Route 53 Resolver"
+layout: "aws"
+page_title: "AWS: aws_route53_resolver_firewall_rule_group_association"
+description: |-
+    Retrieves the specified firewall rule group association.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_route53_resolver_firewall_rule_group_association
+
+`aws_route53_resolver_firewall_rule_group_association` Retrieves the specified firewall rule group association.
+
+This data source allows to retrieve details about a specific a Route 53 Resolver DNS Firewall rule group association.
+
+## Example Usage
+
+The following example shows how to get a firewall rule group association from its id.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_route53_resolver_firewall_rule_group_association import DataAwsRoute53ResolverFirewallRuleGroupAssociation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsRoute53ResolverFirewallRuleGroupAssociation(self, "example",
+            firewall_rule_group_association_id="rslvr-frgassoc-example"
+        )
+```
+
+## Argument Reference
+
+* `firewall_rule_group_association_id` - (Required) The identifier for the association.
+
+The following attribute is additionally exported:
+
+* `arn` - The Amazon Resource Name (ARN) of the firewall rule group association.
+* `creation_time` - The date and time that the association was created, in Unix time format and Coordinated Universal Time (UTC).
+* `creator_request_id` - A unique string defined by you to identify the request.
+* `firewall_rule_group_id` - The unique identifier of the firewall rule group.
+* `managed_owner_name` - The owner of the association, used only for associations that are not managed by you.
+* `modification_time` - The date and time that the association was last modified, in Unix time format and Coordinated Universal Time (UTC).
+* `mutation_protection` - If enabled, this setting disallows modification or removal of the association, to help prevent against accidentally altering DNS firewall protections.
+* `name` - The name of the association.
+* `priority` - The setting that determines the processing order of the rule group among the rule groups that are associated with a single VPC.
+* `status` - The current status of the association.
+* `status_message` - Additional information about the status of the response, if available.
+* `vpc_id` - The unique identifier of the VPC that is associated with the rule group.
+
+<!-- cache-key: cdktf-0.18.0 input-96baaccea7a8993bc2b43ff8bcd9ea43595994e4407fb3bc1d20edf090565dd8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/route53_resolver_firewall_rules.html.markdown b/website/docs/cdktf/python/d/route53_resolver_firewall_rules.html.markdown
new file mode 100644
index 00000000000..68187bca070
--- /dev/null
+++ b/website/docs/cdktf/python/d/route53_resolver_firewall_rules.html.markdown
@@ -0,0 +1,63 @@
+---
+subcategory: "Route 53 Resolver"
+layout: "aws"
+page_title: "AWS: aws_route53_resolver_firewall_rules"
+description: |-
+    Provides details about rules in a specific Route53 Resolver Firewall rule group.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_route53_resolver_firewall_rules
+
+`aws_route53_resolver_firewall_rules` Provides details about rules in a specific Route53 Resolver Firewall rule group.
+
+## Example Usage
+
+The following example shows how to get Route53 Resolver Firewall rules based on its associated firewall group id.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_route53_resolver_firewall_rules import DataAwsRoute53ResolverFirewallRules
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsRoute53ResolverFirewallRules(self, "example",
+            firewall_rule_group_id=Token.as_string(aws_route53_resolver_firewall_rule_group_example.id)
+        )
+```
+
+## Argument Reference
+
+The arguments of this data source act as filters for querying the available resolver rules in the current region.
+The given filters must match exactly one resolver rule whose data will be exported as attributes.
+
+* `firewall_rule_group_id` - (Required) The unique identifier of the firewall rule group that you want to retrieve the rules for.
+* `action` - (Optional) The action that DNS Firewall should take on a DNS query when it matches one of the domains in the rule's domain list.
+* `priority` - (Optional) The setting that determines the processing order of the rules in a rule group.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `firewall_rules` - List with information about the firewall rules. See details below.
+
+### provisioning_artifact_details
+
+* `block_override_dns_type` - The DNS record's type.
+* `block_override_domain` - The custom DNS record to send back in response to the query.
+* `block_override_ttl` - The recommended amount of time, in seconds, for the DNS resolver or web browser to cache the provided override record.
+* `block_response` - The way that you want DNS Firewall to block the request.
+* `creation_time` - The date and time that the rule was created, in Unix time format and Coordinated Universal Time (UTC).
+* `creator_request_id` - A unique string defined by you to identify the request.
+* `firewall_domain_list_id` - The ID of the domain list that's used in the rule.
+* `modification_time` - The date and time that the rule was last modified, in Unix time format and Coordinated Universal Time (UTC).
+* `name` - The name of the rule.
+
+<!-- cache-key: cdktf-0.18.0 input-7b8006826528bb5f3aaa7132422f98725c6be04f17245114660aea8409422dde -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/route53_resolver_query_log_config.html.markdown b/website/docs/cdktf/python/d/route53_resolver_query_log_config.html.markdown
new file mode 100644
index 00000000000..9b20c411d09
--- /dev/null
+++ b/website/docs/cdktf/python/d/route53_resolver_query_log_config.html.markdown
@@ -0,0 +1,77 @@
+---
+subcategory: "Route 53 Resolver"
+layout: "aws"
+page_title: "AWS: aws_route53_resolver_query_log_config"
+description: |-
+  Provides details about a specific Route53 Resolver Query Logging Configuration.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_route53_resolver_query_log_config
+
+`aws_route53_resolver_query_log_config` provides details about a specific Route53 Resolver Query Logging Configuration.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_route53_resolver_query_log_config import DataAwsRoute53ResolverQueryLogConfig
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsRoute53ResolverQueryLogConfig(self, "example",
+            resolver_query_log_config_id="rqlc-1abc2345ef678g91h"
+        )
+```
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_route53_resolver_query_log_config import DataAwsRoute53ResolverQueryLogConfig
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsRoute53ResolverQueryLogConfig(self, "example",
+            filter=[DataAwsRoute53ResolverQueryLogConfigFilter(
+                name="Name",
+                values=["shared-query-log-config"]
+            ), DataAwsRoute53ResolverQueryLogConfigFilter(
+                name="ShareStatus",
+                values=["SHARED_WITH_ME"]
+            )
+            ]
+        )
+```
+
+## Argument Reference
+
+* `resolver_query_log_config_id` - (Optional) ID of the Route53 Resolver Query Logging Configuration.
+* `filter` - (Optional) One or more name/value pairs to use as filters. There are
+several valid keys, for a full reference, check out
+[Route53resolver Filter value in the AWS API reference][1].
+
+In addition to all arguments above, the following attributes are exported:
+
+* `id` - The ID for the query logging configuration.
+* `arn` - Computed ARN of the Route53 Resolver Query Logging Configuration.
+* `destination_arn` - The ARN of the resource that you want Resolver to send query logs: an Amazon S3 bucket, a CloudWatch Logs log group or a Kinesis Data Firehose delivery stream.
+* `name` - The name of the query logging configuration.
+* `owner_id` - The AWS account ID for the account that created the query logging configuration.
+* `share_status` - An indication of whether the query logging configuration is shared with other AWS accounts or was shared with the current account by another AWS account.
+* `tags` - Map of tags to assign to the service.
+
+[1]: https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_Filter.html
+
+<!-- cache-key: cdktf-0.18.0 input-03aae9da90100bb44ba9ea973741cb3491b6e7ffca09d59a483c436ca965901e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/route53_resolver_rule.html.markdown b/website/docs/cdktf/python/d/route53_resolver_rule.html.markdown
new file mode 100644
index 00000000000..42571251ec0
--- /dev/null
+++ b/website/docs/cdktf/python/d/route53_resolver_rule.html.markdown
@@ -0,0 +1,59 @@
+---
+subcategory: "Route 53 Resolver"
+layout: "aws"
+page_title: "AWS: aws_route53_resolver_rule"
+description: |-
+    Provides details about a specific Route53 Resolver rule
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_route53_resolver_rule
+
+`aws_route53_resolver_rule` provides details about a specific Route53 Resolver rule.
+
+## Example Usage
+
+The following example shows how to get a Route53 Resolver rule based on its associated domain name and rule type.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_route53_resolver_rule import DataAwsRoute53ResolverRule
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsRoute53ResolverRule(self, "example",
+            domain_name="subdomain.example.com",
+            rule_type="SYSTEM"
+        )
+```
+
+## Argument Reference
+
+The arguments of this data source act as filters for querying the available resolver rules in the current region.
+The given filters must match exactly one resolver rule whose data will be exported as attributes.
+
+* `domain_name` - (Optional) Domain name the desired resolver rule forwards DNS queries for. Conflicts with `resolver_rule_id`.
+* `name` - (Optional) Friendly name of the desired resolver rule. Conflicts with `resolver_rule_id`.
+* `resolver_endpoint_id` (Optional) ID of the outbound resolver endpoint of the desired resolver rule. Conflicts with `resolver_rule_id`.
+* `resolver_rule_id` (Optional) ID of the desired resolver rule. Conflicts with `domain_name`, `name`, `resolver_endpoint_id` and `rule_type`.
+* `rule_type` - (Optional) Rule type of the desired resolver rule. Valid values are `FORWARD`, `SYSTEM` and `RECURSIVE`. Conflicts with `resolver_rule_id`.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the resolver rule.
+* `arn` - ARN (Amazon Resource Name) for the resolver rule.
+* `owner_id` - When a rule is shared with another AWS account, the account ID of the account that the rule is shared with.
+* `share_status` - Whether the rules is shared and, if so, whether the current account is sharing the rule with another account, or another account is sharing the rule with the current account.
+Values are `NOT_SHARED`, `SHARED_BY_ME` or `SHARED_WITH_ME`
+* `tags` - Map of tags assigned to the resolver rule.
+
+<!-- cache-key: cdktf-0.18.0 input-18fb35f097987b8d14e261d381f5a10359f2716b6cb0f20fc2d80f0c0da22650 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/route53_resolver_rules.html.markdown b/website/docs/cdktf/python/d/route53_resolver_rules.html.markdown
new file mode 100644
index 00000000000..258e363d1d7
--- /dev/null
+++ b/website/docs/cdktf/python/d/route53_resolver_rules.html.markdown
@@ -0,0 +1,98 @@
+---
+subcategory: "Route 53 Resolver"
+layout: "aws"
+page_title: "AWS: aws_route53_resolver_rules"
+description: |-
+    Provides details about a set of Route53 Resolver rules
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_route53_resolver_rules
+
+`aws_route53_resolver_rules` provides details about a set of Route53 Resolver rules.
+
+## Example Usage
+
+### Retrieving the default resolver rule
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_route53_resolver_rules import DataAwsRoute53ResolverRules
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsRoute53ResolverRules(self, "example",
+            owner_id="Route 53 Resolver",
+            rule_type="RECURSIVE",
+            share_status="NOT_SHARED"
+        )
+```
+
+### Retrieving forward rules shared with me
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_route53_resolver_rules import DataAwsRoute53ResolverRules
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsRoute53ResolverRules(self, "example",
+            rule_type="FORWARD",
+            share_status="SHARED_WITH_ME"
+        )
+```
+
+### Retrieving rules by name regex
+
+Resolver rules whose name contains `abc`.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_route53_resolver_rules import DataAwsRoute53ResolverRules
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsRoute53ResolverRules(self, "example",
+            name_regex=".*abc.*"
+        )
+```
+
+## Argument Reference
+
+The arguments of this data source act as filters for querying the available resolver rules in the current region.
+
+* `name_regex` - (Optional) Regex string to filter resolver rule names.
+  The filtering is done locally, so could have a performance impact if the result is large.
+  This argument should be used along with other arguments to limit the number of results returned.
+* `owner_id` (Optional) When the desired resolver rules are shared with another AWS account, the account ID of the account that the rules are shared with.
+* `resolver_endpoint_id` (Optional) ID of the outbound resolver endpoint for the desired resolver rules.
+* `rule_type` (Optional) Rule type of the desired resolver rules. Valid values are `FORWARD`, `SYSTEM` and `RECURSIVE`.
+* `share_status` (Optional) Whether the desired resolver rules are shared and, if so, whether the current account is sharing the rules with another account, or another account is sharing the rules with the current account. Valid values are `NOT_SHARED`, `SHARED_BY_ME` or `SHARED_WITH_ME`
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - AWS Region.
+* `resolver_rule_ids` - IDs of the matched resolver rules.
+
+<!-- cache-key: cdktf-0.18.0 input-9b0c7f44fbc4c3e685d8f6ce94f95d724eb10dbce507d5f4308b0a1bf1da3367 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/route53_traffic_policy_document.html.markdown b/website/docs/cdktf/python/d/route53_traffic_policy_document.html.markdown
new file mode 100644
index 00000000000..d1c98ef5802
--- /dev/null
+++ b/website/docs/cdktf/python/d/route53_traffic_policy_document.html.markdown
@@ -0,0 +1,225 @@
+---
+subcategory: "Route 53"
+layout: "aws"
+page_title: "AWS: aws_route53_traffic_policy_document"
+description: |-
+    Generates an Route53 traffic policy document in JSON format
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_route53_traffic_policy_document
+
+Generates an Route53 traffic policy document in JSON format for use with resources that expect policy documents such as [`aws_route53_traffic_policy`](/docs/providers/aws/r/route53_traffic_policy.html).
+
+## Example Usage
+
+### Basic Example
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_region import DataAwsRegion
+from imports.aws.data_aws_route53_traffic_policy_document import DataAwsRoute53TrafficPolicyDocument
+from imports.aws.route53_traffic_policy import Route53TrafficPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        current = DataAwsRegion(self, "current")
+        example = DataAwsRoute53TrafficPolicyDocument(self, "example",
+            endpoint=[DataAwsRoute53TrafficPolicyDocumentEndpoint(
+                id="my_elb",
+                type="elastic-load-balancer",
+                value="elb-111111.${" + current.name + "}.elb.amazonaws.com"
+            ), DataAwsRoute53TrafficPolicyDocumentEndpoint(
+                id="site_down_banner",
+                region=Token.as_string(current.name),
+                type="s3-website",
+                value="www.example.com"
+            )
+            ],
+            record_type="A",
+            rule=[DataAwsRoute53TrafficPolicyDocumentRule(
+                id="site_switch",
+                primary=DataAwsRoute53TrafficPolicyDocumentRulePrimary(
+                    endpoint_reference="my_elb"
+                ),
+                secondary=DataAwsRoute53TrafficPolicyDocumentRuleSecondary(
+                    endpoint_reference="site_down_banner"
+                ),
+                type="failover"
+            )
+            ],
+            start_rule="site_switch"
+        )
+        aws_route53_traffic_policy_example = Route53TrafficPolicy(self, "example_2",
+            comment="example comment",
+            document=Token.as_string(example.json),
+            name="example"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_route53_traffic_policy_example.override_logical_id("example")
+```
+
+### Complex Example
+
+The following example showcases the use of nested rules within the traffic policy document and introduces the `geoproximity` rule type.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_route53_traffic_policy_document import DataAwsRoute53TrafficPolicyDocument
+from imports.aws.route53_traffic_policy import Route53TrafficPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = DataAwsRoute53TrafficPolicyDocument(self, "example",
+            endpoint=[DataAwsRoute53TrafficPolicyDocumentEndpoint(
+                id="na_endpoint_a",
+                type="elastic-load-balancer",
+                value="elb-111111.us-west-1.elb.amazonaws.com"
+            ), DataAwsRoute53TrafficPolicyDocumentEndpoint(
+                id="na_endpoint_b",
+                type="elastic-load-balancer",
+                value="elb-222222.us-west-1.elb.amazonaws.com"
+            ), DataAwsRoute53TrafficPolicyDocumentEndpoint(
+                id="eu_endpoint",
+                type="elastic-load-balancer",
+                value="elb-333333.eu-west-1.elb.amazonaws.com"
+            ), DataAwsRoute53TrafficPolicyDocumentEndpoint(
+                id="ap_endpoint",
+                type="elastic-load-balancer",
+                value="elb-444444.ap-northeast-2.elb.amazonaws.com"
+            )
+            ],
+            record_type="A",
+            rule=[DataAwsRoute53TrafficPolicyDocumentRule(
+                id="na_rule",
+                primary=DataAwsRoute53TrafficPolicyDocumentRulePrimary(
+                    endpoint_reference="na_endpoint_a"
+                ),
+                secondary=DataAwsRoute53TrafficPolicyDocumentRuleSecondary(
+                    endpoint_reference="na_endpoint_b"
+                ),
+                type="failover"
+            ), DataAwsRoute53TrafficPolicyDocumentRule(
+                geo_proximity_location=[DataAwsRoute53TrafficPolicyDocumentRuleGeoProximityLocation(
+                    bias=Token.as_string(10),
+                    evaluate_target_health=True,
+                    region="aws:route53:us-west-1",
+                    rule_reference="na_rule"
+                ), DataAwsRoute53TrafficPolicyDocumentRuleGeoProximityLocation(
+                    bias=Token.as_string(10),
+                    endpoint_reference="eu_endpoint",
+                    evaluate_target_health=True,
+                    region="aws:route53:eu-west-1"
+                ), DataAwsRoute53TrafficPolicyDocumentRuleGeoProximityLocation(
+                    bias=Token.as_string(0),
+                    endpoint_reference="ap_endpoint",
+                    evaluate_target_health=True,
+                    region="aws:route53:ap-northeast-2"
+                )
+                ],
+                id="geoproximity_rule",
+                type="geoproximity"
+            )
+            ],
+            start_rule="geoproximity_rule"
+        )
+        aws_route53_traffic_policy_example = Route53TrafficPolicy(self, "example_1",
+            comment="example comment",
+            document=Token.as_string(example.json),
+            name="example"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_route53_traffic_policy_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+The following arguments are optional:
+
+* `endpoint` (Optional) - Configuration block for the definitions of the endpoints that you want to use in this traffic policy. See below
+* `record_type` (Optional) - DNS type of all of the resource record sets that Amazon Route 53 will create based on this traffic policy.
+* `rule` (Optional) - Configuration block for definitions of the rules that you want to use in this traffic policy. See below
+* `start_endpoint` (Optional) - An endpoint to be as the starting point for the traffic policy.
+* `start_rule` (Optional) - A rule to be as the starting point for the traffic policy.
+* `version` (Optional) - Version of the traffic policy format.
+
+### `endpoint`
+
+* `id` - (Required) ID of an endpoint you want to assign.
+* `type` - (Optional) Type of the endpoint. Valid values are `value` , `cloudfront` , `elastic-load-balancer`, `s3-website`
+* `region` - (Optional) To route traffic to an Amazon S3 bucket that is configured as a website endpoint, specify the region in which you created the bucket for `region`.
+* `value` - (Optional) Value of the `type`.
+
+### `rule`
+
+* `id` - (Required) ID of a rule you want to assign.
+* `type` - (Optional) Type of the rule.
+* `primary` - (Optional) Configuration block for the settings for the rule or endpoint that you want to route traffic to whenever the corresponding resources are available. Only valid for `failover` type. See below
+* `secondary` - (Optional) Configuration block for the rule or endpoint that you want to route traffic to whenever the primary resources are not available. Only valid for `failover` type. See below
+* `location` - (Optional) Configuration block for when you add a geolocation rule, you configure your traffic policy to route your traffic based on the geographic location of your users.  Only valid for `geo` type. See below
+* `geo_proximity_location` - (Optional) Configuration block for when you add a geoproximity rule, you configure Amazon Route 53 to route traffic to your resources based on the geographic location of your resources. Only valid for `geoproximity` type. See below
+* `regions` - (Optional) Configuration block for when you add a latency rule, you configure your traffic policy to route your traffic based on the latency (the time delay) between your users and the AWS regions where you've created AWS resources such as ELB load balancers and Amazon S3 buckets. Only valid for `latency` type. See below
+* `items` - (Optional) Configuration block for when you add a multivalue answer rule, you configure your traffic policy to route traffic approximately randomly to your healthy resources.  Only valid for `multivalue` type. See below
+
+### `primary` and `secondary`
+
+* `endpoint_reference` - (Optional) References to an endpoint.
+* `evaluate_target_health` - (Optional) Indicates whether you want Amazon Route 53 to evaluate the health of the endpoint and route traffic only to healthy endpoints.
+* `health_check` - (Optional) If you want to associate a health check with the endpoint or rule.
+* `rule_reference` - (Optional) References to a rule.
+
+### `location`
+
+* `continent` - (Optional) Value of a continent.
+* `country` - (Optional) Value of a country.
+* `endpoint_reference` - (Optional) References to an endpoint.
+* `evaluate_target_health` - (Optional) Indicates whether you want Amazon Route 53 to evaluate the health of the endpoint and route traffic only to healthy endpoints.
+* `health_check` - (Optional) If you want to associate a health check with the endpoint or rule.
+* `is_default` - (Optional) Indicates whether this set of values represents the default location.
+* `rule_reference` - (Optional) References to a rule.
+* `subdivision` - (Optional) Value of a subdivision.
+
+### `geo_proximity_location`
+
+* `bias` - (Optional) Specify a value for `bias` if you want to route more traffic to an endpoint from nearby endpoints (positive values) or route less traffic to an endpoint (negative values).
+* `endpoint_reference` - (Optional) References to an endpoint.
+* `evaluate_target_health` - (Optional) Indicates whether you want Amazon Route 53 to evaluate the health of the endpoint and route traffic only to healthy endpoints.
+* `health_check` - (Optional) If you want to associate a health check with the endpoint or rule.
+* `latitude` - (Optional) Represents the location south (negative) or north (positive) of the equator. Valid values are -90 degrees to 90 degrees.
+* `longitude` - (Optional) Represents the location west (negative) or east (positive) of the prime meridian. Valid values are -180 degrees to 180 degrees.
+* `region` - (Optional) If your endpoint is an AWS resource, specify the AWS Region that you created the resource in.
+* `rule_reference` - (Optional) References to a rule.
+
+### `region`
+
+* `endpoint_reference` - (Optional) References to an endpoint.
+* `evaluate_target_health` - (Optional) Indicates whether you want Amazon Route 53 to evaluate the health of the endpoint and route traffic only to healthy endpoints.
+* `health_check` - (Optional) If you want to associate a health check with the endpoint or rule.
+* `region` - (Optional) Region code for the AWS Region that you created the resource in.
+* `rule_reference` - (Optional) References to a rule.
+
+### `item`
+
+* `endpoint_reference` - (Optional) References to an endpoint.
+* `health_check` - (Optional) If you want to associate a health check with the endpoint or rule.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `json` - Standard JSON policy document rendered based on the arguments above.
+
+<!-- cache-key: cdktf-0.18.0 input-9fc530bb661507b956e360642cff24bbe3a5634eccad12a1acf054528f189fc9 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/route53_zone.html.markdown b/website/docs/cdktf/python/d/route53_zone.html.markdown
new file mode 100644
index 00000000000..7a76146f3cd
--- /dev/null
+++ b/website/docs/cdktf/python/d/route53_zone.html.markdown
@@ -0,0 +1,78 @@
+---
+subcategory: "Route 53"
+layout: "aws"
+page_title: "AWS: aws_route53_zone"
+description: |-
+    Provides details about a specific Route 53 Hosted Zone
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_route53_zone
+
+`aws_route53_zone` provides details about a specific Route 53 Hosted Zone.
+
+This data source allows to find a Hosted Zone ID given Hosted Zone name and certain search criteria.
+
+## Example Usage
+
+The following example shows how to get a Hosted Zone from its name and from this data how to create a Record Set.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_route53_zone import DataAwsRoute53Zone
+from imports.aws.route53_record import Route53Record
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        selected = DataAwsRoute53Zone(self, "selected",
+            name="test.com.",
+            private_zone=True
+        )
+        Route53Record(self, "www",
+            name="www.${" + selected.name + "}",
+            records=["10.0.0.1"],
+            ttl=Token.as_number("300"),
+            type="A",
+            zone_id=Token.as_string(selected.zone_id)
+        )
+```
+
+## Argument Reference
+
+The arguments of this data source act as filters for querying the available
+Hosted Zone. You have to use `zone_id` or `name`, not both of them. The given filter must match exactly one
+Hosted Zone. If you use `name` field for private Hosted Zone, you need to add `private_zone` field to `true`
+
+* `zone_id` - (Optional) Hosted Zone id of the desired Hosted Zone.
+
+* `name` - (Optional) Hosted Zone name of the desired Hosted Zone.
+* `private_zone` - (Optional) Used with `name` field to get a private Hosted Zone.
+* `vpc_id` - (Optional) Used with `name` field to get a private Hosted Zone associated with the vpc_id (in this case, private_zone is not mandatory).
+* `tags` - (Optional) Used with `name` field. A map of tags, each pair of which must exactly match a pair on the desired Hosted Zone.
+
+## Attribute Reference
+
+All of the argument attributes are also exported as
+result attributes. This data source will complete the data by populating
+any fields that are not included in the configuration with the data for
+the selected Hosted Zone.
+
+The following attribute is additionally exported:
+
+* `arn` - ARN of the Hosted Zone.
+* `caller_reference` - Caller Reference of the Hosted Zone.
+* `comment` - Comment field of the Hosted Zone.
+* `name_servers` - List of DNS name servers for the Hosted Zone.
+* `primary_name_server` - The Route 53 name server that created the SOA record.
+* `resource_record_set_count` - The number of Record Set in the Hosted Zone.
+* `linked_service_principal` - The service that created the Hosted Zone (e.g., `servicediscovery.amazonaws.com`).
+* `linked_service_description` - The description provided by the service that created the Hosted Zone (e.g., `arn:aws:servicediscovery:us-east-1:1234567890:namespace/ns-xxxxxxxxxxxxxxxx`).
+
+<!-- cache-key: cdktf-0.18.0 input-1a22cb50fe32eb087fe481e2a504db0755c6d63fe989e4c8e5bb2e37f803debb -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/route_table.html.markdown b/website/docs/cdktf/python/d/route_table.html.markdown
new file mode 100644
index 00000000000..648386048b7
--- /dev/null
+++ b/website/docs/cdktf/python/d/route_table.html.markdown
@@ -0,0 +1,118 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_route_table"
+description: |-
+    Provides details about a specific Route Table
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_route_table
+
+`aws_route_table` provides details about a specific Route Table.
+
+This resource can prove useful when a module accepts a Subnet ID as an input variable and needs to, for example, add a route in the Route Table.
+
+## Example Usage
+
+The following example shows how one might accept a Route Table ID as a variable and use this data source to obtain the data necessary to create a route.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformVariable, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_route_table import DataAwsRouteTable
+from imports.aws.route import Route
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        # Terraform Variables are not always the best fit for getting inputs in the context of Terraform CDK.
+        #     You can read more about this at https://cdk.tf/variables
+        subnet_id = TerraformVariable(self, "subnet_id")
+        selected = DataAwsRouteTable(self, "selected",
+            subnet_id=subnet_id.string_value
+        )
+        Route(self, "route",
+            destination_cidr_block="10.0.1.0/22",
+            route_table_id=Token.as_string(selected.id),
+            vpc_peering_connection_id="pcx-45ff3dc1"
+        )
+```
+
+## Argument Reference
+
+The arguments of this data source act as filters for querying the available Route Table in the current region. The given filters must match exactly one Route Table whose data will be exported as attributes.
+
+The following arguments are optional:
+
+* `filter` - (Optional) Configuration block. Detailed below.
+* `gateway_id` - (Optional) ID of an Internet Gateway or Virtual Private Gateway which is connected to the Route Table (not exported if not passed as a parameter).
+* `route_table_id` - (Optional) ID of the specific Route Table to retrieve.
+* `subnet_id` - (Optional) ID of a Subnet which is connected to the Route Table (not exported if not passed as a parameter).
+* `tags` - (Optional) Map of tags, each pair of which must exactly match a pair on the desired Route Table.
+* `vpc_id` - (Optional) ID of the VPC that the desired Route Table belongs to.
+
+### filter
+
+Complex filters can be expressed using one or more `filter` blocks.
+
+The following arguments are required:
+
+* `name` - (Required) Name of the field to filter by, as defined by [the underlying AWS API](http://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeRouteTables.html).
+* `values` - (Required) Set of values that are accepted for the given field. A Route Table will be selected if any one of the given values matches.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the route table.
+* `associations` - List of associations with attributes detailed below.
+* `owner_id` - ID of the AWS account that owns the route table.
+* `routes` - List of routes with attributes detailed below.
+
+### routes
+
+When relevant, routes are also exported with the following attributes:
+
+For destinations:
+
+* `cidr_block` - CIDR block of the route.
+* `destination_prefix_list_id` - The ID of a [managed prefix list](ec2_managed_prefix_list.html) destination of the route.
+* `ipv6_cidr_block` - IPv6 CIDR block of the route.
+
+For targets:
+
+* `carrier_gateway_id` - ID of the Carrier Gateway.
+* `core_network_arn` - ARN of the core network.
+* `egress_only_gateway_id` - ID of the Egress Only Internet Gateway.
+* `gateway_id` - Internet Gateway ID.
+* `instance_id` - EC2 instance ID.
+* `local_gateway_id` - Local Gateway ID.
+* `nat_gateway_id` - NAT Gateway ID.
+* `network_interface_id` - ID of the elastic network interface (eni) to use.
+* `transit_gateway_id` - EC2 Transit Gateway ID.
+* `vpc_endpoint_id` - VPC Endpoint ID.
+* `vpc_peering_connection_id` - VPC Peering ID.
+
+### associations
+
+Associations are also exported with the following attributes:
+
+* `gateway_id` - Gateway ID. Only set when associated with an Internet Gateway or Virtual Private Gateway.
+* `main` - Whether the association is due to the main route table.
+* `route_table_association_id` - Association ID.
+* `route_table_id` - Route Table ID.
+* `subnet_id` - Subnet ID. Only set when associated with a subnet.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `20m`)
+
+<!-- cache-key: cdktf-0.18.0 input-e02f8a1af89557e3d4f7912192d3d91ac681003bf0f578fd465030e054563a1e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/route_tables.html.markdown b/website/docs/cdktf/python/d/route_tables.html.markdown
new file mode 100644
index 00000000000..cf391304e9a
--- /dev/null
+++ b/website/docs/cdktf/python/d/route_tables.html.markdown
@@ -0,0 +1,87 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_route_tables"
+description: |-
+    Get information on Amazon route tables.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_route_tables
+
+This resource can be useful for getting back a list of route table ids to be referenced elsewhere.
+
+## Example Usage
+
+The following adds a route for a particular cidr block to every (private
+kops) route table in a specified vpc to use a particular vpc peering
+connection.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformCount, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_route_tables import DataAwsRouteTables
+from imports.aws.route import Route
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        rts = DataAwsRouteTables(self, "rts",
+            filter=[DataAwsRouteTablesFilter(
+                name="tag:kubernetes.io/kops/role",
+                values=["private*"]
+            )
+            ],
+            vpc_id=vpc_id.string_value
+        )
+        # In most cases loops should be handled in the programming language context and
+        #     not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+        #     you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+        #     you need to keep this like it is.
+        r_count = TerraformCount.of(Token.as_number(Fn.length_of(rts.ids)))
+        Route(self, "r",
+            destination_cidr_block="10.0.0.0/22",
+            route_table_id=Token.as_string(
+                Fn.lookup_nested(Fn.tolist(rts.ids), [r_count.index])),
+            vpc_peering_connection_id="pcx-0e9a7a9ecd137dc54",
+            count=r_count
+        )
+```
+
+## Argument Reference
+
+* `filter` - (Optional) Custom filter block as described below.
+
+* `vpc_id` - (Optional) VPC ID that you want to filter from.
+
+* `tags` - (Optional) Map of tags, each pair of which must exactly match
+  a pair on the desired route tables.
+
+More complex filters can be expressed using one or more `filter` sub-blocks,
+which take the following arguments:
+
+* `name` - (Required) Name of the field to filter by, as defined by
+  [the underlying AWS API](http://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeRouteTables.html).
+
+* `values` - (Required) Set of values that are accepted for the given field.
+  A Route Table will be selected if any one of the given values matches.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - AWS Region.
+* `ids` - List of all the route table ids found.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `20m`)
+
+<!-- cache-key: cdktf-0.18.0 input-07bd888bd13dbd8777e5631c5b36ff641fbc5fd5fb51f5784ae46abc60f9a930 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/s3_account_public_access_block.html.markdown b/website/docs/cdktf/python/d/s3_account_public_access_block.html.markdown
new file mode 100644
index 00000000000..14ca1fa023a
--- /dev/null
+++ b/website/docs/cdktf/python/d/s3_account_public_access_block.html.markdown
@@ -0,0 +1,48 @@
+---
+subcategory: "S3 Control"
+layout: "aws"
+page_title: "AWS: aws_s3_account_public_access_block"
+description: |-
+  Provides S3 account-level Public Access Block Configuration
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_s3_account_public_access_block
+
+The S3 account public access block data source returns account-level public access block configuration.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_s3_account_public_access_block import DataAwsS3AccountPublicAccessBlock
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsS3AccountPublicAccessBlock(self, "example")
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `account_id` - (Optional) AWS account ID to configure. Defaults to automatically determined account ID of the Terraform AWS provider.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - AWS account ID
+* `block_public_acls` - Whether or not Amazon S3 should block public ACLs for buckets in this account is enabled. Returns as `true` or `false`.
+* `block_public_policy` - Whether or not Amazon S3 should block public bucket policies for buckets in this account is enabled. Returns as `true` or `false`.
+* `ignore_public_acls` - Whether or not Amazon S3 should ignore public ACLs for buckets in this account is enabled. Returns as `true` or `false`.
+* `restrict_public_buckets` - Whether or not Amazon S3 should restrict public bucket policies for buckets in this account is enabled. Returns as `true` or `false`.
+
+<!-- cache-key: cdktf-0.18.0 input-c2e3f715fb56a3d3a79dd560c1d0d3c1f47a5c75c1840b0edbba7bc953a6dbc3 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/s3_bucket.html.markdown b/website/docs/cdktf/python/d/s3_bucket.html.markdown
new file mode 100644
index 00000000000..4973c9d1ddd
--- /dev/null
+++ b/website/docs/cdktf/python/d/s3_bucket.html.markdown
@@ -0,0 +1,104 @@
+---
+subcategory: "S3 (Simple Storage)"
+layout: "aws"
+page_title: "AWS: aws_s3_bucket"
+description: |-
+    Provides details about a specific S3 bucket
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_s3_bucket
+
+Provides details about a specific S3 bucket.
+
+This resource may prove useful when setting up a Route53 record, or an origin for a CloudFront
+Distribution.
+
+## Example Usage
+
+### Route53 Record
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_route53_zone import DataAwsRoute53Zone
+from imports.aws.data_aws_s3_bucket import DataAwsS3Bucket
+from imports.aws.route53_record import Route53Record
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, evaluateTargetHealth):
+        super().__init__(scope, name)
+        test_zone = DataAwsRoute53Zone(self, "test_zone",
+            name="test.com."
+        )
+        selected = DataAwsS3Bucket(self, "selected",
+            bucket="bucket.test.com"
+        )
+        Route53Record(self, "example",
+            alias=Route53RecordAlias(
+                name=Token.as_string(selected.website_domain),
+                zone_id=Token.as_string(selected.hosted_zone_id),
+                evaluate_target_health=evaluate_target_health
+            ),
+            name="bucket",
+            type="A",
+            zone_id=Token.as_string(test_zone.id)
+        )
+```
+
+### CloudFront Origin
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudfront_distribution import CloudfrontDistribution
+from imports.aws.data_aws_s3_bucket import DataAwsS3Bucket
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, defaultCacheBehavior, enabled, restrictions, viewerCertificate):
+        super().__init__(scope, name)
+        selected = DataAwsS3Bucket(self, "selected",
+            bucket="a-test-bucket"
+        )
+        CloudfrontDistribution(self, "test",
+            origin=[CloudfrontDistributionOrigin(
+                domain_name=Token.as_string(selected.bucket_domain_name),
+                origin_id="s3-selected-bucket"
+            )
+            ],
+            default_cache_behavior=default_cache_behavior,
+            enabled=enabled,
+            restrictions=restrictions,
+            viewer_certificate=viewer_certificate
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `bucket` - (Required) Name of the bucket
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - Name of the bucket.
+* `arn` - ARN of the bucket. Will be of format `arn:aws:s3:::bucketname`.
+* `bucket_domain_name` - Bucket domain name. Will be of format `bucketname.s3.amazonaws.com`.
+* `bucket_regional_domain_name` - The bucket region-specific domain name. The bucket domain name including the region name. Please refer to the [S3 endpoints reference](https://docs.aws.amazon.com/general/latest/gr/s3.html#s3_region) for format. Note: AWS CloudFront allows specifying an S3 region-specific endpoint when creating an S3 origin. This will prevent redirect issues from CloudFront to the S3 Origin URL. For more information, see the [Virtual Hosted-Style Requests for Other Regions](https://docs.aws.amazon.com/AmazonS3/latest/userguide/VirtualHosting.html#deprecated-global-endpoint) section in the AWS S3 User Guide.
+* `hosted_zone_id` - The [Route 53 Hosted Zone ID](https://docs.aws.amazon.com/general/latest/gr/rande.html#s3_website_region_endpoints) for this bucket's region.
+* `region` - AWS region this bucket resides in.
+* `website_endpoint` - Website endpoint, if the bucket is configured with a website. If not, this will be an empty string.
+* `website_domain` - Domain of the website endpoint, if the bucket is configured with a website. If not, this will be an empty string. This is used to create Route 53 alias records.
+
+<!-- cache-key: cdktf-0.18.0 input-1b3882cef2e383d7b94a441272b1a5c90afe56f7bd4eade88c86484fd024b52a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/s3_bucket_object.html.markdown b/website/docs/cdktf/python/d/s3_bucket_object.html.markdown
new file mode 100644
index 00000000000..17d14ac2a8d
--- /dev/null
+++ b/website/docs/cdktf/python/d/s3_bucket_object.html.markdown
@@ -0,0 +1,119 @@
+---
+subcategory: "S3 (Simple Storage)"
+layout: "aws"
+page_title: "AWS: aws_s3_bucket_object"
+description: |-
+    Provides metadata and optionally content of an S3 object
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_s3_bucket_object
+
+~> **NOTE:** The `aws_s3_bucket_object` data source is DEPRECATED and will be removed in a future version! Use `aws_s3_object` instead, where new features and fixes will be added.
+
+The S3 object data source allows access to the metadata and
+_optionally_ (see below) content of an object stored inside S3 bucket.
+
+~> **Note:** The content of an object (`body` field) is available only for objects which have a human-readable `Content-Type` (`text/*` and `application/json`). This is to prevent printing unsafe characters and potentially downloading large amount of data which would be thrown away in favour of metadata.
+
+## Example Usage
+
+The following example retrieves a text object (which must have a `Content-Type`
+value starting with `text/`) and uses it as the `user_data` for an EC2 instance:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_s3_bucket_object import DataAwsS3BucketObject
+from imports.aws.instance import Instance
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        bootstrap_script = DataAwsS3BucketObject(self, "bootstrap_script",
+            bucket="ourcorp-deploy-config",
+            key="ec2-bootstrap-script.sh"
+        )
+        Instance(self, "example",
+            ami="ami-2757f631",
+            instance_type="t2.micro",
+            user_data=Token.as_string(bootstrap_script.body)
+        )
+```
+
+The following, more-complex example retrieves only the metadata for a zip
+file stored in S3, which is then used to pass the most recent `version_id`
+to AWS Lambda for use as a function implementation. More information about
+Lambda functions is available in the documentation for
+[`aws_lambda_function`](/docs/providers/aws/r/lambda_function.html).
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_s3_bucket_object import DataAwsS3BucketObject
+from imports.aws.lambda_function import LambdaFunction
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        lambda_ = DataAwsS3BucketObject(self, "lambda",
+            bucket="ourcorp-lambda-functions",
+            key="hello-world.zip"
+        )
+        LambdaFunction(self, "test_lambda",
+            function_name="lambda_function_name",
+            handler="exports.test",
+            role=iam_for_lambda.arn,
+            s3_bucket=Token.as_string(lambda_.id),
+            s3_key=Token.as_string(lambda_.key),
+            s3_object_version=Token.as_string(lambda_.version_id)
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `bucket` - (Required) Name of the bucket to read the object from. Alternatively, an [S3 access point](https://docs.aws.amazon.com/AmazonS3/latest/dev/using-access-points.html) ARN can be specified
+* `key` - (Required) Full path to the object inside the bucket
+* `version_id` - (Optional) Specific version ID of the object returned (defaults to latest version)
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `body` - Object data (see **limitations above** to understand cases in which this field is actually available)
+* `bucket_key_enabled` - (Optional) Whether or not to use [Amazon S3 Bucket Keys](https://docs.aws.amazon.com/AmazonS3/latest/dev/bucket-key.html) for SSE-KMS.
+* `cache_control` - Caching behavior along the request/reply chain.
+* `content_disposition` - Presentational information for the object.
+* `content_encoding` - What content encodings have been applied to the object and thus what decoding mechanisms must be applied to obtain the media-type referenced by the Content-Type header field.
+* `content_language` - Language the content is in.
+* `content_length` - Size of the body in bytes.
+* `content_type` - Standard MIME type describing the format of the object data.
+* `etag` - [ETag](https://en.wikipedia.org/wiki/HTTP_ETag) generated for the object (an MD5 sum of the object content in case it's not encrypted)
+* `expiration` - If the object expiration is configured (see [object lifecycle management](http://docs.aws.amazon.com/AmazonS3/latest/dev/object-lifecycle-mgmt.html)), the field includes this header. It includes the expiry-date and rule-id key value pairs providing object expiration information. The value of the rule-id is URL encoded.
+* `expires` - Date and time at which the object is no longer cacheable.
+* `last_modified` - Last modified date of the object in RFC1123 format (e.g., `Mon, 02 Jan 2006 15:04:05 MST`)
+* `metadata` - Map of metadata stored with the object in S3. [Keys](https://developer.hashicorp.com/terraform/language/expressions/types#maps-objects) are always returned in lowercase.
+* `object_lock_legal_hold_status` - Indicates whether this object has an active [legal hold](https://docs.aws.amazon.com/AmazonS3/latest/dev/object-lock-overview.html#object-lock-legal-holds). This field is only returned if you have permission to view an object's legal hold status.
+* `object_lock_mode` - Object lock [retention mode](https://docs.aws.amazon.com/AmazonS3/latest/dev/object-lock-overview.html#object-lock-retention-modes) currently in place for this object.
+* `object_lock_retain_until_date` - The date and time when this object's object lock will expire.
+* `server_side_encryption` - If the object is stored using server-side encryption (KMS or Amazon S3-managed encryption key), this field includes the chosen encryption and algorithm used.
+* `sse_kms_key_id` - If present, specifies the ID of the Key Management Service (KMS) master encryption key that was used for the object.
+* `storage_class` - [Storage class](http://docs.aws.amazon.com/AmazonS3/latest/dev/storage-class-intro.html) information of the object. Available for all objects except for `Standard` storage class objects.
+* `version_id` - Latest version ID of the object returned.
+* `website_redirect_location` - If the bucket is configured as a website, redirects requests for this object to another object in the same bucket or to an external URL. Amazon S3 stores the value of this header in the object metadata.
+* `tags`  - Map of tags assigned to the object.
+
+-> **Note:** Terraform ignores all leading `/`s in the object's `key` and treats multiple `/`s in the rest of the object's `key` as a single `/`, so values of `/index.html` and `index.html` correspond to the same S3 object as do `first//second///third//` and `first/second/third/`.
+
+<!-- cache-key: cdktf-0.18.0 input-eeace90dfa8946b66ba3858986cd60a6630259121cbd2b07283b6d57a5c252cb -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/s3_bucket_objects.html.markdown b/website/docs/cdktf/python/d/s3_bucket_objects.html.markdown
new file mode 100644
index 00000000000..7a58c21d77a
--- /dev/null
+++ b/website/docs/cdktf/python/d/s3_bucket_objects.html.markdown
@@ -0,0 +1,74 @@
+---
+subcategory: "S3 (Simple Storage)"
+layout: "aws"
+page_title: "AWS: aws_s3_bucket_objects"
+description: |-
+    Returns keys and metadata of S3 objects
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_s3_bucket_objects
+
+~> **NOTE:** The `aws_s3_bucket_objects` data source is DEPRECATED and will be removed in a future version! Use `aws_s3_objects` instead, where new features and fixes will be added.
+
+~> **NOTE on `max_keys`:** Retrieving very large numbers of keys can adversely affect Terraform's performance.
+
+The objects data source returns keys (i.e., file names) and other metadata about objects in an S3 bucket.
+
+## Example Usage
+
+The following example retrieves a list of all object keys in an S3 bucket and creates corresponding Terraform object data sources:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformCount, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_s3_bucket_objects import DataAwsS3BucketObjects
+from imports.aws.data_aws_s3_object import DataAwsS3Object
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        my_objects = DataAwsS3BucketObjects(self, "my_objects",
+            bucket="ourcorp"
+        )
+        # In most cases loops should be handled in the programming language context and
+        #     not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+        #     you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+        #     you need to keep this like it is.
+        object_info_count = TerraformCount.of(
+            Token.as_number(Fn.length_of(my_objects.keys)))
+        DataAwsS3Object(self, "object_info",
+            bucket=Token.as_string(my_objects.id),
+            key=Token.as_string(
+                Fn.element(my_objects.keys, Token.as_number(object_info_count.index))),
+            count=object_info_count
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `bucket` - (Required) Lists object keys in this S3 bucket. Alternatively, an [S3 access point](https://docs.aws.amazon.com/AmazonS3/latest/dev/using-access-points.html) ARN can be specified
+* `prefix` - (Optional) Limits results to object keys with this prefix (Default: none)
+* `delimiter` - (Optional) Character used to group keys (Default: none)
+* `encoding_type` - (Optional) Encodes keys using this method (Default: none; besides none, only "url" can be used)
+* `max_keys` - (Optional) Maximum object keys to return (Default: 1000)
+* `start_after` - (Optional) Returns key names lexicographically after a specific object key in your bucket (Default: none; S3 lists object keys in UTF-8 character encoding in lexicographical order)
+* `fetch_owner` - (Optional) Boolean specifying whether to populate the owner list (Default: false)
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `keys` - List of strings representing object keys
+* `common_prefixes` - List of any keys between `prefix` and the next occurrence of `delimiter` (i.e., similar to subdirectories of the `prefix` "directory"); the list is only returned when you specify `delimiter`
+* `id` - S3 Bucket.
+* `owners` - List of strings representing object owner IDs (see `fetch_owner` above)
+
+<!-- cache-key: cdktf-0.18.0 input-a76b73c82fad499d443cf61f0e3f0ceae10818b46525e36001df4ca1d2096e1a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/s3_bucket_policy.html.markdown b/website/docs/cdktf/python/d/s3_bucket_policy.html.markdown
new file mode 100644
index 00000000000..81b62dd815f
--- /dev/null
+++ b/website/docs/cdktf/python/d/s3_bucket_policy.html.markdown
@@ -0,0 +1,51 @@
+---
+subcategory: "S3 (Simple Storage)"
+layout: "aws"
+page_title: "AWS: aws_s3_bucket_policy"
+description: |-
+    Provides IAM policy of an S3 bucket
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_s3_bucket_policy
+
+The bucket policy data source returns IAM policy of an S3 bucket.
+
+## Example Usage
+
+The following example retrieves IAM policy of a specified S3 bucket.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformOutput, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_s3_bucket_policy import DataAwsS3BucketPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = DataAwsS3BucketPolicy(self, "example",
+            bucket="example-bucket-name"
+        )
+        TerraformOutput(self, "foo",
+            value=example.policy
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `bucket` - (Required) Bucket name.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `policy` - IAM bucket policy.
+
+<!-- cache-key: cdktf-0.18.0 input-954a8fd4189d48cbd6438ea0a4f4717a1e6f8116e28864fc0a7752ae9c79f598 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/s3_object.html.markdown b/website/docs/cdktf/python/d/s3_object.html.markdown
new file mode 100644
index 00000000000..1f090bb52fa
--- /dev/null
+++ b/website/docs/cdktf/python/d/s3_object.html.markdown
@@ -0,0 +1,122 @@
+---
+subcategory: "S3 (Simple Storage)"
+layout: "aws"
+page_title: "AWS: aws_s3_object"
+description: |-
+    Provides metadata and optionally content of an S3 object
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_s3_object
+
+The S3 object data source allows access to the metadata and
+_optionally_ (see below) content of an object stored inside S3 bucket.
+
+~> **Note:** The content of an object (`body` field) is available only for objects which have a human-readable `Content-Type` (`text/*` and `application/json`). This is to prevent printing unsafe characters and potentially downloading large amount of data which would be thrown away in favour of metadata.
+
+## Example Usage
+
+The following example retrieves a text object (which must have a `Content-Type`
+value starting with `text/`) and uses it as the `user_data` for an EC2 instance:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_s3_object import DataAwsS3Object
+from imports.aws.instance import Instance
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        bootstrap_script = DataAwsS3Object(self, "bootstrap_script",
+            bucket="ourcorp-deploy-config",
+            key="ec2-bootstrap-script.sh"
+        )
+        Instance(self, "example",
+            ami="ami-2757f631",
+            instance_type="t2.micro",
+            user_data=Token.as_string(bootstrap_script.body)
+        )
+```
+
+The following, more-complex example retrieves only the metadata for a zip
+file stored in S3, which is then used to pass the most recent `version_id`
+to AWS Lambda for use as a function implementation. More information about
+Lambda functions is available in the documentation for
+[`aws_lambda_function`](/docs/providers/aws/r/lambda_function.html).
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_s3_object import DataAwsS3Object
+from imports.aws.lambda_function import LambdaFunction
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        lambda_ = DataAwsS3Object(self, "lambda",
+            bucket="ourcorp-lambda-functions",
+            key="hello-world.zip"
+        )
+        LambdaFunction(self, "test_lambda",
+            function_name="lambda_function_name",
+            handler="exports.test",
+            role=iam_for_lambda.arn,
+            s3_bucket=Token.as_string(lambda_.bucket),
+            s3_key=Token.as_string(lambda_.key),
+            s3_object_version=Token.as_string(lambda_.version_id)
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `bucket` - (Required) Name of the bucket to read the object from. Alternatively, an [S3 access point](https://docs.aws.amazon.com/AmazonS3/latest/dev/using-access-points.html) ARN can be specified
+* `checksum_mode` - (Optional) To retrieve the object's checksum, this argument must be `ENABLED`. If you enable `checksum_mode` and the object is encrypted with KMS, you must have permission to use the `kms:Decrypt` action. Valid values: `ENABLED`
+* `key` - (Required) Full path to the object inside the bucket
+* `version_id` - (Optional) Specific version ID of the object returned (defaults to latest version)
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `body` - Object data (see **limitations above** to understand cases in which this field is actually available)
+* `bucket_key_enabled` - (Optional) Whether or not to use [Amazon S3 Bucket Keys](https://docs.aws.amazon.com/AmazonS3/latest/dev/bucket-key.html) for SSE-KMS.
+* `cache_control` - Caching behavior along the request/reply chain.
+* `checksum_crc32` - The base64-encoded, 32-bit CRC32 checksum of the object.
+* `checksum_crc32c` - The base64-encoded, 32-bit CRC32C checksum of the object.
+* `checksum_sha1` - The base64-encoded, 160-bit SHA-1 digest of the object.
+* `checksum_sha256` - The base64-encoded, 256-bit SHA-256 digest of the object.
+* `content_disposition` - Presentational information for the object.
+* `content_encoding` - What content encodings have been applied to the object and thus what decoding mechanisms must be applied to obtain the media-type referenced by the Content-Type header field.
+* `content_language` - Language the content is in.
+* `content_length` - Size of the body in bytes.
+* `content_type` - Standard MIME type describing the format of the object data.
+* `etag` - [ETag](https://en.wikipedia.org/wiki/HTTP_ETag) generated for the object (an MD5 sum of the object content in case it's not encrypted)
+* `expiration` - If the object expiration is configured (see [object lifecycle management](http://docs.aws.amazon.com/AmazonS3/latest/dev/object-lifecycle-mgmt.html)), the field includes this header. It includes the expiry-date and rule-id key value pairs providing object expiration information. The value of the rule-id is URL encoded.
+* `expires` - Date and time at which the object is no longer cacheable.
+* `last_modified` - Last modified date of the object in RFC1123 format (e.g., `Mon, 02 Jan 2006 15:04:05 MST`)
+* `metadata` - Map of metadata stored with the object in S3. [Keys](https://developer.hashicorp.com/terraform/language/expressions/types#maps-objects) are always returned in lowercase.
+* `object_lock_legal_hold_status` - Indicates whether this object has an active [legal hold](https://docs.aws.amazon.com/AmazonS3/latest/dev/object-lock-overview.html#object-lock-legal-holds). This field is only returned if you have permission to view an object's legal hold status.
+* `object_lock_mode` - Object lock [retention mode](https://docs.aws.amazon.com/AmazonS3/latest/dev/object-lock-overview.html#object-lock-retention-modes) currently in place for this object.
+* `object_lock_retain_until_date` - The date and time when this object's object lock will expire.
+* `server_side_encryption` - If the object is stored using server-side encryption (KMS or Amazon S3-managed encryption key), this field includes the chosen encryption and algorithm used.
+* `sse_kms_key_id` - If present, specifies the ID of the Key Management Service (KMS) master encryption key that was used for the object.
+* `storage_class` - [Storage class](http://docs.aws.amazon.com/AmazonS3/latest/dev/storage-class-intro.html) information of the object. Available for all objects except for `Standard` storage class objects.
+* `version_id` - Latest version ID of the object returned.
+* `website_redirect_location` - If the bucket is configured as a website, redirects requests for this object to another object in the same bucket or to an external URL. Amazon S3 stores the value of this header in the object metadata.
+* `tags`  - Map of tags assigned to the object.
+
+-> **Note:** Terraform ignores all leading `/`s in the object's `key` and treats multiple `/`s in the rest of the object's `key` as a single `/`, so values of `/index.html` and `index.html` correspond to the same S3 object as do `first//second///third//` and `first/second/third/`.
+
+<!-- cache-key: cdktf-0.18.0 input-222e50e78a98cdd8982d72d096abde0605f9c9d699620754eb3607023a2f5858 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/s3_objects.html.markdown b/website/docs/cdktf/python/d/s3_objects.html.markdown
new file mode 100644
index 00000000000..0b90233ad62
--- /dev/null
+++ b/website/docs/cdktf/python/d/s3_objects.html.markdown
@@ -0,0 +1,74 @@
+---
+subcategory: "S3 (Simple Storage)"
+layout: "aws"
+page_title: "AWS: aws_s3_objects"
+description: |-
+    Returns keys and metadata of S3 objects
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_s3_objects
+
+~> **NOTE on `max_keys`:** Retrieving very large numbers of keys can adversely affect Terraform's performance.
+
+The objects data source returns keys (i.e., file names) and other metadata about objects in an S3 bucket.
+
+## Example Usage
+
+The following example retrieves a list of all object keys in an S3 bucket and creates corresponding Terraform object data sources:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformCount, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_s3_object import DataAwsS3Object
+from imports.aws.data_aws_s3_objects import DataAwsS3Objects
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        my_objects = DataAwsS3Objects(self, "my_objects",
+            bucket="ourcorp"
+        )
+        # In most cases loops should be handled in the programming language context and
+        #     not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+        #     you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+        #     you need to keep this like it is.
+        object_info_count = TerraformCount.of(
+            Token.as_number(Fn.length_of(my_objects.keys)))
+        DataAwsS3Object(self, "object_info",
+            bucket=Token.as_string(my_objects.id),
+            key=Token.as_string(
+                Fn.element(my_objects.keys, Token.as_number(object_info_count.index))),
+            count=object_info_count
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `bucket` - (Required) Lists object keys in this S3 bucket. Alternatively, an [S3 access point](https://docs.aws.amazon.com/AmazonS3/latest/dev/using-access-points.html) ARN can be specified
+* `prefix` - (Optional) Limits results to object keys with this prefix (Default: none)
+* `delimiter` - (Optional) Character used to group keys (Default: none)
+* `encoding_type` - (Optional) Encodes keys using this method (Default: none; besides none, only "url" can be used)
+* `max_keys` - (Optional) Maximum object keys to return (Default: 1000)
+* `start_after` - (Optional) Returns key names lexicographically after a specific object key in your bucket (Default: none; S3 lists object keys in UTF-8 character encoding in lexicographical order)
+* `fetch_owner` - (Optional) Boolean specifying whether to populate the owner list (Default: false)
+* `request_payer` - (Optional) Confirms that the requester knows that they will be charged for the request. Bucket owners need not specify this parameter in their requests. If included, the only valid value is `requester`.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `keys` - List of strings representing object keys
+* `common_prefixes` - List of any keys between `prefix` and the next occurrence of `delimiter` (i.e., similar to subdirectories of the `prefix` "directory"); the list is only returned when you specify `delimiter`
+* `id` - S3 Bucket.
+* `owners` - List of strings representing object owner IDs (see `fetch_owner` above)
+* `request_charged` - If present, indicates that the requester was successfully charged for the request.
+
+<!-- cache-key: cdktf-0.18.0 input-75319062f102d49785cbd4721ffbb267fc16f39f945cacf91b31e00a17bc10b2 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/s3control_multi_region_access_point.html.markdown b/website/docs/cdktf/python/d/s3control_multi_region_access_point.html.markdown
new file mode 100644
index 00000000000..a18d4fd56af
--- /dev/null
+++ b/website/docs/cdktf/python/d/s3control_multi_region_access_point.html.markdown
@@ -0,0 +1,72 @@
+---
+subcategory: "S3 Control"
+layout: "aws"
+page_title: "AWS: aws_s3control_multi_region_access_point"
+description: |-
+  Provides details an S3 Multi-Region Access Point.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_s3control_multi_region_access_point
+
+Provides details on a specific S3 Multi-Region Access Point.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_s3_control_multi_region_access_point import DataAwsS3ControlMultiRegionAccessPoint
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsS3ControlMultiRegionAccessPoint(self, "example",
+            name="example"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `account_id` - (Optional) The AWS account ID of the S3 Multi-Region Access Point. Defaults to automatically determined account ID of the Terraform AWS provider.
+* `name` - (Required) The name of the Multi-Region Access Point.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `alias` - The alias for the Multi-Region Access Point.
+* `arn` - Amazon Resource Name (ARN) of the Multi-Region Access Point.
+* `created_at` - Timestamp when the resource has been created.
+* `domain_name` - The DNS domain name of the S3 Multi-Region Access Point in the format _`alias`_.accesspoint.s3-global.amazonaws.com. For more information, see the documentation on [Multi-Region Access Point Requests](https://docs.aws.amazon.com/AmazonS3/latest/userguide/MultiRegionAccessPointRequests.html).
+* `public_access_block` - Public Access Block of the Multi-Region Access Point. Detailed below.
+* `regions` - A collection of the regions and buckets associated with the Multi-Region Access Point.
+* `status` - The current status of the Multi-Region Access Point.
+
+### public_access_block
+
+* `block_public_acls` - Specifies whether Amazon S3 should block public access control lists (ACLs). When set to `true` causes the following behavior:
+    * PUT Bucket acl and PUT Object acl calls fail if the specified ACL is public.
+    * PUT Object calls fail if the request includes a public ACL.
+    * PUT Bucket calls fail if the request includes a public ACL.
+* `block_public_policy` - Specifies whether Amazon S3 should block public bucket policies for buckets in this account. When set to `true` causes Amazon S3 to:
+    * Reject calls to PUT Bucket policy if the specified bucket policy allows public access.
+* `ignore_public_acls` - Specifies whether Amazon S3 should ignore public ACLs for buckets in this account. When set to `true` causes Amazon S3 to:
+    * Ignore all public ACLs on buckets in this account and any objects that they contain.
+* `restrict_public_buckets` - Specifies whether Amazon S3 should restrict public bucket policies for buckets in this account. When set to `true`:
+    * Only the bucket owner and AWS Services can access buckets with public policies.
+
+### regions
+
+* `bucket` - The name of the bucket.
+* `bucket_account_id` - The AWS account ID that owns the bucket.
+* `region` - The name of the region.
+
+<!-- cache-key: cdktf-0.18.0 input-4b2d4507f55425b893c6a7909b5f48feef1f322a3ab4bf8683d78ca9a96619fb -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/sagemaker_prebuilt_ecr_image.html.markdown b/website/docs/cdktf/python/d/sagemaker_prebuilt_ecr_image.html.markdown
new file mode 100644
index 00000000000..f1d9b5857d6
--- /dev/null
+++ b/website/docs/cdktf/python/d/sagemaker_prebuilt_ecr_image.html.markdown
@@ -0,0 +1,55 @@
+---
+subcategory: "SageMaker"
+layout: "aws"
+page_title: "AWS: aws_sagemaker_prebuilt_ecr_image"
+description: |-
+  Get information about prebuilt Amazon SageMaker Docker images.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_sagemaker_prebuilt_ecr_image
+
+Get information about prebuilt Amazon SageMaker Docker images.
+
+~> **NOTE:** The AWS provider creates a validly constructed `registry_path` but does not verify that the `registry_path` corresponds to an existing image. For example, using a `registry_path` containing an `image_tag` that does not correspond to a Docker image in the ECR repository, will result in an error.
+
+## Example Usage
+
+Basic usage:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_sagemaker_prebuilt_ecr_image import DataAwsSagemakerPrebuiltEcrImage
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsSagemakerPrebuiltEcrImage(self, "test",
+            image_tag="2.2-1.0.11.0",
+            repository_name="sagemaker-scikit-learn"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `repository_name` - (Required) Name of the repository, which is generally the algorithm or library. Values include `blazingtext`, `factorization-machines`, `forecasting-deepar`, `image-classification`, `ipinsights`, `kmeans`, `knn`, `lda`, `linear-learner`, `mxnet-inference-eia`, `mxnet-inference`, `mxnet-training`, `ntm`, `object-detection`, `object2vec`, `pca`, `pytorch-inference-eia`, `pytorch-inference`, `pytorch-training`, `randomcutforest`, `sagemaker-scikit-learn`, `sagemaker-sparkml-serving`, `sagemaker-xgboost`, `semantic-segmentation`, `seq2seq`, `tensorflow-inference-eia`, `tensorflow-inference`, `tensorflow-training`, `huggingface-tensorflow-training`, `huggingface-tensorflow-inference`, `huggingface-pytorch-training`, and `huggingface-pytorch-inference`.
+* `dns_suffix` - (Optional) DNS suffix to use in the registry path. If not specified, the AWS provider sets it to the DNS suffix for the current region.
+* `image_tag` - (Optional) Image tag for the Docker image. If not specified, the AWS provider sets the value to `1`, which for many repositories indicates the latest version. Some repositories, such as XGBoost, do not support `1` or `latest` and specific version must be used.
+* `region` (Optional) - Region to use in the registry path. If not specified, the AWS provider sets it to the current region.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `registry_id` - Account ID containing the image. For example, `469771592824`.
+* `registry_path` - Docker image URL. For example, `341280168497.dkr.ecr.ca-central-1.amazonaws.com/sagemaker-sparkml-serving:2.4`.
+
+<!-- cache-key: cdktf-0.18.0 input-9f7430a5070692161cbacbbecaaf444a21d44fae9e8ba95244364cce1a3659ec -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/secretsmanager_random_password.html.markdown b/website/docs/cdktf/python/d/secretsmanager_random_password.html.markdown
new file mode 100644
index 00000000000..a247e02022a
--- /dev/null
+++ b/website/docs/cdktf/python/d/secretsmanager_random_password.html.markdown
@@ -0,0 +1,52 @@
+---
+subcategory: "Secrets Manager"
+layout: "aws"
+page_title: "AWS: aws_secretsmanager_random_password"
+description: |-
+  Generate a random password
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_secretsmanager_random_password
+
+Generate a random password.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_secretsmanager_random_password import DataAwsSecretsmanagerRandomPassword
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsSecretsmanagerRandomPassword(self, "test",
+            exclude_numbers=True,
+            password_length=50
+        )
+```
+
+## Argument Reference
+
+* `exclude_characters` - (Optional) String of the characters that you don't want in the password.
+* `exclude_lowercase` - (Optional) Specifies whether to exclude lowercase letters from the password.
+* `exclude_numbers` - (Optional) Specifies whether to exclude numbers from the password.
+* `exclude_punctuation` - (Optional) Specifies whether to exclude the following punctuation characters from the password: `! " # $ % & ' ( ) * + , - . / : ; < = > ? @ [ \ ] ^ _ ` { | } ~ .`
+* `exclude_uppercase` - (Optional) Specifies whether to exclude uppercase letters from the password.
+* `include_space` - (Optional) Specifies whether to include the space character.
+* `password_length` - (Optional) Length of the password.
+* `require_each_included_type` - (Optional) Specifies whether to include at least one upper and lowercase letter, one number, and one punctuation.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `random_password` - Random password.
+
+<!-- cache-key: cdktf-0.18.0 input-253220cea464918e719cdeb6fc246c1972e3652b5d753f22810bdf68eb8eaeef -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/secretsmanager_secret.html.markdown b/website/docs/cdktf/python/d/secretsmanager_secret.html.markdown
new file mode 100644
index 00000000000..296cd7ee00b
--- /dev/null
+++ b/website/docs/cdktf/python/d/secretsmanager_secret.html.markdown
@@ -0,0 +1,71 @@
+---
+subcategory: "Secrets Manager"
+layout: "aws"
+page_title: "AWS: aws_secretsmanager_secret"
+description: |-
+  Retrieve metadata information about a Secrets Manager secret
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_secretsmanager_secret
+
+Retrieve metadata information about a Secrets Manager secret. To retrieve a secret value, see the [`aws_secretsmanager_secret_version` data source](/docs/providers/aws/d/secretsmanager_secret_version.html).
+
+## Example Usage
+
+### ARN
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_secretsmanager_secret import DataAwsSecretsmanagerSecret
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsSecretsmanagerSecret(self, "by-arn",
+            arn="arn:aws:secretsmanager:us-east-1:123456789012:secret:example-123456"
+        )
+```
+
+### Name
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_secretsmanager_secret import DataAwsSecretsmanagerSecret
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsSecretsmanagerSecret(self, "by-name",
+            name="example"
+        )
+```
+
+## Argument Reference
+
+* `arn` - (Optional) ARN of the secret to retrieve.
+* `name` - (Optional) Name of the secret to retrieve.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the secret.
+* `description` - Description of the secret.
+* `kms_key_id` - Key Management Service (KMS) Customer Master Key (CMK) associated with the secret.
+* `id` - ARN of the secret.
+* `tags` - Tags of the secret.
+* `policy` - Resource-based policy document that's attached to the secret.
+
+<!-- cache-key: cdktf-0.18.0 input-0fca6cfb25caf0f32cdf4fba62b9433e266444e38aa59620febc991b1723f0c4 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/secretsmanager_secret_rotation.html.markdown b/website/docs/cdktf/python/d/secretsmanager_secret_rotation.html.markdown
new file mode 100644
index 00000000000..98ec7a3ec61
--- /dev/null
+++ b/website/docs/cdktf/python/d/secretsmanager_secret_rotation.html.markdown
@@ -0,0 +1,48 @@
+---
+subcategory: "Secrets Manager"
+layout: "aws"
+page_title: "AWS: aws_secretsmanager_secret_rotation"
+description: |-
+  Retrieve information about a Secrets Manager secret rotation configuration
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_secretsmanager_secret_rotation
+
+Retrieve information about a Secrets Manager secret rotation. To retrieve secret metadata, see the [`aws_secretsmanager_secret` data source](/docs/providers/aws/d/secretsmanager_secret.html). To retrieve a secret value, see the [`aws_secretsmanager_secret_version` data source](/docs/providers/aws/d/secretsmanager_secret_version.html).
+
+## Example Usage
+
+### Retrieve Secret Rotation Configuration
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_secretsmanager_secret_rotation import DataAwsSecretsmanagerSecretRotation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsSecretsmanagerSecretRotation(self, "example",
+            secret_id=Token.as_string(data_aws_secretsmanager_secret_example.id)
+        )
+```
+
+## Argument Reference
+
+* `secret_id` - (Required) Specifies the secret containing the version that you want to retrieve. You can specify either the ARN or the friendly name of the secret.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `rotation_enabled` - ARN of the secret.
+* `rotation_lambda_arn` - Decrypted part of the protected secret information that was originally provided as a string.
+* `rotation_rules` - Decrypted part of the protected secret information that was originally provided as a binary. Base64 encoded.
+
+<!-- cache-key: cdktf-0.18.0 input-e027aa73fed49f05ed2c35a302ee5eef5a2de9f215c0ad6bb0470048e38bbb27 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/secretsmanager_secret_version.html.markdown b/website/docs/cdktf/python/d/secretsmanager_secret_version.html.markdown
new file mode 100644
index 00000000000..a751c7e6629
--- /dev/null
+++ b/website/docs/cdktf/python/d/secretsmanager_secret_version.html.markdown
@@ -0,0 +1,91 @@
+---
+subcategory: "Secrets Manager"
+layout: "aws"
+page_title: "AWS: aws_secretsmanager_secret_version"
+description: |-
+  Retrieve information about a Secrets Manager secret version including its secret value
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_secretsmanager_secret_version
+
+Retrieve information about a Secrets Manager secret version, including its secret value. To retrieve secret metadata, see the [`aws_secretsmanager_secret` data source](/docs/providers/aws/d/secretsmanager_secret.html).
+
+## Example Usage
+
+### Retrieve Current Secret Version
+
+By default, this data sources retrieves information based on the `AWSCURRENT` staging label.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_secretsmanager_secret_version import DataAwsSecretsmanagerSecretVersion
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsSecretsmanagerSecretVersion(self, "secret-version",
+            secret_id=Token.as_string(example.id)
+        )
+```
+
+### Retrieve Specific Secret Version
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_secretsmanager_secret_version import DataAwsSecretsmanagerSecretVersion
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsSecretsmanagerSecretVersion(self, "by-version-stage",
+            secret_id=Token.as_string(example.id),
+            version_stage="example"
+        )
+```
+
+### Handling Key-Value Secret Strings in JSON
+
+Reading key-value pairs from JSON back into a native Terraform map can be accomplished in Terraform 0.12 and later with the [`jsondecode()` function](https://www.terraform.io/docs/configuration/functions/jsondecode.html):
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformOutput, Fn, Token, TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        TerraformOutput(self, "example",
+            value=Fn.lookup_nested(
+                Fn.jsondecode(Token.as_string(example.secret_string)), ["\"key1\""])
+        )
+```
+
+## Argument Reference
+
+* `secret_id` - (Required) Specifies the secret containing the version that you want to retrieve. You can specify either the ARN or the friendly name of the secret.
+* `version_id` - (Optional) Specifies the unique identifier of the version of the secret that you want to retrieve. Overrides `version_stage`.
+* `version_stage` - (Optional) Specifies the secret version that you want to retrieve by the staging label attached to the version. Defaults to `AWSCURRENT`.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the secret.
+* `id` - Unique identifier of this version of the secret.
+* `secret_string` - Decrypted part of the protected secret information that was originally provided as a string.
+* `secret_binary` - Decrypted part of the protected secret information that was originally provided as a binary.
+* `version_id` - Unique identifier of this version of the secret.
+
+<!-- cache-key: cdktf-0.18.0 input-0b6eddd0447056d7c1accf69edad117a5cfffc0cc933681a436ac5274d6d9488 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/secretsmanager_secrets.html.markdown b/website/docs/cdktf/python/d/secretsmanager_secrets.html.markdown
new file mode 100644
index 00000000000..27e8679e1a9
--- /dev/null
+++ b/website/docs/cdktf/python/d/secretsmanager_secrets.html.markdown
@@ -0,0 +1,56 @@
+---
+subcategory: "Secrets Manager"
+layout: "aws"
+page_title: "AWS: aws_secretsmanager_secrets"
+description: |-
+    Get information on Secrets Manager secrets.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_secretsmanager_secrets
+
+Use this data source to get the ARNs and names of Secrets Manager secrets matching the specified criteria.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_secretsmanager_secrets import DataAwsSecretsmanagerSecrets
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsSecretsmanagerSecrets(self, "example",
+            filter=[DataAwsSecretsmanagerSecretsFilter(
+                name="name",
+                values=["example"]
+            )
+            ]
+        )
+```
+
+## Argument Reference
+
+* `filter` - (Optional) Configuration block(s) for filtering. Detailed below.
+
+## filter Configuration Block
+
+The `filter` configuration block supports the following arguments:
+
+* `name` - (Required) Name of the filter field. Valid values can be found in the [Secrets Manager ListSecrets API Reference](https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_ListSecrets.html).
+* `values` - (Required) Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arns` - Set of ARNs of the matched Secrets Manager secrets.
+* `names` - Set of names of the matched Secrets Manager secrets.
+
+<!-- cache-key: cdktf-0.18.0 input-150d44c91f421068bbfdaf75b6d510764b7e066887fe235c7afddf8fee2eaa61 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/security_group.html.markdown b/website/docs/cdktf/python/d/security_group.html.markdown
new file mode 100644
index 00000000000..a3c78d87d5e
--- /dev/null
+++ b/website/docs/cdktf/python/d/security_group.html.markdown
@@ -0,0 +1,95 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_security_group"
+description: |-
+    Provides details about a specific Security Group
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_security_group
+
+`aws_security_group` provides details about a specific Security Group.
+
+This resource can prove useful when a module accepts a Security Group id as
+an input variable and needs to, for example, determine the id of the
+VPC that the security group belongs to.
+
+## Example Usage
+
+The following example shows how one might accept a Security Group id as a variable
+and use this data source to obtain the data necessary to create a subnet.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformVariable, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_security_group import DataAwsSecurityGroup
+from imports.aws.subnet import Subnet
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        # Terraform Variables are not always the best fit for getting inputs in the context of Terraform CDK.
+        #     You can read more about this at https://cdk.tf/variables
+        security_group_id = TerraformVariable(self, "security_group_id")
+        selected = DataAwsSecurityGroup(self, "selected",
+            id=security_group_id.string_value
+        )
+        Subnet(self, "subnet",
+            cidr_block="10.0.1.0/24",
+            vpc_id=Token.as_string(selected.vpc_id)
+        )
+```
+
+## Argument Reference
+
+The arguments of this data source act as filters for querying the available
+security group in the current region. The given filters must match exactly one
+security group whose data will be exported as attributes.
+
+* `filter` - (Optional) Custom filter block as described below.
+
+* `id` - (Optional) Id of the specific security group to retrieve.
+
+* `name` - (Optional) Name that the desired security group must have.
+
+* `tags` - (Optional) Map of tags, each pair of which must exactly match
+  a pair on the desired security group.
+
+* `vpc_id` - (Optional) Id of the VPC that the desired security group belongs to.
+
+More complex filters can be expressed using one or more `filter` sub-blocks,
+which take the following arguments:
+
+* `name` - (Required) Name of the field to filter by, as defined by
+  [the underlying AWS API](http://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeSecurityGroups.html).
+
+* `values` - (Required) Set of values that are accepted for the given field.
+  A Security Group will be selected if any one of the given values matches.
+
+## Attribute Reference
+
+All of the argument attributes except `filter` blocks are also exported as
+result attributes. This data source will complete the data by populating
+any fields that are not included in the configuration with the data for
+the selected Security Group.
+
+The following fields are also exported:
+
+* `description` - Description of the security group.
+* `arn` - Computed ARN of the security group.
+
+~> **Note:** The [default security group for a VPC](http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_SecurityGroups.html#DefaultSecurityGroup) has the name `default`.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `20m`)
+
+<!-- cache-key: cdktf-0.18.0 input-faa48f214b0a68965ac66737fa03fbf44f9874b295dbca0d05f8656a6168d9c4 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/security_groups.html.markdown b/website/docs/cdktf/python/d/security_groups.html.markdown
new file mode 100644
index 00000000000..29ee18070f6
--- /dev/null
+++ b/website/docs/cdktf/python/d/security_groups.html.markdown
@@ -0,0 +1,83 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_security_groups"
+description: |-
+  Get information about a set of Security Groups.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_security_groups
+
+Use this data source to get IDs and VPC membership of Security Groups that are created outside of Terraform.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_security_groups import DataAwsSecurityGroups
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsSecurityGroups(self, "test",
+            tags={
+                "Application": "k8s",
+                "Environment": "dev"
+            }
+        )
+```
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_security_groups import DataAwsSecurityGroups
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsSecurityGroups(self, "test",
+            filter=[DataAwsSecurityGroupsFilter(
+                name="group-name",
+                values=["*nodes*"]
+            ), DataAwsSecurityGroupsFilter(
+                name="vpc-id",
+                values=[vpc_id.string_value]
+            )
+            ]
+        )
+```
+
+## Argument Reference
+
+* `tags` - (Optional) Map of tags, each pair of which must exactly match for desired security groups.
+* `filter` - (Optional) One or more name/value pairs to use as filters. There are several valid keys, for a full reference, check out [describe-security-groups in the AWS CLI reference][1].
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arns` - ARNs of the matched security groups.
+* `id` - AWS Region.
+* `ids` - IDs of the matches security groups.
+* `vpc_ids` - VPC IDs of the matched security groups. The data source's tag or filter *will span VPCs* unless the `vpc-id` filter is also used.
+
+[1]: https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-security-groups.html
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `20m`)
+
+<!-- cache-key: cdktf-0.18.0 input-61bce3b277f527514fffcce8fa9eb4692ab442cb83160f5b9461f3e9c31d928a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/serverlessapplicationrepository_application.html.markdown b/website/docs/cdktf/python/d/serverlessapplicationrepository_application.html.markdown
new file mode 100644
index 00000000000..2281e2ced86
--- /dev/null
+++ b/website/docs/cdktf/python/d/serverlessapplicationrepository_application.html.markdown
@@ -0,0 +1,59 @@
+---
+subcategory: "Serverless Application Repository"
+layout: "aws"
+page_title: "AWS: aws_serverlessapplicationrepository_application"
+description: |-
+  Get information on a AWS Serverless Application Repository application
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_serverlessapplicationrepository_application
+
+Use this data source to get information about an AWS Serverless Application Repository application. For example, this can be used to determine the required `capabilities` for an application.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_serverlessapplicationrepository_application import DataAwsServerlessapplicationrepositoryApplication
+from imports.aws.serverlessapplicationrepository_cloudformation_stack import ServerlessapplicationrepositoryCloudformationStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = DataAwsServerlessapplicationrepositoryApplication(self, "example",
+            application_id="arn:aws:serverlessrepo:us-east-1:123456789012:applications/ExampleApplication"
+        )
+        aws_serverlessapplicationrepository_cloudformation_stack_example =
+        ServerlessapplicationrepositoryCloudformationStack(self, "example_1",
+            application_id=Token.as_string(example.application_id),
+            capabilities=Token.as_list(example.required_capabilities),
+            name="Example",
+            semantic_version=Token.as_string(example.semantic_version)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_serverlessapplicationrepository_cloudformation_stack_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+* `application_id` - (Required) ARN of the application.
+* `semantic_version` - (Optional) Requested version of the application. By default, retrieves the latest version.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `application_id` - ARN of the application.
+* `name` - Name of the application.
+* `required_capabilities` - A list of capabilities describing the permissions needed to deploy the application.
+* `source_code_url` - URL pointing to the source code of the application version.
+* `template_url` - URL pointing to the Cloud Formation template for the application version.
+
+<!-- cache-key: cdktf-0.18.0 input-4067d08c02e21d01320463b039dbb33009c80dd466c694f17352beb6a7e00e63 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/service.html.markdown b/website/docs/cdktf/python/d/service.html.markdown
new file mode 100644
index 00000000000..3fa76db2d46
--- /dev/null
+++ b/website/docs/cdktf/python/d/service.html.markdown
@@ -0,0 +1,94 @@
+---
+subcategory: "Meta Data Sources"
+layout: "aws"
+page_title: "AWS: aws_service"
+description: |-
+  Compose and decompose AWS service DNS names
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_service
+
+Use this data source to compose and decompose AWS service DNS names.
+
+## Example Usage
+
+### Get Service DNS Name
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_region import DataAwsRegion
+from imports.aws.data_aws_service import DataAwsService
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        current = DataAwsRegion(self, "current")
+        DataAwsService(self, "test",
+            region=Token.as_string(current.name),
+            service_id="ec2"
+        )
+```
+
+### Use Service Reverse DNS Name to Get Components
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_service import DataAwsService
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsService(self, "s3",
+            reverse_dns_name="cn.com.amazonaws.cn-north-1.s3"
+        )
+```
+
+### Determine Regional Support for a Service
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_service import DataAwsService
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsService(self, "s3",
+            reverse_dns_name="com.amazonaws.us-gov-west-1.waf"
+        )
+```
+
+## Argument Reference
+
+The following arguments are optional:
+
+* `dns_name` - (Optional) DNS name of the service (_e.g.,_ `rds.us-east-1.amazonaws.com`). One of `dns_name`, `reverse_dns_name`, or `service_id` is required.
+* `partition` - (Optional) Partition corresponding to the region.
+* `region` - (Optional) Region of the service (_e.g.,_ `us-west-2`, `ap-northeast-1`).
+* `reverse_dns_name` - (Optional) Reverse DNS name of the service (_e.g.,_ `com.amazonaws.us-west-2.s3`). One of `dns_name`, `reverse_dns_name`, or `service_id` is required.
+* `reverse_dns_prefix` - (Optional) Prefix of the service (_e.g.,_ `com.amazonaws` in AWS Commercial, `cn.com.amazonaws` in AWS China).
+* `service_id` - (Optional) Service (_e.g.,_ `s3`, `rds`, `ec2`). One of `dns_name`, `reverse_dns_name`, or `service_id` is required.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `supported` - Whether the service is supported in the region's partition. New services may not be listed immediately as supported.
+
+<!-- cache-key: cdktf-0.18.0 input-1f67bf4039f0b27910cf9da065ca27ea6cdfc91b4ae00696fbad70cc0c50d4db -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/service_discovery_dns_namespace.html.markdown b/website/docs/cdktf/python/d/service_discovery_dns_namespace.html.markdown
new file mode 100644
index 00000000000..e093f1ad2d0
--- /dev/null
+++ b/website/docs/cdktf/python/d/service_discovery_dns_namespace.html.markdown
@@ -0,0 +1,50 @@
+---
+subcategory: "Cloud Map"
+layout: "aws"
+page_title: "AWS: aws_service_discovery_dns_namespace"
+description: |-
+  Retrieves information about a Service Discovery private or public DNS namespace.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_service_discovery_dns_namespace
+
+Retrieves information about a Service Discovery private or public DNS namespace.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_service_discovery_dns_namespace import DataAwsServiceDiscoveryDnsNamespace
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsServiceDiscoveryDnsNamespace(self, "test",
+            name="example.terraform.local",
+            type="DNS_PRIVATE"
+        )
+```
+
+## Argument Reference
+
+* `name` - (Required) Name of the namespace.
+* `type` - (Required) Type of the namespace. Allowed values are `DNS_PUBLIC` or `DNS_PRIVATE`.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the namespace.
+* `description` - Description of the namespace.
+* `id` - Namespace ID.
+* `hosted_zone` - ID for the hosted zone that Amazon Route 53 creates when you create a namespace.
+* `tags` - Map of tags for the resource.
+
+<!-- cache-key: cdktf-0.18.0 input-536486dabc04dbcda77c827f5666503eea5945a2c5257dff3f3c8c8d37db1b34 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/service_discovery_http_namespace.html.markdown b/website/docs/cdktf/python/d/service_discovery_http_namespace.html.markdown
new file mode 100644
index 00000000000..cf2e1d9b944
--- /dev/null
+++ b/website/docs/cdktf/python/d/service_discovery_http_namespace.html.markdown
@@ -0,0 +1,48 @@
+---
+subcategory: "Cloud Map"
+layout: "aws"
+page_title: "AWS: aws_service_discovery_http_namespace"
+description: |-
+  Retrieves information about a Service Discovery HTTP Namespace.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_service_discovery_http_namespace
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_service_discovery_http_namespace import DataAwsServiceDiscoveryHttpNamespace
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsServiceDiscoveryHttpNamespace(self, "example",
+            name="development"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name of the http namespace.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - ID of a namespace.
+* `arn` - ARN that Amazon Route 53 assigns to the namespace when you create it.
+* `description` - Description that you specify for the namespace when you create it.
+* `http_name` - Name of an HTTP namespace.
+* `tags` - Map of tags for the resource.
+
+<!-- cache-key: cdktf-0.18.0 input-fd64564a9e9f20381d3b8498bc1ece55a0a91282b8fa11f6f5581b84a7b4085a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/service_discovery_service.html.markdown b/website/docs/cdktf/python/d/service_discovery_service.html.markdown
new file mode 100644
index 00000000000..d447b7560dc
--- /dev/null
+++ b/website/docs/cdktf/python/d/service_discovery_service.html.markdown
@@ -0,0 +1,84 @@
+---
+subcategory: "Cloud Map"
+layout: "aws"
+page_title: "AWS: aws_service_discovery_service"
+description: |-
+  Retrieves information about a Service Discovery Service
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_service_discovery_service
+
+Retrieves information about a Service Discovery Service.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_service_discovery_service import DataAwsServiceDiscoveryService
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsServiceDiscoveryService(self, "test",
+            name="example",
+            namespace_id="NAMESPACE_ID_VALUE"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name of the service.
+* `namespace_id` - (Required) ID of the namespace that the service belongs to.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the service.
+* `arn` - ARN of the service.
+* `description` - Description of the service.
+* `dns_config` - Complex type that contains information about the resource record sets that you want Amazon Route 53 to create when you register an instance.
+* `health_check_config` - Complex type that contains settings for an optional health check. Only for Public DNS namespaces.
+* `health_check_custom_config` -  A complex type that contains settings for ECS managed health checks.
+* `tags` - Map of tags to assign to the service. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `tags_all` - (**Deprecated**) Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+### dns_config
+
+This argument supports the following arguments:
+
+* `namespace_id` - ID of the namespace to use for DNS configuration.
+* `dns_records` - An array that contains one DnsRecord object for each resource record set.
+* `routing_policy` - Routing policy that you want to apply to all records that Route 53 creates when you register an instance and specify the service. Valid Values: MULTIVALUE, WEIGHTED
+
+#### dns_records
+
+This argument supports the following arguments:
+
+* `ttl` - Amount of time, in seconds, that you want DNS resolvers to cache the settings for this resource record set.
+* `type` - Type of the resource, which indicates the value that Amazon Route 53 returns in response to DNS queries. Valid Values: A, AAAA, SRV, CNAME
+
+### health_check_config
+
+This argument supports the following arguments:
+
+* `failure_threshold` - Number of consecutive health checks. Maximum value of 10.
+* `resource_path` - Path that you want Route 53 to request when performing health checks. Route 53 automatically adds the DNS name for the service. If you don't specify a value, the default value is /.
+* `type` -  The type of health check that you want to create, which indicates how Route 53 determines whether an endpoint is healthy. Valid Values: HTTP, HTTPS, TCP
+
+### health_check_custom_config
+
+This argument supports the following arguments:
+
+* `failure_threshold` -  The number of 30-second intervals that you want service discovery to wait before it changes the health status of a service instance.  Maximum value of 10.
+
+<!-- cache-key: cdktf-0.18.0 input-7f7cfd8f45e41436fd49818ccfcd8108e8b10153e1f88948ca383049b98272be -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/servicecatalog_constraint.html.markdown b/website/docs/cdktf/python/d/servicecatalog_constraint.html.markdown
new file mode 100644
index 00000000000..95f0bf15450
--- /dev/null
+++ b/website/docs/cdktf/python/d/servicecatalog_constraint.html.markdown
@@ -0,0 +1,59 @@
+---
+subcategory: "Service Catalog"
+layout: "aws"
+page_title: "AWS: aws_servicecatalog_constraint"
+description: |-
+  Provides information on a Service Catalog Constraint
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_servicecatalog_constraint
+
+Provides information on a Service Catalog Constraint.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_servicecatalog_constraint import DataAwsServicecatalogConstraint
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsServicecatalogConstraint(self, "example",
+            accept_language="en",
+            id="cons-hrvy0335"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `id` - Constraint identifier.
+
+The following arguments are optional:
+
+* `accept_language` - (Optional) Language code. Valid values: `en` (English), `jp` (Japanese), `zh` (Chinese). Default value is `en`.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `description` - Description of the constraint.
+* `owner` - Owner of the constraint.
+* `parameters` - Constraint parameters in JSON format.
+* `portfolio_id` - Portfolio identifier.
+* `product_id` - Product identifier.
+* `status` - Constraint status.
+* `type` - Type of constraint. Valid values are `LAUNCH`, `NOTIFICATION`, `RESOURCE_UPDATE`, `STACKSET`, and `TEMPLATE`.
+
+<!-- cache-key: cdktf-0.18.0 input-da418dc5c6998e476df08abac67c17c4dc70e9bf30247effbc012c2e90dbc9b3 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/servicecatalog_launch_paths.html.markdown b/website/docs/cdktf/python/d/servicecatalog_launch_paths.html.markdown
new file mode 100644
index 00000000000..0409cebd8ba
--- /dev/null
+++ b/website/docs/cdktf/python/d/servicecatalog_launch_paths.html.markdown
@@ -0,0 +1,64 @@
+---
+subcategory: "Service Catalog"
+layout: "aws"
+page_title: "AWS: aws_servicecatalog_launch_paths"
+description: |-
+  Provides information on Service Catalog Launch Paths
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_servicecatalog_launch_paths
+
+Lists the paths to the specified product. A path is how the user has access to a specified product, and is necessary when provisioning a product. A path also determines the constraints put on the product.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_servicecatalog_launch_paths import DataAwsServicecatalogLaunchPaths
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsServicecatalogLaunchPaths(self, "example",
+            product_id="prod-yakog5pdriver"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `product_id` - (Required) Product identifier.
+
+The following arguments are optional:
+
+* `accept_language` - (Optional) Language code. Valid values: `en` (English), `jp` (Japanese), `zh` (Chinese). Default value is `en`.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `summaries` - Block with information about the launch path. See details below.
+
+### summaries
+
+* `constraint_summaries` - Block for constraints on the portfolio-product relationship. See details below.
+* `path_id` - Identifier of the product path.
+* `name` - Name of the portfolio to which the path was assigned.
+* `tags` - Tags associated with this product path.
+
+### constraint_summaries
+
+* `description` - Description of the constraint.
+* `type` - Type of constraint. Valid values are `LAUNCH`, `NOTIFICATION`, `STACKSET`, and `TEMPLATE`.
+
+<!-- cache-key: cdktf-0.18.0 input-395a3eb806ea47e44fedb57001a8b66f937569364601cfff911b33a8f74a212b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/servicecatalog_portfolio.html.markdown b/website/docs/cdktf/python/d/servicecatalog_portfolio.html.markdown
new file mode 100644
index 00000000000..5d66f2e1a8e
--- /dev/null
+++ b/website/docs/cdktf/python/d/servicecatalog_portfolio.html.markdown
@@ -0,0 +1,55 @@
+---
+subcategory: "Service Catalog"
+layout: "aws"
+page_title: "AWS: aws_servicecatalog_portfolio"
+description: |-
+  Provides information for a Service Catalog Portfolio.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_servicecatalog_portfolio
+
+Provides information for a Service Catalog Portfolio.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_servicecatalog_portfolio import DataAwsServicecatalogPortfolio
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsServicecatalogPortfolio(self, "portfolio",
+            id="port-07052002"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `id` - (Required) Portfolio identifier.
+
+The following arguments are optional:
+
+* `accept_language` - (Optional) Language code. Valid values: `en` (English), `jp` (Japanese), `zh` (Chinese). Default value is `en`.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - Portfolio ARN.
+* `created_time` - Time the portfolio was created.
+* `description` - Description of the portfolio
+* `name` - Portfolio name.
+* `provider_name` - Name of the person or organization who owns the portfolio.
+* `tags` - Tags applied to the portfolio.
+
+<!-- cache-key: cdktf-0.18.0 input-84da50c0619f8efedfa9915aaeed7934ec932b8663c9afe0bb857f54d0d60299 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/servicecatalog_portfolio_constraints.html.markdown b/website/docs/cdktf/python/d/servicecatalog_portfolio_constraints.html.markdown
new file mode 100644
index 00000000000..a7f22ee77d4
--- /dev/null
+++ b/website/docs/cdktf/python/d/servicecatalog_portfolio_constraints.html.markdown
@@ -0,0 +1,61 @@
+---
+subcategory: "Service Catalog"
+layout: "aws"
+page_title: "AWS: aws_servicecatalog_portfolio_constraints"
+description: |-
+  Provides information on Service Catalog Portfolio Constraints
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_servicecatalog_portfolio_constraints
+
+Provides information on Service Catalog Portfolio Constraints.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_servicecatalog_portfolio_constraints import DataAwsServicecatalogPortfolioConstraints
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsServicecatalogPortfolioConstraints(self, "example",
+            portfolio_id="port-3lli3b3an"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `portfolio_id` - (Required) Portfolio identifier.
+
+The following arguments are optional:
+
+* `accept_language` - (Optional) Language code. Valid values: `en` (English), `jp` (Japanese), `zh` (Chinese). Default value is `en`.
+* `product_id` - (Optional) Product identifier.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `details` - List of information about the constraints. See details below.
+
+### details
+
+* `constraint_id` - Identifier of the constraint.
+* `description` - Description of the constraint.
+* `portfolio_id` - Identifier of the portfolio the product resides in. The constraint applies only to the instance of the product that lives within this portfolio.
+* `product_id` - Identifier of the product the constraint applies to. A constraint applies to a specific instance of a product within a certain portfolio.
+* `type` - Type of constraint. Valid values are `LAUNCH`, `NOTIFICATION`, `STACKSET`, and `TEMPLATE`.
+
+<!-- cache-key: cdktf-0.18.0 input-f95e8d8a013aacf7b3916f6b479047744fecc334d40aba4c8da473d8e4af976e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/servicecatalog_product.html.markdown b/website/docs/cdktf/python/d/servicecatalog_product.html.markdown
new file mode 100644
index 00000000000..0004dad22a1
--- /dev/null
+++ b/website/docs/cdktf/python/d/servicecatalog_product.html.markdown
@@ -0,0 +1,66 @@
+---
+subcategory: "Service Catalog"
+layout: "aws"
+page_title: "AWS: aws_servicecatalog_product"
+description: |-
+  This data source provides information about a Service Catalog product.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_servicecatalog_product
+
+Use this data source to retrieve information about a Service Catalog product.
+
+~> **NOTE:** A "provisioning artifact" is also known as a "version," and a "distributor" is also known as a "vendor."
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_servicecatalog_product import DataAwsServicecatalogProduct
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsServicecatalogProduct(self, "example",
+            id="prod-dnigbtea24ste"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `id` - (Required) ID of the product.
+
+The following arguments are optional:
+
+* `accept_language` - (Optional) Language code. Valid values are `en` (English), `jp` (Japanese), `zh` (Chinese). The default value is `en`.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the product.
+* `created_time` - Time when the product was created.
+* `description` - Description of the product.
+* `distributor` - Vendor of the product.
+* `has_default_path` - Whether the product has a default path.
+* `name` - Name of the product.
+* `owner` - Owner of the product.
+* `status` - Status of the product.
+* `support_description` - Field that provides support information about the product.
+* `support_email` - Contact email for product support.
+* `support_url` - Contact URL for product support.
+* `tags` - Tags applied to the product.
+* `type` - Type of product.
+
+<!-- cache-key: cdktf-0.18.0 input-5458573534df92d96787bca1e91a863522fae24c5024caea86faec96b4253984 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/servicecatalog_provisioning_artifacts.html.markdown b/website/docs/cdktf/python/d/servicecatalog_provisioning_artifacts.html.markdown
new file mode 100644
index 00000000000..5308ff7ccc2
--- /dev/null
+++ b/website/docs/cdktf/python/d/servicecatalog_provisioning_artifacts.html.markdown
@@ -0,0 +1,62 @@
+---
+subcategory: "Service Catalog"
+layout: "aws"
+page_title: "AWS: aws_servicecatalog_provisioning_artifacts"
+description: |-
+  Provides information on Service Catalog Provisioning Artifacts
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_servicecatalog_provisioning_artifacts
+
+Lists the provisioning artifacts for the specified product.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_servicecatalog_provisioning_artifacts import DataAwsServicecatalogProvisioningArtifacts
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsServicecatalogProvisioningArtifacts(self, "example",
+            product_id="prod-yakog5pdriver"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `product_id` - (Required) Product identifier.
+
+The following arguments are optional:
+
+* `accept_language` - (Optional) Language code. Valid values: `en` (English), `jp` (Japanese), `zh` (Chinese). Default value is `en`.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `provisioning_artifact_details` - List with information about the provisioning artifacts. See details below.
+
+### provisioning_artifact_details
+
+* `active` - Indicates whether the product version is active.
+* `created_time` - The UTC time stamp of the creation time.
+* `description` - The description of the provisioning artifact.
+* `guidance` - Information set by the administrator to provide guidance to end users about which provisioning artifacts to use.
+* `id` - The identifier of the provisioning artifact.
+* `name` - The name of the provisioning artifact.
+* `type` - The type of provisioning artifact.
+
+<!-- cache-key: cdktf-0.18.0 input-70d3d0ef3ce0371f0258d9d9db5e9876444b44930ec3530badd4b8fe021fee18 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/servicequotas_service.html.markdown b/website/docs/cdktf/python/d/servicequotas_service.html.markdown
new file mode 100644
index 00000000000..552c4e35e10
--- /dev/null
+++ b/website/docs/cdktf/python/d/servicequotas_service.html.markdown
@@ -0,0 +1,47 @@
+---
+subcategory: "Service Quotas"
+layout: "aws"
+page_title: "AWS: aws_servicequotas_service"
+description: |-
+  Retrieve information about a Service Quotas Service
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_servicequotas_service
+
+Retrieve information about a Service Quotas Service.
+
+~> **NOTE:** Global quotas apply to all AWS regions, but can only be accessed in `us-east-1` in the Commercial partition or `us-gov-west-1` in the GovCloud partition. In other regions, the AWS API will return the error `The request failed because the specified service does not exist.`
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_servicequotas_service import DataAwsServicequotasService
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsServicequotasService(self, "example",
+            service_name="Amazon Virtual Private Cloud (Amazon VPC)"
+        )
+```
+
+## Argument Reference
+
+* `service_name` - (Required) Service name to lookup within Service Quotas. Available values can be found with the [AWS CLI service-quotas list-services command](https://docs.aws.amazon.com/cli/latest/reference/service-quotas/list-services.html).
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - Code of the service.
+* `service_code` - Code of the service.
+
+<!-- cache-key: cdktf-0.18.0 input-4d133c6d1401c018a17d5ac93ddafa2d0e17605d51df1be8cf1b26789b0bd62e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/servicequotas_service_quota.html.markdown b/website/docs/cdktf/python/d/servicequotas_service_quota.html.markdown
new file mode 100644
index 00000000000..f1aa0f48c2b
--- /dev/null
+++ b/website/docs/cdktf/python/d/servicequotas_service_quota.html.markdown
@@ -0,0 +1,70 @@
+---
+subcategory: "Service Quotas"
+layout: "aws"
+page_title: "AWS: aws_servicequotas_service_quota"
+description: |-
+  Retrieve information about a Service Quota
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_servicequotas_service_quota
+
+Retrieve information about a Service Quota.
+
+~> **NOTE:** Global quotas apply to all AWS regions, but can only be accessed in `us-east-1` in the Commercial partition or `us-gov-west-1` in the GovCloud partition. In other regions, the AWS API will return the error `The request failed because the specified service does not exist.`
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_servicequotas_service_quota import DataAwsServicequotasServiceQuota
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsServicequotasServiceQuota(self, "by_quota_code",
+            quota_code="L-F678F1CE",
+            service_code="vpc"
+        )
+        DataAwsServicequotasServiceQuota(self, "by_quota_name",
+            quota_name="VPCs per Region",
+            service_code="vpc"
+        )
+```
+
+## Argument Reference
+
+~> *NOTE:* Either `quota_code` or `quota_name` must be configured.
+
+* `service_code` - (Required) Service code for the quota. Available values can be found with the [`aws_servicequotas_service` data source](/docs/providers/aws/d/servicequotas_service.html) or [AWS CLI service-quotas list-services command](https://docs.aws.amazon.com/cli/latest/reference/service-quotas/list-services.html).
+* `quota_code` - (Optional) Quota code within the service. When configured, the data source directly looks up the service quota. Available values can be found with the [AWS CLI service-quotas list-service-quotas command](https://docs.aws.amazon.com/cli/latest/reference/service-quotas/list-service-quotas.html). One of `quota_code` or `quota_name` must be specified.
+* `quota_name` - (Optional) Quota name within the service. When configured, the data source searches through all service quotas to find the matching quota name. Available values can be found with the [AWS CLI service-quotas list-service-quotas command](https://docs.aws.amazon.com/cli/latest/reference/service-quotas/list-service-quotas.html). One of `quota_name` or `quota_code` must be specified.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `adjustable` - Whether the service quota is adjustable.
+* `arn` - ARN of the service quota.
+* `default_value` - Default value of the service quota.
+* `global_quota` - Whether the service quota is global for the AWS account.
+* `id` - ARN of the service quota.
+* `service_name` - Name of the service.
+* `usage_metric` - Information about the measurement.
+    * `metric_dimensions` - The metric dimensions.
+        * `class`
+        * `resource`
+        * `service`
+        * `type`
+    * `metric_name` - The name of the metric.
+    * `metric_namespace` - The namespace of the metric.
+    * `metric_statistic_recommendation` - The metric statistic that AWS recommend you use when determining quota usage.
+* `value` - Current value of the service quota.
+
+<!-- cache-key: cdktf-0.18.0 input-bc36008b8483826c556e6fd6e192b7a6b4c3b1b4a2f09174ab402172ccc82dd9 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/servicequotas_templates.html.markdown b/website/docs/cdktf/python/d/servicequotas_templates.html.markdown
new file mode 100644
index 00000000000..7f17caa45f8
--- /dev/null
+++ b/website/docs/cdktf/python/d/servicequotas_templates.html.markdown
@@ -0,0 +1,59 @@
+---
+subcategory: "Service Quotas"
+layout: "aws"
+page_title: "AWS: aws_servicequotas_templates"
+description: |-
+  Terraform data source for managing an AWS Service Quotas Templates.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_servicequotas_templates
+
+Terraform data source for managing an AWS Service Quotas Templates.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_servicequotas_templates import DataAwsServicequotasTemplates
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsServicequotasTemplates(self, "example",
+            region="us-east-1"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `region` - (Required) AWS Region to which the quota increases apply.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `templates` - A list of quota increase templates for specified region. See [`templates`](#templates).
+
+### `templates`
+
+* `global_quota` - Indicates whether the quota is global.
+* `quota_name` - Quota name.
+* `quota_code` - Quota identifier.
+* `region` - AWS Region to which the template applies.
+* `service_code` - (Required) Service identifier.
+* `service_name` - Service name.
+* `unit` - Unit of measurement.
+* `value` - (Required) The new, increased value for the quota.
+
+<!-- cache-key: cdktf-0.18.0 input-45d70f2e4ea266e23b4ad36acd3c73ea199467bd5ebbe49c2aee22a627335cbb -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/ses_active_receipt_rule_set.html.markdown b/website/docs/cdktf/python/d/ses_active_receipt_rule_set.html.markdown
new file mode 100644
index 00000000000..6546d627abc
--- /dev/null
+++ b/website/docs/cdktf/python/d/ses_active_receipt_rule_set.html.markdown
@@ -0,0 +1,39 @@
+---
+subcategory: "SES (Simple Email)"
+layout: "aws"
+page_title: "AWS: aws_ses_active_receipt_rule_set"
+description: |-
+  Retrieve the active SES receipt rule set
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_ses_active_receipt_rule_set
+
+Retrieve the active SES receipt rule set
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_ses_active_receipt_rule_set import DataAwsSesActiveReceiptRuleSet
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsSesActiveReceiptRuleSet(self, "main")
+```
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - SES receipt rule set ARN.
+* `rule_set_name` - Name of the rule set
+
+<!-- cache-key: cdktf-0.18.0 input-7e5511881f5e55ae7c44bb058232594f1824f28cdd4358ee38cec88c0c71d14b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/ses_domain_identity.html.markdown b/website/docs/cdktf/python/d/ses_domain_identity.html.markdown
new file mode 100644
index 00000000000..35664f3da77
--- /dev/null
+++ b/website/docs/cdktf/python/d/ses_domain_identity.html.markdown
@@ -0,0 +1,42 @@
+---
+subcategory: "SES (Simple Email)"
+layout: "aws"
+page_title: "AWS: aws_ses_domain_identity"
+description: |-
+  Retrieve the SES domain identity
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_ses_domain_identity
+
+Retrieve the SES domain identity
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_ses_domain_identity import DataAwsSesDomainIdentity
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsSesDomainIdentity(self, "example",
+            domain="example.com"
+        )
+```
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the domain identity.
+* `domain` - Name of the domain
+* `verification_token` - Code which when added to the domain as a TXT record will signal to SES that the owner of the domain has authorized SES to act on their behalf.
+
+<!-- cache-key: cdktf-0.18.0 input-c92b09c53a734f66fe357db2ededfa5c3680d8cf83576766510fba91783213fc -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/ses_domain_identity.markdown b/website/docs/cdktf/python/d/ses_domain_identity.markdown
new file mode 100644
index 00000000000..35664f3da77
--- /dev/null
+++ b/website/docs/cdktf/python/d/ses_domain_identity.markdown
@@ -0,0 +1,42 @@
+---
+subcategory: "SES (Simple Email)"
+layout: "aws"
+page_title: "AWS: aws_ses_domain_identity"
+description: |-
+  Retrieve the SES domain identity
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_ses_domain_identity
+
+Retrieve the SES domain identity
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_ses_domain_identity import DataAwsSesDomainIdentity
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsSesDomainIdentity(self, "example",
+            domain="example.com"
+        )
+```
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the domain identity.
+* `domain` - Name of the domain
+* `verification_token` - Code which when added to the domain as a TXT record will signal to SES that the owner of the domain has authorized SES to act on their behalf.
+
+<!-- cache-key: cdktf-0.18.0 input-c92b09c53a734f66fe357db2ededfa5c3680d8cf83576766510fba91783213fc -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/ses_email_identity.html.markdown b/website/docs/cdktf/python/d/ses_email_identity.html.markdown
new file mode 100644
index 00000000000..35a37d6052a
--- /dev/null
+++ b/website/docs/cdktf/python/d/ses_email_identity.html.markdown
@@ -0,0 +1,41 @@
+---
+subcategory: "SES (Simple Email)"
+layout: "aws"
+page_title: "AWS: aws_ses_email_identity"
+description: |-
+  Retrieve the active SES email identity
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_ses_email_identity
+
+Retrieve the active SES email identity
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_ses_email_identity import DataAwsSesEmailIdentity
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsSesEmailIdentity(self, "example",
+            email="awesome@example.com"
+        )
+```
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` -  The ARN of the email identity.
+* `email` - Email identity.
+
+<!-- cache-key: cdktf-0.18.0 input-8b3c7c5e4c1d6197b2c76516866374779af6bd8d12e2ceda7f1a749b93b9a39e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/ses_email_identity.markdown b/website/docs/cdktf/python/d/ses_email_identity.markdown
new file mode 100644
index 00000000000..35a37d6052a
--- /dev/null
+++ b/website/docs/cdktf/python/d/ses_email_identity.markdown
@@ -0,0 +1,41 @@
+---
+subcategory: "SES (Simple Email)"
+layout: "aws"
+page_title: "AWS: aws_ses_email_identity"
+description: |-
+  Retrieve the active SES email identity
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_ses_email_identity
+
+Retrieve the active SES email identity
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_ses_email_identity import DataAwsSesEmailIdentity
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsSesEmailIdentity(self, "example",
+            email="awesome@example.com"
+        )
+```
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` -  The ARN of the email identity.
+* `email` - Email identity.
+
+<!-- cache-key: cdktf-0.18.0 input-8b3c7c5e4c1d6197b2c76516866374779af6bd8d12e2ceda7f1a749b93b9a39e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/sesv2_configuration_set.html.markdown b/website/docs/cdktf/python/d/sesv2_configuration_set.html.markdown
new file mode 100644
index 00000000000..4e4bb0ebc9e
--- /dev/null
+++ b/website/docs/cdktf/python/d/sesv2_configuration_set.html.markdown
@@ -0,0 +1,65 @@
+---
+subcategory: "SESv2 (Simple Email V2)"
+layout: "aws"
+page_title: "AWS: aws_sesv2_configuration_set"
+description: |-
+  Terraform data source for managing an AWS SESv2 (Simple Email V2) Configuration Set.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_sesv2_configuration_set
+
+Terraform data source for managing an AWS SESv2 (Simple Email V2) Configuration Set.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_sesv2_configuration_set import DataAwsSesv2ConfigurationSet
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsSesv2ConfigurationSet(self, "example",
+            configuration_set_name="example"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `configuration_set_name` - (Required) The name of the configuration set.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `delivery_options` - An object that defines the dedicated IP pool that is used to send emails that you send using the configuration set.
+    * `sending_pool_name` - The name of the dedicated IP pool to associate with the configuration set.
+    * `tls_policy` - Specifies whether messages that use the configuration set are required to use Transport Layer Security (TLS).
+* `reputation_options` - An object that defines whether or not Amazon SES collects reputation metrics for the emails that you send that use the configuration set.
+    * `last_fresh_start` - The date and time (in Unix time) when the reputation metrics were last given a fresh start.
+    * `reputation_metrics_enabled` - Specifies whether tracking of reputation metrics is enabled.
+* `sending_options` - An object that defines whether or not Amazon SES can send email that you send using the configuration set.
+    * `sending_enabled` - Specifies whether email sending is enabled.
+* `suppression_options` - An object that contains information about the suppression list preferences for your account.
+    * `suppressed_reasons` - A list that contains the reasons that email addresses are automatically added to the suppression list for your account.
+* `tags` - Key-value map of resource tags for the container recipe.
+* `tracking_options` - An object that defines the open and click tracking options for emails that you send using the configuration set.
+    * `custom_redirect_domain` - The domain to use for tracking open and click events.
+* `vdm_options` - An object that contains information about the VDM preferences for your configuration set.
+    * `dashboard_options` - Specifies additional settings for your VDM configuration as applicable to the Dashboard.
+        * `engagement_metrics` - Specifies the status of your VDM engagement metrics collection.
+    * `guardian_options` - Specifies additional settings for your VDM configuration as applicable to the Guardian.
+        * `optimized_shared_delivery` - Specifies the status of your VDM optimized shared delivery.
+
+<!-- cache-key: cdktf-0.18.0 input-766473cbe249f97d2e59a5938aa348513964c44ef9762f5fa275491b1409c22a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/sesv2_dedicated_ip_pool.html.markdown b/website/docs/cdktf/python/d/sesv2_dedicated_ip_pool.html.markdown
new file mode 100644
index 00000000000..8e3ec2c52bf
--- /dev/null
+++ b/website/docs/cdktf/python/d/sesv2_dedicated_ip_pool.html.markdown
@@ -0,0 +1,57 @@
+---
+subcategory: "SESv2 (Simple Email V2)"
+layout: "aws"
+page_title: "AWS: aws_sesv2_dedicated_ip_pool"
+description: |-
+  Terraform data source for managing an AWS SESv2 (Simple Email V2) Dedicated IP Pool.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_sesv2_dedicated_ip_pool
+
+Terraform data source for managing an AWS SESv2 (Simple Email V2) Dedicated IP Pool.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_sesv2_dedicated_ip_pool import DataAwsSesv2DedicatedIpPool
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsSesv2DedicatedIpPool(self, "example",
+            pool_name="my-pool"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `pool_name` - (Required) Name of the dedicated IP pool.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Dedicated IP Pool.
+* `dedicated_ips` - A list of objects describing the pool's dedicated IP's. See [`dedicated_ips`](#dedicated_ips).
+* `scaling_mode` - (Optional) IP pool scaling mode. Valid values: `STANDARD`, `MANAGED`.
+* `tags` - A map of tags attached to the pool.
+
+### dedicated_ips
+
+* `ip` - IPv4 address.
+* `warmup_percentage` - Indicates how complete the dedicated IP warm-up process is. When this value equals `1`, the address has completed the warm-up process and is ready for use.
+* `warmup_status` - The warm-up status of a dedicated IP address. Valid values: `IN_PROGRESS`, `DONE`.
+
+<!-- cache-key: cdktf-0.18.0 input-85f32989660a929d8bc2374a2bb39ccd95b65ab0f91d1df95fd4ec734bc35496 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/sesv2_email_identity.html.markdown b/website/docs/cdktf/python/d/sesv2_email_identity.html.markdown
new file mode 100644
index 00000000000..f82bccc0d64
--- /dev/null
+++ b/website/docs/cdktf/python/d/sesv2_email_identity.html.markdown
@@ -0,0 +1,58 @@
+---
+subcategory: "SESv2 (Simple Email V2)"
+layout: "aws"
+page_title: "AWS: aws_sesv2_email_identity"
+description: |-
+  Terraform data source for managing an AWS SESv2 (Simple Email V2) Email Identity.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_sesv2_email_identity
+
+Terraform data source for managing an AWS SESv2 (Simple Email V2) Email Identity.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_sesv2_email_identity import DataAwsSesv2EmailIdentity
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsSesv2EmailIdentity(self, "example",
+            email_identity="example.com"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `email_identity` - (Required) The name of the email identity.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Email Identity.
+* `dkim_signing_attributes` - A list of objects that contains at most one element with information about the private key and selector that you want to use to configure DKIM for the identity for Bring Your Own DKIM (BYODKIM) for the identity, or, configures the key length to be used for Easy DKIM.
+    * `current_signing_key_length` - [Easy DKIM] The key length of the DKIM key pair in use.
+    * `last_key_generation_timestamp` - [Easy DKIM] The last time a key pair was generated for this identity.
+    * `next_signing_key_length` - [Easy DKIM] The key length of the future DKIM key pair to be generated. This can be changed at most once per day.
+    * `signing_attributes_origin` - A string that indicates how DKIM was configured for the identity. `AWS_SES` indicates that DKIM was configured for the identity by using Easy DKIM. `EXTERNAL` indicates that DKIM was configured for the identity by using Bring Your Own DKIM (BYODKIM).
+    * `status` - Describes whether or not Amazon SES has successfully located the DKIM records in the DNS records for the domain. See the [AWS SES API v2 Reference](https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_DkimAttributes.html#SES-Type-DkimAttributes-Status) for supported statuses.
+    * `tokens` - If you used Easy DKIM to configure DKIM authentication for the domain, then this object contains a set of unique strings that you use to create a set of CNAME records that you add to the DNS configuration for your domain. When Amazon SES detects these records in the DNS configuration for your domain, the DKIM authentication process is complete. If you configured DKIM authentication for the domain by providing your own public-private key pair, then this object contains the selector for the public key.
+* `identity_type` - The email identity type. Valid values: `EMAIL_ADDRESS`, `DOMAIN`.
+* `tags` - Key-value mapping of resource tags.
+* `verified_for_sending_status` - Specifies whether or not the identity is verified.
+
+<!-- cache-key: cdktf-0.18.0 input-7c12091698113e4874168fd26ec7c1c02c1487b040cff1044c5b20751c66d041 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/sesv2_email_identity_mail_from_attributes.html.markdown b/website/docs/cdktf/python/d/sesv2_email_identity_mail_from_attributes.html.markdown
new file mode 100644
index 00000000000..36f33d4068b
--- /dev/null
+++ b/website/docs/cdktf/python/d/sesv2_email_identity_mail_from_attributes.html.markdown
@@ -0,0 +1,56 @@
+---
+subcategory: "SESv2 (Simple Email V2)"
+layout: "aws"
+page_title: "AWS: aws_sesv2_email_identity_mail_from_attributes"
+description: |-
+  Terraform data source for managing an AWS SESv2 (Simple Email V2) Email Identity Mail From Attributes.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_sesv2_email_identity_mail_from_attributes
+
+Terraform data source for managing an AWS SESv2 (Simple Email V2) Email Identity Mail From Attributes.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_sesv2_email_identity import DataAwsSesv2EmailIdentity
+from imports.aws.data_aws_sesv2_email_identity_mail_from_attributes import DataAwsSesv2EmailIdentityMailFromAttributes
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = DataAwsSesv2EmailIdentity(self, "example",
+            email_identity="example.com"
+        )
+        data_aws_sesv2_email_identity_mail_from_attributes_example =
+        DataAwsSesv2EmailIdentityMailFromAttributes(self, "example_1",
+            email_identity=Token.as_string(example.email_identity)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_sesv2_email_identity_mail_from_attributes_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `email_identity` - (Required) The name of the email identity.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `behavior_on_mx_failure` - The action to take if the required MX record isn't found when you send an email. Valid values: `USE_DEFAULT_VALUE`, `REJECT_MESSAGE`.
+* `mail_from_domain` - The custom MAIL FROM domain that you want the verified identity to use.
+
+<!-- cache-key: cdktf-0.18.0 input-f06a941b8e525f3b2704cada8b06a7094de35a609eb45fe1ddea9ebc9ad88ae8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/sfn_activity.html.markdown b/website/docs/cdktf/python/d/sfn_activity.html.markdown
new file mode 100644
index 00000000000..80398f0e479
--- /dev/null
+++ b/website/docs/cdktf/python/d/sfn_activity.html.markdown
@@ -0,0 +1,48 @@
+---
+subcategory: "SFN (Step Functions)"
+layout: "aws"
+page_title: "AWS: aws_sfn_activity"
+description: |-
+  Use this data source to get information about a Step Functions Activity.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_sfn_activity
+
+Provides a Step Functions Activity data source
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_sfn_activity import DataAwsSfnActivity
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsSfnActivity(self, "sfn_activity",
+            name="my-activity"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Optional) Name that identifies the activity.
+* `arn` - (Optional) ARN that identifies the activity.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - ARN that identifies the activity.
+* `creation_date` - Date the activity was created.
+
+<!-- cache-key: cdktf-0.18.0 input-e2493cc090cc44214dfdcc458776424943b9df2b9c75318cd7718d0ef209f5e1 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/sfn_alias.html.markdown b/website/docs/cdktf/python/d/sfn_alias.html.markdown
new file mode 100644
index 00000000000..e4b5c9f49aa
--- /dev/null
+++ b/website/docs/cdktf/python/d/sfn_alias.html.markdown
@@ -0,0 +1,53 @@
+---
+subcategory: "SFN (Step Functions)"
+layout: "aws"
+page_title: "AWS: aws_sfn_alias"
+description: |-
+  Terraform data source for managing an AWS SFN (Step Functions) State Machine Alias.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_sfn_alias
+
+Terraform data source for managing an AWS SFN (Step Functions) State Machine Alias.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_sfn_alias import DataAwsSfnAlias
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsSfnAlias(self, "example",
+            name="my_sfn_alias",
+            statemachine_arn=sfn_test.arn
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) Name of the State Machine alias.
+* `statemachine_arn` - (Required) ARN of the State Machine.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN identifying the State Machine alias.
+* `creation_date` - Date the state machine Alias was created.
+* `description` - Description of state machine alias.
+* `routing_configuration` - Routing Configuration of state machine alias
+
+<!-- cache-key: cdktf-0.18.0 input-74bb5c065bedebe96a1f1604459cc4b92ef1bc40588d2a1e6918a9e59b8ae39b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/sfn_state_machine.html.markdown b/website/docs/cdktf/python/d/sfn_state_machine.html.markdown
new file mode 100644
index 00000000000..91ba0dde4ce
--- /dev/null
+++ b/website/docs/cdktf/python/d/sfn_state_machine.html.markdown
@@ -0,0 +1,52 @@
+---
+subcategory: "SFN (Step Functions)"
+layout: "aws"
+page_title: "AWS: aws_sfn_state_machine"
+description: |-
+  Get information on an Amazon Step Function State Machine
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_sfn_state_machine
+
+Use this data source to get the ARN of a State Machine in AWS Step
+Function (SFN). By using this data source, you can reference a
+state machine without having to hard code the ARNs as input.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_sfn_state_machine import DataAwsSfnStateMachine
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsSfnStateMachine(self, "example",
+            name="an_example_sfn_name"
+        )
+```
+
+## Argument Reference
+
+* `name` - (Required) Friendly name of the state machine to match.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - Set to the ARN of the found state machine, suitable for referencing in other resources that support State Machines.
+* `arn` - Set to the arn of the state function.
+* `role_arn` - Set to the role_arn used by the state function.
+* `definition` - Set to the state machine definition.
+* `creation_date` - Date the state machine was created.
+* `revision_id` - The revision identifier for the state machine.
+* `status` - Set to the current status of the state machine.
+
+<!-- cache-key: cdktf-0.18.0 input-0f22f10a18b56fd2ce60408fbc367e0d625ee8c7fc8072d7009918250afe27d7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/sfn_state_machine_versions.html.markdown b/website/docs/cdktf/python/d/sfn_state_machine_versions.html.markdown
new file mode 100644
index 00000000000..a6785df3c9d
--- /dev/null
+++ b/website/docs/cdktf/python/d/sfn_state_machine_versions.html.markdown
@@ -0,0 +1,48 @@
+---
+subcategory: "SFN (Step Functions)"
+layout: "aws"
+page_title: "AWS: aws_sfn_state_machine_versions"
+description: |-
+  Terraform data source for managing an AWS SFN (Step Functions) State Machine Versions.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_sfn_state_machine_versions
+
+Terraform data source for managing an AWS SFN (Step Functions) State Machine Versions.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_sfn_state_machine_versions import DataAwsSfnStateMachineVersions
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsSfnStateMachineVersions(self, "test",
+            statemachine_arn=Token.as_string(aws_sfn_state_machine_test.arn)
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `statemachine_arn` - (Required) ARN of the State Machine.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `statemachine_versions` - ARN List identifying the statemachine versions.
+
+<!-- cache-key: cdktf-0.18.0 input-824fd2b5bdeae5b7a6a3535a32c61238432e8f9bb78e071234ecee4baa02e255 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/signer_signing_job.html.markdown b/website/docs/cdktf/python/d/signer_signing_job.html.markdown
new file mode 100644
index 00000000000..0d94090b930
--- /dev/null
+++ b/website/docs/cdktf/python/d/signer_signing_job.html.markdown
@@ -0,0 +1,60 @@
+---
+subcategory: "Signer"
+layout: "aws"
+page_title: "AWS: aws_signer_signing_job"
+description: |-
+  Provides a Signer Signing Job data source.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_signer_signing_job
+
+Provides information about a Signer Signing Job.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_signer_signing_job import DataAwsSignerSigningJob
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsSignerSigningJob(self, "build_signing_job",
+            job_id="9ed7e5c3-b8d4-4da0-8459-44e0b068f7ee"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `job_id` - (Required) ID of the signing job on output.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `completed_at` - Date and time in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8) that the signing job was completed.
+* `created_at` - Date and time in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8) that the signing job was created.
+* `job_invoker` - IAM entity that initiated the signing job.
+* `job_owner` - AWS account ID of the job owner.
+* `platform_display_name` - A human-readable name for the signing platform associated with the signing job.
+* `platform_id` - Platform to which your signed code image will be distributed.
+* `profile_name` - Name of the profile that initiated the signing operation.
+* `profile_version` - Version of the signing profile used to initiate the signing job.
+* `requested_by` - IAM principal that requested the signing job.
+* `revocation_record` - Revocation record if the signature generated by the signing job has been revoked. Contains a timestamp and the ID of the IAM entity that revoked the signature.
+* `signature_expires_at` - The time when the signature of a signing job expires.
+* `signed_object` - Name of the S3 bucket where the signed code image is saved by code signing.
+* `source` - Object that contains the name of your S3 bucket or your raw code.
+* `status` - Status of the signing job.
+* `status_reason` - String value that contains the status reason.
+
+<!-- cache-key: cdktf-0.18.0 input-da438917e91506b32ffdad63f1749fec4c7fba78b31e711db78cd6ea684d041b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/signer_signing_profile.html.markdown b/website/docs/cdktf/python/d/signer_signing_profile.html.markdown
new file mode 100644
index 00000000000..19dd5fb286a
--- /dev/null
+++ b/website/docs/cdktf/python/d/signer_signing_profile.html.markdown
@@ -0,0 +1,54 @@
+---
+subcategory: "Signer"
+layout: "aws"
+page_title: "AWS: aws_signer_signing_profile"
+description: |-
+  Provides a Signer Signing Profile data source.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_signer_signing_profile
+
+Provides information about a Signer Signing Profile.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_signer_signing_profile import DataAwsSignerSigningProfile
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsSignerSigningProfile(self, "production_signing_profile",
+            name="prod_profile_DdW3Mk1foYL88fajut4mTVFGpuwfd4ACO6ANL0D1uIj7lrn8adK"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name of the target signing profile.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN for the signing profile.
+* `platform_display_name` - A human-readable name for the signing platform associated with the signing profile.
+* `platform_id` - ID of the platform that is used by the target signing profile.
+* `revocation_record` - Revocation information for a signing profile.
+* `signature_validity_period` - The validity period for a signing job.
+* `status` - Status of the target signing profile.
+* `tags` - List of tags associated with the signing profile.
+* `version` - Current version of the signing profile.
+* `version_arn` - Signing profile ARN, including the profile version.
+
+<!-- cache-key: cdktf-0.18.0 input-aba77f8dc958b5e0757ea2581dd2d80a47faca88c585f688dbc1436b3712ace6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/sns_topic.html.markdown b/website/docs/cdktf/python/d/sns_topic.html.markdown
new file mode 100644
index 00000000000..680e1700ce1
--- /dev/null
+++ b/website/docs/cdktf/python/d/sns_topic.html.markdown
@@ -0,0 +1,47 @@
+---
+subcategory: "SNS (Simple Notification)"
+layout: "aws"
+page_title: "AWS: aws_sns_topic"
+description: |-
+  Get information on a Amazon Simple Notification Service (SNS) Topic
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_sns_topic
+
+Use this data source to get the ARN of a topic in AWS Simple Notification
+Service (SNS). By using this data source, you can reference SNS topics
+without having to hard code the ARNs as input.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_sns_topic import DataAwsSnsTopic
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsSnsTopic(self, "example",
+            name="an_example_topic"
+        )
+```
+
+## Argument Reference
+
+* `name` - (Required) Friendly name of the topic to match.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the found topic, suitable for referencing in other resources that support SNS topics.
+* `id` - ARN of the found topic, suitable for referencing in other resources that support SNS topics.
+
+<!-- cache-key: cdktf-0.18.0 input-a8e2c249a5626888f1285a9f19fb2d9d401d550cc75845a638d912a441614449 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/sqs_queue.html.markdown b/website/docs/cdktf/python/d/sqs_queue.html.markdown
new file mode 100644
index 00000000000..c89a88c4432
--- /dev/null
+++ b/website/docs/cdktf/python/d/sqs_queue.html.markdown
@@ -0,0 +1,48 @@
+---
+subcategory: "SQS (Simple Queue)"
+layout: "aws"
+page_title: "AWS: aws_sqs_queue"
+description: |-
+  Get information on an Amazon Simple Queue Service (SQS) Queue
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_sqs_queue
+
+Use this data source to get the ARN and URL of queue in AWS Simple Queue Service (SQS).
+By using this data source, you can reference SQS queues without having to hardcode
+the ARNs as input.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_sqs_queue import DataAwsSqsQueue
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsSqsQueue(self, "example",
+            name="queue"
+        )
+```
+
+## Argument Reference
+
+* `name` - (Required) Name of the queue to match.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the queue.
+* `url` - URL of the queue.
+* `tags` - Map of tags for the resource.
+
+<!-- cache-key: cdktf-0.18.0 input-bc2387998bbb916bdcaa1a3f2f812935f5cc67ab5bb81f0bdfe43f5e898107d4 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/sqs_queues.html.markdown b/website/docs/cdktf/python/d/sqs_queues.html.markdown
new file mode 100644
index 00000000000..811fd381f4e
--- /dev/null
+++ b/website/docs/cdktf/python/d/sqs_queues.html.markdown
@@ -0,0 +1,48 @@
+---
+subcategory: "SQS (Simple Queue)"
+layout: "aws"
+page_title: "AWS: aws_sqs_queues"
+description: |-
+  Terraform data source for managing an AWS SQS (Simple Queue) Queues.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_sqs_queues
+
+Terraform data source for managing an AWS SQS (Simple Queue) Queues.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_sqs_queues import DataAwsSqsQueues
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsSqsQueues(self, "example",
+            queue_name_prefix="example"
+        )
+```
+
+## Argument Reference
+
+The following arguments are optional:
+
+* `queue_name_prefix` - (Optional) A string to use for filtering the list results. Only those queues whose name begins with the specified string are returned. Queue URLs and names are case-sensitive.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `queue_urls` - A list of queue URLs.
+
+<!-- cache-key: cdktf-0.18.0 input-1e5fe100d7582003d54198ed26f28cc150e201a30f6ce59c4e3b9c34624d3a76 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/ssm_document.html.markdown b/website/docs/cdktf/python/d/ssm_document.html.markdown
new file mode 100644
index 00000000000..71fe01b981d
--- /dev/null
+++ b/website/docs/cdktf/python/d/ssm_document.html.markdown
@@ -0,0 +1,76 @@
+---
+subcategory: "SSM (Systems Manager)"
+layout: "aws"
+page_title: "AWS: aws_ssm_document"
+description: |-
+  Provides a SSM Document data source
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_ssm_document
+
+Gets the contents of the specified Systems Manager document.
+
+## Example Usage
+
+To get the contents of the document owned by AWS.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformOutput, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_ssm_document import DataAwsSsmDocument
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        foo = DataAwsSsmDocument(self, "foo",
+            document_format="YAML",
+            name="AWS-GatherSoftwareInventory"
+        )
+        TerraformOutput(self, "content",
+            value=foo.content
+        )
+```
+
+To get the contents of the custom document.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_ssm_document import DataAwsSsmDocument
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsSsmDocument(self, "test",
+            document_format="JSON",
+            name=Token.as_string(aws_ssm_document_test.name)
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name of the Systems Manager document.
+* `document_format` - (Optional) Returns the document in the specified format. The document format can be either `JSON`, `YAML` and `TEXT`. JSON is the default format.
+* `document_version` - (Optional) Document version for which you want information.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the document. If the document is an AWS managed document, this value will be set to the name of the document instead.
+* `content` - Contents of the document.
+* `document_type` - Type of the document.
+
+<!-- cache-key: cdktf-0.18.0 input-9343adb58c9912030cbf5122132a6b4bd27fc637380c9a974b20e323246d88d8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/ssm_instances.html.markdown b/website/docs/cdktf/python/d/ssm_instances.html.markdown
new file mode 100644
index 00000000000..6a0a8b108d2
--- /dev/null
+++ b/website/docs/cdktf/python/d/ssm_instances.html.markdown
@@ -0,0 +1,55 @@
+---
+subcategory: "SSM (Systems Manager)"
+layout: "aws"
+page_title: "AWS: aws_ssm_instances"
+description: |-
+  Get information on SSM managed instances.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_ssm_instances
+
+Use this data source to get the instance IDs of SSM managed instances.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_ssm_instances import DataAwsSsmInstances
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsSsmInstances(self, "example",
+            filter=[DataAwsSsmInstancesFilter(
+                name="PlatformTypes",
+                values=["Linux"]
+            )
+            ]
+        )
+```
+
+## Argument Reference
+
+* `filter` - (Optional) Configuration block(s) for filtering. Detailed below.
+
+### filter Configuration Block
+
+The `filter` configuration block supports the following arguments:
+
+* `name` - (Required) Name of the filter field. Valid values can be found in the [SSM InstanceInformationStringFilter API Reference](https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_InstanceInformationStringFilter.html).
+* `values` - (Required) Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `ids` - Set of instance IDs of the matched SSM managed instances.
+
+<!-- cache-key: cdktf-0.18.0 input-e0bf0a9c24b0fa03c969992656b33d964fe9479c4bd864151f5158999bb3211a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/ssm_maintenance_windows.html.markdown b/website/docs/cdktf/python/d/ssm_maintenance_windows.html.markdown
new file mode 100644
index 00000000000..2d0965a2cb1
--- /dev/null
+++ b/website/docs/cdktf/python/d/ssm_maintenance_windows.html.markdown
@@ -0,0 +1,55 @@
+---
+subcategory: "SSM (Systems Manager)"
+layout: "aws"
+page_title: "AWS: aws_ssm_maintenance_windows"
+description: |-
+  Get information on SSM maintenance windows.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: ssm_maintenance_windows
+
+Use this data source to get the window IDs of SSM maintenance windows.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_ssm_maintenance_windows import DataAwsSsmMaintenanceWindows
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsSsmMaintenanceWindows(self, "example",
+            filter=[DataAwsSsmMaintenanceWindowsFilter(
+                name="Enabled",
+                values=["true"]
+            )
+            ]
+        )
+```
+
+## Argument Reference
+
+* `filter` - (Optional) Configuration block(s) for filtering. Detailed below.
+
+### filter Configuration Block
+
+The `filter` configuration block supports the following arguments:
+
+* `name` - (Required) Name of the filter field. Valid values can be found in the [SSM DescribeMaintenanceWindows API Reference](https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DescribeMaintenanceWindows.html#API_DescribeMaintenanceWindows_RequestSyntax).
+* `values` - (Required) Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `ids` - List of window IDs of the matched SSM maintenance windows.
+
+<!-- cache-key: cdktf-0.18.0 input-c5aedc6143d69465ce8bb1a3ffb4fcbaed9f5bbe552310caa38814607706ddc7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/ssm_parameter.html.markdown b/website/docs/cdktf/python/d/ssm_parameter.html.markdown
new file mode 100644
index 00000000000..42d07aa0887
--- /dev/null
+++ b/website/docs/cdktf/python/d/ssm_parameter.html.markdown
@@ -0,0 +1,55 @@
+---
+subcategory: "SSM (Systems Manager)"
+layout: "aws"
+page_title: "AWS: aws_ssm_parameter"
+description: |-
+  Provides a SSM Parameter Data Source
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_ssm_parameter
+
+Provides an SSM Parameter data source.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_ssm_parameter import DataAwsSsmParameter
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsSsmParameter(self, "foo",
+            name="foo"
+        )
+```
+
+~> **Note:** The unencrypted value of a SecureString will be stored in the raw state as plain-text.
+[Read more about sensitive data in state](https://www.terraform.io/docs/state/sensitive-data.html).
+
+~> **Note:** The data source is currently following the behavior of the [SSM API](https://docs.aws.amazon.com/sdk-for-go/api/service/ssm/#Parameter) to return a string value, regardless of parameter type. For type `StringList`, we can use the built-in [split()](https://www.terraform.io/docs/configuration/functions/split.html) function to get values in a list. Example: `split(",", data.aws_ssm_parameter.subnets.value)`
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name of the parameter.
+* `with_decryption` - (Optional) Whether to return decrypted `SecureString` value. Defaults to `true`.
+
+In addition to all arguments above, the following attributes are exported:
+
+* `arn` - ARN of the parameter.
+* `name` - Name of the parameter.
+* `type` - Type of the parameter. Valid types are `String`, `StringList` and `SecureString`.
+* `value` - Value of the parameter. This value is always marked as sensitive in the Terraform plan output, regardless of `type`. In Terraform CLI version 0.15 and later, this may require additional configuration handling for certain scenarios. For more information, see the [Terraform v0.15 Upgrade Guide](https://www.terraform.io/upgrade-guides/0-15.html#sensitive-output-values).
+* `insecure_value` - Value of the parameter. **Use caution:** This value is never marked as sensitive.
+* `version` - Version of the parameter.
+
+<!-- cache-key: cdktf-0.18.0 input-89a145f5b43a3c824da664ca5cd8985b70d4cc516d350f4aa2411cd727cc5e4b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/ssm_parameters_by_path.html.markdown b/website/docs/cdktf/python/d/ssm_parameters_by_path.html.markdown
new file mode 100644
index 00000000000..1f85f444ca2
--- /dev/null
+++ b/website/docs/cdktf/python/d/ssm_parameters_by_path.html.markdown
@@ -0,0 +1,54 @@
+---
+subcategory: "SSM (Systems Manager)"
+layout: "aws"
+page_title: "AWS: aws_ssm_parameters_by_path"
+description: |-
+  Provides SSM Parameters by path
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_ssm_parameters_by_path
+
+Provides SSM Parameters by path.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_ssm_parameters_by_path import DataAwsSsmParametersByPath
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsSsmParametersByPath(self, "foo",
+            path="/foo"
+        )
+```
+
+~> **Note:** The unencrypted value of a SecureString will be stored in the raw state as plain-text.
+[Read more about sensitive data in state](/docs/state/sensitive-data.html).
+
+~> **Note:** The data source is currently following the behavior of the [SSM API](https://docs.aws.amazon.com/sdk-for-go/api/service/ssm/#Parameter) to return a string value, regardless of parameter type. For type `StringList`, we can use the built-in [split()](https://www.terraform.io/docs/configuration/functions/split.html) function to get values in a list. Example: `split(",", data.aws_ssm_parameter.subnets.value)`
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `path` - (Required) Prefix path of the parameter.
+* `with_decryption` - (Optional) Whether to return decrypted `SecureString` value. Defaults to `true`.
+* `recursive` - (Optional) Whether to recursively return parameters under `path`. Defaults to `false`.
+
+In addition to all arguments above, the following attributes are exported:
+
+* `arns` - ARNs of the parameters.
+* `names` - Names of the parameters.
+* `types` - Types of the parameters.
+* `values` - Value of the parameters.
+
+<!-- cache-key: cdktf-0.18.0 input-7b348a27d41a11a492f12ba3c140b7e05046525d9219a6497f555c54a31584cc -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/ssm_patch_baseline.html.markdown b/website/docs/cdktf/python/d/ssm_patch_baseline.html.markdown
new file mode 100644
index 00000000000..a180ac99e1c
--- /dev/null
+++ b/website/docs/cdktf/python/d/ssm_patch_baseline.html.markdown
@@ -0,0 +1,97 @@
+---
+subcategory: "SSM (Systems Manager)"
+layout: "aws"
+page_title: "AWS: aws_ssm_patch_baseline"
+description: |-
+  Provides an SSM Patch Baseline data source
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_ssm_patch_baseline
+
+Provides an SSM Patch Baseline data source. Useful if you wish to reuse the default baselines provided.
+
+## Example Usage
+
+To retrieve a baseline provided by AWS:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_ssm_patch_baseline import DataAwsSsmPatchBaseline
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsSsmPatchBaseline(self, "centos",
+            name_prefix="AWS-",
+            operating_system="CENTOS",
+            owner="AWS"
+        )
+```
+
+To retrieve a baseline on your account:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_ssm_patch_baseline import DataAwsSsmPatchBaseline
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsSsmPatchBaseline(self, "default_custom",
+            default_baseline=True,
+            name_prefix="MyCustomBaseline",
+            operating_system="WINDOWS",
+            owner="Self"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `owner` - (Required) Owner of the baseline. Valid values: `All`, `AWS`, `Self` (the current account).
+* `name_prefix` - (Optional) Filter results by the baseline name prefix.
+* `default_baseline` - (Optional) Filters the results against the baselines default_baseline field.
+* `operating_system` - (Optional) Specified OS for the baseline. Valid values: `AMAZON_LINUX`, `AMAZON_LINUX_2`, `UBUNTU`, `REDHAT_ENTERPRISE_LINUX`, `SUSE`, `CENTOS`, `ORACLE_LINUX`, `DEBIAN`, `MACOS`, `RASPBIAN` and `ROCKY_LINUX`.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `approved_patches` - List of explicitly approved patches for the baseline.
+* `approved_patches_compliance_level` - The compliance level for approved patches.
+* `approved_patches_enable_non_security` - Indicates whether the list of approved patches includes non-security updates that should be applied to the instances.
+* `approval_rule` - List of rules used to include patches in the baseline.
+    * `approve_after_days` - The number of days after the release date of each patch matched by the rule the patch is marked as approved in the patch baseline.
+    * `approve_until_date` - The cutoff date for auto approval of released patches. Any patches released on or before this date are installed automatically. Date is formatted as `YYYY-MM-DD`. Conflicts with `approve_after_days`
+    * `compliance_level` - The compliance level for patches approved by this rule.
+    * `enable_non_security` - Boolean enabling the application of non-security updates.
+    * `patch_filter` - The patch filter group that defines the criteria for the rule.
+        * `key` - The key for the filter.
+        * `values` - The value for the filter.
+* `global_filter` - Set of global filters used to exclude patches from the baseline.
+    * `key` - The key for the filter.
+    * `values` - The value for the filter.
+* `id` - ID of the baseline.
+* `name` - Name of the baseline.
+* `description` - Description of the baseline.
+* `rejected_patches` - List of rejected patches.
+* `rejected_patches_action` - The action specified to take on patches included in the `rejected_patches` list.
+* `source` - Information about the patches to use to update the managed nodes, including target operating systems and source repositories.
+    * `configuration` - The value of the yum repo configuration.
+    * `name` - The name specified to identify the patch source.
+    * `products` - The specific operating system versions a patch repository applies to.
+
+<!-- cache-key: cdktf-0.18.0 input-1c115d0fa5611577b6c8646f608f018267b9450033415bb6dcacd2efe1e7a958 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/ssmcontacts_contact.html.markdown b/website/docs/cdktf/python/d/ssmcontacts_contact.html.markdown
new file mode 100644
index 00000000000..31058ab0609
--- /dev/null
+++ b/website/docs/cdktf/python/d/ssmcontacts_contact.html.markdown
@@ -0,0 +1,51 @@
+---
+subcategory: "SSM Contacts"
+layout: "aws"
+page_title: "AWS: aws_ssmcontacts_contact"
+description: |-
+  Terraform data source for managing an AWS SSM Contact.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_ssmcontacts_contact
+
+Terraform data source for managing an AWS SSM Contact.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_ssmcontacts_contact import DataAwsSsmcontactsContact
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsSsmcontactsContact(self, "example",
+            arn="arn:aws:ssm-contacts:us-west-2:123456789012:contact/contactalias"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `arn` - (Required) The Amazon Resource Name (ARN) of the contact or escalation plan.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `alias` - A unique and identifiable alias of the contact or escalation plan.
+* `type` - The type of contact engaged. A single contact is type `PERSONAL` and an escalation plan is type `ESCALATION`.
+* `display_name` - Full friendly name of the contact or escalation plan.
+* `tags` - Map of tags to assign to the resource.
+
+<!-- cache-key: cdktf-0.18.0 input-028dcbba9b9d4f6b9868cfdfa5621e49e88520c35fc79346bd35242d298b06bc -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/ssmcontacts_contact_channel.html.markdown b/website/docs/cdktf/python/d/ssmcontacts_contact_channel.html.markdown
new file mode 100644
index 00000000000..8fd8c59df47
--- /dev/null
+++ b/website/docs/cdktf/python/d/ssmcontacts_contact_channel.html.markdown
@@ -0,0 +1,56 @@
+---
+subcategory: "SSM Contacts"
+layout: "aws"
+page_title: "AWS: aws_ssmcontacts_contact_channel"
+description: |-
+  Terraform data source for managing an AWS SSM Contacts Contact Channel.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_ssmcontacts_contact_channel
+
+Terraform data source for managing an AWS SSM Contacts Contact Channel.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_ssmcontacts_contact_channel import DataAwsSsmcontactsContactChannel
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsSsmcontactsContactChannel(self, "example",
+            arn="arn:aws:ssm-contacts:us-west-2:123456789012:contact-channel/example"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+- `arn` - Amazon Resource Name (ARN) of the contact channel.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+- `activation_status` - Whether the contact channel is activated.
+
+- `contact_id` - Amazon Resource Name (ARN) of the AWS SSM Contact that the contact channel belongs to.
+
+- `delivery_address` - Details used to engage the contact channel.
+
+- `name` - Name of the contact channel.
+
+- `type` - Type of the contact channel.
+
+<!-- cache-key: cdktf-0.18.0 input-9f531cedbf6139b19742dde2e104f65f9b8b5e9b437541c3b2cb7082c8b98b4f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/ssmcontacts_plan.html.markdown b/website/docs/cdktf/python/d/ssmcontacts_plan.html.markdown
new file mode 100644
index 00000000000..411e485e779
--- /dev/null
+++ b/website/docs/cdktf/python/d/ssmcontacts_plan.html.markdown
@@ -0,0 +1,48 @@
+---
+subcategory: "SSM Contacts"
+layout: "aws"
+page_title: "AWS: aws_ssmcontacts_plan"
+description: |-
+  Terraform data source for managing an AWS SSM Contact Plan.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_ssmcontacts_plan
+
+Terraform data source for managing a Plan of an AWS SSM Contact.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_ssmcontacts_plan import DataAwsSsmcontactsPlan
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsSsmcontactsPlan(self, "test",
+            contact_id="arn:aws:ssm-contacts:us-west-2:123456789012:contact/contactalias"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `contact_id` - (Required) The Amazon Resource Name (ARN) of the contact or escalation plan.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `stage` - List of stages. A contact has an engagement plan with stages that contact specified contact channels. An escalation plan uses stages that contact specified contacts.
+
+<!-- cache-key: cdktf-0.18.0 input-92a72d4072ec7f614f162d990ca656e1ab1bfa4324ea98598545cebc4173cb62 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/ssmincidents_replication_set.html.markdown b/website/docs/cdktf/python/d/ssmincidents_replication_set.html.markdown
new file mode 100644
index 00000000000..eaf90a963fe
--- /dev/null
+++ b/website/docs/cdktf/python/d/ssmincidents_replication_set.html.markdown
@@ -0,0 +1,61 @@
+---
+subcategory: "SSM Incident Manager Incidents"
+layout: "aws"
+page_title: "AWS: aws_ssmincidents_replication_set"
+description: |-
+  Terraform data source for managing an incident replication set in AWS Systems Manager Incident Manager.
+---
+
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_ssmincidents_replication_set
+
+~> **NOTE:** The AWS Region specified by a Terraform provider must always be one of the Regions specified for the replication set.
+
+Use this Terraform data source to manage a replication set in AWS Systems Manager Incident Manager.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_ssmincidents_replication_set import DataAwsSsmincidentsReplicationSet
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsSsmincidentsReplicationSet(self, "example")
+```
+
+## Argument Reference
+
+No arguments are required.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resouce Name (ARN) of the replication set.
+* `tags` - All tags applied to the replication set.
+* `created_by` - The ARN of the user who created the replication set.
+* `deletion_protected` - If `true`, the last remaining Region in a replication set can’t be deleted.
+* `last_modified_by` - The ARN of the user who last modified the replication set.
+* `status` - The overall status of a replication set.
+    * Valid Values: `ACTIVE` | `CREATING` | `UPDATING` | `DELETING` | `FAILED`
+
+The `region` configuration block exports the following attributes for each Region:
+
+* `name` - The name of the Region.
+* `kms_key_arn` - The ARN of the AWS Key Management Service (AWS KMS) encryption key.
+* `status` - The current status of the Region.
+    * Valid Values: `ACTIVE` | `CREATING` | `UPDATING` | `DELETING` | `FAILED`
+* `status_message` - More information about the status of a Region.
+
+<!-- cache-key: cdktf-0.18.0 input-39319f4ba29ed3dd3b2f5e50f169ffe1879a34918a97973bcb5a09f09dcd8369 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/ssmincidents_response_plan.html.markdown b/website/docs/cdktf/python/d/ssmincidents_response_plan.html.markdown
new file mode 100644
index 00000000000..9bfee72d377
--- /dev/null
+++ b/website/docs/cdktf/python/d/ssmincidents_response_plan.html.markdown
@@ -0,0 +1,90 @@
+---
+subcategory: "SSM Incident Manager Incidents"
+layout: "aws"
+page_title: "AWS: aws_ssmincidents_response_plan"
+description: |-
+  Terraform data source for managing a response plan in AWS Systems Manager Incident Manager.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_ssmincidents_response_plan
+
+Use this Terraform data source to manage a response plan in AWS Systems Manager Incident Manager.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ssmincidents_response_plan import SsmincidentsResponsePlan
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, incidentTemplate, name):
+        super().__init__(scope, name)
+        SsmincidentsResponsePlan(self, "example",
+            arn="exampleARN",
+            incident_template=incident_template,
+            name=name
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `arn` - (Required) The Amazon Resource Name (ARN) of the response plan.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `name` - The name of the response plan.
+* `tags` - The tags applied to the response plan.
+* `display_name` - The long format of the response plan name. This field can contain spaces.
+* `chat_channel` - The Chatbot chat channel used for collaboration during an incident.
+* `engagements` - The Amazon Resource Name (ARN) for the contacts and escalation plans that the response plan engages during an incident.
+
+The `incident_template` configuration block exports the following attributes:
+
+* `title` - The title of a generated incident.
+* `impact` - The impact value of a generated incident. The following values are supported:
+    * `1` - Severe Impact
+    * `2` - High Impact
+    * `3` - Medium Impact
+    * `4` - Low Impact
+    * `5` - No Impact
+* `dedupe_string` - A string used to stop Incident Manager from creating multiple incident records for the same incident.
+* `incident_tags` - The tags assigned to an incident template. When an incident starts, Incident Manager assigns the tags specified in the template to the incident.
+* `summary` - The summary of an incident.
+* `notification_target` - The Amazon Simple Notification Service (Amazon SNS) targets that this incident notifies when it is updated. The `notification_target` configuration block supports the following argument:
+    * `sns_topic_arn` - The ARN of the Amazon SNS topic.
+
+The `action` configuration block exports the following attributes:
+
+* `action` - (Optional) The actions that the response plan starts at the beginning of an incident.
+    * `ssm_automation` - The Systems Manager automation document to start as the runbook at the beginning of the incident. The following values are supported:
+        * `document_name` - The automation document's name.
+        * `role_arn` - The Amazon Resource Name (ARN) of the role that the automation document assumes when it runs commands.
+        * `document_version` - The version of the automation document to use at runtime.
+        * `target_account` - The account that runs the automation document. This can be in either the management account or an application account.
+        * `parameter` - The key-value pair parameters used when the automation document runs. The following values are supported:
+            * `name` - The name of parameter.
+            * `values` - The values for the associated parameter name.
+        * `dynamic_parameters` - The key-value pair used to resolve dynamic parameter values when processing a Systems Manager Automation runbook.
+
+The `integration` configuration block exports the following attributes:
+
+* `integration` - Information about third-party services integrated into the response plan. The following values are supported:
+    * `pagerduty` - Details about the PagerDuty configuration for a response plan. The following values are supported:
+        * `name` - The name of the PagerDuty configuration.
+        * `service_id` - The ID of the PagerDuty service that the response plan associates with an incident when it launches.
+        * `secret_id` - The ID of the AWS Secrets Manager secret that stores your PagerDuty key &mdash; either a General Access REST API Key or User Token REST API Key &mdash; and other user credentials.
+
+<!-- cache-key: cdktf-0.18.0 input-53143826544758b79c896d3903f1f26c1fb9c78df0ebb1d8a86f77ef47ffac71 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/ssoadmin_instances.html.markdown b/website/docs/cdktf/python/d/ssoadmin_instances.html.markdown
new file mode 100644
index 00000000000..17687eba75f
--- /dev/null
+++ b/website/docs/cdktf/python/d/ssoadmin_instances.html.markdown
@@ -0,0 +1,50 @@
+---
+subcategory: "SSO Admin"
+layout: "aws"
+page_title: "AWS: aws_ssoadmin_instances"
+description: |-
+  Get information on SSO Instances.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_ssoadmin_instances
+
+Use this data source to get ARNs and Identity Store IDs of Single Sign-On (SSO) Instances.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformOutput, Fn, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_ssoadmin_instances import DataAwsSsoadminInstances
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = DataAwsSsoadminInstances(self, "example")
+        TerraformOutput(self, "arn",
+            value=Fn.lookup_nested(Fn.tolist(example.arns), ["0"])
+        )
+        TerraformOutput(self, "identity_store_id",
+            value=Fn.lookup_nested(Fn.tolist(example.identity_store_ids), ["0"])
+        )
+```
+
+## Argument Reference
+
+There are no arguments available for this data source.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arns` - Set of Amazon Resource Names (ARNs) of the SSO Instances.
+* `id` - AWS Region.
+* `identity_store_ids` - Set of identifiers of the identity stores connected to the SSO Instances.
+
+<!-- cache-key: cdktf-0.18.0 input-f56f54131de38dcbeec3f2e88e1cd501245218eff2e9ca53862dc82398c4d12b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/ssoadmin_permission_set.html.markdown b/website/docs/cdktf/python/d/ssoadmin_permission_set.html.markdown
new file mode 100644
index 00000000000..aeaa1704d11
--- /dev/null
+++ b/website/docs/cdktf/python/d/ssoadmin_permission_set.html.markdown
@@ -0,0 +1,64 @@
+---
+subcategory: "SSO Admin"
+layout: "aws"
+page_title: "AWS: aws_ssoadmin_permission_set"
+description: |-
+  Get information on a Single Sign-On (SSO) Permission Set.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_ssoadmin_permission_set
+
+Use this data source to get a Single Sign-On (SSO) Permission Set.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformOutput, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_ssoadmin_instances import DataAwsSsoadminInstances
+from imports.aws.data_aws_ssoadmin_permission_set import DataAwsSsoadminPermissionSet
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = DataAwsSsoadminInstances(self, "example")
+        data_aws_ssoadmin_permission_set_example =
+        DataAwsSsoadminPermissionSet(self, "example_1",
+            instance_arn=Token.as_string(
+                Fn.lookup_nested(Fn.tolist(example.arns), ["0"])),
+            name="Example"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_ssoadmin_permission_set_example.override_logical_id("example")
+        TerraformOutput(self, "arn",
+            value=data_aws_ssoadmin_permission_set_example.arn
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+~> **NOTE:** Either `arn` or `name` must be configured.
+
+* `arn` - (Optional) ARN of the permission set.
+* `instance_arn` - (Required) ARN of the SSO Instance associated with the permission set.
+* `name` - (Optional) Name of the SSO Permission Set.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - ARN of the Permission Set.
+* `description` - Description of the Permission Set.
+* `relay_state` - Relay state URL used to redirect users within the application during the federation authentication process.
+* `session_duration` - Length of time that the application user sessions are valid in the ISO-8601 standard.
+* `tags` - Key-value map of resource tags.
+
+<!-- cache-key: cdktf-0.18.0 input-72117fb8aa2c4b577764d0abcde2981eecfaa21858cd3f396c6b7b422f3c859d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/storagegateway_local_disk.html.markdown b/website/docs/cdktf/python/d/storagegateway_local_disk.html.markdown
new file mode 100644
index 00000000000..10ebb76c16d
--- /dev/null
+++ b/website/docs/cdktf/python/d/storagegateway_local_disk.html.markdown
@@ -0,0 +1,48 @@
+---
+subcategory: "Storage Gateway"
+layout: "aws"
+page_title: "AWS: aws_storagegateway_local_disk"
+description: |-
+  Retrieve information about a Storage Gateway local disk
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_storagegateway_local_disk
+
+Retrieve information about a Storage Gateway local disk. The disk identifier is useful for adding the disk as a cache or upload buffer to a gateway.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_storagegateway_local_disk import DataAwsStoragegatewayLocalDisk
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsStoragegatewayLocalDisk(self, "test",
+            disk_path=Token.as_string(aws_volume_attachment_test.device_name),
+            gateway_arn=Token.as_string(aws_storagegateway_gateway_test.arn)
+        )
+```
+
+## Argument Reference
+
+* `gateway_arn` - (Required) ARN of the gateway.
+* `disk_node` - (Optional) Device node of the local disk to retrieve. For example, `/dev/sdb`.
+* `disk_path` - (Optional) Device path of the local disk to retrieve. For example, `/dev/xvdb` or `/dev/nvme1n1`.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `disk_id` - Disk identifierE.g., `pci-0000:03:00.0-scsi-0:0:0:0`
+* `id` - Disk identifierE.g., `pci-0000:03:00.0-scsi-0:0:0:0`
+
+<!-- cache-key: cdktf-0.18.0 input-64c44f7144dae6178c64ac35e8513dac768f1816678a338129b7de095d6a0d5c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/subnet.html.markdown b/website/docs/cdktf/python/d/subnet.html.markdown
new file mode 100644
index 00000000000..2d17d646917
--- /dev/null
+++ b/website/docs/cdktf/python/d/subnet.html.markdown
@@ -0,0 +1,129 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_subnet"
+description: |-
+    Provides details about a specific VPC subnet
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_subnet
+
+`aws_subnet` provides details about a specific VPC subnet.
+
+This resource can prove useful when a module accepts a subnet ID as an input variable and needs to, for example, determine the ID of the VPC that the subnet belongs to.
+
+## Example Usage
+
+The following example shows how one might accept a subnet ID as a variable and use this data source to obtain the data necessary to create a security group that allows connections from hosts in that subnet.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformVariable, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_subnet import DataAwsSubnet
+from imports.aws.security_group import SecurityGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        # Terraform Variables are not always the best fit for getting inputs in the context of Terraform CDK.
+        #     You can read more about this at https://cdk.tf/variables
+        subnet_id = TerraformVariable(self, "subnet_id")
+        selected = DataAwsSubnet(self, "selected",
+            id=subnet_id.string_value
+        )
+        SecurityGroup(self, "subnet",
+            ingress=[SecurityGroupIngress(
+                cidr_blocks=[Token.as_string(selected.cidr_block)],
+                from_port=80,
+                protocol="tcp",
+                to_port=80
+            )
+            ],
+            vpc_id=Token.as_string(selected.vpc_id)
+        )
+```
+
+### Filter Example
+
+If you want to match against tag `Name`, use:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_subnet import DataAwsSubnet
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsSubnet(self, "selected",
+            filter=[DataAwsSubnetFilter(
+                name="tag:Name",
+                values=["yakdriver"]
+            )
+            ]
+        )
+```
+
+## Argument Reference
+
+The arguments of this data source act as filters for querying the available subnets in the current region. The given filters must match exactly one subnet whose data will be exported as attributes.
+
+The following arguments are optional:
+
+* `availability_zone` - (Optional) Availability zone where the subnet must reside.
+* `availability_zone_id` - (Optional) ID of the Availability Zone for the subnet. This argument is not supported in all regions or partitions. If necessary, use `availability_zone` instead.
+* `cidr_block` - (Optional) CIDR block of the desired subnet.
+* `default_for_az` - (Optional) Whether the desired subnet must be the default subnet for its associated availability zone.
+* `filter` - (Optional) Configuration block. Detailed below.
+* `id` - (Optional) ID of the specific subnet to retrieve.
+* `ipv6_cidr_block` - (Optional) IPv6 CIDR block of the desired subnet.
+* `state` - (Optional) State that the desired subnet must have.
+* `tags` - (Optional) Map of tags, each pair of which must exactly match a pair on the desired subnet.
+* `vpc_id` - (Optional) ID of the VPC that the desired subnet belongs to.
+
+### filter
+
+This block allows for complex filters. You can use one or more `filter` blocks.
+
+The following arguments are required:
+
+* `name` - (Required) Name of the field to filter by, as defined by [the underlying AWS API](http://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeSubnets.html).
+* `values` - (Required) Set of values that are accepted for the given field. A subnet will be selected if any one of the given values matches.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the subnet.
+* `assign_ipv6_address_on_creation` - Whether an IPv6 address is assigned on creation.
+* `available_ip_address_count` - Available IP addresses of the subnet.
+* `customer_owned_ipv4_pool` - Identifier of customer owned IPv4 address pool.
+* `enable_dns64` - Whether DNS queries made to the Amazon-provided DNS Resolver in this subnet return synthetic IPv6 addresses for IPv4-only destinations.
+* `enable_lni_at_device_index` - Indicates the device position for local network interfaces in this subnet. For example, 1 indicates local network interfaces in this subnet are the secondary network interface (eth1). A local network interface cannot be the primary network interface (eth0).
+* `enable_resource_name_dns_aaaa_record_on_launch` - Indicates whether to respond to DNS queries for instance hostnames with DNS AAAA records.
+* `enable_resource_name_dns_a_record_on_launch` - Indicates whether to respond to DNS queries for instance hostnames with DNS A records.
+* `ipv6_cidr_block_association_id` - Association ID of the IPv6 CIDR block.
+* `ipv6_native` - Whether this is an IPv6-only subnet.
+* `map_customer_owned_ip_on_launch` - Whether customer owned IP addresses are assigned on network interface creation.
+* `map_public_ip_on_launch` - Whether public IP addresses are assigned on instance launch.
+* `outpost_arn` - ARN of the Outpost.
+* `owner_id` - ID of the AWS account that owns the subnet.
+* `private_dns_hostname_type_on_launch` - The type of hostnames assigned to instances in the subnet at launch.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `20m`)
+
+<!-- cache-key: cdktf-0.18.0 input-4038416b655586cab52609dedf5c41d129209560a5619712772e26a29f2bcdfb -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/subnets.html.markdown b/website/docs/cdktf/python/d/subnets.html.markdown
new file mode 100644
index 00000000000..6106bda2212
--- /dev/null
+++ b/website/docs/cdktf/python/d/subnets.html.markdown
@@ -0,0 +1,146 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_subnets"
+description: |-
+    Get information about a set of subnets.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_subnets
+
+This resource can be useful for getting back a set of subnet IDs.
+
+## Example Usage
+
+The following shows outputting all CIDR blocks for every subnet ID in a VPC.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformIterator, TerraformOutput, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_subnet import DataAwsSubnet
+from imports.aws.data_aws_subnets import DataAwsSubnets
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = DataAwsSubnets(self, "example",
+            filter=[DataAwsSubnetsFilter(
+                name="vpc-id",
+                values=[vpc_id.string_value]
+            )
+            ]
+        )
+        # In most cases loops should be handled in the programming language context and
+        #     not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+        #     you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+        #     you need to keep this like it is.
+        example_for_each_iterator = TerraformIterator.from_list(
+            Token.as_any(Fn.toset(example.ids)))
+        data_aws_subnet_example = DataAwsSubnet(self, "example_1",
+            id=Token.as_string(example_for_each_iterator.value),
+            for_each=example_for_each_iterator
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_subnet_example.override_logical_id("example")
+        TerraformOutput(self, "subnet_cidr_blocks",
+            value="${[ for s in ${" + data_aws_subnet_example.fqn + "} : s.cidr_block]}"
+        )
+```
+
+The following example retrieves a set of all subnets in a VPC with a custom
+tag of `Tier` set to a value of "Private" so that the `aws_instance` resource
+can loop through the subnets, putting instances across availability zones.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformIterator, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_subnets import DataAwsSubnets
+from imports.aws.instance import Instance
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        private = DataAwsSubnets(self, "private",
+            filter=[DataAwsSubnetsFilter(
+                name="vpc-id",
+                values=[vpc_id.string_value]
+            )
+            ],
+            tags={
+                "Tier": "Private"
+            }
+        )
+        # In most cases loops should be handled in the programming language context and
+        #     not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+        #     you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+        #     you need to keep this like it is.
+        app_for_each_iterator = TerraformIterator.from_list(
+            Token.as_any(Fn.toset(private.ids)))
+        Instance(self, "app",
+            ami=ami.string_value,
+            instance_type="t2.micro",
+            subnet_id=Token.as_string(app_for_each_iterator.value),
+            for_each=app_for_each_iterator
+        )
+```
+
+## Argument Reference
+
+* `filter` - (Optional) Custom filter block as described below.
+* `tags` - (Optional) Map of tags, each pair of which must exactly match
+  a pair on the desired subnets.
+
+More complex filters can be expressed using one or more `filter` sub-blocks,
+which take the following arguments:
+
+* `name` - (Required) Name of the field to filter by, as defined by
+  [the underlying AWS API](http://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeSubnets.html).
+  For example, if matching against tag `Name`, use:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_subnets import DataAwsSubnets
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsSubnets(self, "selected",
+            filter=[DataAwsSubnetsFilter(
+                name="tag:Name",
+                values=[""]
+            )
+            ]
+        )
+```
+
+* `values` - (Required) Set of values that are accepted for the given field.
+  Subnet IDs will be selected if any one of the given values match.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `ids` - List of all the subnet ids found.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `20m`)
+
+<!-- cache-key: cdktf-0.18.0 input-fe8a040cf37c7960c6358cab9956de0b13b8749d8ba19ed8500e227449c1329e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/transfer_server.html.markdown b/website/docs/cdktf/python/d/transfer_server.html.markdown
new file mode 100644
index 00000000000..0f061c50ba8
--- /dev/null
+++ b/website/docs/cdktf/python/d/transfer_server.html.markdown
@@ -0,0 +1,56 @@
+---
+subcategory: "Transfer Family"
+layout: "aws"
+page_title: "AWS: aws_transfer_server"
+description: |-
+  Get information on an AWS Transfer Server resource
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_transfer_server
+
+Use this data source to get the ARN of an AWS Transfer Server for use in other
+resources.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_transfer_server import DataAwsTransferServer
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsTransferServer(self, "example",
+            server_id="s-1234567"
+        )
+```
+
+## Argument Reference
+
+* `server_id` - (Required) ID for an SFTP server.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of Transfer Server.
+* `certificate` - ARN of any certificate.
+* `domain` -  The domain of the storage system that is used for file transfers.
+* `endpoint` - Endpoint of the Transfer Server (e.g., `s-12345678.server.transfer.REGION.amazonaws.com`).
+* `endpoint_type` - Type of endpoint that the server is connected to.
+* `identity_provider_type` - The mode of authentication enabled for this service. The default value is `SERVICE_MANAGED`, which allows you to store and access SFTP user credentials within the service. `API_GATEWAY` indicates that user authentication requires a call to an API Gateway endpoint URL provided by you to integrate an identity provider of your choice.
+* `invocation_role` - ARN of the IAM role used to authenticate the user account with an `identity_provider_type` of `API_GATEWAY`.
+* `logging_role` - ARN of an IAM role that allows the service to write your SFTP users’ activity to your Amazon CloudWatch logs for monitoring and auditing purposes.
+* `protocols` - File transfer protocol or protocols over which your file transfer protocol client can connect to your server's endpoint.
+* `security_policy_name` - The name of the security policy that is attached to the server.
+* `structured_log_destinations` - A set of ARNs of destinations that will receive structured logs from the transfer server such as CloudWatch Log Group ARNs.
+* `url` - URL of the service endpoint used to authenticate users with an `identity_provider_type` of `API_GATEWAY`.
+
+<!-- cache-key: cdktf-0.18.0 input-527a93818210197a7ed1dcc84d2ff4fa1fd16ef88ced9a8af3676cc1ab7b8447 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/vpc.html.markdown b/website/docs/cdktf/python/d/vpc.html.markdown
new file mode 100644
index 00000000000..5da522c5350
--- /dev/null
+++ b/website/docs/cdktf/python/d/vpc.html.markdown
@@ -0,0 +1,116 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_vpc"
+description: |-
+    Provides details about a specific VPC
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_vpc
+
+`aws_vpc` provides details about a specific VPC.
+
+This resource can prove useful when a module accepts a vpc id as
+an input variable and needs to, for example, determine the CIDR block of that
+VPC.
+
+## Example Usage
+
+The following example shows how one might accept a VPC id as a variable
+and use this data source to obtain the data necessary to create a subnet
+within it.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformVariable, Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_vpc import DataAwsVpc
+from imports.aws.subnet import Subnet
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        # Terraform Variables are not always the best fit for getting inputs in the context of Terraform CDK.
+        #     You can read more about this at https://cdk.tf/variables
+        vpc_id = TerraformVariable(self, "vpc_id")
+        selected = DataAwsVpc(self, "selected",
+            id=vpc_id.string_value
+        )
+        Subnet(self, "example",
+            availability_zone="us-west-2a",
+            cidr_block=Token.as_string(
+                Fn.cidrsubnet(Token.as_string(selected.cidr_block), 4, 1)),
+            vpc_id=Token.as_string(selected.id)
+        )
+```
+
+## Argument Reference
+
+The arguments of this data source act as filters for querying the available
+VPCs in the current region. The given filters must match exactly one
+VPC whose data will be exported as attributes.
+
+* `cidr_block` - (Optional) Cidr block of the desired VPC.
+
+* `dhcp_options_id` - (Optional) DHCP options id of the desired VPC.
+
+* `default` - (Optional) Boolean constraint on whether the desired VPC is
+  the default VPC for the region.
+
+* `filter` - (Optional) Custom filter block as described below.
+
+* `id` - (Optional) ID of the specific VPC to retrieve.
+
+* `state` - (Optional) Current state of the desired VPC.
+  Can be either `"pending"` or `"available"`.
+
+* `tags` - (Optional) Map of tags, each pair of which must exactly match
+  a pair on the desired VPC.
+
+More complex filters can be expressed using one or more `filter` sub-blocks,
+which take the following arguments:
+
+* `name` - (Required) Name of the field to filter by, as defined by
+  [the underlying AWS API](http://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeVpcs.html).
+
+* `values` - (Required) Set of values that are accepted for the given field.
+  A VPC will be selected if any one of the given values matches.
+
+## Attribute Reference
+
+All of the argument attributes except `filter` blocks are also exported as
+result attributes. This data source will complete the data by populating
+any fields that are not included in the configuration with the data for
+the selected VPC.
+
+The following attribute is additionally exported:
+
+* `arn` - ARN of VPC
+* `enable_dns_support` - Whether or not the VPC has DNS support
+* `enable_network_address_usage_metrics` - Whether Network Address Usage metrics are enabled for your VPC
+* `enable_dns_hostnames` - Whether or not the VPC has DNS hostname support
+* `instance_tenancy` - Allowed tenancy of instances launched into the
+  selected VPC. May be any of `"default"`, `"dedicated"`, or `"host"`.
+* `ipv6_association_id` - Association ID for the IPv6 CIDR block.
+* `ipv6_cidr_block` - IPv6 CIDR block.
+* `main_route_table_id` - ID of the main route table associated with this VPC.
+* `owner_id` - ID of the AWS account that owns the VPC.
+
+`cidr_block_associations` is also exported with the following attributes:
+
+* `association_id` - Association ID for the IPv4 CIDR block.
+* `cidr_block` - CIDR block for the association.
+* `state` - State of the association.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `20m`)
+
+<!-- cache-key: cdktf-0.18.0 input-8f39db2d83eed4fb37599ca81ea8bafc32c666cbedeb2b7236ecabe2e981a42e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/vpc_dhcp_options.html.markdown b/website/docs/cdktf/python/d/vpc_dhcp_options.html.markdown
new file mode 100644
index 00000000000..7e11827003c
--- /dev/null
+++ b/website/docs/cdktf/python/d/vpc_dhcp_options.html.markdown
@@ -0,0 +1,95 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_vpc_dhcp_options"
+description: |-
+  Retrieve information about an EC2 DHCP Options configuration
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_vpc_dhcp_options
+
+Retrieve information about an EC2 DHCP Options configuration.
+
+## Example Usage
+
+### Lookup by DHCP Options ID
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_vpc_dhcp_options import DataAwsVpcDhcpOptions
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsVpcDhcpOptions(self, "example",
+            dhcp_options_id="dopts-12345678"
+        )
+```
+
+### Lookup by Filter
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_vpc_dhcp_options import DataAwsVpcDhcpOptions
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsVpcDhcpOptions(self, "example",
+            filter=[DataAwsVpcDhcpOptionsFilter(
+                name="key",
+                values=["domain-name"]
+            ), DataAwsVpcDhcpOptionsFilter(
+                name="value",
+                values=["example.com"]
+            )
+            ]
+        )
+```
+
+## Argument Reference
+
+* `dhcp_options_id` - (Optional) EC2 DHCP Options ID.
+* `filter` - (Optional) List of custom filters as described below.
+
+### filter
+
+For more information about filtering, see the [EC2 API documentation](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeDhcpOptions.html).
+
+* `name` - (Required) Name of the field to filter.
+* `values` - (Required) Set of values for filtering.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the DHCP Options Set.
+* `dhcp_options_id` - EC2 DHCP Options ID
+* `domain_name` - Suffix domain name to used when resolving non Fully Qualified Domain NamesE.g., the `search` value in the `/etc/resolv.conf` file.
+* `domain_name_servers` - List of name servers.
+* `id` - EC2 DHCP Options ID
+* `netbios_name_servers` - List of NETBIOS name servers.
+* `netbios_node_type` - NetBIOS node type (1, 2, 4, or 8). For more information about these node types, see [RFC 2132](http://www.ietf.org/rfc/rfc2132.txt).
+* `ntp_servers` - List of NTP servers.
+* `tags` - Map of tags assigned to the resource.
+* `owner_id` - ID of the AWS account that owns the DHCP options set.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `20m`)
+
+<!-- cache-key: cdktf-0.18.0 input-791925442f0012e5d97b1162afa65bd01197d035ae1eee08f5a4eb0bdfc0c813 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/vpc_endpoint.html.markdown b/website/docs/cdktf/python/d/vpc_endpoint.html.markdown
new file mode 100644
index 00000000000..9fea81f696d
--- /dev/null
+++ b/website/docs/cdktf/python/d/vpc_endpoint.html.markdown
@@ -0,0 +1,101 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_vpc_endpoint"
+description: |-
+    Provides details about a specific VPC endpoint.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_vpc_endpoint
+
+The VPC Endpoint data source provides details about
+a specific VPC endpoint.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_vpc_endpoint import DataAwsVpcEndpoint
+from imports.aws.vpc_endpoint_route_table_association import VpcEndpointRouteTableAssociation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        s3 = DataAwsVpcEndpoint(self, "s3",
+            service_name="com.amazonaws.us-west-2.s3",
+            vpc_id=foo.id
+        )
+        VpcEndpointRouteTableAssociation(self, "private_s3",
+            route_table_id=private.id,
+            vpc_endpoint_id=Token.as_string(s3.id)
+        )
+```
+
+## Argument Reference
+
+The arguments of this data source act as filters for querying the available VPC endpoints.
+The given filters must match exactly one VPC endpoint whose data will be exported as attributes.
+
+* `filter` - (Optional) Custom filter block as described below.
+* `id` - (Optional) ID of the specific VPC Endpoint to retrieve.
+* `service_name` - (Optional) Service name of the specific VPC Endpoint to retrieve. For AWS services the service name is usually in the form `com.amazonaws.<region>.<service>` (the SageMaker Notebook service is an exception to this rule, the service name is in the form `aws.sagemaker.<region>.notebook`).
+* `state` - (Optional) State of the specific VPC Endpoint to retrieve.
+* `tags` - (Optional) Map of tags, each pair of which must exactly match
+  a pair on the specific VPC Endpoint to retrieve.
+* `vpc_id` - (Optional) ID of the VPC in which the specific VPC Endpoint is used.
+
+More complex filters can be expressed using one or more `filter` sub-blocks,
+which take the following arguments:
+
+* `name` - (Required) Name of the field to filter by, as defined by
+  [the underlying AWS API](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeVpcEndpoints.html).
+* `values` - (Required) Set of values that are accepted for the given field.
+  A VPC Endpoint will be selected if any one of the given values matches.
+
+## Attribute Reference
+
+In addition to all arguments above except `filter`, the following attributes are exported:
+
+* `arn` - ARN of the VPC endpoint.
+* `cidr_blocks` - List of CIDR blocks for the exposed AWS service. Applicable for endpoints of type `Gateway`.
+* `dns_entry` - DNS entries for the VPC Endpoint. Applicable for endpoints of type `Interface`. [DNS entry blocks are documented below](#dns_entry-block).
+* `dns_options` - DNS options for the VPC Endpoint. [DNS options blocks are documented below](#dns_options-block).
+* `network_interface_ids` - One or more network interfaces for the VPC Endpoint. Applicable for endpoints of type `Interface`.
+* `owner_id` - ID of the AWS account that owns the VPC endpoint.
+* `policy` - Policy document associated with the VPC Endpoint. Applicable for endpoints of type `Gateway`.
+* `prefix_list_id` - Prefix list ID of the exposed AWS service. Applicable for endpoints of type `Gateway`.
+* `private_dns_enabled` - Whether or not the VPC is associated with a private hosted zone - `true` or `false`. Applicable for endpoints of type `Interface`.
+* `requester_managed` -  Whether or not the VPC Endpoint is being managed by its service - `true` or `false`.
+* `route_table_ids` - One or more route tables associated with the VPC Endpoint. Applicable for endpoints of type `Gateway`.
+* `security_group_ids` - One or more security groups associated with the network interfaces. Applicable for endpoints of type `Interface`.
+* `subnet_ids` - One or more subnets in which the VPC Endpoint is located. Applicable for endpoints of type `Interface`.
+* `vpc_endpoint_type` - VPC Endpoint type, `Gateway` or `Interface`.
+
+### `dns_entry` Block
+
+DNS blocks (for `dns_entry`) support the following attributes:
+
+* `dns_name` - DNS name.
+* `hosted_zone_id` - ID of the private hosted zone.
+
+### `dns_options` Block
+
+DNS options (for `dns_options`) support the following attributes:
+
+* `dns_record_ip_type` - The DNS records created for the endpoint.
+* `private_dns_only_for_inbound_resolver_endpoint` - Indicates whether to enable private DNS only for inbound endpoints.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `20m`)
+
+<!-- cache-key: cdktf-0.18.0 input-cf41a1af88fdcd16967d2fea2f7220a7cac0581c1bfd6c1afb6c5a31ae85ffb1 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/vpc_endpoint_service.html.markdown b/website/docs/cdktf/python/d/vpc_endpoint_service.html.markdown
new file mode 100644
index 00000000000..17a2531380d
--- /dev/null
+++ b/website/docs/cdktf/python/d/vpc_endpoint_service.html.markdown
@@ -0,0 +1,131 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_vpc_endpoint_service"
+description: |-
+    Provides details about a specific service that can be specified when creating a VPC endpoint.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_vpc_endpoint_service
+
+The VPC Endpoint Service data source details about a specific service that
+can be specified when creating a VPC endpoint within the region configured in the provider.
+
+## Example Usage
+
+### AWS Service
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_vpc_endpoint_service import DataAwsVpcEndpointService
+from imports.aws.vpc import Vpc
+from imports.aws.vpc_endpoint import VpcEndpoint
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        foo = Vpc(self, "foo",
+            cidr_block="10.0.0.0/16"
+        )
+        s3 = DataAwsVpcEndpointService(self, "s3",
+            service="s3",
+            service_type="Gateway"
+        )
+        VpcEndpoint(self, "ep",
+            service_name=Token.as_string(s3.service_name),
+            vpc_id=foo.id
+        )
+```
+
+### Non-AWS Service
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_vpc_endpoint_service import DataAwsVpcEndpointService
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsVpcEndpointService(self, "custome",
+            service_name="com.amazonaws.vpce.us-west-2.vpce-svc-0e87519c997c63cd8"
+        )
+```
+
+### Filter
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_vpc_endpoint_service import DataAwsVpcEndpointService
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsVpcEndpointService(self, "test",
+            filter=[DataAwsVpcEndpointServiceFilter(
+                name="service-name",
+                values=["some-service"]
+            )
+            ]
+        )
+```
+
+## Argument Reference
+
+The arguments of this data source act as filters for querying the available VPC endpoint services.
+The given filters must match exactly one VPC endpoint service whose data will be exported as attributes.
+
+* `filter` - (Optional) Configuration block(s) for filtering. Detailed below.
+* `service` - (Optional) Common name of an AWS service (e.g., `s3`).
+* `service_name` - (Optional) Service name that is specified when creating a VPC endpoint. For AWS services the service name is usually in the form `com.amazonaws.<region>.<service>` (the SageMaker Notebook service is an exception to this rule, the service name is in the form `aws.sagemaker.<region>.notebook`).
+* `service_type` - (Optional) Service type, `Gateway` or `Interface`.
+* `tags` - (Optional) Map of tags, each pair of which must exactly match a pair on the desired VPC Endpoint Service.
+
+~> **NOTE:** Specifying `service` will not work for non-AWS services or AWS services that don't follow the standard `service_name` pattern of `com.amazonaws.<region>.<service>`.
+
+### filter Configuration Block
+
+The `filter` configuration block supports the following arguments:
+
+* `name` - (Required) Name of the filter field. Valid values can be found in the [EC2 DescribeVpcEndpointServices API Reference](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeVpcEndpointServices.html).
+* `values` - (Required) Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `acceptance_required` - Whether or not VPC endpoint connection requests to the service must be accepted by the service owner - `true` or `false`.
+* `arn` - ARN of the VPC endpoint service.
+* `availability_zones` - Availability Zones in which the service is available.
+* `base_endpoint_dns_names` - The DNS names for the service.
+* `manages_vpc_endpoints` - Whether or not the service manages its VPC endpoints - `true` or `false`.
+* `owner` - AWS account ID of the service owner or `amazon`.
+* `private_dns_name` - Private DNS name for the service.
+* `service_id` - ID of the endpoint service.
+* `supported_ip_address_types` - The supported IP address types.
+* `tags` - Map of tags assigned to the resource.
+* `vpc_endpoint_policy_supported` - Whether or not the service supports endpoint policies - `true` or `false`.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `20m`)
+
+<!-- cache-key: cdktf-0.18.0 input-07124556ae240c2c16fc954fbeb348321b8ac1e928a8e3cc7a640d672a6dfb99 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/vpc_ipam_pool.html.markdown b/website/docs/cdktf/python/d/vpc_ipam_pool.html.markdown
new file mode 100644
index 00000000000..da679d70390
--- /dev/null
+++ b/website/docs/cdktf/python/d/vpc_ipam_pool.html.markdown
@@ -0,0 +1,101 @@
+---
+subcategory: "VPC IPAM (IP Address Manager)"
+layout: "aws"
+page_title: "AWS: aws_vpc_ipam_pool"
+description: |-
+    Returns details about the first IPAM pool that matches search parameters provided.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_vpc_ipam_pool
+
+`aws_vpc_ipam_pool` provides details about an IPAM pool.
+
+This resource can prove useful when an ipam pool was created in another root
+module and you need the pool's id as an input variable. For example, pools
+can be shared via RAM and used to create vpcs with CIDRs from that pool.
+
+## Example Usage
+
+The following example shows an account that has only 1 pool, perhaps shared
+via RAM, and using that pool id to create a VPC with a CIDR derived from
+AWS IPAM.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_vpc_ipam_pool import DataAwsVpcIpamPool
+from imports.aws.vpc import Vpc
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        test = DataAwsVpcIpamPool(self, "test",
+            filter=[DataAwsVpcIpamPoolFilter(
+                name="description",
+                values=["*test*"]
+            ), DataAwsVpcIpamPoolFilter(
+                name="address-family",
+                values=["ipv4"]
+            )
+            ]
+        )
+        aws_vpc_test = Vpc(self, "test_1",
+            ipv4_ipam_pool_id=Token.as_string(test.id),
+            ipv4_netmask_length=28
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_vpc_test.override_logical_id("test")
+```
+
+## Argument Reference
+
+The arguments of this data source act as filters for querying the available
+VPCs in the current region. The given filters must match exactly one
+VPC whose data will be exported as attributes.
+
+* `ipam_pool_id` - (Optional) ID of the IPAM pool you would like information on.
+* `filter` - (Optional) Custom filter block as described below.
+
+### filter
+
+* `name` - (Required) The name of the filter. Filter names are case-sensitive.
+* `values` - (Required) The filter values. Filter values are case-sensitive.
+
+## Attribute Reference
+
+All of the argument attributes except `filter` blocks are also exported as
+result attributes. This data source will complete the data by populating
+any fields that are not included in the configuration with the data for
+the selected VPC.
+
+The following attribute is additionally exported:
+
+* `address_family` - IP protocol assigned to this pool.
+* `allocation_default_netmask_length` - A default netmask length for allocations added to this pool. If, for example, the CIDR assigned to this pool is `10.0.0.0/8` and you enter 16 here, new allocations will default to `10.0.0.0/16`.
+* `allocation_max_netmask_length` - The maximum netmask length that will be required for CIDR allocations in this pool.
+* `allocation_min_netmask_length` - The minimum netmask length that will be required for CIDR allocations in this pool.
+* `allocation_resource_tags` - Tags that are required to create resources in using this pool.
+* `arn` - ARN of the pool
+* `auto_import` - If enabled, IPAM will continuously look for resources within the CIDR range of this pool and automatically import them as allocations into your IPAM.
+* `aws_service` - Limits which service in AWS that the pool can be used in. `ec2` for example, allows users to use space for Elastic IP addresses and VPCs.
+* `description` - Description for the IPAM pool.
+* `id` - ID of the IPAM pool.
+* `ipam_scope_id` - ID of the scope the pool belongs to.
+* `locale` - Locale is the Region where your pool is available for allocations. You can only create pools with locales that match the operating Regions of the IPAM. You can only create VPCs from a pool whose locale matches the VPC's Region.
+* `publicly_advertisable` - Defines whether or not IPv6 pool space is publicly advertisable over the internet.
+* `source_ipam_pool_id` - ID of the source IPAM pool.
+* `tags` - Map of tags to assigned to the resource.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `20m`)
+
+<!-- cache-key: cdktf-0.18.0 input-14e0ec5a45dd1fac68d4e842a7b8f6c07c038a22e839fecb94a749a7d96d7a4e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/vpc_ipam_pool_cidrs.html.markdown b/website/docs/cdktf/python/d/vpc_ipam_pool_cidrs.html.markdown
new file mode 100644
index 00000000000..610f7ab9f3a
--- /dev/null
+++ b/website/docs/cdktf/python/d/vpc_ipam_pool_cidrs.html.markdown
@@ -0,0 +1,121 @@
+---
+subcategory: "VPC IPAM (IP Address Manager)"
+layout: "aws"
+page_title: "AWS: aws_vpc_ipam_pool_cidrs"
+description: |-
+    Returns cidrs provisioned into an IPAM pool.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_vpc_ipam_pool_cidrs
+
+`aws_vpc_ipam_pool_cidrs` provides details about an IPAM pool.
+
+This resource can prove useful when an ipam pool was shared to your account and you want to know all (or a filtered list) of the CIDRs that are provisioned into the pool.
+
+## Example Usage
+
+Basic usage:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_vpc_ipam_pool import DataAwsVpcIpamPool
+from imports.aws.data_aws_vpc_ipam_pool_cidrs import DataAwsVpcIpamPoolCidrs
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        p = DataAwsVpcIpamPool(self, "p",
+            filter=[DataAwsVpcIpamPoolFilter(
+                name="description",
+                values=["*mypool*"]
+            ), DataAwsVpcIpamPoolFilter(
+                name="address-family",
+                values=["ipv4"]
+            )
+            ]
+        )
+        DataAwsVpcIpamPoolCidrs(self, "c",
+            ipam_pool_id=Token.as_string(p.id)
+        )
+```
+
+Filtering:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformIterator, Fn, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_vpc_ipam_pool_cidrs import DataAwsVpcIpamPoolCidrs
+from imports.aws.ec2_managed_prefix_list import Ec2ManagedPrefixList
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        c = DataAwsVpcIpamPoolCidrs(self, "c",
+            filter=[DataAwsVpcIpamPoolCidrsFilter(
+                name="cidr",
+                values=["10.*"]
+            )
+            ],
+            ipam_pool_id="ipam-pool-123"
+        )
+        mycidrs = "${[ for cidr in ${" + c.ipam_pool_cidrs + "} : cidr.cidr if cidr.state == \"provisioned\"]}"
+        # In most cases loops should be handled in the programming language context and
+        #     not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+        #     you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+        #     you need to keep this like it is.
+        pls_dynamic_iterator0 = TerraformIterator.from_list(
+            Token.as_any(mycidrs))
+        Ec2ManagedPrefixList(self, "pls",
+            address_family="IPv4",
+            max_entries=Token.as_number(Fn.length_of(mycidrs)),
+            name="IPAM Pool (${" + test.id + "}) Cidrs",
+            entry=pls_dynamic_iterator0.dynamic({
+                "cidr": pls_dynamic_iterator0.value,
+                "description": pls_dynamic_iterator0.value
+            })
+        )
+```
+
+## Argument Reference
+
+The arguments of this data source act as filters for querying the available
+VPCs in the current region. The given filters must match exactly one
+VPC whose data will be exported as attributes.
+
+* `ipam_pool_id` - ID of the IPAM pool you would like the list of provisioned CIDRs.
+* `filter` - Custom filter block as described below.
+
+## Attribute Reference
+
+All of the argument attributes except `filter` blocks are also exported as
+result attributes. This data source will complete the data by populating
+any fields that are not included in the configuration with the data for
+the selected IPAM Pool CIDRs.
+
+The following attribute is additionally exported:
+
+* `ipam_pool_cidrs` - The CIDRs provisioned into the IPAM pool, described below.
+
+### ipam_pool_cidrs
+
+* `cidr` - A network CIDR.
+* `state` - The provisioning state of that CIDR.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `1m`)
+
+<!-- cache-key: cdktf-0.18.0 input-b9fe0569a3bb59535a5bd318b59bb8f37d4a198fb5bfa62af131cfaa8ffd8980 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/vpc_ipam_pools.html.markdown b/website/docs/cdktf/python/d/vpc_ipam_pools.html.markdown
new file mode 100644
index 00000000000..4fbed03e1ab
--- /dev/null
+++ b/website/docs/cdktf/python/d/vpc_ipam_pools.html.markdown
@@ -0,0 +1,83 @@
+---
+subcategory: "VPC IPAM (IP Address Manager)"
+layout: "aws"
+page_title: "AWS: aws_vpc_ipam_pools"
+description: |-
+    Returns details about IPAM pools that match the search parameters provided.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_vpc_ipam_pools
+
+`aws_vpc_ipam_pools` provides details about IPAM pools.
+
+This resource can prove useful when IPAM pools are created in another root
+module and you need the pool ids as input variables. For example, pools
+can be shared via RAM and used to create vpcs with CIDRs from that pool.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_vpc_ipam_pools import DataAwsVpcIpamPools
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsVpcIpamPools(self, "test",
+            filter=[DataAwsVpcIpamPoolsFilter(
+                name="description",
+                values=["*test*"]
+            ), DataAwsVpcIpamPoolsFilter(
+                name="address-family",
+                values=["ipv4"]
+            )
+            ]
+        )
+```
+
+## Argument Reference
+
+The arguments of this data source act as filters for querying the available
+IPAM Pools in the current region.
+
+* `filter` - (Required) Custom filter block as described below.
+
+### filter
+
+* `name` - (Required) The name of the filter. Filter names are case-sensitive.
+* `values` - (Required) The filter values. Filter values are case-sensitive.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `ipam_pools` - List of IPAM pools and their attributes. See below for details
+
+### ipam_pools
+
+The following attributes are available on each pool entry found.
+
+* `address_family` - IP protocol assigned to this pool.
+* `allocation_default_netmask_length` - A default netmask length for allocations added to this pool. If, for example, the CIDR assigned to this pool is `10.0.0.0/8` and you enter 16 here, new allocations will default to `10.0.0.0/16`.
+* `allocation_max_netmask_length` - The maximum netmask length that will be required for CIDR allocations in this pool.
+* `allocation_min_netmask_length` - The minimum netmask length that will be required for CIDR allocations in this pool.
+* `allocation_resource_tags` - Tags that are required to create resources in using this pool.
+* `arn` - ARN of the pool
+* `auto_import` - If enabled, IPAM will continuously look for resources within the CIDR range of this pool and automatically import them as allocations into your IPAM.
+* `aws_service` - Limits which service in AWS that the pool can be used in. `ec2` for example, allows users to use space for Elastic IP addresses and VPCs.
+* `description` - Description for the IPAM pool.
+* `id` - ID of the IPAM pool.
+* `ipam_scope_id` - ID of the scope the pool belongs to.
+* `locale` - Locale is the Region where your pool is available for allocations. You can only create pools with locales that match the operating Regions of the IPAM. You can only create VPCs from a pool whose locale matches the VPC's Region.
+* `publicly_advertisable` - Defines whether or not IPv6 pool space is publicly advertisable over the internet.
+* `source_ipam_pool_id` - ID of the source IPAM pool.
+* `tags` - Map of tags to assigned to the resource.
+
+<!-- cache-key: cdktf-0.18.0 input-0f25f29b8da73a8eab1f57b2d6fd05fbdbacc033fa3a351d8ef07553310a8208 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/vpc_ipam_preview_next_cidr.html.markdown b/website/docs/cdktf/python/d/vpc_ipam_preview_next_cidr.html.markdown
new file mode 100644
index 00000000000..7dbc37770cb
--- /dev/null
+++ b/website/docs/cdktf/python/d/vpc_ipam_preview_next_cidr.html.markdown
@@ -0,0 +1,72 @@
+---
+subcategory: "VPC IPAM (IP Address Manager)"
+layout: "aws"
+page_title: "AWS: aws_vpc_ipam_preview_next_cidr"
+description: |-
+  Previews a CIDR from an IPAM address pool.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_vpc_ipam_preview_next_cidr
+
+Previews a CIDR from an IPAM address pool. Only works for private IPv4.
+
+~> **NOTE:** This functionality is also encapsulated in a resource sharing the same name. The data source can be used when you need to use the cidr in a calculation of the same Root module, `count` for example. However, once a cidr range has been allocated that was previewed, the next refresh will find a **new** cidr and may force new resources downstream. Make sure to use Terraform's lifecycle `ignore_changes` policy if this is undesirable.
+
+## Example Usage
+
+Basic usage:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from cdktf import TerraformResourceLifecycle
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_vpc_ipam_preview_next_cidr import DataAwsVpcIpamPreviewNextCidr
+from imports.aws.vpc_ipam_pool_cidr_allocation import VpcIpamPoolCidrAllocation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        test = DataAwsVpcIpamPreviewNextCidr(self, "test",
+            depends_on=[aws_vpc_ipam_pool_cidr_test],
+            ipam_pool_id=Token.as_string(aws_vpc_ipam_pool_test.id),
+            netmask_length=28
+        )
+        aws_vpc_ipam_pool_cidr_allocation_test = VpcIpamPoolCidrAllocation(self, "test_1",
+            cidr=Token.as_string(test.cidr),
+            ipam_pool_id=Token.as_string(aws_vpc_ipam_pool_test.id),
+            lifecycle=TerraformResourceLifecycle(
+                ignore_changes=[cidr]
+            )
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_vpc_ipam_pool_cidr_allocation_test.override_logical_id("test")
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `disallowed_cidrs` - (Optional) Exclude a particular CIDR range from being returned by the pool.
+* `ipam_pool_id` - (Required) ID of the pool to which you want to assign a CIDR.
+* `netmask_length` - (Optional) Netmask length of the CIDR you would like to preview from the IPAM pool.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `cidr` - Previewed CIDR from the pool.
+* `id` - ID of the preview.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `20m`)
+
+<!-- cache-key: cdktf-0.18.0 input-dd816317496f53d47089ea622a6d2495e074267b1372edce322e33a4007d026b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/vpc_peering_connection.html.markdown b/website/docs/cdktf/python/d/vpc_peering_connection.html.markdown
new file mode 100644
index 00000000000..bd9dbcb5aa2
--- /dev/null
+++ b/website/docs/cdktf/python/d/vpc_peering_connection.html.markdown
@@ -0,0 +1,114 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_vpc_peering_connection"
+description: |-
+    Provides details about a specific VPC peering connection.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_vpc_peering_connection
+
+The VPC Peering Connection data source provides details about
+a specific VPC peering connection.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_vpc_peering_connection import DataAwsVpcPeeringConnection
+from imports.aws.route import Route
+from imports.aws.route_table import RouteTable
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        rt = RouteTable(self, "rt",
+            vpc_id=foo.id
+        )
+        pc = DataAwsVpcPeeringConnection(self, "pc",
+            peer_cidr_block="10.0.1.0/22",
+            vpc_id=foo.id
+        )
+        Route(self, "r",
+            destination_cidr_block=Token.as_string(pc.peer_cidr_block),
+            route_table_id=rt.id,
+            vpc_peering_connection_id=Token.as_string(pc.id)
+        )
+```
+
+## Argument Reference
+
+The arguments of this data source act as filters for querying the available VPC peering connection.
+The given filters must match exactly one VPC peering connection whose data will be exported as attributes.
+
+* `id` - (Optional) ID of the specific VPC Peering Connection to retrieve.
+
+* `status` - (Optional) Status of the specific VPC Peering Connection to retrieve.
+
+* `vpc_id` - (Optional) ID of the requester VPC of the specific VPC Peering Connection to retrieve.
+
+* `owner_id` - (Optional) AWS account ID of the owner of the requester VPC of the specific VPC Peering Connection to retrieve.
+
+* `cidr_block` - (Optional) Primary CIDR block of the requester VPC of the specific VPC Peering Connection to retrieve.
+
+* `region` - (Optional) Region of the requester VPC of the specific VPC Peering Connection to retrieve.
+
+* `peer_vpc_id` - (Optional) ID of the accepter VPC of the specific VPC Peering Connection to retrieve.
+
+* `peer_owner_id` - (Optional) AWS account ID of the owner of the accepter VPC of the specific VPC Peering Connection to retrieve.
+
+* `peer_cidr_block` - (Optional) Primary CIDR block of the accepter VPC of the specific VPC Peering Connection to retrieve.
+
+* `peer_region` - (Optional) Region of the accepter VPC of the specific VPC Peering Connection to retrieve.
+
+* `filter` - (Optional) Custom filter block as described below.
+
+* `tags` - (Optional) Map of tags, each pair of which must exactly match
+  a pair on the desired VPC Peering Connection.
+
+More complex filters can be expressed using one or more `filter` sub-blocks,
+which take the following arguments:
+
+* `name` - (Required) Name of the field to filter by, as defined by
+  [the underlying AWS API](http://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeVpcPeeringConnections.html).
+
+* `values` - (Required) Set of values that are accepted for the given field.
+  A VPC Peering Connection will be selected if any one of the given values matches.
+
+## Attribute Reference
+
+All of the argument attributes except `filter` are also exported as result attributes.
+
+* `accepter` - Configuration block that describes [VPC Peering Connection]
+(https://docs.aws.amazon.com/vpc/latest/peering/what-is-vpc-peering.html) options set for the accepter VPC.
+
+* `cidr_block_set` - List of objects with CIDR blocks of the requester VPC.
+
+* `peer_cidr_block_set` - List of objects with CIDR blocks of the accepter VPC.
+
+* `requester` - Configuration block that describes [VPC Peering Connection]
+(https://docs.aws.amazon.com/vpc/latest/peering/what-is-vpc-peering.html) options set for the requester VPC.
+
+#### Accepter and Requester Attribute Reference
+
+* `allow_remote_vpc_dns_resolution` - Indicates whether a local VPC can resolve public DNS hostnames to
+private IP addresses when queried from instances in a peer VPC.
+
+#### CIDR block set Attribute Reference
+
+* `cidr_block` - CIDR block associated to the VPC of the specific VPC Peering Connection.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `20m`)
+
+<!-- cache-key: cdktf-0.18.0 input-b38a9587aaca2300c795e51ead64f4c57e57a85ac3044ada5792edf97aa88b1a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/vpc_peering_connections.html.markdown b/website/docs/cdktf/python/d/vpc_peering_connections.html.markdown
new file mode 100644
index 00000000000..399685a3968
--- /dev/null
+++ b/website/docs/cdktf/python/d/vpc_peering_connections.html.markdown
@@ -0,0 +1,83 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_vpc_peering_connections"
+description: |-
+    Lists peering connections
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_vpc_peering_connections
+
+Use this data source to get IDs of Amazon VPC peering connections
+To get more details on each connection, use the data resource [aws_vpc_peering_connection](/docs/providers/aws/d/vpc_peering_connection.html)
+
+Note: To use this data source in a count, the resources should exist before trying to access
+the data source, as noted in [issue 4149](https://github.com/hashicorp/terraform/issues/4149)
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformCount, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_vpc_peering_connection import DataAwsVpcPeeringConnection
+from imports.aws.data_aws_vpc_peering_connections import DataAwsVpcPeeringConnections
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        pcs = DataAwsVpcPeeringConnections(self, "pcs",
+            filter=[DataAwsVpcPeeringConnectionsFilter(
+                name="requester-vpc-info.vpc-id",
+                values=[foo.id]
+            )
+            ]
+        )
+        # In most cases loops should be handled in the programming language context and
+        #     not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+        #     you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+        #     you need to keep this like it is.
+        pc_count = TerraformCount.of(Token.as_number(Fn.length_of(pcs.ids)))
+        DataAwsVpcPeeringConnection(self, "pc",
+            id=Token.as_string(Fn.lookup_nested(pcs.ids, [pc_count.index])),
+            count=pc_count
+        )
+```
+
+## Argument Reference
+
+The arguments of this data source act as filters for querying the available VPC peering connections.
+
+* `filter` - (Optional) Custom filter block as described below.
+
+* `tags` - (Optional) Mapping of tags, each pair of which must exactly match
+  a pair on the desired VPC Peering Connection.
+
+More complex filters can be expressed using one or more `filter` sub-blocks,
+which take the following arguments:
+
+* `name` - (Required) Name of the field to filter by, as defined by
+  [the underlying AWS API](http://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeVpcPeeringConnections.html).
+
+* `values` - (Required) Set of values that are accepted for the given field.
+  A VPC Peering Connection will be selected if any one of the given values matches.
+
+## Attribute Reference
+
+All of the argument attributes except `filter` are also exported as result attributes.
+
+* `id` - AWS Region.
+* `ids` - IDs of the VPC Peering Connections.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `20m`)
+
+<!-- cache-key: cdktf-0.18.0 input-a9c5018aed4e1e6786cc7bb5dd8607ab1c1d2ea0787591a3d91d06ccfee33928 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/vpc_security_group_rule.html.markdown b/website/docs/cdktf/python/d/vpc_security_group_rule.html.markdown
new file mode 100644
index 00000000000..732b8a8c59b
--- /dev/null
+++ b/website/docs/cdktf/python/d/vpc_security_group_rule.html.markdown
@@ -0,0 +1,67 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_vpc_security_group_rule"
+description: |-
+    Provides details about a specific security group rule
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_vpc_security_group_rule
+
+`aws_vpc_security_group_rule` provides details about a specific security group rule.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_vpc_security_group_rule import DataAwsVpcSecurityGroupRule
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsVpcSecurityGroupRule(self, "example",
+            security_group_rule_id=security_group_rule_id.string_value
+        )
+```
+
+## Argument Reference
+
+The arguments of this data source act as filters for querying the available
+security group rules. The given filters must match exactly one security group rule
+whose data will be exported as attributes.
+
+* `security_group_rule_id` - (Optional) ID of the security group rule to select.
+* `filter` - (Optional) Configuration block(s) for filtering. Detailed below.
+
+### filter Configuration Block
+
+The `filter` configuration block supports the following arguments:
+
+* `name` - (Required) Name of the filter field. Valid values can be found in the EC2 [`DescribeSecurityGroupRules`](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeSecurityGroupRules.html) API Reference.
+* `values` - (Required) Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the security group rule.
+* `cidr_ipv4` - The destination IPv4 CIDR range.
+* `cidr_ipv6` - The destination IPv6 CIDR range.
+* `description` - The security group rule description.
+* `from_port` - The start of port range for the TCP and UDP protocols, or an ICMP/ICMPv6 type.
+* `is_egress` - Indicates whether the security group rule is an outbound rule.
+* `ip_protocol` - The IP protocol name or number. Use `-1` to specify all protocols.
+* `prefix_list_id` - The ID of the destination prefix list.
+* `referenced_security_group_id` - The destination security group that is referenced in the rule.
+* `security_group_id` - The ID of the security group.
+* `tags` - A map of tags assigned to the resource.
+* `to_port` - (Optional) The end of port range for the TCP and UDP protocols, or an ICMP/ICMPv6 code.
+
+<!-- cache-key: cdktf-0.18.0 input-60bbadf919e19a6b86244afce1efa5865475dc66aa0bf2f6b2d6643a6824df84 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/vpc_security_group_rules.html.markdown b/website/docs/cdktf/python/d/vpc_security_group_rules.html.markdown
new file mode 100644
index 00000000000..43ac31fcc55
--- /dev/null
+++ b/website/docs/cdktf/python/d/vpc_security_group_rules.html.markdown
@@ -0,0 +1,58 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_vpc_security_group_rules"
+description: |-
+    Get information about a set of security group rules.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_vpc_security_group_rules
+
+This resource can be useful for getting back a set of security group rule IDs.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_vpc_security_group_rules import DataAwsVpcSecurityGroupRules
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsVpcSecurityGroupRules(self, "example",
+            filter=[DataAwsVpcSecurityGroupRulesFilter(
+                name="group-id",
+                values=[security_group_id.string_value]
+            )
+            ]
+        )
+```
+
+## Argument Reference
+
+* `filter` - (Optional) Custom filter block as described below.
+* `tags` - (Optional) Map of tags, each pair of which must exactly match
+  a pair on the desired security group rule.
+
+More complex filters can be expressed using one or more `filter` sub-blocks,
+which take the following arguments:
+
+* `name` - (Required) Name of the field to filter by, as defined by
+  [the underlying AWS API](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeSecurityGroupRules.html).
+* `values` - (Required) Set of values that are accepted for the given field.
+  Security group rule IDs will be selected if any one of the given values match.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `ids` - List of all the security group rule IDs found.
+
+<!-- cache-key: cdktf-0.18.0 input-87719c79ae2f1f4c5613b3ccab85a172f42cc7b1318d60caecef6a1733d22344 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/vpclattice_auth_policy.html.markdown b/website/docs/cdktf/python/d/vpclattice_auth_policy.html.markdown
new file mode 100644
index 00000000000..cad3d020692
--- /dev/null
+++ b/website/docs/cdktf/python/d/vpclattice_auth_policy.html.markdown
@@ -0,0 +1,49 @@
+---
+subcategory: "VPC Lattice"
+layout: "aws"
+page_title: "AWS: aws_vpclattice_auth_policy"
+description: |-
+  Terraform data source for managing an AWS VPC Lattice Auth Policy.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_vpclattice_auth_policy
+
+Terraform data source for managing an AWS VPC Lattice Auth Policy.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_vpclattice_auth_policy import DataAwsVpclatticeAuthPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsVpclatticeAuthPolicy(self, "test",
+            resource_identifier=Token.as_string(aws_vpclattice_auth_policy_test.resource_identifier)
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `resource_identifier` - (Required) The ID or Amazon Resource Name (ARN) of the service network or service for which the policy is created.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `policy` - The auth policy. The policy string in JSON must not contain newlines or blank lines.
+* `state` - The state of the auth policy. The auth policy is only active when the auth type is set to AWS_IAM. If you provide a policy, then authentication and authorization decisions are made based on this policy and the client's IAM policy. If the Auth type is NONE, then, any auth policy you provide will remain inactive.
+
+<!-- cache-key: cdktf-0.18.0 input-1a9e7f339073e21595c69c5c150562d38d28dfc83382761a10ef529f50b9408a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/vpclattice_listener.html.markdown b/website/docs/cdktf/python/d/vpclattice_listener.html.markdown
new file mode 100644
index 00000000000..069ff9f2c28
--- /dev/null
+++ b/website/docs/cdktf/python/d/vpclattice_listener.html.markdown
@@ -0,0 +1,60 @@
+---
+subcategory: "VPC Lattice"
+layout: "aws"
+page_title: "AWS: aws_vpclattice_listener"
+description: |-
+  Terraform data source for managing an AWS VPC Lattice Listener.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_vpclattice_listener
+
+Terraform data source for managing an AWS VPC Lattice Listener.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_vpclattice_listener import DataAwsVpclatticeListener
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, listenerIdentifier, serviceIdentifier):
+        super().__init__(scope, name)
+        DataAwsVpclatticeListener(self, "example",
+            listener_identifier=listener_identifier,
+            service_identifier=service_identifier
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `service_identifier` - (Required) ID or Amazon Resource Name (ARN) of the service network
+* `listener_identifier` - (Required) ID or Amazon Resource Name (ARN) of the listener
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the listener.
+* `created_at` - The date and time that the listener was created.
+* `default_action` - The actions for the default listener rule.
+* `last_updated_at` - The date and time the listener was last updated.
+* `listener_id` - The ID of the listener.
+* `name` - The name of the listener.
+* `port` - The listener port.
+* `protocol` - The listener protocol. Either `HTTPS` or `HTTP`.
+* `service_arn` - The ARN of the service.
+* `service_id` - The ID of the service.
+* `tags` - List of tags associated with the listener.
+
+<!-- cache-key: cdktf-0.18.0 input-4a687c57ad29c134d46fc404c1c41b48da0292cbf1e1dd8120398bdb458ec84c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/vpclattice_resource_policy.html.markdown b/website/docs/cdktf/python/d/vpclattice_resource_policy.html.markdown
new file mode 100644
index 00000000000..689e132015f
--- /dev/null
+++ b/website/docs/cdktf/python/d/vpclattice_resource_policy.html.markdown
@@ -0,0 +1,48 @@
+---
+subcategory: "VPC Lattice"
+layout: "aws"
+page_title: "AWS: aws_vpclattice_resource_policy"
+description: |-
+  Terraform data source for managing an AWS VPC Lattice Resource Policy.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_vpclattice_resource_policy
+
+Terraform data source for managing an AWS VPC Lattice Resource Policy.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_vpclattice_resource_policy import DataAwsVpclatticeResourcePolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsVpclatticeResourcePolicy(self, "example",
+            resource_arn=Token.as_string(aws_vpclattice_service_network_example.arn)
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `resource_arn` - (Required) Resource ARN of the resource for which a policy is retrieved.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `policy` - JSON-encoded string representation of the applied resource policy.
+
+<!-- cache-key: cdktf-0.18.0 input-8bbfef254a190e7f80aa5a7e593ea739d64afa50ba608c823c8b66809a5ca7a5 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/vpclattice_service.html.markdown b/website/docs/cdktf/python/d/vpclattice_service.html.markdown
new file mode 100644
index 00000000000..d78783832e1
--- /dev/null
+++ b/website/docs/cdktf/python/d/vpclattice_service.html.markdown
@@ -0,0 +1,57 @@
+---
+subcategory: "VPC Lattice"
+layout: "aws"
+page_title: "AWS: aws_vpclattice_service"
+description: |-
+  Terraform data source for managing an AWS VPC Lattice Service.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_vpclattice_service
+
+Terraform data source for managing an AWS VPC Lattice Service.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_vpclattice_service import DataAwsVpclatticeService
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsVpclatticeService(self, "example",
+            name="example"
+        )
+```
+
+## Argument Reference
+
+The arguments of this data source act as filters for querying the available VPC lattice services.
+The given filters must match exactly one VPC lattice service whose data will be exported as attributes.
+
+* `name` - (Optional) Service name.
+* `service_identifier` - (Optional) ID or Amazon Resource Name (ARN) of the service.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the service.
+* `auth_type` - Type of IAM policy. Either `NONE` or `AWS_IAM`.
+* `certificate_arn` - Amazon Resource Name (ARN) of the certificate.
+* `custom_domain_name` - Custom domain name of the service.
+* `dns_entry` - DNS name of the service.
+* `id` - Unique identifier for the service.
+* `status` - Status of the service.
+* `tags` - List of tags associated with the service.
+
+<!-- cache-key: cdktf-0.18.0 input-7b6870621548d47b2268852ea64bf86123c019e6fafbc3bb70238634ddfbd625 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/vpclattice_service_network.html.markdown b/website/docs/cdktf/python/d/vpclattice_service_network.html.markdown
new file mode 100644
index 00000000000..74e9b483cd3
--- /dev/null
+++ b/website/docs/cdktf/python/d/vpclattice_service_network.html.markdown
@@ -0,0 +1,55 @@
+---
+subcategory: "VPC Lattice"
+layout: "aws"
+page_title: "AWS: aws_vpclattice_service_network"
+description: |-
+  Terraform data source for managing an AWS VPC Lattice Service Network.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_vpclattice_service_network
+
+Terraform data source for managing an AWS VPC Lattice Service Network.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_vpclattice_service_network import DataAwsVpclatticeServiceNetwork
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsVpclatticeServiceNetwork(self, "example",
+            service_network_identifier="snsa-01112223334445556"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `service_network_identifier` - (Required) Identifier of the service network.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Service Network.
+* `auth_type` - Authentication type for the service network. Either `NONE` or `AWS_IAM`.
+* `created_at` - Date and time the service network was created.
+* `id` - ID of the service network.
+* `last_updated_at` - Date and time the service network was last updated.
+* `name` - Name of the service network.
+* `number_of_associated_services` - Number of services associated with this service network.
+* `number_of_associated_vpcs` - Number of VPCs associated with this service network.
+
+<!-- cache-key: cdktf-0.18.0 input-f4109a8ce33f12e8a0ef307b66a1c9cc873bcdc0d442d07fb6e1314973b2d72a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/vpcs.html.markdown b/website/docs/cdktf/python/d/vpcs.html.markdown
new file mode 100644
index 00000000000..78b22b5be34
--- /dev/null
+++ b/website/docs/cdktf/python/d/vpcs.html.markdown
@@ -0,0 +1,121 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_vpcs"
+description: |-
+    Provides a list of VPC Ids in a region
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_vpcs
+
+This resource can be useful for getting back a list of VPC Ids for a region.
+
+The following example retrieves a list of VPC Ids with a custom tag of `service` set to a value of "production".
+
+## Example Usage
+
+The following shows outputting all VPC Ids.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformOutput, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_vpcs import DataAwsVpcs
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        foo = DataAwsVpcs(self, "foo",
+            tags={
+                "service": "production"
+            }
+        )
+        cdktf_terraform_output_foo = TerraformOutput(self, "foo_1",
+            value=foo.ids
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        cdktf_terraform_output_foo.override_logical_id("foo")
+```
+
+An example use case would be interpolate the `aws_vpcs` output into `count` of an aws_flow_log resource.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformOutput, Fn, Token, TerraformCount, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_vpc import DataAwsVpc
+from imports.aws.data_aws_vpcs import DataAwsVpcs
+from imports.aws.flow_log import FlowLog
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        foo = DataAwsVpcs(self, "foo")
+        cdktf_terraform_output_foo = TerraformOutput(self, "foo_1",
+            value=foo.ids
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        cdktf_terraform_output_foo.override_logical_id("foo")
+        # In most cases loops should be handled in the programming language context and
+        #     not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+        #     you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+        #     you need to keep this like it is.
+        foo_count = TerraformCount.of(Token.as_number(Fn.length_of(foo.ids)))
+        data_aws_vpc_foo = DataAwsVpc(self, "foo_2",
+            id=Token.as_string(Fn.lookup_nested(Fn.tolist(foo.ids), [foo_count.index])),
+            count=foo_count
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_vpc_foo.override_logical_id("foo")
+        # In most cases loops should be handled in the programming language context and
+        #     not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+        #     you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+        #     you need to keep this like it is.
+        test_flow_log_count = TerraformCount.of(
+            Token.as_number(Fn.length_of(foo.ids)))
+        FlowLog(self, "test_flow_log",
+            vpc_id=Token.as_string(
+                Fn.lookup_nested(
+                    Fn.lookup_nested(data_aws_vpc_foo, [test_flow_log_count.index]), ["id"])),
+            count=test_flow_log_count
+        )
+```
+
+## Argument Reference
+
+* `tags` - (Optional) Map of tags, each pair of which must exactly match
+  a pair on the desired vpcs.
+
+* `filter` - (Optional) Custom filter block as described below.
+
+More complex filters can be expressed using one or more `filter` sub-blocks,
+which take the following arguments:
+
+* `name` - (Required) Name of the field to filter by, as defined by
+  [the underlying AWS API](http://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeVpcs.html).
+
+* `values` - (Required) Set of values that are accepted for the given field.
+  A VPC will be selected if any one of the given values matches.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - AWS Region.
+* `ids` - List of all the VPC Ids found.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `20m`)
+
+<!-- cache-key: cdktf-0.18.0 input-be6a21066a3ec54cb0732f1d95589ca403b257a294348dbb989f92e860fb3744 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/vpn_gateway.html.markdown b/website/docs/cdktf/python/d/vpn_gateway.html.markdown
new file mode 100644
index 00000000000..51cce979f9d
--- /dev/null
+++ b/website/docs/cdktf/python/d/vpn_gateway.html.markdown
@@ -0,0 +1,81 @@
+---
+subcategory: "VPN (Site-to-Site)"
+layout: "aws"
+page_title: "AWS: aws_vpn_gateway"
+description: |-
+    Provides details about a specific VPN gateway.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_vpn_gateway
+
+The VPN Gateway data source provides details about
+a specific VPN gateway.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformOutput, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_vpn_gateway import DataAwsVpnGateway
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        selected = DataAwsVpnGateway(self, "selected",
+            filter=[DataAwsVpnGatewayFilter(
+                name="tag:Name",
+                values=["vpn-gw"]
+            )
+            ]
+        )
+        TerraformOutput(self, "vpn_gateway_id",
+            value=selected.id
+        )
+```
+
+## Argument Reference
+
+The arguments of this data source act as filters for querying the available VPN gateways.
+The given filters must match exactly one VPN gateway whose data will be exported as attributes.
+
+* `id` - (Optional) ID of the specific VPN Gateway to retrieve.
+
+* `state` - (Optional) State of the specific VPN Gateway to retrieve.
+
+* `availability_zone` - (Optional) Availability Zone of the specific VPN Gateway to retrieve.
+
+* `attached_vpc_id` - (Optional) ID of a VPC attached to the specific VPN Gateway to retrieve.
+
+* `filter` - (Optional) Custom filter block as described below.
+
+* `tags` - (Optional) Map of tags, each pair of which must exactly match
+  a pair on the desired VPN Gateway.
+
+* `amazon_side_asn` - (Optional) Autonomous System Number (ASN) for the Amazon side of the specific VPN Gateway to retrieve.
+
+More complex filters can be expressed using one or more `filter` sub-blocks,
+which take the following arguments:
+
+* `name` - (Required) Name of the field to filter by, as defined by
+  [the underlying AWS API](http://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeVpnGateways.html).
+
+* `values` - (Required) Set of values that are accepted for the given field.
+  A VPN Gateway will be selected if any one of the given values matches.
+
+## Attribute Reference
+
+All of the argument attributes are also exported as result attributes.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `20m`)
+
+<!-- cache-key: cdktf-0.18.0 input-201be9d39d8341a8d96efb3b53da93d78c8ce2b555effb2685f5ba9809677802 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/waf_ipset.html.markdown b/website/docs/cdktf/python/d/waf_ipset.html.markdown
new file mode 100644
index 00000000000..3d8366eb98c
--- /dev/null
+++ b/website/docs/cdktf/python/d/waf_ipset.html.markdown
@@ -0,0 +1,46 @@
+---
+subcategory: "WAF Classic"
+layout: "aws"
+page_title: "AWS: aws_waf_ipset"
+description: |-
+  Retrieves an AWS WAF IP set id.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_waf_ipset
+
+`aws_waf_ipset` Retrieves a WAF IP Set Resource Id.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_waf_ipset import DataAwsWafIpset
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsWafIpset(self, "example",
+            name="tfWAFIPSet"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name of the WAF IP set.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the WAF IP set.
+
+<!-- cache-key: cdktf-0.18.0 input-94305640b0471bb774be2d17cd0306bf77a551e4516c629668c09de87293f751 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/waf_rate_based_rule.html.markdown b/website/docs/cdktf/python/d/waf_rate_based_rule.html.markdown
new file mode 100644
index 00000000000..3ce974f8803
--- /dev/null
+++ b/website/docs/cdktf/python/d/waf_rate_based_rule.html.markdown
@@ -0,0 +1,46 @@
+---
+subcategory: "WAF Classic"
+layout: "aws"
+page_title: "AWS: aws_waf_rate_based_rule"
+description: |-
+  Retrieves an AWS WAF rate based rule id.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_waf_rate_based_rule
+
+`aws_waf_rate_based_rule` Retrieves a WAF Rate Based Rule Resource Id.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_waf_rate_based_rule import DataAwsWafRateBasedRule
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsWafRateBasedRule(self, "example",
+            name="tfWAFRateBasedRule"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name of the WAF rate based rule.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the WAF rate based rule.
+
+<!-- cache-key: cdktf-0.18.0 input-1b97312af7abdeb1a6510cdfa99485977c9509827c5322840ee31acdc07433ed -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/waf_rule.html.markdown b/website/docs/cdktf/python/d/waf_rule.html.markdown
new file mode 100644
index 00000000000..73aa4ee11f9
--- /dev/null
+++ b/website/docs/cdktf/python/d/waf_rule.html.markdown
@@ -0,0 +1,46 @@
+---
+subcategory: "WAF Classic"
+layout: "aws"
+page_title: "AWS: aws_waf_rule"
+description: |-
+  Retrieves an AWS WAF rule id.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_waf_rule
+
+`aws_waf_rule` Retrieves a WAF Rule Resource Id.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_waf_rule import DataAwsWafRule
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsWafRule(self, "example",
+            name="tfWAFRule"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name of the WAF rule.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the WAF rule.
+
+<!-- cache-key: cdktf-0.18.0 input-622f6e79a1da04607bbd486ece4ccfcdc4d3399df37f97810cbcfe6990f9931d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/waf_subscribed_rule_group.html.markdown b/website/docs/cdktf/python/d/waf_subscribed_rule_group.html.markdown
new file mode 100644
index 00000000000..caea275964d
--- /dev/null
+++ b/website/docs/cdktf/python/d/waf_subscribed_rule_group.html.markdown
@@ -0,0 +1,66 @@
+---
+subcategory: "WAF Classic"
+layout: "aws"
+page_title: "AWS: aws_waf_subscribed_rule_group"
+description: |-
+  Retrieves information about a Managed WAF Rule Group from AWS Marketplace.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_waf_rule
+
+`aws_waf_subscribed_rule_group` retrieves information about a Managed WAF Rule Group from AWS Marketplace (needs to be subscribed to first).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_waf_subscribed_rule_group import DataAwsWafSubscribedRuleGroup
+from imports.aws.waf_web_acl import WafWebAcl
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, defaultAction, metricName, name):
+        super().__init__(scope, name)
+        by_metric_name = DataAwsWafSubscribedRuleGroup(self, "by_metric_name",
+            metric_name="F5BotDetectionSignatures"
+        )
+        by_name = DataAwsWafSubscribedRuleGroup(self, "by_name",
+            name="F5 Bot Detection Signatures For AWS WAF"
+        )
+        WafWebAcl(self, "acl",
+            rules=[WafWebAclRules(
+                priority=1,
+                rule_id=Token.as_string(by_name.id),
+                type="GROUP"
+            ), WafWebAclRules(
+                priority=2,
+                rule_id=Token.as_string(by_metric_name.id),
+                type="GROUP"
+            )
+            ],
+            default_action=default_action,
+            metric_name=metric_name,
+            name=name
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments: (at least one needs to be specified)
+
+* `name` - (Optional) Name of the WAF rule group.
+* `metric_name` - (Optional) Name of the WAF rule group.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the WAF rule group.
+
+<!-- cache-key: cdktf-0.18.0 input-00a62e9c864ee7ccf92e3ef224d8f2eba8db0a1386389825ac9c6ed11e482193 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/waf_web_acl.html.markdown b/website/docs/cdktf/python/d/waf_web_acl.html.markdown
new file mode 100644
index 00000000000..4f80303f7cf
--- /dev/null
+++ b/website/docs/cdktf/python/d/waf_web_acl.html.markdown
@@ -0,0 +1,46 @@
+---
+subcategory: "WAF Classic"
+layout: "aws"
+page_title: "AWS: aws_waf_web_acl"
+description: |-
+  Retrieves a WAF Web ACL id.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_waf_web_acl
+
+`aws_waf_web_acl` Retrieves a WAF Web ACL Resource Id.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_waf_web_acl import DataAwsWafWebAcl
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsWafWebAcl(self, "example",
+            name="tfWAFWebACL"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name of the WAF Web ACL.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the WAF Web ACL.
+
+<!-- cache-key: cdktf-0.18.0 input-d097cc64235699a72862520fb07194eebd805ec1ae4dcf4ceff43f0fb78e0e97 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/wafregional_ipset.html.markdown b/website/docs/cdktf/python/d/wafregional_ipset.html.markdown
new file mode 100644
index 00000000000..4f7790ea8cf
--- /dev/null
+++ b/website/docs/cdktf/python/d/wafregional_ipset.html.markdown
@@ -0,0 +1,46 @@
+---
+subcategory: "WAF Classic Regional"
+layout: "aws"
+page_title: "AWS: aws_wafregional_ipset"
+description: |-
+  Retrieves an AWS WAF Regional IP set id.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_wafregional_ipset
+
+`aws_wafregional_ipset` Retrieves a WAF Regional IP Set Resource Id.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_wafregional_ipset import DataAwsWafregionalIpset
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsWafregionalIpset(self, "example",
+            name="tfWAFRegionalIPSet"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name of the WAF Regional IP set.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the WAF Regional IP set.
+
+<!-- cache-key: cdktf-0.18.0 input-664f0bcba2f0944a9bce4e4470bb1ca32f51d08df3ea85f50476a45145d90105 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/wafregional_rate_based_rule.html.markdown b/website/docs/cdktf/python/d/wafregional_rate_based_rule.html.markdown
new file mode 100644
index 00000000000..574e5c1c9e0
--- /dev/null
+++ b/website/docs/cdktf/python/d/wafregional_rate_based_rule.html.markdown
@@ -0,0 +1,46 @@
+---
+subcategory: "WAF Classic Regional"
+layout: "aws"
+page_title: "AWS: aws_wafregional_rate_based_rule"
+description: |-
+  Retrieves an AWS WAF Regional rate based rule id.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_wafregional_rate_based_rule
+
+`aws_wafregional_rate_based_rule` Retrieves a WAF Regional Rate Based Rule Resource Id.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_wafregional_rate_based_rule import DataAwsWafregionalRateBasedRule
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsWafregionalRateBasedRule(self, "example",
+            name="tfWAFRegionalRateBasedRule"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name of the WAF Regional rate based rule.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the WAF Regional rate based rule.
+
+<!-- cache-key: cdktf-0.18.0 input-4efc48cfee1f2c7a8f4f34e4fbb2f4523a05a710c88547ac3014e9d0ff52a993 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/wafregional_rule.html.markdown b/website/docs/cdktf/python/d/wafregional_rule.html.markdown
new file mode 100644
index 00000000000..d90f5feede9
--- /dev/null
+++ b/website/docs/cdktf/python/d/wafregional_rule.html.markdown
@@ -0,0 +1,46 @@
+---
+subcategory: "WAF Classic Regional"
+layout: "aws"
+page_title: "AWS: aws_wafregional_rule"
+description: |-
+  Retrieves an AWS WAF Regional rule id.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_wafregional_rule
+
+`aws_wafregional_rule` Retrieves a WAF Regional Rule Resource Id.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_wafregional_rule import DataAwsWafregionalRule
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsWafregionalRule(self, "example",
+            name="tfWAFRegionalRule"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name of the WAF Regional rule.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the WAF Regional rule.
+
+<!-- cache-key: cdktf-0.18.0 input-8d1cf5dbf5c7c6a32f1f53f110f8770eb6472cb6316958e0e40be72dbcb9dad8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/wafregional_subscribed_rule_group.html.markdown b/website/docs/cdktf/python/d/wafregional_subscribed_rule_group.html.markdown
new file mode 100644
index 00000000000..46c25e38fe7
--- /dev/null
+++ b/website/docs/cdktf/python/d/wafregional_subscribed_rule_group.html.markdown
@@ -0,0 +1,66 @@
+---
+subcategory: "WAF Classic Regional"
+layout: "aws"
+page_title: "AWS: aws_wafregional_subscribed_rule_group"
+description: |-
+  retrieves information about a Managed WAF Rule Group from AWS Marketplace for use in WAF Regional.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_wafregional_rule
+
+`aws_wafregional_subscribed_rule_group` retrieves information about a Managed WAF Rule Group from AWS Marketplace for use in WAF Regional (needs to be subscribed to first).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_wafregional_subscribed_rule_group import DataAwsWafregionalSubscribedRuleGroup
+from imports.aws.wafregional_web_acl import WafregionalWebAcl
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, defaultAction, metricName, name):
+        super().__init__(scope, name)
+        by_metric_name = DataAwsWafregionalSubscribedRuleGroup(self, "by_metric_name",
+            metric_name="F5BotDetectionSignatures"
+        )
+        by_name = DataAwsWafregionalSubscribedRuleGroup(self, "by_name",
+            name="F5 Bot Detection Signatures For AWS WAF"
+        )
+        WafregionalWebAcl(self, "acl",
+            rules=[{
+                "priority": 1,
+                "rule_id": by_name.id,
+                "type": "GROUP"
+            }, {
+                "priority": 2,
+                "rule_id": by_metric_name.id,
+                "type": "GROUP"
+            }
+            ],
+            default_action=default_action,
+            metric_name=metric_name,
+            name=name
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments: (at least one needs to be specified)
+
+* `name` - (Optional) Name of the WAF rule group.
+* `metric_name` - (Optional) Name of the WAF rule group.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the WAF rule group.
+
+<!-- cache-key: cdktf-0.18.0 input-bb4b16d18b71e8e90027f29acab3911274775d639a6a27d7a70acb9c6cfb5569 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/wafregional_web_acl.html.markdown b/website/docs/cdktf/python/d/wafregional_web_acl.html.markdown
new file mode 100644
index 00000000000..cba822ef0fb
--- /dev/null
+++ b/website/docs/cdktf/python/d/wafregional_web_acl.html.markdown
@@ -0,0 +1,46 @@
+---
+subcategory: "WAF Classic Regional"
+layout: "aws"
+page_title: "AWS: aws_wafregional_web_acl"
+description: |-
+  Retrieves a WAF Regional Web ACL id.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_wafregional_web_acl
+
+`aws_wafregional_web_acl` Retrieves a WAF Regional Web ACL Resource Id.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_wafregional_web_acl import DataAwsWafregionalWebAcl
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsWafregionalWebAcl(self, "example",
+            name="tfWAFRegionalWebACL"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name of the WAF Regional Web ACL.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the WAF Regional Web ACL.
+
+<!-- cache-key: cdktf-0.18.0 input-fa2b1a2433b2bd1f14d1f64ae7fa9b7121ac9bea96e36f12426b78a220709ce6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/wafv2_ip_set.html.markdown b/website/docs/cdktf/python/d/wafv2_ip_set.html.markdown
new file mode 100644
index 00000000000..7d966d91aa4
--- /dev/null
+++ b/website/docs/cdktf/python/d/wafv2_ip_set.html.markdown
@@ -0,0 +1,52 @@
+---
+subcategory: "WAF"
+layout: "aws"
+page_title: "AWS: aws_wafv2_ip_set"
+description: |-
+  Retrieves the summary of a WAFv2 IP Set.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_wafv2_ip_set
+
+Retrieves the summary of a WAFv2 IP Set.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_wafv2_ip_set import DataAwsWafv2IpSet
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsWafv2IpSet(self, "example",
+            name="some-ip-set",
+            scope="REGIONAL"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name of the WAFv2 IP Set.
+* `scope` - (Required) Specifies whether this is for an AWS CloudFront distribution or for a regional application. Valid values are `CLOUDFRONT` or `REGIONAL`. To work with CloudFront, you must also specify the region `us-east-1` (N. Virginia) on the AWS provider.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `addresses` - An array of strings that specifies zero or more IP addresses or blocks of IP addresses in Classless Inter-Domain Routing (CIDR) notation.
+* `arn` - ARN of the entity.
+* `description` - Description of the set that helps with identification.
+* `id` - Unique identifier for the set.
+* `ip_address_version` - IP address version of the set.
+
+<!-- cache-key: cdktf-0.18.0 input-d7ec9696daa356516487e670fd980b4d44f0e307cfc20630bd6d1fb8fc4322b0 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/wafv2_regex_pattern_set.html.markdown b/website/docs/cdktf/python/d/wafv2_regex_pattern_set.html.markdown
new file mode 100644
index 00000000000..6e427375f6f
--- /dev/null
+++ b/website/docs/cdktf/python/d/wafv2_regex_pattern_set.html.markdown
@@ -0,0 +1,57 @@
+---
+subcategory: "WAF"
+layout: "aws"
+page_title: "AWS: aws_wafv2_regex_pattern_set"
+description: |-
+  Retrieves the summary of a WAFv2 Regex Pattern Set.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_wafv2_regex_pattern_set
+
+Retrieves the summary of a WAFv2 Regex Pattern Set.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_wafv2_regex_pattern_set import DataAwsWafv2RegexPatternSet
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsWafv2RegexPatternSet(self, "example",
+            name="some-regex-pattern-set",
+            scope="REGIONAL"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name of the WAFv2 Regex Pattern Set.
+* `scope` - (Required) Specifies whether this is for an AWS CloudFront distribution or for a regional application. Valid values are `CLOUDFRONT` or `REGIONAL`. To work with CloudFront, you must also specify the region `us-east-1` (N. Virginia) on the AWS provider.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the entity.
+* `description` - Description of the set that helps with identification.
+* `id` - Unique identifier for the set.
+* `regular_expression` - One or more blocks of regular expression patterns that AWS WAF is searching for. See [Regular Expression](#regular-expression) below for details.
+
+### Regular Expression
+
+Each `regular_expression` supports the following argument:
+
+* `regex_string` - (Required) String representing the regular expression, see the AWS WAF [documentation](https://docs.aws.amazon.com/waf/latest/developerguide/waf-regex-pattern-set-creating.html) for more information.
+
+<!-- cache-key: cdktf-0.18.0 input-a646ff63f23c77b2e1c1477a070043fec306e7b9d0c94cd6c0f0b67fafdb28da -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/wafv2_rule_group.html.markdown b/website/docs/cdktf/python/d/wafv2_rule_group.html.markdown
new file mode 100644
index 00000000000..5e71dbf9d25
--- /dev/null
+++ b/website/docs/cdktf/python/d/wafv2_rule_group.html.markdown
@@ -0,0 +1,50 @@
+---
+subcategory: "WAF"
+layout: "aws"
+page_title: "AWS: aws_wafv2_rule_group"
+description: |-
+  Retrieves the summary of a WAFv2 Rule Group.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_wafv2_rule_group
+
+Retrieves the summary of a WAFv2 Rule Group.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_wafv2_rule_group import DataAwsWafv2RuleGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsWafv2RuleGroup(self, "example",
+            name="some-rule-group",
+            scope="REGIONAL"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name of the WAFv2 Rule Group.
+* `scope` - (Required) Specifies whether this is for an AWS CloudFront distribution or for a regional application. Valid values are `CLOUDFRONT` or `REGIONAL`. To work with CloudFront, you must also specify the region `us-east-1` (N. Virginia) on the AWS provider.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the entity.
+* `description` - Description of the rule group that helps with identification.
+* `id` - Unique identifier of the rule group.
+
+<!-- cache-key: cdktf-0.18.0 input-4de733ef434bbfbe5aa4d54ed8db1f5e78db59b5a79986eddb88c9cc5144e9ca -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/wafv2_web_acl.html.markdown b/website/docs/cdktf/python/d/wafv2_web_acl.html.markdown
new file mode 100644
index 00000000000..f39798139e8
--- /dev/null
+++ b/website/docs/cdktf/python/d/wafv2_web_acl.html.markdown
@@ -0,0 +1,50 @@
+---
+subcategory: "WAF"
+layout: "aws"
+page_title: "AWS: aws_wafv2_web_acl"
+description: |-
+  Retrieves the summary of a WAFv2 Web ACL.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_wafv2_web_acl
+
+Retrieves the summary of a WAFv2 Web ACL.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_wafv2_web_acl import DataAwsWafv2WebAcl
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsWafv2WebAcl(self, "example",
+            name="some-web-acl",
+            scope="REGIONAL"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name of the WAFv2 Web ACL.
+* `scope` - (Required) Specifies whether this is for an AWS CloudFront distribution or for a regional application. Valid values are `CLOUDFRONT` or `REGIONAL`. To work with CloudFront, you must also specify the region `us-east-1` (N. Virginia) on the AWS provider.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the entity.
+* `description` - Description of the WebACL that helps with identification.
+* `id` - Unique identifier of the WebACL.
+
+<!-- cache-key: cdktf-0.18.0 input-af626ac3c0fee58373df42af4a4ea59647ddfb9c8a5feb783fe3c2a90de2da07 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/workspaces_bundle.html.markdown b/website/docs/cdktf/python/d/workspaces_bundle.html.markdown
new file mode 100644
index 00000000000..de8c2970023
--- /dev/null
+++ b/website/docs/cdktf/python/d/workspaces_bundle.html.markdown
@@ -0,0 +1,88 @@
+---
+subcategory: "WorkSpaces"
+layout: "aws"
+page_title: "AWS: aws_workspaces_bundle"
+description: |-
+  Retrieve information about an AWS WorkSpaces bundle.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_workspaces_bundle
+
+Retrieve information about an AWS WorkSpaces bundle.
+
+## Example Usage
+
+### By ID
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_workspaces_bundle import DataAwsWorkspacesBundle
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsWorkspacesBundle(self, "example",
+            bundle_id="wsb-b0s22j3d7"
+        )
+```
+
+### By Owner & Name
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_workspaces_bundle import DataAwsWorkspacesBundle
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsWorkspacesBundle(self, "example",
+            name="Value with Windows 10 and Office 2016",
+            owner="AMAZON"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `bundle_id` – (Optional) ID of the bundle.
+* `owner` – (Optional) Owner of the bundles. You have to leave it blank for own bundles. You cannot combine this parameter with `bundle_id`.
+* `name` – (Optional) Name of the bundle. You cannot combine this parameter with `bundle_id`.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `description` – The description of the bundle.
+* `bundle_id` – The ID of the bundle.
+* `name` – The name of the bundle.
+* `owner` – The owner of the bundle.
+* `compute_type` – The compute type. See supported fields below.
+* `root_storage` – The root volume. See supported fields below.
+* `user_storage` – The user storage. See supported fields below.
+
+### `compute_type`
+
+* `name` - Name of the compute type.
+
+### `root_storage`
+
+* `capacity` - Size of the root volume.
+
+### `user_storage`
+
+* `capacity` - Size of the user storage.
+
+<!-- cache-key: cdktf-0.18.0 input-fa51236e05e24e0256f2207788b1148c2c3ccab79c92b51106d255e1b69a9e3d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/workspaces_directory.html.markdown b/website/docs/cdktf/python/d/workspaces_directory.html.markdown
new file mode 100644
index 00000000000..721dba79460
--- /dev/null
+++ b/website/docs/cdktf/python/d/workspaces_directory.html.markdown
@@ -0,0 +1,85 @@
+---
+subcategory: "WorkSpaces"
+layout: "aws"
+page_title: "AWS: aws_workspaces_directory"
+description: |-
+  Retrieve information about an AWS WorkSpaces directory.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_workspaces_directory
+
+Retrieve information about an AWS WorkSpaces directory.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_workspaces_directory import DataAwsWorkspacesDirectory
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsWorkspacesDirectory(self, "example",
+            directory_id="d-9067783251"
+        )
+```
+
+## Argument Reference
+
+* `directory_id` - (Required) Directory identifier for registration in WorkSpaces service.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - WorkSpaces directory identifier.
+* `alias` - Directory alias.
+* `customer_user_name` - User name for the service account.
+* `directory_name` - Name of the directory.
+* `directory_type` - Directory type.
+* `dns_ip_addresses` - IP addresses of the DNS servers for the directory.
+* `iam_role_id` - Identifier of the IAM role. This is the role that allows Amazon WorkSpaces to make calls to other services, such as Amazon EC2, on your behalf.
+* `ip_group_ids` - Identifiers of the IP access control groups associated with the directory.
+* `registration_code` - Registration code for the directory. This is the code that users enter in their Amazon WorkSpaces client application to connect to the directory.
+* `self_service_permissions` – The permissions to enable or disable self-service capabilities.
+* `subnet_ids` - Identifiers of the subnets where the directory resides.
+* `tags` – A map of tags assigned to the WorkSpaces directory.
+* `workspace_creation_properties` – The default properties that are used for creating WorkSpaces. Defined below.
+* `workspace_access_properties` – (Optional) Specifies which devices and operating systems users can use to access their WorkSpaces. Defined below.
+* `workspace_security_group_id` - The identifier of the security group that is assigned to new WorkSpaces. Defined below.
+
+### self_service_permissions
+
+* `change_compute_type` – Whether WorkSpaces directory users can change the compute type (bundle) for their workspace.
+* `increase_volume_size` – Whether WorkSpaces directory users can increase the volume size of the drives on their workspace.
+* `rebuild_workspace` – Whether WorkSpaces directory users can rebuild the operating system of a workspace to its original state.
+* `restart_workspace` – Whether WorkSpaces directory users can restart their workspace.
+* `switch_running_mode` – Whether WorkSpaces directory users can switch the running mode of their workspace.
+
+### workspace_access_properties
+
+* `device_type_android` – (Optional) Indicates whether users can use Android devices to access their WorkSpaces.
+* `device_type_chromeos` – (Optional) Indicates whether users can use Chromebooks to access their WorkSpaces.
+* `device_type_ios` – (Optional) Indicates whether users can use iOS devices to access their WorkSpaces.
+* `device_type_linux` – (Optional) Indicates whether users can use Linux clients to access their WorkSpaces.
+* `device_type_osx` – (Optional) Indicates whether users can use macOS clients to access their WorkSpaces.
+* `device_type_web` – (Optional) Indicates whether users can access their WorkSpaces through a web browser.
+* `device_type_windows` – (Optional) Indicates whether users can use Windows clients to access their WorkSpaces.
+* `device_type_zeroclient` – (Optional) Indicates whether users can use zero client devices to access their WorkSpaces.
+
+### workspace_creation_properties
+
+* `custom_security_group_id` – The identifier of your custom security group. Should relate to the same VPC, where workspaces reside in.
+* `default_ou` – The default organizational unit (OU) for your WorkSpace directories.
+* `enable_internet_access` – Indicates whether internet access is enabled for your WorkSpaces.
+* `enable_maintenance_mode` – Indicates whether maintenance mode is enabled for your WorkSpaces. For more information, see [WorkSpace Maintenance](https://docs.aws.amazon.com/workspaces/latest/adminguide/workspace-maintenance.html).
+* `user_enabled_as_local_administrator` – Indicates whether users are local administrators of their WorkSpaces.
+
+<!-- cache-key: cdktf-0.18.0 input-b94343197f46538817cb6fbc22fc3a4b2fd2b6a8ee88d85032acad20463566b5 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/workspaces_image.html.markdown b/website/docs/cdktf/python/d/workspaces_image.html.markdown
new file mode 100644
index 00000000000..970a3c4bd81
--- /dev/null
+++ b/website/docs/cdktf/python/d/workspaces_image.html.markdown
@@ -0,0 +1,50 @@
+---
+subcategory: "WorkSpaces"
+layout: "aws"
+page_title: "AWS: aws_workspaces_image"
+description: |-
+  Get information about Workspaces image.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_workspaces_image
+
+Use this data source to get information about a Workspaces image.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_workspaces_image import DataAwsWorkspacesImage
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsWorkspacesImage(self, "example",
+            image_id="wsi-ten5h0y19"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `image_id` – (Required) ID of the image.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `name` – The name of the image.
+* `description` – The description of the image.
+* `os` – The operating system that the image is running.
+* `required_tenancy` – Specifies whether the image is running on dedicated hardware. When Bring Your Own License (BYOL) is enabled, this value is set to DEDICATED. For more information, see [Bring Your Own Windows Desktop Images](https://docs.aws.amazon.com/workspaces/latest/adminguide/byol-windows-images.html).
+* `state` – The status of the image.
+
+<!-- cache-key: cdktf-0.18.0 input-e175478c435ceea20dd9a0b224e5ca9b6f41172a6466e59421b4cd7412f5f83d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/d/workspaces_workspace.html.markdown b/website/docs/cdktf/python/d/workspaces_workspace.html.markdown
new file mode 100644
index 00000000000..ce8009314a6
--- /dev/null
+++ b/website/docs/cdktf/python/d/workspaces_workspace.html.markdown
@@ -0,0 +1,87 @@
+---
+subcategory: "WorkSpaces"
+layout: "aws"
+page_title: "AWS: aws_workspaces_workspace"
+description: |-
+  Get information about a WorkSpace in AWS Workspaces Service.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_workspaces_workspace
+
+Use this data source to get information about a workspace in [AWS Workspaces](https://docs.aws.amazon.com/workspaces/latest/adminguide/amazon-workspaces.html) Service.
+
+## Example Usage
+
+### Filter By Workspace ID
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_workspaces_workspace import DataAwsWorkspacesWorkspace
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsWorkspacesWorkspace(self, "example",
+            workspace_id="ws-cj5xcxsz5"
+        )
+```
+
+### Filter By Directory ID & User Name
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_workspaces_workspace import DataAwsWorkspacesWorkspace
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsWorkspacesWorkspace(self, "example",
+            directory_id="d-9967252f57",
+            user_name="Example"
+        )
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `bundle_id` - (Optional) ID of the bundle for the WorkSpace.
+* `directory_id` - (Optional) ID of the directory for the WorkSpace. You have to specify `user_name` along with `directory_id`. You cannot combine this parameter with `workspace_id`.
+* `root_volume_encryption_enabled` - (Optional) Indicates whether the data stored on the root volume is encrypted.
+* `tags` - (Optional) Tags for the WorkSpace.
+* `user_name` – (Optional) User name of the user for the WorkSpace. This user name must exist in the directory for the WorkSpace. You cannot combine this parameter with `workspace_id`.
+* `user_volume_encryption_enabled` – (Optional) Indicates whether the data stored on the user volume is encrypted.
+* `volume_encryption_key` – (Optional) Symmetric AWS KMS customer master key (CMK) used to encrypt data stored on your WorkSpace. Amazon WorkSpaces does not support asymmetric CMKs.
+* `workspace_id` - (Optional) ID of the WorkSpace. You cannot combine this parameter with `directory_id`.
+* `workspace_properties` – (Optional) WorkSpace properties.
+
+`workspace_properties` supports the following:
+
+* `compute_type_name` – (Optional) Compute type. For more information, see [Amazon WorkSpaces Bundles](http://aws.amazon.com/workspaces/details/#Amazon_WorkSpaces_Bundles). Valid values are `VALUE`, `STANDARD`, `PERFORMANCE`, `POWER`, `GRAPHICS`, `POWERPRO` and `GRAPHICSPRO`.
+* `root_volume_size_gib` – (Optional) Size of the root volume.
+* `running_mode` – (Optional) Running mode. For more information, see [Manage the WorkSpace Running Mode](https://docs.aws.amazon.com/workspaces/latest/adminguide/running-mode.html). Valid values are `AUTO_STOP` and `ALWAYS_ON`.
+* `running_mode_auto_stop_timeout_in_minutes` – (Optional) Time after a user logs off when WorkSpaces are automatically stopped. Configured in 60-minute intervals.
+* `user_volume_size_gib` – (Optional) Size of the user storage.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - Workspaces ID.
+* `ip_address` - IP address of the WorkSpace.
+* `computer_name` - Name of the WorkSpace, as seen by the operating system.
+* `state` - Operational state of the WorkSpace.
+
+<!-- cache-key: cdktf-0.18.0 input-e3b5b66bcfd6093ee222bffc5ccc77c7abda6688fc2aaac99be169c6d22b80cf -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/guides/continuous-validation-examples.html.markdown b/website/docs/cdktf/python/guides/continuous-validation-examples.html.markdown
new file mode 100644
index 00000000000..aeb00cf6220
--- /dev/null
+++ b/website/docs/cdktf/python/guides/continuous-validation-examples.html.markdown
@@ -0,0 +1,110 @@
+---
+subcategory: ""
+layout: "aws"
+page_title: "Using Terraform Cloud's Continuous Validation feature with the AWS Provider"
+description: |-
+  Using Terraform Cloud's Continuous Validation feature with the AWS Provider
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Using Terraform Cloud's Continuous Validation feature with the AWS Provider
+
+## Continuous Validation in Terraform Cloud
+
+The Continuous Validation feature in Terraform Cloud (TFC) allows users to make assertions about their infrastructure between applied runs. This helps users to identify issues at the time they first appear and avoid situations where a change is only identified once it causes a customer-facing problem.
+
+Users can add checks to their Terraform configuration using check blocks. Check blocks contain assertions that are defined with a custom condition expression and an error message. When the condition expression evaluates to true the check passes, but when the expression evaluates to false Terraform will show a warning message that includes the user-defined error message.
+
+Custom conditions can be created using data from Terraform providers’ resources and data sources. Data can also be combined from multiple sources; for example, you can use checks to monitor expirable resources by comparing a resource’s expiration date attribute to the current time returned by Terraform’s built-in time functions.
+
+Below, this guide shows examples of how data returned by the AWS provider can be used to define checks in your Terraform configuration.
+
+## Example - Ensure your AWS account is within budget (aws_budgets_budget)
+
+AWS Budgets allows you to track and take action on your AWS costs and usage. You can use AWS Budgets to monitor your aggregate utilization and coverage metrics for your Reserved Instances (RIs) or Savings Plans.
+
+- You can use AWS Budgets to enable simple-to-complex cost and usage tracking. Some examples include:
+
+- Setting a monthly cost budget with a fixed target amount to track all costs associated with your account.
+
+- Setting a monthly cost budget with a variable target amount, with each subsequent month growing the budget target by 5 percent.
+
+- Setting a monthly usage budget with a fixed usage amount and forecasted notifications to help ensure that you are staying within the service limits for a specific service.
+
+- Setting a daily utilization or coverage budget to track your RI or Savings Plans.
+
+The example below shows how a check block can be used to assert that you remain in compliance for the budgets that have been established.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+If the budget exceeds the set limit, the check block assertion will return a warning similar to the following:
+
+```
+│ Warning: Check block assertion failed
+│ 
+│   on main.tf line 43, in check "check_budget_exceeded":
+│   43:     condition = !data.aws_budgets_budget.example.budget_exceeded
+│     ├────────────────
+│     │ data.aws_budgets_budget.example.budget_exceeded is true
+│ 
+│ AWS budget has been exceeded! Calculated spend: '1550.0' and budget limit: '1200.0'
+```
+
+## Example - Check GuardDuty for Threats (aws_guardduty_finding_ids)
+
+Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior to protect your Amazon Web Services accounts, workloads, and data stored in Amazon S3. With the cloud, the collection and aggregation of account and network activities is simplified, but it can be time consuming for security teams to continuously analyze event log data for potential threats. With GuardDuty, you now have an intelligent and cost-effective option for continuous threat detection in Amazon Web Services Cloud.
+
+The following example outlines how a check block can be utilized to assert that no threats have been identified from AWS GuardDuty.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_guardduty_detector import DataAwsGuarddutyDetector
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsGuarddutyDetector(self, "example")
+```
+
+If findings are present, the check block assertion will return a warning similar to the following:
+
+```
+│ Warning: Check block assertion failed
+│
+│   on main.tf line 24, in check "check_guardduty_findings":
+│   24:     condition = !data.aws_guardduty_finding_ids.example.has_findings
+│     ├────────────────
+│     │ data.aws_guardduty_finding_ids.example.has_findings is true
+│
+│ AWS GuardDuty detector 'abcdef123456' has 9 open findings!
+```
+
+## Example - Check for unused IAM roles (aws_iam_role)
+
+AWS IAM tracks role usage, including the [last used date and region](https://docs.aws.amazon.com/IAM/latest/APIReference/API_RoleLastUsed.html). This information is returned  with the [`aws_iam_role`](../d/iam_role.html.markdown) data source, and can be used in continuous validation to check for unused roles. AWS reports activity for the trailing 400 days. If a role is unused within that period, the `last_used_date` will be an empty string (`""`).
+
+In the example below, the [`timecmp`](https://developer.hashicorp.com/terraform/language/functions/timecmp) function checks for a `last_used_date` more recent than the `unused_limit` local variable (30 days ago). The [`coalesce`](https://developer.hashicorp.com/terraform/language/functions/coalesce) function handles empty (`""`) `last_used_date` values safely, falling back to the `unused_limit` local, and automatically triggering a failed condition.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+<!-- cache-key: cdktf-0.18.0 input-46cf0803d4873a7572320ffe73a6975a74714c2428be20d68b32324329284129 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/guides/custom-service-endpoints.html.markdown b/website/docs/cdktf/python/guides/custom-service-endpoints.html.markdown
new file mode 100644
index 00000000000..b058d10ec90
--- /dev/null
+++ b/website/docs/cdktf/python/guides/custom-service-endpoints.html.markdown
@@ -0,0 +1,401 @@
+---
+subcategory: ""
+layout: "aws"
+page_title: "Terraform AWS Provider Custom Service Endpoint Configuration"
+description: |-
+  Configuring the Terraform AWS Provider to connect to custom AWS service endpoints and AWS compatible solutions.
+---
+
+<!-- Generated by internal/generate/customends/main.go; DO NOT EDIT. -->
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Custom Service Endpoint Configuration
+
+The Terraform AWS Provider configuration can be customized to connect to non-default AWS service endpoints and AWS compatible solutions. This may be useful for environments with specific compliance requirements, such as using [AWS FIPS 140-2 endpoints](https://aws.amazon.com/compliance/fips/), connecting to AWS Snowball, SC2S, or C2S environments, or local testing.
+
+This guide outlines how to get started with customizing endpoints, the available endpoint configurations, and offers example configurations for working with certain local development and testing solutions.
+
+~> **NOTE:** Support for connecting the Terraform AWS Provider with custom endpoints and AWS compatible solutions is offered as best effort. Individual Terraform resources may require compatibility updates to work in certain environments. Integration testing by HashiCorp during provider changes is exclusively done against default AWS endpoints at this time.
+
+<!-- TOC depthFrom:2 -->
+
+- [Getting Started with Custom Endpoints](#getting-started-with-custom-endpoints)
+- [Available Endpoint Customizations](#available-endpoint-customizations)
+- [Connecting to Local AWS Compatible Solutions](#connecting-to-local-aws-compatible-solutions)
+    - [DynamoDB Local](#dynamodb-local)
+    - [LocalStack](#localstack)
+
+<!-- /TOC -->
+
+## Getting Started with Custom Endpoints
+
+To configure the Terraform AWS Provider to use customized endpoints, it can be done within `provider` declarations using the `endpoints` configuration block, e.g.,
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.provider import AwsProvider
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AwsProvider(self, "aws",
+            endpoints=[AwsProviderEndpoints(
+                dynamodb="http://localhost:4569",
+                s3="http://localhost:4572"
+            )
+            ]
+        )
+```
+
+If multiple, different Terraform AWS Provider configurations are required, see the [Terraform documentation on multiple provider instances](https://www.terraform.io/docs/configuration/providers.html#alias-multiple-provider-instances) for additional information about the `alias` provider configuration and its usage.
+
+## Available Endpoint Customizations
+
+The Terraform AWS Provider allows the following endpoints to be customized.
+
+**Note:** The Provider allows some service endpoints to be customized despite not supporting those services.
+
+**Note:** For backward compatibility, some endpoints can be assigned using multiple service "keys" (_e.g._, `dms`, `databasemigration`, or `databasemigrationservice`). If you use more than one equivalent service key in your configuration, the provider will use the _first_ endpoint value set. For example, in the configuration below we have set the DMS service endpoints using both `dms` and `databasemigration`. The provider will set the endpoint to whichever appears first. Subsequent values are ignored.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.provider import AwsProvider
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AwsProvider(self, "aws",
+            endpoints=[AwsProviderEndpoints(
+                databasemigration="http://this.value.will.be.ignored.com",
+                dms="http://this.value.will.be.used.com"
+            )
+            ]
+        )
+```
+
+<!-- markdownlint-disable no-inline-html -->
+<!--
+    The division splits this long list into multiple columns without manually
+    maintaining a table. The terraform.io Markdown parser previously allowed
+    for Markdown within HTML elements, however the Terraform Registry parser
+    is more accurate/strict, so we use raw HTML to maintain this list.
+-->
+<!-- Generated by internal/generate/customends/main.go; DO NOT EDIT. -->
+<div style="column-width: 14em;">
+<ul>
+  <li><code>accessanalyzer</code></li>
+  <li><code>account</code></li>
+  <li><code>acm</code></li>
+  <li><code>acmpca</code></li>
+  <li><code>amp</code> (or <code>prometheus</code> or <code>prometheusservice</code>)</li>
+  <li><code>amplify</code></li>
+  <li><code>apigateway</code></li>
+  <li><code>apigatewayv2</code></li>
+  <li><code>appautoscaling</code> (or <code>applicationautoscaling</code>)</li>
+  <li><code>appconfig</code></li>
+  <li><code>appflow</code></li>
+  <li><code>appintegrations</code> (or <code>appintegrationsservice</code>)</li>
+  <li><code>applicationinsights</code></li>
+  <li><code>appmesh</code></li>
+  <li><code>apprunner</code></li>
+  <li><code>appstream</code></li>
+  <li><code>appsync</code></li>
+  <li><code>athena</code></li>
+  <li><code>auditmanager</code></li>
+  <li><code>autoscaling</code></li>
+  <li><code>autoscalingplans</code></li>
+  <li><code>backup</code></li>
+  <li><code>batch</code></li>
+  <li><code>bedrock</code></li>
+  <li><code>budgets</code></li>
+  <li><code>ce</code> (or <code>costexplorer</code>)</li>
+  <li><code>chime</code></li>
+  <li><code>chimesdkmediapipelines</code></li>
+  <li><code>chimesdkvoice</code></li>
+  <li><code>cleanrooms</code></li>
+  <li><code>cloud9</code></li>
+  <li><code>cloudcontrol</code> (or <code>cloudcontrolapi</code>)</li>
+  <li><code>cloudformation</code></li>
+  <li><code>cloudfront</code></li>
+  <li><code>cloudhsmv2</code> (or <code>cloudhsm</code>)</li>
+  <li><code>cloudsearch</code></li>
+  <li><code>cloudtrail</code></li>
+  <li><code>cloudwatch</code></li>
+  <li><code>codeartifact</code></li>
+  <li><code>codebuild</code></li>
+  <li><code>codecatalyst</code></li>
+  <li><code>codecommit</code></li>
+  <li><code>codegurureviewer</code></li>
+  <li><code>codepipeline</code></li>
+  <li><code>codestarconnections</code></li>
+  <li><code>codestarnotifications</code></li>
+  <li><code>cognitoidentity</code></li>
+  <li><code>cognitoidp</code> (or <code>cognitoidentityprovider</code>)</li>
+  <li><code>comprehend</code></li>
+  <li><code>computeoptimizer</code></li>
+  <li><code>configservice</code> (or <code>config</code>)</li>
+  <li><code>connect</code></li>
+  <li><code>controltower</code></li>
+  <li><code>cur</code> (or <code>costandusagereportservice</code>)</li>
+  <li><code>dataexchange</code></li>
+  <li><code>datapipeline</code></li>
+  <li><code>datasync</code></li>
+  <li><code>dax</code></li>
+  <li><code>deploy</code> (or <code>codedeploy</code>)</li>
+  <li><code>detective</code></li>
+  <li><code>devicefarm</code></li>
+  <li><code>directconnect</code></li>
+  <li><code>dlm</code></li>
+  <li><code>dms</code> (or <code>databasemigration</code> or <code>databasemigrationservice</code>)</li>
+  <li><code>docdb</code></li>
+  <li><code>docdbelastic</code></li>
+  <li><code>ds</code> (or <code>directoryservice</code>)</li>
+  <li><code>dynamodb</code></li>
+  <li><code>ec2</code></li>
+  <li><code>ecr</code></li>
+  <li><code>ecrpublic</code></li>
+  <li><code>ecs</code></li>
+  <li><code>efs</code></li>
+  <li><code>eks</code></li>
+  <li><code>elasticache</code></li>
+  <li><code>elasticbeanstalk</code> (or <code>beanstalk</code>)</li>
+  <li><code>elasticsearch</code> (or <code>es</code> or <code>elasticsearchservice</code>)</li>
+  <li><code>elastictranscoder</code></li>
+  <li><code>elb</code> (or <code>elasticloadbalancing</code>)</li>
+  <li><code>elbv2</code> (or <code>elasticloadbalancingv2</code>)</li>
+  <li><code>emr</code></li>
+  <li><code>emrcontainers</code></li>
+  <li><code>emrserverless</code></li>
+  <li><code>events</code> (or <code>eventbridge</code> or <code>cloudwatchevents</code>)</li>
+  <li><code>evidently</code> (or <code>cloudwatchevidently</code>)</li>
+  <li><code>finspace</code></li>
+  <li><code>firehose</code></li>
+  <li><code>fis</code></li>
+  <li><code>fms</code></li>
+  <li><code>fsx</code></li>
+  <li><code>gamelift</code></li>
+  <li><code>glacier</code></li>
+  <li><code>globalaccelerator</code></li>
+  <li><code>glue</code></li>
+  <li><code>grafana</code> (or <code>managedgrafana</code> or <code>amg</code>)</li>
+  <li><code>greengrass</code></li>
+  <li><code>guardduty</code></li>
+  <li><code>healthlake</code></li>
+  <li><code>iam</code></li>
+  <li><code>identitystore</code></li>
+  <li><code>imagebuilder</code></li>
+  <li><code>inspector</code></li>
+  <li><code>inspector2</code> (or <code>inspectorv2</code>)</li>
+  <li><code>internetmonitor</code></li>
+  <li><code>iot</code></li>
+  <li><code>iotanalytics</code></li>
+  <li><code>iotevents</code></li>
+  <li><code>ivs</code></li>
+  <li><code>ivschat</code></li>
+  <li><code>kafka</code> (or <code>msk</code>)</li>
+  <li><code>kafkaconnect</code></li>
+  <li><code>kendra</code></li>
+  <li><code>keyspaces</code></li>
+  <li><code>kinesis</code></li>
+  <li><code>kinesisanalytics</code></li>
+  <li><code>kinesisanalyticsv2</code></li>
+  <li><code>kinesisvideo</code></li>
+  <li><code>kms</code></li>
+  <li><code>lakeformation</code></li>
+  <li><code>lambda</code></li>
+  <li><code>lexmodels</code> (or <code>lexmodelbuilding</code> or <code>lexmodelbuildingservice</code> or <code>lex</code>)</li>
+  <li><code>lexv2models</code> (or <code>lexmodelsv2</code>)</li>
+  <li><code>licensemanager</code></li>
+  <li><code>lightsail</code></li>
+  <li><code>location</code> (or <code>locationservice</code>)</li>
+  <li><code>logs</code> (or <code>cloudwatchlog</code> or <code>cloudwatchlogs</code>)</li>
+  <li><code>macie2</code></li>
+  <li><code>mediaconnect</code></li>
+  <li><code>mediaconvert</code></li>
+  <li><code>medialive</code></li>
+  <li><code>mediapackage</code></li>
+  <li><code>mediastore</code></li>
+  <li><code>memorydb</code></li>
+  <li><code>mq</code></li>
+  <li><code>mwaa</code></li>
+  <li><code>neptune</code></li>
+  <li><code>networkfirewall</code></li>
+  <li><code>networkmanager</code></li>
+  <li><code>oam</code> (or <code>cloudwatchobservabilityaccessmanager</code>)</li>
+  <li><code>opensearch</code> (or <code>opensearchservice</code>)</li>
+  <li><code>opensearchserverless</code></li>
+  <li><code>opsworks</code></li>
+  <li><code>organizations</code></li>
+  <li><code>outposts</code></li>
+  <li><code>pinpoint</code></li>
+  <li><code>pipes</code></li>
+  <li><code>pricing</code></li>
+  <li><code>qldb</code></li>
+  <li><code>quicksight</code></li>
+  <li><code>ram</code></li>
+  <li><code>rbin</code> (or <code>recyclebin</code>)</li>
+  <li><code>rds</code></li>
+  <li><code>redshift</code></li>
+  <li><code>redshiftdata</code> (or <code>redshiftdataapiservice</code>)</li>
+  <li><code>redshiftserverless</code></li>
+  <li><code>resourceexplorer2</code></li>
+  <li><code>resourcegroups</code></li>
+  <li><code>resourcegroupstaggingapi</code> (or <code>resourcegroupstagging</code>)</li>
+  <li><code>rolesanywhere</code></li>
+  <li><code>route53</code></li>
+  <li><code>route53domains</code></li>
+  <li><code>route53recoverycontrolconfig</code></li>
+  <li><code>route53recoveryreadiness</code></li>
+  <li><code>route53resolver</code></li>
+  <li><code>rum</code> (or <code>cloudwatchrum</code>)</li>
+  <li><code>s3</code> (or <code>s3api</code>)</li>
+  <li><code>s3control</code></li>
+  <li><code>s3outposts</code></li>
+  <li><code>sagemaker</code></li>
+  <li><code>scheduler</code></li>
+  <li><code>schemas</code></li>
+  <li><code>secretsmanager</code></li>
+  <li><code>securityhub</code></li>
+  <li><code>securitylake</code></li>
+  <li><code>serverlessrepo</code> (or <code>serverlessapprepo</code> or <code>serverlessapplicationrepository</code>)</li>
+  <li><code>servicecatalog</code></li>
+  <li><code>servicediscovery</code></li>
+  <li><code>servicequotas</code></li>
+  <li><code>ses</code></li>
+  <li><code>sesv2</code></li>
+  <li><code>sfn</code> (or <code>stepfunctions</code>)</li>
+  <li><code>shield</code></li>
+  <li><code>signer</code></li>
+  <li><code>simpledb</code> (or <code>sdb</code>)</li>
+  <li><code>sns</code></li>
+  <li><code>sqs</code></li>
+  <li><code>ssm</code></li>
+  <li><code>ssmcontacts</code></li>
+  <li><code>ssmincidents</code></li>
+  <li><code>ssoadmin</code></li>
+  <li><code>storagegateway</code></li>
+  <li><code>sts</code></li>
+  <li><code>swf</code></li>
+  <li><code>synthetics</code></li>
+  <li><code>timestreamwrite</code></li>
+  <li><code>transcribe</code> (or <code>transcribeservice</code>)</li>
+  <li><code>transfer</code></li>
+  <li><code>verifiedpermissions</code></li>
+  <li><code>vpclattice</code></li>
+  <li><code>waf</code></li>
+  <li><code>wafregional</code></li>
+  <li><code>wafv2</code></li>
+  <li><code>worklink</code></li>
+  <li><code>workspaces</code></li>
+  <li><code>xray</code></li>
+</ul>
+</div>
+<!-- markdownlint-enable no-inline-html -->
+
+As a convenience, for compatibility with the [Terraform S3 Backend](https://www.terraform.io/language/settings/backends/s3),
+the following service endpoints can be configured using environment variables:
+
+* DynamoDB: `TF_AWS_DYNAMODB_ENDPOINT` (or **Deprecated** `AWS_DYNAMODB_ENDPOINT`)
+* IAM: `TF_AWS_IAM_ENDPOINT` (or **Deprecated** `AWS_IAM_ENDPOINT`)
+* S3: `TF_AWS_S3_ENDPOINT` (or **Deprecated** `AWS_S3_ENDPOINT`)
+* STS: `TF_AWS_STS_ENDPOINT` (or **Deprecated** `AWS_STS_ENDPOINT`)
+
+## Connecting to Local AWS Compatible Solutions
+
+~> **NOTE:** This information is not intended to be exhaustive for all local AWS compatible solutions or necessarily authoritative configurations for those documented. Check the documentation for each of these solutions for the most up to date information.
+
+### DynamoDB Local
+
+The Amazon DynamoDB service offers a downloadable version for writing and testing applications without accessing the DynamoDB web service. For more information about this solution, see the [DynamoDB Local documentation in the Amazon DynamoDB Developer Guide](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/DynamoDBLocal.html).
+
+An example provider configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.provider import AwsProvider
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AwsProvider(self, "aws",
+            access_key="mock_access_key",
+            endpoints=[AwsProviderEndpoints(
+                dynamodb="http://localhost:8000"
+            )
+            ],
+            region="us-east-1",
+            secret_key="mock_secret_key",
+            skip_credentials_validation=True,
+            skip_metadata_api_check=Token.as_string(True),
+            skip_requesting_account_id=True
+        )
+```
+
+### LocalStack
+
+[LocalStack](https://localstack.cloud/) provides an easy-to-use test/mocking framework for developing Cloud applications.
+
+An example provider configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.provider import AwsProvider
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AwsProvider(self, "aws",
+            access_key="mock_access_key",
+            endpoints=[AwsProviderEndpoints(
+                apigateway="http://localhost:4566",
+                cloudformation="http://localhost:4566",
+                cloudwatch="http://localhost:4566",
+                dynamodb="http://localhost:4566",
+                es="http://localhost:4566",
+                firehose="http://localhost:4566",
+                iam="http://localhost:4566",
+                kinesis="http://localhost:4566",
+                lambda_="http://localhost:4566",
+                redshift="http://localhost:4566",
+                route53="http://localhost:4566",
+                s3="http://localhost:4566",
+                secretsmanager="http://localhost:4566",
+                ses="http://localhost:4566",
+                sns="http://localhost:4566",
+                sqs="http://localhost:4566",
+                ssm="http://localhost:4566",
+                stepfunctions="http://localhost:4566",
+                sts="http://localhost:4566"
+            )
+            ],
+            region="us-east-1",
+            s3_use_path_style=True,
+            secret_key="mock_secret_key",
+            skip_credentials_validation=True,
+            skip_metadata_api_check=Token.as_string(True),
+            skip_requesting_account_id=True
+        )
+```
+
+<!-- cache-key: cdktf-0.18.0 input-0e0dec25d22a19f39d4881dd603482a4765f842b794421afb1763a74aeea1795 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/guides/resource-tagging.html.markdown b/website/docs/cdktf/python/guides/resource-tagging.html.markdown
new file mode 100644
index 00000000000..e619e8fa02a
--- /dev/null
+++ b/website/docs/cdktf/python/guides/resource-tagging.html.markdown
@@ -0,0 +1,288 @@
+---
+subcategory: ""
+layout: "aws"
+page_title: "Terraform AWS Provider Resource Tagging"
+description: |-
+  Managing resource tags with the Terraform AWS Provider.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource Tagging
+
+Many AWS services implement [resource tags](https://docs.aws.amazon.com/general/latest/gr/aws_tagging.html) as an essential part of managing components. These arbitrary key-value pairs can be utilized for billing, ownership, automation, [access control](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_tags.html), and many other use cases. Given that these tags are an important aspect of successfully managing an AWS environment, the Terraform AWS Provider implements additional functionality beyond the typical one-to-one resource lifecycle management for easier and more customized implementations.
+
+-> Not all AWS resources support tagging, which can differ across AWS services and even across resources within the same service. Browse the individual Terraform AWS Provider resource documentation pages for the `tags` argument, to see which support resource tagging. If the AWS API implements tagging support for a resource and it is missing from the Terraform AWS Provider resource, a [feature request](https://github.com/hashicorp/terraform-provider-aws/issues/new?labels=enhancement&template=Feature_Request.md) can be submitted.
+
+<!-- TOC depthFrom:2 -->
+
+- [Getting Started with Resource Tags](#getting-started-with-resource-tags)
+- [Ignoring Changes to Specific Tags](#ignoring-changes-to-specific-tags)
+    - [Ignoring Changes in Individual Resources](#ignoring-changes-in-individual-resources)
+    - [Ignoring Changes in All Resources](#ignoring-changes-in-all-resources)
+- [Managing Individual Resource Tags](#managing-individual-resource-tags)
+- [Propagating Tags to All Resources](#propagating-tags-to-all-resources)
+
+<!-- /TOC -->
+
+## Getting Started with Resource Tags
+
+Terraform AWS Provider resources that support resource tags implement a consistent argument named `tags` which accepts a key-value map, e.g.,
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.vpc import Vpc
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Vpc(self, "example",
+            tags={
+                "Name": "MyVPC"
+            }
+        )
+```
+
+The tags for the resource are wholly managed by Terraform except tag keys beginning with `aws:` as these are managed by AWS services and cannot typically be edited or deleted. Any non-AWS tags added to the VPC outside of Terraform will be proposed for removal on the next Terraform execution. Missing tags or those with incorrect values from the Terraform configuration will be proposed for addition or update on the next Terraform execution. Advanced patterns that can adjust these behaviors for special use cases, such as Terraform AWS Provider configurations that affect all resources and the ability to manage resource tags for resources not managed by Terraform, can be found later in this guide.
+
+For most environments and use cases, this is the typical implementation pattern, whether it be in a standalone Terraform configuration or within a [Terraform Module](https://www.terraform.io/docs/modules/). The Terraform configuration language also enables less repetitive configurations via [variables](https://www.terraform.io/docs/configuration/variables.html), [locals](https://www.terraform.io/docs/configuration/locals.html), or potentially a combination of these, e.g.,
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import VariableType, TerraformVariable, Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.vpc import Vpc
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        # Terraform Variables are not always the best fit for getting inputs in the context of Terraform CDK.
+        #     You can read more about this at https://cdk.tf/variables
+        additional_tags = TerraformVariable(self, "additional_tags",
+            default=[{}],
+            description="Additional resource tags",
+            type=VariableType.map(VariableType.STRING)
+        )
+        Vpc(self, "example",
+            tags=Token.as_string_map(
+                Fn.merge([additional_tags.value, {
+                    "Name": "MyVPC"
+                }
+                ]))
+        )
+```
+
+## Ignoring Changes to Specific Tags
+
+Systems outside of Terraform may automatically interact with the tagging associated with AWS resources. These external systems may be for administrative purposes, such as a Configuration Management Database, or the tagging may be required functionality for those systems, such as Kubernetes. This section shows methods to prevent Terraform from showing differences for specific tags.
+
+### Ignoring Changes in Individual Resources
+
+All Terraform resources support the [`lifecycle` configuration block `ignore_changes` argument](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html#ignore_changes), which can be used to explicitly ignore all tags changes on a resource beyond an initial configuration or individual tag values.
+
+In this example, the `Name` tag will be added to the VPC on resource creation, however any external changes to the `Name` tag value or the addition/removal of any tag (including the `Name` tag) will be ignored:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from cdktf import TerraformResourceLifecycle
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.vpc import Vpc
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Vpc(self, "example",
+            lifecycle=TerraformResourceLifecycle(
+                ignore_changes=[tags]
+            ),
+            tags={
+                "Name": "MyVPC"
+            }
+        )
+```
+
+In this example, the `Name` and `Owner` tags will be added to the VPC on resource creation, however any external changes to the value of the `Name` tag will be ignored while any changes to other tags (including the `Owner` tag and any additions) will still be proposed:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from cdktf import TerraformResourceLifecycle
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.vpc import Vpc
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Vpc(self, "example",
+            lifecycle=TerraformResourceLifecycle(
+                ignore_changes=[name]
+            ),
+            tags={
+                "Name": "MyVPC",
+                "Owner": "Operations"
+            }
+        )
+```
+
+### Ignoring Changes in All Resources
+
+As of version 2.60.0 of the Terraform AWS Provider, there is support for ignoring tag changes across all resources under a provider. This simplifies situations where certain tags may be externally applied more globally and enhances functionality beyond `ignore_changes` to support cases such as tag key prefixes.
+
+In this example, all resources will ignore any addition of the `LastScanned` tag:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.provider import AwsProvider
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AwsProvider(self, "aws",
+            ignore_tags=[AwsProviderIgnoreTags(
+                keys=["LastScanned"]
+            )
+            ]
+        )
+```
+
+In this example, all resources will ignore any addition of tags with the `kubernetes.io/` prefix, such as `kubernetes.io/cluster/name` or `kubernetes.io/role/elb`:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.provider import AwsProvider
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AwsProvider(self, "aws",
+            ignore_tags=[AwsProviderIgnoreTags(
+                key_prefixes=["kubernetes.io/"]
+            )
+            ]
+        )
+```
+
+Any of the `ignore_tags` configurations can be combined as needed.
+
+The provider ignore tags configuration applies to all Terraform AWS Provider resources under that particular instance (the `default` provider instance in the above cases). If multiple, different Terraform AWS Provider configurations are being used (e.g., [multiple provider instances](https://www.terraform.io/docs/configuration/providers.html#alias-multiple-provider-instances)), the ignore tags configuration must be added to all applicable provider configurations.
+
+## Managing Individual Resource Tags
+
+Certain Terraform AWS Provider services support a special resource for managing an individual tag on a resource without managing the resource itself. One example is the [`aws_ec2_tag` resource](/docs/providers/aws/r/ec2_tag.html). These resources enable tagging where resources are created outside Terraform such as EC2 Images (AMIs), shared across accounts via Resource Access Manager (RAM), or implicitly created by other means such as EC2 VPN Connections implicitly creating a taggable EC2 Transit Gateway VPN Attachment.
+
+~> **NOTE:** This is an advanced use case and can cause conflicting management issues when improperly implemented. These individual tag resources should not be combined with the Terraform resource for managing the parent resource. For example, using `aws_vpc` and `aws_ec2_tag` to manage tags of the same VPC will cause a perpetual difference where the `aws_vpc` resource will try to remove the tag being added by the `aws_ec2_tag` resource.
+
+-> Not all services supported by the Terraform AWS Provider implement these resources. Browse the Terraform AWS Provider resource documentation pages for a resource with a type ending in `_tag`. If there is a use case where this type of resource is missing, a [feature request](https://github.com/hashicorp/terraform-provider-aws/issues/new?labels=enhancement&template=Feature_Request.md) can be submitted.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ec2_tag import Ec2Tag
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Ec2Tag(self, "example",
+            key="Owner",
+            resource_id=Token.as_string(aws_vpn_connection_example.transit_gateway_attachment_id),
+            value="Operations"
+        )
+```
+
+To manage multiple tags for a resource in this scenario, [`for_each`](https://www.terraform.io/docs/configuration/meta-arguments/for_each.html) can be used:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformIterator, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ec2_tag import Ec2Tag
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        # In most cases loops should be handled in the programming language context and
+        #     not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+        #     you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+        #     you need to keep this like it is.
+        example_for_each_iterator = TerraformIterator.from_list(
+            Token.as_any("[object Object]"))
+        Ec2Tag(self, "example",
+            key=example_for_each_iterator.key,
+            resource_id=Token.as_string(aws_vpn_connection_example.transit_gateway_attachment_id),
+            value=example_for_each_iterator.value,
+            for_each=example_for_each_iterator
+        )
+```
+
+The inline map provided to `for_each` in the example above is used for brevity, but other Terraform configuration language features similar to those noted at the beginning of this guide can be used to make the example more extensible.
+
+### Propagating Tags to All Resources
+
+As of version 3.38.0 of the Terraform AWS Provider, the Terraform Configuration language also enables provider-level tagging as an alternative to the methods described in the [Getting Started with Resource Tags](#getting-started-with-resource-tags) section above.
+This functionality is available for all Terraform AWS Provider resources that currently support `tags`, with the exception of the [`aws_autoscaling_group`](/docs/providers/aws/r/autoscaling_group.html.markdown) resource. Refactoring the use of [variables](https://www.terraform.io/docs/configuration/variables.html) or [locals](https://www.terraform.io/docs/configuration/locals.html) may look like:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.provider import AwsProvider
+from imports.aws.vpc import Vpc
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AwsProvider(self, "aws",
+            default_tags=[AwsProviderDefaultTags(
+                tags={
+                    "Environment": "Production",
+                    "Owner": "Ops"
+                }
+            )
+            ]
+        )
+        Vpc(self, "example",
+            tags={
+                "Name": "MyVPC"
+            }
+        )
+```
+
+In this example, the `Environment` and `Owner` tags defined within the provider configuration block will be added to the VPC on resource creation, in addition to the `Name` tag defined within the VPC resource configuration.
+To access all the tags applied to the VPC resource, use the read-only attribute `tags_all`, e.g., `aws_vpc.example.tags_all`.
+
+<!-- cache-key: cdktf-0.18.0 input-d76ea6fe81ad5c47295d3452558feb86a504b39383ae3e8bd97aba4cffd8dba7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/guides/using-aws-with-awscc-provider.html.markdown b/website/docs/cdktf/python/guides/using-aws-with-awscc-provider.html.markdown
new file mode 100644
index 00000000000..24b23cdf909
--- /dev/null
+++ b/website/docs/cdktf/python/guides/using-aws-with-awscc-provider.html.markdown
@@ -0,0 +1,169 @@
+---
+subcategory: ""
+layout: "aws"
+page_title: "Using the Terraform awscc provider with aws provider"
+description: |-
+  Managing resource tags with the Terraform AWS Provider.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Using AWS & AWSCC Provider Together
+
+~> **NOTE:** The `awscc` provider is currently in technical preview. This means some aspects of its design and implementation are not yet considered stable for production use. We are actively looking for community feedback in order to identify needed improvements.
+
+The [HashiCorp Terraform AWS Cloud Control Provider](https://registry.terraform.io/providers/hashicorp/awscc/latest) aims to bring Amazon Web Services (AWS) resources to Terraform users faster. The new provider is automatically generated, which means new features and services on AWS can be supported right away. The AWS Cloud Control provider supports hundreds of AWS resources, with more support being added as AWS service teams adopt the Cloud Control API standard.
+
+For Terraform users managing infrastructure on AWS, we expect the AWSCC provider will be used alongside the existing AWS provider. This guide is provided to show guidance and an example of using the providers together to deploy an AWS Cloud WAN Core Network.
+
+For more information about the AWSCC provider, please see the provider documentation in [Terraform Registry](https://registry.terraform.io/providers/hashicorp/awscc/latest)
+
+<!-- TOC depthFrom:2 -->
+
+- [AWS CloudWAN Overview](#aws-cloud-wan)
+- [Specifying Multiple Providers](#specifying-multiple-providers)
+    - [First Look at AWSCC Resources](#first-look-at-awscc-resources)
+    - [Using AWS and AWSCC Providers Together](#using-aws-and-awscc-providers-together)
+
+<!-- /TOC -->
+
+## AWS Cloud Wan
+
+In this guide we will deploy [AWS Cloud WAN](https://aws.amazon.com/cloud-wan/) to demonstrate how both AWS & AWSCC can work togther. Cloud WAN is a wide area networking (WAN) service that helps you build, manage, and monitor a unified global network that manages traffic running between resources in your cloud and on-premises environments.
+
+With Cloud WAN, you define network policies that are used to create a global network that spans multiple locations and networks—eliminating the need to configure and manage different networks individually using different technologies. Your network policies can be used to specify which of your Amazon Virtual Private Clouds (VPCs) and on-premises locations you wish to connect through AWS VPN or third-party software-defined WAN (SD-WAN) products, and the Cloud WAN central dashboard generates a complete view of the network to monitor network health, security, and performance. Cloud WAN automatically creates a global network across AWS Regions using Border Gateway Protocol (BGP), so you can easily exchange routes around the world.
+
+For more information on AWS Cloud WAN see [the documentation.](https://docs.aws.amazon.com/vpc/latest/cloudwan/what-is-cloudwan.html)
+
+## Specifying Multiple Providers
+
+Terraform can use many providers at once, as long as they are specified in your `terraform` configuration block:
+
+```terraform
+terraform {
+  required_version = ">= 1.0.7"
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 4.9.0"
+    }
+    awscc = {
+      source  = "hashicorp/awscc"
+      version = ">= 0.25.0"
+    }
+  }
+}
+```
+
+The code snippet above informs terraform to download 2 providers as plugins for the current root module, the AWS and AWSCC provider. You can tell which provider is being use by looking at the resource or data source name-prefix. Resources that start with `aws_` use the AWS provider, resources that start with `awscc_` are using the AWSCC provider.
+
+### First look at AWSCC resources
+
+Lets start by building our [global network](https://aws.amazon.com/about-aws/global-infrastructure/global_network/) which will house our core network.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.awscc.networkmanager_global_network import NetworkmanagerGlobalNetwork
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        # The following providers are missing schema information and might need manual adjustments to synthesize correctly: awscc.
+        #     For a more precise conversion please use the --provider flag in convert.
+        terraform_tag = [{
+            "key": "terraform",
+            "value": "true"
+        }
+        ]
+        NetworkmanagerGlobalNetwork(self, "main",
+            description="My Global Network",
+            tags=Fn.concat([terraform_tag, [{
+                "key": "Name",
+                "value": "My Global Network"
+            }
+            ]
+            ])
+        )
+```
+
+Above, we define a `awscc_networkmanager_global_network` with 2 tags and a description. AWSCC resources use the [standard AWS tag format](https://docs.aws.amazon.com/general/latest/gr/aws_tagging.html) which is expressed in HCL as a list of maps with 2 keys. We want to reuse the `terraform = true` tag so we define it as a `local` then we use [concat](https://www.terraform.io/language/functions/concat) to join the list of tags together.
+
+### Using AWS and AWSCC providers together
+
+Next we will create a [core network](https://docs.aws.amazon.com/vpc/latest/cloudwan/cloudwan-core-network-policy.html) using an AWSCC resource `awscc_networkmanager_core_network` and an AWS data source `data.aws_networkmanager_core_network_policy_document` which allows users to write HCL to generate the json policy used as the [core policy network](https://docs.aws.amazon.com/vpc/latest/cloudwan/cloudwan-policies-json.html).
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, Fn, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_networkmanager_core_network_policy_document import DataAwsNetworkmanagerCoreNetworkPolicyDocument
+from imports.awscc.networkmanager_core_network import NetworkmanagerCoreNetwork
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        # The following providers are missing schema information and might need manual adjustments to synthesize correctly: awscc.
+        #     For a more precise conversion please use the --provider flag in convert.
+        main = DataAwsNetworkmanagerCoreNetworkPolicyDocument(self, "main",
+            attachment_policies=[DataAwsNetworkmanagerCoreNetworkPolicyDocumentAttachmentPolicies(
+                action=DataAwsNetworkmanagerCoreNetworkPolicyDocumentAttachmentPoliciesAction(
+                    association_method="constant",
+                    segment="shared"
+                ),
+                condition_logic="or",
+                conditions=[DataAwsNetworkmanagerCoreNetworkPolicyDocumentAttachmentPoliciesConditions(
+                    key="segment",
+                    operator="equals",
+                    type="tag-value",
+                    value="shared"
+                )
+                ],
+                rule_number=1
+            )
+            ],
+            core_network_configuration=[DataAwsNetworkmanagerCoreNetworkPolicyDocumentCoreNetworkConfiguration(
+                asn_ranges=["64512-64555"],
+                edge_locations=[DataAwsNetworkmanagerCoreNetworkPolicyDocumentCoreNetworkConfigurationEdgeLocations(
+                    asn=Token.as_string(64512),
+                    location="us-east-1"
+                )
+                ],
+                vpn_ecmp_support=False
+            )
+            ],
+            segment_actions=[DataAwsNetworkmanagerCoreNetworkPolicyDocumentSegmentActions(
+                action="share",
+                mode="attachment-route",
+                segment="shared",
+                share_with=["*"]
+            )
+            ],
+            segments=[DataAwsNetworkmanagerCoreNetworkPolicyDocumentSegments(
+                description="SegmentForSharedServices",
+                name="shared",
+                require_attachment_acceptance=True
+            )
+            ]
+        )
+        awscc_networkmanager_core_network_main = NetworkmanagerCoreNetwork(self, "main_1",
+            description="My Core Network",
+            global_network_id=awscc_networkmanager_global_network_main.id,
+            policy_document=Fn.jsonencode(
+                Fn.jsondecode(Token.as_string(main.json))),
+            tags=terraform_tag
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        awscc_networkmanager_core_network_main.override_logical_id("main")
+```
+
+Thanks to Terraform's plugin design, the providers work together seemlessly!
+
+<!-- cache-key: cdktf-0.18.0 input-d0049083f5b79a00f6a6b9e71c9150830577760133eb5f349b9d3fe97a23ad13 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/guides/version-2-upgrade.html.markdown b/website/docs/cdktf/python/guides/version-2-upgrade.html.markdown
new file mode 100644
index 00000000000..e5f165faac3
--- /dev/null
+++ b/website/docs/cdktf/python/guides/version-2-upgrade.html.markdown
@@ -0,0 +1,1256 @@
+---
+subcategory: ""
+layout: "aws"
+page_title: "Terraform AWS Provider Version 2 Upgrade Guide"
+description: |-
+  Terraform AWS Provider Version 2 Upgrade Guide
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Terraform AWS Provider Version 2 Upgrade Guide
+
+Version 2.0.0 of the AWS provider for Terraform is a major release and includes some changes that you will need to consider when upgrading. This guide is intended to help with that process and focuses only on changes from version 1.60.0 to version 2.0.0.
+
+Most of the changes outlined in this guide have been previously marked as deprecated in the Terraform plan/apply output throughout previous provider releases. These changes, such as deprecation notices, can always be found in the [Terraform AWS Provider CHANGELOG](https://github.com/hashicorp/terraform-provider-aws/blob/main/CHANGELOG.md).
+
+Upgrade topics:
+
+<!-- TOC depthFrom:2 depthTo:2 -->
+
+- [Provider Version Configuration](#provider-version-configuration)
+- [Provider: Configuration](#provider-configuration)
+- [Data Source: aws_ami](#data-source-aws_ami)
+- [Data Source: aws_ami_ids](#data-source-aws_ami_ids)
+- [Data Source: aws_iam_role](#data-source-aws_iam_role)
+- [Data Source: aws_kms_secret](#data-source-aws_kms_secret)
+- [Data Source: aws_lambda_function](#data-source-aws_lambda_function)
+- [Data Source: aws_region](#data-source-aws_region)
+- [Resource: aws_api_gateway_api_key](#resource-aws_api_gateway_api_key)
+- [Resource: aws_api_gateway_integration](#resource-aws_api_gateway_integration)
+- [Resource: aws_api_gateway_integration_response](#resource-aws_api_gateway_integration_response)
+- [Resource: aws_api_gateway_method](#resource-aws_api_gateway_method)
+- [Resource: aws_api_gateway_method_response](#resource-aws_api_gateway_method_response)
+- [Resource: aws_appautoscaling_policy](#resource-aws_appautoscaling_policy)
+- [Resource: aws_autoscaling_policy](#resource-aws_autoscaling_policy)
+- [Resource: aws_batch_compute_environment](#resource-aws_batch_compute_environment)
+- [Resource: aws_cloudfront_distribution](#resource-aws_cloudfront_distribution)
+- [Resource: aws_cognito_user_pool](#resource-aws_cognito_user_pool)
+- [Resource: aws_dx_lag](#resource-aws_dx_lag)
+- [Resource: aws_ecs_service](#resource-aws_ecs_service)
+- [Resource: aws_efs_file_system](#resource-aws_efs_file_system)
+- [Resource: aws_elasticache_cluster](#resource-aws_elasticache_cluster)
+- [Resource: aws_iam_user_login_profile](#resource-aws_iam_user_login_profile)
+- [Resource: aws_instance](#resource-aws_instance)
+- [Resource: aws_lambda_function](#resource-aws_lambda_function)
+- [Resource: aws_lambda_layer_version](#resource-aws_lambda_layer_version)
+- [Resource: aws_network_acl](#resource-aws_network_acl)
+- [Resource: aws_redshift_cluster](#resource-aws_redshift_cluster)
+- [Resource: aws_route_table](#resource-aws_route_table)
+- [Resource: aws_route53_record](#resource-aws_route53_record)
+- [Resource: aws_route53_zone](#resource-aws_route53_zone)
+- [Resource: aws_wafregional_byte_match_set](#resource-aws_wafregional_byte_match_set)
+
+<!-- /TOC -->
+
+## Provider Version Configuration
+
+-> Before upgrading to version 2.0.0 or later, it is recommended to upgrade to the most recent 1.X version of the provider (version 1.60.0) and ensure that your environment successfully runs [`terraform plan`](https://www.terraform.io/docs/commands/plan.html) without unexpected changes or deprecation notices.
+
+We recommend using [version constraints when configuring Terraform providers](https://www.terraform.io/docs/configuration/providers.html#provider-versions). If you are following that recommendation, update the version constraints in your Terraform configuration and run [`terraform init`](https://www.terraform.io/docs/commands/init.html) to download the new version.
+
+Update to latest 1.X version:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.provider import AwsProvider
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AwsProvider(self, "aws")
+```
+
+Update to latest 2.X version:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.provider import AwsProvider
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AwsProvider(self, "aws")
+```
+
+## Provider: Configuration
+
+### skip_requesting_account_id Argument Now Required to Skip Account ID Lookup Errors
+
+If the provider is unable to determine the AWS account ID from a provider assume role configuration or the STS GetCallerIdentity call used to verify the credentials (if `skip_credentials_validation = false`), it will attempt to lookup the AWS account ID via EC2 metadata, IAM GetUser, IAM ListRoles, and STS GetCallerIdentity. Previously, the provider would silently allow the failure of all the above methods.
+
+The provider will now return an error to ensure operators understand the implications of the missing AWS account ID in the provider.
+
+If necessary, the AWS account ID lookup logic can be skipped via:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.provider import AwsProvider
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AwsProvider(self, "aws",
+            skip_requesting_account_id=True
+        )
+```
+
+## Data Source: aws_ami
+
+### owners Argument Now Required
+
+The `owners` argument is now required. Specifying `owner-id` or `owner-alias` under `filter` does not satisfy this requirement.
+
+## Data Source: aws_ami_ids
+
+### owners Argument Now Required
+
+The `owners` argument is now required. Specifying `owner-id` or `owner-alias` under `filter` does not satisfy this requirement.
+
+## Data Source: aws_iam_role
+
+### assume_role_policy_document Attribute Removal
+
+Switch your attribute references to the `assume_role_policy` attribute instead.
+
+### role_id Attribute Removal
+
+Switch your attribute references to the `unique_id` attribute instead.
+
+### role_name Argument Removal
+
+Switch your Terraform configuration to the `name` argument instead.
+
+## Data Source: aws_kms_secret
+
+### Data Source Removal and Migrating to aws_kms_secrets Data Source
+
+The implementation of the `aws_kms_secret` data source, prior to Terraform AWS provider version 2.0.0, used dynamic attribute behavior which is not supported with Terraform 0.12 and beyond (full details available in [this GitHub issue](https://github.com/hashicorp/terraform-provider-aws/issues/5144)).
+
+Terraform configuration migration steps:
+
+* Change the data source type from `aws_kms_secret` to `aws_kms_secrets`
+* Change any attribute reference (e.g., `"${data.aws_kms_secret.example.ATTRIBUTE}"`) from `.ATTRIBUTE` to `.plaintext["ATTRIBUTE"]`
+
+As an example, lets take the below sample configuration and migrate it.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_kms_secret import DataAwsKmsSecret
+from imports.aws.rds_cluster import RdsCluster
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, engine):
+        super().__init__(scope, name)
+        example = DataAwsKmsSecret(self, "example",
+            secret=[DataAwsKmsSecretSecret(
+                name="master_password",
+                payload="AQEC..."
+            ), DataAwsKmsSecretSecret(
+                name="master_username",
+                payload="AQEC..."
+            )
+            ]
+        )
+        aws_rds_cluster_example = RdsCluster(self, "example_1",
+            master_password=Token.as_string(example.master_password),
+            master_username=Token.as_string(example.master_username),
+            engine=engine
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_rds_cluster_example.override_logical_id("example")
+```
+
+Notice that the `aws_kms_secret` data source previously was taking the two `secret` configuration block `name` arguments and generating those as attribute names (`master_password` and `master_username` in this case). To remove the incompatible behavior, this updated version of the data source provides the decrypted value of each of those `secret` configuration block `name` arguments within a map attribute named `plaintext`.
+
+Updating the sample configuration from above:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_kms_secrets import DataAwsKmsSecrets
+from imports.aws.rds_cluster import RdsCluster
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, engine):
+        super().__init__(scope, name)
+        example = DataAwsKmsSecrets(self, "example",
+            secret=[DataAwsKmsSecretsSecret(
+                name="master_password",
+                payload="AQEC..."
+            ), DataAwsKmsSecretsSecret(
+                name="master_username",
+                payload="AQEC..."
+            )
+            ]
+        )
+        aws_rds_cluster_example = RdsCluster(self, "example_1",
+            master_password=Token.as_string(
+                Fn.lookup_nested(example.plaintext, ["\"master_password\""])),
+            master_username=Token.as_string(
+                Fn.lookup_nested(example.plaintext, ["\"master_username\""])),
+            engine=engine
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_rds_cluster_example.override_logical_id("example")
+```
+
+## Data Source: aws_lambda_function
+
+### arn and qualified_arn Attribute Behavior Changes
+
+The `arn` attribute now always returns the unqualified (no `:QUALIFIER` or `:VERSION` suffix) ARN value and the `qualified_arn` attribute now always returns the qualified (includes `:QUALIFIER` or `:VERSION` suffix) ARN value. Previously by default, the `arn` attribute included `:$LATEST` suffix when not setting the optional `qualifier` argument, which was not compatible with many other resources. To restore the previous default behavior, set the `qualifier` argument to `$LATEST` and reference the `qualified_arn` attribute.
+
+## Data Source: aws_region
+
+### current Argument Removal
+
+Simply remove `current = true` from your Terraform configuration. The data source defaults to the current provider region if no other filtering is enabled.
+
+## Resource: aws_api_gateway_api_key
+
+### stage_key Argument Removal
+
+Since the API Gateway usage plans feature was launched on August 11, 2016, usage plans are now required to associate an API key with an API stage. To migrate your Terraform configuration, the AWS provider implements support for usage plans with the following resources:
+
+* [`aws_api_gateway_usage_plan`](/docs/providers/aws/r/api_gateway_usage_plan.html)
+* [`aws_api_gateway_usage_plan_key`](/docs/providers/aws/r/api_gateway_usage_plan_key.html)
+
+For example, given this previous configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.api_gateway_api_key import ApiGatewayApiKey
+from imports.aws.api_gateway_deployment import ApiGatewayDeployment
+from imports.aws.api_gateway_rest_api import ApiGatewayRestApi
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = ApiGatewayRestApi(self, "example",
+            name="example"
+        )
+        aws_api_gateway_deployment_example = ApiGatewayDeployment(self, "example_1",
+            rest_api_id=example.id,
+            stage_name="example"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_api_gateway_deployment_example.override_logical_id("example")
+        aws_api_gateway_api_key_example = ApiGatewayApiKey(self, "example_2",
+            name="example",
+            stage_key=[{
+                "rest_api_id": example.id,
+                "stage_name": aws_api_gateway_deployment_example.stage_name
+            }
+            ]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_api_gateway_api_key_example.override_logical_id("example")
+```
+
+An updated configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.api_gateway_api_key import ApiGatewayApiKey
+from imports.aws.api_gateway_deployment import ApiGatewayDeployment
+from imports.aws.api_gateway_rest_api import ApiGatewayRestApi
+from imports.aws.api_gateway_usage_plan import ApiGatewayUsagePlan
+from imports.aws.api_gateway_usage_plan_key import ApiGatewayUsagePlanKey
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = ApiGatewayApiKey(self, "example",
+            name="example"
+        )
+        aws_api_gateway_rest_api_example = ApiGatewayRestApi(self, "example_1",
+            name="example"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_api_gateway_rest_api_example.override_logical_id("example")
+        aws_api_gateway_deployment_example = ApiGatewayDeployment(self, "example_2",
+            rest_api_id=Token.as_string(aws_api_gateway_rest_api_example.id),
+            stage_name="example"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_api_gateway_deployment_example.override_logical_id("example")
+        aws_api_gateway_usage_plan_example = ApiGatewayUsagePlan(self, "example_3",
+            api_stages=[ApiGatewayUsagePlanApiStages(
+                api_id=Token.as_string(aws_api_gateway_rest_api_example.id),
+                stage=Token.as_string(aws_api_gateway_deployment_example.stage_name)
+            )
+            ],
+            name="example"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_api_gateway_usage_plan_example.override_logical_id("example")
+        aws_api_gateway_usage_plan_key_example = ApiGatewayUsagePlanKey(self, "example_4",
+            key_id=example.id,
+            key_type="API_KEY",
+            usage_plan_id=Token.as_string(aws_api_gateway_usage_plan_example.id)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_api_gateway_usage_plan_key_example.override_logical_id("example")
+```
+
+## Resource: aws_api_gateway_integration
+
+### request_parameters_in_json Argument Removal
+
+Switch your Terraform configuration to the `request_parameters` argument instead.
+
+For example, given this previous configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.api_gateway_integration import ApiGatewayIntegration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, httpMethod, resourceId, restApiId, type):
+        super().__init__(scope, name)
+        ApiGatewayIntegration(self, "example",
+            request_parameters_in_json="{\n    \"integration.request.header.X-Authorization\": \"'static'\"\n}\n\n",
+            http_method=http_method,
+            resource_id=resource_id,
+            rest_api_id=rest_api_id,
+            type=type
+        )
+```
+
+An updated configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.api_gateway_integration import ApiGatewayIntegration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, httpMethod, resourceId, restApiId, type):
+        super().__init__(scope, name)
+        ApiGatewayIntegration(self, "example",
+            request_parameters={
+                "integration.request.header.X-Authorization": "'static'"
+            },
+            http_method=http_method,
+            resource_id=resource_id,
+            rest_api_id=rest_api_id,
+            type=type
+        )
+```
+
+## Resource: aws_api_gateway_integration_response
+
+### response_parameters_in_json Argument Removal
+
+Switch your Terraform configuration to the `response_parameters` argument instead.
+
+For example, given this previous configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.api_gateway_integration_response import ApiGatewayIntegrationResponse
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, httpMethod, resourceId, restApiId, statusCode):
+        super().__init__(scope, name)
+        ApiGatewayIntegrationResponse(self, "example",
+            response_parameters_in_json="{\n    \"method.response.header.Content-Type\": \"integration.response.body.type\"\n}\n\n",
+            http_method=http_method,
+            resource_id=resource_id,
+            rest_api_id=rest_api_id,
+            status_code=status_code
+        )
+```
+
+An updated configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.api_gateway_integration_response import ApiGatewayIntegrationResponse
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, httpMethod, resourceId, restApiId, statusCode):
+        super().__init__(scope, name)
+        ApiGatewayIntegrationResponse(self, "example",
+            response_parameters={
+                "method.response.header.Content-Type": "integration.response.body.type"
+            },
+            http_method=http_method,
+            resource_id=resource_id,
+            rest_api_id=rest_api_id,
+            status_code=status_code
+        )
+```
+
+## Resource: aws_api_gateway_method
+
+### request_parameters_in_json Argument Removal
+
+Switch your Terraform configuration to the `request_parameters` argument instead.
+
+For example, given this previous configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.api_gateway_method import ApiGatewayMethod
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, authorization, httpMethod, resourceId, restApiId):
+        super().__init__(scope, name)
+        ApiGatewayMethod(self, "example",
+            request_parameters_in_json="{\n    \"method.request.header.Content-Type\": false,\n    \"method.request.querystring.page\": true\n}\n\n",
+            authorization=authorization,
+            http_method=http_method,
+            resource_id=resource_id,
+            rest_api_id=rest_api_id
+        )
+```
+
+An updated configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.api_gateway_method import ApiGatewayMethod
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, authorization, httpMethod, resourceId, restApiId):
+        super().__init__(scope, name)
+        ApiGatewayMethod(self, "example",
+            request_parameters={
+                "method.request.header.Content-Type": False,
+                "method.request.querystring.page": True
+            },
+            authorization=authorization,
+            http_method=http_method,
+            resource_id=resource_id,
+            rest_api_id=rest_api_id
+        )
+```
+
+## Resource: aws_api_gateway_method_response
+
+### response_parameters_in_json Argument Removal
+
+Switch your Terraform configuration to the `response_parameters` argument instead.
+
+For example, given this previous configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.api_gateway_method_response import ApiGatewayMethodResponse
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, httpMethod, resourceId, restApiId, statusCode):
+        super().__init__(scope, name)
+        ApiGatewayMethodResponse(self, "example",
+            response_parameters_in_json="{\n    \"method.response.header.Content-Type\": true\n}\n\n",
+            http_method=http_method,
+            resource_id=resource_id,
+            rest_api_id=rest_api_id,
+            status_code=status_code
+        )
+```
+
+An updated configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.api_gateway_method_response import ApiGatewayMethodResponse
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, httpMethod, resourceId, restApiId, statusCode):
+        super().__init__(scope, name)
+        ApiGatewayMethodResponse(self, "example",
+            response_parameters={
+                "method.response.header.Content-Type": True
+            },
+            http_method=http_method,
+            resource_id=resource_id,
+            rest_api_id=rest_api_id,
+            status_code=status_code
+        )
+```
+
+## Resource: aws_appautoscaling_policy
+
+### Argument Removals
+
+The following arguments have been moved into a nested argument named `step_scaling_policy_configuration`:
+
+* `adjustment_type`
+* `cooldown`
+* `metric_aggregation_type`
+* `min_adjustment_magnitude`
+* `step_adjustment`
+
+For example, given this previous configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Op, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.appautoscaling_policy import AppautoscalingPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, name, resourceId, scalableDimension, serviceNamespace):
+        super().__init__(scope, name)
+        AppautoscalingPolicy(self, "example",
+            adjustment_type="ChangeInCapacity",
+            cooldown=60,
+            metric_aggregation_type="Maximum",
+            step_adjustment=[{
+                "metric_interval_upper_bound": 0,
+                "scaling_adjustment": Op.negate(1)
+            }
+            ],
+            name=name,
+            resource_id=resource_id,
+            scalable_dimension=scalable_dimension,
+            service_namespace=service_namespace
+        )
+```
+
+An updated configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, Op, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.appautoscaling_policy import AppautoscalingPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, name, resourceId, scalableDimension, serviceNamespace):
+        super().__init__(scope, name)
+        AppautoscalingPolicy(self, "example",
+            step_scaling_policy_configuration=AppautoscalingPolicyStepScalingPolicyConfiguration(
+                adjustment_type="ChangeInCapacity",
+                cooldown=60,
+                metric_aggregation_type="Maximum",
+                step_adjustment=[AppautoscalingPolicyStepScalingPolicyConfigurationStepAdjustment(
+                    metric_interval_upper_bound=Token.as_string(0),
+                    scaling_adjustment=Token.as_number(Op.negate(1))
+                )
+                ]
+            ),
+            name=name,
+            resource_id=resource_id,
+            scalable_dimension=scalable_dimension,
+            service_namespace=service_namespace
+        )
+```
+
+## Resource: aws_autoscaling_policy
+
+### min_adjustment_step Argument Removal
+
+Switch your Terraform configuration to the `min_adjustment_magnitude` argument instead.
+
+For example, given this previous configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.autoscaling_policy import AutoscalingPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, autoscalingGroupName, name):
+        super().__init__(scope, name)
+        AutoscalingPolicy(self, "example",
+            min_adjustment_step=2,
+            autoscaling_group_name=autoscaling_group_name,
+            name=name
+        )
+```
+
+An updated configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.autoscaling_policy import AutoscalingPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, autoscalingGroupName, name):
+        super().__init__(scope, name)
+        AutoscalingPolicy(self, "example",
+            min_adjustment_magnitude=2,
+            autoscaling_group_name=autoscaling_group_name,
+            name=name
+        )
+```
+
+## Resource: aws_batch_compute_environment
+
+### ecc_cluster_arn Attribute Removal
+
+Switch your attribute references to the `ecs_cluster_arn` attribute instead.
+
+## Resource: aws_cloudfront_distribution
+
+### cache_behavior Argument Removal
+
+Switch your Terraform configuration to the `ordered_cache_behavior` argument instead. It behaves similar to the previous `cache_behavior` argument, however the ordering of the configurations in Terraform is now reflected in the distribution where previously it was indeterminate.
+
+For example, given this previous configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudfront_distribution import CloudfrontDistribution
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, defaultCacheBehavior, enabled, origin, restrictions, viewerCertificate):
+        super().__init__(scope, name)
+        CloudfrontDistribution(self, "example",
+            cache_behavior=[{}, {}],
+            default_cache_behavior=default_cache_behavior,
+            enabled=enabled,
+            origin=origin,
+            restrictions=restrictions,
+            viewer_certificate=viewer_certificate
+        )
+```
+
+An updated configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudfront_distribution import CloudfrontDistribution
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, allowedMethods, cachedMethods, pathPattern, targetOriginId, viewerProtocolPolicy, allowedMethods1, cachedMethods1, pathPattern1, targetOriginId1, viewerProtocolPolicy1, defaultCacheBehavior, enabled, origin, restrictions, viewerCertificate):
+        super().__init__(scope, name)
+        CloudfrontDistribution(self, "example",
+            ordered_cache_behavior=[CloudfrontDistributionOrderedCacheBehavior(
+                allowed_methods=allowed_methods,
+                cached_methods=cached_methods,
+                path_pattern=path_pattern,
+                target_origin_id=target_origin_id,
+                viewer_protocol_policy=viewer_protocol_policy
+            ), CloudfrontDistributionOrderedCacheBehavior(
+                allowed_methods=allowed_methods1,
+                cached_methods=cached_methods1,
+                path_pattern=path_pattern1,
+                target_origin_id=target_origin_id1,
+                viewer_protocol_policy=viewer_protocol_policy1
+            )
+            ],
+            default_cache_behavior=default_cache_behavior,
+            enabled=enabled,
+            origin=origin,
+            restrictions=restrictions,
+            viewer_certificate=viewer_certificate
+        )
+```
+
+## Resource: aws_cognito_user_pool
+
+### email_verification_subject Argument Now Conflicts With verification_message_template Configuration Block email_subject Argument
+
+Choose one argument or the other. These arguments update the same underlying information in Cognito and the selection is indeterminate if differing values are provided.
+
+### email_verification_message Argument Now Conflicts With verification_message_template Configuration Block email_message Argument
+
+Choose one argument or the other. These arguments update the same underlying information in Cognito and the selection is indeterminate if differing values are provided.
+
+### sms_verification_message Argument Now Conflicts With verification_message_template Configuration Block sms_message Argument
+
+Choose one argument or the other. These arguments update the same underlying information in Cognito and the selection is indeterminate if differing values are provided.
+
+## Resource: aws_dx_lag
+
+### number_of_connections Argument Removal
+
+Default connections have been removed as part of LAG creation. To migrate your Terraform configuration, the AWS provider implements the following resources:
+
+* [`aws_dx_connection`](/docs/providers/aws/r/dx_connection.html)
+* [`aws_dx_connection_association`](/docs/providers/aws/r/dx_connection_association.html)
+
+For example, given this previous configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.dx_lag import DxLag
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DxLag(self, "example",
+            connections_bandwidth="1Gbps",
+            location="EqSe2-EQ",
+            name="example",
+            number_of_connections=1
+        )
+```
+
+An updated configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.dx_connection import DxConnection
+from imports.aws.dx_connection_association import DxConnectionAssociation
+from imports.aws.dx_lag import DxLag
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = DxConnection(self, "example",
+            bandwidth="1Gbps",
+            location="EqSe2-EQ",
+            name="example"
+        )
+        aws_dx_lag_example = DxLag(self, "example_1",
+            connections_bandwidth="1Gbps",
+            location="EqSe2-EQ",
+            name="example"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_dx_lag_example.override_logical_id("example")
+        aws_dx_connection_association_example = DxConnectionAssociation(self, "example_2",
+            connection_id=example.id,
+            lag_id=Token.as_string(aws_dx_lag_example.id)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_dx_connection_association_example.override_logical_id("example")
+```
+
+## Resource: aws_ecs_service
+
+### placement_strategy Argument Removal
+
+Switch your Terraform configuration to the `ordered_placement_strategy` argument instead. It behaves similar to the previous `placement_strategy` argument, however the ordering of the configurations in Terraform is now reflected in the distribution where previously it was indeterminate.
+
+For example, given this previous configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ecs_service import EcsService
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, name):
+        super().__init__(scope, name)
+        EcsService(self, "example",
+            placement_strategy=[{}, {}],
+            name=name
+        )
+```
+
+An updated configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ecs_service import EcsService
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, type, type1, name):
+        super().__init__(scope, name)
+        EcsService(self, "example",
+            ordered_placement_strategy=[EcsServiceOrderedPlacementStrategy(
+                type=type
+            ), EcsServiceOrderedPlacementStrategy(
+                type=type1
+            )
+            ],
+            name=name
+        )
+```
+
+## Resource: aws_efs_file_system
+
+### reference_name Argument Removal
+
+Switch your Terraform configuration to the `creation_token` argument instead.
+
+For example, given this previous configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.efs_file_system import EfsFileSystem
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        EfsFileSystem(self, "example",
+            reference_name="example"
+        )
+```
+
+An updated configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.efs_file_system import EfsFileSystem
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        EfsFileSystem(self, "example",
+            creation_token="example"
+        )
+```
+
+## Resource: aws_elasticache_cluster
+
+### availability_zones Argument Removal
+
+Switch your Terraform configuration to the `preferred_availability_zones` argument instead. The argument is still optional and the API will continue to automatically choose Availability Zones for nodes if not specified. The new argument will also continue to match the APIs required behavior that the length of the list must be the same as `num_cache_nodes`.
+
+For example, given this previous configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.elasticache_cluster import ElasticacheCluster
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, clusterId):
+        super().__init__(scope, name)
+        ElasticacheCluster(self, "example",
+            availability_zones=["us-west-2a", "us-west-2b"],
+            cluster_id=cluster_id
+        )
+```
+
+An updated configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.elasticache_cluster import ElasticacheCluster
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, clusterId):
+        super().__init__(scope, name)
+        ElasticacheCluster(self, "example",
+            preferred_availability_zones=["us-west-2a", "us-west-2b"],
+            cluster_id=cluster_id
+        )
+```
+
+## Resource: aws_iam_user_login_profile
+
+### Import Now Required For Existing Infrastructure
+
+When attempting to bring existing IAM User Login Profiles under Terraform management, `terraform import` is now required. See the [`aws_iam_user_login_profile` resource documentation](https://www.terraform.io/docs/providers/aws/r/iam_user_login_profile.html) for more information.
+
+## Resource: aws_instance
+
+### network_interface_id Attribute Removal
+
+Switch your attribute references to the `primary_network_interface_id` attribute instead.
+
+## Resource: aws_lambda_function
+
+### reserved_concurrent_executions Argument Behavior Change
+
+Setting `reserved_concurrent_executions` to `0` will now disable Lambda Function invocations, causing downtime for the Lambda Function.
+
+Previously `reserved_concurrent_executions` accepted `0` and below for unreserved concurrency, which means it was not previously possible to disable invocations. The argument now differentiates between a new value for unreserved concurrency (`-1`) and disabling Lambda invocations (`0`). If previously configuring this value to `0` for unreserved concurrency, update the configured value to `-1` or the resource will disable Lambda Function invocations on update. If previously unconfigured, the argument does not require any changes.
+
+See the [Lambda User Guide](https://docs.aws.amazon.com/lambda/latest/dg/concurrent-executions.html) for more information about concurrency.
+
+## Resource: aws_lambda_layer_version
+
+### arn and layer_arn Attribute Value Swap
+
+Switch your `arn` attribute references to the `layer_arn` attribute instead and vice-versa.
+
+## Resource: aws_network_acl
+
+### subnet_id Argument Removal
+
+Switch your Terraform configuration to the `subnet_ids` argument instead.
+
+For example, given this previous configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.network_acl import NetworkAcl
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, vpcId):
+        super().__init__(scope, name)
+        NetworkAcl(self, "example",
+            subnet_id="subnet-12345678",
+            vpc_id=vpc_id
+        )
+```
+
+An updated configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.network_acl import NetworkAcl
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, vpcId):
+        super().__init__(scope, name)
+        NetworkAcl(self, "example",
+            subnet_ids=["subnet-12345678"],
+            vpc_id=vpc_id
+        )
+```
+
+## Resource: aws_redshift_cluster
+
+### Argument Removals
+
+The following arguments have been moved into a nested argument named `logging`:
+
+* `bucket_name`
+* `enable_logging` (also renamed to just `enable`)
+* `s3_key_prefix`
+
+For example, given this previous configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.redshift_cluster import RedshiftCluster
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, clusterIdentifier, nodeType):
+        super().__init__(scope, name)
+        RedshiftCluster(self, "example",
+            bucket_name="example",
+            enable_logging=True,
+            s3_key_prefix="example",
+            cluster_identifier=cluster_identifier,
+            node_type=node_type
+        )
+```
+
+An updated configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.redshift_cluster import RedshiftCluster
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, clusterIdentifier, nodeType):
+        super().__init__(scope, name)
+        RedshiftCluster(self, "example",
+            logging=RedshiftClusterLogging(
+                bucket_name="example",
+                enable=True,
+                s3_key_prefix="example"
+            ),
+            cluster_identifier=cluster_identifier,
+            node_type=node_type
+        )
+```
+
+## Resource: aws_route_table
+
+### Import Change
+
+Previously, importing this resource resulted in an `aws_route` resource for each route, in
+addition to the `aws_route_table`, in the Terraform state. Support for importing `aws_route` resources has been added and importing this resource only adds the `aws_route_table`
+resource, with in-line routes, to the state.
+
+## Resource: aws_route53_record
+
+### allow_overwrite Default Value Change
+
+The resource now requires existing Route 53 Records to be imported into the Terraform state for management unless the `allow_overwrite` argument is enabled.
+
+For example, if the `www.example.com` Route 53 Record in the `example.com` Route 53 Hosted Zone existed previously and this new Terraform configuration was introduced:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.route53_record import Route53Record
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, type, zoneId):
+        super().__init__(scope, name)
+        Route53Record(self, "www",
+            name="www.example.com",
+            type=type,
+            zone_id=zone_id
+        )
+```
+
+During resource creation in version 1.X and prior, it would silently perform an `UPSERT` changeset to the existing Route 53 Record and not report back an error. In version 2.0.0 of the Terraform AWS Provider, the resource now performs a `CREATE` changeset, which will error for existing Route 53 Records.
+
+The `allow_overwrite` argument provides a workaround to keep the old behavior, but most existing workflows should be updated to perform a `terraform import` command like the following instead:
+
+```console
+$ terraform import aws_route53_record.www ZONEID_www.example.com_TYPE
+```
+
+More information can be found in the [`aws_route53_record` resource documentation](https://www.terraform.io/docs/providers/aws/r/route53_record.html#import).
+
+## Resource: aws_route53_zone
+
+### vpc_id and vpc_region Argument Removal
+
+Switch your Terraform configuration to `vpc` configuration block(s) instead.
+
+For example, given this previous configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.route53_zone import Route53Zone
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, name):
+        super().__init__(scope, name)
+        Route53Zone(self, "example",
+            vpc_id="...",
+            name=name
+        )
+```
+
+An updated configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.route53_zone import Route53Zone
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, name):
+        super().__init__(scope, name)
+        Route53Zone(self, "example",
+            vpc=[Route53ZoneVpc(
+                vpc_id="..."
+            )
+            ],
+            name=name
+        )
+```
+
+## Resource: aws_wafregional_byte_match_set
+
+### byte_match_tuple Argument Removal
+
+Switch your Terraform configuration to the `byte_match_tuples` argument instead.
+
+For example, given this previous configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.wafregional_byte_match_set import WafregionalByteMatchSet
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, name):
+        super().__init__(scope, name)
+        WafregionalByteMatchSet(self, "example",
+            byte_match_tuple=[{}, {}],
+            name=name
+        )
+```
+
+An updated configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.wafregional_byte_match_set import WafregionalByteMatchSet
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, fieldToMatch, positionalConstraint, textTransformation, fieldToMatch1, positionalConstraint1, textTransformation1, name):
+        super().__init__(scope, name)
+        WafregionalByteMatchSet(self, "example",
+            byte_match_tuples=[WafregionalByteMatchSetByteMatchTuples(
+                field_to_match=field_to_match,
+                positional_constraint=positional_constraint,
+                text_transformation=text_transformation
+            ), WafregionalByteMatchSetByteMatchTuples(
+                field_to_match=field_to_match1,
+                positional_constraint=positional_constraint1,
+                text_transformation=text_transformation1
+            )
+            ],
+            name=name
+        )
+```
+
+<!-- cache-key: cdktf-0.18.0 input-603687597fabf51f83331995b133df850861a17c0d29ee4fbc2f2bfc3a7c98e8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/guides/version-3-upgrade.html.markdown b/website/docs/cdktf/python/guides/version-3-upgrade.html.markdown
new file mode 100644
index 00000000000..2c8d04116ea
--- /dev/null
+++ b/website/docs/cdktf/python/guides/version-3-upgrade.html.markdown
@@ -0,0 +1,2104 @@
+---
+subcategory: ""
+layout: "aws"
+page_title: "Terraform AWS Provider Version 3 Upgrade Guide"
+description: |-
+  Terraform AWS Provider Version 3 Upgrade Guide
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Terraform AWS Provider Version 3 Upgrade Guide
+
+Version 3.0.0 of the AWS provider for Terraform is a major release and includes some changes that you will need to consider when upgrading. This guide is intended to help with that process and focuses only on changes from version 2.X to version 3.0.0. See the [Version 2 Upgrade Guide](/docs/providers/aws/guides/version-2-upgrade.html) for information about upgrading from 1.X to version 2.0.0.
+
+Most of the changes outlined in this guide have been previously marked as deprecated in the Terraform plan/apply output throughout previous provider releases. These changes, such as deprecation notices, can always be found in the [Terraform AWS Provider CHANGELOG](https://github.com/hashicorp/terraform-provider-aws/blob/main/CHANGELOG.md).
+
+~> **NOTE:** Version 3.0.0 and later of the AWS Provider can only be automatically installed on Terraform 0.12 and later.
+
+Upgrade topics:
+
+<!-- TOC depthFrom:2 depthTo:2 -->
+
+- [Provider Version Configuration](#provider-version-configuration)
+- [Provider Authentication Updates](#provider-authentication-updates)
+- [Provider Custom Service Endpoint Updates](#provider-custom-service-endpoint-updates)
+- [Data Source: aws_availability_zones](#data-source-aws_availability_zones)
+- [Data Source: aws_lambda_invocation](#data-source-aws_lambda_invocation)
+- [Data Source: aws_launch_template](#data-source-aws_launch_template)
+- [Data Source: aws_route53_resolver_rule](#data-source-aws_route53_resolver_rule)
+- [Data Source: aws_route53_zone](#data-source-aws_route53_zone)
+- [Resource: aws_acm_certificate](#resource-aws_acm_certificate)
+- [Resource: aws_api_gateway_method_settings](#resource-aws_api_gateway_method_settings)
+- [Resource: aws_autoscaling_group](#resource-aws_autoscaling_group)
+- [Resource: aws_cloudfront_distribution](#resource-aws_cloudfront_distribution)
+- [Resource: aws_cloudwatch_log_group](#resource-aws_cloudwatch_log_group)
+- [Resource: aws_codepipeline](#resource-aws_codepipeline)
+- [Resource: aws_cognito_user_pool](#resource-aws_cognito_user_pool)
+- [Resource: aws_dx_gateway](#resource-aws_dx_gateway)
+- [Resource: aws_dx_gateway_association](#resource-aws_dx_gateway_association)
+- [Resource: aws_dx_gateway_association_proposal](#resource-aws_dx_gateway_association_proposal)
+- [Resource: aws_ebs_volume](#resource-aws_ebs_volume)
+- [Resource: aws_elastic_transcoder_preset](#resource-aws_elastic_transcoder_preset)
+- [Resource: aws_emr_cluster](#resource-aws_emr_cluster)
+- [Resource: aws_glue_job](#resource-aws_glue_job)
+- [Resource: aws_iam_access_key](#resource-aws_iam_access_key)
+- [Resource: aws_iam_instance_profile](#resource-aws_iam_instance_profile)
+- [Resource: aws_iam_server_certificate](#resource-aws_iam_server_certificate)
+- [Resource: aws_instance](#resource-aws_instance)
+- [Resource: aws_lambda_alias](#resource-aws_lambda_alias)
+- [Resource: aws_launch_template](#resource-aws_launch_template)
+- [Resource: aws_lb_listener_rule](#resource-aws_lb_listener_rule)
+- [Resource: aws_msk_cluster](#resource-aws_msk_cluster)
+- [Resource: aws_rds_cluster](#resource-aws_rds_cluster)
+- [Resource: aws_route53_resolver_rule](#resource-aws_route53_resolver_rule)
+- [Resource: aws_route53_zone](#resource-aws_route53_zone)
+- [Resource: aws_s3_bucket](#resource-aws_s3_bucket)
+- [Resource: aws_s3_bucket_metric](#resource-aws_s3_bucket_metric)
+- [Resource: aws_security_group](#resource-aws_security_group)
+- [Resource: aws_sns_platform_application](#resource-aws_sns_platform_application)
+- [Resource: aws_spot_fleet_request](#resource-aws_spot_fleet_request)
+
+<!-- /TOC -->
+
+## Provider Version Configuration
+
+-> Before upgrading to version 3.0.0, it is recommended to upgrade to the most recent 2.X version of the provider and ensure that your environment successfully runs [`terraform plan`](https://www.terraform.io/docs/commands/plan.html) without unexpected changes or deprecation notices.
+
+We recommend using [version constraints when configuring Terraform providers](https://www.terraform.io/docs/configuration/providers.html#provider-versions). If you are following that recommendation, update the version constraints in your Terraform configuration and run [`terraform init`](https://www.terraform.io/docs/commands/init.html) to download the new version.
+
+For example, given this previous configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.provider import AwsProvider
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AwsProvider(self, "aws")
+```
+
+Update to latest 3.X version:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.provider import AwsProvider
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AwsProvider(self, "aws")
+```
+
+## Provider Authentication Updates
+
+### Authentication Ordering
+
+Previously, the provider preferred credentials in the following order:
+
+- Static credentials (those defined in the Terraform configuration)
+- Environment variables (e.g., `AWS_ACCESS_KEY_ID` or `AWS_PROFILE`)
+- Shared credentials file (e.g., `~/.aws/credentials`)
+- EC2 Instance Metadata Service
+- Default AWS Go SDK handling (shared configuration, CodeBuild/ECS/EKS)
+
+The provider now prefers the following credential ordering:
+
+- Static credentials (those defined in the Terraform configuration)
+- Environment variables (e.g., `AWS_ACCESS_KEY_ID` or `AWS_PROFILE`)
+- Shared credentials and/or configuration file (e.g., `~/.aws/credentials` and `~/.aws/config`)
+- Default AWS Go SDK handling (shared configuration, CodeBuild/ECS/EKS, EC2 Instance Metadata Service)
+
+This means workarounds of disabling the EC2 Instance Metadata Service handling to enable CodeBuild/ECS/EKS credentials or to enable other credential methods such as `credential_process` in the AWS shared configuration are no longer necessary.
+
+### Shared Configuration File Automatically Enabled
+
+The `AWS_SDK_LOAD_CONFIG` environment variable is no longer necessary for the provider to automatically load the AWS shared configuration file (e.g., `~/.aws/config`).
+
+### Removal of AWS_METADATA_TIMEOUT Environment Variable Usage
+
+The provider now relies on the default AWS Go SDK timeouts for interacting with the EC2 Instance Metadata Service.
+
+## Provider Custom Service Endpoint Updates
+
+### Removal of kinesis_analytics and r53 Arguments
+
+The [custom service endpoints](custom-service-endpoints.html) for Kinesis Analytics and Route 53 now use the `kinesisanalytics` and `route53` argument names in the provider configuration.
+
+For example, given this previous configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.provider import AwsProvider
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AwsProvider(self, "aws",
+            endpoints=[AwsProviderEndpoints(
+                kinesis_analytics="https://example.com",
+                r53="https://example.com"
+            )
+            ]
+        )
+```
+
+An updated configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.provider import AwsProvider
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AwsProvider(self, "aws",
+            endpoints=[AwsProviderEndpoints(
+                kinesisanalytics="https://example.com",
+                route53="https://example.com"
+            )
+            ]
+        )
+```
+
+## Data Source: aws_availability_zones
+
+### blacklisted_names Attribute Removal
+
+Switch your Terraform configuration to the `exclude_names` attribute instead.
+
+For example, given this previous configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_availability_zones import DataAwsAvailabilityZones
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsAvailabilityZones(self, "example",
+            blacklisted_names=["us-west-2d"]
+        )
+```
+
+An updated configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_availability_zones import DataAwsAvailabilityZones
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsAvailabilityZones(self, "example",
+            exclude_names=["us-west-2d"]
+        )
+```
+
+### blacklisted_zone_ids Attribute Removal
+
+Switch your Terraform configuration to the `exclude_zone_ids` attribute instead.
+
+For example, given this previous configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_availability_zones import DataAwsAvailabilityZones
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsAvailabilityZones(self, "example",
+            blacklisted_zone_ids=["usw2-az4"]
+        )
+```
+
+An updated configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_availability_zones import DataAwsAvailabilityZones
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsAvailabilityZones(self, "example",
+            exclude_zone_ids=["usw2-az4"]
+        )
+```
+
+## Data Source: aws_lambda_invocation
+
+### result_map Attribute Removal
+
+Switch your Terraform configuration to the `result` attribute with the [`jsondecode()` function](https://www.terraform.io/docs/configuration/functions/jsondecode.html) instead.
+
+For example, given this previous configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformOutput, Fn, TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        TerraformOutput(self, "lambda_result",
+            value=Fn.lookup_nested(example.result_map, ["\"key1\""])
+        )
+```
+
+An updated configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformOutput, Fn, Token, TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        TerraformOutput(self, "lambda_result",
+            value=Fn.lookup_nested(Fn.jsondecode(Token.as_string(example.result)), ["\"key1\""
+            ])
+        )
+```
+
+## Data Source: aws_launch_template
+
+### Error raised if no matching launch template is found
+
+Previously, when a launch template matching the criteria was not found the data source would have been `null`.
+Now this could produce errors similar to the below:
+
+```
+data.aws_launch_template.current: Refreshing state...
+
+Error: error reading launch template: empty output
+```
+
+Configuration that depend on the previous behavior will need to be updated.
+
+## Data Source: aws_route53_resolver_rule
+
+### Removal of trailing period in domain_name argument
+
+Previously the data-source returned the Resolver Rule Domain Name directly from the API, which included a `.` suffix. This proves difficult when many other AWS services do not accept this trailing period (e.g., ACM Certificate). This period is now automatically removed. For example, when the attribute would previously return a Resolver Rule Domain Name such as `example.com.`, the attribute now will be returned as `example.com`.
+While the returned value will omit the trailing period, use of configurations with trailing periods will not be interrupted.
+
+## Data Source: aws_route53_zone
+
+### Removal of trailing period in name argument
+
+Previously the data-source returned the Hosted Zone Domain Name directly from the API, which included a `.` suffix. This proves difficult when many other AWS services do not accept this trailing period (e.g., ACM Certificate). This period is now automatically removed. For example, when the attribute would previously return a Hosted Zone Domain Name such as `example.com.`, the attribute now will be returned as `example.com`.
+While the returned value will omit the trailing period, use of configurations with trailing periods will not be interrupted.
+
+## Resource: aws_acm_certificate
+
+### domain_validation_options Changed from List to Set
+
+Previously, the `domain_validation_options` attribute was a list type and completely unknown until after an initial `terraform apply`. This generally required complicated configuration workarounds to properly create DNS validation records since referencing this attribute directly could produce errors similar to the below:
+
+```
+Error: Invalid for_each argument
+
+  on main.tf line 16, in resource "aws_route53_record" "existing":
+  16:   for_each = aws_acm_certificate.existing.domain_validation_options
+
+The `for_each` value depends on resource attributes that cannot be determined
+until apply, so Terraform cannot predict how many instances will be created.
+To work around this, use the -target argument to first apply only the
+resources that the for_each depends on.
+```
+
+The `domain_validation_options` attribute is now a set type and the resource will attempt to populate the information necessary during the planning phase to handle the above situation in most environments without workarounds. This change also prevents Terraform from showing unexpected differences if the API returns the results in varying order.
+
+Configuration references to this attribute will likely require updates since sets cannot be indexed (e.g., `domain_validation_options[0]` or the older `domain_validation_options.0.` syntax will return errors).
+If the `domain_validation_options` list previously contained only a single element like the two examples just shown,
+it may be possible to wrap these references using the [`tolist()` function](https://www.terraform.io/docs/configuration/functions/tolist.html)
+<!-- markdownlint-disable-next-line no-reversed-links -->
+(e.g., `tolist(aws_acm_certificate.example.domain_validation_options)[0]`) as a quick configuration update.
+However given the complexity and workarounds required with the previous `domain_validation_options` attribute implementation,
+different environments will require different configuration updates and migration steps.
+Below is a more advanced example.
+Further questions on potential update steps can be submitted to the [community forums](https://discuss.hashicorp.com/c/terraform-providers/tf-aws/33).
+
+For example, given this previous configuration using a `count` based resource approach that may have been used in certain environments:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Op, Token, TerraformCount, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.acm_certificate import AcmCertificate
+from imports.aws.acm_certificate_validation import AcmCertificateValidation
+from imports.aws.data_aws_route53_zone import DataAwsRoute53Zone
+from imports.aws.route53_record import Route53Record
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        existing = AcmCertificate(self, "existing",
+            domain_name="existing.${" + public_root_domain.value + "}",
+            subject_alternative_names=["existing1.${" + public_root_domain.value + "}", "existing2.${" + public_root_domain.value + "}", "existing3.${" + public_root_domain.value + "}"
+            ],
+            validation_method="DNS"
+        )
+        data_aws_route53_zone_public_root_domain = DataAwsRoute53Zone(self, "public_root_domain",
+            name=public_root_domain.string_value
+        )
+        # In most cases loops should be handled in the programming language context and
+        #     not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+        #     you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+        #     you need to keep this like it is.
+        existing_count = TerraformCount.of(
+            Token.as_number(Op.add(Fn.length_of(existing.subject_alternative_names), 1)))
+        aws_route53_record_existing = Route53Record(self, "existing_2",
+            allow_overwrite=True,
+            name=Token.as_string(
+                Fn.lookup_nested(
+                    Fn.lookup_nested(existing.domain_validation_options, [existing_count.index
+                    ]), ["resource_record_name"])),
+            records=[
+                Token.as_string(
+                    Fn.lookup_nested(
+                        Fn.lookup_nested(existing.domain_validation_options, [existing_count.index
+                        ]), ["resource_record_value"]))
+            ],
+            ttl=60,
+            type=Token.as_string(
+                Fn.lookup_nested(
+                    Fn.lookup_nested(existing.domain_validation_options, [existing_count.index
+                    ]), ["resource_record_type"])),
+            zone_id=Token.as_string(data_aws_route53_zone_public_root_domain.zone_id),
+            count=existing_count
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_route53_record_existing.override_logical_id("existing")
+        aws_acm_certificate_validation_existing = AcmCertificateValidation(self, "existing_3",
+            certificate_arn=existing.arn,
+            validation_record_fqdns=Token.as_list(
+                Fn.lookup_nested(aws_route53_record_existing, ["*", "fqdn"]))
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_acm_certificate_validation_existing.override_logical_id("existing")
+```
+
+It will receive errors like the below after upgrading:
+
+```
+Error: Invalid index
+
+  on main.tf line 14, in resource "aws_route53_record" "existing":
+  14:   name    = aws_acm_certificate.existing.domain_validation_options[count.index].resource_record_name
+    |----------------
+    | aws_acm_certificate.existing.domain_validation_options is set of object with 4 elements
+    | count.index is 1
+
+This value does not have any indices.
+```
+
+Since the `domain_validation_options` attribute changed from a list to a set and sets cannot be indexed in Terraform, the recommendation is to update the configuration to use the more stable [resource `for_each` support](https://www.terraform.io/docs/configuration/meta-arguments/for_each.html) instead of [`count`](https://www.terraform.io/docs/configuration/meta-arguments/count.html). Note the slight change in the `validation_record_fqdns` syntax as well.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformIterator, Fn, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.acm_certificate_validation import AcmCertificateValidation
+from imports.aws.route53_record import Route53Record
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        # In most cases loops should be handled in the programming language context and
+        #     not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+        #     you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+        #     you need to keep this like it is.
+        existing_for_each_iterator = TerraformIterator.from_list(
+            Token.as_any("${{ for dvo in ${" + aws_acm_certificate_existing.domain_validation_options + "} : dvo.domain_name => {\n      name   = dvo.resource_record_name\n      record = dvo.resource_record_value\n      type   = dvo.resource_record_type\n    }}}"))
+        existing = Route53Record(self, "existing",
+            allow_overwrite=True,
+            name=Token.as_string(
+                Fn.lookup_nested(existing_for_each_iterator.value, ["name"])),
+            records=[
+                Token.as_string(
+                    Fn.lookup_nested(existing_for_each_iterator.value, ["record"]))
+            ],
+            ttl=60,
+            type=Token.as_string(
+                Fn.lookup_nested(existing_for_each_iterator.value, ["type"])),
+            zone_id=Token.as_string(public_root_domain.zone_id),
+            for_each=existing_for_each_iterator
+        )
+        aws_acm_certificate_validation_existing = AcmCertificateValidation(self, "existing_1",
+            certificate_arn=Token.as_string(aws_acm_certificate_existing.arn),
+            validation_record_fqdns=Token.as_list("${[ for record in ${" + existing.fqn + "} : record.fqdn]}")
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_acm_certificate_validation_existing.override_logical_id("existing")
+```
+
+After the configuration has been updated, a plan should no longer error and may look like the following:
+
+```
+------------------------------------------------------------------------
+
+An execution plan has been generated and is shown below.
+Resource actions are indicated with the following symbols:
+  + create
+  - destroy
+-/+ destroy and then create replacement
+
+Terraform will perform the following actions:
+
+  # aws_acm_certificate_validation.existing must be replaced
+-/+ resource "aws_acm_certificate_validation" "existing" {
+        certificate_arn         = "arn:aws:acm:us-east-2:123456789012:certificate/ccbc58e8-061d-4443-9035-d3af0512e863"
+      ~ id                      = "2020-07-16 00:01:19 +0000 UTC" -> (known after apply)
+      ~ validation_record_fqdns = [
+          - "_40b71647a8d88eb82d53fe988e8a3cc1.existing2.example.com",
+          - "_812ddf11b781af1eec1643ec58f102d2.existing.example.com",
+          - "_8dc56b6e35f699b8754afcdd79e9748d.existing3.example.com",
+          - "_d7112da809a40e848207c04399babcec.existing1.example.com",
+        ] -> (known after apply) # forces replacement
+    }
+
+  # aws_route53_record.existing will be destroyed
+  - resource "aws_route53_record" "existing" {
+      - fqdn    = "_812ddf11b781af1eec1643ec58f102d2.existing.example.com" -> null
+      - id      = "Z123456789012__812ddf11b781af1eec1643ec58f102d2.existing.example.com._CNAME" -> null
+      - name    = "_812ddf11b781af1eec1643ec58f102d2.existing.example.com" -> null
+      - records = [
+          - "_bdeba72164eec216c55a32374bcceafd.jfrzftwwjs.acm-validations.aws.",
+        ] -> null
+      - ttl     = 60 -> null
+      - type    = "CNAME" -> null
+      - zone_id = "Z123456789012" -> null
+    }
+
+  # aws_route53_record.existing[1] will be destroyed
+  - resource "aws_route53_record" "existing" {
+      - fqdn    = "_40b71647a8d88eb82d53fe988e8a3cc1.existing2.example.com" -> null
+      - id      = "Z123456789012__40b71647a8d88eb82d53fe988e8a3cc1.existing2.example.com._CNAME" -> null
+      - name    = "_40b71647a8d88eb82d53fe988e8a3cc1.existing2.example.com" -> null
+      - records = [
+          - "_638532db1fa6a1b71aaf063c8ea29d52.jfrzftwwjs.acm-validations.aws.",
+        ] -> null
+      - ttl     = 60 -> null
+      - type    = "CNAME" -> null
+      - zone_id = "Z123456789012" -> null
+    }
+
+  # aws_route53_record.existing[2] will be destroyed
+  - resource "aws_route53_record" "existing" {
+      - fqdn    = "_d7112da809a40e848207c04399babcec.existing1.example.com" -> null
+      - id      = "Z123456789012__d7112da809a40e848207c04399babcec.existing1.example.com._CNAME" -> null
+      - name    = "_d7112da809a40e848207c04399babcec.existing1.example.com" -> null
+      - records = [
+          - "_6e1da5574ab46a6c782ed73438274181.jfrzftwwjs.acm-validations.aws.",
+        ] -> null
+      - ttl     = 60 -> null
+      - type    = "CNAME" -> null
+      - zone_id = "Z123456789012" -> null
+    }
+
+  # aws_route53_record.existing[3] will be destroyed
+  - resource "aws_route53_record" "existing" {
+      - fqdn    = "_8dc56b6e35f699b8754afcdd79e9748d.existing3.example.com" -> null
+      - id      = "Z123456789012__8dc56b6e35f699b8754afcdd79e9748d.existing3.example.com._CNAME" -> null
+      - name    = "_8dc56b6e35f699b8754afcdd79e9748d.existing3.example.com" -> null
+      - records = [
+          - "_a419f8410d2e0720528a96c3506f3841.jfrzftwwjs.acm-validations.aws.",
+        ] -> null
+      - ttl     = 60 -> null
+      - type    = "CNAME" -> null
+      - zone_id = "Z123456789012" -> null
+    }
+
+  # aws_route53_record.existing["existing.example.com"] will be created
+  + resource "aws_route53_record" "existing" {
+      + allow_overwrite = true
+      + fqdn            = (known after apply)
+      + id              = (known after apply)
+      + name            = "_812ddf11b781af1eec1643ec58f102d2.existing.example.com"
+      + records         = [
+          + "_bdeba72164eec216c55a32374bcceafd.jfrzftwwjs.acm-validations.aws.",
+        ]
+      + ttl             = 60
+      + type            = "CNAME"
+      + zone_id         = "Z123456789012"
+    }
+
+  # aws_route53_record.existing["existing1.example.com"] will be created
+  + resource "aws_route53_record" "existing" {
+      + allow_overwrite = true
+      + fqdn            = (known after apply)
+      + id              = (known after apply)
+      + name            = "_d7112da809a40e848207c04399babcec.existing1.example.com"
+      + records         = [
+          + "_6e1da5574ab46a6c782ed73438274181.jfrzftwwjs.acm-validations.aws.",
+        ]
+      + ttl             = 60
+      + type            = "CNAME"
+      + zone_id         = "Z123456789012"
+    }
+
+  # aws_route53_record.existing["existing2.example.com"] will be created
+  + resource "aws_route53_record" "existing" {
+      + allow_overwrite = true
+      + fqdn            = (known after apply)
+      + id              = (known after apply)
+      + name            = "_40b71647a8d88eb82d53fe988e8a3cc1.existing2.example.com"
+      + records         = [
+          + "_638532db1fa6a1b71aaf063c8ea29d52.jfrzftwwjs.acm-validations.aws.",
+        ]
+      + ttl             = 60
+      + type            = "CNAME"
+      + zone_id         = "Z123456789012"
+    }
+
+  # aws_route53_record.existing["existing3.example.com"] will be created
+  + resource "aws_route53_record" "existing" {
+      + allow_overwrite = true
+      + fqdn            = (known after apply)
+      + id              = (known after apply)
+      + name            = "_8dc56b6e35f699b8754afcdd79e9748d.existing3.example.com"
+      + records         = [
+          + "_a419f8410d2e0720528a96c3506f3841.jfrzftwwjs.acm-validations.aws.",
+        ]
+      + ttl             = 60
+      + type            = "CNAME"
+      + zone_id         = "Z123456789012"
+    }
+
+Plan: 5 to add, 0 to change, 5 to destroy.
+```
+
+Due to the type of configuration change, Terraform does not know that the previous `aws_route53_record` resources (indexed by number in the existing state) and the new resources (indexed by domain names in the updated configuration) are equivalent. Typically in this situation, the [`terraform state mv` command](https://www.terraform.io/docs/commands/state/mv.html) can be used to reduce the plan to show no changes. This is done by associating the count index (e.g., `[1]`) with the equivalent domain name index (e.g., `["existing2.example.com"]`), making one of the four commands to fix the above example: `terraform state mv 'aws_route53_record.existing[1]' 'aws_route53_record.existing["existing2.example.com"]'`. We recommend using this `terraform state mv` update process where possible to reduce chances of unexpected behaviors or changes in an environment.
+
+If using `terraform state mv` to reduce the plan to show no changes, no additional steps are required.
+
+In larger or more complex environments though, this process can be tedius to match the old resource address to the new resource address and run all the necessary `terraform state mv` commands. Instead, since the `aws_route53_record` resource implements the `allow_overwrite = true` argument, it is possible to just remove the old `aws_route53_record` resources from the Terraform state using the [`terraform state rm` command](https://www.terraform.io/docs/commands/state/rm.html). In this case, Terraform will leave the existing records in Route 53 and plan to just overwrite the existing validation records with the same exact (previous) values.
+
+-> This guide is showing the simpler `terraform state rm` option below as a potential shortcut in this specific situation, however in most other cases `terraform state mv` is required to change from `count` based resources to `for_each` based resources and properly match the existing Terraform state to the updated Terraform configuration.
+
+```console
+$ terraform state rm aws_route53_record.existing
+Removed aws_route53_record.existing[0]
+Removed aws_route53_record.existing[1]
+Removed aws_route53_record.existing[2]
+Removed aws_route53_record.existing[3]
+Successfully removed 4 resource instance(s).
+```
+
+Now the Terraform plan will show only the additions of new Route 53 records (which are exactly the same as before the upgrade) and the proposed recreation of the `aws_acm_certificate_validation` resource. The `aws_acm_certificate_validation` resource recreation will have no effect as the certificate is already validated and issued.
+
+```
+An execution plan has been generated and is shown below.
+Resource actions are indicated with the following symbols:
+  + create
+-/+ destroy and then create replacement
+
+Terraform will perform the following actions:
+
+  # aws_acm_certificate_validation.existing must be replaced
+-/+ resource "aws_acm_certificate_validation" "existing" {
+        certificate_arn         = "arn:aws:acm:us-east-2:123456789012:certificate/ccbc58e8-061d-4443-9035-d3af0512e863"
+      ~ id                      = "2020-07-16 00:01:19 +0000 UTC" -> (known after apply)
+      ~ validation_record_fqdns = [
+          - "_40b71647a8d88eb82d53fe988e8a3cc1.existing2.example.com",
+          - "_812ddf11b781af1eec1643ec58f102d2.existing.example.com",
+          - "_8dc56b6e35f699b8754afcdd79e9748d.existing3.example.com",
+          - "_d7112da809a40e848207c04399babcec.existing1.example.com",
+        ] -> (known after apply) # forces replacement
+    }
+
+  # aws_route53_record.existing["existing.example.com"] will be created
+  + resource "aws_route53_record" "existing" {
+      + allow_overwrite = true
+      + fqdn            = (known after apply)
+      + id              = (known after apply)
+      + name            = "_812ddf11b781af1eec1643ec58f102d2.existing.example.com"
+      + records         = [
+          + "_bdeba72164eec216c55a32374bcceafd.jfrzftwwjs.acm-validations.aws.",
+        ]
+      + ttl             = 60
+      + type            = "CNAME"
+      + zone_id         = "Z123456789012"
+    }
+
+  # aws_route53_record.existing["existing1.example.com"] will be created
+  + resource "aws_route53_record" "existing" {
+      + allow_overwrite = true
+      + fqdn            = (known after apply)
+      + id              = (known after apply)
+      + name            = "_d7112da809a40e848207c04399babcec.existing1.example.com"
+      + records         = [
+          + "_6e1da5574ab46a6c782ed73438274181.jfrzftwwjs.acm-validations.aws.",
+        ]
+      + ttl             = 60
+      + type            = "CNAME"
+      + zone_id         = "Z123456789012"
+    }
+
+  # aws_route53_record.existing["existing2.example.com"] will be created
+  + resource "aws_route53_record" "existing" {
+      + allow_overwrite = true
+      + fqdn            = (known after apply)
+      + id              = (known after apply)
+      + name            = "_40b71647a8d88eb82d53fe988e8a3cc1.existing2.example.com"
+      + records         = [
+          + "_638532db1fa6a1b71aaf063c8ea29d52.jfrzftwwjs.acm-validations.aws.",
+        ]
+      + ttl             = 60
+      + type            = "CNAME"
+      + zone_id         = "Z123456789012"
+    }
+
+  # aws_route53_record.existing["existing3.example.com"] will be created
+  + resource "aws_route53_record" "existing" {
+      + allow_overwrite = true
+      + fqdn            = (known after apply)
+      + id              = (known after apply)
+      + name            = "_8dc56b6e35f699b8754afcdd79e9748d.existing3.example.com"
+      + records         = [
+          + "_a419f8410d2e0720528a96c3506f3841.jfrzftwwjs.acm-validations.aws.",
+        ]
+      + ttl             = 60
+      + type            = "CNAME"
+      + zone_id         = "Z123456789012"
+    }
+
+Plan: 5 to add, 0 to change, 1 to destroy.
+```
+
+Once applied, no differences should be shown and no additional steps should be necessary.
+
+Alternatively, if you are referencing a subset of `domain_validation_options`, there is another method of upgrading from v2 to v3 without having to move state. Given the scenario below...
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.acm_certificate import AcmCertificate
+from imports.aws.acm_certificate_validation import AcmCertificateValidation
+from imports.aws.data_aws_route53_zone import DataAwsRoute53Zone
+from imports.aws.route53_record import Route53Record
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        existing = AcmCertificate(self, "existing",
+            domain_name="existing.${" + public_root_domain.value + "}",
+            subject_alternative_names=["existing1.${" + public_root_domain.value + "}", "existing2.${" + public_root_domain.value + "}", "existing3.${" + public_root_domain.value + "}"
+            ],
+            validation_method="DNS"
+        )
+        data_aws_route53_zone_public_root_domain = DataAwsRoute53Zone(self, "public_root_domain",
+            name=public_root_domain.string_value
+        )
+        existing1 = Route53Record(self, "existing_1",
+            allow_overwrite=True,
+            name=Token.as_string(
+                Fn.lookup_nested(existing.domain_validation_options, ["0", "resource_record_name"
+                ])),
+            records=[
+                Token.as_string(
+                    Fn.lookup_nested(existing.domain_validation_options, ["0", "resource_record_value"
+                    ]))
+            ],
+            ttl=60,
+            type=Token.as_string(
+                Fn.lookup_nested(existing.domain_validation_options, ["0", "resource_record_type"
+                ])),
+            zone_id=Token.as_string(data_aws_route53_zone_public_root_domain.zone_id)
+        )
+        existing3 = Route53Record(self, "existing_3",
+            allow_overwrite=True,
+            name=Token.as_string(
+                Fn.lookup_nested(existing.domain_validation_options, ["2", "resource_record_name"
+                ])),
+            records=[
+                Token.as_string(
+                    Fn.lookup_nested(existing.domain_validation_options, ["2", "resource_record_value"
+                    ]))
+            ],
+            ttl=60,
+            type=Token.as_string(
+                Fn.lookup_nested(existing.domain_validation_options, ["2", "resource_record_type"
+                ])),
+            zone_id=Token.as_string(data_aws_route53_zone_public_root_domain.zone_id)
+        )
+        aws_acm_certificate_validation_existing1 = AcmCertificateValidation(self, "existing_1_4",
+            certificate_arn=existing.arn,
+            validation_record_fqdns=Token.as_list(existing1.fqdn)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_acm_certificate_validation_existing1.override_logical_id("existing_1")
+        aws_acm_certificate_validation_existing3 = AcmCertificateValidation(self, "existing_3_5",
+            certificate_arn=existing.arn,
+            validation_record_fqdns=Token.as_list(existing3.fqdn)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_acm_certificate_validation_existing3.override_logical_id("existing_3")
+```
+
+You can perform a conversion of the new `domain_validation_options` object into a map, to allow you to perform a lookup by the domain name in place of an index number.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.acm_certificate_validation import AcmCertificateValidation
+from imports.aws.route53_record import Route53Record
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        existing_domain_validation_options = "${{ for dvo in ${" + cloudfront_cert.domain_validation_options + "} : dvo.domain_name => {\n      name   = dvo.resource_record_name\n      record = dvo.resource_record_value\n      type   = dvo.resource_record_type\n    }}}"
+        existing1 = Route53Record(self, "existing_1",
+            allow_overwrite=True,
+            name=Token.as_string(
+                Fn.lookup_nested(
+                    Fn.lookup_nested(existing_domain_validation_options, ["existing1.${" + public_root_domain.value + "}"
+                    ]), ["name"])),
+            records=[
+                Token.as_string(
+                    Fn.lookup_nested(
+                        Fn.lookup_nested(existing_domain_validation_options, ["existing1.${" + public_root_domain.value + "}"
+                        ]), ["record"]))
+            ],
+            ttl=60,
+            type=Token.as_string(
+                Fn.lookup_nested(
+                    Fn.lookup_nested(existing_domain_validation_options, ["existing1.${" + public_root_domain.value + "}"
+                    ]), ["type"])),
+            zone_id=Token.as_string(data_aws_route53_zone_public_root_domain.zone_id)
+        )
+        existing3 = Route53Record(self, "existing_3",
+            allow_overwrite=True,
+            name=Token.as_string(
+                Fn.lookup_nested(
+                    Fn.lookup_nested(existing_domain_validation_options, ["existing3.${" + public_root_domain.value + "}"
+                    ]), ["name"])),
+            records=[
+                Token.as_string(
+                    Fn.lookup_nested(
+                        Fn.lookup_nested(existing_domain_validation_options, ["existing3.${" + public_root_domain.value + "}"
+                        ]), ["record"]))
+            ],
+            ttl=60,
+            type=Token.as_string(
+                Fn.lookup_nested(
+                    Fn.lookup_nested(existing_domain_validation_options, ["existing3.${" + public_root_domain.value + "}"
+                    ]), ["type"])),
+            zone_id=Token.as_string(data_aws_route53_zone_public_root_domain.zone_id)
+        )
+        aws_acm_certificate_validation_existing1 = AcmCertificateValidation(self, "existing_1_2",
+            certificate_arn=existing.arn,
+            validation_record_fqdns=Token.as_list(existing1.fqdn)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_acm_certificate_validation_existing1.override_logical_id("existing_1")
+        aws_acm_certificate_validation_existing3 = AcmCertificateValidation(self, "existing_3_3",
+            certificate_arn=existing.arn,
+            validation_record_fqdns=Token.as_list(existing3.fqdn)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_acm_certificate_validation_existing3.override_logical_id("existing_3")
+```
+
+Performing a plan against these resources will not cause any change in state, since underlying resources have not changed.
+
+### subject_alternative_names Changed from List to Set
+
+Previously the `subject_alternative_names` argument was stored in the Terraform state as an ordered list while the API returned information in an unordered manner. The attribute is now configured as a set instead of a list. Certain Terraform configuration language features distinguish between these two attribute types such as not being able to index a set (e.g., `aws_acm_certificate.example.subject_alternative_names[0]` is no longer a valid reference). Depending on the implementation details of a particular configuration using `subject_alternative_names` as a reference, possible solutions include changing references to using `for`/`for_each` or using the `tolist()` function as a temporary workaround to keep the previous behavior until an appropriate configuration (properly using the unordered set) can be determined. Usage questions can be submitted to the [community forums](https://discuss.hashicorp.com/c/terraform-providers/tf-aws/33).
+
+### certificate_body, certificate_chain, and private_key Arguments No Longer Stored as Hash
+
+Previously when the `certificate_body`, `certificate_chain`, and `private_key` arguments were stored in state, they were stored as a hash of the actual value. This prevented Terraform from properly updating the resource when necessary and the hashing has been removed. The Terraform AWS Provider will show an update to these arguments on the first apply after upgrading to version 3.0.0, which is fixing the Terraform state to remove the hash. Since the `private_key` attribute is marked as sensitive, the values in the update will not be visible in the Terraform output. If the non-hashed values have not changed, then no update is occurring other than the Terraform state update. If these arguments are the only updates and they all match the hash removal, the apply will occur without submitting API calls.
+
+## Resource: aws_api_gateway_method_settings
+
+### throttling_burst_limit and throttling_rate_limit Arguments Now Default to -1
+
+Previously when the `throttling_burst_limit` or `throttling_rate_limit` argument was not configured, the resource would enable throttling and set the limit value to the AWS API Gateway default. In addition, as these arguments were marked as `Computed`, Terraform ignored any subsequent changes made to these arguments in the resource. These behaviors have been removed and, by default, the `throttling_burst_limit` and `throttling_rate_limit` arguments will be disabled in the resource with a value of `-1`.
+
+## Resource: aws_autoscaling_group
+
+### availability_zones and vpc_zone_identifier Arguments Now Report Plan-Time Conflict
+
+Specifying both the `availability_zones` and `vpc_zone_identifier` arguments previously led to confusing behavior and errors. Now this issue is reported at plan-time. Use the `null` value instead of `[]` (empty list) in conditionals to ensure this validation does not unexpectedly trigger.
+
+### Drift detection enabled for `load_balancers` and `target_group_arns` arguments
+
+If you previously set one of these arguments to an empty list to enable drift detection (e.g., when migrating an ASG from ELB to ALB), this can be updated as follows.
+
+For example, given this previous configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.autoscaling_group import AutoscalingGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, maxSize, minSize):
+        super().__init__(scope, name)
+        AutoscalingGroup(self, "example",
+            load_balancers=[],
+            target_group_arns=[Token.as_string(aws_lb_target_group_example.arn)],
+            max_size=max_size,
+            min_size=min_size
+        )
+```
+
+An updated configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.autoscaling_group import AutoscalingGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, maxSize, minSize):
+        super().__init__(scope, name)
+        AutoscalingGroup(self, "example",
+            target_group_arns=[Token.as_string(aws_lb_target_group_example.arn)],
+            max_size=max_size,
+            min_size=min_size
+        )
+```
+
+If `aws_autoscaling_attachment` resources reference your ASG configurations, you will need to add the [`lifecycle` configuration block](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html) with an `ignore_changes` argument to prevent Terraform non-empty plans (i.e., forcing resource update) during the next state refresh.
+
+For example, given this previous configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.autoscaling_attachment import AutoscalingAttachment
+from imports.aws.autoscaling_group import AutoscalingGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, maxSize, minSize):
+        super().__init__(scope, name)
+        example = AutoscalingGroup(self, "example",
+            max_size=max_size,
+            min_size=min_size
+        )
+        aws_autoscaling_attachment_example = AutoscalingAttachment(self, "example_1",
+            autoscaling_group_name=example.id,
+            elb=Token.as_string(aws_elb_example.id)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_autoscaling_attachment_example.override_logical_id("example")
+```
+
+An updated configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from cdktf import TerraformResourceLifecycle
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.autoscaling_attachment import AutoscalingAttachment
+from imports.aws.autoscaling_group import AutoscalingGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, maxSize, minSize):
+        super().__init__(scope, name)
+        example = AutoscalingGroup(self, "example",
+            lifecycle=TerraformResourceLifecycle(
+                ignore_changes=[load_balancers, target_group_arns]
+            ),
+            max_size=max_size,
+            min_size=min_size
+        )
+        aws_autoscaling_attachment_example = AutoscalingAttachment(self, "example_1",
+            autoscaling_group_name=example.id,
+            elb=Token.as_string(aws_elb_example.id)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_autoscaling_attachment_example.override_logical_id("example")
+```
+
+## Resource: aws_cloudfront_distribution
+
+### active_trusted_signers Attribute Name and Type Change
+
+Previously, the `active_trusted_signers` computed attribute was implemented with a Map that did not support accessing its computed `items` attribute in Terraform 0.12 correctly.
+To address this, the `active_trusted_signers` attribute has been renamed to `trusted_signers` and is now implemented as a List with a computed `items` List attribute and computed `enabled` boolean attribute.
+The nested `items` attribute includes computed `aws_account_number` and `key_pair_ids` sub-fields, with the latter implemented as a List.
+Thus, user configurations referencing the `active_trusted_signers` attribute and its sub-fields will need to be changed as follows.
+
+Given these previous references:
+
+```
+aws_cloudfront_distribution.example.active_trusted_signers.enabled
+aws_cloudfront_distribution.example.active_trusted_signers.items
+```
+
+Updated references:
+
+```
+aws_cloudfront_distribution.example.trusted_signers[0].enabled
+aws_cloudfront_distribution.example.trusted_signers[0].items
+```
+
+## Resource: aws_cloudwatch_log_group
+
+### Removal of arn Wildcard Suffix
+
+Previously, the resource returned the ARN directly from the API, which included a `:*` suffix to denote all CloudWatch Log Streams under the CloudWatch Log Group. Most other AWS resources that return ARNs and many other AWS services do not use the `:*` suffix. The suffix is now automatically removed. For example, the resource previously returned an ARN such as `arn:aws:logs:us-east-1:123456789012:log-group:/example:*` but will now return `arn:aws:logs:us-east-1:123456789012:log-group:/example`.
+
+Workarounds, such as using `replace()` as shown below, should be removed:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudwatch_log_group import CloudwatchLogGroup
+from imports.aws.datasync_task import DatasyncTask
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, destinationLocationArn, sourceLocationArn):
+        super().__init__(scope, name)
+        example = CloudwatchLogGroup(self, "example",
+            name="example"
+        )
+        aws_datasync_task_example = DatasyncTask(self, "example_1",
+            cloudwatch_log_group_arn=Token.as_string(Fn.replace(example.arn, ":*", "")),
+            destination_location_arn=destination_location_arn,
+            source_location_arn=source_location_arn
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_datasync_task_example.override_logical_id("example")
+```
+
+Removing the `:*` suffix is a breaking change for some configurations. Fix these configurations using string interpolations as demonstrated below. For example, this configuration is now broken:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsIamPolicyDocument(self, "ad-log-policy",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["logs:CreateLogStream", "logs:PutLogEvents"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["ds.amazonaws.com"],
+                    type="Service"
+                )
+                ],
+                resources=[example.arn]
+            )
+            ]
+        )
+```
+
+An updated configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsIamPolicyDocument(self, "ad-log-policy",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["logs:CreateLogStream", "logs:PutLogEvents"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["ds.amazonaws.com"],
+                    type="Service"
+                )
+                ],
+                resources=["${" + example.arn + "}:*"]
+            )
+            ]
+        )
+```
+
+## Resource: aws_codepipeline
+
+### GITHUB_TOKEN environment variable removal
+
+Switch your Terraform configuration to the `OAuthToken` element in the `action` `configuration` map instead.
+
+For example, given this previous configuration:
+
+```console
+$ GITHUB_TOKEN=<token> terraform apply
+```
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.codepipeline import Codepipeline
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, artifactStore, name, roleArn):
+        super().__init__(scope, name)
+        Codepipeline(self, "example",
+            stage=[CodepipelineStage(
+                action=[CodepipelineStageAction(
+                    category="Source",
+                    configuration={
+                        "Branch": "main",
+                        "Owner": "lifesum-terraform",
+                        "Repo": "example"
+                    },
+                    name="Source",
+                    output_artifacts=["example"],
+                    owner="ThirdParty",
+                    provider="GitHub",
+                    version="1"
+                )
+                ],
+                name="Source"
+            )
+            ],
+            artifact_store=artifact_store,
+            name=name,
+            role_arn=role_arn
+        )
+```
+
+The configuration could be updated as follows:
+
+```console
+$ TF_VAR_github_token=<token> terraform apply
+```
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformVariable, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.codepipeline import Codepipeline
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, artifactStore, name, roleArn):
+        super().__init__(scope, name)
+        # Terraform Variables are not always the best fit for getting inputs in the context of Terraform CDK.
+        #     You can read more about this at https://cdk.tf/variables
+        github_token = TerraformVariable(self, "github_token")
+        Codepipeline(self, "example",
+            stage=[CodepipelineStage(
+                action=[CodepipelineStageAction(
+                    category="Source",
+                    configuration={
+                        "Branch": "main",
+                        "OAuthToken": github_token.string_value,
+                        "Owner": "lifesum-terraform",
+                        "Repo": "example"
+                    },
+                    name="Source",
+                    output_artifacts=["example"],
+                    owner="ThirdParty",
+                    provider="GitHub",
+                    version="1"
+                )
+                ],
+                name="Source"
+            )
+            ],
+            artifact_store=artifact_store,
+            name=name,
+            role_arn=role_arn
+        )
+```
+
+## Resource: aws_cognito_user_pool
+
+### Removal of admin_create_user_config.unused_account_validity_days Argument
+
+The Cognito API previously deprecated the `admin_create_user_config` configuration block `unused_account_validity_days` argument in preference of the `password_policy` configuration block `temporary_password_validity_days` argument. Configurations will need to be updated to use the API supported configuration.
+
+For example, given this previous configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cognito_user_pool import CognitoUserPool
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, name):
+        super().__init__(scope, name)
+        CognitoUserPool(self, "example",
+            admin_create_user_config=CognitoUserPoolAdminCreateUserConfig(
+                unused_account_validity_days=7
+            ),
+            name=name
+        )
+```
+
+An updated configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cognito_user_pool import CognitoUserPool
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, name):
+        super().__init__(scope, name)
+        CognitoUserPool(self, "example",
+            password_policy=CognitoUserPoolPasswordPolicy(
+                temporary_password_validity_days=7
+            ),
+            name=name
+        )
+```
+
+## Resource: aws_dx_gateway
+
+### Removal of Automatic aws_dx_gateway_association Import
+
+Previously when importing the `aws_dx_gateway` resource with the [`terraform import` command](https://www.terraform.io/docs/commands/import.html), the Terraform AWS Provider would automatically attempt to import an associated `aws_dx_gateway_association` resource(s) as well. This automatic resource import has been removed. Use the [`aws_dx_gateway_association` resource import](/docs/providers/aws/r/dx_gateway_association.html#import) to import those resources separately.
+
+## Resource: aws_dx_gateway_association
+
+### vpn_gateway_id Argument Removal
+
+Switch your Terraform configuration to the `associated_gateway_id` argument instead.
+
+For example, given this previous configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.dx_gateway_association import DxGatewayAssociation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, dxGatewayId):
+        super().__init__(scope, name)
+        DxGatewayAssociation(self, "example",
+            vpn_gateway_id=Token.as_string(aws_vpn_gateway_example.id),
+            dx_gateway_id=dx_gateway_id
+        )
+```
+
+An updated configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.dx_gateway_association import DxGatewayAssociation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, dxGatewayId):
+        super().__init__(scope, name)
+        DxGatewayAssociation(self, "example",
+            associated_gateway_id=Token.as_string(aws_vpn_gateway_example.id),
+            dx_gateway_id=dx_gateway_id
+        )
+```
+
+## Resource: aws_dx_gateway_association_proposal
+
+### vpn_gateway_id Argument Removal
+
+Switch your Terraform configuration to the `associated_gateway_id` argument instead.
+
+For example, given this previous configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.dx_gateway_association_proposal import DxGatewayAssociationProposal
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, associatedGatewayId, dxGatewayId, dxGatewayOwnerAccountId):
+        super().__init__(scope, name)
+        DxGatewayAssociationProposal(self, "example",
+            vpn_gateway_id=aws_vpn_gateway_example.id,
+            associated_gateway_id=associated_gateway_id,
+            dx_gateway_id=dx_gateway_id,
+            dx_gateway_owner_account_id=dx_gateway_owner_account_id
+        )
+```
+
+An updated configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.dx_gateway_association_proposal import DxGatewayAssociationProposal
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, dxGatewayId, dxGatewayOwnerAccountId):
+        super().__init__(scope, name)
+        DxGatewayAssociationProposal(self, "example",
+            associated_gateway_id=Token.as_string(aws_vpn_gateway_example.id),
+            dx_gateway_id=dx_gateway_id,
+            dx_gateway_owner_account_id=dx_gateway_owner_account_id
+        )
+```
+
+## Resource: aws_ebs_volume
+
+### iops Argument Apply-Time Validation
+
+Previously when the `iops` argument was configured with a `type` other than `io1` (either explicitly or omitted, indicating the default type `gp2`), the Terraform AWS Provider would automatically disregard the value provided to `iops` as it is only configurable for the `io1` volume type per the AWS EC2 API. This behavior has changed such that the Terraform AWS Provider will instead return an error at apply time indicating an `iops` value is invalid for types other than `io1`.
+Exceptions to this are in cases where `iops` is set to `null` or `0` such that the Terraform AWS Provider will continue to accept the value regardless of `type`.
+
+## Resource: aws_elastic_transcoder_preset
+
+### video Configuration Block max_frame_rate Argument No Longer Uses 30 Default
+
+Previously when the `max_frame_rate` argument was not configured, the resource would default to 30. This behavior has been removed and allows for auto frame rate presets to automatically set the appropriate value.
+
+## Resource: aws_emr_cluster
+
+### core_instance_count Argument Removal
+
+Switch your Terraform configuration to the `core_instance_group` configuration block instead.
+
+For example, given this previous configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.emr_cluster import EmrCluster
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, name, releaseLabel, serviceRole):
+        super().__init__(scope, name)
+        EmrCluster(self, "example",
+            core_instance_count=2,
+            name=name,
+            release_label=release_label,
+            service_role=service_role
+        )
+```
+
+An updated configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.emr_cluster import EmrCluster
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, instanceType, name, releaseLabel, serviceRole):
+        super().__init__(scope, name)
+        EmrCluster(self, "example",
+            core_instance_group=EmrClusterCoreInstanceGroup(
+                instance_count=2,
+                instance_type=instance_type
+            ),
+            name=name,
+            release_label=release_label,
+            service_role=service_role
+        )
+```
+
+### core_instance_type Argument Removal
+
+Switch your Terraform configuration to the `core_instance_group` configuration block instead.
+
+For example, given this previous configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.emr_cluster import EmrCluster
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, name, releaseLabel, serviceRole):
+        super().__init__(scope, name)
+        EmrCluster(self, "example",
+            core_instance_type="m4.large",
+            name=name,
+            release_label=release_label,
+            service_role=service_role
+        )
+```
+
+An updated configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.emr_cluster import EmrCluster
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, name, releaseLabel, serviceRole):
+        super().__init__(scope, name)
+        EmrCluster(self, "example",
+            core_instance_group=EmrClusterCoreInstanceGroup(
+                instance_type="m4.large"
+            ),
+            name=name,
+            release_label=release_label,
+            service_role=service_role
+        )
+```
+
+### instance_group Configuration Block Removal
+
+Switch your Terraform configuration to the `master_instance_group` and `core_instance_group` configuration blocks instead. For any task instance groups, use the `aws_emr_instance_group` resource.
+
+For example, given this previous configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.emr_cluster import EmrCluster
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, name, releaseLabel, serviceRole):
+        super().__init__(scope, name)
+        EmrCluster(self, "example",
+            instance_group=[{
+                "instance_role": "MASTER",
+                "instance_type": "m4.large"
+            }, {
+                "instance_count": 1,
+                "instance_role": "CORE",
+                "instance_type": "c4.large"
+            }, {
+                "instance_count": 2,
+                "instance_role": "TASK",
+                "instance_type": "c4.xlarge"
+            }
+            ],
+            name=name,
+            release_label=release_label,
+            service_role=service_role
+        )
+```
+
+An updated configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.emr_cluster import EmrCluster
+from imports.aws.emr_instance_group import EmrInstanceGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, name, releaseLabel, serviceRole):
+        super().__init__(scope, name)
+        example = EmrCluster(self, "example",
+            core_instance_group=EmrClusterCoreInstanceGroup(
+                instance_count=1,
+                instance_type="c4.large"
+            ),
+            master_instance_group=EmrClusterMasterInstanceGroup(
+                instance_type="m4.large"
+            ),
+            name=name,
+            release_label=release_label,
+            service_role=service_role
+        )
+        aws_emr_instance_group_example = EmrInstanceGroup(self, "example_1",
+            cluster_id=example.id,
+            instance_count=2,
+            instance_type="c4.xlarge"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_emr_instance_group_example.override_logical_id("example")
+```
+
+### master_instance_type Argument Removal
+
+Switch your Terraform configuration to the `master_instance_group` configuration block instead.
+
+For example, given this previous configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.emr_cluster import EmrCluster
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, name, releaseLabel, serviceRole):
+        super().__init__(scope, name)
+        EmrCluster(self, "example",
+            master_instance_type="m4.large",
+            name=name,
+            release_label=release_label,
+            service_role=service_role
+        )
+```
+
+An updated configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.emr_cluster import EmrCluster
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, name, releaseLabel, serviceRole):
+        super().__init__(scope, name)
+        EmrCluster(self, "example",
+            master_instance_group=EmrClusterMasterInstanceGroup(
+                instance_type="m4.large"
+            ),
+            name=name,
+            release_label=release_label,
+            service_role=service_role
+        )
+```
+
+## Resource: aws_glue_job
+
+### allocated_capacity Argument Removal
+
+The Glue API has deprecated the `allocated_capacity` argument. Switch your Terraform configuration to the `max_capacity` argument instead.
+
+For example, given this previous configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.glue_job import GlueJob
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, command, name, roleArn):
+        super().__init__(scope, name)
+        GlueJob(self, "example",
+            allocated_capacity=2,
+            command=command,
+            name=name,
+            role_arn=role_arn
+        )
+```
+
+An updated configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.glue_job import GlueJob
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, command, name, roleArn):
+        super().__init__(scope, name)
+        GlueJob(self, "example",
+            max_capacity=2,
+            command=command,
+            name=name,
+            role_arn=role_arn
+        )
+```
+
+## Resource: aws_iam_access_key
+
+### ses_smtp_password Attribute Removal
+
+In many regions today and in all regions after October 1, 2020, the [SES API will only accept version 4 signatures](https://docs.aws.amazon.com/ses/latest/DeveloperGuide/using-ses-api-authentication.html). If referencing the `ses_smtp_password` attribute, switch your Terraform configuration to the `ses_smtp_password_v4` attribute instead. Please note that this signature is based on the region of the Terraform AWS Provider. If you need the SES v4 password in multiple regions, it may require using [multiple provider instances](https://www.terraform.io/docs/configuration/providers.html#alias-multiple-provider-configurations).
+
+Depending on when the `aws_iam_access_key` resource was created, it may not have a `ses_smtp_password_v4` attribute for you to use. If this is the case you will need to [taint](/docs/commands/taint.html) the resource so that it can be recreated with the new value.
+
+Alternatively, you can stage the change by creating a new `aws_iam_access_key` resource and change any downstream dependencies to use the new `ses_smtp_password_v4` attribute. Once dependents have been updated with the new resource you can remove the old one.
+
+## Resource: aws_iam_instance_profile
+
+### roles Argument Removal
+
+Switch your Terraform configuration to the `role` argument instead.
+
+For example, given this previous configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.iam_instance_profile import IamInstanceProfile
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        IamInstanceProfile(self, "example",
+            roles=[aws_iam_role_example.id]
+        )
+```
+
+An updated configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.iam_instance_profile import IamInstanceProfile
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        IamInstanceProfile(self, "example",
+            role=Token.as_string(aws_iam_role_example.id)
+        )
+```
+
+## Resource: aws_iam_server_certificate
+
+### certificate_body, certificate_chain, and private_key Arguments No Longer Stored as Hash
+
+Previously when the `certificate_body`, `certificate_chain`, and `private_key` arguments were stored in state, they were stored as a hash of the actual value. This hashing has been removed for new or recreated resources to prevent lifecycle issues.
+
+## Resource: aws_instance
+
+### ebs_block_device.iops and root_block_device.iops Argument Apply-Time Validations
+
+Previously when the `iops` argument was configured in either the `ebs_block_device` or `root_block_device` configuration block, the Terraform AWS Provider would automatically disregard the value provided to `iops` if the `type` argument was also configured with a value other than `io1` (either explicitly or omitted, indicating the default type `gp2`) as `iops` are only configurable for the `io1` volume type per the AWS EC2 API. This behavior has changed such that the Terraform AWS Provider will instead return an error at apply time indicating an `iops` value is invalid for volume types other than `io1`.
+Exceptions to this are in cases where `iops` is set to `null` or `0` such that the Terraform AWS Provider will continue to accept the value regardless of `type`.
+
+## Resource: aws_lambda_alias
+
+### Import No Longer Converts Function Name to ARN
+
+Previously the resource import would always convert the `function_name` portion of the import identifier into the ARN format. Configurations using the Lambda Function name would show this as an unexpected difference after import. Now this will passthrough the given value on import whether its a Lambda Function name or ARN.
+
+## Resource: aws_launch_template
+
+### network_interfaces.delete_on_termination Argument type change
+
+The `network_interfaces.delete_on_termination` argument is now of type `string`, allowing an unspecified value for the argument since the previous `bool` type only allowed for `true/false` and defaulted to `false` when no value was set. Now to enforce `delete_on_termination` to `false`, the string `"false"` or bare `false` value must be used.
+
+For example, given this previous configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.launch_template import LaunchTemplate
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        LaunchTemplate(self, "example",
+            network_interfaces=[LaunchTemplateNetworkInterfaces(
+                delete_on_termination=[null]
+            )
+            ]
+        )
+```
+
+An updated configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.launch_template import LaunchTemplate
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        LaunchTemplate(self, "example",
+            network_interfaces=[LaunchTemplateNetworkInterfaces(
+                delete_on_termination=Token.as_string(False)
+            )
+            ]
+        )
+```
+
+## Resource: aws_lb_listener_rule
+
+### condition.field and condition.values Arguments Removal
+
+Switch your Terraform configuration to use the `host_header` or `path_pattern` configuration block instead.
+
+For example, given this previous configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.lb_listener_rule import LbListenerRule
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, action, listenerArn):
+        super().__init__(scope, name)
+        LbListenerRule(self, "example",
+            condition=[LbListenerRuleCondition(
+                field="path-pattern",
+                values=["/static/*"]
+            )
+            ],
+            action=action,
+            listener_arn=listener_arn
+        )
+```
+
+An updated configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.lb_listener_rule import LbListenerRule
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, action, listenerArn):
+        super().__init__(scope, name)
+        LbListenerRule(self, "example",
+            condition=[LbListenerRuleCondition(
+                path_pattern=LbListenerRuleConditionPathPattern(
+                    values=["/static/*"]
+                )
+            )
+            ],
+            action=action,
+            listener_arn=listener_arn
+        )
+```
+
+## Resource: aws_msk_cluster
+
+### encryption_info.encryption_in_transit.client_broker Default Updated to Match API
+
+A few weeks after general availability launch and initial release of the `aws_msk_cluster` resource, the MSK API default for client broker encryption switched from `TLS_PLAINTEXT` to `TLS`. The attribute default has now been updated to match the more secure API default, however existing Terraform configurations may show a difference if this setting is not configured.
+
+To continue using the old default when it was previously not configured, add or modify this configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.msk_cluster import MskCluster
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, brokerNodeGroupInfo, clusterName, kafkaVersion, numberOfBrokerNodes):
+        super().__init__(scope, name)
+        MskCluster(self, "example",
+            encryption_info=MskClusterEncryptionInfo(
+                encryption_in_transit=MskClusterEncryptionInfoEncryptionInTransit(
+                    client_broker="TLS_PLAINTEXT"
+                )
+            ),
+            broker_node_group_info=broker_node_group_info,
+            cluster_name=cluster_name,
+            kafka_version=kafka_version,
+            number_of_broker_nodes=number_of_broker_nodes
+        )
+```
+
+## Resource: aws_rds_cluster
+
+### scaling_configuration.min_capacity Now Defaults to 1
+
+Previously when the `min_capacity` argument in a `scaling_configuration` block was not configured, the resource would default to 2. This behavior has been updated to align with the AWS RDS Cluster API default of 1.
+
+## Resource: aws_route53_resolver_rule
+
+### Removal of trailing period in domain_name argument
+
+Previously the resource returned the Resolver Rule Domain Name directly from the API, which included a `.` suffix. This proves difficult when many other AWS services do not accept this trailing period (e.g., ACM Certificate). This period is now automatically removed. For example, when the attribute would previously return a Resolver Rule Domain Name such as `example.com.`, the attribute now will be returned as `example.com`.
+While the returned value will omit the trailing period, use of configurations with trailing periods will not be interrupted.
+
+## Resource: aws_route53_zone
+
+### Removal of trailing period in name argument
+
+Previously the resource returned the Hosted Zone Domain Name directly from the API, which included a `.` suffix. This proves difficult when many other AWS services do not accept this trailing period (e.g., ACM Certificate). This period is now automatically removed. For example, when the attribute would previously return a Hosted Zone Domain Name such as `example.com.`, the attribute now will be returned as `example.com`.
+While the returned value will omit the trailing period, use of configurations with trailing periods will not be interrupted.
+
+## Resource: aws_s3_bucket
+
+### Removal of Automatic aws_s3_bucket_policy Import
+
+Previously when importing the `aws_s3_bucket` resource with the [`terraform import` command](https://www.terraform.io/docs/commands/import.html), the Terraform AWS Provider would automatically attempt to import an associated `aws_s3_bucket_policy` resource as well. This automatic resource import has been removed. Use the [`aws_s3_bucket_policy` resource import](/docs/providers/aws/r/s3_bucket_policy.html#import) to import that resource separately.
+
+### region Attribute Is Now Read-Only
+
+The `region` attribute is no longer configurable, but it remains as a read-only attribute. The region of the `aws_s3_bucket` resource is determined by the region of the Terraform AWS Provider, similar to all other resources.
+
+For example, given this previous configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        S3Bucket(self, "example",
+            region="us-west-2"
+        )
+```
+
+An updated configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        S3Bucket(self, "example")
+```
+
+## Resource: aws_s3_bucket_metric
+
+### filter configuration block Plan-Time Validation Change
+
+The `filter` configuration block no longer supports the empty block `{}` and requires at least one of the `prefix` or `tags` attributes to be specified.
+
+For example, given this previous configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket_metric import S3BucketMetric
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, bucket, name):
+        super().__init__(scope, name)
+        S3BucketMetric(self, "example",
+            filter=S3BucketMetricFilter(),
+            bucket=bucket,
+            name=name
+        )
+```
+
+An updated configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket_metric import S3BucketMetric
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, bucket, name):
+        super().__init__(scope, name)
+        S3BucketMetric(self, "example",
+            bucket=bucket,
+            name=name
+        )
+```
+
+## Resource: aws_security_group
+
+### Removal of Automatic aws_security_group_rule Import
+
+Previously when importing the `aws_security_group` resource with the [`terraform import` command](https://www.terraform.io/docs/commands/import.html), the Terraform AWS Provider would automatically attempt to import an associated `aws_security_group_rule` resource(s) as well. This automatic resource import has been removed. Use the [`aws_security_group_rule` resource import](/docs/providers/aws/r/security_group_rule.html#import) to import those resources separately.
+
+## Resource: aws_sns_platform_application
+
+### platform_credential and platform_principal Arguments No Longer Stored as SHA256 Hash
+
+Previously when the `platform_credential` and `platform_principal` arguments were stored in state, they were stored as a SHA256 hash of the actual value. This prevented Terraform from properly updating the resource when necessary and the hashing has been removed. The Terraform AWS Provider will show an update to these arguments on the first apply after upgrading to version 3.0.0, which is fixing the Terraform state to remove the hash. Since the attributes are marked as sensitive, the values in the update will not be visible in the Terraform output. If the non-hashed values have not changed, then no update is occurring other than the Terraform state update. If these arguments are the only two updates and they both match the SHA256 removal, the apply will occur without submitting an actual `SetPlatformApplicationAttributes` API call.
+
+## Resource: aws_spot_fleet_request
+
+### valid_until Argument No Longer Uses 24 Hour Default
+
+Previously when the `valid_until` argument was not configured, the resource would default to a 24 hour request. This behavior has been removed and allows for non-expiring requests. To recreate the old behavior, the [`time_offset` resource](https://registry.terraform.io/providers/hashicorp/time/latest/docs/resources/offset) can potentially be used.
+
+## Resource: aws_ssm_maintenance_window_task
+
+### logging_info Configuration Block Removal
+
+Switch your Terraform configuration to the `task_invocation_parameters` configuration block `run_command_parameters` configuration block `output_s3_bucket` and `output_s3_key_prefix` arguments instead.
+
+For example, given this previous configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ssm_maintenance_window_task import SsmMaintenanceWindowTask
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, taskArn, taskType, windowId):
+        super().__init__(scope, name)
+        SsmMaintenanceWindowTask(self, "example",
+            logging_info=[{
+                "s3_bucket_key_prefix": "example",
+                "s3_bucket_name": aws_s3_bucket_example.id
+            }
+            ],
+            task_arn=task_arn,
+            task_type=task_type,
+            window_id=window_id
+        )
+```
+
+An updated configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ssm_maintenance_window_task import SsmMaintenanceWindowTask
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, taskArn, taskType, windowId):
+        super().__init__(scope, name)
+        SsmMaintenanceWindowTask(self, "example",
+            task_invocation_parameters=SsmMaintenanceWindowTaskTaskInvocationParameters(
+                run_command_parameters=SsmMaintenanceWindowTaskTaskInvocationParametersRunCommandParameters(
+                    output_s3_bucket=Token.as_string(aws_s3_bucket_example.id),
+                    output_s3_key_prefix="example"
+                )
+            ),
+            task_arn=task_arn,
+            task_type=task_type,
+            window_id=window_id
+        )
+```
+
+### task_parameters Configuration Block Removal
+
+Switch your Terraform configuration to the `task_invocation_parameters` configuration block `run_command_parameters` configuration block `parameter` configuration blocks instead.
+
+For example, given this previous configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ssm_maintenance_window_task import SsmMaintenanceWindowTask
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, taskArn, taskType, windowId):
+        super().__init__(scope, name)
+        SsmMaintenanceWindowTask(self, "example",
+            task_parameters=[{
+                "name": "commands",
+                "values": ["date"]
+            }
+            ],
+            task_arn=task_arn,
+            task_type=task_type,
+            window_id=window_id
+        )
+```
+
+An updated configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ssm_maintenance_window_task import SsmMaintenanceWindowTask
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, taskArn, taskType, windowId):
+        super().__init__(scope, name)
+        SsmMaintenanceWindowTask(self, "example",
+            task_invocation_parameters=SsmMaintenanceWindowTaskTaskInvocationParameters(
+                run_command_parameters=SsmMaintenanceWindowTaskTaskInvocationParametersRunCommandParameters(
+                    parameter=[SsmMaintenanceWindowTaskTaskInvocationParametersRunCommandParametersParameter(
+                        name="commands",
+                        values=["date"]
+                    )
+                    ]
+                )
+            ),
+            task_arn=task_arn,
+            task_type=task_type,
+            window_id=window_id
+        )
+```
+
+<!-- cache-key: cdktf-0.18.0 input-fedd1760b9754507e4a21a87fc167b34be2073f23cf84a5f4c3f209428295c89 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/guides/version-4-upgrade.html.markdown b/website/docs/cdktf/python/guides/version-4-upgrade.html.markdown
new file mode 100644
index 00000000000..5260e646ca9
--- /dev/null
+++ b/website/docs/cdktf/python/guides/version-4-upgrade.html.markdown
@@ -0,0 +1,4657 @@
+---
+subcategory: ""
+layout: "aws"
+page_title: "Terraform AWS Provider Version 4 Upgrade Guide"
+description: |-
+  Terraform AWS Provider Version 4 Upgrade Guide
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Terraform AWS Provider Version 4 Upgrade Guide
+
+Version 4.0.0 of the AWS provider for Terraform is a major release and includes some changes that you will need to consider when upgrading. We intend this guide to help with that process and focus only on changes from version 3.X to version 4.0.0. See the [Version 3 Upgrade Guide](/docs/providers/aws/guides/version-3-upgrade.html) for information about upgrading from 2.X to version 3.0.0.
+
+We previously marked most of the changes we outline in this guide as deprecated in the Terraform plan/apply output throughout previous provider releases. You can find these changes, including deprecation notices, in the [Terraform AWS Provider CHANGELOG](https://github.com/hashicorp/terraform-provider-aws/blob/main/CHANGELOG.md).
+
+~> **NOTE:** Versions 4.0.0 through v4.8.0 of the AWS Provider introduce significant breaking changes to the `aws_s3_bucket` resource. See [S3 Bucket Refactor](#s3-bucket-refactor) for more details.
+We recommend upgrading to v4.9.0 or later of the AWS Provider instead, where only non-breaking changes and deprecation notices are introduced to the `aws_s3_bucket`. See  [Changes to S3 Bucket Drift Detection](#changes-to-s3-bucket-drift-detection) for additional considerations when upgrading to v4.9.0 or later.
+
+~> **NOTE:** Version 4.0.0 of the AWS Provider introduces changes to the precedence of some authentication and configuration parameters.
+These changes bring the provider in line with the AWS CLI and SDKs.
+See [Changes to Authentication](#changes-to-authentication) for more details.
+
+~> **NOTE:** Version 4.0.0 of the AWS Provider will be the last major version to support [EC2-Classic resources](#ec2-classic-resource-and-data-source-support) as AWS plans to fully retire EC2-Classic Networking. See the [AWS News Blog](https://aws.amazon.com/blogs/aws/ec2-classic-is-retiring-heres-how-to-prepare/) for additional details.
+
+~> **NOTE:** Version 4.0.0 of the AWS Provider will be the last major version to support [Macie Classic resources](#macie-classic-resource-support) as AWS plans to fully retire Macie Classic. See the [Amazon Macie Classic FAQs](https://aws.amazon.com/macie/classic-faqs/) for additional details.
+
+Upgrade topics:
+
+<!-- TOC depthFrom:2 depthTo:2 -->
+
+- [Provider Version Configuration](#provider-version-configuration)
+- [Changes to Authentication](#changes-to-authentication)
+- [New Provider Arguments](#new-provider-arguments)
+- [Changes to S3 Bucket Drift Detection](#changes-to-s3-bucket-drift-detection) (**Applicable to v4.9.0 and later of the AWS Provider**)
+- [S3 Bucket Refactor](#s3-bucket-refactor) (**Only applicable to v4.0.0 through v4.8.0 of the AWS Provider**)
+    - [`acceleration_status` Argument](#acceleration_status-argument)
+    - [`acl` Argument](#acl-argument)
+    - [`cors_rule` Argument](#cors_rule-argument)
+    - [`grant` Argument](#grant-argument)
+    - [`lifecycle_rule` Argument](#lifecycle_rule-argument)
+    - [`logging` Argument](#logging-argument)
+    - [`object_lock_configuration` `rule` Argument](#object_lock_configuration-rule-argument)
+    - [`policy` Argument](#policy-argument)
+    - [`replication_configuration` Argument](#replication_configuration-argument)
+    - [`request_payer` Argument](#request_payer-argument)
+    - [`server_side_encryption_configuration` Argument](#server_side_encryption_configuration-argument)
+    - [`versioning` Argument](#versioning-argument)
+    - [`website`, `website_domain`, and `website_endpoint` Arguments](#website-website_domain-and-website_endpoint-arguments)
+- [Full Resource Lifecycle of Default Resources](#full-resource-lifecycle-of-default-resources)
+    - [Resource: aws_default_subnet](#resource-aws_default_subnet)
+    - [Resource: aws_default_vpc](#resource-aws_default_vpc)
+- [Plural Data Source Behavior](#plural-data-source-behavior)
+- [Empty Strings Not Valid For Certain Resources](#empty-strings-not-valid-for-certain-resources)
+    - [Resource: aws_cloudwatch_event_target (Empty String)](#resource-aws_cloudwatch_event_target-empty-string)
+    - [Resource: aws_customer_gateway](#resource-aws_customer_gateway)
+    - [Resource: aws_default_network_acl](#resource-aws_default_network_acl)
+    - [Resource: aws_default_route_table](#resource-aws_default_route_table)
+    - [Resource: aws_default_vpc (Empty String)](#resource-aws_default_vpc-empty-string)
+    - [Resource: aws_efs_mount_target](#resource-aws_efs_mount_target)
+    - [Resource: aws_elasticsearch_domain](#resource-aws_elasticsearch_domain)
+    - [Resource: aws_instance](#resource-aws_instance)
+    - [Resource: aws_network_acl](#resource-aws_network_acl)
+    - [Resource: aws_route](#resource-aws_route)
+    - [Resource: aws_route_table](#resource-aws_route_table)
+    - [Resource: aws_vpc](#resource-aws_vpc)
+    - [Resource: aws_vpc_ipv6_cidr_block_association](#resource-aws_vpc_ipv6_cidr_block_association)
+- [Data Source: aws_cloudwatch_log_group](#data-source-aws_cloudwatch_log_group)
+- [Data Source: aws_subnet_ids](#data-source-aws_subnet_ids)
+- [Data Source: aws_s3_bucket_object](#data-source-aws_s3_bucket_object)
+- [Data Source: aws_s3_bucket_objects](#data-source-aws_s3_bucket_objects)
+- [Resource: aws_batch_compute_environment](#resource-aws_batch_compute_environment)
+- [Resource: aws_cloudwatch_event_target](#resource-aws_cloudwatch_event_target)
+- [Resource: aws_elasticache_cluster](#resource-aws_elasticache_cluster)
+- [Resource: aws_elasticache_global_replication_group](#resource-aws_elasticache_global_replication_group)
+- [Resource: aws_fsx_ontap_storage_virtual_machine](#resource-aws_fsx_ontap_storage_virtual_machine)
+- [Resource: aws_lb_target_group](#resource-aws_lb_target_group)
+- [Resource: aws_s3_bucket_object](#resource-aws_s3_bucket_object)
+
+<!-- /TOC -->
+
+Additional Topics:
+
+<!-- TOC depthFrom:2 depthTo:2 -->
+
+- [EC2-Classic resource and data source support](#ec2-classic-resource-and-data-source-support)
+- [Macie Classic resource support](#macie-classic-resource-support)
+
+<!-- /TOC -->
+
+## Provider Version Configuration
+
+-> Before upgrading to version 4.0.0, upgrade to the most recent 3.X version of the provider and ensure that your environment successfully runs [`terraform plan`](https://www.terraform.io/docs/commands/plan.html). You should not see changes you don't expect or deprecation notices.
+
+Use [version constraints when configuring Terraform providers](https://www.terraform.io/docs/configuration/providers.html#provider-versions). If you are following that recommendation, update the version constraints in your Terraform configuration and run [`terraform init -upgrade`](https://www.terraform.io/docs/commands/init.html) to download the new version.
+
+For example, given this previous configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.provider import AwsProvider
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AwsProvider(self, "aws")
+```
+
+Update to the latest 4.X version:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.provider import AwsProvider
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AwsProvider(self, "aws")
+```
+
+## Changes to Authentication
+
+The authentication configuration for the AWS Provider has changed in this version to match the behavior of other AWS products, including the AWS SDK and AWS CLI. _This will cause authentication failures in AWS provider configurations where you set a non-empty `profile` in the `provider` configuration but the profile does not correspond to an AWS profile with valid credentials._
+
+Precedence for authentication settings is as follows:
+
+* `provider` configuration
+* Environment variables
+* Shared credentials and configuration files (_e.g._, `~/.aws/credentials` and `~/.aws/config`)
+
+In previous versions of the provider, you could explicitly set `profile` in the `provider`, and if the profile did not correspond to valid credentials, the provider would use credentials from environment variables. Starting in v4.0, the Terraform AWS provider enforces the precedence shown above, similarly to how the AWS SDK and AWS CLI behave.
+
+In other words, when you explicitly set `profile` in `provider`, the AWS provider will not use environment variables per the precedence shown above. Before v4.0, if `profile` was configured in the `provider` configuration but did not correspond to an AWS profile or valid credentials, the provider would attempt to use environment variables. **This is no longer the case.** An explicitly set profile that does not have valid credentials will cause an authentication error.
+
+For example, with the following, the environment variables will not be used:
+
+```console
+$ export AWS_ACCESS_KEY_ID="anaccesskey"
+$ export AWS_SECRET_ACCESS_KEY="asecretkey"
+```
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.provider import AwsProvider
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AwsProvider(self, "aws",
+            profile="customprofile",
+            region="us-west-2"
+        )
+```
+
+## New Provider Arguments
+
+Version 4.x adds these new `provider` arguments:
+
+* `assume_role.duration` - Assume role duration as a string, _e.g._, `"1h"` or `"1h30s"`. Terraform AWS Provider v4.0.0 deprecates `assume_role.duration_seconds` and a future version will remove it.
+* `custom_ca_bundle` - File containing custom root and intermediate certificates. Can also be configured using the `AWS_CA_BUNDLE` environment variable. (Setting `ca_bundle` in the shared config file is not supported.)
+* `ec2_metadata_service_endpoint` - Address of the EC2 metadata service (IMDS) endpoint to use. Can also be set with the `AWS_EC2_METADATA_SERVICE_ENDPOINT` environment variable.
+* `ec2_metadata_service_endpoint_mode` - Mode to use in communicating with the metadata service. Valid values are `IPv4` and `IPv6`. Can also be set with the `AWS_EC2_METADATA_SERVICE_ENDPOINT_MODE` environment variable.
+* `s3_use_path_style` - Replaces `s3_force_path_style`, which has been deprecated in Terraform AWS Provider v4.0.0 and support will be removed in a future version.
+* `shared_config_files` - List of paths to AWS shared config files. If not set, the default is `[~/.aws/config]`. A single value can also be set with the `AWS_CONFIG_FILE` environment variable.
+* `shared_credentials_files` - List of paths to the shared credentials file. If not set, the default  is `[~/.aws/credentials]`. A single value can also be set with the `AWS_SHARED_CREDENTIALS_FILE` environment variable. Replaces `shared_credentials_file`, which has been deprecated in Terraform AWS Provider v4.0.0 and support will be removed in a future version.
+* `sts_region` - Region where AWS STS operations will take place. For example, `us-east-1` and `us-west-2`.
+* `use_dualstack_endpoint` - Force the provider to resolve endpoints with DualStack capability. Can also be set with the `AWS_USE_DUALSTACK_ENDPOINT` environment variable or in a shared config file (`use_dualstack_endpoint`).
+* `use_fips_endpoint` - Force the provider to resolve endpoints with FIPS capability. Can also be set with the `AWS_USE_FIPS_ENDPOINT` environment variable or in a shared config file (`use_fips_endpoint`).
+
+~> **NOTE:** Using the `AWS_METADATA_URL` environment variable has been deprecated in Terraform AWS Provider v4.0.0 and support will be removed in a future version. Change any scripts or environments using `AWS_METADATA_URL` to instead use `AWS_EC2_METADATA_SERVICE_ENDPOINT`.
+
+For example, in previous versions, to use FIPS endpoints, you would need to provide all the FIPS endpoints that you wanted to use in the `endpoints` configuration block:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.provider import AwsProvider
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AwsProvider(self, "aws",
+            endpoints=[AwsProviderEndpoints(
+                ec2="https://ec2-fips.us-west-2.amazonaws.com",
+                s3="https://s3-fips.us-west-2.amazonaws.com",
+                sts="https://sts-fips.us-west-2.amazonaws.com"
+            )
+            ]
+        )
+```
+
+In v4.0.0, you can still set endpoints in the same way. However, you can instead use the `use_fips_endpoint` argument to have the provider automatically resolve FIPS endpoints for all supported services:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.provider import AwsProvider
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AwsProvider(self, "aws",
+            use_fips_endpoint=True
+        )
+```
+
+Note that the provider can only resolve FIPS endpoints where AWS provides FIPS support. Support depends on the service and may include `us-east-1`, `us-east-2`, `us-west-1`, `us-west-2`, `us-gov-east-1`, `us-gov-west-1`, and `ca-central-1`. For more information, see [Federal Information Processing Standard (FIPS) 140-2](https://aws.amazon.com/compliance/fips/).
+
+## Changes to S3 Bucket Drift Detection
+
+~> **NOTE:** This only applies to v4.9.0 and later of the AWS Provider.
+
+~> **NOTE:** If you are migrating from v3.75.x of the AWS Provider and you have already adopted the standalone S3 bucket resources (e.g. `aws_s3_bucket_lifecycle_configuration`),
+a [`lifecycle` configuration block to ignore changes](https://www.terraform.io/language/meta-arguments/lifecycle#ignore_changes) to the internal parameters of the source `aws_s3_bucket` resources will no longer be necessary and can be removed upon upgrade.
+
+~> **NOTE:** In the next major version, v5.0, the parameters listed below will be removed entirely from the `aws_s3_bucket` resource.
+For this reason, a deprecation notice is printed in the Terraform CLI for each of the parameters when used in a configuration.
+
+To remediate the breaking changes introduced to the `aws_s3_bucket` resource in v4.0.0 of the AWS Provider,
+v4.9.0 and later retain the same configuration parameters of the `aws_s3_bucket` resource as in v3.x and functionality of the `aws_s3_bucket` resource only differs from v3.x
+in that Terraform will only perform drift detection for each of the following parameters if a configuration value is provided:
+
+* `acceleration_status`
+* `acl`
+* `cors_rule`
+* `grant`
+* `lifecycle_rule`
+* `logging`
+* `object_lock_configuration`
+* `policy`
+* `replication_configuration`
+* `request_payer`
+* `server_side_encryption_configuration`
+* `versioning`
+* `website`
+
+Thus, if one of these parameters was once configured and then is entirely removed from an `aws_s3_bucket` resource configuration,
+Terraform will not pick up on these changes on a subsequent `terraform plan` or `terraform apply`.
+
+For example, given the following configuration with a single `cors_rule`:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        S3Bucket(self, "example",
+            bucket="yournamehere",
+            cors_rule=[S3BucketCorsRule(
+                allowed_headers=["*"],
+                allowed_methods=["PUT", "POST"],
+                allowed_origins=["https://s3-website-test.hashicorp.com"],
+                expose_headers=["ETag"],
+                max_age_seconds=3000
+            )
+            ]
+        )
+```
+
+When updated to the following configuration without a `cors_rule`:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        S3Bucket(self, "example",
+            bucket="yournamehere"
+        )
+```
+
+Terraform CLI with v4.9.0 of the AWS Provider will report back:
+
+```console
+aws_s3_bucket.example: Refreshing state... [id=yournamehere]
+...
+No changes. Your infrastructure matches the configuration.
+```
+
+With that said, to manage changes to these parameters in the `aws_s3_bucket` resource, practitioners should configure each parameter's respective standalone resource
+and perform updates directly on those new configurations. The parameters are mapped to the standalone resources as follows:
+
+| `aws_s3_bucket` Parameter              | Standalone Resource                                  |
+|----------------------------------------|------------------------------------------------------|
+| `acceleration_status`                  | `aws_s3_bucket_accelerate_configuration`             |
+| `acl`                                  | `aws_s3_bucket_acl`                                  |
+| `cors_rule`                            | `aws_s3_bucket_cors_configuration`                   |
+| `grant`                                | `aws_s3_bucket_acl`                                  |
+| `lifecycle_rule`                       | `aws_s3_bucket_lifecycle_configuration`              |
+| `logging`                              | `aws_s3_bucket_logging`                              |
+| `object_lock_configuration`            | `aws_s3_bucket_object_lock_configuration`            |
+| `policy`                               | `aws_s3_bucket_policy`                               |
+| `replication_configuration`            | `aws_s3_bucket_replication_configuration`            |
+| `request_payer`                        | `aws_s3_bucket_request_payment_configuration`        |
+| `server_side_encryption_configuration` | `aws_s3_bucket_server_side_encryption_configuration` |
+| `versioning`                           | `aws_s3_bucket_versioning`                           |
+| `website`                              | `aws_s3_bucket_website_configuration`                |
+
+Going back to the earlier example, given the following configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        S3Bucket(self, "example",
+            bucket="yournamehere",
+            cors_rule=[S3BucketCorsRule(
+                allowed_headers=["*"],
+                allowed_methods=["PUT", "POST"],
+                allowed_origins=["https://s3-website-test.hashicorp.com"],
+                expose_headers=["ETag"],
+                max_age_seconds=3000
+            )
+            ]
+        )
+```
+
+Practitioners can upgrade to v4.9.0 and then introduce the standalone `aws_s3_bucket_cors_configuration` resource, e.g.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_cors_configuration import S3BucketCorsConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = S3Bucket(self, "example",
+            bucket="yournamehere"
+        )
+        aws_s3_bucket_cors_configuration_example = S3BucketCorsConfiguration(self, "example_1",
+            bucket=example.id,
+            cors_rule=[S3BucketCorsConfigurationCorsRule(
+                allowed_headers=["*"],
+                allowed_methods=["PUT", "POST"],
+                allowed_origins=["https://s3-website-test.hashicorp.com"],
+                expose_headers=["ETag"],
+                max_age_seconds=3000
+            )
+            ]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_cors_configuration_example.override_logical_id("example")
+```
+
+Depending on the tools available to you, the above configuration can either be directly applied with Terraform or the standalone resource
+can be imported into Terraform state. Please refer to each standalone resource's _Import_ documentation for the proper syntax.
+
+Once the standalone resources are managed by Terraform, updates and removal can be performed as needed.
+
+The following sections depict standalone resource adoption per individual parameter. Standalone resource adoption is not required to upgrade but is recommended to ensure drift is detected by Terraform.
+The examples below are by no means exhaustive. The aim is to provide important concepts when migrating to a standalone resource whose parameters may not entirely align with the corresponding parameter in the `aws_s3_bucket` resource.
+
+### Migrating to `aws_s3_bucket_accelerate_configuration`
+
+Given this previous configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        S3Bucket(self, "example",
+            acceleration_status="Enabled",
+            bucket="yournamehere"
+        )
+```
+
+Update the configuration to:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_accelerate_configuration import S3BucketAccelerateConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = S3Bucket(self, "example",
+            bucket="yournamehere"
+        )
+        aws_s3_bucket_accelerate_configuration_example =
+        S3BucketAccelerateConfiguration(self, "example_1",
+            bucket=example.id,
+            status="Enabled"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_accelerate_configuration_example.override_logical_id("example")
+```
+
+### Migrating to `aws_s3_bucket_acl`
+
+#### With `acl`
+
+Given this previous configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        S3Bucket(self, "example",
+            acl="private",
+            bucket="yournamehere"
+        )
+```
+
+Update the configuration to:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_acl import S3BucketAcl
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = S3Bucket(self, "example",
+            bucket="yournamehere"
+        )
+        aws_s3_bucket_acl_example = S3BucketAcl(self, "example_1",
+            acl="private",
+            bucket=example.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_acl_example.override_logical_id("example")
+```
+
+#### With `grant`
+
+Given this previous configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        S3Bucket(self, "example",
+            bucket="yournamehere",
+            grant=[S3BucketGrant(
+                id=Token.as_string(current_user.id),
+                permissions=["FULL_CONTROL"],
+                type="CanonicalUser"
+            ), S3BucketGrant(
+                permissions=["READ_ACP", "WRITE"],
+                type="Group",
+                uri="http://acs.amazonaws.com/groups/s3/LogDelivery"
+            )
+            ]
+        )
+```
+
+Update the configuration to:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_acl import S3BucketAcl
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = S3Bucket(self, "example",
+            bucket="yournamehere"
+        )
+        aws_s3_bucket_acl_example = S3BucketAcl(self, "example_1",
+            access_control_policy=S3BucketAclAccessControlPolicy(
+                grant=[S3BucketAclAccessControlPolicyGrant(
+                    grantee=S3BucketAclAccessControlPolicyGrantGrantee(
+                        id=Token.as_string(current_user.id),
+                        type="CanonicalUser"
+                    ),
+                    permission="FULL_CONTROL"
+                ), S3BucketAclAccessControlPolicyGrant(
+                    grantee=S3BucketAclAccessControlPolicyGrantGrantee(
+                        type="Group",
+                        uri="http://acs.amazonaws.com/groups/s3/LogDelivery"
+                    ),
+                    permission="READ_ACP"
+                ), S3BucketAclAccessControlPolicyGrant(
+                    grantee=S3BucketAclAccessControlPolicyGrantGrantee(
+                        type="Group",
+                        uri="http://acs.amazonaws.com/groups/s3/LogDelivery"
+                    ),
+                    permission="WRITE"
+                )
+                ],
+                owner=S3BucketAclAccessControlPolicyOwner(
+                    id=Token.as_string(current_user.id)
+                )
+            ),
+            bucket=example.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_acl_example.override_logical_id("example")
+```
+
+### Migrating to `aws_s3_bucket_cors_configuration`
+
+Given this previous configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        S3Bucket(self, "example",
+            bucket="yournamehere",
+            cors_rule=[S3BucketCorsRule(
+                allowed_headers=["*"],
+                allowed_methods=["PUT", "POST"],
+                allowed_origins=["https://s3-website-test.hashicorp.com"],
+                expose_headers=["ETag"],
+                max_age_seconds=3000
+            )
+            ]
+        )
+```
+
+Update the configuration to:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_cors_configuration import S3BucketCorsConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = S3Bucket(self, "example",
+            bucket="yournamehere"
+        )
+        aws_s3_bucket_cors_configuration_example = S3BucketCorsConfiguration(self, "example_1",
+            bucket=example.id,
+            cors_rule=[S3BucketCorsConfigurationCorsRule(
+                allowed_headers=["*"],
+                allowed_methods=["PUT", "POST"],
+                allowed_origins=["https://s3-website-test.hashicorp.com"],
+                expose_headers=["ETag"],
+                max_age_seconds=3000
+            )
+            ]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_cors_configuration_example.override_logical_id("example")
+```
+
+### Migrating to `aws_s3_bucket_lifecycle_configuration`
+
+~> **Note:** In version `3.x` of the provider, the `lifecycle_rule.id` argument was optional, while in version `4.x`, the `aws_s3_bucket_lifecycle_configuration.rule.id` argument required. Use the AWS CLI s3api [get-bucket-lifecycle-configuration](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/s3api/get-bucket-lifecycle-configuration.html) to get the source bucket's lifecycle configuration to determine the ID.
+
+#### For Lifecycle Rules with no `prefix` previously configured
+
+~> **Note:** When configuring the `rule.filter` configuration block in the new `aws_s3_bucket_lifecycle_configuration` resource, use the AWS CLI s3api [get-bucket-lifecycle-configuration](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/s3api/get-bucket-lifecycle-configuration.html)
+to get the source bucket's lifecycle configuration and determine if the `Filter` is configured as `"Filter" : {}` or `"Filter" : { "Prefix": "" }`.
+If AWS returns the former, configure `rule.filter` as `filter {}`. Otherwise, neither a `rule.filter` nor `rule.prefix` parameter should be configured as shown here:
+
+Given this previous configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        S3Bucket(self, "example",
+            bucket="yournamehere",
+            lifecycle_rule=[S3BucketLifecycleRule(
+                enabled=True,
+                id="Keep previous version 30 days, then in Glacier another 60",
+                noncurrent_version_expiration=S3BucketLifecycleRuleNoncurrentVersionExpiration(
+                    days=90
+                ),
+                noncurrent_version_transition=[S3BucketLifecycleRuleNoncurrentVersionTransition(
+                    days=30,
+                    storage_class="GLACIER"
+                )
+                ]
+            ), S3BucketLifecycleRule(
+                abort_incomplete_multipart_upload_days=7,
+                enabled=True,
+                id="Delete old incomplete multi-part uploads"
+            )
+            ]
+        )
+```
+
+Update the configuration to:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_lifecycle_configuration import S3BucketLifecycleConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = S3Bucket(self, "example",
+            bucket="yournamehere"
+        )
+        aws_s3_bucket_lifecycle_configuration_example =
+        S3BucketLifecycleConfiguration(self, "example_1",
+            bucket=example.id,
+            rule=[S3BucketLifecycleConfigurationRule(
+                id="Keep previous version 30 days, then in Glacier another 60",
+                noncurrent_version_expiration=S3BucketLifecycleConfigurationRuleNoncurrentVersionExpiration(
+                    noncurrent_days=90
+                ),
+                noncurrent_version_transition=[S3BucketLifecycleConfigurationRuleNoncurrentVersionTransition(
+                    noncurrent_days=30,
+                    storage_class="GLACIER"
+                )
+                ],
+                status="Enabled"
+            ), S3BucketLifecycleConfigurationRule(
+                abort_incomplete_multipart_upload=S3BucketLifecycleConfigurationRuleAbortIncompleteMultipartUpload(
+                    days_after_initiation=7
+                ),
+                id="Delete old incomplete multi-part uploads",
+                status="Enabled"
+            )
+            ]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_lifecycle_configuration_example.override_logical_id("example")
+```
+
+#### For Lifecycle Rules with `prefix` previously configured as an empty string
+
+Given this previous configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        S3Bucket(self, "example",
+            bucket="yournamehere",
+            lifecycle_rule=[S3BucketLifecycleRule(
+                enabled=True,
+                id="log-expiration",
+                prefix="",
+                transition=[S3BucketLifecycleRuleTransition(
+                    days=30,
+                    storage_class="STANDARD_IA"
+                ), S3BucketLifecycleRuleTransition(
+                    days=180,
+                    storage_class="GLACIER"
+                )
+                ]
+            )
+            ]
+        )
+```
+
+Update the configuration to:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_lifecycle_configuration import S3BucketLifecycleConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = S3Bucket(self, "example",
+            bucket="yournamehere"
+        )
+        aws_s3_bucket_lifecycle_configuration_example =
+        S3BucketLifecycleConfiguration(self, "example_1",
+            bucket=example.id,
+            rule=[S3BucketLifecycleConfigurationRule(
+                id="log-expiration",
+                status="Enabled",
+                transition=[S3BucketLifecycleConfigurationRuleTransition(
+                    days=30,
+                    storage_class="STANDARD_IA"
+                ), S3BucketLifecycleConfigurationRuleTransition(
+                    days=180,
+                    storage_class="GLACIER"
+                )
+                ]
+            )
+            ]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_lifecycle_configuration_example.override_logical_id("example")
+```
+
+#### For Lifecycle Rules with `prefix`
+
+Given this previous configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        S3Bucket(self, "example",
+            bucket="yournamehere",
+            lifecycle_rule=[S3BucketLifecycleRule(
+                enabled=True,
+                id="log-expiration",
+                prefix="foobar",
+                transition=[S3BucketLifecycleRuleTransition(
+                    days=30,
+                    storage_class="STANDARD_IA"
+                ), S3BucketLifecycleRuleTransition(
+                    days=180,
+                    storage_class="GLACIER"
+                )
+                ]
+            )
+            ]
+        )
+```
+
+Update the configuration to:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_lifecycle_configuration import S3BucketLifecycleConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = S3Bucket(self, "example",
+            bucket="yournamehere"
+        )
+        aws_s3_bucket_lifecycle_configuration_example =
+        S3BucketLifecycleConfiguration(self, "example_1",
+            bucket=example.id,
+            rule=[S3BucketLifecycleConfigurationRule(
+                filter=S3BucketLifecycleConfigurationRuleFilter(
+                    prefix="foobar"
+                ),
+                id="log-expiration",
+                status="Enabled",
+                transition=[S3BucketLifecycleConfigurationRuleTransition(
+                    days=30,
+                    storage_class="STANDARD_IA"
+                ), S3BucketLifecycleConfigurationRuleTransition(
+                    days=180,
+                    storage_class="GLACIER"
+                )
+                ]
+            )
+            ]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_lifecycle_configuration_example.override_logical_id("example")
+```
+
+#### For Lifecycle Rules with `prefix` and `tags`
+
+Given this previous configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        S3Bucket(self, "example",
+            bucket="yournamehere",
+            lifecycle_rule=[S3BucketLifecycleRule(
+                enabled=True,
+                expiration=S3BucketLifecycleRuleExpiration(
+                    days=90
+                ),
+                id="log",
+                prefix="log/",
+                tags={
+                    "autoclean": "true",
+                    "rule": "log"
+                },
+                transition=[S3BucketLifecycleRuleTransition(
+                    days=30,
+                    storage_class="STANDARD_IA"
+                ), S3BucketLifecycleRuleTransition(
+                    days=60,
+                    storage_class="GLACIER"
+                )
+                ]
+            ), S3BucketLifecycleRule(
+                enabled=True,
+                expiration=S3BucketLifecycleRuleExpiration(
+                    date="2022-12-31"
+                ),
+                id="tmp",
+                prefix="tmp/"
+            )
+            ]
+        )
+```
+
+Update the configuration to:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_lifecycle_configuration import S3BucketLifecycleConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = S3Bucket(self, "example",
+            bucket="yournamehere"
+        )
+        aws_s3_bucket_lifecycle_configuration_example =
+        S3BucketLifecycleConfiguration(self, "example_1",
+            bucket=example.id,
+            rule=[S3BucketLifecycleConfigurationRule(
+                expiration=S3BucketLifecycleConfigurationRuleExpiration(
+                    days=90
+                ),
+                filter=S3BucketLifecycleConfigurationRuleFilter(
+                    and=S3BucketLifecycleConfigurationRuleFilterAnd(
+                        prefix="log/",
+                        tags={
+                            "autoclean": "true",
+                            "rule": "log"
+                        }
+                    )
+                ),
+                id="log",
+                status="Enabled",
+                transition=[S3BucketLifecycleConfigurationRuleTransition(
+                    days=30,
+                    storage_class="STANDARD_IA"
+                ), S3BucketLifecycleConfigurationRuleTransition(
+                    days=60,
+                    storage_class="GLACIER"
+                )
+                ]
+            ), S3BucketLifecycleConfigurationRule(
+                expiration=S3BucketLifecycleConfigurationRuleExpiration(
+                    date="2022-12-31T00:00:00Z"
+                ),
+                filter=S3BucketLifecycleConfigurationRuleFilter(
+                    prefix="tmp/"
+                ),
+                id="tmp",
+                status="Enabled"
+            )
+            ]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_lifecycle_configuration_example.override_logical_id("example")
+```
+
+### Migrating to `aws_s3_bucket_logging`
+
+Given this previous configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        log_bucket = S3Bucket(self, "log_bucket",
+            bucket="example-log-bucket"
+        )
+        S3Bucket(self, "example",
+            bucket="yournamehere",
+            logging=S3BucketLogging(
+                target_bucket=log_bucket.id,
+                target_prefix="log/"
+            )
+        )
+```
+
+Update the configuration to:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_logging import S3BucketLoggingA
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = S3Bucket(self, "example",
+            bucket="yournamehere"
+        )
+        log_bucket = S3Bucket(self, "log_bucket",
+            bucket="example-log-bucket"
+        )
+        aws_s3_bucket_logging_example = S3BucketLoggingA(self, "example_2",
+            bucket=example.id,
+            target_bucket=log_bucket.id,
+            target_prefix="log/"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_logging_example.override_logical_id("example")
+```
+
+### Migrating to `aws_s3_bucket_object_lock_configuration`
+
+Given this previous configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        S3Bucket(self, "example",
+            bucket="yournamehere",
+            object_lock_configuration=S3BucketObjectLockConfiguration(
+                object_lock_enabled="Enabled",
+                rule=S3BucketObjectLockConfigurationRule(
+                    default_retention=S3BucketObjectLockConfigurationRuleDefaultRetention(
+                        days=3,
+                        mode="COMPLIANCE"
+                    )
+                )
+            )
+        )
+```
+
+Update the configuration to:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_object_lock_configuration import S3BucketObjectLockConfigurationA
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = S3Bucket(self, "example",
+            bucket="yournamehere",
+            object_lock_enabled=True
+        )
+        aws_s3_bucket_object_lock_configuration_example =
+        S3BucketObjectLockConfigurationA(self, "example_1",
+            bucket=example.id,
+            rule=S3BucketObjectLockConfigurationRuleA(
+                default_retention=S3BucketObjectLockConfigurationRuleDefaultRetentionA(
+                    days=3,
+                    mode="COMPLIANCE"
+                )
+            )
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_object_lock_configuration_example.override_logical_id("example")
+```
+
+### Migrating to `aws_s3_bucket_policy`
+
+Given this previous configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        S3Bucket(self, "example",
+            bucket="yournamehere",
+            policy="{\n  \"Id\": \"Policy1446577137248\",\n  \"Statement\": [\n    {\n      \"Action\": \"s3:PutObject\",\n      \"Effect\": \"Allow\",\n      \"Principal\": {\n        \"AWS\": \"${" + current.arn + "}\"\n      },\n      \"Resource\": \"arn:${" + data_aws_partition_current.partition + "}:s3:::yournamehere/*\",\n      \"Sid\": \"Stmt1446575236270\"\n    }\n  ],\n  \"Version\": \"2012-10-17\"\n}\n\n"
+        )
+```
+
+Update the configuration to:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_policy import S3BucketPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = S3Bucket(self, "example",
+            bucket="yournamehere"
+        )
+        aws_s3_bucket_policy_example = S3BucketPolicy(self, "example_1",
+            bucket=example.id,
+            policy="{\n  \"Id\": \"Policy1446577137248\",\n  \"Statement\": [\n    {\n      \"Action\": \"s3:PutObject\",\n      \"Effect\": \"Allow\",\n      \"Principal\": {\n        \"AWS\": \"${" + current.arn + "}\"\n      },\n      \"Resource\": \"${" + example.arn + "}/*\",\n      \"Sid\": \"Stmt1446575236270\"\n    }\n  ],\n  \"Version\": \"2012-10-17\"\n}\n\n"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_policy_example.override_logical_id("example")
+```
+
+### Migrating to `aws_s3_bucket_replication_configuration`
+
+Given this previous configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        S3Bucket(self, "example",
+            bucket="yournamehere",
+            provider=central,
+            replication_configuration=S3BucketReplicationConfiguration(
+                role=replication.arn,
+                rules=[S3BucketReplicationConfigurationRules(
+                    destination=S3BucketReplicationConfigurationRulesDestination(
+                        bucket=destination.arn,
+                        metrics=S3BucketReplicationConfigurationRulesDestinationMetrics(
+                            minutes=15,
+                            status="Enabled"
+                        ),
+                        replication_time=S3BucketReplicationConfigurationRulesDestinationReplicationTime(
+                            minutes=15,
+                            status="Enabled"
+                        ),
+                        storage_class="STANDARD"
+                    ),
+                    filter=S3BucketReplicationConfigurationRulesFilter(
+                        tags={}
+                    ),
+                    id="foobar",
+                    status="Enabled"
+                )
+                ]
+            )
+        )
+```
+
+Update the configuration to:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_replication_configuration import S3BucketReplicationConfigurationA
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        S3Bucket(self, "example",
+            bucket="yournamehere",
+            provider=central
+        )
+        aws_s3_bucket_replication_configuration_example =
+        S3BucketReplicationConfigurationA(self, "example_1",
+            bucket=source.id,
+            role=replication.arn,
+            rule=[S3BucketReplicationConfigurationRule(
+                delete_marker_replication=S3BucketReplicationConfigurationRuleDeleteMarkerReplication(
+                    status="Enabled"
+                ),
+                destination=S3BucketReplicationConfigurationRuleDestination(
+                    bucket=destination.arn,
+                    metrics=S3BucketReplicationConfigurationRuleDestinationMetrics(
+                        event_threshold=S3BucketReplicationConfigurationRuleDestinationMetricsEventThreshold(
+                            minutes=15
+                        ),
+                        status="Enabled"
+                    ),
+                    replication_time=S3BucketReplicationConfigurationRuleDestinationReplicationTime(
+                        status="Enabled",
+                        time=S3BucketReplicationConfigurationRuleDestinationReplicationTimeTime(
+                            minutes=15
+                        )
+                    ),
+                    storage_class="STANDARD"
+                ),
+                filter=S3BucketReplicationConfigurationRuleFilter(),
+                id="foobar",
+                status="Enabled"
+            )
+            ]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_replication_configuration_example.override_logical_id("example")
+```
+
+### Migrating to `aws_s3_bucket_request_payment_configuration`
+
+Given this previous configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        S3Bucket(self, "example",
+            bucket="yournamehere",
+            request_payer="Requester"
+        )
+```
+
+Update the configuration to:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_request_payment_configuration import S3BucketRequestPaymentConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = S3Bucket(self, "example",
+            bucket="yournamehere"
+        )
+        aws_s3_bucket_request_payment_configuration_example =
+        S3BucketRequestPaymentConfiguration(self, "example_1",
+            bucket=example.id,
+            payer="Requester"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_request_payment_configuration_example.override_logical_id("example")
+```
+
+### Migrating to `aws_s3_bucket_server_side_encryption_configuration`
+
+Given this previous configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        S3Bucket(self, "example",
+            bucket="yournamehere",
+            server_side_encryption_configuration=S3BucketServerSideEncryptionConfiguration(
+                rule=S3BucketServerSideEncryptionConfigurationRule(
+                    apply_server_side_encryption_by_default=S3BucketServerSideEncryptionConfigurationRuleApplyServerSideEncryptionByDefault(
+                        kms_master_key_id=mykey.arn,
+                        sse_algorithm="aws:kms"
+                    )
+                )
+            )
+        )
+```
+
+Update the configuration to:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_server_side_encryption_configuration import S3BucketServerSideEncryptionConfigurationA
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = S3Bucket(self, "example",
+            bucket="yournamehere"
+        )
+        aws_s3_bucket_server_side_encryption_configuration_example =
+        S3BucketServerSideEncryptionConfigurationA(self, "example_1",
+            bucket=example.id,
+            rule=[S3BucketServerSideEncryptionConfigurationRuleA(
+                apply_server_side_encryption_by_default=S3BucketServerSideEncryptionConfigurationRuleApplyServerSideEncryptionByDefaultA(
+                    kms_master_key_id=mykey.arn,
+                    sse_algorithm="aws:kms"
+                )
+            )
+            ]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_server_side_encryption_configuration_example.override_logical_id("example")
+```
+
+### Migrating to `aws_s3_bucket_versioning`
+
+~> **NOTE:** As `aws_s3_bucket_versioning` is a separate resource, any S3 objects for which versioning is important (_e.g._, a truststore for mutual TLS authentication) must implicitly or explicitly depend on the `aws_s3_bucket_versioning` resource. Otherwise, the S3 objects may be created before versioning has been set. [See below](#ensure-objects-depend-on-versioning) for an example. Also note that AWS recommends waiting 15 minutes after enabling versioning on a bucket before putting or deleting objects in/from the bucket.
+
+#### Buckets With Versioning Enabled
+
+Given this previous configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        S3Bucket(self, "example",
+            bucket="yournamehere",
+            versioning=S3BucketVersioning(
+                enabled=True
+            )
+        )
+```
+
+Update the configuration to:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_versioning import S3BucketVersioningA
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = S3Bucket(self, "example",
+            bucket="yournamehere"
+        )
+        aws_s3_bucket_versioning_example = S3BucketVersioningA(self, "example_1",
+            bucket=example.id,
+            versioning_configuration=S3BucketVersioningVersioningConfiguration(
+                status="Enabled"
+            )
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_versioning_example.override_logical_id("example")
+```
+
+#### Buckets With Versioning Disabled or Suspended
+
+Depending on the version of the Terraform AWS Provider you are migrating from, the interpretation of `versioning.enabled = false`
+in your `aws_s3_bucket` resource will differ and thus the migration to the `aws_s3_bucket_versioning` resource will also differ as follows.
+
+If you are migrating from the Terraform AWS Provider `v3.70.0` or later:
+
+* For new S3 buckets, `enabled = false` is synonymous to `Disabled`.
+* For existing S3 buckets, `enabled = false` is synonymous to `Suspended`.
+
+If you are migrating from an earlier version of the Terraform AWS Provider:
+
+* For both new and existing S3 buckets, `enabled = false` is synonymous to `Suspended`.
+
+Given this previous configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        S3Bucket(self, "example",
+            bucket="yournamehere",
+            versioning=S3BucketVersioning(
+                enabled=False
+            )
+        )
+```
+
+Update the configuration to one of the following:
+
+* If migrating from Terraform AWS Provider `v3.70.0` or later and bucket versioning was never enabled:
+
+  ```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_versioning import S3BucketVersioningA
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = S3Bucket(self, "example",
+            bucket="yournamehere"
+        )
+        aws_s3_bucket_versioning_example = S3BucketVersioningA(self, "example_1",
+            bucket=example.id,
+            versioning_configuration=S3BucketVersioningVersioningConfiguration(
+                status="Disabled"
+            )
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_versioning_example.override_logical_id("example")
+```
+
+* If migrating from Terraform AWS Provider `v3.70.0` or later and bucket versioning was enabled at one point:
+
+  ```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_versioning import S3BucketVersioningA
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = S3Bucket(self, "example",
+            bucket="yournamehere"
+        )
+        aws_s3_bucket_versioning_example = S3BucketVersioningA(self, "example_1",
+            bucket=example.id,
+            versioning_configuration=S3BucketVersioningVersioningConfiguration(
+                status="Suspended"
+            )
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_versioning_example.override_logical_id("example")
+```
+
+* If migrating from an earlier version of Terraform AWS Provider:
+
+  ```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_versioning import S3BucketVersioningA
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = S3Bucket(self, "example",
+            bucket="yournamehere"
+        )
+        aws_s3_bucket_versioning_example = S3BucketVersioningA(self, "example_1",
+            bucket=example.id,
+            versioning_configuration=S3BucketVersioningVersioningConfiguration(
+                status="Suspended"
+            )
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_versioning_example.override_logical_id("example")
+```
+
+#### Ensure Objects Depend on Versioning
+
+When you create an object whose `version_id` you need and an `aws_s3_bucket_versioning` resource in the same configuration, you are more likely to have success by ensuring the `s3_object` depends either implicitly (see below) or explicitly (i.e., using `depends_on = [aws_s3_bucket_versioning.example]`) on the `aws_s3_bucket_versioning` resource.
+
+~> **NOTE:** For critical and/or production S3 objects, do not create a bucket, enable versioning, and create an object in the bucket within the same configuration. Doing so will not allow the AWS-recommended 15 minutes between enabling versioning and writing to the bucket.
+
+This example shows the `aws_s3_object.example` depending implicitly on the versioning resource through the reference to `aws_s3_bucket_versioning.example.id` to define `bucket`:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_versioning import S3BucketVersioningA
+from imports.aws.s3_object import S3Object
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = S3Bucket(self, "example",
+            bucket="yotto"
+        )
+        aws_s3_bucket_versioning_example = S3BucketVersioningA(self, "example_1",
+            bucket=example.id,
+            versioning_configuration=S3BucketVersioningVersioningConfiguration(
+                status="Enabled"
+            )
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_versioning_example.override_logical_id("example")
+        aws_s3_object_example = S3Object(self, "example_2",
+            bucket=Token.as_string(aws_s3_bucket_versioning_example.id),
+            key="droeloe",
+            source="example.txt"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_object_example.override_logical_id("example")
+```
+
+### Migrating to `aws_s3_bucket_website_configuration`
+
+Given this previous configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        S3Bucket(self, "example",
+            bucket="yournamehere",
+            website=S3BucketWebsite(
+                error_document="error.html",
+                index_document="index.html"
+            )
+        )
+```
+
+Update the configuration to:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_website_configuration import S3BucketWebsiteConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = S3Bucket(self, "example",
+            bucket="yournamehere"
+        )
+        aws_s3_bucket_website_configuration_example =
+        S3BucketWebsiteConfiguration(self, "example_1",
+            bucket=example.id,
+            error_document=S3BucketWebsiteConfigurationErrorDocument(
+                key="error.html"
+            ),
+            index_document=S3BucketWebsiteConfigurationIndexDocument(
+                suffix="index.html"
+            )
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_website_configuration_example.override_logical_id("example")
+```
+
+Given this previous configuration that uses the `aws_s3_bucket` parameter `website_domain` with `aws_route53_record`:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.route53_record import Route53Record
+from imports.aws.route53_zone import Route53Zone
+from imports.aws.s3_bucket import S3Bucket
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        main = Route53Zone(self, "main",
+            name="domain.test"
+        )
+        website = S3Bucket(self, "website",
+            website=S3BucketWebsite(
+                error_document="error.html",
+                index_document="index.html"
+            )
+        )
+        Route53Record(self, "alias",
+            alias=Route53RecordAlias(
+                evaluate_target_health=True,
+                name=website.website_domain,
+                zone_id=website.hosted_zone_id
+            ),
+            name="www",
+            type="A",
+            zone_id=main.zone_id
+        )
+```
+
+Update the configuration to use the `aws_s3_bucket_website_configuration` resource and its `website_domain` parameter:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.route53_record import Route53Record
+from imports.aws.route53_zone import Route53Zone
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_website_configuration import S3BucketWebsiteConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        main = Route53Zone(self, "main",
+            name="domain.test"
+        )
+        website = S3Bucket(self, "website")
+        example = S3BucketWebsiteConfiguration(self, "example",
+            bucket=website.id,
+            index_document=S3BucketWebsiteConfigurationIndexDocument(
+                suffix="index.html"
+            )
+        )
+        Route53Record(self, "alias",
+            alias=Route53RecordAlias(
+                evaluate_target_health=True,
+                name=example.website_domain,
+                zone_id=website.hosted_zone_id
+            ),
+            name="www",
+            type="A",
+            zone_id=main.zone_id
+        )
+```
+
+## S3 Bucket Refactor
+
+~> **NOTE:** This only applies to v4.0.0 through v4.8.0 of the AWS Provider, which introduce significant breaking
+changes to the `aws_s3_bucket` resource. We recommend upgrading to v4.9.0 of the AWS Provider instead. See the section above, [Changes to S3 Bucket Drift Detection](#changes-to-s3-bucket-drift-detection), for additional upgrade considerations.
+
+To help distribute the management of S3 bucket settings via independent resources, various arguments and attributes in the `aws_s3_bucket` resource have become **read-only**.
+
+Configurations dependent on these arguments should be updated to use the corresponding `aws_s3_bucket_*` resource in order to prevent Terraform from reporting “unconfigurable attribute” errors for read-only arguments. Once updated, it is recommended to import new `aws_s3_bucket_*` resources into Terraform state.
+
+In the event practitioners do not anticipate future modifications to the S3 bucket settings associated with these read-only arguments or drift detection is not needed, these read-only arguments should be removed from `aws_s3_bucket` resource configurations in order to prevent Terraform from reporting “unconfigurable attribute” errors; the states of these arguments will be preserved but are subject to change with modifications made outside Terraform.
+
+~> **NOTE:** Each of the new `aws_s3_bucket_*` resources relies on S3 API calls that utilize a `PUT` action in order to modify the target S3 bucket. These calls follow standard HTTP methods for REST APIs, and therefore **should** handle situations where the target configuration already exists. While it is not strictly necessary to import new `aws_s3_bucket_*` resources where the updated configuration matches the configuration used in previous versions of the AWS provider, skipping this step will lead to a diff in the first plan after a configuration change indicating that any new `aws_s3_bucket_*` resources will be created, making it more difficult to determine whether the appropriate actions will be taken.
+
+### `acceleration_status` Argument
+
+Switch your Terraform configuration to the [`aws_s3_bucket_accelerate_configuration` resource](/docs/providers/aws/r/s3_bucket_accelerate_configuration.html) instead.
+
+For example, given this previous configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        S3Bucket(self, "example",
+            acceleration_status="Enabled",
+            bucket="yournamehere"
+        )
+```
+
+You will get the following error after upgrading:
+
+```
+│ Error: Value for unconfigurable attribute
+│
+│   with aws_s3_bucket.example,
+│   on main.tf line 1, in resource "aws_s3_bucket" "example":
+│    1: resource "aws_s3_bucket" "example" {
+│
+│ Can't configure a value for "acceleration_status": its value will be decided automatically based on the result of applying this configuration.
+```
+
+Since `acceleration_status` is now read only, update your configuration to use the `aws_s3_bucket_accelerate_configuration`
+resource and remove `acceleration_status` in the `aws_s3_bucket` resource:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_accelerate_configuration import S3BucketAccelerateConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = S3Bucket(self, "example",
+            bucket="yournamehere"
+        )
+        aws_s3_bucket_accelerate_configuration_example =
+        S3BucketAccelerateConfiguration(self, "example_1",
+            bucket=example.id,
+            status="Enabled"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_accelerate_configuration_example.override_logical_id("example")
+```
+
+Run `terraform import` on each new resource, _e.g._,
+
+```console
+$ terraform import aws_s3_bucket_accelerate_configuration.example yournamehere
+aws_s3_bucket_accelerate_configuration.example: Importing from ID "yournamehere"...
+aws_s3_bucket_accelerate_configuration.example: Import prepared!
+  Prepared aws_s3_bucket_accelerate_configuration for import
+aws_s3_bucket_accelerate_configuration.example: Refreshing state... [id=yournamehere]
+
+Import successful!
+
+The resources that were imported are shown above. These resources are now in
+your Terraform state and will henceforth be managed by Terraform.
+```
+
+### `acl` Argument
+
+Switch your Terraform configuration to the [`aws_s3_bucket_acl` resource](/docs/providers/aws/r/s3_bucket_acl.html) instead.
+
+For example, given this previous configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        S3Bucket(self, "example",
+            acl="private",
+            bucket="yournamehere"
+        )
+```
+
+You will get the following error after upgrading:
+
+```
+│ Error: Value for unconfigurable attribute
+│
+│   with aws_s3_bucket.example,
+│   on main.tf line 1, in resource "aws_s3_bucket" "example":
+│    1: resource "aws_s3_bucket" "example" {
+│
+│ Can't configure a value for "acl": its value will be decided automatically based on the result of applying this configuration.
+```
+
+Since `acl` is now read only, update your configuration to use the `aws_s3_bucket_acl`
+resource and remove the `acl` argument in the `aws_s3_bucket` resource:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_acl import S3BucketAcl
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = S3Bucket(self, "example",
+            bucket="yournamehere"
+        )
+        aws_s3_bucket_acl_example = S3BucketAcl(self, "example_1",
+            acl="private",
+            bucket=example.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_acl_example.override_logical_id("example")
+```
+
+~> **NOTE:** When importing into `aws_s3_bucket_acl`, make sure you use the S3 bucket name (_e.g._, `yournamehere` in the example above) as part of the ID, and _not_ the Terraform bucket configuration name (_e.g._, `example` in the example above).
+
+Run `terraform import` on each new resource, _e.g._,
+
+```console
+$ terraform import aws_s3_bucket_acl.example yournamehere,private
+aws_s3_bucket_acl.example: Importing from ID "yournamehere,private"...
+aws_s3_bucket_acl.example: Import prepared!
+  Prepared aws_s3_bucket_acl for import
+aws_s3_bucket_acl.example: Refreshing state... [id=yournamehere,private]
+
+Import successful!
+
+The resources that were imported are shown above. These resources are now in
+your Terraform state and will henceforth be managed by Terraform.
+```
+
+### `cors_rule` Argument
+
+Switch your Terraform configuration to the [`aws_s3_bucket_cors_configuration` resource](/docs/providers/aws/r/s3_bucket_cors_configuration.html) instead.
+
+For example, given this previous configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        S3Bucket(self, "example",
+            bucket="yournamehere",
+            cors_rule=[S3BucketCorsRule(
+                allowed_headers=["*"],
+                allowed_methods=["PUT", "POST"],
+                allowed_origins=["https://s3-website-test.hashicorp.com"],
+                expose_headers=["ETag"],
+                max_age_seconds=3000
+            )
+            ]
+        )
+```
+
+You will get the following error after upgrading:
+
+```
+│ Error: Value for unconfigurable attribute
+│
+│   with aws_s3_bucket.example,
+│   on main.tf line 1, in resource "aws_s3_bucket" "example":
+│    1: resource "aws_s3_bucket" "example" {
+│
+│ Can't configure a value for "cors_rule": its value will be decided automatically based on the result of applying this configuration.
+```
+
+Since `cors_rule` is now read only, update your configuration to use the `aws_s3_bucket_cors_configuration`
+resource and remove `cors_rule` and its nested arguments in the `aws_s3_bucket` resource:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_cors_configuration import S3BucketCorsConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = S3Bucket(self, "example",
+            bucket="yournamehere"
+        )
+        aws_s3_bucket_cors_configuration_example = S3BucketCorsConfiguration(self, "example_1",
+            bucket=example.id,
+            cors_rule=[S3BucketCorsConfigurationCorsRule(
+                allowed_headers=["*"],
+                allowed_methods=["PUT", "POST"],
+                allowed_origins=["https://s3-website-test.hashicorp.com"],
+                expose_headers=["ETag"],
+                max_age_seconds=3000
+            )
+            ]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_cors_configuration_example.override_logical_id("example")
+```
+
+Run `terraform import` on each new resource, _e.g._,
+
+```console
+$ terraform import aws_s3_bucket_cors_configuration.example yournamehere
+aws_s3_bucket_cors_configuration.example: Importing from ID "yournamehere"...
+aws_s3_bucket_cors_configuration.example: Import prepared!
+  Prepared aws_s3_bucket_cors_configuration for import
+aws_s3_bucket_cors_configuration.example: Refreshing state... [id=yournamehere]
+
+Import successful!
+
+The resources that were imported are shown above. These resources are now in
+your Terraform state and will henceforth be managed by Terraform.
+```
+
+### `grant` Argument
+
+Switch your Terraform configuration to the [`aws_s3_bucket_acl` resource](/docs/providers/aws/r/s3_bucket_acl.html) instead.
+
+For example, given this previous configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        S3Bucket(self, "example",
+            bucket="yournamehere",
+            grant=[S3BucketGrant(
+                id=Token.as_string(current_user.id),
+                permissions=["FULL_CONTROL"],
+                type="CanonicalUser"
+            ), S3BucketGrant(
+                permissions=["READ_ACP", "WRITE"],
+                type="Group",
+                uri="http://acs.amazonaws.com/groups/s3/LogDelivery"
+            )
+            ]
+        )
+```
+
+You will get the following error after upgrading:
+
+```
+│ Error: Value for unconfigurable attribute
+│
+│   with aws_s3_bucket.example,
+│   on main.tf line 1, in resource "aws_s3_bucket" "example":
+│    1: resource "aws_s3_bucket" "example" {
+│
+│ Can't configure a value for "grant": its value will be decided automatically based on the result of applying this configuration.
+```
+
+Since `grant` is now read only, update your configuration to use the `aws_s3_bucket_acl`
+resource and remove `grant` in the `aws_s3_bucket` resource:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_acl import S3BucketAcl
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = S3Bucket(self, "example",
+            bucket="yournamehere"
+        )
+        aws_s3_bucket_acl_example = S3BucketAcl(self, "example_1",
+            access_control_policy=S3BucketAclAccessControlPolicy(
+                grant=[S3BucketAclAccessControlPolicyGrant(
+                    grantee=S3BucketAclAccessControlPolicyGrantGrantee(
+                        id=Token.as_string(current_user.id),
+                        type="CanonicalUser"
+                    ),
+                    permission="FULL_CONTROL"
+                ), S3BucketAclAccessControlPolicyGrant(
+                    grantee=S3BucketAclAccessControlPolicyGrantGrantee(
+                        type="Group",
+                        uri="http://acs.amazonaws.com/groups/s3/LogDelivery"
+                    ),
+                    permission="READ_ACP"
+                ), S3BucketAclAccessControlPolicyGrant(
+                    grantee=S3BucketAclAccessControlPolicyGrantGrantee(
+                        type="Group",
+                        uri="http://acs.amazonaws.com/groups/s3/LogDelivery"
+                    ),
+                    permission="WRITE"
+                )
+                ],
+                owner=S3BucketAclAccessControlPolicyOwner(
+                    id=Token.as_string(current_user.id)
+                )
+            ),
+            bucket=example.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_acl_example.override_logical_id("example")
+```
+
+Run `terraform import` on each new resource, _e.g._,
+
+```console
+$ terraform import aws_s3_bucket_acl.example yournamehere
+aws_s3_bucket_acl.example: Importing from ID "yournamehere"...
+aws_s3_bucket_acl.example: Import prepared!
+  Prepared aws_s3_bucket_acl for import
+aws_s3_bucket_acl.example: Refreshing state... [id=yournamehere]
+
+Import successful!
+
+The resources that were imported are shown above. These resources are now in
+your Terraform state and will henceforth be managed by Terraform.
+```
+
+### `lifecycle_rule` Argument
+
+Switch your Terraform configuration to the [`aws_s3_bucket_lifecycle_configuration` resource](/docs/providers/aws/r/s3_bucket_lifecycle_configuration.html) instead.
+
+#### For Lifecycle Rules with no `prefix` previously configured
+
+For example, given this previous configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        S3Bucket(self, "example",
+            bucket="yournamehere",
+            lifecycle_rule=[S3BucketLifecycleRule(
+                enabled=True,
+                id="Keep previous version 30 days, then in Glacier another 60",
+                noncurrent_version_expiration=S3BucketLifecycleRuleNoncurrentVersionExpiration(
+                    days=90
+                ),
+                noncurrent_version_transition=[S3BucketLifecycleRuleNoncurrentVersionTransition(
+                    days=30,
+                    storage_class="GLACIER"
+                )
+                ]
+            ), S3BucketLifecycleRule(
+                abort_incomplete_multipart_upload_days=7,
+                enabled=True,
+                id="Delete old incomplete multi-part uploads"
+            )
+            ]
+        )
+```
+
+You will receive the following error after upgrading:
+
+```
+│ Error: Value for unconfigurable attribute
+│
+│   with aws_s3_bucket.example,
+│   on main.tf line 1, in resource "aws_s3_bucket" "example":
+│    1: resource "aws_s3_bucket" "example" {
+│
+│ Can't configure a value for "lifecycle_rule": its value will be decided automatically based on the result of applying this configuration.
+```
+
+Since the `lifecycle_rule` argument changed to read-only, update the configuration to use the `aws_s3_bucket_lifecycle_configuration`
+resource and remove `lifecycle_rule` and its nested arguments in the `aws_s3_bucket` resource.
+
+~> **Note:** When configuring the `rule.filter` configuration block in the new `aws_s3_bucket_lifecycle_configuration` resource, use the AWS CLI s3api [get-bucket-lifecycle-configuration](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/s3api/get-bucket-lifecycle-configuration.html)
+to get the source bucket's lifecycle configuration and determine if the `Filter` is configured as `"Filter" : {}` or `"Filter" : { "Prefix": "" }`.
+If AWS returns the former, configure `rule.filter` as `filter {}`. Otherwise, neither a `rule.filter` nor `rule.prefix` parameter should be configured as shown here:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_lifecycle_configuration import S3BucketLifecycleConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = S3Bucket(self, "example",
+            bucket="yournamehere"
+        )
+        aws_s3_bucket_lifecycle_configuration_example =
+        S3BucketLifecycleConfiguration(self, "example_1",
+            bucket=example.id,
+            rule=[S3BucketLifecycleConfigurationRule(
+                id="Keep previous version 30 days, then in Glacier another 60",
+                noncurrent_version_expiration=S3BucketLifecycleConfigurationRuleNoncurrentVersionExpiration(
+                    noncurrent_days=90
+                ),
+                noncurrent_version_transition=[S3BucketLifecycleConfigurationRuleNoncurrentVersionTransition(
+                    noncurrent_days=30,
+                    storage_class="GLACIER"
+                )
+                ],
+                status="Enabled"
+            ), S3BucketLifecycleConfigurationRule(
+                abort_incomplete_multipart_upload=S3BucketLifecycleConfigurationRuleAbortIncompleteMultipartUpload(
+                    days_after_initiation=7
+                ),
+                id="Delete old incomplete multi-part uploads",
+                status="Enabled"
+            )
+            ]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_lifecycle_configuration_example.override_logical_id("example")
+```
+
+Run `terraform import` on each new resource, _e.g._,
+
+```console
+$ terraform import aws_s3_bucket_lifecycle_configuration.example yournamehere
+aws_s3_bucket_lifecycle_configuration.example: Importing from ID "yournamehere"...
+aws_s3_bucket_lifecycle_configuration.example: Import prepared!
+  Prepared aws_s3_bucket_lifecycle_configuration for import
+aws_s3_bucket_lifecycle_configuration.example: Refreshing state... [id=yournamehere]
+
+Import successful!
+
+The resources that were imported are shown above. These resources are now in
+your Terraform state and will henceforth be managed by Terraform.
+```
+
+#### For Lifecycle Rules with `prefix` previously configured as an empty string
+
+For example, given this configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        S3Bucket(self, "example",
+            bucket="yournamehere",
+            lifecycle_rule=[S3BucketLifecycleRule(
+                enabled=True,
+                id="log-expiration",
+                prefix="",
+                transition=[S3BucketLifecycleRuleTransition(
+                    days=30,
+                    storage_class="STANDARD_IA"
+                ), S3BucketLifecycleRuleTransition(
+                    days=180,
+                    storage_class="GLACIER"
+                )
+                ]
+            )
+            ]
+        )
+```
+
+You will receive the following error after upgrading:
+
+```
+│ Error: Value for unconfigurable attribute
+│
+│   with aws_s3_bucket.example,
+│   on main.tf line 1, in resource "aws_s3_bucket" "example":
+│    1: resource "aws_s3_bucket" "example" {
+│
+│ Can't configure a value for "lifecycle_rule": its value will be decided automatically based on the result of applying this configuration.
+```
+
+Since the `lifecycle_rule` argument changed to read-only, update the configuration to use the `aws_s3_bucket_lifecycle_configuration`
+resource and remove `lifecycle_rule` and its nested arguments in the `aws_s3_bucket` resource:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_lifecycle_configuration import S3BucketLifecycleConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = S3Bucket(self, "example",
+            bucket="yournamehere"
+        )
+        aws_s3_bucket_lifecycle_configuration_example =
+        S3BucketLifecycleConfiguration(self, "example_1",
+            bucket=example.id,
+            rule=[S3BucketLifecycleConfigurationRule(
+                id="log-expiration",
+                status="Enabled",
+                transition=[S3BucketLifecycleConfigurationRuleTransition(
+                    days=30,
+                    storage_class="STANDARD_IA"
+                ), S3BucketLifecycleConfigurationRuleTransition(
+                    days=180,
+                    storage_class="GLACIER"
+                )
+                ]
+            )
+            ]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_lifecycle_configuration_example.override_logical_id("example")
+```
+
+Run `terraform import` on each new resource, _e.g._,
+
+```console
+$ terraform import aws_s3_bucket_lifecycle_configuration.example yournamehere
+aws_s3_bucket_lifecycle_configuration.example: Importing from ID "yournamehere"...
+aws_s3_bucket_lifecycle_configuration.example: Import prepared!
+  Prepared aws_s3_bucket_lifecycle_configuration for import
+aws_s3_bucket_lifecycle_configuration.example: Refreshing state... [id=yournamehere]
+
+Import successful!
+
+The resources that were imported are shown above. These resources are now in
+your Terraform state and will henceforth be managed by Terraform.
+```
+
+#### For Lifecycle Rules with `prefix`
+
+For example, given this configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        S3Bucket(self, "example",
+            bucket="yournamehere",
+            lifecycle_rule=[S3BucketLifecycleRule(
+                enabled=True,
+                id="log-expiration",
+                prefix="foobar",
+                transition=[S3BucketLifecycleRuleTransition(
+                    days=30,
+                    storage_class="STANDARD_IA"
+                ), S3BucketLifecycleRuleTransition(
+                    days=180,
+                    storage_class="GLACIER"
+                )
+                ]
+            )
+            ]
+        )
+```
+
+You will receive the following error after upgrading:
+
+```
+│ Error: Value for unconfigurable attribute
+│
+│   with aws_s3_bucket.example,
+│   on main.tf line 1, in resource "aws_s3_bucket" "example":
+│    1: resource "aws_s3_bucket" "example" {
+│
+│ Can't configure a value for "lifecycle_rule": its value will be decided automatically based on the result of applying this configuration.
+```
+
+Since the `lifecycle_rule` argument changed to read-only, update the configuration to use the `aws_s3_bucket_lifecycle_configuration`
+resource and remove `lifecycle_rule` and its nested arguments in the `aws_s3_bucket` resource:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_lifecycle_configuration import S3BucketLifecycleConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = S3Bucket(self, "example",
+            bucket="yournamehere"
+        )
+        aws_s3_bucket_lifecycle_configuration_example =
+        S3BucketLifecycleConfiguration(self, "example_1",
+            bucket=example.id,
+            rule=[S3BucketLifecycleConfigurationRule(
+                filter=S3BucketLifecycleConfigurationRuleFilter(
+                    prefix="foobar"
+                ),
+                id="log-expiration",
+                status="Enabled",
+                transition=[S3BucketLifecycleConfigurationRuleTransition(
+                    days=30,
+                    storage_class="STANDARD_IA"
+                ), S3BucketLifecycleConfigurationRuleTransition(
+                    days=180,
+                    storage_class="GLACIER"
+                )
+                ]
+            )
+            ]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_lifecycle_configuration_example.override_logical_id("example")
+```
+
+Run `terraform import` on each new resource, _e.g._,
+
+```console
+$ terraform import aws_s3_bucket_lifecycle_configuration.example yournamehere
+aws_s3_bucket_lifecycle_configuration.example: Importing from ID "yournamehere"...
+aws_s3_bucket_lifecycle_configuration.example: Import prepared!
+  Prepared aws_s3_bucket_lifecycle_configuration for import
+aws_s3_bucket_lifecycle_configuration.example: Refreshing state... [id=yournamehere]
+
+Import successful!
+
+The resources that were imported are shown above. These resources are now in
+your Terraform state and will henceforth be managed by Terraform.
+```
+
+#### For Lifecycle Rules with `prefix` and `tags`
+
+For example, given this previous configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        S3Bucket(self, "example",
+            bucket="yournamehere",
+            lifecycle_rule=[S3BucketLifecycleRule(
+                enabled=True,
+                expiration=S3BucketLifecycleRuleExpiration(
+                    days=90
+                ),
+                id="log",
+                prefix="log/",
+                tags={
+                    "autoclean": "true",
+                    "rule": "log"
+                },
+                transition=[S3BucketLifecycleRuleTransition(
+                    days=30,
+                    storage_class="STANDARD_IA"
+                ), S3BucketLifecycleRuleTransition(
+                    days=60,
+                    storage_class="GLACIER"
+                )
+                ]
+            ), S3BucketLifecycleRule(
+                enabled=True,
+                expiration=S3BucketLifecycleRuleExpiration(
+                    date="2022-12-31"
+                ),
+                id="tmp",
+                prefix="tmp/"
+            )
+            ]
+        )
+```
+
+You will get the following error after upgrading:
+
+```
+│ Error: Value for unconfigurable attribute
+│
+│   with aws_s3_bucket.example,
+│   on main.tf line 1, in resource "aws_s3_bucket" "example":
+│    1: resource "aws_s3_bucket" "example" {
+│
+│ Can't configure a value for "lifecycle_rule": its value will be decided automatically based on the result of applying this configuration.
+```
+
+Since `lifecycle_rule` is now read only, update your configuration to use the `aws_s3_bucket_lifecycle_configuration`
+resource and remove `lifecycle_rule` and its nested arguments in the `aws_s3_bucket` resource:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_lifecycle_configuration import S3BucketLifecycleConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = S3Bucket(self, "example",
+            bucket="yournamehere"
+        )
+        aws_s3_bucket_lifecycle_configuration_example =
+        S3BucketLifecycleConfiguration(self, "example_1",
+            bucket=example.id,
+            rule=[S3BucketLifecycleConfigurationRule(
+                expiration=S3BucketLifecycleConfigurationRuleExpiration(
+                    days=90
+                ),
+                filter=S3BucketLifecycleConfigurationRuleFilter(
+                    and=S3BucketLifecycleConfigurationRuleFilterAnd(
+                        prefix="log/",
+                        tags={
+                            "autoclean": "true",
+                            "rule": "log"
+                        }
+                    )
+                ),
+                id="log",
+                status="Enabled",
+                transition=[S3BucketLifecycleConfigurationRuleTransition(
+                    days=30,
+                    storage_class="STANDARD_IA"
+                ), S3BucketLifecycleConfigurationRuleTransition(
+                    days=60,
+                    storage_class="GLACIER"
+                )
+                ]
+            ), S3BucketLifecycleConfigurationRule(
+                expiration=S3BucketLifecycleConfigurationRuleExpiration(
+                    date="2022-12-31T00:00:00Z"
+                ),
+                filter=S3BucketLifecycleConfigurationRuleFilter(
+                    prefix="tmp/"
+                ),
+                id="tmp",
+                status="Enabled"
+            )
+            ]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_lifecycle_configuration_example.override_logical_id("example")
+```
+
+Run `terraform import` on each new resource, _e.g._,
+
+```console
+$ terraform import aws_s3_bucket_lifecycle_configuration.example yournamehere
+aws_s3_bucket_lifecycle_configuration.example: Importing from ID "yournamehere"...
+aws_s3_bucket_lifecycle_configuration.example: Import prepared!
+  Prepared aws_s3_bucket_lifecycle_configuration for import
+aws_s3_bucket_lifecycle_configuration.example: Refreshing state... [id=yournamehere]
+
+Import successful!
+
+The resources that were imported are shown above. These resources are now in
+your Terraform state and will henceforth be managed by Terraform.
+```
+
+### `logging` Argument
+
+Switch your Terraform configuration to the [`aws_s3_bucket_logging` resource](/docs/providers/aws/r/s3_bucket_logging.html) instead.
+
+For example, given this previous configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        log_bucket = S3Bucket(self, "log_bucket",
+            bucket="example-log-bucket"
+        )
+        S3Bucket(self, "example",
+            bucket="yournamehere",
+            logging=S3BucketLogging(
+                target_bucket=log_bucket.id,
+                target_prefix="log/"
+            )
+        )
+```
+
+You will get the following error after upgrading:
+
+```
+│ Error: Value for unconfigurable attribute
+│
+│   with aws_s3_bucket.example,
+│   on main.tf line 1, in resource "aws_s3_bucket" "example":
+│    1: resource "aws_s3_bucket" "example" {
+│
+│ Can't configure a value for "logging": its value will be decided automatically based on the result of applying this configuration.
+```
+
+Since `logging` is now read only, update your configuration to use the `aws_s3_bucket_logging`
+resource and remove `logging` and its nested arguments in the `aws_s3_bucket` resource:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_logging import S3BucketLoggingA
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = S3Bucket(self, "example",
+            bucket="yournamehere"
+        )
+        log_bucket = S3Bucket(self, "log_bucket",
+            bucket="example-log-bucket"
+        )
+        aws_s3_bucket_logging_example = S3BucketLoggingA(self, "example_2",
+            bucket=example.id,
+            target_bucket=log_bucket.id,
+            target_prefix="log/"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_logging_example.override_logical_id("example")
+```
+
+Run `terraform import` on each new resource, _e.g._,
+
+```console
+$ terraform import aws_s3_bucket_logging.example yournamehere
+aws_s3_bucket_logging.example: Importing from ID "yournamehere"...
+aws_s3_bucket_logging.example: Import prepared!
+  Prepared aws_s3_bucket_logging for import
+aws_s3_bucket_logging.example: Refreshing state... [id=yournamehere]
+
+Import successful!
+
+The resources that were imported are shown above. These resources are now in
+your Terraform state and will henceforth be managed by Terraform.
+```
+
+### `object_lock_configuration` `rule` Argument
+
+Switch your Terraform configuration to the [`aws_s3_bucket_object_lock_configuration` resource](/docs/providers/aws/r/s3_bucket_object_lock_configuration.html) instead.
+
+For example, given this previous configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        S3Bucket(self, "example",
+            bucket="yournamehere",
+            object_lock_configuration=S3BucketObjectLockConfiguration(
+                object_lock_enabled="Enabled",
+                rule=S3BucketObjectLockConfigurationRule(
+                    default_retention=S3BucketObjectLockConfigurationRuleDefaultRetention(
+                        days=3,
+                        mode="COMPLIANCE"
+                    )
+                )
+            )
+        )
+```
+
+You will get the following error after upgrading:
+
+```
+│ Error: Value for unconfigurable attribute
+│
+│   with aws_s3_bucket.example,
+│   on main.tf line 1, in resource "aws_s3_bucket" "example":
+│    1: resource "aws_s3_bucket" "example" {
+│
+│ Can't configure a value for "object_lock_configuration.0.rule": its value will be decided automatically based on the result of applying this configuration.
+```
+
+Since the `rule` argument of the `object_lock_configuration` configuration block changed to read-only, update your configuration to use the `aws_s3_bucket_object_lock_configuration`
+resource and remove `rule` and its nested arguments in the `aws_s3_bucket` resource:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_object_lock_configuration import S3BucketObjectLockConfigurationA
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = S3Bucket(self, "example",
+            bucket="yournamehere",
+            object_lock_enabled=True
+        )
+        aws_s3_bucket_object_lock_configuration_example =
+        S3BucketObjectLockConfigurationA(self, "example_1",
+            bucket=example.id,
+            rule=S3BucketObjectLockConfigurationRuleA(
+                default_retention=S3BucketObjectLockConfigurationRuleDefaultRetentionA(
+                    days=3,
+                    mode="COMPLIANCE"
+                )
+            )
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_object_lock_configuration_example.override_logical_id("example")
+```
+
+Run `terraform import` on each new resource, _e.g._,
+
+```console
+$ terraform import aws_s3_bucket_object_lock_configuration.example yournamehere
+aws_s3_bucket_object_lock_configuration.example: Importing from ID "yournamehere"...
+aws_s3_bucket_object_lock_configuration.example: Import prepared!
+  Prepared aws_s3_bucket_object_lock_configuration for import
+aws_s3_bucket_object_lock_configuration.example: Refreshing state... [id=yournamehere]
+
+Import successful!
+
+The resources that were imported are shown above. These resources are now in
+your Terraform state and will henceforth be managed by Terraform.
+```
+
+### `policy` Argument
+
+Switch your Terraform configuration to the [`aws_s3_bucket_policy` resource](/docs/providers/aws/r/s3_bucket_policy.html) instead.
+
+For example, given this previous configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        S3Bucket(self, "example",
+            bucket="yournamehere",
+            policy="{\n  \"Id\": \"Policy1446577137248\",\n  \"Statement\": [\n    {\n      \"Action\": \"s3:PutObject\",\n      \"Effect\": \"Allow\",\n      \"Principal\": {\n        \"AWS\": \"${" + current.arn + "}\"\n      },\n      \"Resource\": \"arn:${" + data_aws_partition_current.partition + "}:s3:::yournamehere/*\",\n      \"Sid\": \"Stmt1446575236270\"\n    }\n  ],\n  \"Version\": \"2012-10-17\"\n}\n\n"
+        )
+```
+
+You will get the following error after upgrading:
+
+```
+│ Error: Value for unconfigurable attribute
+│
+│   with aws_s3_bucket.example,
+│   on main.tf line 1, in resource "aws_s3_bucket" "example":
+│    1: resource "aws_s3_bucket" "example" {
+│
+│ Can't configure a value for "policy": its value will be decided automatically based on the result of applying this configuration.
+```
+
+Since `policy` is now read only, update your configuration to use the `aws_s3_bucket_policy`
+resource and remove `policy` in the `aws_s3_bucket` resource:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_policy import S3BucketPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = S3Bucket(self, "example",
+            bucket="yournamehere"
+        )
+        aws_s3_bucket_policy_example = S3BucketPolicy(self, "example_1",
+            bucket=example.id,
+            policy="{\n  \"Id\": \"Policy1446577137248\",\n  \"Statement\": [\n    {\n      \"Action\": \"s3:PutObject\",\n      \"Effect\": \"Allow\",\n      \"Principal\": {\n        \"AWS\": \"${" + current.arn + "}\"\n      },\n      \"Resource\": \"${" + example.arn + "}/*\",\n      \"Sid\": \"Stmt1446575236270\"\n    }\n  ],\n  \"Version\": \"2012-10-17\"\n}\n\n"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_policy_example.override_logical_id("example")
+```
+
+Run `terraform import` on each new resource, _e.g._,
+
+```console
+$ terraform import aws_s3_bucket_policy.example yournamehere
+aws_s3_bucket_policy.example: Importing from ID "yournamehere"...
+aws_s3_bucket_policy.example: Import prepared!
+  Prepared aws_s3_bucket_policy for import
+aws_s3_bucket_policy.example: Refreshing state... [id=yournamehere]
+
+Import successful!
+
+The resources that were imported are shown above. These resources are now in
+your Terraform state and will henceforth be managed by Terraform.
+```
+
+### `replication_configuration` Argument
+
+Switch your Terraform configuration to the [`aws_s3_bucket_replication_configuration` resource](/docs/providers/aws/r/s3_bucket_replication_configuration.html) instead.
+
+For example, given this previous configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        S3Bucket(self, "example",
+            bucket="yournamehere",
+            provider=central,
+            replication_configuration=S3BucketReplicationConfiguration(
+                role=replication.arn,
+                rules=[S3BucketReplicationConfigurationRules(
+                    destination=S3BucketReplicationConfigurationRulesDestination(
+                        bucket=destination.arn,
+                        metrics=S3BucketReplicationConfigurationRulesDestinationMetrics(
+                            minutes=15,
+                            status="Enabled"
+                        ),
+                        replication_time=S3BucketReplicationConfigurationRulesDestinationReplicationTime(
+                            minutes=15,
+                            status="Enabled"
+                        ),
+                        storage_class="STANDARD"
+                    ),
+                    filter=S3BucketReplicationConfigurationRulesFilter(
+                        tags={}
+                    ),
+                    id="foobar",
+                    status="Enabled"
+                )
+                ]
+            )
+        )
+```
+
+You will get the following error after upgrading:
+
+```
+│ Error: Value for unconfigurable attribute
+│
+│   with aws_s3_bucket.example,
+│   on main.tf line 1, in resource "aws_s3_bucket" "example":
+│    1: resource "aws_s3_bucket" "example" {
+│
+│ Can't configure a value for "replication_configuration": its value will be decided automatically based on the result of applying this configuration.
+```
+
+Since `replication_configuration` is now read only, update your configuration to use the `aws_s3_bucket_replication_configuration`
+resource and remove `replication_configuration` and its nested arguments in the `aws_s3_bucket` resource:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_replication_configuration import S3BucketReplicationConfigurationA
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = S3Bucket(self, "example",
+            bucket="yournamehere",
+            provider=central
+        )
+        aws_s3_bucket_replication_configuration_example =
+        S3BucketReplicationConfigurationA(self, "example_1",
+            bucket=example.id,
+            role=replication.arn,
+            rule=[S3BucketReplicationConfigurationRule(
+                delete_marker_replication=S3BucketReplicationConfigurationRuleDeleteMarkerReplication(
+                    status="Enabled"
+                ),
+                destination=S3BucketReplicationConfigurationRuleDestination(
+                    bucket=destination.arn,
+                    metrics=S3BucketReplicationConfigurationRuleDestinationMetrics(
+                        event_threshold=S3BucketReplicationConfigurationRuleDestinationMetricsEventThreshold(
+                            minutes=15
+                        ),
+                        status="Enabled"
+                    ),
+                    replication_time=S3BucketReplicationConfigurationRuleDestinationReplicationTime(
+                        status="Enabled",
+                        time=S3BucketReplicationConfigurationRuleDestinationReplicationTimeTime(
+                            minutes=15
+                        )
+                    ),
+                    storage_class="STANDARD"
+                ),
+                filter=S3BucketReplicationConfigurationRuleFilter(),
+                id="foobar",
+                status="Enabled"
+            )
+            ]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_replication_configuration_example.override_logical_id("example")
+```
+
+Run `terraform import` on each new resource, _e.g._,
+
+```console
+$ terraform import aws_s3_bucket_replication_configuration.example yournamehere
+aws_s3_bucket_replication_configuration.example: Importing from ID "yournamehere"...
+aws_s3_bucket_replication_configuration.example: Import prepared!
+  Prepared aws_s3_bucket_replication_configuration for import
+aws_s3_bucket_replication_configuration.example: Refreshing state... [id=yournamehere]
+
+Import successful!
+
+The resources that were imported are shown above. These resources are now in
+your Terraform state and will henceforth be managed by Terraform.
+```
+
+### `request_payer` Argument
+
+Switch your Terraform configuration to the [`aws_s3_bucket_request_payment_configuration` resource](/docs/providers/aws/r/s3_bucket_request_payment_configuration.html) instead.
+
+For example, given this previous configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        S3Bucket(self, "example",
+            bucket="yournamehere",
+            request_payer="Requester"
+        )
+```
+
+You will get the following error after upgrading:
+
+```
+│ Error: Value for unconfigurable attribute
+│
+│   with aws_s3_bucket.example,
+│   on main.tf line 1, in resource "aws_s3_bucket" "example":
+│    1: resource "aws_s3_bucket" "example" {
+│
+│ Can't configure a value for "request_payer": its value will be decided automatically based on the result of applying this configuration.
+```
+
+Since `request_payer` is now read only, update your configuration to use the `aws_s3_bucket_request_payment_configuration`
+resource and remove `request_payer` in the `aws_s3_bucket` resource:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_request_payment_configuration import S3BucketRequestPaymentConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = S3Bucket(self, "example",
+            bucket="yournamehere"
+        )
+        aws_s3_bucket_request_payment_configuration_example =
+        S3BucketRequestPaymentConfiguration(self, "example_1",
+            bucket=example.id,
+            payer="Requester"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_request_payment_configuration_example.override_logical_id("example")
+```
+
+Run `terraform import` on each new resource, _e.g._,
+
+```console
+$ terraform import aws_s3_bucket_request_payment_configuration.example yournamehere
+aws_s3_bucket_request_payment_configuration.example: Importing from ID "yournamehere"...
+aws_s3_bucket_request_payment_configuration.example: Import prepared!
+  Prepared aws_s3_bucket_request_payment_configuration for import
+aws_s3_bucket_request_payment_configuration.example: Refreshing state... [id=yournamehere]
+
+Import successful!
+
+The resources that were imported are shown above. These resources are now in
+your Terraform state and will henceforth be managed by Terraform.
+```
+
+### `server_side_encryption_configuration` Argument
+
+Switch your Terraform configuration to the [`aws_s3_bucket_server_side_encryption_configuration` resource](/docs/providers/aws/r/s3_bucket_server_side_encryption_configuration.html) instead.
+
+For example, given this previous configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        S3Bucket(self, "example",
+            bucket="yournamehere",
+            server_side_encryption_configuration=S3BucketServerSideEncryptionConfiguration(
+                rule=S3BucketServerSideEncryptionConfigurationRule(
+                    apply_server_side_encryption_by_default=S3BucketServerSideEncryptionConfigurationRuleApplyServerSideEncryptionByDefault(
+                        kms_master_key_id=mykey.arn,
+                        sse_algorithm="aws:kms"
+                    )
+                )
+            )
+        )
+```
+
+You will get the following error after upgrading:
+
+```
+│ Error: Value for unconfigurable attribute
+│
+│   with aws_s3_bucket.example,
+│   on main.tf line 1, in resource "aws_s3_bucket" "example":
+│    1: resource "aws_s3_bucket" "example" {
+│
+│ Can't configure a value for "server_side_encryption_configuration": its value will be decided automatically based on the result of applying this configuration.
+```
+
+Since `server_side_encryption_configuration` is now read only, update your configuration to use the `aws_s3_bucket_server_side_encryption_configuration`
+resource and remove `server_side_encryption_configuration` and its nested arguments in the `aws_s3_bucket` resource:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_server_side_encryption_configuration import S3BucketServerSideEncryptionConfigurationA
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = S3Bucket(self, "example",
+            bucket="yournamehere"
+        )
+        aws_s3_bucket_server_side_encryption_configuration_example =
+        S3BucketServerSideEncryptionConfigurationA(self, "example_1",
+            bucket=example.id,
+            rule=[S3BucketServerSideEncryptionConfigurationRuleA(
+                apply_server_side_encryption_by_default=S3BucketServerSideEncryptionConfigurationRuleApplyServerSideEncryptionByDefaultA(
+                    kms_master_key_id=mykey.arn,
+                    sse_algorithm="aws:kms"
+                )
+            )
+            ]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_server_side_encryption_configuration_example.override_logical_id("example")
+```
+
+Run `terraform import` on each new resource, _e.g._,
+
+```console
+$ terraform import aws_s3_bucket_server_side_encryption_configuration.example yournamehere
+aws_s3_bucket_server_side_encryption_configuration.example: Importing from ID "yournamehere"...
+aws_s3_bucket_server_side_encryption_configuration.example: Import prepared!
+  Prepared aws_s3_bucket_server_side_encryption_configuration for import
+aws_s3_bucket_server_side_encryption_configuration.example: Refreshing state... [id=yournamehere]
+
+Import successful!
+
+The resources that were imported are shown above. These resources are now in
+your Terraform state and will henceforth be managed by Terraform.
+```
+
+### `versioning` Argument
+
+Switch your Terraform configuration to the [`aws_s3_bucket_versioning` resource](/docs/providers/aws/r/s3_bucket_versioning.html) instead.
+
+~> **NOTE:** As `aws_s3_bucket_versioning` is a separate resource, any S3 objects for which versioning is important (_e.g._, a truststore for mutual TLS authentication) must implicitly or explicitly depend on the `aws_s3_bucket_versioning` resource. Otherwise, the S3 objects may be created before versioning has been set. [See below](#ensure-objects-depend-on-versioning) for an example. Also note that AWS recommends waiting 15 minutes after enabling versioning on a bucket before putting or deleting objects in/from the bucket.
+
+#### Buckets With Versioning Enabled
+
+Given this previous configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        S3Bucket(self, "example",
+            bucket="yournamehere",
+            versioning=S3BucketVersioning(
+                enabled=True
+            )
+        )
+```
+
+You will get the following error after upgrading:
+
+```
+│ Error: Value for unconfigurable attribute
+│
+│   with aws_s3_bucket.example,
+│   on main.tf line 1, in resource "aws_s3_bucket" "example":
+│    1: resource "aws_s3_bucket" "example" {
+│
+│ Can't configure a value for "versioning": its value will be decided automatically based on the result of applying this configuration.
+```
+
+Since `versioning` is now read only, update your configuration to use the `aws_s3_bucket_versioning`
+resource and remove `versioning` and its nested arguments in the `aws_s3_bucket` resource:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_versioning import S3BucketVersioningA
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = S3Bucket(self, "example",
+            bucket="yournamehere"
+        )
+        aws_s3_bucket_versioning_example = S3BucketVersioningA(self, "example_1",
+            bucket=example.id,
+            versioning_configuration=S3BucketVersioningVersioningConfiguration(
+                status="Enabled"
+            )
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_versioning_example.override_logical_id("example")
+```
+
+Run `terraform import` on each new resource, _e.g._,
+
+```console
+$ terraform import aws_s3_bucket_versioning.example yournamehere
+aws_s3_bucket_versioning.example: Importing from ID "yournamehere"...
+aws_s3_bucket_versioning.example: Import prepared!
+  Prepared aws_s3_bucket_versioning for import
+aws_s3_bucket_versioning.example: Refreshing state... [id=yournamehere]
+
+Import successful!
+
+The resources that were imported are shown above. These resources are now in
+your Terraform state and will henceforth be managed by Terraform.
+```
+
+#### Buckets With Versioning Disabled or Suspended
+
+Depending on the version of the Terraform AWS Provider you are migrating from, the interpretation of `versioning.enabled = false`
+in your `aws_s3_bucket` resource will differ and thus the migration to the `aws_s3_bucket_versioning` resource will also differ as follows.
+
+If you are migrating from the Terraform AWS Provider `v3.70.0` or later:
+
+* For new S3 buckets, `enabled = false` is synonymous to `Disabled`.
+* For existing S3 buckets, `enabled = false` is synonymous to `Suspended`.
+
+If you are migrating from an earlier version of the Terraform AWS Provider:
+
+* For both new and existing S3 buckets, `enabled = false` is synonymous to `Suspended`.
+
+Given this previous configuration :
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        S3Bucket(self, "example",
+            bucket="yournamehere",
+            versioning=S3BucketVersioning(
+                enabled=False
+            )
+        )
+```
+
+You will get the following error after upgrading:
+
+```
+│ Error: Value for unconfigurable attribute
+│
+│   with aws_s3_bucket.example,
+│   on main.tf line 1, in resource "aws_s3_bucket" "example":
+│    1: resource "aws_s3_bucket" "example" {
+│
+│ Can't configure a value for "versioning": its value will be decided automatically based on the result of applying this configuration.
+```
+
+Since `versioning` is now read only, update your configuration to use the `aws_s3_bucket_versioning`
+resource and remove `versioning` and its nested arguments in the `aws_s3_bucket` resource.
+
+* If migrating from Terraform AWS Provider `v3.70.0` or later and bucket versioning was never enabled:
+
+  ```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_versioning import S3BucketVersioningA
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = S3Bucket(self, "example",
+            bucket="yournamehere"
+        )
+        aws_s3_bucket_versioning_example = S3BucketVersioningA(self, "example_1",
+            bucket=example.id,
+            versioning_configuration=S3BucketVersioningVersioningConfiguration(
+                status="Disabled"
+            )
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_versioning_example.override_logical_id("example")
+```
+
+* If migrating from Terraform AWS Provider `v3.70.0` or later and bucket versioning was enabled at one point:
+
+  ```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_versioning import S3BucketVersioningA
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = S3Bucket(self, "example",
+            bucket="yournamehere"
+        )
+        aws_s3_bucket_versioning_example = S3BucketVersioningA(self, "example_1",
+            bucket=example.id,
+            versioning_configuration=S3BucketVersioningVersioningConfiguration(
+                status="Suspended"
+            )
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_versioning_example.override_logical_id("example")
+```
+
+* If migrating from an earlier version of Terraform AWS Provider:
+
+  ```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_versioning import S3BucketVersioningA
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = S3Bucket(self, "example",
+            bucket="yournamehere"
+        )
+        aws_s3_bucket_versioning_example = S3BucketVersioningA(self, "example_1",
+            bucket=example.id,
+            versioning_configuration=S3BucketVersioningVersioningConfiguration(
+                status="Suspended"
+            )
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_versioning_example.override_logical_id("example")
+```
+
+Run `terraform import` on each new resource, _e.g._,
+
+```console
+$ terraform import aws_s3_bucket_versioning.example yournamehere
+aws_s3_bucket_versioning.example: Importing from ID "yournamehere"...
+aws_s3_bucket_versioning.example: Import prepared!
+  Prepared aws_s3_bucket_versioning for import
+aws_s3_bucket_versioning.example: Refreshing state... [id=yournamehere]
+
+Import successful!
+
+The resources that were imported are shown above. These resources are now in
+your Terraform state and will henceforth be managed by Terraform.
+```
+
+#### Ensure Objects Depend on Versioning
+
+When you create an object whose `version_id` you need and an `aws_s3_bucket_versioning` resource in the same configuration, you are more likely to have success by ensuring the `s3_object` depends either implicitly (see below) or explicitly (i.e., using `depends_on = [aws_s3_bucket_versioning.example]`) on the `aws_s3_bucket_versioning` resource.
+
+~> **NOTE:** For critical and/or production S3 objects, do not create a bucket, enable versioning, and create an object in the bucket within the same configuration. Doing so will not allow the AWS-recommended 15 minutes between enabling versioning and writing to the bucket.
+
+This example shows the `aws_s3_object.example` depending implicitly on the versioning resource through the reference to `aws_s3_bucket_versioning.example.bucket` to define `bucket`:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_versioning import S3BucketVersioningA
+from imports.aws.s3_object import S3Object
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = S3Bucket(self, "example",
+            bucket="yotto"
+        )
+        aws_s3_bucket_versioning_example = S3BucketVersioningA(self, "example_1",
+            bucket=example.id,
+            versioning_configuration=S3BucketVersioningVersioningConfiguration(
+                status="Enabled"
+            )
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_versioning_example.override_logical_id("example")
+        aws_s3_object_example = S3Object(self, "example_2",
+            bucket=Token.as_string(aws_s3_bucket_versioning_example.id),
+            key="droeloe",
+            source="example.txt"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_object_example.override_logical_id("example")
+```
+
+### `website`, `website_domain`, and `website_endpoint` Arguments
+
+Switch your Terraform configuration to the [`aws_s3_bucket_website_configuration` resource](/docs/providers/aws/r/s3_bucket_website_configuration.html) instead.
+
+For example, given this previous configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        S3Bucket(self, "example",
+            bucket="yournamehere",
+            website=S3BucketWebsite(
+                error_document="error.html",
+                index_document="index.html"
+            )
+        )
+```
+
+You will get the following error after upgrading:
+
+```
+│ Error: Value for unconfigurable attribute
+│
+│   with aws_s3_bucket.example,
+│   on main.tf line 1, in resource "aws_s3_bucket" "example":
+│    1: resource "aws_s3_bucket" "example" {
+│
+│ Can't configure a value for "website": its value will be decided automatically based on the result of applying this configuration.
+```
+
+Since `website` is now read only, update your configuration to use the `aws_s3_bucket_website_configuration`
+resource and remove `website` and its nested arguments in the `aws_s3_bucket` resource:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_website_configuration import S3BucketWebsiteConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = S3Bucket(self, "example",
+            bucket="yournamehere"
+        )
+        aws_s3_bucket_website_configuration_example =
+        S3BucketWebsiteConfiguration(self, "example_1",
+            bucket=example.id,
+            error_document=S3BucketWebsiteConfigurationErrorDocument(
+                key="error.html"
+            ),
+            index_document=S3BucketWebsiteConfigurationIndexDocument(
+                suffix="index.html"
+            )
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_website_configuration_example.override_logical_id("example")
+```
+
+Run `terraform import` on each new resource, _e.g._,
+
+```console
+$ terraform import aws_s3_bucket_website_configuration.example yournamehere
+aws_s3_bucket_website_configuration.example: Importing from ID "yournamehere"...
+aws_s3_bucket_website_configuration.example: Import prepared!
+  Prepared aws_s3_bucket_website_configuration for import
+aws_s3_bucket_website_configuration.example: Refreshing state... [id=yournamehere]
+
+Import successful!
+
+The resources that were imported are shown above. These resources are now in
+your Terraform state and will henceforth be managed by Terraform.
+```
+
+For example, if you use the `aws_s3_bucket` attribute `website_domain` with `aws_route53_record`, as shown below, you will need to update your configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.route53_record import Route53Record
+from imports.aws.route53_zone import Route53Zone
+from imports.aws.s3_bucket import S3Bucket
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        main = Route53Zone(self, "main",
+            name="domain.test"
+        )
+        website = S3Bucket(self, "website",
+            website=S3BucketWebsite(
+                error_document="error.html",
+                index_document="index.html"
+            )
+        )
+        Route53Record(self, "alias",
+            alias=Route53RecordAlias(
+                evaluate_target_health=True,
+                name=website.website_domain,
+                zone_id=website.hosted_zone_id
+            ),
+            name="www",
+            type="A",
+            zone_id=main.zone_id
+        )
+```
+
+Instead, you will now use the `aws_s3_bucket_website_configuration` resource and its `website_domain` attribute:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.route53_record import Route53Record
+from imports.aws.route53_zone import Route53Zone
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_website_configuration import S3BucketWebsiteConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        main = Route53Zone(self, "main",
+            name="domain.test"
+        )
+        website = S3Bucket(self, "website")
+        example = S3BucketWebsiteConfiguration(self, "example",
+            bucket=website.id,
+            index_document=S3BucketWebsiteConfigurationIndexDocument(
+                suffix="index.html"
+            )
+        )
+        Route53Record(self, "alias",
+            alias=Route53RecordAlias(
+                evaluate_target_health=True,
+                name=example.website_domain,
+                zone_id=website.hosted_zone_id
+            ),
+            name="www",
+            type="A",
+            zone_id=main.zone_id
+        )
+```
+
+## Full Resource Lifecycle of Default Resources
+
+Default subnets and vpcs can now do full resource lifecycle operations such that resource
+creation and deletion are now supported.
+
+### Resource: aws_default_subnet
+
+The `aws_default_subnet` resource behaves differently from normal resources in that if a default subnet exists in the specified Availability Zone, Terraform does not _create_ this resource, but instead "adopts" it into management.
+If no default subnet exists, Terraform creates a new default subnet.
+By default, `terraform destroy` does not delete the default subnet but does remove the resource from Terraform state.
+Set the `force_destroy` argument to `true` to delete the default subnet.
+
+For example, given this previous configuration with no existing default subnet:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.default_subnet import DefaultSubnet
+from imports.aws.provider import AwsProvider
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, availabilityZone):
+        super().__init__(scope, name)
+        AwsProvider(self, "aws",
+            region="eu-west-2"
+        )
+        DefaultSubnet(self, "default",
+            availability_zone=availability_zone
+        )
+```
+
+The following error was thrown on `terraform apply`:
+
+```
+│ Error: Default subnet not found.
+│
+│   with aws_default_subnet.default,
+│   on main.tf line 5, in resource "aws_default_subnet" "default":
+│    5: resource "aws_default_subnet" "default" {}
+```
+
+Now after upgrading, the above configuration will apply successfully.
+
+To delete the default subnet, the above configuration should be updated as follows:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.default_subnet import DefaultSubnet
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, availabilityZone):
+        super().__init__(scope, name)
+        DefaultSubnet(self, "default",
+            force_destroy=True,
+            availability_zone=availability_zone
+        )
+```
+
+### Resource: aws_default_vpc
+
+The `aws_default_vpc` resource behaves differently from normal resources in that if a default VPC exists, Terraform does not _create_ this resource, but instead "adopts" it into management.
+If no default VPC exists, Terraform creates a new default VPC, which leads to the implicit creation of [other resources](https://docs.aws.amazon.com/vpc/latest/userguide/default-vpc.html#default-vpc-components).
+By default, `terraform destroy` does not delete the default VPC but does remove the resource from Terraform state.
+Set the `force_destroy` argument to `true` to delete the default VPC.
+
+For example, given this previous configuration with no existing default VPC:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.default_vpc import DefaultVpc
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DefaultVpc(self, "default")
+```
+
+The following error was thrown on `terraform apply`:
+
+```
+│ Error: No default VPC found in this region.
+│
+│   with aws_default_vpc.default,
+│   on main.tf line 5, in resource "aws_default_vpc" "default":
+│    5: resource "aws_default_vpc" "default" {}
+```
+
+Now after upgrading, the above configuration will apply successfully.
+
+To delete the default VPC, the above configuration should be updated to:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.default_vpc import DefaultVpc
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DefaultVpc(self, "default",
+            force_destroy=True
+        )
+```
+
+## Plural Data Source Behavior
+
+The following plural data sources are now consistent with [Provider Design](https://hashicorp.github.io/terraform-provider-aws/provider-design/#plural-data-sources)
+such that they no longer return an error if zero results are found.
+
+* [aws_cognito_user_pools](/docs/providers/aws/d/cognito_user_pools.html)
+* [aws_db_event_categories](/docs/providers/aws/d/db_event_categories.html)
+* [aws_ebs_volumes](/docs/providers/aws/d/ebs_volumes.html)
+* [aws_ec2_coip_pools](/docs/providers/aws/d/ec2_coip_pools.html)
+* [aws_ec2_local_gateway_route_tables](/docs/providers/aws/d/ec2_local_gateway_route_tables.html)
+* [aws_ec2_local_gateway_virtual_interface_groups](/docs/providers/aws/d/ec2_local_gateway_virtual_interface_groups.html)
+* [aws_ec2_local_gateways](/docs/providers/aws/d/ec2_local_gateways.html)
+* [aws_ec2_transit_gateway_route_tables](/docs/providers/aws/d/ec2_transit_gateway_route_tables.html)
+* [aws_efs_access_points](/docs/providers/aws/d/efs_access_points.html)
+* [aws_emr_release_labels](/docs/providers/aws/d/emr_release_labels.html)
+* [aws_inspector_rules_packages](/docs/providers/aws/d/inspector_rules_packages.html)
+* [aws_ip_ranges](/docs/providers/aws/d/ip_ranges.html)
+* [aws_network_acls](/docs/providers/aws/d/network_acls.html)
+* [aws_route_tables](/docs/providers/aws/d/route_tables.html)
+* [aws_security_groups](/docs/providers/aws/d/security_groups.html)
+* [aws_ssoadmin_instances](/docs/providers/aws/d/ssoadmin_instances.html)
+* [aws_vpcs](/docs/providers/aws/d/vpcs.html)
+* [aws_vpc_peering_connections](/docs/providers/aws/d/vpc_peering_connections.html)
+
+## Empty Strings Not Valid For Certain Resources
+
+First, this is a breaking change but should affect very few configurations.
+
+Second, the motivation behind this change is that previously, you might set an argument to `""` to explicitly convey it is empty. However, with the introduction of `null` in Terraform 0.12 and to prepare for continuing enhancements that distinguish between unset arguments and those that have a value, including an empty string (`""`), we are moving away from this use of zero values. We ask practitioners to either use `null` instead or remove the arguments that are set to `""`.
+
+### Resource: aws_cloudwatch_event_target (Empty String)
+
+Previously, you could set `ecs_target.0.launch_type` to `""`. However, the value `""` is no longer valid. Now, set the argument to `null` (_e.g._, `launch_type = null`) or remove the empty-string configuration.
+
+For example, this type of configuration is now not valid:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudwatch_event_target import CloudwatchEventTarget
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, arn, rule):
+        super().__init__(scope, name)
+        CloudwatchEventTarget(self, "example",
+            ecs_target=CloudwatchEventTargetEcsTarget(
+                launch_type="",
+                task_count=1,
+                task_definition_arn=task.arn
+            ),
+            arn=arn,
+            rule=rule
+        )
+```
+
+We fix this configuration by setting `launch_type` to `null`:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudwatch_event_target import CloudwatchEventTarget
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, arn, rule):
+        super().__init__(scope, name)
+        CloudwatchEventTarget(self, "example",
+            ecs_target=CloudwatchEventTargetEcsTarget(
+                launch_type=[null],
+                task_count=1,
+                task_definition_arn=task.arn
+            ),
+            arn=arn,
+            rule=rule
+        )
+```
+
+### Resource: aws_customer_gateway
+
+Previously, you could set `ip_address` to `""`, which would result in an AWS error. However, the provider now also gives an error.
+
+### Resource: aws_default_network_acl
+
+Previously, you could set `egress.*.cidr_block`, `egress.*.ipv6_cidr_block`, `ingress.*.cidr_block`, or `ingress.*.ipv6_cidr_block` to `""`. However, the value `""` is no longer valid. Now, set the argument to `null` (_e.g._, `ipv6_cidr_block = null`) or remove the empty-string configuration.
+
+For example, this type of configuration is now not valid:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.default_network_acl import DefaultNetworkAcl
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, action, fromPort, protocol, ruleNo, toPort, defaultNetworkAclId):
+        super().__init__(scope, name)
+        DefaultNetworkAcl(self, "example",
+            egress=[DefaultNetworkAclEgress(
+                cidr_block="0.0.0.0/0",
+                ipv6_cidr_block="",
+                action=action,
+                from_port=from_port,
+                protocol=protocol,
+                rule_no=rule_no,
+                to_port=to_port
+            )
+            ],
+            default_network_acl_id=default_network_acl_id
+        )
+```
+
+To fix this configuration, we remove the empty-string configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.default_network_acl import DefaultNetworkAcl
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, action, fromPort, protocol, ruleNo, toPort, defaultNetworkAclId):
+        super().__init__(scope, name)
+        DefaultNetworkAcl(self, "example",
+            egress=[DefaultNetworkAclEgress(
+                cidr_block="0.0.0.0/0",
+                action=action,
+                from_port=from_port,
+                protocol=protocol,
+                rule_no=rule_no,
+                to_port=to_port
+            )
+            ],
+            default_network_acl_id=default_network_acl_id
+        )
+```
+
+### Resource: aws_default_route_table
+
+Previously, you could set `route.*.cidr_block` or `route.*.ipv6_cidr_block` to `""`. However, the value `""` is no longer valid. Now, set the argument to `null` (_e.g._, `ipv6_cidr_block = null`) or remove the empty-string configuration.
+
+For example, this type of configuration is now not valid:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import conditional, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.default_route_table import DefaultRouteTable
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, defaultRouteTableId):
+        super().__init__(scope, name)
+        DefaultRouteTable(self, "example",
+            route=[DefaultRouteTableRoute(
+                cidr_block=Token.as_string(conditional(ipv6, "", destination)),
+                ipv6_cidr_block=Token.as_string(conditional(ipv6, destination_ipv6, ""))
+            )
+            ],
+            default_route_table_id=default_route_table_id
+        )
+```
+
+We fix this configuration by using `null` instead of an empty string (`""`):
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import conditional, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.default_route_table import DefaultRouteTable
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, defaultRouteTableId):
+        super().__init__(scope, name)
+        DefaultRouteTable(self, "example",
+            route=[DefaultRouteTableRoute(
+                cidr_block=Token.as_string(conditional(ipv6, "null", destination)),
+                ipv6_cidr_block=Token.as_string(
+                    conditional(ipv6, destination_ipv6, "null"))
+            )
+            ],
+            default_route_table_id=default_route_table_id
+        )
+```
+
+### Resource: aws_default_vpc (Empty String)
+
+Previously, you could set `ipv6_cidr_block` to `""`. However, the value `""` is no longer valid. Now, set the argument to `null` (_e.g._, `ipv6_cidr_block = null`) or remove the empty-string configuration.
+
+### Resource: aws_instance
+
+Previously, you could set `private_ip` to `""`. However, the value `""` is no longer valid. Now, set the argument to `null` (_e.g._, `private_ip = null`) or remove the empty-string configuration.
+
+For example, this type of configuration is now not valid:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.instance import Instance
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Instance(self, "example",
+            instance_type="t2.micro",
+            private_ip=""
+        )
+```
+
+We fix this configuration by removing the empty-string configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.instance import Instance
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Instance(self, "example",
+            instance_type="t2.micro"
+        )
+```
+
+### Resource: aws_efs_mount_target
+
+Previously, you could set `ip_address` to `""`. However, the value `""` is no longer valid. Now, set the argument to `null` (_e.g._, `ip_address = null`) or remove the empty-string configuration.
+
+For example, this type of configuration is now not valid: `ip_address = ""`.
+
+### Resource: aws_elasticsearch_domain
+
+Previously, you could set `ebs_options.0.volume_type` to `""`. However, the value `""` is no longer valid. Now, set the argument to `null` (_e.g._, `volume_type = null`) or remove the empty-string configuration.
+
+For example, this type of configuration is now not valid:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Op, conditional, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.elasticsearch_domain import ElasticsearchDomain
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, domainName):
+        super().__init__(scope, name)
+        ElasticsearchDomain(self, "example",
+            ebs_options=ElasticsearchDomainEbsOptions(
+                ebs_enabled=True,
+                volume_size=volume_size.number_value,
+                volume_type=Token.as_string(
+                    conditional(Op.gt(volume_size.value, 0), volume_type, ""))
+            ),
+            domain_name=domain_name
+        )
+```
+
+We fix this configuration by using `null` instead of `""`:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Op, conditional, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.elasticsearch_domain import ElasticsearchDomain
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, domainName):
+        super().__init__(scope, name)
+        ElasticsearchDomain(self, "example",
+            ebs_options=ElasticsearchDomainEbsOptions(
+                ebs_enabled=True,
+                volume_size=volume_size.number_value,
+                volume_type=Token.as_string(
+                    conditional(Op.gt(volume_size.value, 0), volume_type, "null"))
+            ),
+            domain_name=domain_name
+        )
+```
+
+### Resource: aws_network_acl
+
+Previously, `egress.*.cidr_block`, `egress.*.ipv6_cidr_block`, `ingress.*.cidr_block`, and `ingress.*.ipv6_cidr_block` could be set to `""`. However, the value `""` is no longer valid. Now, set the argument to `null` (_e.g._, `ipv6_cidr_block = null`) or remove the empty-string configuration.
+
+For example, this type of configuration is now not valid:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.network_acl import NetworkAcl
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, vpcId):
+        super().__init__(scope, name)
+        NetworkAcl(self, "example",
+            egress=[NetworkAclEgress(
+                cidr_block="0.0.0.0/0",
+                ipv6_cidr_block=""
+            )
+            ],
+            vpc_id=vpc_id
+        )
+```
+
+We fix this configuration by removing the empty-string configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.network_acl import NetworkAcl
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, vpcId):
+        super().__init__(scope, name)
+        NetworkAcl(self, "example",
+            egress=[NetworkAclEgress(
+                cidr_block="0.0.0.0/0"
+            )
+            ],
+            vpc_id=vpc_id
+        )
+```
+
+### Resource: aws_route
+
+Previously, `destination_cidr_block` and `destination_ipv6_cidr_block` could be set to `""`. However, the value `""` is no longer valid. Now, set the argument to `null` (_e.g._, `destination_ipv6_cidr_block = null`) or remove the empty-string configuration.
+
+In addition, now exactly one of `destination_cidr_block`, `destination_ipv6_cidr_block`, and `destination_prefix_list_id` can be set.
+
+For example, this type of configuration for `aws_route` is now not valid:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import conditional, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.route import Route
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Route(self, "example",
+            destination_cidr_block=Token.as_string(conditional(ipv6, "", destination)),
+            destination_ipv6_cidr_block=Token.as_string(
+                conditional(ipv6, destination_ipv6, "")),
+            gateway_id=Token.as_string(aws_internet_gateway_example.id),
+            route_table_id=Token.as_string(aws_route_table_example.id)
+        )
+```
+
+We fix this configuration by using `null` instead of an empty-string (`""`):
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import conditional, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.route import Route
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Route(self, "example",
+            destination_cidr_block=Token.as_string(
+                conditional(ipv6, "null", destination)),
+            destination_ipv6_cidr_block=Token.as_string(
+                conditional(ipv6, destination_ipv6, "null")),
+            gateway_id=Token.as_string(aws_internet_gateway_example.id),
+            route_table_id=Token.as_string(aws_route_table_example.id)
+        )
+```
+
+### Resource: aws_route_table
+
+Previously, `route.*.cidr_block` and `route.*.ipv6_cidr_block` could be set to `""`. However, the value `""` is no longer valid. Now, set the argument to `null` (_e.g._, `ipv6_cidr_block = null`) or remove the empty-string configuration.
+
+For example, this type of configuration is now not valid:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import conditional, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.route_table import RouteTable
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, vpcId):
+        super().__init__(scope, name)
+        RouteTable(self, "example",
+            route=[RouteTableRoute(
+                cidr_block=Token.as_string(conditional(ipv6, "", destination)),
+                ipv6_cidr_block=Token.as_string(conditional(ipv6, destination_ipv6, ""))
+            )
+            ],
+            vpc_id=vpc_id
+        )
+```
+
+We fix this configuration by usingd `null` instead of an empty-string (`""`):
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import conditional, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.route_table import RouteTable
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, vpcId):
+        super().__init__(scope, name)
+        RouteTable(self, "example",
+            route=[RouteTableRoute(
+                cidr_block=Token.as_string(conditional(ipv6, "null", destination)),
+                ipv6_cidr_block=Token.as_string(
+                    conditional(ipv6, destination_ipv6, "null"))
+            )
+            ],
+            vpc_id=vpc_id
+        )
+```
+
+### Resource: aws_vpc
+
+Previously, `ipv6_cidr_block` could be set to `""`. However, the value `""` is no longer valid. Now, set the argument to `null` (_e.g._, `ipv6_cidr_block = null`) or remove the empty-string configuration.
+
+For example, this type of configuration is now not valid:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.vpc import Vpc
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Vpc(self, "example",
+            cidr_block="10.1.0.0/16",
+            ipv6_cidr_block=""
+        )
+```
+
+We fix this configuration by removing `ipv6_cidr_block`:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.vpc import Vpc
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Vpc(self, "example",
+            cidr_block="10.1.0.0/16"
+        )
+```
+
+### Resource: aws_vpc_ipv6_cidr_block_association
+
+Previously, `ipv6_cidr_block` could be set to `""`. However, the value `""` is no longer valid. Now, set the argument to `null` (_e.g._, `ipv6_cidr_block = null`) or remove the empty-string configuration.
+
+## Data Source: aws_cloudwatch_log_group
+
+### Removal of arn Wildcard Suffix
+
+Previously, the data source returned the ARN directly from the API, which included a `:*` suffix to denote all CloudWatch Log Streams under the CloudWatch Log Group. Most other AWS resources that return ARNs and many other AWS services do not use the `:*` suffix. The suffix is now automatically removed. For example, the data source previously returned an ARN such as `arn:aws:logs:us-east-1:123456789012:log-group:/example:*` but will now return `arn:aws:logs:us-east-1:123456789012:log-group:/example`.
+
+Workarounds, such as using `replace()` as shown below, should be removed:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_cloudwatch_log_group import DataAwsCloudwatchLogGroup
+from imports.aws.datasync_task import DatasyncTask
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, destinationLocationArn, sourceLocationArn):
+        super().__init__(scope, name)
+        example = DataAwsCloudwatchLogGroup(self, "example",
+            name="example"
+        )
+        aws_datasync_task_example = DatasyncTask(self, "example_1",
+            cloudwatch_log_group_arn=Token.as_string(
+                Fn.replace(Token.as_string(example.arn), ":*", "")),
+            destination_location_arn=destination_location_arn,
+            source_location_arn=source_location_arn
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_datasync_task_example.override_logical_id("example")
+```
+
+Removing the `:*` suffix is a breaking change for some configurations. Fix these configurations using string interpolations as demonstrated below. For example, this configuration is now broken:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsIamPolicyDocument(self, "ad-log-policy",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["logs:CreateLogStream", "logs:PutLogEvents"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["ds.amazonaws.com"],
+                    type="Service"
+                )
+                ],
+                resources=[Token.as_string(example.arn)]
+            )
+            ]
+        )
+```
+
+An updated configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataAwsIamPolicyDocument(self, "ad-log-policy",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["logs:CreateLogStream", "logs:PutLogEvents"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["ds.amazonaws.com"],
+                    type="Service"
+                )
+                ],
+                resources=["${" + example.arn + "}:*"]
+            )
+            ]
+        )
+```
+
+## Data Source: aws_subnet_ids
+
+The `aws_subnet_ids` data source has been deprecated and will be removed in a future version. Use the `aws_subnets` data source instead.
+
+For example, change a configuration such as
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformIterator, TerraformOutput, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws. import DataAwsSubnetIds
+from imports.aws.data_aws_subnet import DataAwsSubnet
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = DataAwsSubnetIds(self, "example",
+            vpc_id=vpc_id.value
+        )
+        # In most cases loops should be handled in the programming language context and
+        #     not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+        #     you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+        #     you need to keep this like it is.
+        example_for_each_iterator = TerraformIterator.from_list(
+            Token.as_any(example.ids))
+        data_aws_subnet_example = DataAwsSubnet(self, "example_1",
+            id=Token.as_string(example_for_each_iterator.value),
+            for_each=example_for_each_iterator
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_subnet_example.override_logical_id("example")
+        TerraformOutput(self, "subnet_cidr_blocks",
+            value="${[ for s in ${" + data_aws_subnet_example.fqn + "} : s.cidr_block]}"
+        )
+```
+
+to
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformIterator, TerraformOutput, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_subnet import DataAwsSubnet
+from imports.aws.data_aws_subnets import DataAwsSubnets
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = DataAwsSubnets(self, "example",
+            filter=[DataAwsSubnetsFilter(
+                name="vpc-id",
+                values=[vpc_id.string_value]
+            )
+            ]
+        )
+        # In most cases loops should be handled in the programming language context and
+        #     not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+        #     you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+        #     you need to keep this like it is.
+        example_for_each_iterator = TerraformIterator.from_list(
+            Token.as_any(example.ids))
+        data_aws_subnet_example = DataAwsSubnet(self, "example_1",
+            id=Token.as_string(example_for_each_iterator.value),
+            for_each=example_for_each_iterator
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_subnet_example.override_logical_id("example")
+        TerraformOutput(self, "subnet_cidr_blocks",
+            value="${[ for s in ${" + data_aws_subnet_example.fqn + "} : s.cidr_block]}"
+        )
+```
+
+## Data Source: aws_s3_bucket_object
+
+Version 4.x deprecates the `aws_s3_bucket_object` data source. Maintainers will remove it in a future version. Use `aws_s3_object` instead, where new features and fixes will be added.
+
+## Data Source: aws_s3_bucket_objects
+
+Version 4.x deprecates the `aws_s3_bucket_objects` data source. Maintainers will remove it in a future version. Use `aws_s3_objects` instead, where new features and fixes will be added.
+
+## Resource: aws_batch_compute_environment
+
+You can no longer specify `compute_resources` when `type` is `UNMANAGED`.
+
+Previously, you could apply this configuration and the provider would ignore any compute resources:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.batch_compute_environment import BatchComputeEnvironment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        BatchComputeEnvironment(self, "test",
+            compute_environment_name="test",
+            compute_resources=BatchComputeEnvironmentComputeResources(
+                instance_role=ecs_instance.arn,
+                instance_type=["c4.large"],
+                max_vcpus=16,
+                min_vcpus=0,
+                security_group_ids=[Token.as_string(aws_security_group_test.id)],
+                subnets=[Token.as_string(aws_subnet_test.id)],
+                type="EC2"
+            ),
+            service_role=batch_service.arn,
+            type="UNMANAGED"
+        )
+```
+
+Now, this configuration is invalid and will result in an error during plan.
+
+To resolve this error, simply remove or comment out the `compute_resources` configuration block.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.batch_compute_environment import BatchComputeEnvironment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        BatchComputeEnvironment(self, "test",
+            compute_environment_name="test",
+            service_role=batch_service.arn,
+            type="UNMANAGED"
+        )
+```
+
+## Resource: aws_cloudwatch_event_target
+
+### Removal of `ecs_target` `launch_type` default value
+
+Previously, the provider assigned `ecs_target` `launch_type` the default value of `EC2` if you did not configure a value. However, the provider no longer assigns a default value.
+
+For example, previously you could workaround the default value by using an empty string (`""`), as shown:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudwatch_event_target import CloudwatchEventTarget
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        CloudwatchEventTarget(self, "test",
+            arn=Token.as_string(aws_ecs_cluster_test.id),
+            ecs_target=CloudwatchEventTargetEcsTarget(
+                launch_type="",
+                network_configuration=CloudwatchEventTargetEcsTargetNetworkConfiguration(
+                    subnets=[subnet.id]
+                ),
+                task_count=1,
+                task_definition_arn=task.arn
+            ),
+            role_arn=Token.as_string(aws_iam_role_test.arn),
+            rule=Token.as_string(aws_cloudwatch_event_rule_test.id)
+        )
+```
+
+This is no longer necessary. We fix the configuration by removing the empty string assignment:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudwatch_event_target import CloudwatchEventTarget
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        CloudwatchEventTarget(self, "test",
+            arn=Token.as_string(aws_ecs_cluster_test.id),
+            ecs_target=CloudwatchEventTargetEcsTarget(
+                network_configuration=CloudwatchEventTargetEcsTargetNetworkConfiguration(
+                    subnets=[subnet.id]
+                ),
+                task_count=1,
+                task_definition_arn=task.arn
+            ),
+            role_arn=Token.as_string(aws_iam_role_test.arn),
+            rule=Token.as_string(aws_cloudwatch_event_rule_test.id)
+        )
+```
+
+## Resource: aws_elasticache_cluster
+
+### Error raised if neither `engine` nor `replication_group_id` is specified
+
+Previously, when you did not specify either `engine` or `replication_group_id`, Terraform would not prevent you from applying the invalid configuration.
+Now, this will produce an error similar to the one below:
+
+```
+Error: Invalid combination of arguments
+
+          with aws_elasticache_cluster.example,
+          on terraform_plugin_test.tf line 2, in resource "aws_elasticache_cluster" "example":
+           2: resource "aws_elasticache_cluster" "example" {
+
+        "replication_group_id": one of `engine,replication_group_id` must be
+        specified
+
+        Error: Invalid combination of arguments
+
+          with aws_elasticache_cluster.example,
+          on terraform_plugin_test.tf line 2, in resource "aws_elasticache_cluster" "example":
+           2: resource "aws_elasticache_cluster" "example" {
+
+        "engine": one of `engine,replication_group_id` must be specified
+```
+
+Update your configuration to supply one of `engine` or `replication_group_id`.
+
+## Resource: aws_elasticache_global_replication_group
+
+### actual_engine_version Attribute removal
+
+Switch your Terraform configuration from using `actual_engine_version` to use the `engine_version_actual` attribute instead.
+
+For example, given this previous configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformOutput, TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        TerraformOutput(self, "elasticache_global_replication_group_version_result",
+            value=example.actual_engine_version
+        )
+```
+
+An updated configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformOutput, TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        TerraformOutput(self, "elasticache_global_replication_group_version_result",
+            value=example.engine_version_actual
+        )
+```
+
+## Resource: aws_fsx_ontap_storage_virtual_machine
+
+We removed the misspelled argument `active_directory_configuration.0.self_managed_active_directory_configuration.0.organizational_unit_distinguidshed_name` that we previously deprecated. Use `active_directory_configuration.0.self_managed_active_directory_configuration.0.organizational_unit_distinguished_name` now instead. Terraform will automatically migrate the state to `active_directory_configuration.0.self_managed_active_directory_configuration.0.organizational_unit_distinguished_name` during planning.
+
+## Resource: aws_lb_target_group
+
+For `protocol = "TCP"`, you can no longer set `stickiness.type` to `lb_cookie` even when `enabled = false`. Instead, either change the `protocol` to `"HTTP"` or `"HTTPS"`, or change `stickiness.type` to `"source_ip"`.
+
+For example, this configuration is no longer valid:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.lb_target_group import LbTargetGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        LbTargetGroup(self, "test",
+            port=25,
+            protocol="TCP",
+            stickiness=LbTargetGroupStickiness(
+                enabled=False,
+                type="lb_cookie"
+            ),
+            vpc_id=Token.as_string(aws_vpc_test.id)
+        )
+```
+
+To fix this, we change the `stickiness.type` to `"source_ip"`.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.lb_target_group import LbTargetGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        LbTargetGroup(self, "test",
+            port=25,
+            protocol="TCP",
+            stickiness=LbTargetGroupStickiness(
+                enabled=False,
+                type="source_ip"
+            ),
+            vpc_id=Token.as_string(aws_vpc_test.id)
+        )
+```
+
+## Resource: aws_s3_bucket_object
+
+Version 4.x deprecates the `aws_s3_bucket_object` and maintainers will remove it in a future version. Use `aws_s3_object` instead, where new features and fixes will be added.
+
+When replacing `aws_s3_bucket_object` with `aws_s3_object` in your configuration, on the next apply, Terraform will recreate the object. If you prefer to not have Terraform recreate the object, import the object using `aws_s3_object`.
+
+For example, the following will import an S3 object into state, assuming the configuration exists, as `aws_s3_object.example`:
+
+```console
+% terraform import aws_s3_object.example s3://some-bucket-name/some/key.txt
+```
+
+~> **CAUTION:** We do not recommend modifying the state file manually. If you do, you can make it unusable. However, if you accept that risk, some community members have upgraded to the new resource by searching and replacing `"type": "aws_s3_bucket_object",` with `"type": "aws_s3_object",` in the state file, and then running `terraform apply -refresh-only`.
+
+## EC2-Classic Resource and Data Source Support
+
+While an upgrade to this major version will not directly impact EC2-Classic resources configured with Terraform,
+it is important to keep in the mind the following AWS Provider resources will eventually no longer
+be compatible with EC2-Classic as AWS completes their EC2-Classic networking retirement (expected around August 15, 2022).
+
+* Running or stopped [EC2 instances](/docs/providers/aws/r/instance.html)
+* Running or stopped [RDS database instances](/docs/providers/aws/r/db_instance.html)
+* [Elastic IP addresses](/docs/providers/aws/r/eip.html)
+* [Classic Load Balancers](/docs/providers/aws/r/lb.html)
+* [Redshift clusters](/docs/providers/aws/r/redshift_cluster.html)
+* [Elastic Beanstalk environments](/docs/providers/aws/r/elastic_beanstalk_environment.html)
+* [EMR clusters](/docs/providers/aws/r/emr_cluster.html)
+* [AWS Data Pipelines pipelines](/docs/providers/aws/r/datapipeline_pipeline.html)
+* [ElastiCache clusters](/docs/providers/aws/r/elasticache_cluster.html)
+* [Spot Requests](/docs/providers/aws/r/spot_instance_request.html)
+* [Capacity Reservations](/docs/providers/aws/r/ec2_capacity_reservation.html)
+
+## Macie Classic Resource Support
+
+These resources should be considered deprecated and will be removed in version 5.0.0.
+
+* Macie Member Account Association
+* Macie S3 Bucket Association
+
+<!-- cache-key: cdktf-0.18.0 input-3ef88020b37e35d78babc46d26306cbef9b0d542745d0afa1cec66e81ef43304 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/guides/version-5-upgrade.html.markdown b/website/docs/cdktf/python/guides/version-5-upgrade.html.markdown
new file mode 100644
index 00000000000..046d95dae95
--- /dev/null
+++ b/website/docs/cdktf/python/guides/version-5-upgrade.html.markdown
@@ -0,0 +1,751 @@
+---
+subcategory: ""
+layout: "aws"
+page_title: "Terraform AWS Provider Version 5 Upgrade Guide"
+description: |-
+  Terraform AWS Provider Version 5 Upgrade Guide
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Terraform AWS Provider Version 5 Upgrade Guide
+
+Version 5.0.0 of the AWS provider for Terraform is a major release and includes changes that you need to consider when upgrading. This guide will help with that process and focuses only on changes from version 4.x to version 5.0.0. See the [Version 4 Upgrade Guide](/docs/providers/aws/guides/version-4-upgrade.html) for information on upgrading from 3.x to version 4.0.0.
+
+Upgrade topics:
+
+<!-- TOC depthFrom:2 depthTo:2 -->
+
+- [Provider Version Configuration](#provider-version-configuration)
+- [Provider Arguments](#provider-arguments)
+- [Default Tags](#default-tags)
+- [EC2-Classic Retirement](#ec2-classic-retirement)
+- [Macie Classic Retirement](#macie-classic-retirement)
+- [resource/aws_acmpca_certificate_authority](#resourceaws_acmpca_certificate_authority)
+- [resource/aws_api_gateway_rest_api](#resourceaws_api_gateway_rest_api)
+- [resource/aws_autoscaling_attachment](#resourceaws_autoscaling_attachment)
+- [resource/aws_autoscaling_group](#resourceaws_autoscaling_group)
+- [resource/aws_budgets_budget](#resourceaws_budgets_budget)
+- [resource/aws_ce_anomaly_subscription](#resourceaws_ce_anomaly_subscription)
+- [resource/aws_cloudwatch_event_target](#resourceaws_cloudwatch_event_target)
+- [resource/aws_codebuild_project](#resourceaws_codebuild_project)
+- [resource/aws_connect_hours_of_operation](#resourceaws_connect_hours_of_operation)
+- [resource/aws_connect_queue](#resourceaws_connect_queue)
+- [resource/aws_connect_routing_profile](#resourceaws_connect_routing_profile)
+- [resource/aws_db_event_subscription](#resourceaws_db_event_subscription)
+- [resource/aws_db_instance_role_association](#resourceaws_db_instance_role_association)
+- [resource/aws_db_instance](#resourceaws_db_instance)
+- [resource/aws_db_proxy_target](#resourceaws_db_proxy_target)
+- [resource/aws_db_security_group](#resourceaws_db_security_group)
+- [resource/aws_db_snapshot](#resourceaws_db_snapshot)
+- [resource/aws_default_vpc](#resourceaws_default_vpc)
+- [resource/aws_dms_endpoint](#resourceaws_dms_endpoint)
+- [resource/aws_docdb_cluster](#resourceaws_docdb_cluster)
+- [resource/aws_dx_gateway_association](#resourceaws_dx_gateway_association)
+- [resource/aws_ec2_client_vpn_endpoint](#resourceaws_ec2_client_vpn_endpoint)
+- [resource/aws_ec2_client_vpn_network_association](#resourceaws_ec2_client_vpn_network_association)
+- [resource/aws_ecs_cluster](#resourceaws_ecs_cluster)
+- [resource/aws_eip](#resourceaws_eip)
+- [resource/aws_eip_association](#resourceaws_eip_association)
+- [resource/aws_eks_addon](#resourceaws_eks_addon)
+- [resource/aws_elasticache_cluster](#resourceaws_elasticache_cluster)
+- [resource/aws_elasticache_replication_group](#resourceaws_elasticache_replication_group)
+- [resource/aws_elasticache_security_group](#resourceaws_elasticache_security_group)
+- [resource/aws_flow_log](#resourceaws_flow_log)
+- [resource/aws_guardduty_organization_configuration](#resourceaws_guardduty_organization_configuration)
+- [resource/aws_kinesis_firehose_delivery_stream](#resourceaws_kinesis_firehose_delivery_stream)
+- [resource/aws_launch_configuration](#resourceaws_launch_configuration)
+- [resource/aws_launch_template](#resourceaws_launch_template)
+- [resource/aws_lightsail_instance](#resourceaws_lightsail_instance)
+- [resource/aws_macie_member_account_association](#resourceaws_macie_member_account_association)
+- [resource/aws_macie_s3_bucket_association](#resourceaws_macie_s3_bucket_association)
+- [resource/aws_medialive_multiplex_program](#resourceaws_medialive_multiplex_program)
+- [resource/aws_msk_cluster](#resourceaws_msk_cluster)
+- [resource/aws_neptune_cluster](#resourceaws_neptune_cluster)
+- [resource/aws_networkmanager_core_network](#resourceaws_networkmanager_core_network)
+- [resource/aws_opensearch_domain](#resourceaws_opensearch_domain)
+- [resource/aws_rds_cluster](#resourceaws_rds_cluster)
+- [resource/aws_rds_cluster_instance](#resourceaws_rds_cluster_instance)
+- [resource/aws_redshift_cluster](#resourceaws_redshift_cluster)
+- [resource/aws_redshift_security_group](#resourceaws_redshift_security_group)
+- [resource/aws_route](#resourceaws_route)
+- [resource/aws_route_table](#resourceaws_route_table)
+- [resource/aws_s3_object](#resourceaws_s3_object)
+- [resource/aws_s3_object_copy](#resourceaws_s3_object_copy)
+- [resource/aws_secretsmanager_secret](#resourceaws_secretsmanager_secret)
+- [resource/aws_security_group](#resourceaws_security_group)
+- [resource/aws_security_group_rule](#resourceaws_security_group_rule)
+- [resource/aws_servicecatalog_product](#resourceaws_servicecatalog_product)
+- [resource/aws_ssm_association](#resourceaws_ssm_association)
+- [resource/aws_ssm_parameter](#resourceaws_ssm_parameter)
+- [resource/aws_vpc](#resourceaws_vpc)
+- [resource/aws_vpc_peering_connection](#resourceaws_vpc_peering_connection)
+- [resource/aws_vpc_peering_connection_accepter](#resourceaws_vpc_peering_connection_accepter)
+- [resource/aws_vpc_peering_connection_options](#resourceaws_vpc_peering_connection_options)
+- [resource/aws_wafv2_web_acl](#resourceaws_wafv2_web_acl)
+- [resource/aws_wafv2_web_acl_logging_configuration](#resourceaws_wafv2_web_acl_logging_configuration)
+- [data-source/aws_api_gateway_rest_api](#data-sourceaws_api_gateway_rest_api)
+- [data-source/aws_connect_hours_of_operation](#data-sourceaws_connect_hours_of_operation)
+- [data-source/aws_db_instance](#data-sourceaws_db_instance)
+- [data-source/aws_elasticache_cluster](#data-sourceaws_elasticache_cluster)
+- [data-source/aws_elasticache_replication_group](#data-sourceaws_elasticache_replication_group)
+- [data-source/aws_iam_policy_document](#data-sourceaws_iam_policy_document)
+- [data-source/aws_identitystore_group](#data-sourceaws_identitystore_group)
+- [data-source/aws_identitystore_user](#data-sourceaws_identitystore_user)
+- [data-source/aws_launch_configuration](#data-sourceaws_launch_configuration)
+- [data-source/aws_opensearch_domain](#data-sourceaws_opensearch_domain)
+- [data-source/aws_quicksight_data_set](#data-sourceaws_quicksight_data_set)
+- [data-source/aws_redshift_cluster](#data-sourceaws_redshift_cluster)
+- [data-source/aws_redshift_service_account](#data-sourceaws_redshift_service_account)
+- [data-source/aws_secretsmanager_secret](#data-sourceaws_secretsmanager_secret)
+- [data-source/aws_service_discovery_service](#data-sourceaws_service_discovery_service)
+- [data-source/aws_subnet_ids](#data-sourceaws_subnet_ids)
+- [data-source/aws_vpc_peering_connection](#data-sourceaws_vpc_peering_connection)
+
+<!-- /TOC -->
+
+## Provider Version Configuration
+
+-> Before upgrading to version 5.0.0, upgrade to the most recent 4.X version of the provider and ensure that your environment successfully runs [`terraform plan`](https://www.terraform.io/docs/commands/plan.html). You should not see changes you don't expect or deprecation notices.
+
+Use [version constraints when configuring Terraform providers](https://www.terraform.io/docs/configuration/providers.html#provider-versions). If you are following that recommendation, update the version constraints in your Terraform configuration and run [`terraform init -upgrade`](https://www.terraform.io/docs/commands/init.html) to download the new version.
+
+For example, given this previous configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.provider import AwsProvider
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AwsProvider(self, "aws")
+```
+
+Update to the latest 5.X version:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.provider import AwsProvider
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AwsProvider(self, "aws")
+```
+
+## Provider Arguments
+
+Version 5.0.0 removes these `provider` arguments:
+
+* `assume_role.duration_seconds` - Use `assume_role.duration` instead
+* `assume_role_with_web_identity.duration_seconds` - Use `assume_role_with_web_identity.duration` instead
+* `s3_force_path_style` - Use `s3_use_path_style` instead
+* `shared_credentials_file` - Use `shared_credentials_files` instead
+* `skip_get_ec2_platforms` - Removed following the retirement of EC2-Classic
+
+## Default Tags
+
+The following enhancements are included:
+
+* Duplicate `default_tags` can now be included and will be overwritten by resource `tags`.
+* Zero value tags, `""`, can now be included in both `default_tags` and resource `tags`.
+* Tags can now be `computed`.
+
+## EC2-Classic Retirement
+
+Following the retirement of EC2-Classic, we removed a number of resources, arguments, and attributes. This list summarizes what we _removed_:
+
+* `aws_db_security_group` resource
+* `aws_elasticache_security_group` resource
+* `aws_redshift_security_group` resource
+* [`aws_db_instance`](/docs/providers/aws/r/db_instance.html) resource's `security_group_names` argument
+* [`aws_elasticache_cluster`](/docs/providers/aws/r/elasticache_cluster.html) resource's `security_group_names` argument
+* [`aws_redshift_cluster`](/docs/providers/aws/r/redshift_cluster.html) resource's `cluster_security_groups` argument
+* [`aws_launch_configuration`](/docs/providers/aws/r/launch_configuration.html) resource's `vpc_classic_link_id` and `vpc_classic_link_security_groups` arguments
+* [`aws_vpc`](/docs/providers/aws/r/vpc.html) resource's `enable_classiclink` and `enable_classiclink_dns_support` arguments
+* [`aws_default_vpc`](/docs/providers/aws/r/default_vpc.html) resource's `enable_classiclink` and `enable_classiclink_dns_support` arguments
+* [`aws_vpc_peering_connection`](/docs/providers/aws/r/vpc_peering_connection.html) resource's `allow_classic_link_to_remote_vpc` and `allow_vpc_to_remote_classic_link` arguments
+* [`aws_vpc_peering_connection_accepter`](/docs/providers/aws/r/vpc_peering_connection_accepter.html) resource's `allow_classic_link_to_remote_vpc` and `allow_vpc_to_remote_classic_link` arguments
+* [`aws_vpc_peering_connection_options`](/docs/providers/aws/r/vpc_peering_connection_options.html) resource's `allow_classic_link_to_remote_vpc` and `allow_vpc_to_remote_classic_link` arguments
+* [`aws_db_instance`](/docs/providers/aws/d/db_instance.html) data source's `db_security_groups` attribute
+* [`aws_elasticache_cluster`](/docs/providers/aws/d/elasticache_cluster.html) data source's `security_group_names` attribute
+* [`aws_redshift_cluster`](/docs/providers/aws/d/redshift_cluster.html) data source's `cluster_security_groups` attribute
+* [`aws_launch_configuration`](/docs/providers/aws/d/launch_configuration.html) data source's `vpc_classic_link_id` and `vpc_classic_link_security_groups` attributes
+
+## Macie Classic Retirement
+
+Following the retirement of Amazon Macie Classic, we removed these resources:
+
+* `aws_macie_member_account_association`
+* `aws_macie_s3_bucket_association`
+
+## resource/aws_acmpca_certificate_authority
+
+Remove `status` from configurations as it no longer exists.
+
+## resource/aws_api_gateway_rest_api
+
+The `minimum_compression_size` attribute is now a String type, allowing it to be computed when set via the `body` attribute. Valid values remain the same.
+
+## resource/aws_autoscaling_attachment
+
+Change `alb_target_group_arn`, which no longer exists, to `lb_target_group_arn` in configurations.
+
+## resource/aws_autoscaling_group
+
+Remove `tags` from configurations as it no longer exists. Use the `tag` attribute instead. For use cases requiring dynamic tags, see the [Dynamic Tagging example](../r/autoscaling_group.html.markdown#dynamic-tagging).
+
+## resource/aws_budgets_budget
+
+Remove `cost_filters` from configurations as it no longer exists.
+
+## resource/aws_ce_anomaly_subscription
+
+Remove `threshold` from configurations as it no longer exists.
+
+## resource/aws_cloudwatch_event_target
+
+The `ecs_target.propagate_tags` attribute now has no default value. If no value is specified, the tags are not propagated.
+
+## resource/aws_codebuild_project
+
+Remove `secondary_sources.auth` and `source.auth` from configurations as they no longer exist.
+
+## resource/aws_connect_hours_of_operation
+
+Remove `hours_of_operation_arn` from configurations as it no longer exists.
+
+## resource/aws_connect_queue
+
+Remove `quick_connect_ids_associated` from configurations as it no longer exists.
+
+## resource/aws_connect_routing_profile
+
+Remove `queue_configs_associated` from configurations as it no longer exists.
+
+## resource/aws_db_event_subscription
+
+Configurations that define `source_ids` using the `id` attribute of `aws_db_instance` must be updated to use `identifier` instead. For example, `source_ids = [aws_db_instance.example.id]` must be updated to `source_ids = [aws_db_instance.example.identifier]`.
+
+## resource/aws_db_instance
+
+`aws_db_instance` has had a number of changes:
+
+1. [`id` is no longer the identifier](#aws_db_instanceid-is-no-longer-the-identifier)
+2. [Use `db_name` instead of `name`](#use-db_name-instead-of-name)
+3. [Remove `db_security_groups`](#remove-db_security_groups)
+
+### aws_db_instance.id is no longer the identifier
+
+**What `id` _is_ has changed and can have far-reaching consequences.** Fortunately, fixing configurations is straightforward.
+
+`id` is _now_ the DBI Resource ID (_i.e._, `dbi-resource-id`), an immutable "identifier" for an instance. `id` is now the same as the `resource_id`. (We recommend using `resource_id` rather than `id` when you need to refer to the DBI Resource ID.) _Previously_, `id` was the DB Identifier. Now when you need to refer to the _DB Identifier_, use `identifier`.
+
+Fixing configurations involves changing any `id` references to `identifier`, where the reference expects the DB Identifier. For example, if you're replicating an `aws_db_instance`, you can no longer use `id` to define the `replicate_source_db`.
+
+This configuration will now result in an error since `replicate_source_db` expects a _DB Identifier_:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.db_instance import DbInstance
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, instanceClass):
+        super().__init__(scope, name)
+        DbInstance(self, "test",
+            replicate_source_db=source.id,
+            instance_class=instance_class
+        )
+```
+
+You can fix the configuration like this:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.db_instance import DbInstance
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, instanceClass):
+        super().__init__(scope, name)
+        DbInstance(self, "test",
+            replicate_source_db=source.identifier,
+            instance_class=instance_class
+        )
+```
+
+### Use `db_name` instead of `name`
+
+Change `name` to `db_name` in configurations as `name` no longer exists.
+
+### Remove `db_security_groups`
+
+Remove `db_security_groups` from configurations as it no longer exists. We removed it as part of the EC2-Classic retirement.
+
+## resource/aws_db_instance_role_association
+
+Configurations that define `db_instance_identifier` using the `id` attribute of `aws_db_instance` must be updated to use `identifier` instead. For example, `db_instance_identifier = aws_db_instance.example.id` must be updated to `db_instance_identifier = aws_db_instance.example.identifier`.
+
+## resource/aws_db_proxy_target
+
+Configurations that define `db_instance_identifier` using the `id` attribute of `aws_db_instance` must be updated to use `identifier` instead. For example, `db_instance_identifier = aws_db_instance.example.id` must be updated to `db_instance_identifier = aws_db_instance.example.identifier`.
+
+## resource/aws_db_security_group
+
+We removed this resource as part of the EC2-Classic retirement.
+
+## resource/aws_db_snapshot
+
+Configurations that define `db_instance_identifier` using the `id` attribute of `aws_db_instance` must be updated to use `identifier` instead. For example, `db_instance_identifier = aws_db_instance.example.id` must be updated to `db_instance_identifier = aws_db_instance.example.identifier`.
+
+## resource/aws_default_vpc
+
+Remove `enable_classiclink` and `enable_classiclink_dns_support` from configurations as they no longer exist. They were part of the EC2-Classic retirement.
+
+## resource/aws_dms_endpoint
+
+Remove `s3_settings.ignore_headers_row` from configurations as it no longer exists. **Be careful to not confuse `ignore_headers_row`, which no longer exists, with `ignore_header_rows`, which still exists.**
+
+## resource/aws_docdb_cluster
+
+Changes to the `snapshot_identifier` attribute will now correctly force re-creation of the resource. Previously, changing this attribute would result in a successful apply, but without the cluster being restored (only the resource state was changed). This change brings behavior of the cluster `snapshot_identifier` attribute into alignment with other RDS resources, such as `aws_db_instance`.
+
+Automated snapshots **should not** be used for this attribute, unless from a different cluster. Automated snapshots are deleted as part of cluster destruction when the resource is replaced.
+
+## resource/aws_dx_gateway_association
+
+The `vpn_gateway_id` attribute has been deprecated. All configurations using `vpn_gateway_id` should be updated to use the `associated_gateway_id` attribute instead.
+
+## resource/aws_ec2_client_vpn_endpoint
+
+Remove `status` from configurations as it no longer exists.
+
+## resource/aws_ec2_client_vpn_network_association
+
+Remove `security_groups` and `status` from configurations as they no longer exist.
+
+## resource/aws_ecs_cluster
+
+Remove `capacity_providers` and `default_capacity_provider_strategy` from configurations as they no longer exist.
+
+## resource/aws_eip
+
+* With the retirement of EC2-Classic, the `standard` domain is no longer supported.
+* The `vpc` argument has been deprecated. Use `domain` argument instead.
+
+## resource/aws_eip_association
+
+With the retirement of EC2-Classic, the `standard` domain is no longer supported.
+
+## resource/aws_eks_addon
+
+The `resolve_conflicts` argument has been deprecated. Use the `resolve_conflicts_on_create` and/or `resolve_conflicts_on_update` arguments instead.
+
+## resource/aws_elasticache_cluster
+
+Remove `security_group_names` from configurations as it no longer exists. We removed it as part of the EC2-Classic retirement.
+
+## resource/aws_elasticache_replication_group
+
+* Remove the `cluster_mode` configuration block. Use top-level `num_node_groups` and `replicas_per_node_group` instead.
+* Remove `availability_zones`, `number_cache_clusters`, `replication_group_description` arguments from configurations as they no longer exist.  Use `preferred_cache_cluster_azs`, `num_cache_clusters`, and `description`, respectively, instead.
+
+## resource/aws_elasticache_security_group
+
+We removed this resource as part of the EC2-Classic retirement.
+
+## resource/aws_flow_log
+
+The `log_group_name` attribute has been deprecated. All configurations using `log_group_name` should be updated to use the `log_destination` attribute instead.
+
+## resource/aws_guardduty_organization_configuration
+
+The `auto_enable` argument has been deprecated. Use the `auto_enable_organization_members` argument instead.
+
+## resource/aws_kinesis_firehose_delivery_stream
+
+* Remove the `s3_configuration` attribute from the root of the resource. `s3_configuration` is now a part of the following blocks: `elasticsearch_configuration`, `opensearch_configuration`, `redshift_configuration`, `splunk_configuration`, and `http_endpoint_configuration`.
+* Remove `s3` as an option for `destination`. Use `extended_s3` instead
+* Rename `extended_s3_configuration.0.s3_backup_configuration.0.buffer_size` and `extended_s3_configuration.0.s3_backup_configuration.0.buffer_interval` to `extended_s3_configuration.0.s3_backup_configuration.0.buffering_size` and `extended_s3_configuration.0.s3_backup_configuration.0.buffering_interval`, respectively.
+* Rename `redshift_configuration.0.s3_backup_configuration.0.buffer_size` and `redshift_configuration.0.s3_backup_configuration.0.buffer_interval` to `redshift_configuration.0.s3_backup_configuration.0.buffering_size` and `redshift_configuration.0.s3_backup_configuration.0.buffering_interval`, respectively.
+* Rename `s3_configuration.0.buffer_size` and `s3_configuration.0.buffer_interval` to `s3_configuration.0.buffering_size` and `s3_configuration.0.buffering_interval`, respectively.
+
+## resource/aws_launch_configuration
+
+Remove `vpc_classic_link_id` and `vpc_classic_link_security_groups` from configurations as they no longer exist. We removed them as part of the EC2-Classic retirement.
+
+## resource/aws_launch_template
+
+We removed defaults from `metatadata_options`. Launch template metadata options will now default to unset values, which is the AWS default behavior.
+
+## resource/aws_lightsail_instance
+
+Remove `ipv6_address` from configurations as it no longer exists.
+
+## resource/aws_macie_member_account_association
+
+We removed this resource as part of the Macie Classic retirement.
+
+## resource/aws_macie_s3_bucket_association
+
+We removed this resource as part of the Macie Classic retirement.
+
+## resource/aws_medialive_multiplex_program
+
+Change `statemux_settings`, which no longer exists, to `statmux_settings` in configurations.
+
+## resource/aws_msk_cluster
+
+Remove `broker_node_group_info.ebs_volume_size` from configurations as it no longer exists.
+
+## resource/aws_neptune_cluster
+
+Changes to the `snapshot_identifier` attribute will now correctly force re-creation of the resource. Previously, changing this attribute would result in a successful apply, but without the cluster being restored (only the resource state was changed). This change brings behavior of the cluster `snapshot_identifier` attribute into alignment with other RDS resources, such as `aws_db_instance`.
+
+Automated snapshots **should not** be used for this attribute, unless from a different cluster. Automated snapshots are deleted as part of cluster destruction when the resource is replaced.
+
+## resource/aws_networkmanager_core_network
+
+Remove `policy_document` from configurations as it no longer exists. Use the `aws_networkmanager_core_network_policy_attachment` resource instead.
+
+## resource/aws_opensearch_domain
+
+* The `kibana_endpoint` attribute has been deprecated. All configurations using `kibana_endpoint` should be updated to use the `dashboard_endpoint` attribute instead.
+* The `engine_version` attribute no longer has a default value. Omitting this attribute will now create a domain with the latest OpenSearch version, consistent with the behavior of the AWS API.
+
+## resource/aws_rds_cluster
+
+* Update configurations to always include `engine` since it is now required and has no default. Previously, not including `engine` was equivalent to `engine = "aurora"` and created a MySQL-5.6-compatible cluster.
+* Changes to the `snapshot_identifier` attribute will now correctly force re-creation of the resource. Previously, changing this attribute would result in a successful apply, but without the cluster being restored (only the resource state was changed). This change brings behavior of the cluster `snapshot_identifier` attribute into alignment with other RDS resources, such as `aws_db_instance`. **NOTE:** Automated snapshots **should not** be used for this attribute, unless from a different cluster. Automated snapshots are deleted as part of cluster destruction when the resource is replaced.
+
+## resource/aws_rds_cluster_instance
+
+Update configurations to always include `engine` since it is now required and has no default. Previously, not including `engine` was equivalent to `engine = "aurora"` and created a MySQL-5.6-compatible cluster.
+
+## resource/aws_redshift_cluster
+
+Remove `cluster_security_groups` from configurations as it no longer exists. We removed it as part of the EC2-Classic retirement.
+
+## resource/aws_redshift_security_group
+
+We removed this resource as part of the EC2-Classic retirement.
+
+## resource/aws_route
+
+Update configurations to use `network_interface_id` rather than `instance_id`, which no longer exists.
+
+For example, this configuration is _no longer valid_:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.route import Route
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, routeTableId):
+        super().__init__(scope, name)
+        Route(self, "example",
+            instance_id=Token.as_string(aws_instance_example.id),
+            route_table_id=route_table_id
+        )
+```
+
+One possible way to fix this configuration involves referring to the `primary_network_interface_id` of an instance:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.route import Route
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, routeTableId):
+        super().__init__(scope, name)
+        Route(self, "example",
+            network_interface_id=Token.as_string(aws_instance_example.primary_network_interface_id),
+            route_table_id=route_table_id
+        )
+```
+
+Another fix is to use an ENI:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.instance import Instance
+from imports.aws.network_interface import NetworkInterface
+from imports.aws.route import Route
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, subnetId, deviceIndex, routeTableId):
+        super().__init__(scope, name)
+        example = NetworkInterface(self, "example",
+            subnet_id=subnet_id
+        )
+        aws_instance_example = Instance(self, "example_1",
+            network_interface=[InstanceNetworkInterface(
+                network_interface_id=example.id,
+                device_index=device_index
+            )
+            ]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_instance_example.override_logical_id("example")
+        aws_route_example = Route(self, "example_2",
+            depends_on=[aws_instance_example],
+            network_interface_id=example.id,
+            route_table_id=route_table_id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_route_example.override_logical_id("example")
+```
+
+## resource/aws_route_table
+
+Update configurations to use `route.*.network_interface_id` rather than `route.*.instance_id`, which no longer exists.
+
+For example, this configuration is _no longer valid_:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.route_table import RouteTable
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, vpcId):
+        super().__init__(scope, name)
+        RouteTable(self, "example",
+            route=[RouteTableRoute(
+                instance_id=aws_instance_example.id
+            )
+            ],
+            vpc_id=vpc_id
+        )
+```
+
+One possible way to fix this configuration involves referring to the `primary_network_interface_id` of an instance:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.route_table import RouteTable
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, vpcId):
+        super().__init__(scope, name)
+        RouteTable(self, "example",
+            route=[RouteTableRoute(
+                network_interface_id=Token.as_string(aws_instance_example.primary_network_interface_id)
+            )
+            ],
+            vpc_id=vpc_id
+        )
+```
+
+Another fix is to use an ENI:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.instance import Instance
+from imports.aws.network_interface import NetworkInterface
+from imports.aws.route_table import RouteTable
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, subnetId, deviceIndex, vpcId):
+        super().__init__(scope, name)
+        example = NetworkInterface(self, "example",
+            subnet_id=subnet_id
+        )
+        aws_instance_example = Instance(self, "example_1",
+            network_interface=[InstanceNetworkInterface(
+                network_interface_id=example.id,
+                device_index=device_index
+            )
+            ]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_instance_example.override_logical_id("example")
+        aws_route_table_example = RouteTable(self, "example_2",
+            depends_on=[aws_instance_example],
+            route=[RouteTableRoute(
+                network_interface_id=example.id
+            )
+            ],
+            vpc_id=vpc_id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_route_table_example.override_logical_id("example")
+```
+
+## resource/aws_s3_object
+
+The `acl` attribute no longer has a default value. Previously this was set to `private` when omitted. Objects requiring a private ACL should now explicitly set this attribute.
+
+## resource/aws_s3_object_copy
+
+The `acl` attribute no longer has a default value. Previously this was set to `private` when omitted. Object copies requiring a private ACL should now explicitly set this attribute.
+
+## resource/aws_secretsmanager_secret
+
+Remove `rotation_enabled`, `rotation_lambda_arn` and `rotation_rules` from configurations as they no longer exist.
+
+## resource/aws_security_group
+
+With the retirement of EC2-Classic, non-VPC security groups are no longer supported.
+
+## resource/aws_security_group_rule
+
+With the retirement of EC2-Classic, non-VPC security groups are no longer supported.
+
+## resource/aws_servicecatalog_product
+
+Changes to any `provisioning_artifact_parameters` arguments now properly trigger a replacement. This fixes incorrect behavior, but may technically be breaking for configurations expecting non-functional in-place updates.
+
+## resource/aws_ssm_association
+
+The `instance_id` attribute has been deprecated. All configurations using `instance_id` should be updated to use the `targets` attribute instead.
+
+## resource/aws_ssm_parameter
+
+The `overwrite` attribute has been deprecated. Existing parameters should be explicitly imported rather than relying on the "import on create" behavior previously enabled by setting `overwrite = true`. In a future major version the `overwrite` attribute will be removed and attempting to create a parameter that already exists will fail.
+
+## resource/aws_vpc
+
+Remove `enable_classiclink` and `enable_classiclink_dns_support` from configurations as they no longer exist. They were part of the EC2-Classic retirement.
+
+## resource/aws_vpc_peering_connection
+
+Remove `allow_classic_link_to_remote_vpc` and `allow_vpc_to_remote_classic_link` from configurations as they no longer exist. They were part of the EC2-Classic retirement.
+
+## resource/aws_vpc_peering_connection_accepter
+
+Remove `allow_classic_link_to_remote_vpc` and `allow_vpc_to_remote_classic_link` from configurations as they no longer exist. They were part of the EC2-Classic retirement.
+
+## resource/aws_vpc_peering_connection_options
+
+Remove `allow_classic_link_to_remote_vpc` and `allow_vpc_to_remote_classic_link` from configurations as they no longer exist. They were part of the EC2-Classic retirement.
+
+## resource/aws_wafv2_web_acl
+
+* Remove `statement.managed_rule_group_statement.excluded_rule` and `statement.rule_group_reference_statement.excluded_rule` from configurations as they no longer exist.
+* The `statement.rule_group_reference_statement.rule_action_override` attribute has been added.
+
+## resource/aws_wafv2_web_acl_logging_configuration
+
+Remove `redacted_fields.all_query_arguments`, `redacted_fields.body` and `redacted_fields.single_query_argument` from configurations as they no longer exist.
+
+## data-source/aws_api_gateway_rest_api
+
+The `minimum_compression_size` attribute is now a String type, allowing it to be computed when set via the `body` attribute.
+
+## data-source/aws_connect_hours_of_operation
+
+Remove `hours_of_operation_arn` from configurations as it no longer exists.
+
+## data-source/aws_db_instance
+
+Remove `db_security_groups` from configurations as it no longer exists. We removed it as part of the EC2-Classic retirement.
+
+## data-source/aws_elasticache_cluster
+
+Remove `security_group_names` from configurations as it no longer exists. We removed it as part of the EC2-Classic retirement.
+
+## data-source/aws_elasticache_replication_group
+
+Rename `number_cache_clusters` and `replication_group_description`, which no longer exist, to `num_cache_clusters`, and `description`, respectively.
+
+## data-source/aws_iam_policy_document
+
+* Remove `source_json` and `override_json` from configurations. Use `source_policy_documents` and `override_policy_documents`, respectively, instead.
+* Don't add empty `statement.sid` values to `json` attribute value.
+
+## data-source/aws_identitystore_group
+
+Remove `filter` from configurations as it no longer exists.
+
+## data-source/aws_identitystore_user
+
+Remove `filter` from configurations as it no longer exists.
+
+## data-source/aws_launch_configuration
+
+Remove `vpc_classic_link_id` and `vpc_classic_link_security_groups` from configurations as they no longer exist. They were part of the EC2-Classic retirement.
+
+## data-source/aws_opensearch_domain
+
+The `kibana_endpoint` attribute has been deprecated. All configurations using `kibana_endpoint` should be updated to use the `dashboard_endpoint` attribute instead.
+
+## data-source/aws_quicksight_data_set
+
+The `tags_all` attribute has been deprecated and will be removed in a future version.
+
+## data-source/aws_redshift_cluster
+
+Remove `cluster_security_groups` from configurations as it no longer exists. We removed it as part of the EC2-Classic retirement.
+
+## data-source/aws_redshift_service_account
+
+[AWS document](https://docs.aws.amazon.com/redshift/latest/mgmt/db-auditing.html#db-auditing-bucket-permissions) that [a service principal name](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html#principal-services) be used instead of AWS account ID in any relevant IAM policy.
+The [`aws_redshift_service_account`](/docs/providers/aws/d/redshift_service_account.html) data source should now be considered deprecated and will be removed in a future version.
+
+## data-source/aws_service_discovery_service
+
+The `tags_all` attribute has been deprecated and will be removed in a future version.
+
+## data-source/aws_secretsmanager_secret
+
+Remove `rotation_enabled`, `rotation_lambda_arn` and `rotation_rules` from configurations as they no longer exist.
+
+## data-source/aws_subnet_ids
+
+We removed the `aws_subnet_ids` data source. Use the [`aws_subnets`](/docs/providers/aws/d/subnets.html) data source instead.
+
+## data-source/aws_vpc_peering_connection
+
+Remove `allow_classic_link_to_remote_vpc` and `allow_vpc_to_remote_classic_link` from configurations as they no longer exist. They were part of the EC2-Classic retirement.
+
+<!-- cache-key: cdktf-0.18.0 input-aca6d1f7e7d666acb626774a0855d9b010ab540c0e171c9acb88a23401334cb9 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/index.html.markdown b/website/docs/cdktf/python/index.html.markdown
new file mode 100644
index 00000000000..c53fc6f27b7
--- /dev/null
+++ b/website/docs/cdktf/python/index.html.markdown
@@ -0,0 +1,790 @@
+---
+layout: "aws"
+page_title: "Provider: AWS"
+description: |-
+  Use the Amazon Web Services (AWS) provider to interact with the many resources supported by AWS. You must configure the provider with the proper credentials before you can use it.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# AWS Provider
+
+Use the Amazon Web Services (AWS) provider to interact with the
+many resources supported by AWS. You must configure the provider
+with the proper credentials before you can use it.
+
+Use the navigation to the left to read about the available resources. There are currently 1270 resources and 520 data sources available in the provider.
+
+To learn the basics of Terraform using this provider, follow the
+hands-on [get started tutorials](https://learn.hashicorp.com/tutorials/terraform/infrastructure-as-code?in=terraform/aws-get-started&utm_source=WEBSITE&utm_medium=WEB_IO&utm_offer=ARTICLE_PAGE&utm_content=DOCS). Interact with AWS services,
+including Lambda, RDS, and IAM by following the [AWS services
+tutorials](https://learn.hashicorp.com/collections/terraform/aws?utm_source=WEBSITE&utm_medium=WEB_IO&utm_offer=ARTICLE_PAGE&utm_content=DOCS).
+
+## Example Usage
+
+Terraform 0.13 and later:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.provider import AwsProvider
+from imports.aws.vpc import Vpc
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AwsProvider(self, "aws",
+            region="us-east-1"
+        )
+        Vpc(self, "example",
+            cidr_block="10.0.0.0/16"
+        )
+```
+
+Terraform 0.12 and earlier:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.provider import AwsProvider
+from imports.aws.vpc import Vpc
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AwsProvider(self, "aws",
+            region="us-east-1"
+        )
+        Vpc(self, "example",
+            cidr_block="10.0.0.0/16"
+        )
+```
+
+## Authentication and Configuration
+
+Configuration for the AWS Provider can be derived from several sources,
+which are applied in the following order:
+
+1. Parameters in the provider configuration
+1. Environment variables
+1. Shared credentials files
+1. Shared configuration files
+1. Container credentials
+1. Instance profile credentials and region
+
+This order matches the precedence used by the
+[AWS CLI](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-quickstart.html#cli-configure-quickstart-precedence)
+and the [AWS SDKs](https://aws.amazon.com/tools/).
+
+The AWS Provider supports assuming an IAM role, either in
+the provider configuration block parameter `assume_role`
+or in [a named profile](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-role.html).
+
+The AWS Provider supports assuming an IAM role using [web identity federation and OpenID Connect (OIDC)](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-role.html#cli-configure-role-oidc).
+This can be configured either using environment variables or in a named profile.
+
+When using a named profile, the AWS Provider also supports [sourcing credentials from an external process](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sourcing-external.html).
+
+### Provider Configuration
+
+!> **Warning:** Hard-coded credentials are not recommended in any Terraform
+configuration and risks secret leakage should this file ever be committed to a
+public version control system.
+
+Credentials can be provided by adding an `access_key`, `secret_key`, and optionally `token`, to the `aws` provider block.
+
+Usage:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.provider import AwsProvider
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AwsProvider(self, "aws",
+            access_key="my-access-key",
+            region="us-west-2",
+            secret_key="my-secret-key"
+        )
+```
+
+Other settings related to authorization can be configured, such as:
+
+* `profile`
+* `shared_config_files`
+* `shared_credentials_files`
+
+### Environment Variables
+
+Credentials can be provided by using the `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, and optionally `AWS_SESSION_TOKEN` environment variables.
+The region can be set using the `AWS_REGION` or `AWS_DEFAULT_REGION` environment variables.
+
+For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.provider import AwsProvider
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AwsProvider(self, "aws")
+```
+
+```console
+% export AWS_ACCESS_KEY_ID="anaccesskey"
+% export AWS_SECRET_ACCESS_KEY="asecretkey"
+% export AWS_REGION="us-west-2"
+% terraform plan
+```
+
+Other environment variables related to authorization are:
+
+* `AWS_PROFILE`
+* `AWS_CONFIG_FILE`
+* `AWS_SHARED_CREDENTIALS_FILE`
+
+### Shared Configuration and Credentials Files
+
+The AWS Provider can source credentials and other settings from the [shared configuration and credentials files](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-files.html).
+By default, these files are located at `$HOME/.aws/config` and `$HOME/.aws/credentials` on Linux and macOS,
+and `"%USERPROFILE%\.aws\config"` and `"%USERPROFILE%\.aws\credentials"` on Windows.
+
+If no named profile is specified, the `default` profile is used.
+Use the `profile` parameter or `AWS_PROFILE` environment variable to specify a named profile.
+
+The locations of the shared configuration and credentials files can be configured using either
+the parameters `shared_config_files` and `shared_credentials_files`
+or the environment variables `AWS_CONFIG_FILE` and `AWS_SHARED_CREDENTIALS_FILE`.
+
+For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.provider import AwsProvider
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AwsProvider(self, "aws",
+            profile="customprofile",
+            shared_config_files=["/Users/tf_user/.aws/conf"],
+            shared_credentials_files=["/Users/tf_user/.aws/creds"]
+        )
+```
+
+### Container Credentials
+
+If you're running Terraform on CodeBuild or ECS and have configured an [IAM Task Role](http://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-iam-roles.html), Terraform can use the container's Task Role. This support is based on the underlying `AWS_CONTAINER_CREDENTIALS_RELATIVE_URI` and `AWS_CONTAINER_CREDENTIALS_FULL_URI` environment variables being automatically set by those services or manually for advanced usage.
+
+If you're running Terraform on EKS and have configured [IAM Roles for Service Accounts (IRSA)](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html), Terraform can use the pod's role. This support is based on the underlying `AWS_ROLE_ARN` and `AWS_WEB_IDENTITY_TOKEN_FILE` environment variables being automatically set by Kubernetes or manually for advanced usage.
+
+### Instance profile credentials and region
+
+When the AWS Provider is running on an EC2 instance with an IAM Instance Profile set,
+the provider can source credentials from the [EC2 Instance Metadata Service](http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html#instance-metadata-security-credentials).
+Both IMDS v1 and IMDS v2 are supported.
+
+A custom endpoint for the metadata service can be provided using the `ec2_metadata_service_endpoint` parameter or the `AWS_EC2_METADATA_SERVICE_ENDPOINT` environment variable.
+
+### Assuming an IAM Role
+
+If provided with a role ARN, the AWS Provider will attempt to assume this role
+using the supplied credentials.
+
+Usage:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.provider import AwsProvider
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AwsProvider(self, "aws",
+            assume_role=[AwsProviderAssumeRole(
+                external_id="EXTERNAL_ID",
+                role_arn="arn:aws:iam::123456789012:role/ROLE_NAME",
+                session_name="SESSION_NAME"
+            )
+            ]
+        )
+```
+
+> **Hands-on:** Try the [Use AssumeRole to Provision AWS Resources Across Accounts](https://learn.hashicorp.com/tutorials/terraform/aws-assumerole) tutorial.
+
+### Assuming an IAM Role Using A Web Identity
+
+If provided with a role ARN and a token from a web identity provider,
+the AWS Provider will attempt to assume this role using the supplied credentials.
+
+Usage:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.provider import AwsProvider
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AwsProvider(self, "aws",
+            assume_role_with_web_identity=[AwsProviderAssumeRoleWithWebIdentity(
+                role_arn="arn:aws:iam::123456789012:role/ROLE_NAME",
+                session_name="SESSION_NAME",
+                web_identity_token_file="/Users/tf_user/secrets/web-identity-token"
+            )
+            ]
+        )
+```
+
+### Using an External Credentials Process
+
+To use an [external process to source credentials](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sourcing-external.html),
+the process must be configured in a named profile, including the `default` profile.
+The profile is configured in a shared configuration file.
+
+For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.provider import AwsProvider
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AwsProvider(self, "aws",
+            profile="customprofile"
+        )
+```
+
+```ini
+[profile customprofile]
+credential_process = custom-process --username jdoe
+```
+
+## AWS Configuration Reference
+
+|Setting|Provider|[Environment Variable][envvars]|[Shared Config][config]|
+|-------|--------|-------------------------------|-----------------------|
+|Access Key ID|`access_key`|`AWS_ACCESS_KEY_ID`|`aws_access_key_id`|
+|Secret Access Key|`secret_key`|`AWS_SECRET_ACCESS_KEY`|`aws_secret_access_key`|
+|Session Token|`token`|`AWS_SESSION_TOKEN`|`aws_session_token`|
+|Region|`region`|`AWS_REGION` or `AWS_DEFAULT_REGION`|`region`|
+|Custom CA Bundle |`custom_ca_bundle`|`AWS_CA_BUNDLE`|`ca_bundle`|
+|EC2 IMDS Endpoint |`ec2_metadata_service_endpoint`|`AWS_EC2_METADATA_SERVICE_ENDPOINT`|N/A|
+|EC2 IMDS Endpoint Mode|`ec2_metadata_service_endpoint_mode`|`AWS_EC2_METADATA_SERVICE_ENDPOINT_MODE`|N/A|
+|Disable EC2 IMDS|`skip_metadata_api_check`|`AWS_EC2_METADATA_DISABLED`|N/A|
+|HTTP Proxy|`http_proxy`|`HTTP_PROXY` or `HTTPS_PROXY`|N/A|
+|Max Retries|`max_retries`|`AWS_MAX_ATTEMPTS`|`max_attempts`|
+|Profile|`profile`|`AWS_PROFILE` or `AWS_DEFAULT_PROFILE`|N/A|
+|Retry Mode|`retry_mode`|`AWS_RETRY_MODE`|`retry_mode`|
+|Shared Config Files|`shared_config_files`|`AWS_CONFIG_FILE`|N/A|
+|Shared Credentials Files|`shared_credentials_files`|`AWS_SHARED_CREDENTIALS_FILE`|N/A|
+|S3 Use Regional Endpoint for `us-east-1`|`s3_us_east_1_regional_endpoint`|`AWS_S3_US_EAST_1_REGIONAL_ENDPOINT`|`s3_us_east_1_regional_endpoint`|
+|Use DualStack Endpoints|`use_dualstack_endpoint`|`AWS_USE_DUALSTACK_ENDPOINT`|`use_dualstack_endpoint`|
+|Use FIPS Endpoints|`use_fips_endpoint`|`AWS_USE_FIPS_ENDPOINT`|`use_fips_endpoint`|
+
+[envvars]: https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-envvars.html
+[config]: https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-files.html#cli-configure-files-settings
+
+### Assume Role Configuration Reference
+
+Configuation for assuming an IAM role can be done using provider configuration or a named profile in shared configuration files.
+In the provider, all parameters for assuming an IAM role are set in the `assume_role` block.
+
+Note that environment variables are not supported for assuming IAM roles.
+
+See the [assume role documentation](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-role.html) for more information.
+
+|Setting|Provider|[Shared Config][config]|
+|-------|--------|-----------------------|
+|Role ARN|`role_arn`|`role_arn`|
+|Duration|`duration`|`duration_seconds`|
+|External ID|`external_id`|`external_id`|
+|Policy|`policy`|N/A|
+|Policy ARNs|`policy_arns`|N/A|
+|Session Name|`session_name`|`role_session_name`|
+|Source Identity|`source_identity`|N/A|
+|Tags|`tags`|N/A|
+|Transitive Tag Keys|`transitive_tag_keys`|N/A|
+
+### Assume Role with Web Identity Configuration Reference
+
+Configuration for assuming an IAM role using web identify federation can be done using provider configuration, environment variables, or a named profile in shared configuration files.
+In the provider, all parameters for assuming an IAM role are set in the `assume_role_with_web_identity` block.
+
+See the assume role documentation [section on web identities](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-role.html#cli-configure-role-oidc) for more information.
+
+|Setting|Provider|[Environment Variable][envvars]|[Shared Config][config]|
+|-------|--------|--------|-----------------------|
+|Role ARN|`role_arn`|`AWS_ROLE_ARN`|`role_arn`|
+|Web Identity Token|`web_identity_token`|N/A|N/A|
+|Web Identity Token File|`web_identity_token_file`|`AWS_WEB_IDENTITY_TOKEN_FILE`|`web_identity_token_file`|
+|Duration|`duration`|N/A|`duration_seconds`|
+|Policy|`policy`|N/A|`policy`|
+|Policy ARNs|`policy_arns`|N/A|`policy_arns`|
+|Session Name|`session_name`|`AWS_ROLE_SESSION_NAME`|`role_session_name`|
+
+## Custom User-Agent Information
+
+By default, the underlying AWS client used by the Terraform AWS Provider creates requests with User-Agent headers including information about Terraform and AWS SDK for Go versions. To provide additional information in the User-Agent headers, the `TF_APPEND_USER_AGENT` environment variable can be set and its value will be directly added to HTTP requests. E.g.,
+
+```console
+% export TF_APPEND_USER_AGENT="JenkinsAgent/i-12345678 BuildID/1234 (Optional Extra Information)"
+```
+
+## Argument Reference
+
+In addition to [generic `provider` arguments](https://www.terraform.io/docs/configuration/providers.html)
+(e.g., `alias` and `version`), the following arguments are supported in the AWS
+ `provider` block:
+
+* `access_key` - (Optional) AWS access key. Can also be set with the `AWS_ACCESS_KEY_ID` environment variable, or via a shared credentials file if `profile` is specified. See also `secret_key`.
+* `allowed_account_ids` - (Optional) List of allowed AWS account IDs to prevent you from mistakenly using an incorrect one (and potentially end up destroying a live environment). Conflicts with `forbidden_account_ids`.
+* `assume_role` - (Optional) Configuration block for assuming an IAM role. See the [`assume_role` Configuration Block](#assume_role-configuration-block) section below. Only one `assume_role` block may be in the configuration.
+* `assume_role_with_web_identity` - (Optional) Configuration block for assuming an IAM role using a web identity. See the [`assume_role_with_web_identity` Configuration Block](#assume_role_with_web_identity-configuration-block) section below. Only one `assume_role_with_web_identity` block may be in the configuration.
+* `custom_ca_bundle` - (Optional) File containing custom root and intermediate certificates.
+  Can also be set using the `AWS_CA_BUNDLE` environment variable.
+  Setting `ca_bundle` in the shared config file is not supported.
+* `default_tags` - (Optional) Configuration block with resource tag settings to apply across all resources handled by this provider (see the [Terraform multiple provider instances documentation](/docs/configuration/providers.html#alias-multiple-provider-instances) for more information about additional provider configurations). This is designed to replace redundant per-resource `tags` configurations. Provider tags can be overridden with new values, but not excluded from specific resources. To override provider tag values, use the `tags` argument within a resource to configure new tag values for matching keys. See the [`default_tags`](#default_tags-configuration-block) Configuration Block section below for example usage and available arguments. This functionality is supported in all resources that implement `tags`, with the exception of the `aws_autoscaling_group` resource.
+* `ec2_metadata_service_endpoint` - (Optional) Address of the EC2 metadata service (IMDS) endpoint to use. Can also be set with the `AWS_EC2_METADATA_SERVICE_ENDPOINT` environment variable.
+* `ec2_metadata_service_endpoint_mode` - (Optional) Mode to use in communicating with the metadata service. Valid values are `IPv4` and `IPv6`. Can also be set with the `AWS_EC2_METADATA_SERVICE_ENDPOINT_MODE` environment variable.
+* `endpoints` - (Optional) Configuration block for customizing service endpoints. See the [Custom Service Endpoints Guide](/docs/providers/aws/guides/custom-service-endpoints.html) for more information about connecting to alternate AWS endpoints or AWS compatible solutions. See also `use_fips_endpoint`.
+* `forbidden_account_ids` - (Optional) List of forbidden AWS account IDs to prevent you from mistakenly using the wrong one (and potentially end up destroying a live environment). Conflicts with `allowed_account_ids`.
+* `http_proxy` - (Optional) Address of an HTTP proxy to use when accessing the AWS API. Can also be set using the `HTTP_PROXY` or `HTTPS_PROXY` environment variables.
+* `ignore_tags` - (Optional) Configuration block with resource tag settings to ignore across all resources handled by this provider (except any individual service tag resources such as `aws_ec2_tag`) for situations where external systems are managing certain resource tags. Arguments to the configuration block are described below in the `ignore_tags` Configuration Block section. See the [Terraform multiple provider instances documentation](https://www.terraform.io/docs/configuration/providers.html#alias-multiple-provider-configurations) for more information about additional provider configurations.
+* `insecure` - (Optional) Whether to explicitly allow the provider to perform "insecure" SSL requests. If omitted, the default value is `false`.
+* `max_retries` - (Optional) Maximum number of times an API call is retried when AWS throttles requests or you experience transient failures.
+  The delay between the subsequent API calls increases exponentially.
+  If omitted, the default value is `25`.
+  Can also be set using the environment variable `AWS_MAX_ATTEMPTS`
+  and the shared configuration parameter `max_attempts`.
+* `profile` - (Optional) AWS profile name as set in the shared configuration and credentials files.
+  Can also be set using either the environment variables `AWS_PROFILE` or `AWS_DEFAULT_PROFILE`.
+* `region` - (Optional) AWS region where the provider will operate. The region must be set.
+  Can also be set with either the `AWS_REGION` or `AWS_DEFAULT_REGION` environment variables,
+  or via a shared config file parameter `region` if `profile` is used.
+  If credentials are retrieved from the EC2 Instance Metadata Service, the region can also be retrieved from the metadata.
+* `retry_mode` - (Optional) Specifies how retries are attempted.
+  Valid values are `standard` and `adaptive`.
+  Can also be configured using the `AWS_RETRY_MODE` environment variable or the shared config file parameter `retry_mode`.
+* `s3_use_path_style` - (Optional) Whether to enable the request to use path-style addressing, i.e., `https://s3.amazonaws.com/BUCKET/KEY`.
+  By default, the S3 client will use virtual hosted bucket addressing, `https://BUCKET.s3.amazonaws.com/KEY`, when possible.
+  Specific to the Amazon S3 service.
+* `s3_us_east_1_regional_endpoint` - (Optional) Specifies whether S3 API calls in the `us-east-1` region use the legacy global endpoint or a regional endpoint.
+  Valid values are `legacy` or `regional`.
+  Can also be configured using the `AWS_S3_US_EAST_1_REGIONAL_ENDPOINT` environment variable or the `s3_us_east_1_regional_endpoint` shared config file parameter.
+  Specific to the Amazon S3 service.
+* `secret_key` - (Optional) AWS secret key. Can also be set with the `AWS_SECRET_ACCESS_KEY` environment variable, or via a shared configuration and credentials files if `profile` is used. See also `access_key`.
+* `shared_config_files` - (Optional) List of paths to AWS shared config files. If not set, the default is `[~/.aws/config]`. A single value can also be set with the `AWS_CONFIG_FILE` environment variable.
+* `shared_credentials_files` - (Optional) List of paths to the shared credentials file. If not set and a profile is used, the default value is `[~/.aws/credentials]`. A single value can also be set with the `AWS_SHARED_CREDENTIALS_FILE` environment variable.
+* `skip_credentials_validation` - (Optional) Whether to skip credentials validation via the STS API. This can be useful for testing and for AWS API implementations that do not have STS available.
+* `skip_metadata_api_check` - (Optional) Whether to skip the AWS Metadata API check.  Useful for AWS API implementations that do not have a metadata API endpoint.  Setting to `true` prevents Terraform from authenticating via the Metadata API. You may need to use other authentication methods like static credentials, configuration variables, or environment variables.
+* `skip_region_validation` - (Optional) Whether to skip validating the region. Useful for AWS-like implementations that use their own region names or to bypass the validation for regions that aren't publicly available yet.
+* `skip_requesting_account_id` - (Optional) Whether to skip requesting the account ID.  Useful for AWS API implementations that do not have the IAM, STS API, or metadata API.  When set to `true` and not determined previously, returns an empty account ID when manually constructing ARN attributes with the following:
+    - [`aws_api_gateway_deployment` resource](/docs/providers/aws/r/api_gateway_deployment.html)
+    - [`aws_api_gateway_rest_api` resource](/docs/providers/aws/r/api_gateway_rest_api.html)
+    - [`aws_api_gateway_stage` resource](/docs/providers/aws/r/api_gateway_stage.html)
+    - [`aws_apigatewayv2_api` data source](/docs/providers/aws/d/apigatewayv2_api.html)
+    - [`aws_apigatewayv2_api` resource](/docs/providers/aws/r/apigatewayv2_api.html)
+    - [`aws_apigatewayv2_stage` resource](/docs/providers/aws/r/apigatewayv2_stage.html)
+    - [`aws_appconfig_application` resource](/docs/providers/aws/r/appconfig_application.html)
+    - [`aws_appconfig_configuration_profile` resource](/docs/providers/aws/r/appconfig_configuration_profile.html)
+    - [`aws_appconfig_deployment` resource](/docs/providers/aws/r/appconfig_deployment.html)
+    - [`aws_appconfig_deployment_strategy` resource](/docs/providers/aws/r/appconfig_deployment_strategy.html)
+    - [`aws_appconfig_environment` resource](/docs/providers/aws/r/appconfig_environment.html)
+    - [`aws_appconfig_hosted_configuration_version` resource](/docs/providers/aws/r/appconfig_hosted_configuration_version.html)
+    - [`aws_athena_workgroup` resource](/docs/providers/aws/r/athena_workgroup.html)
+    - [`aws_budgets_budget` resource](/docs/providers/aws/r/budgets_budget.html)
+    - [`aws_codedeploy_app` resource](/docs/providers/aws/r/codedeploy_app.html)
+    - [`aws_codedeploy_deployment_group` resource](/docs/providers/aws/r/codedeploy_deployment_group.html)
+    - [`aws_cognito_identity_pool` resource](/docs/providers/aws/r/cognito_identity_pool.html)
+    - [`aws_cognito_user_pools` data source](/docs/providers/aws/d/cognito_user_pools.html)
+    - [`aws_default_vpc_dhcp_options`](/docs/providers/aws/r/default_vpc_dhcp_options.html)
+    - [`aws_dms_event_subscription` resource](/docs/providers/aws/r/dms_event_subscription.html)
+    - [`aws_dms_replication_subnet_group` resource](/docs/providers/aws/r/dms_replication_subnet_group.html)
+    - [`aws_dx_connection` resource](/docs/providers/aws/r/dx_connection.html)
+    - [`aws_dx_hosted_private_virtual_interface_accepter` resource](/docs/providers/aws/r/dx_hosted_private_virtual_interface_accepter.html)
+    - [`aws_dx_hosted_private_virtual_interface` resource](/docs/providers/aws/r/dx_hosted_private_virtual_interface.html)
+    - [`aws_dx_hosted_public_virtual_interface_accepter` resource](/docs/providers/aws/r/dx_hosted_public_virtual_interface_accepter.html)
+    - [`aws_dx_hosted_public_virtual_interface` resource](/docs/providers/aws/r/dx_hosted_public_virtual_interface.html)
+    - [`aws_dx_hosted_transit_virtual_interface_accepter` resource](/docs/providers/aws/r/dx_hosted_transit_virtual_interface_accepter.html)
+    - [`aws_dx_hosted_transit_virtual_interface` resource](/docs/providers/aws/r/dx_hosted_transit_virtual_interface.html)
+    - [`aws_dx_lag` resource](/docs/providers/aws/r/dx_lag.html)
+    - [`aws_dx_private_virtual_interface` resource](/docs/providers/aws/r/dx_private_virtual_interface.html)
+    - [`aws_dx_public_virtual_interface` resource](/docs/providers/aws/r/dx_public_virtual_interface.html)
+    - [`aws_dx_transit_virtual_interface` resource](/docs/providers/aws/r/dx_transit_virtual_interface.html)
+    - [`aws_ebs_volume` data source](/docs/providers/aws/d/ebs_volume.html)
+    - [`aws_ec2_client_vpn_endpoint` resource](/docs/providers/aws/r/ec2_client_vpn_endpoint.html)
+    - [`aws_ec2_traffic_mirror_filter` resource](/docs/providers/aws/r/ec2_traffic_mirror_filter.html)
+    - [`aws_ec2_traffic_mirror_filter_rule` resource](/docs/providers/aws/r/ec2_traffic_mirror_filter_rule.html)
+    - [`aws_ec2_traffic_mirror_session` resource](/docs/providers/aws/r/ec2_traffic_mirror_session.html)
+    - [`aws_ec2_traffic_mirror_target` resource](/docs/providers/aws/r/ec2_traffic_mirror_target.html)
+    - [`aws_ec2_transit_gateway_route_table` data source](/docs/providers/aws/d/ec2_transit_gateway_route_table.html)
+    - [`aws_ec2_transit_gateway_route_table` resource](/docs/providers/aws/r/ec2_transit_gateway_route_table.html)
+    - [`aws_ecs_capacity_provider` resource (import)](/docs/providers/aws/r/ecs_capacity_provider.html)
+    - [`aws_ecs_cluster` resource (import)](/docs/providers/aws/r/ecs_cluster.html)
+    - [`aws_ecs_service` resource (import)](/docs/providers/aws/r/ecs_service.html)
+    - [`aws_customer_gateway` data source](/docs/providers/aws/d/customer_gateway.html)
+    - [`aws_customer_gateway` resource](/docs/providers/aws/r/customer_gateway.html)
+    - [`aws_efs_access_point` data source](/docs/providers/aws/d/efs_access_point.html)
+    - [`aws_efs_access_point` resource](/docs/providers/aws/r/efs_access_point.html)
+    - [`aws_efs_file_system` data source](/docs/providers/aws/d/efs_file_system.html)
+    - [`aws_efs_file_system` resource](/docs/providers/aws/r/efs_file_system.html)
+    - [`aws_efs_mount_target` data source](/docs/providers/aws/d/efs_mount_target.html)
+    - [`aws_efs_mount_target` resource](/docs/providers/aws/r/efs_mount_target.html)
+    - [`aws_elasticache_cluster` data source](/docs/providers/aws/d/elasticache_cluster.html)
+    - [`aws_elasticache_cluster` resource](/docs/providers/aws/r/elasticache_cluster.html)
+    - [`aws_elb` data source](/docs/providers/aws/d/elb.html)
+    - [`aws_elb` resource](/docs/providers/aws/r/elb.html)
+    - [`aws_flow_log` resource](/docs/providers/aws/r/flow_log.html)
+    - [`aws_glue_catalog_database` resource](/docs/providers/aws/r/glue_catalog_database.html)
+    - [`aws_glue_catalog_table` resource](/docs/providers/aws/r/glue_catalog_table.html)
+    - [`aws_glue_connection` resource](/docs/providers/aws/r/glue_connection.html)
+    - [`aws_glue_crawler` resource](/docs/providers/aws/r/glue_crawler.html)
+    - [`aws_glue_job` resource](/docs/providers/aws/r/glue_job.html)
+    - [`aws_glue_ml_transform` resource](/docs/providers/aws/r/glue_ml_transform.html)
+    - [`aws_glue_trigger` resource](/docs/providers/aws/r/glue_trigger.html)
+    - [`aws_glue_user_defined_function` resource](/docs/providers/aws/r/glue_user_defined_function.html)
+    - [`aws_glue_workflow` resource](/docs/providers/aws/r/glue_workflow.html)
+    - [`aws_guardduty_detector` resource](/docs/providers/aws/r/guardduty_detector.html)
+    - [`aws_guardduty_ipset` resource](/docs/providers/aws/r/guardduty_ipset.html)
+    - [`aws_guardduty_threatintelset` resource](/docs/providers/aws/r/guardduty_threatintelset.html)
+    - [`aws_instance` data source](/docs/providers/aws/d/instance.html)
+    - [`aws_instance` resource](/docs/providers/aws/r/instance.html)
+    - [`aws_key_pair` resource](/docs/providers/aws/r/key_pair.html)
+    - [`aws_launch_template` data source](/docs/providers/aws/d/launch_template.html)
+    - [`aws_launch_template` resource](/docs/providers/aws/r/launch_template.html)
+    - [`aws_placement_group` resource](/docs/providers/aws/r/placement_group.html)
+    - [`aws_redshift_cluster` resource](/docs/providers/aws/r/redshift_cluster.html)
+    - [`aws_redshift_event_subscription` resource](/docs/providers/aws/r/redshift_event_subscription.html)
+    - [`aws_redshift_parameter_group` resource](/docs/providers/aws/r/redshift_parameter_group.html)
+    - [`aws_redshift_snapshot_copy_grant` resource](/docs/providers/aws/r/redshift_snapshot_copy_grant.html)
+    - [`aws_redshift_snapshot_schedule` resource](/docs/providers/aws/r/redshift_snapshot_schedule.html)
+    - [`aws_redshift_subnet_group` resource](/docs/providers/aws/r/redshift_subnet_group.html)
+    - [`aws_s3_account_public_access_block` resource](/docs/providers/aws/r/s3_account_public_access_block.html)
+    - [`aws_ses_active_receipt_rule_set` resource](/docs/providers/aws/r/ses_active_receipt_rule_set.html)
+    - [`aws_ses_configuration_set` resource](/docs/providers/aws/r/ses_configuration_set.html)
+    - [`aws_ses_domain_identity_verification` resource](/docs/providers/aws/r/ses_domain_identity_verification.html)
+    - [`aws_ses_domain_identity` resource](/docs/providers/aws/r/ses_domain_identity.html)
+    - [`aws_ses_email_identity` resource](/docs/providers/aws/r/ses_email_identity.html)
+    - [`aws_ses_event_destination` resource](/docs/providers/aws/r/ses_event_destination.html)
+    - [`aws_ses_receipt_filter` resource](/docs/providers/aws/r/ses_receipt_filter.html)
+    - [`aws_ses_receipt_rule` resource](/docs/providers/aws/r/ses_receipt_rule.html)
+    - [`aws_ses_template` resource](/docs/providers/aws/r/ses_template.html)
+    - [`aws_ssm_document` data source](/docs/providers/aws/d/ssm_document.html)
+    - [`aws_ssm_document` resource](/docs/providers/aws/r/ssm_document.html)
+    - [`aws_ssm_parameter` data source](/docs/providers/aws/d/ssm_parameter.html)
+    - [`aws_ssm_parameter` resource](/docs/providers/aws/r/ssm_parameter.html)
+    - [`aws_synthetics_canary` resource](/docs/providers/aws/r/synthetics_canary.html)
+    - [`aws_vpc_endpoint_service` data source](/docs/providers/aws/d/vpc_endpoint_service.html)
+    - [`aws_vpc_endpoint_service` resource](/docs/providers/aws/r/vpc_endpoint_service.html)
+    - [`aws_vpn_connection` resource](/docs/providers/aws/r/vpn_connection.html)
+    - [`aws_vpn_gateway` data source](/docs/providers/aws/d/vpn_gateway.html)
+    - [`aws_vpn_gateway` resource](/docs/providers/aws/r/vpn_gateway.html)
+    - [`aws_waf_geo_match_set` resource](/docs/providers/aws/r/waf_geo_match_set.html)
+    - [`aws_waf_ipset` resource](/docs/providers/aws/r/waf_ipset.html)
+    - [`aws_waf_rate_based_rule` resource](/docs/providers/aws/r/waf_rate_based_rule.html)
+    - [`aws_waf_regex_match_set` resource](/docs/providers/aws/r/waf_regex_match_set.html)
+    - [`aws_waf_regex_pattern_set` resource](/docs/providers/aws/r/waf_regex_pattern_set.html)
+    - [`aws_wafregional_ipset` resource](/docs/providers/aws/r/wafregional_ipset.html)
+    - [`aws_wafregional_rate_based_rule` resource](/docs/providers/aws/r/wafregional_rate_based_rule.html)
+    - [`aws_wafregional_rule` resource](/docs/providers/aws/r/wafregional_rule.html)
+    - [`aws_wafregional_rule_group` resource](/docs/providers/aws/r/wafregional_rule_group.html)
+    - [`aws_wafregional_web_acl` resource](/docs/providers/aws/r/wafregional_web_acl.html)
+    - [`aws_waf_rule` resource](/docs/providers/aws/r/waf_rule.html)
+    - [`aws_waf_rule_group` resource](/docs/providers/aws/r/waf_rule_group.html)
+    - [`aws_waf_size_constraint_set` resource](/docs/providers/aws/r/waf_size_constraint_set.html)
+    - [`aws_waf_web_acl` resource](/docs/providers/aws/r/waf_web_acl.html)
+    - [`aws_waf_xss_match_set` resource](/docs/providers/aws/r/waf_xss_match_set.html)
+* `sts_region` - (Optional) AWS region for STS. If unset, AWS will use the same region for STS as other non-STS operations.
+* `token` - (Optional) Session token for validating temporary credentials. Typically provided after successful identity federation or Multi-Factor Authentication (MFA) login. With MFA login, this is the session token provided afterward, not the 6 digit MFA code used to get temporary credentials.  Can also be set with the `AWS_SESSION_TOKEN` environment variable.
+* `use_dualstack_endpoint` - (Optional) Force the provider to resolve endpoints with DualStack capability. Can also be set with the `AWS_USE_DUALSTACK_ENDPOINT` environment variable or in a shared config file (`use_dualstack_endpoint`).
+* `use_fips_endpoint` - (Optional) Force the provider to resolve endpoints with FIPS capability. Can also be set with the `AWS_USE_FIPS_ENDPOINT` environment variable or in a shared config file (`use_fips_endpoint`).
+
+### assume_role Configuration Block
+
+The `assume_role` configuration block supports the following arguments:
+
+* `duration` - (Optional) Duration of the assume role session. You can provide a value from 15 minutes up to the maximum session duration setting for the role. Represented by a string such as `1h`, `2h45m`, or `30m15s`.
+* `external_id` - (Optional) External identifier to use when assuming the role.
+* `policy` - (Optional) IAM Policy JSON describing further restricting permissions for the IAM Role being assumed.
+* `policy_arns` - (Optional) Set of Amazon Resource Names (ARNs) of IAM Policies describing further restricting permissions for the IAM Role being assumed.
+* `role_arn` - (Required) ARN of the IAM Role to assume.
+* `session_name` - (Optional) Session name to use when assuming the role.
+* `source_identity` - (Optional) Source identity specified by the principal assuming the role.
+* `tags` - (Optional) Map of assume role session tags.
+* `transitive_tag_keys` - (Optional) Set of assume role session tag keys to pass to any subsequent sessions.
+
+### assume_role_with_web_identity Configuration Block
+
+The `assume_role_with_web_identity` configuration block supports the following arguments:
+
+* `duration` - (Optional) Duration of the assume role session.
+  You can provide a value from 15 minutes up to the maximum session duration setting for the role.
+  Represented by a string such as `1h`, `2h45m`, or `30m15s`.
+* `policy` - (Optional) IAM Policy JSON describing further restricting permissions for the IAM Role being assumed.
+* `policy_arns` - (Optional) Set of Amazon Resource Names (ARNs) of IAM Policies describing further restricting permissions for the IAM Role being assumed.
+* `role_arn` - (Required) ARN of the IAM Role to assume.
+  Can also be set with the `AWS_ROLE_ARN` environment variable.
+* `session_name` - (Optional) Session name to use when assuming the role.
+  Can also be set with the `AWS_ROLE_SESSION_NAME` environment variable.
+* `web_identity_token` - (Optional) Value of a web identity token from an OpenID Connect (OIDC) or OAuth provider.
+  One of `web_identity_token` or `web_identity_token_file` is required.
+* `web_identity_token_file` - (Optional) File containing a web identity token from an OpenID Connect (OIDC) or OAuth provider.
+  One of `web_identity_token_file` or `web_identity_token` is required.
+  Can also be set with the `AWS_WEB_IDENTITY_TOKEN_FILE` environment variable.
+
+### default_tags Configuration Block
+
+> **Hands-on:** Try the [Configure Default Tags for AWS Resources](https://learn.hashicorp.com/tutorials/terraform/aws-default-tags?in=terraform/aws) tutorial.
+
+Example: Resource with provider default tags
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformOutput, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.provider import AwsProvider
+from imports.aws.vpc import Vpc
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AwsProvider(self, "aws",
+            default_tags=[AwsProviderDefaultTags(
+                tags={
+                    "Environment": "Test",
+                    "Name": "Provider Tag"
+                }
+            )
+            ]
+        )
+        example = Vpc(self, "example")
+        TerraformOutput(self, "vpc_all_tags",
+            value=example.tags_all
+        )
+        TerraformOutput(self, "vpc_resource_level_tags",
+            value=example.tags
+        )
+```
+
+Outputs:
+
+```console
+$ terraform apply
+...
+Outputs:
+
+vpc_all_tags = tomap({
+  "Environment" = "Test"
+  "Name" = "Provider Tag"
+})
+```
+
+Example: Resource with tags and provider default tags
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformOutput, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.provider import AwsProvider
+from imports.aws.vpc import Vpc
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AwsProvider(self, "aws",
+            default_tags=[AwsProviderDefaultTags(
+                tags={
+                    "Environment": "Test",
+                    "Name": "Provider Tag"
+                }
+            )
+            ]
+        )
+        example = Vpc(self, "example",
+            tags={
+                "Owner": "example"
+            }
+        )
+        TerraformOutput(self, "vpc_all_tags",
+            value=example.tags_all
+        )
+        TerraformOutput(self, "vpc_resource_level_tags",
+            value=example.tags
+        )
+```
+
+Outputs:
+
+```console
+$ terraform apply
+...
+Outputs:
+
+vpc_all_tags = tomap({
+  "Environment" = "Test"
+  "Name" = "Provider Tag"
+  "Owner" = "example"
+})
+vpc_resource_level_tags = tomap({
+  "Owner" = "example"
+})
+```
+
+Example: Resource overriding provider default tags
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformOutput, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.provider import AwsProvider
+from imports.aws.vpc import Vpc
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AwsProvider(self, "aws",
+            default_tags=[AwsProviderDefaultTags(
+                tags={
+                    "Environment": "Test",
+                    "Name": "Provider Tag"
+                }
+            )
+            ]
+        )
+        example = Vpc(self, "example",
+            tags={
+                "Environment": "Production"
+            }
+        )
+        TerraformOutput(self, "vpc_all_tags",
+            value=example.tags_all
+        )
+        TerraformOutput(self, "vpc_resource_level_tags",
+            value=example.tags
+        )
+```
+
+Outputs:
+
+```console
+$ terraform apply
+...
+Outputs:
+
+vpc_all_tags = tomap({
+  "Environment" = "Production"
+  "Name" = "Provider Tag"
+})
+vpc_resource_level_tags = tomap({
+  "Environment" = "Production"
+})
+```
+
+The `default_tags` configuration block supports the following argument:
+
+* `tags` - (Optional) Key-value map of tags to apply to all resources.
+
+### ignore_tags Configuration Block
+
+Example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.provider import AwsProvider
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AwsProvider(self, "aws",
+            ignore_tags=[AwsProviderIgnoreTags(
+                keys=["TagKey1"]
+            )
+            ]
+        )
+```
+
+The `ignore_tags` configuration block supports the following arguments:
+
+* `keys` - (Optional) List of exact resource tag keys to ignore across all resources handled by this provider. This configuration prevents Terraform from returning the tag in any `tags` attributes and displaying any configuration difference for the tag value. If any resource configuration still has this tag key configured in the `tags` argument, it will display a perpetual difference until the tag is removed from the argument or [`ignore_changes`](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html#ignore_changes) is also used.
+* `key_prefixes` - (Optional) List of resource tag key prefixes to ignore across all resources handled by this provider. This configuration prevents Terraform from returning any tag key matching the prefixes in any `tags` attributes and displaying any configuration difference for those tag values. If any resource configuration still has a tag matching one of the prefixes configured in the `tags` argument, it will display a perpetual difference until the tag is removed from the argument or [`ignore_changes`](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html#ignore_changes) is also used.
+
+## Getting the Account ID
+
+If you use either `allowed_account_ids` or `forbidden_account_ids`,
+Terraform uses several approaches to get the actual account ID
+in order to compare it with allowed or forbidden IDs.
+
+Approaches differ per authentication providers:
+
+* EC2 instance w/ IAM Instance Profile - [Metadata API](http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html)
+    is always used. Introduced in Terraform `0.6.16`.
+* All other providers (environment variable, shared credentials file, ...)
+    will try three approaches in the following order
+    * `iam:GetUser` - Typically useful for IAM Users. It also means
+      that each user needs to be privileged to call `iam:GetUser` for themselves.
+    * `sts:GetCallerIdentity` - _Should_ work for both IAM Users and federated IAM Roles,
+      introduced in Terraform `0.6.16`.
+    * `iam:ListRoles` - This is specifically useful for IdP-federated profiles
+      which cannot use `iam:GetUser`. It also means that each federated user
+      need to be _assuming_ an IAM role which allows `iam:ListRoles`.
+      Used in Terraform `0.6.16+`.
+      There used to be no better way to get account ID out of the API
+      when using the federated account until `sts:GetCallerIdentity` was introduced.
+
+<!-- cache-key: cdktf-0.18.0 input-acd8a09881ab29aeafe5c6b0411f4694cd3850219e5293c00f973ced87f5aab0 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/accessanalyzer_analyzer.html.markdown b/website/docs/cdktf/python/r/accessanalyzer_analyzer.html.markdown
new file mode 100644
index 00000000000..ecd167eb8ae
--- /dev/null
+++ b/website/docs/cdktf/python/r/accessanalyzer_analyzer.html.markdown
@@ -0,0 +1,101 @@
+---
+subcategory: "IAM Access Analyzer"
+layout: "aws"
+page_title: "AWS: aws_accessanalyzer_analyzer"
+description: |-
+  Manages an Access Analyzer Analyzer
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_accessanalyzer_analyzer
+
+Manages an Access Analyzer Analyzer. More information can be found in the [Access Analyzer User Guide](https://docs.aws.amazon.com/IAM/latest/UserGuide/what-is-access-analyzer.html).
+
+## Example Usage
+
+### Account Analyzer
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.accessanalyzer_analyzer import AccessanalyzerAnalyzer
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AccessanalyzerAnalyzer(self, "example",
+            analyzer_name="example"
+        )
+```
+
+### Organization Analyzer
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.accessanalyzer_analyzer import AccessanalyzerAnalyzer
+from imports.aws.organizations_organization import OrganizationsOrganization
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = OrganizationsOrganization(self, "example",
+            aws_service_access_principals=["access-analyzer.amazonaws.com"]
+        )
+        aws_accessanalyzer_analyzer_example = AccessanalyzerAnalyzer(self, "example_1",
+            analyzer_name="example",
+            depends_on=[example],
+            type="ORGANIZATION"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_accessanalyzer_analyzer_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `analyzer_name` - (Required) Name of the Analyzer.
+
+The following arguments are optional:
+
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `type` - (Optional) Type of Analyzer. Valid values are `ACCOUNT` or `ORGANIZATION`. Defaults to `ACCOUNT`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Analyzer.
+* `id` - Analyzer name.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Access Analyzer Analyzers using the `analyzer_name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Access Analyzer Analyzers using the `analyzer_name`. For example:
+
+```console
+% terraform import aws_accessanalyzer_analyzer.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-865517f541a3e2db841337fbd9f0628587cf4b4a56bf09cdcd6af204495a9819 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/accessanalyzer_archive_rule.html.markdown b/website/docs/cdktf/python/r/accessanalyzer_archive_rule.html.markdown
new file mode 100644
index 00000000000..d461d5ab6e6
--- /dev/null
+++ b/website/docs/cdktf/python/r/accessanalyzer_archive_rule.html.markdown
@@ -0,0 +1,91 @@
+---
+subcategory: "IAM Access Analyzer"
+layout: "aws"
+page_title: "AWS: aws_accessanalyzer_archive_rule"
+description: |-
+  Terraform resource for managing an AWS AccessAnalyzer Archive Rule.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_accessanalyzer_archive_rule
+
+Terraform resource for managing an AWS AccessAnalyzer Archive Rule.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.accessanalyzer_archive_rule import AccessanalyzerArchiveRule
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AccessanalyzerArchiveRule(self, "example",
+            analyzer_name="example-analyzer",
+            filter=[AccessanalyzerArchiveRuleFilter(
+                criteria="condition.aws:UserId",
+                eq=["userid"]
+            ), AccessanalyzerArchiveRuleFilter(
+                criteria="error",
+                exists=Token.as_string(True)
+            ), AccessanalyzerArchiveRuleFilter(
+                criteria="isPublic",
+                eq=["false"]
+            )
+            ],
+            rule_name="example-rule"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `analyzer_name` - (Required) Analyzer name.
+* `filter` - (Required) Filter criteria for the archive rule. See [Filter](#filter) for more details.
+* `rule_name` - (Required) Rule name.
+
+### Filter
+
+**Note** One comparator must be included with each filter.
+
+* `criteria` - (Required) Filter criteria.
+* `contains` - (Optional) Contains comparator.
+* `eq` - (Optional) Equals comparator.
+* `exists` - (Optional) Boolean comparator.
+* `neq` - (Optional) Not Equals comparator.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Resource ID in the format: `analyzer_name/rule_name`.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AccessAnalyzer ArchiveRule using the `analyzer_name/rule_name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import AccessAnalyzer ArchiveRule using the `analyzer_name/rule_name`. For example:
+
+```console
+% terraform import aws_accessanalyzer_archive_rule.example example-analyzer/example-rule
+```
+
+<!-- cache-key: cdktf-0.18.0 input-6c3a5ffb045f96a752c714c3e446067414c5c96251a4373be0b926978dc5643a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/account_alternate_contact.html.markdown b/website/docs/cdktf/python/r/account_alternate_contact.html.markdown
new file mode 100644
index 00000000000..47ae19683b0
--- /dev/null
+++ b/website/docs/cdktf/python/r/account_alternate_contact.html.markdown
@@ -0,0 +1,101 @@
+---
+subcategory: "Account Management"
+layout: "aws"
+page_title: "AWS: aws_account_alternate_contact"
+description: |-
+  Manages the specified alternate contact attached to an AWS Account.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_account_alternate_contact
+
+Manages the specified alternate contact attached to an AWS Account.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.account_alternate_contact import AccountAlternateContact
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AccountAlternateContact(self, "operations",
+            alternate_contact_type="OPERATIONS",
+            email_address="test@example.com",
+            name="Example",
+            phone_number="+1234567890",
+            title="Example"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `account_id` - (Optional) ID of the target account when managing member accounts. Will manage current user's account by default if omitted.
+* `alternate_contact_type` - (Required) Type of the alternate contact. Allowed values are: `BILLING`, `OPERATIONS`, `SECURITY`.
+* `email_address` - (Required) An email address for the alternate contact.
+* `name` - (Required) Name of the alternate contact.
+* `phone_number` - (Required) Phone number for the alternate contact.
+* `title` - (Required) Title for the alternate contact.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `5m`)
+- `update` - (Default `5m`)
+- `delete` - (Default `5m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import the Alternate Contact for the current or another account using the `alternate_contact_type`. For example:
+
+Import the Alternate Contact for the current account:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Import the Alternate Contact for another account using the `account_id` and `alternate_contact_type` separated by a forward slash (`/`):
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+**Using `terraform import` to import** the Alternate Contact for the current or another account using the `alternate_contact_type`. For example:
+
+Import the Alternate Contact for the current account:
+
+```console
+% terraform import aws_account_alternate_contact.operations OPERATIONS
+```
+
+Import the Alternate Contact for another account using the `account_id` and `alternate_contact_type` separated by a forward slash (`/`):
+
+```console
+% terraform import aws_account_alternate_contact.operations 1234567890/OPERATIONS
+```
+
+<!-- cache-key: cdktf-0.18.0 input-03bffb9572a9af37cd374a887e8789217031dddd609768f253119fb07d95935d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/account_primary_contact.html.markdown b/website/docs/cdktf/python/r/account_primary_contact.html.markdown
new file mode 100644
index 00000000000..e800aa05696
--- /dev/null
+++ b/website/docs/cdktf/python/r/account_primary_contact.html.markdown
@@ -0,0 +1,84 @@
+---
+subcategory: "Account Management"
+layout: "aws"
+page_title: "AWS: aws_account_primary_contact"
+description: |-
+  Manages the specified primary contact information associated with an AWS Account.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_account_primary_contact
+
+Manages the specified primary contact information associated with an AWS Account.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.account_primary_contact import AccountPrimaryContact
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AccountPrimaryContact(self, "test",
+            address_line1="123 Any Street",
+            city="Seattle",
+            company_name="Example Corp, Inc.",
+            country_code="US",
+            district_or_county="King",
+            full_name="My Name",
+            phone_number="+64211111111",
+            postal_code="98101",
+            state_or_region="WA",
+            website_url="https://www.examplecorp.com"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `account_id` - (Optional) The ID of the target account when managing member accounts. Will manage current user's account by default if omitted.
+* `address_line_1` - (Required) The first line of the primary contact address.
+* `address_line_2` - (Optional) The second line of the primary contact address, if any.
+* `address_line_3` - (Optional) The third line of the primary contact address, if any.
+* `city` - (Required) The city of the primary contact address.
+* `company_name` - (Optional) The name of the company associated with the primary contact information, if any.
+* `country_code` - (Required) The ISO-3166 two-letter country code for the primary contact address.
+* `district_or_county` - (Optional) The district or county of the primary contact address, if any.
+* `full_name` - (Required) The full name of the primary contact address.
+* `phone_number` - (Required) The phone number of the primary contact information. The number will be validated and, in some countries, checked for activation.
+* `postal_code` - (Required) The postal code of the primary contact address.
+* `state_or_region` - (Optional) The state or region of the primary contact address. This field is required in selected countries.
+* `website_url` - (Optional) The URL of the website associated with the primary contact information, if any.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import the Primary Contact using the `account_id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import the Primary Contact using the `account_id`. For example:
+
+```console
+% terraform import aws_account_primary_contact.test 1234567890
+```
+
+<!-- cache-key: cdktf-0.18.0 input-851429f776e6267c98084e58a5ee924b91d3bd11d2fa3463d9a57ae674b83986 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/acm_certificate.html.markdown b/website/docs/cdktf/python/r/acm_certificate.html.markdown
new file mode 100644
index 00000000000..f2169211191
--- /dev/null
+++ b/website/docs/cdktf/python/r/acm_certificate.html.markdown
@@ -0,0 +1,280 @@
+---
+subcategory: "ACM (Certificate Manager)"
+layout: "aws"
+page_title: "AWS: aws_acm_certificate"
+description: |-
+  Requests and manages a certificate from Amazon Certificate Manager (ACM).
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_acm_certificate
+
+The ACM certificate resource allows requesting and management of certificates
+from the Amazon Certificate Manager.
+
+ACM certificates can be created in three ways:
+Amazon-issued, where AWS provides the certificate authority and automatically manages renewal;
+imported certificates, issued by another certificate authority;
+and private certificates, issued using an ACM Private Certificate Authority.
+
+## Amazon-Issued Certificates
+
+For Amazon-issued certificates, this resource deals with requesting certificates and managing their attributes and life-cycle.
+This resource does not deal with validation of a certificate but can provide inputs
+for other resources implementing the validation.
+It does not wait for a certificate to be issued.
+Use a [`aws_acm_certificate_validation`](acm_certificate_validation.html) resource for this.
+
+Most commonly, this resource is used together with [`aws_route53_record`](route53_record.html) and
+[`aws_acm_certificate_validation`](acm_certificate_validation.html) to request a DNS validated certificate,
+deploy the required validation records and wait for validation to complete.
+
+Domain validation through email is also supported but should be avoided as it requires a manual step outside of Terraform.
+
+It's recommended to specify `create_before_destroy = true` in a [lifecycle][1] block to replace a certificate
+which is currently in use (eg, by [`aws_lb_listener`](lb_listener.html)).
+
+## Certificates Imported from Other Certificate Authority
+
+Imported certificates can be used to make certificates created with an external certificate authority available for AWS services.
+
+As they are not managed by AWS, imported certificates are not eligible for automatic renewal.
+New certificate materials can be supplied to an existing imported certificate to update it in place.
+
+## Private Certificates
+
+Private certificates are issued by an ACM Private Cerificate Authority, which can be created using the resource type [`aws_acmpca_certificate_authority`](acmpca_certificate_authority.html).
+
+Private certificates created using this resource are eligible for managed renewal if they have been exported or associated with another AWS service.
+See [managed renewal documentation](https://docs.aws.amazon.com/acm/latest/userguide/managed-renewal.html) for more information.
+By default, a certificate is valid for 395 days and the managed renewal process will start 60 days before expiration.
+To renew the certificate earlier than 60 days before expiration, configure `early_renewal_duration`.
+
+## Example Usage
+
+### Create Certificate
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from cdktf import TerraformResourceLifecycle
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.acm_certificate import AcmCertificate
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AcmCertificate(self, "cert",
+            domain_name="example.com",
+            lifecycle=TerraformResourceLifecycle(
+                create_before_destroy=True
+            ),
+            tags={
+                "Environment": "test"
+            },
+            validation_method="DNS"
+        )
+```
+
+### Custom Domain Validation Options
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.acm_certificate import AcmCertificate
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AcmCertificate(self, "cert",
+            domain_name="testing.example.com",
+            validation_method="EMAIL",
+            validation_option=[AcmCertificateValidationOption(
+                domain_name="testing.example.com",
+                validation_domain="example.com"
+            )
+            ]
+        )
+```
+
+### Existing Certificate Body Import
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.acm_certificate import AcmCertificate
+from imports.tls.private_key import PrivateKey
+from imports.tls.self_signed_cert import SelfSignedCert
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        # The following providers are missing schema information and might need manual adjustments to synthesize correctly: tls.
+        #     For a more precise conversion please use the --provider flag in convert.
+        example = PrivateKey(self, "example",
+            algorithm="RSA"
+        )
+        tls_self_signed_cert_example = SelfSignedCert(self, "example_1",
+            allowed_uses=["key_encipherment", "digital_signature", "server_auth"],
+            key_algorithm="RSA",
+            private_key_pem=example.private_key_pem,
+            subject=[{
+                "common_name": "example.com",
+                "organization": "ACME Examples, Inc"
+            }
+            ],
+            validity_period_hours=12
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        tls_self_signed_cert_example.override_logical_id("example")
+        AcmCertificate(self, "cert",
+            certificate_body=Token.as_string(tls_self_signed_cert_example.cert_pem),
+            private_key=Token.as_string(example.private_key_pem)
+        )
+```
+
+### Referencing domain_validation_options With for_each Based Resources
+
+See the [`aws_acm_certificate_validation` resource](acm_certificate_validation.html) for a full example of performing DNS validation.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformIterator, Fn, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.route53_record import Route53Record
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        # In most cases loops should be handled in the programming language context and
+        #     not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+        #     you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+        #     you need to keep this like it is.
+        example_for_each_iterator = TerraformIterator.from_list(
+            Token.as_any("${{ for dvo in ${" + aws_acm_certificate_example.domain_validation_options + "} : dvo.domain_name => {\n      name   = dvo.resource_record_name\n      record = dvo.resource_record_value\n      type   = dvo.resource_record_type\n    }}}"))
+        Route53Record(self, "example",
+            allow_overwrite=True,
+            name=Token.as_string(
+                Fn.lookup_nested(example_for_each_iterator.value, ["name"])),
+            records=[
+                Token.as_string(
+                    Fn.lookup_nested(example_for_each_iterator.value, ["record"]))
+            ],
+            ttl=60,
+            type=Token.as_string(
+                Fn.lookup_nested(example_for_each_iterator.value, ["type"])),
+            zone_id=Token.as_string(aws_route53_zone_example.zone_id),
+            for_each=example_for_each_iterator
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* Creating an Amazon issued certificate
+    * `domain_name` - (Required) Domain name for which the certificate should be issued
+    * `subject_alternative_names` - (Optional) Set of domains that should be SANs in the issued certificate. To remove all elements of a previously configured list, set this value equal to an empty list (`[]`) or use the [`terraform taint` command](https://www.terraform.io/docs/commands/taint.html) to trigger recreation.
+    * `validation_method` - (Optional) Which method to use for validation. `DNS` or `EMAIL` are valid. This parameter must not be set for certificates that were imported into ACM and then into Terraform.
+    * `key_algorithm` - (Optional) Specifies the algorithm of the public and private key pair that your Amazon issued certificate uses to encrypt data. See [ACM Certificate characteristics](https://docs.aws.amazon.com/acm/latest/userguide/acm-certificate.html#algorithms) for more details.
+    * `options` - (Optional) Configuration block used to set certificate options. Detailed below.
+    * `validation_option` - (Optional) Configuration block used to specify information about the initial validation of each domain name. Detailed below.
+* Importing an existing certificate
+    * `private_key` - (Required) Certificate's PEM-formatted private key
+    * `certificate_body` - (Required) Certificate's PEM-formatted public key
+    * `certificate_chain` - (Optional) Certificate's PEM-formatted chain
+* Creating a private CA issued certificate
+    * `certificate_authority_arn` - (Required) ARN of an ACM PCA
+    * `domain_name` - (Required) Domain name for which the certificate should be issued.
+    * `early_renewal_duration` - (Optional) Amount of time to start automatic renewal process before expiration.
+      Has no effect if less than 60 days.
+      Represented by either
+      a subset of [RFC 3339 duration](https://www.rfc-editor.org/rfc/rfc3339) supporting years, months, and days (e.g., `P90D`),
+      or a string such as `2160h`.
+* `subject_alternative_names` - (Optional) Set of domains that should be SANs in the issued certificate.
+  To remove all elements of a previously configured list, set this value equal to an empty list (`[]`)
+  or use the [`terraform taint` command](https://www.terraform.io/docs/commands/taint.html) to trigger recreation.
+* `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## options Configuration Block
+
+Supported nested arguments for the `options` configuration block:
+
+* `certificate_transparency_logging_preference` - (Optional) Whether certificate details should be added to a certificate transparency log. Valid values are `ENABLED` or `DISABLED`. See https://docs.aws.amazon.com/acm/latest/userguide/acm-concepts.html#concept-transparency for more details.
+
+## validation_option Configuration Block
+
+Supported nested arguments for the `validation_option` configuration block:
+
+* `domain_name` - (Required) Fully qualified domain name (FQDN) in the certificate.
+* `validation_domain` - (Required) Domain name that you want ACM to use to send you validation emails. This domain name is the suffix of the email addresses that you want ACM to use. This must be the same as the `domain_name` value or a superdomain of the `domain_name` value. For example, if you request a certificate for `"testing.example.com"`, you can specify `"example.com"` for this value.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - ARN of the certificate
+* `arn` - ARN of the certificate
+* `domain_name` - Domain name for which the certificate is issued
+* `domain_validation_options` - Set of domain validation objects which can be used to complete certificate validation.
+  Can have more than one element, e.g., if SANs are defined.
+  Only set if `DNS`-validation was used.
+* `not_after` - Expiration date and time of the certificate.
+* `not_before` - Start of the validity period of the certificate.
+* `pending_renewal` - `true` if a Private certificate eligible for managed renewal is within the `early_renewal_duration` period.
+* `renewal_eligibility` - Whether the certificate is eligible for managed renewal.
+* `renewal_summary` - Contains information about the status of ACM's [managed renewal](https://docs.aws.amazon.com/acm/latest/userguide/acm-renewal.html) for the certificate.
+* `status` - Status of the certificate.
+* `type` - Source of the certificate.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `validation_emails` - List of addresses that received a validation email. Only set if `EMAIL` validation was used.
+
+Domain validation objects export the following attributes:
+
+* `domain_name` - Domain to be validated
+* `resource_record_name` - The name of the DNS record to create to validate the certificate
+* `resource_record_type` - The type of DNS record to create
+* `resource_record_value` - The value the DNS record needs to have
+
+Renewal summary objects export the following attributes:
+
+* `renewal_status` - The status of ACM's managed renewal of the certificate
+* `renewal_status_reason` - The reason that a renewal request was unsuccessful or is pending
+
+[1]: https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import certificates using their ARN. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import certificates using their ARN. For example:
+
+```console
+% terraform import aws_acm_certificate.cert arn:aws:acm:eu-central-1:123456789012:certificate/7e7a28d2-163f-4b8f-b9cd-822f96c08d6a
+```
+
+<!-- cache-key: cdktf-0.18.0 input-e4c3a7735ec99f4007d8e7e7e89139f9d730f0e5d51221b59505955d1de5da60 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/acm_certificate_validation.html.markdown b/website/docs/cdktf/python/r/acm_certificate_validation.html.markdown
new file mode 100644
index 00000000000..dd28642329e
--- /dev/null
+++ b/website/docs/cdktf/python/r/acm_certificate_validation.html.markdown
@@ -0,0 +1,205 @@
+---
+subcategory: "ACM (Certificate Manager)"
+layout: "aws"
+page_title: "AWS: aws_acm_certificate_validation"
+description: |-
+  Waits for and checks successful validation of an ACM certificate.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_acm_certificate_validation
+
+This resource represents a successful validation of an ACM certificate in concert
+with other resources.
+
+Most commonly, this resource is used together with [`aws_route53_record`](route53_record.html) and
+[`aws_acm_certificate`](acm_certificate.html) to request a DNS validated certificate,
+deploy the required validation records and wait for validation to complete.
+
+~> **WARNING:** This resource implements a part of the validation workflow. It does not represent a real-world entity in AWS, therefore changing or deleting this resource on its own has no immediate effect.
+
+## Example Usage
+
+### DNS Validation with Route 53
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformIterator, Fn, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.acm_certificate import AcmCertificate
+from imports.aws.acm_certificate_validation import AcmCertificateValidation
+from imports.aws.data_aws_route53_zone import DataAwsRoute53Zone
+from imports.aws.lb_listener import LbListener
+from imports.aws.route53_record import Route53Record
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, defaultAction, loadBalancerArn):
+        super().__init__(scope, name)
+        example = AcmCertificate(self, "example",
+            domain_name="example.com",
+            validation_method="DNS"
+        )
+        data_aws_route53_zone_example = DataAwsRoute53Zone(self, "example_1",
+            name="example.com",
+            private_zone=False
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_route53_zone_example.override_logical_id("example")
+        # In most cases loops should be handled in the programming language context and
+        #     not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+        #     you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+        #     you need to keep this like it is.
+        example_for_each_iterator = TerraformIterator.from_list(
+            Token.as_any("${{ for dvo in ${" + example.domain_validation_options + "} : dvo.domain_name => {\n      name   = dvo.resource_record_name\n      record = dvo.resource_record_value\n      type   = dvo.resource_record_type\n    }}}"))
+        aws_route53_record_example = Route53Record(self, "example_2",
+            allow_overwrite=True,
+            name=Token.as_string(
+                Fn.lookup_nested(example_for_each_iterator.value, ["name"])),
+            records=[
+                Token.as_string(
+                    Fn.lookup_nested(example_for_each_iterator.value, ["record"]))
+            ],
+            ttl=60,
+            type=Token.as_string(
+                Fn.lookup_nested(example_for_each_iterator.value, ["type"])),
+            zone_id=Token.as_string(data_aws_route53_zone_example.zone_id),
+            for_each=example_for_each_iterator
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_route53_record_example.override_logical_id("example")
+        aws_acm_certificate_validation_example = AcmCertificateValidation(self, "example_3",
+            certificate_arn=example.arn,
+            validation_record_fqdns=Token.as_list("${[ for record in ${" + aws_route53_record_example.fqn + "} : record.fqdn]}")
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_acm_certificate_validation_example.override_logical_id("example")
+        aws_lb_listener_example = LbListener(self, "example_4",
+            certificate_arn=Token.as_string(aws_acm_certificate_validation_example.certificate_arn),
+            default_action=default_action,
+            load_balancer_arn=load_balancer_arn
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_lb_listener_example.override_logical_id("example")
+```
+
+### Alternative Domains DNS Validation with Route 53
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformIterator, Fn, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.acm_certificate import AcmCertificate
+from imports.aws.acm_certificate_validation import AcmCertificateValidation
+from imports.aws.data_aws_route53_zone import DataAwsRoute53Zone
+from imports.aws.lb_listener import LbListener
+from imports.aws.route53_record import Route53Record
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, defaultAction, loadBalancerArn):
+        super().__init__(scope, name)
+        example = AcmCertificate(self, "example",
+            domain_name="example.com",
+            subject_alternative_names=["www.example.com", "example.org"],
+            validation_method="DNS"
+        )
+        # In most cases loops should be handled in the programming language context and
+        #     not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+        #     you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+        #     you need to keep this like it is.
+        example_for_each_iterator = TerraformIterator.from_list(
+            Token.as_any("${{ for dvo in ${" + example.domain_validation_options + "} : dvo.domain_name => {\n      name    = dvo.resource_record_name\n      record  = dvo.resource_record_value\n      type    = dvo.resource_record_type\n      zone_id = dvo.domain_name == \"example.org\" ? data.aws_route53_zone.example_org.zone_id : data.aws_route53_zone.example_com.zone_id\n    }}}"))
+        aws_route53_record_example = Route53Record(self, "example_1",
+            allow_overwrite=True,
+            name=Token.as_string(
+                Fn.lookup_nested(example_for_each_iterator.value, ["name"])),
+            records=[
+                Token.as_string(
+                    Fn.lookup_nested(example_for_each_iterator.value, ["record"]))
+            ],
+            ttl=60,
+            type=Token.as_string(
+                Fn.lookup_nested(example_for_each_iterator.value, ["type"])),
+            zone_id=Token.as_string(
+                Fn.lookup_nested(example_for_each_iterator.value, ["zone_id"])),
+            for_each=example_for_each_iterator
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_route53_record_example.override_logical_id("example")
+        DataAwsRoute53Zone(self, "example_com",
+            name="example.com",
+            private_zone=False
+        )
+        DataAwsRoute53Zone(self, "example_org",
+            name="example.org",
+            private_zone=False
+        )
+        aws_acm_certificate_validation_example = AcmCertificateValidation(self, "example_4",
+            certificate_arn=example.arn,
+            validation_record_fqdns=Token.as_list("${[ for record in ${" + aws_route53_record_example.fqn + "} : record.fqdn]}")
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_acm_certificate_validation_example.override_logical_id("example")
+        aws_lb_listener_example = LbListener(self, "example_5",
+            certificate_arn=Token.as_string(aws_acm_certificate_validation_example.certificate_arn),
+            default_action=default_action,
+            load_balancer_arn=load_balancer_arn
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_lb_listener_example.override_logical_id("example")
+```
+
+### Email Validation
+
+In this situation, the resource is simply a waiter for manual email approval of ACM certificates.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.acm_certificate import AcmCertificate
+from imports.aws.acm_certificate_validation import AcmCertificateValidation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = AcmCertificate(self, "example",
+            domain_name="example.com",
+            validation_method="EMAIL"
+        )
+        aws_acm_certificate_validation_example = AcmCertificateValidation(self, "example_1",
+            certificate_arn=example.arn
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_acm_certificate_validation_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `certificate_arn` - (Required) ARN of the certificate that is being validated.
+* `validation_record_fqdns` - (Optional) List of FQDNs that implement the validation. Only valid for DNS validation method ACM certificates. If this is set, the resource can implement additional sanity checks and has an explicit dependency on the resource that is implementing the validation
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Time at which the certificate was issued
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `75m`)
+
+<!-- cache-key: cdktf-0.18.0 input-bd8c04ee824aa9ba9e41a615796c1554d255a22e9d0a9dd833af77b9c40bb301 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/acmpca_certificate.html.markdown b/website/docs/cdktf/python/r/acmpca_certificate.html.markdown
new file mode 100644
index 00000000000..ee2b23d3b18
--- /dev/null
+++ b/website/docs/cdktf/python/r/acmpca_certificate.html.markdown
@@ -0,0 +1,122 @@
+---
+subcategory: "ACM PCA (Certificate Manager Private Certificate Authority)"
+layout: "aws"
+page_title: "AWS: aws_acmpca_certificate"
+description: |-
+  Provides a resource to issue a certificate using AWS Certificate Manager Private Certificate Authority (ACM PCA)
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_acmpca_certificate
+
+Provides a resource to issue a certificate using AWS Certificate Manager Private Certificate Authority (ACM PCA).
+
+Certificates created using `aws_acmpca_certificate` are not eligible for automatic renewal,
+and must be replaced instead.
+To issue a renewable certificate using an ACM PCA, create a [`aws_acm_certificate`](acm_certificate.html)
+with the parameter `certificate_authority_arn`.
+
+## Example Usage
+
+### Basic
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.acmpca_certificate import AcmpcaCertificate
+from imports.aws.acmpca_certificate_authority import AcmpcaCertificateAuthority
+from imports.tls.cert_request import CertRequest
+from imports.tls.private_key import PrivateKey
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, certificateAuthorityConfiguration):
+        super().__init__(scope, name)
+        # The following providers are missing schema information and might need manual adjustments to synthesize correctly: tls.
+        #     For a more precise conversion please use the --provider flag in convert.
+        example = AcmpcaCertificateAuthority(self, "example",
+            permanent_deletion_time_in_days=7,
+            private_certificate_configuration=[{
+                "key_algorithm": "RSA_4096",
+                "signing_algorithm": "SHA512WITHRSA",
+                "subject": [{
+                    "common_name": "example.com"
+                }
+                ]
+            }
+            ],
+            certificate_authority_configuration=certificate_authority_configuration
+        )
+        key = PrivateKey(self, "key",
+            algorithm="RSA"
+        )
+        csr = CertRequest(self, "csr",
+            key_algorithm="RSA",
+            private_key_pem=key.private_key_pem,
+            subject=[{
+                "common_name": "example"
+            }
+            ]
+        )
+        aws_acmpca_certificate_example = AcmpcaCertificate(self, "example_3",
+            certificate_authority_arn=example.arn,
+            certificate_signing_request=Token.as_string(csr.cert_request_pem),
+            signing_algorithm="SHA256WITHRSA",
+            validity=AcmpcaCertificateValidity(
+                type="YEARS",
+                value=Token.as_string(1)
+            )
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_acmpca_certificate_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `certificate_authority_arn` - (Required) ARN of the certificate authority.
+* `certificate_signing_request` - (Required) Certificate Signing Request in PEM format.
+* `signing_algorithm` - (Required) Algorithm to use to sign certificate requests. Valid values: `SHA256WITHRSA`, `SHA256WITHECDSA`, `SHA384WITHRSA`, `SHA384WITHECDSA`, `SHA512WITHRSA`, `SHA512WITHECDSA`.
+* `validity` - (Required) Configures end of the validity period for the certificate. See [validity block](#validity-block) below.
+* `template_arn` - (Optional) Template to use when issuing a certificate.
+  See [ACM PCA Documentation](https://docs.aws.amazon.com/privateca/latest/userguide/UsingTemplates.html) for more information.
+* `api_passthrough` - (Optional) Specifies X.509 certificate information to be included in the issued certificate. To use with API Passthrough templates
+
+### validity block
+
+* `type` - (Required) Determines how `value` is interpreted. Valid values: `DAYS`, `MONTHS`, `YEARS`, `ABSOLUTE`, `END_DATE`.
+* `value` - (Required) If `type` is `DAYS`, `MONTHS`, or `YEARS`, the relative time until the certificate expires. If `type` is `ABSOLUTE`, the date in seconds since the Unix epoch. If `type` is `END_DATE`, the  date in RFC 3339 format.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the certificate.
+* `certificate` - PEM-encoded certificate value.
+* `certificate_chain` - PEM-encoded certificate chain that includes any intermediate certificates and chains up to root CA.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import ACM PCA Certificates using their ARN. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import ACM PCA Certificates using their ARN. For example:
+
+```console
+% terraform import aws_acmpca_certificate.cert arn:aws:acm-pca:eu-west-1:675225743824:certificate-authority/08319ede-83g9-1400-8f21-c7d12b2b6edb/certificate/a4e9c2aa4bcfab625g1b9136464cd3a
+```
+
+<!-- cache-key: cdktf-0.18.0 input-3b19b04277da26192985928a772fc7a153a2937210c9952942adad77721165c9 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/acmpca_certificate_authority.html.markdown b/website/docs/cdktf/python/r/acmpca_certificate_authority.html.markdown
new file mode 100644
index 00000000000..275bbe1be2d
--- /dev/null
+++ b/website/docs/cdktf/python/r/acmpca_certificate_authority.html.markdown
@@ -0,0 +1,229 @@
+---
+subcategory: "ACM PCA (Certificate Manager Private Certificate Authority)"
+layout: "aws"
+page_title: "AWS: aws_acmpca_certificate_authority"
+description: |-
+  Provides a resource to manage AWS Certificate Manager Private Certificate Authorities
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_acmpca_certificate_authority
+
+Provides a resource to manage AWS Certificate Manager Private Certificate Authorities (ACM PCA Certificate Authorities).
+
+~> **NOTE:** Creating this resource will leave the certificate authority in a `PENDING_CERTIFICATE` status, which means it cannot yet issue certificates. To complete this setup, you must fully sign the certificate authority CSR available in the `certificate_signing_request` attribute. The [`aws_acmpca_certificate_authority_certificate`](/docs/providers/aws/r/acmpca_certificate_authority_certificate.html) resource can be used for this purpose.
+
+## Example Usage
+
+### Basic
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.acmpca_certificate_authority import AcmpcaCertificateAuthority
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AcmpcaCertificateAuthority(self, "example",
+            certificate_authority_configuration=AcmpcaCertificateAuthorityCertificateAuthorityConfiguration(
+                key_algorithm="RSA_4096",
+                signing_algorithm="SHA512WITHRSA",
+                subject=AcmpcaCertificateAuthorityCertificateAuthorityConfigurationSubject(
+                    common_name="example.com"
+                )
+            ),
+            permanent_deletion_time_in_days=7
+        )
+```
+
+### Short-lived certificate
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.acmpca_certificate_authority import AcmpcaCertificateAuthority
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AcmpcaCertificateAuthority(self, "example",
+            certificate_authority_configuration=AcmpcaCertificateAuthorityCertificateAuthorityConfiguration(
+                key_algorithm="RSA_4096",
+                signing_algorithm="SHA512WITHRSA",
+                subject=AcmpcaCertificateAuthorityCertificateAuthorityConfigurationSubject(
+                    common_name="example.com"
+                )
+            ),
+            usage_mode="SHORT_LIVED_CERTIFICATE"
+        )
+```
+
+### Enable Certificate Revocation List
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.acmpca_certificate_authority import AcmpcaCertificateAuthority
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_policy import S3BucketPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = S3Bucket(self, "example",
+            bucket="example",
+            force_destroy=True
+        )
+        acmpca_bucket_access = DataAwsIamPolicyDocument(self, "acmpca_bucket_access",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["s3:GetBucketAcl", "s3:GetBucketLocation", "s3:PutObject", "s3:PutObjectAcl"
+                ],
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["acm-pca.amazonaws.com"],
+                    type="Service"
+                )
+                ],
+                resources=[example.arn, "${" + example.arn + "}/*"]
+            )
+            ]
+        )
+        aws_s3_bucket_policy_example = S3BucketPolicy(self, "example_2",
+            bucket=example.id,
+            policy=Token.as_string(acmpca_bucket_access.json)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_policy_example.override_logical_id("example")
+        aws_acmpca_certificate_authority_example = AcmpcaCertificateAuthority(self, "example_3",
+            certificate_authority_configuration=AcmpcaCertificateAuthorityCertificateAuthorityConfiguration(
+                key_algorithm="RSA_4096",
+                signing_algorithm="SHA512WITHRSA",
+                subject=AcmpcaCertificateAuthorityCertificateAuthorityConfigurationSubject(
+                    common_name="example.com"
+                )
+            ),
+            depends_on=[aws_s3_bucket_policy_example],
+            revocation_configuration=AcmpcaCertificateAuthorityRevocationConfiguration(
+                crl_configuration=AcmpcaCertificateAuthorityRevocationConfigurationCrlConfiguration(
+                    custom_cname="crl.example.com",
+                    enabled=True,
+                    expiration_in_days=7,
+                    s3_bucket_name=example.id,
+                    s3_object_acl="BUCKET_OWNER_FULL_CONTROL"
+                )
+            )
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_acmpca_certificate_authority_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `certificate_authority_configuration` - (Required) Nested argument containing algorithms and certificate subject information. Defined below.
+* `enabled` - (Optional) Whether the certificate authority is enabled or disabled. Defaults to `true`. Can only be disabled if the CA is in an `ACTIVE` state.
+* `revocation_configuration` - (Optional) Nested argument containing revocation configuration. Defined below.
+* `usage_mode` - (Optional) Specifies whether the CA issues general-purpose certificates that typically require a revocation mechanism, or short-lived certificates that may optionally omit revocation because they expire quickly. Short-lived certificate validity is limited to seven days. Defaults to `GENERAL_PURPOSE`. Valid values: `GENERAL_PURPOSE` and `SHORT_LIVED_CERTIFICATE`.
+* `tags` - (Optional) Key-value map of user-defined tags that are attached to the certificate authority. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `type` - (Optional) Type of the certificate authority. Defaults to `SUBORDINATE`. Valid values: `ROOT` and `SUBORDINATE`.
+* `key_storage_security_standard` - (Optional) Cryptographic key management compliance standard used for handling CA keys. Defaults to `FIPS_140_2_LEVEL_3_OR_HIGHER`. Valid values: `FIPS_140_2_LEVEL_3_OR_HIGHER` and `FIPS_140_2_LEVEL_2_OR_HIGHER`. Supported standard for each region can be found in the [Storage and security compliance of AWS Private CA private keys Documentation](https://docs.aws.amazon.com/privateca/latest/userguide/data-protection.html#private-keys).
+* `permanent_deletion_time_in_days` - (Optional) Number of days to make a CA restorable after it has been deleted, must be between 7 to 30 days, with default to 30 days.
+
+### certificate_authority_configuration
+
+* `key_algorithm` - (Required) Type of the public key algorithm and size, in bits, of the key pair that your key pair creates when it issues a certificate. Valid values can be found in the [ACM PCA Documentation](https://docs.aws.amazon.com/privateca/latest/APIReference/API_CertificateAuthorityConfiguration.html).
+* `signing_algorithm` - (Required) Name of the algorithm your private CA uses to sign certificate requests. Valid values can be found in the [ACM PCA Documentation](https://docs.aws.amazon.com/privateca/latest/APIReference/API_CertificateAuthorityConfiguration.html).
+* `subject` - (Required) Nested argument that contains X.500 distinguished name information. At least one nested attribute must be specified.
+
+#### subject
+
+Contains information about the certificate subject. Identifies the entity that owns or controls the public key in the certificate. The entity can be a user, computer, device, or service.
+
+* `common_name` - (Optional) Fully qualified domain name (FQDN) associated with the certificate subject. Must be less than or equal to 64 characters in length.
+* `country` - (Optional) Two digit code that specifies the country in which the certificate subject located. Must be less than or equal to 2 characters in length.
+* `distinguished_name_qualifier` - (Optional) Disambiguating information for the certificate subject. Must be less than or equal to 64 characters in length.
+* `generation_qualifier` - (Optional) Typically a qualifier appended to the name of an individual. Examples include Jr. for junior, Sr. for senior, and III for third. Must be less than or equal to 3 characters in length.
+* `given_name` - (Optional) First name. Must be less than or equal to 16 characters in length.
+* `initials` - (Optional) Concatenation that typically contains the first letter of the `given_name`, the first letter of the middle name if one exists, and the first letter of the `surname`. Must be less than or equal to 5 characters in length.
+* `locality` - (Optional) Locality (such as a city or town) in which the certificate subject is located. Must be less than or equal to 128 characters in length.
+* `organization` - (Optional) Legal name of the organization with which the certificate subject is affiliated. Must be less than or equal to 64 characters in length.
+* `organizational_unit` - (Optional) Subdivision or unit of the organization (such as sales or finance) with which the certificate subject is affiliated. Must be less than or equal to 64 characters in length.
+* `pseudonym` - (Optional) Typically a shortened version of a longer `given_name`. For example, Jonathan is often shortened to John. Elizabeth is often shortened to Beth, Liz, or Eliza. Must be less than or equal to 128 characters in length.
+* `state` - (Optional) State in which the subject of the certificate is located. Must be less than or equal to 128 characters in length.
+* `surname` - (Optional) Family name. In the US and the UK for example, the surname of an individual is ordered last. In Asian cultures the surname is typically ordered first. Must be less than or equal to 40 characters in length.
+* `title` - (Optional) Title such as Mr. or Ms. which is pre-pended to the name to refer formally to the certificate subject. Must be less than or equal to 64 characters in length.
+
+### revocation_configuration
+
+* `crl_configuration` - (Optional) Nested argument containing configuration of the certificate revocation list (CRL), if any, maintained by the certificate authority. Defined below.
+* `ocsp_configuration` - (Optional) Nested argument containing configuration of
+the custom OCSP responder endpoint. Defined below.
+
+#### crl_configuration
+
+* `custom_cname` - (Optional) Name inserted into the certificate CRL Distribution Points extension that enables the use of an alias for the CRL distribution point. Use this value if you don't want the name of your S3 bucket to be public. Must be less than or equal to 253 characters in length.
+* `enabled` - (Optional) Boolean value that specifies whether certificate revocation lists (CRLs) are enabled. Defaults to `false`.
+* `expiration_in_days` - (Optional, Required if `enabled` is `true`) Number of days until a certificate expires. Must be between 1 and 5000.
+* `s3_bucket_name` - (Optional, Required if `enabled` is `true`) Name of the S3 bucket that contains the CRL. If you do not provide a value for the `custom_cname` argument, the name of your S3 bucket is placed into the CRL Distribution Points extension of the issued certificate. You must specify a bucket policy that allows ACM PCA to write the CRL to your bucket. Must be between 3 and 255 characters in length.
+* `s3_object_acl` - (Optional) Determines whether the CRL will be publicly readable or privately held in the CRL Amazon S3 bucket. Defaults to `PUBLIC_READ`.
+
+#### ocsp_configuration
+
+* `enabled` - (Required) Boolean value that specifies whether a custom OCSP responder is enabled.
+* `ocsp_custom_cname` - (Optional) CNAME specifying a customized OCSP domain. Note: The value of the CNAME must not include a protocol prefix such as "http://" or "https://".
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - ARN of the certificate authority.
+* `arn` - ARN of the certificate authority.
+* `certificate` - Base64-encoded certificate authority (CA) certificate. Only available after the certificate authority certificate has been imported.
+* `certificate_chain` - Base64-encoded certificate chain that includes any intermediate certificates and chains up to root on-premises certificate that you used to sign your private CA certificate. The chain does not include your private CA certificate. Only available after the certificate authority certificate has been imported.
+* `certificate_signing_request` - The base64 PEM-encoded certificate signing request (CSR) for your private CA certificate.
+* `not_after` - Date and time after which the certificate authority is not valid. Only available after the certificate authority certificate has been imported.
+* `not_before` - Date and time before which the certificate authority is not valid. Only available after the certificate authority certificate has been imported.
+* `serial` - Serial number of the certificate authority. Only available after the certificate authority certificate has been imported.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `1m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_acmpca_certificate_authority` using the certificate authority ARN. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_acmpca_certificate_authority` using the certificate authority ARN. For example:
+
+```console
+% terraform import aws_acmpca_certificate_authority.example arn:aws:acm-pca:us-east-1:123456789012:certificate-authority/12345678-1234-1234-1234-123456789012
+```
+
+<!-- cache-key: cdktf-0.18.0 input-fb883601ee6544ef5b22499a07d5189a537b1a4c7dcbb9cd6e3997945ee21f4d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/acmpca_certificate_authority_certificate.html.markdown b/website/docs/cdktf/python/r/acmpca_certificate_authority_certificate.html.markdown
new file mode 100644
index 00000000000..efbc585fe06
--- /dev/null
+++ b/website/docs/cdktf/python/r/acmpca_certificate_authority_certificate.html.markdown
@@ -0,0 +1,149 @@
+---
+subcategory: "ACM PCA (Certificate Manager Private Certificate Authority)"
+layout: "aws"
+page_title: "AWS: aws_acmpca_certificate_authority_certificate"
+description: |-
+  Associates a certificate with an AWS Certificate Manager Private Certificate Authority
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_acmpca_certificate_authority_certificate
+
+Associates a certificate with an AWS Certificate Manager Private Certificate Authority (ACM PCA Certificate Authority). An ACM PCA Certificate Authority is unable to issue certificates until it has a certificate associated with it. A root level ACM PCA Certificate Authority is able to self-sign its own root certificate.
+
+## Example Usage
+
+### Self-Signed Root Certificate Authority Certificate
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.acmpca_certificate import AcmpcaCertificate
+from imports.aws.acmpca_certificate_authority import AcmpcaCertificateAuthority
+from imports.aws.acmpca_certificate_authority_certificate import AcmpcaCertificateAuthorityCertificate
+from imports.aws.data_aws_partition import DataAwsPartition
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = AcmpcaCertificateAuthority(self, "example",
+            certificate_authority_configuration=AcmpcaCertificateAuthorityCertificateAuthorityConfiguration(
+                key_algorithm="RSA_4096",
+                signing_algorithm="SHA512WITHRSA",
+                subject=AcmpcaCertificateAuthorityCertificateAuthorityConfigurationSubject(
+                    common_name="example.com"
+                )
+            ),
+            type="ROOT"
+        )
+        current = DataAwsPartition(self, "current")
+        aws_acmpca_certificate_example = AcmpcaCertificate(self, "example_2",
+            certificate_authority_arn=example.arn,
+            certificate_signing_request=example.certificate_signing_request,
+            signing_algorithm="SHA512WITHRSA",
+            template_arn="arn:${" + current.partition + "}:acm-pca:::template/RootCACertificate/V1",
+            validity=AcmpcaCertificateValidity(
+                type="YEARS",
+                value=Token.as_string(1)
+            )
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_acmpca_certificate_example.override_logical_id("example")
+        aws_acmpca_certificate_authority_certificate_example =
+        AcmpcaCertificateAuthorityCertificate(self, "example_3",
+            certificate=Token.as_string(aws_acmpca_certificate_example.certificate),
+            certificate_authority_arn=example.arn,
+            certificate_chain=Token.as_string(aws_acmpca_certificate_example.certificate_chain)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_acmpca_certificate_authority_certificate_example.override_logical_id("example")
+```
+
+### Certificate for Subordinate Certificate Authority
+
+Note that the certificate for the subordinate certificate authority must be issued by the root certificate authority using a signing request from the subordinate certificate authority.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.acmpca_certificate import AcmpcaCertificate
+from imports.aws.acmpca_certificate_authority import AcmpcaCertificateAuthority
+from imports.aws.acmpca_certificate_authority_certificate import AcmpcaCertificateAuthorityCertificate
+from imports.aws.data_aws_partition import DataAwsPartition
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, certificateAuthorityArn, certificateSigningRequest, signingAlgorithm, validity, certificateAuthorityConfiguration, certificate, certificateAuthorityArn1):
+        super().__init__(scope, name)
+        AcmpcaCertificate(self, "root",
+            certificate_authority_arn=certificate_authority_arn,
+            certificate_signing_request=certificate_signing_request,
+            signing_algorithm=signing_algorithm,
+            validity=validity
+        )
+        aws_acmpca_certificate_authority_root = AcmpcaCertificateAuthority(self, "root_1",
+            certificate_authority_configuration=certificate_authority_configuration
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_acmpca_certificate_authority_root.override_logical_id("root")
+        subordinate = AcmpcaCertificateAuthority(self, "subordinate",
+            certificate_authority_configuration=AcmpcaCertificateAuthorityCertificateAuthorityConfiguration(
+                key_algorithm="RSA_2048",
+                signing_algorithm="SHA512WITHRSA",
+                subject=AcmpcaCertificateAuthorityCertificateAuthorityConfigurationSubject(
+                    common_name="sub.example.com"
+                )
+            ),
+            type="SUBORDINATE"
+        )
+        aws_acmpca_certificate_authority_certificate_root =
+        AcmpcaCertificateAuthorityCertificate(self, "root_3",
+            certificate=certificate,
+            certificate_authority_arn=certificate_authority_arn1
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_acmpca_certificate_authority_certificate_root.override_logical_id("root")
+        current = DataAwsPartition(self, "current")
+        aws_acmpca_certificate_subordinate = AcmpcaCertificate(self, "subordinate_5",
+            certificate_authority_arn=Token.as_string(aws_acmpca_certificate_authority_root.arn),
+            certificate_signing_request=subordinate.certificate_signing_request,
+            signing_algorithm="SHA512WITHRSA",
+            template_arn="arn:${" + current.partition + "}:acm-pca:::template/SubordinateCACertificate_PathLen0/V1",
+            validity=AcmpcaCertificateValidity(
+                type="YEARS",
+                value=Token.as_string(1)
+            )
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_acmpca_certificate_subordinate.override_logical_id("subordinate")
+        aws_acmpca_certificate_authority_certificate_subordinate =
+        AcmpcaCertificateAuthorityCertificate(self, "subordinate_6",
+            certificate=Token.as_string(aws_acmpca_certificate_subordinate.certificate),
+            certificate_authority_arn=subordinate.arn,
+            certificate_chain=Token.as_string(aws_acmpca_certificate_subordinate.certificate_chain)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_acmpca_certificate_authority_certificate_subordinate.override_logical_id("subordinate")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `certificate` - (Required) PEM-encoded certificate for the Certificate Authority.
+* `certificate_authority_arn` - (Required) ARN of the Certificate Authority.
+* `certificate_chain` - (Optional) PEM-encoded certificate chain that includes any intermediate certificates and chains up to root CA. Required for subordinate Certificate Authorities. Not allowed for root Certificate Authorities.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+<!-- cache-key: cdktf-0.18.0 input-b19572b64df23c019471d3a64aa69d43a5eea5523748112a7c2283e9d3f7b724 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/acmpca_permission.html.markdown b/website/docs/cdktf/python/r/acmpca_permission.html.markdown
new file mode 100644
index 00000000000..6536f7826be
--- /dev/null
+++ b/website/docs/cdktf/python/r/acmpca_permission.html.markdown
@@ -0,0 +1,64 @@
+---
+subcategory: "ACM PCA (Certificate Manager Private Certificate Authority)"
+layout: "aws"
+page_title: "AWS: aws_acmpca_permission"
+description: |-
+  Provides a resource to manage an AWS Certificate Manager Private Certificate Authorities Permission
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_acmpca_permission
+
+Provides a resource to manage an AWS Certificate Manager Private Certificate Authorities Permission.
+Currently, this is only required in order to allow the ACM service to automatically renew certificates issued by a PCA.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.acmpca_certificate_authority import AcmpcaCertificateAuthority
+from imports.aws.acmpca_permission import AcmpcaPermission
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = AcmpcaCertificateAuthority(self, "example",
+            certificate_authority_configuration=AcmpcaCertificateAuthorityCertificateAuthorityConfiguration(
+                key_algorithm="RSA_4096",
+                signing_algorithm="SHA512WITHRSA",
+                subject=AcmpcaCertificateAuthorityCertificateAuthorityConfigurationSubject(
+                    common_name="example.com"
+                )
+            )
+        )
+        aws_acmpca_permission_example = AcmpcaPermission(self, "example_1",
+            actions=["IssueCertificate", "GetCertificate", "ListPermissions"],
+            certificate_authority_arn=example.arn,
+            principal="acm.amazonaws.com"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_acmpca_permission_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `certificate_authority_arn` - (Required) ARN of the CA that grants the permissions.
+* `actions` - (Required) Actions that the specified AWS service principal can use. These include `IssueCertificate`, `GetCertificate`, and `ListPermissions`. Note that in order for ACM to automatically rotate certificates issued by a PCA, it must be granted permission on all 3 actions, as per the example above.
+* `principal` - (Required) AWS service or identity that receives the permission. At this time, the only valid principal is `acm.amazonaws.com`.
+* `source_account` - (Optional) ID of the calling account
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `policy` - IAM policy that is associated with the permission.
+
+<!-- cache-key: cdktf-0.18.0 input-494bcc5d28fd45281186122cb5e3ebdff619ec5306af716d4d8172805c2c661d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/acmpca_policy.html.markdown b/website/docs/cdktf/python/r/acmpca_policy.html.markdown
new file mode 100644
index 00000000000..f1cf5043c04
--- /dev/null
+++ b/website/docs/cdktf/python/r/acmpca_policy.html.markdown
@@ -0,0 +1,101 @@
+---
+subcategory: "ACM PCA (Certificate Manager Private Certificate Authority)"
+layout: "aws"
+page_title: "AWS: aws_acmpca_policy"
+description: |-
+  Attaches a resource based policy to an AWS Certificate Manager Private Certificate Authority (ACM PCA)
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_acmpca_policy
+
+Attaches a resource based policy to a private CA.
+
+## Example Usage
+
+### Basic
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.acmpca_policy import AcmpcaPolicy
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = DataAwsIamPolicyDocument(self, "example",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["acm-pca:DescribeCertificateAuthority", "acm-pca:GetCertificate", "acm-pca:GetCertificateAuthorityCertificate", "acm-pca:ListPermissions", "acm-pca:ListTags"
+                ],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=[Token.as_string(current.account_id)],
+                    type="AWS"
+                )
+                ],
+                resources=[Token.as_string(aws_acmpca_certificate_authority_example.arn)],
+                sid="1"
+            ), DataAwsIamPolicyDocumentStatement(
+                actions=["acm-pca:IssueCertificate"],
+                condition=[DataAwsIamPolicyDocumentStatementCondition(
+                    test="StringEquals",
+                    values=["arn:aws:acm-pca:::template/EndEntityCertificate/V1"],
+                    variable="acm-pca:TemplateArn"
+                )
+                ],
+                effect=allow,
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=[Token.as_string(current.account_id)],
+                    type="AWS"
+                )
+                ],
+                resources=[Token.as_string(aws_acmpca_certificate_authority_example.arn)],
+                sid="2"
+            )
+            ]
+        )
+        aws_acmpca_policy_example = AcmpcaPolicy(self, "example_1",
+            policy=Token.as_string(example.json),
+            resource_arn=Token.as_string(aws_acmpca_certificate_authority_example.arn)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_acmpca_policy_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `resource_arn` - (Required) ARN of the private CA to associate with the policy.
+* `policy` - (Required) JSON-formatted IAM policy to attach to the specified private CA resource.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_acmpca_policy` using the `resource_arn` value. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_acmpca_policy` using the `resource_arn` value. For example:
+
+```console
+% terraform import aws_acmpca_policy.example arn:aws:acm-pca:us-east-1:123456789012:certificate-authority/12345678-1234-1234-1234-123456789012
+```
+
+<!-- cache-key: cdktf-0.18.0 input-3897a945f24b08cf8623246e958727ed8480522a140850c9c8a5a835f4ee024d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ami.html.markdown b/website/docs/cdktf/python/r/ami.html.markdown
new file mode 100644
index 00000000000..91623aa7733
--- /dev/null
+++ b/website/docs/cdktf/python/r/ami.html.markdown
@@ -0,0 +1,156 @@
+---
+subcategory: "EC2 (Elastic Compute Cloud)"
+layout: "aws"
+page_title: "AWS: aws_ami"
+description: |-
+  Creates and manages a custom Amazon Machine Image (AMI).
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ami
+
+The AMI resource allows the creation and management of a completely-custom
+*Amazon Machine Image* (AMI).
+
+If you just want to duplicate an existing AMI, possibly copying it to another
+region, it's better to use `aws_ami_copy` instead.
+
+If you just want to share an existing AMI with another AWS account,
+it's better to use `aws_ami_launch_permission` instead.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ami import Ami
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Ami(self, "example",
+            ebs_block_device=[AmiEbsBlockDevice(
+                device_name="/dev/xvda",
+                snapshot_id="snap-xxxxxxxx",
+                volume_size=8
+            )
+            ],
+            imds_support="v2.0",
+            name="terraform-example",
+            root_device_name="/dev/xvda",
+            virtualization_type="hvm"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) Region-unique name for the AMI.
+* `boot_mode` - (Optional) Boot mode of the AMI. For more information, see [Boot modes](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ami-boot.html) in the Amazon Elastic Compute Cloud User Guide.
+* `deprecation_time` - (Optional) Date and time to deprecate the AMI. If you specified a value for seconds, Amazon EC2 rounds the seconds to the nearest minute. Valid values: [RFC3339 time string](https://tools.ietf.org/html/rfc3339#section-5.8) (`YYYY-MM-DDTHH:MM:SSZ`)
+* `description` - (Optional) Longer, human-readable description for the AMI.
+* `ena_support` - (Optional) Whether enhanced networking with ENA is enabled. Defaults to `false`.
+* `root_device_name` - (Optional) Name of the root device (for example, `/dev/sda1`, or `/dev/xvda`).
+* `virtualization_type` - (Optional) Keyword to choose what virtualization mode created instances
+  will use. Can be either "paravirtual" (the default) or "hvm". The choice of virtualization type
+  changes the set of further arguments that are required, as described below.
+* `architecture` - (Optional) Machine architecture for created instances. Defaults to "x86_64".
+* `ebs_block_device` - (Optional) Nested block describing an EBS block device that should be
+  attached to created instances. The structure of this block is described below.
+* `ephemeral_block_device` - (Optional) Nested block describing an ephemeral block device that
+  should be attached to created instances. The structure of this block is described below.
+* `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `tpm_support` - (Optional) If the image is configured for NitroTPM support, the value is `v2.0`. For more information, see [NitroTPM](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/nitrotpm.html) in the Amazon Elastic Compute Cloud User Guide.
+* `imds_support` - (Optional) If EC2 instances started from this image should require the use of the Instance Metadata Service V2 (IMDSv2), set this argument to `v2.0`. For more information, see [Configure instance metadata options for new instances](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-IMDS-new-instances.html#configure-IMDS-new-instances-ami-configuration).
+
+When `virtualization_type` is "paravirtual" the following additional arguments apply:
+
+* `image_location` - (Required) Path to an S3 object containing an image manifest, e.g., created
+  by the `ec2-upload-bundle` command in the EC2 command line tools.
+* `kernel_id` - (Required) ID of the kernel image (AKI) that will be used as the paravirtual
+  kernel in created instances.
+* `ramdisk_id` - (Optional) ID of an initrd image (ARI) that will be used when booting the
+  created instances.
+
+When `virtualization_type` is "hvm" the following additional arguments apply:
+
+* `sriov_net_support` - (Optional) When set to "simple" (the default), enables enhanced networking
+  for created instances. No other value is supported at this time.
+
+Nested `ebs_block_device` blocks have the following structure:
+
+* `device_name` - (Required) Path at which the device is exposed to created instances.
+* `delete_on_termination` - (Optional) Boolean controlling whether the EBS volumes created to
+  support each created instance will be deleted once that instance is terminated.
+* `encrypted` - (Optional) Boolean controlling whether the created EBS volumes will be encrypted. Can't be used with `snapshot_id`.
+* `iops` - (Required only when `volume_type` is `io1` or `io2`) Number of I/O operations per second the
+  created volumes will support.
+* `snapshot_id` - (Optional) ID of an EBS snapshot that will be used to initialize the created
+  EBS volumes. If set, the `volume_size` attribute must be at least as large as the referenced
+  snapshot.
+* `throughput` - (Optional) Throughput that the EBS volume supports, in MiB/s. Only valid for `volume_type` of `gp3`.
+* `volume_size` - (Required unless `snapshot_id` is set) Size of created volumes in GiB.
+  If `snapshot_id` is set and `volume_size` is omitted then the volume will have the same size
+  as the selected snapshot.
+* `volume_type` - (Optional) Type of EBS volume to create. Can be `standard`, `gp2`, `gp3`, `io1`, `io2`, `sc1` or `st1` (Default: `standard`).
+* `outpost_arn` - (Optional) ARN of the Outpost on which the snapshot is stored.
+
+~> **Note:** You can specify `encrypted` or `snapshot_id` but not both.
+
+Nested `ephemeral_block_device` blocks have the following structure:
+
+* `device_name` - (Required) Path at which the device is exposed to created instances.
+* `virtual_name` - (Required) Name for the ephemeral device, of the form "ephemeralN" where
+  *N* is a volume number starting from zero.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the AMI.
+* `id` - ID of the created AMI.
+* `owner_id` - AWS account ID of the image owner.
+* `root_snapshot_id` - Snapshot ID for the root volume (for EBS-backed AMIs)
+* `usage_operation` - Operation of the Amazon EC2 instance and the billing code that is associated with the AMI.
+* `platform_details` - Platform details associated with the billing code of the AMI.
+* `image_owner_alias` - AWS account alias (for example, amazon, self) or the AWS account ID of the AMI owner.
+* `image_type` - Type of image.
+* `hypervisor` - Hypervisor type of the image.
+* `platform` - This value is set to windows for Windows AMIs; otherwise, it is blank.
+* `public` - Whether the image has public launch permissions.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `40m`)
+* `update` - (Default `40m`)
+* `delete` - (Default `90m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_ami` using the ID of the AMI. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_ami` using the ID of the AMI. For example:
+
+```console
+% terraform import aws_ami.example ami-12345678
+```
+
+<!-- cache-key: cdktf-0.18.0 input-07ad6907bcdf710f44e4490525952f2744e1fd913c106b86670941ed753bd143 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ami_copy.html.markdown b/website/docs/cdktf/python/r/ami_copy.html.markdown
new file mode 100644
index 00000000000..da19431e460
--- /dev/null
+++ b/website/docs/cdktf/python/r/ami_copy.html.markdown
@@ -0,0 +1,86 @@
+---
+subcategory: "EC2 (Elastic Compute Cloud)"
+layout: "aws"
+page_title: "AWS: aws_ami_copy"
+description: |-
+  Duplicates an existing Amazon Machine Image (AMI)
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ami_copy
+
+The "AMI copy" resource allows duplication of an Amazon Machine Image (AMI),
+including cross-region copies.
+
+If the source AMI has associated EBS snapshots, those will also be duplicated
+along with the AMI.
+
+This is useful for taking a single AMI provisioned in one region and making
+it available in another for a multi-region deployment.
+
+Copying an AMI can take several minutes. The creation of this resource will
+block until the new AMI is available for use on new instances.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ami_copy import AmiCopy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AmiCopy(self, "example",
+            description="A copy of ami-xxxxxxxx",
+            name="terraform-example",
+            source_ami_id="ami-xxxxxxxx",
+            source_ami_region="us-west-1",
+            tags={
+                "Name": "HelloWorld"
+            }
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) Region-unique name for the AMI.
+* `source_ami_id` - (Required) Id of the AMI to copy. This id must be valid in the region
+  given by `source_ami_region`.
+* `source_ami_region` - (Required) Region from which the AMI will be copied. This may be the
+  same as the AWS provider region in order to create a copy within the same region.
+* `destination_outpost_arn` - (Optional) ARN of the Outpost to which to copy the AMI.
+  Only specify this parameter when copying an AMI from an AWS Region to an Outpost. The AMI must be in the Region of the destination Outpost.  
+* `encrypted` - (Optional) Whether the destination snapshots of the copied image should be encrypted. Defaults to `false`
+* `kms_key_id` - (Optional) Full ARN of the KMS Key to use when encrypting the snapshots of an image during a copy operation. If not specified, then the default AWS KMS Key will be used
+* `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+This resource also exposes the full set of arguments from the [`aws_ami`](ami.html) resource.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the AMI.
+* `id` - ID of the created AMI.
+
+This resource also exports a full set of attributes corresponding to the arguments of the
+[`aws_ami`](/docs/providers/aws/r/ami.html) resource, allowing the properties of the created AMI to be used elsewhere in the
+configuration.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `40m`)
+* `update` - (Default `40m`)
+* `delete` - (Default `90m`)
+
+<!-- cache-key: cdktf-0.18.0 input-24f70ab5d03ce5421bd9ce27fd5b5602c0ac4eedfab0b82ddfc7fec0c10806cf -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ami_from_instance.html.markdown b/website/docs/cdktf/python/r/ami_from_instance.html.markdown
new file mode 100644
index 00000000000..572c113cd42
--- /dev/null
+++ b/website/docs/cdktf/python/r/ami_from_instance.html.markdown
@@ -0,0 +1,82 @@
+---
+subcategory: "EC2 (Elastic Compute Cloud)"
+layout: "aws"
+page_title: "AWS: aws_ami_from_instance"
+description: |-
+  Creates an Amazon Machine Image (AMI) from an EBS-backed EC2 instance
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ami_from_instance
+
+The "AMI from instance" resource allows the creation of an Amazon Machine
+Image (AMI) modelled after an existing EBS-backed EC2 instance.
+
+The created AMI will refer to implicitly-created snapshots of the instance's
+EBS volumes and mimick its assigned block device configuration at the time
+the resource is created.
+
+This resource is best applied to an instance that is stopped when this instance
+is created, so that the contents of the created image are predictable. When
+applied to an instance that is running, *the instance will be stopped before taking
+the snapshots and then started back up again*, resulting in a period of
+downtime.
+
+Note that the source instance is inspected only at the initial creation of this
+resource. Ongoing updates to the referenced instance will not be propagated into
+the generated AMI. Users may taint or otherwise recreate the resource in order
+to produce a fresh snapshot.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ami_from_instance import AmiFromInstance
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AmiFromInstance(self, "example",
+            name="terraform-example",
+            source_instance_id="i-xxxxxxxx"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) Region-unique name for the AMI.
+* `source_instance_id` - (Required) ID of the instance to use as the basis of the AMI.
+* `snapshot_without_reboot` - (Optional) Boolean that overrides the behavior of stopping
+  the instance before snapshotting. This is risky since it may cause a snapshot of an
+  inconsistent filesystem state, but can be used to avoid downtime if the user otherwise
+  guarantees that no filesystem writes will be underway at the time of snapshot.
+* `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `40m`)
+* `update` - (Default `40m`)
+* `delete` - (Default `90m`)
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the AMI.
+* `id` - ID of the created AMI.
+
+This resource also exports a full set of attributes corresponding to the arguments of the
+[`aws_ami`](/docs/providers/aws/r/ami.html) resource, allowing the properties of the created AMI to be used elsewhere in the
+configuration.
+
+<!-- cache-key: cdktf-0.18.0 input-d3b464f0179fdca5ee710daa9220402ec177617c9090c92a91af04fa0dca1ffa -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ami_launch_permission.html.markdown b/website/docs/cdktf/python/r/ami_launch_permission.html.markdown
new file mode 100644
index 00000000000..c5fc72f7a9d
--- /dev/null
+++ b/website/docs/cdktf/python/r/ami_launch_permission.html.markdown
@@ -0,0 +1,114 @@
+---
+subcategory: "EC2 (Elastic Compute Cloud)"
+layout: "aws"
+page_title: "AWS: aws_ami_launch_permission"
+description: |-
+  Adds a launch permission to an Amazon Machine Image (AMI).
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ami_launch_permission
+
+Adds a launch permission to an Amazon Machine Image (AMI).
+
+## Example Usage
+
+### AWS Account ID
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ami_launch_permission import AmiLaunchPermission
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AmiLaunchPermission(self, "example",
+            account_id="123456789012",
+            image_id="ami-12345678"
+        )
+```
+
+### Public Access
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ami_launch_permission import AmiLaunchPermission
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AmiLaunchPermission(self, "example",
+            group="all",
+            image_id="ami-12345678"
+        )
+```
+
+### Organization Access
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ami_launch_permission import AmiLaunchPermission
+from imports.aws.data_aws_organizations_organization import DataAwsOrganizationsOrganization
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        current = DataAwsOrganizationsOrganization(self, "current")
+        AmiLaunchPermission(self, "example",
+            image_id="ami-12345678",
+            organization_arn=Token.as_string(current.arn)
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `account_id` - (Optional) AWS account ID for the launch permission.
+* `group` - (Optional) Name of the group for the launch permission. Valid values: `"all"`.
+* `image_id` - (Required) ID of the AMI.
+* `organization_arn` - (Optional) ARN of an organization for the launch permission.
+* `organizational_unit_arn` - (Optional) ARN of an organizational unit for the launch permission.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Launch permission ID.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AMI Launch Permissions using `[ACCOUNT-ID|GROUP-NAME|ORGANIZATION-ARN|ORGANIZATIONAL-UNIT-ARN]/IMAGE-ID`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import AMI Launch Permissions using `[ACCOUNT-ID|GROUP-NAME|ORGANIZATION-ARN|ORGANIZATIONAL-UNIT-ARN]/IMAGE-ID`. For example:
+
+```console
+% terraform import aws_ami_launch_permission.example 123456789012/ami-12345678
+```
+
+<!-- cache-key: cdktf-0.18.0 input-a0902093918e0a418db9b2fc23c95e8777db95ce86c83b3b547f718d788c6648 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/amplify_app.html.markdown b/website/docs/cdktf/python/r/amplify_app.html.markdown
new file mode 100644
index 00000000000..aab5d0b8276
--- /dev/null
+++ b/website/docs/cdktf/python/r/amplify_app.html.markdown
@@ -0,0 +1,245 @@
+---
+subcategory: "Amplify"
+layout: "aws"
+page_title: "AWS: aws_amplify_app"
+description: |-
+  Provides an Amplify App resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_amplify_app
+
+Provides an Amplify App resource, a fullstack serverless app hosted on the [AWS Amplify Console](https://docs.aws.amazon.com/amplify/latest/userguide/welcome.html).
+
+~> **Note:** When you create/update an Amplify App from Terraform, you may end up with the error "BadRequestException: You should at least provide one valid token" because of authentication issues. See the section "Repository with Tokens" below.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.amplify_app import AmplifyApp
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AmplifyApp(self, "example",
+            build_spec="version: 0.1\nfrontend:\n  phases:\n    preBuild:\n      commands:\n        - yarn install\n    build:\n      commands:\n        - yarn run build\n  artifacts:\n    baseDirectory: build\n    files:\n      - '**/*'\n  cache:\n    paths:\n      - node_modules/**/*\n\n",
+            custom_rule=[AmplifyAppCustomRule(
+                source="/<*>",
+                status="404",
+                target="/index.html"
+            )
+            ],
+            environment_variables={
+                "ENV": "test"
+            },
+            name="example",
+            repository="https://github.com/example/app"
+        )
+```
+
+### Repository with Tokens
+
+If you create a new Amplify App with the `repository` argument, you also need to set `oauth_token` or `access_token` for authentication. For GitHub, get a [personal access token](https://help.github.com/en/github/authenticating-to-github/creating-a-personal-access-token-for-the-command-line) and set `access_token` as follows:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.amplify_app import AmplifyApp
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AmplifyApp(self, "example",
+            access_token="...",
+            name="example",
+            repository="https://github.com/example/app"
+        )
+```
+
+You can omit `access_token` if you import an existing Amplify App created by the Amplify Console (using OAuth for authentication).
+
+### Auto Branch Creation
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.amplify_app import AmplifyApp
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AmplifyApp(self, "example",
+            auto_branch_creation_config=AmplifyAppAutoBranchCreationConfig(
+                enable_auto_build=True
+            ),
+            auto_branch_creation_patterns=["*", "*/**"],
+            enable_auto_branch_creation=True,
+            name="example"
+        )
+```
+
+### Basic Authorization
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.amplify_app import AmplifyApp
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AmplifyApp(self, "example",
+            basic_auth_credentials=Token.as_string(
+                Fn.base64encode("username1:password1")),
+            enable_basic_auth=True,
+            name="example"
+        )
+```
+
+### Rewrites and Redirects
+
+```terraform
+resource "aws_amplify_app" "example" {
+  name = "example"
+
+  # Reverse Proxy Rewrite for API requests
+  # https://docs.aws.amazon.com/amplify/latest/userguide/redirects.html#reverse-proxy-rewrite
+  custom_rule {
+    source = "/api/<*>"
+    status = "200"
+    target = "https://api.example.com/api/<*>"
+  }
+
+  # Redirects for Single Page Web Apps (SPA)
+  # https://docs.aws.amazon.com/amplify/latest/userguide/redirects.html#redirects-for-single-page-web-apps-spa
+  custom_rule {
+    source = "</^[^.]+$|\\.(?!(css|gif|ico|jpg|js|png|txt|svg|woff|ttf|map|json)$)([^.]+$)/>"
+    status = "200"
+    target = "/index.html"
+  }
+}
+```
+
+### Custom Image
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.amplify_app import AmplifyApp
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AmplifyApp(self, "example",
+            environment_variables={
+                "__cUSTOM__iMAGE": "node:16"
+            },
+            name="example"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) Name for an Amplify app.
+* `access_token` - (Optional) Personal access token for a third-party source control system for an Amplify app. The personal access token is used to create a webhook and a read-only deploy key. The token is not stored.
+* `auto_branch_creation_config` - (Optional) Automated branch creation configuration for an Amplify app. An `auto_branch_creation_config` block is documented below.
+* `auto_branch_creation_patterns` - (Optional) Automated branch creation glob patterns for an Amplify app.
+* `basic_auth_credentials` - (Optional) Credentials for basic authorization for an Amplify app.
+* `build_spec` - (Optional) The [build specification](https://docs.aws.amazon.com/amplify/latest/userguide/build-settings.html) (build spec) for an Amplify app.
+* `custom_rule` - (Optional) Custom rewrite and redirect rules for an Amplify app. A `custom_rule` block is documented below.
+* `description` - (Optional) Description for an Amplify app.
+* `enable_auto_branch_creation` - (Optional) Enables automated branch creation for an Amplify app.
+* `enable_basic_auth` - (Optional) Enables basic authorization for an Amplify app. This will apply to all branches that are part of this app.
+* `enable_branch_auto_build` - (Optional) Enables auto-building of branches for the Amplify App.
+* `enable_branch_auto_deletion` - (Optional) Automatically disconnects a branch in the Amplify Console when you delete a branch from your Git repository.
+* `environment_variables` - (Optional) Environment variables map for an Amplify app.
+* `iam_service_role_arn` - (Optional) AWS Identity and Access Management (IAM) service role for an Amplify app.
+* `oauth_token` - (Optional) OAuth token for a third-party source control system for an Amplify app. The OAuth token is used to create a webhook and a read-only deploy key. The OAuth token is not stored.
+* `platform` - (Optional) Platform or framework for an Amplify app. Valid values: `WEB`, `WEB_COMPUTE`. Default value: `WEB`.
+* `repository` - (Optional) Repository for an Amplify app.
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+An `auto_branch_creation_config` block supports the following arguments:
+
+* `basic_auth_credentials` - (Optional) Basic authorization credentials for the autocreated branch.
+* `build_spec` - (Optional) Build specification (build spec) for the autocreated branch.
+* `enable_auto_build` - (Optional) Enables auto building for the autocreated branch.
+* `enable_basic_auth` - (Optional) Enables basic authorization for the autocreated branch.
+* `enable_performance_mode` - (Optional) Enables performance mode for the branch.
+* `enable_pull_request_preview` - (Optional) Enables pull request previews for the autocreated branch.
+* `environment_variables` - (Optional) Environment variables for the autocreated branch.
+* `framework` - (Optional) Framework for the autocreated branch.
+* `pull_request_environment_name` - (Optional) Amplify environment name for the pull request.
+* `stage` - (Optional) Describes the current stage for the autocreated branch. Valid values: `PRODUCTION`, `BETA`, `DEVELOPMENT`, `EXPERIMENTAL`, `PULL_REQUEST`.
+
+A `custom_rule` block supports the following arguments:
+
+* `condition` - (Optional) Condition for a URL rewrite or redirect rule, such as a country code.
+* `source` - (Required) Source pattern for a URL rewrite or redirect rule.
+* `status` - (Optional) Status code for a URL rewrite or redirect rule. Valid values: `200`, `301`, `302`, `404`, `404-200`.
+* `target` - (Required) Target pattern for a URL rewrite or redirect rule.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Amplify app.
+* `default_domain` - Default domain for the Amplify app.
+* `id` - Unique ID of the Amplify app.
+* `production_branch` - Describes the information about a production branch for an Amplify app. A `production_branch` block is documented below.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+A `production_branch` block supports the following attributes:
+
+* `branch_name` - Branch name for the production branch.
+* `last_deploy_time` - Last deploy time of the production branch.
+* `status` - Status of the production branch.
+* `thumbnail_url` - Thumbnail URL for the production branch.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Amplify App using Amplify App ID (appId). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Amplify App using Amplify App ID (appId). For example:
+
+```console
+% terraform import aws_amplify_app.example d2ypk4k47z8u6
+```
+
+App ID can be obtained from App ARN (e.g., `arn:aws:amplify:us-east-1:12345678:apps/d2ypk4k47z8u6`).
+
+<!-- cache-key: cdktf-0.18.0 input-aa2222e19fec5cd81db6ed1903530b6a04721809fe7d885a605a693c961c09a6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/amplify_backend_environment.html.markdown b/website/docs/cdktf/python/r/amplify_backend_environment.html.markdown
new file mode 100644
index 00000000000..23d31412708
--- /dev/null
+++ b/website/docs/cdktf/python/r/amplify_backend_environment.html.markdown
@@ -0,0 +1,78 @@
+---
+subcategory: "Amplify"
+layout: "aws"
+page_title: "AWS: aws_amplify_backend_environment"
+description: |-
+  Provides an Amplify Backend Environment resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_amplify_backend_environment
+
+Provides an Amplify Backend Environment resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.amplify_app import AmplifyApp
+from imports.aws.amplify_backend_environment import AmplifyBackendEnvironment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = AmplifyApp(self, "example",
+            name="example"
+        )
+        aws_amplify_backend_environment_example = AmplifyBackendEnvironment(self, "example_1",
+            app_id=example.id,
+            deployment_artifacts="app-example-deployment",
+            environment_name="example",
+            stack_name="amplify-app-example"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_amplify_backend_environment_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `app_id` - (Required) Unique ID for an Amplify app.
+* `environment_name` - (Required) Name for the backend environment.
+* `deployment_artifacts` - (Optional) Name of deployment artifacts.
+* `stack_name` - (Optional) AWS CloudFormation stack name of a backend environment.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN for a backend environment that is part of an Amplify app.
+* `id` - Unique ID of the Amplify backend environment.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Amplify backend environment using `app_id` and `environment_name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Amplify backend environment using `app_id` and `environment_name`. For example:
+
+```console
+% terraform import aws_amplify_backend_environment.example d2ypk4k47z8u6/example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-c0149c5f68fd1dca66f72427d6f00bb2e21d8385c7bdf9671e71789ce006dd4d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/amplify_branch.html.markdown b/website/docs/cdktf/python/r/amplify_branch.html.markdown
new file mode 100644
index 00000000000..b4d32ebe66a
--- /dev/null
+++ b/website/docs/cdktf/python/r/amplify_branch.html.markdown
@@ -0,0 +1,220 @@
+---
+subcategory: "Amplify"
+layout: "aws"
+page_title: "AWS: aws_amplify_branch"
+description: |-
+  Provides an Amplify Branch resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_amplify_branch
+
+Provides an Amplify Branch resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.amplify_app import AmplifyApp
+from imports.aws.amplify_branch import AmplifyBranch
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = AmplifyApp(self, "example",
+            name="app"
+        )
+        AmplifyBranch(self, "master",
+            app_id=example.id,
+            branch_name="master",
+            environment_variables={
+                "REACT_APP_API_SERVER": "https://api.example.com"
+            },
+            framework="React",
+            stage="PRODUCTION"
+        )
+```
+
+### Basic Authentication
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.amplify_app import AmplifyApp
+from imports.aws.amplify_branch import AmplifyBranch
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = AmplifyApp(self, "example",
+            name="app"
+        )
+        AmplifyBranch(self, "master",
+            app_id=example.id,
+            basic_auth_credentials=Token.as_string(
+                Fn.base64encode("username:password")),
+            branch_name="master",
+            enable_basic_auth=True
+        )
+```
+
+### Notifications
+
+Amplify Console uses EventBridge (formerly known as CloudWatch Events) and SNS for email notifications.  To implement the same functionality, you need to set `enable_notification` in a `aws_amplify_branch` resource, as well as creating an EventBridge Rule, an SNS topic, and SNS subscriptions.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.amplify_app import AmplifyApp
+from imports.aws.amplify_branch import AmplifyBranch
+from imports.aws.cloudwatch_event_rule import CloudwatchEventRule
+from imports.aws.cloudwatch_event_target import CloudwatchEventTarget
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.sns_topic import SnsTopic
+from imports.aws.sns_topic_policy import SnsTopicPolicy
+from imports.aws.sns_topic_subscription import SnsTopicSubscription
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = AmplifyApp(self, "example",
+            name="app"
+        )
+        master = AmplifyBranch(self, "master",
+            app_id=example.id,
+            branch_name="master",
+            enable_notification=True
+        )
+        amplify_app_master = CloudwatchEventRule(self, "amplify_app_master",
+            description="AWS Amplify build notifications for :  App: ${" + app.id + "} Branch: ${" + master.branch_name + "}",
+            event_pattern=Token.as_string(
+                Fn.jsonencode({
+                    "detail": {
+                        "app_id": [example.id],
+                        "branch_name": [master.branch_name],
+                        "job_status": ["SUCCEED", "FAILED", "STARTED"]
+                    },
+                    "detail-type": ["Amplify Deployment Status Change"],
+                    "source": ["aws.amplify"]
+                })),
+            name="amplify-${" + app.id + "}-${" + master.branch_name + "}-branch-notification"
+        )
+        aws_sns_topic_amplify_app_master = SnsTopic(self, "amplify_app_master_3",
+            name="amplify-${" + app.id + "}_${" + master.branch_name + "}"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_sns_topic_amplify_app_master.override_logical_id("amplify_app_master")
+        SnsTopicSubscription(self, "this",
+            endpoint="user@acme.com",
+            protocol="email",
+            topic_arn=Token.as_string(aws_sns_topic_amplify_app_master.arn)
+        )
+        data_aws_iam_policy_document_amplify_app_master =
+        DataAwsIamPolicyDocument(self, "amplify_app_master_5",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["SNS:Publish"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["events.amazonaws.com"],
+                    type="Service"
+                )
+                ],
+                resources=[Token.as_string(aws_sns_topic_amplify_app_master.arn)],
+                sid="Allow_Publish_Events ${" + master.arn + "}"
+            )
+            ]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_iam_policy_document_amplify_app_master.override_logical_id("amplify_app_master")
+        aws_cloudwatch_event_target_amplify_app_master = CloudwatchEventTarget(self, "amplify_app_master_6",
+            arn=Token.as_string(aws_sns_topic_amplify_app_master.arn),
+            input_transformer=CloudwatchEventTargetInputTransformer(
+                input_paths={
+                    "app_id": "$.detail.appId",
+                    "branch": "$.detail.branchName",
+                    "job_id": "$.detail.jobId",
+                    "region": "$.region",
+                    "status": "$.detail.jobStatus"
+                },
+                input_template="\\\"Build notification from the AWS Amplify Console for app: https://<branch>.<appId>.amplifyapp.com/. Your build status is <status>. Go to https://console.aws.amazon.com/amplify/home?region=<region>#<appId>/<branch>/<jobId> to view details on your build. \\\""
+            ),
+            rule=amplify_app_master.name,
+            target_id=master.branch_name
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_cloudwatch_event_target_amplify_app_master.override_logical_id("amplify_app_master")
+        aws_sns_topic_policy_amplify_app_master = SnsTopicPolicy(self, "amplify_app_master_7",
+            arn=Token.as_string(aws_sns_topic_amplify_app_master.arn),
+            policy=Token.as_string(data_aws_iam_policy_document_amplify_app_master.json)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_sns_topic_policy_amplify_app_master.override_logical_id("amplify_app_master")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `app_id` - (Required) Unique ID for an Amplify app.
+* `branch_name` - (Required) Name for the branch.
+* `backend_environment_arn` - (Optional) ARN for a backend environment that is part of an Amplify app.
+* `basic_auth_credentials` - (Optional) Basic authorization credentials for the branch.
+* `description` - (Optional) Description for the branch.
+* `display_name` - (Optional) Display name for a branch. This is used as the default domain prefix.
+* `enable_auto_build` - (Optional) Enables auto building for the branch.
+* `enable_basic_auth` - (Optional) Enables basic authorization for the branch.
+* `enable_notification` - (Optional) Enables notifications for the branch.
+* `enable_performance_mode` - (Optional) Enables performance mode for the branch.
+* `enable_pull_request_preview` - (Optional) Enables pull request previews for this branch.
+* `environment_variables` - (Optional) Environment variables for the branch.
+* `framework` - (Optional) Framework for the branch.
+* `pull_request_environment_name` - (Optional) Amplify environment name for the pull request.
+* `stage` - (Optional) Describes the current stage for the branch. Valid values: `PRODUCTION`, `BETA`, `DEVELOPMENT`, `EXPERIMENTAL`, `PULL_REQUEST`.
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `ttl` - (Optional) Content Time To Live (TTL) for the website in seconds.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN for the branch.
+* `associated_resources` - A list of custom resources that are linked to this branch.
+* `custom_domains` - Custom domains for the branch.
+* `destination_branch` - Destination branch if the branch is a pull request branch.
+* `source_branch` - Source branch if the branch is a pull request branch.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Amplify branch using `app_id` and `branch_name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Amplify branch using `app_id` and `branch_name`. For example:
+
+```console
+% terraform import aws_amplify_branch.master d2ypk4k47z8u6/master
+```
+
+<!-- cache-key: cdktf-0.18.0 input-18bb34f7ab2ddc6f2adc5f5bfbff608bb9af62203731b97b751ed9bb930f797a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/amplify_domain_association.html.markdown b/website/docs/cdktf/python/r/amplify_domain_association.html.markdown
new file mode 100644
index 00000000000..9f3db19ff0d
--- /dev/null
+++ b/website/docs/cdktf/python/r/amplify_domain_association.html.markdown
@@ -0,0 +1,106 @@
+---
+subcategory: "Amplify"
+layout: "aws"
+page_title: "AWS: aws_amplify_domain_association"
+description: |-
+  Provides an Amplify Domain Association resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_amplify_domain_association
+
+Provides an Amplify Domain Association resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.amplify_app import AmplifyApp
+from imports.aws.amplify_branch import AmplifyBranch
+from imports.aws.amplify_domain_association import AmplifyDomainAssociation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = AmplifyApp(self, "example",
+            custom_rule=[AmplifyAppCustomRule(
+                source="https://example.com",
+                status="302",
+                target="https://www.example.com"
+            )
+            ],
+            name="app"
+        )
+        master = AmplifyBranch(self, "master",
+            app_id=example.id,
+            branch_name="master"
+        )
+        aws_amplify_domain_association_example = AmplifyDomainAssociation(self, "example_2",
+            app_id=example.id,
+            domain_name="example.com",
+            sub_domain=[AmplifyDomainAssociationSubDomain(
+                branch_name=master.branch_name,
+                prefix=""
+            ), AmplifyDomainAssociationSubDomain(
+                branch_name=master.branch_name,
+                prefix="www"
+            )
+            ]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_amplify_domain_association_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `app_id` - (Required) Unique ID for an Amplify app.
+* `domain_name` - (Required) Domain name for the domain association.
+* `enable_auto_sub_domain` - (Optional) Enables the automated creation of subdomains for branches.
+* `sub_domain` - (Required) Setting for the subdomain. Documented below.
+* `wait_for_verification` - (Optional) If enabled, the resource will wait for the domain association status to change to `PENDING_DEPLOYMENT` or `AVAILABLE`. Setting this to `false` will skip the process. Default: `true`.
+
+The `sub_domain` configuration block supports the following arguments:
+
+* `branch_name` - (Required) Branch name setting for the subdomain.
+* `prefix` - (Required) Prefix setting for the subdomain.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN for the domain association.
+* `certificate_verification_dns_record` - The DNS record for certificate verification.
+
+The `sub_domain` configuration block exports the following attributes:
+
+* `dns_record` - DNS record for the subdomain.
+* `verified` - Verified status of the subdomain.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Amplify domain association using `app_id` and `domain_name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Amplify domain association using `app_id` and `domain_name`. For example:
+
+```console
+% terraform import aws_amplify_domain_association.app d2ypk4k47z8u6/example.com
+```
+
+<!-- cache-key: cdktf-0.18.0 input-10844d85ea1b0809e4b08cd8168c429bf0c742ec4760985072b9f61b55e19893 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/amplify_webhook.html.markdown b/website/docs/cdktf/python/r/amplify_webhook.html.markdown
new file mode 100644
index 00000000000..38825601a86
--- /dev/null
+++ b/website/docs/cdktf/python/r/amplify_webhook.html.markdown
@@ -0,0 +1,81 @@
+---
+subcategory: "Amplify"
+layout: "aws"
+page_title: "AWS: aws_amplify_webhook"
+description: |-
+  Provides an Amplify Webhook resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_amplify_webhook
+
+Provides an Amplify Webhook resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.amplify_app import AmplifyApp
+from imports.aws.amplify_branch import AmplifyBranch
+from imports.aws.amplify_webhook import AmplifyWebhook
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = AmplifyApp(self, "example",
+            name="app"
+        )
+        master = AmplifyBranch(self, "master",
+            app_id=example.id,
+            branch_name="master"
+        )
+        aws_amplify_webhook_master = AmplifyWebhook(self, "master_2",
+            app_id=example.id,
+            branch_name=master.branch_name,
+            description="triggermaster"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_amplify_webhook_master.override_logical_id("master")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `app_id` - (Required) Unique ID for an Amplify app.
+* `branch_name` - (Required) Name for a branch that is part of the Amplify app.
+* `description` - (Optional) Description for a webhook.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN for the webhook.
+* `url` - URL of the webhook.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Amplify webhook using a webhook ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Amplify webhook using a webhook ID. For example:
+
+```console
+% terraform import aws_amplify_webhook.master a26b22a0-748b-4b57-b9a0-ae7e601fe4b1
+```
+
+<!-- cache-key: cdktf-0.18.0 input-3bb11fa5debeb312ce5961222720872aa6f83d12dbd79b3d00fffa77e117baba -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/api_gateway_account.html.markdown b/website/docs/cdktf/python/r/api_gateway_account.html.markdown
new file mode 100644
index 00000000000..32023380f1c
--- /dev/null
+++ b/website/docs/cdktf/python/r/api_gateway_account.html.markdown
@@ -0,0 +1,111 @@
+---
+subcategory: "API Gateway"
+layout: "aws"
+page_title: "AWS: aws_api_gateway_account"
+description: |-
+  Provides a settings of an API Gateway Account.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_api_gateway_account
+
+Provides a settings of an API Gateway Account. Settings is applied region-wide per `provider` block.
+
+-> **Note:** As there is no API method for deleting account settings or resetting it to defaults, destroying this resource will keep your account settings intact
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.api_gateway_account import ApiGatewayAccount
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.iam_role import IamRole
+from imports.aws.iam_role_policy import IamRolePolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        assume_role = DataAwsIamPolicyDocument(self, "assume_role",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["sts:AssumeRole"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["apigateway.amazonaws.com"],
+                    type="Service"
+                )
+                ]
+            )
+            ]
+        )
+        cloudwatch = DataAwsIamPolicyDocument(self, "cloudwatch",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["logs:CreateLogGroup", "logs:CreateLogStream", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:PutLogEvents", "logs:GetLogEvents", "logs:FilterLogEvents"
+                ],
+                effect="Allow",
+                resources=["*"]
+            )
+            ]
+        )
+        aws_iam_role_cloudwatch = IamRole(self, "cloudwatch_2",
+            assume_role_policy=Token.as_string(assume_role.json),
+            name="api_gateway_cloudwatch_global"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_role_cloudwatch.override_logical_id("cloudwatch")
+        aws_iam_role_policy_cloudwatch = IamRolePolicy(self, "cloudwatch_3",
+            name="default",
+            policy=Token.as_string(cloudwatch.json),
+            role=Token.as_string(aws_iam_role_cloudwatch.id)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_role_policy_cloudwatch.override_logical_id("cloudwatch")
+        ApiGatewayAccount(self, "demo",
+            cloudwatch_role_arn=Token.as_string(aws_iam_role_cloudwatch.arn)
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `cloudwatch_role_arn` - (Optional) ARN of an IAM role for CloudWatch (to allow logging & monitoring). See more [in AWS Docs](https://docs.aws.amazon.com/apigateway/latest/developerguide/how-to-stage-settings.html#how-to-stage-settings-console). Logging & monitoring can be enabled/disabled and otherwise tuned on the API Gateway Stage level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `api_key_version` - The version of the API keys used for the account.
+* `throttle_settings` - Account-Level throttle settings. See exported fields below.
+* `features` - A list of features supported for the account.
+
+`throttle_settings` block exports the following:
+
+* `burst_limit` - Absolute maximum number of times API Gateway allows the API to be called per second (RPS).
+* `rate_limit` - Number of times API Gateway allows the API to be called per second on average (RPS).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import API Gateway Accounts using the word `api-gateway-account`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import API Gateway Accounts using the word `api-gateway-account`. For example:
+
+```console
+% terraform import aws_api_gateway_account.demo api-gateway-account
+```
+
+<!-- cache-key: cdktf-0.18.0 input-2c3031685ea1cacb5723c6c52399155d732bc5bb2d7fcfa71a3cc55a2bf24db5 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/api_gateway_api_key.html.markdown b/website/docs/cdktf/python/r/api_gateway_api_key.html.markdown
new file mode 100644
index 00000000000..16f53b72810
--- /dev/null
+++ b/website/docs/cdktf/python/r/api_gateway_api_key.html.markdown
@@ -0,0 +1,76 @@
+---
+subcategory: "API Gateway"
+layout: "aws"
+page_title: "AWS: aws_api_gateway_api_key"
+description: |-
+  Provides an API Gateway API Key.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_api_gateway_api_key
+
+Provides an API Gateway API Key.
+
+~> **NOTE:** Since the API Gateway usage plans feature was launched on August 11, 2016, usage plans are now **required** to associate an API key with an API stage.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.api_gateway_api_key import ApiGatewayApiKey
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ApiGatewayApiKey(self, "example",
+            name="example"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) Name of the API key.
+* `customer_id` - (Required) An Amazon Web Services Marketplace customer identifier, when integrating with the Amazon Web Services SaaS Marketplace.
+* `description` - (Optional) API key description. Defaults to "Managed by Terraform".
+* `enabled` - (Optional) Whether the API key can be used by callers. Defaults to `true`.
+* `value` - (Optional) Value of the API key. If specified, the value must be an alphanumeric string between 20 and 128 characters. If not specified, it will be automatically generated by AWS on creation.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the API key
+* `created_date` - Creation date of the API key
+* `last_updated_date` - Last update date of the API key
+* `arn` - ARN
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import API Gateway Keys using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import API Gateway Keys using the `id`. For example:
+
+```console
+% terraform import aws_api_gateway_api_key.example 8bklk8bl1k3sB38D9B3l0enyWT8c09B30lkq0blk
+```
+
+<!-- cache-key: cdktf-0.18.0 input-22b69fb8534ef570b5d1e520c78e2afd9a75df34ce74287081d34950badd6ce6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/api_gateway_authorizer.html.markdown b/website/docs/cdktf/python/r/api_gateway_authorizer.html.markdown
new file mode 100644
index 00000000000..912ecc44cd8
--- /dev/null
+++ b/website/docs/cdktf/python/r/api_gateway_authorizer.html.markdown
@@ -0,0 +1,144 @@
+---
+subcategory: "API Gateway"
+layout: "aws"
+page_title: "AWS: aws_api_gateway_authorizer"
+description: |-
+  Provides an API Gateway Authorizer.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_api_gateway_authorizer
+
+Provides an API Gateway Authorizer.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, Fn, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.api_gateway_authorizer import ApiGatewayAuthorizer
+from imports.aws.api_gateway_rest_api import ApiGatewayRestApi
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.iam_role import IamRole
+from imports.aws.iam_role_policy import IamRolePolicy
+from imports.aws.lambda_function import LambdaFunction
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        demo = ApiGatewayRestApi(self, "demo",
+            name="auth-demo"
+        )
+        invocation_assume_role = DataAwsIamPolicyDocument(self, "invocation_assume_role",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["sts:AssumeRole"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["apigateway.amazonaws.com"],
+                    type="Service"
+                )
+                ]
+            )
+            ]
+        )
+        lambda_assume_role = DataAwsIamPolicyDocument(self, "lambda_assume_role",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["sts:AssumeRole"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["lambda.amazonaws.com"],
+                    type="Service"
+                )
+                ]
+            )
+            ]
+        )
+        invocation_role = IamRole(self, "invocation_role",
+            assume_role_policy=Token.as_string(invocation_assume_role.json),
+            name="api_gateway_auth_invocation",
+            path="/"
+        )
+        lambda_ = IamRole(self, "lambda",
+            assume_role_policy=Token.as_string(lambda_assume_role.json),
+            name="demo-lambda"
+        )
+        authorizer = LambdaFunction(self, "authorizer",
+            filename="lambda-function.zip",
+            function_name="api_gateway_authorizer",
+            handler="exports.example",
+            role=lambda_.arn,
+            source_code_hash=Token.as_string(
+                Fn.filebase64sha256("lambda-function.zip"))
+        )
+        invocation_policy = DataAwsIamPolicyDocument(self, "invocation_policy",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["lambda:InvokeFunction"],
+                effect="Allow",
+                resources=[authorizer.arn]
+            )
+            ]
+        )
+        aws_api_gateway_authorizer_demo = ApiGatewayAuthorizer(self, "demo_7",
+            authorizer_credentials=invocation_role.arn,
+            authorizer_uri=authorizer.invoke_arn,
+            name="demo",
+            rest_api_id=demo.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_api_gateway_authorizer_demo.override_logical_id("demo")
+        aws_iam_role_policy_invocation_policy = IamRolePolicy(self, "invocation_policy_8",
+            name="default",
+            policy=Token.as_string(invocation_policy.json),
+            role=invocation_role.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_role_policy_invocation_policy.override_logical_id("invocation_policy")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `authorizer_uri` - (Optional, required for type `TOKEN`/`REQUEST`) Authorizer's Uniform Resource Identifier (URI). This must be a well-formed Lambda function URI in the form of `arn:aws:apigateway:{region}:lambda:path/{service_api}`,
+ e.g., `arn:aws:apigateway:us-west-2:lambda:path/2015-03-31/functions/arn:aws:lambda:us-west-2:012345678912:function:my-function/invocations`
+* `name` - (Required) Name of the authorizer
+* `rest_api_id` - (Required) ID of the associated REST API
+* `identity_source` - (Optional) Source of the identity in an incoming request. Defaults to `method.request.header.Authorization`. For `REQUEST` type, this may be a comma-separated list of values, including headers, query string parameters and stage variables - e.g., `"method.request.header.SomeHeaderName,method.request.querystring.SomeQueryStringName,stageVariables.SomeStageVariableName"`
+* `type` - (Optional) Type of the authorizer. Possible values are `TOKEN` for a Lambda function using a single authorization token submitted in a custom header, `REQUEST` for a Lambda function using incoming request parameters, or `COGNITO_USER_POOLS` for using an Amazon Cognito user pool. Defaults to `TOKEN`.
+* `authorizer_credentials` - (Optional) Credentials required for the authorizer. To specify an IAM Role for API Gateway to assume, use the IAM Role ARN.
+* `authorizer_result_ttl_in_seconds` - (Optional) TTL of cached authorizer results in seconds. Defaults to `300`.
+* `identity_validation_expression` - (Optional) Validation expression for the incoming identity. For `TOKEN` type, this value should be a regular expression. The incoming token from the client is matched against this expression, and will proceed if the token matches. If the token doesn't match, the client receives a 401 Unauthorized response.
+* `provider_arns` - (Optional, required for type `COGNITO_USER_POOLS`) List of the Amazon Cognito user pool ARNs. Each element is of this format: `arn:aws:cognito-idp:{region}:{account_id}:userpool/{user_pool_id}`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the API Gateway Authorizer
+* `id` - Authorizer identifier.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AWS API Gateway Authorizer using the `REST-API-ID/AUTHORIZER-ID`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import AWS API Gateway Authorizer using the `REST-API-ID/AUTHORIZER-ID`. For example:
+
+```console
+% terraform import aws_api_gateway_authorizer.authorizer 12345abcde/example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-2079e78abb2de34b252c2d1829bd6d6c7b5e8eea6a54c81a845e12111109c59f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/api_gateway_base_path_mapping.html.markdown b/website/docs/cdktf/python/r/api_gateway_base_path_mapping.html.markdown
new file mode 100644
index 00000000000..47c800f0f68
--- /dev/null
+++ b/website/docs/cdktf/python/r/api_gateway_base_path_mapping.html.markdown
@@ -0,0 +1,114 @@
+---
+subcategory: "API Gateway"
+layout: "aws"
+page_title: "AWS: aws_api_gateway_base_path_mapping"
+description: |-
+  Connects a custom domain with a deployed API
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_api_gateway_base_path_mapping
+
+Connects a custom domain name registered via `aws_api_gateway_domain_name`
+with a deployed API so that its methods can be called via the
+custom domain name.
+
+## Example Usage
+
+An end-to-end example of a REST API configured with OpenAPI can be found in the [`/examples/api-gateway-rest-api-openapi` directory within the GitHub repository](https://github.com/hashicorp/terraform-provider-aws/tree/main/examples/api-gateway-rest-api-openapi).
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.api_gateway_base_path_mapping import ApiGatewayBasePathMapping
+from imports.aws.api_gateway_domain_name import ApiGatewayDomainName
+from imports.aws.api_gateway_stage import ApiGatewayStage
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = ApiGatewayDomainName(self, "example",
+            certificate_body=Token.as_string(
+                Fn.file("${path.module}/example.com/example.crt")),
+            certificate_chain=Token.as_string(
+                Fn.file("${path.module}/example.com/ca.crt")),
+            certificate_name="example-api",
+            certificate_private_key=Token.as_string(
+                Fn.file("${path.module}/example.com/example.key")),
+            domain_name="example.com"
+        )
+        aws_api_gateway_stage_example = ApiGatewayStage(self, "example_1",
+            deployment_id=Token.as_string(aws_api_gateway_deployment_example.id),
+            rest_api_id=Token.as_string(aws_api_gateway_rest_api_example.id),
+            stage_name="example"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_api_gateway_stage_example.override_logical_id("example")
+        aws_api_gateway_base_path_mapping_example = ApiGatewayBasePathMapping(self, "example_2",
+            api_id=Token.as_string(aws_api_gateway_rest_api_example.id),
+            domain_name=example.domain_name,
+            stage_name=Token.as_string(aws_api_gateway_stage_example.stage_name)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_api_gateway_base_path_mapping_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `domain_name` - (Required) Already-registered domain name to connect the API to.
+* `api_id` - (Required) ID of the API to connect.
+* `stage_name` - (Optional) Name of a specific deployment stage to expose at the given path. If omitted, callers may select any stage by including its name as a path element after the base path.
+* `base_path` - (Optional) Path segment that must be prepended to the path when accessing the API via this mapping. If omitted, the API is exposed at the root of the given domain.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_api_gateway_base_path_mapping` using the domain name and base path. For example:
+
+For an empty `base_path` or, in other words, a root path (`/`):
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+For a non-root `base_path`:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_api_gateway_base_path_mapping` using the domain name and base path. For example:
+
+For an empty `base_path` or, in other words, a root path (`/`):
+
+```console
+% terraform import aws_api_gateway_base_path_mapping.example example.com/
+```
+
+For a non-root `base_path`:
+
+```console
+% terraform import aws_api_gateway_base_path_mapping.example example.com/base-path
+```
+
+<!-- cache-key: cdktf-0.18.0 input-7c630b1c026c451c91ce4be44cb571b40bd69a91e074917021e877a73f91c912 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/api_gateway_client_certificate.html.markdown b/website/docs/cdktf/python/r/api_gateway_client_certificate.html.markdown
new file mode 100644
index 00000000000..7b53129b7d1
--- /dev/null
+++ b/website/docs/cdktf/python/r/api_gateway_client_certificate.html.markdown
@@ -0,0 +1,71 @@
+---
+subcategory: "API Gateway"
+layout: "aws"
+page_title: "AWS: aws_api_gateway_client_certificate"
+description: |-
+  Provides an API Gateway Client Certificate.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_api_gateway_client_certificate
+
+Provides an API Gateway Client Certificate.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.api_gateway_client_certificate import ApiGatewayClientCertificate
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ApiGatewayClientCertificate(self, "demo",
+            description="My client certificate"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `description` - (Optional) Description of the client certificate.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Identifier of the client certificate.
+* `created_date` - Date when the client certificate was created.
+* `expiration_date` - Date when the client certificate will expire.
+* `pem_encoded_certificate` - The PEM-encoded public key of the client certificate.
+* `arn` - ARN
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import API Gateway Client Certificates using the id. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import API Gateway Client Certificates using the id. For example:
+
+```console
+% terraform import aws_api_gateway_client_certificate.demo ab1cqe
+```
+
+<!-- cache-key: cdktf-0.18.0 input-f5e9958abec817b82b925c0b36a7398f6252c227f18c1f61028418cabf76045c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/api_gateway_deployment.html.markdown b/website/docs/cdktf/python/r/api_gateway_deployment.html.markdown
new file mode 100644
index 00000000000..f59929259c2
--- /dev/null
+++ b/website/docs/cdktf/python/r/api_gateway_deployment.html.markdown
@@ -0,0 +1,190 @@
+---
+subcategory: "API Gateway"
+layout: "aws"
+page_title: "AWS: aws_api_gateway_deployment"
+description: |-
+  Manages an API Gateway REST Deployment.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_api_gateway_deployment
+
+Manages an API Gateway REST Deployment. A deployment is a snapshot of the REST API configuration. The deployment can then be published to callable endpoints via the [`aws_api_gateway_stage` resource](api_gateway_stage.html) and optionally managed further with the [`aws_api_gateway_base_path_mapping` resource](api_gateway_base_path_mapping.html), [`aws_api_gateway_domain_name` resource](api_gateway_domain_name.html), and [`aws_api_method_settings` resource](api_gateway_method_settings.html). For more information, see the [API Gateway Developer Guide](https://docs.aws.amazon.com/apigateway/latest/developerguide/how-to-deploy-api.html).
+
+To properly capture all REST API configuration in a deployment, this resource must have dependencies on all prior Terraform resources that manage resources/paths, methods, integrations, etc.
+
+* For REST APIs that are configured via OpenAPI specification ([`aws_api_gateway_rest_api` resource](api_gateway_rest_api.html) `body` argument), no special dependency setup is needed beyond referencing the  `id` attribute of that resource unless additional Terraform resources have further customized the REST API.
+* When the REST API configuration involves other Terraform resources ([`aws_api_gateway_integration` resource](api_gateway_integration.html), etc.), the dependency setup can be done with implicit resource references in the `triggers` argument or explicit resource references using the [resource `depends_on` meta-argument](https://www.terraform.io/docs/configuration/meta-arguments/depends_on.html). The `triggers` argument should be preferred over `depends_on`, since `depends_on` can only capture dependency ordering and will not cause the resource to recreate (redeploy the REST API) with upstream configuration changes.
+
+!> **WARNING:** We recommend using the [`aws_api_gateway_stage` resource](api_gateway_stage.html) instead of managing an API Gateway Stage via the `stage_name` argument of this resource. When this resource is recreated (REST API redeployment) with the `stage_name` configured, the stage is deleted and recreated. This will cause a temporary service interruption, increase Terraform plan differences, and can require a second Terraform apply to recreate any downstream stage configuration such as associated `aws_api_method_settings` resources.
+
+~> **NOTE:** Enable the [resource `lifecycle` configuration block `create_before_destroy` argument](https://www.terraform.io/language/meta-arguments/lifecycle#create_before_destroy) in this resource configuration to properly order redeployments in Terraform. Without enabling `create_before_destroy`, API Gateway can return errors such as `BadRequestException: Active stages pointing to this deployment must be moved or deleted` on recreation.
+
+## Example Usage
+
+### OpenAPI Specification
+
+An end-to-end example of a REST API configured with OpenAPI can be found in the [`/examples/api-gateway-rest-api-openapi` directory within the GitHub repository](https://github.com/hashicorp/terraform-provider-aws/tree/main/examples/api-gateway-rest-api-openapi).
+
+```terraform
+resource "aws_api_gateway_rest_api" "example" {
+  body = jsonencode({
+    openapi = "3.0.1"
+    info = {
+      title   = "example"
+      version = "1.0"
+    }
+    paths = {
+      "/path1" = {
+        get = {
+          x-amazon-apigateway-integration = {
+            httpMethod           = "GET"
+            payloadFormatVersion = "1.0"
+            type                 = "HTTP_PROXY"
+            uri                  = "https://ip-ranges.amazonaws.com/ip-ranges.json"
+          }
+        }
+      }
+    }
+  })
+
+  name = "example"
+}
+
+resource "aws_api_gateway_deployment" "example" {
+  rest_api_id = aws_api_gateway_rest_api.example.id
+
+  triggers = {
+    redeployment = sha1(jsonencode(aws_api_gateway_rest_api.example.body))
+  }
+
+  lifecycle {
+    create_before_destroy = true
+  }
+}
+
+resource "aws_api_gateway_stage" "example" {
+  deployment_id = aws_api_gateway_deployment.example.id
+  rest_api_id   = aws_api_gateway_rest_api.example.id
+  stage_name    = "example"
+}
+```
+
+### Terraform Resources
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from cdktf import TerraformResourceLifecycle
+from constructs import Construct
+from cdktf import Token, Fn, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.api_gateway_deployment import ApiGatewayDeployment
+from imports.aws.api_gateway_integration import ApiGatewayIntegration
+from imports.aws.api_gateway_method import ApiGatewayMethod
+from imports.aws.api_gateway_resource import ApiGatewayResource
+from imports.aws.api_gateway_rest_api import ApiGatewayRestApi
+from imports.aws.api_gateway_stage import ApiGatewayStage
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = ApiGatewayRestApi(self, "example",
+            name="example"
+        )
+        aws_api_gateway_resource_example = ApiGatewayResource(self, "example_1",
+            parent_id=example.root_resource_id,
+            path_part="example",
+            rest_api_id=example.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_api_gateway_resource_example.override_logical_id("example")
+        aws_api_gateway_method_example = ApiGatewayMethod(self, "example_2",
+            authorization="NONE",
+            http_method="GET",
+            resource_id=Token.as_string(aws_api_gateway_resource_example.id),
+            rest_api_id=example.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_api_gateway_method_example.override_logical_id("example")
+        aws_api_gateway_integration_example = ApiGatewayIntegration(self, "example_3",
+            http_method=Token.as_string(aws_api_gateway_method_example.http_method),
+            resource_id=Token.as_string(aws_api_gateway_resource_example.id),
+            rest_api_id=example.id,
+            type="MOCK"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_api_gateway_integration_example.override_logical_id("example")
+        aws_api_gateway_deployment_example = ApiGatewayDeployment(self, "example_4",
+            lifecycle=TerraformResourceLifecycle(
+                create_before_destroy=True
+            ),
+            rest_api_id=example.id,
+            triggers={
+                "redeployment": Token.as_string(
+                    Fn.sha1(
+                        Token.as_string(
+                            Fn.jsonencode([aws_api_gateway_resource_example.id, aws_api_gateway_method_example.id, aws_api_gateway_integration_example.id
+                            ]))))
+            }
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_api_gateway_deployment_example.override_logical_id("example")
+        aws_api_gateway_stage_example = ApiGatewayStage(self, "example_5",
+            deployment_id=Token.as_string(aws_api_gateway_deployment_example.id),
+            rest_api_id=example.id,
+            stage_name="example"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_api_gateway_stage_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `rest_api_id` - (Required) REST API identifier.
+* `description` - (Optional) Description of the deployment
+* `stage_name` - (Optional) Name of the stage to create with this deployment. If the specified stage already exists, it will be updated to point to the new deployment. We recommend using the [`aws_api_gateway_stage` resource](api_gateway_stage.html) instead to manage stages.
+* `stage_description` - (Optional) Description to set on the stage managed by the `stage_name` argument.
+* `triggers` - (Optional) Map of arbitrary keys and values that, when changed, will trigger a redeployment. To force a redeployment without changing these keys/values, use the [`-replace` option](https://developer.hashicorp.com/terraform/cli/commands/plan#replace-address) with `terraform plan` or `terraform apply`.
+* `variables` - (Optional) Map to set on the stage managed by the `stage_name` argument.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the deployment
+* `invoke_url` - URL to invoke the API pointing to the stage,
+  e.g., `https://z4675bid1j.execute-api.eu-west-2.amazonaws.com/prod`
+* `execution_arn` - Execution ARN to be used in [`lambda_permission`](/docs/providers/aws/r/lambda_permission.html)'s `source_arn`
+  when allowing API Gateway to invoke a Lambda function,
+  e.g., `arn:aws:execute-api:eu-west-2:123456789012:z4675bid1j/prod`
+* `created_date` - Creation date of the deployment
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_api_gateway_deployment` using `REST-API-ID/DEPLOYMENT-ID`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_api_gateway_deployment` using `REST-API-ID/DEPLOYMENT-ID`. For example:
+
+```console
+% terraform import aws_api_gateway_deployment.example aabbccddee/1122334
+```
+
+The `stage_name`, `stage_description`, and `variables` arguments cannot be imported. Use the [`aws_api_gateway_stage` resource](api_gateway_stage.html) to import and manage stages.
+
+The `triggers` argument cannot be imported.
+
+<!-- cache-key: cdktf-0.18.0 input-a6bba7a5df573767f5e0da500df7a421964740e00b416a999a065c5b3ab27982 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/api_gateway_documentation_part.html.markdown b/website/docs/cdktf/python/r/api_gateway_documentation_part.html.markdown
new file mode 100644
index 00000000000..8dfa10e4b23
--- /dev/null
+++ b/website/docs/cdktf/python/r/api_gateway_documentation_part.html.markdown
@@ -0,0 +1,92 @@
+---
+subcategory: "API Gateway"
+layout: "aws"
+page_title: "AWS: aws_api_gateway_documentation_part"
+description: |-
+  Provides a settings of an API Gateway Documentation Part.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_api_gateway_documentation_part
+
+Provides a settings of an API Gateway Documentation Part.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.api_gateway_documentation_part import ApiGatewayDocumentationPart
+from imports.aws.api_gateway_rest_api import ApiGatewayRestApi
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = ApiGatewayRestApi(self, "example",
+            name="example_api"
+        )
+        aws_api_gateway_documentation_part_example =
+        ApiGatewayDocumentationPart(self, "example_1",
+            location=ApiGatewayDocumentationPartLocation(
+                method="GET",
+                path="/example",
+                type="METHOD"
+            ),
+            properties="{\\\"description\\\":\\\"Example description\\\"}",
+            rest_api_id=example.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_api_gateway_documentation_part_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `location` - (Required) Location of the targeted API entity of the to-be-created documentation part. See below.
+* `properties` - (Required) Content map of API-specific key-value pairs describing the targeted API entity. The map must be encoded as a JSON string, e.g., "{ \"description\": \"The API does ...\" }". Only Swagger-compliant key-value pairs can be exported and, hence, published.
+* `rest_api_id` - (Required) ID of the associated Rest API
+
+### Nested fields
+
+#### `location`
+
+See supported entity types for each field in the [official docs](https://docs.aws.amazon.com/apigateway/api-reference/resource/documentation-part/).
+
+* `method` - (Optional) HTTP verb of a method. The default value is `*` for any method.
+* `name` - (Optional) Name of the targeted API entity.
+* `path` - (Optional) URL path of the target. The default value is `/` for the root resource.
+* `status_code` - (Optional) HTTP status code of a response. The default value is `*` for any status code.
+* `type` - (Required) Type of API entity to which the documentation content appliesE.g., `API`, `METHOD` or `REQUEST_BODY`
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Unique ID of the Documentation Part
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import API Gateway documentation_parts using `REST-API-ID/DOC-PART-ID`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import API Gateway documentation_parts using `REST-API-ID/DOC-PART-ID`. For example:
+
+```console
+% terraform import aws_api_gateway_documentation_part.example 5i4e1ko720/3oyy3t
+```
+
+<!-- cache-key: cdktf-0.18.0 input-867334446462d153ff9de196dd9a6b79eb1a29610b4a35e0c546b546c92093da -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/api_gateway_documentation_version.html.markdown b/website/docs/cdktf/python/r/api_gateway_documentation_version.html.markdown
new file mode 100644
index 00000000000..7c3f5ca2819
--- /dev/null
+++ b/website/docs/cdktf/python/r/api_gateway_documentation_version.html.markdown
@@ -0,0 +1,86 @@
+---
+subcategory: "API Gateway"
+layout: "aws"
+page_title: "AWS: aws_api_gateway_documentation_version"
+description: |-
+  Provides a resource to manage an API Gateway Documentation Version.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_api_gateway_documentation_version
+
+Provides a resource to manage an API Gateway Documentation Version.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.api_gateway_documentation_part import ApiGatewayDocumentationPart
+from imports.aws.api_gateway_documentation_version import ApiGatewayDocumentationVersion
+from imports.aws.api_gateway_rest_api import ApiGatewayRestApi
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = ApiGatewayRestApi(self, "example",
+            name="example_api"
+        )
+        aws_api_gateway_documentation_part_example =
+        ApiGatewayDocumentationPart(self, "example_1",
+            location=ApiGatewayDocumentationPartLocation(
+                type="API"
+            ),
+            properties="{\\\"description\\\":\\\"Example\\\"}",
+            rest_api_id=example.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_api_gateway_documentation_part_example.override_logical_id("example")
+        aws_api_gateway_documentation_version_example =
+        ApiGatewayDocumentationVersion(self, "example_2",
+            depends_on=[aws_api_gateway_documentation_part_example],
+            description="Example description",
+            rest_api_id=example.id,
+            version="example_version"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_api_gateway_documentation_version_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `version` - (Required) Version identifier of the API documentation snapshot.
+* `rest_api_id` - (Required) ID of the associated Rest API
+* `description` - (Optional) Description of the API documentation version.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import API Gateway documentation versions using `REST-API-ID/VERSION`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import API Gateway documentation versions using `REST-API-ID/VERSION`. For example:
+
+```console
+% terraform import aws_api_gateway_documentation_version.example 5i4e1ko720/example-version
+```
+
+<!-- cache-key: cdktf-0.18.0 input-a4c3d7281104b3d492a309138d97e039e5bb599759343aa17d6a213ef2be7c75 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/api_gateway_domain_name.html.markdown b/website/docs/cdktf/python/r/api_gateway_domain_name.html.markdown
new file mode 100644
index 00000000000..be445412c4a
--- /dev/null
+++ b/website/docs/cdktf/python/r/api_gateway_domain_name.html.markdown
@@ -0,0 +1,262 @@
+---
+subcategory: "API Gateway"
+layout: "aws"
+page_title: "AWS: aws_api_gateway_domain_name"
+description: |-
+  Registers a custom domain name for use with AWS API Gateway.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_api_gateway_domain_name
+
+Registers a custom domain name for use with AWS API Gateway. Additional information about this functionality
+can be found in the [API Gateway Developer Guide](https://docs.aws.amazon.com/apigateway/latest/developerguide/how-to-custom-domains.html).
+
+This resource just establishes ownership of and the TLS settings for
+a particular domain name. An API can be attached to a particular path
+under the registered domain name using
+[the `aws_api_gateway_base_path_mapping` resource](api_gateway_base_path_mapping.html).
+
+API Gateway domains can be defined as either 'edge-optimized' or 'regional'.  In an edge-optimized configuration,
+API Gateway internally creates and manages a CloudFront distribution to route requests on the given hostname. In
+addition to this resource it's necessary to create a DNS record corresponding to the given domain name which is an alias
+(either Route53 alias or traditional CNAME) to the Cloudfront domain name exported in the `cloudfront_domain_name`
+attribute.
+
+In a regional configuration, API Gateway does not create a CloudFront distribution to route requests to the API, though
+a distribution can be created if needed. In either case, it is necessary to create a DNS record corresponding to the
+given domain name which is an alias (either Route53 alias or traditional CNAME) to the regional domain name exported in
+the `regional_domain_name` attribute.
+
+~> **Note:** API Gateway requires the use of AWS Certificate Manager (ACM) certificates instead of Identity and Access Management (IAM) certificates in regions that support ACM. Regions that support ACM can be found in the [Regions and Endpoints Documentation](https://docs.aws.amazon.com/general/latest/gr/rande.html#acm_region). To import an existing private key and certificate into ACM or request an ACM certificate, see the [`aws_acm_certificate` resource](/docs/providers/aws/r/acm_certificate.html).
+
+~> **Note:** The `aws_api_gateway_domain_name` resource expects dependency on the `aws_acm_certificate_validation` as
+only verified certificates can be used. This can be made either explicitly by adding the
+`depends_on = [aws_acm_certificate_validation.cert]` attribute. Or implicitly by referring certificate ARN
+from the validation resource where it will be available after the resource creation:
+`regional_certificate_arn = aws_acm_certificate_validation.cert.certificate_arn`.
+
+~> **Note:** All arguments including the private key will be stored in the raw state as plain-text.
+[Read more about sensitive data in state](https://www.terraform.io/docs/state/sensitive-data.html).
+
+## Example Usage
+
+An end-to-end example of a REST API configured with OpenAPI can be found in the [`/examples/api-gateway-rest-api-openapi` directory within the GitHub repository](https://github.com/hashicorp/terraform-provider-aws/tree/main/examples/api-gateway-rest-api-openapi).
+
+### Edge Optimized (ACM Certificate)
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.api_gateway_domain_name import ApiGatewayDomainName
+from imports.aws.route53_record import Route53Record
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = ApiGatewayDomainName(self, "example",
+            certificate_arn=Token.as_string(aws_acm_certificate_validation_example.certificate_arn),
+            domain_name="api.example.com"
+        )
+        aws_route53_record_example = Route53Record(self, "example_1",
+            alias=Route53RecordAlias(
+                evaluate_target_health=True,
+                name=example.cloudfront_domain_name,
+                zone_id=example.cloudfront_zone_id
+            ),
+            name=example.domain_name,
+            type="A",
+            zone_id=Token.as_string(aws_route53_zone_example.id)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_route53_record_example.override_logical_id("example")
+```
+
+### Edge Optimized (IAM Certificate)
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.api_gateway_domain_name import ApiGatewayDomainName
+from imports.aws.route53_record import Route53Record
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = ApiGatewayDomainName(self, "example",
+            certificate_body=Token.as_string(
+                Fn.file("${path.module}/example.com/example.crt")),
+            certificate_chain=Token.as_string(
+                Fn.file("${path.module}/example.com/ca.crt")),
+            certificate_name="example-api",
+            certificate_private_key=Token.as_string(
+                Fn.file("${path.module}/example.com/example.key")),
+            domain_name="api.example.com"
+        )
+        aws_route53_record_example = Route53Record(self, "example_1",
+            alias=Route53RecordAlias(
+                evaluate_target_health=True,
+                name=example.cloudfront_domain_name,
+                zone_id=example.cloudfront_zone_id
+            ),
+            name=example.domain_name,
+            type="A",
+            zone_id=Token.as_string(aws_route53_zone_example.id)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_route53_record_example.override_logical_id("example")
+```
+
+### Regional (ACM Certificate)
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.api_gateway_domain_name import ApiGatewayDomainName
+from imports.aws.route53_record import Route53Record
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = ApiGatewayDomainName(self, "example",
+            domain_name="api.example.com",
+            endpoint_configuration=ApiGatewayDomainNameEndpointConfiguration(
+                types=["REGIONAL"]
+            ),
+            regional_certificate_arn=Token.as_string(aws_acm_certificate_validation_example.certificate_arn)
+        )
+        aws_route53_record_example = Route53Record(self, "example_1",
+            alias=Route53RecordAlias(
+                evaluate_target_health=True,
+                name=example.regional_domain_name,
+                zone_id=example.regional_zone_id
+            ),
+            name=example.domain_name,
+            type="A",
+            zone_id=Token.as_string(aws_route53_zone_example.id)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_route53_record_example.override_logical_id("example")
+```
+
+### Regional (IAM Certificate)
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.api_gateway_domain_name import ApiGatewayDomainName
+from imports.aws.route53_record import Route53Record
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = ApiGatewayDomainName(self, "example",
+            certificate_body=Token.as_string(
+                Fn.file("${path.module}/example.com/example.crt")),
+            certificate_chain=Token.as_string(
+                Fn.file("${path.module}/example.com/ca.crt")),
+            certificate_private_key=Token.as_string(
+                Fn.file("${path.module}/example.com/example.key")),
+            domain_name="api.example.com",
+            endpoint_configuration=ApiGatewayDomainNameEndpointConfiguration(
+                types=["REGIONAL"]
+            ),
+            regional_certificate_name="example-api"
+        )
+        aws_route53_record_example = Route53Record(self, "example_1",
+            alias=Route53RecordAlias(
+                evaluate_target_health=True,
+                name=example.regional_domain_name,
+                zone_id=example.regional_zone_id
+            ),
+            name=example.domain_name,
+            type="A",
+            zone_id=Token.as_string(aws_route53_zone_example.id)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_route53_record_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `domain_name` - (Required) Fully-qualified domain name to register.
+* `endpoint_configuration` - (Optional) Configuration block defining API endpoint information including type. See below.
+* `mutual_tls_authentication` - (Optional) Mutual TLS authentication configuration for the domain name. See below.
+* `ownership_verification_certificate_arn` - (Optional) ARN of the AWS-issued certificate used to validate custom domain ownership (when `certificate_arn` is issued via an ACM Private CA or `mutual_tls_authentication` is configured with an ACM-imported certificate.)
+* `security_policy` - (Optional) Transport Layer Security (TLS) version + cipher suite for this DomainName. Valid values are `TLS_1_0` and `TLS_1_2`. Must be configured to perform drift detection.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+When referencing an AWS-managed certificate, the following arguments are supported:
+
+* `certificate_arn` - (Optional) ARN for an AWS-managed certificate. AWS Certificate Manager is the only supported source. Used when an edge-optimized domain name is desired. Conflicts with `certificate_name`, `certificate_body`, `certificate_chain`, `certificate_private_key`, `regional_certificate_arn`, and `regional_certificate_name`.
+* `regional_certificate_arn` - (Optional) ARN for an AWS-managed certificate. AWS Certificate Manager is the only supported source. Used when a regional domain name is desired. Conflicts with `certificate_arn`, `certificate_name`, `certificate_body`, `certificate_chain`, and `certificate_private_key`.
+
+When uploading a certificate, the following arguments are supported:
+
+* `certificate_body` - (Optional) Certificate issued for the domain name being registered, in PEM format. Only valid for `EDGE` endpoint configuration type. Conflicts with `certificate_arn`, `regional_certificate_arn`, and `regional_certificate_name`.
+* `certificate_chain` - (Optional) Certificate for the CA that issued the certificate, along with any intermediate CA certificates required to create an unbroken chain to a certificate trusted by the intended API clients. Only valid for `EDGE` endpoint configuration type. Conflicts with `certificate_arn`, `regional_certificate_arn`, and `regional_certificate_name`.
+* `certificate_name` - (Optional) Unique name to use when registering this certificate as an IAM server certificate. Conflicts with `certificate_arn`, `regional_certificate_arn`, and `regional_certificate_name`. Required if `certificate_arn` is not set.
+* `certificate_private_key` - (Optional) Private key associated with the domain certificate given in `certificate_body`. Only valid for `EDGE` endpoint configuration type. Conflicts with `certificate_arn`, `regional_certificate_arn`, and `regional_certificate_name`.
+* `regional_certificate_name` - (Optional) User-friendly name of the certificate that will be used by regional endpoint for this domain name. Conflicts with `certificate_arn`, `certificate_name`, `certificate_body`, `certificate_chain`, and `certificate_private_key`.
+
+### endpoint_configuration
+
+* `types` - (Required) List of endpoint types. This resource currently only supports managing a single value. Valid values: `EDGE` or `REGIONAL`. If unspecified, defaults to `EDGE`. Must be declared as `REGIONAL` in non-Commercial partitions. Refer to the [documentation](https://docs.aws.amazon.com/apigateway/latest/developerguide/create-regional-api.html) for more information on the difference between edge-optimized and regional APIs.
+
+### mutual_tls_authentication
+
+* `truststore_uri` - (Required) Amazon S3 URL that specifies the truststore for mutual TLS authentication, for example, `s3://bucket-name/key-name`. The truststore can contain certificates from public or private certificate authorities. To update the truststore, upload a new version to S3, and then update your custom domain name to use the new version.
+* `truststore_version` - (Optional) Version of the S3 object that contains the truststore. To specify a version, you must have versioning enabled for the S3 bucket.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of domain name.
+* `certificate_upload_date` - Upload date associated with the domain certificate.
+* `cloudfront_domain_name` - Hostname created by Cloudfront to represent the distribution that implements this domain name mapping.
+* `cloudfront_zone_id` - For convenience, the hosted zone ID (`Z2FDTNDATAQYW2`) that can be used to create a Route53 alias record for the distribution.
+* `id` - Internal identifier assigned to this domain name by API Gateway.
+* `regional_domain_name` - Hostname for the custom domain's regional endpoint.
+* `regional_zone_id` - Hosted zone ID that can be used to create a Route53 alias record for the regional endpoint.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import API Gateway domain names using their `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import API Gateway domain names using their `name`. For example:
+
+```console
+% terraform import aws_api_gateway_domain_name.example dev.example.com
+```
+
+<!-- cache-key: cdktf-0.18.0 input-94b48fa1d23d0d114bb8d9f31a16923c5bf9db107914287c83b704a97489f072 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/api_gateway_gateway_response.html.markdown b/website/docs/cdktf/python/r/api_gateway_gateway_response.html.markdown
new file mode 100644
index 00000000000..a0ab9329f4a
--- /dev/null
+++ b/website/docs/cdktf/python/r/api_gateway_gateway_response.html.markdown
@@ -0,0 +1,79 @@
+---
+subcategory: "API Gateway"
+layout: "aws"
+page_title: "AWS: aws_api_gateway_gateway_response"
+description: |-
+  Provides an API Gateway Gateway Response for a REST API Gateway.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_api_gateway_gateway_response
+
+Provides an API Gateway Gateway Response for a REST API Gateway.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.api_gateway_gateway_response import ApiGatewayGatewayResponse
+from imports.aws.api_gateway_rest_api import ApiGatewayRestApi
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        main = ApiGatewayRestApi(self, "main",
+            name="MyDemoAPI"
+        )
+        ApiGatewayGatewayResponse(self, "test",
+            response_parameters={
+                "gatewayresponse.header.Authorization": "'Basic'"
+            },
+            response_templates={
+                "application/json": "{\\\"message\\\":$context.error.messageString}"
+            },
+            response_type="UNAUTHORIZED",
+            rest_api_id=main.id,
+            status_code="401"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `rest_api_id` - (Required) String identifier of the associated REST API.
+* `response_type` - (Required) Response type of the associated GatewayResponse.
+* `status_code` - (Optional) HTTP status code of the Gateway Response.
+* `response_templates` - (Optional) Map of templates used to transform the response body.
+* `response_parameters` - (Optional) Map of parameters (paths, query strings and headers) of the Gateway Response.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_api_gateway_gateway_response` using `REST-API-ID/RESPONSE-TYPE`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_api_gateway_gateway_response` using `REST-API-ID/RESPONSE-TYPE`. For example:
+
+```console
+% terraform import aws_api_gateway_gateway_response.example 12345abcde/UNAUTHORIZED
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1cf3d4efa3dea58b3eb33a7d86b84e6f760a3bfa3f2190d9e1f9e796eec417fc -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/api_gateway_gateway_response.markdown b/website/docs/cdktf/python/r/api_gateway_gateway_response.markdown
new file mode 100644
index 00000000000..a0ab9329f4a
--- /dev/null
+++ b/website/docs/cdktf/python/r/api_gateway_gateway_response.markdown
@@ -0,0 +1,79 @@
+---
+subcategory: "API Gateway"
+layout: "aws"
+page_title: "AWS: aws_api_gateway_gateway_response"
+description: |-
+  Provides an API Gateway Gateway Response for a REST API Gateway.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_api_gateway_gateway_response
+
+Provides an API Gateway Gateway Response for a REST API Gateway.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.api_gateway_gateway_response import ApiGatewayGatewayResponse
+from imports.aws.api_gateway_rest_api import ApiGatewayRestApi
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        main = ApiGatewayRestApi(self, "main",
+            name="MyDemoAPI"
+        )
+        ApiGatewayGatewayResponse(self, "test",
+            response_parameters={
+                "gatewayresponse.header.Authorization": "'Basic'"
+            },
+            response_templates={
+                "application/json": "{\\\"message\\\":$context.error.messageString}"
+            },
+            response_type="UNAUTHORIZED",
+            rest_api_id=main.id,
+            status_code="401"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `rest_api_id` - (Required) String identifier of the associated REST API.
+* `response_type` - (Required) Response type of the associated GatewayResponse.
+* `status_code` - (Optional) HTTP status code of the Gateway Response.
+* `response_templates` - (Optional) Map of templates used to transform the response body.
+* `response_parameters` - (Optional) Map of parameters (paths, query strings and headers) of the Gateway Response.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_api_gateway_gateway_response` using `REST-API-ID/RESPONSE-TYPE`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_api_gateway_gateway_response` using `REST-API-ID/RESPONSE-TYPE`. For example:
+
+```console
+% terraform import aws_api_gateway_gateway_response.example 12345abcde/UNAUTHORIZED
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1cf3d4efa3dea58b3eb33a7d86b84e6f760a3bfa3f2190d9e1f9e796eec417fc -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/api_gateway_integration.html.markdown b/website/docs/cdktf/python/r/api_gateway_integration.html.markdown
new file mode 100644
index 00000000000..19fa5e7a1ce
--- /dev/null
+++ b/website/docs/cdktf/python/r/api_gateway_integration.html.markdown
@@ -0,0 +1,285 @@
+---
+subcategory: "API Gateway"
+layout: "aws"
+page_title: "AWS: aws_api_gateway_integration"
+description: |-
+  Provides an HTTP Method Integration for an API Gateway Integration.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_api_gateway_integration
+
+Provides an HTTP Method Integration for an API Gateway Integration.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.api_gateway_integration import ApiGatewayIntegration
+from imports.aws.api_gateway_method import ApiGatewayMethod
+from imports.aws.api_gateway_resource import ApiGatewayResource
+from imports.aws.api_gateway_rest_api import ApiGatewayRestApi
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        my_demo_api = ApiGatewayRestApi(self, "MyDemoAPI",
+            description="This is my API for demonstration purposes",
+            name="MyDemoAPI"
+        )
+        my_demo_resource = ApiGatewayResource(self, "MyDemoResource",
+            parent_id=my_demo_api.root_resource_id,
+            path_part="mydemoresource",
+            rest_api_id=my_demo_api.id
+        )
+        my_demo_method = ApiGatewayMethod(self, "MyDemoMethod",
+            authorization="NONE",
+            http_method="GET",
+            resource_id=my_demo_resource.id,
+            rest_api_id=my_demo_api.id
+        )
+        ApiGatewayIntegration(self, "MyDemoIntegration",
+            cache_key_parameters=["method.request.path.param"],
+            cache_namespace="foobar",
+            http_method=my_demo_method.http_method,
+            request_parameters={
+                "integration.request.header.X-Authorization": "'static'"
+            },
+            request_templates={
+                "application/xml": "{\n   \"body\" : $input.json('$')\n}\n\n"
+            },
+            resource_id=my_demo_resource.id,
+            rest_api_id=my_demo_api.id,
+            timeout_milliseconds=29000,
+            type="MOCK"
+        )
+```
+
+## Lambda integration
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformVariable, Token, Fn, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.api_gateway_integration import ApiGatewayIntegration
+from imports.aws.api_gateway_method import ApiGatewayMethod
+from imports.aws.api_gateway_resource import ApiGatewayResource
+from imports.aws.api_gateway_rest_api import ApiGatewayRestApi
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.iam_role import IamRole
+from imports.aws.lambda_function import LambdaFunction
+from imports.aws.lambda_permission import LambdaPermission
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        # Terraform Variables are not always the best fit for getting inputs in the context of Terraform CDK.
+        #     You can read more about this at https://cdk.tf/variables
+        account_id = TerraformVariable(self, "accountId")
+        myregion = TerraformVariable(self, "myregion")
+        api = ApiGatewayRestApi(self, "api",
+            name="myapi"
+        )
+        assume_role = DataAwsIamPolicyDocument(self, "assume_role",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["sts:AssumeRole"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["lambda.amazonaws.com"],
+                    type="Service"
+                )
+                ]
+            )
+            ]
+        )
+        resource = ApiGatewayResource(self, "resource",
+            parent_id=api.root_resource_id,
+            path_part="resource",
+            rest_api_id=api.id
+        )
+        role = IamRole(self, "role",
+            assume_role_policy=Token.as_string(assume_role.json),
+            name="myrole"
+        )
+        lambda_ = LambdaFunction(self, "lambda",
+            filename="lambda.zip",
+            function_name="mylambda",
+            handler="lambda.lambda_handler",
+            role=role.arn,
+            runtime="python3.7",
+            source_code_hash=Token.as_string(Fn.filebase64sha256("lambda.zip"))
+        )
+        method = ApiGatewayMethod(self, "method",
+            authorization="NONE",
+            http_method="GET",
+            resource_id=resource.id,
+            rest_api_id=api.id
+        )
+        LambdaPermission(self, "apigw_lambda",
+            action="lambda:InvokeFunction",
+            function_name=lambda_.function_name,
+            principal="apigateway.amazonaws.com",
+            source_arn="arn:aws:execute-api:${" + myregion.value + "}:${" + account_id.value + "}:${" + api.id + "}/*/${" + method.http_method + "${" + resource.path + "}",
+            statement_id="AllowExecutionFromAPIGateway"
+        )
+        ApiGatewayIntegration(self, "integration",
+            http_method=method.http_method,
+            integration_http_method="POST",
+            resource_id=resource.id,
+            rest_api_id=api.id,
+            type="AWS_PROXY",
+            uri=lambda_.invoke_arn
+        )
+```
+
+## VPC Link
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformVariable, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.api_gateway_integration import ApiGatewayIntegration
+from imports.aws.api_gateway_method import ApiGatewayMethod
+from imports.aws.api_gateway_resource import ApiGatewayResource
+from imports.aws.api_gateway_rest_api import ApiGatewayRestApi
+from imports.aws.api_gateway_vpc_link import ApiGatewayVpcLink
+from imports.aws.lb import Lb
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        # Terraform Variables are not always the best fit for getting inputs in the context of Terraform CDK.
+        #     You can read more about this at https://cdk.tf/variables
+        name = TerraformVariable(self, "name")
+        subnet_id = TerraformVariable(self, "subnet_id")
+        test = ApiGatewayRestApi(self, "test",
+            name=name.string_value
+        )
+        aws_lb_test = Lb(self, "test_3",
+            internal=True,
+            load_balancer_type="network",
+            name=name.string_value,
+            subnets=[subnet_id.string_value]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_lb_test.override_logical_id("test")
+        aws_api_gateway_resource_test = ApiGatewayResource(self, "test_4",
+            parent_id=test.root_resource_id,
+            path_part="test",
+            rest_api_id=test.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_api_gateway_resource_test.override_logical_id("test")
+        aws_api_gateway_vpc_link_test = ApiGatewayVpcLink(self, "test_5",
+            name=name.string_value,
+            target_arns=[Token.as_string(aws_lb_test.arn)]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_api_gateway_vpc_link_test.override_logical_id("test")
+        aws_api_gateway_method_test = ApiGatewayMethod(self, "test_6",
+            authorization="NONE",
+            http_method="GET",
+            request_models={
+                "application/json": "Error"
+            },
+            resource_id=Token.as_string(aws_api_gateway_resource_test.id),
+            rest_api_id=test.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_api_gateway_method_test.override_logical_id("test")
+        aws_api_gateway_integration_test = ApiGatewayIntegration(self, "test_7",
+            connection_id=Token.as_string(aws_api_gateway_vpc_link_test.id),
+            connection_type="VPC_LINK",
+            content_handling="CONVERT_TO_TEXT",
+            http_method=Token.as_string(aws_api_gateway_method_test.http_method),
+            integration_http_method="GET",
+            passthrough_behavior="WHEN_NO_MATCH",
+            request_parameters={
+                "integration.request.header.X-Authorization": "'static'",
+                "integration.request.header.X-Foo": "'Bar'"
+            },
+            request_templates={
+                "application/json": "",
+                "application/xml": "#set($inputRoot = $input.path('$'))\n{ }\n"
+            },
+            resource_id=Token.as_string(aws_api_gateway_resource_test.id),
+            rest_api_id=test.id,
+            type="HTTP",
+            uri="https://www.google.de"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_api_gateway_integration_test.override_logical_id("test")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `rest_api_id` - (Required) ID of the associated REST API.
+* `resource_id` - (Required) API resource ID.
+* `http_method` - (Required) HTTP method (`GET`, `POST`, `PUT`, `DELETE`, `HEAD`, `OPTION`, `ANY`)
+  when calling the associated resource.
+* `integration_http_method` - (Optional) Integration HTTP method
+  (`GET`, `POST`, `PUT`, `DELETE`, `HEAD`, `OPTIONs`, `ANY`, `PATCH`) specifying how API Gateway will interact with the back end.
+  **Required** if `type` is `AWS`, `AWS_PROXY`, `HTTP` or `HTTP_PROXY`.
+  Not all methods are compatible with all `AWS` integrations.
+  e.g., Lambda function [can only be invoked](https://github.com/awslabs/aws-apigateway-importer/issues/9#issuecomment-129651005) via `POST`.
+* `type` - (Required) Integration input's [type](https://docs.aws.amazon.com/apigateway/api-reference/resource/integration/). Valid values are `HTTP` (for HTTP backends), `MOCK` (not calling any real backend), `AWS` (for AWS services), `AWS_PROXY` (for Lambda proxy integration) and `HTTP_PROXY` (for HTTP proxy integration). An `HTTP` or `HTTP_PROXY` integration with a `connection_type` of `VPC_LINK` is referred to as a private integration and uses a VpcLink to connect API Gateway to a network load balancer of a VPC.
+* `connection_type` - (Optional) Integration input's [connectionType](https://docs.aws.amazon.com/apigateway/api-reference/resource/integration/#connectionType). Valid values are `INTERNET` (default for connections through the public routable internet), and `VPC_LINK` (for private connections between API Gateway and a network load balancer in a VPC).
+* `connection_id` - (Optional) ID of the VpcLink used for the integration. **Required** if `connection_type` is `VPC_LINK`
+* `uri` - (Optional) Input's URI. **Required** if `type` is `AWS`, `AWS_PROXY`, `HTTP` or `HTTP_PROXY`.
+  For HTTP integrations, the URI must be a fully formed, encoded HTTP(S) URL according to the RFC-3986 specification . For AWS integrations, the URI should be of the form `arn:aws:apigateway:{region}:{subdomain.service|service}:{path|action}/{service_api}`. `region`, `subdomain` and `service` are used to determine the right endpoint.
+  e.g., `arn:aws:apigateway:eu-west-1:lambda:path/2015-03-31/functions/arn:aws:lambda:eu-west-1:012345678901:function:my-func/invocations`. For private integrations, the URI parameter is not used for routing requests to your endpoint, but is used for setting the Host header and for certificate validation.
+* `credentials` - (Optional) Credentials required for the integration. For `AWS` integrations, 2 options are available. To specify an IAM Role for Amazon API Gateway to assume, use the role's ARN. To require that the caller's identity be passed through from the request, specify the string `arn:aws:iam::\*:user/\*`.
+* `request_templates` - (Optional) Map of the integration's request templates.
+* `request_parameters` - (Optional) Map of request query string parameters and headers that should be passed to the backend responder.
+  For example: `request_parameters = { "integration.request.header.X-Some-Other-Header" = "method.request.header.X-Some-Header" }`
+* `passthrough_behavior` - (Optional) Integration passthrough behavior (`WHEN_NO_MATCH`, `WHEN_NO_TEMPLATES`, `NEVER`).  **Required** if `request_templates` is used.
+* `cache_key_parameters` - (Optional) List of cache key parameters for the integration.
+* `cache_namespace` - (Optional) Integration's cache namespace.
+* `content_handling` - (Optional) How to handle request payload content type conversions. Supported values are `CONVERT_TO_BINARY` and `CONVERT_TO_TEXT`. If this property is not defined, the request payload will be passed through from the method request to integration request without modification, provided that the passthroughBehaviors is configured to support payload pass-through.
+* `timeout_milliseconds` - (Optional) Custom timeout between 50 and 29,000 milliseconds. The default value is 29,000 milliseconds.
+* `tls_config` - (Optional) TLS configuration. See below.
+
+### tls_config Configuration Block
+
+The `tls_config` configuration block supports the following arguments:
+
+* `insecure_skip_verification` - (Optional) Whether or not API Gateway skips verification that the certificate for an integration endpoint is issued by a [supported certificate authority](https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-supported-certificate-authorities-for-http-endpoints.html). This isn’t recommended, but it enables you to use certificates that are signed by private certificate authorities, or certificates that are self-signed. If enabled, API Gateway still performs basic certificate validation, which includes checking the certificate's expiration date, hostname, and presence of a root certificate authority. Supported only for `HTTP` and `HTTP_PROXY` integrations.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_api_gateway_integration` using `REST-API-ID/RESOURCE-ID/HTTP-METHOD`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_api_gateway_integration` using `REST-API-ID/RESOURCE-ID/HTTP-METHOD`. For example:
+
+```console
+% terraform import aws_api_gateway_integration.example 12345abcde/67890fghij/GET
+```
+
+<!-- cache-key: cdktf-0.18.0 input-6579a01c31e2b3a3e752d392012759bae929079686c0227bc0bc75da134a211f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/api_gateway_integration_response.html.markdown b/website/docs/cdktf/python/r/api_gateway_integration_response.html.markdown
new file mode 100644
index 00000000000..ded24dcea7a
--- /dev/null
+++ b/website/docs/cdktf/python/r/api_gateway_integration_response.html.markdown
@@ -0,0 +1,114 @@
+---
+subcategory: "API Gateway"
+layout: "aws"
+page_title: "AWS: aws_api_gateway_integration_response"
+description: |-
+  Provides an HTTP Method Integration Response for an API Gateway Resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_api_gateway_integration_response
+
+Provides an HTTP Method Integration Response for an API Gateway Resource.
+
+-> **Note:** Depends on having `aws_api_gateway_integration` inside your rest api. To ensure this
+you might need to add an explicit `depends_on` for clean runs.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.api_gateway_integration import ApiGatewayIntegration
+from imports.aws.api_gateway_integration_response import ApiGatewayIntegrationResponse
+from imports.aws.api_gateway_method import ApiGatewayMethod
+from imports.aws.api_gateway_method_response import ApiGatewayMethodResponse
+from imports.aws.api_gateway_resource import ApiGatewayResource
+from imports.aws.api_gateway_rest_api import ApiGatewayRestApi
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        my_demo_api = ApiGatewayRestApi(self, "MyDemoAPI",
+            description="This is my API for demonstration purposes",
+            name="MyDemoAPI"
+        )
+        my_demo_resource = ApiGatewayResource(self, "MyDemoResource",
+            parent_id=my_demo_api.root_resource_id,
+            path_part="mydemoresource",
+            rest_api_id=my_demo_api.id
+        )
+        my_demo_method = ApiGatewayMethod(self, "MyDemoMethod",
+            authorization="NONE",
+            http_method="GET",
+            resource_id=my_demo_resource.id,
+            rest_api_id=my_demo_api.id
+        )
+        response200 = ApiGatewayMethodResponse(self, "response_200",
+            http_method=my_demo_method.http_method,
+            resource_id=my_demo_resource.id,
+            rest_api_id=my_demo_api.id,
+            status_code="200"
+        )
+        ApiGatewayIntegration(self, "MyDemoIntegration",
+            http_method=my_demo_method.http_method,
+            resource_id=my_demo_resource.id,
+            rest_api_id=my_demo_api.id,
+            type="MOCK"
+        )
+        ApiGatewayIntegrationResponse(self, "MyDemoIntegrationResponse",
+            http_method=my_demo_method.http_method,
+            resource_id=my_demo_resource.id,
+            response_templates={
+                "application/xml": "#set($inputRoot = $input.path('$'))\n<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<message>\n    $inputRoot.body\n</message>\n\n"
+            },
+            rest_api_id=my_demo_api.id,
+            status_code=response200.status_code
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `http_method` - (Required) HTTP method (`GET`, `POST`, `PUT`, `DELETE`, `HEAD`, `OPTIONS`, `ANY`).
+* `resource_id` - (Required) API resource ID.
+* `rest_api_id` - (Required) ID of the associated REST API.
+* `status_code` - (Required) HTTP status code.
+
+The following arguments are optional:
+
+* `content_handling` - (Optional) How to handle request payload content type conversions. Supported values are `CONVERT_TO_BINARY` and `CONVERT_TO_TEXT`. If this property is not defined, the response payload will be passed through from the integration response to the method response without modification.
+* `response_parameters` - (Optional) Map of response parameters that can be read from the backend response. For example: `response_parameters = { "method.response.header.X-Some-Header" = "integration.response.header.X-Some-Other-Header" }`.
+* `response_templates` - (Optional) Map of templates used to transform the integration response body.
+* `selection_pattern` - (Optional) Regular expression pattern used to choose an integration response based on the response from the backend. Omit configuring this to make the integration the default one. If the backend is an `AWS` Lambda function, the AWS Lambda function error header is matched. For all other `HTTP` and `AWS` backends, the HTTP status code is matched.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_api_gateway_integration_response` using `REST-API-ID/RESOURCE-ID/HTTP-METHOD/STATUS-CODE`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_api_gateway_integration_response` using `REST-API-ID/RESOURCE-ID/HTTP-METHOD/STATUS-CODE`. For example:
+
+```console
+% terraform import aws_api_gateway_integration_response.example 12345abcde/67890fghij/GET/200
+```
+
+<!-- cache-key: cdktf-0.18.0 input-97c39e121698d07126a2f35c245570b6347a512d3549856ca8d5c2fc0f8be7e7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/api_gateway_method.html.markdown b/website/docs/cdktf/python/r/api_gateway_method.html.markdown
new file mode 100644
index 00000000000..ae05fca296f
--- /dev/null
+++ b/website/docs/cdktf/python/r/api_gateway_method.html.markdown
@@ -0,0 +1,146 @@
+---
+subcategory: "API Gateway"
+layout: "aws"
+page_title: "AWS: aws_api_gateway_method"
+description: |-
+  Provides a HTTP Method for an API Gateway Resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_api_gateway_method
+
+Provides a HTTP Method for an API Gateway Resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.api_gateway_method import ApiGatewayMethod
+from imports.aws.api_gateway_resource import ApiGatewayResource
+from imports.aws.api_gateway_rest_api import ApiGatewayRestApi
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        my_demo_api = ApiGatewayRestApi(self, "MyDemoAPI",
+            description="This is my API for demonstration purposes",
+            name="MyDemoAPI"
+        )
+        my_demo_resource = ApiGatewayResource(self, "MyDemoResource",
+            parent_id=my_demo_api.root_resource_id,
+            path_part="mydemoresource",
+            rest_api_id=my_demo_api.id
+        )
+        ApiGatewayMethod(self, "MyDemoMethod",
+            authorization="NONE",
+            http_method="GET",
+            resource_id=my_demo_resource.id,
+            rest_api_id=my_demo_api.id
+        )
+```
+
+## Usage with Cognito User Pool Authorizer
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformVariable, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.api_gateway_authorizer import ApiGatewayAuthorizer
+from imports.aws.api_gateway_method import ApiGatewayMethod
+from imports.aws.api_gateway_resource import ApiGatewayResource
+from imports.aws.api_gateway_rest_api import ApiGatewayRestApi
+from imports.aws.data_aws_cognito_user_pools import DataAwsCognitoUserPools
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        # Terraform Variables are not always the best fit for getting inputs in the context of Terraform CDK.
+        #     You can read more about this at https://cdk.tf/variables
+        cognito_user_pool_name = TerraformVariable(self, "cognito_user_pool_name")
+        this_var = ApiGatewayRestApi(self, "this",
+            name="with-authorizer"
+        )
+        data_aws_cognito_user_pools_this = DataAwsCognitoUserPools(self, "this_2",
+            name=cognito_user_pool_name.string_value
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_cognito_user_pools_this.override_logical_id("this")
+        aws_api_gateway_authorizer_this = ApiGatewayAuthorizer(self, "this_3",
+            name="CognitoUserPoolAuthorizer",
+            provider_arns=Token.as_list(data_aws_cognito_user_pools_this.arns),
+            rest_api_id=this_var.id,
+            type="COGNITO_USER_POOLS"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_api_gateway_authorizer_this.override_logical_id("this")
+        aws_api_gateway_resource_this = ApiGatewayResource(self, "this_4",
+            parent_id=this_var.root_resource_id,
+            path_part="{proxy+}",
+            rest_api_id=this_var.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_api_gateway_resource_this.override_logical_id("this")
+        ApiGatewayMethod(self, "any",
+            authorization="COGNITO_USER_POOLS",
+            authorizer_id=Token.as_string(aws_api_gateway_authorizer_this.id),
+            http_method="ANY",
+            request_parameters={
+                "method.request.path.proxy": True
+            },
+            resource_id=Token.as_string(aws_api_gateway_resource_this.id),
+            rest_api_id=this_var.id
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `rest_api_id` - (Required) ID of the associated REST API
+* `resource_id` - (Required) API resource ID
+* `http_method` - (Required) HTTP Method (`GET`, `POST`, `PUT`, `DELETE`, `HEAD`, `OPTIONS`, `ANY`)
+* `authorization` - (Required) Type of authorization used for the method (`NONE`, `CUSTOM`, `AWS_IAM`, `COGNITO_USER_POOLS`)
+* `authorizer_id` - (Optional) Authorizer id to be used when the authorization is `CUSTOM` or `COGNITO_USER_POOLS`
+* `authorization_scopes` - (Optional) Authorization scopes used when the authorization is `COGNITO_USER_POOLS`
+* `api_key_required` - (Optional) Specify if the method requires an API key
+* `operation_name` - (Optional) Function name that will be given to the method when generating an SDK through API Gateway. If omitted, API Gateway will generate a function name based on the resource path and HTTP verb.
+* `request_models` - (Optional) Map of the API models used for the request's content type
+  where key is the content type (e.g., `application/json`)
+  and value is either `Error`, `Empty` (built-in models) or `aws_api_gateway_model`'s `name`.
+* `request_validator_id` - (Optional) ID of a `aws_api_gateway_request_validator`
+* `request_parameters` - (Optional) Map of request parameters (from the path, query string and headers) that should be passed to the integration. The boolean value indicates whether the parameter is required (`true`) or optional (`false`).
+  For example: `request_parameters = {"method.request.header.X-Some-Header" = true "method.request.querystring.some-query-param" = true}` would define that the header `X-Some-Header` and the query string `some-query-param` must be provided in the request.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_api_gateway_method` using `REST-API-ID/RESOURCE-ID/HTTP-METHOD`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_api_gateway_method` using `REST-API-ID/RESOURCE-ID/HTTP-METHOD`. For example:
+
+```console
+% terraform import aws_api_gateway_method.example 12345abcde/67890fghij/GET
+```
+
+<!-- cache-key: cdktf-0.18.0 input-d5fc57c36d3feff79723b5c6ed0551e4895d96864eaac47e1cfecf484fd84f98 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/api_gateway_method_response.html.markdown b/website/docs/cdktf/python/r/api_gateway_method_response.html.markdown
new file mode 100644
index 00000000000..07682c02120
--- /dev/null
+++ b/website/docs/cdktf/python/r/api_gateway_method_response.html.markdown
@@ -0,0 +1,98 @@
+---
+subcategory: "API Gateway"
+layout: "aws"
+page_title: "AWS: aws_api_gateway_method_response"
+description: |-
+  Provides an HTTP Method Response for an API Gateway Resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_api_gateway_method_response
+
+Provides an HTTP Method Response for an API Gateway Resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.api_gateway_integration import ApiGatewayIntegration
+from imports.aws.api_gateway_method import ApiGatewayMethod
+from imports.aws.api_gateway_method_response import ApiGatewayMethodResponse
+from imports.aws.api_gateway_resource import ApiGatewayResource
+from imports.aws.api_gateway_rest_api import ApiGatewayRestApi
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        my_demo_api = ApiGatewayRestApi(self, "MyDemoAPI",
+            description="This is my API for demonstration purposes",
+            name="MyDemoAPI"
+        )
+        my_demo_resource = ApiGatewayResource(self, "MyDemoResource",
+            parent_id=my_demo_api.root_resource_id,
+            path_part="mydemoresource",
+            rest_api_id=my_demo_api.id
+        )
+        my_demo_method = ApiGatewayMethod(self, "MyDemoMethod",
+            authorization="NONE",
+            http_method="GET",
+            resource_id=my_demo_resource.id,
+            rest_api_id=my_demo_api.id
+        )
+        ApiGatewayMethodResponse(self, "response_200",
+            http_method=my_demo_method.http_method,
+            resource_id=my_demo_resource.id,
+            rest_api_id=my_demo_api.id,
+            status_code="200"
+        )
+        ApiGatewayIntegration(self, "MyDemoIntegration",
+            http_method=my_demo_method.http_method,
+            resource_id=my_demo_resource.id,
+            rest_api_id=my_demo_api.id,
+            type="MOCK"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `rest_api_id` - (Required) ID of the associated REST API
+* `resource_id` - (Required) API resource ID
+* `http_method` - (Required) HTTP Method (`GET`, `POST`, `PUT`, `DELETE`, `HEAD`, `OPTIONS`, `ANY`)
+* `status_code` - (Required) HTTP status code
+* `response_models` - (Optional) Map of the API models used for the response's content type
+* `response_parameters` - (Optional) Map of response parameters that can be sent to the caller.
+   For example: `response_parameters = { "method.response.header.X-Some-Header" = true }`
+   would define that the header `X-Some-Header` can be provided on the response.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_api_gateway_method_response` using `REST-API-ID/RESOURCE-ID/HTTP-METHOD/STATUS-CODE`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_api_gateway_method_response` using `REST-API-ID/RESOURCE-ID/HTTP-METHOD/STATUS-CODE`. For example:
+
+```console
+% terraform import aws_api_gateway_method_response.example 12345abcde/67890fghij/GET/200
+```
+
+<!-- cache-key: cdktf-0.18.0 input-747ca6d8aa85968a45fb4eebf14083b89f32bb4152faf84deb93ecea4d18c9cb -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/api_gateway_method_settings.html.markdown b/website/docs/cdktf/python/r/api_gateway_method_settings.html.markdown
new file mode 100644
index 00000000000..21a20e918e2
--- /dev/null
+++ b/website/docs/cdktf/python/r/api_gateway_method_settings.html.markdown
@@ -0,0 +1,242 @@
+---
+subcategory: "API Gateway"
+layout: "aws"
+page_title: "AWS: aws_api_gateway_method_settings"
+description: |-
+  Manages API Gateway Stage Method Settings
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_api_gateway_method_settings
+
+Manages API Gateway Stage Method Settings. For example, CloudWatch logging and metrics.
+
+~> **NOTE:** We recommend using this resource in conjunction with the [`aws_api_gateway_stage` resource](api_gateway_stage.html) instead of a stage managed by the [`aws_api_gateway_deployment` resource](api_gateway_deployment.html) optional `stage_name` argument. Stages managed by the `aws_api_gateway_deployment` resource are recreated on redeployment and this resource will require a second apply to recreate the method settings.
+
+## Example Usage
+
+### End-to-end
+
+An end-to-end example of a REST API configured with OpenAPI can be found in the [`/examples/api-gateway-rest-api-openapi` directory within the GitHub repository](https://github.com/hashicorp/terraform-provider-aws/tree/main/examples/api-gateway-rest-api-openapi).
+
+### Basic Usage
+
+```terraform
+resource "aws_api_gateway_rest_api" "example" {
+  body = jsonencode({
+    openapi = "3.0.1"
+    info = {
+      title   = "example"
+      version = "1.0"
+    }
+    paths = {
+      "/path1" = {
+        get = {
+          x-amazon-apigateway-integration = {
+            httpMethod           = "GET"
+            payloadFormatVersion = "1.0"
+            type                 = "HTTP_PROXY"
+            uri                  = "https://ip-ranges.amazonaws.com/ip-ranges.json"
+          }
+        }
+      }
+    }
+  })
+
+  name = "example"
+}
+
+resource "aws_api_gateway_deployment" "example" {
+  rest_api_id = aws_api_gateway_rest_api.example.id
+
+  triggers = {
+    redeployment = sha1(jsonencode(aws_api_gateway_rest_api.example.body))
+  }
+
+  lifecycle {
+    create_before_destroy = true
+  }
+}
+
+resource "aws_api_gateway_stage" "example" {
+  deployment_id = aws_api_gateway_deployment.example.id
+  rest_api_id   = aws_api_gateway_rest_api.example.id
+  stage_name    = "example"
+}
+
+resource "aws_api_gateway_method_settings" "all" {
+  rest_api_id = aws_api_gateway_rest_api.example.id
+  stage_name  = aws_api_gateway_stage.example.stage_name
+  method_path = "*/*"
+
+  settings {
+    metrics_enabled = true
+    logging_level   = "ERROR"
+  }
+}
+
+resource "aws_api_gateway_method_settings" "path_specific" {
+  rest_api_id = aws_api_gateway_rest_api.example.id
+  stage_name  = aws_api_gateway_stage.example.stage_name
+  method_path = "path1/GET"
+
+  settings {
+    metrics_enabled = true
+    logging_level   = "INFO"
+  }
+}
+```
+
+### CloudWatch Logging and Tracing
+
+The AWS Console API Gateway Editor displays multiple options for CloudWatch Logs that don't directly map to the options in the AWS API and Terraform. These examples show the `settings` blocks that are equivalent to the options the AWS Console gives for CloudWatch Logs.
+
+#### Off
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.api_gateway_method_settings import ApiGatewayMethodSettings
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ApiGatewayMethodSettings(self, "path_specific",
+            method_path="path1/GET",
+            rest_api_id=example.id,
+            settings=ApiGatewayMethodSettingsSettings(
+                logging_level="OFF"
+            ),
+            stage_name=Token.as_string(aws_api_gateway_stage_example.stage_name)
+        )
+```
+
+#### Errors Only
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.api_gateway_method_settings import ApiGatewayMethodSettings
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ApiGatewayMethodSettings(self, "path_specific",
+            method_path="path1/GET",
+            rest_api_id=example.id,
+            settings=ApiGatewayMethodSettingsSettings(
+                data_trace_enabled=False,
+                logging_level="ERROR",
+                metrics_enabled=True
+            ),
+            stage_name=Token.as_string(aws_api_gateway_stage_example.stage_name)
+        )
+```
+
+#### Errors and Info Logs
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.api_gateway_method_settings import ApiGatewayMethodSettings
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ApiGatewayMethodSettings(self, "path_specific",
+            method_path="path1/GET",
+            rest_api_id=example.id,
+            settings=ApiGatewayMethodSettingsSettings(
+                data_trace_enabled=False,
+                logging_level="INFO",
+                metrics_enabled=True
+            ),
+            stage_name=Token.as_string(aws_api_gateway_stage_example.stage_name)
+        )
+```
+
+#### Full Request and Response Logs
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.api_gateway_method_settings import ApiGatewayMethodSettings
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ApiGatewayMethodSettings(self, "path_specific",
+            method_path="path1/GET",
+            rest_api_id=example.id,
+            settings=ApiGatewayMethodSettingsSettings(
+                data_trace_enabled=True,
+                logging_level="INFO",
+                metrics_enabled=True
+            ),
+            stage_name=Token.as_string(aws_api_gateway_stage_example.stage_name)
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `rest_api_id` - (Required) ID of the REST API
+* `stage_name` - (Required) Name of the stage
+* `method_path` - (Required) Method path defined as `{resource_path}/{http_method}` for an individual method override, or `*/*` for overriding all methods in the stage. Ensure to trim any leading forward slashes in the path (e.g., `trimprefix(aws_api_gateway_resource.example.path, "/")`).
+* `settings` - (Required) Settings block, see below.
+
+### `settings`
+
+* `metrics_enabled` - (Optional) Whether Amazon CloudWatch metrics are enabled for this method.
+* `logging_level` - (Optional) Logging level for this method, which effects the log entries pushed to Amazon CloudWatch Logs. The available levels are `OFF`, `ERROR`, and `INFO`.
+* `data_trace_enabled` - (Optional) Whether data trace logging is enabled for this method, which effects the log entries pushed to Amazon CloudWatch Logs.
+* `throttling_burst_limit` - (Optional) Throttling burst limit. Default: `-1` (throttling disabled).
+* `throttling_rate_limit` - (Optional) Throttling rate limit. Default: `-1` (throttling disabled).
+* `caching_enabled` - (Optional) Whether responses should be cached and returned for requests. A cache cluster must be enabled on the stage for responses to be cached.
+* `cache_ttl_in_seconds` - (Optional) Time to live (TTL), in seconds, for cached responses. The higher the TTL, the longer the response will be cached.
+* `cache_data_encrypted` - (Optional) Whether the cached responses are encrypted.
+* `require_authorization_for_cache_control` - (Optional) Whether authorization is required for a cache invalidation request.
+* `unauthorized_cache_control_header_strategy` - (Optional) How to handle unauthorized requests for cache invalidation. The available values are `FAIL_WITH_403`, `SUCCEED_WITH_RESPONSE_HEADER`, `SUCCEED_WITHOUT_RESPONSE_HEADER`.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_api_gateway_method_settings` using `REST-API-ID/STAGE-NAME/METHOD-PATH`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_api_gateway_method_settings` using `REST-API-ID/STAGE-NAME/METHOD-PATH`. For example:
+
+```console
+% terraform import aws_api_gateway_method_settings.example 12345abcde/example/test/GET
+```
+
+<!-- cache-key: cdktf-0.18.0 input-7743821eda51c37e62e60ebb2ef0df1ec418fbff45349d42c5ad9056c52929c9 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/api_gateway_model.html.markdown b/website/docs/cdktf/python/r/api_gateway_model.html.markdown
new file mode 100644
index 00000000000..dab33dcc08a
--- /dev/null
+++ b/website/docs/cdktf/python/r/api_gateway_model.html.markdown
@@ -0,0 +1,81 @@
+---
+subcategory: "API Gateway"
+layout: "aws"
+page_title: "AWS: aws_api_gateway_model"
+description: |-
+  Provides a Model for a REST API Gateway.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_api_gateway_model
+
+Provides a Model for a REST API Gateway.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.api_gateway_model import ApiGatewayModel
+from imports.aws.api_gateway_rest_api import ApiGatewayRestApi
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        my_demo_api = ApiGatewayRestApi(self, "MyDemoAPI",
+            description="This is my API for demonstration purposes",
+            name="MyDemoAPI"
+        )
+        ApiGatewayModel(self, "MyDemoModel",
+            content_type="application/json",
+            description="a JSON schema",
+            name="user",
+            rest_api_id=my_demo_api.id,
+            schema=Token.as_string(
+                Fn.jsonencode({
+                    "type": "object"
+                }))
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `rest_api_id` - (Required) ID of the associated REST API
+* `name` - (Required) Name of the model
+* `description` - (Optional) Description of the model
+* `content_type` - (Required) Content type of the model
+* `schema` - (Required) Schema of the model in a JSON form
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the model
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_api_gateway_model` using `REST-API-ID/NAME`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_api_gateway_model` using `REST-API-ID/NAME`. For example:
+
+```console
+% terraform import aws_api_gateway_model.example 12345abcde/example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-3c89195f3305545d621230506fac11346c31eec2c1309a11239463f693b441d7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/api_gateway_request_validator.html.markdown b/website/docs/cdktf/python/r/api_gateway_request_validator.html.markdown
new file mode 100644
index 00000000000..a75f7fb3466
--- /dev/null
+++ b/website/docs/cdktf/python/r/api_gateway_request_validator.html.markdown
@@ -0,0 +1,71 @@
+---
+subcategory: "API Gateway"
+layout: "aws"
+page_title: "AWS: aws_api_gateway_request_validator"
+description: |-
+  Manages an API Gateway Request Validator.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_api_gateway_request_validator
+
+Manages an API Gateway Request Validator.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.api_gateway_request_validator import ApiGatewayRequestValidator
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ApiGatewayRequestValidator(self, "example",
+            name="example",
+            rest_api_id=Token.as_string(aws_api_gateway_rest_api_example.id),
+            validate_request_body=True,
+            validate_request_parameters=True
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) Name of the request validator
+* `rest_api_id` - (Required) ID of the associated Rest API
+* `validate_request_body` - (Optional) Boolean whether to validate request body. Defaults to `false`.
+* `validate_request_parameters` - (Optional) Boolean whether to validate request parameters. Defaults to `false`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Unique ID of the request validator
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_api_gateway_request_validator` using `REST-API-ID/REQUEST-VALIDATOR-ID`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_api_gateway_request_validator` using `REST-API-ID/REQUEST-VALIDATOR-ID`. For example:
+
+```console
+% terraform import aws_api_gateway_request_validator.example 12345abcde/67890fghij
+```
+
+<!-- cache-key: cdktf-0.18.0 input-505defc9caba2113992cea9320dfb9b74802857b30dd2c0100aa471ccc27a60b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/api_gateway_resource.html.markdown b/website/docs/cdktf/python/r/api_gateway_resource.html.markdown
new file mode 100644
index 00000000000..37c83081dc1
--- /dev/null
+++ b/website/docs/cdktf/python/r/api_gateway_resource.html.markdown
@@ -0,0 +1,75 @@
+---
+subcategory: "API Gateway"
+layout: "aws"
+page_title: "AWS: aws_api_gateway_resource"
+description: |-
+  Provides an API Gateway Resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_api_gateway_resource
+
+Provides an API Gateway Resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.api_gateway_resource import ApiGatewayResource
+from imports.aws.api_gateway_rest_api import ApiGatewayRestApi
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        my_demo_api = ApiGatewayRestApi(self, "MyDemoAPI",
+            description="This is my API for demonstration purposes",
+            name="MyDemoAPI"
+        )
+        ApiGatewayResource(self, "MyDemoResource",
+            parent_id=my_demo_api.root_resource_id,
+            path_part="mydemoresource",
+            rest_api_id=my_demo_api.id
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `rest_api_id` - (Required) ID of the associated REST API
+* `parent_id` - (Required) ID of the parent API resource
+* `path_part` - (Required) Last path segment of this API resource.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Resource's identifier.
+* `path` - Complete path for this API resource, including all parent paths.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_api_gateway_resource` using `REST-API-ID/RESOURCE-ID`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_api_gateway_resource` using `REST-API-ID/RESOURCE-ID`. For example:
+
+```console
+% terraform import aws_api_gateway_resource.example 12345abcde/67890fghij
+```
+
+<!-- cache-key: cdktf-0.18.0 input-721175b3ae904d683d63b51b6401729c22f6dffbfde1cdaa50d14675da16dc36 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/api_gateway_rest_api.html.markdown b/website/docs/cdktf/python/r/api_gateway_rest_api.html.markdown
new file mode 100644
index 00000000000..4f7797e5896
--- /dev/null
+++ b/website/docs/cdktf/python/r/api_gateway_rest_api.html.markdown
@@ -0,0 +1,303 @@
+---
+subcategory: "API Gateway"
+layout: "aws"
+page_title: "AWS: aws_api_gateway_rest_api"
+description: |-
+  Manages an API Gateway REST API.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_api_gateway_rest_api
+
+Manages an API Gateway REST API. The REST API can be configured via [importing an OpenAPI specification](https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-import-api.html) in the `body` argument (with other arguments serving as overrides) or via other Terraform resources to manage the resources ([`aws_api_gateway_resource` resource](api_gateway_resource.html)), methods ([`aws_api_gateway_method` resource](api_gateway_method.html)), integrations ([`aws_api_gateway_integration` resource](api_gateway_integration.html)), etc. of the REST API. Once the REST API is configured, the [`aws_api_gateway_deployment` resource](api_gateway_deployment.html) can be used along with the [`aws_api_gateway_stage` resource](api_gateway_stage.html) to publish the REST API.
+
+-> **Note:** Amazon API Gateway Version 1 resources are used for creating and deploying REST APIs. To create and deploy WebSocket and HTTP APIs, use Amazon API Gateway Version 2 [resources](/docs/providers/aws/r/apigatewayv2_api.html).
+
+!> **WARN:** When importing Open API Specifications with the `body` argument, by default the API Gateway REST API will be replaced with the Open API Specification thus removing any existing methods, resources, integrations, or endpoints. Endpoint mutations are asynchronous operations, and race conditions with DNS are possible. To overcome this limitation, use the `put_rest_api_mode` attribute and set it to `merge`.
+
+## Example Usage
+
+### OpenAPI Specification
+
+An end-to-end example of a REST API configured with OpenAPI can be found in the [`/examples/api-gateway-rest-api-openapi` directory within the GitHub repository](https://github.com/hashicorp/terraform-provider-aws/tree/main/examples/api-gateway-rest-api-openapi).
+
+```terraform
+resource "aws_api_gateway_rest_api" "example" {
+  body = jsonencode({
+    openapi = "3.0.1"
+    info = {
+      title   = "example"
+      version = "1.0"
+    }
+    paths = {
+      "/path1" = {
+        get = {
+          x-amazon-apigateway-integration = {
+            httpMethod           = "GET"
+            payloadFormatVersion = "1.0"
+            type                 = "HTTP_PROXY"
+            uri                  = "https://ip-ranges.amazonaws.com/ip-ranges.json"
+          }
+        }
+      }
+    }
+  })
+
+  name = "example"
+
+  endpoint_configuration {
+    types = ["REGIONAL"]
+  }
+}
+
+resource "aws_api_gateway_deployment" "example" {
+  rest_api_id = aws_api_gateway_rest_api.example.id
+
+  triggers = {
+    redeployment = sha1(jsonencode(aws_api_gateway_rest_api.example.body))
+  }
+
+  lifecycle {
+    create_before_destroy = true
+  }
+}
+
+resource "aws_api_gateway_stage" "example" {
+  deployment_id = aws_api_gateway_deployment.example.id
+  rest_api_id   = aws_api_gateway_rest_api.example.id
+  stage_name    = "example"
+}
+```
+
+### OpenAPI Specification with Private Endpoints
+
+Using `put_rest_api_mode` = `merge` when importing the OpenAPI Specification, the AWS control plane will not delete all existing literal properties that are not explicitly set in the OpenAPI definition. Impacted API Gateway properties: ApiKeySourceType, BinaryMediaTypes, Description, EndpointConfiguration, MinimumCompressionSize, Name, Policy).
+
+```terraform
+data "aws_availability_zones" "available" {
+  state = "available"
+
+  filter {
+    name   = "opt-in-status"
+    values = ["opt-in-not-required"]
+  }
+}
+
+data "aws_region" "current" {}
+
+resource "aws_vpc" "example" {
+  cidr_block           = "10.0.0.0/16"
+  enable_dns_support   = true
+  enable_dns_hostnames = true
+}
+
+resource "aws_default_security_group" "example" {
+  vpc_id = aws_vpc.example.id
+}
+
+resource "aws_subnet" "example" {
+  availability_zone = data.aws_availability_zones.available.names[0]
+  cidr_block        = cidrsubnet(aws_vpc.example.cidr_block, 8, 0)
+  vpc_id            = aws_vpc.example.id
+}
+
+resource "aws_vpc_endpoint" "example" {
+  count = 3
+
+  private_dns_enabled = false
+  security_group_ids  = [aws_default_security_group.example.id]
+  service_name        = "com.amazonaws.${data.aws_region.current.name}.execute-api"
+  subnet_ids          = [aws_subnet.example.id]
+  vpc_endpoint_type   = "Interface"
+  vpc_id              = aws_vpc.example.id
+}
+
+resource "aws_api_gateway_rest_api" "example" {
+  body = jsonencode({
+    openapi = "3.0.1"
+    info = {
+      title   = "example"
+      version = "1.0"
+    }
+    paths = {
+      "/path1" = {
+        get = {
+          x-amazon-apigateway-integration = {
+            httpMethod           = "GET"
+            payloadFormatVersion = "1.0"
+            type                 = "HTTP_PROXY"
+            uri                  = "https://ip-ranges.amazonaws.com/ip-ranges.json"
+          }
+        }
+      }
+    }
+  })
+
+  name              = "example"
+  put_rest_api_mode = "merge"
+
+  endpoint_configuration {
+    types            = ["PRIVATE"]
+    vpc_endpoint_ids = [aws_vpc_endpoint.example[0].id, aws_vpc_endpoint.example[1].id, aws_vpc_endpoint.example[2].id]
+  }
+}
+
+resource "aws_api_gateway_deployment" "example" {
+  rest_api_id = aws_api_gateway_rest_api.example.id
+
+  triggers = {
+    redeployment = sha1(jsonencode(aws_api_gateway_rest_api.example.body))
+  }
+
+  lifecycle {
+    create_before_destroy = true
+  }
+}
+
+resource "aws_api_gateway_stage" "example" {
+  deployment_id = aws_api_gateway_deployment.example.id
+  rest_api_id   = aws_api_gateway_rest_api.example.id
+  stage_name    = "example"
+}
+```
+
+### Terraform Resources
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from cdktf import TerraformResourceLifecycle
+from constructs import Construct
+from cdktf import Token, Fn, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.api_gateway_deployment import ApiGatewayDeployment
+from imports.aws.api_gateway_integration import ApiGatewayIntegration
+from imports.aws.api_gateway_method import ApiGatewayMethod
+from imports.aws.api_gateway_resource import ApiGatewayResource
+from imports.aws.api_gateway_rest_api import ApiGatewayRestApi
+from imports.aws.api_gateway_stage import ApiGatewayStage
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = ApiGatewayRestApi(self, "example",
+            name="example"
+        )
+        aws_api_gateway_resource_example = ApiGatewayResource(self, "example_1",
+            parent_id=example.root_resource_id,
+            path_part="example",
+            rest_api_id=example.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_api_gateway_resource_example.override_logical_id("example")
+        aws_api_gateway_method_example = ApiGatewayMethod(self, "example_2",
+            authorization="NONE",
+            http_method="GET",
+            resource_id=Token.as_string(aws_api_gateway_resource_example.id),
+            rest_api_id=example.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_api_gateway_method_example.override_logical_id("example")
+        aws_api_gateway_integration_example = ApiGatewayIntegration(self, "example_3",
+            http_method=Token.as_string(aws_api_gateway_method_example.http_method),
+            resource_id=Token.as_string(aws_api_gateway_resource_example.id),
+            rest_api_id=example.id,
+            type="MOCK"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_api_gateway_integration_example.override_logical_id("example")
+        aws_api_gateway_deployment_example = ApiGatewayDeployment(self, "example_4",
+            lifecycle=TerraformResourceLifecycle(
+                create_before_destroy=True
+            ),
+            rest_api_id=example.id,
+            triggers={
+                "redeployment": Token.as_string(
+                    Fn.sha1(
+                        Token.as_string(
+                            Fn.jsonencode([aws_api_gateway_resource_example.id, aws_api_gateway_method_example.id, aws_api_gateway_integration_example.id
+                            ]))))
+            }
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_api_gateway_deployment_example.override_logical_id("example")
+        aws_api_gateway_stage_example = ApiGatewayStage(self, "example_5",
+            deployment_id=Token.as_string(aws_api_gateway_deployment_example.id),
+            rest_api_id=example.id,
+            stage_name="example"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_api_gateway_stage_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `api_key_source` - (Optional) Source of the API key for requests. Valid values are `HEADER` (default) and `AUTHORIZER`. If importing an OpenAPI specification via the `body` argument, this corresponds to the [`x-amazon-apigateway-api-key-source` extension](https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-swagger-extensions-api-key-source.html). If the argument value is provided and is different than the OpenAPI value, the argument value will override the OpenAPI value.
+* `binary_media_types` - (Optional) List of binary media types supported by the REST API. By default, the REST API supports only UTF-8-encoded text payloads. If importing an OpenAPI specification via the `body` argument, this corresponds to the [`x-amazon-apigateway-binary-media-types` extension](https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-swagger-extensions-binary-media-types.html). If the argument value is provided and is different than the OpenAPI value, the argument value will override the OpenAPI value.
+* `body` - (Optional) OpenAPI specification that defines the set of routes and integrations to create as part of the REST API. This configuration, and any updates to it, will replace all REST API configuration except values overridden in this resource configuration and other resource updates applied after this resource but before any `aws_api_gateway_deployment` creation. More information about REST API OpenAPI support can be found in the [API Gateway Developer Guide](https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-import-api.html).
+* `description` - (Optional) Description of the REST API. If importing an OpenAPI specification via the `body` argument, this corresponds to the `info.description` field. If the argument value is provided and is different than the OpenAPI value, the argument value will override the OpenAPI value.
+* `disable_execute_api_endpoint` - (Optional) Whether clients can invoke your API by using the default execute-api endpoint. By default, clients can invoke your API with the default https://{api_id}.execute-api.{region}.amazonaws.com endpoint. To require that clients use a custom domain name to invoke your API, disable the default endpoint. Defaults to `false`. If importing an OpenAPI specification via the `body` argument, this corresponds to the [`x-amazon-apigateway-endpoint-configuration` extension `disableExecuteApiEndpoint` property](https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-swagger-extensions-endpoint-configuration.html). If the argument value is `true` and is different than the OpenAPI value, the argument value will override the OpenAPI value.
+* `endpoint_configuration` - (Optional) Configuration block defining API endpoint configuration including endpoint type. Defined below.
+* `minimum_compression_size` - (Optional) Minimum response size to compress for the REST API. String containing an integer value between `-1` and `10485760` (10MB). `-1` will disable an existing compression configuration, and all other values will enable compression with the configured size. New resources can simply omit this argument to disable compression, rather than setting the value to `-1`. If importing an OpenAPI specification via the `body` argument, this corresponds to the [`x-amazon-apigateway-minimum-compression-size` extension](https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-openapi-minimum-compression-size.html). If the argument value is provided and is different than the OpenAPI value, the argument value will override the OpenAPI value.
+* `name` - (Required) Name of the REST API. If importing an OpenAPI specification via the `body` argument, this corresponds to the `info.title` field. If the argument value is different than the OpenAPI value, the argument value will override the OpenAPI value.
+* `fail_on_warnings` - (Optional) Whether warnings while API Gateway is creating or updating the resource should return an error or not. Defaults to `false`
+* `parameters` - (Optional) Map of customizations for importing the specification in the `body` argument. For example, to exclude DocumentationParts from an imported API, set `ignore` equal to `documentation`. Additional documentation, including other parameters such as `basepath`, can be found in the [API Gateway Developer Guide](https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-import-api.html).
+* `policy` - (Optional) JSON formatted policy document that controls access to the API Gateway. For more information about building AWS IAM policy documents with Terraform, see the [AWS IAM Policy Document Guide](https://learn.hashicorp.com/terraform/aws/iam-policy). Terraform will only perform drift detection of its value when present in a configuration. We recommend using the [`aws_api_gateway_rest_api_policy` resource](/docs/providers/aws/r/api_gateway_rest_api_policy.html) instead. If importing an OpenAPI specification via the `body` argument, this corresponds to the [`x-amazon-apigateway-policy` extension](https://docs.aws.amazon.com/apigateway/latest/developerguide/openapi-extensions-policy.html). If the argument value is provided and is different than the OpenAPI value, the argument value will override the OpenAPI value.
+* `put_rest_api_mode` - (Optional) Mode of the PutRestApi operation when importing an OpenAPI specification via the `body` argument (create or update operation). Valid values are `merge` and `overwrite`. If unspecificed, defaults to `overwrite` (for backwards compatibility). This corresponds to the [`x-amazon-apigateway-put-integration-method` extension](https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-swagger-extensions-put-integration-method.html). If the argument value is provided and is different than the OpenAPI value, the argument value will override the OpenAPI value.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+**Note**: If the `body` argument is provided, the OpenAPI specification will be used to configure the resources, methods and integrations for the Rest API. If this argument is provided, the following resources should not be managed as separate ones, as updates may cause manual resource updates to be overwritten:
+
+* `aws_api_gateway_resource`
+* `aws_api_gateway_method`
+* `aws_api_gateway_method_response`
+* `aws_api_gateway_method_settings`
+* `aws_api_gateway_integration`
+* `aws_api_gateway_integration_response`
+* `aws_api_gateway_gateway_response`
+* `aws_api_gateway_model`
+
+### endpoint_configuration
+
+* `types` - (Required) List of endpoint types. This resource currently only supports managing a single value. Valid values: `EDGE`, `REGIONAL` or `PRIVATE`. If unspecified, defaults to `EDGE`. If set to `PRIVATE` recommend to set `put_rest_api_mode` = `merge` to not cause the endpoints and associated Route53 records to be deleted. Refer to the [documentation](https://docs.aws.amazon.com/apigateway/latest/developerguide/create-regional-api.html) for more information on the difference between edge-optimized and regional APIs.
+* `vpc_endpoint_ids` - (Optional) Set of VPC Endpoint identifiers. It is only supported for `PRIVATE` endpoint type. If importing an OpenAPI specification via the `body` argument, this corresponds to the [`x-amazon-apigateway-endpoint-configuration` extension `vpcEndpointIds` property](https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-swagger-extensions-endpoint-configuration.html). If the argument value is provided and is different than the OpenAPI value, **the argument value will override the OpenAPI value**.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN
+* `created_date` - Creation date of the REST API
+* `execution_arn` - Execution ARN part to be used in [`lambda_permission`](/docs/providers/aws/r/lambda_permission.html)'s `source_arn`
+  when allowing API Gateway to invoke a Lambda function,
+  e.g., `arn:aws:execute-api:eu-west-2:123456789012:z4675bid1j`, which can be concatenated with allowed stage, method and resource path.
+* `id` - ID of the REST API
+* `root_resource_id` - Resource ID of the REST API's root
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_api_gateway_rest_api` using the REST API ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_api_gateway_rest_api` using the REST API ID. For example:
+
+```console
+% terraform import aws_api_gateway_rest_api.example 12345abcde
+```
+
+~> **NOTE:** Resource import does not currently support the `body` attribute.
+
+<!-- cache-key: cdktf-0.18.0 input-e489f1763b2359237f3dddc078f272955078eab93aabf7213398c9c17e24c7ea -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/api_gateway_rest_api_policy.html.markdown b/website/docs/cdktf/python/r/api_gateway_rest_api_policy.html.markdown
new file mode 100644
index 00000000000..8a7542cfdfc
--- /dev/null
+++ b/website/docs/cdktf/python/r/api_gateway_rest_api_policy.html.markdown
@@ -0,0 +1,99 @@
+---
+subcategory: "API Gateway"
+layout: "aws"
+page_title: "AWS: aws_api_gateway_rest_api_policy"
+description: |-
+  Provides an API Gateway REST API Policy.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_api_gateway_rest_api_policy
+
+Provides an API Gateway REST API Policy.
+
+-> **Note:** Amazon API Gateway Version 1 resources are used for creating and deploying REST APIs. To create and deploy WebSocket and HTTP APIs, use Amazon API Gateway Version 2 [resources](/docs/providers/aws/r/apigatewayv2_api.html).
+
+## Example Usage
+
+### Basic
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.api_gateway_rest_api import ApiGatewayRestApi
+from imports.aws.api_gateway_rest_api_policy import ApiGatewayRestApiPolicy
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        test = ApiGatewayRestApi(self, "test",
+            name="example-rest-api"
+        )
+        data_aws_iam_policy_document_test = DataAwsIamPolicyDocument(self, "test_1",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["execute-api:Invoke"],
+                condition=[DataAwsIamPolicyDocumentStatementCondition(
+                    test="IpAddress",
+                    values=["123.123.123.123/32"],
+                    variable="aws:SourceIp"
+                )
+                ],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["*"],
+                    type="AWS"
+                )
+                ],
+                resources=[test.execution_arn]
+            )
+            ]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_iam_policy_document_test.override_logical_id("test")
+        aws_api_gateway_rest_api_policy_test = ApiGatewayRestApiPolicy(self, "test_2",
+            policy=Token.as_string(data_aws_iam_policy_document_test.json),
+            rest_api_id=test.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_api_gateway_rest_api_policy_test.override_logical_id("test")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `rest_api_id` - (Required) ID of the REST API.
+* `policy` - (Required) JSON formatted policy document that controls access to the API Gateway. For more information about building AWS IAM policy documents with Terraform, see the [AWS IAM Policy Document Guide](https://learn.hashicorp.com/terraform/aws/iam-policy)
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the REST API
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_api_gateway_rest_api_policy` using the REST API ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_api_gateway_rest_api_policy` using the REST API ID. For example:
+
+```console
+% terraform import aws_api_gateway_rest_api_policy.example 12345abcde
+```
+
+<!-- cache-key: cdktf-0.18.0 input-a578ab2cbd9dbd4f544af9402983cad6a4047d176dace00d2077faadb4d78cfa -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/api_gateway_stage.html.markdown b/website/docs/cdktf/python/r/api_gateway_stage.html.markdown
new file mode 100644
index 00000000000..c5858645172
--- /dev/null
+++ b/website/docs/cdktf/python/r/api_gateway_stage.html.markdown
@@ -0,0 +1,182 @@
+---
+subcategory: "API Gateway"
+layout: "aws"
+page_title: "AWS: aws_api_gateway_stage"
+description: |-
+  Manages an API Gateway Stage.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_api_gateway_stage
+
+Manages an API Gateway Stage. A stage is a named reference to a deployment, which can be done via the [`aws_api_gateway_deployment` resource](api_gateway_deployment.html). Stages can be optionally managed further with the [`aws_api_gateway_base_path_mapping` resource](api_gateway_base_path_mapping.html), [`aws_api_gateway_domain_name` resource](api_gateway_domain_name.html), and [`aws_api_method_settings` resource](api_gateway_method_settings.html). For more information, see the [API Gateway Developer Guide](https://docs.aws.amazon.com/apigateway/latest/developerguide/set-up-stages.html).
+
+## Example Usage
+
+An end-to-end example of a REST API configured with OpenAPI can be found in the [`/examples/api-gateway-rest-api-openapi` directory within the GitHub repository](https://github.com/hashicorp/terraform-provider-aws/tree/main/examples/api-gateway-rest-api-openapi).
+
+```terraform
+resource "aws_api_gateway_rest_api" "example" {
+  body = jsonencode({
+    openapi = "3.0.1"
+    info = {
+      title   = "example"
+      version = "1.0"
+    }
+    paths = {
+      "/path1" = {
+        get = {
+          x-amazon-apigateway-integration = {
+            httpMethod           = "GET"
+            payloadFormatVersion = "1.0"
+            type                 = "HTTP_PROXY"
+            uri                  = "https://ip-ranges.amazonaws.com/ip-ranges.json"
+          }
+        }
+      }
+    }
+  })
+
+  name = "example"
+}
+
+resource "aws_api_gateway_deployment" "example" {
+  rest_api_id = aws_api_gateway_rest_api.example.id
+
+  triggers = {
+    redeployment = sha1(jsonencode(aws_api_gateway_rest_api.example.body))
+  }
+
+  lifecycle {
+    create_before_destroy = true
+  }
+}
+
+resource "aws_api_gateway_stage" "example" {
+  deployment_id = aws_api_gateway_deployment.example.id
+  rest_api_id   = aws_api_gateway_rest_api.example.id
+  stage_name    = "example"
+}
+
+resource "aws_api_gateway_method_settings" "example" {
+  rest_api_id = aws_api_gateway_rest_api.example.id
+  stage_name  = aws_api_gateway_stage.example.stage_name
+  method_path = "*/*"
+
+  settings {
+    metrics_enabled = true
+    logging_level   = "INFO"
+  }
+}
+```
+
+### Managing the API Logging CloudWatch Log Group
+
+API Gateway provides the ability to [enable CloudWatch API logging](https://docs.aws.amazon.com/apigateway/latest/developerguide/set-up-logging.html). To manage the CloudWatch Log Group when this feature is enabled, the [`aws_cloudwatch_log_group` resource](/docs/providers/aws/r/cloudwatch_log_group.html) can be used where the name matches the API Gateway naming convention. If the CloudWatch Log Group previously exists, import the [`aws_cloudwatch_log_group` resource into Terraform](/docs/providers/aws/r/cloudwatch_log_group.html#import) as a one time operation. You can recreate the environment without import.
+
+-> The below configuration uses [`depends_on`](https://www.terraform.io/language/meta-arguments/depends_on) to prevent ordering issues with API Gateway automatically creating the log group first and a variable for naming consistency. Other ordering and naming methodologies may be more appropriate for your environment.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import VariableType, TerraformVariable, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.api_gateway_rest_api import ApiGatewayRestApi
+from imports.aws.api_gateway_stage import ApiGatewayStage
+from imports.aws.cloudwatch_log_group import CloudwatchLogGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, name, deploymentId, restApiId):
+        super().__init__(scope, name)
+        # Terraform Variables are not always the best fit for getting inputs in the context of Terraform CDK.
+        #     You can read more about this at https://cdk.tf/variables
+        stage_name = TerraformVariable(self, "stage_name",
+            default="example",
+            type=VariableType.STRING
+        )
+        example = ApiGatewayRestApi(self, "example",
+            name=name
+        )
+        aws_cloudwatch_log_group_example = CloudwatchLogGroup(self, "example_2",
+            name="API-Gateway-Execution-Logs_${" + example.id + "}/${" + stage_name.value + "}",
+            retention_in_days=7
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_cloudwatch_log_group_example.override_logical_id("example")
+        aws_api_gateway_stage_example = ApiGatewayStage(self, "example_3",
+            depends_on=[aws_cloudwatch_log_group_example],
+            stage_name=stage_name.string_value,
+            deployment_id=deployment_id,
+            rest_api_id=rest_api_id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_api_gateway_stage_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `rest_api_id` - (Required) ID of the associated REST API
+* `stage_name` - (Required) Name of the stage
+* `deployment_id` - (Required) ID of the deployment that the stage points to
+* `access_log_settings` - (Optional) Enables access logs for the API stage. See [Access Log Settings](#access-log-settings) below.
+* `cache_cluster_enabled` - (Optional) Whether a cache cluster is enabled for the stage
+* `cache_cluster_size` - (Optional) Size of the cache cluster for the stage, if enabled. Allowed values include `0.5`, `1.6`, `6.1`, `13.5`, `28.4`, `58.2`, `118` and `237`.
+* `canary_settings` - (Optional) Configuration settings of a canary deployment. See [Canary Settings](#canary-settings) below.
+* `client_certificate_id` - (Optional) Identifier of a client certificate for the stage.
+* `description` - (Optional) Description of the stage.
+* `documentation_version` - (Optional) Version of the associated API documentation
+* `variables` - (Optional) Map that defines the stage variables
+* `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `xray_tracing_enabled` - (Optional) Whether active tracing with X-ray is enabled. Defaults to `false`.
+
+### Access Log Settings
+
+* `destination_arn` - (Required) ARN of the CloudWatch Logs log group or Kinesis Data Firehose delivery stream to receive access logs. If you specify a Kinesis Data Firehose delivery stream, the stream name must begin with `amazon-apigateway-`. Automatically removes trailing `:*` if present.
+* `format` - (Required) Formatting and values recorded in the logs.
+For more information on configuring the log format rules visit the AWS [documentation](https://docs.aws.amazon.com/apigateway/latest/developerguide/set-up-logging.html)
+
+### Canary Settings
+
+* `percent_traffic` - (Optional) Percent `0.0` - `100.0` of traffic to divert to the canary deployment.
+* `stage_variable_overrides` - (Optional) Map of overridden stage `variables` (including new variables) for the canary deployment.
+* `use_stage_cache` - (Optional) Whether the canary deployment uses the stage cache. Defaults to false.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN
+* `id` - ID of the stage
+* `invoke_url` - URL to invoke the API pointing to the stage,
+  e.g., `https://z4675bid1j.execute-api.eu-west-2.amazonaws.com/prod`
+* `execution_arn` - Execution ARN to be used in [`lambda_permission`](/docs/providers/aws/r/lambda_permission.html)'s `source_arn`
+  when allowing API Gateway to invoke a Lambda function,
+  e.g., `arn:aws:execute-api:eu-west-2:123456789012:z4675bid1j/prod`
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `web_acl_arn` - ARN of the WebAcl associated with the Stage.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_api_gateway_stage` using `REST-API-ID/STAGE-NAME`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_api_gateway_stage` using `REST-API-ID/STAGE-NAME`. For example:
+
+```console
+% terraform import aws_api_gateway_stage.example 12345abcde/example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-a0512b7365529cfc2af4fc000b34cd44473168df1e317e144f5b466e44cbe9fe -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/api_gateway_usage_plan.html.markdown b/website/docs/cdktf/python/r/api_gateway_usage_plan.html.markdown
new file mode 100644
index 00000000000..2d0100d1d15
--- /dev/null
+++ b/website/docs/cdktf/python/r/api_gateway_usage_plan.html.markdown
@@ -0,0 +1,164 @@
+---
+subcategory: "API Gateway"
+layout: "aws"
+page_title: "AWS: aws_api_gateway_usage_plan"
+description: |-
+  Provides an API Gateway Usage Plan.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_api_gateway_usage_plan
+
+Provides an API Gateway Usage Plan.
+
+## Example Usage
+
+```terraform
+resource "aws_api_gateway_rest_api" "example" {
+  body = jsonencode({
+    openapi = "3.0.1"
+    info = {
+      title   = "example"
+      version = "1.0"
+    }
+    paths = {
+      "/path1" = {
+        get = {
+          x-amazon-apigateway-integration = {
+            httpMethod           = "GET"
+            payloadFormatVersion = "1.0"
+            type                 = "HTTP_PROXY"
+            uri                  = "https://ip-ranges.amazonaws.com/ip-ranges.json"
+          }
+        }
+      }
+    }
+  })
+
+  name = "example"
+}
+
+resource "aws_api_gateway_deployment" "example" {
+  rest_api_id = aws_api_gateway_rest_api.example.id
+
+  triggers = {
+    redeployment = sha1(jsonencode(aws_api_gateway_rest_api.example.body))
+  }
+
+  lifecycle {
+    create_before_destroy = true
+  }
+}
+
+resource "aws_api_gateway_stage" "development" {
+  deployment_id = aws_api_gateway_deployment.example.id
+  rest_api_id   = aws_api_gateway_rest_api.example.id
+  stage_name    = "development"
+}
+
+resource "aws_api_gateway_stage" "production" {
+  deployment_id = aws_api_gateway_deployment.example.id
+  rest_api_id   = aws_api_gateway_rest_api.example.id
+  stage_name    = "production"
+}
+
+resource "aws_api_gateway_usage_plan" "example" {
+  name         = "my-usage-plan"
+  description  = "my description"
+  product_code = "MYCODE"
+
+  api_stages {
+    api_id = aws_api_gateway_rest_api.example.id
+    stage  = aws_api_gateway_stage.development.stage_name
+  }
+
+  api_stages {
+    api_id = aws_api_gateway_rest_api.example.id
+    stage  = aws_api_gateway_stage.production.stage_name
+  }
+
+  quota_settings {
+    limit  = 20
+    offset = 2
+    period = "WEEK"
+  }
+
+  throttle_settings {
+    burst_limit = 5
+    rate_limit  = 10
+  }
+}
+```
+
+## Argument Reference
+
+The API Gateway Usage Plan argument layout is a structure composed of several sub-resources - these resources are laid out below.
+
+### Top-Level Arguments
+
+* `name` - (Required) Name of the usage plan.
+* `description` - (Optional) Description of a usage plan.
+* `api_stages` - (Optional) Associated [API stages](#api-stages-arguments) of the usage plan.
+* `quota_settings` - (Optional) The [quota settings](#quota-settings-arguments) of the usage plan.
+* `throttle_settings` - (Optional) The [throttling limits](#throttling-settings-arguments) of the usage plan.
+* `product_code` - (Optional) AWS Marketplace product identifier to associate with the usage plan as a SaaS product on AWS Marketplace.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+#### Api Stages arguments
+
+* `api_id` (Required) - API Id of the associated API stage in a usage plan.
+* `stage` (Required) - API stage name of the associated API stage in a usage plan.
+* `throttle` - (Optional) The [throttling limits](#throttle) of the usage plan.
+
+##### Throttle
+
+* `path` (Required) - Method to apply the throttle settings for. Specfiy the path and method, for example `/test/GET`.
+* `burst_limit` (Optional) - The API request burst limit, the maximum rate limit over a time ranging from one to a few seconds, depending upon whether the underlying token bucket is at its full capacity.
+* `rate_limit` (Optional) - The API request steady-state rate limit.
+
+#### Quota Settings Arguments
+
+* `limit` (Optional) - Maximum number of requests that can be made in a given time period.
+* `offset` (Optional) - Number of requests subtracted from the given limit in the initial time period.
+* `period` (Optional) - Time period in which the limit applies. Valid values are "DAY", "WEEK" or "MONTH".
+
+#### Throttling Settings Arguments
+
+* `burst_limit` (Optional) - The API request burst limit, the maximum rate limit over a time ranging from one to a few seconds, depending upon whether the underlying token bucket is at its full capacity.
+* `rate_limit` (Optional) - The API request steady-state rate limit.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the API resource
+* `name` - Name of the usage plan.
+* `description` - Description of a usage plan.
+* `api_stages` - Associated API stages of the usage plan.
+* `quota_settings` - Quota of the usage plan.
+* `throttle_settings` - Throttling limits of the usage plan.
+* `product_code` - AWS Marketplace product identifier to associate with the usage plan as a SaaS product on AWS Marketplace.
+* `arn` - ARN
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AWS API Gateway Usage Plan using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import AWS API Gateway Usage Plan using the `id`. For example:
+
+```console
+% terraform import aws_api_gateway_usage_plan.myusageplan <usage_plan_id>
+```
+
+<!-- cache-key: cdktf-0.18.0 input-24116054635474bb919fe95d52d6e98ba1ea28094c03b0bd8fe0eab47156f843 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/api_gateway_usage_plan_key.html.markdown b/website/docs/cdktf/python/r/api_gateway_usage_plan_key.html.markdown
new file mode 100644
index 00000000000..d49951120ca
--- /dev/null
+++ b/website/docs/cdktf/python/r/api_gateway_usage_plan_key.html.markdown
@@ -0,0 +1,91 @@
+---
+subcategory: "API Gateway"
+layout: "aws"
+page_title: "AWS: aws_api_gateway_usage_plan_key"
+description: |-
+  Provides an API Gateway Usage Plan Key.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_api_gateway_usage_plan_key
+
+Provides an API Gateway Usage Plan Key.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.api_gateway_api_key import ApiGatewayApiKey
+from imports.aws.api_gateway_rest_api import ApiGatewayRestApi
+from imports.aws.api_gateway_usage_plan import ApiGatewayUsagePlan
+from imports.aws.api_gateway_usage_plan_key import ApiGatewayUsagePlanKey
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        mykey = ApiGatewayApiKey(self, "mykey",
+            name="my_key"
+        )
+        test = ApiGatewayRestApi(self, "test",
+            name="MyDemoAPI"
+        )
+        myusageplan = ApiGatewayUsagePlan(self, "myusageplan",
+            api_stages=[ApiGatewayUsagePlanApiStages(
+                api_id=test.id,
+                stage=foo.stage_name
+            )
+            ],
+            name="my_usage_plan"
+        )
+        ApiGatewayUsagePlanKey(self, "main",
+            key_id=mykey.id,
+            key_type="API_KEY",
+            usage_plan_id=myusageplan.id
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `key_id` - (Required) Identifier of the API key resource.
+* `key_type` - (Required) Type of the API key resource. Currently, the valid key type is API_KEY.
+* `usage_plan_id` - (Required) Id of the usage plan resource representing to associate the key to.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - ID of a usage plan key.
+* `key_id` - Identifier of the API gateway key resource.
+* `key_type` - Type of a usage plan key. Currently, the valid key type is API_KEY.
+* `usage_plan_id` - ID of the API resource
+* `name` - Name of a usage plan key.
+* `value` - Value of a usage plan key.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AWS API Gateway Usage Plan Key using the `USAGE-PLAN-ID/USAGE-PLAN-KEY-ID`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import AWS API Gateway Usage Plan Key using the `USAGE-PLAN-ID/USAGE-PLAN-KEY-ID`. For example:
+
+```console
+% terraform import aws_api_gateway_usage_plan_key.key 12345abcde/zzz
+```
+
+<!-- cache-key: cdktf-0.18.0 input-64d31ac82ac47958b893fdad358b9552bfb53b3872642df3b580cd7ea2309914 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/api_gateway_vpc_link.html.markdown b/website/docs/cdktf/python/r/api_gateway_vpc_link.html.markdown
new file mode 100644
index 00000000000..51f89ed357e
--- /dev/null
+++ b/website/docs/cdktf/python/r/api_gateway_vpc_link.html.markdown
@@ -0,0 +1,86 @@
+---
+subcategory: "API Gateway"
+layout: "aws"
+page_title: "AWS: aws_api_gateway_vpc_link"
+description: |-
+  Provides an API Gateway VPC Link.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_api_gateway_vpc_link
+
+Provides an API Gateway VPC Link.
+
+-> **Note:** Amazon API Gateway Version 1 VPC Links enable private integrations that connect REST APIs to private resources in a VPC.
+To enable private integration for HTTP APIs, use the Amazon API Gateway Version 2 VPC Link [resource](/docs/providers/aws/r/apigatewayv2_vpc_link.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.api_gateway_vpc_link import ApiGatewayVpcLink
+from imports.aws.lb import Lb
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = Lb(self, "example",
+            internal=True,
+            load_balancer_type="network",
+            name="example",
+            subnet_mapping=[LbSubnetMapping(
+                subnet_id="12345"
+            )
+            ]
+        )
+        aws_api_gateway_vpc_link_example = ApiGatewayVpcLink(self, "example_1",
+            description="example description",
+            name="example",
+            target_arns=[example.arn]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_api_gateway_vpc_link_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) Name used to label and identify the VPC link.
+* `description` - (Optional) Description of the VPC link.
+* `target_arns` - (Required, ForceNew) List of network load balancer arns in the VPC targeted by the VPC link. Currently AWS only supports 1 target.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Identifier of the VpcLink.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import API Gateway VPC Link using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import API Gateway VPC Link using the `id`. For example:
+
+```console
+% terraform import aws_api_gateway_vpc_link.example 12345abcde
+```
+
+<!-- cache-key: cdktf-0.18.0 input-67ae655f1b594d4a56352e7b95e9f98e0a7e757e376024aa97ec46526256091e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/apigatewayv2_api.html.markdown b/website/docs/cdktf/python/r/apigatewayv2_api.html.markdown
new file mode 100644
index 00000000000..e7a73315f86
--- /dev/null
+++ b/website/docs/cdktf/python/r/apigatewayv2_api.html.markdown
@@ -0,0 +1,133 @@
+---
+subcategory: "API Gateway V2"
+layout: "aws"
+page_title: "AWS: aws_apigatewayv2_api"
+description: |-
+  Manages an Amazon API Gateway Version 2 API.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_apigatewayv2_api
+
+Manages an Amazon API Gateway Version 2 API.
+
+-> **Note:** Amazon API Gateway Version 2 resources are used for creating and deploying WebSocket and HTTP APIs. To create and deploy REST APIs, use Amazon API Gateway Version 1 [resources](/docs/providers/aws/r/api_gateway_rest_api.html).
+
+## Example Usage
+
+### Basic WebSocket API
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.apigatewayv2_api import Apigatewayv2Api
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Apigatewayv2Api(self, "example",
+            name="example-websocket-api",
+            protocol_type="WEBSOCKET",
+            route_selection_expression="$request.body.action"
+        )
+```
+
+### Basic HTTP API
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.apigatewayv2_api import Apigatewayv2Api
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Apigatewayv2Api(self, "example",
+            name="example-http-api",
+            protocol_type="HTTP"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) Name of the API. Must be less than or equal to 128 characters in length.
+* `protocol_type` - (Required) API protocol. Valid values: `HTTP`, `WEBSOCKET`.
+* `api_key_selection_expression` - (Optional) An [API key selection expression](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-websocket-api-selection-expressions.html#apigateway-websocket-api-apikey-selection-expressions).
+Valid values: `$context.authorizer.usageIdentifierKey`, `$request.header.x-api-key`. Defaults to `$request.header.x-api-key`.
+Applicable for WebSocket APIs.
+* `cors_configuration` - (Optional) Cross-origin resource sharing (CORS) [configuration](https://docs.aws.amazon.com/apigateway/latest/developerguide/http-api-cors.html). Applicable for HTTP APIs.
+* `credentials_arn` - (Optional) Part of _quick create_. Specifies any credentials required for the integration. Applicable for HTTP APIs.
+* `description` - (Optional) Description of the API. Must be less than or equal to 1024 characters in length.
+* `disable_execute_api_endpoint` - (Optional) Whether clients can invoke the API by using the default `execute-api` endpoint.
+By default, clients can invoke the API with the default `{api_id}.execute-api.{region}.amazonaws.com endpoint`.
+To require that clients use a custom domain name to invoke the API, disable the default endpoint.
+* `route_key` - (Optional) Part of _quick create_. Specifies any [route key](https://docs.aws.amazon.com/apigateway/latest/developerguide/http-api-develop-routes.html). Applicable for HTTP APIs.
+* `route_selection_expression` - (Optional) The [route selection expression](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-websocket-api-selection-expressions.html#apigateway-websocket-api-route-selection-expressions) for the API.
+Defaults to `$request.method $request.path`.
+* `tags` - (Optional) Map of tags to assign to the API. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `target` - (Optional) Part of _quick create_. Quick create produces an API with an integration, a default catch-all route, and a default stage which is configured to automatically deploy changes.
+For HTTP integrations, specify a fully qualified URL. For Lambda integrations, specify a function ARN.
+The type of the integration will be `HTTP_PROXY` or `AWS_PROXY`, respectively. Applicable for HTTP APIs.
+* `body` - (Optional) An OpenAPI specification that defines the set of routes and integrations to create as part of the HTTP APIs. Supported only for HTTP APIs.
+* `version` - (Optional) Version identifier for the API. Must be between 1 and 64 characters in length.
+* `fail_on_warnings` - (Optional) Whether warnings should return an error while API Gateway is creating or updating the resource using an OpenAPI specification. Defaults to `false`. Applicable for HTTP APIs.
+
+__Note__: If the `body` argument is provided, the OpenAPI specification will be used to configure the integrations and route for the HTTP API. If this argument is provided, the following resources should not be managed as separate ones, as updates may cause manual resource updates to be overwritten:
+
+* `aws_apigatewayv2_integration`
+* `aws_apigatewayv2_route`
+
+Further more, the `name`, `description`, `cors_configuration`, `tags` and `version` fields should be specified in the Terraform configuration and the values will override any values specified in the OpenAPI document.
+
+The `cors_configuration` object supports the following:
+
+* `allow_credentials` - (Optional) Whether credentials are included in the CORS request.
+* `allow_headers` - (Optional) Set of allowed HTTP headers.
+* `allow_methods` - (Optional) Set of allowed HTTP methods.
+* `allow_origins` - (Optional) Set of allowed origins.
+* `expose_headers` - (Optional) Set of exposed HTTP headers.
+* `max_age` - (Optional) Number of seconds that the browser should cache preflight request results.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - API identifier.
+* `api_endpoint` - URI of the API, of the form `https://{api-id}.execute-api.{region}.amazonaws.com` for HTTP APIs and `wss://{api-id}.execute-api.{region}.amazonaws.com` for WebSocket APIs.
+* `arn` - ARN of the API.
+* `execution_arn` - ARN prefix to be used in an [`aws_lambda_permission`](/docs/providers/aws/r/lambda_permission.html)'s `source_arn` attribute
+or in an [`aws_iam_policy`](/docs/providers/aws/r/iam_policy.html) to authorize access to the [`@connections` API](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-how-to-call-websocket-api-connections.html).
+See the [Amazon API Gateway Developer Guide](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-websocket-control-access-iam.html) for details.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_apigatewayv2_api` using the API identifier. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_apigatewayv2_api` using the API identifier. For example:
+
+```console
+% terraform import aws_apigatewayv2_api.example aabbccddee
+```
+
+<!-- cache-key: cdktf-0.18.0 input-aa8c33d1b4534c72e0765acdfd063cd72de93dec3553988cad57b268051e01d2 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/apigatewayv2_api_mapping.html.markdown b/website/docs/cdktf/python/r/apigatewayv2_api_mapping.html.markdown
new file mode 100644
index 00000000000..f15ed29adc5
--- /dev/null
+++ b/website/docs/cdktf/python/r/apigatewayv2_api_mapping.html.markdown
@@ -0,0 +1,73 @@
+---
+subcategory: "API Gateway V2"
+layout: "aws"
+page_title: "AWS: aws_apigatewayv2_api_mapping"
+description: |-
+  Manages an Amazon API Gateway Version 2 API mapping.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_apigatewayv2_api_mapping
+
+Manages an Amazon API Gateway Version 2 API mapping.
+More information can be found in the [Amazon API Gateway Developer Guide](https://docs.aws.amazon.com/apigateway/latest/developerguide/how-to-custom-domains.html).
+
+## Example Usage
+
+### Basic
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.apigatewayv2_api_mapping import Apigatewayv2ApiMapping
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Apigatewayv2ApiMapping(self, "example",
+            api_id=Token.as_string(aws_apigatewayv2_api_example.id),
+            domain_name=Token.as_string(aws_apigatewayv2_domain_name_example.id),
+            stage=Token.as_string(aws_apigatewayv2_stage_example.id)
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `api_id` - (Required) API identifier.
+* `domain_name` - (Required) Domain name. Use the [`aws_apigatewayv2_domain_name`](/docs/providers/aws/r/apigatewayv2_domain_name.html) resource to configure a domain name.
+* `stage` - (Required) API stage. Use the [`aws_apigatewayv2_stage`](/docs/providers/aws/r/apigatewayv2_stage.html) resource to configure an API stage.
+* `api_mapping_key` - (Optional) The API mapping key. Refer to [REST API](https://docs.aws.amazon.com/apigateway/latest/developerguide/rest-api-mappings.html), [HTTP API](https://docs.aws.amazon.com/apigateway/latest/developerguide/http-api-mappings.html) or [WebSocket API](https://docs.aws.amazon.com/apigateway/latest/developerguide/websocket-api-mappings.html).
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - API mapping identifier.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_apigatewayv2_api_mapping` using the API mapping identifier and domain name. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_apigatewayv2_api_mapping` using the API mapping identifier and domain name. For example:
+
+```console
+% terraform import aws_apigatewayv2_api_mapping.example 1122334/ws-api.example.com
+```
+
+<!-- cache-key: cdktf-0.18.0 input-580fc04639f7b69e714911cbb27a6fa6354fc412415a99400266b16e65672884 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/apigatewayv2_authorizer.html.markdown b/website/docs/cdktf/python/r/apigatewayv2_authorizer.html.markdown
new file mode 100644
index 00000000000..3b2ca380357
--- /dev/null
+++ b/website/docs/cdktf/python/r/apigatewayv2_authorizer.html.markdown
@@ -0,0 +1,122 @@
+---
+subcategory: "API Gateway V2"
+layout: "aws"
+page_title: "AWS: aws_apigatewayv2_authorizer"
+description: |-
+  Manages an Amazon API Gateway Version 2 authorizer.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_apigatewayv2_authorizer
+
+Manages an Amazon API Gateway Version 2 authorizer.
+More information can be found in the [Amazon API Gateway Developer Guide](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-websocket-api.html).
+
+## Example Usage
+
+### Basic WebSocket API
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.apigatewayv2_authorizer import Apigatewayv2Authorizer
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Apigatewayv2Authorizer(self, "example",
+            api_id=Token.as_string(aws_apigatewayv2_api_example.id),
+            authorizer_type="REQUEST",
+            authorizer_uri=Token.as_string(aws_lambda_function_example.invoke_arn),
+            identity_sources=["route.request.header.Auth"],
+            name="example-authorizer"
+        )
+```
+
+### Basic HTTP API
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.apigatewayv2_authorizer import Apigatewayv2Authorizer
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Apigatewayv2Authorizer(self, "example",
+            api_id=Token.as_string(aws_apigatewayv2_api_example.id),
+            authorizer_payload_format_version="2.0",
+            authorizer_type="REQUEST",
+            authorizer_uri=Token.as_string(aws_lambda_function_example.invoke_arn),
+            identity_sources=["$request.header.Authorization"],
+            name="example-authorizer"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `api_id` - (Required) API identifier.
+* `authorizer_type` - (Required) Authorizer type. Valid values: `JWT`, `REQUEST`.
+Specify `REQUEST` for a Lambda function using incoming request parameters.
+For HTTP APIs, specify `JWT` to use JSON Web Tokens.
+* `name` - (Required) Name of the authorizer. Must be between 1 and 128 characters in length.
+* `authorizer_credentials_arn` - (Optional) Required credentials as an IAM role for API Gateway to invoke the authorizer.
+Supported only for `REQUEST` authorizers.
+* `authorizer_payload_format_version` - (Optional) Format of the payload sent to an HTTP API Lambda authorizer. Required for HTTP API Lambda authorizers.
+Valid values: `1.0`, `2.0`.
+* `authorizer_result_ttl_in_seconds` - (Optional) Time to live (TTL) for cached authorizer results, in seconds. If it equals 0, authorization caching is disabled.
+If it is greater than 0, API Gateway caches authorizer responses. The maximum value is 3600, or 1 hour. Defaults to `300`.
+Supported only for HTTP API Lambda authorizers.
+* `authorizer_uri` - (Optional) Authorizer's Uniform Resource Identifier (URI).
+For `REQUEST` authorizers this must be a well-formed Lambda function URI, such as the `invoke_arn` attribute of the [`aws_lambda_function`](/docs/providers/aws/r/lambda_function.html) resource.
+Supported only for `REQUEST` authorizers. Must be between 1 and 2048 characters in length.
+* `enable_simple_responses` - (Optional) Whether a Lambda authorizer returns a response in a simple format. If enabled, the Lambda authorizer can return a boolean value instead of an IAM policy.
+Supported only for HTTP APIs.
+* `identity_sources` - (Optional) Identity sources for which authorization is requested.
+For `REQUEST` authorizers the value is a list of one or more mapping expressions of the specified request parameters.
+For `JWT` authorizers the single entry specifies where to extract the JSON Web Token (JWT) from inbound requests.
+* `jwt_configuration` - (Optional) Configuration of a JWT authorizer. Required for the `JWT` authorizer type.
+Supported only for HTTP APIs.
+
+The `jwt_configuration` object supports the following:
+
+* `audience` - (Optional) List of the intended recipients of the JWT. A valid JWT must provide an aud that matches at least one entry in this list.
+* `issuer` - (Optional) Base domain of the identity provider that issues JSON Web Tokens, such as the `endpoint` attribute of the [`aws_cognito_user_pool`](/docs/providers/aws/r/cognito_user_pool.html) resource.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Authorizer identifier.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_apigatewayv2_authorizer` using the API identifier and authorizer identifier. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_apigatewayv2_authorizer` using the API identifier and authorizer identifier. For example:
+
+```console
+% terraform import aws_apigatewayv2_authorizer.example aabbccddee/1122334
+```
+
+<!-- cache-key: cdktf-0.18.0 input-322d065b428456a7d1cc59a5a9728d8c2146130eb3756317834d9f82f13b132e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/apigatewayv2_deployment.html.markdown b/website/docs/cdktf/python/r/apigatewayv2_deployment.html.markdown
new file mode 100644
index 00000000000..d7089ed794a
--- /dev/null
+++ b/website/docs/cdktf/python/r/apigatewayv2_deployment.html.markdown
@@ -0,0 +1,119 @@
+---
+subcategory: "API Gateway V2"
+layout: "aws"
+page_title: "AWS: aws_apigatewayv2_deployment"
+description: |-
+  Manages an Amazon API Gateway Version 2 deployment.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_apigatewayv2_deployment
+
+Manages an Amazon API Gateway Version 2 deployment.
+More information can be found in the [Amazon API Gateway Developer Guide](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-websocket-api.html).
+
+-> **Note:** Creating a deployment for an API requires at least one `aws_apigatewayv2_route` resource associated with that API. To avoid race conditions when all resources are being created together, you need to add implicit resource references via the `triggers` argument or explicit resource references using the [resource `depends_on` meta-argument](https://www.terraform.io/docs/configuration/meta-arguments/depends_on.html).
+
+-> Enable the [resource `lifecycle` configuration block `create_before_destroy` argument](https://www.terraform.io/language/meta-arguments/lifecycle#create_before_destroy) in this resource configuration to properly order redeployments in Terraform.
+
+## Example Usage
+
+### Basic
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from cdktf import TerraformResourceLifecycle
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.apigatewayv2_deployment import Apigatewayv2Deployment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Apigatewayv2Deployment(self, "example",
+            api_id=Token.as_string(aws_apigatewayv2_api_example.id),
+            description="Example deployment",
+            lifecycle=TerraformResourceLifecycle(
+                create_before_destroy=True
+            )
+        )
+```
+
+### Redeployment Triggers
+
+-> **NOTE:** This is an optional and Terraform 0.12 (or later) advanced configuration that shows calculating a hash of the API's Terraform resources to determine changes that should trigger a new deployment. This value will change after the first Terraform apply of new resources, triggering an immediate redeployment, however it will stabilize afterwards except for resource changes. The `triggers` map can also be configured in other, more complex ways to fit the environment, avoiding the immediate redeployment issue.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from cdktf import TerraformResourceLifecycle
+from constructs import Construct
+from cdktf import Token, Fn, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.apigatewayv2_deployment import Apigatewayv2Deployment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Apigatewayv2Deployment(self, "example",
+            api_id=Token.as_string(aws_apigatewayv2_api_example.id),
+            description="Example deployment",
+            lifecycle=TerraformResourceLifecycle(
+                create_before_destroy=True
+            ),
+            triggers={
+                "redeployment": Token.as_string(
+                    Fn.sha1(
+                        Token.as_string(
+                            Fn.join(",",
+                                Token.as_list(
+                                    Fn.tolist([
+                                        Fn.jsonencode(aws_apigatewayv2_integration_example),
+                                        Fn.jsonencode(aws_apigatewayv2_route_example)
+                                    ]))))))
+            }
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `api_id` - (Required) API identifier.
+* `description` - (Optional) Description for the deployment resource. Must be less than or equal to 1024 characters in length.
+* `triggers` - (Optional) Map of arbitrary keys and values that, when changed, will trigger a redeployment. To force a redeployment without changing these keys/values, use the [`terraform taint` command](https://www.terraform.io/docs/commands/taint.html).
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Deployment identifier.
+* `auto_deployed` - Whether the deployment was automatically released.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_apigatewayv2_deployment` using the API identifier and deployment identifier. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_apigatewayv2_deployment` using the API identifier and deployment identifier. For example:
+
+```console
+% terraform import aws_apigatewayv2_deployment.example aabbccddee/1122334
+```
+
+The `triggers` argument cannot be imported.
+
+<!-- cache-key: cdktf-0.18.0 input-6f168dfabc70a225ecc775cc6a4b2adaf3369f7cedadbfe8329709220731be58 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/apigatewayv2_domain_name.html.markdown b/website/docs/cdktf/python/r/apigatewayv2_domain_name.html.markdown
new file mode 100644
index 00000000000..a62adbb4916
--- /dev/null
+++ b/website/docs/cdktf/python/r/apigatewayv2_domain_name.html.markdown
@@ -0,0 +1,144 @@
+---
+subcategory: "API Gateway V2"
+layout: "aws"
+page_title: "AWS: aws_apigatewayv2_domain_name"
+description: |-
+  Manages an Amazon API Gateway Version 2 domain name.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_apigatewayv2_domain_name
+
+Manages an Amazon API Gateway Version 2 domain name.
+More information can be found in the [Amazon API Gateway Developer Guide](https://docs.aws.amazon.com/apigateway/latest/developerguide/how-to-custom-domains.html).
+
+-> **Note:** This resource establishes ownership of and the TLS settings for
+a particular domain name. An API stage can be associated with the domain name using the `aws_apigatewayv2_api_mapping` resource.
+
+## Example Usage
+
+### Basic
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.apigatewayv2_domain_name import Apigatewayv2DomainName
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Apigatewayv2DomainName(self, "example",
+            domain_name="ws-api.example.com",
+            domain_name_configuration=Apigatewayv2DomainNameDomainNameConfiguration(
+                certificate_arn=Token.as_string(aws_acm_certificate_example.arn),
+                endpoint_type="REGIONAL",
+                security_policy="TLS_1_2"
+            )
+        )
+```
+
+### Associated Route 53 Resource Record
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, Fn, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.apigatewayv2_domain_name import Apigatewayv2DomainName
+from imports.aws.route53_record import Route53Record
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = Apigatewayv2DomainName(self, "example",
+            domain_name="http-api.example.com",
+            domain_name_configuration=Apigatewayv2DomainNameDomainNameConfiguration(
+                certificate_arn=Token.as_string(aws_acm_certificate_example.arn),
+                endpoint_type="REGIONAL",
+                security_policy="TLS_1_2"
+            )
+        )
+        aws_route53_record_example = Route53Record(self, "example_1",
+            alias=Route53RecordAlias(
+                evaluate_target_health=False,
+                name=Token.as_string(
+                    Fn.lookup_nested(example.domain_name_configuration, ["0", "target_domain_name"
+                    ])),
+                zone_id=Token.as_string(
+                    Fn.lookup_nested(example.domain_name_configuration, ["0", "hosted_zone_id"
+                    ]))
+            ),
+            name=example.domain_name,
+            type="A",
+            zone_id=Token.as_string(aws_route53_zone_example.zone_id)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_route53_record_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `domain_name` - (Required) Domain name. Must be between 1 and 512 characters in length.
+* `domain_name_configuration` - (Required) Domain name configuration. See below.
+* `mutual_tls_authentication` - (Optional) Mutual TLS authentication configuration for the domain name.
+* `tags` - (Optional) Map of tags to assign to the domain name. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### `domain_name_configuration`
+
+* `certificate_arn` - (Required) ARN of an AWS-managed certificate that will be used by the endpoint for the domain name. AWS Certificate Manager is the only supported source. Use the [`aws_acm_certificate`](/docs/providers/aws/r/acm_certificate.html) resource to configure an ACM certificate.
+* `endpoint_type` - (Required) Endpoint type. Valid values: `REGIONAL`.
+* `hosted_zone_id` - (Computed) Amazon Route 53 Hosted Zone ID of the endpoint.
+* `ownership_verification_certificate_arn` - (Optional) ARN of the AWS-issued certificate used to validate custom domain ownership (when `certificate_arn` is issued via an ACM Private CA or `mutual_tls_authentication` is configured with an ACM-imported certificate.)
+* `security_policy` - (Required) Transport Layer Security (TLS) version of the [security policy](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-custom-domain-tls-version.html) for the domain name. Valid values: `TLS_1_2`.
+* `target_domain_name` - (Computed) Target domain name.
+
+### `mutual_tls_authentication`
+
+* `truststore_uri` - (Required) Amazon S3 URL that specifies the truststore for mutual TLS authentication, for example, `s3://bucket-name/key-name`. The truststore can contain certificates from public or private certificate authorities. To update the truststore, upload a new version to S3, and then update your custom domain name to use the new version.
+* `truststore_version` - (Optional) Version of the S3 object that contains the truststore. To specify a version, you must have versioning enabled for the S3 bucket.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `api_mapping_selection_expression` - [API mapping selection expression](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-websocket-api-selection-expressions.html#apigateway-websocket-api-mapping-selection-expressions) for the domain name.
+* `arn` - ARN of the domain name.
+* `id` - Domain name identifier.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `10m`)
+- `update` - (Default `60m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_apigatewayv2_domain_name` using the domain name. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_apigatewayv2_domain_name` using the domain name. For example:
+
+```console
+% terraform import aws_apigatewayv2_domain_name.example ws-api.example.com
+```
+
+<!-- cache-key: cdktf-0.18.0 input-590fddf6e18ec896623edea239e232e92d9d62cdcbd1d648d652e4699c95dd9a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/apigatewayv2_integration.html.markdown b/website/docs/cdktf/python/r/apigatewayv2_integration.html.markdown
new file mode 100644
index 00000000000..ecb1661dbf8
--- /dev/null
+++ b/website/docs/cdktf/python/r/apigatewayv2_integration.html.markdown
@@ -0,0 +1,215 @@
+---
+subcategory: "API Gateway V2"
+layout: "aws"
+page_title: "AWS: aws_apigatewayv2_integration"
+description: |-
+  Manages an Amazon API Gateway Version 2 integration.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_apigatewayv2_integration
+
+Manages an Amazon API Gateway Version 2 integration.
+More information can be found in the [Amazon API Gateway Developer Guide](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-websocket-api.html).
+
+## Example Usage
+
+### Basic
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.apigatewayv2_integration import Apigatewayv2Integration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Apigatewayv2Integration(self, "example",
+            api_id=Token.as_string(aws_apigatewayv2_api_example.id),
+            integration_type="MOCK"
+        )
+```
+
+### Lambda Integration
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.apigatewayv2_integration import Apigatewayv2Integration
+from imports.aws.lambda_function import LambdaFunction
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = LambdaFunction(self, "example",
+            filename="example.zip",
+            function_name="Example",
+            handler="index.handler",
+            role=Token.as_string(aws_iam_role_example.arn),
+            runtime="nodejs16.x"
+        )
+        aws_apigatewayv2_integration_example = Apigatewayv2Integration(self, "example_1",
+            api_id=Token.as_string(aws_apigatewayv2_api_example.id),
+            connection_type="INTERNET",
+            content_handling_strategy="CONVERT_TO_TEXT",
+            description="Lambda example",
+            integration_method="POST",
+            integration_type="AWS_PROXY",
+            integration_uri=example.invoke_arn,
+            passthrough_behavior="WHEN_NO_MATCH"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_apigatewayv2_integration_example.override_logical_id("example")
+```
+
+### AWS Service Integration
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.apigatewayv2_integration import Apigatewayv2Integration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Apigatewayv2Integration(self, "example",
+            api_id=Token.as_string(aws_apigatewayv2_api_example.id),
+            credentials_arn=Token.as_string(aws_iam_role_example.arn),
+            description="SQS example",
+            integration_subtype="SQS-SendMessage",
+            integration_type="AWS_PROXY",
+            request_parameters={
+                "MessageBody": "$request.body.message",
+                "QueueUrl": "$request.header.queueUrl"
+            }
+        )
+```
+
+### Private Integration
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.apigatewayv2_integration import Apigatewayv2Integration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Apigatewayv2Integration(self, "example",
+            api_id=Token.as_string(aws_apigatewayv2_api_example.id),
+            connection_id=Token.as_string(aws_apigatewayv2_vpc_link_example.id),
+            connection_type="VPC_LINK",
+            credentials_arn=Token.as_string(aws_iam_role_example.arn),
+            description="Example with a load balancer",
+            integration_method="ANY",
+            integration_type="HTTP_PROXY",
+            integration_uri=Token.as_string(aws_lb_listener_example.arn),
+            request_parameters={
+                "append:header.authforintegration": "$context.authorizer.authorizerResponse",
+                "overwrite:path": "staticValueForIntegration"
+            },
+            response_parameters=[Apigatewayv2IntegrationResponseParameters(
+                mappings={
+                    "append:header.auth": "$context.authorizer.authorizerResponse"
+                },
+                status_code=Token.as_string(403)
+            ), Apigatewayv2IntegrationResponseParameters(
+                mappings={
+                    "overwrite:statuscode": "204"
+                },
+                status_code=Token.as_string(200)
+            )
+            ],
+            tls_config=Apigatewayv2IntegrationTlsConfig(
+                server_name_to_verify="example.com"
+            )
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `api_id` - (Required) API identifier.
+* `integration_type` - (Required) Integration type of an integration.
+Valid values: `AWS` (supported only for WebSocket APIs), `AWS_PROXY`, `HTTP` (supported only for WebSocket APIs), `HTTP_PROXY`, `MOCK` (supported only for WebSocket APIs). For an HTTP API private integration, use `HTTP_PROXY`.
+* `connection_id` - (Optional) ID of the [VPC link](apigatewayv2_vpc_link.html) for a private integration. Supported only for HTTP APIs. Must be between 1 and 1024 characters in length.
+* `connection_type` - (Optional) Type of the network connection to the integration endpoint. Valid values: `INTERNET`, `VPC_LINK`. Default is `INTERNET`.
+* `content_handling_strategy` - (Optional) How to handle response payload content type conversions. Valid values: `CONVERT_TO_BINARY`, `CONVERT_TO_TEXT`. Supported only for WebSocket APIs.
+* `credentials_arn` - (Optional) Credentials required for the integration, if any.
+* `description` - (Optional) Description of the integration.
+* `integration_method` - (Optional) Integration's HTTP method. Must be specified if `integration_type` is not `MOCK`.
+* `integration_subtype` - (Optional) AWS service action to invoke. Supported only for HTTP APIs when `integration_type` is `AWS_PROXY`. See the [AWS service integration reference](https://docs.aws.amazon.com/apigateway/latest/developerguide/http-api-develop-integrations-aws-services-reference.html) documentation for supported values. Must be between 1 and 128 characters in length.
+* `integration_uri` - (Optional) URI of the Lambda function for a Lambda proxy integration, when `integration_type` is `AWS_PROXY`.
+For an `HTTP` integration, specify a fully-qualified URL. For an HTTP API private integration, specify the ARN of an Application Load Balancer listener, Network Load Balancer listener, or AWS Cloud Map service.
+* `passthrough_behavior` - (Optional) Pass-through behavior for incoming requests based on the Content-Type header in the request, and the available mapping templates specified as the `request_templates` attribute.
+Valid values: `WHEN_NO_MATCH`, `WHEN_NO_TEMPLATES`, `NEVER`. Default is `WHEN_NO_MATCH`. Supported only for WebSocket APIs.
+* `payload_format_version` - (Optional) The [format of the payload](https://docs.aws.amazon.com/apigateway/latest/developerguide/http-api-develop-integrations-lambda.html#http-api-develop-integrations-lambda.proxy-format) sent to an integration. Valid values: `1.0`, `2.0`. Default is `1.0`.
+* `request_parameters` - (Optional) For WebSocket APIs, a key-value map specifying request parameters that are passed from the method request to the backend.
+For HTTP APIs with a specified `integration_subtype`, a key-value map specifying parameters that are passed to `AWS_PROXY` integrations.
+For HTTP APIs without a specified `integration_subtype`, a key-value map specifying how to transform HTTP requests before sending them to the backend.
+See the [Amazon API Gateway Developer Guide](https://docs.aws.amazon.com/apigateway/latest/developerguide/http-api-parameter-mapping.html) for details.
+* `request_templates` - (Optional) Map of [Velocity](https://velocity.apache.org/) templates that are applied on the request payload based on the value of the Content-Type header sent by the client. Supported only for WebSocket APIs.
+* `response_parameters` - (Optional) Mappings to transform the HTTP response from a backend integration before returning the response to clients. Supported only for HTTP APIs.
+* `template_selection_expression` - (Optional) The [template selection expression](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-websocket-api-selection-expressions.html#apigateway-websocket-api-template-selection-expressions) for the integration.
+* `timeout_milliseconds` - (Optional) Custom timeout between 50 and 29,000 milliseconds for WebSocket APIs and between 50 and 30,000 milliseconds for HTTP APIs.
+The default timeout is 29 seconds for WebSocket APIs and 30 seconds for HTTP APIs.
+Terraform will only perform drift detection of its value when present in a configuration.
+* `tls_config` - (Optional) TLS configuration for a private integration. Supported only for HTTP APIs.
+
+The `response_parameters` object supports the following:
+
+* `status_code` - (Required) HTTP status code in the range 200-599.
+* `mappings` - (Required) Key-value map. The key of this map identifies the location of the request parameter to change, and how to change it. The corresponding value specifies the new data for the parameter.
+See the [Amazon API Gateway Developer Guide](https://docs.aws.amazon.com/apigateway/latest/developerguide/http-api-parameter-mapping.html) for details.
+
+The `tls_config` object supports the following:
+
+* `server_name_to_verify` - (Optional) If you specify a server name, API Gateway uses it to verify the hostname on the integration's certificate. The server name is also included in the TLS handshake to support Server Name Indication (SNI) or virtual hosting.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Integration identifier.
+* `integration_response_selection_expression` - The [integration response selection expression](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-websocket-api-selection-expressions.html#apigateway-websocket-api-integration-response-selection-expressions) for the integration.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_apigatewayv2_integration` using the API identifier and integration identifier. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_apigatewayv2_integration` using the API identifier and integration identifier. For example:
+
+```console
+% terraform import aws_apigatewayv2_integration.example aabbccddee/1122334
+```
+
+-> **Note:** The API Gateway managed integration created as part of [_quick_create_](https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-basic-concept.html#apigateway-definition-quick-create) cannot be imported.
+
+<!-- cache-key: cdktf-0.18.0 input-bd3868bb1d19101e5d7a5a40cefadf4031666c5772ea0394fa37f1396d869e4c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/apigatewayv2_integration_response.html.markdown b/website/docs/cdktf/python/r/apigatewayv2_integration_response.html.markdown
new file mode 100644
index 00000000000..3816eb9c5c5
--- /dev/null
+++ b/website/docs/cdktf/python/r/apigatewayv2_integration_response.html.markdown
@@ -0,0 +1,75 @@
+---
+subcategory: "API Gateway V2"
+layout: "aws"
+page_title: "AWS: aws_apigatewayv2_integration_response"
+description: |-
+  Manages an Amazon API Gateway Version 2 integration response.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_apigatewayv2_integration_response
+
+Manages an Amazon API Gateway Version 2 integration response.
+More information can be found in the [Amazon API Gateway Developer Guide](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-websocket-api.html).
+
+## Example Usage
+
+### Basic
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.apigatewayv2_integration_response import Apigatewayv2IntegrationResponse
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Apigatewayv2IntegrationResponse(self, "example",
+            api_id=Token.as_string(aws_apigatewayv2_api_example.id),
+            integration_id=Token.as_string(aws_apigatewayv2_integration_example.id),
+            integration_response_key="/200/"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `api_id` - (Required) API identifier.
+* `integration_id` - (Required) Identifier of the [`aws_apigatewayv2_integration`](/docs/providers/aws/r/apigatewayv2_integration.html).
+* `integration_response_key` - (Required) Integration response key.
+* `content_handling_strategy` - (Optional) How to handle response payload content type conversions. Valid values: `CONVERT_TO_BINARY`, `CONVERT_TO_TEXT`.
+* `response_templates` - (Optional) Map of Velocity templates that are applied on the request payload based on the value of the Content-Type header sent by the client.
+* `template_selection_expression` - (Optional) The [template selection expression](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-websocket-api-selection-expressions.html#apigateway-websocket-api-template-selection-expressions) for the integration response.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Integration response identifier.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_apigatewayv2_integration_response` using the API identifier, integration identifier and integration response identifier. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_apigatewayv2_integration_response` using the API identifier, integration identifier and integration response identifier. For example:
+
+```console
+% terraform import aws_apigatewayv2_integration_response.example aabbccddee/1122334/998877
+```
+
+<!-- cache-key: cdktf-0.18.0 input-c751414ee371648e7a14d8bdd24be3cec193584e33fff3962b58af0f01c841ec -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/apigatewayv2_model.html.markdown b/website/docs/cdktf/python/r/apigatewayv2_model.html.markdown
new file mode 100644
index 00000000000..b627ef984be
--- /dev/null
+++ b/website/docs/cdktf/python/r/apigatewayv2_model.html.markdown
@@ -0,0 +1,84 @@
+---
+subcategory: "API Gateway V2"
+layout: "aws"
+page_title: "AWS: aws_apigatewayv2_model"
+description: |-
+  Manages an Amazon API Gateway Version 2 model.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_apigatewayv2_model
+
+Manages an Amazon API Gateway Version 2 [model](https://docs.aws.amazon.com/apigateway/latest/developerguide/models-mappings.html#models-mappings-models).
+
+## Example Usage
+
+### Basic
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, Fn, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.apigatewayv2_model import Apigatewayv2Model
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Apigatewayv2Model(self, "example",
+            api_id=Token.as_string(aws_apigatewayv2_api_example.id),
+            content_type="application/json",
+            name="example",
+            schema=Token.as_string(
+                Fn.jsonencode({
+                    "$schema": "http://json-schema.org/draft-04/schema#",
+                    "properties": {
+                        "id": {
+                            "type": "string"
+                        }
+                    },
+                    "title": "ExampleModel",
+                    "type": "object"
+                }))
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `api_id` - (Required) API identifier.
+* `content_type` - (Required)  The content-type for the model, for example, `application/json`. Must be between 1 and 256 characters in length.
+* `name` - (Required) Name of the model. Must be alphanumeric. Must be between 1 and 128 characters in length.
+* `schema` - (Required) Schema for the model. This should be a [JSON schema draft 4](https://tools.ietf.org/html/draft-zyp-json-schema-04) model. Must be less than or equal to 32768 characters in length.
+* `description` - (Optional) Description of the model. Must be between 1 and 128 characters in length.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Model identifier.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_apigatewayv2_model` using the API identifier and model identifier. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_apigatewayv2_model` using the API identifier and model identifier. For example:
+
+```console
+% terraform import aws_apigatewayv2_model.example aabbccddee/1122334
+```
+
+<!-- cache-key: cdktf-0.18.0 input-063f47681aa238116147c2530543550c6286bab9afb427347d6c9ef713ac5596 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/apigatewayv2_route.html.markdown b/website/docs/cdktf/python/r/apigatewayv2_route.html.markdown
new file mode 100644
index 00000000000..94339383df0
--- /dev/null
+++ b/website/docs/cdktf/python/r/apigatewayv2_route.html.markdown
@@ -0,0 +1,135 @@
+---
+subcategory: "API Gateway V2"
+layout: "aws"
+page_title: "AWS: aws_apigatewayv2_route"
+description: |-
+  Manages an Amazon API Gateway Version 2 route.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_apigatewayv2_route
+
+Manages an Amazon API Gateway Version 2 route.
+More information can be found in the [Amazon API Gateway Developer Guide](https://docs.aws.amazon.com/apigateway/latest/developerguide/welcome.html) for [WebSocket](https://docs.aws.amazon.com/apigateway/latest/developerguide/websocket-api-develop-routes.html) and [HTTP](https://docs.aws.amazon.com/apigateway/latest/developerguide/http-api-develop-routes.html) APIs.
+
+## Example Usage
+
+### Basic
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.apigatewayv2_api import Apigatewayv2Api
+from imports.aws.apigatewayv2_route import Apigatewayv2Route
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = Apigatewayv2Api(self, "example",
+            name="example-websocket-api",
+            protocol_type="WEBSOCKET",
+            route_selection_expression="$request.body.action"
+        )
+        aws_apigatewayv2_route_example = Apigatewayv2Route(self, "example_1",
+            api_id=example.id,
+            route_key="$default"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_apigatewayv2_route_example.override_logical_id("example")
+```
+
+### HTTP Proxy Integration
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.apigatewayv2_api import Apigatewayv2Api
+from imports.aws.apigatewayv2_integration import Apigatewayv2Integration
+from imports.aws.apigatewayv2_route import Apigatewayv2Route
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = Apigatewayv2Api(self, "example",
+            name="example-http-api",
+            protocol_type="HTTP"
+        )
+        aws_apigatewayv2_integration_example = Apigatewayv2Integration(self, "example_1",
+            api_id=example.id,
+            integration_method="ANY",
+            integration_type="HTTP_PROXY",
+            integration_uri="https://example.com/{proxy}"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_apigatewayv2_integration_example.override_logical_id("example")
+        aws_apigatewayv2_route_example = Apigatewayv2Route(self, "example_2",
+            api_id=example.id,
+            route_key="ANY /example/{proxy+}",
+            target="integrations/${" + aws_apigatewayv2_integration_example.id + "}"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_apigatewayv2_route_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `api_id` - (Required) API identifier.
+* `route_key` - (Required) Route key for the route. For HTTP APIs, the route key can be either `$default`, or a combination of an HTTP method and resource path, for example, `GET /pets`.
+* `api_key_required` - (Optional) Boolean whether an API key is required for the route. Defaults to `false`. Supported only for WebSocket APIs.
+* `authorization_scopes` - (Optional) Authorization scopes supported by this route. The scopes are used with a JWT authorizer to authorize the method invocation.
+* `authorization_type` - (Optional) Authorization type for the route.
+For WebSocket APIs, valid values are `NONE` for open access, `AWS_IAM` for using AWS IAM permissions, and `CUSTOM` for using a Lambda authorizer.
+For HTTP APIs, valid values are `NONE` for open access, `JWT` for using JSON Web Tokens, `AWS_IAM` for using AWS IAM permissions, and `CUSTOM` for using a Lambda authorizer.
+Defaults to `NONE`.
+* `authorizer_id` - (Optional) Identifier of the [`aws_apigatewayv2_authorizer`](apigatewayv2_authorizer.html) resource to be associated with this route.
+* `model_selection_expression` - (Optional) The [model selection expression](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-websocket-api-selection-expressions.html#apigateway-websocket-api-model-selection-expressions) for the route. Supported only for WebSocket APIs.
+* `operation_name` - (Optional) Operation name for the route. Must be between 1 and 64 characters in length.
+* `request_models` - (Optional) Request models for the route. Supported only for WebSocket APIs.
+* `request_parameter` - (Optional) Request parameters for the route. Supported only for WebSocket APIs.
+* `route_response_selection_expression` - (Optional) The [route response selection expression](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-websocket-api-selection-expressions.html#apigateway-websocket-api-route-response-selection-expressions) for the route. Supported only for WebSocket APIs.
+* `target` - (Optional) Target for the route, of the form `integrations/`*`IntegrationID`*, where *`IntegrationID`* is the identifier of an [`aws_apigatewayv2_integration`](apigatewayv2_integration.html) resource.
+
+The `request_parameter` object supports the following:
+
+* `request_parameter_key` - (Required) Request parameter key. This is a [request data mapping parameter](https://docs.aws.amazon.com/apigateway/latest/developerguide/websocket-api-data-mapping.html#websocket-mapping-request-parameters).
+* `required` - (Required) Boolean whether or not the parameter is required.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Route identifier.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_apigatewayv2_route` using the API identifier and route identifier. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_apigatewayv2_route` using the API identifier and route identifier. For example:
+
+```console
+% terraform import aws_apigatewayv2_route.example aabbccddee/1122334
+```
+
+-> **Note:** The API Gateway managed route created as part of [_quick_create_](https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-basic-concept.html#apigateway-definition-quick-create) cannot be imported.
+
+<!-- cache-key: cdktf-0.18.0 input-b9d6c42d850f8d41e68e09883583bfd0059174ab6d5527af47ec51f177c33a41 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/apigatewayv2_route_response.html.markdown b/website/docs/cdktf/python/r/apigatewayv2_route_response.html.markdown
new file mode 100644
index 00000000000..c0a5f7fe81b
--- /dev/null
+++ b/website/docs/cdktf/python/r/apigatewayv2_route_response.html.markdown
@@ -0,0 +1,74 @@
+---
+subcategory: "API Gateway V2"
+layout: "aws"
+page_title: "AWS: aws_apigatewayv2_route_response"
+description: |-
+  Manages an Amazon API Gateway Version 2 route response.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_apigatewayv2_route_response
+
+Manages an Amazon API Gateway Version 2 route response.
+More information can be found in the [Amazon API Gateway Developer Guide](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-websocket-api.html).
+
+## Example Usage
+
+### Basic
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.apigatewayv2_route_response import Apigatewayv2RouteResponse
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Apigatewayv2RouteResponse(self, "example",
+            api_id=Token.as_string(aws_apigatewayv2_api_example.id),
+            route_id=Token.as_string(aws_apigatewayv2_route_example.id),
+            route_response_key="$default"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `api_id` - (Required) API identifier.
+* `route_id` - (Required) Identifier of the [`aws_apigatewayv2_route`](/docs/providers/aws/r/apigatewayv2_route.html).
+* `route_response_key` - (Required) Route response key.
+* `model_selection_expression` - (Optional) The [model selection expression](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-websocket-api-selection-expressions.html#apigateway-websocket-api-model-selection-expressions) for the route response.
+* `response_models` - (Optional) Response models for the route response.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Route response identifier.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_apigatewayv2_route_response` using the API identifier, route identifier and route response identifier. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_apigatewayv2_route_response` using the API identifier, route identifier and route response identifier. For example:
+
+```console
+% terraform import aws_apigatewayv2_route_response.example aabbccddee/1122334/998877
+```
+
+<!-- cache-key: cdktf-0.18.0 input-09d67e36afad395b0392b180f09d72c54381ca9fc1c80ad3269815c5d740e985 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/apigatewayv2_stage.html.markdown b/website/docs/cdktf/python/r/apigatewayv2_stage.html.markdown
new file mode 100644
index 00000000000..870da47b3b8
--- /dev/null
+++ b/website/docs/cdktf/python/r/apigatewayv2_stage.html.markdown
@@ -0,0 +1,119 @@
+---
+subcategory: "API Gateway V2"
+layout: "aws"
+page_title: "AWS: aws_apigatewayv2_stage"
+description: |-
+  Manages an Amazon API Gateway Version 2 stage.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_apigatewayv2_stage
+
+Manages an Amazon API Gateway Version 2 stage.
+More information can be found in the [Amazon API Gateway Developer Guide](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-websocket-api.html).
+
+## Example Usage
+
+### Basic
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.apigatewayv2_stage import Apigatewayv2Stage
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Apigatewayv2Stage(self, "example",
+            api_id=Token.as_string(aws_apigatewayv2_api_example.id),
+            name="example-stage"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `api_id` - (Required) API identifier.
+* `name` - (Required) Name of the stage. Must be between 1 and 128 characters in length.
+
+The following arguments are optional:
+
+* `access_log_settings` - (Optional) Settings for logging access in this stage.
+Use the [`aws_api_gateway_account`](/docs/providers/aws/r/api_gateway_account.html) resource to configure [permissions for CloudWatch Logging](https://docs.aws.amazon.com/apigateway/latest/developerguide/set-up-logging.html#set-up-access-logging-permissions).
+* `auto_deploy` - (Optional) Whether updates to an API automatically trigger a new deployment. Defaults to `false`. Applicable for HTTP APIs.
+* `client_certificate_id` - (Optional) Identifier of a client certificate for the stage. Use the [`aws_api_gateway_client_certificate`](/docs/providers/aws/r/api_gateway_client_certificate.html) resource to configure a client certificate.
+Supported only for WebSocket APIs.
+* `default_route_settings` - (Optional) Default route settings for the stage.
+* `deployment_id` - (Optional) Deployment identifier of the stage. Use the [`aws_apigatewayv2_deployment`](/docs/providers/aws/r/apigatewayv2_deployment.html) resource to configure a deployment.
+* `description` - (Optional) Description for the stage. Must be less than or equal to 1024 characters in length.
+* `route_settings` - (Optional) Route settings for the stage.
+* `stage_variables` - (Optional) Map that defines the stage variables for the stage.
+* `tags` - (Optional) Map of tags to assign to the stage. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### access_log_settings
+
+* `destination_arn` - (Required) ARN of the CloudWatch Logs log group to receive access logs. Any trailing `:*` is trimmed from the ARN.
+* `format` - (Required) Single line [format](https://docs.aws.amazon.com/apigateway/latest/developerguide/set-up-logging.html#apigateway-cloudwatch-log-formats) of the access logs of data. Refer to log settings for [HTTP](https://docs.aws.amazon.com/apigateway/latest/developerguide/http-api-logging-variables.html) or [Websocket](https://docs.aws.amazon.com/apigateway/latest/developerguide/websocket-api-logging.html).
+
+### default_route_settings
+
+* `data_trace_enabled` - (Optional) Whether data trace logging is enabled for the default route. Affects the log entries pushed to Amazon CloudWatch Logs.
+Defaults to `false`. Supported only for WebSocket APIs.
+* `detailed_metrics_enabled` - (Optional) Whether detailed metrics are enabled for the default route. Defaults to `false`.
+* `logging_level` - (Optional) Logging level for the default route. Affects the log entries pushed to Amazon CloudWatch Logs.
+Valid values: `ERROR`, `INFO`, `OFF`. Defaults to `OFF`. Supported only for WebSocket APIs. Terraform will only perform drift detection of its value when present in a configuration.
+* `throttling_burst_limit` - (Optional) Throttling burst limit for the default route.
+* `throttling_rate_limit` - (Optional) Throttling rate limit for the default route.
+
+### route_settings
+
+* `route_key` - (Required) Route key.
+* `data_trace_enabled` - (Optional) Whether data trace logging is enabled for the route. Affects the log entries pushed to Amazon CloudWatch Logs.
+Defaults to `false`. Supported only for WebSocket APIs.
+* `detailed_metrics_enabled` - (Optional) Whether detailed metrics are enabled for the route. Defaults to `false`.
+* `logging_level` - (Optional) Logging level for the route. Affects the log entries pushed to Amazon CloudWatch Logs.
+Valid values: `ERROR`, `INFO`, `OFF`. Defaults to `OFF`. Supported only for WebSocket APIs. Terraform will only perform drift detection of its value when present in a configuration.
+* `throttling_burst_limit` - (Optional) Throttling burst limit for the route.
+* `throttling_rate_limit` - (Optional) Throttling rate limit for the route.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Stage identifier.
+* `arn` - ARN of the stage.
+* `execution_arn` - ARN prefix to be used in an [`aws_lambda_permission`](/docs/providers/aws/r/lambda_permission.html)'s `source_arn` attribute.
+For WebSocket APIs this attribute can additionally be used in an [`aws_iam_policy`](/docs/providers/aws/r/iam_policy.html) to authorize access to the [`@connections` API](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-how-to-call-websocket-api-connections.html).
+See the [Amazon API Gateway Developer Guide](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-websocket-control-access-iam.html) for details.
+* `invoke_url` - URL to invoke the API pointing to the stage,
+  e.g., `wss://z4675bid1j.execute-api.eu-west-2.amazonaws.com/example-stage`, or `https://z4675bid1j.execute-api.eu-west-2.amazonaws.com/`
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_apigatewayv2_stage` using the API identifier and stage name. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_apigatewayv2_stage` using the API identifier and stage name. For example:
+
+```console
+% terraform import aws_apigatewayv2_stage.example aabbccddee/example-stage
+```
+
+-> **Note:** The API Gateway managed stage created as part of [_quick_create_](https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-basic-concept.html#apigateway-definition-quick-create) cannot be imported.
+
+<!-- cache-key: cdktf-0.18.0 input-c7cc2d4235ed06a055a36c6327f99044a8a10f0f104b25ba18451743f15b5497 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/apigatewayv2_vpc_link.html.markdown b/website/docs/cdktf/python/r/apigatewayv2_vpc_link.html.markdown
new file mode 100644
index 00000000000..6667078b2bd
--- /dev/null
+++ b/website/docs/cdktf/python/r/apigatewayv2_vpc_link.html.markdown
@@ -0,0 +1,78 @@
+---
+subcategory: "API Gateway V2"
+layout: "aws"
+page_title: "AWS: aws_apigatewayv2_vpc_link"
+description: |-
+  Manages an Amazon API Gateway Version 2 VPC Link.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_apigatewayv2_vpc_link
+
+Manages an Amazon API Gateway Version 2 VPC Link.
+
+-> **Note:** Amazon API Gateway Version 2 VPC Links enable private integrations that connect HTTP APIs to private resources in a VPC.
+To enable private integration for REST APIs, use the Amazon API Gateway Version 1 VPC Link [resource](/docs/providers/aws/r/api_gateway_vpc_link.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.apigatewayv2_vpc_link import Apigatewayv2VpcLink
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Apigatewayv2VpcLink(self, "example",
+            name="example",
+            security_group_ids=[Token.as_string(data_aws_security_group_example.id)],
+            subnet_ids=Token.as_list(data_aws_subnets_example.ids),
+            tags={
+                "Usage": "example"
+            }
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) Name of the VPC Link. Must be between 1 and 128 characters in length.
+* `security_group_ids` - (Required) Security group IDs for the VPC Link.
+* `subnet_ids` - (Required) Subnet IDs for the VPC Link.
+* `tags` - (Optional) Map of tags to assign to the VPC Link. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - VPC Link identifier.
+* `arn` - VPC Link ARN.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_apigatewayv2_vpc_link` using the VPC Link identifier. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_apigatewayv2_vpc_link` using the VPC Link identifier. For example:
+
+```console
+% terraform import aws_apigatewayv2_vpc_link.example aabbccddee
+```
+
+<!-- cache-key: cdktf-0.18.0 input-7f7266061a30dbdd15dacececebef105a6b52be6446a7f4871237c0ef1b7c4b6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/app_cookie_stickiness_policy.html.markdown b/website/docs/cdktf/python/r/app_cookie_stickiness_policy.html.markdown
new file mode 100644
index 00000000000..45eceb1e59f
--- /dev/null
+++ b/website/docs/cdktf/python/r/app_cookie_stickiness_policy.html.markdown
@@ -0,0 +1,90 @@
+---
+subcategory: "ELB Classic"
+layout: "aws"
+page_title: "AWS: aws_app_cookie_stickiness_policy"
+description: |-
+  Provides an application cookie stickiness policy, which allows an ELB to wed its stickiness cookie to a cookie generated by your application.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_app_cookie_stickiness_policy
+
+Provides an application cookie stickiness policy, which allows an ELB to wed its sticky cookie's expiration to a cookie generated by your application.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.app_cookie_stickiness_policy import AppCookieStickinessPolicy
+from imports.aws.elb import Elb
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        lb = Elb(self, "lb",
+            availability_zones=["us-east-1a"],
+            listener=[ElbListener(
+                instance_port=8000,
+                instance_protocol="http",
+                lb_port=80,
+                lb_protocol="http"
+            )
+            ],
+            name="test-lb"
+        )
+        AppCookieStickinessPolicy(self, "foo",
+            cookie_name="MyAppCookie",
+            lb_port=80,
+            load_balancer=lb.name,
+            name="foo_policy"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) Name of the stickiness policy.
+* `load_balancer` - (Required) Name of load balancer to which the policy
+  should be attached.
+* `lb_port` - (Required) Load balancer port to which the policy
+  should be applied. This must be an active listener on the load
+balancer.
+* `cookie_name` - (Required) Application cookie whose lifetime the ELB's cookie should follow.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the policy.
+* `name` - Name of the stickiness policy.
+* `load_balancer` - Name of load balancer to which the policy is attached.
+* `lb_port` - Load balancer port to which the policy is applied.
+* `cookie_name` - Application cookie whose lifetime the ELB's cookie should follow.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import application cookie stickiness policies using the ELB name, port, and policy name separated by colons (`:`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import application cookie stickiness policies using the ELB name, port, and policy name separated by colons (`:`). For example:
+
+```console
+% terraform import aws_app_cookie_stickiness_policy.example my-elb:80:my-policy
+```
+
+<!-- cache-key: cdktf-0.18.0 input-88293d9f7b9b0c56a30ec158ef04e7ebaf1d4abe22c80ea32220c4d2176785a6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/appautoscaling_policy.html.markdown b/website/docs/cdktf/python/r/appautoscaling_policy.html.markdown
new file mode 100644
index 00000000000..ac37ada560d
--- /dev/null
+++ b/website/docs/cdktf/python/r/appautoscaling_policy.html.markdown
@@ -0,0 +1,432 @@
+---
+subcategory: "Application Auto Scaling"
+layout: "aws"
+page_title: "AWS: aws_appautoscaling_policy"
+description: |-
+  Provides an Application AutoScaling Policy resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_appautoscaling_policy
+
+Provides an Application AutoScaling Policy resource.
+
+## Example Usage
+
+### DynamoDB Table Autoscaling
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.appautoscaling_policy import AppautoscalingPolicy
+from imports.aws.appautoscaling_target import AppautoscalingTarget
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        dynamodb_table_read_target = AppautoscalingTarget(self, "dynamodb_table_read_target",
+            max_capacity=100,
+            min_capacity=5,
+            resource_id="table/tableName",
+            scalable_dimension="dynamodb:table:ReadCapacityUnits",
+            service_namespace="dynamodb"
+        )
+        AppautoscalingPolicy(self, "dynamodb_table_read_policy",
+            name="DynamoDBReadCapacityUtilization:${" + dynamodb_table_read_target.resource_id + "}",
+            policy_type="TargetTrackingScaling",
+            resource_id=dynamodb_table_read_target.resource_id,
+            scalable_dimension=dynamodb_table_read_target.scalable_dimension,
+            service_namespace=dynamodb_table_read_target.service_namespace,
+            target_tracking_scaling_policy_configuration=AppautoscalingPolicyTargetTrackingScalingPolicyConfiguration(
+                predefined_metric_specification=AppautoscalingPolicyTargetTrackingScalingPolicyConfigurationPredefinedMetricSpecification(
+                    predefined_metric_type="DynamoDBReadCapacityUtilization"
+                ),
+                target_value=70
+            )
+        )
+```
+
+### ECS Service Autoscaling
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, Op, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.appautoscaling_policy import AppautoscalingPolicy
+from imports.aws.appautoscaling_target import AppautoscalingTarget
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ecs_target = AppautoscalingTarget(self, "ecs_target",
+            max_capacity=4,
+            min_capacity=1,
+            resource_id="service/clusterName/serviceName",
+            scalable_dimension="ecs:service:DesiredCount",
+            service_namespace="ecs"
+        )
+        AppautoscalingPolicy(self, "ecs_policy",
+            name="scale-down",
+            policy_type="StepScaling",
+            resource_id=ecs_target.resource_id,
+            scalable_dimension=ecs_target.scalable_dimension,
+            service_namespace=ecs_target.service_namespace,
+            step_scaling_policy_configuration=AppautoscalingPolicyStepScalingPolicyConfiguration(
+                adjustment_type="ChangeInCapacity",
+                cooldown=60,
+                metric_aggregation_type="Maximum",
+                step_adjustment=[AppautoscalingPolicyStepScalingPolicyConfigurationStepAdjustment(
+                    metric_interval_upper_bound=Token.as_string(0),
+                    scaling_adjustment=Token.as_number(Op.negate(1))
+                )
+                ]
+            )
+        )
+```
+
+### Preserve desired count when updating an autoscaled ECS Service
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from cdktf import TerraformResourceLifecycle
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ecs_service import EcsService
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        EcsService(self, "ecs_service",
+            cluster="clusterName",
+            desired_count=2,
+            lifecycle=TerraformResourceLifecycle(
+                ignore_changes=[desired_count]
+            ),
+            name="serviceName",
+            task_definition="taskDefinitionFamily:1"
+        )
+```
+
+### Aurora Read Replica Autoscaling
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.appautoscaling_policy import AppautoscalingPolicy
+from imports.aws.appautoscaling_target import AppautoscalingTarget
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        replicas = AppautoscalingTarget(self, "replicas",
+            max_capacity=15,
+            min_capacity=1,
+            resource_id="cluster:${" + example.id + "}",
+            scalable_dimension="rds:cluster:ReadReplicaCount",
+            service_namespace="rds"
+        )
+        aws_appautoscaling_policy_replicas = AppautoscalingPolicy(self, "replicas_1",
+            name="cpu-auto-scaling",
+            policy_type="TargetTrackingScaling",
+            resource_id=replicas.resource_id,
+            scalable_dimension=replicas.scalable_dimension,
+            service_namespace=replicas.service_namespace,
+            target_tracking_scaling_policy_configuration=AppautoscalingPolicyTargetTrackingScalingPolicyConfiguration(
+                predefined_metric_specification=AppautoscalingPolicyTargetTrackingScalingPolicyConfigurationPredefinedMetricSpecification(
+                    predefined_metric_type="RDSReaderAverageCPUUtilization"
+                ),
+                scale_in_cooldown=300,
+                scale_out_cooldown=300,
+                target_value=75
+            )
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_appautoscaling_policy_replicas.override_logical_id("replicas")
+```
+
+### Create target tracking scaling policy using metric math
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.appautoscaling_policy import AppautoscalingPolicy
+from imports.aws.appautoscaling_target import AppautoscalingTarget
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ecs_target = AppautoscalingTarget(self, "ecs_target",
+            max_capacity=4,
+            min_capacity=1,
+            resource_id="service/clusterName/serviceName",
+            scalable_dimension="ecs:service:DesiredCount",
+            service_namespace="ecs"
+        )
+        AppautoscalingPolicy(self, "example",
+            name="foo",
+            policy_type="TargetTrackingScaling",
+            resource_id=ecs_target.resource_id,
+            scalable_dimension=ecs_target.scalable_dimension,
+            service_namespace=ecs_target.service_namespace,
+            target_tracking_scaling_policy_configuration=AppautoscalingPolicyTargetTrackingScalingPolicyConfiguration(
+                customized_metric_specification=AppautoscalingPolicyTargetTrackingScalingPolicyConfigurationCustomizedMetricSpecification(
+                    metrics=[AppautoscalingPolicyTargetTrackingScalingPolicyConfigurationCustomizedMetricSpecificationMetrics(
+                        id="m1",
+                        label="Get the queue size (the number of messages waiting to be processed)",
+                        metric_stat=AppautoscalingPolicyTargetTrackingScalingPolicyConfigurationCustomizedMetricSpecificationMetricsMetricStat(
+                            metric=AppautoscalingPolicyTargetTrackingScalingPolicyConfigurationCustomizedMetricSpecificationMetricsMetricStatMetric(
+                                dimensions=[AppautoscalingPolicyTargetTrackingScalingPolicyConfigurationCustomizedMetricSpecificationMetricsMetricStatMetricDimensions(
+                                    name="QueueName",
+                                    value="my-queue"
+                                )
+                                ],
+                                metric_name="ApproximateNumberOfMessagesVisible",
+                                namespace="AWS/SQS"
+                            ),
+                            stat="Sum"
+                        ),
+                        return_data=False
+                    ), AppautoscalingPolicyTargetTrackingScalingPolicyConfigurationCustomizedMetricSpecificationMetrics(
+                        id="m2",
+                        label="Get the ECS running task count (the number of currently running tasks)",
+                        metric_stat=AppautoscalingPolicyTargetTrackingScalingPolicyConfigurationCustomizedMetricSpecificationMetricsMetricStat(
+                            metric=AppautoscalingPolicyTargetTrackingScalingPolicyConfigurationCustomizedMetricSpecificationMetricsMetricStatMetric(
+                                dimensions=[AppautoscalingPolicyTargetTrackingScalingPolicyConfigurationCustomizedMetricSpecificationMetricsMetricStatMetricDimensions(
+                                    name="ClusterName",
+                                    value="default"
+                                ), AppautoscalingPolicyTargetTrackingScalingPolicyConfigurationCustomizedMetricSpecificationMetricsMetricStatMetricDimensions(
+                                    name="ServiceName",
+                                    value="web-app"
+                                )
+                                ],
+                                metric_name="RunningTaskCount",
+                                namespace="ECS/ContainerInsights"
+                            ),
+                            stat="Average"
+                        ),
+                        return_data=False
+                    ), AppautoscalingPolicyTargetTrackingScalingPolicyConfigurationCustomizedMetricSpecificationMetrics(
+                        expression="m1 / m2",
+                        id="e1",
+                        label="Calculate the backlog per instance",
+                        return_data=True
+                    )
+                    ]
+                ),
+                target_value=100
+            )
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) Name of the policy. Must be between 1 and 255 characters in length.
+* `policy_type` - (Optional) Policy type. Valid values are `StepScaling` and `TargetTrackingScaling`. Defaults to `StepScaling`. Certain services only support only one policy type. For more information see the [Target Tracking Scaling Policies](https://docs.aws.amazon.com/autoscaling/application/userguide/application-auto-scaling-target-tracking.html) and [Step Scaling Policies](https://docs.aws.amazon.com/autoscaling/application/userguide/application-auto-scaling-step-scaling-policies.html) documentation.
+* `resource_id` - (Required) Resource type and unique identifier string for the resource associated with the scaling policy. Documentation can be found in the `ResourceId` parameter at: [AWS Application Auto Scaling API Reference](https://docs.aws.amazon.com/autoscaling/application/APIReference/API_RegisterScalableTarget.html)
+* `scalable_dimension` - (Required) Scalable dimension of the scalable target. Documentation can be found in the `ScalableDimension` parameter at: [AWS Application Auto Scaling API Reference](https://docs.aws.amazon.com/autoscaling/application/APIReference/API_RegisterScalableTarget.html)
+* `service_namespace` - (Required) AWS service namespace of the scalable target. Documentation can be found in the `ServiceNamespace` parameter at: [AWS Application Auto Scaling API Reference](https://docs.aws.amazon.com/autoscaling/application/APIReference/API_RegisterScalableTarget.html)
+* `step_scaling_policy_configuration` - (Optional) Step scaling policy configuration, requires `policy_type = "StepScaling"` (default). See supported fields below.
+* `target_tracking_scaling_policy_configuration` - (Optional) Target tracking policy, requires `policy_type = "TargetTrackingScaling"`. See supported fields below.
+
+### step_scaling_policy_configuration
+
+The `step_scaling_policy_configuration` configuration block supports the following arguments:
+
+* `adjustment_type` - (Required) Whether the adjustment is an absolute number or a percentage of the current capacity. Valid values are `ChangeInCapacity`, `ExactCapacity`, and `PercentChangeInCapacity`.
+* `cooldown` - (Required) Amount of time, in seconds, after a scaling activity completes and before the next scaling activity can start.
+* `metric_aggregation_type` - (Optional) Aggregation type for the policy's metrics. Valid values are "Minimum", "Maximum", and "Average". Without a value, AWS will treat the aggregation type as "Average".
+* `min_adjustment_magnitude` - (Optional) Minimum number to adjust your scalable dimension as a result of a scaling activity. If the adjustment type is PercentChangeInCapacity, the scaling policy changes the scalable dimension of the scalable target by this amount.
+* `step_adjustment` - (Optional) Set of adjustments that manage scaling. These have the following structure:
+
+ ```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, Op, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.appautoscaling_policy import AppautoscalingPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, name, resourceId, scalableDimension, serviceNamespace):
+        super().__init__(scope, name)
+        AppautoscalingPolicy(self, "ecs_policy",
+            step_scaling_policy_configuration=AppautoscalingPolicyStepScalingPolicyConfiguration(
+                step_adjustment=[AppautoscalingPolicyStepScalingPolicyConfigurationStepAdjustment(
+                    metric_interval_lower_bound=Token.as_string(1),
+                    metric_interval_upper_bound=Token.as_string(2),
+                    scaling_adjustment=Token.as_number(Op.negate(1))
+                ), AppautoscalingPolicyStepScalingPolicyConfigurationStepAdjustment(
+                    metric_interval_lower_bound=Token.as_string(2),
+                    metric_interval_upper_bound=Token.as_string(3),
+                    scaling_adjustment=1
+                )
+                ]
+            ),
+            name=name,
+            resource_id=resource_id,
+            scalable_dimension=scalable_dimension,
+            service_namespace=service_namespace
+        )
+```
+
+* `metric_interval_lower_bound` - (Optional) Lower bound for the difference between the alarm threshold and the CloudWatch metric. Without a value, AWS will treat this bound as negative infinity.
+* `metric_interval_upper_bound` - (Optional) Upper bound for the difference between the alarm threshold and the CloudWatch metric. Without a value, AWS will treat this bound as infinity. The upper bound must be greater than the lower bound.
+* `scaling_adjustment` - (Required) Number of members by which to scale, when the adjustment bounds are breached. A positive value scales up. A negative value scales down.
+
+### target_tracking_scaling_policy_configuration
+
+The `target_tracking_scaling_policy_configuration` configuration block supports the following arguments:
+
+* `target_value` - (Required) Target value for the metric.
+* `disable_scale_in` - (Optional) Whether scale in by the target tracking policy is disabled. If the value is true, scale in is disabled and the target tracking policy won't remove capacity from the scalable resource. Otherwise, scale in is enabled and the target tracking policy can remove capacity from the scalable resource. The default value is `false`.
+* `scale_in_cooldown` - (Optional) Amount of time, in seconds, after a scale in activity completes before another scale in activity can start.
+* `scale_out_cooldown` - (Optional) Amount of time, in seconds, after a scale out activity completes before another scale out activity can start.
+* `customized_metric_specification` - (Optional) Custom CloudWatch metric. Documentation can be found  at: [AWS Customized Metric Specification](https://docs.aws.amazon.com/autoscaling/ec2/APIReference/API_CustomizedMetricSpecification.html). See supported fields below.
+* `predefined_metric_specification` - (Optional) Predefined metric. See supported fields below.
+
+### target_tracking_scaling_policy_configuration customized_metric_specification
+
+Example usage:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.appautoscaling_policy import AppautoscalingPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, name, resourceId, scalableDimension, serviceNamespace):
+        super().__init__(scope, name)
+        AppautoscalingPolicy(self, "example",
+            policy_type="TargetTrackingScaling",
+            target_tracking_scaling_policy_configuration=AppautoscalingPolicyTargetTrackingScalingPolicyConfiguration(
+                customized_metric_specification=AppautoscalingPolicyTargetTrackingScalingPolicyConfigurationCustomizedMetricSpecification(
+                    dimensions=[AppautoscalingPolicyTargetTrackingScalingPolicyConfigurationCustomizedMetricSpecificationDimensions(
+                        name="MyOptionalMetricDimensionName",
+                        value="MyOptionalMetricDimensionValue"
+                    )
+                    ],
+                    metric_name="MyUtilizationMetric",
+                    namespace="MyNamespace",
+                    statistic="Average",
+                    unit="Percent"
+                ),
+                target_value=40
+            ),
+            name=name,
+            resource_id=resource_id,
+            scalable_dimension=scalable_dimension,
+            service_namespace=service_namespace
+        )
+```
+
+The `target_tracking_scaling_policy_configuration` `customized_metric_specification` configuration block supports the following arguments:
+
+* `dimensions` - (Optional) Configuration block(s) with the dimensions of the metric if the metric was published with dimensions. Detailed below.
+* `metric_name` - (Optional) Name of the metric.
+* `namespace` - (Optional) Namespace of the metric.
+* `statistic` - (Optional) Statistic of the metric. Valid values: `Average`, `Minimum`, `Maximum`, `SampleCount`, and `Sum`.
+* `unit` - (Optional) Unit of the metric.
+* `metrics` - (Optional) Metrics to include, as a metric data query.
+
+### target_tracking_scaling_policy_configuration customized_metric_specification dimensions
+
+The `target_tracking_scaling_policy_configuration` `customized_metric_specification` `dimensions` configuration block supports the following arguments:
+
+* `name` - (Required) Name of the dimension.
+* `value` - (Required) Value of the dimension.
+
+### target_tracking_scaling_policy_configuration customized_metric_specification metrics
+
+The `target_tracking_scaling_policy_configuration` `customized_metric_specification` `metrics` configuration block supports the following arguments:
+
+* `expression` - (Optional) Math expression used on the returned metric. You must specify either `expression` or `metric_stat`, but not both.
+* `id` - (Required) Short name for the metric used in target tracking scaling policy.
+* `label` - (Optional) Human-readable label for this metric or expression.
+* `metric_stat` - (Optional) Structure that defines CloudWatch metric to be used in target tracking scaling policy. You must specify either `expression` or `metric_stat`, but not both.
+* `return_data` - (Optional) Boolean that indicates whether to return the timestamps and raw data values of this metric, the default is true
+
+### target_tracking_scaling_policy_configuration customized_metric_specification metrics metric_stat
+
+The `target_tracking_scaling_policy_configuration` `customized_metric_specification` `metrics` `metric_stat` configuration block supports the following arguments:
+
+* `metric` - (Required) Structure that defines the CloudWatch metric to return, including the metric name, namespace, and dimensions.
+* `stat` - (Required) Statistic of the metrics to return.
+* `unit` - (Optional) Unit of the metrics to return.
+
+### target_tracking_scaling_policy_configuration customized_metric_specification metrics metric
+
+The `target_tracking_scaling_policy_configuration` `customized_metric_specification` `metrics` `metric` configuration block supports the following arguments:
+
+* `dimensions` - (Optional) Dimensions of the metric.
+* `metric_name` - (Required) Name of the metric.
+* `namespace` - (Required) Namespace of the metric.
+
+### target_tracking_scaling_policy_configuration customized_metric_specification metrics dimensions
+
+The `target_tracking_scaling_policy_configuration` `customized_metric_specification` `metrics` `dimensions` configuration block supports the following arguments:
+
+* `name` - (Required) Name of the dimension.
+* `value` - (Required) Value of the dimension.
+
+### target_tracking_scaling_policy_configuration predefined_metric_specification
+
+The `target_tracking_scaling_policy_configuration` `predefined_metric_specification` configuration block supports the following arguments:
+
+* `predefined_metric_type` - (Required) Metric type.
+* `resource_label` - (Optional) Reserved for future use if the `predefined_metric_type` is not `ALBRequestCountPerTarget`. If the `predefined_metric_type` is `ALBRequestCountPerTarget`, you must specify this argument. Documentation can be found at: [AWS Predefined Scaling Metric Specification](https://docs.aws.amazon.com/autoscaling/plans/APIReference/API_PredefinedScalingMetricSpecification.html). Must be less than or equal to 1023 characters in length.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `alarm_arns` - List of CloudWatch alarm ARNs associated with the scaling policy.
+* `arn` - ARN assigned by AWS to the scaling policy.
+* `name` - Scaling policy's name.
+* `policy_type` - Scaling policy's type.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Application AutoScaling Policy using the `service-namespace` , `resource-id`, `scalable-dimension` and `policy-name` separated by `/`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Application AutoScaling Policy using the `service-namespace` , `resource-id`, `scalable-dimension` and `policy-name` separated by `/`. For example:
+
+```console
+% terraform import aws_appautoscaling_policy.test-policy service-namespace/resource-id/scalable-dimension/policy-name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-fbf0b558db12d5a4ee505edd94d9a657fd67e6fe4b86ba032dbf944c9b850975 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/appautoscaling_scheduled_action.html.markdown b/website/docs/cdktf/python/r/appautoscaling_scheduled_action.html.markdown
new file mode 100644
index 00000000000..49ef2f4efe9
--- /dev/null
+++ b/website/docs/cdktf/python/r/appautoscaling_scheduled_action.html.markdown
@@ -0,0 +1,118 @@
+---
+subcategory: "Application Auto Scaling"
+layout: "aws"
+page_title: "AWS: aws_appautoscaling_scheduled_action"
+description: |-
+  Provides an Application AutoScaling ScheduledAction resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_appautoscaling_scheduled_action
+
+Provides an Application AutoScaling ScheduledAction resource.
+
+## Example Usage
+
+### DynamoDB Table Autoscaling
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.appautoscaling_scheduled_action import AppautoscalingScheduledAction
+from imports.aws.appautoscaling_target import AppautoscalingTarget
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        dynamodb = AppautoscalingTarget(self, "dynamodb",
+            max_capacity=100,
+            min_capacity=5,
+            resource_id="table/tableName",
+            scalable_dimension="dynamodb:table:ReadCapacityUnits",
+            service_namespace="dynamodb"
+        )
+        aws_appautoscaling_scheduled_action_dynamodb =
+        AppautoscalingScheduledAction(self, "dynamodb_1",
+            name="dynamodb",
+            resource_id=dynamodb.resource_id,
+            scalable_dimension=dynamodb.scalable_dimension,
+            scalable_target_action=AppautoscalingScheduledActionScalableTargetAction(
+                max_capacity=Token.as_string(200),
+                min_capacity=Token.as_string(1)
+            ),
+            schedule="at(2006-01-02T15:04:05)",
+            service_namespace=dynamodb.service_namespace
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_appautoscaling_scheduled_action_dynamodb.override_logical_id("dynamodb")
+```
+
+### ECS Service Autoscaling
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.appautoscaling_scheduled_action import AppautoscalingScheduledAction
+from imports.aws.appautoscaling_target import AppautoscalingTarget
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ecs = AppautoscalingTarget(self, "ecs",
+            max_capacity=4,
+            min_capacity=1,
+            resource_id="service/clusterName/serviceName",
+            scalable_dimension="ecs:service:DesiredCount",
+            service_namespace="ecs"
+        )
+        aws_appautoscaling_scheduled_action_ecs =
+        AppautoscalingScheduledAction(self, "ecs_1",
+            name="ecs",
+            resource_id=ecs.resource_id,
+            scalable_dimension=ecs.scalable_dimension,
+            scalable_target_action=AppautoscalingScheduledActionScalableTargetAction(
+                max_capacity=Token.as_string(10),
+                min_capacity=Token.as_string(1)
+            ),
+            schedule="at(2006-01-02T15:04:05)",
+            service_namespace=ecs.service_namespace
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_appautoscaling_scheduled_action_ecs.override_logical_id("ecs")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) Name of the scheduled action.
+* `service_namespace` - (Required) Namespace of the AWS service. Documentation can be found in the `ServiceNamespace` parameter at: [AWS Application Auto Scaling API Reference](https://docs.aws.amazon.com/autoscaling/application/APIReference/API_PutScheduledAction.html) Example: ecs
+* `resource_id` - (Required) Identifier of the resource associated with the scheduled action. Documentation can be found in the `ResourceId` parameter at: [AWS Application Auto Scaling API Reference](https://docs.aws.amazon.com/autoscaling/application/APIReference/API_PutScheduledAction.html)
+* `scalable_dimension` - (Required) Scalable dimension. Documentation can be found in the `ScalableDimension` parameter at: [AWS Application Auto Scaling API Reference](https://docs.aws.amazon.com/autoscaling/application/APIReference/API_PutScheduledAction.html) Example: ecs:service:DesiredCount
+* `scalable_target_action` - (Required) New minimum and maximum capacity. You can set both values or just one. See [below](#scalable-target-action-arguments)
+* `schedule` - (Required) Schedule for this action. The following formats are supported: At expressions - at(yyyy-mm-ddThh:mm:ss), Rate expressions - rate(valueunit), Cron expressions - cron(fields). Times for at expressions and cron expressions are evaluated using the time zone configured in `timezone`. Documentation can be found in the `Timezone` parameter at: [AWS Application Auto Scaling API Reference](https://docs.aws.amazon.com/autoscaling/application/APIReference/API_PutScheduledAction.html)
+* `start_time` - (Optional) Date and time for the scheduled action to start in RFC 3339 format. The timezone is not affected by the setting of `timezone`.
+* `end_time` - (Optional) Date and time for the scheduled action to end in RFC 3339 format. The timezone is not affected by the setting of `timezone`.
+* `timezone` - (Optional) Time zone used when setting a scheduled action by using an at or cron expression. Does not affect timezone for `start_time` and `end_time`. Valid values are the [canonical names of the IANA time zones supported by Joda-Time](https://www.joda.org/joda-time/timezones.html), such as `Etc/GMT+9` or `Pacific/Tahiti`. Default is `UTC`.
+
+### Scalable Target Action Arguments
+
+* `max_capacity` - (Optional) Maximum capacity. At least one of `max_capacity` or `min_capacity` must be set.
+* `min_capacity` - (Optional) Minimum capacity. At least one of `min_capacity` or `max_capacity` must be set.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the scheduled action.
+
+<!-- cache-key: cdktf-0.18.0 input-2340bae330ec995b135b58fdb2388300b4f924ab8525d2c122eed0efb9dccbdd -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/appautoscaling_target.html.markdown b/website/docs/cdktf/python/r/appautoscaling_target.html.markdown
new file mode 100644
index 00000000000..9288f6cf300
--- /dev/null
+++ b/website/docs/cdktf/python/r/appautoscaling_target.html.markdown
@@ -0,0 +1,178 @@
+---
+subcategory: "Application Auto Scaling"
+layout: "aws"
+page_title: "AWS: aws_appautoscaling_target"
+description: |-
+  Provides an Application AutoScaling ScalableTarget resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_appautoscaling_target
+
+Provides an Application AutoScaling ScalableTarget resource. To manage policies which get attached to the target, see the [`aws_appautoscaling_policy` resource](/docs/providers/aws/r/appautoscaling_policy.html).
+
+~> **NOTE:** Scalable targets created before 2023-03-20 may not have an assigned `arn`. These resource cannot use `tags` or participate in `default_tags`. To prevent `terraform plan` showing differences that can never be reconciled, use the [`lifecycle.ignore_changes`](https://developer.hashicorp.com/terraform/language/meta-arguments/lifecycle#ignore_changes) meta-argument. See the example below.
+
+~> **NOTE:** The [Application Auto Scaling service automatically attempts to manage IAM Service-Linked Roles](https://docs.aws.amazon.com/autoscaling/application/userguide/security_iam_service-with-iam.html#security_iam_service-with-iam-roles) when registering certain service namespaces for the first time. To manually manage this role, see the [`aws_iam_service_linked_role` resource](/docs/providers/aws/r/iam_service_linked_role.html).
+
+## Example Usage
+
+### DynamoDB Table Autoscaling
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.appautoscaling_target import AppautoscalingTarget
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AppautoscalingTarget(self, "dynamodb_table_read_target",
+            max_capacity=100,
+            min_capacity=5,
+            resource_id="table/${" + example.name + "}",
+            scalable_dimension="dynamodb:table:ReadCapacityUnits",
+            service_namespace="dynamodb"
+        )
+```
+
+### DynamoDB Index Autoscaling
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.appautoscaling_target import AppautoscalingTarget
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AppautoscalingTarget(self, "dynamodb_index_read_target",
+            max_capacity=100,
+            min_capacity=5,
+            resource_id="table/${" + example.name + "}/index/${" + index_name.value + "}",
+            scalable_dimension="dynamodb:index:ReadCapacityUnits",
+            service_namespace="dynamodb"
+        )
+```
+
+### ECS Service Autoscaling
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.appautoscaling_target import AppautoscalingTarget
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AppautoscalingTarget(self, "ecs_target",
+            max_capacity=4,
+            min_capacity=1,
+            resource_id="service/${" + example.name + "}/${" + aws_ecs_service_example.name + "}",
+            scalable_dimension="ecs:service:DesiredCount",
+            service_namespace="ecs"
+        )
+```
+
+### Aurora Read Replica Autoscaling
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.appautoscaling_target import AppautoscalingTarget
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AppautoscalingTarget(self, "replicas",
+            max_capacity=15,
+            min_capacity=1,
+            resource_id="cluster:${" + example.id + "}",
+            scalable_dimension="rds:cluster:ReadReplicaCount",
+            service_namespace="rds"
+        )
+```
+
+### Suppressing `tags_all` Differences For Older Resources
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from cdktf import TerraformResourceLifecycle
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.appautoscaling_target import AppautoscalingTarget
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AppautoscalingTarget(self, "ecs_target",
+            lifecycle=TerraformResourceLifecycle(
+                ignore_changes=[tags_all]
+            ),
+            max_capacity=4,
+            min_capacity=1,
+            resource_id="service/${" + example.name + "}/${" + aws_ecs_service_example.name + "}",
+            scalable_dimension="ecs:service:DesiredCount",
+            service_namespace="ecs"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `max_capacity` - (Required) Max capacity of the scalable target.
+* `min_capacity` - (Required) Min capacity of the scalable target.
+* `resource_id` - (Required) Resource type and unique identifier string for the resource associated with the scaling policy. Documentation can be found in the `ResourceId` parameter at: [AWS Application Auto Scaling API Reference](https://docs.aws.amazon.com/autoscaling/application/APIReference/API_RegisterScalableTarget.html#API_RegisterScalableTarget_RequestParameters)
+* `role_arn` - (Optional) ARN of the IAM role that allows Application AutoScaling to modify your scalable target on your behalf. This defaults to an IAM Service-Linked Role for most services and custom IAM Roles are ignored by the API for those namespaces. See the [AWS Application Auto Scaling documentation](https://docs.aws.amazon.com/autoscaling/application/userguide/security_iam_service-with-iam.html#security_iam_service-with-iam-roles) for more information about how this service interacts with IAM.
+* `scalable_dimension` - (Required) Scalable dimension of the scalable target. Documentation can be found in the `ScalableDimension` parameter at: [AWS Application Auto Scaling API Reference](https://docs.aws.amazon.com/autoscaling/application/APIReference/API_RegisterScalableTarget.html#API_RegisterScalableTarget_RequestParameters)
+* `service_namespace` - (Required) AWS service namespace of the scalable target. Documentation can be found in the `ServiceNamespace` parameter at: [AWS Application Auto Scaling API Reference](https://docs.aws.amazon.com/autoscaling/application/APIReference/API_RegisterScalableTarget.html#API_RegisterScalableTarget_RequestParameters)
+* `tags` - (Optional) Map of tags to assign to the scalable target. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the scalable target.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Application AutoScaling Target using the `service-namespace` , `resource-id` and `scalable-dimension` separated by `/`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Application AutoScaling Target using the `service-namespace` , `resource-id` and `scalable-dimension` separated by `/`. For example:
+
+```console
+% terraform import aws_appautoscaling_target.test-target service-namespace/resource-id/scalable-dimension
+```
+
+<!-- cache-key: cdktf-0.18.0 input-cff841bc1572dc29970ebd87553eae1d8c7762f0125b027829e17184e7104fdf -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/appconfig_application.html.markdown b/website/docs/cdktf/python/r/appconfig_application.html.markdown
new file mode 100644
index 00000000000..936642e8062
--- /dev/null
+++ b/website/docs/cdktf/python/r/appconfig_application.html.markdown
@@ -0,0 +1,73 @@
+---
+subcategory: "AppConfig"
+layout: "aws"
+page_title: "AWS: aws_appconfig_application"
+description: |-
+  Provides an AppConfig Application resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_appconfig_application
+
+Provides an AppConfig Application resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.appconfig_application import AppconfigApplication
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AppconfigApplication(self, "example",
+            description="Example AppConfig Application",
+            name="example-application-tf",
+            tags={
+                "Type": "AppConfig Application"
+            }
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) Name for the application. Must be between 1 and 64 characters in length.
+* `description` - (Optional) Description of the application. Can be at most 1024 characters.
+* `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the AppConfig Application.
+* `id` - AppConfig application ID.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AppConfig Applications using their application ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import AppConfig Applications using their application ID. For example:
+
+```console
+% terraform import aws_appconfig_application.example 71rxuzt
+```
+
+<!-- cache-key: cdktf-0.18.0 input-640d61d75f2bc0890c5f7e85bddbe3b0d0c1003903cdf41e4dfe4c6e445c5966 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/appconfig_configuration_profile.html.markdown b/website/docs/cdktf/python/r/appconfig_configuration_profile.html.markdown
new file mode 100644
index 00000000000..e1c6096f273
--- /dev/null
+++ b/website/docs/cdktf/python/r/appconfig_configuration_profile.html.markdown
@@ -0,0 +1,93 @@
+---
+subcategory: "AppConfig"
+layout: "aws"
+page_title: "AWS: aws_appconfig_configuration_profile"
+description: |-
+  Provides an AppConfig Configuration Profile resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_appconfig_configuration_profile
+
+Provides an AppConfig Configuration Profile resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.appconfig_configuration_profile import AppconfigConfigurationProfile
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AppconfigConfigurationProfile(self, "example",
+            application_id=Token.as_string(aws_appconfig_application_example.id),
+            description="Example Configuration Profile",
+            location_uri="hosted",
+            name="example-configuration-profile-tf",
+            tags={
+                "Type": "AppConfig Configuration Profile"
+            },
+            validator=[AppconfigConfigurationProfileValidator(
+                content=Token.as_string(aws_lambda_function_example.arn),
+                type="LAMBDA"
+            )
+            ]
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `application_id` - (Required, Forces new resource) Application ID. Must be between 4 and 7 characters in length.
+* `location_uri` - (Required, Forces new resource) URI to locate the configuration. You can specify the AWS AppConfig hosted configuration store, Systems Manager (SSM) document, an SSM Parameter Store parameter, or an Amazon S3 object. For the hosted configuration store, specify `hosted`. For an SSM document, specify either the document name in the format `ssm-document://<Document_name>` or the ARN. For a parameter, specify either the parameter name in the format `ssm-parameter://<Parameter_name>` or the ARN. For an Amazon S3 object, specify the URI in the following format: `s3://<bucket>/<objectKey>`.
+* `name` - (Required) Name for the configuration profile. Must be between 1 and 64 characters in length.
+* `description` - (Optional) Description of the configuration profile. Can be at most 1024 characters.
+* `retrieval_role_arn` - (Optional) ARN of an IAM role with permission to access the configuration at the specified `location_uri`. A retrieval role ARN is not required for configurations stored in the AWS AppConfig `hosted` configuration store. It is required for all other sources that store your configuration.
+* `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `type` - (Optional) Type of configurations contained in the profile. Valid values: `AWS.AppConfig.FeatureFlags` and `AWS.Freeform`.  Default: `AWS.Freeform`.
+* `validator` - (Optional) Set of methods for validating the configuration. Maximum of 2. See [Validator](#validator) below for more details.
+
+### Validator
+
+The `validator` block supports the following:
+
+* `content` - (Optional, Required when `type` is `LAMBDA`) Either the JSON Schema content or the ARN of an AWS Lambda function.
+* `type` - (Optional) Type of validator. Valid values: `JSON_SCHEMA` and `LAMBDA`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the AppConfig Configuration Profile.
+* `configuration_profile_id` - The configuration profile ID.
+* `id` - AppConfig configuration profile ID and application ID separated by a colon (`:`).
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AppConfig Configuration Profiles using the configuration profile ID and application ID separated by a colon (`:`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import AppConfig Configuration Profiles using the configuration profile ID and application ID separated by a colon (`:`). For example:
+
+```console
+% terraform import aws_appconfig_configuration_profile.example 71abcde:11xxxxx
+```
+
+<!-- cache-key: cdktf-0.18.0 input-8bd3175c690640ae4abfd602726abaa14c66e5eea23a0a90f02171c3cfe14ffe -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/appconfig_deployment.html.markdown b/website/docs/cdktf/python/r/appconfig_deployment.html.markdown
new file mode 100644
index 00000000000..b066d56a326
--- /dev/null
+++ b/website/docs/cdktf/python/r/appconfig_deployment.html.markdown
@@ -0,0 +1,83 @@
+---
+subcategory: "AppConfig"
+layout: "aws"
+page_title: "AWS: aws_appconfig_deployment"
+description: |-
+  Provides an AppConfig Deployment resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_appconfig_deployment
+
+Provides an AppConfig Deployment resource for an [`aws_appconfig_application` resource](appconfig_application.html.markdown).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.appconfig_deployment import AppconfigDeployment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AppconfigDeployment(self, "example",
+            application_id=Token.as_string(aws_appconfig_application_example.id),
+            configuration_profile_id=Token.as_string(aws_appconfig_configuration_profile_example.configuration_profile_id),
+            configuration_version=Token.as_string(aws_appconfig_hosted_configuration_version_example.version_number),
+            deployment_strategy_id=Token.as_string(aws_appconfig_deployment_strategy_example.id),
+            description="My example deployment",
+            environment_id=Token.as_string(aws_appconfig_environment_example.environment_id),
+            tags={
+                "Type": "AppConfig Deployment"
+            }
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `application_id` - (Required, Forces new resource) Application ID. Must be between 4 and 7 characters in length.
+* `configuration_profile_id` - (Required, Forces new resource) Configuration profile ID. Must be between 4 and 7 characters in length.
+* `configuration_version` - (Required, Forces new resource) Configuration version to deploy. Can be at most 1024 characters.
+* `deployment_strategy_id` - (Required, Forces new resource) Deployment strategy ID or name of a predefined deployment strategy. See [Predefined Deployment Strategies](https://docs.aws.amazon.com/appconfig/latest/userguide/appconfig-creating-deployment-strategy.html#appconfig-creating-deployment-strategy-predefined) for more details.
+* `description` - (Optional, Forces new resource) Description of the deployment. Can be at most 1024 characters.
+* `environment_id` - (Required, Forces new resource) Environment ID. Must be between 4 and 7 characters in length.
+* `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - AppConfig application ID, environment ID, and deployment number separated by a slash (`/`).
+* `arn` - ARN of the AppConfig Deployment.
+* `deployment_number` - Deployment number.
+* `state` - State of the deployment.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AppConfig Deployments using the application ID, environment ID, and deployment number separated by a slash (`/`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import AppConfig Deployments using the application ID, environment ID, and deployment number separated by a slash (`/`). For example:
+
+```console
+% terraform import aws_appconfig_deployment.example 71abcde/11xxxxx/1
+```
+
+<!-- cache-key: cdktf-0.18.0 input-39d098aa9ae0c1f1d4eeeee8bc2060587e9cc2e856acbf07eef391aa67bc2054 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/appconfig_deployment_strategy.html.markdown b/website/docs/cdktf/python/r/appconfig_deployment_strategy.html.markdown
new file mode 100644
index 00000000000..c534e3b786f
--- /dev/null
+++ b/website/docs/cdktf/python/r/appconfig_deployment_strategy.html.markdown
@@ -0,0 +1,83 @@
+---
+subcategory: "AppConfig"
+layout: "aws"
+page_title: "AWS: aws_appconfig_deployment_strategy"
+description: |-
+  Provides an AppConfig Deployment Strategy resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_appconfig_deployment_strategy
+
+Provides an AppConfig Deployment Strategy resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.appconfig_deployment_strategy import AppconfigDeploymentStrategy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AppconfigDeploymentStrategy(self, "example",
+            deployment_duration_in_minutes=3,
+            description="Example Deployment Strategy",
+            final_bake_time_in_minutes=4,
+            growth_factor=10,
+            growth_type="LINEAR",
+            name="example-deployment-strategy-tf",
+            replicate_to="NONE",
+            tags={
+                "Type": "AppConfig Deployment Strategy"
+            }
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `deployment_duration_in_minutes` - (Required) Total amount of time for a deployment to last. Minimum value of 0, maximum value of 1440.
+* `growth_factor` - (Required) Percentage of targets to receive a deployed configuration during each interval. Minimum value of 1.0, maximum value of 100.0.
+* `name` - (Required, Forces new resource) Name for the deployment strategy. Must be between 1 and 64 characters in length.
+* `replicate_to` - (Required, Forces new resource) Where to save the deployment strategy. Valid values: `NONE` and `SSM_DOCUMENT`.
+* `description` - (Optional) Description of the deployment strategy. Can be at most 1024 characters.
+* `final_bake_time_in_minutes` - (Optional) Amount of time AWS AppConfig monitors for alarms before considering the deployment to be complete and no longer eligible for automatic roll back. Minimum value of 0, maximum value of 1440.
+* `growth_type` - (Optional) Algorithm used to define how percentage grows over time. Valid value: `LINEAR` and `EXPONENTIAL`. Defaults to `LINEAR`.
+* `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - AppConfig deployment strategy ID.
+* `arn` - ARN of the AppConfig Deployment Strategy.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AppConfig Deployment Strategies using their deployment strategy ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import AppConfig Deployment Strategies using their deployment strategy ID. For example:
+
+```console
+% terraform import aws_appconfig_deployment_strategy.example 11xxxxx
+```
+
+<!-- cache-key: cdktf-0.18.0 input-5523efc97b4058c67f8184189e652c62466a4aef6fbcf077f1b0196ea0ec5624 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/appconfig_environment.html.markdown b/website/docs/cdktf/python/r/appconfig_environment.html.markdown
new file mode 100644
index 00000000000..d7746a65aa6
--- /dev/null
+++ b/website/docs/cdktf/python/r/appconfig_environment.html.markdown
@@ -0,0 +1,101 @@
+---
+subcategory: "AppConfig"
+layout: "aws"
+page_title: "AWS: aws_appconfig_environment"
+description: |-
+  Provides an AppConfig Environment resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_appconfig_environment
+
+Provides an AppConfig Environment resource for an [`aws_appconfig_application` resource](appconfig_application.html.markdown). One or more environments can be defined for an application.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.appconfig_application import AppconfigApplication
+from imports.aws.appconfig_environment import AppconfigEnvironment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = AppconfigApplication(self, "example",
+            description="Example AppConfig Application",
+            name="example-application-tf",
+            tags={
+                "Type": "AppConfig Application"
+            }
+        )
+        aws_appconfig_environment_example = AppconfigEnvironment(self, "example_1",
+            application_id=example.id,
+            description="Example AppConfig Environment",
+            monitor=[AppconfigEnvironmentMonitor(
+                alarm_arn=Token.as_string(aws_cloudwatch_metric_alarm_example.arn),
+                alarm_role_arn=Token.as_string(aws_iam_role_example.arn)
+            )
+            ],
+            name="example-environment-tf",
+            tags={
+                "Type": "AppConfig Environment"
+            }
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_appconfig_environment_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `application_id` - (Required, Forces new resource) AppConfig application ID. Must be between 4 and 7 characters in length.
+* `name` - (Required) Name for the environment. Must be between 1 and 64 characters in length.
+* `description` - (Optional) Description of the environment. Can be at most 1024 characters.
+* `monitor` - (Optional) Set of Amazon CloudWatch alarms to monitor during the deployment process. Maximum of 5. See [Monitor](#monitor) below for more details.
+* `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Monitor
+
+The `monitor` block supports the following:
+
+* `alarm_arn` - (Required) ARN of the Amazon CloudWatch alarm.
+* `alarm_role_arn` - (Optional) ARN of an IAM role for AWS AppConfig to monitor `alarm_arn`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the AppConfig Environment.
+* `id` - (**Deprecated**) AppConfig environment ID and application ID separated by a colon (`:`).
+* `environment_id` - AppConfig environment ID.
+* `state` - State of the environment. Possible values are `READY_FOR_DEPLOYMENT`, `DEPLOYING`, `ROLLING_BACK`
+  or `ROLLED_BACK`.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AppConfig Environments using the environment ID and application ID separated by a colon (`:`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import AppConfig Environments using the environment ID and application ID separated by a colon (`:`). For example:
+
+```console
+% terraform import aws_appconfig_environment.example 71abcde:11xxxxx
+```
+
+<!-- cache-key: cdktf-0.18.0 input-fbf604e2e551d298f98ef374aae241f630d53aa562269a500dee31fdf26530c5 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/appconfig_extension.html.markdown b/website/docs/cdktf/python/r/appconfig_extension.html.markdown
new file mode 100644
index 00000000000..7406f79d13b
--- /dev/null
+++ b/website/docs/cdktf/python/r/appconfig_extension.html.markdown
@@ -0,0 +1,136 @@
+---
+subcategory: "AppConfig"
+layout: "aws"
+page_title: "AWS: aws_appconfig_extension"
+description: |-
+  Provides an AppConfig Extension resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_appconfig_extension
+
+Provides an AppConfig Extension resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.appconfig_extension import AppconfigExtension
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.iam_role import IamRole
+from imports.aws.sns_topic import SnsTopic
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        test = SnsTopic(self, "test",
+            name="test"
+        )
+        data_aws_iam_policy_document_test = DataAwsIamPolicyDocument(self, "test_1",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["sts:AssumeRole"],
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["appconfig.amazonaws.com"],
+                    type="Service"
+                )
+                ]
+            )
+            ]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_iam_policy_document_test.override_logical_id("test")
+        aws_iam_role_test = IamRole(self, "test_2",
+            assume_role_policy=Token.as_string(data_aws_iam_policy_document_test.json),
+            name="test"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_role_test.override_logical_id("test")
+        aws_appconfig_extension_test = AppconfigExtension(self, "test_3",
+            action_point=[AppconfigExtensionActionPoint(
+                action=[AppconfigExtensionActionPointAction(
+                    name="test",
+                    role_arn=Token.as_string(aws_iam_role_test.arn),
+                    uri=test.arn
+                )
+                ],
+                point="ON_DEPLOYMENT_COMPLETE"
+            )
+            ],
+            description="test description",
+            name="test",
+            tags={
+                "Type": "AppConfig Extension"
+            }
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_appconfig_extension_test.override_logical_id("test")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) A name for the extension. Each extension name in your account must be unique. Extension versions use the same name.
+* `description` - (Optional) Information about the extension.
+* `action_point` - (Required) The action points defined in the extension. [Detailed below](#action_point).
+* `parameter` - (Optional) The parameters accepted by the extension. You specify parameter values when you associate the extension to an AppConfig resource by using the CreateExtensionAssociation API action. For Lambda extension actions, these parameters are included in the Lambda request object. [Detailed below](#parameter).
+* `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### `action_point`
+
+Defines the actions the extension performs during the AppConfig workflow and at which point those actions are performed. The `action_point` configuration block supports the following arguments:
+
+* `point` - (Required) The point at which to perform the defined actions. Valid points are `PRE_CREATE_HOSTED_CONFIGURATION_VERSION`, `PRE_START_DEPLOYMENT`, `ON_DEPLOYMENT_START`, `ON_DEPLOYMENT_STEP`, `ON_DEPLOYMENT_BAKING`, `ON_DEPLOYMENT_COMPLETE`, `ON_DEPLOYMENT_ROLLED_BACK`.
+* `action` - (Required) An action defines the tasks the extension performs during the AppConfig workflow. [Detailed below](#action).
+
+#### `action`
+
+The `action` configuration block supports configuring any number of the following arguments:
+
+* `name` - (Required) The action name.
+* `role_arn` - (Required) An Amazon Resource Name (ARN) for an Identity and Access Management assume role.
+* `uri` - (Required) The extension URI associated to the action point in the extension definition. The URI can be an Amazon Resource Name (ARN) for one of the following: an Lambda function, an Amazon Simple Queue Service queue, an Amazon Simple Notification Service topic, or the Amazon EventBridge default event bus.
+* `description` - (Optional) Information about the action.
+
+#### `parameter`
+
+The `parameter` configuration block supports configuring any number of the following arguments:
+
+* `name` - (Required) The parameter name.
+* `required` - (Required) Determines if a parameter value must be specified in the extension association.
+* `description` - (Optional) Information about the parameter.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the AppConfig Extension.
+* `id` - AppConfig Extension ID.
+* `version` - The version number for the extension.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AppConfig Extensions using their extension ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import AppConfig Extensions using their extension ID. For example:
+
+```console
+% terraform import aws_appconfig_extension.example 71rxuzt
+```
+
+<!-- cache-key: cdktf-0.18.0 input-a57e9661c333d971fc98cbdd2a1d95de7a9014d90bd4fdbf0d526c04df1b2f9d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/appconfig_extension_association.html.markdown b/website/docs/cdktf/python/r/appconfig_extension_association.html.markdown
new file mode 100644
index 00000000000..4f27eabbe74
--- /dev/null
+++ b/website/docs/cdktf/python/r/appconfig_extension_association.html.markdown
@@ -0,0 +1,124 @@
+---
+subcategory: "AppConfig"
+layout: "aws"
+page_title: "AWS: aws_appconfig_extension_association"
+description: |-
+  Associates an AppConfig Extension with a Resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_appconfig_extension_association
+
+Associates an AppConfig Extension with a Resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.appconfig_application import AppconfigApplication
+from imports.aws.appconfig_extension import AppconfigExtension
+from imports.aws.appconfig_extension_association import AppconfigExtensionAssociation
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.iam_role import IamRole
+from imports.aws.sns_topic import SnsTopic
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        test = AppconfigApplication(self, "test",
+            name="test"
+        )
+        aws_sns_topic_test = SnsTopic(self, "test_1",
+            name="test"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_sns_topic_test.override_logical_id("test")
+        data_aws_iam_policy_document_test = DataAwsIamPolicyDocument(self, "test_2",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["sts:AssumeRole"],
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["appconfig.amazonaws.com"],
+                    type="Service"
+                )
+                ]
+            )
+            ]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_iam_policy_document_test.override_logical_id("test")
+        aws_iam_role_test = IamRole(self, "test_3",
+            assume_role_policy=Token.as_string(data_aws_iam_policy_document_test.json),
+            name="test"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_role_test.override_logical_id("test")
+        aws_appconfig_extension_test = AppconfigExtension(self, "test_4",
+            action_point=[AppconfigExtensionActionPoint(
+                action=[AppconfigExtensionActionPointAction(
+                    name="test",
+                    role_arn=Token.as_string(aws_iam_role_test.arn),
+                    uri=Token.as_string(aws_sns_topic_test.arn)
+                )
+                ],
+                point="ON_DEPLOYMENT_COMPLETE"
+            )
+            ],
+            description="test description",
+            name="test",
+            tags={
+                "Type": "AppConfig Extension"
+            }
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_appconfig_extension_test.override_logical_id("test")
+        aws_appconfig_extension_association_test =
+        AppconfigExtensionAssociation(self, "test_5",
+            extension_arn=Token.as_string(aws_appconfig_extension_test.arn),
+            resource_arn=test.arn
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_appconfig_extension_association_test.override_logical_id("test")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `extension_arn` - (Required) The ARN of the extension defined in the association.
+* `resource_arn` - (Optional) The ARN of the application, configuration profile, or environment to associate with the extension.
+* `parameters` - (Optional) The parameter names and values defined for the association.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the AppConfig Extension Association.
+* `id` - AppConfig Extension Association ID.
+* `extension_version` - The version number for the extension defined in the association.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AppConfig Extension Associations using their extension association ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import AppConfig Extension Associations using their extension association ID. For example:
+
+```console
+% terraform import aws_appconfig_extension_association.example 71rxuzt
+```
+
+<!-- cache-key: cdktf-0.18.0 input-17365f1464d46d38d1dcf2819aa51132f201f9fd4618e6d0e60185e1fad561f2 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/appconfig_hosted_configuration_version.html.markdown b/website/docs/cdktf/python/r/appconfig_hosted_configuration_version.html.markdown
new file mode 100644
index 00000000000..f03997920b4
--- /dev/null
+++ b/website/docs/cdktf/python/r/appconfig_hosted_configuration_version.html.markdown
@@ -0,0 +1,143 @@
+---
+subcategory: "AppConfig"
+layout: "aws"
+page_title: "AWS: aws_appconfig_hosted_configuration_version"
+description: |-
+  Provides an AppConfig Hosted Configuration Version resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_appconfig_hosted_configuration_version
+
+Provides an AppConfig Hosted Configuration Version resource.
+
+## Example Usage
+
+### Freeform
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, Fn, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.appconfig_hosted_configuration_version import AppconfigHostedConfigurationVersion
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AppconfigHostedConfigurationVersion(self, "example",
+            application_id=Token.as_string(aws_appconfig_application_example.id),
+            configuration_profile_id=Token.as_string(aws_appconfig_configuration_profile_example.configuration_profile_id),
+            content=Token.as_string(
+                Fn.jsonencode({
+                    "foo": "bar",
+                    "fruit": ["apple", "pear", "orange"],
+                    "is_thing_enabled": True
+                })),
+            content_type="application/json",
+            description="Example Freeform Hosted Configuration Version"
+        )
+```
+
+### Feature Flags
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, Fn, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.appconfig_hosted_configuration_version import AppconfigHostedConfigurationVersion
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AppconfigHostedConfigurationVersion(self, "example",
+            application_id=Token.as_string(aws_appconfig_application_example.id),
+            configuration_profile_id=Token.as_string(aws_appconfig_configuration_profile_example.configuration_profile_id),
+            content=Token.as_string(
+                Fn.jsonencode({
+                    "flags": {
+                        "bar": {
+                            "attributes": {
+                                "some_attribute": {
+                                    "constraints": {
+                                        "required": True,
+                                        "type": "string"
+                                    }
+                                },
+                                "some_other_attribute": {
+                                    "constraints": {
+                                        "required": True,
+                                        "type": "number"
+                                    }
+                                }
+                            },
+                            "name": "bar"
+                        },
+                        "foo": {
+                            "_deprecation": {
+                                "status": "planned"
+                            },
+                            "name": "foo"
+                        }
+                    },
+                    "values": {
+                        "bar": {
+                            "enabled": "true",
+                            "some_attribute": "Hello World",
+                            "some_other_attribute": 123
+                        },
+                        "foo": {
+                            "enabled": "true"
+                        }
+                    },
+                    "version": "1"
+                })),
+            content_type="application/json",
+            description="Example Feature Flag Configuration Version"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `application_id` - (Required, Forces new resource) Application ID.
+* `configuration_profile_id` - (Required, Forces new resource) Configuration profile ID.
+* `content` - (Required, Forces new resource) Content of the configuration or the configuration data.
+* `content_type` - (Required, Forces new resource) Standard MIME type describing the format of the configuration content. For more information, see [Content-Type](https://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.17).
+* `description` - (Optional, Forces new resource) Description of the configuration.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the AppConfig  hosted configuration version.
+* `id` - AppConfig application ID, configuration profile ID, and version number separated by a slash (`/`).
+* `version_number` - Version number of the hosted configuration.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AppConfig Hosted Configuration Versions using the application ID, configuration profile ID, and version number separated by a slash (`/`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import AppConfig Hosted Configuration Versions using the application ID, configuration profile ID, and version number separated by a slash (`/`). For example:
+
+```console
+% terraform import aws_appconfig_hosted_configuration_version.example 71abcde/11xxxxx/2
+```
+
+<!-- cache-key: cdktf-0.18.0 input-a6ff65d582f450abdbc1195a62bdb811f1120a5973cdab88491b53812cadd935 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/appflow_connector_profile.html.markdown b/website/docs/cdktf/python/r/appflow_connector_profile.html.markdown
new file mode 100644
index 00000000000..a9114448b15
--- /dev/null
+++ b/website/docs/cdktf/python/r/appflow_connector_profile.html.markdown
@@ -0,0 +1,359 @@
+---
+subcategory: "AppFlow"
+layout: "aws"
+page_title: "AWS: aws_appflow_connector_profile"
+description: |-
+  Provides an AppFlow Connector Profile resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_appflow_connector_profile
+
+Provides an AppFlow connector profile resource.
+
+For information about AppFlow flows, see the [Amazon AppFlow API Reference][1].
+For specific information about creating an AppFlow connector profile, see the
+[CreateConnectorProfile][2] page in the Amazon AppFlow API Reference.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.appflow_connector_profile import AppflowConnectorProfile
+from imports.aws.data_aws_iam_policy import DataAwsIamPolicy
+from imports.aws.iam_role import IamRole
+from imports.aws.redshift_cluster import RedshiftCluster
+from imports.aws.s3_bucket import S3Bucket
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = IamRole(self, "example",
+            assume_role_policy=Token.as_string(
+                Fn.jsonencode({
+                    "Statement": [{
+                        "Action": "sts:AssumeRole",
+                        "Effect": "Allow",
+                        "Principal": {
+                            "Service": "ec2.amazonaws.com"
+                        },
+                        "Sid": ""
+                    }
+                    ],
+                    "Version": "2012-10-17"
+                })),
+            managed_policy_arns=[Token.as_string(test.arn)],
+            name="example_role"
+        )
+        aws_redshift_cluster_example = RedshiftCluster(self, "example_1",
+            cluster_identifier="example_cluster",
+            cluster_type="single-node",
+            database_name="example_db",
+            master_password="examplePassword123!",
+            master_username="exampleuser",
+            node_type="dc1.large"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_redshift_cluster_example.override_logical_id("example")
+        aws_s3_bucket_example = S3Bucket(self, "example_2",
+            bucket="example_bucket"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_example.override_logical_id("example")
+        data_aws_iam_policy_example = DataAwsIamPolicy(self, "example_3",
+            name="AmazonRedshiftAllCommandsFullAccess"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_iam_policy_example.override_logical_id("example")
+        aws_appflow_connector_profile_example = AppflowConnectorProfile(self, "example_4",
+            connection_mode="Public",
+            connector_profile_config=AppflowConnectorProfileConnectorProfileConfig(
+                connector_profile_credentials=AppflowConnectorProfileConnectorProfileConfigConnectorProfileCredentials(
+                    redshift=AppflowConnectorProfileConnectorProfileConfigConnectorProfileCredentialsRedshift(
+                        password=Token.as_string(aws_redshift_cluster_example.master_password),
+                        username=Token.as_string(aws_redshift_cluster_example.master_username)
+                    )
+                ),
+                connector_profile_properties=AppflowConnectorProfileConnectorProfileConfigConnectorProfileProperties(
+                    redshift=AppflowConnectorProfileConnectorProfileConfigConnectorProfilePropertiesRedshift(
+                        bucket_name=Token.as_string(aws_s3_bucket_example.name),
+                        database_url="jdbc:redshift://${" + aws_redshift_cluster_example.endpoint + "}/${" + aws_redshift_cluster_example.database_name + "}",
+                        role_arn=example.arn
+                    )
+                )
+            ),
+            connector_type="Redshift",
+            name="example_profile"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_appflow_connector_profile_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+The AppFlow connector profile argument layout is a complex structure. The following top-level arguments are supports:
+
+* `name ` (Required) - Name of the connector profile. The name is unique for each `ConnectorProfile` in your AWS account.
+* `connection_mode` (Required) - Indicates the connection mode and specifies whether it is public or private. Private flows use AWS PrivateLink to route data over AWS infrastructure without exposing it to the public internet. One of: `Public`, `Private`.
+* `connector_label` (Optional) - The label of the connector. The label is unique for each ConnectorRegistration in your AWS account. Only needed if calling for `CustomConnector` connector type.
+* `connector_profile_config` (Required) - Defines the connector-specific configuration and credentials. See [Connector Profile Config](#connector-profile-config) for more details.
+* `connector_type` (Required) - The type of connector. One of: `Amplitude`, `CustomConnector`, `CustomerProfiles`, `Datadog`, `Dynatrace`, `EventBridge`, `Googleanalytics`, `Honeycode`, `Infornexus`, `LookoutMetrics`, `Marketo`, `Redshift`, `S3`, `Salesforce`, `SAPOData`, `Servicenow`, `Singular`, `Slack`, `Snowflake`, `Trendmicro`, `Upsolver`, `Veeva`, `Zendesk`.
+* `kms_arn` (Optional) - ARN (Amazon Resource Name) of the Key Management Service (KMS) key you provide for encryption. This is required if you do not want to use the Amazon AppFlow-managed KMS key. If you don't provide anything here, Amazon AppFlow uses the Amazon AppFlow-managed KMS key.
+
+### Connector Profile Config
+
+* `connector_profile_credentials` (Required) - The connector-specific credentials required by each connector. See [Connector Profile Credentials](#connector-profile-credentials) for more details.
+* `connector_profile_properties` (Required) - The connector-specific properties of the profile configuration. See [Connector Profile Properties](#connector-profile-properties) for more details.
+
+### Connector Profile Credentials
+
+* `amplitude` (Optional) - The connector-specific credentials required when using Amplitude. See [Amplitude Connector Profile Credentials](#amplitude-connector-profile-credentials) for more details.
+* `custom_connector` (Optional) - The connector-specific profile credentials required when using the custom connector. See [Custom Connector Profile Credentials](#custom-connector-profile-credentials) for more details.
+* `datadog` (Optional) - Connector-specific credentials required when using Datadog. See [Datadog Connector Profile Credentials](#datadog-connector-profile-credentials) for more details.
+* `dynatrace` (Optional) - The connector-specific credentials required when using Dynatrace. See [Dynatrace Connector Profile Credentials](#dynatrace-connector-profile-credentials) for more details.
+* `google_analytics` (Optional) - The connector-specific credentials required when using Google Analytics. See [Google Analytics Connector Profile Credentials](#google-analytics-connector-profile-credentials) for more details.
+* `honeycode` (Optional) - The connector-specific credentials required when using Amazon Honeycode. See [Honeycode Connector Profile Credentials](#honeycode-connector-profile-credentials) for more details.
+* `infor_nexus` (Optional) - The connector-specific credentials required when using Infor Nexus. See [Infor Nexus Connector Profile Credentials](#infor-nexus-connector-profile-credentials) for more details.
+* `marketo` (Optional) - Connector-specific credentials required when using Marketo. See [Marketo Connector Profile Credentials](#marketo-connector-profile-credentials) for more details.
+* `redshift` (Optional) - Connector-specific credentials required when using Amazon Redshift. See [Redshift Connector Profile Credentials](#redshift-connector-profile-credentials) for more details.
+* `salesforce` (Optional) - The connector-specific credentials required when using Salesforce. See [Salesforce Connector Profile Credentials](#salesforce-connector-profile-credentials) for more details.
+* `sapo_data` (Optional) - The connector-specific credentials required when using SAPOData. See [SAPOData Connector Profile Credentials](#sapodata-connector-profile-credentials) for more details.
+* `service_now` (Optional) - The connector-specific credentials required when using ServiceNow. See [ServiceNow Connector Profile Credentials](#servicenow-connector-profile-credentials) for more details.
+* `singular` (Optional) - Connector-specific credentials required when using Singular. See [Singular Connector Profile Credentials](#singular-connector-profile-credentials) for more details.
+* `slack` (Optional) - Connector-specific credentials required when using Slack. See [Slack Connector Profile Credentials](#amplitude-connector-profile-credentials) for more details.
+* `snowflake` (Optional) - The connector-specific credentials required when using Snowflake. See [Snowflake Connector Profile Credentials](#snowflake-connector-profile-credentials) for more details.
+* `trendmicro` (Optional) - The connector-specific credentials required when using Trend Micro. See [Trend Micro Connector Profile Credentials](#trendmicro-connector-profile-credentials) for more details.
+* `veeva` (Optional) - Connector-specific credentials required when using Veeva. See [Veeva Connector Profile Credentials](#veeva-connector-profile-credentials) for more details.
+* `zendesk` (Optional) - Connector-specific credentials required when using Zendesk. See [Zendesk Connector Profile Credentials](#zendesk-connector-profile-credentials) for more details.
+
+#### Amplitude Connector Profile Credentials
+
+* `api_key` (Required) - Unique alphanumeric identifier used to authenticate a user, developer, or calling program to your API.
+* `secret_key` (Required) - The Secret Access Key portion of the credentials.
+
+#### Custom Connector Profile Credentials
+
+* `api_key` (Optional) - API keys required for the authentication of the user.
+    * `api_key` (Required) - The API key required for API key authentication.
+    * `api_secret_key` (Optional) - The API secret key required for API key authentication.
+* `authentication_type` (Required) - The authentication type that the custom connector uses for authenticating while creating a connector profile. One of: `APIKEY`, `BASIC`, `CUSTOM`, `OAUTH2`.
+* `basic` (Optional) - Basic credentials that are required for the authentication of the user.
+    * `password` (Required) - The password to use to connect to a resource.
+    * `username` (Required) - The username to use to connect to a resource.
+* `custom` (Optional) - If the connector uses the custom authentication mechanism, this holds the required credentials.
+    * `credentials_map` (Optional) - A map that holds custom authentication credentials.
+    * `custom_authentication_type` (Required) - The custom authentication type that the connector uses.
+* `oauth2` (Optional) - OAuth 2.0 credentials required for the authentication of the user.
+    * `access_token` (Optional) - The access token used to access the connector on your behalf.
+    * `client_id` (Optional) - The identifier for the desired client.
+    * `client_secret` (Optional) - The client secret used by the OAuth client to authenticate to the authorization server.
+    * `oauth_request` (Optional) - Used by select connectors for which the OAuth workflow is supported. See [OAuth Request](#oauth-request) for more details.
+    * `refresh_token` (Optional) - The refresh token used to refresh an expired access token.
+
+#### Datadog Connector Profile Credentials
+
+* `api_key` (Required) - Unique alphanumeric identifier used to authenticate a user, developer, or calling program to your API.
+* `application_key` (Required) - Application keys, in conjunction with your API key, give you full access to Datadog’s programmatic API. Application keys are associated with the user account that created them. The application key is used to log all requests made to the API.
+
+#### Dynatrace Connector Profile Credentials
+
+* `api_token` (Required) - The API tokens used by Dynatrace API to authenticate various API calls.
+
+#### Google Analytics Connector Profile Credentials
+
+* `access_token` (Optional) - The credentials used to access protected Google Analytics resources.
+* `client_id` (Required) - The identifier for the desired client.
+* `client_secret` (Required) - The client secret used by the OAuth client to authenticate to the authorization server.
+* `oauth_request` (Optional) - The OAuth requirement needed to request security tokens from the connector endpoint. See [OAuth Request](#oauth-request) for more details.
+* `refresh_token` (Optional) - The credentials used to acquire new access tokens. This is required only for OAuth2 access tokens, and is not required for OAuth1 access tokens.
+
+#### Honeycode Connector Profile Credentials
+
+* `access_token` (Optional) - The credentials used to access protected Amazon Honeycode resources.
+* `oauth_request` (Optional) - Used by select connectors for which the OAuth workflow is supported, such as Salesforce, Google Analytics, Marketo, Zendesk, and Slack. See [OAuth Request](#oauth-request) for more details.
+* `refresh_token` (Optional) - The credentials used to acquire new access tokens.
+
+#### Infor Nexus Connector Profile Credentials
+
+* `access_key_id` (Required) - The Access Key portion of the credentials.
+* `datakey` (Required) - Encryption keys used to encrypt data.
+* `secret_access_key` (Required) - The secret key used to sign requests.
+* `user_id` (Required) - Identifier for the user.
+
+#### Marketo Connector Profile Credentials
+
+* `access_token` (Optional) - The credentials used to access protected Marketo resources.
+* `client_id` (Required) - The identifier for the desired client.
+* `client_secret` (Required) - The client secret used by the OAuth client to authenticate to the authorization server.
+* `oauth_request` (Optional) - The OAuth requirement needed to request security tokens from the connector endpoint. See [OAuth Request](#oauth-request) for more details.
+
+#### Redshift Connector Profile Credentials
+
+* `password` (Required) - Password that corresponds to the user name.
+* `username` (Required) - Name of the user.
+
+#### Salesforce Connector Profile Credentials
+
+* `access_token` (Optional) - The credentials used to access protected Salesforce resources.
+* `client_credentials_arn` (Optional) - The secret manager ARN, which contains the client ID and client secret of the connected app.
+* `oauth_request` (Optional) - The OAuth requirement needed to request security tokens from the connector endpoint. See [OAuth Request](#oauth-request) for more details.
+* `refresh_token` (Optional) - The credentials used to acquire new access tokens.
+
+#### SAPOData Connector Profile Credentials
+
+* `basic_auth_credentials` (Optional) - The SAPOData basic authentication credentials.
+    * `password` (Required) - The password to use to connect to a resource.
+    * `username` (Required) - The username to use to connect to a resource.
+* `oauth_credentials` (Optional) - The SAPOData OAuth type authentication credentials.
+    * `access_token` (Optional) - The access token used to access protected SAPOData resources.
+    * `client_id` (Required) - The identifier for the desired client.
+    * `client_secret` (Required) -  The client secret used by the OAuth client to authenticate to the authorization server.
+    * `oauth_request` (Optional) - The OAuth requirement needed to request security tokens from the connector endpoint. See [OAuth Request](#oauth-request) for more details.
+    * `refresh_token` (Optional) - The refresh token used to refresh expired access token.
+
+#### ServiceNow Connector Profile Credentials
+
+* `password` (Required) - Password that corresponds to the user name.
+* `username` (Required) - Name of the user.
+
+#### Singular Connector Profile Credentials
+
+* `api_key` (Required) - Unique alphanumeric identifier used to authenticate a user, developer, or calling program to your API.
+
+#### Slack Connector Profile Credentials
+
+* `access_token` (Optional) - The credentials used to access protected Slack resources.
+* `client_id` (Required) - The identifier for the client.
+* `client_secret` (Required) - The client secret used by the OAuth client to authenticate to the authorization server.
+* `oauth_request` (Optional) - The OAuth requirement needed to request security tokens from the connector endpoint. See [OAuth Request](#oauth-request) for more details.
+
+#### Snowflake Connector Profile Credentials
+
+* `password` (Required) - Password that corresponds to the user name.
+* `username` (Required) - Name of the user.
+
+#### Trendmicro Connector Profile Credentials
+
+* `api_secret_key` (Required) - The Secret Access Key portion of the credentials.
+
+#### Veeva Connector Profile Credentials
+
+* `password` (Required) - Password that corresponds to the user name.
+* `username` (Required) - Name of the user.
+
+#### Zendesk Connector Profile Credentials
+
+* `access_token` (Optional) - The credentials used to access protected Zendesk resources.
+* `client_id` (Required) - The identifier for the desired client.
+* `client_secret` (Required) - The client secret used by the OAuth client to authenticate to the authorization server.
+* `oauth_request` (Optional) - The OAuth requirement needed to request security tokens from the connector endpoint. See [OAuth Request](#oauth-request) for more details.
+
+##### OAuth Request
+
+* `auth_code` (Optional) - The code provided by the connector when it has been authenticated via the connected app.
+* `redirect_uri` (Optional) - The URL to which the authentication server redirects the browser after authorization has been granted.
+
+### Connector Profile Properties
+
+* `custom_connector` (Optional) - The connector-specific profile properties required when using the custom connector. See [Custom Connector Profile Properties](#custom-connector-profile-properties) for more details.
+* `datadog` (Optional) - Connector-specific properties required when using Datadog. See [Generic Connector Profile Properties](#generic-connector-profile-properties) for more details.
+* `dynatrace` (Optional) - The connector-specific properties required when using Dynatrace. See [Generic Connector Profile Properties](#generic-connector-profile-properties) for more details.
+* `infor_nexus` (Optional) - The connector-specific properties required when using Infor Nexus. See [Generic Connector Profile Properties](#generic-connector-profile-properties) for more details.
+* `marketo` (Optional) - Connector-specific properties required when using Marketo. See [Generic Connector Profile Properties](#generic-connector-profile-properties) for more details.
+* `redshift` (Optional) - Connector-specific properties required when using Amazon Redshift. See [Redshift Connector Profile Properties](#redshift-connector-profile-properties) for more details.
+* `salesforce` (Optional) - The connector-specific properties required when using Salesforce. See [Salesforce Connector Profile Properties](#salesforce-connector-profile-properties) for more details.
+* `sapo_data` (Optional) - The connector-specific properties required when using SAPOData. See [SAPOData Connector Profile Properties](#sapodata-connector-profile-properties) for more details.
+* `service_now` (Optional) - The connector-specific properties required when using ServiceNow. See [Generic Connector Profile Properties](#generic-connector-profile-properties) for more details.
+* `slack` (Optional) - Connector-specific properties required when using Slack. See [Generic Connector Profile Properties](#generic-connector-profile-properties) for more details.
+* `snowflake` (Optional) - The connector-specific properties required when using Snowflake. See [Snowflake Connector Profile Properties](#snowflake-connector-profile-properties) for more details.
+* `veeva` (Optional) - Connector-specific properties required when using Veeva. See [Generic Connector Profile Properties](#generic-connector-profile-properties) for more details.
+* `zendesk` (Optional) - Connector-specific properties required when using Zendesk. See [Generic Connector Profile Properties](#generic-connector-profile-properties) for more details.
+
+#### Custom Connector Profile Properties
+
+* `oauth2_properties` (Optional) - The OAuth 2.0 properties required for OAuth 2.0 authentication.
+    * `oauth2_grant_type` (Required) - The OAuth 2.0 grant type used by connector for OAuth 2.0 authentication. One of: `AUTHORIZATION_CODE`, `CLIENT_CREDENTIALS`.
+    * `token_url` (Required) - The token URL required for OAuth 2.0 authentication.
+    * `token_url_custom_properties` (Optional) - Associates your token URL with a map of properties that you define. Use this parameter to provide any additional details that the connector requires to authenticate your request.
+* `profile_properties` (Optional) - A map of properties that are required to create a profile for the custom connector.
+
+#### Generic Connector Profile Properties
+
+Datadog, Dynatrace, Infor Nexus, Marketo, ServiceNow, Slack, Veeva, and Zendesk all support the following attributes:
+
+* `instance_url` (Required) - The location of the Datadog resource.
+
+#### Redshift Connector Profile Properties
+
+* `bucket_name` (Required) - A name for the associated Amazon S3 bucket.
+* `bucket_prefix` (Optional) - The object key for the destination bucket in which Amazon AppFlow places the files.
+* `cluster_identifier` (Optional) - The unique ID that's assigned to an Amazon Redshift cluster.
+* `database_name` (Optional) - The name of an Amazon Redshift database.
+* `database_url` (Required) - The JDBC URL of the Amazon Redshift cluster.
+* `data_api_role_arn` (Optional) - ARN of the IAM role that permits AppFlow to access the database through Data API.
+* `role_arn` (Required) - ARN of the IAM role.
+
+#### Salesforce Connector Profile Properties
+
+* `instance_url` (Optional) - The location of the Salesforce resource.
+* `is_sandbox_environment` (Optional) - Indicates whether the connector profile applies to a sandbox or production environment.
+
+#### SAPOData Connector Profile Properties
+
+* `application_host_url` (Required) - The location of the SAPOData resource.
+* `application_service_path` (Required) - The application path to catalog service.
+* `client_number` (Required) - The client number for the client creating the connection.
+* `logon_language` (Optional) - The logon language of SAPOData instance.
+* `oauth_properties` (Optional) - The SAPOData OAuth properties required for OAuth type authentication.
+    * `auth_code_url` (Required) - The authorization code url required to redirect to SAP Login Page to fetch authorization code for OAuth type authentication.
+    * `oauth_scopes` (Required) - The OAuth scopes required for OAuth type authentication.
+    * `token_url` (Required) - The token url required to fetch access/refresh tokens using authorization code and also to refresh expired access token using refresh token.
+* `port_number` (Required) - The port number of the SAPOData instance.
+* `private_link_service_name` (Optional) - The SAPOData Private Link service name to be used for private data transfers.
+
+#### Snowflake Connector Profile Properties
+
+* `account_name` (Optional) - The name of the account.
+* `bucket_name` (Required) - The name of the Amazon S3 bucket associated with Snowflake.
+* `bucket_prefix` (Optional) - The bucket path that refers to the Amazon S3 bucket associated with Snowflake.
+* `private_link_service_name` (Optional) - The Snowflake Private Link service name to be used for private data transfers.
+* `region` (Optional) - AWS Region of the Snowflake account.
+* `stage` (Required) - Name of the Amazon S3 stage that was created while setting up an Amazon S3 stage in the Snowflake account. This is written in the following format: `<Database>.<Schema>.<Stage Name>`.
+* `warehouse` (Required) - The name of the Snowflake warehouse.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the connector profile.
+* `credentials_arn` - ARN of the connector profile credentials.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AppFlow Connector Profile using the connector profile `arn`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import AppFlow Connector Profile using the connector profile `arn`. For example:
+
+```console
+% terraform import aws_appflow_connector_profile.profile arn:aws:appflow:us-west-2:123456789012:connectorprofile/example-profile
+```
+
+[1]: https://docs.aws.amazon.com/appflow/1.0/APIReference/Welcome.html
+[2]: https://docs.aws.amazon.com/appflow/1.0/APIReference/API_CreateConnectorProfile.html
+
+<!-- cache-key: cdktf-0.18.0 input-12a8438ef29150aa2860f41042c61347e6053f7bc63636fa7e0e39ab0a9c445b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/appflow_flow.html.markdown b/website/docs/cdktf/python/r/appflow_flow.html.markdown
new file mode 100644
index 00000000000..64387d8bde9
--- /dev/null
+++ b/website/docs/cdktf/python/r/appflow_flow.html.markdown
@@ -0,0 +1,437 @@
+---
+subcategory: "AppFlow"
+layout: "aws"
+page_title: "AWS: aws_appflow_flow"
+description: |-
+  Provides an AppFlow Flow resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_appflow_flow
+
+Provides an AppFlow flow resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.appflow_flow import AppflowFlow
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_policy import S3BucketPolicy
+from imports.aws.s3_object import S3Object
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example_destination = S3Bucket(self, "example_destination",
+            bucket="example-destination"
+        )
+        example_source = S3Bucket(self, "example_source",
+            bucket="example-source"
+        )
+        S3Object(self, "example",
+            bucket=example_source.id,
+            key="example_source.csv",
+            source="example_source.csv"
+        )
+        data_aws_iam_policy_document_example_destination =
+        DataAwsIamPolicyDocument(self, "example_destination_3",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["s3:PutObject", "s3:AbortMultipartUpload", "s3:ListMultipartUploadParts", "s3:ListBucketMultipartUploads", "s3:GetBucketAcl", "s3:PutObjectAcl"
+                ],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["appflow.amazonaws.com"],
+                    type="Service"
+                )
+                ],
+                resources=["arn:aws:s3:::example_destination", "arn:aws:s3:::example_destination/*"
+                ],
+                sid="AllowAppFlowDestinationActions"
+            )
+            ]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_iam_policy_document_example_destination.override_logical_id("example_destination")
+        data_aws_iam_policy_document_example_source = DataAwsIamPolicyDocument(self, "example_source_4",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["s3:ListBucket", "s3:GetObject"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["appflow.amazonaws.com"],
+                    type="Service"
+                )
+                ],
+                resources=["arn:aws:s3:::example_source", "arn:aws:s3:::example_source/*"
+                ],
+                sid="AllowAppFlowSourceActions"
+            )
+            ]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_iam_policy_document_example_source.override_logical_id("example_source")
+        aws_s3_bucket_policy_example_destination = S3BucketPolicy(self, "example_destination_5",
+            bucket=example_destination.id,
+            policy=Token.as_string(data_aws_iam_policy_document_example_destination.json)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_policy_example_destination.override_logical_id("example_destination")
+        aws_s3_bucket_policy_example_source = S3BucketPolicy(self, "example_source_6",
+            bucket=example_source.id,
+            policy=Token.as_string(data_aws_iam_policy_document_example_source.json)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_policy_example_source.override_logical_id("example_source")
+        aws_appflow_flow_example = AppflowFlow(self, "example_7",
+            destination_flow_config=[AppflowFlowDestinationFlowConfig(
+                connector_type="S3",
+                destination_connector_properties=AppflowFlowDestinationFlowConfigDestinationConnectorProperties(
+                    s3=AppflowFlowDestinationFlowConfigDestinationConnectorPropertiesS3(
+                        bucket_name=Token.as_string(aws_s3_bucket_policy_example_destination.bucket),
+                        s3_output_format_config=AppflowFlowDestinationFlowConfigDestinationConnectorPropertiesS3S3OutputFormatConfig(
+                            prefix_config=AppflowFlowDestinationFlowConfigDestinationConnectorPropertiesS3S3OutputFormatConfigPrefixConfig(
+                                prefix_type="PATH"
+                            )
+                        )
+                    )
+                )
+            )
+            ],
+            name="example",
+            source_flow_config=AppflowFlowSourceFlowConfig(
+                connector_type="S3",
+                source_connector_properties=AppflowFlowSourceFlowConfigSourceConnectorProperties(
+                    s3=AppflowFlowSourceFlowConfigSourceConnectorPropertiesS3(
+                        bucket_name=Token.as_string(aws_s3_bucket_policy_example_source.bucket),
+                        bucket_prefix="example"
+                    )
+                )
+            ),
+            task=[AppflowFlowTask(
+                connector_operator=[AppflowFlowTaskConnectorOperator(
+                    s3="NO_OP"
+                )
+                ],
+                destination_field="exampleField",
+                source_fields=["exampleField"],
+                task_type="Map"
+            )
+            ],
+            trigger_config=AppflowFlowTriggerConfig(
+                trigger_type="OnDemand"
+            )
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_appflow_flow_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) Name of the flow.
+* `destination_flow_config` - (Required) A [Destination Flow Config](#destination-flow-config) that controls how Amazon AppFlow places data in the destination connector.
+* `source_flow_config` - (Required) The [Source Flow Config](#source-flow-config) that controls how Amazon AppFlow retrieves data from the source connector.
+* `task` - (Required) A [Task](#task) that Amazon AppFlow performs while transferring the data in the flow run.
+* `trigger_config` - (Required) A [Trigger](#trigger-config) that determine how and when the flow runs.
+* `description` - (Optional) Description of the flow you want to create.
+* `kms_arn` - (Optional) ARN (Amazon Resource Name) of the Key Management Service (KMS) key you provide for encryption. This is required if you do not want to use the Amazon AppFlow-managed KMS key. If you don't provide anything here, Amazon AppFlow uses the Amazon AppFlow-managed KMS key.
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+### Destination Flow Config
+
+* `connector_type` - (Required) Type of connector, such as Salesforce, Amplitude, and so on. Valid values are `Salesforce`, `Singular`, `Slack`, `Redshift`, `S3`, `Marketo`, `Googleanalytics`, `Zendesk`, `Servicenow`, `Datadog`, `Trendmicro`, `Snowflake`, `Dynatrace`, `Infornexus`, `Amplitude`, `Veeva`, `EventBridge`, `LookoutMetrics`, `Upsolver`, `Honeycode`, `CustomerProfiles`, `SAPOData`, and `CustomConnector`.
+* `destination_connector_properties` - (Required) This stores the information that is required to query a particular connector. See [Destination Connector Properties](#destination-connector-properties) for more information.
+* `api_version` - (Optional) API version that the destination connector uses.
+* `connector_profile_name` - (Optional) Name of the connector profile. This name must be unique for each connector profile in the AWS account.
+
+#### Destination Connector Properties
+
+* `custom_connector` - (Optional) Properties that are required to query the custom Connector. See [Custom Connector Destination Properties](#custom-connector-destination-properties) for more details.
+* `customer_profiles` - (Optional) Properties that are required to query Amazon Connect Customer Profiles. See [Customer Profiles Destination Properties](#customer-profiles-destination-properties) for more details.
+* `event_bridge` - (Optional) Properties that are required to query Amazon EventBridge. See [Generic Destination Properties](#generic-destination-properties) for more details.
+* `honeycode` - (Optional) Properties that are required to query Amazon Honeycode. See [Generic Destination Properties](#generic-destination-properties) for more details.
+* `marketo` - (Optional) Properties that are required to query Marketo. See [Generic Destination Properties](#generic-destination-properties) for more details.
+* `redshift` - (Optional) Properties that are required to query Amazon Redshift. See [Redshift Destination Properties](#redshift-destination-properties) for more details.
+* `s3` - (Optional) Properties that are required to query Amazon S3. See [S3 Destination Properties](#s3-destination-properties) for more details.
+* `salesforce` - (Optional) Properties that are required to query Salesforce. See [Salesforce Destination Properties](#salesforce-destination-properties) for more details.
+* `sapo_data` - (Optional) Properties that are required to query SAPOData. See [SAPOData Destination Properties](#sapodata-destination-properties) for more details.
+* `snowflake` - (Optional) Properties that are required to query Snowflake. See [Snowflake Destination Properties](#snowflake-destination-properties) for more details.
+* `upsolver` - (Optional) Properties that are required to query Upsolver. See [Upsolver Destination Properties](#upsolver-destination-properties) for more details.
+* `zendesk` - (Optional) Properties that are required to query Zendesk. See [Zendesk Destination Properties](#zendesk-destination-properties) for more details.
+
+##### Generic Destination Properties
+
+EventBridge, Honeycode, and Marketo destination properties all support the following attributes:
+
+* `object` - (Required) Object specified in the flow destination.
+* `error_handling_config` - (Optional) Settings that determine how Amazon AppFlow handles an error when placing data in the destination. See [Error Handling Config](#error-handling-config) for more details.
+
+##### Custom Connector Destination Properties
+
+* `entity_name` - (Required) Entity specified in the custom connector as a destination in the flow.
+* `custom_properties` - (Optional) Custom properties that are specific to the connector when it's used as a destination in the flow. Maximum of 50 items.
+* `error_handling_config` - (Optional) Settings that determine how Amazon AppFlow handles an error when placing data in the custom connector as destination. See [Error Handling Config](#error-handling-config) for more details.
+* `id_field_names` - (Optional) Name of the field that Amazon AppFlow uses as an ID when performing a write operation such as update, delete, or upsert.
+* `write_operation_type` - (Optional) Type of write operation to be performed in the custom connector when it's used as destination. Valid values are `INSERT`, `UPSERT`, `UPDATE`, and `DELETE`.
+
+##### Customer Profiles Destination Properties
+
+* `domain_name` - (Required) Unique name of the Amazon Connect Customer Profiles domain.
+* `object_type_name` - (Optional) Object specified in the Amazon Connect Customer Profiles flow destination.
+
+##### Redshift Destination Properties
+
+* `intermediate_bucket_name` - (Required) Intermediate bucket that Amazon AppFlow uses when moving data into Amazon Redshift.
+* `object` - (Required) Object specified in the Amazon Redshift flow destination.
+* `bucket_prefix` - (Optional) Object key for the bucket in which Amazon AppFlow places the destination files.
+* `error_handling_config` - (Optional) Settings that determine how Amazon AppFlow handles an error when placing data in the destination. See [Error Handling Config](#error-handling-config) for more details.
+
+##### S3 Destination Properties
+
+* `bucket_name` - (Required) Amazon S3 bucket name in which Amazon AppFlow places the transferred data.
+* `bucket_prefix` - (Optional) Object key for the bucket in which Amazon AppFlow places the destination files.
+* `s3_output_format_config` - (Optional) Configuration that determines how Amazon AppFlow should format the flow output data when Amazon S3 is used as the destination. See [S3 Output Format Config](#s3-output-format-config) for more details.
+
+###### S3 Output Format Config
+
+* `aggregation_config` - (Optional) Aggregation settings that you can use to customize the output format of your flow data. See [Aggregation Config](#aggregation-config) for more details.
+* `file_type` - (Optional) File type that Amazon AppFlow places in the Amazon S3 bucket. Valid values are `CSV`, `JSON`, and `PARQUET`.
+* `prefix_config` - (Optional) Determines the prefix that Amazon AppFlow applies to the folder name in the Amazon S3 bucket. You can name folders according to the flow frequency and date. See [Prefix Config](#prefix-config) for more details.
+* `preserve_source_data_typing` - (Optional, Boolean) Whether the data types from the source system need to be preserved (Only valid for `Parquet` file type)
+
+##### Salesforce Destination Properties
+
+* `object` - (Required) Object specified in the flow destination.
+* `error_handling_config` - (Optional) Settings that determine how Amazon AppFlow handles an error when placing data in the destination. See [Error Handling Config](#error-handling-config) for more details.
+* `id_field_names` - (Optional) Name of the field that Amazon AppFlow uses as an ID when performing a write operation such as update or delete.
+* `write_operation_type` - (Optional) This specifies the type of write operation to be performed in Salesforce. When the value is `UPSERT`, then `id_field_names` is required. Valid values are `INSERT`, `UPSERT`, `UPDATE`, and `DELETE`.
+
+##### SAPOData Destination Properties
+
+* `object_path` - (Required) Object path specified in the SAPOData flow destination.
+* `error_handling_config` - (Optional) Settings that determine how Amazon AppFlow handles an error when placing data in the destination. See [Error Handling Config](#error-handling-config) for more details.
+* `id_field_names` - (Optional) Name of the field that Amazon AppFlow uses as an ID when performing a write operation such as update or delete.
+* `success_response_handling_config` - (Optional) Determines how Amazon AppFlow handles the success response that it gets from the connector after placing data. See [Success Response Handling Config](#success-response-handling-config) for more details.
+* `write_operation` - (Optional) Possible write operations in the destination connector. When this value is not provided, this defaults to the `INSERT` operation. Valid values are `INSERT`, `UPSERT`, `UPDATE`, and `DELETE`.
+
+###### Success Response Handling Config
+
+* `bucket_name` - (Optional) Name of the Amazon S3 bucket.
+* `bucket_prefix` - (Optional) Amazon S3 bucket prefix.
+
+##### Snowflake Destination Properties
+
+* `intermediate_bucket_name` - (Required) Intermediate bucket that Amazon AppFlow uses when moving data into Amazon Snowflake.
+* `object` - (Required) Object specified in the Amazon Snowflake flow destination.
+* `bucket_prefix` - (Optional) Object key for the bucket in which Amazon AppFlow places the destination files.
+* `error_handling_config` - (Optional) Settings that determine how Amazon AppFlow handles an error when placing data in the destination. See [Error Handling Config](#error-handling-config) for more details.
+
+##### Upsolver Destination Properties
+
+* `bucket_name` - (Required) Upsolver Amazon S3 bucket name in which Amazon AppFlow places the transferred data. This must begin with `upsolver-appflow`.
+* `bucket_prefix` - (Optional) Object key for the Upsolver Amazon S3 Bucket in which Amazon AppFlow places the destination files.
+* `s3_output_format_config` - (Optional) Configuration that determines how Amazon AppFlow should format the flow output data when Upsolver is used as the destination. See [Upsolver S3 Output Format Config](#upsolver-s3-output-format-config) for more details.
+
+###### Upsolver S3 Output Format Config
+
+* `aggregation_config` - (Optional) Aggregation settings that you can use to customize the output format of your flow data. See [Aggregation Config](#aggregation-config) for more details.
+* `file_type` - (Optional) File type that Amazon AppFlow places in the Upsolver Amazon S3 bucket. Valid values are `CSV`, `JSON`, and `PARQUET`.
+* `prefix_config` - (Optional) Determines the prefix that Amazon AppFlow applies to the folder name in the Amazon S3 bucket. You can name folders according to the flow frequency and date. See [Prefix Config](#prefix-config) for more details.
+
+###### Aggregation Config
+
+* `aggregation_type` - (Optional) Whether Amazon AppFlow aggregates the flow records into a single file, or leave them unaggregated. Valid values are `None` and `SingleFile`.
+
+###### Prefix Config
+
+* `prefix_format` - (Optional) Determines the level of granularity that's included in the prefix. Valid values are `YEAR`, `MONTH`, `DAY`, `HOUR`, and `MINUTE`.
+* `prefix_type` - (Optional) Determines the format of the prefix, and whether it applies to the file name, file path, or both. Valid values are `FILENAME`, `PATH`, and `PATH_AND_FILENAME`.
+
+##### Zendesk Destination Properties
+
+* `object` - (Required) Object specified in the flow destination.
+* `error_handling_config` - (Optional) Settings that determine how Amazon AppFlow handles an error when placing data in the destination. See [Error Handling Config](#error-handling-config) for more details.
+* `id_field_names` - (Optional) Name of the field that Amazon AppFlow uses as an ID when performing a write operation such as update or delete.
+* `write_operation_type` - (Optional) This specifies the type of write operation to be performed in Zendesk. When the value is `UPSERT`, then `id_field_names` is required. Valid values are `INSERT`, `UPSERT`, `UPDATE`, and `DELETE`.
+
+###### Error Handling Config
+
+* `bucket_name` - (Optional) Name of the Amazon S3 bucket.
+* `bucket_prefix` - (Optional) Amazon S3 bucket prefix.
+* `fail_on_first_destination_error` - (Optional, boolean) If the flow should fail after the first instance of a failure when attempting to place data in the destination.
+
+### Source Flow Config
+
+* `connector_type` - (Required) Type of connector, such as Salesforce, Amplitude, and so on. Valid values are `Salesforce`, `Singular`, `Slack`, `Redshift`, `S3`, `Marketo`, `Googleanalytics`, `Zendesk`, `Servicenow`, `Datadog`, `Trendmicro`, `Snowflake`, `Dynatrace`, `Infornexus`, `Amplitude`, `Veeva`, `EventBridge`, `LookoutMetrics`, `Upsolver`, `Honeycode`, `CustomerProfiles`, `SAPOData`, and `CustomConnector`.
+* `source_connector_properties` - (Required) Information that is required to query a particular source connector. See [Source Connector Properties](#source-connector-properties) for details.
+* `api_version` - (Optional) API version that the destination connector uses.
+* `connector_profile_name` - (Optional) Name of the connector profile. This name must be unique for each connector profile in the AWS account.
+* `incremental_pull_config` - (Optional) Defines the configuration for a scheduled incremental data pull. If a valid configuration is provided, the fields specified in the configuration are used when querying for the incremental data pull. See [Incremental Pull Config](#incremental-pull-config) for more details.
+
+#### Source Connector Properties
+
+* `amplitude` - (Optional) Information that is required for querying Amplitude. See [Generic Source Properties](#generic-source-properties) for more details.
+* `custom_connector` - (Optional) Properties that are applied when the custom connector is being used as a source. See [Custom Connector Source Properties](#custom-connector-source-properties).
+* `datadog` - (Optional) Information that is required for querying Datadog. See [Generic Source Properties](#generic-source-properties) for more details.
+* `dynratrace` - (Optional) Information that is required for querying Dynatrace. See [Generic Source Properties](#generic-source-properties) for more details.
+* `infor_nexus` - (Optional) Information that is required for querying Infor Nexus. See [Generic Source Properties](#generic-source-properties) for more details.
+* `marketo` - (Optional) Information that is required for querying Marketo. See [Generic Source Properties](#generic-source-properties) for more details.
+* `s3` - (Optional) Information that is required for querying Amazon S3. See [S3 Source Properties](#s3-source-properties) for more details.
+* `salesforce` - (Optional) Information that is required for querying Salesforce. See [Salesforce Source Properties](#s3-source-properties) for more details.
+* `sapo_data` - (Optional) Information that is required for querying SAPOData as a flow source. See [SAPO Source Properties](#sapodata-source-properties) for more details.
+* `service_now` - (Optional) Information that is required for querying ServiceNow. See [Generic Source Properties](#generic-source-properties) for more details.
+* `singular` - (Optional) Information that is required for querying Singular. See [Generic Source Properties](#generic-source-properties) for more details.
+* `slack` - (Optional) Information that is required for querying Slack. See [Generic Source Properties](#generic-source-properties) for more details.
+* `trend_micro` - (Optional) Information that is required for querying Trend Micro. See [Generic Source Properties](#generic-source-properties) for more details.
+* `veeva` - (Optional) Information that is required for querying Veeva. See [Veeva Source Properties](#veeva-source-properties) for more details.
+* `zendesk` - (Optional) Information that is required for querying Zendesk. See [Generic Source Properties](#generic-source-properties) for more details.
+
+##### Generic Source Properties
+
+Amplitude, Datadog, Dynatrace, Google Analytics, Infor Nexus, Marketo, ServiceNow, Singular, Slack, Trend Micro, and Zendesk source properties all support the following attributes:
+
+* `object` - (Required) Object specified in the flow source.
+
+##### Custom Connector Source Properties
+
+* `entity_name` - (Required) Entity specified in the custom connector as a source in the flow.
+* `custom_properties` - (Optional) Custom properties that are specific to the connector when it's used as a source in the flow. Maximum of 50 items.
+
+##### S3 Source Properties
+
+* `bucket_name` - (Required) Amazon S3 bucket name where the source files are stored.
+* `bucket_prefix` - (Optional) Object key for the Amazon S3 bucket in which the source files are stored.
+* `s3_input_format_config` - (Optional) When you use Amazon S3 as the source, the configuration format that you provide the flow input data. See [S3 Input Format Config](#s3-input-format-config) for details.
+
+###### S3 Input Format Config
+
+* `s3_input_file_type` - (Optional) File type that Amazon AppFlow gets from your Amazon S3 bucket. Valid values are `CSV` and `JSON`.
+
+##### Salesforce Source Properties
+
+* `object` - (Required) Object specified in the Salesforce flow source.
+* `enable_dynamic_field_update` - (Optional, boolean) Flag that enables dynamic fetching of new (recently added) fields in the Salesforce objects while running a flow.
+* `include_deleted_records` - (Optional, boolean) Whether Amazon AppFlow includes deleted files in the flow run.
+
+##### SAPOData Source Properties
+
+* `object_path` - (Required) Object path specified in the SAPOData flow source.
+
+##### Veeva Source Properties
+
+* `object` - (Required) Object specified in the Veeva flow source.
+* `document_type` - (Optional) Document type specified in the Veeva document extract flow.
+* `include_all_versions` - (Optional, boolean) Boolean value to include All Versions of files in Veeva document extract flow.
+* `include_renditions` - (Optional, boolean) Boolean value to include file renditions in Veeva document extract flow.
+* `include_source_files` - (Optional, boolean) Boolean value to include source files in Veeva document extract flow.
+
+#### Incremental Pull Config
+
+* `datetime_type_field_name` - (Optional) Field that specifies the date time or timestamp field as the criteria to use when importing incremental records from the source.
+
+### Task
+
+* `source_fields` - (Required) Source fields to which a particular task is applied.
+* `task_type` - (Required) Particular task implementation that Amazon AppFlow performs. Valid values are `Arithmetic`, `Filter`, `Map`, `Map_all`, `Mask`, `Merge`, `Passthrough`, `Truncate`, and `Validate`.
+* `connector_operator` - (Optional) Operation to be performed on the provided source fields. See [Connector Operator](#connector-operator) for details.
+* `destination_field` - (Optional) Field in a destination connector, or a field value against which Amazon AppFlow validates a source field.
+* `task_properties` - (Optional) Map used to store task-related information. The execution service looks for particular information based on the `TaskType`. Valid keys are `VALUE`, `VALUES`, `DATA_TYPE`, `UPPER_BOUND`, `LOWER_BOUND`, `SOURCE_DATA_TYPE`, `DESTINATION_DATA_TYPE`, `VALIDATION_ACTION`, `MASK_VALUE`, `MASK_LENGTH`, `TRUNCATE_LENGTH`, `MATH_OPERATION_FIELDS_ORDER`, `CONCAT_FORMAT`, `SUBFIELD_CATEGORY_MAP`, and `EXCLUDE_SOURCE_FIELDS_LIST`.
+
+#### Connector Operator
+
+* `amplitude` - (Optional) Operation to be performed on the provided Amplitude source fields. The only valid value is `BETWEEN`.
+* `custom_connector` - (Optional) Operators supported by the custom connector. Valid values are `PROJECTION`, `LESS_THAN`, `GREATER_THAN`, `CONTAINS`, `BETWEEN`, `LESS_THAN_OR_EQUAL_TO`, `GREATER_THAN_OR_EQUAL_TO`, `EQUAL_TO`, `NOT_EQUAL_TO`, `ADDITION`, `MULTIPLICATION`, `DIVISION`, `SUBTRACTION`, `MASK_ALL`, `MASK_FIRST_N`, `MASK_LAST_N`, `VALIDATE_NON_NULL`, `VALIDATE_NON_ZERO`, `VALIDATE_NON_NEGATIVE`, `VALIDATE_NUMERIC`, and `NO_OP`.
+* `datadog` - (Optional) Operation to be performed on the provided Datadog source fields. Valid values are `PROJECTION`, `BETWEEN`, `EQUAL_TO`, `ADDITION`, `MULTIPLICATION`, `DIVISION`, `SUBTRACTION`, `MASK_ALL`, `MASK_FIRST_N`, `MASK_LAST_N`, `VALIDATE_NON_NULL`, `VALIDATE_NON_ZERO`, `VALIDATE_NON_NEGATIVE`, `VALIDATE_NUMERIC`, and `NO_OP`.
+* `dynatrace` - (Optional) Operation to be performed on the provided Dynatrace source fields. Valid values are `PROJECTION`, `BETWEEN`, `EQUAL_TO`, `ADDITION`, `MULTIPLICATION`, `DIVISION`, `SUBTRACTION`, `MASK_ALL`, `MASK_FIRST_N`, `MASK_LAST_N`, `VALIDATE_NON_NULL`, `VALIDATE_NON_ZERO`, `VALIDATE_NON_NEGATIVE`, `VALIDATE_NUMERIC`, and `NO_OP`.
+* `google_analytics` - (Optional) Operation to be performed on the provided Google Analytics source fields. Valid values are `PROJECTION` and `BETWEEN`.
+* `infor_nexus` - (Optional) Operation to be performed on the provided Infor Nexus source fields. Valid values are `PROJECTION`, `BETWEEN`, `EQUAL_TO`, `ADDITION`, `MULTIPLICATION`, `DIVISION`, `SUBTRACTION`, `MASK_ALL`, `MASK_FIRST_N`, `MASK_LAST_N`, `VALIDATE_NON_NULL`, `VALIDATE_NON_ZERO`, `VALIDATE_NON_NEGATIVE`, `VALIDATE_NUMERIC`, and `NO_OP`.
+* `marketo` - (Optional) Operation to be performed on the provided Marketo source fields. Valid values are `PROJECTION`, `BETWEEN`, `EQUAL_TO`, `ADDITION`, `MULTIPLICATION`, `DIVISION`, `SUBTRACTION`, `MASK_ALL`, `MASK_FIRST_N`, `MASK_LAST_N`, `VALIDATE_NON_NULL`, `VALIDATE_NON_ZERO`, `VALIDATE_NON_NEGATIVE`, `VALIDATE_NUMERIC`, and `NO_OP`.
+* `s3` - (Optional) Operation to be performed on the provided Amazon S3 source fields. Valid values are `PROJECTION`, `LESS_THAN`, `GREATER_THAN`, `BETWEEN`, `LESS_THAN_OR_EQUAL_TO`, `GREATER_THAN_OR_EQUAL_TO`, `EQUAL_TO`, `NOT_EQUAL_TO`, `ADDITION`, `MULTIPLICATION`, `DIVISION`, `SUBTRACTION`, `MASK_ALL`, `MASK_FIRST_N`, `MASK_LAST_N`, `VALIDATE_NON_NULL`, `VALIDATE_NON_ZERO`, `VALIDATE_NON_NEGATIVE`, `VALIDATE_NUMERIC`, and `NO_OP`.
+* `salesforce` - (Optional) Operation to be performed on the provided Salesforce source fields. Valid values are `PROJECTION`, `LESS_THAN`, `GREATER_THAN`, `CONTAINS`, `BETWEEN`, `LESS_THAN_OR_EQUAL_TO`, `GREATER_THAN_OR_EQUAL_TO`, `EQUAL_TO`, `NOT_EQUAL_TO`, `ADDITION`, `MULTIPLICATION`, `DIVISION`, `SUBTRACTION`, `MASK_ALL`, `MASK_FIRST_N`, `MASK_LAST_N`, `VALIDATE_NON_NULL`, `VALIDATE_NON_ZERO`, `VALIDATE_NON_NEGATIVE`, `VALIDATE_NUMERIC`, and `NO_OP`.
+* `sapo_data` - (Optional) Operation to be performed on the provided SAPOData source fields. Valid values are `PROJECTION`, `LESS_THAN`, `GREATER_THAN`, `CONTAINS`, `BETWEEN`, `LESS_THAN_OR_EQUAL_TO`, `GREATER_THAN_OR_EQUAL_TO`, `EQUAL_TO`, `NOT_EQUAL_TO`, `ADDITION`, `MULTIPLICATION`, `DIVISION`, `SUBTRACTION`, `MASK_ALL`, `MASK_FIRST_N`, `MASK_LAST_N`, `VALIDATE_NON_NULL`, `VALIDATE_NON_ZERO`, `VALIDATE_NON_NEGATIVE`, `VALIDATE_NUMERIC`, and `NO_OP`.
+* `service_now` - (Optional) Operation to be performed on the provided ServiceNow source fields. Valid values are `PROJECTION`, `LESS_THAN`, `GREATER_THAN`, `CONTAINS`, `BETWEEN`, `LESS_THAN_OR_EQUAL_TO`, `GREATER_THAN_OR_EQUAL_TO`, `EQUAL_TO`, `NOT_EQUAL_TO`, `ADDITION`, `MULTIPLICATION`, `DIVISION`, `SUBTRACTION`, `MASK_ALL`, `MASK_FIRST_N`, `MASK_LAST_N`, `VALIDATE_NON_NULL`, `VALIDATE_NON_ZERO`, `VALIDATE_NON_NEGATIVE`, `VALIDATE_NUMERIC`, and `NO_OP`.
+* `singular` - (Optional) Operation to be performed on the provided Singular source fields. Valid values are `PROJECTION`, `EQUAL_TO`, `ADDITION`, `MULTIPLICATION`, `DIVISION`, `SUBTRACTION`, `MASK_ALL`, `MASK_FIRST_N`, `MASK_LAST_N`, `VALIDATE_NON_NULL`, `VALIDATE_NON_ZERO`, `VALIDATE_NON_NEGATIVE`, `VALIDATE_NUMERIC`, and `NO_OP`.
+* `slack` - (Optional) Operation to be performed on the provided Slack source fields. Valid values are `PROJECTION`, `LESS_THAN`, `GREATER_THAN`, `BETWEEN`, `LESS_THAN_OR_EQUAL_TO`, `GREATER_THAN_OR_EQUAL_TO`, `EQUAL_TO`, `ADDITION`, `MULTIPLICATION`, `DIVISION`, `SUBTRACTION`, `MASK_ALL`, `MASK_FIRST_N`, `MASK_LAST_N`, `VALIDATE_NON_NULL`, `VALIDATE_NON_ZERO`, `VALIDATE_NON_NEGATIVE`, `VALIDATE_NUMERIC`, and `NO_OP`.
+* `trendmicro` - (Optional) Operation to be performed on the provided Trend Micro source fields. Valid values are `PROJECTION`, `EQUAL_TO`, `ADDITION`, `MULTIPLICATION`, `DIVISION`, `SUBTRACTION`, `MASK_ALL`, `MASK_FIRST_N`, `MASK_LAST_N`, `VALIDATE_NON_NULL`, `VALIDATE_NON_ZERO`, `VALIDATE_NON_NEGATIVE`, `VALIDATE_NUMERIC`, and `NO_OP`.
+* `veeva` - (Optional) Operation to be performed on the provided Veeva source fields. Valid values are `PROJECTION`, `LESS_THAN`, `GREATER_THAN`, `CONTAINS`, `BETWEEN`, `LESS_THAN_OR_EQUAL_TO`, `GREATER_THAN_OR_EQUAL_TO`, `EQUAL_TO`, `NOT_EQUAL_TO`, `ADDITION`, `MULTIPLICATION`, `DIVISION`, `SUBTRACTION`, `MASK_ALL`, `MASK_FIRST_N`, `MASK_LAST_N`, `VALIDATE_NON_NULL`, `VALIDATE_NON_ZERO`, `VALIDATE_NON_NEGATIVE`, `VALIDATE_NUMERIC`, and `NO_OP`.
+* `zendesk` - (Optional) Operation to be performed on the provided Zendesk source fields. Valid values are `PROJECTION`, `GREATER_THAN`, `ADDITION`, `MULTIPLICATION`, `DIVISION`, `SUBTRACTION`, `MASK_ALL`, `MASK_FIRST_N`, `MASK_LAST_N`, `VALIDATE_NON_NULL`, `VALIDATE_NON_ZERO`, `VALIDATE_NON_NEGATIVE`, `VALIDATE_NUMERIC`, and `NO_OP`.
+
+### Trigger Config
+
+* `trigger_type` - (Required) Type of flow trigger. Valid values are `Scheduled`, `Event`, and `OnDemand`.
+* `trigger_properties` - (Optional) Configuration details of a schedule-triggered flow as defined by the user. Currently, these settings only apply to the `Scheduled` trigger type. See [Scheduled Trigger Properties](#scheduled-trigger-properties) for details.
+
+#### Scheduled Trigger Properties
+
+The `trigger_properties` block only supports one attribute: `scheduled`, a block which in turn supports the following:
+
+* `schedule_expression` - (Required) Scheduling expression that determines the rate at which the schedule will run, for example `rate(5minutes)`.
+* `data_pull_mode` - (Optional) Whether a scheduled flow has an incremental data transfer or a complete data transfer for each flow run. Valid values are `Incremental` and `Complete`.
+* `first_execution_from` - (Optional) Date range for the records to import from the connector in the first flow run. Must be a valid RFC3339 timestamp.
+* `schedule_end_time` - (Optional) Scheduled end time for a schedule-triggered flow. Must be a valid RFC3339 timestamp.
+* `schedule_offset` - (Optional) Optional offset that is added to the time interval for a schedule-triggered flow. Maximum value of 36000.
+* `schedule_start_time` - (Optional) Scheduled start time for a schedule-triggered flow. Must be a valid RFC3339 timestamp.
+* `timezone` - (Optional) Time zone used when referring to the date and time of a scheduled-triggered flow, such as `America/New_York`.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.appflow_flow import AppflowFlow
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, triggerType, destinationFlowConfig, name, sourceFlowConfig, task):
+        super().__init__(scope, name)
+        AppflowFlow(self, "example",
+            trigger_config=AppflowFlowTriggerConfig(
+                scheduled=[{
+                    "schedule_expression": "rate(1minutes)"
+                }
+                ],
+                trigger_type=trigger_type
+            ),
+            destination_flow_config=destination_flow_config,
+            name=name,
+            source_flow_config=source_flow_config,
+            task=task
+        )
+```
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Flow's ARN.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AppFlow flows using the `arn`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import AppFlow flows using the `arn`. For example:
+
+```console
+% terraform import aws_appflow_flow.example arn:aws:appflow:us-west-2:123456789012:flow/example-flow
+```
+
+<!-- cache-key: cdktf-0.18.0 input-17e1cfe9c9c0df000acad27d00f90bbaa486384b6d2aa3d057f258c6051b900d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/appintegrations_data_integration.html.markdown b/website/docs/cdktf/python/r/appintegrations_data_integration.html.markdown
new file mode 100644
index 00000000000..191b11dbf54
--- /dev/null
+++ b/website/docs/cdktf/python/r/appintegrations_data_integration.html.markdown
@@ -0,0 +1,89 @@
+---
+subcategory: "AppIntegrations"
+layout: "aws"
+page_title: "AWS: aws_appintegrations_data_integration"
+description: |-
+  Provides details about a specific Amazon AppIntegrations Data Integration
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_appintegrations_data_integration
+
+Provides an Amazon AppIntegrations Data Integration resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.appintegrations_data_integration import AppintegrationsDataIntegration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AppintegrationsDataIntegration(self, "example",
+            description="example",
+            kms_key=test.arn,
+            name="example",
+            schedule_config=AppintegrationsDataIntegrationScheduleConfig(
+                first_execution_from="1439788442681",
+                object="Account",
+                schedule_expression="rate(1 hour)"
+            ),
+            source_uri="Salesforce://AppFlow/example",
+            tags={
+                "Key1": "Value1"
+            }
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `description` - (Optional) Specifies the description of the Data Integration.
+* `kms_key` - (Required) Specifies the KMS key Amazon Resource Name (ARN) for the Data Integration.
+* `name` - (Required) Specifies the name of the Data Integration.
+* `schedule_config` - (Required) A block that defines the name of the data and how often it should be pulled from the source. The Schedule Config block is documented below.
+* `source_uri` - (Required) Specifies the URI of the data source. Create an [AppFlow Connector Profile](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/appflow_connector_profile) and reference the name of the profile in the URL. An example of this value for Salesforce is `Salesforce://AppFlow/example` where `example` is the name of the AppFlow Connector Profile.
+* `tags` - (Optional) Tags to apply to the Data Integration. If configured with a provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+A `schedule_config` block supports the following arguments:
+
+* `first_execution_from` - (Required) The start date for objects to import in the first flow run as an Unix/epoch timestamp in milliseconds or in ISO-8601 format. This needs to be a time in the past, meaning that the data created or updated before this given date will not be downloaded.
+* `object` - (Required) The name of the object to pull from the data source. Examples of objects in Salesforce include `Case`, `Account`, or `Lead`.
+* `schedule_expression` - (Required) How often the data should be pulled from data source. Examples include `rate(1 hour)`, `rate(3 hours)`, `rate(1 day)`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the Data Integration.
+* `id` - The identifier of the Data Integration.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Amazon AppIntegrations Data Integrations using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Amazon AppIntegrations Data Integrations using the `id`. For example:
+
+```console
+% terraform import aws_appintegrations_data_integration.example 12345678-1234-1234-1234-123456789123
+```
+
+<!-- cache-key: cdktf-0.18.0 input-c453729b63eb0dcd3c4b7bbf7e0c63bfc3f55c4cc0725680004f1efcf202b819 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/appintegrations_event_integration.html.markdown b/website/docs/cdktf/python/r/appintegrations_event_integration.html.markdown
new file mode 100644
index 00000000000..26a67ab9d88
--- /dev/null
+++ b/website/docs/cdktf/python/r/appintegrations_event_integration.html.markdown
@@ -0,0 +1,83 @@
+---
+subcategory: "AppIntegrations"
+layout: "aws"
+page_title: "AWS: aws_appintegrations_event_integration"
+description: |-
+  Provides details about a specific Amazon AppIntegrations Event Integration
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_appintegrations_event_integration
+
+Provides an Amazon AppIntegrations Event Integration resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.appintegrations_event_integration import AppintegrationsEventIntegration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AppintegrationsEventIntegration(self, "example",
+            description="Example Description",
+            event_filter=AppintegrationsEventIntegrationEventFilter(
+                source="aws.partner/examplepartner.com"
+            ),
+            eventbridge_bus="default",
+            name="example-name",
+            tags={
+                "Name": "Example Event Integration"
+            }
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `description` - (Optional) Description of the Event Integration.
+* `eventbridge_bus` - (Required) EventBridge bus.
+* `event_filter` - (Required) Block that defines the configuration information for the event filter. The Event Filter block is documented below.
+* `name` - (Required) Name of the Event Integration.
+* `tags` - (Optional) Tags to apply to the Event Integration. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+A `event_filter` block supports the following arguments:
+
+* `source` - (Required) Source of the events.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Event Integration.
+* `id` - Identifier of the Event Integration which is the name of the Event Integration.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Amazon AppIntegrations Event Integrations using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Amazon AppIntegrations Event Integrations using the `name`. For example:
+
+```console
+% terraform import aws_appintegrations_event_integration.example example-name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-8b79c762f6b5fb4efdf9be46519afb95e300098781375353c9e9d4ad128687a6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/applicationinsights_application.html.markdown b/website/docs/cdktf/python/r/applicationinsights_application.html.markdown
new file mode 100644
index 00000000000..696f35bda45
--- /dev/null
+++ b/website/docs/cdktf/python/r/applicationinsights_application.html.markdown
@@ -0,0 +1,95 @@
+---
+subcategory: "CloudWatch Application Insights"
+layout: "aws"
+page_title: "AWS: aws_applicationinsights_application"
+description: |-
+  Provides a CloudWatch Application Insights Application resource
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_applicationinsights_application
+
+Provides a ApplicationInsights Application resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.applicationinsights_application import ApplicationinsightsApplication
+from imports.aws.resourcegroups_group import ResourcegroupsGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = ResourcegroupsGroup(self, "example",
+            name="example",
+            resource_query=ResourcegroupsGroupResourceQuery(
+                query=Token.as_string(
+                    Fn.jsonencode({
+                        "ResourceTypeFilters": ["AWS::EC2::Instance"],
+                        "TagFilters": [{
+                            "Key": "Stage",
+                            "Values": ["Test"]
+                        }
+                        ]
+                    }))
+            )
+        )
+        aws_applicationinsights_application_example =
+        ApplicationinsightsApplication(self, "example_1",
+            resource_group_name=example.name
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_applicationinsights_application_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `resource_group_name` - (Required) Name of the resource group.
+
+The following arguments are optional:
+
+* `auto_config_enabled` - (Optional)  Indicates whether Application Insights automatically configures unmonitored resources in the resource group.
+* `auto_create` - (Optional) Configures all of the resources in the resource group by applying the recommended configurations.
+* `cwe_monitor_enabled` - (Optional)  Indicates whether Application Insights can listen to CloudWatch events for the application resources, such as instance terminated, failed deployment, and others.
+* `grouping_type` - (Optional) Application Insights can create applications based on a resource group or on an account. To create an account-based application using all of the resources in the account, set this parameter to `ACCOUNT_BASED`.
+* `ops_center_enabled` - (Optional) When set to `true`, creates opsItems for any problems detected on an application.
+* `ops_item_sns_topic_arn` - (Optional) SNS topic provided to Application Insights that is associated to the created opsItem. Allows you to receive notifications for updates to the opsItem.
+* `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Application.
+* `id` - Name of the resource group.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import ApplicationInsights Applications using the `resource_group_name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import ApplicationInsights Applications using the `resource_group_name`. For example:
+
+```console
+% terraform import aws_applicationinsights_application.some some-application
+```
+
+<!-- cache-key: cdktf-0.18.0 input-30b40f9adb8f133c3e275766d86e95f547219ce5038fa7751ad75a6d3c0db957 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/appmesh_gateway_route.html.markdown b/website/docs/cdktf/python/r/appmesh_gateway_route.html.markdown
new file mode 100644
index 00000000000..1d806ebfc4b
--- /dev/null
+++ b/website/docs/cdktf/python/r/appmesh_gateway_route.html.markdown
@@ -0,0 +1,197 @@
+---
+subcategory: "App Mesh"
+layout: "aws"
+page_title: "AWS: aws_appmesh_gateway_route"
+description: |-
+  Provides an AWS App Mesh gateway route resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_appmesh_gateway_route
+
+Provides an AWS App Mesh gateway route resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.appmesh_gateway_route import AppmeshGatewayRoute
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AppmeshGatewayRoute(self, "example",
+            mesh_name="example-service-mesh",
+            name="example-gateway-route",
+            spec=AppmeshGatewayRouteSpec(
+                http_route=AppmeshGatewayRouteSpecHttpRoute(
+                    action=AppmeshGatewayRouteSpecHttpRouteAction(
+                        target=AppmeshGatewayRouteSpecHttpRouteActionTarget(
+                            virtual_service=AppmeshGatewayRouteSpecHttpRouteActionTargetVirtualService(
+                                virtual_service_name=Token.as_string(aws_appmesh_virtual_service_example.name)
+                            )
+                        )
+                    ),
+                    match=AppmeshGatewayRouteSpecHttpRouteMatch(
+                        prefix="/"
+                    )
+                )
+            ),
+            tags={
+                "Environment": "test"
+            },
+            virtual_gateway_name=Token.as_string(aws_appmesh_virtual_gateway_example.name)
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) Name to use for the gateway route. Must be between 1 and 255 characters in length.
+* `mesh_name` - (Required) Name of the service mesh in which to create the gateway route. Must be between 1 and 255 characters in length.
+* `virtual_gateway_name` - (Required) Name of the [virtual gateway](/docs/providers/aws/r/appmesh_virtual_gateway.html) to associate the gateway route with. Must be between 1 and 255 characters in length.
+* `mesh_owner` - (Optional) AWS account ID of the service mesh's owner. Defaults to the account ID the [AWS provider][1] is currently connected to.
+* `spec` - (Required) Gateway route specification to apply.
+* `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+The `spec` object supports the following:
+
+* `grpc_route` - (Optional) Specification of a gRPC gateway route.
+* `http_route` - (Optional) Specification of an HTTP gateway route.
+* `http2_route` - (Optional) Specification of an HTTP/2 gateway route.
+* `priority` - (Optional) Priority for the gateway route, between `0` and `1000`.
+
+The `grpc_route`, `http_route` and `http2_route` objects supports the following:
+
+* `action` - (Required) Action to take if a match is determined.
+* `match` - (Required) Criteria for determining a request match.
+
+The `grpc_route`, `http_route` and `http2_route`'s `action` object supports the following:
+
+* `target` - (Required) Target that traffic is routed to when a request matches the gateway route.
+
+The `target` object supports the following:
+
+* `port` - (Optional) The port number that corresponds to the target for Virtual Service provider port. This is required when the provider (router or node) of the Virtual Service has multiple listeners.
+* `virtual_service` - (Required) Virtual service gateway route target.
+
+The `virtual_service` object supports the following:
+
+* `virtual_service_name` - (Required) Name of the virtual service that traffic is routed to. Must be between 1 and 255 characters in length.
+
+The `http_route` and `http2_route`'s `action` object additionally supports the following:
+
+* `rewrite` - (Optional) Gateway route action to rewrite.
+
+The `rewrite` object supports the following:
+
+* `hostname` - (Optional) Host name to rewrite.
+* `path` - (Optional) Exact path to rewrite.
+* `prefix` - (Optional) Specified beginning characters to rewrite.
+
+The `hostname` object supports the following:
+
+* `default_target_hostname` - (Required) Default target host name to write to. Valid values: `ENABLED`, `DISABLED`.
+
+The `path` object supports the following:
+
+* `exact` - (Required) Value used to replace matched path.
+
+The `prefix` object supports the following:
+
+* `default_prefix` - (Optional) Default prefix used to replace the incoming route prefix when rewritten. Valid values: `ENABLED`, `DISABLED`.
+* `value` - (Optional) Value used to replace the incoming route prefix when rewritten.
+
+The `grpc_route`'s `match` object supports the following:
+
+* `service_name` - (Required) Fully qualified domain name for the service to match from the request.
+* `port` - (Optional) The port number to match from the request.
+
+The `http_route` and `http2_route`'s `match` object supports the following:
+
+* `header` - (Optional) Client request headers to match on.
+* `hostname` - (Optional) Host name to match on.
+* `path` - (Optional) Client request path to match on.
+* `port` - (Optional) The port number to match from the request.
+* `prefix` - (Optional) Path to match requests with. This parameter must always start with `/`, which by itself matches all requests to the virtual service name.
+* `query_parameter` - (Optional) Client request query parameters to match on.
+
+The `header` object supports the following:
+
+* `name` - (Required) Name for the HTTP header in the client request that will be matched on.
+* `invert` - (Optional) If `true`, the match is on the opposite of the `match` method and value. Default is `false`.
+* `match` - (Optional) Method and value to match the header value sent with a request. Specify one match method.
+
+The `header`'s `match` object supports the following:
+
+* `exact` - (Optional) Header value sent by the client must match the specified value exactly.
+* `prefix` - (Optional) Header value sent by the client must begin with the specified characters.
+* `port`- (Optional) The port number to match from the request.
+* `range`- (Optional) Object that specifies the range of numbers that the header value sent by the client must be included in.
+* `regex` - (Optional) Header value sent by the client must include the specified characters.
+* `suffix` - (Optional) Header value sent by the client must end with the specified characters.
+
+The `range` object supports the following:
+
+* `end` - (Required) End of the range.
+* `start` - (Requited) Start of the range.
+
+The `hostname` object supports the following:
+
+* `exact` - (Optional) Exact host name to match on.
+* `suffix` - (Optional) Specified ending characters of the host name to match on.
+
+The `path` object supports the following:
+
+* `exact` - (Optional) The exact path to match on.
+* `regex` - (Optional) The regex used to match the path.
+
+The `query_parameter` object supports the following:
+
+* `name` - (Required) Name for the query parameter that will be matched on.
+* `match` - (Optional) The query parameter to match on.
+
+The `query_parameter`'s `match` object supports the following:
+
+* `exact` - (Optional) The exact query parameter to match on.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the gateway route.
+* `arn` - ARN of the gateway route.
+* `created_date` - Creation date of the gateway route.
+* `last_updated_date` - Last update date of the gateway route.
+* `resource_owner` - Resource owner's AWS account ID.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import App Mesh gateway routes using `mesh_name` and `virtual_gateway_name` together with the gateway route's `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import App Mesh gateway routes using `mesh_name` and `virtual_gateway_name` together with the gateway route's `name`. For example:
+
+```console
+% terraform import aws_appmesh_gateway_route.example mesh/gw1/example-gateway-route
+```
+
+[1]: /docs/providers/aws/index.html
+
+<!-- cache-key: cdktf-0.18.0 input-c4b969b72d8a7fa97ad9813ee47129d1f3ecfc1dcc5979566a12522b5042594d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/appmesh_mesh.html.markdown b/website/docs/cdktf/python/r/appmesh_mesh.html.markdown
new file mode 100644
index 00000000000..f9f5931a287
--- /dev/null
+++ b/website/docs/cdktf/python/r/appmesh_mesh.html.markdown
@@ -0,0 +1,108 @@
+---
+subcategory: "App Mesh"
+layout: "aws"
+page_title: "AWS: aws_appmesh_mesh"
+description: |-
+  Provides an AWS App Mesh service mesh resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_appmesh_mesh
+
+Provides an AWS App Mesh service mesh resource.
+
+## Example Usage
+
+### Basic
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.appmesh_mesh import AppmeshMesh
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AppmeshMesh(self, "simple",
+            name="simpleapp"
+        )
+```
+
+### Egress Filter
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.appmesh_mesh import AppmeshMesh
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AppmeshMesh(self, "simple",
+            name="simpleapp",
+            spec=AppmeshMeshSpec(
+                egress_filter=AppmeshMeshSpecEgressFilter(
+                    type="ALLOW_ALL"
+                )
+            )
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) Name to use for the service mesh. Must be between 1 and 255 characters in length.
+* `spec` - (Optional) Service mesh specification to apply.
+* `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+The `spec` object supports the following:
+
+* `egress_filter`- (Optional) Egress filter rules for the service mesh.
+
+The `egress_filter` object supports the following:
+
+* `type` - (Optional) Egress filter type. By default, the type is `DROP_ALL`.
+Valid values are `ALLOW_ALL` and `DROP_ALL`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the service mesh.
+* `arn` - ARN of the service mesh.
+* `created_date` - Creation date of the service mesh.
+* `last_updated_date` - Last update date of the service mesh.
+* `mesh_owner` - AWS account ID of the service mesh's owner.
+* `resource_owner` - Resource owner's AWS account ID.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import App Mesh service meshes using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import App Mesh service meshes using the `name`. For example:
+
+```console
+% terraform import aws_appmesh_mesh.simple simpleapp
+```
+
+<!-- cache-key: cdktf-0.18.0 input-3173e5025bf46613bb3d81fd897c112506cd0123d7fe3d3c9ffea66ee2187a85 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/appmesh_route.html.markdown b/website/docs/cdktf/python/r/appmesh_route.html.markdown
new file mode 100644
index 00000000000..cac25301d7f
--- /dev/null
+++ b/website/docs/cdktf/python/r/appmesh_route.html.markdown
@@ -0,0 +1,377 @@
+---
+subcategory: "App Mesh"
+layout: "aws"
+page_title: "AWS: aws_appmesh_route"
+description: |-
+  Provides an AWS App Mesh route resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_appmesh_route
+
+Provides an AWS App Mesh route resource.
+
+## Example Usage
+
+### HTTP Routing
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.appmesh_route import AppmeshRoute
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AppmeshRoute(self, "serviceb",
+            mesh_name=simple.id,
+            name="serviceB-route",
+            spec=AppmeshRouteSpec(
+                http_route=AppmeshRouteSpecHttpRoute(
+                    action=AppmeshRouteSpecHttpRouteAction(
+                        weighted_target=[AppmeshRouteSpecHttpRouteActionWeightedTarget(
+                            virtual_node=serviceb1.name,
+                            weight=90
+                        ), AppmeshRouteSpecHttpRouteActionWeightedTarget(
+                            virtual_node=serviceb2.name,
+                            weight=10
+                        )
+                        ]
+                    ),
+                    match=AppmeshRouteSpecHttpRouteMatch(
+                        prefix="/"
+                    )
+                )
+            ),
+            virtual_router_name=Token.as_string(aws_appmesh_virtual_router_serviceb.name)
+        )
+```
+
+### HTTP Header Routing
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.appmesh_route import AppmeshRoute
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AppmeshRoute(self, "serviceb",
+            mesh_name=simple.id,
+            name="serviceB-route",
+            spec=AppmeshRouteSpec(
+                http_route=AppmeshRouteSpecHttpRoute(
+                    action=AppmeshRouteSpecHttpRouteAction(
+                        weighted_target=[AppmeshRouteSpecHttpRouteActionWeightedTarget(
+                            virtual_node=Token.as_string(aws_appmesh_virtual_node_serviceb.name),
+                            weight=100
+                        )
+                        ]
+                    ),
+                    match=AppmeshRouteSpecHttpRouteMatch(
+                        header=[AppmeshRouteSpecHttpRouteMatchHeader(
+                            match=AppmeshRouteSpecHttpRouteMatchHeaderMatch(
+                                prefix="123"
+                            ),
+                            name="clientRequestId"
+                        )
+                        ],
+                        method="POST",
+                        prefix="/",
+                        scheme="https"
+                    )
+                )
+            ),
+            virtual_router_name=Token.as_string(aws_appmesh_virtual_router_serviceb.name)
+        )
+```
+
+### Retry Policy
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.appmesh_route import AppmeshRoute
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AppmeshRoute(self, "serviceb",
+            mesh_name=simple.id,
+            name="serviceB-route",
+            spec=AppmeshRouteSpec(
+                http_route=AppmeshRouteSpecHttpRoute(
+                    action=AppmeshRouteSpecHttpRouteAction(
+                        weighted_target=[AppmeshRouteSpecHttpRouteActionWeightedTarget(
+                            virtual_node=Token.as_string(aws_appmesh_virtual_node_serviceb.name),
+                            weight=100
+                        )
+                        ]
+                    ),
+                    match=AppmeshRouteSpecHttpRouteMatch(
+                        prefix="/"
+                    ),
+                    retry_policy=AppmeshRouteSpecHttpRouteRetryPolicy(
+                        http_retry_events=["server-error"],
+                        max_retries=1,
+                        per_retry_timeout=AppmeshRouteSpecHttpRouteRetryPolicyPerRetryTimeout(
+                            unit="s",
+                            value=15
+                        )
+                    )
+                )
+            ),
+            virtual_router_name=Token.as_string(aws_appmesh_virtual_router_serviceb.name)
+        )
+```
+
+### TCP Routing
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.appmesh_route import AppmeshRoute
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AppmeshRoute(self, "serviceb",
+            mesh_name=simple.id,
+            name="serviceB-route",
+            spec=AppmeshRouteSpec(
+                tcp_route=AppmeshRouteSpecTcpRoute(
+                    action=AppmeshRouteSpecTcpRouteAction(
+                        weighted_target=[AppmeshRouteSpecTcpRouteActionWeightedTarget(
+                            virtual_node=serviceb1.name,
+                            weight=100
+                        )
+                        ]
+                    )
+                )
+            ),
+            virtual_router_name=Token.as_string(aws_appmesh_virtual_router_serviceb.name)
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) Name to use for the route. Must be between 1 and 255 characters in length.
+* `mesh_name` - (Required) Name of the service mesh in which to create the route. Must be between 1 and 255 characters in length.
+* `mesh_owner` - (Optional) AWS account ID of the service mesh's owner. Defaults to the account ID the [AWS provider][1] is currently connected to.
+* `virtual_router_name` - (Required) Name of the virtual router in which to create the route. Must be between 1 and 255 characters in length.
+* `spec` - (Required) Route specification to apply.
+* `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+The `spec` object supports the following:
+
+* `grpc_route` - (Optional) GRPC routing information for the route.
+* `http2_route` - (Optional) HTTP/2 routing information for the route.
+* `http_route` - (Optional) HTTP routing information for the route.
+* `priority` - (Optional) Priority for the route, between `0` and `1000`.
+Routes are matched based on the specified value, where `0` is the highest priority.
+* `tcp_route` - (Optional) TCP routing information for the route.
+
+The `grpc_route` object supports the following:
+
+* `action` - (Required) Action to take if a match is determined.
+* `match` - (Required) Criteria for determining an gRPC request match.
+* `retry_policy` - (Optional) Retry policy.
+* `timeout` - (Optional) Types of timeouts.
+
+The `http2_route` and `http_route` objects supports the following:
+
+* `action` - (Required) Action to take if a match is determined.
+* `match` - (Required) Criteria for determining an HTTP request match.
+* `retry_policy` - (Optional) Retry policy.
+* `timeout` - (Optional) Types of timeouts.
+
+The `tcp_route` object supports the following:
+
+* `action` - (Required) Action to take if a match is determined.
+* `timeout` - (Optional) Types of timeouts.
+
+The `action` object supports the following:
+
+* `weighted_target` - (Required) Targets that traffic is routed to when a request matches the route.
+You can specify one or more targets and their relative weights with which to distribute traffic.
+
+The `timeout` object supports the following:
+
+* `idle` - (Optional) Idle timeout. An idle timeout bounds the amount of time that a connection may be idle.
+
+The `idle` object supports the following:
+
+* `unit` - (Required) Unit of time. Valid values: `ms`, `s`.
+* `value` - (Required) Number of time units. Minimum value of `0`.
+
+The `grpc_route`'s `match` object supports the following:
+
+* `metadata` - (Optional) Data to match from the gRPC request.
+* `method_name` - (Optional) Method name to match from the request. If you specify a name, you must also specify a `service_name`.
+* `service_name` - (Optional) Fully qualified domain name for the service to match from the request.
+* `port`- (Optional) The port number to match from the request.
+
+The `metadata` object supports the following:
+
+* `name` - (Required) Name of the route. Must be between 1 and 50 characters in length.
+* `invert` - (Optional) If `true`, the match is on the opposite of the `match` criteria. Default is `false`.
+* `match` - (Optional) Data to match from the request.
+
+The `metadata`'s `match` object supports the following:
+
+* `exact` - (Optional) Value sent by the client must match the specified value exactly. Must be between 1 and 255 characters in length.
+* `prefix` - (Optional) Value sent by the client must begin with the specified characters. Must be between 1 and 255 characters in length.
+* `port`- (Optional) The port number to match from the request.
+* `range`- (Optional) Object that specifies the range of numbers that the value sent by the client must be included in.
+* `regex` - (Optional) Value sent by the client must include the specified characters. Must be between 1 and 255 characters in length.
+* `suffix` - (Optional) Value sent by the client must end with the specified characters. Must be between 1 and 255 characters in length.
+
+The `grpc_route`'s `retry_policy` object supports the following:
+
+* `grpc_retry_events` - (Optional) List of gRPC retry events.
+Valid values: `cancelled`, `deadline-exceeded`, `internal`, `resource-exhausted`, `unavailable`.
+* `http_retry_events` - (Optional) List of HTTP retry events.
+Valid values: `client-error` (HTTP status code 409), `gateway-error` (HTTP status codes 502, 503, and 504), `server-error` (HTTP status codes 500, 501, 502, 503, 504, 505, 506, 507, 508, 510, and 511), `stream-error` (retry on refused stream).
+* `max_retries` - (Required) Maximum number of retries.
+* `per_retry_timeout` - (Required) Per-retry timeout.
+* `tcp_retry_events` - (Optional) List of TCP retry events. The only valid value is `connection-error`.
+
+The `grpc_route`'s `timeout` object supports the following:
+
+* `idle` - (Optional) Idle timeout. An idle timeout bounds the amount of time that a connection may be idle.
+* `per_request` - (Optional) Per request timeout.
+
+The `idle` and `per_request` objects support the following:
+
+* `unit` - (Required) Unit of time. Valid values: `ms`, `s`.
+* `value` - (Required) Number of time units. Minimum value of `0`.
+
+The `http2_route` and `http_route`'s `match` object supports the following:
+
+* `prefix` - (Optional) Path with which to match requests.
+This parameter must always start with /, which by itself matches all requests to the virtual router service name.
+* `port`- (Optional) The port number to match from the request.
+* `header` - (Optional) Client request headers to match on.
+* `method` - (Optional) Client request header method to match on. Valid values: `GET`, `HEAD`, `POST`, `PUT`, `DELETE`, `CONNECT`, `OPTIONS`, `TRACE`, `PATCH`.
+* `path` - (Optional) Client request path to match on.
+* `query_parameter` - (Optional) Client request query parameters to match on.
+* `scheme` - (Optional) Client request header scheme to match on. Valid values: `http`, `https`.
+
+The `match`'s `path` object supports the following:
+
+* `exact` - (Optional) The exact path to match on.
+* `regex` - (Optional) The regex used to match the path.
+
+The `match`'s `query_parameter` object supports the following:
+
+* `name` - (Required) Name for the query parameter that will be matched on.
+* `match` - (Optional) The query parameter to match on.
+
+The `query_parameter`'s `match` object supports the following:
+
+* `exact` - (Optional) The exact query parameter to match on.
+
+The `http2_route` and `http_route`'s `retry_policy` object supports the following:
+
+* `http_retry_events` - (Optional) List of HTTP retry events.
+Valid values: `client-error` (HTTP status code 409), `gateway-error` (HTTP status codes 502, 503, and 504), `server-error` (HTTP status codes 500, 501, 502, 503, 504, 505, 506, 507, 508, 510, and 511), `stream-error` (retry on refused stream).
+* `max_retries` - (Required) Maximum number of retries.
+* `per_retry_timeout` - (Required) Per-retry timeout.
+* `tcp_retry_events` - (Optional) List of TCP retry events. The only valid value is `connection-error`.
+
+You must specify at least one value for `http_retry_events`, or at least one value for `tcp_retry_events`.
+
+The `http2_route` and `http_route`'s `timeout` object supports the following:
+
+* `idle` - (Optional) Idle timeout. An idle timeout bounds the amount of time that a connection may be idle.
+* `per_request` - (Optional) Per request timeout.
+
+The `idle` and `per_request` objects support the following:
+
+* `unit` - (Required) Unit of time. Valid values: `ms`, `s`.
+* `value` - (Required) Number of time units. Minimum value of `0`.
+
+The `per_retry_timeout` object supports the following:
+
+* `unit` - (Required) Retry unit. Valid values: `ms`, `s`.
+* `value` - (Required) Retry value.
+
+The `weighted_target` object supports the following:
+
+* `virtual_node` - (Required) Virtual node to associate with the weighted target. Must be between 1 and 255 characters in length.
+* `weight` - (Required) Relative weight of the weighted target. An integer between 0 and 100.
+* `port` - (Optional) The targeted port of the weighted object.
+
+The `header` object supports the following:
+
+* `name` - (Required) Name for the HTTP header in the client request that will be matched on.
+* `invert` - (Optional) If `true`, the match is on the opposite of the `match` method and value. Default is `false`.
+* `match` - (Optional) Method and value to match the header value sent with a request. Specify one match method.
+
+The `header`'s `match` object supports the following:
+
+* `exact` - (Optional) Header value sent by the client must match the specified value exactly.
+* `prefix` - (Optional) Header value sent by the client must begin with the specified characters.
+* `port`- (Optional) The port number to match from the request.
+* `range`- (Optional) Object that specifies the range of numbers that the header value sent by the client must be included in.
+* `regex` - (Optional) Header value sent by the client must include the specified characters.
+* `suffix` - (Optional) Header value sent by the client must end with the specified characters.
+
+The `range` object supports the following:
+
+* `end` - (Required) End of the range.
+* `start` - (Requited) Start of the range.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the route.
+* `arn` - ARN of the route.
+* `created_date` - Creation date of the route.
+* `last_updated_date` - Last update date of the route.
+* `resource_owner` - Resource owner's AWS account ID.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import App Mesh virtual routes using `mesh_name` and `virtual_router_name` together with the route's `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import App Mesh virtual routes using `mesh_name` and `virtual_router_name` together with the route's `name`. For example:
+
+```console
+% terraform import aws_appmesh_route.serviceb simpleapp/serviceB/serviceB-route
+```
+
+[1]: /docs/providers/aws/index.html
+
+<!-- cache-key: cdktf-0.18.0 input-80e17b52a5e66a8d0e459a22b8228d6395a8847cf0270d3e66fc0d8a47b1bb28 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/appmesh_virtual_gateway.html.markdown b/website/docs/cdktf/python/r/appmesh_virtual_gateway.html.markdown
new file mode 100644
index 00000000000..b2518136d2f
--- /dev/null
+++ b/website/docs/cdktf/python/r/appmesh_virtual_gateway.html.markdown
@@ -0,0 +1,316 @@
+---
+subcategory: "App Mesh"
+layout: "aws"
+page_title: "AWS: aws_appmesh_virtual_gateway"
+description: |-
+  Provides an AWS App Mesh virtual gateway resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_appmesh_virtual_gateway
+
+Provides an AWS App Mesh virtual gateway resource.
+
+## Example Usage
+
+### Basic
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.appmesh_virtual_gateway import AppmeshVirtualGateway
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AppmeshVirtualGateway(self, "example",
+            mesh_name="example-service-mesh",
+            name="example-virtual-gateway",
+            spec=AppmeshVirtualGatewaySpec(
+                listener=[AppmeshVirtualGatewaySpecListener(
+                    port_mapping=AppmeshVirtualGatewaySpecListenerPortMapping(
+                        port=8080,
+                        protocol="http"
+                    )
+                )
+                ]
+            ),
+            tags={
+                "Environment": "test"
+            }
+        )
+```
+
+### Access Logs and TLS
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.appmesh_virtual_gateway import AppmeshVirtualGateway
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AppmeshVirtualGateway(self, "example",
+            mesh_name="example-service-mesh",
+            name="example-virtual-gateway",
+            spec=AppmeshVirtualGatewaySpec(
+                listener=[AppmeshVirtualGatewaySpecListener(
+                    port_mapping=AppmeshVirtualGatewaySpecListenerPortMapping(
+                        port=8080,
+                        protocol="http"
+                    ),
+                    tls=AppmeshVirtualGatewaySpecListenerTls(
+                        certificate=AppmeshVirtualGatewaySpecListenerTlsCertificate(
+                            acm=AppmeshVirtualGatewaySpecListenerTlsCertificateAcm(
+                                certificate_arn=Token.as_string(aws_acm_certificate_example.arn)
+                            )
+                        ),
+                        mode="STRICT"
+                    )
+                )
+                ],
+                logging=AppmeshVirtualGatewaySpecLogging(
+                    access_log=AppmeshVirtualGatewaySpecLoggingAccessLog(
+                        file=AppmeshVirtualGatewaySpecLoggingAccessLogFile(
+                            path="/var/log/access.log"
+                        )
+                    )
+                )
+            )
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) Name to use for the virtual gateway. Must be between 1 and 255 characters in length.
+* `mesh_name` - (Required) Name of the service mesh in which to create the virtual gateway. Must be between 1 and 255 characters in length.
+* `mesh_owner` - (Optional) AWS account ID of the service mesh's owner. Defaults to the account ID the [AWS provider][1] is currently connected to.
+* `spec` - (Required) Virtual gateway specification to apply.
+* `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+The `spec` object supports the following:
+
+* `listener` - (Required) Listeners that the mesh endpoint is expected to receive inbound traffic from. You can specify one listener.
+* `backend_defaults` - (Optional) Defaults for backends.
+* `logging` - (Optional) Inbound and outbound access logging information for the virtual gateway.
+
+The `backend_defaults` object supports the following:
+
+* `client_policy` - (Optional) Default client policy for virtual gateway backends.
+
+The `client_policy` object supports the following:
+
+* `tls` - (Optional) Transport Layer Security (TLS) client policy.
+
+The `tls` object supports the following:
+
+* `certificate` (Optional) Virtual gateway's client's Transport Layer Security (TLS) certificate.
+* `enforce` - (Optional) Whether the policy is enforced. Default is `true`.
+* `ports` - (Optional) One or more ports that the policy is enforced for.
+* `validation` - (Required) TLS validation context.
+
+The `certificate` object supports the following:
+
+* `file` - (Optional) Local file certificate.
+* `sds` - (Optional) A [Secret Discovery Service](https://www.envoyproxy.io/docs/envoy/latest/configuration/security/secret#secret-discovery-service-sds) certificate.
+
+The `file` object supports the following:
+
+* `certificate_chain` - (Required) Certificate chain for the certificate.
+* `private_key` - (Required) Private key for a certificate stored on the file system of the mesh endpoint that the proxy is running on.
+
+The `sds` object supports the following:
+
+* `secret_name` - (Required) Name of the secret secret requested from the Secret Discovery Service provider representing Transport Layer Security (TLS) materials like a certificate or certificate chain.
+
+The `validation` object supports the following:
+
+* `subject_alternative_names` - (Optional) SANs for a virtual gateway's listener's Transport Layer Security (TLS) validation context.
+* `trust` - (Required) TLS validation context trust.
+
+The `subject_alternative_names` object supports the following:
+
+* `match` - (Required) Criteria for determining a SAN's match.
+
+The `match` object supports the following:
+
+* `exact` - (Required) Values sent must match the specified values exactly.
+
+The `trust` object supports the following:
+
+* `acm` - (Optional) TLS validation context trust for an AWS Certificate Manager (ACM) certificate.
+* `file` - (Optional) TLS validation context trust for a local file certificate.
+* `sds` - (Optional) TLS validation context trust for a [Secret Discovery Service](https://www.envoyproxy.io/docs/envoy/latest/configuration/security/secret#secret-discovery-service-sds) certificate.
+
+The `acm` object supports the following:
+
+* `certificate_authority_arns` - (Required) One or more ACM ARNs.
+
+The `file` object supports the following:
+
+* `certificate_chain` - (Required) Certificate trust chain for a certificate stored on the file system of the mesh endpoint that the proxy is running on. Must be between 1 and 255 characters in length.
+
+The `sds` object supports the following:
+
+* `secret_name` - (Required) Name of the secret for a virtual gateway's Transport Layer Security (TLS) Secret Discovery Service validation context trust.
+
+The `listener` object supports the following:
+
+* `port_mapping` - (Required) Port mapping information for the listener.
+* `connection_pool` - (Optional) Connection pool information for the listener.
+* `health_check` - (Optional) Health check information for the listener.
+* `tls` - (Optional) Transport Layer Security (TLS) properties for the listener
+
+The `logging` object supports the following:
+
+* `access_log` - (Optional) Access log configuration for a virtual gateway.
+
+The `access_log` object supports the following:
+
+* `file` - (Optional) File object to send virtual gateway access logs to.
+
+The `file` object supports the following:
+
+* `format` - (Optional) The specified format for the logs.
+* `path` - (Required) File path to write access logs to. You can use `/dev/stdout` to send access logs to standard out. Must be between 1 and 255 characters in length.
+
+The `format` object supports the following:
+
+* `json` - (Optional) The logging format for JSON.
+* `text` - (Optional) The logging format for text. Must be between 1 and 1000 characters in length.
+
+The `json` object supports the following:
+
+* `key` - (Required) The specified key for the JSON. Must be between 1 and 100 characters in length.
+* `value` - (Required) The specified value for the JSON. Must be between 1 and 100 characters in length.
+
+The `port_mapping` object supports the following:
+
+* `port` - (Required) Port used for the port mapping.
+* `protocol` - (Required) Protocol used for the port mapping. Valid values are `http`, `http2`, `tcp` and `grpc`.
+
+The `connection_pool` object supports the following:
+
+* `grpc` - (Optional) Connection pool information for gRPC listeners.
+* `http` - (Optional) Connection pool information for HTTP listeners.
+* `http2` - (Optional) Connection pool information for HTTP2 listeners.
+
+The `grpc` connection pool object supports the following:
+
+* `max_requests` - (Required) Maximum number of inflight requests Envoy can concurrently support across hosts in upstream cluster. Minimum value of `1`.
+
+The `http` connection pool object supports the following:
+
+* `max_connections` - (Required) Maximum number of outbound TCP connections Envoy can establish concurrently with all hosts in upstream cluster. Minimum value of `1`.
+* `max_pending_requests` - (Optional) Number of overflowing requests after `max_connections` Envoy will queue to upstream cluster. Minimum value of `1`.
+
+The `http2` connection pool object supports the following:
+
+* `max_requests` - (Required) Maximum number of inflight requests Envoy can concurrently support across hosts in upstream cluster. Minimum value of `1`.
+
+The `health_check` object supports the following:
+
+* `healthy_threshold` - (Required) Number of consecutive successful health checks that must occur before declaring listener healthy.
+* `interval_millis`- (Required) Time period in milliseconds between each health check execution.
+* `protocol` - (Required) Protocol for the health check request. Valid values are `http`, `http2`, and `grpc`.
+* `timeout_millis` - (Required) Amount of time to wait when receiving a response from the health check, in milliseconds.
+* `unhealthy_threshold` - (Required) Number of consecutive failed health checks that must occur before declaring a virtual gateway unhealthy.
+* `path` - (Optional) Destination path for the health check request. This is only required if the specified protocol is `http` or `http2`.
+* `port` - (Optional) Destination port for the health check request. This port must match the port defined in the `port_mapping` for the listener.
+
+The `tls` object supports the following:
+
+* `certificate` - (Required) Listener's TLS certificate.
+* `mode`- (Required) Listener's TLS mode. Valid values: `DISABLED`, `PERMISSIVE`, `STRICT`.
+* `validation`- (Optional) Listener's Transport Layer Security (TLS) validation context.
+
+The `certificate` object supports the following:
+
+* `acm` - (Optional) An AWS Certificate Manager (ACM) certificate.
+* `file` - (Optional) Local file certificate.
+* `sds` - (Optional) A [Secret Discovery Service](https://www.envoyproxy.io/docs/envoy/latest/configuration/security/secret#secret-discovery-service-sds) certificate.
+
+The `acm` object supports the following:
+
+* `certificate_arn` - (Required) ARN for the certificate.
+
+The `file` object supports the following:
+
+* `certificate_chain` - (Required) Certificate chain for the certificate. Must be between 1 and 255 characters in length.
+* `private_key` - (Required) Private key for a certificate stored on the file system of the mesh endpoint that the proxy is running on. Must be between 1 and 255 characters in length.
+
+The `sds` object supports the following:
+
+* `secret_name` - (Required) Name of the secret secret requested from the Secret Discovery Service provider representing Transport Layer Security (TLS) materials like a certificate or certificate chain.
+
+The `validation` object supports the following:
+
+* `subject_alternative_names` - (Optional) SANs for a virtual gateway's listener's Transport Layer Security (TLS) validation context.
+* `trust` - (Required) TLS validation context trust.
+
+The `subject_alternative_names` object supports the following:
+
+* `match` - (Required) Criteria for determining a SAN's match.
+
+The `match` object supports the following:
+
+* `exact` - (Required) Values sent must match the specified values exactly.
+
+The `trust` object supports the following:
+
+* `file` - (Optional) TLS validation context trust for a local file certificate.
+* `sds` - (Optional) TLS validation context trust for a [Secret Discovery Service](https://www.envoyproxy.io/docs/envoy/latest/configuration/security/secret#secret-discovery-service-sds) certificate.
+
+The `file` object supports the following:
+
+* `certificate_chain` - (Required) Certificate trust chain for a certificate stored on the file system of the mesh endpoint that the proxy is running on. Must be between 1 and 255 characters in length.
+
+The `sds` object supports the following:
+
+* `secret_name` - (Required) Name of the secret for a virtual gateway's Transport Layer Security (TLS) Secret Discovery Service validation context trust.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the virtual gateway.
+* `arn` - ARN of the virtual gateway.
+* `created_date` - Creation date of the virtual gateway.
+* `last_updated_date` - Last update date of the virtual gateway.
+* `resource_owner` - Resource owner's AWS account ID.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import App Mesh virtual gateway using `mesh_name` together with the virtual gateway's `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import App Mesh virtual gateway using `mesh_name` together with the virtual gateway's `name`. For example:
+
+```console
+% terraform import aws_appmesh_virtual_gateway.example mesh/gw1
+```
+
+[1]: /docs/providers/aws/index.html
+
+<!-- cache-key: cdktf-0.18.0 input-0f019884935cffb4e15faa186fec437bbd1c1ed08bbdf658cac478d98a5253e8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/appmesh_virtual_node.html.markdown b/website/docs/cdktf/python/r/appmesh_virtual_node.html.markdown
new file mode 100644
index 00000000000..c13ffff7420
--- /dev/null
+++ b/website/docs/cdktf/python/r/appmesh_virtual_node.html.markdown
@@ -0,0 +1,519 @@
+---
+subcategory: "App Mesh"
+layout: "aws"
+page_title: "AWS: aws_appmesh_virtual_node"
+description: |-
+  Provides an AWS App Mesh virtual node resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_appmesh_virtual_node
+
+Provides an AWS App Mesh virtual node resource.
+
+## Breaking Changes
+
+Because of backward incompatible API changes (read [here](https://github.com/awslabs/aws-app-mesh-examples/issues/92)), `aws_appmesh_virtual_node` resource definitions created with provider versions earlier than v2.3.0 will need to be modified:
+
+* Rename the `service_name` attribute of the `dns` object to `hostname`.
+
+* Replace the `backends` attribute of the `spec` object with one or more `backend` configuration blocks,
+setting `virtual_service_name` to the name of the service.
+
+The Terraform state associated with existing resources will automatically be migrated.
+
+## Example Usage
+
+### Basic
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.appmesh_virtual_node import AppmeshVirtualNode
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AppmeshVirtualNode(self, "serviceb1",
+            mesh_name=simple.id,
+            name="serviceBv1",
+            spec=AppmeshVirtualNodeSpec(
+                backend=[AppmeshVirtualNodeSpecBackend(
+                    virtual_service=AppmeshVirtualNodeSpecBackendVirtualService(
+                        virtual_service_name="servicea.simpleapp.local"
+                    )
+                )
+                ],
+                listener=[AppmeshVirtualNodeSpecListener(
+                    port_mapping=AppmeshVirtualNodeSpecListenerPortMapping(
+                        port=8080,
+                        protocol="http"
+                    )
+                )
+                ],
+                service_discovery=AppmeshVirtualNodeSpecServiceDiscovery(
+                    dns=AppmeshVirtualNodeSpecServiceDiscoveryDns(
+                        hostname="serviceb.simpleapp.local"
+                    )
+                )
+            )
+        )
+```
+
+### AWS Cloud Map Service Discovery
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.appmesh_virtual_node import AppmeshVirtualNode
+from imports.aws.service_discovery_http_namespace import ServiceDiscoveryHttpNamespace
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = ServiceDiscoveryHttpNamespace(self, "example",
+            name="example-ns"
+        )
+        AppmeshVirtualNode(self, "serviceb1",
+            mesh_name=simple.id,
+            name="serviceBv1",
+            spec=AppmeshVirtualNodeSpec(
+                backend=[AppmeshVirtualNodeSpecBackend(
+                    virtual_service=AppmeshVirtualNodeSpecBackendVirtualService(
+                        virtual_service_name="servicea.simpleapp.local"
+                    )
+                )
+                ],
+                listener=[AppmeshVirtualNodeSpecListener(
+                    port_mapping=AppmeshVirtualNodeSpecListenerPortMapping(
+                        port=8080,
+                        protocol="http"
+                    )
+                )
+                ],
+                service_discovery=AppmeshVirtualNodeSpecServiceDiscovery(
+                    aws_cloud_map=AppmeshVirtualNodeSpecServiceDiscoveryAwsCloudMap(
+                        attributes={
+                            "stack": "blue"
+                        },
+                        namespace_name=example.name,
+                        service_name="serviceb1"
+                    )
+                )
+            )
+        )
+```
+
+### Listener Health Check
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.appmesh_virtual_node import AppmeshVirtualNode
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AppmeshVirtualNode(self, "serviceb1",
+            mesh_name=simple.id,
+            name="serviceBv1",
+            spec=AppmeshVirtualNodeSpec(
+                backend=[AppmeshVirtualNodeSpecBackend(
+                    virtual_service=AppmeshVirtualNodeSpecBackendVirtualService(
+                        virtual_service_name="servicea.simpleapp.local"
+                    )
+                )
+                ],
+                listener=[AppmeshVirtualNodeSpecListener(
+                    health_check=AppmeshVirtualNodeSpecListenerHealthCheck(
+                        healthy_threshold=2,
+                        interval_millis=5000,
+                        path="/ping",
+                        protocol="http",
+                        timeout_millis=2000,
+                        unhealthy_threshold=2
+                    ),
+                    port_mapping=AppmeshVirtualNodeSpecListenerPortMapping(
+                        port=8080,
+                        protocol="http"
+                    )
+                )
+                ],
+                service_discovery=AppmeshVirtualNodeSpecServiceDiscovery(
+                    dns=AppmeshVirtualNodeSpecServiceDiscoveryDns(
+                        hostname="serviceb.simpleapp.local"
+                    )
+                )
+            )
+        )
+```
+
+### Logging
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.appmesh_virtual_node import AppmeshVirtualNode
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AppmeshVirtualNode(self, "serviceb1",
+            mesh_name=simple.id,
+            name="serviceBv1",
+            spec=AppmeshVirtualNodeSpec(
+                backend=[AppmeshVirtualNodeSpecBackend(
+                    virtual_service=AppmeshVirtualNodeSpecBackendVirtualService(
+                        virtual_service_name="servicea.simpleapp.local"
+                    )
+                )
+                ],
+                listener=[AppmeshVirtualNodeSpecListener(
+                    port_mapping=AppmeshVirtualNodeSpecListenerPortMapping(
+                        port=8080,
+                        protocol="http"
+                    )
+                )
+                ],
+                logging=AppmeshVirtualNodeSpecLogging(
+                    access_log=AppmeshVirtualNodeSpecLoggingAccessLog(
+                        file=AppmeshVirtualNodeSpecLoggingAccessLogFile(
+                            path="/dev/stdout"
+                        )
+                    )
+                ),
+                service_discovery=AppmeshVirtualNodeSpecServiceDiscovery(
+                    dns=AppmeshVirtualNodeSpecServiceDiscoveryDns(
+                        hostname="serviceb.simpleapp.local"
+                    )
+                )
+            )
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) Name to use for the virtual node. Must be between 1 and 255 characters in length.
+* `mesh_name` - (Required) Name of the service mesh in which to create the virtual node. Must be between 1 and 255 characters in length.
+* `mesh_owner` - (Optional) AWS account ID of the service mesh's owner. Defaults to the account ID the [AWS provider][1] is currently connected to.
+* `spec` - (Required) Virtual node specification to apply.
+* `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+The `spec` object supports the following:
+
+* `backend` - (Optional) Backends to which the virtual node is expected to send outbound traffic.
+* `backend_defaults` - (Optional) Defaults for backends.
+* `listener` - (Optional) Listeners from which the virtual node is expected to receive inbound traffic.
+* `logging` - (Optional) Inbound and outbound access logging information for the virtual node.
+* `service_discovery` - (Optional) Service discovery information for the virtual node.
+
+The `backend` object supports the following:
+
+* `virtual_service` - (Required) Virtual service to use as a backend for a virtual node.
+
+The `virtual_service` object supports the following:
+
+* `client_policy` - (Optional) Client policy for the backend.
+* `virtual_service_name` - (Required) Name of the virtual service that is acting as a virtual node backend. Must be between 1 and 255 characters in length.
+
+The `client_policy` object supports the following:
+
+* `tls` - (Optional) Transport Layer Security (TLS) client policy.
+
+The `tls` object supports the following:
+
+* `certificate` (Optional) Virtual node's client's Transport Layer Security (TLS) certificate.
+* `enforce` - (Optional) Whether the policy is enforced. Default is `true`.
+* `ports` - (Optional) One or more ports that the policy is enforced for.
+* `validation` - (Required) TLS validation context.
+
+The `certificate` object supports the following:
+
+* `file` - (Optional) Local file certificate.
+* `sds` - (Optional) A [Secret Discovery Service](https://www.envoyproxy.io/docs/envoy/latest/configuration/security/secret#secret-discovery-service-sds) certificate.
+
+The `file` object supports the following:
+
+* `certificate_chain` - (Required) Certificate chain for the certificate.
+* `private_key` - (Required) Private key for a certificate stored on the file system of the mesh endpoint that the proxy is running on.
+
+The `sds` object supports the following:
+
+* `secret_name` - (Required) Name of the secret secret requested from the Secret Discovery Service provider representing Transport Layer Security (TLS) materials like a certificate or certificate chain.
+
+The `validation` object supports the following:
+
+* `subject_alternative_names` - (Optional) SANs for a TLS validation context.
+* `trust` - (Required) TLS validation context trust.
+
+The `subject_alternative_names` object supports the following:
+
+* `match` - (Required) Criteria for determining a SAN's match.
+
+The `match` object supports the following:
+
+* `exact` - (Required) Values sent must match the specified values exactly.
+
+The `trust` object supports the following:
+
+* `acm` - (Optional) TLS validation context trust for an AWS Certificate Manager (ACM) certificate.
+* `file` - (Optional) TLS validation context trust for a local file certificate.
+* `sds` - (Optional) TLS validation context trust for a [Secret Discovery Service](https://www.envoyproxy.io/docs/envoy/latest/configuration/security/secret#secret-discovery-service-sds) certificate.
+
+The `acm` object supports the following:
+
+* `certificate_authority_arns` - (Required) One or more ACM ARNs.
+
+The `file` object supports the following:
+
+* `certificate_chain` - (Required) Certificate trust chain for a certificate stored on the file system of the virtual node that the proxy is running on. Must be between 1 and 255 characters in length.
+
+The `sds` object supports the following:
+
+* `secret_name` - (Required) Name of the secret secret requested from the Secret Discovery Service provider representing Transport Layer Security (TLS) materials like a certificate or certificate chain.
+
+The `backend_defaults` object supports the following:
+
+* `client_policy` - (Optional) Default client policy for virtual service backends. See above for details.
+
+The `listener` object supports the following:
+
+* `port_mapping` - (Required) Port mapping information for the listener.
+* `connection_pool` - (Optional) Connection pool information for the listener.
+* `health_check` - (Optional) Health check information for the listener.
+* `outlier_detection` - (Optional) Outlier detection information for the listener.
+* `timeout` - (Optional) Timeouts for different protocols.
+* `tls` - (Optional) Transport Layer Security (TLS) properties for the listener
+
+The `logging` object supports the following:
+
+* `access_log` - (Optional) Access log configuration for a virtual node.
+
+The `access_log` object supports the following:
+
+* `file` - (Optional) File object to send virtual node access logs to.
+
+The `file` object supports the following:
+
+* `format` - (Optional) The specified format for the logs.
+* `path` - (Required) File path to write access logs to. You can use `/dev/stdout` to send access logs to standard out. Must be between 1 and 255 characters in length.
+
+The `format` object supports the following:
+
+* `json` - (Optional) The logging format for JSON.
+* `text` - (Optional) The logging format for text. Must be between 1 and 1000 characters in length.
+
+The `json` object supports the following:
+
+* `key` - (Required) The specified key for the JSON. Must be between 1 and 100 characters in length.
+* `value` - (Required) The specified value for the JSON. Must be between 1 and 100 characters in length.
+
+The `service_discovery` object supports the following:
+
+* `aws_cloud_map` - (Optional) Any AWS Cloud Map information for the virtual node.
+* `dns` - (Optional) DNS service name for the virtual node.
+
+The `aws_cloud_map` object supports the following:
+
+* `attributes` - (Optional) String map that contains attributes with values that you can use to filter instances by any custom attribute that you specified when you registered the instance. Only instances that match all of the specified key/value pairs will be returned.
+* `namespace_name` - (Required) Name of the AWS Cloud Map namespace to use.
+Use the [`aws_service_discovery_http_namespace`](/docs/providers/aws/r/service_discovery_http_namespace.html) resource to configure a Cloud Map namespace. Must be between 1 and 1024 characters in length.
+* `service_name` - (Required) Name of the AWS Cloud Map service to use. Use the [`aws_service_discovery_service`](/docs/providers/aws/r/service_discovery_service.html) resource to configure a Cloud Map service. Must be between 1 and 1024 characters in length.
+
+The `dns` object supports the following:
+
+* `hostname` - (Required) DNS host name for your virtual node.
+* `ip_preference` - (Optional) The preferred IP version that this virtual node uses. Valid values: `IPv6_PREFERRED`, `IPv4_PREFERRED`, `IPv4_ONLY`, `IPv6_ONLY`.
+* `response_type` - (Optional) The DNS response type for the virtual node. Valid values: `LOADBALANCER`, `ENDPOINTS`.
+
+The `port_mapping` object supports the following:
+
+* `port` - (Required) Port used for the port mapping.
+* `protocol` - (Required) Protocol used for the port mapping. Valid values are `http`, `http2`, `tcp` and `grpc`.
+
+The `connection_pool` object supports the following:
+
+* `grpc` - (Optional) Connection pool information for gRPC listeners.
+* `http` - (Optional) Connection pool information for HTTP listeners.
+* `http2` - (Optional) Connection pool information for HTTP2 listeners.
+* `tcp` - (Optional) Connection pool information for TCP listeners.
+
+The `grpc` connection pool object supports the following:
+
+* `max_requests` - (Required) Maximum number of inflight requests Envoy can concurrently support across hosts in upstream cluster. Minimum value of `1`.
+
+The `http` connection pool object supports the following:
+
+* `max_connections` - (Required) Maximum number of outbound TCP connections Envoy can establish concurrently with all hosts in upstream cluster. Minimum value of `1`.
+* `max_pending_requests` - (Optional) Number of overflowing requests after `max_connections` Envoy will queue to upstream cluster. Minimum value of `1`.
+
+The `http2` connection pool object supports the following:
+
+* `max_requests` - (Required) Maximum number of inflight requests Envoy can concurrently support across hosts in upstream cluster. Minimum value of `1`.
+
+The `tcp` connection pool object supports the following:
+
+* `max_connections` - (Required) Maximum number of outbound TCP connections Envoy can establish concurrently with all hosts in upstream cluster. Minimum value of `1`.
+
+The `health_check` object supports the following:
+
+* `healthy_threshold` - (Required) Number of consecutive successful health checks that must occur before declaring listener healthy.
+* `interval_millis`- (Required) Time period in milliseconds between each health check execution.
+* `protocol` - (Required) Protocol for the health check request. Valid values are `http`, `http2`, `tcp` and `grpc`.
+* `timeout_millis` - (Required) Amount of time to wait when receiving a response from the health check, in milliseconds.
+* `unhealthy_threshold` - (Required) Number of consecutive failed health checks that must occur before declaring a virtual node unhealthy.
+* `path` - (Optional) Destination path for the health check request. This is only required if the specified protocol is `http` or `http2`.
+* `port` - (Optional) Destination port for the health check request. This port must match the port defined in the `port_mapping` for the listener.
+
+The `outlier_detection` object supports the following:
+
+* `base_ejection_duration` - (Required) Base amount of time for which a host is ejected.
+* `interval` - (Required) Time interval between ejection sweep analysis.
+* `max_ejection_percent` - (Required) Maximum percentage of hosts in load balancing pool for upstream service that can be ejected. Will eject at least one host regardless of the value.
+Minimum value of `0`. Maximum value of `100`.
+* `max_server_errors` - (Required) Number of consecutive `5xx` errors required for ejection. Minimum value of `1`.
+
+The `base_ejection_duration` and `interval` objects support the following:
+
+* `unit` - (Required) Unit of time. Valid values: `ms`, `s`.
+* `value` - (Required) Number of time units. Minimum value of `0`.
+
+The `timeout` object supports the following:
+
+* `grpc` - (Optional) Timeouts for gRPC listeners.
+* `http` - (Optional) Timeouts for HTTP listeners.
+* `http2` - (Optional) Timeouts for HTTP2 listeners.
+* `tcp` - (Optional) Timeouts for TCP listeners.
+
+The `grpc` timeout object supports the following:
+
+* `idle` - (Optional) Idle timeout. An idle timeout bounds the amount of time that a connection may be idle.
+* `per_request` - (Optional) Per request timeout.
+
+The `idle` and `per_request` objects support the following:
+
+* `unit` - (Required) Unit of time. Valid values: `ms`, `s`.
+* `value` - (Required) Number of time units. Minimum value of `0`.
+
+The `http` and `http2` timeout objects support the following:
+
+* `idle` - (Optional) Idle timeout. An idle timeout bounds the amount of time that a connection may be idle.
+* `per_request` - (Optional) Per request timeout.
+
+The `idle` and `per_request` objects support the following:
+
+* `unit` - (Required) Unit of time. Valid values: `ms`, `s`.
+* `value` - (Required) Number of time units. Minimum value of `0`.
+
+The `tcp` timeout object supports the following:
+
+* `idle` - (Optional) Idle timeout. An idle timeout bounds the amount of time that a connection may be idle.
+
+The `idle` object supports the following:
+
+* `unit` - (Required) Unit of time. Valid values: `ms`, `s`.
+* `value` - (Required) Number of time units. Minimum value of `0`.
+
+The `tls` object supports the following:
+
+* `certificate` - (Required) Listener's TLS certificate.
+* `mode`- (Required) Listener's TLS mode. Valid values: `DISABLED`, `PERMISSIVE`, `STRICT`.
+* `validation`- (Optional) Listener's Transport Layer Security (TLS) validation context.
+
+The `certificate` object supports the following:
+
+* `acm` - (Optional) An AWS Certificate Manager (ACM) certificate.
+* `file` - (Optional) Local file certificate.
+* `sds` - (Optional) A [Secret Discovery Service](https://www.envoyproxy.io/docs/envoy/latest/configuration/security/secret#secret-discovery-service-sds) certificate.
+
+The `acm` object supports the following:
+
+* `certificate_arn` - (Required) ARN for the certificate.
+
+The `file` object supports the following:
+
+* `certificate_chain` - (Required) Certificate chain for the certificate. Must be between 1 and 255 characters in length.
+* `private_key` - (Required) Private key for a certificate stored on the file system of the virtual node that the proxy is running on. Must be between 1 and 255 characters in length.
+
+The `sds` object supports the following:
+
+* `secret_name` - (Required) Name of the secret secret requested from the Secret Discovery Service provider representing Transport Layer Security (TLS) materials like a certificate or certificate chain.
+
+The `validation` object supports the following:
+
+* `subject_alternative_names` - (Optional) SANs for a TLS validation context.
+* `trust` - (Required) TLS validation context trust.
+
+The `subject_alternative_names` object supports the following:
+
+* `match` - (Required) Criteria for determining a SAN's match.
+
+The `match` object supports the following:
+
+* `exact` - (Required) Values sent must match the specified values exactly.
+
+The `trust` object supports the following:
+
+* `file` - (Optional) TLS validation context trust for a local file certificate.
+* `sds` - (Optional) TLS validation context trust for a [Secret Discovery Service](https://www.envoyproxy.io/docs/envoy/latest/configuration/security/secret#secret-discovery-service-sds) certificate.
+
+The `file` object supports the following:
+
+* `certificate_chain` - (Required) Certificate trust chain for a certificate stored on the file system of the mesh endpoint that the proxy is running on. Must be between 1 and 255 characters in length.
+
+The `sds` object supports the following:
+
+* `secret_name` - (Required) Name of the secret for a virtual node's Transport Layer Security (TLS) Secret Discovery Service validation context trust.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the virtual node.
+* `arn` - ARN of the virtual node.
+* `created_date` - Creation date of the virtual node.
+* `last_updated_date` - Last update date of the virtual node.
+* `resource_owner` - Resource owner's AWS account ID.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import App Mesh virtual nodes using `mesh_name` together with the virtual node's `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import App Mesh virtual nodes using `mesh_name` together with the virtual node's `name`. For example:
+
+```console
+% terraform import aws_appmesh_virtual_node.serviceb1 simpleapp/serviceBv1
+```
+
+[1]: /docs/providers/aws/index.html
+
+<!-- cache-key: cdktf-0.18.0 input-024d5a96598211a97a1626c3090f4db9af8ed04ddfa8eea2600dc09cba20d3c6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/appmesh_virtual_router.html.markdown b/website/docs/cdktf/python/r/appmesh_virtual_router.html.markdown
new file mode 100644
index 00000000000..ddb5def5fff
--- /dev/null
+++ b/website/docs/cdktf/python/r/appmesh_virtual_router.html.markdown
@@ -0,0 +1,110 @@
+---
+subcategory: "App Mesh"
+layout: "aws"
+page_title: "AWS: aws_appmesh_virtual_router"
+description: |-
+  Provides an AWS App Mesh virtual router resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_appmesh_virtual_router
+
+Provides an AWS App Mesh virtual router resource.
+
+## Breaking Changes
+
+Because of backward incompatible API changes (read [here](https://github.com/awslabs/aws-app-mesh-examples/issues/92) and [here](https://github.com/awslabs/aws-app-mesh-examples/issues/94)), `aws_appmesh_virtual_router` resource definitions created with provider versions earlier than v2.3.0 will need to be modified:
+
+* Remove service `service_names` from the `spec` argument. AWS has created a `aws_appmesh_virtual_service` resource for each service name. Import these resource using `terraform import`.
+
+* Add a `listener` configuration block to the `spec` argument.
+
+The Terraform state associated with existing resources will automatically be migrated.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.appmesh_virtual_router import AppmeshVirtualRouter
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AppmeshVirtualRouter(self, "serviceb",
+            mesh_name=simple.id,
+            name="serviceB",
+            spec=AppmeshVirtualRouterSpec(
+                listener=[AppmeshVirtualRouterSpecListener(
+                    port_mapping=AppmeshVirtualRouterSpecListenerPortMapping(
+                        port=8080,
+                        protocol="http"
+                    )
+                )
+                ]
+            )
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) Name to use for the virtual router. Must be between 1 and 255 characters in length.
+* `mesh_name` - (Required) Name of the service mesh in which to create the virtual router. Must be between 1 and 255 characters in length.
+* `mesh_owner` - (Optional) AWS account ID of the service mesh's owner. Defaults to the account ID the [AWS provider][1] is currently connected to.
+* `spec` - (Required) Virtual router specification to apply.
+* `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+The `spec` object supports the following:
+
+* `listener` - (Optional) Listeners that the virtual router is expected to receive inbound traffic from.
+Currently only one listener is supported per virtual router.
+
+The `listener` object supports the following:
+
+* `port_mapping` - (Required) Port mapping information for the listener.
+
+The `port_mapping` object supports the following:
+
+* `port` - (Required) Port used for the port mapping.
+* `protocol` - (Required) Protocol used for the port mapping. Valid values are `http`,`http2`, `tcp` and `grpc`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the virtual router.
+* `arn` - ARN of the virtual router.
+* `created_date` - Creation date of the virtual router.
+* `last_updated_date` - Last update date of the virtual router.
+* `resource_owner` - Resource owner's AWS account ID.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import App Mesh virtual routers using `mesh_name` together with the virtual router's `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import App Mesh virtual routers using `mesh_name` together with the virtual router's `name`. For example:
+
+```console
+% terraform import aws_appmesh_virtual_router.serviceb simpleapp/serviceB
+```
+
+[1]: /docs/providers/aws/index.html
+
+<!-- cache-key: cdktf-0.18.0 input-b6f73966761dbca6e2aaf44ef6787d712dc92b753deee4152c13d29b3071617c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/appmesh_virtual_service.html.markdown b/website/docs/cdktf/python/r/appmesh_virtual_service.html.markdown
new file mode 100644
index 00000000000..03b2bfb9f56
--- /dev/null
+++ b/website/docs/cdktf/python/r/appmesh_virtual_service.html.markdown
@@ -0,0 +1,130 @@
+---
+subcategory: "App Mesh"
+layout: "aws"
+page_title: "AWS: aws_appmesh_virtual_service"
+description: |-
+  Provides an AWS App Mesh virtual service resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_appmesh_virtual_service
+
+Provides an AWS App Mesh virtual service resource.
+
+## Example Usage
+
+### Virtual Node Provider
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.appmesh_virtual_service import AppmeshVirtualService
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AppmeshVirtualService(self, "servicea",
+            mesh_name=simple.id,
+            name="servicea.simpleapp.local",
+            spec=AppmeshVirtualServiceSpec(
+                provider=AppmeshVirtualServiceSpecProvider(
+                    virtual_node=AppmeshVirtualServiceSpecProviderVirtualNode(
+                        virtual_node_name=serviceb1.name
+                    )
+                )
+            )
+        )
+```
+
+### Virtual Router Provider
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.appmesh_virtual_service import AppmeshVirtualService
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AppmeshVirtualService(self, "servicea",
+            mesh_name=simple.id,
+            name="servicea.simpleapp.local",
+            spec=AppmeshVirtualServiceSpec(
+                provider=AppmeshVirtualServiceSpecProvider(
+                    virtual_router=AppmeshVirtualServiceSpecProviderVirtualRouter(
+                        virtual_router_name=serviceb.name
+                    )
+                )
+            )
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) Name to use for the virtual service. Must be between 1 and 255 characters in length.
+* `mesh_name` - (Required) Name of the service mesh in which to create the virtual service. Must be between 1 and 255 characters in length.
+* `mesh_owner` - (Optional) AWS account ID of the service mesh's owner. Defaults to the account ID the [AWS provider][1] is currently connected to.
+* `spec` - (Required) Virtual service specification to apply.
+* `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+The `spec` object supports the following:
+
+* `provider`- (Optional) App Mesh object that is acting as the provider for a virtual service. You can specify a single virtual node or virtual router.
+
+The `provider` object supports the following:
+
+* `virtual_node` - (Optional) Virtual node associated with a virtual service.
+* `virtual_router` - (Optional) Virtual router associated with a virtual service.
+
+The `virtual_node` object supports the following:
+
+* `virtual_node_name` - (Required) Name of the virtual node that is acting as a service provider. Must be between 1 and 255 characters in length.
+
+The `virtual_router` object supports the following:
+
+* `virtual_router_name` - (Required) Name of the virtual router that is acting as a service provider. Must be between 1 and 255 characters in length.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the virtual service.
+* `arn` - ARN of the virtual service.
+* `created_date` - Creation date of the virtual service.
+* `last_updated_date` - Last update date of the virtual service.
+* `resource_owner` - Resource owner's AWS account ID.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import App Mesh virtual services using `mesh_name` together with the virtual service's `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import App Mesh virtual services using `mesh_name` together with the virtual service's `name`. For example:
+
+```console
+% terraform import aws_appmesh_virtual_service.servicea simpleapp/servicea.simpleapp.local
+```
+
+[1]: /docs/providers/aws/index.html
+
+<!-- cache-key: cdktf-0.18.0 input-5fae0e103caf94ef3f122b26a776a50dc44ebd36febaccc175efd0e97ba5bdaf -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/apprunner_auto_scaling_configuration_version.html.markdown b/website/docs/cdktf/python/r/apprunner_auto_scaling_configuration_version.html.markdown
new file mode 100644
index 00000000000..0bdc503e50e
--- /dev/null
+++ b/website/docs/cdktf/python/r/apprunner_auto_scaling_configuration_version.html.markdown
@@ -0,0 +1,79 @@
+---
+subcategory: "App Runner"
+layout: "aws"
+page_title: "AWS: aws_apprunner_auto_scaling_configuration_version"
+description: |-
+  Manages an App Runner AutoScaling Configuration Version.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_apprunner_auto_scaling_configuration_version
+
+Manages an App Runner AutoScaling Configuration Version.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.apprunner_auto_scaling_configuration_version import ApprunnerAutoScalingConfigurationVersion
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ApprunnerAutoScalingConfigurationVersion(self, "example",
+            auto_scaling_configuration_name="example",
+            max_concurrency=50,
+            max_size=10,
+            min_size=2,
+            tags={
+                "Name": "example-apprunner-autoscaling"
+            }
+        )
+```
+
+## Argument Reference
+
+The following arguments supported:
+
+* `auto_scaling_configuration_name` - (Required, Forces new resource) Name of the auto scaling configuration.
+* `max_concurrency` - (Optional, Forces new resource) Maximal number of concurrent requests that you want an instance to process. When the number of concurrent requests goes over this limit, App Runner scales up your service.
+* `max_size` - (Optional, Forces new resource) Maximal number of instances that App Runner provisions for your service.
+* `min_size` - (Optional, Forces new resource) Minimal number of instances that App Runner provisions for your service.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of this auto scaling configuration version.
+* `auto_scaling_configuration_revision` - The revision of this auto scaling configuration.
+* `latest` - Whether the auto scaling configuration has the highest `auto_scaling_configuration_revision` among all configurations that share the same `auto_scaling_configuration_name`.
+* `status` - Current state of the auto scaling configuration. An INACTIVE configuration revision has been deleted and can't be used. It is permanently removed some time after deletion.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import App Runner AutoScaling Configuration Versions using the `arn`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import App Runner AutoScaling Configuration Versions using the `arn`. For example:
+
+```console
+% terraform import aws_apprunner_auto_scaling_configuration_version.example "arn:aws:apprunner:us-east-1:1234567890:autoscalingconfiguration/example/1/69bdfe0115224b0db49398b7beb68e0f
+```
+
+<!-- cache-key: cdktf-0.18.0 input-7aac7f85f31408240e0b57ce4afb75ca1e0d9a5e1f5c9aa2ba1d6961146bc1ac -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/apprunner_connection.html.markdown b/website/docs/cdktf/python/r/apprunner_connection.html.markdown
new file mode 100644
index 00000000000..88ba6346588
--- /dev/null
+++ b/website/docs/cdktf/python/r/apprunner_connection.html.markdown
@@ -0,0 +1,75 @@
+---
+subcategory: "App Runner"
+layout: "aws"
+page_title: "AWS: aws_apprunner_connection"
+description: |-
+  Manages an App Runner Connection.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_apprunner_connection
+
+Manages an App Runner Connection.
+
+~> **NOTE:** After creation, you must complete the authentication handshake using the App Runner console.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.apprunner_connection import ApprunnerConnection
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ApprunnerConnection(self, "example",
+            connection_name="example",
+            provider_type="GITHUB",
+            tags={
+                "Name": "example-apprunner-connection"
+            }
+        )
+```
+
+## Argument Reference
+
+The following arguments supported:
+
+* `connection_name` - (Required) Name of the connection.
+* `provider_type` - (Required) Source repository provider. Valid values: `GITHUB`.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the connection.
+* `status` - Current state of the App Runner connection. When the state is `AVAILABLE`, you can use the connection to create an [`aws_apprunner_service` resource](apprunner_service.html).
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import App Runner Connections using the `connection_name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import App Runner Connections using the `connection_name`. For example:
+
+```console
+% terraform import aws_apprunner_connection.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-3223a9c42fae1a70b59eb72d4fd08310c6f33713ae95b548fcc20326e370a660 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/apprunner_custom_domain_association.html.markdown b/website/docs/cdktf/python/r/apprunner_custom_domain_association.html.markdown
new file mode 100644
index 00000000000..bd1d4695c92
--- /dev/null
+++ b/website/docs/cdktf/python/r/apprunner_custom_domain_association.html.markdown
@@ -0,0 +1,81 @@
+---
+subcategory: "App Runner"
+layout: "aws"
+page_title: "AWS: aws_apprunner_custom_domain_association"
+description: |-
+  Manages an App Runner Custom Domain association.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_apprunner_custom_domain_association
+
+Manages an App Runner Custom Domain association.
+
+~> **NOTE:** After creation, you must use the information in the `certification_validation_records` attribute to add CNAME records to your Domain Name System (DNS). For each mapped domain name, add a mapping to the target App Runner subdomain (found in the `dns_target` attribute) and one or more certificate validation records. App Runner then performs DNS validation to verify that you own or control the domain name you associated. App Runner tracks domain validity in a certificate stored in AWS Certificate Manager (ACM).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.apprunner_custom_domain_association import ApprunnerCustomDomainAssociation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ApprunnerCustomDomainAssociation(self, "example",
+            domain_name="example.com",
+            service_arn=Token.as_string(aws_apprunner_service_example.arn)
+        )
+```
+
+## Argument Reference
+
+The following arguments supported:
+
+* `domain_name` - (Required) Custom domain endpoint to association. Specify a base domain e.g., `example.com` or a subdomain e.g., `subdomain.example.com`.
+* `enable_www_subdomain` (Optional) Whether to associate the subdomain with the App Runner service in addition to the base domain. Defaults to `true`.
+* `service_arn` - (Required) ARN of the App Runner service.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The `domain_name` and `service_arn` separated by a comma (`,`).
+* `certificate_validation_records` - A set of certificate CNAME records used for this domain name. See [Certificate Validation Records](#certificate-validation-records) below for more details.
+* `dns_target` - App Runner subdomain of the App Runner service. The custom domain name is mapped to this target name. Attribute only available if resource created (not imported) with Terraform.
+
+### Certificate Validation Records
+
+The configuration block consists of the following arguments:
+
+* `name` - Certificate CNAME record name.
+* `status` - Current state of the certificate CNAME record validation. It should change to `SUCCESS` after App Runner completes validation with your DNS.
+* `type` - Record type, always `CNAME`.
+* `value` - Certificate CNAME record value.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import App Runner Custom Domain Associations using the `domain_name` and `service_arn` separated by a comma (`,`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import App Runner Custom Domain Associations using the `domain_name` and `service_arn` separated by a comma (`,`). For example:
+
+```console
+% terraform import aws_apprunner_custom_domain_association.example example.com,arn:aws:apprunner:us-east-1:123456789012:service/example-app/8fe1e10304f84fd2b0df550fe98a71fa
+```
+
+<!-- cache-key: cdktf-0.18.0 input-7cc3a375febd6cf6963cf65a24caeee55d47321c71cc824d65ac258b80d66ca7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/apprunner_observability_configuration.html.markdown b/website/docs/cdktf/python/r/apprunner_observability_configuration.html.markdown
new file mode 100644
index 00000000000..4e1e4275311
--- /dev/null
+++ b/website/docs/cdktf/python/r/apprunner_observability_configuration.html.markdown
@@ -0,0 +1,83 @@
+---
+subcategory: "App Runner"
+layout: "aws"
+page_title: "AWS: aws_apprunner_observability_configuration"
+description: |-
+  Manages an App Runner Observability Configuration.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_apprunner_observability_configuration
+
+Manages an App Runner Observability Configuration.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.apprunner_observability_configuration import ApprunnerObservabilityConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ApprunnerObservabilityConfiguration(self, "example",
+            observability_configuration_name="example",
+            tags={
+                "Name": "example-apprunner-observability-configuration"
+            },
+            trace_configuration=ApprunnerObservabilityConfigurationTraceConfiguration(
+                vendor="AWSXRAY"
+            )
+        )
+```
+
+## Argument Reference
+
+The following arguments supported:
+
+* `observability_configuration_name` - (Required, Forces new resource) Name of the observability configuration.
+* `trace_configuration` - (Optional) Configuration of the tracing feature within this observability configuration. If you don't specify it, App Runner doesn't enable tracing. See [Trace Configuration](#trace-configuration) below for more details.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Trace Configuration
+
+The `trace_configuration` block supports the following argument:
+
+* `vendor` - (Required) Implementation provider chosen for tracing App Runner services. Valid values: `AWSXRAY`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of this observability configuration.
+* `observability_configuration_revision` - The revision of this observability configuration.
+* `latest` - Whether the observability configuration has the highest `observability_configuration_revision` among all configurations that share the same `observability_configuration_name`.
+* `status` - Current state of the observability configuration. An INACTIVE configuration revision has been deleted and can't be used. It is permanently removed some time after deletion.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import App Runner Observability Configuration using the `arn`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import App Runner Observability Configuration using the `arn`. For example:
+
+```console
+% terraform import aws_apprunner_observability_configuration.example arn:aws:apprunner:us-east-1:1234567890:observabilityconfiguration/example/1/d75bc7ea55b71e724fe5c23452fe22a1
+```
+
+<!-- cache-key: cdktf-0.18.0 input-8e5cebb86212015c055222a001ff7c401e6fd39752f296bb53ad2acf1c736b46 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/apprunner_service.html.markdown b/website/docs/cdktf/python/r/apprunner_service.html.markdown
new file mode 100644
index 00000000000..24192f3399d
--- /dev/null
+++ b/website/docs/cdktf/python/r/apprunner_service.html.markdown
@@ -0,0 +1,316 @@
+---
+subcategory: "App Runner"
+layout: "aws"
+page_title: "AWS: aws_apprunner_service"
+description: |-
+  Manages an App Runner Service.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_apprunner_service
+
+Manages an App Runner Service.
+
+## Example Usage
+
+### Service with a Code Repository Source
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.apprunner_service import ApprunnerService
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ApprunnerService(self, "example",
+            network_configuration=ApprunnerServiceNetworkConfiguration(
+                egress_configuration=ApprunnerServiceNetworkConfigurationEgressConfiguration(
+                    egress_type="VPC",
+                    vpc_connector_arn=connector.arn
+                )
+            ),
+            service_name="example",
+            source_configuration=ApprunnerServiceSourceConfiguration(
+                authentication_configuration=ApprunnerServiceSourceConfigurationAuthenticationConfiguration(
+                    connection_arn=Token.as_string(aws_apprunner_connection_example.arn)
+                ),
+                code_repository=ApprunnerServiceSourceConfigurationCodeRepository(
+                    code_configuration=ApprunnerServiceSourceConfigurationCodeRepositoryCodeConfiguration(
+                        code_configuration_values=ApprunnerServiceSourceConfigurationCodeRepositoryCodeConfigurationCodeConfigurationValues(
+                            build_command="python setup.py develop",
+                            port="8000",
+                            runtime="PYTHON_3",
+                            start_command="python runapp.py"
+                        ),
+                        configuration_source="API"
+                    ),
+                    repository_url="https://github.com/example/my-example-python-app",
+                    source_code_version=ApprunnerServiceSourceConfigurationCodeRepositorySourceCodeVersion(
+                        type="BRANCH",
+                        value="main"
+                    )
+                )
+            ),
+            tags={
+                "Name": "example-apprunner-service"
+            }
+        )
+```
+
+### Service with an Image Repository Source
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.apprunner_service import ApprunnerService
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ApprunnerService(self, "example",
+            service_name="example",
+            source_configuration=ApprunnerServiceSourceConfiguration(
+                auto_deployments_enabled=False,
+                image_repository=ApprunnerServiceSourceConfigurationImageRepository(
+                    image_configuration=ApprunnerServiceSourceConfigurationImageRepositoryImageConfiguration(
+                        port="8000"
+                    ),
+                    image_identifier="public.ecr.aws/aws-containers/hello-app-runner:latest",
+                    image_repository_type="ECR_PUBLIC"
+                )
+            ),
+            tags={
+                "Name": "example-apprunner-service"
+            }
+        )
+```
+
+### Service with Observability Configuration
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.apprunner_observability_configuration import ApprunnerObservabilityConfiguration
+from imports.aws.apprunner_service import ApprunnerService
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = ApprunnerObservabilityConfiguration(self, "example",
+            observability_configuration_name="example",
+            trace_configuration=ApprunnerObservabilityConfigurationTraceConfiguration(
+                vendor="AWSXRAY"
+            )
+        )
+        aws_apprunner_service_example = ApprunnerService(self, "example_1",
+            observability_configuration=ApprunnerServiceObservabilityConfiguration(
+                observability_configuration_arn=example.arn,
+                observability_enabled=True
+            ),
+            service_name="example",
+            source_configuration=ApprunnerServiceSourceConfiguration(
+                auto_deployments_enabled=False,
+                image_repository=ApprunnerServiceSourceConfigurationImageRepository(
+                    image_configuration=ApprunnerServiceSourceConfigurationImageRepositoryImageConfiguration(
+                        port="8000"
+                    ),
+                    image_identifier="public.ecr.aws/aws-containers/hello-app-runner:latest",
+                    image_repository_type="ECR_PUBLIC"
+                )
+            ),
+            tags={
+                "Name": "example-apprunner-service"
+            }
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_apprunner_service_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `service_name` - (Forces new resource) Name of the service.
+* `source_configuration` - The source to deploy to the App Runner service. Can be a code or an image repository. See [Source Configuration](#source-configuration) below for more details.
+
+The following arguments are optional:
+
+* `auto_scaling_configuration_arn` - ARN of an App Runner automatic scaling configuration resource that you want to associate with your service. If not provided, App Runner associates the latest revision of a default auto scaling configuration.
+* `encryption_configuration` - (Forces new resource) An optional custom encryption key that App Runner uses to encrypt the copy of your source repository that it maintains and your service logs. By default, App Runner uses an AWS managed CMK. See [Encryption Configuration](#encryption-configuration) below for more details.
+* `health_check_configuration` - (Forces new resource) Settings of the health check that AWS App Runner performs to monitor the health of your service. See [Health Check Configuration](#health-check-configuration) below for more details.
+* `instance_configuration` - The runtime configuration of instances (scaling units) of the App Runner service. See [Instance Configuration](#instance-configuration) below for more details.
+* `network_configuration` - Configuration settings related to network traffic of the web application that the App Runner service runs. See [Network Configuration](#network-configuration) below for more details.
+* `observability_configuration` - The observability configuration of your service. See [Observability Configuration](#observability-configuration) below for more details.
+* `tags` - Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Encryption Configuration
+
+The `encryption_configuration` block supports the following argument:
+
+* `kms_key` - (Required) ARN of the KMS key used for encryption.
+
+### Health Check Configuration
+
+The `health_check_configuration` block supports the following arguments:
+
+* `healthy_threshold` - (Optional) Number of consecutive checks that must succeed before App Runner decides that the service is healthy. Defaults to 1. Minimum value of 1. Maximum value of 20.
+* `interval` - (Optional) Time interval, in seconds, between health checks. Defaults to 5. Minimum value of 1. Maximum value of 20.
+* `path` - (Optional) URL to send requests to for health checks. Defaults to `/`. Minimum length of 0. Maximum length of 51200.
+* `protocol` - (Optional) IP protocol that App Runner uses to perform health checks for your service. Valid values: `TCP`, `HTTP`. Defaults to `TCP`. If you set protocol to `HTTP`, App Runner sends health check requests to the HTTP path specified by `path`.
+* `timeout` - (Optional) Time, in seconds, to wait for a health check response before deciding it failed. Defaults to 2. Minimum value of  1. Maximum value of 20.
+* `unhealthy_threshold` - (Optional) Number of consecutive checks that must fail before App Runner decides that the service is unhealthy. Defaults to 5. Minimum value of  1. Maximum value of 20.
+
+### Instance Configuration
+
+The `instance_configuration` block supports the following arguments:
+
+* `cpu` - (Optional) Number of CPU units reserved for each instance of your App Runner service represented as a String. Defaults to `1024`. Valid values: `256|512|1024|2048|4096|(0.25|0.5|1|2|4) vCPU`.
+* `instance_role_arn` - (Optional) ARN of an IAM role that provides permissions to your App Runner service. These are permissions that your code needs when it calls any AWS APIs.
+* `memory` - (Optional) Amount of memory, in MB or GB, reserved for each instance of your App Runner service. Defaults to `2048`. Valid values: `512|1024|2048|3072|4096|6144|8192|10240|12288|(0.5|1|2|3|4|6|8|10|12) GB`.
+
+### Source Configuration
+
+The `source_configuration` block supports the following arguments:
+
+~>**Note:** Either `code_repository` or `image_repository` must be specified (but not both).
+
+* `authentication_configuration` - (Optional) Describes resources needed to authenticate access to some source repositories. See [Authentication Configuration](#authentication-configuration) below for more details.
+* `auto_deployments_enabled` - (Optional) Whether continuous integration from the source repository is enabled for the App Runner service. If set to `true`, each repository change (source code commit or new image version) starts a deployment. Defaults to `true`.
+* `code_repository` - (Optional) Description of a source code repository. See [Code Repository](#code-repository) below for more details.
+* `image_repository` - (Optional) Description of a source image repository. See [Image Repository](#image-repository) below for more details.
+
+### Authentication Configuration
+
+The `authentication_configuration` block supports the following arguments:
+
+* `access_role_arn` - (Optional) ARN of the IAM role that grants the App Runner service access to a source repository. Required for ECR image repositories (but not for ECR Public)
+* `connection_arn` - (Optional) ARN of the App Runner connection that enables the App Runner service to connect to a source repository. Required for GitHub code repositories.
+
+### Network Configuration
+
+The `network_configuration` block supports the following arguments:
+
+* `ingress_configuration` - (Optional) Network configuration settings for inbound network traffic. See [Ingress Configuration](#ingress-configuration) below for more details.
+* `egress_configuration` - (Optional) Network configuration settings for outbound message traffic. See [Egress Configuration](#egress-configuration) below for more details.
+* `egress_type` - (Optional) Type of egress configuration.Set to DEFAULT for access to resources hosted on public networks.Set to VPC to associate your service to a custom VPC specified by VpcConnectorArn.
+* `vpc_connector_arn` - ARN of the App Runner VPC connector that you want to associate with your App Runner service. Only valid when EgressType = VPC.
+
+### Ingress Configuration
+
+The `ingress_configuration` block supports the following argument:
+
+* `is_publicly_accessible` - (Required) Specifies whether your App Runner service is publicly accessible. To make the service publicly accessible set it to True. To make the service privately accessible, from only within an Amazon VPC set it to False.
+
+### Egress Configuration
+
+The `egress_configuration` block supports the following argument:
+
+* `egress_type` - The type of egress configuration. Valid values are: `DEFAULT` and `VPC`.
+* `vpc_connector_arn` - The Amazon Resource Name (ARN) of the App Runner VPC connector that you want to associate with your App Runner service. Only valid when `EgressType = VPC`.
+
+### Observability Configuration
+
+The `observability_configuration` block supports the following arguments:
+
+* `observability_enabled` - (Required) When `true`, an observability configuration resource is associated with the service.
+* `observability_configuration_arn` - (Optional) ARN of the observability configuration that is associated with the service. Specified only when `observability_enabled` is `true`.
+
+### Code Repository
+
+The `code_repository` block supports the following arguments:
+
+* `code_configuration` - (Optional) Configuration for building and running the service from a source code repository. See [Code Configuration](#code-configuration) below for more details.
+* `repository_url` - (Required) Location of the repository that contains the source code.
+* `source_code_version` - (Required) Version that should be used within the source code repository. See [Source Code Version](#source-code-version) below for more details.
+
+### Image Repository
+
+The `image_repository` block supports the following arguments:
+
+* `image_configuration` - (Optional) Configuration for running the identified image. See [Image Configuration](#image-configuration) below for more details.
+* `image_identifier` - (Required) Identifier of an image. For an image in Amazon Elastic Container Registry (Amazon ECR), this is an image name. For the
+  image name format, see Pulling an image in the Amazon ECR User Guide.
+* `image_repository_type` - (Required) Type of the image repository. This reflects the repository provider and whether the repository is private or public. Valid values: `ECR` , `ECR_PUBLIC`.
+
+### Code Configuration
+
+The `code_configuration` block supports the following arguments:
+
+* `code_configuration_values` - (Optional) Basic configuration for building and running the App Runner service. Use this parameter to quickly launch an App Runner service without providing an apprunner.yaml file in the source code repository (or ignoring the file if it exists). See [Code Configuration Values](#code-configuration-values) below for more details.
+* `configuration_source` - (Required) Source of the App Runner configuration. Valid values: `REPOSITORY`, `API`. Values are interpreted as follows:
+    * `REPOSITORY` - App Runner reads configuration values from the apprunner.yaml file in the
+    source code repository and ignores the CodeConfigurationValues parameter.
+    * `API` - App Runner uses configuration values provided in the CodeConfigurationValues
+    parameter and ignores the apprunner.yaml file in the source code repository.
+
+### Code Configuration Values
+
+The `code_configuration_values` blocks supports the following arguments:
+
+* `build_command` - (Optional) Command App Runner runs to build your application.
+* `port` - (Optional) Port that your application listens to in the container. Defaults to `"8080"`.
+* `runtime` - (Required) Runtime environment type for building and running an App Runner service. Represents a programming language runtime. Valid values: `PYTHON_3`, `NODEJS_12`, `NODEJS_14`, `NODEJS_16`, `CORRETTO_8`, `CORRETTO_11`, `GO_1`, `DOTNET_6`, `PHP_81`, `RUBY_31`.
+* `runtime_environment_secrets` - (Optional) Secrets and parameters available to your service as environment variables. A map of key/value pairs, where the key is the desired name of the Secret in the environment (i.e. it does not have to match the name of the secret in Secrets Manager or SSM Parameter Store), and the value is the ARN of the secret from AWS Secrets Manager or the ARN of the parameter in AWS SSM Parameter Store.
+* `runtime_environment_variables` - (Optional) Environment variables available to your running App Runner service. A map of key/value pairs. Keys with a prefix of `AWSAPPRUNNER` are reserved for system use and aren't valid.
+* `start_command` - (Optional) Command App Runner runs to start your application.
+
+### Image Configuration
+
+The `image_configuration` block supports the following arguments:
+
+* `port` - (Optional) Port that your application listens to in the container. Defaults to `"8080"`.
+* `runtime_environment_secrets` - (Optional) Secrets and parameters available to your service as environment variables. A map of key/value pairs, where the key is the desired name of the Secret in the environment (i.e. it does not have to match the name of the secret in Secrets Manager or SSM Parameter Store), and the value is the ARN of the secret from AWS Secrets Manager or the ARN of the parameter in AWS SSM Parameter Store.
+* `runtime_environment_variables` - (Optional) Environment variables available to your running App Runner service. A map of key/value pairs. Keys with a prefix of `AWSAPPRUNNER` are reserved for system use and aren't valid.
+* `start_command` - (Optional) Command App Runner runs to start the application in the source image. If specified, this command overrides the Docker image’s default start command.
+
+### Source Code Version
+
+The `source_code_version` block supports the following arguments:
+
+* `type` - (Required) Type of version identifier. For a git-based repository, branches represent versions. Valid values: `BRANCH`.
+* `value`- (Required) Source code version. For a git-based repository, a branch name maps to a specific version. App Runner uses the most recent commit to the branch.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the App Runner service.
+* `service_id` - An alphanumeric ID that App Runner generated for this service. Unique within the AWS Region.
+* `service_url` - Subdomain URL that App Runner generated for this service. You can use this URL to access your service web application.
+* `status` - Current state of the App Runner service.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import App Runner Services using the `arn`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import App Runner Services using the `arn`. For example:
+
+```console
+% terraform import aws_apprunner_service.example arn:aws:apprunner:us-east-1:1234567890:service/example/0a03292a89764e5882c41d8f991c82fe
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ab52185ade0d482c41dce2950b5061670985bf2589f6ce689511bce1971583a6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/apprunner_vpc_connector.html.markdown b/website/docs/cdktf/python/r/apprunner_vpc_connector.html.markdown
new file mode 100644
index 00000000000..da4e26d9420
--- /dev/null
+++ b/website/docs/cdktf/python/r/apprunner_vpc_connector.html.markdown
@@ -0,0 +1,73 @@
+---
+subcategory: "App Runner"
+layout: "aws"
+page_title: "AWS: aws_apprunner_vpc_connector"
+description: |-
+  Manages an App Runner VPC Connector.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_apprunner_vpc_connector
+
+Manages an App Runner VPC Connector.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.apprunner_vpc_connector import ApprunnerVpcConnector
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ApprunnerVpcConnector(self, "connector",
+            security_groups=["sg1", "sg2"],
+            subnets=["subnet1", "subnet2"],
+            vpc_connector_name="name"
+        )
+```
+
+## Argument Reference
+
+The following arguments supported:
+
+* `vpc_connector_name` - (Required) Name for the VPC connector.
+* `subnets` (Required) List of IDs of subnets that App Runner should use when it associates your service with a custom Amazon VPC. Specify IDs of subnets of a single Amazon VPC. App Runner determines the Amazon VPC from the subnets you specify.
+* `security_groups` - List of IDs of security groups that App Runner should use for access to AWS resources under the specified subnets. If not specified, App Runner uses the default security group of the Amazon VPC. The default security group allows all outbound traffic.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of VPC connector.
+* `status` - Current state of the VPC connector. If the status of a connector revision is INACTIVE, it was deleted and can't be used. Inactive connector revisions are permanently removed some time after they are deleted.
+* `vpc_connector_revision` - The revision of VPC connector. It's unique among all the active connectors ("Status": "ACTIVE") that share the same Name.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import App Runner vpc connector using the `arn`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import App Runner vpc connector using the `arn`. For example:
+
+```console
+% terraform import aws_apprunner_vpc_connector.example arn:aws:apprunner:us-east-1:1234567890:vpcconnector/example/1/0a03292a89764e5882c41d8f991c82fe
+```
+
+<!-- cache-key: cdktf-0.18.0 input-a25bb324f61ef65387154b76f7156f8f2fb7eb7f11a4d07c072913a4bb2014c1 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/apprunner_vpc_ingress_connection.html.markdown b/website/docs/cdktf/python/r/apprunner_vpc_ingress_connection.html.markdown
new file mode 100644
index 00000000000..5bf99f8871f
--- /dev/null
+++ b/website/docs/cdktf/python/r/apprunner_vpc_ingress_connection.html.markdown
@@ -0,0 +1,86 @@
+---
+subcategory: "App Runner"
+layout: "aws"
+page_title: "AWS: aws_apprunner_vpc_ingress_connection"
+description: |-
+  Manages an App Runner VPC Ingress Connection.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_apprunner_vpc_ingress_connection
+
+Manages an App Runner VPC Ingress Connection.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.apprunner_vpc_ingress_connection import ApprunnerVpcIngressConnection
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ApprunnerVpcIngressConnection(self, "example",
+            ingress_vpc_configuration=ApprunnerVpcIngressConnectionIngressVpcConfiguration(
+                vpc_endpoint_id=apprunner.id,
+                vpc_id=default_var.id
+            ),
+            name="example",
+            service_arn=Token.as_string(aws_apprunner_service_example.arn),
+            tags={
+                "foo": "bar"
+            }
+        )
+```
+
+## Argument Reference
+
+The following arguments supported:
+
+* `name` - (Required) A name for the VPC Ingress Connection resource. It must be unique across all the active VPC Ingress Connections in your AWS account in the AWS Region.
+* `service_arn` - (Required) The Amazon Resource Name (ARN) for this App Runner service that is used to create the VPC Ingress Connection resource.
+* `ingress_vpc_configuration` - (Required) Specifications for the customer’s Amazon VPC and the related AWS PrivateLink VPC endpoint that are used to create the VPC Ingress Connection resource. See [Ingress VPC Configuration](#ingress-vpc-configuration) below for more details.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Ingress VPC Configuration
+
+The `ingress_vpc_configuration` block supports the following argument:
+
+* `vpc_id` - (Required) The ID of the VPC that is used for the VPC endpoint.
+* `vpc_endpoint_id` - (Required) The ID of the VPC endpoint that your App Runner service connects to.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the VPC Ingress Connection.
+* `domain_name` - The domain name associated with the VPC Ingress Connection resource.
+* `status` - The current status of the VPC Ingress Connection.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import App Runner VPC Ingress Connection using the `arn`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import App Runner VPC Ingress Connection using the `arn`. For example:
+
+```console
+% terraform import aws_apprunner_vpc_ingress_connection.example "arn:aws:apprunner:us-west-2:837424938642:vpcingressconnection/example/b379f86381d74825832c2e82080342fa"
+```
+
+<!-- cache-key: cdktf-0.18.0 input-5ca4eb20c816b4fc2b57f0cfd6bbd31dc7537e74b1368f2c8074afd614895b23 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/appstream_directory_config.html.markdown b/website/docs/cdktf/python/r/appstream_directory_config.html.markdown
new file mode 100644
index 00000000000..6207d7d57de
--- /dev/null
+++ b/website/docs/cdktf/python/r/appstream_directory_config.html.markdown
@@ -0,0 +1,78 @@
+---
+subcategory: "AppStream 2.0"
+layout: "aws"
+page_title: "AWS: aws_appstream_directory_config"
+description: |-
+  Provides an AppStream Directory Config
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_appstream_directory_config
+
+Provides an AppStream Directory Config.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.appstream_directory_config import AppstreamDirectoryConfig
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AppstreamDirectoryConfig(self, "example",
+            directory_name="NAME OF DIRECTORY",
+            organizational_unit_distinguished_names=["DISTINGUISHED NAME"],
+            service_account_credentials=AppstreamDirectoryConfigServiceAccountCredentials(
+                account_name="NAME OF ACCOUNT",
+                account_password="PASSWORD OF ACCOUNT"
+            )
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `directory_name` - (Required) Fully qualified name of the directory.
+* `organizational_unit_distinguished_names` - (Required) Distinguished names of the organizational units for computer accounts.
+* `service_account_credentials` - (Required) Configuration block for the name of the directory and organizational unit (OU) to use to join the directory config to a Microsoft Active Directory domain. See [`service_account_credentials`](#service_account_credentials) below.
+
+### `service_account_credentials`
+
+* `account_name` - (Required) User name of the account. This account must have the following privileges: create computer objects, join computers to the domain, and change/reset the password on descendant computer objects for the organizational units specified.
+* `account_password` - (Required) Password for the account.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Unique identifier (ID) of the appstream directory config.
+* `created_time` -  Date and time, in UTC and extended RFC 3339 format, when the directory config was created.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_appstream_directory_config` using the id. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_appstream_directory_config` using the id. For example:
+
+```console
+% terraform import aws_appstream_directory_config.example directoryNameExample
+```
+
+<!-- cache-key: cdktf-0.18.0 input-cc4dcd0e21d4459a6f134b5283f0f40cf04088ba29d91cc8b5c68f07a92ceeb9 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/appstream_fleet.html.markdown b/website/docs/cdktf/python/r/appstream_fleet.html.markdown
new file mode 100644
index 00000000000..57d09eab24f
--- /dev/null
+++ b/website/docs/cdktf/python/r/appstream_fleet.html.markdown
@@ -0,0 +1,125 @@
+---
+subcategory: "AppStream 2.0"
+layout: "aws"
+page_title: "AWS: aws_appstream_fleet"
+description: |-
+  Provides an AppStream fleet
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_appstream_fleet
+
+Provides an AppStream fleet.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.appstream_fleet import AppstreamFleet
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AppstreamFleet(self, "test_fleet",
+            compute_capacity=AppstreamFleetComputeCapacity(
+                desired_instances=1
+            ),
+            description="test fleet",
+            display_name="test-fleet",
+            enable_default_internet_access=False,
+            fleet_type="ON_DEMAND",
+            idle_disconnect_timeout_in_seconds=60,
+            image_name="Amazon-AppStream2-Sample-Image-03-11-2023",
+            instance_type="stream.standard.large",
+            max_user_duration_in_seconds=600,
+            name="test-fleet",
+            tags={
+                "TagName": "tag-value"
+            },
+            vpc_config=AppstreamFleetVpcConfig(
+                subnet_ids=["subnet-06e9b13400c225127"]
+            )
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `compute_capacity` - (Required) Configuration block for the desired capacity of the fleet. See below.
+* `instance_type` - (Required) Instance type to use when launching fleet instances.
+* `name` - (Required) Unique name for the fleet.
+
+The following arguments are optional:
+
+* `description` - (Optional) Description to display.
+* `disconnect_timeout_in_seconds` - (Optional) Amount of time that a streaming session remains active after users disconnect.
+* `display_name` - (Optional) Human-readable friendly name for the AppStream fleet.
+* `domain_join_info` - (Optional) Configuration block for the name of the directory and organizational unit (OU) to use to join the fleet to a Microsoft Active Directory domain. See below.
+* `enable_default_internet_access` - (Optional) Enables or disables default internet access for the fleet.
+* `fleet_type` - (Optional) Fleet type. Valid values are: `ON_DEMAND`, `ALWAYS_ON`
+* `iam_role_arn` - (Optional) ARN of the IAM role to apply to the fleet.
+* `idle_disconnect_timeout_in_seconds` - (Optional) Amount of time that users can be idle (inactive) before they are disconnected from their streaming session and the `disconnect_timeout_in_seconds` time interval begins.
+* `image_name` - (Optional) Name of the image used to create the fleet.
+* `image_arn` - (Optional) ARN of the public, private, or shared image to use.
+* `stream_view` - (Optional) AppStream 2.0 view that is displayed to your users when they stream from the fleet. When `APP` is specified, only the windows of applications opened by users display. When `DESKTOP` is specified, the standard desktop that is provided by the operating system displays. If not specified, defaults to `APP`.
+* `max_user_duration_in_seconds` - (Optional) Maximum amount of time that a streaming session can remain active, in seconds.
+* `vpc_config` - (Optional) Configuration block for the VPC configuration for the image builder. See below.
+* `tags` - (Optional) Map of tags to attach to AppStream instances.
+
+### `compute_capacity`
+
+* `desired_instances` - (Required) Desired number of streaming instances.
+
+### `domain_join_info`
+
+* `directory_name` - (Optional) Fully qualified name of the directory (for example, corp.example.com).
+* `organizational_unit_distinguished_name` - (Optional) Distinguished name of the organizational unit for computer accounts.
+
+### `vpc_config`
+
+* `security_group_ids` - Identifiers of the security groups for the fleet or image builder.
+* `subnet_ids` - Identifiers of the subnets to which a network interface is attached from the fleet instance or image builder instance.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Unique identifier (ID) of the appstream fleet.
+* `arn` - ARN of the appstream fleet.
+* `state` - State of the fleet. Can be `STARTING`, `RUNNING`, `STOPPING` or `STOPPED`
+* `created_time` -  Date and time, in UTC and extended RFC 3339 format, when the fleet was created.
+* `compute_capacity` - Describes the capacity status for a fleet.
+
+### `compute_capacity`
+
+* `available` - Number of currently available instances that can be used to stream sessions.
+* `in_use` - Number of instances in use for streaming.
+* `running` - Total number of simultaneous streaming instances that are running.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_appstream_fleet` using the id. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_appstream_fleet` using the id. For example:
+
+```console
+% terraform import aws_appstream_fleet.example fleetNameExample
+```
+
+<!-- cache-key: cdktf-0.18.0 input-73fdf63ad01b397b97d73714aee955eca2295534a2f89adc78fa6fd555eab144 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/appstream_fleet_stack_association.html.markdown b/website/docs/cdktf/python/r/appstream_fleet_stack_association.html.markdown
new file mode 100644
index 00000000000..7a112a64ab7
--- /dev/null
+++ b/website/docs/cdktf/python/r/appstream_fleet_stack_association.html.markdown
@@ -0,0 +1,85 @@
+---
+subcategory: "AppStream 2.0"
+layout: "aws"
+page_title: "AWS: aws_appstream_fleet_stack_association"
+description: |-
+  Manages an AppStream Fleet Stack association.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_appstream_fleet_stack_association
+
+Manages an AppStream Fleet Stack association.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.appstream_fleet import AppstreamFleet
+from imports.aws.appstream_fleet_stack_association import AppstreamFleetStackAssociation
+from imports.aws.appstream_stack import AppstreamStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = AppstreamFleet(self, "example",
+            compute_capacity=AppstreamFleetComputeCapacity(
+                desired_instances=1
+            ),
+            image_name="Amazon-AppStream2-Sample-Image-03-11-2023",
+            instance_type="stream.standard.small",
+            name="NAME"
+        )
+        aws_appstream_stack_example = AppstreamStack(self, "example_1",
+            name="STACK NAME"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_appstream_stack_example.override_logical_id("example")
+        aws_appstream_fleet_stack_association_example =
+        AppstreamFleetStackAssociation(self, "example_2",
+            fleet_name=example.name,
+            stack_name=Token.as_string(aws_appstream_stack_example.name)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_appstream_fleet_stack_association_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `fleet_name` - (Required) Name of the fleet.
+* `stack_name` (Required) Name of the stack.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Unique ID of the appstream stack fleet association, composed of the `fleet_name` and `stack_name` separated by a slash (`/`).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AppStream Stack Fleet Association using the `fleet_name` and `stack_name` separated by a slash (`/`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import AppStream Stack Fleet Association using the `fleet_name` and `stack_name` separated by a slash (`/`). For example:
+
+```console
+% terraform import aws_appstream_fleet_stack_association.example fleetName/stackName
+```
+
+<!-- cache-key: cdktf-0.18.0 input-d02e772e58ab8d188d62ad200741c9e10f12ac34ac4daa8c08f2dbd2bfc87b0a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/appstream_image_builder.html.markdown b/website/docs/cdktf/python/r/appstream_image_builder.html.markdown
new file mode 100644
index 00000000000..e6059e3c221
--- /dev/null
+++ b/website/docs/cdktf/python/r/appstream_image_builder.html.markdown
@@ -0,0 +1,116 @@
+---
+subcategory: "AppStream 2.0"
+layout: "aws"
+page_title: "AWS: aws_appstream_image_builder"
+description: |-
+  Provides an AppStream image builder
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_appstream_image_builder
+
+Provides an AppStream image builder.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.appstream_image_builder import AppstreamImageBuilder
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AppstreamImageBuilder(self, "test_fleet",
+            description="Description of a ImageBuilder",
+            display_name="Display name of a ImageBuilder",
+            enable_default_internet_access=False,
+            image_name="AppStream-WinServer2019-10-05-2022",
+            instance_type="stream.standard.large",
+            name="Name",
+            tags={
+                "Name": "Example Image Builder"
+            },
+            vpc_config=AppstreamImageBuilderVpcConfig(
+                subnet_ids=[example.id]
+            )
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `instance_type` - (Required) Instance type to use when launching the image builder.
+* `name` - (Required) Unique name for the image builder.
+
+The following arguments are optional:
+
+* `access_endpoint` - (Optional) Set of interface VPC endpoint (interface endpoint) objects. Maximum of 4. See below.
+* `appstream_agent_version` - (Optional) Version of the AppStream 2.0 agent to use for this image builder.
+* `description` - (Optional) Description to display.
+* `display_name` - (Optional) Human-readable friendly name for the AppStream image builder.
+* `domain_join_info` - (Optional) Configuration block for the name of the directory and organizational unit (OU) to use to join the image builder to a Microsoft Active Directory domain. See below.
+* `enable_default_internet_access` - (Optional) Enables or disables default internet access for the image builder.
+* `iam_role_arn` - (Optional) ARN of the IAM role to apply to the image builder.
+* `image_arn` - (Optional, Required if `image_name` not provided) ARN of the public, private, or shared image to use.
+* `image_name` - (Optional, Required if `image_arn` not provided) Name of the image used to create the image builder.
+* `vpc_config` - (Optional) Configuration block for the VPC configuration for the image builder. See below.
+* `tags` - (Optional) Map of tags to assign to the instance. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### `access_endpoint`
+
+The `access_endpoint` block supports the following arguments:
+
+* `endpoint_type` - (Required) Type of interface endpoint.
+* `vpce_id` - (Optional) Identifier (ID) of the VPC in which the interface endpoint is used.
+
+### `domain_join_info`
+
+The `domain_join_info` block supports the following arguments:
+
+* `directory_name` - (Optional) Fully qualified name of the directory (for example, corp.example.com).
+* `organizational_unit_distinguished_name` - (Optional) Distinguished name of the organizational unit for computer accounts.
+
+### `vpc_config`
+
+The `vpc_config` block supports the following arguments:
+
+* `security_group_ids` - (Optional) Identifiers of the security groups for the image builder or image builder.
+* `subnet_ids` - (Optional) Identifiers of the subnets to which a network interface is attached from the image builder instance or image builder instance.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the appstream image builder.
+* `created_time` -  Date and time, in UTC and extended RFC 3339 format, when the image builder was created.
+* `id` - Name of the image builder.
+* `state` - State of the image builder. Can be: `PENDING`, `UPDATING_AGENT`, `RUNNING`, `STOPPING`, `STOPPED`, `REBOOTING`, `SNAPSHOTTING`, `DELETING`, `FAILED`, `UPDATING`, `PENDING_QUALIFICATION`
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_appstream_image_builder` using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_appstream_image_builder` using the `name`. For example:
+
+```console
+% terraform import aws_appstream_image_builder.example imageBuilderExample
+```
+
+<!-- cache-key: cdktf-0.18.0 input-4adcf125fe94b0f705d78c11c3a6d984d8e9dbc720fe7e15affd7d0a48348dcb -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/appstream_stack.html.markdown b/website/docs/cdktf/python/r/appstream_stack.html.markdown
new file mode 100644
index 00000000000..ee39b9838e8
--- /dev/null
+++ b/website/docs/cdktf/python/r/appstream_stack.html.markdown
@@ -0,0 +1,156 @@
+---
+subcategory: "AppStream 2.0"
+layout: "aws"
+page_title: "AWS: aws_appstream_stack"
+description: |-
+  Provides an AppStream stack
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_appstream_stack
+
+Provides an AppStream stack.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.appstream_stack import AppstreamStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AppstreamStack(self, "example",
+            application_settings=AppstreamStackApplicationSettings(
+                enabled=True,
+                settings_group="SettingsGroup"
+            ),
+            description="stack description",
+            display_name="stack display name",
+            feedback_url="http://your-domain/feedback",
+            name="stack name",
+            redirect_url="http://your-domain/redirect",
+            storage_connectors=[AppstreamStackStorageConnectors(
+                connector_type="HOMEFOLDERS"
+            )
+            ],
+            tags={
+                "TagName": "TagValue"
+            },
+            user_settings=[AppstreamStackUserSettings(
+                action="CLIPBOARD_COPY_FROM_LOCAL_DEVICE",
+                permission="ENABLED"
+            ), AppstreamStackUserSettings(
+                action="CLIPBOARD_COPY_TO_LOCAL_DEVICE",
+                permission="ENABLED"
+            ), AppstreamStackUserSettings(
+                action="DOMAIN_PASSWORD_SIGNIN",
+                permission="ENABLED"
+            ), AppstreamStackUserSettings(
+                action="DOMAIN_SMART_CARD_SIGNIN",
+                permission="DISABLED"
+            ), AppstreamStackUserSettings(
+                action="FILE_DOWNLOAD",
+                permission="ENABLED"
+            ), AppstreamStackUserSettings(
+                action="FILE_UPLOAD",
+                permission="ENABLED"
+            ), AppstreamStackUserSettings(
+                action="PRINTING_TO_LOCAL_DEVICE",
+                permission="ENABLED"
+            )
+            ]
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) Unique name for the AppStream stack.
+
+The following arguments are optional:
+
+* `access_endpoints` - (Optional) Set of configuration blocks defining the interface VPC endpoints. Users of the stack can connect to AppStream 2.0 only through the specified endpoints.
+  See [`access_endpoints`](#access_endpoints) below.
+* `application_settings` - (Optional) Settings for application settings persistence.
+  See [`application_settings`](#application_settings) below.
+* `description` - (Optional) Description for the AppStream stack.
+* `display_name` - (Optional) Stack name to display.
+* `embed_host_domains` - (Optional) Domains where AppStream 2.0 streaming sessions can be embedded in an iframe. You must approve the domains that you want to host embedded AppStream 2.0 streaming sessions.
+* `feedback_url` - (Optional) URL that users are redirected to after they click the Send Feedback link. If no URL is specified, no Send Feedback link is displayed. .
+* `redirect_url` - (Optional) URL that users are redirected to after their streaming session ends.
+* `storage_connectors` - (Optional) Configuration block for the storage connectors to enable.
+  See [`storage_connectors`](#storage_connectors) below.
+* `user_settings` - (Optional) Configuration block for the actions that are enabled or disabled for users during their streaming sessions. If not provided, these settings are configured automatically by AWS. If provided, the terraform configuration should include a block for each configurable action.
+  See [`user_settings`](#user_settings) below.
+* `streaming_experience_settings` - (Optional) The streaming protocol you want your stack to prefer. This can be UDP or TCP. Currently, UDP is only supported in the Windows native client.
+  See [`streaming_experience_settings`](#streaming_experience_settings) below.
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### `access_endpoints`
+
+* `endpoint_type` - (Required) Type of the interface endpoint.
+  See the [`AccessEndpoint` AWS API documentation](https://docs.aws.amazon.com/appstream2/latest/APIReference/API_AccessEndpoint.html) for valid values.
+* `vpce_id` - (Optional) ID of the VPC in which the interface endpoint is used.
+
+### `application_settings`
+
+* `enabled` - (Required) Whether application settings should be persisted.
+* `settings_group` - (Optional) Name of the settings group.
+  Required when `enabled` is `true`.
+  Can be up to 100 characters.
+
+### `storage_connectors`
+
+* `connector_type` - (Required) Type of storage connector.
+  Valid values are `HOMEFOLDERS`, `GOOGLE_DRIVE`, or `ONE_DRIVE`.
+* `domains` - (Optional) Names of the domains for the account.
+* `resource_identifier` - (Optional) ARN of the storage connector.
+
+### `user_settings`
+
+* `action` - (Required) Action that is enabled or disabled.
+  Valid values are `CLIPBOARD_COPY_FROM_LOCAL_DEVICE`,  `CLIPBOARD_COPY_TO_LOCAL_DEVICE`, `FILE_UPLOAD`, `FILE_DOWNLOAD`, `PRINTING_TO_LOCAL_DEVICE`, `DOMAIN_PASSWORD_SIGNIN`, or `DOMAIN_SMART_CARD_SIGNIN`.
+* `permission` - (Required) Whether the action is enabled or disabled.
+  Valid values are `ENABLED` or `DISABLED`.
+
+### `streaming_experience_settings`
+
+* `preferred_protocol` - (Optional) The preferred protocol that you want to use while streaming your application.
+  Valid values are `TCP` and `UDP`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the appstream stack.
+* `created_time` - Date and time, in UTC and extended RFC 3339 format, when the stack was created.
+* `id` - Unique ID of the appstream stack.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_appstream_stack` using the id. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_appstream_stack` using the id. For example:
+
+```console
+% terraform import aws_appstream_stack.example stackID
+```
+
+<!-- cache-key: cdktf-0.18.0 input-47da4616e548607a748b0c74b6e276c2936292671693468cbdab004d2cb5d071 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/appstream_user.html.markdown b/website/docs/cdktf/python/r/appstream_user.html.markdown
new file mode 100644
index 00000000000..e88db78b098
--- /dev/null
+++ b/website/docs/cdktf/python/r/appstream_user.html.markdown
@@ -0,0 +1,79 @@
+---
+subcategory: "AppStream 2.0"
+layout: "aws"
+page_title: "AWS: aws_appstream_user"
+description: |-
+  Provides an AppStream user
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_appstream_user
+
+Provides an AppStream user.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.appstream_user import AppstreamUser
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AppstreamUser(self, "example",
+            authentication_type="USERPOOL",
+            first_name="FIRST NAME",
+            last_name="LAST NAME",
+            user_name="EMAIL"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `authentication_type` - (Required) Authentication type for the user. You must specify USERPOOL. Valid values: `API`, `SAML`, `USERPOOL`
+* `user_name` - (Required) Email address of the user.
+
+The following arguments are optional:
+
+* `enabled` - (Optional) Whether the user in the user pool is enabled.
+* `first_name` - (Optional) First name, or given name, of the user.
+* `last_name` - (Optional) Last name, or surname, of the user.
+* `send_email_notification` - (Optional) Send an email notification.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the appstream user.
+* `created_time` - Date and time, in UTC and extended RFC 3339 format, when the user was created.
+* `id` - Unique ID of the appstream user.
+* `status` - Status of the user in the user pool.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_appstream_user` using the `user_name` and `authentication_type` separated by a slash (`/`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_appstream_user` using the `user_name` and `authentication_type` separated by a slash (`/`). For example:
+
+```console
+% terraform import aws_appstream_user.example UserName/AuthenticationType
+```
+
+<!-- cache-key: cdktf-0.18.0 input-0ae35608b7c30b00bd83bdb13090e3e240414ae668bedb32d7e62c4aff37c502 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/appstream_user_stack_association.html.markdown b/website/docs/cdktf/python/r/appstream_user_stack_association.html.markdown
new file mode 100644
index 00000000000..e0ab2de9125
--- /dev/null
+++ b/website/docs/cdktf/python/r/appstream_user_stack_association.html.markdown
@@ -0,0 +1,87 @@
+---
+subcategory: "AppStream 2.0"
+layout: "aws"
+page_title: "AWS: aws_appstream_user_stack_association"
+description: |-
+  Manages an AppStream User Stack association.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_appstream_user_stack_association
+
+Manages an AppStream User Stack association.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.appstream_stack import AppstreamStack
+from imports.aws.appstream_user import AppstreamUser
+from imports.aws.appstream_user_stack_association import AppstreamUserStackAssociation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        test = AppstreamStack(self, "test",
+            name="STACK NAME"
+        )
+        aws_appstream_user_test = AppstreamUser(self, "test_1",
+            authentication_type="USERPOOL",
+            user_name="EMAIL"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_appstream_user_test.override_logical_id("test")
+        aws_appstream_user_stack_association_test =
+        AppstreamUserStackAssociation(self, "test_2",
+            authentication_type=Token.as_string(aws_appstream_user_test.authentication_type),
+            stack_name=test.name,
+            user_name=Token.as_string(aws_appstream_user_test.user_name)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_appstream_user_stack_association_test.override_logical_id("test")
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `authentication_type` - (Required) Authentication type for the user.
+* `stack_name` (Required) Name of the stack that is associated with the user.
+* `user_name` (Required) Email address of the user who is associated with the stack.
+
+The following arguments are optional:
+
+* `send_email_notification` - (Optional) Whether a welcome email is sent to a user after the user is created in the user pool.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Unique ID of the appstream User Stack association.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AppStream User Stack Association using the `user_name`, `authentication_type`, and `stack_name`, separated by a slash (`/`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import AppStream User Stack Association using the `user_name`, `authentication_type`, and `stack_name`, separated by a slash (`/`). For example:
+
+```console
+% terraform import aws_appstream_user_stack_association.example userName/auhtenticationType/stackName
+```
+
+<!-- cache-key: cdktf-0.18.0 input-6159c43dc4b863c969b8ab2f6ce472794478e51eb12d2094df23655fbcbc10e5 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/appsync_api_cache.html.markdown b/website/docs/cdktf/python/r/appsync_api_cache.html.markdown
new file mode 100644
index 00000000000..c9673141a87
--- /dev/null
+++ b/website/docs/cdktf/python/r/appsync_api_cache.html.markdown
@@ -0,0 +1,80 @@
+---
+subcategory: "AppSync"
+layout: "aws"
+page_title: "AWS: aws_appsync_api_cache"
+description: |-
+  Provides an AppSync API Cache.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_appsync_api_cache
+
+Provides an AppSync API Cache.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.appsync_api_cache import AppsyncApiCache
+from imports.aws.appsync_graphql_api import AppsyncGraphqlApi
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = AppsyncGraphqlApi(self, "example",
+            authentication_type="API_KEY",
+            name="example"
+        )
+        aws_appsync_api_cache_example = AppsyncApiCache(self, "example_1",
+            api_caching_behavior="FULL_REQUEST_CACHING",
+            api_id=example.id,
+            ttl=900,
+            type="LARGE"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_appsync_api_cache_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `api_id` - (Required) GraphQL API ID.
+* `api_caching_behavior` - (Required) Caching behavior. Valid values are `FULL_REQUEST_CACHING` and `PER_RESOLVER_CACHING`.
+* `type` - (Required) Cache instance type. Valid values are `SMALL`, `MEDIUM`, `LARGE`, `XLARGE`, `LARGE_2X`, `LARGE_4X`, `LARGE_8X`, `LARGE_12X`, `T2_SMALL`, `T2_MEDIUM`, `R4_LARGE`, `R4_XLARGE`, `R4_2XLARGE`, `R4_4XLARGE`, `R4_8XLARGE`.
+* `ttl` - (Required) TTL in seconds for cache entries.
+* `at_rest_encryption_enabled` - (Optional) At-rest encryption flag for cache. You cannot update this setting after creation.
+* `transit_encryption_enabled` - (Optional) Transit encryption flag when connecting to cache. You cannot update this setting after creation.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - AppSync API ID.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_appsync_api_cache` using the AppSync API ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_appsync_api_cache` using the AppSync API ID. For example:
+
+```console
+% terraform import aws_appsync_api_cache.example xxxxx
+```
+
+<!-- cache-key: cdktf-0.18.0 input-7b300ac441f82586ce425ea9b3f1fabbacd0aa2e6e9a8cba068619ac2633970e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/appsync_api_key.html.markdown b/website/docs/cdktf/python/r/appsync_api_key.html.markdown
new file mode 100644
index 00000000000..11e8d00019d
--- /dev/null
+++ b/website/docs/cdktf/python/r/appsync_api_key.html.markdown
@@ -0,0 +1,76 @@
+---
+subcategory: "AppSync"
+layout: "aws"
+page_title: "AWS: aws_appsync_api_key"
+description: |-
+  Provides an AppSync API Key.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_appsync_api_key
+
+Provides an AppSync API Key.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.appsync_api_key import AppsyncApiKey
+from imports.aws.appsync_graphql_api import AppsyncGraphqlApi
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = AppsyncGraphqlApi(self, "example",
+            authentication_type="API_KEY",
+            name="example"
+        )
+        aws_appsync_api_key_example = AppsyncApiKey(self, "example_1",
+            api_id=example.id,
+            expires="2018-05-03T04:00:00Z"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_appsync_api_key_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `api_id` - (Required) ID of the associated AppSync API
+* `description` - (Optional) API key description. Defaults to "Managed by Terraform".
+* `expires` - (Optional) RFC3339 string representation of the expiry date. Rounded down to nearest hour. By default, it is 7 days from the date of creation.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - API Key ID (Formatted as ApiId:Key)
+* `key` - API key
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_appsync_api_key` using the AppSync API ID and key separated by `:`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_appsync_api_key` using the AppSync API ID and key separated by `:`. For example:
+
+```console
+% terraform import aws_appsync_api_key.example xxxxx:yyyyy
+```
+
+<!-- cache-key: cdktf-0.18.0 input-9537eb2363c3276a35011eec4122475228554d13bf2934197192259c7ebc0bcd -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/appsync_datasource.html.markdown b/website/docs/cdktf/python/r/appsync_datasource.html.markdown
new file mode 100644
index 00000000000..4244969f73c
--- /dev/null
+++ b/website/docs/cdktf/python/r/appsync_datasource.html.markdown
@@ -0,0 +1,221 @@
+---
+subcategory: "AppSync"
+layout: "aws"
+page_title: "AWS: aws_appsync_datasource"
+description: |-
+  Provides an AppSync Data Source.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_appsync_datasource
+
+Provides an AppSync Data Source.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.appsync_datasource import AppsyncDatasource
+from imports.aws.appsync_graphql_api import AppsyncGraphqlApi
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.dynamodb_table import DynamodbTable
+from imports.aws.iam_role import IamRole
+from imports.aws.iam_role_policy import IamRolePolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = AppsyncGraphqlApi(self, "example",
+            authentication_type="API_KEY",
+            name="tf_appsync_example"
+        )
+        aws_dynamodb_table_example = DynamodbTable(self, "example_1",
+            attribute=[DynamodbTableAttribute(
+                name="UserId",
+                type="S"
+            )
+            ],
+            hash_key="UserId",
+            name="example",
+            read_capacity=1,
+            write_capacity=1
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_dynamodb_table_example.override_logical_id("example")
+        assume_role = DataAwsIamPolicyDocument(self, "assume_role",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["sts:AssumeRole"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["appsync.amazonaws.com"],
+                    type="Service"
+                )
+                ]
+            )
+            ]
+        )
+        data_aws_iam_policy_document_example = DataAwsIamPolicyDocument(self, "example_3",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["dynamodb:*"],
+                effect="Allow",
+                resources=[Token.as_string(aws_dynamodb_table_example.arn)]
+            )
+            ]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_iam_policy_document_example.override_logical_id("example")
+        aws_iam_role_example = IamRole(self, "example_4",
+            assume_role_policy=Token.as_string(assume_role.json),
+            name="example"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_role_example.override_logical_id("example")
+        aws_iam_role_policy_example = IamRolePolicy(self, "example_5",
+            name="example",
+            policy=Token.as_string(data_aws_iam_policy_document_example.json),
+            role=Token.as_string(aws_iam_role_example.id)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_role_policy_example.override_logical_id("example")
+        aws_appsync_datasource_example = AppsyncDatasource(self, "example_6",
+            api_id=example.id,
+            dynamodb_config=AppsyncDatasourceDynamodbConfig(
+                table_name=Token.as_string(aws_dynamodb_table_example.name)
+            ),
+            name="tf_appsync_example",
+            service_role_arn=Token.as_string(aws_iam_role_example.arn),
+            type="AMAZON_DYNAMODB"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_appsync_datasource_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `api_id` - (Required) API ID for the GraphQL API for the data source.
+* `name` - (Required) User-supplied name for the data source.
+* `type` - (Required) Type of the Data Source. Valid values: `AWS_LAMBDA`, `AMAZON_DYNAMODB`, `AMAZON_ELASTICSEARCH`, `HTTP`, `NONE`, `RELATIONAL_DATABASE`, `AMAZON_EVENTBRIDGE`, `AMAZON_OPENSEARCH_SERVICE`.
+* `description` - (Optional) Description of the data source.
+* `dynamodb_config` - (Optional) DynamoDB settings. See [DynamoDB Config](#dynamodb-config)
+* `elasticsearch_config` - (Optional) Amazon Elasticsearch settings. See [ElasticSearch Config](#elasticsearch-config)
+* `event_bridge_config` - (Optional) AWS EventBridge settings. See [Event Bridge Config](#event-bridge-config)
+* `http_config` - (Optional) HTTP settings. See [HTTP Config](#http-config)
+* `lambda_config` - (Optional) AWS Lambda settings. See [Lambda Config](#lambda-config)
+* `opensearchservice_config` - (Optional) Amazon OpenSearch Service settings. See [OpenSearch Service Config](#opensearch-service-config)
+* `relational_database_config` (Optional) AWS RDS settings. See [Relational Database Config](#relational-database-config)
+* `service_role_arn` - (Optional) IAM service role ARN for the data source.
+
+### DynamoDB Config
+
+This argument supports the following arguments:
+
+* `table_name` - (Required) Name of the DynamoDB table.
+* `region` - (Optional) AWS region of the DynamoDB table. Defaults to current region.
+* `use_caller_credentials` - (Optional) Set to `true` to use Amazon Cognito credentials with this data source.
+* `delta_sync_config` - (Optional) The DeltaSyncConfig for a versioned data source. See [Delta Sync Config](#delta-sync-config)
+* `versioned` - (Optional) Detects Conflict Detection and Resolution with this data source.
+
+### Delta Sync Config
+
+* `base_table_ttl` - (Optional) The number of minutes that an Item is stored in the data source.
+* `delta_sync_table_name` - (Required) The table name.
+* `delta_sync_table_ttl` - (Optional) The number of minutes that a Delta Sync log entry is stored in the Delta Sync table.
+
+### ElasticSearch Config
+
+This argument supports the following arguments:
+
+* `endpoint` - (Required) HTTP endpoint of the Elasticsearch domain.
+* `region` - (Optional) AWS region of Elasticsearch domain. Defaults to current region.
+
+### Event Bridge Config
+
+This argument supports the following arguments:
+
+* `event_bus_arn` - (Required) ARN for the EventBridge bus.
+
+### HTTP Config
+
+This argument supports the following arguments:
+
+* `endpoint` - (Required) HTTP URL.
+* `authorization_config` - (Optional) Authorization configuration in case the HTTP endpoint requires authorization. See [Authorization Config](#authorization-config).
+
+#### Authorization Config
+
+This argument supports the following arguments:
+
+* `authorization_type` - (Optional) Authorization type that the HTTP endpoint requires. Default values is `AWS_IAM`.
+* `aws_iam_config` - (Optional) Identity and Access Management (IAM) settings. See [AWS IAM Config](#aws-iam-config).
+
+##### AWS IAM Config
+
+This argument supports the following arguments:
+
+* `signing_region` - (Optional) Signing Amazon Web Services Region for IAM authorization.
+* `signing_service_name`- (Optional) Signing service name for IAM authorization.
+
+### Lambda Config
+
+This argument supports the following arguments:
+
+* `function_arn` - (Required) ARN for the Lambda function.
+
+### OpenSearch Service Config
+
+This argument supports the following arguments:
+
+* `endpoint` - (Required) HTTP endpoint of the OpenSearch domain.
+* `region` - (Optional) AWS region of the OpenSearch domain. Defaults to current region.
+
+### Relational Database Config
+
+This argument supports the following arguments:
+
+* `http_endpoint_config` - (Required) Amazon RDS HTTP endpoint configuration. See [HTTP Endpoint Config](#http-endpoint-config).
+* `source_type` - (Optional) Source type for the relational database. Valid values: `RDS_HTTP_ENDPOINT`.
+
+#### HTTP Endpoint Config
+
+This argument supports the following arguments:
+
+* `db_cluster_identifier` - (Required) Amazon RDS cluster identifier.
+* `aws_secret_store_arn` - (Required) AWS secret store ARN for database credentials.
+* `database_name` - (Optional) Logical database name.
+* `region` - (Optional) AWS Region for RDS HTTP endpoint. Defaults to current region.
+* `schema` - (Optional) Logical schema name.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_appsync_datasource` using the `api_id`, a hyphen, and `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_appsync_datasource` using the `api_id`, a hyphen, and `name`. For example:
+
+```console
+% terraform import aws_appsync_datasource.example abcdef123456-example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-65f545420c1890e5f6affd2d36656c47c2a7c4b889f24fd05541970389549ddb -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/appsync_domain_name.html.markdown b/website/docs/cdktf/python/r/appsync_domain_name.html.markdown
new file mode 100644
index 00000000000..7e29ad8c6a0
--- /dev/null
+++ b/website/docs/cdktf/python/r/appsync_domain_name.html.markdown
@@ -0,0 +1,70 @@
+---
+subcategory: "AppSync"
+layout: "aws"
+page_title: "AWS: aws_appsync_domain_name"
+description: |-
+  Provides an AppSync Domain Name.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_appsync_domain_name
+
+Provides an AppSync Domain Name.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.appsync_domain_name import AppsyncDomainName
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AppsyncDomainName(self, "example",
+            certificate_arn=Token.as_string(aws_acm_certificate_example.arn),
+            domain_name="api.example.com"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `certificate_arn` - (Required) ARN of the certificate. This can be an Certificate Manager (ACM) certificate or an Identity and Access Management (IAM) server certificate. The certifiacte must reside in us-east-1.
+* `description` - (Optional)  A description of the Domain Name.
+* `domain_name` - (Required) Domain name.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Appsync Domain Name.
+* `appsync_domain_name` - Domain name that AppSync provides.
+* `hosted_zone_id` - ID of your Amazon Route 53 hosted zone.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_appsync_domain_name` using the AppSync domain name. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_appsync_domain_name` using the AppSync domain name. For example:
+
+```console
+% terraform import aws_appsync_domain_name.example example.com
+```
+
+<!-- cache-key: cdktf-0.18.0 input-c850eb2b8026013d6a49e351a9f3cc357c29b074be725be34e7d5f3683fad68c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/appsync_domain_name_api_association.html.markdown b/website/docs/cdktf/python/r/appsync_domain_name_api_association.html.markdown
new file mode 100644
index 00000000000..63f310ebcd8
--- /dev/null
+++ b/website/docs/cdktf/python/r/appsync_domain_name_api_association.html.markdown
@@ -0,0 +1,67 @@
+---
+subcategory: "AppSync"
+layout: "aws"
+page_title: "AWS: aws_appsync_domain_name_api_association"
+description: |-
+  Provides an AppSync API Association.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_appsync_domain_name_api_association
+
+Provides an AppSync API Association.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.appsync_domain_name_api_association import AppsyncDomainNameApiAssociation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AppsyncDomainNameApiAssociation(self, "example",
+            api_id=Token.as_string(aws_appsync_graphql_api_example.id),
+            domain_name=Token.as_string(aws_appsync_domain_name_example.domain_name)
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `api_id` - (Required) API ID.
+* `domain_name` - (Required) Appsync domain name.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Appsync domain name.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_appsync_domain_name_api_association` using the AppSync domain name. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_appsync_domain_name_api_association` using the AppSync domain name. For example:
+
+```console
+% terraform import aws_appsync_domain_name_api_association.example example.com
+```
+
+<!-- cache-key: cdktf-0.18.0 input-20f8e537078df27312c2183f4ab0c0158ba5ec522ac3da6fb70fd599dad00b8f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/appsync_function.html.markdown b/website/docs/cdktf/python/r/appsync_function.html.markdown
new file mode 100644
index 00000000000..e470dcf00b4
--- /dev/null
+++ b/website/docs/cdktf/python/r/appsync_function.html.markdown
@@ -0,0 +1,147 @@
+---
+subcategory: "AppSync"
+layout: "aws"
+page_title: "AWS: aws_appsync_function"
+description: |-
+  Provides an AppSync Function.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_appsync_function
+
+Provides an AppSync Function.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.appsync_datasource import AppsyncDatasource
+from imports.aws.appsync_function import AppsyncFunction
+from imports.aws.appsync_graphql_api import AppsyncGraphqlApi
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = AppsyncGraphqlApi(self, "example",
+            authentication_type="API_KEY",
+            name="example",
+            schema="type Mutation {\n  putPost(id: ID!, title: String!): Post\n}\n\ntype Post {\n  id: ID!\n  title: String!\n}\n\ntype Query {\n  singlePost(id: ID!): Post\n}\n\nschema {\n  query: Query\n  mutation: Mutation\n}\n\n"
+        )
+        aws_appsync_datasource_example = AppsyncDatasource(self, "example_1",
+            api_id=example.id,
+            http_config=AppsyncDatasourceHttpConfig(
+                endpoint="http://example.com"
+            ),
+            name="example",
+            type="HTTP"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_appsync_datasource_example.override_logical_id("example")
+        aws_appsync_function_example = AppsyncFunction(self, "example_2",
+            api_id=example.id,
+            data_source=Token.as_string(aws_appsync_datasource_example.name),
+            name="example",
+            request_mapping_template="{\n    \"version\": \"2018-05-29\",\n    \"method\": \"GET\",\n    \"resourcePath\": \"/\",\n    \"params\":{\n        \"headers\": $utils.http.copyheaders($ctx.request.headers)\n    }\n}\n\n",
+            response_mapping_template="#if($ctx.result.statusCode == 200)\n    $ctx.result.body\n#else\n    $utils.appendError($ctx.result.body, $ctx.result.statusCode)\n#end\n\n"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_appsync_function_example.override_logical_id("example")
+```
+
+## Example Usage With Code
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, Fn, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.appsync_function import AppsyncFunction
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AppsyncFunction(self, "example",
+            api_id=Token.as_string(aws_appsync_graphql_api_example.id),
+            code=Token.as_string(Fn.file("some-code-dir")),
+            data_source=Token.as_string(aws_appsync_datasource_example.name),
+            name="example",
+            runtime=AppsyncFunctionRuntime(
+                name="APPSYNC_JS",
+                runtime_version="1.0.0"
+            )
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `api_id` - (Required) ID of the associated AppSync API.
+* `code` - (Optional) The function code that contains the request and response functions. When code is used, the runtime is required. The runtime value must be APPSYNC_JS.
+* `data_source` - (Required) Function data source name.
+* `max_batch_size` - (Optional) Maximum batching size for a resolver. Valid values are between `0` and `2000`.
+* `name` - (Required) Function name. The function name does not have to be unique.
+* `request_mapping_template` - (Optional) Function request mapping template. Functions support only the 2018-05-29 version of the request mapping template.
+* `response_mapping_template` - (Optional) Function response mapping template.
+* `description` - (Optional) Function description.
+* `runtime` - (Optional) Describes a runtime used by an AWS AppSync pipeline resolver or AWS AppSync function. Specifies the name and version of the runtime to use. Note that if a runtime is specified, code must also be specified. See [Runtime](#runtime).
+* `sync_config` - (Optional) Describes a Sync configuration for a resolver. See [Sync Config](#sync-config).
+* `function_version` - (Optional) Version of the request mapping template. Currently the supported value is `2018-05-29`. Does not apply when specifying `code`.
+
+### Runtime
+
+This argument supports the following arguments:
+
+* `name` - (Optional) The name of the runtime to use. Currently, the only allowed value is `APPSYNC_JS`.
+* `runtime_version` - (Optional) The version of the runtime to use. Currently, the only allowed version is `1.0.0`.
+
+### Sync Config
+
+This argument supports the following arguments:
+
+* `conflict_detection` - (Optional) Conflict Detection strategy to use. Valid values are `NONE` and `VERSION`.
+* `conflict_handler` - (Optional) Conflict Resolution strategy to perform in the event of a conflict. Valid values are `NONE`, `OPTIMISTIC_CONCURRENCY`, `AUTOMERGE`, and `LAMBDA`.
+* `lambda_conflict_handler_config` - (Optional) Lambda Conflict Handler Config when configuring `LAMBDA` as the Conflict Handler. See [Lambda Conflict Handler Config](#lambda-conflict-handler-config).
+
+#### Lambda Conflict Handler Config
+
+This argument supports the following arguments:
+
+* `lambda_conflict_handler_arn` - (Optional) ARN for the Lambda function to use as the Conflict Handler.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - API Function ID (Formatted as ApiId-FunctionId)
+* `arn` - ARN of the Function object.
+* `function_id` - Unique ID representing the Function object.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_appsync_function` using the AppSync API ID and Function ID separated by `-`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_appsync_function` using the AppSync API ID and Function ID separated by `-`. For example:
+
+```console
+% terraform import aws_appsync_function.example xxxxx-yyyyy
+```
+
+<!-- cache-key: cdktf-0.18.0 input-fd5bccadc3a9b3adcc9e953b3f3b963bdbabce78f3f8569cb3998c93b4620955 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/appsync_graphql_api.html.markdown b/website/docs/cdktf/python/r/appsync_graphql_api.html.markdown
new file mode 100644
index 00000000000..a20c775a275
--- /dev/null
+++ b/website/docs/cdktf/python/r/appsync_graphql_api.html.markdown
@@ -0,0 +1,380 @@
+---
+subcategory: "AppSync"
+layout: "aws"
+page_title: "AWS: aws_appsync_graphql_api"
+description: |-
+  Provides an AppSync GraphQL API.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_appsync_graphql_api
+
+Provides an AppSync GraphQL API.
+
+## Example Usage
+
+### API Key Authentication
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.appsync_graphql_api import AppsyncGraphqlApi
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AppsyncGraphqlApi(self, "example",
+            authentication_type="API_KEY",
+            name="example"
+        )
+```
+
+### AWS IAM Authentication
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.appsync_graphql_api import AppsyncGraphqlApi
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AppsyncGraphqlApi(self, "example",
+            authentication_type="AWS_IAM",
+            name="example"
+        )
+```
+
+### AWS Cognito User Pool Authentication
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.appsync_graphql_api import AppsyncGraphqlApi
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AppsyncGraphqlApi(self, "example",
+            authentication_type="AMAZON_COGNITO_USER_POOLS",
+            name="example",
+            user_pool_config=AppsyncGraphqlApiUserPoolConfig(
+                aws_region=Token.as_string(current.name),
+                default_action="DENY",
+                user_pool_id=Token.as_string(aws_cognito_user_pool_example.id)
+            )
+        )
+```
+
+### OpenID Connect Authentication
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.appsync_graphql_api import AppsyncGraphqlApi
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AppsyncGraphqlApi(self, "example",
+            authentication_type="OPENID_CONNECT",
+            name="example",
+            openid_connect_config=AppsyncGraphqlApiOpenidConnectConfig(
+                issuer="https://example.com"
+            )
+        )
+```
+
+### AWS Lambda Authorizer Authentication
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.appsync_graphql_api import AppsyncGraphqlApi
+from imports.aws.lambda_permission import LambdaPermission
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = AppsyncGraphqlApi(self, "example",
+            authentication_type="AWS_LAMBDA",
+            lambda_authorizer_config=AppsyncGraphqlApiLambdaAuthorizerConfig(
+                authorizer_uri="arn:aws:lambda:us-east-1:123456789012:function:custom_lambda_authorizer"
+            ),
+            name="example"
+        )
+        LambdaPermission(self, "appsync_lambda_authorizer",
+            action="lambda:InvokeFunction",
+            function_name="custom_lambda_authorizer",
+            principal="appsync.amazonaws.com",
+            source_arn=example.arn,
+            statement_id="appsync_lambda_authorizer"
+        )
+```
+
+### With Multiple Authentication Providers
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.appsync_graphql_api import AppsyncGraphqlApi
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AppsyncGraphqlApi(self, "example",
+            additional_authentication_provider=[AppsyncGraphqlApiAdditionalAuthenticationProvider(
+                authentication_type="AWS_IAM"
+            )
+            ],
+            authentication_type="API_KEY",
+            name="example"
+        )
+```
+
+### With Schema
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.appsync_graphql_api import AppsyncGraphqlApi
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AppsyncGraphqlApi(self, "example",
+            authentication_type="AWS_IAM",
+            name="example",
+            schema="schema {\n\tquery: Query\n}\ntype Query {\n  test: Int\n}\n\n"
+        )
+```
+
+### Enabling Logging
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.appsync_graphql_api import AppsyncGraphqlApi
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.iam_role import IamRole
+from imports.aws.iam_role_policy_attachment import IamRolePolicyAttachment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, authenticationType, name):
+        super().__init__(scope, name)
+        assume_role = DataAwsIamPolicyDocument(self, "assume_role",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["sts:AssumeRole"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["appsync.amazonaws.com"],
+                    type="Service"
+                )
+                ]
+            )
+            ]
+        )
+        example = IamRole(self, "example",
+            assume_role_policy=Token.as_string(assume_role.json),
+            name="example"
+        )
+        aws_iam_role_policy_attachment_example = IamRolePolicyAttachment(self, "example_2",
+            policy_arn="arn:aws:iam::aws:policy/service-role/AWSAppSyncPushToCloudWatchLogs",
+            role=example.name
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_role_policy_attachment_example.override_logical_id("example")
+        aws_appsync_graphql_api_example = AppsyncGraphqlApi(self, "example_3",
+            log_config=AppsyncGraphqlApiLogConfig(
+                cloudwatch_logs_role_arn=example.arn,
+                field_log_level="ERROR"
+            ),
+            authentication_type=authentication_type,
+            name=name
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_appsync_graphql_api_example.override_logical_id("example")
+```
+
+### Associate Web ACL (v2)
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.appsync_graphql_api import AppsyncGraphqlApi
+from imports.aws.wafv2_web_acl import Wafv2WebAcl
+from imports.aws.wafv2_web_acl_association import Wafv2WebAclAssociation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = AppsyncGraphqlApi(self, "example",
+            authentication_type="API_KEY",
+            name="example"
+        )
+        aws_wafv2_web_acl_example = Wafv2WebAcl(self, "example_1",
+            default_action=Wafv2WebAclDefaultAction(
+                allow=Wafv2WebAclDefaultActionAllow()
+            ),
+            description="Example of a managed rule.",
+            name="managed-rule-example",
+            rule=[Wafv2WebAclRule(
+                name="rule-1",
+                override_action=Wafv2WebAclRuleOverrideAction(
+                    block=[{}]
+                ),
+                priority=1,
+                statement=Wafv2WebAclRuleStatement(
+                    managed_rule_group_statement=Wafv2WebAclRuleStatementManagedRuleGroupStatement(
+                        name="AWSManagedRulesCommonRuleSet",
+                        vendor_name="AWS"
+                    )
+                ),
+                visibility_config=Wafv2WebAclRuleVisibilityConfig(
+                    cloudwatch_metrics_enabled=False,
+                    metric_name="friendly-rule-metric-name",
+                    sampled_requests_enabled=False
+                )
+            )
+            ],
+            scope="REGIONAL",
+            visibility_config=Wafv2WebAclVisibilityConfig(
+                cloudwatch_metrics_enabled=False,
+                metric_name="friendly-metric-name",
+                sampled_requests_enabled=False
+            )
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_wafv2_web_acl_example.override_logical_id("example")
+        aws_wafv2_web_acl_association_example = Wafv2WebAclAssociation(self, "example_2",
+            resource_arn=example.arn,
+            web_acl_arn=Token.as_string(aws_wafv2_web_acl_example.arn)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_wafv2_web_acl_association_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `authentication_type` - (Required) Authentication type. Valid values: `API_KEY`, `AWS_IAM`, `AMAZON_COGNITO_USER_POOLS`, `OPENID_CONNECT`, `AWS_LAMBDA`
+* `name` - (Required) User-supplied name for the GraphqlApi.
+* `log_config` - (Optional) Nested argument containing logging configuration. Defined below.
+* `openid_connect_config` - (Optional) Nested argument containing OpenID Connect configuration. Defined below.
+* `user_pool_config` - (Optional) Amazon Cognito User Pool configuration. Defined below.
+* `lambda_authorizer_config` - (Optional) Nested argument containing Lambda authorizer configuration. Defined below.
+* `schema` - (Optional) Schema definition, in GraphQL schema language format. Terraform cannot perform drift detection of this configuration.
+* `additional_authentication_provider` - (Optional) One or more additional authentication providers for the GraphqlApi. Defined below.
+* `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `xray_enabled` - (Optional) Whether tracing with X-ray is enabled. Defaults to false.
+* `visibility` - (Optional) Sets the value of the GraphQL API to public (`GLOBAL`) or private (`PRIVATE`). If no value is provided, the visibility will be set to `GLOBAL` by default. This value cannot be changed once the API has been created.
+
+### log_config
+
+This argument supports the following arguments:
+
+* `cloudwatch_logs_role_arn` - (Required) Amazon Resource Name of the service role that AWS AppSync will assume to publish to Amazon CloudWatch logs in your account.
+* `field_log_level` - (Required) Field logging level. Valid values: `ALL`, `ERROR`, `NONE`.
+* `exclude_verbose_content` - (Optional) Set to TRUE to exclude sections that contain information such as headers, context, and evaluated mapping templates, regardless of logging  level. Valid values: `true`, `false`. Default value: `false`
+
+### additional_authentication_provider
+
+This argument supports the following arguments:
+
+* `authentication_type` - (Required) Authentication type. Valid values: `API_KEY`, `AWS_IAM`, `AMAZON_COGNITO_USER_POOLS`, `OPENID_CONNECT`, `AWS_LAMBDA`
+* `openid_connect_config` - (Optional) Nested argument containing OpenID Connect configuration. Defined below.
+* `user_pool_config` - (Optional) Amazon Cognito User Pool configuration. Defined below.
+
+### openid_connect_config
+
+This argument supports the following arguments:
+
+* `issuer` - (Required) Issuer for the OpenID Connect configuration. The issuer returned by discovery MUST exactly match the value of iss in the ID Token.
+* `auth_ttl` - (Optional) Number of milliseconds a token is valid after being authenticated.
+* `client_id` - (Optional) Client identifier of the Relying party at the OpenID identity provider. This identifier is typically obtained when the Relying party is registered with the OpenID identity provider. You can specify a regular expression so the AWS AppSync can validate against multiple client identifiers at a time.
+* `iat_ttl` - (Optional) Number of milliseconds a token is valid after being issued to a user.
+
+### user_pool_config
+
+This argument supports the following arguments:
+
+* `default_action` - (Required only if Cognito is used as the default auth provider) Action that you want your GraphQL API to take when a request that uses Amazon Cognito User Pool authentication doesn't match the Amazon Cognito User Pool configuration. Valid: `ALLOW` and `DENY`
+* `user_pool_id` - (Required) User pool ID.
+* `app_id_client_regex` - (Optional) Regular expression for validating the incoming Amazon Cognito User Pool app client ID.
+* `aws_region` - (Optional) AWS region in which the user pool was created.
+
+### lambda_authorizer_config
+
+This argument supports the following arguments:
+
+* `authorizer_uri` - (Required) ARN of the Lambda function to be called for authorization. Note: This Lambda function must have a resource-based policy assigned to it, to allow `lambda:InvokeFunction` from service principal `appsync.amazonaws.com`.
+* `authorizer_result_ttl_in_seconds` - (Optional) Number of seconds a response should be cached for. The default is 5 minutes (300 seconds). The Lambda function can override this by returning a `ttlOverride` key in its response. A value of 0 disables caching of responses. Minimum value of 0. Maximum value of 3600.
+* `identity_validation_expression` - (Optional) Regular expression for validation of tokens before the Lambda function is called.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - API ID
+* `arn` - ARN
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `uris` - Map of URIs associated with the APIE.g., `uris["GRAPHQL"] = https://ID.appsync-api.REGION.amazonaws.com/graphql`
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AppSync GraphQL API using the GraphQL API ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import AppSync GraphQL API using the GraphQL API ID. For example:
+
+```console
+% terraform import aws_appsync_graphql_api.example 0123456789
+```
+
+<!-- cache-key: cdktf-0.18.0 input-604f59c6c350d24f978a0ba94f2c30cf28473a80d9b5a2275a86a5740a4b0ee4 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/appsync_resolver.html.markdown b/website/docs/cdktf/python/r/appsync_resolver.html.markdown
new file mode 100644
index 00000000000..8e474e6478e
--- /dev/null
+++ b/website/docs/cdktf/python/r/appsync_resolver.html.markdown
@@ -0,0 +1,170 @@
+---
+subcategory: "AppSync"
+layout: "aws"
+page_title: "AWS: aws_appsync_resolver"
+description: |-
+  Provides an AppSync Resolver.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_appsync_resolver
+
+Provides an AppSync Resolver.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.appsync_datasource import AppsyncDatasource
+from imports.aws.appsync_graphql_api import AppsyncGraphqlApi
+from imports.aws.appsync_resolver import AppsyncResolver
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        test = AppsyncGraphqlApi(self, "test",
+            authentication_type="API_KEY",
+            name="tf-example",
+            schema="type Mutation {\n\tputPost(id: ID!, title: String!): Post\n}\n\ntype Post {\n\tid: ID!\n\ttitle: String!\n}\n\ntype Query {\n\tsinglePost(id: ID!): Post\n}\n\nschema {\n\tquery: Query\n\tmutation: Mutation\n}\n\n"
+        )
+        AppsyncResolver(self, "Mutation_pipelineTest",
+            api_id=test.id,
+            field="pipelineTest",
+            kind="PIPELINE",
+            pipeline_config=AppsyncResolverPipelineConfig(
+                functions=[test1.function_id, test2.function_id, test3.function_id]
+            ),
+            request_template="{}",
+            response_template="$util.toJson($ctx.result)",
+            type="Mutation"
+        )
+        aws_appsync_datasource_test = AppsyncDatasource(self, "test_2",
+            api_id=test.id,
+            http_config=AppsyncDatasourceHttpConfig(
+                endpoint="http://example.com"
+            ),
+            name="tf_example",
+            type="HTTP"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_appsync_datasource_test.override_logical_id("test")
+        aws_appsync_resolver_test = AppsyncResolver(self, "test_3",
+            api_id=test.id,
+            caching_config=AppsyncResolverCachingConfig(
+                caching_keys=["$context.identity.sub", "$context.arguments.id"],
+                ttl=60
+            ),
+            data_source=Token.as_string(aws_appsync_datasource_test.name),
+            field="singlePost",
+            request_template="{\n    \"version\": \"2018-05-29\",\n    \"method\": \"GET\",\n    \"resourcePath\": \"/\",\n    \"params\":{\n        \"headers\": $utils.http.copyheaders($ctx.request.headers)\n    }\n}\n\n",
+            response_template="#if($ctx.result.statusCode == 200)\n    $ctx.result.body\n#else\n    $utils.appendError($ctx.result.body, $ctx.result.statusCode)\n#end\n\n",
+            type="Query"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_appsync_resolver_test.override_logical_id("test")
+```
+
+## Example Usage JS
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.appsync_resolver import AppsyncResolver
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AppsyncResolver(self, "example",
+            api_id=test.id,
+            code=Token.as_string(Fn.file("some-code-dir")),
+            field="pipelineTest",
+            kind="PIPELINE",
+            pipeline_config=AppsyncResolverPipelineConfig(
+                functions=[Token.as_string(aws_appsync_function_test.function_id)]
+            ),
+            runtime=AppsyncResolverRuntime(
+                name="APPSYNC_JS",
+                runtime_version="1.0.0"
+            ),
+            type="Query"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `api_id` - (Required) API ID for the GraphQL API.
+* `code` - (Optional) The function code that contains the request and response functions. When code is used, the runtime is required. The runtime value must be APPSYNC_JS.
+* `type` - (Required) Type name from the schema defined in the GraphQL API.
+* `field` - (Required) Field name from the schema defined in the GraphQL API.
+* `request_template` - (Optional) Request mapping template for UNIT resolver or 'before mapping template' for PIPELINE resolver. Required for non-Lambda resolvers.
+* `response_template` - (Optional) Response mapping template for UNIT resolver or 'after mapping template' for PIPELINE resolver. Required for non-Lambda resolvers.
+* `data_source` - (Optional) Data source name.
+* `max_batch_size` - (Optional) Maximum batching size for a resolver. Valid values are between `0` and `2000`.
+* `kind`  - (Optional) Resolver type. Valid values are `UNIT` and `PIPELINE`.
+* `sync_config` - (Optional) Describes a Sync configuration for a resolver. See [Sync Config](#sync-config).
+* `pipeline_config` - (Optional) The caching configuration for the resolver. See [Pipeline Config](#pipeline-config).
+* `caching_config` - (Optional) The Caching Config. See [Caching Config](#caching-config).
+* `runtime` - (Optional) Describes a runtime used by an AWS AppSync pipeline resolver or AWS AppSync function. Specifies the name and version of the runtime to use. Note that if a runtime is specified, code must also be specified. See [Runtime](#runtime).
+
+### Caching Config
+
+* `caching_keys` - (Optional) The caching keys for a resolver that has caching activated. Valid values are entries from the $context.arguments, $context.source, and $context.identity maps.
+* `ttl` - (Optional) The TTL in seconds for a resolver that has caching activated. Valid values are between `1` and `3600` seconds.
+
+### Pipeline Config
+
+* `functions` - (Optional) A list of Function objects.
+
+### Sync Config
+
+* `conflict_detection` - (Optional) Conflict Detection strategy to use. Valid values are `NONE` and `VERSION`.
+* `conflict_handler` - (Optional) Conflict Resolution strategy to perform in the event of a conflict. Valid values are `NONE`, `OPTIMISTIC_CONCURRENCY`, `AUTOMERGE`, and `LAMBDA`.
+* `lambda_conflict_handler_config` - (Optional) Lambda Conflict Handler Config when configuring `LAMBDA` as the Conflict Handler. See [Lambda Conflict Handler Config](#lambda-conflict-handler-config).
+
+#### Lambda Conflict Handler Config
+
+* `lambda_conflict_handler_arn` - (Optional) ARN for the Lambda function to use as the Conflict Handler.
+
+### Runtime
+
+* `name` - (Optional) The name of the runtime to use. Currently, the only allowed value is `APPSYNC_JS`.
+* `runtime_version` - (Optional) The version of the runtime to use. Currently, the only allowed version is `1.0.0`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_appsync_resolver` using the `api_id`, a hyphen, `type`, a hypen and `field`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_appsync_resolver` using the `api_id`, a hyphen, `type`, a hypen and `field`. For example:
+
+```console
+% terraform import aws_appsync_resolver.example abcdef123456-exampleType-exampleField
+```
+
+<!-- cache-key: cdktf-0.18.0 input-c52e7e65e799b6104f6c311a148eb1f52433b7035e764e94e6ade1153f6ef6e4 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/appsync_type.html.markdown b/website/docs/cdktf/python/r/appsync_type.html.markdown
new file mode 100644
index 00000000000..c208e31eee4
--- /dev/null
+++ b/website/docs/cdktf/python/r/appsync_type.html.markdown
@@ -0,0 +1,79 @@
+---
+subcategory: "AppSync"
+layout: "aws"
+page_title: "AWS: aws_appsync_type"
+description: |-
+  Provides an AppSync Type.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_appsync_type
+
+Provides an AppSync Type.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.appsync_graphql_api import AppsyncGraphqlApi
+from imports.aws.appsync_type import AppsyncType
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = AppsyncGraphqlApi(self, "example",
+            authentication_type="API_KEY",
+            name="example"
+        )
+        aws_appsync_type_example = AppsyncType(self, "example_1",
+            api_id=example.id,
+            definition="type Mutation\n\n{\nputPost(id: ID!,title: String! ): Post\n\n}\n\n",
+            format="SDL"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_appsync_type_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `api_id` - (Required) GraphQL API ID.
+* `format` - (Required) The type format: `SDL` or `JSON`.
+* `definition` - (Required) The type definition.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the type.
+* `description` - The type description.
+* `id` - The ID is constructed from `api-id:format:name`.
+* `name` - The type name.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Appsync Types using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Appsync Types using the `id`. For example:
+
+```console
+% terraform import aws_appsync_type.example api-id:format:name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-583d1e739ac827e753ccd0e8ee386fa69ac34d8c7a9c5385c707c9de6772d943 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/athena_data_catalog.html.markdown b/website/docs/cdktf/python/r/athena_data_catalog.html.markdown
new file mode 100644
index 00000000000..edc2f6a58e6
--- /dev/null
+++ b/website/docs/cdktf/python/r/athena_data_catalog.html.markdown
@@ -0,0 +1,156 @@
+---
+subcategory: "Athena"
+layout: "aws"
+page_title: "AWS: aws_athena_data_catalog"
+description: |-
+  Provides an Athena data catalog.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_athena_data_catalog
+
+Provides an Athena data catalog.
+
+More information about Athena and Athena data catalogs can be found in the [Athena User Guide](https://docs.aws.amazon.com/athena/latest/ug/what-is.html).
+
+-> **Tip:** for a more detailed explanation on the usage of `parameters`, see the [DataCatalog API documentation](https://docs.aws.amazon.com/athena/latest/APIReference/API_DataCatalog.html)
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.athena_data_catalog import AthenaDataCatalog
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AthenaDataCatalog(self, "example",
+            description="Example Athena data catalog",
+            name="athena-data-catalog",
+            parameters={
+                "function": "arn:aws:lambda:eu-central-1:123456789012:function:not-important-lambda-function"
+            },
+            tags={
+                "Name": "example-athena-data-catalog"
+            },
+            type="LAMBDA"
+        )
+```
+
+### Hive based Data Catalog
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.athena_data_catalog import AthenaDataCatalog
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AthenaDataCatalog(self, "example",
+            description="Hive based Data Catalog",
+            name="hive-data-catalog",
+            parameters={
+                "metadata-function": "arn:aws:lambda:eu-central-1:123456789012:function:not-important-lambda-function"
+            },
+            type="HIVE"
+        )
+```
+
+### Glue based Data Catalog
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.athena_data_catalog import AthenaDataCatalog
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AthenaDataCatalog(self, "example",
+            description="Glue based Data Catalog",
+            name="glue-data-catalog",
+            parameters={
+                "catalog-id": "123456789012"
+            },
+            type="GLUE"
+        )
+```
+
+### Lambda based Data Catalog
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.athena_data_catalog import AthenaDataCatalog
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AthenaDataCatalog(self, "example",
+            description="Lambda based Data Catalog",
+            name="lambda-data-catalog",
+            parameters={
+                "metadata-function": "arn:aws:lambda:eu-central-1:123456789012:function:not-important-lambda-function-1",
+                "record-function": "arn:aws:lambda:eu-central-1:123456789012:function:not-important-lambda-function-2"
+            },
+            type="LAMBDA"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+- `name` - (Required) Name of the data catalog. The catalog name must be unique for the AWS account and can use a maximum of 128 alphanumeric, underscore, at sign, or hyphen characters.
+- `type` - (Required) Type of data catalog: `LAMBDA` for a federated catalog, `GLUE` for AWS Glue Catalog, or `HIVE` for an external hive metastore.
+- `parameters` - (Required) Key value pairs that specifies the Lambda function or functions to use for the data catalog. The mapping used depends on the catalog type.
+- `description` - (Required) Description of the data catalog.
+- `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+- `id` - Name of the data catalog.
+- `arn` - ARN of the data catalog.
+- `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import data catalogs using their `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import data catalogs using their `name`. For example:
+
+```console
+% terraform import aws_athena_data_catalog.example example-data-catalog
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ca384d0d131eb64581ab0b3c036a49902737674d63de3f2960c9f3aa9b8f446f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/athena_database.html.markdown b/website/docs/cdktf/python/r/athena_database.html.markdown
new file mode 100644
index 00000000000..b9654b2d47a
--- /dev/null
+++ b/website/docs/cdktf/python/r/athena_database.html.markdown
@@ -0,0 +1,114 @@
+---
+subcategory: "Athena"
+layout: "aws"
+page_title: "AWS: aws_athena_database"
+description: |-
+  Provides an Athena database.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_athena_database
+
+Provides an Athena database.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.athena_database import AthenaDatabase
+from imports.aws.s3_bucket import S3Bucket
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = S3Bucket(self, "example",
+            bucket="example"
+        )
+        aws_athena_database_example = AthenaDatabase(self, "example_1",
+            bucket=example.id,
+            name="database_name"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_athena_database_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `bucket` - (Required) Name of S3 bucket to save the results of the query execution.
+* `name` - (Required) Name of the database to create.
+* `acl_configuration` - (Optional) That an Amazon S3 canned ACL should be set to control ownership of stored query results. See [ACL Configuration](#acl-configuration) below.
+* `comment` - (Optional) Description of the database.
+* `encryption_configuration` - (Optional) Encryption key block AWS Athena uses to decrypt the data in S3, such as an AWS Key Management Service (AWS KMS) key. See [Encryption Configuration](#encryption-configuration) below.
+* `expected_bucket_owner` - (Optional) AWS account ID that you expect to be the owner of the Amazon S3 bucket.
+* `force_destroy` - (Optional, Default: false) Boolean that indicates all tables should be deleted from the database so that the database can be destroyed without error. The tables are *not* recoverable.
+* `properties` - (Optional) Key-value map of custom metadata properties for the database definition.
+
+### ACL Configuration
+
+* `s3_acl_option` - (Required) Amazon S3 canned ACL that Athena should specify when storing query results. Valid value is `BUCKET_OWNER_FULL_CONTROL`.
+
+~> **NOTE:** When Athena queries are executed, result files may be created in the specified bucket. Consider using `force_destroy` on the bucket too in order to avoid any problems when destroying the bucket.  
+
+### Encryption Configuration
+
+* `encryption_option` - (Required) Type of key; one of `SSE_S3`, `SSE_KMS`, `CSE_KMS`
+* `kms_key` - (Optional) KMS key ARN or ID; required for key types `SSE_KMS` and `CSE_KMS`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Database name
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Athena Databases using their name. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Athena Databases using their name. For example:
+
+```console
+% terraform import aws_athena_database.example example
+```
+
+Certain resource arguments, like `encryption_configuration` and `bucket`, do not have an API method for reading the information after creation. If the argument is set in the Terraform configuration on an imported resource, Terraform will always show a difference. To workaround this behavior, either omit the argument from the Terraform configuration or use [`ignore_changes`](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html#ignore_changes) to hide the difference. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from cdktf import TerraformResourceLifecycle
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.athena_database import AthenaDatabase
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AthenaDatabase(self, "example",
+            bucket=Token.as_string(aws_s3_bucket_example.id),
+            lifecycle=TerraformResourceLifecycle(
+                ignore_changes=[bucket]
+            ),
+            name="database_name"
+        )
+```
+
+<!-- cache-key: cdktf-0.18.0 input-189ae35c915899617823f1aa58e52b808e9d89a93ad41348d3b67590fd2c7244 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/athena_named_query.html.markdown b/website/docs/cdktf/python/r/athena_named_query.html.markdown
new file mode 100644
index 00000000000..7a304f474ca
--- /dev/null
+++ b/website/docs/cdktf/python/r/athena_named_query.html.markdown
@@ -0,0 +1,102 @@
+---
+subcategory: "Athena"
+layout: "aws"
+page_title: "AWS: aws_athena_named_query"
+description: |-
+  Provides an Athena Named Query resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_athena_named_query
+
+Provides an Athena Named Query resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.athena_database import AthenaDatabase
+from imports.aws.athena_named_query import AthenaNamedQuery
+from imports.aws.athena_workgroup import AthenaWorkgroup
+from imports.aws.kms_key import KmsKey
+from imports.aws.s3_bucket import S3Bucket
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        test = KmsKey(self, "test",
+            deletion_window_in_days=7,
+            description="Athena KMS Key"
+        )
+        hoge = S3Bucket(self, "hoge",
+            bucket="tf-test"
+        )
+        aws_athena_database_hoge = AthenaDatabase(self, "hoge_2",
+            bucket=hoge.id,
+            name="users"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_athena_database_hoge.override_logical_id("hoge")
+        aws_athena_workgroup_test = AthenaWorkgroup(self, "test_3",
+            configuration=AthenaWorkgroupConfiguration(
+                result_configuration=AthenaWorkgroupConfigurationResultConfiguration(
+                    encryption_configuration=AthenaWorkgroupConfigurationResultConfigurationEncryptionConfiguration(
+                        encryption_option="SSE_KMS",
+                        kms_key_arn=test.arn
+                    )
+                )
+            ),
+            name="example"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_athena_workgroup_test.override_logical_id("test")
+        AthenaNamedQuery(self, "foo",
+            database=Token.as_string(aws_athena_database_hoge.name),
+            name="bar",
+            query="SELECT * FROM ${" + aws_athena_database_hoge.name + "} limit 10;",
+            workgroup=Token.as_string(aws_athena_workgroup_test.id)
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) Plain language name for the query. Maximum length of 128.
+* `workgroup` - (Optional) Workgroup to which the query belongs. Defaults to `primary`
+* `database` - (Required) Database to which the query belongs.
+* `query` - (Required) Text of the query itself. In other words, all query statements. Maximum length of 262144.
+* `description` - (Optional) Brief explanation of the query. Maximum length of 1024.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Unique ID of the query.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Athena Named Query using the query ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Athena Named Query using the query ID. For example:
+
+```console
+% terraform import aws_athena_named_query.example 0123456789
+```
+
+<!-- cache-key: cdktf-0.18.0 input-47b0d06df589479137354b1a06a5e12352b544e95a27f4e5bc2dec9fa0224790 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/athena_workgroup.html.markdown b/website/docs/cdktf/python/r/athena_workgroup.html.markdown
new file mode 100644
index 00000000000..394b8531bb4
--- /dev/null
+++ b/website/docs/cdktf/python/r/athena_workgroup.html.markdown
@@ -0,0 +1,116 @@
+---
+subcategory: "Athena"
+layout: "aws"
+page_title: "AWS: aws_athena_workgroup"
+description: |-
+  Manages an Athena Workgroup.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_athena_workgroup
+
+Provides an Athena Workgroup.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.athena_workgroup import AthenaWorkgroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AthenaWorkgroup(self, "example",
+            configuration=AthenaWorkgroupConfiguration(
+                enforce_workgroup_configuration=True,
+                publish_cloudwatch_metrics_enabled=True,
+                result_configuration=AthenaWorkgroupConfigurationResultConfiguration(
+                    encryption_configuration=AthenaWorkgroupConfigurationResultConfigurationEncryptionConfiguration(
+                        encryption_option="SSE_KMS",
+                        kms_key_arn=Token.as_string(aws_kms_key_example.arn)
+                    ),
+                    output_location="s3://${" + aws_s3_bucket_example.bucket + "}/output/"
+                )
+            ),
+            name="example"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) Name of the workgroup.
+* `configuration` - (Optional) Configuration block with various settings for the workgroup. Documented below.
+* `description` - (Optional) Description of the workgroup.
+* `state` - (Optional) State of the workgroup. Valid values are `DISABLED` or `ENABLED`. Defaults to `ENABLED`.
+* `tags` - (Optional) Key-value map of resource tags for the workgroup. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `force_destroy` - (Optional) Option to delete the workgroup and its contents even if the workgroup contains any named queries.
+
+### Configuration
+
+* `bytes_scanned_cutoff_per_query` - (Optional) Integer for the upper data usage limit (cutoff) for the amount of bytes a single query in a workgroup is allowed to scan. Must be at least `10485760`.
+* `enforce_workgroup_configuration` - (Optional) Boolean whether the settings for the workgroup override client-side settings. For more information, see [Workgroup Settings Override Client-Side Settings](https://docs.aws.amazon.com/athena/latest/ug/workgroups-settings-override.html). Defaults to `true`.
+* `engine_version` - (Optional) Configuration block for the Athena Engine Versioning. For more information, see [Athena Engine Versioning](https://docs.aws.amazon.com/athena/latest/ug/engine-versions.html). See [Engine Version](#engine-version) below.
+* `execution_role` - (Optional) Role used in a notebook session for accessing the user's resources.
+* `publish_cloudwatch_metrics_enabled` - (Optional) Boolean whether Amazon CloudWatch metrics are enabled for the workgroup. Defaults to `true`.
+* `result_configuration` - (Optional) Configuration block with result settings. See [Result Configuration](#result-configuration) below.
+* `requester_pays_enabled` - (Optional) If set to true , allows members assigned to a workgroup to reference Amazon S3 Requester Pays buckets in queries. If set to false , workgroup members cannot query data from Requester Pays buckets, and queries that retrieve data from Requester Pays buckets cause an error. The default is false . For more information about Requester Pays buckets, see [Requester Pays Buckets](https://docs.aws.amazon.com/AmazonS3/latest/dev/RequesterPaysBuckets.html) in the Amazon Simple Storage Service Developer Guide.
+
+#### Engine Version
+
+* `selected_engine_version` - (Optional) Requested engine version. Defaults to `AUTO`.
+
+#### Result Configuration
+
+* `encryption_configuration` - (Optional) Configuration block with encryption settings. See [Encryption Configuration](#encryption-configuration) below.
+* `acl_configuration` - (Optional) That an Amazon S3 canned ACL should be set to control ownership of stored query results. See [ACL Configuration](#acl-configuration) below.
+* `expected_bucket_owner` - (Optional) AWS account ID that you expect to be the owner of the Amazon S3 bucket.
+* `output_location` - (Optional) Location in Amazon S3 where your query results are stored, such as `s3://path/to/query/bucket/`. For more information, see [Queries and Query Result Files](https://docs.aws.amazon.com/athena/latest/ug/querying.html).
+
+##### ACL Configuration
+
+* `s3_acl_option` - (Required) Amazon S3 canned ACL that Athena should specify when storing query results. Valid value is `BUCKET_OWNER_FULL_CONTROL`.
+
+##### Encryption Configuration
+
+* `encryption_option` - (Required) Whether Amazon S3 server-side encryption with Amazon S3-managed keys (`SSE_S3`), server-side encryption with KMS-managed keys (`SSE_KMS`), or client-side encryption with KMS-managed keys (`CSE_KMS`) is used. If a query runs in a workgroup and the workgroup overrides client-side settings, then the workgroup's setting for encryption is used. It specifies whether query results must be encrypted, for all queries that run in this workgroup.
+* `kms_key_arn` - (Optional) For `SSE_KMS` and `CSE_KMS`, this is the KMS key ARN.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the workgroup
+* `configuration` - Configuration block with various settings for the workgroup
+    * `engine_version` - Configuration block for the Athena Engine Versioning
+        * `effective_engine_version` -  The engine version on which the query runs. If `selected_engine_version` is set to `AUTO`, the effective engine version is chosen by Athena.
+* `id` - Workgroup name
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Athena Workgroups using their name. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Athena Workgroups using their name. For example:
+
+```console
+% terraform import aws_athena_workgroup.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-c130731e53530304eb8b07566132f6c077365dfdbf8f6396690cec4300991bd4 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/auditmanager_account_registration.html.markdown b/website/docs/cdktf/python/r/auditmanager_account_registration.html.markdown
new file mode 100644
index 00000000000..c4f3a47f42b
--- /dev/null
+++ b/website/docs/cdktf/python/r/auditmanager_account_registration.html.markdown
@@ -0,0 +1,87 @@
+---
+subcategory: "Audit Manager"
+layout: "aws"
+page_title: "AWS: aws_auditmanager_account_registration"
+description: |-
+  Terraform resource for managing AWS Audit Manager Account Registration.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_auditmanager_account_registration
+
+Terraform resource for managing AWS Audit Manager Account Registration.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.auditmanager_account_registration import AuditmanagerAccountRegistration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AuditmanagerAccountRegistration(self, "example")
+```
+
+### Deregister On Destroy
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.auditmanager_account_registration import AuditmanagerAccountRegistration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AuditmanagerAccountRegistration(self, "example",
+            deregister_on_destroy=True
+        )
+```
+
+## Argument Reference
+
+The following arguments are optional:
+
+* `delegated_admin_account` - (Optional) Identifier for the delegated administrator account.
+* `deregister_on_destroy` - (Optional) Flag to deregister AuditManager in the account upon destruction. Defaults to `false` (ie. AuditManager will remain active in the account, even if this resource is removed).
+* `kms_key` - (Optional) KMS key identifier.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Unique identifier for the account registration. Since registration is applied per AWS region, this will be the active region name (ex. `us-east-1`).
+* `status` - Status of the account registration request.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Audit Manager Account Registration resources using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Audit Manager Account Registration resources using the `id`. For example:
+
+```console
+% terraform import aws_auditmanager_account_registration.example us-east-1
+```
+
+<!-- cache-key: cdktf-0.18.0 input-b8a8e96a39604df1b10232cf4a3d5b9b1cb58ec03eaacfe07b1799eb42bf2279 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/auditmanager_assessment.html.markdown b/website/docs/cdktf/python/r/auditmanager_assessment.html.markdown
new file mode 100644
index 00000000000..deb4cece494
--- /dev/null
+++ b/website/docs/cdktf/python/r/auditmanager_assessment.html.markdown
@@ -0,0 +1,124 @@
+---
+subcategory: "Audit Manager"
+layout: "aws"
+page_title: "AWS: aws_auditmanager_assessment"
+description: |-
+  Terraform resource for managing an AWS Audit Manager Assessment.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_auditmanager_assessment
+
+Terraform resource for managing an AWS Audit Manager Assessment.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.auditmanager_assessment import AuditmanagerAssessment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AuditmanagerAssessment(self, "test",
+            assessment_reports_destination=[AuditmanagerAssessmentAssessmentReportsDestination(
+                destination="s3://${" + aws_s3_bucket_test.id + "}",
+                destination_type="S3"
+            )
+            ],
+            framework_id=Token.as_string(aws_auditmanager_framework_test.id),
+            name="example",
+            roles=[AuditmanagerAssessmentRoles(
+                role_arn=Token.as_string(aws_iam_role_test.arn),
+                role_type="PROCESS_OWNER"
+            )
+            ],
+            scope=[AuditmanagerAssessmentScope(
+                aws_accounts=[AuditmanagerAssessmentScopeAwsAccounts(
+                    id=Token.as_string(current.account_id)
+                )
+                ],
+                aws_services=[AuditmanagerAssessmentScopeAwsServices(
+                    service_name="S3"
+                )
+                ]
+            )
+            ]
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) Name of the assessment.
+* `assessment_reports_destination` - (Required) Assessment report storage destination configuration. See [`assessment_reports_destination`](#assessment_reports_destination) below.
+* `framework_id` - (Required) Unique identifier of the framework the assessment will be created from.
+* `roles` - (Required) List of roles for the assessment. See [`roles`](#roles) below.
+* `scope` - (Required) Amazon Web Services accounts and services that are in scope for the assessment. See [`scope`](#scope) below.
+
+The following arguments are optional:
+
+* `description` - (Optional) Description of the assessment.
+* `tags` - (Optional) A map of tags to assign to the assessment. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### assessment_reports_destination
+
+* `destination` - (Required) Destination of the assessment report. This value be in the form `s3://{bucket_name}`.
+* `destination_type` - (Required) Destination type. Currently, `S3` is the only valid value.
+
+### roles
+
+* `role_arn` - (Required) Amazon Resource Name (ARN) of the IAM role.
+* `role_type` - (Required) Type of customer persona. For assessment creation, type must always be `PROCESS_OWNER`.
+
+### scope
+
+* `aws_accounts` - Amazon Web Services accounts that are in scope for the assessment. See [`aws_accounts`](#aws_accounts) below.
+* `aws_services` - Amazon Web Services services that are included in the scope of the assessment. See [`aws_services`](#aws_services) below.
+
+### aws_accounts
+
+* `id` - (Required) Identifier for the Amazon Web Services account.
+
+### aws_services
+
+* `service_name` - (Required) Name of the Amazon Web Service.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the assessment.
+* `id` - Unique identifier for the assessment.
+* `roles_all` - Complete list of all roles with access to the assessment. This includes both roles explicitly configured via the `roles` block, and any roles which have access to all Audit Manager assessments by default.
+* `status` - Status of the assessment. Valid values are `ACTIVE` and `INACTIVE`.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Audit Manager Assessments using the assessment `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Audit Manager Assessments using the assessment `id`. For example:
+
+```console
+% terraform import aws_auditmanager_assessment.example abc123-de45
+```
+
+<!-- cache-key: cdktf-0.18.0 input-aa1e0891f6ec8901473fa207078140ea42269fbcc18c7cea3c07e91aa207dcb8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/auditmanager_assessment_delegation.html.markdown b/website/docs/cdktf/python/r/auditmanager_assessment_delegation.html.markdown
new file mode 100644
index 00000000000..e25198b1882
--- /dev/null
+++ b/website/docs/cdktf/python/r/auditmanager_assessment_delegation.html.markdown
@@ -0,0 +1,79 @@
+---
+subcategory: "Audit Manager"
+layout: "aws"
+page_title: "AWS: aws_auditmanager_assessment_delegation"
+description: |-
+  Terraform resource for managing an AWS Audit Manager Assessment Delegation.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_auditmanager_assessment_delegation
+
+Terraform resource for managing an AWS Audit Manager Assessment Delegation.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.auditmanager_assessment_delegation import AuditmanagerAssessmentDelegation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AuditmanagerAssessmentDelegation(self, "example",
+            assessment_id=Token.as_string(aws_auditmanager_assessment_example.id),
+            control_set_id="example",
+            role_arn=Token.as_string(aws_iam_role_example.arn),
+            role_type="RESOURCE_OWNER"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `assessment_id` - (Required) Identifier for the assessment.
+* `control_set_id` - (Required) Assessment control set name. This value is the control set name used during assessment creation (not the AWS-generated ID). The `_id` suffix on this attribute has been preserved to be consistent with the underlying AWS API.
+* `role_arn` - (Required) Amazon Resource Name (ARN) of the IAM role.
+* `role_type` - (Required) Type of customer persona. For assessment delegation, type must always be `RESOURCE_OWNER`.
+
+The following arguments are optional:
+
+* `comment` - (Optional) Comment describing the delegation request.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `delegation_id` - Unique identifier for the delegation.
+* `id` - Unique identifier for the resource. This is a comma-separated string containing `assessment_id`, `role_arn`, and `control_set_id`.
+* `status` - Status of the delegation.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Audit Manager Assessment Delegation using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Audit Manager Assessment Delegation using the `id`. For example:
+
+```console
+% terraform import aws_auditmanager_assessment_delegation.example abcdef-123456,arn:aws:iam::012345678901:role/example,example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-a28cb94ff95d8ebfec7195b030654929667d5f4188784ab4f4a6c94229437e4d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/auditmanager_assessment_report.html.markdown b/website/docs/cdktf/python/r/auditmanager_assessment_report.html.markdown
new file mode 100644
index 00000000000..7b856f33d29
--- /dev/null
+++ b/website/docs/cdktf/python/r/auditmanager_assessment_report.html.markdown
@@ -0,0 +1,75 @@
+---
+subcategory: "Audit Manager"
+layout: "aws"
+page_title: "AWS: aws_auditmanager_assessment_report"
+description: |-
+  Terraform resource for managing an AWS Audit Manager Assessment Report.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_auditmanager_assessment_report
+
+Terraform resource for managing an AWS Audit Manager Assessment Report.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.auditmanager_assessment_report import AuditmanagerAssessmentReport
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AuditmanagerAssessmentReport(self, "test",
+            assessment_id=Token.as_string(aws_auditmanager_assessment_test.id),
+            name="example"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) Name of the assessment report.
+* `assessment_id` - (Required) Unique identifier of the assessment to create the report from.
+
+The following arguments are optional:
+
+* `description` - (Optional) Description of the assessment report.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `author` - Name of the user who created the assessment report.
+* `id` - Unique identifier for the assessment report.
+* `status` - Current status of the specified assessment report. Valid values are `COMPLETE`, `IN_PROGRESS`, and `FAILED`.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Audit Manager Assessment Reports using the assessment report `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Audit Manager Assessment Reports using the assessment report `id`. For example:
+
+```console
+% terraform import aws_auditmanager_assessment_report.example abc123-de45
+```
+
+<!-- cache-key: cdktf-0.18.0 input-6b338b1bd64119b10018fd9c9f0d34c39bf215e8e6866aa5aefd18459615b30e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/auditmanager_control.html.markdown b/website/docs/cdktf/python/r/auditmanager_control.html.markdown
new file mode 100644
index 00000000000..29991f911db
--- /dev/null
+++ b/website/docs/cdktf/python/r/auditmanager_control.html.markdown
@@ -0,0 +1,107 @@
+---
+subcategory: "Audit Manager"
+layout: "aws"
+page_title: "AWS: aws_auditmanager_control"
+description: |-
+  Terraform resource for managing an AWS Audit Manager Control.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_auditmanager_control
+
+Terraform resource for managing an AWS Audit Manager Control.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.auditmanager_control import AuditmanagerControl
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AuditmanagerControl(self, "example",
+            control_mapping_sources=[AuditmanagerControlControlMappingSources(
+                source_name="example",
+                source_set_up_option="Procedural_Controls_Mapping",
+                source_type="MANUAL"
+            )
+            ],
+            name="example"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) Name of the control.
+* `control_mapping_sources` - (Required) Data mapping sources. See [`control_mapping_sources`](#control_mapping_sources) below.
+
+The following arguments are optional:
+
+* `action_plan_instructions` - (Optional) Recommended actions to carry out if the control isn't fulfilled.
+* `action_plan_title` - (Optional) Title of the action plan for remediating the control.
+* `description` - (Optional) Description of the control.
+* `tags` - (Optional) A map of tags to assign to the control. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `testing_information` - (Optional) Steps to follow to determine if the control is satisfied.
+
+### control_mapping_sources
+
+The following arguments are required:
+
+* `source_name` - (Required) Name of the source.
+* `source_set_up_option` - (Required) The setup option for the data source. This option reflects if the evidence collection is automated or manual. Valid values are `System_Controls_Mapping` (automated) and `Procedural_Controls_Mapping` (manual).
+* `source_type` - (Required) Type of data source for evidence collection. If `source_set_up_option` is manual, the only valid value is `MANUAL`. If `source_set_up_option` is automated, valid values are `AWS_Cloudtrail`, `AWS_Config`, `AWS_Security_Hub`, or `AWS_API_Call`.
+
+The following arguments are optional:
+
+* `source_description` - (Optional) Description of the source.
+* `source_frequency` - (Optional) Frequency of evidence collection. Valid values are `DAILY`, `WEEKLY`, or `MONTHLY`.
+* `source_keyword` - (Optional) The keyword to search for in CloudTrail logs, Config rules, Security Hub checks, and Amazon Web Services API names. See [`source_keyword`](#source_keyword) below.
+* `troubleshooting_text` - (Optional) Instructions for troubleshooting the control.
+
+### source_keyword
+
+The following arguments are required:
+
+* `keyword_input_type` - (Required) Input method for the keyword. Valid values are `SELECT_FROM_LIST`.
+* `keyword_value` - (Required) The value of the keyword that's used when mapping a control data source. For example, this can be a CloudTrail event name, a rule name for Config, a Security Hub control, or the name of an Amazon Web Services API call. See the [Audit Manager supported control data sources documentation](https://docs.aws.amazon.com/audit-manager/latest/userguide/control-data-sources.html) for more information.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the control.
+* `control_mapping_sources.*.source_id` - Unique identifier for the source.
+* `id` - Unique identifier for the control.
+* `type` - Type of control, such as a custom control or a standard control.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import an Audit Manager Control using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import an Audit Manager Control using the `id`. For example:
+
+```console
+% terraform import aws_auditmanager_control.example abc123-de45
+```
+
+<!-- cache-key: cdktf-0.18.0 input-b868688bbd20f6d5af9ab3798d86ae2370658daf4faa22e5cee0ffe9436e3cc0 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/auditmanager_framework.html.markdown b/website/docs/cdktf/python/r/auditmanager_framework.html.markdown
new file mode 100644
index 00000000000..3de05201933
--- /dev/null
+++ b/website/docs/cdktf/python/r/auditmanager_framework.html.markdown
@@ -0,0 +1,94 @@
+---
+subcategory: "Audit Manager"
+layout: "aws"
+page_title: "AWS: aws_auditmanager_framework"
+description: |-
+  Terraform resource for managing an AWS Audit Manager Framework.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_auditmanager_framework
+
+Terraform resource for managing an AWS Audit Manager Framework.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.auditmanager_framework import AuditmanagerFramework
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AuditmanagerFramework(self, "test",
+            control_sets=[AuditmanagerFrameworkControlSets(
+                controls=[AuditmanagerFrameworkControlSetsControls(
+                    id=Token.as_string(aws_auditmanager_control_test.id)
+                )
+                ],
+                name="example"
+            )
+            ],
+            name="example"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) Name of the framework.
+* `control_sets` - (Required) Control sets that are associated with the framework. See [`control_sets`](#control_sets) below.
+
+The following arguments are optional:
+
+* `compliance_type` - (Optional) Compliance type that the new custom framework supports, such as `CIS` or `HIPAA`.
+* `description` - (Optional) Description of the framework.
+* `tags` - (Optional) A map of tags to assign to the framework. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### control_sets
+
+* `name` - (Required) Name of the control set.
+* `controls` - (Required) List of controls within the control set. See [`controls`](#controls) below.
+
+### controls
+
+* `id` - (Required) Unique identifier of the control.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the framework.
+* `control_sets[*].id` - Unique identifier for the framework control set.
+* `id` - Unique identifier for the framework.
+* `framework_type` - Framework type, such as a custom framework or a standard framework.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Audit Manager Framework using the framework `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Audit Manager Framework using the framework `id`. For example:
+
+```console
+% terraform import aws_auditmanager_framework.example abc123-de45
+```
+
+<!-- cache-key: cdktf-0.18.0 input-821a948286ad3665c063ce96f7b07cc9d38f2a8d5044bfae6a4c6b6094687367 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/auditmanager_framework_share.html.markdown b/website/docs/cdktf/python/r/auditmanager_framework_share.html.markdown
new file mode 100644
index 00000000000..4b1c0518656
--- /dev/null
+++ b/website/docs/cdktf/python/r/auditmanager_framework_share.html.markdown
@@ -0,0 +1,76 @@
+---
+subcategory: "Audit Manager"
+layout: "aws"
+page_title: "AWS: aws_auditmanager_framework_share"
+description: |-
+  Terraform resource for managing an AWS Audit Manager Framework Share.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_auditmanager_framework_share
+
+Terraform resource for managing an AWS Audit Manager Framework Share.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.auditmanager_framework_share import AuditmanagerFrameworkShare
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AuditmanagerFrameworkShare(self, "example",
+            destination_account="012345678901",
+            destination_region="us-east-1",
+            framework_id=Token.as_string(aws_auditmanager_framework_example.id)
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `destination_account` - (Required) Amazon Web Services account of the recipient.
+* `destination_region` - (Required) Amazon Web Services region of the recipient.
+* `framework_id` - (Required) Unique identifier for the shared custom framework.
+
+The following arguments are optional:
+
+* `comment` - (Optional) Comment from the sender about the share request.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Unique identifier for the share request.
+* `status` -  Status of the share request.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Audit Manager Framework Share using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Audit Manager Framework Share using the `id`. For example:
+
+```console
+% terraform import aws_auditmanager_framework_share.example abcdef-123456
+```
+
+<!-- cache-key: cdktf-0.18.0 input-14d7a2ed97dee3206ec0e19704aeaa2d131932ec24b406ef4fff013eeb7c1aba -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/auditmanager_organization_admin_account_registration.html.markdown b/website/docs/cdktf/python/r/auditmanager_organization_admin_account_registration.html.markdown
new file mode 100644
index 00000000000..8cee861ee01
--- /dev/null
+++ b/website/docs/cdktf/python/r/auditmanager_organization_admin_account_registration.html.markdown
@@ -0,0 +1,68 @@
+---
+subcategory: "Audit Manager"
+layout: "aws"
+page_title: "AWS: aws_auditmanager_organization_admin_account_registration"
+description: |-
+  Terraform resource for managing AWS Audit Manager Organization Admin Account Registration.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_auditmanager_organization_admin_account_registration
+
+Terraform resource for managing AWS Audit Manager Organization Admin Account Registration.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.auditmanager_organization_admin_account_registration import AuditmanagerOrganizationAdminAccountRegistration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AuditmanagerOrganizationAdminAccountRegistration(self, "example",
+            admin_account_id="012345678901"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `admin_account_id` - (Required) Identifier for the organization administrator account.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Identifier for the organization administrator account.
+* `organization_id` - Identifier for the organization.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Audit Manager Organization Admin Account Registration using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Audit Manager Organization Admin Account Registration using the `id`. For example:
+
+```console
+% terraform import aws_auditmanager_organization_admin_account_registration.example 012345678901 
+```
+
+<!-- cache-key: cdktf-0.18.0 input-73a8d01ece65d6322ccb932f7e3936fdefadced313d0732bd4dd6da49b4ca658 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/autoscaling_attachment.html.markdown b/website/docs/cdktf/python/r/autoscaling_attachment.html.markdown
new file mode 100644
index 00000000000..de33fc6bc87
--- /dev/null
+++ b/website/docs/cdktf/python/r/autoscaling_attachment.html.markdown
@@ -0,0 +1,67 @@
+---
+subcategory: "Auto Scaling"
+layout: "aws"
+page_title: "AWS: aws_autoscaling_attachment"
+description: |-
+  Terraform resource for managing an AWS Auto Scaling Attachment.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_autoscaling_attachment
+
+Attaches a load balancer to an Auto Scaling group.
+
+~> **NOTE on Auto Scaling Groups, Attachments and Traffic Source Attachments:** Terraform provides standalone Attachment (for attaching Classic Load Balancers and Application Load Balancer, Gateway Load Balancer, or Network Load Balancer target groups) and [Traffic Source Attachment](autoscaling_traffic_source_attachment.html) (for attaching Load Balancers and VPC Lattice target groups) resources and an [Auto Scaling Group](autoscaling_group.html) resource with `load_balancers`, `target_group_arns` and `traffic_source` attributes. Do not use the same traffic source in more than one of these resources. Doing so will cause a conflict of attachments. A [`lifecycle` configuration block](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html) can be used to suppress differences if necessary.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.autoscaling_attachment import AutoscalingAttachment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AutoscalingAttachment(self, "example",
+            autoscaling_group_name=Token.as_string(aws_autoscaling_group_example.id),
+            elb=Token.as_string(aws_elb_example.id)
+        )
+```
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.autoscaling_attachment import AutoscalingAttachment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AutoscalingAttachment(self, "example",
+            autoscaling_group_name=Token.as_string(aws_autoscaling_group_example.id),
+            lb_target_group_arn=Token.as_string(aws_lb_target_group_example.arn)
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `autoscaling_group_name` - (Required) Name of ASG to associate with the ELB.
+* `elb` - (Optional) Name of the ELB.
+* `lb_target_group_arn` - (Optional) ARN of a load balancer target group.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+<!-- cache-key: cdktf-0.18.0 input-3767bb40f260f9b690b5ce54548d1dacba1a025bee3fd0c8617e2820d6db1a21 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/autoscaling_group.html.markdown b/website/docs/cdktf/python/r/autoscaling_group.html.markdown
new file mode 100644
index 00000000000..7454e2ed427
--- /dev/null
+++ b/website/docs/cdktf/python/r/autoscaling_group.html.markdown
@@ -0,0 +1,914 @@
+---
+subcategory: "Auto Scaling"
+layout: "aws"
+page_title: "AWS: aws_autoscaling_group"
+description: |-
+  Provides an Auto Scaling Group resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_autoscaling_group
+
+Provides an Auto Scaling Group resource.
+
+-> **Note:** You must specify either `launch_configuration`, `launch_template`, or `mixed_instances_policy`.
+
+~> **NOTE on Auto Scaling Groups, Attachments and Traffic Source Attachments:** Terraform provides standalone [Attachment](autoscaling_attachment.html) (for attaching Classic Load Balancers and Application Load Balancer, Gateway Load Balancer, or Network Load Balancer target groups) and [Traffic Source Attachment](autoscaling_traffic_source_attachment.html) (for attaching Load Balancers and VPC Lattice target groups) resources and an Auto Scaling Group resource with `load_balancers`, `target_group_arns` and `traffic_source` attributes. Do not use the same traffic source in more than one of these resources. Doing so will cause a conflict of attachments. A [`lifecycle` configuration block](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html) can be used to suppress differences if necessary.
+
+> **Hands-on:** Try the [Manage AWS Auto Scaling Groups](https://learn.hashicorp.com/tutorials/terraform/aws-asg?utm_source=WEBSITE&utm_medium=WEB_IO&utm_offer=ARTICLE_PAGE&utm_content=DOCS) tutorial on HashiCorp Learn.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.autoscaling_group import AutoscalingGroup
+from imports.aws.placement_group import PlacementGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        test = PlacementGroup(self, "test",
+            name="test",
+            strategy="cluster"
+        )
+        AutoscalingGroup(self, "bar",
+            desired_capacity=4,
+            force_delete=True,
+            health_check_grace_period=300,
+            health_check_type="ELB",
+            initial_lifecycle_hook=[AutoscalingGroupInitialLifecycleHook(
+                default_result="CONTINUE",
+                heartbeat_timeout=2000,
+                lifecycle_transition="autoscaling:EC2_INSTANCE_LAUNCHING",
+                name="foobar",
+                notification_metadata=Token.as_string(
+                    Fn.jsonencode({
+                        "foo": "bar"
+                    })),
+                notification_target_arn="arn:aws:sqs:us-east-1:444455556666:queue1*",
+                role_arn="arn:aws:iam::123456789012:role/S3Access"
+            )
+            ],
+            launch_configuration=foobar.name,
+            max_size=5,
+            min_size=2,
+            name="foobar3-terraform-test",
+            placement_group=test.id,
+            tag=[AutoscalingGroupTag(
+                key="foo",
+                propagate_at_launch=True,
+                value="bar"
+            ), AutoscalingGroupTag(
+                key="lorem",
+                propagate_at_launch=False,
+                value="ipsum"
+            )
+            ],
+            timeouts=[{
+                "delete": "15m"
+            }
+            ],
+            vpc_zone_identifier=[example1.id, example2.id]
+        )
+```
+
+### With Latest Version Of Launch Template
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.autoscaling_group import AutoscalingGroup
+from imports.aws.launch_template import LaunchTemplate
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        foobar = LaunchTemplate(self, "foobar",
+            image_id="ami-1a2b3c",
+            instance_type="t2.micro",
+            name_prefix="foobar"
+        )
+        AutoscalingGroup(self, "bar",
+            availability_zones=["us-east-1a"],
+            desired_capacity=1,
+            launch_template=AutoscalingGroupLaunchTemplate(
+                id=foobar.id,
+                version="$Latest"
+            ),
+            max_size=1,
+            min_size=1
+        )
+```
+
+### Mixed Instances Policy
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.autoscaling_group import AutoscalingGroup
+from imports.aws.launch_template import LaunchTemplate
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = LaunchTemplate(self, "example",
+            image_id=Token.as_string(data_aws_ami_example.id),
+            instance_type="c5.large",
+            name_prefix="example"
+        )
+        aws_autoscaling_group_example = AutoscalingGroup(self, "example_1",
+            availability_zones=["us-east-1a"],
+            desired_capacity=1,
+            max_size=1,
+            min_size=1,
+            mixed_instances_policy=AutoscalingGroupMixedInstancesPolicy(
+                launch_template=AutoscalingGroupMixedInstancesPolicyLaunchTemplate(
+                    launch_template_specification=AutoscalingGroupMixedInstancesPolicyLaunchTemplateLaunchTemplateSpecification(
+                        launch_template_id=example.id
+                    ),
+                    override=[AutoscalingGroupMixedInstancesPolicyLaunchTemplateOverride(
+                        instance_type="c4.large",
+                        weighted_capacity="3"
+                    ), AutoscalingGroupMixedInstancesPolicyLaunchTemplateOverride(
+                        instance_type="c3.large",
+                        weighted_capacity="2"
+                    )
+                    ]
+                )
+            )
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_autoscaling_group_example.override_logical_id("example")
+```
+
+### Mixed Instances Policy with Spot Instances and Capacity Rebalance
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.autoscaling_group import AutoscalingGroup
+from imports.aws.launch_template import LaunchTemplate
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = LaunchTemplate(self, "example",
+            image_id=Token.as_string(data_aws_ami_example.id),
+            instance_type="c5.large",
+            name_prefix="example"
+        )
+        aws_autoscaling_group_example = AutoscalingGroup(self, "example_1",
+            capacity_rebalance=True,
+            desired_capacity=12,
+            max_size=15,
+            min_size=12,
+            mixed_instances_policy=AutoscalingGroupMixedInstancesPolicy(
+                instances_distribution=AutoscalingGroupMixedInstancesPolicyInstancesDistribution(
+                    on_demand_base_capacity=0,
+                    on_demand_percentage_above_base_capacity=25,
+                    spot_allocation_strategy="capacity-optimized"
+                ),
+                launch_template=AutoscalingGroupMixedInstancesPolicyLaunchTemplate(
+                    launch_template_specification=AutoscalingGroupMixedInstancesPolicyLaunchTemplateLaunchTemplateSpecification(
+                        launch_template_id=example.id
+                    ),
+                    override=[AutoscalingGroupMixedInstancesPolicyLaunchTemplateOverride(
+                        instance_type="c4.large",
+                        weighted_capacity="3"
+                    ), AutoscalingGroupMixedInstancesPolicyLaunchTemplateOverride(
+                        instance_type="c3.large",
+                        weighted_capacity="2"
+                    )
+                    ]
+                )
+            ),
+            vpc_zone_identifier=[example1.id, example2.id]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_autoscaling_group_example.override_logical_id("example")
+```
+
+### Mixed Instances Policy with Instance level LaunchTemplateSpecification Overrides
+
+When using a diverse instance set, some instance types might require a launch template with configuration values unique to that instance type such as a different AMI (Graviton2), architecture specific user data script, different EBS configuration, or different networking configuration.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.autoscaling_group import AutoscalingGroup
+from imports.aws.launch_template import LaunchTemplate
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = LaunchTemplate(self, "example",
+            image_id=Token.as_string(data_aws_ami_example.id),
+            instance_type="c5.large",
+            name_prefix="example"
+        )
+        example2 = LaunchTemplate(self, "example2",
+            image_id=Token.as_string(data_aws_ami_example2.id),
+            name_prefix="example2"
+        )
+        aws_autoscaling_group_example = AutoscalingGroup(self, "example_2",
+            availability_zones=["us-east-1a"],
+            desired_capacity=1,
+            max_size=1,
+            min_size=1,
+            mixed_instances_policy=AutoscalingGroupMixedInstancesPolicy(
+                launch_template=AutoscalingGroupMixedInstancesPolicyLaunchTemplate(
+                    launch_template_specification=AutoscalingGroupMixedInstancesPolicyLaunchTemplateLaunchTemplateSpecification(
+                        launch_template_id=example.id
+                    ),
+                    override=[AutoscalingGroupMixedInstancesPolicyLaunchTemplateOverride(
+                        instance_type="c4.large",
+                        weighted_capacity="3"
+                    ), AutoscalingGroupMixedInstancesPolicyLaunchTemplateOverride(
+                        instance_type="c6g.large",
+                        launch_template_specification=AutoscalingGroupMixedInstancesPolicyLaunchTemplateOverrideLaunchTemplateSpecification(
+                            launch_template_id=example2.id
+                        ),
+                        weighted_capacity="2"
+                    )
+                    ]
+                )
+            )
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_autoscaling_group_example.override_logical_id("example")
+```
+
+### Mixed Instances Policy with Attribute-based Instance Type Selection
+
+As an alternative to manually choosing instance types when creating a mixed instances group, you can specify a set of instance attributes that describe your compute requirements.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.autoscaling_group import AutoscalingGroup
+from imports.aws.launch_template import LaunchTemplate
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = LaunchTemplate(self, "example",
+            image_id=Token.as_string(data_aws_ami_example.id),
+            instance_type="c5.large",
+            name_prefix="example"
+        )
+        aws_autoscaling_group_example = AutoscalingGroup(self, "example_1",
+            availability_zones=["us-east-1a"],
+            desired_capacity=1,
+            max_size=1,
+            min_size=1,
+            mixed_instances_policy=AutoscalingGroupMixedInstancesPolicy(
+                launch_template=AutoscalingGroupMixedInstancesPolicyLaunchTemplate(
+                    launch_template_specification=AutoscalingGroupMixedInstancesPolicyLaunchTemplateLaunchTemplateSpecification(
+                        launch_template_id=example.id
+                    ),
+                    override=[AutoscalingGroupMixedInstancesPolicyLaunchTemplateOverride(
+                        instance_requirements=AutoscalingGroupMixedInstancesPolicyLaunchTemplateOverrideInstanceRequirements(
+                            memory_mib=AutoscalingGroupMixedInstancesPolicyLaunchTemplateOverrideInstanceRequirementsMemoryMib(
+                                min=1000
+                            ),
+                            vcpu_count=AutoscalingGroupMixedInstancesPolicyLaunchTemplateOverrideInstanceRequirementsVcpuCount(
+                                min=4
+                            )
+                        )
+                    )
+                    ]
+                )
+            )
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_autoscaling_group_example.override_logical_id("example")
+```
+
+### Dynamic tagging
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformVariable, Token, TerraformIterator, Fn, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.autoscaling_group import AutoscalingGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        # Terraform Variables are not always the best fit for getting inputs in the context of Terraform CDK.
+        #     You can read more about this at https://cdk.tf/variables
+        extra_tags = TerraformVariable(self, "extra_tags",
+            default=[{
+                "key": "Foo",
+                "propagate_at_launch": True,
+                "value": "Bar"
+            }, {
+                "key": "Baz",
+                "propagate_at_launch": True,
+                "value": "Bam"
+            }
+            ]
+        )
+        # In most cases loops should be handled in the programming language context and
+        #     not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+        #     you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+        #     you need to keep this like it is.
+        test_dynamic_iterator0 = TerraformIterator.from_list(
+            Token.as_any(extra_tags.value))
+        AutoscalingGroup(self, "test",
+            launch_configuration=foobar.name,
+            max_size=5,
+            min_size=2,
+            name="foobar3-terraform-test",
+            tag=test_dynamic_iterator0.dynamic({
+                "key": Fn.lookup_nested(test_dynamic_iterator0.value, ["key"]),
+                "propagate_at_launch": Fn.lookup_nested(test_dynamic_iterator0.value, ["propagate_at_launch"
+                ]),
+                "value": Fn.lookup_nested(test_dynamic_iterator0.value, ["value"])
+            }),
+            vpc_zone_identifier=[example1.id, example2.id]
+        )
+```
+
+### Automatically refresh all instances after the group is updated
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.autoscaling_group import AutoscalingGroup
+from imports.aws.data_aws_ami import DataAwsAmi
+from imports.aws.launch_template import LaunchTemplate
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = DataAwsAmi(self, "example",
+            filter=[DataAwsAmiFilter(
+                name="name",
+                values=["amzn-ami-hvm-*-x86_64-gp2"]
+            )
+            ],
+            most_recent=True,
+            owners=["amazon"]
+        )
+        aws_launch_template_example = LaunchTemplate(self, "example_1",
+            image_id=Token.as_string(example.id),
+            instance_type="t3.nano"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_launch_template_example.override_logical_id("example")
+        aws_autoscaling_group_example = AutoscalingGroup(self, "example_2",
+            availability_zones=["us-east-1a"],
+            desired_capacity=1,
+            instance_refresh=AutoscalingGroupInstanceRefresh(
+                preferences=AutoscalingGroupInstanceRefreshPreferences(
+                    min_healthy_percentage=50
+                ),
+                strategy="Rolling",
+                triggers=["tag"]
+            ),
+            launch_template=AutoscalingGroupLaunchTemplate(
+                id=Token.as_string(aws_launch_template_example.id),
+                version=Token.as_string(aws_launch_template_example.latest_version)
+            ),
+            max_size=2,
+            min_size=1,
+            tag=[AutoscalingGroupTag(
+                key="Key",
+                propagate_at_launch=True,
+                value="Value"
+            )
+            ]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_autoscaling_group_example.override_logical_id("example")
+```
+
+### Auto Scaling group with Warm Pool
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.autoscaling_group import AutoscalingGroup
+from imports.aws.launch_template import LaunchTemplate
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AutoscalingGroup(self, "example",
+            availability_zones=["us-east-1a"],
+            desired_capacity=1,
+            max_size=5,
+            min_size=1,
+            warm_pool=AutoscalingGroupWarmPool(
+                instance_reuse_policy=AutoscalingGroupWarmPoolInstanceReusePolicy(
+                    reuse_on_scale_in=True
+                ),
+                max_group_prepared_capacity=10,
+                min_size=1,
+                pool_state="Hibernated"
+            )
+        )
+        aws_launch_template_example = LaunchTemplate(self, "example_1",
+            image_id=Token.as_string(data_aws_ami_example.id),
+            instance_type="c5.large",
+            name_prefix="example"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_launch_template_example.override_logical_id("example")
+```
+
+### Auto Scaling group with Traffic Sources
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformIterator, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.autoscaling_group import AutoscalingGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        # In most cases loops should be handled in the programming language context and
+        #     not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+        #     you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+        #     you need to keep this like it is.
+        test_dynamic_iterator0 = TerraformIterator.from_list(
+            Token.as_any(Fn.lookup_nested(aws_vpclattice_target_group_test, ["*"])))
+        AutoscalingGroup(self, "test",
+            force_delete=True,
+            max_size=1,
+            min_size=1,
+            vpc_zone_identifier=Token.as_list(aws_subnet_test.id),
+            traffic_source=test_dynamic_iterator0.dynamic({
+                "identifier": Fn.lookup_nested(test_dynamic_iterator0.value, ["arn"]),
+                "type": "vpc-lattice"
+            })
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+- `name` - (Optional) Name of the Auto Scaling Group. By default generated by Terraform. Conflicts with `name_prefix`.
+- `name_prefix` - (Optional) Creates a unique name beginning with the specified
+  prefix. Conflicts with `name`.
+- `max_size` - (Required) Maximum size of the Auto Scaling Group.
+- `min_size` - (Required) Minimum size of the Auto Scaling Group.
+  (See also [Waiting for Capacity](#waiting-for-capacity) below.)
+- `availability_zones` - (Optional) A list of Availability Zones where instances in the Auto Scaling group can be created. Used for launching into the default VPC subnet in each Availability Zone when not using the `vpc_zone_identifier` attribute, or for attaching a network interface when an existing network interface ID is specified in a launch template. Conflicts with `vpc_zone_identifier`.
+- `capacity_rebalance` - (Optional) Whether capacity rebalance is enabled. Otherwise, capacity rebalance is disabled.
+- `context` - (Optional) Reserved.
+- `default_cooldown` - (Optional) Amount of time, in seconds, after a scaling activity completes before another scaling activity can start.
+- `default_instance_warmup` - (Optional) Amount of time, in seconds, until a newly launched instance can contribute to the Amazon CloudWatch metrics. This delay lets an instance finish initializing before Amazon EC2 Auto Scaling aggregates instance metrics, resulting in more reliable usage data. Set this value equal to the amount of time that it takes for resource consumption to become stable after an instance reaches the InService state. (See [Set the default instance warmup for an Auto Scaling group](https://docs.aws.amazon.com/autoscaling/ec2/userguide/ec2-auto-scaling-default-instance-warmup.html))
+- `launch_configuration` - (Optional) Name of the launch configuration to use.
+- `launch_template` - (Optional) Nested argument with Launch template specification to use to launch instances. See [Launch Template](#launch_template) below for more details.
+- `mixed_instances_policy` - (Optional) Configuration block containing settings to define launch targets for Auto Scaling groups. See [Mixed Instances Policy](#mixed_instances_policy) below for more details.
+- `ignore_failed_scaling_activities` - (Optional) Whether to ignore failed [Auto Scaling scaling activities](https://docs.aws.amazon.com/autoscaling/ec2/userguide/as-verify-scaling-activity.html) while [waiting for capacity](#waiting-for-capacity). The default is `false` -- failed scaling activities cause errors to be returned.
+- `initial_lifecycle_hook` - (Optional) One or more
+  [Lifecycle Hooks](http://docs.aws.amazon.com/autoscaling/latest/userguide/lifecycle-hooks.html)
+  to attach to the Auto Scaling Group **before** instances are launched. The
+  syntax is exactly the same as the separate
+  [`aws_autoscaling_lifecycle_hook`](/docs/providers/aws/r/autoscaling_lifecycle_hook.html)
+  resource, without the `autoscaling_group_name` attribute. Please note that this will only work when creating
+  a new Auto Scaling Group. For all other use-cases, please use `aws_autoscaling_lifecycle_hook` resource.
+- `health_check_grace_period` - (Optional, Default: 300) Time (in seconds) after instance comes into service before checking health.
+- `health_check_type` - (Optional) "EC2" or "ELB". Controls how health checking is done.
+- `desired_capacity` - (Optional) Number of Amazon EC2 instances that
+  should be running in the group. (See also [Waiting for
+  Capacity](#waiting-for-capacity) below.)
+- `desired_capacity_type` - (Optional) The unit of measurement for the value specified for `desired_capacity`. Supported for attribute-based instance type selection only. Valid values: `"units"`, `"vcpu"`, `"memory-mib"`.
+- `force_delete` - (Optional) Allows deleting the Auto Scaling Group without waiting
+  for all instances in the pool to terminate. You can force an Auto Scaling Group to delete
+  even if it's in the process of scaling a resource. Normally, Terraform
+  drains all the instances before deleting the group. This bypasses that
+  behavior and potentially leaves resources dangling.
+- `load_balancers` - (Optional) List of elastic load balancer names to add to the autoscaling
+  group names. Only valid for classic load balancers. For ALBs, use `target_group_arns` instead. To remove all load balancer attachments an empty list should be specified.
+- `traffic_source` - (Optional) Attaches one or more traffic sources to the specified Auto Scaling group.
+- `vpc_zone_identifier` - (Optional) List of subnet IDs to launch resources in. Subnets automatically determine which availability zones the group will reside. Conflicts with `availability_zones`.
+- `target_group_arns` - (Optional) Set of `aws_alb_target_group` ARNs, for use with Application or Network Load Balancing. To remove all target group attachments an empty list should be specified.
+- `termination_policies` - (Optional) List of policies to decide how the instances in the Auto Scaling Group should be terminated. The allowed values are `OldestInstance`, `NewestInstance`, `OldestLaunchConfiguration`, `ClosestToNextInstanceHour`, `OldestLaunchTemplate`, `AllocationStrategy`, `Default`. Additionally, the ARN of a Lambda function can be specified for custom termination policies.
+- `suspended_processes` - (Optional) List of processes to suspend for the Auto Scaling Group. The allowed values are `Launch`, `Terminate`, `HealthCheck`, `ReplaceUnhealthy`, `AZRebalance`, `AlarmNotification`, `ScheduledActions`, `AddToLoadBalancer`, `InstanceRefresh`.
+  Note that if you suspend either the `Launch` or `Terminate` process types, it can prevent your Auto Scaling Group from functioning properly.
+- `tag` - (Optional) Configuration block(s) containing resource tags. See [Tag](#tag) below for more details.
+- `placement_group` - (Optional) Name of the placement group into which you'll launch your instances, if any.
+- `metrics_granularity` - (Optional) Granularity to associate with the metrics to collect. The only valid value is `1Minute`. Default is `1Minute`.
+- `enabled_metrics` - (Optional) List of metrics to collect. The allowed values are defined by the [underlying AWS API](https://docs.aws.amazon.com/autoscaling/ec2/APIReference/API_EnableMetricsCollection.html).
+- `wait_for_capacity_timeout` - (Optional, Default: "10m") Maximum
+  [duration](https://golang.org/pkg/time/#ParseDuration) that Terraform should
+  wait for ASG instances to be healthy before timing out. (See also [Waiting
+  for Capacity](#waiting-for-capacity) below.) Setting this to "0" causes
+  Terraform to skip all Capacity Waiting behavior.
+- `min_elb_capacity` - (Optional) Setting this causes Terraform to wait for
+  this number of instances from this Auto Scaling Group to show up healthy in the
+  ELB only on creation. Updates will not wait on ELB instance number changes.
+  (See also [Waiting for Capacity](#waiting-for-capacity) below.)
+- `wait_for_elb_capacity` - (Optional) Setting this will cause Terraform to wait
+  for exactly this number of healthy instances from this Auto Scaling Group in
+  all attached load balancers on both create and update operations. (Takes
+  precedence over `min_elb_capacity` behavior.)
+  (See also [Waiting for Capacity](#waiting-for-capacity) below.)
+- `protect_from_scale_in` - (Optional) Whether newly launched instances
+  are automatically protected from termination by Amazon EC2 Auto Scaling when
+  scaling in. For more information about preventing instances from terminating
+  on scale in, see [Using instance scale-in protection](https://docs.aws.amazon.com/autoscaling/ec2/userguide/ec2-auto-scaling-instance-protection.html)
+  in the Amazon EC2 Auto Scaling User Guide.
+- `service_linked_role_arn` - (Optional) ARN of the service-linked role that the ASG will use to call other AWS services
+- `max_instance_lifetime` - (Optional) Maximum amount of time, in seconds, that an instance can be in service, values must be either equal to 0 or between 86400 and 31536000 seconds.
+- `instance_refresh` - (Optional) If this block is configured, start an
+  [Instance Refresh](https://docs.aws.amazon.com/autoscaling/ec2/userguide/asg-instance-refresh.html)
+  when this Auto Scaling Group is updated. Defined [below](#instance_refresh).
+- `warm_pool` - (Optional) If this block is configured, add a [Warm Pool](https://docs.aws.amazon.com/autoscaling/ec2/userguide/ec2-auto-scaling-warm-pools.html)
+  to the specified Auto Scaling group. Defined [below](#warm_pool)
+
+### launch_template
+
+~> **NOTE:** Either `id` or `name` must be specified.
+
+The top-level `launch_template` block supports the following:
+
+- `id` - (Optional) ID of the launch template. Conflicts with `name`.
+- `name` - (Optional) Name of the launch template. Conflicts with `id`.
+- `version` - (Optional) Template version. Can be version number, `$Latest`, or `$Default`. (Default: `$Default`).
+
+### mixed_instances_policy
+
+- `instances_distribution` - (Optional) Nested argument containing settings on how to mix on-demand and Spot instances in the Auto Scaling group. Defined below.
+- `launch_template` - (Required) Nested argument containing launch template settings along with the overrides to specify multiple instance types and weights. Defined below.
+
+#### mixed_instances_policy instances_distribution
+
+This configuration block supports the following:
+
+- `on_demand_allocation_strategy` - (Optional) Strategy to use when launching on-demand instances. Valid values: `prioritized`, `lowest-price`. Default: `prioritized`.
+- `on_demand_base_capacity` - (Optional) Absolute minimum amount of desired capacity that must be fulfilled by on-demand instances. Default: `0`.
+- `on_demand_percentage_above_base_capacity` - (Optional) Percentage split between on-demand and Spot instances above the base on-demand capacity. Default: `100`.
+- `spot_allocation_strategy` - (Optional) How to allocate capacity across the Spot pools. Valid values: `lowest-price`, `capacity-optimized`, `capacity-optimized-prioritized`, and `price-capacity-optimized`. Default: `lowest-price`.
+- `spot_instance_pools` - (Optional) Number of Spot pools per availability zone to allocate capacity. EC2 Auto Scaling selects the cheapest Spot pools and evenly allocates Spot capacity across the number of Spot pools that you specify. Only available with `spot_allocation_strategy` set to `lowest-price`. Otherwise it must be set to `0`, if it has been defined before. Default: `2`.
+- `spot_max_price` - (Optional) Maximum price per unit hour that the user is willing to pay for the Spot instances. Default: an empty string which means the on-demand price.
+
+#### mixed_instances_policy launch_template
+
+This configuration block supports the following:
+
+- `launch_template_specification` - (Required) Nested argument defines the Launch Template. Defined below.
+- `override` - (Optional) List of nested arguments provides the ability to specify multiple instance types. This will override the same parameter in the launch template. For on-demand instances, Auto Scaling considers the order of preference of instance types to launch based on the order specified in the overrides list. Defined below.
+
+##### mixed_instances_policy launch_template launch_template_specification
+
+~> **NOTE:** Either `launch_template_id` or `launch_template_name` must be specified.
+
+This configuration block supports the following:
+
+- `launch_template_id` - (Optional) ID of the launch template. Conflicts with `launch_template_name`.
+- `launch_template_name` - (Optional) Name of the launch template. Conflicts with `launch_template_id`.
+- `version` - (Optional) Template version. Can be version number, `$Latest`, or `$Default`. (Default: `$Default`).
+
+##### mixed_instances_policy launch_template override
+
+This configuration block supports the following:
+
+- `instance_type` - (Optional) Override the instance type in the Launch Template.
+- `instance_requirements` - (Optional) Override the instance type in the Launch Template with instance types that satisfy the requirements.
+- `launch_template_specification` - (Optional) Override the instance launch template specification in the Launch Template.
+- `weighted_capacity` - (Optional) Number of capacity units, which gives the instance type a proportional weight to other instance types.
+
+###### mixed_instances_policy launch_template override instance_requirements
+
+This configuration block supports the following:
+
+~> **NOTE:** Both `memory_mib.min` and `vcpu_count.min` must be specified.
+
+- `accelerator_count` - (Optional) Block describing the minimum and maximum number of accelerators (GPUs, FPGAs, or AWS Inferentia chips). Default is no minimum or maximum.
+    - `min` - (Optional) Minimum.
+    - `max` - (Optional) Maximum. Set to `0` to exclude instance types with accelerators.
+- `accelerator_manufacturers` - (Optional) List of accelerator manufacturer names. Default is any manufacturer.
+
+  ```
+  Valid names:
+    * amazon-web-services
+    * amd
+    * nvidia
+    * xilinx
+  ```
+
+- `accelerator_names` - (Optional) List of accelerator names. Default is any acclerator.
+
+  ```
+  Valid names:
+    * a100            - NVIDIA A100 GPUs
+    * v100            - NVIDIA V100 GPUs
+    * k80             - NVIDIA K80 GPUs
+    * t4              - NVIDIA T4 GPUs
+    * m60             - NVIDIA M60 GPUs
+    * radeon-pro-v520 - AMD Radeon Pro V520 GPUs
+    * vu9p            - Xilinx VU9P FPGAs
+  ```
+
+- `accelerator_total_memory_mib` - (Optional) Block describing the minimum and maximum total memory of the accelerators. Default is no minimum or maximum.
+
+    - `min` - (Optional) Minimum.
+    - `max` - (Optional) Maximum.
+
+- `accelerator_types` - (Optional) List of accelerator types. Default is any accelerator type.
+
+  ```
+  Valid types:
+    * fpga
+    * gpu
+    * inference
+  ```
+
+- `allowed_instance_types` - (Optional) List of instance types to apply your specified attributes against. All other instance types are ignored, even if they match your specified attributes. You can use strings with one or more wild cards, represented by an asterisk (\*), to allow an instance type, size, or generation. The following are examples: `m5.8xlarge`, `c5*.*`, `m5a.*`, `r*`, `*3*`. For example, if you specify `c5*`, you are allowing the entire C5 instance family, which includes all C5a and C5n instance types. If you specify `m5a.*`, you are allowing all the M5a instance types, but not the M5n instance types. Maximum of 400 entries in the list; each entry is limited to 30 characters. Default is all instance types.
+
+  ~> **NOTE:** If you specify `allowed_instance_types`, you can't specify `excluded_instance_types`.
+
+- `bare_metal` - (Optional) Indicate whether bare metal instace types should be `included`, `excluded`, or `required`. Default is `excluded`.
+- `baseline_ebs_bandwidth_mbps` - (Optional) Block describing the minimum and maximum baseline EBS bandwidth, in Mbps. Default is no minimum or maximum.
+    - `min` - (Optional) Minimum.
+    - `max` - (Optional) Maximum.
+- `burstable_performance` - (Optional) Indicate whether burstable performance instance types should be `included`, `excluded`, or `required`. Default is `excluded`.
+- `cpu_manufacturers` (Optional) List of CPU manufacturer names. Default is any manufacturer.
+
+  ~> **NOTE:** Don't confuse the CPU hardware manufacturer with the CPU hardware architecture. Instances will be launched with a compatible CPU architecture based on the Amazon Machine Image (AMI) that you specify in your launch template.
+
+  ```
+  Valid names:
+    * amazon-web-services
+    * amd
+    * intel
+  ```
+
+- `excluded_instance_types` - (Optional) List of instance types to exclude. You can use strings with one or more wild cards, represented by an asterisk (\*), to exclude an instance type, size, or generation. The following are examples: `m5.8xlarge`, `c5*.*`, `m5a.*`, `r*`, `*3*`. For example, if you specify `c5*`, you are excluding the entire C5 instance family, which includes all C5a and C5n instance types. If you specify `m5a.*`, you are excluding all the M5a instance types, but not the M5n instance types. Maximum of 400 entries in the list; each entry is limited to 30 characters. Default is no excluded instance types.
+
+  ~> **NOTE:** If you specify `excluded_instance_types`, you can't specify `allowed_instance_types`.
+
+- `instance_generations` - (Optional) List of instance generation names. Default is any generation.
+
+  ```
+  Valid names:
+    * current  - Recommended for best performance.
+    * previous - For existing applications optimized for older instance types.
+  ```
+
+- `local_storage` - (Optional) Indicate whether instance types with local storage volumes are `included`, `excluded`, or `required`. Default is `included`.
+- `local_storage_types` - (Optional) List of local storage type names. Default any storage type.
+
+  ```
+  Value names:
+    * hdd - hard disk drive
+    * ssd - solid state drive
+  ```
+
+- `memory_gib_per_vcpu` - (Optional) Block describing the minimum and maximum amount of memory (GiB) per vCPU. Default is no minimum or maximum.
+    - `min` - (Optional) Minimum. May be a decimal number, e.g. `0.5`.
+    - `max` - (Optional) Maximum. May be a decimal number, e.g. `0.5`.
+- `memory_mib` - (Required) Block describing the minimum and maximum amount of memory (MiB). Default is no maximum.
+    - `min` - (Required) Minimum.
+    - `max` - (Optional) Maximum.
+- `network_bandwidth_gbps` - (Optional) Block describing the minimum and maximum amount of network bandwidth, in gigabits per second (Gbps). Default is no minimum or maximum.
+    - `min` - (Optional) Minimum.
+    - `max` - (Optional) Maximum.
+- `network_interface_count` - (Optional) Block describing the minimum and maximum number of network interfaces. Default is no minimum or maximum.
+    - `min` - (Optional) Minimum.
+    - `max` - (Optional) Maximum.
+- `on_demand_max_price_percentage_over_lowest_price` - (Optional) Price protection threshold for On-Demand Instances. This is the maximum you’ll pay for an On-Demand Instance, expressed as a percentage higher than the cheapest M, C, or R instance type with your specified attributes. When Amazon EC2 Auto Scaling selects instance types with your attributes, we will exclude instance types whose price is higher than your threshold. The parameter accepts an integer, which Amazon EC2 Auto Scaling interprets as a percentage. To turn off price protection, specify a high value, such as 999999. Default is 20.
+
+  If you set DesiredCapacityType to vcpu or memory-mib, the price protection threshold is applied based on the per vCPU or per memory price instead of the per instance price.
+
+- `require_hibernate_support` - (Optional) Indicate whether instance types must support On-Demand Instance Hibernation, either `true` or `false`. Default is `false`.
+- `spot_max_price_percentage_over_lowest_price` - (Optional) Price protection threshold for Spot Instances. This is the maximum you’ll pay for a Spot Instance, expressed as a percentage higher than the cheapest M, C, or R instance type with your specified attributes. When Amazon EC2 Auto Scaling selects instance types with your attributes, we will exclude instance types whose price is higher than your threshold. The parameter accepts an integer, which Amazon EC2 Auto Scaling interprets as a percentage. To turn off price protection, specify a high value, such as 999999. Default is 100.
+
+  If you set DesiredCapacityType to vcpu or memory-mib, the price protection threshold is applied based on the per vCPU or per memory price instead of the per instance price.
+
+- `total_local_storage_gb` - (Optional) Block describing the minimum and maximum total local storage (GB). Default is no minimum or maximum.
+    - `min` - (Optional) Minimum. May be a decimal number, e.g. `0.5`.
+    - `max` - (Optional) Maximum. May be a decimal number, e.g. `0.5`.
+- `vcpu_count` - (Required) Block describing the minimum and maximum number of vCPUs. Default is no maximum.
+    - `min` - (Required) Minimum.
+    - `max` - (Optional) Maximum.
+
+### tag
+
+The `tag` attribute accepts exactly one tag declaration with the following fields:
+
+- `key` - (Required) Key
+- `value` - (Required) Value
+- `propagate_at_launch` - (Required) Enables propagation of the tag to
+  Amazon EC2 instances launched via this ASG
+
+To declare multiple tags, additional `tag` blocks can be specified.
+
+~> **NOTE:** Other AWS APIs may automatically add special tags to their associated Auto Scaling Group for management purposes, such as ECS Capacity Providers adding the `AmazonECSManaged` tag. These generally should be included in the configuration so Terraform does not attempt to remove them and so if the `min_size` was greater than zero on creation, that these tag(s) are applied to any initial EC2 Instances in the Auto Scaling Group. If these tag(s) were missing in the Auto Scaling Group configuration on creation, affected EC2 Instances missing the tags may require manual intervention of adding the tags to ensure they work properly with the other AWS service.
+
+### instance_refresh
+
+This configuration block supports the following:
+
+- `strategy` - (Required) Strategy to use for instance refresh. The only allowed value is `Rolling`. See [StartInstanceRefresh Action](https://docs.aws.amazon.com/autoscaling/ec2/APIReference/API_StartInstanceRefresh.html#API_StartInstanceRefresh_RequestParameters) for more information.
+- `preferences` - (Optional) Override default parameters for Instance Refresh.
+    - `checkpoint_delay` - (Optional) Number of seconds to wait after a checkpoint. Defaults to `3600`.
+    - `checkpoint_percentages` - (Optional) List of percentages for each checkpoint. Values must be unique and in ascending order. To replace all instances, the final number must be `100`.
+    - `instance_warmup` - (Optional) Number of seconds until a newly launched instance is configured and ready to use. Default behavior is to use the Auto Scaling Group's health check grace period.
+    - `min_healthy_percentage` - (Optional) Amount of capacity in the Auto Scaling group that must remain healthy during an instance refresh to allow the operation to continue, as a percentage of the desired capacity of the Auto Scaling group. Defaults to `90`.
+    - `skip_matching` - (Optional) Replace instances that already have your desired configuration. Defaults to `false`.
+    - `auto_rollback` - (Optional) Automatically rollback if instance refresh fails. Defaults to `false`. This option may only be set to `true` when specifying a `launch_template` or `mixed_instances_policy`.
+    - `scale_in_protected_instances` - (Optional) Behavior when encountering instances protected from scale in are found. Available behaviors are `Refresh`, `Ignore`, and `Wait`. Default is `Ignore`.
+    - `standby_instances` - (Optional) Behavior when encountering instances in the `Standby` state in are found. Available behaviors are `Terminate`, `Ignore`, and `Wait`. Default is `Ignore`.
+- `triggers` - (Optional) Set of additional property names that will trigger an Instance Refresh. A refresh will always be triggered by a change in any of `launch_configuration`, `launch_template`, or `mixed_instances_policy`.
+
+~> **NOTE:** A refresh is started when any of the following Auto Scaling Group properties change: `launch_configuration`, `launch_template`, `mixed_instances_policy`. Additional properties can be specified in the `triggers` property of `instance_refresh`.
+
+~> **NOTE:** A refresh will not start when `version = "$Latest"` is configured in the `launch_template` block. To trigger the instance refresh when a launch template is changed, configure `version` to use the `latest_version` attribute of the `aws_launch_template` resource.
+
+~> **NOTE:** Auto Scaling Groups support up to one active instance refresh at a time. When this resource is updated, any existing refresh is cancelled.
+
+~> **NOTE:** Depending on health check settings and group size, an instance refresh may take a long time or fail. This resource does not wait for the instance refresh to complete.
+
+### warm_pool
+
+This configuration block supports the following:
+
+- `instance_reuse_policy` - (Optional) Whether instances in the Auto Scaling group can be returned to the warm pool on scale in. The default is to terminate instances in the Auto Scaling group when the group scales in.
+- `max_group_prepared_capacity` - (Optional) Total maximum number of instances that are allowed to be in the warm pool or in any state except Terminated for the Auto Scaling group.
+- `min_size` - (Optional) Minimum number of instances to maintain in the warm pool. This helps you to ensure that there is always a certain number of warmed instances available to handle traffic spikes. Defaults to 0 if not specified.
+- `pool_state` - (Optional) Sets the instance state to transition to after the lifecycle hooks finish. Valid values are: Stopped (default), Running or Hibernated.
+
+### traffic_source
+
+- `identifier` - Identifies the traffic source. For Application Load Balancers, Gateway Load Balancers, Network Load Balancers, and VPC Lattice, this will be the Amazon Resource Name (ARN) for a target group in this account and Region. For Classic Load Balancers, this will be the name of the Classic Load Balancer in this account and Region.
+- `type` - Provides additional context for the value of Identifier.
+  The following lists the valid values:
+  `elb` if `identifier` is the name of a Classic Load Balancer.
+  `elbv2` if `identifier` is the ARN of an Application Load Balancer, Gateway Load Balancer, or Network Load Balancer target group.
+  `vpc-lattice` if `identifier` is the ARN of a VPC Lattice target group.
+
+##### instance_reuse_policy
+
+This configuration block supports the following:
+
+- `reuse_on_scale_in` - (Optional) Whether instances in the Auto Scaling group can be returned to the warm pool on scale in.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+- `id` - Auto Scaling Group id.
+- `arn` - ARN for this Auto Scaling Group
+- `availability_zones` - Availability zones of the Auto Scaling Group.
+- `min_size` - Minimum size of the Auto Scaling Group
+- `max_size` - Maximum size of the Auto Scaling Group
+- `default_cooldown` - Time between a scaling activity and the succeeding scaling activity.
+- `default_instance_warmup` - The duration of the default instance warmup, in seconds.
+- `name` - Name of the Auto Scaling Group
+- `health_check_grace_period` - Time after instance comes into service before checking health.
+- `health_check_type` - "EC2" or "ELB". Controls how health checking is done.
+- `desired_capacity` -The number of Amazon EC2 instances that should be running in the group.
+- `launch_configuration` - The launch configuration of the Auto Scaling Group
+- `predicted_capacity` - Predicted capacity of the group.
+- `vpc_zone_identifier` (Optional) - The VPC zone identifier
+- `warm_pool_size` - Current size of the warm pool.
+
+~> **NOTE:** When using `ELB` as the `health_check_type`, `health_check_grace_period` is required.
+
+~> **NOTE:** Terraform has two types of ways you can add lifecycle hooks - via
+the `initial_lifecycle_hook` attribute from this resource, or via the separate
+[`aws_autoscaling_lifecycle_hook`](/docs/providers/aws/r/autoscaling_lifecycle_hook.html)
+resource. `initial_lifecycle_hook` exists here because any lifecycle hooks
+added with `aws_autoscaling_lifecycle_hook` will not be added until the
+Auto Scaling Group has been created, and depending on your
+[capacity](#waiting-for-capacity) settings, after the initial instances have
+been launched, creating unintended behavior. If you need hooks to run on all
+instances, add them with `initial_lifecycle_hook` here, but take
+care to not duplicate these hooks in `aws_autoscaling_lifecycle_hook`.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `delete` - (Default `10m`)
+
+## Waiting for Capacity
+
+A newly-created ASG is initially empty and begins to scale to `min_size` (or
+`desired_capacity`, if specified) by launching instances using the provided
+Launch Configuration. These instances take time to launch and boot.
+
+On ASG Update, changes to these values also take time to result in the target
+number of instances providing service.
+
+Terraform provides two mechanisms to help consistently manage ASG scale up
+time across dependent resources.
+
+#### Waiting for ASG Capacity
+
+The first is default behavior. Terraform waits after ASG creation for
+`min_size` (or `desired_capacity`, if specified) healthy instances to show up
+in the ASG before continuing.
+
+If `min_size` or `desired_capacity` are changed in a subsequent update,
+Terraform will also wait for the correct number of healthy instances before
+continuing.
+
+Terraform considers an instance "healthy" when the ASG reports `HealthStatus:
+"Healthy"` and `LifecycleState: "InService"`. See the [AWS AutoScaling
+Docs](https://docs.aws.amazon.com/AutoScaling/latest/DeveloperGuide/AutoScalingGroupLifecycle.html)
+for more information on an ASG's lifecycle.
+
+Terraform will wait for healthy instances for up to
+`wait_for_capacity_timeout`. If ASG creation is taking more than a few minutes,
+it's worth investigating for scaling activity errors, which can be caused by
+problems with the selected Launch Configuration.
+
+Setting `wait_for_capacity_timeout` to `"0"` disables ASG Capacity waiting.
+
+#### Waiting for ELB Capacity
+
+The second mechanism is optional, and affects ASGs with attached ELBs specified
+via the `load_balancers` attribute or with ALBs specified with `target_group_arns`.
+
+The `min_elb_capacity` parameter causes Terraform to wait for at least the
+requested number of instances to show up `"InService"` in all attached ELBs
+during ASG creation. It has no effect on ASG updates.
+
+If `wait_for_elb_capacity` is set, Terraform will wait for exactly that number
+of Instances to be `"InService"` in all attached ELBs on both creation and
+updates.
+
+These parameters can be used to ensure that service is being provided before
+Terraform moves on. If new instances don't pass the ELB's health checks for any
+reason, the Terraform apply will time out, and the ASG will be marked as
+tainted (i.e., marked to be destroyed in a follow up run).
+
+As with ASG Capacity, Terraform will wait for up to `wait_for_capacity_timeout`
+for the proper number of instances to be healthy.
+
+#### Troubleshooting Capacity Waiting Timeouts
+
+If ASG creation takes more than a few minutes, this could indicate one of a
+number of configuration problems. See the [AWS Docs on Load Balancer
+Troubleshooting](https://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/elb-troubleshooting.html)
+for more information.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Auto Scaling Groups using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Auto Scaling Groups using the `name`. For example:
+
+```console
+% terraform import aws_autoscaling_group.web web-asg
+```
+
+<!-- cache-key: cdktf-0.18.0 input-6123f1ad176783c4aeeb8809e50b4e73d7842b1025fac3b7c66ab4860931dd4c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/autoscaling_group_tag.html.markdown b/website/docs/cdktf/python/r/autoscaling_group_tag.html.markdown
new file mode 100644
index 00000000000..771b738e6c7
--- /dev/null
+++ b/website/docs/cdktf/python/r/autoscaling_group_tag.html.markdown
@@ -0,0 +1,100 @@
+---
+subcategory: "Auto Scaling"
+layout: "aws"
+page_title: "AWS: aws_autoscaling_group_tag"
+description: |-
+  Manages an individual Autoscaling Group tag
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_autoscaling_group_tag
+
+Manages an individual Autoscaling Group (ASG) tag. This resource should only be used in cases where ASGs are created outside Terraform (e.g., ASGs implicitly created by EKS Node Groups).
+
+~> **NOTE:** This tagging resource should not be combined with the Terraform resource for managing the parent resource. For example, using `aws_autoscaling_group` and `aws_autoscaling_group_tag` to manage tags of the same ASG will cause a perpetual difference where the `aws_autoscaling_group` resource will try to remove the tag being added by the `aws_autoscaling_group_tag` resource.
+
+~> **NOTE:** This tagging resource does not use the [provider `ignore_tags` configuration](/docs/providers/aws/index.html#ignore_tags).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformIterator, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.autoscaling_group_tag import AutoscalingGroupTagA
+from imports.aws.eks_node_group import EksNodeGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, nodeRoleArn, scalingConfig, subnetIds):
+        super().__init__(scope, name)
+        # In most cases loops should be handled in the programming language context and
+        #     not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+        #     you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+        #     you need to keep this like it is.
+        example_for_each_iterator = TerraformIterator.from_list(
+            Token.as_any(
+                Fn.toset("${[ for asg in ${" +
+                    Fn.flatten("${[ for resources in ${" + aws_eks_node_group_example.resources + "} : resources.autoscaling_groups]}") + "} : asg.name]}")))
+        AutoscalingGroupTagA(self, "example",
+            autoscaling_group_name=Token.as_string(example_for_each_iterator.value),
+            tag=AutoscalingGroupTagTag(
+                key="k8s.io/cluster-autoscaler/node-template/label/eks.amazonaws.com/capacityType",
+                propagate_at_launch=False,
+                value="SPOT"
+            ),
+            for_each=example_for_each_iterator
+        )
+        aws_eks_node_group_example = EksNodeGroup(self, "example_1",
+            cluster_name="example",
+            node_group_name="example",
+            node_role_arn=node_role_arn,
+            scaling_config=scaling_config,
+            subnet_ids=subnet_ids
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_eks_node_group_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `autoscaling_group_name` - (Required) Name of the Autoscaling Group to apply the tag to.
+* `tag` - (Required) Tag to create. The `tag` block is documented below.
+
+The `tag` block supports the following arguments:
+
+* `key` - (Required) Tag name.
+* `value` - (Required) Tag value.
+* `propagate_at_launch` - (Required) Whether to propagate the tags to instances launched by the ASG.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - ASG name and key, separated by a comma (`,`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_autoscaling_group_tag` using the ASG name and key, separated by a comma (`,`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_autoscaling_group_tag` using the ASG name and key, separated by a comma (`,`). For example:
+
+```console
+% terraform import aws_autoscaling_group_tag.example asg-example,k8s.io/cluster-autoscaler/node-template/label/eks.amazonaws.com/capacityType
+```
+
+<!-- cache-key: cdktf-0.18.0 input-6d03164dc8f7802d7fed35fe5527ff2cb206eef4734529984f76a9f8bdd4520e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/autoscaling_lifecycle_hook.html.markdown b/website/docs/cdktf/python/r/autoscaling_lifecycle_hook.html.markdown
new file mode 100644
index 00000000000..7ef2276145c
--- /dev/null
+++ b/website/docs/cdktf/python/r/autoscaling_lifecycle_hook.html.markdown
@@ -0,0 +1,109 @@
+---
+subcategory: "Auto Scaling"
+layout: "aws"
+page_title: "AWS: aws_autoscaling_lifecycle_hook"
+description: |-
+  Provides an AutoScaling Lifecycle Hook resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_autoscaling_lifecycle_hook
+
+Provides an AutoScaling Lifecycle Hook resource.
+
+~> **NOTE:** Terraform has two types of ways you can add lifecycle hooks - via
+the `initial_lifecycle_hook` attribute from the
+[`aws_autoscaling_group`](/docs/providers/aws/r/autoscaling_group.html)
+resource, or via this one. Hooks added via this resource will not be added
+until the autoscaling group has been created, and depending on your
+[capacity](/docs/providers/aws/r/autoscaling_group.html#waiting-for-capacity)
+settings, after the initial instances have been launched, creating unintended
+behavior. If you need hooks to run on all instances, add them with
+`initial_lifecycle_hook` in
+[`aws_autoscaling_group`](/docs/providers/aws/r/autoscaling_group.html),
+but take care to not duplicate those hooks with this resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.autoscaling_group import AutoscalingGroup
+from imports.aws.autoscaling_lifecycle_hook import AutoscalingLifecycleHook
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, maxSize, minSize):
+        super().__init__(scope, name)
+        foobar = AutoscalingGroup(self, "foobar",
+            availability_zones=["us-west-2a"],
+            health_check_type="EC2",
+            name="terraform-test-foobar5",
+            tag=[AutoscalingGroupTag(
+                key="Foo",
+                propagate_at_launch=True,
+                value="foo-bar"
+            )
+            ],
+            termination_policies=["OldestInstance"],
+            max_size=max_size,
+            min_size=min_size
+        )
+        aws_autoscaling_lifecycle_hook_foobar = AutoscalingLifecycleHook(self, "foobar_1",
+            autoscaling_group_name=foobar.name,
+            default_result="CONTINUE",
+            heartbeat_timeout=2000,
+            lifecycle_transition="autoscaling:EC2_INSTANCE_LAUNCHING",
+            name="foobar",
+            notification_metadata=Token.as_string(
+                Fn.jsonencode({
+                    "foo": "bar"
+                })),
+            notification_target_arn="arn:aws:sqs:us-east-1:444455556666:queue1*",
+            role_arn="arn:aws:iam::123456789012:role/S3Access"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_autoscaling_lifecycle_hook_foobar.override_logical_id("foobar")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) Name of the lifecycle hook.
+* `autoscaling_group_name` - (Required) Name of the Auto Scaling group to which you want to assign the lifecycle hook
+* `default_result` - (Optional) Defines the action the Auto Scaling group should take when the lifecycle hook timeout elapses or if an unexpected failure occurs. The value for this parameter can be either CONTINUE or ABANDON. The default value for this parameter is ABANDON.
+* `heartbeat_timeout` - (Optional) Defines the amount of time, in seconds, that can elapse before the lifecycle hook times out. When the lifecycle hook times out, Auto Scaling performs the action defined in the DefaultResult parameter
+* `lifecycle_transition` - (Required) Instance state to which you want to attach the lifecycle hook. For a list of lifecycle hook types, see [describe-lifecycle-hook-types](https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-lifecycle-hook-types.html#examples)
+* `notification_metadata` - (Optional) Contains additional information that you want to include any time Auto Scaling sends a message to the notification target.
+* `notification_target_arn` - (Optional) ARN of the notification target that Auto Scaling will use to notify you when an instance is in the transition state for the lifecycle hook. This ARN target can be either an SQS queue or an SNS topic.
+* `role_arn` - (Optional) ARN of the IAM role that allows the Auto Scaling group to publish to the specified notification target.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AutoScaling Lifecycle Hooks using the role autoscaling_group_name and name separated by `/`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import AutoScaling Lifecycle Hooks using the role autoscaling_group_name and name separated by `/`. For example:
+
+```console
+% terraform import aws_autoscaling_lifecycle_hook.test-lifecycle-hook asg-name/lifecycle-hook-name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-8ca53e0779c7b9f57e18da9406cc44b6560bf338b79f9897124efbb999b1bb41 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/autoscaling_notification.html.markdown b/website/docs/cdktf/python/r/autoscaling_notification.html.markdown
new file mode 100644
index 00000000000..9cb9eca9717
--- /dev/null
+++ b/website/docs/cdktf/python/r/autoscaling_notification.html.markdown
@@ -0,0 +1,76 @@
+---
+subcategory: "Auto Scaling"
+layout: "aws"
+page_title: "AWS: aws_autoscaling_notification"
+description: |-
+  Provides an AutoScaling Group with Notification support
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_autoscaling_notification
+
+Provides an AutoScaling Group with Notification support, via SNS Topics. Each of
+the `notifications` map to a [Notification Configuration][2] inside Amazon Web
+Services, and are applied to each AutoScaling Group you supply.
+
+## Example Usage
+
+Basic usage:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.autoscaling_group import AutoscalingGroup
+from imports.aws.autoscaling_notification import AutoscalingNotification
+from imports.aws.sns_topic import SnsTopic
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, maxSize, minSize, maxSize1, minSize1):
+        super().__init__(scope, name)
+        bar = AutoscalingGroup(self, "bar",
+            name="foobar1-terraform-test",
+            max_size=max_size,
+            min_size=min_size
+        )
+        foo = AutoscalingGroup(self, "foo",
+            name="barfoo-terraform-test",
+            max_size=max_size1,
+            min_size=min_size1
+        )
+        example = SnsTopic(self, "example",
+            name="example-topic"
+        )
+        AutoscalingNotification(self, "example_notifications",
+            group_names=[bar.name, foo.name],
+            notifications=["autoscaling:EC2_INSTANCE_LAUNCH", "autoscaling:EC2_INSTANCE_TERMINATE", "autoscaling:EC2_INSTANCE_LAUNCH_ERROR", "autoscaling:EC2_INSTANCE_TERMINATE_ERROR"
+            ],
+            topic_arn=example.arn
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `group_names` - (Required) List of AutoScaling Group Names
+* `notifications` - (Required) List of Notification Types that trigger
+notifications. Acceptable values are documented [in the AWS documentation here][1]
+* `topic_arn` - (Required) Topic ARN for notifications to be sent through
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `group_names`
+* `notifications`
+* `topic_arn`
+
+[1]: https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_NotificationConfiguration.html
+[2]: https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_DescribeNotificationConfigurations.html
+
+<!-- cache-key: cdktf-0.18.0 input-3938cfbc30acbf16d80d3b3f6c56e132af303339229bf6a953b7b328c401cceb -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/autoscaling_policy.html.markdown b/website/docs/cdktf/python/r/autoscaling_policy.html.markdown
new file mode 100644
index 00000000000..1c0314f6ab0
--- /dev/null
+++ b/website/docs/cdktf/python/r/autoscaling_policy.html.markdown
@@ -0,0 +1,508 @@
+---
+subcategory: "Auto Scaling"
+layout: "aws"
+page_title: "AWS: aws_autoscaling_policy"
+description: |-
+  Provides an AutoScaling Scaling Group resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_autoscaling_policy
+
+Provides an AutoScaling Scaling Policy resource.
+
+~> **NOTE:** You may want to omit `desired_capacity` attribute from attached `aws_autoscaling_group`
+when using autoscaling policies. It's good practice to pick either
+[manual](https://docs.aws.amazon.com/AutoScaling/latest/DeveloperGuide/as-manual-scaling.html)
+or [dynamic](https://docs.aws.amazon.com/AutoScaling/latest/DeveloperGuide/as-scale-based-on-demand.html)
+(policy-based) scaling.
+
+> **Hands-on:** Try the [Manage AWS Auto Scaling Groups](https://learn.hashicorp.com/tutorials/terraform/aws-asg?utm_source=WEBSITE&utm_medium=WEB_IO&utm_offer=ARTICLE_PAGE&utm_content=DOCS) tutorial on HashiCorp Learn.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.autoscaling_group import AutoscalingGroup
+from imports.aws.autoscaling_policy import AutoscalingPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        bar = AutoscalingGroup(self, "bar",
+            availability_zones=["us-east-1a"],
+            force_delete=True,
+            health_check_grace_period=300,
+            health_check_type="ELB",
+            launch_configuration=foo.name,
+            max_size=5,
+            min_size=2,
+            name="foobar3-terraform-test"
+        )
+        AutoscalingPolicy(self, "bat",
+            adjustment_type="ChangeInCapacity",
+            autoscaling_group_name=bar.name,
+            cooldown=300,
+            name="foobar3-terraform-test",
+            scaling_adjustment=4
+        )
+```
+
+### Create target tracking scaling policy using metric math
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.autoscaling_policy import AutoscalingPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AutoscalingPolicy(self, "example",
+            autoscaling_group_name="my-test-asg",
+            name="foo",
+            policy_type="TargetTrackingScaling",
+            target_tracking_configuration=AutoscalingPolicyTargetTrackingConfiguration(
+                customized_metric_specification=AutoscalingPolicyTargetTrackingConfigurationCustomizedMetricSpecification(
+                    metrics=[AutoscalingPolicyTargetTrackingConfigurationCustomizedMetricSpecificationMetrics(
+                        id="m1",
+                        label="Get the queue size (the number of messages waiting to be processed)",
+                        metric_stat=AutoscalingPolicyTargetTrackingConfigurationCustomizedMetricSpecificationMetricsMetricStat(
+                            metric=AutoscalingPolicyTargetTrackingConfigurationCustomizedMetricSpecificationMetricsMetricStatMetric(
+                                dimensions=[AutoscalingPolicyTargetTrackingConfigurationCustomizedMetricSpecificationMetricsMetricStatMetricDimensions(
+                                    name="QueueName",
+                                    value="my-queue"
+                                )
+                                ],
+                                metric_name="ApproximateNumberOfMessagesVisible",
+                                namespace="AWS/SQS"
+                            ),
+                            stat="Sum"
+                        ),
+                        return_data=False
+                    ), AutoscalingPolicyTargetTrackingConfigurationCustomizedMetricSpecificationMetrics(
+                        id="m2",
+                        label="Get the group size (the number of InService instances)",
+                        metric_stat=AutoscalingPolicyTargetTrackingConfigurationCustomizedMetricSpecificationMetricsMetricStat(
+                            metric=AutoscalingPolicyTargetTrackingConfigurationCustomizedMetricSpecificationMetricsMetricStatMetric(
+                                dimensions=[AutoscalingPolicyTargetTrackingConfigurationCustomizedMetricSpecificationMetricsMetricStatMetricDimensions(
+                                    name="AutoScalingGroupName",
+                                    value="my-asg"
+                                )
+                                ],
+                                metric_name="GroupInServiceInstances",
+                                namespace="AWS/AutoScaling"
+                            ),
+                            stat="Average"
+                        ),
+                        return_data=False
+                    ), AutoscalingPolicyTargetTrackingConfigurationCustomizedMetricSpecificationMetrics(
+                        expression="m1 / m2",
+                        id="e1",
+                        label="Calculate the backlog per instance",
+                        return_data=True
+                    )
+                    ]
+                ),
+                target_value=100
+            )
+        )
+```
+
+### Create predictive scaling policy using customized metrics
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.autoscaling_policy import AutoscalingPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AutoscalingPolicy(self, "example",
+            autoscaling_group_name="my-test-asg",
+            name="foo",
+            policy_type="PredictiveScaling",
+            predictive_scaling_configuration=AutoscalingPolicyPredictiveScalingConfiguration(
+                metric_specification=AutoscalingPolicyPredictiveScalingConfigurationMetricSpecification(
+                    customized_capacity_metric_specification=AutoscalingPolicyPredictiveScalingConfigurationMetricSpecificationCustomizedCapacityMetricSpecification(
+                        metric_data_queries=[AutoscalingPolicyPredictiveScalingConfigurationMetricSpecificationCustomizedCapacityMetricSpecificationMetricDataQueries(
+                            expression="SUM(SEARCH('{AWS/AutoScaling,AutoScalingGroupName} MetricName=\\\"GroupInServiceIntances\\\" my-test-asg', 'Average', 300))",
+                            id="capacity_sum"
+                        )
+                        ]
+                    ),
+                    customized_load_metric_specification=AutoscalingPolicyPredictiveScalingConfigurationMetricSpecificationCustomizedLoadMetricSpecification(
+                        metric_data_queries=[AutoscalingPolicyPredictiveScalingConfigurationMetricSpecificationCustomizedLoadMetricSpecificationMetricDataQueries(
+                            expression="SUM(SEARCH('{AWS/EC2,AutoScalingGroupName} MetricName=\\\"CPUUtilization\\\" my-test-asg', 'Sum', 3600))",
+                            id="load_sum"
+                        )
+                        ]
+                    ),
+                    customized_scaling_metric_specification=AutoscalingPolicyPredictiveScalingConfigurationMetricSpecificationCustomizedScalingMetricSpecification(
+                        metric_data_queries=[AutoscalingPolicyPredictiveScalingConfigurationMetricSpecificationCustomizedScalingMetricSpecificationMetricDataQueries(
+                            expression="SUM(SEARCH('{AWS/AutoScaling,AutoScalingGroupName} MetricName=\\\"GroupInServiceIntances\\\" my-test-asg', 'Average', 300))",
+                            id="capacity_sum",
+                            return_data=False
+                        ), AutoscalingPolicyPredictiveScalingConfigurationMetricSpecificationCustomizedScalingMetricSpecificationMetricDataQueries(
+                            expression="SUM(SEARCH('{AWS/EC2,AutoScalingGroupName} MetricName=\\\"CPUUtilization\\\" my-test-asg', 'Sum', 300))",
+                            id="load_sum",
+                            return_data=False
+                        ), AutoscalingPolicyPredictiveScalingConfigurationMetricSpecificationCustomizedScalingMetricSpecificationMetricDataQueries(
+                            expression="load_sum / (capacity_sum * PERIOD(capacity_sum) / 60)",
+                            id="weighted_average"
+                        )
+                        ]
+                    ),
+                    target_value=10
+                )
+            )
+        )
+```
+
+### Create predictive scaling policy using customized scaling and predefined load metric
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.autoscaling_policy import AutoscalingPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AutoscalingPolicy(self, "example",
+            autoscaling_group_name="my-test-asg",
+            name="foo",
+            policy_type="PredictiveScaling",
+            predictive_scaling_configuration=AutoscalingPolicyPredictiveScalingConfiguration(
+                metric_specification=AutoscalingPolicyPredictiveScalingConfigurationMetricSpecification(
+                    customized_scaling_metric_specification=AutoscalingPolicyPredictiveScalingConfigurationMetricSpecificationCustomizedScalingMetricSpecification(
+                        metric_data_queries=[AutoscalingPolicyPredictiveScalingConfigurationMetricSpecificationCustomizedScalingMetricSpecificationMetricDataQueries(
+                            id="scaling",
+                            metric_stat=AutoscalingPolicyPredictiveScalingConfigurationMetricSpecificationCustomizedScalingMetricSpecificationMetricDataQueriesMetricStat(
+                                metric=AutoscalingPolicyPredictiveScalingConfigurationMetricSpecificationCustomizedScalingMetricSpecificationMetricDataQueriesMetricStatMetric(
+                                    dimensions=[AutoscalingPolicyPredictiveScalingConfigurationMetricSpecificationCustomizedScalingMetricSpecificationMetricDataQueriesMetricStatMetricDimensions(
+                                        name="AutoScalingGroupName",
+                                        value="my-test-asg"
+                                    )
+                                    ],
+                                    metric_name="CPUUtilization",
+                                    namespace="AWS/EC2"
+                                ),
+                                stat="Average"
+                            )
+                        )
+                        ]
+                    ),
+                    predefined_load_metric_specification=AutoscalingPolicyPredictiveScalingConfigurationMetricSpecificationPredefinedLoadMetricSpecification(
+                        predefined_metric_type="ASGTotalCPUUtilization",
+                        resource_label="testLabel"
+                    ),
+                    target_value=10
+                )
+            )
+        )
+```
+
+## Argument Reference
+
+* `name` - (Required) Name of the policy.
+* `autoscaling_group_name` - (Required) Name of the autoscaling group.
+* `adjustment_type` - (Optional) Whether the adjustment is an absolute number or a percentage of the current capacity. Valid values are `ChangeInCapacity`, `ExactCapacity`, and `PercentChangeInCapacity`.
+* `policy_type` - (Optional) Policy type, either "SimpleScaling", "StepScaling", "TargetTrackingScaling", or "PredictiveScaling". If this value isn't provided, AWS will default to "SimpleScaling."
+* `predictive_scaling_configuration` - (Optional) Predictive scaling policy configuration to use with Amazon EC2 Auto Scaling.
+* `estimated_instance_warmup` - (Optional) Estimated time, in seconds, until a newly launched instance will contribute CloudWatch metrics. Without a value, AWS will default to the group's specified cooldown period.
+* `enabled` - (Optional) Whether the scaling policy is enabled or disabled. Default: `true`.
+
+The following argument is only available to "SimpleScaling" and "StepScaling" type policies:
+
+* `min_adjustment_magnitude` - (Optional) Minimum value to scale by when `adjustment_type` is set to `PercentChangeInCapacity`.
+
+The following arguments are only available to "SimpleScaling" type policies:
+
+* `cooldown` - (Optional) Amount of time, in seconds, after a scaling activity completes and before the next scaling activity can start.
+* `scaling_adjustment` - (Optional) Number of instances by which to scale. `adjustment_type` determines the interpretation of this number (e.g., as an absolute number or as a percentage of the existing Auto Scaling group size). A positive increment adds to the current capacity and a negative value removes from the current capacity.
+
+The following arguments are only available to "StepScaling" type policies:
+
+* `metric_aggregation_type` - (Optional) Aggregation type for the policy's metrics. Valid values are "Minimum", "Maximum", and "Average". Without a value, AWS will treat the aggregation type as "Average".
+* `step_adjustment` - (Optional) Set of adjustments that manage
+group scaling. These have the following structure:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, Op, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.autoscaling_policy import AutoscalingPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, autoscalingGroupName, name):
+        super().__init__(scope, name)
+        AutoscalingPolicy(self, "example",
+            step_adjustment=[AutoscalingPolicyStepAdjustment(
+                metric_interval_lower_bound=Token.as_string(1),
+                metric_interval_upper_bound=Token.as_string(2),
+                scaling_adjustment=Token.as_number(Op.negate(1))
+            ), AutoscalingPolicyStepAdjustment(
+                metric_interval_lower_bound=Token.as_string(2),
+                metric_interval_upper_bound=Token.as_string(3),
+                scaling_adjustment=1
+            )
+            ],
+            autoscaling_group_name=autoscaling_group_name,
+            name=name
+        )
+```
+
+The following fields are available in step adjustments:
+
+* `scaling_adjustment` - (Required) Number of members by which to
+scale, when the adjustment bounds are breached. A positive value scales
+up. A negative value scales down.
+* `metric_interval_lower_bound` - (Optional) Lower bound for the
+difference between the alarm threshold and the CloudWatch metric.
+Without a value, AWS will treat this bound as negative infinity.
+* `metric_interval_upper_bound` - (Optional) Upper bound for the
+difference between the alarm threshold and the CloudWatch metric.
+Without a value, AWS will treat this bound as positive infinity. The upper bound
+must be greater than the lower bound.
+
+Notice the bounds are **relative** to the alarm threshold, meaning that the starting point is not 0%, but the alarm threshold. Check the official [docs](https://docs.aws.amazon.com/autoscaling/ec2/userguide/as-scaling-simple-step.html#as-scaling-steps) for a detailed example.
+
+The following arguments are only available to "TargetTrackingScaling" type policies:
+
+* `target_tracking_configuration` - (Optional) Target tracking policy. These have the following structure:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.autoscaling_policy import AutoscalingPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, autoscalingGroupName, name):
+        super().__init__(scope, name)
+        AutoscalingPolicy(self, "example",
+            target_tracking_configuration=AutoscalingPolicyTargetTrackingConfiguration(
+                predefined_metric_specification=AutoscalingPolicyTargetTrackingConfigurationPredefinedMetricSpecification(
+                    predefined_metric_type="ASGAverageCPUUtilization"
+                ),
+                target_value=40
+            ),
+            autoscaling_group_name=autoscaling_group_name,
+            name=name
+        )
+```
+
+The following fields are available in target tracking configuration:
+
+* `predefined_metric_specification` - (Optional) Predefined metric. Conflicts with `customized_metric_specification`.
+* `customized_metric_specification` - (Optional) Customized metric. Conflicts with `predefined_metric_specification`.
+* `target_value` - (Required) Target value for the metric.
+* `disable_scale_in` - (Optional, Default: false) Whether scale in by the target tracking policy is disabled.
+
+### predefined_metric_specification
+
+This argument supports the following arguments:
+
+* `predefined_metric_type` - (Required) Metric type.
+* `resource_label` - (Optional) Identifies the resource associated with the metric type.
+
+### customized_metric_specification
+
+This argument supports the following arguments:
+
+* `metric_dimension` - (Optional) Dimensions of the metric.
+* `metric_name` - (Optional) Name of the metric.
+* `namespace` - (Optional) Namespace of the metric.
+* `statistic` - (Optional) Statistic of the metric.
+* `unit` - (Optional) Unit of the metric.
+* `metrics` - (Optional) Metrics to include, as a metric data query.
+
+#### metric_dimension
+
+This argument supports the following arguments:
+
+* `name` - (Required) Name of the dimension.
+* `value` - (Required) Value of the dimension.
+
+#### metrics
+
+This argument supports the following arguments:
+
+* `expression` - (Optional) Math expression used on the returned metric. You must specify either `expression` or `metric_stat`, but not both.
+* `id` - (Required) Short name for the metric used in target tracking scaling policy.
+* `label` - (Optional) Human-readable label for this metric or expression.
+* `metric_stat` - (Optional) Structure that defines CloudWatch metric to be used in target tracking scaling policy. You must specify either `expression` or `metric_stat`, but not both.
+* `return_data` - (Optional) Boolean that indicates whether to return the timestamps and raw data values of this metric, the default is true
+
+##### metric_stat
+
+This argument supports the following arguments:
+
+* `metric` - (Required) Structure that defines the CloudWatch metric to return, including the metric name, namespace, and dimensions.
+* `stat` - (Required) Statistic of the metrics to return.
+* `unit` - (Optional) Unit of the metrics to return.
+
+##### metric
+
+This argument supports the following arguments:
+
+* `dimensions` - (Optional) Dimensions of the metric.
+* `metric_name` - (Required) Name of the metric.
+* `namespace` - (Required) Namespace of the metric.
+
+###### dimensions
+
+This argument supports the following arguments:
+
+* `name` - (Required) Name of the dimension.
+* `value` - (Required) Value of the dimension.
+
+### predictive_scaling_configuration
+
+This argument supports the following arguments:
+
+* `max_capacity_breach_behavior` - (Optional) Defines the behavior that should be applied if the forecast capacity approaches or exceeds the maximum capacity of the Auto Scaling group. Valid values are `HonorMaxCapacity` or `IncreaseMaxCapacity`. Default is `HonorMaxCapacity`.
+* `max_capacity_buffer` - (Optional) Size of the capacity buffer to use when the forecast capacity is close to or exceeds the maximum capacity. Valid range is `0` to `100`. If set to `0`, Amazon EC2 Auto Scaling may scale capacity higher than the maximum capacity to equal but not exceed forecast capacity.
+* `metric_specification` - (Required) This structure includes the metrics and target utilization to use for predictive scaling.
+* `mode` - (Optional) Predictive scaling mode. Valid values are `ForecastAndScale` and `ForecastOnly`. Default is `ForecastOnly`.
+* `scheduling_buffer_time` - (Optional) Amount of time, in seconds, by which the instance launch time can be advanced. Minimum is `0`.
+
+#### metric_specification
+
+This argument supports the following arguments:
+
+* `customized_capacity_metric_specification` - (Optional) Customized capacity metric specification. The field is only valid when you use `customized_load_metric_specification`
+* `customized_load_metric_specification` - (Optional) Customized load metric specification.
+* `customized_scaling_metric_specification` - (Optional) Customized scaling metric specification.
+* `predefined_load_metric_specification` - (Optional) Predefined load metric specification.
+* `predefined_metric_pair_specification` - (Optional) Metric pair specification from which Amazon EC2 Auto Scaling determines the appropriate scaling metric and load metric to use.
+* `predefined_scaling_metric_specification` - (Optional) Predefined scaling metric specification.
+
+##### predefined_load_metric_specification
+
+This argument supports the following arguments:
+
+* `predefined_metric_type` - (Required) Metric type. Valid values are `ASGTotalCPUUtilization`, `ASGTotalNetworkIn`, `ASGTotalNetworkOut`, or `ALBTargetGroupRequestCount`.
+* `resource_label` - (Required) Label that uniquely identifies a specific Application Load Balancer target group from which to determine the request count served by your Auto Scaling group.
+
+##### predefined_metric_pair_specification
+
+This argument supports the following arguments:
+
+* `predefined_metric_type` - (Required) Which metrics to use. There are two different types of metrics for each metric type: one is a load metric and one is a scaling metric. For example, if the metric type is `ASGCPUUtilization`, the Auto Scaling group's total CPU metric is used as the load metric, and the average CPU metric is used for the scaling metric. Valid values are `ASGCPUUtilization`, `ASGNetworkIn`, `ASGNetworkOut`, or `ALBRequestCount`.
+* `resource_label` - (Required) Label that uniquely identifies a specific Application Load Balancer target group from which to determine the request count served by your Auto Scaling group.
+
+##### predefined_scaling_metric_specification
+
+This argument supports the following arguments:
+
+* `predefined_metric_type` - (Required) Describes a scaling metric for a predictive scaling policy. Valid values are `ASGAverageCPUUtilization`, `ASGAverageNetworkIn`, `ASGAverageNetworkOut`, or `ALBRequestCountPerTarget`.
+* `resource_label` - (Required) Label that uniquely identifies a specific Application Load Balancer target group from which to determine the request count served by your Auto Scaling group.
+
+##### customized_scaling_metric_specification
+
+This argument supports the following arguments:
+
+* `metric_data_queries` - (Required) List of up to 10 structures that defines custom scaling metric in predictive scaling policy
+
+##### customized_load_metric_specification
+
+This argument supports the following arguments:
+
+* `metric_data_queries` - (Required) List of up to 10 structures that defines custom load metric in predictive scaling policy
+
+##### customized_capacity_metric_specification
+
+This argument supports the following arguments:
+
+* `metric_data_queries` - (Required) List of up to 10 structures that defines custom capacity metric in predictive scaling policy
+
+##### metric_data_queries
+
+This argument supports the following arguments:
+
+* `expression` - (Optional) Math expression used on the returned metric. You must specify either `expression` or `metric_stat`, but not both.
+* `id` - (Required) Short name for the metric used in predictive scaling policy.
+* `label` - (Optional) Human-readable label for this metric or expression.
+* `metric_stat` - (Optional) Structure that defines CloudWatch metric to be used in predictive scaling policy. You must specify either `expression` or `metric_stat`, but not both.
+* `return_data` - (Optional) Boolean that indicates whether to return the timestamps and raw data values of this metric, the default is true
+
+##### metric_stat
+
+This argument supports the following arguments:
+
+* `metric` - (Required) Structure that defines the CloudWatch metric to return, including the metric name, namespace, and dimensions.
+* `stat` - (Required) Statistic of the metrics to return.
+* `unit` - (Optional) Unit of the metrics to return.
+
+##### metric
+
+This argument supports the following arguments:
+
+* `dimensions` - (Optional) Dimensions of the metric.
+* `metric_name` - (Required) Name of the metric.
+* `namespace` - (Required) Namespace of the metric.
+
+##### dimensions
+
+This argument supports the following arguments:
+
+* `name` - (Required) Name of the dimension.
+* `value` - (Required) Value of the dimension.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN assigned by AWS to the scaling policy.
+* `name` - Scaling policy's name.
+* `autoscaling_group_name` - The scaling policy's assigned autoscaling group.
+* `adjustment_type` - Scaling policy's adjustment type.
+* `policy_type` - Scaling policy's type.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AutoScaling scaling policy using the role autoscaling_group_name and name separated by `/`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import AutoScaling scaling policy using the role autoscaling_group_name and name separated by `/`. For example:
+
+```console
+% terraform import aws_autoscaling_policy.test-policy asg-name/policy-name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-6ef16432ba01c530072bf934dd255361c14e5ea52efe71ab800335601445b659 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/autoscaling_schedule.html.markdown b/website/docs/cdktf/python/r/autoscaling_schedule.html.markdown
new file mode 100644
index 00000000000..59f404ec196
--- /dev/null
+++ b/website/docs/cdktf/python/r/autoscaling_schedule.html.markdown
@@ -0,0 +1,97 @@
+---
+subcategory: "Auto Scaling"
+layout: "aws"
+page_title: "AWS: aws_autoscaling_schedule"
+description: |-
+  Provides an AutoScaling Schedule resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_autoscaling_schedule
+
+Provides an AutoScaling Schedule resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.autoscaling_group import AutoscalingGroup
+from imports.aws.autoscaling_schedule import AutoscalingSchedule
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        foobar = AutoscalingGroup(self, "foobar",
+            availability_zones=["us-west-2a"],
+            force_delete=True,
+            health_check_grace_period=300,
+            health_check_type="ELB",
+            max_size=1,
+            min_size=1,
+            name="terraform-test-foobar5",
+            termination_policies=["OldestInstance"]
+        )
+        aws_autoscaling_schedule_foobar = AutoscalingSchedule(self, "foobar_1",
+            autoscaling_group_name=foobar.name,
+            desired_capacity=0,
+            end_time="2016-12-12T06:00:00Z",
+            max_size=1,
+            min_size=0,
+            scheduled_action_name="foobar",
+            start_time="2016-12-11T18:00:00Z"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_autoscaling_schedule_foobar.override_logical_id("foobar")
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `autoscaling_group_name` - (Required) The name of the Auto Scaling group.
+* `scheduled_action_name` - (Required) The name of this scaling action.
+
+The following arguments are optional:
+
+* `desired_capacity` - (Optional) The initial capacity of the Auto Scaling group after the scheduled action runs and the capacity it attempts to maintain. Set to `-1` if you don't want to change the desired capacity at the scheduled time. Defaults to `0`.
+* `end_time` - (Optional) The date and time for the recurring schedule to end, in UTC with the format `"YYYY-MM-DDThh:mm:ssZ"` (e.g. `"2021-06-01T00:00:00Z"`).
+* `max_size` - (Optional) The maximum size of the Auto Scaling group. Set to `-1` if you don't want to change the maximum size at the scheduled time. Defaults to `0`.
+* `min_size` - (Optional) The minimum size of the Auto Scaling group. Set to `-1` if you don't want to change the minimum size at the scheduled time. Defaults to `0`.
+* `recurrence` - (Optional) The recurring schedule for this action specified using the Unix cron syntax format.
+* `start_time` - (Optional) The date and time for the recurring schedule to start, in UTC with the format `"YYYY-MM-DDThh:mm:ssZ"` (e.g. `"2021-06-01T00:00:00Z"`).
+* `time_zone` - (Optional)  Specifies the time zone for a cron expression. Valid values are the canonical names of the IANA time zones (such as `Etc/GMT+9` or `Pacific/Tahiti`).
+
+~> **NOTE:** When `start_time` and `end_time` are specified with `recurrence` , they form the boundaries of when the recurring action will start and stop.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN assigned by AWS to the autoscaling schedule.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AutoScaling ScheduledAction using the `auto-scaling-group-name` and `scheduled-action-name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import AutoScaling ScheduledAction using the `auto-scaling-group-name` and `scheduled-action-name`. For example:
+
+```console
+% terraform import aws_autoscaling_schedule.resource-name auto-scaling-group-name/scheduled-action-name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-5be402701834f8814cc05c38173674caf079493d6dfbaad45363725e999d42d0 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/autoscaling_traffic_source_attachment.html.markdown b/website/docs/cdktf/python/r/autoscaling_traffic_source_attachment.html.markdown
new file mode 100644
index 00000000000..1e3c63f436c
--- /dev/null
+++ b/website/docs/cdktf/python/r/autoscaling_traffic_source_attachment.html.markdown
@@ -0,0 +1,62 @@
+---
+subcategory: "Auto Scaling"
+layout: "aws"
+page_title: "AWS: aws_autoscaling_traffic_source_attachment"
+description: |-
+  Terraform resource for managing an AWS Auto Scaling Traffic Source Attachment.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_autoscaling_traffic_source_attachment
+
+Attaches a traffic source to an Auto Scaling group.
+
+~> **NOTE on Auto Scaling Groups, Attachments and Traffic Source Attachments:** Terraform provides standalone [Attachment](autoscaling_attachment.html) (for attaching Classic Load Balancers and Application Load Balancer, Gateway Load Balancer, or Network Load Balancer target groups) and Traffic Source Attachment (for attaching Load Balancers and VPC Lattice target groups) resources and an [Auto Scaling Group](autoscaling_group.html) resource with `load_balancers`, `target_group_arns` and `traffic_source` attributes. Do not use the same traffic source in more than one of these resources. Doing so will cause a conflict of attachments. A [`lifecycle` configuration block](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html) can be used to suppress differences if necessary.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.autoscaling_traffic_source_attachment import AutoscalingTrafficSourceAttachment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AutoscalingTrafficSourceAttachment(self, "example",
+            autoscaling_group_name=Token.as_string(aws_autoscaling_group_example.id),
+            traffic_source=AutoscalingTrafficSourceAttachmentTrafficSource(
+                identifier=Token.as_string(aws_lb_target_group_example.arn),
+                type="elbv2"
+            )
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+- `autoscaling_group_name` - (Required) The name of the Auto Scaling group.
+- `traffic_source` - (Required) The unique identifiers of a traffic sources.
+
+`traffic_source` supports the following:
+
+- `identifier` - (Required) Identifies the traffic source. For Application Load Balancers, Gateway Load Balancers, Network Load Balancers, and VPC Lattice, this will be the Amazon Resource Name (ARN) for a target group in this account and Region. For Classic Load Balancers, this will be the name of the Classic Load Balancer in this account and Region.
+- `type` - (Required) Provides additional context for the value of `identifier`.
+  The following lists the valid values:
+  `elb` if `identifier` is the name of a Classic Load Balancer.
+  `elbv2` if `identifier` is the ARN of an Application Load Balancer, Gateway Load Balancer, or Network Load Balancer target group.
+  `vpc-lattice` if `identifier` is the ARN of a VPC Lattice target group.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+<!-- cache-key: cdktf-0.18.0 input-72bb6c9704283849d9c75ff3dafc57a9e90be5f5708ae5130ec931e2c4f0ef04 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/autoscalingplans_scaling_plan.html.markdown b/website/docs/cdktf/python/r/autoscalingplans_scaling_plan.html.markdown
new file mode 100644
index 00000000000..9ca4455b965
--- /dev/null
+++ b/website/docs/cdktf/python/r/autoscalingplans_scaling_plan.html.markdown
@@ -0,0 +1,260 @@
+---
+subcategory: "Auto Scaling Plans"
+layout: "aws"
+page_title: "AWS: aws_autoscalingplans_scaling_plan"
+description: |-
+  Manages an AWS Auto Scaling scaling plan.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_autoscalingplans_scaling_plan
+
+Manages an AWS Auto Scaling scaling plan.
+More information can be found in the [AWS Auto Scaling User Guide](https://docs.aws.amazon.com/autoscaling/plans/userguide/what-is-aws-auto-scaling.html).
+
+~> **NOTE:** The AWS Auto Scaling service uses an AWS IAM service-linked role to manage predictive scaling of Amazon EC2 Auto Scaling groups. The service attempts to automatically create this role the first time a scaling plan with predictive scaling enabled is created.
+An [`aws_iam_service_linked_role`](/docs/providers/aws/r/iam_service_linked_role.html) resource can be used to manually manage this role.
+See the [AWS documentation](https://docs.aws.amazon.com/autoscaling/plans/userguide/aws-auto-scaling-service-linked-roles.html#create-service-linked-role-manual) for more details.
+
+## Example Usage
+
+### Basic Dynamic Scaling
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.autoscaling_group import AutoscalingGroup
+from imports.aws.autoscalingplans_scaling_plan import AutoscalingplansScalingPlan
+from imports.aws.data_aws_availability_zones import DataAwsAvailabilityZones
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        available = DataAwsAvailabilityZones(self, "available")
+        example = AutoscalingGroup(self, "example",
+            availability_zones=[
+                Token.as_string(Fn.lookup_nested(available.names, ["0"]))
+            ],
+            launch_configuration=Token.as_string(aws_launch_configuration_example.name),
+            max_size=3,
+            min_size=0,
+            name_prefix="example",
+            tags=[{
+                "key": "application",
+                "propagate_at_launch": True,
+                "value": "example"
+            }
+            ]
+        )
+        aws_autoscalingplans_scaling_plan_example =
+        AutoscalingplansScalingPlan(self, "example_2",
+            application_source=AutoscalingplansScalingPlanApplicationSource(
+                tag_filter=[AutoscalingplansScalingPlanApplicationSourceTagFilter(
+                    key="application",
+                    values=["example"]
+                )
+                ]
+            ),
+            name="example-dynamic-cost-optimization",
+            scaling_instruction=[AutoscalingplansScalingPlanScalingInstruction(
+                max_capacity=3,
+                min_capacity=0,
+                resource_id=Token.as_string(
+                    Fn.format("autoScalingGroup/%s", [example.name])),
+                scalable_dimension="autoscaling:autoScalingGroup:DesiredCapacity",
+                service_namespace="autoscaling",
+                target_tracking_configuration=[AutoscalingplansScalingPlanScalingInstructionTargetTrackingConfiguration(
+                    predefined_scaling_metric_specification=AutoscalingplansScalingPlanScalingInstructionTargetTrackingConfigurationPredefinedScalingMetricSpecification(
+                        predefined_scaling_metric_type="ASGAverageCPUUtilization"
+                    ),
+                    target_value=70
+                )
+                ]
+            )
+            ]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_autoscalingplans_scaling_plan_example.override_logical_id("example")
+```
+
+### Basic Predictive Scaling
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.autoscaling_group import AutoscalingGroup
+from imports.aws.autoscalingplans_scaling_plan import AutoscalingplansScalingPlan
+from imports.aws.data_aws_availability_zones import DataAwsAvailabilityZones
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        available = DataAwsAvailabilityZones(self, "available")
+        example = AutoscalingGroup(self, "example",
+            availability_zones=[
+                Token.as_string(Fn.lookup_nested(available.names, ["0"]))
+            ],
+            launch_configuration=Token.as_string(aws_launch_configuration_example.name),
+            max_size=3,
+            min_size=0,
+            name_prefix="example",
+            tags=[{
+                "key": "application",
+                "propagate_at_launch": True,
+                "value": "example"
+            }
+            ]
+        )
+        aws_autoscalingplans_scaling_plan_example =
+        AutoscalingplansScalingPlan(self, "example_2",
+            application_source=AutoscalingplansScalingPlanApplicationSource(
+                tag_filter=[AutoscalingplansScalingPlanApplicationSourceTagFilter(
+                    key="application",
+                    values=["example"]
+                )
+                ]
+            ),
+            name="example-predictive-cost-optimization",
+            scaling_instruction=[AutoscalingplansScalingPlanScalingInstruction(
+                disable_dynamic_scaling=True,
+                max_capacity=3,
+                min_capacity=0,
+                predefined_load_metric_specification=AutoscalingplansScalingPlanScalingInstructionPredefinedLoadMetricSpecification(
+                    predefined_load_metric_type="ASGTotalCPUUtilization"
+                ),
+                predictive_scaling_max_capacity_behavior="SetForecastCapacityToMaxCapacity",
+                predictive_scaling_mode="ForecastAndScale",
+                resource_id=Token.as_string(
+                    Fn.format("autoScalingGroup/%s", [example.name])),
+                scalable_dimension="autoscaling:autoScalingGroup:DesiredCapacity",
+                service_namespace="autoscaling",
+                target_tracking_configuration=[AutoscalingplansScalingPlanScalingInstructionTargetTrackingConfiguration(
+                    predefined_scaling_metric_specification=AutoscalingplansScalingPlanScalingInstructionTargetTrackingConfigurationPredefinedScalingMetricSpecification(
+                        predefined_scaling_metric_type="ASGAverageCPUUtilization"
+                    ),
+                    target_value=70
+                )
+                ]
+            )
+            ]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_autoscalingplans_scaling_plan_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) Name of the scaling plan. Names cannot contain vertical bars, colons, or forward slashes.
+* `application_source` - (Required) CloudFormation stack or set of tags. You can create one scaling plan per application source.
+* `scaling_instruction` - (Required) Scaling instructions. More details can be found in the [AWS Auto Scaling API Reference](https://docs.aws.amazon.com/autoscaling/plans/APIReference/API_ScalingInstruction.html).
+
+The `application_source` object supports the following:
+
+* `cloudformation_stack_arn` - (Optional) ARN of a AWS CloudFormation stack.
+* `tag_filter` - (Optional) Set of tags.
+
+The `tag_filter` object supports the following:
+
+* `key` - (Required) Tag key.
+* `values` - (Optional) Tag values.
+
+The `scaling_instruction` object supports the following:
+
+* `max_capacity` - (Required) Maximum capacity of the resource. The exception to this upper limit is if you specify a non-default setting for `predictive_scaling_max_capacity_behavior`.
+* `min_capacity` - (Required) Minimum capacity of the resource.
+* `resource_id` - (Required) ID of the resource. This string consists of the resource type and unique identifier.
+* `scalable_dimension` - (Required) Scalable dimension associated with the resource. Valid values: `autoscaling:autoScalingGroup:DesiredCapacity`, `dynamodb:index:ReadCapacityUnits`, `dynamodb:index:WriteCapacityUnits`, `dynamodb:table:ReadCapacityUnits`, `dynamodb:table:WriteCapacityUnits`, `ecs:service:DesiredCount`, `ec2:spot-fleet-request:TargetCapacity`, `rds:cluster:ReadReplicaCount`.
+* `service_namespace` - (Required) Namespace of the AWS service. Valid values: `autoscaling`, `dynamodb`, `ecs`, `ec2`, `rds`.
+* `target_tracking_configuration` - (Required) Structure that defines new target tracking configurations. Each of these structures includes a specific scaling metric and a target value for the metric, along with various parameters to use with dynamic scaling.
+More details can be found in the [AWS Auto Scaling API Reference](https://docs.aws.amazon.com/autoscaling/plans/APIReference/API_TargetTrackingConfiguration.html).
+* `customized_load_metric_specification` - (Optional) Customized load metric to use for predictive scaling. You must specify either `customized_load_metric_specification` or `predefined_load_metric_specification` when configuring predictive scaling.
+More details can be found in the [AWS Auto Scaling API Reference](https://docs.aws.amazon.com/autoscaling/plans/APIReference/API_CustomizedLoadMetricSpecification.html).
+* `disable_dynamic_scaling` - (Optional) Boolean controlling whether dynamic scaling by AWS Auto Scaling is disabled. Defaults to `false`.
+* `predefined_load_metric_specification` - (Optional) Predefined load metric to use for predictive scaling. You must specify either `predefined_load_metric_specification` or `customized_load_metric_specification` when configuring predictive scaling.
+More details can be found in the [AWS Auto Scaling API Reference](https://docs.aws.amazon.com/autoscaling/plans/APIReference/API_PredefinedLoadMetricSpecification.html).
+* `predictive_scaling_max_capacity_behavior`- (Optional) Defines the behavior that should be applied if the forecast capacity approaches or exceeds the maximum capacity specified for the resource.
+Valid values: `SetForecastCapacityToMaxCapacity`, `SetMaxCapacityAboveForecastCapacity`, `SetMaxCapacityToForecastCapacity`.
+* `predictive_scaling_max_capacity_buffer` - (Optional) Size of the capacity buffer to use when the forecast capacity is close to or exceeds the maximum capacity.
+* `predictive_scaling_mode` - (Optional) Predictive scaling mode. Valid values: `ForecastAndScale`, `ForecastOnly`.
+* `scaling_policy_update_behavior` - (Optional) Controls whether a resource's externally created scaling policies are kept or replaced. Valid values: `KeepExternalPolicies`, `ReplaceExternalPolicies`. Defaults to `KeepExternalPolicies`.
+* `scheduled_action_buffer_time` - (Optional) Amount of time, in seconds, to buffer the run time of scheduled scaling actions when scaling out.
+
+The `customized_load_metric_specification` object supports the following:
+
+* `metric_name` - (Required) Name of the metric.
+* `namespace` - (Required) Namespace of the metric.
+* `statistic` - (Required) Statistic of the metric. Currently, the value must always be `Sum`.
+* `dimensions` - (Optional) Dimensions of the metric.
+* `unit` - (Optional) Unit of the metric.
+
+The `predefined_load_metric_specification` object supports the following:
+
+* `predefined_load_metric_type` - (Required) Metric type. Valid values: `ALBTargetGroupRequestCount`, `ASGTotalCPUUtilization`, `ASGTotalNetworkIn`, `ASGTotalNetworkOut`.
+* `resource_label` - (Optional) Identifies the resource associated with the metric type.
+
+The `target_tracking_configuration` object supports the following:
+
+* `target_value` - (Required) Target value for the metric.
+* `customized_scaling_metric_specification` - (Optional) Customized metric. You can specify either `customized_scaling_metric_specification` or `predefined_scaling_metric_specification`.
+More details can be found in the [AWS Auto Scaling API Reference](https://docs.aws.amazon.com/autoscaling/plans/APIReference/API_CustomizedScalingMetricSpecification.html).
+* `disable_scale_in` - (Optional) Boolean indicating whether scale in by the target tracking scaling policy is disabled. Defaults to `false`.
+* `predefined_scaling_metric_specification` - (Optional) Predefined metric. You can specify either `predefined_scaling_metric_specification` or `customized_scaling_metric_specification`.
+More details can be found in the [AWS Auto Scaling API Reference](https://docs.aws.amazon.com/autoscaling/plans/APIReference/API_PredefinedScalingMetricSpecification.html).
+* `estimated_instance_warmup` - (Optional) Estimated time, in seconds, until a newly launched instance can contribute to the CloudWatch metrics.
+This value is used only if the resource is an Auto Scaling group.
+* `scale_in_cooldown` - (Optional) Amount of time, in seconds, after a scale in activity completes before another scale in activity can start.
+This value is not used if the scalable resource is an Auto Scaling group.
+* `scale_out_cooldown` - (Optional) Amount of time, in seconds, after a scale-out activity completes before another scale-out activity can start.
+This value is not used if the scalable resource is an Auto Scaling group.
+
+The `customized_scaling_metric_specification` object supports the following:
+
+* `metric_name` - (Required) Name of the metric.
+* `namespace` - (Required) Namespace of the metric.
+* `statistic` - (Required) Statistic of the metric. Valid values: `Average`, `Maximum`, `Minimum`, `SampleCount`, `Sum`.
+* `dimensions` - (Optional) Dimensions of the metric.
+* `unit` - (Optional) Unit of the metric.
+
+The `predefined_scaling_metric_specification` object supports the following:
+
+* `predefined_scaling_metric_type` - (Required) Metric type. Valid values: `ALBRequestCountPerTarget`, `ASGAverageCPUUtilization`, `ASGAverageNetworkIn`, `ASGAverageNetworkOut`, `DynamoDBReadCapacityUtilization`, `DynamoDBWriteCapacityUtilization`, `ECSServiceAverageCPUUtilization`, `ECSServiceAverageMemoryUtilization`, `EC2SpotFleetRequestAverageCPUUtilization`, `EC2SpotFleetRequestAverageNetworkIn`, `EC2SpotFleetRequestAverageNetworkOut`, `RDSReaderAverageCPUUtilization`, `RDSReaderAverageDatabaseConnections`.
+* `resource_label` - (Optional) Identifies the resource associated with the metric type.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Scaling plan identifier.
+* `scaling_plan_version` - The version number of the scaling plan. This value is always 1.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Auto Scaling scaling plans using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Auto Scaling scaling plans using the `name`. For example:
+
+```console
+% terraform import aws_autoscalingplans_scaling_plan.example MyScale1
+```
+
+<!-- cache-key: cdktf-0.18.0 input-f67f35037f518287955e616d7a36d30ef67c9f228d87872a4d2e00fce74eaaef -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/backup_framework.html.markdown b/website/docs/cdktf/python/r/backup_framework.html.markdown
new file mode 100644
index 00000000000..73656dc7b2f
--- /dev/null
+++ b/website/docs/cdktf/python/r/backup_framework.html.markdown
@@ -0,0 +1,167 @@
+---
+subcategory: "Backup"
+layout: "aws"
+page_title: "AWS: aws_backup_framework"
+description: |-
+  Provides an AWS Backup Framework resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_backup_framework
+
+Provides an AWS Backup Framework resource.
+
+~> **Note:** For the Deployment Status of the Framework to be successful, please turn on resource tracking to enable AWS Config recording to track configuration changes of your backup resources. This can be done from the AWS Console.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.backup_framework import BackupFramework
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        BackupFramework(self, "Example",
+            control=[BackupFrameworkControl(
+                input_parameter=[BackupFrameworkControlInputParameter(
+                    name="requiredRetentionDays",
+                    value="35"
+                )
+                ],
+                name="BACKUP_RECOVERY_POINT_MINIMUM_RETENTION_CHECK"
+            ), BackupFrameworkControl(
+                input_parameter=[BackupFrameworkControlInputParameter(
+                    name="requiredFrequencyUnit",
+                    value="hours"
+                ), BackupFrameworkControlInputParameter(
+                    name="requiredRetentionDays",
+                    value="35"
+                ), BackupFrameworkControlInputParameter(
+                    name="requiredFrequencyValue",
+                    value="1"
+                )
+                ],
+                name="BACKUP_PLAN_MIN_FREQUENCY_AND_MIN_RETENTION_CHECK"
+            ), BackupFrameworkControl(
+                name="BACKUP_RECOVERY_POINT_ENCRYPTED"
+            ), BackupFrameworkControl(
+                name="BACKUP_RESOURCES_PROTECTED_BY_BACKUP_PLAN",
+                scope=BackupFrameworkControlScope(
+                    compliance_resource_types=["EBS"]
+                )
+            ), BackupFrameworkControl(
+                name="BACKUP_RECOVERY_POINT_MANUAL_DELETION_DISABLED"
+            ), BackupFrameworkControl(
+                input_parameter=[BackupFrameworkControlInputParameter(
+                    name="maxRetentionDays",
+                    value="100"
+                ), BackupFrameworkControlInputParameter(
+                    name="minRetentionDays",
+                    value="1"
+                )
+                ],
+                name="BACKUP_RESOURCES_PROTECTED_BY_BACKUP_VAULT_LOCK",
+                scope=BackupFrameworkControlScope(
+                    compliance_resource_types=["EBS"]
+                )
+            ), BackupFrameworkControl(
+                input_parameter=[BackupFrameworkControlInputParameter(
+                    name="recoveryPointAgeUnit",
+                    value="days"
+                ), BackupFrameworkControlInputParameter(
+                    name="recoveryPointAgeValue",
+                    value="1"
+                )
+                ],
+                name="BACKUP_LAST_RECOVERY_POINT_CREATED",
+                scope=BackupFrameworkControlScope(
+                    compliance_resource_types=["EBS"]
+                )
+            )
+            ],
+            description="this is an example framework",
+            name="exampleFramework",
+            tags={
+                "Name": "Example Framework"
+            }
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `control` - (Required) One or more control blocks that make up the framework. Each control in the list has a name, input parameters, and scope. Detailed below.
+* `description` - (Optional) The description of the framework with a maximum of 1,024 characters
+* `name` - (Required) The unique name of the framework. The name must be between 1 and 256 characters, starting with a letter, and consisting of letters, numbers, and underscores.
+* `tags` - (Optional) Metadata that you can assign to help organize the frameworks you create. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Control Arguments
+
+`control` has the following attributes:
+
+* `input_parameter` - (Optional) One or more input parameter blocks. An example of a control with two parameters is: "backup plan frequency is at least daily and the retention period is at least 1 year". The first parameter is daily. The second parameter is 1 year. Detailed below.
+* `name` - (Required) The name of a control. This name is between 1 and 256 characters.
+* `scope` - (Optional) The scope of a control. The control scope defines what the control will evaluate. Three examples of control scopes are: a specific backup plan, all backup plans with a specific tag, or all backup plans. Detailed below.
+
+### Input Parameter Arguments
+
+`input_parameter` has the following attributes:
+
+* `name` - (Optional) The name of a parameter, for example, BackupPlanFrequency.
+* `value` - (Optional) The value of parameter, for example, hourly.
+
+### Scope Arguments
+
+`scope` has the following attributes:
+
+* `compliance_resource_ids` - (Optional) The ID of the only AWS resource that you want your control scope to contain. Minimum number of 1 item. Maximum number of 100 items.
+* `compliance_resource_types` - (Optional) Describes whether the control scope includes one or more types of resources, such as EFS or RDS.
+* `tags` - (Optional) The tag key-value pair applied to those AWS resources that you want to trigger an evaluation for a rule. A maximum of one key-value pair can be provided.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the backup framework.
+* `creation_time` - The date and time that a framework is created, in Unix format and Coordinated Universal Time (UTC).
+* `deployment_status` - The deployment status of a framework. The statuses are: `CREATE_IN_PROGRESS` | `UPDATE_IN_PROGRESS` | `DELETE_IN_PROGRESS` | `COMPLETED` | `FAILED`.
+* `id` - The id of the backup framework.
+* `status` - A framework consists of one or more controls. Each control governs a resource, such as backup plans, backup selections, backup vaults, or recovery points. You can also turn AWS Config recording on or off for each resource. For more information refer to the [AWS documentation for Framework Status](https://docs.aws.amazon.com/aws-backup/latest/devguide/API_DescribeFramework.html#Backup-DescribeFramework-response-FrameworkStatus)
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `2m`)
+* `update` - (Default `2m`)
+* `delete` - (Default `2m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Backup Framework using the `id` which corresponds to the name of the Backup Framework. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Backup Framework using the `id` which corresponds to the name of the Backup Framework. For example:
+
+```console
+% terraform import aws_backup_framework.test <id>
+```
+
+<!-- cache-key: cdktf-0.18.0 input-4cb34459561740182d4b24333fe8df9142bdd3e691f64f140504aa521fe31ef8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/backup_global_settings.html.markdown b/website/docs/cdktf/python/r/backup_global_settings.html.markdown
new file mode 100644
index 00000000000..10d7b759fcc
--- /dev/null
+++ b/website/docs/cdktf/python/r/backup_global_settings.html.markdown
@@ -0,0 +1,67 @@
+---
+subcategory: "Backup"
+layout: "aws"
+page_title: "AWS: aws_backup_global_settings"
+description: |-
+  Provides an AWS Backup Global Settings resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_backup_global_settings
+
+Provides an AWS Backup Global Settings resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.backup_global_settings import BackupGlobalSettings
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        BackupGlobalSettings(self, "test",
+            global_settings={
+                "is_cross_account_backup_enabled": "true"
+            }
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `global_settings` - (Required) A list of resources along with the opt-in preferences for the account.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The AWS Account ID.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Backup Global Settings using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Backup Global Settings using the `id`. For example:
+
+```console
+% terraform import aws_backup_global_settings.example 123456789012
+```
+
+<!-- cache-key: cdktf-0.18.0 input-61e4ea90b0bc8bb7e796f1019721fafa7192f84c3c85dd25a159206e861e05c7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/backup_plan.html.markdown b/website/docs/cdktf/python/r/backup_plan.html.markdown
new file mode 100644
index 00000000000..710867840c9
--- /dev/null
+++ b/website/docs/cdktf/python/r/backup_plan.html.markdown
@@ -0,0 +1,122 @@
+---
+subcategory: "Backup"
+layout: "aws"
+page_title: "AWS: aws_backup_plan"
+description: |-
+  Provides an AWS Backup plan resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_backup_plan
+
+Provides an AWS Backup plan resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.backup_plan import BackupPlan
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        BackupPlan(self, "example",
+            advanced_backup_setting=[BackupPlanAdvancedBackupSetting(
+                backup_options={
+                    "WindowsVSS": "enabled"
+                },
+                resource_type="EC2"
+            )
+            ],
+            name="tf_example_backup_plan",
+            rule=[BackupPlanRule(
+                lifecycle=BackupPlanRuleLifecycle(
+                    delete_after=14
+                ),
+                rule_name="tf_example_backup_rule",
+                schedule="cron(0 12 * * ? *)",
+                target_vault_name=test.name
+            )
+            ]
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The display name of a backup plan.
+* `rule` - (Required) A rule object that specifies a scheduled task that is used to back up a selection of resources.
+* `advanced_backup_setting` - (Optional) An object that specifies backup options for each resource type.
+* `tags` - (Optional) Metadata that you can assign to help organize the plans you create. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Rule Arguments
+
+`rule` supports the following attributes:
+
+* `rule_name` - (Required) An display name for a backup rule.
+* `target_vault_name` - (Required) The name of a logical container where backups are stored.
+* `schedule` - (Optional) A CRON expression specifying when AWS Backup initiates a backup job.
+* `enable_continuous_backup` - (Optional) Enable continuous backups for supported resources.
+* `start_window` - (Optional) The amount of time in minutes before beginning a backup.
+* `completion_window` - (Optional) The amount of time in minutes AWS Backup attempts a backup before canceling the job and returning an error.
+* `lifecycle` - (Optional) The lifecycle defines when a protected resource is transitioned to cold storage and when it expires.  Fields documented below.
+* `recovery_point_tags` - (Optional) Metadata that you can assign to help organize the resources that you create.
+* `copy_action` - (Optional) Configuration block(s) with copy operation settings. Detailed below.
+
+### Lifecycle Arguments
+
+`lifecycle` supports the following attributes:
+
+* `cold_storage_after` - (Optional) Specifies the number of days after creation that a recovery point is moved to cold storage.
+* `delete_after` - (Optional) Specifies the number of days after creation that a recovery point is deleted. Must be 90 days greater than `cold_storage_after`.
+
+### Copy Action Arguments
+
+`copy_action` supports the following attributes:
+
+* `lifecycle` - (Optional) The lifecycle defines when a protected resource is copied over to a backup vault and when it expires.  Fields documented above.
+* `destination_vault_arn` - (Required) An Amazon Resource Name (ARN) that uniquely identifies the destination backup vault for the copied backup.
+
+### Advanced Backup Setting Arguments
+
+`advanced_backup_setting` supports the following arguments:
+
+* `backup_options` - (Required) Specifies the backup option for a selected resource. This option is only available for Windows VSS backup jobs. Set to `{ WindowsVSS = "enabled" }` to enable Windows VSS backup option and create a VSS Windows backup.
+* `resource_type` - (Required) The type of AWS resource to be backed up. For VSS Windows backups, the only supported resource type is Amazon EC2. Valid values: `EC2`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The id of the backup plan.
+* `arn` - The ARN of the backup plan.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `version` - Unique, randomly generated, Unicode, UTF-8 encoded string that serves as the version ID of the backup plan.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Backup Plan using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Backup Plan using the `id`. For example:
+
+```console
+% terraform import aws_backup_plan.test <id>
+```
+
+<!-- cache-key: cdktf-0.18.0 input-e41e73e041e50613fcaa9cb0889a0177d0b33c0a30b6e8469e4e706a67a8b35d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/backup_region_settings.html.markdown b/website/docs/cdktf/python/r/backup_region_settings.html.markdown
new file mode 100644
index 00000000000..daa86fddf1c
--- /dev/null
+++ b/website/docs/cdktf/python/r/backup_region_settings.html.markdown
@@ -0,0 +1,82 @@
+---
+subcategory: "Backup"
+layout: "aws"
+page_title: "AWS: aws_backup_region_settings"
+description: |-
+  Provides an AWS Backup Region Settings resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_backup_region_settings
+
+Provides an AWS Backup Region Settings resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.backup_region_settings import BackupRegionSettings
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        BackupRegionSettings(self, "test",
+            resource_type_management_preference={
+                "DynamoDB": True,
+                "EFS": True
+            },
+            resource_type_opt_in_preference={
+                "Aurora": True,
+                "DocumentDB": True,
+                "DynamoDB": True,
+                "EBS": True,
+                "EC2": True,
+                "EFS": True,
+                "FSx": True,
+                "Neptune": True,
+                "RDS": True,
+                "Storage Gateway": True,
+                "VirtualMachine": True
+            }
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `resource_type_opt_in_preference` - (Required) A map of services along with the opt-in preferences for the Region.
+* `resource_type_management_preference` - (Optional) A map of services along with the management preferences for the Region. For more information, see the [AWS Documentation](https://docs.aws.amazon.com/aws-backup/latest/devguide/API_UpdateRegionSettings.html#API_UpdateRegionSettings_RequestSyntax).
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The AWS region.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Backup Region Settings using the `region`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Backup Region Settings using the `region`. For example:
+
+```console
+% terraform import aws_backup_region_settings.test us-west-2
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1c87f4723a3ea47fdb8b9fe296035ddc01080e9391eac471698160d93a976e00 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/backup_report_plan.html.markdown b/website/docs/cdktf/python/r/backup_report_plan.html.markdown
new file mode 100644
index 00000000000..6d10122c908
--- /dev/null
+++ b/website/docs/cdktf/python/r/backup_report_plan.html.markdown
@@ -0,0 +1,103 @@
+---
+subcategory: "Backup"
+layout: "aws"
+page_title: "AWS: aws_backup_report_plan"
+description: |-
+  Provides an AWS Backup Report Plan resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_backup_report_plan
+
+Provides an AWS Backup Report Plan resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.backup_report_plan import BackupReportPlan
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        BackupReportPlan(self, "example",
+            description="example description",
+            name="example_name",
+            report_delivery_channel=BackupReportPlanReportDeliveryChannel(
+                formats=["CSV", "JSON"],
+                s3_bucket_name="example-bucket-name"
+            ),
+            report_setting=BackupReportPlanReportSetting(
+                report_template="RESTORE_JOB_REPORT"
+            ),
+            tags={
+                "Name": "Example Report Plan"
+            }
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `description` - (Optional) The description of the report plan with a maximum of 1,024 characters
+* `name` - (Required) The unique name of the report plan. The name must be between 1 and 256 characters, starting with a letter, and consisting of letters, numbers, and underscores.
+* `report_delivery_channel` - (Required) An object that contains information about where and how to deliver your reports, specifically your Amazon S3 bucket name, S3 key prefix, and the formats of your reports. Detailed below.
+* `report_setting` - (Required) An object that identifies the report template for the report. Reports are built using a report template. Detailed below.
+* `tags` - (Optional) Metadata that you can assign to help organize the report plans you create. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Report Delivery Channel Arguments
+
+`report_delivery_channel` supports the following arguments:
+
+* `formats` - (Optional) A list of the format of your reports: CSV, JSON, or both. If not specified, the default format is CSV.
+* `s3_bucket_name` - (Required) The unique name of the S3 bucket that receives your reports.
+* `s3_key_prefix` - (Optional) The prefix for where Backup Audit Manager delivers your reports to Amazon S3. The prefix is this part of the following path: s3://your-bucket-name/prefix/Backup/us-west-2/year/month/day/report-name. If not specified, there is no prefix.
+
+### Report Setting Arguments
+
+`report_setting` supports the following arguments:
+
+* `accounts` - (Optional) Specifies the list of accounts a report covers.
+* `framework_arns` - (Optional) Specifies the Amazon Resource Names (ARNs) of the frameworks a report covers.
+* `number_of_frameworks` - (Optional) Specifies the number of frameworks a report covers.
+* `organization_units` - (Optional) Specifies the list of Organizational Units a report covers.
+* `regions` - (Optional) Specifies the list of regions a report covers.
+* `report_template` - (Required) Identifies the report template for the report. Reports are built using a report template. The report templates are: `RESOURCE_COMPLIANCE_REPORT` | `CONTROL_COMPLIANCE_REPORT` | `BACKUP_JOB_REPORT` | `COPY_JOB_REPORT` | `RESTORE_JOB_REPORT`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the backup report plan.
+* `creation_time` - The date and time that a report plan is created, in Unix format and Coordinated Universal Time (UTC).
+* `deployment_status` - The deployment status of a report plan. The statuses are: `CREATE_IN_PROGRESS` | `UPDATE_IN_PROGRESS` | `DELETE_IN_PROGRESS` | `COMPLETED`.
+* `id` - The id of the backup report plan.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Backup Report Plan using the `id` which corresponds to the name of the Backup Report Plan. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Backup Report Plan using the `id` which corresponds to the name of the Backup Report Plan. For example:
+
+```console
+% terraform import aws_backup_report_plan.test <id>
+```
+
+<!-- cache-key: cdktf-0.18.0 input-bd959edfce1b301196f86382fc18f07f59bfcba90604113c6790f12cd75715da -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/backup_selection.html.markdown b/website/docs/cdktf/python/r/backup_selection.html.markdown
new file mode 100644
index 00000000000..a3a87861127
--- /dev/null
+++ b/website/docs/cdktf/python/r/backup_selection.html.markdown
@@ -0,0 +1,236 @@
+---
+subcategory: "Backup"
+layout: "aws"
+page_title: "AWS: aws_backup_selection"
+description: |-
+  Manages selection conditions for AWS Backup plan resources.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_backup_selection
+
+Manages selection conditions for AWS Backup plan resources.
+
+## Example Usage
+
+### IAM Role
+
+-> For more information about creating and managing IAM Roles for backups and restores, see the [AWS Backup Developer Guide](https://docs.aws.amazon.com/aws-backup/latest/devguide/iam-service-roles.html).
+
+The below example creates an IAM role with the default managed IAM Policy for allowing AWS Backup to create backups.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.backup_selection import BackupSelection
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.iam_role import IamRole
+from imports.aws.iam_role_policy_attachment import IamRolePolicyAttachment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, name, planId):
+        super().__init__(scope, name)
+        assume_role = DataAwsIamPolicyDocument(self, "assume_role",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["sts:AssumeRole"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["backup.amazonaws.com"],
+                    type="Service"
+                )
+                ]
+            )
+            ]
+        )
+        example = IamRole(self, "example",
+            assume_role_policy=Token.as_string(assume_role.json),
+            name="example"
+        )
+        aws_iam_role_policy_attachment_example = IamRolePolicyAttachment(self, "example_2",
+            policy_arn="arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForBackup",
+            role=example.name
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_role_policy_attachment_example.override_logical_id("example")
+        aws_backup_selection_example = BackupSelection(self, "example_3",
+            iam_role_arn=example.arn,
+            name=name,
+            plan_id=plan_id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_backup_selection_example.override_logical_id("example")
+```
+
+### Selecting Backups By Tag
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.backup_selection import BackupSelection
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        BackupSelection(self, "example",
+            iam_role_arn=Token.as_string(aws_iam_role_example.arn),
+            name="tf_example_backup_selection",
+            plan_id=Token.as_string(aws_backup_plan_example.id),
+            selection_tag=[BackupSelectionSelectionTag(
+                key="foo",
+                type="STRINGEQUALS",
+                value="bar"
+            )
+            ]
+        )
+```
+
+### Selecting Backups By Conditions
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.backup_selection import BackupSelection
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        BackupSelection(self, "example",
+            condition=[BackupSelectionCondition(
+                string_equals=[BackupSelectionConditionStringEquals(
+                    key="aws:ResourceTag/Component",
+                    value="rds"
+                )
+                ],
+                string_like=[BackupSelectionConditionStringLike(
+                    key="aws:ResourceTag/Application",
+                    value="app*"
+                )
+                ],
+                string_not_equals=[BackupSelectionConditionStringNotEquals(
+                    key="aws:ResourceTag/Backup",
+                    value="false"
+                )
+                ],
+                string_not_like=[BackupSelectionConditionStringNotLike(
+                    key="aws:ResourceTag/Environment",
+                    value="test*"
+                )
+                ]
+            )
+            ],
+            iam_role_arn=Token.as_string(aws_iam_role_example.arn),
+            name="tf_example_backup_selection",
+            plan_id=Token.as_string(aws_backup_plan_example.id),
+            resources=["*"]
+        )
+```
+
+### Selecting Backups By Resource
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.backup_selection import BackupSelection
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        BackupSelection(self, "example",
+            iam_role_arn=Token.as_string(aws_iam_role_example.arn),
+            name="tf_example_backup_selection",
+            plan_id=Token.as_string(aws_backup_plan_example.id),
+            resources=[
+                Token.as_string(aws_db_instance_example.arn),
+                Token.as_string(aws_ebs_volume_example.arn),
+                Token.as_string(aws_efs_file_system_example.arn)
+            ]
+        )
+```
+
+### Selecting Backups By Not Resource
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.backup_selection import BackupSelection
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        BackupSelection(self, "example",
+            iam_role_arn=Token.as_string(aws_iam_role_example.arn),
+            name="tf_example_backup_selection",
+            not_resources=[
+                Token.as_string(aws_db_instance_example.arn),
+                Token.as_string(aws_ebs_volume_example.arn),
+                Token.as_string(aws_efs_file_system_example.arn)
+            ],
+            plan_id=Token.as_string(aws_backup_plan_example.id)
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The display name of a resource selection document.
+* `plan_id` - (Required) The backup plan ID to be associated with the selection of resources.
+* `iam_role_arn` - (Required) The ARN of the IAM role that AWS Backup uses to authenticate when restoring and backing up the target resource. See the [AWS Backup Developer Guide](https://docs.aws.amazon.com/aws-backup/latest/devguide/access-control.html#managed-policies) for additional information about using AWS managed policies or creating custom policies attached to the IAM role.
+* `selection_tag` - (Optional) Tag-based conditions used to specify a set of resources to assign to a backup plan.
+* `condition` - (Optional) A list of conditions that you define to assign resources to your backup plans using tags.
+* `resources` - (Optional) An array of strings that either contain Amazon Resource Names (ARNs) or match patterns of resources to assign to a backup plan.
+* `not_resources` - (Optional) An array of strings that either contain Amazon Resource Names (ARNs) or match patterns of resources to exclude from a backup plan.
+
+Tag conditions (`selection_tag`) support the following:
+
+* `type` - (Required) An operation, such as `StringEquals`, that is applied to a key-value pair used to filter resources in a selection.
+* `key` - (Required) The key in a key-value pair.
+* `value` - (Required) The value in a key-value pair.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Backup Selection identifier
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Backup selection using the role plan_id and id separated by `|`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Backup selection using the role plan_id and id separated by `|`. For example:
+
+```console
+% terraform import aws_backup_selection.example plan-id|selection-id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-611a33d70e2d7ee876d82838e90e00edfd3ded77693e25a475537a3e728818a3 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/backup_vault.html.markdown b/website/docs/cdktf/python/r/backup_vault.html.markdown
new file mode 100644
index 00000000000..354c9d1f08c
--- /dev/null
+++ b/website/docs/cdktf/python/r/backup_vault.html.markdown
@@ -0,0 +1,78 @@
+---
+subcategory: "Backup"
+layout: "aws"
+page_title: "AWS: aws_backup_vault"
+description: |-
+  Provides an AWS Backup vault resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_backup_vault
+
+Provides an AWS Backup vault resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.backup_vault import BackupVault
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        BackupVault(self, "example",
+            kms_key_arn=Token.as_string(aws_kms_key_example.arn),
+            name="example_backup_vault"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `force_destroy` - (Optional, Default: `false`) A boolean that indicates that all recovery points stored in the vault are deleted so that the vault can be destroyed without error.
+* `kms_key_arn` - (Optional) The server-side encryption key that is used to protect your backups.
+* `name` - (Required) Name of the backup vault to create.
+* `tags` - (Optional) Metadata that you can assign to help organize the resources that you create. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name of the vault.
+* `arn` - The ARN of the vault.
+* `recovery_points` - The number of recovery points that are stored in a backup vault.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `delete` - (Default `10m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Backup vault using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Backup vault using the `name`. For example:
+
+```console
+% terraform import aws_backup_vault.test-vault TestVault
+```
+
+<!-- cache-key: cdktf-0.18.0 input-eca95e815c6165631f5519aecaf60793b9c12d8e7d3bc319cb6177906c2d98c0 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/backup_vault_lock_configuration.html.markdown b/website/docs/cdktf/python/r/backup_vault_lock_configuration.html.markdown
new file mode 100644
index 00000000000..76b30db8ee1
--- /dev/null
+++ b/website/docs/cdktf/python/r/backup_vault_lock_configuration.html.markdown
@@ -0,0 +1,72 @@
+---
+subcategory: "Backup"
+layout: "aws"
+page_title: "AWS: aws_backup_vault_lock_configuration"
+description: |-
+  Provides an AWS Backup vault lock configuration resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_backup_vault_lock_configuration
+
+Provides an AWS Backup vault lock configuration resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.backup_vault_lock_configuration import BackupVaultLockConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        BackupVaultLockConfiguration(self, "test",
+            backup_vault_name="example_backup_vault",
+            changeable_for_days=3,
+            max_retention_days=1200,
+            min_retention_days=7
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `backup_vault_name` - (Required) Name of the backup vault to add a lock configuration for.
+* `changeable_for_days` - (Optional) The number of days before the lock date. If omitted creates a vault lock in `governance` mode, otherwise it will create a vault lock in `compliance` mode.
+* `max_retention_days` - (Optional) The maximum retention period that the vault retains its recovery points.
+* `min_retention_days` - (Optional) The minimum retention period that the vault retains its recovery points.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `backup_vault_name` - The name of the vault.
+* `backup_vault_arn` - The ARN of the vault.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Backup vault lock configuration using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Backup vault lock configuration using the `name`. For example:
+
+```console
+% terraform import aws_backup_vault_lock_configuration.test TestVault
+```
+
+<!-- cache-key: cdktf-0.18.0 input-7a6a16a744584530b702e520addc8fa4bab5b7a770b8ab9d13d1bbcb2f7c3f12 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/backup_vault_notifications.html.markdown b/website/docs/cdktf/python/r/backup_vault_notifications.html.markdown
new file mode 100644
index 00000000000..071801ca0ce
--- /dev/null
+++ b/website/docs/cdktf/python/r/backup_vault_notifications.html.markdown
@@ -0,0 +1,101 @@
+---
+subcategory: "Backup"
+layout: "aws"
+page_title: "AWS: aws_backup_vault_notifications"
+description: |-
+  Provides an AWS Backup vault notifications resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_backup_vault_notifications
+
+Provides an AWS Backup vault notifications resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.backup_vault_notifications import BackupVaultNotifications
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.sns_topic import SnsTopic
+from imports.aws.sns_topic_policy import SnsTopicPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        test = SnsTopic(self, "test",
+            name="backup-vault-events"
+        )
+        data_aws_iam_policy_document_test = DataAwsIamPolicyDocument(self, "test_1",
+            policy_id="__default_policy_ID",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["SNS:Publish"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["backup.amazonaws.com"],
+                    type="Service"
+                )
+                ],
+                resources=[test.arn],
+                sid="__default_statement_ID"
+            )
+            ]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_iam_policy_document_test.override_logical_id("test")
+        aws_backup_vault_notifications_test = BackupVaultNotifications(self, "test_2",
+            backup_vault_events=["BACKUP_JOB_STARTED", "RESTORE_JOB_COMPLETED"],
+            backup_vault_name="example_backup_vault",
+            sns_topic_arn=test.arn
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_backup_vault_notifications_test.override_logical_id("test")
+        aws_sns_topic_policy_test = SnsTopicPolicy(self, "test_3",
+            arn=test.arn,
+            policy=Token.as_string(data_aws_iam_policy_document_test.json)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_sns_topic_policy_test.override_logical_id("test")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `backup_vault_name` - (Required) Name of the backup vault to add notifications for.
+* `sns_topic_arn` - (Required) The Amazon Resource Name (ARN) that specifies the topic for a backup vault’s events
+* `backup_vault_events` - (Required) An array of events that indicate the status of jobs to back up resources to the backup vault.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name of the vault.
+* `backup_vault_arn` - The ARN of the vault.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Backup vault notifications using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Backup vault notifications using the `name`. For example:
+
+```console
+% terraform import aws_backup_vault_notifications.test TestVault
+```
+
+<!-- cache-key: cdktf-0.18.0 input-08e7368ad3cd60e158138ba083276c5a2949bfb1492a95cc0bc4ae1150912893 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/backup_vault_policy.html.markdown b/website/docs/cdktf/python/r/backup_vault_policy.html.markdown
new file mode 100644
index 00000000000..09706d3defe
--- /dev/null
+++ b/website/docs/cdktf/python/r/backup_vault_policy.html.markdown
@@ -0,0 +1,91 @@
+---
+subcategory: "Backup"
+layout: "aws"
+page_title: "AWS: aws_backup_vault_policy"
+description: |-
+  Provides an AWS Backup vault policy resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_backup_vault_policy
+
+Provides an AWS Backup vault policy resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.backup_vault import BackupVault
+from imports.aws.backup_vault_policy import BackupVaultPolicy
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = BackupVault(self, "example",
+            name="example"
+        )
+        data_aws_iam_policy_document_example = DataAwsIamPolicyDocument(self, "example_1",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["backup:DescribeBackupVault", "backup:DeleteBackupVault", "backup:PutBackupVaultAccessPolicy", "backup:DeleteBackupVaultAccessPolicy", "backup:GetBackupVaultAccessPolicy", "backup:StartBackupJob", "backup:GetBackupVaultNotifications", "backup:PutBackupVaultNotifications"
+                ],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["*"],
+                    type="AWS"
+                )
+                ],
+                resources=[example.arn]
+            )
+            ]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_iam_policy_document_example.override_logical_id("example")
+        aws_backup_vault_policy_example = BackupVaultPolicy(self, "example_2",
+            backup_vault_name=example.name,
+            policy=Token.as_string(data_aws_iam_policy_document_example.json)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_backup_vault_policy_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `backup_vault_name` - (Required) Name of the backup vault to add policy for.
+* `policy` - (Required) The backup vault access policy document in JSON format.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name of the vault.
+* `backup_vault_arn` - The ARN of the vault.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Backup vault policy using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Backup vault policy using the `name`. For example:
+
+```console
+% terraform import aws_backup_vault_policy.test TestVault
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ab98f99514f38866a517aac446be1f3acb9e1bf25ba0c4567594ea6cc2e401d8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/batch_compute_environment.html.markdown b/website/docs/cdktf/python/r/batch_compute_environment.html.markdown
new file mode 100644
index 00000000000..073d7e8aa1c
--- /dev/null
+++ b/website/docs/cdktf/python/r/batch_compute_environment.html.markdown
@@ -0,0 +1,258 @@
+---
+subcategory: "Batch"
+layout: "aws"
+page_title: "AWS: aws_batch_compute_environment"
+description: |-
+  Creates a AWS Batch compute environment.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_batch_compute_environment
+
+Creates a AWS Batch compute environment. Compute environments contain the Amazon ECS container instances that are used to run containerized batch jobs.
+
+For information about AWS Batch, see [What is AWS Batch?][1] .
+For information about compute environment, see [Compute Environments][2] .
+
+~> **Note:** To prevent a race condition during environment deletion, make sure to set `depends_on` to the related `aws_iam_role_policy_attachment`;
+otherwise, the policy may be destroyed too soon and the compute environment will then get stuck in the `DELETING` state, see [Troubleshooting AWS Batch][3] .
+
+## Example Usage
+
+### EC2 Type
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.batch_compute_environment import BatchComputeEnvironment
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.iam_instance_profile import IamInstanceProfile
+from imports.aws.iam_role import IamRole
+from imports.aws.iam_role_policy_attachment import IamRolePolicyAttachment
+from imports.aws.placement_group import PlacementGroup
+from imports.aws.security_group import SecurityGroup
+from imports.aws.subnet import Subnet
+from imports.aws.vpc import Vpc
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        sample = PlacementGroup(self, "sample",
+            name="sample",
+            strategy="cluster"
+        )
+        aws_security_group_sample = SecurityGroup(self, "sample_1",
+            egress=[SecurityGroupEgress(
+                cidr_blocks=["0.0.0.0/0"],
+                from_port=0,
+                protocol="-1",
+                to_port=0
+            )
+            ],
+            name="aws_batch_compute_environment_security_group"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_security_group_sample.override_logical_id("sample")
+        aws_vpc_sample = Vpc(self, "sample_2",
+            cidr_block="10.1.0.0/16"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_vpc_sample.override_logical_id("sample")
+        batch_assume_role = DataAwsIamPolicyDocument(self, "batch_assume_role",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["sts:AssumeRole"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["batch.amazonaws.com"],
+                    type="Service"
+                )
+                ]
+            )
+            ]
+        )
+        ec2_assume_role = DataAwsIamPolicyDocument(self, "ec2_assume_role",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["sts:AssumeRole"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["ec2.amazonaws.com"],
+                    type="Service"
+                )
+                ]
+            )
+            ]
+        )
+        aws_batch_service_role = IamRole(self, "aws_batch_service_role",
+            assume_role_policy=Token.as_string(batch_assume_role.json),
+            name="aws_batch_service_role"
+        )
+        ecs_instance_role = IamRole(self, "ecs_instance_role",
+            assume_role_policy=Token.as_string(ec2_assume_role.json),
+            name="ecs_instance_role"
+        )
+        aws_iam_role_policy_attachment_aws_batch_service_role =
+        IamRolePolicyAttachment(self, "aws_batch_service_role_7",
+            policy_arn="arn:aws:iam::aws:policy/service-role/AWSBatchServiceRole",
+            role=aws_batch_service_role.name
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_role_policy_attachment_aws_batch_service_role.override_logical_id("aws_batch_service_role")
+        aws_iam_role_policy_attachment_ecs_instance_role =
+        IamRolePolicyAttachment(self, "ecs_instance_role_8",
+            policy_arn="arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role",
+            role=ecs_instance_role.name
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_role_policy_attachment_ecs_instance_role.override_logical_id("ecs_instance_role")
+        aws_subnet_sample = Subnet(self, "sample_9",
+            cidr_block="10.1.1.0/24",
+            vpc_id=Token.as_string(aws_vpc_sample.id)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_subnet_sample.override_logical_id("sample")
+        aws_iam_instance_profile_ecs_instance_role = IamInstanceProfile(self, "ecs_instance_role_10",
+            name="ecs_instance_role",
+            role=ecs_instance_role.name
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_instance_profile_ecs_instance_role.override_logical_id("ecs_instance_role")
+        aws_batch_compute_environment_sample = BatchComputeEnvironment(self, "sample_11",
+            compute_environment_name="sample",
+            compute_resources=BatchComputeEnvironmentComputeResources(
+                instance_role=Token.as_string(aws_iam_instance_profile_ecs_instance_role.arn),
+                instance_type=["c4.large"],
+                max_vcpus=16,
+                min_vcpus=0,
+                placement_group=sample.name,
+                security_group_ids=[Token.as_string(aws_security_group_sample.id)],
+                subnets=[Token.as_string(aws_subnet_sample.id)],
+                type="EC2"
+            ),
+            depends_on=[aws_iam_role_policy_attachment_aws_batch_service_role],
+            service_role=aws_batch_service_role.arn,
+            type="MANAGED"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_batch_compute_environment_sample.override_logical_id("sample")
+```
+
+### Fargate Type
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.batch_compute_environment import BatchComputeEnvironment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        BatchComputeEnvironment(self, "sample",
+            compute_environment_name="sample",
+            compute_resources=BatchComputeEnvironmentComputeResources(
+                max_vcpus=16,
+                security_group_ids=[Token.as_string(aws_security_group_sample.id)],
+                subnets=[Token.as_string(aws_subnet_sample.id)],
+                type="FARGATE"
+            ),
+            depends_on=[aws_batch_service_role],
+            service_role=Token.as_string(aws_iam_role_aws_batch_service_role.arn),
+            type="MANAGED"
+        )
+```
+
+## Argument Reference
+
+* `compute_environment_name` - (Optional, Forces new resource) The name for your compute environment. Up to 128 letters (uppercase and lowercase), numbers, and underscores are allowed. If omitted, Terraform will assign a random, unique name.
+* `compute_environment_name_prefix` - (Optional, Forces new resource) Creates a unique compute environment name beginning with the specified prefix. Conflicts with `compute_environment_name`.
+* `compute_resources` - (Optional) Details of the compute resources managed by the compute environment. This parameter is required for managed compute environments. See details below.
+* `eks_configuration` - (Optional) Details for the Amazon EKS cluster that supports the compute environment. See details below.
+* `service_role` - (Required) The full Amazon Resource Name (ARN) of the IAM role that allows AWS Batch to make calls to other AWS services on your behalf.
+* `state` - (Optional) The state of the compute environment. If the state is `ENABLED`, then the compute environment accepts jobs from a queue and can scale out automatically based on queues. Valid items are `ENABLED` or `DISABLED`. Defaults to `ENABLED`.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `type` - (Required) The type of the compute environment. Valid items are `MANAGED` or `UNMANAGED`.
+
+### compute_resources
+
+* `allocation_strategy` - (Optional) The allocation strategy to use for the compute resource in case not enough instances of the best fitting instance type can be allocated. Valid items are `BEST_FIT_PROGRESSIVE`, `SPOT_CAPACITY_OPTIMIZED` or `BEST_FIT`. Defaults to `BEST_FIT`. See [AWS docs](https://docs.aws.amazon.com/batch/latest/userguide/allocation-strategies.html) for details. This parameter isn't applicable to jobs running on Fargate resources, and shouldn't be specified.
+* `bid_percentage` - (Optional) Integer of maximum percentage that a Spot Instance price can be when compared with the On-Demand price for that instance type before instances are launched. For example, if your bid percentage is 20% (`20`), then the Spot price must be below 20% of the current On-Demand price for that EC2 instance. If you leave this field empty, the default value is 100% of the On-Demand price. This parameter isn't applicable to jobs running on Fargate resources, and shouldn't be specified.
+* `desired_vcpus` - (Optional) The desired number of EC2 vCPUS in the compute environment. This parameter isn't applicable to jobs running on Fargate resources, and shouldn't be specified.
+* `ec2_configuration` - (Optional) Provides information used to select Amazon Machine Images (AMIs) for EC2 instances in the compute environment. If Ec2Configuration isn't specified, the default is ECS_AL2. This parameter isn't applicable to jobs that are running on Fargate resources, and shouldn't be specified.
+* `ec2_key_pair` - (Optional) The EC2 key pair that is used for instances launched in the compute environment. This parameter isn't applicable to jobs running on Fargate resources, and shouldn't be specified.
+* `image_id` - (Optional) The Amazon Machine Image (AMI) ID used for instances launched in the compute environment. This parameter isn't applicable to jobs running on Fargate resources, and shouldn't be specified. (Deprecated, use [`ec2_configuration`](#ec2_configuration) `image_id_override` instead)
+* `instance_role` - (Optional) The Amazon ECS instance role applied to Amazon EC2 instances in a compute environment. This parameter isn't applicable to jobs running on Fargate resources, and shouldn't be specified.
+* `instance_type` - (Optional) A list of instance types that may be launched. This parameter isn't applicable to jobs running on Fargate resources, and shouldn't be specified.
+* `launch_template` - (Optional) The launch template to use for your compute resources. See details below. This parameter isn't applicable to jobs running on Fargate resources, and shouldn't be specified.
+* `max_vcpus` - (Required) The maximum number of EC2 vCPUs that an environment can reach.
+* `min_vcpus` - (Optional) The minimum number of EC2 vCPUs that an environment should maintain. For `EC2` or `SPOT` compute environments, if the parameter is not explicitly defined, a `0` default value will be set. This parameter isn't applicable to jobs running on Fargate resources, and shouldn't be specified.
+* `placement_group` - (Optional) The Amazon EC2 placement group to associate with your compute resources.
+* `security_group_ids` - (Optional) A list of EC2 security group that are associated with instances launched in the compute environment. This parameter is required for Fargate compute environments.
+* `spot_iam_fleet_role` - (Optional) The Amazon Resource Name (ARN) of the Amazon EC2 Spot Fleet IAM role applied to a SPOT compute environment. This parameter is required for SPOT compute environments. This parameter isn't applicable to jobs running on Fargate resources, and shouldn't be specified.
+* `subnets` - (Required) A list of VPC subnets into which the compute resources are launched.
+* `tags` - (Optional) Key-value pair tags to be applied to resources that are launched in the compute environment. This parameter isn't applicable to jobs running on Fargate resources, and shouldn't be specified.
+* `type` - (Required) The type of compute environment. Valid items are `EC2`, `SPOT`, `FARGATE` or `FARGATE_SPOT`.
+
+### ec2_configuration
+
+`ec2_configuration` supports the following:
+
+* `image_id_override` - (Optional) The AMI ID used for instances launched in the compute environment that match the image type. This setting overrides the `image_id` argument in the [`compute_resources`](#compute_resources) block.
+* `image_type` - (Optional) The image type to match with the instance type to select an AMI. If the `image_id_override` parameter isn't specified, then a recent [Amazon ECS-optimized Amazon Linux 2 AMI](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/ecs-optimized_AMI.html#al2ami) (`ECS_AL2`) is used.
+
+### launch_template
+
+`launch_template` supports the following:
+
+* `launch_template_id` - (Optional) ID of the launch template. You must specify either the launch template ID or launch template name in the request, but not both.
+* `launch_template_name` - (Optional) Name of the launch template.
+* `version` - (Optional) The version number of the launch template. Default: The default version of the launch template.
+
+### eks_configuration
+
+`eks_configuration` supports the following:
+
+* `eks_cluster_arn` - (Required) The Amazon Resource Name (ARN) of the Amazon EKS cluster.
+* `kubernetes_namespace` - (Required) The namespace of the Amazon EKS cluster. AWS Batch manages pods in this namespace.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the compute environment.
+* `ecs_cluster_arn` - The Amazon Resource Name (ARN) of the underlying Amazon ECS cluster used by the compute environment.
+* `status` - The current status of the compute environment (for example, CREATING or VALID).
+* `status_reason` - A short, human-readable string to provide additional details about the current status of the compute environment.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AWS Batch compute using the `compute_environment_name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import AWS Batch compute using the `compute_environment_name`. For example:
+
+```console
+% terraform import aws_batch_compute_environment.sample sample
+```
+
+[1]: http://docs.aws.amazon.com/batch/latest/userguide/what-is-batch.html
+[2]: http://docs.aws.amazon.com/batch/latest/userguide/compute_environments.html
+[3]: http://docs.aws.amazon.com/batch/latest/userguide/troubleshooting.html
+
+<!-- cache-key: cdktf-0.18.0 input-31fc6d6f638d73792d12848676f9c99338d2b0f1615c84b67aea80c0d2df44fc -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/batch_job_definition.html.markdown b/website/docs/cdktf/python/r/batch_job_definition.html.markdown
new file mode 100644
index 00000000000..cedd917b98b
--- /dev/null
+++ b/website/docs/cdktf/python/r/batch_job_definition.html.markdown
@@ -0,0 +1,195 @@
+---
+subcategory: "Batch"
+layout: "aws"
+page_title: "AWS: aws_batch_job_definition"
+description: |-
+  Provides a Batch Job Definition resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_batch_job_definition
+
+Provides a Batch Job Definition resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.batch_job_definition import BatchJobDefinition
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        BatchJobDefinition(self, "test",
+            container_properties=Token.as_string(
+                Fn.jsonencode({
+                    "command": ["ls", "-la"],
+                    "environment": [{
+                        "name": "VARNAME",
+                        "value": "VARVAL"
+                    }
+                    ],
+                    "image": "busybox",
+                    "mount_points": [{
+                        "container_path": "/tmp",
+                        "read_only": False,
+                        "source_volume": "tmp"
+                    }
+                    ],
+                    "resource_requirements": [{
+                        "type": "VCPU",
+                        "value": "0.25"
+                    }, {
+                        "type": "MEMORY",
+                        "value": "512"
+                    }
+                    ],
+                    "ulimits": [{
+                        "hard_limit": 1024,
+                        "name": "nofile",
+                        "soft_limit": 1024
+                    }
+                    ],
+                    "volumes": [{
+                        "host": {
+                            "source_path": "/tmp"
+                        },
+                        "name": "tmp"
+                    }
+                    ]
+                })),
+            name="tf_test_batch_job_definition",
+            type="container"
+        )
+```
+
+### Fargate Platform Capability
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, Fn, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.batch_job_definition import BatchJobDefinition
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.iam_role import IamRole
+from imports.aws.iam_role_policy_attachment import IamRolePolicyAttachment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        assume_role_policy = DataAwsIamPolicyDocument(self, "assume_role_policy",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["sts:AssumeRole"],
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["ecs-tasks.amazonaws.com"],
+                    type="Service"
+                )
+                ]
+            )
+            ]
+        )
+        ecs_task_execution_role = IamRole(self, "ecs_task_execution_role",
+            assume_role_policy=Token.as_string(assume_role_policy.json),
+            name="tf_test_batch_exec_role"
+        )
+        IamRolePolicyAttachment(self, "ecs_task_execution_role_policy",
+            policy_arn="arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy",
+            role=ecs_task_execution_role.name
+        )
+        BatchJobDefinition(self, "test",
+            container_properties=Token.as_string(
+                Fn.jsonencode({
+                    "command": ["echo", "test"],
+                    "execution_role_arn": ecs_task_execution_role.arn,
+                    "fargate_platform_configuration": {
+                        "platform_version": "LATEST"
+                    },
+                    "image": "busybox",
+                    "job_role_arn": "arn:aws:iam::123456789012:role/AWSBatchS3ReadOnly",
+                    "resource_requirements": [{
+                        "type": "VCPU",
+                        "value": "0.25"
+                    }, {
+                        "type": "MEMORY",
+                        "value": "512"
+                    }
+                    ]
+                })),
+            name="tf_test_batch_job_definition",
+            platform_capabilities=["FARGATE"],
+            type="container"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) Specifies the name of the job definition.
+* `type` - (Required) The type of job definition. Must be `container`.
+
+The following arguments are optional:
+
+* `container_properties` - (Optional) A valid [container properties](http://docs.aws.amazon.com/batch/latest/APIReference/API_RegisterJobDefinition.html)
+    provided as a single valid JSON document. This parameter is required if the `type` parameter is `container`.
+* `parameters` - (Optional) Specifies the parameter substitution placeholders to set in the job definition.
+* `platform_capabilities` - (Optional) The platform capabilities required by the job definition. If no value is specified, it defaults to `EC2`. To run the job on Fargate resources, specify `FARGATE`.
+* `propagate_tags` - (Optional) Specifies whether to propagate the tags from the job definition to the corresponding Amazon ECS task. Default is `false`.
+* `retry_strategy` - (Optional) Specifies the retry strategy to use for failed jobs that are submitted with this job definition.
+    Maximum number of `retry_strategy` is `1`.  Defined below.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `timeout` - (Optional) Specifies the timeout for jobs so that if a job runs longer, AWS Batch terminates the job. Maximum number of `timeout` is `1`. Defined below.
+
+### retry_strategy
+
+* `attempts` - (Optional) The number of times to move a job to the `RUNNABLE` status. You may specify between `1` and `10` attempts.
+* `evaluate_on_exit` - (Optional) The [evaluate on exit](#evaluate_on_exit) conditions under which the job should be retried or failed. If this parameter is specified, then the `attempts` parameter must also be specified. You may specify up to 5 configuration blocks.
+
+#### evaluate_on_exit
+
+* `action` - (Required) Specifies the action to take if all of the specified conditions are met. The values are not case sensitive. Valid values: `RETRY`, `EXIT`.
+* `on_exit_code` - (Optional) A glob pattern to match against the decimal representation of the exit code returned for a job.
+* `on_reason` - (Optional) A glob pattern to match against the reason returned for a job.
+* `on_status_reason` - (Optional) A glob pattern to match against the status reason returned for a job.
+  
+### timeout
+
+* `attempt_duration_seconds` - (Optional) The time duration in seconds after which AWS Batch terminates your jobs if they have not finished. The minimum value for the timeout is `60` seconds.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name of the job definition.
+* `revision` - The revision of the job definition.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Batch Job Definition using the `arn`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Batch Job Definition using the `arn`. For example:
+
+```console
+% terraform import aws_batch_job_definition.test arn:aws:batch:us-east-1:123456789012:job-definition/sample
+```
+
+<!-- cache-key: cdktf-0.18.0 input-6ae285cb9efa6efba899233ae6cf160def3681423ed8aca3247f22377d9d046c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/batch_job_queue.html.markdown b/website/docs/cdktf/python/r/batch_job_queue.html.markdown
new file mode 100644
index 00000000000..b99560af292
--- /dev/null
+++ b/website/docs/cdktf/python/r/batch_job_queue.html.markdown
@@ -0,0 +1,124 @@
+---
+subcategory: "Batch"
+layout: "aws"
+page_title: "AWS: aws_batch_job_queue"
+description: |-
+  Provides a Batch Job Queue resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_batch_job_queue
+
+Provides a Batch Job Queue resource.
+
+## Example Usage
+
+### Basic Job Queue
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.batch_job_queue import BatchJobQueue
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        BatchJobQueue(self, "test_queue",
+            compute_environments=[test_environment1.arn, test_environment2.arn],
+            name="tf-test-batch-job-queue",
+            priority=1,
+            state="ENABLED"
+        )
+```
+
+### Job Queue with a fair share scheduling policy
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.batch_job_queue import BatchJobQueue
+from imports.aws.batch_scheduling_policy import BatchSchedulingPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = BatchSchedulingPolicy(self, "example",
+            fair_share_policy=BatchSchedulingPolicyFairSharePolicy(
+                compute_reservation=1,
+                share_decay_seconds=3600,
+                share_distribution=[BatchSchedulingPolicyFairSharePolicyShareDistribution(
+                    share_identifier="A1*",
+                    weight_factor=0.1
+                )
+                ]
+            ),
+            name="example"
+        )
+        aws_batch_job_queue_example = BatchJobQueue(self, "example_1",
+            compute_environments=[test_environment1.arn, test_environment2.arn],
+            name="tf-test-batch-job-queue",
+            priority=1,
+            scheduling_policy_arn=example.arn,
+            state="ENABLED"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_batch_job_queue_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) Specifies the name of the job queue.
+* `compute_environments` - (Required) List of compute environment ARNs mapped to a job queue.
+  The position of the compute environments in the list will dictate the order.
+* `priority` - (Required) The priority of the job queue. Job queues with a higher priority
+    are evaluated first when associated with the same compute environment.
+* `scheduling_policy_arn` - (Optional) The ARN of the fair share scheduling policy. If this parameter is specified, the job queue uses a fair share scheduling policy. If this parameter isn't specified, the job queue uses a first in, first out (FIFO) scheduling policy. After a job queue is created, you can replace but can't remove the fair share scheduling policy.
+* `state` - (Required) The state of the job queue. Must be one of: `ENABLED` or `DISABLED`
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name of the job queue.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `10m`)
+- `update` - (Default `10m`)
+- `delete` - (Default `10m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Batch Job Queue using the `arn`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Batch Job Queue using the `arn`. For example:
+
+```console
+% terraform import aws_batch_job_queue.test_queue arn:aws:batch:us-east-1:123456789012:job-queue/sample
+```
+
+<!-- cache-key: cdktf-0.18.0 input-11a6c4c8622e2192aee9e7e7cc4d490a2dcbd3674d74501dcd201fc0b34547ee -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/batch_scheduling_policy.html.markdown b/website/docs/cdktf/python/r/batch_scheduling_policy.html.markdown
new file mode 100644
index 00000000000..62dba4fe671
--- /dev/null
+++ b/website/docs/cdktf/python/r/batch_scheduling_policy.html.markdown
@@ -0,0 +1,94 @@
+---
+subcategory: "Batch"
+layout: "aws"
+page_title: "AWS: aws_batch_scheduling_policy"
+description: |-
+  Provides a Batch Scheduling Policy resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_batch_scheduling_policy
+
+Provides a Batch Scheduling Policy resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.batch_scheduling_policy import BatchSchedulingPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        BatchSchedulingPolicy(self, "example",
+            fair_share_policy=BatchSchedulingPolicyFairSharePolicy(
+                compute_reservation=1,
+                share_decay_seconds=3600,
+                share_distribution=[BatchSchedulingPolicyFairSharePolicyShareDistribution(
+                    share_identifier="A1*",
+                    weight_factor=0.1
+                ), BatchSchedulingPolicyFairSharePolicyShareDistribution(
+                    share_identifier="A2",
+                    weight_factor=0.2
+                )
+                ]
+            ),
+            name="example",
+            tags={
+                "Name": "Example Batch Scheduling Policy"
+            }
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `fairshare_policy` - (Optional) A fairshare policy block specifies the `compute_reservation`, `share_delay_seconds`, and `share_distribution` of the scheduling policy. The `fairshare_policy` block is documented below.
+* `name` - (Required) Specifies the name of the scheduling policy.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+A `fairshare_policy` block supports the following arguments:
+
+* `compute_reservation` - (Optional) A value used to reserve some of the available maximum vCPU for fair share identifiers that have not yet been used. For more information, see [FairsharePolicy](https://docs.aws.amazon.com/batch/latest/APIReference/API_FairsharePolicy.html).
+* `share_delay_seconds` - (Optional) The time period to use to calculate a fair share percentage for each fair share identifier in use, in seconds. For more information, see [FairsharePolicy](https://docs.aws.amazon.com/batch/latest/APIReference/API_FairsharePolicy.html).
+* `share_distribution` - (Optional) One or more share distribution blocks which define the weights for the fair share identifiers for the fair share policy. For more information, see [FairsharePolicy](https://docs.aws.amazon.com/batch/latest/APIReference/API_FairsharePolicy.html). The `share_distribution` block is documented below.
+
+A `share_distribution` block supports the following arguments:
+
+* `share_identifier` - (Required) A fair share identifier or fair share identifier prefix. For more information, see [ShareAttributes](https://docs.aws.amazon.com/batch/latest/APIReference/API_ShareAttributes.html).
+* `weight_factor` - (Optional) The weight factor for the fair share identifier. For more information, see [ShareAttributes](https://docs.aws.amazon.com/batch/latest/APIReference/API_ShareAttributes.html).
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name of the scheduling policy.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Batch Scheduling Policy using the `arn`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Batch Scheduling Policy using the `arn`. For example:
+
+```console
+% terraform import aws_batch_scheduling_policy.test_policy arn:aws:batch:us-east-1:123456789012:scheduling-policy/sample
+```
+
+<!-- cache-key: cdktf-0.18.0 input-c7708019f2dc1954cf5d6a36c441a8ca9c516d4c4eb0c1825e47bb64113b9003 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/budgets_budget.html.markdown b/website/docs/cdktf/python/r/budgets_budget.html.markdown
new file mode 100644
index 00000000000..ecd48b5876b
--- /dev/null
+++ b/website/docs/cdktf/python/r/budgets_budget.html.markdown
@@ -0,0 +1,369 @@
+---
+subcategory: "Web Services Budgets"
+layout: "aws"
+page_title: "AWS: aws_budgets_budget"
+description: |-
+  Provides a budgets budget resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_budgets_budget
+
+Provides a budgets budget resource. Budgets use the cost visualisation provided by Cost Explorer to show you the status of your budgets, to provide forecasts of your estimated costs, and to track your AWS usage, including your free tier usage.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.budgets_budget import BudgetsBudget
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        BudgetsBudget(self, "ec2",
+            budget_type="COST",
+            cost_filter=[BudgetsBudgetCostFilter(
+                name="Service",
+                values=["Amazon Elastic Compute Cloud - Compute"]
+            )
+            ],
+            limit_amount="1200",
+            limit_unit="USD",
+            name="budget-ec2-monthly",
+            notification=[BudgetsBudgetNotification(
+                comparison_operator="GREATER_THAN",
+                notification_type="FORECASTED",
+                subscriber_email_addresses=["test@example.com"],
+                threshold=100,
+                threshold_type="PERCENTAGE"
+            )
+            ],
+            time_period_end="2087-06-15_00:00",
+            time_period_start="2017-07-01_00:00",
+            time_unit="MONTHLY"
+        )
+```
+
+Create a budget for *$100*.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.budgets_budget import BudgetsBudget
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, timeUnit):
+        super().__init__(scope, name)
+        BudgetsBudget(self, "cost",
+            budget_type="COST",
+            limit_amount="100",
+            limit_unit="USD",
+            time_unit=time_unit
+        )
+```
+
+Create a budget with planned budget limits.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.budgets_budget import BudgetsBudget
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, budgetType, timeUnit):
+        super().__init__(scope, name)
+        BudgetsBudget(self, "cost",
+            planned_limit=[BudgetsBudgetPlannedLimit(
+                amount="100",
+                start_time="2017-07-01_00:00",
+                unit="USD"
+            ), BudgetsBudgetPlannedLimit(
+                amount="200",
+                start_time="2017-08-01_00:00",
+                unit="USD"
+            )
+            ],
+            budget_type=budget_type,
+            time_unit=time_unit
+        )
+```
+
+Create a budget for s3 with a limit of *3 GB* of storage.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.budgets_budget import BudgetsBudget
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, timeUnit):
+        super().__init__(scope, name)
+        BudgetsBudget(self, "s3",
+            budget_type="USAGE",
+            limit_amount="3",
+            limit_unit="GB",
+            time_unit=time_unit
+        )
+```
+
+Create a Savings Plan Utilization Budget
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.budgets_budget import BudgetsBudget
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, timeUnit):
+        super().__init__(scope, name)
+        BudgetsBudget(self, "savings_plan_utilization",
+            budget_type="SAVINGS_PLANS_UTILIZATION",
+            cost_types=BudgetsBudgetCostTypes(
+                include_credit=False,
+                include_discount=False,
+                include_other_subscription=False,
+                include_recurring=False,
+                include_refund=False,
+                include_subscription=True,
+                include_support=False,
+                include_tax=False,
+                include_upfront=False,
+                use_blended=False
+            ),
+            limit_amount="100.0",
+            limit_unit="PERCENTAGE",
+            time_unit=time_unit
+        )
+```
+
+Create a RI Utilization Budget
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.budgets_budget import BudgetsBudget
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, timeUnit):
+        super().__init__(scope, name)
+        BudgetsBudget(self, "ri_utilization",
+            budget_type="RI_UTILIZATION",
+            cost_filter=[BudgetsBudgetCostFilter(
+                name="Service",
+                values=["Amazon Relational Database Service"]
+            )
+            ],
+            cost_types=BudgetsBudgetCostTypes(
+                include_credit=False,
+                include_discount=False,
+                include_other_subscription=False,
+                include_recurring=False,
+                include_refund=False,
+                include_subscription=True,
+                include_support=False,
+                include_tax=False,
+                include_upfront=False,
+                use_blended=False
+            ),
+            limit_amount="100.0",
+            limit_unit="PERCENTAGE",
+            time_unit=time_unit
+        )
+```
+
+Create a Cost Filter using Resource Tags
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.budgets_budget import BudgetsBudget
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, budgetType, timeUnit):
+        super().__init__(scope, name)
+        BudgetsBudget(self, "cost",
+            cost_filter=[BudgetsBudgetCostFilter(
+                name="TagKeyValue",
+                values=["TagKey$TagValue"]
+            )
+            ],
+            budget_type=budget_type,
+            time_unit=time_unit
+        )
+```
+
+Create a cost_filter using resource tags, obtaining the tag value from a terraform variable
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.budgets_budget import BudgetsBudget
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, budgetType, timeUnit):
+        super().__init__(scope, name)
+        BudgetsBudget(self, "cost",
+            cost_filter=[BudgetsBudgetCostFilter(
+                name="TagKeyValue",
+                values=["TagKey$${var.TagValue}"]
+            )
+            ],
+            budget_type=budget_type,
+            time_unit=time_unit
+        )
+```
+
+## Argument Reference
+
+For more detailed documentation about each argument, refer to the [AWS official
+documentation](http://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/data-type-budget.html).
+
+This argument supports the following arguments:
+
+* `account_id` - (Optional) The ID of the target account for budget. Will use current user's account_id by default if omitted.
+* `auto_adjust_data` - (Optional) Object containing [AutoAdjustData] which determines the budget amount for an auto-adjusting budget.
+* `name` - (Optional) The name of a budget. Unique within accounts.
+* `name_prefix` - (Optional) The prefix of the name of a budget. Unique within accounts.
+* `budget_type` - (Required) Whether this budget tracks monetary cost or usage.
+* `cost_filter` - (Optional) A list of [CostFilter](#cost-filter) name/values pair to apply to budget.
+* `cost_types` - (Optional) Object containing [CostTypes](#cost-types) The types of cost included in a budget, such as tax and subscriptions.
+* `limit_amount` - (Required) The amount of cost or usage being measured for a budget.
+* `limit_unit` - (Required) The unit of measurement used for the budget forecast, actual spend, or budget threshold, such as dollars or GB. See [Spend](http://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/data-type-spend.html) documentation.
+* `time_period_end` - (Optional) The end of the time period covered by the budget. There are no restrictions on the end date. Format: `2017-01-01_12:00`.
+* `time_period_start` - (Optional) The start of the time period covered by the budget. If you don't specify a start date, AWS defaults to the start of your chosen time period. The start date must come before the end date. Format: `2017-01-01_12:00`.
+* `time_unit` - (Required) The length of time until a budget resets the actual and forecasted spend. Valid values: `MONTHLY`, `QUARTERLY`, `ANNUALLY`, and `DAILY`.
+* `notification` - (Optional) Object containing [Budget Notifications](#budget-notification). Can be used multiple times to define more than one budget notification.
+* `planned_limit` - (Optional) Object containing [Planned Budget Limits](#planned-budget-limits). Can be used multiple times to plan more than one budget limit. See [PlannedBudgetLimits](https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_budgets_Budget.html#awscostmanagement-Type-budgets_Budget-PlannedBudgetLimits) documentation.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - id of resource.
+* `arn` - The ARN of the budget.
+
+### Auto Adjust Data
+
+The parameters that determine the budget amount for an auto-adjusting budget.
+
+`auto_adjust_type` (Required) - The string that defines whether your budget auto-adjusts based on historical or forecasted data. Valid values: `FORECAST`,`HISTORICAL`
+`historical_options` (Optional) - Configuration block of [Historical Options](#historical-options). Required for `auto_adjust_type` of `HISTORICAL` Configuration block that defines the historical data that your auto-adjusting budget is based on.
+`last_auto_adjust_time` (Optional) - The last time that your budget was auto-adjusted.
+
+### Historical Options
+
+`budget_adjustment_period` (Required) - The number of budget periods included in the moving-average calculation that determines your auto-adjusted budget amount.
+`lookback_available_periods` (Optional) - The integer that describes how many budget periods in your BudgetAdjustmentPeriod are included in the calculation of your current budget limit. If the first budget period in your BudgetAdjustmentPeriod has no cost data, then that budget period isn’t included in the average that determines your budget limit. You can’t set your own LookBackAvailablePeriods. The value is automatically calculated from the `budget_adjustment_period` and your historical cost data.
+
+### Cost Types
+
+Valid keys for `cost_types` parameter.
+
+* `include_credit` - A boolean value whether to include credits in the cost budget. Defaults to `true`
+* `include_discount` - Whether a budget includes discounts. Defaults to `true`
+* `include_other_subscription` - A boolean value whether to include other subscription costs in the cost budget. Defaults to `true`
+* `include_recurring` - A boolean value whether to include recurring costs in the cost budget. Defaults to `true`
+* `include_refund` - A boolean value whether to include refunds in the cost budget. Defaults to `true`
+* `include_subscription` - A boolean value whether to include subscriptions in the cost budget. Defaults to `true`
+* `include_support` - A boolean value whether to include support costs in the cost budget. Defaults to `true`
+* `include_tax` - A boolean value whether to include tax in the cost budget. Defaults to `true`
+* `include_upfront` - A boolean value whether to include upfront costs in the cost budget. Defaults to `true`
+* `use_amortized` - Whether a budget uses the amortized rate. Defaults to `false`
+* `use_blended` - A boolean value whether to use blended costs in the cost budget. Defaults to `false`
+
+Refer to [AWS CostTypes documentation](https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_budgets_CostTypes.html) for further detail.
+
+### Cost Filter
+
+Based on your choice of budget type, you can choose one or more of the available budget filters.
+
+* `PurchaseType`
+* `UsageTypeGroup`
+* `Service`
+* `Operation`
+* `UsageType`
+* `BillingEntity`
+* `CostCategory`
+* `LinkedAccount`
+* `TagKeyValue`
+* `LegalEntityName`
+* `InvoicingEntity`
+* `AZ`
+* `Region`
+* `InstanceType`
+
+Refer to [AWS CostFilter documentation](https://docs.aws.amazon.com/cost-management/latest/userguide/budgets-create-filters.html) for further detail.
+
+### Budget Notification
+
+Valid keys for `notification` parameter.
+
+* `comparison_operator` - (Required) Comparison operator to use to evaluate the condition. Can be `LESS_THAN`, `EQUAL_TO` or `GREATER_THAN`.
+* `threshold` - (Required) Threshold when the notification should be sent.
+* `threshold_type` - (Required) What kind of threshold is defined. Can be `PERCENTAGE` OR `ABSOLUTE_VALUE`.
+* `notification_type` - (Required) What kind of budget value to notify on. Can be `ACTUAL` or `FORECASTED`
+* `subscriber_email_addresses` - (Optional) E-Mail addresses to notify. Either this or `subscriber_sns_topic_arns` is required.
+* `subscriber_sns_topic_arns` - (Optional) SNS topics to notify. Either this or `subscriber_email_addresses` is required.
+
+### Planned Budget Limits
+
+Valid keys for `planned_limit` parameter.
+
+* `start_time` - (Required) The start time of the budget limit. Format: `2017-01-01_12:00`. See [PlannedBudgetLimits](https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_budgets_Budget.html#awscostmanagement-Type-budgets_Budget-PlannedBudgetLimits) documentation.
+* `amount` - (Required) The amount of cost or usage being measured for a budget.
+* `unit` - (Required) The unit of measurement used for the budget forecast, actual spend, or budget threshold, such as dollars or GB. See [Spend](http://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/data-type-spend.html) documentation.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import budgets using `AccountID:ActionID:BudgetName`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import budgets using `AccountID:ActionID:BudgetName`. For example:
+
+```console
+% terraform import aws_budgets_budget.myBudget 123456789012:myBudget
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1e489919affafec652fb181d887cfb745c4899bec31c5aef82fa0e7dc17bde94 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/budgets_budget_action.html.markdown b/website/docs/cdktf/python/r/budgets_budget_action.html.markdown
new file mode 100644
index 00000000000..6fba86b6ea5
--- /dev/null
+++ b/website/docs/cdktf/python/r/budgets_budget_action.html.markdown
@@ -0,0 +1,187 @@
+---
+subcategory: "Web Services Budgets"
+layout: "aws"
+page_title: "AWS: aws_budgets_budget_action"
+description: |-
+  Provides a budget action resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_budgets_budget_action
+
+Provides a budget action resource. Budget actions are cost savings controls that run either automatically on your behalf or by using a workflow approval process.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.budgets_budget import BudgetsBudget
+from imports.aws.budgets_budget_action import BudgetsBudgetAction
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.data_aws_partition import DataAwsPartition
+from imports.aws.iam_policy import IamPolicy
+from imports.aws.iam_role import IamRole
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = BudgetsBudget(self, "example",
+            budget_type="USAGE",
+            limit_amount="10.0",
+            limit_unit="dollars",
+            name="example",
+            time_period_start="2006-01-02_15:04",
+            time_unit="MONTHLY"
+        )
+        data_aws_iam_policy_document_example = DataAwsIamPolicyDocument(self, "example_1",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["ec2:Describe*"],
+                effect="Allow",
+                resources=["*"]
+            )
+            ]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_iam_policy_document_example.override_logical_id("example")
+        current = DataAwsPartition(self, "current")
+        aws_iam_policy_example = IamPolicy(self, "example_3",
+            description="My example policy",
+            name="example",
+            policy=Token.as_string(data_aws_iam_policy_document_example.json)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_policy_example.override_logical_id("example")
+        assume_role = DataAwsIamPolicyDocument(self, "assume_role",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["sts:AssumeRole"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["budgets.${" + current.dns_suffix + "}"],
+                    type="Service"
+                )
+                ]
+            )
+            ]
+        )
+        aws_iam_role_example = IamRole(self, "example_5",
+            assume_role_policy=Token.as_string(assume_role.json),
+            name="example"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_role_example.override_logical_id("example")
+        aws_budgets_budget_action_example = BudgetsBudgetAction(self, "example_6",
+            action_threshold=BudgetsBudgetActionActionThreshold(
+                action_threshold_type="ABSOLUTE_VALUE",
+                action_threshold_value=100
+            ),
+            action_type="APPLY_IAM_POLICY",
+            approval_model="AUTOMATIC",
+            budget_name=example.name,
+            definition=BudgetsBudgetActionDefinition(
+                iam_action_definition=BudgetsBudgetActionDefinitionIamActionDefinition(
+                    policy_arn=Token.as_string(aws_iam_policy_example.arn),
+                    roles=[Token.as_string(aws_iam_role_example.name)]
+                )
+            ),
+            execution_role_arn=Token.as_string(aws_iam_role_example.arn),
+            notification_type="ACTUAL",
+            subscriber=[BudgetsBudgetActionSubscriber(
+                address="example@example.example",
+                subscription_type="EMAIL"
+            )
+            ]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_budgets_budget_action_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `account_id` - (Optional) The ID of the target account for budget. Will use current user's account_id by default if omitted.
+* `budget_name` - (Required) The name of a budget.
+* `action_threshold` - (Required) The trigger threshold of the action. See [Action Threshold](#action-threshold).
+* `action_type` - (Required) The type of action. This defines the type of tasks that can be carried out by this action. This field also determines the format for definition. Valid values are `APPLY_IAM_POLICY`, `APPLY_SCP_POLICY`, and `RUN_SSM_DOCUMENTS`.
+* `approval_model` - (Required) This specifies if the action needs manual or automatic approval. Valid values are `AUTOMATIC` and `MANUAL`.
+* `definition` - (Required) Specifies all of the type-specific parameters. See [Definition](#definition).
+* `execution_role_arn` - (Required) The role passed for action execution and reversion. Roles and actions must be in the same account.
+* `notification_type` - (Required) The type of a notification. Valid values are `ACTUAL` or `FORECASTED`.
+* `subscriber` - (Required) A list of subscribers. See [Subscriber](#subscriber).
+
+### Action Threshold
+
+* `action_threshold_type` - (Required) The type of threshold for a notification. Valid values are `PERCENTAGE` or `ABSOLUTE_VALUE`.
+* `action_threshold_value` - (Required) The threshold of a notification.
+
+### Subscriber
+
+* `address` - (Required) The address that AWS sends budget notifications to, either an SNS topic or an email.
+* `subscription_type` - (Required) The type of notification that AWS sends to a subscriber. Valid values are `SNS` or `EMAIL`.
+
+### Definition
+
+* `iam_action_definition` - (Optional) The AWS Identity and Access Management (IAM) action definition details. See [IAM Action Definition](#iam-action-definition).
+* `ssm_action_definition` - (Optional) The AWS Systems Manager (SSM) action definition details. See [SSM Action Definition](#ssm-action-definition).
+* `scp_action_definition` - (Optional) The service control policies (SCPs) action definition details. See [SCP Action Definition](#scp-action-definition).
+
+#### IAM Action Definition
+
+* `policy_arn` - (Required) The Amazon Resource Name (ARN) of the policy to be attached.
+* `groups` - (Optional) A list of groups to be attached. There must be at least one group.
+* `roles` - (Optional) A list of roles to be attached. There must be at least one role.
+* `users` - (Optional) A list of users to be attached. There must be at least one user.
+
+#### SCP Action Definition
+
+* `policy_id` - (Required) The policy ID attached.
+* `target_ids` - (Optional) A list of target IDs.
+
+#### SSM Action Definition
+
+* `action_sub_type` - (Required) The action subType. Valid values are `STOP_EC2_INSTANCES` or `STOP_RDS_INSTANCES`.
+* `instance_ids` - (Required) The EC2 and RDS instance IDs.
+* `region` - (Required) The Region to run the SSM document.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `action_id` - The id of the budget action.
+* `id` - ID of resource.
+* `arn` - The ARN of the budget action.
+* `status` - The status of the budget action.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `5m`)
+* `update` - (Default `5m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import budget actions using `AccountID:ActionID:BudgetName`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import budget actions using `AccountID:ActionID:BudgetName`. For example:
+
+```console
+% terraform import aws_budgets_budget_action.myBudget 123456789012:some-id:myBudget
+```
+
+<!-- cache-key: cdktf-0.18.0 input-a8daba74b839303b60ec0ca7332cc6e8fa6dbb5c1bd3883e6e008d98d91f359b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ce_anomaly_monitor.html.markdown b/website/docs/cdktf/python/r/ce_anomaly_monitor.html.markdown
new file mode 100644
index 00000000000..ca1531befc6
--- /dev/null
+++ b/website/docs/cdktf/python/r/ce_anomaly_monitor.html.markdown
@@ -0,0 +1,110 @@
+---
+subcategory: "CE (Cost Explorer)"
+layout: "aws"
+page_title: "AWS: aws_ce_anomaly_monitor"
+description: |-
+  Provides a CE Cost Anomaly Monitor
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ce_anomaly_monitor
+
+Provides a CE Anomaly Monitor.
+
+## Example Usage
+
+There are two main types of a Cost Anomaly Monitor: `DIMENSIONAL` and `CUSTOM`.
+
+### Dimensional Example
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ce_anomaly_monitor import CeAnomalyMonitor
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        CeAnomalyMonitor(self, "service_monitor",
+            monitor_dimension="SERVICE",
+            monitor_type="DIMENSIONAL",
+            name="AWSServiceMonitor"
+        )
+```
+
+### Custom Example
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ce_anomaly_monitor import CeAnomalyMonitor
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        CeAnomalyMonitor(self, "test",
+            monitor_specification=Token.as_string(
+                Fn.jsonencode({
+                    "And": "null",
+                    "CostCategories": "null",
+                    "Dimensions": "null",
+                    "Not": "null",
+                    "Or": "null",
+                    "Tags": {
+                        "Key": "CostCenter",
+                        "MatchOptions": "null",
+                        "Values": ["10000"]
+                    }
+                })),
+            monitor_type="CUSTOM",
+            name="AWSCustomAnomalyMonitor"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) The name of the monitor.
+* `monitor_type` - (Required) The possible type values. Valid values: `DIMENSIONAL` | `CUSTOM`.
+* `monitor_dimension` - (Required, if `monitor_type` is `DIMENSIONAL`) The dimensions to evaluate. Valid values: `SERVICE`.
+* `monitor_specification` - (Required, if `monitor_type` is `CUSTOM`) A valid JSON representation for the [Expression](https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_Expression.html) object.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the anomaly monitor.
+* `id` - Unique ID of the anomaly monitor. Same as `arn`.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_ce_anomaly_monitor` using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_ce_anomaly_monitor` using the `id`. For example:
+
+```console
+% terraform import aws_ce_anomaly_monitor.example costAnomalyMonitorARN
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1578f36961ed88a11a17f0c1c8745d16387472eae9e80de6c376da2f0ebcc68e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ce_anomaly_subscription.html.markdown b/website/docs/cdktf/python/r/ce_anomaly_subscription.html.markdown
new file mode 100644
index 00000000000..4f93f12232c
--- /dev/null
+++ b/website/docs/cdktf/python/r/ce_anomaly_subscription.html.markdown
@@ -0,0 +1,274 @@
+---
+subcategory: "CE (Cost Explorer)"
+layout: "aws"
+page_title: "AWS: aws_ce_anomaly_subscription"
+description: |-
+  Provides a CE Cost Anomaly Subscription
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ce_anomaly_subscription
+
+Provides a CE Anomaly Subscription.
+
+## Example Usage
+
+### Basic Example
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ce_anomaly_monitor import CeAnomalyMonitor
+from imports.aws.ce_anomaly_subscription import CeAnomalySubscription
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        test = CeAnomalyMonitor(self, "test",
+            monitor_dimension="SERVICE",
+            monitor_type="DIMENSIONAL",
+            name="AWSServiceMonitor"
+        )
+        aws_ce_anomaly_subscription_test = CeAnomalySubscription(self, "test_1",
+            frequency="DAILY",
+            monitor_arn_list=[test.arn],
+            name="DAILYSUBSCRIPTION",
+            subscriber=[CeAnomalySubscriptionSubscriber(
+                address="abc@example.com",
+                type="EMAIL"
+            )
+            ],
+            threshold=100
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_ce_anomaly_subscription_test.override_logical_id("test")
+```
+
+### Threshold Expression Example
+
+#### For a Specific Dimension
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ce_anomaly_subscription import CeAnomalySubscription
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        CeAnomalySubscription(self, "test",
+            frequency="DAILY",
+            monitor_arn_list=[Token.as_string(aws_ce_anomaly_monitor_test.arn)],
+            name="AWSServiceMonitor",
+            subscriber=[CeAnomalySubscriptionSubscriber(
+                address="abc@example.com",
+                type="EMAIL"
+            )
+            ],
+            threshold_expression=CeAnomalySubscriptionThresholdExpression(
+                dimension=CeAnomalySubscriptionThresholdExpressionDimension(
+                    key="ANOMALY_TOTAL_IMPACT_ABSOLUTE",
+                    match_options=["GREATER_THAN_OR_EQUAL"],
+                    values=["100.0"]
+                )
+            )
+        )
+```
+
+#### Using an `and` Expression
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ce_anomaly_subscription import CeAnomalySubscription
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        CeAnomalySubscription(self, "test",
+            frequency="DAILY",
+            monitor_arn_list=[Token.as_string(aws_ce_anomaly_monitor_test.arn)],
+            name="AWSServiceMonitor",
+            subscriber=[CeAnomalySubscriptionSubscriber(
+                address="abc@example.com",
+                type="EMAIL"
+            )
+            ],
+            threshold_expression=CeAnomalySubscriptionThresholdExpression(
+                and=[CeAnomalySubscriptionThresholdExpressionAnd(
+                    dimension=CeAnomalySubscriptionThresholdExpressionAndDimension(
+                        key="ANOMALY_TOTAL_IMPACT_ABSOLUTE",
+                        match_options=["GREATER_THAN_OR_EQUAL"],
+                        values=["100"]
+                    )
+                ), CeAnomalySubscriptionThresholdExpressionAnd(
+                    dimension=CeAnomalySubscriptionThresholdExpressionAndDimension(
+                        key="ANOMALY_TOTAL_IMPACT_PERCENTAGE",
+                        match_options=["GREATER_THAN_OR_EQUAL"],
+                        values=["50"]
+                    )
+                )
+                ]
+            )
+        )
+```
+
+### SNS Example
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ce_anomaly_monitor import CeAnomalyMonitor
+from imports.aws.ce_anomaly_subscription import CeAnomalySubscription
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.sns_topic import SnsTopic
+from imports.aws.sns_topic_policy import SnsTopicPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        anomaly_monitor = CeAnomalyMonitor(self, "anomaly_monitor",
+            monitor_dimension="SERVICE",
+            monitor_type="DIMENSIONAL",
+            name="AWSServiceMonitor"
+        )
+        cost_anomaly_updates = SnsTopic(self, "cost_anomaly_updates",
+            name="CostAnomalyUpdates"
+        )
+        sns_topic_policy = DataAwsIamPolicyDocument(self, "sns_topic_policy",
+            policy_id="__default_policy_ID",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["SNS:Publish"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["costalerts.amazonaws.com"],
+                    type="Service"
+                )
+                ],
+                resources=[cost_anomaly_updates.arn],
+                sid="AWSAnomalyDetectionSNSPublishingPermissions"
+            ), DataAwsIamPolicyDocumentStatement(
+                actions=["SNS:Subscribe", "SNS:SetTopicAttributes", "SNS:RemovePermission", "SNS:Receive", "SNS:Publish", "SNS:ListSubscriptionsByTopic", "SNS:GetTopicAttributes", "SNS:DeleteTopic", "SNS:AddPermission"
+                ],
+                condition=[DataAwsIamPolicyDocumentStatementCondition(
+                    test="StringEquals",
+                    values=[account_id.string_value],
+                    variable="AWS:SourceOwner"
+                )
+                ],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["*"],
+                    type="AWS"
+                )
+                ],
+                resources=[cost_anomaly_updates.arn],
+                sid="__default_statement_ID"
+            )
+            ]
+        )
+        default_var = SnsTopicPolicy(self, "default",
+            arn=cost_anomaly_updates.arn,
+            policy=Token.as_string(sns_topic_policy.json)
+        )
+        CeAnomalySubscription(self, "realtime_subscription",
+            depends_on=[default_var],
+            frequency="IMMEDIATE",
+            monitor_arn_list=[anomaly_monitor.arn],
+            name="RealtimeAnomalySubscription",
+            subscriber=[CeAnomalySubscriptionSubscriber(
+                address=cost_anomaly_updates.arn,
+                type="SNS"
+            )
+            ],
+            threshold=0
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `account_id` - (Optional) The unique identifier for the AWS account in which the anomaly subscription ought to be created.
+* `frequency` - (Required) The frequency that anomaly reports are sent. Valid Values: `DAILY` | `IMMEDIATE` | `WEEKLY`.
+* `monitor_arn_list` - (Required) A list of cost anomaly monitors.
+* `name` - (Required) The name for the subscription.
+* `subscriber` - (Required) A subscriber configuration. Multiple subscribers can be defined.
+    * `type` - (Required) The type of subscription. Valid Values: `SNS` | `EMAIL`.
+    * `address` - (Required) The address of the subscriber. If type is `SNS`, this will be the arn of the sns topic. If type is `EMAIL`, this will be the destination email address.
+* `threshold` - (Optional) The dollar value that triggers a notification if the threshold is exceeded. Depracated, use `threshold_expression` instead.
+* `threshold_expression` - (Optional) An Expression object used to specify the anomalies that you want to generate alerts for. See [Threshold Expression](#threshold-expression).
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Threshold Expression
+
+* `and` - (Optional) Return results that match both [Dimension](#dimension) objects.
+* `cost_category` - (Optional) Configuration block for the filter that's based on  values. See [Cost Category](#cost-category) below.
+* `dimension` - (Optional) Configuration block for the specific [Dimension](#dimension) to use for.
+* `not` - (Optional) Return results that match both [Dimension](#dimension) object.
+* `or` - (Optional) Return results that match both [Dimension](#dimension) object.
+* `tags` - (Optional) Configuration block for the specific Tag to use for. See [Tags](#tags) below.
+
+### Cost Category
+
+* `key` - (Optional) Unique name of the Cost Category.
+* `match_options` - (Optional) Match options that you can use to filter your results. MatchOptions is only applicable for actions related to cost category. The default values for MatchOptions is `EQUALS` and `CASE_SENSITIVE`. Valid values are: `EQUALS`,  `ABSENT`, `STARTS_WITH`, `ENDS_WITH`, `CONTAINS`, `CASE_SENSITIVE`, `CASE_INSENSITIVE`.
+* `values` - (Optional) Specific value of the Cost Category.
+
+### Dimension
+
+* `key` - (Optional) Unique name of the Cost Category.
+* `match_options` - (Optional) Match options that you can use to filter your results. MatchOptions is only applicable for actions related to cost category. The default values for MatchOptions is `EQUALS` and `CASE_SENSITIVE`. Valid values are: `EQUALS`,  `ABSENT`, `STARTS_WITH`, `ENDS_WITH`, `CONTAINS`, `CASE_SENSITIVE`, `CASE_INSENSITIVE`.
+* `values` - (Optional) Specific value of the Cost Category.
+
+### Tags
+
+* `key` - (Optional) Key for the tag.
+* `match_options` - (Optional) Match options that you can use to filter your results. MatchOptions is only applicable for actions related to cost category. The default values for MatchOptions is `EQUALS` and `CASE_SENSITIVE`. Valid values are: `EQUALS`,  `ABSENT`, `STARTS_WITH`, `ENDS_WITH`, `CONTAINS`, `CASE_SENSITIVE`, `CASE_INSENSITIVE`.
+* `values` - (Optional) Specific value of the Cost Category.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the anomaly subscription.
+* `id` - Unique ID of the anomaly subscription. Same as `arn`.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_ce_anomaly_subscription` using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_ce_anomaly_subscription` using the `id`. For example:
+
+```console
+% terraform import aws_ce_anomaly_subscription.example AnomalySubscriptionARN
+```
+
+<!-- cache-key: cdktf-0.18.0 input-8e7a0801298f69044c659554617a5baf1372b080e7b8c8feed89f9dfbbaac302 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ce_cost_allocation_tag.html.markdown b/website/docs/cdktf/python/r/ce_cost_allocation_tag.html.markdown
new file mode 100644
index 00000000000..4dd8ea14db5
--- /dev/null
+++ b/website/docs/cdktf/python/r/ce_cost_allocation_tag.html.markdown
@@ -0,0 +1,68 @@
+---
+subcategory: "CE (Cost Explorer)"
+layout: "aws"
+page_title: "AWS: aws_ce_cost_allocation_tag"
+description: |-
+  Provides a CE Cost Allocation Tag
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ce_cost_allocation_tag
+
+Provides a CE Cost Allocation Tag.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ce_cost_allocation_tag import CeCostAllocationTag
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        CeCostAllocationTag(self, "example",
+            status="Active",
+            tag_key="example"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `tag_key` - (Required) The key for the cost allocation tag.
+* `status` - (Required) The status of a cost allocation tag. Valid values are `Active` and `Inactive`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The key for the cost allocation tag.
+* `type` - The type of cost allocation tag.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_ce_cost_allocation_tag` using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_ce_cost_allocation_tag` using the `id`. For example:
+
+```console
+% terraform import aws_ce_cost_allocation_tag.example key
+```
+
+<!-- cache-key: cdktf-0.18.0 input-544cfa0670b83ddbc9c2d5d5bbdf2b0ec54ea059c22ab29b2f86b8890060e8a5 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ce_cost_category.html.markdown b/website/docs/cdktf/python/r/ce_cost_category.html.markdown
new file mode 100644
index 00000000000..c809c90f376
--- /dev/null
+++ b/website/docs/cdktf/python/r/ce_cost_category.html.markdown
@@ -0,0 +1,158 @@
+---
+subcategory: "CE (Cost Explorer)"
+layout: "aws"
+page_title: "AWS: aws_ce_cost_category"
+description: |-
+  Provides a CE Cost Category Definition
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ce_cost_category
+
+Provides a CE Cost Category.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ce_cost_category import CeCostCategory
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        CeCostCategory(self, "test",
+            name="NAME",
+            rule=[CeCostCategoryRule(
+                rule=CeCostCategoryRuleRule(
+                    dimension=CeCostCategoryRuleRuleDimension(
+                        key="LINKED_ACCOUNT_NAME",
+                        match_options=["ENDS_WITH"],
+                        values=["-prod"]
+                    )
+                ),
+                value="production"
+            ), CeCostCategoryRule(
+                rule=CeCostCategoryRuleRule(
+                    dimension=CeCostCategoryRuleRuleDimension(
+                        key="LINKED_ACCOUNT_NAME",
+                        match_options=["ENDS_WITH"],
+                        values=["-stg"]
+                    )
+                ),
+                value="staging"
+            ), CeCostCategoryRule(
+                rule=CeCostCategoryRuleRule(
+                    dimension=CeCostCategoryRuleRuleDimension(
+                        key="LINKED_ACCOUNT_NAME",
+                        match_options=["ENDS_WITH"],
+                        values=["-dev"]
+                    )
+                ),
+                value="testing"
+            )
+            ],
+            rule_version="CostCategoryExpression.v1"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) Unique name for the Cost Category.
+* `rule` - (Required) Configuration block for the Cost Category rules used to categorize costs. See below.
+* `rule_version` - (Required) Rule schema version in this particular Cost Category.
+* `effective_start`- (Optional)  The Cost Category's effective start date. It can only be a billing start date (first day of the month). If the date isn't provided, it's the first day of the current month. Dates can't be before the previous twelve months, or in the future. For example `2022-11-01T00:00:00Z`.
+
+The following arguments are optional:
+
+* `default_value` - (Optional) Default value for the cost category.
+* `split_charge_rule` - (Optional) Configuration block for the split charge rules used to allocate your charges between your Cost Category values. See below.
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### `rule`
+
+* `inherited_value` - (Optional) Configuration block for the value the line item is categorized as if the line item contains the matched dimension. See below.
+* `rule` - (Optional) Configuration block for the `Expression` object used to categorize costs. See below.
+* `type` - (Optional) You can define the CostCategoryRule rule type as either `REGULAR` or `INHERITED_VALUE`.
+* `value` - (Optional) Default value for the cost category.
+
+### `inherited_value`
+
+* `dimension_key` - (Optional) Key to extract cost category values.
+* `dimension_name` - (Optional) Name of the dimension that's used to group costs. If you specify `LINKED_ACCOUNT_NAME`, the cost category value is based on account name. If you specify `TAG`, the cost category value will be based on the value of the specified tag key. Valid values are `LINKED_ACCOUNT_NAME`, `TAG`
+
+### `rule`
+
+* `and` - (Optional) Return results that match both `Dimension` objects.
+* `cost_category` - (Optional) Configuration block for the filter that's based on `CostCategory` values. See below.
+* `dimension` - (Optional) Configuration block for the specific `Dimension` to use for `Expression`. See below.
+* `not` - (Optional) Return results that match both `Dimension` object.
+* `or` - (Optional) Return results that match both `Dimension` object.
+* `tags` - (Optional) Configuration block for the specific `Tag` to use for `Expression`. See below.
+
+### `cost_category`
+
+* `key` - (Optional) Unique name of the Cost Category.
+* `match_options` - (Optional) Match options that you can use to filter your results. MatchOptions is only applicable for actions related to cost category. The default values for MatchOptions is `EQUALS` and `CASE_SENSITIVE`. Valid values are: `EQUALS`,  `ABSENT`, `STARTS_WITH`, `ENDS_WITH`, `CONTAINS`, `CASE_SENSITIVE`, `CASE_INSENSITIVE`.
+* `values` - (Optional) Specific value of the Cost Category.
+
+### `dimension`
+
+* `key` - (Optional) Unique name of the Cost Category.
+* `match_options` - (Optional) Match options that you can use to filter your results. MatchOptions is only applicable for actions related to cost category. The default values for MatchOptions is `EQUALS` and `CASE_SENSITIVE`. Valid values are: `EQUALS`,  `ABSENT`, `STARTS_WITH`, `ENDS_WITH`, `CONTAINS`, `CASE_SENSITIVE`, `CASE_INSENSITIVE`.
+* `values` - (Optional) Specific value of the Cost Category.
+
+### `tags`
+
+* `key` - (Optional) Key for the tag.
+* `match_options` - (Optional) Match options that you can use to filter your results. MatchOptions is only applicable for actions related to cost category. The default values for MatchOptions is `EQUALS` and `CASE_SENSITIVE`. Valid values are: `EQUALS`,  `ABSENT`, `STARTS_WITH`, `ENDS_WITH`, `CONTAINS`, `CASE_SENSITIVE`, `CASE_INSENSITIVE`.
+* `values` - (Optional) Specific value of the Cost Category.
+
+### `split_charge_rule`
+
+* `method` - (Required) Method that's used to define how to split your source costs across your targets. Valid values are `FIXED`, `PROPORTIONAL`, `EVEN`
+* `parameter` - (Optional) Configuration block for the parameters for a split charge method. This is only required for the `FIXED` method. See below.
+* `source` - (Required) Cost Category value that you want to split.
+* `targets` - (Required) Cost Category values that you want to split costs across. These values can't be used as a source in other split charge rules.
+
+### `parameter`
+
+* `type` - (Optional) Parameter type.
+* `values` - (Optional) Parameter values.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the cost category.
+* `effective_end` - Effective end data of your Cost Category.
+* `id` - Unique ID of the cost category.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_ce_cost_category` using the id. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_ce_cost_category` using the id. For example:
+
+```console
+% terraform import aws_ce_cost_category.example costCategoryARN
+```
+
+<!-- cache-key: cdktf-0.18.0 input-6d32509d874b0d724dcb62ee9ca6ed83a7cb80815f66336ea0a19f4b9bd60e60 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/chime_voice_connector.html.markdown b/website/docs/cdktf/python/r/chime_voice_connector.html.markdown
new file mode 100644
index 00000000000..3e73de4cd06
--- /dev/null
+++ b/website/docs/cdktf/python/r/chime_voice_connector.html.markdown
@@ -0,0 +1,75 @@
+---
+subcategory: "Chime"
+layout: "aws"
+page_title: "AWS: aws_chime_voice_connector"
+description: |-
+  Enables you to connect your phone system to the telephone network at a substantial cost savings by using SIP trunking.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_chime_voice_connector
+
+Enables you to connect your phone system to the telephone network at a substantial cost savings by using SIP trunking.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.chime_voice_connector import ChimeVoiceConnector
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ChimeVoiceConnector(self, "test",
+            aws_region="us-east-1",
+            name="connector-test-1",
+            require_encryption=True
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) The name of the Amazon Chime Voice Connector.
+* `require_encryption` - (Required) When enabled, requires encryption for the Amazon Chime Voice Connector.
+
+The following arguments are optional:
+
+* `aws_region` - (Optional) The AWS Region in which the Amazon Chime Voice Connector is created. Default value: `us-east-1`
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN (Amazon Resource Name) of the Amazon Chime Voice Connector.
+* `outbound_host_name` - The outbound host name for the Amazon Chime Voice Connector.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Configuration Recorder using the name. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Configuration Recorder using the name. For example:
+
+```console
+% terraform import aws_chime_voice_connector.test example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-57d9ed8368462a0a6c75d0f398c65a29c78ba9f2b52b59eeb50b3be795890ccd -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/chime_voice_connector_group.html.markdown b/website/docs/cdktf/python/r/chime_voice_connector_group.html.markdown
new file mode 100644
index 00000000000..074bfe319ce
--- /dev/null
+++ b/website/docs/cdktf/python/r/chime_voice_connector_group.html.markdown
@@ -0,0 +1,94 @@
+---
+subcategory: "Chime"
+layout: "aws"
+page_title: "AWS: aws_chime_voice_connector_group"
+description: |-
+  Creates an Amazon Chime Voice Connector group under the administrator's AWS account.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_chime_voice_connector_group
+
+Creates an Amazon Chime Voice Connector group under the administrator's AWS account. You can associate Amazon Chime Voice Connectors with the Amazon Chime Voice Connector group by including VoiceConnectorItems in the request.
+
+You can include Amazon Chime Voice Connectors from different AWS Regions in your group. This creates a fault tolerant mechanism for fallback in case of availability events.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.chime_voice_connector import ChimeVoiceConnector
+from imports.aws.chime_voice_connector_group import ChimeVoiceConnectorGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        vc1 = ChimeVoiceConnector(self, "vc1",
+            aws_region="us-east-1",
+            name="connector-test-1",
+            require_encryption=True
+        )
+        vc2 = ChimeVoiceConnector(self, "vc2",
+            aws_region="us-west-2",
+            name="connector-test-2",
+            require_encryption=True
+        )
+        ChimeVoiceConnectorGroup(self, "group",
+            connector=[ChimeVoiceConnectorGroupConnector(
+                priority=1,
+                voice_connector_id=vc1.id
+            ), ChimeVoiceConnectorGroupConnector(
+                priority=3,
+                voice_connector_id=vc2.id
+            )
+            ],
+            name="test-group"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the Amazon Chime Voice Connector group.
+* `connector` - (Optional) The Amazon Chime Voice Connectors to route inbound calls to.
+
+### `connector`
+
+For Amazon Chime Voice Connector groups, the Amazon Chime Voice Connectors to which to route inbound calls. Includes priority configuration settings. Limit: 3 VoiceConnectorItems per Amazon Chime Voice Connector group.
+
+* `voice_connector_id` - (Required) The Amazon Chime Voice Connector ID.
+* `priority` - (Required) The priority associated with the Amazon Chime Voice Connector, with 1 being the highest priority. Higher priority Amazon Chime Voice Connectors are attempted first.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Amazon Chime Voice Connector group ID.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Configuration Recorder using the name. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Configuration Recorder using the name. For example:
+
+```console
+% terraform import aws_chime_voice_connector_group.default example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-2647c34ddcecc5abad23c5553fbf101209a26f858db52f9c3b06b4b66669a7c9 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/chime_voice_connector_logging.html.markdown b/website/docs/cdktf/python/r/chime_voice_connector_logging.html.markdown
new file mode 100644
index 00000000000..8bb1a5ea135
--- /dev/null
+++ b/website/docs/cdktf/python/r/chime_voice_connector_logging.html.markdown
@@ -0,0 +1,76 @@
+---
+subcategory: "Chime"
+layout: "aws"
+page_title: "AWS: aws_chime_voice_connector_logging"
+description: |-
+    Adds a logging configuration for the specified Amazon Chime Voice Connector. The logging configuration specifies whether SIP message logs are enabled for sending to Amazon CloudWatch Logs.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_chime_voice_connector_logging
+
+Adds a logging configuration for the specified Amazon Chime Voice Connector. The logging configuration specifies whether SIP message logs are enabled for sending to Amazon CloudWatch Logs.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.chime_voice_connector import ChimeVoiceConnector
+from imports.aws.chime_voice_connector_logging import ChimeVoiceConnectorLogging
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        default_var = ChimeVoiceConnector(self, "default",
+            name="vc-name-test",
+            require_encryption=True
+        )
+        aws_chime_voice_connector_logging_default = ChimeVoiceConnectorLogging(self, "default_1",
+            enable_media_metric_logs=True,
+            enable_sip_logs=True,
+            voice_connector_id=default_var.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_chime_voice_connector_logging_default.override_logical_id("default")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `voice_connector_id` - (Required) The Amazon Chime Voice Connector ID.
+* `enable_sip_logs` - (Optional) When true, enables SIP message logs for sending to Amazon CloudWatch Logs.
+* `enable_media_metric_logs` - (Optional) When true, enables logging of detailed media metrics for Voice Connectors to Amazon CloudWatch logs.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Amazon Chime Voice Connector ID.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Chime Voice Connector Logging using the `voice_connector_id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Chime Voice Connector Logging using the `voice_connector_id`. For example:
+
+```console
+% terraform import aws_chime_voice_connector_logging.default abcdef1ghij2klmno3pqr4
+```
+
+<!-- cache-key: cdktf-0.18.0 input-361c57bb71aad3cb46b58306335292d5a69d6d2855bbf5152806871405e9e3ff -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/chime_voice_connector_origination.html.markdown b/website/docs/cdktf/python/r/chime_voice_connector_origination.html.markdown
new file mode 100644
index 00000000000..7ea596c123a
--- /dev/null
+++ b/website/docs/cdktf/python/r/chime_voice_connector_origination.html.markdown
@@ -0,0 +1,100 @@
+---
+subcategory: "Chime"
+layout: "aws"
+page_title: "AWS: aws_chime_voice_connector_origination"
+description: |-
+    Enable origination settings to control inbound calling to your SIP infrastructure.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_chime_voice_connector_origination
+
+Enable origination settings to control inbound calling to your SIP infrastructure.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.chime_voice_connector import ChimeVoiceConnector
+from imports.aws.chime_voice_connector_origination import ChimeVoiceConnectorOrigination
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        default_var = ChimeVoiceConnector(self, "default",
+            name="test",
+            require_encryption=True
+        )
+        aws_chime_voice_connector_origination_default =
+        ChimeVoiceConnectorOrigination(self, "default_1",
+            disabled=False,
+            route=[ChimeVoiceConnectorOriginationRoute(
+                host="127.0.0.1",
+                port=8081,
+                priority=1,
+                protocol="TCP",
+                weight=1
+            ), ChimeVoiceConnectorOriginationRoute(
+                host="127.0.0.2",
+                port=8082,
+                priority=2,
+                protocol="TCP",
+                weight=10
+            )
+            ],
+            voice_connector_id=default_var.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_chime_voice_connector_origination_default.override_logical_id("default")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `voice_connector_id` - (Required) The Amazon Chime Voice Connector ID.
+* `route` - (Required) Set of call distribution properties defined for your SIP hosts. See [route](#route) below for more details. Minimum of 1. Maximum of 20.
+* `disabled` - (Optional) When origination settings are disabled, inbound calls are not enabled for your Amazon Chime Voice Connector.
+
+### `route`
+
+Origination routes define call distribution properties for your SIP hosts to receive inbound calls using your Amazon Chime Voice Connector. Limit: Ten origination routes for each Amazon Chime Voice Connector.
+
+* `host` - (Required) The FQDN or IP address to contact for origination traffic.
+* `port` - (Required) The designated origination route port. Defaults to `5060`.
+* `priority` - (Required) The priority associated with the host, with 1 being the highest priority. Higher priority hosts are attempted first.
+* `protocol` - (Required) The protocol to use for the origination route. Encryption-enabled Amazon Chime Voice Connectors use TCP protocol by default.
+* `weight` - (Required) The weight associated with the host. If hosts are equal in priority, calls are redistributed among them based on their relative weight.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Amazon Chime Voice Connector ID.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Chime Voice Connector Origination using the `voice_connector_id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Chime Voice Connector Origination using the `voice_connector_id`. For example:
+
+```console
+% terraform import aws_chime_voice_connector_origination.default abcdef1ghij2klmno3pqr4
+```
+
+<!-- cache-key: cdktf-0.18.0 input-2f8024ec4e12ef059381d8723231847b43f7b2e0c051e5ee2e2f2bc6e04e4558 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/chime_voice_connector_streaming.html.markdown b/website/docs/cdktf/python/r/chime_voice_connector_streaming.html.markdown
new file mode 100644
index 00000000000..9550a53d8db
--- /dev/null
+++ b/website/docs/cdktf/python/r/chime_voice_connector_streaming.html.markdown
@@ -0,0 +1,165 @@
+---
+subcategory: "Chime"
+layout: "aws"
+page_title: "AWS: aws_chime_voice_connector_streaming"
+description: |-
+    The streaming configuration associated with an Amazon Chime Voice Connector. Specifies whether media streaming is enabled for sending to Amazon Kinesis, and shows the retention period for the Amazon Kinesis data, in hours.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_chime_voice_connector_streaming
+
+Adds a streaming configuration for the specified Amazon Chime Voice Connector. The streaming configuration specifies whether media streaming is enabled for sending to Amazon Kinesis.
+It also sets the retention period, in hours, for the Amazon Kinesis data.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.chime_voice_connector import ChimeVoiceConnector
+from imports.aws.chime_voice_connector_streaming import ChimeVoiceConnectorStreaming
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        default_var = ChimeVoiceConnector(self, "default",
+            name="vc-name-test",
+            require_encryption=True
+        )
+        aws_chime_voice_connector_streaming_default =
+        ChimeVoiceConnectorStreaming(self, "default_1",
+            data_retention=7,
+            disabled=False,
+            streaming_notification_targets=["SQS"],
+            voice_connector_id=default_var.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_chime_voice_connector_streaming_default.override_logical_id("default")
+```
+
+### Example Usage With Media Insights
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.chime_voice_connector import ChimeVoiceConnector
+from imports.aws.chime_voice_connector_streaming import ChimeVoiceConnectorStreaming
+from imports.aws.chimesdkmediapipelines_media_insights_pipeline_configuration import ChimesdkmediapipelinesMediaInsightsPipelineConfiguration
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.iam_role import IamRole
+from imports.aws.kinesis_stream import KinesisStream
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        default_var = ChimeVoiceConnector(self, "default",
+            name="vc-name-test",
+            require_encryption=True
+        )
+        example = KinesisStream(self, "example",
+            name="ExampleStream",
+            shard_count=2
+        )
+        assume_role = DataAwsIamPolicyDocument(self, "assume_role",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["sts:AssumeRole"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["mediapipelines.chime.amazonaws.com"],
+                    type="Service"
+                )
+                ]
+            )
+            ]
+        )
+        aws_iam_role_example = IamRole(self, "example_3",
+            assume_role_policy=Token.as_string(assume_role.json),
+            name="ExampleResourceAccessRole"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_role_example.override_logical_id("example")
+        aws_chimesdkmediapipelines_media_insights_pipeline_configuration_example =
+        ChimesdkmediapipelinesMediaInsightsPipelineConfiguration(self, "example_4",
+            elements=[ChimesdkmediapipelinesMediaInsightsPipelineConfigurationElements(
+                amazon_transcribe_call_analytics_processor_configuration=ChimesdkmediapipelinesMediaInsightsPipelineConfigurationElementsAmazonTranscribeCallAnalyticsProcessorConfiguration(
+                    language_code="en-US"
+                ),
+                type="AmazonTranscribeCallAnalyticsProcessor"
+            ), ChimesdkmediapipelinesMediaInsightsPipelineConfigurationElements(
+                kinesis_data_stream_sink_configuration=ChimesdkmediapipelinesMediaInsightsPipelineConfigurationElementsKinesisDataStreamSinkConfiguration(
+                    insights_target=example.arn
+                ),
+                type="KinesisDataStreamSink"
+            )
+            ],
+            name="ExampleConfig",
+            resource_access_role_arn=Token.as_string(aws_iam_role_example.arn)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_chimesdkmediapipelines_media_insights_pipeline_configuration_example.override_logical_id("example")
+        aws_chime_voice_connector_streaming_default =
+        ChimeVoiceConnectorStreaming(self, "default_5",
+            data_retention=7,
+            disabled=False,
+            media_insights_configuration=ChimeVoiceConnectorStreamingMediaInsightsConfiguration(
+                configuration_arn=Token.as_string(aws_chimesdkmediapipelines_media_insights_pipeline_configuration_example.arn),
+                disabled=False
+            ),
+            streaming_notification_targets=["SQS"],
+            voice_connector_id=default_var.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_chime_voice_connector_streaming_default.override_logical_id("default")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `voice_connector_id` - (Required) The Amazon Chime Voice Connector ID.
+* `data_retention`  - (Required) The retention period, in hours, for the Amazon Kinesis data.
+* `disabled` - (Optional) When true, media streaming to Amazon Kinesis is turned off. Default: `false`
+* `streaming_notification_targets` - (Optional) The streaming notification targets. Valid Values: `EventBridge | SNS | SQS`
+* `media_insights_configuration` - (Optional) The media insights configuration. See [`media_insights_configuration`](#media_insights_configuration).
+
+### media_insights_configuration
+
+* `disabled` - (Optional) When `true`, the media insights configuration is not enabled. Defaults to `false`.
+* `configuration_arn` - (Optional) The media insights configuration that will be invoked by the Voice Connector.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Amazon Chime Voice Connector ID.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Chime Voice Connector Streaming using the `voice_connector_id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Chime Voice Connector Streaming using the `voice_connector_id`. For example:
+
+```console
+% terraform import aws_chime_voice_connector_streaming.default abcdef1ghij2klmno3pqr4
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1d6eaf10d1870a1e8fdf049fb6ca121f258d5ffdbe4eae79fe564f39d16ce4f8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/chime_voice_connector_termination.html.markdown b/website/docs/cdktf/python/r/chime_voice_connector_termination.html.markdown
new file mode 100644
index 00000000000..f52ac741257
--- /dev/null
+++ b/website/docs/cdktf/python/r/chime_voice_connector_termination.html.markdown
@@ -0,0 +1,82 @@
+---
+subcategory: "Chime"
+layout: "aws"
+page_title: "AWS: aws_chime_voice_connector_termination"
+description: |-
+    Enable Termination settings to control outbound calling from your SIP infrastructure.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_chime_voice_connector_termination
+
+Enable Termination settings to control outbound calling from your SIP infrastructure.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.chime_voice_connector import ChimeVoiceConnector
+from imports.aws.chime_voice_connector_termination import ChimeVoiceConnectorTermination
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        default_var = ChimeVoiceConnector(self, "default",
+            name="vc-name-test",
+            require_encryption=True
+        )
+        aws_chime_voice_connector_termination_default =
+        ChimeVoiceConnectorTermination(self, "default_1",
+            calling_regions=["US", "CA"],
+            cidr_allow_list=["50.35.78.96/31"],
+            cps_limit=1,
+            disabled=False,
+            voice_connector_id=default_var.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_chime_voice_connector_termination_default.override_logical_id("default")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `voice_connector_id` - (Required) The Amazon Chime Voice Connector ID.
+* `cidr_allow_list` - (Required) The IP addresses allowed to make calls, in CIDR format.
+* `calling_regions` - (Required) The countries to which calls are allowed, in ISO 3166-1 alpha-2 format.
+* `disabled` - (Optional) When termination settings are disabled, outbound calls can not be made.
+* `default_phone_number` - (Optional) The default caller ID phone number.
+* `cps_limit` - (Optional) The limit on calls per second. Max value based on account service quota. Default value of `1`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Amazon Chime Voice Connector ID.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Chime Voice Connector Termination using the `voice_connector_id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Chime Voice Connector Termination using the `voice_connector_id`. For example:
+
+```console
+% terraform import aws_chime_voice_connector_termination.default abcdef1ghij2klmno3pqr4
+```
+
+<!-- cache-key: cdktf-0.18.0 input-9b91d0804f73c2e363dbd51b5e4d5f6a556c88d12ee33e47aece98cc8ef64a64 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/chime_voice_connector_termination_credentials.html.markdown b/website/docs/cdktf/python/r/chime_voice_connector_termination_credentials.html.markdown
new file mode 100644
index 00000000000..91ab1125f0e
--- /dev/null
+++ b/website/docs/cdktf/python/r/chime_voice_connector_termination_credentials.html.markdown
@@ -0,0 +1,100 @@
+---
+subcategory: "Chime"
+layout: "aws"
+page_title: "AWS: aws_chime_voice_connector_termination_credentials"
+description: |-
+    Adds termination SIP credentials for the specified Amazon Chime Voice Connector.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_chime_voice_connector_termination_credentials
+
+Adds termination SIP credentials for the specified Amazon Chime Voice Connector.
+
+~> **Note:** Voice Connector Termination Credentials requires a [Voice Connector Termination](/docs/providers/aws/r/chime_voice_connector_termination.html) to be present. Use of `depends_on` (as shown below) is recommended to avoid race conditions.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.chime_voice_connector import ChimeVoiceConnector
+from imports.aws.chime_voice_connector_termination import ChimeVoiceConnectorTermination
+from imports.aws.chime_voice_connector_termination_credentials import ChimeVoiceConnectorTerminationCredentials
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        default_var = ChimeVoiceConnector(self, "default",
+            name="test",
+            require_encryption=True
+        )
+        aws_chime_voice_connector_termination_default =
+        ChimeVoiceConnectorTermination(self, "default_1",
+            calling_regions=["US", "CA"],
+            cidr_allow_list=["50.35.78.96/31"],
+            cps_limit=1,
+            disabled=True,
+            voice_connector_id=default_var.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_chime_voice_connector_termination_default.override_logical_id("default")
+        aws_chime_voice_connector_termination_credentials_default =
+        ChimeVoiceConnectorTerminationCredentials(self, "default_2",
+            credentials=[ChimeVoiceConnectorTerminationCredentialsCredentials(
+                password="test!",
+                username="test"
+            )
+            ],
+            depends_on=[aws_chime_voice_connector_termination_default],
+            voice_connector_id=default_var.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_chime_voice_connector_termination_credentials_default.override_logical_id("default")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `voice_connector_id` - (Required) Amazon Chime Voice Connector ID.
+* `credentials` - (Required) List of termination SIP credentials.
+
+### `credentials`
+
+The SIP credentials used to authenticate requests to your Amazon Chime Voice Connector.
+
+* `username` - (Required) RFC2617 compliant username associated with the SIP credentials.
+* `password` - (Required) RFC2617 compliant password associated with the SIP credentials.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Amazon Chime Voice Connector ID.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Chime Voice Connector Termination Credentials using the `voice_connector_id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Chime Voice Connector Termination Credentials using the `voice_connector_id`. For example:
+
+```console
+% terraform import aws_chime_voice_connector_termination_credentials.default abcdef1ghij2klmno3pqr4
+```
+
+<!-- cache-key: cdktf-0.18.0 input-02b1a944fea362b1a923331d302d7f87fdfe8ec990e3008661b3af45d9ffd0c0 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/chimesdkmediapipelines_media_insights_pipeline_configuration.html.markdown b/website/docs/cdktf/python/r/chimesdkmediapipelines_media_insights_pipeline_configuration.html.markdown
new file mode 100644
index 00000000000..d39332fbac6
--- /dev/null
+++ b/website/docs/cdktf/python/r/chimesdkmediapipelines_media_insights_pipeline_configuration.html.markdown
@@ -0,0 +1,426 @@
+---
+subcategory: "Chime SDK Media Pipelines"
+layout: "aws"
+page_title: "AWS: aws_chimesdkmediapipelines_media_insights_pipeline_configuration"
+description: |-
+  Terraform resource for managing an AWS Chime SDK Media Pipelines Media Insights Pipeline Configuration.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_chimesdkmediapipelines_media_insights_pipeline_configuration
+
+Terraform resource for managing an AWS Chime SDK Media Pipelines Media Insights Pipeline Configuration.
+Consult the [Call analytics developer guide](https://docs.aws.amazon.com/chime-sdk/latest/dg/call-analytics.html) for more detailed information about usage.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.chimesdkmediapipelines_media_insights_pipeline_configuration import ChimesdkmediapipelinesMediaInsightsPipelineConfiguration
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.iam_role import IamRole
+from imports.aws.kinesis_stream import KinesisStream
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = KinesisStream(self, "example",
+            name="example",
+            shard_count=2
+        )
+        media_pipelines_assume_role = DataAwsIamPolicyDocument(self, "media_pipelines_assume_role",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["sts:AssumeRole"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["mediapipelines.chime.amazonaws.com"],
+                    type="Service"
+                )
+                ]
+            )
+            ]
+        )
+        call_analytics_role = IamRole(self, "call_analytics_role",
+            assume_role_policy=Token.as_string(media_pipelines_assume_role.json),
+            name="CallAnalyticsRole"
+        )
+        ChimesdkmediapipelinesMediaInsightsPipelineConfiguration(self, "my_configuration",
+            elements=[ChimesdkmediapipelinesMediaInsightsPipelineConfigurationElements(
+                amazon_transcribe_call_analytics_processor_configuration=ChimesdkmediapipelinesMediaInsightsPipelineConfigurationElementsAmazonTranscribeCallAnalyticsProcessorConfiguration(
+                    language_code="en-US"
+                ),
+                type="AmazonTranscribeCallAnalyticsProcessor"
+            ), ChimesdkmediapipelinesMediaInsightsPipelineConfigurationElements(
+                kinesis_data_stream_sink_configuration=ChimesdkmediapipelinesMediaInsightsPipelineConfigurationElementsKinesisDataStreamSinkConfiguration(
+                    insights_target=example.arn
+                ),
+                type="KinesisDataStreamSink"
+            )
+            ],
+            name="MyBasicConfiguration",
+            resource_access_role_arn=call_analytics_role.arn,
+            tags={
+                "Key1": "Value1",
+                "Key2": "Value2"
+            }
+        )
+```
+
+- The required policies on `call_analytics_role` will vary based on the selected processors. See [Call analytics resource access role](https://docs.aws.amazon.com/chime-sdk/latest/dg/ca-resource-access-role.html) for directions on choosing appropriate policies.
+
+### Transcribe Call Analytics processor usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.chimesdkmediapipelines_media_insights_pipeline_configuration import ChimesdkmediapipelinesMediaInsightsPipelineConfiguration
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.iam_role import IamRole
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        transcribe_assume_role = DataAwsIamPolicyDocument(self, "transcribe_assume_role",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["sts:AssumeRole"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["transcribe.amazonaws.com"],
+                    type="Service"
+                )
+                ]
+            )
+            ]
+        )
+        post_call_role = IamRole(self, "post_call_role",
+            assume_role_policy=Token.as_string(transcribe_assume_role.json),
+            name="PostCallAccessRole"
+        )
+        ChimesdkmediapipelinesMediaInsightsPipelineConfiguration(self, "my_configuration",
+            elements=[ChimesdkmediapipelinesMediaInsightsPipelineConfigurationElements(
+                amazon_transcribe_call_analytics_processor_configuration=ChimesdkmediapipelinesMediaInsightsPipelineConfigurationElementsAmazonTranscribeCallAnalyticsProcessorConfiguration(
+                    call_analytics_stream_categories=["category_1", "category_2"],
+                    content_redaction_type="PII",
+                    enable_partial_results_stabilization=True,
+                    filter_partial_results=True,
+                    language_code="en-US",
+                    language_model_name="MyLanguageModel",
+                    partial_results_stability="high",
+                    pii_entity_types="ADDRESS,BANK_ACCOUNT_NUMBER",
+                    post_call_analytics_settings=ChimesdkmediapipelinesMediaInsightsPipelineConfigurationElementsAmazonTranscribeCallAnalyticsProcessorConfigurationPostCallAnalyticsSettings(
+                        content_redaction_output="redacted",
+                        data_access_role_arn=post_call_role.arn,
+                        output_encryption_kms_key_id="MyKmsKeyId",
+                        output_location="s3://MyBucket"
+                    ),
+                    vocabulary_filter_method="mask",
+                    vocabulary_filter_name="MyVocabularyFilter",
+                    vocabulary_name="MyVocabulary"
+                ),
+                type="AmazonTranscribeCallAnalyticsProcessor"
+            ), ChimesdkmediapipelinesMediaInsightsPipelineConfigurationElements(
+                kinesis_data_stream_sink_configuration=ChimesdkmediapipelinesMediaInsightsPipelineConfigurationElementsKinesisDataStreamSinkConfiguration(
+                    insights_target=example.arn
+                ),
+                type="KinesisDataStreamSink"
+            )
+            ],
+            name="MyCallAnalyticsConfiguration",
+            resource_access_role_arn=Token.as_string(aws_iam_role_example.arn)
+        )
+```
+
+### Real time alerts usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.chimesdkmediapipelines_media_insights_pipeline_configuration import ChimesdkmediapipelinesMediaInsightsPipelineConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ChimesdkmediapipelinesMediaInsightsPipelineConfiguration(self, "my_configuration",
+            elements=[ChimesdkmediapipelinesMediaInsightsPipelineConfigurationElements(
+                amazon_transcribe_call_analytics_processor_configuration=ChimesdkmediapipelinesMediaInsightsPipelineConfigurationElementsAmazonTranscribeCallAnalyticsProcessorConfiguration(
+                    language_code="en-US"
+                ),
+                type="AmazonTranscribeCallAnalyticsProcessor"
+            ), ChimesdkmediapipelinesMediaInsightsPipelineConfigurationElements(
+                kinesis_data_stream_sink_configuration=ChimesdkmediapipelinesMediaInsightsPipelineConfigurationElementsKinesisDataStreamSinkConfiguration(
+                    insights_target=example.arn
+                ),
+                type="KinesisDataStreamSink"
+            )
+            ],
+            name="MyRealTimeAlertConfiguration",
+            real_time_alert_configuration=ChimesdkmediapipelinesMediaInsightsPipelineConfigurationRealTimeAlertConfiguration(
+                disabled=False,
+                rules=[ChimesdkmediapipelinesMediaInsightsPipelineConfigurationRealTimeAlertConfigurationRules(
+                    issue_detection_configuration=ChimesdkmediapipelinesMediaInsightsPipelineConfigurationRealTimeAlertConfigurationRulesIssueDetectionConfiguration(
+                        rule_name="MyIssueDetectionRule"
+                    ),
+                    type="IssueDetection"
+                ), ChimesdkmediapipelinesMediaInsightsPipelineConfigurationRealTimeAlertConfigurationRules(
+                    keyword_match_configuration=ChimesdkmediapipelinesMediaInsightsPipelineConfigurationRealTimeAlertConfigurationRulesKeywordMatchConfiguration(
+                        keywords=["keyword1", "keyword2"],
+                        negate=False,
+                        rule_name="MyKeywordMatchRule"
+                    ),
+                    type="KeywordMatch"
+                ), ChimesdkmediapipelinesMediaInsightsPipelineConfigurationRealTimeAlertConfigurationRules(
+                    sentiment_configuration=ChimesdkmediapipelinesMediaInsightsPipelineConfigurationRealTimeAlertConfigurationRulesSentimentConfiguration(
+                        rule_name="MySentimentRule",
+                        sentiment_type="NEGATIVE",
+                        time_period=60
+                    ),
+                    type="Sentiment"
+                )
+                ]
+            ),
+            resource_access_role_arn=call_analytics_role.arn
+        )
+```
+
+### Transcribe processor usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.chimesdkmediapipelines_media_insights_pipeline_configuration import ChimesdkmediapipelinesMediaInsightsPipelineConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ChimesdkmediapipelinesMediaInsightsPipelineConfiguration(self, "my_configuration",
+            elements=[ChimesdkmediapipelinesMediaInsightsPipelineConfigurationElements(
+                amazon_transcribe_processor_configuration=ChimesdkmediapipelinesMediaInsightsPipelineConfigurationElementsAmazonTranscribeProcessorConfiguration(
+                    content_identification_type="PII",
+                    enable_partial_results_stabilization=True,
+                    filter_partial_results=True,
+                    language_code="en-US",
+                    language_model_name="MyLanguageModel",
+                    partial_results_stability="high",
+                    pii_entity_types="ADDRESS,BANK_ACCOUNT_NUMBER",
+                    show_speaker_label=True,
+                    vocabulary_filter_method="mask",
+                    vocabulary_filter_name="MyVocabularyFilter",
+                    vocabulary_name="MyVocabulary"
+                ),
+                type="AmazonTranscribeProcessor"
+            ), ChimesdkmediapipelinesMediaInsightsPipelineConfigurationElements(
+                kinesis_data_stream_sink_configuration=ChimesdkmediapipelinesMediaInsightsPipelineConfigurationElementsKinesisDataStreamSinkConfiguration(
+                    insights_target=example.arn
+                ),
+                type="KinesisDataStreamSink"
+            )
+            ],
+            name="MyTranscribeConfiguration",
+            resource_access_role_arn=Token.as_string(aws_iam_role_example.arn)
+        )
+```
+
+### Voice analytics processor usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.chimesdkmediapipelines_media_insights_pipeline_configuration import ChimesdkmediapipelinesMediaInsightsPipelineConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ChimesdkmediapipelinesMediaInsightsPipelineConfiguration(self, "my_configuration",
+            elements=[ChimesdkmediapipelinesMediaInsightsPipelineConfigurationElements(
+                type="VoiceAnalyticsProcessor",
+                voice_analytics_processor_configuration=ChimesdkmediapipelinesMediaInsightsPipelineConfigurationElementsVoiceAnalyticsProcessorConfiguration(
+                    speaker_search_status="Enabled",
+                    voice_tone_analysis_status="Enabled"
+                )
+            ), ChimesdkmediapipelinesMediaInsightsPipelineConfigurationElements(
+                lambda_function_sink_configuration=ChimesdkmediapipelinesMediaInsightsPipelineConfigurationElementsLambdaFunctionSinkConfiguration(
+                    insights_target="arn:aws:lambda:us-west-2:1111111111:function:MyFunction"
+                ),
+                type="LambdaFunctionSink"
+            ), ChimesdkmediapipelinesMediaInsightsPipelineConfigurationElements(
+                sns_topic_sink_configuration=ChimesdkmediapipelinesMediaInsightsPipelineConfigurationElementsSnsTopicSinkConfiguration(
+                    insights_target="arn:aws:sns:us-west-2:1111111111:topic/MyTopic"
+                ),
+                type="SnsTopicSink"
+            ), ChimesdkmediapipelinesMediaInsightsPipelineConfigurationElements(
+                sqs_queue_sink_configuration=ChimesdkmediapipelinesMediaInsightsPipelineConfigurationElementsSqsQueueSinkConfiguration(
+                    insights_target="arn:aws:sqs:us-west-2:1111111111:queue/MyQueue"
+                ),
+                type="SqsQueueSink"
+            ), ChimesdkmediapipelinesMediaInsightsPipelineConfigurationElements(
+                kinesis_data_stream_sink_configuration=ChimesdkmediapipelinesMediaInsightsPipelineConfigurationElementsKinesisDataStreamSinkConfiguration(
+                    insights_target=test.arn
+                ),
+                type="KinesisDataStreamSink"
+            )
+            ],
+            name="MyVoiceAnalyticsConfiguration",
+            resource_access_role_arn=example.arn
+        )
+```
+
+### S3 Recording sink usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.chimesdkmediapipelines_media_insights_pipeline_configuration import ChimesdkmediapipelinesMediaInsightsPipelineConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ChimesdkmediapipelinesMediaInsightsPipelineConfiguration(self, "my_configuration",
+            elements=[ChimesdkmediapipelinesMediaInsightsPipelineConfigurationElements(
+                s3_recording_sink_configuration=ChimesdkmediapipelinesMediaInsightsPipelineConfigurationElementsS3RecordingSinkConfiguration(
+                    destination="arn:aws:s3:::MyBucket"
+                ),
+                type="S3RecordingSink"
+            )
+            ],
+            name="MyS3RecordingConfiguration",
+            resource_access_role_arn=example.arn
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) Configuration name.
+* `resource_access_role_arn` - (Required) ARN of IAM Role used by service to invoke processors and sinks specified by configuration elements.
+* `elements` - (Required) Collection of processors and sinks to transform media and deliver data.
+* `real_time_alert_configuration` - (Optional) Configuration for real-time alert rules to send EventBridge notifications when certain conditions are met.
+* `tags` - (Optional) Key-value map of tags for the resource.
+
+### Elements
+
+* `type` - (Required) Element type.
+* `amazon_transcribe_call_analytics_processor_configuration` - (Optional) Configuration for Amazon Transcribe Call Analytics processor.
+    * `call_analytics_stream_categories` - (Optional) Filter for category events to be delivered to insights target.
+    * `content_identification_type` - (Optional) Labels all personally identifiable information (PII) identified in Utterance events.
+    * `content_redaction_type` - (Optional) Redacts all personally identifiable information (PII) identified in Utterance events.
+    * `enable_partial_results_stabilization` - (Optional) Enables partial result stabilization in Utterance events.
+    * `filter_partial_results` - (Optional) Filters partial Utterance events from delivery to the insights target.
+    * `language_code` - (Required) Language code for the transcription model.
+    * `language_model_name` - (Optional) Name of custom language model for transcription.
+    * `partial_results_stability` - (Optional) Level of stability to use when partial results stabilization is enabled.
+    * `pii_entity_types` - (Optional) Types of personally identifiable information (PII) to redact from an Utterance event.
+    * `post_call_analytics_settings` - (Optional) Settings for post call analytics.
+        * `content_redaction_output` - (Optional) Should output be redacted.
+        * `data_access_role_arn` - (Required) ARN of the role used by AWS Transcribe to upload your post call analysis.
+        * `output_encryption_kms_key_id` - (Optional) ID of the KMS key used to encrypt the output.
+        * `output_location` - (Required) The Amazon S3 location where you want your Call Analytics post-call transcription output stored.
+    * `vocabulary_filter_method` - (Optional) Method for applying a vocabulary filter to Utterance events.
+    * `vocabulary_filter_name` - (Optional) Name of the custom vocabulary filter to use when processing Utterance events.
+    * `vocabulary_name` - (Optional) Name of the custom vocabulary to use when processing Utterance events.
+* `amazon_transcribe_processor_configuration` - (Optional) Configuration for Amazon Transcribe processor.
+    * `content_identification_type` - (Optional) Labels all personally identifiable information (PII) identified in Transcript events.
+    * `content_redaction_type` - (Optional) Redacts all personally identifiable information (PII) identified in Transcript events.
+    * `enable_partial_results_stabilization` - (Optional) Enables partial result stabilization in Transcript events.
+    * `filter_partial_results` - (Optional) Filters partial Utterance events from delivery to the insights target.
+    * `language_code` - (Required) Language code for the transcription model.
+    * `language_model_name` - (Optional) Name of custom language model for transcription.
+    * `partial_results_stability` - (Optional) Level of stability to use when partial results stabilization is enabled.
+    * `pii_entity_types` - (Optional) Types of personally identifiable information (PII) to redact from a Transcript event.
+    * `show_speaker_label` - (Optional) Enables speaker partitioning (diarization) in your Transcript events.
+    * `vocabulary_filter_method` - (Optional) Method for applying a vocabulary filter to Transcript events.
+    * `vocabulary_filter_name` - (Optional) Name of the custom vocabulary filter to use when processing Transcript events.
+    * `vocabulary_name` - (Optional) Name of the custom vocabulary to use when processing Transcript events.
+* `kinesis_data_stream_sink_configuration` - (Optional) Configuration for Kinesis Data Stream sink.
+    * `insights_target` - (Required) Kinesis Data Stream to deliver results.
+* `lambda_function_sink_configuration` - (Optional) Configuration for Lambda Function sink.
+    * `insights_target` - (Required) Lambda Function to deliver results.
+* `sns_topic_sink_configuration` - (Optional) Configuration for SNS Topic sink.
+    * `insights_target` - (Required) SNS topic to deliver results.
+* `sqs_queue_sink_configuration` - (Optional) Configuration for SQS Queue sink.
+    * `insights_target` - (Required) SQS queue to deliver results.
+* `s3_recording_sink_configuration` - (Optional) Configuration for S3 recording sink.
+    * `destination` - (Required) S3 URI to deliver recordings.
+* `voice_analytics_processor_configuration` - (Optional) Configuration for Voice analytics processor.
+    * `speaker_search_status` - (Required) Enable speaker search.
+    * `voice_tone_analysis_status` - (Required) Enable voice tone analysis.
+
+### Real time alert configuration
+
+* `rules` - (Required) Collection of real time alert rules
+    * `type` - (Required) Rule type.
+    * `issue_detection_configuration` - (Optional) Configuration for an issue detection rule.
+        * `rule_name` - (Required) Rule name.
+    * `keyword_match_configuration` - (Optional) Configuration for a keyword match rule.
+        * `rule_name` - (Required) Rule name.
+        * `keywords` - (Required) Collection of keywords to match.
+        * `negate` - (Optional) Negate the rule.
+    * `sentiment_configuration` - (Optional) Configuration for a sentiment rule.
+        * `rule_name` - (Required) Rule name.
+        * `sentiment_type` - (Required) Sentiment type to match.
+        * `time_period` - (Optional) Analysis interval.
+* `disabled` - (Optional) Disables real time alert rules.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Media Insights Pipeline Configuration.
+* `id` - Unique ID of the Media Insights Pipeline Configuration.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `3m`)
+* `update` - (Default `3m`)
+* `delete` - (Default `30s`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Chime SDK Media Pipelines Media Insights Pipeline Configuration using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Chime SDK Media Pipelines Media Insights Pipeline Configuration using the `id`. For example:
+
+```console
+% terraform import aws_chimesdkmediapipelines_media_insights_pipeline_configuration.example abcdef123456
+```
+
+<!-- cache-key: cdktf-0.18.0 input-e27c8cae132bb59224264ffd318670201dbde0c3fb71b0400db863d44cf5ecde -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/chimesdkvoice_global_settings.html.markdown b/website/docs/cdktf/python/r/chimesdkvoice_global_settings.html.markdown
new file mode 100644
index 00000000000..4e9c179400a
--- /dev/null
+++ b/website/docs/cdktf/python/r/chimesdkvoice_global_settings.html.markdown
@@ -0,0 +1,75 @@
+---
+subcategory: "Chime SDK Voice"
+layout: "aws"
+page_title: "AWS: aws_chimesdkvoice_global_settings"
+description: |-
+  Terraform resource for managing Amazon Chime SDK Voice Global Settings.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_chimesdkvoice_global_settings
+
+Terraform resource for managing Amazon Chime SDK Voice Global Settings.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.chimesdkvoice_global_settings import ChimesdkvoiceGlobalSettings
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ChimesdkvoiceGlobalSettings(self, "example",
+            voice_connector=ChimesdkvoiceGlobalSettingsVoiceConnector(
+                cdr_bucket="example-bucket-name"
+            )
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `voice_connector` - (Required) The Voice Connector settings. See [voice_connector](#voice_connector).
+
+### `voice_connector`
+
+The Amazon Chime SDK Voice Connector settings. Includes any Amazon S3 buckets designated for storing call detail records.
+
+* `cdr_bucket` - (Optional) The S3 bucket that stores the Voice Connector's call detail records.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - AWS account ID for which the settings are applied.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AWS Chime SDK Voice Global Settings using the `id` (AWS account ID). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import AWS Chime SDK Voice Global Settings using the `id` (AWS account ID). For example:
+
+```console
+% terraform import aws_chimesdkvoice_global_settings.example 123456789012
+```
+
+<!-- cache-key: cdktf-0.18.0 input-dd8eeed093a67a95ba6171329281d91e91a270a2747bca2d4eb8cc09920ff746 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/chimesdkvoice_sip_media_application.html.markdown b/website/docs/cdktf/python/r/chimesdkvoice_sip_media_application.html.markdown
new file mode 100644
index 00000000000..d73620418a1
--- /dev/null
+++ b/website/docs/cdktf/python/r/chimesdkvoice_sip_media_application.html.markdown
@@ -0,0 +1,85 @@
+---
+subcategory: "Chime SDK Voice"
+layout: "aws"
+page_title: "AWS: aws_chimesdkvoice_sip_media_application"
+description: |-
+  A ChimeSDKVoice SIP Media Application is a managed object that passes values from a SIP rule to a target AWS Lambda function.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_chimesdkvoice_sip_media_application
+
+A ChimeSDKVoice SIP Media Application is a managed object that passes values from a SIP rule to a target AWS Lambda function.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.chimesdkvoice_sip_media_application import ChimesdkvoiceSipMediaApplication
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ChimesdkvoiceSipMediaApplication(self, "example",
+            aws_region="us-east-1",
+            endpoints=ChimesdkvoiceSipMediaApplicationEndpoints(
+                lambda_arn=test.arn
+            ),
+            name="example-sip-media-application"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `aws_region` - (Required) The AWS Region in which the AWS Chime SDK Voice Sip Media Application is created.
+* `endpoints` - (Required)  List of endpoints (Lambda Amazon Resource Names) specified for the SIP media application. Currently, only one endpoint is supported. See [`endpoints`](#endpoints).
+* `name` - (Required) The name of the AWS Chime SDK Voice Sip Media Application.
+
+The following arguments are optional:
+
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### `endpoints`
+
+The endpoint assigned to the SIP media application.
+
+* `lambda_arn` - (Required) Valid Amazon Resource Name (ARN) of the Lambda function, version, or alias. The function must be created in the same AWS Region as the SIP media application.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` -  ARN (Amazon Resource Name) of the AWS Chime SDK Voice Sip Media Application
+* `id` - The SIP media application ID.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import a ChimeSDKVoice SIP Media Application using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import a ChimeSDKVoice SIP Media Application using the `id`. For example:
+
+```console
+% terraform import aws_chimesdkvoice_sip_media_application.example abcdef123456
+```
+
+<!-- cache-key: cdktf-0.18.0 input-e1b6072f4d998c9e513ec72230b13fe8b463d6b65adffbd9a34c66c4336e5e88 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/chimesdkvoice_sip_rule.html.markdown b/website/docs/cdktf/python/r/chimesdkvoice_sip_rule.html.markdown
new file mode 100644
index 00000000000..82fa31cbe05
--- /dev/null
+++ b/website/docs/cdktf/python/r/chimesdkvoice_sip_rule.html.markdown
@@ -0,0 +1,89 @@
+---
+subcategory: "Chime SDK Voice"
+layout: "aws"
+page_title: "AWS: aws_chimesdkvoice_sip_rule"
+description: |-
+    A SIP rule associates your SIP media application with a phone number or a Request URI hostname. You can associate a SIP rule with more than one SIP media application. Each application then runs only that rule.
+---
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_chimesdkvoice_sip_rule
+
+A SIP rule associates your SIP media application with a phone number or a Request URI hostname. You can associate a SIP rule with more than one SIP media application. Each application then runs only that rule.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.chimesdkvoice_sip_rule import ChimesdkvoiceSipRule
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ChimesdkvoiceSipRule(self, "example",
+            name="example-sip-rule",
+            target_applications=[ChimesdkvoiceSipRuleTargetApplications(
+                aws_region="us-east-1",
+                priority=1,
+                sip_media_application_id=example_sma.id
+            )
+            ],
+            trigger_type="RequestUriHostname",
+            trigger_value=example_voice_connector.outbound_host_name
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) The name of the SIP rule.
+* `target_applications` - (Required) List of SIP media applications with priority and AWS Region. Only one SIP application per AWS Region can be used. See [`target_applications`](#target_applications).
+* `trigger_type` - (Required) The type of trigger assigned to the SIP rule in `trigger_value`. Valid values are `RequestUriHostname` or `ToPhoneNumber`.
+* `trigger_value` - (Required) If `trigger_type` is `RequestUriHostname`, the value can be the outbound host name of an Amazon Chime Voice Connector. If `trigger_type` is `ToPhoneNumber`, the value can be a customer-owned phone number in the E164 format. The Sip Media Application specified in the Sip Rule is triggered if the request URI in an incoming SIP request matches the `RequestUriHostname`, or if the "To" header in the incoming SIP request matches the `ToPhoneNumber` value.
+
+The following arguments are optional:
+
+* `disabled` - (Optional) Enables or disables a rule. You must disable rules before you can delete them.
+
+### `target_applications`
+
+List of SIP media applications with priority and AWS Region. Only one SIP application per AWS Region can be used.
+
+* `aws_region` - (Required) The AWS Region of the target application.
+* `priority` - (Required) Priority of the SIP media application in the target list.
+* `sip_media_application_id` - (Required) The SIP media application ID.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The SIP rule ID.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import a ChimeSDKVoice SIP Rule using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import a ChimeSDKVoice SIP Rule using the `id`. For example:
+
+```console
+% terraform import aws_chimesdkvoice_sip_rule.example abcdef123456
+```
+
+<!-- cache-key: cdktf-0.18.0 input-3475b0a57a4be526a5e2626982a1ad5155fe2cd8afc53724a14c23471b5a6ff8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/chimesdkvoice_voice_profile_domain.html.markdown b/website/docs/cdktf/python/r/chimesdkvoice_voice_profile_domain.html.markdown
new file mode 100644
index 00000000000..a647e633f80
--- /dev/null
+++ b/website/docs/cdktf/python/r/chimesdkvoice_voice_profile_domain.html.markdown
@@ -0,0 +1,97 @@
+---
+subcategory: "Chime SDK Voice"
+layout: "aws"
+page_title: "AWS: aws_chimesdkvoice_voice_profile_domain"
+description: |-
+  Terraform resource for managing an AWS Chime SDK Voice Profile Domain.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_chimesdkvoice_voice_profile_domain
+
+Terraform resource for managing an AWS Chime SDK Voice Profile Domain.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.chimesdkvoice_voice_profile_domain import ChimesdkvoiceVoiceProfileDomain
+from imports.aws.kms_key import KmsKey
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = KmsKey(self, "example",
+            deletion_window_in_days=7,
+            description="KMS Key for Voice Profile Domain"
+        )
+        aws_chimesdkvoice_voice_profile_domain_example =
+        ChimesdkvoiceVoiceProfileDomain(self, "example_1",
+            description="My Voice Profile Domain",
+            name="ExampleVoiceProfileDomain",
+            server_side_encryption_configuration=ChimesdkvoiceVoiceProfileDomainServerSideEncryptionConfiguration(
+                kms_key_arn=example.arn
+            ),
+            tags={
+                "key1": "value1"
+            }
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_chimesdkvoice_voice_profile_domain_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) Name of Voice Profile Domain.
+* `server_side_encryption_configuration` - (Required) Configuration for server side encryption.
+    * `kms_key_arn` - (Required) ARN for KMS Key.
+
+The following arguments are optional:
+
+* `description` - (Optional) Description of Voice Profile Domain.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Voice Profile Domain.
+* `id` - ID of the Voice Profile Domain.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `30s`)
+* `update` - (Default `30s`)
+* `delete` - (Default `30s`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AWS Chime SDK Voice Profile Domain using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import AWS Chime SDK Voice Profile Domain using the `id`. For example:
+
+```console
+% terraform import aws_chimesdkvoice_voice_profile_domain.example abcdef123456
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1ed3340a6d443b0bc7304eeda785a30b45ce4604e81681eebd0a62911c653c94 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/cleanrooms_collaboration.html.markdown b/website/docs/cdktf/python/r/cleanrooms_collaboration.html.markdown
new file mode 100644
index 00000000000..d43083ddfe6
--- /dev/null
+++ b/website/docs/cdktf/python/r/cleanrooms_collaboration.html.markdown
@@ -0,0 +1,118 @@
+---
+subcategory: "Clean Rooms"
+layout: "aws"
+page_title: "AWS: aws_cleanrooms_collaboration"
+description: |-
+  Provides a Clean Rooms Collaboration.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cleanrooms_collaboration
+
+Provides a AWS Clean Rooms collaboration.  All members included in the definition will be invited to
+join the collaboration and can create memberships.
+
+## Example Usage
+
+### Collaboration with tags
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cleanrooms_collaboration import CleanroomsCollaboration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, memberAbilities):
+        super().__init__(scope, name)
+        CleanroomsCollaboration(self, "test_collaboration",
+            creator_display_name="Creator ",
+            creator_member_abilities=["CAN_QUERY", "CAN_RECEIVE_RESULTS"],
+            data_encryption_metadata=CleanroomsCollaborationDataEncryptionMetadata(
+                allow_clear_text=True,
+                allow_duplicates=True,
+                allow_joins_on_columns_with_different_names=True,
+                preserve_nulls=False
+            ),
+            description="I made this collaboration with terraform!",
+            member=[CleanroomsCollaborationMember(
+                account_id=Token.as_string(123456789012),
+                display_name="Other member",
+                member_abilities=member_abilities
+            )
+            ],
+            name="terraform-example-collaboration",
+            query_log_status="DISABLED",
+            tags={
+                "Project": "Terraform"
+            }
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) - The name of the collaboration.  Collaboration names do not need to be unique.
+* `description` - (Required) - A description for a collaboration.
+* `creator_member_abilities` - (Required - Forces new resource) - The list of member abilities for the creator of the collaboration.  Valid values [may be found here](https://docs.aws.amazon.com/clean-rooms/latest/apireference/API_CreateCollaboration.html#API-CreateCollaboration-request-creatorMemberAbilities).
+* `creator_display_name` - (Required - Forces new resource) - The name for the member record for the collaboration creator.
+* `query_log_status` - (Required - Forces new resource) - Determines if members of the collaboration can enable query logs within their own.
+emberships. Valid values [may be found here](https://docs.aws.amazon.com/clean-rooms/latest/apireference/API_CreateCollaboration.html#API-CreateCollaboration-request-queryLogStatus).
+* `data_encryption_metadata` - (Required - Forces new resource) - a collection of settings which determine how the [c3r client](https://docs.aws.amazon.com/clean-rooms/latest/userguide/crypto-computing.html) will encrypt data for use within this collaboration.
+* `data_encryption_metadata.allow_clear_text` - (Required - Forces new resource) - Indicates whether encrypted tables can contain cleartext data. This is a boolea
+ field.
+* `data_encryption_metadata.allow_duplicates` - (Required - Forces new resource ) - Indicates whether Fingerprint columns can contain duplicate entries. This is a
+boolean field.
+* `data_encryption_metadata.allow_joins_on_columns_with_different_names` - (Required - Forces new resource) - Indicates whether Fingerprint columns can be joined
+n any other Fingerprint column with a different name. This is a boolean field.
+* `data_encryption_metadata.preserve_nulls` - (Required - Forces new resource) - Indicates whether NULL values are to be copied as NULL to encrypted tables (true)
+or cryptographically processed (false).
+* `member` - (Optional - Forces new resource) - Additional members of the collaboration which will be invited to join the collaboration.
+* `member.account_id` - (Required - Forces new resource) - The account id for the invited member.
+* `member.display_name` - (Required - Forces new resource) - The display name for the invited member.
+* `member.member_abilities` - (Required - Forces new resource) - The list of abilities for the invited member. Valid values [may be found here](https://docs.aws.amazon.com/clean-rooms/latest/apireference/API_CreateCollaboration.html#API-CreateCollaboration-request-creatorMemberAbilities).
+* `tags` - (Optional) - Key value pairs which tag the collaboration.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The arn of the collaboration.
+* `id` - The id of the collaboration.
+* `create_time` - The date and time the collaboration was created.
+* `member status` - For each member included in the collaboration an additional computed attribute of status is added. These values [may be found here](https://docs.aws.amazon.com/clean-rooms/latest/apireference/API_MemberSummary.html#API-Type-MemberSummary-status).
+* `updated_time` - The date and time the collaboration was last updated.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `1m`)
+- `update` - (Default `1m`)
+- `delete` - (Default `1m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_cleanrooms_collaboration` using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_cleanrooms_collaboration` using the `id`. For example:
+
+```console
+% terraform import aws_cleanrooms_collaboration.collaboration 1234abcd-12ab-34cd-56ef-1234567890ab
+```
+
+<!-- cache-key: cdktf-0.18.0 input-395ee6487e82b1be6f52fee6f12058bc05b7b0fad6b5632c7701a3893516718e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/cleanrooms_configured_table.html.markdown b/website/docs/cdktf/python/r/cleanrooms_configured_table.html.markdown
new file mode 100644
index 00000000000..56a82550c36
--- /dev/null
+++ b/website/docs/cdktf/python/r/cleanrooms_configured_table.html.markdown
@@ -0,0 +1,95 @@
+---
+subcategory: "Clean Rooms"
+layout: "aws"
+page_title: "AWS: aws_cleanrooms_configured_table"
+description: |-
+  Provides a Clean Rooms Configured Table.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cleanrooms_configured_table
+
+Provides a AWS Clean Rooms configured table. Configured tables are used to represent references to existing tables in the AWS Glue Data Catalog.
+
+## Example Usage
+
+### Configured table with tags
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cleanrooms_configured_table import CleanroomsConfiguredTable
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        CleanroomsConfiguredTable(self, "test_configured_table",
+            allowed_columns=["column1", "column2", "column3"],
+            analysis_method="DIRECT_QUERY",
+            description="I made this table with terraform!",
+            name="terraform-example-table",
+            table_reference=CleanroomsConfiguredTableTableReference(
+                database_name="example_database",
+                table_name="example_table"
+            ),
+            tags={
+                "Project": "Terraform"
+            }
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) - The name of the configured table.
+* `description` - (Optional) - A description for the configured table.
+* `analysis_method` - (Required) - The analysis method for the configured table. The only valid value is currently `DIRECT_QUERY`.
+* `allowed_columns` - (Required - Forces new resource) - The columns of the references table which will be included in the configured table.
+* `table_reference` - (Required - Forces new resource) - A reference to the AWS Glue table which will be used to create the configured table.
+* `table_reference.database_name` - (Required - Forces new resource) - The name of the AWS Glue database which contains the table.
+* `table_reference.table_name` - (Required - Forces new resource) - The name of the AWS Glue table which will be used to create the configured table.
+* `tags` - (Optional) - Key value pairs which tag the configured table.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the configured table.
+* `id` - The ID of the configured table.
+* `create_time` - The date and time the configured table was created.
+* `update_time` - The date and time the configured table was last updated.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `1m`)
+- `update` - (Default `1m`)
+- `delete` - (Default `1m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_cleanrooms_configured_table` using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_cleanrooms_configured_table` using the `id`. For example:
+
+```console
+% terraform import aws_cleanrooms_configured_table.table 1234abcd-12ab-34cd-56ef-1234567890ab
+```
+
+<!-- cache-key: cdktf-0.18.0 input-453a78d0a031324d090ad2bc765ccc4d2f1ec41c65c0d162ac12a0a01d1fb07d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/cloud9_environment_ec2.html.markdown b/website/docs/cdktf/python/r/cloud9_environment_ec2.html.markdown
new file mode 100644
index 00000000000..1e705d2b08f
--- /dev/null
+++ b/website/docs/cdktf/python/r/cloud9_environment_ec2.html.markdown
@@ -0,0 +1,136 @@
+---
+subcategory: "Cloud9"
+layout: "aws"
+page_title: "AWS: aws_cloud9_environment_ec2"
+description: |-
+  Provides a Cloud9 EC2 Development Environment.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloud9_environment_ec2
+
+Provides a Cloud9 EC2 Development Environment.
+
+## Example Usage
+
+Basic usage:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloud9_environment_ec2 import Cloud9EnvironmentEc2
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Cloud9EnvironmentEc2(self, "example",
+            instance_type="t2.micro",
+            name="example-env"
+        )
+```
+
+Get the URL of the Cloud9 environment after creation:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformOutput, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloud9_environment_ec2 import Cloud9EnvironmentEc2
+from imports.aws.data_aws_instance import DataAwsInstance
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, name):
+        super().__init__(scope, name)
+        example = Cloud9EnvironmentEc2(self, "example",
+            instance_type="t2.micro",
+            name=name
+        )
+        DataAwsInstance(self, "cloud9_instance",
+            filter=[DataAwsInstanceFilter(
+                name="tag:aws:cloud9:environment",
+                values=[example.id]
+            )
+            ]
+        )
+        TerraformOutput(self, "cloud9_url",
+            value="https://${" + region.value + "}.console.aws.amazon.com/cloud9/ide/${" + example.id + "}"
+        )
+```
+
+Allocate a static IP to the Cloud9 environment:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformOutput, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloud9_environment_ec2 import Cloud9EnvironmentEc2
+from imports.aws.data_aws_instance import DataAwsInstance
+from imports.aws.eip import Eip
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, name):
+        super().__init__(scope, name)
+        example = Cloud9EnvironmentEc2(self, "example",
+            instance_type="t2.micro",
+            name=name
+        )
+        cloud9_instance = DataAwsInstance(self, "cloud9_instance",
+            filter=[DataAwsInstanceFilter(
+                name="tag:aws:cloud9:environment",
+                values=[example.id]
+            )
+            ]
+        )
+        cloud9_eip = Eip(self, "cloud9_eip",
+            domain="vpc",
+            instance=Token.as_string(cloud9_instance.id)
+        )
+        TerraformOutput(self, "cloud9_public_ip",
+            value=cloud9_eip.public_ip
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the environment.
+* `instance_type` - (Required) The type of instance to connect to the environment, e.g., `t2.micro`.
+* `automatic_stop_time_minutes` - (Optional) The number of minutes until the running instance is shut down after the environment has last been used.
+* `connection_type` - (Optional) The connection type used for connecting to an Amazon EC2 environment. Valid values are `CONNECT_SSH` and `CONNECT_SSM`. For more information please refer [AWS documentation for Cloud9](https://docs.aws.amazon.com/cloud9/latest/user-guide/ec2-ssm.html).
+* `description` - (Optional) The description of the environment.
+* `image_id` - (Optional) The identifier for the Amazon Machine Image (AMI) that's used to create the EC2 instance. Valid values are
+    * `amazonlinux-1-x86_64`
+    * `amazonlinux-2-x86_64`
+    * `ubuntu-18.04-x86_64`
+    * `ubuntu-22.04-x86_64`
+    * `resolve:ssm:/aws/service/cloud9/amis/amazonlinux-1-x86_64`
+    * `resolve:ssm:/aws/service/cloud9/amis/amazonlinux-2-x86_64`
+    * `resolve:ssm:/aws/service/cloud9/amis/ubuntu-18.04-x86_64`
+    * `resolve:ssm:/aws/service/cloud9/amis/ubuntu-22.04-x86_64`
+
+* `owner_arn` - (Optional) The ARN of the environment owner. This can be ARN of any AWS IAM principal. Defaults to the environment's creator.
+* `subnet_id` - (Optional) The ID of the subnet in Amazon VPC that AWS Cloud9 will use to communicate with the Amazon EC2 instance.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the environment.
+* `arn` - The ARN of the environment.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `type` - The type of the environment (e.g., `ssh` or `ec2`)
+
+<!-- cache-key: cdktf-0.18.0 input-0a7b7bb4db1f7b69891ee6f0c3a4d079fd3d0b45f3d6b81be48656fbea075db1 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/cloud9_environment_membership.html.markdown b/website/docs/cdktf/python/r/cloud9_environment_membership.html.markdown
new file mode 100644
index 00000000000..32201636615
--- /dev/null
+++ b/website/docs/cdktf/python/r/cloud9_environment_membership.html.markdown
@@ -0,0 +1,83 @@
+---
+subcategory: "Cloud9"
+layout: "aws"
+page_title: "AWS: aws_cloud9_environment_membership"
+description: |-
+  Provides an environment member to an AWS Cloud9 development environment.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloud9_environment_membership
+
+Provides an environment member to an AWS Cloud9 development environment.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloud9_environment_ec2 import Cloud9EnvironmentEc2
+from imports.aws.cloud9_environment_membership import Cloud9EnvironmentMembership
+from imports.aws.iam_user import IamUser
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        test = Cloud9EnvironmentEc2(self, "test",
+            instance_type="t2.micro",
+            name="some-env"
+        )
+        aws_iam_user_test = IamUser(self, "test_1",
+            name="some-user"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_user_test.override_logical_id("test")
+        aws_cloud9_environment_membership_test = Cloud9EnvironmentMembership(self, "test_2",
+            environment_id=test.id,
+            permissions="read-only",
+            user_arn=Token.as_string(aws_iam_user_test.arn)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_cloud9_environment_membership_test.override_logical_id("test")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `environment_id` - (Required) The ID of the environment that contains the environment member you want to add.
+* `permissions` - (Required) The type of environment member permissions you want to associate with this environment member. Allowed values are `read-only` and `read-write` .
+* `user_arn` - (Required) The Amazon Resource Name (ARN) of the environment member you want to add.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the environment membership.
+* `user_id` - he user ID in AWS Identity and Access Management (AWS IAM) of the environment member.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Cloud9 environment membership using the `environment-id#user-arn`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Cloud9 environment membership using the `environment-id#user-arn`. For example:
+
+```console
+% terraform import aws_cloud9_environment_membership.test environment-id#user-arn
+```
+
+<!-- cache-key: cdktf-0.18.0 input-10e00164fec66c387e4ef6582684bf8de89732c31df86387c3215daa6335723f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/cloud9_environment_membership.markdown b/website/docs/cdktf/python/r/cloud9_environment_membership.markdown
new file mode 100644
index 00000000000..32201636615
--- /dev/null
+++ b/website/docs/cdktf/python/r/cloud9_environment_membership.markdown
@@ -0,0 +1,83 @@
+---
+subcategory: "Cloud9"
+layout: "aws"
+page_title: "AWS: aws_cloud9_environment_membership"
+description: |-
+  Provides an environment member to an AWS Cloud9 development environment.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloud9_environment_membership
+
+Provides an environment member to an AWS Cloud9 development environment.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloud9_environment_ec2 import Cloud9EnvironmentEc2
+from imports.aws.cloud9_environment_membership import Cloud9EnvironmentMembership
+from imports.aws.iam_user import IamUser
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        test = Cloud9EnvironmentEc2(self, "test",
+            instance_type="t2.micro",
+            name="some-env"
+        )
+        aws_iam_user_test = IamUser(self, "test_1",
+            name="some-user"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_user_test.override_logical_id("test")
+        aws_cloud9_environment_membership_test = Cloud9EnvironmentMembership(self, "test_2",
+            environment_id=test.id,
+            permissions="read-only",
+            user_arn=Token.as_string(aws_iam_user_test.arn)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_cloud9_environment_membership_test.override_logical_id("test")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `environment_id` - (Required) The ID of the environment that contains the environment member you want to add.
+* `permissions` - (Required) The type of environment member permissions you want to associate with this environment member. Allowed values are `read-only` and `read-write` .
+* `user_arn` - (Required) The Amazon Resource Name (ARN) of the environment member you want to add.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the environment membership.
+* `user_id` - he user ID in AWS Identity and Access Management (AWS IAM) of the environment member.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Cloud9 environment membership using the `environment-id#user-arn`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Cloud9 environment membership using the `environment-id#user-arn`. For example:
+
+```console
+% terraform import aws_cloud9_environment_membership.test environment-id#user-arn
+```
+
+<!-- cache-key: cdktf-0.18.0 input-10e00164fec66c387e4ef6582684bf8de89732c31df86387c3215daa6335723f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/cloudcontrolapi_resource.html.markdown b/website/docs/cdktf/python/r/cloudcontrolapi_resource.html.markdown
new file mode 100644
index 00000000000..94a8ef32e06
--- /dev/null
+++ b/website/docs/cdktf/python/r/cloudcontrolapi_resource.html.markdown
@@ -0,0 +1,62 @@
+---
+subcategory: "Cloud Control API"
+layout: "aws"
+page_title: "AWS: aws_cloudcontrolapi_resource"
+description: |-
+    Manages a Cloud Control API Resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudcontrolapi_resource
+
+Manages a Cloud Control API Resource. The configuration and lifecycle handling of these resources is proxied through Cloud Control API handlers to the backend service.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudcontrolapi_resource import CloudcontrolapiResource
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        CloudcontrolapiResource(self, "example",
+            desired_state=Token.as_string(
+                Fn.jsonencode({
+                    "ClusterName": "example",
+                    "Tags": [{
+                        "Key": "CostCenter",
+                        "Value": "IT"
+                    }
+                    ]
+                })),
+            type_name="AWS::ECS::Cluster"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `desired_state` - (Required) JSON string matching the CloudFormation resource type schema with desired configuration. Terraform configuration expressions can be converted into JSON using the [`jsonencode()` function](https://www.terraform.io/docs/language/functions/jsonencode.html).
+* `type_name` - (Required) CloudFormation resource type name. For example, `AWS::EC2::VPC`.
+
+The following arguments are optional:
+
+* `role_arn` - (Optional) Amazon Resource Name (ARN) of the IAM Role to assume for operations.
+* `schema` - (Optional) JSON string of the CloudFormation resource type schema which is used for plan time validation where possible. Automatically fetched if not provided. In large scale environments with multiple resources using the same `type_name`, it is recommended to fetch the schema once via the [`aws_cloudformation_type` data source](/docs/providers/aws/d/cloudformation_type.html) and use this argument to reduce `DescribeType` API operation throttling. This value is marked sensitive only to prevent large plan differences from showing.
+* `type_version_id` - (Optional) Identifier of the CloudFormation resource type version.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `properties` - JSON string matching the CloudFormation resource type schema with current configuration. Underlying attributes can be referenced via the [`jsondecode()` function](https://www.terraform.io/docs/language/functions/jsondecode.html), for example, `jsondecode(data.aws_cloudcontrolapi_resource.example.properties)["example"]`.
+
+<!-- cache-key: cdktf-0.18.0 input-cf513e77c3363383fd47f2e480126cd6439d06b2a5ae773b5b9401ac9b353ec6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/cloudformation_stack.html.markdown b/website/docs/cdktf/python/r/cloudformation_stack.html.markdown
new file mode 100644
index 00000000000..c7685bde994
--- /dev/null
+++ b/website/docs/cdktf/python/r/cloudformation_stack.html.markdown
@@ -0,0 +1,120 @@
+---
+subcategory: "CloudFormation"
+layout: "aws"
+page_title: "AWS: aws_cloudformation_stack"
+description: |-
+  Provides a CloudFormation Stack resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudformation_stack
+
+Provides a CloudFormation Stack resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudformation_stack import CloudformationStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        CloudformationStack(self, "network",
+            name="networking-stack",
+            parameters={
+                "VPCCidr": "10.0.0.0/16"
+            },
+            template_body=Token.as_string(
+                Fn.jsonencode({
+                    "Parameters": {
+                        "VPCCidr": {
+                            "Default": "10.0.0.0/16",
+                            "Description": "Enter the CIDR block for the VPC. Default is 10.0.0.0/16.",
+                            "Type": "String"
+                        }
+                    },
+                    "Resources": {
+                        "my_vpc": {
+                            "Properties": {
+                                "CidrBlock": {
+                                    "Ref": "VPCCidr"
+                                },
+                                "Tags": [{
+                                    "Key": "Name",
+                                    "Value": "Primary_CF_VPC"
+                                }
+                                ]
+                            },
+                            "Type": "AWS::EC2::VPC"
+                        }
+                    }
+                }))
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) Stack name.
+* `template_body` - (Optional) Structure containing the template body (max size: 51,200 bytes).
+* `template_url` - (Optional) Location of a file containing the template body (max size: 460,800 bytes).
+* `capabilities` - (Optional) A list of capabilities.
+  Valid values: `CAPABILITY_IAM`, `CAPABILITY_NAMED_IAM`, or `CAPABILITY_AUTO_EXPAND`
+* `disable_rollback` - (Optional) Set to true to disable rollback of the stack if stack creation failed.
+  Conflicts with `on_failure`.
+* `notification_arns` - (Optional) A list of SNS topic ARNs to publish stack related events.
+* `on_failure` - (Optional) Action to be taken if stack creation fails. This must be
+  one of: `DO_NOTHING`, `ROLLBACK`, or `DELETE`. Conflicts with `disable_rollback`.
+* `parameters` - (Optional) A map of Parameter structures that specify input parameters for the stack.
+* `policy_body` - (Optional) Structure containing the stack policy body.
+  Conflicts w/ `policy_url`.
+* `policy_url` - (Optional) Location of a file containing the stack policy.
+  Conflicts w/ `policy_body`.
+* `tags` - (Optional) Map of resource tags to associate with this stack. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `iam_role_arn` - (Optional) The ARN of an IAM role that AWS CloudFormation assumes to create the stack. If you don't specify a value, AWS CloudFormation uses the role that was previously associated with the stack. If no role is available, AWS CloudFormation uses a temporary session that is generated from your user credentials.
+* `timeout_in_minutes` - (Optional) The amount of time that can pass before the stack status becomes `CREATE_FAILED`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - A unique identifier of the stack.
+* `outputs` - A map of outputs from the stack.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `30m`)
+- `update` - (Default `30m`)
+- `delete` - (Default `30m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Cloudformation Stacks using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Cloudformation Stacks using the `name`. For example:
+
+```console
+% terraform import aws_cloudformation_stack.stack networking-stack
+```
+
+<!-- cache-key: cdktf-0.18.0 input-c53bfbdca12c0eaf80e8a2eed58d9aa3dfa199b8365b1dbcd91c0ab7688d53d5 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/cloudformation_stack_set.html.markdown b/website/docs/cdktf/python/r/cloudformation_stack_set.html.markdown
new file mode 100644
index 00000000000..c8084b54297
--- /dev/null
+++ b/website/docs/cdktf/python/r/cloudformation_stack_set.html.markdown
@@ -0,0 +1,189 @@
+---
+subcategory: "CloudFormation"
+layout: "aws"
+page_title: "AWS: aws_cloudformation_stack_set"
+description: |-
+  Manages a CloudFormation StackSet.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudformation_stack_set
+
+Manages a CloudFormation StackSet. StackSets allow CloudFormation templates to be easily deployed across multiple accounts and regions via StackSet Instances ([`aws_cloudformation_stack_set_instance` resource](/docs/providers/aws/r/cloudformation_stack_set_instance.html)). Additional information about StackSets can be found in the [AWS CloudFormation User Guide](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/what-is-cfnstacksets.html).
+
+~> **NOTE:** All template parameters, including those with a `Default`, must be configured or ignored with the `lifecycle` configuration block `ignore_changes` argument.
+
+~> **NOTE:** All `NoEcho` template parameters must be ignored with the `lifecycle` configuration block `ignore_changes` argument.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, Fn, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudformation_stack_set import CloudformationStackSet
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.iam_role import IamRole
+from imports.aws.iam_role_policy import IamRolePolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        aws_cloud_formation_stack_set_administration_role_assume_role_policy =
+        DataAwsIamPolicyDocument(self, "AWSCloudFormationStackSetAdministrationRole_assume_role_policy",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["sts:AssumeRole"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["cloudformation.amazonaws.com"],
+                    type="Service"
+                )
+                ]
+            )
+            ]
+        )
+        aws_cloud_formation_stack_set_administration_role = IamRole(self, "AWSCloudFormationStackSetAdministrationRole",
+            assume_role_policy=Token.as_string(aws_cloud_formation_stack_set_administration_role_assume_role_policy.json),
+            name="AWSCloudFormationStackSetAdministrationRole"
+        )
+        example = CloudformationStackSet(self, "example",
+            administration_role_arn=aws_cloud_formation_stack_set_administration_role.arn,
+            name="example",
+            parameters={
+                "VPCCidr": "10.0.0.0/16"
+            },
+            template_body=Token.as_string(
+                Fn.jsonencode({
+                    "Parameters": {
+                        "VPCCidr": {
+                            "Default": "10.0.0.0/16",
+                            "Description": "Enter the CIDR block for the VPC. Default is 10.0.0.0/16.",
+                            "Type": "String"
+                        }
+                    },
+                    "Resources": {
+                        "my_vpc": {
+                            "Properties": {
+                                "CidrBlock": {
+                                    "Ref": "VPCCidr"
+                                },
+                                "Tags": [{
+                                    "Key": "Name",
+                                    "Value": "Primary_CF_VPC"
+                                }
+                                ]
+                            },
+                            "Type": "AWS::EC2::VPC"
+                        }
+                    }
+                }))
+        )
+        aws_cloud_formation_stack_set_administration_role_execution_policy =
+        DataAwsIamPolicyDocument(self, "AWSCloudFormationStackSetAdministrationRole_ExecutionPolicy",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["sts:AssumeRole"],
+                effect="Allow",
+                resources=["arn:aws:iam::*:role/${" + example.execution_role_name + "}"
+                ]
+            )
+            ]
+        )
+        aws_iam_role_policy_aws_cloud_formation_stack_set_administration_role_execution_policy =
+        IamRolePolicy(self, "AWSCloudFormationStackSetAdministrationRole_ExecutionPolicy_4",
+            name="ExecutionPolicy",
+            policy=Token.as_string(aws_cloud_formation_stack_set_administration_role_execution_policy.json),
+            role=aws_cloud_formation_stack_set_administration_role.name
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_role_policy_aws_cloud_formation_stack_set_administration_role_execution_policy.override_logical_id("AWSCloudFormationStackSetAdministrationRole_ExecutionPolicy")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `administration_role_arn` - (Optional) Amazon Resource Number (ARN) of the IAM Role in the administrator account. This must be defined when using the `SELF_MANAGED` permission model.
+* `auto_deployment` - (Optional) Configuration block containing the auto-deployment model for your StackSet. This can only be defined when using the `SERVICE_MANAGED` permission model.
+    * `enabled` - (Optional) Whether or not auto-deployment is enabled.
+    * `retain_stacks_on_account_removal` - (Optional) Whether or not to retain stacks when the account is removed.
+* `name` - (Required) Name of the StackSet. The name must be unique in the region where you create your StackSet. The name can contain only alphanumeric characters (case-sensitive) and hyphens. It must start with an alphabetic character and cannot be longer than 128 characters.
+* `capabilities` - (Optional) A list of capabilities. Valid values: `CAPABILITY_IAM`, `CAPABILITY_NAMED_IAM`, `CAPABILITY_AUTO_EXPAND`.
+* `operation_preferences` - (Optional) Preferences for how AWS CloudFormation performs a stack set update.
+* `description` - (Optional) Description of the StackSet.
+* `execution_role_name` - (Optional) Name of the IAM Role in all target accounts for StackSet operations. Defaults to `AWSCloudFormationStackSetExecutionRole` when using the `SELF_MANAGED` permission model. This should not be defined when using the `SERVICE_MANAGED` permission model.
+* `managed_execution` - (Optional) Configuration block to allow StackSets to perform non-conflicting operations concurrently and queues conflicting operations.
+    * `active` - (Optional) When set to true, StackSets performs non-conflicting operations concurrently and queues conflicting operations. After conflicting operations finish, StackSets starts queued operations in request order. Default is false.
+* `parameters` - (Optional) Key-value map of input parameters for the StackSet template. All template parameters, including those with a `Default`, must be configured or ignored with `lifecycle` configuration block `ignore_changes` argument. All `NoEcho` template parameters must be ignored with the `lifecycle` configuration block `ignore_changes` argument.
+* `permission_model` - (Optional) Describes how the IAM roles required for your StackSet are created. Valid values: `SELF_MANAGED` (default), `SERVICE_MANAGED`.
+* `call_as` - (Optional) Specifies whether you are acting as an account administrator in the organization's management account or as a delegated administrator in a member account. Valid values: `SELF` (default), `DELEGATED_ADMIN`.
+* `tags` - (Optional) Key-value map of tags to associate with this StackSet and the Stacks created from it. AWS CloudFormation also propagates these tags to supported resources that are created in the Stacks. A maximum number of 50 tags can be specified. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `template_body` - (Optional) String containing the CloudFormation template body. Maximum size: 51,200 bytes. Conflicts with `template_url`.
+* `template_url` - (Optional) String containing the location of a file containing the CloudFormation template body. The URL must point to a template that is located in an Amazon S3 bucket. Maximum location file size: 460,800 bytes. Conflicts with `template_body`.
+
+### `operation_preferences` Argument Reference
+
+The `operation_preferences` configuration block supports the following arguments:
+
+* `failure_tolerance_count` - (Optional) The number of accounts, per Region, for which this operation can fail before AWS CloudFormation stops the operation in that Region.
+* `failure_tolerance_percentage` - (Optional) The percentage of accounts, per Region, for which this stack operation can fail before AWS CloudFormation stops the operation in that Region.
+* `max_concurrent_count` - (Optional) The maximum number of accounts in which to perform this operation at one time.
+* `max_concurrent_percentage` - (Optional) The maximum percentage of accounts in which to perform this operation at one time.
+* `region_concurrency_type` - (Optional) The concurrency type of deploying StackSets operations in Regions, could be in parallel or one Region at a time.
+* `region_order` - (Optional) The order of the Regions in where you want to perform the stack operation.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the StackSet.
+* `id` - Name of the StackSet.
+* `stack_set_id` - Unique identifier of the StackSet.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `update` - (Default `30m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudFormation StackSets using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Import CloudFormation StackSets when acting a delegated administrator in a member account using the `name` and `call_as` values separated by a comma (`,`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import CloudFormation StackSets using the `name`. For example:
+
+```console
+% terraform import aws_cloudformation_stack_set.example example
+```
+
+Using `terraform import`, import CloudFormation StackSets when acting a delegated administrator in a member account using the `name` and `call_as` values separated by a comma (`,`). For example:
+
+```console
+% terraform import aws_cloudformation_stack_set.example example,DELEGATED_ADMIN
+```
+
+<!-- cache-key: cdktf-0.18.0 input-419f928fb2ff9a66818eeeb6e7d41583d5b811405ac256cc0869c14a937c9a2d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/cloudformation_stack_set_instance.html.markdown b/website/docs/cdktf/python/r/cloudformation_stack_set_instance.html.markdown
new file mode 100644
index 00000000000..f6278104f20
--- /dev/null
+++ b/website/docs/cdktf/python/r/cloudformation_stack_set_instance.html.markdown
@@ -0,0 +1,228 @@
+---
+subcategory: "CloudFormation"
+layout: "aws"
+page_title: "AWS: aws_cloudformation_stack_set_instance"
+description: |-
+  Manages a CloudFormation StackSet Instance.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudformation_stack_set_instance
+
+Manages a CloudFormation StackSet Instance. Instances are managed in the account and region of the StackSet after the target account permissions have been configured. Additional information about StackSets can be found in the [AWS CloudFormation User Guide](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/what-is-cfnstacksets.html).
+
+~> **NOTE:** All target accounts must have an IAM Role created that matches the name of the execution role configured in the StackSet (the `execution_role_name` argument in the `aws_cloudformation_stack_set` resource) in a trust relationship with the administrative account or administration IAM Role. The execution role must have appropriate permissions to manage resources defined in the template along with those required for StackSets to operate. See the [AWS CloudFormation User Guide](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-prereqs.html) for more details.
+
+~> **NOTE:** To retain the Stack during Terraform resource destroy, ensure `retain_stack = true` has been successfully applied into the Terraform state first. This must be completed _before_ an apply that would destroy the resource.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudformation_stack_set_instance import CloudformationStackSetInstance
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        CloudformationStackSetInstance(self, "example",
+            account_id="123456789012",
+            region="us-east-1",
+            stack_set_name=Token.as_string(aws_cloudformation_stack_set_example.name)
+        )
+```
+
+### Example IAM Setup in Target Account
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.iam_role import IamRole
+from imports.aws.iam_role_policy import IamRolePolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        aws_cloud_formation_stack_set_execution_role_minimum_execution_policy =
+        DataAwsIamPolicyDocument(self, "AWSCloudFormationStackSetExecutionRole_MinimumExecutionPolicy",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["cloudformation:*", "s3:*", "sns:*"],
+                effect="Allow",
+                resources=["*"]
+            )
+            ]
+        )
+        aws_cloud_formation_stack_set_execution_role_assume_role_policy =
+        DataAwsIamPolicyDocument(self, "AWSCloudFormationStackSetExecutionRole_assume_role_policy",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["sts:AssumeRole"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=[aws_cloud_formation_stack_set_administration_role.arn
+                    ],
+                    type="AWS"
+                )
+                ]
+            )
+            ]
+        )
+        aws_cloud_formation_stack_set_execution_role = IamRole(self, "AWSCloudFormationStackSetExecutionRole",
+            assume_role_policy=Token.as_string(aws_cloud_formation_stack_set_execution_role_assume_role_policy.json),
+            name="AWSCloudFormationStackSetExecutionRole"
+        )
+        aws_iam_role_policy_aws_cloud_formation_stack_set_execution_role_minimum_execution_policy =
+        IamRolePolicy(self, "AWSCloudFormationStackSetExecutionRole_MinimumExecutionPolicy_3",
+            name="MinimumExecutionPolicy",
+            policy=Token.as_string(aws_cloud_formation_stack_set_execution_role_minimum_execution_policy.json),
+            role=aws_cloud_formation_stack_set_execution_role.name
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_role_policy_aws_cloud_formation_stack_set_execution_role_minimum_execution_policy.override_logical_id("AWSCloudFormationStackSetExecutionRole_MinimumExecutionPolicy")
+```
+
+### Example Deployment across Organizations account
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudformation_stack_set_instance import CloudformationStackSetInstance
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        CloudformationStackSetInstance(self, "example",
+            deployment_targets=CloudformationStackSetInstanceDeploymentTargets(
+                organizational_unit_ids=[
+                    Token.as_string(
+                        Fn.lookup_nested(aws_organizations_organization_example.roots, ["0", "id"
+                        ]))
+                ]
+            ),
+            region="us-east-1",
+            stack_set_name=Token.as_string(aws_cloudformation_stack_set_example.name)
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `stack_set_name` - (Required) Name of the StackSet.
+* `account_id` - (Optional) Target AWS Account ID to create a Stack based on the StackSet. Defaults to current account.
+* `deployment_targets` - (Optional) The AWS Organizations accounts to which StackSets deploys. StackSets doesn't deploy stack instances to the organization management account, even if the organization management account is in your organization or in an OU in your organization. Drift detection is not possible for this argument. See [deployment_targets](#deployment_targets-argument-reference) below.
+* `parameter_overrides` - (Optional) Key-value map of input parameters to override from the StackSet for this Instance.
+* `region` - (Optional) Target AWS Region to create a Stack based on the StackSet. Defaults to current region.
+* `retain_stack` - (Optional) During Terraform resource destroy, remove Instance from StackSet while keeping the Stack and its associated resources. Must be enabled in Terraform state _before_ destroy operation to take effect. You cannot reassociate a retained Stack or add an existing, saved Stack to a new StackSet. Defaults to `false`.
+* `call_as` - (Optional) Specifies whether you are acting as an account administrator in the organization's management account or as a delegated administrator in a member account. Valid values: `SELF` (default), `DELEGATED_ADMIN`.
+* `operation_preferences` - (Optional) Preferences for how AWS CloudFormation performs a stack set operation.
+
+### `deployment_targets` Argument Reference
+
+The `deployment_targets` configuration block supports the following arguments:
+
+* `organizational_unit_ids` - (Optional) The organization root ID or organizational unit (OU) IDs to which StackSets deploys.
+
+### `operation_preferences` Argument Reference
+
+The `operation_preferences` configuration block supports the following arguments:
+
+* `failure_tolerance_count` - (Optional) The number of accounts, per Region, for which this operation can fail before AWS CloudFormation stops the operation in that Region.
+* `failure_tolerance_percentage` - (Optional) The percentage of accounts, per Region, for which this stack operation can fail before AWS CloudFormation stops the operation in that Region.
+* `max_concurrent_count` - (Optional) The maximum number of accounts in which to perform this operation at one time.
+* `max_concurrent_percentage` - (Optional) The maximum percentage of accounts in which to perform this operation at one time.
+* `region_concurrency_type` - (Optional) The concurrency type of deploying StackSets operations in Regions, could be in parallel or one Region at a time. Valid values are `SEQUENTIAL` and `PARALLEL`.
+* `region_order` - (Optional) The order of the Regions in where you want to perform the stack operation.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Unique identifier for the resource. If `deployment_targets` is set, this is a comma-delimited string combining stack set name, organizational unit IDs (`/`-delimited), and region (ie. `mystack,ou-123/ou-456,us-east-1`). Otherwise, this is a comma-delimited string combining stack set name, AWS account ID, and region (ie. `mystack,123456789012,us-east-1`).
+* `organizational_unit_id` - The organization root ID or organizational unit (OU) ID in which the stack is deployed.
+* `stack_id` - Stack identifier.
+* `stack_instance_summaries` - List of stack instances created from an organizational unit deployment target. This will only be populated when `deployment_targets` is set. See [`stack_instance_summaries`](#stack_instance_summaries-attribute-reference).
+
+### `stack_instance_summaries` Attribute Reference
+
+* `account_id` - AWS account ID in which the stack is deployed.
+* `organizational_unit_id` - Organizational unit ID in which the stack is deployed.
+* `stack_id` - Stack identifier.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `30m`)
+* `update` - (Default `30m`)
+* `delete` - (Default `30m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudFormation StackSet Instances that target an AWS Account ID using the StackSet name, target AWS account ID, and target AWS Region separated by commas (`,`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Import CloudFormation StackSet Instances that target AWS Organizational Units using the StackSet name, a slash (`/`) separated list of organizational unit IDs, and target AWS Region separated by commas (`,`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Import CloudFormation StackSet Instances when acting a delegated administrator in a member account using the StackSet name, target AWS account ID or slash (`/`) separated list of organizational unit IDs, target AWS Region and `call_as` value separated by commas (`,`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import CloudFormation StackSet Instances that target an AWS Account ID using the StackSet name, target AWS account ID, and target AWS Region separated by commas (`,`). For example:
+
+```console
+% terraform import aws_cloudformation_stack_set_instance.example example,123456789012,us-east-1
+```
+
+Using `terraform import`, import CloudFormation StackSet Instances that target AWS Organizational Units using the StackSet name, a slash (`/`) separated list of organizational unit IDs, and target AWS Region separated by commas (`,`). For example:
+
+```console
+% terraform import aws_cloudformation_stack_set_instance.example example,ou-sdas-123123123/ou-sdas-789789789,us-east-1
+```
+
+Using `terraform import`, import CloudFormation StackSet Instances when acting a delegated administrator in a member account using the StackSet name, target AWS account ID or slash (`/`) separated list of organizational unit IDs, target AWS Region and `call_as` value separated by commas (`,`). For example:
+
+```console
+% terraform import aws_cloudformation_stack_set_instance.example example,ou-sdas-123123123/ou-sdas-789789789,us-east-1,DELEGATED_ADMIN
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1e1b74c9b69f000ae028bff21e6d418d876fa6006347b01a1cc908f1b3a20e44 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/cloudformation_type.html.markdown b/website/docs/cdktf/python/r/cloudformation_type.html.markdown
new file mode 100644
index 00000000000..1dc74d1157d
--- /dev/null
+++ b/website/docs/cdktf/python/r/cloudformation_type.html.markdown
@@ -0,0 +1,99 @@
+---
+subcategory: "CloudFormation"
+layout: "aws"
+page_title: "AWS: aws_cloudformation_type"
+description: |-
+    Manages a version of a CloudFormation Type.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudformation_type
+
+Manages a version of a CloudFormation Type.
+
+~> **NOTE:** The destroy operation of this resource marks the version as deprecated. If this was the only `LIVE` version, the type is marked as deprecated. Enable the [resource `lifecycle` configuration block `create_before_destroy` argument](https://www.terraform.io/language/meta-arguments/lifecycle#create_before_destroy) in this resource configuration to properly order redeployments in Terraform.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from cdktf import TerraformResourceLifecycle
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudformation_type import CloudformationType
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        CloudformationType(self, "example",
+            lifecycle=TerraformResourceLifecycle(
+                create_before_destroy=True
+            ),
+            logging_config=CloudformationTypeLoggingConfig(
+                log_group_name=Token.as_string(aws_cloudwatch_log_group_example.name),
+                log_role_arn=Token.as_string(aws_iam_role_example.arn)
+            ),
+            schema_handler_package="s3://${" + aws_s3_object_example.bucket + "}/${" + aws_s3_object_example.key + "}",
+            type="RESOURCE",
+            type_name="ExampleCompany::ExampleService::ExampleResource"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `execution_role_arn` - (Optional) Amazon Resource Name (ARN) of the IAM Role for CloudFormation to assume when invoking the extension. If your extension calls AWS APIs in any of its handlers, you must create an IAM execution role that includes the necessary permissions to call those AWS APIs, and provision that execution role in your account. When CloudFormation needs to invoke the extension handler, CloudFormation assumes this execution role to create a temporary session token, which it then passes to the extension handler, thereby supplying your extension with the appropriate credentials.
+* `logging_config` - (Optional) Configuration block containing logging configuration.
+* `schema_handler_package` - (Required) URL to the S3 bucket containing the extension project package that contains the necessary files for the extension you want to register. Must begin with `s3://` or `https://`. For example, `s3://example-bucket/example-object`.
+* `type` - (Optional) CloudFormation Registry Type. For example, `RESOURCE` or `MODULE`.
+* `type_name` - (Optional) CloudFormation Type name. For example, `ExampleCompany::ExampleService::ExampleResource`.
+
+### logging_config
+
+The `logging_config` configuration block supports the following arguments:
+
+* `log_group_name` - (Required) Name of the CloudWatch Log Group where CloudFormation sends error logging information when invoking the type's handlers.
+* `log_role_arn` - (Required) Amazon Resource Name (ARN) of the IAM Role CloudFormation assumes when sending error logging information to CloudWatch Logs.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - (Optional) Amazon Resource Name (ARN) of the CloudFormation Type version. See also `type_arn`.
+* `default_version_id` - Identifier of the CloudFormation Type default version.
+* `deprecated_status` - Deprecation status of the version.
+* `description` - Description of the version.
+* `documentation_url` - URL of the documentation for the CloudFormation Type.
+* `is_default_version` - Whether the CloudFormation Type version is the default version.
+* `provisioning_type` - Provisioning behavior of the CloudFormation Type.
+* `schema` - JSON document of the CloudFormation Type schema.
+* `source_url` - URL of the source code for the CloudFormation Type.
+* `type_arn` - (Optional) Amazon Resource Name (ARN) of the CloudFormation Type. See also `arn`.
+* `version_id` - (Optional) Identifier of the CloudFormation Type version.
+* `visibility` - Scope of the CloudFormation Type.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_cloudformation_type` using the type version Amazon Resource Name (ARN). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_cloudformation_type` using the type version Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_cloudformation_type.example arn:aws:cloudformation:us-east-1:123456789012:type/resource/ExampleCompany-ExampleService-ExampleType/1
+```
+
+<!-- cache-key: cdktf-0.18.0 input-4738423c73768d212dce00b4674e015861f2836ad18ef9b55653e2e9fd2462e5 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/cloudfront_cache_policy.html.markdown b/website/docs/cdktf/python/r/cloudfront_cache_policy.html.markdown
new file mode 100644
index 00000000000..3693afa3f52
--- /dev/null
+++ b/website/docs/cdktf/python/r/cloudfront_cache_policy.html.markdown
@@ -0,0 +1,122 @@
+---
+subcategory: "CloudFront"
+layout: "aws"
+page_title: "AWS: aws_cloudfront_cache_policy"
+description: |-
+  Use the `aws_cloudfront_cache_policy` resource to manage cache policies for CloudFront distributions. This resource allows you to attach cache policies to cache behaviors, which determine the values included in the cache key, such as HTTP headers, cookies, and URL query strings. CloudFront uses the cache key to locate cached objects and return them to viewers. Additionally, the cache policy sets the default, minimum, and maximum time to live (TTL) values for objects in the CloudFront cache.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudfront_cache_policy
+
+## Example Usage
+
+Use the `aws_cloudfront_cache_policy` resource to create a cache policy for CloudFront.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudfront_cache_policy import CloudfrontCachePolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        CloudfrontCachePolicy(self, "example",
+            comment="test comment",
+            default_ttl=50,
+            max_ttl=100,
+            min_ttl=1,
+            name="example-policy",
+            parameters_in_cache_key_and_forwarded_to_origin=CloudfrontCachePolicyParametersInCacheKeyAndForwardedToOrigin(
+                cookies_config=CloudfrontCachePolicyParametersInCacheKeyAndForwardedToOriginCookiesConfig(
+                    cookie_behavior="whitelist",
+                    cookies=CloudfrontCachePolicyParametersInCacheKeyAndForwardedToOriginCookiesConfigCookies(
+                        items=["example"]
+                    )
+                ),
+                headers_config=CloudfrontCachePolicyParametersInCacheKeyAndForwardedToOriginHeadersConfig(
+                    header_behavior="whitelist",
+                    headers=CloudfrontCachePolicyParametersInCacheKeyAndForwardedToOriginHeadersConfigHeaders(
+                        items=["example"]
+                    )
+                ),
+                query_strings_config=CloudfrontCachePolicyParametersInCacheKeyAndForwardedToOriginQueryStringsConfig(
+                    query_string_behavior="whitelist",
+                    query_strings=CloudfrontCachePolicyParametersInCacheKeyAndForwardedToOriginQueryStringsConfigQueryStrings(
+                        items=["example"]
+                    )
+                )
+            )
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) Unique name used to identify the cache policy.
+* `min_ttl` - (Required) Minimum amount of time, in seconds, that objects should remain in the CloudFront cache before a new request is sent to the origin to check for updates.
+* `max_ttl` - (Optional) Maximum amount of time, in seconds, that objects stay in the CloudFront cache before CloudFront sends another request to the origin to see if the object has been updated.
+* `default_ttl` - (Optional) Amount of time, in seconds, that objects are allowed to remain in the CloudFront cache before CloudFront sends a new request to the origin server to check if the object has been updated.
+* `comment` - (Optional) Description for the cache policy.
+* `parameters_in_cache_key_and_forwarded_to_origin` - (Required) Configuration for including HTTP headers, cookies, and URL query strings in the cache key. For more information, refer to the [Parameters In Cache Key And Forwarded To Origin](#parameters-in-cache-key-and-forwarded-to-origin) section.
+
+### Parameters In Cache Key And Forwarded To Origin
+
+* `cookies_config` - (Required) Whether any cookies in viewer requests are included in the cache key and automatically included in requests that CloudFront sends to the origin. See [Cookies Config](#cookies-config) for more information.
+* `headers_config` - (Required) Whether any HTTP headers are included in the cache key and automatically included in requests that CloudFront sends to the origin. See [Headers Config](#headers-config) for more information.
+* `query_strings_config` - (Required) Whether any URL query strings in viewer requests are included in the cache key. It also automatically includes these query strings in requests that CloudFront sends to the origin. Please refer to the [Query String Config](#query-string-config) for more information.
+* `enable_accept_encoding_brotli` - (Optional) Flag determines whether the Accept-Encoding HTTP header is included in the cache key and in requests that CloudFront sends to the origin.
+* `enable_accept_encoding_gzip` - (Optional) Whether the Accept-Encoding HTTP header is included in the cache key and in requests sent to the origin by CloudFront.
+
+### Cookies Config
+
+* `cookie_behavior` - (Required) Whether any cookies in viewer requests are included in the cache key and automatically included in requests that CloudFront sends to the origin. Valid values for `cookie_behavior` are `none`, `whitelist`, `allExcept`, and `all`.
+* `cookies` - (Optional) Object that contains a list of cookie names. See [Items](#items) for more information.
+
+### Headers Config
+
+* `header_behavior` - (Required) Whether any HTTP headers are included in the cache key and automatically included in requests that CloudFront sends to the origin. Valid values for `header_behavior` are `none` and `whitelist`.
+* `headers` - (Optional) Object contains a list of header names. See [Items](#items) for more information.
+
+### Query String Config
+
+* `query_string_behavior` - (Required) Whether URL query strings in viewer requests are included in the cache key and automatically included in requests that CloudFront sends to the origin. Valid values for `query_string_behavior` are `none`, `whitelist`, `allExcept`, and `all`.
+* `query_strings` - (Optional) Configuration parameter that contains a list of query string names. See [Items](#items) for more information.
+
+### Items
+
+* `items` - (Required) List of item names, such as cookies, headers, or query strings.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `etag` - Current version of the cache policy.
+* `id` - Identifier for the cache policy.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudFront cache policies using the `id` of the cache policy. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import CloudFront cache policies using the `id` of the cache policy. For example:
+
+```console
+% terraform import aws_cloudfront_cache_policy.policy 658327ea-f89d-4fab-a63d-7e88639e58f6
+```
+
+<!-- cache-key: cdktf-0.18.0 input-8fda72f4e7c4165f1b2aa65dbf0738cc394e0490f46a68016d550c5ffee31214 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/cloudfront_continuous_deployment_policy.html.markdown b/website/docs/cdktf/python/r/cloudfront_continuous_deployment_policy.html.markdown
new file mode 100644
index 00000000000..52cfebc52a3
--- /dev/null
+++ b/website/docs/cdktf/python/r/cloudfront_continuous_deployment_policy.html.markdown
@@ -0,0 +1,196 @@
+---
+subcategory: "CloudFront"
+layout: "aws"
+page_title: "AWS: aws_cloudfront_continuous_deployment_policy"
+description: |-
+  Terraform resource for managing an AWS CloudFront Continuous Deployment Policy.
+---
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudfront_continuous_deployment_policy
+
+Terraform resource for managing an AWS CloudFront Continuous Deployment Policy.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudfront_continuous_deployment_policy import CloudfrontContinuousDeploymentPolicy
+from imports.aws.cloudfront_distribution import CloudfrontDistribution
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, defaultCacheBehavior, origin, restrictions, viewerCertificate, defaultCacheBehavior1, origin1, restrictions1, viewerCertificate1):
+        super().__init__(scope, name)
+        staging = CloudfrontDistribution(self, "staging",
+            enabled=True,
+            staging=True,
+            default_cache_behavior=default_cache_behavior,
+            origin=origin,
+            restrictions=restrictions,
+            viewer_certificate=viewer_certificate
+        )
+        example = CloudfrontContinuousDeploymentPolicy(self, "example",
+            enabled=True,
+            staging_distribution_dns_names=[CloudfrontContinuousDeploymentPolicyStagingDistributionDnsNames(
+                items=[staging.domain_name],
+                quantity=1
+            )
+            ],
+            traffic_config=[CloudfrontContinuousDeploymentPolicyTrafficConfig(
+                single_weight_config=[CloudfrontContinuousDeploymentPolicyTrafficConfigSingleWeightConfig(
+                    weight=Token.as_number("0.01")
+                )
+                ],
+                type="SingleWeight"
+            )
+            ]
+        )
+        CloudfrontDistribution(self, "production",
+            continuous_deployment_policy_id=example.id,
+            enabled=True,
+            default_cache_behavior=default_cache_behavior1,
+            origin=origin1,
+            restrictions=restrictions1,
+            viewer_certificate=viewer_certificate1
+        )
+```
+
+### Single Weight Config with Session Stickiness
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudfront_continuous_deployment_policy import CloudfrontContinuousDeploymentPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        CloudfrontContinuousDeploymentPolicy(self, "example",
+            enabled=True,
+            staging_distribution_dns_names=[CloudfrontContinuousDeploymentPolicyStagingDistributionDnsNames(
+                items=[staging.domain_name],
+                quantity=1
+            )
+            ],
+            traffic_config=[CloudfrontContinuousDeploymentPolicyTrafficConfig(
+                single_weight_config=[CloudfrontContinuousDeploymentPolicyTrafficConfigSingleWeightConfig(
+                    session_stickiness_config=[CloudfrontContinuousDeploymentPolicyTrafficConfigSingleWeightConfigSessionStickinessConfig(
+                        idle_ttl=300,
+                        maximum_ttl=600
+                    )
+                    ],
+                    weight=Token.as_number("0.01")
+                )
+                ],
+                type="SingleWeight"
+            )
+            ]
+        )
+```
+
+### Single Header Config
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudfront_continuous_deployment_policy import CloudfrontContinuousDeploymentPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        CloudfrontContinuousDeploymentPolicy(self, "example",
+            enabled=True,
+            staging_distribution_dns_names=[CloudfrontContinuousDeploymentPolicyStagingDistributionDnsNames(
+                items=[staging.domain_name],
+                quantity=1
+            )
+            ],
+            traffic_config=[CloudfrontContinuousDeploymentPolicyTrafficConfig(
+                single_header_config=[CloudfrontContinuousDeploymentPolicyTrafficConfigSingleHeaderConfig(
+                    header="aws-cf-cd-example",
+                    value="example"
+                )
+                ],
+                type="SingleHeader"
+            )
+            ]
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `enabled` - (Required) Whether this continuous deployment policy is enabled.
+* `staging_distribution_dns_names` - (Required) CloudFront domain name of the staging distribution. See [`staging_distribution_dns_names`](#staging_distribution_dns_names).
+* `traffic_config` - (Required) Parameters for routing production traffic from primary to staging distributions. See [`traffic_config`](#traffic_config).
+
+### `staging_distribution_dns_names`
+
+* `items` - (Required) A list of CloudFront domain names for the staging distribution.
+* `quantity` - (Required) Number of CloudFront domain names in the staging distribution.
+
+### `traffic_config`
+
+* `type` - (Required) Type of traffic configuration. Valid values are `SingleWeight` and `SingleHeader`.
+* `single_header_config` - (Optional) Determines which HTTP requests are sent to the staging distribution. See [`single_header_config`](#single_header_config).
+* `single_weight_config` - (Optional) Contains the percentage of traffic to send to the staging distribution. See [`single_weight_config`](#single_weight_config).
+
+### `single_header_config`
+
+* `header` - (Required) Request header name to send to the staging distribution. The header must contain the prefix `aws-cf-cd-`.
+* `value` - (Required) Request header value.
+
+### `single_weight_config`
+
+* `weight` - (Required) The percentage of traffic to send to a staging distribution, expressed as a decimal number between `0` and `.15`.
+* `session_stickiness_config` - (Optional) Session stickiness provides the ability to define multiple requests from a single viewer as a single session. This prevents the potentially inconsistent experience of sending some of a given user's requests to the staging distribution, while others are sent to the primary distribution. Define the session duration using TTL values. See [`session_stickiness_config`](#session_stickiness_config).
+
+### `session_stickiness_config`
+
+* `idle_ttl` - (Required) The amount of time in seconds after which sessions will cease if no requests are received. Valid values are `300` – `3600` (5–60 minutes). The value must be less than or equal to `maximum_ttl`.
+* `maximum_ttl` - (Required) The maximum amount of time in seconds to consider requests from the viewer as being part of the same session. Valid values are `300` – `3600` (5–60 minutes). The value must be greater than or equal to `idle_ttl`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `etag` - Current version of the continuous distribution policy.
+* `id` - Identifier of the continuous deployment policy.
+* `last_modified_time` - Date and time the continuous deployment policy was last modified.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudFront Continuous Deployment Policy using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import CloudFront Continuous Deployment Policy using the `id`. For example:
+
+```console
+% terraform import aws_cloudfront_continuous_deployment_policy.example abcd-1234 
+```
+
+<!-- cache-key: cdktf-0.18.0 input-10ca91c1c5f42a4e7c34b2e87eb874a6c1a113aec1a477105e5b977db0a0d32d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/cloudfront_distribution.html.markdown b/website/docs/cdktf/python/r/cloudfront_distribution.html.markdown
new file mode 100644
index 00000000000..f6c3a110b3a
--- /dev/null
+++ b/website/docs/cdktf/python/r/cloudfront_distribution.html.markdown
@@ -0,0 +1,530 @@
+---
+subcategory: "CloudFront"
+layout: "aws"
+page_title: "AWS: aws_cloudfront_distribution"
+description: |-
+  Provides a CloudFront web distribution resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudfront_distribution
+
+Creates an Amazon CloudFront web distribution.
+
+For information about CloudFront distributions, see the [Amazon CloudFront Developer Guide][1]. For specific information about creating CloudFront web distributions, see the [POST Distribution][2] page in the Amazon CloudFront API Reference.
+
+~> **NOTE:** CloudFront distributions take about 15 minutes to reach a deployed state after creation or modification. During this time, deletes to resources will be blocked. If you need to delete a distribution that is enabled and you do not want to wait, you need to use the `retain_on_delete` flag.
+
+## Example Usage
+
+### S3 Origin
+
+The example below creates a CloudFront distribution with an S3 origin.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudfront_distribution import CloudfrontDistribution
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_acl import S3BucketAcl
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        s3_origin_id = "myS3Origin"
+        b = S3Bucket(self, "b",
+            bucket="mybucket",
+            tags={
+                "Name": "My bucket"
+            }
+        )
+        S3BucketAcl(self, "b_acl",
+            acl="private",
+            bucket=b.id
+        )
+        CloudfrontDistribution(self, "s3_distribution",
+            aliases=["mysite.example.com", "yoursite.example.com"],
+            comment="Some comment",
+            default_cache_behavior=CloudfrontDistributionDefaultCacheBehavior(
+                allowed_methods=["DELETE", "GET", "HEAD", "OPTIONS", "PATCH", "POST", "PUT"
+                ],
+                cached_methods=["GET", "HEAD"],
+                default_ttl=3600,
+                forwarded_values=CloudfrontDistributionDefaultCacheBehaviorForwardedValues(
+                    cookies=CloudfrontDistributionDefaultCacheBehaviorForwardedValuesCookies(
+                        forward="none"
+                    ),
+                    query_string=False
+                ),
+                max_ttl=86400,
+                min_ttl=0,
+                target_origin_id=s3_origin_id,
+                viewer_protocol_policy="allow-all"
+            ),
+            default_root_object="index.html",
+            enabled=True,
+            is_ipv6_enabled=True,
+            logging_config=CloudfrontDistributionLoggingConfig(
+                bucket="mylogs.s3.amazonaws.com",
+                include_cookies=False,
+                prefix="myprefix"
+            ),
+            ordered_cache_behavior=[CloudfrontDistributionOrderedCacheBehavior(
+                allowed_methods=["GET", "HEAD", "OPTIONS"],
+                cached_methods=["GET", "HEAD", "OPTIONS"],
+                compress=True,
+                default_ttl=86400,
+                forwarded_values=CloudfrontDistributionOrderedCacheBehaviorForwardedValues(
+                    cookies=CloudfrontDistributionOrderedCacheBehaviorForwardedValuesCookies(
+                        forward="none"
+                    ),
+                    headers=["Origin"],
+                    query_string=False
+                ),
+                max_ttl=31536000,
+                min_ttl=0,
+                path_pattern="/content/immutable/*",
+                target_origin_id=s3_origin_id,
+                viewer_protocol_policy="redirect-to-https"
+            ), CloudfrontDistributionOrderedCacheBehavior(
+                allowed_methods=["GET", "HEAD", "OPTIONS"],
+                cached_methods=["GET", "HEAD"],
+                compress=True,
+                default_ttl=3600,
+                forwarded_values=CloudfrontDistributionOrderedCacheBehaviorForwardedValues(
+                    cookies=CloudfrontDistributionOrderedCacheBehaviorForwardedValuesCookies(
+                        forward="none"
+                    ),
+                    query_string=False
+                ),
+                max_ttl=86400,
+                min_ttl=0,
+                path_pattern="/content/*",
+                target_origin_id=s3_origin_id,
+                viewer_protocol_policy="redirect-to-https"
+            )
+            ],
+            origin=[CloudfrontDistributionOrigin(
+                domain_name=b.bucket_regional_domain_name,
+                origin_access_control_id=default_var.id,
+                origin_id=s3_origin_id
+            )
+            ],
+            price_class="PriceClass_200",
+            restrictions=CloudfrontDistributionRestrictions(
+                geo_restriction=CloudfrontDistributionRestrictionsGeoRestriction(
+                    locations=["US", "CA", "GB", "DE"],
+                    restriction_type="whitelist"
+                )
+            ),
+            tags={
+                "Environment": "production"
+            },
+            viewer_certificate=CloudfrontDistributionViewerCertificate(
+                cloudfront_default_certificate=True
+            )
+        )
+```
+
+### With Failover Routing
+
+The example below creates a CloudFront distribution with an origin group for failover routing.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudfront_distribution import CloudfrontDistribution
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, allowedMethods, cachedMethods, viewerProtocolPolicy, enabled, restrictions, viewerCertificate):
+        super().__init__(scope, name)
+        CloudfrontDistribution(self, "s3_distribution",
+            default_cache_behavior=CloudfrontDistributionDefaultCacheBehavior(
+                target_origin_id="groupS3",
+                allowed_methods=allowed_methods,
+                cached_methods=cached_methods,
+                viewer_protocol_policy=viewer_protocol_policy
+            ),
+            origin=[CloudfrontDistributionOrigin(
+                domain_name=primary.bucket_regional_domain_name,
+                origin_id="primaryS3",
+                s3_origin_config=CloudfrontDistributionOriginS3OriginConfig(
+                    origin_access_identity=default_var.cloudfront_access_identity_path
+                )
+            ), CloudfrontDistributionOrigin(
+                domain_name=failover.bucket_regional_domain_name,
+                origin_id="failoverS3",
+                s3_origin_config=CloudfrontDistributionOriginS3OriginConfig(
+                    origin_access_identity=default_var.cloudfront_access_identity_path
+                )
+            )
+            ],
+            origin_group=[CloudfrontDistributionOriginGroup(
+                failover_criteria=CloudfrontDistributionOriginGroupFailoverCriteria(
+                    status_codes=[403, 404, 500, 502]
+                ),
+                member=[CloudfrontDistributionOriginGroupMember(
+                    origin_id="primaryS3"
+                ), CloudfrontDistributionOriginGroupMember(
+                    origin_id="failoverS3"
+                )
+                ],
+                origin_id="groupS3"
+            )
+            ],
+            enabled=enabled,
+            restrictions=restrictions,
+            viewer_certificate=viewer_certificate
+        )
+```
+
+### With Managed Caching Policy
+
+The example below creates a CloudFront distribution with an [AWS managed caching policy](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-managed-cache-policies.html).
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudfront_distribution import CloudfrontDistribution
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, cachedMethods, viewerProtocolPolicy):
+        super().__init__(scope, name)
+        s3_origin_id = "myS3Origin"
+        CloudfrontDistribution(self, "s3_distribution",
+            comment="Some comment",
+            default_cache_behavior=CloudfrontDistributionDefaultCacheBehavior(
+                allowed_methods=["GET", "HEAD", "OPTIONS"],
+                cache_policy_id="4135ea2d-6df8-44a3-9df3-4b5a84be39ad",
+                target_origin_id=s3_origin_id,
+                cached_methods=cached_methods,
+                viewer_protocol_policy=viewer_protocol_policy
+            ),
+            default_root_object="index.html",
+            enabled=True,
+            is_ipv6_enabled=True,
+            origin=[CloudfrontDistributionOrigin(
+                domain_name=primary.bucket_regional_domain_name,
+                origin_id="myS3Origin",
+                s3_origin_config=CloudfrontDistributionOriginS3OriginConfig(
+                    origin_access_identity=default_var.cloudfront_access_identity_path
+                )
+            )
+            ],
+            restrictions=CloudfrontDistributionRestrictions(
+                geo_restriction=CloudfrontDistributionRestrictionsGeoRestriction(
+                    locations=["US", "CA", "GB", "DE"],
+                    restriction_type="whitelist"
+                )
+            ),
+            viewer_certificate=CloudfrontDistributionViewerCertificate(
+                cloudfront_default_certificate=True
+            )
+        )
+```
+
+## Argument Reference
+
+The CloudFront distribution argument layout is a complex structure composed of several sub-resources - these resources are laid out below.
+
+### Top-Level Arguments
+
+* `aliases` (Optional) - Extra CNAMEs (alternate domain names), if any, for this distribution.
+* `comment` (Optional) - Any comments you want to include about the distribution.
+* `continuous_deployment_policy_id` (Optional) - Identifier of a continuous deployment policy. This argument should only be set on a production distribution. See the [`aws_cloudfront_continuous_deployment_policy` resource](./cloudfront_continuous_deployment_policy.html.markdown) for additional details.
+* `custom_error_response` (Optional) - One or more [custom error response](#custom-error-response-arguments) elements (multiples allowed).
+* `default_cache_behavior` (Required) - [Default cache behavior](#default-cache-behavior-arguments) for this distribution (maximum one). Requires either `cache_policy_id` (preferred) or `forwarded_values` (deprecated) be set.
+* `default_root_object` (Optional) - Object that you want CloudFront to return (for example, index.html) when an end user requests the root URL.
+* `enabled` (Required) - Whether the distribution is enabled to accept end user requests for content.
+* `is_ipv6_enabled` (Optional) - Whether the IPv6 is enabled for the distribution.
+* `http_version` (Optional) - Maximum HTTP version to support on the distribution. Allowed values are `http1.1`, `http2`, `http2and3` and `http3`. The default is `http2`.
+* `logging_config` (Optional) - The [logging configuration](#logging-config-arguments) that controls how logs are written to your distribution (maximum one).
+* `ordered_cache_behavior` (Optional) - Ordered list of [cache behaviors](#cache-behavior-arguments) resource for this distribution. List from top to bottom in order of precedence. The topmost cache behavior will have precedence 0.
+* `origin` (Required) - One or more [origins](#origin-arguments) for this distribution (multiples allowed).
+* `origin_group` (Optional) - One or more [origin_group](#origin-group-arguments) for this distribution (multiples allowed).
+* `price_class` (Optional) - Price class for this distribution. One of `PriceClass_All`, `PriceClass_200`, `PriceClass_100`.
+* `restrictions` (Required) - The [restriction configuration](#restrictions-arguments) for this distribution (maximum one).
+* `staging` (Optional) - A Boolean that indicates whether this is a staging distribution. Defaults to `false`.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `viewer_certificate` (Required) - The [SSL configuration](#viewer-certificate-arguments) for this distribution (maximum one).
+* `web_acl_id` (Optional) - Unique identifier that specifies the AWS WAF web ACL, if any, to associate with this distribution. To specify a web ACL created using the latest version of AWS WAF (WAFv2), use the ACL ARN, for example `aws_wafv2_web_acl.example.arn`. To specify a web ACL created using AWS WAF Classic, use the ACL ID, for example `aws_waf_web_acl.example.id`. The WAF Web ACL must exist in the WAF Global (CloudFront) region and the credentials configuring this argument must have `waf:GetWebACL` permissions assigned.
+* `retain_on_delete` (Optional) - Disables the distribution instead of deleting it when destroying the resource through Terraform. If this is set, the distribution needs to be deleted manually afterwards. Default: `false`.
+* `wait_for_deployment` (Optional) - If enabled, the resource will wait for the distribution status to change from `InProgress` to `Deployed`. Setting this to`false` will skip the process. Default: `true`.
+
+#### Cache Behavior Arguments
+
+~> **NOTE:** To achieve the setting of 'Use origin cache headers' without a linked cache policy, use the following TTL values: `min_ttl` = 0, `max_ttl` = 31536000, `default_ttl` = 86400. See [this issue](https://github.com/hashicorp/terraform-provider-aws/issues/19382) for additional context.
+
+* `allowed_methods` (Required) - Controls which HTTP methods CloudFront processes and forwards to your Amazon S3 bucket or your custom origin.
+* `cached_methods` (Required) - Controls whether CloudFront caches the response to requests using the specified HTTP methods.
+* `cache_policy_id` (Optional) - Unique identifier of the cache policy that is attached to the cache behavior. If configuring the `default_cache_behavior` either `cache_policy_id` or `forwarded_values` must be set.
+* `compress` (Optional) - Whether you want CloudFront to automatically compress content for web requests that include `Accept-Encoding: gzip` in the request header (default: `false`).
+* `default_ttl` (Optional) - Default amount of time (in seconds) that an object is in a CloudFront cache before CloudFront forwards another request in the absence of an `Cache-Control max-age` or `Expires` header.
+* `field_level_encryption_id` (Optional) - Field level encryption configuration ID.
+* `forwarded_values` (Optional, **Deprecated** use `cache_policy_id` or `origin_request_policy_id ` instead) - The [forwarded values configuration](#forwarded-values-arguments) that specifies how CloudFront handles query strings, cookies and headers (maximum one).
+* `lambda_function_association` (Optional) - A [config block](#lambda-function-association) that triggers a lambda function with specific actions (maximum 4).
+* `function_association` (Optional) - A [config block](#function-association) that triggers a cloudfront function with specific actions (maximum 2).
+* `max_ttl` (Optional) - Maximum amount of time (in seconds) that an object is in a CloudFront cache before CloudFront forwards another request to your origin to determine whether the object has been updated. Only effective in the presence of `Cache-Control max-age`, `Cache-Control s-maxage`, and `Expires` headers.
+* `min_ttl` (Optional) - Minimum amount of time that you want objects to stay in CloudFront caches before CloudFront queries your origin to see whether the object has been updated. Defaults to 0 seconds.
+* `origin_request_policy_id` (Optional) - Unique identifier of the origin request policy that is attached to the behavior.
+* `path_pattern` (Required) - Pattern (for example, `images/*.jpg`) that specifies which requests you want this cache behavior to apply to.
+* `realtime_log_config_arn` (Optional) - ARN of the [real-time log configuration](cloudfront_realtime_log_config.html) that is attached to this cache behavior.
+* `response_headers_policy_id` (Optional) - Identifier for a response headers policy.
+* `smooth_streaming` (Optional) - Indicates whether you want to distribute media files in Microsoft Smooth Streaming format using the origin that is associated with this cache behavior.
+* `target_origin_id` (Required) - Value of ID for the origin that you want CloudFront to route requests to when a request matches the path pattern either for a cache behavior or for the default cache behavior.
+* `trusted_key_groups` (Optional) - List of key group IDs that CloudFront can use to validate signed URLs or signed cookies. See the [CloudFront User Guide](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-trusted-signers.html) for more information about this feature.
+* `trusted_signers` (Optional) - List of AWS account IDs (or `self`) that you want to allow to create signed URLs for private content. See the [CloudFront User Guide](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-trusted-signers.html) for more information about this feature.
+* `viewer_protocol_policy` (Required) - Use this element to specify the protocol that users can use to access the files in the origin specified by TargetOriginId when a request matches the path pattern in PathPattern. One of `allow-all`, `https-only`, or `redirect-to-https`.
+
+##### Forwarded Values Arguments
+
+* `cookies` (Required) - The [forwarded values cookies](#cookies-arguments) that specifies how CloudFront handles cookies (maximum one).
+* `headers` (Optional) - Headers, if any, that you want CloudFront to vary upon for this cache behavior. Specify `*` to include all headers.
+* `query_string` (Required) - Indicates whether you want CloudFront to forward query strings to the origin that is associated with this cache behavior.
+* `query_string_cache_keys` (Optional) - When specified, along with a value of `true` for `query_string`, all query strings are forwarded, however only the query string keys listed in this argument are cached. When omitted with a value of `true` for `query_string`, all query string keys are cached.
+
+##### Lambda Function Association
+
+Lambda@Edge allows you to associate an AWS Lambda Function with a predefined
+event. You can associate a single function per event type. See [What is
+Lambda@Edge](http://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/what-is-lambda-at-edge.html)
+for more information.
+
+Example configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudfront_distribution import CloudfrontDistribution
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, allowedMethods, cachedMethods, pathPattern, targetOriginId, viewerProtocolPolicy, defaultCacheBehavior, enabled, origin, restrictions, viewerCertificate):
+        super().__init__(scope, name)
+        CloudfrontDistribution(self, "example",
+            ordered_cache_behavior=[CloudfrontDistributionOrderedCacheBehavior(
+                lambda_function_association=[CloudfrontDistributionOrderedCacheBehaviorLambdaFunctionAssociation(
+                    event_type="viewer-request",
+                    include_body=False,
+                    lambda_arn=Token.as_string(aws_lambda_function_example.qualified_arn)
+                )
+                ],
+                allowed_methods=allowed_methods,
+                cached_methods=cached_methods,
+                path_pattern=path_pattern,
+                target_origin_id=target_origin_id,
+                viewer_protocol_policy=viewer_protocol_policy
+            )
+            ],
+            default_cache_behavior=default_cache_behavior,
+            enabled=enabled,
+            origin=origin,
+            restrictions=restrictions,
+            viewer_certificate=viewer_certificate
+        )
+```
+
+* `event_type` (Required) - Specific event to trigger this function. Valid values: `viewer-request`, `origin-request`, `viewer-response`, `origin-response`.
+* `lambda_arn` (Required) - ARN of the Lambda function.
+* `include_body` (Optional) - When set to true it exposes the request body to the lambda function. Defaults to false. Valid values: `true`, `false`.
+
+##### Function Association
+
+With CloudFront Functions in Amazon CloudFront, you can write lightweight functions in JavaScript for high-scale, latency-sensitive CDN customizations. You can associate a single function per event type. See [CloudFront Functions](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/cloudfront-functions.html)
+for more information.
+
+Example configuration:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudfront_distribution import CloudfrontDistribution
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, allowedMethods, cachedMethods, pathPattern, targetOriginId, viewerProtocolPolicy, defaultCacheBehavior, enabled, origin, restrictions, viewerCertificate):
+        super().__init__(scope, name)
+        CloudfrontDistribution(self, "example",
+            ordered_cache_behavior=[CloudfrontDistributionOrderedCacheBehavior(
+                function_association=[CloudfrontDistributionOrderedCacheBehaviorFunctionAssociation(
+                    event_type="viewer-request",
+                    function_arn=Token.as_string(aws_cloudfront_function_example.arn)
+                )
+                ],
+                allowed_methods=allowed_methods,
+                cached_methods=cached_methods,
+                path_pattern=path_pattern,
+                target_origin_id=target_origin_id,
+                viewer_protocol_policy=viewer_protocol_policy
+            )
+            ],
+            default_cache_behavior=default_cache_behavior,
+            enabled=enabled,
+            origin=origin,
+            restrictions=restrictions,
+            viewer_certificate=viewer_certificate
+        )
+```
+
+* `event_type` (Required) - Specific event to trigger this function. Valid values: `viewer-request` or `viewer-response`.
+* `function_arn` (Required) - ARN of the CloudFront function.
+
+##### Cookies Arguments
+
+* `forward` (Required) - Whether you want CloudFront to forward cookies to the origin that is associated with this cache behavior. You can specify `all`, `none` or `whitelist`. If `whitelist`, you must include the subsequent `whitelisted_names`.
+* `whitelisted_names` (Optional) - If you have specified `whitelist` to `forward`, the whitelisted cookies that you want CloudFront to forward to your origin.
+
+#### Custom Error Response Arguments
+
+* `error_caching_min_ttl` (Optional) - Minimum amount of time you want HTTP error codes to stay in CloudFront caches before CloudFront queries your origin to see whether the object has been updated.
+* `error_code` (Required) - 4xx or 5xx HTTP status code that you want to customize.
+* `response_code` (Optional) - HTTP status code that you want CloudFront to return with the custom error page to the viewer.
+* `response_page_path` (Optional) - Path of the custom error page (for example, `/custom_404.html`).
+
+#### Default Cache Behavior Arguments
+
+The arguments for `default_cache_behavior` are the same as for
+[`ordered_cache_behavior`](#cache-behavior-arguments), except for the `path_pattern`
+argument should not be specified.
+
+#### Logging Config Arguments
+
+* `bucket` (Required) - Amazon S3 bucket to store the access logs in, for example, `myawslogbucket.s3.amazonaws.com`.
+* `include_cookies` (Optional) - Whether to include cookies in access logs (default: `false`).
+* `prefix` (Optional) - Prefix to the access log filenames for this distribution, for example, `myprefix/`.
+
+#### Origin Arguments
+
+* `connection_attempts` (Optional) - Number of times that CloudFront attempts to connect to the origin. Must be between 1-3. Defaults to 3.
+* `connection_timeout` (Optional) - Number of seconds that CloudFront waits when trying to establish a connection to the origin. Must be between 1-10. Defaults to 10.
+* `custom_origin_config` - The [CloudFront custom origin](#custom-origin-config-arguments) configuration information. If an S3 origin is required, use `origin_access_control_id` or `s3_origin_config` instead.
+* `domain_name` (Required) - DNS domain name of either the S3 bucket, or web site of your custom origin.
+* `custom_header` (Optional) - One or more sub-resources with `name` and `value` parameters that specify header data that will be sent to the origin (multiples allowed).
+* `origin_access_control_id` (Optional) - Unique identifier of a [CloudFront origin access control][8] for this origin.
+* `origin_id` (Required) - Unique identifier for the origin.
+* `origin_path` (Optional) - Optional element that causes CloudFront to request your content from a directory in your Amazon S3 bucket or your custom origin.
+* `origin_shield` - (Optional) [CloudFront Origin Shield](#origin-shield-arguments) configuration information. Using Origin Shield can help reduce the load on your origin. For more information, see [Using Origin Shield](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/origin-shield.html) in the Amazon CloudFront Developer Guide.
+* `s3_origin_config` - (Optional) [CloudFront S3 origin](#s3-origin-config-arguments) configuration information. If a custom origin is required, use `custom_origin_config` instead.
+
+##### Custom Origin Config Arguments
+
+* `http_port` (Required) - HTTP port the custom origin listens on.
+* `https_port` (Required) - HTTPS port the custom origin listens on.
+* `origin_protocol_policy` (Required) - Origin protocol policy to apply to your origin. One of `http-only`, `https-only`, or `match-viewer`.
+* `origin_ssl_protocols` (Required) - SSL/TLS protocols that you want CloudFront to use when communicating with your origin over HTTPS. A list of one or more of `SSLv3`, `TLSv1`, `TLSv1.1`, and `TLSv1.2`.
+* `origin_keepalive_timeout` - (Optional) The Custom KeepAlive timeout, in seconds. By default, AWS enforces an upper limit of `60`. But you can request an [increase](http://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/RequestAndResponseBehaviorCustomOrigin.html#request-custom-request-timeout). Defaults to `5`.
+* `origin_read_timeout` - (Optional) The Custom Read timeout, in seconds. By default, AWS enforces an upper limit of `60`. But you can request an [increase](http://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/RequestAndResponseBehaviorCustomOrigin.html#request-custom-request-timeout). Defaults to `30`.
+
+##### Origin Shield Arguments
+
+* `enabled` (Required) - Whether Origin Shield is enabled.
+* `origin_shield_region` (Optional) - AWS Region for Origin Shield. To specify a region, use the region code, not the region name. For example, specify the US East (Ohio) region as `us-east-2`.
+
+##### S3 Origin Config Arguments
+
+* `origin_access_identity` (Required) - The [CloudFront origin access identity][5] to associate with the origin.
+
+#### Origin Group Arguments
+
+* `origin_id` (Required) - Unique identifier for the origin group.
+* `failover_criteria` (Required) - The [failover criteria](#failover-criteria-arguments) for when to failover to the secondary origin.
+* `member` (Required) - Ordered [member](#member-arguments) configuration blocks assigned to the origin group, where the first member is the primary origin. You must specify two members.
+
+##### Failover Criteria Arguments
+
+* `status_codes` (Required) - List of HTTP status codes for the origin group.
+
+##### Member Arguments
+
+* `origin_id` (Required) - Unique identifier of the member origin.
+
+#### Restrictions Arguments
+
+The `restrictions` sub-resource takes another single sub-resource named `geo_restriction` (see the example for usage).
+
+The arguments of `geo_restriction` are:
+
+* `locations` (Required) - [ISO 3166-1-alpha-2 codes][4] for which you want CloudFront either to distribute your content (`whitelist`) or not distribute your content (`blacklist`). If the type is specified as `none` an empty array can be used.
+* `restriction_type` (Required) - Method that you want to use to restrict distribution of your content by country: `none`, `whitelist`, or `blacklist`.
+
+#### Viewer Certificate Arguments
+
+* `acm_certificate_arn` - ARN of the [AWS Certificate Manager][6] certificate that you wish to use with this distribution. Specify this, `cloudfront_default_certificate`, or `iam_certificate_id`.  The ACM certificate must be in  US-EAST-1.
+* `cloudfront_default_certificate` - `true` if you want viewers to use HTTPS to request your objects and you're using the CloudFront domain name for your distribution. Specify this, `acm_certificate_arn`, or `iam_certificate_id`.
+* `iam_certificate_id` - IAM certificate identifier of the custom viewer certificate for this distribution if you are using a custom domain. Specify this, `acm_certificate_arn`, or `cloudfront_default_certificate`.
+* `minimum_protocol_version` - Minimum version of the SSL protocol that you want CloudFront to use for HTTPS connections. Can only be set if `cloudfront_default_certificate = false`. See all possible values in [this](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/secure-connections-supported-viewer-protocols-ciphers.html) table under "Security policy." Some examples include: `TLSv1.2_2019` and `TLSv1.2_2021`. Default: `TLSv1`. **NOTE**: If you are using a custom certificate (specified with `acm_certificate_arn` or `iam_certificate_id`), and have specified `sni-only` in `ssl_support_method`, `TLSv1` or later must be specified. If you have specified `vip` in `ssl_support_method`, only `SSLv3` or `TLSv1` can be specified. If you have specified `cloudfront_default_certificate`, `TLSv1` must be specified.
+* `ssl_support_method` - How you want CloudFront to serve HTTPS requests. One of `vip` or `sni-only`. Required if you specify `acm_certificate_arn` or `iam_certificate_id`. **NOTE:** `vip` causes CloudFront to use a dedicated IP address and may incur extra charges.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Identifier for the distribution. For example: `EDFDVBD632BHDS5`.
+* `arn` - ARN for the distribution. For example: `arn:aws:cloudfront::123456789012:distribution/EDFDVBD632BHDS5`, where `123456789012` is your AWS account ID.
+* `caller_reference` - Internal value used by CloudFront to allow future updates to the distribution configuration.
+* `status` - Current status of the distribution. `Deployed` if the distribution's information is fully propagated throughout the Amazon CloudFront system.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `trusted_key_groups` - List of nested attributes for active trusted key groups, if the distribution is set up to serve private content with signed URLs.
+    * `enabled` - `true` if any of the key groups have public keys that CloudFront can use to verify the signatures of signed URLs and signed cookies.
+    * `items` - List of nested attributes for each key group.
+        * `key_group_id` - ID of the key group that contains the public keys.
+        * `key_pair_ids` - Set of CloudFront key pair IDs.
+* `trusted_signers` - List of nested attributes for active trusted signers, if the distribution is set up to serve private content with signed URLs.
+    * `enabled` - `true` if any of the AWS accounts listed as trusted signers have active CloudFront key pairs
+    * `items` - List of nested attributes for each trusted signer
+        * `aws_account_number` - AWS account ID or `self`
+        * `key_pair_ids` - Set of active CloudFront key pairs associated with the signer account
+* `domain_name` - Domain name corresponding to the distribution. For example: `d604721fxaaqy9.cloudfront.net`.
+* `last_modified_time` - Date and time the distribution was last modified.
+* `in_progress_validation_batches` - Number of invalidation batches currently in progress.
+* `etag` - Current version of the distribution's information. For example: `E2QWRUHAPOMQZL`.
+* `hosted_zone_id` - CloudFront Route 53 zone ID that can be used to route an [Alias Resource Record Set][7] to. This attribute is simply an alias for the zone ID `Z2FDTNDATAQYW2`.
+
+[1]: http://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Introduction.html
+[2]: https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_CreateDistribution.html
+[3]: http://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-s3.html
+[4]: http://www.iso.org/iso/country_codes/iso_3166_code_lists/country_names_and_code_elements.htm
+[5]: /docs/providers/aws/r/cloudfront_origin_access_identity.html
+[6]: https://aws.amazon.com/certificate-manager/
+[7]: http://docs.aws.amazon.com/Route53/latest/APIReference/CreateAliasRRSAPI.html
+[8]: /docs/providers/aws/r/cloudfront_origin_access_control.html
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudFront Distributions using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import CloudFront Distributions using the `id`. For example:
+
+```console
+% terraform import aws_cloudfront_distribution.distribution E74FTE3EXAMPLE
+```
+
+<!-- cache-key: cdktf-0.18.0 input-0b6496126422015df51ee5b7114c332b4222965bc778c7ff2aecedac14a3a375 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/cloudfront_field_level_encryption_config.html.markdown b/website/docs/cdktf/python/r/cloudfront_field_level_encryption_config.html.markdown
new file mode 100644
index 00000000000..b6194ac8680
--- /dev/null
+++ b/website/docs/cdktf/python/r/cloudfront_field_level_encryption_config.html.markdown
@@ -0,0 +1,110 @@
+---
+subcategory: "CloudFront"
+layout: "aws"
+page_title: "AWS: aws_cloudfront_field_level_encryption_config"
+description: |-
+  Provides a CloudFront Field-level Encryption Config resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudfront_field_level_encryption_config
+
+Provides a CloudFront Field-level Encryption Config resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudfront_field_level_encryption_config import CloudfrontFieldLevelEncryptionConfig
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        CloudfrontFieldLevelEncryptionConfig(self, "test",
+            comment="test comment",
+            content_type_profile_config=CloudfrontFieldLevelEncryptionConfigContentTypeProfileConfig(
+                content_type_profiles=CloudfrontFieldLevelEncryptionConfigContentTypeProfileConfigContentTypeProfiles(
+                    items=[CloudfrontFieldLevelEncryptionConfigContentTypeProfileConfigContentTypeProfilesItems(
+                        content_type="application/x-www-form-urlencoded",
+                        format="URLEncoded"
+                    )
+                    ]
+                ),
+                forward_when_content_type_is_unknown=True
+            ),
+            query_arg_profile_config=CloudfrontFieldLevelEncryptionConfigQueryArgProfileConfig(
+                forward_when_query_arg_profile_is_unknown=True,
+                query_arg_profiles=CloudfrontFieldLevelEncryptionConfigQueryArgProfileConfigQueryArgProfiles(
+                    items=[CloudfrontFieldLevelEncryptionConfigQueryArgProfileConfigQueryArgProfilesItems(
+                        profile_id=Token.as_string(aws_cloudfront_field_level_encryption_profile_test.id),
+                        query_arg="Arg1"
+                    )
+                    ]
+                )
+            )
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `comment` - (Optional) An optional comment about the Field Level Encryption Config.
+* `content_type_profile_config` - (Required) [Content Type Profile Config](#content-type-profile-config) specifies when to forward content if a content type isn't recognized and profiles to use as by default in a request if a query argument doesn't specify a profile to use.
+* `query_arg_profile_config` - (Required) [Query Arg Profile Config](#query-arg-profile-config) that specifies when to forward content if a profile isn't found and the profile that can be provided as a query argument in a request.
+
+### Content Type Profile Config
+
+* `forward_when_content_type_is_unknown` - (Required) specifies what to do when an unknown content type is provided for the profile. If true, content is forwarded without being encrypted when the content type is unknown. If false (the default), an error is returned when the content type is unknown.
+* `content_type_profiles` - (Required) Object that contains an attribute `items` that contains the list of configurations for a field-level encryption content type-profile. See [Content Type Profile](#content-type-profile).
+
+### Content Type Profile
+
+* `content_type` - (Required) he content type for a field-level encryption content type-profile mapping. Valid value is `application/x-www-form-urlencoded`.
+* `format` - (Required) The format for a field-level encryption content type-profile mapping. Valid value is `URLEncoded`.
+* `profile_id` - (Optional) The profile ID for a field-level encryption content type-profile mapping.
+
+### Query Arg Profile Config
+
+* `forward_when_query_arg_profile_is_unknown` - (Required) Flag to set if you want a request to be forwarded to the origin even if the profile specified by the field-level encryption query argument, fle-profile, is unknown.
+* `query_arg_profiles` - (Optional) Object that contains an attribute `items` that contains the list ofrofiles specified for query argument-profile mapping for field-level encryption. see [Query Arg Profile](#query-arg-profile).
+
+### Query Arg Profile
+
+* `profile_id` - (Required) ID of profile to use for field-level encryption query argument-profile mapping
+* `query_arg` - (Required) Query argument for field-level encryption query argument-profile mapping.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `caller_reference` - Internal value used by CloudFront to allow future updates to the Field Level Encryption Config.
+* `etag` - The current version of the Field Level Encryption Config. For example: `E2QWRUHAPOMQZL`.
+* `id` - The identifier for the Field Level Encryption Config. For example: `K3D5EWEUDCCXON`.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Cloudfront Field Level Encryption Config using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Cloudfront Field Level Encryption Config using the `id`. For example:
+
+```console
+% terraform import aws_cloudfront_field_level_encryption_config.config E74FTE3AEXAMPLE
+```
+
+<!-- cache-key: cdktf-0.18.0 input-757359a9350d143cc637cf70befbb7ac23a36d48718be8d5941639a0def4ff71 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/cloudfront_field_level_encryption_profile.html.markdown b/website/docs/cdktf/python/r/cloudfront_field_level_encryption_profile.html.markdown
new file mode 100644
index 00000000000..206935daad8
--- /dev/null
+++ b/website/docs/cdktf/python/r/cloudfront_field_level_encryption_profile.html.markdown
@@ -0,0 +1,92 @@
+---
+subcategory: "CloudFront"
+layout: "aws"
+page_title: "AWS: aws_cloudfront_field_level_encryption_profile"
+description: |-
+  Provides a CloudFront Field-level Encryption Profile resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudfront_field_level_encryption_profile
+
+Provides a CloudFront Field-level Encryption Profile resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudfront_field_level_encryption_profile import CloudfrontFieldLevelEncryptionProfile
+from imports.aws.cloudfront_public_key import CloudfrontPublicKey
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = CloudfrontPublicKey(self, "example",
+            comment="test public key",
+            encoded_key=Token.as_string(Fn.file("public_key.pem")),
+            name="test_key"
+        )
+        CloudfrontFieldLevelEncryptionProfile(self, "test",
+            comment="test comment",
+            encryption_entities=CloudfrontFieldLevelEncryptionProfileEncryptionEntities(
+                items=[CloudfrontFieldLevelEncryptionProfileEncryptionEntitiesItems(
+                    field_patterns=CloudfrontFieldLevelEncryptionProfileEncryptionEntitiesItemsFieldPatterns(
+                        items=["DateOfBirth"]
+                    ),
+                    provider_id="test provider",
+                    public_key_id=example.id
+                )
+                ]
+            ),
+            name="test profile"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the Field Level Encryption Profile.
+* `comment` - (Optional) An optional comment about the Field Level Encryption Profile.
+* `encryption_entities` - (Required) The [encryption entities](#encryption-entities) config block for field-level encryption profiles that contains an attribute `items` which includes the encryption key and field pattern specifications.
+
+### Encryption Entities
+
+* `public_key_id` - (Required) The public key associated with a set of field-level encryption patterns, to be used when encrypting the fields that match the patterns.
+* `provider_id` - (Required) The provider associated with the public key being used for encryption.
+* `field_patterns` - (Required) Object that contains an attribute `items` that contains the list of field patterns in a field-level encryption content type profile specify the fields that you want to be encrypted.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `caller_reference` - Internal value used by CloudFront to allow future updates to the Field Level Encryption Profile.
+* `etag` - The current version of the Field Level Encryption Profile. For example: `E2QWRUHAPOMQZL`.
+* `id` - The identifier for the Field Level Encryption Profile. For example: `K3D5EWEUDCCXON`.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Cloudfront Field Level Encryption Profile using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Cloudfront Field Level Encryption Profile using the `id`. For example:
+
+```console
+% terraform import aws_cloudfront_field_level_encryption_profile.profile K3D5EWEUDCCXON
+```
+
+<!-- cache-key: cdktf-0.18.0 input-70b6337b5220a74802bcb7be93e79696a90a0f0a1a7870e9703063485f2517fe -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/cloudfront_function.html.markdown b/website/docs/cdktf/python/r/cloudfront_function.html.markdown
new file mode 100644
index 00000000000..ceea1418954
--- /dev/null
+++ b/website/docs/cdktf/python/r/cloudfront_function.html.markdown
@@ -0,0 +1,85 @@
+---
+subcategory: "CloudFront"
+layout: "aws"
+page_title: "AWS: aws_cloudfront_function"
+description: |-
+  Provides a CloudFront Function resource. With CloudFront Functions in Amazon CloudFront, you can write lightweight functions in JavaScript for high-scale, latency-sensitive CDN customizations.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudfront_function
+
+Provides a CloudFront Function resource. With CloudFront Functions in Amazon CloudFront, you can write lightweight functions in JavaScript for high-scale, latency-sensitive CDN customizations.
+
+See [CloudFront Functions](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/cloudfront-functions.html)
+
+~> **NOTE:** You cannot delete a function if it’s associated with a cache behavior. First, update your distributions to remove the function association from all cache behaviors, then delete the function.
+
+## Example Usage
+
+### Basic Example
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudfront_function import CloudfrontFunction
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        CloudfrontFunction(self, "test",
+            code=Token.as_string(Fn.file("${path.module}/function.js")),
+            comment="my function",
+            name="test",
+            publish=True,
+            runtime="cloudfront-js-1.0"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) Unique name for your CloudFront Function.
+* `code` - (Required) Source code of the function
+* `runtime` - (Required) Identifier of the function's runtime. Currently only `cloudfront-js-1.0` is valid.
+
+The following arguments are optional:
+
+* `comment` - (Optional) Comment.
+* `publish` - (Optional) Whether to publish creation/change as Live CloudFront Function Version. Defaults to `true`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) identifying your CloudFront Function.
+* `etag` - ETag hash of the function. This is the value for the `DEVELOPMENT` stage of the function.
+* `live_stage_etag` - ETag hash of any `LIVE` stage of the function.
+* `status` - Status of the function. Can be `UNPUBLISHED`, `UNASSOCIATED` or `ASSOCIATED`.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudFront Functions using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import CloudFront Functions using the `name`. For example:
+
+```console
+% terraform import aws_cloudfront_function.test my_test_function
+```
+
+<!-- cache-key: cdktf-0.18.0 input-4dbd0fc63d6063c2f79ef92be1f7d40dedd1c366a0fddb227942d78a1ac1a21c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/cloudfront_key_group.html.markdown b/website/docs/cdktf/python/r/cloudfront_key_group.html.markdown
new file mode 100644
index 00000000000..1a6c55e0866
--- /dev/null
+++ b/website/docs/cdktf/python/r/cloudfront_key_group.html.markdown
@@ -0,0 +1,78 @@
+---
+subcategory: "CloudFront"
+layout: "aws"
+page_title: "AWS: aws_cloudfront_key_group"
+description: |-
+  Provides a CloudFront key group.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudfront_key_group
+
+## Example Usage
+
+The following example below creates a CloudFront key group.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudfront_key_group import CloudfrontKeyGroup
+from imports.aws.cloudfront_public_key import CloudfrontPublicKey
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = CloudfrontPublicKey(self, "example",
+            comment="example public key",
+            encoded_key=Token.as_string(Fn.file("public_key.pem")),
+            name="example-key"
+        )
+        aws_cloudfront_key_group_example = CloudfrontKeyGroup(self, "example_1",
+            comment="example key group",
+            items=[example.id],
+            name="example-key-group"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_cloudfront_key_group_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `comment` - (Optional) A comment to describe the key group..
+* `items` - (Required) A list of the identifiers of the public keys in the key group.
+* `name` - (Required) A name to identify the key group.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `etag` - The identifier for this version of the key group.
+* `id` - The identifier for the key group.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudFront Key Group using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import CloudFront Key Group using the `id`. For example:
+
+```console
+% terraform import aws_cloudfront_key_group.example 4b4f2r1c-315d-5c2e-f093-216t50jed10f
+```
+
+<!-- cache-key: cdktf-0.18.0 input-0db0e51d4954b3fa9a11b3c80e65d4eec2e3dd9da0abaf0109fbb3ae52ac9582 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/cloudfront_monitoring_subscription.html.markdown b/website/docs/cdktf/python/r/cloudfront_monitoring_subscription.html.markdown
new file mode 100644
index 00000000000..9a31b89bff1
--- /dev/null
+++ b/website/docs/cdktf/python/r/cloudfront_monitoring_subscription.html.markdown
@@ -0,0 +1,79 @@
+---
+subcategory: "CloudFront"
+layout: "aws"
+page_title: "AWS: aws_cloudfront_monitoring_subscription"
+description: |-
+  Provides a CloudFront monitoring subscription resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudfront_monitoring_subscription
+
+Provides a CloudFront real-time log configuration resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudfront_monitoring_subscription import CloudfrontMonitoringSubscription
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        CloudfrontMonitoringSubscription(self, "example",
+            distribution_id=Token.as_string(aws_cloudfront_distribution_example.id),
+            monitoring_subscription=CloudfrontMonitoringSubscriptionMonitoringSubscription(
+                realtime_metrics_subscription_config=CloudfrontMonitoringSubscriptionMonitoringSubscriptionRealtimeMetricsSubscriptionConfig(
+                    realtime_metrics_subscription_status="Enabled"
+                )
+            )
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `distribution_id` - (Required) The ID of the distribution that you are enabling metrics for.
+* `monitoring_subscription` - (Required) A monitoring subscription. This structure contains information about whether additional CloudWatch metrics are enabled for a given CloudFront distribution.
+
+### monitoring_subscription
+
+* `realtime_metrics_subscription_config` - (Required) A subscription configuration for additional CloudWatch metrics. See below.
+
+### realtime_metrics_subscription_config
+
+* `realtime_metrics_subscription_status` - (Required) A flag that indicates whether additional CloudWatch metrics are enabled for a given CloudFront distribution. Valid values are `Enabled` and `Disabled`. See below.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the CloudFront monitoring subscription, which corresponds to the `distribution_id`.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudFront monitoring subscription using the id. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import CloudFront monitoring subscription using the id. For example:
+
+```console
+% terraform import aws_cloudfront_monitoring_subscription.example E3QYSUHO4VYRGB
+```
+
+<!-- cache-key: cdktf-0.18.0 input-b91e31f3e82dbecd167a0e42115b3ad5594b5f039d0b0b9f9acb77abb50ffaa6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/cloudfront_origin_access_control.html.markdown b/website/docs/cdktf/python/r/cloudfront_origin_access_control.html.markdown
new file mode 100644
index 00000000000..8544b5d4e83
--- /dev/null
+++ b/website/docs/cdktf/python/r/cloudfront_origin_access_control.html.markdown
@@ -0,0 +1,78 @@
+---
+subcategory: "CloudFront"
+layout: "aws"
+page_title: "AWS: aws_cloudfront_origin_access_control"
+description: |-
+  Terraform resource for managing an AWS CloudFront Origin Access Control.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudfront_origin_access_control
+
+Manages an AWS CloudFront Origin Access Control, which is used by CloudFront Distributions with an Amazon S3 bucket as the origin.
+
+Read more about Origin Access Control in the [CloudFront Developer Guide](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-s3.html).
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudfront_origin_access_control import CloudfrontOriginAccessControl
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        CloudfrontOriginAccessControl(self, "example",
+            description="Example Policy",
+            name="example",
+            origin_access_control_origin_type="s3",
+            signing_behavior="always",
+            signing_protocol="sigv4"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) A name that identifies the Origin Access Control.
+* `description` - (Optional) The description of the Origin Access Control. Defaults to "Managed by Terraform" if omitted.
+* `origin_access_control_origin_type` - (Required) The type of origin that this Origin Access Control is for. Valid values are `s3`, and `mediastore`.
+* `signing_behavior` - (Required) Specifies which requests CloudFront signs. Specify `always` for the most common use case. Allowed values: `always`, `never`, and `no-override`.
+* `signing_protocol` - (Required) Determines how CloudFront signs (authenticates) requests. The only valid value is `sigv4`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The unique identifier of this Origin Access Control.
+* `etag` - The current version of this Origin Access Control.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudFront Origin Access Control using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import CloudFront Origin Access Control using the `id`. For example:
+
+```console
+% terraform import aws_cloudfront_origin_access_control.example E327GJI25M56DG
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ebc51b864ba0cfb9ad22453d6e45a68aee5f617744805baea102f871af18ab56 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/cloudfront_origin_access_identity.html.markdown b/website/docs/cdktf/python/r/cloudfront_origin_access_identity.html.markdown
new file mode 100644
index 00000000000..6065ba60378
--- /dev/null
+++ b/website/docs/cdktf/python/r/cloudfront_origin_access_identity.html.markdown
@@ -0,0 +1,161 @@
+---
+subcategory: "CloudFront"
+layout: "aws"
+page_title: "AWS: aws_cloudfront_origin_access_identity"
+description: |-
+  Provides a CloudFront origin access identity.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudfront_origin_access_identity
+
+Creates an Amazon CloudFront origin access identity.
+
+For information about CloudFront distributions, see the
+[Amazon CloudFront Developer Guide][1]. For more information on generating
+origin access identities, see
+[Using an Origin Access Identity to Restrict Access to Your Amazon S3 Content][2].
+
+## Example Usage
+
+The following example below creates a CloudFront origin access identity.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudfront_origin_access_identity import CloudfrontOriginAccessIdentity
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        CloudfrontOriginAccessIdentity(self, "example",
+            comment="Some comment"
+        )
+```
+
+## Argument Reference
+
+* `comment` (Optional) - An optional comment for the origin access identity.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The identifier for the distribution. For example: `EDFDVBD632BHDS5`.
+* `caller_reference` - Internal value used by CloudFront to allow future
+   updates to the origin access identity.
+* `cloudfront_access_identity_path` - A shortcut to the full path for the
+   origin access identity to use in CloudFront, see below.
+* `etag` - The current version of the origin access identity's information.
+   For example: `E2QWRUHAPOMQZL`.
+* `iam_arn` - A pre-generated ARN for use in S3 bucket policies (see below).
+   Example: `arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity
+ E2QWRUHAPOMQZL`.
+* `s3_canonical_user_id` - The Amazon S3 canonical user ID for the origin
+   access identity, which you use when giving the origin access identity read
+   permission to an object in Amazon S3.
+
+## Using With CloudFront
+
+Normally, when referencing an origin access identity in CloudFront, you need to
+prefix the ID with the `origin-access-identity/cloudfront/` special path.
+The `cloudfront_access_identity_path` allows this to be circumvented.
+The below snippet demonstrates use with the `s3_origin_config` structure for the
+[`aws_cloudfront_distribution`][3] resource:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudfront_distribution import CloudfrontDistribution
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, domainName, originId, defaultCacheBehavior, enabled, restrictions, viewerCertificate):
+        super().__init__(scope, name)
+        CloudfrontDistribution(self, "example",
+            origin=[CloudfrontDistributionOrigin(
+                s3_origin_config=CloudfrontDistributionOriginS3OriginConfig(
+                    origin_access_identity=Token.as_string(aws_cloudfront_origin_access_identity_example.cloudfront_access_identity_path)
+                ),
+                domain_name=domain_name,
+                origin_id=origin_id
+            )
+            ],
+            default_cache_behavior=default_cache_behavior,
+            enabled=enabled,
+            restrictions=restrictions,
+            viewer_certificate=viewer_certificate
+        )
+```
+
+### Updating your bucket policy
+
+Note that the AWS API may translate the `s3_canonical_user_id` `CanonicalUser`
+principal into an `AWS` IAM ARN principal when supplied in an
+[`aws_s3_bucket`][4] bucket policy, causing spurious diffs in Terraform. If
+you see this behaviour, use the `iam_arn` instead:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.s3_bucket_policy import S3BucketPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        s3_policy = DataAwsIamPolicyDocument(self, "s3_policy",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["s3:GetObject"],
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=[example.iam_arn],
+                    type="AWS"
+                )
+                ],
+                resources=["${" + aws_s3_bucket_example.arn + "}/*"]
+            )
+            ]
+        )
+        S3BucketPolicy(self, "example",
+            bucket=Token.as_string(aws_s3_bucket_example.id),
+            policy=Token.as_string(s3_policy.json)
+        )
+```
+
+[1]: http://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Introduction.html
+[2]: http://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-s3.html
+[3]: /docs/providers/aws/r/cloudfront_distribution.html
+[4]: /docs/providers/aws/r/s3_bucket.html
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Cloudfront Origin Access Identities using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Cloudfront Origin Access Identities using the `id`. For example:
+
+```console
+% terraform import aws_cloudfront_origin_access_identity.origin_access E74FTE3AEXAMPLE
+```
+
+<!-- cache-key: cdktf-0.18.0 input-233a1ba59fc5b72e6eab9f06e063242d771c0defae3bd21f603123c05ec4d160 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/cloudfront_origin_request_policy.html.markdown b/website/docs/cdktf/python/r/cloudfront_origin_request_policy.html.markdown
new file mode 100644
index 00000000000..98d6fe0be5f
--- /dev/null
+++ b/website/docs/cdktf/python/r/cloudfront_origin_request_policy.html.markdown
@@ -0,0 +1,108 @@
+---
+subcategory: "CloudFront"
+layout: "aws"
+page_title: "AWS: aws_cloudfront_origin_request_policy"
+description: |-
+  Determines the values that CloudFront includes in requests that it sends to the origin.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudfront_origin_request_policy
+
+## Example Usage
+
+The following example below creates a CloudFront origin request policy.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudfront_origin_request_policy import CloudfrontOriginRequestPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        CloudfrontOriginRequestPolicy(self, "example",
+            comment="example comment",
+            cookies_config=CloudfrontOriginRequestPolicyCookiesConfig(
+                cookie_behavior="whitelist",
+                cookies=CloudfrontOriginRequestPolicyCookiesConfigCookies(
+                    items=["example"]
+                )
+            ),
+            headers_config=CloudfrontOriginRequestPolicyHeadersConfig(
+                header_behavior="whitelist",
+                headers=CloudfrontOriginRequestPolicyHeadersConfigHeaders(
+                    items=["example"]
+                )
+            ),
+            name="example-policy",
+            query_strings_config=CloudfrontOriginRequestPolicyQueryStringsConfig(
+                query_string_behavior="whitelist",
+                query_strings=CloudfrontOriginRequestPolicyQueryStringsConfigQueryStrings(
+                    items=["example"]
+                )
+            )
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) Unique name to identify the origin request policy.
+* `comment` - (Optional) Comment to describe the origin request policy.
+* `cookies_config` - (Required) Object that determines whether any cookies in viewer requests (and if so, which cookies) are included in the origin request key and automatically included in requests that CloudFront sends to the origin. See [Cookies Config](#cookies-config) for more information.
+* `headers_config` - (Required) Object that determines whether any HTTP headers (and if so, which headers) are included in the origin request key and automatically included in requests that CloudFront sends to the origin. See [Headers Config](#headers-config) for more information.
+* `query_strings_config` - (Required) Object that determines whether any URL query strings in viewer requests (and if so, which query strings) are included in the origin request key and automatically included in requests that CloudFront sends to the origin. See [Query String Config](#query-string-config) for more information.
+
+### Cookies Config
+
+`cookie_behavior` - (Required) Determines whether any cookies in viewer requests are included in the origin request key and automatically included in requests that CloudFront sends to the origin. Valid values are `none`, `whitelist`, `all`, `allExcept`.
+`cookies` - (Optional) Object that contains a list of cookie names. See [Items](#items) for more information.
+
+### Headers Config
+
+`header_behavior` - (Required) Determines whether any HTTP headers are included in the origin request key and automatically included in requests that CloudFront sends to the origin. Valid values are `none`, `whitelist`, `allViewer`, `allViewerAndWhitelistCloudFront`, `allExcept`.
+`headers` - (Optional) Object that contains a list of header names. See [Items](#items) for more information.
+
+### Query String Config
+
+`query_string_behavior` - (Required) Determines whether any URL query strings in viewer requests are included in the origin request key and automatically included in requests that CloudFront sends to the origin. Valid values are `none`, `whitelist`, `all`, `allExcept`.
+`query_strings` - (Optional) Object that contains a list of query string names. See [Items](#items) for more information.
+
+### Items
+
+`items` - (Required) List of item names (cookies, headers, or query strings).
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `etag` - The current version of the origin request policy.
+* `id` - The identifier for the origin request policy.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Cloudfront Origin Request Policies using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Cloudfront Origin Request Policies using the `id`. For example:
+
+```console
+% terraform import aws_cloudfront_origin_request_policy.policy ccca32ef-dce3-4df3-80df-1bd3000bc4d3
+```
+
+<!-- cache-key: cdktf-0.18.0 input-2bef7bc4558d3ce6ae66dcd3bb9da0419f06c50e2e3848dabc38af31c3b16d3b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/cloudfront_public_key.html.markdown b/website/docs/cdktf/python/r/cloudfront_public_key.html.markdown
new file mode 100644
index 00000000000..1c0590fe69c
--- /dev/null
+++ b/website/docs/cdktf/python/r/cloudfront_public_key.html.markdown
@@ -0,0 +1,74 @@
+---
+subcategory: "CloudFront"
+layout: "aws"
+page_title: "AWS: aws_cloudfront_public_key"
+description: |-
+  Provides a CloudFront Public Key which you add to CloudFront to use with features like field-level encryption.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudfront_public_key
+
+## Example Usage
+
+The following example below creates a CloudFront public key.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudfront_public_key import CloudfrontPublicKey
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        CloudfrontPublicKey(self, "example",
+            comment="test public key",
+            encoded_key=Token.as_string(Fn.file("public_key.pem")),
+            name="test_key"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `comment` - (Optional) An optional comment about the public key.
+* `encoded_key` - (Required) The encoded public key that you want to add to CloudFront to use with features like field-level encryption.
+* `name` - (Optional) The name for the public key. By default generated by Terraform.
+* `name_prefix` - (Optional) The name for the public key. Conflicts with `name`.
+
+**NOTE:** When setting `encoded_key` value, there needs a newline at the end of string. Otherwise, multiple runs of terraform will want to recreate the `aws_cloudfront_public_key` resource.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `caller_reference` - Internal value used by CloudFront to allow future updates to the public key configuration.
+* `etag` - The current version of the public key. For example: `E2QWRUHAPOMQZL`.
+* `id` - The identifier for the public key. For example: `K3D5EWEUDCCXON`.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudFront Public Key using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import CloudFront Public Key using the `id`. For example:
+
+```console
+% terraform import aws_cloudfront_public_key.example K3D5EWEUDCCXON
+```
+
+<!-- cache-key: cdktf-0.18.0 input-94d904f4fccc2abfc5cddc1442837a48d3cf0fcd0480a05c448d4736bae1203a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/cloudfront_realtime_log_config.html.markdown b/website/docs/cdktf/python/r/cloudfront_realtime_log_config.html.markdown
new file mode 100644
index 00000000000..b4c45ac0468
--- /dev/null
+++ b/website/docs/cdktf/python/r/cloudfront_realtime_log_config.html.markdown
@@ -0,0 +1,130 @@
+---
+subcategory: "CloudFront"
+layout: "aws"
+page_title: "AWS: aws_cloudfront_realtime_log_config"
+description: |-
+  Provides a CloudFront real-time log configuration resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudfront_realtime_log_config
+
+Provides a CloudFront real-time log configuration resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudfront_realtime_log_config import CloudfrontRealtimeLogConfig
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.iam_role import IamRole
+from imports.aws.iam_role_policy import IamRolePolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        assume_role = DataAwsIamPolicyDocument(self, "assume_role",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["sts:AssumeRole"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["cloudfront.amazonaws.com"],
+                    type="Service"
+                )
+                ]
+            )
+            ]
+        )
+        example = DataAwsIamPolicyDocument(self, "example",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["kinesis:DescribeStreamSummary", "kinesis:DescribeStream", "kinesis:PutRecord", "kinesis:PutRecords"
+                ],
+                effect="Allow",
+                resources=[Token.as_string(aws_kinesis_stream_example.arn)]
+            )
+            ]
+        )
+        aws_iam_role_example = IamRole(self, "example_2",
+            assume_role_policy=Token.as_string(assume_role.json),
+            name="cloudfront-realtime-log-config-example"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_role_example.override_logical_id("example")
+        aws_iam_role_policy_example = IamRolePolicy(self, "example_3",
+            name="cloudfront-realtime-log-config-example",
+            policy=Token.as_string(example.json),
+            role=Token.as_string(aws_iam_role_example.id)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_role_policy_example.override_logical_id("example")
+        aws_cloudfront_realtime_log_config_example =
+        CloudfrontRealtimeLogConfig(self, "example_4",
+            depends_on=[aws_iam_role_policy_example],
+            endpoint=CloudfrontRealtimeLogConfigEndpoint(
+                kinesis_stream_config=CloudfrontRealtimeLogConfigEndpointKinesisStreamConfig(
+                    role_arn=Token.as_string(aws_iam_role_example.arn),
+                    stream_arn=Token.as_string(aws_kinesis_stream_example.arn)
+                ),
+                stream_type="Kinesis"
+            ),
+            fields=["timestamp", "c-ip"],
+            name="example",
+            sampling_rate=75
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_cloudfront_realtime_log_config_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `endpoint` - (Required) The Amazon Kinesis data streams where real-time log data is sent.
+* `fields` - (Required) The fields that are included in each real-time log record. See the [AWS documentation](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/real-time-logs.html#understand-real-time-log-config-fields) for supported values.
+* `name` - (Required) The unique name to identify this real-time log configuration.
+* `sampling_rate` - (Required) The sampling rate for this real-time log configuration. The sampling rate determines the percentage of viewer requests that are represented in the real-time log data. An integer between `1` and `100`, inclusive.
+
+The `endpoint` object supports the following:
+
+* `kinesis_stream_config` - (Required) The Amazon Kinesis data stream configuration.
+* `stream_type` - (Required) The type of data stream where real-time log data is sent. The only valid value is `Kinesis`.
+
+The `kinesis_stream_config` object supports the following:
+
+* `role_arn` - (Required) The ARN of an [IAM role](iam_role.html) that CloudFront can use to send real-time log data to the Kinesis data stream.
+See the [AWS documentation](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/real-time-logs.html#understand-real-time-log-config-iam-role) for more information.
+* `stream_arn` - (Required) The ARN of the [Kinesis data stream](kinesis_stream.html).
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the CloudFront real-time log configuration.
+* `arn` - The ARN (Amazon Resource Name) of the CloudFront real-time log configuration.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudFront real-time log configurations using the ARN. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import CloudFront real-time log configurations using the ARN. For example:
+
+```console
+% terraform import aws_cloudfront_realtime_log_config.example arn:aws:cloudfront::111122223333:realtime-log-config/ExampleNameForRealtimeLogConfig
+```
+
+<!-- cache-key: cdktf-0.18.0 input-be02677fb3ad25ac1055ce131b85e8c78a124b0a2ec359c977c007200fc38e11 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/cloudfront_response_headers_policy.html.markdown b/website/docs/cdktf/python/r/cloudfront_response_headers_policy.html.markdown
new file mode 100644
index 00000000000..03c21fbb8d8
--- /dev/null
+++ b/website/docs/cdktf/python/r/cloudfront_response_headers_policy.html.markdown
@@ -0,0 +1,220 @@
+---
+subcategory: "CloudFront"
+layout: "aws"
+page_title: "AWS: aws_cloudfront_response_headers_policy"
+description: |-
+  Provides a CloudFront response headers policy resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudfront_response_headers_policy
+
+Provides a CloudFront response headers policy resource.
+A response headers policy contains information about a set of HTTP response headers and their values.
+After you create a response headers policy, you can use its ID to attach it to one or more cache behaviors in a CloudFront distribution.
+When it’s attached to a cache behavior, CloudFront adds the headers in the policy to every response that it sends for requests that match the cache behavior.
+
+## Example Usage
+
+The example below creates a CloudFront response headers policy.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudfront_response_headers_policy import CloudfrontResponseHeadersPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        CloudfrontResponseHeadersPolicy(self, "example",
+            comment="test comment",
+            cors_config=CloudfrontResponseHeadersPolicyCorsConfig(
+                access_control_allow_credentials=True,
+                access_control_allow_headers=CloudfrontResponseHeadersPolicyCorsConfigAccessControlAllowHeaders(
+                    items=["test"]
+                ),
+                access_control_allow_methods=CloudfrontResponseHeadersPolicyCorsConfigAccessControlAllowMethods(
+                    items=["GET"]
+                ),
+                access_control_allow_origins=CloudfrontResponseHeadersPolicyCorsConfigAccessControlAllowOrigins(
+                    items=["test.example.comtest"]
+                ),
+                origin_override=True
+            ),
+            name="example-policy"
+        )
+```
+
+The example below creates a CloudFront response headers policy with a custom headers config.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudfront_response_headers_policy import CloudfrontResponseHeadersPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        CloudfrontResponseHeadersPolicy(self, "example",
+            custom_headers_config=CloudfrontResponseHeadersPolicyCustomHeadersConfig(
+                items=[CloudfrontResponseHeadersPolicyCustomHeadersConfigItems(
+                    header="X-Permitted-Cross-Domain-Policies",
+                    override=True,
+                    value="none"
+                ), CloudfrontResponseHeadersPolicyCustomHeadersConfigItems(
+                    header="X-Test",
+                    override=True,
+                    value="none"
+                )
+                ]
+            ),
+            name="example-headers-policy"
+        )
+```
+
+The example below creates a CloudFront response headers policy with a custom headers config and server timing headers config.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudfront_response_headers_policy import CloudfrontResponseHeadersPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        CloudfrontResponseHeadersPolicy(self, "example",
+            custom_headers_config=CloudfrontResponseHeadersPolicyCustomHeadersConfig(
+                items=[CloudfrontResponseHeadersPolicyCustomHeadersConfigItems(
+                    header="X-Permitted-Cross-Domain-Policies",
+                    override=True,
+                    value="none"
+                )
+                ]
+            ),
+            name="example-headers-policy",
+            server_timing_headers_config=CloudfrontResponseHeadersPolicyServerTimingHeadersConfig(
+                enabled=True,
+                sampling_rate=50
+            )
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) A unique name to identify the response headers policy.
+* `comment` - (Optional) A comment to describe the response headers policy. The comment cannot be longer than 128 characters.
+* `cors_config` - (Optional) A configuration for a set of HTTP response headers that are used for Cross-Origin Resource Sharing (CORS). See [Cors Config](#cors-config) for more information.
+* `custom_headers_config` - (Optional) Object that contains an attribute `items` that contains a list of custom headers. See [Custom Header](#custom-header) for more information.
+* `remove_headers_config` - (Optional) A configuration for a set of HTTP headers to remove from the HTTP response. Object that contains an attribute `items` that contains a list of headers. See [Remove Header](#remove-header) for more information.
+* `security_headers_config` - (Optional) A configuration for a set of security-related HTTP response headers. See [Security Headers Config](#security-headers-config) for more information.
+* `server_timing_headers_config` - (Optional) A configuration for enabling the Server-Timing header in HTTP responses sent from CloudFront. See [Server Timing Headers Config](#server-timing-headers-config) for more information.
+
+### Cors Config
+
+* `access_control_allow_credentials` - (Required) A Boolean value that CloudFront uses as the value for the `Access-Control-Allow-Credentials` HTTP response header.
+* `access_control_allow_headers` - (Required) Object that contains an attribute `items` that contains a list of HTTP header names that CloudFront includes as values for the `Access-Control-Allow-Headers` HTTP response header.
+* `access_control_allow_methods` - (Required) Object that contains an attribute `items` that contains a list of HTTP methods that CloudFront includes as values for the `Access-Control-Allow-Methods` HTTP response header. Valid values: `GET` | `POST` | `OPTIONS` | `PUT` | `DELETE` | `HEAD` | `ALL`
+* `access_control_allow_origins` - (Required) Object that contains an attribute `items` that contains a list of origins that CloudFront can use as the value for the `Access-Control-Allow-Origin` HTTP response header.
+* `access_control_expose_headers` - (Optional) Object that contains an attribute `items` that contains a list of HTTP headers that CloudFront includes as values for the `Access-Control-Expose-Headers` HTTP response header.
+* `access_control_max_age_sec` - (Optional) A number that CloudFront uses as the value for the `Access-Control-Max-Age` HTTP response header.
+* `origin_override` - (Required) A Boolean value that determines how CloudFront behaves for the HTTP response header.
+
+### Custom Header
+
+* `header` - (Required) The HTTP response header name.
+* `override` - (Required) Whether CloudFront overrides a response header with the same name received from the origin with the header specifies here.
+* `value` - (Required) The value for the HTTP response header.
+
+### Remove Header
+
+* `header` - (Required) The HTTP header name.
+
+### Security Headers Config
+
+* `content_security_policy` - (Optional) The policy directives and their values that CloudFront includes as values for the `Content-Security-Policy` HTTP response header. See [Content Security Policy](#content-security-policy) for more information.
+* `content_type_options` - (Optional) Determines whether CloudFront includes the `X-Content-Type-Options` HTTP response header with its value set to `nosniff`. See [Content Type Options](#content-type-options) for more information.
+* `frame_options` - (Optional) Determines whether CloudFront includes the `X-Frame-Options` HTTP response header and the header’s value. See [Frame Options](#frame-options) for more information.
+* `referrer_policy` - (Optional) Determines whether CloudFront includes the `Referrer-Policy` HTTP response header and the header’s value. See [Referrer Policy](#referrer-policy) for more information.
+* `strict_transport_security` - (Optional) Determines whether CloudFront includes the `Strict-Transport-Security` HTTP response header and the header’s value. See [Strict Transport Security](#strict-transport-security) for more information.
+* `xss_protection` - (Optional) Determine whether CloudFront includes the `X-XSS-Protection` HTTP response header and the header’s value. See [XSS Protection](#xss-protection) for more information.
+
+### Content Security Policy
+
+* `content_security_policy` - (Required) The policy directives and their values that CloudFront includes as values for the `Content-Security-Policy` HTTP response header.
+* `override` - (Required) Whether CloudFront overrides the `Content-Security-Policy` HTTP response header received from the origin with the one specified in this response headers policy.
+
+### Content Type Options
+
+* `override` - (Required) Whether CloudFront overrides the `X-Content-Type-Options` HTTP response header received from the origin with the one specified in this response headers policy.
+
+### Frame Options
+
+* `frame_option` - (Required) The value of the `X-Frame-Options` HTTP response header. Valid values: `DENY` | `SAMEORIGIN`
+* `override` - (Required) Whether CloudFront overrides the `X-Frame-Options` HTTP response header received from the origin with the one specified in this response headers policy.
+
+### Referrer Policy
+
+* `referrer_policy` - (Required) The value of the `Referrer-Policy` HTTP response header. Valid Values: `no-referrer` | `no-referrer-when-downgrade` | `origin` | `origin-when-cross-origin` | `same-origin` | `strict-origin` | `strict-origin-when-cross-origin` | `unsafe-url`
+* `override` - (Required) Whether CloudFront overrides the `Referrer-Policy` HTTP response header received from the origin with the one specified in this response headers policy.
+
+### Strict Transport Security
+
+* `access_control_max_age_sec` - (Required) A number that CloudFront uses as the value for the `max-age` directive in the `Strict-Transport-Security` HTTP response header.
+* `include_subdomains` - (Optional) Whether CloudFront includes the `includeSubDomains` directive in the `Strict-Transport-Security` HTTP response header.
+* `override` - (Required) Whether CloudFront overrides the `Strict-Transport-Security` HTTP response header received from the origin with the one specified in this response headers policy.
+* `preload` - (Optional) Whether CloudFront includes the `preload` directive in the `Strict-Transport-Security` HTTP response header.
+
+### XSS Protection
+
+* `mode_block` - (Optional) Whether CloudFront includes the `mode=block` directive in the `X-XSS-Protection` header.
+* `override` - (Required) Whether CloudFront overrides the `X-XSS-Protection` HTTP response header received from the origin with the one specified in this response headers policy.
+* `protection` - (Required) A Boolean value that determines the value of the `X-XSS-Protection` HTTP response header. When this setting is `true`, the value of the `X-XSS-Protection` header is `1`. When this setting is `false`, the value of the `X-XSS-Protection` header is `0`.
+* `report_uri` - (Optional) A reporting URI, which CloudFront uses as the value of the report directive in the `X-XSS-Protection` header. You cannot specify a `report_uri` when `mode_block` is `true`.
+
+### Server Timing Headers Config
+
+* `enabled` - (Required) A Whether CloudFront adds the `Server-Timing` header to HTTP responses that it sends in response to requests that match a cache behavior that's associated with this response headers policy.
+* `sampling_rate` - (Required) A number 0–100 (inclusive) that specifies the percentage of responses that you want CloudFront to add the Server-Timing header to. Valid range: Minimum value of 0.0. Maximum value of 100.0.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `etag` - The current version of the response headers policy.
+* `id` - The identifier for the response headers policy.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Cloudfront Response Headers Policies using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Cloudfront Response Headers Policies using the `id`. For example:
+
+```console
+% terraform import aws_cloudfront_response_headers_policy.policy 658327ea-f89d-4fab-a63d-7e88639e58f9
+```
+
+<!-- cache-key: cdktf-0.18.0 input-15a6be73fafecd64814710cc46b232493b1b75d7043901288106fe05e9584aec -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/cloudhsm_v2_cluster.html.markdown b/website/docs/cdktf/python/r/cloudhsm_v2_cluster.html.markdown
new file mode 100644
index 00000000000..7f6c9ab7f09
--- /dev/null
+++ b/website/docs/cdktf/python/r/cloudhsm_v2_cluster.html.markdown
@@ -0,0 +1,128 @@
+---
+subcategory: "CloudHSM"
+layout: "aws"
+page_title: "AWS: aws_cloudhsm_v2_cluster"
+description: |-
+  Provides a CloudHSM v2 resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudhsm_v2_cluster
+
+Creates an Amazon CloudHSM v2 cluster.
+
+For information about CloudHSM v2, see the
+[AWS CloudHSM User Guide][1] and the [Amazon
+CloudHSM API Reference][2].
+
+~> **NOTE:** A CloudHSM Cluster can take several minutes to set up.
+Practically no single attribute can be updated, except for `tags`.
+If you need to delete a cluster, you have to remove its HSM modules first.
+To initialize cluster, you have to add an HSM instance to the cluster, then sign CSR and upload it.
+
+## Example Usage
+
+The following example below creates a CloudHSM cluster.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformCount, Fn, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudhsm_v2_cluster import CloudhsmV2Cluster
+from imports.aws.data_aws_availability_zones import DataAwsAvailabilityZones
+from imports.aws.provider import AwsProvider
+from imports.aws.subnet import Subnet
+from imports.aws.vpc import Vpc
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AwsProvider(self, "aws",
+            region=aws_region.string_value
+        )
+        cloudhsm_v2_vpc = Vpc(self, "cloudhsm_v2_vpc",
+            cidr_block="10.0.0.0/16",
+            tags={
+                "Name": "example-aws_cloudhsm_v2_cluster"
+            }
+        )
+        available = DataAwsAvailabilityZones(self, "available")
+        # In most cases loops should be handled in the programming language context and
+        #     not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+        #     you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+        #     you need to keep this like it is.
+        cloudhsm_v2_subnets_count = TerraformCount.of(Token.as_number("2"))
+        cloudhsm_v2_subnets = Subnet(self, "cloudhsm_v2_subnets",
+            availability_zone=Token.as_string(
+                Fn.element(available.names,
+                    Token.as_number(cloudhsm_v2_subnets_count.index))),
+            cidr_block=Token.as_string(
+                Fn.element(subnets.value, Token.as_number(cloudhsm_v2_subnets_count.index))),
+            map_public_ip_on_launch=False,
+            tags={
+                "Name": "example-aws_cloudhsm_v2_cluster"
+            },
+            vpc_id=cloudhsm_v2_vpc.id,
+            count=cloudhsm_v2_subnets_count
+        )
+        CloudhsmV2Cluster(self, "cloudhsm_v2_cluster",
+            hsm_type="hsm1.medium",
+            subnet_ids=Token.as_list(Fn.lookup_nested(cloudhsm_v2_subnets, ["*", "id"])),
+            tags={
+                "Name": "example-aws_cloudhsm_v2_cluster"
+            }
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `source_backup_identifier` - (Optional) ID of Cloud HSM v2 cluster backup to be restored.
+* `hsm_type` - (Required) The type of HSM module in the cluster. Currently, only `hsm1.medium` is supported.
+* `subnet_ids` - (Required) The IDs of subnets in which cluster will operate.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `cluster_id` - The id of the CloudHSM cluster.
+* `cluster_state` - The state of the CloudHSM cluster.
+* `vpc_id` - The id of the VPC that the CloudHSM cluster resides in.
+* `security_group_id` - The ID of the security group associated with the CloudHSM cluster.
+* `cluster_certificates` - The list of cluster certificates.
+    * `cluster_certificates.0.cluster_certificate` - The cluster certificate issued (signed) by the issuing certificate authority (CA) of the cluster's owner.
+    * `cluster_certificates.0.cluster_csr` - The certificate signing request (CSR). Available only in `UNINITIALIZED` state after an HSM instance is added to the cluster.
+    * `cluster_certificates.0.aws_hardware_certificate` - The HSM hardware certificate issued (signed) by AWS CloudHSM.
+    * `cluster_certificates.0.hsm_certificate` - The HSM certificate issued (signed) by the HSM hardware.
+    * `cluster_certificates.0.manufacturer_hardware_certificate` - The HSM hardware certificate issued (signed) by the hardware manufacturer.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+[1]: https://docs.aws.amazon.com/cloudhsm/latest/userguide/introduction.html
+[2]: https://docs.aws.amazon.com/cloudhsm/latest/APIReference/Welcome.html
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudHSM v2 Clusters using the cluster `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import CloudHSM v2 Clusters using the cluster `id`. For example:
+
+```console
+% terraform import aws_cloudhsm_v2_cluster.test_cluster cluster-aeb282a201
+```
+
+<!-- cache-key: cdktf-0.18.0 input-60608d99ff28e60f3d4ab022d7e83a5948556613036f369878a80719c7316ce2 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/cloudhsm_v2_hsm.html.markdown b/website/docs/cdktf/python/r/cloudhsm_v2_hsm.html.markdown
new file mode 100644
index 00000000000..c549df67d6e
--- /dev/null
+++ b/website/docs/cdktf/python/r/cloudhsm_v2_hsm.html.markdown
@@ -0,0 +1,79 @@
+---
+subcategory: "CloudHSM"
+layout: "aws"
+page_title: "AWS: aws_cloudhsm_v2_hsm"
+description: |-
+  Provides a CloudHSM v2 HSM module resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudhsm_v2_hsm
+
+Creates an HSM module in Amazon CloudHSM v2 cluster.
+
+## Example Usage
+
+The following example below creates an HSM module in CloudHSM cluster.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, Fn, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudhsm_v2_hsm import CloudhsmV2Hsm
+from imports.aws.data_aws_cloudhsm_v2_cluster import DataAwsCloudhsmV2Cluster
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        cluster = DataAwsCloudhsmV2Cluster(self, "cluster",
+            cluster_id=cloudhsm_cluster_id.string_value
+        )
+        CloudhsmV2Hsm(self, "cloudhsm_v2_hsm",
+            cluster_id=Token.as_string(cluster.cluster_id),
+            subnet_id=Token.as_string(Fn.lookup_nested(cluster.subnet_ids, ["0"]))
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+~> **NOTE:** Either `subnet_id` or `availability_zone` must be specified.
+
+* `cluster_id` - (Required) The ID of Cloud HSM v2 cluster to which HSM will be added.
+* `subnet_id` - (Optional) The ID of subnet in which HSM module will be located. Conflicts with `availability_zone`.
+* `availability_zone` - (Optional) The IDs of AZ in which HSM module will be located. Conflicts with `subnet_id`.
+* `ip_address` - (Optional) The IP address of HSM module. Must be within the CIDR of selected subnet.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `hsm_id` - The id of the HSM module.
+* `hsm_state` - The state of the HSM module.
+* `hsm_eni_id` - The id of the ENI interface allocated for HSM module.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import HSM modules using their HSM ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import HSM modules using their HSM ID. For example:
+
+```console
+% terraform import aws_cloudhsm_v2_hsm.bar hsm-quo8dahtaca
+```
+
+<!-- cache-key: cdktf-0.18.0 input-3969951d1910a8cfdfc7ba1e038e8b5797479bc0a89a46b5174ec4142d750a5c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/cloudsearch_domain.html.markdown b/website/docs/cdktf/python/r/cloudsearch_domain.html.markdown
new file mode 100644
index 00000000000..a4527ac4661
--- /dev/null
+++ b/website/docs/cdktf/python/r/cloudsearch_domain.html.markdown
@@ -0,0 +1,133 @@
+---
+subcategory: "CloudSearch"
+layout: "aws"
+page_title: "AWS: aws_cloudsearch_domain"
+description: |-
+  Provides an CloudSearch domain resource. 
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudsearch_domain
+
+Provides an CloudSearch domain resource.
+
+Terraform waits for the domain to become `Active` when applying a configuration.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudsearch_domain import CloudsearchDomain
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        CloudsearchDomain(self, "example",
+            index_field=[CloudsearchDomainIndexField(
+                analysis_scheme="_en_default_",
+                highlight=False,
+                name="headline",
+                return=True,
+                search=True,
+                sort=True,
+                type="text"
+            ), CloudsearchDomainIndexField(
+                facet=True,
+                name="price",
+                return=True,
+                search=True,
+                sort=True,
+                source_fields="headline",
+                type="double"
+            )
+            ],
+            name="example-domain",
+            scaling_parameters=CloudsearchDomainScalingParameters(
+                desired_instance_type="search.medium"
+            )
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `endpoint_options` - (Optional) Domain endpoint options. Documented below.
+* `index_field` - (Optional) The index fields for documents added to the domain. Documented below.
+* `multi_az` - (Optional) Whether or not to maintain extra instances for the domain in a second Availability Zone to ensure high availability.
+* `name` - (Required) The name of the CloudSearch domain.
+* `scaling_parameters` - (Optional) Domain scaling parameters. Documented below.
+
+### endpoint_options
+
+This configuration block supports the following attributes:
+
+* `enforce_https` - (Optional) Enables or disables the requirement that all requests to the domain arrive over HTTPS.
+* `tls_security_policy` - (Optional) The minimum required TLS version. See the [AWS documentation](https://docs.aws.amazon.com/cloudsearch/latest/developerguide/API_DomainEndpointOptions.html) for valid values.
+
+### scaling_parameters
+
+This configuration block supports the following attributes:
+
+* `desired_instance_type` - (Optional) The instance type that you want to preconfigure for your domain. See the [AWS documentation](https://docs.aws.amazon.com/cloudsearch/latest/developerguide/API_ScalingParameters.html) for valid values.
+* `desired_partition_count` - (Optional) The number of partitions you want to preconfigure for your domain. Only valid when you select `search.2xlarge` as the instance type.
+* `desired_replication_count` - (Optional) The number of replicas you want to preconfigure for each index partition.
+
+### index_field
+
+This configuration block supports the following attributes:
+
+* `name` - (Required) A unique name for the field. Field names must begin with a letter and be at least 3 and no more than 64 characters long. The allowed characters are: `a`-`z` (lower-case letters), `0`-`9`, and `_` (underscore). The name `score` is reserved and cannot be used as a field name.
+* `type` - (Required) The field type. Valid values: `date`, `date-array`, `double`, `double-array`, `int`, `int-array`, `literal`, `literal-array`, `text`, `text-array`.
+* `analysis_scheme` - (Optional) The analysis scheme you want to use for a `text` field. The analysis scheme specifies the language-specific text processing options that are used during indexing.
+* `default_value` - (Optional) The default value for the field. This value is used when no value is specified for the field in the document data.
+* `facet` - (Optional) You can get facet information by enabling this.
+* `highlight` - (Optional) You can highlight information.
+* `return` - (Optional) You can enable returning the value of all searchable fields.
+* `search` - (Optional) You can set whether this index should be searchable or not.
+* `sort` - (Optional) You can enable the property to be sortable.
+* `source_fields` - (Optional) A comma-separated list of source fields to map to the field. Specifying a source field copies data from one field to another, enabling you to use the same source data in different ways by configuring different options for the fields.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The domain's ARN.
+* `document_service_endpoint` - The service endpoint for updating documents in a search domain.
+* `domain_id` - An internally generated unique identifier for the domain.
+* `search_service_endpoint` - The service endpoint for requesting search results from a search domain.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `30m`)
+* `update` - (Default `30m`)
+* `delete` - (Default `20m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudSearch Domains using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import CloudSearch Domains using the `name`. For example:
+
+```console
+% terraform import aws_cloudsearch_domain.example example-domain
+```
+
+<!-- cache-key: cdktf-0.18.0 input-df7fa25a0a776188ea2cf1cb4023457fb311e8f2073fe09ae64b76245200a9e4 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/cloudsearch_domain_service_access_policy.html.markdown b/website/docs/cdktf/python/r/cloudsearch_domain_service_access_policy.html.markdown
new file mode 100644
index 00000000000..c0ad1b7635e
--- /dev/null
+++ b/website/docs/cdktf/python/r/cloudsearch_domain_service_access_policy.html.markdown
@@ -0,0 +1,103 @@
+---
+subcategory: "CloudSearch"
+layout: "aws"
+page_title: "AWS: aws_cloudsearch_domain_service_access_policy"
+description: |-
+  Provides an CloudSearch domain service access policy resource. 
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudsearch_domain_service_access_policy
+
+Provides an CloudSearch domain service access policy resource.
+
+Terraform waits for the domain service access policy to become `Active` when applying a configuration.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudsearch_domain import CloudsearchDomain
+from imports.aws.cloudsearch_domain_service_access_policy import CloudsearchDomainServiceAccessPolicy
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = CloudsearchDomain(self, "example",
+            name="example-domain"
+        )
+        data_aws_iam_policy_document_example = DataAwsIamPolicyDocument(self, "example_1",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["cloudsearch:search", "cloudsearch:document"],
+                condition=[DataAwsIamPolicyDocumentStatementCondition(
+                    test="IpAddress",
+                    values=["192.0.2.0/32"],
+                    variable="aws:SourceIp"
+                )
+                ],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["*"],
+                    type="*"
+                )
+                ],
+                sid="search_only"
+            )
+            ]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_iam_policy_document_example.override_logical_id("example")
+        aws_cloudsearch_domain_service_access_policy_example =
+        CloudsearchDomainServiceAccessPolicy(self, "example_2",
+            access_policy=Token.as_string(data_aws_iam_policy_document_example.json),
+            domain_name=example.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_cloudsearch_domain_service_access_policy_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `access_policy` - (Required) The access rules you want to configure. These rules replace any existing rules. See the [AWS documentation](https://docs.aws.amazon.com/cloudsearch/latest/developerguide/configuring-access.html) for details.
+* `domain_name` - (Required) The CloudSearch domain name the policy applies to.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `update` - (Default `20m`)
+* `delete` - (Default `20m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudSearch domain service access policies using the domain name. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import CloudSearch domain service access policies using the domain name. For example:
+
+```console
+% terraform import aws_cloudsearch_domain_service_access_policy.example example-domain
+```
+
+<!-- cache-key: cdktf-0.18.0 input-c2ebea6afae4e24a2fd5837f7a4fbdb9c6667ec6f7293e498314a0c3b1c43e87 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/cloudtrail.html.markdown b/website/docs/cdktf/python/r/cloudtrail.html.markdown
new file mode 100644
index 00000000000..f8768646b9e
--- /dev/null
+++ b/website/docs/cdktf/python/r/cloudtrail.html.markdown
@@ -0,0 +1,448 @@
+---
+subcategory: "CloudTrail"
+layout: "aws"
+page_title: "AWS: aws_cloudtrail"
+description: |-
+  Provides a CloudTrail resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudtrail
+
+Provides a CloudTrail resource.
+
+-> **Tip:** For a multi-region trail, this resource must be in the home region of the trail.
+
+-> **Tip:** For an organization trail, this resource must be in the master account of the organization.
+
+## Example Usage
+
+### Basic
+
+Enable CloudTrail to capture all compatible management events in region.
+For capturing events from services like IAM, `include_global_service_events` must be enabled.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudtrail import Cloudtrail
+from imports.aws.data_aws_caller_identity import DataAwsCallerIdentity
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.data_aws_partition import DataAwsPartition
+from imports.aws.data_aws_region import DataAwsRegion
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_policy import S3BucketPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = S3Bucket(self, "example",
+            bucket="tf-test-trail",
+            force_destroy=True
+        )
+        current = DataAwsCallerIdentity(self, "current")
+        data_aws_partition_current = DataAwsPartition(self, "current_2")
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_partition_current.override_logical_id("current")
+        data_aws_region_current = DataAwsRegion(self, "current_3")
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_region_current.override_logical_id("current")
+        aws_cloudtrail_example = Cloudtrail(self, "example_4",
+            include_global_service_events=False,
+            name="example",
+            s3_bucket_name=example.id,
+            s3_key_prefix="prefix"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_cloudtrail_example.override_logical_id("example")
+        data_aws_iam_policy_document_example = DataAwsIamPolicyDocument(self, "example_5",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["s3:GetBucketAcl"],
+                condition=[DataAwsIamPolicyDocumentStatementCondition(
+                    test="StringEquals",
+                    values=["arn:${" + data_aws_partition_current.partition + "}:cloudtrail:${" + data_aws_region_current.name + "}:${" + current.account_id + "}:trail/example"
+                    ],
+                    variable="aws:SourceArn"
+                )
+                ],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["cloudtrail.amazonaws.com"],
+                    type="Service"
+                )
+                ],
+                resources=[example.arn],
+                sid="AWSCloudTrailAclCheck"
+            ), DataAwsIamPolicyDocumentStatement(
+                actions=["s3:PutObject"],
+                condition=[DataAwsIamPolicyDocumentStatementCondition(
+                    test="StringEquals",
+                    values=["bucket-owner-full-control"],
+                    variable="s3:x-amz-acl"
+                ), DataAwsIamPolicyDocumentStatementCondition(
+                    test="StringEquals",
+                    values=["arn:${" + data_aws_partition_current.partition + "}:cloudtrail:${" + data_aws_region_current.name + "}:${" + current.account_id + "}:trail/example"
+                    ],
+                    variable="aws:SourceArn"
+                )
+                ],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["cloudtrail.amazonaws.com"],
+                    type="Service"
+                )
+                ],
+                resources=["${" + example.arn + "}/prefix/AWSLogs/${" + current.account_id + "}/*"
+                ],
+                sid="AWSCloudTrailWrite"
+            )
+            ]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_iam_policy_document_example.override_logical_id("example")
+        aws_s3_bucket_policy_example = S3BucketPolicy(self, "example_6",
+            bucket=example.id,
+            policy=Token.as_string(data_aws_iam_policy_document_example.json)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_policy_example.override_logical_id("example")
+```
+
+### Data Event Logging
+
+CloudTrail can log [Data Events](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.html) for certain services such as S3 objects and Lambda function invocations. Additional information about data event configuration can be found in the following links:
+
+* [CloudTrail API DataResource documentation](https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_DataResource.html) (for basic event selector).
+* [CloudTrail API AdvancedFieldSelector documentation](https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_AdvancedFieldSelector.html) (for advanced event selector).
+
+#### Logging All Lambda Function Invocations By Using Basic Event Selectors
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudtrail import Cloudtrail
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, name, s3BucketName):
+        super().__init__(scope, name)
+        Cloudtrail(self, "example",
+            event_selector=[CloudtrailEventSelector(
+                data_resource=[CloudtrailEventSelectorDataResource(
+                    type="AWS::Lambda::Function",
+                    values=["arn:aws:lambda"]
+                )
+                ],
+                include_management_events=True,
+                read_write_type="All"
+            )
+            ],
+            name=name,
+            s3_bucket_name=s3_bucket_name
+        )
+```
+
+#### Logging All S3 Object Events By Using Basic Event Selectors
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudtrail import Cloudtrail
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, name, s3BucketName):
+        super().__init__(scope, name)
+        Cloudtrail(self, "example",
+            event_selector=[CloudtrailEventSelector(
+                data_resource=[CloudtrailEventSelectorDataResource(
+                    type="AWS::S3::Object",
+                    values=["arn:aws:s3"]
+                )
+                ],
+                include_management_events=True,
+                read_write_type="All"
+            )
+            ],
+            name=name,
+            s3_bucket_name=s3_bucket_name
+        )
+```
+
+#### Logging Individual S3 Bucket Events By Using Basic Event Selectors
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudtrail import Cloudtrail
+from imports.aws.data_aws_s3_bucket import DataAwsS3Bucket
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, name, s3BucketName):
+        super().__init__(scope, name)
+        important_bucket = DataAwsS3Bucket(self, "important-bucket",
+            bucket="important-bucket"
+        )
+        Cloudtrail(self, "example",
+            event_selector=[CloudtrailEventSelector(
+                data_resource=[CloudtrailEventSelectorDataResource(
+                    type="AWS::S3::Object",
+                    values=["${" + important_bucket.arn + "}/"]
+                )
+                ],
+                include_management_events=True,
+                read_write_type="All"
+            )
+            ],
+            name=name,
+            s3_bucket_name=s3_bucket_name
+        )
+```
+
+#### Logging All S3 Object Events Except For Two S3 Buckets By Using Advanced Event Selectors
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudtrail import Cloudtrail
+from imports.aws.data_aws_s3_bucket import DataAwsS3Bucket
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, name, s3BucketName):
+        super().__init__(scope, name)
+        not_important_bucket1 = DataAwsS3Bucket(self, "not-important-bucket-1",
+            bucket="not-important-bucket-1"
+        )
+        not_important_bucket2 = DataAwsS3Bucket(self, "not-important-bucket-2",
+            bucket="not-important-bucket-2"
+        )
+        Cloudtrail(self, "example",
+            advanced_event_selector=[CloudtrailAdvancedEventSelector(
+                field_selector=[CloudtrailAdvancedEventSelectorFieldSelector(
+                    equal_to=["Data"],
+                    field="eventCategory"
+                ), CloudtrailAdvancedEventSelectorFieldSelector(
+                    field="resources.ARN",
+                    not_starts_with=["${" + not_important_bucket1.arn + "}/", "${" + not_important_bucket2.arn + "}/"
+                    ]
+                ), CloudtrailAdvancedEventSelectorFieldSelector(
+                    equal_to=["AWS::S3::Object"],
+                    field="resources.type"
+                )
+                ],
+                name="Log all S3 objects events except for two S3 buckets"
+            ), CloudtrailAdvancedEventSelector(
+                field_selector=[CloudtrailAdvancedEventSelectorFieldSelector(
+                    equal_to=["Management"],
+                    field="eventCategory"
+                )
+                ],
+                name="Log readOnly and writeOnly management events"
+            )
+            ],
+            name=name,
+            s3_bucket_name=s3_bucket_name
+        )
+```
+
+#### Logging Individual S3 Buckets And Specific Event Names By Using Advanced Event Selectors
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudtrail import Cloudtrail
+from imports.aws.data_aws_s3_bucket import DataAwsS3Bucket
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, name, s3BucketName):
+        super().__init__(scope, name)
+        important_bucket1 = DataAwsS3Bucket(self, "important-bucket-1",
+            bucket="important-bucket-1"
+        )
+        important_bucket2 = DataAwsS3Bucket(self, "important-bucket-2",
+            bucket="important-bucket-2"
+        )
+        important_bucket3 = DataAwsS3Bucket(self, "important-bucket-3",
+            bucket="important-bucket-3"
+        )
+        Cloudtrail(self, "example",
+            advanced_event_selector=[CloudtrailAdvancedEventSelector(
+                field_selector=[CloudtrailAdvancedEventSelectorFieldSelector(
+                    equal_to=["Data"],
+                    field="eventCategory"
+                ), CloudtrailAdvancedEventSelectorFieldSelector(
+                    equal_to=["PutObject", "DeleteObject"],
+                    field="eventName"
+                ), CloudtrailAdvancedEventSelectorFieldSelector(
+                    field="resources.ARN",
+                    starts_with=["${" + important_bucket1.arn + "}/", "${" + important_bucket2.arn + "}/"
+                    ]
+                ), CloudtrailAdvancedEventSelectorFieldSelector(
+                    equal_to=["false"],
+                    field="readOnly"
+                ), CloudtrailAdvancedEventSelectorFieldSelector(
+                    equal_to=["AWS::S3::Object"],
+                    field="resources.type"
+                )
+                ],
+                name="Log PutObject and DeleteObject events for two S3 buckets"
+            ), CloudtrailAdvancedEventSelector(
+                field_selector=[CloudtrailAdvancedEventSelectorFieldSelector(
+                    equal_to=["Data"],
+                    field="eventCategory"
+                ), CloudtrailAdvancedEventSelectorFieldSelector(
+                    field="eventName",
+                    starts_with=["Delete"]
+                ), CloudtrailAdvancedEventSelectorFieldSelector(
+                    equal_to=["${" + important_bucket3.arn + "}/important-prefix"],
+                    field="resources.ARN"
+                ), CloudtrailAdvancedEventSelectorFieldSelector(
+                    equal_to=["false"],
+                    field="readOnly"
+                ), CloudtrailAdvancedEventSelectorFieldSelector(
+                    equal_to=["AWS::S3::Object"],
+                    field="resources.type"
+                )
+                ],
+                name="Log Delete* events for one S3 bucket"
+            )
+            ],
+            name=name,
+            s3_bucket_name=s3_bucket_name
+        )
+```
+
+#### Sending Events to CloudWatch Logs
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudtrail import Cloudtrail
+from imports.aws.cloudwatch_log_group import CloudwatchLogGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, name, s3BucketName):
+        super().__init__(scope, name)
+        example = CloudwatchLogGroup(self, "example",
+            name="Example"
+        )
+        aws_cloudtrail_example = Cloudtrail(self, "example_1",
+            cloud_watch_logs_group_arn="${" + example.arn + "}:*",
+            name=name,
+            s3_bucket_name=s3_bucket_name
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_cloudtrail_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) Name of the trail.
+* `s3_bucket_name` - (Required) Name of the S3 bucket designated for publishing log files.
+
+The following arguments are optional:
+
+* `advanced_event_selector` - (Optional) Specifies an advanced event selector for enabling data event logging. Fields documented below. Conflicts with `event_selector`.
+* `cloud_watch_logs_group_arn` - (Optional) Log group name using an ARN that represents the log group to which CloudTrail logs will be delivered. Note that CloudTrail requires the Log Stream wildcard.
+* `cloud_watch_logs_role_arn` - (Optional) Role for the CloudWatch Logs endpoint to assume to write to a user’s log group.
+* `enable_log_file_validation` - (Optional) Whether log file integrity validation is enabled. Defaults to `false`.
+* `enable_logging` - (Optional) Enables logging for the trail. Defaults to `true`. Setting this to `false` will pause logging.
+* `event_selector` - (Optional) Specifies an event selector for enabling data event logging. Fields documented below. Please note the [CloudTrail limits](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/WhatIsCloudTrail-Limits.html) when configuring these. Conflicts with `advanced_event_selector`.
+* `include_global_service_events` - (Optional) Whether the trail is publishing events from global services such as IAM to the log files. Defaults to `true`.
+* `insight_selector` - (Optional) Configuration block for identifying unusual operational activity. See details below.
+* `is_multi_region_trail` - (Optional) Whether the trail is created in the current region or in all regions. Defaults to `false`.
+* `is_organization_trail` - (Optional) Whether the trail is an AWS Organizations trail. Organization trails log events for the master account and all member accounts. Can only be created in the organization master account. Defaults to `false`.
+* `kms_key_id` - (Optional) KMS key ARN to use to encrypt the logs delivered by CloudTrail.
+* `s3_key_prefix` - (Optional) S3 key prefix that follows the name of the bucket you have designated for log file delivery.
+* `sns_topic_name` - (Optional) Name of the Amazon SNS topic defined for notification of log file delivery.
+* `tags` - (Optional) Map of tags to assign to the trail. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### event_selector
+
+* `data_resource` - (Optional) Configuration block for data events. See details below.
+* `exclude_management_event_sources` (Optional) -  A set of event sources to exclude. Valid values include: `kms.amazonaws.com` and `rdsdata.amazonaws.com`. `include_management_events` must be set to`true` to allow this.
+* `include_management_events` - (Optional) Whether to include management events for your trail. Defaults to `true`.
+* `read_write_type` - (Optional) Type of events to log. Valid values are `ReadOnly`, `WriteOnly`, `All`. Default value is `All`.
+
+#### data_resource
+
+* `type` - (Required) Resource type in which you want to log data events. You can specify only the following value: "AWS::S3::Object", "AWS::Lambda::Function" and "AWS::DynamoDB::Table".
+* `values` - (Required) List of ARN strings or partial ARN strings to specify selectors for data audit events over data resources. ARN list is specific to single-valued `type`. For example, `arn:aws:s3:::<bucket name>/` for all objects in a bucket, `arn:aws:s3:::<bucket name>/key` for specific objects, `arn:aws:lambda` for all lambda events within an account, `arn:aws:lambda:<region>:<account number>:function:<function name>` for a specific Lambda function, `arn:aws:dynamodb` for all DDB events for all tables within an account, or `arn:aws:dynamodb:<region>:<account number>:table/<table name>` for a specific DynamoDB table.
+
+### insight_selector
+
+* `insight_type` - (Optional) Type of insights to log on a trail. Valid values are: `ApiCallRateInsight` and `ApiErrorRateInsight`.
+
+### Advanced Event Selector Arguments
+
+* `field_selector` (Required) - Specifies the selector statements in an advanced event selector. Fields documented below.
+* `name` (Optional) - Name of the advanced event selector.
+
+#### Field Selector Arguments
+
+* `field` (Required) - Field in an event record on which to filter events to be logged. You can specify only the following values: `readOnly`, `eventSource`, `eventName`, `eventCategory`, `resources.type`, `resources.ARN`.
+* `ends_with` (Optional) - A list of values that includes events that match the last few characters of the event record field specified as the value of `field`.
+* `equals` (Optional) - A list of values that includes events that match the exact value of the event record field specified as the value of `field`. This is the only valid operator that you can use with the `readOnly`, `eventCategory`, and `resources.type` fields.
+* `not_ends_with` (Optional) - A list of values that excludes events that match the last few characters of the event record field specified as the value of `field`.
+* `not_equals` (Optional) - A list of values that excludes events that match the exact value of the event record field specified as the value of `field`.
+* `not_starts_with` (Optional) - A list of values that excludes events that match the first few characters of the event record field specified as the value of `field`.
+* `starts_with` (Optional) - A list of values that includes events that match the first few characters of the event record field specified as the value of `field`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the trail.
+* `home_region` - Region in which the trail was created.
+* `id` - Name of the trail.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Cloudtrails using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Cloudtrails using the `name`. For example:
+
+```console
+% terraform import aws_cloudtrail.sample my-sample-trail
+```
+
+<!-- cache-key: cdktf-0.18.0 input-98216d45a2a27863ff111f0d40da50548fbed7371974a66a6d0f1d447b675fea -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/cloudtrail_event_data_store.html.markdown b/website/docs/cdktf/python/r/cloudtrail_event_data_store.html.markdown
new file mode 100644
index 00000000000..245dd604af2
--- /dev/null
+++ b/website/docs/cdktf/python/r/cloudtrail_event_data_store.html.markdown
@@ -0,0 +1,148 @@
+---
+subcategory: "CloudTrail"
+layout: "aws"
+page_title: "AWS: aws_cloudtrail_event_data_store"
+description: |-
+  Provides a CloudTrail Event Data Store resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudtrail_event_data_store
+
+Provides a CloudTrail Event Data Store.
+
+More information about event data stores can be found in the [Event Data Store User Guide](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/query-event-data-store.html).
+
+-> **Tip:** For an organization event data store you must create this resource in the management account.
+
+## Example Usage
+
+### Basic
+
+The most simple event data store configuration requires us to only set the `name` attribute. The event data store will automatically capture all management events. To capture management events from all the regions, `multi_region_enabled` must be `true`.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudtrail_event_data_store import CloudtrailEventDataStore
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        CloudtrailEventDataStore(self, "example",
+            name="example-event-data-store"
+        )
+```
+
+### Data Event Logging
+
+CloudTrail can log [Data Events](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.html) for certain services such as S3 bucket objects and Lambda function invocations. Additional information about data event configuration can be found in the following links:
+
+- [CloudTrail API AdvancedFieldSelector documentation](https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_AdvancedFieldSelector.html)
+
+#### Log all DynamoDB PutEvent actions for a specific DynamoDB table
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudtrail_event_data_store import CloudtrailEventDataStore
+from imports.aws.data_aws_dynamodb_table import DataAwsDynamodbTable
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, name):
+        super().__init__(scope, name)
+        table = DataAwsDynamodbTable(self, "table",
+            name="not-important-dynamodb-table"
+        )
+        CloudtrailEventDataStore(self, "example",
+            advanced_event_selector=[CloudtrailEventDataStoreAdvancedEventSelector(
+                field_selector=[CloudtrailEventDataStoreAdvancedEventSelectorFieldSelector(
+                    equal_to=["Data"],
+                    field="eventCategory"
+                ), CloudtrailEventDataStoreAdvancedEventSelectorFieldSelector(
+                    equal_to=["AWS::DynamoDB::Table"],
+                    field="resources.type"
+                ), CloudtrailEventDataStoreAdvancedEventSelectorFieldSelector(
+                    equal_to=["PutItem"],
+                    field="eventName"
+                ), CloudtrailEventDataStoreAdvancedEventSelectorFieldSelector(
+                    equal_to=[Token.as_string(table.arn)],
+                    field="resources.ARN"
+                )
+                ],
+                name="Log all DynamoDB PutEvent actions for a specific DynamoDB table"
+            )
+            ],
+            name=name
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+- `name` - (Required) The name of the event data store.
+- `advanced_event_selector` - (Optional) The advanced event selectors to use to select the events for the data store. For more information about how to use advanced event selectors, see [Log events by using advanced event selectors](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.html#creating-data-event-selectors-advanced) in the CloudTrail User Guide.
+- `multi_region_enabled` - (Optional) Specifies whether the event data store includes events from all regions, or only from the region in which the event data store is created. Default: `true`.
+- `organization_enabled` - (Optional) Specifies whether an event data store collects events logged for an organization in AWS Organizations. Default: `false`.
+- `retention_period` - (Optional) The retention period of the event data store, in days. You can set a retention period of up to 2555 days, the equivalent of seven years. Default: `2555`.
+- `kms_key_id` - Specifies the AWS KMS key ID to use to encrypt the events delivered by CloudTrail. The value can be an alias name prefixed by alias/, a fully specified ARN to an alias, a fully specified ARN to a key, or a globally unique identifier.
+- `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+- `termination_protection_enabled` - (Optional) Specifies whether termination protection is enabled for the event data store. If termination protection is enabled, you cannot delete the event data store until termination protection is disabled. Default: `true`.
+
+### Advanced Event Selector Arguments
+
+`advanced_event_selector` supports the following arguments:
+
+- `name` (Optional) - Specifies the name of the advanced event selector.
+- `field_selector` (Required) - Specifies the selector statements in an advanced event selector. Fields documented below.
+
+#### Field Selector Arguments
+
+`field_selector` supports the following arguments:
+
+- `field` (Required) - Specifies a field in an event record on which to filter events to be logged. You can specify only the following values: `readOnly`, `eventSource`, `eventName`, `eventCategory`, `resources.type`, `resources.ARN`.
+- `equals` (Optional) - A list of values that includes events that match the exact value of the event record field specified as the value of `field`. This is the only valid operator that you can use with the `readOnly`, `eventCategory`, and `resources.type` fields.
+- `not_equals` (Optional) - A list of values that excludes events that match the exact value of the event record field specified as the value of `field`.
+- `starts_with` (Optional) - A list of values that includes events that match the first few characters of the event record field specified as the value of `field`.
+- `not_starts_with` (Optional) - A list of values that excludes events that match the first few characters of the event record field specified as the value of `field`.
+- `ends_with` (Optional) - A list of values that includes events that match the last few characters of the event record field specified as the value of `field`.
+- `not_ends_with` (Optional) - A list of values that excludes events that match the last few characters of the event record field specified as the value of `field`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+- `arn` - ARN of the event data store.
+- `id` - Name of the event data store.
+- `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import event data stores using their `arn`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import event data stores using their `arn`. For example:
+
+```console
+% terraform import aws_cloudtrail_event_data_store.example arn:aws:cloudtrail:us-east-1:123456789123:eventdatastore/22333815-4414-412c-b155-dd254033gfhf
+```
+
+<!-- cache-key: cdktf-0.18.0 input-606e5cb558b509aa1002c2f846e4174eed937e4e6b6708dfbb236e4bae1cfe9d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/cloudwatch_composite_alarm.html.markdown b/website/docs/cdktf/python/r/cloudwatch_composite_alarm.html.markdown
new file mode 100644
index 00000000000..b0db316ae0c
--- /dev/null
+++ b/website/docs/cdktf/python/r/cloudwatch_composite_alarm.html.markdown
@@ -0,0 +1,87 @@
+---
+subcategory: "CloudWatch"
+layout: "aws"
+page_title: "AWS: aws_cloudwatch_composite_alarm"
+description: |-
+  Provides a CloudWatch Composite Alarm resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudwatch_composite_alarm
+
+Provides a CloudWatch Composite Alarm resource.
+
+~> **NOTE:** An alarm (composite or metric) cannot be destroyed when there are other composite alarms depending on it. This can lead to a cyclical dependency on update, as Terraform will unsuccessfully attempt to destroy alarms before updating the rule. Consider using `depends_on`, references to alarm names, and two-stage updates.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudwatch_composite_alarm import CloudwatchCompositeAlarm
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        CloudwatchCompositeAlarm(self, "example",
+            actions_suppressor=CloudwatchCompositeAlarmActionsSuppressor(
+                alarm="suppressor-alarm",
+                extension_period=10,
+                wait_period=20
+            ),
+            alarm_actions=Token.as_list(aws_sns_topic_example.arn),
+            alarm_description="This is a composite alarm!",
+            alarm_name="example-composite-alarm",
+            alarm_rule="ALARM(${" + alpha.alarm_name + "}) OR\nALARM(${" + bravo.alarm_name + "})\n\n",
+            ok_actions=Token.as_list(aws_sns_topic_example.arn)
+        )
+```
+
+## Argument Reference
+
+* `actions_enabled` - (Optional, Forces new resource) Indicates whether actions should be executed during any changes to the alarm state of the composite alarm. Defaults to `true`.
+* `actions_suppressor` - (Optional) Actions will be suppressed if the suppressor alarm is in the ALARM state.
+    * `alarm` - (Required) Can be an AlarmName or an Amazon Resource Name (ARN) from an existing alarm.
+    * `extension_period` - (Required) The maximum time in seconds that the composite alarm waits after suppressor alarm goes out of the `ALARM` state. After this time, the composite alarm performs its actions.
+    * `wait_period` - (Required) The maximum time in seconds that the composite alarm waits for the suppressor alarm to go into the `ALARM` state. After this time, the composite alarm performs its actions.
+* `alarm_actions` - (Optional) The set of actions to execute when this alarm transitions to the `ALARM` state from any other state. Each action is specified as an ARN. Up to 5 actions are allowed.
+* `alarm_description` - (Optional) The description for the composite alarm.
+* `alarm_name` - (Required) The name for the composite alarm. This name must be unique within the region.
+* `alarm_rule` - (Required) An expression that specifies which other alarms are to be evaluated to determine this composite alarm's state. For syntax, see [Creating a Composite Alarm](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Create_Composite_Alarm.html). The maximum length is 10240 characters.
+* `insufficient_data_actions` - (Optional) The set of actions to execute when this alarm transitions to the `INSUFFICIENT_DATA` state from any other state. Each action is specified as an ARN. Up to 5 actions are allowed.
+* `ok_actions` - (Optional) The set of actions to execute when this alarm transitions to an `OK` state from any other state. Each action is specified as an ARN. Up to 5 actions are allowed.
+* `tags` - (Optional) A map of tags to associate with the alarm. Up to 50 tags are allowed. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the composite alarm.
+* `id` - The ID of the composite alarm resource, which is equivalent to its `alarm_name`.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import a CloudWatch Composite Alarm using the `alarm_name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import a CloudWatch Composite Alarm using the `alarm_name`. For example:
+
+```console
+% terraform import aws_cloudwatch_composite_alarm.test my-alarm
+```
+
+<!-- cache-key: cdktf-0.18.0 input-bc5f81d668dc98cce89e801ef7bbb869b647ded82d35c20f03ae8298b2d50282 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/cloudwatch_dashboard.html.markdown b/website/docs/cdktf/python/r/cloudwatch_dashboard.html.markdown
new file mode 100644
index 00000000000..464bca20472
--- /dev/null
+++ b/website/docs/cdktf/python/r/cloudwatch_dashboard.html.markdown
@@ -0,0 +1,94 @@
+---
+subcategory: "CloudWatch"
+layout: "aws"
+page_title: "AWS: aws_cloudwatch_dashboard"
+description: |-
+  Provides a CloudWatch Dashboard resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudwatch_dashboard
+
+Provides a CloudWatch Dashboard resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudwatch_dashboard import CloudwatchDashboard
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        CloudwatchDashboard(self, "main",
+            dashboard_body=Token.as_string(
+                Fn.jsonencode({
+                    "widgets": [{
+                        "height": 6,
+                        "properties": {
+                            "metrics": [["AWS/EC2", "CPUUtilization", "InstanceId", "i-012345"]
+                            ],
+                            "period": 300,
+                            "region": "us-east-1",
+                            "stat": "Average",
+                            "title": "EC2 Instance CPU"
+                        },
+                        "type": "metric",
+                        "width": 12,
+                        "x": 0,
+                        "y": 0
+                    }, {
+                        "height": 3,
+                        "properties": {
+                            "markdown": "Hello world"
+                        },
+                        "type": "text",
+                        "width": 3,
+                        "x": 0,
+                        "y": 7
+                    }
+                    ]
+                })),
+            dashboard_name="my-dashboard"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `dashboard_name` - (Required) The name of the dashboard.
+* `dashboard_body` - (Required) The detailed information about the dashboard, including what widgets are included and their location on the dashboard. You can read more about the body structure in the [documentation](https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/CloudWatch-Dashboard-Body-Structure.html).
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `dashboard_arn` - The Amazon Resource Name (ARN) of the dashboard.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudWatch dashboards using the `dashboard_name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import CloudWatch dashboards using the `dashboard_name`. For example:
+
+```console
+% terraform import aws_cloudwatch_dashboard.sample dashboard_name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-2364f68cbb18d2dbd2754d885496d994d344609a1d9297eee7cdf140181ca478 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/cloudwatch_event_api_destination.html.markdown b/website/docs/cdktf/python/r/cloudwatch_event_api_destination.html.markdown
new file mode 100644
index 00000000000..507b3b7f417
--- /dev/null
+++ b/website/docs/cdktf/python/r/cloudwatch_event_api_destination.html.markdown
@@ -0,0 +1,77 @@
+---
+subcategory: "EventBridge"
+layout: "aws"
+page_title: "AWS: aws_cloudwatch_event_api_destination"
+description: |-
+  Provides an EventBridge event API Destination resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudwatch_event_api_destination
+
+Provides an EventBridge event API Destination resource.
+
+~> **Note:** EventBridge was formerly known as CloudWatch Events. The functionality is identical.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudwatch_event_api_destination import CloudwatchEventApiDestination
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        CloudwatchEventApiDestination(self, "test",
+            connection_arn=Token.as_string(aws_cloudwatch_event_connection_test.arn),
+            description="An API Destination",
+            http_method="POST",
+            invocation_endpoint="https://api.destination.com/endpoint",
+            invocation_rate_limit_per_second=20,
+            name="api-destination"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the new API Destination. The name must be unique for your account. Maximum of 64 characters consisting of numbers, lower/upper case letters, .,-,_.
+* `description` - (Optional) The description of the new API Destination. Maximum of 512 characters.
+* `invocation_endpoint` - (Required) URL endpoint to invoke as a target. This could be a valid endpoint generated by a partner service. You can include "*" as path parameters wildcards to be set from the Target HttpParameters.
+* `http_method` - (Required) Select the HTTP method used for the invocation endpoint, such as GET, POST, PUT, etc.
+* `invocation_rate_limit_per_second` - (Optional) Enter the maximum number of invocations per second to allow for this destination. Enter a value greater than 0 (default 300).
+* `connection_arn` - (Required) ARN of the EventBridge Connection to use for the API Destination.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the event API Destination.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EventBridge API Destinations using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import EventBridge API Destinations using the `name`. For example:
+
+```console
+% terraform import aws_cloudwatch_event_api_destination.test api-destination
+```
+
+<!-- cache-key: cdktf-0.18.0 input-f0527648b10617b833d1ba117b6b713b350a47ccacb5b91bbd9d88762283759c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/cloudwatch_event_archive.html.markdown b/website/docs/cdktf/python/r/cloudwatch_event_archive.html.markdown
new file mode 100644
index 00000000000..cec3093dbf4
--- /dev/null
+++ b/website/docs/cdktf/python/r/cloudwatch_event_archive.html.markdown
@@ -0,0 +1,110 @@
+---
+subcategory: "EventBridge"
+layout: "aws"
+page_title: "AWS: aws_cloudwatch_event_archive"
+description: |-
+  Provides an EventBridge event archive resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudwatch_event_archive
+
+Provides an EventBridge event archive resource.
+
+~> **Note:** EventBridge was formerly known as CloudWatch Events. The functionality is identical.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudwatch_event_archive import CloudwatchEventArchive
+from imports.aws.cloudwatch_event_bus import CloudwatchEventBus
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        order = CloudwatchEventBus(self, "order",
+            name="orders"
+        )
+        aws_cloudwatch_event_archive_order = CloudwatchEventArchive(self, "order_1",
+            event_source_arn=order.arn,
+            name="order-archive"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_cloudwatch_event_archive_order.override_logical_id("order")
+```
+
+## Example all optional arguments
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudwatch_event_archive import CloudwatchEventArchive
+from imports.aws.cloudwatch_event_bus import CloudwatchEventBus
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        order = CloudwatchEventBus(self, "order",
+            name="orders"
+        )
+        aws_cloudwatch_event_archive_order = CloudwatchEventArchive(self, "order_1",
+            description="Archived events from order service",
+            event_pattern=Token.as_string(
+                Fn.jsonencode({
+                    "source": ["company.team.order"]
+                })),
+            event_source_arn=order.arn,
+            name="order-archive",
+            retention_days=7
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_cloudwatch_event_archive_order.override_logical_id("order")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the new event archive. The archive name cannot exceed 48 characters.
+* `event_source_arn` - (Required) Event bus source ARN from where these events should be archived.
+* `description` - (Optional) The description of the new event archive.
+* `event_pattern` - (Optional) Instructs the new event archive to only capture events matched by this pattern. By default, it attempts to archive every event received in the `event_source_arn`.
+* `retention_days` - (Optional) The maximum number of days to retain events in the new event archive. By default, it archives indefinitely.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the event archive.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import an EventBridge archive using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import an EventBridge archive using the `name`. For example:
+
+```console
+% terraform import aws_cloudwatch_event_archive.imported_event_archive order-archive
+```
+
+<!-- cache-key: cdktf-0.18.0 input-230aef7101e3a99451d3a96541a344389622f8e93208093246611e6e08ee12b5 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/cloudwatch_event_bus.html.markdown b/website/docs/cdktf/python/r/cloudwatch_event_bus.html.markdown
new file mode 100644
index 00000000000..bebc209ab27
--- /dev/null
+++ b/website/docs/cdktf/python/r/cloudwatch_event_bus.html.markdown
@@ -0,0 +1,94 @@
+---
+subcategory: "EventBridge"
+layout: "aws"
+page_title: "AWS: aws_cloudwatch_event_bus"
+description: |-
+  Provides an EventBridge event bus resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudwatch_event_bus
+
+Provides an EventBridge event bus resource.
+
+~> **Note:** EventBridge was formerly known as CloudWatch Events. The functionality is identical.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudwatch_event_bus import CloudwatchEventBus
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        CloudwatchEventBus(self, "messenger",
+            name="chat-messages"
+        )
+```
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudwatch_event_bus import CloudwatchEventBus
+from imports.aws.data_aws_cloudwatch_event_source import DataAwsCloudwatchEventSource
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        examplepartner = DataAwsCloudwatchEventSource(self, "examplepartner",
+            name_prefix="aws.partner/examplepartner.com"
+        )
+        aws_cloudwatch_event_bus_examplepartner = CloudwatchEventBus(self, "examplepartner_1",
+            event_source_name=Token.as_string(examplepartner.name),
+            name=Token.as_string(examplepartner.name)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_cloudwatch_event_bus_examplepartner.override_logical_id("examplepartner")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the new event bus. The names of custom event buses can't contain the / character. To create a partner event bus, ensure the `name` matches the `event_source_name`.
+* `event_source_name` (Optional) The partner event source that the new event bus will be matched with. Must match `name`.
+* `tags` - (Optional)  A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the event bus.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EventBridge event buses using the `name` (which can also be a partner event source name). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import EventBridge event buses using the `name` (which can also be a partner event source name). For example:
+
+```console
+% terraform import aws_cloudwatch_event_bus.messenger chat-messages
+```
+
+<!-- cache-key: cdktf-0.18.0 input-740b7ef9a57fce58b33a2b98397aad29a82f722b6025aed22c549b727c9580eb -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/cloudwatch_event_bus_policy.html.markdown b/website/docs/cdktf/python/r/cloudwatch_event_bus_policy.html.markdown
new file mode 100644
index 00000000000..0f53f9a661e
--- /dev/null
+++ b/website/docs/cdktf/python/r/cloudwatch_event_bus_policy.html.markdown
@@ -0,0 +1,193 @@
+---
+subcategory: "EventBridge"
+layout: "aws"
+page_title: "AWS: aws_cloudwatch_event_bus_policy"
+description: |-
+  Provides a resource to create an EventBridge policy to support cross-account events.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudwatch_event_bus_policy
+
+Provides a resource to create an EventBridge resource policy to support cross-account events.
+
+~> **Note:** EventBridge was formerly known as CloudWatch Events. The functionality is identical.
+
+~> **Note:** The EventBridge bus policy resource  (`aws_cloudwatch_event_bus_policy`) is incompatible with the EventBridge permission resource (`aws_cloudwatch_event_permission`) and will overwrite permissions.
+
+## Example Usage
+
+### Account Access
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudwatch_event_bus_policy import CloudwatchEventBusPolicy
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        test = DataAwsIamPolicyDocument(self, "test",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["events:PutEvents"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["123456789012"],
+                    type="AWS"
+                )
+                ],
+                resources=["arn:aws:events:eu-west-1:123456789012:event-bus/default"
+                ],
+                sid="DevAccountAccess"
+            )
+            ]
+        )
+        aws_cloudwatch_event_bus_policy_test = CloudwatchEventBusPolicy(self, "test_1",
+            event_bus_name=Token.as_string(aws_cloudwatch_event_bus_test.name),
+            policy=Token.as_string(test.json)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_cloudwatch_event_bus_policy_test.override_logical_id("test")
+```
+
+### Organization Access
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudwatch_event_bus_policy import CloudwatchEventBusPolicy
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        test = DataAwsIamPolicyDocument(self, "test",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["events:DescribeRule", "events:ListRules", "events:ListTargetsByRule", "events:ListTagsForResource"
+                ],
+                condition=[DataAwsIamPolicyDocumentStatementCondition(
+                    test="StringEquals",
+                    values=[example.id],
+                    variable="aws:PrincipalOrgID"
+                )
+                ],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["*"],
+                    type="AWS"
+                )
+                ],
+                resources=["arn:aws:events:eu-west-1:123456789012:rule/*", "arn:aws:events:eu-west-1:123456789012:event-bus/default"
+                ],
+                sid="OrganizationAccess"
+            )
+            ]
+        )
+        aws_cloudwatch_event_bus_policy_test = CloudwatchEventBusPolicy(self, "test_1",
+            event_bus_name=Token.as_string(aws_cloudwatch_event_bus_test.name),
+            policy=Token.as_string(test.json)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_cloudwatch_event_bus_policy_test.override_logical_id("test")
+```
+
+### Multiple Statements
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudwatch_event_bus_policy import CloudwatchEventBusPolicy
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        test = DataAwsIamPolicyDocument(self, "test",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["events:PutEvents"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["123456789012"],
+                    type="AWS"
+                )
+                ],
+                resources=["arn:aws:events:eu-west-1:123456789012:event-bus/default"
+                ],
+                sid="DevAccountAccess"
+            ), DataAwsIamPolicyDocumentStatement(
+                actions=["events:DescribeRule", "events:ListRules", "events:ListTargetsByRule", "events:ListTagsForResource"
+                ],
+                condition=[DataAwsIamPolicyDocumentStatementCondition(
+                    test="StringEquals",
+                    values=[example.id],
+                    variable="aws:PrincipalOrgID"
+                )
+                ],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["*"],
+                    type="AWS"
+                )
+                ],
+                resources=["arn:aws:events:eu-west-1:123456789012:rule/*", "arn:aws:events:eu-west-1:123456789012:event-bus/default"
+                ],
+                sid="OrganizationAccess"
+            )
+            ]
+        )
+        aws_cloudwatch_event_bus_policy_test = CloudwatchEventBusPolicy(self, "test_1",
+            event_bus_name=Token.as_string(aws_cloudwatch_event_bus_test.name),
+            policy=Token.as_string(test.json)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_cloudwatch_event_bus_policy_test.override_logical_id("test")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `policy` - (Required) The text of the policy. For more information about building AWS IAM policy documents with Terraform, see the [AWS IAM Policy Document Guide](https://learn.hashicorp.com/terraform/aws/iam-policy).
+* `event_bus_name` - (Optional) The name of the event bus to set the permissions on.
+  If you omit this, the permissions are set on the `default` event bus.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name of the EventBridge event bus.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import an EventBridge policy using the `event_bus_name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import an EventBridge policy using the `event_bus_name`. For example:
+
+```console
+% terraform import aws_cloudwatch_event_bus_policy.DevAccountAccess example-event-bus
+```
+
+<!-- cache-key: cdktf-0.18.0 input-169b2e45e0cb69c0e508149ef8eef91ea77e8a9d2a0a5c4ea7af58d28ac95866 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/cloudwatch_event_connection.html.markdown b/website/docs/cdktf/python/r/cloudwatch_event_connection.html.markdown
new file mode 100644
index 00000000000..f68e9bc6aa4
--- /dev/null
+++ b/website/docs/cdktf/python/r/cloudwatch_event_connection.html.markdown
@@ -0,0 +1,251 @@
+---
+subcategory: "EventBridge"
+layout: "aws"
+page_title: "AWS: aws_cloudwatch_event_connection"
+description: |-
+  Provides an EventBridge connection resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudwatch_event_connection
+
+Provides an EventBridge connection resource.
+
+~> **Note:** EventBridge was formerly known as CloudWatch Events. The functionality is identical.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudwatch_event_connection import CloudwatchEventConnection
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        CloudwatchEventConnection(self, "test",
+            auth_parameters=CloudwatchEventConnectionAuthParameters(
+                api_key=CloudwatchEventConnectionAuthParametersApiKey(
+                    key="x-signature",
+                    value="1234"
+                )
+            ),
+            authorization_type="API_KEY",
+            description="A connection description",
+            name="ngrok-connection"
+        )
+```
+
+## Example Usage Basic Authorization
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudwatch_event_connection import CloudwatchEventConnection
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        CloudwatchEventConnection(self, "test",
+            auth_parameters=CloudwatchEventConnectionAuthParameters(
+                basic=CloudwatchEventConnectionAuthParametersBasic(
+                    password="Pass1234!",
+                    username="user"
+                )
+            ),
+            authorization_type="BASIC",
+            description="A connection description",
+            name="ngrok-connection"
+        )
+```
+
+## Example Usage OAuth Authorization
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudwatch_event_connection import CloudwatchEventConnection
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        CloudwatchEventConnection(self, "test",
+            auth_parameters=CloudwatchEventConnectionAuthParameters(
+                oauth=CloudwatchEventConnectionAuthParametersOauth(
+                    authorization_endpoint="https://auth.url.com/endpoint",
+                    client_parameters=CloudwatchEventConnectionAuthParametersOauthClientParameters(
+                        client_id="1234567890",
+                        client_secret="Pass1234!"
+                    ),
+                    http_method="GET",
+                    oauth_http_parameters=CloudwatchEventConnectionAuthParametersOauthOauthHttpParameters(
+                        body=[CloudwatchEventConnectionAuthParametersOauthOauthHttpParametersBody(
+                            is_value_secret=False,
+                            key="body-parameter-key",
+                            value="body-parameter-value"
+                        )
+                        ],
+                        header=[CloudwatchEventConnectionAuthParametersOauthOauthHttpParametersHeader(
+                            is_value_secret=False,
+                            key="header-parameter-key",
+                            value="header-parameter-value"
+                        )
+                        ],
+                        query_string=[CloudwatchEventConnectionAuthParametersOauthOauthHttpParametersQueryString(
+                            is_value_secret=False,
+                            key="query-string-parameter-key",
+                            value="query-string-parameter-value"
+                        )
+                        ]
+                    )
+                )
+            ),
+            authorization_type="OAUTH_CLIENT_CREDENTIALS",
+            description="A connection description",
+            name="ngrok-connection"
+        )
+```
+
+## Example Usage Invocation Http Parameters
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudwatch_event_connection import CloudwatchEventConnection
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        CloudwatchEventConnection(self, "test",
+            auth_parameters=CloudwatchEventConnectionAuthParameters(
+                basic=CloudwatchEventConnectionAuthParametersBasic(
+                    password="Pass1234!",
+                    username="user"
+                ),
+                invocation_http_parameters=CloudwatchEventConnectionAuthParametersInvocationHttpParameters(
+                    body=[CloudwatchEventConnectionAuthParametersInvocationHttpParametersBody(
+                        is_value_secret=False,
+                        key="body-parameter-key",
+                        value="body-parameter-value"
+                    ), CloudwatchEventConnectionAuthParametersInvocationHttpParametersBody(
+                        is_value_secret=True,
+                        key="body-parameter-key2",
+                        value="body-parameter-value2"
+                    )
+                    ],
+                    header=[CloudwatchEventConnectionAuthParametersInvocationHttpParametersHeader(
+                        is_value_secret=False,
+                        key="header-parameter-key",
+                        value="header-parameter-value"
+                    )
+                    ],
+                    query_string=[CloudwatchEventConnectionAuthParametersInvocationHttpParametersQueryString(
+                        is_value_secret=False,
+                        key="query-string-parameter-key",
+                        value="query-string-parameter-value"
+                    )
+                    ]
+                )
+            ),
+            authorization_type="BASIC",
+            description="A connection description",
+            name="ngrok-connection"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the new connection. Maximum of 64 characters consisting of numbers, lower/upper case letters, .,-,_.
+* `description` - (Optional) Enter a description for the connection. Maximum of 512 characters.
+* `authorization_type` - (Required) Choose the type of authorization to use for the connection. One of `API_KEY`,`BASIC`,`OAUTH_CLIENT_CREDENTIALS`.
+* `auth_parameters` - (Required) Parameters used for authorization. A maximum of 1 are allowed. Documented below.
+* `invocation_http_parameters` - (Optional) Invocation Http Parameters are additional credentials used to sign each Invocation of the ApiDestination created from this Connection. If the ApiDestination Rule Target has additional HttpParameters, the values will be merged together, with the Connection Invocation Http Parameters taking precedence. Secret values are stored and managed by AWS Secrets Manager. A maximum of 1 are allowed. Documented below.
+
+`auth_parameters` support the following:
+
+* `api_key` - (Optional) Parameters used for API_KEY authorization. An API key to include in the header for each authentication request. A maximum of 1 are allowed. Conflicts with `basic` and `oauth`. Documented below.
+* `basic` - (Optional) Parameters used for BASIC authorization. A maximum of 1 are allowed. Conflicts with `api_key` and `oauth`. Documented below.
+* `oauth` - (Optional) Parameters used for OAUTH_CLIENT_CREDENTIALS authorization. A maximum of 1 are allowed. Conflicts with `basic` and `api_key`. Documented below.
+
+`api_key` support the following:
+
+* `key` - (Required) Header Name.
+* `value` - (Required) Header Value. Created and stored in AWS Secrets Manager.
+
+`basic` support the following:
+
+* `username` - (Required) A username for the authorization.
+* `password` - (Required) A password for the authorization. Created and stored in AWS Secrets Manager.
+
+`oauth` support the following:
+
+* `authorization_endpoint` - (Required) The URL to the authorization endpoint.
+* `http_method` - (Required) A password for the authorization. Created and stored in AWS Secrets Manager.
+* `client_parameters` - (Required) Contains the client parameters for OAuth authorization. Contains the following two parameters.
+    * `client_id` - (Required) The client ID for the credentials to use for authorization. Created and stored in AWS Secrets Manager.
+    * `client_secret` - (Required) The client secret for the credentials to use for authorization. Created and stored in AWS Secrets Manager.
+* `oauth_http_parameters` - (Required) OAuth Http Parameters are additional credentials used to sign the request to the authorization endpoint to exchange the OAuth Client information for an access token. Secret values are stored and managed by AWS Secrets Manager. A maximum of 1 are allowed. Documented below.
+
+`invocation_http_parameters` and `oauth_http_parameters` support the following:
+
+* `body` - (Optional) Contains additional body string parameters for the connection. You can include up to 100 additional body string parameters per request. Each additional parameter counts towards the event payload size, which cannot exceed 64 KB. Each parameter can contain the following:
+    * `key` - (Required) The key for the parameter.
+    * `value` - (Required) The value associated with the key. Created and stored in AWS Secrets Manager if is secret.
+    * `is_value_secret` - (Optional) Specified whether the value is secret.
+
+* `header` - (Optional) Contains additional header parameters for the connection. You can include up to 100 additional body string parameters per request. Each additional parameter counts towards the event payload size, which cannot exceed 64 KB. Each parameter can contain the following:
+    * `key` - (Required) The key for the parameter.
+    * `value` - (Required) The value associated with the key. Created and stored in AWS Secrets Manager if is secret.
+    * `is_value_secret` - (Optional) Specified whether the value is secret.
+
+* `query_string` - (Optional) Contains additional query string parameters for the connection. You can include up to 100 additional body string parameters per request. Each additional parameter counts towards the event payload size, which cannot exceed 64 KB. Each parameter can contain the following:
+    * `key` - (Required) The key for the parameter.
+    * `value` - (Required) The value associated with the key. Created and stored in AWS Secrets Manager if is secret.
+    * `is_value_secret` - (Optional) Specified whether the value is secret.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the connection.
+* `secret_arn` - The Amazon Resource Name (ARN) of the secret created from the authorization parameters specified for the connection.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EventBridge connection using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import EventBridge EventBridge connection using the `name`. For example:
+
+```console
+% terraform import aws_cloudwatch_event_connection.test ngrok-connection
+```
+
+<!-- cache-key: cdktf-0.18.0 input-4759efe6af4674649e56020fa0ba96724fe1874dd8ece605bca5846e4d11241e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/cloudwatch_event_endpoint.html.markdown b/website/docs/cdktf/python/r/cloudwatch_event_endpoint.html.markdown
new file mode 100644
index 00000000000..88e42064a4d
--- /dev/null
+++ b/website/docs/cdktf/python/r/cloudwatch_event_endpoint.html.markdown
@@ -0,0 +1,118 @@
+---
+subcategory: "EventBridge"
+layout: "aws"
+page_title: "AWS: aws_cloudwatch_event_endpoint"
+description: |-
+  Provides a resource to create an EventBridge Global Endpoint.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudwatch_event_endpoint
+
+Provides a resource to create an EventBridge Global Endpoint.
+
+~> **Note:** EventBridge was formerly known as CloudWatch Events. The functionality is identical.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudwatch_event_endpoint import CloudwatchEventEndpoint
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        CloudwatchEventEndpoint(self, "this",
+            event_bus=[CloudwatchEventEndpointEventBus(
+                event_bus_arn=primary.arn
+            ), CloudwatchEventEndpointEventBus(
+                event_bus_arn=secondary.arn
+            )
+            ],
+            name="global-endpoint",
+            replication_config=CloudwatchEventEndpointReplicationConfig(
+                state="DISABLED"
+            ),
+            role_arn=replication.arn,
+            routing_config=CloudwatchEventEndpointRoutingConfig(
+                failover_config=CloudwatchEventEndpointRoutingConfigFailoverConfig(
+                    primary=CloudwatchEventEndpointRoutingConfigFailoverConfigPrimary(
+                        health_check=Token.as_string(aws_route53_health_check_primary.arn)
+                    ),
+                    secondary=CloudwatchEventEndpointRoutingConfigFailoverConfigSecondary(
+                        route="us-east-2"
+                    )
+                )
+            )
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `description` - (Optional) A description of the global endpoint.
+* `event_bus` - (Required) The event buses to use. The names of the event buses must be identical in each Region. Exactly two event buses are required. Documented below.
+* `name` - (Required) The name of the global endpoint.
+* `replication_config` - (Optional) Parameters used for replication. Documented below.
+* `role_arn` - (Optional) The ARN of the IAM role used for replication between event buses.
+* `routing_config` - (Required) Parameters used for routing, including the health check and secondary Region. Documented below.
+
+`event_bus` supports the following:
+
+* `event_bus_arn` - (Required) The ARN of the event bus the endpoint is associated with.
+
+`replication_config` supports the following:
+
+* `state` - (Optional) The state of event replication. Valid values: `ENABLED`, `DISABLED`. The default state is `ENABLED`, which means you must supply a `role_arn`. If you don't have a `role_arn` or you don't want event replication enabled, set `state` to `DISABLED`.
+
+`routing_config` support the following:
+
+* `failover_config` - (Required) Parameters used for failover. This includes what triggers failover and what happens when it's triggered. Documented below.
+
+`failover_config` support the following:
+
+* `primary` - (Required) Parameters used for the primary Region. Documented below.
+* `secondary` - (Required) Parameters used for the secondary Region, the Region that events are routed to when failover is triggered or event replication is enabled. Documented below.
+
+`primary` support the following:
+
+* `health_check` - (Required) The ARN of the health check used by the endpoint to determine whether failover is triggered.
+
+`secondary` support the following:
+
+* `route` - (Required) The name of the secondary Region.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the endpoint that was created.
+* `endpoint_url` - The URL of the endpoint that was created.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EventBridge Global Endpoints using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import EventBridge Global Endpoints using the `name`. For example:
+
+```console
+% terraform import aws_cloudwatch_event_endpoint.imported_endpoint example-endpoint
+```
+
+<!-- cache-key: cdktf-0.18.0 input-dac45f03f23cfb9ec43d7243c7ab30a08379fa9704853c26c6d6b06354f671a4 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/cloudwatch_event_permission.html.markdown b/website/docs/cdktf/python/r/cloudwatch_event_permission.html.markdown
new file mode 100644
index 00000000000..d178a95a769
--- /dev/null
+++ b/website/docs/cdktf/python/r/cloudwatch_event_permission.html.markdown
@@ -0,0 +1,108 @@
+---
+subcategory: "EventBridge"
+layout: "aws"
+page_title: "AWS: aws_cloudwatch_event_permission"
+description: |-
+  Provides a resource to create an EventBridge permission to support cross-account events in the current account default event bus.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudwatch_event_permission
+
+Provides a resource to create an EventBridge permission to support cross-account events in the current account default event bus.
+
+~> **Note:** EventBridge was formerly known as CloudWatch Events. The functionality is identical.
+
+~> **Note:** The EventBridge bus policy resource  (`aws_cloudwatch_event_bus_policy`) is incompatible with the EventBridge permission resource (`aws_cloudwatch_event_permission`) and will overwrite permissions.
+
+## Example Usage
+
+### Account Access
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudwatch_event_permission import CloudwatchEventPermission
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        CloudwatchEventPermission(self, "DevAccountAccess",
+            principal="123456789012",
+            statement_id="DevAccountAccess"
+        )
+```
+
+### Organization Access
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudwatch_event_permission import CloudwatchEventPermission
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        CloudwatchEventPermission(self, "OrganizationAccess",
+            condition=CloudwatchEventPermissionCondition(
+                key="aws:PrincipalOrgID",
+                type="StringEquals",
+                value=example.id
+            ),
+            principal="*",
+            statement_id="OrganizationAccess"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `principal` - (Required) The 12-digit AWS account ID that you are permitting to put events to your default event bus. Specify `*` to permit any account to put events to your default event bus, optionally limited by `condition`.
+* `statement_id` - (Required) An identifier string for the external account that you are granting permissions to.
+* `action` - (Optional) The action that you are enabling the other account to perform. Defaults to `events:PutEvents`.
+* `condition` - (Optional) Configuration block to limit the event bus permissions you are granting to only accounts that fulfill the condition. Specified below.
+* `event_bus_name` - (Optional) The name of the event bus to set the permissions on.
+  If you omit this, the permissions are set on the `default` event bus.
+
+### condition
+
+* `key` - (Required) Key for the condition. Valid values: `aws:PrincipalOrgID`.
+* `type` - (Required) Type of condition. Value values: `StringEquals`.
+* `value` - (Required) Value for the key.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The statement ID of the EventBridge permission.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EventBridge permissions using the `event_bus_name/statement_id` (if you omit `event_bus_name`, the `default` event bus will be used). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import EventBridge permissions using the `event_bus_name/statement_id` (if you omit `event_bus_name`, the `default` event bus will be used). For example:
+
+```console
+% terraform import aws_cloudwatch_event_permission.DevAccountAccess example-event-bus/DevAccountAccess
+```
+
+<!-- cache-key: cdktf-0.18.0 input-61e6e8cd01bf17093c7daf47be3dce1db556b13575a6c0f84dd9556644d63f94 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/cloudwatch_event_rule.html.markdown b/website/docs/cdktf/python/r/cloudwatch_event_rule.html.markdown
new file mode 100644
index 00000000000..e3bbdf3fc62
--- /dev/null
+++ b/website/docs/cdktf/python/r/cloudwatch_event_rule.html.markdown
@@ -0,0 +1,103 @@
+---
+subcategory: "EventBridge"
+layout: "aws"
+page_title: "AWS: aws_cloudwatch_event_rule"
+description: |-
+  Provides an EventBridge Rule resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudwatch_event_rule
+
+Provides an EventBridge Rule resource.
+
+~> **Note:** EventBridge was formerly known as CloudWatch Events. The functionality is identical.
+
+## Example Usage
+
+```terraform
+resource "aws_cloudwatch_event_rule" "console" {
+  name        = "capture-aws-sign-in"
+  description = "Capture each AWS Console Sign In"
+
+  event_pattern = jsonencode({
+    detail-type = [
+      "AWS Console Sign In via CloudTrail"
+    ]
+  })
+}
+
+resource "aws_cloudwatch_event_target" "sns" {
+  rule      = aws_cloudwatch_event_rule.console.name
+  target_id = "SendToSNS"
+  arn       = aws_sns_topic.aws_logins.arn
+}
+
+resource "aws_sns_topic" "aws_logins" {
+  name = "aws-console-logins"
+}
+
+resource "aws_sns_topic_policy" "default" {
+  arn    = aws_sns_topic.aws_logins.arn
+  policy = data.aws_iam_policy_document.sns_topic_policy.json
+}
+
+data "aws_iam_policy_document" "sns_topic_policy" {
+  statement {
+    effect  = "Allow"
+    actions = ["SNS:Publish"]
+
+    principals {
+      type        = "Service"
+      identifiers = ["events.amazonaws.com"]
+    }
+
+    resources = [aws_sns_topic.aws_logins.arn]
+  }
+}
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Optional) The name of the rule. If omitted, Terraform will assign a random, unique name. Conflicts with `name_prefix`.
+* `name_prefix` - (Optional) Creates a unique name beginning with the specified prefix. Conflicts with `name`. **Note**: Due to the length of the generated suffix, must be 38 characters or less.
+* `schedule_expression` - (Optional) The scheduling expression. For example, `cron(0 20 * * ? *)` or `rate(5 minutes)`. At least one of `schedule_expression` or `event_pattern` is required. Can only be used on the default event bus. For more information, refer to the AWS documentation [Schedule Expressions for Rules](https://docs.aws.amazon.com/AmazonCloudWatch/latest/events/ScheduledEvents.html).
+* `event_bus_name` - (Optional) The name or ARN of the event bus to associate with this rule.
+  If you omit this, the `default` event bus is used.
+* `event_pattern` - (Optional) The event pattern described a JSON object. At least one of `schedule_expression` or `event_pattern` is required. See full documentation of [Events and Event Patterns in EventBridge](https://docs.aws.amazon.com/eventbridge/latest/userguide/eventbridge-and-event-patterns.html) for details.
+* `description` - (Optional) The description of the rule.
+* `role_arn` - (Optional) The Amazon Resource Name (ARN) associated with the role that is used for target invocation.
+* `is_enabled` - (Optional) Whether the rule should be enabled (defaults to `true`).
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name of the rule.
+* `arn` - The Amazon Resource Name (ARN) of the rule.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EventBridge Rules using the `event_bus_name/rule_name` (if you omit `event_bus_name`, the `default` event bus will be used). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import EventBridge Rules using the `event_bus_name/rule_name` (if you omit `event_bus_name`, the `default` event bus will be used). For example:
+
+```console
+% terraform import aws_cloudwatch_event_rule.console example-event-bus/capture-console-sign-in
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1682a88e595c1129ead5e465869167f15b794aa7b9b39b0aef0d03a1bb04985b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/cloudwatch_event_target.html.markdown b/website/docs/cdktf/python/r/cloudwatch_event_target.html.markdown
new file mode 100644
index 00000000000..877df86fc74
--- /dev/null
+++ b/website/docs/cdktf/python/r/cloudwatch_event_target.html.markdown
@@ -0,0 +1,697 @@
+---
+subcategory: "EventBridge"
+layout: "aws"
+page_title: "AWS: aws_cloudwatch_event_target"
+description: |-
+  Provides an EventBridge Target resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudwatch_event_target
+
+Provides an EventBridge Target resource.
+
+~> **Note:** EventBridge was formerly known as CloudWatch Events. The functionality is identical.
+
+## Example Usage
+
+### Kinesis Usage
+
+```terraform
+resource "aws_cloudwatch_event_target" "yada" {
+  target_id = "Yada"
+  rule      = aws_cloudwatch_event_rule.console.name
+  arn       = aws_kinesis_stream.test_stream.arn
+
+  run_command_targets {
+    key    = "tag:Name"
+    values = ["FooBar"]
+  }
+
+  run_command_targets {
+    key    = "InstanceIds"
+    values = ["i-162058cd308bffec2"]
+  }
+}
+
+resource "aws_cloudwatch_event_rule" "console" {
+  name        = "capture-ec2-scaling-events"
+  description = "Capture all EC2 scaling events"
+
+  event_pattern = jsonencode({
+    source = [
+      "aws.autoscaling"
+    ]
+
+    detail-type = [
+      "EC2 Instance Launch Successful",
+      "EC2 Instance Terminate Successful",
+      "EC2 Instance Launch Unsuccessful",
+      "EC2 Instance Terminate Unsuccessful"
+    ]
+  })
+}
+
+resource "aws_kinesis_stream" "test_stream" {
+  name        = "terraform-kinesis-test"
+  shard_count = 1
+}
+```
+
+### SSM Document Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudwatch_event_rule import CloudwatchEventRule
+from imports.aws.cloudwatch_event_target import CloudwatchEventTarget
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.iam_policy import IamPolicy
+from imports.aws.iam_role import IamRole
+from imports.aws.iam_role_policy_attachment import IamRolePolicyAttachment
+from imports.aws.ssm_document import SsmDocument
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        stop_instances = CloudwatchEventRule(self, "stop_instances",
+            description="Stop instances nightly",
+            name="StopInstance",
+            schedule_expression="cron(0 0 * * ? *)"
+        )
+        stop_instance = SsmDocument(self, "stop_instance",
+            content=Token.as_string(
+                Fn.jsonencode({
+                    "description": "Stop an instance",
+                    "parameters": {},
+                    "runtime_config": {
+                        "aws:run_shell_script": {
+                            "properties": [{
+                                "id": "0.aws:runShellScript",
+                                "run_command": ["halt"]
+                            }
+                            ]
+                        }
+                    },
+                    "schema_version": "1.2"
+                })),
+            document_type="Command",
+            name="stop_instance"
+        )
+        ssm_lifecycle = DataAwsIamPolicyDocument(self, "ssm_lifecycle",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["ssm:SendCommand"],
+                condition=[DataAwsIamPolicyDocumentStatementCondition(
+                    test="StringEquals",
+                    values=["*"],
+                    variable="ec2:ResourceTag/Terminate"
+                )
+                ],
+                effect="Allow",
+                resources=["arn:aws:ec2:eu-west-1:1234567890:instance/*"]
+            ), DataAwsIamPolicyDocumentStatement(
+                actions=["ssm:SendCommand"],
+                effect="Allow",
+                resources=[stop_instance.arn]
+            )
+            ]
+        )
+        ssm_lifecycle_trust = DataAwsIamPolicyDocument(self, "ssm_lifecycle_trust",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["sts:AssumeRole"],
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["events.amazonaws.com"],
+                    type="Service"
+                )
+                ]
+            )
+            ]
+        )
+        aws_iam_policy_ssm_lifecycle = IamPolicy(self, "ssm_lifecycle_4",
+            name="SSMLifecycle",
+            policy=Token.as_string(ssm_lifecycle.json)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_policy_ssm_lifecycle.override_logical_id("ssm_lifecycle")
+        aws_iam_role_ssm_lifecycle = IamRole(self, "ssm_lifecycle_5",
+            assume_role_policy=Token.as_string(ssm_lifecycle_trust.json),
+            name="SSMLifecycle"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_role_ssm_lifecycle.override_logical_id("ssm_lifecycle")
+        aws_iam_role_policy_attachment_ssm_lifecycle = IamRolePolicyAttachment(self, "ssm_lifecycle_6",
+            policy_arn=Token.as_string(aws_iam_policy_ssm_lifecycle.arn),
+            role=Token.as_string(aws_iam_role_ssm_lifecycle.name)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_role_policy_attachment_ssm_lifecycle.override_logical_id("ssm_lifecycle")
+        aws_cloudwatch_event_target_stop_instances = CloudwatchEventTarget(self, "stop_instances_7",
+            arn=stop_instance.arn,
+            role_arn=Token.as_string(aws_iam_role_ssm_lifecycle.arn),
+            rule=stop_instances.name,
+            run_command_targets=[CloudwatchEventTargetRunCommandTargets(
+                key="tag:Terminate",
+                values=["midnight"]
+            )
+            ],
+            target_id="StopInstance"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_cloudwatch_event_target_stop_instances.override_logical_id("stop_instances")
+```
+
+### RunCommand Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudwatch_event_rule import CloudwatchEventRule
+from imports.aws.cloudwatch_event_target import CloudwatchEventTarget
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        stop_instances = CloudwatchEventRule(self, "stop_instances",
+            description="Stop instances nightly",
+            name="StopInstance",
+            schedule_expression="cron(0 0 * * ? *)"
+        )
+        aws_cloudwatch_event_target_stop_instances = CloudwatchEventTarget(self, "stop_instances_1",
+            arn="arn:aws:ssm:${" + aws_region.value + "}::document/AWS-RunShellScript",
+            input="{\\\"commands\\\":[\\\"halt\\\"]}",
+            role_arn=ssm_lifecycle.arn,
+            rule=stop_instances.name,
+            run_command_targets=[CloudwatchEventTargetRunCommandTargets(
+                key="tag:Terminate",
+                values=["midnight"]
+            )
+            ],
+            target_id="StopInstance"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_cloudwatch_event_target_stop_instances.override_logical_id("stop_instances")
+```
+
+### ECS Run Task with Role and Task Override Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudwatch_event_target import CloudwatchEventTarget
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.iam_role import IamRole
+from imports.aws.iam_role_policy import IamRolePolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        assume_role = DataAwsIamPolicyDocument(self, "assume_role",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["sts:AssumeRole"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["events.amazonaws.com"],
+                    type="Service"
+                )
+                ]
+            )
+            ]
+        )
+        ecs_events_run_task_with_any_role = DataAwsIamPolicyDocument(self, "ecs_events_run_task_with_any_role",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["iam:PassRole"],
+                effect="Allow",
+                resources=["*"]
+            ), DataAwsIamPolicyDocumentStatement(
+                actions=["ecs:RunTask"],
+                effect="Allow",
+                resources=[
+                    Token.as_string(Fn.replace(task_name.arn, "/:\\\\d+$/", ":*"))
+                ]
+            )
+            ]
+        )
+        ecs_events = IamRole(self, "ecs_events",
+            assume_role_policy=Token.as_string(assume_role.json),
+            name="ecs_events"
+        )
+        aws_iam_role_policy_ecs_events_run_task_with_any_role = IamRolePolicy(self, "ecs_events_run_task_with_any_role_3",
+            name="ecs_events_run_task_with_any_role",
+            policy=Token.as_string(ecs_events_run_task_with_any_role.json),
+            role=ecs_events.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_role_policy_ecs_events_run_task_with_any_role.override_logical_id("ecs_events_run_task_with_any_role")
+        CloudwatchEventTarget(self, "ecs_scheduled_task",
+            arn=cluster_name.arn,
+            ecs_target=CloudwatchEventTargetEcsTarget(
+                task_count=1,
+                task_definition_arn=task_name.arn
+            ),
+            input=Token.as_string(
+                Fn.jsonencode({
+                    "container_overrides": [{
+                        "command": ["bin/console", "scheduled-task"],
+                        "name": "name-of-container-to-override"
+                    }
+                    ]
+                })),
+            role_arn=ecs_events.arn,
+            rule=every_hour.name,
+            target_id="run-scheduled-task-every-hour"
+        )
+```
+
+### API Gateway target
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.api_gateway_deployment import ApiGatewayDeployment
+from imports.aws.api_gateway_stage import ApiGatewayStage
+from imports.aws.cloudwatch_event_rule import CloudwatchEventRule
+from imports.aws.cloudwatch_event_target import CloudwatchEventTarget
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, stageName):
+        super().__init__(scope, name)
+        example = ApiGatewayDeployment(self, "example",
+            rest_api_id=Token.as_string(aws_api_gateway_rest_api_example.id)
+        )
+        aws_api_gateway_stage_example = ApiGatewayStage(self, "example_1",
+            deployment_id=example.id,
+            rest_api_id=Token.as_string(aws_api_gateway_rest_api_example.id),
+            stage_name=stage_name
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_api_gateway_stage_example.override_logical_id("example")
+        aws_cloudwatch_event_rule_example = CloudwatchEventRule(self, "example_2")
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_cloudwatch_event_rule_example.override_logical_id("example")
+        aws_cloudwatch_event_target_example = CloudwatchEventTarget(self, "example_3",
+            arn="${" + aws_api_gateway_stage_example.execution_arn + "}/GET",
+            http_target=CloudwatchEventTargetHttpTarget(
+                header_parameters={
+                    "Env": "Test"
+                },
+                query_string_parameters={
+                    "Body": "$.detail.body"
+                }
+            ),
+            rule=Token.as_string(aws_cloudwatch_event_rule_example.id)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_cloudwatch_event_target_example.override_logical_id("example")
+```
+
+### Cross-Account Event Bus target
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudwatch_event_rule import CloudwatchEventRule
+from imports.aws.cloudwatch_event_target import CloudwatchEventTarget
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.iam_policy import IamPolicy
+from imports.aws.iam_role import IamRole
+from imports.aws.iam_role_policy_attachment import IamRolePolicyAttachment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        stop_instances = CloudwatchEventRule(self, "stop_instances",
+            description="Stop instances nightly",
+            name="StopInstance",
+            schedule_expression="cron(0 0 * * ? *)"
+        )
+        assume_role = DataAwsIamPolicyDocument(self, "assume_role",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["sts:AssumeRole"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["events.amazonaws.com"],
+                    type="Service"
+                )
+                ]
+            )
+            ]
+        )
+        event_bus_invoke_remote_event_bus = DataAwsIamPolicyDocument(self, "event_bus_invoke_remote_event_bus",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["events:PutEvents"],
+                effect="Allow",
+                resources=["arn:aws:events:eu-west-1:1234567890:event-bus/My-Event-Bus"
+                ]
+            )
+            ]
+        )
+        aws_iam_policy_event_bus_invoke_remote_event_bus = IamPolicy(self, "event_bus_invoke_remote_event_bus_3",
+            name="event_bus_invoke_remote_event_bus",
+            policy=Token.as_string(event_bus_invoke_remote_event_bus.json)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_policy_event_bus_invoke_remote_event_bus.override_logical_id("event_bus_invoke_remote_event_bus")
+        aws_iam_role_event_bus_invoke_remote_event_bus = IamRole(self, "event_bus_invoke_remote_event_bus_4",
+            assume_role_policy=Token.as_string(assume_role.json),
+            name="event-bus-invoke-remote-event-bus"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_role_event_bus_invoke_remote_event_bus.override_logical_id("event_bus_invoke_remote_event_bus")
+        aws_iam_role_policy_attachment_event_bus_invoke_remote_event_bus =
+        IamRolePolicyAttachment(self, "event_bus_invoke_remote_event_bus_5",
+            policy_arn=Token.as_string(aws_iam_policy_event_bus_invoke_remote_event_bus.arn),
+            role=Token.as_string(aws_iam_role_event_bus_invoke_remote_event_bus.name)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_role_policy_attachment_event_bus_invoke_remote_event_bus.override_logical_id("event_bus_invoke_remote_event_bus")
+        aws_cloudwatch_event_target_stop_instances = CloudwatchEventTarget(self, "stop_instances_6",
+            arn="arn:aws:events:eu-west-1:1234567890:event-bus/My-Event-Bus",
+            role_arn=Token.as_string(aws_iam_role_event_bus_invoke_remote_event_bus.arn),
+            rule=stop_instances.name,
+            target_id="StopInstance"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_cloudwatch_event_target_stop_instances.override_logical_id("stop_instances")
+```
+
+### Input Transformer Usage - JSON Object
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudwatch_event_rule import CloudwatchEventRule
+from imports.aws.cloudwatch_event_target import CloudwatchEventTarget
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = CloudwatchEventRule(self, "example")
+        aws_cloudwatch_event_target_example = CloudwatchEventTarget(self, "example_1",
+            arn=Token.as_string(aws_lambda_function_example.arn),
+            input_transformer=CloudwatchEventTargetInputTransformer(
+                input_paths={
+                    "instance": "$.detail.instance",
+                    "status": "$.detail.status"
+                },
+                input_template="{\n  \"instance_id\": <instance>,\n  \"instance_status\": <status>\n}\n\n"
+            ),
+            rule=example.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_cloudwatch_event_target_example.override_logical_id("example")
+```
+
+### Input Transformer Usage - Simple String
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudwatch_event_rule import CloudwatchEventRule
+from imports.aws.cloudwatch_event_target import CloudwatchEventTarget
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = CloudwatchEventRule(self, "example")
+        aws_cloudwatch_event_target_example = CloudwatchEventTarget(self, "example_1",
+            arn=Token.as_string(aws_lambda_function_example.arn),
+            input_transformer=CloudwatchEventTargetInputTransformer(
+                input_paths={
+                    "instance": "$.detail.instance",
+                    "status": "$.detail.status"
+                },
+                input_template="\\\"<instance> is in state <status>\\\""
+            ),
+            rule=example.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_cloudwatch_event_target_example.override_logical_id("example")
+```
+
+### Cloudwatch Log Group Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudwatch_event_rule import CloudwatchEventRule
+from imports.aws.cloudwatch_event_target import CloudwatchEventTarget
+from imports.aws.cloudwatch_log_group import CloudwatchLogGroup
+from imports.aws.cloudwatch_log_resource_policy import CloudwatchLogResourcePolicy
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = CloudwatchEventRule(self, "example",
+            description="GuardDuty Findings",
+            event_pattern=Token.as_string(
+                Fn.jsonencode({
+                    "source": ["aws.guardduty"]
+                })),
+            name="guard-duty_event_rule",
+            tags={
+                "Environment": "example"
+            }
+        )
+        aws_cloudwatch_log_group_example = CloudwatchLogGroup(self, "example_1",
+            name="/aws/events/guardduty/logs",
+            retention_in_days=1
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_cloudwatch_log_group_example.override_logical_id("example")
+        example_log_policy = DataAwsIamPolicyDocument(self, "example_log_policy",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["logs:CreateLogStream"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["events.amazonaws.com", "delivery.logs.amazonaws.com"
+                    ],
+                    type="Service"
+                )
+                ],
+                resources=["${" + aws_cloudwatch_log_group_example.arn + "}:*"]
+            ), DataAwsIamPolicyDocumentStatement(
+                actions=["logs:PutLogEvents"],
+                condition=[DataAwsIamPolicyDocumentStatementCondition(
+                    test="ArnEquals",
+                    values=[example.arn],
+                    variable="aws:SourceArn"
+                )
+                ],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["events.amazonaws.com", "delivery.logs.amazonaws.com"
+                    ],
+                    type="Service"
+                )
+                ],
+                resources=["${" + aws_cloudwatch_log_group_example.arn + "}:*:*"]
+            )
+            ]
+        )
+        aws_cloudwatch_event_target_example = CloudwatchEventTarget(self, "example_3",
+            arn=Token.as_string(aws_cloudwatch_log_group_example.arn),
+            rule=example.name
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_cloudwatch_event_target_example.override_logical_id("example")
+        aws_cloudwatch_log_resource_policy_example =
+        CloudwatchLogResourcePolicy(self, "example_4",
+            policy_document=Token.as_string(example_log_policy.json),
+            policy_name="guardduty-log-publishing-policy"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_cloudwatch_log_resource_policy_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+-> **Note:** In order to be able to have your AWS Lambda function or
+   SNS topic invoked by an EventBridge rule, you must set up the right permissions
+   using [`aws_lambda_permission`](/docs/providers/aws/r/lambda_permission.html)
+   or [`aws_sns_topic_policy`](/docs/providers/aws/r/sns_topic_policy.html).
+   More info [here](https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-use-resource-based.html).
+
+The following arguments are required:
+
+* `arn` - (Required) The Amazon Resource Name (ARN) of the target.
+* `rule` - (Required) The name of the rule you want to add targets to.
+
+The following arguments are optional:
+
+* `batch_target` - (Optional) Parameters used when you are using the rule to invoke an Amazon Batch Job. Documented below. A maximum of 1 are allowed.
+* `dead_letter_config` - (Optional)  Parameters used when you are providing a dead letter config. Documented below. A maximum of 1 are allowed.
+* `ecs_target` - (Optional) Parameters used when you are using the rule to invoke Amazon ECS Task. Documented below. A maximum of 1 are allowed.
+* `event_bus_name` - (Optional) The name or ARN of the event bus to associate with the rule.
+  If you omit this, the `default` event bus is used.
+* `http_target` - (Optional) Parameters used when you are using the rule to invoke an API Gateway REST endpoint. Documented below. A maximum of 1 is allowed.
+* `input` - (Optional) Valid JSON text passed to the target. Conflicts with `input_path` and `input_transformer`.
+* `input_path` - (Optional) The value of the [JSONPath](http://goessner.net/articles/JsonPath/) that is used for extracting part of the matched event when passing it to the target. Conflicts with `input` and `input_transformer`.
+* `input_transformer` - (Optional) Parameters used when you are providing a custom input to a target based on certain event data. Conflicts with `input` and `input_path`.
+* `kinesis_target` - (Optional) Parameters used when you are using the rule to invoke an Amazon Kinesis Stream. Documented below. A maximum of 1 are allowed.
+* `role_arn` - (Optional) The Amazon Resource Name (ARN) of the IAM role to be used for this target when the rule is triggered. Required if `ecs_target` is used or target in `arn` is EC2 instance, Kinesis data stream, Step Functions state machine, or Event Bus in different account or region.
+* `run_command_targets` - (Optional) Parameters used when you are using the rule to invoke Amazon EC2 Run Command. Documented below. A maximum of 5 are allowed.
+* `redshift_target` - (Optional) Parameters used when you are using the rule to invoke an Amazon Redshift Statement. Documented below. A maximum of 1 are allowed.
+* `retry_policy` - (Optional)  Parameters used when you are providing retry policies. Documented below. A maximum of 1 are allowed.
+* `sagemaker_pipeline_target` - (Optional) Parameters used when you are using the rule to invoke an Amazon SageMaker Pipeline. Documented below. A maximum of 1 are allowed.
+* `sqs_target` - (Optional) Parameters used when you are using the rule to invoke an Amazon SQS Queue. Documented below. A maximum of 1 are allowed.
+* `target_id` - (Optional) The unique target assignment ID. If missing, will generate a random, unique id.
+
+### batch_target
+
+* `job_definition` - (Required) The ARN or name of the job definition to use if the event target is an AWS Batch job. This job definition must already exist.
+* `job_name` - (Required) The name to use for this execution of the job, if the target is an AWS Batch job.
+* `array_size` - (Optional) The size of the array, if this is an array batch job. Valid values are integers between 2 and 10,000.
+* `job_attempts` - (Optional) The number of times to attempt to retry, if the job fails. Valid values are 1 to 10.
+
+### capacity_provider_strategy
+
+* `capacity_provider` - (Required) Short name of the capacity provider.
+* `weight` - (Required) The weight value designates the relative percentage of the total number of tasks launched that should use the specified capacity provider. The weight value is taken into consideration after the base value, if defined, is satisfied.
+* `base` - (Optional) The base value designates how many tasks, at a minimum, to run on the specified capacity provider. Only one capacity provider in a capacity provider strategy can have a base defined. Defaults to `0`.
+
+### dead_letter_config
+
+* `arn` - (Optional) - ARN of the SQS queue specified as the target for the dead-letter queue.
+
+### ecs_target
+
+* `task_definition_arn` - (Required) The ARN of the task definition to use if the event target is an Amazon ECS cluster.
+* `capacity_provider_strategy` - (Optional) The capacity provider strategy to use for the task. If a `capacity_provider_strategy` specified, the `launch_type` parameter must be omitted. If no `capacity_provider_strategy` or `launch_type` is specified, the default capacity provider strategy for the cluster is used. Can be one or more. See below.
+* `enable_ecs_managed_tags` - (Optional) Specifies whether to enable Amazon ECS managed tags for the task.
+* `enable_execute_command` - (Optional) Whether or not to enable the execute command functionality for the containers in this task. If true, this enables execute command functionality on all containers in the task.
+* `group` - (Optional) Specifies an ECS task group for the task. The maximum length is 255 characters.
+* `launch_type` - (Optional) Specifies the launch type on which your task is running. The launch type that you specify here must match one of the launch type (compatibilities) of the target task. Valid values include: `EC2`, `EXTERNAL`, or `FARGATE`.
+* `network_configuration` - (Optional) Use this if the ECS task uses the awsvpc network mode. This specifies the VPC subnets and security groups associated with the task, and whether a public IP address is to be used. Required if `launch_type` is `FARGATE` because the awsvpc mode is required for Fargate tasks.
+* `ordered_placement_strategy` - (Optional) An array of placement strategy objects to use for the task. You can specify a maximum of five strategy rules per task.
+* `placement_constraint` - (Optional) An array of placement constraint objects to use for the task. You can specify up to 10 constraints per task (including constraints in the task definition and those specified at runtime). See Below.
+* `platform_version` - (Optional) Specifies the platform version for the task. Specify only the numeric portion of the platform version, such as `1.1.0`. This is used only if LaunchType is FARGATE. For more information about valid platform versions, see [AWS Fargate Platform Versions](http://docs.aws.amazon.com/AmazonECS/latest/developerguide/platform_versions.html).
+* `propagate_tags` - (Optional) Specifies whether to propagate the tags from the task definition to the task. If no value is specified, the tags are not propagated. Tags can only be propagated to the task during task creation. The only valid value is: `TASK_DEFINITION`.
+* `task_count` - (Optional) The number of tasks to create based on the TaskDefinition. Defaults to `1`.
+* `tags` - (Optional) A map of tags to assign to ecs resources.
+
+### http_target
+
+* `header_parameters` - (Optional) Enables you to specify HTTP headers to add to the request.
+* `path_parameter_values` - (Optional) The list of values that correspond sequentially to any path variables in your endpoint ARN (for example `arn:aws:execute-api:us-east-1:123456:myapi/*/POST/pets/*`).
+* `query_string_parameters` - (Optional) Represents keys/values of query string parameters that are appended to the invoked endpoint.
+
+### input_transformer
+
+* `input_template` - (Required) Template to customize data sent to the target. Must be valid JSON. To send a string value, the string value must include double quotes. Values must be escaped for both JSON and Terraform, e.g., `"\"Your string goes here.\\nA new line.\""`
+* `input_paths` - (Optional) Key value pairs specified in the form of JSONPath (for example, time = $.time)
+    * You can have as many as 100 key-value pairs.
+    * You must use JSON dot notation, not bracket notation.
+    * The keys can't start with "AWS".
+
+### kinesis_target
+
+* `partition_key_path` - (Optional) The JSON path to be extracted from the event and used as the partition key.
+
+### network_configuration
+
+* `subnets` - (Required) The subnets associated with the task or service.
+* `security_groups` - (Optional) The security groups associated with the task or service. If you do not specify a security group, the default security group for the VPC is used.
+* `assign_public_ip` - (Optional) Assign a public IP address to the ENI (Fargate launch type only). Valid values are `true` or `false`. Defaults to `false`.
+
+For more information, see [Task Networking](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-networking.html)
+
+### ordered_placement_strategy
+
+* `type` - (Required) Type of placement strategy. The only valid values at this time are `binpack`, `random` and `spread`.
+* `field` - (Optional) The field to apply the placement strategy against. For the `spread` placement strategy, valid values are `instanceId` (or `host`, which has the same effect), or any platform or custom attribute that is applied to a container instance, such as `attribute:ecs.availability-zone`. For the `binpack` placement strategy, valid values are `cpu` and `memory`. For the `random` placement strategy, this field is not used. For more information, see [Amazon ECS task placement strategies](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-placement-strategies.html).
+
+### placement_constraint
+
+* `type` - (Required) Type of constraint. The only valid values at this time are `memberOf` and `distinctInstance`.
+* `expression` -  (Optional) Cluster Query Language expression to apply to the constraint. Does not need to be specified for the `distinctInstance` type. For more information, see [Cluster Query Language in the Amazon EC2 Container Service Developer Guide](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/cluster-query-language.html).
+
+### redshift_target
+
+* `database` - (Required) The name of the database.
+* `db_user` - (Optional) The database user name.
+* `secrets_manager_arn` - (Optional) The name or ARN of the secret that enables access to the database.
+* `sql` - (Optional) The SQL statement text to run.
+* `statement_name` - (Optional) The name of the SQL statement.
+* `with_event` - (Optional) Indicates whether to send an event back to EventBridge after the SQL statement runs.
+
+### retry_policy
+
+* `maximum_event_age_in_seconds` - (Optional) The age in seconds to continue to make retry attempts.
+* `maximum_retry_attempts` - (Optional) maximum number of retry attempts to make before the request fails
+
+### run_command_targets
+
+* `key` - (Required) Can be either `tag:tag-key` or `InstanceIds`.
+* `values` - (Required) If Key is `tag:tag-key`, Values is a list of tag values. If Key is `InstanceIds`, Values is a list of Amazon EC2 instance IDs.
+
+### sqs_target
+
+* `message_group_id` - (Optional) The FIFO message group ID to use as the target.
+
+### sagemaker_pipeline_target
+
+* `pipeline_parameter_list` - (Optional) List of Parameter names and values for SageMaker Model Building Pipeline execution.
+
+#### pipeline_parameter_list
+
+* `name` - (Required) Name of parameter to start execution of a SageMaker Model Building Pipeline.
+* `value` - (Required) Value of parameter to start execution of a SageMaker Model Building Pipeline.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EventBridge Targets using `event_bus_name/rule-name/target-id` (if you omit `event_bus_name`, the `default` event bus will be used). For example:
+
+ ```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import EventBridge Targets using `event_bus_name/rule-name/target-id` (if you omit `event_bus_name`, the `default` event bus will be used). For example:
+
+ ```console
+% terraform import aws_cloudwatch_event_target.test-event-target rule-name/target-id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-164c7e04d13a473ab9a0bbaa30d85030d052da19096a3497304d82fd1d72d513 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/cloudwatch_log_data_protection_policy.html.markdown b/website/docs/cdktf/python/r/cloudwatch_log_data_protection_policy.html.markdown
new file mode 100644
index 00000000000..eeacdc66859
--- /dev/null
+++ b/website/docs/cdktf/python/r/cloudwatch_log_data_protection_policy.html.markdown
@@ -0,0 +1,108 @@
+---
+subcategory: "CloudWatch Logs"
+layout: "aws"
+page_title: "AWS: aws_cloudwatch_log_data_protection_policy"
+description: |-
+  Provides a CloudWatch Log Data Protection Policy resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudwatch_log_data_protection_policy
+
+Provides a CloudWatch Log Data Protection Policy resource.
+
+Read more about protecting sensitive user data in the [User Guide](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/mask-sensitive-log-data.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudwatch_log_data_protection_policy import CloudwatchLogDataProtectionPolicy
+from imports.aws.cloudwatch_log_group import CloudwatchLogGroup
+from imports.aws.s3_bucket import S3Bucket
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = CloudwatchLogGroup(self, "example",
+            name="example"
+        )
+        aws_s3_bucket_example = S3Bucket(self, "example_1",
+            bucket="example"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_example.override_logical_id("example")
+        aws_cloudwatch_log_data_protection_policy_example =
+        CloudwatchLogDataProtectionPolicy(self, "example_2",
+            log_group_name=example.name,
+            policy_document=Token.as_string(
+                Fn.jsonencode({
+                    "Name": "Example",
+                    "Statement": [{
+                        "DataIdentifier": ["arn:aws:dataprotection::aws:data-identifier/EmailAddress"
+                        ],
+                        "Operation": {
+                            "Audit": {
+                                "FindingsDestination": {
+                                    "S3": {
+                                        "Bucket": aws_s3_bucket_example.bucket
+                                    }
+                                }
+                            }
+                        },
+                        "Sid": "Audit"
+                    }, {
+                        "DataIdentifier": ["arn:aws:dataprotection::aws:data-identifier/EmailAddress"
+                        ],
+                        "Operation": {
+                            "Deidentify": {
+                                "MaskConfig": {}
+                            }
+                        },
+                        "Sid": "Redact"
+                    }
+                    ],
+                    "Version": "2021-06-01"
+                }))
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_cloudwatch_log_data_protection_policy_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `log_group_name` - (Required) The name of the log group under which the log stream is to be created.
+* `policy_document` - (Required) Specifies the data protection policy in JSON. Read more at [Data protection policy syntax](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/mask-sensitive-log-data-start.html#mask-sensitive-log-data-policysyntax).
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import this resource using the `log_group_name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import this resource using the `log_group_name`. For example:
+
+```console
+% terraform import aws_cloudwatch_log_data_protection_policy.example my-log-group
+```
+
+<!-- cache-key: cdktf-0.18.0 input-5d0eb45bdebf63544029d216f663f1fa8e735ed48c73f741006440431b616666 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/cloudwatch_log_destination.html.markdown b/website/docs/cdktf/python/r/cloudwatch_log_destination.html.markdown
new file mode 100644
index 00000000000..dddd557e225
--- /dev/null
+++ b/website/docs/cdktf/python/r/cloudwatch_log_destination.html.markdown
@@ -0,0 +1,71 @@
+---
+subcategory: "CloudWatch Logs"
+layout: "aws"
+page_title: "AWS: aws_cloudwatch_log_destination"
+description: |-
+  Provides a CloudWatch Logs destination.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudwatch_log_destination
+
+Provides a CloudWatch Logs destination resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudwatch_log_destination import CloudwatchLogDestination
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        CloudwatchLogDestination(self, "test_destination",
+            name="test_destination",
+            role_arn=iam_for_cloudwatch.arn,
+            target_arn=kinesis_for_cloudwatch.arn
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) A name for the log destination.
+* `role_arn` - (Required) The ARN of an IAM role that grants Amazon CloudWatch Logs permissions to put data into the target.
+* `target_arn` - (Required) The ARN of the target Amazon Kinesis stream resource for the destination.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) specifying the log destination.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudWatch Logs destinations using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import CloudWatch Logs destinations using the `name`. For example:
+
+```console
+% terraform import aws_cloudwatch_log_destination.test_destination test_destination
+```
+
+<!-- cache-key: cdktf-0.18.0 input-46d1c43716e504d59d633735be752913c3042813cb3fadb4b8427dbfc5e8d918 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/cloudwatch_log_destination_policy.html.markdown b/website/docs/cdktf/python/r/cloudwatch_log_destination_policy.html.markdown
new file mode 100644
index 00000000000..e3e80d83d2a
--- /dev/null
+++ b/website/docs/cdktf/python/r/cloudwatch_log_destination_policy.html.markdown
@@ -0,0 +1,89 @@
+---
+subcategory: "CloudWatch Logs"
+layout: "aws"
+page_title: "AWS: aws_cloudwatch_log_destination_policy"
+description: |-
+  Provides a CloudWatch Logs destination policy.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudwatch_log_destination_policy
+
+Provides a CloudWatch Logs destination policy resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudwatch_log_destination import CloudwatchLogDestination
+from imports.aws.cloudwatch_log_destination_policy import CloudwatchLogDestinationPolicy
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        test_destination = CloudwatchLogDestination(self, "test_destination",
+            name="test_destination",
+            role_arn=iam_for_cloudwatch.arn,
+            target_arn=kinesis_for_cloudwatch.arn
+        )
+        test_destination_policy = DataAwsIamPolicyDocument(self, "test_destination_policy",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["logs:PutSubscriptionFilter"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["123456789012"],
+                    type="AWS"
+                )
+                ],
+                resources=[test_destination.arn]
+            )
+            ]
+        )
+        aws_cloudwatch_log_destination_policy_test_destination_policy =
+        CloudwatchLogDestinationPolicy(self, "test_destination_policy_2",
+            access_policy=Token.as_string(test_destination_policy.json),
+            destination_name=test_destination.name
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_cloudwatch_log_destination_policy_test_destination_policy.override_logical_id("test_destination_policy")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `destination_name` - (Required) A name for the subscription filter
+* `access_policy` - (Required) The policy document. This is a JSON formatted string.
+* `force_update` - (Optional) Specify true if you are updating an existing destination policy to grant permission to an organization ID instead of granting permission to individual AWS accounts.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudWatch Logs destination policies using the `destination_name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import CloudWatch Logs destination policies using the `destination_name`. For example:
+
+```console
+% terraform import aws_cloudwatch_log_destination_policy.test_destination_policy test_destination
+```
+
+<!-- cache-key: cdktf-0.18.0 input-e9a8dea320a37c932bb21790e7e8761e42c974c856dc567a8154f492a8252914 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/cloudwatch_log_group.html.markdown b/website/docs/cdktf/python/r/cloudwatch_log_group.html.markdown
new file mode 100644
index 00000000000..4fcc7aee253
--- /dev/null
+++ b/website/docs/cdktf/python/r/cloudwatch_log_group.html.markdown
@@ -0,0 +1,79 @@
+---
+subcategory: "CloudWatch Logs"
+layout: "aws"
+page_title: "AWS: aws_cloudwatch_log_group"
+description: |-
+  Provides a CloudWatch Log Group resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudwatch_log_group
+
+Provides a CloudWatch Log Group resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudwatch_log_group import CloudwatchLogGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        CloudwatchLogGroup(self, "yada",
+            name="Yada",
+            tags={
+                "Application": "serviceA",
+                "Environment": "production"
+            }
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Optional, Forces new resource) The name of the log group. If omitted, Terraform will assign a random, unique name.
+* `name_prefix` - (Optional, Forces new resource) Creates a unique name beginning with the specified prefix. Conflicts with `name`.
+* `skip_destroy` - (Optional) Set to true if you do not wish the log group (and any logs it may contain) to be deleted at destroy time, and instead just remove the log group from the Terraform state.
+* `retention_in_days` - (Optional) Specifies the number of days
+  you want to retain log events in the specified log group.  Possible values are: 1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1096, 1827, 2192, 2557, 2922, 3288, 3653, and 0.
+  If you select 0, the events in the log group are always retained and never expire.
+* `kms_key_id` - (Optional) The ARN of the KMS Key to use when encrypting log data. Please note, after the AWS KMS CMK is disassociated from the log group,
+AWS CloudWatch Logs stops encrypting newly ingested data for the log group. All previously ingested data remains encrypted, and AWS CloudWatch Logs requires
+permissions for the CMK whenever the encrypted data is requested.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) specifying the log group. Any `:*` suffix added by the API, denoting all CloudWatch Log Streams under the CloudWatch Log Group, is removed for greater compatibility with other AWS services that do not accept the suffix.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Cloudwatch Log Groups using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Cloudwatch Log Groups using the `name`. For example:
+
+```console
+% terraform import aws_cloudwatch_log_group.test_group yada
+```
+
+<!-- cache-key: cdktf-0.18.0 input-80dd704f7091eb9abb465ed20f8cdf999d0caa9424fa22d9998666170de0145a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/cloudwatch_log_metric_filter.html.markdown b/website/docs/cdktf/python/r/cloudwatch_log_metric_filter.html.markdown
new file mode 100644
index 00000000000..95e558c8d36
--- /dev/null
+++ b/website/docs/cdktf/python/r/cloudwatch_log_metric_filter.html.markdown
@@ -0,0 +1,89 @@
+---
+subcategory: "CloudWatch Logs"
+layout: "aws"
+page_title: "AWS: aws_cloudwatch_log_metric_filter"
+description: |-
+  Provides a CloudWatch Log Metric Filter resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudwatch_log_metric_filter
+
+Provides a CloudWatch Log Metric Filter resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudwatch_log_group import CloudwatchLogGroup
+from imports.aws.cloudwatch_log_metric_filter import CloudwatchLogMetricFilter
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        dada = CloudwatchLogGroup(self, "dada",
+            name="MyApp/access.log"
+        )
+        CloudwatchLogMetricFilter(self, "yada",
+            log_group_name=dada.name,
+            metric_transformation=CloudwatchLogMetricFilterMetricTransformation(
+                name="EventCount",
+                namespace="YourNamespace",
+                value="1"
+            ),
+            name="MyAppAccessCount",
+            pattern=""
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) A name for the metric filter.
+* `pattern` - (Required) A valid [CloudWatch Logs filter pattern](https://docs.aws.amazon.com/AmazonCloudWatch/latest/DeveloperGuide/FilterAndPatternSyntax.html)
+  for extracting metric data out of ingested log events.
+* `log_group_name` - (Required) The name of the log group to associate the metric filter with.
+* `metric_transformation` - (Required) A block defining collection of information needed to define how metric data gets emitted. See below.
+
+The `metric_transformation` block supports the following arguments:
+
+* `name` - (Required) The name of the CloudWatch metric to which the monitored log information should be published (e.g., `ErrorCount`)
+* `namespace` - (Required) The destination namespace of the CloudWatch metric.
+* `value` - (Required) What to publish to the metric. For example, if you're counting the occurrences of a particular term like "Error", the value will be "1" for each occurrence. If you're counting the bytes transferred the published value will be the value in the log event.
+* `default_value` - (Optional) The value to emit when a filter pattern does not match a log event. Conflicts with `dimensions`.
+* `dimensions` - (Optional) Map of fields to use as dimensions for the metric. Up to 3 dimensions are allowed. Conflicts with `default_value`.
+* `unit` - (Optional) The unit to assign to the metric. If you omit this, the unit is set as `None`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name of the metric filter.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudWatch Log Metric Filter using the `log_group_name:name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import CloudWatch Log Metric Filter using the `log_group_name:name`. For example:
+
+```console
+% terraform import aws_cloudwatch_log_metric_filter.test /aws/lambda/function:test
+```
+
+<!-- cache-key: cdktf-0.18.0 input-c3539b00aea6703f03f30c699d9e6682c77afa8c2025da9bd2bce0e294523841 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/cloudwatch_log_resource_policy.html.markdown b/website/docs/cdktf/python/r/cloudwatch_log_resource_policy.html.markdown
new file mode 100644
index 00000000000..48ad512c033
--- /dev/null
+++ b/website/docs/cdktf/python/r/cloudwatch_log_resource_policy.html.markdown
@@ -0,0 +1,122 @@
+---
+subcategory: "CloudWatch Logs"
+layout: "aws"
+page_title: "AWS: aws_cloudwatch_log_resource_policy"
+description: |-
+  Provides a resource to manage a CloudWatch log resource policy
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudwatch_log_resource_policy
+
+Provides a resource to manage a CloudWatch log resource policy.
+
+## Example Usage
+
+### Elasticsearch Log Publishing
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudwatch_log_resource_policy import CloudwatchLogResourcePolicy
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        elasticsearch_log_publishing_policy = DataAwsIamPolicyDocument(self, "elasticsearch-log-publishing-policy",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["logs:CreateLogStream", "logs:PutLogEvents", "logs:PutLogEventsBatch"
+                ],
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["es.amazonaws.com"],
+                    type="Service"
+                )
+                ],
+                resources=["arn:aws:logs:*"]
+            )
+            ]
+        )
+        aws_cloudwatch_log_resource_policy_elasticsearch_log_publishing_policy =
+        CloudwatchLogResourcePolicy(self, "elasticsearch-log-publishing-policy_1",
+            policy_document=Token.as_string(elasticsearch_log_publishing_policy.json),
+            policy_name="elasticsearch-log-publishing-policy"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_cloudwatch_log_resource_policy_elasticsearch_log_publishing_policy.override_logical_id("elasticsearch-log-publishing-policy")
+```
+
+### Route53 Query Logging
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudwatch_log_resource_policy import CloudwatchLogResourcePolicy
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        route53_query_logging_policy = DataAwsIamPolicyDocument(self, "route53-query-logging-policy",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["logs:CreateLogStream", "logs:PutLogEvents"],
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["route53.amazonaws.com"],
+                    type="Service"
+                )
+                ],
+                resources=["arn:aws:logs:*:*:log-group:/aws/route53/*"]
+            )
+            ]
+        )
+        aws_cloudwatch_log_resource_policy_route53_query_logging_policy =
+        CloudwatchLogResourcePolicy(self, "route53-query-logging-policy_1",
+            policy_document=Token.as_string(route53_query_logging_policy.json),
+            policy_name="route53-query-logging-policy"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_cloudwatch_log_resource_policy_route53_query_logging_policy.override_logical_id("route53-query-logging-policy")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `policy_document` - (Required) Details of the resource policy, including the identity of the principal that is enabled to put logs to this account. This is formatted as a JSON string. Maximum length of 5120 characters.
+* `policy_name` - (Required) Name of the resource policy.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name of the CloudWatch log resource policy
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudWatch log resource policies using the policy name. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import CloudWatch log resource policies using the policy name. For example:
+
+```console
+% terraform import aws_cloudwatch_log_resource_policy.MyPolicy MyPolicy
+```
+
+<!-- cache-key: cdktf-0.18.0 input-e10ada71512fa142d53597fd2949e853332001f8f918abaf19a3f490a6fae621 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/cloudwatch_log_stream.html.markdown b/website/docs/cdktf/python/r/cloudwatch_log_stream.html.markdown
new file mode 100644
index 00000000000..5215b63ab29
--- /dev/null
+++ b/website/docs/cdktf/python/r/cloudwatch_log_stream.html.markdown
@@ -0,0 +1,71 @@
+---
+subcategory: "CloudWatch Logs"
+layout: "aws"
+page_title: "AWS: aws_cloudwatch_log_stream"
+description: |-
+  Provides a CloudWatch Log Stream resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudwatch_log_stream
+
+Provides a CloudWatch Log Stream resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudwatch_log_group import CloudwatchLogGroup
+from imports.aws.cloudwatch_log_stream import CloudwatchLogStream
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        yada = CloudwatchLogGroup(self, "yada",
+            name="Yada"
+        )
+        CloudwatchLogStream(self, "foo",
+            log_group_name=yada.name,
+            name="SampleLogStream1234"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the log stream. Must not be longer than 512 characters and must not contain `:`
+* `log_group_name` - (Required) The name of the log group under which the log stream is to be created.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) specifying the log stream.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Cloudwatch Log Stream using the stream's `log_group_name` and `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Cloudwatch Log Stream using the stream's `log_group_name` and `name`. For example:
+
+```console
+% terraform import aws_cloudwatch_log_stream.foo Yada:SampleLogStream1234
+```
+
+<!-- cache-key: cdktf-0.18.0 input-4fed32ff75bb830aa4a809d588a8fcccf96c6368ab7e6ad418f7d940ac65117d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/cloudwatch_log_subscription_filter.html.markdown b/website/docs/cdktf/python/r/cloudwatch_log_subscription_filter.html.markdown
new file mode 100644
index 00000000000..05a2709d263
--- /dev/null
+++ b/website/docs/cdktf/python/r/cloudwatch_log_subscription_filter.html.markdown
@@ -0,0 +1,73 @@
+---
+subcategory: "CloudWatch Logs"
+layout: "aws"
+page_title: "AWS: aws_cloudwatch_log_subscription_filter"
+description: |-
+  Provides a CloudWatch Logs subscription filter.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudwatch_log_subscription_filter
+
+Provides a CloudWatch Logs subscription filter resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudwatch_log_subscription_filter import CloudwatchLogSubscriptionFilter
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        CloudwatchLogSubscriptionFilter(self, "test_lambdafunction_logfilter",
+            destination_arn=test_logstream.arn,
+            distribution="Random",
+            filter_pattern="logtype test",
+            log_group_name="/aws/lambda/example_lambda_name",
+            name="test_lambdafunction_logfilter",
+            role_arn=iam_for_lambda.arn
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) A name for the subscription filter
+* `destination_arn` - (Required) The ARN of the destination to deliver matching log events to. Kinesis stream or Lambda function ARN.
+* `filter_pattern` - (Required) A valid CloudWatch Logs filter pattern for subscribing to a filtered stream of log events. Use empty string `""` to match everything. For more information, see the [Amazon CloudWatch Logs User Guide](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/FilterAndPatternSyntax.html).
+* `log_group_name` - (Required) The name of the log group to associate the subscription filter with
+* `role_arn` - (Optional) The ARN of an IAM role that grants Amazon CloudWatch Logs permissions to deliver ingested log events to the destination. If you use Lambda as a destination, you should skip this argument and use `aws_lambda_permission` resource for granting access from CloudWatch logs to the destination Lambda function.
+* `distribution` - (Optional) The method used to distribute log data to the destination. By default log data is grouped by log stream, but the grouping can be set to random for a more even distribution. This property is only applicable when the destination is an Amazon Kinesis stream. Valid values are "Random" and "ByLogStream".
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudWatch Logs subscription filter using the log group name and subscription filter name separated by `|`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import CloudWatch Logs subscription filter using the log group name and subscription filter name separated by `|`. For example:
+
+```console
+% terraform import aws_cloudwatch_log_subscription_filter.test_lambdafunction_logfilter /aws/lambda/example_lambda_name|test_lambdafunction_logfilter
+```
+
+<!-- cache-key: cdktf-0.18.0 input-6fe4a3f3f90f50bfb6b67e46b6ceeb3cbceaaa24c09559152a030888d8e3104b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/cloudwatch_metric_alarm.html.markdown b/website/docs/cdktf/python/r/cloudwatch_metric_alarm.html.markdown
new file mode 100644
index 00000000000..a70e37c1d68
--- /dev/null
+++ b/website/docs/cdktf/python/r/cloudwatch_metric_alarm.html.markdown
@@ -0,0 +1,314 @@
+---
+subcategory: "CloudWatch"
+layout: "aws"
+page_title: "AWS: aws_cloudwatch_metric_alarm"
+description: |-
+  Provides a CloudWatch Metric Alarm resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudwatch_metric_alarm
+
+Provides a CloudWatch Metric Alarm resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudwatch_metric_alarm import CloudwatchMetricAlarm
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        CloudwatchMetricAlarm(self, "foobar",
+            alarm_description="This metric monitors ec2 cpu utilization",
+            alarm_name="terraform-test-foobar5",
+            comparison_operator="GreaterThanOrEqualToThreshold",
+            evaluation_periods=2,
+            insufficient_data_actions=[],
+            metric_name="CPUUtilization",
+            namespace="AWS/EC2",
+            period=120,
+            statistic="Average",
+            threshold=80
+        )
+```
+
+## Example in Conjunction with Scaling Policies
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.autoscaling_policy import AutoscalingPolicy
+from imports.aws.cloudwatch_metric_alarm import CloudwatchMetricAlarm
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        bat = AutoscalingPolicy(self, "bat",
+            adjustment_type="ChangeInCapacity",
+            autoscaling_group_name=bar.name,
+            cooldown=300,
+            name="foobar3-terraform-test",
+            scaling_adjustment=4
+        )
+        aws_cloudwatch_metric_alarm_bat = CloudwatchMetricAlarm(self, "bat_1",
+            alarm_actions=[bat.arn],
+            alarm_description="This metric monitors ec2 cpu utilization",
+            alarm_name="terraform-test-foobar5",
+            comparison_operator="GreaterThanOrEqualToThreshold",
+            dimensions={
+                "AutoScalingGroupName": bar.name
+            },
+            evaluation_periods=2,
+            metric_name="CPUUtilization",
+            namespace="AWS/EC2",
+            period=120,
+            statistic="Average",
+            threshold=80
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_cloudwatch_metric_alarm_bat.override_logical_id("bat")
+```
+
+## Example with an Expression
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudwatch_metric_alarm import CloudwatchMetricAlarm
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        CloudwatchMetricAlarm(self, "foobar",
+            alarm_description="Request error rate has exceeded 10%",
+            alarm_name="terraform-test-foobar",
+            comparison_operator="GreaterThanOrEqualToThreshold",
+            evaluation_periods=2,
+            insufficient_data_actions=[],
+            metric_query=[CloudwatchMetricAlarmMetricQuery(
+                expression="m2/m1*100",
+                id="e1",
+                label="Error Rate",
+                return_data=Token.as_boolean("true")
+            ), CloudwatchMetricAlarmMetricQuery(
+                id="m1",
+                metric=CloudwatchMetricAlarmMetricQueryMetric(
+                    dimensions={
+                        "LoadBalancer": "app/web"
+                    },
+                    metric_name="RequestCount",
+                    namespace="AWS/ApplicationELB",
+                    period=120,
+                    stat="Sum",
+                    unit="Count"
+                )
+            ), CloudwatchMetricAlarmMetricQuery(
+                id="m2",
+                metric=CloudwatchMetricAlarmMetricQueryMetric(
+                    dimensions={
+                        "LoadBalancer": "app/web"
+                    },
+                    metric_name="HTTPCode_ELB_5XX_Count",
+                    namespace="AWS/ApplicationELB",
+                    period=120,
+                    stat="Sum",
+                    unit="Count"
+                )
+            )
+            ],
+            threshold=10
+        )
+```
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudwatch_metric_alarm import CloudwatchMetricAlarm
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        CloudwatchMetricAlarm(self, "xx_anomaly_detection",
+            alarm_description="This metric monitors ec2 cpu utilization",
+            alarm_name="terraform-test-foobar",
+            comparison_operator="GreaterThanUpperThreshold",
+            evaluation_periods=2,
+            insufficient_data_actions=[],
+            metric_query=[CloudwatchMetricAlarmMetricQuery(
+                expression="ANOMALY_DETECTION_BAND(m1)",
+                id="e1",
+                label="CPUUtilization (Expected)",
+                return_data=Token.as_boolean("true")
+            ), CloudwatchMetricAlarmMetricQuery(
+                id="m1",
+                metric=CloudwatchMetricAlarmMetricQueryMetric(
+                    dimensions={
+                        "InstanceId": "i-abc123"
+                    },
+                    metric_name="CPUUtilization",
+                    namespace="AWS/EC2",
+                    period=120,
+                    stat="Average",
+                    unit="Count"
+                ),
+                return_data=Token.as_boolean("true")
+            )
+            ],
+            threshold_metric_id="e1"
+        )
+```
+
+## Example of monitoring Healthy Hosts on NLB using Target Group and NLB
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudwatch_metric_alarm import CloudwatchMetricAlarm
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        CloudwatchMetricAlarm(self, "nlb_healthyhosts",
+            actions_enabled=Token.as_boolean("true"),
+            alarm_actions=[sns.arn],
+            alarm_description="Number of healthy nodes in Target Group",
+            alarm_name="alarmname",
+            comparison_operator="LessThanThreshold",
+            dimensions={
+                "LoadBalancer": lb.arn_suffix,
+                "TargetGroup": lb_tg.arn_suffix
+            },
+            evaluation_periods=1,
+            metric_name="HealthyHostCount",
+            namespace="AWS/NetworkELB",
+            ok_actions=[sns.arn],
+            period=60,
+            statistic="Average",
+            threshold=logstash_servers_count.number_value
+        )
+```
+
+~> **NOTE:**  You cannot create a metric alarm consisting of both `statistic` and `extended_statistic` parameters.
+You must choose one or the other
+
+## Argument Reference
+
+See [related part of AWS Docs](https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_PutMetricAlarm.html)
+for details about valid values.
+
+This argument supports the following arguments:
+
+* `alarm_name` - (Required) The descriptive name for the alarm. This name must be unique within the user's AWS account
+* `comparison_operator` - (Required) The arithmetic operation to use when comparing the specified Statistic and Threshold. The specified Statistic value is used as the first operand. Either of the following is supported: `GreaterThanOrEqualToThreshold`, `GreaterThanThreshold`, `LessThanThreshold`, `LessThanOrEqualToThreshold`. Additionally, the values  `LessThanLowerOrGreaterThanUpperThreshold`, `LessThanLowerThreshold`, and `GreaterThanUpperThreshold` are used only for alarms based on anomaly detection models.
+* `evaluation_periods` - (Required) The number of periods over which data is compared to the specified threshold.
+* `metric_name` - (Optional) The name for the alarm's associated metric.
+  See docs for [supported metrics](https://docs.aws.amazon.com/AmazonCloudWatch/latest/DeveloperGuide/CW_Support_For_AWS.html).
+* `namespace` - (Optional) The namespace for the alarm's associated metric. See docs for the [list of namespaces](https://docs.aws.amazon.com/AmazonCloudWatch/latest/DeveloperGuide/aws-namespaces.html).
+  See docs for [supported metrics](https://docs.aws.amazon.com/AmazonCloudWatch/latest/DeveloperGuide/CW_Support_For_AWS.html).
+* `period` - (Optional) The period in seconds over which the specified `statistic` is applied.
+  Valid values are `10`, `30`, or any multiple of `60`.
+* `statistic` - (Optional) The statistic to apply to the alarm's associated metric.
+   Either of the following is supported: `SampleCount`, `Average`, `Sum`, `Minimum`, `Maximum`
+* `threshold` - (Optional) The value against which the specified statistic is compared. This parameter is required for alarms based on static thresholds, but should not be used for alarms based on anomaly detection models.
+* `threshold_metric_id` - (Optional) If this is an alarm based on an anomaly detection model, make this value match the ID of the ANOMALY_DETECTION_BAND function.
+* `actions_enabled` - (Optional) Indicates whether or not actions should be executed during any changes to the alarm's state. Defaults to `true`.
+* `alarm_actions` - (Optional) The list of actions to execute when this alarm transitions into an ALARM state from any other state. Each action is specified as an Amazon Resource Name (ARN).
+* `alarm_description` - (Optional) The description for the alarm.
+* `datapoints_to_alarm` - (Optional) The number of datapoints that must be breaching to trigger the alarm.
+* `dimensions` - (Optional) The dimensions for the alarm's associated metric.  For the list of available dimensions see the AWS documentation [here](http://docs.aws.amazon.com/AmazonCloudWatch/latest/DeveloperGuide/CW_Support_For_AWS.html).
+* `insufficient_data_actions` - (Optional) The list of actions to execute when this alarm transitions into an INSUFFICIENT_DATA state from any other state. Each action is specified as an Amazon Resource Name (ARN).
+* `ok_actions` - (Optional) The list of actions to execute when this alarm transitions into an OK state from any other state. Each action is specified as an Amazon Resource Name (ARN).
+* `unit` - (Optional) The unit for the alarm's associated metric.
+* `extended_statistic` - (Optional) The percentile statistic for the metric associated with the alarm. Specify a value between p0.0 and p100.
+* `treat_missing_data` - (Optional) Sets how this alarm is to handle missing data points. The following values are supported: `missing`, `ignore`, `breaching` and `notBreaching`. Defaults to `missing`.
+* `evaluate_low_sample_count_percentiles` - (Optional) Used only for alarms based on percentiles.
+  If you specify `ignore`, the alarm state will not change during periods with too few data points to be statistically significant.
+  If you specify `evaluate` or omit this parameter, the alarm will always be evaluated and possibly change state no matter how many data points are available.
+The following values are supported: `ignore`, and `evaluate`.
+* `metric_query` (Optional) Enables you to create an alarm based on a metric math expression. You may specify at most 20.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+~> **NOTE:**  If you specify at least one `metric_query`, you may not specify a `metric_name`, `namespace`, `period` or `statistic`. If you do not specify a `metric_query`, you must specify each of these (although you may use `extended_statistic` instead of `statistic`).
+
+### Nested fields
+
+#### `metric_query`
+
+* `id` - (Required) A short name used to tie this object to the results in the response. If you are performing math expressions on this set of data, this name represents that data and can serve as a variable in the mathematical expression. The valid characters are letters, numbers, and underscore. The first character must be a lowercase letter.
+* `account_id` - (Optional) The ID of the account where the metrics are located, if this is a cross-account alarm.
+* `expression` - (Optional) The math expression to be performed on the returned data, if this object is performing a math expression. This expression can use the id of the other metrics to refer to those metrics, and can also use the id of other expressions to use the result of those expressions. For more information about metric math expressions, see Metric Math Syntax and Functions in the [Amazon CloudWatch User Guide](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/using-metric-math.html#metric-math-syntax).
+* `label` - (Optional) A human-readable label for this metric or expression. This is especially useful if this is an expression, so that you know what the value represents.
+* `metric` - (Optional) The metric to be returned, along with statistics, period, and units. Use this parameter only if this object is retrieving a metric and not performing a math expression on returned data.
+* `period` - (Optional) Granularity in seconds of returned data points.
+  For metrics with regular resolution, valid values are any multiple of `60`.
+  For high-resolution metrics, valid values are `1`, `5`, `10`, `30`, or any multiple of `60`.
+* `return_data` - (Optional) Specify exactly one `metric_query` to be `true` to use that `metric_query` result as the alarm.
+
+~> **NOTE:**  You must specify either `metric` or `expression`. Not both.
+
+#### `metric`
+
+* `dimensions` - (Optional) The dimensions for this metric.  For the list of available dimensions see the AWS documentation [here](http://docs.aws.amazon.com/AmazonCloudWatch/latest/DeveloperGuide/CW_Support_For_AWS.html).
+* `metric_name` - (Required) The name for this metric.
+  See docs for [supported metrics](https://docs.aws.amazon.com/AmazonCloudWatch/latest/DeveloperGuide/CW_Support_For_AWS.html).
+* `namespace` - (Required) The namespace for this metric. See docs for the [list of namespaces](https://docs.aws.amazon.com/AmazonCloudWatch/latest/DeveloperGuide/aws-namespaces.html).
+  See docs for [supported metrics](https://docs.aws.amazon.com/AmazonCloudWatch/latest/DeveloperGuide/CW_Support_For_AWS.html).
+* `period` - (Required) Granularity in seconds of returned data points.
+  For metrics with regular resolution, valid values are any multiple of `60`.
+  For high-resolution metrics, valid values are `1`, `5`, `10`, `30`, or any multiple of `60`.
+* `stat` - (Required) The statistic to apply to this metric.
+   See docs for [supported statistics](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Statistics-definitions.html).
+* `unit` - (Optional) The unit for this metric.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the CloudWatch Metric Alarm.
+* `id` - The ID of the health check.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudWatch Metric Alarm using the `alarm_name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import CloudWatch Metric Alarm using the `alarm_name`. For example:
+
+```console
+% terraform import aws_cloudwatch_metric_alarm.test alarm-12345
+```
+
+<!-- cache-key: cdktf-0.18.0 input-35c84ffb25db36c6ca1bc5ffe04bb308aa8f69f6412b0c58319d41a28b5c21f7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/cloudwatch_metric_stream.html.markdown b/website/docs/cdktf/python/r/cloudwatch_metric_stream.html.markdown
new file mode 100644
index 00000000000..42f9d813f44
--- /dev/null
+++ b/website/docs/cdktf/python/r/cloudwatch_metric_stream.html.markdown
@@ -0,0 +1,242 @@
+---
+subcategory: "CloudWatch"
+layout: "aws"
+page_title: "AWS: aws_cloudwatch_metric_stream"
+description: |-
+  Provides a CloudWatch Metric Stream resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudwatch_metric_stream
+
+Provides a CloudWatch Metric Stream resource.
+
+## Example Usage
+
+### Filters
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudwatch_metric_stream import CloudwatchMetricStream
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.iam_role import IamRole
+from imports.aws.iam_role_policy import IamRolePolicy
+from imports.aws.kinesis_firehose_delivery_stream import KinesisFirehoseDeliveryStream
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_acl import S3BucketAcl
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        bucket = S3Bucket(self, "bucket",
+            bucket="metric-stream-test-bucket"
+        )
+        S3BucketAcl(self, "bucket_acl",
+            acl="private",
+            bucket=bucket.id
+        )
+        firehose_assume_role = DataAwsIamPolicyDocument(self, "firehose_assume_role",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["sts:AssumeRole"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["firehose.amazonaws.com"],
+                    type="Service"
+                )
+                ]
+            )
+            ]
+        )
+        firehose_to_s3 = DataAwsIamPolicyDocument(self, "firehose_to_s3",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["s3:AbortMultipartUpload", "s3:GetBucketLocation", "s3:GetObject", "s3:ListBucket", "s3:ListBucketMultipartUploads", "s3:PutObject"
+                ],
+                effect="Allow",
+                resources=[bucket.arn, "${" + bucket.arn + "}/*"]
+            )
+            ]
+        )
+        streams_assume_role = DataAwsIamPolicyDocument(self, "streams_assume_role",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["sts:AssumeRole"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["streams.metrics.cloudwatch.amazonaws.com"],
+                    type="Service"
+                )
+                ]
+            )
+            ]
+        )
+        aws_iam_role_firehose_to_s3 = IamRole(self, "firehose_to_s3_5",
+            assume_role_policy=Token.as_string(firehose_assume_role.json)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_role_firehose_to_s3.override_logical_id("firehose_to_s3")
+        metric_stream_to_firehose = IamRole(self, "metric_stream_to_firehose",
+            assume_role_policy=Token.as_string(streams_assume_role.json),
+            name="metric_stream_to_firehose_role"
+        )
+        aws_iam_role_policy_firehose_to_s3 = IamRolePolicy(self, "firehose_to_s3_7",
+            name="default",
+            policy=Token.as_string(firehose_to_s3.json),
+            role=Token.as_string(aws_iam_role_firehose_to_s3.id)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_role_policy_firehose_to_s3.override_logical_id("firehose_to_s3")
+        s3_stream = KinesisFirehoseDeliveryStream(self, "s3_stream",
+            destination="extended_s3",
+            extended_s3_configuration=KinesisFirehoseDeliveryStreamExtendedS3Configuration(
+                bucket_arn=bucket.arn,
+                role_arn=Token.as_string(aws_iam_role_firehose_to_s3.arn)
+            ),
+            name="metric-stream-test-stream"
+        )
+        data_aws_iam_policy_document_metric_stream_to_firehose =
+        DataAwsIamPolicyDocument(self, "metric_stream_to_firehose_9",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["firehose:PutRecord", "firehose:PutRecordBatch"],
+                effect="Allow",
+                resources=[s3_stream.arn]
+            )
+            ]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_iam_policy_document_metric_stream_to_firehose.override_logical_id("metric_stream_to_firehose")
+        CloudwatchMetricStream(self, "main",
+            firehose_arn=s3_stream.arn,
+            include_filter=[CloudwatchMetricStreamIncludeFilter(
+                metric_names=["CPUUtilization", "NetworkOut"],
+                namespace="AWS/EC2"
+            ), CloudwatchMetricStreamIncludeFilter(
+                metric_names=[],
+                namespace="AWS/EBS"
+            )
+            ],
+            name="my-metric-stream",
+            output_format="json",
+            role_arn=metric_stream_to_firehose.arn
+        )
+        aws_iam_role_policy_metric_stream_to_firehose = IamRolePolicy(self, "metric_stream_to_firehose_11",
+            name="default",
+            policy=Token.as_string(data_aws_iam_policy_document_metric_stream_to_firehose.json),
+            role=metric_stream_to_firehose.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_role_policy_metric_stream_to_firehose.override_logical_id("metric_stream_to_firehose")
+```
+
+### Additional Statistics
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudwatch_metric_stream import CloudwatchMetricStream
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        CloudwatchMetricStream(self, "main",
+            firehose_arn=s3_stream.arn,
+            name="my-metric-stream",
+            output_format="json",
+            role_arn=metric_stream_to_firehose.arn,
+            statistics_configuration=[CloudwatchMetricStreamStatisticsConfiguration(
+                additional_statistics=["p1", "tm99"],
+                include_metric=[CloudwatchMetricStreamStatisticsConfigurationIncludeMetric(
+                    metric_name="CPUUtilization",
+                    namespace="AWS/EC2"
+                )
+                ]
+            ), CloudwatchMetricStreamStatisticsConfiguration(
+                additional_statistics=["TS(50.5:)"],
+                include_metric=[CloudwatchMetricStreamStatisticsConfigurationIncludeMetric(
+                    metric_name="CPUUtilization",
+                    namespace="AWS/EC2"
+                )
+                ]
+            )
+            ]
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `firehose_arn` - (Required) ARN of the Amazon Kinesis Firehose delivery stream to use for this metric stream.
+* `role_arn` - (Required) ARN of the IAM role that this metric stream will use to access Amazon Kinesis Firehose resources. For more information about role permissions, see [Trust between CloudWatch and Kinesis Data Firehose](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-metric-streams-trustpolicy.html).
+* `output_format` - (Required) Output format for the stream. Possible values are `json` and `opentelemetry0.7`. For more information about output formats, see [Metric streams output formats](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-metric-streams-formats.html).
+
+The following arguments are optional:
+
+* `exclude_filter` - (Optional) List of exclusive metric filters. If you specify this parameter, the stream sends metrics from all metric namespaces except for the namespaces and the conditional metric names that you specify here. If you don't specify metric names or provide empty metric names whole metric namespace is excluded. Conflicts with `include_filter`.
+* `include_filter` - (Optional) List of inclusive metric filters. If you specify this parameter, the stream sends only the conditional metric names from the metric namespaces that you specify here. If you don't specify metric names or provide empty metric names whole metric namespace is included. Conflicts with `exclude_filter`.
+* `name` - (Optional, Forces new resource) Friendly name of the metric stream. If omitted, Terraform will assign a random, unique name. Conflicts with `name_prefix`.
+* `name_prefix` - (Optional, Forces new resource) Creates a unique friendly name beginning with the specified prefix. Conflicts with `name`.
+* `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `statistics_configuration` - (Optional) For each entry in this array, you specify one or more metrics and the list of additional statistics to stream for those metrics. The additional statistics that you can stream depend on the stream's `output_format`. If the OutputFormat is `json`, you can stream any additional statistic that is supported by CloudWatch, listed in [CloudWatch statistics definitions](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Statistics-definitions.html.html). If the OutputFormat is `opentelemetry0.7`, you can stream percentile statistics (p99 etc.). See details below.
+* `include_linked_accounts_metrics` (Optional) If you are creating a metric stream in a monitoring account, specify true to include metrics from source accounts that are linked to this monitoring account, in the metric stream. The default is false. For more information about linking accounts, see [CloudWatch cross-account observability](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-Unified-Cross-Account.html).
+
+### Nested Fields
+
+#### `exclude_filter`
+
+* `namespace` - (Required) Name of the metric namespace in the filter.
+* `metric_names` - (Optional) An array that defines the metrics you want to exclude for this metric namespace
+
+#### `include_filter`
+
+* `namespace` - (Required) Name of the metric namespace in the filter.
+* `metric_names` - (Optional) An array that defines the metrics you want to include for this metric namespace
+
+#### `statistics_configurations`
+
+* `additional_statistics` - (Required) The additional statistics to stream for the metrics listed in `include_metrics`.
+* `include_metric` - (Required) An array that defines the metrics that are to have additional statistics streamed. See details below.
+
+#### `include_metrics`
+
+* `metric_name` - (Required) The name of the metric.
+* `namespace` - (Required) The namespace of the metric.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the metric stream.
+* `creation_date` - Date and time in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8) that the metric stream was created.
+* `last_update_date` - Date and time in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8) that the metric stream was last updated.
+* `state` - State of the metric stream. Possible values are `running` and `stopped`.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudWatch metric streams using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import CloudWatch metric streams using the `name`. For example:
+
+```console
+% terraform import aws_cloudwatch_metric_stream.sample sample-stream-name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-c784099071593ee0e42cd9f39aed6e0e5231d53ebec38c6f6c7bc696081f0d87 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/cloudwatch_query_definition.html.markdown b/website/docs/cdktf/python/r/cloudwatch_query_definition.html.markdown
new file mode 100644
index 00000000000..fcbeb9c27e0
--- /dev/null
+++ b/website/docs/cdktf/python/r/cloudwatch_query_definition.html.markdown
@@ -0,0 +1,69 @@
+---
+subcategory: "CloudWatch Logs"
+layout: "aws"
+page_title: "AWS: aws_cloudwatch_query_definition"
+description: |-
+  Provides a CloudWatch Logs query definition resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudwatch_query_definition
+
+Provides a CloudWatch Logs query definition resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudwatch_query_definition import CloudwatchQueryDefinition
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        CloudwatchQueryDefinition(self, "example",
+            log_group_names=["/aws/logGroup1", "/aws/logGroup2"],
+            name="custom_query",
+            query_string="fields @timestamp, @message\n| sort @timestamp desc\n| limit 25\n\n"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the query.
+* `query_string` - (Required) The query to save. You can read more about CloudWatch Logs Query Syntax in the [documentation](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_QuerySyntax.html).
+* `log_group_names` - (Optional) Specific log groups to use with the query.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `query_definition_id` - The query definition ID.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudWatch query definitions using the query definition ARN. The ARN can be found on the "Edit Query" page for the query in the AWS Console. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import CloudWatch query definitions using the query definition ARN. The ARN can be found on the "Edit Query" page for the query in the AWS Console. For example:
+
+```console
+% terraform import aws_cloudwatch_query_definition.example arn:aws:logs:us-west-2:123456789012:query-definition:269951d7-6f75-496d-9d7b-6b7a5486bdbd
+```
+
+<!-- cache-key: cdktf-0.18.0 input-a122b619c0de2afa7a8b5aa10fde4e196df14477d2ae2e40ef733a9bc5105e18 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/codeartifact_domain.html.markdown b/website/docs/cdktf/python/r/codeartifact_domain.html.markdown
new file mode 100644
index 00000000000..33f4c197395
--- /dev/null
+++ b/website/docs/cdktf/python/r/codeartifact_domain.html.markdown
@@ -0,0 +1,73 @@
+---
+subcategory: "CodeArtifact"
+layout: "aws"
+page_title: "AWS: aws_codeartifact_domain"
+description: |-
+  Provides a CodeArtifact Domain resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_codeartifact_domain
+
+Provides a CodeArtifact Domain Resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.codeartifact_domain import CodeartifactDomain
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        CodeartifactDomain(self, "example",
+            domain="example"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `domain` - (Required) The name of the domain to create. All domain names in an AWS Region that are in the same AWS account must be unique. The domain name is used as the prefix in DNS hostnames. Do not use sensitive information in a domain name because it is publicly discoverable.
+* `encryption_key` - (Optional) The encryption key for the domain. This is used to encrypt content stored in a domain. The KMS Key Amazon Resource Name (ARN). The default aws/codeartifact AWS KMS master key is used if this element is absent.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ARN of the Domain.
+* `arn` - The ARN of the Domain.
+* `owner` - The AWS account ID that owns the domain.
+* `repository_count` - The number of repositories in the domain.
+* `created_time` - A timestamp that represents the date and time the domain was created in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8).
+* `asset_size_bytes` - The total size of all assets in the domain.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CodeArtifact Domain using the CodeArtifact Domain arn. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import CodeArtifact Domain using the CodeArtifact Domain arn. For example:
+
+```console
+% terraform import aws_codeartifact_domain.example arn:aws:codeartifact:us-west-2:012345678912:domain/tf-acc-test-8593714120730241305
+```
+
+<!-- cache-key: cdktf-0.18.0 input-a89c6d8c19079509b918e67525ee7273ddf173853ad8232d1909b2d3be8ac22c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/codeartifact_domain_permissions_policy.html.markdown b/website/docs/cdktf/python/r/codeartifact_domain_permissions_policy.html.markdown
new file mode 100644
index 00000000000..f67fd121d91
--- /dev/null
+++ b/website/docs/cdktf/python/r/codeartifact_domain_permissions_policy.html.markdown
@@ -0,0 +1,98 @@
+---
+subcategory: "CodeArtifact"
+layout: "aws"
+page_title: "AWS: aws_codeartifact_domain_permissions_policy"
+description: |-
+  Provides a CodeArtifact Domain Permissions Policy resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_codeartifact_domain_permissions_policy
+
+Provides a CodeArtifact Domains Permissions Policy Resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.codeartifact_domain import CodeartifactDomain
+from imports.aws.codeartifact_domain_permissions_policy import CodeartifactDomainPermissionsPolicy
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.kms_key import KmsKey
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = KmsKey(self, "example",
+            description="domain key"
+        )
+        aws_codeartifact_domain_example = CodeartifactDomain(self, "example_1",
+            domain="example",
+            encryption_key=example.arn
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_codeartifact_domain_example.override_logical_id("example")
+        test = DataAwsIamPolicyDocument(self, "test",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["codeartifact:CreateRepository"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["*"],
+                    type="*"
+                )
+                ],
+                resources=[Token.as_string(aws_codeartifact_domain_example.arn)]
+            )
+            ]
+        )
+        aws_codeartifact_domain_permissions_policy_test =
+        CodeartifactDomainPermissionsPolicy(self, "test_3",
+            domain=Token.as_string(aws_codeartifact_domain_example.domain),
+            policy_document=Token.as_string(test.json)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_codeartifact_domain_permissions_policy_test.override_logical_id("test")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `domain` - (Required) The name of the domain on which to set the resource policy.
+* `policy_document` - (Required) A JSON policy string to be set as the access control resource policy on the provided domain.
+* `domain_owner` - (Optional) The account number of the AWS account that owns the domain.
+* `policy_revision` - (Optional) The current revision of the resource policy to be set. This revision is used for optimistic locking, which prevents others from overwriting your changes to the domain's resource policy.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Name of Domain.
+* `resource_arn` - The ARN of the resource associated with the resource policy.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CodeArtifact Domain Permissions Policies using the CodeArtifact Domain ARN. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import CodeArtifact Domain Permissions Policies using the CodeArtifact Domain ARN. For example:
+
+```console
+% terraform import aws_codeartifact_domain_permissions_policy.example arn:aws:codeartifact:us-west-2:012345678912:domain/tf-acc-test-1928056699409417367
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ad7db656ffa6152a6f3b17e85bd919f6f92ab7d824fe3b18d3dfdd0e0c9f5daf -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/codeartifact_repository.html.markdown b/website/docs/cdktf/python/r/codeartifact_repository.html.markdown
new file mode 100644
index 00000000000..fada714663b
--- /dev/null
+++ b/website/docs/cdktf/python/r/codeartifact_repository.html.markdown
@@ -0,0 +1,149 @@
+---
+subcategory: "CodeArtifact"
+layout: "aws"
+page_title: "AWS: aws_codeartifact_repository"
+description: |-
+  Provides a CodeArtifact Repository resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_codeartifact_repository
+
+Provides a CodeArtifact Repository Resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.codeartifact_domain import CodeartifactDomain
+from imports.aws.codeartifact_repository import CodeartifactRepository
+from imports.aws.kms_key import KmsKey
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = KmsKey(self, "example",
+            description="domain key"
+        )
+        aws_codeartifact_domain_example = CodeartifactDomain(self, "example_1",
+            domain="example",
+            encryption_key=example.arn
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_codeartifact_domain_example.override_logical_id("example")
+        CodeartifactRepository(self, "test",
+            domain=Token.as_string(aws_codeartifact_domain_example.domain),
+            repository="example"
+        )
+```
+
+## Example Usage with upstream repository
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.codeartifact_repository import CodeartifactRepository
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        upstream = CodeartifactRepository(self, "upstream",
+            domain=test.domain,
+            repository="upstream"
+        )
+        CodeartifactRepository(self, "test",
+            domain=example.domain,
+            repository="example",
+            upstream=[CodeartifactRepositoryUpstream(
+                repository_name=upstream.repository
+            )
+            ]
+        )
+```
+
+## Example Usage with external connection
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.codeartifact_repository import CodeartifactRepository
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        CodeartifactRepository(self, "test",
+            domain=example.domain,
+            external_connections=CodeartifactRepositoryExternalConnections(
+                external_connection_name="public:npmjs"
+            ),
+            repository="example"
+        )
+        CodeartifactRepository(self, "upstream",
+            domain=Token.as_string(aws_codeartifact_domain_test.domain),
+            repository="upstream"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `domain` - (Required) The domain that contains the created repository.
+* `repository` - (Required) The name of the repository to create.
+* `domain_owner` - (Optional) The account number of the AWS account that owns the domain.
+* `description` - (Optional) The description of the repository.
+* `upstream` - (Optional) A list of upstream repositories to associate with the repository. The order of the upstream repositories in the list determines their priority order when AWS CodeArtifact looks for a requested package version. see [Upstream](#upstream)
+* `external_connections` - An array of external connections associated with the repository. Only one external connection can be set per repository. see [External Connections](#external-connections).
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Upstream
+
+* `repository_name` - (Required) The name of an upstream repository.
+
+### External Connections
+
+* `external_connection_name` - (Required) The name of the external connection associated with a repository.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ARN of the repository.
+* `arn` - The ARN of the repository.
+* `administrator_account` - The account number of the AWS account that manages the repository.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CodeArtifact Repository using the CodeArtifact Repository ARN. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import CodeArtifact Repository using the CodeArtifact Repository ARN. For example:
+
+```console
+% terraform import aws_codeartifact_repository.example arn:aws:codeartifact:us-west-2:012345678912:repository/tf-acc-test-6968272603913957763/tf-acc-test-6968272603913957763
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ca58cfb42dd4c4e2a87c170764549f39f2f66f3383a2b20872f8e68bcce2c980 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/codeartifact_repository_permissions_policy.html.markdown b/website/docs/cdktf/python/r/codeartifact_repository_permissions_policy.html.markdown
new file mode 100644
index 00000000000..c758e6fc144
--- /dev/null
+++ b/website/docs/cdktf/python/r/codeartifact_repository_permissions_policy.html.markdown
@@ -0,0 +1,109 @@
+---
+subcategory: "CodeArtifact"
+layout: "aws"
+page_title: "AWS: aws_codeartifact_repository_permissions_policy"
+description: |-
+  Provides a CodeArtifact Repository Permissions Policy resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_codeartifact_repository_permissions_policy
+
+Provides a CodeArtifact Repostory Permissions Policy Resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.codeartifact_domain import CodeartifactDomain
+from imports.aws.codeartifact_repository import CodeartifactRepository
+from imports.aws.codeartifact_repository_permissions_policy import CodeartifactRepositoryPermissionsPolicy
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.kms_key import KmsKey
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = KmsKey(self, "example",
+            description="domain key"
+        )
+        aws_codeartifact_domain_example = CodeartifactDomain(self, "example_1",
+            domain="example",
+            encryption_key=example.arn
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_codeartifact_domain_example.override_logical_id("example")
+        aws_codeartifact_repository_example = CodeartifactRepository(self, "example_2",
+            domain=Token.as_string(aws_codeartifact_domain_example.domain),
+            repository="example"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_codeartifact_repository_example.override_logical_id("example")
+        data_aws_iam_policy_document_example = DataAwsIamPolicyDocument(self, "example_3",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["codeartifact:ReadFromRepository"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["*"],
+                    type="*"
+                )
+                ],
+                resources=[Token.as_string(aws_codeartifact_repository_example.arn)]
+            )
+            ]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_iam_policy_document_example.override_logical_id("example")
+        aws_codeartifact_repository_permissions_policy_example =
+        CodeartifactRepositoryPermissionsPolicy(self, "example_4",
+            domain=Token.as_string(aws_codeartifact_domain_example.domain),
+            policy_document=Token.as_string(data_aws_iam_policy_document_example.json),
+            repository=Token.as_string(aws_codeartifact_repository_example.repository)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_codeartifact_repository_permissions_policy_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `repository` - (Required) The name of the repository to set the resource policy on.
+* `domain` - (Required) The name of the domain on which to set the resource policy.
+* `policy_document` - (Required) A JSON policy string to be set as the access control resource policy on the provided domain.
+* `domain_owner` - (Optional) The account number of the AWS account that owns the domain.
+* `policy_revision` - (Optional) The current revision of the resource policy to be set. This revision is used for optimistic locking, which prevents others from overwriting your changes to the domain's resource policy.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ARN of the resource associated with the resource policy.
+* `resource_arn` - The ARN of the resource associated with the resource policy.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CodeArtifact Repository Permissions Policies using the CodeArtifact Repository ARN. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import CodeArtifact Repository Permissions Policies using the CodeArtifact Repository ARN. For example:
+
+```console
+% terraform import aws_codeartifact_repository_permissions_policy.example arn:aws:codeartifact:us-west-2:012345678912:repository/tf-acc-test-6968272603913957763/tf-acc-test-6968272603913957763
+```
+
+<!-- cache-key: cdktf-0.18.0 input-2609ffac94d64cc0a79333020641c78ce36e999d6d8358e8f31df4a0ce52ddb0 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/codebuild_project.html.markdown b/website/docs/cdktf/python/r/codebuild_project.html.markdown
new file mode 100644
index 00000000000..f23b38b87ef
--- /dev/null
+++ b/website/docs/cdktf/python/r/codebuild_project.html.markdown
@@ -0,0 +1,409 @@
+---
+subcategory: "CodeBuild"
+layout: "aws"
+page_title: "AWS: aws_codebuild_project"
+description: |-
+  Provides a CodeBuild Project resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_codebuild_project
+
+Provides a CodeBuild Project resource. See also the [`aws_codebuild_webhook` resource](/docs/providers/aws/r/codebuild_webhook.html), which manages the webhook to the source (e.g., the "rebuild every time a code change is pushed" option in the CodeBuild web console).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.codebuild_project import CodebuildProject
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.iam_role import IamRole
+from imports.aws.iam_role_policy import IamRolePolicy
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_acl import S3BucketAcl
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = S3Bucket(self, "example",
+            bucket="example"
+        )
+        aws_s3_bucket_acl_example = S3BucketAcl(self, "example_1",
+            acl="private",
+            bucket=example.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_acl_example.override_logical_id("example")
+        assume_role = DataAwsIamPolicyDocument(self, "assume_role",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["sts:AssumeRole"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["codebuild.amazonaws.com"],
+                    type="Service"
+                )
+                ]
+            )
+            ]
+        )
+        data_aws_iam_policy_document_example = DataAwsIamPolicyDocument(self, "example_3",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents"
+                ],
+                effect="Allow",
+                resources=["*"]
+            ), DataAwsIamPolicyDocumentStatement(
+                actions=["ec2:CreateNetworkInterface", "ec2:DescribeDhcpOptions", "ec2:DescribeNetworkInterfaces", "ec2:DeleteNetworkInterface", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "ec2:DescribeVpcs"
+                ],
+                effect="Allow",
+                resources=["*"]
+            ), DataAwsIamPolicyDocumentStatement(
+                actions=["ec2:CreateNetworkInterfacePermission"],
+                condition=[DataAwsIamPolicyDocumentStatementCondition(
+                    test="StringEquals",
+                    values=[example1.arn, example2.arn],
+                    variable="ec2:Subnet"
+                ), DataAwsIamPolicyDocumentStatementCondition(
+                    test="StringEquals",
+                    values=["codebuild.amazonaws.com"],
+                    variable="ec2:AuthorizedService"
+                )
+                ],
+                effect="Allow",
+                resources=["arn:aws:ec2:us-east-1:123456789012:network-interface/*"
+                ]
+            ), DataAwsIamPolicyDocumentStatement(
+                actions=["s3:*"],
+                effect="Allow",
+                resources=[example.arn, "${" + example.arn + "}/*"]
+            )
+            ]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_iam_policy_document_example.override_logical_id("example")
+        aws_iam_role_example = IamRole(self, "example_4",
+            assume_role_policy=Token.as_string(assume_role.json),
+            name="example"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_role_example.override_logical_id("example")
+        aws_iam_role_policy_example = IamRolePolicy(self, "example_5",
+            policy=Token.as_string(data_aws_iam_policy_document_example.json),
+            role=Token.as_string(aws_iam_role_example.name)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_role_policy_example.override_logical_id("example")
+        aws_codebuild_project_example = CodebuildProject(self, "example_6",
+            artifacts=CodebuildProjectArtifacts(
+                type="NO_ARTIFACTS"
+            ),
+            build_timeout=5,
+            cache=CodebuildProjectCache(
+                location=example.bucket,
+                type="S3"
+            ),
+            description="test_codebuild_project",
+            environment=CodebuildProjectEnvironment(
+                compute_type="BUILD_GENERAL1_SMALL",
+                environment_variable=[CodebuildProjectEnvironmentEnvironmentVariable(
+                    name="SOME_KEY1",
+                    value="SOME_VALUE1"
+                ), CodebuildProjectEnvironmentEnvironmentVariable(
+                    name="SOME_KEY2",
+                    type="PARAMETER_STORE",
+                    value="SOME_VALUE2"
+                )
+                ],
+                image="aws/codebuild/amazonlinux2-x86_64-standard:4.0",
+                image_pull_credentials_type="CODEBUILD",
+                type="LINUX_CONTAINER"
+            ),
+            logs_config=CodebuildProjectLogsConfig(
+                cloudwatch_logs=CodebuildProjectLogsConfigCloudwatchLogs(
+                    group_name="log-group",
+                    stream_name="log-stream"
+                ),
+                s3_logs=CodebuildProjectLogsConfigS3Logs(
+                    location="${" + example.id + "}/build-log",
+                    status="ENABLED"
+                )
+            ),
+            name="test-project",
+            service_role=Token.as_string(aws_iam_role_example.arn),
+            source=CodebuildProjectSource(
+                git_clone_depth=1,
+                git_submodules_config=CodebuildProjectSourceGitSubmodulesConfig(
+                    fetch_submodules=True
+                ),
+                location="https://github.com/mitchellh/packer.git",
+                type="GITHUB"
+            ),
+            source_version="master",
+            tags={
+                "Environment": "Test"
+            },
+            vpc_config=CodebuildProjectVpcConfig(
+                security_group_ids=[
+                    Token.as_string(aws_security_group_example1.id),
+                    Token.as_string(aws_security_group_example2.id)
+                ],
+                subnets=[example1.id, example2.id],
+                vpc_id=Token.as_string(aws_vpc_example.id)
+            )
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_codebuild_project_example.override_logical_id("example")
+        CodebuildProject(self, "project-with-cache",
+            artifacts=CodebuildProjectArtifacts(
+                type="NO_ARTIFACTS"
+            ),
+            build_timeout=5,
+            cache=CodebuildProjectCache(
+                modes=["LOCAL_DOCKER_LAYER_CACHE", "LOCAL_SOURCE_CACHE"],
+                type="LOCAL"
+            ),
+            description="test_codebuild_project_cache",
+            environment=CodebuildProjectEnvironment(
+                compute_type="BUILD_GENERAL1_SMALL",
+                environment_variable=[CodebuildProjectEnvironmentEnvironmentVariable(
+                    name="SOME_KEY1",
+                    value="SOME_VALUE1"
+                )
+                ],
+                image="aws/codebuild/amazonlinux2-x86_64-standard:4.0",
+                image_pull_credentials_type="CODEBUILD",
+                type="LINUX_CONTAINER"
+            ),
+            name="test-project-cache",
+            queued_timeout=5,
+            service_role=Token.as_string(aws_iam_role_example.arn),
+            source=CodebuildProjectSource(
+                git_clone_depth=1,
+                location="https://github.com/mitchellh/packer.git",
+                type="GITHUB"
+            ),
+            tags={
+                "Environment": "Test"
+            }
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `artifacts` - (Required) Configuration block. Detailed below.
+* `environment` - (Required) Configuration block. Detailed below.
+* `name` - (Required) Project's name.
+* `service_role` - (Required) Amazon Resource Name (ARN) of the AWS Identity and Access Management (IAM) role that enables AWS CodeBuild to interact with dependent AWS services on behalf of the AWS account.
+* `source` - (Required) Configuration block. Detailed below.
+
+The following arguments are optional:
+
+* `badge_enabled` - (Optional) Generates a publicly-accessible URL for the projects build badge. Available as `badge_url` attribute when enabled.
+* `build_batch_config` - (Optional) Defines the batch build options for the project.
+* `build_timeout` - (Optional) Number of minutes, from 5 to 480 (8 hours), for AWS CodeBuild to wait until timing out any related build that does not get marked as completed. The default is 60 minutes.
+* `cache` - (Optional) Configuration block. Detailed below.
+* `concurrent_build_limit` - (Optional) Specify a maximum number of concurrent builds for the project. The value specified must be greater than 0 and less than the account concurrent running builds limit.
+* `description` - (Optional) Short description of the project.
+* `file_system_locations` - (Optional) A set of file system locations to mount inside the build. File system locations are documented below.
+* `encryption_key` - (Optional) AWS Key Management Service (AWS KMS) customer master key (CMK) to be used for encrypting the build project's build output artifacts.
+* `logs_config` - (Optional) Configuration block. Detailed below.
+* `project_visibility` - (Optional) Specifies the visibility of the project's builds. Possible values are: `PUBLIC_READ` and `PRIVATE`. Default value is `PRIVATE`.
+* `resource_access_role` - The ARN of the IAM role that enables CodeBuild to access the CloudWatch Logs and Amazon S3 artifacts for the project's builds.
+* `queued_timeout` - (Optional) Number of minutes, from 5 to 480 (8 hours), a build is allowed to be queued before it times out. The default is 8 hours.
+* `secondary_artifacts` - (Optional) Configuration block. Detailed below.
+* `secondary_sources` - (Optional) Configuration block. Detailed below.
+* `secondary_source_version` - (Optional) Configuration block. Detailed below.
+* `source_version` - (Optional) Version of the build input to be built for this project. If not specified, the latest version is used.
+* `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `vpc_config` - (Optional) Configuration block. Detailed below.
+
+### artifacts
+
+* `artifact_identifier` - (Optional) Artifact identifier. Must be the same specified inside the AWS CodeBuild build specification.
+* `bucket_owner_access` - (Optional) Specifies the bucket owner's access for objects that another account uploads to their Amazon S3 bucket. By default, only the account that uploads the objects to the bucket has access to these objects. This property allows you to give the bucket owner access to these objects. Valid values are `NONE`, `READ_ONLY`, and `FULL`. your CodeBuild service role must have the `s3:PutBucketAcl` permission. This permission allows CodeBuild to modify the access control list for the bucket.
+* `encryption_disabled` - (Optional) Whether to disable encrypting output artifacts. If `type` is set to `NO_ARTIFACTS`, this value is ignored. Defaults to `false`.
+* `location` - (Optional) Information about the build output artifact location. If `type` is set to `CODEPIPELINE` or `NO_ARTIFACTS`, this value is ignored. If `type` is set to `S3`, this is the name of the output bucket.
+* `name` - (Optional) Name of the project. If `type` is set to `S3`, this is the name of the output artifact object
+* `namespace_type` - (Optional) Namespace to use in storing build artifacts. If `type` is set to `S3`, then valid values are `BUILD_ID`, `NONE`.
+* `override_artifact_name` (Optional) Whether a name specified in the build specification overrides the artifact name.
+* `packaging` - (Optional) Type of build output artifact to create. If `type` is set to `S3`, valid values are `NONE`, `ZIP`
+* `path` - (Optional) If `type` is set to `S3`, this is the path to the output artifact.
+* `type` - (Required) Build output artifact's type. Valid values: `CODEPIPELINE`, `NO_ARTIFACTS`, `S3`.
+
+### build_batch_config
+
+* `combine_artifacts` - (Optional) Specifies if the build artifacts for the batch build should be combined into a single artifact location.
+* `restrictions` - (Optional) Configuration block specifying the restrictions for the batch build. Detailed below.
+* `service_role` - (Required) Specifies the service role ARN for the batch build project.
+* `timeout_in_mins` - (Optional) Specifies the maximum amount of time, in minutes, that the batch build must be completed in.
+
+#### build_batch_config: restrictions
+
+* `compute_types_allowed` - (Optional) An array of strings that specify the compute types that are allowed for the batch build. See [Build environment compute types](https://docs.aws.amazon.com/codebuild/latest/userguide/build-env-ref-compute-types.html) in the AWS CodeBuild User Guide for these values.
+* `maximum_builds_allowed` - (Optional) Specifies the maximum number of builds allowed.
+
+### cache
+
+* `location` - (Required when cache type is `S3`) Location where the AWS CodeBuild project stores cached resources. For type `S3`, the value must be a valid S3 bucket name/prefix.
+* `modes` - (Required when cache type is `LOCAL`) Specifies settings that AWS CodeBuild uses to store and reuse build dependencies. Valid values:  `LOCAL_SOURCE_CACHE`, `LOCAL_DOCKER_LAYER_CACHE`, `LOCAL_CUSTOM_CACHE`.
+* `type` - (Optional) Type of storage that will be used for the AWS CodeBuild project cache. Valid values: `NO_CACHE`, `LOCAL`, `S3`. Defaults to `NO_CACHE`.
+
+### environment
+
+* `certificate` - (Optional) ARN of the S3 bucket, path prefix and object key that contains the PEM-encoded certificate.
+* `compute_type` - (Required) Information about the compute resources the build project will use. Valid values: `BUILD_GENERAL1_SMALL`, `BUILD_GENERAL1_MEDIUM`, `BUILD_GENERAL1_LARGE`, `BUILD_GENERAL1_2XLARGE`. `BUILD_GENERAL1_SMALL` is only valid if `type` is set to `LINUX_CONTAINER`. When `type` is set to `LINUX_GPU_CONTAINER`, `compute_type` must be `BUILD_GENERAL1_LARGE`.
+* `environment_variable` - (Optional) Configuration block. Detailed below.
+* `image_pull_credentials_type` - (Optional) Type of credentials AWS CodeBuild uses to pull images in your build. Valid values: `CODEBUILD`, `SERVICE_ROLE`. When you use a cross-account or private registry image, you must use SERVICE_ROLE credentials. When you use an AWS CodeBuild curated image, you must use CodeBuild credentials. Defaults to `CODEBUILD`.
+* `image` - (Required) Docker image to use for this build project. Valid values include [Docker images provided by CodeBuild](https://docs.aws.amazon.com/codebuild/latest/userguide/build-env-ref-available.html) (e.g `aws/codebuild/amazonlinux2-x86_64-standard:4.0`), [Docker Hub images](https://hub.docker.com/) (e.g., `hashicorp/terraform:latest`), and full Docker repository URIs such as those for ECR (e.g., `137112412989.dkr.ecr.us-west-2.amazonaws.com/amazonlinux:latest`).
+* `privileged_mode` - (Optional) Whether to enable running the Docker daemon inside a Docker container. Defaults to `false`.
+* `registry_credential` - (Optional) Configuration block. Detailed below.
+* `type` - (Required) Type of build environment to use for related builds. Valid values: `LINUX_CONTAINER`, `LINUX_GPU_CONTAINER`, `WINDOWS_CONTAINER` (deprecated), `WINDOWS_SERVER_2019_CONTAINER`, `ARM_CONTAINER`. For additional information, see the [CodeBuild User Guide](https://docs.aws.amazon.com/codebuild/latest/userguide/build-env-ref-compute-types.html).
+
+#### environment: environment_variable
+
+* `name` - (Required) Environment variable's name or key.
+* `type` - (Optional) Type of environment variable. Valid values: `PARAMETER_STORE`, `PLAINTEXT`, `SECRETS_MANAGER`.
+* `value` - (Required) Environment variable's value.
+
+#### environment: registry_credential
+
+Credentials for access to a private Docker registry.
+
+* `credential` - (Required) ARN or name of credentials created using AWS Secrets Manager.
+* `credential_provider` - (Required) Service that created the credentials to access a private Docker registry. Valid value: `SECRETS_MANAGER` (AWS Secrets Manager).
+
+### file_system_locations
+
+See [ProjectFileSystemLocation](https://docs.aws.amazon.com/codebuild/latest/APIReference/API_ProjectFileSystemLocation.html) for more details of the fields.
+
+* `identifier` - (Optional) The name used to access a file system created by Amazon EFS. CodeBuild creates an environment variable by appending the identifier in all capital letters to CODEBUILD\_. For example, if you specify my-efs for identifier, a new environment variable is create named CODEBUILD_MY-EFS.
+* `location` - (Optional) A string that specifies the location of the file system created by Amazon EFS. Its format is `efs-dns-name:/directory-path`.
+* `mount_options` - (Optional) The mount options for a file system created by AWS EFS.
+* `mount_point` - (Optional) The location in the container where you mount the file system.
+* `type` - (Optional) The type of the file system. The one supported type is `EFS`.
+
+### logs_config
+
+* `cloudwatch_logs` - (Optional) Configuration block. Detailed below.
+* `s3_logs` - (Optional) Configuration block. Detailed below.
+
+#### logs_config: cloudwatch_logs
+
+* `group_name` - (Optional) Group name of the logs in CloudWatch Logs.
+* `status` - (Optional) Current status of logs in CloudWatch Logs for a build project. Valid values: `ENABLED`, `DISABLED`. Defaults to `ENABLED`.
+* `stream_name` - (Optional) Stream name of the logs in CloudWatch Logs.
+
+#### logs_config: s3_logs
+
+* `encryption_disabled` - (Optional) Whether to disable encrypting S3 logs. Defaults to `false`.
+* `location` - (Optional) Name of the S3 bucket and the path prefix for S3 logs. Must be set if status is `ENABLED`, otherwise it must be empty.
+* `status` - (Optional) Current status of logs in S3 for a build project. Valid values: `ENABLED`, `DISABLED`. Defaults to `DISABLED`.
+* `bucket_owner_access` - (Optional) Specifies the bucket owner's access for objects that another account uploads to their Amazon S3 bucket. By default, only the account that uploads the objects to the bucket has access to these objects. This property allows you to give the bucket owner access to these objects. Valid values are `NONE`, `READ_ONLY`, and `FULL`. your CodeBuild service role must have the `s3:PutBucketAcl` permission. This permission allows CodeBuild to modify the access control list for the bucket.
+
+### secondary_artifacts
+
+* `artifact_identifier` - (Required) Artifact identifier. Must be the same specified inside the AWS CodeBuild build specification.
+* `bucket_owner_access` - (Optional) Specifies the bucket owner's access for objects that another account uploads to their Amazon S3 bucket. By default, only the account that uploads the objects to the bucket has access to these objects. This property allows you to give the bucket owner access to these objects. Valid values are `NONE`, `READ_ONLY`, and `FULL`. The CodeBuild service role must have the `s3:PutBucketAcl` permission. This permission allows CodeBuild to modify the access control list for the bucket.
+* `encryption_disabled` - (Optional) Whether to disable encrypting output artifacts. If `type` is set to `NO_ARTIFACTS`, this value is ignored. Defaults to `false`.
+* `location` - (Optional) Information about the build output artifact location. If `type` is set to `CODEPIPELINE` or `NO_ARTIFACTS`, this value is ignored if specified. If `type` is set to `S3`, this is the name of the output bucket. If `path` is not specified, `location` can specify the path of the output artifact in the output bucket.
+* `name` - (Optional) Name of the project. If `type` is set to `CODEPIPELINE` or `NO_ARTIFACTS`, this value is ignored if specified. If `type` is set to `S3`, this is the name of the output artifact object.
+* `namespace_type` - (Optional) Namespace to use in storing build artifacts. If `type` is set to `CODEPIPELINE` or `NO_ARTIFACTS`, this value is ignored if specified. If `type` is set to `S3`, valid values are `BUILD_ID` or `NONE`.
+* `override_artifact_name` (Optional) Whether a name specified in the build specification overrides the artifact name.
+* `packaging` - (Optional) Type of build output artifact to create. If `type` is set to `CODEPIPELINE` or `NO_ARTIFACTS`, this value is ignored if specified. If `type` is set to `S3`, valid values are `NONE` or `ZIP`.
+* `path` - (Optional) Along with `namespace_type` and `name`, the pattern that AWS CodeBuild uses to name and store the output artifact. If `type` is set to `CODEPIPELINE` or `NO_ARTIFACTS`, this value is ignored if specified. If `type` is set to `S3`, this is the path to the output artifact.
+* `type` - (Required) Build output artifact's type. Valid values `CODEPIPELINE`, `NO_ARTIFACTS`, and `S3`.
+
+### secondary_sources
+
+* `buildspec` - (Optional) The build spec declaration to use for this build project's related builds. This must be set when `type` is `NO_SOURCE`. It can either be a path to a file residing in the repository to be built or a local file path leveraging the `file()` built-in.
+* `git_clone_depth` - (Optional) Truncate git history to this many commits. Use `0` for a `Full` checkout which you need to run commands like `git branch --show-current`. See [AWS CodePipeline User Guide: Tutorial: Use full clone with a GitHub pipeline source](https://docs.aws.amazon.com/codepipeline/latest/userguide/tutorials-github-gitclone.html) for details.
+* `git_submodules_config` - (Optional) Configuration block. Detailed below.
+* `insecure_ssl` - (Optional) Ignore SSL warnings when connecting to source control.
+* `location` - (Optional) Location of the source code from git or s3.
+* `report_build_status` - (Optional) Whether to report the status of a build's start and finish to your source provider. This option is only valid when your source provider is `GITHUB`, `BITBUCKET`, or `GITHUB_ENTERPRISE`.
+* `build_status_config` - (Optional) Configuration block that contains information that defines how the build project reports the build status to the source provider. This option is only used when the source provider is `GITHUB`, `GITHUB_ENTERPRISE`, or `BITBUCKET`. `build_status_config` blocks are documented below.
+* `source_identifier` - (Required) An identifier for this project source. The identifier can only contain alphanumeric characters and underscores, and must be less than 128 characters in length.
+* `type` - (Required) Type of repository that contains the source code to be built. Valid values: `CODECOMMIT`, `CODEPIPELINE`, `GITHUB`, `GITHUB_ENTERPRISE`, `BITBUCKET` or `S3`.
+
+#### secondary_sources: git_submodules_config
+
+This block is only valid when the `type` is `CODECOMMIT`, `GITHUB` or `GITHUB_ENTERPRISE`.
+
+* `fetch_submodules` - (Required) Whether to fetch Git submodules for the AWS CodeBuild build project.
+
+#### secondary_sources: build_status_config
+
+* `context` - (Optional) Specifies the context of the build status CodeBuild sends to the source provider. The usage of this parameter depends on the source provider.
+* `target_url` - (Optional) Specifies the target url of the build status CodeBuild sends to the source provider. The usage of this parameter depends on the source provider.
+
+### secondary_source_version
+
+* `source_identifier` - (Required) An identifier for a source in the build project.
+* `source_version` - (Required) The source version for the corresponding source identifier. See [AWS docs](https://docs.aws.amazon.com/codebuild/latest/APIReference/API_ProjectSourceVersion.html#CodeBuild-Type-ProjectSourceVersion-sourceVersion) for more details.
+
+### source
+
+* `buildspec` - (Optional) Build specification to use for this build project's related builds. This must be set when `type` is `NO_SOURCE`.
+* `git_clone_depth` - (Optional) Truncate git history to this many commits. Use `0` for a `Full` checkout which you need to run commands like `git branch --show-current`. See [AWS CodePipeline User Guide: Tutorial: Use full clone with a GitHub pipeline source](https://docs.aws.amazon.com/codepipeline/latest/userguide/tutorials-github-gitclone.html) for details.
+* `git_submodules_config` - (Optional) Configuration block. Detailed below.
+* `insecure_ssl` - (Optional) Ignore SSL warnings when connecting to source control.
+* `location` - (Optional) Location of the source code from git or s3.
+* `report_build_status` - (Optional) Whether to report the status of a build's start and finish to your source provider. This option is only valid when the `type` is `BITBUCKET` or `GITHUB`.
+* `build_status_config` - (Optional) Configuration block that contains information that defines how the build project reports the build status to the source provider. This option is only used when the source provider is `GITHUB`, `GITHUB_ENTERPRISE`, or `BITBUCKET`. `build_status_config` blocks are documented below.
+* `type` - (Required) Type of repository that contains the source code to be built. Valid values: `CODECOMMIT`, `CODEPIPELINE`, `GITHUB`, `GITHUB_ENTERPRISE`, `BITBUCKET`, `S3`, `NO_SOURCE`.
+
+#### source: git_submodules_config
+
+This block is only valid when the `type` is `CODECOMMIT`, `GITHUB` or `GITHUB_ENTERPRISE`.
+
+* `fetch_submodules` - (Required) Whether to fetch Git submodules for the AWS CodeBuild build project.
+
+#### source: build_status_config
+
+* `context` - (Optional) Specifies the context of the build status CodeBuild sends to the source provider. The usage of this parameter depends on the source provider.
+* `target_url` - (Optional) Specifies the target url of the build status CodeBuild sends to the source provider. The usage of this parameter depends on the source provider.
+
+### vpc_config
+
+* `security_group_ids` - (Required) Security group IDs to assign to running builds.
+* `subnets` - (Required) Subnet IDs within which to run builds.
+* `vpc_id` - (Required) ID of the VPC within which to run builds.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the CodeBuild project.
+* `badge_url` - URL of the build badge when `badge_enabled` is enabled.
+* `id` - Name (if imported via `name`) or ARN (if created via Terraform or imported via ARN) of the CodeBuild project.
+* `public_project_alias` - The project identifier used with the public build APIs.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CodeBuild Project using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import CodeBuild Project using the `name`. For example:
+
+```console
+% terraform import aws_codebuild_project.name project-name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1231db4e8811d1c6f118d55d81d8dd0ad67e7fea5670ef0ab686100249f240fc -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/codebuild_report_group.html.markdown b/website/docs/cdktf/python/r/codebuild_report_group.html.markdown
new file mode 100644
index 00000000000..02754d758a5
--- /dev/null
+++ b/website/docs/cdktf/python/r/codebuild_report_group.html.markdown
@@ -0,0 +1,130 @@
+---
+subcategory: "CodeBuild"
+layout: "aws"
+page_title: "AWS: aws_codebuild_report_group"
+description: |-
+  Provides a CodeBuild Report Group resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_codebuild_report_group
+
+Provides a CodeBuild Report Groups Resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.codebuild_report_group import CodebuildReportGroup
+from imports.aws.data_aws_caller_identity import DataAwsCallerIdentity
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.kms_key import KmsKey
+from imports.aws.s3_bucket import S3Bucket
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = S3Bucket(self, "example",
+            bucket="my-test"
+        )
+        current = DataAwsCallerIdentity(self, "current")
+        data_aws_iam_policy_document_example = DataAwsIamPolicyDocument(self, "example_2",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["kms:*"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["arn:aws:iam::${" + current.account_id + "}:root"],
+                    type="AWS"
+                )
+                ],
+                resources=["*"],
+                sid="Enable IAM User Permissions"
+            )
+            ]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_iam_policy_document_example.override_logical_id("example")
+        aws_kms_key_example = KmsKey(self, "example_3",
+            deletion_window_in_days=7,
+            description="my test kms key",
+            policy=Token.as_string(data_aws_iam_policy_document_example.json)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_kms_key_example.override_logical_id("example")
+        aws_codebuild_report_group_example = CodebuildReportGroup(self, "example_4",
+            export_config=CodebuildReportGroupExportConfig(
+                s3_destination=CodebuildReportGroupExportConfigS3Destination(
+                    bucket=example.id,
+                    encryption_disabled=False,
+                    encryption_key=Token.as_string(aws_kms_key_example.arn),
+                    packaging="NONE",
+                    path="/some"
+                ),
+                type="S3"
+            ),
+            name="my test report group",
+            type="TEST"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_codebuild_report_group_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of a Report Group.
+* `type` - (Required) The type of the Report Group. Valid value are `TEST` and `CODE_COVERAGE`.
+* `export_config` - (Required) Information about the destination where the raw data of this Report Group is exported. see [Export Config](#export-config) documented below.
+* `delete_reports` - (Optional) If `true`, deletes any reports that belong to a report group before deleting the report group. If `false`, you must delete any reports in the report group before deleting it. Default value is `false`.
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Export Config
+
+* `type` - (Required) The export configuration type. Valid values are `S3` and `NO_EXPORT`.
+* `s3_destination` - (Required) contains information about the S3 bucket where the run of a report is exported. see [S3 Destination](#s3-destination) documented below.
+
+#### S3 Destination
+
+* `bucket`- (Required) The name of the S3 bucket where the raw data of a report are exported.
+* `encryption_key` - (Required) The encryption key for the report's encrypted raw data. The KMS key ARN.
+* `encryption_disabled`- (Optional) A boolean value that specifies if the results of a report are encrypted.
+ **Note: the API does not currently allow setting encryption as disabled**
+* `packaging` - (Optional) The type of build output artifact to create. Valid values are: `NONE` (default) and `ZIP`.
+* `path` - (Optional) The path to the exported report's raw data results.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ARN of Report Group.
+* `arn` - The ARN of Report Group.
+* `created` - The date and time this Report Group was created.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CodeBuild Report Group using the CodeBuild Report Group arn. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import CodeBuild Report Group using the CodeBuild Report Group arn. For example:
+
+```console
+% terraform import aws_codebuild_report_group.example arn:aws:codebuild:us-west-2:123456789:report-group/report-group-name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-8ad57ea33f51d8c292612a210a7b0152c2dbf1d07a6f6d7699514cc614c46f5d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/codebuild_resource_policy.html.markdown b/website/docs/cdktf/python/r/codebuild_resource_policy.html.markdown
new file mode 100644
index 00000000000..21df0e12e82
--- /dev/null
+++ b/website/docs/cdktf/python/r/codebuild_resource_policy.html.markdown
@@ -0,0 +1,98 @@
+---
+subcategory: "CodeBuild"
+layout: "aws"
+page_title: "AWS: aws_codebuild_resource_policy"
+description: |-
+  Provides a CodeBuild Resource Policy resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_codebuild_resource_policy
+
+Provides a CodeBuild Resource Policy Resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.codebuild_report_group import CodebuildReportGroup
+from imports.aws.codebuild_resource_policy import CodebuildResourcePolicy
+from imports.aws.data_aws_caller_identity import DataAwsCallerIdentity
+from imports.aws.data_aws_partition import DataAwsPartition
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = CodebuildReportGroup(self, "example",
+            export_config=CodebuildReportGroupExportConfig(
+                type="NO_EXPORT"
+            ),
+            name="example",
+            type="TEST"
+        )
+        current = DataAwsCallerIdentity(self, "current")
+        data_aws_partition_current = DataAwsPartition(self, "current_2")
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_partition_current.override_logical_id("current")
+        aws_codebuild_resource_policy_example = CodebuildResourcePolicy(self, "example_3",
+            policy=Token.as_string(
+                Fn.jsonencode({
+                    "Id": "default",
+                    "Statement": [{
+                        "Action": ["codebuild:BatchGetReportGroups", "codebuild:BatchGetReports", "codebuild:ListReportsForReportGroup", "codebuild:DescribeTestCases"
+                        ],
+                        "Effect": "Allow",
+                        "Principal": {
+                            "AWS": "arn:${" + data_aws_partition_current.partition + "}:iam::${" + current.account_id + "}:root"
+                        },
+                        "Resource": example.arn,
+                        "Sid": "default"
+                    }
+                    ],
+                    "Version": "2012-10-17"
+                })),
+            resource_arn=example.arn
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_codebuild_resource_policy_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `resource_arn` - (Required) The ARN of the Project or ReportGroup resource you want to associate with a resource policy.
+* `policy` - (Required) A JSON-formatted resource policy. For more information, see [Sharing a Projec](https://docs.aws.amazon.com/codebuild/latest/userguide/project-sharing.html#project-sharing-share) and [Sharing a Report Group](https://docs.aws.amazon.com/codebuild/latest/userguide/report-groups-sharing.html#report-groups-sharing-share).
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ARN of Resource.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CodeBuild Resource Policy using the CodeBuild Resource Policy arn. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import CodeBuild Resource Policy using the CodeBuild Resource Policy arn. For example:
+
+```console
+% terraform import aws_codebuild_resource_policy.example arn:aws:codebuild:us-west-2:123456789:report-group/report-group-name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-f23442c58293672c191dd97a4494665d2aef6eee691d16bd2960548ec6b274dd -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/codebuild_source_credential.html.markdown b/website/docs/cdktf/python/r/codebuild_source_credential.html.markdown
new file mode 100644
index 00000000000..25ca0cab90d
--- /dev/null
+++ b/website/docs/cdktf/python/r/codebuild_source_credential.html.markdown
@@ -0,0 +1,96 @@
+---
+subcategory: "CodeBuild"
+layout: "aws"
+page_title: "AWS: aws_codebuild_source_credential"
+description: |-
+  Provides a CodeBuild Source Credential resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_codebuild_source_credential
+
+Provides a CodeBuild Source Credentials Resource.
+
+~> **NOTE:**
+[Codebuild only allows a single credential per given server type in a given region](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_codebuild.GitHubSourceCredentials.html). Therefore, when you define `aws_codebuild_source_credential`, [`aws_codebuild_project` resource](/docs/providers/aws/r/codebuild_project.html) defined in the same module will use it.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.codebuild_source_credential import CodebuildSourceCredential
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        CodebuildSourceCredential(self, "example",
+            auth_type="PERSONAL_ACCESS_TOKEN",
+            server_type="GITHUB",
+            token="example"
+        )
+```
+
+### Bitbucket Server Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.codebuild_source_credential import CodebuildSourceCredential
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        CodebuildSourceCredential(self, "example",
+            auth_type="BASIC_AUTH",
+            server_type="BITBUCKET",
+            token="example",
+            user_name="test-user"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `auth_type` - (Required) The type of authentication used to connect to a GitHub, GitHub Enterprise, or Bitbucket repository. An OAUTH connection is not supported by the API.
+* `server_type` - (Required) The source provider used for this project.
+* `token` - (Required) For `GitHub` or `GitHub Enterprise`, this is the personal access token. For `Bitbucket`, this is the app password.
+* `user_name` - (Optional) The Bitbucket username when the authType is `BASIC_AUTH`. This parameter is not valid for other types of source providers or connections.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ARN of Source Credential.
+* `arn` - The ARN of Source Credential.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CodeBuild Source Credential using the CodeBuild Source Credential arn. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import CodeBuild Source Credential using the CodeBuild Source Credential arn. For example:
+
+```console
+% terraform import aws_codebuild_source_credential.example arn:aws:codebuild:us-west-2:123456789:token:github
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1d3035420b7bbe8f89436bdbdcd040691cc3649bd4b17947a90be506a262d9cb -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/codebuild_webhook.html.markdown b/website/docs/cdktf/python/r/codebuild_webhook.html.markdown
new file mode 100644
index 00000000000..39693d7985e
--- /dev/null
+++ b/website/docs/cdktf/python/r/codebuild_webhook.html.markdown
@@ -0,0 +1,144 @@
+---
+subcategory: "CodeBuild"
+layout: "aws"
+page_title: "AWS: aws_codebuild_webhook"
+description: |-
+  Provides a CodeBuild Webhook resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_codebuild_webhook
+
+Manages a CodeBuild webhook, which is an endpoint accepted by the CodeBuild service to trigger builds from source code repositories. Depending on the source type of the CodeBuild project, the CodeBuild service may also automatically create and delete the actual repository webhook as well.
+
+## Example Usage
+
+### Bitbucket and GitHub
+
+When working with [Bitbucket](https://bitbucket.org) and [GitHub](https://github.com) source CodeBuild webhooks, the CodeBuild service will automatically create (on `aws_codebuild_webhook` resource creation) and delete (on `aws_codebuild_webhook` resource deletion) the Bitbucket/GitHub repository webhook using its granted OAuth permissions. This behavior cannot be controlled by Terraform.
+
+~> **Note:** The AWS account that Terraform uses to create this resource *must* have authorized CodeBuild to access Bitbucket/GitHub's OAuth API in each applicable region. This is a manual step that must be done *before* creating webhooks with this resource. If OAuth is not configured, AWS will return an error similar to `ResourceNotFoundException: Could not find access token for server type github`. More information can be found in the CodeBuild User Guide for [Bitbucket](https://docs.aws.amazon.com/codebuild/latest/userguide/sample-bitbucket-pull-request.html) and [GitHub](https://docs.aws.amazon.com/codebuild/latest/userguide/sample-github-pull-request.html).
+
+~> **Note:** Further managing the automatically created Bitbucket/GitHub webhook with the `bitbucket_hook`/`github_repository_webhook` resource is only possible with importing that resource after creation of the `aws_codebuild_webhook` resource. The CodeBuild API does not ever provide the `secret` attribute for the `aws_codebuild_webhook` resource in this scenario.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.codebuild_webhook import CodebuildWebhook
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        CodebuildWebhook(self, "example",
+            build_type="BUILD",
+            filter_group=[CodebuildWebhookFilterGroup(
+                filter=[CodebuildWebhookFilterGroupFilter(
+                    pattern="PUSH",
+                    type="EVENT"
+                ), CodebuildWebhookFilterGroupFilter(
+                    pattern="master",
+                    type="BASE_REF"
+                )
+                ]
+            )
+            ],
+            project_name=Token.as_string(aws_codebuild_project_example.name)
+        )
+```
+
+### GitHub Enterprise
+
+When working with [GitHub Enterprise](https://enterprise.github.com/) source CodeBuild webhooks, the GHE repository webhook must be separately managed (e.g., manually or with the `github_repository_webhook` resource).
+
+More information creating webhooks with GitHub Enterprise can be found in the [CodeBuild User Guide](https://docs.aws.amazon.com/codebuild/latest/userguide/sample-github-enterprise.html).
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.codebuild_webhook import CodebuildWebhook
+from imports.github.repository_webhook import RepositoryWebhook
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        # The following providers are missing schema information and might need manual adjustments to synthesize correctly: github.
+        #     For a more precise conversion please use the --provider flag in convert.
+        example = CodebuildWebhook(self, "example",
+            project_name=Token.as_string(aws_codebuild_project_example.name)
+        )
+        github_repository_webhook_example = RepositoryWebhook(self, "example_1",
+            active=True,
+            configuration=[{
+                "content_type": "json",
+                "insecure_ssl": False,
+                "secret": example.secret,
+                "url": example.payload_url
+            }
+            ],
+            events=["push"],
+            name="example",
+            repository=github_repository_example.name
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        github_repository_webhook_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `project_name` - (Required) The name of the build project.
+* `build_type` - (Optional) The type of build this webhook will trigger. Valid values for this parameter are: `BUILD`, `BUILD_BATCH`.
+* `branch_filter` - (Optional) A regular expression used to determine which branches get built. Default is all branches are built. We recommend using `filter_group` over `branch_filter`.
+* `filter_group` - (Optional) Information about the webhook's trigger. Filter group blocks are documented below.
+
+`filter_group` supports the following:
+
+* `filter` - (Required) A webhook filter for the group. Filter blocks are documented below.
+
+`filter` supports the following:
+
+* `type` - (Required) The webhook filter group's type. Valid values for this parameter are: `EVENT`, `BASE_REF`, `HEAD_REF`, `ACTOR_ACCOUNT_ID`, `FILE_PATH`, `COMMIT_MESSAGE`. At least one filter group must specify `EVENT` as its type.
+* `pattern` - (Required) For a filter that uses `EVENT` type, a comma-separated string that specifies one event: `PUSH`, `PULL_REQUEST_CREATED`, `PULL_REQUEST_UPDATED`, `PULL_REQUEST_REOPENED`. `PULL_REQUEST_MERGED` works with GitHub & GitHub Enterprise only. For a filter that uses any of the other filter types, a regular expression.
+* `exclude_matched_pattern` - (Optional) If set to `true`, the specified filter does *not* trigger a build. Defaults to `false`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name of the build project.
+* `payload_url` - The CodeBuild endpoint where webhook events are sent.
+* `secret` - The secret token of the associated repository. Not returned by the CodeBuild API for all source types.
+* `url` - The URL to the webhook.
+
+~> **Note:** The `secret` attribute is only set on resource creation, so if the secret is manually rotated, terraform will not pick up the change on subsequent runs.  In that case, the webhook resource should be tainted and re-created to get the secret back in sync.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CodeBuild Webhooks using the CodeBuild Project name. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import CodeBuild Webhooks using the CodeBuild Project name. For example:
+
+```console
+% terraform import aws_codebuild_webhook.example MyProjectName
+```
+
+<!-- cache-key: cdktf-0.18.0 input-cf2c7457e01d223f33713530c0bde71a1f3d519e66df2997191b2c29539aab1a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/codecatalyst_dev_environment.html.markdown b/website/docs/cdktf/python/r/codecatalyst_dev_environment.html.markdown
new file mode 100644
index 00000000000..ad919264bab
--- /dev/null
+++ b/website/docs/cdktf/python/r/codecatalyst_dev_environment.html.markdown
@@ -0,0 +1,92 @@
+---
+subcategory: "CodeCatalyst"
+layout: "aws"
+page_title: "AWS: aws_codecatalyst_dev_environment"
+description: |-
+  Terraform resource for managing an AWS CodeCatalyst Devenvironment.
+---
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_codecatalyst_dev_environment
+
+Terraform resource for managing an AWS CodeCatalyst Dev Environment.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.codecatalyst_dev_environment import CodecatalystDevEnvironment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        CodecatalystDevEnvironment(self, "test",
+            alias="devenv",
+            ides=CodecatalystDevEnvironmentIdes(
+                name="PyCharm",
+                runtime="public.ecr.aws/jetbrains/py"
+            ),
+            inactivity_timeout_minutes=40,
+            instance_type="dev.standard1.small",
+            persistent_storage=CodecatalystDevEnvironmentPersistentStorage(
+                size=16
+            ),
+            project_name="myproject",
+            repositories=[CodecatalystDevEnvironmentRepositories(
+                branch_name="main",
+                repository_name="terraform-provider-aws"
+            )
+            ],
+            space_name="myspace"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `space_name` - (Required) The name of the space.
+* `project_name` - (Required) The name of the project in the space.
+* `persistent_storage` - (Required) Information about the amount of storage allocated to the Dev Environment.
+* `ides` - (Required) Information about the integrated development environment (IDE) configured for a Dev Environment.
+* `instance_type` - (Required) The Amazon EC2 instace type to use for the Dev Environment. Valid values include dev.standard1.small,dev.standard1.medium,dev.standard1.large,dev.standard1.xlarge
+
+The following arguments are optional:
+
+* `inactivity_timeout_minutes` - (Optional) The amount of time the Dev Environment will run without any activity detected before stopping, in minutes. Only whole integers are allowed. Dev Environments consume compute minutes when running.
+* `repositories` - (Optional) The source repository that contains the branch to clone into the Dev Environment.
+
+ides (`ides`) supports the following:
+
+* `name` - (Required) The name of the IDE. Valid values include Cloud9, IntelliJ, PyCharm, GoLand, and VSCode.
+* `runtime` - (Required) A link to the IDE runtime image. This parameter is not required if the name is VSCode. Values of the runtime can be for example public.ecr.aws/jetbrains/py,public.ecr.aws/jetbrains/go
+
+repositories (`repositories`) supports the following:
+
+* `repository_name` - (Required) The name of the source repository.
+* `branch_name` - (Optional) The name of the branch in a source repository.
+
+persistent storage (` persistent_storage`) supports the following:
+
+* `size` - (Required) The size of the persistent storage in gigabytes (specifically GiB). Valid values for storage are based on memory sizes in 16GB increments. Valid values are 16, 32, and 64.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Unique identifier for the Dev Environment
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `30m`)
+- `update` - (Default `10m`)
+- `delete` - (Default `10m`)
+
+<!-- cache-key: cdktf-0.18.0 input-83072c31095d92a81b54f714ca680dc32ebce04ee3482f885395e5500cfeace5 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/codecatalyst_project.html.markdown b/website/docs/cdktf/python/r/codecatalyst_project.html.markdown
new file mode 100644
index 00000000000..37cffe8c320
--- /dev/null
+++ b/website/docs/cdktf/python/r/codecatalyst_project.html.markdown
@@ -0,0 +1,82 @@
+---
+subcategory: "CodeCatalyst"
+layout: "aws"
+page_title: "AWS: aws_codecatalyst_project"
+description: |-
+  Terraform resource for managing an AWS CodeCatalyst Project.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_codecatalyst_project
+
+Terraform resource for managing an AWS CodeCatalyst Project.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.codecatalyst_project import CodecatalystProject
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        CodecatalystProject(self, "test",
+            description="My CodeCatalyst Project created using Terraform",
+            display_name="MyProject",
+            space_name="myproject"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `space_name` - (Required) The name of the space.
+* `display_name` - (Required) The friendly name of the project that will be displayed to users.
+
+The following arguments are optional:
+
+* `description` - (Optional) The description of the project. This description will be displayed to all users of the project. We recommend providing a brief description of the project and its intended purpose.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `name` - The name of the project in the space.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `60m`)
+* `update` - (Default `180m`)
+* `delete` - (Default `90m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CodeCatalyst Project using the `example_id_arg`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import CodeCatalyst Project using the `example_id_arg`. For example:
+
+```console
+% terraform import aws_codecatalyst_project.example project-id-12345678
+```
+
+<!-- cache-key: cdktf-0.18.0 input-458059ba4aa1ab978fd9d595f17ad727e6f517ced23cac7527a27f8c131037e1 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/codecatalyst_source_repository.html.markdown b/website/docs/cdktf/python/r/codecatalyst_source_repository.html.markdown
new file mode 100644
index 00000000000..924d65b141b
--- /dev/null
+++ b/website/docs/cdktf/python/r/codecatalyst_source_repository.html.markdown
@@ -0,0 +1,81 @@
+---
+subcategory: "CodeCatalyst"
+layout: "aws"
+page_title: "AWS: aws_codecatalyst_source_repository"
+description: |-
+  Terraform resource for managing an AWS CodeCatalyst Source Repository.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_codecatalyst_source_repository
+
+Terraform resource for managing an AWS CodeCatalyst Source Repository.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.codecatalyst_source_repository import CodecatalystSourceRepository
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        CodecatalystSourceRepository(self, "example",
+            name="example-repo",
+            project_name="example-project",
+            space_name="example-space"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) The name of the source repository. For more information about name requirements, see [Quotas for source repositories](https://docs.aws.amazon.com/codecatalyst/latest/userguide/source-quotas.html).
+* `space_name` - (Required) The name of the CodeCatalyst space.
+* `project_name` - (Required) The name of the project in the CodeCatalyst space.
+
+The following arguments are optional:
+
+* `description` - (Optional) The description of the project. This description will be displayed to all users of the project. We recommend providing a brief description of the project and its intended purpose.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `60m`)
+* `update` - (Default `180m`)
+* `delete` - (Default `90m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CodeCatalyst Source Repository using the `example_id_arg`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import CodeCatalyst Source Repository using the `example_id_arg`. For example:
+
+```console
+% terraform import aws_codecatalyst_source_repository.example source_repository-id-12345678
+```
+
+<!-- cache-key: cdktf-0.18.0 input-03b428f1b5cc0fdf28b4d5ea9381e651fe9e72981c5ada420c0f7134b76c3774 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/codecommit_approval_rule_template.html.markdown b/website/docs/cdktf/python/r/codecommit_approval_rule_template.html.markdown
new file mode 100644
index 00000000000..4564a07dcc4
--- /dev/null
+++ b/website/docs/cdktf/python/r/codecommit_approval_rule_template.html.markdown
@@ -0,0 +1,84 @@
+---
+subcategory: "CodeCommit"
+layout: "aws"
+page_title: "AWS: aws_codecommit_approval_rule_template"
+description: |-
+  Provides a CodeCommit Approval Rule Template Resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_codecommit_approval_rule_template
+
+Provides a CodeCommit Approval Rule Template Resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.codecommit_approval_rule_template import CodecommitApprovalRuleTemplate
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        CodecommitApprovalRuleTemplate(self, "example",
+            content=Token.as_string(
+                Fn.jsonencode({
+                    "DestinationReferences": ["refs/heads/master"],
+                    "Statements": [{
+                        "ApprovalPoolMembers": ["arn:aws:sts::123456789012:assumed-role/CodeCommitReview/*"
+                        ],
+                        "NumberOfApprovalsNeeded": 2,
+                        "Type": "Approvers"
+                    }
+                    ],
+                    "Version": "2018-11-08"
+                })),
+            description="This is an example approval rule template",
+            name="MyExampleApprovalRuleTemplate"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `content` - (Required) The content of the approval rule template. Maximum of 3000 characters.
+* `name` - (Required) The name for the approval rule template. Maximum of 100 characters.
+* `description` - (Optional) The description of the approval rule template. Maximum of 1000 characters.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `approval_rule_template_id` - The ID of the approval rule template
+* `creation_date` - The date the approval rule template was created, in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8).
+* `last_modified_date` - The date the approval rule template was most recently changed, in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8).
+* `last_modified_user` - The Amazon Resource Name (ARN) of the user who made the most recent changes to the approval rule template.
+* `rule_content_sha256` - The SHA-256 hash signature for the content of the approval rule template.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CodeCommit approval rule templates using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import CodeCommit approval rule templates using the `name`. For example:
+
+```console
+% terraform import aws_codecommit_approval_rule_template.imported ExistingApprovalRuleTemplateName
+```
+
+<!-- cache-key: cdktf-0.18.0 input-7214ebc6881ab8b5f086e92ff1f7e4c9d9a74e5ba4ce12face913b9951a3a79e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/codecommit_approval_rule_template_association.html.markdown b/website/docs/cdktf/python/r/codecommit_approval_rule_template_association.html.markdown
new file mode 100644
index 00000000000..15d04f88e2d
--- /dev/null
+++ b/website/docs/cdktf/python/r/codecommit_approval_rule_template_association.html.markdown
@@ -0,0 +1,67 @@
+---
+subcategory: "CodeCommit"
+layout: "aws"
+page_title: "AWS: aws_codecommit_approval_rule_template_association"
+description: |-
+  Associates a CodeCommit Approval Rule Template with a Repository.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_codecommit_approval_rule_template_association
+
+Associates a CodeCommit Approval Rule Template with a Repository.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.codecommit_approval_rule_template_association import CodecommitApprovalRuleTemplateAssociation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        CodecommitApprovalRuleTemplateAssociation(self, "example",
+            approval_rule_template_name=Token.as_string(aws_codecommit_approval_rule_template_example.name),
+            repository_name=Token.as_string(aws_codecommit_repository_example.repository_name)
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `approval_rule_template_name` - (Required) The name for the approval rule template.
+* `repository_name` - (Required) The name of the repository that you want to associate with the template.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name of the approval rule template and name of the repository, separated by a comma (`,`).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CodeCommit approval rule template associations using the `approval_rule_template_name` and `repository_name` separated by a comma (`,`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import CodeCommit approval rule template associations using the `approval_rule_template_name` and `repository_name` separated by a comma (`,`). For example:
+
+```console
+% terraform import aws_codecommit_approval_rule_template_association.example approver-rule-for-example,MyExampleRepo
+```
+
+<!-- cache-key: cdktf-0.18.0 input-800a49692194ca7d70016b5efe848036ee2107aa5291a82d90a63cd527264967 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/codecommit_repository.html.markdown b/website/docs/cdktf/python/r/codecommit_repository.html.markdown
new file mode 100644
index 00000000000..6d174445b7c
--- /dev/null
+++ b/website/docs/cdktf/python/r/codecommit_repository.html.markdown
@@ -0,0 +1,73 @@
+---
+subcategory: "CodeCommit"
+layout: "aws"
+page_title: "AWS: aws_codecommit_repository"
+description: |-
+  Provides a CodeCommit Repository Resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_codecommit_repository
+
+Provides a CodeCommit Repository Resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.codecommit_repository import CodecommitRepository
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        CodecommitRepository(self, "test",
+            description="This is the Sample App Repository",
+            repository_name="MyTestRepository"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `repository_name` - (Required) The name for the repository. This needs to be less than 100 characters.
+* `description` - (Optional) The description of the repository. This needs to be less than 1000 characters
+* `default_branch` - (Optional) The default branch of the repository. The branch specified here needs to exist.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `repository_id` - The ID of the repository
+* `arn` - The ARN of the repository
+* `clone_url_http` - The URL to use for cloning the repository over HTTPS.
+* `clone_url_ssh` - The URL to use for cloning the repository over SSH.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CodeCommit repository using repository name. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import CodeCommit repository using repository name. For example:
+
+```console
+% terraform import aws_codecommit_repository.imported ExistingRepo
+```
+
+<!-- cache-key: cdktf-0.18.0 input-50d294f897d743c5c8bc69d3979c0e0ea1f7abc83eb38554128f2468842056ab -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/codecommit_trigger.html.markdown b/website/docs/cdktf/python/r/codecommit_trigger.html.markdown
new file mode 100644
index 00000000000..281b4de62e2
--- /dev/null
+++ b/website/docs/cdktf/python/r/codecommit_trigger.html.markdown
@@ -0,0 +1,65 @@
+---
+subcategory: "CodeCommit"
+layout: "aws"
+page_title: "AWS: aws_codecommit_trigger"
+description: |-
+  Provides a CodeCommit Trigger Resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_codecommit_trigger
+
+Provides a CodeCommit Trigger Resource.
+
+~> **NOTE:** Terraform currently can create only one trigger per repository, even if multiple aws_codecommit_trigger resources are defined. Moreover, creating triggers with Terraform will delete all other triggers in the repository (also manually-created triggers).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.codecommit_repository import CodecommitRepository
+from imports.aws.codecommit_trigger import CodecommitTrigger
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        test = CodecommitRepository(self, "test",
+            repository_name="test"
+        )
+        aws_codecommit_trigger_test = CodecommitTrigger(self, "test_1",
+            repository_name=test.repository_name,
+            trigger=[CodecommitTriggerTrigger(
+                destination_arn=Token.as_string(aws_sns_topic_test.arn),
+                events=["all"],
+                name="all"
+            )
+            ]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_codecommit_trigger_test.override_logical_id("test")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `repository_name` - (Required) The name for the repository. This needs to be less than 100 characters.
+* `name` - (Required) The name of the trigger.
+* `destination_arn` - (Required) The ARN of the resource that is the target for a trigger. For example, the ARN of a topic in Amazon Simple Notification Service (SNS).
+* `custom_data` - (Optional) Any custom data associated with the trigger that will be included in the information sent to the target of the trigger.
+* `branches` - (Optional) The branches that will be included in the trigger configuration. If no branches are specified, the trigger will apply to all branches.
+* `events` - (Required) The repository events that will cause the trigger to run actions in another service, such as sending a notification through Amazon Simple Notification Service (SNS). If no events are specified, the trigger will run for all repository events. Event types include: `all`, `updateReference`, `createReference`, `deleteReference`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `configuration_id` - System-generated unique identifier.
+
+<!-- cache-key: cdktf-0.18.0 input-6fc445fde615a4a95723b535dcf09b6e0655d8096cedb2b5da2231587aee3f88 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/codedeploy_app.html.markdown b/website/docs/cdktf/python/r/codedeploy_app.html.markdown
new file mode 100644
index 00000000000..4f2f894bbee
--- /dev/null
+++ b/website/docs/cdktf/python/r/codedeploy_app.html.markdown
@@ -0,0 +1,116 @@
+---
+subcategory: "CodeDeploy"
+layout: "aws"
+page_title: "AWS: aws_codedeploy_app"
+description: |-
+  Provides a CodeDeploy application.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_codedeploy_app
+
+Provides a CodeDeploy application to be used as a basis for deployments
+
+## Example Usage
+
+### ECS Application
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.codedeploy_app import CodedeployApp
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        CodedeployApp(self, "example",
+            compute_platform="ECS",
+            name="example"
+        )
+```
+
+### Lambda Application
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.codedeploy_app import CodedeployApp
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        CodedeployApp(self, "example",
+            compute_platform="Lambda",
+            name="example"
+        )
+```
+
+### Server Application
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.codedeploy_app import CodedeployApp
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        CodedeployApp(self, "example",
+            compute_platform="Server",
+            name="example"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the application.
+* `compute_platform` - (Optional) The compute platform can either be `ECS`, `Lambda`, or `Server`. Default is `Server`.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the CodeDeploy application.
+* `application_id` - The application ID.
+* `id` - Amazon's assigned ID for the application.
+* `name` - The application's name.
+* `github_account_name` - The name for a connection to a GitHub account.
+* `linked_to_github` - Whether the user has authenticated with GitHub for the specified application.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CodeDeploy Applications using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import CodeDeploy Applications using the `name`. For example:
+
+```console
+% terraform import aws_codedeploy_app.example my-application
+```
+
+<!-- cache-key: cdktf-0.18.0 input-00b9fbbd35972d7215984367937bb47e7c6439d5c41831dac0b563a419c59962 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/codedeploy_deployment_config.html.markdown b/website/docs/cdktf/python/r/codedeploy_deployment_config.html.markdown
new file mode 100644
index 00000000000..40d2fd2fe4b
--- /dev/null
+++ b/website/docs/cdktf/python/r/codedeploy_deployment_config.html.markdown
@@ -0,0 +1,172 @@
+---
+subcategory: "CodeDeploy"
+layout: "aws"
+page_title: "AWS: aws_codedeploy_deployment_config"
+description: |-
+  Provides a CodeDeploy deployment config.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_codedeploy_deployment_config
+
+Provides a CodeDeploy deployment config for an application
+
+## Example Usage
+
+### Server Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.codedeploy_deployment_config import CodedeployDeploymentConfig
+from imports.aws.codedeploy_deployment_group import CodedeployDeploymentGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        foo = CodedeployDeploymentConfig(self, "foo",
+            deployment_config_name="test-deployment-config",
+            minimum_healthy_hosts=CodedeployDeploymentConfigMinimumHealthyHosts(
+                type="HOST_COUNT",
+                value=2
+            )
+        )
+        aws_codedeploy_deployment_group_foo = CodedeployDeploymentGroup(self, "foo_1",
+            alarm_configuration=CodedeployDeploymentGroupAlarmConfiguration(
+                alarms=["my-alarm-name"],
+                enabled=True
+            ),
+            app_name=foo_app.name,
+            auto_rollback_configuration=CodedeployDeploymentGroupAutoRollbackConfiguration(
+                enabled=True,
+                events=["DEPLOYMENT_FAILURE"]
+            ),
+            deployment_config_name=foo.id,
+            deployment_group_name="bar",
+            ec2_tag_filter=[CodedeployDeploymentGroupEc2TagFilter(
+                key="filterkey",
+                type="KEY_AND_VALUE",
+                value="filtervalue"
+            )
+            ],
+            service_role_arn=foo_role.arn,
+            trigger_configuration=[CodedeployDeploymentGroupTriggerConfiguration(
+                trigger_events=["DeploymentFailure"],
+                trigger_name="foo-trigger",
+                trigger_target_arn="foo-topic-arn"
+            )
+            ]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_codedeploy_deployment_group_foo.override_logical_id("foo")
+```
+
+### Lambda Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.codedeploy_deployment_config import CodedeployDeploymentConfig
+from imports.aws.codedeploy_deployment_group import CodedeployDeploymentGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        foo = CodedeployDeploymentConfig(self, "foo",
+            compute_platform="Lambda",
+            deployment_config_name="test-deployment-config",
+            traffic_routing_config=CodedeployDeploymentConfigTrafficRoutingConfig(
+                time_based_linear=CodedeployDeploymentConfigTrafficRoutingConfigTimeBasedLinear(
+                    interval=10,
+                    percentage=10
+                ),
+                type="TimeBasedLinear"
+            )
+        )
+        aws_codedeploy_deployment_group_foo = CodedeployDeploymentGroup(self, "foo_1",
+            alarm_configuration=CodedeployDeploymentGroupAlarmConfiguration(
+                alarms=["my-alarm-name"],
+                enabled=True
+            ),
+            app_name=foo_app.name,
+            auto_rollback_configuration=CodedeployDeploymentGroupAutoRollbackConfiguration(
+                enabled=True,
+                events=["DEPLOYMENT_STOP_ON_ALARM"]
+            ),
+            deployment_config_name=foo.id,
+            deployment_group_name="bar",
+            service_role_arn=foo_role.arn
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_codedeploy_deployment_group_foo.override_logical_id("foo")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `deployment_config_name` - (Required) The name of the deployment config.
+* `compute_platform` - (Optional) The compute platform can be `Server`, `Lambda`, or `ECS`. Default is `Server`.
+* `minimum_healthy_hosts` - (Optional) A minimum_healthy_hosts block. Required for `Server` compute platform. Minimum Healthy Hosts are documented below.
+* `traffic_routing_config` - (Optional) A traffic_routing_config block. Traffic Routing Config is documented below.
+
+The `minimum_healthy_hosts` block supports the following:
+
+* `type` - (Required) The type can either be `FLEET_PERCENT` or `HOST_COUNT`.
+* `value` - (Required) The value when the type is `FLEET_PERCENT` represents the minimum number of healthy instances as
+a percentage of the total number of instances in the deployment. If you specify FLEET_PERCENT, at the start of the
+deployment, AWS CodeDeploy converts the percentage to the equivalent number of instance and rounds up fractional instances.
+When the type is `HOST_COUNT`, the value represents the minimum number of healthy instances as an absolute value.
+
+The `traffic_routing_config` block supports the following:
+
+* `type` - (Optional) Type of traffic routing config. One of `TimeBasedCanary`, `TimeBasedLinear`, `AllAtOnce`.
+* `time_based_canary` - (Optional) The time based canary configuration information. If `type` is `TimeBasedLinear`, use `time_based_linear` instead.
+* `time_based_linear` - (Optional) The time based linear configuration information. If `type` is `TimeBasedCanary`, use `time_based_canary` instead.
+
+The `time_based_canary` block supports the following:
+
+* `interval` - (Optional) The number of minutes between the first and second traffic shifts of a `TimeBasedCanary` deployment.
+* `percentage` - (Optional) The percentage of traffic to shift in the first increment of a `TimeBasedCanary` deployment.
+
+The `time_based_linear` block supports the following:
+
+* `interval` - (Optional) The number of minutes between each incremental traffic shift of a `TimeBasedLinear` deployment.
+* `percentage` - (Optional) The percentage of traffic that is shifted at the start of each increment of a `TimeBasedLinear` deployment.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The deployment group's config name.
+* `deployment_config_id` - The AWS Assigned deployment config id
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CodeDeploy Deployment Configurations using the `deployment_config_name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import CodeDeploy Deployment Configurations using the `deployment_config_name`. For example:
+
+```console
+% terraform import aws_codedeploy_deployment_config.example my-deployment-config
+```
+
+<!-- cache-key: cdktf-0.18.0 input-2cc160bcb5a9c6c91fd5d75e63168fd2d320f48dbdb419ab8d514075206a12e7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/codedeploy_deployment_group.html.markdown b/website/docs/cdktf/python/r/codedeploy_deployment_group.html.markdown
new file mode 100644
index 00000000000..9886bbb8979
--- /dev/null
+++ b/website/docs/cdktf/python/r/codedeploy_deployment_group.html.markdown
@@ -0,0 +1,411 @@
+---
+subcategory: "CodeDeploy"
+layout: "aws"
+page_title: "AWS: aws_codedeploy_deployment_group"
+description: |-
+  Provides a CodeDeploy deployment group.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_codedeploy_deployment_group
+
+Provides a CodeDeploy Deployment Group for a CodeDeploy Application
+
+~> **NOTE on blue/green deployments:** When using `green_fleet_provisioning_option` with the `COPY_AUTO_SCALING_GROUP` action, CodeDeploy will create a new ASG with a different name. This ASG is _not_ managed by terraform and will conflict with existing configuration and state. You may want to use a different approach to managing deployments that involve multiple ASG, such as `DISCOVER_EXISTING` with separate blue and green ASG.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.codedeploy_app import CodedeployApp
+from imports.aws.codedeploy_deployment_group import CodedeployDeploymentGroup
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.iam_role import IamRole
+from imports.aws.iam_role_policy_attachment import IamRolePolicyAttachment
+from imports.aws.sns_topic import SnsTopic
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = CodedeployApp(self, "example",
+            name="example-app"
+        )
+        aws_sns_topic_example = SnsTopic(self, "example_1",
+            name="example-topic"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_sns_topic_example.override_logical_id("example")
+        assume_role = DataAwsIamPolicyDocument(self, "assume_role",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["sts:AssumeRole"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["codedeploy.amazonaws.com"],
+                    type="Service"
+                )
+                ]
+            )
+            ]
+        )
+        aws_iam_role_example = IamRole(self, "example_3",
+            assume_role_policy=Token.as_string(assume_role.json),
+            name="example-role"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_role_example.override_logical_id("example")
+        IamRolePolicyAttachment(self, "AWSCodeDeployRole",
+            policy_arn="arn:aws:iam::aws:policy/service-role/AWSCodeDeployRole",
+            role=Token.as_string(aws_iam_role_example.name)
+        )
+        aws_codedeploy_deployment_group_example = CodedeployDeploymentGroup(self, "example_5",
+            alarm_configuration=CodedeployDeploymentGroupAlarmConfiguration(
+                alarms=["my-alarm-name"],
+                enabled=True
+            ),
+            app_name=example.name,
+            auto_rollback_configuration=CodedeployDeploymentGroupAutoRollbackConfiguration(
+                enabled=True,
+                events=["DEPLOYMENT_FAILURE"]
+            ),
+            deployment_group_name="example-group",
+            ec2_tag_set=[CodedeployDeploymentGroupEc2TagSet(
+                ec2_tag_filter=[CodedeployDeploymentGroupEc2TagSetEc2TagFilter(
+                    key="filterkey1",
+                    type="KEY_AND_VALUE",
+                    value="filtervalue"
+                ), CodedeployDeploymentGroupEc2TagSetEc2TagFilter(
+                    key="filterkey2",
+                    type="KEY_AND_VALUE",
+                    value="filtervalue"
+                )
+                ]
+            )
+            ],
+            outdated_instances_strategy="UPDATE",
+            service_role_arn=Token.as_string(aws_iam_role_example.arn),
+            trigger_configuration=[CodedeployDeploymentGroupTriggerConfiguration(
+                trigger_events=["DeploymentFailure"],
+                trigger_name="example-trigger",
+                trigger_target_arn=Token.as_string(aws_sns_topic_example.arn)
+            )
+            ]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_codedeploy_deployment_group_example.override_logical_id("example")
+```
+
+### Blue Green Deployments with ECS
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.codedeploy_app import CodedeployApp
+from imports.aws.codedeploy_deployment_group import CodedeployDeploymentGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = CodedeployApp(self, "example",
+            compute_platform="ECS",
+            name="example"
+        )
+        aws_codedeploy_deployment_group_example = CodedeployDeploymentGroup(self, "example_1",
+            app_name=example.name,
+            auto_rollback_configuration=CodedeployDeploymentGroupAutoRollbackConfiguration(
+                enabled=True,
+                events=["DEPLOYMENT_FAILURE"]
+            ),
+            blue_green_deployment_config=CodedeployDeploymentGroupBlueGreenDeploymentConfig(
+                deployment_ready_option=CodedeployDeploymentGroupBlueGreenDeploymentConfigDeploymentReadyOption(
+                    action_on_timeout="CONTINUE_DEPLOYMENT"
+                ),
+                terminate_blue_instances_on_deployment_success=CodedeployDeploymentGroupBlueGreenDeploymentConfigTerminateBlueInstancesOnDeploymentSuccess(
+                    action="TERMINATE",
+                    termination_wait_time_in_minutes=5
+                )
+            ),
+            deployment_config_name="CodeDeployDefault.ECSAllAtOnce",
+            deployment_group_name="example",
+            deployment_style=CodedeployDeploymentGroupDeploymentStyle(
+                deployment_option="WITH_TRAFFIC_CONTROL",
+                deployment_type="BLUE_GREEN"
+            ),
+            ecs_service=CodedeployDeploymentGroupEcsService(
+                cluster_name=Token.as_string(aws_ecs_cluster_example.name),
+                service_name=Token.as_string(aws_ecs_service_example.name)
+            ),
+            load_balancer_info=CodedeployDeploymentGroupLoadBalancerInfo(
+                target_group_pair_info=CodedeployDeploymentGroupLoadBalancerInfoTargetGroupPairInfo(
+                    prod_traffic_route=CodedeployDeploymentGroupLoadBalancerInfoTargetGroupPairInfoProdTrafficRoute(
+                        listener_arns=[Token.as_string(aws_lb_listener_example.arn)]
+                    ),
+                    target_group=[CodedeployDeploymentGroupLoadBalancerInfoTargetGroupPairInfoTargetGroup(
+                        name=blue.name
+                    ), CodedeployDeploymentGroupLoadBalancerInfoTargetGroupPairInfoTargetGroup(
+                        name=green.name
+                    )
+                    ]
+                )
+            ),
+            service_role_arn=Token.as_string(aws_iam_role_example.arn)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_codedeploy_deployment_group_example.override_logical_id("example")
+```
+
+### Blue Green Deployments with Servers and Classic ELB
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.codedeploy_app import CodedeployApp
+from imports.aws.codedeploy_deployment_group import CodedeployDeploymentGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = CodedeployApp(self, "example",
+            name="example-app"
+        )
+        aws_codedeploy_deployment_group_example = CodedeployDeploymentGroup(self, "example_1",
+            app_name=example.name,
+            blue_green_deployment_config=CodedeployDeploymentGroupBlueGreenDeploymentConfig(
+                deployment_ready_option=CodedeployDeploymentGroupBlueGreenDeploymentConfigDeploymentReadyOption(
+                    action_on_timeout="STOP_DEPLOYMENT",
+                    wait_time_in_minutes=60
+                ),
+                green_fleet_provisioning_option=CodedeployDeploymentGroupBlueGreenDeploymentConfigGreenFleetProvisioningOption(
+                    action="DISCOVER_EXISTING"
+                ),
+                terminate_blue_instances_on_deployment_success=CodedeployDeploymentGroupBlueGreenDeploymentConfigTerminateBlueInstancesOnDeploymentSuccess(
+                    action="KEEP_ALIVE"
+                )
+            ),
+            deployment_group_name="example-group",
+            deployment_style=CodedeployDeploymentGroupDeploymentStyle(
+                deployment_option="WITH_TRAFFIC_CONTROL",
+                deployment_type="BLUE_GREEN"
+            ),
+            load_balancer_info=CodedeployDeploymentGroupLoadBalancerInfo(
+                elb_info=[CodedeployDeploymentGroupLoadBalancerInfoElbInfo(
+                    name=Token.as_string(aws_elb_example.name)
+                )
+                ]
+            ),
+            service_role_arn=Token.as_string(aws_iam_role_example.arn)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_codedeploy_deployment_group_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `app_name` - (Required) The name of the application.
+* `deployment_group_name` - (Required) The name of the deployment group.
+* `service_role_arn` - (Required) The service role ARN that allows deployments.
+* `alarm_configuration` - (Optional) Configuration block of alarms associated with the deployment group (documented below).
+* `auto_rollback_configuration` - (Optional) Configuration block of the automatic rollback configuration associated with the deployment group (documented below).
+* `autoscaling_groups` - (Optional) Autoscaling groups associated with the deployment group.
+* `blue_green_deployment_config` - (Optional) Configuration block of the blue/green deployment options for a deployment group (documented below).
+* `deployment_config_name` - (Optional) The name of the group's deployment config. The default is "CodeDeployDefault.OneAtATime".
+* `deployment_style` - (Optional) Configuration block of the type of deployment, either in-place or blue/green, you want to run and whether to route deployment traffic behind a load balancer (documented below).
+* `ec2_tag_filter` - (Optional) Tag filters associated with the deployment group. See the AWS docs for details.
+* `ec2_tag_set` - (Optional) Configuration block(s) of Tag filters associated with the deployment group, which are also referred to as tag groups (documented below). See the AWS docs for details.
+* `ecs_service` - (Optional) Configuration block(s) of the ECS services for a deployment group (documented below).
+* `load_balancer_info` - (Optional) Single configuration block of the load balancer to use in a blue/green deployment (documented below).
+* `on_premises_instance_tag_filter` - (Optional) On premise tag filters associated with the group. See the AWS docs for details.
+* `trigger_configuration` - (Optional) Configuration block(s) of the triggers for the deployment group (documented below).
+* `outdated_instances_strategy` - (Optional) Configuration block of Indicates what happens when new Amazon EC2 instances are launched mid-deployment and do not receive the deployed application revision. Valid values are `UPDATE` and `IGNORE`. Defaults to `UPDATE`.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### alarm_configuration Argument Reference
+
+You can configure a deployment to stop when a **CloudWatch** alarm detects that a metric has fallen below or exceeded a defined threshold. `alarm_configuration` supports the following:
+
+* `alarms` - (Optional) A list of alarms configured for the deployment group. _A maximum of 10 alarms can be added to a deployment group_.
+* `enabled` - (Optional) Indicates whether the alarm configuration is enabled. This option is useful when you want to temporarily deactivate alarm monitoring for a deployment group without having to add the same alarms again later.
+* `ignore_poll_alarm_failure` - (Optional) Indicates whether a deployment should continue if information about the current state of alarms cannot be retrieved from CloudWatch. The default value is `false`.
+    * `true`: The deployment will proceed even if alarm status information can't be retrieved.
+    * `false`: The deployment will stop if alarm status information can't be retrieved.
+
+_Only one `alarm_configuration` is allowed_.
+
+### auto_rollback_configuration Argument Reference
+
+You can configure a deployment group to automatically rollback when a deployment fails or when a monitoring threshold you specify is met. In this case, the last known good version of an application revision is deployed. `auto_rollback_configuration` supports the following:
+
+* `enabled` - (Optional) Indicates whether a defined automatic rollback configuration is currently enabled for this Deployment Group. If you enable automatic rollback, you must specify at least one event type.
+* `events` - (Optional) The event type or types that trigger a rollback. Supported types are `DEPLOYMENT_FAILURE`, `DEPLOYMENT_STOP_ON_ALARM` and `DEPLOYMENT_STOP_ON_REQUEST`.
+
+_Only one `auto_rollback_configuration` is allowed_.
+
+### blue_green_deployment_config Argument Reference
+
+You can configure options for a blue/green deployment. `blue_green_deployment_config` supports the following:
+
+* `deployment_ready_option` - (Optional) Information about the action to take when newly provisioned instances are ready to receive traffic in a blue/green deployment (documented below).
+* `green_fleet_provisioning_option` - (Optional) Information about how instances are provisioned for a replacement environment in a blue/green deployment (documented below).
+* `terminate_blue_instances_on_deployment_success` - (Optional) Information about whether to terminate instances in the original fleet during a blue/green deployment (documented below).
+
+_Only one `blue_green_deployment_config` is allowed_.
+
+You can configure how traffic is rerouted to instances in a replacement environment in a blue/green deployment. `deployment_ready_option` supports the following:
+
+* `action_on_timeout` - (Optional) When to reroute traffic from an original environment to a replacement environment in a blue/green deployment.
+    * `CONTINUE_DEPLOYMENT`: Register new instances with the load balancer immediately after the new application revision is installed on the instances in the replacement environment.
+    * `STOP_DEPLOYMENT`: Do not register new instances with load balancer unless traffic is rerouted manually. If traffic is not rerouted manually before the end of the specified wait period, the deployment status is changed to Stopped.
+* `wait_time_in_minutes` - (Optional) The number of minutes to wait before the status of a blue/green deployment changed to Stopped if rerouting is not started manually. Applies only to the `STOP_DEPLOYMENT` option for `action_on_timeout`.
+
+You can configure how instances will be added to the replacement environment in a blue/green deployment. `green_fleet_provisioning_option` supports the following:
+
+* `action` - (Optional) The method used to add instances to a replacement environment.
+    * `DISCOVER_EXISTING`: Use instances that already exist or will be created manually.
+    * `COPY_AUTO_SCALING_GROUP`: Use settings from a specified **Auto Scaling** group to define and create instances in a new Auto Scaling group. _Exactly one Auto Scaling group must be specified_ when selecting `COPY_AUTO_SCALING_GROUP`. Use `autoscaling_groups` to specify the Auto Scaling group.
+
+You can configure how instances in the original environment are terminated when a blue/green deployment is successful. `terminate_blue_instances_on_deployment_success` supports the following:
+
+* `action` - (Optional) The action to take on instances in the original environment after a successful blue/green deployment.
+    * `TERMINATE`: Instances are terminated after a specified wait time.
+    * `KEEP_ALIVE`: Instances are left running after they are deregistered from the load balancer and removed from the deployment group.
+* `termination_wait_time_in_minutes` - (Optional) The number of minutes to wait after a successful blue/green deployment before terminating instances from the original environment.
+
+### deployment_style Argument Reference
+
+You can configure the type of deployment, either in-place or blue/green, you want to run and whether to route deployment traffic behind a load balancer. `deployment_style` supports the following:
+
+* `deployment_option` - (Optional) Indicates whether to route deployment traffic behind a load balancer. Valid Values are `WITH_TRAFFIC_CONTROL` or `WITHOUT_TRAFFIC_CONTROL`. Default is `WITHOUT_TRAFFIC_CONTROL`.
+* `deployment_type` - (Optional) Indicates whether to run an in-place deployment or a blue/green deployment. Valid Values are `IN_PLACE` or `BLUE_GREEN`. Default is `IN_PLACE`.
+
+_Only one `deployment_style` is allowed_.
+
+### ec2_tag_filter Argument Reference
+
+The `ec2_tag_filter` configuration block supports the following:
+
+* `key` - (Optional) The key of the tag filter.
+* `type` - (Optional) The type of the tag filter, either `KEY_ONLY`, `VALUE_ONLY`, or `KEY_AND_VALUE`.
+* `value` - (Optional) The value of the tag filter.
+
+Multiple occurrences of `ec2_tag_filter` are allowed, where any instance that matches to at least one of the tag filters is selected.
+
+### ec2_tag_set Argument Reference
+
+You can form a tag group by putting a set of tag filters into `ec2_tag_set`. If multiple tag groups are specified, any instance that matches to at least one tag filter of every tag group is selected.
+
+### ecs_service Argument Reference
+
+Each `ecs_service` configuration block supports the following:
+
+* `cluster_name` - (Required) The name of the ECS cluster.
+* `service_name` - (Required) The name of the ECS service.
+
+### load_balancer_info Argument Reference
+
+You can configure the **Load Balancer** to use in a deployment. `load_balancer_info` supports the following:
+
+* `elb_info` - (Optional) The Classic Elastic Load Balancer to use in a deployment. Conflicts with `target_group_info` and `target_group_pair_info`.
+* `target_group_info` - (Optional) The (Application/Network Load Balancer) target group to use in a deployment. Conflicts with `elb_info` and `target_group_pair_info`.
+* `target_group_pair_info` - (Optional) The (Application/Network Load Balancer) target group pair to use in a deployment. Conflicts with `elb_info` and `target_group_info`.
+
+#### load_balancer_info elb_info Argument Reference
+
+The `elb_info` configuration block supports the following:
+
+* `name` - (Optional) The name of the load balancer that will be used to route traffic from original instances to replacement instances in a blue/green deployment. For in-place deployments, the name of the load balancer that instances are deregistered from so they are not serving traffic during a deployment, and then re-registered with after the deployment completes.
+
+#### load_balancer_info target_group_info Argument Reference
+
+The `target_group_info` configuration block supports the following:
+
+* `name` - (Optional) The name of the target group that instances in the original environment are deregistered from, and instances in the replacement environment registered with. For in-place deployments, the name of the target group that instances are deregistered from, so they are not serving traffic during a deployment, and then re-registered with after the deployment completes.
+
+#### load_balancer_info target_group_pair_info Argument Reference
+
+The `target_group_pair_info` configuration block supports the following:
+
+* `prod_traffic_route` - (Required) Configuration block for the production traffic route (documented below).
+* `target_group` - (Required) Configuration blocks for a target group within a target group pair (documented below).
+* `test_traffic_route` - (Optional) Configuration block for the test traffic route (documented below).
+
+##### load_balancer_info target_group_pair_info prod_traffic_route Argument Reference
+
+The `prod_traffic_route` configuration block supports the following:
+
+* `listener_arns` - (Required) List of Amazon Resource Names (ARNs) of the load balancer listeners. Must contain exactly one listener ARN.
+
+##### load_balancer_info target_group_pair_info target_group Argument Reference
+
+The `target_group` configuration block supports the following:
+
+* `name` - (Required) Name of the target group.
+
+##### load_balancer_info target_group_pair_info test_traffic_route Argument Reference
+
+The `test_traffic_route` configuration block supports the following:
+
+* `listener_arns` - (Required) List of Amazon Resource Names (ARNs) of the load balancer listeners.
+
+### on_premises_instance_tag_filter Argument Reference
+
+The `on_premises_instance_tag_filter` configuration block supports the following:
+
+* `key` - (Optional) The key of the tag filter.
+* `type` - (Optional) The type of the tag filter, either `KEY_ONLY`, `VALUE_ONLY`, or `KEY_AND_VALUE`.
+* `value` - (Optional) The value of the tag filter.
+
+### trigger_configuration Argument Reference
+
+Add triggers to a Deployment Group to receive notifications about events related to deployments or instances in the group. Notifications are sent to subscribers of the **SNS** topic associated with the trigger. _CodeDeploy must have permission to publish to the topic from this deployment group_. `trigger_configuration` supports the following:
+
+* `trigger_events` - (Required) The event type or types for which notifications are triggered. Some values that are supported: `DeploymentStart`, `DeploymentSuccess`, `DeploymentFailure`, `DeploymentStop`, `DeploymentRollback`, `InstanceStart`, `InstanceSuccess`, `InstanceFailure`.  See [the CodeDeploy documentation][1] for all possible values.
+* `trigger_name` - (Required) The name of the notification trigger.
+* `trigger_target_arn` - (Required) The ARN of the SNS topic through which notifications are sent.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the CodeDeploy deployment group.
+* `id` - Application name and deployment group name.
+* `compute_platform` - The destination platform type for the deployment.
+* `deployment_group_id` - The ID of the CodeDeploy deployment group.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CodeDeploy Deployment Groups using `app_name`, a colon, and `deployment_group_name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import CodeDeploy Deployment Groups using `app_name`, a colon, and `deployment_group_name`. For example:
+
+```console
+% terraform import aws_codedeploy_deployment_group.example my-application:my-deployment-group
+```
+
+[1]: http://docs.aws.amazon.com/codedeploy/latest/userguide/monitoring-sns-event-notifications-create-trigger.html
+
+<!-- cache-key: cdktf-0.18.0 input-5e030adb78af16cbd2b9d795ba427fe21289613e6f4a6a7fcdd3fb270bcf4d76 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/codegurureviewer_repository_association.html.markdown b/website/docs/cdktf/python/r/codegurureviewer_repository_association.html.markdown
new file mode 100644
index 00000000000..65c0c6c1b10
--- /dev/null
+++ b/website/docs/cdktf/python/r/codegurureviewer_repository_association.html.markdown
@@ -0,0 +1,121 @@
+---
+subcategory: "CodeGuru Reviewer"
+layout: "aws"
+page_title: "AWS: aws_codegurureviewer_repository_association"
+description: |-
+  Terraform resource for managing an AWS CodeGuru Reviewer Repository Association.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_codegurureviewer_repository_association
+
+Terraform resource for managing an AWS CodeGuru Reviewer Repository Association.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from cdktf import TerraformResourceLifecycle
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.codecommit_repository import CodecommitRepository
+from imports.aws.codegurureviewer_repository_association import CodegurureviewerRepositoryAssociation
+from imports.aws.kms_key import KmsKey
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = CodecommitRepository(self, "example",
+            lifecycle=TerraformResourceLifecycle(
+                ignore_changes=["codeguruReviewer"]
+            ),
+            repository_name="example-repo"
+        )
+        aws_kms_key_example = KmsKey(self, "example_1")
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_kms_key_example.override_logical_id("example")
+        aws_codegurureviewer_repository_association_example =
+        CodegurureviewerRepositoryAssociation(self, "example_2",
+            kms_key_details=CodegurureviewerRepositoryAssociationKmsKeyDetails(
+                encryption_option="CUSTOMER_MANAGED_CMK",
+                kms_key_id=Token.as_string(aws_kms_key_example.key_id)
+            ),
+            repository=CodegurureviewerRepositoryAssociationRepository(
+                codecommit=CodegurureviewerRepositoryAssociationRepositoryCodecommit(
+                    name=example.repository_name
+                )
+            )
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_codegurureviewer_repository_association_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `repository` - (Required) An object describing the repository to associate. Valid values: `bitbucket`, `codecommit`, `github_enterprise_server`, or `s3_bucket`. Block is documented below. Note: for repositories that leverage CodeStar connections (ex. `bitbucket`, `github_enterprise_server`) the connection must be in `Available` status prior to creating this resource.
+
+The following arguments are optional:
+
+* `kms_key_details` - (Optional) An object describing the KMS key to asssociate. Block is documented below.
+
+## repository
+
+This configuration block supports the following:
+
+### bitbucket
+
+* `connection_arn` - (Required) The Amazon Resource Name (ARN) of an AWS CodeStar Connections connection.
+* `name` - (Required) The name of the third party source repository.
+* `owner` - (Required) The username for the account that owns the repository.
+
+### codecommit
+
+* `name` - (Required) The name of the AWS CodeCommit repository.
+
+### github_enterprise_server
+
+* `connection_arn` - (Required) The Amazon Resource Name (ARN) of an AWS CodeStar Connections connection.
+* `name` - (Required) The name of the third party source repository.
+* `owner` - (Required) The username for the account that owns the repository.
+
+### s3_bucket
+
+* `bucket_name` - (Required) The name of the S3 bucket used for associating a new S3 repository. Note: The name must begin with `codeguru-reviewer-`.
+* `name` - (Required) The name of the repository in the S3 bucket.
+
+## kms_key_details
+
+This configuration block supports the following:
+
+* `encryption_option` - (Optional) The encryption option for a repository association. It is either owned by AWS Key Management Service (KMS) (`AWS_OWNED_CMK`) or customer managed (`CUSTOMER_MANAGED_CMK`).
+* `kms_key_id` - (Optional) The ID of the AWS KMS key that is associated with a repository association.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) identifying the repository association.
+* `association_id` - The ID of the repository association.
+* `connection_arn` - The Amazon Resource Name (ARN) of an AWS CodeStar Connections connection.
+* `id` - The Amazon Resource Name (ARN) identifying the repository association.
+* `name` - The name of the repository.
+* `owner` - The owner of the repository.
+* `provider_type` - The provider type of the repository association.
+* `state` - The state of the repository association.
+* `state_reason` - A description of why the repository association is in the current state.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `60m`)
+* `update` - (Default `180m`)
+* `delete` - (Default `90m`)
+
+<!-- cache-key: cdktf-0.18.0 input-b8a4a1df23287da973904a4fa9f7f519b62aeebe1f60535df99ad7d1c408a770 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/codepipeline.html.markdown b/website/docs/cdktf/python/r/codepipeline.html.markdown
new file mode 100644
index 00000000000..7c0067e51b0
--- /dev/null
+++ b/website/docs/cdktf/python/r/codepipeline.html.markdown
@@ -0,0 +1,228 @@
+---
+subcategory: "CodePipeline"
+layout: "aws"
+page_title: "AWS: aws_codepipeline"
+description: |-
+  Provides a CodePipeline
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_codepipeline
+
+Provides a CodePipeline.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.codepipeline import Codepipeline
+from imports.aws.codestarconnections_connection import CodestarconnectionsConnection
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.data_aws_kms_alias import DataAwsKmsAlias
+from imports.aws.iam_role import IamRole
+from imports.aws.iam_role_policy import IamRolePolicy
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_acl import S3BucketAcl
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = CodestarconnectionsConnection(self, "example",
+            name="example-connection",
+            provider_type="GitHub"
+        )
+        codepipeline_bucket = S3Bucket(self, "codepipeline_bucket",
+            bucket="test-bucket"
+        )
+        S3BucketAcl(self, "codepipeline_bucket_acl",
+            acl="private",
+            bucket=codepipeline_bucket.id
+        )
+        assume_role = DataAwsIamPolicyDocument(self, "assume_role",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["sts:AssumeRole"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["codepipeline.amazonaws.com"],
+                    type="Service"
+                )
+                ]
+            )
+            ]
+        )
+        codepipeline_policy = DataAwsIamPolicyDocument(self, "codepipeline_policy",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["s3:GetObject", "s3:GetObjectVersion", "s3:GetBucketVersioning", "s3:PutObjectAcl", "s3:PutObject"
+                ],
+                effect="Allow",
+                resources=[codepipeline_bucket.arn, "${" + codepipeline_bucket.arn + "}/*"
+                ]
+            ), DataAwsIamPolicyDocumentStatement(
+                actions=["codestar-connections:UseConnection"],
+                effect="Allow",
+                resources=[example.arn]
+            ), DataAwsIamPolicyDocumentStatement(
+                actions=["codebuild:BatchGetBuilds", "codebuild:StartBuild"],
+                effect="Allow",
+                resources=["*"]
+            )
+            ]
+        )
+        s3_kmskey = DataAwsKmsAlias(self, "s3kmskey",
+            name="alias/myKmsKey"
+        )
+        codepipeline_role = IamRole(self, "codepipeline_role",
+            assume_role_policy=Token.as_string(assume_role.json),
+            name="test-role"
+        )
+        aws_iam_role_policy_codepipeline_policy = IamRolePolicy(self, "codepipeline_policy_7",
+            name="codepipeline_policy",
+            policy=Token.as_string(codepipeline_policy.json),
+            role=codepipeline_role.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_role_policy_codepipeline_policy.override_logical_id("codepipeline_policy")
+        Codepipeline(self, "codepipeline",
+            artifact_store=[CodepipelineArtifactStore(
+                encryption_key=CodepipelineArtifactStoreEncryptionKey(
+                    id=Token.as_string(s3_kmskey.arn),
+                    type="KMS"
+                ),
+                location=codepipeline_bucket.bucket,
+                type="S3"
+            )
+            ],
+            name="tf-test-pipeline",
+            role_arn=codepipeline_role.arn,
+            stage=[CodepipelineStage(
+                action=[CodepipelineStageAction(
+                    category="Source",
+                    configuration={
+                        "BranchName": "main",
+                        "ConnectionArn": example.arn,
+                        "FullRepositoryId": "my-organization/example"
+                    },
+                    name="Source",
+                    output_artifacts=["source_output"],
+                    owner="AWS",
+                    provider="CodeStarSourceConnection",
+                    version="1"
+                )
+                ],
+                name="Source"
+            ), CodepipelineStage(
+                action=[CodepipelineStageAction(
+                    category="Build",
+                    configuration={
+                        "ProjectName": "test"
+                    },
+                    input_artifacts=["source_output"],
+                    name="Build",
+                    output_artifacts=["build_output"],
+                    owner="AWS",
+                    provider="CodeBuild",
+                    version="1"
+                )
+                ],
+                name="Build"
+            ), CodepipelineStage(
+                action=[CodepipelineStageAction(
+                    category="Deploy",
+                    configuration={
+                        "ActionMode": "REPLACE_ON_FAILURE",
+                        "Capabilities": "CAPABILITY_AUTO_EXPAND,CAPABILITY_IAM",
+                        "OutputFileName": "CreateStackOutput.json",
+                        "StackName": "MyStack",
+                        "TemplatePath": "build_output::sam-templated.yaml"
+                    },
+                    input_artifacts=["build_output"],
+                    name="Deploy",
+                    owner="AWS",
+                    provider="CloudFormation",
+                    version="1"
+                )
+                ],
+                name="Deploy"
+            )
+            ]
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the pipeline.
+* `role_arn` - (Required) A service role Amazon Resource Name (ARN) that grants AWS CodePipeline permission to make calls to AWS services on your behalf.
+* `artifact_store` (Required) One or more artifact_store blocks. Artifact stores are documented below.
+* `stage` (Minimum of at least two `stage` blocks is required) A stage block. Stages are documented below.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+An `artifact_store` block supports the following arguments:
+
+* `location` - (Required) The location where AWS CodePipeline stores artifacts for a pipeline; currently only `S3` is supported.
+* `type` - (Required) The type of the artifact store, such as Amazon S3
+* `encryption_key` - (Optional) The encryption key block AWS CodePipeline uses to encrypt the data in the artifact store, such as an AWS Key Management Service (AWS KMS) key. If you don't specify a key, AWS CodePipeline uses the default key for Amazon Simple Storage Service (Amazon S3). An `encryption_key` block is documented below.
+* `region` - (Optional) The region where the artifact store is located. Required for a cross-region CodePipeline, do not provide for a single-region CodePipeline.
+
+An `encryption_key` block supports the following arguments:
+
+* `id` - (Required) The KMS key ARN or ID
+* `type` - (Required) The type of key; currently only `KMS` is supported
+
+A `stage` block supports the following arguments:
+
+* `name` - (Required) The name of the stage.
+* `action` - (Required) The action(s) to include in the stage. Defined as an `action` block below
+
+An `action` block supports the following arguments:
+
+* `category` - (Required) A category defines what kind of action can be taken in the stage, and constrains the provider type for the action. Possible values are `Approval`, `Build`, `Deploy`, `Invoke`, `Source` and `Test`.
+* `owner` - (Required) The creator of the action being called. Possible values are `AWS`, `Custom` and `ThirdParty`.
+* `name` - (Required) The action declaration's name.
+* `provider` - (Required) The provider of the service being called by the action. Valid providers are determined by the action category. Provider names are listed in the [Action Structure Reference](https://docs.aws.amazon.com/codepipeline/latest/userguide/action-reference.html) documentation.
+* `version` - (Required) A string that identifies the action type.
+* `configuration` - (Optional) A map of the action declaration's configuration. Configurations options for action types and providers can be found in the [Pipeline Structure Reference](http://docs.aws.amazon.com/codepipeline/latest/userguide/reference-pipeline-structure.html#action-requirements) and [Action Structure Reference](https://docs.aws.amazon.com/codepipeline/latest/userguide/action-reference.html) documentation.
+* `input_artifacts` - (Optional) A list of artifact names to be worked on.
+* `output_artifacts` - (Optional) A list of artifact names to output. Output artifact names must be unique within a pipeline.
+* `role_arn` - (Optional) The ARN of the IAM service role that will perform the declared action. This is assumed through the roleArn for the pipeline.
+* `run_order` - (Optional) The order in which actions are run.
+* `region` - (Optional) The region in which to run the action.
+* `namespace` - (Optional) The namespace all output variables will be accessed from.
+
+~> **Note:** The input artifact of an action must exactly match the output artifact declared in a preceding action, but the input artifact does not have to be the next action in strict sequence from the action that provided the output artifact. Actions in parallel can declare different output artifacts, which are in turn consumed by different following actions.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The codepipeline ID.
+* `arn` - The codepipeline ARN.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CodePipelines using the name. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import CodePipelines using the name. For example:
+
+```console
+% terraform import aws_codepipeline.foo example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-7564a4a21906390b235c7f254087ae49e059d302514c3158ce3d6d1c0c29ca5e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/codepipeline.markdown b/website/docs/cdktf/python/r/codepipeline.markdown
new file mode 100644
index 00000000000..7c0067e51b0
--- /dev/null
+++ b/website/docs/cdktf/python/r/codepipeline.markdown
@@ -0,0 +1,228 @@
+---
+subcategory: "CodePipeline"
+layout: "aws"
+page_title: "AWS: aws_codepipeline"
+description: |-
+  Provides a CodePipeline
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_codepipeline
+
+Provides a CodePipeline.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.codepipeline import Codepipeline
+from imports.aws.codestarconnections_connection import CodestarconnectionsConnection
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.data_aws_kms_alias import DataAwsKmsAlias
+from imports.aws.iam_role import IamRole
+from imports.aws.iam_role_policy import IamRolePolicy
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_acl import S3BucketAcl
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = CodestarconnectionsConnection(self, "example",
+            name="example-connection",
+            provider_type="GitHub"
+        )
+        codepipeline_bucket = S3Bucket(self, "codepipeline_bucket",
+            bucket="test-bucket"
+        )
+        S3BucketAcl(self, "codepipeline_bucket_acl",
+            acl="private",
+            bucket=codepipeline_bucket.id
+        )
+        assume_role = DataAwsIamPolicyDocument(self, "assume_role",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["sts:AssumeRole"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["codepipeline.amazonaws.com"],
+                    type="Service"
+                )
+                ]
+            )
+            ]
+        )
+        codepipeline_policy = DataAwsIamPolicyDocument(self, "codepipeline_policy",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["s3:GetObject", "s3:GetObjectVersion", "s3:GetBucketVersioning", "s3:PutObjectAcl", "s3:PutObject"
+                ],
+                effect="Allow",
+                resources=[codepipeline_bucket.arn, "${" + codepipeline_bucket.arn + "}/*"
+                ]
+            ), DataAwsIamPolicyDocumentStatement(
+                actions=["codestar-connections:UseConnection"],
+                effect="Allow",
+                resources=[example.arn]
+            ), DataAwsIamPolicyDocumentStatement(
+                actions=["codebuild:BatchGetBuilds", "codebuild:StartBuild"],
+                effect="Allow",
+                resources=["*"]
+            )
+            ]
+        )
+        s3_kmskey = DataAwsKmsAlias(self, "s3kmskey",
+            name="alias/myKmsKey"
+        )
+        codepipeline_role = IamRole(self, "codepipeline_role",
+            assume_role_policy=Token.as_string(assume_role.json),
+            name="test-role"
+        )
+        aws_iam_role_policy_codepipeline_policy = IamRolePolicy(self, "codepipeline_policy_7",
+            name="codepipeline_policy",
+            policy=Token.as_string(codepipeline_policy.json),
+            role=codepipeline_role.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_role_policy_codepipeline_policy.override_logical_id("codepipeline_policy")
+        Codepipeline(self, "codepipeline",
+            artifact_store=[CodepipelineArtifactStore(
+                encryption_key=CodepipelineArtifactStoreEncryptionKey(
+                    id=Token.as_string(s3_kmskey.arn),
+                    type="KMS"
+                ),
+                location=codepipeline_bucket.bucket,
+                type="S3"
+            )
+            ],
+            name="tf-test-pipeline",
+            role_arn=codepipeline_role.arn,
+            stage=[CodepipelineStage(
+                action=[CodepipelineStageAction(
+                    category="Source",
+                    configuration={
+                        "BranchName": "main",
+                        "ConnectionArn": example.arn,
+                        "FullRepositoryId": "my-organization/example"
+                    },
+                    name="Source",
+                    output_artifacts=["source_output"],
+                    owner="AWS",
+                    provider="CodeStarSourceConnection",
+                    version="1"
+                )
+                ],
+                name="Source"
+            ), CodepipelineStage(
+                action=[CodepipelineStageAction(
+                    category="Build",
+                    configuration={
+                        "ProjectName": "test"
+                    },
+                    input_artifacts=["source_output"],
+                    name="Build",
+                    output_artifacts=["build_output"],
+                    owner="AWS",
+                    provider="CodeBuild",
+                    version="1"
+                )
+                ],
+                name="Build"
+            ), CodepipelineStage(
+                action=[CodepipelineStageAction(
+                    category="Deploy",
+                    configuration={
+                        "ActionMode": "REPLACE_ON_FAILURE",
+                        "Capabilities": "CAPABILITY_AUTO_EXPAND,CAPABILITY_IAM",
+                        "OutputFileName": "CreateStackOutput.json",
+                        "StackName": "MyStack",
+                        "TemplatePath": "build_output::sam-templated.yaml"
+                    },
+                    input_artifacts=["build_output"],
+                    name="Deploy",
+                    owner="AWS",
+                    provider="CloudFormation",
+                    version="1"
+                )
+                ],
+                name="Deploy"
+            )
+            ]
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the pipeline.
+* `role_arn` - (Required) A service role Amazon Resource Name (ARN) that grants AWS CodePipeline permission to make calls to AWS services on your behalf.
+* `artifact_store` (Required) One or more artifact_store blocks. Artifact stores are documented below.
+* `stage` (Minimum of at least two `stage` blocks is required) A stage block. Stages are documented below.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+An `artifact_store` block supports the following arguments:
+
+* `location` - (Required) The location where AWS CodePipeline stores artifacts for a pipeline; currently only `S3` is supported.
+* `type` - (Required) The type of the artifact store, such as Amazon S3
+* `encryption_key` - (Optional) The encryption key block AWS CodePipeline uses to encrypt the data in the artifact store, such as an AWS Key Management Service (AWS KMS) key. If you don't specify a key, AWS CodePipeline uses the default key for Amazon Simple Storage Service (Amazon S3). An `encryption_key` block is documented below.
+* `region` - (Optional) The region where the artifact store is located. Required for a cross-region CodePipeline, do not provide for a single-region CodePipeline.
+
+An `encryption_key` block supports the following arguments:
+
+* `id` - (Required) The KMS key ARN or ID
+* `type` - (Required) The type of key; currently only `KMS` is supported
+
+A `stage` block supports the following arguments:
+
+* `name` - (Required) The name of the stage.
+* `action` - (Required) The action(s) to include in the stage. Defined as an `action` block below
+
+An `action` block supports the following arguments:
+
+* `category` - (Required) A category defines what kind of action can be taken in the stage, and constrains the provider type for the action. Possible values are `Approval`, `Build`, `Deploy`, `Invoke`, `Source` and `Test`.
+* `owner` - (Required) The creator of the action being called. Possible values are `AWS`, `Custom` and `ThirdParty`.
+* `name` - (Required) The action declaration's name.
+* `provider` - (Required) The provider of the service being called by the action. Valid providers are determined by the action category. Provider names are listed in the [Action Structure Reference](https://docs.aws.amazon.com/codepipeline/latest/userguide/action-reference.html) documentation.
+* `version` - (Required) A string that identifies the action type.
+* `configuration` - (Optional) A map of the action declaration's configuration. Configurations options for action types and providers can be found in the [Pipeline Structure Reference](http://docs.aws.amazon.com/codepipeline/latest/userguide/reference-pipeline-structure.html#action-requirements) and [Action Structure Reference](https://docs.aws.amazon.com/codepipeline/latest/userguide/action-reference.html) documentation.
+* `input_artifacts` - (Optional) A list of artifact names to be worked on.
+* `output_artifacts` - (Optional) A list of artifact names to output. Output artifact names must be unique within a pipeline.
+* `role_arn` - (Optional) The ARN of the IAM service role that will perform the declared action. This is assumed through the roleArn for the pipeline.
+* `run_order` - (Optional) The order in which actions are run.
+* `region` - (Optional) The region in which to run the action.
+* `namespace` - (Optional) The namespace all output variables will be accessed from.
+
+~> **Note:** The input artifact of an action must exactly match the output artifact declared in a preceding action, but the input artifact does not have to be the next action in strict sequence from the action that provided the output artifact. Actions in parallel can declare different output artifacts, which are in turn consumed by different following actions.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The codepipeline ID.
+* `arn` - The codepipeline ARN.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CodePipelines using the name. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import CodePipelines using the name. For example:
+
+```console
+% terraform import aws_codepipeline.foo example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-7564a4a21906390b235c7f254087ae49e059d302514c3158ce3d6d1c0c29ca5e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/codepipeline_custom_action_type.html.markdown b/website/docs/cdktf/python/r/codepipeline_custom_action_type.html.markdown
new file mode 100644
index 00000000000..d2e67c9904c
--- /dev/null
+++ b/website/docs/cdktf/python/r/codepipeline_custom_action_type.html.markdown
@@ -0,0 +1,116 @@
+---
+subcategory: "CodePipeline"
+layout: "aws"
+page_title: "AWS: aws_codepipeline_custom_action_type"
+description: |-
+  Provides a CodePipeline CustomActionType.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_codepipeline_custom_action_type
+
+Provides a CodeDeploy CustomActionType
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.codepipeline_custom_action_type import CodepipelineCustomActionType
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        CodepipelineCustomActionType(self, "example",
+            category="Build",
+            input_artifact_details=CodepipelineCustomActionTypeInputArtifactDetails(
+                maximum_count=1,
+                minimum_count=0
+            ),
+            output_artifact_details=CodepipelineCustomActionTypeOutputArtifactDetails(
+                maximum_count=1,
+                minimum_count=0
+            ),
+            provider_name="example",
+            version="1"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `category` - (Required) The category of the custom action. Valid values: `Source`, `Build`, `Deploy`, `Test`, `Invoke`, `Approval`
+* `configuration_property` - (Optional) The configuration properties for the custom action. Max 10 items.
+
+The `configuration_property` object supports the following:
+
+* `description` - (Optional) The description of the action configuration property.
+* `key` - (Required) Whether the configuration property is a key.
+* `name` - (Required) The name of the action configuration property.
+* `queryable` - (Optional) Indicates that the property will be used in conjunction with PollForJobs.
+* `required` - (Required) Whether the configuration property is a required value.
+* `secret`- (Required) Whether the configuration property is secret.
+* `type`- (Optional) The type of the configuration property. Valid values: `String`, `Number`, `Boolean`
+
+* `input_artifact_details` - (Required) The details of the input artifact for the action.
+
+The `input_artifact_details` object supports the following:
+
+* `maximum_count` - (Required) The maximum number of artifacts allowed for the action type. Min: 0, Max: 5
+* `minimum_count` - (Required) The minimum number of artifacts allowed for the action type. Min: 0, Max: 5
+
+* `output_artifact_details` - (Required) The details of the output artifact of the action.
+
+The `output_artifact_details` object supports the following:
+
+* `maximum_count` - (Required) The maximum number of artifacts allowed for the action type. Min: 0, Max: 5
+* `minimum_count` - (Required) The minimum number of artifacts allowed for the action type. Min: 0, Max: 5
+
+* `provider_name` - (Required) The provider of the service used in the custom action
+* `settings` - (Optional) The settings for an action type.
+
+The `settings` object supports the following:
+
+* `entity_url_template` - (Optional) The URL returned to the AWS CodePipeline console that provides a deep link to the resources of the external system.
+* `execution_url_template` - (Optional) The URL returned to the AWS CodePipeline console that contains a link to the top-level landing page for the external system.
+* `revision_url_template` - (Optional) The URL returned to the AWS CodePipeline console that contains a link to the page where customers can update or change the configuration of the external action.
+* `third_party_configuration_url` - (Optional) The URL of a sign-up page where users can sign up for an external service and perform initial configuration of the action provided by that service.
+
+* `tags` - (Optional) Map of tags to assign to this resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `version` - (Required) The version identifier of the custom action.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Composed of category, provider and version. For example, `Build:terraform:1`
+* `arn` - The action ARN.
+* `owner` - The creator of the action being called.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CodeDeploy CustomActionType using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import CodeDeploy CustomActionType using the `id`. For example:
+
+```console
+% terraform import aws_codepipeline_custom_action_type.example Build:terraform:1
+```
+
+<!-- cache-key: cdktf-0.18.0 input-618f4e853ef9774ea870455f957f72ac7ccbe371d784f81ae5996c728184b956 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/codepipeline_webhook.html.markdown b/website/docs/cdktf/python/r/codepipeline_webhook.html.markdown
new file mode 100644
index 00000000000..421afd09082
--- /dev/null
+++ b/website/docs/cdktf/python/r/codepipeline_webhook.html.markdown
@@ -0,0 +1,161 @@
+---
+subcategory: "CodePipeline"
+layout: "aws"
+page_title: "AWS: aws_codepipeline_webhook"
+description: |-
+  Provides a CodePipeline Webhook
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_codepipeline_webhook
+
+Provides a CodePipeline Webhook.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.codepipeline import Codepipeline
+from imports.aws.codepipeline_webhook import CodepipelineWebhook
+from imports.github.repository_webhook import RepositoryWebhook
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        # The following providers are missing schema information and might need manual adjustments to synthesize correctly: github.
+        #     For a more precise conversion please use the --provider flag in convert.
+        webhook_secret = "super-secret"
+        bar = Codepipeline(self, "bar",
+            artifact_store=[CodepipelineArtifactStore(
+                encryption_key=CodepipelineArtifactStoreEncryptionKey(
+                    id=Token.as_string(s3_kmskey.arn),
+                    type="KMS"
+                ),
+                location=Token.as_string(aws_s3_bucket_bar.bucket),
+                type="S3"
+            )
+            ],
+            name="tf-test-pipeline",
+            role_arn=Token.as_string(aws_iam_role_bar.arn),
+            stage=[CodepipelineStage(
+                action=[CodepipelineStageAction(
+                    category="Source",
+                    configuration={
+                        "Branch": "master",
+                        "Owner": "my-organization",
+                        "Repo": "test"
+                    },
+                    name="Source",
+                    output_artifacts=["test"],
+                    owner="ThirdParty",
+                    provider="GitHub",
+                    version="1"
+                )
+                ],
+                name="Source"
+            ), CodepipelineStage(
+                action=[CodepipelineStageAction(
+                    category="Build",
+                    configuration={
+                        "ProjectName": "test"
+                    },
+                    input_artifacts=["test"],
+                    name="Build",
+                    owner="AWS",
+                    provider="CodeBuild",
+                    version="1"
+                )
+                ],
+                name="Build"
+            )
+            ]
+        )
+        aws_codepipeline_webhook_bar = CodepipelineWebhook(self, "bar_1",
+            authentication="GITHUB_HMAC",
+            authentication_configuration=CodepipelineWebhookAuthenticationConfiguration(
+                secret_token=webhook_secret
+            ),
+            filter=[CodepipelineWebhookFilter(
+                json_path="$.ref",
+                match_equals="refs/heads/{Branch}"
+            )
+            ],
+            name="test-webhook-github-bar",
+            target_action="Source",
+            target_pipeline=bar.name
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_codepipeline_webhook_bar.override_logical_id("bar")
+        github_repository_webhook_bar = RepositoryWebhook(self, "bar_2",
+            configuration=[{
+                "content_type": "json",
+                "insecure_ssl": True,
+                "secret": webhook_secret,
+                "url": aws_codepipeline_webhook_bar.url
+            }
+            ],
+            events=["push"],
+            name="web",
+            repository=repo.name
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        github_repository_webhook_bar.override_logical_id("bar")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the webhook.
+* `authentication` - (Required) The type of authentication  to use. One of `IP`, `GITHUB_HMAC`, or `UNAUTHENTICATED`.
+* `authentication_configuration` - (Optional) An `auth` block. Required for `IP` and `GITHUB_HMAC`. Auth blocks are documented below.
+* `filter` (Required) One or more `filter` blocks. Filter blocks are documented below.
+* `target_action` - (Required) The name of the action in a pipeline you want to connect to the webhook. The action must be from the source (first) stage of the pipeline.
+* `target_pipeline` - (Required) The name of the pipeline.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+An `authentication_configuration` block supports the following arguments:
+
+* `secret_token` - (Optional) The shared secret for the GitHub repository webhook. Set this as `secret` in your `github_repository_webhook`'s `configuration` block. Required for `GITHUB_HMAC`.
+* `allowed_ip_range` - (Optional) A valid CIDR block for `IP` filtering. Required for `IP`.
+
+A `filter` block supports the following arguments:
+
+* `json_path` - (Required) The [JSON path](https://github.com/json-path/JsonPath) to filter on.
+* `match_equals` - (Required) The value to match on (e.g., `refs/heads/{Branch}`). See [AWS docs](https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_WebhookFilterRule.html) for details.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The CodePipeline webhook's ARN.
+* `id` - The CodePipeline webhook's ARN.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `url` - The CodePipeline webhook's URL. POST events to this endpoint to trigger the target.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CodePipeline Webhooks using their ARN. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import CodePipeline Webhooks using their ARN. For example:
+
+```console
+% terraform import aws_codepipeline_webhook.example arn:aws:codepipeline:us-west-2:123456789012:webhook:example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-12eddb2b0e3d8862aa33cfaab94c4516ce51690b35cba10b34567326ccde28ed -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/codepipeline_webhook.markdown b/website/docs/cdktf/python/r/codepipeline_webhook.markdown
new file mode 100644
index 00000000000..421afd09082
--- /dev/null
+++ b/website/docs/cdktf/python/r/codepipeline_webhook.markdown
@@ -0,0 +1,161 @@
+---
+subcategory: "CodePipeline"
+layout: "aws"
+page_title: "AWS: aws_codepipeline_webhook"
+description: |-
+  Provides a CodePipeline Webhook
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_codepipeline_webhook
+
+Provides a CodePipeline Webhook.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.codepipeline import Codepipeline
+from imports.aws.codepipeline_webhook import CodepipelineWebhook
+from imports.github.repository_webhook import RepositoryWebhook
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        # The following providers are missing schema information and might need manual adjustments to synthesize correctly: github.
+        #     For a more precise conversion please use the --provider flag in convert.
+        webhook_secret = "super-secret"
+        bar = Codepipeline(self, "bar",
+            artifact_store=[CodepipelineArtifactStore(
+                encryption_key=CodepipelineArtifactStoreEncryptionKey(
+                    id=Token.as_string(s3_kmskey.arn),
+                    type="KMS"
+                ),
+                location=Token.as_string(aws_s3_bucket_bar.bucket),
+                type="S3"
+            )
+            ],
+            name="tf-test-pipeline",
+            role_arn=Token.as_string(aws_iam_role_bar.arn),
+            stage=[CodepipelineStage(
+                action=[CodepipelineStageAction(
+                    category="Source",
+                    configuration={
+                        "Branch": "master",
+                        "Owner": "my-organization",
+                        "Repo": "test"
+                    },
+                    name="Source",
+                    output_artifacts=["test"],
+                    owner="ThirdParty",
+                    provider="GitHub",
+                    version="1"
+                )
+                ],
+                name="Source"
+            ), CodepipelineStage(
+                action=[CodepipelineStageAction(
+                    category="Build",
+                    configuration={
+                        "ProjectName": "test"
+                    },
+                    input_artifacts=["test"],
+                    name="Build",
+                    owner="AWS",
+                    provider="CodeBuild",
+                    version="1"
+                )
+                ],
+                name="Build"
+            )
+            ]
+        )
+        aws_codepipeline_webhook_bar = CodepipelineWebhook(self, "bar_1",
+            authentication="GITHUB_HMAC",
+            authentication_configuration=CodepipelineWebhookAuthenticationConfiguration(
+                secret_token=webhook_secret
+            ),
+            filter=[CodepipelineWebhookFilter(
+                json_path="$.ref",
+                match_equals="refs/heads/{Branch}"
+            )
+            ],
+            name="test-webhook-github-bar",
+            target_action="Source",
+            target_pipeline=bar.name
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_codepipeline_webhook_bar.override_logical_id("bar")
+        github_repository_webhook_bar = RepositoryWebhook(self, "bar_2",
+            configuration=[{
+                "content_type": "json",
+                "insecure_ssl": True,
+                "secret": webhook_secret,
+                "url": aws_codepipeline_webhook_bar.url
+            }
+            ],
+            events=["push"],
+            name="web",
+            repository=repo.name
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        github_repository_webhook_bar.override_logical_id("bar")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the webhook.
+* `authentication` - (Required) The type of authentication  to use. One of `IP`, `GITHUB_HMAC`, or `UNAUTHENTICATED`.
+* `authentication_configuration` - (Optional) An `auth` block. Required for `IP` and `GITHUB_HMAC`. Auth blocks are documented below.
+* `filter` (Required) One or more `filter` blocks. Filter blocks are documented below.
+* `target_action` - (Required) The name of the action in a pipeline you want to connect to the webhook. The action must be from the source (first) stage of the pipeline.
+* `target_pipeline` - (Required) The name of the pipeline.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+An `authentication_configuration` block supports the following arguments:
+
+* `secret_token` - (Optional) The shared secret for the GitHub repository webhook. Set this as `secret` in your `github_repository_webhook`'s `configuration` block. Required for `GITHUB_HMAC`.
+* `allowed_ip_range` - (Optional) A valid CIDR block for `IP` filtering. Required for `IP`.
+
+A `filter` block supports the following arguments:
+
+* `json_path` - (Required) The [JSON path](https://github.com/json-path/JsonPath) to filter on.
+* `match_equals` - (Required) The value to match on (e.g., `refs/heads/{Branch}`). See [AWS docs](https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_WebhookFilterRule.html) for details.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The CodePipeline webhook's ARN.
+* `id` - The CodePipeline webhook's ARN.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `url` - The CodePipeline webhook's URL. POST events to this endpoint to trigger the target.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CodePipeline Webhooks using their ARN. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import CodePipeline Webhooks using their ARN. For example:
+
+```console
+% terraform import aws_codepipeline_webhook.example arn:aws:codepipeline:us-west-2:123456789012:webhook:example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-12eddb2b0e3d8862aa33cfaab94c4516ce51690b35cba10b34567326ccde28ed -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/codestarconnections_connection.html.markdown b/website/docs/cdktf/python/r/codestarconnections_connection.html.markdown
new file mode 100644
index 00000000000..e9d265bae54
--- /dev/null
+++ b/website/docs/cdktf/python/r/codestarconnections_connection.html.markdown
@@ -0,0 +1,124 @@
+---
+subcategory: "CodeStar Connections"
+layout: "aws"
+page_title: "AWS: aws_codestarconnections_connection"
+description: |-
+  Provides a CodeStar Connection
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_codestarconnections_connection
+
+Provides a CodeStar Connection.
+
+~> **NOTE:** The `aws_codestarconnections_connection` resource is created in the state `PENDING`. Authentication with the connection provider must be completed in the AWS Console. See the [AWS documentation](https://docs.aws.amazon.com/dtconsole/latest/userguide/connections-update.html) for details.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.codepipeline import Codepipeline
+from imports.aws.codestarconnections_connection import CodestarconnectionsConnection
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, location, type, category, name, owner, provider, version, category1, name1, owner1, provider1, version1):
+        super().__init__(scope, name)
+        example = CodestarconnectionsConnection(self, "example",
+            name="example-connection",
+            provider_type="Bitbucket"
+        )
+        aws_codepipeline_example = Codepipeline(self, "example_1",
+            artifact_store=[CodepipelineArtifactStore(
+                location=location,
+                type=type
+            )
+            ],
+            name="tf-test-pipeline",
+            role_arn=codepipeline_role.arn,
+            stage=[CodepipelineStage(
+                action=[CodepipelineStageAction(
+                    category="Source",
+                    configuration={
+                        "BranchName": "main",
+                        "ConnectionArn": example.arn,
+                        "FullRepositoryId": "my-organization/test"
+                    },
+                    name="Source",
+                    output_artifacts=["source_output"],
+                    owner="AWS",
+                    provider="CodeStarSourceConnection",
+                    version="1"
+                )
+                ],
+                name="Source"
+            ), CodepipelineStage(
+                action=[CodepipelineStageAction(
+                    category=category,
+                    name=name,
+                    owner=owner,
+                    provider=provider,
+                    version=version
+                )
+                ],
+                name="Build"
+            ), CodepipelineStage(
+                action=[CodepipelineStageAction(
+                    category=category1,
+                    name=name1,
+                    owner=owner1,
+                    provider=provider1,
+                    version=version1
+                )
+                ],
+                name="Deploy"
+            )
+            ]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_codepipeline_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the connection to be created. The name must be unique in the calling AWS account. Changing `name` will create a new resource.
+* `provider_type` - (Optional) The name of the external provider where your third-party code repository is configured. Valid values are `Bitbucket`, `GitHub` or `GitHubEnterpriseServer`. Changing `provider_type` will create a new resource. Conflicts with `host_arn`
+* `host_arn` - (Optional) The Amazon Resource Name (ARN) of the host associated with the connection. Conflicts with `provider_type`
+* `tags` - (Optional) Map of key-value resource tags to associate with the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The codestar connection ARN.
+* `arn` - The codestar connection ARN.
+* `connection_status` - The codestar connection status. Possible values are `PENDING`, `AVAILABLE` and `ERROR`.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CodeStar connections using the ARN. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import CodeStar connections using the ARN. For example:
+
+```console
+% terraform import aws_codestarconnections_connection.test-connection arn:aws:codestar-connections:us-west-1:0123456789:connection/79d4d357-a2ee-41e4-b350-2fe39ae59448
+```
+
+<!-- cache-key: cdktf-0.18.0 input-cea28696e8a04ea0fb64e3b43f622ae20b1f905cc54be4b416fdf569f4bc9518 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/codestarconnections_connection.markdown b/website/docs/cdktf/python/r/codestarconnections_connection.markdown
new file mode 100644
index 00000000000..e9d265bae54
--- /dev/null
+++ b/website/docs/cdktf/python/r/codestarconnections_connection.markdown
@@ -0,0 +1,124 @@
+---
+subcategory: "CodeStar Connections"
+layout: "aws"
+page_title: "AWS: aws_codestarconnections_connection"
+description: |-
+  Provides a CodeStar Connection
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_codestarconnections_connection
+
+Provides a CodeStar Connection.
+
+~> **NOTE:** The `aws_codestarconnections_connection` resource is created in the state `PENDING`. Authentication with the connection provider must be completed in the AWS Console. See the [AWS documentation](https://docs.aws.amazon.com/dtconsole/latest/userguide/connections-update.html) for details.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.codepipeline import Codepipeline
+from imports.aws.codestarconnections_connection import CodestarconnectionsConnection
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, location, type, category, name, owner, provider, version, category1, name1, owner1, provider1, version1):
+        super().__init__(scope, name)
+        example = CodestarconnectionsConnection(self, "example",
+            name="example-connection",
+            provider_type="Bitbucket"
+        )
+        aws_codepipeline_example = Codepipeline(self, "example_1",
+            artifact_store=[CodepipelineArtifactStore(
+                location=location,
+                type=type
+            )
+            ],
+            name="tf-test-pipeline",
+            role_arn=codepipeline_role.arn,
+            stage=[CodepipelineStage(
+                action=[CodepipelineStageAction(
+                    category="Source",
+                    configuration={
+                        "BranchName": "main",
+                        "ConnectionArn": example.arn,
+                        "FullRepositoryId": "my-organization/test"
+                    },
+                    name="Source",
+                    output_artifacts=["source_output"],
+                    owner="AWS",
+                    provider="CodeStarSourceConnection",
+                    version="1"
+                )
+                ],
+                name="Source"
+            ), CodepipelineStage(
+                action=[CodepipelineStageAction(
+                    category=category,
+                    name=name,
+                    owner=owner,
+                    provider=provider,
+                    version=version
+                )
+                ],
+                name="Build"
+            ), CodepipelineStage(
+                action=[CodepipelineStageAction(
+                    category=category1,
+                    name=name1,
+                    owner=owner1,
+                    provider=provider1,
+                    version=version1
+                )
+                ],
+                name="Deploy"
+            )
+            ]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_codepipeline_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the connection to be created. The name must be unique in the calling AWS account. Changing `name` will create a new resource.
+* `provider_type` - (Optional) The name of the external provider where your third-party code repository is configured. Valid values are `Bitbucket`, `GitHub` or `GitHubEnterpriseServer`. Changing `provider_type` will create a new resource. Conflicts with `host_arn`
+* `host_arn` - (Optional) The Amazon Resource Name (ARN) of the host associated with the connection. Conflicts with `provider_type`
+* `tags` - (Optional) Map of key-value resource tags to associate with the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The codestar connection ARN.
+* `arn` - The codestar connection ARN.
+* `connection_status` - The codestar connection status. Possible values are `PENDING`, `AVAILABLE` and `ERROR`.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CodeStar connections using the ARN. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import CodeStar connections using the ARN. For example:
+
+```console
+% terraform import aws_codestarconnections_connection.test-connection arn:aws:codestar-connections:us-west-1:0123456789:connection/79d4d357-a2ee-41e4-b350-2fe39ae59448
+```
+
+<!-- cache-key: cdktf-0.18.0 input-cea28696e8a04ea0fb64e3b43f622ae20b1f905cc54be4b416fdf569f4bc9518 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/codestarconnections_host.html.markdown b/website/docs/cdktf/python/r/codestarconnections_host.html.markdown
new file mode 100644
index 00000000000..ba66cf8914b
--- /dev/null
+++ b/website/docs/cdktf/python/r/codestarconnections_host.html.markdown
@@ -0,0 +1,81 @@
+---
+subcategory: "CodeStar Connections"
+layout: "aws"
+page_title: "AWS: aws_codestarconnections_host"
+description: |-
+  Provides a CodeStar Host
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_codestarconnections_host
+
+Provides a CodeStar Host.
+
+~> **NOTE:** The `aws_codestarconnections_host` resource is created in the state `PENDING`. Authentication with the host provider must be completed in the AWS Console. For more information visit [Set up a pending host](https://docs.aws.amazon.com/dtconsole/latest/userguide/connections-host-setup.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.codestarconnections_host import CodestarconnectionsHost
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        CodestarconnectionsHost(self, "example",
+            name="example-host",
+            provider_endpoint="https://example.com",
+            provider_type="GitHubEnterpriseServer"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the host to be created. The name must be unique in the calling AWS account.
+* `provider_endpoint` - (Required) The endpoint of the infrastructure to be represented by the host after it is created.
+* `provider_type` - (Required) The name of the external provider where your third-party code repository is configured.
+* `vpc_configuration` - (Optional) The VPC configuration to be provisioned for the host. A VPC must be configured, and the infrastructure to be represented by the host must already be connected to the VPC.
+
+A `vpc_configuration` block supports the following arguments:
+
+* `security_group_ids` - (Required) ID of the security group or security groups associated with the Amazon VPC connected to the infrastructure where your provider type is installed.
+* `subnet_ids` - (Required) The ID of the subnet or subnets associated with the Amazon VPC connected to the infrastructure where your provider type is installed.
+* `tls_certificate` - (Optional) The value of the Transport Layer Security (TLS) certificate associated with the infrastructure where your provider type is installed.
+* `vpc_id` - (Required) The ID of the Amazon VPC connected to the infrastructure where your provider type is installed.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The CodeStar Host ARN.
+* `arn` - The CodeStar Host ARN.
+* `status` - The CodeStar Host status. Possible values are `PENDING`, `AVAILABLE`, `VPC_CONFIG_DELETING`, `VPC_CONFIG_INITIALIZING`, and `VPC_CONFIG_FAILED_INITIALIZATION`.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CodeStar Host using the ARN. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import CodeStar Host using the ARN. For example:
+
+```console
+% terraform import aws_codestarconnections_host.example-host arn:aws:codestar-connections:us-west-1:0123456789:host/79d4d357-a2ee-41e4-b350-2fe39ae59448
+```
+
+<!-- cache-key: cdktf-0.18.0 input-deb204f04b1d3b40e9230a8529e261bf3e35a0ba36cd5b092788c3a247d424f1 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/codestarconnections_host.markdown b/website/docs/cdktf/python/r/codestarconnections_host.markdown
new file mode 100644
index 00000000000..ba66cf8914b
--- /dev/null
+++ b/website/docs/cdktf/python/r/codestarconnections_host.markdown
@@ -0,0 +1,81 @@
+---
+subcategory: "CodeStar Connections"
+layout: "aws"
+page_title: "AWS: aws_codestarconnections_host"
+description: |-
+  Provides a CodeStar Host
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_codestarconnections_host
+
+Provides a CodeStar Host.
+
+~> **NOTE:** The `aws_codestarconnections_host` resource is created in the state `PENDING`. Authentication with the host provider must be completed in the AWS Console. For more information visit [Set up a pending host](https://docs.aws.amazon.com/dtconsole/latest/userguide/connections-host-setup.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.codestarconnections_host import CodestarconnectionsHost
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        CodestarconnectionsHost(self, "example",
+            name="example-host",
+            provider_endpoint="https://example.com",
+            provider_type="GitHubEnterpriseServer"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the host to be created. The name must be unique in the calling AWS account.
+* `provider_endpoint` - (Required) The endpoint of the infrastructure to be represented by the host after it is created.
+* `provider_type` - (Required) The name of the external provider where your third-party code repository is configured.
+* `vpc_configuration` - (Optional) The VPC configuration to be provisioned for the host. A VPC must be configured, and the infrastructure to be represented by the host must already be connected to the VPC.
+
+A `vpc_configuration` block supports the following arguments:
+
+* `security_group_ids` - (Required) ID of the security group or security groups associated with the Amazon VPC connected to the infrastructure where your provider type is installed.
+* `subnet_ids` - (Required) The ID of the subnet or subnets associated with the Amazon VPC connected to the infrastructure where your provider type is installed.
+* `tls_certificate` - (Optional) The value of the Transport Layer Security (TLS) certificate associated with the infrastructure where your provider type is installed.
+* `vpc_id` - (Required) The ID of the Amazon VPC connected to the infrastructure where your provider type is installed.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The CodeStar Host ARN.
+* `arn` - The CodeStar Host ARN.
+* `status` - The CodeStar Host status. Possible values are `PENDING`, `AVAILABLE`, `VPC_CONFIG_DELETING`, `VPC_CONFIG_INITIALIZING`, and `VPC_CONFIG_FAILED_INITIALIZATION`.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CodeStar Host using the ARN. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import CodeStar Host using the ARN. For example:
+
+```console
+% terraform import aws_codestarconnections_host.example-host arn:aws:codestar-connections:us-west-1:0123456789:host/79d4d357-a2ee-41e4-b350-2fe39ae59448
+```
+
+<!-- cache-key: cdktf-0.18.0 input-deb204f04b1d3b40e9230a8529e261bf3e35a0ba36cd5b092788c3a247d424f1 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/codestarnotifications_notification_rule.html.markdown b/website/docs/cdktf/python/r/codestarnotifications_notification_rule.html.markdown
new file mode 100644
index 00000000000..18734cf4a5a
--- /dev/null
+++ b/website/docs/cdktf/python/r/codestarnotifications_notification_rule.html.markdown
@@ -0,0 +1,112 @@
+---
+subcategory: "CodeStar Notifications"
+layout: "aws"
+page_title: "AWS: aws_codestarnotifications_notification_rule"
+description: |-
+  Provides a CodeStar Notifications Rule
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_codestarnotifications_notification_rule
+
+Provides a CodeStar Notifications Rule.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.codecommit_repository import CodecommitRepository
+from imports.aws.codestarnotifications_notification_rule import CodestarnotificationsNotificationRule
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.sns_topic import SnsTopic
+from imports.aws.sns_topic_policy import SnsTopicPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        code = CodecommitRepository(self, "code",
+            repository_name="example-code-repo"
+        )
+        notif = SnsTopic(self, "notif",
+            name="notification"
+        )
+        notif_access = DataAwsIamPolicyDocument(self, "notif_access",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["sns:Publish"],
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["codestar-notifications.amazonaws.com"],
+                    type="Service"
+                )
+                ],
+                resources=[notif.arn]
+            )
+            ]
+        )
+        CodestarnotificationsNotificationRule(self, "commits",
+            detail_type="BASIC",
+            event_type_ids=["codecommit-repository-comments-on-commits"],
+            name="example-code-repo-commits",
+            resource=code.arn,
+            target=[CodestarnotificationsNotificationRuleTarget(
+                address=notif.arn
+            )
+            ]
+        )
+        SnsTopicPolicy(self, "default",
+            arn=notif.arn,
+            policy=Token.as_string(notif_access.json)
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `detail_type` - (Required) The level of detail to include in the notifications for this resource. Possible values are `BASIC` and `FULL`.
+* `event_type_ids` - (Required) A list of event types associated with this notification rule.
+  For list of allowed events see [here](https://docs.aws.amazon.com/codestar-notifications/latest/userguide/concepts.html#concepts-api).
+* `name` - (Required) The name of notification rule.
+* `resource` - (Required) The ARN of the resource to associate with the notification rule.
+* `status` - (Optional) The status of the notification rule. Possible values are `ENABLED` and `DISABLED`, default is `ENABLED`.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `target` - (Optional) Configuration blocks containing notification target information. Can be specified multiple times. At least one target must be specified on creation.
+
+An `target` block supports the following arguments:
+
+* `address` - (Required) The ARN of notification rule target. For example, a SNS Topic ARN.
+* `type` - (Optional) The type of the notification target. Default value is `SNS`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The codestar notification rule ARN.
+* `arn` - The codestar notification rule ARN.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CodeStar notification rule using the ARN. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import CodeStar notification rule using the ARN. For example:
+
+```console
+% terraform import aws_codestarnotifications_notification_rule.foo arn:aws:codestar-notifications:us-west-1:0123456789:notificationrule/2cdc68a3-8f7c-4893-b6a5-45b362bd4f2b
+```
+
+<!-- cache-key: cdktf-0.18.0 input-4e53883c7fac8ce18f0f284d8670fbec11d282232b37f3e8c5d77110845632ed -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/codestarnotifications_notification_rule.markdown b/website/docs/cdktf/python/r/codestarnotifications_notification_rule.markdown
new file mode 100644
index 00000000000..18734cf4a5a
--- /dev/null
+++ b/website/docs/cdktf/python/r/codestarnotifications_notification_rule.markdown
@@ -0,0 +1,112 @@
+---
+subcategory: "CodeStar Notifications"
+layout: "aws"
+page_title: "AWS: aws_codestarnotifications_notification_rule"
+description: |-
+  Provides a CodeStar Notifications Rule
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_codestarnotifications_notification_rule
+
+Provides a CodeStar Notifications Rule.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.codecommit_repository import CodecommitRepository
+from imports.aws.codestarnotifications_notification_rule import CodestarnotificationsNotificationRule
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.sns_topic import SnsTopic
+from imports.aws.sns_topic_policy import SnsTopicPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        code = CodecommitRepository(self, "code",
+            repository_name="example-code-repo"
+        )
+        notif = SnsTopic(self, "notif",
+            name="notification"
+        )
+        notif_access = DataAwsIamPolicyDocument(self, "notif_access",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["sns:Publish"],
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["codestar-notifications.amazonaws.com"],
+                    type="Service"
+                )
+                ],
+                resources=[notif.arn]
+            )
+            ]
+        )
+        CodestarnotificationsNotificationRule(self, "commits",
+            detail_type="BASIC",
+            event_type_ids=["codecommit-repository-comments-on-commits"],
+            name="example-code-repo-commits",
+            resource=code.arn,
+            target=[CodestarnotificationsNotificationRuleTarget(
+                address=notif.arn
+            )
+            ]
+        )
+        SnsTopicPolicy(self, "default",
+            arn=notif.arn,
+            policy=Token.as_string(notif_access.json)
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `detail_type` - (Required) The level of detail to include in the notifications for this resource. Possible values are `BASIC` and `FULL`.
+* `event_type_ids` - (Required) A list of event types associated with this notification rule.
+  For list of allowed events see [here](https://docs.aws.amazon.com/codestar-notifications/latest/userguide/concepts.html#concepts-api).
+* `name` - (Required) The name of notification rule.
+* `resource` - (Required) The ARN of the resource to associate with the notification rule.
+* `status` - (Optional) The status of the notification rule. Possible values are `ENABLED` and `DISABLED`, default is `ENABLED`.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `target` - (Optional) Configuration blocks containing notification target information. Can be specified multiple times. At least one target must be specified on creation.
+
+An `target` block supports the following arguments:
+
+* `address` - (Required) The ARN of notification rule target. For example, a SNS Topic ARN.
+* `type` - (Optional) The type of the notification target. Default value is `SNS`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The codestar notification rule ARN.
+* `arn` - The codestar notification rule ARN.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CodeStar notification rule using the ARN. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import CodeStar notification rule using the ARN. For example:
+
+```console
+% terraform import aws_codestarnotifications_notification_rule.foo arn:aws:codestar-notifications:us-west-1:0123456789:notificationrule/2cdc68a3-8f7c-4893-b6a5-45b362bd4f2b
+```
+
+<!-- cache-key: cdktf-0.18.0 input-4e53883c7fac8ce18f0f284d8670fbec11d282232b37f3e8c5d77110845632ed -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/cognito_identity_pool.html.markdown b/website/docs/cdktf/python/r/cognito_identity_pool.html.markdown
new file mode 100644
index 00000000000..6fdcf920f59
--- /dev/null
+++ b/website/docs/cdktf/python/r/cognito_identity_pool.html.markdown
@@ -0,0 +1,106 @@
+---
+subcategory: "Cognito Identity"
+layout: "aws"
+page_title: "AWS: aws_cognito_identity_pool"
+description: |-
+  Provides an AWS Cognito Identity Pool.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cognito_identity_pool
+
+Provides an AWS Cognito Identity Pool.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cognito_identity_pool import CognitoIdentityPool
+from imports.aws.iam_saml_provider import IamSamlProvider
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        default_var = IamSamlProvider(self, "default",
+            name="my-saml-provider",
+            saml_metadata_document=Token.as_string(Fn.file("saml-metadata.xml"))
+        )
+        CognitoIdentityPool(self, "main",
+            allow_classic_flow=False,
+            allow_unauthenticated_identities=False,
+            cognito_identity_providers=[CognitoIdentityPoolCognitoIdentityProviders(
+                client_id="6lhlkkfbfb4q5kpp90urffae",
+                provider_name="cognito-idp.us-east-1.amazonaws.com/us-east-1_Tv0493apJ",
+                server_side_token_check=False
+            ), CognitoIdentityPoolCognitoIdentityProviders(
+                client_id="7kodkvfqfb4qfkp39eurffae",
+                provider_name="cognito-idp.us-east-1.amazonaws.com/eu-west-1_Zr231apJu",
+                server_side_token_check=False
+            )
+            ],
+            identity_pool_name="identity pool",
+            openid_connect_provider_arns=["arn:aws:iam::123456789012:oidc-provider/id.example.com"
+            ],
+            saml_provider_arns=[default_var.arn],
+            supported_login_providers={
+                "accounts.google.com": "123456789012.apps.googleusercontent.com",
+                "graph.facebook.com": "7346241598935552"
+            }
+        )
+```
+
+## Argument Reference
+
+The Cognito Identity Pool argument layout is a structure composed of several sub-resources - these resources are laid out below.
+
+* `identity_pool_name` (Required) - The Cognito Identity Pool name.
+* `allow_unauthenticated_identities` (Required) - Whether the identity pool supports unauthenticated logins or not.
+* `allow_classic_flow` (Optional) - Enables or disables the classic / basic authentication flow. Default is `false`.
+* `developer_provider_name` (Optional) - The "domain" by which Cognito will refer to your users. This name acts as a placeholder that allows your
+backend and the Cognito service to communicate about the developer provider.
+* `cognito_identity_providers` (Optional) - An array of [Amazon Cognito Identity user pools](#cognito-identity-providers) and their client IDs.
+* `openid_connect_provider_arns` (Optional) - Set of OpendID Connect provider ARNs.
+* `saml_provider_arns` (Optional) - An array of Amazon Resource Names (ARNs) of the SAML provider for your identity.
+* `supported_login_providers` (Optional) - Key-Value pairs mapping provider names to provider app IDs.
+* `tags` - (Optional) A map of tags to assign to the Identity Pool. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+#### Cognito Identity Providers
+
+* `client_id` (Optional) - The client ID for the Amazon Cognito Identity User Pool.
+* `provider_name` (Optional) - The provider name for an Amazon Cognito Identity User Pool.
+* `server_side_token_check` (Optional) - Whether server-side token validation is enabled for the identity provider’s token or not.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - An identity pool ID, e.g. `us-west-2:1a234567-8901-234b-5cde-f6789g01h2i3`.
+* `arn` - The ARN of the identity pool.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Cognito Identity Pool using its ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Cognito Identity Pool using its ID. For example:
+
+```console
+% terraform import aws_cognito_identity_pool.mypool us-west-2:1a234567-8901-234b-5cde-f6789g01h2i3
+```
+
+<!-- cache-key: cdktf-0.18.0 input-6cea6e360281bc475ea8b2d012b8c1df933a00c36975d5e9256c0c0610277b76 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/cognito_identity_pool.markdown b/website/docs/cdktf/python/r/cognito_identity_pool.markdown
new file mode 100644
index 00000000000..6fdcf920f59
--- /dev/null
+++ b/website/docs/cdktf/python/r/cognito_identity_pool.markdown
@@ -0,0 +1,106 @@
+---
+subcategory: "Cognito Identity"
+layout: "aws"
+page_title: "AWS: aws_cognito_identity_pool"
+description: |-
+  Provides an AWS Cognito Identity Pool.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cognito_identity_pool
+
+Provides an AWS Cognito Identity Pool.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cognito_identity_pool import CognitoIdentityPool
+from imports.aws.iam_saml_provider import IamSamlProvider
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        default_var = IamSamlProvider(self, "default",
+            name="my-saml-provider",
+            saml_metadata_document=Token.as_string(Fn.file("saml-metadata.xml"))
+        )
+        CognitoIdentityPool(self, "main",
+            allow_classic_flow=False,
+            allow_unauthenticated_identities=False,
+            cognito_identity_providers=[CognitoIdentityPoolCognitoIdentityProviders(
+                client_id="6lhlkkfbfb4q5kpp90urffae",
+                provider_name="cognito-idp.us-east-1.amazonaws.com/us-east-1_Tv0493apJ",
+                server_side_token_check=False
+            ), CognitoIdentityPoolCognitoIdentityProviders(
+                client_id="7kodkvfqfb4qfkp39eurffae",
+                provider_name="cognito-idp.us-east-1.amazonaws.com/eu-west-1_Zr231apJu",
+                server_side_token_check=False
+            )
+            ],
+            identity_pool_name="identity pool",
+            openid_connect_provider_arns=["arn:aws:iam::123456789012:oidc-provider/id.example.com"
+            ],
+            saml_provider_arns=[default_var.arn],
+            supported_login_providers={
+                "accounts.google.com": "123456789012.apps.googleusercontent.com",
+                "graph.facebook.com": "7346241598935552"
+            }
+        )
+```
+
+## Argument Reference
+
+The Cognito Identity Pool argument layout is a structure composed of several sub-resources - these resources are laid out below.
+
+* `identity_pool_name` (Required) - The Cognito Identity Pool name.
+* `allow_unauthenticated_identities` (Required) - Whether the identity pool supports unauthenticated logins or not.
+* `allow_classic_flow` (Optional) - Enables or disables the classic / basic authentication flow. Default is `false`.
+* `developer_provider_name` (Optional) - The "domain" by which Cognito will refer to your users. This name acts as a placeholder that allows your
+backend and the Cognito service to communicate about the developer provider.
+* `cognito_identity_providers` (Optional) - An array of [Amazon Cognito Identity user pools](#cognito-identity-providers) and their client IDs.
+* `openid_connect_provider_arns` (Optional) - Set of OpendID Connect provider ARNs.
+* `saml_provider_arns` (Optional) - An array of Amazon Resource Names (ARNs) of the SAML provider for your identity.
+* `supported_login_providers` (Optional) - Key-Value pairs mapping provider names to provider app IDs.
+* `tags` - (Optional) A map of tags to assign to the Identity Pool. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+#### Cognito Identity Providers
+
+* `client_id` (Optional) - The client ID for the Amazon Cognito Identity User Pool.
+* `provider_name` (Optional) - The provider name for an Amazon Cognito Identity User Pool.
+* `server_side_token_check` (Optional) - Whether server-side token validation is enabled for the identity provider’s token or not.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - An identity pool ID, e.g. `us-west-2:1a234567-8901-234b-5cde-f6789g01h2i3`.
+* `arn` - The ARN of the identity pool.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Cognito Identity Pool using its ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Cognito Identity Pool using its ID. For example:
+
+```console
+% terraform import aws_cognito_identity_pool.mypool us-west-2:1a234567-8901-234b-5cde-f6789g01h2i3
+```
+
+<!-- cache-key: cdktf-0.18.0 input-6cea6e360281bc475ea8b2d012b8c1df933a00c36975d5e9256c0c0610277b76 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/cognito_identity_pool_provider_principal_tag.html.markdown b/website/docs/cdktf/python/r/cognito_identity_pool_provider_principal_tag.html.markdown
new file mode 100644
index 00000000000..d9526f024cd
--- /dev/null
+++ b/website/docs/cdktf/python/r/cognito_identity_pool_provider_principal_tag.html.markdown
@@ -0,0 +1,101 @@
+---
+subcategory: "Cognito Identity"
+layout: "aws"
+page_title: "AWS: aws_cognito_identity_pool_provider_principal_tag"
+description: |-
+  Provides an AWS Cognito Identity Principal Mapping.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cognito_identity_pool_provider_principal_tag
+
+Provides an AWS Cognito Identity Principal Mapping.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cognito_identity_pool import CognitoIdentityPool
+from imports.aws.cognito_identity_pool_provider_principal_tag import CognitoIdentityPoolProviderPrincipalTag
+from imports.aws.cognito_user_pool import CognitoUserPool
+from imports.aws.cognito_user_pool_client import CognitoUserPoolClient
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = CognitoUserPool(self, "example",
+            auto_verified_attributes=["email"],
+            name="user pool"
+        )
+        aws_cognito_user_pool_client_example = CognitoUserPoolClient(self, "example_1",
+            name="client",
+            supported_identity_providers=Token.as_list(
+                Fn.compact(Token.as_list(["COGNITO"]))),
+            user_pool_id=example.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_cognito_user_pool_client_example.override_logical_id("example")
+        aws_cognito_identity_pool_example = CognitoIdentityPool(self, "example_2",
+            allow_unauthenticated_identities=False,
+            cognito_identity_providers=[CognitoIdentityPoolCognitoIdentityProviders(
+                client_id=Token.as_string(aws_cognito_user_pool_client_example.id),
+                provider_name=example.endpoint,
+                server_side_token_check=False
+            )
+            ],
+            identity_pool_name="identity pool"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_cognito_identity_pool_example.override_logical_id("example")
+        aws_cognito_identity_pool_provider_principal_tag_example =
+        CognitoIdentityPoolProviderPrincipalTag(self, "example_3",
+            identity_pool_id=Token.as_string(aws_cognito_identity_pool_example.id),
+            identity_provider_name=example.endpoint,
+            principal_tags={
+                "test": "value"
+            },
+            use_defaults=False
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_cognito_identity_pool_provider_principal_tag_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `identity_pool_id` (Required) - An identity pool ID.
+* `identity_provider_name` (Required) - The name of the identity provider.
+* `principal_tags`: (Optional: []) - String to string map of variables.
+* `use_defaults`: (Optional: true) use default (username and clientID) attribute mappings.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Cognito Identity Pool Roles Attachment using the Identity Pool ID and provider name. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Cognito Identity Pool Roles Attachment using the Identity Pool ID and provider name. For example:
+
+```console
+% terraform import aws_cognito_identity_pool_provider_principal_tag.example us-west-2_abc123:CorpAD
+```
+
+<!-- cache-key: cdktf-0.18.0 input-d4f777a31b91b31ab50e67859396a09149b958fe813bebf15e96c5dcc295d8be -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/cognito_identity_pool_provider_principal_tag.markdown b/website/docs/cdktf/python/r/cognito_identity_pool_provider_principal_tag.markdown
new file mode 100644
index 00000000000..d9526f024cd
--- /dev/null
+++ b/website/docs/cdktf/python/r/cognito_identity_pool_provider_principal_tag.markdown
@@ -0,0 +1,101 @@
+---
+subcategory: "Cognito Identity"
+layout: "aws"
+page_title: "AWS: aws_cognito_identity_pool_provider_principal_tag"
+description: |-
+  Provides an AWS Cognito Identity Principal Mapping.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cognito_identity_pool_provider_principal_tag
+
+Provides an AWS Cognito Identity Principal Mapping.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cognito_identity_pool import CognitoIdentityPool
+from imports.aws.cognito_identity_pool_provider_principal_tag import CognitoIdentityPoolProviderPrincipalTag
+from imports.aws.cognito_user_pool import CognitoUserPool
+from imports.aws.cognito_user_pool_client import CognitoUserPoolClient
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = CognitoUserPool(self, "example",
+            auto_verified_attributes=["email"],
+            name="user pool"
+        )
+        aws_cognito_user_pool_client_example = CognitoUserPoolClient(self, "example_1",
+            name="client",
+            supported_identity_providers=Token.as_list(
+                Fn.compact(Token.as_list(["COGNITO"]))),
+            user_pool_id=example.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_cognito_user_pool_client_example.override_logical_id("example")
+        aws_cognito_identity_pool_example = CognitoIdentityPool(self, "example_2",
+            allow_unauthenticated_identities=False,
+            cognito_identity_providers=[CognitoIdentityPoolCognitoIdentityProviders(
+                client_id=Token.as_string(aws_cognito_user_pool_client_example.id),
+                provider_name=example.endpoint,
+                server_side_token_check=False
+            )
+            ],
+            identity_pool_name="identity pool"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_cognito_identity_pool_example.override_logical_id("example")
+        aws_cognito_identity_pool_provider_principal_tag_example =
+        CognitoIdentityPoolProviderPrincipalTag(self, "example_3",
+            identity_pool_id=Token.as_string(aws_cognito_identity_pool_example.id),
+            identity_provider_name=example.endpoint,
+            principal_tags={
+                "test": "value"
+            },
+            use_defaults=False
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_cognito_identity_pool_provider_principal_tag_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `identity_pool_id` (Required) - An identity pool ID.
+* `identity_provider_name` (Required) - The name of the identity provider.
+* `principal_tags`: (Optional: []) - String to string map of variables.
+* `use_defaults`: (Optional: true) use default (username and clientID) attribute mappings.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Cognito Identity Pool Roles Attachment using the Identity Pool ID and provider name. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Cognito Identity Pool Roles Attachment using the Identity Pool ID and provider name. For example:
+
+```console
+% terraform import aws_cognito_identity_pool_provider_principal_tag.example us-west-2_abc123:CorpAD
+```
+
+<!-- cache-key: cdktf-0.18.0 input-d4f777a31b91b31ab50e67859396a09149b958fe813bebf15e96c5dcc295d8be -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/cognito_identity_pool_roles_attachment.html.markdown b/website/docs/cdktf/python/r/cognito_identity_pool_roles_attachment.html.markdown
new file mode 100644
index 00000000000..3e374dba665
--- /dev/null
+++ b/website/docs/cdktf/python/r/cognito_identity_pool_roles_attachment.html.markdown
@@ -0,0 +1,155 @@
+---
+subcategory: "Cognito Identity"
+layout: "aws"
+page_title: "AWS: aws_cognito_identity_pool_roles_attachment"
+description: |-
+  Provides an AWS Cognito Identity Pool Roles Attachment.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cognito_identity_pool_roles_attachment
+
+Provides an AWS Cognito Identity Pool Roles Attachment.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cognito_identity_pool import CognitoIdentityPool
+from imports.aws.cognito_identity_pool_roles_attachment import CognitoIdentityPoolRolesAttachment
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.iam_role import IamRole
+from imports.aws.iam_role_policy import IamRolePolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        main = CognitoIdentityPool(self, "main",
+            allow_unauthenticated_identities=False,
+            identity_pool_name="identity pool",
+            supported_login_providers={
+                "graph.facebook.com": "7346241598935555"
+            }
+        )
+        authenticated = DataAwsIamPolicyDocument(self, "authenticated",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["sts:AssumeRoleWithWebIdentity"],
+                condition=[DataAwsIamPolicyDocumentStatementCondition(
+                    test="StringEquals",
+                    values=[main.id],
+                    variable="cognito-identity.amazonaws.com:aud"
+                ), DataAwsIamPolicyDocumentStatementCondition(
+                    test="ForAnyValue:StringLike",
+                    values=["authenticated"],
+                    variable="cognito-identity.amazonaws.com:amr"
+                )
+                ],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["cognito-identity.amazonaws.com"],
+                    type="Federated"
+                )
+                ]
+            )
+            ]
+        )
+        authenticated_role_policy = DataAwsIamPolicyDocument(self, "authenticated_role_policy",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["mobileanalytics:PutEvents", "cognito-sync:*", "cognito-identity:*"
+                ],
+                effect="Allow",
+                resources=["*"]
+            )
+            ]
+        )
+        aws_iam_role_authenticated = IamRole(self, "authenticated_3",
+            assume_role_policy=Token.as_string(authenticated.json),
+            name="cognito_authenticated"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_role_authenticated.override_logical_id("authenticated")
+        aws_iam_role_policy_authenticated = IamRolePolicy(self, "authenticated_4",
+            name="authenticated_policy",
+            policy=Token.as_string(authenticated_role_policy.json),
+            role=Token.as_string(aws_iam_role_authenticated.id)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_role_policy_authenticated.override_logical_id("authenticated")
+        aws_cognito_identity_pool_roles_attachment_main =
+        CognitoIdentityPoolRolesAttachment(self, "main_5",
+            identity_pool_id=main.id,
+            role_mapping=[CognitoIdentityPoolRolesAttachmentRoleMapping(
+                ambiguous_role_resolution="AuthenticatedRole",
+                identity_provider="graph.facebook.com",
+                mapping_rule=[CognitoIdentityPoolRolesAttachmentRoleMappingMappingRule(
+                    claim="isAdmin",
+                    match_type="Equals",
+                    role_arn=Token.as_string(aws_iam_role_authenticated.arn),
+                    value="paid"
+                )
+                ],
+                type="Rules"
+            )
+            ],
+            roles={
+                "authenticated": Token.as_string(aws_iam_role_authenticated.arn)
+            }
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_cognito_identity_pool_roles_attachment_main.override_logical_id("main")
+```
+
+## Argument Reference
+
+The Cognito Identity Pool Roles Attachment argument layout is a structure composed of several sub-resources - these resources are laid out below.
+
+* `identity_pool_id` (Required) - An identity pool ID in the format `REGION_GUID`.
+* `role_mapping` (Optional) - A List of [Role Mapping](#role-mappings).
+* `roles` (Required) - The map of roles associated with this pool. For a given role, the key will be either "authenticated" or "unauthenticated" and the value will be the Role ARN.
+
+#### Role Mappings
+
+* `identity_provider` (Required) - A string identifying the identity provider, for example, "graph.facebook.com" or "cognito-idp.us-east-1.amazonaws.com/us-east-1_abcdefghi:app_client_id". Depends on `cognito_identity_providers` set on `aws_cognito_identity_pool` resource or a `aws_cognito_identity_provider` resource.
+* `ambiguous_role_resolution` (Optional) - Specifies the action to be taken if either no rules match the claim value for the Rules type, or there is no cognito:preferred_role claim and there are multiple cognito:roles matches for the Token type. `Required` if you specify Token or Rules as the Type.
+* `mapping_rule` (Optional) - The [Rules Configuration](#rules-configuration) to be used for mapping users to roles. You can specify up to 25 rules per identity provider. Rules are evaluated in order. The first one to match specifies the role.
+* `type` (Required) - The role mapping type.
+
+#### Rules Configuration
+
+* `claim` (Required) - The claim name that must be present in the token, for example, "isAdmin" or "paid".
+* `match_type` (Required) - The match condition that specifies how closely the claim value in the IdP token must match Value.
+* `role_arn` (Required) - The role ARN.
+* `value` (Required) - A brief string that the claim must match, for example, "paid" or "yes".
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The identity pool ID.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Cognito Identity Pool Roles Attachment using the Identity Pool ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Cognito Identity Pool Roles Attachment using the Identity Pool ID. For example:
+
+```console
+% terraform import aws_cognito_identity_pool_roles_attachment.example us-west-2:b64805ad-cb56-40ba-9ffc-f5d8207e6d42
+```
+
+<!-- cache-key: cdktf-0.18.0 input-74c6734db32e60310fb7b71d1ef7e57fff3eb57e2065822e5e2535d8f77e6646 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/cognito_identity_pool_roles_attachment.markdown b/website/docs/cdktf/python/r/cognito_identity_pool_roles_attachment.markdown
new file mode 100644
index 00000000000..3e374dba665
--- /dev/null
+++ b/website/docs/cdktf/python/r/cognito_identity_pool_roles_attachment.markdown
@@ -0,0 +1,155 @@
+---
+subcategory: "Cognito Identity"
+layout: "aws"
+page_title: "AWS: aws_cognito_identity_pool_roles_attachment"
+description: |-
+  Provides an AWS Cognito Identity Pool Roles Attachment.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cognito_identity_pool_roles_attachment
+
+Provides an AWS Cognito Identity Pool Roles Attachment.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cognito_identity_pool import CognitoIdentityPool
+from imports.aws.cognito_identity_pool_roles_attachment import CognitoIdentityPoolRolesAttachment
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.iam_role import IamRole
+from imports.aws.iam_role_policy import IamRolePolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        main = CognitoIdentityPool(self, "main",
+            allow_unauthenticated_identities=False,
+            identity_pool_name="identity pool",
+            supported_login_providers={
+                "graph.facebook.com": "7346241598935555"
+            }
+        )
+        authenticated = DataAwsIamPolicyDocument(self, "authenticated",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["sts:AssumeRoleWithWebIdentity"],
+                condition=[DataAwsIamPolicyDocumentStatementCondition(
+                    test="StringEquals",
+                    values=[main.id],
+                    variable="cognito-identity.amazonaws.com:aud"
+                ), DataAwsIamPolicyDocumentStatementCondition(
+                    test="ForAnyValue:StringLike",
+                    values=["authenticated"],
+                    variable="cognito-identity.amazonaws.com:amr"
+                )
+                ],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["cognito-identity.amazonaws.com"],
+                    type="Federated"
+                )
+                ]
+            )
+            ]
+        )
+        authenticated_role_policy = DataAwsIamPolicyDocument(self, "authenticated_role_policy",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["mobileanalytics:PutEvents", "cognito-sync:*", "cognito-identity:*"
+                ],
+                effect="Allow",
+                resources=["*"]
+            )
+            ]
+        )
+        aws_iam_role_authenticated = IamRole(self, "authenticated_3",
+            assume_role_policy=Token.as_string(authenticated.json),
+            name="cognito_authenticated"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_role_authenticated.override_logical_id("authenticated")
+        aws_iam_role_policy_authenticated = IamRolePolicy(self, "authenticated_4",
+            name="authenticated_policy",
+            policy=Token.as_string(authenticated_role_policy.json),
+            role=Token.as_string(aws_iam_role_authenticated.id)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_role_policy_authenticated.override_logical_id("authenticated")
+        aws_cognito_identity_pool_roles_attachment_main =
+        CognitoIdentityPoolRolesAttachment(self, "main_5",
+            identity_pool_id=main.id,
+            role_mapping=[CognitoIdentityPoolRolesAttachmentRoleMapping(
+                ambiguous_role_resolution="AuthenticatedRole",
+                identity_provider="graph.facebook.com",
+                mapping_rule=[CognitoIdentityPoolRolesAttachmentRoleMappingMappingRule(
+                    claim="isAdmin",
+                    match_type="Equals",
+                    role_arn=Token.as_string(aws_iam_role_authenticated.arn),
+                    value="paid"
+                )
+                ],
+                type="Rules"
+            )
+            ],
+            roles={
+                "authenticated": Token.as_string(aws_iam_role_authenticated.arn)
+            }
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_cognito_identity_pool_roles_attachment_main.override_logical_id("main")
+```
+
+## Argument Reference
+
+The Cognito Identity Pool Roles Attachment argument layout is a structure composed of several sub-resources - these resources are laid out below.
+
+* `identity_pool_id` (Required) - An identity pool ID in the format `REGION_GUID`.
+* `role_mapping` (Optional) - A List of [Role Mapping](#role-mappings).
+* `roles` (Required) - The map of roles associated with this pool. For a given role, the key will be either "authenticated" or "unauthenticated" and the value will be the Role ARN.
+
+#### Role Mappings
+
+* `identity_provider` (Required) - A string identifying the identity provider, for example, "graph.facebook.com" or "cognito-idp.us-east-1.amazonaws.com/us-east-1_abcdefghi:app_client_id". Depends on `cognito_identity_providers` set on `aws_cognito_identity_pool` resource or a `aws_cognito_identity_provider` resource.
+* `ambiguous_role_resolution` (Optional) - Specifies the action to be taken if either no rules match the claim value for the Rules type, or there is no cognito:preferred_role claim and there are multiple cognito:roles matches for the Token type. `Required` if you specify Token or Rules as the Type.
+* `mapping_rule` (Optional) - The [Rules Configuration](#rules-configuration) to be used for mapping users to roles. You can specify up to 25 rules per identity provider. Rules are evaluated in order. The first one to match specifies the role.
+* `type` (Required) - The role mapping type.
+
+#### Rules Configuration
+
+* `claim` (Required) - The claim name that must be present in the token, for example, "isAdmin" or "paid".
+* `match_type` (Required) - The match condition that specifies how closely the claim value in the IdP token must match Value.
+* `role_arn` (Required) - The role ARN.
+* `value` (Required) - A brief string that the claim must match, for example, "paid" or "yes".
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The identity pool ID.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Cognito Identity Pool Roles Attachment using the Identity Pool ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Cognito Identity Pool Roles Attachment using the Identity Pool ID. For example:
+
+```console
+% terraform import aws_cognito_identity_pool_roles_attachment.example us-west-2:b64805ad-cb56-40ba-9ffc-f5d8207e6d42
+```
+
+<!-- cache-key: cdktf-0.18.0 input-74c6734db32e60310fb7b71d1ef7e57fff3eb57e2065822e5e2535d8f77e6646 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/cognito_identity_provider.html.markdown b/website/docs/cdktf/python/r/cognito_identity_provider.html.markdown
new file mode 100644
index 00000000000..9f668116750
--- /dev/null
+++ b/website/docs/cdktf/python/r/cognito_identity_provider.html.markdown
@@ -0,0 +1,85 @@
+---
+subcategory: "Cognito IDP (Identity Provider)"
+layout: "aws"
+page_title: "AWS: aws_cognito_identity_provider"
+side_bar_current: "docs-aws-resource-cognito-identity-provider"
+description: |-
+  Provides a Cognito User Identity Provider resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cognito_identity_provider
+
+Provides a Cognito User Identity Provider resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cognito_identity_provider import CognitoIdentityProvider
+from imports.aws.cognito_user_pool import CognitoUserPool
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = CognitoUserPool(self, "example",
+            auto_verified_attributes=["email"],
+            name="example-pool"
+        )
+        CognitoIdentityProvider(self, "example_provider",
+            attribute_mapping={
+                "email": "email",
+                "username": "sub"
+            },
+            provider_details={
+                "authorize_scopes": "email",
+                "client_id": "your client_id",
+                "client_secret": "your client_secret"
+            },
+            provider_name="Google",
+            provider_type="Google",
+            user_pool_id=example.id
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `user_pool_id` (Required) - The user pool id
+* `provider_name` (Required) - The provider name
+* `provider_type` (Required) - The provider type.  [See AWS API for valid values](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_CreateIdentityProvider.html#CognitoUserPools-CreateIdentityProvider-request-ProviderType)
+* `attribute_mapping` (Optional) - The map of attribute mapping of user pool attributes. [AttributeMapping in AWS API documentation](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_CreateIdentityProvider.html#CognitoUserPools-CreateIdentityProvider-request-AttributeMapping)
+* `idp_identifiers` (Optional) - The list of identity providers.
+* `provider_details` (Optional) - The map of identity details, such as access token
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_cognito_identity_provider` resources using their User Pool ID and Provider Name. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_cognito_identity_provider` resources using their User Pool ID and Provider Name. For example:
+
+```console
+% terraform import aws_cognito_identity_provider.example us-west-2_abc123:CorpAD
+```
+
+<!-- cache-key: cdktf-0.18.0 input-6efb87c639b5fd6ebfce1d4da9543ffcb04eb147b8e55d66726d206815799eac -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/cognito_managed_user_pool_client.html.markdown b/website/docs/cdktf/python/r/cognito_managed_user_pool_client.html.markdown
new file mode 100644
index 00000000000..c25ff324609
--- /dev/null
+++ b/website/docs/cdktf/python/r/cognito_managed_user_pool_client.html.markdown
@@ -0,0 +1,186 @@
+---
+subcategory: "Cognito IDP (Identity Provider)"
+layout: "aws"
+page_title: "AWS: aws_cognito_managed_user_pool_client"
+description: |-
+  Use the `aws_cognito_user_pool_client` resource to manage a Cognito User Pool Client. This resource is created by another service.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cognito_managed_user_pool_client
+
+Use the `aws_cognito_user_pool_client` resource to manage a Cognito User Pool Client.
+
+**This resource is advanced** and has special caveats to consider before use. Please read this document completely before using the resource.
+
+Use the `aws_cognito_managed_user_pool_client` resource to manage a Cognito User Pool Client that is automatically created by an AWS service. For instance, when [configuring an OpenSearch Domain to use Cognito authentication](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/cognito-auth.html), the OpenSearch service creates the User Pool Client during setup and removes it when it is no longer required. As a result, the `aws_cognito_managed_user_pool_client` resource does not create or delete this resource, but instead assumes management of it.
+
+Use the [`aws_cognito_user_pool_client`](cognito_user_pool_client.html) resource to manage Cognito User Pool Clients for normal use cases.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from cdktf import TerraformResourceLifecycle
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cognito_identity_pool import CognitoIdentityPool
+from imports.aws.cognito_managed_user_pool_client import CognitoManagedUserPoolClient
+from imports.aws.cognito_user_pool import CognitoUserPool
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.data_aws_partition import DataAwsPartition
+from imports.aws.iam_role import IamRole
+from imports.aws.iam_role_policy_attachment import IamRolePolicyAttachment
+from imports.aws.opensearch_domain import OpensearchDomain
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = CognitoIdentityPool(self, "example",
+            identity_pool_name="example",
+            lifecycle=TerraformResourceLifecycle(
+                ignore_changes=[cognito_identity_providers]
+            )
+        )
+        aws_cognito_user_pool_example = CognitoUserPool(self, "example_1",
+            name="example"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_cognito_user_pool_example.override_logical_id("example")
+        current = DataAwsPartition(self, "current")
+        data_aws_iam_policy_document_example = DataAwsIamPolicyDocument(self, "example_3",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["sts:AssumeRole"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["es.${" + current.dns_suffix + "}"],
+                    type="Service"
+                )
+                ],
+                sid=""
+            )
+            ]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_iam_policy_document_example.override_logical_id("example")
+        aws_iam_role_example = IamRole(self, "example_4",
+            assume_role_policy=Token.as_string(data_aws_iam_policy_document_example.json),
+            name="example-role",
+            path="/service-role/"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_role_example.override_logical_id("example")
+        aws_iam_role_policy_attachment_example = IamRolePolicyAttachment(self, "example_5",
+            policy_arn="arn:${" + current.partition + "}:iam::aws:policy/AmazonESCognitoAccess",
+            role=Token.as_string(aws_iam_role_example.name)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_role_policy_attachment_example.override_logical_id("example")
+        aws_opensearch_domain_example = OpensearchDomain(self, "example_6",
+            cognito_options=OpensearchDomainCognitoOptions(
+                enabled=True,
+                identity_pool_id=example.id,
+                role_arn=Token.as_string(aws_iam_role_example.arn),
+                user_pool_id=Token.as_string(aws_cognito_user_pool_example.id)
+            ),
+            depends_on=[aws_cognito_user_pool_domain_example, aws_iam_role_policy_attachment_example
+            ],
+            domain_name="example",
+            ebs_options=OpensearchDomainEbsOptions(
+                ebs_enabled=True,
+                volume_size=10
+            )
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_opensearch_domain_example.override_logical_id("example")
+        aws_cognito_managed_user_pool_client_example =
+        CognitoManagedUserPoolClient(self, "example_7",
+            depends_on=[aws_opensearch_domain_example],
+            name_prefix="AmazonOpenSearchService-example",
+            user_pool_id=Token.as_string(aws_cognito_user_pool_example.id)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_cognito_managed_user_pool_client_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `user_pool_id` - (Required) User pool that the client belongs to.
+* `name_pattern` - (Required, one of `name_pattern` or `name_prefix`) Regular expression that matches the name of the desired User Pool Client. It must only match one User Pool Client.
+* `name_prefix` - (Required, one of `name_prefix` or `name_pattern`) String that matches the beginning of the name of the desired User Pool Client. It must match only one User Pool Client.
+
+The following arguments are optional:
+
+* `access_token_validity` - (Optional) Time limit, between 5 minutes and 1 day, after which the access token is no longer valid and cannot be used. By default, the unit is hours. The unit can be overridden by a value in `token_validity_units.access_token`.
+* `allowed_oauth_flows_user_pool_client` - (Optional) Whether the client is allowed to use the OAuth protocol when interacting with Cognito user pools.
+* `allowed_oauth_flows` - (Optional) List of allowed OAuth flows, including code, implicit, and client_credentials.
+* `allowed_oauth_scopes` - (Optional) List of allowed OAuth scopes, including phone, email, openid, profile, and aws.cognito.signin.user.admin.
+* `analytics_configuration` - (Optional) Configuration block for Amazon Pinpoint analytics that collects metrics for this user pool. See [details below](#analytics_configuration).
+* `auth_session_validity` - (Optional) Duration, in minutes, of the session token created by Amazon Cognito for each API request in an authentication flow. The session token must be responded to by the native user of the user pool before it expires. Valid values for `auth_session_validity` are between `3` and `15`, with a default value of `3`.
+* `callback_urls` - (Optional) List of allowed callback URLs for the identity providers.
+* `default_redirect_uri` - (Optional) Default redirect URI and must be included in the list of callback URLs.
+* `enable_token_revocation` - (Optional) Enables or disables token revocation.
+* `enable_propagate_additional_user_context_data` - (Optional) Enables the propagation of additional user context data.
+* `explicit_auth_flows` - (Optional) List of authentication flows. The available options include ADMIN_NO_SRP_AUTH, CUSTOM_AUTH_FLOW_ONLY, USER_PASSWORD_AUTH, ALLOW_ADMIN_USER_PASSWORD_AUTH, ALLOW_CUSTOM_AUTH, ALLOW_USER_PASSWORD_AUTH, ALLOW_USER_SRP_AUTH, and ALLOW_REFRESH_TOKEN_AUTH.
+* `generate_secret` - (Optional) Boolean flag indicating whether an application secret should be generated.
+* `id_token_validity` - (Optional) Time limit, between 5 minutes and 1 day, after which the ID token is no longer valid and cannot be used. By default, the unit is hours. The unit can be overridden by a value in `token_validity_units.id_token`.
+* `logout_urls` - (Optional) List of allowed logout URLs for the identity providers.
+* `prevent_user_existence_errors` - (Optional) Setting determines the errors and responses returned by Cognito APIs when a user does not exist in the user pool during authentication, account confirmation, and password recovery.
+* `read_attributes` - (Optional) List of user pool attributes that the application client can read from.
+* `refresh_token_validity` - (Optional) Time limit, between 60 minutes and 10 years, after which the refresh token is no longer valid and cannot be used. By default, the unit is days. The unit can be overridden by a value in `token_validity_units.refresh_token`.
+* `supported_identity_providers` - (Optional) List of provider names for the identity providers that are supported on this client. It uses the `provider_name` attribute of the `aws_cognito_identity_provider` resource(s), or the equivalent string(s).
+* `token_validity_units` - (Optional) Configuration block for representing the validity times in units. See details below. [Detailed below](#token_validity_units).
+* `write_attributes` - (Optional) List of user pool attributes that the application client can write to.
+
+### analytics_configuration
+
+Either `application_arn` or `application_id` is required for this configuration block.
+
+* `application_arn` - (Optional) Application ARN for an Amazon Pinpoint application. It conflicts with `external_id` and `role_arn`.
+* `application_id` - (Optional) Unique identifier for an Amazon Pinpoint application.
+* `external_id` - (Optional) ID for the Analytics Configuration and conflicts with `application_arn`.
+* `role_arn` - (Optional) ARN of an IAM role that authorizes Amazon Cognito to publish events to Amazon Pinpoint analytics. It conflicts with `application_arn`.
+* `user_data_shared` - (Optional) If `user_data_shared` is set to `true`, Amazon Cognito will include user data in the events it publishes to Amazon Pinpoint analytics.
+
+### token_validity_units
+
+Valid values for the following arguments are: `seconds`, `minutes`, `hours`, or `days`.
+
+* `access_token` - (Optional) Time unit for the value in `access_token_validity` and defaults to `hours`.
+* `id_token` - (Optional) Time unit for the value in `id_token_validity`, and it defaults to `hours`.
+* `refresh_token` - (Optional) Time unit for the value in `refresh_token_validity` and defaults to `days`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `client_secret` - Client secret of the user pool client.
+* `id` - Unique identifier for the user pool client.
+* `name` - Name of the user pool client.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Cognito User Pool Clients using the `id` of the Cognito User Pool and the `id` of the Cognito User Pool Client. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Cognito User Pool Clients using the `id` of the Cognito User Pool and the `id` of the Cognito User Pool Client. For example:
+
+```console
+% terraform import aws_cognito_managed_user_pool_client.client us-west-2_abc123/3ho4ek12345678909nh3fmhpko
+```
+
+<!-- cache-key: cdktf-0.18.0 input-09a5545a9b1f170005d5b45885469f05e619194057d0005875513587b0db3def -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/cognito_resource_server.html.markdown b/website/docs/cdktf/python/r/cognito_resource_server.html.markdown
new file mode 100644
index 00000000000..ef9dcdb8263
--- /dev/null
+++ b/website/docs/cdktf/python/r/cognito_resource_server.html.markdown
@@ -0,0 +1,111 @@
+---
+subcategory: "Cognito IDP (Identity Provider)"
+layout: "aws"
+page_title: "AWS: aws_cognito_resource_server"
+side_bar_current: "docs-aws-resource-cognito-resource-server"
+description: |-
+  Provides a Cognito Resource Server.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cognito_resource_server
+
+Provides a Cognito Resource Server.
+
+## Example Usage
+
+### Create a basic resource server
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cognito_resource_server import CognitoResourceServer
+from imports.aws.cognito_user_pool import CognitoUserPool
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        pool = CognitoUserPool(self, "pool",
+            name="pool"
+        )
+        CognitoResourceServer(self, "resource",
+            identifier="https://example.com",
+            name="example",
+            user_pool_id=pool.id
+        )
+```
+
+### Create a resource server with sample-scope
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cognito_resource_server import CognitoResourceServer
+from imports.aws.cognito_user_pool import CognitoUserPool
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        pool = CognitoUserPool(self, "pool",
+            name="pool"
+        )
+        CognitoResourceServer(self, "resource",
+            identifier="https://example.com",
+            name="example",
+            scope=[CognitoResourceServerScope(
+                scope_description="a Sample Scope Description",
+                scope_name="sample-scope"
+            )
+            ],
+            user_pool_id=pool.id
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `identifier` - (Required) An identifier for the resource server.
+* `name` - (Required) A name for the resource server.
+* `scope` - (Optional) A list of [Authorization Scope](#authorization-scope).
+
+### Authorization Scope
+
+* `scope_name` - (Required) The scope name.
+* `scope_description` - (Required) The scope description.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `scope_identifiers` - A list of all scopes configured for this resource server in the format identifier/scope_name.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_cognito_resource_server` using their User Pool ID and Identifier. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_cognito_resource_server` using their User Pool ID and Identifier. For example:
+
+```console
+% terraform import aws_cognito_resource_server.example "us-west-2_abc123|https://example.com"
+```
+
+<!-- cache-key: cdktf-0.18.0 input-de46a7a41e5a457b2e40bf3acab26f989ff8b0291a8fbbdd80d28397469c06a7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/cognito_risk_configuration.html.markdown b/website/docs/cdktf/python/r/cognito_risk_configuration.html.markdown
new file mode 100644
index 00000000000..99f932a73f6
--- /dev/null
+++ b/website/docs/cdktf/python/r/cognito_risk_configuration.html.markdown
@@ -0,0 +1,142 @@
+---
+subcategory: "Cognito IDP (Identity Provider)"
+layout: "aws"
+page_title: "AWS: aws_cognito_risk_configuration"
+description: |-
+  Provides a Cognito Risk Configuration resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cognito_risk_configuration
+
+Provides a Cognito Risk Configuration resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cognito_risk_configuration import CognitoRiskConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        CognitoRiskConfiguration(self, "example",
+            risk_exception_configuration=CognitoRiskConfigurationRiskExceptionConfiguration(
+                blocked_ip_range_list=["10.10.10.10/32"]
+            ),
+            user_pool_id=Token.as_string(aws_cognito_user_pool_example.id)
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `user_pool_id` - (Required) The user pool ID.
+* `client_id` - (Optional) The app client ID. When the client ID is not provided, the same risk configuration is applied to all the clients in the User Pool.
+* `account_takeover_risk_configuration` - (Optional) The account takeover risk configuration. See details below.
+* `compromised_credentials_risk_configuration` - (Optional) The compromised credentials risk configuration. See details below.
+* `risk_exception_configuration` - (Optional) The configuration to override the risk decision. See details below.
+
+### account_takeover_risk_configuration
+
+* `notify_configuration` - (Required) The notify configuration used to construct email notifications. See details below.
+* `actions` - (Required) Account takeover risk configuration actions. See details below.
+
+#### notify_configuration
+
+* `block_email` - (Optional) Email template used when a detected risk event is blocked. See notify email type below.
+* `mfa_email` - (Optional) The multi-factor authentication (MFA) email template used when MFA is challenged as part of a detected risk. See notify email type below.
+* `no_action_email` - (Optional) The email template used when a detected risk event is allowed. See notify email type below.
+* `from` - (Optional) The email address that is sending the email. The address must be either individually verified with Amazon Simple Email Service, or from a domain that has been verified with Amazon SES.
+* `reply_to` - (Optional) The destination to which the receiver of an email should reply to.
+* `source_arn` - (Required) The Amazon Resource Name (ARN) of the identity that is associated with the sending authorization policy. This identity permits Amazon Cognito to send for the email address specified in the From parameter.
+
+##### notify email type
+
+* `html_body` - (Required) The email HTML body.
+* `subject` - (Required) The email subject.
+* `text_body` - (Required) The email text body.
+
+#### actions
+
+* `high_action` - (Optional) Action to take for a high risk. See action block below.
+* `low_action` - (Optional) Action to take for a low risk. See action block below.
+* `medium_action` - (Optional) Action to take for a medium risk. See action block below.
+
+##### action
+
+* `event_action` - (Required) The action to take in response to the account takeover action. Valid values are `BLOCK`, `MFA_IF_CONFIGURED`, `MFA_REQUIRED` and `NO_ACTION`.
+* `notify` - (Required) Whether to send a notification.
+
+### compromised_credentials_risk_configuration
+
+* `event_filter` - (Optional) Perform the action for these events. The default is to perform all events if no event filter is specified. Valid values are `SIGN_IN`, `PASSWORD_CHANGE`, and `SIGN_UP`.
+* `actions` - (Required) The compromised credentials risk configuration actions. See details below.
+
+#### actions
+
+* `event_action` - (Optional) The event action. Valid values are `BLOCK` or `NO_ACTION`.
+
+### risk_exception_configuration
+
+* `blocked_ip_range_list` - (Optional) Overrides the risk decision to always block the pre-authentication requests.
+  The IP range is in CIDR notation, a compact representation of an IP address and its routing prefix.
+  Can contain a maximum of 200 items.
+* `skipped_ip_range_list` - (Optional) Risk detection isn't performed on the IP addresses in this range list.
+  The IP range is in CIDR notation.
+  Can contain a maximum of 200 items.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The user pool ID or the user pool ID and Client Id separated by a `:` if the configuration is client specific.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Cognito Risk Configurations using the user pool ID or the user pool ID and Client Id separated by a `:`. For example:
+
+Import using the user pool ID:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Import using the user pool ID and Client ID separated by a `:`:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+**Using `terraform import` to import** Cognito Risk Configurations using the user pool ID or the user pool ID and Client Id separated by a `:`. For example:
+
+Import using the user pool ID:
+
+```console
+% terraform import aws_cognito_risk_configuration.main example
+```
+
+Import using the user pool ID and Client ID separated by a `:`:
+
+```console
+% terraform import aws_cognito_risk_configuration.main example:example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-b75593cc575d1cd95ecde1a9b1a8a4e0bd77767201715d4f626c2fa0398eed4b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/cognito_user.html.markdown b/website/docs/cdktf/python/r/cognito_user.html.markdown
new file mode 100644
index 00000000000..0fd93ea1200
--- /dev/null
+++ b/website/docs/cdktf/python/r/cognito_user.html.markdown
@@ -0,0 +1,138 @@
+---
+subcategory: "Cognito IDP (Identity Provider)"
+layout: "aws"
+page_title: "AWS: aws_cognito_user"
+description: |-
+  Provides a Cognito User resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cognito_user
+
+Provides a Cognito User Resource.
+
+## Example Usage
+
+### Basic configuration
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cognito_user import CognitoUser
+from imports.aws.cognito_user_pool import CognitoUserPool
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = CognitoUserPool(self, "example",
+            name="MyExamplePool"
+        )
+        aws_cognito_user_example = CognitoUser(self, "example_1",
+            user_pool_id=example.id,
+            username="example"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_cognito_user_example.override_logical_id("example")
+```
+
+### Setting user attributes
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cognito_user import CognitoUser
+from imports.aws.cognito_user_pool import CognitoUserPool
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = CognitoUserPool(self, "example",
+            name="mypool",
+            schema=[CognitoUserPoolSchema(
+                attribute_data_type="Boolean",
+                developer_only_attribute=False,
+                mutable=False,
+                name="terraform",
+                required=False
+            ), CognitoUserPoolSchema(
+                attribute_data_type="String",
+                developer_only_attribute=False,
+                mutable=False,
+                name="foo",
+                required=False,
+                string_attribute_constraints=CognitoUserPoolSchemaStringAttributeConstraints()
+            )
+            ]
+        )
+        aws_cognito_user_example = CognitoUser(self, "example_1",
+            attributes={
+                "email": "no-reply@hashicorp.com",
+                "email_verified": Token.as_string(True),
+                "foo": "bar",
+                "terraform": Token.as_string(True)
+            },
+            user_pool_id=example.id,
+            username="example"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_cognito_user_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `user_pool_id` - (Required) The user pool ID for the user pool where the user will be created.
+* `username` - (Required) The username for the user. Must be unique within the user pool. Must be a UTF-8 string between 1 and 128 characters. After the user is created, the username cannot be changed.
+
+The following arguments are optional:
+
+* `attributes` - (Optional) A map that contains user attributes and attribute values to be set for the user.
+* `client_metadata` - (Optional) A map of custom key-value pairs that you can provide as input for any custom workflows that user creation triggers. Amazon Cognito does not store the `client_metadata` value. This data is available only to Lambda triggers that are assigned to a user pool to support custom workflows. If your user pool configuration does not include triggers, the ClientMetadata parameter serves no purpose. For more information, see [Customizing User Pool Workflows with Lambda Triggers](https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-identity-pools-working-with-aws-lambda-triggers.html).
+* `desired_delivery_mediums` - (Optional) A list of mediums to the welcome message will be sent through. Allowed values are `EMAIL` and `SMS`. If it's provided, make sure you have also specified `email` attribute for the `EMAIL` medium and `phone_number` for the `SMS`. More than one value can be specified. Amazon Cognito does not store the `desired_delivery_mediums` value. Defaults to `["SMS"]`.
+* `enabled` - (Optional) Specifies whether the user should be enabled after creation. The welcome message will be sent regardless of the `enabled` value. The behavior can be changed with `message_action` argument. Defaults to `true`.
+* `force_alias_creation` - (Optional) If this parameter is set to True and the `phone_number` or `email` address specified in the `attributes` parameter already exists as an alias with a different user, Amazon Cognito will migrate the alias from the previous user to the newly created user. The previous user will no longer be able to log in using that alias. Amazon Cognito does not store the `force_alias_creation` value. Defaults to `false`.
+* `message_action` - (Optional) Set to `RESEND` to resend the invitation message to a user that already exists and reset the expiration limit on the user's account. Set to `SUPPRESS` to suppress sending the message. Only one value can be specified. Amazon Cognito does not store the `message_action` value.
+* `password` - (Optional) The user's permanent password. This password must conform to the password policy specified by user pool the user belongs to. The welcome message always contains only `temporary_password` value. You can suppress sending the welcome message with the `message_action` argument. Amazon Cognito does not store the `password` value. Conflicts with `temporary_password`.
+* `temporary_password` - (Optional) The user's temporary password. Conflicts with `password`.
+* `validation_data` - (Optional) The user's validation data. This is an array of name-value pairs that contain user attributes and attribute values that you can use for custom validation, such as restricting the types of user accounts that can be registered. Amazon Cognito does not store the `validation_data` value. For more information, see [Customizing User Pool Workflows with Lambda Triggers](https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-identity-pools-working-with-aws-lambda-triggers.html).
+
+~> **NOTE:** Clearing `password` or `temporary_password` does not reset user's password in Cognito.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `status` - current user status.
+* `sub` - unique user id that is never reassignable to another user.
+* `mfa_preference` - user's settings regarding MFA settings and preferences.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Cognito User using the `user_pool_id`/`name` attributes concatenated. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Cognito User using the `user_pool_id`/`name` attributes concatenated. For example:
+
+```console
+% terraform import aws_cognito_user.user us-east-1_vG78M4goG/user
+```
+
+<!-- cache-key: cdktf-0.18.0 input-b603092428c63c12332d47bff8ea434c3f148dcd1ba3a4fb846409da827bc678 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/cognito_user_group.html.markdown b/website/docs/cdktf/python/r/cognito_user_group.html.markdown
new file mode 100644
index 00000000000..7dd07c55eb9
--- /dev/null
+++ b/website/docs/cdktf/python/r/cognito_user_group.html.markdown
@@ -0,0 +1,107 @@
+---
+subcategory: "Cognito IDP (Identity Provider)"
+layout: "aws"
+page_title: "AWS: aws_cognito_user_group"
+description: |-
+  Provides a Cognito User Group resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cognito_user_group
+
+Provides a Cognito User Group resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cognito_user_group import CognitoUserGroup
+from imports.aws.cognito_user_pool import CognitoUserPool
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.iam_role import IamRole
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        main = CognitoUserPool(self, "main",
+            name="identity pool"
+        )
+        group_role = DataAwsIamPolicyDocument(self, "group_role",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["sts:AssumeRoleWithWebIdentity"],
+                condition=[DataAwsIamPolicyDocumentStatementCondition(
+                    test="StringEquals",
+                    values=["us-east-1:12345678-dead-beef-cafe-123456790ab"],
+                    variable="cognito-identity.amazonaws.com:aud"
+                ), DataAwsIamPolicyDocumentStatementCondition(
+                    test="ForAnyValue:StringLike",
+                    values=["authenticated"],
+                    variable="cognito-identity.amazonaws.com:amr"
+                )
+                ],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["cognito-identity.amazonaws.com"],
+                    type="Federated"
+                )
+                ]
+            )
+            ]
+        )
+        aws_iam_role_group_role = IamRole(self, "group_role_2",
+            assume_role_policy=Token.as_string(group_role.json),
+            name="user-group-role"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_role_group_role.override_logical_id("group_role")
+        aws_cognito_user_group_main = CognitoUserGroup(self, "main_3",
+            description="Managed by Terraform",
+            name="user-group",
+            precedence=42,
+            role_arn=Token.as_string(aws_iam_role_group_role.arn),
+            user_pool_id=main.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_cognito_user_group_main.override_logical_id("main")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the user group.
+* `user_pool_id` - (Required) The user pool ID.
+* `description` - (Optional) The description of the user group.
+* `precedence` - (Optional) The precedence of the user group.
+* `role_arn` - (Optional) The ARN of the IAM role to be associated with the user group.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Cognito User Groups using the `user_pool_id`/`name` attributes concatenated. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Cognito User Groups using the `user_pool_id`/`name` attributes concatenated. For example:
+
+```console
+% terraform import aws_cognito_user_group.group us-east-1_vG78M4goG/user-group
+```
+
+<!-- cache-key: cdktf-0.18.0 input-cc1b14439a5de34e3245c86b3fde6854b55b9ec7ad46bd038fb95fabbe714a37 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/cognito_user_in_group.html.markdown b/website/docs/cdktf/python/r/cognito_user_in_group.html.markdown
new file mode 100644
index 00000000000..38caa55a5ba
--- /dev/null
+++ b/website/docs/cdktf/python/r/cognito_user_in_group.html.markdown
@@ -0,0 +1,75 @@
+---
+subcategory: "Cognito IDP (Identity Provider)"
+layout: "aws"
+page_title: "AWS: aws_cognito_user_in_group"
+description: |-
+  Adds the specified user to the specified group.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cognito_user_in_group
+
+Adds the specified user to the specified group.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cognito_user import CognitoUser
+from imports.aws.cognito_user_group import CognitoUserGroup
+from imports.aws.cognito_user_in_group import CognitoUserInGroup
+from imports.aws.cognito_user_pool import CognitoUserPool
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = CognitoUserPool(self, "example",
+            name="example",
+            password_policy=CognitoUserPoolPasswordPolicy(
+                minimum_length=6,
+                require_numbers=False,
+                require_symbols=False,
+                require_uppercase=False,
+                temporary_password_validity_days=7
+            )
+        )
+        aws_cognito_user_example = CognitoUser(self, "example_1",
+            user_pool_id=example.id,
+            username="example"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_cognito_user_example.override_logical_id("example")
+        aws_cognito_user_group_example = CognitoUserGroup(self, "example_2",
+            name="example",
+            user_pool_id=example.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_cognito_user_group_example.override_logical_id("example")
+        aws_cognito_user_in_group_example = CognitoUserInGroup(self, "example_3",
+            group_name=Token.as_string(aws_cognito_user_group_example.name),
+            user_pool_id=example.id,
+            username=Token.as_string(aws_cognito_user_example.username)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_cognito_user_in_group_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `user_pool_id` - (Required) The user pool ID of the user and group.
+* `group_name` - (Required) The name of the group to which the user is to be added.
+* `username` - (Required) The username of the user to be added to the group.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+<!-- cache-key: cdktf-0.18.0 input-be59be793cc148b63f6cb2c1176522ea395a72e01fb79223c762c9ea801a348a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/cognito_user_pool.html.markdown b/website/docs/cdktf/python/r/cognito_user_pool.html.markdown
new file mode 100644
index 00000000000..13e49334756
--- /dev/null
+++ b/website/docs/cdktf/python/r/cognito_user_pool.html.markdown
@@ -0,0 +1,312 @@
+---
+subcategory: "Cognito IDP (Identity Provider)"
+layout: "aws"
+page_title: "AWS: aws_cognito_user_pool"
+description: |-
+  Provides a Cognito User Pool resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cognito_user_pool
+
+Provides a Cognito User Pool resource.
+
+## Example Usage
+
+### Basic configuration
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cognito_user_pool import CognitoUserPool
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        CognitoUserPool(self, "pool",
+            name="mypool"
+        )
+```
+
+### Enabling SMS and Software Token Multi-Factor Authentication
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cognito_user_pool import CognitoUserPool
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, name):
+        super().__init__(scope, name)
+        CognitoUserPool(self, "example",
+            mfa_configuration="ON",
+            sms_authentication_message="Your code is {####}",
+            sms_configuration=CognitoUserPoolSmsConfiguration(
+                external_id="example",
+                sns_caller_arn=Token.as_string(aws_iam_role_example.arn),
+                sns_region="us-east-1"
+            ),
+            software_token_mfa_configuration=CognitoUserPoolSoftwareTokenMfaConfiguration(
+                enabled=True
+            ),
+            name=name
+        )
+```
+
+### Using Account Recovery Setting
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cognito_user_pool import CognitoUserPool
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        CognitoUserPool(self, "test",
+            account_recovery_setting=CognitoUserPoolAccountRecoverySetting(
+                recovery_mechanism=[CognitoUserPoolAccountRecoverySettingRecoveryMechanism(
+                    name="verified_email",
+                    priority=1
+                ), CognitoUserPoolAccountRecoverySettingRecoveryMechanism(
+                    name="verified_phone_number",
+                    priority=2
+                )
+                ]
+            ),
+            name="mypool"
+        )
+```
+
+## Argument Reference
+
+The following argument is required:
+
+* `name` - (Required) Name of the user pool.
+
+The following arguments are optional:
+
+* `account_recovery_setting` - (Optional) Configuration block to define which verified available method a user can use to recover their forgotten password. [Detailed below](#account_recovery_setting).
+* `admin_create_user_config` - (Optional) Configuration block for creating a new user profile. [Detailed below](#admin_create_user_config).
+* `alias_attributes` - (Optional) Attributes supported as an alias for this user pool. Valid values: `phone_number`, `email`, or `preferred_username`. Conflicts with `username_attributes`.
+* `auto_verified_attributes` - (Optional) Attributes to be auto-verified. Valid values: `email`, `phone_number`.
+* `deletion_protection` - (Optional) When active, DeletionProtection prevents accidental deletion of your user pool. Before you can delete a user pool that you have protected against deletion, you must deactivate this feature. Valid values are `ACTIVE` and `INACTIVE`, Default value is `INACTIVE`.
+* `device_configuration` - (Optional) Configuration block for the user pool's device tracking. [Detailed below](#device_configuration).
+* `email_configuration` - (Optional) Configuration block for configuring email. [Detailed below](#email_configuration).
+* `email_verification_message` - (Optional) String representing the email verification message. Conflicts with `verification_message_template` configuration block `email_message` argument.
+* `email_verification_subject` - (Optional) String representing the email verification subject. Conflicts with `verification_message_template` configuration block `email_subject` argument.
+* `lambda_config` - (Optional) Configuration block for the AWS Lambda triggers associated with the user pool. [Detailed below](#lambda_config).
+* `mfa_configuration` - (Optional) Multi-Factor Authentication (MFA) configuration for the User Pool. Defaults of `OFF`. Valid values are `OFF` (MFA Tokens are not required), `ON` (MFA is required for all users to sign in; requires at least one of `sms_configuration` or `software_token_mfa_configuration` to be configured), or `OPTIONAL` (MFA Will be required only for individual users who have MFA Enabled; requires at least one of `sms_configuration` or `software_token_mfa_configuration` to be configured).
+* `password_policy` - (Optional) Configuration block for information about the user pool password policy. [Detailed below](#password_policy).
+* `schema` - (Optional) Configuration block for the schema attributes of a user pool. [Detailed below](#schema). Schema attributes from the [standard attribute set](https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-settings-attributes.html#cognito-user-pools-standard-attributes) only need to be specified if they are different from the default configuration. Attributes can be added, but not modified or removed. Maximum of 50 attributes.
+* `sms_authentication_message` - (Optional) String representing the SMS authentication message. The Message must contain the `{####}` placeholder, which will be replaced with the code.
+* `sms_configuration` - (Optional) Configuration block for Short Message Service (SMS) settings. [Detailed below](#sms_configuration). These settings apply to SMS user verification and SMS Multi-Factor Authentication (MFA). Due to Cognito API restrictions, the SMS configuration cannot be removed without recreating the Cognito User Pool. For user data safety, this resource will ignore the removal of this configuration by disabling drift detection. To force resource recreation after this configuration has been applied, see the [`taint` command](https://www.terraform.io/docs/commands/taint.html).
+* `sms_verification_message` - (Optional) String representing the SMS verification message. Conflicts with `verification_message_template` configuration block `sms_message` argument.
+* `software_token_mfa_configuration` - (Optional) Configuration block for software token Mult-Factor Authentication (MFA) settings. [Detailed below](#software_token_mfa_configuration).
+* `tags` - (Optional) Map of tags to assign to the User Pool. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `user_attribute_update_settings` - (Optional) Configuration block for user attribute update settings. [Detailed below](#user_attribute_update_settings).
+* `user_pool_add_ons` - (Optional) Configuration block for user pool add-ons to enable user pool advanced security mode features. [Detailed below](#user_pool_add_ons).
+* `username_attributes` - (Optional) Whether email addresses or phone numbers can be specified as usernames when a user signs up. Conflicts with `alias_attributes`.
+* `username_configuration` - (Optional) Configuration block for username configuration. [Detailed below](#username_configuration).
+* `verification_message_template` - (Optional) Configuration block for verification message templates. [Detailed below](#verification_message_template).
+
+### account_recovery_setting
+
+* `recovery_mechanism` - (Optional) List of Account Recovery Options of the following structure:
+    * `name` - (Required) Recovery method for a user. Can be of the following: `verified_email`, `verified_phone_number`, and `admin_only`.
+    * `priority` - (Required) Positive integer specifying priority of a method with 1 being the highest priority.
+
+### admin_create_user_config
+
+* `allow_admin_create_user_only` - (Optional) Set to True if only the administrator is allowed to create user profiles. Set to False if users can sign themselves up via an app.
+* `invite_message_template` - (Optional) Invite message template structure. [Detailed below](#invite_message_template).
+
+#### invite_message_template
+
+* `email_message` - (Optional) Message template for email messages. Must contain `{username}` and `{####}` placeholders, for username and temporary password, respectively.
+* `email_subject` - (Optional) Subject line for email messages.
+* `sms_message` - (Optional) Message template for SMS messages. Must contain `{username}` and `{####}` placeholders, for username and temporary password, respectively.
+
+### device_configuration
+
+* `challenge_required_on_new_device` - (Optional) Whether a challenge is required on a new device. Only applicable to a new device.
+* `device_only_remembered_on_user_prompt` - (Optional) Whether a device is only remembered on user prompt. `false` equates to "Always" remember, `true` is "User Opt In," and not using a `device_configuration` block is "No."
+
+### email_configuration
+
+* `configuration_set` - (Optional) Email configuration set name from SES.
+* `email_sending_account` - (Optional) Email delivery method to use. `COGNITO_DEFAULT` for the default email functionality built into Cognito or `DEVELOPER` to use your Amazon SES configuration. Required to be `DEVELOPER` if `from_email_address` is set.
+* `from_email_address` - (Optional) Sender’s email address or sender’s display name with their email address (e.g., `john@example.com`, `John Smith <john@example.com>` or `\"John Smith Ph.D.\" <john@example.com>`). Escaped double quotes are required around display names that contain certain characters as specified in [RFC 5322](https://tools.ietf.org/html/rfc5322).
+* `reply_to_email_address` - (Optional) REPLY-TO email address.
+* `source_arn` - (Optional) ARN of the SES verified email identity to use. Required if `email_sending_account` is set to `DEVELOPER`.
+
+### lambda_config
+
+* `create_auth_challenge` - (Optional) ARN of the lambda creating an authentication challenge.
+* `custom_message` - (Optional) Custom Message AWS Lambda trigger.
+* `define_auth_challenge` - (Optional) Defines the authentication challenge.
+* `post_authentication` - (Optional) Post-authentication AWS Lambda trigger.
+* `post_confirmation` - (Optional) Post-confirmation AWS Lambda trigger.
+* `pre_authentication` - (Optional) Pre-authentication AWS Lambda trigger.
+* `pre_sign_up` - (Optional) Pre-registration AWS Lambda trigger.
+* `pre_token_generation` - (Optional) Allow to customize identity token claims before token generation.
+* `user_migration` - (Optional) User migration Lambda config type.
+* `verify_auth_challenge_response` - (Optional) Verifies the authentication challenge response.
+* `kms_key_id` - (Optional) The Amazon Resource Name of Key Management Service Customer master keys. Amazon Cognito uses the key to encrypt codes and temporary passwords sent to CustomEmailSender and CustomSMSSender.
+* `custom_email_sender` - (Optional) A custom email sender AWS Lambda trigger. See [custom_email_sender](#custom_email_sender) Below.
+* `custom_sms_sender` - (Optional) A custom SMS sender AWS Lambda trigger. See [custom_sms_sender](#custom_sms_sender) Below.
+
+#### custom_email_sender
+
+* `lambda_arn` - (Required) The Lambda Amazon Resource Name of the Lambda function that Amazon Cognito triggers to send email notifications to users.
+* `lambda_version` - (Required) The Lambda version represents the signature of the "request" attribute in the "event" information Amazon Cognito passes to your custom email Lambda function. The only supported value is `V1_0`.
+
+#### custom_sms_sender
+
+* `lambda_arn` - (Required) The Lambda Amazon Resource Name of the Lambda function that Amazon Cognito triggers to send SMS notifications to users.
+* `lambda_version` - (Required) The Lambda version represents the signature of the "request" attribute in the "event" information Amazon Cognito passes to your custom SMS Lambda function. The only supported value is `V1_0`.
+
+### password_policy
+
+* `minimum_length` - (Optional) Minimum length of the password policy that you have set.
+* `require_lowercase` - (Optional) Whether you have required users to use at least one lowercase letter in their password.
+* `require_numbers` - (Optional) Whether you have required users to use at least one number in their password.
+* `require_symbols` - (Optional) Whether you have required users to use at least one symbol in their password.
+* `require_uppercase` - (Optional) Whether you have required users to use at least one uppercase letter in their password.
+* `temporary_password_validity_days` - (Optional) In the password policy you have set, refers to the number of days a temporary password is valid. If the user does not sign-in during this time, their password will need to be reset by an administrator.
+
+### schema
+
+~> **NOTE:** When defining an `attribute_data_type` of `String` or `Number`, the respective attribute constraints configuration block (e.g `string_attribute_constraints` or `number_attribute_constraints`) is **required** to prevent recreation of the Terraform resource. This requirement is true for both standard (e.g., name, email) and custom schema attributes.
+
+* `attribute_data_type` - (Required) Attribute data type. Must be one of `Boolean`, `Number`, `String`, `DateTime`.
+* `developer_only_attribute` - (Optional) Whether the attribute type is developer only.
+* `mutable` - (Optional) Whether the attribute can be changed once it has been created.
+* `name` - (Required) Name of the attribute.
+* `number_attribute_constraints` - (Required when `attribute_data_type` is `Number`) Configuration block for the constraints for an attribute of the number type. [Detailed below](#number_attribute_constraints).
+* `required` - (Optional) Whether a user pool attribute is required. If the attribute is required and the user does not provide a value, registration or sign-in will fail.
+* `string_attribute_constraints` - (Required when `attribute_data_type` is `String`) Constraints for an attribute of the string type. [Detailed below](#string_attribute_constraints).
+
+#### schema: Defaults for Standard Attributes
+
+The [standard attributes](https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-settings-attributes.html#cognito-user-pools-standard-attributes) have the following defaults. Note that attributes which match the default values are not stored in Terraform state when importing.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cognito_user_pool import CognitoUserPool
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, name):
+        super().__init__(scope, name)
+        CognitoUserPool(self, "example",
+            schema=[CognitoUserPoolSchema(
+                attribute_data_type="<appropriate type>",
+                developer_only_attribute=False,
+                mutable=True,
+                name="<name>",
+                required=False,
+                string_attribute_constraints=CognitoUserPoolSchemaStringAttributeConstraints(
+                    max_length=Token.as_string(2048),
+                    min_length=Token.as_string(0)
+                )
+            )
+            ],
+            name=name
+        )
+```
+
+#### number_attribute_constraints
+
+* `max_value` - (Optional) Maximum value of an attribute that is of the number data type.
+* `min_value` - (Optional) Minimum value of an attribute that is of the number data type.
+
+#### string_attribute_constraints
+
+* `max_length` - (Optional) Maximum length of an attribute value of the string type.
+* `min_length` - (Optional) Minimum length of an attribute value of the string type.
+
+### sms_configuration
+
+* `external_id` - (Required) External ID used in IAM role trust relationships. For more information about using external IDs, see [How to Use an External ID When Granting Access to Your AWS Resources to a Third Party](http://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user_externalid.html).
+* `sns_caller_arn` - (Required) ARN of the Amazon SNS caller. This is usually the IAM role that you've given Cognito permission to assume.
+* `sns_region` - (Optional) The AWS Region to use with Amazon SNS integration. You can choose the same Region as your user pool, or a supported Legacy Amazon SNS alternate Region. Amazon Cognito resources in the Asia Pacific (Seoul) AWS Region must use your Amazon SNS configuration in the Asia Pacific (Tokyo) Region. For more information, see [SMS message settings for Amazon Cognito user pools](https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-sms-settings.html).
+
+### software_token_mfa_configuration
+
+The following arguments are required in the `software_token_mfa_configuration` configuration block:
+
+* `enabled` - (Required) Boolean whether to enable software token Multi-Factor (MFA) tokens, such as Time-based One-Time Password (TOTP). To disable software token MFA When `sms_configuration` is not present, the `mfa_configuration` argument must be set to `OFF` and the `software_token_mfa_configuration` configuration block must be fully removed.
+
+### user_attribute_update_settings
+
+* `attributes_require_verification_before_update` - (Required) A list of attributes requiring verification before update. If set, the provided value(s) must also be set in `auto_verified_attributes`. Valid values: `email`, `phone_number`.
+
+### user_pool_add_ons
+
+* `advanced_security_mode` - (Required) Mode for advanced security, must be one of `OFF`, `AUDIT` or `ENFORCED`.
+
+### username_configuration
+
+* `case_sensitive` - (Required) Whether username case sensitivity will be applied for all users in the user pool through Cognito APIs.
+
+### verification_message_template
+
+* `default_email_option` - (Optional) Default email option. Must be either `CONFIRM_WITH_CODE` or `CONFIRM_WITH_LINK`. Defaults to `CONFIRM_WITH_CODE`.
+* `email_message` - (Optional) Email message template. Must contain the `{####}` placeholder. Conflicts with `email_verification_message` argument.
+* `email_message_by_link` - (Optional) Email message template for sending a confirmation link to the user, it must contain the `{##Click Here##}` placeholder.
+* `email_subject` - (Optional) Subject line for the email message template. Conflicts with `email_verification_subject` argument.
+* `email_subject_by_link` - (Optional) Subject line for the email message template for sending a confirmation link to the user.
+* `sms_message` - (Optional) SMS message template. Must contain the `{####}` placeholder. Conflicts with `sms_verification_message` argument.
+  
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the user pool.
+* `creation_date` - Date the user pool was created.
+* `custom_domain` - A custom domain name that you provide to Amazon Cognito. This parameter applies only if you use a custom domain to host the sign-up and sign-in pages for your application. For example: `auth.example.com`.
+* `domain` - Holds the domain prefix if the user pool has a domain associated with it.
+* `endpoint` - Endpoint name of the user pool. Example format: `cognito-idp.REGION.amazonaws.com/xxxx_yyyyy`
+* `estimated_number_of_users` - A number estimating the size of the user pool.
+* `id` - ID of the user pool.
+* `last_modified_date` - Date the user pool was last modified.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Cognito User Pools using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Cognito User Pools using the `id`. For example:
+
+```console
+% terraform import aws_cognito_user_pool.pool us-west-2_abc123
+```
+
+<!-- cache-key: cdktf-0.18.0 input-956f61f5814a7a2fe0cddeef5fa9d4a645f79dd8c9a568695d52c319ef5ea5d4 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/cognito_user_pool.markdown b/website/docs/cdktf/python/r/cognito_user_pool.markdown
new file mode 100644
index 00000000000..13e49334756
--- /dev/null
+++ b/website/docs/cdktf/python/r/cognito_user_pool.markdown
@@ -0,0 +1,312 @@
+---
+subcategory: "Cognito IDP (Identity Provider)"
+layout: "aws"
+page_title: "AWS: aws_cognito_user_pool"
+description: |-
+  Provides a Cognito User Pool resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cognito_user_pool
+
+Provides a Cognito User Pool resource.
+
+## Example Usage
+
+### Basic configuration
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cognito_user_pool import CognitoUserPool
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        CognitoUserPool(self, "pool",
+            name="mypool"
+        )
+```
+
+### Enabling SMS and Software Token Multi-Factor Authentication
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cognito_user_pool import CognitoUserPool
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, name):
+        super().__init__(scope, name)
+        CognitoUserPool(self, "example",
+            mfa_configuration="ON",
+            sms_authentication_message="Your code is {####}",
+            sms_configuration=CognitoUserPoolSmsConfiguration(
+                external_id="example",
+                sns_caller_arn=Token.as_string(aws_iam_role_example.arn),
+                sns_region="us-east-1"
+            ),
+            software_token_mfa_configuration=CognitoUserPoolSoftwareTokenMfaConfiguration(
+                enabled=True
+            ),
+            name=name
+        )
+```
+
+### Using Account Recovery Setting
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cognito_user_pool import CognitoUserPool
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        CognitoUserPool(self, "test",
+            account_recovery_setting=CognitoUserPoolAccountRecoverySetting(
+                recovery_mechanism=[CognitoUserPoolAccountRecoverySettingRecoveryMechanism(
+                    name="verified_email",
+                    priority=1
+                ), CognitoUserPoolAccountRecoverySettingRecoveryMechanism(
+                    name="verified_phone_number",
+                    priority=2
+                )
+                ]
+            ),
+            name="mypool"
+        )
+```
+
+## Argument Reference
+
+The following argument is required:
+
+* `name` - (Required) Name of the user pool.
+
+The following arguments are optional:
+
+* `account_recovery_setting` - (Optional) Configuration block to define which verified available method a user can use to recover their forgotten password. [Detailed below](#account_recovery_setting).
+* `admin_create_user_config` - (Optional) Configuration block for creating a new user profile. [Detailed below](#admin_create_user_config).
+* `alias_attributes` - (Optional) Attributes supported as an alias for this user pool. Valid values: `phone_number`, `email`, or `preferred_username`. Conflicts with `username_attributes`.
+* `auto_verified_attributes` - (Optional) Attributes to be auto-verified. Valid values: `email`, `phone_number`.
+* `deletion_protection` - (Optional) When active, DeletionProtection prevents accidental deletion of your user pool. Before you can delete a user pool that you have protected against deletion, you must deactivate this feature. Valid values are `ACTIVE` and `INACTIVE`, Default value is `INACTIVE`.
+* `device_configuration` - (Optional) Configuration block for the user pool's device tracking. [Detailed below](#device_configuration).
+* `email_configuration` - (Optional) Configuration block for configuring email. [Detailed below](#email_configuration).
+* `email_verification_message` - (Optional) String representing the email verification message. Conflicts with `verification_message_template` configuration block `email_message` argument.
+* `email_verification_subject` - (Optional) String representing the email verification subject. Conflicts with `verification_message_template` configuration block `email_subject` argument.
+* `lambda_config` - (Optional) Configuration block for the AWS Lambda triggers associated with the user pool. [Detailed below](#lambda_config).
+* `mfa_configuration` - (Optional) Multi-Factor Authentication (MFA) configuration for the User Pool. Defaults of `OFF`. Valid values are `OFF` (MFA Tokens are not required), `ON` (MFA is required for all users to sign in; requires at least one of `sms_configuration` or `software_token_mfa_configuration` to be configured), or `OPTIONAL` (MFA Will be required only for individual users who have MFA Enabled; requires at least one of `sms_configuration` or `software_token_mfa_configuration` to be configured).
+* `password_policy` - (Optional) Configuration block for information about the user pool password policy. [Detailed below](#password_policy).
+* `schema` - (Optional) Configuration block for the schema attributes of a user pool. [Detailed below](#schema). Schema attributes from the [standard attribute set](https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-settings-attributes.html#cognito-user-pools-standard-attributes) only need to be specified if they are different from the default configuration. Attributes can be added, but not modified or removed. Maximum of 50 attributes.
+* `sms_authentication_message` - (Optional) String representing the SMS authentication message. The Message must contain the `{####}` placeholder, which will be replaced with the code.
+* `sms_configuration` - (Optional) Configuration block for Short Message Service (SMS) settings. [Detailed below](#sms_configuration). These settings apply to SMS user verification and SMS Multi-Factor Authentication (MFA). Due to Cognito API restrictions, the SMS configuration cannot be removed without recreating the Cognito User Pool. For user data safety, this resource will ignore the removal of this configuration by disabling drift detection. To force resource recreation after this configuration has been applied, see the [`taint` command](https://www.terraform.io/docs/commands/taint.html).
+* `sms_verification_message` - (Optional) String representing the SMS verification message. Conflicts with `verification_message_template` configuration block `sms_message` argument.
+* `software_token_mfa_configuration` - (Optional) Configuration block for software token Mult-Factor Authentication (MFA) settings. [Detailed below](#software_token_mfa_configuration).
+* `tags` - (Optional) Map of tags to assign to the User Pool. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `user_attribute_update_settings` - (Optional) Configuration block for user attribute update settings. [Detailed below](#user_attribute_update_settings).
+* `user_pool_add_ons` - (Optional) Configuration block for user pool add-ons to enable user pool advanced security mode features. [Detailed below](#user_pool_add_ons).
+* `username_attributes` - (Optional) Whether email addresses or phone numbers can be specified as usernames when a user signs up. Conflicts with `alias_attributes`.
+* `username_configuration` - (Optional) Configuration block for username configuration. [Detailed below](#username_configuration).
+* `verification_message_template` - (Optional) Configuration block for verification message templates. [Detailed below](#verification_message_template).
+
+### account_recovery_setting
+
+* `recovery_mechanism` - (Optional) List of Account Recovery Options of the following structure:
+    * `name` - (Required) Recovery method for a user. Can be of the following: `verified_email`, `verified_phone_number`, and `admin_only`.
+    * `priority` - (Required) Positive integer specifying priority of a method with 1 being the highest priority.
+
+### admin_create_user_config
+
+* `allow_admin_create_user_only` - (Optional) Set to True if only the administrator is allowed to create user profiles. Set to False if users can sign themselves up via an app.
+* `invite_message_template` - (Optional) Invite message template structure. [Detailed below](#invite_message_template).
+
+#### invite_message_template
+
+* `email_message` - (Optional) Message template for email messages. Must contain `{username}` and `{####}` placeholders, for username and temporary password, respectively.
+* `email_subject` - (Optional) Subject line for email messages.
+* `sms_message` - (Optional) Message template for SMS messages. Must contain `{username}` and `{####}` placeholders, for username and temporary password, respectively.
+
+### device_configuration
+
+* `challenge_required_on_new_device` - (Optional) Whether a challenge is required on a new device. Only applicable to a new device.
+* `device_only_remembered_on_user_prompt` - (Optional) Whether a device is only remembered on user prompt. `false` equates to "Always" remember, `true` is "User Opt In," and not using a `device_configuration` block is "No."
+
+### email_configuration
+
+* `configuration_set` - (Optional) Email configuration set name from SES.
+* `email_sending_account` - (Optional) Email delivery method to use. `COGNITO_DEFAULT` for the default email functionality built into Cognito or `DEVELOPER` to use your Amazon SES configuration. Required to be `DEVELOPER` if `from_email_address` is set.
+* `from_email_address` - (Optional) Sender’s email address or sender’s display name with their email address (e.g., `john@example.com`, `John Smith <john@example.com>` or `\"John Smith Ph.D.\" <john@example.com>`). Escaped double quotes are required around display names that contain certain characters as specified in [RFC 5322](https://tools.ietf.org/html/rfc5322).
+* `reply_to_email_address` - (Optional) REPLY-TO email address.
+* `source_arn` - (Optional) ARN of the SES verified email identity to use. Required if `email_sending_account` is set to `DEVELOPER`.
+
+### lambda_config
+
+* `create_auth_challenge` - (Optional) ARN of the lambda creating an authentication challenge.
+* `custom_message` - (Optional) Custom Message AWS Lambda trigger.
+* `define_auth_challenge` - (Optional) Defines the authentication challenge.
+* `post_authentication` - (Optional) Post-authentication AWS Lambda trigger.
+* `post_confirmation` - (Optional) Post-confirmation AWS Lambda trigger.
+* `pre_authentication` - (Optional) Pre-authentication AWS Lambda trigger.
+* `pre_sign_up` - (Optional) Pre-registration AWS Lambda trigger.
+* `pre_token_generation` - (Optional) Allow to customize identity token claims before token generation.
+* `user_migration` - (Optional) User migration Lambda config type.
+* `verify_auth_challenge_response` - (Optional) Verifies the authentication challenge response.
+* `kms_key_id` - (Optional) The Amazon Resource Name of Key Management Service Customer master keys. Amazon Cognito uses the key to encrypt codes and temporary passwords sent to CustomEmailSender and CustomSMSSender.
+* `custom_email_sender` - (Optional) A custom email sender AWS Lambda trigger. See [custom_email_sender](#custom_email_sender) Below.
+* `custom_sms_sender` - (Optional) A custom SMS sender AWS Lambda trigger. See [custom_sms_sender](#custom_sms_sender) Below.
+
+#### custom_email_sender
+
+* `lambda_arn` - (Required) The Lambda Amazon Resource Name of the Lambda function that Amazon Cognito triggers to send email notifications to users.
+* `lambda_version` - (Required) The Lambda version represents the signature of the "request" attribute in the "event" information Amazon Cognito passes to your custom email Lambda function. The only supported value is `V1_0`.
+
+#### custom_sms_sender
+
+* `lambda_arn` - (Required) The Lambda Amazon Resource Name of the Lambda function that Amazon Cognito triggers to send SMS notifications to users.
+* `lambda_version` - (Required) The Lambda version represents the signature of the "request" attribute in the "event" information Amazon Cognito passes to your custom SMS Lambda function. The only supported value is `V1_0`.
+
+### password_policy
+
+* `minimum_length` - (Optional) Minimum length of the password policy that you have set.
+* `require_lowercase` - (Optional) Whether you have required users to use at least one lowercase letter in their password.
+* `require_numbers` - (Optional) Whether you have required users to use at least one number in their password.
+* `require_symbols` - (Optional) Whether you have required users to use at least one symbol in their password.
+* `require_uppercase` - (Optional) Whether you have required users to use at least one uppercase letter in their password.
+* `temporary_password_validity_days` - (Optional) In the password policy you have set, refers to the number of days a temporary password is valid. If the user does not sign-in during this time, their password will need to be reset by an administrator.
+
+### schema
+
+~> **NOTE:** When defining an `attribute_data_type` of `String` or `Number`, the respective attribute constraints configuration block (e.g `string_attribute_constraints` or `number_attribute_constraints`) is **required** to prevent recreation of the Terraform resource. This requirement is true for both standard (e.g., name, email) and custom schema attributes.
+
+* `attribute_data_type` - (Required) Attribute data type. Must be one of `Boolean`, `Number`, `String`, `DateTime`.
+* `developer_only_attribute` - (Optional) Whether the attribute type is developer only.
+* `mutable` - (Optional) Whether the attribute can be changed once it has been created.
+* `name` - (Required) Name of the attribute.
+* `number_attribute_constraints` - (Required when `attribute_data_type` is `Number`) Configuration block for the constraints for an attribute of the number type. [Detailed below](#number_attribute_constraints).
+* `required` - (Optional) Whether a user pool attribute is required. If the attribute is required and the user does not provide a value, registration or sign-in will fail.
+* `string_attribute_constraints` - (Required when `attribute_data_type` is `String`) Constraints for an attribute of the string type. [Detailed below](#string_attribute_constraints).
+
+#### schema: Defaults for Standard Attributes
+
+The [standard attributes](https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-settings-attributes.html#cognito-user-pools-standard-attributes) have the following defaults. Note that attributes which match the default values are not stored in Terraform state when importing.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cognito_user_pool import CognitoUserPool
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, name):
+        super().__init__(scope, name)
+        CognitoUserPool(self, "example",
+            schema=[CognitoUserPoolSchema(
+                attribute_data_type="<appropriate type>",
+                developer_only_attribute=False,
+                mutable=True,
+                name="<name>",
+                required=False,
+                string_attribute_constraints=CognitoUserPoolSchemaStringAttributeConstraints(
+                    max_length=Token.as_string(2048),
+                    min_length=Token.as_string(0)
+                )
+            )
+            ],
+            name=name
+        )
+```
+
+#### number_attribute_constraints
+
+* `max_value` - (Optional) Maximum value of an attribute that is of the number data type.
+* `min_value` - (Optional) Minimum value of an attribute that is of the number data type.
+
+#### string_attribute_constraints
+
+* `max_length` - (Optional) Maximum length of an attribute value of the string type.
+* `min_length` - (Optional) Minimum length of an attribute value of the string type.
+
+### sms_configuration
+
+* `external_id` - (Required) External ID used in IAM role trust relationships. For more information about using external IDs, see [How to Use an External ID When Granting Access to Your AWS Resources to a Third Party](http://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user_externalid.html).
+* `sns_caller_arn` - (Required) ARN of the Amazon SNS caller. This is usually the IAM role that you've given Cognito permission to assume.
+* `sns_region` - (Optional) The AWS Region to use with Amazon SNS integration. You can choose the same Region as your user pool, or a supported Legacy Amazon SNS alternate Region. Amazon Cognito resources in the Asia Pacific (Seoul) AWS Region must use your Amazon SNS configuration in the Asia Pacific (Tokyo) Region. For more information, see [SMS message settings for Amazon Cognito user pools](https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-sms-settings.html).
+
+### software_token_mfa_configuration
+
+The following arguments are required in the `software_token_mfa_configuration` configuration block:
+
+* `enabled` - (Required) Boolean whether to enable software token Multi-Factor (MFA) tokens, such as Time-based One-Time Password (TOTP). To disable software token MFA When `sms_configuration` is not present, the `mfa_configuration` argument must be set to `OFF` and the `software_token_mfa_configuration` configuration block must be fully removed.
+
+### user_attribute_update_settings
+
+* `attributes_require_verification_before_update` - (Required) A list of attributes requiring verification before update. If set, the provided value(s) must also be set in `auto_verified_attributes`. Valid values: `email`, `phone_number`.
+
+### user_pool_add_ons
+
+* `advanced_security_mode` - (Required) Mode for advanced security, must be one of `OFF`, `AUDIT` or `ENFORCED`.
+
+### username_configuration
+
+* `case_sensitive` - (Required) Whether username case sensitivity will be applied for all users in the user pool through Cognito APIs.
+
+### verification_message_template
+
+* `default_email_option` - (Optional) Default email option. Must be either `CONFIRM_WITH_CODE` or `CONFIRM_WITH_LINK`. Defaults to `CONFIRM_WITH_CODE`.
+* `email_message` - (Optional) Email message template. Must contain the `{####}` placeholder. Conflicts with `email_verification_message` argument.
+* `email_message_by_link` - (Optional) Email message template for sending a confirmation link to the user, it must contain the `{##Click Here##}` placeholder.
+* `email_subject` - (Optional) Subject line for the email message template. Conflicts with `email_verification_subject` argument.
+* `email_subject_by_link` - (Optional) Subject line for the email message template for sending a confirmation link to the user.
+* `sms_message` - (Optional) SMS message template. Must contain the `{####}` placeholder. Conflicts with `sms_verification_message` argument.
+  
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the user pool.
+* `creation_date` - Date the user pool was created.
+* `custom_domain` - A custom domain name that you provide to Amazon Cognito. This parameter applies only if you use a custom domain to host the sign-up and sign-in pages for your application. For example: `auth.example.com`.
+* `domain` - Holds the domain prefix if the user pool has a domain associated with it.
+* `endpoint` - Endpoint name of the user pool. Example format: `cognito-idp.REGION.amazonaws.com/xxxx_yyyyy`
+* `estimated_number_of_users` - A number estimating the size of the user pool.
+* `id` - ID of the user pool.
+* `last_modified_date` - Date the user pool was last modified.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Cognito User Pools using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Cognito User Pools using the `id`. For example:
+
+```console
+% terraform import aws_cognito_user_pool.pool us-west-2_abc123
+```
+
+<!-- cache-key: cdktf-0.18.0 input-956f61f5814a7a2fe0cddeef5fa9d4a645f79dd8c9a568695d52c319ef5ea5d4 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/cognito_user_pool_client.html.markdown b/website/docs/cdktf/python/r/cognito_user_pool_client.html.markdown
new file mode 100644
index 00000000000..757d63260ca
--- /dev/null
+++ b/website/docs/cdktf/python/r/cognito_user_pool_client.html.markdown
@@ -0,0 +1,260 @@
+---
+subcategory: "Cognito IDP (Identity Provider)"
+layout: "aws"
+page_title: "AWS: aws_cognito_user_pool_client"
+description: |-
+  Provides a Cognito User Pool Client resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cognito_user_pool_client
+
+Provides a Cognito User Pool Client resource.
+
+To manage a User Pool Client created by another service, such as when [configuring an OpenSearch Domain to use Cognito authentication](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/cognito-auth.html),
+use the [`aws_cognito_managed_user_pool_client` resource](cognito_managed_user_pool_client.html) instead.
+
+## Example Usage
+
+### Create a basic user pool client
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cognito_user_pool import CognitoUserPool
+from imports.aws.cognito_user_pool_client import CognitoUserPoolClient
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        pool = CognitoUserPool(self, "pool",
+            name="pool"
+        )
+        CognitoUserPoolClient(self, "client",
+            name="client",
+            user_pool_id=pool.id
+        )
+```
+
+### Create a user pool client with no SRP authentication
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cognito_user_pool import CognitoUserPool
+from imports.aws.cognito_user_pool_client import CognitoUserPoolClient
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        pool = CognitoUserPool(self, "pool",
+            name="pool"
+        )
+        CognitoUserPoolClient(self, "client",
+            explicit_auth_flows=["ADMIN_NO_SRP_AUTH"],
+            generate_secret=True,
+            name="client",
+            user_pool_id=pool.id
+        )
+```
+
+### Create a user pool client with pinpoint analytics
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cognito_user_pool import CognitoUserPool
+from imports.aws.cognito_user_pool_client import CognitoUserPoolClient
+from imports.aws.data_aws_caller_identity import DataAwsCallerIdentity
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.iam_role import IamRole
+from imports.aws.iam_role_policy import IamRolePolicy
+from imports.aws.pinpoint_app import PinpointApp
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        test = CognitoUserPool(self, "test",
+            name="pool"
+        )
+        aws_pinpoint_app_test = PinpointApp(self, "test_1",
+            name="pinpoint"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_pinpoint_app_test.override_logical_id("test")
+        current = DataAwsCallerIdentity(self, "current")
+        assume_role = DataAwsIamPolicyDocument(self, "assume_role",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["sts:AssumeRole"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["cognito-idp.amazonaws.com"],
+                    type="Service"
+                )
+                ]
+            )
+            ]
+        )
+        data_aws_iam_policy_document_test = DataAwsIamPolicyDocument(self, "test_4",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["mobiletargeting:UpdateEndpoint", "mobiletargeting:PutEvents"
+                ],
+                effect="Allow",
+                resources=["arn:aws:mobiletargeting:*:${" + current.account_id + "}:apps/${" + aws_pinpoint_app_test.application_id + "}*"
+                ]
+            )
+            ]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_iam_policy_document_test.override_logical_id("test")
+        aws_iam_role_test = IamRole(self, "test_5",
+            assume_role_policy=Token.as_string(assume_role.json),
+            name="role"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_role_test.override_logical_id("test")
+        aws_iam_role_policy_test = IamRolePolicy(self, "test_6",
+            name="role_policy",
+            policy=Token.as_string(data_aws_iam_policy_document_test.json),
+            role=Token.as_string(aws_iam_role_test.id)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_role_policy_test.override_logical_id("test")
+        aws_cognito_user_pool_client_test = CognitoUserPoolClient(self, "test_7",
+            analytics_configuration=[CognitoUserPoolClientAnalyticsConfiguration(
+                application_id=Token.as_string(aws_pinpoint_app_test.application_id),
+                external_id="some_id",
+                role_arn=Token.as_string(aws_iam_role_test.arn),
+                user_data_shared=True
+            )
+            ],
+            name="pool_client",
+            user_pool_id=test.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_cognito_user_pool_client_test.override_logical_id("test")
+```
+
+### Create a user pool client with Cognito as the identity provider
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cognito_user_pool import CognitoUserPool
+from imports.aws.cognito_user_pool_client import CognitoUserPoolClient
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        pool = CognitoUserPool(self, "pool",
+            name="pool"
+        )
+        CognitoUserPoolClient(self, "userpool_client",
+            allowed_oauth_flows=["code", "implicit"],
+            allowed_oauth_flows_user_pool_client=True,
+            allowed_oauth_scopes=["email", "openid"],
+            callback_urls=["https://example.com"],
+            name="client",
+            supported_identity_providers=["COGNITO"],
+            user_pool_id=pool.id
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) Name of the application client.
+* `user_pool_id` - (Required) User pool the client belongs to.
+
+The following arguments are optional:
+
+* `access_token_validity` - (Optional) Time limit, between 5 minutes and 1 day, after which the access token is no longer valid and cannot be used.
+  By default, the unit is hours.
+  The unit can be overridden by a value in `token_validity_units.access_token`.
+* `allowed_oauth_flows_user_pool_client` - (Optional) Whether the client is allowed to follow the OAuth protocol when interacting with Cognito user pools.
+* `allowed_oauth_flows` - (Optional) List of allowed OAuth flows (code, implicit, client_credentials).
+* `allowed_oauth_scopes` - (Optional) List of allowed OAuth scopes (phone, email, openid, profile, and aws.cognito.signin.user.admin).
+* `analytics_configuration` - (Optional) Configuration block for Amazon Pinpoint analytics for collecting metrics for this user pool. [Detailed below](#analytics_configuration).
+* `auth_session_validity` - (Optional) Amazon Cognito creates a session token for each API request in an authentication flow. AuthSessionValidity is the duration, in minutes, of that session token. Your user pool native user must respond to each authentication challenge before the session expires. Valid values between `3` and `15`. Default value is `3`.
+* `callback_urls` - (Optional) List of allowed callback URLs for the identity providers.
+* `default_redirect_uri` - (Optional) Default redirect URI. Must be in the list of callback URLs.
+* `enable_token_revocation` - (Optional) Enables or disables token revocation.
+* `enable_propagate_additional_user_context_data` - (Optional) Activates the propagation of additional user context data.
+* `explicit_auth_flows` - (Optional) List of authentication flows (ADMIN_NO_SRP_AUTH, CUSTOM_AUTH_FLOW_ONLY, USER_PASSWORD_AUTH, ALLOW_ADMIN_USER_PASSWORD_AUTH, ALLOW_CUSTOM_AUTH, ALLOW_USER_PASSWORD_AUTH, ALLOW_USER_SRP_AUTH, ALLOW_REFRESH_TOKEN_AUTH).
+* `generate_secret` - (Optional) Should an application secret be generated.
+* `id_token_validity` - (Optional) Time limit, between 5 minutes and 1 day, after which the ID token is no longer valid and cannot be used.
+  By default, the unit is hours.
+  The unit can be overridden by a value in `token_validity_units.id_token`.
+* `logout_urls` - (Optional) List of allowed logout URLs for the identity providers.
+* `prevent_user_existence_errors` - (Optional) Choose which errors and responses are returned by Cognito APIs during authentication, account confirmation, and password recovery when the user does not exist in the user pool. When set to `ENABLED` and the user does not exist, authentication returns an error indicating either the username or password was incorrect, and account confirmation and password recovery return a response indicating a code was sent to a simulated destination. When set to `LEGACY`, those APIs will return a `UserNotFoundException` exception if the user does not exist in the user pool.
+* `read_attributes` - (Optional) List of user pool attributes the application client can read from.
+* `refresh_token_validity` - (Optional) Time limit, between 60 minutes and 10 years, after which the refresh token is no longer valid and cannot be used.
+  By default, the unit is days.
+  The unit can be overridden by a value in `token_validity_units.refresh_token`.
+* `supported_identity_providers` - (Optional) List of provider names for the identity providers that are supported on this client. Uses the `provider_name` attribute of `aws_cognito_identity_provider` resource(s), or the equivalent string(s).
+* `token_validity_units` - (Optional) Configuration block for units in which the validity times are represented in. [Detailed below](#token_validity_units).
+* `write_attributes` - (Optional) List of user pool attributes the application client can write to.
+
+### analytics_configuration
+
+Either `application_arn` or `application_id` is required.
+
+* `application_arn` - (Optional) Application ARN for an Amazon Pinpoint application. Conflicts with `external_id` and `role_arn`.
+* `application_id` - (Optional) Application ID for an Amazon Pinpoint application.
+* `external_id` - (Optional) ID for the Analytics Configuration. Conflicts with `application_arn`.
+* `role_arn` - (Optional) ARN of an IAM role that authorizes Amazon Cognito to publish events to Amazon Pinpoint analytics. Conflicts with `application_arn`.
+* `user_data_shared` (Optional) If set to `true`, Amazon Cognito will include user data in the events it publishes to Amazon Pinpoint analytics.
+
+### token_validity_units
+
+Valid values for the following arguments are: `seconds`, `minutes`, `hours` or `days`.
+
+* `access_token` - (Optional) Time unit in for the value in `access_token_validity`, defaults to `hours`.
+* `id_token` - (Optional) Time unit in for the value in `id_token_validity`, defaults to `hours`.
+* `refresh_token` - (Optional) Time unit in for the value in `refresh_token_validity`, defaults to `days`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `client_secret` - Client secret of the user pool client.
+* `id` - ID of the user pool client.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Cognito User Pool Clients using the `id` of the Cognito User Pool, and the `id` of the Cognito User Pool Client. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Cognito User Pool Clients using the `id` of the Cognito User Pool, and the `id` of the Cognito User Pool Client. For example:
+
+```console
+% terraform import aws_cognito_user_pool_client.client us-west-2_abc123/3ho4ek12345678909nh3fmhpko
+```
+
+<!-- cache-key: cdktf-0.18.0 input-f15ecc5dad4d3b315fc63b6cc6f271d574fd906c13652ee8c6dbe7ed3789a449 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/cognito_user_pool_domain.html.markdown b/website/docs/cdktf/python/r/cognito_user_pool_domain.html.markdown
new file mode 100644
index 00000000000..490b670b86a
--- /dev/null
+++ b/website/docs/cdktf/python/r/cognito_user_pool_domain.html.markdown
@@ -0,0 +1,121 @@
+---
+subcategory: "Cognito IDP (Identity Provider)"
+layout: "aws"
+page_title: "AWS: aws_cognito_user_pool_domain"
+description: |-
+  Provides a Cognito User Pool Domain resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cognito_user_pool_domain
+
+Provides a Cognito User Pool Domain resource.
+
+## Example Usage
+
+### Amazon Cognito domain
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cognito_user_pool import CognitoUserPool
+from imports.aws.cognito_user_pool_domain import CognitoUserPoolDomain
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = CognitoUserPool(self, "example",
+            name="example-pool"
+        )
+        CognitoUserPoolDomain(self, "main",
+            domain="example-domain",
+            user_pool_id=example.id
+        )
+```
+
+### Custom Cognito domain
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cognito_user_pool import CognitoUserPool
+from imports.aws.cognito_user_pool_domain import CognitoUserPoolDomain
+from imports.aws.data_aws_route53_zone import DataAwsRoute53Zone
+from imports.aws.route53_record import Route53Record
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = CognitoUserPool(self, "example",
+            name="example-pool"
+        )
+        main = CognitoUserPoolDomain(self, "main",
+            certificate_arn=cert.arn,
+            domain="example-domain",
+            user_pool_id=example.id
+        )
+        data_aws_route53_zone_example = DataAwsRoute53Zone(self, "example_2",
+            name="example.com"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_route53_zone_example.override_logical_id("example")
+        Route53Record(self, "auth-cognito-A",
+            alias=Route53RecordAlias(
+                evaluate_target_health=False,
+                name=main.cloudfront_distribution,
+                zone_id=main.cloudfront_distribution_zone_id
+            ),
+            name=main.domain,
+            type="A",
+            zone_id=Token.as_string(data_aws_route53_zone_example.zone_id)
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `domain` - (Required) For custom domains, this is the fully-qualified domain name, such as auth.example.com. For Amazon Cognito prefix domains, this is the prefix alone, such as auth.
+* `user_pool_id` - (Required) The user pool ID.
+* `certificate_arn` - (Optional) The ARN of an ISSUED ACM certificate in us-east-1 for a custom domain.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `aws_account_id` - The AWS account ID for the user pool owner.
+* `cloudfront_distribution` - The Amazon CloudFront endpoint (e.g. `dpp0gtxikpq3y.cloudfront.net`) that you use as the target of the alias that you set up with your Domain Name Service (DNS) provider.
+* `cloudfront_distribution_arn` - The URL of the CloudFront distribution. This is required to generate the ALIAS `aws_route53_record`
+* `cloudfront_distribution_zone_id` - The Route 53 hosted zone ID of the CloudFront distribution.
+* `s3_bucket` - The S3 bucket where the static files for this domain are stored.
+* `version` - The app version.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Cognito User Pool Domains using the `domain`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Cognito User Pool Domains using the `domain`. For example:
+
+```console
+% terraform import aws_cognito_user_pool_domain.main auth.example.org
+```
+
+<!-- cache-key: cdktf-0.18.0 input-733a59c8cc009e81485e84116993b875f945dcad026524678e85b20d84780cc3 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/cognito_user_pool_ui_customization.html.markdown b/website/docs/cdktf/python/r/cognito_user_pool_ui_customization.html.markdown
new file mode 100644
index 00000000000..4fab988261b
--- /dev/null
+++ b/website/docs/cdktf/python/r/cognito_user_pool_ui_customization.html.markdown
@@ -0,0 +1,134 @@
+---
+subcategory: "Cognito IDP (Identity Provider)"
+layout: "aws"
+page_title: "AWS: aws_cognito_user_pool_ui_customization"
+description: |-
+  Provides a Cognito User Pool UI Customization resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cognito_user_pool_ui_customization
+
+Provides a Cognito User Pool UI Customization resource.
+
+~> **Note:** To use this resource, the user pool must have a domain associated with it. For more information, see the Amazon Cognito Developer Guide on [Customizing the Built-in Sign-In and Sign-up Webpages](https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-app-ui-customization.html).
+
+## Example Usage
+
+### UI customization settings for a single client
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, Fn, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cognito_user_pool import CognitoUserPool
+from imports.aws.cognito_user_pool_client import CognitoUserPoolClient
+from imports.aws.cognito_user_pool_domain import CognitoUserPoolDomain
+from imports.aws.cognito_user_pool_ui_customization import CognitoUserPoolUiCustomization
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = CognitoUserPool(self, "example",
+            name="example"
+        )
+        aws_cognito_user_pool_client_example = CognitoUserPoolClient(self, "example_1",
+            name="example",
+            user_pool_id=example.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_cognito_user_pool_client_example.override_logical_id("example")
+        aws_cognito_user_pool_domain_example = CognitoUserPoolDomain(self, "example_2",
+            domain="example",
+            user_pool_id=example.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_cognito_user_pool_domain_example.override_logical_id("example")
+        aws_cognito_user_pool_ui_customization_example =
+        CognitoUserPoolUiCustomization(self, "example_3",
+            client_id=Token.as_string(aws_cognito_user_pool_client_example.id),
+            css=".label-customizable {font-weight: 400;}",
+            image_file=Token.as_string(Fn.filebase64("logo.png")),
+            user_pool_id=Token.as_string(aws_cognito_user_pool_domain_example.user_pool_id)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_cognito_user_pool_ui_customization_example.override_logical_id("example")
+```
+
+### UI customization settings for all clients
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cognito_user_pool import CognitoUserPool
+from imports.aws.cognito_user_pool_domain import CognitoUserPoolDomain
+from imports.aws.cognito_user_pool_ui_customization import CognitoUserPoolUiCustomization
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = CognitoUserPool(self, "example",
+            name="example"
+        )
+        aws_cognito_user_pool_domain_example = CognitoUserPoolDomain(self, "example_1",
+            domain="example",
+            user_pool_id=example.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_cognito_user_pool_domain_example.override_logical_id("example")
+        aws_cognito_user_pool_ui_customization_example =
+        CognitoUserPoolUiCustomization(self, "example_2",
+            css=".label-customizable {font-weight: 400;}",
+            image_file=Token.as_string(Fn.filebase64("logo.png")),
+            user_pool_id=Token.as_string(aws_cognito_user_pool_domain_example.user_pool_id)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_cognito_user_pool_ui_customization_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `client_id` (Optional) The client ID for the client app. Defaults to `ALL`. If `ALL` is specified, the `css` and/or `image_file` settings will be used for every client that has no UI customization set previously.
+* `css` (Optional) - The CSS values in the UI customization, provided as a String. At least one of `css` or `image_file` is required.
+* `image_file` (Optional) - The uploaded logo image for the UI customization, provided as a base64-encoded String. Drift detection is not possible for this argument. At least one of `css` or `image_file` is required.
+* `user_pool_id` (Required) - The user pool ID for the user pool.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `creation_date` - The creation date in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8) for the UI customization.
+* `css_version` - The CSS version number.
+* `image_url` - The logo image URL for the UI customization.
+* `last_modified_date` - The last-modified date in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8) for the UI customization.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Cognito User Pool UI Customizations using the `user_pool_id` and `client_id` separated by `,`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Cognito User Pool UI Customizations using the `user_pool_id` and `client_id` separated by `,`. For example:
+
+```console
+% terraform import aws_cognito_user_pool_ui_customization.example us-west-2_ZCTarbt5C,12bu4fuk3mlgqa2rtrujgp6egq
+```
+
+<!-- cache-key: cdktf-0.18.0 input-bf4b70b595c743ddb747623355c0d273cc993578aa1b9483b75e196d7e5ca18c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/comprehend_document_classifier.html.markdown b/website/docs/cdktf/python/r/comprehend_document_classifier.html.markdown
new file mode 100644
index 00000000000..02acafb8679
--- /dev/null
+++ b/website/docs/cdktf/python/r/comprehend_document_classifier.html.markdown
@@ -0,0 +1,162 @@
+---
+subcategory: "Comprehend"
+layout: "aws"
+page_title: "AWS: aws_comprehend_document_classifier"
+description: |-
+  Terraform resource for managing an AWS Comprehend Document Classifier.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_comprehend_document_classifier
+
+Terraform resource for managing an AWS Comprehend Document Classifier.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.comprehend_document_classifier import ComprehendDocumentClassifier
+from imports.aws.s3_object import S3Object
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, bucket, key, bucket1, key1):
+        super().__init__(scope, name)
+        documents = S3Object(self, "documents",
+            bucket=bucket,
+            key=key
+        )
+        S3Object(self, "entities",
+            bucket=bucket1,
+            key=key1
+        )
+        ComprehendDocumentClassifier(self, "example",
+            data_access_role_arn=Token.as_string(aws_iam_role_example.arn),
+            depends_on=[aws_iam_role_policy_example],
+            input_data_config=ComprehendDocumentClassifierInputDataConfig(
+                s3_uri="s3://${" + test.bucket + "}/${" + documents.id + "}"
+            ),
+            language_code="en",
+            name="example"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `data_access_role_arn` - (Required) The ARN for an IAM Role which allows Comprehend to read the training and testing data.
+* `input_data_config` - (Required) Configuration for the training and testing data.
+  See the [`input_data_config` Configuration Block](#input_data_config-configuration-block) section below.
+* `language_code` - (Required) Two-letter language code for the language.
+  One of `en`, `es`, `fr`, `it`, `de`, or `pt`.
+* `name` - (Required) Name for the Document Classifier.
+  Has a maximum length of 63 characters.
+  Can contain upper- and lower-case letters, numbers, and hypen (`-`).
+
+The following arguments are optional:
+
+* `mode` - (Optional, Default: `MULTI_CLASS`) The document classification mode.
+  One of `MULTI_CLASS` or `MULTI_LABEL`.
+  `MULTI_CLASS` is also known as "Single Label" in the AWS Console.
+* `model_kms_key_id` - (Optional) KMS Key used to encrypt trained Document Classifiers.
+  Can be a KMS Key ID or a KMS Key ARN.
+* `output_data_config` - (Optional) Configuration for the output results of training.
+  See the [`output_data_config` Configuration Block](#output_data_config-configuration-block) section below.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` Configuration Block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `version_name` - (Optional) Name for the version of the Document Classifier.
+  Each version must have a unique name within the Document Classifier.
+  If omitted, Terraform will assign a random, unique version name.
+  If explicitly set to `""`, no version name will be set.
+  Has a maximum length of 63 characters.
+  Can contain upper- and lower-case letters, numbers, and hypen (`-`).
+  Conflicts with `version_name_prefix`.
+* `version_name_prefix` - (Optional) Creates a unique version name beginning with the specified prefix.
+  Has a maximum length of 37 characters.
+  Can contain upper- and lower-case letters, numbers, and hypen (`-`).
+  Conflicts with `version_name`.
+* `volume_kms_key_id` - (Optional) KMS Key used to encrypt storage volumes during job processing.
+  Can be a KMS Key ID or a KMS Key ARN.
+* `vpc_config` - (Optional) Configuration parameters for VPC to contain Document Classifier resources.
+  See the [`vpc_config` Configuration Block](#vpc_config-configuration-block) section below.
+
+### `input_data_config` Configuration Block
+
+* `augmented_manifests` - (Optional) List of training datasets produced by Amazon SageMaker Ground Truth.
+  Used if `data_format` is `AUGMENTED_MANIFEST`.
+  See the [`augmented_manifests` Configuration Block](#augmented_manifests-configuration-block) section below.
+* `data_format` - (Optional, Default: `COMPREHEND_CSV`) The format for the training data.
+  One of `COMPREHEND_CSV` or `AUGMENTED_MANIFEST`.
+* `label_delimiter` - (Optional) Delimiter between labels when training a multi-label classifier.
+  Valid values are `|`, `~`, `!`, `@`, `#`, `$`, `%`, `^`, `*`, `-`, `_`, `+`, `=`, `\`, `:`, `;`, `>`, `?`, `/`, `<space>`, and `<tab>`.
+  Default is `|`.
+* `s3_uri` - (Optional) Location of training documents.
+  Used if `data_format` is `COMPREHEND_CSV`.
+* `test_s3uri` - (Optional) Location of test documents.
+
+### `augmented_manifests` Configuration Block
+
+* `annotation_data_s3_uri` - (Optional) Location of annotation files.
+* `attribute_names` - (Required) The JSON attribute that contains the annotations for the training documents.
+* `document_type` - (Optional, Default: `PLAIN_TEXT_DOCUMENT`) Type of augmented manifest.
+  One of `PLAIN_TEXT_DOCUMENT` or `SEMI_STRUCTURED_DOCUMENT`.
+* `s3_uri` - (Required) Location of augmented manifest file.
+* `source_documents_s3_uri` - (Optional) Location of source PDF files.
+* `split` - (Optional, Default: `TRAIN`) Purpose of data in augmented manifest.
+  One of `TRAIN` or `TEST`.
+
+### `output_data_config` Configuration Block
+
+* `kms_key_id` - (Optional) KMS Key used to encrypt the output documents.
+  Can be a KMS Key ID, a KMS Key ARN, a KMS Alias name, or a KMS Alias ARN.
+* `output_s3_uri` - (Computed) Full path for the output documents.
+* `s3_uri` - (Required) Destination path for the output documents.
+  The full path to the output file will be returned in `output_s3_uri`.
+
+### `vpc_config` Configuration Block
+
+* `security_group_ids` - (Required) List of security group IDs.
+* `subnets` - (Required) List of VPC subnets.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Document Classifier version.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block).
+
+## Timeouts
+
+`aws_comprehend_document_classifier` provides the following [Timeouts](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts) configuration options:
+
+* `create` - (Optional, Default: `60m`)
+* `update` - (Optional, Default: `60m`)
+* `delete` - (Optional, Default: `30m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Comprehend Document Classifier using the ARN. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Comprehend Document Classifier using the ARN. For example:
+
+```console
+% terraform import aws_comprehend_document_classifier.example arn:aws:comprehend:us-west-2:123456789012:document_classifier/example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-3bdf44a11e1e62cc863f8955dc4387827ea8dcfb6ef1cd3b96e5d632e2eea8cf -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/comprehend_entity_recognizer.html.markdown b/website/docs/cdktf/python/r/comprehend_entity_recognizer.html.markdown
new file mode 100644
index 00000000000..548e83d3b78
--- /dev/null
+++ b/website/docs/cdktf/python/r/comprehend_entity_recognizer.html.markdown
@@ -0,0 +1,185 @@
+---
+subcategory: "Comprehend"
+layout: "aws"
+page_title: "AWS: aws_comprehend_entity_recognizer"
+description: |-
+  Terraform resource for managing an AWS Comprehend Entity Recognizer.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_comprehend_entity_recognizer
+
+Terraform resource for managing an AWS Comprehend Entity Recognizer.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.comprehend_entity_recognizer import ComprehendEntityRecognizer
+from imports.aws.s3_object import S3Object
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, bucket, key, bucket1, key1):
+        super().__init__(scope, name)
+        documents = S3Object(self, "documents",
+            bucket=bucket,
+            key=key
+        )
+        entities = S3Object(self, "entities",
+            bucket=bucket1,
+            key=key1
+        )
+        ComprehendEntityRecognizer(self, "example",
+            data_access_role_arn=Token.as_string(aws_iam_role_example.arn),
+            depends_on=[aws_iam_role_policy_example],
+            input_data_config=ComprehendEntityRecognizerInputDataConfig(
+                documents=ComprehendEntityRecognizerInputDataConfigDocuments(
+                    s3_uri="s3://${" + aws_s3_bucket_documents.bucket + "}/${" + documents.id + "}"
+                ),
+                entity_list=ComprehendEntityRecognizerInputDataConfigEntityListStruct(
+                    s3_uri="s3://${" + aws_s3_bucket_entities.bucket + "}/${" + entities.id + "}"
+                ),
+                entity_types=[ComprehendEntityRecognizerInputDataConfigEntityTypes(
+                    type="ENTITY_1"
+                ), ComprehendEntityRecognizerInputDataConfigEntityTypes(
+                    type="ENTITY_2"
+                )
+                ]
+            ),
+            language_code="en",
+            name="example"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `data_access_role_arn` - (Required) The ARN for an IAM Role which allows Comprehend to read the training and testing data.
+* `input_data_config` - (Required) Configuration for the training and testing data.
+  See the [`input_data_config` Configuration Block](#input_data_config-configuration-block) section below.
+* `language_code` - (Required) Two-letter language code for the language.
+  One of `en`, `es`, `fr`, `it`, `de`, or `pt`.
+* `name` - (Required) Name for the Entity Recognizer.
+  Has a maximum length of 63 characters.
+  Can contain upper- and lower-case letters, numbers, and hypen (`-`).
+
+The following arguments are optional:
+
+* `model_kms_key_id` - (Optional) The ID or ARN of a KMS Key used to encrypt trained Entity Recognizers.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` Configuration Block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `version_name` - (Optional) Name for the version of the Entity Recognizer.
+  Each version must have a unique name within the Entity Recognizer.
+  If omitted, Terraform will assign a random, unique version name.
+  If explicitly set to `""`, no version name will be set.
+  Has a maximum length of 63 characters.
+  Can contain upper- and lower-case letters, numbers, and hypen (`-`).
+  Conflicts with `version_name_prefix`.
+* `version_name_prefix` - (Optional) Creates a unique version name beginning with the specified prefix.
+  Has a maximum length of 37 characters.
+  Can contain upper- and lower-case letters, numbers, and hypen (`-`).
+  Conflicts with `version_name`.
+* `volume_kms_key_id` - (Optional) ID or ARN of a KMS Key used to encrypt storage volumes during job processing.
+* `vpc_config` - (Optional) Configuration parameters for VPC to contain Entity Recognizer resources.
+  See the [`vpc_config` Configuration Block](#vpc_config-configuration-block) section below.
+
+### `input_data_config` Configuration Block
+
+* `annotations` - (Optional) Specifies location of the document annotation data.
+  See the [`annotations` Configuration Block](#annotations-configuration-block) section below.
+  One of `annotations` or `entity_list` is required.
+* `augmented_manifests` - (Optional) List of training datasets produced by Amazon SageMaker Ground Truth.
+  Used if `data_format` is `AUGMENTED_MANIFEST`.
+  See the [`augmented_manifests` Configuration Block](#augmented_manifests-configuration-block) section below.
+* `data_format` - (Optional, Default: `COMPREHEND_CSV`) The format for the training data.
+  One of `COMPREHEND_CSV` or `AUGMENTED_MANIFEST`.
+* `documents` - (Optional) Specifies a collection of training documents.
+  Used if `data_format` is `COMPREHEND_CSV`.
+  See the [`documents` Configuration Block](#documents-configuration-block) section below.
+* `entity_list` - (Optional) Specifies location of the entity list data.
+  See the [`entity_list` Configuration Block](#entity_list-configuration-block) section below.
+  One of `entity_list` or `annotations` is required.
+* `entity_types` - (Required) Set of entity types to be recognized.
+  Has a maximum of 25 items.
+  See the [`entity_types` Configuration Block](#entity_types-configuration-block) section below.
+
+### `annotations` Configuration Block
+
+* `s3_uri` - (Required) Location of training annotations.
+* `test_s3uri` - (Optional) Location of test annotations.
+
+### `augmented_manifests` Configuration Block
+
+* `annotation_data_s3_uri` - (Optional) Location of annotation files.
+* `attribute_names` - (Required) The JSON attribute that contains the annotations for the training documents.
+* `document_type` - (Optional, Default: `PLAIN_TEXT_DOCUMENT`) Type of augmented manifest.
+  One of `PLAIN_TEXT_DOCUMENT` or `SEMI_STRUCTURED_DOCUMENT`.
+* `s3_uri` - (Required) Location of augmented manifest file.
+* `source_documents_s3_uri` - (Optional) Location of source PDF files.
+* `split` - (Optional, Default: `TRAIN`) Purpose of data in augmented manifest.
+  One of `TRAIN` or `TEST`.
+
+### `documents` Configuration Block
+
+* `input_format` - (Optional, Default: `ONE_DOC_PER_LINE`) Specifies how the input files should be processed.
+  One of `ONE_DOC_PER_LINE` or `ONE_DOC_PER_FILE`.
+* `s3_uri` - (Required) Location of training documents.
+* `test_s3uri` - (Optional) Location of test documents.
+
+### `entity_list` Configuration Block
+
+* `s3_uri` - (Required) Location of entity list.
+
+### `entity_types` Configuration Block
+
+* `type` - (Required) An entity type to be matched by the Entity Recognizer.
+  Cannot contain a newline (`\n`), carriage return (`\r`), or tab (`\t`).
+
+### `vpc_config` Configuration Block
+
+* `security_group_ids` - (Required) List of security group IDs.
+* `subnets` - (Required) List of VPC subnets.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Entity Recognizer version.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block).
+
+## Timeouts
+
+`aws_comprehend_entity_recognizer` provides the following [Timeouts](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts) configuration options:
+
+* `create` - (Optional, Default: `60m`)
+* `update` - (Optional, Default: `60m`)
+* `delete` - (Optional, Default: `30m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Comprehend Entity Recognizer using the ARN. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Comprehend Entity Recognizer using the ARN. For example:
+
+```console
+% terraform import aws_comprehend_entity_recognizer.example arn:aws:comprehend:us-west-2:123456789012:entity-recognizer/example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-5a4f330d945c67ebd2c327cc9ed1a4d3cbd7331cc6eefe3c8b6a54590b34a394 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/config_aggregate_authorization.html.markdown b/website/docs/cdktf/python/r/config_aggregate_authorization.html.markdown
new file mode 100644
index 00000000000..4a28729cab5
--- /dev/null
+++ b/website/docs/cdktf/python/r/config_aggregate_authorization.html.markdown
@@ -0,0 +1,69 @@
+---
+subcategory: "Config"
+layout: "aws"
+page_title: "AWS: aws_config_aggregate_authorization"
+description: |-
+  Manages an AWS Config Aggregate Authorization.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_config_aggregate_authorization
+
+Manages an AWS Config Aggregate Authorization
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.config_aggregate_authorization import ConfigAggregateAuthorization
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ConfigAggregateAuthorization(self, "example",
+            account_id="123456789012",
+            region="eu-west-2"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `account_id` - (Required) Account ID
+* `region` - (Required) Region
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the authorization
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Config aggregate authorizations using `account_id:region`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Config aggregate authorizations using `account_id:region`. For example:
+
+```console
+% terraform import aws_config_aggregate_authorization.example 123456789012:us-east-1
+```
+
+<!-- cache-key: cdktf-0.18.0 input-4204f5d9e939a49ac26b9c31dd13e4a4acdca6966654b750d69b34875f0ffb29 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/config_aggregate_authorization.markdown b/website/docs/cdktf/python/r/config_aggregate_authorization.markdown
new file mode 100644
index 00000000000..4a28729cab5
--- /dev/null
+++ b/website/docs/cdktf/python/r/config_aggregate_authorization.markdown
@@ -0,0 +1,69 @@
+---
+subcategory: "Config"
+layout: "aws"
+page_title: "AWS: aws_config_aggregate_authorization"
+description: |-
+  Manages an AWS Config Aggregate Authorization.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_config_aggregate_authorization
+
+Manages an AWS Config Aggregate Authorization
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.config_aggregate_authorization import ConfigAggregateAuthorization
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ConfigAggregateAuthorization(self, "example",
+            account_id="123456789012",
+            region="eu-west-2"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `account_id` - (Required) Account ID
+* `region` - (Required) Region
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the authorization
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Config aggregate authorizations using `account_id:region`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Config aggregate authorizations using `account_id:region`. For example:
+
+```console
+% terraform import aws_config_aggregate_authorization.example 123456789012:us-east-1
+```
+
+<!-- cache-key: cdktf-0.18.0 input-4204f5d9e939a49ac26b9c31dd13e4a4acdca6966654b750d69b34875f0ffb29 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/config_config_rule.html.markdown b/website/docs/cdktf/python/r/config_config_rule.html.markdown
new file mode 100644
index 00000000000..e9e8a148206
--- /dev/null
+++ b/website/docs/cdktf/python/r/config_config_rule.html.markdown
@@ -0,0 +1,243 @@
+---
+subcategory: "Config"
+layout: "aws"
+page_title: "AWS: aws_config_config_rule"
+description: |-
+  Provides an AWS Config Rule.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_config_config_rule
+
+Provides an AWS Config Rule.
+
+~> **Note:** Config Rule requires an existing [Configuration Recorder](/docs/providers/aws/r/config_configuration_recorder.html) to be present. Use of `depends_on` is recommended (as shown below) to avoid race conditions.
+
+## Example Usage
+
+### AWS Managed Rules
+
+AWS managed rules can be used by setting the source owner to `AWS` and the source identifier to the name of the managed rule. More information about AWS managed rules can be found in the [AWS Config Developer Guide](https://docs.aws.amazon.com/config/latest/developerguide/evaluate-config_use-managed-rules.html).
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.config_config_rule import ConfigConfigRule
+from imports.aws.config_configuration_recorder import ConfigConfigurationRecorder
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.iam_role import IamRole
+from imports.aws.iam_role_policy import IamRolePolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        assume_role = DataAwsIamPolicyDocument(self, "assume_role",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["sts:AssumeRole"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["config.amazonaws.com"],
+                    type="Service"
+                )
+                ]
+            )
+            ]
+        )
+        p = DataAwsIamPolicyDocument(self, "p",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["config:Put*"],
+                effect="Allow",
+                resources=["*"]
+            )
+            ]
+        )
+        r = IamRole(self, "r",
+            assume_role_policy=Token.as_string(assume_role.json),
+            name="my-awsconfig-role"
+        )
+        aws_iam_role_policy_p = IamRolePolicy(self, "p_3",
+            name="my-awsconfig-policy",
+            policy=Token.as_string(p.json),
+            role=r.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_role_policy_p.override_logical_id("p")
+        foo = ConfigConfigurationRecorder(self, "foo",
+            name="example",
+            role_arn=r.arn
+        )
+        aws_config_config_rule_r = ConfigConfigRule(self, "r_5",
+            depends_on=[foo],
+            name="example",
+            source=ConfigConfigRuleSource(
+                owner="AWS",
+                source_identifier="S3_BUCKET_VERSIONING_ENABLED"
+            )
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_config_config_rule_r.override_logical_id("r")
+```
+
+### Custom Rules
+
+Custom rules can be used by setting the source owner to `CUSTOM_LAMBDA` and the source identifier to the Amazon Resource Name (ARN) of the Lambda Function. The AWS Config service must have permissions to invoke the Lambda Function, e.g., via the [`aws_lambda_permission` resource](/docs/providers/aws/r/lambda_permission.html). More information about custom rules can be found in the [AWS Config Developer Guide](https://docs.aws.amazon.com/config/latest/developerguide/evaluate-config_develop-rules.html).
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.config_config_rule import ConfigConfigRule
+from imports.aws.config_configuration_recorder import ConfigConfigurationRecorder
+from imports.aws.lambda_function import LambdaFunction
+from imports.aws.lambda_permission import LambdaPermission
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, roleArn, functionName, role, name):
+        super().__init__(scope, name)
+        example = ConfigConfigurationRecorder(self, "example",
+            role_arn=role_arn
+        )
+        aws_lambda_function_example = LambdaFunction(self, "example_1",
+            function_name=function_name,
+            role=role
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_lambda_function_example.override_logical_id("example")
+        aws_lambda_permission_example = LambdaPermission(self, "example_2",
+            action="lambda:InvokeFunction",
+            function_name=Token.as_string(aws_lambda_function_example.arn),
+            principal="config.amazonaws.com",
+            statement_id="AllowExecutionFromConfig"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_lambda_permission_example.override_logical_id("example")
+        aws_config_config_rule_example = ConfigConfigRule(self, "example_3",
+            depends_on=[example, aws_lambda_permission_example],
+            source=ConfigConfigRuleSource(
+                owner="CUSTOM_LAMBDA",
+                source_identifier=Token.as_string(aws_lambda_function_example.arn)
+            ),
+            name=name
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_config_config_rule_example.override_logical_id("example")
+```
+
+### Custom Policies
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.config_config_rule import ConfigConfigRule
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ConfigConfigRule(self, "example",
+            name="example",
+            source=ConfigConfigRuleSource(
+                custom_policy_details=ConfigConfigRuleSourceCustomPolicyDetails(
+                    policy_runtime="guard-2.x.x",
+                    policy_text="\t  rule tableisactive when\n\t\t  resourceType == \"AWS::DynamoDB::Table\" {\n\t\t  configuration.tableStatus == ['ACTIVE']\n\t  }\n\t  \n\t  rule checkcompliance when\n\t\t  resourceType == \"AWS::DynamoDB::Table\"\n\t\t  tableisactive {\n\t\t\t  supplementaryConfiguration.ContinuousBackupsDescription.pointInTimeRecoveryDescription.pointInTimeRecoveryStatus == \"ENABLED\"\n\t  }\n\n"
+                ),
+                owner="CUSTOM_POLICY",
+                source_detail=[ConfigConfigRuleSourceSourceDetail(
+                    message_type="ConfigurationItemChangeNotification"
+                )
+                ]
+            )
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the rule
+* `description` - (Optional) Description of the rule
+* `evaluation_mode` - (Optional) The modes the Config rule can be evaluated in. See [Evaluation Mode](#evaluation-mode) for more details.
+* `input_parameters` - (Optional) A string in JSON format that is passed to the AWS Config rule Lambda function.
+* `maximum_execution_frequency` - (Optional) The maximum frequency with which AWS Config runs evaluations for a rule.
+* `scope` - (Optional) Scope defines which resources can trigger an evaluation for the rule. See [Source](#source) Below.
+* `source` - (Required) Source specifies the rule owner, the rule identifier, and the notifications that cause the function to evaluate your AWS resources. See [Scope](#scope) Below.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Evaluation Mode
+
+* `mode` - (Optional) The mode of an evaluation.
+
+### Scope
+
+Defines which resources can trigger an evaluation for the rule.
+If you do not specify a scope, evaluations are triggered when any resource in the recording group changes.
+
+* `compliance_resource_id` - (Optional) The IDs of the only AWS resource that you want to trigger an evaluation for the rule. If you specify a resource ID, you must specify one resource type for `compliance_resource_types`.
+* `compliance_resource_types` - (Optional) A list of resource types of only those AWS resources that you want to trigger an evaluation for the ruleE.g., `AWS::EC2::Instance`. You can only specify one type if you also specify a resource ID for `compliance_resource_id`. See [relevant part of AWS Docs](http://docs.aws.amazon.com/config/latest/APIReference/API_ResourceIdentifier.html#config-Type-ResourceIdentifier-resourceType) for available types.
+* `tag_key` - (Optional, Required if `tag_value` is specified) The tag key that is applied to only those AWS resources that you want you want to trigger an evaluation for the rule.
+* `tag_value` - (Optional) The tag value applied to only those AWS resources that you want to trigger an evaluation for the rule.
+
+### Source
+
+Provides the rule owner (AWS or customer), the rule identifier, and the notifications that cause the function to evaluate your AWS resources.
+
+* `owner` - (Required) Indicates whether AWS or the customer owns and manages the AWS Config rule. Valid values are `AWS`, `CUSTOM_LAMBDA` or `CUSTOM_POLICY`. For more information about managed rules, see the [AWS Config Managed Rules documentation](https://docs.aws.amazon.com/config/latest/developerguide/evaluate-config_use-managed-rules.html). For more information about custom rules, see the [AWS Config Custom Rules documentation](https://docs.aws.amazon.com/config/latest/developerguide/evaluate-config_develop-rules.html). Custom Lambda Functions require permissions to allow the AWS Config service to invoke them, e.g., via the [`aws_lambda_permission` resource](/docs/providers/aws/r/lambda_permission.html).
+* `source_identifier` - (Optional) For AWS Config managed rules, a predefined identifier, e.g `IAM_PASSWORD_POLICY`. For custom Lambda rules, the identifier is the ARN of the Lambda Function, such as `arn:aws:lambda:us-east-1:123456789012:function:custom_rule_name` or the [`arn` attribute of the `aws_lambda_function` resource](/docs/providers/aws/r/lambda_function.html#arn).
+* `source_detail` - (Optional) Provides the source and type of the event that causes AWS Config to evaluate your AWS resources. Only valid if `owner` is `CUSTOM_LAMBDA` or `CUSTOM_POLICY`. See [Source Detail](#source-detail) Below.
+* `custom_policy_details` - (Optional) Provides the runtime system, policy definition, and whether debug logging is enabled. Required when owner is set to `CUSTOM_POLICY`. See [Custom Policy Details](#custom-policy-details) Below.
+
+#### Source Detail
+
+* `event_source` - (Optional) The source of the event, such as an AWS service, that triggers AWS Config to evaluate your AWSresources. This defaults to `aws.config` and is the only valid value.
+* `maximum_execution_frequency` - (Optional) The frequency that you want AWS Config to run evaluations for a rule that istriggered periodically. If specified, requires `message_type` to be `ScheduledNotification`.
+* `message_type` - (Optional) The type of notification that triggers AWS Config to run an evaluation for a rule. You canspecify the following notification types:
+    * `ConfigurationItemChangeNotification` - Triggers an evaluation when AWS Config delivers a configuration item as a result of a resource change.
+    * `OversizedConfigurationItemChangeNotification` - Triggers an evaluation when AWS Config delivers an oversized configuration item. AWS Config may generate this notification type when a resource changes and the notification exceeds the maximum size allowed by Amazon SNS.
+    * `ScheduledNotification` - Triggers a periodic evaluation at the frequency specified for `maximum_execution_frequency`.
+    * `ConfigurationSnapshotDeliveryCompleted` - Triggers a periodic evaluation when AWS Config delivers a configuration snapshot.
+
+#### Custom Policy Details
+
+* `enable_debug_log_delivery` - (Optional) The boolean expression for enabling debug logging for your Config Custom Policy rule. The default value is `false`.
+* `policy_runtime` - (Required) The runtime system for your Config Custom Policy rule. Guard is a policy-as-code language that allows you to write policies that are enforced by Config Custom Policy rules. For more information about Guard, see the [Guard GitHub Repository](https://github.com/aws-cloudformation/cloudformation-guard).
+* `policy_text` - (Required) The policy definition containing the logic for your Config Custom Policy rule.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the config rule
+* `rule_id` - The ID of the config rule
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Config Rule using the name. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Config Rule using the name. For example:
+
+```console
+% terraform import aws_config_config_rule.foo example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ddaef59fa5f30160f091633e8659aa1541092b84b1622013d4f61c51640fbed0 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/config_configuration_aggregator.html.markdown b/website/docs/cdktf/python/r/config_configuration_aggregator.html.markdown
new file mode 100644
index 00000000000..a5d094dd5c4
--- /dev/null
+++ b/website/docs/cdktf/python/r/config_configuration_aggregator.html.markdown
@@ -0,0 +1,147 @@
+---
+subcategory: "Config"
+layout: "aws"
+page_title: "AWS: aws_config_configuration_aggregator"
+description: |-
+  Manages an AWS Config Configuration Aggregator.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_config_configuration_aggregator
+
+Manages an AWS Config Configuration Aggregator
+
+## Example Usage
+
+### Account Based Aggregation
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.config_configuration_aggregator import ConfigConfigurationAggregator
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ConfigConfigurationAggregator(self, "account",
+            account_aggregation_source=ConfigConfigurationAggregatorAccountAggregationSource(
+                account_ids=["123456789012"],
+                regions=["us-west-2"]
+            ),
+            name="example"
+        )
+```
+
+### Organization Based Aggregation
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.config_configuration_aggregator import ConfigConfigurationAggregator
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.iam_role import IamRole
+from imports.aws.iam_role_policy_attachment import IamRolePolicyAttachment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        assume_role = DataAwsIamPolicyDocument(self, "assume_role",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["sts:AssumeRole"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["config.amazonaws.com"],
+                    type="Service"
+                )
+                ]
+            )
+            ]
+        )
+        organization = IamRole(self, "organization",
+            assume_role_policy=Token.as_string(assume_role.json),
+            name="example"
+        )
+        aws_iam_role_policy_attachment_organization = IamRolePolicyAttachment(self, "organization_2",
+            policy_arn="arn:aws:iam::aws:policy/service-role/AWSConfigRoleForOrganizations",
+            role=organization.name
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_role_policy_attachment_organization.override_logical_id("organization")
+        aws_config_configuration_aggregator_organization =
+        ConfigConfigurationAggregator(self, "organization_3",
+            depends_on=[aws_iam_role_policy_attachment_organization],
+            name="example",
+            organization_aggregation_source=ConfigConfigurationAggregatorOrganizationAggregationSource(
+                all_regions=True,
+                role_arn=organization.arn
+            )
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_config_configuration_aggregator_organization.override_logical_id("organization")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the configuration aggregator.
+* `account_aggregation_source` - (Optional) The account(s) to aggregate config data from as documented below.
+* `organization_aggregation_source` - (Optional) The organization to aggregate config data from as documented below.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+Either `account_aggregation_source` or `organization_aggregation_source` must be specified.
+
+### `account_aggregation_source`
+
+* `account_ids` - (Required) List of 12-digit account IDs of the account(s) being aggregated.
+* `all_regions` - (Optional) If true, aggregate existing AWS Config regions and future regions.
+* `regions` - (Optional) List of source regions being aggregated.
+
+Either `regions` or `all_regions` (as true) must be specified.
+
+### `organization_aggregation_source`
+
+~> **Note:** If your source type is an organization, you must be signed in to the master account and all features must be enabled in your organization. AWS Config calls EnableAwsServiceAccess API to enable integration between AWS Config and AWS Organizations.
+
+* `all_regions` - (Optional) If true, aggregate existing AWS Config regions and future regions.
+* `regions` - (Optional) List of source regions being aggregated.
+* `role_arn` - (Required) ARN of the IAM role used to retrieve AWS Organization details associated with the aggregator account.
+
+Either `regions` or `all_regions` (as true) must be specified.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the aggregator
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Configuration Aggregators using the name. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Configuration Aggregators using the name. For example:
+
+```console
+% terraform import aws_config_configuration_aggregator.example foo
+```
+
+<!-- cache-key: cdktf-0.18.0 input-bd7368dc645892d0916218e47f2c57cc5932d586ba0ba2eedc64e2d5eb4009f8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/config_configuration_recorder.html.markdown b/website/docs/cdktf/python/r/config_configuration_recorder.html.markdown
new file mode 100644
index 00000000000..e76b84248cb
--- /dev/null
+++ b/website/docs/cdktf/python/r/config_configuration_recorder.html.markdown
@@ -0,0 +1,137 @@
+---
+subcategory: "Config"
+layout: "aws"
+page_title: "AWS: aws_config_configuration_recorder"
+description: |-
+  Provides an AWS Config Configuration Recorder.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_config_configuration_recorder
+
+Provides an AWS Config Configuration Recorder. Please note that this resource **does not start** the created recorder automatically.
+
+~> **Note:** _Starting_ the Configuration Recorder requires a [delivery channel](/docs/providers/aws/r/config_delivery_channel.html) (while delivery channel creation requires Configuration Recorder). This is why [`aws_config_configuration_recorder_status`](/docs/providers/aws/r/config_configuration_recorder_status.html) is a separate resource.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.config_configuration_recorder import ConfigConfigurationRecorder
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.iam_role import IamRole
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        assume_role = DataAwsIamPolicyDocument(self, "assume_role",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["sts:AssumeRole"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["config.amazonaws.com"],
+                    type="Service"
+                )
+                ]
+            )
+            ]
+        )
+        r = IamRole(self, "r",
+            assume_role_policy=Token.as_string(assume_role.json),
+            name="awsconfig-example"
+        )
+        ConfigConfigurationRecorder(self, "foo",
+            name="example",
+            role_arn=r.arn
+        )
+```
+
+### Exclude Resources Types Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.config_configuration_recorder import ConfigConfigurationRecorder
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ConfigConfigurationRecorder(self, "foo",
+            name="example",
+            recording_group=ConfigConfigurationRecorderRecordingGroup(
+                all_supported=False,
+                exclusion_by_resource_types=[ConfigConfigurationRecorderRecordingGroupExclusionByResourceTypes(
+                    resource_types=["AWS::EC2::Instance"]
+                )
+                ],
+                recording_strategy=[ConfigConfigurationRecorderRecordingGroupRecordingStrategy(
+                    use_only="EXCLUSION_BY_RESOURCE_TYPES"
+                )
+                ]
+            ),
+            role_arn=r.arn
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Optional) The name of the recorder. Defaults to `default`. Changing it recreates the resource.
+* `role_arn` - (Required) Amazon Resource Name (ARN) of the IAM role. Used to make read or write requests to the delivery channel and to describe the AWS resources associated with the account. See [AWS Docs](http://docs.aws.amazon.com/config/latest/developerguide/iamrole-permissions.html) for more details.
+* `recording_group` - (Optional) Recording group - see below.
+
+### recording_group Configuration Block
+
+* `all_supported` - (Optional) Specifies whether AWS Config records configuration changes for every supported type of regional resource (which includes any new type that will become supported in the future). Conflicts with `resource_types`. Defaults to `true`.
+* `exclusion_by_resource_types` - (Optional) An object that specifies how AWS Config excludes resource types from being recorded by the configuration recorder.To use this option, you must set the useOnly field of RecordingStrategy to `EXCLUSION_BY_RESOURCE_TYPES` Requires `all_supported = false`. Conflicts with `resource_types`.
+* `include_global_resource_types` - (Optional) Specifies whether AWS Config includes all supported types of _global resources_ with the resources that it records. Requires `all_supported = true`. Conflicts with `resource_types`.
+* `recording_strategy` - (Optional) Recording Strategy. Detailed below.
+* `resource_types` - (Optional) A list that specifies the types of AWS resources for which AWS Config records configuration changes (for example, `AWS::EC2::Instance` or `AWS::CloudTrail::Trail`). See [relevant part of AWS Docs](http://docs.aws.amazon.com/config/latest/APIReference/API_ResourceIdentifier.html#config-Type-ResourceIdentifier-resourceType) for available types. In order to use this attribute, `all_supported` must be set to false.
+
+#### exclusion_by_resource_types Configuration Block
+
+* `resource_types` - (Optional) A list that specifies the types of AWS resources for which AWS Config excludes records configuration changes. See [relevant part of AWS Docs](http://docs.aws.amazon.com/config/latest/APIReference/API_ResourceIdentifier.html#config-Type-ResourceIdentifier-resourceType) for available types.
+
+#### recording_strategy Configuration Block
+
+* ` use_only` - (Optional) The recording strategy for the configuration recorder.See [relevant part of AWS Docs](https://docs.aws.amazon.com/config/latest/APIReference/API_RecordingStrategy.html)
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Name of the recorder
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Configuration Recorder using the name. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Configuration Recorder using the name. For example:
+
+```console
+% terraform import aws_config_configuration_recorder.foo example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-f7d9392378b34f2ee90f6663aee76cb66b2d7d72f4eb2ced771d862822d5a3df -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/config_configuration_recorder_status.html.markdown b/website/docs/cdktf/python/r/config_configuration_recorder_status.html.markdown
new file mode 100644
index 00000000000..422b6ff70c0
--- /dev/null
+++ b/website/docs/cdktf/python/r/config_configuration_recorder_status.html.markdown
@@ -0,0 +1,126 @@
+---
+subcategory: "Config"
+layout: "aws"
+page_title: "AWS: aws_config_configuration_recorder_status"
+description: |-
+  Manages status of an AWS Config Configuration Recorder.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_config_configuration_recorder_status
+
+Manages status (recording / stopped) of an AWS Config Configuration Recorder.
+
+~> **Note:** Starting Configuration Recorder requires a [Delivery Channel](/docs/providers/aws/r/config_delivery_channel.html) to be present. Use of `depends_on` (as shown below) is recommended to avoid race conditions.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.config_configuration_recorder import ConfigConfigurationRecorder
+from imports.aws.config_configuration_recorder_status import ConfigConfigurationRecorderStatus
+from imports.aws.config_delivery_channel import ConfigDeliveryChannel
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.iam_role import IamRole
+from imports.aws.iam_role_policy import IamRolePolicy
+from imports.aws.iam_role_policy_attachment import IamRolePolicyAttachment
+from imports.aws.s3_bucket import S3Bucket
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        b = S3Bucket(self, "b",
+            bucket="awsconfig-example"
+        )
+        assume_role = DataAwsIamPolicyDocument(self, "assume_role",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["sts:AssumeRole"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["config.amazonaws.com"],
+                    type="Service"
+                )
+                ]
+            )
+            ]
+        )
+        p = DataAwsIamPolicyDocument(self, "p",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["s3:*"],
+                effect="Allow",
+                resources=[b.arn, "${" + b.arn + "}/*"]
+            )
+            ]
+        )
+        foo = ConfigDeliveryChannel(self, "foo",
+            name="example",
+            s3_bucket_name=b.bucket
+        )
+        r = IamRole(self, "r",
+            assume_role_policy=Token.as_string(assume_role.json),
+            name="example-awsconfig"
+        )
+        aws_iam_role_policy_p = IamRolePolicy(self, "p_5",
+            name="awsconfig-example",
+            policy=Token.as_string(p.json),
+            role=r.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_role_policy_p.override_logical_id("p")
+        IamRolePolicyAttachment(self, "a",
+            policy_arn="arn:aws:iam::aws:policy/service-role/AWS_ConfigRole",
+            role=r.name
+        )
+        aws_config_configuration_recorder_foo = ConfigConfigurationRecorder(self, "foo_7",
+            name="example",
+            role_arn=r.arn
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_config_configuration_recorder_foo.override_logical_id("foo")
+        aws_config_configuration_recorder_status_foo =
+        ConfigConfigurationRecorderStatus(self, "foo_8",
+            depends_on=[foo],
+            is_enabled=True,
+            name=Token.as_string(aws_config_configuration_recorder_foo.name)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_config_configuration_recorder_status_foo.override_logical_id("foo")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the recorder
+* `is_enabled` - (Required) Whether the configuration recorder should be enabled or disabled.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Configuration Recorder Status using the name of the Configuration Recorder. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Configuration Recorder Status using the name of the Configuration Recorder. For example:
+
+```console
+% terraform import aws_config_configuration_recorder_status.foo example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-eff5be1ca06224bd56323b786df4a302b3a7bde4963a5efe48e7bee409360bcf -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/config_conformance_pack.html.markdown b/website/docs/cdktf/python/r/config_conformance_pack.html.markdown
new file mode 100644
index 00000000000..48498b6a7ac
--- /dev/null
+++ b/website/docs/cdktf/python/r/config_conformance_pack.html.markdown
@@ -0,0 +1,130 @@
+---
+subcategory: "Config"
+layout: "aws"
+page_title: "AWS: aws_config_conformance_pack"
+description: |-
+  Manages a Config Conformance Pack
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_config_conformance_pack
+
+Manages a Config Conformance Pack. More information about this collection of Config rules and remediation actions can be found in the
+[Conformance Packs](https://docs.aws.amazon.com/config/latest/developerguide/conformance-packs.html) documentation.
+Sample Conformance Pack templates may be found in the
+[AWS Config Rules Repository](https://github.com/awslabs/aws-config-rules/tree/master/aws-config-conformance-packs).
+
+~> **NOTE:** The account must have a Configuration Recorder with proper IAM permissions before the Conformance Pack will
+successfully create or update. See also the
+[`aws_config_configuration_recorder` resource](/docs/providers/aws/r/config_configuration_recorder.html).
+
+## Example Usage
+
+### Template Body
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.config_conformance_pack import ConfigConformancePack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ConfigConformancePack(self, "example",
+            depends_on=[aws_config_configuration_recorder_example],
+            input_parameter=[ConfigConformancePackInputParameter(
+                parameter_name="AccessKeysRotatedParameterMaxAccessKeyAge",
+                parameter_value="90"
+            )
+            ],
+            name="example",
+            template_body="Parameters:\n  AccessKeysRotatedParameterMaxAccessKeyAge:\n    Type: String\nResources:\n  IAMPasswordPolicy:\n    Properties:\n      ConfigRuleName: IAMPasswordPolicy\n      Source:\n        Owner: AWS\n        SourceIdentifier: IAM_PASSWORD_POLICY\n    Type: AWS::Config::ConfigRule\n\n"
+        )
+```
+
+### Template S3 URI
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.config_conformance_pack import ConfigConformancePack
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_object import S3Object
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = S3Bucket(self, "example",
+            bucket="example"
+        )
+        aws_s3_object_example = S3Object(self, "example_1",
+            bucket=example.id,
+            content="Resources:\n  IAMPasswordPolicy:\n    Properties:\n      ConfigRuleName: IAMPasswordPolicy\n      Source:\n        Owner: AWS\n        SourceIdentifier: IAM_PASSWORD_POLICY\n    Type: AWS::Config::ConfigRule\n\n",
+            key="example-key"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_object_example.override_logical_id("example")
+        aws_config_conformance_pack_example = ConfigConformancePack(self, "example_2",
+            depends_on=[aws_config_configuration_recorder_example],
+            name="example",
+            template_s3_uri="s3://${" + example.bucket + "}/${" + aws_s3_object_example.key + "}"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_config_conformance_pack_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+~> **Note:** If both `template_body` and `template_s3_uri` are specified, AWS Config uses the `template_s3_uri` and ignores the `template_body`.
+
+This argument supports the following arguments:
+
+* `name` - (Required, Forces new resource) The name of the conformance pack. Must begin with a letter and contain from 1 to 256 alphanumeric characters and hyphens.
+* `delivery_s3_bucket` - (Optional) Amazon S3 bucket where AWS Config stores conformance pack templates. Maximum length of 63.
+* `delivery_s3_key_prefix` - (Optional) The prefix for the Amazon S3 bucket. Maximum length of 1024.
+* `input_parameter` - (Optional) Set of configuration blocks describing input parameters passed to the conformance pack template. Documented below. When configured, the parameters must also be included in the `template_body` or in the template stored in Amazon S3 if using `template_s3_uri`.
+* `template_body` - (Optional, required if `template_s3_uri` is not provided) A string containing full conformance pack template body. Maximum length of 51200. Drift detection is not possible with this argument.
+* `template_s3_uri` - (Optional, required if `template_body` is not provided) Location of file, e.g., `s3://bucketname/prefix`, containing the template body. The uri must point to the conformance pack template that is located in an Amazon S3 bucket in the same region as the conformance pack. Maximum length of 1024. Drift detection is not possible with this argument.
+
+### input_parameter Argument Reference
+
+The `input_parameter` configuration block supports the following arguments:
+
+* `parameter_name` - (Required) The input key.
+* `parameter_value` - (Required) The input value.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the conformance pack.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Config Conformance Packs using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Config Conformance Packs using the `name`. For example:
+
+```console
+% terraform import aws_config_conformance_pack.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-86a608716b92b915769aca6b0e5f24ca5b42bf4f52fb91a1566b43fe79868c79 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/config_delivery_channel.html.markdown b/website/docs/cdktf/python/r/config_delivery_channel.html.markdown
new file mode 100644
index 00000000000..995215d10d5
--- /dev/null
+++ b/website/docs/cdktf/python/r/config_delivery_channel.html.markdown
@@ -0,0 +1,124 @@
+---
+subcategory: "Config"
+layout: "aws"
+page_title: "AWS: aws_config_delivery_channel"
+description: |-
+  Provides an AWS Config Delivery Channel.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_config_delivery_channel
+
+Provides an AWS Config Delivery Channel.
+
+~> **Note:** Delivery Channel requires a [Configuration Recorder](/docs/providers/aws/r/config_configuration_recorder.html) to be present. Use of `depends_on` (as shown below) is recommended to avoid race conditions.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.config_configuration_recorder import ConfigConfigurationRecorder
+from imports.aws.config_delivery_channel import ConfigDeliveryChannel
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.iam_role import IamRole
+from imports.aws.iam_role_policy import IamRolePolicy
+from imports.aws.s3_bucket import S3Bucket
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        b = S3Bucket(self, "b",
+            bucket="example-awsconfig",
+            force_destroy=True
+        )
+        assume_role = DataAwsIamPolicyDocument(self, "assume_role",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["sts:AssumeRole"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["config.amazonaws.com"],
+                    type="Service"
+                )
+                ]
+            )
+            ]
+        )
+        p = DataAwsIamPolicyDocument(self, "p",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["s3:*"],
+                effect="Allow",
+                resources=[b.arn, "${" + b.arn + "}/*"]
+            )
+            ]
+        )
+        r = IamRole(self, "r",
+            assume_role_policy=Token.as_string(assume_role.json),
+            name="awsconfig-example"
+        )
+        aws_iam_role_policy_p = IamRolePolicy(self, "p_4",
+            name="awsconfig-example",
+            policy=Token.as_string(p.json),
+            role=r.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_role_policy_p.override_logical_id("p")
+        foo = ConfigConfigurationRecorder(self, "foo",
+            name="example",
+            role_arn=r.arn
+        )
+        aws_config_delivery_channel_foo = ConfigDeliveryChannel(self, "foo_6",
+            depends_on=[foo],
+            name="example",
+            s3_bucket_name=b.bucket
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_config_delivery_channel_foo.override_logical_id("foo")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Optional) The name of the delivery channel. Defaults to `default`. Changing it recreates the resource.
+* `s3_bucket_name` - (Required) The name of the S3 bucket used to store the configuration history.
+* `s3_key_prefix` - (Optional) The prefix for the specified S3 bucket.
+* `s3_kms_key_arn` - (Optional) The ARN of the AWS KMS key used to encrypt objects delivered by AWS Config. Must belong to the same Region as the destination S3 bucket.
+* `sns_topic_arn` - (Optional) The ARN of the SNS topic that AWS Config delivers notifications to.
+* `snapshot_delivery_properties` - (Optional) Options for how AWS Config delivers configuration snapshots. See below
+
+### `snapshot_delivery_properties`
+
+* `delivery_frequency` - (Optional) - The frequency with which AWS Config recurringly delivers configuration snapshotsE.g., `One_Hour` or `Three_Hours`. Valid values are listed [here](https://docs.aws.amazon.com/config/latest/APIReference/API_ConfigSnapshotDeliveryProperties.html#API_ConfigSnapshotDeliveryProperties_Contents).
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name of the delivery channel.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Delivery Channel using the name. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Delivery Channel using the name. For example:
+
+```console
+% terraform import aws_config_delivery_channel.foo example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-54435b5e17865652d2b4e1be7bdaf36c37288ea5a996a242391550ce3763b0a2 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/config_organization_conformance_pack.html.markdown b/website/docs/cdktf/python/r/config_organization_conformance_pack.html.markdown
new file mode 100644
index 00000000000..ae17ccddbb6
--- /dev/null
+++ b/website/docs/cdktf/python/r/config_organization_conformance_pack.html.markdown
@@ -0,0 +1,149 @@
+---
+subcategory: "Config"
+layout: "aws"
+page_title: "AWS: aws_config_organization_conformance_pack"
+description: |-
+  Manages a Config Organization Conformance Pack
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_config_organization_conformance_pack
+
+Manages a Config Organization Conformance Pack. More information can be found in the [Managing Conformance Packs Across all Accounts in Your Organization](https://docs.aws.amazon.com/config/latest/developerguide/conformance-pack-organization-apis.html) and [AWS Config Managed Rules](https://docs.aws.amazon.com/config/latest/developerguide/evaluate-config_use-managed-rules.html) documentation. Example conformance pack templates may be found in the [AWS Config Rules Repository](https://github.com/awslabs/aws-config-rules/tree/master/aws-config-conformance-packs).
+
+~> **NOTE:** This resource must be created in the Organization master account or a delegated administrator account, and the Organization must have all features enabled. Every Organization account except those configured in the `excluded_accounts` argument must have a Configuration Recorder with proper IAM permissions before the Organization Conformance Pack will successfully create or update. See also the [`aws_config_configuration_recorder` resource](/docs/providers/aws/r/config_configuration_recorder.html).
+
+## Example Usage
+
+### Using Template Body
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.config_organization_conformance_pack import ConfigOrganizationConformancePack
+from imports.aws.organizations_organization import OrganizationsOrganization
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = OrganizationsOrganization(self, "example",
+            aws_service_access_principals=["config-multiaccountsetup.amazonaws.com"],
+            feature_set="ALL"
+        )
+        aws_config_organization_conformance_pack_example =
+        ConfigOrganizationConformancePack(self, "example_1",
+            depends_on=[aws_config_configuration_recorder_example, example],
+            input_parameter=[ConfigOrganizationConformancePackInputParameter(
+                parameter_name="AccessKeysRotatedParameterMaxAccessKeyAge",
+                parameter_value="90"
+            )
+            ],
+            name="example",
+            template_body="Parameters:\n  AccessKeysRotatedParameterMaxAccessKeyAge:\n    Type: String\nResources:\n  IAMPasswordPolicy:\n    Properties:\n      ConfigRuleName: IAMPasswordPolicy\n      Source:\n        Owner: AWS\n        SourceIdentifier: IAM_PASSWORD_POLICY\n    Type: AWS::Config::ConfigRule\n\n"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_config_organization_conformance_pack_example.override_logical_id("example")
+```
+
+### Using Template S3 URI
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.config_organization_conformance_pack import ConfigOrganizationConformancePack
+from imports.aws.organizations_organization import OrganizationsOrganization
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_object import S3Object
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = OrganizationsOrganization(self, "example",
+            aws_service_access_principals=["config-multiaccountsetup.amazonaws.com"],
+            feature_set="ALL"
+        )
+        aws_s3_bucket_example = S3Bucket(self, "example_1",
+            bucket="example"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_example.override_logical_id("example")
+        aws_s3_object_example = S3Object(self, "example_2",
+            bucket=Token.as_string(aws_s3_bucket_example.id),
+            content="Resources:\n  IAMPasswordPolicy:\n    Properties:\n      ConfigRuleName: IAMPasswordPolicy\n      Source:\n        Owner: AWS\n        SourceIdentifier: IAM_PASSWORD_POLICY\n    Type: AWS::Config::ConfigRule\n\n",
+            key="example-key"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_object_example.override_logical_id("example")
+        aws_config_organization_conformance_pack_example =
+        ConfigOrganizationConformancePack(self, "example_3",
+            depends_on=[aws_config_configuration_recorder_example, example],
+            name="example",
+            template_s3_uri="s3://${" + aws_s3_bucket_example.bucket + "}/${" + aws_s3_object_example.key + "}"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_config_organization_conformance_pack_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required, Forces new resource) The name of the organization conformance pack. Must begin with a letter and contain from 1 to 128 alphanumeric characters and hyphens.
+* `delivery_s3_bucket` - (Optional) Amazon S3 bucket where AWS Config stores conformance pack templates. Delivery bucket must begin with `awsconfigconforms` prefix. Maximum length of 63.
+* `delivery_s3_key_prefix` - (Optional) The prefix for the Amazon S3 bucket. Maximum length of 1024.
+* `excluded_accounts` - (Optional) Set of AWS accounts to be excluded from an organization conformance pack while deploying a conformance pack. Maximum of 1000 accounts.
+* `input_parameter` - (Optional) Set of configuration blocks describing input parameters passed to the conformance pack template. Documented below. When configured, the parameters must also be included in the `template_body` or in the template stored in Amazon S3 if using `template_s3_uri`.
+* `template_body` - (Optional, Conflicts with `template_s3_uri`) A string containing full conformance pack template body. Maximum length of 51200. Drift detection is not possible with this argument.
+* `template_s3_uri` - (Optional, Conflicts with `template_body`) Location of file, e.g., `s3://bucketname/prefix`, containing the template body. The uri must point to the conformance pack template that is located in an Amazon S3 bucket in the same region as the conformance pack. Maximum length of 1024. Drift detection is not possible with this argument.
+
+### input_parameter Argument Reference
+
+The `input_parameter` configuration block supports the following arguments:
+
+* `parameter_name` - (Required) The input key.
+* `parameter_value` - (Required) The input value.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the organization conformance pack.
+* `id` - The name of the organization conformance pack.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `10m`)
+- `update` - (Default `10m`)
+- `delete` - (Default `20m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Config Organization Conformance Packs using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Config Organization Conformance Packs using the `name`. For example:
+
+```console
+% terraform import aws_config_organization_conformance_pack.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-4f933a5e639d5b2cfd2450761a6e901c02e6e8a4875255817cf9b88f4cfacd1d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/config_organization_custom_policy_rule.html.markdown b/website/docs/cdktf/python/r/config_organization_custom_policy_rule.html.markdown
new file mode 100644
index 00000000000..02a9172d77a
--- /dev/null
+++ b/website/docs/cdktf/python/r/config_organization_custom_policy_rule.html.markdown
@@ -0,0 +1,96 @@
+---
+subcategory: "Config"
+layout: "aws"
+page_title: "AWS: aws_config_organization_custom_policy_rule"
+description: |-
+  Terraform resource for managing an AWS Config Organization Custom Policy.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_config_organization_custom_policy_rule
+
+Manages a Config Organization Custom Policy Rule. More information about these rules can be found in the [Enabling AWS Config Rules Across all Accounts in Your Organization](https://docs.aws.amazon.com/config/latest/developerguide/config-rule-multi-account-deployment.html) and [AWS Config Managed Rules](https://docs.aws.amazon.com/config/latest/developerguide/evaluate-config_use-managed-rules.html) documentation. For working with Organization Managed Rules (those invoking an AWS managed rule), see the [`aws_config_organization_managed__rule` resource](/docs/providers/aws/r/config_organization_managed_rule.html).
+
+~> **NOTE:** This resource must be created in the Organization master account and rules will include the master account unless its ID is added to the `excluded_accounts` argument.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.config_organization_custom_policy_rule import ConfigOrganizationCustomPolicyRule
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, triggerTypes):
+        super().__init__(scope, name)
+        ConfigOrganizationCustomPolicyRule(self, "example",
+            name="example_rule_name",
+            policy_runtime="guard-2.x.x",
+            policy_text="let status = ['ACTIVE']\n\nrule tableisactive when\n    resourceType == \"AWS::DynamoDB::Table\" {\n    configuration.tableStatus == %status\n}\n\nrule checkcompliance when\n    resourceType == \"AWS::DynamoDB::Table\"\n    tableisactive {\n        let pitr = supplementaryConfiguration.ContinuousBackupsDescription.pointInTimeRecoveryDescription.pointInTimeRecoveryStatus\n        %pitr == \"ENABLED\"\n    }\n\n",
+            resource_types_scope=["AWS::DynamoDB::Table"],
+            trigger_types=trigger_types
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) name of the rule
+* `policy_text` - (Required) policy definition containing the logic for your organization AWS Config Custom Policy rule
+* `policy_runtime` - (Required)  runtime system for your organization AWS Config Custom Policy rules
+* `trigger_types` - (Required) List of notification types that trigger AWS Config to run an evaluation for the rule. Valid values: `ConfigurationItemChangeNotification`, `OversizedConfigurationItemChangeNotification`
+
+The following arguments are optional:
+
+* `description` - (Optional) Description of the rule
+* `debug_log_delivery_accounts` - (Optional) List of AWS account identifiers to exclude from the rule
+* `excluded_accounts` - (Optional) List of AWS account identifiers to exclude from the rule
+* `input_parameters` - (Optional) A string in JSON format that is passed to the AWS Config Rule Lambda Function
+* `maximum_execution_frequency` - (Optional) Maximum frequency with which AWS Config runs evaluations for a rule, if the rule is triggered at a periodic frequency. Defaults to `TwentyFour_Hours` for periodic frequency triggered rules. Valid values: `One_Hour`, `Three_Hours`, `Six_Hours`, `Twelve_Hours`, or `TwentyFour_Hours`.
+* `resource_id_scope` - (Optional) Identifier of the AWS resource to evaluate
+* `resource_types_scope` - (Optional) List of types of AWS resources to evaluate
+* `tag_key_scope` - (Optional, Required if `tag_value_scope` is configured) Tag key of AWS resources to evaluate
+* `tag_value_scope` - (Optional) Tag value of AWS resources to evaluate
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the rule
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `20m`)
+* `update` - (Default `20m`)
+* `delete` - (Default `20m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import a Config Organization Custom Policy Rule using the `name` argument. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import a Config Organization Custom Policy Rule using the `name` argument. For example:
+
+```console
+% terraform import aws_config_organization_custom_policy_rule.example example_rule_name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-f90143a3072d513a2fe1459c4bfdb050b7dfd52b0b478cfb10ff823139422527 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/config_organization_custom_rule.html.markdown b/website/docs/cdktf/python/r/config_organization_custom_rule.html.markdown
new file mode 100644
index 00000000000..681a4d7a51b
--- /dev/null
+++ b/website/docs/cdktf/python/r/config_organization_custom_rule.html.markdown
@@ -0,0 +1,107 @@
+---
+subcategory: "Config"
+layout: "aws"
+page_title: "AWS: aws_config_organization_custom_rule"
+description: |-
+  Manages a Config Organization Custom Rule
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_config_organization_custom_rule
+
+Manages a Config Organization Custom Rule. More information about these rules can be found in the [Enabling AWS Config Rules Across all Accounts in Your Organization](https://docs.aws.amazon.com/config/latest/developerguide/config-rule-multi-account-deployment.html) and [AWS Config Managed Rules](https://docs.aws.amazon.com/config/latest/developerguide/evaluate-config_use-managed-rules.html) documentation. For working with Organization Managed Rules (those invoking an AWS managed rule), see the [`aws_config_organization_managed__rule` resource](/docs/providers/aws/r/config_organization_managed_rule.html).
+
+~> **NOTE:** This resource must be created in the Organization master account and rules will include the master account unless its ID is added to the `excluded_accounts` argument.
+
+~> **NOTE:** The proper Lambda permission to allow the AWS Config service invoke the Lambda Function must be in place before the rule will successfully create or update. See also the [`aws_lambda_permission` resource](/docs/providers/aws/r/lambda_permission.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.config_organization_custom_rule import ConfigOrganizationCustomRule
+from imports.aws.lambda_permission import LambdaPermission
+from imports.aws.organizations_organization import OrganizationsOrganization
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = LambdaPermission(self, "example",
+            action="lambda:InvokeFunction",
+            function_name=Token.as_string(aws_lambda_function_example.arn),
+            principal="config.amazonaws.com",
+            statement_id="AllowExecutionFromConfig"
+        )
+        aws_organizations_organization_example = OrganizationsOrganization(self, "example_1",
+            aws_service_access_principals=["config-multiaccountsetup.amazonaws.com"],
+            feature_set="ALL"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_organizations_organization_example.override_logical_id("example")
+        aws_config_organization_custom_rule_example =
+        ConfigOrganizationCustomRule(self, "example_2",
+            depends_on=[example, aws_organizations_organization_example],
+            lambda_function_arn=Token.as_string(aws_lambda_function_example.arn),
+            name="example",
+            trigger_types=["ConfigurationItemChangeNotification"]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_config_organization_custom_rule_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `lambda_function_arn` - (Required) Amazon Resource Name (ARN) of the rule Lambda Function
+* `name` - (Required) The name of the rule
+* `trigger_types` - (Required) List of notification types that trigger AWS Config to run an evaluation for the rule. Valid values: `ConfigurationItemChangeNotification`, `OversizedConfigurationItemChangeNotification`, and `ScheduledNotification`
+* `description` - (Optional) Description of the rule
+* `excluded_accounts` - (Optional) List of AWS account identifiers to exclude from the rule
+* `input_parameters` - (Optional) A string in JSON format that is passed to the AWS Config Rule Lambda Function
+* `maximum_execution_frequency` - (Optional) The maximum frequency with which AWS Config runs evaluations for a rule, if the rule is triggered at a periodic frequency. Defaults to `TwentyFour_Hours` for periodic frequency triggered rules. Valid values: `One_Hour`, `Three_Hours`, `Six_Hours`, `Twelve_Hours`, or `TwentyFour_Hours`.
+* `resource_id_scope` - (Optional) Identifier of the AWS resource to evaluate
+* `resource_types_scope` - (Optional) List of types of AWS resources to evaluate
+* `tag_key_scope` - (Optional, Required if `tag_value_scope` is configured) Tag key of AWS resources to evaluate
+* `tag_value_scope` - (Optional) Tag value of AWS resources to evaluate
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the rule
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `5m`)
+* `delete` - (Default `5m`)
+* `update` - (Default `5m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Config Organization Custom Rules using the name. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Config Organization Custom Rules using the name. For example:
+
+```console
+% terraform import aws_config_organization_custom_rule.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-33094f531130f32ecdf884f7220da12125657cf545f1554a9e4e90b73a4d1db1 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/config_organization_managed_rule.html.markdown b/website/docs/cdktf/python/r/config_organization_managed_rule.html.markdown
new file mode 100644
index 00000000000..7647c08f05d
--- /dev/null
+++ b/website/docs/cdktf/python/r/config_organization_managed_rule.html.markdown
@@ -0,0 +1,96 @@
+---
+subcategory: "Config"
+layout: "aws"
+page_title: "AWS: aws_config_organization_managed_rule"
+description: |-
+  Manages a Config Organization Managed Rule
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_config_organization_managed_rule
+
+Manages a Config Organization Managed Rule. More information about these rules can be found in the [Enabling AWS Config Rules Across all Accounts in Your Organization](https://docs.aws.amazon.com/config/latest/developerguide/config-rule-multi-account-deployment.html) and [AWS Config Managed Rules](https://docs.aws.amazon.com/config/latest/developerguide/evaluate-config_use-managed-rules.html) documentation. For working with Organization Custom Rules (those invoking a custom Lambda Function), see the [`aws_config_organization_custom_rule` resource](/docs/providers/aws/r/config_organization_custom_rule.html).
+
+~> **NOTE:** This resource must be created in the Organization master account and rules will include the master account unless its ID is added to the `excluded_accounts` argument.
+
+~> **NOTE:** Every Organization account except those configured in the `excluded_accounts` argument must have a Configuration Recorder with proper IAM permissions before the rule will successfully create or update. See also the [`aws_config_configuration_recorder` resource](/docs/providers/aws/r/config_configuration_recorder.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.config_organization_managed_rule import ConfigOrganizationManagedRule
+from imports.aws.organizations_organization import OrganizationsOrganization
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = OrganizationsOrganization(self, "example",
+            aws_service_access_principals=["config-multiaccountsetup.amazonaws.com"],
+            feature_set="ALL"
+        )
+        aws_config_organization_managed_rule_example =
+        ConfigOrganizationManagedRule(self, "example_1",
+            depends_on=[example],
+            name="example",
+            rule_identifier="IAM_PASSWORD_POLICY"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_config_organization_managed_rule_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the rule
+* `rule_identifier` - (Required) Identifier of an available AWS Config Managed Rule to call. For available values, see the [List of AWS Config Managed Rules](https://docs.aws.amazon.com/config/latest/developerguide/managed-rules-by-aws-config.html) documentation
+* `description` - (Optional) Description of the rule
+* `excluded_accounts` - (Optional) List of AWS account identifiers to exclude from the rule
+* `input_parameters` - (Optional) A string in JSON format that is passed to the AWS Config Rule Lambda Function
+* `maximum_execution_frequency` - (Optional) The maximum frequency with which AWS Config runs evaluations for a rule, if the rule is triggered at a periodic frequency. Defaults to `TwentyFour_Hours` for periodic frequency triggered rules. Valid values: `One_Hour`, `Three_Hours`, `Six_Hours`, `Twelve_Hours`, or `TwentyFour_Hours`.
+* `resource_id_scope` - (Optional) Identifier of the AWS resource to evaluate
+* `resource_types_scope` - (Optional) List of types of AWS resources to evaluate
+* `tag_key_scope` - (Optional, Required if `tag_value_scope` is configured) Tag key of AWS resources to evaluate
+* `tag_value_scope` - (Optional) Tag value of AWS resources to evaluate
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the rule
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `5m`)
+* `delete` - (Default `5m`)
+* `update` - (Default `5m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Config Organization Managed Rules using the name. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Config Organization Managed Rules using the name. For example:
+
+```console
+% terraform import aws_config_organization_managed_rule.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-29a5f024d0a4952e4ef689b372b4e88a2023404e9e31631bc6e865b75a8f3733 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/config_remediation_configuration.html.markdown b/website/docs/cdktf/python/r/config_remediation_configuration.html.markdown
new file mode 100644
index 00000000000..3a795c3a25c
--- /dev/null
+++ b/website/docs/cdktf/python/r/config_remediation_configuration.html.markdown
@@ -0,0 +1,136 @@
+---
+subcategory: "Config"
+layout: "aws"
+page_title: "AWS: aws_config_remediation_configuration"
+description: |-
+  Provides an AWS Config Remediation Configuration.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_config_remediation_configuration
+
+Provides an AWS Config Remediation Configuration.
+
+~> **Note:** Config Remediation Configuration requires an existing [Config Rule](/docs/providers/aws/r/config_config_rule.html) to be present.
+
+## Example Usage
+
+AWS managed rules can be used by setting the source owner to `AWS` and the source identifier to the name of the managed rule. More information about AWS managed rules can be found in the [AWS Config Developer Guide](https://docs.aws.amazon.com/config/latest/developerguide/evaluate-config_use-managed-rules.html).
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.config_config_rule import ConfigConfigRule
+from imports.aws.config_remediation_configuration import ConfigRemediationConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        this_var = ConfigConfigRule(self, "this",
+            name="example",
+            source=ConfigConfigRuleSource(
+                owner="AWS",
+                source_identifier="S3_BUCKET_VERSIONING_ENABLED"
+            )
+        )
+        aws_config_remediation_configuration_this =
+        ConfigRemediationConfiguration(self, "this_1",
+            automatic=True,
+            config_rule_name=this_var.name,
+            execution_controls=ConfigRemediationConfigurationExecutionControls(
+                ssm_controls=ConfigRemediationConfigurationExecutionControlsSsmControls(
+                    concurrent_execution_rate_percentage=25,
+                    error_percentage=20
+                )
+            ),
+            maximum_automatic_attempts=10,
+            parameter=[ConfigRemediationConfigurationParameter(
+                name="AutomationAssumeRole",
+                static_value="arn:aws:iam::875924563244:role/security_config"
+            ), ConfigRemediationConfigurationParameter(
+                name="BucketName",
+                resource_value="RESOURCE_ID"
+            ), ConfigRemediationConfigurationParameter(
+                name="SSEAlgorithm",
+                static_value="AES256"
+            )
+            ],
+            resource_type="AWS::S3::Bucket",
+            retry_attempt_seconds=600,
+            target_id="AWS-EnableS3BucketEncryption",
+            target_type="SSM_DOCUMENT",
+            target_version="1"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_config_remediation_configuration_this.override_logical_id("this")
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `config_rule_name` - (Required) Name of the AWS Config rule.
+* `target_id` - (Required) Target ID is the name of the public document.
+* `target_type` - (Required) Type of the target. Target executes remediation. For example, SSM document.
+
+The following arguments are optional:
+
+* `automatic` - (Optional) Remediation is triggered automatically if `true`.
+* `execution_controls` - (Optional) Configuration block for execution controls. See below.
+* `maximum_automatic_attempts` - (Optional) Maximum number of failed attempts for auto-remediation. If you do not select a number, the default is 5.
+* `parameter` - (Optional) Can be specified multiple times for each parameter. Each parameter block supports arguments below.
+* `resource_type` - (Optional) Type of resource.
+* `retry_attempt_seconds` - (Optional) Maximum time in seconds that AWS Config runs auto-remediation. If you do not select a number, the default is 60 seconds.
+* `target_version` - (Optional) Version of the target. For example, version of the SSM document
+
+### `execution_controls`
+
+* `ssm_controls` - (Required) Configuration block for SSM controls. See below.
+
+#### `ssm_controls`
+
+One or both of these values are required.
+
+* `concurrent_execution_rate_percentage` - (Optional) Maximum percentage of remediation actions allowed to run in parallel on the non-compliant resources for that specific rule. The default value is 10%.
+* `error_percentage` - (Optional) Percentage of errors that are allowed before SSM stops running automations on non-compliant resources for that specific rule. The default is 50%.
+
+### `parameter`
+
+The value is either a dynamic (resource) value or a static value. You must select either a dynamic value or a static value.
+
+* `name` - (Required) Name of the attribute.
+* `resource_value` - (Optional) Value is dynamic and changes at run-time.
+* `static_value` - (Optional) Value is static and does not change at run-time.
+* `static_values` - (Optional) List of static values.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Config Remediation Configuration.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Remediation Configurations using the name config_rule_name. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Remediation Configurations using the name config_rule_name. For example:
+
+```console
+% terraform import aws_config_remediation_configuration.this example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-e4422e32c7a9b0e1b751fde0505405c8311a46abe23651a75ba503285c3a58bd -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/connect_bot_association.html.markdown b/website/docs/cdktf/python/r/connect_bot_association.html.markdown
new file mode 100644
index 00000000000..a4106e8658b
--- /dev/null
+++ b/website/docs/cdktf/python/r/connect_bot_association.html.markdown
@@ -0,0 +1,146 @@
+---
+subcategory: "Connect"
+layout: "aws"
+page_title: "AWS: aws_connect_bot_association"
+description: |-
+  Associates an Amazon Connect instance to an Amazon Lex (V1) bot
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_connect_bot_association
+
+Allows the specified Amazon Connect instance to access the specified Amazon Lex (V1) bot. For more information see
+[Amazon Connect: Getting Started](https://docs.aws.amazon.com/connect/latest/adminguide/amazon-connect-get-started.html) and [Add an Amazon Lex bot](https://docs.aws.amazon.com/connect/latest/adminguide/amazon-lex.html).
+
+~> **NOTE:** This resource only currently supports Amazon Lex (V1) Associations.
+
+## Example Usage
+
+### Basic
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.connect_bot_association import ConnectBotAssociation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ConnectBotAssociation(self, "example",
+            instance_id=Token.as_string(aws_connect_instance_example.id),
+            lex_bot=ConnectBotAssociationLexBot(
+                lex_region="us-west-2",
+                name="Test"
+            )
+        )
+```
+
+### Including a sample Lex bot
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.connect_bot_association import ConnectBotAssociation
+from imports.aws.data_aws_region import DataAwsRegion
+from imports.aws.lex_bot import LexBot
+from imports.aws.lex_intent import LexIntent
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = LexIntent(self, "example",
+            create_version=True,
+            fulfillment_activity=LexIntentFulfillmentActivity(
+                type="ReturnIntent"
+            ),
+            name="connect_lex_intent",
+            sample_utterances=["I would like to pick up flowers."]
+        )
+        current = DataAwsRegion(self, "current")
+        aws_lex_bot_example = LexBot(self, "example_2",
+            abort_statement=LexBotAbortStatement(
+                message=[LexBotAbortStatementMessage(
+                    content="Sorry, I am not able to assist at this time.",
+                    content_type="PlainText"
+                )
+                ]
+            ),
+            child_directed=False,
+            clarification_prompt=LexBotClarificationPrompt(
+                max_attempts=2,
+                message=[LexBotClarificationPromptMessage(
+                    content="I didn't understand you, what would you like to do?",
+                    content_type="PlainText"
+                )
+                ]
+            ),
+            intent=[LexBotIntent(
+                intent_name=example.name,
+                intent_version="1"
+            )
+            ],
+            name="connect_lex_bot",
+            process_behavior="BUILD"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_lex_bot_example.override_logical_id("example")
+        aws_connect_bot_association_example = ConnectBotAssociation(self, "example_3",
+            instance_id=Token.as_string(aws_connect_instance_example.id),
+            lex_bot=ConnectBotAssociationLexBot(
+                lex_region=Token.as_string(current.name),
+                name=Token.as_string(aws_lex_bot_example.name)
+            )
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_connect_bot_association_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `instance_id` - (Required) The identifier of the Amazon Connect instance. You can find the instanceId in the ARN of the instance.
+* `lex_bot` - (Required) Configuration information of an Amazon Lex (V1) bot. Detailed below.
+
+### lex_bot
+
+The `lex_bot` configuration block supports the following:
+
+* `name` - (Required) The name of the Amazon Lex (V1) bot.
+* `lex_region` - (Optional) The Region that the Amazon Lex (V1) bot was created in. Defaults to current region.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Amazon Connect instance ID, Lex (V1) bot name, and Lex (V1) bot region separated by colons (`:`).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_connect_bot_association` using the Amazon Connect instance ID, Lex (V1) bot name, and Lex (V1) bot region separated by colons (`:`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_connect_bot_association` using the Amazon Connect instance ID, Lex (V1) bot name, and Lex (V1) bot region separated by colons (`:`). For example:
+
+```console
+% terraform import aws_connect_bot_association.example aaaaaaaa-bbbb-cccc-dddd-111111111111:Example:us-west-2
+```
+
+<!-- cache-key: cdktf-0.18.0 input-a2f9c06dc453656a33c733da12968f311c1fb8ca4fa4a21171e1bb6249dad8c8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/connect_bot_association.markdown b/website/docs/cdktf/python/r/connect_bot_association.markdown
new file mode 100644
index 00000000000..a4106e8658b
--- /dev/null
+++ b/website/docs/cdktf/python/r/connect_bot_association.markdown
@@ -0,0 +1,146 @@
+---
+subcategory: "Connect"
+layout: "aws"
+page_title: "AWS: aws_connect_bot_association"
+description: |-
+  Associates an Amazon Connect instance to an Amazon Lex (V1) bot
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_connect_bot_association
+
+Allows the specified Amazon Connect instance to access the specified Amazon Lex (V1) bot. For more information see
+[Amazon Connect: Getting Started](https://docs.aws.amazon.com/connect/latest/adminguide/amazon-connect-get-started.html) and [Add an Amazon Lex bot](https://docs.aws.amazon.com/connect/latest/adminguide/amazon-lex.html).
+
+~> **NOTE:** This resource only currently supports Amazon Lex (V1) Associations.
+
+## Example Usage
+
+### Basic
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.connect_bot_association import ConnectBotAssociation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ConnectBotAssociation(self, "example",
+            instance_id=Token.as_string(aws_connect_instance_example.id),
+            lex_bot=ConnectBotAssociationLexBot(
+                lex_region="us-west-2",
+                name="Test"
+            )
+        )
+```
+
+### Including a sample Lex bot
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.connect_bot_association import ConnectBotAssociation
+from imports.aws.data_aws_region import DataAwsRegion
+from imports.aws.lex_bot import LexBot
+from imports.aws.lex_intent import LexIntent
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = LexIntent(self, "example",
+            create_version=True,
+            fulfillment_activity=LexIntentFulfillmentActivity(
+                type="ReturnIntent"
+            ),
+            name="connect_lex_intent",
+            sample_utterances=["I would like to pick up flowers."]
+        )
+        current = DataAwsRegion(self, "current")
+        aws_lex_bot_example = LexBot(self, "example_2",
+            abort_statement=LexBotAbortStatement(
+                message=[LexBotAbortStatementMessage(
+                    content="Sorry, I am not able to assist at this time.",
+                    content_type="PlainText"
+                )
+                ]
+            ),
+            child_directed=False,
+            clarification_prompt=LexBotClarificationPrompt(
+                max_attempts=2,
+                message=[LexBotClarificationPromptMessage(
+                    content="I didn't understand you, what would you like to do?",
+                    content_type="PlainText"
+                )
+                ]
+            ),
+            intent=[LexBotIntent(
+                intent_name=example.name,
+                intent_version="1"
+            )
+            ],
+            name="connect_lex_bot",
+            process_behavior="BUILD"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_lex_bot_example.override_logical_id("example")
+        aws_connect_bot_association_example = ConnectBotAssociation(self, "example_3",
+            instance_id=Token.as_string(aws_connect_instance_example.id),
+            lex_bot=ConnectBotAssociationLexBot(
+                lex_region=Token.as_string(current.name),
+                name=Token.as_string(aws_lex_bot_example.name)
+            )
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_connect_bot_association_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `instance_id` - (Required) The identifier of the Amazon Connect instance. You can find the instanceId in the ARN of the instance.
+* `lex_bot` - (Required) Configuration information of an Amazon Lex (V1) bot. Detailed below.
+
+### lex_bot
+
+The `lex_bot` configuration block supports the following:
+
+* `name` - (Required) The name of the Amazon Lex (V1) bot.
+* `lex_region` - (Optional) The Region that the Amazon Lex (V1) bot was created in. Defaults to current region.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Amazon Connect instance ID, Lex (V1) bot name, and Lex (V1) bot region separated by colons (`:`).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_connect_bot_association` using the Amazon Connect instance ID, Lex (V1) bot name, and Lex (V1) bot region separated by colons (`:`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_connect_bot_association` using the Amazon Connect instance ID, Lex (V1) bot name, and Lex (V1) bot region separated by colons (`:`). For example:
+
+```console
+% terraform import aws_connect_bot_association.example aaaaaaaa-bbbb-cccc-dddd-111111111111:Example:us-west-2
+```
+
+<!-- cache-key: cdktf-0.18.0 input-a2f9c06dc453656a33c733da12968f311c1fb8ca4fa4a21171e1bb6249dad8c8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/connect_contact_flow.html.markdown b/website/docs/cdktf/python/r/connect_contact_flow.html.markdown
new file mode 100644
index 00000000000..068d49e83d4
--- /dev/null
+++ b/website/docs/cdktf/python/r/connect_contact_flow.html.markdown
@@ -0,0 +1,152 @@
+---
+subcategory: "Connect"
+layout: "aws"
+page_title: "AWS: aws_connect_contact_flow"
+description: |-
+  Provides details about a specific Amazon Connect Contact Flow.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_connect_contact_flow
+
+Provides an Amazon Connect Contact Flow resource. For more information see
+[Amazon Connect: Getting Started](https://docs.aws.amazon.com/connect/latest/adminguide/amazon-connect-get-started.html)
+
+This resource embeds or references Contact Flows specified in Amazon Connect Contact Flow Language. For more information see
+[Amazon Connect Flow language](https://docs.aws.amazon.com/connect/latest/adminguide/flow-language.html)
+
+!> **WARN:** Contact Flows exported from the Console [Contact Flow import/export](https://docs.aws.amazon.com/connect/latest/adminguide/contact-flow-import-export.html) are not in the Amazon Connect Contact Flow Language and can not be used with this resource. Instead, the recommendation is to use the AWS CLI [`describe-contact-flow`](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/connect/describe-contact-flow.html).
+See [example](#with-external-content) below which uses `jq` to extract the `Content` attribute and saves it to a local file.
+
+## Example Usage
+
+### Basic
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.connect_contact_flow import ConnectContactFlow
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ConnectContactFlow(self, "test",
+            content=Token.as_string(
+                Fn.jsonencode({
+                    "Actions": [{
+                        "Identifier": "12345678-1234-1234-1234-123456789012",
+                        "Parameters": {
+                            "Text": "Thanks for calling the sample flow!"
+                        },
+                        "Transitions": {
+                            "Conditions": [],
+                            "Errors": [],
+                            "NextAction": "abcdef-abcd-abcd-abcd-abcdefghijkl"
+                        },
+                        "Type": "MessageParticipant"
+                    }, {
+                        "Identifier": "abcdef-abcd-abcd-abcd-abcdefghijkl",
+                        "Parameters": {},
+                        "Transitions": {},
+                        "Type": "DisconnectParticipant"
+                    }
+                    ],
+                    "StartAction": "12345678-1234-1234-1234-123456789012",
+                    "Version": "2019-10-30"
+                })),
+            description="Test Contact Flow Description",
+            instance_id="aaaaaaaa-bbbb-cccc-dddd-111111111111",
+            name="Test",
+            tags={
+                "Application": "Terraform",
+                "Method": "Create",
+                "Name": "Test Contact Flow"
+            },
+            type="CONTACT_FLOW"
+        )
+```
+
+### With External Content
+
+Use the AWS CLI to extract Contact Flow Content:
+
+```console
+% aws connect describe-contact-flow --instance-id 1b3c5d8-1b3c-1b3c-1b3c-1b3c5d81b3c5 --contact-flow-id c1d4e5f6-1b3c-1b3c-1b3c-c1d4e5f6c1d4e5 --region us-west-2 | jq '.ContactFlow.Content | fromjson' > contact_flow.json
+```
+
+Use the generated file as input:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.connect_contact_flow import ConnectContactFlow
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ConnectContactFlow(self, "test",
+            content_hash=Token.as_string(Fn.filebase64sha256("contact_flow.json")),
+            description="Test Contact Flow Description",
+            filename="contact_flow.json",
+            instance_id="aaaaaaaa-bbbb-cccc-dddd-111111111111",
+            name="Test",
+            tags={
+                "Application": "Terraform",
+                "Method": "Create",
+                "Name": "Test Contact Flow"
+            },
+            type="CONTACT_FLOW"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `content` - (Optional) Specifies the content of the Contact Flow, provided as a JSON string, written in Amazon Connect Contact Flow Language. If defined, the `filename` argument cannot be used.
+* `content_hash` - (Optional) Used to trigger updates. Must be set to a base64-encoded SHA256 hash of the Contact Flow source specified with `filename`. The usual way to set this is filebase64sha256("mycontact_flow.json") (Terraform 0.11.12 and later) or base64sha256(file("mycontact_flow.json")) (Terraform 0.11.11 and earlier), where "mycontact_flow.json" is the local filename of the Contact Flow source.
+* `description` - (Optional) Specifies the description of the Contact Flow.
+* `filename` - (Optional) The path to the Contact Flow source within the local filesystem. Conflicts with `content`.
+* `instance_id` - (Required) Specifies the identifier of the hosting Amazon Connect Instance.
+* `name` - (Required) Specifies the name of the Contact Flow.
+* `tags` - (Optional) Tags to apply to the Contact Flow. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `type` - (Optional, Forces new resource) Specifies the type of the Contact Flow. Defaults to `CONTACT_FLOW`. Allowed Values are: `CONTACT_FLOW`, `CUSTOMER_QUEUE`, `CUSTOMER_HOLD`, `CUSTOMER_WHISPER`, `AGENT_HOLD`, `AGENT_WHISPER`, `OUTBOUND_WHISPER`, `AGENT_TRANSFER`, `QUEUE_TRANSFER`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the Contact Flow.
+* `id` - The identifier of the hosting Amazon Connect Instance and identifier of the Contact Flow separated by a colon (`:`).
+* `contact_flow_id` - The identifier of the Contact Flow.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Amazon Connect Contact Flows using the `instance_id` and `contact_flow_id` separated by a colon (`:`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Amazon Connect Contact Flows using the `instance_id` and `contact_flow_id` separated by a colon (`:`). For example:
+
+```console
+% terraform import aws_connect_contact_flow.example f1288a1f-6193-445a-b47e-af739b2:c1d4e5f6-1b3c-1b3c-1b3c-c1d4e5f6c1d4e5
+```
+
+<!-- cache-key: cdktf-0.18.0 input-d0d71a52cab7abb64ba26756e847f3a0e817e9bd943be18f335c31c6bacc92bc -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/connect_contact_flow_module.html.markdown b/website/docs/cdktf/python/r/connect_contact_flow_module.html.markdown
new file mode 100644
index 00000000000..702e3c0d853
--- /dev/null
+++ b/website/docs/cdktf/python/r/connect_contact_flow_module.html.markdown
@@ -0,0 +1,164 @@
+---
+subcategory: "Connect"
+layout: "aws"
+page_title: "AWS: aws_connect_contact_flow_module"
+description: |-
+  Provides details about a specific Amazon Connect Contact Flow Module.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_connect_contact_flow_module
+
+Provides an Amazon Connect Contact Flow Module resource. For more information see
+[Amazon Connect: Getting Started](https://docs.aws.amazon.com/connect/latest/adminguide/amazon-connect-get-started.html)
+
+This resource embeds or references Contact Flows Modules specified in Amazon Connect Contact Flow Language. For more information see
+[Amazon Connect Flow language](https://docs.aws.amazon.com/connect/latest/adminguide/flow-language.html)
+
+!> **WARN:** Contact Flow Modules exported from the Console [See Contact Flow import/export which is the same for Contact Flow Modules](https://docs.aws.amazon.com/connect/latest/adminguide/contact-flow-import-export.html) are not in the Amazon Connect Contact Flow Language and can not be used with this resource. Instead, the recommendation is to use the AWS CLI [`describe-contact-flow-module`](https://docs.aws.amazon.com/cli/latest/reference/connect/describe-contact-flow-module.html).
+See [example](#with-external-content) below which uses `jq` to extract the `Content` attribute and saves it to a local file.
+
+## Example Usage
+
+### Basic
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.connect_contact_flow_module import ConnectContactFlowModule
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ConnectContactFlowModule(self, "example",
+            content=Token.as_string(
+                Fn.jsonencode({
+                    "Actions": [{
+                        "Identifier": "12345678-1234-1234-1234-123456789012",
+                        "Parameters": {
+                            "Text": "Hello contact flow module"
+                        },
+                        "Transitions": {
+                            "Conditions": [],
+                            "Errors": [],
+                            "NextAction": "abcdef-abcd-abcd-abcd-abcdefghijkl"
+                        },
+                        "Type": "MessageParticipant"
+                    }, {
+                        "Identifier": "abcdef-abcd-abcd-abcd-abcdefghijkl",
+                        "Parameters": {},
+                        "Transitions": {},
+                        "Type": "DisconnectParticipant"
+                    }
+                    ],
+                    "Settings": {
+                        "InputParameters": [],
+                        "OutputParameters": [],
+                        "Transitions": [{
+                            "Description": "",
+                            "DisplayName": "Success",
+                            "ReferenceName": "Success"
+                        }, {
+                            "Description": "",
+                            "DisplayName": "Error",
+                            "ReferenceName": "Error"
+                        }
+                        ]
+                    },
+                    "StartAction": "12345678-1234-1234-1234-123456789012",
+                    "Version": "2019-10-30"
+                })),
+            description="Example Contact Flow Module Description",
+            instance_id="aaaaaaaa-bbbb-cccc-dddd-111111111111",
+            name="Example",
+            tags={
+                "Application": "Terraform",
+                "Method": "Create",
+                "Name": "Example Contact Flow Module"
+            }
+        )
+```
+
+### With External Content
+
+Use the AWS CLI to extract Contact Flow Content:
+
+```console
+% aws connect describe-contact-flow-module --instance-id 1b3c5d8-1b3c-1b3c-1b3c-1b3c5d81b3c5 --contact-flow-module-id c1d4e5f6-1b3c-1b3c-1b3c-c1d4e5f6c1d4e5 --region us-west-2 | jq '.ContactFlowModule.Content | fromjson' > contact_flow_module.json
+```
+
+Use the generated file as input:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.connect_contact_flow_module import ConnectContactFlowModule
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ConnectContactFlowModule(self, "example",
+            content_hash=Token.as_string(
+                Fn.filebase64sha256("contact_flow_module.json")),
+            description="Example Contact Flow Module Description",
+            filename="contact_flow_module.json",
+            instance_id="aaaaaaaa-bbbb-cccc-dddd-111111111111",
+            name="Example",
+            tags={
+                "Application": "Terraform",
+                "Method": "Create",
+                "Name": "Example Contact Flow Module"
+            }
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `content` - (Optional) Specifies the content of the Contact Flow Module, provided as a JSON string, written in Amazon Connect Contact Flow Language. If defined, the `filename` argument cannot be used.
+* `content_hash` - (Optional) Used to trigger updates. Must be set to a base64-encoded SHA256 hash of the Contact Flow Module source specified with `filename`. The usual way to set this is filebase64sha256("contact_flow_module.json") (Terraform 0.11.12 and later) or base64sha256(file("contact_flow_module.json")) (Terraform 0.11.11 and earlier), where "contact_flow_module.json" is the local filename of the Contact Flow Module source.
+* `description` - (Optional) Specifies the description of the Contact Flow Module.
+* `filename` - (Optional) The path to the Contact Flow Module source within the local filesystem. Conflicts with `content`.
+* `instance_id` - (Required) Specifies the identifier of the hosting Amazon Connect Instance.
+* `name` - (Required) Specifies the name of the Contact Flow Module.
+* `tags` - (Optional) Tags to apply to the Contact Flow Module. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the Contact Flow Module.
+* `id` - The identifier of the hosting Amazon Connect Instance and identifier of the Contact Flow Module separated by a colon (`:`).
+* `contact_flow_module_id` - The identifier of the Contact Flow Module.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Amazon Connect Contact Flow Modules using the `instance_id` and `contact_flow_module_id` separated by a colon (`:`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Amazon Connect Contact Flow Modules using the `instance_id` and `contact_flow_module_id` separated by a colon (`:`). For example:
+
+```console
+% terraform import aws_connect_contact_flow_module.example f1288a1f-6193-445a-b47e-af739b2:c1d4e5f6-1b3c-1b3c-1b3c-c1d4e5f6c1d4e5
+```
+
+<!-- cache-key: cdktf-0.18.0 input-fad5a83f3f5a5cf193df0637530e1bc1f6d891f07b57ab8518ef971ee9d23841 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/connect_hours_of_operation.html.markdown b/website/docs/cdktf/python/r/connect_hours_of_operation.html.markdown
new file mode 100644
index 00000000000..90c268fc9cc
--- /dev/null
+++ b/website/docs/cdktf/python/r/connect_hours_of_operation.html.markdown
@@ -0,0 +1,118 @@
+---
+subcategory: "Connect"
+layout: "aws"
+page_title: "AWS: aws_connect_hours_of_operation"
+description: |-
+  Provides details about a specific Amazon Connect Hours of Operation.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_connect_hours_of_operation
+
+Provides an Amazon Connect Hours of Operation resource. For more information see
+[Amazon Connect: Getting Started](https://docs.aws.amazon.com/connect/latest/adminguide/amazon-connect-get-started.html)
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.connect_hours_of_operation import ConnectHoursOfOperation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ConnectHoursOfOperation(self, "test",
+            config=[ConnectHoursOfOperationConfigA(
+                day="MONDAY",
+                end_time=ConnectHoursOfOperationConfigEndTime(
+                    hours=23,
+                    minutes=8
+                ),
+                start_time=ConnectHoursOfOperationConfigStartTime(
+                    hours=8,
+                    minutes=0
+                )
+            ), ConnectHoursOfOperationConfigA(
+                day="TUESDAY",
+                end_time=ConnectHoursOfOperationConfigEndTime(
+                    hours=21,
+                    minutes=0
+                ),
+                start_time=ConnectHoursOfOperationConfigStartTime(
+                    hours=9,
+                    minutes=0
+                )
+            )
+            ],
+            description="Monday office hours",
+            instance_id="aaaaaaaa-bbbb-cccc-dddd-111111111111",
+            name="Office Hours",
+            tags={
+                "Name": "Example Hours of Operation"
+            },
+            time_zone="EST"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `config` - (Required) One or more config blocks which define the configuration information for the hours of operation: day, start time, and end time . Config blocks are documented below.
+* `description` - (Optional) Specifies the description of the Hours of Operation.
+* `instance_id` - (Required) Specifies the identifier of the hosting Amazon Connect Instance.
+* `name` - (Required) Specifies the name of the Hours of Operation.
+* `tags` - (Optional) Tags to apply to the Hours of Operation. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `time_zone` - (Required) Specifies the time zone of the Hours of Operation.
+
+A `config` block supports the following arguments:
+
+* `day` - (Required) Specifies the day that the hours of operation applies to.
+* `end_time` - (Required) A end time block specifies the time that your contact center closes. The `end_time` is documented below.
+* `start_time` - (Required) A start time block specifies the time that your contact center opens. The `start_time` is documented below.
+
+A `end_time` block supports the following arguments:
+
+* `hours` - (Required) Specifies the hour of closing.
+* `minutes` - (Required) Specifies the minute of closing.
+
+A `start_time` block supports the following arguments:
+
+* `hours` - (Required) Specifies the hour of opening.
+* `minutes` - (Required) Specifies the minute of opening.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the Hours of Operation.
+* `hours_of_operation_id` - The identifier for the hours of operation.
+* `id` - The identifier of the hosting Amazon Connect Instance and identifier of the Hours of Operation separated by a colon (`:`).
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Amazon Connect Hours of Operations using the `instance_id` and `hours_of_operation_id` separated by a colon (`:`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Amazon Connect Hours of Operations using the `instance_id` and `hours_of_operation_id` separated by a colon (`:`). For example:
+
+```console
+% terraform import aws_connect_hours_of_operation.example f1288a1f-6193-445a-b47e-af739b2:c1d4e5f6-1b3c-1b3c-1b3c-c1d4e5f6c1d4e5
+```
+
+<!-- cache-key: cdktf-0.18.0 input-e685961316f9f34f8486d7fd79d05b0468f7a89263abaaf59ddd74e65a685a9c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/connect_instance.html.markdown b/website/docs/cdktf/python/r/connect_instance.html.markdown
new file mode 100644
index 00000000000..8432d603d87
--- /dev/null
+++ b/website/docs/cdktf/python/r/connect_instance.html.markdown
@@ -0,0 +1,137 @@
+---
+subcategory: "Connect"
+layout: "aws"
+page_title: "AWS: aws_connect_instance"
+description: |-
+  Provides details about a specific Connect Instance.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_connect_instance
+
+Provides an Amazon Connect instance resource. For more information see
+[Amazon Connect: Getting Started](https://docs.aws.amazon.com/connect/latest/adminguide/amazon-connect-get-started.html)
+
+!> **WARN:** Amazon Connect enforces a limit of [100 combined instance creation and deletions every 30 days](https://docs.aws.amazon.com/connect/latest/adminguide/amazon-connect-service-limits.html#feature-limits).  For example, if you create 80 instances and delete 20 of them, you must wait 30 days to create or delete another instance.  Use care when creating or deleting instances.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.connect_instance import ConnectInstance
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ConnectInstance(self, "test",
+            identity_management_type="CONNECT_MANAGED",
+            inbound_calls_enabled=True,
+            instance_alias="friendly-name-connect",
+            outbound_calls_enabled=True
+        )
+```
+
+## Example Usage with Existing Active Directory
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.connect_instance import ConnectInstance
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ConnectInstance(self, "test",
+            directory_id=Token.as_string(aws_directory_service_directory_test.id),
+            identity_management_type="EXISTING_DIRECTORY",
+            inbound_calls_enabled=True,
+            instance_alias="friendly-name-connect",
+            outbound_calls_enabled=True
+        )
+```
+
+## Example Usage with SAML
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.connect_instance import ConnectInstance
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ConnectInstance(self, "test",
+            identity_management_type="SAML",
+            inbound_calls_enabled=True,
+            instance_alias="friendly-name-connect",
+            outbound_calls_enabled=True
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `auto_resolve_best_voices_enabled` - (Optional) Specifies whether auto resolve best voices is enabled. Defaults to `true`.
+* `contact_flow_logs_enabled` - (Optional) Specifies whether contact flow logs are enabled. Defaults to `false`.
+* `contact_lens_enabled` - (Optional) Specifies whether contact lens is enabled. Defaults to `true`.
+* `directory_id` - (Optional) The identifier for the directory if identity_management_type is `EXISTING_DIRECTORY`.
+* `early_media_enabled` - (Optional) Specifies whether early media for outbound calls is enabled . Defaults to `true` if outbound calls is enabled.
+* `identity_management_type` - (Required) Specifies the identity management type attached to the instance. Allowed Values are: `SAML`, `CONNECT_MANAGED`, `EXISTING_DIRECTORY`.
+* `inbound_calls_enabled` - (Required) Specifies whether inbound calls are enabled.
+* `instance_alias` - (Optional) Specifies the name of the instance. Required if `directory_id` not specified.
+* `multi_party_conference_enabled` - (Optional) Specifies whether multi-party calls/conference is enabled. Defaults to `false`.
+* `outbound_calls_enabled` - (Required) Specifies whether outbound calls are enabled.
+<!-- * `use_custom_tts_voices` - (Optional) Whether use custom tts voices is enabled. Defaults to `false` -->
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The identifier of the instance.
+* `arn` - Amazon Resource Name (ARN) of the instance.
+* `created_time` - When the instance was created.
+* `service_role` - The service role of the instance.
+* `status` - The state of the instance.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `5m`)
+* `delete` - (Default `5m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Connect instances using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Connect instances using the `id`. For example:
+
+```console
+% terraform import aws_connect_instance.example f1288a1f-6193-445a-b47e-af739b2
+```
+
+<!-- cache-key: cdktf-0.18.0 input-e8635103b3da162fead649adf119535c0b0db258c89a17c04da04da2013fbd83 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/connect_instance_storage_config.html.markdown b/website/docs/cdktf/python/r/connect_instance_storage_config.html.markdown
new file mode 100644
index 00000000000..378b6329b8c
--- /dev/null
+++ b/website/docs/cdktf/python/r/connect_instance_storage_config.html.markdown
@@ -0,0 +1,238 @@
+---
+subcategory: "Connect"
+layout: "aws"
+page_title: "AWS: aws_connect_instance_storage_config"
+description: |-
+  Provides details about a specific Amazon Connect Instance Storage Config.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_connect_instance_storage_config
+
+Provides an Amazon Connect Instance Storage Config resource. For more information see
+[Amazon Connect: Getting Started](https://docs.aws.amazon.com/connect/latest/adminguide/amazon-connect-get-started.html)
+
+## Example Usage
+
+### Storage Config Kinesis Firehose Config
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.connect_instance_storage_config import ConnectInstanceStorageConfig
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ConnectInstanceStorageConfig(self, "example",
+            instance_id=Token.as_string(aws_connect_instance_example.id),
+            resource_type="CONTACT_TRACE_RECORDS",
+            storage_config=ConnectInstanceStorageConfigStorageConfig(
+                kinesis_firehose_config=ConnectInstanceStorageConfigStorageConfigKinesisFirehoseConfig(
+                    firehose_arn=Token.as_string(aws_kinesis_firehose_delivery_stream_example.arn)
+                ),
+                storage_type="KINESIS_FIREHOSE"
+            )
+        )
+```
+
+### Storage Config Kinesis Stream Config
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.connect_instance_storage_config import ConnectInstanceStorageConfig
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ConnectInstanceStorageConfig(self, "example",
+            instance_id=Token.as_string(aws_connect_instance_example.id),
+            resource_type="CONTACT_TRACE_RECORDS",
+            storage_config=ConnectInstanceStorageConfigStorageConfig(
+                kinesis_stream_config=ConnectInstanceStorageConfigStorageConfigKinesisStreamConfig(
+                    stream_arn=Token.as_string(aws_kinesis_stream_example.arn)
+                ),
+                storage_type="KINESIS_STREAM"
+            )
+        )
+```
+
+### Storage Config Kinesis Video Stream Config
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.connect_instance_storage_config import ConnectInstanceStorageConfig
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ConnectInstanceStorageConfig(self, "example",
+            instance_id=Token.as_string(aws_connect_instance_example.id),
+            resource_type="MEDIA_STREAMS",
+            storage_config=ConnectInstanceStorageConfigStorageConfig(
+                kinesis_video_stream_config=ConnectInstanceStorageConfigStorageConfigKinesisVideoStreamConfig(
+                    encryption_config=ConnectInstanceStorageConfigStorageConfigKinesisVideoStreamConfigEncryptionConfig(
+                        encryption_type="KMS",
+                        key_id=Token.as_string(aws_kms_key_example.arn)
+                    ),
+                    prefix="example",
+                    retention_period_hours=3
+                ),
+                storage_type="KINESIS_VIDEO_STREAM"
+            )
+        )
+```
+
+### Storage Config S3 Config
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.connect_instance_storage_config import ConnectInstanceStorageConfig
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ConnectInstanceStorageConfig(self, "example",
+            instance_id=Token.as_string(aws_connect_instance_example.id),
+            resource_type="CHAT_TRANSCRIPTS",
+            storage_config=ConnectInstanceStorageConfigStorageConfig(
+                s3_config=ConnectInstanceStorageConfigStorageConfigS3Config(
+                    bucket_name=Token.as_string(aws_s3_bucket_example.id),
+                    bucket_prefix="example"
+                ),
+                storage_type="S3"
+            )
+        )
+```
+
+### Storage Config S3 Config with Encryption Config
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.connect_instance_storage_config import ConnectInstanceStorageConfig
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ConnectInstanceStorageConfig(self, "example",
+            instance_id=Token.as_string(aws_connect_instance_example.id),
+            resource_type="CHAT_TRANSCRIPTS",
+            storage_config=ConnectInstanceStorageConfigStorageConfig(
+                s3_config=ConnectInstanceStorageConfigStorageConfigS3Config(
+                    bucket_name=Token.as_string(aws_s3_bucket_example.id),
+                    bucket_prefix="example",
+                    encryption_config=ConnectInstanceStorageConfigStorageConfigS3ConfigEncryptionConfig(
+                        encryption_type="KMS",
+                        key_id=Token.as_string(aws_kms_key_example.arn)
+                    )
+                ),
+                storage_type="S3"
+            )
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `instance_id` - (Required) Specifies the identifier of the hosting Amazon Connect Instance.
+* `resource_type` - (Required) A valid resource type. Valid Values: `AGENT_EVENTS` | `ATTACHMENTS` | `CALL_RECORDINGS` | `CHAT_TRANSCRIPTS` | `CONTACT_EVALUATIONS` | `CONTACT_TRACE_RECORDS` | `MEDIA_STREAMS` | `REAL_TIME_CONTACT_ANALYSIS_SEGMENTS` | `SCHEDULED_REPORTS` | `SCREEN_RECORDINGS`.
+* `storage_config` - (Required) Specifies the storage configuration options for the Connect Instance. [Documented below](#storage_config).
+
+### `storage_config`
+
+The `storage_config` configuration block supports the following arguments:
+
+* `kinesis_firehose_config` - (Required if `type` is set to `KINESIS_FIREHOSE`) A block that specifies the configuration of the Kinesis Firehose delivery stream. [Documented below](#kinesis_firehose_config).
+* `kinesis_stream_config` - (Required if `type` is set to `KINESIS_STREAM`) A block that specifies the configuration of the Kinesis data stream. [Documented below](#kinesis_stream_config).
+* `kinesis_video_stream_config` - (Required if `type` is set to `KINESIS_VIDEO_STREAM`) A block that specifies the configuration of the Kinesis video stream. [Documented below](#kinesis_video_stream_config).
+* `s3_config` - (Required if `type` is set to `S3`) A block that specifies the configuration of S3 Bucket. [Documented below](#s3_config).
+* `storage_type` - (Required) A valid storage type. Valid Values: `S3` | `KINESIS_VIDEO_STREAM` | `KINESIS_STREAM` | `KINESIS_FIREHOSE`.
+
+#### `kinesis_firehose_config`
+
+The `kinesis_firehose_config` configuration block supports the following arguments:
+
+* `firehose_arn` - (Required) The Amazon Resource Name (ARN) of the delivery stream.
+
+#### `kinesis_stream_config`
+
+The `kinesis_stream_config` configuration block supports the following arguments:
+
+* `stream_arn` - (Required) The Amazon Resource Name (ARN) of the data stream.
+
+#### `kinesis_video_stream_config`
+
+The `kinesis_video_stream_config` configuration block supports the following arguments:
+
+* `encryption_config` - (Required) The encryption configuration. [Documented below](#encryption_config).
+* `prefix` - (Required) The prefix of the video stream. Minimum length of `1`. Maximum length of `128`. When read from the state, the value returned is `<prefix>-connect-<connect_instance_alias>-contact-` since the API appends additional details to the `prefix`.
+* `retention_period_hours` - (Required) The number of hours data is retained in the stream. Kinesis Video Streams retains the data in a data store that is associated with the stream. Minimum value of `0`. Maximum value of `87600`. A value of `0`, indicates that the stream does not persist data.
+
+#### `s3_config`
+
+The `s3_config` configuration block supports the following arguments:
+
+* `bucket_name` - (Required) The S3 bucket name.
+* `bucket_prefix` - (Required) The S3 bucket prefix.
+* `encryption_config` - (Optional) The encryption configuration. [Documented below](#encryption_config).
+
+#### `encryption_config`
+
+The `encryption_config` configuration block supports the following arguments:
+
+* `encryption_type` - (Required) The type of encryption. Valid Values: `KMS`.
+* `key_id` - (Required) The full ARN of the encryption key. Be sure to provide the full ARN of the encryption key, not just the ID.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `association_id` - The existing association identifier that uniquely identifies the resource type and storage config for the given instance ID.
+* `id` - The identifier of the hosting Amazon Connect Instance, `association_id`, and `resource_type` separated by a colon (`:`).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Amazon Connect Instance Storage Configs using the `instance_id`, `association_id`, and `resource_type` separated by a colon (`:`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Amazon Connect Instance Storage Configs using the `instance_id`, `association_id`, and `resource_type` separated by a colon (`:`). For example:
+
+```console
+% terraform import aws_connect_instance_storage_config.example f1288a1f-6193-445a-b47e-af739b2:c1d4e5f6-1b3c-1b3c-1b3c-c1d4e5f6c1d4e5:CHAT_TRANSCRIPTS
+```
+
+<!-- cache-key: cdktf-0.18.0 input-f61d343b420a3f570c17898dc773fd2fccd8d832985461fc87179d145f2b2518 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/connect_lambda_function_association.html.markdown b/website/docs/cdktf/python/r/connect_lambda_function_association.html.markdown
new file mode 100644
index 00000000000..cc6b266b23c
--- /dev/null
+++ b/website/docs/cdktf/python/r/connect_lambda_function_association.html.markdown
@@ -0,0 +1,68 @@
+---
+subcategory: "Connect"
+layout: "aws"
+page_title: "AWS: aws_connect_lambda_function_association"
+description: |-
+  Provides details about a specific Connect Lambda Function Association.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_connect_lambda_function_association
+
+Provides an Amazon Connect Lambda Function Association. For more information see
+[Amazon Connect: Getting Started](https://docs.aws.amazon.com/connect/latest/adminguide/amazon-connect-get-started.html) and [Invoke AWS Lambda functions](https://docs.aws.amazon.com/connect/latest/adminguide/connect-lambda-functions.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.connect_lambda_function_association import ConnectLambdaFunctionAssociation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ConnectLambdaFunctionAssociation(self, "example",
+            function_arn=Token.as_string(aws_lambda_function_example.arn),
+            instance_id=Token.as_string(aws_connect_instance_example.id)
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `function_arn` - (Required) Amazon Resource Name (ARN) of the Lambda Function, omitting any version or alias qualifier.
+* `instance_id` - (Required) The identifier of the Amazon Connect instance. You can find the instanceId in the ARN of the instance.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Amazon Connect instance ID and Lambda Function ARN separated by a comma (`,`).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_connect_lambda_function_association` using the `instance_id` and `function_arn` separated by a comma (`,`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_connect_lambda_function_association` using the `instance_id` and `function_arn` separated by a comma (`,`). For example:
+
+```console
+% terraform import aws_connect_lambda_function_association.example aaaaaaaa-bbbb-cccc-dddd-111111111111,arn:aws:lambda:us-west-2:123456789123:function:example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-0dc6354187f80cf8f051974afaaff4271402269b69f61f468fc0147b5f4d0bfa -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/connect_lambda_function_association.markdown b/website/docs/cdktf/python/r/connect_lambda_function_association.markdown
new file mode 100644
index 00000000000..cc6b266b23c
--- /dev/null
+++ b/website/docs/cdktf/python/r/connect_lambda_function_association.markdown
@@ -0,0 +1,68 @@
+---
+subcategory: "Connect"
+layout: "aws"
+page_title: "AWS: aws_connect_lambda_function_association"
+description: |-
+  Provides details about a specific Connect Lambda Function Association.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_connect_lambda_function_association
+
+Provides an Amazon Connect Lambda Function Association. For more information see
+[Amazon Connect: Getting Started](https://docs.aws.amazon.com/connect/latest/adminguide/amazon-connect-get-started.html) and [Invoke AWS Lambda functions](https://docs.aws.amazon.com/connect/latest/adminguide/connect-lambda-functions.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.connect_lambda_function_association import ConnectLambdaFunctionAssociation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ConnectLambdaFunctionAssociation(self, "example",
+            function_arn=Token.as_string(aws_lambda_function_example.arn),
+            instance_id=Token.as_string(aws_connect_instance_example.id)
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `function_arn` - (Required) Amazon Resource Name (ARN) of the Lambda Function, omitting any version or alias qualifier.
+* `instance_id` - (Required) The identifier of the Amazon Connect instance. You can find the instanceId in the ARN of the instance.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Amazon Connect instance ID and Lambda Function ARN separated by a comma (`,`).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_connect_lambda_function_association` using the `instance_id` and `function_arn` separated by a comma (`,`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_connect_lambda_function_association` using the `instance_id` and `function_arn` separated by a comma (`,`). For example:
+
+```console
+% terraform import aws_connect_lambda_function_association.example aaaaaaaa-bbbb-cccc-dddd-111111111111,arn:aws:lambda:us-west-2:123456789123:function:example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-0dc6354187f80cf8f051974afaaff4271402269b69f61f468fc0147b5f4d0bfa -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/connect_phone_number.html.markdown b/website/docs/cdktf/python/r/connect_phone_number.html.markdown
new file mode 100644
index 00000000000..b88110be067
--- /dev/null
+++ b/website/docs/cdktf/python/r/connect_phone_number.html.markdown
@@ -0,0 +1,141 @@
+---
+subcategory: "Connect"
+layout: "aws"
+page_title: "AWS: aws_connect_phone_number"
+description: |-
+  Provides details about a specific Amazon Connect Phone Number.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_connect_phone_number
+
+Provides an Amazon Connect Phone Number resource. For more information see
+[Amazon Connect: Getting Started](https://docs.aws.amazon.com/connect/latest/adminguide/amazon-connect-get-started.html)
+
+## Example Usage
+
+### Basic
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.connect_phone_number import ConnectPhoneNumber
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ConnectPhoneNumber(self, "example",
+            country_code="US",
+            tags={
+                "hello": "world"
+            },
+            target_arn=Token.as_string(aws_connect_instance_example.arn),
+            type="DID"
+        )
+```
+
+### Description
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.connect_phone_number import ConnectPhoneNumber
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ConnectPhoneNumber(self, "example",
+            country_code="US",
+            description="example description",
+            target_arn=Token.as_string(aws_connect_instance_example.arn),
+            type="DID"
+        )
+```
+
+### Prefix to filter phone numbers
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.connect_phone_number import ConnectPhoneNumber
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ConnectPhoneNumber(self, "example",
+            country_code="US",
+            prefix="+18005",
+            target_arn=Token.as_string(aws_connect_instance_example.arn),
+            type="DID"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `country_code` - (Required, Forces new resource) The ISO country code. For a list of Valid values, refer to [PhoneNumberCountryCode](https://docs.aws.amazon.com/connect/latest/APIReference/API_SearchAvailablePhoneNumbers.html#connect-SearchAvailablePhoneNumbers-request-PhoneNumberCountryCode).
+* `description` - (Optional, Forces new resource) The description of the phone number.
+* `prefix` - (Optional, Forces new resource) The prefix of the phone number that is used to filter available phone numbers. If provided, it must contain `+` as part of the country code. Do not specify this argument when importing the resource.
+* `tags` - (Optional) Tags to apply to the Phone Number. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `target_arn` - (Required) The Amazon Resource Name (ARN) for Amazon Connect instances that phone numbers are claimed to.
+* `type` - (Required, Forces new resource) The type of phone number. Valid Values: `TOLL_FREE` | `DID`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the phone number.
+* `phone_number` - The phone number. Phone numbers are formatted `[+] [country code] [subscriber number including area code]`.
+* `id` - The identifier of the phone number.
+* `status` - A block that specifies status of the phone number. [Documented below](#status).
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+### `status`
+
+The `status` configuration block supports the following attributes:
+
+* `message` - The status message.
+* `status` - The status of the phone number. Valid Values: `CLAIMED` | `IN_PROGRESS` | `FAILED`.
+
+## Timeouts
+
+[Configuration options](https://www.terraform.io/docs/configuration/blocks/resources/syntax.html#operation-timeouts):
+
+* `create` - (Default `2m`)
+* `update` - (Default `2m`)
+* `delete` - (Default `2m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Amazon Connect Phone Numbers using its `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Amazon Connect Phone Numbers using its `id`. For example:
+
+```console
+% terraform import aws_connect_phone_number.example 12345678-abcd-1234-efgh-9876543210ab
+```
+
+<!-- cache-key: cdktf-0.18.0 input-3709bbd75b47ca64869527df48be54e1acf135a3093efdda6d797cfbc24ebba1 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/connect_queue.html.markdown b/website/docs/cdktf/python/r/connect_queue.html.markdown
new file mode 100644
index 00000000000..6b2d3e9319d
--- /dev/null
+++ b/website/docs/cdktf/python/r/connect_queue.html.markdown
@@ -0,0 +1,147 @@
+---
+subcategory: "Connect"
+layout: "aws"
+page_title: "AWS: aws_connect_queue"
+description: |-
+  Provides details about a specific Amazon Connect Queue
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_connect_queue
+
+Provides an Amazon Connect Queue resource. For more information see
+[Amazon Connect: Getting Started](https://docs.aws.amazon.com/connect/latest/adminguide/amazon-connect-get-started.html)
+
+## Example Usage
+
+### Basic
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.connect_queue import ConnectQueue
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ConnectQueue(self, "test",
+            description="Example Description",
+            hours_of_operation_id="12345678-1234-1234-1234-123456789012",
+            instance_id="aaaaaaaa-bbbb-cccc-dddd-111111111111",
+            name="Example Name",
+            tags={
+                "Name": "Example Queue"
+            }
+        )
+```
+
+### With Quick Connect IDs
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.connect_queue import ConnectQueue
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ConnectQueue(self, "test",
+            description="Example Description",
+            hours_of_operation_id="12345678-1234-1234-1234-123456789012",
+            instance_id="aaaaaaaa-bbbb-cccc-dddd-111111111111",
+            name="Example Name",
+            quick_connect_ids=["12345678-abcd-1234-abcd-123456789012"],
+            tags={
+                "Name": "Example Queue with Quick Connect IDs"
+            }
+        )
+```
+
+### With Outbound Caller Config
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.connect_queue import ConnectQueue
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ConnectQueue(self, "test",
+            description="Example Description",
+            hours_of_operation_id="12345678-1234-1234-1234-123456789012",
+            instance_id="aaaaaaaa-bbbb-cccc-dddd-111111111111",
+            name="Example Name",
+            outbound_caller_config=ConnectQueueOutboundCallerConfig(
+                outbound_caller_id_name="example",
+                outbound_caller_id_number_id="12345678-abcd-1234-abcd-123456789012",
+                outbound_flow_id="87654321-defg-1234-defg-987654321234"
+            ),
+            tags={
+                "Name": "Example Queue with Outbound Caller Config"
+            }
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `description` - (Optional) Specifies the description of the Queue.
+* `hours_of_operation_id` - (Required) Specifies the identifier of the Hours of Operation.
+* `instance_id` - (Required) Specifies the identifier of the hosting Amazon Connect Instance.
+* `max_contacts` - (Optional) Specifies the maximum number of contacts that can be in the queue before it is considered full. Minimum value of 0.
+* `name` - (Required) Specifies the name of the Queue.
+* `outbound_caller_config` - (Required) A block that defines the outbound caller ID name, number, and outbound whisper flow. The Outbound Caller Config block is documented below.
+* `quick_connect_ids` - (Optional) Specifies a list of quick connects ids that determine the quick connects available to agents who are working the queue.
+* `status` - (Optional) Specifies the description of the Queue. Valid values are `ENABLED`, `DISABLED`.
+* `tags` - (Optional) Tags to apply to the Queue. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+A `outbound_caller_config` block supports the following arguments:
+
+* `outbound_caller_id_name` - (Optional) Specifies the caller ID name.
+* `outbound_caller_id_number_id` - (Optional) Specifies the caller ID number.
+* `outbound_flow_id` - (Optional) Specifies outbound whisper flow to be used during an outbound call.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the Queue.
+* `queue_id` - The identifier for the Queue.
+* `id` - The identifier of the hosting Amazon Connect Instance and identifier of the Queue separated by a colon (`:`).
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Amazon Connect Queues using the `instance_id` and `queue_id` separated by a colon (`:`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Amazon Connect Queues using the `instance_id` and `queue_id` separated by a colon (`:`). For example:
+
+```console
+% terraform import aws_connect_queue.example f1288a1f-6193-445a-b47e-af739b2:c1d4e5f6-1b3c-1b3c-1b3c-c1d4e5f6c1d4e5
+```
+
+<!-- cache-key: cdktf-0.18.0 input-2ad77533b286fa62f6bf36fa4951ae8f0bd431d1f8cd5d285ecbbda98060e486 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/connect_quick_connect.html.markdown b/website/docs/cdktf/python/r/connect_quick_connect.html.markdown
new file mode 100644
index 00000000000..a25bfc17ada
--- /dev/null
+++ b/website/docs/cdktf/python/r/connect_quick_connect.html.markdown
@@ -0,0 +1,106 @@
+---
+subcategory: "Connect"
+layout: "aws"
+page_title: "AWS: aws_connect_quick_connect"
+description: |-
+  Provides details about a specific Amazon Quick Connect
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_connect_quick_connect
+
+Provides an Amazon Connect Quick Connect resource. For more information see
+[Amazon Connect: Getting Started](https://docs.aws.amazon.com/connect/latest/adminguide/amazon-connect-get-started.html)
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.connect_quick_connect import ConnectQuickConnect
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ConnectQuickConnect(self, "test",
+            description="quick connect phone number",
+            instance_id="aaaaaaaa-bbbb-cccc-dddd-111111111111",
+            name="Example Name",
+            quick_connect_config=ConnectQuickConnectQuickConnectConfig(
+                phone_config=[ConnectQuickConnectQuickConnectConfigPhoneConfig(
+                    phone_number="+12345678912"
+                )
+                ],
+                quick_connect_type="PHONE_NUMBER"
+            ),
+            tags={
+                "Name": "Example Quick Connect"
+            }
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `description` - (Optional) Specifies the description of the Quick Connect.
+* `instance_id` - (Required) Specifies the identifier of the hosting Amazon Connect Instance.
+* `name` - (Required) Specifies the name of the Quick Connect.
+* `quick_connect_config` - (Required) A block that defines the configuration information for the Quick Connect: `quick_connect_type` and one of `phone_config`, `queue_config`, `user_config` . The Quick Connect Config block is documented below.
+* `tags` - (Optional) Tags to apply to the Quick Connect. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+A `quick_connect_config` block supports the following arguments:
+
+* `quick_connect_type` - (Required) Specifies the configuration type of the quick connect. valid values are `PHONE_NUMBER`, `QUEUE`, `USER`.
+* `phone_config` - (Optional) Specifies the phone configuration of the Quick Connect. This is required only if `quick_connect_type` is `PHONE_NUMBER`. The `phone_config` block is documented below.
+* `queue_config` - (Optional) Specifies the queue configuration of the Quick Connect. This is required only if `quick_connect_type` is `QUEUE`. The `queue_config` block is documented below.
+* `user_config` - (Optional) Specifies the user configuration of the Quick Connect. This is required only if `quick_connect_type` is `USER`. The `user_config` block is documented below.
+
+A `phone_config` block supports the following arguments:
+
+* `phone_number` - (Required) Specifies the phone number in in E.164 format.
+
+A `queue_config` block supports the following arguments:
+
+* `contact_flow_id` - (Required) Specifies the identifier of the contact flow.
+* `queue_id` - (Required) Specifies the identifier for the queue.
+
+A `user_config` block supports the following arguments:
+
+* `contact_flow_id` - (Required) Specifies the identifier of the contact flow.
+* `user_id` - (Required) Specifies the identifier for the user.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the Quick Connect.
+* `quick_connect_id` - The identifier for the Quick Connect.
+* `id` - The identifier of the hosting Amazon Connect Instance and identifier of the Quick Connect separated by a colon (`:`).
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Amazon Connect Quick Connects using the `instance_id` and `quick_connect_id` separated by a colon (`:`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Amazon Connect Quick Connects using the `instance_id` and `quick_connect_id` separated by a colon (`:`). For example:
+
+```console
+% terraform import aws_connect_quick_connect.example f1288a1f-6193-445a-b47e-af739b2:c1d4e5f6-1b3c-1b3c-1b3c-c1d4e5f6c1d4e5
+```
+
+<!-- cache-key: cdktf-0.18.0 input-01f9e092c1240fc60d8e6329e1e37cd1a809022b9cf4800e0a25c88837374218 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/connect_routing_profile.html.markdown b/website/docs/cdktf/python/r/connect_routing_profile.html.markdown
new file mode 100644
index 00000000000..ebd00da9974
--- /dev/null
+++ b/website/docs/cdktf/python/r/connect_routing_profile.html.markdown
@@ -0,0 +1,112 @@
+---
+subcategory: "Connect"
+layout: "aws"
+page_title: "AWS: aws_connect_routing_profile"
+description: |-
+  Provides details about a specific Amazon Connect Routing Profile.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_connect_routing_profile
+
+Provides an Amazon Connect Routing Profile resource. For more information see
+[Amazon Connect: Getting Started](https://docs.aws.amazon.com/connect/latest/adminguide/amazon-connect-get-started.html)
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.connect_routing_profile import ConnectRoutingProfile
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ConnectRoutingProfile(self, "example",
+            default_outbound_queue_id="12345678-1234-1234-1234-123456789012",
+            description="example description",
+            instance_id="aaaaaaaa-bbbb-cccc-dddd-111111111111",
+            media_concurrencies=[ConnectRoutingProfileMediaConcurrencies(
+                channel="VOICE",
+                concurrency=1
+            )
+            ],
+            name="example",
+            queue_configs=[ConnectRoutingProfileQueueConfigs(
+                channel="VOICE",
+                delay=2,
+                priority=1,
+                queue_id="12345678-1234-1234-1234-123456789012"
+            )
+            ],
+            tags={
+                "Name": "Example Routing Profile"
+            }
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `default_outbound_queue_id` - (Required) Specifies the default outbound queue for the Routing Profile.
+* `description` - (Required) Specifies the description of the Routing Profile.
+* `instance_id` - (Required) Specifies the identifier of the hosting Amazon Connect Instance.
+* `media_concurrencies` - (Required) One or more `media_concurrencies` blocks that specify the channels that agents can handle in the Contact Control Panel (CCP) for this Routing Profile. The `media_concurrencies` block is documented below.
+* `name` - (Required) Specifies the name of the Routing Profile.
+* `queue_configs` - (Optional) One or more `queue_configs` blocks that specify the inbound queues associated with the routing profile. If no queue is added, the agent only can make outbound calls. The `queue_configs` block is documented below.
+* `tags` - (Optional) Tags to apply to the Routing Profile. If configured with a provider
+[`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+A `media_concurrencies` block supports the following arguments:
+
+* `channel` - (Required) Specifies the channels that agents can handle in the Contact Control Panel (CCP). Valid values are `VOICE`, `CHAT`, `TASK`.
+* `concurrency` - (Required) Specifies the number of contacts an agent can have on a channel simultaneously. Valid Range for `VOICE`: Minimum value of 1. Maximum value of 1. Valid Range for `CHAT`: Minimum value of 1. Maximum value of 10. Valid Range for `TASK`: Minimum value of 1. Maximum value of 10.
+
+A `queue_configs` block supports the following arguments:
+
+* `channel` - (Required) Specifies the channels agents can handle in the Contact Control Panel (CCP) for this routing profile. Valid values are `VOICE`, `CHAT`, `TASK`.
+* `delay` - (Required) Specifies the delay, in seconds, that a contact should be in the queue before they are routed to an available agent
+* `priority` - (Required) Specifies the order in which contacts are to be handled for the queue.
+* `queue_id` - (Required) Specifies the identifier for the queue.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the Routing Profile.
+* `id` - The identifier of the hosting Amazon Connect Instance and identifier of the Routing Profile separated by a colon (`:`).
+* `queue_configs` - In addition to the arguments used in the `queue_configs` argument block, there are additional attributes exported within the `queue_configs` block. These additional attributes are documented below.
+* `routing_profile_id` - The identifier for the Routing Profile.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+A `queue_configs` block supports the following attributes in addition to the arguments defined earlier:
+
+* `queue_arn` - ARN for the queue.
+* `queue_name` - Name for the queue.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Amazon Connect Routing Profiles using the `instance_id` and `routing_profile_id` separated by a colon (`:`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Amazon Connect Routing Profiles using the `instance_id` and `routing_profile_id` separated by a colon (`:`). For example:
+
+```console
+% terraform import aws_connect_routing_profile.example f1288a1f-6193-445a-b47e-af739b2:c1d4e5f6-1b3c-1b3c-1b3c-c1d4e5f6c1d4e5
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1f2cd7ee9876fa36ee4179b3d2a05a02f4d68fe3bb0d9a30414b3a35c3873635 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/connect_security_profile.html.markdown b/website/docs/cdktf/python/r/connect_security_profile.html.markdown
new file mode 100644
index 00000000000..ca230822ff4
--- /dev/null
+++ b/website/docs/cdktf/python/r/connect_security_profile.html.markdown
@@ -0,0 +1,81 @@
+---
+subcategory: "Connect"
+layout: "aws"
+page_title: "AWS: aws_connect_security_profile"
+description: |-
+  Provides details about a specific Amazon Connect Security Profile.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_connect_security_profile
+
+Provides an Amazon Connect Security Profile resource. For more information see
+[Amazon Connect: Getting Started](https://docs.aws.amazon.com/connect/latest/adminguide/amazon-connect-get-started.html)
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.connect_security_profile import ConnectSecurityProfile
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ConnectSecurityProfile(self, "example",
+            description="example description",
+            instance_id="aaaaaaaa-bbbb-cccc-dddd-111111111111",
+            name="example",
+            permissions=["BasicAgentAccess", "OutboundCallAccess"],
+            tags={
+                "Name": "Example Security Profile"
+            }
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `description` - (Optional) Specifies the description of the Security Profile.
+* `instance_id` - (Required) Specifies the identifier of the hosting Amazon Connect Instance.
+* `name` - (Required) Specifies the name of the Security Profile.
+* `permissions` - (Optional) Specifies a list of permissions assigned to the security profile.
+* `tags` - (Optional) Tags to apply to the Security Profile. If configured with a provider
+[`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the Security Profile.
+* `organization_resource_id` - The organization resource identifier for the security profile.
+* `security_profile_id` - The identifier for the Security Profile.
+* `id` - The identifier of the hosting Amazon Connect Instance and identifier of the Security Profile separated by a colon (`:`).
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Amazon Connect Security Profiles using the `instance_id` and `security_profile_id` separated by a colon (`:`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Amazon Connect Security Profiles using the `instance_id` and `security_profile_id` separated by a colon (`:`). For example:
+
+```console
+% terraform import aws_connect_security_profile.example f1288a1f-6193-445a-b47e-af739b2:c1d4e5f6-1b3c-1b3c-1b3c-c1d4e5f6c1d4e5
+```
+
+<!-- cache-key: cdktf-0.18.0 input-220f16e830e0261ed2fda1556d594951dc89e406092f917b2ad3ea75fafbac54 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/connect_user.html.markdown b/website/docs/cdktf/python/r/connect_user.html.markdown
new file mode 100644
index 00000000000..4a3298e42f7
--- /dev/null
+++ b/website/docs/cdktf/python/r/connect_user.html.markdown
@@ -0,0 +1,237 @@
+---
+subcategory: "Connect"
+layout: "aws"
+page_title: "AWS: aws_connect_user"
+description: |-
+  Provides details about a specific Amazon Connect User
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_connect_user
+
+Provides an Amazon Connect User resource. For more information see
+[Amazon Connect: Getting Started](https://docs.aws.amazon.com/connect/latest/adminguide/amazon-connect-get-started.html)
+
+## Example Usage
+
+### Basic
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.connect_user import ConnectUser
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ConnectUser(self, "example",
+            identity_info=ConnectUserIdentityInfo(
+                first_name="example",
+                last_name="example2"
+            ),
+            instance_id=Token.as_string(aws_connect_instance_example.id),
+            name="example",
+            password="Password123",
+            phone_config=ConnectUserPhoneConfig(
+                after_contact_work_time_limit=0,
+                phone_type="SOFT_PHONE"
+            ),
+            routing_profile_id=Token.as_string(aws_connect_routing_profile_example.routing_profile_id),
+            security_profile_ids=[
+                Token.as_string(aws_connect_security_profile_example.security_profile_id)
+            ]
+        )
+```
+
+### With hierarchy_group_id
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.connect_user import ConnectUser
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ConnectUser(self, "example",
+            hierarchy_group_id=Token.as_string(aws_connect_user_hierarchy_group_example.hierarchy_group_id),
+            identity_info=ConnectUserIdentityInfo(
+                first_name="example",
+                last_name="example2"
+            ),
+            instance_id=Token.as_string(aws_connect_instance_example.id),
+            name="example",
+            password="Password123",
+            phone_config=ConnectUserPhoneConfig(
+                after_contact_work_time_limit=0,
+                phone_type="SOFT_PHONE"
+            ),
+            routing_profile_id=Token.as_string(aws_connect_routing_profile_example.routing_profile_id),
+            security_profile_ids=[
+                Token.as_string(aws_connect_security_profile_example.security_profile_id)
+            ]
+        )
+```
+
+### With identity_info filled
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.connect_user import ConnectUser
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ConnectUser(self, "example",
+            identity_info=ConnectUserIdentityInfo(
+                email="example@example.com",
+                first_name="example",
+                last_name="example2"
+            ),
+            instance_id=Token.as_string(aws_connect_instance_example.id),
+            name="example",
+            password="Password123",
+            phone_config=ConnectUserPhoneConfig(
+                after_contact_work_time_limit=0,
+                phone_type="SOFT_PHONE"
+            ),
+            routing_profile_id=Token.as_string(aws_connect_routing_profile_example.routing_profile_id),
+            security_profile_ids=[
+                Token.as_string(aws_connect_security_profile_example.security_profile_id)
+            ]
+        )
+```
+
+### With phone_config phone type as desk phone
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.connect_user import ConnectUser
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ConnectUser(self, "example",
+            instance_id=Token.as_string(aws_connect_instance_example.id),
+            name="example",
+            password="Password123",
+            phone_config=ConnectUserPhoneConfig(
+                after_contact_work_time_limit=0,
+                phone_type="SOFT_PHONE"
+            ),
+            routing_profile_id=Token.as_string(aws_connect_routing_profile_example.routing_profile_id),
+            security_profile_ids=[
+                Token.as_string(aws_connect_security_profile_example.security_profile_id)
+            ]
+        )
+```
+
+### With multiple Security profile ids specified in security_profile_ids
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.connect_user import ConnectUser
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ConnectUser(self, "example",
+            instance_id=Token.as_string(aws_connect_instance_example.id),
+            name="example",
+            password="Password123",
+            phone_config=ConnectUserPhoneConfig(
+                after_contact_work_time_limit=0,
+                auto_accept=False,
+                desk_phone_number="+112345678912",
+                phone_type="DESK_PHONE"
+            ),
+            routing_profile_id=Token.as_string(aws_connect_routing_profile_example.routing_profile_id),
+            security_profile_ids=[
+                Token.as_string(aws_connect_security_profile_example.security_profile_id), example2.security_profile_id
+            ]
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `directory_user_id` - (Optional) The identifier of the user account in the directory used for identity management. If Amazon Connect cannot access the directory, you can specify this identifier to authenticate users. If you include the identifier, we assume that Amazon Connect cannot access the directory. Otherwise, the identity information is used to authenticate users from your directory. This parameter is required if you are using an existing directory for identity management in Amazon Connect when Amazon Connect cannot access your directory to authenticate users. If you are using SAML for identity management and include this parameter, an error is returned.
+* `hierarchy_group_id` - (Optional) The identifier of the hierarchy group for the user.
+* `identity_info` - (Optional) A block that contains information about the identity of the user. Documented below.
+* `instance_id` - (Required) Specifies the identifier of the hosting Amazon Connect Instance.
+* `name` - (Required) The user name for the account. For instances not using SAML for identity management, the user name can include up to 20 characters. If you are using SAML for identity management, the user name can include up to 64 characters from `[a-zA-Z0-9_-.\@]+`.
+* `password` - (Optional) The password for the user account. A password is required if you are using Amazon Connect for identity management. Otherwise, it is an error to include a password.
+* `phone_config` - (Required) A block that contains information about the phone settings for the user. Documented below.
+* `routing_profile_id` - (Required) The identifier of the routing profile for the user.
+* `security_profile_ids` - (Required) A list of identifiers for the security profiles for the user. Specify a minimum of 1 and maximum of 10 security profile ids. For more information, see [Best Practices for Security Profiles](https://docs.aws.amazon.com/connect/latest/adminguide/security-profile-best-practices.html) in the Amazon Connect Administrator Guide.
+* `tags` - (Optional) Tags to apply to the user. If configured with a provider
+[`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+A `identity_info` block supports the following arguments:
+
+* `email` - (Optional) The email address. If you are using SAML for identity management and include this parameter, an error is returned. Note that updates to the `email` is supported. From the [UpdateUserIdentityInfo API documentation](https://docs.aws.amazon.com/connect/latest/APIReference/API_UpdateUserIdentityInfo.html) it is strongly recommended to limit who has the ability to invoke `UpdateUserIdentityInfo`. Someone with that ability can change the login credentials of other users by changing their email address. This poses a security risk to your organization. They can change the email address of a user to the attacker's email address, and then reset the password through email. For more information, see [Best Practices for Security Profiles](https://docs.aws.amazon.com/connect/latest/adminguide/security-profile-best-practices.html) in the Amazon Connect Administrator Guide.
+* `first_name` - (Optional) The first name. This is required if you are using Amazon Connect or SAML for identity management. Minimum length of 1. Maximum length of 100.
+* `last_name` - (Optional) The last name. This is required if you are using Amazon Connect or SAML for identity management. Minimum length of 1. Maximum length of 100.
+
+A `phone_config` block supports the following arguments:
+
+* `after_contact_work_time_limit` - (Optional) The After Call Work (ACW) timeout setting, in seconds. Minimum value of 0.
+* `auto_accept` - (Optional) When Auto-Accept Call is enabled for an available agent, the agent connects to contacts automatically.
+* `desk_phone_number` - (Optional) The phone number for the user's desk phone. Required if `phone_type` is set as `DESK_PHONE`.
+* `phone_type` - (Required) The phone type. Valid values are `DESK_PHONE` and `SOFT_PHONE`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the user.
+* `id` - The identifier of the hosting Amazon Connect Instance and identifier of the user
+separated by a colon (`:`).
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `user_id` - The identifier for the user.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Amazon Connect Users using the `instance_id` and `user_id` separated by a colon (`:`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Amazon Connect Users using the `instance_id` and `user_id` separated by a colon (`:`). For example:
+
+```console
+% terraform import aws_connect_user.example f1288a1f-6193-445a-b47e-af739b2:c1d4e5f6-1b3c-1b3c-1b3c-c1d4e5f6c1d4e5
+```
+
+<!-- cache-key: cdktf-0.18.0 input-637041caefd4e9ef7b93ae5320925ba1005510f5cbf4f83cc643caaa13039440 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/connect_user_hierarchy_group.html.markdown b/website/docs/cdktf/python/r/connect_user_hierarchy_group.html.markdown
new file mode 100644
index 00000000000..84823e43edf
--- /dev/null
+++ b/website/docs/cdktf/python/r/connect_user_hierarchy_group.html.markdown
@@ -0,0 +1,129 @@
+---
+subcategory: "Connect"
+layout: "aws"
+page_title: "AWS: aws_connect_user_hierarchy_group"
+description: |-
+  Provides details about a specific Amazon Connect User Hierarchy Group
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_connect_user_hierarchy_group
+
+Provides an Amazon Connect User Hierarchy Group resource. For more information see
+[Amazon Connect: Getting Started](https://docs.aws.amazon.com/connect/latest/adminguide/amazon-connect-get-started.html)
+
+~> **NOTE:** The User Hierarchy Structure must be created before creating a User Hierarchy Group.
+
+## Example Usage
+
+### Basic
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.connect_user_hierarchy_group import ConnectUserHierarchyGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ConnectUserHierarchyGroup(self, "example",
+            instance_id="aaaaaaaa-bbbb-cccc-dddd-111111111111",
+            name="example",
+            tags={
+                "Name": "Example User Hierarchy Group"
+            }
+        )
+```
+
+### With a parent group
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.connect_user_hierarchy_group import ConnectUserHierarchyGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        parent = ConnectUserHierarchyGroup(self, "parent",
+            instance_id="aaaaaaaa-bbbb-cccc-dddd-111111111111",
+            name="parent",
+            tags={
+                "Name": "Example User Hierarchy Group Parent"
+            }
+        )
+        ConnectUserHierarchyGroup(self, "child",
+            instance_id="aaaaaaaa-bbbb-cccc-dddd-111111111111",
+            name="child",
+            parent_group_id=parent.hierarchy_group_id,
+            tags={
+                "Name": "Example User Hierarchy Group Child"
+            }
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `instance_id` - (Required) Specifies the identifier of the hosting Amazon Connect Instance.
+* `name` - (Required) The name of the user hierarchy group. Must not be more than 100 characters.
+* `parent_group_id` - (Optional) The identifier for the parent hierarchy group. The user hierarchy is created at level one if the parent group ID is null.
+* `tags` - (Optional) Tags to apply to the hierarchy group. If configured with a provider
+[`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the hierarchy group.
+* `hierarchy_group_id` - The identifier for the hierarchy group.
+* `hierarchy_path` - A block that contains information about the levels in the hierarchy group. The `hierarchy_path` block is documented below.
+* `id` - The identifier of the hosting Amazon Connect Instance and identifier of the hierarchy group
+separated by a colon (`:`).
+* `level_id` - The identifier of the level in the hierarchy group.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+A `hierarchy_path` block supports the following attributes:
+
+* `level_one` - A block that defines the details of level one. The level block is documented below.
+* `level_two` - A block that defines the details of level two. The level block is documented below.
+* `level_three` - A block that defines the details of level three. The level block is documented below.
+* `level_four` - A block that defines the details of level four. The level block is documented below.
+* `level_five` - A block that defines the details of level five. The level block is documented below.
+
+A level block supports the following attributes:
+
+* `arn` -  The Amazon Resource Name (ARN) of the hierarchy group.
+* `id` -  The identifier of the hierarchy group.
+* `name` - The name of the hierarchy group.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Amazon Connect User Hierarchy Groups using the `instance_id` and `hierarchy_group_id` separated by a colon (`:`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Amazon Connect User Hierarchy Groups using the `instance_id` and `hierarchy_group_id` separated by a colon (`:`). For example:
+
+```console
+% terraform import aws_connect_user_hierarchy_group.example f1288a1f-6193-445a-b47e-af739b2:c1d4e5f6-1b3c-1b3c-1b3c-c1d4e5f6c1d4e5
+```
+
+<!-- cache-key: cdktf-0.18.0 input-88263c0c4b64231cf0ae6b158e3728e1a26added6f1a3b85f4dc8db7b158609a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/connect_user_hierarchy_structure.html.markdown b/website/docs/cdktf/python/r/connect_user_hierarchy_structure.html.markdown
new file mode 100644
index 00000000000..8d021be2338
--- /dev/null
+++ b/website/docs/cdktf/python/r/connect_user_hierarchy_structure.html.markdown
@@ -0,0 +1,128 @@
+---
+subcategory: "Connect"
+layout: "aws"
+page_title: "AWS: aws_connect_user_hierarchy_structure"
+description: |-
+  Provides details about a specific Amazon Connect User Hierarchy Structure
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_connect_user_hierarchy_structure
+
+Provides an Amazon Connect User Hierarchy Structure resource. For more information see
+[Amazon Connect: Getting Started](https://docs.aws.amazon.com/connect/latest/adminguide/amazon-connect-get-started.html)
+
+## Example Usage
+
+### Basic
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.connect_user_hierarchy_structure import ConnectUserHierarchyStructure
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ConnectUserHierarchyStructure(self, "example",
+            hierarchy_structure=ConnectUserHierarchyStructureHierarchyStructure(
+                level_one=ConnectUserHierarchyStructureHierarchyStructureLevelOne(
+                    name="levelone"
+                )
+            ),
+            instance_id="aaaaaaaa-bbbb-cccc-dddd-111111111111"
+        )
+```
+
+### With Five Levels
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.connect_user_hierarchy_structure import ConnectUserHierarchyStructure
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ConnectUserHierarchyStructure(self, "example",
+            hierarchy_structure=ConnectUserHierarchyStructureHierarchyStructure(
+                level_five=ConnectUserHierarchyStructureHierarchyStructureLevelFive(
+                    name="levelfive"
+                ),
+                level_four=ConnectUserHierarchyStructureHierarchyStructureLevelFour(
+                    name="levelfour"
+                ),
+                level_one=ConnectUserHierarchyStructureHierarchyStructureLevelOne(
+                    name="levelone"
+                ),
+                level_three=ConnectUserHierarchyStructureHierarchyStructureLevelThree(
+                    name="levelthree"
+                ),
+                level_two=ConnectUserHierarchyStructureHierarchyStructureLevelTwo(
+                    name="leveltwo"
+                )
+            ),
+            instance_id="aaaaaaaa-bbbb-cccc-dddd-111111111111"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `hierarchy_structure` - (Required) A block that defines the hierarchy structure's levels. The `hierarchy_structure` block is documented below.
+* `instance_id` - (Required) Specifies the identifier of the hosting Amazon Connect Instance.
+
+A `hierarchy_structure` block supports the following arguments:
+
+* `level_one` - (Optional) A block that defines the details of level one. The level block is documented below.
+* `level_two` - (Optional) A block that defines the details of level two. The level block is documented below.
+* `level_three` - (Optional) A block that defines the details of level three. The level block is documented below.
+* `level_four` - (Optional) A block that defines the details of level four. The level block is documented below.
+* `level_five` - (Optional) A block that defines the details of level five. The level block is documented below.
+
+Each level block supports the following arguments:
+
+* `name` - (Required) The name of the user hierarchy level. Must not be more than 50 characters.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `hierarchy_structure` - In addition to the arguments defined initially, there are attributes added to the levels created. These additional attributes are documented below.
+* `id` - The identifier of the hosting Amazon Connect Instance.
+
+A level block supports the following additional attributes:
+
+* `arn` -  The Amazon Resource Name (ARN) of the hierarchy level.
+* `id` -  The identifier of the hierarchy level.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Amazon Connect User Hierarchy Structures using the `instance_id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Amazon Connect User Hierarchy Structures using the `instance_id`. For example:
+
+```console
+% terraform import aws_connect_user_hierarchy_structure.example f1288a1f-6193-445a-b47e-af739b2
+```
+
+<!-- cache-key: cdktf-0.18.0 input-d4221332a1de6be2872d8c5ee9a0bd06fd2ef712cb35778939fcdd12ecf0c17c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/connect_vocabulary.html.markdown b/website/docs/cdktf/python/r/connect_vocabulary.html.markdown
new file mode 100644
index 00000000000..9bc9c7b0a6c
--- /dev/null
+++ b/website/docs/cdktf/python/r/connect_vocabulary.html.markdown
@@ -0,0 +1,91 @@
+---
+subcategory: "Connect"
+layout: "aws"
+page_title: "AWS: aws_connect_vocabulary"
+description: |-
+  Provides details about a specific Amazon Connect Vocabulary
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_connect_vocabulary
+
+Provides an Amazon Connect Vocabulary resource. For more information see
+[Amazon Connect: Getting Started](https://docs.aws.amazon.com/connect/latest/adminguide/amazon-connect-get-started.html)
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.connect_vocabulary import ConnectVocabulary
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ConnectVocabulary(self, "example",
+            content="Phrase\tIPA\tSoundsLike\tDisplayAs\nLos-Angeles\t\t\tLos Angeles\nF.B.I.\tɛ f b i aɪ\t\tFBI\nEtienne\t\teh-tee-en\t\n",
+            instance_id="aaaaaaaa-bbbb-cccc-dddd-111111111111",
+            language_code="en-US",
+            name="example",
+            tags={
+                "Key1": "Value1"
+            }
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `content` - (Required) The content of the custom vocabulary in plain-text format with a table of values. Each row in the table represents a word or a phrase, described with Phrase, IPA, SoundsLike, and DisplayAs fields. Separate the fields with TAB characters. For more information, see [Create a custom vocabulary using a table](https://docs.aws.amazon.com/transcribe/latest/dg/custom-vocabulary.html#create-vocabulary-table). Minimum length of `1`. Maximum length of `60000`.
+* `instance_id` - (Required) Specifies the identifier of the hosting Amazon Connect Instance.
+* `language_code` - (Required) The language code of the vocabulary entries. For a list of languages and their corresponding language codes, see [What is Amazon Transcribe?](https://docs.aws.amazon.com/transcribe/latest/dg/transcribe-whatis.html). Valid Values are `ar-AE`, `de-CH`, `de-DE`, `en-AB`, `en-AU`, `en-GB`, `en-IE`, `en-IN`, `en-US`, `en-WL`, `es-ES`, `es-US`, `fr-CA`, `fr-FR`, `hi-IN`, `it-IT`, `ja-JP`, `ko-KR`, `pt-BR`, `pt-PT`, `zh-CN`.
+* `name` - (Required) A unique name of the custom vocabulary. Must not be more than 140 characters.
+* `tags` - (Optional) Tags to apply to the vocabulary. If configured with a provider
+[`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `5m`)
+* `delete` - (Default `100m`)
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the vocabulary.
+* `failure_reason` - The reason why the custom vocabulary was not created.
+* `id` - The identifier of the hosting Amazon Connect Instance and identifier of the vocabulary
+separated by a colon (`:`).
+* `last_modified_time` - The timestamp when the custom vocabulary was last modified.
+* `state` - The current state of the custom vocabulary. Valid values are `CREATION_IN_PROGRESS`, `ACTIVE`, `CREATION_FAILED`, `DELETE_IN_PROGRESS`.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `vocabulary_id` - The identifier of the custom vocabulary.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Amazon Connect Vocabularies using the `instance_id` and `vocabulary_id` separated by a colon (`:`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Amazon Connect Vocabularies using the `instance_id` and `vocabulary_id` separated by a colon (`:`). For example:
+
+```console
+% terraform import aws_connect_vocabulary.example f1288a1f-6193-445a-b47e-af739b2:c1d4e5f6-1b3c-1b3c-1b3c-c1d4e5f6c1d4e5
+```
+
+<!-- cache-key: cdktf-0.18.0 input-3955fbdc4f62d37293c6c592a646970e8139f7fe6c62b5ff6553de1bddf5eb38 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/controltower_control.html.markdown b/website/docs/cdktf/python/r/controltower_control.html.markdown
new file mode 100644
index 00000000000..4bc5b91d364
--- /dev/null
+++ b/website/docs/cdktf/python/r/controltower_control.html.markdown
@@ -0,0 +1,82 @@
+---
+subcategory: "Control Tower"
+layout: "aws"
+page_title: "AWS: aws_controltower_control"
+description: |-
+  Allows the application of pre-defined controls to organizational units.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_controltower_control
+
+Allows the application of pre-defined controls to organizational units. For more information on usage, please see the
+[AWS Control Tower User Guide](https://docs.aws.amazon.com/controltower/latest/userguide/enable-guardrails.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.controltower_control import ControltowerControl
+from imports.aws.data_aws_organizations_organization import DataAwsOrganizationsOrganization
+from imports.aws.data_aws_organizations_organizational_units import DataAwsOrganizationsOrganizationalUnits
+from imports.aws.data_aws_region import DataAwsRegion
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = DataAwsOrganizationsOrganization(self, "example")
+        data_aws_organizations_organizational_units_example =
+        DataAwsOrganizationsOrganizationalUnits(self, "example_1",
+            parent_id=Token.as_string(Fn.lookup_nested(example.roots, ["0", "id"]))
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_organizations_organizational_units_example.override_logical_id("example")
+        current = DataAwsRegion(self, "current")
+        aws_controltower_control_example = ControltowerControl(self, "example_3",
+            control_identifier="arn:aws:controltower:${" + current.name + "}::control/AWS-GR_EC2_VOLUME_INUSE_CHECK",
+            target_identifier=Token.as_string(
+                Fn.lookup_nested("${[ for x in ${" + data_aws_organizations_organizational_units_example.children + "} : x.arn if x.name == \"Infrastructure\"]}", ["0"]))
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_controltower_control_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `control_identifier` - (Required) The ARN of the control. Only Strongly recommended and Elective controls are permitted, with the exception of the Region deny guardrail.
+* `target_identifier` - (Required) The ARN of the organizational unit.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ARN of the organizational unit.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Control Tower Controls using their `organizational_unit_arn/control_identifier`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Control Tower Controls using their `organizational_unit_arn/control_identifier`. For example:
+
+```console
+% terraform import aws_controltower_control.example arn:aws:organizations::123456789101:ou/o-qqaejywet/ou-qg5o-ufbhdtv3,arn:aws:controltower:us-east-1::control/WTDSMKDKDNLE
+```
+
+<!-- cache-key: cdktf-0.18.0 input-9eb1fc57f4835f2b8e9d32dc66ec655897e6e1d78cffd7254048eef1370885df -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/cur_report_definition.html.markdown b/website/docs/cdktf/python/r/cur_report_definition.html.markdown
new file mode 100644
index 00000000000..8a27ae5a291
--- /dev/null
+++ b/website/docs/cdktf/python/r/cur_report_definition.html.markdown
@@ -0,0 +1,84 @@
+---
+subcategory: "Cost and Usage Report"
+layout: "aws"
+page_title: "AWS: aws_cur_report_definition"
+description: |-
+  Provides a Cost and Usage Report Definition.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cur_report_definition
+
+Manages Cost and Usage Report Definitions.
+
+~> *NOTE:* The AWS Cost and Usage Report service is only available in `us-east-1` currently.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cur_report_definition import CurReportDefinition
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        CurReportDefinition(self, "example_cur_report_definition",
+            additional_artifacts=["REDSHIFT", "QUICKSIGHT"],
+            additional_schema_elements=["RESOURCES", "SPLIT_COST_ALLOCATION_DATA"],
+            compression="GZIP",
+            format="textORcsv",
+            report_name="example-cur-report-definition",
+            s3_bucket="example-bucket-name",
+            s3_region="us-east-1",
+            time_unit="HOURLY"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `report_name` - (Required) Unique name for the report. Must start with a number/letter and is case sensitive. Limited to 256 characters.
+* `time_unit` - (Required) The frequency on which report data are measured and displayed.  Valid values are: `DAILY`, `HOURLY`, `MONTHLY`.
+* `format` - (Required) Format for report. Valid values are: `textORcsv`, `Parquet`. If `Parquet` is used, then Compression must also be `Parquet`.
+* `compression` - (Required) Compression format for report. Valid values are: `GZIP`, `ZIP`, `Parquet`. If `Parquet` is used, then format must also be `Parquet`.
+* `additional_schema_elements` - (Required) A list of schema elements. Valid values are: `RESOURCES`, `SPLIT_COST_ALLOCATION_DATA`.
+* `s3_bucket` - (Required) Name of the existing S3 bucket to hold generated reports.
+* `s3_prefix` - (Optional) Report path prefix. Limited to 256 characters.
+* `s3_region` - (Required) Region of the existing S3 bucket to hold generated reports.
+* `additional_artifacts` - (Required) A list of additional artifacts. Valid values are: `REDSHIFT`, `QUICKSIGHT`, `ATHENA`. When ATHENA exists within additional_artifacts, no other artifact type can be declared and report_versioning must be `OVERWRITE_REPORT`.
+* `refresh_closed_reports` - (Optional) Set to true to update your reports after they have been finalized if AWS detects charges related to previous months.
+* `report_versioning` - (Optional) Overwrite the previous version of each report or to deliver the report in addition to the previous versions. Valid values are: `CREATE_NEW_REPORT` and `OVERWRITE_REPORT`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) specifying the cur report.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Report Definitions using the `report_name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Report Definitions using the `report_name`. For example:
+
+```console
+% terraform import aws_cur_report_definition.example_cur_report_definition example-cur-report-definition
+```
+
+<!-- cache-key: cdktf-0.18.0 input-067985956199063abed34d5456679d542c82c7fd1e66853cbcc4c311a08d07b2 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/customer_gateway.html.markdown b/website/docs/cdktf/python/r/customer_gateway.html.markdown
new file mode 100644
index 00000000000..bd380414260
--- /dev/null
+++ b/website/docs/cdktf/python/r/customer_gateway.html.markdown
@@ -0,0 +1,80 @@
+---
+subcategory: "VPN (Site-to-Site)"
+layout: "aws"
+page_title: "AWS: aws_customer_gateway"
+description: |-
+  Provides a customer gateway inside a VPC. These objects can be
+  connected to VPN gateways via VPN connections, and allow you to
+  establish tunnels between your network and the VPC.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_customer_gateway
+
+Provides a customer gateway inside a VPC. These objects can be connected to VPN gateways via VPN connections, and allow you to establish tunnels between your network and the VPC.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.customer_gateway import CustomerGateway
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        CustomerGateway(self, "main",
+            bgp_asn=Token.as_string(65000),
+            ip_address="172.83.124.10",
+            tags={
+                "Name": "main-customer-gateway"
+            },
+            type="ipsec.1"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `bgp_asn` - (Required) The gateway's Border Gateway Protocol (BGP) Autonomous System Number (ASN).
+* `certificate_arn` - (Optional) The Amazon Resource Name (ARN) for the customer gateway certificate.
+* `device_name` - (Optional) A name for the customer gateway device.
+* `ip_address` - (Optional) The IPv4 address for the customer gateway device's outside interface.
+* `type` - (Required) The type of customer gateway. The only type AWS
+  supports at this time is "ipsec.1".
+* `tags` - (Optional) Tags to apply to the gateway. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The amazon-assigned ID of the gateway.
+* `arn` - The ARN of the customer gateway.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Customer Gateways using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Customer Gateways using the `id`. For example:
+
+```console
+% terraform import aws_customer_gateway.main cgw-b4dc3961
+```
+
+<!-- cache-key: cdktf-0.18.0 input-88fc55069a35af7318bebf35b35547af61fdd41a1afa9f74484f765b22315549 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/dataexchange_data_set.html.markdown b/website/docs/cdktf/python/r/dataexchange_data_set.html.markdown
new file mode 100644
index 00000000000..fd6a7923268
--- /dev/null
+++ b/website/docs/cdktf/python/r/dataexchange_data_set.html.markdown
@@ -0,0 +1,70 @@
+---
+subcategory: "Data Exchange"
+layout: "aws"
+page_title: "AWS: aws_dataexchange_data_set"
+description: |-
+  Provides a DataExchange DataSet
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_dataexchange_data_set
+
+Provides a resource to manage AWS Data Exchange DataSets.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.dataexchange_data_set import DataexchangeDataSet
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataexchangeDataSet(self, "example",
+            asset_type="S3_SNAPSHOT",
+            description="example",
+            name="example"
+        )
+```
+
+## Argument Reference
+
+* `asset_type` - (Required) The type of asset that is added to a data set. Valid values are: `S3_SNAPSHOT`, `REDSHIFT_DATA_SHARE`, and `API_GATEWAY_API`.
+* `description` - (Required) A description for the data set.
+* `name` - (Required) The name of the data set.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Id of the data set.
+* `arn` - The Amazon Resource Name of this data set.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DataExchange DataSets using their ARN. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import DataExchange DataSets using their ARN. For example:
+
+```console
+% terraform import aws_dataexchange_data_set.example arn:aws:dataexchange:us-west-2:123456789012:data-sets/4fa784c7-ccb4-4dbf-ba4f-02198320daa1
+```
+
+<!-- cache-key: cdktf-0.18.0 input-bcb32869378838571a8ae492463bc57c036b3f3e8528a58d44a0847e4f76852a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/dataexchange_revision.html.markdown b/website/docs/cdktf/python/r/dataexchange_revision.html.markdown
new file mode 100644
index 00000000000..2a673de68cb
--- /dev/null
+++ b/website/docs/cdktf/python/r/dataexchange_revision.html.markdown
@@ -0,0 +1,68 @@
+---
+subcategory: "Data Exchange"
+layout: "aws"
+page_title: "AWS: aws_dataexchange_revision"
+description: |-
+  Provides a DataExchange Revision
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_dataexchange_revision
+
+Provides a resource to manage AWS Data Exchange Revisions.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.dataexchange_revision import DataexchangeRevision
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DataexchangeRevision(self, "example",
+            data_set_id=Token.as_string(aws_dataexchange_data_set_example.id)
+        )
+```
+
+## Argument Reference
+
+* `data_set_id` - (Required) The dataset id.
+* `comment` - (Required) An optional comment about the revision.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Id of the data set.
+* `revision_id` - The Id of the revision.
+* `arn` - The Amazon Resource Name of this data set.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DataExchange Revisions using their `data-set-id:revision-id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import DataExchange Revisions using their `data-set-id:revision-id`. For example:
+
+```console
+% terraform import aws_dataexchange_revision.example 4fa784c7-ccb4-4dbf-ba4f-02198320daa1:4fa784c7-ccb4-4dbf-ba4f-02198320daa1
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1dff294cf3af4fd0944cbd190d7f06ffbbea96e953f96933b6e5b54e4c8fdcd1 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/datapipeline_pipeline.html.markdown b/website/docs/cdktf/python/r/datapipeline_pipeline.html.markdown
new file mode 100644
index 00000000000..077e4e6318c
--- /dev/null
+++ b/website/docs/cdktf/python/r/datapipeline_pipeline.html.markdown
@@ -0,0 +1,68 @@
+---
+subcategory: "Data Pipeline"
+layout: "aws"
+page_title: "AWS: aws_datapipeline_pipeline"
+description: |-
+  Provides a AWS DataPipeline Pipeline.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_datapipeline_pipeline
+
+Provides a DataPipeline Pipeline resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.datapipeline_pipeline import DatapipelinePipeline
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DatapipelinePipeline(self, "default",
+            name="tf-pipeline-default"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of Pipeline.
+* `description` - (Optional) The description of Pipeline.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The identifier of the client certificate.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_datapipeline_pipeline` using the id (Pipeline ID). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_datapipeline_pipeline` using the id (Pipeline ID). For example:
+
+```console
+% terraform import aws_datapipeline_pipeline.default df-1234567890
+```
+
+<!-- cache-key: cdktf-0.18.0 input-900f2070a2090481270a42e79665c28c006980d650e7abfe29339b39fbd3a425 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/datapipeline_pipeline_definition.html.markdown b/website/docs/cdktf/python/r/datapipeline_pipeline_definition.html.markdown
new file mode 100644
index 00000000000..51110b93a1b
--- /dev/null
+++ b/website/docs/cdktf/python/r/datapipeline_pipeline_definition.html.markdown
@@ -0,0 +1,146 @@
+---
+subcategory: "Data Pipeline"
+layout: "aws"
+page_title: "AWS: aws_datapipeline_pipeline_definition"
+description: |-
+  Provides a DataPipeline Definition.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_datapipeline_pipeline_definition
+
+Provides a DataPipeline Pipeline Definition resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.datapipeline_pipeline import DatapipelinePipeline
+from imports.aws.datapipeline_pipeline_definition import DatapipelinePipelineDefinition
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        default_var = DatapipelinePipeline(self, "default",
+            name="tf-pipeline-default"
+        )
+        DatapipelinePipelineDefinition(self, "example",
+            pipeline_id=default_var.id,
+            pipeline_object=[DatapipelinePipelineDefinitionPipelineObject(
+                field=[DatapipelinePipelineDefinitionPipelineObjectField(
+                    key="workerGroup",
+                    string_value="workerGroup"
+                )
+                ],
+                id="Default",
+                name="Default"
+            ), DatapipelinePipelineDefinitionPipelineObject(
+                field=[DatapipelinePipelineDefinitionPipelineObjectField(
+                    key="startDateTime",
+                    string_value="2012-12-12T00:00:00"
+                ), DatapipelinePipelineDefinitionPipelineObjectField(
+                    key="type",
+                    string_value="Schedule"
+                ), DatapipelinePipelineDefinitionPipelineObjectField(
+                    key="period",
+                    string_value="1 hour"
+                ), DatapipelinePipelineDefinitionPipelineObjectField(
+                    key="endDateTime",
+                    string_value="2012-12-21T18:00:00"
+                )
+                ],
+                id="Schedule",
+                name="Schedule"
+            ), DatapipelinePipelineDefinitionPipelineObject(
+                field=[DatapipelinePipelineDefinitionPipelineObjectField(
+                    key="type",
+                    string_value="ShellCommandActivity"
+                ), DatapipelinePipelineDefinitionPipelineObjectField(
+                    key="command",
+                    string_value="echo hello"
+                ), DatapipelinePipelineDefinitionPipelineObjectField(
+                    key="parent",
+                    string_value="Default"
+                ), DatapipelinePipelineDefinitionPipelineObjectField(
+                    key="schedule",
+                    string_value="Schedule"
+                )
+                ],
+                id="SayHello",
+                name="SayHello"
+            )
+            ]
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `pipeline_id` - (Required) ID of the pipeline.
+* `pipeline_object` - (Required) Configuration block for the objects that define the pipeline. See below
+
+The following arguments are optional:
+
+* `parameter_object` - (Optional) Configuration block for the parameter objects used in the pipeline definition. See below
+* `parameter_value` - (Optional) Configuration block for the parameter values used in the pipeline definition. See below
+
+### `pipeline_object`
+
+* `field` - (Required) Configuration block for Key-value pairs that define the properties of the object. See below
+* `id` - (Required) ID of the object.
+* `name` - (Required) ARN of the storage connector.
+
+### `field`
+
+* `key` - (Required) Field identifier.
+* `ref_value` - (Optional) Field value, expressed as the identifier of another object
+* `string_value` - (Optional) Field value, expressed as a String.
+
+### `parameter_object`
+
+* `attribute` - (Required) Configuration block for attributes of the parameter object. See below
+* `id` - (Required) ID of the parameter object.
+
+### `attribute`
+
+* `key` - (Required) Field identifier.
+* `string_value` - (Required) Field value, expressed as a String.
+
+### `parameter_value`
+
+* `id` - (Required) ID of the parameter value.
+* `string_value` - (Required) Field value, expressed as a String.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Unique ID of the datapipeline definition.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_datapipeline_pipeline_definition` using the id. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_datapipeline_pipeline_definition` using the id. For example:
+
+```console
+% terraform import aws_datapipeline_pipeline_definition.example df-1234567890
+```
+
+<!-- cache-key: cdktf-0.18.0 input-513fb767241e4c9deb0e2e131aa76eae7629b4160098b9555deea889ccb98bd7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/datasync_agent.html.markdown b/website/docs/cdktf/python/r/datasync_agent.html.markdown
new file mode 100644
index 00000000000..897ff4ae1cb
--- /dev/null
+++ b/website/docs/cdktf/python/r/datasync_agent.html.markdown
@@ -0,0 +1,126 @@
+---
+subcategory: "DataSync"
+layout: "aws"
+page_title: "AWS: aws_datasync_agent"
+description: |-
+  Manages an AWS DataSync Agent in the provider region
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_datasync_agent
+
+Manages an AWS DataSync Agent deployed on premises.
+
+~> **NOTE:** One of `activation_key` or `ip_address` must be provided for resource creation (agent activation). Neither is required for resource import. If using `ip_address`, Terraform must be able to make an HTTP (port 80) GET request to the specified IP address from where it is running. The agent will turn off that HTTP server after activation.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.datasync_agent import DatasyncAgent
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DatasyncAgent(self, "example",
+            ip_address="1.2.3.4",
+            name="example"
+        )
+```
+
+## Example Usage with VPC Endpoints
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, Fn, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_network_interface import DataAwsNetworkInterface
+from imports.aws.data_aws_region import DataAwsRegion
+from imports.aws.datasync_agent import DatasyncAgent
+from imports.aws.vpc_endpoint import VpcEndpoint
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        current = DataAwsRegion(self, "current")
+        example = VpcEndpoint(self, "example",
+            security_group_ids=[Token.as_string(aws_security_group_example.id)],
+            service_name="com.amazonaws.${" + current.name + "}.datasync",
+            subnet_ids=[Token.as_string(aws_subnet_example.id)],
+            vpc_endpoint_type="Interface",
+            vpc_id=Token.as_string(aws_vpc_example.id)
+        )
+        data_aws_network_interface_example = DataAwsNetworkInterface(self, "example_2",
+            id=Token.as_string(
+                Fn.lookup_nested(Fn.tolist(example.network_interface_ids), ["0"]))
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_network_interface_example.override_logical_id("example")
+        aws_datasync_agent_example = DatasyncAgent(self, "example_3",
+            ip_address="1.2.3.4",
+            name="example",
+            private_link_endpoint=Token.as_string(data_aws_network_interface_example.private_ip),
+            security_group_arns=[Token.as_string(aws_security_group_example.arn)],
+            subnet_arns=[Token.as_string(aws_subnet_example.arn)],
+            vpc_endpoint_id=example.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_datasync_agent_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) Name of the DataSync Agent.
+* `activation_key` - (Optional) DataSync Agent activation key during resource creation. Conflicts with `ip_address`. If an `ip_address` is provided instead, Terraform will retrieve the `activation_key` as part of the resource creation.
+* `ip_address` - (Optional) DataSync Agent IP address to retrieve activation key during resource creation. Conflicts with `activation_key`. DataSync Agent must be accessible on port 80 from where Terraform is running.
+* `private_link_endpoint` - (Optional) The IP address of the VPC endpoint the agent should connect to when retrieving an activation key during resource creation. Conflicts with `activation_key`.
+* `security_group_arns` - (Optional) The ARNs of the security groups used to protect your data transfer task subnets.
+* `subnet_arns` - (Optional) The Amazon Resource Names (ARNs) of the subnets in which DataSync will create elastic network interfaces for each data transfer task.
+* `tags` - (Optional) Key-value pairs of resource tags to assign to the DataSync Agent. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `vpc_endpoint_id` - (Optional) The ID of the VPC (virtual private cloud) endpoint that the agent has access to.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Amazon Resource Name (ARN) of the DataSync Agent.
+* `arn` - Amazon Resource Name (ARN) of the DataSync Agent.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `10m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_datasync_agent` using the DataSync Agent Amazon Resource Name (ARN). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_datasync_agent` using the DataSync Agent Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_datasync_agent.example arn:aws:datasync:us-east-1:123456789012:agent/agent-12345678901234567
+```
+
+<!-- cache-key: cdktf-0.18.0 input-0acba5dd129383087553f49e6f95af67ac05fa502cb2be0e9157f77f225a5cfa -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/datasync_location_azure_blob.html.markdown b/website/docs/cdktf/python/r/datasync_location_azure_blob.html.markdown
new file mode 100644
index 00000000000..4f1443d7c61
--- /dev/null
+++ b/website/docs/cdktf/python/r/datasync_location_azure_blob.html.markdown
@@ -0,0 +1,84 @@
+---
+subcategory: "DataSync"
+layout: "aws"
+page_title: "AWS: aws_datasync_location_azure_blob"
+description: |-
+  Manages an AWS DataSync Microsoft Azure Blob Storage Location
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_datasync_location_azure_blob
+
+Manages a Microsoft Azure Blob Storage Location within AWS DataSync.
+
+~> **NOTE:** The DataSync Agents must be available before creating this resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.datasync_location_azure_blob import DatasyncLocationAzureBlob
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DatasyncLocationAzureBlob(self, "example",
+            agent_arns=[Token.as_string(aws_datasync_agent_example.arn)],
+            authentication_type="SAS",
+            container_url="https://example.com/path",
+            sas_configuration=DatasyncLocationAzureBlobSasConfiguration(
+                token="sp=r&st=2023-12-20T14:54:52Z&se=2023-12-20T22:54:52Z&spr=https&sv=2021-06-08&sr=c&sig=aBBKDWQvyuVcTPH9EBp%2FXTI9E%2F%2Fmq171%2BZU178wcwqU%3D"
+            )
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `access_tier` - (Optional) The access tier that you want your objects or files transferred into. Valid values: `HOT`, `COOL` and `ARCHIVE`. Default: `HOT`.
+* `agent_arns` - (Required) A list of DataSync Agent ARNs with which this location will be associated.
+* `authentication_type` - (Required) The authentication method DataSync uses to access your Azure Blob Storage. Valid values: `SAS`.
+* `blob_type` - (Optional) The type of blob that you want your objects or files to be when transferring them into Azure Blob Storage. Valid values: `BLOB`. Default: `BLOB`.
+* `container_url` - (Required) The URL of the Azure Blob Storage container involved in your transfer.
+* `sas_configuration` - (Optional) The SAS configuration that allows DataSync to access your Azure Blob Storage. See configuration below.
+* `subdirectory` - (Optional) Path segments if you want to limit your transfer to a virtual directory in the container.
+* `tags` - (Optional) Key-value pairs of resource tags to assign to the DataSync Location. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### sas_configuration Argument Reference
+
+* `token` - (Required) A SAS token that provides permissions to access your Azure Blob Storage.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the DataSync Location.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_datasync_location_azure_blob` using the Amazon Resource Name (ARN). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_datasync_location_azure_blob` using the Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_datasync_location_azure_blob.example arn:aws:datasync:us-east-1:123456789012:location/loc-12345678901234567
+```
+
+<!-- cache-key: cdktf-0.18.0 input-edba47394ea99b575175b683fe5ef747a098ab29d4224c1d53d79c12b0a9eadd -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/datasync_location_efs.html.markdown b/website/docs/cdktf/python/r/datasync_location_efs.html.markdown
new file mode 100644
index 00000000000..c419727600f
--- /dev/null
+++ b/website/docs/cdktf/python/r/datasync_location_efs.html.markdown
@@ -0,0 +1,86 @@
+---
+subcategory: "DataSync"
+layout: "aws"
+page_title: "AWS: aws_datasync_location_efs"
+description: |-
+  Manages an EFS Location within AWS DataSync.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_datasync_location_efs
+
+Manages an AWS DataSync EFS Location.
+
+~> **NOTE:** The EFS File System must have a mounted EFS Mount Target before creating this resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.datasync_location_efs import DatasyncLocationEfs
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DatasyncLocationEfs(self, "example",
+            ec2_config=DatasyncLocationEfsEc2Config(
+                security_group_arns=[Token.as_string(aws_security_group_example.arn)],
+                subnet_arn=Token.as_string(aws_subnet_example.arn)
+            ),
+            efs_file_system_arn=Token.as_string(aws_efs_mount_target_example.file_system_arn)
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `access_point_arn` - (Optional) Specifies the Amazon Resource Name (ARN) of the access point that DataSync uses to access the Amazon EFS file system.
+* `ec2_config` - (Required) Configuration block containing EC2 configurations for connecting to the EFS File System.
+* `efs_file_system_arn` - (Required) Amazon Resource Name (ARN) of EFS File System.
+* `file_system_access_role_arn` - (Optional)  Specifies an Identity and Access Management (IAM) role that DataSync assumes when mounting the Amazon EFS file system.
+* `in_transit_encryption` - (Optional) Specifies whether you want DataSync to use TLS encryption when transferring data to or from your Amazon EFS file system. Valid values are `NONE` and `TLS1_2`.
+* `subdirectory` - (Optional) Subdirectory to perform actions as source or destination. Default `/`.
+* `tags` - (Optional) Key-value pairs of resource tags to assign to the DataSync Location. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### ec2_config Argument Reference
+
+The `ec2_config` configuration block supports the following arguments:
+
+* `security_group_arns` - (Required) List of Amazon Resource Names (ARNs) of the EC2 Security Groups that are associated with the EFS Mount Target.
+* `subnet_arn` - (Required) Amazon Resource Name (ARN) of the EC2 Subnet that is associated with the EFS Mount Target.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Amazon Resource Name (ARN) of the DataSync Location.
+* `arn` - Amazon Resource Name (ARN) of the DataSync Location.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_datasync_location_efs` using the DataSync Task Amazon Resource Name (ARN). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_datasync_location_efs` using the DataSync Task Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_datasync_location_efs.example arn:aws:datasync:us-east-1:123456789012:location/loc-12345678901234567
+```
+
+<!-- cache-key: cdktf-0.18.0 input-fd6bfd5001bb7a9ddd15cbeb18b63b36796ee1633c2d3e03d32a2391d872d1d1 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/datasync_location_fsx_lustre_file_system.html.markdown b/website/docs/cdktf/python/r/datasync_location_fsx_lustre_file_system.html.markdown
new file mode 100644
index 00000000000..ebe244fa24a
--- /dev/null
+++ b/website/docs/cdktf/python/r/datasync_location_fsx_lustre_file_system.html.markdown
@@ -0,0 +1,73 @@
+---
+subcategory: "DataSync"
+layout: "aws"
+page_title: "AWS: aws_datasync_location_fsx_lustre_file_system"
+description: |-
+  Manages an FSx Lustre Location within AWS DataSync.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_datasync_location_fsx_lustre_file_system
+
+Manages an AWS DataSync FSx Lustre Location.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.datasync_location_fsx_lustre_file_system import DatasyncLocationFsxLustreFileSystem
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DatasyncLocationFsxLustreFileSystem(self, "example",
+            fsx_filesystem_arn=Token.as_string(aws_fsx_lustre_file_system_example.arn),
+            security_group_arns=[Token.as_string(aws_security_group_example.arn)]
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `fsx_filesystem_arn` - (Required) The Amazon Resource Name (ARN) for the FSx for Lustre file system.
+* `security_group_arns` - (Optional) The Amazon Resource Names (ARNs) of the security groups that are to use to configure the FSx for Lustre file system.
+* `subdirectory` - (Optional) Subdirectory to perform actions as source or destination.
+* `tags` - (Optional) Key-value pairs of resource tags to assign to the DataSync Location. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Amazon Resource Name (ARN) of the DataSync Location.
+* `arn` - Amazon Resource Name (ARN) of the DataSync Location.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `uri` - The URL of the FSx for Lustre location that was described.
+* `creation_time` - The time that the FSx for Lustre location was created.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_datasync_location_fsx_lustre_file_system` using the `DataSync-ARN#FSx-Lustre-ARN`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_datasync_location_fsx_lustre_file_system` using the `DataSync-ARN#FSx-Lustre-ARN`. For example:
+
+```console
+% terraform import aws_datasync_location_fsx_lustre_file_system.example arn:aws:datasync:us-west-2:123456789012:location/loc-12345678901234567#arn:aws:fsx:us-west-2:476956259333:file-system/fs-08e04cd442c1bb94a
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ff1125dfd4d4a7819d78cada4fa2e6a9cacc0dbd81f2b217268a7544a6a5415d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/datasync_location_fsx_ontap_file_system.html.markdown b/website/docs/cdktf/python/r/datasync_location_fsx_ontap_file_system.html.markdown
new file mode 100644
index 00000000000..82576c7f9d3
--- /dev/null
+++ b/website/docs/cdktf/python/r/datasync_location_fsx_ontap_file_system.html.markdown
@@ -0,0 +1,111 @@
+---
+subcategory: "DataSync"
+layout: "aws"
+page_title: "AWS: aws_datasync_location_fsx_ontap_file_system"
+description: |-
+  Terraform resource for managing an AWS DataSync Location FSx Ontap File System.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_datasync_location_fsx_ontap_file_system
+
+Terraform resource for managing an AWS DataSync Location FSx Ontap File System.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.datasync_location_fsx_ontap_file_system import DatasyncLocationFsxOntapFileSystem
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DatasyncLocationFsxOntapFileSystem(self, "test",
+            fsx_filesystem_arn=Token.as_string(aws_fsx_ontap_file_system_test.arn),
+            protocol=DatasyncLocationFsxOntapFileSystemProtocol(
+                nfs=DatasyncLocationFsxOntapFileSystemProtocolNfs(
+                    mount_options=DatasyncLocationFsxOntapFileSystemProtocolNfsMountOptions(
+                        version="NFS3"
+                    )
+                )
+            ),
+            security_group_arns=[Token.as_string(aws_security_group_test.arn)],
+            storage_virtual_machine_arn=Token.as_string(aws_fsx_ontap_storage_virtual_machine_test.arn)
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `protocol` - (Required) The data transfer protocol that DataSync uses to access your Amazon FSx file system. See [Protocol](#protocol) below.
+* `security_group_arns` - (Required) The security groups that provide access to your file system's preferred subnet. The security groups must allow outbbound traffic on the following ports (depending on the protocol you use):
+    * Network File System (NFS): TCP ports 111, 635, and 2049
+    * Server Message Block (SMB): TCP port 445
+* `storage_virtual_machine_arn` - (Required) The ARN of the SVM in your file system where you want to copy data to of from.
+
+The following arguments are optional:
+
+* `subdirectory` - (Optional) Path to the file share in the SVM where you'll copy your data. You can specify a junction path (also known as a mount point), qtree path (for NFS file shares), or share name (for SMB file shares) (e.g. `/vol1`, `/vol1/tree1`, `share1`).
+* `tags` - (Optional) Key-value pairs of resource tags to assign to the DataSync Location. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Protocol
+
+* `nfs` - Network File System (NFS) protocol that DataSync uses to access your FSx ONTAP file system. See [NFS](#nfs) below.
+* `smb` - Server Message Block (SMB) protocol that DataSync uses to access your FSx ONTAP file system. See [SMB] (#smb) below.
+
+### NFS
+
+* `mount_options` - (Required) Mount options that are available for DataSync to access an NFS location. See [NFS Mount Options](#nfs-mount-options) below.
+
+### NFS Mount Options
+
+* `version` - (Optional) The specific NFS version that you want DataSync to use for mounting your NFS share. Valid values: `NFS3`. Default: `NFS3`
+
+### SMB
+
+* `domain` - Fully qualified domain name of the Microsoft Active Directory (AD) that your storage virtual machine belongs to.
+* `mount_options` - Mount options that are available for DataSync to access an SMB location. See [SMB Mount Options](#smb-mount-options) below.
+* `password` - Password of a user who has permission to access your SVM.
+* `user` - Username that can mount the location and access the files, folders, and metadata that you need in the SVM.
+
+### SMB Mount Options
+
+* `version` - (Optional) SMB version that you want DataSync to use for mounting your SMB share. Valid values: `AUTOMATIC`, `SMB3`, `SMB2` `SMB2_0`. Default: `AUTOMATIC`
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the DataSync Location for the FSx Ontap File System.
+* `fsx_filesystem_arn` - ARN of the FSx Ontap File System.
+* `uri` - URI of the FSx ONTAP file system location
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_datasync_location_fsx_ontap_file_system` using the `DataSync-ARN#FSx-ontap-svm-ARN`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_datasync_location_fsx_ontap_file_system` using the `DataSync-ARN#FSx-ontap-svm-ARN`. For example:
+
+```console
+% terraform import aws_datasync_location_fsx_ontap_file_system.example arn:aws:datasync:us-west-2:123456789012:location/loc-12345678901234567#arn:aws:fsx:us-west-2:123456789012:storage-virtual-machine/svm-12345678abcdef123
+```
+
+<!-- cache-key: cdktf-0.18.0 input-fdb2898abac9131a1e6f0aedf0c516dba5a11e0930534026410c35d320db2ff2 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/datasync_location_fsx_openzfs_file_system.html.markdown b/website/docs/cdktf/python/r/datasync_location_fsx_openzfs_file_system.html.markdown
new file mode 100644
index 00000000000..3071dbb71e3
--- /dev/null
+++ b/website/docs/cdktf/python/r/datasync_location_fsx_openzfs_file_system.html.markdown
@@ -0,0 +1,93 @@
+---
+subcategory: "DataSync"
+layout: "aws"
+page_title: "AWS: aws_datasync_location_fsx_openzfs_file_system"
+description: |-
+  Manages an FSx OpenZfs Location within AWS DataSync.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_datasync_location_fsx_openzfs_file_system
+
+Manages an AWS DataSync FSx OpenZfs Location.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.datasync_location_fsx_openzfs_file_system import DatasyncLocationFsxOpenzfsFileSystem
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DatasyncLocationFsxOpenzfsFileSystem(self, "example",
+            fsx_filesystem_arn=Token.as_string(aws_fsx_openzfs_file_system_example.arn),
+            protocol=DatasyncLocationFsxOpenzfsFileSystemProtocol(
+                nfs=DatasyncLocationFsxOpenzfsFileSystemProtocolNfs(
+                    mount_options=DatasyncLocationFsxOpenzfsFileSystemProtocolNfsMountOptions(
+                        version="AUTOMATIC"
+                    )
+                )
+            ),
+            security_group_arns=[Token.as_string(aws_security_group_example.arn)]
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `fsx_filesystem_arn` - (Required) The Amazon Resource Name (ARN) for the FSx for OpenZfs file system.
+* `protocol` - (Required) The type of protocol that DataSync uses to access your file system. See below.
+* `security_group_arns` - (Optional) The Amazon Resource Names (ARNs) of the security groups that are to use to configure the FSx for openzfs file system.
+* `subdirectory` - (Optional) Subdirectory to perform actions as source or destination. Must start with `/fsx`.
+* `tags` - (Optional) Key-value pairs of resource tags to assign to the DataSync Location. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### protocol
+
+* `nfs` - (Required) Represents the Network File System (NFS) protocol that DataSync uses to access your FSx for OpenZFS file system. See below.
+
+### nfs
+
+* `mount_options` - (Required) Represents the mount options that are available for DataSync to access an NFS location. See below.
+
+### mount_options
+
+* `version` - (Optional) The specific NFS version that you want DataSync to use for mounting your NFS share. Valid values: `AUTOMATIC`, `NFS3`, `NFS4_0` and `NFS4_1`. Default: `AUTOMATIC`
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Amazon Resource Name (ARN) of the DataSync Location.
+* `arn` - Amazon Resource Name (ARN) of the DataSync Location.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `uri` - The URL of the FSx for openzfs location that was described.
+* `creation_time` - The time that the FSx for openzfs location was created.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_datasync_location_fsx_openzfs_file_system` using the `DataSync-ARN#FSx-openzfs-ARN`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_datasync_location_fsx_openzfs_file_system` using the `DataSync-ARN#FSx-openzfs-ARN`. For example:
+
+```console
+% terraform import aws_datasync_location_fsx_openzfs_file_system.example arn:aws:datasync:us-west-2:123456789012:location/loc-12345678901234567#arn:aws:fsx:us-west-2:123456789012:file-system/fs-08e04cd442c1bb94a
+```
+
+<!-- cache-key: cdktf-0.18.0 input-fd48fc85d580e2ffedd314108832541f3cf603267b4fbea2028c4f03fd9b3981 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/datasync_location_fsx_windows_file_system.html.markdown b/website/docs/cdktf/python/r/datasync_location_fsx_windows_file_system.html.markdown
new file mode 100644
index 00000000000..bae46e0c7b0
--- /dev/null
+++ b/website/docs/cdktf/python/r/datasync_location_fsx_windows_file_system.html.markdown
@@ -0,0 +1,78 @@
+---
+subcategory: "DataSync"
+layout: "aws"
+page_title: "AWS: aws_datasync_location_fsx_windows_file_system"
+description: |-
+  Manages an FSx Windows Location within AWS DataSync.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_datasync_location_fsx_windows_file_system
+
+Manages an AWS DataSync FSx Windows Location.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.datasync_location_fsx_windows_file_system import DatasyncLocationFsxWindowsFileSystem
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DatasyncLocationFsxWindowsFileSystem(self, "example",
+            fsx_filesystem_arn=Token.as_string(aws_fsx_windows_file_system_example.arn),
+            password="SuperSecretPassw0rd",
+            security_group_arns=[Token.as_string(aws_security_group_example.arn)],
+            user="SomeUser"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `fsx_filesystem_arn` - (Required) The Amazon Resource Name (ARN) for the FSx for Windows file system.
+* `password` - (Required) The password of the user who has the permissions to access files and folders in the FSx for Windows file system.
+* `user` - (Required) The user who has the permissions to access files and folders in the FSx for Windows file system.
+* `domain` - (Optional) The name of the Windows domain that the FSx for Windows server belongs to.
+* `security_group_arns` - (Optional) The Amazon Resource Names (ARNs) of the security groups that are to use to configure the FSx for Windows file system.
+* `subdirectory` - (Optional) Subdirectory to perform actions as source or destination.
+* `tags` - (Optional) Key-value pairs of resource tags to assign to the DataSync Location. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Amazon Resource Name (ARN) of the DataSync Location.
+* `arn` - Amazon Resource Name (ARN) of the DataSync Location.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `uri` - The URL of the FSx for Windows location that was described.
+* `creation_time` - The time that the FSx for Windows location was created.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_datasync_location_fsx_windows_file_system` using the `DataSync-ARN#FSx-Windows-ARN`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_datasync_location_fsx_windows_file_system` using the `DataSync-ARN#FSx-Windows-ARN`. For example:
+
+```console
+% terraform import aws_datasync_location_fsx_windows_file_system.example arn:aws:datasync:us-west-2:123456789012:location/loc-12345678901234567#arn:aws:fsx:us-west-2:476956259333:file-system/fs-08e04cd442c1bb94a
+```
+
+<!-- cache-key: cdktf-0.18.0 input-4eec17500a279969bf934f139b5e4af49e794bbe75e137b1fefca8b157890cbf -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/datasync_location_hdfs.html.markdown b/website/docs/cdktf/python/r/datasync_location_hdfs.html.markdown
new file mode 100644
index 00000000000..0864e5af689
--- /dev/null
+++ b/website/docs/cdktf/python/r/datasync_location_hdfs.html.markdown
@@ -0,0 +1,97 @@
+---
+subcategory: "DataSync"
+layout: "aws"
+page_title: "AWS: aws_datasync_location_hdfs"
+description: |-
+  Manages an AWS DataSync HDFS Location
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_datasync_location_hdfs
+
+Manages an HDFS Location within AWS DataSync.
+
+~> **NOTE:** The DataSync Agents must be available before creating this resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.datasync_location_hdfs import DatasyncLocationHdfs
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DatasyncLocationHdfs(self, "example",
+            agent_arns=[Token.as_string(aws_datasync_agent_example.arn)],
+            authentication_type="SIMPLE",
+            name_node=[DatasyncLocationHdfsNameNode(
+                hostname=Token.as_string(aws_instance_example.private_dns),
+                port=80
+            )
+            ],
+            simple_user="example"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `agent_arns` - (Required) A list of DataSync Agent ARNs with which this location will be associated.
+* `authentication_type` - (Required) The type of authentication used to determine the identity of the user. Valid values are `SIMPLE` and `KERBEROS`.
+* `name_node` - (Required)  The NameNode that manages the HDFS namespace. The NameNode performs operations such as opening, closing, and renaming files and directories. The NameNode contains the information to map blocks of data to the DataNodes. You can use only one NameNode. See configuration below.
+* `simple_user` - (Optional) The user name used to identify the client on the host operating system. If `SIMPLE` is specified for `authentication_type`, this parameter is required.
+* `block_size` - (Optional) The size of data blocks to write into the HDFS cluster. The block size must be a multiple of 512 bytes. The default block size is 128 mebibytes (MiB).
+* `replication_factor` - (Optional) The number of DataNodes to replicate the data to when writing to the HDFS cluster. By default, data is replicated to three DataNodes.
+* `kerberos_keytab` - (Optional) The Kerberos key table (keytab) that contains mappings between the defined Kerberos principal and the encrypted keys. If `KERBEROS` is specified for `authentication_type`, this parameter is required.
+* `kerberos_krb5_conf` - (Optional) The krb5.conf file that contains the Kerberos configuration information. If `KERBEROS` is specified for `authentication_type`, this parameter is required.
+* `kerberos_principal` - (Optional) The Kerberos principal with access to the files and folders on the HDFS cluster. If `KERBEROS` is specified for `authentication_type`, this parameter is required.
+* `kms_key_provider_uri` - (Optional) The URI of the HDFS cluster's Key Management Server (KMS).
+* `qop_configuration` - (Optional) The Quality of Protection (QOP) configuration specifies the Remote Procedure Call (RPC) and data transfer protection settings configured on the Hadoop Distributed File System (HDFS) cluster. If `qop_configuration` isn't specified, `rpc_protection` and `data_transfer_protection` default to `PRIVACY`. If you set RpcProtection or DataTransferProtection, the other parameter assumes the same value.  See configuration below.
+* `subdirectory` - (Optional) A subdirectory in the HDFS cluster. This subdirectory is used to read data from or write data to the HDFS cluster. If the subdirectory isn't specified, it will default to /.
+* `tags` - (Optional) Key-value pairs of resource tags to assign to the DataSync Location. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### name_node Argument Reference
+
+* `hostname` - (Required) The hostname of the NameNode in the HDFS cluster. This value is the IP address or Domain Name Service (DNS) name of the NameNode. An agent that's installed on-premises uses this hostname to communicate with the NameNode in the network.
+* `port` - (Required) The port that the NameNode uses to listen to client requests.
+
+### qop_configuration Argument Reference
+
+* `data_transfer_protection` - (Optional) The data transfer protection setting configured on the HDFS cluster. This setting corresponds to your dfs.data.transfer.protection setting in the hdfs-site.xml file on your Hadoop cluster. Valid values are `DISABLED`, `AUTHENTICATION`, `INTEGRITY` and `PRIVACY`.
+* `rpc_protection` - (Optional)The RPC protection setting configured on the HDFS cluster. This setting corresponds to your hadoop.rpc.protection setting in your core-site.xml file on your Hadoop cluster. Valid values are `DISABLED`, `AUTHENTICATION`, `INTEGRITY` and `PRIVACY`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the DataSync Location.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_datasync_location_hdfs` using the Amazon Resource Name (ARN). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_datasync_location_hdfs` using the Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_datasync_location_hdfs.example arn:aws:datasync:us-east-1:123456789012:location/loc-12345678901234567
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1cc985ade5113195ca4aacb6777a856e91fc3b85034c6177aac61b5f398194ec -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/datasync_location_nfs.html.markdown b/website/docs/cdktf/python/r/datasync_location_nfs.html.markdown
new file mode 100644
index 00000000000..7558e8aad0b
--- /dev/null
+++ b/website/docs/cdktf/python/r/datasync_location_nfs.html.markdown
@@ -0,0 +1,89 @@
+---
+subcategory: "DataSync"
+layout: "aws"
+page_title: "AWS: aws_datasync_location_nfs"
+description: |-
+  Manages an AWS DataSync NFS Location
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_datasync_location_nfs
+
+Manages an NFS Location within AWS DataSync.
+
+~> **NOTE:** The DataSync Agents must be available before creating this resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.datasync_location_nfs import DatasyncLocationNfs
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DatasyncLocationNfs(self, "example",
+            on_prem_config=DatasyncLocationNfsOnPremConfig(
+                agent_arns=[Token.as_string(aws_datasync_agent_example.arn)]
+            ),
+            server_hostname="nfs.example.com",
+            subdirectory="/exported/path"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `mount_options` - (Optional) Configuration block containing mount options used by DataSync to access the NFS Server.
+* `on_prem_config` - (Required) Configuration block containing information for connecting to the NFS File System.
+* `server_hostname` - (Required) Specifies the IP address or DNS name of the NFS server. The DataSync Agent(s) use this to mount the NFS server.
+* `subdirectory` - (Required) Subdirectory to perform actions as source or destination. Should be exported by the NFS server.
+* `tags` - (Optional) Key-value pairs of resource tags to assign to the DataSync Location. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### mount_options Argument Reference
+
+The `mount_options` configuration block supports the following arguments:
+
+* `version` - (Optional) The specific NFS version that you want DataSync to use for mounting your NFS share. Valid values: `AUTOMATIC`, `NFS3`, `NFS4_0` and `NFS4_1`. Default: `AUTOMATIC`
+
+### on_prem_config Argument Reference
+
+The `on_prem_config` configuration block supports the following arguments:
+
+* `agent_arns` - (Required) List of Amazon Resource Names (ARNs) of the DataSync Agents used to connect to the NFS server.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Amazon Resource Name (ARN) of the DataSync Location.
+* `arn` - Amazon Resource Name (ARN) of the DataSync Location.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_datasync_location_nfs` using the DataSync Task Amazon Resource Name (ARN). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_datasync_location_nfs` using the DataSync Task Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_datasync_location_nfs.example arn:aws:datasync:us-east-1:123456789012:location/loc-12345678901234567
+```
+
+<!-- cache-key: cdktf-0.18.0 input-cb00fc82fb27ed23545aa2a14e593899a6887ce57ca2c5b408cf2933841b79e3 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/datasync_location_object_storage.html.markdown b/website/docs/cdktf/python/r/datasync_location_object_storage.html.markdown
new file mode 100644
index 00000000000..0e33059e9be
--- /dev/null
+++ b/website/docs/cdktf/python/r/datasync_location_object_storage.html.markdown
@@ -0,0 +1,80 @@
+---
+subcategory: "DataSync"
+layout: "aws"
+page_title: "AWS: aws_datasync_location_object_storage"
+description: |-
+  Manages an AWS DataSync Object Storage Location
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_datasync_location_object_storage
+
+Manages a Object Storage Location within AWS DataSync.
+
+~> **NOTE:** The DataSync Agents must be available before creating this resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.datasync_location_object_storage import DatasyncLocationObjectStorage
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DatasyncLocationObjectStorage(self, "example",
+            agent_arns=[Token.as_string(aws_datasync_agent_example.arn)],
+            bucket_name="example",
+            server_hostname="example"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `agent_arns` - (Required) A list of DataSync Agent ARNs with which this location will be associated.
+* `access_key` - (Optional) The access key is used if credentials are required to access the self-managed object storage server. If your object storage requires a user name and password to authenticate, use `access_key` and `secret_key` to provide the user name and password, respectively.
+* `bucket_name` - (Required) The bucket on the self-managed object storage server that is used to read data from.
+* `secret_key` - (Optional) The secret key is used if credentials are required to access the self-managed object storage server. If your object storage requires a user name and password to authenticate, use `access_key` and `secret_key` to provide the user name and password, respectively.
+* `server_certificate` - (Optional) Specifies a certificate to authenticate with an object storage system that uses a private or self-signed certificate authority (CA). You must specify a Base64-encoded .pem string. The certificate can be up to 32768 bytes (before Base64 encoding).
+* `server_hostname` - (Required) The name of the self-managed object storage server. This value is the IP address or Domain Name Service (DNS) name of the object storage server. An agent uses this host name to mount the object storage server in a network.
+* `server_protocol` - (Optional) The protocol that the object storage server uses to communicate. Valid values are `HTTP` or `HTTPS`.
+* `server_port` - (Optional) The port that your self-managed object storage server accepts inbound network traffic on. The server port is set by default to TCP 80 (`HTTP`) or TCP 443 (`HTTPS`). You can specify a custom port if your self-managed object storage server requires one.
+* `subdirectory` - (Optional) A subdirectory in the HDFS cluster. This subdirectory is used to read data from or write data to the HDFS cluster. If the subdirectory isn't specified, it will default to /.
+* `tags` - (Optional) Key-value pairs of resource tags to assign to the DataSync Location. If configured with a provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the DataSync Location.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block).
+* `uri` - The URL of the Object Storage location that was described.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_datasync_location_object_storage` using the Amazon Resource Name (ARN). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_datasync_location_object_storage` using the Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_datasync_location_object_storage.example arn:aws:datasync:us-east-1:123456789012:location/loc-12345678901234567
+```
+
+<!-- cache-key: cdktf-0.18.0 input-aa5f076525dfa611768eccf07161cc0a0de01894b1d5fb99e88d9b4c0d6109a2 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/datasync_location_s3.html.markdown b/website/docs/cdktf/python/r/datasync_location_s3.html.markdown
new file mode 100644
index 00000000000..60367cae522
--- /dev/null
+++ b/website/docs/cdktf/python/r/datasync_location_s3.html.markdown
@@ -0,0 +1,82 @@
+---
+subcategory: "DataSync"
+layout: "aws"
+page_title: "AWS: aws_datasync_location_s3"
+description: |-
+  Manages an AWS DataSync S3 Location
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_datasync_location_s3
+
+Manages an S3 Location within AWS DataSync.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.datasync_location_s3 import DatasyncLocationS3
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DatasyncLocationS3(self, "example",
+            s3_bucket_arn=Token.as_string(aws_s3_bucket_example.arn),
+            s3_config=DatasyncLocationS3S3Config(
+                bucket_access_role_arn=Token.as_string(aws_iam_role_example.arn)
+            ),
+            subdirectory="/example/prefix"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `agent_arns` - (Optional) A list of DataSync Agent ARNs with which this location will be associated.
+* `s3_bucket_arn` - (Required) Amazon Resource Name (ARN) of the S3 Bucket.
+* `s3_config` - (Required) Configuration block containing information for connecting to S3.
+* `s3_storage_class` - (Optional) The Amazon S3 storage class that you want to store your files in when this location is used as a task destination. [Valid values](https://docs.aws.amazon.com/datasync/latest/userguide/create-s3-location.html#using-storage-classes)  
+* `subdirectory` - (Required) Prefix to perform actions as source or destination.
+* `tags` - (Optional) Key-value pairs of resource tags to assign to the DataSync Location. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### s3_config Argument Reference
+
+The `s3_config` configuration block supports the following arguments:
+
+* `bucket_access_role_arn` - (Required) ARN of the IAM Role used to connect to the S3 Bucket.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Amazon Resource Name (ARN) of the DataSync Location.
+* `arn` - Amazon Resource Name (ARN) of the DataSync Location.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_datasync_location_s3` using the DataSync Task Amazon Resource Name (ARN). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_datasync_location_s3` using the DataSync Task Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_datasync_location_s3.example arn:aws:datasync:us-east-1:123456789012:location/loc-12345678901234567
+```
+
+<!-- cache-key: cdktf-0.18.0 input-667c050457c227762c7f8b9400f09ce49e704686c477993bb241f2426bbb2497 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/datasync_location_smb.html.markdown b/website/docs/cdktf/python/r/datasync_location_smb.html.markdown
new file mode 100644
index 00000000000..d11abf92c04
--- /dev/null
+++ b/website/docs/cdktf/python/r/datasync_location_smb.html.markdown
@@ -0,0 +1,85 @@
+---
+subcategory: "DataSync"
+layout: "aws"
+page_title: "AWS: aws_datasync_location_smb"
+description: |-
+  Manages an AWS DataSync SMB Location
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_datasync_location_smb
+
+Manages a SMB Location within AWS DataSync.
+
+~> **NOTE:** The DataSync Agents must be available before creating this resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.datasync_location_smb import DatasyncLocationSmb
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DatasyncLocationSmb(self, "example",
+            agent_arns=[Token.as_string(aws_datasync_agent_example.arn)],
+            password="ANotGreatPassword",
+            server_hostname="smb.example.com",
+            subdirectory="/exported/path",
+            user="Guest"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `agent_arns` - (Required) A list of DataSync Agent ARNs with which this location will be associated.
+* `domain` - (Optional) The name of the Windows domain the SMB server belongs to.
+* `mount_options` - (Optional) Configuration block containing mount options used by DataSync to access the SMB Server. Can be `AUTOMATIC`, `SMB2`, or `SMB3`.
+* `password` - (Required) The password of the user who can mount the share and has file permissions in the SMB.
+* `server_hostname` - (Required) Specifies the IP address or DNS name of the SMB server. The DataSync Agent(s) use this to mount the SMB share.
+* `subdirectory` - (Required) Subdirectory to perform actions as source or destination. Should be exported by the NFS server.
+* `tags` - (Optional) Key-value pairs of resource tags to assign to the DataSync Location. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `user` - (Required) The user who can mount the share and has file and folder permissions in the SMB share.
+
+### mount_options Argument Reference
+
+The `mount_options` configuration block supports the following arguments:
+
+* `version` - (Optional) The specific SMB version that you want DataSync to use for mounting your SMB share. Valid values: `AUTOMATIC`, `SMB2`, and `SMB3`. Default: `AUTOMATIC`
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the DataSync Location.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_datasync_location_smb` using the Amazon Resource Name (ARN). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_datasync_location_smb` using the Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_datasync_location_smb.example arn:aws:datasync:us-east-1:123456789012:location/loc-12345678901234567
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ef64a786032b1bd4736b717fcbb2fa2b4849fff365db36c6537de225840acb5d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/datasync_task.html.markdown b/website/docs/cdktf/python/r/datasync_task.html.markdown
new file mode 100644
index 00000000000..1ea81e5d967
--- /dev/null
+++ b/website/docs/cdktf/python/r/datasync_task.html.markdown
@@ -0,0 +1,175 @@
+---
+subcategory: "DataSync"
+layout: "aws"
+page_title: "AWS: aws_datasync_task"
+description: |-
+  Manages an AWS DataSync Task
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_datasync_task
+
+Manages an AWS DataSync Task, which represents a configuration for synchronization. Starting an execution of these DataSync Tasks (actually synchronizing files) is performed outside of this Terraform resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Op, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.datasync_task import DatasyncTask
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DatasyncTask(self, "example",
+            destination_location_arn=destination.arn,
+            name="example",
+            options=DatasyncTaskOptions(
+                bytes_per_second=Token.as_number(Op.negate(1))
+            ),
+            source_location_arn=source.arn
+        )
+```
+
+## Example Usage with Scheduling
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.datasync_task import DatasyncTask
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DatasyncTask(self, "example",
+            destination_location_arn=destination.arn,
+            name="example",
+            schedule=DatasyncTaskSchedule(
+                schedule_expression="cron(0 12 ? * SUN,WED *)"
+            ),
+            source_location_arn=source.arn
+        )
+```
+
+## Example Usage with Filtering
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.datasync_task import DatasyncTask
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DatasyncTask(self, "example",
+            destination_location_arn=destination.arn,
+            excludes=DatasyncTaskExcludes(
+                filter_type="SIMPLE_PATTERN",
+                value="/folder1|/folder2"
+            ),
+            includes=DatasyncTaskIncludes(
+                filter_type="SIMPLE_PATTERN",
+                value="/folder1|/folder2"
+            ),
+            name="example",
+            source_location_arn=source.arn
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `destination_location_arn` - (Required) Amazon Resource Name (ARN) of destination DataSync Location.
+* `source_location_arn` - (Required) Amazon Resource Name (ARN) of source DataSync Location.
+* `cloudwatch_log_group_arn` - (Optional) Amazon Resource Name (ARN) of the CloudWatch Log Group that is used to monitor and log events in the sync task.
+* `excludes` - (Optional) Filter rules that determines which files to exclude from a task.
+* `includes` - (Optional) Filter rules that determines which files to include in a task.
+* `name` - (Optional) Name of the DataSync Task.
+* `options` - (Optional) Configuration block containing option that controls the default behavior when you start an execution of this DataSync Task. For each individual task execution, you can override these options by specifying an overriding configuration in those executions.
+* `schedule` - (Optional) Specifies a schedule used to periodically transfer files from a source to a destination location.
+* `tags` - (Optional) Key-value pairs of resource tags to assign to the DataSync Task. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### options Argument Reference
+
+~> **NOTE:** If `atime` is set to `BEST_EFFORT`, `mtime` must be set to `PRESERVE`. If `atime` is set to `NONE`, `mtime` must be set to `NONE`.
+
+The `options` configuration block supports the following arguments:
+
+* `atime` - (Optional) A file metadata that shows the last time a file was accessed (that is when the file was read or written to). If set to `BEST_EFFORT`, the DataSync Task attempts to preserve the original (that is, the version before sync `PREPARING` phase) `atime` attribute on all source files. Valid values: `BEST_EFFORT`, `NONE`. Default: `BEST_EFFORT`.
+* `bytes_per_second` - (Optional) Limits the bandwidth utilized. For example, to set a maximum of 1 MB, set this value to `1048576`. Value values: `-1` or greater. Default: `-1` (unlimited).
+* `gid` - (Optional) Group identifier of the file's owners. Valid values: `BOTH`, `INT_VALUE`, `NAME`, `NONE`. Default: `INT_VALUE` (preserve integer value of the ID).
+* `log_level` - (Optional) Determines the type of logs that DataSync publishes to a log stream in the Amazon CloudWatch log group that you provide. Valid values: `OFF`, `BASIC`, `TRANSFER`. Default: `OFF`.
+* `mtime` - (Optional) A file metadata that indicates the last time a file was modified (written to) before the sync `PREPARING` phase. Value values: `NONE`, `PRESERVE`. Default: `PRESERVE`.
+* `object_tags` - (Optional) Specifies whether object tags are maintained when transferring between object storage systems. If you want your DataSync task to ignore object tags, specify the NONE value. Valid values: `PRESERVE`, `NONE`. Default value: `PRESERVE`.
+* `overwrite_mode` - (Optional) Determines whether files at the destination should be overwritten or preserved when copying files. Valid values: `ALWAYS`, `NEVER`. Default: `ALWAYS`.
+* `posix_permissions` - (Optional) Determines which users or groups can access a file for a specific purpose such as reading, writing, or execution of the file. Valid values: `NONE`, `PRESERVE`. Default: `PRESERVE`.
+* `preserve_deleted_files` - (Optional) Whether files deleted in the source should be removed or preserved in the destination file system. Valid values: `PRESERVE`, `REMOVE`. Default: `PRESERVE`.
+* `preserve_devices` - (Optional) Whether the DataSync Task should preserve the metadata of block and character devices in the source files system, and recreate the files with that device name and metadata on the destination. The DataSync Task can’t sync the actual contents of such devices, because many of the devices are non-terminal and don’t return an end of file (EOF) marker. Valid values: `NONE`, `PRESERVE`. Default: `NONE` (ignore special devices).
+* `security_descriptor_copy_flags` - (Optional) Determines which components of the SMB security descriptor are copied from source to destination objects. This value is only used for transfers between SMB and Amazon FSx for Windows File Server locations, or between two Amazon FSx for Windows File Server locations. Valid values: `NONE`, `OWNER_DACL`, `OWNER_DACL_SACL`. Default: `OWNER_DACL`.
+* `task_queueing` - (Optional) Determines whether tasks should be queued before executing the tasks. Valid values: `ENABLED`, `DISABLED`. Default `ENABLED`.
+* `transfer_mode` - (Optional) Determines whether DataSync transfers only the data and metadata that differ between the source and the destination location, or whether DataSync transfers all the content from the source, without comparing to the destination location. Valid values: `CHANGED`, `ALL`. Default: `CHANGED`
+* `uid` - (Optional) User identifier of the file's owners. Valid values: `BOTH`, `INT_VALUE`, `NAME`, `NONE`. Default: `INT_VALUE` (preserve integer value of the ID).
+* `verify_mode` - (Optional) Whether a data integrity verification should be performed at the end of a task execution after all data and metadata have been transferred. Valid values: `NONE`, `POINT_IN_TIME_CONSISTENT`, `ONLY_FILES_TRANSFERRED`. Default: `POINT_IN_TIME_CONSISTENT`.
+
+### Schedule
+
+* `schedule_expression` - (Required) Specifies the schedule you want your task to use for repeated executions. For more information, see [Schedule Expressions for Rules](https://docs.aws.amazon.com/AmazonCloudWatch/latest/events/ScheduledEvents.html).
+
+### excludes Argument Reference
+
+* `filter_type` - (Optional) The type of filter rule to apply. Valid values: `SIMPLE_PATTERN`.
+* `value` - (Optional) A single filter string that consists of the patterns to exclude. The patterns are delimited by "|" (that is, a pipe), for example: `/folder1|/folder2`
+
+### includes Argument Reference
+
+* `filter_type` - (Optional) The type of filter rule to apply. Valid values: `SIMPLE_PATTERN`.
+* `value` - (Optional) A single filter string that consists of the patterns to include. The patterns are delimited by "|" (that is, a pipe), for example: `/folder1|/folder2`
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Amazon Resource Name (ARN) of the DataSync Task.
+* `arn` - Amazon Resource Name (ARN) of the DataSync Task.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `5m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_datasync_task` using the DataSync Task Amazon Resource Name (ARN). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_datasync_task` using the DataSync Task Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_datasync_task.example arn:aws:datasync:us-east-1:123456789012:task/task-12345678901234567
+```
+
+<!-- cache-key: cdktf-0.18.0 input-cdd40a57bab5272f6d1ab360a92d6775feeadf4450ae0350087abd170b623ea3 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/dax_cluster.html.markdown b/website/docs/cdktf/python/r/dax_cluster.html.markdown
new file mode 100644
index 00000000000..35b710c89ca
--- /dev/null
+++ b/website/docs/cdktf/python/r/dax_cluster.html.markdown
@@ -0,0 +1,138 @@
+---
+subcategory: "DynamoDB Accelerator (DAX)"
+layout: "aws"
+page_title: "AWS: aws_dax_cluster"
+description: |-
+  Provides an DAX Cluster resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_dax_cluster
+
+Provides a DAX Cluster resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.dax_cluster import DaxCluster
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DaxCluster(self, "bar",
+            cluster_name="cluster-example",
+            iam_role_arn=Token.as_string(example.arn),
+            node_type="dax.r4.large",
+            replication_factor=1
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `cluster_endpoint_encryption_type` – (Optional) The type of encryption the
+cluster's endpoint should support. Valid values are: `NONE` and `TLS`.
+Default value is `NONE`.
+
+* `cluster_name` – (Required) Group identifier. DAX converts this name to
+lowercase
+
+* `iam_role_arn` - (Required) A valid Amazon Resource Name (ARN) that identifies
+an IAM role. At runtime, DAX will assume this role and use the role's
+permissions to access DynamoDB on your behalf
+
+* `node_type` – (Required) The compute and memory capacity of the nodes. See
+[Nodes][1] for supported node types
+
+* `replication_factor` – (Required) The number of nodes in the DAX cluster. A
+replication factor of 1 will create a single-node cluster, without any read
+replicas
+
+* `availability_zones` - (Optional) List of Availability Zones in which the
+nodes will be created
+
+* `description` – (Optional) Description for the cluster
+
+* `notification_topic_arn` – (Optional) An Amazon Resource Name (ARN) of an
+SNS topic to send DAX notifications to. Example:
+`arn:aws:sns:us-east-1:012345678999:my_sns_topic`
+
+* `parameter_group_name` – (Optional) Name of the parameter group to associate
+with this DAX cluster
+
+* `maintenance_window` – (Optional) Specifies the weekly time range for when
+maintenance on the cluster is performed. The format is `ddd:hh24:mi-ddd:hh24:mi`
+(24H Clock UTC). The minimum maintenance window is a 60 minute period. Example:
+`sun:05:00-sun:09:00`
+
+* `security_group_ids` – (Optional) One or more VPC security groups associated
+with the cluster
+
+* `server_side_encryption` - (Optional) Encrypt at rest options
+
+* `subnet_group_name` – (Optional) Name of the subnet group to be used for the
+cluster
+
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+The `server_side_encryption` object supports the following:
+
+* `enabled` - (Optional) Whether to enable encryption at rest. Defaults to `false`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the DAX cluster
+
+* `nodes` - List of node objects including `id`, `address`, `port` and
+`availability_zone`. Referenceable e.g., as
+`${aws_dax_cluster.test.nodes.0.address}`
+
+* `configuration_endpoint` - The configuration endpoint for this DAX cluster,
+consisting of a DNS name and a port number
+
+* `cluster_address` - The DNS name of the DAX cluster without the port appended
+
+* `port` - The port used by the configuration endpoint
+
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `45m`)
+- `update` - (Default `45m`)
+- `delete` - (Default `90m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DAX Clusters using the `cluster_name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import DAX Clusters using the `cluster_name`. For example:
+
+```console
+% terraform import aws_dax_cluster.my_cluster my_cluster
+```
+
+[1]: http://docs.aws.amazon.com/amazondynamodb/latest/developerguide/DAX.concepts.cluster.html#DAX.concepts.nodes
+
+<!-- cache-key: cdktf-0.18.0 input-4181166d95f7861d31bfe7d254c348dcceab5cb195724123d069730a8e82414d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/dax_parameter_group.html.markdown b/website/docs/cdktf/python/r/dax_parameter_group.html.markdown
new file mode 100644
index 00000000000..59ceb1e8387
--- /dev/null
+++ b/website/docs/cdktf/python/r/dax_parameter_group.html.markdown
@@ -0,0 +1,84 @@
+---
+subcategory: "DynamoDB Accelerator (DAX)"
+layout: "aws"
+page_title: "AWS: aws_dax_parameter_group"
+description: |-
+  Provides an DAX Parameter Group resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_dax_parameter_group
+
+Provides a DAX Parameter Group resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.dax_parameter_group import DaxParameterGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DaxParameterGroup(self, "example",
+            name="example",
+            parameters=[DaxParameterGroupParameters(
+                name="query-ttl-millis",
+                value="100000"
+            ), DaxParameterGroupParameters(
+                name="record-ttl-millis",
+                value="100000"
+            )
+            ]
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` – (Required) The name of the parameter group.
+
+* `description` - (Optional, ForceNew) A description of the parameter group.
+
+* `parameters` – (Optional) The parameters of the parameter group.
+
+## parameters
+
+`parameters` supports the following:
+
+* `name` - (Required) The name of the parameter.
+* `value` - (Required) The value for the parameter.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name of the parameter group.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DAX Parameter Group using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import DAX Parameter Group using the `name`. For example:
+
+```console
+% terraform import aws_dax_parameter_group.example my_dax_pg
+```
+
+<!-- cache-key: cdktf-0.18.0 input-3baebb2b38580e9504f432df3ad10f9401086de59d9fede3a77fa269c4b381fa -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/dax_subnet_group.html.markdown b/website/docs/cdktf/python/r/dax_subnet_group.html.markdown
new file mode 100644
index 00000000000..7d458926059
--- /dev/null
+++ b/website/docs/cdktf/python/r/dax_subnet_group.html.markdown
@@ -0,0 +1,69 @@
+---
+subcategory: "DynamoDB Accelerator (DAX)"
+layout: "aws"
+page_title: "AWS: aws_dax_subnet_group"
+description: |-
+  Provides an DAX Subnet Group resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_dax_subnet_group
+
+Provides a DAX Subnet Group resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.dax_subnet_group import DaxSubnetGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DaxSubnetGroup(self, "example",
+            name="example",
+            subnet_ids=[example1.id, example2.id]
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` – (Required) The name of the subnet group.
+* `description` - (Optional) A description of the subnet group.
+* `subnet_ids` – (Required) A list of VPC subnet IDs for the subnet group.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name of the subnet group.
+* `vpc_id` – VPC ID of the subnet group.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DAX Subnet Group using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import DAX Subnet Group using the `name`. For example:
+
+```console
+% terraform import aws_dax_subnet_group.example my_dax_sg
+```
+
+<!-- cache-key: cdktf-0.18.0 input-7e0b85bfae073f3145aed1d3f2658b614702a6a6a2bc2cf27086e92f41fc07d8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/db_cluster_snapshot.html.markdown b/website/docs/cdktf/python/r/db_cluster_snapshot.html.markdown
new file mode 100644
index 00000000000..63e9610bba0
--- /dev/null
+++ b/website/docs/cdktf/python/r/db_cluster_snapshot.html.markdown
@@ -0,0 +1,86 @@
+---
+subcategory: "RDS (Relational Database)"
+layout: "aws"
+page_title: "AWS: aws_db_cluster_snapshot"
+description: |-
+  Manages an RDS database cluster snapshot.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_db_cluster_snapshot
+
+Manages an RDS database cluster snapshot for Aurora clusters. For managing RDS database instance snapshots, see the [`aws_db_snapshot` resource](/docs/providers/aws/r/db_snapshot.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.db_cluster_snapshot import DbClusterSnapshot
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DbClusterSnapshot(self, "example",
+            db_cluster_identifier=Token.as_string(aws_rds_cluster_example.id),
+            db_cluster_snapshot_identifier="resourcetestsnapshot1234"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `db_cluster_identifier` - (Required) The DB Cluster Identifier from which to take the snapshot.
+* `db_cluster_snapshot_identifier` - (Required) The Identifier for the snapshot.
+* `tags` - (Optional) A map of tags to assign to the DB cluster. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `allocated_storage` - Allocated storage size in gigabytes (GB).
+* `availability_zones` - List of EC2 Availability Zones that instances in the DB cluster snapshot can be restored in.
+* `db_cluster_snapshot_arn` - The Amazon Resource Name (ARN) for the DB Cluster Snapshot.
+* `engine` - Name of the database engine.
+* `engine_version` - Version of the database engine for this DB cluster snapshot.
+* `kms_key_id` - If storage_encrypted is true, the AWS KMS key identifier for the encrypted DB cluster snapshot.
+* `license_model` - License model information for the restored DB cluster.
+* `port` - Port that the DB cluster was listening on at the time of the snapshot.
+* `source_db_cluster_snapshot_identifier` - DB Cluster Snapshot ARN that the DB Cluster Snapshot was copied from. It only has value in case of cross customer or cross region copy.
+* `storage_encrypted` - Whether the DB cluster snapshot is encrypted.
+* `status` - The status of this DB Cluster Snapshot.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `vpc_id` - The VPC ID associated with the DB cluster snapshot.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `20m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_db_cluster_snapshot` using the cluster snapshot identifier. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_db_cluster_snapshot` using the cluster snapshot identifier. For example:
+
+```console
+% terraform import aws_db_cluster_snapshot.example my-cluster-snapshot
+```
+
+<!-- cache-key: cdktf-0.18.0 input-184cf1bfcccfca9c2ff7ce3ea29b9445d23880d46f0be562ac06c71e5ee10f89 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/db_event_subscription.html.markdown b/website/docs/cdktf/python/r/db_event_subscription.html.markdown
new file mode 100644
index 00000000000..2c2f4db400a
--- /dev/null
+++ b/website/docs/cdktf/python/r/db_event_subscription.html.markdown
@@ -0,0 +1,108 @@
+---
+subcategory: "RDS (Relational Database)"
+layout: "aws"
+page_title: "AWS: aws_db_event_subscription"
+description: |-
+  Provides a DB event subscription resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_db_event_subscription
+
+Provides a DB event subscription resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.db_event_subscription import DbEventSubscription
+from imports.aws.db_instance import DbInstance
+from imports.aws.sns_topic import SnsTopic
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        default_var = DbInstance(self, "default",
+            allocated_storage=10,
+            db_name="mydb",
+            db_subnet_group_name="my_database_subnet_group",
+            engine="mysql",
+            engine_version="5.6.17",
+            instance_class="db.t2.micro",
+            parameter_group_name="default.mysql5.6",
+            password="bar",
+            username="foo"
+        )
+        aws_sns_topic_default = SnsTopic(self, "default_1",
+            name="rds-events"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_sns_topic_default.override_logical_id("default")
+        aws_db_event_subscription_default = DbEventSubscription(self, "default_2",
+            event_categories=["availability", "deletion", "failover", "failure", "low storage", "maintenance", "notification", "read replica", "recovery", "restoration"
+            ],
+            name="rds-event-sub",
+            sns_topic=Token.as_string(aws_sns_topic_default.arn),
+            source_ids=[default_var.identifier],
+            source_type="db-instance"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_db_event_subscription_default.override_logical_id("default")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Optional) The name of the DB event subscription. By default generated by Terraform.
+* `name_prefix` - (Optional) The name of the DB event subscription. Conflicts with `name`.
+* `sns_topic` - (Required) The SNS topic to send events to.
+* `source_ids` - (Optional) A list of identifiers of the event sources for which events will be returned. If not specified, then all sources are included in the response. If specified, a source_type must also be specified.
+* `source_type` - (Optional) The type of source that will be generating the events. Valid options are `db-instance`, `db-security-group`, `db-parameter-group`, `db-snapshot`, `db-cluster`, `db-cluster-snapshot`, or `db-proxy`. If not set, all sources will be subscribed to.
+* `event_categories` - (Optional) A list of event categories for a SourceType that you want to subscribe to. See http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Events.html or run `aws rds describe-event-categories`.
+* `enabled` - (Optional) A boolean flag to enable/disable the subscription. Defaults to true.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name of the RDS event notification subscription
+* `arn` - The Amazon Resource Name of the RDS event notification subscription
+* `customer_aws_id` - The AWS customer account associated with the RDS event notification subscription
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `40m`)
+- `delete` - (Default `40m`)
+- `update` - (Default `40m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DB Event Subscriptions using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import DB Event Subscriptions using the `name`. For example:
+
+```console
+% terraform import aws_db_event_subscription.default rds-event-sub
+```
+
+<!-- cache-key: cdktf-0.18.0 input-cb5fc34abd6de28afa1d0edc0e2b55d536c749f2cbd0845b420b9fb388541aff -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/db_instance.html.markdown b/website/docs/cdktf/python/r/db_instance.html.markdown
new file mode 100644
index 00000000000..e2e00bc9f84
--- /dev/null
+++ b/website/docs/cdktf/python/r/db_instance.html.markdown
@@ -0,0 +1,581 @@
+---
+subcategory: "RDS (Relational Database)"
+layout: "aws"
+page_title: "AWS: aws_db_instance"
+description: |-
+  Provides an RDS instance resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_db_instance
+
+Provides an RDS instance resource.  A DB instance is an isolated database
+environment in the cloud.  A DB instance can contain multiple user-created
+databases.
+
+Changes to a DB instance can occur when you manually change a parameter, such as
+`allocated_storage`, and are reflected in the next maintenance window. Because
+of this, Terraform may report a difference in its planning phase because a
+modification has not yet taken place. You can use the `apply_immediately` flag
+to instruct the service to apply the change immediately (see documentation
+below).
+
+When upgrading the major version of an engine, `allow_major_version_upgrade` must be set to `true`.
+
+~> **Note:** using `apply_immediately` can result in a brief downtime as the server reboots.
+See the AWS Docs on [RDS Instance Maintenance][instance-maintenance] for more information.
+
+~> **Note:** All arguments including the username and password will be stored in the raw state as plain-text.
+[Read more about sensitive data instate](https://www.terraform.io/docs/state/sensitive-data.html).
+
+> **Hands-on:** Try the [Manage AWS RDS Instances](https://learn.hashicorp.com/tutorials/terraform/aws-rds) tutorial on HashiCorp Learn.
+
+## RDS Instance Class Types
+
+Amazon RDS supports three types of instance classes: Standard, Memory Optimized, and Burstable Performance.
+For more information please read the AWS RDS documentation about [DB Instance Class Types](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Concepts.DBInstanceClass.html)
+
+## Low-Downtime Updates
+
+By default, RDS applies updates to DB Instances in-place, which can lead to service interruptions.
+Low-downtime updates minimize service interruptions by performing the updates with an [RDS Blue/Green deployment][blue-green] and switching over the instances when complete.
+
+Low-downtime updates are only available for DB Instances using MySQL and MariaDB,
+as other engines are not supported by RDS Blue/Green deployments.
+
+Backups must be enabled to use low-downtime updates.
+
+Enable low-downtime updates by setting `blue_green_update.enabled` to `true`.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.db_instance import DbInstance
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DbInstance(self, "default",
+            allocated_storage=10,
+            db_name="mydb",
+            engine="mysql",
+            engine_version="5.7",
+            instance_class="db.t3.micro",
+            parameter_group_name="default.mysql5.7",
+            password="foobarbaz",
+            skip_final_snapshot=True,
+            username="foo"
+        )
+```
+
+### RDS Custom for Oracle Usage with Replica
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_kms_key import DataAwsKmsKey
+from imports.aws.data_aws_rds_orderable_db_instance import DataAwsRdsOrderableDbInstance
+from imports.aws.db_instance import DbInstance
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        by_id = DataAwsKmsKey(self, "by_id",
+            key_id="example-ef278353ceba4a5a97de6784565b9f78"
+        )
+        custom_oracle = DataAwsRdsOrderableDbInstance(self, "custom-oracle",
+            engine="custom-oracle-ee",
+            engine_version="19.c.ee.002",
+            license_model="bring-your-own-license",
+            preferred_instance_classes=["db.r5.xlarge", "db.r5.2xlarge", "db.r5.4xlarge"
+            ],
+            storage_type="gp3"
+        )
+        default_var = DbInstance(self, "default",
+            allocated_storage=50,
+            auto_minor_version_upgrade=False,
+            backup_retention_period=7,
+            custom_iam_instance_profile="AWSRDSCustomInstanceProfile",
+            db_subnet_group_name=db_subnet_group_name,
+            engine=Token.as_string(custom_oracle.engine),
+            engine_version=Token.as_string(custom_oracle.engine_version),
+            identifier="ee-instance-demo",
+            instance_class=Token.as_string(custom_oracle.instance_class),
+            kms_key_id=Token.as_string(by_id.arn),
+            license_model=Token.as_string(custom_oracle.license_model),
+            multi_az=False,
+            password="avoid-plaintext-passwords",
+            storage_encrypted=True,
+            timeouts=[{
+                "create": "3h",
+                "delete": "3h",
+                "update": "3h"
+            }
+            ],
+            username="test"
+        )
+        DbInstance(self, "test-replica",
+            auto_minor_version_upgrade=False,
+            backup_retention_period=7,
+            custom_iam_instance_profile="AWSRDSCustomInstanceProfile",
+            identifier="ee-instance-replica",
+            instance_class=Token.as_string(custom_oracle.instance_class),
+            kms_key_id=Token.as_string(by_id.arn),
+            multi_az=False,
+            replica_mode="mounted",
+            replicate_source_db=default_var.identifier,
+            skip_final_snapshot=True,
+            storage_encrypted=True,
+            timeouts=[{
+                "create": "3h",
+                "delete": "3h",
+                "update": "3h"
+            }
+            ]
+        )
+```
+
+### RDS Custom for SQL Server
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_kms_key import DataAwsKmsKey
+from imports.aws.data_aws_rds_orderable_db_instance import DataAwsRdsOrderableDbInstance
+from imports.aws.db_instance import DbInstance
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        by_id = DataAwsKmsKey(self, "by_id",
+            key_id="example-ef278353ceba4a5a97de6784565b9f78"
+        )
+        custom_sqlserver = DataAwsRdsOrderableDbInstance(self, "custom-sqlserver",
+            engine="custom-sqlserver-se",
+            engine_version="15.00.4249.2.v1",
+            preferred_instance_classes=["db.r5.xlarge", "db.r5.2xlarge", "db.r5.4xlarge"
+            ],
+            storage_type="gp3"
+        )
+        DbInstance(self, "example",
+            allocated_storage=500,
+            auto_minor_version_upgrade=False,
+            backup_retention_period=7,
+            custom_iam_instance_profile="AWSRDSCustomSQLServerInstanceRole",
+            db_subnet_group_name=db_subnet_group_name,
+            engine=Token.as_string(custom_sqlserver.engine),
+            engine_version=Token.as_string(custom_sqlserver.engine_version),
+            identifier="sql-instance-demo",
+            instance_class=Token.as_string(custom_sqlserver.instance_class),
+            kms_key_id=Token.as_string(by_id.arn),
+            multi_az=False,
+            password="avoid-plaintext-passwords",
+            storage_encrypted=True,
+            timeouts=[{
+                "create": "3h",
+                "delete": "3h",
+                "update": "3h"
+            }
+            ],
+            username="test"
+        )
+```
+
+### Storage Autoscaling
+
+To enable Storage Autoscaling with instances that support the feature, define the `max_allocated_storage` argument higher than the `allocated_storage` argument. Terraform will automatically hide differences with the `allocated_storage` argument value if autoscaling occurs.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.db_instance import DbInstance
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, instanceClass):
+        super().__init__(scope, name)
+        DbInstance(self, "example",
+            allocated_storage=50,
+            max_allocated_storage=100,
+            instance_class=instance_class
+        )
+```
+
+### Managed Master Passwords via Secrets Manager, default KMS Key
+
+-> More information about RDS/Aurora Aurora integrates with Secrets Manager to manage master user passwords for your DB clusters can be found in the [RDS User Guide](https://aws.amazon.com/about-aws/whats-new/2022/12/amazon-rds-integration-aws-secrets-manager/) and [Aurora User Guide](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/rds-secrets-manager.html).
+
+You can specify the `manage_master_user_password` attribute to enable managing the master password with Secrets Manager. You can also update an existing cluster to use Secrets Manager by specify the `manage_master_user_password` attribute and removing the `password` attribute (removal is required).
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.db_instance import DbInstance
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DbInstance(self, "default",
+            allocated_storage=10,
+            db_name="mydb",
+            engine="mysql",
+            engine_version="5.7",
+            instance_class="db.t3.micro",
+            manage_master_user_password=True,
+            parameter_group_name="default.mysql5.7",
+            username="foo"
+        )
+```
+
+### Managed Master Passwords via Secrets Manager, specific KMS Key
+
+-> More information about RDS/Aurora Aurora integrates with Secrets Manager to manage master user passwords for your DB clusters can be found in the [RDS User Guide](https://aws.amazon.com/about-aws/whats-new/2022/12/amazon-rds-integration-aws-secrets-manager/) and [Aurora User Guide](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/rds-secrets-manager.html).
+
+You can specify the `master_user_secret_kms_key_id` attribute to specify a specific KMS Key.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.db_instance import DbInstance
+from imports.aws.kms_key import KmsKey
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = KmsKey(self, "example",
+            description="Example KMS Key"
+        )
+        DbInstance(self, "default",
+            allocated_storage=10,
+            db_name="mydb",
+            engine="mysql",
+            engine_version="5.7",
+            instance_class="db.t3.micro",
+            manage_master_user_password=True,
+            master_user_secret_kms_key_id=example.key_id,
+            parameter_group_name="default.mysql5.7",
+            username="foo"
+        )
+```
+
+## Argument Reference
+
+For more detailed documentation about each argument, refer to the [AWS official
+documentation](http://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_CreateDBInstance.html).
+
+This argument supports the following arguments:
+
+* `allocated_storage` - (Required unless a `snapshot_identifier` or `replicate_source_db` is provided) The allocated storage in gibibytes. If `max_allocated_storage` is configured, this argument represents the initial storage allocation and differences from the configuration will be ignored automatically when Storage Autoscaling occurs. If `replicate_source_db` is set, the value is ignored during the creation of the instance.
+* `allow_major_version_upgrade` - (Optional) Indicates that major version
+upgrades are allowed. Changing this parameter does not result in an outage and
+the change is asynchronously applied as soon as possible.
+* `apply_immediately` - (Optional) Specifies whether any database modifications
+are applied immediately, or during the next maintenance window. Default is
+`false`. See [Amazon RDS Documentation for more
+information.](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.DBInstance.Modifying.html)
+* `auto_minor_version_upgrade` - (Optional) Indicates that minor engine upgrades
+will be applied automatically to the DB instance during the maintenance window.
+Defaults to true.
+* `availability_zone` - (Optional) The AZ for the RDS instance.
+* `backup_retention_period` - (Optional) The days to retain backups for.
+  Must be between `0` and `35`.
+  Default is `0`.
+  Must be greater than `0` if the database is used as a source for a [Read Replica][instance-replication],
+  uses [low-downtime updates](#low-downtime-updates),
+  or will use [RDS Blue/Green deployments][blue-green].
+* `backup_target` - (Optional, Forces new resource) Specifies where automated backups and manual snapshots are stored. Possible values are `region` (default) and `outposts`. See [Working with Amazon RDS on AWS Outposts](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/rds-on-outposts.html) for more information.
+* `backup_window` - (Optional) The daily time range (in UTC) during which automated backups are created if they are enabled.
+  Example: "09:46-10:16". Must not overlap with `maintenance_window`.
+* `blue_green_update` - (Optional) Enables low-downtime updates using [RDS Blue/Green deployments][blue-green].
+  See [`blue_green_update`](#blue_green_update) below.
+* `ca_cert_identifier` - (Optional) The identifier of the CA certificate for the DB instance.
+* `character_set_name` - (Optional) The character set name to use for DB
+encoding in Oracle and Microsoft SQL instances (collation). This can't be changed. See [Oracle Character Sets
+Supported in Amazon RDS](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Appendix.OracleCharacterSets.html)
+or [Server-Level Collation for Microsoft SQL Server](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Appendix.SQLServer.CommonDBATasks.Collation.html) for more information.
+* `copy_tags_to_snapshot` – (Optional, boolean) Copy all Instance `tags` to snapshots. Default is `false`.
+* `custom_iam_instance_profile` - (Optional) The instance profile associated with the underlying Amazon EC2 instance of an RDS Custom DB instance.
+* `db_name` - (Optional) The name of the database to create when the DB instance is created. If this parameter is not specified, no database is created in the DB instance. Note that this does not apply for Oracle or SQL Server engines. See the [AWS documentation](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/rds/create-db-instance.html) for more details on what applies for those engines. If you are providing an Oracle db name, it needs to be in all upper case. Cannot be specified for a replica.
+* `db_subnet_group_name` - (Optional) Name of [DB subnet group](/docs/providers/aws/r/db_subnet_group.html). DB instance will
+be created in the VPC associated with the DB subnet group. If unspecified, will
+be created in the `default` VPC, or in EC2 Classic, if available. When working
+with read replicas, it should be specified only if the source database
+specifies an instance in another AWS Region. See [DBSubnetGroupName in API
+action CreateDBInstanceReadReplica](https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_CreateDBInstanceReadReplica.html)
+for additional read replica constraints.
+* `delete_automated_backups` - (Optional) Specifies whether to remove automated backups immediately after the DB instance is deleted. Default is `true`.
+* `deletion_protection` - (Optional) If the DB instance should have deletion protection enabled. The database can't be deleted when this value is set to `true`. The default is `false`.
+* `domain` - (Optional) The ID of the Directory Service Active Directory domain to create the instance in.
+* `domain_iam_role_name` - (Optional, but required if domain is provided) The name of the IAM role to be used when making API calls to the Directory Service.
+* `enabled_cloudwatch_logs_exports` - (Optional) Set of log types to enable for exporting to CloudWatch logs. If omitted, no logs will be exported. Valid values (depending on `engine`). MySQL and MariaDB: `audit`, `error`, `general`, `slowquery`. PostgreSQL: `postgresql`, `upgrade`. MSSQL: `agent` , `error`. Oracle: `alert`, `audit`, `listener`, `trace`.
+* `engine` - (Required unless a `snapshot_identifier` or `replicate_source_db` is provided) The database engine to use. For supported values, see the Engine parameter in [API action CreateDBInstance](https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_CreateDBInstance.html). Note that for Amazon Aurora instances the engine must match the [DB cluster](/docs/providers/aws/r/rds_cluster.html)'s engine'. For information on the difference between the available Aurora MySQL engines see [Comparison between Aurora MySQL 1 and Aurora MySQL 2](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/AuroraMySQL.Updates.20180206.html) in the Amazon RDS User Guide.
+* `engine_version` - (Optional) The engine version to use. If `auto_minor_version_upgrade` is enabled, you can provide a prefix of the version such as `5.7` (for `5.7.10`). The actual engine version used is returned in the attribute `engine_version_actual`, see [Attribute Reference](#attribute-reference) below. For supported values, see the EngineVersion parameter in [API action CreateDBInstance](https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_CreateDBInstance.html). Note that for Amazon Aurora instances the engine version must match the [DB cluster](/docs/providers/aws/r/rds_cluster.html)'s engine version'.
+* `final_snapshot_identifier` - (Optional) The name of your final DB snapshot
+when this DB instance is deleted. Must be provided if `skip_final_snapshot` is
+set to `false`. The value must begin with a letter, only contain alphanumeric characters and hyphens, and not end with a hyphen or contain two consecutive hyphens. Must not be provided when deleting a read replica.
+* `iam_database_authentication_enabled` - (Optional) Specifies whether mappings of AWS Identity and Access Management (IAM) accounts to database
+accounts is enabled.
+* `identifier` - (Optional) The name of the RDS instance, if omitted, Terraform will assign a random, unique identifier. Required if `restore_to_point_in_time` is specified.
+* `identifier_prefix` - (Optional) Creates a unique identifier beginning with the specified prefix. Conflicts with `identifier`.
+* `instance_class` - (Required) The instance type of the RDS instance.
+* `iops` - (Optional) The amount of provisioned IOPS. Setting this implies a
+storage_type of "io1". Can only be set when `storage_type` is `"io1"` or `"gp3"`.
+Cannot be specified for gp3 storage if the `allocated_storage` value is below a per-`engine` threshold.
+See the [RDS User Guide](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_Storage.html#gp3-storage) for details.
+* `kms_key_id` - (Optional) The ARN for the KMS encryption key. If creating an
+encrypted replica, set this to the destination KMS ARN.
+* `license_model` - (Optional, but required for some DB engines, i.e., Oracle SE1) License model information for this DB instance. Valid values for this field are as follows:
+    * RDS for MariaDB: `general-public-license`
+    * RDS for Microsoft SQL Server: `license-included`
+    * RDS for MySQL: `general-public-license`
+    * RDS for Oracle: `bring-your-own-license | license-included`
+    * RDS for PostgreSQL: `postgresql-license`
+* `maintenance_window` - (Optional) The window to perform maintenance in.
+Syntax: "ddd:hh24:mi-ddd:hh24:mi". Eg: "Mon:00:00-Mon:03:00". See [RDS
+Maintenance Window
+docs](http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_UpgradeDBInstance.Maintenance.html#AdjustingTheMaintenanceWindow)
+for more information.
+* `manage_master_user_password` - (Optional) Set to true to allow RDS to manage the master user password in Secrets Manager. Cannot be set if `password` is provided.
+* `master_user_secret_kms_key_id` - (Optional) The Amazon Web Services KMS key identifier is the key ARN, key ID, alias ARN, or alias name for the KMS key. To use a KMS key in a different Amazon Web Services account, specify the key ARN or alias ARN. If not specified, the default KMS key for your Amazon Web Services account is used.
+* `max_allocated_storage` - (Optional) When configured, the upper limit to which Amazon RDS can automatically scale the storage of the DB instance. Configuring this will automatically ignore differences to `allocated_storage`. Must be greater than or equal to `allocated_storage` or `0` to disable Storage Autoscaling.
+* `monitoring_interval` - (Optional) The interval, in seconds, between points
+when Enhanced Monitoring metrics are collected for the DB instance. To disable
+collecting Enhanced Monitoring metrics, specify 0. The default is 0. Valid
+Values: 0, 1, 5, 10, 15, 30, 60.
+* `monitoring_role_arn` - (Optional) The ARN for the IAM role that permits RDS
+to send enhanced monitoring metrics to CloudWatch Logs. You can find more
+information on the [AWS
+Documentation](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Monitoring.html)
+what IAM permissions are needed to allow Enhanced Monitoring for RDS Instances.
+* `multi_az` - (Optional) Specifies if the RDS instance is multi-AZ
+* `nchar_character_set_name` - (Optional, Forces new resource) The national character set is used in the NCHAR, NVARCHAR2, and NCLOB data types for Oracle instances. This can't be changed. See [Oracle Character Sets
+Supported in Amazon RDS](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Appendix.OracleCharacterSets.html).
+* `network_type` - (Optional) The network type of the DB instance. Valid values: `IPV4`, `DUAL`.
+* `option_group_name` - (Optional) Name of the DB option group to associate.
+* `parameter_group_name` - (Optional) Name of the DB parameter group to
+associate.
+* `password` - (Required unless `manage_master_user_password` is set to true or unless a `snapshot_identifier` or `replicate_source_db`
+is provided or `manage_master_user_password` is set.) Password for the master DB user. Note that this may show up in
+logs, and it will be stored in the state file. Cannot be set if `manage_master_user_password` is set to `true`.
+* `performance_insights_enabled` - (Optional) Specifies whether Performance Insights are enabled. Defaults to false.
+* `performance_insights_kms_key_id` - (Optional) The ARN for the KMS key to encrypt Performance Insights data. When specifying `performance_insights_kms_key_id`, `performance_insights_enabled` needs to be set to true. Once KMS key is set, it can never be changed.
+* `performance_insights_retention_period` - (Optional) Amount of time in days to retain Performance Insights data. Valid values are `7`, `731` (2 years) or a multiple of `31`. When specifying `performance_insights_retention_period`, `performance_insights_enabled` needs to be set to true. Defaults to '7'.
+* `port` - (Optional) The port on which the DB accepts connections.
+* `publicly_accessible` - (Optional) Bool to control if instance is publicly
+accessible. Default is `false`.
+* `replica_mode` - (Optional) Specifies whether the replica is in either `mounted` or `open-read-only` mode. This attribute
+is only supported by Oracle instances. Oracle replicas operate in `open-read-only` mode unless otherwise specified. See [Working with Oracle Read Replicas](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/oracle-read-replicas.html) for more information.
+* `replicate_source_db` - (Optional) Specifies that this resource is a Replicate
+database, and to use this value as the source database. This correlates to the
+`identifier` of another Amazon RDS Database to replicate (if replicating within
+a single region) or ARN of the Amazon RDS Database to replicate (if replicating
+cross-region). Note that if you are
+creating a cross-region replica of an encrypted database you will also need to
+specify a `kms_key_id`. See [DB Instance Replication][instance-replication] and [Working with
+PostgreSQL and MySQL Read Replicas](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_ReadRepl.html)
+for more information on using Replication.
+* `restore_to_point_in_time` - (Optional, Forces new resource) A configuration block for restoring a DB instance to an arbitrary point in time. Requires the `identifier` argument to be set with the name of the new DB instance to be created. See [Restore To Point In Time](#restore-to-point-in-time) below for details.
+* `s3_import` - (Optional) Restore from a Percona Xtrabackup in S3.  See [Importing Data into an Amazon RDS MySQL DB Instance](http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/MySQL.Procedural.Importing.html)
+* `skip_final_snapshot` - (Optional) Determines whether a final DB snapshot is
+created before the DB instance is deleted. If true is specified, no DBSnapshot
+is created. If false is specified, a DB snapshot is created before the DB
+instance is deleted, using the value from `final_snapshot_identifier`. Default
+is `false`.
+* `snapshot_identifier` - (Optional) Specifies whether or not to create this
+database from a snapshot. This correlates to the snapshot ID you'd find in the
+RDS console, e.g: rds:production-2015-06-26-06-05.
+* `storage_encrypted` - (Optional) Specifies whether the DB instance is
+encrypted. Note that if you are creating a cross-region read replica this field
+is ignored and you should instead declare `kms_key_id` with a valid ARN. The
+default is `false` if not specified.
+* `storage_type` - (Optional) One of "standard" (magnetic), "gp2" (general
+purpose SSD), "gp3" (general purpose SSD that needs `iops` independently)
+or "io1" (provisioned IOPS SSD). The default is "io1" if `iops` is specified,
+"gp2" if not.
+* `storage_throughput` - (Optional) The storage throughput value for the DB instance. Can only be set when `storage_type` is `"gp3"`. Cannot be specified if the `allocated_storage` value is below a per-`engine` threshold. See the [RDS User Guide](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_Storage.html#gp3-storage) for details.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `timezone` - (Optional) Time zone of the DB instance. `timezone` is currently
+only supported by Microsoft SQL Server. The `timezone` can only be set on
+creation. See [MSSQL User
+Guide](http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_SQLServer.html#SQLServer.Concepts.General.TimeZone)
+for more information.
+* `username` - (Required unless a `snapshot_identifier` or `replicate_source_db`
+is provided) Username for the master DB user. Cannot be specified for a replica.
+* `vpc_security_group_ids` - (Optional) List of VPC security groups to
+associate.
+* `customer_owned_ip_enabled` - (Optional) Indicates whether to enable a customer-owned IP address (CoIP) for an RDS on Outposts DB instance. See [CoIP for RDS on Outposts](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/rds-on-outposts.html#rds-on-outposts.coip) for more information.
+
+~> **NOTE:** Removing the `replicate_source_db` attribute from an existing RDS
+Replicate database managed by Terraform will promote the database to a fully
+standalone database.
+
+### Restore To Point In Time
+
+-> **Note:** You can restore to any point in time before the source DB instance's `latest_restorable_time` or a point up to the number of days specified in the source DB instance's `backup_retention_period`.
+For more information, please refer to the [Developer Guide](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_PIT.html).
+This setting does not apply to `aurora-mysql` or `aurora-postgresql` DB engines. For Aurora, refer to the [`aws_rds_cluster` resource documentation](/docs/providers/aws/r/rds_cluster.html#restore_in_time).
+
+The `restore_to_point_in_time` block supports the following arguments:
+
+* `restore_time` - (Optional) The date and time to restore from. Value must be a time in Universal Coordinated Time (UTC) format and must be before the latest restorable time for the DB instance. Cannot be specified with `use_latest_restorable_time`.
+* `source_db_instance_identifier` - (Optional) The identifier of the source DB instance from which to restore. Must match the identifier of an existing DB instance. Required if `source_db_instance_automated_backups_arn` or `source_dbi_resource_id` is not specified.
+* `source_db_instance_automated_backups_arn` - (Optional) The ARN of the automated backup from which to restore. Required if `source_db_instance_identifier` or `source_dbi_resource_id` is not specified.
+* `source_dbi_resource_id` - (Optional) The resource ID of the source DB instance from which to restore. Required if `source_db_instance_identifier` or `source_db_instance_automated_backups_arn` is not specified.
+* `use_latest_restorable_time` - (Optional) A boolean value that indicates whether the DB instance is restored from the latest backup time. Defaults to `false`. Cannot be specified with `restore_time`.
+
+### S3 Import Options
+
+Full details on the core parameters and impacts are in the API Docs: [RestoreDBInstanceFromS3](http://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_RestoreDBInstanceFromS3.html).  Sample
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.db_instance import DbInstance
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, instanceClass):
+        super().__init__(scope, name)
+        DbInstance(self, "db",
+            s3_import=DbInstanceS3Import(
+                bucket_name="mybucket",
+                bucket_prefix="backups",
+                ingestion_role="arn:aws:iam::1234567890:role/role-xtrabackup-rds-restore",
+                source_engine="mysql",
+                source_engine_version="5.6"
+            ),
+            instance_class=instance_class
+        )
+```
+
+* `bucket_name` - (Required) The bucket name where your backup is stored
+* `bucket_prefix` - (Optional) Can be blank, but is the path to your backup
+* `ingestion_role` - (Required) Role applied to load the data.
+* `source_engine` - (Required, as of Feb 2018 only 'mysql' supported) Source engine for the backup
+* `source_engine_version` - (Required, as of Feb 2018 only '5.6' supported) Version of the source engine used to make the backup
+
+This will not recreate the resource if the S3 object changes in some way.  It's only used to initialize the database.
+
+### `blue_green_update`
+
+* `enabled` - (Optional) Enables [low-downtime updates](#low-downtime-updates) when `true`.
+  Default is `false`.
+
+[instance-replication]:
+https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.Replication.html
+[instance-maintenance]:
+https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_UpgradeDBInstance.Maintenance.html
+[blue-green]:
+https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/blue-green-deployments.html
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `address` - The hostname of the RDS instance. See also `endpoint` and `port`.
+* `arn` - The ARN of the RDS instance.
+* `allocated_storage` - The amount of allocated storage.
+* `availability_zone` - The availability zone of the instance.
+* `backup_retention_period` - The backup retention period.
+* `backup_window` - The backup window.
+* `ca_cert_identifier` - Identifier of the CA certificate for the
+DB instance.
+* `db_name` - The database name.
+* `domain` - The ID of the Directory Service Active Directory domain the instance is joined to
+* `domain_iam_role_name` - The name of the IAM role to be used when making API calls to the Directory Service.
+* `endpoint` - The connection endpoint in `address:port` format.
+* `engine` - The database engine.
+* `engine_version_actual` - The running version of the database.
+* `hosted_zone_id` - The canonical hosted zone ID of the DB instance (to be used
+in a Route 53 Alias record).
+* `id` - RDS DBI resource ID.
+* `instance_class`- The RDS instance class.
+* `latest_restorable_time` - The latest time, in UTC [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8), to which a database can be restored with point-in-time restore.
+* `listener_endpoint` - Specifies the listener connection endpoint for SQL Server Always On. See [endpoint](#endpoint) below.
+* `maintenance_window` - The instance maintenance window.
+* `master_user_secret` - A block that specifies the master user secret. Only available when `manage_master_user_password` is set to true. [Documented below](#master_user_secret).
+* `multi_az` - If the RDS instance is multi AZ enabled.
+* `port` - The database port.
+* `resource_id` - The RDS Resource ID of this instance.
+* `status` - The RDS instance status.
+* `storage_encrypted` - Whether the DB instance is encrypted.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `username` - The master username for the database.
+
+On Oracle and Microsoft SQL instances the following is exported additionally:
+
+* `character_set_name` - The character set (collation) used on Oracle and Microsoft SQL instances.
+
+### Endpoint
+
+* `address` - Specifies the DNS address of the DB instance.
+* `hosted_zone_id` - Specifies the ID that Amazon Route 53 assigns when you create a hosted zone.
+* `port` - Specifies the port that the database engine is listening on.
+
+### master_user_secret
+
+The `master_user_secret` configuration block supports the following attributes:
+
+* `kms_key_id` - The Amazon Web Services KMS key identifier that is used to encrypt the secret.
+* `secret_arn` - The Amazon Resource Name (ARN) of the secret.
+* `secret_status` - The status of the secret. Valid Values: `creating` | `active` | `rotating` | `impaired`.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `40m`)
+- `update` - (Default `80m`)
+- `delete` - (Default `60m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DB Instances using the `identifier`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import DB Instances using the `identifier`. For example:
+
+```console
+% terraform import aws_db_instance.default mydb-rds-instance
+```
+
+<!-- cache-key: cdktf-0.18.0 input-b21700814161e25f711326174480a6752fc0080770ea5836b639fbad92ed7c1e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/db_instance_automated_backups_replication.html.markdown b/website/docs/cdktf/python/r/db_instance_automated_backups_replication.html.markdown
new file mode 100644
index 00000000000..c5deae0fbc7
--- /dev/null
+++ b/website/docs/cdktf/python/r/db_instance_automated_backups_replication.html.markdown
@@ -0,0 +1,153 @@
+---
+subcategory: "RDS (Relational Database)"
+layout: "aws"
+page_title: "AWS: aws_db_instance_automated_backups_replication"
+description: |-
+  Enables replication of automated backups to a different AWS Region.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_db_instance_automated_backups_replication
+
+Manage cross-region replication of automated backups to a different AWS Region. Documentation for cross-region automated backup replication can be found at:
+
+* [Replicating automated backups to another AWS Region](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_ReplicateBackups.html)
+
+-> **Note:** This resource has to be created in the destination region.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.db_instance_automated_backups_replication import DbInstanceAutomatedBackupsReplication
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DbInstanceAutomatedBackupsReplication(self, "default",
+            retention_period=14,
+            source_db_instance_arn="arn:aws:rds:us-west-2:123456789012:db:mydatabase"
+        )
+```
+
+## Encrypting the automated backup with KMS
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.db_instance_automated_backups_replication import DbInstanceAutomatedBackupsReplication
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DbInstanceAutomatedBackupsReplication(self, "default",
+            kms_key_id="arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012",
+            source_db_instance_arn="arn:aws:rds:us-west-2:123456789012:db:mydatabase"
+        )
+```
+
+## Example including a RDS DB instance
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.db_instance import DbInstance
+from imports.aws.db_instance_automated_backups_replication import DbInstanceAutomatedBackupsReplication
+from imports.aws.kms_key import KmsKey
+from imports.aws.provider import AwsProvider
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AwsProvider(self, "aws",
+            region="us-east-1"
+        )
+        replica = AwsProvider(self, "aws_1",
+            alias="replica",
+            region="us-west-2"
+        )
+        default_var = DbInstance(self, "default",
+            allocated_storage=10,
+            backup_retention_period=7,
+            db_name="mydb",
+            engine="postgres",
+            engine_version="13.4",
+            identifier="mydb",
+            instance_class="db.t3.micro",
+            password="mustbeeightcharacters",
+            skip_final_snapshot=True,
+            storage_encrypted=True,
+            username="masterusername"
+        )
+        aws_kms_key_default = KmsKey(self, "default_3",
+            description="Encryption key for automated backups",
+            provider=replica
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_kms_key_default.override_logical_id("default")
+        aws_db_instance_automated_backups_replication_default =
+        DbInstanceAutomatedBackupsReplication(self, "default_4",
+            kms_key_id=Token.as_string(aws_kms_key_default.arn),
+            provider=replica,
+            source_db_instance_arn=default_var.arn
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_db_instance_automated_backups_replication_default.override_logical_id("default")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `kms_key_id` - (Optional, Forces new resource) The AWS KMS key identifier for encryption of the replicated automated backups. The KMS key ID is the Amazon Resource Name (ARN) for the KMS encryption key in the destination AWS Region, for example, `arn:aws:kms:us-east-1:123456789012:key/AKIAIOSFODNN7EXAMPLE`.
+* `pre_signed_url` - (Optional, Forces new resource) A URL that contains a [Signature Version 4](https://docs.aws.amazon.com/general/latest/gr/signature-version-4.html) signed request for the [`StartDBInstanceAutomatedBackupsReplication`](https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_StartDBInstanceAutomatedBackupsReplication.html) action to be called in the AWS Region of the source DB instance.
+* `retention_period` - (Optional, Forces new resource) The retention period for the replicated automated backups, defaults to `7`.
+* `source_db_instance_arn` - (Required, Forces new resource) The Amazon Resource Name (ARN) of the source DB instance for the replicated automated backups, for example, `arn:aws:rds:us-west-2:123456789012:db:mydatabase`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Amazon Resource Name (ARN) of the replicated automated backups.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `75m`)
+- `delete` - (Default `75m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import RDS instance automated backups replication using the `arn`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import RDS instance automated backups replication using the `arn`. For example:
+
+```console
+% terraform import aws_db_instance_automated_backups_replication.default arn:aws:rds:us-east-1:123456789012:auto-backup:ab-faaa2mgdj1vmp4xflr7yhsrmtbtob7ltrzzz2my
+```
+
+<!-- cache-key: cdktf-0.18.0 input-a1a4df51ceeb0b407d09f3cecea4189146c75a1f96880f39dc75e22abd29cc11 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/db_instance_automated_backups_replication.markdown b/website/docs/cdktf/python/r/db_instance_automated_backups_replication.markdown
new file mode 100644
index 00000000000..c5deae0fbc7
--- /dev/null
+++ b/website/docs/cdktf/python/r/db_instance_automated_backups_replication.markdown
@@ -0,0 +1,153 @@
+---
+subcategory: "RDS (Relational Database)"
+layout: "aws"
+page_title: "AWS: aws_db_instance_automated_backups_replication"
+description: |-
+  Enables replication of automated backups to a different AWS Region.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_db_instance_automated_backups_replication
+
+Manage cross-region replication of automated backups to a different AWS Region. Documentation for cross-region automated backup replication can be found at:
+
+* [Replicating automated backups to another AWS Region](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_ReplicateBackups.html)
+
+-> **Note:** This resource has to be created in the destination region.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.db_instance_automated_backups_replication import DbInstanceAutomatedBackupsReplication
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DbInstanceAutomatedBackupsReplication(self, "default",
+            retention_period=14,
+            source_db_instance_arn="arn:aws:rds:us-west-2:123456789012:db:mydatabase"
+        )
+```
+
+## Encrypting the automated backup with KMS
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.db_instance_automated_backups_replication import DbInstanceAutomatedBackupsReplication
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DbInstanceAutomatedBackupsReplication(self, "default",
+            kms_key_id="arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012",
+            source_db_instance_arn="arn:aws:rds:us-west-2:123456789012:db:mydatabase"
+        )
+```
+
+## Example including a RDS DB instance
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.db_instance import DbInstance
+from imports.aws.db_instance_automated_backups_replication import DbInstanceAutomatedBackupsReplication
+from imports.aws.kms_key import KmsKey
+from imports.aws.provider import AwsProvider
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AwsProvider(self, "aws",
+            region="us-east-1"
+        )
+        replica = AwsProvider(self, "aws_1",
+            alias="replica",
+            region="us-west-2"
+        )
+        default_var = DbInstance(self, "default",
+            allocated_storage=10,
+            backup_retention_period=7,
+            db_name="mydb",
+            engine="postgres",
+            engine_version="13.4",
+            identifier="mydb",
+            instance_class="db.t3.micro",
+            password="mustbeeightcharacters",
+            skip_final_snapshot=True,
+            storage_encrypted=True,
+            username="masterusername"
+        )
+        aws_kms_key_default = KmsKey(self, "default_3",
+            description="Encryption key for automated backups",
+            provider=replica
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_kms_key_default.override_logical_id("default")
+        aws_db_instance_automated_backups_replication_default =
+        DbInstanceAutomatedBackupsReplication(self, "default_4",
+            kms_key_id=Token.as_string(aws_kms_key_default.arn),
+            provider=replica,
+            source_db_instance_arn=default_var.arn
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_db_instance_automated_backups_replication_default.override_logical_id("default")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `kms_key_id` - (Optional, Forces new resource) The AWS KMS key identifier for encryption of the replicated automated backups. The KMS key ID is the Amazon Resource Name (ARN) for the KMS encryption key in the destination AWS Region, for example, `arn:aws:kms:us-east-1:123456789012:key/AKIAIOSFODNN7EXAMPLE`.
+* `pre_signed_url` - (Optional, Forces new resource) A URL that contains a [Signature Version 4](https://docs.aws.amazon.com/general/latest/gr/signature-version-4.html) signed request for the [`StartDBInstanceAutomatedBackupsReplication`](https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_StartDBInstanceAutomatedBackupsReplication.html) action to be called in the AWS Region of the source DB instance.
+* `retention_period` - (Optional, Forces new resource) The retention period for the replicated automated backups, defaults to `7`.
+* `source_db_instance_arn` - (Required, Forces new resource) The Amazon Resource Name (ARN) of the source DB instance for the replicated automated backups, for example, `arn:aws:rds:us-west-2:123456789012:db:mydatabase`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Amazon Resource Name (ARN) of the replicated automated backups.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `75m`)
+- `delete` - (Default `75m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import RDS instance automated backups replication using the `arn`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import RDS instance automated backups replication using the `arn`. For example:
+
+```console
+% terraform import aws_db_instance_automated_backups_replication.default arn:aws:rds:us-east-1:123456789012:auto-backup:ab-faaa2mgdj1vmp4xflr7yhsrmtbtob7ltrzzz2my
+```
+
+<!-- cache-key: cdktf-0.18.0 input-a1a4df51ceeb0b407d09f3cecea4189146c75a1f96880f39dc75e22abd29cc11 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/db_instance_role_association.html.markdown b/website/docs/cdktf/python/r/db_instance_role_association.html.markdown
new file mode 100644
index 00000000000..8cc86ed1781
--- /dev/null
+++ b/website/docs/cdktf/python/r/db_instance_role_association.html.markdown
@@ -0,0 +1,74 @@
+---
+subcategory: "RDS (Relational Database)"
+layout: "aws"
+page_title: "AWS: aws_db_instance_role_association"
+description: |-
+  Manages an RDS DB Instance association with an IAM Role.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_db_instance_role_association
+
+Manages an RDS DB Instance association with an IAM Role. Example use cases:
+
+* [Amazon RDS Oracle integration with Amazon S3](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/oracle-s3-integration.html)
+* [Importing Amazon S3 Data into an RDS PostgreSQL DB Instance](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_PostgreSQL.S3Import.html)
+
+-> To manage the RDS DB Instance IAM Role for [Enhanced Monitoring](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Monitoring.OS.html), see the `aws_db_instance` resource `monitoring_role_arn` argument instead.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.db_instance_role_association import DbInstanceRoleAssociation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DbInstanceRoleAssociation(self, "example",
+            db_instance_identifier=Token.as_string(aws_db_instance_example.identifier),
+            feature_name="S3_INTEGRATION",
+            role_arn=Token.as_string(aws_iam_role_example.arn)
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `db_instance_identifier` - (Required) DB Instance Identifier to associate with the IAM Role.
+* `feature_name` - (Required) Name of the feature for association. This can be found in the AWS documentation relevant to the integration or a full list is available in the `SupportedFeatureNames` list returned by [AWS CLI rds describe-db-engine-versions](https://docs.aws.amazon.com/cli/latest/reference/rds/describe-db-engine-versions.html).
+* `role_arn` - (Required) Amazon Resource Name (ARN) of the IAM Role to associate with the DB Instance.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - DB Instance Identifier and IAM Role ARN separated by a comma (`,`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_db_instance_role_association` using the DB Instance Identifier and IAM Role ARN separated by a comma (`,`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_db_instance_role_association` using the DB Instance Identifier and IAM Role ARN separated by a comma (`,`). For example:
+
+```console
+% terraform import aws_db_instance_role_association.example my-db-instance,arn:aws:iam::123456789012:role/my-role
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ea9099caf40d7a4cade1ea4194ea1b75c0145f79cdeb15a2e5c098eb364ca5d9 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/db_option_group.html.markdown b/website/docs/cdktf/python/r/db_option_group.html.markdown
new file mode 100644
index 00000000000..78d025dc3c9
--- /dev/null
+++ b/website/docs/cdktf/python/r/db_option_group.html.markdown
@@ -0,0 +1,129 @@
+---
+subcategory: "RDS (Relational Database)"
+layout: "aws"
+page_title: "AWS: aws_db_option_group"
+description: |-
+  Provides an RDS DB option group resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_db_option_group
+
+Provides an RDS DB option group resource. Documentation of the available options for various RDS engines can be found at:
+
+* [MariaDB Options](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Appendix.MariaDB.Options.html)
+* [Microsoft SQL Server Options](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Appendix.SQLServer.Options.html)
+* [MySQL Options](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Appendix.MySQL.Options.html)
+* [Oracle Options](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Appendix.Oracle.Options.html)
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.db_option_group import DbOptionGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DbOptionGroup(self, "example",
+            engine_name="sqlserver-ee",
+            major_engine_version="11.00",
+            name="option-group-test-terraform",
+            option=[DbOptionGroupOption(
+                option_name="Timezone",
+                option_settings=[DbOptionGroupOptionOptionSettings(
+                    name="TIME_ZONE",
+                    value="UTC"
+                )
+                ]
+            ), DbOptionGroupOption(
+                option_name="SQLSERVER_BACKUP_RESTORE",
+                option_settings=[DbOptionGroupOptionOptionSettings(
+                    name="IAM_ROLE_ARN",
+                    value=Token.as_string(aws_iam_role_example.arn)
+                )
+                ]
+            ), DbOptionGroupOption(
+                option_name="TDE"
+            )
+            ],
+            option_group_description="Terraform Option Group"
+        )
+```
+
+~> **Note:** Any modifications to the `aws_db_option_group` are set to happen immediately as we default to applying immediately.
+
+~> **WARNING:** You can perform a destroy on a `aws_db_option_group`, as long as it is not associated with any Amazon RDS resource. An option group can be associated with a DB instance, a manual DB snapshot, or an automated DB snapshot.
+
+If you try to delete an option group that is associated with an Amazon RDS resource, an error similar to the following is returned:
+
+> An error occurred (InvalidOptionGroupStateFault) when calling the DeleteOptionGroup operation: The option group 'optionGroupName' cannot be deleted because it is in use.
+
+More information about this can be found [here](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_WorkingWithOptionGroups.html#USER_WorkingWithOptionGroups.Delete).
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Optional, Forces new resource) Name of the option group. If omitted, Terraform will assign a random, unique name. Must be lowercase, to match as it is stored in AWS.
+* `name_prefix` - (Optional, Forces new resource) Creates a unique name beginning with the specified prefix. Conflicts with `name`. Must be lowercase, to match as it is stored in AWS.
+* `option_group_description` - (Optional) Description of the option group. Defaults to "Managed by Terraform".
+* `engine_name` - (Required) Specifies the name of the engine that this option group should be associated with.
+* `major_engine_version` - (Required) Specifies the major version of the engine that this option group should be associated with.
+* `option` - (Optional) List of options to apply.
+* `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+`option` blocks support the following:
+
+* `option_name` - (Required) Name of the option (e.g., MEMCACHED).
+* `option_settings` - (Optional) List of option settings to apply.
+* `port` - (Optional) Port number when connecting to the option (e.g., 11211). Leaving out or removing `port` from your configuration does not remove or clear a port from the option in AWS. AWS may assign a default port. Not including `port` in your configuration means that the AWS provider will ignore a previously set value, a value set by AWS, and any port changes.
+* `version` - (Optional) Version of the option (e.g., 13.1.0.0). Leaving out or removing `version` from your configuration does not remove or clear a version from the option in AWS. AWS may assign a default version. Not including `version` in your configuration means that the AWS provider will ignore a previously set value, a value set by AWS, and any version changes.
+* `db_security_group_memberships` - (Optional) List of DB Security Groups for which the option is enabled.
+* `vpc_security_group_memberships` - (Optional) List of VPC Security Groups for which the option is enabled.
+
+`option_settings` blocks support the following:
+
+* `name` - (Optional) Name of the setting.
+* `value` - (Optional) Value of the setting.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - DB option group name.
+* `arn` - ARN of the DB option group.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `delete` - (Default `15m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DB option groups using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import DB option groups using the `name`. For example:
+
+```console
+% terraform import aws_db_option_group.example mysql-option-group
+```
+
+<!-- cache-key: cdktf-0.18.0 input-62a59e358d472f90cc96a8b627a9411731fa9d779529aff440ffd21e6234b0b2 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/db_parameter_group.html.markdown b/website/docs/cdktf/python/r/db_parameter_group.html.markdown
new file mode 100644
index 00000000000..d4fc119d405
--- /dev/null
+++ b/website/docs/cdktf/python/r/db_parameter_group.html.markdown
@@ -0,0 +1,148 @@
+---
+subcategory: "RDS (Relational Database)"
+layout: "aws"
+page_title: "AWS: aws_db_parameter_group"
+description: |-
+  Provides an RDS DB parameter group resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_db_parameter_group
+
+Provides an RDS DB parameter group resource. Documentation of the available parameters for various RDS engines can be found at:
+
+* [Aurora MySQL Parameters](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/AuroraMySQL.Reference.html)
+* [Aurora PostgreSQL Parameters](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/AuroraPostgreSQL.Reference.html)
+* [MariaDB Parameters](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Appendix.MariaDB.Parameters.html)
+* [Oracle Parameters](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_ModifyInstance.Oracle.html#USER_ModifyInstance.Oracle.sqlnet)
+* [PostgreSQL Parameters](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Appendix.PostgreSQL.CommonDBATasks.html#Appendix.PostgreSQL.CommonDBATasks.Parameters)
+
+> **Hands-on:** For an example of the `aws_db_parameter_group` in use, follow the [Manage AWS RDS Instances](https://learn.hashicorp.com/tutorials/terraform/aws-rds?in=terraform/aws&utm_source=WEBSITE&utm_medium=WEB_IO&utm_offer=ARTICLE_PAGE&utm_content=DOCS) tutorial on HashiCorp Learn.
+
+~> **NOTE:** After applying your changes, you may encounter a perpetual diff in your Terraform plan
+output for a `parameter` whose `value` remains unchanged but whose `apply_method` is changing
+(e.g., from `immediate` to `pending-reboot`, or `pending-reboot` to `immediate`). If only the
+apply method of a parameter is changing, the AWS API will not register this change. To change
+the `apply_method` of a parameter, its value must also change.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.db_parameter_group import DbParameterGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DbParameterGroup(self, "default",
+            family="mysql5.6",
+            name="rds-pg",
+            parameter=[DbParameterGroupParameter(
+                name="character_set_server",
+                value="utf8"
+            ), DbParameterGroupParameter(
+                name="character_set_client",
+                value="utf8"
+            )
+            ]
+        )
+```
+
+### `create_before_destroy` Lifecycle Configuration
+
+The [`create_before_destroy`](https://developer.hashicorp.com/terraform/language/meta-arguments/lifecycle#create_before_destroy)
+lifecycle configuration is necessary for modifications that force re-creation of an existing,
+in-use parameter group. This includes common situations like changing the group `name` or
+bumping the `family` version during a major version upgrade. This configuration will prevent destruction
+of the deposed parameter group while still in use by the database during upgrade.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from cdktf import TerraformResourceLifecycle
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.db_instance import DbInstance
+from imports.aws.db_parameter_group import DbParameterGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, instanceClass):
+        super().__init__(scope, name)
+        example = DbParameterGroup(self, "example",
+            family="postgres13",
+            lifecycle=TerraformResourceLifecycle(
+                create_before_destroy=True
+            ),
+            name="my-pg",
+            parameter=[DbParameterGroupParameter(
+                name="log_connections",
+                value="1"
+            )
+            ]
+        )
+        aws_db_instance_example = DbInstance(self, "example_1",
+            apply_immediately=True,
+            parameter_group_name=example.name,
+            instance_class=instance_class
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_db_instance_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Optional, Forces new resource) The name of the DB parameter group. If omitted, Terraform will assign a random, unique name.
+* `name_prefix` - (Optional, Forces new resource) Creates a unique name beginning with the specified prefix. Conflicts with `name`.
+* `family` - (Required, Forces new resource) The family of the DB parameter group.
+* `description` - (Optional, Forces new resource) The description of the DB parameter group. Defaults to "Managed by Terraform".
+* `parameter` - (Optional) A list of DB parameters to apply. Note that parameters may differ from a family to an other. Full list of all parameters can be discovered via [`aws rds describe-db-parameters`](https://docs.aws.amazon.com/cli/latest/reference/rds/describe-db-parameters.html) after initial creation of the group.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+Parameter blocks support the following:
+
+* `name` - (Required) The name of the DB parameter.
+* `value` - (Required) The value of the DB parameter.
+* `apply_method` - (Optional) "immediate" (default), or "pending-reboot". Some
+    engines can't apply some parameters without a reboot, and you will need to
+    specify "pending-reboot" here.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The db parameter group name.
+* `arn` - The ARN of the db parameter group.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DB Parameter groups using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import DB Parameter groups using the `name`. For example:
+
+```console
+% terraform import aws_db_parameter_group.rds_pg rds-pg
+```
+
+<!-- cache-key: cdktf-0.18.0 input-58d3afb77ce85c7eccf039e1c08d533c541b3a0e93a559083e86605494ac1352 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/db_proxy.html.markdown b/website/docs/cdktf/python/r/db_proxy.html.markdown
new file mode 100644
index 00000000000..29249319774
--- /dev/null
+++ b/website/docs/cdktf/python/r/db_proxy.html.markdown
@@ -0,0 +1,112 @@
+---
+subcategory: "RDS (Relational Database)"
+layout: "aws"
+page_title: "AWS: aws_db_proxy"
+description: |-
+  Provides an RDS DB proxy resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_db_proxy
+
+Provides an RDS DB proxy resource. For additional information, see the [RDS User Guide](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/rds-proxy.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.db_proxy import DbProxy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DbProxy(self, "example",
+            auth=[DbProxyAuth(
+                auth_scheme="SECRETS",
+                description="example",
+                iam_auth="DISABLED",
+                secret_arn=Token.as_string(aws_secretsmanager_secret_example.arn)
+            )
+            ],
+            debug_logging=False,
+            engine_family="MYSQL",
+            idle_client_timeout=1800,
+            name="example",
+            require_tls=True,
+            role_arn=Token.as_string(aws_iam_role_example.arn),
+            tags={
+                "Key": "value",
+                "Name": "example"
+            },
+            vpc_security_group_ids=[Token.as_string(aws_security_group_example.id)],
+            vpc_subnet_ids=[Token.as_string(aws_subnet_example.id)]
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The identifier for the proxy. This name must be unique for all proxies owned by your AWS account in the specified AWS Region. An identifier must begin with a letter and must contain only ASCII letters, digits, and hyphens; it can't end with a hyphen or contain two consecutive hyphens.
+* `auth` - (Required) Configuration block(s) with authorization mechanisms to connect to the associated instances or clusters. Described below.
+* `debug_logging` - (Optional) Whether the proxy includes detailed information about SQL statements in its logs. This information helps you to debug issues involving SQL behavior or the performance and scalability of the proxy connections. The debug information includes the text of SQL statements that you submit through the proxy. Thus, only enable this setting when needed for debugging, and only when you have security measures in place to safeguard any sensitive information that appears in the logs.
+* `engine_family` - (Required, Forces new resource) The kinds of databases that the proxy can connect to. This value determines which database network protocol the proxy recognizes when it interprets network traffic to and from the database. For Aurora MySQL, RDS for MariaDB, and RDS for MySQL databases, specify `MYSQL`. For Aurora PostgreSQL and RDS for PostgreSQL databases, specify `POSTGRESQL`. For RDS for Microsoft SQL Server, specify `SQLSERVER`. Valid values are `MYSQL`, `POSTGRESQL`, and `SQLSERVER`.
+* `idle_client_timeout` - (Optional) The number of seconds that a connection to the proxy can be inactive before the proxy disconnects it. You can set this value higher or lower than the connection timeout limit for the associated database.
+* `require_tls` - (Optional) A Boolean parameter that specifies whether Transport Layer Security (TLS) encryption is required for connections to the proxy. By enabling this setting, you can enforce encrypted TLS connections to the proxy.
+* `role_arn` - (Required) The Amazon Resource Name (ARN) of the IAM role that the proxy uses to access secrets in AWS Secrets Manager.
+* `vpc_security_group_ids` - (Optional) One or more VPC security group IDs to associate with the new proxy.
+* `vpc_subnet_ids` - (Required) One or more VPC subnet IDs to associate with the new proxy.
+* `tags` - (Optional) A mapping of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+`auth` blocks support the following:
+
+* `auth_scheme` - (Optional) The type of authentication that the proxy uses for connections from the proxy to the underlying database. One of `SECRETS`.
+* `client_password_auth_type` - (Optional) The type of authentication the proxy uses for connections from clients. Valid values are `MYSQL_NATIVE_PASSWORD`, `POSTGRES_SCRAM_SHA_256`, `POSTGRES_MD5`, and `SQL_SERVER_AUTHENTICATION`.
+* `description` - (Optional) A user-specified description about the authentication used by a proxy to log in as a specific database user.
+* `iam_auth` - (Optional) Whether to require or disallow AWS Identity and Access Management (IAM) authentication for connections to the proxy. One of `DISABLED`, `REQUIRED`.
+* `secret_arn` - (Optional) The Amazon Resource Name (ARN) representing the secret that the proxy uses to authenticate to the RDS DB instance or Aurora DB cluster. These secrets are stored within Amazon Secrets Manager.
+* `username` - (Optional) The name of the database user to which the proxy connects.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Amazon Resource Name (ARN) for the proxy.
+* `arn` - The Amazon Resource Name (ARN) for the proxy.
+* `endpoint` - The endpoint that you can use to connect to the proxy. You include the endpoint value in the connection string for a database client application.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `30m`)
+- `update` - (Default `30m`)
+- `delete` - (Default `60m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DB proxies using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import DB proxies using the `name`. For example:
+
+```console
+% terraform import aws_db_proxy.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-8a3c238396074ac96e7b1e4adfae2e3755201827cad27408ac90aeb3b6b1ca32 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/db_proxy_default_target_group.html.markdown b/website/docs/cdktf/python/r/db_proxy_default_target_group.html.markdown
new file mode 100644
index 00000000000..d035f570c3e
--- /dev/null
+++ b/website/docs/cdktf/python/r/db_proxy_default_target_group.html.markdown
@@ -0,0 +1,116 @@
+---
+subcategory: "RDS (Relational Database)"
+layout: "aws"
+page_title: "AWS: aws_db_proxy_default_target_group"
+description: |-
+  Manage an RDS DB proxy default target group resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_db_proxy_default_target_group
+
+Provides a resource to manage an RDS DB proxy default target group resource.
+
+The `aws_db_proxy_default_target_group` behaves differently from normal resources, in that Terraform does not _create_ or _destroy_ this resource, since it implicitly exists as part of an RDS DB Proxy. On Terraform resource creation it is automatically imported and on resource destruction, Terraform performs no actions in RDS.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.db_proxy import DbProxy
+from imports.aws.db_proxy_default_target_group import DbProxyDefaultTargetGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = DbProxy(self, "example",
+            auth=[DbProxyAuth(
+                auth_scheme="SECRETS",
+                description="example",
+                iam_auth="DISABLED",
+                secret_arn=Token.as_string(aws_secretsmanager_secret_example.arn)
+            )
+            ],
+            debug_logging=False,
+            engine_family="MYSQL",
+            idle_client_timeout=1800,
+            name="example",
+            require_tls=True,
+            role_arn=Token.as_string(aws_iam_role_example.arn),
+            tags={
+                "Key": "value",
+                "Name": "example"
+            },
+            vpc_security_group_ids=[Token.as_string(aws_security_group_example.id)],
+            vpc_subnet_ids=[Token.as_string(aws_subnet_example.id)]
+        )
+        aws_db_proxy_default_target_group_example = DbProxyDefaultTargetGroup(self, "example_1",
+            connection_pool_config=DbProxyDefaultTargetGroupConnectionPoolConfig(
+                connection_borrow_timeout=120,
+                init_query="SET x=1, y=2",
+                max_connections_percent=100,
+                max_idle_connections_percent=50,
+                session_pinning_filters=["EXCLUDE_VARIABLE_SETS"]
+            ),
+            db_proxy_name=example.name
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_db_proxy_default_target_group_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `db_proxy_name` - (Required) Name of the RDS DB Proxy.
+* `connection_pool_config` - (Optional) The settings that determine the size and behavior of the connection pool for the target group.
+
+`connection_pool_config` blocks support the following:
+
+* `connection_borrow_timeout` - (Optional) The number of seconds for a proxy to wait for a connection to become available in the connection pool. Only applies when the proxy has opened its maximum number of connections and all connections are busy with client sessions.
+* `init_query` - (Optional) One or more SQL statements for the proxy to run when opening each new database connection. Typically used with `SET` statements to make sure that each connection has identical settings such as time zone and character set. This setting is empty by default. For multiple statements, use semicolons as the separator. You can also include multiple variables in a single `SET` statement, such as `SET x=1, y=2`.
+* `max_connections_percent` - (Optional) The maximum size of the connection pool for each target in a target group. For Aurora MySQL, it is expressed as a percentage of the max_connections setting for the RDS DB instance or Aurora DB cluster used by the target group.
+* `max_idle_connections_percent` - (Optional) Controls how actively the proxy closes idle database connections in the connection pool. A high value enables the proxy to leave a high percentage of idle connections open. A low value causes the proxy to close idle client connections and return the underlying database connections to the connection pool. For Aurora MySQL, it is expressed as a percentage of the max_connections setting for the RDS DB instance or Aurora DB cluster used by the target group.
+* `session_pinning_filters` - (Optional) Each item in the list represents a class of SQL operations that normally cause all later statements in a session using a proxy to be pinned to the same underlying database connection. Including an item in the list exempts that class of SQL operations from the pinning behavior. Currently, the only allowed value is `EXCLUDE_VARIABLE_SETS`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Name of the RDS DB Proxy.
+* `arn` - The Amazon Resource Name (ARN) representing the target group.
+* `name` - The name of the default target group.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `30m`)
+- `update` - (Default `30m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DB proxy default target groups using the `db_proxy_name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import DB proxy default target groups using the `db_proxy_name`. For example:
+
+```console
+% terraform import aws_db_proxy_default_target_group.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-586609f3d8c714e67602a68a74614deb7a87a2757faa28cdcb1f6179fbffb6a9 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/db_proxy_endpoint.html.markdown b/website/docs/cdktf/python/r/db_proxy_endpoint.html.markdown
new file mode 100644
index 00000000000..8a7abad97d8
--- /dev/null
+++ b/website/docs/cdktf/python/r/db_proxy_endpoint.html.markdown
@@ -0,0 +1,85 @@
+---
+subcategory: "RDS (Relational Database)"
+layout: "aws"
+page_title: "AWS: aws_db_proxy_endpoint"
+description: |-
+  Provides an RDS DB proxy endpoint resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_db_proxy_endpoint
+
+Provides an RDS DB proxy endpoint resource. For additional information, see the [RDS User Guide](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/rds-proxy-endpoints.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.db_proxy_endpoint import DbProxyEndpoint
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DbProxyEndpoint(self, "example",
+            db_proxy_endpoint_name="example",
+            db_proxy_name=test.name,
+            target_role="READ_ONLY",
+            vpc_subnet_ids=Token.as_list(Fn.lookup_nested(aws_subnet_test, ["*", "id"]))
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `db_proxy_endpoint_name` - (Required) The identifier for the proxy endpoint. An identifier must begin with a letter and must contain only ASCII letters, digits, and hyphens; it can't end with a hyphen or contain two consecutive hyphens.
+* `db_proxy_name` - (Required) The name of the DB proxy associated with the DB proxy endpoint that you create.
+* `vpc_subnet_ids` - (Required) One or more VPC subnet IDs to associate with the new proxy.
+* `vpc_security_group_ids` - (Optional) One or more VPC security group IDs to associate with the new proxy.
+* `target_role` - (Optional) Indicates whether the DB proxy endpoint can be used for read/write or read-only operations. The default is `READ_WRITE`. Valid values are `READ_WRITE` and `READ_ONLY`.
+* `tags` - (Optional) A mapping of tags to assign to the resource.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name of the proxy and proxy endpoint separated by `/`, `DB-PROXY-NAME/DB-PROXY-ENDPOINT-NAME`.
+* `arn` - The Amazon Resource Name (ARN) for the proxy endpoint.
+* `endpoint` - The endpoint that you can use to connect to the proxy. You include the endpoint value in the connection string for a database client application.
+* `is_default` - Indicates whether this endpoint is the default endpoint for the associated DB proxy.
+* `vpc_id` - The VPC ID of the DB proxy endpoint.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `30m`)
+- `update` - (Default `30m`)
+- `delete` - (Default `60m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DB proxy endpoints using the `DB-PROXY-NAME/DB-PROXY-ENDPOINT-NAME`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import DB proxy endpoints using the `DB-PROXY-NAME/DB-PROXY-ENDPOINT-NAME`. For example:
+
+```console
+% terraform import aws_db_proxy_endpoint.example example/example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-350a8a6ad58a9a637252ca5d1e91e374fee3e01e2e35b79ea8ea63a3a00e8a4d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/db_proxy_target.html.markdown b/website/docs/cdktf/python/r/db_proxy_target.html.markdown
new file mode 100644
index 00000000000..c7d6fbe43a4
--- /dev/null
+++ b/website/docs/cdktf/python/r/db_proxy_target.html.markdown
@@ -0,0 +1,136 @@
+---
+subcategory: "RDS (Relational Database)"
+layout: "aws"
+page_title: "AWS: aws_db_proxy_target"
+description: |-
+  Provides an RDS DB proxy target resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_db_proxy_target
+
+Provides an RDS DB proxy target resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.db_proxy import DbProxy
+from imports.aws.db_proxy_default_target_group import DbProxyDefaultTargetGroup
+from imports.aws.db_proxy_target import DbProxyTarget
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = DbProxy(self, "example",
+            auth=[DbProxyAuth(
+                auth_scheme="SECRETS",
+                description="example",
+                iam_auth="DISABLED",
+                secret_arn=Token.as_string(aws_secretsmanager_secret_example.arn)
+            )
+            ],
+            debug_logging=False,
+            engine_family="MYSQL",
+            idle_client_timeout=1800,
+            name="example",
+            require_tls=True,
+            role_arn=Token.as_string(aws_iam_role_example.arn),
+            tags={
+                "Key": "value",
+                "Name": "example"
+            },
+            vpc_security_group_ids=[Token.as_string(aws_security_group_example.id)],
+            vpc_subnet_ids=[Token.as_string(aws_subnet_example.id)]
+        )
+        aws_db_proxy_default_target_group_example = DbProxyDefaultTargetGroup(self, "example_1",
+            connection_pool_config=DbProxyDefaultTargetGroupConnectionPoolConfig(
+                connection_borrow_timeout=120,
+                init_query="SET x=1, y=2",
+                max_connections_percent=100,
+                max_idle_connections_percent=50,
+                session_pinning_filters=["EXCLUDE_VARIABLE_SETS"]
+            ),
+            db_proxy_name=example.name
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_db_proxy_default_target_group_example.override_logical_id("example")
+        aws_db_proxy_target_example = DbProxyTarget(self, "example_2",
+            db_instance_identifier=Token.as_string(aws_db_instance_example.identifier),
+            db_proxy_name=example.name,
+            target_group_name=Token.as_string(aws_db_proxy_default_target_group_example.name)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_db_proxy_target_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `db_proxy_name` - (Required, Forces new resource) The name of the DB proxy.
+* `target_group_name` - (Required, Forces new resource) The name of the target group.
+* `db_instance_identifier` - (Optional, Forces new resource) DB instance identifier.
+* `db_cluster_identifier` - (Optional, Forces new resource) DB cluster identifier.
+
+**NOTE:** Either `db_instance_identifier` or `db_cluster_identifier` should be specified and both should not be specified together
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `endpoint` - Hostname for the target RDS DB Instance. Only returned for `RDS_INSTANCE` type.
+* `id` - Identifier of  `db_proxy_name`, `target_group_name`, target type (e.g., `RDS_INSTANCE` or `TRACKED_CLUSTER`), and resource identifier separated by forward slashes (`/`).
+* `port` - Port for the target RDS DB Instance or Aurora DB Cluster.
+* `rds_resource_id` - Identifier representing the DB Instance or DB Cluster target.
+* `target_arn` - Amazon Resource Name (ARN) for the DB instance or DB cluster. Currently not returned by the RDS API.
+* `tracked_cluster_id` - DB Cluster identifier for the DB Instance target. Not returned unless manually importing an `RDS_INSTANCE` target that is part of a DB Cluster.
+* `type` - Type of targetE.g., `RDS_INSTANCE` or `TRACKED_CLUSTER`
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import RDS DB Proxy Targets using the `db_proxy_name`, `target_group_name`, target type (such as `RDS_INSTANCE` or `TRACKED_CLUSTER`), and resource identifier separated by forward slashes (`/`). For example:
+
+Instances:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Provisioned Clusters:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+**Using `terraform import` to import** RDS DB Proxy Targets using the `db_proxy_name`, `target_group_name`, target type (such as `RDS_INSTANCE` or `TRACKED_CLUSTER`), and resource identifier separated by forward slashes (`/`). For example:
+
+Instances:
+
+```console
+% terraform import aws_db_proxy_target.example example-proxy/default/RDS_INSTANCE/example-instance
+```
+
+Provisioned Clusters:
+
+```console
+% terraform import aws_db_proxy_target.example example-proxy/default/TRACKED_CLUSTER/example-cluster
+```
+
+<!-- cache-key: cdktf-0.18.0 input-7434cf3969d924cf4dd540c487f947d3059ac1146283da81333dc7dd742fe6ae -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/db_snapshot.html.markdown b/website/docs/cdktf/python/r/db_snapshot.html.markdown
new file mode 100644
index 00000000000..85dc9f0d312
--- /dev/null
+++ b/website/docs/cdktf/python/r/db_snapshot.html.markdown
@@ -0,0 +1,103 @@
+---
+subcategory: "RDS (Relational Database)"
+layout: "aws"
+page_title: "AWS: aws_db_snapshot"
+description: |-
+  Manages an RDS database instance snapshot.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_db_snapshot
+
+Manages an RDS database instance snapshot. For managing RDS database cluster snapshots, see the [`aws_db_cluster_snapshot` resource](/docs/providers/aws/r/db_cluster_snapshot.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.db_instance import DbInstance
+from imports.aws.db_snapshot import DbSnapshot
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        bar = DbInstance(self, "bar",
+            allocated_storage=10,
+            backup_retention_period=0,
+            db_name="baz",
+            engine="mysql",
+            engine_version="5.6.21",
+            instance_class="db.t2.micro",
+            maintenance_window="Fri:09:00-Fri:09:30",
+            parameter_group_name="default.mysql5.6",
+            password="barbarbarbar",
+            username="foo"
+        )
+        DbSnapshot(self, "test",
+            db_instance_identifier=bar.identifier,
+            db_snapshot_identifier="testsnapshot1234"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `db_instance_identifier` - (Required) The DB Instance Identifier from which to take the snapshot.
+* `db_snapshot_identifier` - (Required) The Identifier for the snapshot.
+* `shared_accounts` - (Optional) List of AWS Account ids to share snapshot with, use `all` to make snaphot public.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `allocated_storage` - Specifies the allocated storage size in gigabytes (GB).
+* `availability_zone` - Specifies the name of the Availability Zone the DB instance was located in at the time of the DB snapshot.
+* `db_snapshot_arn` - The Amazon Resource Name (ARN) for the DB snapshot.
+* `encrypted` - Specifies whether the DB snapshot is encrypted.
+* `engine` - Specifies the name of the database engine.
+* `engine_version` - Specifies the version of the database engine.
+* `iops` - Specifies the Provisioned IOPS (I/O operations per second) value of the DB instance at the time of the snapshot.
+* `kms_key_id` - The ARN for the KMS encryption key.
+* `license_model` - License model information for the restored DB instance.
+* `option_group_name` - Provides the option group name for the DB snapshot.
+* `source_db_snapshot_identifier` - The DB snapshot Arn that the DB snapshot was copied from. It only has value in case of cross customer or cross region copy.
+* `source_region` - The region that the DB snapshot was created in or copied from.
+* `status` - Specifies the status of this DB snapshot.
+* `storage_type` - Specifies the storage type associated with DB snapshot.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `vpc_id` - Provides the VPC ID associated with the DB snapshot.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `20m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_db_snapshot` using the snapshot identifier. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_db_snapshot` using the snapshot identifier. For example:
+
+```console
+% terraform import aws_db_snapshot.example my-snapshot
+```
+
+<!-- cache-key: cdktf-0.18.0 input-41ad054e1cd5f9035a73439b5851601fe3048ea049009ee39814356714bc4d11 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/db_snapshot_copy.html.markdown b/website/docs/cdktf/python/r/db_snapshot_copy.html.markdown
new file mode 100644
index 00000000000..52f084cf4f7
--- /dev/null
+++ b/website/docs/cdktf/python/r/db_snapshot_copy.html.markdown
@@ -0,0 +1,117 @@
+---
+subcategory: "RDS (Relational Database)"
+layout: "aws"
+page_title: "AWS: aws_db_snapshot_copy"
+description: |-
+  Manages an RDS database instance snapshot copy.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_db_snapshot_copy
+
+Manages an RDS database instance snapshot copy. For managing RDS database cluster snapshots, see the [`aws_db_cluster_snapshot` resource](/docs/providers/aws/r/db_cluster_snapshot.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.db_instance import DbInstance
+from imports.aws.db_snapshot import DbSnapshot
+from imports.aws.db_snapshot_copy import DbSnapshotCopy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = DbInstance(self, "example",
+            allocated_storage=10,
+            backup_retention_period=0,
+            db_name="baz",
+            engine="mysql",
+            engine_version="5.6.21",
+            instance_class="db.t2.micro",
+            maintenance_window="Fri:09:00-Fri:09:30",
+            parameter_group_name="default.mysql5.6",
+            password="barbarbarbar",
+            username="foo"
+        )
+        aws_db_snapshot_example = DbSnapshot(self, "example_1",
+            db_instance_identifier=example.identifier,
+            db_snapshot_identifier="testsnapshot1234"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_db_snapshot_example.override_logical_id("example")
+        aws_db_snapshot_copy_example = DbSnapshotCopy(self, "example_2",
+            source_db_snapshot_identifier=Token.as_string(aws_db_snapshot_example.db_snapshot_arn),
+            target_db_snapshot_identifier="testsnapshot1234-copy"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_db_snapshot_copy_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `copy_tags` - (Optional) Whether to copy existing tags. Defaults to `false`.
+* `destination_region` - (Optional) The Destination region to place snapshot copy.
+* `kms_key_id` - (Optional) KMS key ID.
+* `option_group_name`- (Optional) The name of an option group to associate with the copy of the snapshot.
+* `presigned_url` - (Optional) he URL that contains a Signature Version 4 signed request.
+* `source_db_snapshot_identifier` - (Required) Snapshot identifier of the source snapshot.
+* `target_custom_availability_zone` - (Optional) The external custom Availability Zone.
+* `target_db_snapshot_identifier` - (Required) The Identifier for the snapshot.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Snapshot Identifier.
+* `allocated_storage` - Specifies the allocated storage size in gigabytes (GB).
+* `availability_zone` - Specifies the name of the Availability Zone the DB instance was located in at the time of the DB snapshot.
+* `db_snapshot_arn` - The Amazon Resource Name (ARN) for the DB snapshot.
+* `encrypted` - Specifies whether the DB snapshot is encrypted.
+* `engine` - Specifies the name of the database engine.
+* `engine_version` - Specifies the version of the database engine.
+* `iops` - Specifies the Provisioned IOPS (I/O operations per second) value of the DB instance at the time of the snapshot.
+* `kms_key_id` - The ARN for the KMS encryption key.
+* `license_model` - License model information for the restored DB instance.
+* `option_group_name` - Provides the option group name for the DB snapshot.
+* `source_db_snapshot_identifier` - The DB snapshot Arn that the DB snapshot was copied from. It only has value in case of cross customer or cross region copy.
+* `source_region` - The region that the DB snapshot was created in or copied from.
+* `storage_type` - Specifies the storage type associated with DB snapshot.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `vpc_id` - Provides the VPC ID associated with the DB snapshot.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `20m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_db_snapshot_copy` using the snapshot identifier. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_db_snapshot_copy` using the snapshot identifier. For example:
+
+```console
+% terraform import aws_db_snapshot_copy.example my-snapshot
+```
+
+<!-- cache-key: cdktf-0.18.0 input-082f155090a12691f858aa1fdb27e4c7fb93bb3dd71c2796c7c873690f9af714 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/db_subnet_group.html.markdown b/website/docs/cdktf/python/r/db_subnet_group.html.markdown
new file mode 100644
index 00000000000..14f1a10798f
--- /dev/null
+++ b/website/docs/cdktf/python/r/db_subnet_group.html.markdown
@@ -0,0 +1,79 @@
+---
+subcategory: "RDS (Relational Database)"
+layout: "aws"
+page_title: "AWS: aws_db_subnet_group"
+description: |-
+  Provides an RDS DB subnet group resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_db_subnet_group
+
+Provides an RDS DB subnet group resource.
+
+> **Hands-on:** For an example of the `aws_db_subnet_group` in use, follow the [Manage AWS RDS Instances](https://learn.hashicorp.com/tutorials/terraform/aws-rds?in=terraform/aws&utm_source=WEBSITE&utm_medium=WEB_IO&utm_offer=ARTICLE_PAGE&utm_content=DOCS) tutorial on HashiCorp Learn.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.db_subnet_group import DbSubnetGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DbSubnetGroup(self, "default",
+            name="main",
+            subnet_ids=[frontend.id, backend.id],
+            tags={
+                "Name": "My DB subnet group"
+            }
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Optional, Forces new resource) The name of the DB subnet group. If omitted, Terraform will assign a random, unique name.
+* `name_prefix` - (Optional, Forces new resource) Creates a unique name beginning with the specified prefix. Conflicts with `name`.
+* `description` - (Optional) The description of the DB subnet group. Defaults to "Managed by Terraform".
+* `subnet_ids` - (Required) A list of VPC subnet IDs.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The db subnet group name.
+* `arn` - The ARN of the db subnet group.
+* `supported_network_types` - The network type of the db subnet group.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `vpc_id` - Provides the VPC ID of the DB subnet group.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DB Subnet groups using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import DB Subnet groups using the `name`. For example:
+
+```console
+% terraform import aws_db_subnet_group.default production-subnet-group
+```
+
+<!-- cache-key: cdktf-0.18.0 input-179353c0fba303d203c766c21037c29f91420947dad2e027698bb64aec31054a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/default_network_acl.html.markdown b/website/docs/cdktf/python/r/default_network_acl.html.markdown
new file mode 100644
index 00000000000..8ec8e3aa672
--- /dev/null
+++ b/website/docs/cdktf/python/r/default_network_acl.html.markdown
@@ -0,0 +1,227 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_default_network_acl"
+description: |-
+  Manage a default network ACL.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_default_network_acl
+
+Provides a resource to manage a VPC's default network ACL. This resource can manage the default network ACL of the default or a non-default VPC.
+
+~> **NOTE:** This is an advanced resource with special caveats. Please read this document in its entirety before using this resource. The `aws_default_network_acl` behaves differently from normal resources. Terraform does not _create_ this resource but instead attempts to "adopt" it into management.
+
+Every VPC has a default network ACL that can be managed but not destroyed. When Terraform first adopts the Default Network ACL, it **immediately removes all rules in the ACL**. It then proceeds to create any rules specified in the configuration. This step is required so that only the rules specified in the configuration are created.
+
+This resource treats its inline rules as absolute; only the rules defined inline are created, and any additions/removals external to this resource will result in diffs being shown. For these reasons, this resource is incompatible with the `aws_network_acl_rule` resource.
+
+For more information about Network ACLs, see the AWS Documentation on [Network ACLs][aws-network-acls].
+
+## Example Usage
+
+### Basic Example
+
+The following config gives the Default Network ACL the same rules that AWS includes but pulls the resource under management by Terraform. This means that any ACL rules added or changed will be detected as drift.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Op, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.default_network_acl import DefaultNetworkAcl
+from imports.aws.vpc import Vpc
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        mainvpc = Vpc(self, "mainvpc",
+            cidr_block="10.1.0.0/16"
+        )
+        DefaultNetworkAcl(self, "default",
+            default_network_acl_id=mainvpc.default_network_acl_id,
+            egress=[DefaultNetworkAclEgress(
+                action="allow",
+                cidr_block="0.0.0.0/0",
+                from_port=0,
+                protocol=Token.as_string(Op.negate(1)),
+                rule_no=100,
+                to_port=0
+            )
+            ],
+            ingress=[DefaultNetworkAclIngress(
+                action="allow",
+                cidr_block="0.0.0.0/0",
+                from_port=0,
+                protocol=Token.as_string(Op.negate(1)),
+                rule_no=100,
+                to_port=0
+            )
+            ]
+        )
+```
+
+### Example: Deny All Egress Traffic, Allow Ingress
+
+The following denies all Egress traffic by omitting any `egress` rules, while including the default `ingress` rule to allow all traffic.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Op, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.default_network_acl import DefaultNetworkAcl
+from imports.aws.vpc import Vpc
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        mainvpc = Vpc(self, "mainvpc",
+            cidr_block="10.1.0.0/16"
+        )
+        DefaultNetworkAcl(self, "default",
+            default_network_acl_id=mainvpc.default_network_acl_id,
+            ingress=[DefaultNetworkAclIngress(
+                action="allow",
+                cidr_block=Token.as_string(aws_default_vpc_mainvpc.cidr_block),
+                from_port=0,
+                protocol=Token.as_string(Op.negate(1)),
+                rule_no=100,
+                to_port=0
+            )
+            ]
+        )
+```
+
+### Example: Deny All Traffic To Any Subnet In The Default Network ACL
+
+This config denies all traffic in the Default ACL. This can be useful if you want to lock down the VPC to force all resources to assign a non-default ACL.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.default_network_acl import DefaultNetworkAcl
+from imports.aws.vpc import Vpc
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        mainvpc = Vpc(self, "mainvpc",
+            cidr_block="10.1.0.0/16"
+        )
+        DefaultNetworkAcl(self, "default",
+            default_network_acl_id=mainvpc.default_network_acl_id
+        )
+```
+
+### Managing Subnets In A Default Network ACL
+
+Within a VPC, all Subnets must be associated with a Network ACL. In order to "delete" the association between a Subnet and a non-default Network ACL, the association is destroyed by replacing it with an association between the Subnet and the Default ACL instead.
+
+When managing the Default Network ACL, you cannot "remove" Subnets. Instead, they must be reassigned to another Network ACL, or the Subnet itself must be destroyed. Because of these requirements, removing the `subnet_ids` attribute from the configuration of a `aws_default_network_acl` resource may result in a reoccurring plan, until the Subnets are reassigned to another Network ACL or are destroyed.
+
+Because Subnets are by default associated with the Default Network ACL, any non-explicit association will show up as a plan to remove the Subnet. For example: if you have a custom `aws_network_acl` with two subnets attached, and you remove the `aws_network_acl` resource, after successfully destroying this resource future plans will show a diff on the managed `aws_default_network_acl`, as those two Subnets have been orphaned by the now destroyed network acl and thus adopted by the Default Network ACL. In order to avoid a reoccurring plan, they will need to be reassigned, destroyed, or added to the `subnet_ids` attribute of the `aws_default_network_acl` entry.
+
+As an alternative to the above, you can also specify the following lifecycle configuration in your `aws_default_network_acl` resource:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from cdktf import TerraformResourceLifecycle
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.default_network_acl import DefaultNetworkAcl
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, defaultNetworkAclId):
+        super().__init__(scope, name)
+        DefaultNetworkAcl(self, "default",
+            lifecycle=TerraformResourceLifecycle(
+                ignore_changes=[subnet_ids]
+            ),
+            default_network_acl_id=default_network_acl_id
+        )
+```
+
+### Removing `aws_default_network_acl` From Your Configuration
+
+Each AWS VPC comes with a Default Network ACL that cannot be deleted. The `aws_default_network_acl` allows you to manage this Network ACL, but Terraform cannot destroy it. Removing this resource from your configuration will remove it from your statefile and management, **but will not destroy the Network ACL.** All Subnets associations and ingress or egress rules will be left as they are at the time of removal. You can resume managing them via the AWS Console.
+
+## Argument Reference
+
+The following arguments are required:
+
+* `default_network_acl_id` - (Required) Network ACL ID to manage. This attribute is exported from `aws_vpc`, or manually found via the AWS Console.
+
+The following arguments are optional:
+
+* `egress` - (Optional) Configuration block for an egress rule. Detailed below.
+* `ingress` - (Optional) Configuration block for an ingress rule. Detailed below.
+* `subnet_ids` - (Optional) List of Subnet IDs to apply the ACL to. See the notes above on Managing Subnets in the Default Network ACL
+* `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### egress and ingress
+
+Both the `egress` and `ingress` configuration blocks have the same arguments.
+
+The following arguments are required:
+
+* `action` - (Required) The action to take.
+* `from_port` - (Required) The from port to match.
+* `protocol` - (Required) The protocol to match. If using the -1 'all' protocol, you must specify a from and to port of 0.
+* `rule_no` - (Required) The rule number. Used for ordering.
+* `to_port` - (Required) The to port to match.
+
+The following arguments are optional:
+
+* `cidr_block` - (Optional) The CIDR block to match. This must be a valid network mask.
+* `icmp_code` - (Optional) The ICMP type code to be used. Default 0.
+* `icmp_type` - (Optional) The ICMP type to be used. Default 0.
+* `ipv6_cidr_block` - (Optional) The IPv6 CIDR block.
+
+-> For more information on ICMP types and codes, see [Internet Control Message Protocol (ICMP) Parameters](https://www.iana.org/assignments/icmp-parameters/icmp-parameters.xhtml).
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Default Network ACL
+* `id` - ID of the Default Network ACL
+* `owner_id` - ID of the AWS account that owns the Default Network ACL
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `vpc_id` -  ID of the associated VPC
+
+[aws-network-acls]: http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_ACLs.html
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Default Network ACLs using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Default Network ACLs using the `id`. For example:
+
+```console
+% terraform import aws_default_network_acl.sample acl-7aaabd18
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1ee0cdf2a65fb9b81bf170ed16e018fb9c51a76e5efe0185e333f268f198ed71 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/default_route_table.html.markdown b/website/docs/cdktf/python/r/default_route_table.html.markdown
new file mode 100644
index 00000000000..1171d39aa9f
--- /dev/null
+++ b/website/docs/cdktf/python/r/default_route_table.html.markdown
@@ -0,0 +1,148 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_default_route_table"
+description: |-
+  Provides a resource to manage a default route table of a VPC.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_default_route_table
+
+Provides a resource to manage a default route table of a VPC. This resource can manage the default route table of the default or a non-default VPC.
+
+~> **NOTE:** This is an advanced resource with special caveats. Please read this document in its entirety before using this resource. The `aws_default_route_table` resource behaves differently from normal resources. Terraform does not _create_ this resource but instead attempts to "adopt" it into management. **Do not** use both `aws_default_route_table` to manage a default route table **and** `aws_main_route_table_association` with the same VPC due to possible route conflicts. See [aws_main_route_table_association][tf-main-route-table-association] documentation for more details.
+
+Every VPC has a default route table that can be managed but not destroyed. When Terraform first adopts a default route table, it **immediately removes all defined routes**. It then proceeds to create any routes specified in the configuration. This step is required so that only the routes specified in the configuration exist in the default route table.
+
+For more information, see the Amazon VPC User Guide on [Route Tables](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Route_Tables.html). For information about managing normal route tables in Terraform, see [`aws_route_table`](/docs/providers/aws/r/route_table.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.default_route_table import DefaultRouteTable
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DefaultRouteTable(self, "example",
+            default_route_table_id=Token.as_string(aws_vpc_example.default_route_table_id),
+            route=[DefaultRouteTableRoute(
+                cidr_block="10.0.1.0/24",
+                gateway_id=Token.as_string(aws_internet_gateway_example.id)
+            ), DefaultRouteTableRoute(
+                egress_only_gateway_id=Token.as_string(aws_egress_only_internet_gateway_example.id),
+                ipv6_cidr_block="::/0"
+            )
+            ],
+            tags={
+                "Name": "example"
+            }
+        )
+```
+
+To subsequently remove all managed routes:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.default_route_table import DefaultRouteTable
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DefaultRouteTable(self, "example",
+            default_route_table_id=Token.as_string(aws_vpc_example.default_route_table_id),
+            route=[],
+            tags={
+                "Name": "example"
+            }
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `default_route_table_id` - (Required) ID of the default route table.
+
+The following arguments are optional:
+
+* `propagating_vgws` - (Optional) List of virtual gateways for propagation.
+* `route` - (Optional) Configuration block of routes. Detailed below. This argument is processed in [attribute-as-blocks mode](https://www.terraform.io/docs/configuration/attr-as-blocks.html). This means that omitting this argument is interpreted as ignoring any existing routes. To remove all managed routes an empty list should be specified. See the example above.
+* `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### route
+
+This argument is processed in [attribute-as-blocks mode](https://www.terraform.io/docs/configuration/attr-as-blocks.html).
+
+One of the following destination arguments must be supplied:
+
+* `cidr_block` - (Required) The CIDR block of the route.
+* `ipv6_cidr_block` - (Optional) The Ipv6 CIDR block of the route
+* `destination_prefix_list_id` - (Optional) The ID of a [managed prefix list](ec2_managed_prefix_list.html) destination of the route.
+
+One of the following target arguments must be supplied:
+
+* `core_network_arn` - (Optional) The Amazon Resource Name (ARN) of a core network.
+* `egress_only_gateway_id` - (Optional) Identifier of a VPC Egress Only Internet Gateway.
+* `gateway_id` - (Optional) Identifier of a VPC internet gateway or a virtual private gateway.
+* `instance_id` - (Optional) Identifier of an EC2 instance.
+* `nat_gateway_id` - (Optional) Identifier of a VPC NAT gateway.
+* `network_interface_id` - (Optional) Identifier of an EC2 network interface.
+* `transit_gateway_id` - (Optional) Identifier of an EC2 Transit Gateway.
+* `vpc_endpoint_id` - (Optional) Identifier of a VPC Endpoint. This route must be removed prior to VPC Endpoint deletion.
+* `vpc_peering_connection_id` - (Optional) Identifier of a VPC peering connection.
+
+Note that the default route, mapping the VPC's CIDR block to "local", is created implicitly and cannot be specified.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the route table.
+* `arn` - The ARN of the route table.
+* `owner_id` - ID of the AWS account that owns the route table.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `vpc_id` - ID of the VPC.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `2m`)
+- `update` - (Default `2m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Default VPC route tables using the `vpc_id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Default VPC route tables using the `vpc_id`. For example:
+
+```console
+% terraform import aws_default_route_table.example vpc-33cc44dd
+```
+
+[tf-main-route-table-association]: /docs/providers/aws/r/main_route_table_association.html
+
+<!-- cache-key: cdktf-0.18.0 input-52890b2ce73c129b096972d97be8827bd1630df722976c50bc3863ebadce1093 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/default_security_group.html.markdown b/website/docs/cdktf/python/r/default_security_group.html.markdown
new file mode 100644
index 00000000000..16eb070bc3e
--- /dev/null
+++ b/website/docs/cdktf/python/r/default_security_group.html.markdown
@@ -0,0 +1,155 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_default_security_group"
+description: |-
+  Manage a default security group resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_default_security_group
+
+Provides a resource to manage a default security group. This resource can manage the default security group of the default or a non-default VPC.
+
+~> **NOTE:** This is an advanced resource with special caveats. Please read this document in its entirety before using this resource. The `aws_default_security_group` resource behaves differently from normal resources. Terraform does not _create_ this resource but instead attempts to "adopt" it into management.
+
+When Terraform first begins managing the default security group, it **immediately removes all ingress and egress rules in the Security Group**. It then creates any rules specified in the configuration. This way only the rules specified in the configuration are created.
+
+This resource treats its inline rules as absolute; only the rules defined inline are created, and any additions/removals external to this resource will result in diff shown. For these reasons, this resource is incompatible with the `aws_security_group_rule` resource.
+
+For more information about default security groups, see the AWS documentation on [Default Security Groups][aws-default-security-groups]. To manage normal security groups, see the [`aws_security_group`](/docs/providers/aws/r/security_group.html) resource.
+
+## Example Usage
+
+The following config gives the default security group the same rules that AWS provides by default but under management by Terraform. This means that any ingress or egress rules added or changed will be detected as drift.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Op, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.default_security_group import DefaultSecurityGroup
+from imports.aws.vpc import Vpc
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        mainvpc = Vpc(self, "mainvpc",
+            cidr_block="10.1.0.0/16"
+        )
+        DefaultSecurityGroup(self, "default",
+            egress=[DefaultSecurityGroupEgress(
+                cidr_blocks=["0.0.0.0/0"],
+                from_port=0,
+                protocol="-1",
+                to_port=0
+            )
+            ],
+            ingress=[DefaultSecurityGroupIngress(
+                from_port=0,
+                protocol=Token.as_string(Op.negate(1)),
+                self_attribute=True,
+                to_port=0
+            )
+            ],
+            vpc_id=mainvpc.id
+        )
+```
+
+### Example Config To Deny All Egress Traffic, Allowing Ingress
+
+The following denies all Egress traffic by omitting any `egress` rules, while including the default `ingress` rule to allow all traffic.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Op, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.default_security_group import DefaultSecurityGroup
+from imports.aws.vpc import Vpc
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        mainvpc = Vpc(self, "mainvpc",
+            cidr_block="10.1.0.0/16"
+        )
+        DefaultSecurityGroup(self, "default",
+            ingress=[DefaultSecurityGroupIngress(
+                from_port=0,
+                protocol=Token.as_string(Op.negate(1)),
+                self_attribute=True,
+                to_port=0
+            )
+            ],
+            vpc_id=mainvpc.id
+        )
+```
+
+### Removing `aws_default_security_group` From Your Configuration
+
+Removing this resource from your configuration will remove it from your statefile and management, but will not destroy the Security Group. All ingress or egress rules will be left as they are at the time of removal. You can resume managing them via the AWS Console.
+
+## Argument Reference
+
+The following arguments are optional:
+
+* `egress` - (Optional, VPC only) Configuration block. Detailed below.
+* `ingress` - (Optional) Configuration block. Detailed below.
+* `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `vpc_id` - (Optional, Forces new resource) VPC ID. **Note that changing the `vpc_id` will _not_ restore any default security group rules that were modified, added, or removed.** It will be left in its current state.
+
+### egress and ingress
+
+Both arguments are processed in [attribute-as-blocks mode](https://www.terraform.io/docs/configuration/attr-as-blocks.html).
+
+Both `egress` and `ingress` objects have the same arguments.
+
+* `cidr_blocks` - (Optional) List of CIDR blocks.
+* `description` - (Optional) Description of this rule.
+* `from_port` - (Required) Start port (or ICMP type number if protocol is `icmp`)
+* `ipv6_cidr_blocks` - (Optional) List of IPv6 CIDR blocks.
+* `prefix_list_ids` - (Optional) List of prefix list IDs (for allowing access to VPC endpoints)
+* `protocol` - (Required) Protocol. If you select a protocol of "-1" (semantically equivalent to `all`, which is not a valid value here), you must specify a `from_port` and `to_port` equal to `0`. If not `icmp`, `tcp`, `udp`, or `-1` use the [protocol number](https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml).
+* `security_groups` - (Optional) List of security groups. A group name can be used relative to the default VPC. Otherwise, group ID.
+* `self` - (Optional) Whether the security group itself will be added as a source to this egress rule.
+* `to_port` - (Required) End range port (or ICMP code if protocol is `icmp`).
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the security group.
+* `description` - Description of the security group.
+* `id` - ID of the security group.
+* `name` - Name of the security group.
+* `owner_id` - Owner ID.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+[aws-default-security-groups]: http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-network-security.html#default-security-group
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Security Groups using the security group `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Security Groups using the security group `id`. For example:
+
+```console
+% terraform import aws_default_security_group.default_sg sg-903004f8
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1772c4a79e74a3aeb963e0bbd212a020fc07e8e9c6c1eef173ce3d3d6f84d54b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/default_subnet.html.markdown b/website/docs/cdktf/python/r/default_subnet.html.markdown
new file mode 100644
index 00000000000..d6ffc6a6150
--- /dev/null
+++ b/website/docs/cdktf/python/r/default_subnet.html.markdown
@@ -0,0 +1,83 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_default_subnet"
+description: |-
+  Manage a default subnet resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_default_subnet
+
+Provides a resource to manage a [default subnet](http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/default-vpc.html#default-vpc-basics) in the current region.
+
+**This is an advanced resource** and has special caveats to be aware of when using it. Please read this document in its entirety before using this resource.
+
+The `aws_default_subnet` resource behaves differently from normal resources in that if a default subnet exists in the specified Availability Zone, Terraform does not _create_ this resource, but instead "adopts" it into management.
+If no default subnet exists, Terraform creates a new default subnet.
+By default, `terraform destroy` does not delete the default subnet but does remove the resource from Terraform state.
+Set the `force_destroy` argument to `true` to delete the default subnet.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.default_subnet import DefaultSubnet
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DefaultSubnet(self, "default_az1",
+            availability_zone="us-west-2a",
+            tags={
+                "Name": "Default subnet for us-west-2a"
+            }
+        )
+```
+
+## Argument Reference
+
+The arguments of an `aws_default_subnet` differ slightly from those of [`aws_subnet`](subnet.html):
+
+* `availability_zone` is required
+* The `availability_zone_id`, `cidr_block` and `vpc_id` arguments become computed attributes
+* The default value for `map_public_ip_on_launch` is `true`
+
+This resource supports the following additional arguments:
+
+* `force_destroy` - (Optional) Whether destroying the resource deletes the default subnet. Default: `false`
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `availability_zone_id` - The AZ ID of the subnet
+* `cidr_block` - The IPv4 CIDR block assigned to the subnet
+* `vpc_id` - The ID of the VPC the subnet is in
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import subnets using the subnet `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import subnets using the subnet `id`. For example:
+
+```console
+% terraform import aws_default_subnet.public_subnet subnet-9d4a7b6c
+```
+
+<!-- cache-key: cdktf-0.18.0 input-946ded19323b4288f4f2e72461cc5948a23ea35404090c8cf1614d4381c9ce49 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/default_vpc.html.markdown b/website/docs/cdktf/python/r/default_vpc.html.markdown
new file mode 100644
index 00000000000..e1762eeb8f5
--- /dev/null
+++ b/website/docs/cdktf/python/r/default_vpc.html.markdown
@@ -0,0 +1,85 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_default_vpc"
+description: |-
+  Manage a default VPC resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_default_vpc
+
+Provides a resource to manage the [default AWS VPC](http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/default-vpc.html)
+in the current AWS Region.
+
+If you created your AWS account after 2013-12-04 you have a default VPC in each AWS Region.
+
+**This is an advanced resource** and has special caveats to be aware of when using it. Please read this document in its entirety before using this resource.
+
+The `aws_default_vpc` resource behaves differently from normal resources in that if a default VPC exists, Terraform does not _create_ this resource, but instead "adopts" it into management.
+If no default VPC exists, Terraform creates a new default VPC, which leads to the implicit creation of [other resources](https://docs.aws.amazon.com/vpc/latest/userguide/default-vpc.html#default-vpc-components).
+By default, `terraform destroy` does not delete the default VPC but does remove the resource from Terraform state.
+Set the `force_destroy` argument to `true` to delete the default VPC.
+
+## Example Usage
+
+Basic usage with tags:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.default_vpc import DefaultVpc
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DefaultVpc(self, "default",
+            tags={
+                "Name": "Default VPC"
+            }
+        )
+```
+
+## Argument Reference
+
+The arguments of an `aws_default_vpc` differ slightly from those of [`aws_vpc`](vpc.html):
+
+* The `cidr_block` and `instance_tenancy` arguments become computed attributes
+* The default value for `enable_dns_hostnames` is `true`
+
+This resource supports the following additional arguments:
+
+* `force_destroy` - (Optional) Whether destroying the resource deletes the default VPC. Default: `false`
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `cidr_block` - The primary IPv4 CIDR block for the VPC
+* `instance_tenancy` - The allowed tenancy of instances launched into the VPC
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Default VPCs using the VPC `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Default VPCs using the VPC `id`. For example:
+
+```console
+% terraform import aws_default_vpc.default vpc-a01106c2
+```
+
+<!-- cache-key: cdktf-0.18.0 input-23d964c1dc88c45ec1734d4089d10399fa0b6a694656d6ed659894a9f0b6dd98 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/default_vpc_dhcp_options.html.markdown b/website/docs/cdktf/python/r/default_vpc_dhcp_options.html.markdown
new file mode 100644
index 00000000000..7a04a34ef9c
--- /dev/null
+++ b/website/docs/cdktf/python/r/default_vpc_dhcp_options.html.markdown
@@ -0,0 +1,91 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_default_vpc_dhcp_options"
+description: |-
+  Manage the default VPC DHCP Options resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_default_vpc_dhcp_options
+
+Provides a resource to manage the [default AWS DHCP Options Set](http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_DHCP_Options.html#AmazonDNS)
+in the current region.
+
+Each AWS region comes with a default set of DHCP options.
+**This is an advanced resource**, and has special caveats to be aware of when
+using it. Please read this document in its entirety before using this resource.
+
+The `aws_default_vpc_dhcp_options` behaves differently from normal resources, in that
+Terraform does not _create_ this resource, but instead "adopts" it
+into management.
+
+## Example Usage
+
+Basic usage with tags:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.default_vpc_dhcp_options import DefaultVpcDhcpOptions
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DefaultVpcDhcpOptions(self, "default",
+            tags={
+                "Name": "Default DHCP Option Set"
+            }
+        )
+```
+
+## Argument Reference
+
+The arguments of an `aws_default_vpc_dhcp_options` differ slightly from `aws_vpc_dhcp_options`  resources.
+Namely, the `domain_name`, `domain_name_servers` and `ntp_servers` arguments are computed.
+The following arguments are still supported:
+
+* `netbios_name_servers` - (Optional) List of NETBIOS name servers.
+* `netbios_node_type` - (Optional) The NetBIOS node type (1, 2, 4, or 8). AWS recommends to specify 2 since broadcast and multicast are not supported in their network. For more information about these node types, see [RFC 2132](http://www.ietf.org/rfc/rfc2132.txt).
+* `owner_id` - The ID of the AWS account that owns the DHCP options set.
+* `tags` - (Optional) A map of tags to assign to the resource.
+
+### Removing `aws_default_vpc_dhcp_options` from your configuration
+
+The `aws_default_vpc_dhcp_options` resource allows you to manage a region's default DHCP Options Set,
+but Terraform cannot destroy it. Removing this resource from your configuration
+will remove it from your statefile and management, but will not destroy the DHCP Options Set.
+You can resume managing the DHCP Options Set via the AWS Console.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the DHCP Options Set.
+* `arn` - The ARN of the DHCP Options Set.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import VPC DHCP Options using the DHCP Options `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import VPC DHCP Options using the DHCP Options `id`. For example:
+
+```console
+% terraform import aws_default_vpc_dhcp_options.default_options dopt-d9070ebb
+```
+
+<!-- cache-key: cdktf-0.18.0 input-21aa3abe1b6cf1b9d60f1d171804683cdd303ce6ce4e6aea648ed7c2d5d6b7c2 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/detective_graph.html.markdown b/website/docs/cdktf/python/r/detective_graph.html.markdown
new file mode 100644
index 00000000000..87595f14cbe
--- /dev/null
+++ b/website/docs/cdktf/python/r/detective_graph.html.markdown
@@ -0,0 +1,69 @@
+---
+subcategory: "Detective"
+layout: "aws"
+page_title: "AWS: aws_detective_graph"
+description: |-
+  Provides a resource to manage an Amazon Detective graph.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_detective_graph
+
+Provides a resource to manage an [AWS Detective Graph](https://docs.aws.amazon.com/detective/latest/APIReference/API_CreateGraph.html). As an AWS account may own only one Detective graph per region, provisioning multiple Detective graphs requires a separate provider configuration for each graph.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.detective_graph import DetectiveGraph
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DetectiveGraph(self, "example",
+            tags={
+                "Name": "example-detective-graph"
+            }
+        )
+```
+
+## Argument Reference
+
+The following arguments are optional:
+
+* `tags` -  (Optional) A map of tags to assign to the instance. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - ARN of the Detective Graph.
+* `graph_arn` - ARN of the Detective Graph.
+* `created_time` - Date and time, in UTC and extended RFC 3339 format, when the Amazon Detective Graph was created.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_detective_graph` using the ARN. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_detective_graph` using the ARN. For example:
+
+```console
+% terraform import aws_detective_graph.example arn:aws:detective:us-east-1:123456789101:graph:231684d34gh74g4bae1dbc7bd807d02d
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ee8961bdda24bd4636640d877e7c8cec4877ed2d26e63964d9fab2e0003f440c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/detective_invitation_accepter.html.markdown b/website/docs/cdktf/python/r/detective_invitation_accepter.html.markdown
new file mode 100644
index 00000000000..a98475bb6cc
--- /dev/null
+++ b/website/docs/cdktf/python/r/detective_invitation_accepter.html.markdown
@@ -0,0 +1,78 @@
+---
+subcategory: "Detective"
+layout: "aws"
+page_title: "AWS: aws_detective_invitation_accepter"
+description: |-
+  Provides a resource to manage an Amazon Detective member invitation accepter.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_detective_invitation_accepter
+
+Provides a resource to manage an [Amazon Detective Invitation Accepter](https://docs.aws.amazon.com/detective/latest/APIReference/API_AcceptInvitation.html). Ensure that the accepter is configured to use the AWS account you wish to _accept_ the invitation from the primary graph owner account.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.detective_graph import DetectiveGraph
+from imports.aws.detective_invitation_accepter import DetectiveInvitationAccepter
+from imports.aws.detective_member import DetectiveMember
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        primary = DetectiveGraph(self, "primary")
+        aws_detective_member_primary = DetectiveMember(self, "primary_1",
+            account_id="ACCOUNT ID",
+            email_address="EMAIL",
+            graph_arn=primary.id,
+            message="Message of the invite"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_detective_member_primary.override_logical_id("primary")
+        DetectiveInvitationAccepter(self, "member",
+            depends_on=[aws_detective_member_primary],
+            graph_arn=primary.graph_arn,
+            provider="awsalternate"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `graph_arn` - (Required) ARN of the behavior graph that the member account is accepting the invitation for.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Unique identifier (ID) of the Detective invitation accepter.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_detective_invitation_accepter` using the graph ARN. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_detective_invitation_accepter` using the graph ARN. For example:
+
+```console
+% terraform import aws_detective_invitation_accepter.example arn:aws:detective:us-east-1:123456789101:graph:231684d34gh74g4bae1dbc7bd807d02d
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ca2bf5e5cb9affcfcf860965a82f07a76d1193a82b4cdb53e84a5d10e901c8a0 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/detective_member.html.markdown b/website/docs/cdktf/python/r/detective_member.html.markdown
new file mode 100644
index 00000000000..94a3a1bf5b1
--- /dev/null
+++ b/website/docs/cdktf/python/r/detective_member.html.markdown
@@ -0,0 +1,82 @@
+---
+subcategory: "Detective"
+layout: "aws"
+page_title: "AWS: aws_detective_member"
+description: |-
+  Provides a resource to manage an Amazon Detective member.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_detective_member
+
+Provides a resource to manage an [Amazon Detective Member](https://docs.aws.amazon.com/detective/latest/APIReference/API_CreateMembers.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.detective_graph import DetectiveGraph
+from imports.aws.detective_member import DetectiveMember
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = DetectiveGraph(self, "example")
+        aws_detective_member_example = DetectiveMember(self, "example_1",
+            account_id="AWS ACCOUNT ID",
+            disable_email_notification=True,
+            email_address="EMAIL",
+            graph_arn=example.id,
+            message="Message of the invitation"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_detective_member_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `account_id` - (Required) AWS account ID for the account.
+* `email_address` - (Required) Email address for the account.
+* `graph_arn` - (Required) ARN of the behavior graph to invite the member accounts to contribute their data to.
+* `message` - (Optional) A custom message to include in the invitation. Amazon Detective adds this message to the standard content that it sends for an invitation.
+* `disable_email_notification` - (Optional) If set to true, then the root user of the invited account will _not_ receive an email notification. This notification is in addition to an alert that the root user receives in AWS Personal Health Dashboard. By default, this is set to `false`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Unique identifier (ID) of the Detective.
+* `status` - Current membership status of the member account.
+* `administrator_id` - AWS account ID for the administrator account.
+* `volume_usage_in_bytes` - Data volume in bytes per day for the member account.
+* `invited_time` - Date and time, in UTC and extended RFC 3339 format, when an Amazon Detective membership invitation was last sent to the account.
+* `updated_time` - Date and time, in UTC and extended RFC 3339 format, of the most recent change to the member account's status.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_detective_member` using the ARN of the graph followed by the account ID of the member account. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_detective_member` using the ARN of the graph followed by the account ID of the member account. For example:
+
+```console
+% terraform import aws_detective_member.example arn:aws:detective:us-east-1:123456789101:graph:231684d34gh74g4bae1dbc7bd807d02d/123456789012
+```
+
+<!-- cache-key: cdktf-0.18.0 input-4108f05240e0c0f62d7dfe1e0039f5231d9901dad3b7104a04e9f1121a124644 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/devicefarm_device_pool.html.markdown b/website/docs/cdktf/python/r/devicefarm_device_pool.html.markdown
new file mode 100644
index 00000000000..8f575a50be2
--- /dev/null
+++ b/website/docs/cdktf/python/r/devicefarm_device_pool.html.markdown
@@ -0,0 +1,82 @@
+---
+subcategory: "Device Farm"
+layout: "aws"
+page_title: "AWS: aws_devicefarm_device_pool"
+description: |-
+  Provides a Devicefarm device_pool
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_devicefarm_device_pool
+
+Provides a resource to manage AWS Device Farm Device Pools.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.devicefarm_device_pool import DevicefarmDevicePool
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DevicefarmDevicePool(self, "example",
+            name="example",
+            project_arn=Token.as_string(aws_devicefarm_project_example.arn),
+            rule=[DevicefarmDevicePoolRule(
+                attribute="OS_VERSION",
+                operator="EQUALS",
+                value="\\\"AVAILABLE\\\""
+            )
+            ]
+        )
+```
+
+## Argument Reference
+
+* `name` - (Required) The name of the Device Pool
+* `project_arn` - (Required) The ARN of the project for the device pool.
+* `rule` - (Required) The device pool's rules. See [Rule](#rule).
+* `description` - (Optional) The device pool's description.
+* `max_devices` - (Optional) The number of devices that Device Farm can add to your device pool.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Rule
+
+* `attribute` - (Optional) The rule's stringified attribute. Valid values are: `APPIUM_VERSION`, `ARN`, `AVAILABILITY`, `FLEET_TYPE`, `FORM_FACTOR`, `INSTANCE_ARN`, `INSTANCE_LABELS`, `MANUFACTURER`, `MODEL`, `OS_VERSION`, `PLATFORM`, `REMOTE_ACCESS_ENABLED`, `REMOTE_DEBUG_ENABLED`.
+* `operator` - (Optional) Specifies how Device Farm compares the rule's attribute to the value. For the operators that are supported by each attribute. Valid values are: `EQUALS`, `NOT_IN`, `IN`, `GREATER_THAN`, `GREATER_THAN_OR_EQUALS`, `LESS_THAN`, `LESS_THAN_OR_EQUALS`, `CONTAINS`.
+* `value` - (Optional) The rule's value.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name of this Device Pool
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DeviceFarm Device Pools using their ARN. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import DeviceFarm Device Pools using their ARN. For example:
+
+```console
+% terraform import aws_devicefarm_device_pool.example arn:aws:devicefarm:us-west-2:123456789012:devicepool:4fa784c7-ccb4-4dbf-ba4f-02198320daa1/4fa784c7-ccb4-4dbf-ba4f-02198320daa1
+```
+
+<!-- cache-key: cdktf-0.18.0 input-70dc4ff5fd779dddf25798da293a38ce0cbfa6d4a0332256582b1806152f2230 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/devicefarm_instance_profile.html.markdown b/website/docs/cdktf/python/r/devicefarm_instance_profile.html.markdown
new file mode 100644
index 00000000000..0d817be4c0e
--- /dev/null
+++ b/website/docs/cdktf/python/r/devicefarm_instance_profile.html.markdown
@@ -0,0 +1,71 @@
+---
+subcategory: "Device Farm"
+layout: "aws"
+page_title: "AWS: aws_devicefarm_instance_profile"
+description: |-
+  Provides a Devicefarm instance profile
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_devicefarm_instance_profile
+
+Provides a resource to manage AWS Device Farm Instance Profiles.
+∂
+~> **NOTE:** AWS currently has limited regional support for Device Farm (e.g., `us-west-2`). See [AWS Device Farm endpoints and quotas](https://docs.aws.amazon.com/general/latest/gr/devicefarm.html) for information on supported regions.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.devicefarm_instance_profile import DevicefarmInstanceProfile
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DevicefarmInstanceProfile(self, "example",
+            name="example"
+        )
+```
+
+## Argument Reference
+
+* `description` - (Optional) The description of the instance profile.
+* `exclude_app_packages_from_cleanup` - (Optional) An array of strings that specifies the list of app packages that should not be cleaned up from the device after a test run.
+* `name` - (Required) The name for the instance profile.
+* `package_cleanup` - (Optional) When set to `true`, Device Farm removes app packages after a test run. The default value is `false` for private devices.
+* `reboot_after_use` - (Optional) When set to `true`, Device Farm reboots the instance after a test run. The default value is `true`.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name of this instance profile.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DeviceFarm Instance Profiles using their ARN. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import DeviceFarm Instance Profiles using their ARN. For example:
+
+```console
+% terraform import aws_devicefarm_instance_profile.example arn:aws:devicefarm:us-west-2:123456789012:instanceprofile:4fa784c7-ccb4-4dbf-ba4f-02198320daa1
+```
+
+<!-- cache-key: cdktf-0.18.0 input-869291a59b04d3cacb00462dab45e1d4434b9d843a3070738a3d718940fb202b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/devicefarm_network_profile.html.markdown b/website/docs/cdktf/python/r/devicefarm_network_profile.html.markdown
new file mode 100644
index 00000000000..18342ebbef6
--- /dev/null
+++ b/website/docs/cdktf/python/r/devicefarm_network_profile.html.markdown
@@ -0,0 +1,85 @@
+---
+subcategory: "Device Farm"
+layout: "aws"
+page_title: "AWS: aws_devicefarm_network_profile"
+description: |-
+  Provides a Devicefarm network profile
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_devicefarm_network_profile
+
+Provides a resource to manage AWS Device Farm Network Profiles.
+∂
+~> **NOTE:** AWS currently has limited regional support for Device Farm (e.g., `us-west-2`). See [AWS Device Farm endpoints and quotas](https://docs.aws.amazon.com/general/latest/gr/devicefarm.html) for information on supported regions.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.devicefarm_network_profile import DevicefarmNetworkProfile
+from imports.aws.devicefarm_project import DevicefarmProject
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = DevicefarmProject(self, "example",
+            name="example"
+        )
+        aws_devicefarm_network_profile_example = DevicefarmNetworkProfile(self, "example_1",
+            name="example",
+            project_arn=example.arn
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_devicefarm_network_profile_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+* `description` - (Optional) The description of the network profile.
+* `downlink_bandwidth_bits` - (Optional) The data throughput rate in bits per second, as an integer from `0` to `104857600`. Default value is `104857600`.
+* `downlink_delay_ms` - (Optional) Delay time for all packets to destination in milliseconds as an integer from `0` to `2000`.
+* `downlink_jitter_ms` - (Optional) Time variation in the delay of received packets in milliseconds as an integer from `0` to `2000`.
+* `downlink_loss_percent` - (Optional) Proportion of received packets that fail to arrive from `0` to `100` percent.
+* `name` - (Required) The name for the network profile.
+* `uplink_bandwidth_bits` - (Optional) The data throughput rate in bits per second, as an integer from `0` to `104857600`. Default value is `104857600`.
+* `uplink_delay_ms` - (Optional) Delay time for all packets to destination in milliseconds as an integer from `0` to `2000`.
+* `uplink_jitter_ms` - (Optional) Time variation in the delay of received packets in milliseconds as an integer from `0` to `2000`.
+* `uplink_loss_percent` - (Optional) Proportion of received packets that fail to arrive from `0` to `100` percent.
+* `project_arn` - (Required) The ARN of the project for the network profile.
+* `type` - (Optional) The type of network profile to create. Valid values are listed are `PRIVATE` and `CURATED`.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name of this network profile.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DeviceFarm Network Profiles using their ARN. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import DeviceFarm Network Profiles using their ARN. For example:
+
+```console
+% terraform import aws_devicefarm_network_profile.example arn:aws:devicefarm:us-west-2:123456789012:networkprofile:4fa784c7-ccb4-4dbf-ba4f-02198320daa1
+```
+
+<!-- cache-key: cdktf-0.18.0 input-82616cb48039f8368ead9b616e986d34cc6658f5bc299c003c202bc94e665131 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/devicefarm_project.html.markdown b/website/docs/cdktf/python/r/devicefarm_project.html.markdown
new file mode 100644
index 00000000000..4c5c3508d14
--- /dev/null
+++ b/website/docs/cdktf/python/r/devicefarm_project.html.markdown
@@ -0,0 +1,73 @@
+---
+subcategory: "Device Farm"
+layout: "aws"
+page_title: "AWS: aws_devicefarm_project"
+description: |-
+  Provides a Devicefarm project
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_devicefarm_project
+
+Provides a resource to manage AWS Device Farm Projects.
+
+For more information about Device Farm Projects, see the AWS Documentation on
+[Device Farm Projects][aws-get-project].
+
+~> **NOTE:** AWS currently has limited regional support for Device Farm (e.g., `us-west-2`). See [AWS Device Farm endpoints and quotas](https://docs.aws.amazon.com/general/latest/gr/devicefarm.html) for information on supported regions.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.devicefarm_project import DevicefarmProject
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DevicefarmProject(self, "awesome_devices",
+            name="my-device-farm"
+        )
+```
+
+## Argument Reference
+
+* `name` - (Required) The name of the project
+* `default_job_timeout_minutes` - (Optional) Sets the execution timeout value (in minutes) for a project. All test runs in this project use the specified execution timeout value unless overridden when scheduling a run.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name of this project
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+[aws-get-project]: http://docs.aws.amazon.com/devicefarm/latest/APIReference/API_GetProject.html
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DeviceFarm Projects using their ARN. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import DeviceFarm Projects using their ARN. For example:
+
+```console
+% terraform import aws_devicefarm_project.example arn:aws:devicefarm:us-west-2:123456789012:project:4fa784c7-ccb4-4dbf-ba4f-02198320daa1
+```
+
+<!-- cache-key: cdktf-0.18.0 input-fea501aea933ca5c661b1980e1f92d94c086b5241762d0510490c8478e31499d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/devicefarm_test_grid_project.html.markdown b/website/docs/cdktf/python/r/devicefarm_test_grid_project.html.markdown
new file mode 100644
index 00000000000..9c28ed62809
--- /dev/null
+++ b/website/docs/cdktf/python/r/devicefarm_test_grid_project.html.markdown
@@ -0,0 +1,81 @@
+---
+subcategory: "Device Farm"
+layout: "aws"
+page_title: "AWS: aws_devicefarm_test_grid_project"
+description: |-
+  Provides a Devicefarm test_grid_project
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_devicefarm_test_grid_project
+
+Provides a resource to manage AWS Device Farm Test Grid Projects.
+
+~> **NOTE:** AWS currently has limited regional support for Device Farm (e.g., `us-west-2`). See [AWS Device Farm endpoints and quotas](https://docs.aws.amazon.com/general/latest/gr/devicefarm.html) for information on supported regions.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.devicefarm_test_grid_project import DevicefarmTestGridProject
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DevicefarmTestGridProject(self, "example",
+            name="example",
+            vpc_config=DevicefarmTestGridProjectVpcConfig(
+                security_group_ids=Token.as_list(
+                    Fn.lookup_nested(aws_security_group_example, ["*", "id"])),
+                subnet_ids=Token.as_list(Fn.lookup_nested(aws_subnet_example, ["*", "id"])),
+                vpc_id=Token.as_string(aws_vpc_example.id)
+            )
+        )
+```
+
+## Argument Reference
+
+* `name` - (Required) The name of the Selenium testing project.
+* `description` - (Optional) Human-readable description of the project.
+* `vpc_config` - (Required) The VPC security groups and subnets that are attached to a project. See [VPC Config](#vpc-config) below.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### VPC Config
+
+* `security_group_ids` - (Required) A list of VPC security group IDs in your Amazon VPC.
+* `subnet_ids` - (Required) A list of VPC subnet IDs in your Amazon VPC.
+* `vpc_id` - (Required) The ID of the Amazon VPC.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name of this Test Grid Project.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DeviceFarm Test Grid Projects using their ARN. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import DeviceFarm Test Grid Projects using their ARN. For example:
+
+```console
+% terraform import aws_devicefarm_test_grid_project.example arn:aws:devicefarm:us-west-2:123456789012:testgrid-project:4fa784c7-ccb4-4dbf-ba4f-02198320daa1
+```
+
+<!-- cache-key: cdktf-0.18.0 input-2f5eb3ada6471cdbf41632a80ae508f4c526e15908f83a9d3ac70cb7c05f37b2 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/devicefarm_upload.html.markdown b/website/docs/cdktf/python/r/devicefarm_upload.html.markdown
new file mode 100644
index 00000000000..3e20815e0ef
--- /dev/null
+++ b/website/docs/cdktf/python/r/devicefarm_upload.html.markdown
@@ -0,0 +1,79 @@
+---
+subcategory: "Device Farm"
+layout: "aws"
+page_title: "AWS: aws_devicefarm_upload"
+description: |-
+  Provides a Devicefarm upload
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_devicefarm_upload
+
+Provides a resource to manage AWS Device Farm Uploads.
+
+~> **NOTE:** AWS currently has limited regional support for Device Farm (e.g., `us-west-2`). See [AWS Device Farm endpoints and quotas](https://docs.aws.amazon.com/general/latest/gr/devicefarm.html) for information on supported regions.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.devicefarm_project import DevicefarmProject
+from imports.aws.devicefarm_upload import DevicefarmUpload
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = DevicefarmProject(self, "example",
+            name="example"
+        )
+        aws_devicefarm_upload_example = DevicefarmUpload(self, "example_1",
+            name="example",
+            project_arn=example.arn,
+            type="APPIUM_JAVA_TESTNG_TEST_SPEC"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_devicefarm_upload_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+* `content_type` - (Optional) The upload's content type (for example, application/octet-stream).
+* `name` - (Required) The upload's file name. The name should not contain any forward slashes (/). If you are uploading an iOS app, the file name must end with the .ipa extension. If you are uploading an Android app, the file name must end with the .apk extension. For all others, the file name must end with the .zip file extension.
+* `project_arn` - (Required) The ARN of the project for the upload.
+* `type` - (Required) The upload's upload type. See [AWS Docs](https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_CreateUpload.html#API_CreateUpload_RequestSyntax) for valid list of values.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name of this upload.
+* `url` - The presigned Amazon S3 URL that was used to store a file using a PUT request.
+* `category` - The upload's category.
+* `metadata` - The upload's metadata. For example, for Android, this contains information that is parsed from the manifest and is displayed in the AWS Device Farm console after the associated app is uploaded.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DeviceFarm Uploads using their ARN. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import DeviceFarm Uploads using their ARN. For example:
+
+```console
+% terraform import aws_devicefarm_upload.example arn:aws:devicefarm:us-west-2:123456789012:upload:4fa784c7-ccb4-4dbf-ba4f-02198320daa1
+```
+
+<!-- cache-key: cdktf-0.18.0 input-157c6a3834c0d5903b438d5bff03780c3535132f31f3df5b70aed301ac010dfd -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/directory_service_conditional_forwarder.html.markdown b/website/docs/cdktf/python/r/directory_service_conditional_forwarder.html.markdown
new file mode 100644
index 00000000000..57b1f6cd89c
--- /dev/null
+++ b/website/docs/cdktf/python/r/directory_service_conditional_forwarder.html.markdown
@@ -0,0 +1,67 @@
+---
+subcategory: "Directory Service"
+layout: "aws"
+page_title: "AWS: aws_directory_service_conditional_forwarder"
+description: |-
+  Provides a conditional forwarder for managed Microsoft AD in AWS Directory Service.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_directory_service_conditional_forwarder
+
+Provides a conditional forwarder for managed Microsoft AD in AWS Directory Service.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.directory_service_conditional_forwarder import DirectoryServiceConditionalForwarder
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DirectoryServiceConditionalForwarder(self, "example",
+            directory_id=ad.id,
+            dns_ips=["8.8.8.8", "8.8.4.4"],
+            remote_domain_name="example.com"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `directory_id` - (Required) ID of directory.
+* `dns_ips` - (Required) A list of forwarder IP addresses.
+* `remote_domain_name` - (Required) The fully qualified domain name of the remote domain for which forwarders will be used.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import conditional forwarders using the directory id and remote_domain_name. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import conditional forwarders using the directory id and remote_domain_name. For example:
+
+```console
+% terraform import aws_directory_service_conditional_forwarder.example d-1234567890:example.com
+```
+
+<!-- cache-key: cdktf-0.18.0 input-6c5202e2bda00c02157b7a412c0e460a4f86c81c2eec1650454ecd36ded52d0d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/directory_service_directory.html.markdown b/website/docs/cdktf/python/r/directory_service_directory.html.markdown
new file mode 100644
index 00000000000..97251ad57e3
--- /dev/null
+++ b/website/docs/cdktf/python/r/directory_service_directory.html.markdown
@@ -0,0 +1,225 @@
+---
+subcategory: "Directory Service"
+layout: "aws"
+page_title: "AWS: aws_directory_service_directory"
+description: |-
+  Provides a directory in AWS Directory Service.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_directory_service_directory
+
+Provides a Simple or Managed Microsoft directory in AWS Directory Service.
+
+~> **Note:** All arguments including the password and customer username will be stored in the raw state as plain-text.
+[Read more about sensitive data in state](https://www.terraform.io/docs/state/sensitive-data.html).
+
+## Example Usage
+
+### SimpleAD
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.directory_service_directory import DirectoryServiceDirectory
+from imports.aws.subnet import Subnet
+from imports.aws.vpc import Vpc
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        main = Vpc(self, "main",
+            cidr_block="10.0.0.0/16"
+        )
+        bar = Subnet(self, "bar",
+            availability_zone="us-west-2b",
+            cidr_block="10.0.2.0/24",
+            vpc_id=main.id
+        )
+        foo = Subnet(self, "foo",
+            availability_zone="us-west-2a",
+            cidr_block="10.0.1.0/24",
+            vpc_id=main.id
+        )
+        aws_directory_service_directory_bar = DirectoryServiceDirectory(self, "bar_3",
+            name="corp.notexample.com",
+            password="SuperSecretPassw0rd",
+            size="Small",
+            tags={
+                "Project": "foo"
+            },
+            vpc_settings=DirectoryServiceDirectoryVpcSettings(
+                subnet_ids=[foo.id, bar.id],
+                vpc_id=main.id
+            )
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_directory_service_directory_bar.override_logical_id("bar")
+```
+
+### Microsoft Active Directory (MicrosoftAD)
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.directory_service_directory import DirectoryServiceDirectory
+from imports.aws.subnet import Subnet
+from imports.aws.vpc import Vpc
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        main = Vpc(self, "main",
+            cidr_block="10.0.0.0/16"
+        )
+        bar = Subnet(self, "bar",
+            availability_zone="us-west-2b",
+            cidr_block="10.0.2.0/24",
+            vpc_id=main.id
+        )
+        foo = Subnet(self, "foo",
+            availability_zone="us-west-2a",
+            cidr_block="10.0.1.0/24",
+            vpc_id=main.id
+        )
+        aws_directory_service_directory_bar = DirectoryServiceDirectory(self, "bar_3",
+            edition="Standard",
+            name="corp.notexample.com",
+            password="SuperSecretPassw0rd",
+            tags={
+                "Project": "foo"
+            },
+            type="MicrosoftAD",
+            vpc_settings=DirectoryServiceDirectoryVpcSettings(
+                subnet_ids=[foo.id, bar.id],
+                vpc_id=main.id
+            )
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_directory_service_directory_bar.override_logical_id("bar")
+```
+
+### Microsoft Active Directory Connector (ADConnector)
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.directory_service_directory import DirectoryServiceDirectory
+from imports.aws.subnet import Subnet
+from imports.aws.vpc import Vpc
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        main = Vpc(self, "main",
+            cidr_block="10.0.0.0/16"
+        )
+        bar = Subnet(self, "bar",
+            availability_zone="us-west-2b",
+            cidr_block="10.0.2.0/24",
+            vpc_id=main.id
+        )
+        foo = Subnet(self, "foo",
+            availability_zone="us-west-2a",
+            cidr_block="10.0.1.0/24",
+            vpc_id=main.id
+        )
+        DirectoryServiceDirectory(self, "connector",
+            connect_settings=DirectoryServiceDirectoryConnectSettings(
+                customer_dns_ips=["A.B.C.D"],
+                customer_username="Admin",
+                subnet_ids=[foo.id, bar.id],
+                vpc_id=main.id
+            ),
+            name="corp.notexample.com",
+            password="SuperSecretPassw0rd",
+            size="Small",
+            type="ADConnector"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The fully qualified name for the directory, such as `corp.example.com`
+* `password` - (Required) The password for the directory administrator or connector user.
+* `size` - (Optional) (For `SimpleAD` and `ADConnector` types) The size of the directory (`Small` or `Large` are accepted values). `Large` by default.
+* `vpc_settings` - (Required for `SimpleAD` and `MicrosoftAD`) VPC related information about the directory. Fields documented below.
+* `connect_settings` - (Required for `ADConnector`) Connector related information about the directory. Fields documented below.
+* `alias` - (Optional) The alias for the directory (must be unique amongst all aliases in AWS). Required for `enable_sso`.
+* `description` - (Optional) A textual description for the directory.
+* `desired_number_of_domain_controllers` - (Optional) The number of domain controllers desired in the directory. Minimum value of `2`. Scaling of domain controllers is only supported for `MicrosoftAD` directories.
+* `short_name` - (Optional) The short name of the directory, such as `CORP`.
+* `enable_sso` - (Optional) Whether to enable single-sign on for the directory. Requires `alias`. Defaults to `false`.
+* `type` (Optional) - The directory type (`SimpleAD`, `ADConnector` or `MicrosoftAD` are accepted values). Defaults to `SimpleAD`.
+* `edition` - (Optional, for type `MicrosoftAD` only) The MicrosoftAD edition (`Standard` or `Enterprise`). Defaults to `Enterprise`.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+**vpc_settings** supports the following:
+
+* `subnet_ids` - (Required) The identifiers of the subnets for the directory servers (2 subnets in 2 different AZs).
+* `vpc_id` - (Required) The identifier of the VPC that the directory is in.
+
+**connect_settings** supports the following:
+
+* `customer_username` - (Required) The username corresponding to the password provided.
+* `customer_dns_ips` - (Required) The DNS IP addresses of the domain to connect to.
+* `subnet_ids` - (Required) The identifiers of the subnets for the directory servers (2 subnets in 2 different AZs).
+* `vpc_id` - (Required) The identifier of the VPC that the directory is in.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The directory identifier.
+* `access_url` - The access URL for the directory, such as `http://alias.awsapps.com`.
+* `dns_ip_addresses` - A list of IP addresses of the DNS servers for the directory or connector.
+* `security_group_id` - The ID of the security group created by the directory.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+`connect_settings` (for `ADConnector`) is also exported with the following attributes:
+
+* `connect_ips` - The IP addresses of the AD Connector servers.
+
+## Timeouts
+
+`aws_directory_service_directory` provides the following [Timeouts](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts) configuration options:
+
+- `create` - (Default `60 minutes`) Used for directory creation
+- `update` - (Default `60 minutes`) Used for directory update
+- `delete` - (Default `60 minutes`) Used for directory deletion
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DirectoryService directories using the directory `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import DirectoryService directories using the directory `id`. For example:
+
+```console
+% terraform import aws_directory_service_directory.sample d-926724cf57
+```
+
+<!-- cache-key: cdktf-0.18.0 input-49c24dcd4cf67951f7f5fa46955d3c67849291a777e1963a25110967098be86d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/directory_service_log_subscription.html.markdown b/website/docs/cdktf/python/r/directory_service_log_subscription.html.markdown
new file mode 100644
index 00000000000..63fc0e0f80d
--- /dev/null
+++ b/website/docs/cdktf/python/r/directory_service_log_subscription.html.markdown
@@ -0,0 +1,95 @@
+---
+subcategory: "Directory Service"
+layout: "aws"
+page_title: "AWS: aws_directory_service_log_subscription"
+description: |-
+  Provides a Log subscription for AWS Directory Service that pushes logs to cloudwatch.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_directory_service_log_subscription
+
+Provides a Log subscription for AWS Directory Service that pushes logs to cloudwatch.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudwatch_log_group import CloudwatchLogGroup
+from imports.aws.cloudwatch_log_resource_policy import CloudwatchLogResourcePolicy
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.directory_service_log_subscription import DirectoryServiceLogSubscription
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = CloudwatchLogGroup(self, "example",
+            name="/aws/directoryservice/${" + aws_directory_service_directory_example.id + "}",
+            retention_in_days=14
+        )
+        aws_directory_service_log_subscription_example =
+        DirectoryServiceLogSubscription(self, "example_1",
+            directory_id=Token.as_string(aws_directory_service_directory_example.id),
+            log_group_name=example.name
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_directory_service_log_subscription_example.override_logical_id("example")
+        ad_log_policy = DataAwsIamPolicyDocument(self, "ad-log-policy",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["logs:CreateLogStream", "logs:PutLogEvents"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["ds.amazonaws.com"],
+                    type="Service"
+                )
+                ],
+                resources=["${" + example.arn + "}:*"]
+            )
+            ]
+        )
+        aws_cloudwatch_log_resource_policy_ad_log_policy =
+        CloudwatchLogResourcePolicy(self, "ad-log-policy_3",
+            policy_document=Token.as_string(ad_log_policy.json),
+            policy_name="ad-log-policy"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_cloudwatch_log_resource_policy_ad_log_policy.override_logical_id("ad-log-policy")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `directory_id` - (Required) ID of directory.
+* `log_group_name` - (Required) Name of the cloudwatch log group to which the logs should be published. The log group should be already created and the directory service principal should be provided with required permission to create stream and publish logs. Changing this value would delete the current subscription and create a new one. A directory can only have one log subscription at a time.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Directory Service Log Subscriptions using the directory id. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Directory Service Log Subscriptions using the directory id. For example:
+
+```console
+% terraform import aws_directory_service_log_subscription.msad d-1234567890
+```
+
+<!-- cache-key: cdktf-0.18.0 input-4c454e09cdbbcc5b15311701235bc1776950d5a3aac1b39f531b202fbb8a7072 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/directory_service_radius_settings.html.markdown b/website/docs/cdktf/python/r/directory_service_radius_settings.html.markdown
new file mode 100644
index 00000000000..fd609af5795
--- /dev/null
+++ b/website/docs/cdktf/python/r/directory_service_radius_settings.html.markdown
@@ -0,0 +1,87 @@
+---
+subcategory: "Directory Service"
+layout: "aws"
+page_title: "AWS: aws_directory_service_radius_settings"
+description: |-
+  Manages a directory's multi-factor authentication (MFA) using a Remote Authentication Dial In User Service (RADIUS) server.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_directory_service_radius_settings
+
+Manages a directory's multi-factor authentication (MFA) using a Remote Authentication Dial In User Service (RADIUS) server.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.directory_service_radius_settings import DirectoryServiceRadiusSettings
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DirectoryServiceRadiusSettings(self, "example",
+            authentication_protocol="PAP",
+            directory_id=Token.as_string(aws_directory_service_directory_example.id),
+            display_label="example",
+            radius_port=1812,
+            radius_retries=4,
+            radius_servers=["10.0.1.5"],
+            radius_timeout=1,
+            shared_secret="12345678"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `authentication_protocol` - (Optional) The protocol specified for your RADIUS endpoints. Valid values: `PAP`, `CHAP`, `MS-CHAPv1`, `MS-CHAPv2`.
+* `directory_id` - (Required) The identifier of the directory for which you want to manager RADIUS settings.
+* `display_label` - (Required) Display label.
+* `radius_port` - (Required) The port that your RADIUS server is using for communications. Your self-managed network must allow inbound traffic over this port from the AWS Directory Service servers.
+* `radius_retries` - (Required) The maximum number of times that communication with the RADIUS server is attempted. Minimum value of `0`. Maximum value of `10`.
+* `radius_servers` - (Required) An array of strings that contains the fully qualified domain name (FQDN) or IP addresses of the RADIUS server endpoints, or the FQDN or IP addresses of your RADIUS server load balancer.
+* `radius_timeout` - (Required) The amount of time, in seconds, to wait for the RADIUS server to respond. Minimum value of `1`. Maximum value of `50`.
+* `shared_secret` - (Required) Required for enabling RADIUS on the directory.
+* `use_same_username` - (Optional) Not currently used.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The directory identifier.
+
+## Timeouts
+
+`aws_directory_service_radius_settings` provides the following [Timeouts](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts) configuration options:
+
+- `create` - (Default `30 minutes`) Used for RADIUS settings creation
+- `update` - (Default `30 minutes`) Used for RADIUS settings update
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import RADIUS settings using the directory ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import RADIUS settings using the directory ID. For example:
+
+```console
+% terraform import aws_directory_service_radius_settings.example d-926724cf57
+```
+
+<!-- cache-key: cdktf-0.18.0 input-120cead939815417bd9577d93de9c412838e216cb9e55a21bc6d0f08acbd6ddc -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/directory_service_region.html.markdown b/website/docs/cdktf/python/r/directory_service_region.html.markdown
new file mode 100644
index 00000000000..3b4d8a63d42
--- /dev/null
+++ b/website/docs/cdktf/python/r/directory_service_region.html.markdown
@@ -0,0 +1,192 @@
+---
+subcategory: "Directory Service"
+layout: "aws"
+page_title: "AWS: aws_directory_service_region"
+description: |-
+    Manages a replicated Region and directory for Multi-Region replication.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_directory_service_region
+
+Manages a replicated Region and directory for Multi-Region replication.
+Multi-Region replication is only supported for the Enterprise Edition of AWS Managed Microsoft AD.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformCount, Fn, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_availability_zones import DataAwsAvailabilityZones
+from imports.aws.data_aws_region import DataAwsRegion
+from imports.aws.directory_service_directory import DirectoryServiceDirectory
+from imports.aws.directory_service_region import DirectoryServiceRegion
+from imports.aws.provider import AwsProvider
+from imports.aws.subnet import Subnet
+from imports.aws.vpc import Vpc
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AwsProvider(self, "aws",
+            region="us-west-2"
+        )
+        secondary = AwsProvider(self, "aws_1",
+            alias="secondary",
+            region="us-east-2"
+        )
+        example = Vpc(self, "example",
+            cidr_block="10.0.0.0/16",
+            tags={
+                "Name": "Primary"
+            }
+        )
+        example_secondary = Vpc(self, "example-secondary",
+            cidr_block="10.1.0.0/16",
+            provider=secondary,
+            tags={
+                "Name": "Secondary"
+            }
+        )
+        available = DataAwsAvailabilityZones(self, "available",
+            filter=[DataAwsAvailabilityZonesFilter(
+                name="opt-in-status",
+                values=["opt-in-not-required"]
+            )
+            ],
+            state="available"
+        )
+        available_secondary = DataAwsAvailabilityZones(self, "available-secondary",
+            filter=[DataAwsAvailabilityZonesFilter(
+                name="opt-in-status",
+                values=["opt-in-not-required"]
+            )
+            ],
+            provider=secondary,
+            state="available"
+        )
+        data_aws_region_example = DataAwsRegion(self, "example_6",
+            provider=secondary
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_region_example.override_logical_id("example")
+        # In most cases loops should be handled in the programming language context and
+        #     not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+        #     you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+        #     you need to keep this like it is.
+        example_count = TerraformCount.of(Token.as_number("2"))
+        aws_subnet_example = Subnet(self, "example_7",
+            availability_zone=Token.as_string(
+                Fn.lookup_nested(available.names, [example_count.index])),
+            cidr_block=Token.as_string(
+                Fn.cidrsubnet(example.cidr_block, 8, Token.as_number(example_count.index))),
+            tags={
+                "Name": "Primary"
+            },
+            vpc_id=example.id,
+            count=example_count
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_subnet_example.override_logical_id("example")
+        # In most cases loops should be handled in the programming language context and
+        #     not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+        #     you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+        #     you need to keep this like it is.
+        example_secondary_count = TerraformCount.of(Token.as_number("2"))
+        aws_subnet_example_secondary = Subnet(self, "example-secondary_8",
+            availability_zone=Token.as_string(
+                Fn.lookup_nested(available_secondary.names, [example_secondary_count.index])),
+            cidr_block=Token.as_string(
+                Fn.cidrsubnet(example_secondary.cidr_block, 8,
+                    Token.as_number(example_secondary_count.index))),
+            provider=secondary,
+            tags={
+                "Name": "Secondary"
+            },
+            vpc_id=example_secondary.id,
+            count=example_secondary_count
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_subnet_example_secondary.override_logical_id("example-secondary")
+        aws_directory_service_directory_example = DirectoryServiceDirectory(self, "example_9",
+            name="example.com",
+            password="SuperSecretPassw0rd",
+            type="MicrosoftAD",
+            vpc_settings=DirectoryServiceDirectoryVpcSettings(
+                subnet_ids=Token.as_list(
+                    Fn.lookup_nested(aws_subnet_example, ["*", "id"])),
+                vpc_id=example.id
+            )
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_directory_service_directory_example.override_logical_id("example")
+        aws_directory_service_region_example = DirectoryServiceRegion(self, "example_10",
+            directory_id=Token.as_string(aws_directory_service_directory_example.id),
+            region_name=Token.as_string(data_aws_region_example.name),
+            tags={
+                "Name": "Secondary"
+            },
+            vpc_settings=DirectoryServiceRegionVpcSettings(
+                subnet_ids=Token.as_list(
+                    Fn.lookup_nested(aws_subnet_example_secondary, ["*", "id"])),
+                vpc_id=example_secondary.id
+            )
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_directory_service_region_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `desired_number_of_domain_controllers` - (Optional) The number of domain controllers desired in the replicated directory. Minimum value of `2`.
+* `directory_id` - (Required) The identifier of the directory to which you want to add Region replication.
+* `region_name` - (Required) The name of the Region where you want to add domain controllers for replication.
+* `tags` - (Optional) Map of tags to assign to this resource. If configured with a provider [`default_tags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `vpc_settings` - (Required) VPC information in the replicated Region. Detailed below.
+
+### `vpc_settings`
+
+* `subnet_ids` - (Required) The identifiers of the subnets for the directory servers.
+* `vpc_id` - (Optional) The identifier of the VPC in which to create the directory.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block).
+
+## Timeouts
+
+`aws_directory_service_region` provides the following [Timeouts](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts) configuration options:
+
+- `create` - (Default `180 minutes`) Used for Region addition
+- `update` - (Default `90 minutes`) Used for replicated directory update
+- `delete` - (Default `90 minutes`) Used for Region removal
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Replicated Regions using directory ID,Region name. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Replicated Regions using directory ID,Region name. For example:
+
+```console
+% terraform import aws_directory_service_region.example d-9267651497,us-east-2
+```
+
+<!-- cache-key: cdktf-0.18.0 input-20d7af9911cb4ea2ab9c63d5899325921c11d1438c0a0bd4b54c4be7952b8fff -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/directory_service_shared_directory.html.markdown b/website/docs/cdktf/python/r/directory_service_shared_directory.html.markdown
new file mode 100644
index 00000000000..e39749eca9b
--- /dev/null
+++ b/website/docs/cdktf/python/r/directory_service_shared_directory.html.markdown
@@ -0,0 +1,101 @@
+---
+subcategory: "Directory Service"
+layout: "aws"
+page_title: "AWS: aws_directory_service_shared_directory"
+description: |-
+    Manages a directory in your account (directory owner) shared with another account (directory consumer).
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_directory_service_shared_directory
+
+Manages a directory in your account (directory owner) shared with another account (directory consumer).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.directory_service_directory import DirectoryServiceDirectory
+from imports.aws.directory_service_shared_directory import DirectoryServiceSharedDirectory
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = DirectoryServiceDirectory(self, "example",
+            edition="Standard",
+            name="tf-example",
+            password="SuperSecretPassw0rd",
+            type="MicrosoftAD",
+            vpc_settings=DirectoryServiceDirectoryVpcSettings(
+                subnet_ids=Token.as_list(Fn.lookup_nested(aws_subnet_example, ["*", "id"])),
+                vpc_id=Token.as_string(aws_vpc_example.id)
+            )
+        )
+        aws_directory_service_shared_directory_example =
+        DirectoryServiceSharedDirectory(self, "example_1",
+            directory_id=example.id,
+            notes="You wanna have a catch?",
+            target=DirectoryServiceSharedDirectoryTarget(
+                id=Token.as_string(receiver.account_id)
+            )
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_directory_service_shared_directory_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `directory_id` - (Required) Identifier of the Managed Microsoft AD directory that you want to share with other accounts.
+* `target` - (Required) Identifier for the directory consumer account with whom the directory is to be shared. See below.
+
+The following arguments are optional:
+
+* `method` - (Optional) Method used when sharing a directory. Valid values are `ORGANIZATIONS` and `HANDSHAKE`. Default is `HANDSHAKE`.
+* `notes` - (Optional, Sensitive) Message sent by the directory owner to the directory consumer to help the directory consumer administrator determine whether to approve or reject the share invitation.
+
+### `target`
+
+* `id` - (Required) Identifier of the directory consumer account.
+* `type` - (Optional) Type of identifier to be used in the `id` field. Valid value is `ACCOUNT`. Default is `ACCOUNT`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Identifier of the shared directory.
+* `shared_directory_id` - Identifier of the directory that is stored in the directory consumer account that corresponds to the shared directory in the owner account.
+
+## Timeouts
+
+`aws_directory_service_shared_directory` provides the following [Timeouts](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts) configuration options:
+
+- `delete` - (Default `60 minutes`) Used for shared directory deletion
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Directory Service Shared Directories using the owner directory ID/shared directory ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Directory Service Shared Directories using the owner directory ID/shared directory ID. For example:
+
+```console
+% terraform import aws_directory_service_shared_directory.example d-1234567890/d-9267633ece
+```
+
+<!-- cache-key: cdktf-0.18.0 input-703c00eb7c77b3d6d3290dced0c2f1e34dd8c3a57ded6619cfae213d85fabb65 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/directory_service_shared_directory_accepter.html.markdown b/website/docs/cdktf/python/r/directory_service_shared_directory_accepter.html.markdown
new file mode 100644
index 00000000000..bedfa38ee49
--- /dev/null
+++ b/website/docs/cdktf/python/r/directory_service_shared_directory_accepter.html.markdown
@@ -0,0 +1,90 @@
+---
+subcategory: "Directory Service"
+layout: "aws"
+page_title: "AWS: aws_directory_service_shared_directory_accepter"
+description: |-
+    Accepts a shared directory in a consumer account.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_directory_service_shared_directory_accepter
+
+Accepts a shared directory in a consumer account.
+
+~> **NOTE:** Destroying this resource removes the shared directory from the consumer account only.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.directory_service_shared_directory import DirectoryServiceSharedDirectory
+from imports.aws.directory_service_shared_directory_accepter import DirectoryServiceSharedDirectoryAccepter
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = DirectoryServiceSharedDirectory(self, "example",
+            directory_id=Token.as_string(aws_directory_service_directory_example.id),
+            notes="example",
+            target=DirectoryServiceSharedDirectoryTarget(
+                id=Token.as_string(receiver.account_id)
+            )
+        )
+        aws_directory_service_shared_directory_accepter_example =
+        DirectoryServiceSharedDirectoryAccepter(self, "example_1",
+            provider="awsalternate",
+            shared_directory_id=example.shared_directory_id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_directory_service_shared_directory_accepter_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `shared_directory_id` - (Required) Identifier of the directory that is stored in the directory consumer account that corresponds to the shared directory in the owner account.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Identifier of the shared directory.
+* `method` - Method used when sharing a directory (i.e., `ORGANIZATIONS` or `HANDSHAKE`).
+* `notes` - Message sent by the directory owner to the directory consumer to help the directory consumer administrator determine whether to approve or reject the share invitation.
+* `owner_account_id` - Account identifier of the directory owner.
+* `owner_directory_id` - Identifier of the Managed Microsoft AD directory from the perspective of the directory owner.
+
+## Timeouts
+
+`aws_directory_service_shared_directory_accepter` provides the following [Timeouts](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts) configuration options:
+
+- `create` - (Default `60 minutes`) Used for directory creation
+- `delete` - (Default `60 minutes`) Used for directory deletion
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Directory Service Shared Directories using the shared directory ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Directory Service Shared Directories using the shared directory ID. For example:
+
+```console
+% terraform import aws_directory_service_shared_directory_accepter.example d-9267633ece
+```
+
+<!-- cache-key: cdktf-0.18.0 input-63416097ef145afd37784c7610985af402f18b723a7a423cc37dfe1e13007046 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/directory_service_trust.html.markdown b/website/docs/cdktf/python/r/directory_service_trust.html.markdown
new file mode 100644
index 00000000000..3bf66f7120a
--- /dev/null
+++ b/website/docs/cdktf/python/r/directory_service_trust.html.markdown
@@ -0,0 +1,166 @@
+---
+subcategory: "Directory Service"
+layout: "aws"
+page_title: "AWS: aws_directory_service_trust"
+description: |-
+  Manages a trust relationship between two Active Directory Directories.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_directory_service_trust
+
+Manages a trust relationship between two Active Directory Directories.
+
+The directories may either be both AWS Managed Microsoft AD domains or an AWS Managed Microsoft AD domain and a self-managed Active Directory Domain.
+
+The Trust relationship must be configured on both sides of the relationship.
+If a Trust has only been created on one side, it will be in the state `VerifyFailed`.
+Once the second Trust is created, the first will update to the correct state.
+
+## Example Usage
+
+### Two-Way Trust
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.directory_service_directory import DirectoryServiceDirectory
+from imports.aws.directory_service_trust import DirectoryServiceTrust
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, password, password1):
+        super().__init__(scope, name)
+        one = DirectoryServiceDirectory(self, "one",
+            name="one.example.com",
+            type="MicrosoftAD",
+            password=password
+        )
+        two = DirectoryServiceDirectory(self, "two",
+            name="two.example.com",
+            type="MicrosoftAD",
+            password=password1
+        )
+        aws_directory_service_trust_one = DirectoryServiceTrust(self, "one_2",
+            conditional_forwarder_ip_addrs=two.dns_ip_addresses,
+            directory_id=one.id,
+            remote_domain_name=two.name,
+            trust_direction="Two-Way",
+            trust_password="Some0therPassword"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_directory_service_trust_one.override_logical_id("one")
+        aws_directory_service_trust_two = DirectoryServiceTrust(self, "two_3",
+            conditional_forwarder_ip_addrs=one.dns_ip_addresses,
+            directory_id=two.id,
+            remote_domain_name=one.name,
+            trust_direction="Two-Way",
+            trust_password="Some0therPassword"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_directory_service_trust_two.override_logical_id("two")
+```
+
+### One-Way Trust
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.directory_service_directory import DirectoryServiceDirectory
+from imports.aws.directory_service_trust import DirectoryServiceTrust
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, password, password1):
+        super().__init__(scope, name)
+        one = DirectoryServiceDirectory(self, "one",
+            name="one.example.com",
+            type="MicrosoftAD",
+            password=password
+        )
+        two = DirectoryServiceDirectory(self, "two",
+            name="two.example.com",
+            type="MicrosoftAD",
+            password=password1
+        )
+        aws_directory_service_trust_one = DirectoryServiceTrust(self, "one_2",
+            conditional_forwarder_ip_addrs=two.dns_ip_addresses,
+            directory_id=one.id,
+            remote_domain_name=two.name,
+            trust_direction="One-Way: Incoming",
+            trust_password="Some0therPassword"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_directory_service_trust_one.override_logical_id("one")
+        aws_directory_service_trust_two = DirectoryServiceTrust(self, "two_3",
+            conditional_forwarder_ip_addrs=one.dns_ip_addresses,
+            directory_id=two.id,
+            remote_domain_name=one.name,
+            trust_direction="One-Way: Outgoing",
+            trust_password="Some0therPassword"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_directory_service_trust_two.override_logical_id("two")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `conditional_forwarder_ip_addrs` - (Optional) Set of IPv4 addresses for the DNS server associated with the remote Directory.
+  Can contain between 1 and 4 values.
+* `delete_associated_conditional_forwarder` - (Optional) Whether to delete the conditional forwarder when deleting the Trust relationship.
+* `directory_id` - (Required) ID of the Directory.
+* `remote_domain_name` - (Required) Fully qualified domain name of the remote Directory.
+* `selective_auth` - (Optional) Whether to enable selective authentication.
+  Valid values are `Enabled` and `Disabled`.
+  Default value is `Disabled`.
+* `trust_direction` - (Required) The direction of the Trust relationship.
+  Valid values are `One-Way: Outgoing`, `One-Way: Incoming`, and `Two-Way`.
+* `trust_password` - (Required) Password for the Trust.
+  Does not need to match the passwords for either Directory.
+  Can contain upper- and lower-case letters, numbers, and punctuation characters.
+  May be up to 128 characters long.
+* `trust_type` - (Optional) Type of the Trust relationship.
+  Valid values are `Forest` and `External`.
+  Default value is `Forest`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `created_date_time` - Date and time when the Trust was created.
+* `id` - The Trust identifier.
+* `last_updated_date_time` - Date and time when the Trust was last updated.
+* `state_last_updated_date_time` - Date and time when the Trust state in `trust_state` was last updated.
+* `trust_state` - State of the Trust relationship.
+  One of `Created`, `VerifyFailed`,`Verified`, `UpdateFailed`,`Updated`,`Deleted`, or `Failed`.
+* `trust_state_reason` - Reason for the Trust state set in `trust_state`.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import the Trust relationship using the directory ID and remote domain name, separated by a `/`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import the Trust relationship using the directory ID and remote domain name, separated by a `/`. For example:
+
+```console
+% terraform import aws_directory_service_trust.example d-926724cf57/directory.example.com
+```
+
+<!-- cache-key: cdktf-0.18.0 input-66aa03e6601035df60798595ea8787d00d4683201307e38bda224131aa72224e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/dlm_lifecycle_policy.html.markdown b/website/docs/cdktf/python/r/dlm_lifecycle_policy.html.markdown
new file mode 100644
index 00000000000..766a6b7a0be
--- /dev/null
+++ b/website/docs/cdktf/python/r/dlm_lifecycle_policy.html.markdown
@@ -0,0 +1,381 @@
+---
+subcategory: "DLM (Data Lifecycle Manager)"
+layout: "aws"
+page_title: "AWS: aws_dlm_lifecycle_policy"
+description: |-
+  Provides a Data Lifecycle Manager (DLM) lifecycle policy for managing snapshots.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_dlm_lifecycle_policy
+
+Provides a [Data Lifecycle Manager (DLM) lifecycle policy](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/snapshot-lifecycle.html) for managing snapshots.
+
+## Example Usage
+
+### Basic
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.dlm_lifecycle_policy import DlmLifecyclePolicy
+from imports.aws.iam_role import IamRole
+from imports.aws.iam_role_policy import IamRolePolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        assume_role = DataAwsIamPolicyDocument(self, "assume_role",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["sts:AssumeRole"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["dlm.amazonaws.com"],
+                    type="Service"
+                )
+                ]
+            )
+            ]
+        )
+        dlm_lifecycle = DataAwsIamPolicyDocument(self, "dlm_lifecycle",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["ec2:CreateSnapshot", "ec2:CreateSnapshots", "ec2:DeleteSnapshot", "ec2:DescribeInstances", "ec2:DescribeVolumes", "ec2:DescribeSnapshots"
+                ],
+                effect="Allow",
+                resources=["*"]
+            ), DataAwsIamPolicyDocumentStatement(
+                actions=["ec2:CreateTags"],
+                effect="Allow",
+                resources=["arn:aws:ec2:*::snapshot/*"]
+            )
+            ]
+        )
+        dlm_lifecycle_role = IamRole(self, "dlm_lifecycle_role",
+            assume_role_policy=Token.as_string(assume_role.json),
+            name="dlm-lifecycle-role"
+        )
+        aws_iam_role_policy_dlm_lifecycle = IamRolePolicy(self, "dlm_lifecycle_3",
+            name="dlm-lifecycle-policy",
+            policy=Token.as_string(dlm_lifecycle.json),
+            role=dlm_lifecycle_role.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_role_policy_dlm_lifecycle.override_logical_id("dlm_lifecycle")
+        DlmLifecyclePolicy(self, "example",
+            description="example DLM lifecycle policy",
+            execution_role_arn=dlm_lifecycle_role.arn,
+            policy_details=DlmLifecyclePolicyPolicyDetails(
+                resource_types=["VOLUME"],
+                schedule=[DlmLifecyclePolicyPolicyDetailsSchedule(
+                    copy_tags=False,
+                    create_rule=DlmLifecyclePolicyPolicyDetailsScheduleCreateRule(
+                        interval=24,
+                        interval_unit="HOURS",
+                        times=["23:45"]
+                    ),
+                    name="2 weeks of daily snapshots",
+                    retain_rule=DlmLifecyclePolicyPolicyDetailsScheduleRetainRule(
+                        count=14
+                    ),
+                    tags_to_add={
+                        "snapshot_creator": "DLM"
+                    }
+                )
+                ],
+                target_tags={
+                    "snapshot": "true"
+                }
+            ),
+            state="ENABLED"
+        )
+```
+
+### Example Cross-Region Snapshot Copy Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_caller_identity import DataAwsCallerIdentity
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.dlm_lifecycle_policy import DlmLifecyclePolicy
+from imports.aws.kms_key import KmsKey
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        current = DataAwsCallerIdentity(self, "current")
+        key = DataAwsIamPolicyDocument(self, "key",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["kms:*"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["arn:aws:iam::${" + current.account_id + "}:root"],
+                    type="AWS"
+                )
+                ],
+                resources=["*"],
+                sid="Enable IAM User Permissions"
+            )
+            ]
+        )
+        dlm_cross_region_copy_cmk = KmsKey(self, "dlm_cross_region_copy_cmk",
+            description="Example Alternate Region KMS Key",
+            policy=Token.as_string(key.json),
+            provider=alternate
+        )
+        DlmLifecyclePolicy(self, "example",
+            description="example DLM lifecycle policy",
+            execution_role_arn=dlm_lifecycle_role.arn,
+            policy_details=DlmLifecyclePolicyPolicyDetails(
+                resource_types=["VOLUME"],
+                schedule=[DlmLifecyclePolicyPolicyDetailsSchedule(
+                    copy_tags=False,
+                    create_rule=DlmLifecyclePolicyPolicyDetailsScheduleCreateRule(
+                        interval=24,
+                        interval_unit="HOURS",
+                        times=["23:45"]
+                    ),
+                    cross_region_copy_rule=[DlmLifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRule(
+                        cmk_arn=dlm_cross_region_copy_cmk.arn,
+                        copy_tags=True,
+                        encrypted=True,
+                        retain_rule=DlmLifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRule(
+                            interval=30,
+                            interval_unit="DAYS"
+                        ),
+                        target="us-west-2"
+                    )
+                    ],
+                    name="2 weeks of daily snapshots",
+                    retain_rule=DlmLifecyclePolicyPolicyDetailsScheduleRetainRule(
+                        count=14
+                    ),
+                    tags_to_add={
+                        "snapshot_creator": "DLM"
+                    }
+                )
+                ],
+                target_tags={
+                    "snapshot": "true"
+                }
+            ),
+            state="ENABLED"
+        )
+```
+
+### Example Event Based Policy Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_caller_identity import DataAwsCallerIdentity
+from imports.aws.data_aws_iam_policy import DataAwsIamPolicy
+from imports.aws.dlm_lifecycle_policy import DlmLifecyclePolicy
+from imports.aws.iam_role_policy_attachment import IamRolePolicyAttachment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        current = DataAwsCallerIdentity(self, "current")
+        example = DataAwsIamPolicy(self, "example",
+            name="AWSDataLifecycleManagerServiceRole"
+        )
+        aws_dlm_lifecycle_policy_example = DlmLifecyclePolicy(self, "example_2",
+            description="tf-acc-basic",
+            execution_role_arn=Token.as_string(aws_iam_role_example.arn),
+            policy_details=DlmLifecyclePolicyPolicyDetails(
+                action=DlmLifecyclePolicyPolicyDetailsAction(
+                    cross_region_copy=[DlmLifecyclePolicyPolicyDetailsActionCrossRegionCopy(
+                        encryption_configuration=DlmLifecyclePolicyPolicyDetailsActionCrossRegionCopyEncryptionConfiguration(),
+                        retain_rule=DlmLifecyclePolicyPolicyDetailsActionCrossRegionCopyRetainRule(
+                            interval=15,
+                            interval_unit="MONTHS"
+                        ),
+                        target="us-east-1"
+                    )
+                    ],
+                    name="tf-acc-basic"
+                ),
+                event_source=DlmLifecyclePolicyPolicyDetailsEventSource(
+                    parameters=DlmLifecyclePolicyPolicyDetailsEventSourceParameters(
+                        description_regex="^.*Created for policy: policy-1234567890abcdef0.*$",
+                        event_type="shareSnapshot",
+                        snapshot_owner=[Token.as_string(current.account_id)]
+                    ),
+                    type="MANAGED_CWE"
+                ),
+                policy_type="EVENT_BASED_POLICY"
+            )
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_dlm_lifecycle_policy_example.override_logical_id("example")
+        aws_iam_role_policy_attachment_example = IamRolePolicyAttachment(self, "example_3",
+            policy_arn=Token.as_string(example.arn),
+            role=Token.as_string(aws_iam_role_example.id)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_role_policy_attachment_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `description` - (Required) A description for the DLM lifecycle policy.
+* `execution_role_arn` - (Required) The ARN of an IAM role that is able to be assumed by the DLM service.
+* `policy_details` - (Required) See the [`policy_details` configuration](#policy-details-arguments) block. Max of 1.
+* `state` - (Optional) Whether the lifecycle policy should be enabled or disabled. `ENABLED` or `DISABLED` are valid values. Defaults to `ENABLED`.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+#### Policy Details arguments
+
+* `action` - (Optional) The actions to be performed when the event-based policy is triggered. You can specify only one action per policy. This parameter is required for event-based policies only. If you are creating a snapshot or AMI policy, omit this parameter. See the [`action` configuration](#action-arguments) block.
+* `event_source` - (Optional) The event that triggers the event-based policy. This parameter is required for event-based policies only. If you are creating a snapshot or AMI policy, omit this parameter. See the [`event_source` configuration](#event-source-arguments) block.
+* `resource_types` - (Optional) A list of resource types that should be targeted by the lifecycle policy. Valid values are `VOLUME` and `INSTANCE`.
+* `resource_locations` - (Optional) The location of the resources to backup. If the source resources are located in an AWS Region, specify `CLOUD`. If the source resources are located on an Outpost in your account, specify `OUTPOST`. If you specify `OUTPOST`, Amazon Data Lifecycle Manager backs up all resources of the specified type with matching target tags across all of the Outposts in your account. Valid values are `CLOUD` and `OUTPOST`.
+* `policy_type` - (Optional) The valid target resource types and actions a policy can manage. Specify `EBS_SNAPSHOT_MANAGEMENT` to create a lifecycle policy that manages the lifecycle of Amazon EBS snapshots. Specify `IMAGE_MANAGEMENT` to create a lifecycle policy that manages the lifecycle of EBS-backed AMIs. Specify `EVENT_BASED_POLICY` to create an event-based policy that performs specific actions when a defined event occurs in your AWS account. Default value is `EBS_SNAPSHOT_MANAGEMENT`.
+* `parameters` - (Optional) A set of optional parameters for snapshot and AMI lifecycle policies. See the [`parameters` configuration](#parameters-arguments) block.
+* `schedule` - (Optional) See the [`schedule` configuration](#schedule-arguments) block.
+* `target_tags` (Optional) A map of tag keys and their values. Any resources that match the `resource_types` and are tagged with _any_ of these tags will be targeted.
+
+~> Note: You cannot have overlapping lifecycle policies that share the same `target_tags`. Terraform is unable to detect this at plan time but it will fail during apply.
+
+#### Action arguments
+
+* `cross_region_copy` - (Optional) The rule for copying shared snapshots across Regions. See the [`cross_region_copy` configuration](#action-cross-region-copy-rule-arguments) block.
+* `name` - (Optional) A descriptive name for the action.
+
+##### Action Cross Region Copy Rule arguments
+
+* `encryption_configuration` - (Required) The encryption settings for the copied snapshot. See the [`encryption_configuration`](#encryption-configuration-arguments) block. Max of 1 per action.
+* `retain_rule` - (Required) Specifies the retention rule for cross-Region snapshot copies. See the [`retain_rule`](#cross-region-copy-rule-retain-rule-arguments) block. Max of 1 per action.
+* `target` - (Required) The target Region or the Amazon Resource Name (ARN) of the target Outpost for the snapshot copies.
+
+###### Encryption Configuration arguments
+
+* `cmk_arn` - (Optional) The Amazon Resource Name (ARN) of the AWS KMS key to use for EBS encryption. If this parameter is not specified, the default KMS key for the account is used.
+* `encrypted` - (Required) To encrypt a copy of an unencrypted snapshot when encryption by default is not enabled, enable encryption using this parameter. Copies of encrypted snapshots are encrypted, even if this parameter is false or when encryption by default is not enabled.
+
+#### Event Source arguments
+
+* `parameters` - (Required) Information about the event. See the [`parameters` configuration](#event-source-parameters-arguments) block.
+* `type` - (Required) The source of the event. Currently only managed CloudWatch Events rules are supported. Valid values are `MANAGED_CWE`.
+
+##### Event Source Parameters arguments
+
+* `description_regex` - (Required) The snapshot description that can trigger the policy. The description pattern is specified using a regular expression. The policy runs only if a snapshot with a description that matches the specified pattern is shared with your account.
+* `event_type` - (Required) The type of event. Currently, only `shareSnapshot` events are supported.
+* `snapshot_owner` - (Required) The IDs of the AWS accounts that can trigger policy by sharing snapshots with your account. The policy only runs if one of the specified AWS accounts shares a snapshot with your account.
+
+#### Parameters arguments
+
+* `exclude_boot_volume` - (Optional) Indicates whether to exclude the root volume from snapshots created using CreateSnapshots. The default is `false`.
+* `no_reboot` - (Optional) Applies to AMI lifecycle policies only. Indicates whether targeted instances are rebooted when the lifecycle policy runs. `true` indicates that targeted instances are not rebooted when the policy runs. `false` indicates that target instances are rebooted when the policy runs. The default is `true` (instances are not rebooted).
+
+#### Schedule arguments
+
+* `copy_tags` - (Optional) Copy all user-defined tags on a source volume to snapshots of the volume created by this policy.
+* `create_rule` - (Required) See the [`create_rule`](#create-rule-arguments) block. Max of 1 per schedule.
+* `cross_region_copy_rule` (Optional) - See the [`cross_region_copy_rule`](#cross-region-copy-rule-arguments) block. Max of 3 per schedule.
+* `name` - (Required) A name for the schedule.
+* `deprecate_rule` - (Required) See the [`deprecate_rule`](#deprecate-rule-arguments) block. Max of 1 per schedule.
+* `fast_restore_rule` - (Required) See the [`fast_restore_rule`](#fast-restore-rule-arguments) block. Max of 1 per schedule.
+* `retain_rule` - (Required) See the [`retain_rule`](#retain-rule-arguments) block. Max of 1 per schedule.
+* `share_rule` - (Required) See the [`share_rule`](#share-rule-arguments) block. Max of 1 per schedule.
+* `tags_to_add` - (Optional) A map of tag keys and their values. DLM lifecycle policies will already tag the snapshot with the tags on the volume. This configuration adds extra tags on top of these.
+* `variable_tags` - (Optional) A map of tag keys and variable values, where the values are determined when the policy is executed. Only `$(instance-id)` or `$(timestamp)` are valid values. Can only be used when `resource_types` is `INSTANCE`.
+
+#### Create Rule arguments
+
+* `cron_expression` - (Optional) The schedule, as a Cron expression. The schedule interval must be between 1 hour and 1 year. Conflicts with `interval`, `interval_unit`, and `times`.
+* `interval` - (Optional) How often this lifecycle policy should be evaluated. `1`, `2`,`3`,`4`,`6`,`8`,`12` or `24` are valid values. Conflicts with `cron_expression`. If set, `interval_unit` and `times` must also be set.
+* `interval_unit` - (Optional) The unit for how often the lifecycle policy should be evaluated. `HOURS` is currently the only allowed value and also the default value. Conflicts with `cron_expression`. Must be set if `interval` is set.
+* `location` - (Optional) Specifies the destination for snapshots created by the policy. To create snapshots in the same Region as the source resource, specify `CLOUD`. To create snapshots on the same Outpost as the source resource, specify `OUTPOST_LOCAL`. If you omit this parameter, `CLOUD` is used by default. If the policy targets resources in an AWS Region, then you must create snapshots in the same Region as the source resource. If the policy targets resources on an Outpost, then you can create snapshots on the same Outpost as the source resource, or in the Region of that Outpost. Valid values are `CLOUD` and `OUTPOST_LOCAL`.
+* `times` - (Optional) A list of times in 24 hour clock format that sets when the lifecycle policy should be evaluated. Max of 1. Conflicts with `cron_expression`. Must be set if `interval` is set.
+
+#### Deprecate Rule arguments
+
+* `count` - (Optional) Specifies the number of oldest AMIs to deprecate. Must be an integer between `1` and `1000`. Conflicts with `interval` and `interval_unit`.
+* `interval` - (Optional) Specifies the period after which to deprecate AMIs created by the schedule. The maximum is 100 years. This is equivalent to 1200 months, 5200 weeks, or 36500 days. Conflicts with `count`. If set, `interval_unit` must also be set.
+* `interval_unit` - (Optional) The unit of time for time-based retention. Valid values are `DAYS`, `WEEKS`, `MONTHS`, `YEARS`. Conflicts with `count`. Must be set if `interval` is set.
+
+#### Fast Restore Rule arguments
+
+* `availability_zones` - (Required) The Availability Zones in which to enable fast snapshot restore.
+* `count` - (Optional) The number of snapshots to be enabled with fast snapshot restore. Must be an integer between `1` and `1000`. Conflicts with `interval` and `interval_unit`.
+* `interval` - (Optional) The amount of time to enable fast snapshot restore. The maximum is 100 years. This is equivalent to 1200 months, 5200 weeks, or 36500 days. Conflicts with `count`. If set, `interval_unit` must also be set.
+* `interval_unit` - (Optional) The unit of time for enabling fast snapshot restore. Valid values are `DAYS`, `WEEKS`, `MONTHS`, `YEARS`. Conflicts with `count`. Must be set if `interval` is set.
+
+#### Retain Rule arguments
+
+* `count` - (Optional) How many snapshots to keep. Must be an integer between `1` and `1000`. Conflicts with `interval` and `interval_unit`.
+* `interval` - (Optional) The amount of time to retain each snapshot. The maximum is 100 years. This is equivalent to 1200 months, 5200 weeks, or 36500 days. Conflicts with `count`. If set, `interval_unit` must also be set.
+* `interval_unit` - (Optional) The unit of time for time-based retention. Valid values are `DAYS`, `WEEKS`, `MONTHS`, `YEARS`. Conflicts with `count`. Must be set if `interval` is set.
+
+#### Share Rule arguments
+
+* `target_accounts` - (Required) The IDs of the AWS accounts with which to share the snapshots.
+* `interval` - (Optional) The period after which snapshots that are shared with other AWS accounts are automatically unshared.
+* `interval_unit` - (Optional) The unit of time for the automatic unsharing interval. Valid values are `DAYS`, `WEEKS`, `MONTHS`, `YEARS`.
+
+#### Cross Region Copy Rule arguments
+
+* `cmk_arn` - (Optional) The Amazon Resource Name (ARN) of the AWS KMS customer master key (CMK) to use for EBS encryption. If this argument is not specified, the default KMS key for the account is used.
+* `copy_tags` - (Optional) Whether to copy all user-defined tags from the source snapshot to the cross-region snapshot copy.
+* `deprecate_rule` - (Optional) The AMI deprecation rule for cross-Region AMI copies created by the rule. See the [`deprecate_rule`](#cross-region-copy-rule-deprecate-rule-arguments) block.
+* `encrypted` - (Required) To encrypt a copy of an unencrypted snapshot if encryption by default is not enabled, enable encryption using this parameter. Copies of encrypted snapshots are encrypted, even if this parameter is false or if encryption by default is not enabled.
+* `retain_rule` - (Required) The retention rule that indicates how long snapshot copies are to be retained in the destination Region. See the [`retain_rule`](#cross-region-copy-rule-retain-rule-arguments) block. Max of 1 per schedule.
+* `target` - (Required) The target Region or the Amazon Resource Name (ARN) of the target Outpost for the snapshot copies.
+
+#### Cross Region Copy Rule Deprecate Rule arguments
+
+* `interval` - (Required) The period after which to deprecate the cross-Region AMI copies. The period must be less than or equal to the cross-Region AMI copy retention period, and it can't be greater than 10 years. This is equivalent to 120 months, 520 weeks, or 3650 days.
+* `interval_unit` - (Required) The unit of time in which to measure the `interval`. Valid values: `DAYS`, `WEEKS`, `MONTHS`, or `YEARS`.
+
+#### Cross Region Copy Rule Retain Rule arguments
+
+* `interval` - (Required) The amount of time to retain each snapshot. The maximum is 100 years. This is equivalent to 1200 months, 5200 weeks, or 36500 days.
+* `interval_unit` - (Required) The unit of time for time-based retention. Valid values: `DAYS`, `WEEKS`, `MONTHS`, or `YEARS`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the DLM Lifecycle Policy.
+* `id` - Identifier of the DLM Lifecycle Policy.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DLM lifecycle policies using their policy ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import DLM lifecycle policies using their policy ID. For example:
+
+```console
+% terraform import aws_dlm_lifecycle_policy.example policy-abcdef12345678901
+```
+
+<!-- cache-key: cdktf-0.18.0 input-cd52275658ea26bb97d5ff6b8e5c283dfc879cf7239a8546704deb3cc7ac57ec -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/dlm_lifecycle_policy.markdown b/website/docs/cdktf/python/r/dlm_lifecycle_policy.markdown
new file mode 100644
index 00000000000..766a6b7a0be
--- /dev/null
+++ b/website/docs/cdktf/python/r/dlm_lifecycle_policy.markdown
@@ -0,0 +1,381 @@
+---
+subcategory: "DLM (Data Lifecycle Manager)"
+layout: "aws"
+page_title: "AWS: aws_dlm_lifecycle_policy"
+description: |-
+  Provides a Data Lifecycle Manager (DLM) lifecycle policy for managing snapshots.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_dlm_lifecycle_policy
+
+Provides a [Data Lifecycle Manager (DLM) lifecycle policy](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/snapshot-lifecycle.html) for managing snapshots.
+
+## Example Usage
+
+### Basic
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.dlm_lifecycle_policy import DlmLifecyclePolicy
+from imports.aws.iam_role import IamRole
+from imports.aws.iam_role_policy import IamRolePolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        assume_role = DataAwsIamPolicyDocument(self, "assume_role",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["sts:AssumeRole"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["dlm.amazonaws.com"],
+                    type="Service"
+                )
+                ]
+            )
+            ]
+        )
+        dlm_lifecycle = DataAwsIamPolicyDocument(self, "dlm_lifecycle",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["ec2:CreateSnapshot", "ec2:CreateSnapshots", "ec2:DeleteSnapshot", "ec2:DescribeInstances", "ec2:DescribeVolumes", "ec2:DescribeSnapshots"
+                ],
+                effect="Allow",
+                resources=["*"]
+            ), DataAwsIamPolicyDocumentStatement(
+                actions=["ec2:CreateTags"],
+                effect="Allow",
+                resources=["arn:aws:ec2:*::snapshot/*"]
+            )
+            ]
+        )
+        dlm_lifecycle_role = IamRole(self, "dlm_lifecycle_role",
+            assume_role_policy=Token.as_string(assume_role.json),
+            name="dlm-lifecycle-role"
+        )
+        aws_iam_role_policy_dlm_lifecycle = IamRolePolicy(self, "dlm_lifecycle_3",
+            name="dlm-lifecycle-policy",
+            policy=Token.as_string(dlm_lifecycle.json),
+            role=dlm_lifecycle_role.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_role_policy_dlm_lifecycle.override_logical_id("dlm_lifecycle")
+        DlmLifecyclePolicy(self, "example",
+            description="example DLM lifecycle policy",
+            execution_role_arn=dlm_lifecycle_role.arn,
+            policy_details=DlmLifecyclePolicyPolicyDetails(
+                resource_types=["VOLUME"],
+                schedule=[DlmLifecyclePolicyPolicyDetailsSchedule(
+                    copy_tags=False,
+                    create_rule=DlmLifecyclePolicyPolicyDetailsScheduleCreateRule(
+                        interval=24,
+                        interval_unit="HOURS",
+                        times=["23:45"]
+                    ),
+                    name="2 weeks of daily snapshots",
+                    retain_rule=DlmLifecyclePolicyPolicyDetailsScheduleRetainRule(
+                        count=14
+                    ),
+                    tags_to_add={
+                        "snapshot_creator": "DLM"
+                    }
+                )
+                ],
+                target_tags={
+                    "snapshot": "true"
+                }
+            ),
+            state="ENABLED"
+        )
+```
+
+### Example Cross-Region Snapshot Copy Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_caller_identity import DataAwsCallerIdentity
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.dlm_lifecycle_policy import DlmLifecyclePolicy
+from imports.aws.kms_key import KmsKey
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        current = DataAwsCallerIdentity(self, "current")
+        key = DataAwsIamPolicyDocument(self, "key",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["kms:*"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["arn:aws:iam::${" + current.account_id + "}:root"],
+                    type="AWS"
+                )
+                ],
+                resources=["*"],
+                sid="Enable IAM User Permissions"
+            )
+            ]
+        )
+        dlm_cross_region_copy_cmk = KmsKey(self, "dlm_cross_region_copy_cmk",
+            description="Example Alternate Region KMS Key",
+            policy=Token.as_string(key.json),
+            provider=alternate
+        )
+        DlmLifecyclePolicy(self, "example",
+            description="example DLM lifecycle policy",
+            execution_role_arn=dlm_lifecycle_role.arn,
+            policy_details=DlmLifecyclePolicyPolicyDetails(
+                resource_types=["VOLUME"],
+                schedule=[DlmLifecyclePolicyPolicyDetailsSchedule(
+                    copy_tags=False,
+                    create_rule=DlmLifecyclePolicyPolicyDetailsScheduleCreateRule(
+                        interval=24,
+                        interval_unit="HOURS",
+                        times=["23:45"]
+                    ),
+                    cross_region_copy_rule=[DlmLifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRule(
+                        cmk_arn=dlm_cross_region_copy_cmk.arn,
+                        copy_tags=True,
+                        encrypted=True,
+                        retain_rule=DlmLifecyclePolicyPolicyDetailsScheduleCrossRegionCopyRuleRetainRule(
+                            interval=30,
+                            interval_unit="DAYS"
+                        ),
+                        target="us-west-2"
+                    )
+                    ],
+                    name="2 weeks of daily snapshots",
+                    retain_rule=DlmLifecyclePolicyPolicyDetailsScheduleRetainRule(
+                        count=14
+                    ),
+                    tags_to_add={
+                        "snapshot_creator": "DLM"
+                    }
+                )
+                ],
+                target_tags={
+                    "snapshot": "true"
+                }
+            ),
+            state="ENABLED"
+        )
+```
+
+### Example Event Based Policy Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_caller_identity import DataAwsCallerIdentity
+from imports.aws.data_aws_iam_policy import DataAwsIamPolicy
+from imports.aws.dlm_lifecycle_policy import DlmLifecyclePolicy
+from imports.aws.iam_role_policy_attachment import IamRolePolicyAttachment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        current = DataAwsCallerIdentity(self, "current")
+        example = DataAwsIamPolicy(self, "example",
+            name="AWSDataLifecycleManagerServiceRole"
+        )
+        aws_dlm_lifecycle_policy_example = DlmLifecyclePolicy(self, "example_2",
+            description="tf-acc-basic",
+            execution_role_arn=Token.as_string(aws_iam_role_example.arn),
+            policy_details=DlmLifecyclePolicyPolicyDetails(
+                action=DlmLifecyclePolicyPolicyDetailsAction(
+                    cross_region_copy=[DlmLifecyclePolicyPolicyDetailsActionCrossRegionCopy(
+                        encryption_configuration=DlmLifecyclePolicyPolicyDetailsActionCrossRegionCopyEncryptionConfiguration(),
+                        retain_rule=DlmLifecyclePolicyPolicyDetailsActionCrossRegionCopyRetainRule(
+                            interval=15,
+                            interval_unit="MONTHS"
+                        ),
+                        target="us-east-1"
+                    )
+                    ],
+                    name="tf-acc-basic"
+                ),
+                event_source=DlmLifecyclePolicyPolicyDetailsEventSource(
+                    parameters=DlmLifecyclePolicyPolicyDetailsEventSourceParameters(
+                        description_regex="^.*Created for policy: policy-1234567890abcdef0.*$",
+                        event_type="shareSnapshot",
+                        snapshot_owner=[Token.as_string(current.account_id)]
+                    ),
+                    type="MANAGED_CWE"
+                ),
+                policy_type="EVENT_BASED_POLICY"
+            )
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_dlm_lifecycle_policy_example.override_logical_id("example")
+        aws_iam_role_policy_attachment_example = IamRolePolicyAttachment(self, "example_3",
+            policy_arn=Token.as_string(example.arn),
+            role=Token.as_string(aws_iam_role_example.id)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_role_policy_attachment_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `description` - (Required) A description for the DLM lifecycle policy.
+* `execution_role_arn` - (Required) The ARN of an IAM role that is able to be assumed by the DLM service.
+* `policy_details` - (Required) See the [`policy_details` configuration](#policy-details-arguments) block. Max of 1.
+* `state` - (Optional) Whether the lifecycle policy should be enabled or disabled. `ENABLED` or `DISABLED` are valid values. Defaults to `ENABLED`.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+#### Policy Details arguments
+
+* `action` - (Optional) The actions to be performed when the event-based policy is triggered. You can specify only one action per policy. This parameter is required for event-based policies only. If you are creating a snapshot or AMI policy, omit this parameter. See the [`action` configuration](#action-arguments) block.
+* `event_source` - (Optional) The event that triggers the event-based policy. This parameter is required for event-based policies only. If you are creating a snapshot or AMI policy, omit this parameter. See the [`event_source` configuration](#event-source-arguments) block.
+* `resource_types` - (Optional) A list of resource types that should be targeted by the lifecycle policy. Valid values are `VOLUME` and `INSTANCE`.
+* `resource_locations` - (Optional) The location of the resources to backup. If the source resources are located in an AWS Region, specify `CLOUD`. If the source resources are located on an Outpost in your account, specify `OUTPOST`. If you specify `OUTPOST`, Amazon Data Lifecycle Manager backs up all resources of the specified type with matching target tags across all of the Outposts in your account. Valid values are `CLOUD` and `OUTPOST`.
+* `policy_type` - (Optional) The valid target resource types and actions a policy can manage. Specify `EBS_SNAPSHOT_MANAGEMENT` to create a lifecycle policy that manages the lifecycle of Amazon EBS snapshots. Specify `IMAGE_MANAGEMENT` to create a lifecycle policy that manages the lifecycle of EBS-backed AMIs. Specify `EVENT_BASED_POLICY` to create an event-based policy that performs specific actions when a defined event occurs in your AWS account. Default value is `EBS_SNAPSHOT_MANAGEMENT`.
+* `parameters` - (Optional) A set of optional parameters for snapshot and AMI lifecycle policies. See the [`parameters` configuration](#parameters-arguments) block.
+* `schedule` - (Optional) See the [`schedule` configuration](#schedule-arguments) block.
+* `target_tags` (Optional) A map of tag keys and their values. Any resources that match the `resource_types` and are tagged with _any_ of these tags will be targeted.
+
+~> Note: You cannot have overlapping lifecycle policies that share the same `target_tags`. Terraform is unable to detect this at plan time but it will fail during apply.
+
+#### Action arguments
+
+* `cross_region_copy` - (Optional) The rule for copying shared snapshots across Regions. See the [`cross_region_copy` configuration](#action-cross-region-copy-rule-arguments) block.
+* `name` - (Optional) A descriptive name for the action.
+
+##### Action Cross Region Copy Rule arguments
+
+* `encryption_configuration` - (Required) The encryption settings for the copied snapshot. See the [`encryption_configuration`](#encryption-configuration-arguments) block. Max of 1 per action.
+* `retain_rule` - (Required) Specifies the retention rule for cross-Region snapshot copies. See the [`retain_rule`](#cross-region-copy-rule-retain-rule-arguments) block. Max of 1 per action.
+* `target` - (Required) The target Region or the Amazon Resource Name (ARN) of the target Outpost for the snapshot copies.
+
+###### Encryption Configuration arguments
+
+* `cmk_arn` - (Optional) The Amazon Resource Name (ARN) of the AWS KMS key to use for EBS encryption. If this parameter is not specified, the default KMS key for the account is used.
+* `encrypted` - (Required) To encrypt a copy of an unencrypted snapshot when encryption by default is not enabled, enable encryption using this parameter. Copies of encrypted snapshots are encrypted, even if this parameter is false or when encryption by default is not enabled.
+
+#### Event Source arguments
+
+* `parameters` - (Required) Information about the event. See the [`parameters` configuration](#event-source-parameters-arguments) block.
+* `type` - (Required) The source of the event. Currently only managed CloudWatch Events rules are supported. Valid values are `MANAGED_CWE`.
+
+##### Event Source Parameters arguments
+
+* `description_regex` - (Required) The snapshot description that can trigger the policy. The description pattern is specified using a regular expression. The policy runs only if a snapshot with a description that matches the specified pattern is shared with your account.
+* `event_type` - (Required) The type of event. Currently, only `shareSnapshot` events are supported.
+* `snapshot_owner` - (Required) The IDs of the AWS accounts that can trigger policy by sharing snapshots with your account. The policy only runs if one of the specified AWS accounts shares a snapshot with your account.
+
+#### Parameters arguments
+
+* `exclude_boot_volume` - (Optional) Indicates whether to exclude the root volume from snapshots created using CreateSnapshots. The default is `false`.
+* `no_reboot` - (Optional) Applies to AMI lifecycle policies only. Indicates whether targeted instances are rebooted when the lifecycle policy runs. `true` indicates that targeted instances are not rebooted when the policy runs. `false` indicates that target instances are rebooted when the policy runs. The default is `true` (instances are not rebooted).
+
+#### Schedule arguments
+
+* `copy_tags` - (Optional) Copy all user-defined tags on a source volume to snapshots of the volume created by this policy.
+* `create_rule` - (Required) See the [`create_rule`](#create-rule-arguments) block. Max of 1 per schedule.
+* `cross_region_copy_rule` (Optional) - See the [`cross_region_copy_rule`](#cross-region-copy-rule-arguments) block. Max of 3 per schedule.
+* `name` - (Required) A name for the schedule.
+* `deprecate_rule` - (Required) See the [`deprecate_rule`](#deprecate-rule-arguments) block. Max of 1 per schedule.
+* `fast_restore_rule` - (Required) See the [`fast_restore_rule`](#fast-restore-rule-arguments) block. Max of 1 per schedule.
+* `retain_rule` - (Required) See the [`retain_rule`](#retain-rule-arguments) block. Max of 1 per schedule.
+* `share_rule` - (Required) See the [`share_rule`](#share-rule-arguments) block. Max of 1 per schedule.
+* `tags_to_add` - (Optional) A map of tag keys and their values. DLM lifecycle policies will already tag the snapshot with the tags on the volume. This configuration adds extra tags on top of these.
+* `variable_tags` - (Optional) A map of tag keys and variable values, where the values are determined when the policy is executed. Only `$(instance-id)` or `$(timestamp)` are valid values. Can only be used when `resource_types` is `INSTANCE`.
+
+#### Create Rule arguments
+
+* `cron_expression` - (Optional) The schedule, as a Cron expression. The schedule interval must be between 1 hour and 1 year. Conflicts with `interval`, `interval_unit`, and `times`.
+* `interval` - (Optional) How often this lifecycle policy should be evaluated. `1`, `2`,`3`,`4`,`6`,`8`,`12` or `24` are valid values. Conflicts with `cron_expression`. If set, `interval_unit` and `times` must also be set.
+* `interval_unit` - (Optional) The unit for how often the lifecycle policy should be evaluated. `HOURS` is currently the only allowed value and also the default value. Conflicts with `cron_expression`. Must be set if `interval` is set.
+* `location` - (Optional) Specifies the destination for snapshots created by the policy. To create snapshots in the same Region as the source resource, specify `CLOUD`. To create snapshots on the same Outpost as the source resource, specify `OUTPOST_LOCAL`. If you omit this parameter, `CLOUD` is used by default. If the policy targets resources in an AWS Region, then you must create snapshots in the same Region as the source resource. If the policy targets resources on an Outpost, then you can create snapshots on the same Outpost as the source resource, or in the Region of that Outpost. Valid values are `CLOUD` and `OUTPOST_LOCAL`.
+* `times` - (Optional) A list of times in 24 hour clock format that sets when the lifecycle policy should be evaluated. Max of 1. Conflicts with `cron_expression`. Must be set if `interval` is set.
+
+#### Deprecate Rule arguments
+
+* `count` - (Optional) Specifies the number of oldest AMIs to deprecate. Must be an integer between `1` and `1000`. Conflicts with `interval` and `interval_unit`.
+* `interval` - (Optional) Specifies the period after which to deprecate AMIs created by the schedule. The maximum is 100 years. This is equivalent to 1200 months, 5200 weeks, or 36500 days. Conflicts with `count`. If set, `interval_unit` must also be set.
+* `interval_unit` - (Optional) The unit of time for time-based retention. Valid values are `DAYS`, `WEEKS`, `MONTHS`, `YEARS`. Conflicts with `count`. Must be set if `interval` is set.
+
+#### Fast Restore Rule arguments
+
+* `availability_zones` - (Required) The Availability Zones in which to enable fast snapshot restore.
+* `count` - (Optional) The number of snapshots to be enabled with fast snapshot restore. Must be an integer between `1` and `1000`. Conflicts with `interval` and `interval_unit`.
+* `interval` - (Optional) The amount of time to enable fast snapshot restore. The maximum is 100 years. This is equivalent to 1200 months, 5200 weeks, or 36500 days. Conflicts with `count`. If set, `interval_unit` must also be set.
+* `interval_unit` - (Optional) The unit of time for enabling fast snapshot restore. Valid values are `DAYS`, `WEEKS`, `MONTHS`, `YEARS`. Conflicts with `count`. Must be set if `interval` is set.
+
+#### Retain Rule arguments
+
+* `count` - (Optional) How many snapshots to keep. Must be an integer between `1` and `1000`. Conflicts with `interval` and `interval_unit`.
+* `interval` - (Optional) The amount of time to retain each snapshot. The maximum is 100 years. This is equivalent to 1200 months, 5200 weeks, or 36500 days. Conflicts with `count`. If set, `interval_unit` must also be set.
+* `interval_unit` - (Optional) The unit of time for time-based retention. Valid values are `DAYS`, `WEEKS`, `MONTHS`, `YEARS`. Conflicts with `count`. Must be set if `interval` is set.
+
+#### Share Rule arguments
+
+* `target_accounts` - (Required) The IDs of the AWS accounts with which to share the snapshots.
+* `interval` - (Optional) The period after which snapshots that are shared with other AWS accounts are automatically unshared.
+* `interval_unit` - (Optional) The unit of time for the automatic unsharing interval. Valid values are `DAYS`, `WEEKS`, `MONTHS`, `YEARS`.
+
+#### Cross Region Copy Rule arguments
+
+* `cmk_arn` - (Optional) The Amazon Resource Name (ARN) of the AWS KMS customer master key (CMK) to use for EBS encryption. If this argument is not specified, the default KMS key for the account is used.
+* `copy_tags` - (Optional) Whether to copy all user-defined tags from the source snapshot to the cross-region snapshot copy.
+* `deprecate_rule` - (Optional) The AMI deprecation rule for cross-Region AMI copies created by the rule. See the [`deprecate_rule`](#cross-region-copy-rule-deprecate-rule-arguments) block.
+* `encrypted` - (Required) To encrypt a copy of an unencrypted snapshot if encryption by default is not enabled, enable encryption using this parameter. Copies of encrypted snapshots are encrypted, even if this parameter is false or if encryption by default is not enabled.
+* `retain_rule` - (Required) The retention rule that indicates how long snapshot copies are to be retained in the destination Region. See the [`retain_rule`](#cross-region-copy-rule-retain-rule-arguments) block. Max of 1 per schedule.
+* `target` - (Required) The target Region or the Amazon Resource Name (ARN) of the target Outpost for the snapshot copies.
+
+#### Cross Region Copy Rule Deprecate Rule arguments
+
+* `interval` - (Required) The period after which to deprecate the cross-Region AMI copies. The period must be less than or equal to the cross-Region AMI copy retention period, and it can't be greater than 10 years. This is equivalent to 120 months, 520 weeks, or 3650 days.
+* `interval_unit` - (Required) The unit of time in which to measure the `interval`. Valid values: `DAYS`, `WEEKS`, `MONTHS`, or `YEARS`.
+
+#### Cross Region Copy Rule Retain Rule arguments
+
+* `interval` - (Required) The amount of time to retain each snapshot. The maximum is 100 years. This is equivalent to 1200 months, 5200 weeks, or 36500 days.
+* `interval_unit` - (Required) The unit of time for time-based retention. Valid values: `DAYS`, `WEEKS`, `MONTHS`, or `YEARS`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the DLM Lifecycle Policy.
+* `id` - Identifier of the DLM Lifecycle Policy.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DLM lifecycle policies using their policy ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import DLM lifecycle policies using their policy ID. For example:
+
+```console
+% terraform import aws_dlm_lifecycle_policy.example policy-abcdef12345678901
+```
+
+<!-- cache-key: cdktf-0.18.0 input-cd52275658ea26bb97d5ff6b8e5c283dfc879cf7239a8546704deb3cc7ac57ec -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/dms_certificate.html.markdown b/website/docs/cdktf/python/r/dms_certificate.html.markdown
new file mode 100644
index 00000000000..0c77c8c7ddd
--- /dev/null
+++ b/website/docs/cdktf/python/r/dms_certificate.html.markdown
@@ -0,0 +1,79 @@
+---
+subcategory: "DMS (Database Migration)"
+layout: "aws"
+page_title: "AWS: aws_dms_certificate"
+description: |-
+  Provides a DMS (Data Migration Service) certificate resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_dms_certificate
+
+Provides a DMS (Data Migration Service) certificate resource. DMS certificates can be created, deleted, and imported.
+
+~> **Note:** All arguments including the PEM encoded certificate will be stored in the raw state as plain-text.
+[Read more about sensitive data in state](https://www.terraform.io/docs/state/sensitive-data.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.dms_certificate import DmsCertificate
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DmsCertificate(self, "test",
+            certificate_id="test-dms-certificate-tf",
+            certificate_pem="...",
+            tags={
+                "Name": "test"
+            }
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `certificate_id` - (Required) The certificate identifier.
+
+    - Must contain from 1 to 255 alphanumeric characters and hyphens.
+
+* `certificate_pem` - (Optional) The contents of the .pem X.509 certificate file for the certificate. Either `certificate_pem` or `certificate_wallet` must be set.
+* `certificate_wallet` - (Optional) The contents of the Oracle Wallet certificate for use with SSL, provided as a base64-encoded String. Either `certificate_pem` or `certificate_wallet` must be set.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `certificate_arn` - The Amazon Resource Name (ARN) for the certificate.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import certificates using the `certificate_id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import certificates using the `certificate_id`. For example:
+
+```console
+% terraform import aws_dms_certificate.test test-dms-certificate-tf
+```
+
+<!-- cache-key: cdktf-0.18.0 input-43c2ddd8bdacc0b322a9d01379d67b520abc0514fee6ac2b769064b1afbc324d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/dms_endpoint.html.markdown b/website/docs/cdktf/python/r/dms_endpoint.html.markdown
new file mode 100644
index 00000000000..da491ef92f0
--- /dev/null
+++ b/website/docs/cdktf/python/r/dms_endpoint.html.markdown
@@ -0,0 +1,239 @@
+---
+subcategory: "DMS (Database Migration)"
+layout: "aws"
+page_title: "AWS: aws_dms_endpoint"
+description: |-
+  Provides a DMS (Data Migration Service) endpoint resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_dms_endpoint
+
+Provides a DMS (Data Migration Service) endpoint resource. DMS endpoints can be created, updated, deleted, and imported.
+
+~> **Note:** All arguments including the password will be stored in the raw state as plain-text. [Read more about sensitive data in state](https://www.terraform.io/docs/state/sensitive-data.html).
+
+~> **Note:** The `s3_settings` argument is deprecated, may not be maintained, and will be removed in a future version. Use the [`aws_dms_s3_endpoint`](/docs/providers/aws/r/dms_s3_endpoint.html) resource instead.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.dms_endpoint import DmsEndpoint
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DmsEndpoint(self, "test",
+            certificate_arn="arn:aws:acm:us-east-1:123456789012:certificate/12345678-1234-1234-1234-123456789012",
+            database_name="test",
+            endpoint_id="test-dms-endpoint-tf",
+            endpoint_type="source",
+            engine_name="aurora",
+            extra_connection_attributes="",
+            kms_key_arn="arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012",
+            password="test",
+            port=3306,
+            server_name="test",
+            ssl_mode="none",
+            tags={
+                "Name": "test"
+            },
+            username="test"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `endpoint_id` - (Required) Database endpoint identifier. Identifiers must contain from 1 to 255 alphanumeric characters or hyphens, begin with a letter, contain only ASCII letters, digits, and hyphens, not end with a hyphen, and not contain two consecutive hyphens.
+* `endpoint_type` - (Required) Type of endpoint. Valid values are `source`, `target`.
+* `engine_name` - (Required) Type of engine for the endpoint. Valid values are `aurora`, `aurora-postgresql`, `azuredb`, `azure-sql-managed-instance`, `babelfish`, `db2`, `db2-zos`, `docdb`, `dynamodb`, `elasticsearch`, `kafka`, `kinesis`, `mariadb`, `mongodb`, `mysql`, `opensearch`, `oracle`, `postgres`, `redshift`, `s3`, `sqlserver`, `sybase`. Please note that some of engine names are available only for `target` endpoint type (e.g. `redshift`).
+* `kms_key_arn` - (Required when `engine_name` is `mongodb`, cannot be set when `engine_name` is `s3`, optional otherwise) ARN for the KMS key that will be used to encrypt the connection parameters. If you do not specify a value for `kms_key_arn`, then AWS DMS will use your default encryption key. AWS KMS creates the default encryption key for your AWS account. Your AWS account has a different default encryption key for each AWS region. To encrypt an S3 target with a KMS Key, use the parameter `s3_settings.server_side_encryption_kms_key_id`. When `engine_name` is `redshift`, `kms_key_arn` is the KMS Key for the Redshift target and the parameter `redshift_settings.server_side_encryption_kms_key_id` encrypts the S3 intermediate storage.
+
+The following arguments are optional:
+
+* `certificate_arn` - (Optional, Default: empty string) ARN for the certificate.
+* `database_name` - (Optional) Name of the endpoint database.
+* `elasticsearch_settings` - (Optional) Configuration block for OpenSearch settings. See below.
+* `extra_connection_attributes` - (Optional) Additional attributes associated with the connection. For available attributes for a `source` Endpoint, see [Sources for data migration](https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Source.html). For available attributes for a `target` Endpoint, see [Targets for data migration](https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Target.html).
+* `kafka_settings` - (Optional) Configuration block for Kafka settings. See below.
+* `kinesis_settings` - (Optional) Configuration block for Kinesis settings. See below.
+* `mongodb_settings` - (Optional) Configuration block for MongoDB settings. See below.
+* `password` - (Optional) Password to be used to login to the endpoint database.
+* `port` - (Optional) Port used by the endpoint database.
+* `redshift_settings` - (Optional) Configuration block for Redshift settings. See below.
+* `s3_settings` - (Optional) (**Deprecated**, use the [`aws_dms_s3_endpoint`](/docs/providers/aws/r/dms_s3_endpoint.html) resource instead) Configuration block for S3 settings. See below.
+* `secrets_manager_access_role_arn` - (Optional) ARN of the IAM role that specifies AWS DMS as the trusted entity and has the required permissions to access the value in SecretsManagerSecret.
+* `secrets_manager_arn` - (Optional) Full ARN, partial ARN, or friendly name of the SecretsManagerSecret that contains the endpoint connection details. Supported only when `engine_name` is `aurora`, `aurora-postgresql`, `mariadb`, `mongodb`, `mysql`, `oracle`, `postgres`, `redshift`, or `sqlserver`.
+* `server_name` - (Optional) Host name of the server.
+* `service_access_role` - (Optional) ARN used by the service access IAM role for dynamodb endpoints.
+* `ssl_mode` - (Optional, Default: `none`) SSL mode to use for the connection. Valid values are `none`, `require`, `verify-ca`, `verify-full`
+* `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `username` - (Optional) User name to be used to login to the endpoint database.
+
+### elasticsearch_settings
+
+-> Additional information can be found in the [Using Amazon OpenSearch Service as a Target for AWS Database Migration Service documentation](https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Target.Elasticsearch.html).
+
+* `endpoint_uri` - (Required) Endpoint for the OpenSearch cluster.
+* `error_retry_duration` - (Optional) Maximum number of seconds for which DMS retries failed API requests to the OpenSearch cluster. Default is `300`.
+* `full_load_error_percentage` - (Optional) Maximum percentage of records that can fail to be written before a full load operation stops. Default is `10`.
+* `service_access_role_arn` - (Required) ARN of the IAM Role with permissions to write to the OpenSearch cluster.
+
+### kafka_settings
+
+-> Additional information can be found in the [Using Apache Kafka as a Target for AWS Database Migration Service documentation](https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Target.Kafka.html).
+
+* `broker` - (Required) Kafka broker location. Specify in the form broker-hostname-or-ip:port.
+* `include_control_details` - (Optional) Shows detailed control information for table definition, column definition, and table and column changes in the Kafka message output. Default is `false`.
+* `include_null_and_empty` - (Optional) Include NULL and empty columns for records migrated to the endpoint. Default is `false`.
+* `include_partition_value` - (Optional) Shows the partition value within the Kafka message output unless the partition type is `schema-table-type`. Default is `false`.
+* `include_table_alter_operations` - (Optional) Includes any data definition language (DDL) operations that change the table in the control data, such as `rename-table`, `drop-table`, `add-column`, `drop-column`, and `rename-column`. Default is `false`.
+* `include_transaction_details` - (Optional) Provides detailed transaction information from the source database. This information includes a commit timestamp, a log position, and values for `transaction_id`, previous `transaction_id`, and `transaction_record_id` (the record offset within a transaction). Default is `false`.
+* `message_format` - (Optional) Output format for the records created on the endpoint. Message format is `JSON` (default) or `JSON_UNFORMATTED` (a single line with no tab).
+* `message_max_bytes` - (Optional) Maximum size in bytes for records created on the endpoint Default is `1,000,000`.
+* `no_hex_prefix` - (Optional) Set this optional parameter to true to avoid adding a '0x' prefix to raw data in hexadecimal format. For example, by default, AWS DMS adds a '0x' prefix to the LOB column type in hexadecimal format moving from an Oracle source to a Kafka target. Use the `no_hex_prefix` endpoint setting to enable migration of RAW data type columns without adding the `'0x'` prefix.
+* `partition_include_schema_table` - (Optional) Prefixes schema and table names to partition values, when the partition type is `primary-key-type`. Doing this increases data distribution among Kafka partitions. For example, suppose that a SysBench schema has thousands of tables and each table has only limited range for a primary key. In this case, the same primary key is sent from thousands of tables to the same partition, which causes throttling. Default is `false`.
+* `sasl_password` - (Optional) Secure password you created when you first set up your MSK cluster to validate a client identity and make an encrypted connection between server and client using SASL-SSL authentication.
+* `sasl_username` - (Optional) Secure user name you created when you first set up your MSK cluster to validate a client identity and make an encrypted connection between server and client using SASL-SSL authentication.
+* `security_protocol` - (Optional) Set secure connection to a Kafka target endpoint using Transport Layer Security (TLS). Options include `ssl-encryption`, `ssl-authentication`, and `sasl-ssl`. `sasl-ssl` requires `sasl_username` and `sasl_password`.
+* `ssl_ca_certificate_arn` - (Optional) ARN for the private certificate authority (CA) cert that AWS DMS uses to securely connect to your Kafka target endpoint.
+* `ssl_client_certificate_arn` - (Optional) ARN of the client certificate used to securely connect to a Kafka target endpoint.
+* `ssl_client_key_arn` - (Optional) ARN for the client private key used to securely connect to a Kafka target endpoint.
+* `ssl_client_key_password` - (Optional) Password for the client private key used to securely connect to a Kafka target endpoint.
+* `topic` - (Optional) Kafka topic for migration. Default is `kafka-default-topic`.
+
+### kinesis_settings
+
+-> Additional information can be found in the [Using Amazon Kinesis Data Streams as a Target for AWS Database Migration Service documentation](https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Target.Kinesis.html).
+
+* `include_control_details` - (Optional) Shows detailed control information for table definition, column definition, and table and column changes in the Kinesis message output. Default is `false`.
+* `include_null_and_empty` - (Optional) Include NULL and empty columns in the target. Default is `false`.
+* `include_partition_value` - (Optional) Shows the partition value within the Kinesis message output, unless the partition type is schema-table-type. Default is `false`.
+* `include_table_alter_operations` - (Optional) Includes any data definition language (DDL) operations that change the table in the control data. Default is `false`.
+* `include_transaction_details` - (Optional) Provides detailed transaction information from the source database. Default is `false`.
+* `message_format` - (Optional) Output format for the records created. Default is `json`. Valid values are `json` and `json-unformatted` (a single line with no tab).
+* `partition_include_schema_table` - (Optional) Prefixes schema and table names to partition values, when the partition type is primary-key-type. Default is `false`.
+* `service_access_role_arn` - (Optional) ARN of the IAM Role with permissions to write to the Kinesis data stream.
+* `stream_arn` - (Optional) ARN of the Kinesis data stream.
+
+### mongodb_settings
+
+-> Additional information can be found in the [Using MongoDB as a Source for AWS DMS documentation](https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Source.MongoDB.html).
+
+* `auth_mechanism` - (Optional) Authentication mechanism to access the MongoDB source endpoint. Default is `default`.
+* `auth_source` - (Optional) Authentication database name. Not used when `auth_type` is `no`. Default is `admin`.
+* `auth_type` - (Optional) Authentication type to access the MongoDB source endpoint. Default is `password`.
+* `docs_to_investigate` - (Optional) Number of documents to preview to determine the document organization. Use this setting when `nesting_level` is set to `one`. Default is `1000`.
+* `extract_doc_id` - (Optional) Document ID. Use this setting when `nesting_level` is set to `none`. Default is `false`.
+* `nesting_level` - (Optional) Specifies either document or table mode. Default is `none`. Valid values are `one` (table mode) and `none` (document mode).
+
+### redis_settings
+
+-> Additional information can be found in the [Using Redis as a target for AWS Database Migration Service](https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Target.Redis.html).
+
+* `auth_password` - (Optional) The password provided with the auth-role and auth-token options of the AuthType setting for a Redis target endpoint.
+* `auth_type` - (Required) The type of authentication to perform when connecting to a Redis target. Options include `none`, `auth-token`, and `auth-role`. The `auth-token` option requires an `auth_password` value to be provided. The `auth-role` option requires `auth_user_name` and `auth_password` values to be provided.
+* `auth_user_name` - (Optional) The username provided with the `auth-role` option of the AuthType setting for a Redis target endpoint.
+* `server_name` - (Required) Fully qualified domain name of the endpoint.
+* `port` - (Required) Transmission Control Protocol (TCP) port for the endpoint.
+* `ssl_ca_certificate_arn` - (Optional) The Amazon Resource Name (ARN) for the certificate authority (CA) that DMS uses to connect to your Redis target endpoint.
+* `ssl_security_protocol`- (Optional) The plaintext option doesn't provide Transport Layer Security (TLS) encryption for traffic between endpoint and database. Options include `plaintext`, `ssl-encryption`. The default is `ssl-encryption`.
+
+### redshift_settings
+
+-> Additional information can be found in the [Using Amazon Redshift as a Target for AWS Database Migration Service documentation](https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Target.Redshift.html).
+
+* `bucket_folder` - (Optional) Custom S3 Bucket Object prefix for intermediate storage.
+* `bucket_name` - (Optional) Custom S3 Bucket name for intermediate storage.
+* `encryption_mode` - (Optional) The server-side encryption mode that you want to encrypt your intermediate .csv object files copied to S3. Defaults to `SSE_S3`. Valid values are `SSE_S3` and `SSE_KMS`.
+* `server_side_encryption_kms_key_id` - (Required when `encryption_mode` is  `SSE_KMS`, must not be set otherwise) ARN or Id of KMS Key to use when `encryption_mode` is `SSE_KMS`.
+* `service_access_role_arn` - (Optional) Amazon Resource Name (ARN) of the IAM Role with permissions to read from or write to the S3 Bucket for intermediate storage.
+
+### s3_settings
+
+~> **Deprecated:** This argument is deprecated, may not be maintained, and will be removed in a future version. Use the [`aws_dms_s3_endpoint`](/docs/providers/aws/r/dms_s3_endpoint.html) resource instead.
+
+-> Additional information can be found in the [Using Amazon S3 as a Source for AWS Database Migration Service documentation](https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Source.S3.html) and [Using Amazon S3 as a Target for AWS Database Migration Service documentation](https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Target.S3.html).
+
+* `add_column_name` - (Optional) Whether to add column name information to the .csv output file. Default is `false`.
+* `bucket_folder` - (Optional) S3 object prefix.
+* `bucket_name` - (Optional) S3 bucket name.
+* `canned_acl_for_objects` - (Optional) Predefined (canned) access control list for objects created in an S3 bucket. Valid values include `none`, `private`, `public-read`, `public-read-write`, `authenticated-read`, `aws-exec-read`, `bucket-owner-read`, and `bucket-owner-full-control`. Default is `none`.
+* `cdc_inserts_and_updates` - (Optional) Whether to write insert and update operations to .csv or .parquet output files. Default is `false`.
+* `cdc_inserts_only` - (Optional) Whether to write insert operations to .csv or .parquet output files. Default is `false`.
+* `cdc_max_batch_interval` - (Optional) Maximum length of the interval, defined in seconds, after which to output a file to Amazon S3. Default is `60`.
+* `cdc_min_file_size` - (Optional) Minimum file size condition as defined in kilobytes to output a file to Amazon S3. Default is `32000`. **NOTE:** Previously, this setting was measured in megabytes but now represents kilobytes. Update configurations accordingly.
+* `cdc_path` - (Optional) Folder path of CDC files. For an S3 source, this setting is required if a task captures change data; otherwise, it's optional. If `cdc_path` is set, AWS DMS reads CDC files from this path and replicates the data changes to the target endpoint. Supported in AWS DMS versions 3.4.2 and later.
+* `compression_type` - (Optional) Set to compress target files. Default is `NONE`. Valid values are `GZIP` and `NONE`.
+* `csv_delimiter` - (Optional) Delimiter used to separate columns in the source files. Default is `,`.
+* `csv_no_sup_value` - (Optional) String to use for all columns not included in the supplemental log.
+* `csv_null_value` - (Optional) String to as null when writing to the target.
+* `csv_row_delimiter` - (Optional) Delimiter used to separate rows in the source files. Default is `\n`.
+* `data_format` - (Optional) Output format for the files that AWS DMS uses to create S3 objects. Valid values are `csv` and `parquet`. Default is `csv`.
+* `data_page_size` - (Optional) Size of one data page in bytes. Default is `1048576` (1 MiB).
+* `date_partition_delimiter` - (Optional) Date separating delimiter to use during folder partitioning. Valid values are `SLASH`, `UNDERSCORE`, `DASH`, and `NONE`. Default is `SLASH`.
+* `date_partition_enabled` - (Optional) Partition S3 bucket folders based on transaction commit dates. Default is `false`.
+* `date_partition_sequence` - (Optional) Date format to use during folder partitioning. Use this parameter when `date_partition_enabled` is set to true. Valid values are `YYYYMMDD`, `YYYYMMDDHH`, `YYYYMM`, `MMYYYYDD`, and `DDMMYYYY`. Default is `YYYYMMDD`.
+* `dict_page_size_limit` - (Optional) Maximum size in bytes of an encoded dictionary page of a column. Default is `1048576` (1 MiB).
+* `enable_statistics` - (Optional) Whether to enable statistics for Parquet pages and row groups. Default is `true`.
+* `encoding_type` - (Optional) Type of encoding to use. Value values are `rle_dictionary`, `plain`, and `plain_dictionary`. Default is `rle_dictionary`.
+* `encryption_mode` - (Optional) Server-side encryption mode that you want to encrypt your .csv or .parquet object files copied to S3. Valid values are `SSE_S3` and `SSE_KMS`. Default is `SSE_S3`.
+* `external_table_definition` - (Optional) JSON document that describes how AWS DMS should interpret the data.
+* `glue_catalog_generation` - (Optional) Whether to integrate AWS Glue Data Catalog with an Amazon S3 target. See [Using AWS Glue Data Catalog with an Amazon S3 target for AWS DMS](https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Target.S3.html#CHAP_Target.S3.GlueCatalog) for more information. Default is `false`.
+* `ignore_header_rows` - (Optional) When this value is set to `1`, DMS ignores the first row header in a .csv file. Default is `0`.
+* `include_op_for_full_load` - (Optional) Whether to enable a full load to write INSERT operations to the .csv output files only to indicate how the rows were added to the source database. Default is `false`.
+* `max_file_size` - (Optional) Maximum size (in KB) of any .csv file to be created while migrating to an S3 target during full load. Valid values are from `1` to `1048576`. Default is `1048576` (1 GB).
+* `parquet_timestamp_in_millisecond` - (Optional) - Specifies the precision of any TIMESTAMP column values written to an S3 object file in .parquet format. Default is `false`.
+* `parquet_version` - (Optional) Version of the .parquet file format. Default is `parquet-1-0`. Valid values are `parquet-1-0` and `parquet-2-0`.
+* `preserve_transactions` - (Optional) Whether DMS saves the transaction order for a CDC load on the S3 target specified by `cdc_path`. Default is `false`.
+* `rfc_4180` - (Optional) For an S3 source, whether each leading double quotation mark has to be followed by an ending double quotation mark. Default is `true`.
+* `row_group_length` - (Optional) Number of rows in a row group. Default is `10000`.
+* `server_side_encryption_kms_key_id` - (Required when `encryption_mode` is  `SSE_KMS`, must not be set otherwise) ARN or Id of KMS Key to use when `encryption_mode` is `SSE_KMS`.
+* `service_access_role_arn` - (Optional) ARN of the IAM Role with permissions to read from or write to the S3 Bucket.
+* `timestamp_column_name` - (Optional) Column to add with timestamp information to the endpoint data for an Amazon S3 target.
+* `use_csv_no_sup_value` - (Optional) Whether to use `csv_no_sup_value` for columns not included in the supplemental log.
+* `use_task_start_time_for_full_load_timestamp` - (Optional) When set to true, uses the task start time as the timestamp column value instead of the time data is written to target. For full load, when set to true, each row of the timestamp column contains the task start time. For CDC loads, each row of the timestamp column contains the transaction commit time. When set to false, the full load timestamp in the timestamp column increments with the time data arrives at the target. Default is `false`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `endpoint_arn` - ARN for the endpoint.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `5m`)
+- `delete` - (Default `10m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import endpoints using the `endpoint_id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import endpoints using the `endpoint_id`. For example:
+
+```console
+% terraform import aws_dms_endpoint.test test-dms-endpoint-tf
+```
+
+<!-- cache-key: cdktf-0.18.0 input-f2f58fcc9fc681dd781d8464906ff4fb32f765c99816410fe344b23200d8740a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/dms_event_subscription.html.markdown b/website/docs/cdktf/python/r/dms_event_subscription.html.markdown
new file mode 100644
index 00000000000..b947add35e0
--- /dev/null
+++ b/website/docs/cdktf/python/r/dms_event_subscription.html.markdown
@@ -0,0 +1,90 @@
+---
+subcategory: "DMS (Database Migration)"
+layout: "aws"
+page_title: "AWS: aws_dms_event_subscription"
+description: |-
+  Provides a DMS (Data Migration Service) event subscription resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_dms_event_subscription
+
+Provides a DMS (Data Migration Service) event subscription resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.dms_event_subscription import DmsEventSubscription
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DmsEventSubscription(self, "example",
+            enabled=True,
+            event_categories=["creation", "failure"],
+            name="my-favorite-event-subscription",
+            sns_topic_arn=Token.as_string(aws_sns_topic_example.arn),
+            source_ids=[
+                Token.as_string(aws_dms_replication_task_example.replication_task_id)
+            ],
+            source_type="replication-task",
+            tags={
+                "Name": "example"
+            }
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) Name of event subscription.
+* `enabled` - (Optional, Default: true) Whether the event subscription should be enabled.
+* `event_categories` - (Optional) List of event categories to listen for, see `DescribeEventCategories` for a canonical list.
+* `source_type` - (Optional, Default: all events) Type of source for events. Valid values: `replication-instance` or `replication-task`
+* `source_ids` - (Required) Ids of sources to listen to.
+* `sns_topic_arn` - (Required) SNS topic arn to send events on.
+* `tags` - (Optional) Map of resource tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the DMS Event Subscription.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `10m`)
+- `update` - (Default `10m`)
+- `delete` - (Default `10m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import event subscriptions using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import event subscriptions using the `name`. For example:
+
+```console
+% terraform import aws_dms_event_subscription.test my-awesome-event-subscription
+```
+
+<!-- cache-key: cdktf-0.18.0 input-8fddb59943e1aef59e7d893b468b8a5bb1e2486c31cb4b972078535d91348ad6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/dms_replication_config.html.markdown b/website/docs/cdktf/python/r/dms_replication_config.html.markdown
new file mode 100644
index 00000000000..b38079d6567
--- /dev/null
+++ b/website/docs/cdktf/python/r/dms_replication_config.html.markdown
@@ -0,0 +1,116 @@
+---
+subcategory: "DMS (Database Migration)"
+layout: "aws"
+page_title: "AWS: aws_dms_replication_config"
+description: |-
+  Provides a DMS Serverless replication config resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_dms_replication_config
+
+Provides a DMS Serverless replication config resource.
+
+~> **NOTE:** Changing most arguments will stop the replication if it is running. You can set `start_replication` to resume the replication afterwards.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.dms_replication_config import DmsReplicationConfig
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DmsReplicationConfig(self, "name",
+            compute_config=DmsReplicationConfigComputeConfig(
+                max_capacity_units=Token.as_number("64"),
+                min_capacity_units=Token.as_number("2"),
+                preferred_maintenance_window="sun:23:45-mon:00:30",
+                replication_subnet_group_id=default_var.replication_subnet_group_id
+            ),
+            replication_config_identifier="test-dms-serverless-replication-tf",
+            replication_type="cdc",
+            resource_identifier="test-dms-serverless-replication-tf",
+            source_endpoint_arn=source.endpoint_arn,
+            start_replication=True,
+            table_mappings="  {\n    \"rules\":[{\"rule-type\":\"selection\",\"rule-id\":\"1\",\"rule-name\":\"1\",\"object-locator\":{\"schema-name\":\"%%\",\"table-name\":\"%%\", \"rule-action\":\"include\"}]\n  }\n\n",
+            target_endpoint_arn=target.endpoint_arn
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `compute_config` - (Required) Configuration block for provisioning an DMS Serverless replication.
+* `start_replication` - (Optional) Whether to run or stop the serverless replication, default is false.
+* `replication_config_identifier` - (Required) Unique identifier that you want to use to create the config.
+* `replication_type` - (Required) The migration type. Can be one of `full-load | cdc | full-load-and-cdc`.
+* `source_endpoint_arn` - (Required) The Amazon Resource Name (ARN) string that uniquely identifies the source endpoint.
+* `table_mappings` - (Required) An escaped JSON string that contains the table mappings. For information on table mapping see [Using Table Mapping with an AWS Database Migration Service Task to Select and Filter Data](http://docs.aws.amazon.com/dms/latest/userguide/CHAP_Tasks.CustomizingTasks.TableMapping.html)
+* `target_endpoint_arn` - (Required) The Amazon Resource Name (ARN) string that uniquely identifies the target endpoint.
+* `replication_settings` - (Optional) An escaped JSON string that are used to provision this replication configuration. For example, [Change processing tuning settings](https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Tasks.CustomizingTasks.TaskSettings.ChangeProcessingTuning.html)
+* `resource_identifier` - (Optional) Unique value or name that you set for a given resource that can be used to construct an Amazon Resource Name (ARN) for that resource. For more information, see [Fine-grained access control using resource names and tags](https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Security.html#CHAP_Security.FineGrainedAccess)
+* `supplemental_settings` - (Optional) JSON settings for specifying supplemental data. For more information see [Specifying supplemental data for task settings](https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Tasks.TaskData.html)
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+`compute_config` block support the following:
+
+* `availability_zone` - (Optional) The Availability Zone where the DMS Serverless replication using this configuration will run. The default value is a random.
+* `dns_name_servers` - (Optional) A list of custom DNS name servers supported for the DMS Serverless replication to access your source or target database.
+* `kms_key_id` - (Optional) An Key Management Service (KMS) key Amazon Resource Name (ARN) that is used to encrypt the data during DMS Serverless replication. If you don't specify a value for the KmsKeyId parameter, DMS uses your default encryption key.
+* `max_capacity_units` - (Required) Specifies the maximum value of the DMS capacity units (DCUs) for which a given DMS Serverless replication can be provisioned. A single DCU is 2GB of RAM, with 2 DCUs as the minimum value allowed. The list of valid DCU values includes 2, 4, 8, 16, 32, 64, 128, 192, 256, and 384.
+* `min_capacity_units` - (Optional) Specifies the minimum value of the DMS capacity units (DCUs) for which a given DMS Serverless replication can be provisioned. The list of valid DCU values includes 2, 4, 8, 16, 32, 64, 128, 192, 256, and 384. If this value isn't set DMS scans the current activity of available source tables to identify an optimum setting for this parameter.
+* `multi_az` - (Optional) Specifies if the replication instance is a multi-az deployment. You cannot set the `availability_zone` parameter if the `multi_az` parameter is set to `true`.
+* `preferred_maintenance_window` - (Optional) The weekly time range during which system maintenance can occur, in Universal Coordinated Time (UTC).
+
+    - Default: A 30-minute window selected at random from an 8-hour block of time per region, occurring on a random day of the week.
+    - Format: `ddd:hh24:mi-ddd:hh24:mi`
+    - Valid Days: `mon, tue, wed, thu, fri, sat, sun`
+    - Constraints: Minimum 30-minute window.
+
+* `replication_subnet_group_id` - (Optional) Specifies a subnet group identifier to associate with the DMS Serverless replication.
+* `vpc_security_group_ids` - (Optional) Specifies the virtual private cloud (VPC) security group to use with the DMS Serverless replication. The VPC security group must work with the VPC containing the replication.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) for the serverless replication config.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `60m`)
+* `update` - (Default `60m`)
+* `delete` - (Default `60m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import replication configs using the `arn`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import a replication config using the `arn`. For example:
+
+```console
+% terraform import aws_dms_replication_config.example arn:aws:dms:us-east-1:123456789012:replication-config:UX6OL6MHMMJKFFOXE3H7LLJCMEKBDUG4ZV7DRSI
+```
+
+<!-- cache-key: cdktf-0.18.0 input-d8fd85468f8a4bdafb679d4023f27b854c796261291e1127611bbb9de03be1ef -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/dms_replication_instance.html.markdown b/website/docs/cdktf/python/r/dms_replication_instance.html.markdown
new file mode 100644
index 00000000000..4e57a61cec4
--- /dev/null
+++ b/website/docs/cdktf/python/r/dms_replication_instance.html.markdown
@@ -0,0 +1,162 @@
+---
+subcategory: "DMS (Database Migration)"
+layout: "aws"
+page_title: "AWS: aws_dms_replication_instance"
+description: |-
+  Provides a DMS (Data Migration Service) replication instance resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_dms_replication_instance
+
+Provides a DMS (Data Migration Service) replication instance resource. DMS replication instances can be created, updated, deleted, and imported.
+
+## Example Usage
+
+Create required roles and then create a DMS instance, setting the depends_on to the required role policy attachments.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.dms_replication_instance import DmsReplicationInstance
+from imports.aws.iam_role import IamRole
+from imports.aws.iam_role_policy_attachment import IamRolePolicyAttachment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        dms_assume_role = DataAwsIamPolicyDocument(self, "dms_assume_role",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["sts:AssumeRole"],
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["dms.amazonaws.com"],
+                    type="Service"
+                )
+                ]
+            )
+            ]
+        )
+        dms_access_for_endpoint = IamRole(self, "dms-access-for-endpoint",
+            assume_role_policy=Token.as_string(dms_assume_role.json),
+            name="dms-access-for-endpoint"
+        )
+        dms_cloudwatch_logs_role = IamRole(self, "dms-cloudwatch-logs-role",
+            assume_role_policy=Token.as_string(dms_assume_role.json),
+            name="dms-cloudwatch-logs-role"
+        )
+        dms_vpc_role = IamRole(self, "dms-vpc-role",
+            assume_role_policy=Token.as_string(dms_assume_role.json),
+            name="dms-vpc-role"
+        )
+        dms_access_for_endpoint_amazon_dms_redshift_s3_role =
+        IamRolePolicyAttachment(self, "dms-access-for-endpoint-AmazonDMSRedshiftS3Role",
+            policy_arn="arn:aws:iam::aws:policy/service-role/AmazonDMSRedshiftS3Role",
+            role=dms_access_for_endpoint.name
+        )
+        dms_cloudwatch_logs_role_amazon_dms_cloud_watch_logs_role =
+        IamRolePolicyAttachment(self, "dms-cloudwatch-logs-role-AmazonDMSCloudWatchLogsRole",
+            policy_arn="arn:aws:iam::aws:policy/service-role/AmazonDMSCloudWatchLogsRole",
+            role=dms_cloudwatch_logs_role.name
+        )
+        dms_vpc_role_amazon_dmsvpc_management_role = IamRolePolicyAttachment(self, "dms-vpc-role-AmazonDMSVPCManagementRole",
+            policy_arn="arn:aws:iam::aws:policy/service-role/AmazonDMSVPCManagementRole",
+            role=dms_vpc_role.name
+        )
+        DmsReplicationInstance(self, "test",
+            allocated_storage=20,
+            apply_immediately=True,
+            auto_minor_version_upgrade=True,
+            availability_zone="us-west-2c",
+            depends_on=[dms_access_for_endpoint_amazon_dms_redshift_s3_role, dms_cloudwatch_logs_role_amazon_dms_cloud_watch_logs_role, dms_vpc_role_amazon_dmsvpc_management_role
+            ],
+            engine_version="3.1.4",
+            kms_key_arn="arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012",
+            multi_az=False,
+            preferred_maintenance_window="sun:10:30-sun:14:30",
+            publicly_accessible=True,
+            replication_instance_class="dms.t2.micro",
+            replication_instance_id="test-dms-replication-instance-tf",
+            replication_subnet_group_id=test_dms_replication_subnet_group_tf.id,
+            tags={
+                "Name": "test"
+            },
+            vpc_security_group_ids=["sg-12345678"]
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `allocated_storage` - (Optional, Default: 50, Min: 5, Max: 6144) The amount of storage (in gigabytes) to be initially allocated for the replication instance.
+* `allow_major_version_upgrade` - (Optional, Default: false) Indicates that major version upgrades are allowed.
+* `apply_immediately` - (Optional, Default: false) Indicates whether the changes should be applied immediately or during the next maintenance window. Only used when updating an existing resource.
+* `auto_minor_version_upgrade` - (Optional, Default: false) Indicates that minor engine upgrades will be applied automatically to the replication instance during the maintenance window.
+* `availability_zone` - (Optional) The EC2 Availability Zone that the replication instance will be created in.
+* `engine_version` - (Optional) The engine version number of the replication instance.
+* `kms_key_arn` - (Optional) The Amazon Resource Name (ARN) for the KMS key that will be used to encrypt the connection parameters. If you do not specify a value for `kms_key_arn`, then AWS DMS will use your default encryption key. AWS KMS creates the default encryption key for your AWS account. Your AWS account has a different default encryption key for each AWS region.
+* `multi_az` - (Optional) Specifies if the replication instance is a multi-az deployment. You cannot set the `availability_zone` parameter if the `multi_az` parameter is set to `true`.
+* `network_type` - (Optional) The type of IP address protocol used by a replication instance. Valid values: `IPV4`, `DUAL`.
+* `preferred_maintenance_window` - (Optional) The weekly time range during which system maintenance can occur, in Universal Coordinated Time (UTC).
+
+    - Default: A 30-minute window selected at random from an 8-hour block of time per region, occurring on a random day of the week.
+    - Format: `ddd:hh24:mi-ddd:hh24:mi`
+    - Valid Days: `mon, tue, wed, thu, fri, sat, sun`
+    - Constraints: Minimum 30-minute window.
+
+* `publicly_accessible` - (Optional, Default: false) Specifies the accessibility options for the replication instance. A value of true represents an instance with a public IP address. A value of false represents an instance with a private IP address.
+* `replication_instance_class` - (Required) The compute and memory capacity of the replication instance as specified by the replication instance class. See [AWS DMS User Guide](https://docs.aws.amazon.com/dms/latest/userguide/CHAP_ReplicationInstance.Types.html) for available instance sizes and advice on which one to choose.
+* `replication_instance_id` - (Required) The replication instance identifier. This parameter is stored as a lowercase string.
+
+    - Must contain from 1 to 63 alphanumeric characters or hyphens.
+    - First character must be a letter.
+    - Cannot end with a hyphen
+    - Cannot contain two consecutive hyphens.
+
+* `replication_subnet_group_id` - (Optional) A subnet group to associate with the replication instance.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `vpc_security_group_ids` - (Optional) A list of VPC security group IDs to be used with the replication instance. The VPC security groups must work with the VPC containing the replication instance.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `replication_instance_arn` - The Amazon Resource Name (ARN) of the replication instance.
+* `replication_instance_private_ips` -  A list of the private IP addresses of the replication instance.
+* `replication_instance_public_ips` - A list of the public IP addresses of the replication instance.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `40m`)
+- `update` - (Default `30m`)
+- `delete` - (Default `30m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import replication instances using the `replication_instance_id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import replication instances using the `replication_instance_id`. For example:
+
+```console
+% terraform import aws_dms_replication_instance.test test-dms-replication-instance-tf
+```
+
+<!-- cache-key: cdktf-0.18.0 input-2a8ab503ceaef9d74fa0c9b95408ac59f3a841f451a3553fdde42db11c32ef45 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/dms_replication_subnet_group.html.markdown b/website/docs/cdktf/python/r/dms_replication_subnet_group.html.markdown
new file mode 100644
index 00000000000..bf4aa4db783
--- /dev/null
+++ b/website/docs/cdktf/python/r/dms_replication_subnet_group.html.markdown
@@ -0,0 +1,137 @@
+---
+subcategory: "DMS (Database Migration)"
+layout: "aws"
+page_title: "AWS: aws_dms_replication_subnet_group"
+description: |-
+  Provides a DMS (Data Migration Service) subnet group resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_dms_replication_subnet_group
+
+Provides a DMS (Data Migration Service) replication subnet group resource. DMS replication subnet groups can be created, updated, deleted, and imported.
+
+~> **Note:** AWS requires a special IAM role called `dms-vpc-role` when using this resource. See the example below to create it as part of your configuration.
+
+## Example Usage
+
+### Basic
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.dms_replication_subnet_group import DmsReplicationSubnetGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DmsReplicationSubnetGroup(self, "example",
+            replication_subnet_group_description="Example replication subnet group",
+            replication_subnet_group_id="example-dms-replication-subnet-group-tf",
+            subnet_ids=["subnet-12345678", "subnet-12345679"],
+            tags={
+                "Name": "example"
+            }
+        )
+```
+
+### Creating special IAM role
+
+If your account does not already include the `dms-vpc-role` IAM role, you will need to create it to allow DMS to manage subnets in the VPC.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.dms_replication_subnet_group import DmsReplicationSubnetGroup
+from imports.aws.iam_role import IamRole
+from imports.aws.iam_role_policy_attachment import IamRolePolicyAttachment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        dms_vpc_role = IamRole(self, "dms-vpc-role",
+            assume_role_policy=Token.as_string(
+                Fn.jsonencode({
+                    "Statement": [{
+                        "Action": "sts:AssumeRole",
+                        "Effect": "Allow",
+                        "Principal": {
+                            "Service": "dms.amazonaws.com"
+                        }
+                    }
+                    ],
+                    "Version": "2012-10-17"
+                })),
+            description="Allows DMS to manage VPC",
+            name="dms-vpc-role"
+        )
+        example = IamRolePolicyAttachment(self, "example",
+            policy_arn="arn:aws:iam::aws:policy/service-role/AmazonDMSVPCManagementRole",
+            role=dms_vpc_role.name
+        )
+        aws_dms_replication_subnet_group_example = DmsReplicationSubnetGroup(self, "example_2",
+            depends_on=[example],
+            replication_subnet_group_description="Example",
+            replication_subnet_group_id="example-id",
+            subnet_ids=["subnet-12345678", "subnet-12345679"],
+            tags={
+                "Name": "example-id"
+            }
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_dms_replication_subnet_group_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `replication_subnet_group_description` - (Required) Description for the subnet group.
+* `replication_subnet_group_id` - (Required) Name for the replication subnet group. This value is stored as a lowercase string. It must contain no more than 255 alphanumeric characters, periods, spaces, underscores, or hyphens and cannot be `default`.
+* `subnet_ids` - (Required) List of at least 2 EC2 subnet IDs for the subnet group. The subnets must cover at least 2 availability zones.
+* `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `vpc_id` - The ID of the VPC the subnet group is in.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `15m`)
+- `update` - (Default `15m`)
+- `delete` - (Default `15m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import replication subnet groups using the `replication_subnet_group_id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import replication subnet groups using the `replication_subnet_group_id`. For example:
+
+```console
+% terraform import aws_dms_replication_subnet_group.test test-dms-replication-subnet-group-tf
+```
+
+<!-- cache-key: cdktf-0.18.0 input-fa31dcade703f4d670cd66caa1d006a3088f31feb8196071fd288c511faec143 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/dms_replication_task.html.markdown b/website/docs/cdktf/python/r/dms_replication_task.html.markdown
new file mode 100644
index 00000000000..2d1636a9c80
--- /dev/null
+++ b/website/docs/cdktf/python/r/dms_replication_task.html.markdown
@@ -0,0 +1,95 @@
+---
+subcategory: "DMS (Database Migration)"
+layout: "aws"
+page_title: "AWS: aws_dms_replication_task"
+description: |-
+  Provides a DMS (Data Migration Service) replication task resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_dms_replication_task
+
+Provides a DMS (Data Migration Service) replication task resource. DMS replication tasks can be created, updated, deleted, and imported.
+
+~> **NOTE:** Changing most arguments will stop the task if it is running. You can set `start_replication_task` to resume the task afterwards.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.dms_replication_task import DmsReplicationTask
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DmsReplicationTask(self, "test",
+            cdc_start_time=Token.as_string(1484346880),
+            migration_type="full-load",
+            replication_instance_arn=test_dms_replication_instance_tf.replication_instance_arn,
+            replication_task_id="test-dms-replication-task-tf",
+            replication_task_settings="...",
+            source_endpoint_arn=test_dms_source_endpoint_tf.endpoint_arn,
+            table_mappings="{\\\"rules\\\":[{\\\"rule-type\\\":\\\"selection\\\",\\\"rule-id\\\":\\\"1\\\",\\\"rule-name\\\":\\\"1\\\",\\\"object-locator\\\":{\\\"schema-name\\\":\\\"%\\\",\\\"table-name\\\":\\\"%\\\"},\\\"rule-action\\\":\\\"include\\\"}]}",
+            tags={
+                "Name": "test"
+            },
+            target_endpoint_arn=test_dms_target_endpoint_tf.endpoint_arn
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `cdc_start_position` - (Optional, Conflicts with `cdc_start_time`) Indicates when you want a change data capture (CDC) operation to start. The value can be in date, checkpoint, or LSN/SCN format depending on the source engine. For more information, see [Determining a CDC native start point](https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Task.CDC.html#CHAP_Task.CDC.StartPoint.Native).
+* `cdc_start_time` - (Optional, Conflicts with `cdc_start_position`) The Unix timestamp integer for the start of the Change Data Capture (CDC) operation.
+* `migration_type` - (Required) The migration type. Can be one of `full-load | cdc | full-load-and-cdc`.
+* `replication_instance_arn` - (Required) The Amazon Resource Name (ARN) of the replication instance.
+* `replication_task_id` - (Required) The replication task identifier.
+
+    - Must contain from 1 to 255 alphanumeric characters or hyphens.
+    - First character must be a letter.
+    - Cannot end with a hyphen.
+    - Cannot contain two consecutive hyphens.
+
+* `replication_task_settings` - (Optional) An escaped JSON string that contains the task settings. For a complete list of task settings, see [Task Settings for AWS Database Migration Service Tasks](http://docs.aws.amazon.com/dms/latest/userguide/CHAP_Tasks.CustomizingTasks.TaskSettings.html).
+* `source_endpoint_arn` - (Required) The Amazon Resource Name (ARN) string that uniquely identifies the source endpoint.
+* `start_replication_task` - (Optional) Whether to run or stop the replication task.
+* `table_mappings` - (Required) An escaped JSON string that contains the table mappings. For information on table mapping see [Using Table Mapping with an AWS Database Migration Service Task to Select and Filter Data](http://docs.aws.amazon.com/dms/latest/userguide/CHAP_Tasks.CustomizingTasks.TableMapping.html)
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `target_endpoint_arn` - (Required) The Amazon Resource Name (ARN) string that uniquely identifies the target endpoint.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `replication_task_arn` - The Amazon Resource Name (ARN) for the replication task.
+* `status` - Replication Task status.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import replication tasks using the `replication_task_id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import replication tasks using the `replication_task_id`. For example:
+
+```console
+% terraform import aws_dms_replication_task.test test-dms-replication-task-tf
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1c6fdf5f04f2d2b7b3a680bdf7b1130eb1a4ca982a963ef8d0d3f17d5c86acbb -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/dms_s3_endpoint.html.markdown b/website/docs/cdktf/python/r/dms_s3_endpoint.html.markdown
new file mode 100644
index 00000000000..37b567f3bee
--- /dev/null
+++ b/website/docs/cdktf/python/r/dms_s3_endpoint.html.markdown
@@ -0,0 +1,206 @@
+---
+subcategory: "DMS (Database Migration)"
+layout: "aws"
+page_title: "AWS: aws_dms_s3_endpoint"
+description: |-
+  Provides a DMS (Data Migration Service) S3 endpoint resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_dms_s3_endpoint
+
+Provides a DMS (Data Migration Service) S3 endpoint resource. DMS S3 endpoints can be created, updated, deleted, and imported.
+
+~> **Note:** AWS is deprecating `extra_connection_attributes`, such as used with `aws_dms_endpoint`. This resource is an alternative to `aws_dms_endpoint` and does not use `extra_connection_attributes`. (AWS currently includes `extra_connection_attributes` in the raw responses to the AWS Provider requests and so they may be visible in Terraform logs.)
+
+~> **Note:** Some of this resource's arguments have default values that come from the AWS Provider. Other default values are provided by AWS and subject to change without notice. When relying on AWS defaults, the Terraform state will often have a zero value. For example, the AWS Provider does not provide a default for `cdc_max_batch_interval` but the AWS default is `60` (seconds). However, the Terraform state will show `0` since this is the value return by AWS when no value is present. Below, we aim to flag the defaults that come from AWS (_e.g._, "AWS default...").
+
+## Example Usage
+
+### Minimal Configuration
+
+This is the minimal configuration for an `aws_dms_s3_endpoint`. This endpoint will rely on the AWS Provider and AWS defaults.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.dms_s3_endpoint import DmsS3Endpoint
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DmsS3Endpoint(self, "example",
+            bucket_name="beckut_name",
+            depends_on=[aws_iam_role_policy_example],
+            endpoint_id="donnedtipi",
+            endpoint_type="target",
+            service_access_role_arn=Token.as_string(aws_iam_role_example.arn)
+        )
+```
+
+### Complete Configuration
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.dms_s3_endpoint import DmsS3Endpoint
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DmsS3Endpoint(self, "example",
+            add_column_name=True,
+            add_trailing_padding_character=False,
+            bucket_folder="folder",
+            bucket_name="bucket_name",
+            canned_acl_for_objects="private",
+            cdc_inserts_and_updates=True,
+            cdc_inserts_only=False,
+            cdc_max_batch_interval=100,
+            cdc_min_file_size=16,
+            cdc_path="cdc/path",
+            compression_type="GZIP",
+            csv_delimiter=";",
+            csv_no_sup_value="x",
+            csv_null_value="?",
+            csv_row_delimiter="\\r\\n",
+            data_format="parquet",
+            data_page_size=1100000,
+            date_partition_delimiter="UNDERSCORE",
+            date_partition_enabled=True,
+            date_partition_sequence="yyyymmddhh",
+            date_partition_timezone="Asia/Seoul",
+            depends_on=[aws_iam_role_policy_example],
+            dict_page_size_limit=1000000,
+            enable_statistics=False,
+            encoding_type="plain",
+            encryption_mode="SSE_S3",
+            endpoint_id="donnedtipi",
+            endpoint_type="target",
+            expected_bucket_owner=Token.as_string(current.account_id),
+            external_table_definition="etd",
+            glue_catalog_generation=True,
+            ignore_header_rows=1,
+            include_op_for_full_load=True,
+            max_file_size=1000000,
+            parquet_timestamp_in_millisecond=True,
+            parquet_version="parquet-2-0",
+            preserve_transactions=False,
+            rfc4180=False,
+            row_group_length=11000,
+            server_side_encryption_kms_key_id=Token.as_string(aws_kms_key_example.arn),
+            service_access_role_arn=Token.as_string(aws_iam_role_example.arn),
+            ssl_mode="none",
+            tags={
+                "Name": "donnedtipi",
+                "Remove": "to-remove",
+                "Update": "to-update"
+            },
+            timestamp_column_name="tx_commit_time",
+            use_csv_no_sup_value=False,
+            use_task_start_time_for_full_load_timestamp=True
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `bucket_name` - (Required) S3 bucket name.
+* `cdc_path` - (Required for CDC; otherwise, Optional) Folder path of CDC files. If `cdc_path` is set, AWS DMS reads CDC files from this path and replicates the data changes to the target endpoint. Supported in AWS DMS versions 3.4.2 and later.
+* `endpoint_id` - (Required) Database endpoint identifier. Identifiers must contain from 1 to 255 alphanumeric characters or hyphens, begin with a letter, contain only ASCII letters, digits, and hyphens, not end with a hyphen, and not contain two consecutive hyphens.
+* `endpoint_type` - (Required) Type of endpoint. Valid values are `source`, `target`.
+* `external_table_definition` - (Required for `source` endpoints; otherwise, Optional) JSON document that describes how AWS DMS should interpret the data.
+* `service_access_role_arn` - (Required) ARN of the IAM role with permissions to the S3 Bucket.
+
+The following arguments are optional:
+
+* `add_column_name` - (Optional) Whether to add column name information to the .csv output file. Default is `false`.
+* `add_trailing_padding_character` - (Optional) Whether to add padding. Default is `false`. (Ignored for source endpoints.)
+* `bucket_folder` - (Optional) S3 object prefix.
+* `canned_acl_for_objects` - (Optional) Predefined (canned) access control list for objects created in an S3 bucket. Valid values include `none`, `private`, `public-read`, `public-read-write`, `authenticated-read`, `aws-exec-read`, `bucket-owner-read`, and `bucket-owner-full-control`. Default is `none`.
+* `cdc_inserts_and_updates` - (Optional) Whether to write insert and update operations to .csv or .parquet output files. Default is `false`.
+* `cdc_inserts_only` - (Optional) Whether to write insert operations to .csv or .parquet output files. Default is `false`.
+* `cdc_max_batch_interval` - (Optional) Maximum length of the interval, defined in seconds, after which to output a file to Amazon S3. (AWS default is `60`.)
+* `cdc_min_file_size` - (Optional) Minimum file size condition as defined in kilobytes to output a file to Amazon S3. (AWS default is 32000 KB.)
+* `certificate_arn` - (Optional, Default: empty string) ARN for the certificate.
+* `compression_type` - (Optional) Set to compress target files. Valid values are `GZIP` and `NONE`. Default is `NONE`. (Ignored for source endpoints.)
+* `csv_delimiter` - (Optional) Delimiter used to separate columns in the source files. Default is `,`.
+* `csv_no_sup_value` - (Optional) Only applies if output files for a CDC load are written in .csv format. If `use_csv_no_sup_value` is set to `true`, string to use for all columns not included in the supplemental log. If you do not specify a string value, DMS uses the null value for these columns regardless of `use_csv_no_sup_value`. (Ignored for source endpoints.)
+* `csv_null_value` - (Optional) String to as null when writing to the target. (AWS default is `NULL`.)
+* `csv_row_delimiter` - (Optional) Delimiter used to separate rows in the source files. Default is newline (_i.e._, `\n`).
+* `data_format` - (Optional) Output format for the files that AWS DMS uses to create S3 objects. Valid values are `csv` and `parquet`.  (Ignored for source endpoints -- only `csv` is valid.)
+* `data_page_size` - (Optional) Size of one data page in bytes. (AWS default is 1 MiB, _i.e._, `1048576`.)
+* `date_partition_delimiter` - (Optional) Date separating delimiter to use during folder partitioning. Valid values are `SLASH`, `UNDERSCORE`, `DASH`, and `NONE`. (AWS default is `SLASH`.) (Ignored for source endpoints.)
+* `date_partition_enabled` - (Optional) Partition S3 bucket folders based on transaction commit dates. Default is `false`. (Ignored for source endpoints.)
+* `date_partition_sequence` - (Optional) Date format to use during folder partitioning. Use this parameter when `date_partition_enabled` is set to true. Valid values are `YYYYMMDD`, `YYYYMMDDHH`, `YYYYMM`, `MMYYYYDD`, and `DDMMYYYY`. (AWS default is `YYYYMMDD`.) (Ignored for source endpoints.)
+* `date_partition_timezone` - (Optional) Convert the current UTC time to a timezone. The conversion occurs when a date partition folder is created and a CDC filename is generated. The timezone format is Area/Location (_e.g._, `Europe/Paris`). Use this when `date_partition_enabled` is `true`. (Ignored for source endpoints.)
+* `detach_target_on_lob_lookup_failure_parquet` - (Optional) Undocumented argument for use as directed by AWS Support.
+* `dict_page_size_limit` - (Optional) Maximum size in bytes of an encoded dictionary page of a column. (AWS default is 1 MiB, _i.e._, `1048576`.)
+* `enable_statistics` - (Optional) Whether to enable statistics for Parquet pages and row groups. Default is `true`.
+* `encoding_type` - (Optional) Type of encoding to use. Value values are `rle_dictionary`, `plain`, and `plain_dictionary`. (AWS default is `rle_dictionary`.)
+* `encryption_mode` - (Optional) Server-side encryption mode that you want to encrypt your .csv or .parquet object files copied to S3. Valid values are `SSE_S3` and `SSE_KMS`. (AWS default is `SSE_S3`.) (Ignored for source endpoints -- only `SSE_S3` is valid.)
+* `expected_bucket_owner` - (Optional) Bucket owner to prevent sniping. Value is an AWS account ID.
+* `glue_catalog_generation` - (Optional) Whether to integrate AWS Glue Data Catalog with an Amazon S3 target. See [Using AWS Glue Data Catalog with an Amazon S3 target for AWS DMS](https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Target.S3.html#CHAP_Target.S3.GlueCatalog) for more information. Default is `false`.
+* `ignore_header_rows` - (Optional, Force New) When this value is set to `1`, DMS ignores the first row header in a .csv file. (AWS default is `0`.)
+* `include_op_for_full_load` - (Optional) Whether to enable a full load to write INSERT operations to the .csv output files only to indicate how the rows were added to the source database. Default is `false`.
+* `kms_key_arn` - (Optional) ARN for the KMS key that will be used to encrypt the connection parameters. If you do not specify a value for `kms_key_arn`, then AWS DMS will use your default encryption key. AWS KMS creates the default encryption key for your AWS account. Your AWS account has a different default encryption key for each AWS region.
+* `max_file_size` - (Optional) Maximum size (in KB) of any .csv file to be created while migrating to an S3 target during full load. Valid values are from `1` to `1048576`. (AWS default is 1 GB, _i.e._, `1048576`.)
+* `parquet_timestamp_in_millisecond` - (Optional) - Specifies the precision of any TIMESTAMP column values written to an S3 object file in .parquet format. Default is `false`. (Ignored for source endpoints.)
+* `parquet_version` - (Optional) Version of the .parquet file format. Valid values are `parquet-1-0` and `parquet-2-0`. (AWS default is `parquet-1-0`.) (Ignored for source endpoints.)
+* `preserve_transactions` - (Optional) Whether DMS saves the transaction order for a CDC load on the S3 target specified by `cdc_path`. Default is `false`. (Ignored for source endpoints.)
+* `rfc_4180` - (Optional) For an S3 source, whether each leading double quotation mark has to be followed by an ending double quotation mark. Default is `true`.
+* `row_group_length` - (Optional) Number of rows in a row group. (AWS default is `10000`.)
+* `server_side_encryption_kms_key_id` - (Optional) When `encryption_mode` is `SSE_KMS`, ARN for the AWS KMS key. (Ignored for source endpoints -- only `SSE_S3` `encryption_mode` is valid.)
+* `ssl_mode` - (Optional) SSL mode to use for the connection. Valid values are `none`, `require`, `verify-ca`, `verify-full`. (AWS default is `none`.)
+* `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `timestamp_column_name` - (Optional) Column to add with timestamp information to the endpoint data for an Amazon S3 target.
+* `use_csv_no_sup_value` - (Optional) Whether to use `csv_no_sup_value` for columns not included in the supplemental log. (Ignored for source endpoints.)
+* `use_task_start_time_for_full_load_timestamp` - (Optional) When set to `true`, uses the task start time as the timestamp column value instead of the time data is written to target. For full load, when set to `true`, each row of the timestamp column contains the task start time. For CDC loads, each row of the timestamp column contains the transaction commit time.When set to false, the full load timestamp in the timestamp column increments with the time data arrives at the target. Default is `false`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `endpoint_arn` - ARN for the endpoint.
+* `engine_display_name` - Expanded name for the engine name.
+* `external_id` - Can be used for cross-account validation. Use it in another account with `aws_dms_s3_endpoint` to create the endpoint cross-account.
+* `status` - Status of the endpoint.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `5m`)
+- `delete` - (Default `5m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import endpoints using the `endpoint_id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import endpoints using the `endpoint_id`. For example:
+
+```console
+% terraform import aws_dms_s3_endpoint.example example-dms-endpoint-tf
+```
+
+<!-- cache-key: cdktf-0.18.0 input-5a916eee3e75e7c52d38f0617e6cc2027169298f0d0789be4639e960826d0ab3 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/docdb_cluster.html.markdown b/website/docs/cdktf/python/r/docdb_cluster.html.markdown
new file mode 100644
index 00000000000..cbde10be1e8
--- /dev/null
+++ b/website/docs/cdktf/python/r/docdb_cluster.html.markdown
@@ -0,0 +1,134 @@
+---
+subcategory: "DocumentDB"
+layout: "aws"
+page_title: "AWS: aws_docdb_cluster"
+description: |-
+  Manages a DocumentDB Aurora Cluster
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_docdb_cluster
+
+Manages a DocumentDB Cluster.
+
+Changes to a DocumentDB Cluster can occur when you manually change a
+parameter, such as `port`, and are reflected in the next maintenance
+window. Because of this, Terraform may report a difference in its planning
+phase because a modification has not yet taken place. You can use the
+`apply_immediately` flag to instruct the service to apply the change immediately
+(see documentation below).
+
+~> **Note:** using `apply_immediately` can result in a brief downtime as the server reboots.
+~> **Note:** All arguments including the username and password will be stored in the raw state as plain-text.
+[Read more about sensitive data in state](https://www.terraform.io/docs/state/sensitive-data.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.docdb_cluster import DocdbCluster
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DocdbCluster(self, "docdb",
+            backup_retention_period=5,
+            cluster_identifier="my-docdb-cluster",
+            engine="docdb",
+            master_password="mustbeeightchars",
+            master_username="foo",
+            preferred_backup_window="07:00-09:00",
+            skip_final_snapshot=True
+        )
+```
+
+## Argument Reference
+
+For more detailed documentation about each argument, refer to
+the [AWS official documentation](https://docs.aws.amazon.com/cli/latest/reference/docdb/create-db-cluster.html).
+
+This argument supports the following arguments:
+
+* `allow_major_version_upgrade` - (Optional) A value that indicates whether major version upgrades are allowed. Constraints: You must allow major version upgrades when specifying a value for the EngineVersion parameter that is a different major version than the DB cluster's current version.
+* `apply_immediately` - (Optional) Specifies whether any cluster modifications
+     are applied immediately, or during the next maintenance window. Default is
+     `false`.
+* `availability_zones` - (Optional) A list of EC2 Availability Zones that
+  instances in the DB cluster can be created in.
+* `backup_retention_period` - (Optional) The days to retain backups for. Default `1`
+* `cluster_identifier_prefix` - (Optional, Forces new resource) Creates a unique cluster identifier beginning with the specified prefix. Conflicts with `cluster_identifier`.
+* `cluster_identifier` - (Optional, Forces new resources) The cluster identifier. If omitted, Terraform will assign a random, unique identifier.
+* `db_subnet_group_name` - (Optional) A DB subnet group to associate with this DB instance.
+* `db_cluster_parameter_group_name` - (Optional) A cluster parameter group to associate with the cluster.
+* `deletion_protection` - (Optional) A value that indicates whether the DB cluster has deletion protection enabled. The database can't be deleted when deletion protection is enabled. By default, deletion protection is disabled.
+* `enabled_cloudwatch_logs_exports` - (Optional) List of log types to export to cloudwatch. If omitted, no logs will be exported.
+   The following log types are supported: `audit`, `profiler`.
+* `engine_version` - (Optional) The database engine version. Updating this argument results in an outage.
+* `engine` - (Optional) The name of the database engine to be used for this DB cluster. Defaults to `docdb`. Valid Values: `docdb`
+* `final_snapshot_identifier` - (Optional) The name of your final DB snapshot
+    when this DB cluster is deleted. If omitted, no final snapshot will be
+    made.
+* `global_cluster_identifier` - (Optional) The global cluster identifier specified on [`aws_docdb_global_cluster`](/docs/providers/aws/r/docdb_global_cluster.html).
+* `kms_key_id` - (Optional) The ARN for the KMS encryption key. When specifying `kms_key_id`, `storage_encrypted` needs to be set to true.
+* `master_password` - (Required unless a `snapshot_identifier` or unless a `global_cluster_identifier` is provided when the cluster is the "secondary" cluster of a global database) Password for the master DB user. Note that this may
+    show up in logs, and it will be stored in the state file. Please refer to the DocumentDB Naming Constraints.
+* `master_username` - (Required unless a `snapshot_identifier` or unless a `global_cluster_identifier` is provided when the cluster is the "secondary" cluster of a global database) Username for the master DB user.
+* `port` - (Optional) The port on which the DB accepts connections
+* `preferred_backup_window` - (Optional) The daily time range during which automated backups are created if automated backups are enabled using the BackupRetentionPeriod parameter.Time in UTC
+Default: A 30-minute window selected at random from an 8-hour block of time per regionE.g., 04:00-09:00
+* `preferred_maintenance_window` - (Optional) The weekly time range during which system maintenance can occur, in (UTC) e.g., wed:04:00-wed:04:30
+* `skip_final_snapshot` - (Optional) Determines whether a final DB snapshot is created before the DB cluster is deleted. If true is specified, no DB snapshot is created. If false is specified, a DB snapshot is created before the DB cluster is deleted, using the value from `final_snapshot_identifier`. Default is `false`.
+* `snapshot_identifier` - (Optional) Specifies whether or not to create this cluster from a snapshot. You can use either the name or ARN when specifying a DB cluster snapshot, or the ARN when specifying a DB snapshot. Automated snapshots **should not** be used for this attribute, unless from a different cluster. Automated snapshots are deleted as part of cluster destruction when the resource is replaced.
+* `storage_encrypted` - (Optional) Specifies whether the DB cluster is encrypted. The default is `false`.
+* `tags` - (Optional) A map of tags to assign to the DB cluster. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `vpc_security_group_ids` - (Optional) List of VPC security groups to associate
+  with the Cluster
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of cluster
+* `cluster_members` – List of DocumentDB Instances that are a part of this cluster
+* `cluster_resource_id` - The DocumentDB Cluster Resource ID
+* `endpoint` - The DNS address of the DocumentDB instance
+* `hosted_zone_id` - The Route53 Hosted Zone ID of the endpoint
+* `id` - The DocumentDB Cluster Identifier
+* `reader_endpoint` - A read-only endpoint for the DocumentDB cluster, automatically load-balanced across replicas
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `120m`)
+- `update` - (Default `120m`)
+- `delete` - (Default `120m`)
+any cleanup task during the destroying process.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DocumentDB Clusters using the `cluster_identifier`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import DocumentDB Clusters using the `cluster_identifier`. For example:
+
+```console
+% terraform import aws_docdb_cluster.docdb_cluster docdb-prod-cluster
+```
+
+<!-- cache-key: cdktf-0.18.0 input-7cf348aecf73384b6129a72828575287fcb17575843e5c9cf838a6b1a7e65009 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/docdb_cluster_instance.html.markdown b/website/docs/cdktf/python/r/docdb_cluster_instance.html.markdown
new file mode 100644
index 00000000000..6e1f1b65fe9
--- /dev/null
+++ b/website/docs/cdktf/python/r/docdb_cluster_instance.html.markdown
@@ -0,0 +1,154 @@
+---
+subcategory: "DocumentDB"
+layout: "aws"
+page_title: "AWS: aws_docdb_cluster_instance"
+description: |-
+  Provides an DocumentDB Cluster Resource Instance
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_docdb_cluster_instance
+
+Provides an DocumentDB Cluster Resource Instance. A Cluster Instance Resource defines
+attributes that are specific to a single instance in a [DocumentDB Cluster][1].
+
+You do not designate a primary and subsequent replicas. Instead, you simply add DocumentDB
+Instances and DocumentDB manages the replication. You can use the [count][3]
+meta-parameter to make multiple instances and join them all to the same DocumentDB
+Cluster, or you may specify different Cluster Instance resources with various
+`instance_class` sizes.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformCount, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.docdb_cluster import DocdbCluster
+from imports.aws.docdb_cluster_instance import DocdbClusterInstance
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        default_var = DocdbCluster(self, "default",
+            availability_zones=["us-west-2a", "us-west-2b", "us-west-2c"],
+            cluster_identifier="docdb-cluster-demo",
+            master_password="barbut8chars",
+            master_username="foo"
+        )
+        # In most cases loops should be handled in the programming language context and
+        #     not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+        #     you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+        #     you need to keep this like it is.
+        cluster_instances_count = TerraformCount.of(Token.as_number("2"))
+        DocdbClusterInstance(self, "cluster_instances",
+            cluster_identifier=default_var.id,
+            identifier="docdb-cluster-demo-${" + cluster_instances_count.index + "}",
+            instance_class="db.r5.large",
+            count=cluster_instances_count
+        )
+```
+
+## Argument Reference
+
+For more detailed documentation about each argument, refer to
+the [AWS official documentation](https://docs.aws.amazon.com/cli/latest/reference/docdb/create-db-instance.html).
+
+This argument supports the following arguments:
+
+* `apply_immediately` - (Optional) Specifies whether any database modifications
+     are applied immediately, or during the next maintenance window. Default is`false`.
+* `auto_minor_version_upgrade` - (Optional) This parameter does not apply to Amazon DocumentDB. Amazon DocumentDB does not perform minor version upgrades regardless of the value set (see [docs](https://docs.aws.amazon.com/documentdb/latest/developerguide/API_DBInstance.html)). Default `true`.
+* `availability_zone` - (Optional, Computed) The EC2 Availability Zone that the DB instance is created in. See [docs](https://docs.aws.amazon.com/documentdb/latest/developerguide/API_CreateDBInstance.html) about the details.
+* `cluster_identifier` - (Required) The identifier of the [`aws_docdb_cluster`](/docs/providers/aws/r/docdb_cluster.html) in which to launch this instance.
+* `copy_tags_to_snapshot` – (Optional, boolean) Copy all DB instance `tags` to snapshots. Default is `false`.
+* `enable_performance_insights` - (Optional) A value that indicates whether to enable Performance Insights for the DB Instance. Default `false`. See [docs] (https://docs.aws.amazon.com/documentdb/latest/developerguide/performance-insights.html) about the details.
+* `engine` - (Optional) The name of the database engine to be used for the DocumentDB instance. Defaults to `docdb`. Valid Values: `docdb`.
+* `identifier` - (Optional, Forces new resource) The identifier for the DocumentDB instance, if omitted, Terraform will assign a random, unique identifier.
+* `identifier_prefix` - (Optional, Forces new resource) Creates a unique identifier beginning with the specified prefix. Conflicts with `identifier`.
+* `instance_class` - (Required) The instance class to use. For details on CPU and memory, see [Scaling for DocumentDB Instances][2].
+  DocumentDB currently supports the below instance classes.
+  Please see [AWS Documentation][4] for complete details.
+    - db.r6g.large
+    - db.r6g.xlarge
+    - db.r6g.2xlarge
+    - db.r6g.4xlarge
+    - db.r6g.8xlarge
+    - db.r6g.12xlarge
+    - db.r6g.16xlarge
+    - db.r5.large
+    - db.r5.xlarge
+    - db.r5.2xlarge
+    - db.r5.4xlarge
+    - db.r5.12xlarge
+    - db.r5.24xlarge
+    - db.r4.large
+    - db.r4.xlarge
+    - db.r4.2xlarge
+    - db.r4.4xlarge
+    - db.r4.8xlarge
+    - db.r4.16xlarge
+    - db.t4g.medium
+    - db.t3.medium
+* `performance_insights_kms_key_id` - (Optional) The KMS key identifier is the key ARN, key ID, alias ARN, or alias name for the KMS key. If you do not specify a value for PerformanceInsightsKMSKeyId, then Amazon DocumentDB uses your default KMS key.
+* `preferred_maintenance_window` - (Optional) The window to perform maintenance in.
+  Syntax: "ddd:hh24:mi-ddd:hh24:mi". Eg: "Mon:00:00-Mon:03:00".
+* `promotion_tier` - (Optional) Default 0. Failover Priority setting on instance level. The reader who has lower tier has higher priority to get promoter to writer.
+* `tags` - (Optional) A map of tags to assign to the instance. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of cluster instance
+* `db_subnet_group_name` - The DB subnet group to associate with this DB instance.
+* `dbi_resource_id` - The region-unique, immutable identifier for the DB instance.
+* `endpoint` - The DNS address for this instance. May not be writable
+* `engine_version` - The database engine version
+* `kms_key_id` - The ARN for the KMS encryption key if one is set to the cluster.
+* `port` - The database port
+* `preferred_backup_window` - The daily time range during which automated backups are created if automated backups are enabled.
+* `storage_encrypted` - Specifies whether the DB cluster is encrypted.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `writer` – Boolean indicating if this instance is writable. `False` indicates this instance is a read replica.
+* `ca_cert_identifier` - (Optional) The identifier of the CA certificate for the DB instance.
+
+[1]: /docs/providers/aws/r/docdb_cluster.html
+[2]: https://docs.aws.amazon.com/documentdb/latest/developerguide/db-cluster-manage-performance.html#db-cluster-manage-scaling-instance
+[3]: https://www.terraform.io/docs/configuration/meta-arguments/count.html
+[4]: https://docs.aws.amazon.com/documentdb/latest/developerguide/db-instance-classes.html#db-instance-class-specs
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `90m`)
+restoring from Snapshots
+- `update` - (Default `90m`)
+- `delete` - (Default `90m`)
+the time required to take snapshots
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DocumentDB Cluster Instances using the `identifier`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import DocumentDB Cluster Instances using the `identifier`. For example:
+
+```console
+% terraform import aws_docdb_cluster_instance.prod_instance_1 aurora-cluster-instance-1
+```
+
+<!-- cache-key: cdktf-0.18.0 input-9a6c6904f8952b2942358908c66b371b4c5097186378f30754ea569b6e4e1d71 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/docdb_cluster_parameter_group.html.markdown b/website/docs/cdktf/python/r/docdb_cluster_parameter_group.html.markdown
new file mode 100644
index 00000000000..20b16ea58ac
--- /dev/null
+++ b/website/docs/cdktf/python/r/docdb_cluster_parameter_group.html.markdown
@@ -0,0 +1,87 @@
+---
+subcategory: "DocumentDB"
+layout: "aws"
+page_title: "AWS: aws_docdb_cluster_parameter_group"
+description: |-
+  Manages a DocumentDB Cluster Parameter Group
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_docdb_cluster_parameter_group
+
+Manages a DocumentDB Cluster Parameter Group
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.docdb_cluster_parameter_group import DocdbClusterParameterGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DocdbClusterParameterGroup(self, "example",
+            description="docdb cluster parameter group",
+            family="docdb3.6",
+            name="example",
+            parameter=[DocdbClusterParameterGroupParameter(
+                name="tls",
+                value="enabled"
+            )
+            ]
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Optional, Forces new resource) The name of the DocumentDB cluster parameter group. If omitted, Terraform will assign a random, unique name.
+* `name_prefix` - (Optional, Forces new resource) Creates a unique name beginning with the specified prefix. Conflicts with `name`.
+* `family` - (Required, Forces new resource) The family of the DocumentDB cluster parameter group.
+* `description` - (Optional, Forces new resource) The description of the DocumentDB cluster parameter group. Defaults to "Managed by Terraform".
+* `parameter` - (Optional) A list of DocumentDB parameters to apply. Setting parameters to system default values may show a difference on imported resources.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+Parameter blocks support the following:
+
+~> **NOTE:** These arguments take a `string` representation of their values.
+
+* `name` - (Required) The name of the DocumentDB parameter.
+* `value` - (Required) The value of the DocumentDB parameter.
+* `apply_method` - (Optional) Valid values are `immediate` and `pending-reboot`. Defaults to `pending-reboot`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The DocumentDB cluster parameter group name.
+* `arn` - The ARN of the DocumentDB cluster parameter group.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DocumentDB Cluster Parameter Groups using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import DocumentDB Cluster Parameter Groups using the `name`. For example:
+
+```console
+% terraform import aws_docdb_cluster_parameter_group.cluster_pg production-pg-1
+```
+
+<!-- cache-key: cdktf-0.18.0 input-419b7174b76157b8619854ef58a66430a8d320805696c26428ef99ede67bae36 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/docdb_cluster_snapshot.html.markdown b/website/docs/cdktf/python/r/docdb_cluster_snapshot.html.markdown
new file mode 100644
index 00000000000..46bb69ed199
--- /dev/null
+++ b/website/docs/cdktf/python/r/docdb_cluster_snapshot.html.markdown
@@ -0,0 +1,82 @@
+---
+subcategory: "DocumentDB"
+layout: "aws"
+page_title: "AWS: aws_docdb_cluster_snapshot"
+description: |-
+  Manages a DocumentDB database cluster snapshot.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_docdb_cluster_snapshot
+
+Manages a DocumentDB database cluster snapshot for DocumentDB clusters.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.docdb_cluster_snapshot import DocdbClusterSnapshot
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DocdbClusterSnapshot(self, "example",
+            db_cluster_identifier=Token.as_string(aws_docdb_cluster_example.id),
+            db_cluster_snapshot_identifier="resourcetestsnapshot1234"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `db_cluster_identifier` - (Required) The DocumentDB Cluster Identifier from which to take the snapshot.
+* `db_cluster_snapshot_identifier` - (Required) The Identifier for the snapshot.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `availability_zones` - List of EC2 Availability Zones that instances in the DocumentDB cluster snapshot can be restored in.
+* `db_cluster_snapshot_arn` - The Amazon Resource Name (ARN) for the DocumentDB Cluster Snapshot.
+* `engine` - Specifies the name of the database engine.
+* `engine_version` - Version of the database engine for this DocumentDB cluster snapshot.
+* `kms_key_id` - If storage_encrypted is true, the AWS KMS key identifier for the encrypted DocumentDB cluster snapshot.
+* `port` - Port that the DocumentDB cluster was listening on at the time of the snapshot.
+* `source_db_cluster_snapshot_identifier` - The DocumentDB Cluster Snapshot Arn that the DocumentDB Cluster Snapshot was copied from. It only has value in case of cross customer or cross region copy.
+* `storage_encrypted` - Specifies whether the DocumentDB cluster snapshot is encrypted.
+* `status` - The status of this DocumentDB Cluster Snapshot.
+* `vpc_id` - The VPC ID associated with the DocumentDB cluster snapshot.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `20m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_docdb_cluster_snapshot` using the cluster snapshot identifier. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_docdb_cluster_snapshot` using the cluster snapshot identifier. For example:
+
+```console
+% terraform import aws_docdb_cluster_snapshot.example my-cluster-snapshot
+```
+
+<!-- cache-key: cdktf-0.18.0 input-8dd2ea6e382c4e0856668c83fa43a1a39b2e7be56350a64cc442fe4366d3e1c4 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/docdb_event_subscription.html.markdown b/website/docs/cdktf/python/r/docdb_event_subscription.html.markdown
new file mode 100644
index 00000000000..121a1d151c1
--- /dev/null
+++ b/website/docs/cdktf/python/r/docdb_event_subscription.html.markdown
@@ -0,0 +1,108 @@
+---
+subcategory: "DocumentDB"
+layout: "aws"
+page_title: "AWS: aws_docdb_event_subscription"
+description: |-
+  Provides a DocumentDB event subscription resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_docdb_event_subscription
+
+Provides a DocumentDB event subscription resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.docdb_cluster import DocdbCluster
+from imports.aws.docdb_event_subscription import DocdbEventSubscription
+from imports.aws.sns_topic import SnsTopic
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = DocdbCluster(self, "example",
+            availability_zones=[
+                Token.as_string(Fn.lookup_nested(available.names, ["0"])),
+                Token.as_string(Fn.lookup_nested(available.names, ["1"])),
+                Token.as_string(Fn.lookup_nested(available.names, ["2"]))
+            ],
+            cluster_identifier="example",
+            master_password="mustbeeightcharaters",
+            master_username="foo",
+            skip_final_snapshot=True
+        )
+        aws_sns_topic_example = SnsTopic(self, "example_1",
+            name="example-events"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_sns_topic_example.override_logical_id("example")
+        aws_docdb_event_subscription_example = DocdbEventSubscription(self, "example_2",
+            enabled=True,
+            event_categories=["creation", "failure"],
+            name="example",
+            sns_topic_arn=Token.as_string(aws_sns_topic_example.arn),
+            source_ids=[example.id],
+            source_type="db-cluster"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_docdb_event_subscription_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Optional) The name of the DocumentDB event subscription. By default generated by Terraform.
+* `name_prefix` - (Optional) The name of the DocumentDB event subscription. Conflicts with `name`.
+* `sns_topic` - (Required) The SNS topic to send events to.
+* `source_ids` - (Optional) A list of identifiers of the event sources for which events will be returned. If not specified, then all sources are included in the response. If specified, a source_type must also be specified.
+* `source_type` - (Optional) The type of source that will be generating the events. Valid options are `db-instance`, `db-cluster`, `db-parameter-group`, `db-security-group`,` db-cluster-snapshot`. If not set, all sources will be subscribed to.
+* `event_categories` - (Optional) A list of event categories for a SourceType that you want to subscribe to. See https://docs.aws.amazon.com/documentdb/latest/developerguide/API_Event.html or run `aws docdb describe-event-categories`.
+* `enabled` - (Optional) A boolean flag to enable/disable the subscription. Defaults to true.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name of the DocumentDB event notification subscription
+* `arn` - The Amazon Resource Name of the DocumentDB event notification subscription
+* `customer_aws_id` - The AWS customer account associated with the DocumentDB event notification subscription
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `40m`)
+- `delete` - (Default `40m`)
+- `update` - (Default `40m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DocumentDB Event Subscriptions using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import DocumentDB Event Subscriptions using the `name`. For example:
+
+```console
+% terraform import aws_docdb_event_subscription.example event-sub
+```
+
+<!-- cache-key: cdktf-0.18.0 input-01289746062c0ecfee11e0fdbb6b08b84b9bb7709018031af990b6ef46d1dc7b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/docdb_global_cluster.html.markdown b/website/docs/cdktf/python/r/docdb_global_cluster.html.markdown
new file mode 100644
index 00000000000..1d0e81e4b6b
--- /dev/null
+++ b/website/docs/cdktf/python/r/docdb_global_cluster.html.markdown
@@ -0,0 +1,192 @@
+---
+subcategory: "DocumentDB"
+layout: "aws"
+page_title: "AWS: aws_docdb_global_cluster"
+description: |-
+  Manages a DocumentDB Global Cluster
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_docdb_global_cluster
+
+Manages an DocumentDB Global Cluster. A global cluster consists of one primary region and up to five read-only secondary regions. You issue write operations directly to the primary cluster in the primary region and Amazon DocumentDB automatically replicates the data to the secondary regions using dedicated infrastructure.
+
+More information about DocumentDB Global Clusters can be found in the [DocumentDB Developer Guide](https://docs.aws.amazon.com/documentdb/latest/developerguide/global-clusters.html).
+
+## Example Usage
+
+### New DocumentDB Global Cluster
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.docdb_cluster import DocdbCluster
+from imports.aws.docdb_cluster_instance import DocdbClusterInstance
+from imports.aws.docdb_global_cluster import DocdbGlobalCluster
+from imports.aws.provider import AwsProvider
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        primary = AwsProvider(self, "aws",
+            alias="primary",
+            region="us-east-2"
+        )
+        secondary = AwsProvider(self, "aws_1",
+            alias="secondary",
+            region="us-east-1"
+        )
+        example = DocdbGlobalCluster(self, "example",
+            engine="docdb",
+            engine_version="4.0.0",
+            global_cluster_identifier="global-test"
+        )
+        aws_docdb_cluster_primary = DocdbCluster(self, "primary",
+            cluster_identifier="test-primary-cluster",
+            db_subnet_group_name="default",
+            engine=example.engine,
+            engine_version=example.engine_version,
+            global_cluster_identifier=example.id,
+            master_password="somepass123",
+            master_username="username",
+            provider=primary
+        )
+        aws_docdb_cluster_secondary = DocdbCluster(self, "secondary",
+            cluster_identifier="test-secondary-cluster",
+            db_subnet_group_name="default",
+            depends_on=[aws_docdb_cluster_primary],
+            engine=example.engine,
+            engine_version=example.engine_version,
+            global_cluster_identifier=example.id,
+            provider=secondary
+        )
+        aws_docdb_cluster_instance_primary = DocdbClusterInstance(self, "primary_5",
+            cluster_identifier=Token.as_string(aws_docdb_cluster_primary.id),
+            engine=example.engine,
+            identifier="test-primary-cluster-instance",
+            instance_class="db.r5.large",
+            provider=primary
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_docdb_cluster_instance_primary.override_logical_id("primary")
+        aws_docdb_cluster_instance_secondary = DocdbClusterInstance(self, "secondary_6",
+            cluster_identifier=Token.as_string(aws_docdb_cluster_secondary.id),
+            depends_on=[aws_docdb_cluster_instance_primary],
+            engine=example.engine,
+            identifier="test-secondary-cluster-instance",
+            instance_class="db.r5.large",
+            provider=secondary
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_docdb_cluster_instance_secondary.override_logical_id("secondary")
+```
+
+### New Global Cluster From Existing DB Cluster
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from cdktf import TerraformResourceLifecycle
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.docdb_cluster import DocdbCluster
+from imports.aws.docdb_global_cluster import DocdbGlobalCluster
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = DocdbCluster(self, "example",
+            lifecycle=TerraformResourceLifecycle(
+                ignore_changes=[global_cluster_identifier]
+            )
+        )
+        aws_docdb_global_cluster_example = DocdbGlobalCluster(self, "example_1",
+            global_cluster_identifier="example",
+            source_db_cluster_identifier=example.arn
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_docdb_global_cluster_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `global_cluster_identifier` - (Required, Forces new resources) The global cluster identifier.
+* `database_name` - (Optional, Forces new resources) Name for an automatically created database on cluster creation.
+* `deletion_protection` - (Optional) If the Global Cluster should have deletion protection enabled. The database can't be deleted when this value is set to `true`. The default is `false`.
+* `engine` - (Optional, Forces new resources) Name of the database engine to be used for this DB cluster. Terraform will only perform drift detection if a configuration value is provided. Current Valid values: `docdb`. Defaults to `docdb`. Conflicts with `source_db_cluster_identifier`.
+* `engine_version` - (Optional) Engine version of the global database. Upgrading the engine version will result in all cluster members being immediately updated and will.
+    * **NOTE:** Upgrading major versions is not supported.
+* `source_db_cluster_identifier` - (Optional) Amazon Resource Name (ARN) to use as the primary DB Cluster of the Global Cluster on creation. Terraform cannot perform drift detection of this value.
+* `storage_encrypted` - (Optional, Forces new resources) Specifies whether the DB cluster is encrypted. The default is `false` unless `source_db_cluster_identifier` is specified and encrypted. Terraform will only perform drift detection if a configuration value is provided.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Global Cluster Amazon Resource Name (ARN)
+* `global_cluster_members` - Set of objects containing Global Cluster members.
+    * `db_cluster_arn` - Amazon Resource Name (ARN) of member DB Cluster.
+    * `is_writer` - Whether the member is the primary DB Cluster.
+* `global_cluster_resource_id` - AWS Region-unique, immutable identifier for the global database cluster. This identifier is found in AWS CloudTrail log entries whenever the AWS KMS key for the DB cluster is accessed.
+* `id` - DocumentDB Global Cluster ID.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `5m`)
+* `update` - (Default `5m`)
+* `delete` - (Default `5m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_docdb_global_cluster` using the Global Cluster identifier. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_docdb_global_cluster` using the Global Cluster identifier. For example:
+
+```console
+% terraform import aws_docdb_global_cluster.example example
+```
+
+Certain resource arguments, like `source_db_cluster_identifier`, do not have an API method for reading the information after creation. If the argument is set in the Terraform configuration on an imported resource, Terraform will always show a difference. To workaround this behavior, either omit the argument from the Terraform configuration or use [`ignore_changes`](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html#ignore_changes) to hide the difference. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from cdktf import TerraformResourceLifecycle
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.docdb_global_cluster import DocdbGlobalCluster
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, globalClusterIdentifier):
+        super().__init__(scope, name)
+        DocdbGlobalCluster(self, "example",
+            lifecycle=TerraformResourceLifecycle(
+                ignore_changes=[source_db_cluster_identifier]
+            ),
+            global_cluster_identifier=global_cluster_identifier
+        )
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1969b7e5823c37dcaa70faf533c61504633b6662145d39efba4b15fdc30e77b9 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/docdb_subnet_group.html.markdown b/website/docs/cdktf/python/r/docdb_subnet_group.html.markdown
new file mode 100644
index 00000000000..257d0ec85e2
--- /dev/null
+++ b/website/docs/cdktf/python/r/docdb_subnet_group.html.markdown
@@ -0,0 +1,75 @@
+---
+subcategory: "DocumentDB"
+layout: "aws"
+page_title: "AWS: aws_docdb_subnet_group"
+description: |-
+  Provides an DocumentDB subnet group resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_docdb_subnet_group
+
+Provides an DocumentDB subnet group resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.docdb_subnet_group import DocdbSubnetGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DocdbSubnetGroup(self, "default",
+            name="main",
+            subnet_ids=[frontend.id, backend.id],
+            tags={
+                "Name": "My docdb subnet group"
+            }
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Optional, Forces new resource) The name of the docDB subnet group. If omitted, Terraform will assign a random, unique name.
+* `name_prefix` - (Optional, Forces new resource) Creates a unique name beginning with the specified prefix. Conflicts with `name`.
+* `description` - (Optional) The description of the docDB subnet group. Defaults to "Managed by Terraform".
+* `subnet_ids` - (Required) A list of VPC subnet IDs.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The docDB subnet group name.
+* `arn` - The ARN of the docDB subnet group.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DocumentDB Subnet groups using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import DocumentDB Subnet groups using the `name`. For example:
+
+```console
+% terraform import aws_docdb_subnet_group.default production-subnet-group
+```
+
+<!-- cache-key: cdktf-0.18.0 input-88009fd606f1c5adfe6f2ed488e5bfa54a43279608f02880560a223786cb4993 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/dx_bgp_peer.html.markdown b/website/docs/cdktf/python/r/dx_bgp_peer.html.markdown
new file mode 100644
index 00000000000..36c0ddb461a
--- /dev/null
+++ b/website/docs/cdktf/python/r/dx_bgp_peer.html.markdown
@@ -0,0 +1,65 @@
+---
+subcategory: "Direct Connect"
+layout: "aws"
+page_title: "AWS: aws_dx_bgp_peer"
+description: |-
+  Provides a Direct Connect BGP peer resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_dx_bgp_peer
+
+Provides a Direct Connect BGP peer resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.dx_bgp_peer import DxBgpPeer
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DxBgpPeer(self, "peer",
+            address_family="ipv6",
+            bgp_asn=65351,
+            virtual_interface_id=foo.id
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `address_family` - (Required) The address family for the BGP peer. `ipv4 ` or `ipv6`.
+* `bgp_asn` - (Required) The autonomous system (AS) number for Border Gateway Protocol (BGP) configuration.
+* `virtual_interface_id` - (Required) The ID of the Direct Connect virtual interface on which to create the BGP peer.
+* `amazon_address` - (Optional) The IPv4 CIDR address to use to send traffic to Amazon.
+Required for IPv4 BGP peers on public virtual interfaces.
+* `bgp_auth_key` - (Optional) The authentication key for BGP configuration.
+* `customer_address` - (Optional) The IPv4 CIDR destination address to which Amazon should send traffic.
+Required for IPv4 BGP peers on public virtual interfaces.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the BGP peer resource.
+* `bgp_status` - The Up/Down state of the BGP peer.
+* `bgp_peer_id` - The ID of the BGP peer.
+* `aws_device` - The Direct Connect endpoint on which the BGP peer terminates.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `10m`)
+- `delete` - (Default `10m`)
+
+<!-- cache-key: cdktf-0.18.0 input-fce27b12427c127b90f63ebcc9725bb7d4127413367ba03f518a0e5c6f7ac443 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/dx_connection.html.markdown b/website/docs/cdktf/python/r/dx_connection.html.markdown
new file mode 100644
index 00000000000..55ba9ddfe24
--- /dev/null
+++ b/website/docs/cdktf/python/r/dx_connection.html.markdown
@@ -0,0 +1,136 @@
+---
+subcategory: "Direct Connect"
+layout: "aws"
+page_title: "AWS: aws_dx_connection"
+description: |-
+  Provides a Connection of Direct Connect.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_dx_connection
+
+Provides a Connection of Direct Connect.
+
+## Example Usage
+
+### Create a connection
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.dx_connection import DxConnection
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DxConnection(self, "hoge",
+            bandwidth="1Gbps",
+            location="EqDC2",
+            name="tf-dx-connection"
+        )
+```
+
+### Request a MACsec-capable connection
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.dx_connection import DxConnection
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DxConnection(self, "example",
+            bandwidth="10Gbps",
+            location="EqDA2",
+            name="tf-dx-connection",
+            request_macsec=True
+        )
+```
+
+### Configure encryption mode for MACsec-capable connections
+
+-> **NOTE:** You can only specify the `encryption_mode` argument once the connection is in an `Available` state.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.dx_connection import DxConnection
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DxConnection(self, "example",
+            bandwidth="10Gbps",
+            encryption_mode="must_encrypt",
+            location="EqDC2",
+            name="tf-dx-connection",
+            request_macsec=True
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `bandwidth` - (Required) The bandwidth of the connection. Valid values for dedicated connections: 1Gbps, 10Gbps. Valid values for hosted connections: 50Mbps, 100Mbps, 200Mbps, 300Mbps, 400Mbps, 500Mbps, 1Gbps, 2Gbps, 5Gbps, 10Gbps and 100Gbps. Case sensitive.
+* `encryption_mode` - (Optional) The connection MAC Security (MACsec) encryption mode. MAC Security (MACsec) is only available on dedicated connections. Valid values are `no_encrypt`, `should_encrypt`, and `must_encrypt`.
+* `location` - (Required) The AWS Direct Connect location where the connection is located. See [DescribeLocations](https://docs.aws.amazon.com/directconnect/latest/APIReference/API_DescribeLocations.html) for the list of AWS Direct Connect locations. Use `locationCode`.
+* `name` - (Required) The name of the connection.
+* `provider_name` - (Optional) The name of the service provider associated with the connection.
+* `request_macsec` - (Optional) Boolean value indicating whether you want the connection to support MAC Security (MACsec). MAC Security (MACsec) is only available on dedicated connections. See [MACsec prerequisites](https://docs.aws.amazon.com/directconnect/latest/UserGuide/direct-connect-mac-sec-getting-started.html#mac-sec-prerequisites) for more information about MAC Security (MACsec) prerequisites. Default value: `false`.
+
+~> **NOTE:** Changing the value of `request_macsec` will cause the resource to be destroyed and re-created.
+
+* `skip_destroy` - (Optional) Set to true if you do not wish the connection to be deleted at destroy time, and instead just removed from the Terraform state.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the connection.
+* `aws_device` - The Direct Connect endpoint on which the physical connection terminates.
+* `has_logical_redundancy` - Indicates whether the connection supports a secondary BGP peer in the same address family (IPv4/IPv6).
+* `id` - The ID of the connection.
+* `jumbo_frame_capable` - Boolean value representing if jumbo frames have been enabled for this connection.
+* `macsec_capable` - Boolean value indicating whether the connection supports MAC Security (MACsec).
+* `owner_account_id` - The ID of the AWS account that owns the connection.
+* `partner_name` - The name of the AWS Direct Connect service provider associated with the connection.
+* `port_encryption_status` - The MAC Security (MACsec) port link status of the connection.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `vlan_id` - The VLAN ID.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Direct Connect connections using the connection `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Direct Connect connections using the connection `id`. For example:
+
+```console
+% terraform import aws_dx_connection.test_connection dxcon-ffre0ec3
+```
+
+<!-- cache-key: cdktf-0.18.0 input-d13e1be5ac537438097f3cb1617cb8cb47731fc5c21629b7b4afb1e95a242b92 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/dx_connection_association.html.markdown b/website/docs/cdktf/python/r/dx_connection_association.html.markdown
new file mode 100644
index 00000000000..e6b41686ecb
--- /dev/null
+++ b/website/docs/cdktf/python/r/dx_connection_association.html.markdown
@@ -0,0 +1,62 @@
+---
+subcategory: "Direct Connect"
+layout: "aws"
+page_title: "AWS: aws_dx_connection_association"
+description: |-
+  Associates a Direct Connect Connection with a LAG.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_dx_connection_association
+
+Associates a Direct Connect Connection with a LAG.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.dx_connection import DxConnection
+from imports.aws.dx_connection_association import DxConnectionAssociation
+from imports.aws.dx_lag import DxLag
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = DxConnection(self, "example",
+            bandwidth="1Gbps",
+            location="EqSe2-EQ",
+            name="example"
+        )
+        aws_dx_lag_example = DxLag(self, "example_1",
+            connections_bandwidth="1Gbps",
+            location="EqSe2-EQ",
+            name="example"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_dx_lag_example.override_logical_id("example")
+        aws_dx_connection_association_example = DxConnectionAssociation(self, "example_2",
+            connection_id=example.id,
+            lag_id=Token.as_string(aws_dx_lag_example.id)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_dx_connection_association_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `connection_id` - (Required) The ID of the connection.
+* `lag_id` - (Required) The ID of the LAG with which to associate the connection.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+<!-- cache-key: cdktf-0.18.0 input-96feeae586392eb0efd53cf41e2bf1f425927ad87299e1068630c2fe6ba0f85c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/dx_connection_confirmation.html.markdown b/website/docs/cdktf/python/r/dx_connection_confirmation.html.markdown
new file mode 100644
index 00000000000..81e3e4877c9
--- /dev/null
+++ b/website/docs/cdktf/python/r/dx_connection_confirmation.html.markdown
@@ -0,0 +1,51 @@
+---
+subcategory: "Direct Connect"
+layout: "aws"
+page_title: "AWS: aws_dx_connection_confirmation"
+description: |-
+  Provides a confirmation of the creation of the specified hosted connection on an interconnect.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_dx_connection_confirmation
+
+Provides a confirmation of the creation of the specified hosted connection on an interconnect.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.dx_connection_confirmation import DxConnectionConfirmation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DxConnectionConfirmation(self, "confirmation",
+            connection_id="dxcon-ffabc123"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `connection_id` - (Required) The ID of the hosted connection.
+
+### Removing `aws_dx_connection_confirmation` from your configuration
+
+Removing an `aws_dx_connection_confirmation` resource from your configuration will remove it
+from your statefile and management, **but will not destroy the Hosted Connection.**
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the connection.
+
+<!-- cache-key: cdktf-0.18.0 input-e2add46dba26c378ed4b9326ebee9569e0e5c8903ce7dbc8024cc7347469032a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/dx_gateway.html.markdown b/website/docs/cdktf/python/r/dx_gateway.html.markdown
new file mode 100644
index 00000000000..40b152ca5ee
--- /dev/null
+++ b/website/docs/cdktf/python/r/dx_gateway.html.markdown
@@ -0,0 +1,75 @@
+---
+subcategory: "Direct Connect"
+layout: "aws"
+page_title: "AWS: aws_dx_gateway"
+description: |-
+  Provides a Direct Connect Gateway.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_dx_gateway
+
+Provides a Direct Connect Gateway.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.dx_gateway import DxGateway
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DxGateway(self, "example",
+            amazon_side_asn="64512",
+            name="tf-dxg-example"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the connection.
+* `amazon_side_asn` - (Required) The ASN to be configured on the Amazon side of the connection. The ASN must be in the private range of 64,512 to 65,534 or 4,200,000,000 to 4,294,967,294.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the gateway.
+* `owner_account_id` - AWS Account ID of the gateway.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `10m`)
+- `delete` - (Default `10m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Direct Connect Gateways using the gateway `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Direct Connect Gateways using the gateway `id`. For example:
+
+```console
+% terraform import aws_dx_gateway.test abcd1234-dcba-5678-be23-cdef9876ab45
+```
+
+<!-- cache-key: cdktf-0.18.0 input-db317b4e261abf2f1827c55dbc125b82d7d76ea9e8e48abeda0133e6d7d18e78 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/dx_gateway_association.html.markdown b/website/docs/cdktf/python/r/dx_gateway_association.html.markdown
new file mode 100644
index 00000000000..4d3abef01c1
--- /dev/null
+++ b/website/docs/cdktf/python/r/dx_gateway_association.html.markdown
@@ -0,0 +1,185 @@
+---
+subcategory: "Direct Connect"
+layout: "aws"
+page_title: "AWS: aws_dx_gateway_association"
+description: |-
+  Associates a Direct Connect Gateway with a VGW or transit gateway.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_dx_gateway_association
+
+Associates a Direct Connect Gateway with a VGW or transit gateway.
+
+To create a cross-account association, create an [`aws_dx_gateway_association_proposal` resource](/docs/providers/aws/r/dx_gateway_association_proposal.html)
+in the AWS account that owns the VGW or transit gateway and then accept the proposal in the AWS account that owns the Direct Connect Gateway
+by creating an `aws_dx_gateway_association` resource with the `proposal_id` and `associated_gateway_owner_account_id` attributes set.
+
+## Example Usage
+
+### VPN Gateway Association
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.dx_gateway import DxGateway
+from imports.aws.dx_gateway_association import DxGatewayAssociation
+from imports.aws.vpc import Vpc
+from imports.aws.vpn_gateway import VpnGateway
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = DxGateway(self, "example",
+            amazon_side_asn="64512",
+            name="example"
+        )
+        aws_vpc_example = Vpc(self, "example_1",
+            cidr_block="10.255.255.0/28"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_vpc_example.override_logical_id("example")
+        aws_vpn_gateway_example = VpnGateway(self, "example_2",
+            vpc_id=Token.as_string(aws_vpc_example.id)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_vpn_gateway_example.override_logical_id("example")
+        aws_dx_gateway_association_example = DxGatewayAssociation(self, "example_3",
+            associated_gateway_id=Token.as_string(aws_vpn_gateway_example.id),
+            dx_gateway_id=example.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_dx_gateway_association_example.override_logical_id("example")
+```
+
+### Transit Gateway Association
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.dx_gateway import DxGateway
+from imports.aws.dx_gateway_association import DxGatewayAssociation
+from imports.aws.ec2_transit_gateway import Ec2TransitGateway
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = DxGateway(self, "example",
+            amazon_side_asn="64512",
+            name="example"
+        )
+        aws_ec2_transit_gateway_example = Ec2TransitGateway(self, "example_1")
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_ec2_transit_gateway_example.override_logical_id("example")
+        aws_dx_gateway_association_example = DxGatewayAssociation(self, "example_2",
+            allowed_prefixes=["10.255.255.0/30", "10.255.255.8/30"],
+            associated_gateway_id=Token.as_string(aws_ec2_transit_gateway_example.id),
+            dx_gateway_id=example.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_dx_gateway_association_example.override_logical_id("example")
+```
+
+### Allowed Prefixes
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.dx_gateway import DxGateway
+from imports.aws.dx_gateway_association import DxGatewayAssociation
+from imports.aws.vpc import Vpc
+from imports.aws.vpn_gateway import VpnGateway
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = DxGateway(self, "example",
+            amazon_side_asn="64512",
+            name="example"
+        )
+        aws_vpc_example = Vpc(self, "example_1",
+            cidr_block="10.255.255.0/28"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_vpc_example.override_logical_id("example")
+        aws_vpn_gateway_example = VpnGateway(self, "example_2",
+            vpc_id=Token.as_string(aws_vpc_example.id)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_vpn_gateway_example.override_logical_id("example")
+        aws_dx_gateway_association_example = DxGatewayAssociation(self, "example_3",
+            allowed_prefixes=["210.52.109.0/24", "175.45.176.0/22"],
+            associated_gateway_id=Token.as_string(aws_vpn_gateway_example.id),
+            dx_gateway_id=example.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_dx_gateway_association_example.override_logical_id("example")
+```
+
+A full example of how to create a VPN Gateway in one AWS account, create a Direct Connect Gateway in a second AWS account, and associate the VPN Gateway with the Direct Connect Gateway via the `aws_dx_gateway_association_proposal` and `aws_dx_gateway_association` resources can be found in [the `./examples/dx-gateway-cross-account-vgw-association` directory within the Github Repository](https://github.com/hashicorp/terraform-provider-aws/tree/main/examples/dx-gateway-cross-account-vgw-association).
+
+## Argument Reference
+
+~> **NOTE:** `dx_gateway_id` and `associated_gateway_id` must be specified for single account Direct Connect gateway associations.
+
+This argument supports the following arguments:
+
+* `dx_gateway_id` - (Required) The ID of the Direct Connect gateway.
+* `associated_gateway_id` - (Optional) The ID of the VGW or transit gateway with which to associate the Direct Connect gateway.
+Used for single account Direct Connect gateway associations.
+* `associated_gateway_owner_account_id` - (Optional) The ID of the AWS account that owns the VGW or transit gateway with which to associate the Direct Connect gateway.
+Used for cross-account Direct Connect gateway associations.
+* `proposal_id` - (Optional) The ID of the Direct Connect gateway association proposal.
+Used for cross-account Direct Connect gateway associations.
+* `allowed_prefixes` - (Optional) VPC prefixes (CIDRs) to advertise to the Direct Connect gateway. Defaults to the CIDR block of the VPC associated with the Virtual Gateway. To enable drift detection, must be configured.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the Direct Connect gateway association resource.
+* `associated_gateway_type` - The type of the associated gateway, `transitGateway` or `virtualPrivateGateway`.
+* `dx_gateway_association_id` - The ID of the Direct Connect gateway association.
+* `dx_gateway_owner_account_id` - The ID of the AWS account that owns the Direct Connect gateway.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `30m`)
+- `update` - (Default `30m`)
+- `delete` - (Default `30m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Direct Connect gateway associations using `dx_gateway_id` together with `associated_gateway_id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Direct Connect gateway associations using `dx_gateway_id` together with `associated_gateway_id`. For example:
+
+```console
+% terraform import aws_dx_gateway_association.example 345508c3-7215-4aef-9832-07c125d5bd0f/vgw-98765432
+```
+
+<!-- cache-key: cdktf-0.18.0 input-a27cdf93a7d5c42337724f3a987226ae88c4ae0502a4d4160e2444683c6a343d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/dx_gateway_association_proposal.html.markdown b/website/docs/cdktf/python/r/dx_gateway_association_proposal.html.markdown
new file mode 100644
index 00000000000..7356aaa10b1
--- /dev/null
+++ b/website/docs/cdktf/python/r/dx_gateway_association_proposal.html.markdown
@@ -0,0 +1,98 @@
+---
+subcategory: "Direct Connect"
+layout: "aws"
+page_title: "AWS: aws_dx_gateway_association_proposal"
+description: |-
+  Manages a Direct Connect Gateway Association Proposal.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_dx_gateway_association_proposal
+
+Manages a Direct Connect Gateway Association Proposal, typically for enabling cross-account associations. For single account associations, see the [`aws_dx_gateway_association` resource](/docs/providers/aws/r/dx_gateway_association.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.dx_gateway_association_proposal import DxGatewayAssociationProposal
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DxGatewayAssociationProposal(self, "example",
+            associated_gateway_id=Token.as_string(aws_vpn_gateway_example.id),
+            dx_gateway_id=Token.as_string(aws_dx_gateway_example.id),
+            dx_gateway_owner_account_id=Token.as_string(aws_dx_gateway_example.owner_account_id)
+        )
+```
+
+A full example of how to create a VPN Gateway in one AWS account, create a Direct Connect Gateway in a second AWS account, and associate the VPN Gateway with the Direct Connect Gateway via the `aws_dx_gateway_association_proposal` and `aws_dx_gateway_association` resources can be found in [the `./examples/dx-gateway-cross-account-vgw-association` directory within the Github Repository](https://github.com/hashicorp/terraform-provider-aws/tree/main/examples/dx-gateway-cross-account-vgw-association).
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `associated_gateway_id` - (Required) The ID of the VGW or transit gateway with which to associate the Direct Connect gateway.
+* `dx_gateway_id` - (Required) Direct Connect Gateway identifier.
+* `dx_gateway_owner_account_id` - (Required) AWS Account identifier of the Direct Connect Gateway's owner.
+* `allowed_prefixes` - (Optional) VPC prefixes (CIDRs) to advertise to the Direct Connect gateway. Defaults to the CIDR block of the VPC associated with the Virtual Gateway. To enable drift detection, must be configured.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Direct Connect Gateway Association Proposal identifier.
+* `associated_gateway_owner_account_id` - The ID of the AWS account that owns the VGW or transit gateway with which to associate the Direct Connect gateway.
+* `associated_gateway_type` - The type of the associated gateway, `transitGateway` or `virtualPrivateGateway`.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Direct Connect Gateway Association Proposals using either a proposal ID or proposal ID, Direct Connect Gateway ID and associated gateway ID separated by `/`. For example:
+
+Using a proposal ID:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using a proposal ID, Direct Connect Gateway ID and associated gateway ID separated by `/`:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+**With `terraform import`**, import Direct Connect Gateway Association Proposals using either a proposal ID or proposal ID, Direct Connect Gateway ID and associated gateway ID separated by `/`. For example:
+
+Using a proposal ID:
+
+```console
+% terraform import aws_dx_gateway_association_proposal.example ac90e981-b718-4364-872d-65478c84fafe
+```
+
+Using a proposal ID, Direct Connect Gateway ID and associated gateway ID separated by `/`:
+
+```console
+% terraform import aws_dx_gateway_association_proposal.example ac90e981-b718-4364-872d-65478c84fafe/abcd1234-dcba-5678-be23-cdef9876ab45/vgw-12345678
+```
+
+The latter case is useful when a previous proposal has been accepted and deleted by AWS.
+The `aws_dx_gateway_association_proposal` resource will then represent a pseudo-proposal for the same Direct Connect Gateway and associated gateway. If no previous proposal is available, use a tool like [`uuidgen`](http://manpages.ubuntu.com/manpages/bionic/man1/uuidgen.1.html) to generate a new random pseudo-proposal ID.
+
+<!-- cache-key: cdktf-0.18.0 input-4c6dba02a31331ff74f6b982064aff401065a96d07736b20f32eb5d034a7822f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/dx_hosted_connection.html.markdown b/website/docs/cdktf/python/r/dx_hosted_connection.html.markdown
new file mode 100644
index 00000000000..6d5a45b3f45
--- /dev/null
+++ b/website/docs/cdktf/python/r/dx_hosted_connection.html.markdown
@@ -0,0 +1,64 @@
+---
+subcategory: "Direct Connect"
+layout: "aws"
+page_title: "AWS: aws_dx_hosted_connection"
+description: |-
+  Provides a hosted connection on the specified interconnect or a link aggregation group (LAG) of interconnects. Intended for use by AWS Direct Connect Partners only.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_dx_hosted_connection
+
+Provides a hosted connection on the specified interconnect or a link aggregation group (LAG) of interconnects. Intended for use by AWS Direct Connect Partners only.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.dx_hosted_connection import DxHostedConnection
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DxHostedConnection(self, "hosted",
+            bandwidth="100Mbps",
+            connection_id="dxcon-ffabc123",
+            name="tf-dx-hosted-connection",
+            owner_account_id="123456789012",
+            vlan=1
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the connection.
+* `bandwidth` - (Required) The bandwidth of the connection. Valid values for dedicated connections: 1Gbps, 10Gbps. Valid values for hosted connections: 50Mbps, 100Mbps, 200Mbps, 300Mbps, 400Mbps, 500Mbps, 1Gbps, 2Gbps, 5Gbps and 10Gbps. Case sensitive.
+* `connection_id` - (Required) The ID of the interconnect or LAG.
+* `owner_account_id` - (Required) The ID of the AWS account of the customer for the connection.
+* `vlan` - (Required) The dedicated VLAN provisioned to the hosted connection.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the connection.
+* `jumbo_frame_capable` - Boolean value representing if jumbo frames have been enabled for this connection.
+* `has_logical_redundancy` - Indicates whether the connection supports a secondary BGP peer in the same address family (IPv4/IPv6).
+* `aws_device` - The Direct Connect endpoint on which the physical connection terminates.
+* `state` - The state of the connection. Possible values include: ordering, requested, pending, available, down, deleting, deleted, rejected, unknown. See [AllocateHostedConnection](https://docs.aws.amazon.com/directconnect/latest/APIReference/API_AllocateHostedConnection.html) for a description of each connection state.
+* `lag_id` - The ID of the LAG.
+* `loa_issue_time` - The time of the most recent call to [DescribeLoa](https://docs.aws.amazon.com/directconnect/latest/APIReference/API_DescribeLoa.html) for this connection.
+* `location` - The location of the connection.
+* `partner_name` - The name of the AWS Direct Connect service provider associated with the connection.
+* `provider_name` - The name of the service provider associated with the connection.
+* `region` - The AWS Region where the connection is located.
+
+<!-- cache-key: cdktf-0.18.0 input-97bc5655cc271850c8ea111d0eeb9833b2352964ab1dc9e68ab175109b7b9dee -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/dx_hosted_private_virtual_interface.html.markdown b/website/docs/cdktf/python/r/dx_hosted_private_virtual_interface.html.markdown
new file mode 100644
index 00000000000..8e6b25f7221
--- /dev/null
+++ b/website/docs/cdktf/python/r/dx_hosted_private_virtual_interface.html.markdown
@@ -0,0 +1,91 @@
+---
+subcategory: "Direct Connect"
+layout: "aws"
+page_title: "AWS: aws_dx_hosted_private_virtual_interface"
+description: |-
+  Provides a Direct Connect hosted private virtual interface resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_dx_hosted_private_virtual_interface
+
+Provides a Direct Connect hosted private virtual interface resource. This resource represents the allocator's side of the hosted virtual interface.
+A hosted virtual interface is a virtual interface that is owned by another AWS account.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.dx_hosted_private_virtual_interface import DxHostedPrivateVirtualInterface
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, ownerAccountId):
+        super().__init__(scope, name)
+        DxHostedPrivateVirtualInterface(self, "foo",
+            address_family="ipv4",
+            bgp_asn=65352,
+            connection_id="dxcon-zzzzzzzz",
+            name="vif-foo",
+            vlan=4094,
+            owner_account_id=owner_account_id
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `address_family` - (Required) The address family for the BGP peer. `ipv4 ` or `ipv6`.
+* `bgp_asn` - (Required) The autonomous system (AS) number for Border Gateway Protocol (BGP) configuration.
+* `connection_id` - (Required) The ID of the Direct Connect connection (or LAG) on which to create the virtual interface.
+* `name` - (Required) The name for the virtual interface.
+* `owner_account_id` - (Required) The AWS account that will own the new virtual interface.
+* `vlan` - (Required) The VLAN ID.
+* `amazon_address` - (Optional) The IPv4 CIDR address to use to send traffic to Amazon. Required for IPv4 BGP peers.
+* `mtu` - (Optional) The maximum transmission unit (MTU) is the size, in bytes, of the largest permissible packet that can be passed over the connection. The MTU of a virtual private interface can be either `1500` or `9001` (jumbo frames). Default is `1500`.
+* `bgp_auth_key` - (Optional) The authentication key for BGP configuration.
+* `customer_address` - (Optional) The IPv4 CIDR destination address to which Amazon should send traffic. Required for IPv4 BGP peers.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the virtual interface.
+* `arn` - The ARN of the virtual interface.
+* `jumbo_frame_capable` - Indicates whether jumbo frames (9001 MTU) are supported.
+* `aws_device` - The Direct Connect endpoint on which the virtual interface terminates.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `10m`)
+- `update` - (Default `10m`)
+- `delete` - (Default `10m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Direct Connect hosted private virtual interfaces using the VIF `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Direct Connect hosted private virtual interfaces using the VIF `id`. For example:
+
+```console
+% terraform import aws_dx_hosted_private_virtual_interface.test dxvif-33cc44dd
+```
+
+<!-- cache-key: cdktf-0.18.0 input-30c56346b371b07a0381a9a9a399fae393a6827e0de105fc1f2ffe338e99c3e4 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/dx_hosted_private_virtual_interface_accepter.html.markdown b/website/docs/cdktf/python/r/dx_hosted_private_virtual_interface_accepter.html.markdown
new file mode 100644
index 00000000000..2549c99cd4c
--- /dev/null
+++ b/website/docs/cdktf/python/r/dx_hosted_private_virtual_interface_accepter.html.markdown
@@ -0,0 +1,117 @@
+---
+subcategory: "Direct Connect"
+layout: "aws"
+page_title: "AWS: aws_dx_hosted_private_virtual_interface_accepter"
+description: |-
+  Provides a resource to manage the accepter's side of a Direct Connect hosted private virtual interface.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_dx_hosted_private_virtual_interface_accepter
+
+Provides a resource to manage the accepter's side of a Direct Connect hosted private virtual interface.
+This resource accepts ownership of a private virtual interface created by another AWS account.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_caller_identity import DataAwsCallerIdentity
+from imports.aws.dx_hosted_private_virtual_interface import DxHostedPrivateVirtualInterface
+from imports.aws.dx_hosted_private_virtual_interface_accepter import DxHostedPrivateVirtualInterfaceAccepter
+from imports.aws.provider import AwsProvider
+from imports.aws.vpn_gateway import VpnGateway
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AwsProvider(self, "aws")
+        accepter = AwsProvider(self, "aws_1",
+            alias="accepter"
+        )
+        vpn_gw = VpnGateway(self, "vpn_gw",
+            provider=accepter
+        )
+        data_aws_caller_identity_accepter = DataAwsCallerIdentity(self, "accepter",
+            provider=accepter
+        )
+        creator = DxHostedPrivateVirtualInterface(self, "creator",
+            address_family="ipv4",
+            bgp_asn=65352,
+            connection_id="dxcon-zzzzzzzz",
+            depends_on=[vpn_gw],
+            name="vif-foo",
+            owner_account_id=Token.as_string(data_aws_caller_identity_accepter.account_id),
+            vlan=4094
+        )
+        aws_dx_hosted_private_virtual_interface_accepter_accepter =
+        DxHostedPrivateVirtualInterfaceAccepter(self, "accepter_5",
+            provider=accepter,
+            tags={
+                "Side": "Accepter"
+            },
+            virtual_interface_id=creator.id,
+            vpn_gateway_id=vpn_gw.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_dx_hosted_private_virtual_interface_accepter_accepter.override_logical_id("accepter")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `virtual_interface_id` - (Required) The ID of the Direct Connect virtual interface to accept.
+* `dx_gateway_id` - (Optional) The ID of the Direct Connect gateway to which to connect the virtual interface.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `vpn_gateway_id` - (Optional) The ID of the [virtual private gateway](vpn_gateway.html) to which to connect the virtual interface.
+
+### Removing `aws_dx_hosted_private_virtual_interface_accepter` from your configuration
+
+AWS allows a Direct Connect hosted private virtual interface to be deleted from either the allocator's or accepter's side.
+However, Terraform only allows the Direct Connect hosted private virtual interface to be deleted from the allocator's side
+by removing the corresponding `aws_dx_hosted_private_virtual_interface` resource from your configuration.
+Removing a `aws_dx_hosted_private_virtual_interface_accepter` resource from your configuration will remove it
+from your statefile and management, **but will not delete the Direct Connect virtual interface.**
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the virtual interface.
+* `arn` - The ARN of the virtual interface.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `10m`)
+- `delete` - (Default `10m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Direct Connect hosted private virtual interfaces using the VIF `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Direct Connect hosted private virtual interfaces using the VIF `id`. For example:
+
+```console
+% terraform import aws_dx_hosted_private_virtual_interface_accepter.test dxvif-33cc44dd
+```
+
+<!-- cache-key: cdktf-0.18.0 input-82aee1d3fc70745175c9dad52c1bbb0ad47469969a29d92069bf48c33d5539a9 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/dx_hosted_public_virtual_interface.html.markdown b/website/docs/cdktf/python/r/dx_hosted_public_virtual_interface.html.markdown
new file mode 100644
index 00000000000..3fb14135abc
--- /dev/null
+++ b/website/docs/cdktf/python/r/dx_hosted_public_virtual_interface.html.markdown
@@ -0,0 +1,92 @@
+---
+subcategory: "Direct Connect"
+layout: "aws"
+page_title: "AWS: aws_dx_hosted_public_virtual_interface"
+description: |-
+  Provides a Direct Connect hosted public virtual interface resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_dx_hosted_public_virtual_interface
+
+Provides a Direct Connect hosted public virtual interface resource. This resource represents the allocator's side of the hosted virtual interface.
+A hosted virtual interface is a virtual interface that is owned by another AWS account.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.dx_hosted_public_virtual_interface import DxHostedPublicVirtualInterface
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, ownerAccountId):
+        super().__init__(scope, name)
+        DxHostedPublicVirtualInterface(self, "foo",
+            address_family="ipv4",
+            amazon_address="175.45.176.2/30",
+            bgp_asn=65352,
+            connection_id="dxcon-zzzzzzzz",
+            customer_address="175.45.176.1/30",
+            name="vif-foo",
+            route_filter_prefixes=["210.52.109.0/24", "175.45.176.0/22"],
+            vlan=4094,
+            owner_account_id=owner_account_id
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `address_family` - (Required) The address family for the BGP peer. `ipv4 ` or `ipv6`.
+* `bgp_asn` - (Required) The autonomous system (AS) number for Border Gateway Protocol (BGP) configuration.
+* `connection_id` - (Required) The ID of the Direct Connect connection (or LAG) on which to create the virtual interface.
+* `name` - (Required) The name for the virtual interface.
+* `owner_account_id` - (Required) The AWS account that will own the new virtual interface.
+* `route_filter_prefixes` - (Required) A list of routes to be advertised to the AWS network in this region.
+* `vlan` - (Required) The VLAN ID.
+* `amazon_address` - (Optional) The IPv4 CIDR address to use to send traffic to Amazon. Required for IPv4 BGP peers.
+* `bgp_auth_key` - (Optional) The authentication key for BGP configuration.
+* `customer_address` - (Optional) The IPv4 CIDR destination address to which Amazon should send traffic. Required for IPv4 BGP peers.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the virtual interface.
+* `arn` - The ARN of the virtual interface.
+* `aws_device` - The Direct Connect endpoint on which the virtual interface terminates.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `10m`)
+- `delete` - (Default `10m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Direct Connect hosted public virtual interfaces using the VIF `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Direct Connect hosted public virtual interfaces using the VIF `id`. For example:
+
+```console
+% terraform import aws_dx_hosted_public_virtual_interface.test dxvif-33cc44dd
+```
+
+<!-- cache-key: cdktf-0.18.0 input-262d7b7a8f2eb087cdb87de5bfe3e80f0a5fe07b0c75b381a8e2e13dc74e39ca -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/dx_hosted_public_virtual_interface_accepter.html.markdown b/website/docs/cdktf/python/r/dx_hosted_public_virtual_interface_accepter.html.markdown
new file mode 100644
index 00000000000..c885a30ef2a
--- /dev/null
+++ b/website/docs/cdktf/python/r/dx_hosted_public_virtual_interface_accepter.html.markdown
@@ -0,0 +1,112 @@
+---
+subcategory: "Direct Connect"
+layout: "aws"
+page_title: "AWS: aws_dx_hosted_public_virtual_interface_accepter"
+description: |-
+  Provides a resource to manage the accepter's side of a Direct Connect hosted public virtual interface.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_dx_hosted_public_virtual_interface_accepter
+
+Provides a resource to manage the accepter's side of a Direct Connect hosted public virtual interface.
+This resource accepts ownership of a public virtual interface created by another AWS account.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_caller_identity import DataAwsCallerIdentity
+from imports.aws.dx_hosted_public_virtual_interface import DxHostedPublicVirtualInterface
+from imports.aws.dx_hosted_public_virtual_interface_accepter import DxHostedPublicVirtualInterfaceAccepter
+from imports.aws.provider import AwsProvider
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AwsProvider(self, "aws")
+        accepter = AwsProvider(self, "aws_1",
+            alias="accepter"
+        )
+        data_aws_caller_identity_accepter = DataAwsCallerIdentity(self, "accepter",
+            provider=accepter
+        )
+        creator = DxHostedPublicVirtualInterface(self, "creator",
+            address_family="ipv4",
+            amazon_address="175.45.176.2/30",
+            bgp_asn=65352,
+            connection_id="dxcon-zzzzzzzz",
+            customer_address="175.45.176.1/30",
+            name="vif-foo",
+            owner_account_id=Token.as_string(data_aws_caller_identity_accepter.account_id),
+            route_filter_prefixes=["210.52.109.0/24", "175.45.176.0/22"],
+            vlan=4094
+        )
+        aws_dx_hosted_public_virtual_interface_accepter_accepter =
+        DxHostedPublicVirtualInterfaceAccepter(self, "accepter_4",
+            provider=accepter,
+            tags={
+                "Side": "Accepter"
+            },
+            virtual_interface_id=creator.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_dx_hosted_public_virtual_interface_accepter_accepter.override_logical_id("accepter")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `virtual_interface_id` - (Required) The ID of the Direct Connect virtual interface to accept.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Removing `aws_dx_hosted_public_virtual_interface_accepter` from your configuration
+
+AWS allows a Direct Connect hosted public virtual interface to be deleted from either the allocator's or accepter's side.
+However, Terraform only allows the Direct Connect hosted public virtual interface to be deleted from the allocator's side
+by removing the corresponding `aws_dx_hosted_public_virtual_interface` resource from your configuration.
+Removing a `aws_dx_hosted_public_virtual_interface_accepter` resource from your configuration will remove it
+from your statefile and management, **but will not delete the Direct Connect virtual interface.**
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the virtual interface.
+* `arn` - The ARN of the virtual interface.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `10m`)
+- `delete` - (Default `10m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Direct Connect hosted public virtual interfaces using the VIF `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Direct Connect hosted public virtual interfaces using the VIF `id`. For example:
+
+```console
+% terraform import aws_dx_hosted_public_virtual_interface_accepter.test dxvif-33cc44dd
+```
+
+<!-- cache-key: cdktf-0.18.0 input-3fb98a54fb9a43c15d6fee296c8d86bd4a38051bd45d29bc11886d96390ceb99 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/dx_hosted_transit_virtual_interface.html.markdown b/website/docs/cdktf/python/r/dx_hosted_transit_virtual_interface.html.markdown
new file mode 100644
index 00000000000..bfc8cd790c8
--- /dev/null
+++ b/website/docs/cdktf/python/r/dx_hosted_transit_virtual_interface.html.markdown
@@ -0,0 +1,92 @@
+---
+subcategory: "Direct Connect"
+layout: "aws"
+page_title: "AWS: aws_dx_hosted_transit_virtual_interface"
+description: |-
+  Provides a Direct Connect hosted transit virtual interface resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_dx_hosted_transit_virtual_interface
+
+Provides a Direct Connect hosted transit virtual interface resource.
+This resource represents the allocator's side of the hosted virtual interface.
+A hosted virtual interface is a virtual interface that is owned by another AWS account.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.dx_hosted_transit_virtual_interface import DxHostedTransitVirtualInterface
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, ownerAccountId):
+        super().__init__(scope, name)
+        DxHostedTransitVirtualInterface(self, "example",
+            address_family="ipv4",
+            bgp_asn=65352,
+            connection_id=Token.as_string(aws_dx_connection_example.id),
+            name="tf-transit-vif-example",
+            vlan=4094,
+            owner_account_id=owner_account_id
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `address_family` - (Required) The address family for the BGP peer. `ipv4 ` or `ipv6`.
+* `bgp_asn` - (Required) The autonomous system (AS) number for Border Gateway Protocol (BGP) configuration.
+* `connection_id` - (Required) The ID of the Direct Connect connection (or LAG) on which to create the virtual interface.
+* `name` - (Required) The name for the virtual interface.
+* `owner_account_id` - (Required) The AWS account that will own the new virtual interface.
+* `vlan` - (Required) The VLAN ID.
+* `amazon_address` - (Optional) The IPv4 CIDR address to use to send traffic to Amazon. Required for IPv4 BGP peers.
+* `bgp_auth_key` - (Optional) The authentication key for BGP configuration.
+* `customer_address` - (Optional) The IPv4 CIDR destination address to which Amazon should send traffic. Required for IPv4 BGP peers.
+* `mtu` - (Optional) The maximum transmission unit (MTU) is the size, in bytes, of the largest permissible packet that can be passed over the connection. The MTU of a virtual transit interface can be either `1500` or `8500` (jumbo frames). Default is `1500`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the virtual interface.
+* `arn` - The ARN of the virtual interface.
+* `aws_device` - The Direct Connect endpoint on which the virtual interface terminates.
+* `jumbo_frame_capable` - Indicates whether jumbo frames (8500 MTU) are supported.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `10m`)
+- `update` - (Default `10m`)
+- `delete` - (Default `10m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Direct Connect hosted transit virtual interfaces using the VIF `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Direct Connect hosted transit virtual interfaces using the VIF `id`. For example:
+
+```console
+% terraform import aws_dx_hosted_transit_virtual_interface.test dxvif-33cc44dd
+```
+
+<!-- cache-key: cdktf-0.18.0 input-f81c32393a3d19d17be728198b387816f13df0e65ec9958f05a3ac37f50db5bd -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/dx_hosted_transit_virtual_interface_accepter.html.markdown b/website/docs/cdktf/python/r/dx_hosted_transit_virtual_interface_accepter.html.markdown
new file mode 100644
index 00000000000..1f3017985bd
--- /dev/null
+++ b/website/docs/cdktf/python/r/dx_hosted_transit_virtual_interface_accepter.html.markdown
@@ -0,0 +1,112 @@
+---
+subcategory: "Direct Connect"
+layout: "aws"
+page_title: "AWS: aws_dx_hosted_transit_virtual_interface_accepter"
+description: |-
+  Provides a resource to manage the accepter's side of a Direct Connect hosted transit virtual interface.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_dx_hosted_transit_virtual_interface_accepter
+
+Provides a resource to manage the accepter's side of a Direct Connect hosted transit virtual interface.
+This resource accepts ownership of a transit virtual interface created by another AWS account.
+
+-> **NOTE:** AWS allows a Direct Connect hosted transit virtual interface to be deleted from either the allocator's or accepter's side. However, Terraform only allows the Direct Connect hosted transit virtual interface to be deleted from the allocator's side by removing the corresponding `aws_dx_hosted_transit_virtual_interface` resource from your configuration. Removing a `aws_dx_hosted_transit_virtual_interface_accepter` resource from your configuration will remove it from your statefile and management, **but will not delete the Direct Connect virtual interface.**
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_caller_identity import DataAwsCallerIdentity
+from imports.aws.dx_gateway import DxGateway
+from imports.aws.dx_hosted_transit_virtual_interface import DxHostedTransitVirtualInterface
+from imports.aws.dx_hosted_transit_virtual_interface_accepter import DxHostedTransitVirtualInterfaceAccepter
+from imports.aws.provider import AwsProvider
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AwsProvider(self, "aws")
+        accepter = AwsProvider(self, "aws_1",
+            alias="accepter"
+        )
+        example = DxGateway(self, "example",
+            amazon_side_asn=Token.as_string(64512),
+            name="tf-dxg-example",
+            provider=accepter
+        )
+        data_aws_caller_identity_accepter = DataAwsCallerIdentity(self, "accepter",
+            provider=accepter
+        )
+        creator = DxHostedTransitVirtualInterface(self, "creator",
+            address_family="ipv4",
+            bgp_asn=65352,
+            connection_id="dxcon-zzzzzzzz",
+            depends_on=[example],
+            name="tf-transit-vif-example",
+            owner_account_id=Token.as_string(data_aws_caller_identity_accepter.account_id),
+            vlan=4094
+        )
+        aws_dx_hosted_transit_virtual_interface_accepter_accepter =
+        DxHostedTransitVirtualInterfaceAccepter(self, "accepter_5",
+            dx_gateway_id=example.id,
+            provider=accepter,
+            tags={
+                "Side": "Accepter"
+            },
+            virtual_interface_id=creator.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_dx_hosted_transit_virtual_interface_accepter_accepter.override_logical_id("accepter")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `dx_gateway_id` - (Required) The ID of the [Direct Connect gateway](dx_gateway.html) to which to connect the virtual interface.
+* `virtual_interface_id` - (Required) The ID of the Direct Connect virtual interface to accept.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the virtual interface.
+* `arn` - The ARN of the virtual interface.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `10m`)
+- `delete` - (Default `10m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Direct Connect hosted transit virtual interfaces using the VIF `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Direct Connect hosted transit virtual interfaces using the VIF `id`. For example:
+
+```console
+% terraform import aws_dx_hosted_transit_virtual_interface_accepter.test dxvif-33cc44dd
+```
+
+<!-- cache-key: cdktf-0.18.0 input-11153e84fd4c6aad81c1acf38c978286aaac606a6d4e54cc6058708bc8cb04ba -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/dx_lag.html.markdown b/website/docs/cdktf/python/r/dx_lag.html.markdown
new file mode 100644
index 00000000000..dda1cbf289e
--- /dev/null
+++ b/website/docs/cdktf/python/r/dx_lag.html.markdown
@@ -0,0 +1,81 @@
+---
+subcategory: "Direct Connect"
+layout: "aws"
+page_title: "AWS: aws_dx_lag"
+description: |-
+  Provides a Direct Connect LAG.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_dx_lag
+
+Provides a Direct Connect LAG. Connections can be added to the LAG via the [`aws_dx_connection`](/docs/providers/aws/r/dx_connection.html) and [`aws_dx_connection_association`](/docs/providers/aws/r/dx_connection_association.html) resources.
+
+~> *NOTE:* When creating a LAG, if no existing connection is specified, Direct Connect will create a connection and Terraform will remove this unmanaged connection during resource creation.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.dx_lag import DxLag
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DxLag(self, "hoge",
+            connections_bandwidth="1Gbps",
+            force_destroy=True,
+            location="EqDC2",
+            name="tf-dx-lag"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the LAG.
+* `connections_bandwidth` - (Required) The bandwidth of the individual physical connections bundled by the LAG. Valid values: 50Mbps, 100Mbps, 200Mbps, 300Mbps, 400Mbps, 500Mbps, 1Gbps, 2Gbps, 5Gbps, 10Gbps and 100Gbps. Case sensitive.
+* `location` - (Required) The AWS Direct Connect location in which the LAG should be allocated. See [DescribeLocations](https://docs.aws.amazon.com/directconnect/latest/APIReference/API_DescribeLocations.html) for the list of AWS Direct Connect locations. Use `locationCode`.
+* `connection_id` - (Optional) The ID of an existing dedicated connection to migrate to the LAG.
+* `force_destroy` - (Optional, Default:false) A boolean that indicates all connections associated with the LAG should be deleted so that the LAG can be destroyed without error. These objects are *not* recoverable.
+* `provider_name` - (Optional) The name of the service provider associated with the LAG.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the LAG.
+* `has_logical_redundancy` - Indicates whether the LAG supports a secondary BGP peer in the same address family (IPv4/IPv6).
+* `id` - The ID of the LAG.
+* `jumbo_frame_capable` -Indicates whether jumbo frames (9001 MTU) are supported.
+* `owner_account_id` - The ID of the AWS account that owns the LAG.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Direct Connect LAGs using the LAG `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Direct Connect LAGs using the LAG `id`. For example:
+
+```console
+% terraform import aws_dx_lag.test_lag dxlag-fgnsp5rq
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ed3f72bbdf567cfec0fe7862f21073034886100b66c1dcbdcdf0587bf6a6a4c4 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/dx_macsec_key_association.html.markdown b/website/docs/cdktf/python/r/dx_macsec_key_association.html.markdown
new file mode 100644
index 00000000000..712b8d3f87d
--- /dev/null
+++ b/website/docs/cdktf/python/r/dx_macsec_key_association.html.markdown
@@ -0,0 +1,98 @@
+---
+subcategory: "Direct Connect"
+layout: "aws"
+page_title: "AWS: aws_dx_macsec_key_association"
+description: |-
+  Provides a MAC Security (MACSec) secret key resource for use with Direct Connect.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_dx_macsec_key_association
+
+Provides a MAC Security (MACSec) secret key resource for use with Direct Connect. See [MACsec prerequisites](https://docs.aws.amazon.com/directconnect/latest/UserGuide/direct-connect-mac-sec-getting-started.html#mac-sec-prerequisites) for information about MAC Security (MACsec) prerequisites.
+
+Creating this resource will also create a resource of type [`aws_secretsmanager_secret`](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/secretsmanager_secret) which is managed by Direct Connect. While you can import this resource into your Terraform state, because this secret is managed by Direct Connect, you will not be able to make any modifications to it. See [How AWS Direct Connect uses AWS Secrets Manager](https://docs.aws.amazon.com/secretsmanager/latest/userguide/integrating_how-services-use-secrets_directconnect.html) for details.
+
+~> **Note:** All arguments including `ckn` and `cak` will be stored in the raw state as plain-text.
+[Read more about sensitive data in state](https://www.terraform.io/docs/state/sensitive-data.html).
+
+~> **Note:** The `secret_arn` argument can only be used to reference a previously created MACSec key. You cannot associate a Secrets Manager secret created outside of the `aws_dx_macsec_key_association` resource.
+
+## Example Usage
+
+### Create MACSec key with CKN and CAK
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_dx_connection import DataAwsDxConnection
+from imports.aws.dx_macsec_key_association import DxMacsecKeyAssociation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = DataAwsDxConnection(self, "example",
+            name="tf-dx-connection"
+        )
+        DxMacsecKeyAssociation(self, "test",
+            cak="abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789",
+            ckn="0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
+            connection_id=Token.as_string(example.id)
+        )
+```
+
+### Create MACSec key with existing Secrets Manager secret
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_dx_connection import DataAwsDxConnection
+from imports.aws.data_aws_secretsmanager_secret import DataAwsSecretsmanagerSecret
+from imports.aws.dx_macsec_key_association import DxMacsecKeyAssociation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = DataAwsDxConnection(self, "example",
+            name="tf-dx-connection"
+        )
+        data_aws_secretsmanager_secret_example = DataAwsSecretsmanagerSecret(self, "example_1",
+            name="directconnect!prod/us-east-1/directconnect/0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_secretsmanager_secret_example.override_logical_id("example")
+        DxMacsecKeyAssociation(self, "test",
+            connection_id=Token.as_string(example.id),
+            secret_arn=Token.as_string(data_aws_secretsmanager_secret_example.arn)
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `cak` - (Optional) The MAC Security (MACsec) CAK to associate with the dedicated connection. The valid values are 64 hexadecimal characters (0-9, A-E). Required if using `ckn`.
+* `ckn` - (Optional) The MAC Security (MACsec) CKN to associate with the dedicated connection. The valid values are 64 hexadecimal characters (0-9, A-E). Required if using `cak`.
+* `connection_id` - (Required) The ID of the dedicated Direct Connect connection. The connection must be a dedicated connection in the `AVAILABLE` state.
+* `secret_arn` - (Optional) The Amazon Resource Name (ARN) of the MAC Security (MACsec) secret key to associate with the dedicated connection.
+
+~> **Note:** `ckn` and `cak` are mutually exclusive with `secret_arn` - these arguments cannot be used together. If you use `ckn` and `cak`, you should not use `secret_arn`. If you use the `secret_arn` argument to reference an existing MAC Security (MACSec) secret key, you should not use `ckn` or `cak`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the MAC Security (MACSec) secret key resource.
+* `start_on` - The date in UTC format that the MAC Security (MACsec) secret key takes effect.
+* `state` -  The state of the MAC Security (MACsec) secret key. The possible values are: associating, associated, disassociating, disassociated. See [MacSecKey](https://docs.aws.amazon.com/directconnect/latest/APIReference/API_MacSecKey.html#DX-Type-MacSecKey-state) for descriptions of each state.
+
+<!-- cache-key: cdktf-0.18.0 input-50e631d31892cfa79cc6641d788fa0436c1b909e5a7fa4536b04ed0e3acb3b04 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/dx_private_virtual_interface.html.markdown b/website/docs/cdktf/python/r/dx_private_virtual_interface.html.markdown
new file mode 100644
index 00000000000..8a1a7e839f4
--- /dev/null
+++ b/website/docs/cdktf/python/r/dx_private_virtual_interface.html.markdown
@@ -0,0 +1,94 @@
+---
+subcategory: "Direct Connect"
+layout: "aws"
+page_title: "AWS: aws_dx_private_virtual_interface"
+description: |-
+  Provides a Direct Connect private virtual interface resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_dx_private_virtual_interface
+
+Provides a Direct Connect private virtual interface resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.dx_private_virtual_interface import DxPrivateVirtualInterface
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DxPrivateVirtualInterface(self, "foo",
+            address_family="ipv4",
+            bgp_asn=65352,
+            connection_id="dxcon-zzzzzzzz",
+            name="vif-foo",
+            vlan=4094
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `address_family` - (Required) The address family for the BGP peer. `ipv4 ` or `ipv6`.
+* `bgp_asn` - (Required) The autonomous system (AS) number for Border Gateway Protocol (BGP) configuration.
+* `connection_id` - (Required) The ID of the Direct Connect connection (or LAG) on which to create the virtual interface.
+* `name` - (Required) The name for the virtual interface.
+* `vlan` - (Required) The VLAN ID.
+* `amazon_address` - (Optional) The IPv4 CIDR address to use to send traffic to Amazon. Required for IPv4 BGP peers.
+* `bgp_auth_key` - (Optional) The authentication key for BGP configuration.
+* `customer_address` - (Optional) The IPv4 CIDR destination address to which Amazon should send traffic. Required for IPv4 BGP peers.
+* `dx_gateway_id` - (Optional) The ID of the Direct Connect gateway to which to connect the virtual interface.
+* `mtu` - (Optional) The maximum transmission unit (MTU) is the size, in bytes, of the largest permissible packet that can be passed over the connection.
+The MTU of a virtual private interface can be either `1500` or `9001` (jumbo frames). Default is `1500`.
+* `sitelink_enabled` - (Optional) Indicates whether to enable or disable SiteLink.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `vpn_gateway_id` - (Optional) The ID of the [virtual private gateway](vpn_gateway.html) to which to connect the virtual interface.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the virtual interface.
+* `arn` - The ARN of the virtual interface.
+* `aws_device` - The Direct Connect endpoint on which the virtual interface terminates.
+* `jumbo_frame_capable` - Indicates whether jumbo frames (9001 MTU) are supported.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `10m`)
+- `update` - (Default `10m`)
+- `delete` - (Default `10m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Direct Connect private virtual interfaces using the VIF `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Direct Connect private virtual interfaces using the VIF `id`. For example:
+
+```console
+% terraform import aws_dx_private_virtual_interface.test dxvif-33cc44dd
+```
+
+<!-- cache-key: cdktf-0.18.0 input-c9ac0219d04bdf984abd5ff5099a9682a1da16fcc6658d74d4103ab21c9a9998 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/dx_public_virtual_interface.html.markdown b/website/docs/cdktf/python/r/dx_public_virtual_interface.html.markdown
new file mode 100644
index 00000000000..7952afb02d3
--- /dev/null
+++ b/website/docs/cdktf/python/r/dx_public_virtual_interface.html.markdown
@@ -0,0 +1,91 @@
+---
+subcategory: "Direct Connect"
+layout: "aws"
+page_title: "AWS: aws_dx_public_virtual_interface"
+description: |-
+  Provides a Direct Connect public virtual interface resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_dx_public_virtual_interface
+
+Provides a Direct Connect public virtual interface resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.dx_public_virtual_interface import DxPublicVirtualInterface
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DxPublicVirtualInterface(self, "foo",
+            address_family="ipv4",
+            amazon_address="175.45.176.2/30",
+            bgp_asn=65352,
+            connection_id="dxcon-zzzzzzzz",
+            customer_address="175.45.176.1/30",
+            name="vif-foo",
+            route_filter_prefixes=["210.52.109.0/24", "175.45.176.0/22"],
+            vlan=4094
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `address_family` - (Required) The address family for the BGP peer. `ipv4 ` or `ipv6`.
+* `bgp_asn` - (Required) The autonomous system (AS) number for Border Gateway Protocol (BGP) configuration.
+* `connection_id` - (Required) The ID of the Direct Connect connection (or LAG) on which to create the virtual interface.
+* `name` - (Required) The name for the virtual interface.
+* `vlan` - (Required) The VLAN ID.
+* `amazon_address` - (Optional) The IPv4 CIDR address to use to send traffic to Amazon. Required for IPv4 BGP peers.
+* `bgp_auth_key` - (Optional) The authentication key for BGP configuration.
+* `customer_address` - (Optional) The IPv4 CIDR destination address to which Amazon should send traffic. Required for IPv4 BGP peers.
+* `route_filter_prefixes` - (Required) A list of routes to be advertised to the AWS network in this region.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the virtual interface.
+* `arn` - The ARN of the virtual interface.
+* `aws_device` - The Direct Connect endpoint on which the virtual interface terminates.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `10m`)
+- `delete` - (Default `10m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Direct Connect public virtual interfaces using the VIF `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Direct Connect public virtual interfaces using the VIF `id`. For example:
+
+```console
+% terraform import aws_dx_public_virtual_interface.test dxvif-33cc44dd
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ebdc8f75c16e66de8524c4ee98373933ff1fa3ba07471cde890864f94bc85d6f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/dx_transit_virtual_interface.html.markdown b/website/docs/cdktf/python/r/dx_transit_virtual_interface.html.markdown
new file mode 100644
index 00000000000..abe6f5fb834
--- /dev/null
+++ b/website/docs/cdktf/python/r/dx_transit_virtual_interface.html.markdown
@@ -0,0 +1,102 @@
+---
+subcategory: "Direct Connect"
+layout: "aws"
+page_title: "AWS: aws_dx_transit_virtual_interface"
+description: |-
+  Provides a Direct Connect transit virtual interface resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_dx_transit_virtual_interface
+
+Provides a Direct Connect transit virtual interface resource.
+A transit virtual interface is a VLAN that transports traffic from a [Direct Connect gateway](dx_gateway.html) to one or more [transit gateways](ec2_transit_gateway.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.dx_gateway import DxGateway
+from imports.aws.dx_transit_virtual_interface import DxTransitVirtualInterface
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = DxGateway(self, "example",
+            amazon_side_asn=Token.as_string(64512),
+            name="tf-dxg-example"
+        )
+        aws_dx_transit_virtual_interface_example = DxTransitVirtualInterface(self, "example_1",
+            address_family="ipv4",
+            bgp_asn=65352,
+            connection_id=Token.as_string(aws_dx_connection_example.id),
+            dx_gateway_id=example.id,
+            name="tf-transit-vif-example",
+            vlan=4094
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_dx_transit_virtual_interface_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `address_family` - (Required) The address family for the BGP peer. `ipv4 ` or `ipv6`.
+* `bgp_asn` - (Required) The autonomous system (AS) number for Border Gateway Protocol (BGP) configuration.
+* `connection_id` - (Required) The ID of the Direct Connect connection (or LAG) on which to create the virtual interface.
+* `dx_gateway_id` - (Required) The ID of the Direct Connect gateway to which to connect the virtual interface.
+* `name` - (Required) The name for the virtual interface.
+* `vlan` - (Required) The VLAN ID.
+* `amazon_address` - (Optional) The IPv4 CIDR address to use to send traffic to Amazon. Required for IPv4 BGP peers.
+* `bgp_auth_key` - (Optional) The authentication key for BGP configuration.
+* `customer_address` - (Optional) The IPv4 CIDR destination address to which Amazon should send traffic. Required for IPv4 BGP peers.
+* `mtu` - (Optional) The maximum transmission unit (MTU) is the size, in bytes, of the largest permissible packet that can be passed over the connection.
+The MTU of a virtual transit interface can be either `1500` or `8500` (jumbo frames). Default is `1500`.
+* `sitelink_enabled` - (Optional) Indicates whether to enable or disable SiteLink.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the virtual interface.
+* `arn` - The ARN of the virtual interface.
+* `aws_device` - The Direct Connect endpoint on which the virtual interface terminates.
+* `jumbo_frame_capable` - Indicates whether jumbo frames (8500 MTU) are supported.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `10m`)
+- `update` - (Default `10m`)
+- `delete` - (Default `10m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Direct Connect transit virtual interfaces using the VIF `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Direct Connect transit virtual interfaces using the VIF `id`. For example:
+
+```console
+% terraform import aws_dx_transit_virtual_interface.test dxvif-33cc44dd
+```
+
+<!-- cache-key: cdktf-0.18.0 input-50fafeb6465a4e137f551c411cb1ceffa75181ced4f85830fcb62fdb271ace49 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/dynamodb_contributor_insights.html.markdown b/website/docs/cdktf/python/r/dynamodb_contributor_insights.html.markdown
new file mode 100644
index 00000000000..be4b8b00ffc
--- /dev/null
+++ b/website/docs/cdktf/python/r/dynamodb_contributor_insights.html.markdown
@@ -0,0 +1,64 @@
+---
+subcategory: "DynamoDB"
+layout: "aws"
+page_title: "AWS: aws_dynamodb_contributor_insights"
+description: |-
+  Provides a DynamoDB contributor insights resource
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_dynamodb_contributor_insights
+
+Provides a DynamoDB contributor insights resource
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.dynamodb_contributor_insights import DynamodbContributorInsights
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DynamodbContributorInsights(self, "test",
+            table_name="ExampleTableName"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `table_name` - (Required) The name of the table to enable contributor insights
+* `index_name` - (Optional) The global secondary index name
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_dynamodb_contributor_insights` using the format `name:table_name/index:index_name`, followed by the account number. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_dynamodb_contributor_insights` using the format `name:table_name/index:index_name`, followed by the account number. For example:
+
+```console
+% terraform import aws_dynamodb_contributor_insights.test name:ExampleTableName/index:ExampleIndexName/123456789012
+```
+
+<!-- cache-key: cdktf-0.18.0 input-d4f805846bc4797dd113a929cf5b487a41e12a9aff6d1f926f1a2fb7c8b04f60 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/dynamodb_global_table.html.markdown b/website/docs/cdktf/python/r/dynamodb_global_table.html.markdown
new file mode 100644
index 00000000000..fee8b5c144a
--- /dev/null
+++ b/website/docs/cdktf/python/r/dynamodb_global_table.html.markdown
@@ -0,0 +1,123 @@
+---
+subcategory: "DynamoDB"
+layout: "aws"
+page_title: "AWS: aws_dynamodb_global_table"
+description: |-
+  Manages DynamoDB Global Tables V1 (version 2017.11.29)
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_dynamodb_global_table
+
+Manages [DynamoDB Global Tables V1 (version 2017.11.29)](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/globaltables.V1.html). These are layered on top of existing DynamoDB Tables.
+
+~> **NOTE:** To instead manage [DynamoDB Global Tables V2 (version 2019.11.21)](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/globaltables.V2.html), use the [`aws_dynamodb_table` resource](/docs/providers/aws/r/dynamodb_table.html) `replica` configuration block.
+
+~> Note: There are many restrictions before you can properly create DynamoDB Global Tables in multiple regions. See the [AWS DynamoDB Global Table Requirements](http://docs.aws.amazon.com/amazondynamodb/latest/developerguide/globaltables_reqs_bestpractices.html) for more information.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.dynamodb_global_table import DynamodbGlobalTable
+from imports.aws.dynamodb_table import DynamodbTable
+from imports.aws.provider import AwsProvider
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        us_east1 = AwsProvider(self, "aws",
+            alias="us-east-1",
+            region="us-east-1"
+        )
+        us_west2 = AwsProvider(self, "aws_1",
+            alias="us-west-2",
+            region="us-west-2"
+        )
+        aws_dynamodb_table_us_east1 = DynamodbTable(self, "us-east-1",
+            attribute=[DynamodbTableAttribute(
+                name="myAttribute",
+                type="S"
+            )
+            ],
+            hash_key="myAttribute",
+            name="myTable",
+            provider=us_east1,
+            read_capacity=1,
+            stream_enabled=True,
+            stream_view_type="NEW_AND_OLD_IMAGES",
+            write_capacity=1
+        )
+        aws_dynamodb_table_us_west2 = DynamodbTable(self, "us-west-2",
+            attribute=[DynamodbTableAttribute(
+                name="myAttribute",
+                type="S"
+            )
+            ],
+            hash_key="myAttribute",
+            name="myTable",
+            provider=us_west2,
+            read_capacity=1,
+            stream_enabled=True,
+            stream_view_type="NEW_AND_OLD_IMAGES",
+            write_capacity=1
+        )
+        DynamodbGlobalTable(self, "myTable",
+            depends_on=[aws_dynamodb_table_us_east1, aws_dynamodb_table_us_west2],
+            name="myTable",
+            provider=us_east1,
+            replica=[DynamodbGlobalTableReplica(
+                region_name="us-east-1"
+            ), DynamodbGlobalTableReplica(
+                region_name="us-west-2"
+            )
+            ]
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the global table. Must match underlying DynamoDB Table names in all regions.
+* `replica` - (Required) Underlying DynamoDB Table. At least 1 replica must be defined. See below.
+
+### Nested Fields
+
+#### `replica`
+
+* `region_name` - (Required) AWS region name of replica DynamoDB TableE.g., `us-east-1`
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name of the DynamoDB Global Table
+* `arn` - The ARN of the DynamoDB Global Table
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DynamoDB Global Tables using the global table name. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import DynamoDB Global Tables using the global table name. For example:
+
+```console
+% terraform import aws_dynamodb_global_table.MyTable MyTable
+```
+
+<!-- cache-key: cdktf-0.18.0 input-36c3419a203344c40c1651647342ffb9754b89e09585c7824bc0dc4a9fd6a617 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/dynamodb_kinesis_streaming_destination.html.markdown b/website/docs/cdktf/python/r/dynamodb_kinesis_streaming_destination.html.markdown
new file mode 100644
index 00000000000..baa3944e43a
--- /dev/null
+++ b/website/docs/cdktf/python/r/dynamodb_kinesis_streaming_destination.html.markdown
@@ -0,0 +1,89 @@
+---
+subcategory: "DynamoDB"
+layout: "aws"
+page_title: "AWS: aws_dynamodb_kinesis_streaming_destination"
+description: |-
+  Enables a Kinesis streaming destination for a DynamoDB table
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_dynamodb_kinesis_streaming_destination
+
+Enables a [Kinesis streaming destination](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/kds.html) for data replication of a DynamoDB table.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.dynamodb_kinesis_streaming_destination import DynamodbKinesisStreamingDestination
+from imports.aws.dynamodb_table import DynamodbTable
+from imports.aws.kinesis_stream import KinesisStream
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = DynamodbTable(self, "example",
+            attribute=[DynamodbTableAttribute(
+                name="id",
+                type="S"
+            )
+            ],
+            hash_key="id",
+            name="orders"
+        )
+        aws_kinesis_stream_example = KinesisStream(self, "example_1",
+            name="order_item_changes",
+            shard_count=1
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_kinesis_stream_example.override_logical_id("example")
+        aws_dynamodb_kinesis_streaming_destination_example =
+        DynamodbKinesisStreamingDestination(self, "example_2",
+            stream_arn=Token.as_string(aws_kinesis_stream_example.arn),
+            table_name=example.name
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_dynamodb_kinesis_streaming_destination_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `stream_arn` - (Required) The ARN for a Kinesis data stream. This must exist in the same account and region as the DynamoDB table.
+  
+* `table_name` - (Required) The name of the DynamoDB table. There
+  can only be one Kinesis streaming destination for a given DynamoDB table.
+  
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The `table_name` and `stream_arn` separated by a comma (`,`).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DynamoDB Kinesis Streaming Destinations using the `table_name` and `stream_arn` separated by `,`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import DynamoDB Kinesis Streaming Destinations using the `table_name` and `stream_arn` separated by `,`. For example:
+
+```console
+% terraform import aws_dynamodb_kinesis_streaming_destination.example example,arn:aws:kinesis:us-east-1:111122223333:exampleStreamName
+```
+
+<!-- cache-key: cdktf-0.18.0 input-d0a54894e87b04c66f4b0385516446c2240689109ec043bf93470658fee0ec34 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/dynamodb_table.html.markdown b/website/docs/cdktf/python/r/dynamodb_table.html.markdown
new file mode 100644
index 00000000000..cb3e04317a6
--- /dev/null
+++ b/website/docs/cdktf/python/r/dynamodb_table.html.markdown
@@ -0,0 +1,334 @@
+---
+subcategory: "DynamoDB"
+layout: "aws"
+page_title: "AWS: aws_dynamodb_table"
+description: |-
+  Provides a DynamoDB table resource
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_dynamodb_table
+
+Provides a DynamoDB table resource.
+
+~> **Note:** We recommend using `lifecycle` [`ignore_changes`](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html#ignore_changes) for `read_capacity` and/or `write_capacity` if there's [autoscaling policy](/docs/providers/aws/r/appautoscaling_policy.html) attached to the table.
+
+~> **Note:** When using [aws_dynamodb_table_replica](/docs/providers/aws/r/dynamodb_table_replica.html) with this resource, use `lifecycle` [`ignore_changes`](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html#ignore_changes) for `replica`, _e.g._, `lifecycle { ignore_changes = [replica] }`.
+
+## DynamoDB Table attributes
+
+Only define attributes on the table object that are going to be used as:
+
+* Table hash key or range key
+* LSI or GSI hash key or range key
+
+The DynamoDB API expects attribute structure (name and type) to be passed along when creating or updating GSI/LSIs or creating the initial table. In these cases it expects the Hash / Range keys to be provided. Because these get re-used in numerous places (i.e the table's range key could be a part of one or more GSIs), they are stored on the table object to prevent duplication and increase consistency. If you add attributes here that are not used in these scenarios it can cause an infinite loop in planning.
+
+## Example Usage
+
+### Basic Example
+
+The following dynamodb table description models the table and GSI shown in the [AWS SDK example documentation](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/GSI.html)
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.dynamodb_table import DynamodbTable
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DynamodbTable(self, "basic-dynamodb-table",
+            attribute=[DynamodbTableAttribute(
+                name="UserId",
+                type="S"
+            ), DynamodbTableAttribute(
+                name="GameTitle",
+                type="S"
+            ), DynamodbTableAttribute(
+                name="TopScore",
+                type="N"
+            )
+            ],
+            billing_mode="PROVISIONED",
+            global_secondary_index=[DynamodbTableGlobalSecondaryIndex(
+                hash_key="GameTitle",
+                name="GameTitleIndex",
+                non_key_attributes=["UserId"],
+                projection_type="INCLUDE",
+                range_key="TopScore",
+                read_capacity=10,
+                write_capacity=10
+            )
+            ],
+            hash_key="UserId",
+            name="GameScores",
+            range_key="GameTitle",
+            read_capacity=20,
+            tags={
+                "Environment": "production",
+                "Name": "dynamodb-table-1"
+            },
+            ttl=DynamodbTableTtl(
+                attribute_name="TimeToExist",
+                enabled=False
+            ),
+            write_capacity=20
+        )
+```
+
+### Global Tables
+
+This resource implements support for [DynamoDB Global Tables V2 (version 2019.11.21)](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/globaltables.V2.html) via `replica` configuration blocks. For working with [DynamoDB Global Tables V1 (version 2017.11.29)](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/globaltables.V1.html), see the [`aws_dynamodb_global_table` resource](/docs/providers/aws/r/dynamodb_global_table.html).
+
+~> **Note:** [aws_dynamodb_table_replica](/docs/providers/aws/r/dynamodb_table_replica.html) is an alternate way of configuring Global Tables. Do not use `replica` configuration blocks of `aws_dynamodb_table` together with [aws_dynamodb_table_replica](/docs/providers/aws/r/dynamodb_table_replica.html).
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.dynamodb_table import DynamodbTable
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DynamodbTable(self, "example",
+            attribute=[DynamodbTableAttribute(
+                name="TestTableHashKey",
+                type="S"
+            )
+            ],
+            billing_mode="PAY_PER_REQUEST",
+            hash_key="TestTableHashKey",
+            name="example",
+            replica=[DynamodbTableReplica(
+                region_name="us-east-2"
+            ), DynamodbTableReplica(
+                region_name="us-west-2"
+            )
+            ],
+            stream_enabled=True,
+            stream_view_type="NEW_AND_OLD_IMAGES"
+        )
+```
+
+### Replica Tagging
+
+You can manage global table replicas' tags in various ways. This example shows using `replica.*.propagate_tags` for the first replica and the `aws_dynamodb_tag` resource for the other.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, Fn, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_region import DataAwsRegion
+from imports.aws.dynamodb_table import DynamodbTable
+from imports.aws.dynamodb_tag import DynamodbTag
+from imports.aws.provider import AwsProvider
+from imports.awsalternate.provider import AwsalternateProvider
+from imports.awsthird.provider import AwsthirdProvider
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        # The following providers are missing schema information and might need manual adjustments to synthesize correctly: awsalternate, awsthird.
+        #     For a more precise conversion please use the --provider flag in convert.
+        AwsProvider(self, "aws",
+            region="us-west-2"
+        )
+        AwsalternateProvider(self, "awsalternate",
+            region="us-east-1"
+        )
+        AwsthirdProvider(self, "awsthird",
+            region="us-east-2"
+        )
+        alternate = DataAwsRegion(self, "alternate",
+            provider="awsalternate"
+        )
+        current = DataAwsRegion(self, "current")
+        third = DataAwsRegion(self, "third",
+            provider="awsthird"
+        )
+        example = DynamodbTable(self, "example",
+            attribute=[DynamodbTableAttribute(
+                name="TestTableHashKey",
+                type="S"
+            )
+            ],
+            billing_mode="PAY_PER_REQUEST",
+            hash_key="TestTableHashKey",
+            name="example-13281",
+            replica=[DynamodbTableReplica(
+                region_name=Token.as_string(alternate.name)
+            ), DynamodbTableReplica(
+                propagate_tags=True,
+                region_name=Token.as_string(third.name)
+            )
+            ],
+            stream_enabled=True,
+            stream_view_type="NEW_AND_OLD_IMAGES",
+            tags={
+                "Architect": "Eleanor",
+                "Zone": "SW"
+            }
+        )
+        aws_dynamodb_tag_example = DynamodbTag(self, "example_7",
+            key="Architect",
+            resource_arn=Token.as_string(
+                Fn.replace(example.arn,
+                    Token.as_string(current.name),
+                    Token.as_string(alternate.name))),
+            value="Gigi"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_dynamodb_tag_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+Required arguments:
+
+* `attribute` - (Required) Set of nested attribute definitions. Only required for `hash_key` and `range_key` attributes. See below.
+* `hash_key` - (Required, Forces new resource) Attribute to use as the hash (partition) key. Must also be defined as an `attribute`. See below.
+* `name` - (Required) Unique within a region name of the table.
+
+Optional arguments:
+
+* `billing_mode` - (Optional) Controls how you are charged for read and write throughput and how you manage capacity. The valid values are `PROVISIONED` and `PAY_PER_REQUEST`. Defaults to `PROVISIONED`.
+* `deletion_protection_enabled` - (Optional) Enables deletion protection for table. Defaults to `false`.
+* `import_table` - (Optional) Import Amazon S3 data into a new table. See below.
+* `global_secondary_index` - (Optional) Describe a GSI for the table; subject to the normal limits on the number of GSIs, projected attributes, etc. See below.
+* `local_secondary_index` - (Optional, Forces new resource) Describe an LSI on the table; these can only be allocated _at creation_ so you cannot change this definition after you have created the resource. See below.
+* `point_in_time_recovery` - (Optional) Enable point-in-time recovery options. See below.
+* `range_key` - (Optional, Forces new resource) Attribute to use as the range (sort) key. Must also be defined as an `attribute`, see below.
+* `read_capacity` - (Optional) Number of read units for this table. If the `billing_mode` is `PROVISIONED`, this field is required.
+* `replica` - (Optional) Configuration block(s) with [DynamoDB Global Tables V2 (version 2019.11.21)](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/globaltables.V2.html) replication configurations. See below.
+* `restore_date_time` - (Optional) Time of the point-in-time recovery point to restore.
+* `restore_source_name` - (Optional) Name of the table to restore. Must match the name of an existing table.
+* `restore_to_latest_time` - (Optional) If set, restores table to the most recent point-in-time recovery point.
+* `server_side_encryption` - (Optional) Encryption at rest options. AWS DynamoDB tables are automatically encrypted at rest with an AWS-owned Customer Master Key if this argument isn't specified. See below.
+* `stream_enabled` - (Optional) Whether Streams are enabled.
+* `stream_view_type` - (Optional) When an item in the table is modified, StreamViewType determines what information is written to the table's stream. Valid values are `KEYS_ONLY`, `NEW_IMAGE`, `OLD_IMAGE`, `NEW_AND_OLD_IMAGES`.
+* `table_class` - (Optional) Storage class of the table.
+  Valid values are `STANDARD` and `STANDARD_INFREQUENT_ACCESS`.
+  Default value is `STANDARD`.
+* `tags` - (Optional) A map of tags to populate on the created table. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `ttl` - (Optional) Configuration block for TTL. See below.
+* `write_capacity` - (Optional) Number of write units for this table. If the `billing_mode` is `PROVISIONED`, this field is required.
+
+### `attribute`
+
+* `name` - (Required) Name of the attribute
+* `type` - (Required) Attribute type. Valid values are `S` (string), `N` (number), `B` (binary).
+
+### `import_table`
+
+* `input_format` - (Required) The format of the source data. Valid values are `CSV`, `DYNAMODB_JSON` and `ION`.
+* `s3_bucket_source` - (Required) Values for the S3 bucket the source file is imported from. See below.
+* `client_token` - (Optional) Makes the import idempotent, meaning that multiple identical calls have the same effect as one single call (8 hours validity).
+* `input_compression_type` - (Optional) Type of compression to be used on the input coming from the imported table. Valid values are `GZIP`, `ZSTD` and `NONE`.
+* `input_format_options` - (Optional) Describe the format options for the data that was imported into the target table. There is one value, `csv`. See below.
+
+#### `input_format_options`
+
+* `csv` - (Optional) This block contains the processing options for the CSV file being imported:
+    * `delimiter` - (Optional) The delimiter used for separating items in the CSV file being imported.
+    * `header_list` - (Optional) List of the headers used to specify a common header for all source CSV files being imported.
+
+#### `s3_bucket_source`
+
+* `bucket` - (Required) The S3 bucket that is being imported from.
+* `bucket_owner`- (Optional) The account number of the S3 bucket that is being imported from.
+* `key_prefix` - (Optional) The key prefix shared by all S3 Objects that are being imported.
+
+### `global_secondary_index`
+
+* `hash_key` - (Required) Name of the hash key in the index; must be defined as an attribute in the resource.
+* `name` - (Required) Name of the index.
+* `non_key_attributes` - (Optional) Only required with `INCLUDE` as a projection type; a list of attributes to project into the index. These do not need to be defined as attributes on the table.
+* `projection_type` - (Required) One of `ALL`, `INCLUDE` or `KEYS_ONLY` where `ALL` projects every attribute into the index, `KEYS_ONLY` projects  into the index only the table and index hash_key and sort_key attributes ,  `INCLUDE` projects into the index all of the attributes that are defined in `non_key_attributes` in addition to the attributes that that`KEYS_ONLY` project.
+* `range_key` - (Optional) Name of the range key; must be defined
+* `read_capacity` - (Optional) Number of read units for this index. Must be set if billing_mode is set to PROVISIONED.
+* `write_capacity` - (Optional) Number of write units for this index. Must be set if billing_mode is set to PROVISIONED.
+
+### `local_secondary_index`
+
+* `name` - (Required) Name of the index
+* `non_key_attributes` - (Optional) Only required with `INCLUDE` as a projection type; a list of attributes to project into the index. These do not need to be defined as attributes on the table.
+* `projection_type` - (Required) One of `ALL`, `INCLUDE` or `KEYS_ONLY` where `ALL` projects every attribute into the index, `KEYS_ONLY` projects  into the index only the table and index hash_key and sort_key attributes ,  `INCLUDE` projects into the index all of the attributes that are defined in `non_key_attributes` in addition to the attributes that that`KEYS_ONLY` project.
+* `range_key` - (Required) Name of the range key.
+
+### `point_in_time_recovery`
+
+* `enabled` - (Required) Whether to enable point-in-time recovery. It can take 10 minutes to enable for new tables. If the `point_in_time_recovery` block is not provided, this defaults to `false`.
+
+### `replica`
+
+* `kms_key_arn` - (Optional, Forces new resource) ARN of the CMK that should be used for the AWS KMS encryption. This argument should only be used if the key is different from the default KMS-managed DynamoDB key, `alias/aws/dynamodb`. **Note:** This attribute will _not_ be populated with the ARN of _default_ keys.
+* `point_in_time_recovery` - (Optional) Whether to enable Point In Time Recovery for the replica. Default is `false`.
+* `propagate_tags` - (Optional) Whether to propagate the global table's tags to a replica. Default is `false`. Changes to tags only move in one direction: from global (source) to replica. In other words, tag drift on a replica will not trigger an update. Tag or replica changes on the global table, whether from drift or configuration changes, are propagated to replicas. Changing from `true` to `false` on a subsequent `apply` means replica tags are left as they were, unmanaged, not deleted.
+* `region_name` - (Required) Region name of the replica.
+
+### `server_side_encryption`
+
+* `enabled` - (Required) Whether or not to enable encryption at rest using an AWS managed KMS customer master key (CMK). If `enabled` is `false` then server-side encryption is set to AWS-_owned_ key (shown as `DEFAULT` in the AWS console). Potentially confusingly, if `enabled` is `true` and no `kms_key_arn` is specified then server-side encryption is set to the _default_ KMS-_managed_ key (shown as `KMS` in the AWS console). The [AWS KMS documentation](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html) explains the difference between AWS-_owned_ and KMS-_managed_ keys.
+* `kms_key_arn` - (Optional) ARN of the CMK that should be used for the AWS KMS encryption. This argument should only be used if the key is different from the default KMS-managed DynamoDB key, `alias/aws/dynamodb`. **Note:** This attribute will _not_ be populated with the ARN of _default_ keys.
+
+### `ttl`
+
+* `enabled` - (Required) Whether TTL is enabled.
+* `attribute_name` - (Required) Name of the table attribute to store the TTL timestamp in.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the table
+* `id` - Name of the table
+* `replica.*.arn` - ARN of the replica
+* `replica.*.stream_arn` - ARN of the replica Table Stream. Only available when `stream_enabled = true`.
+* `replica.*.stream_label` - Timestamp, in ISO 8601 format, for the replica stream. Note that this timestamp is not a unique identifier for the stream on its own. However, the combination of AWS customer ID, table name and this field is guaranteed to be unique. It can be used for creating CloudWatch Alarms. Only available when `stream_enabled = true`.
+* `stream_arn` - ARN of the Table Stream. Only available when `stream_enabled = true`
+* `stream_label` - Timestamp, in ISO 8601 format, for this stream. Note that this timestamp is not a unique identifier for the stream on its own. However, the combination of AWS customer ID, table name and this field is guaranteed to be unique. It can be used for creating CloudWatch Alarms. Only available when `stream_enabled = true`.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+~> **Note:** There are a variety of default timeouts set internally. If you set a shorter custom timeout than one of the defaults, the custom timeout will not be respected as the longer of the custom or internal default will be used.
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `30m`)
+* `update` - (Default `60m`)
+* `delete` - (Default `10m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DynamoDB tables using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import DynamoDB tables using the `name`. For example:
+
+```console
+% terraform import aws_dynamodb_table.basic-dynamodb-table GameScores
+```
+
+<!-- cache-key: cdktf-0.18.0 input-331d28a11466721603dd7ef5ef376375b2685f617fa41cb89eac4c639b0b23d1 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/dynamodb_table_item.html.markdown b/website/docs/cdktf/python/r/dynamodb_table_item.html.markdown
new file mode 100644
index 00000000000..55a8184685d
--- /dev/null
+++ b/website/docs/cdktf/python/r/dynamodb_table_item.html.markdown
@@ -0,0 +1,72 @@
+---
+subcategory: "DynamoDB"
+layout: "aws"
+page_title: "AWS: aws_dynamodb_table_item"
+description: |-
+  Provides a DynamoDB table item resource
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_dynamodb_table_item
+
+Provides a DynamoDB table item resource
+
+-> **Note:** This resource is not meant to be used for managing large amounts of data in your table, it is not designed to scale.
+  You should perform **regular backups** of all data in the table, see [AWS docs for more](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/BackupRestore.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.dynamodb_table import DynamodbTable
+from imports.aws.dynamodb_table_item import DynamodbTableItem
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = DynamodbTable(self, "example",
+            attribute=[DynamodbTableAttribute(
+                name="exampleHashKey",
+                type="S"
+            )
+            ],
+            hash_key="exampleHashKey",
+            name="example-name",
+            read_capacity=10,
+            write_capacity=10
+        )
+        aws_dynamodb_table_item_example = DynamodbTableItem(self, "example_1",
+            hash_key=example.hash_key,
+            item="{\n  \"exampleHashKey\": {\"S\": \"something\"},\n  \"one\": {\"N\": \"11111\"},\n  \"two\": {\"N\": \"22222\"},\n  \"three\": {\"N\": \"33333\"},\n  \"four\": {\"N\": \"44444\"}\n}\n\n",
+            table_name=example.name
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_dynamodb_table_item_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+~> **Note:** Names included in `item` are represented internally with everything but letters removed. There is the possibility of collisions if two names, once filtered, are the same. For example, the names `your-name-here` and `yournamehere` will overlap and cause an error.
+
+This argument supports the following arguments:
+
+* `hash_key` - (Required) Hash key to use for lookups and identification of the item
+* `item` - (Required) JSON representation of a map of attribute name/value pairs, one for each attribute. Only the primary key attributes are required; you can optionally provide other attribute name-value pairs for the item.
+* `range_key` - (Optional) Range key to use for lookups and identification of the item. Required if there is range key defined in the table.
+* `table_name` - (Required) Name of the table to contain the item.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+## Import
+
+You cannot import DynamoDB table items.
+
+<!-- cache-key: cdktf-0.18.0 input-6a024662e07162f55823fe5a6848f74b793eff6585ccc516e75fcbdfe573f734 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/dynamodb_table_replica.html.markdown b/website/docs/cdktf/python/r/dynamodb_table_replica.html.markdown
new file mode 100644
index 00000000000..075eb3091e9
--- /dev/null
+++ b/website/docs/cdktf/python/r/dynamodb_table_replica.html.markdown
@@ -0,0 +1,126 @@
+---
+subcategory: "DynamoDB"
+layout: "aws"
+page_title: "AWS: aws_dynamodb_table_replica"
+description: |-
+  Provides a DynamoDB table replica resource
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_dynamodb_table_replica
+
+Provides a DynamoDB table replica resource for [DynamoDB Global Tables V2 (version 2019.11.21)](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/globaltables.V2.html).
+
+~> **Note:** Use `lifecycle` [`ignore_changes`](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html#ignore_changes) for `replica` in the associated [aws_dynamodb_table](/docs/providers/aws/r/dynamodb_table.html) configuration.
+
+~> **Note:** Do not use the `replica` configuration block of [aws_dynamodb_table](/docs/providers/aws/r/dynamodb_table.html) together with this resource as the two configuration options are mutually exclusive.
+
+## Example Usage
+
+### Basic Example
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from cdktf import TerraformResourceLifecycle
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.dynamodb_table import DynamodbTable
+from imports.aws.dynamodb_table_replica import DynamodbTableReplicaA
+from imports.aws.provider import AwsProvider
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        main = AwsProvider(self, "aws",
+            alias="main",
+            region="us-west-2"
+        )
+        alt = AwsProvider(self, "aws_1",
+            alias="alt",
+            region="us-east-2"
+        )
+        example = DynamodbTable(self, "example",
+            attribute=[DynamodbTableAttribute(
+                name="BrodoBaggins",
+                type="S"
+            )
+            ],
+            billing_mode="PAY_PER_REQUEST",
+            hash_key="BrodoBaggins",
+            lifecycle=TerraformResourceLifecycle(
+                ignore_changes=[replica]
+            ),
+            name="TestTable",
+            provider=main,
+            stream_enabled=True,
+            stream_view_type="NEW_AND_OLD_IMAGES"
+        )
+        aws_dynamodb_table_replica_example = DynamodbTableReplicaA(self, "example_3",
+            global_table_arn=example.arn,
+            provider=alt,
+            tags={
+                "Name": "IZPAWS",
+                "Pozo": "Amargo"
+            }
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_dynamodb_table_replica_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+Required arguments:
+
+* `global_table_arn` - (Required) ARN of the _main_ or global table which this resource will replicate.
+
+Optional arguments:
+
+* `kms_key_arn` - (Optional, Forces new resource) ARN of the CMK that should be used for the AWS KMS encryption. This argument should only be used if the key is different from the default KMS-managed DynamoDB key, `alias/aws/dynamodb`. **Note:** This attribute will _not_ be populated with the ARN of _default_ keys.
+* `point_in_time_recovery` - (Optional) Whether to enable Point In Time Recovery for the replica. Default is `false`.
+* `table_class_override` - (Optional, Forces new resource) Storage class of the table replica. Valid values are `STANDARD` and `STANDARD_INFREQUENT_ACCESS`. If not used, the table replica will use the same class as the global table.
+* `tags` - (Optional) Map of tags to populate on the created table. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the table replica.
+* `id` - Name of the table and region of the main global table joined with a semicolon (_e.g._, `TableName:us-east-1`).
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `30m`)
+* `update` - (Default `30m`)
+* `delete` - (Default `20m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DynamoDB table replicas using the `table-name:main-region`. For example:
+
+~> **Note:** When importing, use the region where the initial or _main_ global table resides, _not_ the region of the replica.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import DynamoDB table replicas using the `table-name:main-region`. For example:
+
+~> **Note:** When importing, use the region where the initial or _main_ global table resides, _not_ the region of the replica.
+
+```console
+% terraform import aws_dynamodb_table_replica.example TestTable:us-west-2
+```
+
+<!-- cache-key: cdktf-0.18.0 input-825c94d582679fcb249521e58e00123dba670a7f2f1b962c70bbd04b4762d01d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/dynamodb_tag.html.markdown b/website/docs/cdktf/python/r/dynamodb_tag.html.markdown
new file mode 100644
index 00000000000..84c021a6491
--- /dev/null
+++ b/website/docs/cdktf/python/r/dynamodb_tag.html.markdown
@@ -0,0 +1,98 @@
+---
+subcategory: "DynamoDB"
+layout: "aws"
+page_title: "AWS: aws_dynamodb_tag"
+description: |-
+  Manages an individual DynamoDB resource tag
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_dynamodb_tag
+
+Manages an individual DynamoDB resource tag. This resource should only be used in cases where DynamoDB resources are created outside Terraform (e.g., Table replicas in other regions).
+
+~> **NOTE:** This tagging resource should not be combined with the Terraform resource for managing the parent resource. For example, using `aws_dynamodb_table` and `aws_dynamodb_tag` to manage tags of the same DynamoDB Table in the same region will cause a perpetual difference where the `aws_dynamodb_cluster` resource will try to remove the tag being added by the `aws_dynamodb_tag` resource.
+
+~> **NOTE:** This tagging resource does not use the [provider `ignore_tags` configuration](/docs/providers/aws/index.html#ignore_tags).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, Fn, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_region import DataAwsRegion
+from imports.aws.dynamodb_table import DynamodbTable
+from imports.aws.dynamodb_tag import DynamodbTag
+from imports.aws.provider import AwsProvider
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, name):
+        super().__init__(scope, name)
+        AwsProvider(self, "aws",
+            region="us-west-2"
+        )
+        replica = AwsProvider(self, "aws_1",
+            alias="replica",
+            region="us-east-1"
+        )
+        current = DataAwsRegion(self, "current")
+        data_aws_region_replica = DataAwsRegion(self, "replica",
+            provider=replica
+        )
+        example = DynamodbTable(self, "example",
+            replica=[DynamodbTableReplica(
+                region_name=Token.as_string(data_aws_region_replica.name)
+            )
+            ],
+            name=name
+        )
+        DynamodbTag(self, "test",
+            key="testkey",
+            provider=replica,
+            resource_arn=Token.as_string(
+                Fn.replace(example.arn,
+                    Token.as_string(current.name),
+                    Token.as_string(data_aws_region_replica.name))),
+            value="testvalue"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `resource_arn` - (Required) Amazon Resource Name (ARN) of the DynamoDB resource to tag.
+* `key` - (Required) Tag name.
+* `value` - (Required) Tag value.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - DynamoDB resource identifier and key, separated by a comma (`,`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_dynamodb_tag` using the DynamoDB resource identifier and key, separated by a comma (`,`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_dynamodb_tag` using the DynamoDB resource identifier and key, separated by a comma (`,`). For example:
+
+```console
+% terraform import aws_dynamodb_tag.example arn:aws:dynamodb:us-east-1:123456789012:table/example,Name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-75e8bd469b3a6122cab5fe6f134e77c1f13bdbca2f2645fd979c4c90c7684f40 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ebs_default_kms_key.html.markdown b/website/docs/cdktf/python/r/ebs_default_kms_key.html.markdown
new file mode 100644
index 00000000000..68f78a33f94
--- /dev/null
+++ b/website/docs/cdktf/python/r/ebs_default_kms_key.html.markdown
@@ -0,0 +1,70 @@
+---
+subcategory: "EBS (EC2)"
+layout: "aws"
+page_title: "AWS: aws_ebs_default_kms_key"
+description: |-
+  Manages the default customer master key (CMK) that your AWS account uses to encrypt EBS volumes.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ebs_default_kms_key
+
+Provides a resource to manage the default customer master key (CMK) that your AWS account uses to encrypt EBS volumes.
+
+Your AWS account has an AWS-managed default CMK that is used for encrypting an EBS volume when no CMK is specified in the API call that creates the volume.
+By using the `aws_ebs_default_kms_key` resource, you can specify a customer-managed CMK to use in place of the AWS-managed default CMK.
+
+~> **NOTE:** Creating an `aws_ebs_default_kms_key` resource does not enable default EBS encryption. Use the [`aws_ebs_encryption_by_default`](ebs_encryption_by_default.html) to enable default EBS encryption.
+
+~> **NOTE:** Destroying this resource will reset the default CMK to the account's AWS-managed default CMK for EBS.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ebs_default_kms_key import EbsDefaultKmsKey
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        EbsDefaultKmsKey(self, "example",
+            key_arn=Token.as_string(aws_kms_key_example.arn)
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `key_arn` - (Required, ForceNew) The ARN of the AWS Key Management Service (AWS KMS) customer master key (CMK) to use to encrypt the EBS volume.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import the EBS default KMS CMK using the KMS key ARN. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import the EBS default KMS CMK using the KMS key ARN. For example:
+
+```console
+% terraform import aws_ebs_default_kms_key.example arn:aws:kms:us-east-1:123456789012:key/abcd-1234
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1b6624f3132e4695fc32d40d7c90ec4c11690a7b3a4758236262f116dc876595 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ebs_encryption_by_default.html.markdown b/website/docs/cdktf/python/r/ebs_encryption_by_default.html.markdown
new file mode 100644
index 00000000000..76c0952dd11
--- /dev/null
+++ b/website/docs/cdktf/python/r/ebs_encryption_by_default.html.markdown
@@ -0,0 +1,65 @@
+---
+subcategory: "EBS (EC2)"
+layout: "aws"
+page_title: "AWS: aws_ebs_encryption_by_default"
+description: |-
+  Manages whether default EBS encryption is enabled for your AWS account in the current AWS region.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ebs_encryption_by_default
+
+Provides a resource to manage whether default EBS encryption is enabled for your AWS account in the current AWS region. To manage the default KMS key for the region, see the [`aws_ebs_default_kms_key` resource](/docs/providers/aws/r/ebs_default_kms_key.html).
+
+~> **NOTE:** Removing this Terraform resource disables default EBS encryption.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ebs_encryption_by_default import EbsEncryptionByDefault
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        EbsEncryptionByDefault(self, "example",
+            enabled=True
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `enabled` - (Optional) Whether or not default EBS encryption is enabled. Valid values are `true` or `false`. Defaults to `true`.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import the default EBS encryption state. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import the default EBS encryption state. For example:
+
+```console
+% terraform import aws_ebs_encryption_by_default.example default
+```
+
+<!-- cache-key: cdktf-0.18.0 input-26d56aaac9991ae4f8fb9772f7e16551e204f392912f72bea53feb7f7680cc3b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ebs_snapshot.html.markdown b/website/docs/cdktf/python/r/ebs_snapshot.html.markdown
new file mode 100644
index 00000000000..50d3d9a7b6d
--- /dev/null
+++ b/website/docs/cdktf/python/r/ebs_snapshot.html.markdown
@@ -0,0 +1,97 @@
+---
+subcategory: "EBS (EC2)"
+layout: "aws"
+page_title: "AWS: aws_ebs_snapshot"
+description: |-
+  Provides an elastic block storage snapshot resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ebs_snapshot
+
+Creates a Snapshot of an EBS Volume.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ebs_snapshot import EbsSnapshot
+from imports.aws.ebs_volume import EbsVolume
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = EbsVolume(self, "example",
+            availability_zone="us-west-2a",
+            size=40,
+            tags={
+                "Name": "HelloWorld"
+            }
+        )
+        EbsSnapshot(self, "example_snapshot",
+            tags={
+                "Name": "HelloWorld_snap"
+            },
+            volume_id=example.id
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `volume_id` - (Required) The Volume ID of which to make a snapshot.
+* `description` - (Optional) A description of what the snapshot is.
+* `outpost_arn` - (Optional) The Amazon Resource Name (ARN) of the Outpost on which to create a local snapshot.
+* `storage_tier` - (Optional) The name of the storage tier. Valid values are `archive` and `standard`. Default value is `standard`.
+* `permanent_restore` - (Optional) Indicates whether to permanently restore an archived snapshot.
+* `temporary_restore_days` - (Optional) Specifies the number of days for which to temporarily restore an archived snapshot. Required for temporary restores only. The snapshot will be automatically re-archived after this period.
+* `tags` - (Optional) A map of tags to assign to the snapshot. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the EBS Snapshot.
+* `id` - The snapshot ID (e.g., snap-59fcb34e).
+* `owner_id` - The AWS account ID of the EBS snapshot owner.
+* `owner_alias` - Value from an Amazon-maintained list (`amazon`, `aws-marketplace`, `microsoft`) of snapshot owners.
+* `encrypted` - Whether the snapshot is encrypted.
+* `volume_size` - The size of the drive in GiBs.
+* `kms_key_id` - The ARN for the KMS encryption key.
+* `data_encryption_key_id` - The data encryption key identifier for the snapshot.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `10m`)
+- `delete` - (Default `10m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EBS Snapshot using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import EBS Snapshot using the `id`. For example:
+
+```console
+% terraform import aws_ebs_snapshot.id snap-049df61146c4d7901
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1e7edd88fa309f9a2fbc01f16873ff7d886c948a085d015d286894010821fe01 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ebs_snapshot_copy.html.markdown b/website/docs/cdktf/python/r/ebs_snapshot_copy.html.markdown
new file mode 100644
index 00000000000..3b5088ba573
--- /dev/null
+++ b/website/docs/cdktf/python/r/ebs_snapshot_copy.html.markdown
@@ -0,0 +1,86 @@
+---
+subcategory: "EBS (EC2)"
+layout: "aws"
+page_title: "AWS: aws_ebs_snapshot_copy"
+description: |-
+  Duplicates an existing Amazon snapshot
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ebs_snapshot_copy
+
+Creates a Snapshot of a snapshot.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ebs_snapshot import EbsSnapshot
+from imports.aws.ebs_snapshot_copy import EbsSnapshotCopy
+from imports.aws.ebs_volume import EbsVolume
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = EbsVolume(self, "example",
+            availability_zone="us-west-2a",
+            size=40,
+            tags={
+                "Name": "HelloWorld"
+            }
+        )
+        example_snapshot = EbsSnapshot(self, "example_snapshot",
+            tags={
+                "Name": "HelloWorld_snap"
+            },
+            volume_id=example.id
+        )
+        EbsSnapshotCopy(self, "example_copy",
+            source_region="us-west-2",
+            source_snapshot_id=example_snapshot.id,
+            tags={
+                "Name": "HelloWorld_copy_snap"
+            }
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `description` - (Optional) A description of what the snapshot is.
+* `encrypted` - Whether the snapshot is encrypted.
+* `kms_key_id` - The ARN for the KMS encryption key.
+* `source_snapshot_id` The ARN for the snapshot to be copied.
+* `source_region` The region of the source snapshot.
+* `storage_tier` - (Optional) The name of the storage tier. Valid values are `archive` and `standard`. Default value is `standard`.
+* `permanent_restore` - (Optional) Indicates whether to permanently restore an archived snapshot.
+* `temporary_restore_days` - (Optional) Specifies the number of days for which to temporarily restore an archived snapshot. Required for temporary restores only. The snapshot will be automatically re-archived after this period.
+* `tags` - A map of tags for the snapshot. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the EBS Snapshot.
+* `id` - The snapshot ID (e.g., snap-59fcb34e).
+* `owner_id` - The AWS account ID of the snapshot owner.
+* `owner_alias` - Value from an Amazon-maintained list (`amazon`, `aws-marketplace`, `microsoft`) of snapshot owners.
+* `volume_size` - The size of the drive in GiBs.
+* `data_encryption_key_id` - The data encryption key identifier for the snapshot.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `10m`)
+- `delete` - (Default `10m`)
+
+<!-- cache-key: cdktf-0.18.0 input-6584e150a20694a655473ad745eb449af2bb52af49f6c18028f8aa482965ddc1 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ebs_snapshot_import.html.markdown b/website/docs/cdktf/python/r/ebs_snapshot_import.html.markdown
new file mode 100644
index 00000000000..6f8a9c4bc6c
--- /dev/null
+++ b/website/docs/cdktf/python/r/ebs_snapshot_import.html.markdown
@@ -0,0 +1,97 @@
+---
+subcategory: "EBS (EC2)"
+layout: "aws"
+page_title: "AWS: aws_ebs_snapshot_import"
+description: |-
+  Provides an elastic block storage snapshot import resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ebs_snapshot_import
+
+Imports a disk image from S3 as a Snapshot.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ebs_snapshot_import import EbsSnapshotImport
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        EbsSnapshotImport(self, "example",
+            disk_container=EbsSnapshotImportDiskContainer(
+                format="VHD",
+                user_bucket=EbsSnapshotImportDiskContainerUserBucket(
+                    s3_bucket="disk-images",
+                    s3_key="source.vhd"
+                )
+            ),
+            role_name="disk-image-import",
+            tags={
+                "Name": "HelloWorld"
+            }
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `client_data` - (Optional) The client-specific data. Detailed below.
+* `description` - (Optional) The description string for the import snapshot task.
+* `disk_container` - (Required) Information about the disk container. Detailed below.
+* `encrypted` - (Optional) Specifies whether the destination snapshot of the imported image should be encrypted. The default KMS key for EBS is used unless you specify a non-default KMS key using KmsKeyId.
+* `kms_key_id` - (Optional) An identifier for the symmetric KMS key to use when creating the encrypted snapshot. This parameter is only required if you want to use a non-default KMS key; if this parameter is not specified, the default KMS key for EBS is used. If a KmsKeyId is specified, the Encrypted flag must also be set.
+* `storage_tier` - (Optional) The name of the storage tier. Valid values are `archive` and `standard`. Default value is `standard`.
+* `permanent_restore` - (Optional) Indicates whether to permanently restore an archived snapshot.
+* `temporary_restore_days` - (Optional) Specifies the number of days for which to temporarily restore an archived snapshot. Required for temporary restores only. The snapshot will be automatically re-archived after this period.
+* `role_name` - (Optional) The name of the IAM Role the VM Import/Export service will assume. This role needs certain permissions. See https://docs.aws.amazon.com/vm-import/latest/userguide/vmie_prereqs.html#vmimport-role. Default: `vmimport`
+* `tags` - (Optional) A map of tags to assign to the snapshot.
+
+### client_data Configuration Block
+
+* `comment` - (Optional) A user-defined comment about the disk upload.
+* `upload_start` - (Optional) The time that the disk upload starts.
+* `upload_end` - (Optional) The time that the disk upload ends.
+* `upload_size` - (Optional) The size of the uploaded disk image, in GiB.
+
+### disk_container Configuration Block
+
+* `description` - (Optional) The description of the disk image being imported.
+* `format` - (Required) The format of the disk image being imported. One of `VHD` or `VMDK`.
+* `url` - (Optional) The URL to the Amazon S3-based disk image being imported. It can either be a https URL (https://..) or an Amazon S3 URL (s3://..). One of `url` or `user_bucket` must be set.
+* `user_bucket` - (Optional) The Amazon S3 bucket for the disk image. One of `url` or `user_bucket` must be set. Detailed below.
+
+### user_bucket Configuration Block
+
+* `s3_bucket` - The name of the Amazon S3 bucket where the disk image is located.
+* `s3_key` - The file name of the disk image.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `60m`)
+- `delete` - (Default `10m`)
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the EBS Snapshot.
+* `id` - The snapshot ID (e.g., snap-59fcb34e).
+* `owner_id` - The AWS account ID of the EBS snapshot owner.
+* `owner_alias` - Value from an Amazon-maintained list (`amazon`, `aws-marketplace`, `microsoft`) of snapshot owners.
+* `volume_size` - The size of the drive in GiBs.
+* `data_encryption_key_id` - The data encryption key identifier for the snapshot.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+<!-- cache-key: cdktf-0.18.0 input-a913e99cf61c1c6954df7657480fc954e915e7e612a83eefbf5010e1f4fc479d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ebs_volume.html.markdown b/website/docs/cdktf/python/r/ebs_volume.html.markdown
new file mode 100644
index 00000000000..999c90503f3
--- /dev/null
+++ b/website/docs/cdktf/python/r/ebs_volume.html.markdown
@@ -0,0 +1,94 @@
+---
+subcategory: "EBS (EC2)"
+layout: "aws"
+page_title: "AWS: aws_ebs_volume"
+description: |-
+  Provides an elastic block storage resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ebs_volume
+
+Manages a single EBS volume.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ebs_volume import EbsVolume
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        EbsVolume(self, "example",
+            availability_zone="us-west-2a",
+            size=40,
+            tags={
+                "Name": "HelloWorld"
+            }
+        )
+```
+
+~> **NOTE:** At least one of `size` or `snapshot_id` is required when specifying an EBS volume
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `availability_zone` - (Required) The AZ where the EBS volume will exist.
+* `encrypted` - (Optional) If true, the disk will be encrypted.
+* `final_snapshot` - (Optional) If true, snapshot will be created before volume deletion. Any tags on the volume will be migrated to the snapshot. By default set to false
+* `iops` - (Optional) The amount of IOPS to provision for the disk. Only valid for `type` of `io1`, `io2` or `gp3`.
+* `multi_attach_enabled` - (Optional) Specifies whether to enable Amazon EBS Multi-Attach. Multi-Attach is supported on `io1` and `io2` volumes.
+* `size` - (Optional) The size of the drive in GiBs.
+* `snapshot_id` (Optional) A snapshot to base the EBS volume off of.
+* `outpost_arn` - (Optional) The Amazon Resource Name (ARN) of the Outpost.
+* `type` - (Optional) The type of EBS volume. Can be `standard`, `gp2`, `gp3`, `io1`, `io2`, `sc1` or `st1` (Default: `gp2`).
+* `kms_key_id` - (Optional) The ARN for the KMS encryption key. When specifying `kms_key_id`, `encrypted` needs to be set to true. Note: Terraform must be running with credentials which have the `GenerateDataKeyWithoutPlaintext` permission on the specified KMS key as required by the [EBS KMS CMK volume provisioning process](https://docs.aws.amazon.com/kms/latest/developerguide/services-ebs.html#ebs-cmk) to prevent a volume from being created and almost immediately deleted.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `throughput` - (Optional) The throughput that the volume supports, in MiB/s. Only valid for `type` of `gp3`.
+
+~> **NOTE:** When changing the `size`, `iops` or `type` of an instance, there are [considerations](http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/considerations.html) to be aware of.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The volume ID (e.g., vol-59fcb34e).
+* `arn` - The volume ARN (e.g., arn:aws:ec2:us-east-1:0123456789012:volume/vol-59fcb34e).
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `5m`)
+- `update` - (Default `5m`)
+- `delete` - (Default `5m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EBS Volumes using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import EBS Volumes using the `id`. For example:
+
+```console
+% terraform import aws_ebs_volume.id vol-049df61146c4d7901
+```
+
+<!-- cache-key: cdktf-0.18.0 input-92ec3ce7171663c1078ea136c38ae14a9544f626bf400bd2be9fd052c9a938d8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ec2_availability_zone_group.html.markdown b/website/docs/cdktf/python/r/ec2_availability_zone_group.html.markdown
index 1b23003c61b..c266b394d47 100644
--- a/website/docs/cdktf/python/r/ec2_availability_zone_group.html.markdown
+++ b/website/docs/cdktf/python/r/ec2_availability_zone_group.html.markdown
@@ -6,6 +6,8 @@ description: |-
   Manages an EC2 Availability Zone Group.
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Resource: aws_ec2_availability_zone_group
 
 Manages an EC2 Availability Zone Group, such as updating its opt-in status.
@@ -15,15 +17,18 @@ Manages an EC2 Availability Zone Group, such as updating its opt-in status.
 ## Example Usage
 
 ```python
-import constructs as constructs
-import cdktf as cdktf
-# Provider bindings are generated by running cdktf get.
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
 # See https://cdk.tf/provider-generation for more details.
-import ...gen.providers.aws as aws
-class MyConvertedCode(cdktf.TerraformStack):
+#
+from imports.aws.ec2_availability_zone_group import Ec2AvailabilityZoneGroup
+class MyConvertedCode(TerraformStack):
     def __init__(self, scope, name):
         super().__init__(scope, name)
-        aws.ec2_availability_zone_group.Ec2AvailabilityZoneGroup(self, "example",
+        Ec2AvailabilityZoneGroup(self, "example",
             group_name="us-west-2-lax-1",
             opt_in_status="opted-in"
         )
@@ -36,18 +41,29 @@ The following arguments are required:
 * `group_name` - (Required) Name of the Availability Zone Group.
 * `opt_in_status` - (Required) Indicates whether to enable or disable Availability Zone Group. Valid values: `opted-in` or `not-opted-in`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Name of the Availability Zone Group.
 
 ## Import
 
-EC2 Availability Zone Groups can be imported using the group name, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EC2 Availability Zone Groups using the group name. For example:
 
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
 ```
-$ terraform import aws_ec2_availability_zone_group.example us-west-2-lax-1
+
+Using `terraform import`, import EC2 Availability Zone Groups using the group name. For example:
+
+```console
+% terraform import aws_ec2_availability_zone_group.example us-west-2-lax-1
 ```
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-ec04450e93feebc7cdb027063eaa1b76316b185dd8882c75d29821697f953592 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-473f003faaf663001178efaa8445c87b532a38c1e63d75f64ea2c7c9e3600f9b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ec2_capacity_reservation.html.markdown b/website/docs/cdktf/python/r/ec2_capacity_reservation.html.markdown
index fea396044a8..fe2d4420cb0 100644
--- a/website/docs/cdktf/python/r/ec2_capacity_reservation.html.markdown
+++ b/website/docs/cdktf/python/r/ec2_capacity_reservation.html.markdown
@@ -6,6 +6,8 @@ description: |-
   Provides an EC2 Capacity Reservation. This allows you to reserve capacity for your Amazon EC2 instances in a specific Availability Zone for any duration.
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Resource: aws_ec2_capacity_reservation
 
 Provides an EC2 Capacity Reservation. This allows you to reserve capacity for your Amazon EC2 instances in a specific Availability Zone for any duration.
@@ -13,15 +15,18 @@ Provides an EC2 Capacity Reservation. This allows you to reserve capacity for yo
 ## Example Usage
 
 ```python
-import constructs as constructs
-import cdktf as cdktf
-# Provider bindings are generated by running cdktf get.
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
 # See https://cdk.tf/provider-generation for more details.
-import ...gen.providers.aws as aws
-class MyConvertedCode(cdktf.TerraformStack):
+#
+from imports.aws.ec2_capacity_reservation import Ec2CapacityReservation
+class MyConvertedCode(TerraformStack):
     def __init__(self, scope, name):
         super().__init__(scope, name)
-        aws.ec2_capacity_reservation.Ec2CapacityReservation(self, "default",
+        Ec2CapacityReservation(self, "default",
             availability_zone="eu-west-1a",
             instance_count=1,
             instance_platform="Linux/UNIX",
@@ -31,7 +36,7 @@ class MyConvertedCode(cdktf.TerraformStack):
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `availability_zone` - (Required) The Availability Zone in which to create the Capacity Reservation.
 * `ebs_optimized` - (Optional) Indicates whether the Capacity Reservation supports EBS-optimized instances.
@@ -47,9 +52,9 @@ The following arguments are supported:
 * `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 * `tenancy` - (Optional) Indicates the tenancy of the Capacity Reservation. Specify either `default` or `dedicated`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The Capacity Reservation ID.
 * `owner_id` - The ID of the AWS account that owns the Capacity Reservation.
@@ -58,10 +63,21 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Capacity Reservations can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Capacity Reservations using the `id`. For example:
 
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
 ```
-$ terraform import aws_ec2_capacity_reservation.web cr-0123456789abcdef0
+
+Using `terraform import`, import Capacity Reservations using the `id`. For example:
+
+```console
+% terraform import aws_ec2_capacity_reservation.web cr-0123456789abcdef0
 ```
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-5de72e0a8199275fad3ad56e38ae6035b7b1ce0b96844b6338e061c1672a9bd9 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-93a356c14077d7db2f6957607bc33725d67bfe6e53d726dbffcc5d0f5f8dea86 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ec2_carrier_gateway.html.markdown b/website/docs/cdktf/python/r/ec2_carrier_gateway.html.markdown
index 93772d19dda..0390e557b44 100644
--- a/website/docs/cdktf/python/r/ec2_carrier_gateway.html.markdown
+++ b/website/docs/cdktf/python/r/ec2_carrier_gateway.html.markdown
@@ -6,32 +6,44 @@ description: |-
   Manages an EC2 Carrier Gateway.
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Resource: aws_ec2_carrier_gateway
 
 Manages an EC2 Carrier Gateway. See the AWS [documentation](https://docs.aws.amazon.com/vpc/latest/userguide/Carrier_Gateway.html) for more information.
 
 ## Example Usage
 
-```terraform
-resource "aws_ec2_carrier_gateway" "example" {
-  vpc_id = aws_vpc.example.id
-
-  tags = {
-    Name = "example-carrier-gateway"
-  }
-}
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ec2_carrier_gateway import Ec2CarrierGateway
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Ec2CarrierGateway(self, "example",
+            tags={
+                "Name": "example-carrier-gateway"
+            },
+            vpc_id=Token.as_string(aws_vpc_example.id)
+        )
 ```
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 * `vpc_id` - (Required) The ID of the VPC to associate with the carrier gateway.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The ARN of the carrier gateway.
 * `id` - The ID of the carrier gateway.
@@ -40,11 +52,21 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_ec2_carrier_gateway` can be imported using the carrier gateway's ID,
-e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_ec2_carrier_gateway` using the carrier gateway's ID. For example:
 
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
 ```
-$ terraform import aws_ec2_carrier_gateway.example cgw-12345
+
+Using `terraform import`, import `aws_ec2_carrier_gateway` using the carrier gateway's ID. For example:
+
+```console
+% terraform import aws_ec2_carrier_gateway.example cgw-12345
 ```
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-69fb2719765f13af292ecd34e9026074198e61b364e7f0845c2b65af0b9641db -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-9d4096fc983e6a4fb708311553dddf500634237507ba8f350eee35f1f925e85c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ec2_client_vpn_authorization_rule.html.markdown b/website/docs/cdktf/python/r/ec2_client_vpn_authorization_rule.html.markdown
index 132561ee3c9..42480baaf1c 100644
--- a/website/docs/cdktf/python/r/ec2_client_vpn_authorization_rule.html.markdown
+++ b/website/docs/cdktf/python/r/ec2_client_vpn_authorization_rule.html.markdown
@@ -6,6 +6,8 @@ description: |-
   Provides authorization rules for AWS Client VPN endpoints.
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Resource: aws_ec2_client_vpn_authorization_rule
 
 Provides authorization rules for AWS Client VPN endpoints. For more information on usage, please see the
@@ -13,17 +15,28 @@ Provides authorization rules for AWS Client VPN endpoints. For more information
 
 ## Example Usage
 
-```terraform
-resource "aws_ec2_client_vpn_authorization_rule" "example" {
-  client_vpn_endpoint_id = aws_ec2_client_vpn_endpoint.example.id
-  target_network_cidr    = aws_subnet.example.cidr_block
-  authorize_all_groups   = true
-}
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ec2_client_vpn_authorization_rule import Ec2ClientVpnAuthorizationRule
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Ec2ClientVpnAuthorizationRule(self, "example",
+            authorize_all_groups=True,
+            client_vpn_endpoint_id=Token.as_string(aws_ec2_client_vpn_endpoint_example.id),
+            target_network_cidr=Token.as_string(aws_subnet_example.cidr_block)
+        )
 ```
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `client_vpn_endpoint_id` - (Required) The ID of the Client VPN endpoint.
 * `target_network_cidr` - (Required) The IPv4 address range, in CIDR notation, of the network to which the authorization rule applies.
@@ -31,9 +44,9 @@ The following arguments are supported:
 * `authorize_all_groups` - (Optional) Indicates whether the authorization rule grants access to all clients. One of `access_group_id` or `authorize_all_groups` must be set.
 * `description` - (Optional) A brief description of the authorization rule.
 
-## Attributes Reference
+## Attribute Reference
 
-No additional attributes are exported.
+This resource exports no additional attributes.
 
 ## Timeouts
 
@@ -44,14 +57,42 @@ No additional attributes are exported.
 
 ## Import
 
-AWS Client VPN authorization rules can be imported using the endpoint ID and target network CIDR. If there is a specific group name that is included as well. All values are separated by a `,`.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AWS Client VPN authorization rules using the endpoint ID and target network CIDR. If there is a specific group name, include that also. All values are separated by a `,`. For example:
+
+Using the endpoint ID and target network CIDR:
 
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
 ```
-$ terraform import aws_ec2_client_vpn_authorization_rule.example cvpn-endpoint-0ac3a1abbccddd666,10.1.0.0/24
+
+Using the endpoint ID, target network CIDR, and group name:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
 ```
 
+**Using `terraform import` to import** AWS Client VPN authorization rules using the endpoint ID and target network CIDR. If there is a specific group name, include that also. All values are separated by a `,`. For example:
+
+Using the endpoint ID and target network CIDR:
+
+```console
+% terraform import aws_ec2_client_vpn_authorization_rule.example cvpn-endpoint-0ac3a1abbccddd666,10.1.0.0/24
 ```
-$ terraform import aws_ec2_client_vpn_authorization_rule.example cvpn-endpoint-0ac3a1abbccddd666,10.1.0.0/24,team-a
+
+Using the endpoint ID, target network CIDR, and group name:
+
+```console
+% terraform import aws_ec2_client_vpn_authorization_rule.example cvpn-endpoint-0ac3a1abbccddd666,10.1.0.0/24,team-a
 ```
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-8993bda934e1c0dafea15ed7286e6454dd951b4e5ba094c102f6feb9fa0f98e0 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-9be9ac769186ff37ee1d96174a6329f4231687f8b5769f002ba41ebeea327607 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ec2_client_vpn_endpoint.html.markdown b/website/docs/cdktf/python/r/ec2_client_vpn_endpoint.html.markdown
index d950ed10bd2..6ce8d92fa2a 100644
--- a/website/docs/cdktf/python/r/ec2_client_vpn_endpoint.html.markdown
+++ b/website/docs/cdktf/python/r/ec2_client_vpn_endpoint.html.markdown
@@ -6,6 +6,8 @@ description: |-
   Provides an AWS Client VPN endpoint for OpenVPN clients.
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Resource: aws_ec2_client_vpn_endpoint
 
 Provides an AWS Client VPN endpoint for OpenVPN clients. For more information on usage, please see the
@@ -13,28 +15,38 @@ Provides an AWS Client VPN endpoint for OpenVPN clients. For more information on
 
 ## Example Usage
 
-```terraform
-resource "aws_ec2_client_vpn_endpoint" "example" {
-  description            = "terraform-clientvpn-example"
-  server_certificate_arn = aws_acm_certificate.cert.arn
-  client_cidr_block      = "10.0.0.0/16"
-
-  authentication_options {
-    type                       = "certificate-authentication"
-    root_certificate_chain_arn = aws_acm_certificate.root_cert.arn
-  }
-
-  connection_log_options {
-    enabled               = true
-    cloudwatch_log_group  = aws_cloudwatch_log_group.lg.name
-    cloudwatch_log_stream = aws_cloudwatch_log_stream.ls.name
-  }
-}
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ec2_client_vpn_endpoint import Ec2ClientVpnEndpoint
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Ec2ClientVpnEndpoint(self, "example",
+            authentication_options=[Ec2ClientVpnEndpointAuthenticationOptions(
+                root_certificate_chain_arn=root_cert.arn,
+                type="certificate-authentication"
+            )
+            ],
+            client_cidr_block="10.0.0.0/16",
+            connection_log_options=Ec2ClientVpnEndpointConnectionLogOptions(
+                cloudwatch_log_group=lg.name,
+                cloudwatch_log_stream=ls.name,
+                enabled=True
+            ),
+            description="terraform-clientvpn-example",
+            server_certificate_arn=cert.arn
+        )
 ```
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `authentication_options` - (Required) Information about the authentication method to be used to authenticate clients.
 * `client_cidr_block` - (Required) The IPv4 address range, in CIDR notation, from which to assign client IP addresses. The address range cannot overlap with the local CIDR of the VPC in which the associated subnet is located, or the routes that you add manually. The address range cannot be changed after the Client VPN endpoint has been created. The CIDR block should be /22 or greater.
@@ -81,21 +93,33 @@ One of the following arguments must be supplied:
 * `cloudwatch_log_stream` - (Optional) The name of the CloudWatch Logs log stream to which the connection data is published.
 * `enabled` - (Required) Indicates whether connection logging is enabled.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The ARN of the Client VPN endpoint.
 * `dns_name` - The DNS name to be used by clients when establishing their VPN session.
 * `id` - The ID of the Client VPN endpoint.
+* `self_service_portal_url` - The URL of the self-service portal.
 * `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
 
 ## Import
 
-AWS Client VPN endpoints can be imported using the `id` value found via `aws ec2 describe-client-vpn-endpoints`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AWS Client VPN endpoints using the `id` value found via `aws ec2 describe-client-vpn-endpoints`. For example:
 
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
 ```
-$ terraform import aws_ec2_client_vpn_endpoint.example cvpn-endpoint-0ac3a1abbccddd666
+
+Using `terraform import`, import AWS Client VPN endpoints using the `id` value found via `aws ec2 describe-client-vpn-endpoints`. For example:
+
+```console
+% terraform import aws_ec2_client_vpn_endpoint.example cvpn-endpoint-0ac3a1abbccddd666
 ```
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-a26501efa4c7174b2c2cb5dadf20d0288919ea642f95616bb9aaec5a718b6122 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-668469ff889101884cb8259cd8c05b2008ff8bae928811357f2cfcabe260d50a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ec2_client_vpn_network_association.html.markdown b/website/docs/cdktf/python/r/ec2_client_vpn_network_association.html.markdown
index 089c77dbb88..40b47d9e04e 100644
--- a/website/docs/cdktf/python/r/ec2_client_vpn_network_association.html.markdown
+++ b/website/docs/cdktf/python/r/ec2_client_vpn_network_association.html.markdown
@@ -6,6 +6,8 @@ description: |-
   Provides network associations for AWS Client VPN endpoints.
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Resource: aws_ec2_client_vpn_network_association
 
 Provides network associations for AWS Client VPN endpoints. For more information on usage, please see the
@@ -13,23 +15,34 @@ Provides network associations for AWS Client VPN endpoints. For more information
 
 ## Example Usage
 
-```terraform
-resource "aws_ec2_client_vpn_network_association" "example" {
-  client_vpn_endpoint_id = aws_ec2_client_vpn_endpoint.example.id
-  subnet_id              = aws_subnet.example.id
-}
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ec2_client_vpn_network_association import Ec2ClientVpnNetworkAssociation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Ec2ClientVpnNetworkAssociation(self, "example",
+            client_vpn_endpoint_id=Token.as_string(aws_ec2_client_vpn_endpoint_example.id),
+            subnet_id=Token.as_string(aws_subnet_example.id)
+        )
 ```
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `client_vpn_endpoint_id` - (Required) The ID of the Client VPN endpoint.
 * `subnet_id` - (Required) The ID of the subnet to associate with the Client VPN endpoint.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The unique ID of the target network association.
 * `association_id` - The unique ID of the target network association.
@@ -44,10 +57,21 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-AWS Client VPN network associations can be imported using the endpoint ID and the association ID. Values are separated by a `,`.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AWS Client VPN network associations using the endpoint ID and the association ID. Values are separated by a `,`. For example:
 
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
 ```
-$ terraform import aws_ec2_client_vpn_network_association.example cvpn-endpoint-0ac3a1abbccddd666,vpn-assoc-0b8db902465d069ad
+
+Using `terraform import`, import AWS Client VPN network associations using the endpoint ID and the association ID. Values are separated by a `,`. For example:
+
+```console
+% terraform import aws_ec2_client_vpn_network_association.example cvpn-endpoint-0ac3a1abbccddd666,vpn-assoc-0b8db902465d069ad
 ```
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-4ee204844cf9a14e05461614c35d00163e0b5a2f0e0659277881ae5c05e91db9 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-93b06b3eb31b248a508f1acf81dceb795b39cf3f2e929e8af4cfbaad6365e994 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ec2_client_vpn_route.html.markdown b/website/docs/cdktf/python/r/ec2_client_vpn_route.html.markdown
index eed51fdd474..798cfd7ea27 100644
--- a/website/docs/cdktf/python/r/ec2_client_vpn_route.html.markdown
+++ b/website/docs/cdktf/python/r/ec2_client_vpn_route.html.markdown
@@ -6,6 +6,8 @@ description: |-
   Provides additional routes for AWS Client VPN endpoints.
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Resource: aws_ec2_client_vpn_route
 
 Provides additional routes for AWS Client VPN endpoints. For more information on usage, please see the
@@ -13,46 +15,61 @@ Provides additional routes for AWS Client VPN endpoints. For more information on
 
 ## Example Usage
 
-```terraform
-resource "aws_ec2_client_vpn_route" "example" {
-  client_vpn_endpoint_id = aws_ec2_client_vpn_endpoint.example.id
-  destination_cidr_block = "0.0.0.0/0"
-  target_vpc_subnet_id   = aws_ec2_client_vpn_network_association.example.subnet_id
-}
-
-resource "aws_ec2_client_vpn_network_association" "example" {
-  client_vpn_endpoint_id = aws_ec2_client_vpn_endpoint.example.id
-  subnet_id              = aws_subnet.example.id
-}
-
-resource "aws_ec2_client_vpn_endpoint" "example" {
-  description            = "Example Client VPN endpoint"
-  server_certificate_arn = aws_acm_certificate.example.arn
-  client_cidr_block      = "10.0.0.0/16"
-
-  authentication_options {
-    type                       = "certificate-authentication"
-    root_certificate_chain_arn = aws_acm_certificate.example.arn
-  }
-
-  connection_log_options {
-    enabled = false
-  }
-}
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ec2_client_vpn_endpoint import Ec2ClientVpnEndpoint
+from imports.aws.ec2_client_vpn_network_association import Ec2ClientVpnNetworkAssociation
+from imports.aws.ec2_client_vpn_route import Ec2ClientVpnRoute
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = Ec2ClientVpnEndpoint(self, "example",
+            authentication_options=[Ec2ClientVpnEndpointAuthenticationOptions(
+                root_certificate_chain_arn=Token.as_string(aws_acm_certificate_example.arn),
+                type="certificate-authentication"
+            )
+            ],
+            client_cidr_block="10.0.0.0/16",
+            connection_log_options=Ec2ClientVpnEndpointConnectionLogOptions(
+                enabled=False
+            ),
+            description="Example Client VPN endpoint",
+            server_certificate_arn=Token.as_string(aws_acm_certificate_example.arn)
+        )
+        aws_ec2_client_vpn_network_association_example =
+        Ec2ClientVpnNetworkAssociation(self, "example_1",
+            client_vpn_endpoint_id=example.id,
+            subnet_id=Token.as_string(aws_subnet_example.id)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_ec2_client_vpn_network_association_example.override_logical_id("example")
+        aws_ec2_client_vpn_route_example = Ec2ClientVpnRoute(self, "example_2",
+            client_vpn_endpoint_id=example.id,
+            destination_cidr_block="0.0.0.0/0",
+            target_vpc_subnet_id=Token.as_string(aws_ec2_client_vpn_network_association_example.subnet_id)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_ec2_client_vpn_route_example.override_logical_id("example")
 ```
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `client_vpn_endpoint_id` - (Required) The ID of the Client VPN endpoint.
 * `destination_cidr_block` - (Required) The IPv4 address range, in CIDR notation, of the route destination.
 * `description` - (Optional) A brief description of the route.
 * `target_vpc_subnet_id` - (Required) The ID of the Subnet to route the traffic through. It must already be attached to the Client VPN.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the Client VPN endpoint.
 * `origin` - Indicates how the Client VPN route was added. Will be `add-route` for routes created by this resource.
@@ -67,10 +84,21 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-AWS Client VPN routes can be imported using the endpoint ID, target subnet ID, and destination CIDR block. All values are separated by a `,`.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AWS Client VPN routes using the endpoint ID, target subnet ID, and destination CIDR block. All values are separated by a `,`. For example:
 
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
 ```
-$ terraform import aws_ec2_client_vpn_route.example cvpn-endpoint-1234567890abcdef,subnet-9876543210fedcba,10.1.0.0/24
+
+Using `terraform import`, import AWS Client VPN routes using the endpoint ID, target subnet ID, and destination CIDR block. All values are separated by a `,`. For example:
+
+```console
+% terraform import aws_ec2_client_vpn_route.example cvpn-endpoint-1234567890abcdef,subnet-9876543210fedcba,10.1.0.0/24
 ```
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-ac5e35df38cbbdcd333467aae4b715320ea400fd110d67043d13b062d5c74b69 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-144efd2b6259f86199d398e7181456f408b908b3630ac4f3343668fe63a992b9 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ec2_fleet.html.markdown b/website/docs/cdktf/python/r/ec2_fleet.html.markdown
index 2cac1b0a692..e577d03e2a9 100644
--- a/website/docs/cdktf/python/r/ec2_fleet.html.markdown
+++ b/website/docs/cdktf/python/r/ec2_fleet.html.markdown
@@ -6,31 +6,44 @@ description: |-
   Provides a resource to manage EC2 Fleets
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Resource: aws_ec2_fleet
 
 Provides a resource to manage EC2 Fleets.
 
 ## Example Usage
 
-```terraform
-resource "aws_ec2_fleet" "example" {
-  launch_template_config {
-    launch_template_specification {
-      launch_template_id = aws_launch_template.example.id
-      version            = aws_launch_template.example.latest_version
-    }
-  }
-
-  target_capacity_specification {
-    default_target_capacity_type = "spot"
-    total_target_capacity        = 5
-  }
-}
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ec2_fleet import Ec2Fleet
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Ec2Fleet(self, "example",
+            launch_template_config=[Ec2FleetLaunchTemplateConfig(
+                launch_template_specification=Ec2FleetLaunchTemplateConfigLaunchTemplateSpecification(
+                    launch_template_id=Token.as_string(aws_launch_template_example.id),
+                    version=Token.as_string(aws_launch_template_example.latest_version)
+                )
+            )
+            ],
+            target_capacity_specification=Ec2FleetTargetCapacitySpecification(
+                default_target_capacity_type="spot",
+                total_target_capacity=5
+            )
+        )
 ```
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `context` - (Optional) Reserved.
 * `excess_capacity_termination_policy` - (Optional) Whether running instances should be terminated if the total target capacity of the EC2 Fleet is decreased below the current size of the EC2. Valid values: `no-termination`, `termination`. Defaults to `termination`. Supported only for fleets of type `maintain`.
@@ -67,24 +80,32 @@ Any parameters that you specify override the same parameters in the launch templ
 
 Example:
 
-```terraform
-resource "aws_ec2_fleet" "example" {
-  # ... other configuration ...
-
-  launch_template_config {
-    # ... other configuration ...
-
-    override {
-      instance_type     = "m4.xlarge"
-      weighted_capacity = 1
-    }
-
-    override {
-      instance_type     = "m4.2xlarge"
-      weighted_capacity = 2
-    }
-  }
-}
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ec2_fleet import Ec2Fleet
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, targetCapacitySpecification):
+        super().__init__(scope, name)
+        Ec2Fleet(self, "example",
+            launch_template_config=[Ec2FleetLaunchTemplateConfig(
+                override=[Ec2FleetLaunchTemplateConfigOverride(
+                    instance_type="m4.xlarge",
+                    weighted_capacity=1
+                ), Ec2FleetLaunchTemplateConfigOverride(
+                    instance_type="m4.2xlarge",
+                    weighted_capacity=2
+                )
+                ]
+            )
+            ],
+            target_capacity_specification=target_capacity_specification
+        )
 ```
 
 * `availability_zone` - (Optional) Availability Zone in which to launch the instances.
@@ -199,9 +220,9 @@ This configuration block supports the following:
 
 * `total_target_capacity` - (Required) The number of units to request, filled using `default_target_capacity_type`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Fleet identifier
 * `arn` - The ARN of the fleet
@@ -225,10 +246,21 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_ec2_fleet` can be imported by using the Fleet identifier, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_ec2_fleet` using the Fleet identifier. For example:
 
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
 ```
-$ terraform import aws_ec2_fleet.example fleet-b9b55d27-c5fc-41ac-a6f3-48fcc91f080c
+
+Using `terraform import`, import `aws_ec2_fleet` using the Fleet identifier. For example:
+
+```console
+% terraform import aws_ec2_fleet.example fleet-b9b55d27-c5fc-41ac-a6f3-48fcc91f080c
 ```
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-fb56043e128df20faa90dd637acc56b7f555acaf2d82061066a1c5be1d60aa2d -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-c7054e3c8757a06c71fb64005ddb5aa34c48f993fd6eadf199635a28b3f099e7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ec2_host.html.markdown b/website/docs/cdktf/python/r/ec2_host.html.markdown
index 46583ee083d..ed8cb20a81a 100644
--- a/website/docs/cdktf/python/r/ec2_host.html.markdown
+++ b/website/docs/cdktf/python/r/ec2_host.html.markdown
@@ -6,6 +6,8 @@ description: |-
   Provides an EC2 Host resource. This allows Dedicated Hosts to be allocated, modified, and released.
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Resource: aws_ec2_host
 
 Provides an EC2 Host resource. This allows Dedicated Hosts to be allocated, modified, and released.
@@ -13,15 +15,18 @@ Provides an EC2 Host resource. This allows Dedicated Hosts to be allocated, modi
 ## Example Usage
 
 ```python
-import constructs as constructs
-import cdktf as cdktf
-# Provider bindings are generated by running cdktf get.
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
 # See https://cdk.tf/provider-generation for more details.
-import ...gen.providers.aws as aws
-class MyConvertedCode(cdktf.TerraformStack):
+#
+from imports.aws.ec2_host import Ec2Host
+class MyConvertedCode(TerraformStack):
     def __init__(self, scope, name):
         super().__init__(scope, name)
-        aws.ec2_host.Ec2Host(self, "test",
+        Ec2Host(self, "test",
             auto_placement="on",
             availability_zone="us-west-2a",
             host_recovery="on",
@@ -31,8 +36,9 @@ class MyConvertedCode(cdktf.TerraformStack):
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
+* `asset_id` - (Optional) The ID of the Outpost hardware asset on which to allocate the Dedicated Hosts. This parameter is supported only if you specify OutpostArn. If you are allocating the Dedicated Hosts in a Region, omit this parameter.
 * `auto_placement` - (Optional) Indicates whether the host accepts any untargeted instance launches that match its instance type configuration, or if it only accepts Host tenancy instance launches that specify its unique host ID. Valid values: `on`, `off`. Default: `on`.
 * `availability_zone` - (Required) The Availability Zone in which to allocate the Dedicated Host.
 * `host_recovery` - (Optional) Indicates whether to enable or disable host recovery for the Dedicated Host. Valid values: `on`, `off`. Default: `off`.
@@ -41,9 +47,9 @@ The following arguments are supported:
 * `outpost_arn` - (Optional) The Amazon Resource Name (ARN) of the AWS Outpost on which to allocate the Dedicated Host.
 * `tags` - (Optional) Map of tags to assign to this resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the allocated Dedicated Host. This is used to launch an instance onto a specific host.
 * `arn` - The ARN of the Dedicated Host.
@@ -52,10 +58,21 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Hosts can be imported using the host `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import hosts using the host `id`. For example:
 
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
 ```
-$ terraform import aws_ec2_host.example h-0385a99d0e4b20cbb
+
+Using `terraform import`, import hosts using the host `id`. For example:
+
+```console
+% terraform import aws_ec2_host.example h-0385a99d0e4b20cbb
 ```
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-41c9a4bcef2bc29bfceae6876d0cd049e3590480296e3067c4b8334afc6193ff -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-7d7c66a25dca67846d4d6fca617b72c9903de5c7710e0dff44f2f8ae2633bebb -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ec2_image_block_public_access.markdown b/website/docs/cdktf/python/r/ec2_image_block_public_access.markdown
new file mode 100644
index 00000000000..7777b9ebb7a
--- /dev/null
+++ b/website/docs/cdktf/python/r/ec2_image_block_public_access.markdown
@@ -0,0 +1,57 @@
+---
+subcategory: "EC2 (Elastic Compute Cloud)"
+layout: "aws"
+page_title: "AWS: aws_ec2_image_block_public_access"
+description: |-
+  Provides a regional public access block for AMIs. This prevents AMIs from being made publicly accessible.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ec2_image_block_public_access
+
+Provides a regional public access block for AMIs. This prevents AMIs from being made publicly accessible.
+If you already have public AMIs, they will remain publicly available.
+
+~> **NOTE:** Deleting this resource does not change the block public access value, the resource in simply removed from state instead.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ec2_image_block_public_access import Ec2ImageBlockPublicAccess
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Ec2ImageBlockPublicAccess(self, "test",
+            state="block-new-sharing"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `state` - (Required) The state of block public access for AMIs at the account level in the configured AWS Region. Valid values: `unblocked` and `block-new-sharing`.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `update` - (Default `10m`)
+
+## Import
+
+You cannot import this resource.
+
+<!-- cache-key: cdktf-0.18.0 input-8368ec530535593c1f1e2aea209aa886960d23064815bc5ab871c21a27856e60 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ec2_instance_connect_endpoint.html.markdown b/website/docs/cdktf/python/r/ec2_instance_connect_endpoint.html.markdown
new file mode 100644
index 00000000000..7825fd2522e
--- /dev/null
+++ b/website/docs/cdktf/python/r/ec2_instance_connect_endpoint.html.markdown
@@ -0,0 +1,82 @@
+---
+subcategory: "EC2 (Elastic Compute Cloud)"
+layout: "aws"
+page_title: "AWS: aws_ec2_instance_connect_endpoint"
+description: |-
+  Provides an EC2 Instance Connect Endpoint resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ec2_instance_connect_endpoint
+
+Manages an EC2 Instance Connect Endpoint.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ec2_instance_connect_endpoint import Ec2InstanceConnectEndpoint
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Ec2InstanceConnectEndpoint(self, "example",
+            subnet_id=Token.as_string(aws_subnet_example.id)
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `preserve_client_ip` - (Optional) Indicates whether your client's IP address is preserved as the source. Default: `true`.
+* `security_group_ids` - (Optional) One or more security groups to associate with the endpoint. If you don't specify a security group, the default security group for the VPC will be associated with the endpoint.
+* `subnet_id` - (Required) The ID of the subnet in which to create the EC2 Instance Connect Endpoint.
+* `tags` - (Optional) Map of tags to assign to this resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `10m`)
+- `delete` - (Default `10m`)
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the EC2 Instance Connect Endpoint.
+* `availability_zone` - The Availability Zone of the EC2 Instance Connect Endpoint.
+* `dns_name` - The DNS name of the EC2 Instance Connect Endpoint.
+* `fips_dns_name` - The DNS name of the EC2 Instance Connect FIPS Endpoint.
+* `network_interface_ids` - The IDs of the ENIs that Amazon EC2 automatically created when creating the EC2 Instance Connect Endpoint.
+* `owner_id` - The ID of the AWS account that created the EC2 Instance Connect Endpoint.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `vpc_id` - The ID of the VPC in which the EC2 Instance Connect Endpoint was created.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EC2 Instance Connect Endpoints using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import EC2 Instance Connect Endpoints using the `id`. For example:
+
+```console
+% terraform import aws_ec2_instance_connect_endpoint.example eice-012345678
+```
+
+<!-- cache-key: cdktf-0.18.0 input-b6a7a4118c37b347c22b70a637e3a2dec2ab1a881d2fb350da6ffa550807522b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ec2_instance_state.html.markdown b/website/docs/cdktf/python/r/ec2_instance_state.html.markdown
index 01da15e39d7..535ee388375 100644
--- a/website/docs/cdktf/python/r/ec2_instance_state.html.markdown
+++ b/website/docs/cdktf/python/r/ec2_instance_state.html.markdown
@@ -6,6 +6,8 @@ description: |-
   Provides an EC2 instance state resource. This allows managing an instance power state. 
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Resource: aws_ec2_instance_state
 
 Provides an EC2 instance state resource. This allows managing an instance power state.
@@ -15,15 +17,20 @@ Provides an EC2 instance state resource. This allows managing an instance power
 ## Example Usage
 
 ```python
-import constructs as constructs
-import cdktf as cdktf
-# Provider bindings are generated by running cdktf get.
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
 # See https://cdk.tf/provider-generation for more details.
-import ...gen.providers.aws as aws
-class MyConvertedCode(cdktf.TerraformStack):
+#
+from imports.aws.data_aws_ami import DataAwsAmi
+from imports.aws.ec2_instance_state import Ec2InstanceState
+from imports.aws.instance import Instance
+class MyConvertedCode(TerraformStack):
     def __init__(self, scope, name):
         super().__init__(scope, name)
-        data_aws_ami_ubuntu = aws.data_aws_ami.DataAwsAmi(self, "ubuntu",
+        ubuntu = DataAwsAmi(self, "ubuntu",
             filter=[DataAwsAmiFilter(
                 name="name",
                 values=["ubuntu/images/hvm-ssd/ubuntu-focal-20.04-amd64-server-*"]
@@ -35,15 +42,15 @@ class MyConvertedCode(cdktf.TerraformStack):
             most_recent=True,
             owners=["099720109477"]
         )
-        aws_instance_test = aws.instance.Instance(self, "test",
-            ami=cdktf.Token.as_string(data_aws_ami_ubuntu.id),
+        test = Instance(self, "test",
+            ami=Token.as_string(ubuntu.id),
             instance_type="t3.micro",
             tags={
                 "Name": "HelloWorld"
             }
         )
-        aws_ec2_instance_state_test = aws.ec2_instance_state.Ec2InstanceState(self, "test_2",
-            instance_id=cdktf.Token.as_string(aws_instance_test.id),
+        aws_ec2_instance_state_test = Ec2InstanceState(self, "test_2",
+            instance_id=test.id,
             state="stopped"
         )
         # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
@@ -61,9 +68,9 @@ The following arguments are optional:
 
 * `force` - (Optional) Whether to request a forced stop when `state` is `stopped`. Otherwise (_i.e._, `state` is `running`), ignored. When an instance is forced to stop, it does not flush file system caches or file system metadata, and you must subsequently perform file system check and repair. Not recommended for Windows instances. Defaults to `false`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - ID of the instance (matches `instance_id`).
 
@@ -77,10 +84,21 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_ec2_instance_state` can be imported by using the `instance_id` attribute, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_ec2_instance_state` using the `instance_id` attribute. For example:
 
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
 ```
-$ terraform import aws_ec2_instance_state.test i-02cae6557dfcf2f96
+
+Using `terraform import`, import `aws_ec2_instance_state` using the `instance_id` attribute. For example:
+
+```console
+% terraform import aws_ec2_instance_state.test i-02cae6557dfcf2f96
 ```
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-19c105887b99c9546865f82e4635edb9590d1b4933fa7a3973baeb84dbc5ce9c -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-55ec6962efa979f04735e3258bd738fd11e346e716880406215eee2600843353 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ec2_local_gateway_route.html.markdown b/website/docs/cdktf/python/r/ec2_local_gateway_route.html.markdown
index 815dec7e437..5b8d384fdb7 100644
--- a/website/docs/cdktf/python/r/ec2_local_gateway_route.html.markdown
+++ b/website/docs/cdktf/python/r/ec2_local_gateway_route.html.markdown
@@ -6,18 +6,31 @@ description: |-
   Manages an EC2 Local Gateway Route
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Resource: aws_ec2_local_gateway_route
 
 Manages an EC2 Local Gateway Route. More information can be found in the [Outposts User Guide](https://docs.aws.amazon.com/outposts/latest/userguide/outposts-networking-components.html#routing).
 
 ## Example Usage
 
-```terraform
-resource "aws_ec2_local_gateway_route" "example" {
-  destination_cidr_block                   = "172.16.0.0/16"
-  local_gateway_route_table_id             = data.aws_ec2_local_gateway_route_table.example.id
-  local_gateway_virtual_interface_group_id = data.aws_ec2_local_gateway_virtual_interface_group.example.id
-}
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ec2_local_gateway_route import Ec2LocalGatewayRoute
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Ec2LocalGatewayRoute(self, "example",
+            destination_cidr_block="172.16.0.0/16",
+            local_gateway_route_table_id=Token.as_string(data_aws_ec2_local_gateway_route_table_example.id),
+            local_gateway_virtual_interface_group_id=Token.as_string(data_aws_ec2_local_gateway_virtual_interface_group_example.id)
+        )
 ```
 
 ## Argument Reference
@@ -28,18 +41,29 @@ The following arguments are required:
 * `local_gateway_route_table_id` - (Required) Identifier of EC2 Local Gateway Route Table.
 * `local_gateway_virtual_interface_group_id` - (Required) Identifier of EC2 Local Gateway Virtual Interface Group.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - EC2 Local Gateway Route Table identifier and destination CIDR block separated by underscores (`_`)
 
 ## Import
 
-`aws_ec2_local_gateway_route` can be imported by using the EC2 Local Gateway Route Table identifier and destination CIDR block separated by underscores (`_`), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_ec2_local_gateway_route` using the EC2 Local Gateway Route Table identifier and destination CIDR block separated by underscores (`_`). For example:
 
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
 ```
-$ terraform import aws_ec2_local_gateway_route.example lgw-rtb-12345678_172.16.0.0/16
+
+Using `terraform import`, import `aws_ec2_local_gateway_route` using the EC2 Local Gateway Route Table identifier and destination CIDR block separated by underscores (`_`). For example:
+
+```console
+% terraform import aws_ec2_local_gateway_route.example lgw-rtb-12345678_172.16.0.0/16
 ```
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-1e91a283bb3d9d11b1b4699831f824ebe2b6e4d62ba4a95fea8fbf7e64228942 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-760f4fd810c3df45b557ef2e81d281f4a76d35aed253a5917f9f7fd6971b06b0 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ec2_local_gateway_route_table_vpc_association.html.markdown b/website/docs/cdktf/python/r/ec2_local_gateway_route_table_vpc_association.html.markdown
index 842b4f5b10b..f0be06eb322 100644
--- a/website/docs/cdktf/python/r/ec2_local_gateway_route_table_vpc_association.html.markdown
+++ b/website/docs/cdktf/python/r/ec2_local_gateway_route_table_vpc_association.html.markdown
@@ -6,6 +6,8 @@ description: |-
   Manages an EC2 Local Gateway Route Table VPC Association
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Resource: aws_ec2_local_gateway_route_table_vpc_association
 
 Manages an EC2 Local Gateway Route Table VPC Association. More information can be found in the [Outposts User Guide](https://docs.aws.amazon.com/outposts/latest/userguide/outposts-local-gateways.html#vpc-associations).
@@ -13,27 +15,32 @@ Manages an EC2 Local Gateway Route Table VPC Association. More information can b
 ## Example Usage
 
 ```python
-import constructs as constructs
-import cdktf as cdktf
-# Provider bindings are generated by running cdktf get.
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
 # See https://cdk.tf/provider-generation for more details.
-import ...gen.providers.aws as aws
-class MyConvertedCode(cdktf.TerraformStack):
+#
+from imports.aws.data_aws_ec2_local_gateway_route_table import DataAwsEc2LocalGatewayRouteTable
+from imports.aws.ec2_local_gateway_route_table_vpc_association import Ec2LocalGatewayRouteTableVpcAssociation
+from imports.aws.vpc import Vpc
+class MyConvertedCode(TerraformStack):
     def __init__(self, scope, name):
         super().__init__(scope, name)
-        aws_vpc_example = aws.vpc.Vpc(self, "example",
+        example = Vpc(self, "example",
             cidr_block="10.0.0.0/16"
         )
         data_aws_ec2_local_gateway_route_table_example =
-        aws.data_aws_ec2_local_gateway_route_table.DataAwsEc2LocalGatewayRouteTable(self, "example_1",
+        DataAwsEc2LocalGatewayRouteTable(self, "example_1",
             outpost_arn="arn:aws:outposts:us-west-2:123456789012:outpost/op-1234567890abcdef"
         )
         # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
         data_aws_ec2_local_gateway_route_table_example.override_logical_id("example")
         aws_ec2_local_gateway_route_table_vpc_association_example =
-        aws.ec2_local_gateway_route_table_vpc_association.Ec2LocalGatewayRouteTableVpcAssociation(self, "example_2",
-            local_gateway_route_table_id=cdktf.Token.as_string(data_aws_ec2_local_gateway_route_table_example.id),
-            vpc_id=cdktf.Token.as_string(aws_vpc_example.id)
+        Ec2LocalGatewayRouteTableVpcAssociation(self, "example_2",
+            local_gateway_route_table_id=Token.as_string(data_aws_ec2_local_gateway_route_table_example.id),
+            vpc_id=example.id
         )
         # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
         aws_ec2_local_gateway_route_table_vpc_association_example.override_logical_id("example")
@@ -50,19 +57,30 @@ The following arguments are optional:
 
 * `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Identifier of EC2 Local Gateway Route Table VPC Association.
 * `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
 
 ## Import
 
-`aws_ec2_local_gateway_route_table_vpc_association` can be imported by using the Local Gateway Route Table VPC Association identifier, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_ec2_local_gateway_route_table_vpc_association` using the Local Gateway Route Table VPC Association identifier. For example:
 
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
 ```
-$ terraform import aws_ec2_local_gateway_route_table_vpc_association.example lgw-vpc-assoc-1234567890abcdef
+
+Using `terraform import`, import `aws_ec2_local_gateway_route_table_vpc_association` using the Local Gateway Route Table VPC Association identifier. For example:
+
+```console
+% terraform import aws_ec2_local_gateway_route_table_vpc_association.example lgw-vpc-assoc-1234567890abcdef
 ```
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-8a5ccaa440d2879afbbcfd1fd244061ead081eec60878025f40d64bfe098b7d2 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-f4f905dac47ee96e216b29234377003c85028f4754efe49a90ad2269ba720a64 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ec2_managed_prefix_list.html.markdown b/website/docs/cdktf/python/r/ec2_managed_prefix_list.html.markdown
index 304664078e6..c5bca1b4d2a 100644
--- a/website/docs/cdktf/python/r/ec2_managed_prefix_list.html.markdown
+++ b/website/docs/cdktf/python/r/ec2_managed_prefix_list.html.markdown
@@ -6,6 +6,8 @@ description: |-
   Provides a managed prefix list resource.
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Resource: aws_ec2_managed_prefix_list
 
 Provides a managed prefix list resource.
@@ -26,31 +28,39 @@ as 20 rules for the security group.
 
 Basic usage
 
-```terraform
-resource "aws_ec2_managed_prefix_list" "example" {
-  name           = "All VPC CIDR-s"
-  address_family = "IPv4"
-  max_entries    = 5
-
-  entry {
-    cidr        = aws_vpc.example.cidr_block
-    description = "Primary"
-  }
-
-  entry {
-    cidr        = aws_vpc_ipv4_cidr_block_association.example.cidr_block
-    description = "Secondary"
-  }
-
-  tags = {
-    Env = "live"
-  }
-}
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ec2_managed_prefix_list import Ec2ManagedPrefixList
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Ec2ManagedPrefixList(self, "example",
+            address_family="IPv4",
+            entry=[Ec2ManagedPrefixListEntry(
+                cidr=Token.as_string(aws_vpc_example.cidr_block),
+                description="Primary"
+            ), Ec2ManagedPrefixListEntry(
+                cidr=Token.as_string(aws_vpc_ipv4_cidr_block_association_example.cidr_block),
+                description="Secondary"
+            )
+            ],
+            max_entries=5,
+            name="All VPC CIDR-s",
+            tags={
+                "Env": "live"
+            }
+        )
 ```
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `address_family` - (Required, Forces new resource) Address family (`IPv4` or `IPv6`) of this prefix list.
 * `entry` - (Optional) Configuration block for prefix list entry. Detailed below. Different entries may have overlapping CIDR blocks, but a particular CIDR should not be duplicated.
@@ -63,9 +73,9 @@ The following arguments are supported:
 * `cidr` - (Required) CIDR block of this entry.
 * `description` - (Optional) Description of this entry. Due to API limitations, updating only the description of an existing entry requires temporarily removing and re-adding the entry.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the prefix list.
 * `id` - ID of the prefix list.
@@ -75,10 +85,21 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Prefix Lists can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Prefix Lists using the `id`. For example:
 
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
 ```
-$ terraform import aws_ec2_managed_prefix_list.default pl-0570a1d2d725c16be
+
+Using `terraform import`, import Prefix Lists using the `id`. For example:
+
+```console
+% terraform import aws_ec2_managed_prefix_list.default pl-0570a1d2d725c16be
 ```
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-d03b2e2be51b11ee0de71dbcc39b429bde1f7958cc357946fd1044aa8a1f2a79 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-f31ae5e52895be9c6e214e756efedf3f324fec164272531bc7a2c04e0cb5b0ae -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ec2_managed_prefix_list_entry.html.markdown b/website/docs/cdktf/python/r/ec2_managed_prefix_list_entry.html.markdown
index 2c2617cd846..5d4c0e02be3 100644
--- a/website/docs/cdktf/python/r/ec2_managed_prefix_list_entry.html.markdown
+++ b/website/docs/cdktf/python/r/ec2_managed_prefix_list_entry.html.markdown
@@ -3,67 +3,82 @@ subcategory: "VPC (Virtual Private Cloud)"
 layout: "aws"
 page_title: "AWS: aws_ec2_managed_prefix_list_entry"
 description: |-
-  Provides a managed prefix list entry resource.
+  Use the `aws_ec2_managed_prefix_list_entry` resource to manage a managed prefix list entry.
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Resource: aws_ec2_managed_prefix_list_entry
 
-Provides a managed prefix list entry resource.
+Use the `aws_prefix_list_entry` resource to manage a managed prefix list entry.
 
-~> **NOTE on Managed Prefix Lists and Managed Prefix List Entries:** Terraform
-currently provides both a standalone Managed Prefix List Entry resource (a single entry),
-and a [Managed Prefix List resource](ec2_managed_prefix_list.html) with entries defined
-in-line. At this time you cannot use a Managed Prefix List with in-line rules in
-conjunction with any Managed Prefix List Entry resources. Doing so will cause a conflict
-of entries and will overwrite entries.
+~> **NOTE:** Terraform currently provides two resources for managing Managed Prefix Lists and Managed Prefix List Entries. The standalone resource, [Managed Prefix List Entry](ec2_managed_prefix_list_entry.html), is used to manage a single entry. The [Managed Prefix List resource](ec2_managed_prefix_list.html) is used to manage multiple entries defined in-line. It is important to note that you cannot use a Managed Prefix List with in-line rules in conjunction with any Managed Prefix List Entry resources. This will result in a conflict of entries and will cause the entries to be overwritten.
 
-~> **NOTE on Managed Prefix Lists with many entries:**  To improved execution times on larger
-updates, if you plan to create a prefix list with more than 100 entries, it is **recommended**
-that you use the inline `entry` block as part of the [Managed Prefix List resource](ec2_managed_prefix_list.html)
-resource instead.
+~> **NOTE:** To improve execution times on larger updates, it is recommended to use the inline `entry` block as part of the Managed Prefix List resource when creating a prefix list with more than 100 entries. You can find more information about the resource [here](ec2_managed_prefix_list.html).
 
 ## Example Usage
 
-Basic usage
-
-```terraform
-resource "aws_ec2_managed_prefix_list" "example" {
-  name           = "All VPC CIDR-s"
-  address_family = "IPv4"
-  max_entries    = 5
-
-  tags = {
-    Env = "live"
-  }
-}
-
-resource "aws_ec2_managed_prefix_list_entry" "entry_1" {
-  cidr           = aws_vpc.example.cidr_block
-  description    = "Primary"
-  prefix_list_id = aws_ec2_managed_prefix_list.example.id
-}
+Basic usage.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ec2_managed_prefix_list import Ec2ManagedPrefixList
+from imports.aws.ec2_managed_prefix_list_entry import Ec2ManagedPrefixListEntryA
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = Ec2ManagedPrefixList(self, "example",
+            address_family="IPv4",
+            max_entries=5,
+            name="All VPC CIDR-s",
+            tags={
+                "Env": "live"
+            }
+        )
+        Ec2ManagedPrefixListEntryA(self, "entry_1",
+            cidr=Token.as_string(aws_vpc_example.cidr_block),
+            description="Primary",
+            prefix_list_id=example.id
+        )
 ```
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `cidr` - (Required) CIDR block of this entry.
-* `description` - (Optional) Description of this entry. Due to API limitations, updating only the description of an entry requires recreating the entry.
+* `description` - (Optional) Description of this entry. Please note that due to API limitations, updating only the description of an entry will require recreating the entry.
 * `prefix_list_id` - (Required) CIDR block of this entry.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - ID of the managed prefix list entry.
 
 ## Import
 
-Prefix List Entries can be imported using the `prefix_list_id` and `cidr` separated by a `,`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import prefix list entries using `prefix_list_id` and `cidr` separated by a comma (`,`). For example:
 
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
 ```
-$ terraform import aws_ec2_managed_prefix_list_entry.default pl-0570a1d2d725c16be,10.0.3.0/24
+
+Using `terraform import`, import prefix list entries using `prefix_list_id` and `cidr` separated by a comma (`,`). For example:
+
+```console
+% terraform import aws_ec2_managed_prefix_list_entry.default pl-0570a1d2d725c16be,10.0.3.0/24
 ```
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-8044d9df33545e75bc4f855bebf836afa8d3e58985e94cca9f369fb466375d88 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-a95730eacb673234acf87d5fadae62c50b9ab8fba39c257ae0b77d4dc4586a17 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ec2_network_insights_analysis.html.markdown b/website/docs/cdktf/python/r/ec2_network_insights_analysis.html.markdown
index 74ecc094ad2..032b57f6d3d 100644
--- a/website/docs/cdktf/python/r/ec2_network_insights_analysis.html.markdown
+++ b/website/docs/cdktf/python/r/ec2_network_insights_analysis.html.markdown
@@ -6,22 +6,35 @@ description: |-
   Provides a Network Insights Analysis resource.
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Resource: aws_ec2_network_insights_analysis
 
 Provides a Network Insights Analysis resource. Part of the "Reachability Analyzer" service in the AWS VPC console.
 
 ## Example Usage
 
-```terraform
-resource "aws_ec2_network_insights_path" "path" {
-  source      = aws_network_interface.source.id
-  destination = aws_network_interface.destination.id
-  protocol    = "tcp"
-}
-
-resource "aws_ec2_network_insights_analysis" "analysis" {
-  network_insights_path_id = aws_ec2_network_insights_path.path.id
-}
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ec2_network_insights_analysis import Ec2NetworkInsightsAnalysis
+from imports.aws.ec2_network_insights_path import Ec2NetworkInsightsPath
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        path = Ec2NetworkInsightsPath(self, "path",
+            destination=destination.id,
+            protocol="tcp",
+            source=source.id
+        )
+        Ec2NetworkInsightsAnalysis(self, "analysis",
+            network_insights_path_id=path.id
+        )
 ```
 
 ## Argument Reference
@@ -36,9 +49,9 @@ The following arguments are optional:
 * `wait_for_completion` - (Optional) If enabled, the resource will wait for the Network Insights Analysis status to change to `succeeded` or `failed`. Setting this to `false` will skip the process. Default: `true`.
 * `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `alternate_path_hints` - Potential intermediate components of a feasible path. Described below.
 * `arn` - ARN of the Network Insights Analysis.
@@ -60,10 +73,21 @@ The `alternate_path_hints` object supports the following:
 
 ## Import
 
-Network Insights Analyses can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Network Insights Analyses using the `id`. For example:
 
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
 ```
-$ terraform import aws_ec2_network_insights_analysis.test nia-0462085c957f11a55
+
+Using `terraform import`, import Network Insights Analyses using the `id`. For example:
+
+```console
+% terraform import aws_ec2_network_insights_analysis.test nia-0462085c957f11a55
 ```
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-6c52a3f45a5c53a101825e5d344e7a38516ecb14af919feddb6511f6632e0f4a -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-d364ed056c8c7e9f437f7a613d16d15bd1837a75ee3566f79b85669e4eb1f0d1 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ec2_network_insights_path.html.markdown b/website/docs/cdktf/python/r/ec2_network_insights_path.html.markdown
index 2b0b1ba32fa..a686c6eae74 100644
--- a/website/docs/cdktf/python/r/ec2_network_insights_path.html.markdown
+++ b/website/docs/cdktf/python/r/ec2_network_insights_path.html.markdown
@@ -6,26 +6,39 @@ description: |-
   Provides a Network Insights Path resource.
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Resource: aws_ec2_network_insights_path
 
 Provides a Network Insights Path resource. Part of the "Reachability Analyzer" service in the AWS VPC console.
 
 ## Example Usage
 
-```terraform
-resource "aws_ec2_network_insights_path" "test" {
-  source      = aws_network_interface.source.id
-  destination = aws_network_interface.destination.id
-  protocol    = "tcp"
-}
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ec2_network_insights_path import Ec2NetworkInsightsPath
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Ec2NetworkInsightsPath(self, "test",
+            destination=destination.id,
+            protocol="tcp",
+            source=source.id
+        )
 ```
 
 ## Argument Reference
 
 The following arguments are required:
 
-* `source` - (Required) ID of the resource which is the source of the path. Can be an Instance, Internet Gateway, Network Interface, Transit Gateway, VPC Endpoint, VPC Peering Connection or VPN Gateway.
-* `destination` - (Required) ID of the resource which is the source of the path. Can be an Instance, Internet Gateway, Network Interface, Transit Gateway, VPC Endpoint, VPC Peering Connection or VPN Gateway.
+* `source` - (Required) ID or ARN of the resource which is the source of the path. Can be an Instance, Internet Gateway, Network Interface, Transit Gateway, VPC Endpoint, VPC Peering Connection or VPN Gateway. If the resource is in another account, you must specify an ARN.
+* `destination` - (Required) ID or ARN of the resource which is the destination of the path. Can be an Instance, Internet Gateway, Network Interface, Transit Gateway, VPC Endpoint, VPC Peering Connection or VPN Gateway. If the resource is in another account, you must specify an ARN.
 * `protocol` - (Required) Protocol to use for analysis. Valid options are `tcp` or `udp`.
 
 The following arguments are optional:
@@ -35,20 +48,33 @@ The following arguments are optional:
 * `destination_port` - (Optional) Destination port to analyze access to.
 * `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the Network Insights Path.
+* `destination_arn` - ARN of the destination.
 * `id` - ID of the Network Insights Path.
+* `source_arn` - ARN of the source.
 * `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
 
 ## Import
 
-Network Insights Paths can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Network Insights Paths using the `id`. For example:
 
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
 ```
-$ terraform import aws_ec2_network_insights_path.test nip-00edfba169923aefd
+
+Using `terraform import`, import Network Insights Paths using the `id`. For example:
+
+```console
+% terraform import aws_ec2_network_insights_path.test nip-00edfba169923aefd
 ```
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-c926a6193628df8930deeb3e316583f9163e2d4f39989879768b5c0502ec2bc5 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-2d954457dd6558b313317ea2a62a029bb4f6b0f9fb109a2eff89ecd56e960d31 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ec2_serial_console_access.html.markdown b/website/docs/cdktf/python/r/ec2_serial_console_access.html.markdown
index 10586885f97..482d40ba314 100644
--- a/website/docs/cdktf/python/r/ec2_serial_console_access.html.markdown
+++ b/website/docs/cdktf/python/r/ec2_serial_console_access.html.markdown
@@ -6,6 +6,8 @@ description: |-
   Manages whether serial console access is enabled for your AWS account in the current AWS region.
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Resource: aws_ec2_serial_console_access
 
 Provides a resource to manage whether serial console access is enabled for your AWS account in the current AWS region.
@@ -15,35 +17,49 @@ Provides a resource to manage whether serial console access is enabled for your
 ## Example Usage
 
 ```python
-import constructs as constructs
-import cdktf as cdktf
-# Provider bindings are generated by running cdktf get.
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
 # See https://cdk.tf/provider-generation for more details.
-import ...gen.providers.aws as aws
-class MyConvertedCode(cdktf.TerraformStack):
+#
+from imports.aws.ec2_serial_console_access import Ec2SerialConsoleAccess
+class MyConvertedCode(TerraformStack):
     def __init__(self, scope, name):
         super().__init__(scope, name)
-        aws.ec2_serial_console_access.Ec2SerialConsoleAccess(self, "example",
+        Ec2SerialConsoleAccess(self, "example",
             enabled=True
         )
 ```
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `enabled` - (Optional) Whether or not serial console access is enabled. Valid values are `true` or `false`. Defaults to `true`.
 
-## Attributes Reference
+## Attribute Reference
 
-No additional attributes are exported.
+This resource exports no additional attributes.
 
 ## Import
 
-Serial console access state can be imported, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import serial console access state. For example:
 
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
 ```
-$ terraform import aws_ec2_serial_console_access.example default
+
+Using `terraform import`, import serial console access state. For example:
+
+```console
+% terraform import aws_ec2_serial_console_access.example default
 ```
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-b3550eec1a2807a26834271d28b2d03e898cca3cd2a732d5d38c79ddf71181e6 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-a8751aa6eb0a3b96c3378b69be9c857d11be1b4723fc3142c82967475affbbbc -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ec2_subnet_cidr_reservation.html.markdown b/website/docs/cdktf/python/r/ec2_subnet_cidr_reservation.html.markdown
index 059efaf893e..dc0e4c75699 100644
--- a/website/docs/cdktf/python/r/ec2_subnet_cidr_reservation.html.markdown
+++ b/website/docs/cdktf/python/r/ec2_subnet_cidr_reservation.html.markdown
@@ -6,42 +6,66 @@ description: |-
   Provides a subnet CIDR reservation resource.
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Resource: aws_ec2_subnet_cidr_reservation
 
 Provides a subnet CIDR reservation resource.
 
 ## Example Usage
 
-```terraform
-resource "aws_ec2_subnet_cidr_reservation" "example" {
-  cidr_block       = "10.0.0.16/28"
-  reservation_type = "prefix"
-  subnet_id        = aws_subnet.example.id
-}
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ec2_subnet_cidr_reservation import Ec2SubnetCidrReservation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Ec2SubnetCidrReservation(self, "example",
+            cidr_block="10.0.0.16/28",
+            reservation_type="prefix",
+            subnet_id=Token.as_string(aws_subnet_example.id)
+        )
 ```
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `cidr_block` - (Required) The CIDR block for the reservation.
 * `reservation_type` - (Required) The type of reservation to create. Valid values: `explicit`, `prefix`
 * `subnet_id` - (Required) The ID of the subnet to create the reservation for.
 * `description` - (Optional) A brief description of the reservation.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - ID of the CIDR reservation.
 * `owner_id` - ID of the AWS account that owns this CIDR reservation.
 
 ## Import
 
-Existing CIDR reservations can be imported using `SUBNET_ID:RESERVATION_ID`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Existing CIDR reservations using `SUBNET_ID:RESERVATION_ID`. For example:
 
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
 ```
-$ terraform import aws_ec2_subnet_cidr_reservation.example subnet-01llsxvsxabqiymcz:scr-4mnvz6wb7otksjcs9
+
+Using `terraform import`, import Existing CIDR reservations using `SUBNET_ID:RESERVATION_ID`. For example:
+
+```console
+% terraform import aws_ec2_subnet_cidr_reservation.example subnet-01llsxvsxabqiymcz:scr-4mnvz6wb7otksjcs9
 ```
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-068d78a5a45794a8e8dfb5699785f8dd8fbaf725814c393dab988a122183fd6d -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-fc461a33a61b61090347c3aebed74b1fbf423338d6a3082dc4e7dd5963cc132c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ec2_tag.html.markdown b/website/docs/cdktf/python/r/ec2_tag.html.markdown
index 15b700f40d9..5a924e3a031 100644
--- a/website/docs/cdktf/python/r/ec2_tag.html.markdown
+++ b/website/docs/cdktf/python/r/ec2_tag.html.markdown
@@ -6,6 +6,8 @@ description: |-
   Manages an individual EC2 resource tag
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Resource: aws_ec2_tag
 
 Manages an individual EC2 resource tag. This resource should only be used in cases where EC2 resources are created outside Terraform (e.g., AMIs), being shared via Resource Access Manager (RAM), or implicitly created by other means (e.g., Transit Gateway VPN Attachments).
@@ -17,33 +19,38 @@ Manages an individual EC2 resource tag. This resource should only be used in cas
 ## Example Usage
 
 ```python
-import constructs as constructs
-import cdktf as cdktf
-# Provider bindings are generated by running cdktf get.
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
 # See https://cdk.tf/provider-generation for more details.
-import ...gen.providers.aws as aws
-class MyConvertedCode(cdktf.TerraformStack):
+#
+from imports.aws.customer_gateway import CustomerGateway
+from imports.aws.ec2_tag import Ec2Tag
+from imports.aws.ec2_transit_gateway import Ec2TransitGateway
+from imports.aws.vpn_connection import VpnConnection
+class MyConvertedCode(TerraformStack):
     def __init__(self, scope, name):
         super().__init__(scope, name)
-        aws_customer_gateway_example = aws.customer_gateway.CustomerGateway(self, "example",
-            bgp_asn=cdktf.Token.as_string(65000),
+        example = CustomerGateway(self, "example",
+            bgp_asn=Token.as_string(65000),
             ip_address="172.0.0.1",
             type="ipsec.1"
         )
-        aws_ec2_transit_gateway_example =
-        aws.ec2_transit_gateway.Ec2TransitGateway(self, "example_1")
+        aws_ec2_transit_gateway_example = Ec2TransitGateway(self, "example_1")
         # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
         aws_ec2_transit_gateway_example.override_logical_id("example")
-        aws_vpn_connection_example = aws.vpn_connection.VpnConnection(self, "example_2",
-            customer_gateway_id=cdktf.Token.as_string(aws_customer_gateway_example.id),
-            transit_gateway_id=cdktf.Token.as_string(aws_ec2_transit_gateway_example.id),
-            type=cdktf.Token.as_string(aws_customer_gateway_example.type)
+        aws_vpn_connection_example = VpnConnection(self, "example_2",
+            customer_gateway_id=example.id,
+            transit_gateway_id=Token.as_string(aws_ec2_transit_gateway_example.id),
+            type=example.type
         )
         # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
         aws_vpn_connection_example.override_logical_id("example")
-        aws_ec2_tag_example = aws.ec2_tag.Ec2Tag(self, "example_3",
+        aws_ec2_tag_example = Ec2Tag(self, "example_3",
             key="Name",
-            resource_id=cdktf.Token.as_string(aws_vpn_connection_example.transit_gateway_attachment_id),
+            resource_id=Token.as_string(aws_vpn_connection_example.transit_gateway_attachment_id),
             value="Hello World"
         )
         # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
@@ -52,24 +59,35 @@ class MyConvertedCode(cdktf.TerraformStack):
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `resource_id` - (Required) The ID of the EC2 resource to manage the tag for.
 * `key` - (Required) The tag name.
 * `value` - (Required) The value of the tag.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - EC2 resource identifier and key, separated by a comma (`,`)
 
 ## Import
 
-`aws_ec2_tag` can be imported by using the EC2 resource identifier and key, separated by a comma (`,`), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_ec2_tag` using the EC2 resource identifier and key, separated by a comma (`,`). For example:
 
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
 ```
-$ terraform import aws_ec2_tag.example tgw-attach-1234567890abcdef,Name
+
+Using `terraform import`, import `aws_ec2_tag` using the EC2 resource identifier and key, separated by a comma (`,`). For example:
+
+```console
+% terraform import aws_ec2_tag.example tgw-attach-1234567890abcdef,Name
 ```
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-a019f483855232814dd71801911c02977a3e810c118efe8f2670f5db055f687e -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-426f65492ad1473d61135571b53f491b7c40004b57450d752d563e20252feea5 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ec2_traffic_mirror_filter.html.markdown b/website/docs/cdktf/python/r/ec2_traffic_mirror_filter.html.markdown
index 1fc8bf46f48..df2fcc95924 100644
--- a/website/docs/cdktf/python/r/ec2_traffic_mirror_filter.html.markdown
+++ b/website/docs/cdktf/python/r/ec2_traffic_mirror_filter.html.markdown
@@ -6,6 +6,8 @@ description: |-
   Provides an Traffic mirror filter
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Resource: aws_ec2_traffic_mirror_filter
 
 Provides an Traffic mirror filter.  
@@ -16,15 +18,18 @@ Read [limits and considerations](https://docs.aws.amazon.com/vpc/latest/mirrorin
 To create a basic traffic mirror filter
 
 ```python
-import constructs as constructs
-import cdktf as cdktf
-# Provider bindings are generated by running cdktf get.
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
 # See https://cdk.tf/provider-generation for more details.
-import ...gen.providers.aws as aws
-class MyConvertedCode(cdktf.TerraformStack):
+#
+from imports.aws.ec2_traffic_mirror_filter import Ec2TrafficMirrorFilter
+class MyConvertedCode(TerraformStack):
     def __init__(self, scope, name):
         super().__init__(scope, name)
-        aws.ec2_traffic_mirror_filter.Ec2TrafficMirrorFilter(self, "foo",
+        Ec2TrafficMirrorFilter(self, "foo",
             description="traffic mirror filter - terraform example",
             network_services=["amazon-dns"]
         )
@@ -32,15 +37,15 @@ class MyConvertedCode(cdktf.TerraformStack):
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `description` - (Optional, Forces new resource) A description of the filter.
 * `network_services` - (Optional) List of amazon network services that should be mirrored. Valid values: `amazon-dns`.
 * `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The ARN of the traffic mirror filter.
 * `id` - The name of the filter.
@@ -48,10 +53,21 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Traffic mirror filter can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import traffic mirror filter using the `id`. For example:
 
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
 ```
-$ terraform import aws_ec2_traffic_mirror_filter.foo tmf-0fbb93ddf38198f64
+
+Using `terraform import`, import traffic mirror filter using the `id`. For example:
+
+```console
+% terraform import aws_ec2_traffic_mirror_filter.foo tmf-0fbb93ddf38198f64
 ```
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-b7d0c8547ea5ec647a0886aad11141c27cca1006379ac82906bc6f26a46c5898 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-08ada8ec01a41a5d998f21a5946d9d4b579e2fe8c3ac968d45ecefd291cbd4c3 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ec2_traffic_mirror_filter_rule.html.markdown b/website/docs/cdktf/python/r/ec2_traffic_mirror_filter_rule.html.markdown
index 86094c8e80c..a325c971210 100644
--- a/website/docs/cdktf/python/r/ec2_traffic_mirror_filter_rule.html.markdown
+++ b/website/docs/cdktf/python/r/ec2_traffic_mirror_filter_rule.html.markdown
@@ -6,6 +6,8 @@ description: |-
   Provides an Traffic mirror filter rule
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Resource: aws_ec2_traffic_mirror_filter_rule
 
 Provides an Traffic mirror filter rule.  
@@ -16,20 +18,23 @@ Read [limits and considerations](https://docs.aws.amazon.com/vpc/latest/mirrorin
 To create a basic traffic mirror session
 
 ```python
-import constructs as constructs
-import cdktf as cdktf
-# Provider bindings are generated by running cdktf get.
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
 # See https://cdk.tf/provider-generation for more details.
-import ...gen.providers.aws as aws
-class MyConvertedCode(cdktf.TerraformStack):
+#
+from imports.aws.ec2_traffic_mirror_filter import Ec2TrafficMirrorFilter
+from imports.aws.ec2_traffic_mirror_filter_rule import Ec2TrafficMirrorFilterRule
+class MyConvertedCode(TerraformStack):
     def __init__(self, scope, name):
         super().__init__(scope, name)
-        aws_ec2_traffic_mirror_filter_filter =
-        aws.ec2_traffic_mirror_filter.Ec2TrafficMirrorFilter(self, "filter",
+        filter = Ec2TrafficMirrorFilter(self, "filter",
             description="traffic mirror filter - terraform example",
             network_services=["amazon-dns"]
         )
-        aws.ec2_traffic_mirror_filter_rule.Ec2TrafficMirrorFilterRule(self, "rulein",
+        Ec2TrafficMirrorFilterRule(self, "rulein",
             description="test rule",
             destination_cidr_block="10.0.0.0/8",
             destination_port_range=Ec2TrafficMirrorFilterRuleDestinationPortRange(
@@ -45,22 +50,22 @@ class MyConvertedCode(cdktf.TerraformStack):
                 to_port=10
             ),
             traffic_direction="ingress",
-            traffic_mirror_filter_id=cdktf.Token.as_string(aws_ec2_traffic_mirror_filter_filter.id)
+            traffic_mirror_filter_id=filter.id
         )
-        aws.ec2_traffic_mirror_filter_rule.Ec2TrafficMirrorFilterRule(self, "ruleout",
+        Ec2TrafficMirrorFilterRule(self, "ruleout",
             description="test rule",
             destination_cidr_block="10.0.0.0/8",
             rule_action="accept",
             rule_number=1,
             source_cidr_block="10.0.0.0/8",
             traffic_direction="egress",
-            traffic_mirror_filter_id=cdktf.Token.as_string(aws_ec2_traffic_mirror_filter_filter.id)
+            traffic_mirror_filter_id=filter.id
         )
 ```
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `description` - (Optional) Description of the traffic mirror filter rule.
 * `traffic_mirror_filter_id`  - (Required) ID of the traffic mirror filter to which this rule should be added
@@ -78,19 +83,30 @@ Traffic mirror port range support following attributes:
 * `from_port` - (Optional) Starting port of the range
 * `to_port` - (Optional) Ending port of the range
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the traffic mirror filter rule.
 * `id` - Name of the traffic mirror filter rule.
 
 ## Import
 
-Traffic mirror rules can be imported using the `traffic_mirror_filter_id` and `id` separated by `:` e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import traffic mirror rules using the `traffic_mirror_filter_id` and `id` separated by `:`. For example:
 
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
 ```
-$ terraform import aws_ec2_traffic_mirror_filter_rule.rule tmf-0fbb93ddf38198f64:tmfr-05a458f06445d0aee
+
+Using `terraform import`, import traffic mirror rules using the `traffic_mirror_filter_id` and `id` separated by `:`. For example:
+
+```console
+% terraform import aws_ec2_traffic_mirror_filter_rule.rule tmf-0fbb93ddf38198f64:tmfr-05a458f06445d0aee
 ```
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-ee0ef6357eca144bbb3215244fe80128101015d1bdebdadc916196862d53f340 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-ee8ae70ab3b42d0c264494b7dc21ff8f9e48c2c41596a2bf47513cd2380b21c6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ec2_traffic_mirror_session.html.markdown b/website/docs/cdktf/python/r/ec2_traffic_mirror_session.html.markdown
index 58b0d2dc980..d94b83f7857 100644
--- a/website/docs/cdktf/python/r/ec2_traffic_mirror_session.html.markdown
+++ b/website/docs/cdktf/python/r/ec2_traffic_mirror_session.html.markdown
@@ -6,6 +6,8 @@ description: |-
   Provides a Traffic mirror session
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Resource: aws_ec2_traffic_mirror_session
 
 Provides an Traffic mirror session.  
@@ -15,28 +17,39 @@ Read [limits and considerations](https://docs.aws.amazon.com/vpc/latest/mirrorin
 
 To create a basic traffic mirror session
 
-```terraform
-resource "aws_ec2_traffic_mirror_filter" "filter" {
-  description      = "traffic mirror filter - terraform example"
-  network_services = ["amazon-dns"]
-}
-
-resource "aws_ec2_traffic_mirror_target" "target" {
-  network_load_balancer_arn = aws_lb.lb.arn
-}
-
-resource "aws_ec2_traffic_mirror_session" "session" {
-  description              = "traffic mirror session - terraform example"
-  network_interface_id     = aws_instance.test.primary_network_interface_id
-  session_number           = 1
-  traffic_mirror_filter_id = aws_ec2_traffic_mirror_filter.filter.id
-  traffic_mirror_target_id = aws_ec2_traffic_mirror_target.target.id
-}
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ec2_traffic_mirror_filter import Ec2TrafficMirrorFilter
+from imports.aws.ec2_traffic_mirror_session import Ec2TrafficMirrorSession
+from imports.aws.ec2_traffic_mirror_target import Ec2TrafficMirrorTarget
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        filter = Ec2TrafficMirrorFilter(self, "filter",
+            description="traffic mirror filter - terraform example",
+            network_services=["amazon-dns"]
+        )
+        target = Ec2TrafficMirrorTarget(self, "target",
+            network_load_balancer_arn=lb.arn
+        )
+        Ec2TrafficMirrorSession(self, "session",
+            description="traffic mirror session - terraform example",
+            network_interface_id=test.primary_network_interface_id,
+            session_number=1,
+            traffic_mirror_filter_id=filter.id,
+            traffic_mirror_target_id=target.id
+        )
 ```
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `description` - (Optional) A description of the traffic mirror session.
 * `network_interface_id` - (Required, Forces new) ID of the source network interface. Not all network interfaces are eligible as mirror sources. On EC2 instances only nitro based instances support mirroring.
@@ -47,9 +60,9 @@ The following arguments are supported:
 * `virtual_network_id` - (Optional) - The VXLAN ID for the Traffic Mirror session. For more information about the VXLAN protocol, see RFC 7348. If you do not specify a VirtualNetworkId, an account-wide unique id is chosen at random.
 * `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The ARN of the traffic mirror session.
 * `id` - The name of the session.
@@ -58,10 +71,21 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Traffic mirror sessions can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import traffic mirror sessions using the `id`. For example:
 
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
 ```
-$ terraform import aws_ec2_traffic_mirror_session.session tms-0d8aa3ca35897b82e
+
+Using `terraform import`, import traffic mirror sessions using the `id`. For example:
+
+```console
+% terraform import aws_ec2_traffic_mirror_session.session tms-0d8aa3ca35897b82e
 ```
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-5670ce5560910952c3933c8ed7317f718ceb01dc8d39fc7495f64601c87b72c4 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-bebf9726dbd8427c2549afe146e9559250616ce6b54593bc2d8e49757985351e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ec2_traffic_mirror_target.html.markdown b/website/docs/cdktf/python/r/ec2_traffic_mirror_target.html.markdown
index a926f203af1..cf23076e10d 100644
--- a/website/docs/cdktf/python/r/ec2_traffic_mirror_target.html.markdown
+++ b/website/docs/cdktf/python/r/ec2_traffic_mirror_target.html.markdown
@@ -6,6 +6,8 @@ description: |-
   Provides a Traffic mirror target
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Resource: aws_ec2_traffic_mirror_target
 
 Provides a Traffic mirror target.  
@@ -15,26 +17,35 @@ Read [limits and considerations](https://docs.aws.amazon.com/vpc/latest/mirrorin
 
 To create a basic traffic mirror session
 
-```terraform
-resource "aws_ec2_traffic_mirror_target" "nlb" {
-  description               = "NLB target"
-  network_load_balancer_arn = aws_lb.lb.arn
-}
-
-resource "aws_ec2_traffic_mirror_target" "eni" {
-  description          = "ENI target"
-  network_interface_id = aws_instance.test.primary_network_interface_id
-}
-
-resource "aws_ec2_traffic_mirror_target" "gwlb" {
-  description                       = "GWLB target"
-  gateway_load_balancer_endpoint_id = aws_vpc_endpoint.example.id
-}
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ec2_traffic_mirror_target import Ec2TrafficMirrorTarget
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Ec2TrafficMirrorTarget(self, "eni",
+            description="ENI target",
+            network_interface_id=test.primary_network_interface_id
+        )
+        Ec2TrafficMirrorTarget(self, "gwlb",
+            description="GWLB target",
+            gateway_load_balancer_endpoint_id=example.id
+        )
+        Ec2TrafficMirrorTarget(self, "nlb",
+            description="NLB target",
+            network_load_balancer_arn=lb.arn
+        )
 ```
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `description` - (Optional, Forces new) A description of the traffic mirror session.
 * `network_interface_id` - (Optional, Forces new) The network interface ID that is associated with the target.
@@ -44,9 +55,9 @@ The following arguments are supported:
 
 **NOTE:** Either `network_interface_id` or `network_load_balancer_arn` should be specified and both should not be specified together
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the Traffic Mirror target.
 * `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
@@ -55,10 +66,21 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Traffic mirror targets can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import traffic mirror targets using the `id`. For example:
 
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
 ```
-$ terraform import aws_ec2_traffic_mirror_target.target tmt-0c13a005422b86606
+
+Using `terraform import`, import traffic mirror targets using the `id`. For example:
+
+```console
+% terraform import aws_ec2_traffic_mirror_target.target tmt-0c13a005422b86606
 ```
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-992368b8db2722ef4cf35e5d727bab897b351724752b8e15f51ad89877879f51 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-0dcea120206f78ae4bab492b768957fc04e77c30670fd1496757b5d3a63f1ae0 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ec2_transit_gateway.html.markdown b/website/docs/cdktf/python/r/ec2_transit_gateway.html.markdown
index 54cff4fa604..09657927323 100644
--- a/website/docs/cdktf/python/r/ec2_transit_gateway.html.markdown
+++ b/website/docs/cdktf/python/r/ec2_transit_gateway.html.markdown
@@ -6,6 +6,8 @@ description: |-
   Manages an EC2 Transit Gateway
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Resource: aws_ec2_transit_gateway
 
 Manages an EC2 Transit Gateway.
@@ -13,22 +15,25 @@ Manages an EC2 Transit Gateway.
 ## Example Usage
 
 ```python
-import constructs as constructs
-import cdktf as cdktf
-# Provider bindings are generated by running cdktf get.
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
 # See https://cdk.tf/provider-generation for more details.
-import ...gen.providers.aws as aws
-class MyConvertedCode(cdktf.TerraformStack):
+#
+from imports.aws.ec2_transit_gateway import Ec2TransitGateway
+class MyConvertedCode(TerraformStack):
     def __init__(self, scope, name):
         super().__init__(scope, name)
-        aws.ec2_transit_gateway.Ec2TransitGateway(self, "example",
+        Ec2TransitGateway(self, "example",
             description="example"
         )
 ```
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `amazon_side_asn` - (Optional) Private Autonomous System Number (ASN) for the Amazon side of a BGP session. The range is `64512` to `65534` for 16-bit ASNs and `4200000000` to `4294967294` for 32-bit ASNs. Default value: `64512`.
 
@@ -44,9 +49,9 @@ The following arguments are supported:
 * `transit_gateway_cidr_blocks` - (Optional) One or more IPv4 or IPv6 CIDR blocks for the transit gateway. Must be a size /24 CIDR block or larger for IPv4, or a size /64 CIDR block or larger for IPv6.
 * `vpn_ecmp_support` - (Optional) Whether VPN Equal Cost Multipath Protocol support is enabled. Valid values: `disable`, `enable`. Default value: `enable`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - EC2 Transit Gateway Amazon Resource Name (ARN)
 * `association_default_route_table_id` - Identifier of the default association route table
@@ -65,10 +70,21 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_ec2_transit_gateway` can be imported by using the EC2 Transit Gateway identifier, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_ec2_transit_gateway` using the EC2 Transit Gateway identifier. For example:
 
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
 ```
-$ terraform import aws_ec2_transit_gateway.example tgw-12345678
+
+Using `terraform import`, import `aws_ec2_transit_gateway` using the EC2 Transit Gateway identifier. For example:
+
+```console
+% terraform import aws_ec2_transit_gateway.example tgw-12345678
 ```
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-6e48757e816afbbf68b47d7e2d67bd6065154cade25b443bde58088cdd10f4a1 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-8abb713f19097861ce297d1a598e2ebacc47c1a42889776410c75cd929a248ea -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ec2_transit_gateway_connect.html.markdown b/website/docs/cdktf/python/r/ec2_transit_gateway_connect.html.markdown
index b879075850f..5e7f010e534 100644
--- a/website/docs/cdktf/python/r/ec2_transit_gateway_connect.html.markdown
+++ b/website/docs/cdktf/python/r/ec2_transit_gateway_connect.html.markdown
@@ -6,39 +6,52 @@ description: |-
   Manages an EC2 Transit Gateway Connect
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Resource: aws_ec2_transit_gateway_connect
 
 Manages an EC2 Transit Gateway Connect.
 
 ## Example Usage
 
-```terraform
-resource "aws_ec2_transit_gateway_vpc_attachment" "example" {
-  subnet_ids         = [aws_subnet.example.id]
-  transit_gateway_id = aws_ec2_transit_gateway.example.id
-  vpc_id             = aws_vpc.example.id
-}
-
-resource "aws_ec2_transit_gateway_connect" "attachment" {
-  transport_attachment_id = aws_ec2_transit_gateway_vpc_attachment.example.id
-  transit_gateway_id      = aws_ec2_transit_gateway.example.id
-}
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ec2_transit_gateway_connect import Ec2TransitGatewayConnect
+from imports.aws.ec2_transit_gateway_vpc_attachment import Ec2TransitGatewayVpcAttachment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = Ec2TransitGatewayVpcAttachment(self, "example",
+            subnet_ids=[Token.as_string(aws_subnet_example.id)],
+            transit_gateway_id=Token.as_string(aws_ec2_transit_gateway_example.id),
+            vpc_id=Token.as_string(aws_vpc_example.id)
+        )
+        Ec2TransitGatewayConnect(self, "attachment",
+            transit_gateway_id=Token.as_string(aws_ec2_transit_gateway_example.id),
+            transport_attachment_id=example.id
+        )
 ```
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
-* `protocol` - (Optional) The tunnel protocol. Valida values: `gre`. Default is `gre`.
+* `protocol` - (Optional) The tunnel protocol. Valid values: `gre`. Default is `gre`.
 * `tags` - (Optional) Key-value tags for the EC2 Transit Gateway Connect. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 * `transit_gateway_default_route_table_association` - (Optional) Boolean whether the Connect should be associated with the EC2 Transit Gateway association default route table. This cannot be configured or perform drift detection with Resource Access Manager shared EC2 Transit Gateways. Default value: `true`.
 * `transit_gateway_default_route_table_propagation` - (Optional) Boolean whether the Connect should propagate routes with the EC2 Transit Gateway propagation default route table. This cannot be configured or perform drift detection with Resource Access Manager shared EC2 Transit Gateways. Default value: `true`.
 * `transit_gateway_id` - (Required) Identifier of EC2 Transit Gateway.
 * `transport_attachment_id` - (Required) The underlaying VPC attachment
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - EC2 Transit Gateway Attachment identifier
 * `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
@@ -53,10 +66,21 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_ec2_transit_gateway_connect` can be imported by using the EC2 Transit Gateway Connect identifier, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_ec2_transit_gateway_connect` using the EC2 Transit Gateway Connect identifier. For example:
 
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
 ```
-$ terraform import aws_ec2_transit_gateway_connect.example tgw-attach-12345678
+
+Using `terraform import`, import `aws_ec2_transit_gateway_connect` using the EC2 Transit Gateway Connect identifier. For example:
+
+```console
+% terraform import aws_ec2_transit_gateway_connect.example tgw-attach-12345678
 ```
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-f3d6047229225fad16296092d58f858cc2275ae28af2b04cb19cf33046ea88ae -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-3587ce9a543683c2a7be3dfe58f86b578cf760c76595adf37a9f30c13a13e9b9 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ec2_transit_gateway_connect_peer.html.markdown b/website/docs/cdktf/python/r/ec2_transit_gateway_connect_peer.html.markdown
index 5ce8eae9788..656442b3f33 100644
--- a/website/docs/cdktf/python/r/ec2_transit_gateway_connect_peer.html.markdown
+++ b/website/docs/cdktf/python/r/ec2_transit_gateway_connect_peer.html.markdown
@@ -6,28 +6,44 @@ description: |-
   Manages an EC2 Transit Gateway Connect Peer
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Resource: aws_ec2_transit_gateway_connect_peer
 
 Manages an EC2 Transit Gateway Connect Peer.
 
 ## Example Usage
 
-```terraform
-resource "aws_ec2_transit_gateway_connect" "example" {
-  transport_attachment_id = aws_ec2_transit_gateway_vpc_attachment.example.id
-  transit_gateway_id      = aws_ec2_transit_gateway.example.id
-}
-
-resource "aws_ec2_transit_gateway_connect_peer" "example" {
-  peer_address                  = "10.1.2.3"
-  inside_cidr_blocks            = ["169.254.100.0/29"]
-  transit_gateway_attachment_id = aws_ec2_transit_gateway_connect.example.id
-}
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ec2_transit_gateway_connect import Ec2TransitGatewayConnect
+from imports.aws.ec2_transit_gateway_connect_peer import Ec2TransitGatewayConnectPeer
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = Ec2TransitGatewayConnect(self, "example",
+            transit_gateway_id=Token.as_string(aws_ec2_transit_gateway_example.id),
+            transport_attachment_id=Token.as_string(aws_ec2_transit_gateway_vpc_attachment_example.id)
+        )
+        aws_ec2_transit_gateway_connect_peer_example =
+        Ec2TransitGatewayConnectPeer(self, "example_1",
+            inside_cidr_blocks=["169.254.100.0/29"],
+            peer_address="10.1.2.3",
+            transit_gateway_attachment_id=example.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_ec2_transit_gateway_connect_peer_example.override_logical_id("example")
 ```
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `bgp_asn` - (Optional) The BGP ASN number assigned customer device. If not provided, it will use the same BGP ASN as is associated with Transit Gateway.
 * `inside_cidr_blocks` - (Required) The CIDR block that will be used for addressing within the tunnel. It must contain exactly one IPv4 CIDR block and up to one IPv6 CIDR block. The IPv4 CIDR block must be /29 size and must be within 169.254.0.0/16 range, with exception of: 169.254.0.0/29, 169.254.1.0/29, 169.254.2.0/29, 169.254.3.0/29, 169.254.4.0/29, 169.254.5.0/29, 169.254.169.248/29. The IPv6 CIDR block must be /125 size and must be within fd00::/8. The first IP from each CIDR block is assigned for customer gateway, the second and third is for Transit Gateway (An example: from range 169.254.100.0/29, .1 is assigned to customer gateway and .2 and .3 are assigned to Transit Gateway)
@@ -36,12 +52,14 @@ The following arguments are supported:
 * `transit_gateway_address` - (Optional) The IP address assigned to Transit Gateway, which will be used as tunnel endpoint. This address must be from associated Transit Gateway CIDR block. The address must be from the same address family as `peer_address`. If not set explicitly, it will be selected from associated Transit Gateway CIDR blocks
 * `transit_gateway_attachment_id` - (Required) The Transit Gateway Connect
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - EC2 Transit Gateway Connect Peer identifier
 * `arn` - EC2 Transit Gateway Connect Peer ARN
+* `bgp_peer_address` - The IP address assigned to customer device, which is used as BGP IP address.
+* `bgp_transit_gateway_addresses` - The IP addresses assigned to Transit Gateway, which are used as BGP IP addresses.
 * `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
 
 ## Timeouts
@@ -53,10 +71,21 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_ec2_transit_gateway_connect_peer` can be imported by using the EC2 Transit Gateway Connect Peer identifier, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_ec2_transit_gateway_connect_peer` using the EC2 Transit Gateway Connect Peer identifier. For example:
 
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
 ```
-$ terraform import aws_ec2_transit_gateway_connect_peer.example tgw-connect-peer-12345678
+
+Using `terraform import`, import `aws_ec2_transit_gateway_connect_peer` using the EC2 Transit Gateway Connect Peer identifier. For example:
+
+```console
+% terraform import aws_ec2_transit_gateway_connect_peer.example tgw-connect-peer-12345678
 ```
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-1f5256822c622c77c21ea6bcc2a5888752a92236b8b89351636b84119799598d -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-d6fe2e495100d4a7884cb0832674c4c28b10dc1276e47184967c743d1b05aec4 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ec2_transit_gateway_multicast_domain.html.markdown b/website/docs/cdktf/python/r/ec2_transit_gateway_multicast_domain.html.markdown
index 93bb146aed9..071b9e281b6 100644
--- a/website/docs/cdktf/python/r/ec2_transit_gateway_multicast_domain.html.markdown
+++ b/website/docs/cdktf/python/r/ec2_transit_gateway_multicast_domain.html.markdown
@@ -6,6 +6,8 @@ description: |-
   Manages an EC2 Transit Gateway Multicast Domain
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Resource: aws_ec2_transit_gateway_multicast_domain
 
 Manages an EC2 Transit Gateway Multicast Domain.
@@ -13,32 +15,44 @@ Manages an EC2 Transit Gateway Multicast Domain.
 ## Example Usage
 
 ```python
-import constructs as constructs
-import cdktf as cdktf
-# Provider bindings are generated by running cdktf get.
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
 # See https://cdk.tf/provider-generation for more details.
-import ...gen.providers.aws as aws
-class MyConvertedCode(cdktf.TerraformStack):
+#
+from imports.aws.data_aws_ami import DataAwsAmi
+from imports.aws.data_aws_availability_zones import DataAwsAvailabilityZones
+from imports.aws.ec2_transit_gateway import Ec2TransitGateway
+from imports.aws.ec2_transit_gateway_multicast_domain import Ec2TransitGatewayMulticastDomain
+from imports.aws.ec2_transit_gateway_multicast_domain_association import Ec2TransitGatewayMulticastDomainAssociation
+from imports.aws.ec2_transit_gateway_multicast_group_member import Ec2TransitGatewayMulticastGroupMember
+from imports.aws.ec2_transit_gateway_multicast_group_source import Ec2TransitGatewayMulticastGroupSource
+from imports.aws.ec2_transit_gateway_vpc_attachment import Ec2TransitGatewayVpcAttachment
+from imports.aws.instance import Instance
+from imports.aws.subnet import Subnet
+from imports.aws.vpc import Vpc
+class MyConvertedCode(TerraformStack):
     def __init__(self, scope, name):
         super().__init__(scope, name)
-        aws_ec2_transit_gateway_tgw = aws.ec2_transit_gateway.Ec2TransitGateway(self, "tgw",
+        tgw = Ec2TransitGateway(self, "tgw",
             multicast_support="enable"
         )
-        aws_ec2_transit_gateway_multicast_domain_domain =
-        aws.ec2_transit_gateway_multicast_domain.Ec2TransitGatewayMulticastDomain(self, "domain",
+        domain = Ec2TransitGatewayMulticastDomain(self, "domain",
             static_sources_support="enable",
             tags={
                 "Name": "Transit_Gateway_Multicast_Domain_Example"
             },
-            transit_gateway_id=cdktf.Token.as_string(aws_ec2_transit_gateway_tgw.id)
+            transit_gateway_id=tgw.id
         )
-        aws_vpc_vpc1 = aws.vpc.Vpc(self, "vpc1",
+        vpc1 = Vpc(self, "vpc1",
             cidr_block="10.0.0.0/16"
         )
-        aws_vpc_vpc2 = aws.vpc.Vpc(self, "vpc2",
+        vpc2 = Vpc(self, "vpc2",
             cidr_block="10.1.0.0/16"
         )
-        data_aws_ami_amazon_linux = aws.data_aws_ami.DataAwsAmi(self, "amazon_linux",
+        amazon_linux = DataAwsAmi(self, "amazon_linux",
             filter=[DataAwsAmiFilter(
                 name="name",
                 values=["amzn-ami-hvm-*-x86_64-gp2"]
@@ -50,95 +64,84 @@ class MyConvertedCode(cdktf.TerraformStack):
             most_recent=True,
             owners=["amazon"]
         )
-        data_aws_availability_zones_available =
-        aws.data_aws_availability_zones.DataAwsAvailabilityZones(self, "available",
+        available = DataAwsAvailabilityZones(self, "available",
             state="available"
         )
-        aws_subnet_subnet1 = aws.subnet.Subnet(self, "subnet1",
-            availability_zone=cdktf.Token.as_string(
-                cdktf.property_access(data_aws_availability_zones_available.names, ["0"])),
+        subnet1 = Subnet(self, "subnet1",
+            availability_zone=Token.as_string(Fn.lookup_nested(available.names, ["0"])),
             cidr_block="10.0.1.0/24",
-            vpc_id=cdktf.Token.as_string(aws_vpc_vpc1.id)
+            vpc_id=vpc1.id
         )
-        aws_subnet_subnet2 = aws.subnet.Subnet(self, "subnet2",
-            availability_zone=cdktf.Token.as_string(
-                cdktf.property_access(data_aws_availability_zones_available.names, ["1"])),
+        subnet2 = Subnet(self, "subnet2",
+            availability_zone=Token.as_string(Fn.lookup_nested(available.names, ["1"])),
             cidr_block="10.0.2.0/24",
-            vpc_id=cdktf.Token.as_string(aws_vpc_vpc1.id)
+            vpc_id=vpc1.id
         )
-        aws_subnet_subnet3 = aws.subnet.Subnet(self, "subnet3",
-            availability_zone=cdktf.Token.as_string(
-                cdktf.property_access(data_aws_availability_zones_available.names, ["0"])),
+        subnet3 = Subnet(self, "subnet3",
+            availability_zone=Token.as_string(Fn.lookup_nested(available.names, ["0"])),
             cidr_block="10.1.1.0/24",
-            vpc_id=cdktf.Token.as_string(aws_vpc_vpc2.id)
+            vpc_id=vpc2.id
         )
-        aws_ec2_transit_gateway_vpc_attachment_attachment1 =
-        aws.ec2_transit_gateway_vpc_attachment.Ec2TransitGatewayVpcAttachment(self, "attachment1",
-            subnet_ids=[
-                cdktf.Token.as_string(aws_subnet_subnet1.id),
-                cdktf.Token.as_string(aws_subnet_subnet2.id)
-            ],
-            transit_gateway_id=cdktf.Token.as_string(aws_ec2_transit_gateway_tgw.id),
-            vpc_id=cdktf.Token.as_string(aws_vpc_vpc1.id)
+        attachment1 = Ec2TransitGatewayVpcAttachment(self, "attachment1",
+            subnet_ids=[subnet1.id, subnet2.id],
+            transit_gateway_id=tgw.id,
+            vpc_id=vpc1.id
         )
-        aws_ec2_transit_gateway_vpc_attachment_attachment2 =
-        aws.ec2_transit_gateway_vpc_attachment.Ec2TransitGatewayVpcAttachment(self, "attachment2",
-            subnet_ids=[cdktf.Token.as_string(aws_subnet_subnet3.id)],
-            transit_gateway_id=cdktf.Token.as_string(aws_ec2_transit_gateway_tgw.id),
-            vpc_id=cdktf.Token.as_string(aws_vpc_vpc2.id)
+        attachment2 = Ec2TransitGatewayVpcAttachment(self, "attachment2",
+            subnet_ids=[subnet3.id],
+            transit_gateway_id=tgw.id,
+            vpc_id=vpc2.id
         )
-        aws_instance_instance1 = aws.instance.Instance(self, "instance1",
-            ami=cdktf.Token.as_string(data_aws_ami_amazon_linux.id),
+        instance1 = Instance(self, "instance1",
+            ami=Token.as_string(amazon_linux.id),
             instance_type="t2.micro",
-            subnet_id=cdktf.Token.as_string(aws_subnet_subnet1.id)
+            subnet_id=subnet1.id
         )
-        aws_instance_instance2 = aws.instance.Instance(self, "instance2",
-            ami=cdktf.Token.as_string(data_aws_ami_amazon_linux.id),
+        instance2 = Instance(self, "instance2",
+            ami=Token.as_string(amazon_linux.id),
             instance_type="t2.micro",
-            subnet_id=cdktf.Token.as_string(aws_subnet_subnet2.id)
+            subnet_id=subnet2.id
         )
-        aws_instance_instance3 = aws.instance.Instance(self, "instance3",
-            ami=cdktf.Token.as_string(data_aws_ami_amazon_linux.id),
+        instance3 = Instance(self, "instance3",
+            ami=Token.as_string(amazon_linux.id),
             instance_type="t2.micro",
-            subnet_id=cdktf.Token.as_string(aws_subnet_subnet3.id)
-        )
-        aws_ec2_transit_gateway_multicast_domain_association_association1 =
-        aws.ec2_transit_gateway_multicast_domain_association.Ec2TransitGatewayMulticastDomainAssociation(self, "association1",
-            subnet_id=cdktf.Token.as_string(aws_subnet_subnet1.id),
-            transit_gateway_attachment_id=cdktf.Token.as_string(aws_ec2_transit_gateway_vpc_attachment_attachment1.id),
-            transit_gateway_multicast_domain_id=cdktf.Token.as_string(aws_ec2_transit_gateway_multicast_domain_domain.id)
-        )
-        aws.ec2_transit_gateway_multicast_domain_association.Ec2TransitGatewayMulticastDomainAssociation(self, "association2",
-            subnet_id=cdktf.Token.as_string(aws_subnet_subnet2.id),
-            transit_gateway_attachment_id=cdktf.Token.as_string(aws_ec2_transit_gateway_vpc_attachment_attachment2.id),
-            transit_gateway_multicast_domain_id=cdktf.Token.as_string(aws_ec2_transit_gateway_multicast_domain_domain.id)
-        )
-        aws_ec2_transit_gateway_multicast_domain_association_association3 =
-        aws.ec2_transit_gateway_multicast_domain_association.Ec2TransitGatewayMulticastDomainAssociation(self, "association3",
-            subnet_id=cdktf.Token.as_string(aws_subnet_subnet3.id),
-            transit_gateway_attachment_id=cdktf.Token.as_string(aws_ec2_transit_gateway_vpc_attachment_attachment2.id),
-            transit_gateway_multicast_domain_id=cdktf.Token.as_string(aws_ec2_transit_gateway_multicast_domain_domain.id)
-        )
-        aws.ec2_transit_gateway_multicast_group_member.Ec2TransitGatewayMulticastGroupMember(self, "member1",
+            subnet_id=subnet3.id
+        )
+        association1 = Ec2TransitGatewayMulticastDomainAssociation(self, "association1",
+            subnet_id=subnet1.id,
+            transit_gateway_attachment_id=attachment1.id,
+            transit_gateway_multicast_domain_id=domain.id
+        )
+        Ec2TransitGatewayMulticastDomainAssociation(self, "association2",
+            subnet_id=subnet2.id,
+            transit_gateway_attachment_id=attachment2.id,
+            transit_gateway_multicast_domain_id=domain.id
+        )
+        association3 = Ec2TransitGatewayMulticastDomainAssociation(self, "association3",
+            subnet_id=subnet3.id,
+            transit_gateway_attachment_id=attachment2.id,
+            transit_gateway_multicast_domain_id=domain.id
+        )
+        Ec2TransitGatewayMulticastGroupMember(self, "member1",
             group_ip_address="224.0.0.1",
-            network_interface_id=cdktf.Token.as_string(aws_instance_instance1.primary_network_interface_id),
-            transit_gateway_multicast_domain_id=cdktf.Token.as_string(aws_ec2_transit_gateway_multicast_domain_association_association1.transit_gateway_multicast_domain_id)
+            network_interface_id=instance1.primary_network_interface_id,
+            transit_gateway_multicast_domain_id=association1.transit_gateway_multicast_domain_id
         )
-        aws.ec2_transit_gateway_multicast_group_member.Ec2TransitGatewayMulticastGroupMember(self, "member2",
+        Ec2TransitGatewayMulticastGroupMember(self, "member2",
             group_ip_address="224.0.0.1",
-            network_interface_id=cdktf.Token.as_string(aws_instance_instance2.primary_network_interface_id),
-            transit_gateway_multicast_domain_id=cdktf.Token.as_string(aws_ec2_transit_gateway_multicast_domain_association_association1.transit_gateway_multicast_domain_id)
+            network_interface_id=instance2.primary_network_interface_id,
+            transit_gateway_multicast_domain_id=association1.transit_gateway_multicast_domain_id
         )
-        aws.ec2_transit_gateway_multicast_group_source.Ec2TransitGatewayMulticastGroupSource(self, "source",
+        Ec2TransitGatewayMulticastGroupSource(self, "source",
             group_ip_address="224.0.0.1",
-            network_interface_id=cdktf.Token.as_string(aws_instance_instance3.primary_network_interface_id),
-            transit_gateway_multicast_domain_id=cdktf.Token.as_string(aws_ec2_transit_gateway_multicast_domain_association_association3.transit_gateway_multicast_domain_id)
+            network_interface_id=instance3.primary_network_interface_id,
+            transit_gateway_multicast_domain_id=association3.transit_gateway_multicast_domain_id
         )
 ```
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `transit_gateway_id` - (Required) EC2 Transit Gateway identifier. The EC2 Transit Gateway must have `multicast_support` enabled.
 * `auto_accept_shared_associations` - (Optional) Whether to automatically accept cross-account subnet associations that are associated with the EC2 Transit Gateway Multicast Domain. Valid values: `disable`, `enable`. Default value: `disable`.
@@ -146,9 +149,9 @@ The following arguments are supported:
 * `static_sources_support` - (Optional) Whether to enable support for statically configuring multicast group sources for the EC2 Transit Gateway Multicast Domain. Valid values: `disable`, `enable`. Default value: `disable`.
 * `tags` - (Optional) Key-value tags for the EC2 Transit Gateway Multicast Domain. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - EC2 Transit Gateway Multicast Domain identifier.
 * `arn` - EC2 Transit Gateway Multicast Domain Amazon Resource Name (ARN).
@@ -164,10 +167,21 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_ec2_transit_gateway_multicast_domain` can be imported by using the EC2 Transit Gateway Multicast Domain identifier, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_ec2_transit_gateway_multicast_domain` using the EC2 Transit Gateway Multicast Domain identifier. For example:
 
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
 ```
-terraform import aws_ec2_transit_gateway_multicast_domain.example tgw-mcast-domain-12345
+
+Using `terraform import`, import `aws_ec2_transit_gateway_multicast_domain` using the EC2 Transit Gateway Multicast Domain identifier. For example:
+
+```console
+% terraform import aws_ec2_transit_gateway_multicast_domain.example tgw-mcast-domain-12345
 ```
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-af570cc56449ad3f3c4b5a829709b1b5977e549ce5e66e168ab6e20788f81ed8 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-8493dfab227c918d9b3e4e208962affb97781a33e5cd93321c066ab973c7252b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ec2_transit_gateway_multicast_domain_association.html.markdown b/website/docs/cdktf/python/r/ec2_transit_gateway_multicast_domain_association.html.markdown
index 6a56a74beee..07739759707 100644
--- a/website/docs/cdktf/python/r/ec2_transit_gateway_multicast_domain_association.html.markdown
+++ b/website/docs/cdktf/python/r/ec2_transit_gateway_multicast_domain_association.html.markdown
@@ -6,45 +6,67 @@ description: |-
   Manages an EC2 Transit Gateway Multicast Domain Association
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Resource: aws_ec2_transit_gateway_multicast_domain_association
 
 Associates the specified subnet and transit gateway attachment with the specified transit gateway multicast domain.
 
 ## Example Usage
 
-```terraform
-resource "aws_ec2_transit_gateway" "example" {
-  multicast_support = "enable"
-}
-
-resource "aws_ec2_transit_gateway_vpc_attachment" "example" {
-  subnet_ids         = [aws_subnet.example.id]
-  transit_gateway_id = aws_ec2_transit_gateway.example.id
-  vpc_id             = aws_vpc.example.id
-}
-
-resource "aws_ec2_transit_gateway_multicast_domain" "example" {
-  transit_gateway_id = aws_ec2_transit_gateway.example.id
-}
-
-resource "aws_ec2_transit_gateway_multicast_domain_association" "example" {
-  subnet_id                           = aws_subnet.example.id
-  transit_gateway_attachment_id       = aws_ec2_transit_gateway_vpc_attachment.example.id
-  transit_gateway_multicast_domain_id = aws_ec2_transit_gateway_multicast_domain.example.id
-}
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ec2_transit_gateway import Ec2TransitGateway
+from imports.aws.ec2_transit_gateway_multicast_domain import Ec2TransitGatewayMulticastDomain
+from imports.aws.ec2_transit_gateway_multicast_domain_association import Ec2TransitGatewayMulticastDomainAssociation
+from imports.aws.ec2_transit_gateway_vpc_attachment import Ec2TransitGatewayVpcAttachment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = Ec2TransitGateway(self, "example",
+            multicast_support="enable"
+        )
+        aws_ec2_transit_gateway_multicast_domain_example =
+        Ec2TransitGatewayMulticastDomain(self, "example_1",
+            transit_gateway_id=example.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_ec2_transit_gateway_multicast_domain_example.override_logical_id("example")
+        aws_ec2_transit_gateway_vpc_attachment_example =
+        Ec2TransitGatewayVpcAttachment(self, "example_2",
+            subnet_ids=[Token.as_string(aws_subnet_example.id)],
+            transit_gateway_id=example.id,
+            vpc_id=Token.as_string(aws_vpc_example.id)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_ec2_transit_gateway_vpc_attachment_example.override_logical_id("example")
+        aws_ec2_transit_gateway_multicast_domain_association_example =
+        Ec2TransitGatewayMulticastDomainAssociation(self, "example_3",
+            subnet_id=Token.as_string(aws_subnet_example.id),
+            transit_gateway_attachment_id=Token.as_string(aws_ec2_transit_gateway_vpc_attachment_example.id),
+            transit_gateway_multicast_domain_id=Token.as_string(aws_ec2_transit_gateway_multicast_domain_example.id)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_ec2_transit_gateway_multicast_domain_association_example.override_logical_id("example")
 ```
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `subnet_id` - (Required) The ID of the subnet to associate with the transit gateway multicast domain.
 * `transit_gateway_attachment_id` - (Required) The ID of the transit gateway attachment.
 * `transit_gateway_multicast_domain_id` - (Required) The ID of the transit gateway multicast domain.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - EC2 Transit Gateway Multicast Domain Association identifier.
 
@@ -55,4 +77,4 @@ In addition to all arguments above, the following attributes are exported:
 - `create` - (Default `10m`)
 - `delete` - (Default `10m`)
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-0aab754cf2f3ec5b55918c480d40a25c05ca4acac47f8f8d44dabc61eeb6bf26 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-6c4de69f84e7a9ddb2ed6ce4cfadb8fa72c50ebf1d30ec7a4dc0c8b0330dd7d7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ec2_transit_gateway_multicast_group_member.html.markdown b/website/docs/cdktf/python/r/ec2_transit_gateway_multicast_group_member.html.markdown
index f2dd0248c9b..17a4232dd54 100644
--- a/website/docs/cdktf/python/r/ec2_transit_gateway_multicast_group_member.html.markdown
+++ b/website/docs/cdktf/python/r/ec2_transit_gateway_multicast_group_member.html.markdown
@@ -6,6 +6,8 @@ description: |-
   Manages an EC2 Transit Gateway Multicast Group Member
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Resource: aws_ec2_transit_gateway_multicast_group_member
 
 Registers members (network interfaces) with the transit gateway multicast group.
@@ -13,26 +15,37 @@ A member is a network interface associated with a supported EC2 instance that re
 
 ## Example Usage
 
-```terraform
-resource "aws_ec2_transit_gateway_multicast_group_member" "example" {
-  group_ip_address                    = "224.0.0.1"
-  network_interface_id                = aws_network_interface.example.id
-  transit_gateway_multicast_domain_id = aws_ec2_transit_gateway_multicast_domain.example.id
-}
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ec2_transit_gateway_multicast_group_member import Ec2TransitGatewayMulticastGroupMember
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Ec2TransitGatewayMulticastGroupMember(self, "example",
+            group_ip_address="224.0.0.1",
+            network_interface_id=Token.as_string(aws_network_interface_example.id),
+            transit_gateway_multicast_domain_id=Token.as_string(aws_ec2_transit_gateway_multicast_domain_example.id)
+        )
 ```
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `group_ip_address` - (Required) The IP address assigned to the transit gateway multicast group.
 * `network_interface_id` - (Required) The group members' network interface ID to register with the transit gateway multicast group.
 * `transit_gateway_multicast_domain_id` - (Required) The ID of the transit gateway multicast domain.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - EC2 Transit Gateway Multicast Group Member identifier.
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-286c39b2f59b7534bbe97baf79dd0b9741f58e4a81a46b026a37ff2930718d60 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-91bef72daade97f93eac61bbc5f6341295847aeaaf5638e91668e61f2b73e95f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ec2_transit_gateway_multicast_group_source.html.markdown b/website/docs/cdktf/python/r/ec2_transit_gateway_multicast_group_source.html.markdown
index 41d11afb87f..acc1509b323 100644
--- a/website/docs/cdktf/python/r/ec2_transit_gateway_multicast_group_source.html.markdown
+++ b/website/docs/cdktf/python/r/ec2_transit_gateway_multicast_group_source.html.markdown
@@ -6,6 +6,8 @@ description: |-
   Manages an EC2 Transit Gateway Multicast Group Source
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Resource: aws_ec2_transit_gateway_multicast_group_source
 
 Registers sources (network interfaces) with the transit gateway multicast group.
@@ -13,26 +15,37 @@ A multicast source is a network interface attached to a supported instance that
 
 ## Example Usage
 
-```terraform
-resource "aws_ec2_transit_gateway_multicast_group_source" "example" {
-  group_ip_address                    = "224.0.0.1"
-  network_interface_id                = aws_network_interface.example.id
-  transit_gateway_multicast_domain_id = aws_ec2_transit_gateway_multicast_domain.example.id
-}
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ec2_transit_gateway_multicast_group_source import Ec2TransitGatewayMulticastGroupSource
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Ec2TransitGatewayMulticastGroupSource(self, "example",
+            group_ip_address="224.0.0.1",
+            network_interface_id=Token.as_string(aws_network_interface_example.id),
+            transit_gateway_multicast_domain_id=Token.as_string(aws_ec2_transit_gateway_multicast_domain_example.id)
+        )
 ```
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `group_ip_address` - (Required) The IP address assigned to the transit gateway multicast group.
 * `network_interface_id` - (Required) The group members' network interface ID to register with the transit gateway multicast group.
 * `transit_gateway_multicast_domain_id` - (Required) The ID of the transit gateway multicast domain.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - EC2 Transit Gateway Multicast Group Member identifier.
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-65215e11717df1869097637d2ac9989417c165158f1d4b33781b1f0782026494 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-561db583d91352dec7ba040b0abbb86f30bfd413562c455a18fa76289ce3489f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ec2_transit_gateway_peering_attachment.html.markdown b/website/docs/cdktf/python/r/ec2_transit_gateway_peering_attachment.html.markdown
index 1bbcb3b3a96..26ea83dfa45 100644
--- a/website/docs/cdktf/python/r/ec2_transit_gateway_peering_attachment.html.markdown
+++ b/website/docs/cdktf/python/r/ec2_transit_gateway_peering_attachment.html.markdown
@@ -6,6 +6,8 @@ description: |-
   Manages an EC2 Transit Gateway Peering Attachment
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Resource: aws_ec2_transit_gateway_peering_attachment
 
 Manages an EC2 Transit Gateway Peering Attachment.
@@ -14,49 +16,53 @@ For examples of custom route table association and propagation, see the [EC2 Tra
 ## Example Usage
 
 ```python
-import constructs as constructs
-import cdktf as cdktf
-# Provider bindings are generated by running cdktf get.
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
 # See https://cdk.tf/provider-generation for more details.
-import ...gen.providers.aws as aws
-class MyConvertedCode(cdktf.TerraformStack):
+#
+from imports.aws.data_aws_region import DataAwsRegion
+from imports.aws.ec2_transit_gateway import Ec2TransitGateway
+from imports.aws.ec2_transit_gateway_peering_attachment import Ec2TransitGatewayPeeringAttachment
+from imports.aws.provider import AwsProvider
+class MyConvertedCode(TerraformStack):
     def __init__(self, scope, name):
         super().__init__(scope, name)
-        aws_local = aws.provider.AwsProvider(self, "aws",
+        local = AwsProvider(self, "aws",
             alias="local",
             region="us-east-1"
         )
-        aws_peer = aws.provider.AwsProvider(self, "aws_1",
+        peer = AwsProvider(self, "aws_1",
             alias="peer",
             region="us-west-2"
         )
-        aws_ec2_transit_gateway_local =
-        aws.ec2_transit_gateway.Ec2TransitGateway(self, "local",
-            provider=aws_local,
+        aws_ec2_transit_gateway_local = Ec2TransitGateway(self, "local",
+            provider=local,
             tags={
                 "Name": "Local TGW"
             }
         )
-        aws_ec2_transit_gateway_peer =
-        aws.ec2_transit_gateway.Ec2TransitGateway(self, "peer",
-            provider=aws_peer,
+        aws_ec2_transit_gateway_peer = Ec2TransitGateway(self, "peer",
+            provider=peer,
             tags={
                 "Name": "Peer TGW"
             }
         )
-        data_aws_region_peer = aws.data_aws_region.DataAwsRegion(self, "peer_4",
-            provider=aws_peer
+        data_aws_region_peer = DataAwsRegion(self, "peer_4",
+            provider=peer
         )
         # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
         data_aws_region_peer.override_logical_id("peer")
-        aws.ec2_transit_gateway_peering_attachment.Ec2TransitGatewayPeeringAttachment(self, "example",
-            peer_account_id=cdktf.Token.as_string(aws_ec2_transit_gateway_peer.owner_id),
-            peer_region=cdktf.Token.as_string(data_aws_region_peer.name),
-            peer_transit_gateway_id=cdktf.Token.as_string(aws_ec2_transit_gateway_peer.id),
+        Ec2TransitGatewayPeeringAttachment(self, "example",
+            peer_account_id=Token.as_string(aws_ec2_transit_gateway_peer.owner_id),
+            peer_region=Token.as_string(data_aws_region_peer.name),
+            peer_transit_gateway_id=Token.as_string(aws_ec2_transit_gateway_peer.id),
             tags={
                 "Name": "TGW Peering Requestor"
             },
-            transit_gateway_id=cdktf.Token.as_string(aws_ec2_transit_gateway_local.id)
+            transit_gateway_id=Token.as_string(aws_ec2_transit_gateway_local.id)
         )
 ```
 
@@ -64,7 +70,7 @@ A full example of how to create a Transit Gateway in one AWS account, share it w
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `peer_account_id` - (Optional) Account ID of EC2 Transit Gateway to peer with. Defaults to the account ID the [AWS provider][1] is currently connected to.
 * `peer_region` - (Required) Region of EC2 Transit Gateway to peer with.
@@ -72,21 +78,32 @@ The following arguments are supported:
 * `tags` - (Optional) Key-value tags for the EC2 Transit Gateway Peering Attachment. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 * `transit_gateway_id` - (Required) Identifier of EC2 Transit Gateway.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - EC2 Transit Gateway Attachment identifier
 * `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
 
 ## Import
 
-`aws_ec2_transit_gateway_peering_attachment` can be imported by using the EC2 Transit Gateway Attachment identifier, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_ec2_transit_gateway_peering_attachment` using the EC2 Transit Gateway Attachment identifier. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_ec2_transit_gateway_peering_attachment` using the EC2 Transit Gateway Attachment identifier. For example:
 
-```sh
-terraform import aws_ec2_transit_gateway_peering_attachment.example tgw-attach-12345678
+```console
+% terraform import aws_ec2_transit_gateway_peering_attachment.example tgw-attach-12345678
 ```
 
 [1]: /docs/providers/aws/index.html
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-5e6980d31532832aa0ca35b8561fc1b7da555248123d68a53651ee6e3c1bfee2 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-58f6c9437a7c95b8df5161dbac8476475147b7788b6b5351cb7f1a812d59aa51 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ec2_transit_gateway_peering_attachment_accepter.html.markdown b/website/docs/cdktf/python/r/ec2_transit_gateway_peering_attachment_accepter.html.markdown
index f09ba0dea8f..a7adb3ca472 100644
--- a/website/docs/cdktf/python/r/ec2_transit_gateway_peering_attachment_accepter.html.markdown
+++ b/website/docs/cdktf/python/r/ec2_transit_gateway_peering_attachment_accepter.html.markdown
@@ -6,34 +6,46 @@ description: |-
   Manages the accepter's side of an EC2 Transit Gateway peering Attachment
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Resource: aws_ec2_transit_gateway_peering_attachment_accepter
 
 Manages the accepter's side of an EC2 Transit Gateway Peering Attachment.
 
 ## Example Usage
 
-```terraform
-resource "aws_ec2_transit_gateway_peering_attachment_accepter" "example" {
-  transit_gateway_attachment_id = aws_ec2_transit_gateway_peering_attachment.example.id
-
-  tags = {
-    Name = "Example cross-account attachment"
-  }
-}
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ec2_transit_gateway_peering_attachment_accepter import Ec2TransitGatewayPeeringAttachmentAccepter
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Ec2TransitGatewayPeeringAttachmentAccepter(self, "example",
+            tags={
+                "Name": "Example cross-account attachment"
+            },
+            transit_gateway_attachment_id=Token.as_string(aws_ec2_transit_gateway_peering_attachment_example.id)
+        )
 ```
 
 A full example of how to create a Transit Gateway in one AWS account, share it with a second AWS account, and attach a to a Transit Gateway in the second account via the `aws_ec2_transit_gateway_peering_attachment` resource can be found in [the `./examples/transit-gateway-cross-account-peering-attachment` directory within the Github Repository](https://github.com/hashicorp/terraform-provider-aws/tree/main/examples/transit-gateway-cross-account-peering-attachment).
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `transit_gateway_attachment_id` - (Required) The ID of the EC2 Transit Gateway Peering Attachment to manage.
 * `tags` - (Optional) Key-value tags for the EC2 Transit Gateway Peering Attachment. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - EC2 Transit Gateway Attachment identifier
 * `transit_gateway_id` - Identifier of EC2 Transit Gateway.
@@ -43,10 +55,21 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_ec2_transit_gateway_peering_attachment_accepter` can be imported by using the EC2 Transit Gateway Attachment identifier, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_ec2_transit_gateway_peering_attachment_accepter` using the EC2 Transit Gateway Attachment identifier. For example:
 
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
 ```
-$ terraform import aws_ec2_transit_gateway_peering_attachment_accepter.example tgw-attach-12345678
+
+Using `terraform import`, import `aws_ec2_transit_gateway_peering_attachment_accepter` using the EC2 Transit Gateway Attachment identifier. For example:
+
+```console
+% terraform import aws_ec2_transit_gateway_peering_attachment_accepter.example tgw-attach-12345678
 ```
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-fab6deae8f43bceb887eb6da8d66bf91ec6984a573d451705f72d107809f5a68 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-6f990861cdea5515b1adb7416bea698b8254af1069c30ac70cdb56d2891f29e4 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ec2_transit_gateway_policy_table.html.markdown b/website/docs/cdktf/python/r/ec2_transit_gateway_policy_table.html.markdown
index dc9ab805bca..3ae9b7fb859 100644
--- a/website/docs/cdktf/python/r/ec2_transit_gateway_policy_table.html.markdown
+++ b/website/docs/cdktf/python/r/ec2_transit_gateway_policy_table.html.markdown
@@ -6,32 +6,44 @@ description: |-
   Manages an EC2 Transit Gateway Policy Table
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Resource: aws_ec2_transit_gateway_policy_table
 
 Manages an EC2 Transit Gateway Policy Table.
 
 ## Example Usage
 
-```terraform
-resource "aws_ec2_transit_gateway_policy_table" "example" {
-  transit_gateway_id = aws_ec2_transit_gateway.example.id
-
-  tags = {
-    Name = "Example Policy Table"
-  }
-}
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ec2_transit_gateway_policy_table import Ec2TransitGatewayPolicyTable
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Ec2TransitGatewayPolicyTable(self, "example",
+            tags={
+                "Name": "Example Policy Table"
+            },
+            transit_gateway_id=Token.as_string(aws_ec2_transit_gateway_example.id)
+        )
 ```
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `transit_gateway_id` - (Required) EC2 Transit Gateway identifier.
 * `tags` - (Optional) Key-value tags for the EC2 Transit Gateway Policy Table. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - EC2 Transit Gateway Policy Table Amazon Resource Name (ARN).
 * `id` - EC2 Transit Gateway Policy Table identifier.
@@ -40,10 +52,21 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_ec2_transit_gateway_policy_table` can be imported by using the EC2 Transit Gateway Policy Table identifier, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_ec2_transit_gateway_policy_table` using the EC2 Transit Gateway Policy Table identifier. For example:
 
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
 ```
-$ terraform import aws_ec2_transit_gateway_policy_table.example tgw-rtb-12345678
+
+Using `terraform import`, import `aws_ec2_transit_gateway_policy_table` using the EC2 Transit Gateway Policy Table identifier. For example:
+
+```console
+% terraform import aws_ec2_transit_gateway_policy_table.example tgw-rtb-12345678
 ```
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-6200610860d8045f7e9f0172434a88391558b460f129907e25f4790f7bb77806 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-74a9f90cb0d2a1a3f4d315939168fb889955b8d8ab3822d27c7d6149af4bd379 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ec2_transit_gateway_policy_table_association.html.markdown b/website/docs/cdktf/python/r/ec2_transit_gateway_policy_table_association.html.markdown
index ecf06015b0d..57c0c5bd63b 100644
--- a/website/docs/cdktf/python/r/ec2_transit_gateway_policy_table_association.html.markdown
+++ b/website/docs/cdktf/python/r/ec2_transit_gateway_policy_table_association.html.markdown
@@ -6,29 +6,42 @@ description: |-
   Manages an EC2 Transit Gateway Policy Table association
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Resource: aws_ec2_transit_gateway_policy_table_association
 
 Manages an EC2 Transit Gateway Policy Table association.
 
 ## Example Usage
 
-```terraform
-resource "aws_ec2_transit_gateway_policy_table_association" "example" {
-  transit_gateway_attachment_id   = aws_networkmanager_transit_gateway_peering.example.transit_gateway_peering_attachment_id
-  transit_gateway_policy_table_id = aws_ec2_transit_gateway_policy_table.example.id
-}
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ec2_transit_gateway_policy_table_association import Ec2TransitGatewayPolicyTableAssociation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Ec2TransitGatewayPolicyTableAssociation(self, "example",
+            transit_gateway_attachment_id=Token.as_string(aws_networkmanager_transit_gateway_peering_example.transit_gateway_peering_attachment_id),
+            transit_gateway_policy_table_id=Token.as_string(aws_ec2_transit_gateway_policy_table_example.id)
+        )
 ```
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `transit_gateway_attachment_id` - (Required) Identifier of EC2 Transit Gateway Attachment.
 * `transit_gateway_policy_table_id` - (Required) Identifier of EC2 Transit Gateway Policy Table.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - EC2 Transit Gateway Policy Table identifier combined with EC2 Transit Gateway Attachment identifier
 * `resource_id` - Identifier of the resource
@@ -36,10 +49,21 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_ec2_transit_gateway_policy_table_association` can be imported by using the EC2 Transit Gateway Policy Table identifier, an underscore, and the EC2 Transit Gateway Attachment identifier, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_ec2_transit_gateway_policy_table_association` using the EC2 Transit Gateway Policy Table identifier, an underscore, and the EC2 Transit Gateway Attachment identifier. For example:
 
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
 ```
-$ terraform import aws_ec2_transit_gateway_policy_table_association.example tgw-rtb-12345678_tgw-attach-87654321
+
+Using `terraform import`, import `aws_ec2_transit_gateway_policy_table_association` using the EC2 Transit Gateway Policy Table identifier, an underscore, and the EC2 Transit Gateway Attachment identifier. For example:
+
+```console
+% terraform import aws_ec2_transit_gateway_policy_table_association.example tgw-rtb-12345678_tgw-attach-87654321
 ```
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-71380ed0eec27922255ea166a66458c5cd56cb198475d01b1f355b8ed09e3323 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-fb6c9a474c21becbfa7750b9e0ef6a384a8f2e3673c394bf8ae8f12a2b132f7b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ec2_transit_gateway_prefix_list_reference.html.markdown b/website/docs/cdktf/python/r/ec2_transit_gateway_prefix_list_reference.html.markdown
index 6dcdfb21f4f..8122aeeb0bc 100644
--- a/website/docs/cdktf/python/r/ec2_transit_gateway_prefix_list_reference.html.markdown
+++ b/website/docs/cdktf/python/r/ec2_transit_gateway_prefix_list_reference.html.markdown
@@ -6,6 +6,8 @@ description: |-
   Manages an EC2 Transit Gateway Prefix List Reference
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Resource: aws_ec2_transit_gateway_prefix_list_reference
 
 Manages an EC2 Transit Gateway Prefix List Reference.
@@ -14,22 +16,44 @@ Manages an EC2 Transit Gateway Prefix List Reference.
 
 ### Attachment Routing
 
-```terraform
-resource "aws_ec2_transit_gateway_prefix_list_reference" "example" {
-  prefix_list_id                 = aws_ec2_managed_prefix_list.example.id
-  transit_gateway_attachment_id  = aws_ec2_transit_gateway_vpc_attachment.example.id
-  transit_gateway_route_table_id = aws_ec2_transit_gateway.example.association_default_route_table_id
-}
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ec2_transit_gateway_prefix_list_reference import Ec2TransitGatewayPrefixListReference
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Ec2TransitGatewayPrefixListReference(self, "example",
+            prefix_list_id=Token.as_string(aws_ec2_managed_prefix_list_example.id),
+            transit_gateway_attachment_id=Token.as_string(aws_ec2_transit_gateway_vpc_attachment_example.id),
+            transit_gateway_route_table_id=Token.as_string(aws_ec2_transit_gateway_example.association_default_route_table_id)
+        )
 ```
 
 ### Blackhole Routing
 
-```terraform
-resource "aws_ec2_transit_gateway_prefix_list_reference" "example" {
-  blackhole                      = true
-  prefix_list_id                 = aws_ec2_managed_prefix_list.example.id
-  transit_gateway_route_table_id = aws_ec2_transit_gateway.example.association_default_route_table_id
-}
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ec2_transit_gateway_prefix_list_reference import Ec2TransitGatewayPrefixListReference
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Ec2TransitGatewayPrefixListReference(self, "example",
+            blackhole=True,
+            prefix_list_id=Token.as_string(aws_ec2_managed_prefix_list_example.id),
+            transit_gateway_route_table_id=Token.as_string(aws_ec2_transit_gateway_example.association_default_route_table_id)
+        )
 ```
 
 ## Argument Reference
@@ -44,18 +68,29 @@ The following arguments are optional:
 * `blackhole` - (Optional) Indicates whether to drop traffic that matches the Prefix List. Defaults to `false`.
 * `transit_gateway_attachment_id` - (Optional) Identifier of EC2 Transit Gateway Attachment.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - EC2 Transit Gateway Route Table identifier and EC2 Prefix List identifier, separated by an underscore (`_`)
 
 ## Import
 
-`aws_ec2_transit_gateway_prefix_list_reference` can be imported by using the EC2 Transit Gateway Route Table identifier and EC2 Prefix List identifier, separated by an underscore (`_`), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_ec2_transit_gateway_prefix_list_reference` using the EC2 Transit Gateway Route Table identifier and EC2 Prefix List identifier, separated by an underscore (`_`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_ec2_transit_gateway_prefix_list_reference` using the EC2 Transit Gateway Route Table identifier and EC2 Prefix List identifier, separated by an underscore (`_`). For example:
 
 ```console
-$ terraform import aws_ec2_transit_gateway_prefix_list_reference.example tgw-rtb-12345678_pl-12345678
+% terraform import aws_ec2_transit_gateway_prefix_list_reference.example tgw-rtb-12345678_pl-12345678
 ```
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-dae2b5290418a326474491e4cd679453c7c96892eefcda91996a5bc3e7297a8d -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-32c5c00eacc9b022003008b236983d6790e2080f489aa235567510a3cf34f745 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ec2_transit_gateway_route.html.markdown b/website/docs/cdktf/python/r/ec2_transit_gateway_route.html.markdown
index 383121e4257..55517d9415d 100644
--- a/website/docs/cdktf/python/r/ec2_transit_gateway_route.html.markdown
+++ b/website/docs/cdktf/python/r/ec2_transit_gateway_route.html.markdown
@@ -6,6 +6,8 @@ description: |-
   Manages an EC2 Transit Gateway Route
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Resource: aws_ec2_transit_gateway_route
 
 Manages an EC2 Transit Gateway Route.
@@ -14,45 +16,78 @@ Manages an EC2 Transit Gateway Route.
 
 ### Standard usage
 
-```terraform
-resource "aws_ec2_transit_gateway_route" "example" {
-  destination_cidr_block         = "0.0.0.0/0"
-  transit_gateway_attachment_id  = aws_ec2_transit_gateway_vpc_attachment.example.id
-  transit_gateway_route_table_id = aws_ec2_transit_gateway.example.association_default_route_table_id
-}
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ec2_transit_gateway_route import Ec2TransitGatewayRoute
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Ec2TransitGatewayRoute(self, "example",
+            destination_cidr_block="0.0.0.0/0",
+            transit_gateway_attachment_id=Token.as_string(aws_ec2_transit_gateway_vpc_attachment_example.id),
+            transit_gateway_route_table_id=Token.as_string(aws_ec2_transit_gateway_example.association_default_route_table_id)
+        )
 ```
 
 ### Blackhole route
 
-```terraform
-resource "aws_ec2_transit_gateway_route" "example" {
-  destination_cidr_block         = "0.0.0.0/0"
-  blackhole                      = true
-  transit_gateway_route_table_id = aws_ec2_transit_gateway.example.association_default_route_table_id
-}
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ec2_transit_gateway_route import Ec2TransitGatewayRoute
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Ec2TransitGatewayRoute(self, "example",
+            blackhole=True,
+            destination_cidr_block="0.0.0.0/0",
+            transit_gateway_route_table_id=Token.as_string(aws_ec2_transit_gateway_example.association_default_route_table_id)
+        )
 ```
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `destination_cidr_block` - (Required) IPv4 or IPv6 RFC1924 CIDR used for destination matches. Routing decisions are based on the most specific match.
 * `transit_gateway_attachment_id` - (Optional) Identifier of EC2 Transit Gateway Attachment (required if `blackhole` is set to false).
 * `blackhole` - (Optional) Indicates whether to drop traffic that matches this route (default to `false`).
 * `transit_gateway_route_table_id` - (Required) Identifier of EC2 Transit Gateway Route Table.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - EC2 Transit Gateway Route Table identifier combined with destination
 
 ## Import
 
-`aws_ec2_transit_gateway_route` can be imported by using the EC2 Transit Gateway Route Table, an underscore, and the destination, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_ec2_transit_gateway_route` using the EC2 Transit Gateway Route Table, an underscore, and the destination. For example:
 
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
 ```
-$ terraform import aws_ec2_transit_gateway_route.example tgw-rtb-12345678_0.0.0.0/0
+
+Using `terraform import`, import `aws_ec2_transit_gateway_route` using the EC2 Transit Gateway Route Table, an underscore, and the destination. For example:
+
+```console
+% terraform import aws_ec2_transit_gateway_route.example tgw-rtb-12345678_0.0.0.0/0
 ```
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-c1cd33512986d2076d7edfcf1ac44456fcdaf749f1f4263bf4eee8fa75071101 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-3f4289296824edee3b69e6fca23a5970445532afeb5abfc08517d091ea79a4c6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ec2_transit_gateway_route_table.html.markdown b/website/docs/cdktf/python/r/ec2_transit_gateway_route_table.html.markdown
index 013d344a1e1..3f7c191e976 100644
--- a/website/docs/cdktf/python/r/ec2_transit_gateway_route_table.html.markdown
+++ b/website/docs/cdktf/python/r/ec2_transit_gateway_route_table.html.markdown
@@ -6,28 +6,41 @@ description: |-
   Manages an EC2 Transit Gateway Route Table
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Resource: aws_ec2_transit_gateway_route_table
 
 Manages an EC2 Transit Gateway Route Table.
 
 ## Example Usage
 
-```terraform
-resource "aws_ec2_transit_gateway_route_table" "example" {
-  transit_gateway_id = aws_ec2_transit_gateway.example.id
-}
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ec2_transit_gateway_route_table import Ec2TransitGatewayRouteTable
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Ec2TransitGatewayRouteTable(self, "example",
+            transit_gateway_id=Token.as_string(aws_ec2_transit_gateway_example.id)
+        )
 ```
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `transit_gateway_id` - (Required) Identifier of EC2 Transit Gateway.
 * `tags` - (Optional) Key-value tags for the EC2 Transit Gateway Route Table. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - EC2 Transit Gateway Route Table Amazon Resource Name (ARN).
 * `default_association_route_table` - Boolean whether this is the default association route table for the EC2 Transit Gateway.
@@ -37,10 +50,21 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_ec2_transit_gateway_route_table` can be imported by using the EC2 Transit Gateway Route Table identifier, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_ec2_transit_gateway_route_table` using the EC2 Transit Gateway Route Table identifier. For example:
 
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
 ```
-$ terraform import aws_ec2_transit_gateway_route_table.example tgw-rtb-12345678
+
+Using `terraform import`, import `aws_ec2_transit_gateway_route_table` using the EC2 Transit Gateway Route Table identifier. For example:
+
+```console
+% terraform import aws_ec2_transit_gateway_route_table.example tgw-rtb-12345678
 ```
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-092be375f2f09f63bf27cf8ba5f401de29a29a0e18c98e42df9a11ae41925104 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-22bcd95f66a310e881b85f1b296248135302868e7015f65168f1d2d03e9aefba -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ec2_transit_gateway_route_table_association.html.markdown b/website/docs/cdktf/python/r/ec2_transit_gateway_route_table_association.html.markdown
index 44073ddc56f..28bdc57cdf5 100644
--- a/website/docs/cdktf/python/r/ec2_transit_gateway_route_table_association.html.markdown
+++ b/website/docs/cdktf/python/r/ec2_transit_gateway_route_table_association.html.markdown
@@ -6,29 +6,43 @@ description: |-
   Manages an EC2 Transit Gateway Route Table association
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Resource: aws_ec2_transit_gateway_route_table_association
 
 Manages an EC2 Transit Gateway Route Table association.
 
 ## Example Usage
 
-```terraform
-resource "aws_ec2_transit_gateway_route_table_association" "example" {
-  transit_gateway_attachment_id  = aws_ec2_transit_gateway_vpc_attachment.example.id
-  transit_gateway_route_table_id = aws_ec2_transit_gateway_route_table.example.id
-}
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ec2_transit_gateway_route_table_association import Ec2TransitGatewayRouteTableAssociation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Ec2TransitGatewayRouteTableAssociation(self, "example",
+            transit_gateway_attachment_id=Token.as_string(aws_ec2_transit_gateway_vpc_attachment_example.id),
+            transit_gateway_route_table_id=Token.as_string(aws_ec2_transit_gateway_route_table_example.id)
+        )
 ```
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `transit_gateway_attachment_id` - (Required) Identifier of EC2 Transit Gateway Attachment.
 * `transit_gateway_route_table_id` - (Required) Identifier of EC2 Transit Gateway Route Table.
+* `replace_existing_association` - (Optional) Boolean whether the Gateway Attachment should remove any current Route Table association before associating with the specified Route Table. Default value: `false`. This argument is intended for use with EC2 Transit Gateways shared into the current account, otherwise the `transit_gateway_default_route_table_association` argument of the `aws_ec2_transit_gateway_vpc_attachment` resource should be used.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - EC2 Transit Gateway Route Table identifier combined with EC2 Transit Gateway Attachment identifier
 * `resource_id` - Identifier of the resource
@@ -36,10 +50,21 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_ec2_transit_gateway_route_table_association` can be imported by using the EC2 Transit Gateway Route Table identifier, an underscore, and the EC2 Transit Gateway Attachment identifier, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_ec2_transit_gateway_route_table_association` using the EC2 Transit Gateway Route Table identifier, an underscore, and the EC2 Transit Gateway Attachment identifier. For example:
 
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
 ```
-$ terraform import aws_ec2_transit_gateway_route_table_association.example tgw-rtb-12345678_tgw-attach-87654321
+
+Using `terraform import`, import `aws_ec2_transit_gateway_route_table_association` using the EC2 Transit Gateway Route Table identifier, an underscore, and the EC2 Transit Gateway Attachment identifier. For example:
+
+```console
+% terraform import aws_ec2_transit_gateway_route_table_association.example tgw-rtb-12345678_tgw-attach-87654321
 ```
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-e8bd264e123bc7d73d8d6836f2d3010e1b9d33e09d6d8cab85d400cbc4c35f21 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-3ac16f5f12533178bcc9006668852009e911e3309377a5bca5cfb4099f491912 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ec2_transit_gateway_route_table_propagation.html.markdown b/website/docs/cdktf/python/r/ec2_transit_gateway_route_table_propagation.html.markdown
index 302b9252679..26d746227a0 100644
--- a/website/docs/cdktf/python/r/ec2_transit_gateway_route_table_propagation.html.markdown
+++ b/website/docs/cdktf/python/r/ec2_transit_gateway_route_table_propagation.html.markdown
@@ -6,29 +6,42 @@ description: |-
   Manages an EC2 Transit Gateway Route Table propagation
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Resource: aws_ec2_transit_gateway_route_table_propagation
 
 Manages an EC2 Transit Gateway Route Table propagation.
 
 ## Example Usage
 
-```terraform
-resource "aws_ec2_transit_gateway_route_table_propagation" "example" {
-  transit_gateway_attachment_id  = aws_ec2_transit_gateway_vpc_attachment.example.id
-  transit_gateway_route_table_id = aws_ec2_transit_gateway_route_table.example.id
-}
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ec2_transit_gateway_route_table_propagation import Ec2TransitGatewayRouteTablePropagation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Ec2TransitGatewayRouteTablePropagation(self, "example",
+            transit_gateway_attachment_id=Token.as_string(aws_ec2_transit_gateway_vpc_attachment_example.id),
+            transit_gateway_route_table_id=Token.as_string(aws_ec2_transit_gateway_route_table_example.id)
+        )
 ```
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `transit_gateway_attachment_id` - (Required) Identifier of EC2 Transit Gateway Attachment.
 * `transit_gateway_route_table_id` - (Required) Identifier of EC2 Transit Gateway Route Table.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - EC2 Transit Gateway Route Table identifier combined with EC2 Transit Gateway Attachment identifier
 * `resource_id` - Identifier of the resource
@@ -36,10 +49,21 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_ec2_transit_gateway_route_table_propagation` can be imported by using the EC2 Transit Gateway Route Table identifier, an underscore, and the EC2 Transit Gateway Attachment identifier, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_ec2_transit_gateway_route_table_propagation` using the EC2 Transit Gateway Route Table identifier, an underscore, and the EC2 Transit Gateway Attachment identifier. For example:
 
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
 ```
-$ terraform import aws_ec2_transit_gateway_route_table_propagation.example tgw-rtb-12345678_tgw-attach-87654321
+
+Using `terraform import`, import `aws_ec2_transit_gateway_route_table_propagation` using the EC2 Transit Gateway Route Table identifier, an underscore, and the EC2 Transit Gateway Attachment identifier. For example:
+
+```console
+% terraform import aws_ec2_transit_gateway_route_table_propagation.example tgw-rtb-12345678_tgw-attach-87654321
 ```
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-3f7fc604735b965a0bdab490984fe7efcec8e99742613ec9237376463dd81611 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-0296774da3cc7e6a2540fcd890af389ccf67fa4d39cf5ee59832361eca60bcc4 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ec2_transit_gateway_vpc_attachment.html.markdown b/website/docs/cdktf/python/r/ec2_transit_gateway_vpc_attachment.html.markdown
index 7c61855a797..df8ed6ddcdd 100644
--- a/website/docs/cdktf/python/r/ec2_transit_gateway_vpc_attachment.html.markdown
+++ b/website/docs/cdktf/python/r/ec2_transit_gateway_vpc_attachment.html.markdown
@@ -6,25 +6,38 @@ description: |-
   Manages an EC2 Transit Gateway VPC Attachment
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Resource: aws_ec2_transit_gateway_vpc_attachment
 
 Manages an EC2 Transit Gateway VPC Attachment. For examples of custom route table association and propagation, see the EC2 Transit Gateway Networking Examples Guide.
 
 ## Example Usage
 
-```terraform
-resource "aws_ec2_transit_gateway_vpc_attachment" "example" {
-  subnet_ids         = [aws_subnet.example.id]
-  transit_gateway_id = aws_ec2_transit_gateway.example.id
-  vpc_id             = aws_vpc.example.id
-}
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ec2_transit_gateway_vpc_attachment import Ec2TransitGatewayVpcAttachment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Ec2TransitGatewayVpcAttachment(self, "example",
+            subnet_ids=[Token.as_string(aws_subnet_example.id)],
+            transit_gateway_id=Token.as_string(aws_ec2_transit_gateway_example.id),
+            vpc_id=Token.as_string(aws_vpc_example.id)
+        )
 ```
 
 A full example of how to create a Transit Gateway in one AWS account, share it with a second AWS account, and attach a VPC in the second account to the Transit Gateway via the `aws_ec2_transit_gateway_vpc_attachment` and `aws_ec2_transit_gateway_vpc_attachment_accepter` resources can be found in [the `./examples/transit-gateway-cross-account-vpc-attachment` directory within the Github Repository](https://github.com/hashicorp/terraform-provider-aws/tree/main/examples/transit-gateway-cross-account-vpc-attachment).
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `subnet_ids` - (Required) Identifiers of EC2 Subnets.
 * `transit_gateway_id` - (Required) Identifier of EC2 Transit Gateway.
@@ -36,9 +49,9 @@ The following arguments are supported:
 * `transit_gateway_default_route_table_association` - (Optional) Boolean whether the VPC Attachment should be associated with the EC2 Transit Gateway association default route table. This cannot be configured or perform drift detection with Resource Access Manager shared EC2 Transit Gateways. Default value: `true`.
 * `transit_gateway_default_route_table_propagation` - (Optional) Boolean whether the VPC Attachment should propagate routes with the EC2 Transit Gateway propagation default route table. This cannot be configured or perform drift detection with Resource Access Manager shared EC2 Transit Gateways. Default value: `true`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - EC2 Transit Gateway Attachment identifier
 * `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
@@ -46,10 +59,21 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_ec2_transit_gateway_vpc_attachment` can be imported by using the EC2 Transit Gateway Attachment identifier, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_ec2_transit_gateway_vpc_attachment` using the EC2 Transit Gateway Attachment identifier. For example:
 
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
 ```
-$ terraform import aws_ec2_transit_gateway_vpc_attachment.example tgw-attach-12345678
+
+Using `terraform import`, import `aws_ec2_transit_gateway_vpc_attachment` using the EC2 Transit Gateway Attachment identifier. For example:
+
+```console
+% terraform import aws_ec2_transit_gateway_vpc_attachment.example tgw-attach-12345678
 ```
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-542104b0b8b14cf70d217cb89d2940711fa38ea1e89aed4d0f46c3315423c656 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-e76943b879789e9aa1c622ff0379f66692ea0b317120aa63e121af64f6a6d4c3 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ec2_transit_gateway_vpc_attachment_accepter.html.markdown b/website/docs/cdktf/python/r/ec2_transit_gateway_vpc_attachment_accepter.html.markdown
index a1096e1d9a3..57724e0f6a6 100644
--- a/website/docs/cdktf/python/r/ec2_transit_gateway_vpc_attachment_accepter.html.markdown
+++ b/website/docs/cdktf/python/r/ec2_transit_gateway_vpc_attachment_accepter.html.markdown
@@ -6,6 +6,8 @@ description: |-
   Manages the accepter's side of an EC2 Transit Gateway VPC Attachment
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Resource: aws_ec2_transit_gateway_vpc_attachment_accepter
 
 Manages the accepter's side of an EC2 Transit Gateway VPC Attachment.
@@ -18,30 +20,40 @@ connection into management.
 
 ## Example Usage
 
-```terraform
-resource "aws_ec2_transit_gateway_vpc_attachment_accepter" "example" {
-  transit_gateway_attachment_id = aws_ec2_transit_gateway_vpc_attachment.example.id
-
-  tags = {
-    Name = "Example cross-account attachment"
-  }
-}
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ec2_transit_gateway_vpc_attachment_accepter import Ec2TransitGatewayVpcAttachmentAccepter
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Ec2TransitGatewayVpcAttachmentAccepter(self, "example",
+            tags={
+                "Name": "Example cross-account attachment"
+            },
+            transit_gateway_attachment_id=Token.as_string(aws_ec2_transit_gateway_vpc_attachment_example.id)
+        )
 ```
 
 A full example of how to create a Transit Gateway in one AWS account, share it with a second AWS account, and attach a VPC in the second account to the Transit Gateway via the `aws_ec2_transit_gateway_vpc_attachment` and `aws_ec2_transit_gateway_vpc_attachment_accepter` resources can be found in [the `./examples/transit-gateway-cross-account-vpc-attachment` directory within the Github Repository](https://github.com/hashicorp/terraform-provider-aws/tree/main/examples/transit-gateway-cross-account-vpc-attachment).
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `transit_gateway_attachment_id` - (Required) The ID of the EC2 Transit Gateway Attachment to manage.
 * `transit_gateway_default_route_table_association` - (Optional) Boolean whether the VPC Attachment should be associated with the EC2 Transit Gateway association default route table. Default value: `true`.
 * `transit_gateway_default_route_table_propagation` - (Optional) Boolean whether the VPC Attachment should propagate routes with the EC2 Transit Gateway propagation default route table. Default value: `true`.
 * `tags` - (Optional) Key-value tags for the EC2 Transit Gateway VPC Attachment. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - EC2 Transit Gateway Attachment identifier
 * `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
@@ -55,10 +67,21 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_ec2_transit_gateway_vpc_attachment_accepter` can be imported by using the EC2 Transit Gateway Attachment identifier, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_ec2_transit_gateway_vpc_attachment_accepter` using the EC2 Transit Gateway Attachment identifier. For example:
 
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
 ```
-$ terraform import aws_ec2_transit_gateway_vpc_attachment_accepter.example tgw-attach-12345678
+
+Using `terraform import`, import `aws_ec2_transit_gateway_vpc_attachment_accepter` using the EC2 Transit Gateway Attachment identifier. For example:
+
+```console
+% terraform import aws_ec2_transit_gateway_vpc_attachment_accepter.example tgw-attach-12345678
 ```
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-232f5fcd8a6ad2c2a3f3e13403cef004626b48c5673a3cce15a3172b9006d2c5 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-ecbf6dbf5eb02fc6c50aa5f135ccaddf1f97a389191703614a66b382e746bf66 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ecr_lifecycle_policy.html.markdown b/website/docs/cdktf/python/r/ecr_lifecycle_policy.html.markdown
new file mode 100644
index 00000000000..2e7c80392a5
--- /dev/null
+++ b/website/docs/cdktf/python/r/ecr_lifecycle_policy.html.markdown
@@ -0,0 +1,102 @@
+---
+subcategory: "ECR (Elastic Container Registry)"
+layout: "aws"
+page_title: "AWS: aws_ecr_lifecycle_policy"
+description: |-
+  Manages an ECR repository lifecycle policy.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ecr_lifecycle_policy
+
+Manages an ECR repository lifecycle policy.
+
+~> **NOTE:** Only one `aws_ecr_lifecycle_policy` resource can be used with the same ECR repository. To apply multiple rules, they must be combined in the `policy` JSON.
+
+~> **NOTE:** The AWS ECR API seems to reorder rules based on `rulePriority`. If you define multiple rules that are not sorted in ascending `rulePriority` order in the Terraform code, the resource will be flagged for recreation every `terraform plan`.
+
+## Example Usage
+
+### Policy on untagged image
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ecr_lifecycle_policy import EcrLifecyclePolicy
+from imports.aws.ecr_repository import EcrRepository
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        foo = EcrRepository(self, "foo",
+            name="bar"
+        )
+        EcrLifecyclePolicy(self, "foopolicy",
+            policy="{\n    \"rules\": [\n        {\n            \"rulePriority\": 1,\n            \"description\": \"Expire images older than 14 days\",\n            \"selection\": {\n                \"tagStatus\": \"untagged\",\n                \"countType\": \"sinceImagePushed\",\n                \"countUnit\": \"days\",\n                \"countNumber\": 14\n            },\n            \"action\": {\n                \"type\": \"expire\"\n            }\n        }\n    ]\n}\n\n",
+            repository=foo.name
+        )
+```
+
+### Policy on tagged image
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ecr_lifecycle_policy import EcrLifecyclePolicy
+from imports.aws.ecr_repository import EcrRepository
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        foo = EcrRepository(self, "foo",
+            name="bar"
+        )
+        EcrLifecyclePolicy(self, "foopolicy",
+            policy="{\n    \"rules\": [\n        {\n            \"rulePriority\": 1,\n            \"description\": \"Keep last 30 images\",\n            \"selection\": {\n                \"tagStatus\": \"tagged\",\n                \"tagPrefixList\": [\"v\"],\n                \"countType\": \"imageCountMoreThan\",\n                \"countNumber\": 30\n            },\n            \"action\": {\n                \"type\": \"expire\"\n            }\n        }\n    ]\n}\n\n",
+            repository=foo.name
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `repository` - (Required) Name of the repository to apply the policy.
+* `policy` - (Required) The policy document. This is a JSON formatted string. See more details about [Policy Parameters](http://docs.aws.amazon.com/AmazonECR/latest/userguide/LifecyclePolicies.html#lifecycle_policy_parameters) in the official AWS docs.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `repository` - The name of the repository.
+* `registry_id` - The registry ID where the repository was created.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import ECR Lifecycle Policy using the name of the repository. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import ECR Lifecycle Policy using the name of the repository. For example:
+
+```console
+% terraform import aws_ecr_lifecycle_policy.example tf-example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-0e4c7e8c7cdaee9fd0d8211aaa75d4db1e461d9cccef8d7c28f406dede927735 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ecr_pull_through_cache_rule.html.markdown b/website/docs/cdktf/python/r/ecr_pull_through_cache_rule.html.markdown
new file mode 100644
index 00000000000..fadb6b8dac3
--- /dev/null
+++ b/website/docs/cdktf/python/r/ecr_pull_through_cache_rule.html.markdown
@@ -0,0 +1,70 @@
+---
+subcategory: "ECR (Elastic Container Registry)"
+layout: "aws"
+page_title: "AWS: aws_ecr_pull_through_cache_rule"
+description: |-
+  Provides an Elastic Container Registry Pull Through Cache Rule.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ecr_pull_through_cache_rule
+
+Provides an Elastic Container Registry Pull Through Cache Rule.
+
+More information about pull through cache rules, including the set of supported
+upstream repositories, see [Using pull through cache rules](https://docs.aws.amazon.com/AmazonECR/latest/userguide/pull-through-cache.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ecr_pull_through_cache_rule import EcrPullThroughCacheRule
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        EcrPullThroughCacheRule(self, "example",
+            ecr_repository_prefix="ecr-public",
+            upstream_registry_url="public.ecr.aws"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `ecr_repository_prefix` - (Required, Forces new resource) The repository name prefix to use when caching images from the source registry.
+* `upstream_registry_url` - (Required, Forces new resource) The registry URL of the upstream public registry to use as the source.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `registry_id` - The registry ID where the repository was created.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import a pull-through cache rule using the `ecr_repository_prefix`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import a pull-through cache rule using the `ecr_repository_prefix`. For example:
+
+```console
+% terraform import aws_ecr_pull_through_cache_rule.example ecr-public
+```
+
+<!-- cache-key: cdktf-0.18.0 input-6f34bbf2ac113908932d429c51221ac1598eaf73e0c126d6199e75b0b3c98d1b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ecr_registry_policy.html.markdown b/website/docs/cdktf/python/r/ecr_registry_policy.html.markdown
new file mode 100644
index 00000000000..cf2241cdeb8
--- /dev/null
+++ b/website/docs/cdktf/python/r/ecr_registry_policy.html.markdown
@@ -0,0 +1,89 @@
+---
+subcategory: "ECR (Elastic Container Registry)"
+layout: "aws"
+page_title: "AWS: aws_ecr_registry_policy"
+description: |-
+  Provides an Elastic Container Registry Policy.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ecr_registry_policy
+
+Provides an Elastic Container Registry Policy.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_caller_identity import DataAwsCallerIdentity
+from imports.aws.data_aws_partition import DataAwsPartition
+from imports.aws.data_aws_region import DataAwsRegion
+from imports.aws.ecr_registry_policy import EcrRegistryPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        current = DataAwsCallerIdentity(self, "current")
+        data_aws_partition_current = DataAwsPartition(self, "current_1")
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_partition_current.override_logical_id("current")
+        data_aws_region_current = DataAwsRegion(self, "current_2")
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_region_current.override_logical_id("current")
+        EcrRegistryPolicy(self, "example",
+            policy=Token.as_string(
+                Fn.jsonencode({
+                    "Statement": [{
+                        "Action": ["ecr:ReplicateImage"],
+                        "Effect": "Allow",
+                        "Principal": {
+                            "AWS": "arn:${" + data_aws_partition_current.partition + "}:iam::${" + current.account_id + "}:root"
+                        },
+                        "Resource": ["arn:${" + data_aws_partition_current.partition + "}:ecr:${" + data_aws_region_current.name + "}:${" + current.account_id + "}:repository/*"
+                        ],
+                        "Sid": "testpolicy"
+                    }
+                    ],
+                    "Version": "2012-10-17"
+                }))
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `policy` - (Required) The policy document. This is a JSON formatted string. For more information about building IAM policy documents with Terraform, see the [AWS IAM Policy Document Guide](https://learn.hashicorp.com/terraform/aws/iam-policy)
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `registry_id` - The registry ID where the registry was created.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import ECR Registry Policy using the registry id. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import ECR Registry Policy using the registry id. For example:
+
+```console
+% terraform import aws_ecr_registry_policy.example 123456789012
+```
+
+<!-- cache-key: cdktf-0.18.0 input-a8b9e1b12da0ab4f7f9e19fe22a9fd339fcf53514637769a293dcb91b039f9b6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ecr_registry_scanning_configuration.html.markdown b/website/docs/cdktf/python/r/ecr_registry_scanning_configuration.html.markdown
new file mode 100644
index 00000000000..dc2d86a9211
--- /dev/null
+++ b/website/docs/cdktf/python/r/ecr_registry_scanning_configuration.html.markdown
@@ -0,0 +1,117 @@
+---
+subcategory: "ECR (Elastic Container Registry)"
+layout: "aws"
+page_title: "AWS: aws_ecr_registry_scanning_configuration"
+description: |-
+  Provides an Elastic Container Registry Scanning Configuration.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ecr_registry_scanning_configuration
+
+Provides an Elastic Container Registry Scanning Configuration. Can't be completely deleted, instead reverts to the default `BASIC` scanning configuration without rules.
+
+## Example Usage
+
+### Basic example
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ecr_registry_scanning_configuration import EcrRegistryScanningConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        EcrRegistryScanningConfiguration(self, "configuration",
+            rule=[EcrRegistryScanningConfigurationRule(
+                repository_filter=[EcrRegistryScanningConfigurationRuleRepositoryFilter(
+                    filter="example",
+                    filter_type="WILDCARD"
+                )
+                ],
+                scan_frequency="CONTINUOUS_SCAN"
+            )
+            ],
+            scan_type="ENHANCED"
+        )
+```
+
+### Multiple rules
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ecr_registry_scanning_configuration import EcrRegistryScanningConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        EcrRegistryScanningConfiguration(self, "test",
+            rule=[EcrRegistryScanningConfigurationRule(
+                repository_filter=[EcrRegistryScanningConfigurationRuleRepositoryFilter(
+                    filter="*",
+                    filter_type="WILDCARD"
+                )
+                ],
+                scan_frequency="SCAN_ON_PUSH"
+            ), EcrRegistryScanningConfigurationRule(
+                repository_filter=[EcrRegistryScanningConfigurationRuleRepositoryFilter(
+                    filter="example",
+                    filter_type="WILDCARD"
+                )
+                ],
+                scan_frequency="CONTINUOUS_SCAN"
+            )
+            ],
+            scan_type="ENHANCED"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+- `scan_type` - (Required) the scanning type to set for the registry. Can be either `ENHANCED` or `BASIC`.
+- `rule` - (Optional) One or multiple blocks specifying scanning rules to determine which repository filters are used and at what frequency scanning will occur. See [below for schema](#rule).
+
+### rule
+
+- `repository_filter` - (Required) One or more repository filter blocks, containing a `filter` (required string filtering repositories, see pattern regex [here](https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_ScanningRepositoryFilter.html)) and a `filter_type` (required string, currently only `WILDCARD` is supported).
+- `scan_frequency` - (Required) The frequency that scans are performed at for a private registry. Can be `SCAN_ON_PUSH`, `CONTINUOUS_SCAN`, or `MANUAL`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `registry_id` - The registry ID the scanning configuration applies to.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import ECR Scanning Configurations using the `registry_id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import ECR Scanning Configurations using the `registry_id`. For example:
+
+```console
+% terraform import aws_ecr_registry_scanning_configuration.example 012345678901
+```
+
+<!-- cache-key: cdktf-0.18.0 input-878f43063e7870789fdafbc4e35da8eca405013c513258165088a92488bbfa61 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ecr_replication_configuration.html.markdown b/website/docs/cdktf/python/r/ecr_replication_configuration.html.markdown
new file mode 100644
index 00000000000..75c9911043c
--- /dev/null
+++ b/website/docs/cdktf/python/r/ecr_replication_configuration.html.markdown
@@ -0,0 +1,178 @@
+---
+subcategory: "ECR (Elastic Container Registry)"
+layout: "aws"
+page_title: "AWS: aws_ecr_replication_configuration"
+description: |-
+  Provides an Elastic Container Registry Replication Configuration.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ecr_replication_configuration
+
+Provides an Elastic Container Registry Replication Configuration.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_caller_identity import DataAwsCallerIdentity
+from imports.aws.data_aws_regions import DataAwsRegions
+from imports.aws.ecr_replication_configuration import EcrReplicationConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        current = DataAwsCallerIdentity(self, "current")
+        example = DataAwsRegions(self, "example")
+        aws_ecr_replication_configuration_example =
+        EcrReplicationConfiguration(self, "example_2",
+            replication_configuration=EcrReplicationConfigurationReplicationConfiguration(
+                rule=[EcrReplicationConfigurationReplicationConfigurationRule(
+                    destination=[EcrReplicationConfigurationReplicationConfigurationRuleDestination(
+                        region=Token.as_string(Fn.lookup_nested(example.names, ["0"])),
+                        registry_id=Token.as_string(current.account_id)
+                    )
+                    ]
+                )
+                ]
+            )
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_ecr_replication_configuration_example.override_logical_id("example")
+```
+
+## Multiple Region Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_caller_identity import DataAwsCallerIdentity
+from imports.aws.data_aws_regions import DataAwsRegions
+from imports.aws.ecr_replication_configuration import EcrReplicationConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        current = DataAwsCallerIdentity(self, "current")
+        example = DataAwsRegions(self, "example")
+        aws_ecr_replication_configuration_example =
+        EcrReplicationConfiguration(self, "example_2",
+            replication_configuration=EcrReplicationConfigurationReplicationConfiguration(
+                rule=[EcrReplicationConfigurationReplicationConfigurationRule(
+                    destination=[EcrReplicationConfigurationReplicationConfigurationRuleDestination(
+                        region=Token.as_string(Fn.lookup_nested(example.names, ["0"])),
+                        registry_id=Token.as_string(current.account_id)
+                    ), EcrReplicationConfigurationReplicationConfigurationRuleDestination(
+                        region=Token.as_string(Fn.lookup_nested(example.names, ["1"])),
+                        registry_id=Token.as_string(current.account_id)
+                    )
+                    ]
+                )
+                ]
+            )
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_ecr_replication_configuration_example.override_logical_id("example")
+```
+
+## Repository Filter Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_caller_identity import DataAwsCallerIdentity
+from imports.aws.data_aws_regions import DataAwsRegions
+from imports.aws.ecr_replication_configuration import EcrReplicationConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        current = DataAwsCallerIdentity(self, "current")
+        example = DataAwsRegions(self, "example")
+        aws_ecr_replication_configuration_example =
+        EcrReplicationConfiguration(self, "example_2",
+            replication_configuration=EcrReplicationConfigurationReplicationConfiguration(
+                rule=[EcrReplicationConfigurationReplicationConfigurationRule(
+                    destination=[EcrReplicationConfigurationReplicationConfigurationRuleDestination(
+                        region=Token.as_string(Fn.lookup_nested(example.names, ["0"])),
+                        registry_id=Token.as_string(current.account_id)
+                    )
+                    ],
+                    repository_filter=[EcrReplicationConfigurationReplicationConfigurationRuleRepositoryFilter(
+                        filter="prod-microservice",
+                        filter_type="PREFIX_MATCH"
+                    )
+                    ]
+                )
+                ]
+            )
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_ecr_replication_configuration_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `replication_configuration` - (Required) Replication configuration for a registry. See [Replication Configuration](#replication-configuration).
+
+### Replication Configuration
+
+* `rule` - (Required) The replication rules for a replication configuration. A maximum of 10 are allowed per `replication_configuration`. See [Rule](#rule)
+
+### Rule
+
+* `destination` - (Required) the details of a replication destination. A maximum of 25 are allowed per `rule`. See [Destination](#destination).
+* `repository_filter` - (Optional) filters for a replication rule. See [Repository Filter](#repository-filter).
+
+### Destination
+
+* `region` - (Required) A Region to replicate to.
+* `registry_id` - (Required) The account ID of the destination registry to replicate to.
+
+### Repository Filter
+
+* `filter` - (Required) The repository filter details.
+* `filter_type` - (Required) The repository filter type. The only supported value is `PREFIX_MATCH`, which is a repository name prefix specified with the filter parameter.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `registry_id` - The registry ID where the replication configuration was created.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import ECR Replication Configuration using the `registry_id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import ECR Replication Configuration using the `registry_id`. For example:
+
+```console
+% terraform import aws_ecr_replication_configuration.service 012345678912
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1e720b09bffb1410913da15b1daa4aaef042cc175055603ba3335ca4406730fc -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ecr_repository.html.markdown b/website/docs/cdktf/python/r/ecr_repository.html.markdown
new file mode 100644
index 00000000000..6734b651b8b
--- /dev/null
+++ b/website/docs/cdktf/python/r/ecr_repository.html.markdown
@@ -0,0 +1,90 @@
+---
+subcategory: "ECR (Elastic Container Registry)"
+layout: "aws"
+page_title: "AWS: aws_ecr_repository"
+description: |-
+  Provides an Elastic Container Registry Repository.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ecr_repository
+
+Provides an Elastic Container Registry Repository.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ecr_repository import EcrRepository
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        EcrRepository(self, "foo",
+            image_scanning_configuration=EcrRepositoryImageScanningConfiguration(
+                scan_on_push=True
+            ),
+            image_tag_mutability="MUTABLE",
+            name="bar"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) Name of the repository.
+* `encryption_configuration` - (Optional) Encryption configuration for the repository. See [below for schema](#encryption_configuration).
+* `force_delete` - (Optional) If `true`, will delete the repository even if it contains images.
+  Defaults to `false`.
+* `image_tag_mutability` - (Optional) The tag mutability setting for the repository. Must be one of: `MUTABLE` or `IMMUTABLE`. Defaults to `MUTABLE`.
+* `image_scanning_configuration` - (Optional) Configuration block that defines image scanning configuration for the repository. By default, image scanning must be manually triggered. See the [ECR User Guide](https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html) for more information about image scanning.
+    * `scan_on_push` - (Required) Indicates whether images are scanned after being pushed to the repository (true) or not scanned (false).
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### encryption_configuration
+
+* `encryption_type` - (Optional) The encryption type to use for the repository. Valid values are `AES256` or `KMS`. Defaults to `AES256`.
+* `kms_key` - (Optional) The ARN of the KMS key to use when `encryption_type` is `KMS`. If not specified, uses the default AWS managed key for ECR.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Full ARN of the repository.
+* `registry_id` - The registry ID where the repository was created.
+* `repository_url` - The URL of the repository (in the form `aws_account_id.dkr.ecr.region.amazonaws.com/repositoryName`).
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `delete` - (Default `20m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import ECR Repositories using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import ECR Repositories using the `name`. For example:
+
+```console
+% terraform import aws_ecr_repository.service test-service
+```
+
+<!-- cache-key: cdktf-0.18.0 input-e1209b507b315e404a10f48d280e6590a59e9ffd637d877733fc8905cf37de81 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ecr_repository_policy.html.markdown b/website/docs/cdktf/python/r/ecr_repository_policy.html.markdown
new file mode 100644
index 00000000000..0feb36f2147
--- /dev/null
+++ b/website/docs/cdktf/python/r/ecr_repository_policy.html.markdown
@@ -0,0 +1,91 @@
+---
+subcategory: "ECR (Elastic Container Registry)"
+layout: "aws"
+page_title: "AWS: aws_ecr_repository_policy"
+description: |-
+  Provides an Elastic Container Registry Repository Policy.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ecr_repository_policy
+
+Provides an Elastic Container Registry Repository Policy.
+
+Note that currently only one policy may be applied to a repository.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.ecr_repository import EcrRepository
+from imports.aws.ecr_repository_policy import EcrRepositoryPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        foo = EcrRepository(self, "foo",
+            name="bar"
+        )
+        foopolicy = DataAwsIamPolicyDocument(self, "foopolicy",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["ecr:GetDownloadUrlForLayer", "ecr:BatchGetImage", "ecr:BatchCheckLayerAvailability", "ecr:PutImage", "ecr:InitiateLayerUpload", "ecr:UploadLayerPart", "ecr:CompleteLayerUpload", "ecr:DescribeRepositories", "ecr:GetRepositoryPolicy", "ecr:ListImages", "ecr:DeleteRepository", "ecr:BatchDeleteImage", "ecr:SetRepositoryPolicy", "ecr:DeleteRepositoryPolicy"
+                ],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["123456789012"],
+                    type="AWS"
+                )
+                ],
+                sid="new policy"
+            )
+            ]
+        )
+        aws_ecr_repository_policy_foopolicy = EcrRepositoryPolicy(self, "foopolicy_2",
+            policy=Token.as_string(foopolicy.json),
+            repository=foo.name
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_ecr_repository_policy_foopolicy.override_logical_id("foopolicy")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `repository` - (Required) Name of the repository to apply the policy.
+* `policy` - (Required) The policy document. This is a JSON formatted string. For more information about building IAM policy documents with Terraform, see the [AWS IAM Policy Document Guide](https://learn.hashicorp.com/terraform/aws/iam-policy)
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `repository` - The name of the repository.
+* `registry_id` - The registry ID where the repository was created.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import ECR Repository Policy using the repository name. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import ECR Repository Policy using the repository name. For example:
+
+```console
+% terraform import aws_ecr_repository_policy.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-0bb26796a34294f42562707b8dbdd994b19d2487ea08fdd2ae6fdedbc68aee00 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ecrpublic_repository.html.markdown b/website/docs/cdktf/python/r/ecrpublic_repository.html.markdown
new file mode 100644
index 00000000000..5a822e5489a
--- /dev/null
+++ b/website/docs/cdktf/python/r/ecrpublic_repository.html.markdown
@@ -0,0 +1,105 @@
+---
+subcategory: "ECR Public"
+layout: "aws"
+page_title: "AWS: aws_ecrpublic_repository"
+description: |-
+  Provides a Public Elastic Container Registry Repository.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ecrpublic_repository
+
+Provides a Public Elastic Container Registry Repository.
+
+~> **NOTE:** This resource can only be used in the `us-east-1` region.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ecrpublic_repository import EcrpublicRepository
+from imports.aws.provider import AwsProvider
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        us_east1 = AwsProvider(self, "aws",
+            alias="us_east_1",
+            region="us-east-1"
+        )
+        EcrpublicRepository(self, "foo",
+            catalog_data=EcrpublicRepositoryCatalogData(
+                about_text="About Text",
+                architectures=["ARM"],
+                description="Description",
+                logo_image_blob=Token.as_string(Fn.filebase64(png)),
+                operating_systems=["Linux"],
+                usage_text="Usage Text"
+            ),
+            provider=us_east1,
+            repository_name="bar",
+            tags={
+                "env": "production"
+            }
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `repository_name` - (Required) Name of the repository.
+* `catalog_data` - (Optional) Catalog data configuration for the repository. See [below for schema](#catalog_data).
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### catalog_data
+
+* `about_text` - (Optional) A detailed description of the contents of the repository. It is publicly visible in the Amazon ECR Public Gallery. The text must be in markdown format.
+* `architectures` - (Optional) The system architecture that the images in the repository are compatible with. On the Amazon ECR Public Gallery, the following supported architectures will appear as badges on the repository and are used as search filters: `ARM`, `ARM 64`, `x86`, `x86-64`
+* `description` - (Optional) A short description of the contents of the repository. This text appears in both the image details and also when searching for repositories on the Amazon ECR Public Gallery.
+* `logo_image_blob` - (Optional) The base64-encoded repository logo payload. (Only visible for verified accounts) Note that drift detection is disabled for this attribute.
+* `operating_systems` -  (Optional) The operating systems that the images in the repository are compatible with. On the Amazon ECR Public Gallery, the following supported operating systems will appear as badges on the repository and are used as search filters: `Linux`, `Windows`
+* `usage_text` -  (Optional) Detailed information on how to use the contents of the repository. It is publicly visible in the Amazon ECR Public Gallery. The usage text provides context, support information, and additional usage details for users of the repository. The text must be in markdown format.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Full ARN of the repository.
+* `id` - The repository name.
+* `registry_id` - The registry ID where the repository was created.
+* `repository_uri` - The URI of the repository.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `delete` - (Default `20m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import ECR Public Repositories using the `repository_name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import ECR Public Repositories using the `repository_name`. For example:
+
+```console
+% terraform import aws_ecrpublic_repository.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-0eb50922129c99699d4703ec9d9700079393eb47686643926f7ecccc4d057b7c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ecrpublic_repository_policy.html.markdown b/website/docs/cdktf/python/r/ecrpublic_repository_policy.html.markdown
new file mode 100644
index 00000000000..b753d938051
--- /dev/null
+++ b/website/docs/cdktf/python/r/ecrpublic_repository_policy.html.markdown
@@ -0,0 +1,94 @@
+---
+subcategory: "ECR Public"
+layout: "aws"
+page_title: "AWS: aws_ecrpublic_repository_policy"
+description: |-
+  Provides an Elastic Container Registry Public Repository Policy.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ecrpublic_repository_policy
+
+Provides an Elastic Container Registry Public Repository Policy.
+
+Note that currently only one policy may be applied to a repository.
+
+~> **NOTE:** This resource can only be used in the `us-east-1` region.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.ecrpublic_repository import EcrpublicRepository
+from imports.aws.ecrpublic_repository_policy import EcrpublicRepositoryPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = EcrpublicRepository(self, "example",
+            repository_name="example"
+        )
+        data_aws_iam_policy_document_example = DataAwsIamPolicyDocument(self, "example_1",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["ecr:GetDownloadUrlForLayer", "ecr:BatchGetImage", "ecr:BatchCheckLayerAvailability", "ecr:PutImage", "ecr:InitiateLayerUpload", "ecr:UploadLayerPart", "ecr:CompleteLayerUpload", "ecr:DescribeRepositories", "ecr:GetRepositoryPolicy", "ecr:ListImages", "ecr:DeleteRepository", "ecr:BatchDeleteImage", "ecr:SetRepositoryPolicy", "ecr:DeleteRepositoryPolicy"
+                ],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["123456789012"],
+                    type="AWS"
+                )
+                ],
+                sid="new policy"
+            )
+            ]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_iam_policy_document_example.override_logical_id("example")
+        aws_ecrpublic_repository_policy_example = EcrpublicRepositoryPolicy(self, "example_2",
+            policy=Token.as_string(data_aws_iam_policy_document_example.json),
+            repository_name=example.repository_name
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_ecrpublic_repository_policy_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `repository_name` - (Required) Name of the repository to apply the policy.
+* `policy` - (Required) The policy document. This is a JSON formatted string. For more information about building IAM policy documents with Terraform, see the [AWS IAM Policy Document Guide](https://learn.hashicorp.com/terraform/aws/iam-policy)
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `registry_id` - The registry ID where the repository was created.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import ECR Public Repository Policy using the repository name. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import ECR Public Repository Policy using the repository name. For example:
+
+```console
+% terraform import aws_ecrpublic_repository_policy.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-5333277a8aafe52743e3f8ec371b6439d670b524be4655ccdec7e4c63f6b5fd0 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ecs_account_setting_default.html.markdown b/website/docs/cdktf/python/r/ecs_account_setting_default.html.markdown
new file mode 100644
index 00000000000..0cd0dd0e878
--- /dev/null
+++ b/website/docs/cdktf/python/r/ecs_account_setting_default.html.markdown
@@ -0,0 +1,72 @@
+---
+subcategory: "ECS (Elastic Container)"
+layout: "aws"
+page_title: "AWS: aws_ecs_account_setting_default"
+description: |-
+  Provides an ECS Default account setting.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ecs_account_setting_default
+
+Provides an ECS default account setting for a specific ECS Resource name within a specific region. More information can be found on the [ECS Developer Guide](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/ecs-account-settings.html).
+
+~> **NOTE:** The AWS API does not delete this resource. When you run `destroy`, the provider will attempt to disable the setting.
+
+~> **NOTE:** Your AWS account may not support disabling `containerInstanceLongArnFormat`, `serviceLongArnFormat`, and `taskLongArnFormat`. If your account does not support disabling these, "destroying" this resource will not disable the setting nor cause a Terraform error. However, the AWS Provider will log an AWS error: `InvalidParameterException: You can no longer disable Long Arn settings`.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ecs_account_setting_default import EcsAccountSettingDefault
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        EcsAccountSettingDefault(self, "test",
+            name="taskLongArnFormat",
+            value="enabled"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) Name of the account setting to set. Valid values are `serviceLongArnFormat`, `taskLongArnFormat`, `containerInstanceLongArnFormat`, `awsvpcTrunking` and `containerInsights`.
+* `value` - (Required) State of the setting. Valid values are `enabled` and `disabled`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - ARN that identifies the account setting.
+* `prinicpal_arn` - ARN that identifies the account setting.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import ECS Account Setting defaults using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import ECS Account Setting defaults using the `name`. For example:
+
+```console
+% terraform import aws_ecs_account_setting_default.example taskLongArnFormat
+```
+
+<!-- cache-key: cdktf-0.18.0 input-c6b2c30bb370dbc4f2130758dcd1fab12e3335f271b897842de52c4e4af677af -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ecs_capacity_provider.html.markdown b/website/docs/cdktf/python/r/ecs_capacity_provider.html.markdown
new file mode 100644
index 00000000000..cbcd489264a
--- /dev/null
+++ b/website/docs/cdktf/python/r/ecs_capacity_provider.html.markdown
@@ -0,0 +1,108 @@
+---
+subcategory: "ECS (Elastic Container)"
+layout: "aws"
+page_title: "AWS: aws_ecs_capacity_provider"
+description: |-
+  Provides an ECS cluster capacity provider.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ecs_capacity_provider
+
+Provides an ECS cluster capacity provider. More information can be found on the [ECS Developer Guide](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/cluster-capacity-providers.html).
+
+~> **NOTE:** Associating an ECS Capacity Provider to an Auto Scaling Group will automatically add the `AmazonECSManaged` tag to the Auto Scaling Group. This tag should be included in the `aws_autoscaling_group` resource configuration to prevent Terraform from removing it in subsequent executions as well as ensuring the `AmazonECSManaged` tag is propagated to all EC2 Instances in the Auto Scaling Group if `min_size` is above 0 on creation. Any EC2 Instances in the Auto Scaling Group without this tag must be manually be updated, otherwise they may cause unexpected scaling behavior and metrics.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.autoscaling_group import AutoscalingGroup
+from imports.aws.ecs_capacity_provider import EcsCapacityProvider
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, maxSize, minSize):
+        super().__init__(scope, name)
+        test = AutoscalingGroup(self, "test",
+            tag=[AutoscalingGroupTag(
+                key="AmazonECSManaged",
+                propagate_at_launch=True,
+                value=Token.as_string(True)
+            )
+            ],
+            max_size=max_size,
+            min_size=min_size
+        )
+        aws_ecs_capacity_provider_test = EcsCapacityProvider(self, "test_1",
+            auto_scaling_group_provider=EcsCapacityProviderAutoScalingGroupProvider(
+                auto_scaling_group_arn=test.arn,
+                managed_scaling=EcsCapacityProviderAutoScalingGroupProviderManagedScaling(
+                    maximum_scaling_step_size=1000,
+                    minimum_scaling_step_size=1,
+                    status="ENABLED",
+                    target_capacity=10
+                ),
+                managed_termination_protection="ENABLED"
+            ),
+            name="test"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_ecs_capacity_provider_test.override_logical_id("test")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `auto_scaling_group_provider` - (Required) Configuration block for the provider for the ECS auto scaling group. Detailed below.
+* `name` - (Required) Name of the capacity provider.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### `auto_scaling_group_provider`
+
+* `auto_scaling_group_arn` - (Required) - ARN of the associated auto scaling group.
+* `managed_scaling` - (Optional) - Configuration block defining the parameters of the auto scaling. Detailed below.
+* `managed_termination_protection` - (Optional) - Enables or disables container-aware termination of instances in the auto scaling group when scale-in happens. Valid values are `ENABLED` and `DISABLED`.
+
+### `managed_scaling`
+
+* `instance_warmup_period` - (Optional) Period of time, in seconds, after a newly launched Amazon EC2 instance can contribute to CloudWatch metrics for Auto Scaling group. If this parameter is omitted, the default value of 300 seconds is used.
+* `maximum_scaling_step_size` - (Optional) Maximum step adjustment size. A number between 1 and 10,000.
+* `minimum_scaling_step_size` - (Optional) Minimum step adjustment size. A number between 1 and 10,000.
+* `status` - (Optional) Whether auto scaling is managed by ECS. Valid values are `ENABLED` and `DISABLED`.
+* `target_capacity` - (Optional) Target utilization for the capacity provider. A number between 1 and 100.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN that identifies the capacity provider.
+* `id` - ARN that identifies the capacity provider.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import ECS Capacity Providers using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import ECS Capacity Providers using the `name`. For example:
+
+```console
+% terraform import aws_ecs_capacity_provider.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-085876568cc2c4593afd22394b677657c0db3a438e0613974a494910237cb352 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ecs_cluster.html.markdown b/website/docs/cdktf/python/r/ecs_cluster.html.markdown
new file mode 100644
index 00000000000..ddd1416b693
--- /dev/null
+++ b/website/docs/cdktf/python/r/ecs_cluster.html.markdown
@@ -0,0 +1,143 @@
+---
+subcategory: "ECS (Elastic Container)"
+layout: "aws"
+page_title: "AWS: aws_ecs_cluster"
+description: |-
+  Provides an ECS cluster.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ecs_cluster
+
+Provides an ECS cluster.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ecs_cluster import EcsCluster
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        EcsCluster(self, "foo",
+            name="white-hart",
+            setting=[EcsClusterSetting(
+                name="containerInsights",
+                value="enabled"
+            )
+            ]
+        )
+```
+
+### Example with Log Configuration
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudwatch_log_group import CloudwatchLogGroup
+from imports.aws.ecs_cluster import EcsCluster
+from imports.aws.kms_key import KmsKey
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = CloudwatchLogGroup(self, "example",
+            name="example"
+        )
+        aws_kms_key_example = KmsKey(self, "example_1",
+            deletion_window_in_days=7,
+            description="example"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_kms_key_example.override_logical_id("example")
+        EcsCluster(self, "test",
+            configuration=EcsClusterConfiguration(
+                execute_command_configuration=EcsClusterConfigurationExecuteCommandConfiguration(
+                    kms_key_id=Token.as_string(aws_kms_key_example.arn),
+                    log_configuration=EcsClusterConfigurationExecuteCommandConfigurationLogConfiguration(
+                        cloud_watch_encryption_enabled=True,
+                        cloud_watch_log_group_name=example.name
+                    ),
+                    logging="OVERRIDE"
+                )
+            ),
+            name="example"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `configuration` - (Optional) The execute command configuration for the cluster. Detailed below.
+* `name` - (Required) Name of the cluster (up to 255 letters, numbers, hyphens, and underscores)
+* `service_connect_defaults` - (Optional) Configures a default Service Connect namespace. Detailed below.
+* `setting` - (Optional) Configuration block(s) with cluster settings. For example, this can be used to enable CloudWatch Container Insights for a cluster. Detailed below.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### `configuration`
+
+* `execute_command_configuration` - (Optional) The details of the execute command configuration. Detailed below.
+
+#### `execute_command_configuration`
+
+* `kms_key_id` - (Optional) The AWS Key Management Service key ID to encrypt the data between the local client and the container.
+* `log_configuration` - (Optional) The log configuration for the results of the execute command actions Required when `logging` is `OVERRIDE`. Detailed below.
+* `logging` - (Optional) The log setting to use for redirecting logs for your execute command results. Valid values are `NONE`, `DEFAULT`, and `OVERRIDE`.
+
+##### `log_configuration`
+
+* `cloud_watch_encryption_enabled` - (Optional) Whether or not to enable encryption on the CloudWatch logs. If not specified, encryption will be disabled.
+* `cloud_watch_log_group_name` - (Optional) The name of the CloudWatch log group to send logs to.
+* `s3_bucket_name` - (Optional) The name of the S3 bucket to send logs to.
+* `s3_bucket_encryption_enabled` - (Optional) Whether or not to enable encryption on the logs sent to S3. If not specified, encryption will be disabled.
+* `s3_key_prefix` - (Optional) An optional folder in the S3 bucket to place logs in.
+
+### `setting`
+
+* `name` - (Required) Name of the setting to manage. Valid values: `containerInsights`.
+* `value` -  (Required) The value to assign to the setting. Valid values are `enabled` and `disabled`.
+
+### `service_connect_defaults`
+
+* `namespace` - (Required) The ARN of the [`aws_service_discovery_http_namespace`](/docs/providers/aws/r/service_discovery_http_namespace.html) that's used when you create a service and don't specify a Service Connect configuration.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN that identifies the cluster.
+* `id` - ARN that identifies the cluster.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import ECS clusters using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import ECS clusters using the `name`. For example:
+
+```console
+% terraform import aws_ecs_cluster.stateless stateless-app
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1154f096b3c84b6ef18254400c16ed7229ee1dd00d8545d69ff1e3a5e359aa99 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ecs_cluster_capacity_providers.html.markdown b/website/docs/cdktf/python/r/ecs_cluster_capacity_providers.html.markdown
new file mode 100644
index 00000000000..692562b192d
--- /dev/null
+++ b/website/docs/cdktf/python/r/ecs_cluster_capacity_providers.html.markdown
@@ -0,0 +1,89 @@
+---
+subcategory: "ECS (Elastic Container)"
+layout: "aws"
+page_title: "AWS: aws_ecs_cluster_capacity_providers"
+description: |-
+  Provides an ECS cluster capacity providers resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ecs_cluster_capacity_providers
+
+Manages the capacity providers of an ECS Cluster.
+
+More information about capacity providers can be found in the [ECS User Guide](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/cluster-capacity-providers.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ecs_cluster import EcsCluster
+from imports.aws.ecs_cluster_capacity_providers import EcsClusterCapacityProviders
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = EcsCluster(self, "example",
+            name="my-cluster"
+        )
+        aws_ecs_cluster_capacity_providers_example =
+        EcsClusterCapacityProviders(self, "example_1",
+            capacity_providers=["FARGATE"],
+            cluster_name=example.name,
+            default_capacity_provider_strategy=[EcsClusterCapacityProvidersDefaultCapacityProviderStrategy(
+                base=1,
+                capacity_provider="FARGATE",
+                weight=100
+            )
+            ]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_ecs_cluster_capacity_providers_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `capacity_providers` - (Optional) Set of names of one or more capacity providers to associate with the cluster. Valid values also include `FARGATE` and `FARGATE_SPOT`.
+* `cluster_name` - (Required, Forces new resource) Name of the ECS cluster to manage capacity providers for.
+* `default_capacity_provider_strategy` - (Optional) Set of capacity provider strategies to use by default for the cluster. Detailed below.
+
+### default_capacity_provider_strategy Configuration Block
+
+* `capacity_provider` - (Required) Name of the capacity provider.
+* `weight` - (Optional) The relative percentage of the total number of launched tasks that should use the specified capacity provider. The `weight` value is taken into consideration after the `base` count of tasks has been satisfied. Defaults to `0`.
+* `base` - (Optional) The number of tasks, at a minimum, to run on the specified capacity provider. Only one capacity provider in a capacity provider strategy can have a base defined. Defaults to `0`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Same as `cluster_name`.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import ECS cluster capacity providers using the `cluster_name` attribute. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import ECS cluster capacity providers using the `cluster_name` attribute. For example:
+
+```console
+% terraform import aws_ecs_cluster_capacity_providers.example my-cluster
+```
+
+<!-- cache-key: cdktf-0.18.0 input-07d58c0c07d75ffbdc73f076ed8b48e2079c33284e6a34a1e4cdf792f6d41841 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ecs_service.html.markdown b/website/docs/cdktf/python/r/ecs_service.html.markdown
new file mode 100644
index 00000000000..bf375d67be9
--- /dev/null
+++ b/website/docs/cdktf/python/r/ecs_service.html.markdown
@@ -0,0 +1,372 @@
+---
+subcategory: "ECS (Elastic Container)"
+layout: "aws"
+page_title: "AWS: aws_ecs_service"
+description: |-
+  Provides an ECS service.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ecs_service
+
+-> **Note:** To prevent a race condition during service deletion, make sure to set `depends_on` to the related `aws_iam_role_policy`; otherwise, the policy may be destroyed too soon and the ECS service will then get stuck in the `DRAINING` state.
+
+Provides an ECS service - effectively a task that is expected to run until an error occurs or a user terminates it (typically a webserver or a database).
+
+See [ECS Services section in AWS developer guide](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/ecs_services.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ecs_service import EcsService
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        EcsService(self, "mongo",
+            cluster=foo.id,
+            depends_on=[aws_iam_role_policy_foo],
+            desired_count=3,
+            iam_role=Token.as_string(aws_iam_role_foo.arn),
+            load_balancer=[EcsServiceLoadBalancer(
+                container_name="mongo",
+                container_port=8080,
+                target_group_arn=Token.as_string(aws_lb_target_group_foo.arn)
+            )
+            ],
+            name="mongodb",
+            ordered_placement_strategy=[EcsServiceOrderedPlacementStrategy(
+                field="cpu",
+                type="binpack"
+            )
+            ],
+            placement_constraints=[EcsServicePlacementConstraints(
+                expression="attribute:ecs.availability-zone in [us-west-2a, us-west-2b]",
+                type="memberOf"
+            )
+            ],
+            task_definition=Token.as_string(aws_ecs_task_definition_mongo.arn)
+        )
+```
+
+### Ignoring Changes to Desired Count
+
+You can utilize the generic Terraform resource [lifecycle configuration block](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html) with `ignore_changes` to create an ECS service with an initial count of running instances, then ignore any changes to that count caused externally (e.g., Application Autoscaling).
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from cdktf import TerraformResourceLifecycle
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ecs_service import EcsService
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, name):
+        super().__init__(scope, name)
+        EcsService(self, "example",
+            desired_count=2,
+            lifecycle=TerraformResourceLifecycle(
+                ignore_changes=[desired_count]
+            ),
+            name=name
+        )
+```
+
+### Daemon Scheduling Strategy
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ecs_service import EcsService
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        EcsService(self, "bar",
+            cluster=foo.id,
+            name="bar",
+            scheduling_strategy="DAEMON",
+            task_definition=Token.as_string(aws_ecs_task_definition_bar.arn)
+        )
+```
+
+### CloudWatch Deployment Alarms
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ecs_service import EcsService
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        EcsService(self, "example",
+            alarms=EcsServiceAlarms(
+                alarm_names=[Token.as_string(aws_cloudwatch_metric_alarm_example.alarm_name)],
+                enable=True,
+                rollback=True
+            ),
+            cluster=Token.as_string(aws_ecs_cluster_example.id),
+            name="example"
+        )
+```
+
+### External Deployment Controller
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ecs_service import EcsService
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        EcsService(self, "example",
+            cluster=Token.as_string(aws_ecs_cluster_example.id),
+            deployment_controller=EcsServiceDeploymentController(
+                type="EXTERNAL"
+            ),
+            name="example"
+        )
+```
+
+### Redeploy Service On Every Apply
+
+The key used with `triggers` is arbitrary.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ecs_service import EcsService
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, name):
+        super().__init__(scope, name)
+        EcsService(self, "example",
+            force_new_deployment=True,
+            triggers={
+                "redeployment": Token.as_string(Fn.timestamp())
+            },
+            name=name
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) Name of the service (up to 255 letters, numbers, hyphens, and underscores)
+
+The following arguments are optional:
+
+* `alarms` - (Optional) Information about the CloudWatch alarms. [See below](#alarms).
+* `capacity_provider_strategy` - (Optional) Capacity provider strategies to use for the service. Can be one or more. These can be updated without destroying and recreating the service only if `force_new_deployment = true` and not changing from 0 `capacity_provider_strategy` blocks to greater than 0, or vice versa. See below.
+* `cluster` - (Optional) ARN of an ECS cluster.
+* `deployment_circuit_breaker` - (Optional) Configuration block for deployment circuit breaker. See below.
+* `deployment_controller` - (Optional) Configuration block for deployment controller configuration. See below.
+* `deployment_maximum_percent` - (Optional) Upper limit (as a percentage of the service's desiredCount) of the number of running tasks that can be running in a service during a deployment. Not valid when using the `DAEMON` scheduling strategy.
+* `deployment_minimum_healthy_percent` - (Optional) Lower limit (as a percentage of the service's desiredCount) of the number of running tasks that must remain running and healthy in a service during a deployment.
+* `desired_count` - (Optional) Number of instances of the task definition to place and keep running. Defaults to 0. Do not specify if using the `DAEMON` scheduling strategy.
+* `enable_ecs_managed_tags` - (Optional) Specifies whether to enable Amazon ECS managed tags for the tasks within the service.
+* `enable_execute_command` - (Optional) Specifies whether to enable Amazon ECS Exec for the tasks within the service.
+* `force_new_deployment` - (Optional) Enable to force a new task deployment of the service. This can be used to update tasks to use a newer Docker image with same image/tag combination (e.g., `myimage:latest`), roll Fargate tasks onto a newer platform version, or immediately deploy `ordered_placement_strategy` and `placement_constraints` updates.
+* `health_check_grace_period_seconds` - (Optional) Seconds to ignore failing load balancer health checks on newly instantiated tasks to prevent premature shutdown, up to 2147483647. Only valid for services configured to use load balancers.
+* `iam_role` - (Optional) ARN of the IAM role that allows Amazon ECS to make calls to your load balancer on your behalf. This parameter is required if you are using a load balancer with your service, but only if your task definition does not use the `awsvpc` network mode. If using `awsvpc` network mode, do not specify this role. If your account has already created the Amazon ECS service-linked role, that role is used by default for your service unless you specify a role here.
+* `launch_type` - (Optional) Launch type on which to run your service. The valid values are `EC2`, `FARGATE`, and `EXTERNAL`. Defaults to `EC2`.
+* `load_balancer` - (Optional) Configuration block for load balancers. See below.
+* `network_configuration` - (Optional) Network configuration for the service. This parameter is required for task definitions that use the `awsvpc` network mode to receive their own Elastic Network Interface, and it is not supported for other network modes. See below.
+* `ordered_placement_strategy` - (Optional) Service level strategy rules that are taken into consideration during task placement. List from top to bottom in order of precedence. Updates to this configuration will take effect next task deployment unless `force_new_deployment` is enabled. The maximum number of `ordered_placement_strategy` blocks is `5`. See below.
+* `placement_constraints` - (Optional) Rules that are taken into consideration during task placement. Updates to this configuration will take effect next task deployment unless `force_new_deployment` is enabled. Maximum number of `placement_constraints` is `10`. See below.
+* `platform_version` - (Optional) Platform version on which to run your service. Only applicable for `launch_type` set to `FARGATE`. Defaults to `LATEST`. More information about Fargate platform versions can be found in the [AWS ECS User Guide](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/platform_versions.html).
+* `propagate_tags` - (Optional) Specifies whether to propagate the tags from the task definition or the service to the tasks. The valid values are `SERVICE` and `TASK_DEFINITION`.
+* `scheduling_strategy` - (Optional) Scheduling strategy to use for the service. The valid values are `REPLICA` and `DAEMON`. Defaults to `REPLICA`. Note that [*Tasks using the Fargate launch type or the `CODE_DEPLOY` or `EXTERNAL` deployment controller types don't support the `DAEMON` scheduling strategy*](https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_CreateService.html).
+* `service_connect_configuration` - (Optional) The ECS Service Connect configuration for this service to discover and connect to services, and be discovered by, and connected from, other services within a namespace. See below.
+* `service_registries` - (Optional) Service discovery registries for the service. The maximum number of `service_registries` blocks is `1`. See below.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `task_definition` - (Optional) Family and revision (`family:revision`) or full ARN of the task definition that you want to run in your service. Required unless using the `EXTERNAL` deployment controller. If a revision is not specified, the latest `ACTIVE` revision is used.
+* `triggers` - (Optional) Map of arbitrary keys and values that, when changed, will trigger an in-place update (redeployment). Useful with `timestamp()`. See example above.
+* `wait_for_steady_state` - (Optional) If `true`, Terraform will wait for the service to reach a steady state (like [`aws ecs wait services-stable`](https://docs.aws.amazon.com/cli/latest/reference/ecs/wait/services-stable.html)) before continuing. Default `false`.
+
+### alarms
+
+The `alarms` configuration block supports the following:
+
+* `alarm_names` - (Required) One or more CloudWatch alarm names.
+* `enable` - (Required) Determines whether to use the CloudWatch alarm option in the service deployment process.
+* `rollback` - (Required) Determines whether to configure Amazon ECS to roll back the service if a service deployment fails. If rollback is used, when a service deployment fails, the service is rolled back to the last deployment that completed successfully.
+
+### capacity_provider_strategy
+
+The `capacity_provider_strategy` configuration block supports the following:
+
+* `base` - (Optional) Number of tasks, at a minimum, to run on the specified capacity provider. Only one capacity provider in a capacity provider strategy can have a base defined.
+* `capacity_provider` - (Required) Short name of the capacity provider.
+* `weight` - (Required) Relative percentage of the total number of launched tasks that should use the specified capacity provider.
+
+### deployment_circuit_breaker
+
+The `deployment_circuit_breaker` configuration block supports the following:
+
+* `enable` - (Required) Whether to enable the deployment circuit breaker logic for the service.
+* `rollback` - (Required) Whether to enable Amazon ECS to roll back the service if a service deployment fails. If rollback is enabled, when a service deployment fails, the service is rolled back to the last deployment that completed successfully.
+
+### deployment_controller
+
+The `deployment_controller` configuration block supports the following:
+
+* `type` - (Optional) Type of deployment controller. Valid values: `CODE_DEPLOY`, `ECS`, `EXTERNAL`. Default: `ECS`.
+
+### load_balancer
+
+`load_balancer` supports the following:
+
+* `elb_name` - (Required for ELB Classic) Name of the ELB (Classic) to associate with the service.
+* `target_group_arn` - (Required for ALB/NLB) ARN of the Load Balancer target group to associate with the service.
+* `container_name` - (Required) Name of the container to associate with the load balancer (as it appears in a container definition).
+* `container_port` - (Required) Port on the container to associate with the load balancer.
+
+-> **Version note:** Multiple `load_balancer` configuration block support was added in Terraform AWS Provider version 2.22.0. This allows configuration of [ECS service support for multiple target groups](https://aws.amazon.com/about-aws/whats-new/2019/07/amazon-ecs-services-now-support-multiple-load-balancer-target-groups/).
+
+### network_configuration
+
+`network_configuration` support the following:
+
+* `subnets` - (Required) Subnets associated with the task or service.
+* `security_groups` - (Optional) Security groups associated with the task or service. If you do not specify a security group, the default security group for the VPC is used.
+* `assign_public_ip` - (Optional) Assign a public IP address to the ENI (Fargate launch type only). Valid values are `true` or `false`. Default `false`.
+
+For more information, see [Task Networking](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-networking.html)
+
+### ordered_placement_strategy
+
+`ordered_placement_strategy` supports the following:
+
+* `type` - (Required) Type of placement strategy. Must be one of: `binpack`, `random`, or `spread`
+* `field` - (Optional) For the `spread` placement strategy, valid values are `instanceId` (or `host`,
+ which has the same effect), or any platform or custom attribute that is applied to a container instance.
+ For the `binpack` type, valid values are `memory` and `cpu`. For the `random` type, this attribute is not
+ needed. For more information, see [Placement Strategy](https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_PlacementStrategy.html).
+
+-> **Note:** for `spread`, `host` and `instanceId` will be normalized, by AWS, to be `instanceId`. This means the statefile will show `instanceId` but your config will differ if you use `host`.
+
+### placement_constraints
+
+`placement_constraints` support the following:
+
+* `type` - (Required) Type of constraint. The only valid values at this time are `memberOf` and `distinctInstance`.
+* `expression` -  (Optional) Cluster Query Language expression to apply to the constraint. Does not need to be specified for the `distinctInstance` type. For more information, see [Cluster Query Language in the Amazon EC2 Container Service Developer Guide](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/cluster-query-language.html).
+
+### service_registries
+
+`service_registries` support the following:
+
+* `registry_arn` - (Required) ARN of the Service Registry. The currently supported service registry is Amazon Route 53 Auto Naming Service(`aws_service_discovery_service`). For more information, see [Service](https://docs.aws.amazon.com/Route53/latest/APIReference/API_autonaming_Service.html)
+* `port` - (Optional) Port value used if your Service Discovery service specified an SRV record.
+* `container_port` - (Optional) Port value, already specified in the task definition, to be used for your service discovery service.
+* `container_name` - (Optional) Container name value, already specified in the task definition, to be used for your service discovery service.
+
+### service_connect_configuration
+
+`service_connect_configuration` supports the following:
+
+* `enabled` - (Required) Specifies whether to use Service Connect with this service.
+* `log_configuration` - (Optional) The log configuration for the container. See below.
+* `namespace` - (Optional) The namespace name or ARN of the [`aws_service_discovery_http_namespace`](/docs/providers/aws/r/service_discovery_http_namespace.html) for use with Service Connect.
+* `service` - (Optional) The list of Service Connect service objects. See below.
+
+### log_configuration
+
+`log_configuration` supports the following:
+
+* `log_driver` - (Required) The log driver to use for the container.
+* `options` - (Optional) The configuration options to send to the log driver.
+* `secret_option` - (Optional) The secrets to pass to the log configuration. See below.
+
+### secret_option
+
+`secret_option` supports the following:
+
+* `name` - (Required) The name of the secret.
+* `value_from` - (Required) The secret to expose to the container. The supported values are either the full ARN of the AWS Secrets Manager secret or the full ARN of the parameter in the SSM Parameter Store.
+
+### service
+
+`service` supports the following:
+
+* `client_alias` - (Optional) The list of client aliases for this Service Connect service. You use these to assign names that can be used by client applications. The maximum number of client aliases that you can have in this list is 1. See below.
+* `discovery_name` - (Optional) The name of the new AWS Cloud Map service that Amazon ECS creates for this Amazon ECS service.
+* `ingress_port_override` - (Optional) The port number for the Service Connect proxy to listen on.
+* `port_name` - (Required) The name of one of the `portMappings` from all the containers in the task definition of this Amazon ECS service.
+
+### client_alias
+
+`client_alias` supports the following:
+
+* `dns_name` - (Optional) The name that you use in the applications of client tasks to connect to this service.
+* `port` - (Required) The listening port number for the Service Connect proxy. This port is available inside of all of the tasks within the same namespace.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `cluster` - Amazon Resource Name (ARN) of cluster which the service runs on.
+* `desired_count` - Number of instances of the task definition.
+* `iam_role` - ARN of IAM role used for ELB.
+* `id` - ARN that identifies the service.
+* `name` - Name of the service.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `20m`)
+- `update` - (Default `20m`)
+- `delete` - (Default `20m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import ECS services using the `name` together with ecs cluster `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import ECS services using the `name` together with ecs cluster `name`. For example:
+
+```console
+% terraform import aws_ecs_service.imported cluster-name/service-name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-0c2dba4511f8b41de16532abefaed14f7708fa06b49a3887e0b136935976402d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ecs_tag.html.markdown b/website/docs/cdktf/python/r/ecs_tag.html.markdown
new file mode 100644
index 00000000000..700046c5520
--- /dev/null
+++ b/website/docs/cdktf/python/r/ecs_tag.html.markdown
@@ -0,0 +1,81 @@
+---
+subcategory: "ECS (Elastic Container)"
+layout: "aws"
+page_title: "AWS: aws_ecs_tag"
+description: |-
+  Manages an individual ECS resource tag
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ecs_tag
+
+Manages an individual ECS resource tag. This resource should only be used in cases where ECS resources are created outside Terraform (e.g., ECS Clusters implicitly created by Batch Compute Environments).
+
+~> **NOTE:** This tagging resource should not be combined with the Terraform resource for managing the parent resource. For example, using `aws_ecs_cluster` and `aws_ecs_tag` to manage tags of the same ECS Cluster will cause a perpetual difference where the `aws_ecs_cluster` resource will try to remove the tag being added by the `aws_ecs_tag` resource.
+
+~> **NOTE:** This tagging resource does not use the [provider `ignore_tags` configuration](/docs/providers/aws/index.html#ignore_tags).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.batch_compute_environment import BatchComputeEnvironment
+from imports.aws.ecs_tag import EcsTag
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = BatchComputeEnvironment(self, "example",
+            compute_environment_name="example",
+            service_role=Token.as_string(aws_iam_role_example.arn),
+            type="UNMANAGED"
+        )
+        aws_ecs_tag_example = EcsTag(self, "example_1",
+            key="Name",
+            resource_arn=example.ecs_cluster_arn,
+            value="Hello World"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_ecs_tag_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `resource_arn` - (Required) Amazon Resource Name (ARN) of the ECS resource to tag.
+* `key` - (Required) Tag name.
+* `value` - (Required) Tag value.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - ECS resource identifier and key, separated by a comma (`,`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_ecs_tag` using the ECS resource identifier and key, separated by a comma (`,`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_ecs_tag` using the ECS resource identifier and key, separated by a comma (`,`). For example:
+
+```console
+% terraform import aws_ecs_tag.example arn:aws:ecs:us-east-1:123456789012:cluster/example,Name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-6f495a4add8be734874309797134ad568af10ab0883471ac6917e03b469e68e0 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ecs_task_definition.html.markdown b/website/docs/cdktf/python/r/ecs_task_definition.html.markdown
new file mode 100644
index 00000000000..b860dc67d96
--- /dev/null
+++ b/website/docs/cdktf/python/r/ecs_task_definition.html.markdown
@@ -0,0 +1,382 @@
+---
+subcategory: "ECS (Elastic Container)"
+layout: "aws"
+page_title: "AWS: aws_ecs_task_definition"
+description: |-
+  Manages a revision of an ECS task definition.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ecs_task_definition
+
+Manages a revision of an ECS task definition to be used in `aws_ecs_service`.
+
+## Example Usage
+
+### Basic Example
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ecs_task_definition import EcsTaskDefinition
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        EcsTaskDefinition(self, "service",
+            container_definitions=Token.as_string(
+                Fn.jsonencode([{
+                    "cpu": 10,
+                    "essential": True,
+                    "image": "service-first",
+                    "memory": 512,
+                    "name": "first",
+                    "port_mappings": [{
+                        "container_port": 80,
+                        "host_port": 80
+                    }
+                    ]
+                }, {
+                    "cpu": 10,
+                    "essential": True,
+                    "image": "service-second",
+                    "memory": 256,
+                    "name": "second",
+                    "port_mappings": [{
+                        "container_port": 443,
+                        "host_port": 443
+                    }
+                    ]
+                }
+                ])),
+            family="service",
+            placement_constraints=[EcsTaskDefinitionPlacementConstraints(
+                expression="attribute:ecs.availability-zone in [us-west-2a, us-west-2b]",
+                type="memberOf"
+            )
+            ],
+            volume=[EcsTaskDefinitionVolume(
+                host_path="/ecs/service-storage",
+                name="service-storage"
+            )
+            ]
+        )
+```
+
+### With AppMesh Proxy
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, Fn, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ecs_task_definition import EcsTaskDefinition
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        EcsTaskDefinition(self, "service",
+            container_definitions=Token.as_string(
+                Fn.file("task-definitions/service.json")),
+            family="service",
+            proxy_configuration=EcsTaskDefinitionProxyConfiguration(
+                container_name="applicationContainerName",
+                properties={
+                    "AppPorts": "8080",
+                    "EgressIgnoredIPs": "169.254.170.2,169.254.169.254",
+                    "IgnoredUID": "1337",
+                    "ProxyEgressPort": Token.as_string(15001),
+                    "ProxyIngressPort": Token.as_string(15000)
+                },
+                type="APPMESH"
+            )
+        )
+```
+
+### Example Using `docker_volume_configuration`
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ecs_task_definition import EcsTaskDefinition
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        EcsTaskDefinition(self, "service",
+            container_definitions=Token.as_string(
+                Fn.file("task-definitions/service.json")),
+            family="service",
+            volume=[EcsTaskDefinitionVolume(
+                docker_volume_configuration=EcsTaskDefinitionVolumeDockerVolumeConfiguration(
+                    autoprovision=True,
+                    driver="local",
+                    driver_opts={
+                        "device": "${" + fs.dns_name + "}:/",
+                        "o": "addr=${" + fs.dns_name + "},rsize=1048576,wsize=1048576,hard,timeo=600,retrans=2,noresvport",
+                        "type": "nfs"
+                    },
+                    scope="shared"
+                ),
+                name="service-storage"
+            )
+            ]
+        )
+```
+
+### Example Using `efs_volume_configuration`
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ecs_task_definition import EcsTaskDefinition
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        EcsTaskDefinition(self, "service",
+            container_definitions=Token.as_string(
+                Fn.file("task-definitions/service.json")),
+            family="service",
+            volume=[EcsTaskDefinitionVolume(
+                efs_volume_configuration=EcsTaskDefinitionVolumeEfsVolumeConfiguration(
+                    authorization_config=EcsTaskDefinitionVolumeEfsVolumeConfigurationAuthorizationConfig(
+                        access_point_id=test.id,
+                        iam="ENABLED"
+                    ),
+                    file_system_id=fs.id,
+                    root_directory="/opt/data",
+                    transit_encryption="ENABLED",
+                    transit_encryption_port=2999
+                ),
+                name="service-storage"
+            )
+            ]
+        )
+```
+
+### Example Using `fsx_windows_file_server_volume_configuration`
+
+```terraform
+resource "aws_ecs_task_definition" "service" {
+  family                = "service"
+  container_definitions = file("task-definitions/service.json")
+
+  volume {
+    name = "service-storage"
+
+    fsx_windows_file_server_volume_configuration {
+      file_system_id = aws_fsx_windows_file_system.test.id
+      root_directory = "\\data"
+
+      authorization_config {
+        credentials_parameter = aws_secretsmanager_secret_version.test.arn
+        domain                = aws_directory_service_directory.test.name
+      }
+    }
+  }
+}
+
+resource "aws_secretsmanager_secret_version" "test" {
+  secret_id     = aws_secretsmanager_secret.test.id
+  secret_string = jsonencode({ username : "admin", password : aws_directory_service_directory.test.password })
+}
+```
+
+### Example Using `container_definitions` and `inference_accelerator`
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ecs_task_definition import EcsTaskDefinition
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        EcsTaskDefinition(self, "test",
+            container_definitions="[\n  {\n    \"cpu\": 10,\n    \"command\": [\"sleep\", \"10\"],\n    \"entryPoint\": [\"/\"],\n    \"environment\": [\n      {\"name\": \"VARNAME\", \"value\": \"VARVAL\"}\n    ],\n    \"essential\": true,\n    \"image\": \"jenkins\",\n    \"memory\": 128,\n    \"name\": \"jenkins\",\n    \"portMappings\": [\n      {\n        \"containerPort\": 80,\n        \"hostPort\": 8080\n      }\n    ],\n        \"resourceRequirements\":[\n            {\n                \"type\":\"InferenceAccelerator\",\n                \"value\":\"device_1\"\n            }\n        ]\n  }\n]\n\n",
+            family="test",
+            inference_accelerator=[EcsTaskDefinitionInferenceAccelerator(
+                device_name="device_1",
+                device_type="eia1.medium"
+            )
+            ]
+        )
+```
+
+### Example Using `runtime_platform` and `fargate`
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ecs_task_definition import EcsTaskDefinition
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        EcsTaskDefinition(self, "test",
+            container_definitions="[\n  {\n    \"name\": \"iis\",\n    \"image\": \"mcr.microsoft.com/windows/servercore/iis\",\n    \"cpu\": 1024,\n    \"memory\": 2048,\n    \"essential\": true\n  }\n]\n\n",
+            cpu=Token.as_string(1024),
+            family="test",
+            memory=Token.as_string(2048),
+            network_mode="awsvpc",
+            requires_compatibilities=["FARGATE"],
+            runtime_platform=EcsTaskDefinitionRuntimePlatform(
+                cpu_architecture="X86_64",
+                operating_system_family="WINDOWS_SERVER_2019_CORE"
+            )
+        )
+```
+
+## Argument Reference
+
+~> **NOTE:** Proper escaping is required for JSON field values containing quotes (`"`) such as `environment` values. If directly setting the JSON, they should be escaped as `\"` in the JSON,  e.g., `"value": "I \"love\" escaped quotes"`. If using a Terraform variable value, they should be escaped as `\\\"` in the variable, e.g., `value = "I \\\"love\\\" escaped quotes"` in the variable and `"value": "${var.myvariable}"` in the JSON.
+
+The following arguments are required:
+
+* `container_definitions` - (Required) A list of valid [container definitions](http://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_ContainerDefinition.html) provided as a single valid JSON document. Please note that you should only provide values that are part of the container definition document. For a detailed description of what parameters are available, see the [Task Definition Parameters](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task_definition_parameters.html) section from the official [Developer Guide](https://docs.aws.amazon.com/AmazonECS/latest/developerguide).
+* `family` - (Required) A unique name for your task definition.
+
+The following arguments are optional:
+
+* `cpu` - (Optional) Number of cpu units used by the task. If the `requires_compatibilities` is `FARGATE` this field is required.
+* `execution_role_arn` - (Optional) ARN of the task execution role that the Amazon ECS container agent and the Docker daemon can assume.
+* `inference_accelerator` - (Optional) Configuration block(s) with Inference Accelerators settings. [Detailed below.](#inference_accelerator)
+* `ipc_mode` - (Optional) IPC resource namespace to be used for the containers in the task The valid values are `host`, `task`, and `none`.
+* `memory` - (Optional) Amount (in MiB) of memory used by the task. If the `requires_compatibilities` is `FARGATE` this field is required.
+* `network_mode` - (Optional) Docker networking mode to use for the containers in the task. Valid values are `none`, `bridge`, `awsvpc`, and `host`.
+* `runtime_platform` - (Optional) Configuration block for [runtime_platform](#runtime_platform) that containers in your task may use.
+* `pid_mode` - (Optional) Process namespace to use for the containers in the task. The valid values are `host` and `task`.
+* `placement_constraints` - (Optional) Configuration block for rules that are taken into consideration during task placement. Maximum number of `placement_constraints` is `10`. [Detailed below](#placement_constraints).
+* `proxy_configuration` - (Optional) Configuration block for the App Mesh proxy. [Detailed below.](#proxy_configuration)
+* `ephemeral_storage` - (Optional)  The amount of ephemeral storage to allocate for the task. This parameter is used to expand the total amount of ephemeral storage available, beyond the default amount, for tasks hosted on AWS Fargate. See [Ephemeral Storage](#ephemeral_storage).
+* `requires_compatibilities` - (Optional) Set of launch types required by the task. The valid values are `EC2` and `FARGATE`.
+* `skip_destroy` - (Optional) Whether to retain the old revision when the resource is destroyed or replacement is necessary. Default is `false`.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `task_role_arn` - (Optional) ARN of IAM role that allows your Amazon ECS container task to make calls to other AWS services.
+* `volume` - (Optional) Configuration block for [volumes](#volume) that containers in your task may use. Detailed below.
+
+### volume
+
+* `docker_volume_configuration` - (Optional) Configuration block to configure a [docker volume](#docker_volume_configuration). Detailed below.
+* `efs_volume_configuration` - (Optional) Configuration block for an [EFS volume](#efs_volume_configuration). Detailed below.
+* `fsx_windows_file_server_volume_configuration` - (Optional) Configuration block for an [FSX Windows File Server volume](#fsx_windows_file_server_volume_configuration). Detailed below.
+* `host_path` - (Optional) Path on the host container instance that is presented to the container. If not set, ECS will create a nonpersistent data volume that starts empty and is deleted after the task has finished.
+* `name` - (Required) Name of the volume. This name is referenced in the `sourceVolume`
+parameter of container definition in the `mountPoints` section.
+
+### docker_volume_configuration
+
+For more information, see [Specifying a Docker volume in your Task Definition Developer Guide](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/docker-volumes.html#specify-volume-config)
+
+* `autoprovision` - (Optional) If this value is `true`, the Docker volume is created if it does not already exist. *Note*: This field is only used if the scope is `shared`.
+* `driver_opts` - (Optional) Map of Docker driver specific options.
+* `driver` - (Optional) Docker volume driver to use. The driver value must match the driver name provided by Docker because it is used for task placement.
+* `labels` - (Optional) Map of custom metadata to add to your Docker volume.
+* `scope` - (Optional) Scope for the Docker volume, which determines its lifecycle, either `task` or `shared`.  Docker volumes that are scoped to a `task` are automatically provisioned when the task starts and destroyed when the task stops. Docker volumes that are scoped as `shared` persist after the task stops.
+
+### efs_volume_configuration
+
+For more information, see [Specifying an EFS volume in your Task Definition Developer Guide](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/efs-volumes.html#specify-efs-config)
+
+* `file_system_id` - (Required) ID of the EFS File System.
+* `root_directory` - (Optional) Directory within the Amazon EFS file system to mount as the root directory inside the host. If this parameter is omitted, the root of the Amazon EFS volume will be used. Specifying / will have the same effect as omitting this parameter. This argument is ignored when using `authorization_config`.
+* `transit_encryption` - (Optional) Whether or not to enable encryption for Amazon EFS data in transit between the Amazon ECS host and the Amazon EFS server. Transit encryption must be enabled if Amazon EFS IAM authorization is used. Valid values: `ENABLED`, `DISABLED`. If this parameter is omitted, the default value of `DISABLED` is used.
+* `transit_encryption_port` - (Optional) Port to use for transit encryption. If you do not specify a transit encryption port, it will use the port selection strategy that the Amazon EFS mount helper uses.
+* `authorization_config` - (Optional) Configuration block for [authorization](#authorization_config) for the Amazon EFS file system. Detailed below.
+
+### runtime_platform
+
+* `operating_system_family` - (Optional) If the `requires_compatibilities` is `FARGATE` this field is required; must be set to a valid option from the [operating system family in the runtime platform](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task_definition_parameters.html#runtime-platform) setting
+* `cpu_architecture` - (Optional) Must be set to either `X86_64` or `ARM64`; see [cpu architecture](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task_definition_parameters.html#runtime-platform)
+
+#### authorization_config
+
+* `access_point_id` - (Optional) Access point ID to use. If an access point is specified, the root directory value will be relative to the directory set for the access point. If specified, transit encryption must be enabled in the EFSVolumeConfiguration.
+* `iam` - (Optional) Whether or not to use the Amazon ECS task IAM role defined in a task definition when mounting the Amazon EFS file system. If enabled, transit encryption must be enabled in the EFSVolumeConfiguration. Valid values: `ENABLED`, `DISABLED`. If this parameter is omitted, the default value of `DISABLED` is used.
+
+### fsx_windows_file_server_volume_configuration
+
+For more information, see [Specifying an FSX Windows File Server volume in your Task Definition Developer Guide](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/tutorial-wfsx-volumes.html)
+
+* `file_system_id` - (Required) The Amazon FSx for Windows File Server file system ID to use.
+* `root_directory` - (Required) The directory within the Amazon FSx for Windows File Server file system to mount as the root directory inside the host.
+* `authorization_config` - (Required) Configuration block for [authorization](#authorization_config) for the Amazon FSx for Windows File Server file system detailed below.
+
+#### authorization_config
+
+* `credentials_parameter` - (Required) The authorization credential option to use. The authorization credential options can be provided using either the Amazon Resource Name (ARN) of an AWS Secrets Manager secret or AWS Systems Manager Parameter Store parameter. The ARNs refer to the stored credentials.
+* `domain` - (Required) A fully qualified domain name hosted by an AWS Directory Service Managed Microsoft AD (Active Directory) or self-hosted AD on Amazon EC2.
+
+### placement_constraints
+
+* `expression` -  (Optional) Cluster Query Language expression to apply to the constraint. For more information, see [Cluster Query Language in the Amazon EC2 Container Service Developer Guide](http://docs.aws.amazon.com/AmazonECS/latest/developerguide/cluster-query-language.html).
+* `type` - (Required) Type of constraint. Use `memberOf` to restrict selection to a group of valid candidates. Note that `distinctInstance` is not supported in task definitions.
+
+### proxy_configuration
+
+* `container_name` - (Required) Name of the container that will serve as the App Mesh proxy.
+* `properties` - (Required) Set of network configuration parameters to provide the Container Network Interface (CNI) plugin, specified a key-value mapping.
+* `type` - (Optional) Proxy type. The default value is `APPMESH`. The only supported value is `APPMESH`.
+
+### ephemeral_storage
+
+* `size_in_gib` - (Required) The total amount, in GiB, of ephemeral storage to set for the task. The minimum supported value is `21` GiB and the maximum supported value is `200` GiB.
+
+### inference_accelerator
+
+* `device_name` - (Required) Elastic Inference accelerator device name. The deviceName must also be referenced in a container definition as a ResourceRequirement.
+* `device_type` - (Required) Elastic Inference accelerator type to use.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Full ARN of the Task Definition (including both `family` and `revision`).
+* `arn_without_revision` - ARN of the Task Definition with the trailing `revision` removed. This may be useful for situations where the latest task definition is always desired. If a revision isn't specified, the latest ACTIVE revision is used. See the [AWS documentation](https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_StartTask.html#ECS-StartTask-request-taskDefinition) for details.
+* `revision` - Revision of the task in a particular family.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import ECS Task Definitions using their ARNs. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import ECS Task Definitions using their ARNs. For example:
+
+```console
+% terraform import aws_ecs_task_definition.example arn:aws:ecs:us-east-1:012345678910:task-definition/mytaskfamily:123
+```
+
+<!-- cache-key: cdktf-0.18.0 input-e600d146b2b55ceeb9bc9361167e95241f61a5b3e90831c8b6a3c0cb748b8f00 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ecs_task_set.html.markdown b/website/docs/cdktf/python/r/ecs_task_set.html.markdown
new file mode 100644
index 00000000000..0597dcccbd5
--- /dev/null
+++ b/website/docs/cdktf/python/r/ecs_task_set.html.markdown
@@ -0,0 +1,172 @@
+---
+subcategory: "ECS (Elastic Container)"
+layout: "aws"
+page_title: "AWS: aws_ecs_task_set"
+description: |-
+  Provides an ECS task set.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ecs_task_set
+
+Provides an ECS task set - effectively a task that is expected to run until an error occurs or a user terminates it (typically a webserver or a database).
+
+See [ECS Task Set section in AWS developer guide](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/deployment-type-external.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ecs_task_set import EcsTaskSet
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        EcsTaskSet(self, "example",
+            cluster=Token.as_string(aws_ecs_cluster_example.id),
+            load_balancer=[EcsTaskSetLoadBalancer(
+                container_name="mongo",
+                container_port=8080,
+                target_group_arn=Token.as_string(aws_lb_target_group_example.arn)
+            )
+            ],
+            service=Token.as_string(aws_ecs_service_example.id),
+            task_definition=Token.as_string(aws_ecs_task_definition_example.arn)
+        )
+```
+
+### Ignoring Changes to Scale
+
+You can utilize the generic Terraform resource [lifecycle configuration block](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html) with `ignore_changes` to create an ECS service with an initial count of running instances, then ignore any changes to that count caused externally (e.g. Application Autoscaling).
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from cdktf import TerraformResourceLifecycle
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ecs_task_set import EcsTaskSet
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, cluster, service, taskDefinition):
+        super().__init__(scope, name)
+        EcsTaskSet(self, "example",
+            lifecycle=TerraformResourceLifecycle(
+                ignore_changes=["scale"]
+            ),
+            scale=EcsTaskSetScale(
+                value=50
+            ),
+            cluster=cluster,
+            service=service,
+            task_definition=task_definition
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `service` - (Required) The short name or ARN of the ECS service.
+* `cluster` - (Required) The short name or ARN of the cluster that hosts the service to create the task set in.
+* `task_definition` - (Required) The family and revision (`family:revision`) or full ARN of the task definition that you want to run in your service.
+
+The following arguments are optional:
+
+* `capacity_provider_strategy` - (Optional) The capacity provider strategy to use for the service. Can be one or more.  [Defined below](#capacity_provider_strategy).
+* `external_id` - (Optional) The external ID associated with the task set.
+* `force_delete` - (Optional) Whether to allow deleting the task set without waiting for scaling down to 0. You can force a task set to delete even if it's in the process of scaling a resource. Normally, Terraform drains all the tasks before deleting the task set. This bypasses that behavior and potentially leaves resources dangling.
+* `launch_type` - (Optional) The launch type on which to run your service. The valid values are `EC2`, `FARGATE`, and `EXTERNAL`. Defaults to `EC2`.
+* `load_balancer` - (Optional) Details on load balancers that are used with a task set. [Detailed below](#load_balancer).
+* `platform_version` - (Optional) The platform version on which to run your service. Only applicable for `launch_type` set to `FARGATE`. Defaults to `LATEST`. More information about Fargate platform versions can be found in the [AWS ECS User Guide](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/platform_versions.html).
+* `network_configuration` - (Optional) The network configuration for the service. This parameter is required for task definitions that use the `awsvpc` network mode to receive their own Elastic Network Interface, and it is not supported for other network modes. [Detailed below](#network_configuration).
+* `scale` - (Optional) A floating-point percentage of the desired number of tasks to place and keep running in the task set. [Detailed below](#scale).
+* `service_registries` - (Optional) The service discovery registries for the service. The maximum number of `service_registries` blocks is `1`. [Detailed below](#service_registries).
+* `tags` - (Optional) A map of tags to assign to the file system. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level. If you have set `copy_tags_to_backups` to true, and you specify one or more tags, no existing file system tags are copied from the file system to the backup.
+* `wait_until_stable` - (Optional) Whether `terraform` should wait until the task set has reached `STEADY_STATE`.
+* `wait_until_stable_timeout` - (Optional) Wait timeout for task set to reach `STEADY_STATE`. Valid time units include `ns`, `us` (or `µs`), `ms`, `s`, `m`, and `h`. Default `10m`.
+
+## capacity_provider_strategy
+
+The `capacity_provider_strategy` configuration block supports the following:
+
+* `capacity_provider` - (Required) The short name or full Amazon Resource Name (ARN) of the capacity provider.
+* `weight` - (Required) The relative percentage of the total number of launched tasks that should use the specified capacity provider.
+* `base` - (Optional) The number of tasks, at a minimum, to run on the specified capacity provider. Only one capacity provider in a capacity provider strategy can have a base defined.
+
+## load_balancer
+
+The `load_balancer` configuration block supports the following:
+
+* `container_name` - (Required) The name of the container to associate with the load balancer (as it appears in a container definition).
+* `load_balancer_name` - (Optional, Required for ELB Classic) The name of the ELB (Classic) to associate with the service.
+* `target_group_arn` - (Optional, Required for ALB/NLB) The ARN of the Load Balancer target group to associate with the service.
+* `container_port` - (Optional) The port on the container to associate with the load balancer. Defaults to `0` if not specified.
+
+~> **Note:** Specifying multiple `load_balancer` configurations is still not supported by AWS for ECS task set.
+
+## network_configuration
+
+The `network_configuration` configuration block supports the following:
+
+* `subnets` - (Required) The subnets associated with the task or service. Maximum of 16.
+* `security_groups` - (Optional) The security groups associated with the task or service. If you do not specify a security group, the default security group for the VPC is used. Maximum of 5.
+* `assign_public_ip` - (Optional) Whether to assign a public IP address to the ENI (`FARGATE` launch type only). Valid values are `true` or `false`. Default `false`.
+
+For more information, see [Task Networking](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-networking.html).
+
+## scale
+
+The `scale` configuration block supports the following:
+
+* `unit` - (Optional) The unit of measure for the scale value. Default: `PERCENT`.
+* `value` - (Optional) The value, specified as a percent total of a service's `desiredCount`, to scale the task set. Defaults to `0` if not specified. Accepted values are numbers between 0.0 and 100.0.
+
+## service_registries
+
+`service_registries` support the following:
+
+* `registry_arn` - (Required) The ARN of the Service Registry. The currently supported service registry is Amazon Route 53 Auto Naming Service([`aws_service_discovery_service` resource](/docs/providers/aws/r/service_discovery_service.html)). For more information, see [Service](https://docs.aws.amazon.com/Route53/latest/APIReference/API_autonaming_Service.html).
+* `port` - (Optional) The port value used if your Service Discovery service specified an SRV record.
+* `container_port` - (Optional) The port value, already specified in the task definition, to be used for your service discovery service.
+* `container_name` - (Optional) The container name value, already specified in the task definition, to be used for your service discovery service.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The `task_set_id`, `service` and `cluster` separated by commas (`,`).
+* `arn` - The Amazon Resource Name (ARN) that identifies the task set.
+* `stability_status` - The stability status. This indicates whether the task set has reached a steady state.
+* `status` - The status of the task set.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `task_set_id` - The ID of the task set.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import ECS Task Sets using the `task_set_id`, `service`, and `cluster` separated by commas (`,`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import ECS Task Sets using the `task_set_id`, `service`, and `cluster` separated by commas (`,`). For example:
+
+```console
+% terraform import aws_ecs_task_set.example ecs-svc/7177320696926227436,arn:aws:ecs:us-west-2:123456789101:service/example/example-1234567890,arn:aws:ecs:us-west-2:123456789101:cluster/example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-0c23f439c10bf62237c2978dae4ddbb20ffe6a937ff6356657670867f1942259 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/efs_access_point.html.markdown b/website/docs/cdktf/python/r/efs_access_point.html.markdown
new file mode 100644
index 00000000000..79b66ed9df0
--- /dev/null
+++ b/website/docs/cdktf/python/r/efs_access_point.html.markdown
@@ -0,0 +1,92 @@
+---
+subcategory: "EFS (Elastic File System)"
+layout: "aws"
+page_title: "AWS: aws_efs_access_point"
+description: |-
+  Provides an Elastic File System (EFS) access point.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_efs_access_point
+
+Provides an Elastic File System (EFS) access point.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.efs_access_point import EfsAccessPoint
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        EfsAccessPoint(self, "test",
+            file_system_id=foo.id
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `file_system_id` - (Required) ID of the file system for which the access point is intended.
+* `posix_user` - (Optional) Operating system user and group applied to all file system requests made using the access point. [Detailed](#posix_user) below.
+* `root_directory`- (Optional) Directory on the Amazon EFS file system that the access point provides access to. [Detailed](#root_directory) below.
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### posix_user
+
+* `gid` - (Required) POSIX group ID used for all file system operations using this access point.
+* `secondary_gids` - (Optional) Secondary POSIX group IDs used for all file system operations using this access point.
+* `uid` - (Required) POSIX user ID used for all file system operations using this access point.
+
+### root_directory
+
+The access point exposes the specified file system path as the root directory of your file system to applications using the access point. NFS clients using the access point can only access data in the access point's RootDirectory and it's subdirectories.
+
+* `creation_info` - (Optional) POSIX IDs and permissions to apply to the access point's Root Directory. See [Creation Info](#creation_info) below.
+* `path` - (Optional) Path on the EFS file system to expose as the root directory to NFS clients using the access point to access the EFS file system. A path can have up to four subdirectories. If the specified path does not exist, you are required to provide `creation_info`.
+
+### creation_info
+
+If the `path` specified does not exist, EFS creates the root directory using the `creation_info` settings when a client connects to an access point.
+
+* `owner_gid` - (Required) POSIX group ID to apply to the `root_directory`.
+* `owner_uid` - (Required) POSIX user ID to apply to the `root_directory`.
+* `permissions` - (Required) POSIX permissions to apply to the RootDirectory, in the format of an octal number representing the file's mode bits.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the access point.
+* `file_system_arn` - ARN of the file system.
+* `id` - ID of the access point.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import the EFS access points using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import the EFS access points using the `id`. For example:
+
+```console
+% terraform import aws_efs_access_point.test fsap-52a643fb
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ffd407eb1dbab3cdcf58701fd44811aa2c2bcc1408ea548ad5726f0832c16821 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/efs_backup_policy.html.markdown b/website/docs/cdktf/python/r/efs_backup_policy.html.markdown
new file mode 100644
index 00000000000..16e65eedb80
--- /dev/null
+++ b/website/docs/cdktf/python/r/efs_backup_policy.html.markdown
@@ -0,0 +1,80 @@
+---
+subcategory: "EFS (Elastic File System)"
+layout: "aws"
+page_title: "AWS: aws_efs_backup_policy"
+description: |-
+  Provides an Elastic File System (EFS) Backup Policy resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_efs_backup_policy
+
+Provides an Elastic File System (EFS) Backup Policy resource.
+Backup policies turn automatic backups on or off for an existing file system.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.efs_backup_policy import EfsBackupPolicy
+from imports.aws.efs_file_system import EfsFileSystem
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        fs = EfsFileSystem(self, "fs",
+            creation_token="my-product"
+        )
+        EfsBackupPolicy(self, "policy",
+            backup_policy=EfsBackupPolicyBackupPolicy(
+                status="ENABLED"
+            ),
+            file_system_id=fs.id
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `file_system_id` - (Required) The ID of the EFS file system.
+* `backup_policy` - (Required) A backup_policy object (documented below).
+
+### Backup Policy Arguments
+
+`backup_policy` supports the following arguments:
+
+* `status` - (Required) A status of the backup policy. Valid values: `ENABLED`, `DISABLED`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID that identifies the file system (e.g., fs-ccfc0d65).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import the EFS backup policies using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import the EFS backup policies using the `id`. For example:
+
+```console
+% terraform import aws_efs_backup_policy.example fs-6fa144c6
+```
+
+<!-- cache-key: cdktf-0.18.0 input-2eaef1b32aa6d84fbacde458faaad79654ff49b6670f288a4068fb17b6e3960c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/efs_file_system.html.markdown b/website/docs/cdktf/python/r/efs_file_system.html.markdown
new file mode 100644
index 00000000000..273596db82e
--- /dev/null
+++ b/website/docs/cdktf/python/r/efs_file_system.html.markdown
@@ -0,0 +1,125 @@
+---
+subcategory: "EFS (Elastic File System)"
+layout: "aws"
+page_title: "AWS: aws_efs_file_system"
+description: |-
+  Provides an Elastic File System (EFS) File System resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_efs_file_system
+
+Provides an Elastic File System (EFS) File System resource.
+
+## Example Usage
+
+### EFS File System w/ tags
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.efs_file_system import EfsFileSystem
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        EfsFileSystem(self, "foo",
+            creation_token="my-product",
+            tags={
+                "Name": "MyProduct"
+            }
+        )
+```
+
+### Using lifecycle policy
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.efs_file_system import EfsFileSystem
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        EfsFileSystem(self, "foo_with_lifecyle_policy",
+            creation_token="my-product",
+            lifecycle_policy=[EfsFileSystemLifecyclePolicy(
+                transition_to_ia="AFTER_30_DAYS"
+            )
+            ]
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `availability_zone_name` - (Optional) the AWS Availability Zone in which to create the file system. Used to create a file system that uses One Zone storage classes. See [user guide](https://docs.aws.amazon.com/efs/latest/ug/storage-classes.html) for more information.
+* `creation_token` - (Optional) A unique name (a maximum of 64 characters are allowed)
+used as reference when creating the Elastic File System to ensure idempotent file
+system creation. By default generated by Terraform. See [Elastic File System](http://docs.aws.amazon.com/efs/latest/ug/)
+user guide for more information.
+* `encrypted` - (Optional) If true, the disk will be encrypted.
+* `kms_key_id` - (Optional) The ARN for the KMS encryption key. When specifying kms_key_id, encrypted needs to be set to true.
+* `lifecycle_policy` - (Optional) A file system [lifecycle policy](https://docs.aws.amazon.com/efs/latest/ug/API_LifecyclePolicy.html) object (documented below).
+* `performance_mode` - (Optional) The file system performance mode. Can be either `"generalPurpose"` or `"maxIO"` (Default: `"generalPurpose"`).
+* `provisioned_throughput_in_mibps` - (Optional) The throughput, measured in MiB/s, that you want to provision for the file system. Only applicable with `throughput_mode` set to `provisioned`.
+* `tags` - (Optional) A map of tags to assign to the file system. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `throughput_mode` - (Optional) Throughput mode for the file system. Defaults to `bursting`. Valid values: `bursting`, `provisioned`, or `elastic`. When using `provisioned`, also set `provisioned_throughput_in_mibps`.
+
+### Lifecycle Policy Arguments
+
+`lifecycle_policy` supports the following arguments:
+
+* `transition_to_ia` - (Optional) Indicates how long it takes to transition files to the IA storage class. Valid values: `AFTER_1_DAY`, `AFTER_7_DAYS`, `AFTER_14_DAYS`, `AFTER_30_DAYS`, `AFTER_60_DAYS`, or `AFTER_90_DAYS`.
+* `transition_to_primary_storage_class` - (Optional) Describes the policy used to transition a file from infequent access storage to primary storage. Valid values: `AFTER_1_ACCESS`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name of the file system.
+* `availability_zone_id` - The identifier of the Availability Zone in which the file system's One Zone storage classes exist.
+* `id` - The ID that identifies the file system (e.g., fs-ccfc0d65).
+* `dns_name` - The DNS name for the filesystem per [documented convention](http://docs.aws.amazon.com/efs/latest/ug/mounting-fs-mount-cmd-dns-name.html).
+* `name` - The value of the file system's `Name` tag.
+* `number_of_mount_targets` - The current number of mount targets that the file system has.
+* `owner_id` - The AWS account that created the file system. If the file system was createdby an IAM user, the parent account to which the user belongs is the owner.
+* `size_in_bytes` - The latest known metered size (in bytes) of data stored in the file system, the value is not the exact size that the file system was at any point in time. See [Size In Bytes](#size-in-bytes).
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+### Size In Bytes
+
+* `value` - The latest known metered size (in bytes) of data stored in the file system.
+* `value_in_ia` - The latest known metered size (in bytes) of data stored in the Infrequent Access storage class.
+* `value_in_standard` - The latest known metered size (in bytes) of data stored in the Standard storage class.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import the EFS file systems using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import the EFS file systems using the `id`. For example:
+
+```console
+% terraform import aws_efs_file_system.foo fs-6fa144c6
+```
+
+<!-- cache-key: cdktf-0.18.0 input-b61c944770ac6802dbeb15c2afb8f175aaffd7b4d47e45eb8ac4c3b58d546d0b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/efs_file_system_policy.html.markdown b/website/docs/cdktf/python/r/efs_file_system_policy.html.markdown
new file mode 100644
index 00000000000..36e1c6bd08c
--- /dev/null
+++ b/website/docs/cdktf/python/r/efs_file_system_policy.html.markdown
@@ -0,0 +1,99 @@
+---
+subcategory: "EFS (Elastic File System)"
+layout: "aws"
+page_title: "AWS: aws_efs_file_system_policy"
+description: |-
+  Provides an Elastic File System (EFS) File System Policy resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_efs_file_system_policy
+
+Provides an Elastic File System (EFS) File System Policy resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.efs_file_system import EfsFileSystem
+from imports.aws.efs_file_system_policy import EfsFileSystemPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        fs = EfsFileSystem(self, "fs",
+            creation_token="my-product"
+        )
+        policy = DataAwsIamPolicyDocument(self, "policy",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["elasticfilesystem:ClientMount", "elasticfilesystem:ClientWrite"
+                ],
+                condition=[DataAwsIamPolicyDocumentStatementCondition(
+                    test="Bool",
+                    values=["true"],
+                    variable="aws:SecureTransport"
+                )
+                ],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["*"],
+                    type="AWS"
+                )
+                ],
+                resources=[fs.arn],
+                sid="ExampleStatement01"
+            )
+            ]
+        )
+        aws_efs_file_system_policy_policy = EfsFileSystemPolicy(self, "policy_2",
+            file_system_id=fs.id,
+            policy=Token.as_string(policy.json)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_efs_file_system_policy_policy.override_logical_id("policy")
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `file_system_id` - (Required) The ID of the EFS file system.
+* `policy` - (Required) The JSON formatted file system policy for the EFS file system. see [Docs](https://docs.aws.amazon.com/efs/latest/ug/access-control-overview.html#access-control-manage-access-intro-resource-policies) for more info.
+
+The following arguments are optional:
+
+* `bypass_policy_lockout_safety_check` - (Optional) A flag to indicate whether to bypass the `aws_efs_file_system_policy` lockout safety check. The policy lockout safety check determines whether the policy in the request will prevent the principal making the request will be locked out from making future `PutFileSystemPolicy` requests on the file system. Set `bypass_policy_lockout_safety_check` to `true` only when you intend to prevent the principal that is making the request from making a subsequent `PutFileSystemPolicy` request on the file system. The default value is `false`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID that identifies the file system (e.g., fs-ccfc0d65).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import the EFS file system policies using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import the EFS file system policies using the `id`. For example:
+
+```console
+% terraform import aws_efs_file_system_policy.foo fs-6fa144c6
+```
+
+<!-- cache-key: cdktf-0.18.0 input-51ce0e6776bd5a12b73f8fd6edc2135ed20119de727978bb7a52e39fe7641ce6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/efs_mount_target.html.markdown b/website/docs/cdktf/python/r/efs_mount_target.html.markdown
new file mode 100644
index 00000000000..442ae0cc5c5
--- /dev/null
+++ b/website/docs/cdktf/python/r/efs_mount_target.html.markdown
@@ -0,0 +1,101 @@
+---
+subcategory: "EFS (Elastic File System)"
+layout: "aws"
+page_title: "AWS: aws_efs_mount_target"
+description: |-
+  Provides an Elastic File System (EFS) mount target.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_efs_mount_target
+
+Provides an Elastic File System (EFS) mount target.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.efs_mount_target import EfsMountTarget
+from imports.aws.subnet import Subnet
+from imports.aws.vpc import Vpc
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        foo = Vpc(self, "foo",
+            cidr_block="10.0.0.0/16"
+        )
+        alpha = Subnet(self, "alpha",
+            availability_zone="us-west-2a",
+            cidr_block="10.0.1.0/24",
+            vpc_id=foo.id
+        )
+        aws_efs_mount_target_alpha = EfsMountTarget(self, "alpha_2",
+            file_system_id=Token.as_string(aws_efs_file_system_foo.id),
+            subnet_id=alpha.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_efs_mount_target_alpha.override_logical_id("alpha")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `file_system_id` - (Required) The ID of the file system for which the mount target is intended.
+* `subnet_id` - (Required) The ID of the subnet to add the mount target in.
+* `ip_address` - (Optional) The address (within the address range of the specified subnet) at
+which the file system may be mounted via the mount target.
+* `security_groups` - (Optional) A list of up to 5 VPC security group IDs (that must
+be for the same VPC as subnet specified) in effect for the mount target.
+
+## Attribute Reference
+
+~> **Note:** The `dns_name` and `mount_target_dns_name` attributes are only useful if the mount target is in a VPC that has
+support for DNS hostnames enabled. See [Using DNS with Your VPC](http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/vpc-dns.html)
+and [VPC resource](/docs/providers/aws/r/vpc.html#enable_dns_hostnames) in Terraform for more information.
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the mount target.
+* `dns_name` - The DNS name for the EFS file system.
+* `mount_target_dns_name` - The DNS name for the given subnet/AZ per [documented convention](http://docs.aws.amazon.com/efs/latest/ug/mounting-fs-mount-cmd-dns-name.html).
+* `file_system_arn` - Amazon Resource Name of the file system.
+* `network_interface_id` - The ID of the network interface that Amazon EFS created when it created the mount target.
+* `availability_zone_name` - The name of the Availability Zone (AZ) that the mount target resides in.
+* `availability_zone_id` - The unique and consistent identifier of the Availability Zone (AZ) that the mount target resides in.
+* `owner_id` - AWS account ID that owns the resource.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `30m`)
+- `delete` - (Default `10m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import the EFS mount targets using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import the EFS mount targets using the `id`. For example:
+
+```console
+% terraform import aws_efs_mount_target.alpha fsmt-52a643fb
+```
+
+<!-- cache-key: cdktf-0.18.0 input-7dcbc13dbededd010d6caa93608126170e98da8f59ca6aabaeeb59e86082c8d2 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/efs_replication_configuration.html.markdown b/website/docs/cdktf/python/r/efs_replication_configuration.html.markdown
new file mode 100644
index 00000000000..f46e784e760
--- /dev/null
+++ b/website/docs/cdktf/python/r/efs_replication_configuration.html.markdown
@@ -0,0 +1,125 @@
+---
+subcategory: "EFS (Elastic File System)"
+layout: "aws"
+page_title: "AWS: aws_efs_replication_configuration"
+description: Provides an Elastic File System (EFS) Replication Configuration.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_efs_replication_configuration
+
+Creates a replica of an existing EFS file system in the same or another region. Creating this resource causes the source EFS file system to be replicated to a new read-only destination EFS file system. Deleting this resource will cause the replication from source to destination to stop and the destination file system will no longer be read only.
+
+~> **NOTE:** Deleting this resource does **not** delete the destination file system that was created.
+
+## Example Usage
+
+Will create a replica using regional storage in us-west-2 that will be encrypted by the default EFS KMS key `/aws/elasticfilesystem`.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.efs_file_system import EfsFileSystem
+from imports.aws.efs_replication_configuration import EfsReplicationConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = EfsFileSystem(self, "example")
+        aws_efs_replication_configuration_example =
+        EfsReplicationConfiguration(self, "example_1",
+            destination=EfsReplicationConfigurationDestination(
+                region="us-west-2"
+            ),
+            source_file_system_id=example.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_efs_replication_configuration_example.override_logical_id("example")
+```
+
+Replica will be created as One Zone storage in the us-west-2b Availability Zone and encrypted with the specified KMS key.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.efs_file_system import EfsFileSystem
+from imports.aws.efs_replication_configuration import EfsReplicationConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = EfsFileSystem(self, "example")
+        aws_efs_replication_configuration_example =
+        EfsReplicationConfiguration(self, "example_1",
+            destination=EfsReplicationConfigurationDestination(
+                availability_zone_name="us-west-2b",
+                kms_key_id="1234abcd-12ab-34cd-56ef-1234567890ab"
+            ),
+            source_file_system_id=example.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_efs_replication_configuration_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `source_file_system_id` - (Required) The ID of the file system that is to be replicated.
+* `destination` - (Required) A destination configuration block (documented below).
+
+### Destination Arguments
+
+`destination` supports the following arguments:
+
+* `availability_zone_name` - (Optional) The availability zone in which the replica should be created. If specified, the replica will be created with One Zone storage. If omitted, regional storage will be used.
+* `kms_key_id` - (Optional) The Key ID, ARN, alias, or alias ARN of the KMS key that should be used to encrypt the replica file system. If omitted, the default KMS key for EFS `/aws/elasticfilesystem` will be used.
+* `region` - (Optional) The region in which the replica should be created.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `creation_time` - When the replication configuration was created.
+* `original_source_file_system_arn` - The Amazon Resource Name (ARN) of the original source Amazon EFS file system in the replication configuration.
+* `source_file_system_arn` - The Amazon Resource Name (ARN) of the current source file system in the replication configuration.
+* `source_file_system_region` - The AWS Region in which the source Amazon EFS file system is located.
+* `destination[0].file_system_id` - The fs ID of the replica.
+* `destination[0].status` - The status of the replication.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `10m`)
+* `delete` - (Default `20m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EFS Replication Configurations using the file system ID of either the source or destination file system. When importing, the `availability_zone_name` and `kms_key_id` attributes must **not** be set in the configuration. The AWS API does not return these values when querying the replication configuration and their presence will therefore show as a diff in a subsequent plan. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import EFS Replication Configurations using the file system ID of either the source or destination file system. When importing, the `availability_zone_name` and `kms_key_id` attributes must **not** be set in the configuration. The AWS API does not return these values when querying the replication configuration and their presence will therefore show as a diff in a subsequent plan. For example:
+
+```console
+% terraform import aws_efs_replication_configuration.example fs-id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-946efd1b44fba73bdf7367fb477373ab0672aab7b032ed389da0ec41f5bbc874 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/egress_only_internet_gateway.html.markdown b/website/docs/cdktf/python/r/egress_only_internet_gateway.html.markdown
new file mode 100644
index 00000000000..0f64303f913
--- /dev/null
+++ b/website/docs/cdktf/python/r/egress_only_internet_gateway.html.markdown
@@ -0,0 +1,80 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_egress_only_internet_gateway"
+description: |-
+  Provides a resource to create an egress-only Internet gateway.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_egress_only_internet_gateway
+
+[IPv6 only] Creates an egress-only Internet gateway for your VPC.
+An egress-only Internet gateway is used to enable outbound communication
+over IPv6 from instances in your VPC to the Internet, and prevents hosts
+outside of your VPC from initiating an IPv6 connection with your instance.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.egress_only_internet_gateway import EgressOnlyInternetGateway
+from imports.aws.vpc import Vpc
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = Vpc(self, "example",
+            assign_generated_ipv6_cidr_block=True,
+            cidr_block="10.1.0.0/16"
+        )
+        aws_egress_only_internet_gateway_example = EgressOnlyInternetGateway(self, "example_1",
+            tags={
+                "Name": "main"
+            },
+            vpc_id=example.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_egress_only_internet_gateway_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `vpc_id` - (Required) The VPC ID to create in.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the egress-only Internet gateway.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Egress-only Internet gateways using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Egress-only Internet gateways using the `id`. For example:
+
+```console
+% terraform import aws_egress_only_internet_gateway.example eigw-015e0e244e24dfe8a
+```
+
+<!-- cache-key: cdktf-0.18.0 input-7ed3e94395680c60b6e40820f5a3e85dfb53bdc2a67b6dc191917e0125e4b534 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/eip.html.markdown b/website/docs/cdktf/python/r/eip.html.markdown
new file mode 100644
index 00000000000..8467dbe1532
--- /dev/null
+++ b/website/docs/cdktf/python/r/eip.html.markdown
@@ -0,0 +1,205 @@
+---
+subcategory: "EC2 (Elastic Compute Cloud)"
+layout: "aws"
+page_title: "AWS: aws_eip"
+description: |-
+  Provides an Elastic IP resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_eip
+
+Provides an Elastic IP resource.
+
+~> **Note:** EIP may require IGW to exist prior to association. Use `depends_on` to set an explicit dependency on the IGW.
+
+~> **Note:** Do not use `network_interface` to associate the EIP to `aws_lb` or `aws_nat_gateway` resources. Instead use the `allocation_id` available in those resources to allow AWS to manage the association, otherwise you will see `AuthFailure` errors.
+
+## Example Usage
+
+### Single EIP associated with an instance
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.eip import Eip
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Eip(self, "lb",
+            domain="vpc",
+            instance=web.id
+        )
+```
+
+### Multiple EIPs associated with a single network interface
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.eip import Eip
+from imports.aws.network_interface import NetworkInterface
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        multi_ip = NetworkInterface(self, "multi-ip",
+            private_ips=["10.0.0.10", "10.0.0.11"],
+            subnet_id=main.id
+        )
+        Eip(self, "one",
+            associate_with_private_ip="10.0.0.10",
+            domain="vpc",
+            network_interface=multi_ip.id
+        )
+        Eip(self, "two",
+            associate_with_private_ip="10.0.0.11",
+            domain="vpc",
+            network_interface=multi_ip.id
+        )
+```
+
+### Attaching an EIP to an Instance with a pre-assigned private ip (VPC Only)
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.eip import Eip
+from imports.aws.instance import Instance
+from imports.aws.internet_gateway import InternetGateway
+from imports.aws.subnet import Subnet
+from imports.aws.vpc import Vpc
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        default_var = Vpc(self, "default",
+            cidr_block="10.0.0.0/16",
+            enable_dns_hostnames=True
+        )
+        gw = InternetGateway(self, "gw",
+            vpc_id=default_var.id
+        )
+        tf_test_subnet = Subnet(self, "tf_test_subnet",
+            cidr_block="10.0.0.0/24",
+            depends_on=[gw],
+            map_public_ip_on_launch=True,
+            vpc_id=default_var.id
+        )
+        foo = Instance(self, "foo",
+            ami="ami-5189a661",
+            instance_type="t2.micro",
+            private_ip="10.0.0.12",
+            subnet_id=tf_test_subnet.id
+        )
+        Eip(self, "bar",
+            associate_with_private_ip="10.0.0.12",
+            depends_on=[gw],
+            domain="vpc",
+            instance=foo.id
+        )
+```
+
+### Allocating EIP from the BYOIP pool
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.eip import Eip
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Eip(self, "byoip-ip",
+            domain="vpc",
+            public_ipv4_pool="ipv4pool-ec2-012345"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `address` - (Optional) IP address from an EC2 BYOIP pool. This option is only available for VPC EIPs.
+* `associate_with_private_ip` - (Optional) User-specified primary or secondary private IP address to associate with the Elastic IP address. If no private IP address is specified, the Elastic IP address is associated with the primary private IP address.
+* `customer_owned_ipv4_pool` - (Optional) ID  of a customer-owned address pool. For more on customer owned IP addressed check out [Customer-owned IP addresses guide](https://docs.aws.amazon.com/outposts/latest/userguide/outposts-networking-components.html#ip-addressing).
+* `domain` - Indicates if this EIP is for use in VPC (`vpc`).
+* `instance` - (Optional) EC2 instance ID.
+* `network_border_group` - (Optional) Location from which the IP address is advertised. Use this parameter to limit the address to this location.
+* `network_interface` - (Optional) Network interface ID to associate with.
+* `public_ipv4_pool` - (Optional) EC2 IPv4 address pool identifier or `amazon`.
+  This option is only available for VPC EIPs.
+* `tags` - (Optional) Map of tags to assign to the resource. Tags can only be applied to EIPs in a VPC. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `vpc` - (Optional **Deprecated**) Boolean if the EIP is in a VPC or not. Use `domain` instead.
+  Defaults to `true` unless the region supports EC2-Classic.
+
+~> **NOTE:** You can specify either the `instance` ID or the `network_interface` ID, but not both. Including both will **not** return an error from the AWS API, but will have undefined behavior. See the relevant [AssociateAddress API Call][1] for more information.
+
+~> **NOTE:** Specifying both `public_ipv4_pool` and `address` won't cause an error but `address` will be used in the
+case both options are defined as the api only requires one or the other.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `allocation_id` - ID that AWS assigns to represent the allocation of the Elastic IP address for use with instances in a VPC.
+* `association_id` - ID representing the association of the address with an instance in a VPC.
+* `carrier_ip` - Carrier IP address.
+* `customer_owned_ip` - Customer owned IP.
+* `id` - Contains the EIP allocation ID.
+* `private_dns` - The Private DNS associated with the Elastic IP address (if in VPC).
+* `private_ip` - Contains the private IP address (if in VPC).
+* `public_dns` - Public DNS associated with the Elastic IP address.
+* `public_ip` - Contains the public IP address.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+~> **Note:** The resource computes the `public_dns` and `private_dns` attributes according to the [VPC DNS Guide](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-dns.html#vpc-dns-hostnames) as they are not available with the EC2 API.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `15m`)
+- `update` - (Default `5m`)
+- `delete` - (Default `3m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EIPs in a VPC using their Allocation ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import EIPs in a VPC using their Allocation ID. For example:
+
+```console
+% terraform import aws_eip.bar eipalloc-00a10e96
+```
+
+[1]: https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AssociateAddress.html
+
+<!-- cache-key: cdktf-0.18.0 input-2894d9bbbc820133a7e6582361d7e5ae944dbddb77332e6b8487b7c5fcf90efe -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/eip_association.html.markdown b/website/docs/cdktf/python/r/eip_association.html.markdown
new file mode 100644
index 00000000000..1024cc96971
--- /dev/null
+++ b/website/docs/cdktf/python/r/eip_association.html.markdown
@@ -0,0 +1,105 @@
+---
+subcategory: "EC2 (Elastic Compute Cloud)"
+layout: "aws"
+page_title: "AWS: aws_eip_association"
+description: |-
+  Provides an AWS EIP Association
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_eip_association
+
+Provides an AWS EIP Association as a top level resource, to associate and
+disassociate Elastic IPs from AWS Instances and Network Interfaces.
+
+~> **NOTE:** Do not use this resource to associate an EIP to `aws_lb` or `aws_nat_gateway` resources. Instead use the `allocation_id` available in those resources to allow AWS to manage the association, otherwise you will see `AuthFailure` errors.
+
+~> **NOTE:** `aws_eip_association` is useful in scenarios where EIPs are either
+pre-existing or distributed to customers or users and therefore cannot be changed.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.eip import Eip
+from imports.aws.eip_association import EipAssociation
+from imports.aws.instance import Instance
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = Eip(self, "example",
+            domain="vpc"
+        )
+        web = Instance(self, "web",
+            ami="ami-21f78e11",
+            availability_zone="us-west-2a",
+            instance_type="t2.micro",
+            tags={
+                "Name": "HelloWorld"
+            }
+        )
+        EipAssociation(self, "eip_assoc",
+            allocation_id=example.id,
+            instance_id=web.id
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `allocation_id` - (Optional) The allocation ID. This is required for EC2-VPC.
+* `allow_reassociation` - (Optional, Boolean) Whether to allow an Elastic IP to
+be re-associated. Defaults to `true` in VPC.
+* `instance_id` - (Optional) The ID of the instance. This is required for
+EC2-Classic. For EC2-VPC, you can specify either the instance ID or the
+network interface ID, but not both. The operation fails if you specify an
+instance ID unless exactly one network interface is attached.
+* `network_interface_id` - (Optional) The ID of the network interface. If the
+instance has more than one network interface, you must specify a network
+interface ID.
+* `private_ip_address` - (Optional) The primary or secondary private IP address
+to associate with the Elastic IP address. If no private IP address is
+specified, the Elastic IP address is associated with the primary private IP
+address.
+* `public_ip` - (Optional) The Elastic IP address. This is required for EC2-Classic.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `association_id` - The ID that represents the association of the Elastic IP
+address with an instance.
+* `allocation_id` - As above
+* `instance_id` - As above
+* `network_interface_id` - As above
+* `private_ip_address` - As above
+* `public_ip` - As above
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EIP Assocations using their association IDs. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import EIP Assocations using their association IDs. For example:
+
+```console
+% terraform import aws_eip_association.test eipassoc-ab12c345
+```
+
+<!-- cache-key: cdktf-0.18.0 input-0b7dcca3745ca6b46014b918c2445a458ece3c2721fbe7d3b6d1cb5ec4e2bb32 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/eks_addon.html.markdown b/website/docs/cdktf/python/r/eks_addon.html.markdown
new file mode 100644
index 00000000000..08d83c90192
--- /dev/null
+++ b/website/docs/cdktf/python/r/eks_addon.html.markdown
@@ -0,0 +1,258 @@
+---
+subcategory: "EKS (Elastic Kubernetes)"
+layout: "aws"
+page_title: "AWS: aws_eks_addon"
+description: |-
+  Manages an EKS add-on
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_eks_addon
+
+Manages an EKS add-on.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.eks_addon import EksAddon
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        EksAddon(self, "example",
+            addon_name="vpc-cni",
+            cluster_name=Token.as_string(aws_eks_cluster_example.name)
+        )
+```
+
+## Example Update add-on usage with resolve_conflicts_on_update and PRESERVE
+
+`resolve_conflicts_on_update` with `PRESERVE` can be used to retain the config changes applied to the add-on with kubectl while upgrading to a newer version of the add-on.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.eks_addon import EksAddon
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        EksAddon(self, "example",
+            addon_name="coredns",
+            addon_version="v1.10.1-eksbuild.1",
+            cluster_name=Token.as_string(aws_eks_cluster_example.name),
+            resolve_conflicts_on_update="PRESERVE"
+        )
+```
+
+## Example add-on usage with custom configuration_values
+
+Custom add-on configuration can be passed using `configuration_values` as a single JSON string while creating or updating the add-on.
+
+~> **Note:** `configuration_values` is a single JSON string should match the valid JSON schema for each add-on with specific version.
+
+To find the correct JSON schema for each add-on can be extracted using [describe-addon-configuration](https://docs.aws.amazon.com/cli/latest/reference/eks/describe-addon-configuration.html) call.
+This below is an example for extracting the `configuration_values` schema for `coredns`.
+
+```bash
+ aws eks describe-addon-configuration \
+ --addon-name coredns \
+ --addon-version v1.10.1-eksbuild.1
+```
+
+Example to create a `coredns` managed addon with custom `configuration_values`.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.eks_addon import EksAddon
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        EksAddon(self, "example",
+            addon_name="coredns",
+            addon_version="v1.10.1-eksbuild.1",
+            cluster_name="mycluster",
+            configuration_values=Token.as_string(
+                Fn.jsonencode({
+                    "replica_count": 4,
+                    "resources": {
+                        "limits": {
+                            "cpu": "100m",
+                            "memory": "150Mi"
+                        },
+                        "requests": {
+                            "cpu": "100m",
+                            "memory": "150Mi"
+                        }
+                    }
+                })),
+            resolve_conflicts_on_create="OVERWRITE"
+        )
+```
+
+### Example IAM Role for EKS Addon "vpc-cni" with AWS managed policy
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.eks_cluster import EksCluster
+from imports.aws.iam_openid_connect_provider import IamOpenidConnectProvider
+from imports.aws.iam_role import IamRole
+from imports.aws.iam_role_policy_attachment import IamRolePolicyAttachment
+from imports.tls.data_tls_certificate import DataTlsCertificate
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, name, roleArn, vpcConfig):
+        super().__init__(scope, name)
+        # The following providers are missing schema information and might need manual adjustments to synthesize correctly: tls.
+        #     For a more precise conversion please use the --provider flag in convert.
+        example = EksCluster(self, "example",
+            name=name,
+            role_arn=role_arn,
+            vpc_config=vpc_config
+        )
+        data_tls_certificate_example = DataTlsCertificate(self, "example_1",
+            url=Fn.lookup_nested(example.identity, ["0", "oidc", "0", "issuer"])
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_tls_certificate_example.override_logical_id("example")
+        aws_iam_openid_connect_provider_example = IamOpenidConnectProvider(self, "example_2",
+            client_id_list=["sts.amazonaws.com"],
+            thumbprint_list=[
+                Token.as_string(
+                    Fn.lookup_nested(data_tls_certificate_example.certificates, ["0", "sha1_fingerprint"
+                    ]))
+            ],
+            url=Token.as_string(
+                Fn.lookup_nested(example.identity, ["0", "oidc", "0", "issuer"]))
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_openid_connect_provider_example.override_logical_id("example")
+        example_assume_role_policy = DataAwsIamPolicyDocument(self, "example_assume_role_policy",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["sts:AssumeRoleWithWebIdentity"],
+                condition=[DataAwsIamPolicyDocumentStatementCondition(
+                    test="StringEquals",
+                    values=["system:serviceaccount:kube-system:aws-node"],
+                    variable=
+                    Token.as_string(
+                        Fn.replace(
+                            Token.as_string(aws_iam_openid_connect_provider_example.url), "https://", "")) + ":sub"
+                )
+                ],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=[
+                        Token.as_string(aws_iam_openid_connect_provider_example.arn)
+                    ],
+                    type="Federated"
+                )
+                ]
+            )
+            ]
+        )
+        aws_iam_role_example = IamRole(self, "example_4",
+            assume_role_policy=Token.as_string(example_assume_role_policy.json),
+            name="example-vpc-cni-role"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_role_example.override_logical_id("example")
+        aws_iam_role_policy_attachment_example = IamRolePolicyAttachment(self, "example_5",
+            policy_arn="arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy",
+            role=Token.as_string(aws_iam_role_example.name)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_role_policy_attachment_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `addon_name` – (Required) Name of the EKS add-on. The name must match one of
+  the names returned by [describe-addon-versions](https://docs.aws.amazon.com/cli/latest/reference/eks/describe-addon-versions.html).
+* `cluster_name` – (Required) Name of the EKS Cluster. Must be between 1-100 characters in length. Must begin with an alphanumeric character, and must only contain alphanumeric characters, dashes and underscores (`^[0-9A-Za-z][A-Za-z0-9\-_]+$`).
+
+The following arguments are optional:
+
+* `addon_version` – (Optional) The version of the EKS add-on. The version must
+  match one of the versions returned by [describe-addon-versions](https://docs.aws.amazon.com/cli/latest/reference/eks/describe-addon-versions.html).
+* `configuration_values` - (Optional) custom configuration values for addons with single JSON string. This JSON string value must match the JSON schema derived from [describe-addon-configuration](https://docs.aws.amazon.com/cli/latest/reference/eks/describe-addon-configuration.html).
+* `resolve_conflicts_on_create` - (Optional) How to resolve field value conflicts when migrating a self-managed add-on to an Amazon EKS add-on. Valid values are `NONE` and `OVERWRITE`. For more details see the [CreateAddon](https://docs.aws.amazon.com/eks/latest/APIReference/API_CreateAddon.html) API Docs.
+* `resolve_conflicts_on_update` - (Optional) How to resolve field value conflicts for an Amazon EKS add-on if you've changed a value from the Amazon EKS default value. Valid values are `NONE`, `OVERWRITE`, and `PRESERVE`. For more details see the [UpdateAddon](https://docs.aws.amazon.com/eks/latest/APIReference/API_UpdateAddon.html) API Docs.
+* `resolve_conflicts` - (**Deprecated** use the `resolve_conflicts_on_create` and `resolve_conflicts_on_update` attributes instead) Define how to resolve parameter value conflicts when migrating an existing add-on to an Amazon EKS add-on or when applying version updates to the add-on. Valid values are `NONE`, `OVERWRITE` and `PRESERVE`. Note that `PRESERVE` is only valid on addon update, not for initial addon creation. If you need to set this to `PRESERVE`, use the `resolve_conflicts_on_create` and `resolve_conflicts_on_update` attributes instead. For more details check [UpdateAddon](https://docs.aws.amazon.com/eks/latest/APIReference/API_UpdateAddon.html) API Docs.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `preserve` - (Optional) Indicates if you want to preserve the created resources when deleting the EKS add-on.
+* `service_account_role_arn` - (Optional) The Amazon Resource Name (ARN) of an
+  existing IAM role to bind to the add-on's service account. The role must be
+  assigned the IAM permissions required by the add-on. If you don't specify
+  an existing IAM role, then the add-on uses the permissions assigned to the node
+  IAM role. For more information, see [Amazon EKS node IAM role](https://docs.aws.amazon.com/eks/latest/userguide/create-node-role.html)
+  in the Amazon EKS User Guide.
+
+  ~> **Note:** To specify an existing IAM role, you must have an IAM OpenID Connect (OIDC)
+  provider created for your cluster. For more information, [see Enabling IAM roles
+  for service accounts on your cluster](https://docs.aws.amazon.com/eks/latest/userguide/enable-iam-roles-for-service-accounts.html)
+  in the Amazon EKS User Guide.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the EKS add-on.
+* `id` - EKS Cluster name and EKS Addon name separated by a colon (`:`).
+* `status` - Status of the EKS add-on.
+* `created_at` - Date and time in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8) that the EKS add-on was created.
+* `modified_at` - Date and time in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8) that the EKS add-on was updated.
+* `tags_all` - (Optional) Key-value map of resource tags, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `20m`)
+* `update` - (Default `20m`)
+* `delete` - (Default `40m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EKS add-on using the `cluster_name` and `addon_name` separated by a colon (`:`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import EKS add-on using the `cluster_name` and `addon_name` separated by a colon (`:`). For example:
+
+```console
+% terraform import aws_eks_addon.my_eks_addon my_cluster_name:my_addon_name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-e953ed182a0fa1dcb61c6d51bec7e4fd4935f7e22b773c4ebbee1298edc5e49e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/eks_cluster.html.markdown b/website/docs/cdktf/python/r/eks_cluster.html.markdown
new file mode 100644
index 00000000000..c5024644f33
--- /dev/null
+++ b/website/docs/cdktf/python/r/eks_cluster.html.markdown
@@ -0,0 +1,380 @@
+---
+subcategory: "EKS (Elastic Kubernetes)"
+layout: "aws"
+page_title: "AWS: aws_eks_cluster"
+description: |-
+  Manages an EKS Cluster
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_eks_cluster
+
+Manages an EKS Cluster.
+
+> **Hands-on:** For an example of `aws_eks_cluster` in use, follow the [Provision an EKS Cluster](https://learn.hashicorp.com/tutorials/terraform/eks) tutorial on HashiCorp Learn.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformOutput, Fn, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.eks_cluster import EksCluster
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = EksCluster(self, "example",
+            depends_on=[example_amazon_eks_cluster_policy, example_amazon_eksvpc_resource_controller
+            ],
+            name="example",
+            role_arn=Token.as_string(aws_iam_role_example.arn),
+            vpc_config=EksClusterVpcConfig(
+                subnet_ids=[example1.id, example2.id]
+            )
+        )
+        TerraformOutput(self, "endpoint",
+            value=example.endpoint
+        )
+        TerraformOutput(self, "kubeconfig-certificate-authority-data",
+            value=Fn.lookup_nested(example.certificate_authority, ["0", "data"])
+        )
+```
+
+### Example IAM Role for EKS Cluster
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.iam_role import IamRole
+from imports.aws.iam_role_policy_attachment import IamRolePolicyAttachment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        assume_role = DataAwsIamPolicyDocument(self, "assume_role",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["sts:AssumeRole"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["eks.amazonaws.com"],
+                    type="Service"
+                )
+                ]
+            )
+            ]
+        )
+        example = IamRole(self, "example",
+            assume_role_policy=Token.as_string(assume_role.json),
+            name="eks-cluster-example"
+        )
+        IamRolePolicyAttachment(self, "example-AmazonEKSClusterPolicy",
+            policy_arn="arn:aws:iam::aws:policy/AmazonEKSClusterPolicy",
+            role=example.name
+        )
+        IamRolePolicyAttachment(self, "example-AmazonEKSVPCResourceController",
+            policy_arn="arn:aws:iam::aws:policy/AmazonEKSVPCResourceController",
+            role=example.name
+        )
+```
+
+### Enabling Control Plane Logging
+
+[EKS Control Plane Logging](https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html) can be enabled via the `enabled_cluster_log_types` argument. To manage the CloudWatch Log Group retention period, the [`aws_cloudwatch_log_group` resource](/docs/providers/aws/r/cloudwatch_log_group.html) can be used.
+
+-> The below configuration uses [`depends_on`](https://www.terraform.io/docs/configuration/meta-arguments/depends_on.html) to prevent ordering issues with EKS automatically creating the log group first and a variable for naming consistency. Other ordering and naming methodologies may be more appropriate for your environment.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import VariableType, TerraformVariable, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudwatch_log_group import CloudwatchLogGroup
+from imports.aws.eks_cluster import EksCluster
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, roleArn, vpcConfig):
+        super().__init__(scope, name)
+        # Terraform Variables are not always the best fit for getting inputs in the context of Terraform CDK.
+        #     You can read more about this at https://cdk.tf/variables
+        cluster_name = TerraformVariable(self, "cluster_name",
+            default="example",
+            type=VariableType.STRING
+        )
+        example = CloudwatchLogGroup(self, "example",
+            name="/aws/eks/${" + cluster_name.value + "}/cluster",
+            retention_in_days=7
+        )
+        aws_eks_cluster_example = EksCluster(self, "example_2",
+            depends_on=[example],
+            enabled_cluster_log_types=["api", "audit"],
+            name=cluster_name.string_value,
+            role_arn=role_arn,
+            vpc_config=vpc_config
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_eks_cluster_example.override_logical_id("example")
+```
+
+### Enabling IAM Roles for Service Accounts
+
+Only available on Kubernetes version 1.13 and 1.14 clusters created or upgraded on or after September 3, 2019. For more information about this feature, see the [EKS User Guide](https://docs.aws.amazon.com/eks/latest/userguide/enable-iam-roles-for-service-accounts.html).
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.eks_cluster import EksCluster
+from imports.aws.iam_openid_connect_provider import IamOpenidConnectProvider
+from imports.aws.iam_role import IamRole
+from imports.tls.data_tls_certificate import DataTlsCertificate
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, name, roleArn, vpcConfig):
+        super().__init__(scope, name)
+        # The following providers are missing schema information and might need manual adjustments to synthesize correctly: tls.
+        #     For a more precise conversion please use the --provider flag in convert.
+        example = EksCluster(self, "example",
+            name=name,
+            role_arn=role_arn,
+            vpc_config=vpc_config
+        )
+        data_tls_certificate_example = DataTlsCertificate(self, "example_1",
+            url=Fn.lookup_nested(example.identity, ["0", "oidc", "0", "issuer"])
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_tls_certificate_example.override_logical_id("example")
+        aws_iam_openid_connect_provider_example = IamOpenidConnectProvider(self, "example_2",
+            client_id_list=["sts.amazonaws.com"],
+            thumbprint_list=[
+                Token.as_string(
+                    Fn.lookup_nested(data_tls_certificate_example.certificates, ["0", "sha1_fingerprint"
+                    ]))
+            ],
+            url=Token.as_string(data_tls_certificate_example.url)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_openid_connect_provider_example.override_logical_id("example")
+        example_assume_role_policy = DataAwsIamPolicyDocument(self, "example_assume_role_policy",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["sts:AssumeRoleWithWebIdentity"],
+                condition=[DataAwsIamPolicyDocumentStatementCondition(
+                    test="StringEquals",
+                    values=["system:serviceaccount:kube-system:aws-node"],
+                    variable=
+                    Token.as_string(
+                        Fn.replace(
+                            Token.as_string(aws_iam_openid_connect_provider_example.url), "https://", "")) + ":sub"
+                )
+                ],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=[
+                        Token.as_string(aws_iam_openid_connect_provider_example.arn)
+                    ],
+                    type="Federated"
+                )
+                ]
+            )
+            ]
+        )
+        aws_iam_role_example = IamRole(self, "example_4",
+            assume_role_policy=Token.as_string(example_assume_role_policy.json),
+            name="example"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_role_example.override_logical_id("example")
+```
+
+### EKS Cluster on AWS Outpost
+
+[Creating a local Amazon EKS cluster on an AWS Outpost](https://docs.aws.amazon.com/eks/latest/userguide/create-cluster-outpost.html)
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.eks_cluster import EksCluster
+from imports.aws.iam_role import IamRole
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, subnetIds):
+        super().__init__(scope, name)
+        example = IamRole(self, "example",
+            assume_role_policy=Token.as_string(example_assume_role_policy.json),
+            name="example"
+        )
+        aws_eks_cluster_example = EksCluster(self, "example_1",
+            name="example-cluster",
+            outpost_config=EksClusterOutpostConfig(
+                control_plane_instance_type="m5d.large",
+                outpost_arns=[Token.as_string(data_aws_outposts_outpost_example.arn)]
+            ),
+            role_arn=example.arn,
+            vpc_config=EksClusterVpcConfig(
+                endpoint_private_access=True,
+                endpoint_public_access=False,
+                subnet_ids=subnet_ids
+            )
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_eks_cluster_example.override_logical_id("example")
+```
+
+After adding inline IAM Policies (e.g., [`aws_iam_role_policy` resource](/docs/providers/aws/r/iam_role_policy.html)) or attaching IAM Policies (e.g., [`aws_iam_policy` resource](/docs/providers/aws/r/iam_policy.html) and [`aws_iam_role_policy_attachment` resource](/docs/providers/aws/r/iam_role_policy_attachment.html)) with the desired permissions to the IAM Role, annotate the Kubernetes service account (e.g., [`kubernetes_service_account` resource](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/service_account)) and recreate any pods.
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` – (Required) Name of the cluster. Must be between 1-100 characters in length. Must begin with an alphanumeric character, and must only contain alphanumeric characters, dashes and underscores (`^[0-9A-Za-z][A-Za-z0-9\-_]+$`).
+* `role_arn` - (Required) ARN of the IAM role that provides permissions for the Kubernetes control plane to make calls to AWS API operations on your behalf. Ensure the resource configuration includes explicit dependencies on the IAM Role permissions by adding [`depends_on`](https://www.terraform.io/docs/configuration/meta-arguments/depends_on.html) if using the [`aws_iam_role_policy` resource](/docs/providers/aws/r/iam_role_policy.html) or [`aws_iam_role_policy_attachment` resource](/docs/providers/aws/r/iam_role_policy_attachment.html), otherwise EKS cannot delete EKS managed EC2 infrastructure such as Security Groups on EKS Cluster deletion.
+* `vpc_config` - (Required) Configuration block for the VPC associated with your cluster. Amazon EKS VPC resources have specific requirements to work properly with Kubernetes. For more information, see [Cluster VPC Considerations](https://docs.aws.amazon.com/eks/latest/userguide/network_reqs.html) and [Cluster Security Group Considerations](https://docs.aws.amazon.com/eks/latest/userguide/sec-group-reqs.html) in the Amazon EKS User Guide. Detailed below. Also contains attributes detailed in the Attributes section.
+
+The following arguments are optional:
+
+* `enabled_cluster_log_types` - (Optional) List of the desired control plane logging to enable. For more information, see [Amazon EKS Control Plane Logging](https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html).
+* `encryption_config` - (Optional) Configuration block with encryption configuration for the cluster. Only available on Kubernetes 1.13 and above clusters created after March 6, 2020. Detailed below.
+* `kubernetes_network_config` - (Optional) Configuration block with kubernetes network configuration for the cluster. Detailed below. If removed, Terraform will only perform drift detection if a configuration value is provided.
+* `outpost_config` - (Optional) Configuration block representing the configuration of your local Amazon EKS cluster on an AWS Outpost. This block isn't available for creating Amazon EKS clusters on the AWS cloud.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `version` – (Optional) Desired Kubernetes master version. If you do not specify a value, the latest available version at resource creation is used and no upgrades will occur except those automatically triggered by EKS. The value must be configured and increased to upgrade the version when desired. Downgrades are not supported by EKS.
+
+### encryption_config
+
+The `encryption_config` configuration block supports the following arguments:
+
+* `provider` - (Required) Configuration block with provider for encryption. Detailed below.
+* `resources` - (Required) List of strings with resources to be encrypted. Valid values: `secrets`.
+
+#### provider
+
+The `provider` configuration block supports the following arguments:
+
+* `key_arn` - (Required) ARN of the Key Management Service (KMS) customer master key (CMK). The CMK must be symmetric, created in the same region as the cluster, and if the CMK was created in a different account, the user must have access to the CMK. For more information, see [Allowing Users in Other Accounts to Use a CMK in the AWS Key Management Service Developer Guide](https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-modifying-external-accounts.html).
+
+### vpc_config Arguments
+
+* `endpoint_private_access` - (Optional) Whether the Amazon EKS private API server endpoint is enabled. Default is `false`.
+* `endpoint_public_access` - (Optional) Whether the Amazon EKS public API server endpoint is enabled. Default is `true`.
+* `public_access_cidrs` - (Optional) List of CIDR blocks. Indicates which CIDR blocks can access the Amazon EKS public API server endpoint when enabled. EKS defaults this to a list with `0.0.0.0/0`. Terraform will only perform drift detection of its value when present in a configuration.
+* `security_group_ids` – (Optional) List of security group IDs for the cross-account elastic network interfaces that Amazon EKS creates to use to allow communication between your worker nodes and the Kubernetes control plane.
+* `subnet_ids` – (Required) List of subnet IDs. Must be in at least two different availability zones. Amazon EKS creates cross-account elastic network interfaces in these subnets to allow communication between your worker nodes and the Kubernetes control plane.
+
+### kubernetes_network_config
+
+The `kubernetes_network_config` configuration block supports the following arguments:
+
+* `service_ipv4_cidr` - (Optional) The CIDR block to assign Kubernetes pod and service IP addresses from. If you don't specify a block, Kubernetes assigns addresses from either the 10.100.0.0/16 or 172.20.0.0/16 CIDR blocks. We recommend that you specify a block that does not overlap with resources in other networks that are peered or connected to your VPC. You can only specify a custom CIDR block when you create a cluster, changing this value will force a new cluster to be created. The block must meet the following requirements:
+
+    * Within one of the following private IP address blocks: 10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16.
+
+    * Doesn't overlap with any CIDR block assigned to the VPC that you selected for VPC.
+
+    * Between /24 and /12.
+* `ip_family` - (Optional) The IP family used to assign Kubernetes pod and service addresses. Valid values are `ipv4` (default) and `ipv6`. You can only specify an IP family when you create a cluster, changing this value will force a new cluster to be created.
+
+### outpost_config
+
+The `outpost_config` configuration block supports the following arguments:
+
+* `control_plane_instance_type` - (Required) The Amazon EC2 instance type that you want to use for your local Amazon EKS cluster on Outposts. The instance type that you specify is used for all Kubernetes control plane instances. The instance type can't be changed after cluster creation. Choose an instance type based on the number of nodes that your cluster will have. If your cluster will have:
+
+    * 1–20 nodes, then we recommend specifying a large instance type.
+
+    * 21–100 nodes, then we recommend specifying an xlarge instance type.
+
+    * 101–250 nodes, then we recommend specifying a 2xlarge instance type.
+
+    For a list of the available Amazon EC2 instance types, see Compute and storage in AWS Outposts rack features  The control plane is not automatically scaled by Amazon EKS.
+
+* `control_plane_placement` - (Optional) An object representing the placement configuration for all the control plane instances of your local Amazon EKS cluster on AWS Outpost.
+The `control_plane_placement` configuration block supports the following arguments:
+
+    * `group_name` - (Required) The name of the placement group for the Kubernetes control plane instances. This setting can't be changed after cluster creation.
+
+* `outpost_arns` - (Required) The ARN of the Outpost that you want to use for your local Amazon EKS cluster on Outposts. This argument is a list of arns, but only a single Outpost ARN is supported currently.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the cluster.
+* `certificate_authority` - Attribute block containing `certificate-authority-data` for your cluster. Detailed below.
+* `cluster_id` - The ID of your local Amazon EKS cluster on the AWS Outpost. This attribute isn't available for an AWS EKS cluster on AWS cloud.
+* `created_at` - Unix epoch timestamp in seconds for when the cluster was created.
+* `endpoint` - Endpoint for your Kubernetes API server.
+* `id` - Name of the cluster.
+* `identity` - Attribute block containing identity provider information for your cluster. Only available on Kubernetes version 1.13 and 1.14 clusters created or upgraded on or after September 3, 2019. Detailed below.
+* `kubernetes_network_config.service_ipv6_cidr` - The CIDR block that Kubernetes pod and service IP addresses are assigned from if you specified `ipv6` for ipFamily when you created the cluster. Kubernetes assigns service addresses from the unique local address range (fc00::/7) because you can't specify a custom IPv6 CIDR block when you create the cluster.
+* `platform_version` - Platform version for the cluster.
+* `status` - Status of the EKS cluster. One of `CREATING`, `ACTIVE`, `DELETING`, `FAILED`.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `vpc_config` - Configuration block _argument_ that also includes attributes for the VPC associated with your cluster. Detailed below.
+
+### certificate_authority
+
+* `data` - Base64 encoded certificate data required to communicate with your cluster. Add this to the `certificate-authority-data` section of the `kubeconfig` file for your cluster.
+
+### identity
+
+* `oidc` - Nested block containing [OpenID Connect](https://openid.net/connect/) identity provider information for the cluster. Detailed below.
+
+### oidc
+
+* `issuer` - Issuer URL for the OpenID Connect identity provider.
+
+### vpc_config Attributes
+
+* `cluster_security_group_id` - Cluster security group that was created by Amazon EKS for the cluster. Managed node groups use this security group for control-plane-to-data-plane communication.
+* `vpc_id` - ID of the VPC associated with your cluster.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `30m`)
+* `update` - (Default `60m`)
+Note that the `update` timeout is used separately for both `version` and `vpc_config` update timeouts.
+* `delete` - (Default `15m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EKS Clusters using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import EKS Clusters using the `name`. For example:
+
+```console
+% terraform import aws_eks_cluster.my_cluster my_cluster
+```
+
+<!-- cache-key: cdktf-0.18.0 input-6cb4e58d2d6459048ce11426d7c64e17bbcb1a488c1508bd0a076ea2e1feb536 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/eks_fargate_profile.html.markdown b/website/docs/cdktf/python/r/eks_fargate_profile.html.markdown
new file mode 100644
index 00000000000..a31ce88c928
--- /dev/null
+++ b/website/docs/cdktf/python/r/eks_fargate_profile.html.markdown
@@ -0,0 +1,136 @@
+---
+subcategory: "EKS (Elastic Kubernetes)"
+layout: "aws"
+page_title: "AWS: aws_eks_fargate_profile"
+description: |-
+  Manages an EKS Fargate Profile
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_eks_fargate_profile
+
+Manages an EKS Fargate Profile.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, Fn, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.eks_fargate_profile import EksFargateProfile
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        EksFargateProfile(self, "example",
+            cluster_name=Token.as_string(aws_eks_cluster_example.name),
+            fargate_profile_name="example",
+            pod_execution_role_arn=Token.as_string(aws_iam_role_example.arn),
+            selector=[EksFargateProfileSelector(
+                namespace="example"
+            )
+            ],
+            subnet_ids=Token.as_list(Fn.lookup_nested(aws_subnet_example, ["*", "id"]))
+        )
+```
+
+### Example IAM Role for EKS Fargate Profile
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.iam_role import IamRole
+from imports.aws.iam_role_policy_attachment import IamRolePolicyAttachment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = IamRole(self, "example",
+            assume_role_policy=Token.as_string(
+                Fn.jsonencode({
+                    "Statement": [{
+                        "Action": "sts:AssumeRole",
+                        "Effect": "Allow",
+                        "Principal": {
+                            "Service": "eks-fargate-pods.amazonaws.com"
+                        }
+                    }
+                    ],
+                    "Version": "2012-10-17"
+                })),
+            name="eks-fargate-profile-example"
+        )
+        IamRolePolicyAttachment(self, "example-AmazonEKSFargatePodExecutionRolePolicy",
+            policy_arn="arn:aws:iam::aws:policy/AmazonEKSFargatePodExecutionRolePolicy",
+            role=example.name
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `cluster_name` – (Required) Name of the EKS Cluster. Must be between 1-100 characters in length. Must begin with an alphanumeric character, and must only contain alphanumeric characters, dashes and underscores (`^[0-9A-Za-z][A-Za-z0-9\-_]+$`).
+* `fargate_profile_name` – (Required) Name of the EKS Fargate Profile.
+* `pod_execution_role_arn` – (Required) Amazon Resource Name (ARN) of the IAM Role that provides permissions for the EKS Fargate Profile.
+* `selector` - (Required) Configuration block(s) for selecting Kubernetes Pods to execute with this EKS Fargate Profile. Detailed below.
+* `subnet_ids` – (Required) Identifiers of private EC2 Subnets to associate with the EKS Fargate Profile. These subnets must have the following resource tag: `kubernetes.io/cluster/CLUSTER_NAME` (where `CLUSTER_NAME` is replaced with the name of the EKS Cluster).
+
+The following arguments are optional:
+
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### selector Configuration Block
+
+The following arguments are required:
+
+* `namespace` - (Required) Kubernetes namespace for selection.
+
+The following arguments are optional:
+
+* `labels` - (Optional) Key-value map of Kubernetes labels for selection.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the EKS Fargate Profile.
+* `id` - EKS Cluster name and EKS Fargate Profile name separated by a colon (`:`).
+* `status` - Status of the EKS Fargate Profile.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `10m`)
+* `delete` - (Default `10m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EKS Fargate Profiles using the `cluster_name` and `fargate_profile_name` separated by a colon (`:`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import EKS Fargate Profiles using the `cluster_name` and `fargate_profile_name` separated by a colon (`:`). For example:
+
+```console
+% terraform import aws_eks_fargate_profile.my_fargate_profile my_cluster:my_fargate_profile
+```
+
+<!-- cache-key: cdktf-0.18.0 input-52dddf83ced38ed29e926dd7cc5c30ad1c64cf020058373656f323fa68137332 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/eks_identity_provider_config.html.markdown b/website/docs/cdktf/python/r/eks_identity_provider_config.html.markdown
new file mode 100644
index 00000000000..11bfb398bad
--- /dev/null
+++ b/website/docs/cdktf/python/r/eks_identity_provider_config.html.markdown
@@ -0,0 +1,93 @@
+---
+subcategory: "EKS (Elastic Kubernetes)"
+layout: "aws"
+page_title: "AWS: aws_eks_identity_provider_config"
+description: |-
+  Manages an EKS Identity Provider Configuration.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_eks_identity_provider_config
+
+Manages an EKS Identity Provider Configuration.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.eks_identity_provider_config import EksIdentityProviderConfig
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        EksIdentityProviderConfig(self, "example",
+            cluster_name=Token.as_string(aws_eks_cluster_example.name),
+            oidc=EksIdentityProviderConfigOidc(
+                client_id="your client_id",
+                identity_provider_config_name="example",
+                issuer_url="your issuer_url"
+            )
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `cluster_name` – (Required) Name of the EKS Cluster.
+* `oidc` - (Required) Nested attribute containing [OpenID Connect](https://openid.net/connect/) identity provider information for the cluster. Detailed below.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### oidc Configuration Block
+
+* `client_id` – (Required) Client ID for the OpenID Connect identity provider.
+* `groups_claim` - (Optional) The JWT claim that the provider will use to return groups.
+* `groups_prefix` - (Optional) A prefix that is prepended to group claims e.g., `oidc:`.
+* `identity_provider_config_name` – (Required) The name of the identity provider config.
+* `issuer_url` - (Required) Issuer URL for the OpenID Connect identity provider.
+* `required_claims` - (Optional) The key value pairs that describe required claims in the identity token.
+* `username_claim` - (Optional) The JWT claim that the provider will use as the username.
+* `username_prefix` - (Optional) A prefix that is prepended to username claims.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the EKS Identity Provider Configuration.
+* `id` - EKS Cluster name and EKS Identity Provider Configuration name separated by a colon (`:`).
+* `status` - Status of the EKS Identity Provider Configuration.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `40m`)
+* `delete` - (Default `40m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EKS Identity Provider Configurations using the `cluster_name` and `identity_provider_config_name` separated by a colon (`:`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import EKS Identity Provider Configurations using the `cluster_name` and `identity_provider_config_name` separated by a colon (`:`). For example:
+
+```console
+% terraform import aws_eks_identity_provider_config.my_identity_provider_config my_cluster:my_identity_provider_config
+```
+
+<!-- cache-key: cdktf-0.18.0 input-5c1f7e41459f3297aafc7d76e5e6f234ff3ac373c8e28f3c212e15d50db41a0f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/eks_node_group.html.markdown b/website/docs/cdktf/python/r/eks_node_group.html.markdown
new file mode 100644
index 00000000000..1025905dac9
--- /dev/null
+++ b/website/docs/cdktf/python/r/eks_node_group.html.markdown
@@ -0,0 +1,289 @@
+---
+subcategory: "EKS (Elastic Kubernetes)"
+layout: "aws"
+page_title: "AWS: aws_eks_node_group"
+description: |-
+  Manages an EKS Node Group
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_eks_node_group
+
+Manages an EKS Node Group, which can provision and optionally update an Auto Scaling Group of Kubernetes worker nodes compatible with EKS. Additional documentation about this functionality can be found in the [EKS User Guide](https://docs.aws.amazon.com/eks/latest/userguide/managed-node-groups.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, Fn, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.eks_node_group import EksNodeGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        EksNodeGroup(self, "example",
+            cluster_name=Token.as_string(aws_eks_cluster_example.name),
+            depends_on=[example_amazon_eks_worker_node_policy, example_amazon_eks_cni_policy, example_amazon_ec2_container_registry_read_only
+            ],
+            node_group_name="example",
+            node_role_arn=Token.as_string(aws_iam_role_example.arn),
+            scaling_config=EksNodeGroupScalingConfig(
+                desired_size=1,
+                max_size=2,
+                min_size=1
+            ),
+            subnet_ids=Token.as_list(Fn.lookup_nested(aws_subnet_example, ["*", "id"])),
+            update_config=EksNodeGroupUpdateConfig(
+                max_unavailable=1
+            )
+        )
+```
+
+### Ignoring Changes to Desired Size
+
+You can utilize the generic Terraform resource [lifecycle configuration block](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html) with `ignore_changes` to create an EKS Node Group with an initial size of running instances, then ignore any changes to that count caused externally (e.g., Application Autoscaling).
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from cdktf import TerraformResourceLifecycle
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.eks_node_group import EksNodeGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, maxSize, minSize, clusterName, nodeRoleArn, subnetIds):
+        super().__init__(scope, name)
+        EksNodeGroup(self, "example",
+            lifecycle=TerraformResourceLifecycle(
+                ignore_changes=[d0.desired_size]
+            ),
+            scaling_config=EksNodeGroupScalingConfig(
+                desired_size=2,
+                max_size=max_size,
+                min_size=min_size
+            ),
+            cluster_name=cluster_name,
+            node_role_arn=node_role_arn,
+            subnet_ids=subnet_ids
+        )
+```
+
+### Tracking the latest EKS Node Group AMI releases
+
+You can have the node group track the latest version of the Amazon EKS optimized Amazon Linux AMI for a given EKS version by querying an Amazon provided SSM parameter. Replace `amazon-linux-2` in the parameter name below with `amazon-linux-2-gpu` to retrieve the  accelerated AMI version and `amazon-linux-2-arm64` to retrieve the Arm version.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, Fn, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_ssm_parameter import DataAwsSsmParameter
+from imports.aws.eks_node_group import EksNodeGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, scalingConfig):
+        super().__init__(scope, name)
+        eks_ami_release_version = DataAwsSsmParameter(self, "eks_ami_release_version",
+            name="/aws/service/eks/optimized-ami/${" + example.version + "}/amazon-linux-2/recommended/release_version"
+        )
+        EksNodeGroup(self, "example",
+            cluster_name=example.name,
+            node_group_name="example",
+            node_role_arn=Token.as_string(aws_iam_role_example.arn),
+            release_version=Token.as_string(
+                Fn.nonsensitive(eks_ami_release_version.value)),
+            subnet_ids=Token.as_list(Fn.lookup_nested(aws_subnet_example, ["*", "id"])),
+            version=example.version,
+            scaling_config=scaling_config
+        )
+```
+
+### Example IAM Role for EKS Node Group
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.iam_role import IamRole
+from imports.aws.iam_role_policy_attachment import IamRolePolicyAttachment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = IamRole(self, "example",
+            assume_role_policy=Token.as_string(
+                Fn.jsonencode({
+                    "Statement": [{
+                        "Action": "sts:AssumeRole",
+                        "Effect": "Allow",
+                        "Principal": {
+                            "Service": "ec2.amazonaws.com"
+                        }
+                    }
+                    ],
+                    "Version": "2012-10-17"
+                })),
+            name="eks-node-group-example"
+        )
+        IamRolePolicyAttachment(self, "example-AmazonEC2ContainerRegistryReadOnly",
+            policy_arn="arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
+            role=example.name
+        )
+        IamRolePolicyAttachment(self, "example-AmazonEKSWorkerNodePolicy",
+            policy_arn="arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy",
+            role=example.name
+        )
+        IamRolePolicyAttachment(self, "example-AmazonEKS_CNI_Policy",
+            policy_arn="arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy",
+            role=example.name
+        )
+```
+
+### Example Subnets for EKS Node Group
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformCount, Fn, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_availability_zones import DataAwsAvailabilityZones
+from imports.aws.subnet import Subnet
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        available = DataAwsAvailabilityZones(self, "available",
+            state="available"
+        )
+        # In most cases loops should be handled in the programming language context and
+        #     not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+        #     you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+        #     you need to keep this like it is.
+        example_count = TerraformCount.of(Token.as_number("2"))
+        Subnet(self, "example",
+            availability_zone=Token.as_string(
+                Fn.lookup_nested(available.names, [example_count.index])),
+            cidr_block=Token.as_string(
+                Fn.cidrsubnet(
+                    Token.as_string(aws_vpc_example.cidr_block), 8,
+                    Token.as_number(example_count.index))),
+            vpc_id=Token.as_string(aws_vpc_example.id),
+            count=example_count
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `cluster_name` – (Required) Name of the EKS Cluster. Must be between 1-100 characters in length. Must begin with an alphanumeric character, and must only contain alphanumeric characters, dashes and underscores (`^[0-9A-Za-z][A-Za-z0-9\-_]+$`).
+* `node_role_arn` – (Required) Amazon Resource Name (ARN) of the IAM Role that provides permissions for the EKS Node Group.
+* `scaling_config` - (Required) Configuration block with scaling settings. See [`scaling_config`](#scaling_config-configuration-block) below for details.
+* `subnet_ids` – (Required) Identifiers of EC2 Subnets to associate with the EKS Node Group.
+
+The following arguments are optional:
+
+* `ami_type` - (Optional) Type of Amazon Machine Image (AMI) associated with the EKS Node Group. See the [AWS documentation](https://docs.aws.amazon.com/eks/latest/APIReference/API_Nodegroup.html#AmazonEKS-Type-Nodegroup-amiType) for valid values. Terraform will only perform drift detection if a configuration value is provided.
+* `capacity_type` - (Optional) Type of capacity associated with the EKS Node Group. Valid values: `ON_DEMAND`, `SPOT`. Terraform will only perform drift detection if a configuration value is provided.
+* `disk_size` - (Optional) Disk size in GiB for worker nodes. Defaults to `50` for Windows, `20` all other node groups. Terraform will only perform drift detection if a configuration value is provided.
+* `force_update_version` - (Optional) Force version update if existing pods are unable to be drained due to a pod disruption budget issue.
+* `instance_types` - (Optional) List of instance types associated with the EKS Node Group. Defaults to `["t3.medium"]`. Terraform will only perform drift detection if a configuration value is provided.
+* `labels` - (Optional) Key-value map of Kubernetes labels. Only labels that are applied with the EKS API are managed by this argument. Other Kubernetes labels applied to the EKS Node Group will not be managed.
+* `launch_template` - (Optional) Configuration block with Launch Template settings. See [`launch_template`](#launch_template-configuration-block) below for details.
+* `node_group_name` – (Optional) Name of the EKS Node Group. If omitted, Terraform will assign a random, unique name. Conflicts with `node_group_name_prefix`. The node group name can't be longer than 63 characters. It must start with a letter or digit, but can also include hyphens and underscores for the remaining characters.
+* `node_group_name_prefix` – (Optional) Creates a unique name beginning with the specified prefix. Conflicts with `node_group_name`.
+* `release_version` – (Optional) AMI version of the EKS Node Group. Defaults to latest version for Kubernetes version.
+* `remote_access` - (Optional) Configuration block with remote access settings. See [`remote_access`](#remote_access-configuration-block) below for details.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `taint` - (Optional) The Kubernetes taints to be applied to the nodes in the node group. Maximum of 50 taints per node group. See [taint](#taint-configuration-block) below for details.
+* `update_config` - (Optional) Configuration block with update settings. See [`update_config`](#update_config-configuration-block) below for details.
+* `version` – (Optional) Kubernetes version. Defaults to EKS Cluster Kubernetes version. Terraform will only perform drift detection if a configuration value is provided.
+
+### launch_template Configuration Block
+
+~> **NOTE:** Either `id` or `name` must be specified.
+
+* `id` - (Optional) Identifier of the EC2 Launch Template. Conflicts with `name`.
+* `name` - (Optional) Name of the EC2 Launch Template. Conflicts with `id`.
+* `version` - (Required) EC2 Launch Template version number. While the API accepts values like `$Default` and `$Latest`, the API will convert the value to the associated version number (e.g., `1`) on read and Terraform will show a difference on next plan. Using the `default_version` or `latest_version` attribute of the `aws_launch_template` resource or data source is recommended for this argument.
+
+### remote_access Configuration Block
+
+* `ec2_ssh_key` - (Optional) EC2 Key Pair name that provides access for remote communication with the worker nodes in the EKS Node Group. If you specify this configuration, but do not specify `source_security_group_ids` when you create an EKS Node Group, either port 3389 for Windows, or port 22 for all other operating systems is opened on the worker nodes to the Internet (0.0.0.0/0). For Windows nodes, this will allow you to use RDP, for all others this allows you to SSH into the worker nodes.
+* `source_security_group_ids` - (Optional) Set of EC2 Security Group IDs to allow SSH access (port 22) from on the worker nodes. If you specify `ec2_ssh_key`, but do not specify this configuration when you create an EKS Node Group, port 22 on the worker nodes is opened to the Internet (0.0.0.0/0).
+
+### scaling_config Configuration Block
+
+* `desired_size` - (Required) Desired number of worker nodes.
+* `max_size` - (Required) Maximum number of worker nodes.
+* `min_size` - (Required) Minimum number of worker nodes.
+
+### taint Configuration Block
+
+* `key` - (Required) The key of the taint. Maximum length of 63.
+* `value` - (Optional) The value of the taint. Maximum length of 63.
+* `effect` - (Required) The effect of the taint. Valid values: `NO_SCHEDULE`, `NO_EXECUTE`, `PREFER_NO_SCHEDULE`.
+
+### update_config Configuration Block
+
+The following arguments are mutually exclusive.
+
+* `max_unavailable` - (Optional) Desired max number of unavailable worker nodes during node group update.
+* `max_unavailable_percentage` - (Optional) Desired max percentage of unavailable worker nodes during node group update.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the EKS Node Group.
+* `id` - EKS Cluster name and EKS Node Group name separated by a colon (`:`).
+* `resources` - List of objects containing information about underlying resources.
+    * `autoscaling_groups` - List of objects containing information about AutoScaling Groups.
+        * `name` - Name of the AutoScaling Group.
+    * `remote_access_security_group_id` - Identifier of the remote access EC2 Security Group.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `status` - Status of the EKS Node Group.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `60m`)
+* `update` - (Default `60m`)
+* `delete` - (Default `60m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EKS Node Groups using the `cluster_name` and `node_group_name` separated by a colon (`:`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import EKS Node Groups using the `cluster_name` and `node_group_name` separated by a colon (`:`). For example:
+
+```console
+% terraform import aws_eks_node_group.my_node_group my_cluster:my_node_group
+```
+
+<!-- cache-key: cdktf-0.18.0 input-129aa761b524fec3c4f03d1723899506954e7ced19cd217e1c8e264b7e760456 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/elastic_beanstalk_application.html.markdown b/website/docs/cdktf/python/r/elastic_beanstalk_application.html.markdown
new file mode 100644
index 00000000000..d014d19fff9
--- /dev/null
+++ b/website/docs/cdktf/python/r/elastic_beanstalk_application.html.markdown
@@ -0,0 +1,86 @@
+---
+subcategory: "Elastic Beanstalk"
+layout: "aws"
+page_title: "AWS: aws_elastic_beanstalk_application"
+description: |-
+  Provides an Elastic Beanstalk Application Resource
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_elastic_beanstalk_application
+
+Provides an Elastic Beanstalk Application Resource. Elastic Beanstalk allows
+you to deploy and manage applications in the AWS cloud without worrying about
+the infrastructure that runs those applications.
+
+This resource creates an application that has one configuration template named
+`default`, and no application versions
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.elastic_beanstalk_application import ElasticBeanstalkApplication
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ElasticBeanstalkApplication(self, "tftest",
+            appversion_lifecycle=ElasticBeanstalkApplicationAppversionLifecycle(
+                delete_source_from_s3=True,
+                max_count=128,
+                service_role=beanstalk_service.arn
+            ),
+            description="tf-test-desc",
+            name="tf-test-name"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the application, must be unique within your account
+* `description` - (Optional) Short description of the application
+* `tags` - (Optional) Key-value map of tags for the Elastic Beanstalk Application. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+Application version lifecycle (`appversion_lifecycle`) supports the following settings.  Only one of either `max_count` or `max_age_in_days` can be provided:
+
+* `service_role` - (Required) The ARN of an IAM service role under which the application version is deleted.  Elastic Beanstalk must have permission to assume this role.
+* `max_count` - (Optional) The maximum number of application versions to retain ('max_age_in_days' and 'max_count' cannot be enabled simultaneously.).
+* `max_age_in_days` - (Optional) The number of days to retain an application version ('max_age_in_days' and 'max_count' cannot be enabled simultaneously.).
+* `delete_source_from_s3` - (Optional) Set to `true` to delete a version's source bundle from S3 when the application version is deleted.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN assigned by AWS for this Elastic Beanstalk Application.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Elastic Beanstalk Applications using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Elastic Beanstalk Applications using the `name`. For example:
+
+```console
+% terraform import aws_elastic_beanstalk_application.tf_test tf-test-name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-6eaa1decc4c221d8dd0a8f0ef93ceb4a04389948c33dfca24f61bca9ea476b90 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/elastic_beanstalk_application_version.html.markdown b/website/docs/cdktf/python/r/elastic_beanstalk_application_version.html.markdown
new file mode 100644
index 00000000000..e64225ab383
--- /dev/null
+++ b/website/docs/cdktf/python/r/elastic_beanstalk_application_version.html.markdown
@@ -0,0 +1,92 @@
+---
+subcategory: "Elastic Beanstalk"
+layout: "aws"
+page_title: "AWS: aws_elastic_beanstalk_application_version"
+description: |-
+  Provides an Elastic Beanstalk Application Version Resource
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_elastic_beanstalk_application_version
+
+Provides an Elastic Beanstalk Application Version Resource. Elastic Beanstalk allows
+you to deploy and manage applications in the AWS cloud without worrying about
+the infrastructure that runs those applications.
+
+This resource creates a Beanstalk Application Version that can be deployed to a Beanstalk
+Environment.
+
+~> **NOTE on Application Version Resource:**  When using the Application Version resource with multiple
+[Elastic Beanstalk Environments](elastic_beanstalk_environment.html) it is possible that an error may be returned
+when attempting to delete an Application Version while it is still in use by a different environment.
+To work around this you can either create each environment in a separate AWS account or create your `aws_elastic_beanstalk_application_version` resources with a unique names in your Elastic Beanstalk Application. For example &lt;revision&gt;-&lt;environment&gt;.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.elastic_beanstalk_application import ElasticBeanstalkApplication
+from imports.aws.elastic_beanstalk_application_version import ElasticBeanstalkApplicationVersion
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_object import S3Object
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ElasticBeanstalkApplication(self, "default",
+            description="tf-test-desc",
+            name="tf-test-name"
+        )
+        aws_s3_bucket_default = S3Bucket(self, "default_1",
+            bucket="tftest.applicationversion.bucket"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_default.override_logical_id("default")
+        aws_s3_object_default = S3Object(self, "default_2",
+            bucket=Token.as_string(aws_s3_bucket_default.id),
+            key="beanstalk/go-v1.zip",
+            source="go-v1.zip"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_object_default.override_logical_id("default")
+        aws_elastic_beanstalk_application_version_default =
+        ElasticBeanstalkApplicationVersion(self, "default_3",
+            application="tf-test-name",
+            bucket=Token.as_string(aws_s3_bucket_default.id),
+            description="application version created by terraform",
+            key=Token.as_string(aws_s3_object_default.id),
+            name="tf-test-version-label"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_elastic_beanstalk_application_version_default.override_logical_id("default")
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `application` - (Required) Name of the Beanstalk Application the version is associated with.
+* `bucket` - (Required) S3 bucket that contains the Application Version source bundle.
+* `key` - (Required) S3 object that is the Application Version source bundle.
+* `name` - (Required) Unique name for the this Application Version.
+
+The following arguments are optional:
+
+* `description` - (Optional) Short description of the Application Version.
+* `force_delete` - (Optional) On delete, force an Application Version to be deleted when it may be in use by multiple Elastic Beanstalk Environments.
+* `tags` - (Optional) Key-value map of tags for the Elastic Beanstalk Application Version. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN assigned by AWS for this Elastic Beanstalk Application.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+<!-- cache-key: cdktf-0.18.0 input-751fb6889b75c7692aeacfbc770bb96d2cd80c1b9203d93fbf9daa51aef09d4a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/elastic_beanstalk_configuration_template.html.markdown b/website/docs/cdktf/python/r/elastic_beanstalk_configuration_template.html.markdown
new file mode 100644
index 00000000000..edffa82bc11
--- /dev/null
+++ b/website/docs/cdktf/python/r/elastic_beanstalk_configuration_template.html.markdown
@@ -0,0 +1,79 @@
+---
+subcategory: "Elastic Beanstalk"
+layout: "aws"
+page_title: "AWS: aws_elastic_beanstalk_configuration_template"
+description: |-
+  Provides an Elastic Beanstalk Configuration Template
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_elastic_beanstalk_configuration_template
+
+Provides an Elastic Beanstalk Configuration Template, which are associated with
+a specific application and are used to deploy different versions of the
+application with the same configuration settings.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.elastic_beanstalk_application import ElasticBeanstalkApplication
+from imports.aws.elastic_beanstalk_configuration_template import ElasticBeanstalkConfigurationTemplate
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        tftest = ElasticBeanstalkApplication(self, "tftest",
+            description="tf-test-desc",
+            name="tf-test-name"
+        )
+        ElasticBeanstalkConfigurationTemplate(self, "tf_template",
+            application=tftest.name,
+            name="tf-test-template-config",
+            solution_stack_name="64bit Amazon Linux 2015.09 v2.0.8 running Go 1.4"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) A unique name for this Template.
+* `application` – (Required) name of the application to associate with this configuration template
+* `description` - (Optional) Short description of the Template
+* `environment_id` – (Optional) The ID of the environment used with this configuration template
+* `setting` – (Optional) Option settings to configure the new Environment. These
+  override specific values that are set as defaults. The format is detailed
+  below in [Option Settings](#option-settings)
+* `solution_stack_name` – (Optional) A solution stack to base your Template
+off of. Example stacks can be found in the [Amazon API documentation][1]
+
+## Option Settings
+
+The `setting` field supports the following format:
+
+* `namespace` - unique namespace identifying the option's associated AWS resource
+* `name` - name of the configuration option
+* `value` - value for the configuration option
+* `resource` - (Optional) resource name for [scheduled action](https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/command-options-general.html#command-options-general-autoscalingscheduledaction)
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `name`
+* `application`
+* `description`
+* `environment_id`
+* `option_settings`
+* `solution_stack_name`
+
+[1]: https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/concepts.platforms.html
+
+<!-- cache-key: cdktf-0.18.0 input-abd91b17373f96fef9bb9422def3ab0d77d4ca67c22d5b83904d54987db262f7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/elastic_beanstalk_environment.html.markdown b/website/docs/cdktf/python/r/elastic_beanstalk_environment.html.markdown
new file mode 100644
index 00000000000..8d45787a1b1
--- /dev/null
+++ b/website/docs/cdktf/python/r/elastic_beanstalk_environment.html.markdown
@@ -0,0 +1,174 @@
+---
+subcategory: "Elastic Beanstalk"
+layout: "aws"
+page_title: "AWS: aws_elastic_beanstalk_environment"
+description: |-
+  Provides an Elastic Beanstalk Environment Resource
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_elastic_beanstalk_environment
+
+Provides an Elastic Beanstalk Environment Resource. Elastic Beanstalk allows
+you to deploy and manage applications in the AWS cloud without worrying about
+the infrastructure that runs those applications.
+
+Environments are often things such as `development`, `integration`, or
+`production`.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.elastic_beanstalk_application import ElasticBeanstalkApplication
+from imports.aws.elastic_beanstalk_environment import ElasticBeanstalkEnvironment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        tftest = ElasticBeanstalkApplication(self, "tftest",
+            description="tf-test-desc",
+            name="tf-test-name"
+        )
+        ElasticBeanstalkEnvironment(self, "tfenvtest",
+            application=tftest.name,
+            name="tf-test-name",
+            solution_stack_name="64bit Amazon Linux 2015.03 v2.0.3 running Go 1.4"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) A unique name for this Environment. This name is used
+  in the application URL
+* `application` – (Required) Name of the application that contains the version
+  to be deployed
+* `cname_prefix` - (Optional) Prefix to use for the fully qualified DNS name of
+  the Environment.
+* `description` - (Optional) Short description of the Environment
+* `tier` - (Optional) Elastic Beanstalk Environment tier. Valid values are `Worker`
+  or `WebServer`. If tier is left blank `WebServer` will be used.
+* `setting` – (Optional) Option settings to configure the new Environment. These
+  override specific values that are set as defaults. The format is detailed
+  below in [Option Settings](#option-settings)
+* `solution_stack_name` – (Optional) A solution stack to base your environment
+off of. Example stacks can be found in the [Amazon API documentation][1]
+* `template_name` – (Optional) The name of the Elastic Beanstalk Configuration
+  template to use in deployment
+* `platform_arn` – (Optional) The [ARN][2] of the Elastic Beanstalk [Platform][3]
+  to use in deployment
+* `wait_for_ready_timeout` - (Default `20m`) The maximum
+  [duration](https://golang.org/pkg/time/#ParseDuration) that Terraform should
+  wait for an Elastic Beanstalk Environment to be in a ready state before timing
+  out.
+* `poll_interval` – The time between polling the AWS API to
+check if changes have been applied. Use this to adjust the rate of API calls
+for any `create` or `update` action. Minimum `10s`, maximum `180s`. Omit this to
+use the default behavior, which is an exponential backoff
+* `version_label` - (Optional) The name of the Elastic Beanstalk Application Version
+to use in deployment.
+* `tags` - (Optional) A set of tags to apply to the Environment. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Option Settings
+
+Some options can be stack-specific, check [AWS Docs](https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/command-options-general.html)
+for supported options and examples.
+
+The `setting` and `all_settings` mappings support the following format:
+
+* `namespace` - unique namespace identifying the option's associated AWS resource
+* `name` - name of the configuration option
+* `value` - value for the configuration option
+* `resource` - (Optional) resource name for [scheduled action](https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/command-options-general.html#command-options-general-autoscalingscheduledaction)
+
+### Example With Options
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.elastic_beanstalk_application import ElasticBeanstalkApplication
+from imports.aws.elastic_beanstalk_environment import ElasticBeanstalkEnvironment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        tftest = ElasticBeanstalkApplication(self, "tftest",
+            description="tf-test-desc",
+            name="tf-test-name"
+        )
+        ElasticBeanstalkEnvironment(self, "tfenvtest",
+            application=tftest.name,
+            name="tf-test-name",
+            setting=[ElasticBeanstalkEnvironmentSetting(
+                name="VPCId",
+                namespace="aws:ec2:vpc",
+                value="vpc-xxxxxxxx"
+            ), ElasticBeanstalkEnvironmentSetting(
+                name="Subnets",
+                namespace="aws:ec2:vpc",
+                value="subnet-xxxxxxxx"
+            )
+            ],
+            solution_stack_name="64bit Amazon Linux 2015.03 v2.0.3 running Go 1.4"
+        )
+```
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the Elastic Beanstalk Environment.
+* `name` - Name of the Elastic Beanstalk Environment.
+* `description` - Description of the Elastic Beanstalk Environment.
+* `tier` - The environment tier specified.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `application` – The Elastic Beanstalk Application specified for this environment.
+* `setting` – Settings specifically set for this Environment.
+* `all_settings` – List of all option settings configured in this Environment. These
+  are a combination of default settings and their overrides from `setting` in
+  the configuration.
+* `cname` - Fully qualified DNS name for this Environment.
+* `autoscaling_groups` - The autoscaling groups used by this Environment.
+* `instances` - Instances used by this Environment.
+* `launch_configurations` - Launch configurations in use by this Environment.
+* `load_balancers` - Elastic load balancers in use by this Environment.
+* `queues` - SQS queues in use by this Environment.
+* `triggers` - Autoscaling triggers in use by this Environment.
+* `endpoint_url` - The URL to the Load Balancer for this Environment
+
+[1]: https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/concepts.platforms.html
+[2]: https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html
+[3]: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-beanstalk-environment.html#cfn-beanstalk-environment-platformarn
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Elastic Beanstalk Environments using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Elastic Beanstalk Environments using the `id`. For example:
+
+```console
+% terraform import aws_elastic_beanstalk_environment.prodenv e-rpqsewtp2j
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ad1ef9e1da7358ae03a61072b63ebad273ca716292310f87ea1ffcf0427f9d1d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/elasticache_cluster.html.markdown b/website/docs/cdktf/python/r/elasticache_cluster.html.markdown
new file mode 100644
index 00000000000..7eb83bedd34
--- /dev/null
+++ b/website/docs/cdktf/python/r/elasticache_cluster.html.markdown
@@ -0,0 +1,298 @@
+---
+subcategory: "ElastiCache"
+layout: "aws"
+page_title: "AWS: aws_elasticache_cluster"
+description: |-
+  Provides an ElastiCache Cluster resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_elasticache_cluster
+
+Provides an ElastiCache Cluster resource, which manages either a
+[Memcached cluster](https://docs.aws.amazon.com/AmazonElastiCache/latest/mem-ug/WhatIs.html), a
+[single-node Redis instance](https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/WhatIs.html), or a
+[read replica in a Redis (Cluster Mode Enabled) replication group].
+
+For working with Redis (Cluster Mode Enabled) replication groups, see the
+[`aws_elasticache_replication_group` resource](/docs/providers/aws/r/elasticache_replication_group.html).
+
+~> **Note:** When you change an attribute, such as `num_cache_nodes`, by default
+it is applied in the next maintenance window. Because of this, Terraform may report
+a difference in its planning phase because the actual modification has not yet taken
+place. You can use the `apply_immediately` flag to instruct the service to apply the
+change immediately. Using `apply_immediately` can result in a brief downtime as the server reboots.
+See the AWS Documentation on Modifying an ElastiCache Cache Cluster for
+[ElastiCache for Memcached](https://docs.aws.amazon.com/AmazonElastiCache/latest/mem-ug/Clusters.Modify.html) or
+[ElastiCache for Redis](https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/Clusters.Modify.html)
+for more information.
+
+~> **Note:** Any attribute changes that re-create the resource will be applied immediately, regardless of the value of `apply_immediately`.
+
+## Example Usage
+
+### Memcached Cluster
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.elasticache_cluster import ElasticacheCluster
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ElasticacheCluster(self, "example",
+            cluster_id="cluster-example",
+            engine="memcached",
+            node_type="cache.m4.large",
+            num_cache_nodes=2,
+            parameter_group_name="default.memcached1.4",
+            port=11211
+        )
+```
+
+### Redis Instance
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.elasticache_cluster import ElasticacheCluster
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ElasticacheCluster(self, "example",
+            cluster_id="cluster-example",
+            engine="redis",
+            engine_version="3.2.10",
+            node_type="cache.m4.large",
+            num_cache_nodes=1,
+            parameter_group_name="default.redis3.2",
+            port=6379
+        )
+```
+
+### Redis Cluster Mode Disabled Read Replica Instance
+
+These inherit their settings from the replication group.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.elasticache_cluster import ElasticacheCluster
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ElasticacheCluster(self, "replica",
+            cluster_id="cluster-example",
+            replication_group_id=example.id
+        )
+```
+
+### Redis Log Delivery configuration
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.elasticache_cluster import ElasticacheCluster
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ElasticacheCluster(self, "test",
+            apply_immediately=True,
+            cluster_id="mycluster",
+            engine="redis",
+            log_delivery_configuration=[ElasticacheClusterLogDeliveryConfiguration(
+                destination=example.name,
+                destination_type="cloudwatch-logs",
+                log_format="text",
+                log_type="slow-log"
+            ), ElasticacheClusterLogDeliveryConfiguration(
+                destination=Token.as_string(aws_kinesis_firehose_delivery_stream_example.name),
+                destination_type="kinesis-firehose",
+                log_format="json",
+                log_type="engine-log"
+            )
+            ],
+            node_type="cache.t3.micro",
+            num_cache_nodes=1,
+            port=6379
+        )
+```
+
+### Elasticache Cluster in Outpost
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_outposts_outpost import DataAwsOutpostsOutpost
+from imports.aws.data_aws_outposts_outposts import DataAwsOutpostsOutposts
+from imports.aws.elasticache_cluster import ElasticacheCluster
+from imports.aws.elasticache_subnet_group import ElasticacheSubnetGroup
+from imports.aws.subnet import Subnet
+from imports.aws.vpc import Vpc
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = Vpc(self, "example",
+            cidr_block="10.0.0.0/16"
+        )
+        data_aws_outposts_outposts_example = DataAwsOutpostsOutposts(self, "example_1")
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_outposts_outposts_example.override_logical_id("example")
+        aws_subnet_example = Subnet(self, "example_2",
+            cidr_block="10.0.1.0/24",
+            tags={
+                "Name": "my-subnet"
+            },
+            vpc_id=example.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_subnet_example.override_logical_id("example")
+        data_aws_outposts_outpost_example = DataAwsOutpostsOutpost(self, "example_3",
+            id=Token.as_string(
+                Fn.lookup_nested(Fn.tolist(data_aws_outposts_outposts_example.ids), ["0"]))
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_outposts_outpost_example.override_logical_id("example")
+        aws_elasticache_subnet_group_example = ElasticacheSubnetGroup(self, "example_4",
+            name="my-cache-subnet",
+            subnet_ids=[Token.as_string(aws_subnet_example.id)]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_elasticache_subnet_group_example.override_logical_id("example")
+        aws_elasticache_cluster_example = ElasticacheCluster(self, "example_5",
+            cluster_id="cluster-example",
+            engine="memcached",
+            node_type="cache.r5.large",
+            num_cache_nodes=2,
+            outpost_mode="single-outpost",
+            parameter_group_name="default.memcached1.4",
+            port=11211,
+            preferred_outpost_arn=Token.as_string(data_aws_outposts_outpost_example.arn),
+            subnet_group_name=Token.as_string(aws_elasticache_subnet_group_example.name)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_elasticache_cluster_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `cluster_id` – (Required) Group identifier. ElastiCache converts this name to lowercase. Changing this value will re-create the resource.
+* `engine` – (Optional, Required if `replication_group_id` is not specified) Name of the cache engine to be used for this cache cluster. Valid values are `memcached` or `redis`.
+* `node_type` – (Required unless `replication_group_id` is provided) The instance class used. See AWS documentation for information on [supported node types for Redis](https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/CacheNodes.SupportedTypes.html) and [guidance on selecting node types for Redis](https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/nodes-select-size.html). See AWS documentation for information on [supported node types for Memcached](https://docs.aws.amazon.com/AmazonElastiCache/latest/mem-ug/CacheNodes.SupportedTypes.html) and [guidance on selecting node types for Memcached](https://docs.aws.amazon.com/AmazonElastiCache/latest/mem-ug/nodes-select-size.html). For Memcached, changing this value will re-create the resource.
+* `num_cache_nodes` – (Required unless `replication_group_id` is provided) The initial number of cache nodes that the cache cluster will have. For Redis, this value must be 1. For Memcached, this value must be between 1 and 40. If this number is reduced on subsequent runs, the highest numbered nodes will be removed.
+* `parameter_group_name` – (Required unless `replication_group_id` is provided) The name of the parameter group to associate with this cache cluster.
+
+The following arguments are optional:
+
+* `apply_immediately` - (Optional) Whether any database modifications are applied immediately, or during the next maintenance window. Default is `false`. See [Amazon ElastiCache Documentation for more information.](https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_ModifyCacheCluster.html).
+* `auto_minor_version_upgrade` - (Optional) Specifies whether minor version engine upgrades will be applied automatically to the underlying Cache Cluster instances during the maintenance window.
+  Only supported for engine type `"redis"` and if the engine version is 6 or higher.
+  Defaults to `true`.
+* `availability_zone` - (Optional) Availability Zone for the cache cluster. If you want to create cache nodes in multi-az, use `preferred_availability_zones` instead. Default: System chosen Availability Zone. Changing this value will re-create the resource.
+* `az_mode` - (Optional, Memcached only) Whether the nodes in this Memcached node group are created in a single Availability Zone or created across multiple Availability Zones in the cluster's region. Valid values for this parameter are `single-az` or `cross-az`, default is `single-az`. If you want to choose `cross-az`, `num_cache_nodes` must be greater than `1`.
+* `engine_version` – (Optional) Version number of the cache engine to be used.
+  If not set, defaults to the latest version.
+  See [Describe Cache Engine Versions](https://docs.aws.amazon.com/cli/latest/reference/elasticache/describe-cache-engine-versions.html) in the AWS Documentation for supported versions.
+  When `engine` is `redis` and the version is 7 or higher, the major and minor version should be set, e.g., `7.2`.
+  When the version is 6, the major and minor version can be set, e.g., `6.2`,
+  or the minor version can be unspecified which will use the latest version at creation time, e.g., `6.x`.
+  Otherwise, specify the full version desired, e.g., `5.0.6`.
+  The actual engine version used is returned in the attribute `engine_version_actual`, see [Attribute Reference](#attribute-reference) below. Cannot be provided with `replication_group_id.`
+* `final_snapshot_identifier` - (Optional, Redis only) Name of your final cluster snapshot. If omitted, no final snapshot will be made.
+* `ip_discovery` - (Optional) The IP version to advertise in the discovery protocol. Valid values are `ipv4` or `ipv6`.
+* `log_delivery_configuration` - (Optional, Redis only) Specifies the destination and format of Redis [SLOWLOG](https://redis.io/commands/slowlog) or Redis [Engine Log](https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/Log_Delivery.html#Log_contents-engine-log). See the documentation on [Amazon ElastiCache](https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/Log_Delivery.html). See [Log Delivery Configuration](#log-delivery-configuration) below for more details.
+* `maintenance_window` – (Optional) Specifies the weekly time range for when maintenance
+on the cache cluster is performed. The format is `ddd:hh24:mi-ddd:hh24:mi` (24H Clock UTC).
+The minimum maintenance window is a 60 minute period. Example: `sun:05:00-sun:09:00`.
+* `network_type` - (Optional) The IP versions for cache cluster connections. IPv6 is supported with Redis engine `6.2` onword or Memcached version `1.6.6` for all [Nitro system](https://aws.amazon.com/ec2/nitro/) instances. Valid values are `ipv4`, `ipv6` or `dual_stack`.
+* `notification_topic_arn` – (Optional) ARN of an SNS topic to send ElastiCache notifications to. Example: `arn:aws:sns:us-east-1:012345678999:my_sns_topic`.
+* `outpost_mode` - (Optional) Specify the outpost mode that will apply to the cache cluster creation. Valid values are `"single-outpost"` and `"cross-outpost"`, however AWS currently only supports `"single-outpost"` mode.
+* `port` – (Optional) The port number on which each of the cache nodes will accept connections. For Memcached the default is 11211, and for Redis the default port is 6379. Cannot be provided with `replication_group_id`. Changing this value will re-create the resource.
+* `preferred_availability_zones` - (Optional, Memcached only) List of the Availability Zones in which cache nodes are created. If you are creating your cluster in an Amazon VPC you can only locate nodes in Availability Zones that are associated with the subnets in the selected subnet group. The number of Availability Zones listed must equal the value of `num_cache_nodes`. If you want all the nodes in the same Availability Zone, use `availability_zone` instead, or repeat the Availability Zone multiple times in the list. Default: System chosen Availability Zones. Detecting drift of existing node availability zone is not currently supported. Updating this argument by itself to migrate existing node availability zones is not currently supported and will show a perpetual difference.
+* `preferred_outpost_arn` - (Optional, Required if `outpost_mode` is specified) The outpost ARN in which the cache cluster will be created.
+* `replication_group_id` - (Optional, Required if `engine` is not specified) ID of the replication group to which this cluster should belong. If this parameter is specified, the cluster is added to the specified replication group as a read replica; otherwise, the cluster is a standalone primary that is not part of any replication group.
+* `security_group_ids` – (Optional, VPC only) One or more VPC security groups associated with the cache cluster. Cannot be provided with `replication_group_id.`
+* `snapshot_arns` – (Optional, Redis only) Single-element string list containing an Amazon Resource Name (ARN) of a Redis RDB snapshot file stored in Amazon S3. The object name cannot contain any commas. Changing `snapshot_arns` forces a new resource.
+* `snapshot_name` - (Optional, Redis only) Name of a snapshot from which to restore data into the new node group. Changing `snapshot_name` forces a new resource.
+* `snapshot_retention_limit` - (Optional, Redis only) Number of days for which ElastiCache will retain automatic cache cluster snapshots before deleting them. For example, if you set SnapshotRetentionLimit to 5, then a snapshot that was taken today will be retained for 5 days before being deleted. If the value of SnapshotRetentionLimit is set to zero (0), backups are turned off. Please note that setting a `snapshot_retention_limit` is not supported on cache.t1.micro cache nodes
+* `snapshot_window` - (Optional, Redis only) Daily time range (in UTC) during which ElastiCache will begin taking a daily snapshot of your cache cluster. Example: 05:00-09:00
+* `subnet_group_name` – (Optional, VPC only) Name of the subnet group to be used for the cache cluster. Changing this value will re-create the resource. Cannot be provided with `replication_group_id.`
+* `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `transit_encryption_enabled` - (Optional) Enable encryption in-transit. Supported only with Memcached versions `1.6.12` and later, running in a VPC. See the [ElastiCache in-transit encryption](https://docs.aws.amazon.com/AmazonElastiCache/latest/mem-ug/in-transit-encryption-mc.html) documentation for more details.
+
+### Log Delivery Configuration
+
+The `log_delivery_configuration` block allows the streaming of Redis [SLOWLOG](https://redis.io/commands/slowlog) or Redis [Engine Log](https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/Log_Delivery.html#Log_contents-engine-log) to CloudWatch Logs or Kinesis Data Firehose. Max of 2 blocks.
+
+* `destination` - Name of either the CloudWatch Logs LogGroup or Kinesis Data Firehose resource.
+* `destination_type` - For CloudWatch Logs use `cloudwatch-logs` or for Kinesis Data Firehose use `kinesis-firehose`.
+* `log_format` - Valid values are `json` or `text`
+* `log_type` - Valid values are  `slow-log` or `engine-log`. Max 1 of each.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the created ElastiCache Cluster.
+* `engine_version_actual` - Because ElastiCache pulls the latest minor or patch for a version, this attribute returns the running version of the cache engine.
+* `cache_nodes` - List of node objects including `id`, `address`, `port` and `availability_zone`.
+* `cluster_address` - (Memcached only) DNS name of the cache cluster without the port appended.
+* `configuration_endpoint` - (Memcached only) Configuration endpoint to allow host discovery.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `40m`)
+- `update` - (Default `80m`)
+- `delete` - (Default `40m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import ElastiCache Clusters using the `cluster_id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import ElastiCache Clusters using the `cluster_id`. For example:
+
+```console
+% terraform import aws_elasticache_cluster.my_cluster my_cluster
+```
+
+<!-- cache-key: cdktf-0.18.0 input-407a7f00eaf445bba1164068f7df66d3af3f6600a762abdab44b9baeff7de833 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/elasticache_global_replication_group.html.markdown b/website/docs/cdktf/python/r/elasticache_global_replication_group.html.markdown
new file mode 100644
index 00000000000..1c337bdd1d0
--- /dev/null
+++ b/website/docs/cdktf/python/r/elasticache_global_replication_group.html.markdown
@@ -0,0 +1,183 @@
+---
+subcategory: "ElastiCache"
+layout: "aws"
+page_title: "AWS: aws_elasticache_global_replication_group"
+description: |-
+  Provides an ElastiCache Global Replication Group resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_elasticache_global_replication_group
+
+Provides an ElastiCache Global Replication Group resource, which manages replication between two or more Replication Groups in different regions. For more information, see the [ElastiCache User Guide](https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/Redis-Global-Datastore.html).
+
+## Example Usage
+
+### Global replication group with one secondary replication group
+
+The global replication group depends on the primary group existing. Secondary replication groups depend on the global replication group. Terraform dependency management will handle this transparently using resource value references.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.elasticache_global_replication_group import ElasticacheGlobalReplicationGroup
+from imports.aws.elasticache_replication_group import ElasticacheReplicationGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        primary = ElasticacheReplicationGroup(self, "primary",
+            description="primary replication group",
+            engine="redis",
+            engine_version="5.0.6",
+            node_type="cache.m5.large",
+            num_cache_clusters=1,
+            replication_group_id="example-primary"
+        )
+        example = ElasticacheGlobalReplicationGroup(self, "example",
+            global_replication_group_id_suffix="example",
+            primary_replication_group_id=primary.id
+        )
+        ElasticacheReplicationGroup(self, "secondary",
+            description="secondary replication group",
+            global_replication_group_id=example.global_replication_group_id,
+            num_cache_clusters=1,
+            provider=other_region,
+            replication_group_id="example-secondary"
+        )
+```
+
+### Managing Redis Engine Versions
+
+The initial Redis version is determined by the version set on the primary replication group.
+However, once it is part of a Global Replication Group,
+the Global Replication Group manages the version of all member replication groups.
+
+The member replication groups must have [`lifecycle.ignore_changes[engine_version]`](https://www.terraform.io/language/meta-arguments/lifecycle) set,
+or Terraform will always return a diff.
+
+In this example,
+the primary replication group will be created with Redis 6.0,
+and then upgraded to Redis 6.2 once added to the Global Replication Group.
+The secondary replication group will be created with Redis 6.2.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from cdktf import TerraformResourceLifecycle, TerraformResourceLifecycle
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.elasticache_global_replication_group import ElasticacheGlobalReplicationGroup
+from imports.aws.elasticache_replication_group import ElasticacheReplicationGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        primary = ElasticacheReplicationGroup(self, "primary",
+            description="primary replication group",
+            engine="redis",
+            engine_version="6.0",
+            lifecycle=TerraformResourceLifecycle(
+                ignore_changes=[engine_version]
+            ),
+            node_type="cache.m5.large",
+            num_cache_clusters=1,
+            replication_group_id="example-primary"
+        )
+        example = ElasticacheGlobalReplicationGroup(self, "example",
+            engine_version="6.2",
+            global_replication_group_id_suffix="example",
+            primary_replication_group_id=primary.id
+        )
+        ElasticacheReplicationGroup(self, "secondary",
+            description="secondary replication group",
+            global_replication_group_id=example.global_replication_group_id,
+            lifecycle=TerraformResourceLifecycle(
+                ignore_changes=[engine_version]
+            ),
+            num_cache_clusters=1,
+            provider=other_region,
+            replication_group_id="example-secondary"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `automatic_failover_enabled` - (Optional) Specifies whether read-only replicas will be automatically promoted to read/write primary if the existing primary fails.
+  When creating, by default the Global Replication Group inherits the automatic failover setting of the primary replication group.
+* `cache_node_type` - (Optional) The instance class used.
+  See AWS documentation for information on [supported node types](https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/CacheNodes.SupportedTypes.html)
+  and [guidance on selecting node types](https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/nodes-select-size.html).
+  When creating, by default the Global Replication Group inherits the node type of the primary replication group.
+* `engine_version` - (Optional) Redis version to use for the Global Replication Group.
+  When creating, by default the Global Replication Group inherits the version of the primary replication group.
+  If a version is specified, the Global Replication Group and all member replication groups will be upgraded to this version.
+  Cannot be downgraded without replacing the Global Replication Group and all member replication groups.
+  When the version is 7 or higher, the major and minor version should be set, e.g., `7.2`.
+  When the version is 6, the major and minor version can be set, e.g., `6.2`,
+  or the minor version can be unspecified which will use the latest version at creation time, e.g., `6.x`.
+  The actual engine version used is returned in the attribute `engine_version_actual`, see [Attribute Reference](#attribute-reference) below.
+* `global_replication_group_id_suffix` – (Required) The suffix name of a Global Datastore. If `global_replication_group_id_suffix` is changed, creates a new resource.
+* `primary_replication_group_id` – (Required) The ID of the primary cluster that accepts writes and will replicate updates to the secondary cluster. If `primary_replication_group_id` is changed, creates a new resource.
+* `global_replication_group_description` – (Optional) A user-created description for the global replication group.
+* `num_node_groups` - (Optional) The number of node groups (shards) on the global replication group.
+* `parameter_group_name` - (Optional) An ElastiCache Parameter Group to use for the Global Replication Group.
+  Required when upgrading a major engine version, but will be ignored if left configured after the upgrade is complete.
+  Specifying without a major version upgrade will fail.
+  Note that ElastiCache creates a copy of this parameter group for each member replication group.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the ElastiCache Global Replication Group.
+* `arn` - The ARN of the ElastiCache Global Replication Group.
+* `engine_version_actual` - The full version number of the cache engine running on the members of this global replication group.
+* `at_rest_encryption_enabled` - A flag that indicate whether the encryption at rest is enabled.
+* `auth_token_enabled` - A flag that indicate whether AuthToken (password) is enabled.
+* `cluster_enabled` - Indicates whether the Global Datastore is cluster enabled.
+* `engine` - The name of the cache engine to be used for the clusters in this global replication group.
+* `global_replication_group_id` - The full ID of the global replication group.
+* `global_node_groups` - Set of node groups (shards) on the global replication group.
+  Has the values:
+    * `global_node_group_id` - The ID of the global node group.
+    * `slots` - The keyspace for this node group.
+* `transit_encryption_enabled` - A flag that indicates whether the encryption in transit is enabled.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `60m`)
+* `update` - (Default `60m`)
+* `delete` - (Default `20m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import ElastiCache Global Replication Groups using the `global_replication_group_id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import ElastiCache Global Replication Groups using the `global_replication_group_id`. For example:
+
+```console
+% terraform import aws_elasticache_global_replication_group.my_global_replication_group okuqm-global-replication-group-1
+```
+
+<!-- cache-key: cdktf-0.18.0 input-bfdf8fb8151d1dd27e56bf30242603f71120c4ececefd5c623f1f7efab72074a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/elasticache_parameter_group.html.markdown b/website/docs/cdktf/python/r/elasticache_parameter_group.html.markdown
new file mode 100644
index 00000000000..80a30afb382
--- /dev/null
+++ b/website/docs/cdktf/python/r/elasticache_parameter_group.html.markdown
@@ -0,0 +1,87 @@
+---
+subcategory: "ElastiCache"
+layout: "aws"
+page_title: "AWS: aws_elasticache_parameter_group"
+description: |-
+  Provides an ElastiCache parameter group resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_elasticache_parameter_group
+
+Provides an ElastiCache parameter group resource.
+
+~> **NOTE:** Attempting to remove the `reserved-memory` parameter when `family` is set to `redis2.6` or `redis2.8` may show a perpetual difference in Terraform due to an ElastiCache API limitation. Leave that parameter configured with any value to workaround the issue.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.elasticache_parameter_group import ElasticacheParameterGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ElasticacheParameterGroup(self, "default",
+            family="redis2.8",
+            name="cache-params",
+            parameter=[ElasticacheParameterGroupParameter(
+                name="activerehashing",
+                value="yes"
+            ), ElasticacheParameterGroupParameter(
+                name="min-slaves-to-write",
+                value="2"
+            )
+            ]
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the ElastiCache parameter group.
+* `family` - (Required) The family of the ElastiCache parameter group.
+* `description` - (Optional) The description of the ElastiCache parameter group. Defaults to "Managed by Terraform".
+* `parameter` - (Optional) A list of ElastiCache parameters to apply.
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+Parameter blocks support the following:
+
+* `name` - (Required) The name of the ElastiCache parameter.
+* `value` - (Required) The value of the ElastiCache parameter.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ElastiCache parameter group name.
+* `arn` - The AWS ARN associated with the parameter group.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import ElastiCache Parameter Groups using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import ElastiCache Parameter Groups using the `name`. For example:
+
+```console
+% terraform import aws_elasticache_parameter_group.default redis-params
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1858c11d21ea62b961241aaf317216a7b9adcdbbfcf280755e49cbf394b01a06 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/elasticache_replication_group.html.markdown b/website/docs/cdktf/python/r/elasticache_replication_group.html.markdown
new file mode 100644
index 00000000000..95865e176bb
--- /dev/null
+++ b/website/docs/cdktf/python/r/elasticache_replication_group.html.markdown
@@ -0,0 +1,323 @@
+---
+subcategory: "ElastiCache"
+layout: "aws"
+page_title: "AWS: aws_elasticache_replication_group"
+description: |-
+  Provides an ElastiCache Replication Group resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_elasticache_replication_group
+
+Provides an ElastiCache Replication Group resource.
+
+For working with a [Memcached cluster](https://docs.aws.amazon.com/AmazonElastiCache/latest/mem-ug/WhatIs.html) or a
+[single-node Redis instance (Cluster Mode Disabled)](https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/WhatIs.html),
+see the [`aws_elasticache_cluster` resource](/docs/providers/aws/r/elasticache_cluster.html).
+
+~> **Note:** When you change an attribute, such as `engine_version`, by
+default the ElastiCache API applies it in the next maintenance window. Because
+of this, Terraform may report a difference in its planning phase because the
+actual modification has not yet taken place. You can use the
+`apply_immediately` flag to instruct the service to apply the change
+immediately. Using `apply_immediately` can result in a brief downtime as
+servers reboots.
+See the AWS Documentation on
+[Modifying an ElastiCache Cache Cluster](https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/Clusters.Modify.html)
+for more information.
+
+~> **Note:** Any attribute changes that re-create the resource will be applied immediately, regardless of the value of `apply_immediately`.
+
+~> **Note:** Be aware of the terminology collision around "cluster" for `aws_elasticache_replication_group`. For example, it is possible to create a ["Cluster Mode Disabled [Redis] Cluster"](https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/Clusters.Create.CON.Redis.html). With "Cluster Mode Enabled", the data will be stored in shards (called "node groups"). See [Redis Cluster Configuration](https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/cluster-create-determine-requirements.html#redis-cluster-configuration) for a diagram of the differences. To enable cluster mode, use a parameter group that has cluster mode enabled. The default parameter groups provided by AWS end with ".cluster.on", for example `default.redis6.x.cluster.on`.
+
+## Example Usage
+
+### Redis Cluster Mode Disabled
+
+To create a single shard primary with single read replica:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.elasticache_replication_group import ElasticacheReplicationGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ElasticacheReplicationGroup(self, "example",
+            automatic_failover_enabled=True,
+            description="example description",
+            node_type="cache.m4.large",
+            num_cache_clusters=2,
+            parameter_group_name="default.redis3.2",
+            port=6379,
+            preferred_cache_cluster_azs=["us-west-2a", "us-west-2b"],
+            replication_group_id="tf-rep-group-1"
+        )
+```
+
+You have two options for adjusting the number of replicas:
+
+* Adjusting `num_cache_clusters` directly. This will attempt to automatically add or remove replicas, but provides no granular control (e.g., preferred availability zone, cache cluster ID) for the added or removed replicas. This also currently expects cache cluster IDs in the form of `replication_group_id-00#`.
+* Otherwise for fine grained control of the underlying cache clusters, they can be added or removed with the [`aws_elasticache_cluster` resource](/docs/providers/aws/r/elasticache_cluster.html) and its `replication_group_id` attribute. In this situation, you will need to utilize the [lifecycle configuration block](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html) with `ignore_changes` to prevent perpetual differences during Terraform plan with the `num_cache_cluster` attribute.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from cdktf import TerraformResourceLifecycle
+from constructs import Construct
+from cdktf import Token, TerraformCount, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.elasticache_cluster import ElasticacheCluster
+from imports.aws.elasticache_replication_group import ElasticacheReplicationGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = ElasticacheReplicationGroup(self, "example",
+            automatic_failover_enabled=True,
+            description="example description",
+            lifecycle=TerraformResourceLifecycle(
+                ignore_changes=[num_cache_clusters]
+            ),
+            node_type="cache.m4.large",
+            num_cache_clusters=2,
+            parameter_group_name="default.redis3.2",
+            port=6379,
+            preferred_cache_cluster_azs=["us-west-2a", "us-west-2b"],
+            replication_group_id="tf-rep-group-1"
+        )
+        # In most cases loops should be handled in the programming language context and
+        #     not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+        #     you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+        #     you need to keep this like it is.
+        replica_count = TerraformCount.of(Token.as_number("1"))
+        ElasticacheCluster(self, "replica",
+            cluster_id="tf-rep-group-1-${" + replica_count.index + "}",
+            replication_group_id=example.id,
+            count=replica_count
+        )
+```
+
+### Redis Cluster Mode Enabled
+
+To create two shards with a primary and a single read replica each:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.elasticache_replication_group import ElasticacheReplicationGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ElasticacheReplicationGroup(self, "baz",
+            automatic_failover_enabled=True,
+            description="example description",
+            node_type="cache.t2.small",
+            num_node_groups=2,
+            parameter_group_name="default.redis3.2.cluster.on",
+            port=6379,
+            replicas_per_node_group=1,
+            replication_group_id="tf-redis-cluster"
+        )
+```
+
+### Redis Log Delivery configuration
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.elasticache_replication_group import ElasticacheReplicationGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ElasticacheReplicationGroup(self, "test",
+            apply_immediately=True,
+            auto_minor_version_upgrade=Token.as_string(False),
+            description="test description",
+            log_delivery_configuration=[ElasticacheReplicationGroupLogDeliveryConfiguration(
+                destination=example.name,
+                destination_type="cloudwatch-logs",
+                log_format="text",
+                log_type="slow-log"
+            ), ElasticacheReplicationGroupLogDeliveryConfiguration(
+                destination=Token.as_string(aws_kinesis_firehose_delivery_stream_example.name),
+                destination_type="kinesis-firehose",
+                log_format="json",
+                log_type="engine-log"
+            )
+            ],
+            maintenance_window="tue:06:30-tue:07:30",
+            node_type="cache.t3.small",
+            port=6379,
+            replication_group_id="myreplicaciongroup",
+            snapshot_window="01:00-02:00"
+        )
+```
+
+~> **Note:** We currently do not support passing a `primary_cluster_id` in order to create the Replication Group.
+
+~> **Note:** Automatic Failover is unavailable for Redis versions earlier than 2.8.6,
+and unavailable on T1 node types. For T2 node types, it is only available on Redis version 3.2.4 or later with cluster mode enabled. See the [High Availability Using Replication Groups](https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/Replication.html) guide
+for full details on using Replication Groups.
+
+### Creating a secondary replication group for a global replication group
+
+A Global Replication Group can have one one two secondary Replication Groups in different regions. These are added to an existing Global Replication Group.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.elasticache_global_replication_group import ElasticacheGlobalReplicationGroup
+from imports.aws.elasticache_replication_group import ElasticacheReplicationGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        primary = ElasticacheReplicationGroup(self, "primary",
+            description="primary replication group",
+            engine="redis",
+            engine_version="5.0.6",
+            node_type="cache.m5.large",
+            num_cache_clusters=1,
+            provider=other_region,
+            replication_group_id="example-primary"
+        )
+        example = ElasticacheGlobalReplicationGroup(self, "example",
+            global_replication_group_id_suffix="example",
+            primary_replication_group_id=primary.id,
+            provider=other_region
+        )
+        ElasticacheReplicationGroup(self, "secondary",
+            description="secondary replication group",
+            global_replication_group_id=example.global_replication_group_id,
+            num_cache_clusters=1,
+            replication_group_id="example-secondary"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `description` – (Required) User-created description for the replication group. Must not be empty.
+* `replication_group_id` – (Required) Replication group identifier. This parameter is stored as a lowercase string.
+
+The following arguments are optional:
+
+* `apply_immediately` - (Optional) Specifies whether any modifications are applied immediately, or during the next maintenance window. Default is `false`.
+* `at_rest_encryption_enabled` - (Optional) Whether to enable encryption at rest.
+* `auth_token` - (Optional) Password used to access a password protected server. Can be specified only if `transit_encryption_enabled = true`.
+* `auto_minor_version_upgrade` - (Optional) Specifies whether minor version engine upgrades will be applied automatically to the underlying Cache Cluster instances during the maintenance window.
+  Only supported for engine type `"redis"` and if the engine version is 6 or higher.
+  Defaults to `true`.
+* `automatic_failover_enabled` - (Optional) Specifies whether a read-only replica will be automatically promoted to read/write primary if the existing primary fails. If enabled, `num_cache_clusters` must be greater than 1. Must be enabled for Redis (cluster mode enabled) replication groups. Defaults to `false`.
+* `data_tiering_enabled` - (Optional) Enables data tiering. Data tiering is only supported for replication groups using the r6gd node type. This parameter must be set to `true` when using r6gd nodes.
+* `engine` - (Optional) Name of the cache engine to be used for the clusters in this replication group. The only valid value is `redis`.
+* `engine_version` - (Optional) Version number of the cache engine to be used for the cache clusters in this replication group.
+  If the version is 7 or higher, the major and minor version should be set, e.g., `7.2`.
+  If the version is 6, the major and minor version can be set, e.g., `6.2`,
+  or the minor version can be unspecified which will use the latest version at creation time, e.g., `6.x`.
+  Otherwise, specify the full version desired, e.g., `5.0.6`.
+  The actual engine version used is returned in the attribute `engine_version_actual`, see [Attribute Reference](#attribute-reference) below.
+* `final_snapshot_identifier` - (Optional) The name of your final node group (shard) snapshot. ElastiCache creates the snapshot from the primary node in the cluster. If omitted, no final snapshot will be made.
+* `global_replication_group_id` - (Optional) The ID of the global replication group to which this replication group should belong. If this parameter is specified, the replication group is added to the specified global replication group as a secondary replication group; otherwise, the replication group is not part of any global replication group. If `global_replication_group_id` is set, the `num_node_groups` parameter cannot be set.
+* `ip_discovery` - (Optional) The IP version to advertise in the discovery protocol. Valid values are `ipv4` or `ipv6`.
+* `kms_key_id` - (Optional) The ARN of the key that you wish to use if encrypting at rest. If not supplied, uses service managed encryption. Can be specified only if `at_rest_encryption_enabled = true`.
+* `log_delivery_configuration` - (Optional, Redis only) Specifies the destination and format of Redis [SLOWLOG](https://redis.io/commands/slowlog) or Redis [Engine Log](https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/Log_Delivery.html#Log_contents-engine-log). See the documentation on [Amazon ElastiCache](https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/Log_Delivery.html#Log_contents-engine-log). See [Log Delivery Configuration](#log-delivery-configuration) below for more details.
+* `maintenance_window` – (Optional) Specifies the weekly time range for when maintenance on the cache cluster is performed. The format is `ddd:hh24:mi-ddd:hh24:mi` (24H Clock UTC). The minimum maintenance window is a 60 minute period. Example: `sun:05:00-sun:09:00`
+* `multi_az_enabled` - (Optional) Specifies whether to enable Multi-AZ Support for the replication group. If `true`, `automatic_failover_enabled` must also be enabled. Defaults to `false`.
+* `network_type` - (Optional) The IP versions for cache cluster connections. Valid values are `ipv4`, `ipv6` or `dual_stack`.
+* `node_type` - (Optional) Instance class to be used. See AWS documentation for information on [supported node types](https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/CacheNodes.SupportedTypes.html) and [guidance on selecting node types](https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/nodes-select-size.html). Required unless `global_replication_group_id` is set. Cannot be set if `global_replication_group_id` is set.
+* `notification_topic_arn` – (Optional) ARN of an SNS topic to send ElastiCache notifications to. Example: `arn:aws:sns:us-east-1:012345678999:my_sns_topic`
+* `num_cache_clusters` - (Optional) Number of cache clusters (primary and replicas) this replication group will have. If Multi-AZ is enabled, the value of this parameter must be at least 2. Updates will occur before other modifications. Conflicts with `num_node_groups`. Defaults to `1`.
+* `num_node_groups` - (Optional) Number of node groups (shards) for this Redis replication group.
+  Changing this number will trigger a resizing operation before other settings modifications.
+* `parameter_group_name` - (Optional) Name of the parameter group to associate with this replication group. If this argument is omitted, the default cache parameter group for the specified engine is used. To enable "cluster mode", i.e., data sharding, use a parameter group that has the parameter `cluster-enabled` set to true.
+* `port` – (Optional) Port number on which each of the cache nodes will accept connections. For Memcache the default is 11211, and for Redis the default port is 6379.
+* `preferred_cache_cluster_azs` - (Optional) List of EC2 availability zones in which the replication group's cache clusters will be created. The order of the availability zones in the list is considered. The first item in the list will be the primary node. Ignored when updating.
+* `replicas_per_node_group` - (Optional) Number of replica nodes in each node group.
+  Changing this number will trigger a resizing operation before other settings modifications.
+  Valid values are 0 to 5.
+* `security_group_ids` - (Optional) IDs of one or more Amazon VPC security groups associated with this replication group. Use this parameter only when you are creating a replication group in an Amazon Virtual Private Cloud.
+* `security_group_names` - (Optional) Names of one or more Amazon VPC security groups associated with this replication group. Use this parameter only when you are creating a replication group in an Amazon Virtual Private Cloud.
+* `snapshot_arns` – (Optional) List of ARNs that identify Redis RDB snapshot files stored in Amazon S3. The names object names cannot contain any commas.
+* `snapshot_name` - (Optional) Name of a snapshot from which to restore data into the new node group. Changing the `snapshot_name` forces a new resource.
+* `snapshot_retention_limit` - (Optional, Redis only) Number of days for which ElastiCache will retain automatic cache cluster snapshots before deleting them. For example, if you set SnapshotRetentionLimit to 5, then a snapshot that was taken today will be retained for 5 days before being deleted. If the value of `snapshot_retention_limit` is set to zero (0), backups are turned off. Please note that setting a `snapshot_retention_limit` is not supported on cache.t1.micro cache nodes
+* `snapshot_window` - (Optional, Redis only) Daily time range (in UTC) during which ElastiCache will begin taking a daily snapshot of your cache cluster. The minimum snapshot window is a 60 minute period. Example: `05:00-09:00`
+* `subnet_group_name` - (Optional) Name of the cache subnet group to be used for the replication group.
+* `tags` - (Optional) Map of tags to assign to the resource. Adding tags to this resource will add or overwrite any existing tags on the clusters in the replication group and not to the group itself. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `transit_encryption_enabled` - (Optional) Whether to enable encryption in transit.
+* `user_group_ids` - (Optional) User Group ID to associate with the replication group. Only a maximum of one (1) user group ID is valid. **NOTE:** This argument _is_ a set because the AWS specification allows for multiple IDs. However, in practice, AWS only allows a maximum size of one.
+
+### Log Delivery Configuration
+
+The `log_delivery_configuration` block allows the streaming of Redis [SLOWLOG](https://redis.io/commands/slowlog) or Redis [Engine Log](https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/Log_Delivery.html#Log_contents-engine-log) to CloudWatch Logs or Kinesis Data Firehose. Max of 2 blocks.
+
+* `destination` - Name of either the CloudWatch Logs LogGroup or Kinesis Data Firehose resource.
+* `destination_type` - For CloudWatch Logs use `cloudwatch-logs` or for Kinesis Data Firehose use `kinesis-firehose`.
+* `log_format` - Valid values are `json` or `text`
+* `log_type` - Valid values are  `slow-log` or `engine-log`. Max 1 of each.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the created ElastiCache Replication Group.
+* `engine_version_actual` - Because ElastiCache pulls the latest minor or patch for a version, this attribute returns the running version of the cache engine.
+* `cluster_enabled` - Indicates if cluster mode is enabled.
+* `configuration_endpoint_address` - Address of the replication group configuration endpoint when cluster mode is enabled.
+* `id` - ID of the ElastiCache Replication Group.
+* `member_clusters` - Identifiers of all the nodes that are part of this replication group.
+* `primary_endpoint_address` - (Redis only) Address of the endpoint for the primary node in the replication group, if the cluster mode is disabled.
+* `reader_endpoint_address` - (Redis only) Address of the endpoint for the reader node in the replication group, if the cluster mode is disabled.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `60m`)
+* `delete` - (Default `40m`)
+* `update` - (Default `40m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import ElastiCache Replication Groups using the `replication_group_id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import ElastiCache Replication Groups using the `replication_group_id`. For example:
+
+```console
+% terraform import aws_elasticache_replication_group.my_replication_group replication-group-1
+```
+
+<!-- cache-key: cdktf-0.18.0 input-29e9b485cffca2848117f5e673253482a1c7125d44f2bd91aac53bf7a91444be -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/elasticache_subnet_group.html.markdown b/website/docs/cdktf/python/r/elasticache_subnet_group.html.markdown
new file mode 100644
index 00000000000..91166e28d14
--- /dev/null
+++ b/website/docs/cdktf/python/r/elasticache_subnet_group.html.markdown
@@ -0,0 +1,90 @@
+---
+subcategory: "ElastiCache"
+layout: "aws"
+page_title: "AWS: aws_elasticache_subnet_group"
+description: |-
+  Provides an ElastiCache Subnet Group resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_elasticache_subnet_group
+
+Provides an ElastiCache Subnet Group resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.elasticache_subnet_group import ElasticacheSubnetGroup
+from imports.aws.subnet import Subnet
+from imports.aws.vpc import Vpc
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        foo = Vpc(self, "foo",
+            cidr_block="10.0.0.0/16",
+            tags={
+                "Name": "tf-test"
+            }
+        )
+        aws_subnet_foo = Subnet(self, "foo_1",
+            availability_zone="us-west-2a",
+            cidr_block="10.0.0.0/24",
+            tags={
+                "Name": "tf-test"
+            },
+            vpc_id=foo.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_subnet_foo.override_logical_id("foo")
+        ElasticacheSubnetGroup(self, "bar",
+            name="tf-test-cache-subnet",
+            subnet_ids=[Token.as_string(aws_subnet_foo.id)]
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` – (Required) Name for the cache subnet group. ElastiCache converts this name to lowercase.
+* `description` – (Optional) Description for the cache subnet group. Defaults to "Managed by Terraform".
+* `subnet_ids` – (Required) List of VPC Subnet IDs for the cache subnet group
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `description` - The Description of the ElastiCache Subnet Group.
+* `name` - The Name of the ElastiCache Subnet Group.
+* `subnet_ids` - The Subnet IDs of the ElastiCache Subnet Group.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import ElastiCache Subnet Groups using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import ElastiCache Subnet Groups using the `name`. For example:
+
+```console
+% terraform import aws_elasticache_subnet_group.bar tf-test-cache-subnet
+```
+
+<!-- cache-key: cdktf-0.18.0 input-d49c45c9808e5118d0af382be9e2a43a4d61bdb33e03f20e46b9f01473a0e825 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/elasticache_user.html.markdown b/website/docs/cdktf/python/r/elasticache_user.html.markdown
new file mode 100644
index 00000000000..437f61a00dc
--- /dev/null
+++ b/website/docs/cdktf/python/r/elasticache_user.html.markdown
@@ -0,0 +1,142 @@
+---
+subcategory: "ElastiCache"
+layout: "aws"
+page_title: "AWS: aws_elasticache_user"
+description: |-
+  Provides an ElastiCache user.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_elasticache_user
+
+Provides an ElastiCache user resource.
+
+~> **Note:** All arguments including the username and passwords will be stored in the raw state as plain-text.
+[Read more about sensitive data in state](https://www.terraform.io/docs/state/sensitive-data.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.elasticache_user import ElasticacheUser
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ElasticacheUser(self, "test",
+            access_string="on ~app::* -@all +@read +@hash +@bitmap +@geo -setbit -bitfield -hset -hsetnx -hmset -hincrby -hincrbyfloat -hdel -bitop -geoadd -georadius -georadiusbymember",
+            engine="REDIS",
+            passwords=["password123456789"],
+            user_id="testUserId",
+            user_name="testUserName"
+        )
+```
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.elasticache_user import ElasticacheUser
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ElasticacheUser(self, "test",
+            access_string="on ~* +@all",
+            authentication_mode=ElasticacheUserAuthenticationMode(
+                type="iam"
+            ),
+            engine="REDIS",
+            user_id="testUserId",
+            user_name="testUserName"
+        )
+```
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.elasticache_user import ElasticacheUser
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ElasticacheUser(self, "test",
+            access_string="on ~* +@all",
+            authentication_mode=ElasticacheUserAuthenticationMode(
+                passwords=["password1", "password2"],
+                type="password"
+            ),
+            engine="REDIS",
+            user_id="testUserId",
+            user_name="testUserName"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `access_string` - (Required) Access permissions string used for this user. See [Specifying Permissions Using an Access String](https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/Clusters.RBAC.html#Access-string) for more details.
+* `engine` - (Required) The current supported value is `REDIS`.
+* `user_id` - (Required) The ID of the user.
+* `user_name` - (Required) The username of the user.
+
+The following arguments are optional:
+
+* `authentication_mode` - (Optional) Denotes the user's authentication properties. Detailed below.
+* `no_password_required` - (Optional) Indicates a password is not required for this user.
+* `passwords` - (Optional) Passwords used for this user. You can create up to two passwords for each user.
+* `tags` - (Optional) A list of tags to be added to this resource. A tag is a key-value pair.
+
+### authentication_mode Configuration Block
+
+* `passwords` - (Optional) Specifies the passwords to use for authentication if `type` is set to `password`.
+* `type` - (Required) Specifies the authentication type. Possible options are: `password`, `no-password-required` or `iam`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the created ElastiCache User.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `5m`)
+- `update` - (Default `5m`)
+- `delete` - (Default `5m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import ElastiCache users using the `user_id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import ElastiCache users using the `user_id`. For example:
+
+```console
+% terraform import aws_elasticache_user.my_user userId1
+```
+
+<!-- cache-key: cdktf-0.18.0 input-c37a7a3d6865b0708a24bc5e37568bc382a09c2d006a5a45f7b5eac613f84ed1 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/elasticache_user_group.html.markdown b/website/docs/cdktf/python/r/elasticache_user_group.html.markdown
new file mode 100644
index 00000000000..9a2177767a6
--- /dev/null
+++ b/website/docs/cdktf/python/r/elasticache_user_group.html.markdown
@@ -0,0 +1,85 @@
+---
+subcategory: "ElastiCache"
+layout: "aws"
+page_title: "AWS: aws_elasticache_user_group"
+description: |-
+  Provides an ElastiCache user group.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_elasticache_user_group
+
+Provides an ElastiCache user group resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.elasticache_user import ElasticacheUser
+from imports.aws.elasticache_user_group import ElasticacheUserGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        test = ElasticacheUser(self, "test",
+            access_string="on ~app::* -@all +@read +@hash +@bitmap +@geo -setbit -bitfield -hset -hsetnx -hmset -hincrby -hincrbyfloat -hdel -bitop -geoadd -georadius -georadiusbymember",
+            engine="REDIS",
+            passwords=["password123456789"],
+            user_id="testUserId",
+            user_name="default"
+        )
+        aws_elasticache_user_group_test = ElasticacheUserGroup(self, "test_1",
+            engine="REDIS",
+            user_group_id="userGroupId",
+            user_ids=[test.user_id]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_elasticache_user_group_test.override_logical_id("test")
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `engine` - (Required) The current supported value is `REDIS`.
+* `user_group_id` - (Required) The ID of the user group.
+
+The following arguments are optional:
+
+* `user_ids` - (Optional) The list of user IDs that belong to the user group.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The user group identifier.
+* `arn` - The ARN that identifies the user group.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import ElastiCache user groups using the `user_group_id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import ElastiCache user groups using the `user_group_id`. For example:
+
+```console
+% terraform import aws_elasticache_user_group.my_user_group userGoupId1
+```
+
+<!-- cache-key: cdktf-0.18.0 input-273ead1e6f40d517ea4aa4538fa2dae8368c51b3c1f92a67ddcf5ffa9c8dd66f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/elasticache_user_group_association.html.markdown b/website/docs/cdktf/python/r/elasticache_user_group_association.html.markdown
new file mode 100644
index 00000000000..bccf96529a8
--- /dev/null
+++ b/website/docs/cdktf/python/r/elasticache_user_group_association.html.markdown
@@ -0,0 +1,97 @@
+---
+subcategory: "ElastiCache"
+layout: "aws"
+page_title: "AWS: aws_elasticache_user_group_association"
+description: |-
+  Associate an ElastiCache user and user group.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_elasticache_user_group_association
+
+Associate an existing ElastiCache user and an existing user group.
+
+~> **NOTE:** Terraform will detect changes in the `aws_elasticache_user_group` since `aws_elasticache_user_group_association` changes the user IDs associated with the user group. You can ignore these changes with the `lifecycle` `ignore_changes` meta argument as shown in the example.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from cdktf import TerraformResourceLifecycle
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.elasticache_user import ElasticacheUser
+from imports.aws.elasticache_user_group import ElasticacheUserGroup
+from imports.aws.elasticache_user_group_association import ElasticacheUserGroupAssociation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        default_var = ElasticacheUser(self, "default",
+            access_string="on ~app::* -@all +@read +@hash +@bitmap +@geo -setbit -bitfield -hset -hsetnx -hmset -hincrby -hincrbyfloat -hdel -bitop -geoadd -georadius -georadiusbymember",
+            engine="REDIS",
+            passwords=["password123456789"],
+            user_id="defaultUserID",
+            user_name="default"
+        )
+        example = ElasticacheUser(self, "example",
+            access_string="on ~app::* -@all +@read +@hash +@bitmap +@geo -setbit -bitfield -hset -hsetnx -hmset -hincrby -hincrbyfloat -hdel -bitop -geoadd -georadius -georadiusbymember",
+            engine="REDIS",
+            passwords=["password123456789"],
+            user_id="exampleUserID",
+            user_name="exampleuser"
+        )
+        aws_elasticache_user_group_example = ElasticacheUserGroup(self, "example_2",
+            engine="REDIS",
+            lifecycle=TerraformResourceLifecycle(
+                ignore_changes=[user_ids]
+            ),
+            user_group_id="userGroupId",
+            user_ids=[default_var.user_id]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_elasticache_user_group_example.override_logical_id("example")
+        aws_elasticache_user_group_association_example =
+        ElasticacheUserGroupAssociation(self, "example_3",
+            user_group_id=Token.as_string(aws_elasticache_user_group_example.user_group_id),
+            user_id=example.user_id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_elasticache_user_group_association_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `user_group_id` - (Required) ID of the user group.
+* `user_id` - (Required) ID of the user to associated with the user group.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import ElastiCache user group associations using the `user_group_id` and `user_id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import ElastiCache user group associations using the `user_group_id` and `user_id`. For example:
+
+```console
+% terraform import aws_elasticache_user_group_association.example userGoupId1,userId
+```
+
+<!-- cache-key: cdktf-0.18.0 input-0fb04431352bb053d0baffe8ca67747d1db14fc5f35be68ff3b233036b0d1ebf -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/elasticsearch_domain.html.markdown b/website/docs/cdktf/python/r/elasticsearch_domain.html.markdown
new file mode 100644
index 00000000000..a0993ca90bc
--- /dev/null
+++ b/website/docs/cdktf/python/r/elasticsearch_domain.html.markdown
@@ -0,0 +1,396 @@
+---
+subcategory: "Elasticsearch"
+layout: "aws"
+page_title: "AWS: aws_elasticsearch_domain"
+description: |-
+  Terraform resource for managing an AWS Elasticsearch Domain.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_elasticsearch_domain
+
+Manages an AWS Elasticsearch Domain.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.elasticsearch_domain import ElasticsearchDomain
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ElasticsearchDomain(self, "example",
+            cluster_config=ElasticsearchDomainClusterConfig(
+                instance_type="r4.large.elasticsearch"
+            ),
+            domain_name="example",
+            elasticsearch_version="7.10",
+            tags={
+                "Domain": "TestDomain"
+            }
+        )
+```
+
+### Access Policy
+
+-> See also: [`aws_elasticsearch_domain_policy` resource](/docs/providers/aws/r/elasticsearch_domain_policy.html)
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformVariable, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_caller_identity import DataAwsCallerIdentity
+from imports.aws.data_aws_region import DataAwsRegion
+from imports.aws.elasticsearch_domain import ElasticsearchDomain
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        # Terraform Variables are not always the best fit for getting inputs in the context of Terraform CDK.
+        #     You can read more about this at https://cdk.tf/variables
+        domain = TerraformVariable(self, "domain",
+            default="tf-test"
+        )
+        current = DataAwsCallerIdentity(self, "current")
+        data_aws_region_current = DataAwsRegion(self, "current_2")
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_region_current.override_logical_id("current")
+        ElasticsearchDomain(self, "example",
+            access_policies="{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Action\": \"es:*\",\n      \"Principal\": \"*\",\n      \"Effect\": \"Allow\",\n      \"Resource\": \"arn:aws:es:${" + data_aws_region_current.name + "}:${" + current.account_id + "}:domain/${" + domain.value + "}/*\",\n      \"Condition\": {\n        \"IpAddress\": {\"aws:SourceIp\": [\"66.193.100.22/32\"]}\n      }\n    }\n  ]\n}\n\n",
+            domain_name=domain.string_value
+        )
+```
+
+### Log Publishing to CloudWatch Logs
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudwatch_log_group import CloudwatchLogGroup
+from imports.aws.cloudwatch_log_resource_policy import CloudwatchLogResourcePolicy
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.elasticsearch_domain import ElasticsearchDomain
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, domainName):
+        super().__init__(scope, name)
+        example = CloudwatchLogGroup(self, "example",
+            name="example"
+        )
+        aws_elasticsearch_domain_example = ElasticsearchDomain(self, "example_1",
+            log_publishing_options=[ElasticsearchDomainLogPublishingOptions(
+                cloudwatch_log_group_arn=example.arn,
+                log_type="INDEX_SLOW_LOGS"
+            )
+            ],
+            domain_name=domain_name
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_elasticsearch_domain_example.override_logical_id("example")
+        data_aws_iam_policy_document_example = DataAwsIamPolicyDocument(self, "example_2",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["logs:PutLogEvents", "logs:PutLogEventsBatch", "logs:CreateLogStream"
+                ],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["es.amazonaws.com"],
+                    type="Service"
+                )
+                ],
+                resources=["arn:aws:logs:*"]
+            )
+            ]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_iam_policy_document_example.override_logical_id("example")
+        aws_cloudwatch_log_resource_policy_example =
+        CloudwatchLogResourcePolicy(self, "example_3",
+            policy_document=Token.as_string(data_aws_iam_policy_document_example.json),
+            policy_name="example"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_cloudwatch_log_resource_policy_example.override_logical_id("example")
+```
+
+### VPC based ES
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformVariable, Token, Fn, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_caller_identity import DataAwsCallerIdentity
+from imports.aws.data_aws_region import DataAwsRegion
+from imports.aws.data_aws_subnets import DataAwsSubnets
+from imports.aws.data_aws_vpc import DataAwsVpc
+from imports.aws.elasticsearch_domain import ElasticsearchDomain
+from imports.aws.iam_service_linked_role import IamServiceLinkedRole
+from imports.aws.security_group import SecurityGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        # Terraform Variables are not always the best fit for getting inputs in the context of Terraform CDK.
+        #     You can read more about this at https://cdk.tf/variables
+        domain = TerraformVariable(self, "domain",
+            default="tf-test"
+        )
+        vpc = TerraformVariable(self, "vpc")
+        es = IamServiceLinkedRole(self, "es",
+            aws_service_name="opensearchservice.amazonaws.com"
+        )
+        current = DataAwsCallerIdentity(self, "current")
+        data_aws_region_current = DataAwsRegion(self, "current_4")
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_region_current.override_logical_id("current")
+        selected = DataAwsVpc(self, "selected",
+            tags={
+                "Name": vpc.string_value
+            }
+        )
+        aws_security_group_es = SecurityGroup(self, "es_6",
+            description="Managed by Terraform",
+            ingress=[SecurityGroupIngress(
+                cidr_blocks=[Token.as_string(selected.cidr_block)],
+                from_port=443,
+                protocol="tcp",
+                to_port=443
+            )
+            ],
+            name="${" + vpc.value + "}-elasticsearch-${" + domain.value + "}",
+            vpc_id=Token.as_string(selected.id)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_security_group_es.override_logical_id("es")
+        data_aws_subnets_selected = DataAwsSubnets(self, "selected_7",
+            filter=[DataAwsSubnetsFilter(
+                name="vpc-id",
+                values=[Token.as_string(selected.id)]
+            )
+            ],
+            tags={
+                "Tier": "private"
+            }
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_subnets_selected.override_logical_id("selected")
+        aws_elasticsearch_domain_es = ElasticsearchDomain(self, "es_8",
+            access_policies="{\n\t\"Version\": \"2012-10-17\",\n\t\"Statement\": [\n\t\t{\n\t\t\t\"Action\": \"es:*\",\n\t\t\t\"Principal\": \"*\",\n\t\t\t\"Effect\": \"Allow\",\n\t\t\t\"Resource\": \"arn:aws:es:${" + data_aws_region_current.name + "}:${" + current.account_id + "}:domain/${" + domain.value + "}/*\"\n\t\t}\n\t]\n}\n\n",
+            advanced_options={
+                "rest.action.multi.allow_explicit_index": "true"
+            },
+            cluster_config=ElasticsearchDomainClusterConfig(
+                instance_type="m4.large.elasticsearch",
+                zone_awareness_enabled=True
+            ),
+            depends_on=[es],
+            domain_name=domain.string_value,
+            elasticsearch_version="6.3",
+            tags={
+                "Domain": "TestDomain"
+            },
+            vpc_options=ElasticsearchDomainVpcOptions(
+                security_group_ids=[Token.as_string(aws_security_group_es.id)],
+                subnet_ids=[
+                    Token.as_string(Fn.lookup_nested(data_aws_subnets_selected.ids, ["0"])),
+                    Token.as_string(Fn.lookup_nested(data_aws_subnets_selected.ids, ["1"]))
+                ]
+            )
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_elasticsearch_domain_es.override_logical_id("es")
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `domain_name` - (Required) Name of the domain.
+
+The following arguments are optional:
+
+* `access_policies` - (Optional) IAM policy document specifying the access policies for the domain.
+* `advanced_options` - (Optional) Key-value string pairs to specify advanced configuration options. Note that the values for these configuration options must be strings (wrapped in quotes) or they may be wrong and cause a perpetual diff, causing Terraform to want to recreate your Elasticsearch domain on every apply.
+* `advanced_security_options` - (Optional) Configuration block for [fine-grained access control](https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/fgac.html). Detailed below.
+* `auto_tune_options` - (Optional) Configuration block for the Auto-Tune options of the domain. Detailed below.
+* `cluster_config` - (Optional) Configuration block for the cluster of the domain. Detailed below.
+* `cognito_options` - (Optional) Configuration block for authenticating Kibana with Cognito. Detailed below.
+* `domain_endpoint_options` - (Optional) Configuration block for domain endpoint HTTP(S) related options. Detailed below.
+* `ebs_options` - (Optional) Configuration block for EBS related options, may be required based on chosen [instance size](https://aws.amazon.com/elasticsearch-service/pricing/). Detailed below.
+* `elasticsearch_version` - (Optional) Version of Elasticsearch to deploy. Defaults to `1.5`.
+* `encrypt_at_rest` - (Optional) Configuration block for encrypt at rest options. Only available for [certain instance types](http://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/aes-supported-instance-types.html). Detailed below.
+* `log_publishing_options` - (Optional) Configuration block for publishing slow and application logs to CloudWatch Logs. This block can be declared multiple times, for each log_type, within the same resource. Detailed below.
+* `node_to_node_encryption` - (Optional) Configuration block for node-to-node encryption options. Detailed below.
+* `snapshot_options` - (Optional) Configuration block for snapshot related options. Detailed below. DEPRECATED. For domains running Elasticsearch 5.3 and later, Amazon ES takes hourly automated snapshots, making this setting irrelevant. For domains running earlier versions of Elasticsearch, Amazon ES takes daily automated snapshots.
+* `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `vpc_options` - (Optional) Configuration block for VPC related options. Adding or removing this configuration forces a new resource ([documentation](https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-vpc.html#es-vpc-limitations)). Detailed below.
+
+### advanced_security_options
+
+* `enabled` - (Required, Forces new resource) Whether advanced security is enabled.
+* `internal_user_database_enabled` - (Optional, Default: false) Whether the internal user database is enabled. If not set, defaults to `false` by the AWS API.
+* `master_user_options` - (Optional) Configuration block for the main user. Detailed below.
+
+#### master_user_options
+
+* `master_user_arn` - (Optional) ARN for the main user. Only specify if `internal_user_database_enabled` is not set or set to `false`.
+* `master_user_name` - (Optional) Main user's username, which is stored in the Amazon Elasticsearch Service domain's internal database. Only specify if `internal_user_database_enabled` is set to `true`.
+* `master_user_password` - (Optional) Main user's password, which is stored in the Amazon Elasticsearch Service domain's internal database. Only specify if `internal_user_database_enabled` is set to `true`.
+
+### auto_tune_options
+
+* `desired_state` - (Required) The Auto-Tune desired state for the domain. Valid values: `ENABLED` or `DISABLED`.
+* `maintenance_schedule` - (Required if `rollback_on_disable` is set to `DEFAULT_ROLLBACK`) Configuration block for Auto-Tune maintenance windows. Can be specified multiple times for each maintenance window. Detailed below.
+* `rollback_on_disable` - (Optional) Whether to roll back to default Auto-Tune settings when disabling Auto-Tune. Valid values: `DEFAULT_ROLLBACK` or `NO_ROLLBACK`.
+
+#### maintenance_schedule
+
+* `start_at` - (Required) Date and time at which to start the Auto-Tune maintenance schedule in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8).
+* `duration` - (Required) Configuration block for the duration of the Auto-Tune maintenance window. Detailed below.
+* `cron_expression_for_recurrence` - (Required) A cron expression specifying the recurrence pattern for an Auto-Tune maintenance schedule.
+
+##### duration
+
+* `value` - (Required) An integer specifying the value of the duration of an Auto-Tune maintenance window.
+* `unit` - (Required) The unit of time specifying the duration of an Auto-Tune maintenance window. Valid values: `HOURS`.
+
+### cluster_config
+
+* `cold_storage_options` - (Optional) Configuration block containing cold storage configuration. Detailed below.
+* `dedicated_master_count` - (Optional) Number of dedicated main nodes in the cluster.
+* `dedicated_master_enabled` - (Optional) Whether dedicated main nodes are enabled for the cluster.
+* `dedicated_master_type` - (Optional) Instance type of the dedicated main nodes in the cluster.
+* `instance_count` - (Optional) Number of instances in the cluster.
+* `instance_type` - (Optional) Instance type of data nodes in the cluster.
+* `warm_count` - (Optional) Number of warm nodes in the cluster. Valid values are between `2` and `150`. `warm_count` can be only and must be set when `warm_enabled` is set to `true`.
+* `warm_enabled` - (Optional) Whether to enable warm storage.
+* `warm_type` - (Optional) Instance type for the Elasticsearch cluster's warm nodes. Valid values are `ultrawarm1.medium.elasticsearch`, `ultrawarm1.large.elasticsearch` and `ultrawarm1.xlarge.elasticsearch`. `warm_type` can be only and must be set when `warm_enabled` is set to `true`.
+* `zone_awareness_config` - (Optional) Configuration block containing zone awareness settings. Detailed below.
+* `zone_awareness_enabled` - (Optional) Whether zone awareness is enabled, set to `true` for multi-az deployment. To enable awareness with three Availability Zones, the `availability_zone_count` within the `zone_awareness_config` must be set to `3`.
+
+#### cold_storage_options
+
+* `enabled` - (Optional) Boolean to enable cold storage for an Elasticsearch domain. Defaults to `false`. Master and ultrawarm nodes must be enabled for cold storage.
+
+#### zone_awareness_config
+
+* `availability_zone_count` - (Optional) Number of Availability Zones for the domain to use with `zone_awareness_enabled`. Defaults to `2`. Valid values: `2` or `3`.
+
+### cognito_options
+
+AWS documentation: [Amazon Cognito Authentication for Kibana](https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-cognito-auth.html)
+
+* `enabled` - (Optional, Default: false) Whether Amazon Cognito authentication with Kibana is enabled or not.
+* `identity_pool_id` - (Required) ID of the Cognito Identity Pool to use.
+* `role_arn` - (Required) ARN of the IAM role that has the AmazonESCognitoAccess policy attached.
+* `user_pool_id` - (Required) ID of the Cognito User Pool to use.
+
+### domain_endpoint_options
+
+* `custom_endpoint_certificate_arn` - (Optional) ACM certificate ARN for your custom endpoint.
+* `custom_endpoint_enabled` - (Optional) Whether to enable custom endpoint for the Elasticsearch domain.
+* `custom_endpoint` - (Optional) Fully qualified domain for your custom endpoint.
+* `enforce_https` - (Optional) Whether or not to require HTTPS. Defaults to `true`.
+* `tls_security_policy` - (Optional) Name of the TLS security policy that needs to be applied to the HTTPS endpoint. Valid values:  `Policy-Min-TLS-1-0-2019-07` and `Policy-Min-TLS-1-2-2019-07`. Terraform will only perform drift detection if a configuration value is provided.
+
+### ebs_options
+
+* `ebs_enabled` - (Required) Whether EBS volumes are attached to data nodes in the domain.
+* `iops` - (Optional) Baseline input/output (I/O) performance of EBS volumes attached to data nodes. Applicable only for the GP3 and Provisioned IOPS EBS volume types.
+* `throughput` - (Required if `volume_type` is set to `gp3`) Specifies the throughput (in MiB/s) of the EBS volumes attached to data nodes. Applicable only for the gp3 volume type.
+* `volume_size` - (Required if `ebs_enabled` is set to `true`.) Size of EBS volumes attached to data nodes (in GiB).
+* `volume_type` - (Optional) Type of EBS volumes attached to data nodes.
+
+### encrypt_at_rest
+
+~> **Note:** You can enable `encrypt_at_rest` _in place_ for an existing, unencrypted domain only if your Elasticsearch version is 6.7 or greater. For lower versions, if you enable `encrypt_at_rest`, Terraform with recreate the domain, potentially causing data loss. For any version, if you disable `encrypt_at_rest` for an existing, encrypted domain, Terraform will recreate the domain, potentially causing data loss. If you change the `kms_key_id`, Terraform will also recreate the domain, potentially causing data loss.
+
+* `enabled` - (Required) Whether to enable encryption at rest. If the `encrypt_at_rest` block is not provided then this defaults to `false`. Enabling encryption on new domains requires `elasticsearch_version` 5.1 or greater.
+* `kms_key_id` - (Optional) KMS key ARN to encrypt the Elasticsearch domain with. If not specified then it defaults to using the `aws/es` service KMS key. Note that KMS will accept a KMS key ID but will return the key ARN. To prevent Terraform detecting unwanted changes, use the key ARN instead.
+
+### log_publishing_options
+
+* `cloudwatch_log_group_arn` - (Required) ARN of the Cloudwatch log group to which log needs to be published.
+* `enabled` - (Optional, Default: true) Whether given log publishing option is enabled or not.
+* `log_type` - (Required) Type of Elasticsearch log. Valid values: `INDEX_SLOW_LOGS`, `SEARCH_SLOW_LOGS`, `ES_APPLICATION_LOGS`, `AUDIT_LOGS`.
+
+### node_to_node_encryption
+
+~> **Note:** You can enable `node_to_node_encryption` _in place_ for an existing, unencrypted domain only if your Elasticsearch version is 6.7 or greater. For lower versions, if you enable `node_to_node_encryption`, Terraform will recreate the domain, potentially causing data loss. For any version, if you disable `node_to_node_encryption` for an existing, node-to-node encrypted domain, Terraform will recreate the domain, potentially causing data loss.
+
+* `enabled` - (Required) Whether to enable node-to-node encryption. If the `node_to_node_encryption` block is not provided then this defaults to `false`. Enabling node-to-node encryption of a new domain requires an `elasticsearch_version` of `6.0` or greater.
+
+### snapshot_options
+
+* `automated_snapshot_start_hour` - (Required) Hour during which the service takes an automated daily snapshot of the indices in the domain.
+
+### vpc_options
+
+AWS documentation: [VPC Support for Amazon Elasticsearch Service Domains](https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-vpc.html)
+
+~> **Note:** You must have created the service linked role for the Elasticsearch service to use `vpc_options`. If you need to create the service linked role at the same time as the Elasticsearch domain then you must use `depends_on` to make sure that the role is created before the Elasticsearch domain. See the [VPC based ES domain example](#vpc-based-es) above.
+
+-> Security Groups and Subnets referenced in these attributes must all be within the same VPC. This determines what VPC the endpoints are created in.
+
+* `security_group_ids` - (Optional) List of VPC Security Group IDs to be applied to the Elasticsearch domain endpoints. If omitted, the default Security Group for the VPC will be used.
+* `subnet_ids` - (Required) List of VPC Subnet IDs for the Elasticsearch domain endpoints to be created in.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the domain.
+* `domain_id` - Unique identifier for the domain.
+* `domain_name` - Name of the Elasticsearch domain.
+* `endpoint` - Domain-specific endpoint used to submit index, search, and data upload requests.
+* `kibana_endpoint` - Domain-specific endpoint for kibana without https scheme.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `vpc_options.0.availability_zones` - If the domain was created inside a VPC, the names of the availability zones the configured `subnet_ids` were created inside.
+* `vpc_options.0.vpc_id` - If the domain was created inside a VPC, the ID of the VPC.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `60m`)
+* `update` - (Default `60m`)
+* `delete` - (Default `90m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Elasticsearch domains using the `domain_name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Elasticsearch domains using the `domain_name`. For example:
+
+```console
+% terraform import aws_elasticsearch_domain.example domain_name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-2ba3b0b9b5de9cf5e4bfb0c3d93db7aa5852b5b15d23694c08cdf16cdf8481e6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/elasticsearch_domain_policy.html.markdown b/website/docs/cdktf/python/r/elasticsearch_domain_policy.html.markdown
new file mode 100644
index 00000000000..d91fe0ab40f
--- /dev/null
+++ b/website/docs/cdktf/python/r/elasticsearch_domain_policy.html.markdown
@@ -0,0 +1,51 @@
+---
+subcategory: "Elasticsearch"
+layout: "aws"
+page_title: "AWS: aws_elasticsearch_domain_policy"
+description: |-
+  Provides an Elasticsearch Domain Policy.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_elasticsearch_domain_policy
+
+Allows setting policy to an Elasticsearch domain while referencing domain attributes (e.g., ARN)
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.elasticsearch_domain import ElasticsearchDomain
+from imports.aws.elasticsearch_domain_policy import ElasticsearchDomainPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = ElasticsearchDomain(self, "example",
+            domain_name="tf-test",
+            elasticsearch_version="2.3"
+        )
+        ElasticsearchDomainPolicy(self, "main",
+            access_policies="{\n    \"Version\": \"2012-10-17\",\n    \"Statement\": [\n        {\n            \"Action\": \"es:*\",\n            \"Principal\": \"*\",\n            \"Effect\": \"Allow\",\n            \"Condition\": {\n                \"IpAddress\": {\"aws:SourceIp\": \"127.0.0.1/32\"}\n            },\n            \"Resource\": \"${" + example.arn + "}/*\"\n        }\n    ]\n}\n\n",
+            domain_name=example.domain_name
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `domain_name` - (Required) Name of the domain.
+* `access_policies` - (Optional) IAM policy document specifying the access policies for the domain
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+<!-- cache-key: cdktf-0.18.0 input-74932bbb0d0c5abd0e5dc3aa9416bb7bfcf5a404e91d4a90ec6ae56e5f33bb53 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/elasticsearch_domain_saml_options.html.markdown b/website/docs/cdktf/python/r/elasticsearch_domain_saml_options.html.markdown
new file mode 100644
index 00000000000..c35d716d93a
--- /dev/null
+++ b/website/docs/cdktf/python/r/elasticsearch_domain_saml_options.html.markdown
@@ -0,0 +1,110 @@
+---
+subcategory: "Elasticsearch"
+layout: "aws"
+page_title: "AWS: aws_elasticsearch_domain_saml_options"
+description: |-
+  Terraform resource for managing SAML authentication options for an AWS Elasticsearch Domain.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_elasticsearch_domain_saml_options
+
+Manages SAML authentication options for an AWS Elasticsearch Domain.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.elasticsearch_domain import ElasticsearchDomain
+from imports.aws.elasticsearch_domain_saml_options import ElasticsearchDomainSamlOptions
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = ElasticsearchDomain(self, "example",
+            cluster_config=ElasticsearchDomainClusterConfig(
+                instance_type="r4.large.elasticsearch"
+            ),
+            domain_name="example",
+            elasticsearch_version="1.5",
+            snapshot_options=ElasticsearchDomainSnapshotOptions(
+                automated_snapshot_start_hour=23
+            ),
+            tags={
+                "Domain": "TestDomain"
+            }
+        )
+        aws_elasticsearch_domain_saml_options_example =
+        ElasticsearchDomainSamlOptions(self, "example_1",
+            domain_name=example.domain_name,
+            saml_options=ElasticsearchDomainSamlOptionsSamlOptions(
+                enabled=True,
+                idp=ElasticsearchDomainSamlOptionsSamlOptionsIdp(
+                    entity_id="https://example.com",
+                    metadata_content=Token.as_string(Fn.file("./saml-metadata.xml"))
+                )
+            )
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_elasticsearch_domain_saml_options_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `domain_name` - (Required) Name of the domain.
+
+The following arguments are optional:
+
+* `saml_options` - (Optional) The SAML authentication options for an AWS Elasticsearch Domain.
+
+### saml_options
+
+* `enabled` - (Required) Whether SAML authentication is enabled.
+* `idp` - (Optional) Information from your identity provider.
+* `master_backend_role` - (Optional) This backend role from the SAML IdP receives full permissions to the cluster, equivalent to a new master user.
+* `master_user_name` - (Optional) This username from the SAML IdP receives full permissions to the cluster, equivalent to a new master user.
+* `roles_key` - (Optional) Element of the SAML assertion to use for backend roles. Default is roles.
+* `session_timeout_minutes` - (Optional) Duration of a session in minutes after a user logs in. Default is 60. Maximum value is 1,440.
+* `subject_key` - (Optional) Custom SAML attribute to use for user names. Default is an empty string - `""`. This will cause Elasticsearch to use the `NameID` element of the `Subject`, which is the default location for name identifiers in the SAML specification.
+
+#### idp
+
+* `entity_id` - (Required) The unique Entity ID of the application in SAML Identity Provider.
+* `metadata_content` - (Required) The Metadata of the SAML application in xml format.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name of the domain the SAML options are associated with.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Elasticsearch domains using the `domain_name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Elasticsearch domains using the `domain_name`. For example:
+
+```console
+% terraform import aws_elasticsearch_domain_saml_options.example domain_name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-65d51b7512d651dc02ab5c3e4dec870cf5f9710ffdd2fa0237566b35396e143c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/elasticsearch_vpc_endpoint.html.markdown b/website/docs/cdktf/python/r/elasticsearch_vpc_endpoint.html.markdown
new file mode 100644
index 00000000000..d264aacc825
--- /dev/null
+++ b/website/docs/cdktf/python/r/elasticsearch_vpc_endpoint.html.markdown
@@ -0,0 +1,89 @@
+---
+subcategory: "Elasticsearch"
+layout: "aws"
+page_title: "AWS: aws_elasticsearch_vpc_endpoint"
+description: |-
+  Terraform resource for managing an AWS elasticsearch VPC Endpoint.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_elasticsearch_vpc_endpoint
+
+Manages an [AWS Elasticsearch VPC Endpoint](https://docs.aws.amazon.com/elasticsearch-service/latest/APIReference/API_CreateVpcEndpoint.html). Creates an Amazon elasticsearch Service-managed VPC endpoint.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.elasticsearch_vpc_endpoint import ElasticsearchVpcEndpoint
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ElasticsearchVpcEndpoint(self, "foo",
+            domain_arn=domain1.arn,
+            vpc_options=ElasticsearchVpcEndpointVpcOptions(
+                security_group_ids=[test.id, test2.id],
+                subnet_ids=[
+                    Token.as_string(aws_subnet_test.id),
+                    Token.as_string(aws_subnet_test2.id)
+                ]
+            )
+        )
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `domain_arn` - (Required, Forces new resource) Specifies the Amazon Resource Name (ARN) of the domain to create the endpoint for
+* `vpc_options` - (Required) Options to specify the subnets and security groups for the endpoint.
+
+### vpc_options
+
+* `security_group_ids` - (Optional) The list of security group IDs associated with the VPC endpoints for the domain. If you do not provide a security group ID, elasticsearch Service uses the default security group for the VPC.
+* `subnet_ids` - (Required) A list of subnet IDs associated with the VPC endpoints for the domain. If your domain uses multiple Availability Zones, you need to provide two subnet IDs, one per zone. Otherwise, provide only one.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The unique identifier of the endpoint.
+* `endpoint` - The connection endpoint ID for connecting to the domain.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `60m`)
+* `update` - (Default `60m`)
+* `delete` - (Default `90m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import elasticsearch VPC endpoint connections using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import elasticsearch VPC endpoint connections using the `id`. For example:
+
+```console
+% terraform import aws_elasticsearch_vpc_endpoint_connection.example endpoint-id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-2068c0865c6751dbf0530210c6d3a7ca46d1c366f24a062e8d2eb949a01e616a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/elastictranscoder_pipeline.html.markdown b/website/docs/cdktf/python/r/elastictranscoder_pipeline.html.markdown
new file mode 100644
index 00000000000..d3c6b8f925f
--- /dev/null
+++ b/website/docs/cdktf/python/r/elastictranscoder_pipeline.html.markdown
@@ -0,0 +1,133 @@
+---
+subcategory: "Elastic Transcoder"
+layout: "aws"
+page_title: "AWS: aws_elastictranscoder_pipeline"
+description: |-
+  Provides an Elastic Transcoder pipeline resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_elastictranscoder_pipeline
+
+Provides an Elastic Transcoder pipeline resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.elastictranscoder_pipeline import ElastictranscoderPipeline
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ElastictranscoderPipeline(self, "bar",
+            content_config=ElastictranscoderPipelineContentConfig(
+                bucket=content_bucket.id,
+                storage_class="Standard"
+            ),
+            input_bucket=input_bucket.id,
+            name="aws_elastictranscoder_pipeline_tf_test_",
+            role=test_role.arn,
+            thumbnail_config=ElastictranscoderPipelineThumbnailConfig(
+                bucket=thumb_bucket.id,
+                storage_class="Standard"
+            )
+        )
+```
+
+## Argument Reference
+
+See ["Create Pipeline"](http://docs.aws.amazon.com/elastictranscoder/latest/developerguide/create-pipeline.html) in the AWS docs for reference.
+
+This argument supports the following arguments:
+
+* `aws_kms_key_arn` - (Optional) The AWS Key Management Service (AWS KMS) key that you want to use with this pipeline.
+* `content_config` - (Optional) The ContentConfig object specifies information about the Amazon S3 bucket in which you want Elastic Transcoder to save transcoded files and playlists. (documented below)
+* `content_config_permissions` - (Optional) The permissions for the `content_config` object. (documented below)
+* `input_bucket` - (Required) The Amazon S3 bucket in which you saved the media files that you want to transcode and the graphics that you want to use as watermarks.
+* `name` - (Optional, Forces new resource) The name of the pipeline. Maximum 40 characters
+* `notifications` - (Optional) The Amazon Simple Notification Service (Amazon SNS) topic that you want to notify to report job status. (documented below)
+* `output_bucket` - (Optional) The Amazon S3 bucket in which you want Elastic Transcoder to save the transcoded files.
+* `role` - (Required) The IAM Amazon Resource Name (ARN) for the role that you want Elastic Transcoder to use to transcode jobs for this pipeline.
+* `thumbnail_config` - (Optional) The ThumbnailConfig object specifies information about the Amazon S3 bucket in which you want Elastic Transcoder to save thumbnail files. (documented below)
+* `thumbnail_config_permissions` - (Optional) The permissions for the `thumbnail_config` object. (documented below)
+
+The `content_config` object specifies information about the Amazon S3 bucket in
+which you want Elastic Transcoder to save transcoded files and playlists: which
+bucket to use, and the storage class that you want to assign to the files. If
+you specify values for `content_config`, you must also specify values for
+`thumbnail_config`. If you specify values for `content_config` and
+`thumbnail_config`, omit the `output_bucket` object.
+
+The `content_config` object supports the following:
+
+* `bucket` - The Amazon S3 bucket in which you want Elastic Transcoder to save transcoded files and playlists.
+* `storage_class` - The Amazon S3 storage class, `Standard` or `ReducedRedundancy`, that you want Elastic Transcoder to assign to the files and playlists that it stores in your Amazon S3 bucket.
+
+The `content_config_permissions` object supports the following:
+
+* `access` - The permission that you want to give to the AWS user that you specified in `content_config_permissions.grantee`. Valid values are `Read`, `ReadAcp`, `WriteAcp` or `FullControl`.
+* `grantee` - The AWS user or group that you want to have access to transcoded files and playlists.
+* `grantee_type` - Specify the type of value that appears in the `content_config_permissions.grantee` object. Valid values are `Canonical`, `Email` or `Group`.
+
+The `notifications` object supports the following:
+
+* `completed` - The topic ARN for the Amazon SNS topic that you want to notify when Elastic Transcoder has finished processing a job in this pipeline.
+* `error` - The topic ARN for the Amazon SNS topic that you want to notify when Elastic Transcoder encounters an error condition while processing a job in this pipeline.
+* `progressing` - The topic ARN for the Amazon Simple Notification Service (Amazon SNS) topic that you want to notify when Elastic Transcoder has started to process a job in this pipeline.
+* `warning` - The topic ARN for the Amazon SNS topic that you want to notify when Elastic Transcoder encounters a warning condition while processing a job in this pipeline.
+
+The `thumbnail_config` object specifies information about the Amazon S3 bucket in
+which you want Elastic Transcoder to save thumbnail files: which bucket to use,
+which users you want to have access to the files, the type of access you want
+users to have, and the storage class that you want to assign to the files. If
+you specify values for `content_config`, you must also specify values for
+`thumbnail_config` even if you don't want to create thumbnails. (You control
+whether to create thumbnails when you create a job. For more information, see
+ThumbnailPattern in the topic Create Job.) If you specify values for
+`content_config` and `thumbnail_config`, omit the OutputBucket object.
+
+The `thumbnail_config` object supports the following:
+
+* `bucket` - The Amazon S3 bucket in which you want Elastic Transcoder to save thumbnail files.
+* `storage_class` - The Amazon S3 storage class, Standard or ReducedRedundancy, that you want Elastic Transcoder to assign to the thumbnails that it stores in your Amazon S3 bucket.
+
+The `thumbnail_config_permissions` object supports the following:
+
+* `access` - The permission that you want to give to the AWS user that you specified in `thumbnail_config_permissions.grantee`. Valid values are `Read`, `ReadAcp`, `WriteAcp` or `FullControl`.
+* `grantee` - The AWS user or group that you want to have access to thumbnail files.
+* `grantee_type` - Specify the type of value that appears in the `thumbnail_config_permissions.grantee` object. Valid values are `Canonical`, `Email` or `Group`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the Elastictranscoder pipeline.
+* `arn` - The ARN of the Elastictranscoder pipeline.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Elastic Transcoder pipelines using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Elastic Transcoder pipelines using the `id`. For example:
+
+```console
+% terraform import aws_elastictranscoder_pipeline.basic_pipeline 1407981661351-cttk8b
+```
+
+<!-- cache-key: cdktf-0.18.0 input-6b409c28f1ed17363c636a956212b4fffbbcf9da888917717aff32273f1430a2 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/elastictranscoder_preset.html.markdown b/website/docs/cdktf/python/r/elastictranscoder_preset.html.markdown
new file mode 100644
index 00000000000..50126d9232f
--- /dev/null
+++ b/website/docs/cdktf/python/r/elastictranscoder_preset.html.markdown
@@ -0,0 +1,195 @@
+---
+subcategory: "Elastic Transcoder"
+layout: "aws"
+page_title: "AWS: aws_elastictranscoder_preset"
+description: |-
+  Provides an Elastic Transcoder preset resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_elastictranscoder_preset
+
+Provides an Elastic Transcoder preset resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.elastictranscoder_preset import ElastictranscoderPreset
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ElastictranscoderPreset(self, "bar",
+            audio=ElastictranscoderPresetAudio(
+                audio_packing_mode="SingleTrack",
+                bit_rate=Token.as_string(96),
+                channels=Token.as_string(2),
+                codec="AAC",
+                sample_rate=Token.as_string(44100)
+            ),
+            audio_codec_options=ElastictranscoderPresetAudioCodecOptions(
+                profile="AAC-LC"
+            ),
+            container="mp4",
+            description="Sample Preset",
+            name="sample_preset",
+            thumbnails=ElastictranscoderPresetThumbnails(
+                format="png",
+                interval=Token.as_string(120),
+                max_height="auto",
+                max_width="auto",
+                padding_policy="Pad",
+                sizing_policy="Fit"
+            ),
+            video=ElastictranscoderPresetVideo(
+                bit_rate="1600",
+                codec="H.264",
+                display_aspect_ratio="16:9",
+                fixed_gop="false",
+                frame_rate="auto",
+                keyframes_max_dist=Token.as_string(240),
+                max_frame_rate="60",
+                max_height="auto",
+                max_width="auto",
+                padding_policy="Pad",
+                sizing_policy="Fit"
+            ),
+            video_codec_options={
+                "ColorSpaceConversionMode": "None",
+                "InterlacedMode": "Progressive",
+                "Level": "2.2",
+                "MaxReferenceFrames": Token.as_string(3),
+                "Profile": "main"
+            },
+            video_watermarks=[ElastictranscoderPresetVideoWatermarks(
+                horizontal_align="Right",
+                horizontal_offset="10px",
+                id="Terraform Test",
+                max_height="20%",
+                max_width="20%",
+                opacity="55.5",
+                sizing_policy="ShrinkToFit",
+                target="Content",
+                vertical_align="Bottom",
+                vertical_offset="10px"
+            )
+            ]
+        )
+```
+
+## Argument Reference
+
+See ["Create Preset"](http://docs.aws.amazon.com/elastictranscoder/latest/developerguide/create-preset.html) in the AWS docs for reference.
+
+This argument supports the following arguments:
+
+* `audio` - (Optional, Forces new resource) Audio parameters object (documented below).
+* `audio_codec_options` - (Optional, Forces new resource) Codec options for the audio parameters (documented below)
+* `container` - (Required, Forces new resource) The container type for the output file. Valid values are `flac`, `flv`, `fmp4`, `gif`, `mp3`, `mp4`, `mpg`, `mxf`, `oga`, `ogg`, `ts`, and `webm`.
+* `description` - (Optional, Forces new resource) A description of the preset (maximum 255 characters)
+* `name` - (Optional, Forces new resource) The name of the preset. (maximum 40 characters)
+* `thumbnails` - (Optional, Forces new resource) Thumbnail parameters object (documented below)
+* `video` - (Optional, Forces new resource) Video parameters object (documented below)
+* `video_watermarks` - (Optional, Forces new resource) Watermark parameters for the video parameters (documented below)
+* `video_codec_options` (Optional, Forces new resource) Codec options for the video parameters
+
+The `audio` object supports the following:
+
+* `audio_packing_mode` - The method of organizing audio channels and tracks. Use Audio:Channels to specify the number of channels in your output, and Audio:AudioPackingMode to specify the number of tracks and their relation to the channels. If you do not specify an Audio:AudioPackingMode, Elastic Transcoder uses SingleTrack.
+* `bit_rate` - The bit rate of the audio stream in the output file, in kilobits/second. Enter an integer between 64 and 320, inclusive.
+* `channels` - The number of audio channels in the output file
+* `codec` - The audio codec for the output file. Valid values are `AAC`, `flac`, `mp2`, `mp3`, `pcm`, and `vorbis`.
+* `sample_rate` - The sample rate of the audio stream in the output file, in hertz. Valid values are: `auto`, `22050`, `32000`, `44100`, `48000`, `96000`
+
+The `audio_codec_options` object supports the following:
+
+* `bit_depth` - The bit depth of a sample is how many bits of information are included in the audio samples. Valid values are `16` and `24`. (FLAC/PCM Only)
+* `bit_order` - The order the bits of a PCM sample are stored in. The supported value is LittleEndian. (PCM Only)
+* `profile` - If you specified AAC for Audio:Codec, choose the AAC profile for the output file.
+* `signed` - Whether audio samples are represented with negative and positive numbers (signed) or only positive numbers (unsigned). The supported value is Signed. (PCM Only)
+
+The `thumbnails` object supports the following:
+
+* `aspect_ratio` - The aspect ratio of thumbnails. The following values are valid: auto, 1:1, 4:3, 3:2, 16:9
+* `format` - The format of thumbnails, if any. Valid formats are jpg and png.
+* `interval` - The approximate number of seconds between thumbnails. The value must be an integer. The actual interval can vary by several seconds from one thumbnail to the next.
+* `max_height` - The maximum height of thumbnails, in pixels. If you specify auto, Elastic Transcoder uses 1080 (Full HD) as the default value. If you specify a numeric value, enter an even integer between 32 and 3072, inclusive.
+* `max_width` - The maximum width of thumbnails, in pixels. If you specify auto, Elastic Transcoder uses 1920 (Full HD) as the default value. If you specify a numeric value, enter an even integer between 32 and 4096, inclusive.
+* `padding_policy` - When you set PaddingPolicy to Pad, Elastic Transcoder might add black bars to the top and bottom and/or left and right sides of thumbnails to make the total size of the thumbnails match the values that you specified for thumbnail MaxWidth and MaxHeight settings.
+* `resolution` - The width and height of thumbnail files in pixels, in the format WidthxHeight, where both values are even integers. The values cannot exceed the width and height that you specified in the Video:Resolution object. (To better control resolution and aspect ratio of thumbnails, we recommend that you use the thumbnail values `max_width`, `max_height`, `sizing_policy`, and `padding_policy` instead of `resolution` and `aspect_ratio`. The two groups of settings are mutually exclusive. Do not use them together)
+* `sizing_policy` - A value that controls scaling of thumbnails. Valid values are: `Fit`, `Fill`, `Stretch`, `Keep`, `ShrinkToFit`, and `ShrinkToFill`.
+
+The `video` object supports the following:
+
+* `aspect_ratio` - The display aspect ratio of the video in the output file. Valid values are: `auto`, `1:1`, `4:3`, `3:2`, `16:9`. (Note; to better control resolution and aspect ratio of output videos, we recommend that you use the values `max_width`, `max_height`, `sizing_policy`, `padding_policy`, and `display_aspect_ratio` instead of `resolution` and `aspect_ratio`.)
+* `bit_rate` - The bit rate of the video stream in the output file, in kilobits/second. You can configure variable bit rate or constant bit rate encoding.
+* `codec` - The video codec for the output file. Valid values are `gif`, `H.264`, `mpeg2`, `vp8`, and `vp9`.
+* `display_aspect_ratio` - The value that Elastic Transcoder adds to the metadata in the output file. If you set DisplayAspectRatio to auto, Elastic Transcoder chooses an aspect ratio that ensures square pixels. If you specify another option, Elastic Transcoder sets that value in the output file.
+* `fixed_gop` - Whether to use a fixed value for Video:FixedGOP. Not applicable for containers of type gif. Valid values are true and false. Also known as, Fixed Number of Frames Between Keyframes.
+* `frame_rate` - The frames per second for the video stream in the output file. The following values are valid: `auto`, `10`, `15`, `23.97`, `24`, `25`, `29.97`, `30`, `50`, `60`.
+* `keyframes_max_dist` - The maximum number of frames between key frames. Not applicable for containers of type gif.
+* `max_frame_rate` - If you specify auto for FrameRate, Elastic Transcoder uses the frame rate of the input video for the frame rate of the output video, up to the maximum frame rate. If you do not specify a MaxFrameRate, Elastic Transcoder will use a default of 30.
+* `max_height` - The maximum height of the output video in pixels. If you specify auto, Elastic Transcoder uses 1080 (Full HD) as the default value. If you specify a numeric value, enter an even integer between 96 and 3072, inclusive.
+* `max_width` - The maximum width of the output video in pixels. If you specify auto, Elastic Transcoder uses 1920 (Full HD) as the default value. If you specify a numeric value, enter an even integer between 128 and 4096, inclusive.
+* `padding_policy` - When you set PaddingPolicy to Pad, Elastic Transcoder might add black bars to the top and bottom and/or left and right sides of the output video to make the total size of the output video match the values that you specified for `max_width` and `max_height`.
+* `resolution` - The width and height of the video in the output file, in pixels. Valid values are `auto` and `widthxheight`. (see note for `aspect_ratio`)
+* `sizing_policy` - A value that controls scaling of the output video. Valid values are: `Fit`, `Fill`, `Stretch`, `Keep`, `ShrinkToFit`, `ShrinkToFill`.
+
+The `video_watermarks` object supports the following:
+
+* `horizontal_align` - The horizontal position of the watermark unless you specify a nonzero value for `horzontal_offset`.
+* `horizontal_offset` - The amount by which you want the horizontal position of the watermark to be offset from the position specified by `horizontal_align`.
+* `id` - A unique identifier for the settings for one watermark. The value of Id can be up to 40 characters long. You can specify settings for up to four watermarks.
+* `max_height` - The maximum height of the watermark.
+* `max_width` - The maximum width of the watermark.
+* `opacity` - A percentage that indicates how much you want a watermark to obscure the video in the location where it appears.
+* `sizing_policy` - A value that controls scaling of the watermark. Valid values are: `Fit`, `Stretch`, `ShrinkToFit`
+* `target` - A value that determines how Elastic Transcoder interprets values that you specified for `video_watermarks.horizontal_offset`, `video_watermarks.vertical_offset`, `video_watermarks.max_width`, and `video_watermarks.max_height`. Valid values are `Content` and `Frame`.
+* `vertical_align` - The vertical position of the watermark unless you specify a nonzero value for `vertical_align`. Valid values are `Top`, `Bottom`, `Center`.
+* `vertical_offset` - The amount by which you want the vertical position of the watermark to be offset from the position specified by `vertical_align`
+
+The `video_codec_options` map supports the following:
+
+* `Profile` - The codec profile that you want to use for the output file. (H.264/VP8 Only)
+* `Level` - The H.264 level that you want to use for the output file. Elastic Transcoder supports the following levels: `1`, `1b`, `1.1`, `1.2`, `1.3`, `2`, `2.1`, `2.2`, `3`, `3.1`, `3.2`, `4`, `4.1` (H.264 only)
+* `MaxReferenceFrames` - The maximum number of previously decoded frames to use as a reference for decoding future frames. Valid values are integers 0 through 16. (H.264 only)
+* `MaxBitRate` - The maximum number of kilobits per second in the output video. Specify a value between 16 and 62,500 inclusive, or `auto`. (Optional, H.264/MPEG2/VP8/VP9 only)
+* `BufferSize` - The maximum number of kilobits in any x seconds of the output video. This window is commonly 10 seconds, the standard segment duration when you're using ts for the container type of the output video. Specify an integer greater than 0. If you specify MaxBitRate and omit BufferSize, Elastic Transcoder sets BufferSize to 10 times the value of MaxBitRate. (Optional, H.264/MPEG2/VP8/VP9 only)
+* `InterlacedMode` -  The interlace mode for the output video. (Optional, H.264/MPEG2 Only)
+* `ColorSpaceConversion` - The color space conversion Elastic Transcoder applies to the output video. Valid values are `None`, `Bt709toBt601`, `Bt601toBt709`, and `Auto`. (Optional, H.264/MPEG2 Only)
+* `ChromaSubsampling` - The sampling pattern for the chroma (color) channels of the output video. Valid values are `yuv420p` and `yuv422p`.
+* `LoopCount` - The number of times you want the output gif to loop (Gif only)
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the Elastic Transcoder Preset.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Elastic Transcoder presets using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Elastic Transcoder presets using the `id`. For example:
+
+```console
+% terraform import aws_elastictranscoder_preset.basic_preset 1407981661351-cttk8b
+```
+
+<!-- cache-key: cdktf-0.18.0 input-8282c40b65cf6c7bab35ac986097ade68a35de7fee2c7e606836eefd3ed414ca -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/elb.html.markdown b/website/docs/cdktf/python/r/elb.html.markdown
new file mode 100644
index 00000000000..ea77f3d97e2
--- /dev/null
+++ b/website/docs/cdktf/python/r/elb.html.markdown
@@ -0,0 +1,177 @@
+---
+subcategory: "ELB Classic"
+layout: "aws"
+page_title: "AWS: aws_elb"
+description: |-
+  Provides an Elastic Load Balancer resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_elb
+
+Provides an Elastic Load Balancer resource, also known as a "Classic
+Load Balancer" after the release of
+[Application/Network Load Balancers](/docs/providers/aws/r/lb.html).
+
+~> **NOTE on ELB Instances and ELB Attachments:** Terraform currently
+provides both a standalone [ELB Attachment resource](elb_attachment.html)
+(describing an instance attached to an ELB), and an ELB resource with
+`instances` defined in-line. At this time you cannot use an ELB with in-line
+instances in conjunction with a ELB Attachment resources. Doing so will cause a
+conflict and will overwrite attachments.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.elb import Elb
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Elb(self, "bar",
+            access_logs=ElbAccessLogs(
+                bucket="foo",
+                bucket_prefix="bar",
+                interval=60
+            ),
+            availability_zones=["us-west-2a", "us-west-2b", "us-west-2c"],
+            connection_draining=True,
+            connection_draining_timeout=400,
+            cross_zone_load_balancing=True,
+            health_check=ElbHealthCheck(
+                healthy_threshold=2,
+                interval=30,
+                target="HTTP:8000/",
+                timeout=3,
+                unhealthy_threshold=2
+            ),
+            idle_timeout=400,
+            instances=[foo.id],
+            listener=[ElbListener(
+                instance_port=8000,
+                instance_protocol="http",
+                lb_port=80,
+                lb_protocol="http"
+            ), ElbListener(
+                instance_port=8000,
+                instance_protocol="http",
+                lb_port=443,
+                lb_protocol="https",
+                ssl_certificate_id="arn:aws:iam::123456789012:server-certificate/certName"
+            )
+            ],
+            name="foobar-terraform-elb",
+            tags={
+                "Name": "foobar-terraform-elb"
+            }
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Optional) The name of the ELB. By default generated by Terraform.
+* `name_prefix` - (Optional, Forces new resource) Creates a unique name beginning with the specified
+  prefix. Conflicts with `name`.
+* `access_logs` - (Optional) An Access Logs block. Access Logs documented below.
+* `availability_zones` - (Required for an EC2-classic ELB) The AZ's to serve traffic in.
+* `security_groups` - (Optional) A list of security group IDs to assign to the ELB.
+  Only valid if creating an ELB within a VPC
+* `subnets` - (Required for a VPC ELB) A list of subnet IDs to attach to the ELB. When an update to subnets will remove all current subnets, this will force a new resource.
+* `instances` - (Optional) A list of instance ids to place in the ELB pool.
+* `internal` - (Optional) If true, ELB will be an internal ELB.
+* `listener` - (Required) A list of listener blocks. Listeners documented below.
+* `health_check` - (Optional) A health_check block. Health Check documented below.
+* `cross_zone_load_balancing` - (Optional) Enable cross-zone load balancing. Default: `true`
+* `idle_timeout` - (Optional) The time in seconds that the connection is allowed to be idle. Default: `60`
+* `connection_draining` - (Optional) Boolean to enable connection draining. Default: `false`
+* `connection_draining_timeout` - (Optional) The time in seconds to allow for connections to drain. Default: `300`
+* `desync_mitigation_mode` - (Optional) Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+Exactly one of `availability_zones` or `subnets` must be specified: this
+determines if the ELB exists in a VPC or in EC2-classic.
+
+Access Logs (`access_logs`) support the following:
+
+* `bucket` - (Required) The S3 bucket name to store the logs in.
+* `bucket_prefix` - (Optional) The S3 bucket prefix. Logs are stored in the root if not configured.
+* `interval` - (Optional) The publishing interval in minutes. Valid values: `5` and `60`. Default: `60`
+* `enabled` - (Optional) Boolean to enable / disable `access_logs`. Default is `true`
+
+Listeners (`listener`) support the following:
+
+* `instance_port` - (Required) The port on the instance to route to
+* `instance_protocol` - (Required) The protocol to use to the instance. Valid
+  values are `HTTP`, `HTTPS`, `TCP`, or `SSL`
+* `lb_port` - (Required) The port to listen on for the load balancer
+* `lb_protocol` - (Required) The protocol to listen on. Valid values are `HTTP`,
+  `HTTPS`, `TCP`, or `SSL`
+* `ssl_certificate_id` - (Optional) The ARN of an SSL certificate you have
+uploaded to AWS IAM. **Note ECDSA-specific restrictions below.  Only valid when `lb_protocol` is either HTTPS or SSL**
+
+Health Check (`health_check`) supports the following:
+
+* `healthy_threshold` - (Required) The number of checks before the instance is declared healthy.
+* `unhealthy_threshold` - (Required) The number of checks before the instance is declared unhealthy.
+* `target` - (Required) The target of the check. Valid pattern is "${PROTOCOL}:${PORT}${PATH}", where PROTOCOL
+  values are:
+    * `HTTP`, `HTTPS` - PORT and PATH are required
+    * `TCP`, `SSL` - PORT is required, PATH is not supported
+* `interval` - (Required) The interval between checks.
+* `timeout` - (Required) The length of time before the check times out.
+
+## Note on ECDSA Key Algorithm
+
+If the ARN of the `ssl_certificate_id` that is pointed to references a
+certificate that was signed by an ECDSA key, note that ELB only supports the
+P256 and P384 curves.  Using a certificate signed by a key using a different
+curve could produce the error `ERR_SSL_VERSION_OR_CIPHER_MISMATCH` in your
+browser.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name of the ELB
+* `arn` - The ARN of the ELB
+* `name` - The name of the ELB
+* `dns_name` - The DNS name of the ELB
+* `instances` - The list of instances in the ELB
+* `source_security_group` - The name of the security group that you can use as
+  part of your inbound rules for your load balancer's back-end application
+  instances. Use this for Classic or Default VPC only.
+* `source_security_group_id` - The ID of the security group that you can use as
+  part of your inbound rules for your load balancer's back-end application
+  instances. Only available on ELBs launched in a VPC.
+* `zone_id` - The canonical hosted zone ID of the ELB (to be used in a Route 53 Alias record)
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import ELBs using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import ELBs using the `name`. For example:
+
+```console
+% terraform import aws_elb.bar elb-production-12345
+```
+
+<!-- cache-key: cdktf-0.18.0 input-51cf9c0bd7493a8933e0ea949d5da8ff7b2aba67934ff679f9a3811feef95d7c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/elb_attachment.html.markdown b/website/docs/cdktf/python/r/elb_attachment.html.markdown
new file mode 100644
index 00000000000..fc762e1c3d6
--- /dev/null
+++ b/website/docs/cdktf/python/r/elb_attachment.html.markdown
@@ -0,0 +1,53 @@
+---
+subcategory: "ELB Classic"
+layout: "aws"
+page_title: "AWS: aws_elb_attachment"
+description: |-
+  Provides an Elastic Load Balancer Attachment resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_elb_attachment
+
+Attaches an EC2 instance to an Elastic Load Balancer (ELB). For attaching resources with Application Load Balancer (ALB) or Network Load Balancer (NLB), see the [`aws_lb_target_group_attachment` resource](/docs/providers/aws/r/lb_target_group_attachment.html).
+
+~> **NOTE on ELB Instances and ELB Attachments:** Terraform currently provides
+both a standalone ELB Attachment resource (describing an instance attached to
+an ELB), and an [Elastic Load Balancer resource](elb.html) with
+`instances` defined in-line. At this time you cannot use an ELB with in-line
+instances in conjunction with an ELB Attachment resource. Doing so will cause a
+conflict and will overwrite attachments.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.elb_attachment import ElbAttachment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ElbAttachment(self, "baz",
+            elb=bar.id,
+            instance=foo.id
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `elb` - (Required) The name of the ELB.
+* `instance` - (Required) Instance ID to place in the ELB pool.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+<!-- cache-key: cdktf-0.18.0 input-99c0a2bdaa3c996a4fa9095610cca1664b20df2774feb4374303141a331e823c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/emr_block_public_access_configuration.html.markdown b/website/docs/cdktf/python/r/emr_block_public_access_configuration.html.markdown
new file mode 100644
index 00000000000..41f1095700e
--- /dev/null
+++ b/website/docs/cdktf/python/r/emr_block_public_access_configuration.html.markdown
@@ -0,0 +1,154 @@
+---
+subcategory: "EMR"
+layout: "aws"
+page_title: "AWS: aws_emr_block_public_access_configuration"
+description: |-
+  Terraform resource for managing an AWS EMR Block Public Access Configuration.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_emr_block_public_access_configuration
+
+Terraform resource for managing an AWS EMR block public access configuration. This region level security configuration restricts the launch of EMR clusters that have associated security groups permitting public access on unspecified ports. See the [EMR Block Public Access Configuration](https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-block-public-access.html) documentation for further information.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.emr_block_public_access_configuration import EmrBlockPublicAccessConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        EmrBlockPublicAccessConfiguration(self, "example",
+            block_public_security_group_rules=True
+        )
+```
+
+### Default Configuration
+
+By default, each AWS region is equipped with a block public access configuration that prevents EMR clusters from being launched if they have security group rules permitting public access on any port except for port 22. The default configuration can be managed using this Terraform resource.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.emr_block_public_access_configuration import EmrBlockPublicAccessConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        EmrBlockPublicAccessConfiguration(self, "example",
+            block_public_security_group_rules=True,
+            permitted_public_security_group_rule_range=[EmrBlockPublicAccessConfigurationPermittedPublicSecurityGroupRuleRange(
+                max_range=22,
+                min_range=22
+            )
+            ]
+        )
+```
+
+~> **NOTE:** If an `aws_emr_block_public_access_configuration` Terraform resource is destroyed, the configuration will reset to this default configuration.
+
+### Multiple Permitted Public Security Group Rule Ranges
+
+The resource permits specification of multiple `permitted_public_security_group_rule_range` blocks.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.emr_block_public_access_configuration import EmrBlockPublicAccessConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        EmrBlockPublicAccessConfiguration(self, "example",
+            block_public_security_group_rules=True,
+            permitted_public_security_group_rule_range=[EmrBlockPublicAccessConfigurationPermittedPublicSecurityGroupRuleRange(
+                max_range=22,
+                min_range=22
+            ), EmrBlockPublicAccessConfigurationPermittedPublicSecurityGroupRuleRange(
+                max_range=101,
+                min_range=100
+            )
+            ]
+        )
+```
+
+### Disabling Block Public Access
+
+To permit EMR clusters to be launched in the configured region regardless of associated security group rules, the Block Public Access feature can be disabled using this Terraform resource.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.emr_block_public_access_configuration import EmrBlockPublicAccessConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        EmrBlockPublicAccessConfiguration(self, "example",
+            block_public_security_group_rules=False
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `block_public_security_group_rules` - (Required) Enable or disable EMR Block Public Access.
+
+The following arguments are optional:
+
+* `permitted_public_security_group_rule_range` - (Optional) Configuration block for defining permitted public security group rule port ranges. Can be defined multiple times per resource. Only valid if `block_public_security_group_rules` is set to `true`.
+
+### `permitted_public_security_group_rule_range`
+
+This block is used to define a range of TCP ports that should form exceptions to the Block Public Access Configuration. If an attempt is made to launch an EMR cluster in the configured region and account, with `block_public_security_group_rules = true`, the EMR cluster will be permitted to launch even if there are security group rules permitting public access to ports in this range.
+
+* `min_range` - (Required) The first port in the range of TCP ports.
+* `max_range` - (Required) The final port in the range of TCP ports.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import the current EMR Block Public Access Configuration. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import the current EMR Block Public Access Configuration. For example:
+
+```console
+% terraform import aws_emr_block_public_access_configuration.example current
+```
+
+<!-- cache-key: cdktf-0.18.0 input-aa7683c154001c04829343267ab3b769046fafe4a515b4091bc80943f1f89917 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/emr_cluster.html.markdown b/website/docs/cdktf/python/r/emr_cluster.html.markdown
new file mode 100644
index 00000000000..48e9c985d07
--- /dev/null
+++ b/website/docs/cdktf/python/r/emr_cluster.html.markdown
@@ -0,0 +1,729 @@
+---
+subcategory: "EMR"
+layout: "aws"
+page_title: "AWS: aws_emr_cluster"
+description: |-
+  Provides an Elastic MapReduce Cluster
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_emr_cluster
+
+Provides an Elastic MapReduce Cluster, a web service that makes it easy to process large amounts of data efficiently. See [Amazon Elastic MapReduce Documentation](https://aws.amazon.com/documentation/elastic-mapreduce/) for more information.
+
+To configure [Instance Groups](https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-instance-group-configuration.html#emr-plan-instance-groups) for [task nodes](https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-master-core-task-nodes.html#emr-plan-task), see the [`aws_emr_instance_group` resource](/docs/providers/aws/r/emr_instance_group.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.emr_cluster import EmrCluster
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        EmrCluster(self, "cluster",
+            additional_info="{\n  \"instanceAwsClientConfiguration\": {\n    \"proxyPort\": 8099,\n    \"proxyHost\": \"myproxy.example.com\"\n  }\n}\n\n",
+            applications=["Spark"],
+            bootstrap_action=[EmrClusterBootstrapAction(
+                args=["instance.isMaster=true", "echo running on master node"],
+                name="runif",
+                path="s3://elasticmapreduce/bootstrap-actions/run-if"
+            )
+            ],
+            configurations_json="  [\n    {\n      \"Classification\": \"hadoop-env\",\n      \"Configurations\": [\n        {\n          \"Classification\": \"export\",\n          \"Properties\": {\n            \"JAVA_HOME\": \"/usr/lib/jvm/java-1.8.0\"\n          }\n        }\n      ],\n      \"Properties\": {}\n    },\n    {\n      \"Classification\": \"spark-env\",\n      \"Configurations\": [\n        {\n          \"Classification\": \"export\",\n          \"Properties\": {\n            \"JAVA_HOME\": \"/usr/lib/jvm/java-1.8.0\"\n          }\n        }\n      ],\n      \"Properties\": {}\n    }\n  ]\n\n",
+            core_instance_group=EmrClusterCoreInstanceGroup(
+                autoscaling_policy="{\n\"Constraints\": {\n  \"MinCapacity\": 1,\n  \"MaxCapacity\": 2\n},\n\"Rules\": [\n  {\n    \"Name\": \"ScaleOutMemoryPercentage\",\n    \"Description\": \"Scale out if YARNMemoryAvailablePercentage is less than 15\",\n    \"Action\": {\n      \"SimpleScalingPolicyConfiguration\": {\n        \"AdjustmentType\": \"CHANGE_IN_CAPACITY\",\n        \"ScalingAdjustment\": 1,\n        \"CoolDown\": 300\n      }\n    },\n    \"Trigger\": {\n      \"CloudWatchAlarmDefinition\": {\n        \"ComparisonOperator\": \"LESS_THAN\",\n        \"EvaluationPeriods\": 1,\n        \"MetricName\": \"YARNMemoryAvailablePercentage\",\n        \"Namespace\": \"AWS/ElasticMapReduce\",\n        \"Period\": 300,\n        \"Statistic\": \"AVERAGE\",\n        \"Threshold\": 15.0,\n        \"Unit\": \"PERCENT\"\n      }\n    }\n  }\n]\n}\n\n",
+                bid_price="0.30",
+                ebs_config=[EmrClusterCoreInstanceGroupEbsConfig(
+                    size=Token.as_number("40"),
+                    type="gp2",
+                    volumes_per_instance=1
+                )
+                ],
+                instance_count=1,
+                instance_type="c4.large"
+            ),
+            ebs_root_volume_size=100,
+            ec2_attributes=EmrClusterEc2Attributes(
+                emr_managed_master_security_group=sg.id,
+                emr_managed_slave_security_group=sg.id,
+                instance_profile=emr_profile.arn,
+                subnet_id=main.id
+            ),
+            keep_job_flow_alive_when_no_steps=True,
+            master_instance_group=EmrClusterMasterInstanceGroup(
+                instance_type="m4.large"
+            ),
+            name="emr-test-arn",
+            release_label="emr-4.6.0",
+            service_role=iam_emr_service_role.arn,
+            tags={
+                "env": "env",
+                "role": "rolename"
+            },
+            termination_protection=False
+        )
+```
+
+The `aws_emr_cluster` resource typically requires two IAM roles, one for the EMR Cluster to use as a service role, and another is assigned to every EC2 instance in a cluster and each application process that runs on a cluster assumes this role for permissions to interact with other AWS services. An additional role, the Auto Scaling role, is required if your cluster uses automatic scaling in Amazon EMR.
+
+The default AWS managed EMR service role is called `EMR_DefaultRole` with Amazon managed policy `AmazonEMRServicePolicy_v2` attached. The name of default instance profile role is `EMR_EC2_DefaultRole` with default managed policy `AmazonElasticMapReduceforEC2Role` attached, but it is on the path to deprecation and will not be replaced with another default managed policy. You'll need to create and specify an instance profile to replace the deprecated role and default policy. See the [Configure IAM service roles for Amazon EMR](https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-iam-roles.html) guide for more information on these IAM roles. There is also a fully-bootable example Terraform configuration at the bottom of this page.
+
+### Instance Fleet
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.emr_cluster import EmrCluster
+from imports.aws.emr_instance_fleet import EmrInstanceFleet
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, name, releaseLabel, serviceRole):
+        super().__init__(scope, name)
+        example = EmrCluster(self, "example",
+            core_instance_fleet=EmrClusterCoreInstanceFleet(
+                instance_type_configs=[EmrClusterCoreInstanceFleetInstanceTypeConfigs(
+                    bid_price_as_percentage_of_on_demand_price=80,
+                    ebs_config=[EmrClusterCoreInstanceFleetInstanceTypeConfigsEbsConfig(
+                        size=100,
+                        type="gp2",
+                        volumes_per_instance=1
+                    )
+                    ],
+                    instance_type="m3.xlarge",
+                    weighted_capacity=1
+                ), EmrClusterCoreInstanceFleetInstanceTypeConfigs(
+                    bid_price_as_percentage_of_on_demand_price=100,
+                    ebs_config=[EmrClusterCoreInstanceFleetInstanceTypeConfigsEbsConfig(
+                        size=100,
+                        type="gp2",
+                        volumes_per_instance=1
+                    )
+                    ],
+                    instance_type="m4.xlarge",
+                    weighted_capacity=1
+                ), EmrClusterCoreInstanceFleetInstanceTypeConfigs(
+                    bid_price_as_percentage_of_on_demand_price=100,
+                    ebs_config=[EmrClusterCoreInstanceFleetInstanceTypeConfigsEbsConfig(
+                        size=100,
+                        type="gp2",
+                        volumes_per_instance=1
+                    )
+                    ],
+                    instance_type="m4.2xlarge",
+                    weighted_capacity=2
+                )
+                ],
+                launch_specifications=EmrClusterCoreInstanceFleetLaunchSpecifications(
+                    spot_specification=[EmrClusterCoreInstanceFleetLaunchSpecificationsSpotSpecification(
+                        allocation_strategy="capacity-optimized",
+                        block_duration_minutes=0,
+                        timeout_action="SWITCH_TO_ON_DEMAND",
+                        timeout_duration_minutes=10
+                    )
+                    ]
+                ),
+                name="core fleet",
+                target_on_demand_capacity=2,
+                target_spot_capacity=2
+            ),
+            master_instance_fleet=EmrClusterMasterInstanceFleet(
+                instance_type_configs=[EmrClusterMasterInstanceFleetInstanceTypeConfigs(
+                    instance_type="m4.xlarge"
+                )
+                ],
+                target_on_demand_capacity=1
+            ),
+            name=name,
+            release_label=release_label,
+            service_role=service_role
+        )
+        EmrInstanceFleet(self, "task",
+            cluster_id=example.id,
+            instance_type_configs=[EmrInstanceFleetInstanceTypeConfigs(
+                bid_price_as_percentage_of_on_demand_price=100,
+                ebs_config=[EmrInstanceFleetInstanceTypeConfigsEbsConfig(
+                    size=100,
+                    type="gp2",
+                    volumes_per_instance=1
+                )
+                ],
+                instance_type="m4.xlarge",
+                weighted_capacity=1
+            ), EmrInstanceFleetInstanceTypeConfigs(
+                bid_price_as_percentage_of_on_demand_price=100,
+                ebs_config=[EmrInstanceFleetInstanceTypeConfigsEbsConfig(
+                    size=100,
+                    type="gp2",
+                    volumes_per_instance=1
+                )
+                ],
+                instance_type="m4.2xlarge",
+                weighted_capacity=2
+            )
+            ],
+            launch_specifications=EmrInstanceFleetLaunchSpecifications(
+                spot_specification=[EmrInstanceFleetLaunchSpecificationsSpotSpecification(
+                    allocation_strategy="capacity-optimized",
+                    block_duration_minutes=0,
+                    timeout_action="TERMINATE_CLUSTER",
+                    timeout_duration_minutes=10
+                )
+                ]
+            ),
+            name="task fleet",
+            target_on_demand_capacity=1,
+            target_spot_capacity=1
+        )
+```
+
+### Enable Debug Logging
+
+[Debug logging in EMR](https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-plan-debugging.html) is implemented as a step. It is highly recommended that you utilize the [lifecycle configuration block](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html) with `ignore_changes` if other steps are being managed outside of Terraform.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from cdktf import TerraformResourceLifecycle
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.emr_cluster import EmrCluster
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, name, releaseLabel, serviceRole):
+        super().__init__(scope, name)
+        EmrCluster(self, "example",
+            lifecycle=TerraformResourceLifecycle(
+                ignore_changes=[step]
+            ),
+            step=[EmrClusterStep(
+                action_on_failure="TERMINATE_CLUSTER",
+                hadoop_jar_step=[EmrClusterStepHadoopJarStep(
+                    args=["state-pusher-script"],
+                    jar="command-runner.jar"
+                )
+                ],
+                name="Setup Hadoop Debugging"
+            )
+            ],
+            name=name,
+            release_label=release_label,
+            service_role=service_role
+        )
+```
+
+### Multiple Node Master Instance Group
+
+Available in EMR version 5.23.0 and later, an EMR Cluster can be launched with three master nodes for high availability. Additional information about this functionality and its requirements can be found in the [EMR Management Guide](https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-plan-ha.html).
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.emr_cluster import EmrCluster
+from imports.aws.subnet import Subnet
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, vpcId, instanceType, instanceProfile, instanceType1, name, serviceRole):
+        super().__init__(scope, name)
+        example = Subnet(self, "example",
+            map_public_ip_on_launch=True,
+            vpc_id=vpc_id
+        )
+        aws_emr_cluster_example = EmrCluster(self, "example_1",
+            core_instance_group=EmrClusterCoreInstanceGroup(
+                instance_type=instance_type
+            ),
+            ec2_attributes=EmrClusterEc2Attributes(
+                subnet_id=example.id,
+                instance_profile=instance_profile
+            ),
+            master_instance_group=EmrClusterMasterInstanceGroup(
+                instance_count=3,
+                instance_type=instance_type1
+            ),
+            release_label="emr-5.24.1",
+            termination_protection=True,
+            name=name,
+            service_role=service_role
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_emr_cluster_example.override_logical_id("example")
+```
+
+### Bootable Cluster
+
+**NOTE:** This configuration demonstrates a minimal configuration needed to boot an example EMR Cluster. It is not meant to display best practices. As with all examples, use at your own risk.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from cdktf import TerraformResourceLifecycle
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.emr_cluster import EmrCluster
+from imports.aws.iam_instance_profile import IamInstanceProfile
+from imports.aws.iam_role import IamRole
+from imports.aws.iam_role_policy import IamRolePolicy
+from imports.aws.internet_gateway import InternetGateway
+from imports.aws.main_route_table_association import MainRouteTableAssociation
+from imports.aws.route_table import RouteTable
+from imports.aws.security_group import SecurityGroup
+from imports.aws.subnet import Subnet
+from imports.aws.vpc import Vpc
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        main = Vpc(self, "main",
+            cidr_block="168.31.0.0/16",
+            enable_dns_hostnames=True,
+            tags={
+                "name": "emr_test"
+            }
+        )
+        ec2_assume_role = DataAwsIamPolicyDocument(self, "ec2_assume_role",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=Token.as_list("sts:AssumeRole"),
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["ec2.amazonaws.com"],
+                    type="Service"
+                )
+                ]
+            )
+            ]
+        )
+        emr_assume_role = DataAwsIamPolicyDocument(self, "emr_assume_role",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=Token.as_list("sts:AssumeRole"),
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["elasticmapreduce.amazonaws.com"],
+                    type="Service"
+                )
+                ]
+            )
+            ]
+        )
+        iam_emr_profile_policy = DataAwsIamPolicyDocument(self, "iam_emr_profile_policy",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["cloudwatch:*", "dynamodb:*", "ec2:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:ListBootstrapActions", "elasticmapreduce:ListClusters", "elasticmapreduce:ListInstanceGroups", "elasticmapreduce:ListInstances", "elasticmapreduce:ListSteps", "kinesis:CreateStream", "kinesis:DeleteStream", "kinesis:DescribeStream", "kinesis:GetRecords", "kinesis:GetShardIterator", "kinesis:MergeShards", "kinesis:PutRecord", "kinesis:SplitShard", "rds:Describe*", "s3:*", "sdb:*", "sns:*", "sqs:*"
+                ],
+                effect="Allow",
+                resources=["*"]
+            )
+            ]
+        )
+        iam_emr_service_policy = DataAwsIamPolicyDocument(self, "iam_emr_service_policy",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CancelSpotInstanceRequests", "ec2:CreateNetworkInterface", "ec2:CreateSecurityGroup", "ec2:CreateTags", "ec2:DeleteNetworkInterface", "ec2:DeleteSecurityGroup", "ec2:DeleteTags", "ec2:DescribeAvailabilityZones", "ec2:DescribeAccountAttributes", "ec2:DescribeDhcpOptions", "ec2:DescribeInstanceStatus", "ec2:DescribeInstances", "ec2:DescribeKeyPairs", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInterfaces", "ec2:DescribePrefixLists", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSpotInstanceRequests", "ec2:DescribeSpotPriceHistory", "ec2:DescribeSubnets", "ec2:DescribeVpcAttribute", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcEndpointServices", "ec2:DescribeVpcs", "ec2:DetachNetworkInterface", "ec2:ModifyImageAttribute", "ec2:ModifyInstanceAttribute", "ec2:RequestSpotInstances", "ec2:RevokeSecurityGroupEgress", "ec2:RunInstances", "ec2:TerminateInstances", "ec2:DeleteVolume", "ec2:DescribeVolumeStatus", "ec2:DescribeVolumes", "ec2:DetachVolume", "iam:GetRole", "iam:GetRolePolicy", "iam:ListInstanceProfiles", "iam:ListRolePolicies", "iam:PassRole", "s3:CreateBucket", "s3:Get*", "s3:List*", "sdb:BatchPutAttributes", "sdb:Select", "sqs:CreateQueue", "sqs:Delete*", "sqs:GetQueue*", "sqs:PurgeQueue", "sqs:ReceiveMessage"
+                ],
+                effect="Allow",
+                resources=["*"]
+            )
+            ]
+        )
+        iam_emr_profile_role = IamRole(self, "iam_emr_profile_role",
+            assume_role_policy=Token.as_string(ec2_assume_role.json),
+            name="iam_emr_profile_role"
+        )
+        iam_emr_service_role = IamRole(self, "iam_emr_service_role",
+            assume_role_policy=Token.as_string(emr_assume_role.json),
+            name="iam_emr_service_role"
+        )
+        aws_iam_role_policy_iam_emr_profile_policy = IamRolePolicy(self, "iam_emr_profile_policy_7",
+            name="iam_emr_profile_policy",
+            policy=Token.as_string(iam_emr_profile_policy.json),
+            role=iam_emr_profile_role.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_role_policy_iam_emr_profile_policy.override_logical_id("iam_emr_profile_policy")
+        aws_iam_role_policy_iam_emr_service_policy = IamRolePolicy(self, "iam_emr_service_policy_8",
+            name="iam_emr_service_policy",
+            policy=Token.as_string(iam_emr_service_policy.json),
+            role=iam_emr_service_role.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_role_policy_iam_emr_service_policy.override_logical_id("iam_emr_service_policy")
+        gw = InternetGateway(self, "gw",
+            vpc_id=main.id
+        )
+        r = RouteTable(self, "r",
+            route=[RouteTableRoute(
+                cidr_block="0.0.0.0/0",
+                gateway_id=gw.id
+            )
+            ],
+            vpc_id=main.id
+        )
+        aws_subnet_main = Subnet(self, "main_11",
+            cidr_block="168.31.0.0/20",
+            tags={
+                "name": "emr_test"
+            },
+            vpc_id=main.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_subnet_main.override_logical_id("main")
+        emr_profile = IamInstanceProfile(self, "emr_profile",
+            name="emr_profile",
+            role=iam_emr_profile_role.name
+        )
+        MainRouteTableAssociation(self, "a",
+            route_table_id=r.id,
+            vpc_id=main.id
+        )
+        allow_access = SecurityGroup(self, "allow_access",
+            depends_on=[aws_subnet_main],
+            description="Allow inbound traffic",
+            egress=[SecurityGroupEgress(
+                cidr_blocks=["0.0.0.0/0"],
+                from_port=0,
+                protocol="-1",
+                to_port=0
+            )
+            ],
+            ingress=[SecurityGroupIngress(
+                cidr_blocks=[main.cidr_block],
+                from_port=0,
+                protocol="-1",
+                to_port=0
+            )
+            ],
+            lifecycle=TerraformResourceLifecycle(
+                ignore_changes=[ingress, egress]
+            ),
+            name="allow_access",
+            tags={
+                "name": "emr_test"
+            },
+            vpc_id=main.id
+        )
+        EmrCluster(self, "cluster",
+            applications=["Spark"],
+            bootstrap_action=[EmrClusterBootstrapAction(
+                args=["instance.isMaster=true", "echo running on master node"],
+                name="runif",
+                path="s3://elasticmapreduce/bootstrap-actions/run-if"
+            )
+            ],
+            configurations_json="  [\n    {\n      \"Classification\": \"hadoop-env\",\n      \"Configurations\": [\n        {\n          \"Classification\": \"export\",\n          \"Properties\": {\n            \"JAVA_HOME\": \"/usr/lib/jvm/java-1.8.0\"\n          }\n        }\n      ],\n      \"Properties\": {}\n    },\n    {\n      \"Classification\": \"spark-env\",\n      \"Configurations\": [\n        {\n          \"Classification\": \"export\",\n          \"Properties\": {\n            \"JAVA_HOME\": \"/usr/lib/jvm/java-1.8.0\"\n          }\n        }\n      ],\n      \"Properties\": {}\n    }\n  ]\n\n",
+            core_instance_group=EmrClusterCoreInstanceGroup(
+                instance_count=1,
+                instance_type="m5.xlarge"
+            ),
+            ec2_attributes=EmrClusterEc2Attributes(
+                emr_managed_master_security_group=allow_access.id,
+                emr_managed_slave_security_group=allow_access.id,
+                instance_profile=emr_profile.arn,
+                subnet_id=Token.as_string(aws_subnet_main.id)
+            ),
+            master_instance_group=EmrClusterMasterInstanceGroup(
+                instance_type="m5.xlarge"
+            ),
+            name="emr-test-arn",
+            release_label="emr-4.6.0",
+            service_role=iam_emr_service_role.arn,
+            tags={
+                "dns_zone": "env_zone",
+                "env": "env",
+                "name": "name-env",
+                "role": "rolename"
+            }
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) Name of the job flow.
+* `release_label` - (Required) Release label for the Amazon EMR release.
+* `service_role` - (Required) IAM role that will be assumed by the Amazon EMR service to access AWS resources.
+
+The following arguments are optional:
+
+* `additional_info` - (Optional) JSON string for selecting additional features such as adding proxy information. Note: Currently there is no API to retrieve the value of this argument after EMR cluster creation from provider, therefore Terraform cannot detect drift from the actual EMR cluster if its value is changed outside Terraform.
+* `applications` - (Optional) A case-insensitive list of applications for Amazon EMR to install and configure when launching the cluster. For a list of applications available for each Amazon EMR release version, see the [Amazon EMR Release Guide](https://docs.aws.amazon.com/emr/latest/ReleaseGuide/emr-release-components.html).
+* `autoscaling_role` - (Optional) IAM role for automatic scaling policies. The IAM role provides permissions that the automatic scaling feature requires to launch and terminate EC2 instances in an instance group.
+* `auto_termination_policy` - (Optional) An auto-termination policy for an Amazon EMR cluster. An auto-termination policy defines the amount of idle time in seconds after which a cluster automatically terminates. See [Auto Termination Policy](#auto_termination_policy) Below.
+* `bootstrap_action` - (Optional) Ordered list of bootstrap actions that will be run before Hadoop is started on the cluster nodes. See below.
+* `configurations` - (Optional) List of configurations supplied for the EMR cluster you are creating. Supply a configuration object for applications to override their default configuration. See [AWS Documentation](https://docs.aws.amazon.com/emr/latest/ReleaseGuide/emr-configure-apps.html) for more information.
+* `configurations_json` - (Optional) JSON string for supplying list of configurations for the EMR cluster.
+
+~> **NOTE on `configurations_json`:** If the `Configurations` value is empty then you should skip the `Configurations` field instead of providing an empty list as a value, `"Configurations": []`.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.emr_cluster import EmrCluster
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, name, releaseLabel, serviceRole):
+        super().__init__(scope, name)
+        EmrCluster(self, "cluster",
+            configurations_json="  [\n    {\n      \"Classification\": \"hadoop-env\",\n      \"Configurations\": [\n        {\n          \"Classification\": \"export\",\n          \"Properties\": {\n            \"JAVA_HOME\": \"/usr/lib/jvm/java-1.8.0\"\n          }\n        }\n      ],\n      \"Properties\": {}\n    }\n  ]\n\n",
+            name=name,
+            release_label=release_label,
+            service_role=service_role
+        )
+```
+
+* `core_instance_fleet` - (Optional) Configuration block to use an [Instance Fleet](https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-instance-fleet.html) for the core node type. Cannot be specified if any `core_instance_group` configuration blocks are set. Detailed below.
+* `core_instance_group` - (Optional) Configuration block to use an [Instance Group](https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-instance-group-configuration.html#emr-plan-instance-groups) for the [core node type](https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-master-core-task-nodes.html#emr-plan-core).
+* `custom_ami_id` - (Optional) Custom Amazon Linux AMI for the cluster (instead of an EMR-owned AMI). Available in Amazon EMR version 5.7.0 and later.
+* `ebs_root_volume_size` - (Optional) Size in GiB of the EBS root device volume of the Linux AMI that is used for each EC2 instance. Available in Amazon EMR version 4.x and later.
+* `ec2_attributes` - (Optional) Attributes for the EC2 instances running the job flow. See below.
+* `keep_job_flow_alive_when_no_steps` - (Optional) Switch on/off run cluster with no steps or when all steps are complete (default is on)
+* `kerberos_attributes` - (Optional) Kerberos configuration for the cluster. See below.
+* `list_steps_states` - (Optional) List of [step states](https://docs.aws.amazon.com/emr/latest/APIReference/API_StepStatus.html) used to filter returned steps
+* `log_encryption_kms_key_id` - (Optional) AWS KMS customer master key (CMK) key ID or arn used for encrypting log files. This attribute is only available with EMR version 5.30.0 and later, excluding EMR 6.0.0.
+* `log_uri` - (Optional) S3 bucket to write the log files of the job flow. If a value is not provided, logs are not created.
+* `master_instance_fleet` - (Optional) Configuration block to use an [Instance Fleet](https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-instance-fleet.html) for the master node type. Cannot be specified if any `master_instance_group` configuration blocks are set. Detailed below.
+* `master_instance_group` - (Optional) Configuration block to use an [Instance Group](https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-instance-group-configuration.html#emr-plan-instance-groups) for the [master node type](https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-master-core-task-nodes.html#emr-plan-master).
+* `placement_group_config` - (Optional) The specified placement group configuration for an Amazon EMR cluster.
+* `scale_down_behavior` - (Optional) Way that individual Amazon EC2 instances terminate when an automatic scale-in activity occurs or an `instance group` is resized.
+* `security_configuration` - (Optional) Security configuration name to attach to the EMR cluster. Only valid for EMR clusters with `release_label` 4.8.0 or greater.
+* `step` - (Optional) List of steps to run when creating the cluster. See below. It is highly recommended to utilize the [lifecycle configuration block](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html) with `ignore_changes` if other steps are being managed outside of Terraform. This argument is processed in [attribute-as-blocks mode](https://www.terraform.io/docs/configuration/attr-as-blocks.html).
+* `step_concurrency_level` - (Optional) Number of steps that can be executed concurrently. You can specify a maximum of 256 steps. Only valid for EMR clusters with `release_label` 5.28.0 or greater (default is 1).
+* `tags` - (Optional) list of tags to apply to the EMR Cluster. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `termination_protection` - (Optional) Switch on/off termination protection (default is `false`, except when using multiple master nodes). Before attempting to destroy the resource when termination protection is enabled, this configuration must be applied with its value set to `false`.
+* `visible_to_all_users` - (Optional) Whether the job flow is visible to all IAM users of the AWS account associated with the job flow. Default value is `true`.
+
+### bootstrap_action
+
+* `args` - (Optional) List of command line arguments to pass to the bootstrap action script.
+* `name` - (Required) Name of the bootstrap action.
+* `path` - (Required) Location of the script to run during a bootstrap action. Can be either a location in Amazon S3 or on a local file system.
+
+### auto_termination_policy
+
+* `idle_timeout` - (Optional) Specifies the amount of idle time in seconds after which the cluster automatically terminates. You can specify a minimum of `60` seconds and a maximum of `604800` seconds (seven days).
+
+### configurations
+
+A configuration classification that applies when provisioning cluster instances, which can include configurations for applications and software that run on the cluster. See [Configuring Applications](https://docs.aws.amazon.com/emr/latest/ReleaseGuide/emr-configure-apps.html).
+
+* `classification` - (Optional) Classification within a configuration.
+* `properties` - (Optional) Map of properties specified within a configuration classification.
+
+### core_instance_fleet
+
+* `instance_type_configs` - (Optional) Configuration block for instance fleet.
+* `launch_specifications` - (Optional) Configuration block for launch specification.
+* `name` - (Optional) Friendly name given to the instance fleet.
+* `target_on_demand_capacity` - (Optional)  The target capacity of On-Demand units for the instance fleet, which determines how many On-Demand instances to provision.
+* `target_spot_capacity` - (Optional) Target capacity of Spot units for the instance fleet, which determines how many Spot instances to provision.
+
+#### instance_type_configs
+
+* `bid_price` - (Optional) Bid price for each EC2 Spot instance type as defined by `instance_type`. Expressed in USD. If neither `bid_price` nor `bid_price_as_percentage_of_on_demand_price` is provided, `bid_price_as_percentage_of_on_demand_price` defaults to 100%.
+* `bid_price_as_percentage_of_on_demand_price` - (Optional) Bid price, as a percentage of On-Demand price, for each EC2 Spot instance as defined by `instance_type`. Expressed as a number (for example, 20 specifies 20%). If neither `bid_price` nor `bid_price_as_percentage_of_on_demand_price` is provided, `bid_price_as_percentage_of_on_demand_price` defaults to 100%.
+* `configurations` - (Optional) Configuration classification that applies when provisioning cluster instances, which can include configurations for applications and software that run on the cluster. List of `configuration` blocks.
+* `ebs_config` - (Optional) Configuration block(s) for EBS volumes attached to each instance in the instance group. Detailed below.
+* `instance_type` - (Required) EC2 instance type, such as m4.xlarge.
+* `weighted_capacity` - (Optional) Number of units that a provisioned instance of this type provides toward fulfilling the target capacities defined in `aws_emr_instance_fleet`.
+
+#### launch_specifications
+
+* `on_demand_specification` - (Optional) Configuration block for on demand instances launch specifications.
+* `spot_specification` - (Optional) Configuration block for spot instances launch specifications.
+
+##### on_demand_specification
+
+The launch specification for On-Demand instances in the instance fleet, which determines the allocation strategy.
+The instance fleet configuration is available only in Amazon EMR versions 4.8.0 and later, excluding 5.0.x versions. On-Demand instances allocation strategy is available in Amazon EMR version 5.12.1 and later.
+
+* `allocation_strategy` - (Required) Specifies the strategy to use in launching On-Demand instance fleets. Currently, the only option is `lowest-price` (the default), which launches the lowest price first.
+
+##### spot_specification
+
+The launch specification for Spot instances in the fleet, which determines the defined duration, provisioning timeout behavior, and allocation strategy.
+
+* `allocation_strategy` - (Required) Specifies the strategy to use in launching Spot instance fleets. Valid values include `capacity-optimized`, `diversified`, `lowest-price`, `price-capacity-optimized`. See the [AWS documentation](https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-instance-fleet.html#emr-instance-fleet-allocation-strategy) for details on each strategy type.
+* `block_duration_minutes` - (Optional) Defined duration for Spot instances (also known as Spot blocks) in minutes. When specified, the Spot instance does not terminate before the defined duration expires, and defined duration pricing for Spot instances applies. Valid values are 60, 120, 180, 240, 300, or 360. The duration period starts as soon as a Spot instance receives its instance ID. At the end of the duration, Amazon EC2 marks the Spot instance for termination and provides a Spot instance termination notice, which gives the instance a two-minute warning before it terminates.
+* `timeout_action` - (Required) Action to take when TargetSpotCapacity has not been fulfilled when the TimeoutDurationMinutes has expired; that is, when all Spot instances could not be provisioned within the Spot provisioning timeout. Valid values are `TERMINATE_CLUSTER` and `SWITCH_TO_ON_DEMAND`. SWITCH_TO_ON_DEMAND specifies that if no Spot instances are available, On-Demand Instances should be provisioned to fulfill any remaining Spot capacity.
+* `timeout_duration_minutes` - (Required) Spot provisioning timeout period in minutes. If Spot instances are not provisioned within this time period, the TimeOutAction is taken. Minimum value is 5 and maximum value is 1440. The timeout applies only during initial provisioning, when the cluster is first created.
+
+### core_instance_group
+
+* `autoscaling_policy` - (Optional) String containing the [EMR Auto Scaling Policy](https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-automatic-scaling.html) JSON.
+* `bid_price` - (Optional) Bid price for each EC2 instance in the instance group, expressed in USD. By setting this attribute, the instance group is being declared as a Spot Instance, and will implicitly create a Spot request. Leave this blank to use On-Demand Instances.
+* `ebs_config` - (Optional) Configuration block(s) for EBS volumes attached to each instance in the instance group. Detailed below.
+* `instance_count` - (Optional) Target number of instances for the instance group. Must be at least 1. Defaults to 1.
+* `instance_type` - (Required) EC2 instance type for all instances in the instance group.
+* `name` - (Optional) Friendly name given to the instance group.
+
+#### ebs_config
+
+* `iops` - (Optional) Number of I/O operations per second (IOPS) that the volume supports.
+* `size` - (Required) Volume size, in gibibytes (GiB).
+* `type` - (Required) Volume type. Valid options are `gp3`, `gp2`, `io1`, `standard`, `st1` and `sc1`. See [EBS Volume Types](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSVolumeTypes.html).
+* `throughput` - (Optional) The throughput, in mebibyte per second (MiB/s).
+* `volumes_per_instance` - (Optional) Number of EBS volumes with this configuration to attach to each EC2 instance in the instance group (default is 1).
+
+### ec2_attributes
+
+Attributes for the Amazon EC2 instances running the job flow:
+
+* `additional_master_security_groups` - (Optional) String containing a comma separated list of additional Amazon EC2 security group IDs for the master node.
+* `additional_slave_security_groups` - (Optional) String containing a comma separated list of additional Amazon EC2 security group IDs for the slave nodes as a comma separated string.
+* `emr_managed_master_security_group` - (Optional) Identifier of the Amazon EC2 EMR-Managed security group for the master node.
+* `emr_managed_slave_security_group` - (Optional) Identifier of the Amazon EC2 EMR-Managed security group for the slave nodes.
+* `instance_profile` - (Required) Instance Profile for EC2 instances of the cluster assume this role.
+* `key_name` - (Optional) Amazon EC2 key pair that can be used to ssh to the master node as the user called `hadoop`.
+* `service_access_security_group` - (Optional) Identifier of the Amazon EC2 service-access security group - required when the cluster runs on a private subnet.
+* `subnet_id` - (Optional) VPC subnet id where you want the job flow to launch. Cannot specify the `cc1.4xlarge` instance type for nodes of a job flow launched in an Amazon VPC.
+* `subnet_ids` - (Optional) List of VPC subnet id-s where you want the job flow to launch.  Amazon EMR identifies the best Availability Zone to launch instances according to your fleet specifications.
+
+~> **NOTE on EMR-Managed security groups:** These security groups will have any missing inbound or outbound access rules added and maintained by AWS, to ensure proper communication between instances in a cluster. The EMR service will maintain these rules for groups provided in `emr_managed_master_security_group` and `emr_managed_slave_security_group`; attempts to remove the required rules may succeed, only for the EMR service to re-add them in a matter of minutes. This may cause Terraform to fail to destroy an environment that contains an EMR cluster, because the EMR service does not revoke rules added on deletion, leaving a cyclic dependency between the security groups that prevents their deletion. To avoid this, use the `revoke_rules_on_delete` optional attribute for any Security Group used in `emr_managed_master_security_group` and `emr_managed_slave_security_group`. See [Amazon EMR-Managed Security Groups](http://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-man-sec-groups.html) for more information about the EMR-managed security group rules.
+
+### kerberos_attributes
+
+* `ad_domain_join_password` - (Optional) Active Directory password for `ad_domain_join_user`. Terraform cannot perform drift detection of this configuration.
+* `ad_domain_join_user` - (Optional) Required only when establishing a cross-realm trust with an Active Directory domain. A user with sufficient privileges to join resources to the domain. Terraform cannot perform drift detection of this configuration.
+* `cross_realm_trust_principal_password` - (Optional) Required only when establishing a cross-realm trust with a KDC in a different realm. The cross-realm principal password, which must be identical across realms. Terraform cannot perform drift detection of this configuration.
+* `kdc_admin_password` - (Required) Password used within the cluster for the kadmin service on the cluster-dedicated KDC, which maintains Kerberos principals, password policies, and keytabs for the cluster. Terraform cannot perform drift detection of this configuration.
+* `realm` - (Required) Name of the Kerberos realm to which all nodes in a cluster belong. For example, `EC2.INTERNAL`
+
+### master_instance_fleet
+
+* `instance_type_configs` - (Optional) Configuration block for instance fleet.
+* `launch_specifications` - (Optional) Configuration block for launch specification.
+* `name` - (Optional) Friendly name given to the instance fleet.
+* `target_on_demand_capacity` - (Optional) Target capacity of On-Demand units for the instance fleet, which determines how many On-Demand instances to provision.
+* `target_spot_capacity` - (Optional) Target capacity of Spot units for the instance fleet, which determines how many Spot instances to provision.
+
+#### instance_type_configs
+
+See `instance_type_configs` above, under `core_instance_fleet`.
+
+#### launch_specifications
+
+See `launch_specifications` above, under `core_instance_fleet`.
+
+### master_instance_group
+
+Supported nested arguments for the `master_instance_group` configuration block:
+
+* `bid_price` - (Optional) Bid price for each EC2 instance in the instance group, expressed in USD. By setting this attribute, the instance group is being declared as a Spot Instance, and will implicitly create a Spot request. Leave this blank to use On-Demand Instances.
+* `ebs_config` - (Optional) Configuration block(s) for EBS volumes attached to each instance in the instance group. Detailed below.
+* `instance_count` - (Optional) Target number of instances for the instance group. Must be 1 or 3. Defaults to 1. Launching with multiple master nodes is only supported in EMR version 5.23.0+, and requires this resource's `core_instance_group` to be configured. Public (Internet accessible) instances must be created in VPC subnets that have [map public IP on launch](/docs/providers/aws/r/subnet.html#map_public_ip_on_launch) enabled. Termination protection is automatically enabled when launched with multiple master nodes and Terraform must have the `termination_protection = false` configuration applied before destroying this resource.
+* `instance_type` - (Required) EC2 instance type for all instances in the instance group.
+* `name` - (Optional) Friendly name given to the instance group.
+
+#### ebs_config
+
+See `ebs_config` under `core_instance_group` above.
+
+### step
+
+This argument is processed in [attribute-as-blocks mode](https://www.terraform.io/docs/configuration/attr-as-blocks.html).
+
+* `action_on_failure` - (Required) Action to take if the step fails. Valid values: `TERMINATE_JOB_FLOW`, `TERMINATE_CLUSTER`, `CANCEL_AND_WAIT`, and `CONTINUE`
+* `hadoop_jar_step` - (Required) JAR file used for the step. See below.
+* `name` - (Required) Name of the step.
+
+#### hadoop_jar_step
+
+This argument is processed in [attribute-as-blocks mode](https://www.terraform.io/docs/configuration/attr-as-blocks.html).
+
+* `args` - (Optional) List of command line arguments passed to the JAR file's main function when executed.
+* `jar` - (Required) Path to a JAR file run during the step.
+* `main_class` - (Optional) Name of the main class in the specified Java file. If not specified, the JAR file should specify a Main-Class in its manifest file.
+* `properties` - (Optional) Key-Value map of Java properties that are set when the step runs. You can use these properties to pass key value pairs to your main function.
+
+### placement_group_config
+
+* `instance_role` - (Required) Role of the instance in the cluster. Valid Values: `MASTER`, `CORE`, `TASK`.
+* `placement_strategy` - (Optional) EC2 Placement Group strategy associated with instance role. Valid Values: `SPREAD`, `PARTITION`, `CLUSTER`, `NONE`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `applications` - Applications installed on this cluster.
+* `arn`- ARN of the cluster.
+* `bootstrap_action` - List of bootstrap actions that will be run before Hadoop is started on the cluster nodes.
+* `configurations` - List of Configurations supplied to the EMR cluster.
+* `core_instance_group.0.id` - Core node type Instance Group ID, if using Instance Group for this node type.
+* `ec2_attributes` - Provides information about the EC2 instances in a cluster grouped by category: key name, subnet ID, IAM instance profile, and so on.
+* `id` - ID of the cluster.
+* `log_uri` - Path to the Amazon S3 location where logs for this cluster are stored.
+* `master_instance_group.0.id` - Master node type Instance Group ID, if using Instance Group for this node type.
+* `master_public_dns` - The DNS name of the master node. If the cluster is on a private subnet, this is the private DNS name. On a public subnet, this is the public DNS name.
+* `name` - Name of the cluster.
+* `release_label` - Release label for the Amazon EMR release.
+* `service_role` - IAM role that will be assumed by the Amazon EMR service to access AWS resources on your behalf.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `visible_to_all_users` - Indicates whether the job flow is visible to all IAM users of the AWS account associated with the job flow.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EMR clusters using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import EMR clusters using the `id`. For example:
+
+```console
+% terraform import aws_emr_cluster.cluster j-123456ABCDEF
+```
+
+Since the API does not return the actual values for Kerberos configurations, environments with those Terraform configurations will need to use the [`lifecycle` configuration block `ignore_changes` argument](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html#ignore_changes) available to all Terraform resources to prevent perpetual differences. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from cdktf import TerraformResourceLifecycle
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.emr_cluster import EmrCluster
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, name, releaseLabel, serviceRole):
+        super().__init__(scope, name)
+        EmrCluster(self, "example",
+            lifecycle=TerraformResourceLifecycle(
+                ignore_changes=[kerberos_attributes]
+            ),
+            name=name,
+            release_label=release_label,
+            service_role=service_role
+        )
+```
+
+<!-- cache-key: cdktf-0.18.0 input-b9d18b24d38c79ee9f688a74547cdb740e2cd654a3d3dc2a431681dd4a66d46c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/emr_instance_fleet.html.markdown b/website/docs/cdktf/python/r/emr_instance_fleet.html.markdown
new file mode 100644
index 00000000000..e7e3d19f45c
--- /dev/null
+++ b/website/docs/cdktf/python/r/emr_instance_fleet.html.markdown
@@ -0,0 +1,163 @@
+---
+subcategory: "EMR"
+layout: "aws"
+page_title: "AWS: aws_emr_instance_fleet"
+description: |-
+  Provides an Elastic MapReduce Cluster Instance Fleet
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_emr_instance_fleet
+
+Provides an Elastic MapReduce Cluster Instance Fleet configuration.
+See [Amazon Elastic MapReduce Documentation](https://aws.amazon.com/documentation/emr/) for more information.
+
+~> **NOTE:** At this time, Instance Fleets cannot be destroyed through the API nor
+web interface. Instance Fleets are destroyed when the EMR Cluster is destroyed.
+Terraform will resize any Instance Fleet to zero when destroying the resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.emr_instance_fleet import EmrInstanceFleet
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        EmrInstanceFleet(self, "task",
+            cluster_id=cluster.id,
+            instance_type_configs=[EmrInstanceFleetInstanceTypeConfigs(
+                bid_price_as_percentage_of_on_demand_price=100,
+                ebs_config=[EmrInstanceFleetInstanceTypeConfigsEbsConfig(
+                    size=100,
+                    type="gp2",
+                    volumes_per_instance=1
+                )
+                ],
+                instance_type="m4.xlarge",
+                weighted_capacity=1
+            ), EmrInstanceFleetInstanceTypeConfigs(
+                bid_price_as_percentage_of_on_demand_price=100,
+                ebs_config=[EmrInstanceFleetInstanceTypeConfigsEbsConfig(
+                    size=100,
+                    type="gp2",
+                    volumes_per_instance=1
+                )
+                ],
+                instance_type="m4.2xlarge",
+                weighted_capacity=2
+            )
+            ],
+            launch_specifications=EmrInstanceFleetLaunchSpecifications(
+                spot_specification=[EmrInstanceFleetLaunchSpecificationsSpotSpecification(
+                    allocation_strategy="capacity-optimized",
+                    block_duration_minutes=0,
+                    timeout_action="TERMINATE_CLUSTER",
+                    timeout_duration_minutes=10
+                )
+                ]
+            ),
+            name="task fleet",
+            target_on_demand_capacity=1,
+            target_spot_capacity=1
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `cluster_id` - (Required) ID of the EMR Cluster to attach to. Changing this forces a new resource to be created.
+* `instance_type_configs` - (Optional) Configuration block for instance fleet
+* `launch_specifications` - (Optional) Configuration block for launch specification
+* `target_on_demand_capacity` - (Optional)  The target capacity of On-Demand units for the instance fleet, which determines how many On-Demand instances to provision.
+* `target_spot_capacity` - (Optional) The target capacity of Spot units for the instance fleet, which determines how many Spot instances to provision.
+* `name` - (Optional) Friendly name given to the instance fleet.
+
+## instance_type_configs Configuration Block
+
+* `bid_price` - (Optional) The bid price for each EC2 Spot instance type as defined by `instance_type`. Expressed in USD. If neither `bid_price` nor `bid_price_as_percentage_of_on_demand_price` is provided, `bid_price_as_percentage_of_on_demand_price` defaults to 100%.
+* `bid_price_as_percentage_of_on_demand_price` - (Optional) The bid price, as a percentage of On-Demand price, for each EC2 Spot instance as defined by `instance_type`. Expressed as a number (for example, 20 specifies 20%). If neither `bid_price` nor `bid_price_as_percentage_of_on_demand_price` is provided, `bid_price_as_percentage_of_on_demand_price` defaults to 100%.
+* `configurations` - (Optional) A configuration classification that applies when provisioning cluster instances, which can include configurations for applications and software that run on the cluster. List of `configuration` blocks.
+* `ebs_config` - (Optional) Configuration block(s) for EBS volumes attached to each instance in the instance group. Detailed below.
+* `instance_type` - (Required) An EC2 instance type, such as m4.xlarge.
+* `weighted_capacity` - (Optional) The number of units that a provisioned instance of this type provides toward fulfilling the target capacities defined in `aws_emr_instance_fleet`.
+
+## configurations Configuration Block
+
+A configuration classification that applies when provisioning cluster instances, which can include configurations for applications and software that run on the cluster. See [Configuring Applications](https://docs.aws.amazon.com/emr/latest/ReleaseGuide/emr-configure-apps.html).
+
+* `classification` - (Optional) The classification within a configuration.
+* `properties` - (Optional) A map of properties specified within a configuration classification
+
+## ebs_config
+
+Attributes for the EBS volumes attached to each EC2 instance in the `master_instance_group` and `core_instance_group` configuration blocks:
+
+* `size` - (Required) The volume size, in gibibytes (GiB).
+* `type` - (Required) The volume type. Valid options are `gp2`, `io1`, `standard` and `st1`. See [EBS Volume Types](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSVolumeTypes.html).
+* `iops` - (Optional) The number of I/O operations per second (IOPS) that the volume supports
+* `volumes_per_instance` - (Optional) The number of EBS volumes with this configuration to attach to each EC2 instance in the instance group (default is 1)
+
+## launch_specifications Configuration Block
+
+* `on_demand_specification` - (Optional) Configuration block for on demand instances launch specifications
+* `spot_specification` - (Optional) Configuration block for spot instances launch specifications
+
+## on_demand_specification  Configuration Block
+
+The launch specification for On-Demand instances in the instance fleet, which determines the allocation strategy.
+The instance fleet configuration is available only in Amazon EMR versions 4.8.0 and later, excluding 5.0.x versions. On-Demand instances allocation strategy is available in Amazon EMR version 5.12.1 and later.
+
+* `allocation_strategy` - (Required) Specifies the strategy to use in launching On-Demand instance fleets. Currently, the only option is `lowest-price` (the default), which launches the lowest price first.
+
+## spot_specification  Configuration Block
+
+The launch specification for Spot instances in the fleet, which determines the defined duration, provisioning timeout behavior, and allocation strategy.
+
+* `allocation_strategy` - (Required) Specifies the strategy to use in launching Spot instance fleets. Currently, the only option is `capacity-optimized` (the default), which launches instances from Spot instance pools with optimal capacity for the number of instances that are launching.
+* `block_duration_minutes` - (Optional) The defined duration for Spot instances (also known as Spot blocks) in minutes. When specified, the Spot instance does not terminate before the defined duration expires, and defined duration pricing for Spot instances applies. Valid values are 60, 120, 180, 240, 300, or 360. The duration period starts as soon as a Spot instance receives its instance ID. At the end of the duration, Amazon EC2 marks the Spot instance for termination and provides a Spot instance termination notice, which gives the instance a two-minute warning before it terminates.
+* `timeout_action` - (Required) The action to take when TargetSpotCapacity has not been fulfilled when the TimeoutDurationMinutes has expired; that is, when all Spot instances could not be provisioned within the Spot provisioning timeout. Valid values are `TERMINATE_CLUSTER` and `SWITCH_TO_ON_DEMAND`. SWITCH_TO_ON_DEMAND specifies that if no Spot instances are available, On-Demand Instances should be provisioned to fulfill any remaining Spot capacity.
+* `timeout_duration_minutes` - (Required) The spot provisioning timeout period in minutes. If Spot instances are not provisioned within this time period, the TimeOutAction is taken. Minimum value is 5 and maximum value is 1440. The timeout applies only during initial provisioning, when the cluster is first created.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The unique identifier of the instance fleet.
+
+* `provisioned_on_demand_capacity` The number of On-Demand units that have been provisioned for the instance
+fleet to fulfill TargetOnDemandCapacity. This provisioned capacity might be less than or greater than TargetOnDemandCapacity.
+
+* `provisioned_spot_capacity` The number of Spot units that have been provisioned for this instance fleet
+to fulfill TargetSpotCapacity. This provisioned capacity might be less than or greater than TargetSpotCapacity.
+
+* `status` The current status of the instance fleet.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EMR Instance Fleet using the EMR Cluster identifier and Instance Fleet identifier separated by a forward slash (`/`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import EMR Instance Fleet using the EMR Cluster identifier and Instance Fleet identifier separated by a forward slash (`/`). For example:
+
+```console
+% terraform import aws_emr_instance_fleet.example j-123456ABCDEF/if-15EK4O09RZLNR
+```
+
+<!-- cache-key: cdktf-0.18.0 input-47af6409cc7439e921a67c3063fdd66af4d873f6cbbb0f2ce7c746cff87b4eb8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/emr_instance_group.html.markdown b/website/docs/cdktf/python/r/emr_instance_group.html.markdown
new file mode 100644
index 00000000000..a2ea866f96f
--- /dev/null
+++ b/website/docs/cdktf/python/r/emr_instance_group.html.markdown
@@ -0,0 +1,109 @@
+---
+subcategory: "EMR"
+layout: "aws"
+page_title: "AWS: aws_emr_instance_group"
+description: |-
+  Provides an Elastic MapReduce Cluster Instance Group
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_emr_instance_group
+
+Provides an Elastic MapReduce Cluster Instance Group configuration.
+See [Amazon Elastic MapReduce Documentation](https://aws.amazon.com/documentation/emr/) for more information.
+
+~> **NOTE:** At this time, Instance Groups cannot be destroyed through the API nor
+web interface. Instance Groups are destroyed when the EMR Cluster is destroyed.
+Terraform will resize any Instance Group to zero when destroying the resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.emr_instance_group import EmrInstanceGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        EmrInstanceGroup(self, "task",
+            cluster_id=tf_test_cluster.id,
+            instance_count=1,
+            instance_type="m5.xlarge",
+            name="my little instance group"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` (Required) Human friendly name given to the instance group. Changing this forces a new resource to be created.
+* `cluster_id` (Required) ID of the EMR Cluster to attach to. Changing this forces a new resource to be created.
+* `instance_type` (Required) The EC2 instance type for all instances in the instance group. Changing this forces a new resource to be created.
+* `instance_count` (Optional) target number of instances for the instance group. defaults to 0.
+* `bid_price` - (Optional) If set, the bid price for each EC2 instance in the instance group, expressed in USD. By setting this attribute, the instance group is being declared as a Spot Instance, and will implicitly create a Spot request. Leave this blank to use On-Demand Instances.
+* `ebs_optimized` (Optional) Indicates whether an Amazon EBS volume is EBS-optimized. Changing this forces a new resource to be created.
+* `ebs_config` (Optional) One or more `ebs_config` blocks as defined below. Changing this forces a new resource to be created.
+* `autoscaling_policy` - (Optional) The autoscaling policy document. This is a JSON formatted string. See [EMR Auto Scaling](https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-automatic-scaling.html)
+* `configurations_json` - (Optional) A JSON string for supplying list of configurations specific to the EMR instance group. Note that this can only be changed when using EMR release 5.21 or later.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.emr_instance_group import EmrInstanceGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, clusterId, instanceType):
+        super().__init__(scope, name)
+        EmrInstanceGroup(self, "task",
+            configurations_json="  [\n    {\n      \"Classification\": \"hadoop-env\",\n      \"Configurations\": [\n        {\n          \"Classification\": \"export\",\n          \"Properties\": {\n            \"JAVA_HOME\": \"/usr/lib/jvm/java-1.8.0\"\n          }\n        }\n      ],\n      \"Properties\": {}\n    }\n  ]\n\n",
+            cluster_id=cluster_id,
+            instance_type=instance_type
+        )
+```
+
+`ebs_config` supports the following:
+
+* `iops` - (Optional) The number of I/O operations per second (IOPS) that the volume supports.
+* `size` - (Optional) The volume size, in gibibytes (GiB). This can be a number from 1 - 1024. If the volume type is EBS-optimized, the minimum value is 10.
+* `type` - (Optional) The volume type. Valid options are 'gp2', 'io1' and 'standard'.
+* `volumes_per_instance` - (Optional) The number of EBS Volumes to attach per instance.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The EMR Instance ID
+* `running_instance_count` The number of instances currently running in this instance group.
+* `status` The current status of the instance group.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EMR task instance group using their EMR Cluster id and Instance Group id separated by a forward-slash `/`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import EMR task instance group using their EMR Cluster id and Instance Group id separated by a forward-slash `/`. For example:
+
+```console
+% terraform import aws_emr_instance_group.task_group j-123456ABCDEF/ig-15EK4O09RZLNR
+```
+
+<!-- cache-key: cdktf-0.18.0 input-81ea0e37ef071af4b0b3288229252058d70fdfc3a60046cd4d509292a38b32f0 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/emr_managed_scaling_policy.html.markdown b/website/docs/cdktf/python/r/emr_managed_scaling_policy.html.markdown
new file mode 100644
index 00000000000..eab99082729
--- /dev/null
+++ b/website/docs/cdktf/python/r/emr_managed_scaling_policy.html.markdown
@@ -0,0 +1,92 @@
+---
+subcategory: "EMR"
+layout: "aws"
+page_title: "AWS: aws_emr_managed_scaling_policy"
+description: |-
+  Provides a resource for EMR Managed Scaling policy
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_emr_managed_scaling_policy
+
+Provides a Managed Scaling policy for EMR Cluster. With Amazon EMR versions 5.30.0 and later (except for Amazon EMR 6.0.0), you can enable EMR managed scaling to automatically increase or decrease the number of instances or units in your cluster based on workload. See [Using EMR Managed Scaling in Amazon EMR](https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-managed-scaling.html) for more information.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.emr_cluster import EmrCluster
+from imports.aws.emr_managed_scaling_policy import EmrManagedScalingPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, serviceRole):
+        super().__init__(scope, name)
+        sample = EmrCluster(self, "sample",
+            core_instance_group=EmrClusterCoreInstanceGroup(
+                instance_type="c4.large"
+            ),
+            master_instance_group=EmrClusterMasterInstanceGroup(
+                instance_type="m4.large"
+            ),
+            name="emr-sample-cluster",
+            release_label="emr-5.30.0",
+            service_role=service_role
+        )
+        EmrManagedScalingPolicy(self, "samplepolicy",
+            cluster_id=sample.id,
+            compute_limits=[EmrManagedScalingPolicyComputeLimits(
+                maximum_capacity_units=10,
+                maximum_core_capacity_units=10,
+                maximum_ondemand_capacity_units=2,
+                minimum_capacity_units=2,
+                unit_type="Instances"
+            )
+            ]
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `cluster_id` - (Required) ID of the EMR cluster
+* `compute_limits` - (Required) Configuration block with compute limit settings. Described below.
+
+### compute_limits
+
+* `unit_type` - (Required) The unit type used for specifying a managed scaling policy. Valid Values: `InstanceFleetUnits` | `Instances` | `VCPU`
+* `minimum_capacity_units` - (Required) The lower boundary of EC2 units. It is measured through VCPU cores or instances for instance groups and measured through units for instance fleets. Managed scaling activities are not allowed beyond this boundary. The limit only applies to the core and task nodes. The master node cannot be scaled after initial configuration.
+* `maximum_capacity_units` - (Required) The upper boundary of EC2 units. It is measured through VCPU cores or instances for instance groups and measured through units for instance fleets. Managed scaling activities are not allowed beyond this boundary. The limit only applies to the core and task nodes. The master node cannot be scaled after initial configuration.
+* `maximum_ondemand_capacity_units` - (Optional) The upper boundary of On-Demand EC2 units. It is measured through VCPU cores or instances for instance groups and measured through units for instance fleets. The On-Demand units are not allowed to scale beyond this boundary. The parameter is used to split capacity allocation between On-Demand and Spot instances.
+* `maximum_core_capacity_units` - (Optional) The upper boundary of EC2 units for core node type in a cluster. It is measured through VCPU cores or instances for instance groups and measured through units for instance fleets. The core units are not allowed to scale beyond this boundary. The parameter is used to split capacity allocation between core and task nodes.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EMR Managed Scaling Policies using the EMR Cluster identifier. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import EMR Managed Scaling Policies using the EMR Cluster identifier. For example:
+
+```console
+% terraform import aws_emr_managed_scaling_policy.example j-123456ABCDEF
+```
+
+<!-- cache-key: cdktf-0.18.0 input-62b04cc94e05c0974582d7b0b1123356847a607e2399a95467c580bdbc32dcb0 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/emr_security_configuration.html.markdown b/website/docs/cdktf/python/r/emr_security_configuration.html.markdown
new file mode 100644
index 00000000000..42581fc26d4
--- /dev/null
+++ b/website/docs/cdktf/python/r/emr_security_configuration.html.markdown
@@ -0,0 +1,72 @@
+---
+subcategory: "EMR"
+layout: "aws"
+page_title: "AWS: aws_emr_security_configuration"
+description: |-
+  Provides a resource to manage AWS EMR Security Configurations
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_emr_security_configuration
+
+Provides a resource to manage AWS EMR Security Configurations
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.emr_security_configuration import EmrSecurityConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        EmrSecurityConfiguration(self, "foo",
+            configuration="{\n  \"EncryptionConfiguration\": {\n    \"AtRestEncryptionConfiguration\": {\n      \"S3EncryptionConfiguration\": {\n        \"EncryptionMode\": \"SSE-S3\"\n      },\n      \"LocalDiskEncryptionConfiguration\": {\n        \"EncryptionKeyProviderType\": \"AwsKms\",\n        \"AwsKmsKey\": \"arn:aws:kms:us-west-2:187416307283:alias/tf_emr_test_key\"\n      }\n    },\n    \"EnableInTransitEncryption\": false,\n    \"EnableAtRestEncryption\": true\n  }\n}\n\n",
+            name="emrsc_other"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Optional) The name of the EMR Security Configuration. By default generated by Terraform.
+* `name_prefix` - (Optional) Creates a unique name beginning with the specified
+  prefix. Conflicts with `name`.
+* `configuration` - (Required) A JSON formatted Security Configuration
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the EMR Security Configuration (Same as the `name`)
+* `name` - The Name of the EMR Security Configuration
+* `configuration` - The JSON formatted Security Configuration
+* `creation_date` - Date the Security Configuration was created
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EMR Security Configurations using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import EMR Security Configurations using the `name`. For example:
+
+```console
+% terraform import aws_emr_security_configuration.sc example-sc-name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-b64a1c2b9d100ab236186e61b15ae97f07452528ddea572b121afa7cc189e40f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/emr_studio.html.markdown b/website/docs/cdktf/python/r/emr_studio.html.markdown
new file mode 100644
index 00000000000..77ccba8d54b
--- /dev/null
+++ b/website/docs/cdktf/python/r/emr_studio.html.markdown
@@ -0,0 +1,89 @@
+---
+subcategory: "EMR"
+layout: "aws"
+page_title: "AWS: aws_emr_studio"
+description: |-
+  Provides an Elastic MapReduce Studio
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_emr_studio
+
+Provides an Elastic MapReduce Studio.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.emr_studio import EmrStudio
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        EmrStudio(self, "example",
+            auth_mode="SSO",
+            default_s3_location="s3://${" + test.bucket + "}/test",
+            engine_security_group_id=Token.as_string(aws_security_group_test.id),
+            name="example",
+            service_role=Token.as_string(aws_iam_role_test.arn),
+            subnet_ids=[Token.as_string(aws_subnet_test.id)],
+            user_role=Token.as_string(aws_iam_role_test.arn),
+            vpc_id=Token.as_string(aws_vpc_test.id),
+            workspace_security_group_id=Token.as_string(aws_security_group_test.id)
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `auth_mode`- (Required) Specifies whether the Studio authenticates users using IAM or Amazon Web Services SSO. Valid values are `SSO` or `IAM`.
+* `default_s3_location` - (Required) The Amazon S3 location to back up Amazon EMR Studio Workspaces and notebook files.
+* `name` - (Required) A descriptive name for the Amazon EMR Studio.
+* `engine_security_group_id` - (Required) The ID of the Amazon EMR Studio Engine security group. The Engine security group allows inbound network traffic from the Workspace security group, and it must be in the same VPC specified by `vpc_id`.
+* `service_role` - (Required) The IAM role that the Amazon EMR Studio assumes. The service role provides a way for Amazon EMR Studio to interoperate with other Amazon Web Services services.
+* `subnet_ids` - (Required) A list of subnet IDs to associate with the Amazon EMR Studio. A Studio can have a maximum of 5 subnets. The subnets must belong to the VPC specified by `vpc_id`. Studio users can create a Workspace in any of the specified subnets.
+* `vpc_id` - (Required) The ID of the Amazon Virtual Private Cloud (Amazon VPC) to associate with the Studio.
+* `workspace_security_group_id` - (Required) The ID of the Amazon EMR Studio Workspace security group. The Workspace security group allows outbound network traffic to resources in the Engine security group, and it must be in the same VPC specified by `vpc_id`.
+
+The following arguments are optional:
+
+* `description` - (Optional) A detailed description of the Amazon EMR Studio.
+* `idp_auth_url` - (Optional) The authentication endpoint of your identity provider (IdP). Specify this value when you use IAM authentication and want to let federated users log in to a Studio with the Studio URL and credentials from your IdP. Amazon EMR Studio redirects users to this endpoint to enter credentials.
+* `idp_relay_state_parameter_name` - (Optional) The name that your identity provider (IdP) uses for its RelayState parameter. For example, RelayState or TargetSource. Specify this value when you use IAM authentication and want to let federated users log in to a Studio using the Studio URL. The RelayState parameter differs by IdP.
+* `tags` - (Optional) list of tags to apply to the EMR Cluster. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `user_role` - (Optional) - The IAM user role that users and groups assume when logged in to an Amazon EMR Studio. Only specify a User Role when you use Amazon Web Services SSO authentication. The permissions attached to the User Role can be scoped down for each user or group using session policies.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn`- ARN of the studio.
+* `url` - The unique access URL of the Amazon EMR Studio.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EMR studios using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import EMR studios using the `id`. For example:
+
+```console
+% terraform import aws_emr_studio.studio es-123456ABCDEF
+```
+
+<!-- cache-key: cdktf-0.18.0 input-61bdc9504022130875c4d8d0fd748ffd340f18084eaa62d5583c0c5041452faf -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/emr_studio_session_mapping.html.markdown b/website/docs/cdktf/python/r/emr_studio_session_mapping.html.markdown
new file mode 100644
index 00000000000..6a89a665848
--- /dev/null
+++ b/website/docs/cdktf/python/r/emr_studio_session_mapping.html.markdown
@@ -0,0 +1,72 @@
+---
+subcategory: "EMR"
+layout: "aws"
+page_title: "AWS: aws_emr_studio_session_mapping"
+description: |-
+  Provides an Elastic MapReduce Studio
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_emr_studio_session_mapping
+
+Provides an Elastic MapReduce Studio Session Mapping.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.emr_studio_session_mapping import EmrStudioSessionMapping
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        EmrStudioSessionMapping(self, "example",
+            identity_id="example",
+            identity_type="USER",
+            session_policy_arn=Token.as_string(aws_iam_policy_example.arn),
+            studio_id=Token.as_string(aws_emr_studio_example.id)
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `identity_id`- (Optional) The globally unique identifier (GUID) of the user or group from the Amazon Web Services SSO Identity Store.
+* `identity_name` - (Optional) The name of the user or group from the Amazon Web Services SSO Identity Store.
+* `identity_type` - (Required) Specifies whether the identity to map to the Amazon EMR Studio is a `USER` or a `GROUP`.
+* `session_policy_arn` - (Required) The Amazon Resource Name (ARN) for the session policy that will be applied to the user or group. You should specify the ARN for the session policy that you want to apply, not the ARN of your user role.
+* `studio_id` - (Required) The ID of the Amazon EMR Studio to which the user or group will be mapped.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id`- The id of the Elastic MapReduce Studio Session Mapping.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EMR studio session mappings using `studio-id:identity-type:identity-id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import EMR studio session mappings using `studio-id:identity-type:identity-id`. For example:
+
+```console
+% terraform import aws_emr_studio_session_mapping.example es-xxxxx:USER:xxxxx-xxx-xxx
+```
+
+<!-- cache-key: cdktf-0.18.0 input-6be21ee08f5326f461796bd38e16a942ea254529c5e303950bf2b3a3f049afa4 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/emrcontainers_job_template.html.markdown b/website/docs/cdktf/python/r/emrcontainers_job_template.html.markdown
new file mode 100644
index 00000000000..462c8dc15e5
--- /dev/null
+++ b/website/docs/cdktf/python/r/emrcontainers_job_template.html.markdown
@@ -0,0 +1,131 @@
+---
+subcategory: "EMR Containers"
+layout: "aws"
+page_title: "AWS: aws_emrcontainers_job_template"
+description: |-
+  Manages an EMR Containers (EMR on EKS) Job Template
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_emrcontainers_job_template
+
+Manages an EMR Containers (EMR on EKS) Job Template.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.emrcontainers_job_template import EmrcontainersJobTemplate
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        EmrcontainersJobTemplate(self, "example",
+            job_template_data=EmrcontainersJobTemplateJobTemplateData(
+                execution_role_arn=Token.as_string(aws_iam_role_example.arn),
+                job_driver=EmrcontainersJobTemplateJobTemplateDataJobDriver(
+                    spark_sql_job_driver=EmrcontainersJobTemplateJobTemplateDataJobDriverSparkSqlJobDriver(
+                        entry_point="default"
+                    )
+                ),
+                release_label="emr-6.10.0-latest"
+            ),
+            name="example"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `job_template_data` - (Required) The job template data which holds values of StartJobRun API request.
+* `kms_key_arn` - (Optional) The KMS key ARN used to encrypt the job template.
+* `name` – (Required) The specified name of the job template.
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### job_template_data Arguments
+
+* `configuration_overrides` - (Optional) The configuration settings that are used to override defaults configuration.
+* `execution_role_arn` - (Required) The execution role ARN of the job run.
+* `job_driver` - (Required) Specify the driver that the job runs on. Exactly one of the two available job drivers is required, either sparkSqlJobDriver or sparkSubmitJobDriver.
+* `job_tags` - (Optional) The tags assigned to jobs started using the job template.
+* `release_label` - (Required) The release version of Amazon EMR.
+
+#### configuration_overrides Arguments
+
+* `application_configuration` - (Optional) The configurations for the application running by the job run.
+* `monitoring_configuration` - (Optional) The configurations for monitoring.
+
+##### application_configuration Arguments
+
+* `classification` - (Required) The classification within a configuration.
+* `configurations` - (Optional) A list of additional configurations to apply within a configuration object.
+* `properties` - (Optional) A set of properties specified within a configuration classification.
+
+##### monitoring_configuration Arguments
+
+* `cloud_watch_monitoring_configuration` - (Optional) Monitoring configurations for CloudWatch.
+* `persistent_app_ui` - (Optional)  Monitoring configurations for the persistent application UI.
+* `s3_monitoring_configuration` - (Optional) Amazon S3 configuration for monitoring log publishing.
+
+###### cloud_watch_monitoring_configuration Arguments
+
+* `log_group_name` - (Required) The name of the log group for log publishing.
+* `log_stream_name_prefix` - (Optional) The specified name prefix for log streams.
+
+###### s3_monitoring_configuration Arguments
+
+* `log_uri` - (Optional) Amazon S3 destination URI for log publishing.
+
+#### job_driver Arguments
+
+* `spark_sql_job_driver` - (Optional) The job driver for job type.
+* `spark_submit_job_driver` - (Optional) The job driver parameters specified for spark submit.
+
+##### spark_sql_job_driver Arguments
+
+* `entry_point` - (Optional) The SQL file to be executed.
+* `spark_sql_parameters` - (Optional) The Spark parameters to be included in the Spark SQL command.
+
+##### spark_submit_job_driver Arguments
+
+* `entry_point` - (Required) The entry point of job application.
+* `entry_point_arguments` - (Optional) The arguments for job application.
+* `spark_submit_parameters` - (Optional) The Spark submit parameters that are used for job runs.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the job template.
+* `id` - The ID of the job template.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EKS job templates using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import EKS job templates using the `id`. For example:
+
+```console
+% terraform import aws_emrcontainers_job_template.example a1b2c3d4e5f6g7h8i9j10k11l
+```
+
+<!-- cache-key: cdktf-0.18.0 input-40a45aaa72930deebb9754da5bddf771139ffc5f6fcddde32b7b2b44ae90f112 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/emrcontainers_job_template.markdown b/website/docs/cdktf/python/r/emrcontainers_job_template.markdown
new file mode 100644
index 00000000000..462c8dc15e5
--- /dev/null
+++ b/website/docs/cdktf/python/r/emrcontainers_job_template.markdown
@@ -0,0 +1,131 @@
+---
+subcategory: "EMR Containers"
+layout: "aws"
+page_title: "AWS: aws_emrcontainers_job_template"
+description: |-
+  Manages an EMR Containers (EMR on EKS) Job Template
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_emrcontainers_job_template
+
+Manages an EMR Containers (EMR on EKS) Job Template.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.emrcontainers_job_template import EmrcontainersJobTemplate
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        EmrcontainersJobTemplate(self, "example",
+            job_template_data=EmrcontainersJobTemplateJobTemplateData(
+                execution_role_arn=Token.as_string(aws_iam_role_example.arn),
+                job_driver=EmrcontainersJobTemplateJobTemplateDataJobDriver(
+                    spark_sql_job_driver=EmrcontainersJobTemplateJobTemplateDataJobDriverSparkSqlJobDriver(
+                        entry_point="default"
+                    )
+                ),
+                release_label="emr-6.10.0-latest"
+            ),
+            name="example"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `job_template_data` - (Required) The job template data which holds values of StartJobRun API request.
+* `kms_key_arn` - (Optional) The KMS key ARN used to encrypt the job template.
+* `name` – (Required) The specified name of the job template.
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### job_template_data Arguments
+
+* `configuration_overrides` - (Optional) The configuration settings that are used to override defaults configuration.
+* `execution_role_arn` - (Required) The execution role ARN of the job run.
+* `job_driver` - (Required) Specify the driver that the job runs on. Exactly one of the two available job drivers is required, either sparkSqlJobDriver or sparkSubmitJobDriver.
+* `job_tags` - (Optional) The tags assigned to jobs started using the job template.
+* `release_label` - (Required) The release version of Amazon EMR.
+
+#### configuration_overrides Arguments
+
+* `application_configuration` - (Optional) The configurations for the application running by the job run.
+* `monitoring_configuration` - (Optional) The configurations for monitoring.
+
+##### application_configuration Arguments
+
+* `classification` - (Required) The classification within a configuration.
+* `configurations` - (Optional) A list of additional configurations to apply within a configuration object.
+* `properties` - (Optional) A set of properties specified within a configuration classification.
+
+##### monitoring_configuration Arguments
+
+* `cloud_watch_monitoring_configuration` - (Optional) Monitoring configurations for CloudWatch.
+* `persistent_app_ui` - (Optional)  Monitoring configurations for the persistent application UI.
+* `s3_monitoring_configuration` - (Optional) Amazon S3 configuration for monitoring log publishing.
+
+###### cloud_watch_monitoring_configuration Arguments
+
+* `log_group_name` - (Required) The name of the log group for log publishing.
+* `log_stream_name_prefix` - (Optional) The specified name prefix for log streams.
+
+###### s3_monitoring_configuration Arguments
+
+* `log_uri` - (Optional) Amazon S3 destination URI for log publishing.
+
+#### job_driver Arguments
+
+* `spark_sql_job_driver` - (Optional) The job driver for job type.
+* `spark_submit_job_driver` - (Optional) The job driver parameters specified for spark submit.
+
+##### spark_sql_job_driver Arguments
+
+* `entry_point` - (Optional) The SQL file to be executed.
+* `spark_sql_parameters` - (Optional) The Spark parameters to be included in the Spark SQL command.
+
+##### spark_submit_job_driver Arguments
+
+* `entry_point` - (Required) The entry point of job application.
+* `entry_point_arguments` - (Optional) The arguments for job application.
+* `spark_submit_parameters` - (Optional) The Spark submit parameters that are used for job runs.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the job template.
+* `id` - The ID of the job template.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EKS job templates using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import EKS job templates using the `id`. For example:
+
+```console
+% terraform import aws_emrcontainers_job_template.example a1b2c3d4e5f6g7h8i9j10k11l
+```
+
+<!-- cache-key: cdktf-0.18.0 input-40a45aaa72930deebb9754da5bddf771139ffc5f6fcddde32b7b2b44ae90f112 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/emrcontainers_virtual_cluster.html.markdown b/website/docs/cdktf/python/r/emrcontainers_virtual_cluster.html.markdown
new file mode 100644
index 00000000000..15129eb0626
--- /dev/null
+++ b/website/docs/cdktf/python/r/emrcontainers_virtual_cluster.html.markdown
@@ -0,0 +1,88 @@
+---
+subcategory: "EMR Containers"
+layout: "aws"
+page_title: "AWS: aws_emrcontainers_virtual_cluster"
+description: |-
+  Manages an EMR Containers (EMR on EKS) Virtual Cluster
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_emrcontainers_virtual_cluster
+
+Manages an EMR Containers (EMR on EKS) Virtual Cluster.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.emrcontainers_virtual_cluster import EmrcontainersVirtualCluster
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        EmrcontainersVirtualCluster(self, "example",
+            container_provider=EmrcontainersVirtualClusterContainerProvider(
+                id=Token.as_string(aws_eks_cluster_example.name),
+                info=EmrcontainersVirtualClusterContainerProviderInfo(
+                    eks_info=EmrcontainersVirtualClusterContainerProviderInfoEksInfo(
+                        namespace="default"
+                    )
+                ),
+                type="EKS"
+            ),
+            name="example"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `container_provider` - (Required) Configuration block for the container provider associated with your cluster.
+* `name` – (Required) Name of the virtual cluster.
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### container_provider Arguments
+
+* `id` - The name of the container provider that is running your EMR Containers cluster
+* `info` - Nested list containing information about the configuration of the container provider
+    * `eks_info` - Nested list containing EKS-specific information about the cluster where the EMR Containers cluster is running
+        * `namespace` - The namespace where the EMR Containers cluster is running
+* `type` - The type of the container provider
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the cluster.
+* `id` - The ID of the cluster.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EKS Clusters using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import EKS Clusters using the `id`. For example:
+
+```console
+% terraform import aws_emrcontainers_virtual_cluster.example a1b2c3d4e5f6g7h8i9j10k11l
+```
+
+<!-- cache-key: cdktf-0.18.0 input-221e0f1e69a0b4a1b86a8c23d4aa75c1195f9ddf4419494ec9832c76d6a2f913 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/emrcontainers_virtual_cluster.markdown b/website/docs/cdktf/python/r/emrcontainers_virtual_cluster.markdown
new file mode 100644
index 00000000000..15129eb0626
--- /dev/null
+++ b/website/docs/cdktf/python/r/emrcontainers_virtual_cluster.markdown
@@ -0,0 +1,88 @@
+---
+subcategory: "EMR Containers"
+layout: "aws"
+page_title: "AWS: aws_emrcontainers_virtual_cluster"
+description: |-
+  Manages an EMR Containers (EMR on EKS) Virtual Cluster
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_emrcontainers_virtual_cluster
+
+Manages an EMR Containers (EMR on EKS) Virtual Cluster.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.emrcontainers_virtual_cluster import EmrcontainersVirtualCluster
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        EmrcontainersVirtualCluster(self, "example",
+            container_provider=EmrcontainersVirtualClusterContainerProvider(
+                id=Token.as_string(aws_eks_cluster_example.name),
+                info=EmrcontainersVirtualClusterContainerProviderInfo(
+                    eks_info=EmrcontainersVirtualClusterContainerProviderInfoEksInfo(
+                        namespace="default"
+                    )
+                ),
+                type="EKS"
+            ),
+            name="example"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `container_provider` - (Required) Configuration block for the container provider associated with your cluster.
+* `name` – (Required) Name of the virtual cluster.
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### container_provider Arguments
+
+* `id` - The name of the container provider that is running your EMR Containers cluster
+* `info` - Nested list containing information about the configuration of the container provider
+    * `eks_info` - Nested list containing EKS-specific information about the cluster where the EMR Containers cluster is running
+        * `namespace` - The namespace where the EMR Containers cluster is running
+* `type` - The type of the container provider
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the cluster.
+* `id` - The ID of the cluster.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EKS Clusters using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import EKS Clusters using the `id`. For example:
+
+```console
+% terraform import aws_emrcontainers_virtual_cluster.example a1b2c3d4e5f6g7h8i9j10k11l
+```
+
+<!-- cache-key: cdktf-0.18.0 input-221e0f1e69a0b4a1b86a8c23d4aa75c1195f9ddf4419494ec9832c76d6a2f913 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/emrserverless_application.html.markdown b/website/docs/cdktf/python/r/emrserverless_application.html.markdown
new file mode 100644
index 00000000000..3b53869e7e0
--- /dev/null
+++ b/website/docs/cdktf/python/r/emrserverless_application.html.markdown
@@ -0,0 +1,178 @@
+---
+subcategory: "EMR Serverless"
+layout: "aws"
+page_title: "AWS: aws_emrserverless_application"
+description: |-
+  Manages an EMR Serverless Application
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_emrserverless_application
+
+Manages an EMR Serverless Application.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.emrserverless_application import EmrserverlessApplication
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        EmrserverlessApplication(self, "example",
+            name="example",
+            release_label="emr-6.6.0",
+            type="hive"
+        )
+```
+
+### Initial Capacity Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.emrserverless_application import EmrserverlessApplication
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        EmrserverlessApplication(self, "example",
+            initial_capacity=[EmrserverlessApplicationInitialCapacity(
+                initial_capacity_config=EmrserverlessApplicationInitialCapacityInitialCapacityConfig(
+                    worker_configuration=EmrserverlessApplicationInitialCapacityInitialCapacityConfigWorkerConfiguration(
+                        cpu="2 vCPU",
+                        memory="10 GB"
+                    ),
+                    worker_count=1
+                ),
+                initial_capacity_type="HiveDriver"
+            )
+            ],
+            name="example",
+            release_label="emr-6.6.0",
+            type="hive"
+        )
+```
+
+### Maximum Capacity Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.emrserverless_application import EmrserverlessApplication
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        EmrserverlessApplication(self, "example",
+            maximum_capacity=EmrserverlessApplicationMaximumCapacity(
+                cpu="2 vCPU",
+                memory="10 GB"
+            ),
+            name="example",
+            release_label="emr-6.6.0",
+            type="hive"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `architecture` – (Optional) The CPU architecture of an application. Valid values are `ARM64` or `X86_64`. Default value is `X86_64`.
+* `auto_start_configuration` – (Optional) The configuration for an application to automatically start on job submission.
+* `auto_stop_configuration` – (Optional) The configuration for an application to automatically stop after a certain amount of time being idle.
+* `image_configuration` – (Optional) The image configuration applied to all worker types.
+* `initial_capacity` – (Optional) The capacity to initialize when the application is created.
+* `maximum_capacity` – (Optional) The maximum capacity to allocate when the application is created. This is cumulative across all workers at any given point in time, not just when an application is created. No new resources will be created once any one of the defined limits is hit.
+* `name` – (Required) The name of the application.
+* `network_configuration` – (Optional) The network configuration for customer VPC connectivity.
+* `release_label` – (Required) The EMR release version associated with the application.
+* `type` – (Required) The type of application you want to start, such as `spark` or `hive`.
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### auto_start_configuration Arguments
+
+* `enabled` - (Optional) Enables the application to automatically start on job submission. Defaults to `true`.
+
+### auto_stop_configuration Arguments
+
+* `enabled` - (Optional) Enables the application to automatically stop after a certain amount of time being idle. Defaults to `true`.
+* `idle_timeout_minutes` - (Optional) The amount of idle time in minutes after which your application will automatically stop. Defaults to `15` minutes.
+
+### initial_capacity Arguments
+
+* `initial_capacity_config` - (Optional) The initial capacity configuration per worker.
+* `initial_capacity_type` - (Required) The worker type for an analytics framework. For Spark applications, the key can either be set to `Driver` or `Executor`. For Hive applications, it can be set to `HiveDriver` or `TezTask`.
+
+### maximum_capacity Arguments
+
+* `cpu` - (Required) The maximum allowed CPU for an application.
+* `disk` - (Optional) The maximum allowed disk for an application.
+* `memory` - (Required) The maximum allowed resources for an application.
+
+### network_configuration Arguments
+
+* `security_group_ids` - (Optional) The array of security group Ids for customer VPC connectivity.
+* `subnet_ids` - (Optional) The array of subnet Ids for customer VPC connectivity.
+
+#### image_configuration Arguments
+
+* `image_uri` - (Required) The image URI.
+
+#### initial_capacity_config Arguments
+
+* `worker_configuration` - (Optional) The resource configuration of the initial capacity configuration.
+* `worker_count` - (Required) The number of workers in the initial capacity configuration.
+
+##### worker_configuration Arguments
+
+* `cpu` - (Required) The CPU requirements for every worker instance of the worker type.
+* `disk` - (Optional) The disk requirements for every worker instance of the worker type.
+* `memory` - (Required) The memory requirements for every worker instance of the worker type.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the cluster.
+* `id` - The ID of the cluster.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EMR Severless applications using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import EMR Severless applications using the `id`. For example:
+
+```console
+% terraform import aws_emrserverless_application.example id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-e44c01cb3d0245a04c0ae76333390d6e8ad9c201d82a7409ec4c28eab63c55d0 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/emrserverless_application.markdown b/website/docs/cdktf/python/r/emrserverless_application.markdown
new file mode 100644
index 00000000000..3b53869e7e0
--- /dev/null
+++ b/website/docs/cdktf/python/r/emrserverless_application.markdown
@@ -0,0 +1,178 @@
+---
+subcategory: "EMR Serverless"
+layout: "aws"
+page_title: "AWS: aws_emrserverless_application"
+description: |-
+  Manages an EMR Serverless Application
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_emrserverless_application
+
+Manages an EMR Serverless Application.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.emrserverless_application import EmrserverlessApplication
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        EmrserverlessApplication(self, "example",
+            name="example",
+            release_label="emr-6.6.0",
+            type="hive"
+        )
+```
+
+### Initial Capacity Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.emrserverless_application import EmrserverlessApplication
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        EmrserverlessApplication(self, "example",
+            initial_capacity=[EmrserverlessApplicationInitialCapacity(
+                initial_capacity_config=EmrserverlessApplicationInitialCapacityInitialCapacityConfig(
+                    worker_configuration=EmrserverlessApplicationInitialCapacityInitialCapacityConfigWorkerConfiguration(
+                        cpu="2 vCPU",
+                        memory="10 GB"
+                    ),
+                    worker_count=1
+                ),
+                initial_capacity_type="HiveDriver"
+            )
+            ],
+            name="example",
+            release_label="emr-6.6.0",
+            type="hive"
+        )
+```
+
+### Maximum Capacity Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.emrserverless_application import EmrserverlessApplication
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        EmrserverlessApplication(self, "example",
+            maximum_capacity=EmrserverlessApplicationMaximumCapacity(
+                cpu="2 vCPU",
+                memory="10 GB"
+            ),
+            name="example",
+            release_label="emr-6.6.0",
+            type="hive"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `architecture` – (Optional) The CPU architecture of an application. Valid values are `ARM64` or `X86_64`. Default value is `X86_64`.
+* `auto_start_configuration` – (Optional) The configuration for an application to automatically start on job submission.
+* `auto_stop_configuration` – (Optional) The configuration for an application to automatically stop after a certain amount of time being idle.
+* `image_configuration` – (Optional) The image configuration applied to all worker types.
+* `initial_capacity` – (Optional) The capacity to initialize when the application is created.
+* `maximum_capacity` – (Optional) The maximum capacity to allocate when the application is created. This is cumulative across all workers at any given point in time, not just when an application is created. No new resources will be created once any one of the defined limits is hit.
+* `name` – (Required) The name of the application.
+* `network_configuration` – (Optional) The network configuration for customer VPC connectivity.
+* `release_label` – (Required) The EMR release version associated with the application.
+* `type` – (Required) The type of application you want to start, such as `spark` or `hive`.
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### auto_start_configuration Arguments
+
+* `enabled` - (Optional) Enables the application to automatically start on job submission. Defaults to `true`.
+
+### auto_stop_configuration Arguments
+
+* `enabled` - (Optional) Enables the application to automatically stop after a certain amount of time being idle. Defaults to `true`.
+* `idle_timeout_minutes` - (Optional) The amount of idle time in minutes after which your application will automatically stop. Defaults to `15` minutes.
+
+### initial_capacity Arguments
+
+* `initial_capacity_config` - (Optional) The initial capacity configuration per worker.
+* `initial_capacity_type` - (Required) The worker type for an analytics framework. For Spark applications, the key can either be set to `Driver` or `Executor`. For Hive applications, it can be set to `HiveDriver` or `TezTask`.
+
+### maximum_capacity Arguments
+
+* `cpu` - (Required) The maximum allowed CPU for an application.
+* `disk` - (Optional) The maximum allowed disk for an application.
+* `memory` - (Required) The maximum allowed resources for an application.
+
+### network_configuration Arguments
+
+* `security_group_ids` - (Optional) The array of security group Ids for customer VPC connectivity.
+* `subnet_ids` - (Optional) The array of subnet Ids for customer VPC connectivity.
+
+#### image_configuration Arguments
+
+* `image_uri` - (Required) The image URI.
+
+#### initial_capacity_config Arguments
+
+* `worker_configuration` - (Optional) The resource configuration of the initial capacity configuration.
+* `worker_count` - (Required) The number of workers in the initial capacity configuration.
+
+##### worker_configuration Arguments
+
+* `cpu` - (Required) The CPU requirements for every worker instance of the worker type.
+* `disk` - (Optional) The disk requirements for every worker instance of the worker type.
+* `memory` - (Required) The memory requirements for every worker instance of the worker type.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the cluster.
+* `id` - The ID of the cluster.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EMR Severless applications using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import EMR Severless applications using the `id`. For example:
+
+```console
+% terraform import aws_emrserverless_application.example id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-e44c01cb3d0245a04c0ae76333390d6e8ad9c201d82a7409ec4c28eab63c55d0 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/evidently_feature.html.markdown b/website/docs/cdktf/python/r/evidently_feature.html.markdown
new file mode 100644
index 00000000000..2aa274c6a4b
--- /dev/null
+++ b/website/docs/cdktf/python/r/evidently_feature.html.markdown
@@ -0,0 +1,225 @@
+---
+subcategory: "CloudWatch Evidently"
+layout: "aws"
+page_title: "AWS: aws_evidently_feature"
+description: |-
+  Provides a CloudWatch Evidently Feature resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_evidently_feature
+
+Provides a CloudWatch Evidently Feature resource.
+
+## Example Usage
+
+### Basic
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.evidently_feature import EvidentlyFeature
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        EvidentlyFeature(self, "example",
+            description="example description",
+            name="example",
+            project=Token.as_string(aws_evidently_project_example.name),
+            tags={
+                "Key1": "example Feature"
+            },
+            variations=[EvidentlyFeatureVariations(
+                name="Variation1",
+                value=EvidentlyFeatureVariationsValue(
+                    string_value="example"
+                )
+            )
+            ]
+        )
+```
+
+### With default variation
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.evidently_feature import EvidentlyFeature
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        EvidentlyFeature(self, "example",
+            default_variation="Variation2",
+            name="example",
+            project=Token.as_string(aws_evidently_project_example.name),
+            variations=[EvidentlyFeatureVariations(
+                name="Variation1",
+                value=EvidentlyFeatureVariationsValue(
+                    string_value="exampleval1"
+                )
+            ), EvidentlyFeatureVariations(
+                name="Variation2",
+                value=EvidentlyFeatureVariationsValue(
+                    string_value="exampleval2"
+                )
+            )
+            ]
+        )
+```
+
+### With entity overrides
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.evidently_feature import EvidentlyFeature
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        EvidentlyFeature(self, "example",
+            entity_overrides={
+                "test1": "Variation1"
+            },
+            name="example",
+            project=Token.as_string(aws_evidently_project_example.name),
+            variations=[EvidentlyFeatureVariations(
+                name="Variation1",
+                value=EvidentlyFeatureVariationsValue(
+                    string_value="exampleval1"
+                )
+            ), EvidentlyFeatureVariations(
+                name="Variation2",
+                value=EvidentlyFeatureVariationsValue(
+                    string_value="exampleval2"
+                )
+            )
+            ]
+        )
+```
+
+### With evaluation strategy
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.evidently_feature import EvidentlyFeature
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        EvidentlyFeature(self, "example",
+            entity_overrides={
+                "test1": "Variation1"
+            },
+            evaluation_strategy="ALL_RULES",
+            name="example",
+            project=Token.as_string(aws_evidently_project_example.name),
+            variations=[EvidentlyFeatureVariations(
+                name="Variation1",
+                value=EvidentlyFeatureVariationsValue(
+                    string_value="exampleval1"
+                )
+            )
+            ]
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `default_variation` - (Optional) The name of the variation to use as the default variation. The default variation is served to users who are not allocated to any ongoing launches or experiments of this feature. This variation must also be listed in the `variations` structure. If you omit `default_variation`, the first variation listed in the `variations` structure is used as the default variation.
+* `description` - (Optional) Specifies the description of the feature.
+* `entity_overrides` - (Optional) Specify users that should always be served a specific variation of a feature. Each user is specified by a key-value pair . For each key, specify a user by entering their user ID, account ID, or some other identifier. For the value, specify the name of the variation that they are to be served.
+* `evaluation_strategy` - (Optional) Specify `ALL_RULES` to activate the traffic allocation specified by any ongoing launches or experiments. Specify `DEFAULT_VARIATION` to serve the default variation to all users instead.
+* `name` - (Required) The name for the new feature. Minimum length of `1`. Maximum length of `127`.
+* `project` - (Required) The name or ARN of the project that is to contain the new feature.
+* `tags` - (Optional) Tags to apply to the feature. If configured with a provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `variations` - (Required) One or more blocks that contain the configuration of the feature's different variations. [Detailed below](#variations)
+
+### `variations`
+
+The `variations` block supports the following arguments:
+
+* `name` - (Required) The name of the variation. Minimum length of `1`. Maximum length of `127`.
+* `value` - (Required) A block that specifies the value assigned to this variation. [Detailed below](#value)
+
+#### `value`
+
+The `value` block supports the following arguments:
+
+~> **NOTE:** You must specify exactly one of `bool_value`, `double_value`, `long_value`, `string_value`.
+
+* `bool_value` - (Optional) If this feature uses the Boolean variation type, this field contains the Boolean value of this variation.
+* `double_value` - (Optional) If this feature uses the double integer variation type, this field contains the double integer value of this variation.
+* `long_value` - (Optional) If this feature uses the long variation type, this field contains the long value of this variation. Minimum value of `-9007199254740991`. Maximum value of `9007199254740991`.
+* `string_value` - (Optional) If this feature uses the string variation type, this field contains the string value of this variation. Minimum length of `0`. Maximum length of `512`.
+
+## Timeouts
+
+[Configuration options](https://www.terraform.io/docs/configuration/blocks/resources/syntax.html#operation-timeouts):
+
+* `create` - (Default `2m`)
+* `delete` - (Default `2m`)
+* `update` - (Default `2m`)
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the feature.
+* `created_time` - The date and time that the feature is created.
+* `evaluation_rules` - One or more blocks that define the evaluation rules for the feature. [Detailed below](#evaluation_rules)
+* `id` - The feature `name` and the project `name` or `arn` separated by a colon (`:`).
+* `last_updated_time` - The date and time that the feature was most recently updated.
+* `status` - The current state of the feature. Valid values are `AVAILABLE` and `UPDATING`.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block).
+* `value_type` - Defines the type of value used to define the different feature variations. Valid Values: `STRING`, `LONG`, `DOUBLE`, `BOOLEAN`.
+
+### `evaluation_rules`
+
+The `evaluation_rules` block supports the following attributes:
+
+* `name` - The name of the experiment or launch.
+* `type` - This value is `aws.evidently.splits` if this is an evaluation rule for a launch, and it is `aws.evidently.onlineab` if this is an evaluation rule for an experiment.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudWatch Evidently Feature using the feature `name` and `name` or `arn` of the hosting CloudWatch Evidently Project separated by a `:`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import CloudWatch Evidently Feature using the feature `name` and `name` or `arn` of the hosting CloudWatch Evidently Project separated by a `:`. For example:
+
+```console
+% terraform import aws_evidently_feature.example exampleFeatureName:arn:aws:evidently:us-east-1:123456789012:project/example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-d3315398a5d858c2584803f038f31f451feb575e340aad72583ed89839e493c9 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/evidently_launch.html.markdown b/website/docs/cdktf/python/r/evidently_launch.html.markdown
new file mode 100644
index 00000000000..5c27b974448
--- /dev/null
+++ b/website/docs/cdktf/python/r/evidently_launch.html.markdown
@@ -0,0 +1,447 @@
+---
+subcategory: "CloudWatch Evidently"
+layout: "aws"
+page_title: "AWS: aws_evidently_launch"
+description: |-
+  Provides a CloudWatch Evidently Launch resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_evidently_launch
+
+Provides a CloudWatch Evidently Launch resource.
+
+## Example Usage
+
+### Basic
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.evidently_launch import EvidentlyLaunch
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        EvidentlyLaunch(self, "example",
+            groups=[EvidentlyLaunchGroups(
+                feature=Token.as_string(aws_evidently_feature_example.name),
+                name="Variation1",
+                variation="Variation1"
+            )
+            ],
+            name="example",
+            project=Token.as_string(aws_evidently_project_example.name),
+            scheduled_splits_config=EvidentlyLaunchScheduledSplitsConfig(
+                steps=[EvidentlyLaunchScheduledSplitsConfigSteps(
+                    group_weights={
+                        "Variation1": 0
+                    },
+                    start_time="2024-01-07 01:43:59+00:00"
+                )
+                ]
+            )
+        )
+```
+
+### With description
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.evidently_launch import EvidentlyLaunch
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        EvidentlyLaunch(self, "example",
+            description="example description",
+            groups=[EvidentlyLaunchGroups(
+                feature=Token.as_string(aws_evidently_feature_example.name),
+                name="Variation1",
+                variation="Variation1"
+            )
+            ],
+            name="example",
+            project=Token.as_string(aws_evidently_project_example.name),
+            scheduled_splits_config=EvidentlyLaunchScheduledSplitsConfig(
+                steps=[EvidentlyLaunchScheduledSplitsConfigSteps(
+                    group_weights={
+                        "Variation1": 0
+                    },
+                    start_time="2024-01-07 01:43:59+00:00"
+                )
+                ]
+            )
+        )
+```
+
+### With multiple groups
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.evidently_launch import EvidentlyLaunch
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        EvidentlyLaunch(self, "example",
+            groups=[EvidentlyLaunchGroups(
+                description="first-group",
+                feature=Token.as_string(aws_evidently_feature_example.name),
+                name="Variation1",
+                variation="Variation1"
+            ), EvidentlyLaunchGroups(
+                description="second-group",
+                feature=Token.as_string(aws_evidently_feature_example.name),
+                name="Variation2",
+                variation="Variation2"
+            )
+            ],
+            name="example",
+            project=Token.as_string(aws_evidently_project_example.name),
+            scheduled_splits_config=EvidentlyLaunchScheduledSplitsConfig(
+                steps=[EvidentlyLaunchScheduledSplitsConfigSteps(
+                    group_weights={
+                        "Variation1": 0,
+                        "Variation2": 0
+                    },
+                    start_time="2024-01-07 01:43:59+00:00"
+                )
+                ]
+            )
+        )
+```
+
+### With metric_monitors
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.evidently_launch import EvidentlyLaunch
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        EvidentlyLaunch(self, "example",
+            groups=[EvidentlyLaunchGroups(
+                feature=Token.as_string(aws_evidently_feature_example.name),
+                name="Variation1",
+                variation="Variation1"
+            )
+            ],
+            metric_monitors=[EvidentlyLaunchMetricMonitors(
+                metric_definition=EvidentlyLaunchMetricMonitorsMetricDefinition(
+                    entity_id_key="entity_id_key1",
+                    event_pattern="{\\\"Price\\\":[{\\\"numeric\\\":[\\\">\\\",11,\\\"<=\\\",22]}]}",
+                    name="name1",
+                    unit_label="unit_label1",
+                    value_key="value_key1"
+                )
+            ), EvidentlyLaunchMetricMonitors(
+                metric_definition=EvidentlyLaunchMetricMonitorsMetricDefinition(
+                    entity_id_key="entity_id_key2",
+                    event_pattern="{\\\"Price\\\":[{\\\"numeric\\\":[\\\">\\\",9,\\\"<=\\\",19]}]}",
+                    name="name2",
+                    unit_label="unit_label2",
+                    value_key="value_key2"
+                )
+            )
+            ],
+            name="example",
+            project=Token.as_string(aws_evidently_project_example.name),
+            scheduled_splits_config=EvidentlyLaunchScheduledSplitsConfig(
+                steps=[EvidentlyLaunchScheduledSplitsConfigSteps(
+                    group_weights={
+                        "Variation1": 0
+                    },
+                    start_time="2024-01-07 01:43:59+00:00"
+                )
+                ]
+            )
+        )
+```
+
+### With randomization_salt
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.evidently_launch import EvidentlyLaunch
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        EvidentlyLaunch(self, "example",
+            groups=[EvidentlyLaunchGroups(
+                feature=Token.as_string(aws_evidently_feature_example.name),
+                name="Variation1",
+                variation="Variation1"
+            )
+            ],
+            name="example",
+            project=Token.as_string(aws_evidently_project_example.name),
+            randomization_salt="example randomization salt",
+            scheduled_splits_config=EvidentlyLaunchScheduledSplitsConfig(
+                steps=[EvidentlyLaunchScheduledSplitsConfigSteps(
+                    group_weights={
+                        "Variation1": 0
+                    },
+                    start_time="2024-01-07 01:43:59+00:00"
+                )
+                ]
+            )
+        )
+```
+
+### With multiple steps
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.evidently_launch import EvidentlyLaunch
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        EvidentlyLaunch(self, "example",
+            groups=[EvidentlyLaunchGroups(
+                feature=Token.as_string(aws_evidently_feature_example.name),
+                name="Variation1",
+                variation="Variation1"
+            ), EvidentlyLaunchGroups(
+                feature=Token.as_string(aws_evidently_feature_example.name),
+                name="Variation2",
+                variation="Variation2"
+            )
+            ],
+            name="example",
+            project=Token.as_string(aws_evidently_project_example.name),
+            scheduled_splits_config=EvidentlyLaunchScheduledSplitsConfig(
+                steps=[EvidentlyLaunchScheduledSplitsConfigSteps(
+                    group_weights={
+                        "Variation1": 15,
+                        "Variation2": 10
+                    },
+                    start_time="2024-01-07 01:43:59+00:00"
+                ), EvidentlyLaunchScheduledSplitsConfigSteps(
+                    group_weights={
+                        "Variation1": 20,
+                        "Variation2": 25
+                    },
+                    start_time="2024-01-08 01:43:59+00:00"
+                )
+                ]
+            )
+        )
+```
+
+### With segment overrides
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.evidently_launch import EvidentlyLaunch
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        EvidentlyLaunch(self, "example",
+            groups=[EvidentlyLaunchGroups(
+                feature=Token.as_string(aws_evidently_feature_example.name),
+                name="Variation1",
+                variation="Variation1"
+            ), EvidentlyLaunchGroups(
+                feature=Token.as_string(aws_evidently_feature_example.name),
+                name="Variation2",
+                variation="Variation2"
+            )
+            ],
+            name="example",
+            project=Token.as_string(aws_evidently_project_example.name),
+            scheduled_splits_config=EvidentlyLaunchScheduledSplitsConfig(
+                steps=[EvidentlyLaunchScheduledSplitsConfigSteps(
+                    group_weights={
+                        "Variation1": 0,
+                        "Variation2": 0
+                    },
+                    segment_overrides=[EvidentlyLaunchScheduledSplitsConfigStepsSegmentOverrides(
+                        evaluation_order=1,
+                        segment=Token.as_string(aws_evidently_segment_example.name),
+                        weights={
+                            "Variation2": 10000
+                        }
+                    ), EvidentlyLaunchScheduledSplitsConfigStepsSegmentOverrides(
+                        evaluation_order=2,
+                        segment=Token.as_string(aws_evidently_segment_example.name),
+                        weights={
+                            "Variation1": 40000,
+                            "Variation2": 30000
+                        }
+                    )
+                    ],
+                    start_time="2024-01-08 01:43:59+00:00"
+                )
+                ]
+            )
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `description` - (Optional) Specifies the description of the launch.
+* `groups` - (Required) One or up to five blocks that contain the feature and variations that are to be used for the launch. [Detailed below](#groups).
+* `metric_monitors` - (Optional) One or up to three blocks that define the metrics that will be used to monitor the launch performance. [Detailed below](#metric_monitors).
+* `name` - (Required) The name for the new launch. Minimum length of `1`. Maximum length of `127`.
+* `project` - (Required) The name or ARN of the project that is to contain the new launch.
+* `randomization_salt` - (Optional) When Evidently assigns a particular user session to a launch, it must use a randomization ID to determine which variation the user session is served. This randomization ID is a combination of the entity ID and randomizationSalt. If you omit randomizationSalt, Evidently uses the launch name as the randomizationSalt.
+* `scheduled_splits_config` - (Optional) A block that defines the traffic allocation percentages among the feature variations during each step of the launch. [Detailed below](#scheduled_splits_config).
+* `tags` - (Optional) Tags to apply to the launch. If configured with a provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### `groups`
+
+The `groups` block supports the following arguments:
+
+* `description` - (Optional) Specifies the description of the launch group.
+* `feature` - (Required) Specifies the name of the feature that the launch is using.
+* `name` - (Required) Specifies the name of the lahnch group.
+* `variation` - (Required) Specifies the feature variation to use for this launch group.
+
+### `metric_monitors`
+
+The `metric_monitors` block supports the following arguments:
+
+* `metric_definition` - (Required) A block that defines the metric. [Detailed below](#metric_definition).
+
+#### `metric_definition`
+
+The `metric_definition` block supports the following arguments:
+
+* `entity_id_key` - (Required) Specifies the entity, such as a user or session, that does an action that causes a metric value to be recorded. An example is `userDetails.userID`.
+* `event_pattern` - (Required) Specifies The EventBridge event pattern that defines how the metric is recorded.
+* `name` - (Required) Specifies the name for the metric.
+* `unit_label` - (Optional) Specifies a label for the units that the metric is measuring.
+* `value_key` - (Required) Specifies the value that is tracked to produce the metric.
+
+### `scheduled_splits_config`
+
+The `scheduled_splits_config` block supports the following arguments:
+
+* `steps` - (Required) One or up to six blocks that define the traffic allocation percentages among the feature variations during each step of the launch. This also defines the start time of each step. [Detailed below](#steps).
+
+#### `steps`
+
+The `steps` block supports the following arguments:
+
+* `group_weights` - (Required) The traffic allocation percentages among the feature variations during one step of a launch. This is a set of key-value pairs. The keys are variation names. The values represent the percentage of traffic to allocate to that variation during this step. For more information, refer to the [AWS documentation for ScheduledSplitConfig groupWeights](https://docs.aws.amazon.com/cloudwatchevidently/latest/APIReference/API_ScheduledSplitConfig.html).
+* `segment_overrides` - (Required) One or up to six blocks that specify different traffic splits for one or more audience segments. A segment is a portion of your audience that share one or more characteristics. Examples could be Chrome browser users, users in Europe, or Firefox browser users in Europe who also fit other criteria that your application collects, such as age. [Detailed below](#segment_overrides).
+* `start_time` - (Required) Specifies the date and time that this step of the launch starts.
+
+##### `segment_overrides`
+
+* `evaluation_order` - (Required) Specifies a number indicating the order to use to evaluate segment overrides, if there are more than one. Segment overrides with lower numbers are evaluated first.
+* `segment` - (Required) The name or ARN of the segment to use.
+* `weights` - (Required) The traffic allocation percentages among the feature variations to assign to this segment. This is a set of key-value pairs. The keys are variation names. The values represent the amount of traffic to allocate to that variation for this segment. This is expressed in thousandths of a percent, so a weight of 50000 represents 50% of traffic.
+
+## Timeouts
+
+[Configuration options](https://www.terraform.io/docs/configuration/blocks/resources/syntax.html#operation-timeouts):
+
+* `create` - (Default `2m`)
+* `delete` - (Default `2m`)
+* `update` - (Default `2m`)
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the launch.
+* `created_time` - The date and time that the launch is created.
+* `execution` - A block that contains information about the start and end times of the launch. [Detailed below](#execution)
+* `id` - The launch `name` and the project `name` or `arn` separated by a colon (`:`).
+* `last_updated_time` - The date and time that the launch was most recently updated.
+* `status` - The current state of the launch. Valid values are `CREATED`, `UPDATING`, `RUNNING`, `COMPLETED`, and `CANCELLED`.
+* `status_reason` - If the launch was stopped, this is the string that was entered by the person who stopped the launch, to explain why it was stopped.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block).
+* `type` - The type of launch.
+
+### `execution`
+
+The `execution` block supports the following attributes:
+
+* `ended_time` - The date and time that the launch ended.
+* `started_time` - The date and time that the launch started.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudWatch Evidently Launch using the `name` of the launch and `name` of the project or `arn` of the hosting CloudWatch Evidently Project separated by a `:`. For example:
+
+Import using the `name` of the launch and `name` of the project separated by a `:`:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Import using the `name` of the launch and `arn` of the project separated by a `:`:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+**Using `terraform import` to import** CloudWatch Evidently Launch using the `name` of the launch and `name` of the project or `arn` of the hosting CloudWatch Evidently Project separated by a `:`. For example:
+
+Import using the `name` of the launch and `name` of the project separated by a `:`:
+
+```console
+% terraform import aws_evidently_launch.example exampleLaunchName:exampleProjectName
+```
+
+Import using the `name` of the launch and `arn` of the project separated by a `:`:
+
+```console
+% terraform import aws_evidently_launch.example exampleLaunchName:arn:aws:evidently:us-east-1:123456789012:project/exampleProjectName
+```
+
+<!-- cache-key: cdktf-0.18.0 input-aae11bd8a9c8b5e230e84e3f211fbabba6612255938e01ceece5ed580fbee328 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/evidently_project.html.markdown b/website/docs/cdktf/python/r/evidently_project.html.markdown
new file mode 100644
index 00000000000..42b06f68975
--- /dev/null
+++ b/website/docs/cdktf/python/r/evidently_project.html.markdown
@@ -0,0 +1,165 @@
+---
+subcategory: "CloudWatch Evidently"
+layout: "aws"
+page_title: "AWS: aws_evidently_project"
+description: |-
+  Provides a CloudWatch Evidently Project resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_evidently_project
+
+Provides a CloudWatch Evidently Project resource.
+
+## Example Usage
+
+### Basic
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.evidently_project import EvidentlyProject
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        EvidentlyProject(self, "example",
+            description="Example Description",
+            name="Example",
+            tags={
+                "Key1": "example Project"
+            }
+        )
+```
+
+### Store evaluation events in a CloudWatch Log Group
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.evidently_project import EvidentlyProject
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        EvidentlyProject(self, "example",
+            data_delivery=EvidentlyProjectDataDelivery(
+                cloudwatch_logs=EvidentlyProjectDataDeliveryCloudwatchLogs(
+                    log_group="example-log-group-name"
+                )
+            ),
+            description="Example Description",
+            name="Example",
+            tags={
+                "Key1": "example Project"
+            }
+        )
+```
+
+### Store evaluation events in an S3 bucket
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.evidently_project import EvidentlyProject
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        EvidentlyProject(self, "example",
+            data_delivery=EvidentlyProjectDataDelivery(
+                s3_destination=EvidentlyProjectDataDeliveryS3Destination(
+                    bucket="example-bucket-name",
+                    prefix="example"
+                )
+            ),
+            description="Example Description",
+            name="Example",
+            tags={
+                "Key1": "example Project"
+            }
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `data_delivery` - (Optional) A block that contains information about where Evidently is to store evaluation events for longer term storage, if you choose to do so. If you choose not to store these events, Evidently deletes them after using them to produce metrics and other experiment results that you can view. See below.
+* `description` - (Optional) Specifies the description of the project.
+* `name` - (Required) A name for the project.
+* `tags` - (Optional) Tags to apply to the project. If configured with a provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+The `data_delivery` block supports the following arguments:
+
+~> **NOTE:** You can't specify both `cloudwatch_logs` and `s3_destination`.
+
+* `cloudwatch_logs` - (Optional) A block that defines the CloudWatch Log Group that stores the evaluation events. See below.
+* `s3_destination` - (Optional) A block that defines the S3 bucket and prefix that stores the evaluation events. See below.
+
+The `cloudwatch_logs` block supports the following arguments:
+
+* `log_group` - (Optional) The name of the log group where the project stores evaluation events.
+
+The `s3_destination` block supports the following arguments:
+
+* `bucket` - (Optional) The name of the bucket in which Evidently stores evaluation events.
+* `prefix` - (Optional) The bucket prefix in which Evidently stores evaluation events.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `2m`)
+* `delete` - (Default `2m`)
+* `update` - (Default `2m`)
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `active_experiment_count` - The number of ongoing experiments currently in the project.
+* `active_launch_count` - The number of ongoing launches currently in the project.
+* `arn` - The ARN of the project.
+* `created_time` - The date and time that the project is created.
+* `experiment_count` - The number of experiments currently in the project. This includes all experiments that have been created and not deleted, whether they are ongoing or not.
+* `feature_count` - The number of features currently in the project.
+* `id` - The ID has the same value as the arn of the project.
+* `last_updated_time` - The date and time that the project was most recently updated.
+* `launch_count` - The number of launches currently in the project. This includes all launches that have been created and not deleted, whether they are ongoing or not.
+* `status` - The current state of the project. Valid values are `AVAILABLE` and `UPDATING`.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudWatch Evidently Project using the `arn`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import CloudWatch Evidently Project using the `arn`. For example:
+
+```console
+% terraform import aws_evidently_project.example arn:aws:evidently:us-east-1:123456789012:segment/example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-98108c26628ca8c5832f4e1d0f90d72906605975ec0417106000b17f811ac230 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/evidently_segment.html.markdown b/website/docs/cdktf/python/r/evidently_segment.html.markdown
new file mode 100644
index 00000000000..20b1613b414
--- /dev/null
+++ b/website/docs/cdktf/python/r/evidently_segment.html.markdown
@@ -0,0 +1,124 @@
+---
+subcategory: "CloudWatch Evidently"
+layout: "aws"
+page_title: "AWS: aws_evidently_segment"
+description: |-
+  Provides a CloudWatch Evidently Segment resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_evidently_segment
+
+Provides a CloudWatch Evidently Segment resource.
+
+## Example Usage
+
+### Basic
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.evidently_segment import EvidentlySegment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        EvidentlySegment(self, "example",
+            name="example",
+            pattern="{\\\"Price\\\":[{\\\"numeric\\\":[\\\">\\\",10,\\\"<=\\\",20]}]}",
+            tags={
+                "Key1": "example Segment"
+            }
+        )
+```
+
+### With JSON object in pattern
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.evidently_segment import EvidentlySegment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        EvidentlySegment(self, "example",
+            name="example",
+            pattern="  {\n    \"Price\": [\n      {\n        \"numeric\": [\">\",10,\"<=\",20]\n      }\n    ]\n  }\n\n",
+            tags={
+                "Key1": "example Segment"
+            }
+        )
+```
+
+### With Description
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.evidently_segment import EvidentlySegment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        EvidentlySegment(self, "example",
+            description="example",
+            name="example",
+            pattern="{\\\"Price\\\":[{\\\"numeric\\\":[\\\">\\\",10,\\\"<=\\\",20]}]}"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `description` - (Optional, Forces new resource) Specifies the description of the segment.
+* `name` - (Required, Forces new resource) A name for the segment.
+* `pattern` - (Required, Forces new resource) The pattern to use for the segment. For more information about pattern syntax, see [Segment rule pattern syntax](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-Evidently-segments.html#CloudWatch-Evidently-segments-syntax.html).
+* `tags` - (Optional) Tags to apply to the segment. If configured with a provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the segment.
+* `created_time` - The date and time that the segment is created.
+* `experiment_count` - The number of experiments that this segment is used in. This count includes all current experiments, not just those that are currently running.
+* `id` - The ID has the same value as the ARN of the segment.
+* `last_updated_time` - The date and time that this segment was most recently updated.
+* `launch_count` - The number of launches that this segment is used in. This count includes all current launches, not just those that are currently running.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudWatch Evidently Segment using the `arn`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import CloudWatch Evidently Segment using the `arn`. For example:
+
+```console
+% terraform import aws_evidently_segment.example arn:aws:evidently:us-west-2:123456789012:segment/example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-8f4f148ae07fcc5e61c1f38f8166eb6097494f8e5ccee4064e248569af124d84 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/finspace_kx_cluster.html.markdown b/website/docs/cdktf/python/r/finspace_kx_cluster.html.markdown
new file mode 100644
index 00000000000..cebe97d7a8f
--- /dev/null
+++ b/website/docs/cdktf/python/r/finspace_kx_cluster.html.markdown
@@ -0,0 +1,214 @@
+---
+subcategory: "FinSpace"
+layout: "aws"
+page_title: "AWS: aws_finspace_kx_cluster"
+description: |-
+  Terraform resource for managing an AWS FinSpace Kx Cluster.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_finspace_kx_cluster
+
+Terraform resource for managing an AWS FinSpace Kx Cluster.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.finspace_kx_cluster import FinspaceKxCluster
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        FinspaceKxCluster(self, "example",
+            availability_zone_id="use1-az2",
+            az_mode="SINGLE",
+            cache_storage_configurations=[FinspaceKxClusterCacheStorageConfigurations(
+                size=1200,
+                type="CACHE_1000"
+            )
+            ],
+            capacity_configuration=FinspaceKxClusterCapacityConfiguration(
+                node_count=2,
+                node_type="kx.s.2xlarge"
+            ),
+            code=FinspaceKxClusterCode(
+                s3_bucket=test.id,
+                s3_key=object.key
+            ),
+            database=[FinspaceKxClusterDatabase(
+                cache_configuration=[{
+                    "cache_type": "CACHE_1000",
+                    "db_paths": "/"
+                }
+                ],
+                database_name=Token.as_string(aws_finspace_kx_database_example.name)
+            )
+            ],
+            environment_id=Token.as_string(aws_finspace_kx_environment_example.id),
+            name="my-tf-kx-cluster",
+            release_label="1.0",
+            type="HDB",
+            vpc_configuration=FinspaceKxClusterVpcConfiguration(
+                ip_address_type="IP_V4",
+                security_group_ids=[Token.as_string(aws_security_group_example.id)],
+                subnet_ids=[Token.as_string(aws_subnet_example.id)],
+                vpc_id=Token.as_string(aws_vpc_test.id)
+            )
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `az_mode` - (Required) The number of availability zones you want to assign per cluster. This can be one of the following:
+    * SINGLE - Assigns one availability zone per cluster.
+    * MULTI - Assigns all the availability zones per cluster.
+* `capacity_configuration` - (Required) Structure for the metadata of a cluster. Includes information like the CPUs needed, memory of instances, and number of instances. See [capacity_configuration](#capacity_configuration).
+* `environment_id` - (Required) Unique identifier for the KX environment.
+* `name` - (Required) Unique name for the cluster that you want to create.
+* `release_label` - (Required) Version of FinSpace Managed kdb to run.
+* `type` - (Required) Type of KDB database. The following types are available:
+    * HDB - Historical Database. The data is only accessible with read-only permissions from one of the FinSpace managed KX databases mounted to the cluster.
+    * RDB - Realtime Database. This type of database captures all the data from a ticker plant and stores it in memory until the end of day, after which it writes all of its data to a disk and reloads the HDB. This cluster type requires local storage for temporary storage of data during the savedown process. If you specify this field in your request, you must provide the `savedownStorageConfiguration` parameter.
+    * GATEWAY - A gateway cluster allows you to access data across processes in kdb systems. It allows you to create your own routing logic using the initialization scripts and custom code. This type of cluster does not require a  writable local storage.
+* `vpc_configuration` - (Required) Configuration details about the network where the Privatelink endpoint of the cluster resides. See [vpc_configuration](#vpc_configuration).
+
+The following arguments are optional:
+
+* `auto_scaling_configuration` - (Optional) Configuration based on which FinSpace will scale in or scale out nodes in your cluster. See [auto_scaling_configuration](#auto_scaling_configuration).
+* `availability_zone_id` - (Optional) The availability zone identifiers for the requested regions. Required when `az_mode` is set to SINGLE.
+* `cache_storage_configurations` - (Optional) Configurations for a read only cache storage associated with a cluster. This cache will be stored as an FSx Lustre that reads from the S3 store. See [cache_storage_configuration](#cache_storage_configuration).
+* `code` - (Optional) Details of the custom code that you want to use inside a cluster when analyzing data. Consists of the S3 source bucket, location, object version, and the relative path from where the custom code is loaded into the cluster. See [code](#code).
+* `command_line_arguments` - (Optional) List of key-value pairs to make available inside the cluster.
+* `database` - (Optional) KX database that will be available for querying. Defined below.
+* `description` - (Optional) Description of the cluster.
+* `execution_role` - (Optional) An IAM role that defines a set of permissions associated with a cluster. These permissions are assumed when a cluster attempts to access another cluster.
+* `initialization_script` - (Optional) Path to Q program that will be run at launch of a cluster. This is a relative path within .zip file that contains the custom code, which will be loaded on the cluster. It must include the file name itself. For example, somedir/init.q.
+* `savedown_storage_configuration` - (Optional) Size and type of the temporary storage that is used to hold data during the savedown process. This parameter is required when you choose `type` as RDB. All the data written to this storage space is lost when the cluster node is restarted. See [savedown_storage_configuration](#savedown_storage_configuration).
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### auto_scaling_configuration
+
+The auto_scaling_configuration block supports the following arguments:
+
+* `auto_scaling_metric` - (Required) Metric your cluster will track in order to scale in and out. For example, CPU_UTILIZATION_PERCENTAGE is the average CPU usage across all nodes in a cluster.
+* `min_node_count` - (Required) Lowest number of nodes to scale. Must be at least 1 and less than the `max_node_count`. If nodes in cluster belong to multiple availability zones, then `min_node_count` must be at least 3.
+* `max_node_count` - (Required) Highest number of nodes to scale. Cannot be greater than 5
+* `metric_target` - (Required) Desired value of chosen `auto_scaling_metric`. When metric drops below this value, cluster will scale in. When metric goes above this value, cluster will scale out. Can be set between 0 and 100 percent.
+* `scale_in_cooldown_seconds` - (Required) Duration in seconds that FinSpace will wait after a scale in event before initiating another scaling event.
+* `scale_out_cooldown_seconds` - (Required) Duration in seconds that FinSpace will wait after a scale out event before initiating another scaling event.
+
+### capacity_configuration
+
+The capacity_configuration block supports the following arguments:
+
+* `node_type` - (Required) Determines the hardware of the host computer used for your cluster instance. Each node type offers different memory and storage capabilities. Choose a node type based on the requirements of the application or software that you plan to run on your instance.
+  
+  You can only specify one of the following values:
+    * kx.s.large – The node type with a configuration of 12 GiB memory and 2 vCPUs.
+    * kx.s.xlarge – The node type with a configuration of 27 GiB memory and 4 vCPUs.
+    * kx.s.2xlarge – The node type with a configuration of 54 GiB memory and 8 vCPUs.
+    * kx.s.4xlarge – The node type with a configuration of 108 GiB memory and 16 vCPUs.
+    * kx.s.8xlarge – The node type with a configuration of 216 GiB memory and 32 vCPUs.
+    * kx.s.16xlarge – The node type with a configuration of 432 GiB memory and 64 vCPUs.
+    * kx.s.32xlarge – The node type with a configuration of 864 GiB memory and 128 vCPUs.
+* `node_count` - (Required) Number of instances running in a cluster. Must be at least 1 and at most 5.
+
+### cache_storage_configuration
+
+The cache_storage_configuration block supports the following arguments:
+
+* `type` - (Required) Type of cache storage . The valid values are:
+    * CACHE_1000 - This type provides 1000 MB/s disk access throughput.
+    * CACHE_250 - This type provides 250 MB/s disk access throughput.
+    * CACHE_12 - This type provides 12 MB/s disk access throughput.
+* `size` - (Required) Size of cache in Gigabytes.
+
+### code
+
+The code block supports the following arguments:
+
+* `s3_bucket` - (Required) Unique name for the S3 bucket.
+* `s3_key` - (Required) Full S3 path (excluding bucket) to the .zip file that contains the code to be loaded onto the cluster when it’s started.
+* `s3_object_version` - (Optional) Version of an S3 Object.
+
+### database
+
+The database block supports the following arguments:
+
+* `database_name` - (Required) Name of the KX database.
+* `cache_configurations` - (Optional) Configuration details for the disk cache to increase performance reading from a KX database mounted to the cluster. See [cache_configurations](#cache_configurations).
+* `changeset_id` - (Optional) A unique identifier of the changeset that is associated with the cluster.
+
+#### cache_configurations
+
+The cache_configuration block supports the following arguments:
+
+* `cache_type` - (Required) Type of disk cache.
+* `db_paths` - (Optional) Paths within the database to cache.
+
+### savedown_storage_configuration
+
+The savedown_storage_configuration block supports the following arguments:
+
+* `type` - (Required) Type of writeable storage space for temporarily storing your savedown data. The valid values are:
+    * SDS01 - This type represents 3000 IOPS and io2 ebs volume type.
+* `size` - (Required) Size of temporary storage in gigabytes. Must be between 10 and 16000.
+
+### vpc_configuration
+
+The vpc_configuration block supports the following arguments:
+
+* `vpc_id` - (Required) Identifier of the VPC endpoint
+* `security_group_ids` - (Required) Unique identifier of the VPC security group applied to the VPC endpoint ENI for the cluster.
+* `subnet_ids `- (Required) Identifier of the subnet that the Privatelink VPC endpoint uses to connect to the cluster.
+* `ip_address_type` - (Required) IP address type for cluster network configuration parameters. The following type is available: IP_V4 - IP address version 4.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) identifier of the KX cluster.
+* `created_timestamp` - Timestamp at which the cluster is created in FinSpace. Value determined as epoch time in seconds. For example, the value for Monday, November 1, 2021 12:00:00 PM UTC is specified as 1635768000.
+* `id` - A comma-delimited string joining environment ID and cluster name.
+* `last_modified_timestamp` - Last timestamp at which the cluster was updated in FinSpace. Value determined as epoch time in seconds. For example, the value for Monday, November 1, 2021 12:00:00 PM UTC is specified as 1635768000.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `45m`)
+* `update` - (Default `2m`)
+* `delete` - (Default `60m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import an AWS FinSpace Kx Cluster using the `id` (environment ID and cluster name, comma-delimited). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import an AWS FinSpace Kx Cluster using the `id` (environment ID and cluster name, comma-delimited). For example:
+
+```console
+% terraform import aws_finspace_kx_cluster.example n3ceo7wqxoxcti5tujqwzs,my-tf-kx-cluster
+```
+
+<!-- cache-key: cdktf-0.18.0 input-fc12ddc3549a8a0db45ead2f8a186a8a85e440b7a6cea4031c22a41e5b9963bc -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/finspace_kx_database.html.markdown b/website/docs/cdktf/python/r/finspace_kx_database.html.markdown
new file mode 100644
index 00000000000..6954b3130e3
--- /dev/null
+++ b/website/docs/cdktf/python/r/finspace_kx_database.html.markdown
@@ -0,0 +1,101 @@
+---
+subcategory: "FinSpace"
+layout: "aws"
+page_title: "AWS: aws_finspace_kx_database"
+description: |-
+  Terraform resource for managing an AWS FinSpace Kx Database.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_finspace_kx_database
+
+Terraform resource for managing an AWS FinSpace Kx Database.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.finspace_kx_database import FinspaceKxDatabase
+from imports.aws.finspace_kx_environment import FinspaceKxEnvironment
+from imports.aws.kms_key import KmsKey
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = KmsKey(self, "example",
+            deletion_window_in_days=7,
+            description="Example KMS Key"
+        )
+        aws_finspace_kx_environment_example = FinspaceKxEnvironment(self, "example_1",
+            kms_key_id=example.arn,
+            name="my-tf-kx-environment"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_finspace_kx_environment_example.override_logical_id("example")
+        aws_finspace_kx_database_example = FinspaceKxDatabase(self, "example_2",
+            description="Example database description",
+            environment_id=Token.as_string(aws_finspace_kx_environment_example.id),
+            name="my-tf-kx-database"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_finspace_kx_database_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `environment_id` - (Required) Unique identifier for the KX environment.
+* `name` - (Required) Name of the KX database.
+
+The following arguments are optional:
+
+* `description` - (Optional) Description of the KX database.
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) identifier of the KX database.
+* `created_timestamp` - Timestamp at which the databse is created in FinSpace. Value determined as epoch time in seconds. For example, the value for Monday, November 1, 2021 12:00:00 PM UTC is specified as 1635768000.
+* `id` - A comma-delimited string joining environment ID and database name.
+* `last_modified_timestamp` - Last timestamp at which the database was updated in FinSpace. Value determined as epoch time in seconds. For example, the value for Monday, November 1, 2021 12:00:00 PM UTC is specified as 1635768000.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `30m`)
+* `update` - (Default `30m`)
+* `delete` - (Default `30m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import an AWS FinSpace Kx Database using the `id` (environment ID and database name, comma-delimited). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import an AWS FinSpace Kx Database using the `id` (environment ID and database name, comma-delimited). For example:
+
+```console
+% terraform import aws_finspace_kx_database.example n3ceo7wqxoxcti5tujqwzs,my-tf-kx-database
+```
+
+<!-- cache-key: cdktf-0.18.0 input-d4510cf871c3b574384323c384811db1afe4695931c813e1e9e6fb86b9433a73 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/finspace_kx_environment.html.markdown b/website/docs/cdktf/python/r/finspace_kx_environment.html.markdown
new file mode 100644
index 00000000000..0f592395144
--- /dev/null
+++ b/website/docs/cdktf/python/r/finspace_kx_environment.html.markdown
@@ -0,0 +1,237 @@
+---
+subcategory: "FinSpace"
+layout: "aws"
+page_title: "AWS: aws_finspace_kx_environment"
+description: |-
+  Terraform resource for managing an AWS FinSpace Kx Environment.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_finspace_kx_environment
+
+Terraform resource for managing an AWS FinSpace Kx Environment.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.finspace_kx_environment import FinspaceKxEnvironment
+from imports.aws.kms_key import KmsKey
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = KmsKey(self, "example",
+            deletion_window_in_days=7,
+            description="Sample KMS Key"
+        )
+        aws_finspace_kx_environment_example = FinspaceKxEnvironment(self, "example_1",
+            kms_key_id=example.arn,
+            name="my-tf-kx-environment"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_finspace_kx_environment_example.override_logical_id("example")
+```
+
+### With Transit Gateway Configuration
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ec2_transit_gateway import Ec2TransitGateway
+from imports.aws.finspace_kx_environment import FinspaceKxEnvironment
+from imports.aws.kms_key import KmsKey
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = Ec2TransitGateway(self, "example",
+            description="example"
+        )
+        aws_kms_key_example = KmsKey(self, "example_1",
+            deletion_window_in_days=7,
+            description="Sample KMS Key"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_kms_key_example.override_logical_id("example")
+        FinspaceKxEnvironment(self, "example_env",
+            custom_dns_configuration=[FinspaceKxEnvironmentCustomDnsConfiguration(
+                custom_dns_server_ip="10.0.0.76",
+                custom_dns_server_name="example.finspace.amazonaws.com"
+            )
+            ],
+            description="Environment description",
+            kms_key_id=Token.as_string(aws_kms_key_example.arn),
+            name="my-tf-kx-environment",
+            transit_gateway_configuration=FinspaceKxEnvironmentTransitGatewayConfiguration(
+                routable_cidr_space="100.64.0.0/26",
+                transit_gateway_id=example.id
+            )
+        )
+```
+
+### With Transit Gateway Attachment Network ACL Configuration
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Op, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ec2_transit_gateway import Ec2TransitGateway
+from imports.aws.finspace_kx_environment import FinspaceKxEnvironment
+from imports.aws.kms_key import KmsKey
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = Ec2TransitGateway(self, "example",
+            description="example"
+        )
+        aws_kms_key_example = KmsKey(self, "example_1",
+            deletion_window_in_days=7,
+            description="Sample KMS Key"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_kms_key_example.override_logical_id("example")
+        FinspaceKxEnvironment(self, "example_env",
+            custom_dns_configuration=[FinspaceKxEnvironmentCustomDnsConfiguration(
+                custom_dns_server_ip="10.0.0.76",
+                custom_dns_server_name="example.finspace.amazonaws.com"
+            )
+            ],
+            description="Environment description",
+            kms_key_id=Token.as_string(aws_kms_key_example.arn),
+            name="my-tf-kx-environment",
+            transit_gateway_configuration=FinspaceKxEnvironmentTransitGatewayConfiguration(
+                attachment_network_acl_configuration=[FinspaceKxEnvironmentTransitGatewayConfigurationAttachmentNetworkAclConfiguration(
+                    cidr_block="0.0.0.0/0",
+                    icmp_type_code=FinspaceKxEnvironmentTransitGatewayConfigurationAttachmentNetworkAclConfigurationIcmpTypeCode(
+                        code=Token.as_number(Op.negate(1)),
+                        type=Token.as_number(Op.negate(1))
+                    ),
+                    port_range=FinspaceKxEnvironmentTransitGatewayConfigurationAttachmentNetworkAclConfigurationPortRange(
+                        from=53,
+                        to=53
+                    ),
+                    protocol="6",
+                    rule_action="allow",
+                    rule_number=1
+                )
+                ],
+                routable_cidr_space="100.64.0.0/26",
+                transit_gateway_id=example.id
+            )
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) Name of the KX environment that you want to create.
+* `kms_key_id` - (Required) KMS key ID to encrypt your data in the FinSpace environment.
+
+The following arguments are optional:
+
+* `custom_dns_configuration` - (Optional) List of DNS server name and server IP. This is used to set up Route-53 outbound resolvers. Defined below.
+* `description` - (Optional) Description for the KX environment.
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `transit_gateway_configuration` - (Optional) Transit gateway and network configuration that is used to connect the KX environment to an internal network. Defined below.
+
+### custom_dns_configuration
+
+The custom_dns_configuration block supports the following arguments:
+
+* `custom_dns_server_ip` - (Required) IP address of the DNS server.
+* `custom_dns_server_name` - (Required) Name of the DNS server.
+
+### transit_gateway_configuration
+
+The transit_gateway_configuration block supports the following arguments:
+
+* `routable_cidr_space` - (Required) Routing CIDR on behalf of KX environment. It could be any “/26 range in the 100.64.0.0 CIDR space. After providing, it will be added to the customer’s transit gateway routing table so that the traffics could be routed to KX network.
+* `transit_gateway_id` - (Required) Identifier of the transit gateway created by the customer to connect outbound traffics from KX network to your internal network.
+* `attachment_network_acl_configuration` - (Optional) Rules that define how you manage outbound traffic from kdb network to your internal network. Defined below.
+
+### attachment_network_acl_configuration
+
+The network access control list (ACL) is an optional layer of security for VPCs that acts as a firewall for controlling traffic in and out of one or more subnets.
+The entry is a set of numbered ingress and egress rules that determine whether a packet should be allowed in or out of a subnet associated with the ACL.
+Entries in the ACL are processed according to the rule numbers, in ascending order. The `attachment_network_acl_configuration` block supports the following arguments:
+
+* `cidr_block` - (Required) The IPv4 network range to allow or deny, in CIDR notation. The specified CIDR block is modified to its canonical form. For example, `100.68.0.18/18` will be converted to `100.68.0.0/18`.
+* `protocol` - (Required) Protocol number. A value of `1` means all the protocols.
+* `rule_action` - (Required) Indicates whether to `allow` or `deny` the traffic that matches the rule.
+* `rule_number` - (Required) Rule number for the entry. All the network ACL entries are processed in ascending order by rule number.
+* `icmp_type_code` - (Optional) Defines the ICMP protocol that consists of the ICMP type and code. Defined below.
+* `port_range` - (Optional) Range of ports the rule applies to. Defined below.
+
+### port_range
+
+The range of ports the rule applies to (between `0` and `65535`). The `port_range` block supports the following arguments:
+
+* `from` - (Required) First port in the range.
+* `to` - (Required) Last port in the range.
+
+### icmp_type_code
+
+Defines the ICMP protocol that consists of the ICMP type and code. The `icmp_type_code` block supports the following arguments:
+
+* `code` - (Required) ICMP code. A value of `-1` means all codes for the specified ICMP type.
+* `type` - (Required) ICMP type. A value of `-1` means all types.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) identifier of the KX environment.
+* `availability_zones` - AWS Availability Zone IDs that this environment is available in. Important when selecting VPC subnets to use in cluster creation.
+* `created_timestamp` - Timestamp at which the environment is created in FinSpace. Value determined as epoch time in seconds. For example, the value for Monday, November 1, 2021 12:00:00 PM UTC is specified as 1635768000.
+* `id` - Unique identifier for the KX environment.
+* `infrastructure_account_id` - Unique identifier for the AWS environment infrastructure account.
+* `last_modified_timestamp` - Last timestamp at which the environment was updated in FinSpace. Value determined as epoch time in seconds. For example, the value for Monday, November 1, 2021 12:00:00 PM UTC is specified as 1635768000.
+* `status` - Status of environment creation
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `30m`)
+* `update` - (Default `30m`)
+* `delete` - (Default `45m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import an AWS FinSpace Kx Environment using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import an AWS FinSpace Kx Environment using the `id`. For example:
+
+```console
+% terraform import aws_finspace_kx_environment.example n3ceo7wqxoxcti5tujqwzs
+```
+
+<!-- cache-key: cdktf-0.18.0 input-66ff5897d5ab2c91b6931ad3c3dac3ade7477821d5c997374b18bd09ac1f1dd9 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/finspace_kx_user.html.markdown b/website/docs/cdktf/python/r/finspace_kx_user.html.markdown
new file mode 100644
index 00000000000..1cb079b5968
--- /dev/null
+++ b/website/docs/cdktf/python/r/finspace_kx_user.html.markdown
@@ -0,0 +1,118 @@
+---
+subcategory: "FinSpace"
+layout: "aws"
+page_title: "AWS: aws_finspace_kx_user"
+description: |-
+  Terraform resource for managing an AWS FinSpace Kx User.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_finspace_kx_user
+
+Terraform resource for managing an AWS FinSpace Kx User.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.finspace_kx_environment import FinspaceKxEnvironment
+from imports.aws.finspace_kx_user import FinspaceKxUser
+from imports.aws.iam_role import IamRole
+from imports.aws.kms_key import KmsKey
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = IamRole(self, "example",
+            assume_role_policy=Token.as_string(
+                Fn.jsonencode({
+                    "Statement": [{
+                        "Action": "sts:AssumeRole",
+                        "Effect": "Allow",
+                        "Principal": {
+                            "Service": "ec2.amazonaws.com"
+                        },
+                        "Sid": ""
+                    }
+                    ],
+                    "Version": "2012-10-17"
+                })),
+            name="example-role"
+        )
+        aws_kms_key_example = KmsKey(self, "example_1",
+            deletion_window_in_days=7,
+            description="Example KMS Key"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_kms_key_example.override_logical_id("example")
+        aws_finspace_kx_environment_example = FinspaceKxEnvironment(self, "example_2",
+            kms_key_id=Token.as_string(aws_kms_key_example.arn),
+            name="my-tf-kx-environment"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_finspace_kx_environment_example.override_logical_id("example")
+        aws_finspace_kx_user_example = FinspaceKxUser(self, "example_3",
+            environment_id=Token.as_string(aws_finspace_kx_environment_example.id),
+            iam_role=example.arn,
+            name="my-tf-kx-user"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_finspace_kx_user_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) A unique identifier for the user.
+* `environment_id` - (Required) Unique identifier for the KX environment.
+* `iam_role` - (Required) IAM role ARN to be associated with the user.
+
+The following arguments are optional:
+
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) identifier of the KX user.
+* `id` - A comma-delimited string joining environment ID and user name.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `30m`)
+* `update` - (Default `30m`)
+* `delete` - (Default `30m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import an AWS FinSpace Kx User using the `id` (environment ID and user name, comma-delimited). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import an AWS FinSpace Kx User using the `id` (environment ID and user name, comma-delimited). For example:
+
+```console
+% terraform import aws_finspace_kx_user.example n3ceo7wqxoxcti5tujqwzs,my-tf-kx-user
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ca0c383fee51cd83230b9fbdc20cbdd865bb1f5eb6633d7d2d1fa7bea216bcb4 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/fis_experiment_template.html.markdown b/website/docs/cdktf/python/r/fis_experiment_template.html.markdown
new file mode 100644
index 00000000000..a6129528852
--- /dev/null
+++ b/website/docs/cdktf/python/r/fis_experiment_template.html.markdown
@@ -0,0 +1,168 @@
+---
+subcategory: "FIS (Fault Injection Simulator)"
+layout: "aws"
+page_title: "AWS: aws_fis_experiment_template"
+description: |-
+  Provides an FIS Experiment Template.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_fis_experiment_template
+
+Provides an FIS Experiment Template, which can be used to run an experiment.
+An experiment template contains one or more actions to run on specified targets during an experiment.
+It also contains the stop conditions that prevent the experiment from going out of bounds.
+See [Amazon Fault Injection Simulator](https://docs.aws.amazon.com/fis/index.html)
+for more information.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.fis_experiment_template import FisExperimentTemplate
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        FisExperimentTemplate(self, "example",
+            action=[FisExperimentTemplateAction(
+                action_id="aws:ec2:terminate-instances",
+                name="example-action",
+                target=FisExperimentTemplateActionTarget(
+                    key="Instances",
+                    value="example-target"
+                )
+            )
+            ],
+            description="example",
+            role_arn=Token.as_string(aws_iam_role_example.arn),
+            stop_condition=[FisExperimentTemplateStopCondition(
+                source="none"
+            )
+            ],
+            target=[FisExperimentTemplateTarget(
+                name="example-target",
+                resource_tag=[FisExperimentTemplateTargetResourceTag(
+                    key="env",
+                    value="example"
+                )
+                ],
+                resource_type="aws:ec2:instance",
+                selection_mode="COUNT(1)"
+            )
+            ]
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `action` - (Required) Action to be performed during an experiment. See below.
+* `description` - (Required) Description for the experiment template.
+* `role_arn` - (Required) ARN of an IAM role that grants the AWS FIS service permission to perform service actions on your behalf.
+* `stop_condition` - (Required) When an ongoing experiment should be stopped. See below.
+
+The following arguments are optional:
+
+* `tags` - (Optional) Key-value mapping of tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `target` - (Optional) Target of an action. See below.
+* `log_configuration` - (Optional) The configuration for experiment logging. See below.
+
+### `action`
+
+* `action_id` - (Required) ID of the action. To find out what actions are supported see [AWS FIS actions reference](https://docs.aws.amazon.com/fis/latest/userguide/fis-actions-reference.html).
+* `name` - (Required) Friendly name of the action.
+* `description` - (Optional) Description of the action.
+* `parameter` - (Optional) Parameter(s) for the action, if applicable. See below.
+* `start_after` - (Optional) Set of action names that must complete before this action can be executed.
+* `target` - (Optional) Action's target, if applicable. See below.
+
+#### `parameter`
+
+* `key` - (Required) Parameter name.
+* `value` - (Required) Parameter value.
+
+For a list of parameters supported by each action, see [AWS FIS actions reference](https://docs.aws.amazon.com/fis/latest/userguide/fis-actions-reference.html).
+
+#### `target` (`action.*.target`)
+
+* `key` - (Required) Target type. Valid values are `Cluster` (EKS Cluster), `Clusters` (ECS Clusters), `DBInstances` (RDS DB Instances), `Instances` (EC2 Instances), `Nodegroups` (EKS Node groups), `Roles` (IAM Roles), `SpotInstances` (EC2 Spot Instances), `Subnets` (VPC Subnets), `Volumes` (EBS Volumes) , `Pods` (EKS Pods), `Tasks` (ECS Tasks). See the [documentation](https://docs.aws.amazon.com/fis/latest/userguide/actions.html#action-targets) for more details.
+* `value` - (Required) Target name, referencing a corresponding target.
+
+### `stop_condition`
+
+* `source` - (Required) Source of the condition. One of `none`, `aws:cloudwatch:alarm`.
+* `value` - (Optional) ARN of the CloudWatch alarm. Required if the source is a CloudWatch alarm.
+
+### `target`
+
+* `name` - (Required) Friendly name given to the target.
+* `resource_type` - (Required) AWS resource type. The resource type must be supported for the specified action. To find out what resource types are supported, see [Targets for AWS FIS](https://docs.aws.amazon.com/fis/latest/userguide/targets.html#resource-types).
+* `selection_mode` - (Required) Scopes the identified resources. Valid values are `ALL` (all identified resources), `COUNT(n)` (randomly select `n` of the identified resources), `PERCENT(n)` (randomly select `n` percent of the identified resources).
+* `filter` - (Optional) Filter(s) for the target. Filters can be used to select resources based on specific attributes returned by the respective describe action of the resource type. For more information, see [Targets for AWS FIS](https://docs.aws.amazon.com/fis/latest/userguide/targets.html#target-filters). See below.
+* `resource_arns` - (Optional) Set of ARNs of the resources to target with an action. Conflicts with `resource_tag`.
+* `resource_tag` - (Optional) Tag(s) the resources need to have to be considered a valid target for an action. Conflicts with `resource_arns`. See below.
+* `parameters` - (Optional) The resource type parameters.
+
+~> **NOTE:** The `target` configuration block requires either `resource_arns` or `resource_tag`.
+
+#### `filter`
+
+* `path` - (Required) Attribute path for the filter.
+* `values` - (Required) Set of attribute values for the filter.
+
+~> **NOTE:** Values specified in a `filter` are joined with an `OR` clause, while values across multiple `filter` blocks are joined with an `AND` clause. For more information, see [Targets for AWS FIS](https://docs.aws.amazon.com/fis/latest/userguide/targets.html#target-filters).
+
+#### `resource_tag`
+
+* `key` - (Required) Tag key.
+* `value` - (Required) Tag value.
+
+### `log_configuration`
+
+* `log_schema_version` - (Required) The schema version. See [documentation](https://docs.aws.amazon.com/fis/latest/userguide/monitoring-logging.html#experiment-log-schema) for the list of schema versions.
+* `cloudwatch_logs_configuration` - (Optional) The configuration for experiment logging to Amazon CloudWatch Logs. See below.
+* `s3_configuration` - (Optional) The configuration for experiment logging to Amazon S3. See below.
+
+#### `cloudwatch_logs_configuration`
+
+* `log_group_arn` - (Required) The Amazon Resource Name (ARN) of the destination Amazon CloudWatch Logs log group.
+
+#### `s3_configuration`
+
+* `bucket_name` - (Required) The name of the destination bucket.
+* `prefix` - (Optional) The bucket prefix.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Experiment Template ID.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import FIS Experiment Templates using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import FIS Experiment Templates using the `id`. For example:
+
+```console
+% terraform import aws_fis_experiment_template.template EXT123AbCdEfGhIjK
+```
+
+<!-- cache-key: cdktf-0.18.0 input-6f86f6051a01d559c0189ce9cb6d94bc035f6fe628c05e2f0aba1d5a3f86e00b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/flow_log.html.markdown b/website/docs/cdktf/python/r/flow_log.html.markdown
new file mode 100644
index 00000000000..9758240a9ee
--- /dev/null
+++ b/website/docs/cdktf/python/r/flow_log.html.markdown
@@ -0,0 +1,291 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_flow_log"
+description: |-
+  Provides a VPC/Subnet/ENI Flow Log
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_flow_log
+
+Provides a VPC/Subnet/ENI/Transit Gateway/Transit Gateway Attachment Flow Log to capture IP traffic for a specific network
+interface, subnet, or VPC. Logs are sent to a CloudWatch Log Group, a S3 Bucket, or Amazon Kinesis Data Firehose
+
+## Example Usage
+
+### CloudWatch Logging
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudwatch_log_group import CloudwatchLogGroup
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.flow_log import FlowLog
+from imports.aws.iam_role import IamRole
+from imports.aws.iam_role_policy import IamRolePolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = CloudwatchLogGroup(self, "example",
+            name="example"
+        )
+        assume_role = DataAwsIamPolicyDocument(self, "assume_role",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["sts:AssumeRole"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["vpc-flow-logs.amazonaws.com"],
+                    type="Service"
+                )
+                ]
+            )
+            ]
+        )
+        data_aws_iam_policy_document_example = DataAwsIamPolicyDocument(self, "example_2",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogGroups", "logs:DescribeLogStreams"
+                ],
+                effect="Allow",
+                resources=["*"]
+            )
+            ]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_iam_policy_document_example.override_logical_id("example")
+        aws_iam_role_example = IamRole(self, "example_3",
+            assume_role_policy=Token.as_string(assume_role.json),
+            name="example"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_role_example.override_logical_id("example")
+        aws_iam_role_policy_example = IamRolePolicy(self, "example_4",
+            name="example",
+            policy=Token.as_string(data_aws_iam_policy_document_example.json),
+            role=Token.as_string(aws_iam_role_example.id)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_role_policy_example.override_logical_id("example")
+        aws_flow_log_example = FlowLog(self, "example_5",
+            iam_role_arn=Token.as_string(aws_iam_role_example.arn),
+            log_destination=example.arn,
+            traffic_type="ALL",
+            vpc_id=Token.as_string(aws_vpc_example.id)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_flow_log_example.override_logical_id("example")
+```
+
+### Amazon Kinesis Data Firehose logging
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.flow_log import FlowLog
+from imports.aws.iam_role import IamRole
+from imports.aws.iam_role_policy import IamRolePolicy
+from imports.aws.kinesis_firehose_delivery_stream import KinesisFirehoseDeliveryStream
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_acl import S3BucketAcl
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = S3Bucket(self, "example",
+            bucket="example"
+        )
+        aws_s3_bucket_acl_example = S3BucketAcl(self, "example_1",
+            acl="private",
+            bucket=example.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_acl_example.override_logical_id("example")
+        assume_role = DataAwsIamPolicyDocument(self, "assume_role",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["sts:AssumeRole"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["firehose.amazonaws.com"],
+                    type="Service"
+                )
+                ]
+            )
+            ]
+        )
+        data_aws_iam_policy_document_example = DataAwsIamPolicyDocument(self, "example_3",
+            actions=["logs:CreateLogDelivery", "logs:DeleteLogDelivery", "logs:ListLogDeliveries", "logs:GetLogDelivery", "firehose:TagDeliveryStream"
+            ],
+            effect="Allow",
+            resources=["*"]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_iam_policy_document_example.override_logical_id("example")
+        aws_iam_role_example = IamRole(self, "example_4",
+            assume_role_policy=Token.as_string(assume_role.json),
+            name="firehose_test_role"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_role_example.override_logical_id("example")
+        aws_iam_role_policy_example = IamRolePolicy(self, "example_5",
+            name="test",
+            policy=Token.as_string(data_aws_iam_policy_document_example.json),
+            role=Token.as_string(aws_iam_role_example.id)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_role_policy_example.override_logical_id("example")
+        aws_kinesis_firehose_delivery_stream_example =
+        KinesisFirehoseDeliveryStream(self, "example_6",
+            destination="extended_s3",
+            extended_s3_configuration=KinesisFirehoseDeliveryStreamExtendedS3Configuration(
+                bucket_arn=example.arn,
+                role_arn=Token.as_string(aws_iam_role_example.arn)
+            ),
+            name="kinesis_firehose_test",
+            tags={
+                "LogDeliveryEnabled": "true"
+            }
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_kinesis_firehose_delivery_stream_example.override_logical_id("example")
+        aws_flow_log_example = FlowLog(self, "example_7",
+            log_destination=Token.as_string(aws_kinesis_firehose_delivery_stream_example.arn),
+            log_destination_type="kinesis-data-firehose",
+            traffic_type="ALL",
+            vpc_id=Token.as_string(aws_vpc_example.id)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_flow_log_example.override_logical_id("example")
+```
+
+### S3 Logging
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.flow_log import FlowLog
+from imports.aws.s3_bucket import S3Bucket
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = S3Bucket(self, "example",
+            bucket="example"
+        )
+        aws_flow_log_example = FlowLog(self, "example_1",
+            log_destination=example.arn,
+            log_destination_type="s3",
+            traffic_type="ALL",
+            vpc_id=Token.as_string(aws_vpc_example.id)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_flow_log_example.override_logical_id("example")
+```
+
+### S3 Logging in Apache Parquet format with per-hour partitions
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.flow_log import FlowLog
+from imports.aws.s3_bucket import S3Bucket
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = S3Bucket(self, "example",
+            bucket="example"
+        )
+        aws_flow_log_example = FlowLog(self, "example_1",
+            destination_options=FlowLogDestinationOptions(
+                file_format="parquet",
+                per_hour_partition=True
+            ),
+            log_destination=example.arn,
+            log_destination_type="s3",
+            traffic_type="ALL",
+            vpc_id=Token.as_string(aws_vpc_example.id)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_flow_log_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+~> **NOTE:** One of `eni_id`, `subnet_id`, `transit_gateway_id`, `transit_gateway_attachment_id`, or `vpc_id` must be specified.
+
+This argument supports the following arguments:
+
+* `traffic_type` - (Required) The type of traffic to capture. Valid values: `ACCEPT`,`REJECT`, `ALL`.
+* `deliver_cross_account_role` - (Optional) ARN of the IAM role that allows Amazon EC2 to publish flow logs across accounts.
+* `eni_id` - (Optional) Elastic Network Interface ID to attach to
+* `iam_role_arn` - (Optional) The ARN for the IAM role that's used to post flow logs to a CloudWatch Logs log group
+* `log_destination_type` - (Optional) The type of the logging destination. Valid values: `cloud-watch-logs`, `s3`, `kinesis-data-firehose`. Default: `cloud-watch-logs`.
+* `log_destination` - (Optional) The ARN of the logging destination. Either `log_destination` or `log_group_name` must be set.
+* `log_group_name` - (Optional) **Deprecated:** Use `log_destination` instead. The name of the CloudWatch log group. Either `log_group_name` or `log_destination` must be set.
+* `subnet_id` - (Optional) Subnet ID to attach to
+* `transit_gateway_id` - (Optional) Transit Gateway ID to attach to
+* `transit_gateway_attachment_id` - (Optional) Transit Gateway Attachment ID to attach to
+* `vpc_id` - (Optional) VPC ID to attach to
+* `log_format` - (Optional) The fields to include in the flow log record, in the order in which they should appear.
+* `max_aggregation_interval` - (Optional) The maximum interval of time
+  during which a flow of packets is captured and aggregated into a flow
+  log record. Valid Values: `60` seconds (1 minute) or `600` seconds (10
+  minutes). Default: `600`. When `transit_gateway_id` or `transit_gateway_attachment_id` is specified, `max_aggregation_interval` *must* be 60 seconds (1 minute).
+* `destination_options` - (Optional) Describes the destination options for a flow log. More details below.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### destination_options
+
+Describes the destination options for a flow log.
+
+* `file_format` - (Optional) The format for the flow log. Default value: `plain-text`. Valid values: `plain-text`, `parquet`.
+* `hive_compatible_partitions` - (Optional) Indicates whether to use Hive-compatible prefixes for flow logs stored in Amazon S3. Default value: `false`.
+* `per_hour_partition` - (Optional) Indicates whether to partition the flow log per hour. This reduces the cost and response time for queries. Default value: `false`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Flow Log ID
+* `arn` - The ARN of the Flow Log.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Flow Logs using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Flow Logs using the `id`. For example:
+
+```console
+% terraform import aws_flow_log.test_flow_log fl-1a2b3c4d
+```
+
+<!-- cache-key: cdktf-0.18.0 input-379eebee0faf6ddc6b72192ea7791d99a401f706aaa6660a39aa2f4709546656 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/fms_admin_account.html.markdown b/website/docs/cdktf/python/r/fms_admin_account.html.markdown
new file mode 100644
index 00000000000..07df6485c6f
--- /dev/null
+++ b/website/docs/cdktf/python/r/fms_admin_account.html.markdown
@@ -0,0 +1,70 @@
+---
+subcategory: "FMS (Firewall Manager)"
+layout: "aws"
+page_title: "AWS: aws_fms_admin_account"
+description: |-
+  Provides a resource to associate/disassociate an AWS Firewall Manager administrator account
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_fms_admin_account
+
+Provides a resource to associate/disassociate an AWS Firewall Manager administrator account. This operation must be performed in the `us-east-1` region.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.fms_admin_account import FmsAdminAccount
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        FmsAdminAccount(self, "example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `account_id` - (Optional) The AWS account ID to associate with AWS Firewall Manager as the AWS Firewall Manager administrator account. This can be an AWS Organizations master account or a member account. Defaults to the current account. Must be configured to perform drift detection.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The AWS account ID of the AWS Firewall Manager administrator account.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `30m`)
+- `delete` - (Default `10m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Firewall Manager administrator account association using the account ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Firewall Manager administrator account association using the account ID. For example:
+
+```console
+% terraform import aws_fms_admin_account.example 123456789012
+```
+
+<!-- cache-key: cdktf-0.18.0 input-9887cf15245a4b734a6b9de0582fbcd635a6b8d70933e7656427281a76b59b6c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/fms_policy.html.markdown b/website/docs/cdktf/python/r/fms_policy.html.markdown
new file mode 100644
index 00000000000..4f99bc53afd
--- /dev/null
+++ b/website/docs/cdktf/python/r/fms_policy.html.markdown
@@ -0,0 +1,145 @@
+---
+subcategory: "FMS (Firewall Manager)"
+layout: "aws"
+page_title: "AWS: aws_fms_policy"
+description: |-
+  Provides a resource to create an AWS Firewall Manager policy
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_fms_policy
+
+Provides a resource to create an AWS Firewall Manager policy. You need to be using AWS organizations and have enabled the Firewall Manager administrator account.
+
+~> **NOTE:** Due to limitations with testing, we provide it as best effort. If you find it useful, and have the ability to help test or notice issues, consider reaching out to us on [GitHub](https://github.com/hashicorp/terraform-provider-aws).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.fms_policy import FmsPolicy
+from imports.aws.wafregional_rule_group import WafregionalRuleGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = WafregionalRuleGroup(self, "example",
+            metric_name="WAFRuleGroupExample",
+            name="WAF-Rule-Group-Example"
+        )
+        aws_fms_policy_example = FmsPolicy(self, "example_1",
+            exclude_resource_tags=False,
+            name="FMS-Policy-Example",
+            remediation_enabled=False,
+            resource_type="AWS::ElasticLoadBalancingV2::LoadBalancer",
+            security_service_policy_data=FmsPolicySecurityServicePolicyData(
+                managed_service_data=Token.as_string(
+                    Fn.jsonencode({
+                        "default_action": {
+                            "type": "BLOCK"
+                        },
+                        "override_customer_web_aCLAssociation": False,
+                        "rule_groups": [{
+                            "id": example.id,
+                            "override_action": {
+                                "type": "COUNT"
+                            }
+                        }
+                        ],
+                        "type": "WAF"
+                    })),
+                type="WAF"
+            ),
+            tags={
+                "Name": "example-fms-policy"
+            }
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_fms_policy_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required, Forces new resource) The friendly name of the AWS Firewall Manager Policy.
+* `delete_all_policy_resources` - (Optional) If true, the request will also perform a clean-up process. Defaults to `true`. More information can be found here [AWS Firewall Manager delete policy](https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_DeletePolicy.html)
+* `delete_unused_fm_managed_resources` - (Optional) If true, Firewall Manager will automatically remove protections from resources that leave the policy scope. Defaults to `false`. More information can be found here [AWS Firewall Manager policy contents](https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_Policy.html)
+* `description` - (Optional) The description of the AWS Network Firewall firewall policy.
+* `exclude_map` - (Optional) A map of lists of accounts and OU's to exclude from the policy.
+* `exclude_resource_tags` - (Required, Forces new resource) A boolean value, if true the tags that are specified in the `resource_tags` are not protected by this policy. If set to false and resource_tags are populated, resources that contain tags will be protected by this policy.
+* `include_map` - (Optional) A map of lists of accounts and OU's to include in the policy.
+* `remediation_enabled` - (Required) A boolean value, indicates if the policy should automatically applied to resources that already exist in the account.
+* `resource_tags` - (Optional) A map of resource tags, that if present will filter protections on resources based on the exclude_resource_tags.
+* `resource_type` - (Optional) A resource type to protect. Conflicts with `resource_type_list`. See the [FMS API Reference](https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_Policy.html#fms-Type-Policy-ResourceType) for more information about supported values.
+* `resource_type_list` - (Optional) A list of resource types to protect. Conflicts with `resource_type`. See the [FMS API Reference](https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_Policy.html#fms-Type-Policy-ResourceType) for more information about supported values. Lists with only one element are not supported, instead use `resource_type`.
+* `security_service_policy_data` - (Required) The objects to include in Security Service Policy Data. Documented below.
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## `exclude_map` Configuration Block
+
+* `account` - (Optional) A list of AWS Organization member Accounts that you want to exclude from this AWS FMS Policy.
+* `orgunit` - (Optional) A list of IDs of the AWS Organizational Units that you want to exclude from this AWS FMS Policy. Specifying an OU is the equivalent of specifying all accounts in the OU and in any of its child OUs, including any child OUs and accounts that are added at a later time.
+
+You can specify inclusions or exclusions, but not both. If you specify an `include_map`, AWS Firewall Manager applies the policy to all accounts specified by the `include_map`, and does not evaluate any `exclude_map` specifications. If you do not specify an `include_map`, then Firewall Manager applies the policy to all accounts except for those specified by the `exclude_map`.
+
+## `include_map` Configuration Block
+
+* `account` - (Optional) A list of AWS Organization member Accounts that you want to include for this AWS FMS Policy.
+* `orgunit` - (Optional) A list of IDs of the AWS Organizational Units that you want to include for this AWS FMS Policy. Specifying an OU is the equivalent of specifying all accounts in the OU and in any of its child OUs, including any child OUs and accounts that are added at a later time.
+
+You can specify inclusions or exclusions, but not both. If you specify an `include_map`, AWS Firewall Manager applies the policy to all accounts specified by the `include_map`, and does not evaluate any `exclude_map` specifications. If you do not specify an `include_map`, then Firewall Manager applies the policy to all accounts except for those specified by the `exclude_map`.
+
+## `security_service_policy_data` Configuration Block
+
+* `managed_service_data` - (Optional) Details about the service that are specific to the service type, in JSON format. For service type `SHIELD_ADVANCED`, this is an empty string. Examples depending on `type` can be found in the [AWS Firewall Manager SecurityServicePolicyData API Reference](https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_SecurityServicePolicyData.html).
+* `policy_option` - (Optional) Contains the Network Firewall firewall policy options to configure a centralized deployment model. Documented below.
+* `type` - (Required, Forces new resource) The service that the policy is using to protect the resources. For the current list of supported types, please refer to the [AWS Firewall Manager SecurityServicePolicyData API Type Reference](https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_SecurityServicePolicyData.html#fms-Type-SecurityServicePolicyData-Type).
+
+## `policy_option` Configuration Block
+
+* `network_firewall_policy` - (Optional) Defines the deployment model to use for the firewall policy. Documented below.
+* `thirdparty_firewall_policy` - (Optional) Defines the policy options for a third-party firewall policy. Documented below.
+
+## `network_firewall_policy` Configuration Block
+
+* `firewall_deployment_model` - (Optional) Defines the deployment model to use for the firewall policy. To use a distributed model, remove the `policy_option` section. Valid values are `CENTRALIZED` and `DISTRIBUTED`.
+
+## `thirdparty_firewall_policy` Configuration Block
+
+* `firewall_deployment_model` - (Optional) Defines the deployment model to use for the third-party firewall policy. Valid values are `CENTRALIZED` and `DISTRIBUTED`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The AWS account ID of the AWS Firewall Manager administrator account.
+* `policy_update_token` - A unique identifier for each update to the policy.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Firewall Manager policies using the policy ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Firewall Manager policies using the policy ID. For example:
+
+```console
+% terraform import aws_fms_policy.example 5be49585-a7e3-4c49-dde1-a179fe4a619a
+```
+
+<!-- cache-key: cdktf-0.18.0 input-0ae1df390d47241169d44152adee2f18fc2ef166fb2e999418b584927f81b7b3 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/fsx_backup.html.markdown b/website/docs/cdktf/python/r/fsx_backup.html.markdown
new file mode 100644
index 00000000000..584cf0cc300
--- /dev/null
+++ b/website/docs/cdktf/python/r/fsx_backup.html.markdown
@@ -0,0 +1,178 @@
+---
+subcategory: "FSx"
+layout: "aws"
+page_title: "AWS: aws_fsx_backup"
+description: |-
+  Manages a FSx Backup.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_fsx_backup
+
+Provides a FSx Backup resource.
+
+## Example Usage
+
+## Lustre Example
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.fsx_backup import FsxBackup
+from imports.aws.fsx_lustre_file_system import FsxLustreFileSystem
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = FsxLustreFileSystem(self, "example",
+            deployment_type="PERSISTENT_1",
+            per_unit_storage_throughput=50,
+            storage_capacity=1200,
+            subnet_ids=[Token.as_string(aws_subnet_example.id)]
+        )
+        aws_fsx_backup_example = FsxBackup(self, "example_1",
+            file_system_id=example.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_fsx_backup_example.override_logical_id("example")
+```
+
+## Windows Example
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.fsx_backup import FsxBackup
+from imports.aws.fsx_windows_file_system import FsxWindowsFileSystem
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = FsxWindowsFileSystem(self, "example",
+            active_directory_id=eample.id,
+            skip_final_backup=True,
+            storage_capacity=32,
+            subnet_ids=[example1.id],
+            throughput_capacity=8
+        )
+        aws_fsx_backup_example = FsxBackup(self, "example_1",
+            file_system_id=example.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_fsx_backup_example.override_logical_id("example")
+```
+
+## ONTAP Example
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.fsx_backup import FsxBackup
+from imports.aws.fsx_ontap_volume import FsxOntapVolume
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = FsxOntapVolume(self, "example",
+            junction_path="/example",
+            name="example",
+            size_in_megabytes=1024,
+            storage_efficiency_enabled=True,
+            storage_virtual_machine_id=test.id
+        )
+        aws_fsx_backup_example = FsxBackup(self, "example_1",
+            volume_id=example.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_fsx_backup_example.override_logical_id("example")
+```
+
+## OpenZFS Example
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.fsx_backup import FsxBackup
+from imports.aws.fsx_openzfs_file_system import FsxOpenzfsFileSystem
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = FsxOpenzfsFileSystem(self, "example",
+            deployment_type="SINGLE_AZ_1",
+            storage_capacity=64,
+            subnet_ids=[Token.as_string(aws_subnet_example.id)],
+            throughput_capacity=64
+        )
+        aws_fsx_backup_example = FsxBackup(self, "example_1",
+            file_system_id=example.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_fsx_backup_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+Note - Only file_system_id or volume_id can be specified. file_system_id is used for Lustre and Windows, volume_id is used for ONTAP.
+
+* `file_system_id` - (Optional) The ID of the file system to back up. Required if backing up Lustre or Windows file systems.
+* `tags` - (Optional) A map of tags to assign to the file system. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level. If you have set `copy_tags_to_backups` to true, and you specify one or more tags, no existing file system tags are copied from the file system to the backup.
+* `volume_id` - (Optional) The ID of the volume to back up. Required if backing up a ONTAP Volume.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name of the backup.
+* `id` - Identifier of the backup, e.g., `fs-12345678`
+* `kms_key_id` -  The ID of the AWS Key Management Service (AWS KMS) key used to encrypt the backup of the Amazon FSx file system's data at rest.
+* `owner_id` - AWS account identifier that created the file system.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `type` - The type of the file system backup.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `10m`)
+* `delete` - (Default `10m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import FSx Backups using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import FSx Backups using the `id`. For example:
+
+```console
+% terraform import aws_fsx_backup.example fs-543ab12b1ca672f33
+```
+
+<!-- cache-key: cdktf-0.18.0 input-0ec17c1115f996a3a9d6f257bcf0f3b19a4abf6354a302a0d56b57c97b46ab01 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/fsx_data_repository_association.html.markdown b/website/docs/cdktf/python/r/fsx_data_repository_association.html.markdown
new file mode 100644
index 00000000000..67f10d110de
--- /dev/null
+++ b/website/docs/cdktf/python/r/fsx_data_repository_association.html.markdown
@@ -0,0 +1,127 @@
+---
+subcategory: "FSx"
+layout: "aws"
+page_title: "AWS: aws_fsx_data_repository_association"
+description: |-
+  Manages a FSx for Lustre Data Repository Association.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_fsx_data_repository_association
+
+Manages a FSx for Lustre Data Repository Association. See [Linking your file system to an S3 bucket](https://docs.aws.amazon.com/fsx/latest/LustreGuide/create-dra-linked-data-repo.html) for more information.
+
+~> **NOTE:** Data Repository Associations are only compatible with AWS FSx for Lustre File Systems and `PERSISTENT_2` deployment type.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.fsx_data_repository_association import FsxDataRepositoryAssociation
+from imports.aws.fsx_lustre_file_system import FsxLustreFileSystem
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_acl import S3BucketAcl
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = FsxLustreFileSystem(self, "example",
+            deployment_type="PERSISTENT_2",
+            per_unit_storage_throughput=125,
+            storage_capacity=1200,
+            subnet_ids=[Token.as_string(aws_subnet_example.id)]
+        )
+        aws_s3_bucket_example = S3Bucket(self, "example_1",
+            bucket="my-bucket"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_example.override_logical_id("example")
+        aws_s3_bucket_acl_example = S3BucketAcl(self, "example_2",
+            acl="private",
+            bucket=Token.as_string(aws_s3_bucket_example.id)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_acl_example.override_logical_id("example")
+        aws_fsx_data_repository_association_example =
+        FsxDataRepositoryAssociation(self, "example_3",
+            data_repository_path="s3://${" + aws_s3_bucket_example.id + "}",
+            file_system_id=example.id,
+            file_system_path="/my-bucket",
+            s3=FsxDataRepositoryAssociationS3(
+                auto_export_policy=FsxDataRepositoryAssociationS3AutoExportPolicy(
+                    events=["NEW", "CHANGED", "DELETED"]
+                ),
+                auto_import_policy=FsxDataRepositoryAssociationS3AutoImportPolicy(
+                    events=["NEW", "CHANGED", "DELETED"]
+                )
+            )
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_fsx_data_repository_association_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `batch_import_meta_data_on_create` - (Optional) Set to true to run an import data repository task to import metadata from the data repository to the file system after the data repository association is created. Defaults to `false`.
+* `data_repository_path` - (Required) The path to the Amazon S3 data repository that will be linked to the file system. The path must be an S3 bucket s3://myBucket/myPrefix/. This path specifies where in the S3 data repository files will be imported from or exported to. The same S3 bucket cannot be linked more than once to the same file system.
+* `file_system_id` - (Required) The ID of the Amazon FSx file system to on which to create a data repository association.
+* `file_system_path` - (Required) A path on the file system that points to a high-level directory (such as `/ns1/`) or subdirectory (such as `/ns1/subdir/`) that will be mapped 1-1 with `data_repository_path`. The leading forward slash in the name is required. Two data repository associations cannot have overlapping file system paths. For example, if a data repository is associated with file system path `/ns1/`, then you cannot link another data repository with file system path `/ns1/ns2`. This path specifies where in your file system files will be exported from or imported to. This file system directory can be linked to only one Amazon S3 bucket, and no other S3 bucket can be linked to the directory.
+* `imported_file_chunk_size` - (Optional) For files imported from a data repository, this value determines the stripe count and maximum amount of data per file (in MiB) stored on a single physical disk. The maximum number of disks that a single file can be striped across is limited by the total number of disks that make up the file system.
+* `s3` - (Optional) See the [`s3` configuration](#s3-arguments) block. Max of 1.
+The configuration for an Amazon S3 data repository linked to an Amazon FSx Lustre file system with a data repository association. The configuration defines which file events (new, changed, or deleted files or directories) are automatically imported from the linked data repository to the file system or automatically exported from the file system to the data repository.
+* `delete_data_in_filesystem` - (Optional) Set to true to delete files from the file system upon deleting this data repository association. Defaults to `false`.
+* `tags` - (Optional) A map of tags to assign to the data repository association. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+#### S3 arguments
+
+* `auto_export_policy` - (Optional) Specifies the type of updated objects that will be automatically exported from your file system to the linked S3 bucket. See the [`events` configuration](#events-arguments) block.
+* `auto_import_policy` - (Optional) Specifies the type of updated objects that will be automatically imported from the linked S3 bucket to your file system. See the [`events` configuration](#events-arguments) block.
+
+#### Events arguments
+
+* `events` - (Optional) A list of file event types to automatically export to your linked S3 bucket or import from the linked S3 bucket. Valid values are `NEW`, `CHANGED`, `DELETED`. Max of 3.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name of the file system.
+* `id` - Identifier of the data repository association, e.g., `dra-12345678`
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `10m`)
+* `update` - (Default `10m`)
+* `delete` - (Default `10m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import FSx Data Repository Associations using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import FSx Data Repository Associations using the `id`. For example:
+
+```console
+% terraform import aws_fsx_data_repository_association.example dra-0b1cfaeca11088b10
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ccbef1d76e1257a56bbcfd48884d7a6ba0aaf2b3d64139f2f28bb6a48fb634c8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/fsx_file_cache.html.markdown b/website/docs/cdktf/python/r/fsx_file_cache.html.markdown
new file mode 100644
index 00000000000..13270fb78bd
--- /dev/null
+++ b/website/docs/cdktf/python/r/fsx_file_cache.html.markdown
@@ -0,0 +1,148 @@
+---
+subcategory: "FSx"
+layout: "aws"
+page_title: "AWS: aws_fsx_file_cache"
+description: |-
+  Terraform resource for managing an Amazon File Cache cache.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_fsx_file_cache
+
+Terraform resource for managing an Amazon File Cache cache.
+See the [Create File Cache](https://docs.aws.amazon.com/fsx/latest/APIReference/API_CreateFileCache.html) for more information.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.fsx_file_cache import FsxFileCache
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        FsxFileCache(self, "example",
+            data_repository_association=[FsxFileCacheDataRepositoryAssociation(
+                data_repository_path="nfs://filer.domain.com",
+                data_repository_subdirectories=["test", "test2"],
+                file_cache_path="/ns1",
+                nfs=[FsxFileCacheDataRepositoryAssociationNfs(
+                    dns_ips=["192.168.0.1", "192.168.0.2"],
+                    version="NFS3"
+                )
+                ]
+            )
+            ],
+            file_cache_type="LUSTRE",
+            file_cache_type_version="2.12",
+            lustre_configuration=[FsxFileCacheLustreConfiguration(
+                deployment_type="CACHE_1",
+                metadata_configuration=[FsxFileCacheLustreConfigurationMetadataConfiguration(
+                    storage_capacity=2400
+                )
+                ],
+                per_unit_storage_throughput=1000,
+                weekly_maintenance_start_time="2:05:00"
+            )
+            ],
+            storage_capacity=1200,
+            subnet_ids=[test1.id]
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `file_cache_type` - The type of cache that you're creating. The only supported value is `LUSTRE`.
+* `file_cache_type_version` - The version for the type of cache that you're creating. The only supported value is `2.12`.
+* `storage_capacity` - The storage capacity of the cache in gibibytes (GiB). Valid values are `1200` GiB, `2400` GiB, and increments of `2400` GiB.
+* `subnet_ids` - A list of subnet IDs that the cache will be accessible from. You can specify only one subnet ID.
+
+The following arguments are optional:
+
+* `copy_tags_to_data_repository_associations` - A boolean flag indicating whether tags for the cache should be copied to data repository associations. This value defaults to false.
+* `data_repository_association` - See the [`data_repository_association` configuration](#data-repository-association-arguments) block. Max of 8.
+A list of up to 8 configurations for data repository associations (DRAs) to be created during the cache creation. The DRAs link the cache to either an Amazon S3 data repository or a Network File System (NFS) data repository that supports the NFSv3 protocol. The DRA configurations must meet the following requirements: 1) All configurations on the list must be of the same data repository type, either all S3 or all NFS. A cache can't link to different data repository types at the same time. 2) An NFS DRA must link to an NFS file system that supports the NFSv3 protocol. DRA automatic import and automatic export is not supported.
+* `kms_key_id` - Specifies the ID of the AWS Key Management Service (AWS KMS) key to use for encrypting data on an Amazon File Cache. If a KmsKeyId isn't specified, the Amazon FSx-managed AWS KMS key for your account is used.
+* `lustre_configuration` - See the [`lustre_configuration`](#lustre-configuration-arguments) block. Required when `file_cache_type` is `LUSTRE`.
+* `security_group_ids` - A list of IDs specifying the security groups to apply to all network interfaces created for Amazon File Cache access.
+* `tags` - (Optional) A map of tags to assign to the file cache. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+#### Data Repository Association arguments
+
+The `data_repository_association` configuration block supports the following arguments:
+
+* `file_cache_path` - (Required) A path on the cache that points to a high-level directory (such as /ns1/) or subdirectory (such as /ns1/subdir/) that will be mapped 1-1 with DataRepositoryPath. The leading forward slash in the name is required. Two data repository associations cannot have overlapping cache paths. For example, if a data repository is associated with cache path /ns1/, then you cannot link another data repository with cache path /ns1/ns2. This path specifies where in your cache files will be exported from. This cache directory can be linked to only one data repository, and no data repository other can be linked to the directory. Note: The cache path can only be set to root (/) on an NFS DRA when DataRepositorySubdirectories is specified. If you specify root (/) as the cache path, you can create only one DRA on the cache. The cache path cannot be set to root (/) for an S3 DRA.
+* `data_repository_path` - (Optional) The path to the S3 or NFS data repository that links to the cache.
+* `data_repository_subdirectories` - (Optional) A list of NFS Exports that will be linked with this data repository association. The Export paths are in the format /exportpath1. To use this parameter, you must configure DataRepositoryPath as the domain name of the NFS file system. The NFS file system domain name in effect is the root of the subdirectories. Note that DataRepositorySubdirectories is not supported for S3 data repositories. Max of 500.
+* `nfs` - (Optional) - (Optional) See the [`nfs` configuration](#nfs-arguments) block.
+
+#### NFS arguments
+
+The `nfs` configuration block supports the following arguments:
+
+* `version` - (Required) - The version of the NFS (Network File System) protocol of the NFS data repository. The only supported value is NFS3, which indicates that the data repository must support the NFSv3 protocol. The only supported value is `NFS3`.
+* `dns_ips` - (Optional) - A list of up to 2 IP addresses of DNS servers used to resolve the NFS file system domain name. The provided IP addresses can either be the IP addresses of a DNS forwarder or resolver that the customer manages and runs inside the customer VPC, or the IP addresses of the on-premises DNS servers.
+
+#### Lustre Configuration arguments
+
+The `lustre_configuration` configuration block supports the following arguments:
+
+* `deployment_type` - (Required) Specifies the cache deployment type. The only supported value is `CACHE_1`.
+* `metadata_configuration` - (Required) The configuration for a Lustre MDT (Metadata Target) storage volume. See the [`metadata_configuration`](#metadata-configuration-arguments) block.
+* `per_unit_storage_throughput` - (Required) Provisions the amount of read and write throughput for each 1 tebibyte (TiB) of cache storage capacity, in MB/s/TiB. The only supported value is `1000`.
+* `weekly_maintenance_start_time` - (Optional) A recurring weekly time, in the format `D:HH:MM`. `D` is the day of the week, for which `1` represents Monday and `7` represents Sunday. `HH` is the zero-padded hour of the day (0-23), and `MM` is the zero-padded minute of the hour. For example, 1:05:00 specifies maintenance at 5 AM Monday. See the [ISO week date](https://en.wikipedia.org/wiki/ISO_week_date) for more information.
+
+#### Metadata Configuration arguments
+
+The `metadata_configuration` configuration block supports the following arguments:
+
+* `storage_capacity` - (Required) The storage capacity of the Lustre MDT (Metadata Target) storage volume in gibibytes (GiB). The only supported value is `2400` GiB.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) for the resource.
+* `data_repository_association_ids` - A list of IDs of data repository associations that are associated with this cache.
+* `dns_name` - The Domain Name System (DNS) name for the cache.
+* `file_cache_id` - The system-generated, unique ID of the cache.
+* `id` - The system-generated, unique ID of the cache.
+* `network_interface_ids` - A list of network interface IDs.
+* `vpc_id` - The ID of your virtual private cloud (VPC).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `30m`)
+* `update` - (Default `30m`)
+* `delete` - (Default `30m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Amazon File Cache cache using the resource `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Amazon File Cache cache using the resource `id`. For example:
+
+```console
+% terraform import aws_fsx_file_cache.example fc-8012925589
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1859ea99cb9d6d35c3bafa1903ea724f9611978baf76d96694a45ea873f2f1c0 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/fsx_lustre_file_system.html.markdown b/website/docs/cdktf/python/r/fsx_lustre_file_system.html.markdown
new file mode 100644
index 00000000000..81753fa7bc1
--- /dev/null
+++ b/website/docs/cdktf/python/r/fsx_lustre_file_system.html.markdown
@@ -0,0 +1,139 @@
+---
+subcategory: "FSx"
+layout: "aws"
+page_title: "AWS: aws_fsx_lustre_file_system"
+description: |-
+  Manages a FSx Lustre File System.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_fsx_lustre_file_system
+
+Manages a FSx Lustre File System. See the [FSx Lustre Guide](https://docs.aws.amazon.com/fsx/latest/LustreGuide/what-is.html) for more information.
+
+~> **NOTE:** `auto_import_policy`, `export_path`, `import_path` and `imported_file_chunk_size` are not supported with the `PERSISTENT_2` deployment type. Use `aws_fsx_data_repository_association` instead.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.fsx_lustre_file_system import FsxLustreFileSystem
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        FsxLustreFileSystem(self, "example",
+            import_path="s3://${" + aws_s3_bucket_example.bucket + "}",
+            storage_capacity=1200,
+            subnet_ids=[Token.as_string(aws_subnet_example.id)]
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `storage_capacity` - (Optional) The storage capacity (GiB) of the file system. Minimum of `1200`. See more details at [Allowed values for Fsx storage capacity](https://docs.aws.amazon.com/fsx/latest/APIReference/API_CreateFileSystem.html#FSx-CreateFileSystem-request-StorageCapacity). Update is allowed only for `SCRATCH_2`, `PERSISTENT_1` and `PERSISTENT_2` deployment types, See more details at [Fsx Storage Capacity Update](https://docs.aws.amazon.com/fsx/latest/APIReference/API_UpdateFileSystem.html#FSx-UpdateFileSystem-request-StorageCapacity). Required when not creating filesystem for a backup.
+* `subnet_ids` - (Required) A list of IDs for the subnets that the file system will be accessible from. File systems currently support only one subnet. The file server is also launched in that subnet's Availability Zone.
+* `backup_id` - (Optional) The ID of the source backup to create the filesystem from.
+* `export_path` - (Optional) S3 URI (with optional prefix) where the root of your Amazon FSx file system is exported. Can only be specified with `import_path` argument and the path must use the same Amazon S3 bucket as specified in `import_path`. Set equal to `import_path` to overwrite files on export. Defaults to `s3://{IMPORT BUCKET}/FSxLustre{CREATION TIMESTAMP}`. Only supported on `PERSISTENT_1` deployment types.
+* `import_path` - (Optional) S3 URI (with optional prefix) that you're using as the data repository for your FSx for Lustre file system. For example, `s3://example-bucket/optional-prefix/`. Only supported on `PERSISTENT_1` deployment types.
+* `imported_file_chunk_size` - (Optional) For files imported from a data repository, this value determines the stripe count and maximum amount of data per file (in MiB) stored on a single physical disk. Can only be specified with `import_path` argument. Defaults to `1024`. Minimum of `1` and maximum of `512000`. Only supported on `PERSISTENT_1` deployment types.
+* `security_group_ids` - (Optional) A list of IDs for the security groups that apply to the specified network interfaces created for file system access. These security groups will apply to all network interfaces.
+* `tags` - (Optional) A map of tags to assign to the file system. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `weekly_maintenance_start_time` - (Optional) The preferred start time (in `d:HH:MM` format) to perform weekly maintenance, in the UTC time zone.
+* `deployment_type` - (Optional) - The filesystem deployment type. One of: `SCRATCH_1`, `SCRATCH_2`, `PERSISTENT_1`, `PERSISTENT_2`.
+* `kms_key_id` - (Optional) ARN for the KMS Key to encrypt the file system at rest, applicable for `PERSISTENT_1` and `PERSISTENT_2` deployment_type. Defaults to an AWS managed KMS Key.
+* `per_unit_storage_throughput` - (Optional) - Describes the amount of read and write throughput for each 1 tebibyte of storage, in MB/s/TiB, required for the `PERSISTENT_1` and `PERSISTENT_2` deployment_type. Valid values for `PERSISTENT_1` deployment_type and `SSD` storage_type are 50, 100, 200. Valid values for `PERSISTENT_1` deployment_type and `HDD` storage_type are 12, 40. Valid values for `PERSISTENT_2` deployment_type and ` SSD` storage_type are 125, 250, 500, 1000.
+* `automatic_backup_retention_days` - (Optional) The number of days to retain automatic backups. Setting this to 0 disables automatic backups. You can retain automatic backups for a maximum of 90 days. only valid for `PERSISTENT_1` and `PERSISTENT_2` deployment_type.
+* `storage_type` - (Optional) - The filesystem storage type. Either `SSD` or `HDD`, defaults to `SSD`. `HDD` is only supported on `PERSISTENT_1` deployment types.
+* `drive_cache_type` - (Optional) - The type of drive cache used by `PERSISTENT_1` filesystems that are provisioned with `HDD` storage_type. Required for `HDD` storage_type, set to either `READ` or `NONE`.
+* `daily_automatic_backup_start_time` - (Optional) A recurring daily time, in the format HH:MM. HH is the zero-padded hour of the day (0-23), and MM is the zero-padded minute of the hour. For example, 05:00 specifies 5 AM daily. only valid for `PERSISTENT_1` and `PERSISTENT_2` deployment_type. Requires `automatic_backup_retention_days` to be set.
+* `auto_import_policy` - (Optional) How Amazon FSx keeps your file and directory listings up to date as you add or modify objects in your linked S3 bucket. see [Auto Import Data Repo](https://docs.aws.amazon.com/fsx/latest/LustreGuide/autoimport-data-repo.html) for more details. Only supported on `PERSISTENT_1` deployment types.
+* `copy_tags_to_backups` - (Optional) A boolean flag indicating whether tags for the file system should be copied to backups. Applicable for `PERSISTENT_1` and `PERSISTENT_2` deployment_type. The default value is false.
+* `data_compression_type` - (Optional) Sets the data compression configuration for the file system. Valid values are `LZ4` and `NONE`. Default value is `NONE`. Unsetting this value reverts the compression type back to `NONE`.
+* `file_system_type_version` - (Optional) Sets the Lustre version for the file system that you're creating. Valid values are 2.10 for `SCRATCH_1`, `SCRATCH_2` and `PERSISTENT_1` deployment types. Valid values for 2.12 include all deployment types.
+* `log_configuration` - (Optional) The Lustre logging configuration used when creating an Amazon FSx for Lustre file system. When logging is enabled, Lustre logs error and warning events for data repositories associated with your file system to Amazon CloudWatch Logs.
+* `root_squash_configuration` - (Optional) The Lustre root squash configuration used when creating an Amazon FSx for Lustre file system. When enabled, root squash restricts root-level access from clients that try to access your file system as a root user.
+
+### log_configuration
+
+* `destination` - (Optional) The Amazon Resource Name (ARN) that specifies the destination of the logs. The name of the Amazon CloudWatch Logs log group must begin with the `/aws/fsx` prefix. If you do not provide a destination, Amazon FSx will create and use a log stream in the CloudWatch Logs `/aws/fsx/lustre` log group.
+* `level` - (Optional) Sets which data repository events are logged by Amazon FSx. Valid values are `WARN_ONLY`, `FAILURE_ONLY`, `ERROR_ONLY`, `WARN_ERROR` and `DISABLED`. Default value is `DISABLED`.
+
+### root_squash_configuration
+
+* `no_squash_nids` - (Optional) When root squash is enabled, you can optionally specify an array of NIDs of clients for which root squash does not apply. A client NID is a Lustre Network Identifier used to uniquely identify a client. You can specify the NID as either a single address or a range of addresses: 1. A single address is described in standard Lustre NID format by specifying the client’s IP address followed by the Lustre network ID (for example, 10.0.1.6@tcp). 2. An address range is described using a dash to separate the range (for example, 10.0.[2-10].[1-255]@tcp).
+* `root_squash` - (Optional) You enable root squash by setting a user ID (UID) and group ID (GID) for the file system in the format UID:GID (for example, 365534:65534). The UID and GID values can range from 0 to 4294967294.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name of the file system.
+* `dns_name` - DNS name for the file system, e.g., `fs-12345678.fsx.us-west-2.amazonaws.com`
+* `id` - Identifier of the file system, e.g., `fs-12345678`
+* `network_interface_ids` - Set of Elastic Network Interface identifiers from which the file system is accessible. As explained in the [documentation](https://docs.aws.amazon.com/fsx/latest/LustreGuide/mounting-on-premises.html), the first network interface returned is the primary network interface.
+* `mount_name` - The value to be used when mounting the filesystem.
+* `owner_id` - AWS account identifier that created the file system.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `vpc_id` - Identifier of the Virtual Private Cloud for the file system.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `30m`)
+* `update` - (Default `30m`)
+* `delete` - (Default `30m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import FSx File Systems using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import FSx File Systems using the `id`. For example:
+
+```console
+% terraform import aws_fsx_lustre_file_system.example fs-543ab12b1ca672f33
+```
+
+Certain resource arguments, like `security_group_ids`, do not have a FSx API method for reading the information after creation. If the argument is set in the Terraform configuration on an imported resource, Terraform will always show a difference. To workaround this behavior, either omit the argument from the Terraform configuration or use [`ignore_changes`](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html#ignore_changes) to hide the difference. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from cdktf import TerraformResourceLifecycle
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.fsx_lustre_file_system import FsxLustreFileSystem
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, subnetIds):
+        super().__init__(scope, name)
+        FsxLustreFileSystem(self, "example",
+            lifecycle=TerraformResourceLifecycle(
+                ignore_changes=[security_group_ids]
+            ),
+            security_group_ids=[Token.as_string(aws_security_group_example.id)],
+            subnet_ids=subnet_ids
+        )
+```
+
+<!-- cache-key: cdktf-0.18.0 input-2ed523e5edea92ba7aad4326103ac0db6486835dcbf78b6a54ded8c844851b3e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/fsx_ontap_file_system.html.markdown b/website/docs/cdktf/python/r/fsx_ontap_file_system.html.markdown
new file mode 100644
index 00000000000..e7f4145cbd7
--- /dev/null
+++ b/website/docs/cdktf/python/r/fsx_ontap_file_system.html.markdown
@@ -0,0 +1,142 @@
+---
+subcategory: "FSx"
+layout: "aws"
+page_title: "AWS: aws_fsx_ontap_file_system"
+description: |-
+  Manages an Amazon FSx for NetApp ONTAP file system.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_fsx_ontap_file_system
+
+Manages an Amazon FSx for NetApp ONTAP file system.
+See the [FSx ONTAP User Guide](https://docs.aws.amazon.com/fsx/latest/ONTAPGuide/what-is-fsx-ontap.html) for more information.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.fsx_ontap_file_system import FsxOntapFileSystem
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        FsxOntapFileSystem(self, "test",
+            deployment_type="MULTI_AZ_1",
+            preferred_subnet_id=test1.id,
+            storage_capacity=1024,
+            subnet_ids=[test1.id, test2.id],
+            throughput_capacity=512
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `storage_capacity` - (Optional) The storage capacity (GiB) of the file system. Valid values between `1024` and `196608`.
+* `subnet_ids` - (Required) A list of IDs for the subnets that the file system will be accessible from. Upto 2 subnets can be provided.
+* `preferred_subnet_id` - (Required) The ID for a subnet. A subnet is a range of IP addresses in your virtual private cloud (VPC).
+* `security_group_ids` - (Optional) A list of IDs for the security groups that apply to the specified network interfaces created for file system access. These security groups will apply to all network interfaces.
+* `weekly_maintenance_start_time` - (Optional) The preferred start time (in `d:HH:MM` format) to perform weekly maintenance, in the UTC time zone.
+* `deployment_type` - (Optional) - The filesystem deployment type. Supports `MULTI_AZ_1` and `SINGLE_AZ_1`.
+* `kms_key_id` - (Optional) ARN for the KMS Key to encrypt the file system at rest, Defaults to an AWS managed KMS Key.
+* `automatic_backup_retention_days` - (Optional) The number of days to retain automatic backups. Setting this to 0 disables automatic backups. You can retain automatic backups for a maximum of 90 days.
+* `daily_automatic_backup_start_time` - (Optional) A recurring daily time, in the format HH:MM. HH is the zero-padded hour of the day (0-23), and MM is the zero-padded minute of the hour. For example, 05:00 specifies 5 AM daily. Requires `automatic_backup_retention_days` to be set.
+* `disk_iops_configuration` - (Optional) The SSD IOPS configuration for the Amazon FSx for NetApp ONTAP file system. See [Disk Iops Configuration](#disk-iops-configuration) below.
+* `endpoint_ip_address_range` - (Optional) Specifies the IP address range in which the endpoints to access your file system will be created. By default, Amazon FSx selects an unused IP address range for you from the 198.19.* range.
+* `storage_type` - (Optional) - The filesystem storage type. defaults to `SSD`.
+* `fsx_admin_password` - (Optional) The ONTAP administrative password for the fsxadmin user that you can use to administer your file system using the ONTAP CLI and REST API.
+* `route_table_ids` - (Optional) Specifies the VPC route tables in which your file system's endpoints will be created. You should specify all VPC route tables associated with the subnets in which your clients are located. By default, Amazon FSx selects your VPC's default route table.
+* `tags` - (Optional) A map of tags to assign to the file system. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `throughput_capacity` - (Required) Sets the throughput capacity (in MBps) for the file system that you're creating. Valid values are `128`, `256`, `512`, `1024`, `2048`, and `4096`.
+
+### Disk Iops Configuration
+
+* `iops` - (Optional) - The total number of SSD IOPS provisioned for the file system.
+* `mode` - (Optional) - Specifies whether the number of IOPS for the file system is using the system. Valid values are `AUTOMATIC` and `USER_PROVISIONED`. Default value is `AUTOMATIC`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name of the file system.
+* `dns_name` - DNS name for the file system, e.g., `fs-12345678.fsx.us-west-2.amazonaws.com`
+* `endpoints` - The endpoints that are used to access data or to manage the file system using the NetApp ONTAP CLI, REST API, or NetApp SnapMirror. See [Endpoints](#endpoints) below.
+* `id` - Identifier of the file system, e.g., `fs-12345678`
+* `network_interface_ids` - Set of Elastic Network Interface identifiers from which the file system is accessible The first network interface returned is the primary network interface.
+* `owner_id` - AWS account identifier that created the file system.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `vpc_id` - Identifier of the Virtual Private Cloud for the file system.
+
+### Endpoints
+
+* `intercluster` - An endpoint for managing your file system by setting up NetApp SnapMirror with other ONTAP systems. See [Endpoint](#endpoint).
+* `management` - An endpoint for managing your file system using the NetApp ONTAP CLI and NetApp ONTAP API. See [Endpoint](#endpoint).
+
+#### Endpoint
+
+* `dns_name` - The Domain Name Service (DNS) name for the file system. You can mount your file system using its DNS name.
+* `ip_addresses` - IP addresses of the file system endpoint.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `60m`)
+* `update` - (Default `60m`)
+* `delete` - (Default `60m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import FSx File Systems using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import FSx File Systems using the `id`. For example:
+
+```console
+% terraform import aws_fsx_ontap_file_system.example fs-543ab12b1ca672f33
+```
+
+Certain resource arguments, like `security_group_ids`, do not have a FSx API method for reading the information after creation. If the argument is set in the Terraform configuration on an imported resource, Terraform will always show a difference. To workaround this behavior, either omit the argument from the Terraform configuration or use [`ignore_changes`](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html#ignore_changes) to hide the difference. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from cdktf import TerraformResourceLifecycle
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.fsx_ontap_file_system import FsxOntapFileSystem
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, deploymentType, preferredSubnetId, subnetIds, throughputCapacity):
+        super().__init__(scope, name)
+        FsxOntapFileSystem(self, "example",
+            lifecycle=TerraformResourceLifecycle(
+                ignore_changes=[security_group_ids]
+            ),
+            security_group_ids=[Token.as_string(aws_security_group_example.id)],
+            deployment_type=deployment_type,
+            preferred_subnet_id=preferred_subnet_id,
+            subnet_ids=subnet_ids,
+            throughput_capacity=throughput_capacity
+        )
+```
+
+<!-- cache-key: cdktf-0.18.0 input-134bc14f228fe82b4650aaa88cebc5d01bdf04be8f95607b99c8c282d98c71c1 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/fsx_ontap_storage_virtual_machine.html.markdown b/website/docs/cdktf/python/r/fsx_ontap_storage_virtual_machine.html.markdown
new file mode 100644
index 00000000000..d03e945f721
--- /dev/null
+++ b/website/docs/cdktf/python/r/fsx_ontap_storage_virtual_machine.html.markdown
@@ -0,0 +1,172 @@
+---
+subcategory: "FSx"
+layout: "aws"
+page_title: "AWS: aws_fsx_ontap_storage_virtual_machine"
+description: |-
+  Manages a FSx Storage Virtual Machine.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_fsx_ontap_storage_virtual_machine
+
+Manages a FSx Storage Virtual Machine.
+See the [FSx ONTAP User Guide](https://docs.aws.amazon.com/fsx/latest/ONTAPGuide/managing-svms.html) for more information.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.fsx_ontap_storage_virtual_machine import FsxOntapStorageVirtualMachine
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        FsxOntapStorageVirtualMachine(self, "test",
+            file_system_id=Token.as_string(aws_fsx_ontap_file_system_test.id),
+            name="test"
+        )
+```
+
+### Using a Self-Managed Microsoft Active Directory
+
+Additional information for using AWS Directory Service with ONTAP File Systems can be found in the [FSx ONTAP Guide](https://docs.aws.amazon.com/fsx/latest/ONTAPGuide/self-managed-AD.html).
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.fsx_ontap_storage_virtual_machine import FsxOntapStorageVirtualMachine
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        FsxOntapStorageVirtualMachine(self, "test",
+            active_directory_configuration=FsxOntapStorageVirtualMachineActiveDirectoryConfiguration(
+                netbios_name="mysvm",
+                self_managed_active_directory_configuration=FsxOntapStorageVirtualMachineActiveDirectoryConfigurationSelfManagedActiveDirectoryConfiguration(
+                    dns_ips=["10.0.0.111", "10.0.0.222"],
+                    domain_name="corp.example.com",
+                    password="avoid-plaintext-passwords",
+                    username="Admin"
+                )
+            ),
+            file_system_id=Token.as_string(aws_fsx_ontap_file_system_test.id),
+            name="mysvm"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `active_directory_configuration` - (Optional) Configuration block that Amazon FSx uses to join the FSx ONTAP Storage Virtual Machine(SVM) to your Microsoft Active Directory (AD) directory. Detailed below.
+* `file_system_id` - (Required) The ID of the Amazon FSx ONTAP File System that this SVM will be created on.
+* `name` - (Required) The name of the SVM. You can use a maximum of 47 alphanumeric characters, plus the underscore (_) special character.
+* `root_volume_security_style` - (Optional) Specifies the root volume security style, Valid values are `UNIX`, `NTFS`, and `MIXED`. All volumes created under this SVM will inherit the root security style unless the security style is specified on the volume. Default value is `UNIX`.
+* `tags` - (Optional) A map of tags to assign to the storage virtual machine. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### active_directory_configuration
+
+The `active_directory_configuration` configuration block supports the following arguments:
+
+* `netbios_name` - (Required) The NetBIOS name of the Active Directory computer object that will be created for your SVM. This is often the same as the SVM name but can be different. AWS limits to 15 characters because of standard NetBIOS naming limits.
+* `self_managed_active_directory` - (Optional) Configuration block that Amazon FSx uses to join the SVM to your self-managed (including on-premises) Microsoft Active Directory (AD) directory.
+
+### self_managed_active_directory
+
+The `self_managed_active_directory` configuration block supports the following arguments:
+
+* `dns_ips` - (Required) A list of up to three IP addresses of DNS servers or domain controllers in the self-managed AD directory.
+* `domain_name` - (Required) The fully qualified domain name of the self-managed AD directory. For example, `corp.example.com`.
+* `password` - (Required) The password for the service account on your self-managed AD domain that Amazon FSx will use to join to your AD domain.
+* `username` - (Required) The user name for the service account on your self-managed AD domain that Amazon FSx will use to join to your AD domain.
+* `file_system_administrators_group` - (Optional) The name of the domain group whose members are granted administrative privileges for the SVM. The group that you specify must already exist in your domain. Defaults to `Domain Admins`.
+* `organizational_unit_distinguished_name` - (Optional) The fully qualified distinguished name of the organizational unit within your self-managed AD directory that the Windows File Server instance will join. For example, `OU=FSx,DC=yourdomain,DC=corp,DC=com`. Only accepts OU as the direct parent of the SVM. If none is provided, the SVM is created in the default location of your self-managed AD directory. To learn more, see [RFC 2253](https://tools.ietf.org/html/rfc2253).
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name of the storage virtual machine.
+* `endpoints` - The endpoints that are used to access data or to manage the storage virtual machine using the NetApp ONTAP CLI, REST API, or NetApp SnapMirror. See [Endpoints](#endpoints) below.
+* `id` - Identifier of the storage virtual machine, e.g., `svm-12345678`
+* `subtype` - Describes the SVM's subtype, e.g. `DEFAULT`
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `uuid` - The SVM's UUID (universally unique identifier).
+
+### Endpoints
+
+* `iscsi` - An endpoint for accessing data on your storage virtual machine via iSCSI protocol. See [Endpoint](#endpoint).
+* `management` - An endpoint for managing your file system using the NetApp ONTAP CLI and NetApp ONTAP API. See [Endpoint](#endpoint).
+* `nfs` - An endpoint for accessing data on your storage virtual machine via NFS protocol. See [Endpoint](#endpoint).
+* `smb` - An endpoint for accessing data on your storage virtual machine via SMB protocol. This is only set if an active_directory_configuration has been set. See [Endpoint](#endpoint).
+
+#### Endpoint
+
+* `dns_name` - The Domain Name Service (DNS) name for the storage virtual machine. You can mount your storage virtual machine using its DNS name.
+* `ip_addresses` - IP addresses of the storage virtual machine endpoint.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `30m`)
+* `delete` - (Default `30m`)
+* `update` - (Default `30m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import FSx Storage Virtual Machine using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import FSx Storage Virtual Machine using the `id`. For example:
+
+```console
+% terraform import aws_fsx_ontap_storage_virtual_machine.example svm-12345678abcdef123
+```
+
+Certain resource arguments, like `svm_admin_password` and the `self_managed_active_directory` configuation block `password`, do not have a FSx API method for reading the information after creation. If these arguments are set in the Terraform configuration on an imported resource, Terraform will always show a difference. To workaround this behavior, either omit the argument from the Terraform configuration or use [`ignore_changes`](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html#ignore_changes) to hide the difference. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from cdktf import TerraformResourceLifecycle
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.fsx_ontap_storage_virtual_machine import FsxOntapStorageVirtualMachine
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, fileSystemId, name):
+        super().__init__(scope, name)
+        FsxOntapStorageVirtualMachine(self, "example",
+            lifecycle=TerraformResourceLifecycle(
+                ignore_changes=[svm_admin_password]
+            ),
+            svm_admin_password="avoid-plaintext-passwords",
+            file_system_id=file_system_id,
+            name=name
+        )
+```
+
+<!-- cache-key: cdktf-0.18.0 input-74ebf93c5246fec0a83d413f672feb2cd78262f5765744a5bca89505730e563b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/fsx_ontap_volume.html.markdown b/website/docs/cdktf/python/r/fsx_ontap_volume.html.markdown
new file mode 100644
index 00000000000..3ea3493869c
--- /dev/null
+++ b/website/docs/cdktf/python/r/fsx_ontap_volume.html.markdown
@@ -0,0 +1,158 @@
+---
+subcategory: "FSx"
+layout: "aws"
+page_title: "AWS: aws_fsx_ontap_volume"
+description: |-
+  Manages a FSx ONTAP Volume.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_fsx_ontap_volume
+
+Manages a FSx ONTAP Volume.
+See the [FSx ONTAP User Guide](https://docs.aws.amazon.com/fsx/latest/ONTAPGuide/managing-volumes.html) for more information.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.fsx_ontap_volume import FsxOntapVolume
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        FsxOntapVolume(self, "test",
+            junction_path="/test",
+            name="test",
+            size_in_megabytes=1024,
+            storage_efficiency_enabled=True,
+            storage_virtual_machine_id=Token.as_string(aws_fsx_ontap_storage_virtual_machine_test.id)
+        )
+```
+
+### Using Tiering Policy
+
+Additional information on tiering policy with ONTAP Volumes can be found in the [FSx ONTAP Guide](https://docs.aws.amazon.com/fsx/latest/ONTAPGuide/managing-volumes.html).
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.fsx_ontap_volume import FsxOntapVolume
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        FsxOntapVolume(self, "test",
+            junction_path="/test",
+            name="test",
+            size_in_megabytes=1024,
+            storage_efficiency_enabled=True,
+            storage_virtual_machine_id=Token.as_string(aws_fsx_ontap_storage_virtual_machine_test.id),
+            tiering_policy=FsxOntapVolumeTieringPolicy(
+                cooling_period=31,
+                name="AUTO"
+            )
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the Volume. You can use a maximum of 203 alphanumeric characters, plus the underscore (_) special character.
+* `bypass_snaplock_enterprise_retention` - (Optional) Setting this to `true` allows a SnapLock administrator to delete an FSx for ONTAP SnapLock Enterprise volume with unexpired write once, read many (WORM) files. This configuration must be applied separately before attempting to delete the resource to have the desired behavior. Defaults to `false`.
+* `copy_tags_to_backups` - (Optional) A boolean flag indicating whether tags for the volume should be copied to backups. This value defaults to `false`.
+* `junction_path` - (Optional) Specifies the location in the storage virtual machine's namespace where the volume is mounted. The junction_path must have a leading forward slash, such as `/vol3`
+* `ontap_volume_type` - (Optional) Specifies the type of volume, valid values are `RW`, `DP`. Default value is `RW`. These can be set by the ONTAP CLI or API. This setting is used as part of migration and replication [Migrating to Amazon FSx for NetApp ONTAP](https://docs.aws.amazon.com/fsx/latest/ONTAPGuide/migrating-fsx-ontap.html)
+* `security_style` - (Optional) Specifies the volume security style, Valid values are `UNIX`, `NTFS`, and `MIXED`.
+* `size_in_megabytes` - (Required) Specifies the size of the volume, in megabytes (MB), that you are creating.
+* `skip_final_backup` - (Optional) When enabled, will skip the default final backup taken when the volume is deleted. This configuration must be applied separately before attempting to delete the resource to have the desired behavior. Defaults to `false`.
+* `snaplock_configuration` - (Optional) The SnapLock configuration for an FSx for ONTAP volume. See [SnapLock Configuration](#snaplock-configuration) below.
+* `snapshot_policy` - (Optional) Specifies the snapshot policy for the volume. See [snapshot policies](https://docs.aws.amazon.com/fsx/latest/ONTAPGuide/snapshots-ontap.html#snapshot-policies) in the Amazon FSx ONTAP User Guide
+* `storage_efficiency_enabled` - (Optional) Set to true to enable deduplication, compression, and compaction storage efficiency features on the volume.
+* `storage_virtual_machine_id` - (Required) Specifies the storage virtual machine in which to create the volume.
+* `tags` - (Optional) A map of tags to assign to the volume. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `tiering_policy` - (Optional) The data tiering policy for an FSx for ONTAP volume. See [Tiering Policy](#tiering-policy) below.
+
+### SnapLock Configuration
+
+* `audit_log_volume` - (Optional) Enables or disables the audit log volume for an FSx for ONTAP SnapLock volume. The default value is `false`.
+* `autocommit_period` - (Optional) The configuration object for setting the autocommit period of files in an FSx for ONTAP SnapLock volume. See [Autocommit Period](#autocommit-period) below.
+* `privileged_delete` - (Optional) Enables, disables, or permanently disables privileged delete on an FSx for ONTAP SnapLock Enterprise volume. Valid values: `DISABLED`, `ENABLED`, `PERMANENTLY_DISABLED`. The default value is `DISABLED`.
+* `retention_period` - (Optional) The retention period of an FSx for ONTAP SnapLock volume. See [SnapLock Retention Period](#snaplock-retention-period) below.
+* `snaplock_type` - (Required) Specifies the retention mode of an FSx for ONTAP SnapLock volume. After it is set, it can't be changed. Valid values: `COMPLIANCE`, `ENTERPRISE`.
+* `volume_append_mode_enabled` - (Optional) Enables or disables volume-append mode on an FSx for ONTAP SnapLock volume. The default value is `false`.
+
+### Autocommit Period
+
+* `type` - (Required) The type of time for the autocommit period of a file in an FSx for ONTAP SnapLock volume. Setting this value to `NONE` disables autocommit. Valid values: `MINUTES`, `HOURS`, `DAYS`, `MONTHS`, `YEARS`, `NONE`.
+* `value` - (Optional) The amount of time for the autocommit period of a file in an FSx for ONTAP SnapLock volume.
+
+### SnapLock Retention Period
+
+* `default_retention` - (Required) The retention period assigned to a write once, read many (WORM) file by default if an explicit retention period is not set for an FSx for ONTAP SnapLock volume. The default retention period must be greater than or equal to the minimum retention period and less than or equal to the maximum retention period. See [Retention Period](#retention-period) below.
+* `maximum_retention` - (Required) The longest retention period that can be assigned to a WORM file on an FSx for ONTAP SnapLock volume. See [Retention Period](#retention-period) below.
+* `minimum_retention` - (Required) The shortest retention period that can be assigned to a WORM file on an FSx for ONTAP SnapLock volume. See [Retention Period](#retention-period) below.
+
+### Retention Period
+
+* `type` - (Required) The type of time for the retention period of an FSx for ONTAP SnapLock volume. Set it to one of the valid types. If you set it to `INFINITE`, the files are retained forever. If you set it to `UNSPECIFIED`, the files are retained until you set an explicit retention period. Valid values: `SECONDS`, `MINUTES`, `HOURS`, `DAYS`, `MONTHS`, `YEARS`, `INFINITE`, `UNSPECIFIED`.
+* `value` - (Optional) The amount of time for the autocommit period of a file in an FSx for ONTAP SnapLock volume.
+
+### Tiering Policy
+
+* `name` - (Required) Specifies the tiering policy for the ONTAP volume for moving data to the capacity pool storage. Valid values are `SNAPSHOT_ONLY`, `AUTO`, `ALL`, `NONE`. Default value is `SNAPSHOT_ONLY`.
+* `cooling_period` - (Optional) Specifies the number of days that user data in a volume must remain inactive before it is considered "cold" and moved to the capacity pool. Used with `AUTO` and `SNAPSHOT_ONLY` tiering policies only. Valid values are whole numbers between 2 and 183. Default values are 31 days for `AUTO` and 2 days for `SNAPSHOT_ONLY`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name of the volune.
+* `id` - Identifier of the volume, e.g., `fsvol-12345678`
+* `file_system_id` - Describes the file system for the volume, e.g. `fs-12345679`
+* `flexcache_endpoint_type` - Specifies the FlexCache endpoint type of the volume, Valid values are `NONE`, `ORIGIN`, `CACHE`. Default value is `NONE`. These can be set by the ONTAP CLI or API and are use with FlexCache feature.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `uuid` - The Volume's UUID (universally unique identifier).
+* `volume_type` - The type of volume, currently the only valid value is `ONTAP`.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `30m`)
+* `delete` - (Default `30m`)
+* `update` - (Default `30m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import FSx ONTAP volume using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import FSx ONTAP volume using the `id`. For example:
+
+```console
+% terraform import aws_fsx_ontap_volume.example fsvol-12345678abcdef123
+```
+
+<!-- cache-key: cdktf-0.18.0 input-4150b6016178afdca4f0be9139d92abeffcd41f64e3fc04737a2e1147ba2af7e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/fsx_openzfs_file_system.html.markdown b/website/docs/cdktf/python/r/fsx_openzfs_file_system.html.markdown
new file mode 100644
index 00000000000..73bda27ff57
--- /dev/null
+++ b/website/docs/cdktf/python/r/fsx_openzfs_file_system.html.markdown
@@ -0,0 +1,157 @@
+---
+subcategory: "FSx"
+layout: "aws"
+page_title: "AWS: aws_fsx_openzfs_file_system"
+description: |-
+  Manages an Amazon FSx for OpenZFS file system.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_fsx_openzfs_file_system
+
+Manages an Amazon FSx for OpenZFS file system.
+See the [FSx OpenZFS User Guide](https://docs.aws.amazon.com/fsx/latest/OpenZFSGuide/what-is-fsx.html) for more information.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.fsx_openzfs_file_system import FsxOpenzfsFileSystem
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        FsxOpenzfsFileSystem(self, "test",
+            deployment_type="SINGLE_AZ_1",
+            storage_capacity=64,
+            subnet_ids=[test1.id],
+            throughput_capacity=64
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `deployment_type` - (Required) - The filesystem deployment type. Valid values: `SINGLE_AZ_1`, `SINGLE_AZ_2` and `MULTI_AZ_1`.
+* `storage_capacity` - (Required) The storage capacity (GiB) of the file system. Valid values between `64` and `524288`.
+* `subnet_ids` - (Required) A list of IDs for the subnets that the file system will be accessible from.
+* `throughput_capacity` - (Required) Throughput (MB/s) of the file system. Valid values depend on `deployment_type`. Must be one of `64`, `128`, `256`, `512`, `1024`, `2048`, `3072`, `4096` for `SINGLE_AZ_1`. Must be one of `160`, `320`, `640`, `1280`, `2560`, `3840`, `5120`, `7680`, `10240` for `SINGLE_AZ_2`.
+* `automatic_backup_retention_days` - (Optional) The number of days to retain automatic backups. Setting this to 0 disables automatic backups. You can retain automatic backups for a maximum of 90 days.
+* `backup_id` - (Optional) The ID of the source backup to create the filesystem from.
+* `copy_tags_to_backups` - (Optional) A boolean flag indicating whether tags for the file system should be copied to backups. The default value is false.
+* `copy_tags_to_volumes` - (Optional) A boolean flag indicating whether tags for the file system should be copied to snapshots. The default value is false.
+* `daily_automatic_backup_start_time` - (Optional) A recurring daily time, in the format HH:MM. HH is the zero-padded hour of the day (0-23), and MM is the zero-padded minute of the hour. For example, 05:00 specifies 5 AM daily. Requires `automatic_backup_retention_days` to be set.
+* `disk_iops_configuration` - (Optional) The SSD IOPS configuration for the Amazon FSx for OpenZFS file system. See [Disk Iops Configuration](#disk-iops-configuration) below.
+* `endpoint_ip_address_range` - (Optional) (Multi-AZ only) Specifies the IP address range in which the endpoints to access your file system will be created.
+* `kms_key_id` - (Optional) ARN for the KMS Key to encrypt the file system at rest, Defaults to an AWS managed KMS Key.
+* `preferred_subnet_id` - (Optional) (Multi-AZ only) Required when `deployment_type` is set to `MULTI_AZ_1`. This specifies the subnet in which you want the preferred file server to be located.
+* `root_volume_configuration` - (Optional) The configuration for the root volume of the file system. All other volumes are children or the root volume. See [Root Volume Configuration](#root-volume-configuration) below.
+* `route_table_ids` - (Optional) (Multi-AZ only) Specifies the route tables in which Amazon FSx creates the rules for routing traffic to the correct file server. You should specify all virtual private cloud (VPC) route tables associated with the subnets in which your clients are located. By default, Amazon FSx selects your VPC's default route table.
+* `security_group_ids` - (Optional) A list of IDs for the security groups that apply to the specified network interfaces created for file system access. These security groups will apply to all network interfaces.
+* `storage_type` - (Optional) The filesystem storage type. Only `SSD` is supported.
+* `tags` - (Optional) A map of tags to assign to the file system. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `weekly_maintenance_start_time` - (Optional) The preferred start time (in `d:HH:MM` format) to perform weekly maintenance, in the UTC time zone.
+
+### Disk Iops Configuration
+
+* `iops` - (Optional) - The total number of SSD IOPS provisioned for the file system.
+* `mode` - (Optional) - Specifies whether the number of IOPS for the file system is using the system. Valid values are `AUTOMATIC` and `USER_PROVISIONED`. Default value is `AUTOMATIC`.
+
+### Root Volume Configuration
+
+* `copy_tags_to_snapshots` - (Optional) - A boolean flag indicating whether tags for the file system should be copied to snapshots. The default value is false.
+* `data_compression_type` - (Optional) - Method used to compress the data on the volume. Valid values are `LZ4`, `NONE` or `ZSTD`. Child volumes that don't specify compression option will inherit from parent volume. This option on file system applies to the root volume.
+* `nfs_exports` - (Optional) - NFS export configuration for the root volume. Exactly 1 item. See [NFS Exports](#nfs-exports) Below.
+* `read_only` - (Optional) - specifies whether the volume is read-only. Default is false.
+* `record_size_kib` - (Optional) - Specifies the record size of an OpenZFS root volume, in kibibytes (KiB). Valid values are `4`, `8`, `16`, `32`, `64`, `128`, `256`, `512`, or `1024` KiB. The default is `128` KiB.
+* `user_and_group_quotas` - (Optional) - Specify how much storage users or groups can use on the volume. Maximum of 100 items. See [User and Group Quotas](#user-and-group-quotas) Below.
+
+### NFS Exports
+
+* `client_configurations` - (Required) - A list of configuration objects that contain the client and options for mounting the OpenZFS file system. Maximum of 25 items. See [Client Configurations](#client configurations) Below.
+
+### Client Configurations
+
+* `clients` - (Required) - A value that specifies who can mount the file system. You can provide a wildcard character (*), an IP address (0.0.0.0), or a CIDR address (192.0.2.0/24. By default, Amazon FSx uses the wildcard character when specifying the client.
+* `options` - (Required) -  The options to use when mounting the file system. Maximum of 20 items. See the [Linix NFS exports man page](https://linux.die.net/man/5/exports) for more information. `crossmount` and `sync` are used by default.
+
+### User and Group Quotas
+
+* `id` - (Required) - The ID of the user or group. Valid values between `0` and `2147483647`
+* `storage_capacity_quota_gib` - (Required) - The amount of storage that the user or group can use in gibibytes (GiB). Valid values between `0` and `2147483647`
+* `type` - (Required) - A value that specifies whether the quota applies to a user or group. Valid values are `USER` or `GROUP`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name of the file system.
+* `dns_name` - DNS name for the file system, e.g., `fs-12345678.fsx.us-west-2.amazonaws.com`
+* `id` - Identifier of the file system, e.g., `fs-12345678`
+* `network_interface_ids` - Set of Elastic Network Interface identifiers from which the file system is accessible The first network interface returned is the primary network interface.
+* `root_volume_id` - Identifier of the root volume, e.g., `fsvol-12345678`
+* `owner_id` - AWS account identifier that created the file system.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `vpc_id` - Identifier of the Virtual Private Cloud for the file system.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `60m`)
+* `update` - (Default `60m`)
+* `delete` - (Default `60m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import FSx File Systems using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import FSx File Systems using the `id`. For example:
+
+```console
+% terraform import aws_fsx_openzfs_file_system.example fs-543ab12b1ca672f33
+```
+
+Certain resource arguments, like `security_group_ids`, do not have a FSx API method for reading the information after creation. If the argument is set in the Terraform configuration on an imported resource, Terraform will always show a difference. To workaround this behavior, either omit the argument from the Terraform configuration or use [`ignore_changes`](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html#ignore_changes) to hide the difference. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from cdktf import TerraformResourceLifecycle
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.fsx_openzfs_file_system import FsxOpenzfsFileSystem
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, deploymentType, subnetIds, throughputCapacity):
+        super().__init__(scope, name)
+        FsxOpenzfsFileSystem(self, "example",
+            lifecycle=TerraformResourceLifecycle(
+                ignore_changes=[security_group_ids]
+            ),
+            security_group_ids=[Token.as_string(aws_security_group_example.id)],
+            deployment_type=deployment_type,
+            subnet_ids=subnet_ids,
+            throughput_capacity=throughput_capacity
+        )
+```
+
+<!-- cache-key: cdktf-0.18.0 input-747caeeb6ae73c2beade6eba7cdec24bd727587f1c4cbe894ef193c84d502d2e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/fsx_openzfs_snapshot.html.markdown b/website/docs/cdktf/python/r/fsx_openzfs_snapshot.html.markdown
new file mode 100644
index 00000000000..519b6851cca
--- /dev/null
+++ b/website/docs/cdktf/python/r/fsx_openzfs_snapshot.html.markdown
@@ -0,0 +1,126 @@
+---
+subcategory: "FSx"
+layout: "aws"
+page_title: "AWS: aws_fsx_openzfs_snapshot"
+description: |-
+  Manages an Amazon FSx for OpenZFS snapshot.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_fsx_openzfs_snapshot
+
+Manages an Amazon FSx for OpenZFS volume.
+See the [FSx OpenZFS User Guide](https://docs.aws.amazon.com/fsx/latest/OpenZFSGuide/what-is-fsx.html) for more information.
+
+## Example Usage
+
+### Root volume Example
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.fsx_openzfs_file_system import FsxOpenzfsFileSystem
+from imports.aws.fsx_openzfs_snapshot import FsxOpenzfsSnapshot
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = FsxOpenzfsFileSystem(self, "example",
+            deployment_type="SINGLE_AZ_1",
+            storage_capacity=64,
+            subnet_ids=[Token.as_string(aws_subnet_example.id)],
+            throughput_capacity=64
+        )
+        aws_fsx_openzfs_snapshot_example = FsxOpenzfsSnapshot(self, "example_1",
+            name="example",
+            volume_id=example.root_volume_id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_fsx_openzfs_snapshot_example.override_logical_id("example")
+```
+
+### Child volume Example
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.fsx_openzfs_file_system import FsxOpenzfsFileSystem
+from imports.aws.fsx_openzfs_snapshot import FsxOpenzfsSnapshot
+from imports.aws.fsx_openzfs_volume import FsxOpenzfsVolume
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = FsxOpenzfsFileSystem(self, "example",
+            deployment_type="SINGLE_AZ_1",
+            storage_capacity=64,
+            subnet_ids=[Token.as_string(aws_subnet_example.id)],
+            throughput_capacity=64
+        )
+        aws_fsx_openzfs_volume_example = FsxOpenzfsVolume(self, "example_1",
+            name="example",
+            parent_volume_id=example.root_volume_id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_fsx_openzfs_volume_example.override_logical_id("example")
+        aws_fsx_openzfs_snapshot_example = FsxOpenzfsSnapshot(self, "example_2",
+            name="example",
+            volume_id=Token.as_string(aws_fsx_openzfs_volume_example.id)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_fsx_openzfs_snapshot_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the Snapshot. You can use a maximum of 203 alphanumeric characters plus either _ or -  or : or . for the name.
+* `tags` - (Optional) A map of tags to assign to the file system. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level. If you have set `copy_tags_to_backups` to true, and you specify one or more tags, no existing file system tags are copied from the file system to the backup.
+* `volume_id` - (Optional) The ID of the volume to snapshot. This can be the root volume or a child volume.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name of the snapshot.
+* `id` - Identifier of the snapshot, e.g., `fsvolsnap-12345678`
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `30m`)
+* `delete` - (Default `30m`)
+* `update` - (Default `30m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import FSx OpenZFS snapshot using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import FSx OpenZFS snapshot using the `id`. For example:
+
+```console
+% terraform import aws_fsx_openzfs_snapshot.example fs-543ab12b1ca672f33
+```
+
+<!-- cache-key: cdktf-0.18.0 input-f33ba26e8f39726647995a0b6dacb8d0a5084b4411c18471d481f35f094019e6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/fsx_openzfs_volume.html.markdown b/website/docs/cdktf/python/r/fsx_openzfs_volume.html.markdown
new file mode 100644
index 00000000000..14e73ba28c4
--- /dev/null
+++ b/website/docs/cdktf/python/r/fsx_openzfs_volume.html.markdown
@@ -0,0 +1,104 @@
+---
+subcategory: "FSx"
+layout: "aws"
+page_title: "AWS: aws_fsx_openzfs_volume"
+description: |-
+  Manages an Amazon FSx for OpenZFS volume.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_fsx_openzfs_volume
+
+Manages an Amazon FSx for OpenZFS volume.
+See the [FSx OpenZFS User Guide](https://docs.aws.amazon.com/fsx/latest/OpenZFSGuide/what-is-fsx.html) for more information.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.fsx_openzfs_volume import FsxOpenzfsVolume
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        FsxOpenzfsVolume(self, "test",
+            name="testvolume",
+            parent_volume_id=Token.as_string(aws_fsx_openzfs_file_system_test.root_volume_id)
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the Volume. You can use a maximum of 203 alphanumeric characters, plus the underscore (_) special character.
+* `parent_volume_id` - (Required) The volume id of volume that will be the parent volume for the volume being created, this could be the root volume created from the `aws_fsx_openzfs_file_system` resource with the `root_volume_id` or the `id` property of another `aws_fsx_openzfs_volume`.
+* `origin_snapshot` - (Optional) The ARN of the source snapshot to create the volume from.
+* `copy_tags_to_snapshots` - (Optional) A boolean flag indicating whether tags for the file system should be copied to snapshots. The default value is false.
+* `data_compression_type` - (Optional) Method used to compress the data on the volume. Valid values are `NONE` or `ZSTD`. Child volumes that don't specify compression option will inherit from parent volume. This option on file system applies to the root volume.
+* `delete_volume_options` - (Optional) Whether to delete all child volumes and snapshots. Valid values: `DELETE_CHILD_VOLUMES_AND_SNAPSHOTS`. This configuration must be applied separately before attempting to delete the resource to have the desired behavior..
+* `nfs_exports` - (Optional) NFS export configuration for the root volume. Exactly 1 item. See [NFS Exports](#nfs-exports) Below.
+* `read_only` - (Optional) specifies whether the volume is read-only. Default is false.
+* `record_size_kib` - (Optional) The record size of an OpenZFS volume, in kibibytes (KiB). Valid values are `4`, `8`, `16`, `32`, `64`, `128`, `256`, `512`, or `1024` KiB. The default is `128` KiB.
+* `storage_capacity_quota_gib`  - (Optional) The maximum amount of storage in gibibytes (GiB) that the volume can use from its parent.
+* `storage_capacity_reservation_gib`  - (Optional) The amount of storage in gibibytes (GiB) to reserve from the parent volume.
+* `user_and_group_quotas` - (Optional) - Specify how much storage users or groups can use on the volume. Maximum of 100 items. See [User and Group Quotas](#user-and-group-quotas) Below.
+* `tags` - (Optional) A map of tags to assign to the file system. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### NFS Exports
+
+* `client_configurations` - (Required) - A list of configuration objects that contain the client and options for mounting the OpenZFS file system. Maximum of 25 items. See [Client Configurations](#client configurations) Below.
+
+### Client Configurations
+
+* `clients` - (Required) - A value that specifies who can mount the file system. You can provide a wildcard character (*), an IP address (0.0.0.0), or a CIDR address (192.0.2.0/24. By default, Amazon FSx uses the wildcard character when specifying the client.
+* `options` - (Required) -  The options to use when mounting the file system. Maximum of 20 items. See the [Linix NFS exports man page](https://linux.die.net/man/5/exports) for more information. `crossmount` and `sync` are used by default.
+
+### User and Group Quotas
+
+* `id` - (Required) - The ID of the user or group. Valid values between `0` and `2147483647`
+* `storage_capacity_quota_gib` - (Required) - The amount of storage that the user or group can use in gibibytes (GiB). Valid values between `0` and `2147483647`
+* `Type` - (Required) - A value that specifies whether the quota applies to a user or group. Valid values are `USER` or `GROUP`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name of the file system.
+* `id` - Identifier of the file system, e.g., `fsvol-12345678`
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `30m`)
+* `update` - (Default `30m`)
+* `delete` - (Default `30m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import FSx Volumes using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import FSx Volumes using the `id`. For example:
+
+```console
+% terraform import aws_fsx_openzfs_volume.example fsvol-543ab12b1ca672f33
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1179f10edd690fc9c59b2fb74afd95265abe59dfbd0b69ee2df86ce1400318a0 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/fsx_windows_file_system.html.markdown b/website/docs/cdktf/python/r/fsx_windows_file_system.html.markdown
new file mode 100644
index 00000000000..7d67063afc9
--- /dev/null
+++ b/website/docs/cdktf/python/r/fsx_windows_file_system.html.markdown
@@ -0,0 +1,190 @@
+---
+subcategory: "FSx"
+layout: "aws"
+page_title: "AWS: aws_fsx_windows_file_system"
+description: |-
+  Manages a FSx Windows File System.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_fsx_windows_file_system
+
+Manages a FSx Windows File System. See the [FSx Windows Guide](https://docs.aws.amazon.com/fsx/latest/WindowsGuide/what-is.html) for more information.
+
+~> **NOTE:** Either the `active_directory_id` argument or `self_managed_active_directory` configuration block must be specified.
+
+## Example Usage
+
+### Using AWS Directory Service
+
+Additional information for using AWS Directory Service with Windows File Systems can be found in the [FSx Windows Guide](https://docs.aws.amazon.com/fsx/latest/WindowsGuide/fsx-aws-managed-ad.html).
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.fsx_windows_file_system import FsxWindowsFileSystem
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        FsxWindowsFileSystem(self, "example",
+            active_directory_id=Token.as_string(aws_directory_service_directory_example.id),
+            kms_key_id=Token.as_string(aws_kms_key_example.arn),
+            storage_capacity=300,
+            subnet_ids=[Token.as_string(aws_subnet_example.id)],
+            throughput_capacity=1024
+        )
+```
+
+### Using a Self-Managed Microsoft Active Directory
+
+Additional information for using AWS Directory Service with Windows File Systems can be found in the [FSx Windows Guide](https://docs.aws.amazon.com/fsx/latest/WindowsGuide/self-managed-AD.html).
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.fsx_windows_file_system import FsxWindowsFileSystem
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        FsxWindowsFileSystem(self, "example",
+            kms_key_id=Token.as_string(aws_kms_key_example.arn),
+            self_managed_active_directory=FsxWindowsFileSystemSelfManagedActiveDirectory(
+                dns_ips=["10.0.0.111", "10.0.0.222"],
+                domain_name="corp.example.com",
+                password="avoid-plaintext-passwords",
+                username="Admin"
+            ),
+            storage_capacity=300,
+            subnet_ids=[Token.as_string(aws_subnet_example.id)],
+            throughput_capacity=1024
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `subnet_ids` - (Required) A list of IDs for the subnets that the file system will be accessible from. To specify more than a single subnet set `deployment_type` to `MULTI_AZ_1`.
+* `throughput_capacity` - (Required) Throughput (megabytes per second) of the file system in power of 2 increments. Minimum of `8` and maximum of `2048`.
+
+The following arguments are optional:
+
+* `active_directory_id` - (Optional) The ID for an existing Microsoft Active Directory instance that the file system should join when it's created. Cannot be specified with `self_managed_active_directory`.
+* `aliases` - (Optional) An array DNS alias names that you want to associate with the Amazon FSx file system.  For more information, see [Working with DNS Aliases](https://docs.aws.amazon.com/fsx/latest/WindowsGuide/managing-dns-aliases.html)
+* `audit_log_configuration` - (Optional) The configuration that Amazon FSx for Windows File Server uses to audit and log user accesses of files, folders, and file shares on the Amazon FSx for Windows File Server file system. See [Audit Log Configuration](#audit-log-configuration) below.
+* `automatic_backup_retention_days` - (Optional) The number of days to retain automatic backups. Minimum of `0` and maximum of `90`. Defaults to `7`. Set to `0` to disable.
+* `backup_id` - (Optional) The ID of the source backup to create the filesystem from.
+* `copy_tags_to_backups` - (Optional) A boolean flag indicating whether tags on the file system should be copied to backups. Defaults to `false`.
+* `daily_automatic_backup_start_time` - (Optional) The preferred time (in `HH:MM` format) to take daily automatic backups, in the UTC time zone.
+* `deployment_type` - (Optional) Specifies the file system deployment type, valid values are `MULTI_AZ_1`, `SINGLE_AZ_1` and `SINGLE_AZ_2`. Default value is `SINGLE_AZ_1`.
+* `disk_iops_configuration` - (Optional) The SSD IOPS configuration for the Amazon FSx for Windows File Server file system. See [Disk Iops Configuration](#disk-iops-configuration) below.
+* `kms_key_id` - (Optional) ARN for the KMS Key to encrypt the file system at rest. Defaults to an AWS managed KMS Key.
+* `preferred_subnet_id` - (Optional) Specifies the subnet in which you want the preferred file server to be located. Required for when deployment type is `MULTI_AZ_1`.
+* `security_group_ids` - (Optional) A list of IDs for the security groups that apply to the specified network interfaces created for file system access. These security groups will apply to all network interfaces.
+* `self_managed_active_directory` - (Optional) Configuration block that Amazon FSx uses to join the Windows File Server instance to your self-managed (including on-premises) Microsoft Active Directory (AD) directory. Cannot be specified with `active_directory_id`. See [Self-Managed Active Directory](#self-managed-active-directory) below.
+* `skip_final_backup` - (Optional) When enabled, will skip the default final backup taken when the file system is deleted. This configuration must be applied separately before attempting to delete the resource to have the desired behavior. Defaults to `false`.
+* `tags` - (Optional) A map of tags to assign to the file system. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `storage_capacity` - (Optional) Storage capacity (GiB) of the file system. Minimum of 32 and maximum of 65536. If the storage type is set to `HDD` the minimum value is 2000. Required when not creating filesystem for a backup.
+* `storage_type` - (Optional) Specifies the storage type, Valid values are `SSD` and `HDD`. `HDD` is supported on `SINGLE_AZ_2` and `MULTI_AZ_1` Windows file system deployment types. Default value is `SSD`.
+* `weekly_maintenance_start_time` - (Optional) The preferred start time (in `d:HH:MM` format) to perform weekly maintenance, in the UTC time zone.
+
+### Disk Iops Configuration
+
+* `iops` - (Optional) - The total number of SSD IOPS provisioned for the file system.
+* `mode` - (Optional) - Specifies whether the number of IOPS for the file system is using the system. Valid values are `AUTOMATIC` and `USER_PROVISIONED`. Default value is `AUTOMATIC`.
+
+### Self-Managed Active Directory
+
+The `self_managed_active_directory` configuration block supports the following arguments:
+
+* `dns_ips` - (Required) A list of up to two IP addresses of DNS servers or domain controllers in the self-managed AD directory. The IP addresses need to be either in the same VPC CIDR range as the file system or in the private IP version 4 (IPv4) address ranges as specified in [RFC 1918](https://tools.ietf.org/html/rfc1918).
+* `domain_name` - (Required) The fully qualified domain name of the self-managed AD directory. For example, `corp.example.com`.
+* `password` - (Required) The password for the service account on your self-managed AD domain that Amazon FSx will use to join to your AD domain.
+* `username` - (Required) The user name for the service account on your self-managed AD domain that Amazon FSx will use to join to your AD domain.
+* `file_system_administrators_group` - (Optional) The name of the domain group whose members are granted administrative privileges for the file system. Administrative privileges include taking ownership of files and folders, and setting audit controls (audit ACLs) on files and folders. The group that you specify must already exist in your domain. Defaults to `Domain Admins`.
+* `organizational_unit_distinguished_name` - (Optional) The fully qualified distinguished name of the organizational unit within your self-managed AD directory that the Windows File Server instance will join. For example, `OU=FSx,DC=yourdomain,DC=corp,DC=com`. Only accepts OU as the direct parent of the file system. If none is provided, the FSx file system is created in the default location of your self-managed AD directory. To learn more, see [RFC 2253](https://tools.ietf.org/html/rfc2253).
+
+### Audit Log Configuration
+
+* `audit_log_destination` - (Optional) The Amazon Resource Name (ARN) for the destination of the audit logs. The destination can be any Amazon CloudWatch Logs log group ARN or Amazon Kinesis Data Firehose delivery stream ARN. Can be specified when `file_access_audit_log_level` and `file_share_access_audit_log_level` are not set to `DISABLED`. The name of the Amazon CloudWatch Logs log group must begin with the `/aws/fsx` prefix. The name of the Amazon Kinesis Data Firehouse delivery stream must begin with the `aws-fsx` prefix. If you do not provide a destination in `audit_log_destionation`, Amazon FSx will create and use a log stream in the CloudWatch Logs /aws/fsx/windows log group.
+* `file_access_audit_log_level` - (Optional) Sets which attempt type is logged by Amazon FSx for file and folder accesses. Valid values are `SUCCESS_ONLY`, `FAILURE_ONLY`, `SUCCESS_AND_FAILURE`, and `DISABLED`. Default value is `DISABLED`.
+* `file_share_access_audit_log_level` - (Optional) Sets which attempt type is logged by Amazon FSx for file share accesses. Valid values are `SUCCESS_ONLY`, `FAILURE_ONLY`, `SUCCESS_AND_FAILURE`, and `DISABLED`. Default value is `DISABLED`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name of the file system.
+* `dns_name` - DNS name for the file system, e.g., `fs-12345678.corp.example.com` (domain name matching the Active Directory domain name)
+* `id` - Identifier of the file system (e.g. `fs-12345678`).
+* `network_interface_ids` - Set of Elastic Network Interface identifiers from which the file system is accessible.
+* `owner_id` - AWS account identifier that created the file system.
+* `preferred_file_server_ip` - The IP address of the primary, or preferred, file server.
+* `remote_administration_endpoint` - For `MULTI_AZ_1` deployment types, use this endpoint when performing administrative tasks on the file system using Amazon FSx Remote PowerShell. For `SINGLE_AZ_1` deployment types, this is the DNS name of the file system.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `vpc_id` - Identifier of the Virtual Private Cloud for the file system.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `45m`)
+* `delete` - (Default `30m`)
+* `update` - (Default `45m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import FSx File Systems using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import FSx File Systems using the `id`. For example:
+
+```console
+% terraform import aws_fsx_windows_file_system.example fs-543ab12b1ca672f33
+```
+
+Certain resource arguments, like `security_group_ids` and the `self_managed_active_directory` configuation block `password`, do not have a FSx API method for reading the information after creation. If these arguments are set in the Terraform configuration on an imported resource, Terraform will always show a difference. To workaround this behavior, either omit the argument from the Terraform configuration or use [`ignore_changes`](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html#ignore_changes) to hide the difference. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from cdktf import TerraformResourceLifecycle
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.fsx_windows_file_system import FsxWindowsFileSystem
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, subnetIds, throughputCapacity):
+        super().__init__(scope, name)
+        FsxWindowsFileSystem(self, "example",
+            lifecycle=TerraformResourceLifecycle(
+                ignore_changes=[security_group_ids]
+            ),
+            security_group_ids=[Token.as_string(aws_security_group_example.id)],
+            subnet_ids=subnet_ids,
+            throughput_capacity=throughput_capacity
+        )
+```
+
+<!-- cache-key: cdktf-0.18.0 input-31e24eac31454cd45208a9da64e10292bbdac7ddfbe8990731498cf18fa7de07 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/gamelift_alias.html.markdown b/website/docs/cdktf/python/r/gamelift_alias.html.markdown
new file mode 100644
index 00000000000..42fc27addb2
--- /dev/null
+++ b/website/docs/cdktf/python/r/gamelift_alias.html.markdown
@@ -0,0 +1,83 @@
+---
+subcategory: "GameLift"
+layout: "aws"
+page_title: "AWS: aws_gamelift_alias"
+description: |-
+  Provides a GameLift Alias resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_gamelift_alias
+
+Provides a GameLift Alias resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.gamelift_alias import GameliftAlias
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        GameliftAlias(self, "example",
+            description="Example Description",
+            name="example-alias",
+            routing_strategy=GameliftAliasRoutingStrategy(
+                message="Example Message",
+                type="TERMINAL"
+            )
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) Name of the alias.
+* `description` - (Optional) Description of the alias.
+* `routing_strategy` - (Required) Specifies the fleet and/or routing type to use for the alias.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Nested Fields
+
+#### `routing_strategy`
+
+* `fleet_id` - (Optional) ID of the GameLift Fleet to point the alias to.
+* `message` - (Optional) Message text to be used with the `TERMINAL` routing strategy.
+* `type` - (Required) Type of routing strategyE.g., `SIMPLE` or `TERMINAL`
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Alias ID.
+* `arn` - Alias ARN.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import GameLift Aliases using the ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import GameLift Aliases using the ID. For example:
+
+```console
+% terraform import aws_gamelift_alias.example <alias-id>
+```
+
+<!-- cache-key: cdktf-0.18.0 input-0388556f6d66db5cdeeff13f1605184c6bf94fb66ae580f7a99c34af9b175b72 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/gamelift_build.html.markdown b/website/docs/cdktf/python/r/gamelift_build.html.markdown
new file mode 100644
index 00000000000..8f12f2551af
--- /dev/null
+++ b/website/docs/cdktf/python/r/gamelift_build.html.markdown
@@ -0,0 +1,86 @@
+---
+subcategory: "GameLift"
+layout: "aws"
+page_title: "AWS: aws_gamelift_build"
+description: |-
+  Provides a GameLift Build resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_gamelift_build
+
+Provides an GameLift Build resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.gamelift_build import GameliftBuild
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        GameliftBuild(self, "test",
+            name="example-build",
+            operating_system="WINDOWS_2012",
+            storage_location=GameliftBuildStorageLocation(
+                bucket=Token.as_string(aws_s3_bucket_test.id),
+                key=Token.as_string(aws_s3_object_test.key),
+                role_arn=Token.as_string(aws_iam_role_test.arn)
+            )
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) Name of the build
+* `operating_system` - (Required) Operating system that the game server binaries are built to run onE.g., `WINDOWS_2012`, `AMAZON_LINUX` or `AMAZON_LINUX_2`.
+* `storage_location` - (Required) Information indicating where your game build files are stored. See below.
+* `version` - (Optional) Version that is associated with this build.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Nested Fields
+
+#### `storage_location`
+
+* `bucket` - (Required) Name of your S3 bucket.
+* `key` - (Required) Name of the zip file containing your build files.
+* `role_arn` - (Required) ARN of the access role that allows Amazon GameLift to access your S3 bucket.
+* `object_version` - (Optional) A specific version of the file. If not set, the latest version of the file is retrieved.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - GameLift Build ID.
+* `arn` - GameLift Build ARN.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import GameLift Builds using the ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import GameLift Builds using the ID. For example:
+
+```console
+% terraform import aws_gamelift_build.example <build-id>
+```
+
+<!-- cache-key: cdktf-0.18.0 input-c2f0faa65301c95ac0436ad1af88ccbf7979ead6e43e9ac51b389783a62ddcfb -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/gamelift_fleet.html.markdown b/website/docs/cdktf/python/r/gamelift_fleet.html.markdown
new file mode 100644
index 00000000000..ee7b8940924
--- /dev/null
+++ b/website/docs/cdktf/python/r/gamelift_fleet.html.markdown
@@ -0,0 +1,119 @@
+---
+subcategory: "GameLift"
+layout: "aws"
+page_title: "AWS: aws_gamelift_fleet"
+description: |-
+  Provides a GameLift Fleet resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_gamelift_fleet
+
+Provides a GameLift Fleet resource.
+
+## Example Usage
+
+```terraform
+resource "aws_gamelift_fleet" "example" {
+  build_id          = aws_gamelift_build.example.id
+  ec2_instance_type = "t2.micro"
+  fleet_type        = "ON_DEMAND"
+  name              = "example-fleet-name"
+
+  runtime_configuration {
+    server_process {
+      concurrent_executions = 1
+      launch_path           = "C:\\game\\GomokuServer.exe"
+    }
+  }
+}
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `build_id` - (Optional) ID of the GameLift Build to be deployed on the fleet.
+* `certificate_configuration` - (Optional) Prompts GameLift to generate a TLS/SSL certificate for the fleet. See [certificate_configuration](#certificate_configuration).
+* `description` - (Optional) Human-readable description of the fleet.
+* `ec2_inbound_permission` - (Optional) Range of IP addresses and port settings that permit inbound traffic to access server processes running on the fleet. See below.
+* `ec2_instance_type` - (Required) Name of an EC2 instance typeE.g., `t2.micro`
+* `fleet_type` - (Optional) Type of fleet. This value must be `ON_DEMAND` or `SPOT`. Defaults to `ON_DEMAND`.
+* `instance_role_arn` - (Optional) ARN of an IAM role that instances in the fleet can assume.
+* `metric_groups` - (Optional) List of names of metric groups to add this fleet to. A metric group tracks metrics across all fleets in the group. Defaults to `default`.
+* `name` - (Required) The name of the fleet.
+* `new_game_session_protection_policy` - (Optional) Game session protection policy to apply to all instances in this fleetE.g., `FullProtection`. Defaults to `NoProtection`.
+* `resource_creation_limit_policy` - (Optional) Policy that limits the number of game sessions an individual player can create over a span of time for this fleet. See below.
+* `runtime_configuration` - (Optional) Instructions for launching server processes on each instance in the fleet. See below.
+* `script_id` - (Optional) ID of the GameLift Script to be deployed on the fleet.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Nested Fields
+
+#### `certificate_configuration`
+
+* `certificate_type` - (Optional) Indicates whether a TLS/SSL certificate is generated for a fleet. Valid values are `DISABLED` and `GENERATED`. Default value is `DISABLED`.
+
+#### `ec2_inbound_permission`
+
+* `from_port` - (Required) Starting value for a range of allowed port numbers.
+* `ip_range` - (Required) Range of allowed IP addresses expressed in CIDR notationE.g., `000.000.000.000/[subnet mask]` or `0.0.0.0/[subnet mask]`.
+* `protocol` - (Required) Network communication protocol used by the fleetE.g., `TCP` or `UDP`
+* `to_port` - (Required) Ending value for a range of allowed port numbers. Port numbers are end-inclusive. This value must be higher than `from_port`.
+
+#### `resource_creation_limit_policy`
+
+* `new_game_sessions_per_creator` - (Optional) Maximum number of game sessions that an individual can create during the policy period.
+* `policy_period_in_minutes` - (Optional) Time span used in evaluating the resource creation limit policy.
+
+#### `runtime_configuration`
+
+* `game_session_activation_timeout_seconds` - (Optional) Maximum amount of time (in seconds) that a game session can remain in status `ACTIVATING`.
+* `max_concurrent_game_session_activations` - (Optional) Maximum number of game sessions with status `ACTIVATING` to allow on an instance simultaneously.
+* `server_process` - (Optional) Collection of server process configurations that describe which server processes to run on each instance in a fleet. See below.
+
+#### `server_process`
+
+* `concurrent_executions` - (Required) Number of server processes using this configuration to run concurrently on an instance.
+* `launch_path` - (Required) Location of the server executable in a game build. All game builds are installed on instances at the root : for Windows instances `C:\game`, and for Linux instances `/local/game`.
+* `parameters` - (Optional) Optional list of parameters to pass to the server executable on launch.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Fleet ID.
+* `arn` - Fleet ARN.
+* `build_arn` - Build ARN.
+* `operating_system` - Operating system of the fleet's computing resources.
+* `script_arn` - Script ARN.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `70m`)
+* `delete` - (Default `20m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import GameLift Fleets using the ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import GameLift Fleets using the ID. For example:
+
+```console
+% terraform import aws_gamelift_fleet.example <fleet-id>
+```
+
+<!-- cache-key: cdktf-0.18.0 input-3bb7364110eb682f1c0a8b20937e245e89dbedcb5915fce66d3f5e59fd6676d6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/gamelift_game_server_group.html.markdown b/website/docs/cdktf/python/r/gamelift_game_server_group.html.markdown
new file mode 100644
index 00000000000..e6cb5d65cbd
--- /dev/null
+++ b/website/docs/cdktf/python/r/gamelift_game_server_group.html.markdown
@@ -0,0 +1,233 @@
+---
+subcategory: "GameLift"
+layout: "aws"
+page_title: "AWS: aws_gamelift_game_server_group"
+description: |-
+  Provides a GameLift Game Server Group resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_gamelift_game_server_group
+
+Provides an GameLift Game Server Group resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.gamelift_game_server_group import GameliftGameServerGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        GameliftGameServerGroup(self, "example",
+            depends_on=[aws_iam_role_policy_attachment_example],
+            game_server_group_name="example",
+            instance_definition=[GameliftGameServerGroupInstanceDefinition(
+                instance_type="c5.large"
+            ), GameliftGameServerGroupInstanceDefinition(
+                instance_type="c5a.large"
+            )
+            ],
+            launch_template=GameliftGameServerGroupLaunchTemplate(
+                id=Token.as_string(aws_launch_template_example.id)
+            ),
+            max_size=1,
+            min_size=1,
+            role_arn=Token.as_string(aws_iam_role_example.arn)
+        )
+```
+
+Full usage:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.gamelift_game_server_group import GameliftGameServerGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        GameliftGameServerGroup(self, "example",
+            auto_scaling_policy=GameliftGameServerGroupAutoScalingPolicy(
+                estimated_instance_warmup=60,
+                target_tracking_configuration=GameliftGameServerGroupAutoScalingPolicyTargetTrackingConfiguration(
+                    target_value=75
+                )
+            ),
+            balancing_strategy="SPOT_ONLY",
+            depends_on=[aws_iam_role_policy_attachment_example],
+            game_server_group_name="example",
+            game_server_protection_policy="FULL_PROTECTION",
+            instance_definition=[GameliftGameServerGroupInstanceDefinition(
+                instance_type="c5.large",
+                weighted_capacity="1"
+            ), GameliftGameServerGroupInstanceDefinition(
+                instance_type="c5.2xlarge",
+                weighted_capacity="2"
+            )
+            ],
+            launch_template=GameliftGameServerGroupLaunchTemplate(
+                id=Token.as_string(aws_launch_template_example.id),
+                version="1"
+            ),
+            max_size=1,
+            min_size=1,
+            role_arn=Token.as_string(aws_iam_role_example.arn),
+            tags={
+                "Name": "example"
+            },
+            vpc_subnets=["subnet-12345678", "subnet-23456789"]
+        )
+```
+
+### Example IAM Role for GameLift Game Server Group
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.data_aws_partition import DataAwsPartition
+from imports.aws.iam_role import IamRole
+from imports.aws.iam_role_policy_attachment import IamRolePolicyAttachment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        assume_role = DataAwsIamPolicyDocument(self, "assume_role",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["sts:AssumeRole"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["autoscaling.amazonaws.com", "gamelift.amazonaws.com"
+                    ],
+                    type="Service"
+                )
+                ]
+            )
+            ]
+        )
+        current = DataAwsPartition(self, "current")
+        example = IamRole(self, "example",
+            assume_role_policy=Token.as_string(assume_role.json),
+            name="gamelift-game-server-group-example"
+        )
+        aws_iam_role_policy_attachment_example = IamRolePolicyAttachment(self, "example_3",
+            policy_arn="arn:${" + current.partition + "}:iam::aws:policy/GameLiftGameServerGroupPolicy",
+            role=example.name
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_role_policy_attachment_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `balancing_strategy` - (Optional) Indicates how GameLift FleetIQ balances the use of Spot Instances and On-Demand Instances.
+  Valid values: `SPOT_ONLY`, `SPOT_PREFERRED`, `ON_DEMAND_ONLY`. Defaults to `SPOT_PREFERRED`.
+* `game_server_group_name` - (Required) Name of the game server group.
+  This value is used to generate unique ARN identifiers for the EC2 Auto Scaling group and the GameLift FleetIQ game server group.
+* `game_server_protection_policy` - (Optional) Indicates whether instances in the game server group are protected from early termination.
+  Unprotected instances that have active game servers running might be terminated during a scale-down event,
+  causing players to be dropped from the game.
+  Protected instances cannot be terminated while there are active game servers running except in the event
+  of a forced game server group deletion.
+  Valid values: `NO_PROTECTION`, `FULL_PROTECTION`. Defaults to `NO_PROTECTION`.
+* `max_size` - (Required) The maximum number of instances allowed in the EC2 Auto Scaling group.
+  During automatic scaling events, GameLift FleetIQ and EC2 do not scale up the group above this maximum.
+* `min_size` - (Required) The minimum number of instances allowed in the EC2 Auto Scaling group.
+  During automatic scaling events, GameLift FleetIQ and EC2 do not scale down the group below this minimum.
+* `role_arn` - (Required) ARN for an IAM role that allows Amazon GameLift to access your EC2 Auto Scaling groups.
+* `tags` - (Optional) Key-value map of resource tags
+* `vpc_subnets` - (Optional) A list of VPC subnets to use with instances in the game server group.
+  By default, all GameLift FleetIQ-supported Availability Zones are used.
+
+### `auto_scaling_policy`
+
+Configuration settings to define a scaling policy for the Auto Scaling group that is optimized for game hosting.
+The scaling policy uses the metric `PercentUtilizedGameServers` to maintain a buffer of idle game servers that
+can immediately accommodate new games and players.
+
+* `estimated_instance_warmup` - (Optional) Length of time, in seconds, it takes for a new instance to start
+  new game server processes and register with GameLift FleetIQ.
+  Specifying a warm-up time can be useful, particularly with game servers that take a long time to start up,
+  because it avoids prematurely starting new instances. Defaults to `60`.
+
+#### `target_tracking_configuration`
+
+Settings for a target-based scaling policy applied to Auto Scaling group.
+These settings are used to create a target-based policy that tracks the GameLift FleetIQ metric `PercentUtilizedGameServers`
+and specifies a target value for the metric.
+
+* `target_value` - (Required) Desired value to use with a game server group target-based scaling policy.
+
+### `instance_definition`
+
+The EC2 instance types and sizes to use in the Auto Scaling group.
+The instance definitions must specify at least two different instance types that are supported by GameLift FleetIQ.
+
+* `instance_type` - (Required) An EC2 instance type.
+* `weighted_capacity` - (Optional) Instance weighting that indicates how much this instance type contributes
+  to the total capacity of a game server group.
+  Instance weights are used by GameLift FleetIQ to calculate the instance type's cost per unit hour and better identify
+  the most cost-effective options.
+
+### `launch_template`
+
+The EC2 launch template that contains configuration settings and game server code to be deployed to all instances in the game server group.
+You can specify the template using either the template name or ID.
+
+* `id` - (Optional) A unique identifier for an existing EC2 launch template.
+* `name` - (Optional) A readable identifier for an existing EC2 launch template.
+* `version` - (Optional) The version of the EC2 launch template to use. If none is set, the default is the first version created.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name of the GameLift Game Server Group.
+* `arn` - The ARN of the GameLift Game Server Group.
+* `auto_scaling_group_arn` - The ARN of the created EC2 Auto Scaling group.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `10m`)
+* `delete` - (Default `30m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import GameLift Game Server Group using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import GameLift Game Server Group using the `name`. For example:
+
+```console
+% terraform import aws_gamelift_game_server_group.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-366bd6af5a933ffff5198fbc9bb42ed30d90f3b3e04f89cb1b84627bb8a40b8c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/gamelift_game_server_group.markdown b/website/docs/cdktf/python/r/gamelift_game_server_group.markdown
new file mode 100644
index 00000000000..e6cb5d65cbd
--- /dev/null
+++ b/website/docs/cdktf/python/r/gamelift_game_server_group.markdown
@@ -0,0 +1,233 @@
+---
+subcategory: "GameLift"
+layout: "aws"
+page_title: "AWS: aws_gamelift_game_server_group"
+description: |-
+  Provides a GameLift Game Server Group resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_gamelift_game_server_group
+
+Provides an GameLift Game Server Group resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.gamelift_game_server_group import GameliftGameServerGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        GameliftGameServerGroup(self, "example",
+            depends_on=[aws_iam_role_policy_attachment_example],
+            game_server_group_name="example",
+            instance_definition=[GameliftGameServerGroupInstanceDefinition(
+                instance_type="c5.large"
+            ), GameliftGameServerGroupInstanceDefinition(
+                instance_type="c5a.large"
+            )
+            ],
+            launch_template=GameliftGameServerGroupLaunchTemplate(
+                id=Token.as_string(aws_launch_template_example.id)
+            ),
+            max_size=1,
+            min_size=1,
+            role_arn=Token.as_string(aws_iam_role_example.arn)
+        )
+```
+
+Full usage:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.gamelift_game_server_group import GameliftGameServerGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        GameliftGameServerGroup(self, "example",
+            auto_scaling_policy=GameliftGameServerGroupAutoScalingPolicy(
+                estimated_instance_warmup=60,
+                target_tracking_configuration=GameliftGameServerGroupAutoScalingPolicyTargetTrackingConfiguration(
+                    target_value=75
+                )
+            ),
+            balancing_strategy="SPOT_ONLY",
+            depends_on=[aws_iam_role_policy_attachment_example],
+            game_server_group_name="example",
+            game_server_protection_policy="FULL_PROTECTION",
+            instance_definition=[GameliftGameServerGroupInstanceDefinition(
+                instance_type="c5.large",
+                weighted_capacity="1"
+            ), GameliftGameServerGroupInstanceDefinition(
+                instance_type="c5.2xlarge",
+                weighted_capacity="2"
+            )
+            ],
+            launch_template=GameliftGameServerGroupLaunchTemplate(
+                id=Token.as_string(aws_launch_template_example.id),
+                version="1"
+            ),
+            max_size=1,
+            min_size=1,
+            role_arn=Token.as_string(aws_iam_role_example.arn),
+            tags={
+                "Name": "example"
+            },
+            vpc_subnets=["subnet-12345678", "subnet-23456789"]
+        )
+```
+
+### Example IAM Role for GameLift Game Server Group
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.data_aws_partition import DataAwsPartition
+from imports.aws.iam_role import IamRole
+from imports.aws.iam_role_policy_attachment import IamRolePolicyAttachment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        assume_role = DataAwsIamPolicyDocument(self, "assume_role",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["sts:AssumeRole"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["autoscaling.amazonaws.com", "gamelift.amazonaws.com"
+                    ],
+                    type="Service"
+                )
+                ]
+            )
+            ]
+        )
+        current = DataAwsPartition(self, "current")
+        example = IamRole(self, "example",
+            assume_role_policy=Token.as_string(assume_role.json),
+            name="gamelift-game-server-group-example"
+        )
+        aws_iam_role_policy_attachment_example = IamRolePolicyAttachment(self, "example_3",
+            policy_arn="arn:${" + current.partition + "}:iam::aws:policy/GameLiftGameServerGroupPolicy",
+            role=example.name
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_role_policy_attachment_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `balancing_strategy` - (Optional) Indicates how GameLift FleetIQ balances the use of Spot Instances and On-Demand Instances.
+  Valid values: `SPOT_ONLY`, `SPOT_PREFERRED`, `ON_DEMAND_ONLY`. Defaults to `SPOT_PREFERRED`.
+* `game_server_group_name` - (Required) Name of the game server group.
+  This value is used to generate unique ARN identifiers for the EC2 Auto Scaling group and the GameLift FleetIQ game server group.
+* `game_server_protection_policy` - (Optional) Indicates whether instances in the game server group are protected from early termination.
+  Unprotected instances that have active game servers running might be terminated during a scale-down event,
+  causing players to be dropped from the game.
+  Protected instances cannot be terminated while there are active game servers running except in the event
+  of a forced game server group deletion.
+  Valid values: `NO_PROTECTION`, `FULL_PROTECTION`. Defaults to `NO_PROTECTION`.
+* `max_size` - (Required) The maximum number of instances allowed in the EC2 Auto Scaling group.
+  During automatic scaling events, GameLift FleetIQ and EC2 do not scale up the group above this maximum.
+* `min_size` - (Required) The minimum number of instances allowed in the EC2 Auto Scaling group.
+  During automatic scaling events, GameLift FleetIQ and EC2 do not scale down the group below this minimum.
+* `role_arn` - (Required) ARN for an IAM role that allows Amazon GameLift to access your EC2 Auto Scaling groups.
+* `tags` - (Optional) Key-value map of resource tags
+* `vpc_subnets` - (Optional) A list of VPC subnets to use with instances in the game server group.
+  By default, all GameLift FleetIQ-supported Availability Zones are used.
+
+### `auto_scaling_policy`
+
+Configuration settings to define a scaling policy for the Auto Scaling group that is optimized for game hosting.
+The scaling policy uses the metric `PercentUtilizedGameServers` to maintain a buffer of idle game servers that
+can immediately accommodate new games and players.
+
+* `estimated_instance_warmup` - (Optional) Length of time, in seconds, it takes for a new instance to start
+  new game server processes and register with GameLift FleetIQ.
+  Specifying a warm-up time can be useful, particularly with game servers that take a long time to start up,
+  because it avoids prematurely starting new instances. Defaults to `60`.
+
+#### `target_tracking_configuration`
+
+Settings for a target-based scaling policy applied to Auto Scaling group.
+These settings are used to create a target-based policy that tracks the GameLift FleetIQ metric `PercentUtilizedGameServers`
+and specifies a target value for the metric.
+
+* `target_value` - (Required) Desired value to use with a game server group target-based scaling policy.
+
+### `instance_definition`
+
+The EC2 instance types and sizes to use in the Auto Scaling group.
+The instance definitions must specify at least two different instance types that are supported by GameLift FleetIQ.
+
+* `instance_type` - (Required) An EC2 instance type.
+* `weighted_capacity` - (Optional) Instance weighting that indicates how much this instance type contributes
+  to the total capacity of a game server group.
+  Instance weights are used by GameLift FleetIQ to calculate the instance type's cost per unit hour and better identify
+  the most cost-effective options.
+
+### `launch_template`
+
+The EC2 launch template that contains configuration settings and game server code to be deployed to all instances in the game server group.
+You can specify the template using either the template name or ID.
+
+* `id` - (Optional) A unique identifier for an existing EC2 launch template.
+* `name` - (Optional) A readable identifier for an existing EC2 launch template.
+* `version` - (Optional) The version of the EC2 launch template to use. If none is set, the default is the first version created.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name of the GameLift Game Server Group.
+* `arn` - The ARN of the GameLift Game Server Group.
+* `auto_scaling_group_arn` - The ARN of the created EC2 Auto Scaling group.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `10m`)
+* `delete` - (Default `30m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import GameLift Game Server Group using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import GameLift Game Server Group using the `name`. For example:
+
+```console
+% terraform import aws_gamelift_game_server_group.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-366bd6af5a933ffff5198fbc9bb42ed30d90f3b3e04f89cb1b84627bb8a40b8c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/gamelift_game_session_queue.html.markdown b/website/docs/cdktf/python/r/gamelift_game_session_queue.html.markdown
new file mode 100644
index 00000000000..0e0de8f65a7
--- /dev/null
+++ b/website/docs/cdktf/python/r/gamelift_game_session_queue.html.markdown
@@ -0,0 +1,89 @@
+---
+subcategory: "GameLift"
+layout: "aws"
+page_title: "AWS: aws_gamelift_game_session_queue"
+description: |-
+  Provides a GameLift Game Session Queue resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_gamelift_game_session_queue
+
+Provides an GameLift Game Session Queue resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.gamelift_game_session_queue import GameliftGameSessionQueue
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        GameliftGameSessionQueue(self, "test",
+            destinations=[us_west2_fleet.arn, eu_central1_fleet.arn],
+            name="example-session-queue",
+            notification_target=game_session_queue_notifications.arn,
+            player_latency_policy=[GameliftGameSessionQueuePlayerLatencyPolicy(
+                maximum_individual_player_latency_milliseconds=100,
+                policy_duration_seconds=5
+            ), GameliftGameSessionQueuePlayerLatencyPolicy(
+                maximum_individual_player_latency_milliseconds=200
+            )
+            ],
+            timeout_in_seconds=60
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) Name of the session queue.
+* `timeout_in_seconds` - (Required) Maximum time a game session request can remain in the queue.
+* `custom_event_data` - (Optional) Information to be added to all events that are related to this game session queue.
+* `destinations` - (Optional) List of fleet/alias ARNs used by session queue for placing game sessions.
+* `notification_target` - (Optional) An SNS topic ARN that is set up to receive game session placement notifications.
+* `player_latency_policy` - (Optional) One or more policies used to choose fleet based on player latency. See below.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Nested Fields
+
+#### `player_latency_policy`
+
+* `maximum_individual_player_latency_milliseconds` - (Required) Maximum latency value that is allowed for any player.
+* `policy_duration_seconds` - (Optional) Length of time that the policy is enforced while placing a new game session. Absence of value for this attribute means that the policy is enforced until the queue times out.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Game Session Queue ARN.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import GameLift Game Session Queues using their `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import GameLift Game Session Queues using their `name`. For example:
+
+```console
+% terraform import aws_gamelift_game_session_queue.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1e69f1135cf583861ec3815dcbcde5d0ca2b5117945e9f7a46b7008c92b6115a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/gamelift_script.html.markdown b/website/docs/cdktf/python/r/gamelift_script.html.markdown
new file mode 100644
index 00000000000..b2ed1c71134
--- /dev/null
+++ b/website/docs/cdktf/python/r/gamelift_script.html.markdown
@@ -0,0 +1,85 @@
+---
+subcategory: "GameLift"
+layout: "aws"
+page_title: "AWS: aws_gamelift_script"
+description: |-
+  Provides a GameLift Script resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_gamelift_script
+
+Provides an GameLift Script resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.gamelift_script import GameliftScript
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        GameliftScript(self, "example",
+            name="example-script",
+            storage_location=GameliftScriptStorageLocation(
+                bucket=Token.as_string(aws_s3_bucket_example.id),
+                key=Token.as_string(aws_s3_object_example.key),
+                role_arn=Token.as_string(aws_iam_role_example.arn)
+            )
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) Name of the script
+* `storage_location` - (Optional) Information indicating where your game script files are stored. See below.
+* `version` - (Optional) Version that is associated with this script.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `zip_file` - (Optional) A data object containing your Realtime scripts and dependencies as a zip  file. The zip file can have one or multiple files. Maximum size of a zip file is 5 MB.
+
+### Nested Fields
+
+#### `storage_location`
+
+* `bucket` - (Required) Name of your S3 bucket.
+* `key` - (Required) Name of the zip file containing your script files.
+* `role_arn` - (Required) ARN of the access role that allows Amazon GameLift to access your S3 bucket.
+* `object_version` - (Optional) A specific version of the file. If not set, the latest version of the file is retrieved.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - GameLift Script ID.
+* `arn` - GameLift Script ARN.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import GameLift Scripts using the ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import GameLift Scripts using the ID. For example:
+
+```console
+% terraform import aws_gamelift_script.example <script-id>
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ea65675a0727f9e5f10a03be30cedabffe531a0a9407f9d714cbdeca2fce29dc -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/glacier_vault.html.markdown b/website/docs/cdktf/python/r/glacier_vault.html.markdown
new file mode 100644
index 00000000000..b1ec7d3f27c
--- /dev/null
+++ b/website/docs/cdktf/python/r/glacier_vault.html.markdown
@@ -0,0 +1,108 @@
+---
+subcategory: "S3 Glacier"
+layout: "aws"
+page_title: "AWS: aws_glacier_vault"
+description: |-
+  Provides a Glacier Vault.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_glacier_vault
+
+Provides a Glacier Vault Resource. You can refer to the [Glacier Developer Guide](https://docs.aws.amazon.com/amazonglacier/latest/dev/working-with-vaults.html) for a full explanation of the Glacier Vault functionality
+
+~> **NOTE:** When removing a Glacier Vault, the Vault must be empty.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.glacier_vault import GlacierVault
+from imports.aws.sns_topic import SnsTopic
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        aws_sns_topic = SnsTopic(self, "aws_sns_topic",
+            name="glacier-sns-topic"
+        )
+        my_archive = DataAwsIamPolicyDocument(self, "my_archive",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["glacier:InitiateJob", "glacier:GetJobOutput"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["*"],
+                    type="*"
+                )
+                ],
+                resources=["arn:aws:glacier:eu-west-1:432981146916:vaults/MyArchive"
+                ],
+                sid="add-read-only-perm"
+            )
+            ]
+        )
+        aws_glacier_vault_my_archive = GlacierVault(self, "my_archive_2",
+            access_policy=Token.as_string(my_archive.json),
+            name="MyArchive",
+            notification=GlacierVaultNotification(
+                events=["ArchiveRetrievalCompleted", "InventoryRetrievalCompleted"],
+                sns_topic=aws_sns_topic.arn
+            ),
+            tags={
+                "Test": "MyArchive"
+            }
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_glacier_vault_my_archive.override_logical_id("my_archive")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the Vault. Names can be between 1 and 255 characters long and the valid characters are a-z, A-Z, 0-9, '_' (underscore), '-' (hyphen), and '.' (period).
+* `access_policy` - (Optional) The policy document. This is a JSON formatted string.
+  The heredoc syntax or `file` function is helpful here. Use the [Glacier Developer Guide](https://docs.aws.amazon.com/amazonglacier/latest/dev/vault-access-policy.html) for more information on Glacier Vault Policy
+* `notification` - (Optional) The notifications for the Vault. Fields documented below.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+**notification** supports the following:
+
+* `events` - (Required) You can configure a vault to publish a notification for `ArchiveRetrievalCompleted` and `InventoryRetrievalCompleted` events.
+* `sns_topic` - (Required) The SNS Topic ARN.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `location` - The URI of the vault that was created.
+* `arn` - The ARN of the vault.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Glacier Vaults using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Glacier Vaults using the `name`. For example:
+
+```console
+% terraform import aws_glacier_vault.archive my_archive
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1bfb612252a42581f297e83a2d1f1c7c609160aeeb4a7bd67bccea5a3aa3cff5 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/glacier_vault_lock.html.markdown b/website/docs/cdktf/python/r/glacier_vault_lock.html.markdown
new file mode 100644
index 00000000000..5ce67da348a
--- /dev/null
+++ b/website/docs/cdktf/python/r/glacier_vault_lock.html.markdown
@@ -0,0 +1,120 @@
+---
+subcategory: "S3 Glacier"
+layout: "aws"
+page_title: "AWS: aws_glacier_vault_lock"
+description: |-
+  Manages a Glacier Vault Lock.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_glacier_vault_lock
+
+Manages a Glacier Vault Lock. You can refer to the [Glacier Developer Guide](https://docs.aws.amazon.com/amazonglacier/latest/dev/vault-lock.html) for a full explanation of the Glacier Vault Lock functionality.
+
+~> **NOTE:** This resource allows you to test Glacier Vault Lock policies by setting the `complete_lock` argument to `false`. When testing policies in this manner, the Glacier Vault Lock automatically expires after 24 hours and Terraform will show this resource as needing recreation after that time. To permanently apply the policy, set the `complete_lock` argument to `true`. When changing `complete_lock` to `true`, it is expected the resource will show as recreating.
+
+!> **WARNING:** Once a Glacier Vault Lock is completed, it is immutable. The deletion of the Glacier Vault Lock is not be possible and attempting to remove it from Terraform will return an error. Set the `ignore_deletion_error` argument to `true` and apply this configuration before attempting to delete this resource via Terraform or use `terraform state rm` to remove this resource from Terraform management.
+
+## Example Usage
+
+### Testing Glacier Vault Lock Policy
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.glacier_vault import GlacierVault
+from imports.aws.glacier_vault_lock import GlacierVaultLock
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = GlacierVault(self, "example",
+            name="example"
+        )
+        data_aws_iam_policy_document_example = DataAwsIamPolicyDocument(self, "example_1",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["glacier:DeleteArchive"],
+                condition=[DataAwsIamPolicyDocumentStatementCondition(
+                    test="NumericLessThanEquals",
+                    values=["365"],
+                    variable="glacier:ArchiveAgeinDays"
+                )
+                ],
+                effect="Deny",
+                resources=[example.arn]
+            )
+            ]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_iam_policy_document_example.override_logical_id("example")
+        aws_glacier_vault_lock_example = GlacierVaultLock(self, "example_2",
+            complete_lock=False,
+            policy=Token.as_string(data_aws_iam_policy_document_example.json),
+            vault_name=example.name
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_glacier_vault_lock_example.override_logical_id("example")
+```
+
+### Permanently Applying Glacier Vault Lock Policy
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.glacier_vault_lock import GlacierVaultLock
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        GlacierVaultLock(self, "example",
+            complete_lock=True,
+            policy=Token.as_string(data_aws_iam_policy_document_example.json),
+            vault_name=Token.as_string(aws_glacier_vault_example.name)
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `complete_lock` - (Required) Boolean whether to permanently apply this Glacier Lock Policy. Once completed, this cannot be undone. If set to `false`, the Glacier Lock Policy remains in a testing mode for 24 hours. After that time, the Glacier Lock Policy is automatically removed by Glacier and the Terraform resource will show as needing recreation. Changing this from `false` to `true` will show as resource recreation, which is expected. Changing this from `true` to `false` is not possible unless the Glacier Vault is recreated at the same time.
+* `policy` - (Required) JSON string containing the IAM policy to apply as the Glacier Vault Lock policy.
+* `vault_name` - (Required) The name of the Glacier Vault.
+* `ignore_deletion_error` - (Optional) Allow Terraform to ignore the error returned when attempting to delete the Glacier Lock Policy. This can be used to delete or recreate the Glacier Vault via Terraform, for example, if the Glacier Vault Lock policy permits that action. This should only be used in conjunction with `complete_lock` being set to `true`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Glacier Vault name.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Glacier Vault Locks using the Glacier Vault name. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Glacier Vault Locks using the Glacier Vault name. For example:
+
+```console
+% terraform import aws_glacier_vault_lock.example example-vault
+```
+
+<!-- cache-key: cdktf-0.18.0 input-518c16374c45cebffee79cb05e96dd966379682d9c133b507d51448663341de4 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/globalaccelerator_accelerator.html.markdown b/website/docs/cdktf/python/r/globalaccelerator_accelerator.html.markdown
new file mode 100644
index 00000000000..469f811e8b5
--- /dev/null
+++ b/website/docs/cdktf/python/r/globalaccelerator_accelerator.html.markdown
@@ -0,0 +1,105 @@
+---
+subcategory: "Global Accelerator"
+layout: "aws"
+page_title: "AWS: aws_globalaccelerator_accelerator"
+description: |-
+  Provides a Global Accelerator accelerator.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_globalaccelerator_accelerator
+
+Creates a Global Accelerator accelerator.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.globalaccelerator_accelerator import GlobalacceleratorAccelerator
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        GlobalacceleratorAccelerator(self, "example",
+            attributes=GlobalacceleratorAcceleratorAttributes(
+                flow_logs_enabled=True,
+                flow_logs_s3_bucket="example-bucket",
+                flow_logs_s3_prefix="flow-logs/"
+            ),
+            enabled=True,
+            ip_address_type="IPV4",
+            ip_addresses=["1.2.3.4"],
+            name="Example"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the accelerator.
+* `ip_address_type` - (Optional) The value for the address type. Defaults to `IPV4`. Valid values: `IPV4`, `DUAL_STACK`.
+* `ip_addresses` - (Optional) The IP addresses to use for BYOIP accelerators. If not specified, the service assigns IP addresses. Valid values: 1 or 2 IPv4 addresses.
+* `enabled` - (Optional) Indicates whether the accelerator is enabled. Defaults to `true`. Valid values: `true`, `false`.
+* `attributes` - (Optional) The attributes of the accelerator. Fields documented below.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+`attributes` supports the following arguments:
+
+* `flow_logs_enabled` - (Optional) Indicates whether flow logs are enabled. Defaults to `false`. Valid values: `true`, `false`.
+* `flow_logs_s3_bucket` - (Optional) The name of the Amazon S3 bucket for the flow logs. Required if `flow_logs_enabled` is `true`.
+* `flow_logs_s3_prefix` - (Optional) The prefix for the location in the Amazon S3 bucket for the flow logs. Required if `flow_logs_enabled` is `true`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Amazon Resource Name (ARN) of the accelerator.
+* `dns_name` - The DNS name of the accelerator. For example, `a5d53ff5ee6bca4ce.awsglobalaccelerator.com`.
+* `dual_stack_dns_name` - The Domain Name System (DNS) name that Global Accelerator creates that points to a dual-stack accelerator's four static IP addresses: two IPv4 addresses and two IPv6 addresses. For example, `a1234567890abcdef.dualstack.awsglobalaccelerator.com`.
+* `hosted_zone_id` --  The Global Accelerator Route 53 zone ID that can be used to
+  route an [Alias Resource Record Set][1] to the Global Accelerator. This attribute
+  is simply an alias for the zone ID `Z2BJ6XQ5FK7U4H`.
+* `ip_sets` - IP address set associated with the accelerator.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+**ip_sets** exports the following attributes:
+
+* `ip_addresses` - A list of IP addresses in the IP address set.
+* `ip_family` - The type of IP addresses included in this IP set.
+
+[1]: https://docs.aws.amazon.com/Route53/latest/APIReference/API_AliasTarget.html
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `30m`)
+* `update` - (Default `30m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Global Accelerator accelerators using the `arn`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Global Accelerator accelerators using the `arn`. For example:
+
+```console
+% terraform import aws_globalaccelerator_accelerator.example arn:aws:globalaccelerator::111111111111:accelerator/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
+```
+
+<!-- cache-key: cdktf-0.18.0 input-7f5b36602f0875f89018a31aa91d4a8e5d30b8b26a613494ca2259ff9749c761 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/globalaccelerator_custom_routing_accelerator.html.markdown b/website/docs/cdktf/python/r/globalaccelerator_custom_routing_accelerator.html.markdown
new file mode 100644
index 00000000000..790bb3f2c5a
--- /dev/null
+++ b/website/docs/cdktf/python/r/globalaccelerator_custom_routing_accelerator.html.markdown
@@ -0,0 +1,104 @@
+---
+subcategory: "Global Accelerator"
+layout: "aws"
+page_title: "AWS: aws_globalaccelerator_custom_routing_accelerator"
+description: |-
+  Provides a Global Accelerator custom routing accelerator.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_globalaccelerator_custom_routing_accelerator
+
+Creates a Global Accelerator custom routing accelerator.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.globalaccelerator_custom_routing_accelerator import GlobalacceleratorCustomRoutingAccelerator
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        GlobalacceleratorCustomRoutingAccelerator(self, "example",
+            attributes=GlobalacceleratorCustomRoutingAcceleratorAttributes(
+                flow_logs_enabled=True,
+                flow_logs_s3_bucket="example-bucket",
+                flow_logs_s3_prefix="flow-logs/"
+            ),
+            enabled=True,
+            ip_address_type="IPV4",
+            ip_addresses=["1.2.3.4"],
+            name="Example"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of a custom routing accelerator.
+* `ip_address_type` - (Optional) The IP address type that an accelerator supports. For a custom routing accelerator, the value must be `"IPV4"`.
+* `ip_addresses` - (Optional) The IP addresses to use for BYOIP accelerators. If not specified, the service assigns IP addresses. Valid values: 1 or 2 IPv4 addresses.
+* `enabled` - (Optional) Indicates whether the accelerator is enabled. Defaults to `true`. Valid values: `true`, `false`.
+* `attributes` - (Optional) The attributes of the accelerator. Fields documented below.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+`attributes` supports the following arguments:
+
+* `flow_logs_enabled` - (Optional) Indicates whether flow logs are enabled. Defaults to `false`. Valid values: `true`, `false`.
+* `flow_logs_s3_bucket` - (Optional) The name of the Amazon S3 bucket for the flow logs. Required if `flow_logs_enabled` is `true`.
+* `flow_logs_s3_prefix` - (Optional) The prefix for the location in the Amazon S3 bucket for the flow logs. Required if `flow_logs_enabled` is `true`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Amazon Resource Name (ARN) of the custom accelerator.
+* `dns_name` - The DNS name of the accelerator. For example, `a5d53ff5ee6bca4ce.awsglobalaccelerator.com`.
+* `hosted_zone_id` --  The Global Accelerator Route 53 zone ID that can be used to
+  route an [Alias Resource Record Set][1] to the Global Accelerator. This attribute
+  is simply an alias for the zone ID `Z2BJ6XQ5FK7U4H`.
+* `ip_sets` - IP address set associated with the accelerator.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+**ip_sets** exports the following attributes:
+
+* `ip_addresses` - A list of IP addresses in the IP address set.
+* `ip_family` - The type of IP addresses included in this IP set.
+
+[1]: https://docs.aws.amazon.com/Route53/latest/APIReference/API_AliasTarget.html
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `30m`)
+* `update` - (Default `30m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Global Accelerator custom routing accelerators using the `arn`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Global Accelerator custom routing accelerators using the `arn`. For example:
+
+```console
+% terraform import aws_globalaccelerator_custom_routing_accelerator.example arn:aws:globalaccelerator::111111111111:accelerator/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
+```
+
+<!-- cache-key: cdktf-0.18.0 input-765641ba0d03ea8679c57c2c3557a0495cf7d72f403588b6664a9e2b49f09bcd -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/globalaccelerator_custom_routing_endpoint_group.html.markdown b/website/docs/cdktf/python/r/globalaccelerator_custom_routing_endpoint_group.html.markdown
new file mode 100644
index 00000000000..3eaceb6e717
--- /dev/null
+++ b/website/docs/cdktf/python/r/globalaccelerator_custom_routing_endpoint_group.html.markdown
@@ -0,0 +1,97 @@
+---
+subcategory: "Global Accelerator"
+layout: "aws"
+page_title: "AWS: aws_globalaccelerator_custom_routing_endpoint_group"
+description: |-
+  Provides a Global Accelerator custom routing endpoint group.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_globalaccelerator_custom_routing_endpoint_group
+
+Provides a Global Accelerator custom routing endpoint group.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.globalaccelerator_custom_routing_endpoint_group import GlobalacceleratorCustomRoutingEndpointGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        GlobalacceleratorCustomRoutingEndpointGroup(self, "example",
+            destination_configuration=[GlobalacceleratorCustomRoutingEndpointGroupDestinationConfiguration(
+                from_port=80,
+                protocols=["TCP"],
+                to_port=8080
+            )
+            ],
+            endpoint_configuration=[GlobalacceleratorCustomRoutingEndpointGroupEndpointConfiguration(
+                endpoint_id=Token.as_string(aws_subnet_example.id)
+            )
+            ],
+            listener_arn=Token.as_string(aws_globalaccelerator_custom_routing_listener_example.id)
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `listener_arn` - (Required) The Amazon Resource Name (ARN) of the custom routing listener.
+* `destination_configuration` - (Required) The port ranges and protocols for all endpoints in a custom routing endpoint group to accept client traffic on. Fields documented below.
+* `endpoint_configuration` - (Optional) The list of endpoint objects. Fields documented below.
+* `endpoint_group_region` (Optional) - The name of the AWS Region where the custom routing endpoint group is located.
+
+`destination_configuration` supports the following arguments:
+
+* `from_port` - (Required) The first port, inclusive, in the range of ports for the endpoint group that is associated with a custom routing accelerator.
+* `protocols` - (Required) The protocol for the endpoint group that is associated with a custom routing accelerator. The protocol can be either `"TCP"` or `"UDP"`.
+* `to_port` - (Required) The last port, inclusive, in the range of ports for the endpoint group that is associated with a custom routing accelerator.
+
+`endpoint_configuration` supports the following arguments:
+
+* `endpoint_id` - (Optional) An ID for the endpoint. For custom routing accelerators, this is the virtual private cloud (VPC) subnet ID.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Amazon Resource Name (ARN) of the custom routing endpoint group.
+* `arn` - The Amazon Resource Name (ARN) of the custom routing endpoint group.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `30m`)
+* `update` - (Default `30m`)
+* `delete` - (Default `30m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Global Accelerator custom routing endpoint groups using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Global Accelerator custom routing endpoint groups using the `id`. For example:
+
+```console
+% terraform import aws_globalaccelerator_custom_routing_endpoint_group.example arn:aws:globalaccelerator::111111111111:accelerator/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/listener/xxxxxxx/endpoint-group/xxxxxxxx
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1cdf76aa1d7720de7b94c9800ff5e5f2715b300edfc472a4a81ea499fa6efa64 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/globalaccelerator_custom_routing_listener.html.markdown b/website/docs/cdktf/python/r/globalaccelerator_custom_routing_listener.html.markdown
new file mode 100644
index 00000000000..fa14a78c3a5
--- /dev/null
+++ b/website/docs/cdktf/python/r/globalaccelerator_custom_routing_listener.html.markdown
@@ -0,0 +1,98 @@
+---
+subcategory: "Global Accelerator"
+layout: "aws"
+page_title: "AWS: aws_globalaccelerator_custom_routing_listener"
+description: |-
+  Provides a Global Accelerator custom routing listener.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_globalaccelerator_custom_routing_listener
+
+Provides a Global Accelerator custom routing listener.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.globalaccelerator_custom_routing_accelerator import GlobalacceleratorCustomRoutingAccelerator
+from imports.aws.globalaccelerator_custom_routing_listener import GlobalacceleratorCustomRoutingListener
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = GlobalacceleratorCustomRoutingAccelerator(self, "example",
+            attributes=GlobalacceleratorCustomRoutingAcceleratorAttributes(
+                flow_logs_enabled=True,
+                flow_logs_s3_bucket="example-bucket",
+                flow_logs_s3_prefix="flow-logs/"
+            ),
+            enabled=True,
+            ip_address_type="IPV4",
+            name="Example"
+        )
+        aws_globalaccelerator_custom_routing_listener_example =
+        GlobalacceleratorCustomRoutingListener(self, "example_1",
+            accelerator_arn=example.id,
+            port_range=[GlobalacceleratorCustomRoutingListenerPortRange(
+                from_port=80,
+                to_port=80
+            )
+            ]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_globalaccelerator_custom_routing_listener_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `accelerator_arn` - (Required) The Amazon Resource Name (ARN) of a custom routing accelerator.
+* `port_range` - (Optional) The list of port ranges for the connections from clients to the accelerator. Fields documented below.
+
+`port_range` supports the following arguments:
+
+* `from_port` - (Optional) The first port in the range of ports, inclusive.
+* `to_port` - (Optional) The last port in the range of ports, inclusive.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Amazon Resource Name (ARN) of the custom routing listener.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `30m`)
+* `update` - (Default `30m`)
+* `delete` - (Default `30m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Global Accelerator custom routing listeners using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Global Accelerator custom routing listeners using the `id`. For example:
+
+```console
+% terraform import aws_globalaccelerator_custom_routing_listener.example arn:aws:globalaccelerator::111111111111:accelerator/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/listener/xxxxxxxx
+```
+
+<!-- cache-key: cdktf-0.18.0 input-7d9b14c85b89fb6ec7d4fa26f1cd657180812dab00b0742e6d404be95e64a568 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/globalaccelerator_endpoint_group.html.markdown b/website/docs/cdktf/python/r/globalaccelerator_endpoint_group.html.markdown
new file mode 100644
index 00000000000..c8e9a70a836
--- /dev/null
+++ b/website/docs/cdktf/python/r/globalaccelerator_endpoint_group.html.markdown
@@ -0,0 +1,101 @@
+---
+subcategory: "Global Accelerator"
+layout: "aws"
+page_title: "AWS: aws_globalaccelerator_endpoint_group"
+description: |-
+  Provides a Global Accelerator endpoint group.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_globalaccelerator_endpoint_group
+
+Provides a Global Accelerator endpoint group.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.globalaccelerator_endpoint_group import GlobalacceleratorEndpointGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        GlobalacceleratorEndpointGroup(self, "example",
+            endpoint_configuration=[GlobalacceleratorEndpointGroupEndpointConfiguration(
+                endpoint_id=Token.as_string(aws_lb_example.arn),
+                weight=100
+            )
+            ],
+            listener_arn=Token.as_string(aws_globalaccelerator_listener_example.id)
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `listener_arn` - (Required) The Amazon Resource Name (ARN) of the listener.
+* `endpoint_group_region` (Optional) - The name of the AWS Region where the endpoint group is located.
+* `health_check_interval_seconds` - (Optional) The time—10 seconds or 30 seconds—between each health check for an endpoint. The default value is 30.
+* `health_check_path` - (Optional) If the protocol is HTTP/S, then this specifies the path that is the destination for health check targets. The default value is slash (`/`). Terraform will only perform drift detection of its value when present in a configuration.
+* `health_check_port` - (Optional) The port that AWS Global Accelerator uses to check the health of endpoints that are part of this endpoint group. The default port is the listener port that this endpoint group is associated with. If listener port is a list of ports, Global Accelerator uses the first port in the list.
+Terraform will only perform drift detection of its value when present in a configuration.
+* `health_check_protocol` - (Optional) The protocol that AWS Global Accelerator uses to check the health of endpoints that are part of this endpoint group. The default value is TCP.
+* `threshold_count` - (Optional) The number of consecutive health checks required to set the state of a healthy endpoint to unhealthy, or to set an unhealthy endpoint to healthy. The default value is 3.
+* `traffic_dial_percentage` - (Optional) The percentage of traffic to send to an AWS Region. Additional traffic is distributed to other endpoint groups for this listener. The default value is 100.
+* `endpoint_configuration` - (Optional) The list of endpoint objects. Fields documented below.
+* `port_override` - (Optional) Override specific listener ports used to route traffic to endpoints that are part of this endpoint group. Fields documented below.
+
+`endpoint_configuration` supports the following arguments:
+
+* `client_ip_preservation_enabled` - (Optional) Indicates whether client IP address preservation is enabled for an Application Load Balancer endpoint. See the [AWS documentation](https://docs.aws.amazon.com/global-accelerator/latest/dg/preserve-client-ip-address.html) for more details. The default value is `false`.
+**Note:** When client IP address preservation is enabled, the Global Accelerator service creates an EC2 Security Group in the VPC named `GlobalAccelerator` that must be deleted (potentially outside of Terraform) before the VPC will successfully delete. If this EC2 Security Group is not deleted, Terraform will retry the VPC deletion for a few minutes before reporting a `DependencyViolation` error. This cannot be resolved by re-running Terraform.
+* `endpoint_id` - (Optional) An ID for the endpoint. If the endpoint is a Network Load Balancer or Application Load Balancer, this is the Amazon Resource Name (ARN) of the resource. If the endpoint is an Elastic IP address, this is the Elastic IP address allocation ID.
+* `weight` - (Optional) The weight associated with the endpoint. When you add weights to endpoints, you configure AWS Global Accelerator to route traffic based on proportions that you specify.
+
+`port_override` supports the following arguments:
+
+* `endpoint_port` - (Required) The endpoint port that you want a listener port to be mapped to. This is the port on the endpoint, such as the Application Load Balancer or Amazon EC2 instance.
+* `listener_port` - (Required) The listener port that you want to map to a specific endpoint port. This is the port that user traffic arrives to the Global Accelerator on.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Amazon Resource Name (ARN) of the endpoint group.
+* `arn` - The Amazon Resource Name (ARN) of the endpoint group.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `30m`)
+* `update` - (Default `30m`)
+* `delete` - (Default `30m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Global Accelerator endpoint groups using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Global Accelerator endpoint groups using the `id`. For example:
+
+```console
+% terraform import aws_globalaccelerator_endpoint_group.example arn:aws:globalaccelerator::111111111111:accelerator/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/listener/xxxxxxx/endpoint-group/xxxxxxxx
+```
+
+<!-- cache-key: cdktf-0.18.0 input-a99822bb8d802bdee38671c5875d85175be0aff6331a6b380641cb861eac7402 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/globalaccelerator_listener.html.markdown b/website/docs/cdktf/python/r/globalaccelerator_listener.html.markdown
new file mode 100644
index 00000000000..548f793832b
--- /dev/null
+++ b/website/docs/cdktf/python/r/globalaccelerator_listener.html.markdown
@@ -0,0 +1,101 @@
+---
+subcategory: "Global Accelerator"
+layout: "aws"
+page_title: "AWS: aws_globalaccelerator_listener"
+description: |-
+  Provides a Global Accelerator listener.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_globalaccelerator_listener
+
+Provides a Global Accelerator listener.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.globalaccelerator_accelerator import GlobalacceleratorAccelerator
+from imports.aws.globalaccelerator_listener import GlobalacceleratorListener
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = GlobalacceleratorAccelerator(self, "example",
+            attributes=GlobalacceleratorAcceleratorAttributes(
+                flow_logs_enabled=True,
+                flow_logs_s3_bucket="example-bucket",
+                flow_logs_s3_prefix="flow-logs/"
+            ),
+            enabled=True,
+            ip_address_type="IPV4",
+            name="Example"
+        )
+        aws_globalaccelerator_listener_example = GlobalacceleratorListener(self, "example_1",
+            accelerator_arn=example.id,
+            client_affinity="SOURCE_IP",
+            port_range=[GlobalacceleratorListenerPortRange(
+                from_port=80,
+                to_port=80
+            )
+            ],
+            protocol="TCP"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_globalaccelerator_listener_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `accelerator_arn` - (Required) The Amazon Resource Name (ARN) of your accelerator.
+* `client_affinity` - (Optional) Direct all requests from a user to the same endpoint. Valid values are `NONE`, `SOURCE_IP`. Default: `NONE`. If `NONE`, Global Accelerator uses the "five-tuple" properties of source IP address, source port, destination IP address, destination port, and protocol to select the hash value. If `SOURCE_IP`, Global Accelerator uses the "two-tuple" properties of source (client) IP address and destination IP address to select the hash value.
+* `protocol` - (Optional) The protocol for the connections from clients to the accelerator. Valid values are `TCP`, `UDP`.
+* `port_range` - (Optional) The list of port ranges for the connections from clients to the accelerator. Fields documented below.
+
+`port_range` supports the following arguments:
+
+* `from_port` - (Optional) The first port in the range of ports, inclusive.
+* `to_port` - (Optional) The last port in the range of ports, inclusive.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Amazon Resource Name (ARN) of the listener.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `30m`)
+* `update` - (Default `30m`)
+* `delete` - (Default `30m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Global Accelerator listeners using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Global Accelerator listeners using the `id`. For example:
+
+```console
+% terraform import aws_globalaccelerator_listener.example arn:aws:globalaccelerator::111111111111:accelerator/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/listener/xxxxxxxx
+```
+
+<!-- cache-key: cdktf-0.18.0 input-916b1c351e05097e7ddc260e23377eafd367b2e2e899550a7d4798b0d81ab853 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/glue_catalog_database.html.markdown b/website/docs/cdktf/python/r/glue_catalog_database.html.markdown
new file mode 100644
index 00000000000..9239d440014
--- /dev/null
+++ b/website/docs/cdktf/python/r/glue_catalog_database.html.markdown
@@ -0,0 +1,115 @@
+---
+subcategory: "Glue"
+layout: "aws"
+page_title: "AWS: aws_glue_catalog_database"
+description: |-
+  Provides a Glue Catalog Database.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_glue_catalog_database
+
+Provides a Glue Catalog Database Resource. You can refer to the [Glue Developer Guide](http://docs.aws.amazon.com/glue/latest/dg/populate-data-catalog.html) for a full explanation of the Glue Data Catalog functionality
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.glue_catalog_database import GlueCatalogDatabase
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        GlueCatalogDatabase(self, "aws_glue_catalog_database",
+            name="MyCatalogDatabase"
+        )
+```
+
+### Create Table Default Permissions
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.glue_catalog_database import GlueCatalogDatabase
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        GlueCatalogDatabase(self, "aws_glue_catalog_database",
+            create_table_default_permission=[GlueCatalogDatabaseCreateTableDefaultPermission(
+                permissions=["SELECT"],
+                principal=GlueCatalogDatabaseCreateTableDefaultPermissionPrincipal(
+                    data_lake_principal_identifier="IAM_ALLOWED_PRINCIPALS"
+                )
+            )
+            ],
+            name="MyCatalogDatabase"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `catalog_id` - (Optional) ID of the Glue Catalog to create the database in. If omitted, this defaults to the AWS Account ID.
+* `create_table_default_permission` - (Optional) Creates a set of default permissions on the table for principals. See [`create_table_default_permission`](#create_table_default_permission) below.
+* `description` - (Optional) Description of the database.
+* `location_uri` - (Optional) Location of the database (for example, an HDFS path).
+* `name` - (Required) Name of the database. The acceptable characters are lowercase letters, numbers, and the underscore character.
+* `parameters` - (Optional) List of key-value pairs that define parameters and properties of the database.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `target_database` - (Optional) Configuration block for a target database for resource linking. See [`target_database`](#target_database) below.
+
+### target_database
+
+* `catalog_id` - (Required) ID of the Data Catalog in which the database resides.
+* `database_name` - (Required) Name of the catalog database.
+* `region` - (Optional) Region of the target database.
+
+### create_table_default_permission
+
+* `permissions` - (Optional) The permissions that are granted to the principal.
+* `principal` - (Optional) The principal who is granted permissions.. See [`principal`](#principal) below.
+
+#### principal
+
+* `data_lake_principal_identifier` - (Optional) An identifier for the Lake Formation principal.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Glue Catalog Database.
+* `id` - Catalog ID and name of the database.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Glue Catalog Databases using the `catalog_id:name`. If you have not set a Catalog ID specify the AWS Account ID that the database is in. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Glue Catalog Databases using the `catalog_id:name`. If you have not set a Catalog ID specify the AWS Account ID that the database is in. For example:
+
+```console
+% terraform import aws_glue_catalog_database.database 123456789012:my_database
+```
+
+<!-- cache-key: cdktf-0.18.0 input-556c19f9f828a7b00dcbf12d311ec9ce93276130015a07072b31615d6edc75d0 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/glue_catalog_table.html.markdown b/website/docs/cdktf/python/r/glue_catalog_table.html.markdown
new file mode 100644
index 00000000000..c1822914e05
--- /dev/null
+++ b/website/docs/cdktf/python/r/glue_catalog_table.html.markdown
@@ -0,0 +1,231 @@
+---
+subcategory: "Glue"
+layout: "aws"
+page_title: "AWS: aws_glue_catalog_table"
+description: |-
+  Provides a Glue Catalog Table.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_glue_catalog_table
+
+Provides a Glue Catalog Table Resource. You can refer to the [Glue Developer Guide](http://docs.aws.amazon.com/glue/latest/dg/populate-data-catalog.html) for a full explanation of the Glue Data Catalog functionality.
+
+## Example Usage
+
+### Basic Table
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.glue_catalog_table import GlueCatalogTable
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        GlueCatalogTable(self, "aws_glue_catalog_table",
+            database_name="MyCatalogDatabase",
+            name="MyCatalogTable"
+        )
+```
+
+### Parquet Table for Athena
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.glue_catalog_table import GlueCatalogTable
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        GlueCatalogTable(self, "aws_glue_catalog_table",
+            database_name="MyCatalogDatabase",
+            name="MyCatalogTable",
+            parameters={
+                "EXTERNAL": "TRUE",
+                "parquet.compression": "SNAPPY"
+            },
+            storage_descriptor=GlueCatalogTableStorageDescriptor(
+                columns=[GlueCatalogTableStorageDescriptorColumns(
+                    name="my_string",
+                    type="string"
+                ), GlueCatalogTableStorageDescriptorColumns(
+                    name="my_double",
+                    type="double"
+                ), GlueCatalogTableStorageDescriptorColumns(
+                    comment="",
+                    name="my_date",
+                    type="date"
+                ), GlueCatalogTableStorageDescriptorColumns(
+                    comment="",
+                    name="my_bigint",
+                    type="bigint"
+                ), GlueCatalogTableStorageDescriptorColumns(
+                    comment="",
+                    name="my_struct",
+                    type="struct<my_nested_string:string>"
+                )
+                ],
+                input_format="org.apache.hadoop.hive.ql.io.parquet.MapredParquetInputFormat",
+                location="s3://my-bucket/event-streams/my-stream",
+                output_format="org.apache.hadoop.hive.ql.io.parquet.MapredParquetOutputFormat",
+                ser_de_info=GlueCatalogTableStorageDescriptorSerDeInfo(
+                    name="my-stream",
+                    parameters={
+                        "serialization.format": Token.as_string(1)
+                    },
+                    serialization_library="org.apache.hadoop.hive.ql.io.parquet.serde.ParquetHiveSerDe"
+                )
+            ),
+            table_type="EXTERNAL_TABLE"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) Name of the table. For Hive compatibility, this must be entirely lowercase.
+* `database_name` - (Required) Name of the metadata database where the table metadata resides. For Hive compatibility, this must be all lowercase.
+
+The follow arguments are optional:
+
+* `catalog_id` - (Optional) ID of the Glue Catalog and database to create the table in. If omitted, this defaults to the AWS Account ID plus the database name.
+* `description` - (Optional) Description of the table.
+* `owner` - (Optional) Owner of the table.
+* `open_table_format_input` - (Optional) Configuration block for open table formats. See [`open_table_format_input`](#open_table_format_input) below.
+* `parameters` - (Optional) Properties associated with this table, as a list of key-value pairs.
+* `partition_index` - (Optional) Configuration block for a maximum of 3 partition indexes. See [`partition_index`](#partition_index) below.
+* `partition_keys` - (Optional) Configuration block of columns by which the table is partitioned. Only primitive types are supported as partition keys. See [`partition_keys`](#partition_keys) below.
+* `retention` - (Optional) Retention time for this table.
+* `storage_descriptor` - (Optional) Configuration block for information about the physical storage of this table. For more information, refer to the [Glue Developer Guide](https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-tables.html#aws-glue-api-catalog-tables-StorageDescriptor). See [`storage_descriptor`](#storage_descriptor) below.
+* `table_type` - (Optional) Type of this table (EXTERNAL_TABLE, VIRTUAL_VIEW, etc.). While optional, some Athena DDL queries such as `ALTER TABLE` and `SHOW CREATE TABLE` will fail if this argument is empty.
+* `target_table` - (Optional) Configuration block of a target table for resource linking. See [`target_table`](#target_table) below.
+* `view_expanded_text` - (Optional) If the table is a view, the expanded text of the view; otherwise null.
+* `view_original_text` - (Optional) If the table is a view, the original text of the view; otherwise null.
+
+### open_table_format_input
+
+~> **NOTE:** A `open_table_format_input` cannot be added to an existing `glue_catalog_table`.
+This will destroy and recreate the table, possibly resulting in data loss.
+
+* `iceberg_input` - (Required) Configuration block for iceberg table config. See [`iceberg_input`](#iceberg_input) below.
+
+### iceberg_input
+
+~> **NOTE:** A `iceberg_input` cannot be added to an existing `open_table_format_input`.
+This will destroy and recreate the table, possibly resulting in data loss.
+
+* `metadata_operation` - (Required) A required metadata operation. Can only be set to CREATE.
+* `version` - (Optional) The table version for the Iceberg table. Defaults to 2.
+
+### partition_index
+
+~> **NOTE:** A `partition_index` cannot be added to an existing `glue_catalog_table`.
+This will destroy and recreate the table, possibly resulting in data loss.
+To add an index to an existing table, see the [`glue_partition_index` resource](/docs/providers/aws/r/glue_partition_index.html) for configuration details.
+
+* `index_name` - (Required) Name of the partition index.
+* `keys` - (Required) Keys for the partition index.
+
+### partition_keys
+
+* `comment` - (Optional) Free-form text comment.
+* `name` - (Required) Name of the Partition Key.
+* `type` - (Optional) Datatype of data in the Partition Key.
+
+### storage_descriptor
+
+* `bucket_columns` - (Optional) List of reducer grouping columns, clustering columns, and bucketing columns in the table.
+* `columns` - (Optional) Configuration block for columns in the table. See [`columns`](#columns) below.
+* `compressed` - (Optional) Whether the data in the table is compressed.
+* `input_format` - (Optional) Input format: SequenceFileInputFormat (binary), or TextInputFormat, or a custom format.
+* `location` - (Optional) Physical location of the table. By default this takes the form of the warehouse location, followed by the database location in the warehouse, followed by the table name.
+* `number_of_buckets` - (Optional) Must be specified if the table contains any dimension columns.
+* `output_format` - (Optional) Output format: SequenceFileOutputFormat (binary), or IgnoreKeyTextOutputFormat, or a custom format.
+* `parameters` - (Optional) User-supplied properties in key-value form.
+* `schema_reference` - (Optional) Object that references a schema stored in the AWS Glue Schema Registry. When creating a table, you can pass an empty list of columns for the schema, and instead use a schema reference. See [Schema Reference](#schema_reference) below.
+* `ser_de_info` - (Optional) Configuration block for serialization and deserialization ("SerDe") information. See [`ser_de_info`](#ser_de_info) below.
+* `skewed_info` - (Optional) Configuration block with information about values that appear very frequently in a column (skewed values). See [`skewed_info`](#skewed_info) below.
+* `sort_columns` - (Optional) Configuration block for the sort order of each bucket in the table. See [`sort_columns`](#sort_columns) below.
+* `stored_as_sub_directories` - (Optional) Whether the table data is stored in subdirectories.
+
+#### columns
+
+* `comment` - (Optional) Free-form text comment.
+* `name` - (Required) Name of the Column.
+* `parameters` - (Optional) Key-value pairs defining properties associated with the column.
+* `type` - (Optional) Datatype of data in the Column.
+
+#### schema_reference
+
+* `schema_id` - (Optional) Configuration block that contains schema identity fields. Either this or the `schema_version_id` has to be provided. See [`schema_id`](#schema_id) below.
+* `schema_version_id` - (Optional) Unique ID assigned to a version of the schema. Either this or the `schema_id` has to be provided.
+* `schema_version_number` - (Required) Version number of the schema.
+
+##### schema_id
+
+* `registry_name` - (Optional) Name of the schema registry that contains the schema. Must be provided when `schema_name` is specified and conflicts with `schema_arn`.
+* `schema_arn` - (Optional) ARN of the schema. One of `schema_arn` or `schema_name` has to be provided.
+* `schema_name` - (Optional) Name of the schema. One of `schema_arn` or `schema_name` has to be provided.
+
+#### ser_de_info
+
+* `name` - (Optional) Name of the SerDe.
+* `parameters` - (Optional) Map of initialization parameters for the SerDe, in key-value form.
+* `serialization_library` - (Optional) Usually the class that implements the SerDe. An example is `org.apache.hadoop.hive.serde2.columnar.ColumnarSerDe`.
+
+#### sort_columns
+
+* `column` - (Required) Name of the column.
+* `sort_order` - (Required) Whether the column is sorted in ascending (`1`) or descending order (`0`).
+
+#### skewed_info
+
+* `skewed_column_names` - (Optional) List of names of columns that contain skewed values.
+* `skewed_column_value_location_maps` - (Optional) List of values that appear so frequently as to be considered skewed.
+* `skewed_column_values` - (Optional) Map of skewed values to the columns that contain them.
+
+### target_table
+
+* `catalog_id` - (Required) ID of the Data Catalog in which the table resides.
+* `database_name` - (Required) Name of the catalog database that contains the target table.
+* `name` - (Required) Name of the target table.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the Glue Table.
+* `id` - Catalog ID, Database name and of the name table.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Glue Tables using the catalog ID (usually AWS account ID), database name, and table name. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Glue Tables using the catalog ID (usually AWS account ID), database name, and table name. For example:
+
+```console
+% terraform import aws_glue_catalog_table.MyTable 123456789012:MyDatabase:MyTable
+```
+
+<!-- cache-key: cdktf-0.18.0 input-45918d95d1ee42b18f0a38282d1c7f92c766f0d90f43a1e0cd1f7c41e6fd3936 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/glue_classifier.html.markdown b/website/docs/cdktf/python/r/glue_classifier.html.markdown
new file mode 100644
index 00000000000..1b55c40d244
--- /dev/null
+++ b/website/docs/cdktf/python/r/glue_classifier.html.markdown
@@ -0,0 +1,175 @@
+---
+subcategory: "Glue"
+layout: "aws"
+page_title: "AWS: aws_glue_classifier"
+description: |-
+  Provides an Glue Classifier resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_glue_classifier
+
+Provides a Glue Classifier resource.
+
+~> **NOTE:** It is only valid to create one type of classifier (csv, grok, JSON, or XML). Changing classifier types will recreate the classifier.
+
+## Example Usage
+
+### Csv Classifier
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.glue_classifier import GlueClassifier
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        GlueClassifier(self, "example",
+            csv_classifier=GlueClassifierCsvClassifier(
+                allow_single_column=False,
+                contains_header="PRESENT",
+                delimiter=",",
+                disable_value_trimming=False,
+                header=["example1", "example2"],
+                quote_symbol="'"
+            ),
+            name="example"
+        )
+```
+
+### Grok Classifier
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.glue_classifier import GlueClassifier
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        GlueClassifier(self, "example",
+            grok_classifier=GlueClassifierGrokClassifier(
+                classification="example",
+                grok_pattern="example"
+            ),
+            name="example"
+        )
+```
+
+### JSON Classifier
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.glue_classifier import GlueClassifier
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        GlueClassifier(self, "example",
+            json_classifier=GlueClassifierJsonClassifier(
+                json_path="example"
+            ),
+            name="example"
+        )
+```
+
+### XML Classifier
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.glue_classifier import GlueClassifier
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        GlueClassifier(self, "example",
+            name="example",
+            xml_classifier=GlueClassifierXmlClassifier(
+                classification="example",
+                row_tag="example"
+            )
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `csv_classifier` - (Optional) A classifier for Csv content. Defined below.
+* `grok_classifier` – (Optional) A classifier that uses grok patterns. Defined below.
+* `json_classifier` – (Optional) A classifier for JSON content. Defined below.
+* `name` – (Required) The name of the classifier.
+* `xml_classifier` – (Optional) A classifier for XML content. Defined below.
+
+### csv_classifier
+
+* `allow_single_column` - (Optional) Enables the processing of files that contain only one column.
+* `contains_header` - (Optional) Indicates whether the CSV file contains a header. This can be one of "ABSENT", "PRESENT", or "UNKNOWN".
+* `custom_datatype_configured` - (Optional) A custom symbol to denote what combines content into a single column value. It must be different from the column delimiter.
+* `custom_datatypes` - (Optional) A list of supported custom datatypes. Valid values are `BINARY`, `BOOLEAN`, `DATE`, `DECIMAL`, `DOUBLE`, `FLOAT`, `INT`, `LONG`, `SHORT`, `STRING`, `TIMESTAMP`.
+* `delimiter` - (Optional) The delimiter used in the Csv to separate columns.
+* `disable_value_trimming` - (Optional) Specifies whether to trim column values.
+* `header` - (Optional) A list of strings representing column names.
+* `quote_symbol` - (Optional) A custom symbol to denote what combines content into a single column value. It must be different from the column delimiter.
+
+### grok_classifier
+
+* `classification` - (Required) An identifier of the data format that the classifier matches, such as Twitter, JSON, Omniture logs, Amazon CloudWatch Logs, and so on.
+* `custom_patterns` - (Optional) Custom grok patterns used by this classifier.
+* `grok_pattern` - (Required) The grok pattern used by this classifier.
+
+### json_classifier
+
+* `json_path` - (Required) A `JsonPath` string defining the JSON data for the classifier to classify. AWS Glue supports a subset of `JsonPath`, as described in [Writing JsonPath Custom Classifiers](https://docs.aws.amazon.com/glue/latest/dg/custom-classifier.html#custom-classifier-json).
+
+### xml_classifier
+
+* `classification` - (Required) An identifier of the data format that the classifier matches.
+* `row_tag` - (Required) The XML tag designating the element that contains each record in an XML document being parsed. Note that this cannot identify a self-closing element (closed by `/>`). An empty row element that contains only attributes can be parsed as long as it ends with a closing tag (for example, `<row item_a="A" item_b="B"></row>` is okay, but `<row item_a="A" item_b="B" />` is not).
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Name of the classifier
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Glue Classifiers using their name. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Glue Classifiers using their name. For example:
+
+```console
+% terraform import aws_glue_classifier.MyClassifier MyClassifier
+```
+
+<!-- cache-key: cdktf-0.18.0 input-79f267ac82abd7c066ef5dc22fae51abc346ed566400e78952a79529d3af71bd -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/glue_connection.html.markdown b/website/docs/cdktf/python/r/glue_connection.html.markdown
new file mode 100644
index 00000000000..cf2bd193a5f
--- /dev/null
+++ b/website/docs/cdktf/python/r/glue_connection.html.markdown
@@ -0,0 +1,190 @@
+---
+subcategory: "Glue"
+layout: "aws"
+page_title: "AWS: aws_glue_connection"
+description: |-
+  Provides an Glue Connection resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_glue_connection
+
+Provides a Glue Connection resource.
+
+## Example Usage
+
+### Non-VPC Connection
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.glue_connection import GlueConnection
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        GlueConnection(self, "example",
+            connection_properties={
+                "JDBC_CONNECTION_URL": "jdbc:mysql://example.com/exampledatabase",
+                "PASSWORD": "examplepassword",
+                "USERNAME": "exampleusername"
+            },
+            name="example"
+        )
+```
+
+### Non-VPC Connection with secret manager reference
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws. import DataAwsSecretmanagerSecret
+from imports.aws.glue_connection import GlueConnection
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = DataAwsSecretmanagerSecret(self, "example",
+            name="example-secret"
+        )
+        aws_glue_connection_example = GlueConnection(self, "example_1",
+            connection_properties={
+                "JDBC_CONNECTION_URL": "jdbc:mysql://example.com/exampledatabase",
+                "SECRET_ID": Token.as_string(example.name)
+            },
+            name="example"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_glue_connection_example.override_logical_id("example")
+```
+
+### VPC Connection
+
+For more information, see the [AWS Documentation](https://docs.aws.amazon.com/glue/latest/dg/populate-add-connection.html#connection-JDBC-VPC).
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.glue_connection import GlueConnection
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        GlueConnection(self, "example",
+            connection_properties={
+                "JDBC_CONNECTION_URL": "jdbc:mysql://${" + aws_rds_cluster_example.endpoint + "}/exampledatabase",
+                "PASSWORD": "examplepassword",
+                "USERNAME": "exampleusername"
+            },
+            name="example",
+            physical_connection_requirements=GlueConnectionPhysicalConnectionRequirements(
+                availability_zone=Token.as_string(aws_subnet_example.availability_zone),
+                security_group_id_list=[Token.as_string(aws_security_group_example.id)],
+                subnet_id=Token.as_string(aws_subnet_example.id)
+            )
+        )
+```
+
+### Connection using a custom connector
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws. import DataAwsSecretmanagerSecret
+from imports.aws.glue_connection import GlueConnection
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example_connector = GlueConnection(self, "example_connector",
+            connection_properties={
+                "CONNECTION_TYPE": "Jdbc",
+                "CONNECTOR_CLASS_NAME": "net.snowflake.client.jdbc.SnowflakeDriver",
+                "CONNECTOR_URL": "s3://example/snowflake-jdbc.jar",
+                "JDBC_CONNECTION_URL": "[[\\\"default=jdbc:snowflake://example.com/?user=$${user}&password=$${password}\\\"],\\\",\\\"]"
+            },
+            connection_type="CUSTOM",
+            match_criteria=["template-connection"],
+            name="example_connector"
+        )
+        example = DataAwsSecretmanagerSecret(self, "example",
+            name="example-secret"
+        )
+        GlueConnection(self, "example_connection",
+            connection_properties={
+                "CONNECTION_TYPE": "Jdbc",
+                "CONNECTOR_CLASS_NAME": "net.snowflake.client.jdbc.SnowflakeDriver",
+                "CONNECTOR_URL": "s3://example/snowflake-jdbc.jar",
+                "JDBC_CONNECTION_URL": "jdbc:snowflake://example.com/?user=$${user}&password=$${password}",
+                "SECRET_ID": Token.as_string(example.name)
+            },
+            connection_type="CUSTOM",
+            match_criteria=["Connection", example_connector.name],
+            name="example"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `catalog_id` – (Optional) The ID of the Data Catalog in which to create the connection. If none is supplied, the AWS account ID is used by default.
+* `connection_properties` – (Optional) A map of key-value pairs used as parameters for this connection.
+* `connection_type` – (Optional) The type of the connection. Supported are: `CUSTOM`, `JDBC`, `KAFKA`, `MARKETPLACE`, `MONGODB`, and `NETWORK`. Defaults to `JBDC`.
+* `description` – (Optional) Description of the connection.
+* `match_criteria` – (Optional) A list of criteria that can be used in selecting this connection.
+* `name` – (Required) The name of the connection.
+* `physical_connection_requirements` - (Optional) A map of physical connection requirements, such as VPC and SecurityGroup. Defined below.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### physical_connection_requirements
+
+* `availability_zone` - (Optional) The availability zone of the connection. This field is redundant and implied by `subnet_id`, but is currently an api requirement.
+* `security_group_id_list` - (Optional) The security group ID list used by the connection.
+* `subnet_id` - (Optional) The subnet ID used by the connection.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Catalog ID and name of the connection
+* `arn` - The ARN of the Glue Connection.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Glue Connections using the `CATALOG-ID` (AWS account ID if not custom) and `NAME`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Glue Connections using the `CATALOG-ID` (AWS account ID if not custom) and `NAME`. For example:
+
+```console
+% terraform import aws_glue_connection.MyConnection 123456789012:MyConnection
+```
+
+<!-- cache-key: cdktf-0.18.0 input-e5f54a151c81766ea8f354e5241734756142da42a3b5bcc9ad07d0060d066e20 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/glue_crawler.html.markdown b/website/docs/cdktf/python/r/glue_crawler.html.markdown
new file mode 100644
index 00000000000..7312467dae6
--- /dev/null
+++ b/website/docs/cdktf/python/r/glue_crawler.html.markdown
@@ -0,0 +1,322 @@
+---
+subcategory: "Glue"
+layout: "aws"
+page_title: "AWS: aws_glue_crawler"
+description: |-
+  Manages a Glue Crawler
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_glue_crawler
+
+Manages a Glue Crawler. More information can be found in the [AWS Glue Developer Guide](https://docs.aws.amazon.com/glue/latest/dg/add-crawler.html)
+
+## Example Usage
+
+### DynamoDB Target Example
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.glue_crawler import GlueCrawler
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        GlueCrawler(self, "example",
+            database_name=Token.as_string(aws_glue_catalog_database_example.name),
+            dynamodb_target=[GlueCrawlerDynamodbTarget(
+                path="table-name"
+            )
+            ],
+            name="example",
+            role=Token.as_string(aws_iam_role_example.arn)
+        )
+```
+
+### JDBC Target Example
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.glue_crawler import GlueCrawler
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        GlueCrawler(self, "example",
+            database_name=Token.as_string(aws_glue_catalog_database_example.name),
+            jdbc_target=[GlueCrawlerJdbcTarget(
+                connection_name=Token.as_string(aws_glue_connection_example.name),
+                path="database-name/%"
+            )
+            ],
+            name="example",
+            role=Token.as_string(aws_iam_role_example.arn)
+        )
+```
+
+### S3 Target Example
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.glue_crawler import GlueCrawler
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        GlueCrawler(self, "example",
+            database_name=Token.as_string(aws_glue_catalog_database_example.name),
+            name="example",
+            role=Token.as_string(aws_iam_role_example.arn),
+            s3_target=[GlueCrawlerS3Target(
+                path="s3://${" + aws_s3_bucket_example.bucket + "}"
+            )
+            ]
+        )
+```
+
+### Catalog Target Example
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.glue_crawler import GlueCrawler
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        GlueCrawler(self, "example",
+            catalog_target=[GlueCrawlerCatalogTarget(
+                database_name=Token.as_string(aws_glue_catalog_database_example.name),
+                tables=[Token.as_string(aws_glue_catalog_table_example.name)]
+            )
+            ],
+            configuration="{\n  \"Version\":1.0,\n  \"Grouping\": {\n    \"TableGroupingPolicy\": \"CombineCompatibleSchemas\"\n  }\n}\n\n",
+            database_name=Token.as_string(aws_glue_catalog_database_example.name),
+            name="example",
+            role=Token.as_string(aws_iam_role_example.arn),
+            schema_change_policy=GlueCrawlerSchemaChangePolicy(
+                delete_behavior="LOG"
+            )
+        )
+```
+
+### MongoDB Target Example
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.glue_crawler import GlueCrawler
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        GlueCrawler(self, "example",
+            database_name=Token.as_string(aws_glue_catalog_database_example.name),
+            mongodb_target=[GlueCrawlerMongodbTarget(
+                connection_name=Token.as_string(aws_glue_connection_example.name),
+                path="database-name/%"
+            )
+            ],
+            name="example",
+            role=Token.as_string(aws_iam_role_example.arn)
+        )
+```
+
+### Configuration Settings Example
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.glue_crawler import GlueCrawler
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        GlueCrawler(self, "events_crawler",
+            configuration=Token.as_string(
+                Fn.jsonencode({
+                    "CrawlerOutput": {
+                        "Partitions": {
+                            "AddOrUpdateBehavior": "InheritFromTable"
+                        }
+                    },
+                    "Grouping": {
+                        "TableGroupingPolicy": "CombineCompatibleSchemas"
+                    },
+                    "Version": 1
+                })),
+            database_name=glue_database.name,
+            name="events_crawler_${" + environment_name.value + "}",
+            role=glue_role.arn,
+            s3_target=[GlueCrawlerS3Target(
+                path="s3://${" + data_lake_bucket.bucket + "}"
+            )
+            ],
+            schedule="cron(0 1 * * ? *)",
+            tags=Token.as_string_map(tags.value)
+        )
+```
+
+## Argument Reference
+
+~> **NOTE:** Must specify at least one of `dynamodb_target`, `jdbc_target`, `s3_target`, `mongodb_target` or `catalog_target`.
+
+This argument supports the following arguments:
+
+* `database_name` (Required) Glue database where results are written.
+* `name` (Required) Name of the crawler.
+* `role` (Required) The IAM role friendly name (including path without leading slash), or ARN of an IAM role, used by the crawler to access other resources.
+* `classifiers` (Optional) List of custom classifiers. By default, all AWS classifiers are included in a crawl, but these custom classifiers always override the default classifiers for a given classification.
+* `configuration` (Optional) JSON string of configuration information. For more details see [Setting Crawler Configuration Options](https://docs.aws.amazon.com/glue/latest/dg/crawler-configuration.html).
+* `description` (Optional) Description of the crawler.
+* `delta_target` (Optional) List of nested Delta Lake target arguments. See [Delta Target](#delta-target) below.
+* `dynamodb_target` (Optional) List of nested DynamoDB target arguments. See [Dynamodb Target](#dynamodb-target) below.
+* `jdbc_target` (Optional) List of nested JBDC target arguments. See [JDBC Target](#jdbc-target) below.
+* `s3_target` (Optional) List of nested Amazon S3 target arguments. See [S3 Target](#s3-target) below.
+* `mongodb_target` (Optional) List of nested MongoDB target arguments. See [MongoDB Target](#mongodb-target) below.
+* `hudi_target` (Optional) List of nested Hudi target arguments. See [Iceberg Target](#hudi-target) below.
+* `iceberg_target` (Optional) List of nested Iceberg target arguments. See [Iceberg Target](#iceberg-target) below.
+* `schedule` (Optional) A cron expression used to specify the schedule. For more information, see [Time-Based Schedules for Jobs and Crawlers](https://docs.aws.amazon.com/glue/latest/dg/monitor-data-warehouse-schedule.html). For example, to run something every day at 12:15 UTC, you would specify: `cron(15 12 * * ? *)`.
+* `schema_change_policy` (Optional) Policy for the crawler's update and deletion behavior. See [Schema Change Policy](#schema-change-policy) below.
+* `lake_formation_configuration` (Optional) Specifies Lake Formation configuration settings for the crawler. See [Lake Formation Configuration](#lake-formation-configuration) below.
+* `lineage_configuration` (Optional) Specifies data lineage configuration settings for the crawler. See [Lineage Configuration](#lineage-configuration) below.
+* `recrawl_policy` (Optional)  A policy that specifies whether to crawl the entire dataset again, or to crawl only folders that were added since the last crawler run.. See [Recrawl Policy](#recrawl-policy) below.
+* `security_configuration` (Optional) The name of Security Configuration to be used by the crawler
+* `table_prefix` (Optional) The table prefix used for catalog tables that are created.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Dynamodb Target
+
+* `path` - (Required) The name of the DynamoDB table to crawl.
+* `scan_all` - (Optional) Indicates whether to scan all the records, or to sample rows from the table. Scanning all the records can take a long time when the table is not a high throughput table.  defaults to `true`.
+* `scan_rate` - (Optional) The percentage of the configured read capacity units to use by the AWS Glue crawler. The valid values are null or a value between 0.1 to 1.5.
+
+### JDBC Target
+
+* `connection_name` - (Required) The name of the connection to use to connect to the JDBC target.
+* `path` - (Required) The path of the JDBC target.
+* `exclusions` - (Optional) A list of glob patterns used to exclude from the crawl.
+* `enable_additional_metadata` - (Optional) Specify a value of `RAWTYPES` or `COMMENTS` to enable additional metadata intable responses. `RAWTYPES` provides the native-level datatype. `COMMENTS` provides comments associated with a column or table in the database.
+
+### S3 Target
+
+* `path` - (Required) The path to the Amazon S3 target.
+* `connection_name` - (Optional) The name of a connection which allows crawler to access data in S3 within a VPC.
+* `exclusions` - (Optional) A list of glob patterns used to exclude from the crawl.
+* `sample_size` - (Optional) Sets the number of files in each leaf folder to be crawled when crawling sample files in a dataset. If not set, all the files are crawled. A valid value is an integer between 1 and 249.
+* `event_queue_arn` - (Optional) The ARN of the SQS queue to receive S3 notifications from.
+* `dlq_event_queue_arn` - (Optional) The ARN of the dead-letter SQS queue.
+
+### Catalog Target
+
+* `connection_name` - (Optional) The name of the connection for an Amazon S3-backed Data Catalog table to be a target of the crawl when using a Catalog connection type paired with a `NETWORK` Connection type.
+* `database_name` - (Required) The name of the Glue database to be synchronized.
+* `tables` - (Required) A list of catalog tables to be synchronized.
+* `event_queue_arn` - (Optional)  A valid Amazon SQS ARN.
+* `dlq_event_queue_arn` - (Optional)  A valid Amazon SQS ARN.
+
+~> **Note:** `deletion_behavior` of catalog target doesn't support `DEPRECATE_IN_DATABASE`.
+
+-> **Note:** `configuration` for catalog target crawlers will have `{ ... "Grouping": { "TableGroupingPolicy": "CombineCompatibleSchemas"} }` by default.
+
+### MongoDB Target
+
+* `connection_name` - (Required) The name of the connection to use to connect to the Amazon DocumentDB or MongoDB target.
+* `path` - (Required) The path of the Amazon DocumentDB or MongoDB target (database/collection).
+* `scan_all` - (Optional) Indicates whether to scan all the records, or to sample rows from the table. Scanning all the records can take a long time when the table is not a high throughput table. Default value is `true`.
+
+### Hudi Target
+
+* `connection_name` - (Optional) The name of the connection to use to connect to the Hudi target.
+* `paths` - (Required) One or more Amazon S3 paths that contains Hudi metadata folders as s3://bucket/prefix.
+* `exclusions` - (Optional) A list of glob patterns used to exclude from the crawl.
+* `maximum_traversal_depth` - (Required) The maximum depth of Amazon S3 paths that the crawler can traverse to discover the Hudi metadata folder in your Amazon S3 path. Used to limit the crawler run time. Valid values are between `1` and `20`.
+
+### Iceberg Target
+
+* `connection_name` - (Optional) The name of the connection to use to connect to the Iceberg target.
+* `paths` - (Required) One or more Amazon S3 paths that contains Iceberg metadata folders as s3://bucket/prefix.
+* `exclusions` - (Optional) A list of glob patterns used to exclude from the crawl.
+* `maximum_traversal_depth` - (Required) The maximum depth of Amazon S3 paths that the crawler can traverse to discover the Iceberg metadata folder in your Amazon S3 path. Used to limit the crawler run time. Valid values are between `1` and `20`.
+
+### Delta Target
+
+* `connection_name` - (Optional) The name of the connection to use to connect to the Delta table target.
+* `create_native_delta_table` (Optional) Specifies whether the crawler will create native tables, to allow integration with query engines that support querying of the Delta transaction log directly.
+* `delta_tables` - (Required) A list of the Amazon S3 paths to the Delta tables.
+* `write_manifest` - (Required) Specifies whether to write the manifest files to the Delta table path.
+
+### Schema Change Policy
+
+* `delete_behavior` - (Optional) The deletion behavior when the crawler finds a deleted object. Valid values: `LOG`, `DELETE_FROM_DATABASE`, or `DEPRECATE_IN_DATABASE`. Defaults to `DEPRECATE_IN_DATABASE`.
+* `update_behavior` - (Optional) The update behavior when the crawler finds a changed schema. Valid values: `LOG` or `UPDATE_IN_DATABASE`. Defaults to `UPDATE_IN_DATABASE`.
+
+### Lake Formation Configuration
+
+* `account_id` - (Optional) Required for cross account crawls. For same account crawls as the target data, this can omitted.
+* `use_lake_formation_credentials` - (Optional) Specifies whether to use Lake Formation credentials for the crawler instead of the IAM role credentials.
+
+### Lineage Configuration
+
+* `crawler_lineage_settings` - (Optional) Specifies whether data lineage is enabled for the crawler. Valid values are: `ENABLE` and `DISABLE`. Default value is `DISABLE`.
+
+### Recrawl Policy
+
+* `recrawl_behavior` - (Optional) Specifies whether to crawl the entire dataset again, crawl only folders that were added since the last crawler run, or crawl what S3 notifies the crawler of via SQS. Valid Values are: `CRAWL_EVENT_MODE`, `CRAWL_EVERYTHING` and `CRAWL_NEW_FOLDERS_ONLY`. Default value is `CRAWL_EVERYTHING`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Crawler name
+* `arn` - The ARN of the crawler
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Glue Crawlers using `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Glue Crawlers using `name`. For example:
+
+```console
+% terraform import aws_glue_crawler.MyJob MyJob
+```
+
+<!-- cache-key: cdktf-0.18.0 input-aa6aaa4c28c3da2b4a760961f15f17a04ceb8fb380ac8fce49211f1c27ef79ba -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/glue_data_catalog_encryption_settings.html.markdown b/website/docs/cdktf/python/r/glue_data_catalog_encryption_settings.html.markdown
new file mode 100644
index 00000000000..eb7b49853c4
--- /dev/null
+++ b/website/docs/cdktf/python/r/glue_data_catalog_encryption_settings.html.markdown
@@ -0,0 +1,90 @@
+---
+subcategory: "Glue"
+layout: "aws"
+page_title: "AWS: aws_glue_data_catalog_encryption_settings"
+description: |-
+  Provides a Glue Data Catalog Encryption Settings resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_glue_data_catalog_encryption_settings
+
+Provides a Glue Data Catalog Encryption Settings resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.glue_data_catalog_encryption_settings import GlueDataCatalogEncryptionSettings
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        GlueDataCatalogEncryptionSettings(self, "example",
+            data_catalog_encryption_settings=GlueDataCatalogEncryptionSettingsDataCatalogEncryptionSettings(
+                connection_password_encryption=GlueDataCatalogEncryptionSettingsDataCatalogEncryptionSettingsConnectionPasswordEncryption(
+                    aws_kms_key_id=test.arn,
+                    return_connection_password_encrypted=True
+                ),
+                encryption_at_rest=GlueDataCatalogEncryptionSettingsDataCatalogEncryptionSettingsEncryptionAtRest(
+                    catalog_encryption_mode="SSE-KMS",
+                    sse_aws_kms_key_id=test.arn
+                )
+            )
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `data_catalog_encryption_settings` – (Required) The security configuration to set. see [Data Catalog Encryption Settings](#data_catalog_encryption_settings).
+* `catalog_id` – (Optional) The ID of the Data Catalog to set the security configuration for. If none is provided, the AWS account ID is used by default.
+
+### data_catalog_encryption_settings
+
+* `connection_password_encryption` - (Required) When connection password protection is enabled, the Data Catalog uses a customer-provided key to encrypt the password as part of CreateConnection or UpdateConnection and store it in the ENCRYPTED_PASSWORD field in the connection properties. You can enable catalog encryption or only password encryption. see [Connection Password Encryption](#connection_password_encryption).
+* `encryption_at_rest` - (Required) Specifies the encryption-at-rest configuration for the Data Catalog. see [Encryption At Rest](#encryption_at_rest).
+
+### connection_password_encryption
+
+* `return_connection_password_encrypted` - (Required) When set to `true`, passwords remain encrypted in the responses of GetConnection and GetConnections. This encryption takes effect independently of the catalog encryption.
+* `aws_kms_key_id` - (Optional) A KMS key ARN that is used to encrypt the connection password. If connection password protection is enabled, the caller of CreateConnection and UpdateConnection needs at least `kms:Encrypt` permission on the specified AWS KMS key, to encrypt passwords before storing them in the Data Catalog.
+
+### encryption_at_rest
+
+* `catalog_encryption_mode` - (Required) The encryption-at-rest mode for encrypting Data Catalog data. Valid values are `DISABLED` and `SSE-KMS`.
+* `sse_aws_kms_key_id` - (Optional) The ARN of the AWS KMS key to use for encryption at rest.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the Data Catalog to set the security configuration for.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Glue Data Catalog Encryption Settings using `CATALOG-ID` (AWS account ID if not custom). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Glue Data Catalog Encryption Settings using `CATALOG-ID` (AWS account ID if not custom). For example:
+
+```console
+% terraform import aws_glue_data_catalog_encryption_settings.example 123456789012
+```
+
+<!-- cache-key: cdktf-0.18.0 input-c2e85f7ebdcf7cc062a847481555cf88d0fa1324f7ad5edd2567de866f418d1e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/glue_data_quality_ruleset.html.markdown b/website/docs/cdktf/python/r/glue_data_quality_ruleset.html.markdown
new file mode 100644
index 00000000000..40145a90aae
--- /dev/null
+++ b/website/docs/cdktf/python/r/glue_data_quality_ruleset.html.markdown
@@ -0,0 +1,150 @@
+---
+subcategory: "Glue"
+layout: "aws"
+page_title: "AWS: aws_glue_data_quality_ruleset"
+description: |-
+  Provides a Glue Data Quality Ruleset.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_glue_data_quality_ruleset
+
+Provides a Glue Data Quality Ruleset Resource. You can refer to the [Glue Developer Guide](https://docs.aws.amazon.com/glue/latest/dg/glue-data-quality.html) for a full explanation of the Glue Data Quality Ruleset functionality
+
+## Example Usage
+
+### Basic
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.glue_data_quality_ruleset import GlueDataQualityRuleset
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        GlueDataQualityRuleset(self, "example",
+            name="example",
+            ruleset="Rules = [Completeness \\\"colA\\\" between 0.4 and 0.8]"
+        )
+```
+
+### With description
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.glue_data_quality_ruleset import GlueDataQualityRuleset
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        GlueDataQualityRuleset(self, "example",
+            description="example",
+            name="example",
+            ruleset="Rules = [Completeness \\\"colA\\\" between 0.4 and 0.8]"
+        )
+```
+
+### With tags
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.glue_data_quality_ruleset import GlueDataQualityRuleset
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        GlueDataQualityRuleset(self, "example",
+            name="example",
+            ruleset="Rules = [Completeness \\\"colA\\\" between 0.4 and 0.8]",
+            tags={
+                "hello": "world"
+            }
+        )
+```
+
+### With target_table
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.glue_data_quality_ruleset import GlueDataQualityRuleset
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        GlueDataQualityRuleset(self, "example",
+            name="example",
+            ruleset="Rules = [Completeness \\\"colA\\\" between 0.4 and 0.8]",
+            target_table=GlueDataQualityRulesetTargetTable(
+                database_name=Token.as_string(aws_glue_catalog_database_example.name),
+                table_name=Token.as_string(aws_glue_catalog_table_example.name)
+            )
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `description` - (Optional) Description of the data quality ruleset.
+* `name` - (Required, Forces new resource) Name of the data quality ruleset.
+* `ruleset` - (Optional) A Data Quality Definition Language (DQDL) ruleset. For more information, see the AWS Glue developer guide.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `target_table` - (Optional, Forces new resource) A Configuration block specifying a target table associated with the data quality ruleset. See [`target_table`](#target_table) below.
+
+### target_table
+
+* `catalog_id` - (Optional, Forces new resource) The catalog id where the AWS Glue table exists.
+* `database_name` - (Required, Forces new resource) Name of the database where the AWS Glue table exists.
+* `table_name` - (Required, Forces new resource) Name of the AWS Glue table.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Glue Data Quality Ruleset.
+* `created_on` - The time and date that this data quality ruleset was created.
+* `last_modified_on` - The time and date that this data quality ruleset was created.
+* `recommendation_run_id` - When a ruleset was created from a recommendation run, this run ID is generated to link the two together.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Glue Data Quality Ruleset using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Glue Data Quality Ruleset using the `name`. For example:
+
+```console
+% terraform import aws_glue_data_quality_ruleset.example exampleName
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1c73af64f9d424d885b65e53dcc6d2467ecb21df266c61f99fe72cab1b72c68d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/glue_dev_endpoint.html.markdown b/website/docs/cdktf/python/r/glue_dev_endpoint.html.markdown
new file mode 100644
index 00000000000..12f4a77651f
--- /dev/null
+++ b/website/docs/cdktf/python/r/glue_dev_endpoint.html.markdown
@@ -0,0 +1,118 @@
+---
+subcategory: "Glue"
+layout: "aws"
+page_title: "AWS: aws_glue_dev_endpoint"
+description: |-
+  Provides a Glue Development Endpoint resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_glue_dev_endpoint
+
+Provides a Glue Development Endpoint resource.
+
+## Example Usage
+
+Basic usage:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.glue_dev_endpoint import GlueDevEndpoint
+from imports.aws.iam_role import IamRole
+from imports.aws.iam_role_policy_attachment import IamRolePolicyAttachment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = DataAwsIamPolicyDocument(self, "example",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["sts:AssumeRole"],
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["glue.amazonaws.com"],
+                    type="Service"
+                )
+                ]
+            )
+            ]
+        )
+        aws_iam_role_example = IamRole(self, "example_1",
+            assume_role_policy=Token.as_string(example.json),
+            name="AWSGlueServiceRole-foo"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_role_example.override_logical_id("example")
+        IamRolePolicyAttachment(self, "example-AWSGlueServiceRole",
+            policy_arn="arn:aws:iam::aws:policy/service-role/AWSGlueServiceRole",
+            role=Token.as_string(aws_iam_role_example.name)
+        )
+        aws_glue_dev_endpoint_example = GlueDevEndpoint(self, "example_3",
+            name="foo",
+            role_arn=Token.as_string(aws_iam_role_example.arn)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_glue_dev_endpoint_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `arguments` - (Optional) A map of arguments used to configure the endpoint.
+* `extra_jars_s3_path` - (Optional) Path to one or more Java Jars in an S3 bucket that should be loaded in this endpoint.
+* `extra_python_libs_s3_path` - (Optional) Path(s) to one or more Python libraries in an S3 bucket that should be loaded in this endpoint. Multiple values must be complete paths separated by a comma.
+* `glue_version` - (Optional) -  Specifies the versions of Python and Apache Spark to use. Defaults to AWS Glue version 0.9.
+* `name` - (Required) The name of this endpoint. It must be unique in your account.
+* `number_of_nodes` - (Optional) The number of AWS Glue Data Processing Units (DPUs) to allocate to this endpoint. Conflicts with `worker_type`.
+* `number_of_workers` - (Optional) The number of workers of a defined worker type that are allocated to this endpoint. This field is available only when you choose worker type G.1X or G.2X.
+* `public_key` - (Optional) The public key to be used by this endpoint for authentication.
+* `public_keys` - (Optional) A list of public keys to be used by this endpoint for authentication.
+* `role_arn` - (Required) The IAM role for this endpoint.
+* `security_configuration` - (Optional) The name of the Security Configuration structure to be used with this endpoint.
+* `security_group_ids` - (Optional) Security group IDs for the security groups to be used by this endpoint.
+* `subnet_id` - (Optional) The subnet ID for the new endpoint to use.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `worker_type` - (Optional) The type of predefined worker that is allocated to this endpoint. Accepts a value of Standard, G.1X, or G.2X.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the endpoint.
+* `name` - The name of the new endpoint.
+* `private_address` - A private IP address to access the endpoint within a VPC, if this endpoint is created within one.
+* `public_address` - The public IP address used by this endpoint. The PublicAddress field is present only when you create a non-VPC endpoint.
+* `yarn_endpoint_address` - The YARN endpoint address used by this endpoint.
+* `zeppelin_remote_spark_interpreter_port` - The Apache Zeppelin port for the remote Apache Spark interpreter.
+* `availability_zone` - The AWS availability zone where this endpoint is located.
+* `vpc_id` - he ID of the VPC used by this endpoint.
+* `status` - The current status of this endpoint.
+* `failure_reason` - The reason for a current failure in this endpoint.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import a Glue Development Endpoint using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import a Glue Development Endpoint using the `name`. For example:
+
+```console
+% terraform import aws_glue_dev_endpoint.example foo
+```
+
+<!-- cache-key: cdktf-0.18.0 input-59223466494b9a1666a02d2c293b3450a6518da65a3ffe2d8e998ffd375782a6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/glue_dev_endpoint.markdown b/website/docs/cdktf/python/r/glue_dev_endpoint.markdown
new file mode 100644
index 00000000000..12f4a77651f
--- /dev/null
+++ b/website/docs/cdktf/python/r/glue_dev_endpoint.markdown
@@ -0,0 +1,118 @@
+---
+subcategory: "Glue"
+layout: "aws"
+page_title: "AWS: aws_glue_dev_endpoint"
+description: |-
+  Provides a Glue Development Endpoint resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_glue_dev_endpoint
+
+Provides a Glue Development Endpoint resource.
+
+## Example Usage
+
+Basic usage:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.glue_dev_endpoint import GlueDevEndpoint
+from imports.aws.iam_role import IamRole
+from imports.aws.iam_role_policy_attachment import IamRolePolicyAttachment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = DataAwsIamPolicyDocument(self, "example",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["sts:AssumeRole"],
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["glue.amazonaws.com"],
+                    type="Service"
+                )
+                ]
+            )
+            ]
+        )
+        aws_iam_role_example = IamRole(self, "example_1",
+            assume_role_policy=Token.as_string(example.json),
+            name="AWSGlueServiceRole-foo"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_role_example.override_logical_id("example")
+        IamRolePolicyAttachment(self, "example-AWSGlueServiceRole",
+            policy_arn="arn:aws:iam::aws:policy/service-role/AWSGlueServiceRole",
+            role=Token.as_string(aws_iam_role_example.name)
+        )
+        aws_glue_dev_endpoint_example = GlueDevEndpoint(self, "example_3",
+            name="foo",
+            role_arn=Token.as_string(aws_iam_role_example.arn)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_glue_dev_endpoint_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `arguments` - (Optional) A map of arguments used to configure the endpoint.
+* `extra_jars_s3_path` - (Optional) Path to one or more Java Jars in an S3 bucket that should be loaded in this endpoint.
+* `extra_python_libs_s3_path` - (Optional) Path(s) to one or more Python libraries in an S3 bucket that should be loaded in this endpoint. Multiple values must be complete paths separated by a comma.
+* `glue_version` - (Optional) -  Specifies the versions of Python and Apache Spark to use. Defaults to AWS Glue version 0.9.
+* `name` - (Required) The name of this endpoint. It must be unique in your account.
+* `number_of_nodes` - (Optional) The number of AWS Glue Data Processing Units (DPUs) to allocate to this endpoint. Conflicts with `worker_type`.
+* `number_of_workers` - (Optional) The number of workers of a defined worker type that are allocated to this endpoint. This field is available only when you choose worker type G.1X or G.2X.
+* `public_key` - (Optional) The public key to be used by this endpoint for authentication.
+* `public_keys` - (Optional) A list of public keys to be used by this endpoint for authentication.
+* `role_arn` - (Required) The IAM role for this endpoint.
+* `security_configuration` - (Optional) The name of the Security Configuration structure to be used with this endpoint.
+* `security_group_ids` - (Optional) Security group IDs for the security groups to be used by this endpoint.
+* `subnet_id` - (Optional) The subnet ID for the new endpoint to use.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `worker_type` - (Optional) The type of predefined worker that is allocated to this endpoint. Accepts a value of Standard, G.1X, or G.2X.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the endpoint.
+* `name` - The name of the new endpoint.
+* `private_address` - A private IP address to access the endpoint within a VPC, if this endpoint is created within one.
+* `public_address` - The public IP address used by this endpoint. The PublicAddress field is present only when you create a non-VPC endpoint.
+* `yarn_endpoint_address` - The YARN endpoint address used by this endpoint.
+* `zeppelin_remote_spark_interpreter_port` - The Apache Zeppelin port for the remote Apache Spark interpreter.
+* `availability_zone` - The AWS availability zone where this endpoint is located.
+* `vpc_id` - he ID of the VPC used by this endpoint.
+* `status` - The current status of this endpoint.
+* `failure_reason` - The reason for a current failure in this endpoint.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import a Glue Development Endpoint using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import a Glue Development Endpoint using the `name`. For example:
+
+```console
+% terraform import aws_glue_dev_endpoint.example foo
+```
+
+<!-- cache-key: cdktf-0.18.0 input-59223466494b9a1666a02d2c293b3450a6518da65a3ffe2d8e998ffd375782a6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/glue_job.html.markdown b/website/docs/cdktf/python/r/glue_job.html.markdown
new file mode 100644
index 00000000000..5df666d7355
--- /dev/null
+++ b/website/docs/cdktf/python/r/glue_job.html.markdown
@@ -0,0 +1,224 @@
+---
+subcategory: "Glue"
+layout: "aws"
+page_title: "AWS: aws_glue_job"
+description: |-
+  Provides an Glue Job resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_glue_job
+
+Provides a Glue Job resource.
+
+-> Glue functionality, such as monitoring and logging of jobs, is typically managed with the `default_arguments` argument. See the [Special Parameters Used by AWS Glue](https://docs.aws.amazon.com/glue/latest/dg/aws-glue-programming-etl-glue-arguments.html) topic in the Glue developer guide for additional information.
+
+## Example Usage
+
+### Python Job
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.glue_job import GlueJob
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        GlueJob(self, "example",
+            command=GlueJobCommand(
+                script_location="s3://${" + aws_s3_bucket_example.bucket + "}/example.py"
+            ),
+            name="example",
+            role_arn=Token.as_string(aws_iam_role_example.arn)
+        )
+```
+
+### Ray Job
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.glue_job import GlueJob
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        GlueJob(self, "example",
+            command=GlueJobCommand(
+                name="glueray",
+                python_version="3.9",
+                runtime="Ray2.4",
+                script_location="s3://${" + aws_s3_bucket_example.bucket + "}/example.py"
+            ),
+            glue_version="4.0",
+            name="example",
+            role_arn=Token.as_string(aws_iam_role_example.arn),
+            worker_type="Z.2X"
+        )
+```
+
+### Scala Job
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.glue_job import GlueJob
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        GlueJob(self, "example",
+            command=GlueJobCommand(
+                script_location="s3://${" + aws_s3_bucket_example.bucket + "}/example.scala"
+            ),
+            default_arguments={
+                "--job-language": "scala"
+            },
+            name="example",
+            role_arn=Token.as_string(aws_iam_role_example.arn)
+        )
+```
+
+### Streaming Job
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.glue_job import GlueJob
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        GlueJob(self, "example",
+            command=GlueJobCommand(
+                name="gluestreaming",
+                script_location="s3://${" + aws_s3_bucket_example.bucket + "}/example.script"
+            ),
+            name="example streaming job",
+            role_arn=Token.as_string(aws_iam_role_example.arn)
+        )
+```
+
+### Enabling CloudWatch Logs and Metrics
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudwatch_log_group import CloudwatchLogGroup
+from imports.aws.glue_job import GlueJob
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, command, name, roleArn):
+        super().__init__(scope, name)
+        example = CloudwatchLogGroup(self, "example",
+            name="example",
+            retention_in_days=14
+        )
+        aws_glue_job_example = GlueJob(self, "example_1",
+            default_arguments={
+                "--continuous-log-logGroup": example.name,
+                "--enable-continuous-cloudwatch-log": "true",
+                "--enable-continuous-log-filter": "true",
+                "--enable-metrics": ""
+            },
+            command=command,
+            name=name,
+            role_arn=role_arn
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_glue_job_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `command` – (Required) The command of the job. Defined below.
+* `connections` – (Optional) The list of connections used for this job.
+* `default_arguments` – (Optional) The map of default arguments for this job. You can specify arguments here that your own job-execution script consumes, as well as arguments that AWS Glue itself consumes. For information about how to specify and consume your own Job arguments, see the [Calling AWS Glue APIs in Python](http://docs.aws.amazon.com/glue/latest/dg/aws-glue-programming-python-calling.html) topic in the developer guide. For information about the key-value pairs that AWS Glue consumes to set up your job, see the [Special Parameters Used by AWS Glue](http://docs.aws.amazon.com/glue/latest/dg/aws-glue-programming-python-glue-arguments.html) topic in the developer guide.
+* `non_overridable_arguments` – (Optional) Non-overridable arguments for this job, specified as name-value pairs.
+* `description` – (Optional) Description of the job.
+* `execution_property` – (Optional) Execution property of the job. Defined below.
+* `glue_version` - (Optional) The version of glue to use, for example "1.0". Ray jobs should set this to 4.0 or greater. For information about available versions, see the [AWS Glue Release Notes](https://docs.aws.amazon.com/glue/latest/dg/release-notes.html).
+* `execution_class` - (Optional) Indicates whether the job is run with a standard or flexible execution class. The standard execution class is ideal for time-sensitive workloads that require fast job startup and dedicated resources. Valid value: `FLEX`, `STANDARD`.
+* `max_capacity` – (Optional) The maximum number of AWS Glue data processing units (DPUs) that can be allocated when this job runs. `Required` when `pythonshell` is set, accept either `0.0625` or `1.0`. Use `number_of_workers` and `worker_type` arguments instead with `glue_version` `2.0` and above.
+* `max_retries` – (Optional) The maximum number of times to retry this job if it fails.
+* `name` – (Required) The name you assign to this job. It must be unique in your account.
+* `notification_property` - (Optional) Notification property of the job. Defined below.
+* `role_arn` – (Required) The ARN of the IAM role associated with this job.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `timeout` – (Optional) The job timeout in minutes. The default is 2880 minutes (48 hours) for `glueetl` and `pythonshell` jobs, and null (unlimited) for `gluestreaming` jobs.
+* `security_configuration` - (Optional) The name of the Security Configuration to be associated with the job.
+* `worker_type` - (Optional) The type of predefined worker that is allocated when a job runs. Accepts a value of Standard, G.1X, G.2X, or G.025X for Spark jobs. Accepts the value Z.2X for Ray jobs.
+    * For the Standard worker type, each worker provides 4 vCPU, 16 GB of memory and a 50GB disk, and 2 executors per worker.
+    * For the G.1X worker type, each worker maps to 1 DPU (4 vCPU, 16 GB of memory, 64 GB disk), and provides 1 executor per worker. Recommended for memory-intensive jobs.
+    * For the G.2X worker type, each worker maps to 2 DPU (8 vCPU, 32 GB of memory, 128 GB disk), and provides 1 executor per worker. Recommended for memory-intensive jobs.
+    * For the G.025X worker type, each worker maps to 0.25 DPU (2 vCPU, 4GB of memory, 64 GB disk), and provides 1 executor per worker. Recommended for low volume streaming jobs. Only available for Glue version 3.0.
+    * For the Z.2X worker type, each worker maps to 2 M-DPU (8vCPU, 64 GB of m emory, 128 GB disk), and provides up to 8 Ray workers based on the autoscaler.
+* `number_of_workers` - (Optional) The number of workers of a defined workerType that are allocated when a job runs.
+
+### command Argument Reference
+
+* `name` - (Optional) The name of the job command. Defaults to `glueetl`. Use `pythonshell` for Python Shell Job Type, `glueray` for Ray Job Type, or `gluestreaming` for Streaming Job Type. `max_capacity` needs to be set if `pythonshell` is chosen.
+* `script_location` - (Required) Specifies the S3 path to a script that executes a job.
+* `python_version` - (Optional) The Python version being used to execute a Python shell job. Allowed values are 2, 3 or 3.9. Version 3 refers to Python 3.6.
+* `runtime` - (Optional) In Ray jobs, runtime is used to specify the versions of Ray, Python and additional libraries available in your environment. This field is not used in other job types. For supported runtime environment values, see [Working with Ray jobs](https://docs.aws.amazon.com/glue/latest/dg/ray-jobs-section.html#author-job-ray-runtimes) in the Glue Developer Guide.
+
+### execution_property Argument Reference
+
+* `max_concurrent_runs` - (Optional) The maximum number of concurrent runs allowed for a job. The default is 1.
+
+### notification_property Argument Reference
+
+* `notify_delay_after` - (Optional) After a job run starts, the number of minutes to wait before sending a job run delay notification.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of Glue Job
+* `id` - Job name
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Glue Jobs using `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Glue Jobs using `name`. For example:
+
+```console
+% terraform import aws_glue_job.MyJob MyJob
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ac5c52bfdcb19605598f998f548ee765f8ef650d5dfdb2f5a9674b5f4c2f9ae2 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/glue_ml_transform.html.markdown b/website/docs/cdktf/python/r/glue_ml_transform.html.markdown
new file mode 100644
index 00000000000..f60da34ab2f
--- /dev/null
+++ b/website/docs/cdktf/python/r/glue_ml_transform.html.markdown
@@ -0,0 +1,189 @@
+---
+subcategory: "Glue"
+layout: "aws"
+page_title: "AWS: aws_glue_ml_transform"
+description: |-
+  Provides a Glue ML Transform resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_glue_ml_transform
+
+Provides a Glue ML Transform resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.glue_catalog_database import GlueCatalogDatabase
+from imports.aws.glue_catalog_table import GlueCatalogTable
+from imports.aws.glue_ml_transform import GlueMlTransform
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        test = GlueCatalogDatabase(self, "test",
+            name="example"
+        )
+        aws_glue_catalog_table_test = GlueCatalogTable(self, "test_1",
+            database_name=test.name,
+            name="example",
+            owner="my_owner",
+            parameters={
+                "param1": "param1_val"
+            },
+            partition_keys=[GlueCatalogTablePartitionKeys(
+                comment="my_column_1_comment",
+                name="my_column_1",
+                type="int"
+            ), GlueCatalogTablePartitionKeys(
+                comment="my_column_2_comment",
+                name="my_column_2",
+                type="string"
+            )
+            ],
+            retention=1,
+            storage_descriptor=GlueCatalogTableStorageDescriptor(
+                bucket_columns=["bucket_column_1"],
+                columns=[GlueCatalogTableStorageDescriptorColumns(
+                    comment="my_column1_comment",
+                    name="my_column_1",
+                    type="int"
+                ), GlueCatalogTableStorageDescriptorColumns(
+                    comment="my_column2_comment",
+                    name="my_column_2",
+                    type="string"
+                )
+                ],
+                compressed=False,
+                input_format="SequenceFileInputFormat",
+                location="my_location",
+                number_of_buckets=1,
+                output_format="SequenceFileInputFormat",
+                parameters={
+                    "param1": "param1_val"
+                },
+                ser_de_info=GlueCatalogTableStorageDescriptorSerDeInfo(
+                    name="ser_de_name",
+                    parameters={
+                        "param1": "param_val_1"
+                    },
+                    serialization_library="org.apache.hadoop.hive.serde2.columnar.ColumnarSerDe"
+                ),
+                skewed_info=GlueCatalogTableStorageDescriptorSkewedInfo(
+                    skewed_column_names=["my_column_1"],
+                    skewed_column_value_location_maps={
+                        "my_column_1": "my_column_1_val_loc_map"
+                    },
+                    skewed_column_values=["skewed_val_1"]
+                ),
+                sort_columns=[GlueCatalogTableStorageDescriptorSortColumns(
+                    column="my_column_1",
+                    sort_order=1
+                )
+                ],
+                stored_as_sub_directories=False
+            ),
+            table_type="VIRTUAL_VIEW",
+            view_expanded_text="view_expanded_text_1",
+            view_original_text="view_original_text_1"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_glue_catalog_table_test.override_logical_id("test")
+        aws_glue_ml_transform_test = GlueMlTransform(self, "test_2",
+            depends_on=[aws_iam_role_policy_attachment_test],
+            input_record_tables=[GlueMlTransformInputRecordTables(
+                database_name=Token.as_string(aws_glue_catalog_table_test.database_name),
+                table_name=Token.as_string(aws_glue_catalog_table_test.name)
+            )
+            ],
+            name="example",
+            parameters=GlueMlTransformParameters(
+                find_matches_parameters=GlueMlTransformParametersFindMatchesParameters(
+                    primary_key_column_name="my_column_1"
+                ),
+                transform_type="FIND_MATCHES"
+            ),
+            role_arn=Token.as_string(aws_iam_role_test.arn)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_glue_ml_transform_test.override_logical_id("test")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` – (Required) The name you assign to this ML Transform. It must be unique in your account.
+* `input_record_tables` - (Required)  A list of AWS Glue table definitions used by the transform. see [Input Record Tables](#input_record_tables).
+* `parameters` - (Required) The algorithmic parameters that are specific to the transform type used. Conditionally dependent on the transform type. see [Parameters](#parameters).
+* `role_arn` – (Required) The ARN of the IAM role associated with this ML Transform.
+* `description` – (Optional) Description of the ML Transform.
+* `glue_version` - (Optional) The version of glue to use, for example "1.0". For information about available versions, see the [AWS Glue Release Notes](https://docs.aws.amazon.com/glue/latest/dg/release-notes.html).
+* `max_capacity` – (Optional) The number of AWS Glue data processing units (DPUs) that are allocated to task runs for this transform. You can allocate from `2` to `100` DPUs; the default is `10`. `max_capacity` is a mutually exclusive option with `number_of_workers` and `worker_type`.
+* `max_retries` – (Optional) The maximum number of times to retry this ML Transform if it fails.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `timeout` – (Optional) The ML Transform timeout in minutes. The default is 2880 minutes (48 hours).
+* `worker_type` - (Optional) The type of predefined worker that is allocated when an ML Transform runs. Accepts a value of `Standard`, `G.1X`, or `G.2X`. Required with `number_of_workers`.
+* `number_of_workers` - (Optional) The number of workers of a defined `worker_type` that are allocated when an ML Transform runs. Required with `worker_type`.
+
+### input_record_tables
+
+* `database_name` - (Required) A database name in the AWS Glue Data Catalog.
+* `table_name` - (Required) A table name in the AWS Glue Data Catalog.
+* `catalog_id` - (Optional) A unique identifier for the AWS Glue Data Catalog.
+* `connection_name`- (Optional) The name of the connection to the AWS Glue Data Catalog.
+
+### parameters
+
+* `transform_type` - (Required) The type of machine learning transform. For information about the types of machine learning transforms, see [Creating Machine Learning Transforms](http://docs.aws.amazon.com/glue/latest/dg/add-job-machine-learning-transform.html).
+* `find_matches_parameters` - (Required) The parameters for the find matches algorithm. see [Find Matches Parameters](#find_matches_parameters).
+
+#### find_matches_parameters
+
+* `accuracy_cost_trade_off` - (Optional) The value that is selected when tuning your transform for a balance between accuracy and cost.
+* `enforce_provided_labels` - (Optional) The value to switch on or off to force the output to match the provided labels from users.
+* `precision_recall_trade_off` - (Optional) The value selected when tuning your transform for a balance between precision and recall.
+* `primary_key_column_name` - (Optional) The name of a column that uniquely identifies rows in the source table.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of Glue ML Transform.
+* `id` - Glue ML Transform ID.
+* `label_count` - The number of labels available for this transform.
+* `schema` - The object that represents the schema that this transform accepts. see [Schema](#schema).
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+### schema
+
+* `name` - The name of the column.
+* `data_type` - The type of data in the column.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Glue ML Transforms using `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Glue ML Transforms using `id`. For example:
+
+```console
+% terraform import aws_glue_ml_transform.example tfm-c2cafbe83b1c575f49eaca9939220e2fcd58e2d5
+```
+
+<!-- cache-key: cdktf-0.18.0 input-295ef64caa0ed9cd96476b3d72c04967e7f94dc142182bf5b2175f9cde26f649 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/glue_partition.html.markdown b/website/docs/cdktf/python/r/glue_partition.html.markdown
new file mode 100644
index 00000000000..508e420e183
--- /dev/null
+++ b/website/docs/cdktf/python/r/glue_partition.html.markdown
@@ -0,0 +1,113 @@
+---
+subcategory: "Glue"
+layout: "aws"
+page_title: "AWS: aws_glue_partition"
+description: |-
+  Provides a Glue Partition.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_glue_partition
+
+Provides a Glue Partition Resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.glue_partition import GluePartition
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, partitionValues):
+        super().__init__(scope, name)
+        GluePartition(self, "example",
+            database_name="some-database",
+            table_name="some-table",
+            values=["some-value"],
+            partition_values=partition_values
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `database_name` - (Required) Name of the metadata database where the table metadata resides. For Hive compatibility, this must be all lowercase.
+* `partition_values` - (Required) The values that define the partition.
+* `catalog_id` - (Optional) ID of the Glue Catalog and database to create the table in. If omitted, this defaults to the AWS Account ID plus the database name.
+* `storage_descriptor` - (Optional) A [storage descriptor](#storage_descriptor) object containing information about the physical storage of this table. You can refer to the [Glue Developer Guide](https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-tables.html#aws-glue-api-catalog-tables-StorageDescriptor) for a full explanation of this object.
+* `parameters` - (Optional) Properties associated with this table, as a list of key-value pairs.
+
+##### storage_descriptor
+
+* `columns` - (Optional) A list of the [Columns](#column) in the table.
+* `location` - (Optional) The physical location of the table. By default this takes the form of the warehouse location, followed by the database location in the warehouse, followed by the table name.
+* `input_format` - (Optional) The input format: SequenceFileInputFormat (binary), or TextInputFormat, or a custom format.
+* `output_format` - (Optional) The output format: SequenceFileOutputFormat (binary), or IgnoreKeyTextOutputFormat, or a custom format.
+* `compressed` - (Optional) True if the data in the table is compressed, or False if not.
+* `number_of_buckets` - (Optional) Must be specified if the table contains any dimension columns.
+* `ser_de_info` - (Optional) [Serialization/deserialization (SerDe)](#ser_de_info) information.
+* `bucket_columns` - (Optional) A list of reducer grouping columns, clustering columns, and bucketing columns in the table.
+* `sort_columns` - (Optional) A list of [Order](#sort_columns) objects specifying the sort order of each bucket in the table.
+* `parameters` - (Optional) User-supplied properties in key-value form.
+* `skewed_info` - (Optional) Information about values that appear very frequently in a column (skewed values).
+* `stored_as_sub_directories` - (Optional) True if the table data is stored in subdirectories, or False if not.
+
+##### column
+
+* `name` - (Required) The name of the Column.
+* `type` - (Optional) The datatype of data in the Column.
+* `comment` - (Optional) Free-form text comment.
+
+##### ser_de_info
+
+* `name` - (Optional) Name of the SerDe.
+* `parameters` - (Optional) A map of initialization parameters for the SerDe, in key-value form.
+* `serialization_library` - (Optional) Usually the class that implements the SerDe. An example is: org.apache.hadoop.hive.serde2.columnar.ColumnarSerDe.
+
+##### sort_columns
+
+* `column` - (Required) The name of the column.
+* `sort_order` - (Required) Indicates that the column is sorted in ascending order (== 1), or in descending order (==0).
+
+##### skewed_info
+
+* `skewed_column_names` - (Optional) A list of names of columns that contain skewed values.
+* `skewed_column_value_location_maps` - (Optional) A list of values that appear so frequently as to be considered skewed.
+* `skewed_column_values` - (Optional) A map of skewed values to the columns that contain them.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - partition id.
+* `creation_time` - The time at which the partition was created.
+* `last_analyzed_time` - The last time at which column statistics were computed for this partition.
+* `last_accessed_time` - The last time at which the partition was accessed.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Glue Partitions using the catalog ID (usually AWS account ID), database name, table name and partition values. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Glue Partitions using the catalog ID (usually AWS account ID), database name, table name and partition values. For example:
+
+```console
+% terraform import aws_glue_partition.part 123456789012:MyDatabase:MyTable:val1#val2
+```
+
+<!-- cache-key: cdktf-0.18.0 input-82eb5064cb5a885033f5995b599111156aaf6ca6d5bd48324fd36f1a445015f1 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/glue_partition_index.html.markdown b/website/docs/cdktf/python/r/glue_partition_index.html.markdown
new file mode 100644
index 00000000000..c4b52deeefe
--- /dev/null
+++ b/website/docs/cdktf/python/r/glue_partition_index.html.markdown
@@ -0,0 +1,155 @@
+---
+subcategory: "Glue"
+layout: "aws"
+page_title: "AWS: aws_glue_partition_index"
+description: |-
+  Provides a Glue Partition Index.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_glue_partition_index
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.glue_catalog_database import GlueCatalogDatabase
+from imports.aws.glue_catalog_table import GlueCatalogTable
+from imports.aws.glue_partition_index import GluePartitionIndex
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = GlueCatalogDatabase(self, "example",
+            name="example"
+        )
+        aws_glue_catalog_table_example = GlueCatalogTable(self, "example_1",
+            database_name=example.name,
+            name="example",
+            owner="my_owner",
+            parameters={
+                "param1": "param1_val"
+            },
+            partition_keys=[GlueCatalogTablePartitionKeys(
+                comment="my_column_1_comment",
+                name="my_column_1",
+                type="int"
+            ), GlueCatalogTablePartitionKeys(
+                comment="my_column_2_comment",
+                name="my_column_2",
+                type="string"
+            )
+            ],
+            retention=1,
+            storage_descriptor=GlueCatalogTableStorageDescriptor(
+                bucket_columns=["bucket_column_1"],
+                columns=[GlueCatalogTableStorageDescriptorColumns(
+                    comment="my_column1_comment",
+                    name="my_column_1",
+                    type="int"
+                ), GlueCatalogTableStorageDescriptorColumns(
+                    comment="my_column2_comment",
+                    name="my_column_2",
+                    type="string"
+                )
+                ],
+                compressed=False,
+                input_format="SequenceFileInputFormat",
+                location="my_location",
+                number_of_buckets=1,
+                output_format="SequenceFileInputFormat",
+                parameters={
+                    "param1": "param1_val"
+                },
+                ser_de_info=GlueCatalogTableStorageDescriptorSerDeInfo(
+                    name="ser_de_name",
+                    parameters={
+                        "param1": "param_val_1"
+                    },
+                    serialization_library="org.apache.hadoop.hive.serde2.columnar.ColumnarSerDe"
+                ),
+                skewed_info=GlueCatalogTableStorageDescriptorSkewedInfo(
+                    skewed_column_names=["my_column_1"],
+                    skewed_column_value_location_maps={
+                        "my_column_1": "my_column_1_val_loc_map"
+                    },
+                    skewed_column_values=["skewed_val_1"]
+                ),
+                sort_columns=[GlueCatalogTableStorageDescriptorSortColumns(
+                    column="my_column_1",
+                    sort_order=1
+                )
+                ],
+                stored_as_sub_directories=False
+            ),
+            table_type="VIRTUAL_VIEW",
+            view_expanded_text="view_expanded_text_1",
+            view_original_text="view_original_text_1"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_glue_catalog_table_example.override_logical_id("example")
+        aws_glue_partition_index_example = GluePartitionIndex(self, "example_2",
+            database_name=example.name,
+            partition_index=GluePartitionIndexPartitionIndex(
+                index_name="example",
+                keys=["my_column_1", "my_column_2"]
+            ),
+            table_name=Token.as_string(aws_glue_catalog_table_example.name)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_glue_partition_index_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `table_name` - (Required) Name of the table. For Hive compatibility, this must be entirely lowercase.
+* `database_name` - (Required) Name of the metadata database where the table metadata resides. For Hive compatibility, this must be all lowercase.
+* `partition_index` - (Required) Configuration block for a partition index. See [`partition_index`](#partition_index) below.
+* `catalog_id` - (Optional) The catalog ID where the table resides.
+
+### partition_index
+
+* `index_name` - (Required) Name of the partition index.
+* `keys` - (Required) Keys for the partition index.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Catalog ID, Database name, table name, and index name.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `10m`)
+* `delete` - (Default `10m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Glue Partition Indexes using the catalog ID (usually AWS account ID), database name, table name, and index name. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Glue Partition Indexes using the catalog ID (usually AWS account ID), database name, table name, and index name. For example:
+
+```console
+% terraform import aws_glue_partition_index.example 123456789012:MyDatabase:MyTable:index-name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-2c1eca414462f36b306c6c36d0f8b45e95a67975829b6e6678f2b74c1376628b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/glue_registry.html.markdown b/website/docs/cdktf/python/r/glue_registry.html.markdown
new file mode 100644
index 00000000000..eb33157b617
--- /dev/null
+++ b/website/docs/cdktf/python/r/glue_registry.html.markdown
@@ -0,0 +1,69 @@
+---
+subcategory: "Glue"
+layout: "aws"
+page_title: "AWS: aws_glue_registry"
+description: |-
+  Provides a Glue Registry resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_glue_registry
+
+Provides a Glue Registry resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.glue_registry import GlueRegistry
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        GlueRegistry(self, "example",
+            registry_name="example"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `registry_name` – (Required) The Name of the registry.
+* `description` – (Optional) A description of the registry.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of Glue Registry.
+* `id` - Amazon Resource Name (ARN) of Glue Registry.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Glue Registries using `arn`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Glue Registries using `arn`. For example:
+
+```console
+% terraform import aws_glue_registry.example arn:aws:glue:us-west-2:123456789012:registry/example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ca7291533ababa19fd90f315f11beb8ec44905df2527d1937679132938c2cddd -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/glue_resource_policy.html.markdown b/website/docs/cdktf/python/r/glue_resource_policy.html.markdown
new file mode 100644
index 00000000000..ffce0ad9f09
--- /dev/null
+++ b/website/docs/cdktf/python/r/glue_resource_policy.html.markdown
@@ -0,0 +1,88 @@
+---
+subcategory: "Glue"
+layout: "aws"
+page_title: "AWS: aws_glue_resource_policy"
+description: |-
+  Provides a resource to configure the aws glue resource policy.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_glue_resource_policy
+
+Provides a Glue resource policy. Only one can exist per region.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_caller_identity import DataAwsCallerIdentity
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.data_aws_partition import DataAwsPartition
+from imports.aws.data_aws_region import DataAwsRegion
+from imports.aws.glue_resource_policy import GlueResourcePolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        current = DataAwsCallerIdentity(self, "current")
+        data_aws_partition_current = DataAwsPartition(self, "current_1")
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_partition_current.override_logical_id("current")
+        data_aws_region_current = DataAwsRegion(self, "current_2")
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_region_current.override_logical_id("current")
+        glue_example_policy = DataAwsIamPolicyDocument(self, "glue-example-policy",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["glue:CreateTable"],
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["*"],
+                    type="AWS"
+                )
+                ],
+                resources=["arn:${" + data_aws_partition_current.partition + "}:glue:${" + data_aws_region_current.name + "}:${" + current.account_id + "}:*"
+                ]
+            )
+            ]
+        )
+        GlueResourcePolicy(self, "example",
+            policy=Token.as_string(glue_example_policy.json)
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `policy` – (Required) The policy to be applied to the aws glue data catalog.
+* `enable_hybrid` - (Optional) Indicates that you are using both methods to grant cross-account. Valid values are `TRUE` and `FALSE`. Note the terraform will not perform drift detetction on this field as its not return on read.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Glue Resource Policy using the account ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Glue Resource Policy using the account ID. For example:
+
+```console
+% terraform import aws_glue_resource_policy.Test 12356789012
+```
+
+<!-- cache-key: cdktf-0.18.0 input-505ce1c4e38c338e6ee96c4f345643e93eb421593db3b74a6669f3f253de8617 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/glue_schema.html.markdown b/website/docs/cdktf/python/r/glue_schema.html.markdown
new file mode 100644
index 00000000000..d23470398bb
--- /dev/null
+++ b/website/docs/cdktf/python/r/glue_schema.html.markdown
@@ -0,0 +1,81 @@
+---
+subcategory: "Glue"
+layout: "aws"
+page_title: "AWS: aws_glue_schema"
+description: |-
+  Provides a Glue Schema resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_glue_schema
+
+Provides a Glue Schema resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.glue_schema import GlueSchema
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        GlueSchema(self, "example",
+            compatibility="NONE",
+            data_format="AVRO",
+            registry_arn=test.arn,
+            schema_definition="{\\\"type\\\": \\\"record\\\", \\\"name\\\": \\\"r1\\\", \\\"fields\\\": [ {\\\"name\\\": \\\"f1\\\", \\\"type\\\": \\\"int\\\"}, {\\\"name\\\": \\\"f2\\\", \\\"type\\\": \\\"string\\\"} ]}",
+            schema_name="example"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `schema_name` – (Required) The Name of the schema.
+* `registry_arn` - (Required) The ARN of the Glue Registry to create the schema in.
+* `data_format` - (Required) The data format of the schema definition. Valid values are `AVRO`, `JSON` and `PROTOBUF`.
+* `compatibility` - (Required) The compatibility mode of the schema. Values values are: `NONE`, `DISABLED`, `BACKWARD`, `BACKWARD_ALL`, `FORWARD`, `FORWARD_ALL`, `FULL`, and `FULL_ALL`.
+* `schema_definition` - (Required) The schema definition using the `data_format` setting for `schema_name`.
+* `description` – (Optional) A description of the schema.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the schema.
+* `id` - Amazon Resource Name (ARN) of the schema.
+* `registry_name` - The name of the Glue Registry.
+* `latest_schema_version` - The latest version of the schema associated with the returned schema definition.
+* `next_schema_version` - The next version of the schema associated with the returned schema definition.
+* `schema_checkpoint` - The version number of the checkpoint (the last time the compatibility mode was changed).
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Glue Registries using `arn`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Glue Registries using `arn`. For example:
+
+```console
+% terraform import aws_glue_schema.example arn:aws:glue:us-west-2:123456789012:schema/example/example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-07d8be72b0ef5ec7a36f90bf89a090da4b36963b4802cf618422290e600eac94 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/glue_security_configuration.html.markdown b/website/docs/cdktf/python/r/glue_security_configuration.html.markdown
new file mode 100644
index 00000000000..b678a40eb9e
--- /dev/null
+++ b/website/docs/cdktf/python/r/glue_security_configuration.html.markdown
@@ -0,0 +1,99 @@
+---
+subcategory: "Glue"
+layout: "aws"
+page_title: "AWS: aws_glue_security_configuration"
+description: |-
+  Manages a Glue Security Configuration
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_glue_security_configuration
+
+Manages a Glue Security Configuration.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.glue_security_configuration import GlueSecurityConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        GlueSecurityConfiguration(self, "example",
+            encryption_configuration=GlueSecurityConfigurationEncryptionConfiguration(
+                cloudwatch_encryption=GlueSecurityConfigurationEncryptionConfigurationCloudwatchEncryption(
+                    cloudwatch_encryption_mode="DISABLED"
+                ),
+                job_bookmarks_encryption=GlueSecurityConfigurationEncryptionConfigurationJobBookmarksEncryption(
+                    job_bookmarks_encryption_mode="DISABLED"
+                ),
+                s3_encryption=GlueSecurityConfigurationEncryptionConfigurationS3Encryption(
+                    kms_key_arn=Token.as_string(data_aws_kms_key_example.arn),
+                    s3_encryption_mode="SSE-KMS"
+                )
+            ),
+            name="example"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `encryption_configuration` – (Required) Configuration block containing encryption configuration. Detailed below.
+* `name` – (Required) Name of the security configuration.
+
+### encryption_configuration Argument Reference
+
+* `cloudwatch_encryption ` - (Required) A `cloudwatch_encryption ` block as described below, which contains encryption configuration for CloudWatch.
+* `job_bookmarks_encryption ` - (Required) A `job_bookmarks_encryption ` block as described below, which contains encryption configuration for job bookmarks.
+* `s3_encryption` - (Required) A `s3_encryption ` block as described below, which contains encryption configuration for S3 data.
+
+#### cloudwatch_encryption Argument Reference
+
+* `cloudwatch_encryption_mode` - (Optional) Encryption mode to use for CloudWatch data. Valid values: `DISABLED`, `SSE-KMS`. Default value: `DISABLED`.
+* `kms_key_arn` - (Optional) Amazon Resource Name (ARN) of the KMS key to be used to encrypt the data.
+
+#### job_bookmarks_encryption Argument Reference
+
+* `job_bookmarks_encryption_mode` - (Optional) Encryption mode to use for job bookmarks data. Valid values: `CSE-KMS`, `DISABLED`. Default value: `DISABLED`.
+* `kms_key_arn` - (Optional) Amazon Resource Name (ARN) of the KMS key to be used to encrypt the data.
+
+#### s3_encryption Argument Reference
+
+* `s3_encryption_mode` - (Optional) Encryption mode to use for S3 data. Valid values: `DISABLED`, `SSE-KMS`, `SSE-S3`. Default value: `DISABLED`.
+* `kms_key_arn` - (Optional) Amazon Resource Name (ARN) of the KMS key to be used to encrypt the data.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Glue security configuration name
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Glue Security Configurations using `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Glue Security Configurations using `name`. For example:
+
+```console
+% terraform import aws_glue_security_configuration.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-648d5a94dbcbfce0a30b8db8178f35b6d6f0e3b9f5501dfc1bc90378045104ee -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/glue_trigger.html.markdown b/website/docs/cdktf/python/r/glue_trigger.html.markdown
new file mode 100644
index 00000000000..2b1bf6879e5
--- /dev/null
+++ b/website/docs/cdktf/python/r/glue_trigger.html.markdown
@@ -0,0 +1,245 @@
+---
+subcategory: "Glue"
+layout: "aws"
+page_title: "AWS: aws_glue_trigger"
+description: |-
+  Manages a Glue Trigger resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_glue_trigger
+
+Manages a Glue Trigger resource.
+
+## Example Usage
+
+### Conditional Trigger
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.glue_trigger import GlueTrigger
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        GlueTrigger(self, "example",
+            actions=[GlueTriggerActions(
+                job_name=example1.name
+            )
+            ],
+            name="example",
+            predicate=GlueTriggerPredicate(
+                conditions=[GlueTriggerPredicateConditions(
+                    job_name=example2.name,
+                    state="SUCCEEDED"
+                )
+                ]
+            ),
+            type="CONDITIONAL"
+        )
+```
+
+### On-Demand Trigger
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.glue_trigger import GlueTrigger
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        GlueTrigger(self, "example",
+            actions=[GlueTriggerActions(
+                job_name=Token.as_string(aws_glue_job_example.name)
+            )
+            ],
+            name="example",
+            type="ON_DEMAND"
+        )
+```
+
+### Scheduled Trigger
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.glue_trigger import GlueTrigger
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        GlueTrigger(self, "example",
+            actions=[GlueTriggerActions(
+                job_name=Token.as_string(aws_glue_job_example.name)
+            )
+            ],
+            name="example",
+            schedule="cron(15 12 * * ? *)",
+            type="SCHEDULED"
+        )
+```
+
+### Conditional Trigger with Crawler Action
+
+**Note:** Triggers can have both a crawler action and a crawler condition, just no example provided.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.glue_trigger import GlueTrigger
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        GlueTrigger(self, "example",
+            actions=[GlueTriggerActions(
+                crawler_name=example1.name
+            )
+            ],
+            name="example",
+            predicate=GlueTriggerPredicate(
+                conditions=[GlueTriggerPredicateConditions(
+                    job_name=example2.name,
+                    state="SUCCEEDED"
+                )
+                ]
+            ),
+            type="CONDITIONAL"
+        )
+```
+
+### Conditional Trigger with Crawler Condition
+
+**Note:** Triggers can have both a crawler action and a crawler condition, just no example provided.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.glue_trigger import GlueTrigger
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        GlueTrigger(self, "example",
+            actions=[GlueTriggerActions(
+                job_name=example1.name
+            )
+            ],
+            name="example",
+            predicate=GlueTriggerPredicate(
+                conditions=[GlueTriggerPredicateConditions(
+                    crawl_state="SUCCEEDED",
+                    crawler_name=example2.name
+                )
+                ]
+            ),
+            type="CONDITIONAL"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `actions` – (Required) List of actions initiated by this trigger when it fires. See [Actions](#actions) Below.
+* `description` – (Optional) A description of the new trigger.
+* `enabled` – (Optional) Start the trigger. Defaults to `true`.
+* `name` – (Required) The name of the trigger.
+* `predicate` – (Optional) A predicate to specify when the new trigger should fire. Required when trigger type is `CONDITIONAL`. See [Predicate](#predicate) Below.
+* `schedule` – (Optional) A cron expression used to specify the schedule. [Time-Based Schedules for Jobs and Crawlers](https://docs.aws.amazon.com/glue/latest/dg/monitor-data-warehouse-schedule.html)
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `start_on_creation` – (Optional) Set to true to start `SCHEDULED` and `CONDITIONAL` triggers when created. True is not supported for `ON_DEMAND` triggers.
+* `type` – (Required) The type of trigger. Valid values are `CONDITIONAL`, `EVENT`, `ON_DEMAND`, and `SCHEDULED`.
+* `workflow_name` - (Optional) A workflow to which the trigger should be associated to. Every workflow graph (DAG) needs a starting trigger (`ON_DEMAND` or `SCHEDULED` type) and can contain multiple additional `CONDITIONAL` triggers.
+* `event_batching_condition` - (Optional) Batch condition that must be met (specified number of events received or batch time window expired) before EventBridge event trigger fires. See [Event Batching Condition](#event-batching-condition).
+
+### Actions
+
+* `arguments` - (Optional) Arguments to be passed to the job. You can specify arguments here that your own job-execution script consumes, as well as arguments that AWS Glue itself consumes.
+* `crawler_name` - (Optional) The name of the crawler to be executed. Conflicts with `job_name`.
+* `job_name` - (Optional) The name of a job to be executed. Conflicts with `crawler_name`.
+* `timeout` - (Optional) The job run timeout in minutes. It overrides the timeout value of the job.
+* `security_configuration` - (Optional) The name of the Security Configuration structure to be used with this action.
+* `notification_property` - (Optional) Specifies configuration properties of a job run notification. See [Notification Property](#notification-property) details below.
+
+#### Notification Property
+
+* `notify_delay_after` - (Optional) After a job run starts, the number of minutes to wait before sending a job run delay notification.
+
+### Predicate
+
+* `conditions` - (Required) A list of the conditions that determine when the trigger will fire. See [Conditions](#conditions).
+* `logical` - (Optional) How to handle multiple conditions. Defaults to `AND`. Valid values are `AND` or `ANY`.
+
+#### Conditions
+
+* `job_name` - (Optional) The name of the job to watch. If this is specified, `state` must also be specified. Conflicts with `crawler_name`.
+* `state` - (Optional) The condition job state. Currently, the values supported are `SUCCEEDED`, `STOPPED`, `TIMEOUT` and `FAILED`. If this is specified, `job_name` must also be specified. Conflicts with `crawler_state`.
+* `crawler_name` - (Optional) The name of the crawler to watch. If this is specified, `crawl_state` must also be specified. Conflicts with `job_name`.
+* `crawl_state` - (Optional) The condition crawl state. Currently, the values supported are `RUNNING`, `SUCCEEDED`, `CANCELLED`, and `FAILED`. If this is specified, `crawler_name` must also be specified. Conflicts with `state`.
+* `logical_operator` - (Optional) A logical operator. Defaults to `EQUALS`.
+
+### Event Batching Condition
+
+* `batch_size` - (Required)Number of events that must be received from Amazon EventBridge before EventBridge  event trigger fires.
+* `batch_window` - (Optional) Window of time in seconds after which EventBridge event trigger fires. Window starts when first event is received. Default value is `900`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of Glue Trigger
+* `id` - Trigger name
+* `state` - The current state of the trigger.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `5m`)
+- `delete` - (Default `5m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Glue Triggers using `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Glue Triggers using `name`. For example:
+
+```console
+% terraform import aws_glue_trigger.MyTrigger MyTrigger
+```
+
+<!-- cache-key: cdktf-0.18.0 input-74dac647f2910891d6faab60e44decc3077a16fcd9bc0bb5252ee16bfc7e2cb5 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/glue_user_defined_function.html.markdown b/website/docs/cdktf/python/r/glue_user_defined_function.html.markdown
new file mode 100644
index 00000000000..1be15e963de
--- /dev/null
+++ b/website/docs/cdktf/python/r/glue_user_defined_function.html.markdown
@@ -0,0 +1,94 @@
+---
+subcategory: "Glue"
+layout: "aws"
+page_title: "AWS: aws_glue_user_defined_function"
+description: |-
+  Provides a Glue User Defined Function.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_glue_user_defined_function
+
+Provides a Glue User Defined Function Resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.glue_catalog_database import GlueCatalogDatabase
+from imports.aws.glue_user_defined_function import GlueUserDefinedFunction
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = GlueCatalogDatabase(self, "example",
+            name="my_database"
+        )
+        aws_glue_user_defined_function_example = GlueUserDefinedFunction(self, "example_1",
+            catalog_id=example.catalog_id,
+            class_name="class",
+            database_name=example.name,
+            name="my_func",
+            owner_name="owner",
+            owner_type="GROUP",
+            resource_uris=[GlueUserDefinedFunctionResourceUris(
+                resource_type="ARCHIVE",
+                uri="uri"
+            )
+            ]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_glue_user_defined_function_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the function.
+* `catalog_id` - (Optional) ID of the Glue Catalog to create the function in. If omitted, this defaults to the AWS Account ID.
+* `database_name` - (Required) The name of the Database to create the Function.
+* `class_name` - (Required) The Java class that contains the function code.
+* `owner_name` - (Required) The owner of the function.
+* `owner_type` - (Required) The owner type. can be one of `USER`, `ROLE`, and `GROUP`.
+* `resource_uris` - (Optional) The configuration block for Resource URIs. See [resource uris](#resource-uris) below for more details.
+
+### Resource URIs
+
+* `resource_type` - (Required) The type of the resource. can be one of `JAR`, `FILE`, and `ARCHIVE`.
+* `uri` - (Required) The URI for accessing the resource.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id`- The id of the Glue User Defined Function.
+* `arn`- The ARN of the Glue User Defined Function.
+* `create_time`- The time at which the function was created.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Glue User Defined Functions using the `catalog_id:database_name:function_name`. If you have not set a Catalog ID specify the AWS Account ID that the database is in. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Glue User Defined Functions using the `catalog_id:database_name:function_name`. If you have not set a Catalog ID specify the AWS Account ID that the database is in. For example:
+
+```console
+% terraform import aws_glue_user_defined_function.func 123456789012:my_database:my_func
+```
+
+<!-- cache-key: cdktf-0.18.0 input-194cac21dea8d6e573aab71efbb8346e096eb5b0106430a43511971b8c50376b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/glue_workflow.html.markdown b/website/docs/cdktf/python/r/glue_workflow.html.markdown
new file mode 100644
index 00000000000..4ccf8cc8b4b
--- /dev/null
+++ b/website/docs/cdktf/python/r/glue_workflow.html.markdown
@@ -0,0 +1,99 @@
+---
+subcategory: "Glue"
+layout: "aws"
+page_title: "AWS: aws_glue_workflow"
+description: |-
+  Provides a Glue Workflow resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_glue_workflow
+
+Provides a Glue Workflow resource.
+The workflow graph (DAG) can be build using the `aws_glue_trigger` resource.
+See the example below for creating a graph with four nodes (two triggers and two jobs).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.glue_trigger import GlueTrigger
+from imports.aws.glue_workflow import GlueWorkflow
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = GlueWorkflow(self, "example",
+            name="example"
+        )
+        GlueTrigger(self, "example-inner",
+            actions=[GlueTriggerActions(
+                job_name="another-example-job"
+            )
+            ],
+            name="trigger-inner",
+            predicate=GlueTriggerPredicate(
+                conditions=[GlueTriggerPredicateConditions(
+                    job_name="example-job",
+                    state="SUCCEEDED"
+                )
+                ]
+            ),
+            type="CONDITIONAL",
+            workflow_name=example.name
+        )
+        GlueTrigger(self, "example-start",
+            actions=[GlueTriggerActions(
+                job_name="example-job"
+            )
+            ],
+            name="trigger-start",
+            type="ON_DEMAND",
+            workflow_name=example.name
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` – (Required) The name you assign to this workflow.
+* `default_run_properties` – (Optional) A map of default run properties for this workflow. These properties are passed to all jobs associated to the workflow.
+* `description` – (Optional) Description of the workflow.
+* `max_concurrent_runs` - (Optional) Prevents exceeding the maximum number of concurrent runs of any of the component jobs. If you leave this parameter blank, there is no limit to the number of concurrent workflow runs.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of Glue Workflow
+* `id` - Workflow name
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Glue Workflows using `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Glue Workflows using `name`. For example:
+
+```console
+% terraform import aws_glue_workflow.MyWorkflow MyWorkflow
+```
+
+<!-- cache-key: cdktf-0.18.0 input-7df9adc6f57f0dd25966f803f616a0d5ba6f246209f657e6b2508d999ef81f32 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/grafana_license_association.html.markdown b/website/docs/cdktf/python/r/grafana_license_association.html.markdown
new file mode 100644
index 00000000000..7aa182e4e89
--- /dev/null
+++ b/website/docs/cdktf/python/r/grafana_license_association.html.markdown
@@ -0,0 +1,96 @@
+---
+subcategory: "Managed Grafana"
+layout: "aws"
+page_title: "AWS: aws_grafana_license_association"
+description: |-
+  Provides an Amazon Managed Grafana workspace license association resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_grafana_license_association
+
+Provides an Amazon Managed Grafana workspace license association resource.
+
+## Example Usage
+
+### Basic configuration
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.grafana_license_association import GrafanaLicenseAssociation
+from imports.aws.grafana_workspace import GrafanaWorkspace
+from imports.aws.iam_role import IamRole
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        assume = IamRole(self, "assume",
+            assume_role_policy=Token.as_string(
+                Fn.jsonencode({
+                    "Statement": [{
+                        "Action": "sts:AssumeRole",
+                        "Effect": "Allow",
+                        "Principal": {
+                            "Service": "grafana.amazonaws.com"
+                        },
+                        "Sid": ""
+                    }
+                    ],
+                    "Version": "2012-10-17"
+                })),
+            name="grafana-assume"
+        )
+        example = GrafanaWorkspace(self, "example",
+            account_access_type="CURRENT_ACCOUNT",
+            authentication_providers=["SAML"],
+            permission_type="SERVICE_MANAGED",
+            role_arn=assume.arn
+        )
+        aws_grafana_license_association_example = GrafanaLicenseAssociation(self, "example_2",
+            license_type="ENTERPRISE_FREE_TRIAL",
+            workspace_id=example.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_grafana_license_association_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `license_type` - (Required) The type of license for the workspace license association. Valid values are `ENTERPRISE` and `ENTERPRISE_FREE_TRIAL`.
+* `workspace_id` - (Required) The workspace id.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `free_trial_expiration` - If `license_type` is set to `ENTERPRISE_FREE_TRIAL`, this is the expiration date of the free trial.
+* `license_expiration` - If `license_type` is set to `ENTERPRISE`, this is the expiration date of the enterprise license.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Grafana workspace license association using the workspace's `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Grafana workspace license association using the workspace's `id`. For example:
+
+```console
+% terraform import aws_grafana_license_association.example g-2054c75a02
+```
+
+<!-- cache-key: cdktf-0.18.0 input-90acddbaf917f9205b009266924d2aa8cb3bd6ec3e83679cbf909ed8d07bd217 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/grafana_role_association.html.markdown b/website/docs/cdktf/python/r/grafana_role_association.html.markdown
new file mode 100644
index 00000000000..6313762c8e9
--- /dev/null
+++ b/website/docs/cdktf/python/r/grafana_role_association.html.markdown
@@ -0,0 +1,80 @@
+---
+subcategory: "Managed Grafana"
+layout: "aws"
+page_title: "AWS: aws_grafana_role_association"
+description: |-
+  Provides an Amazon Managed Grafana workspace role association resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_grafana_role_association
+
+Provides an Amazon Managed Grafana workspace role association resource.
+
+## Example Usage
+
+### Basic configuration
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.grafana_role_association import GrafanaRoleAssociation
+from imports.aws.grafana_workspace import GrafanaWorkspace
+from imports.aws.iam_role import IamRole
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        assume = IamRole(self, "assume",
+            assume_role_policy=Token.as_string(
+                Fn.jsonencode({
+                    "Statement": [{
+                        "Action": "sts:AssumeRole",
+                        "Effect": "Allow",
+                        "Principal": {
+                            "Service": "grafana.amazonaws.com"
+                        },
+                        "Sid": ""
+                    }
+                    ],
+                    "Version": "2012-10-17"
+                })),
+            name="grafana-assume"
+        )
+        example = GrafanaWorkspace(self, "example",
+            account_access_type="CURRENT_ACCOUNT",
+            authentication_providers=["SAML"],
+            permission_type="SERVICE_MANAGED",
+            role_arn=assume.arn
+        )
+        aws_grafana_role_association_example = GrafanaRoleAssociation(self, "example_2",
+            role="ADMIN",
+            user_ids=["USER_ID_1", "USER_ID_2"],
+            workspace_id=example.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_grafana_role_association_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `role` - (Required) The grafana role. Valid values can be found [here](https://docs.aws.amazon.com/grafana/latest/APIReference/API_UpdateInstruction.html#ManagedGrafana-Type-UpdateInstruction-role).
+* `workspace_id` - (Required) The workspace id.
+
+The following arguments are optional:
+
+* `group_ids` - (Optional) The AWS SSO group ids to be assigned the role given in `role`.
+* `user_ids` - (Optional) The AWS SSO user ids to be assigned the role given in `role`.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+<!-- cache-key: cdktf-0.18.0 input-4d21bedd686a943999565d73b09e0fb7f400801629b70dba191f5a85e621bf6f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/grafana_workspace.html.markdown b/website/docs/cdktf/python/r/grafana_workspace.html.markdown
new file mode 100644
index 00000000000..86f63c1c371
--- /dev/null
+++ b/website/docs/cdktf/python/r/grafana_workspace.html.markdown
@@ -0,0 +1,118 @@
+---
+subcategory: "Managed Grafana"
+layout: "aws"
+page_title: "AWS: aws_grafana_workspace"
+description: |-
+  Provides an Amazon Managed Grafana workspace resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_grafana_workspace
+
+Provides an Amazon Managed Grafana workspace resource.
+
+## Example Usage
+
+### Basic configuration
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.grafana_workspace import GrafanaWorkspace
+from imports.aws.iam_role import IamRole
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        assume = IamRole(self, "assume",
+            assume_role_policy=Token.as_string(
+                Fn.jsonencode({
+                    "Statement": [{
+                        "Action": "sts:AssumeRole",
+                        "Effect": "Allow",
+                        "Principal": {
+                            "Service": "grafana.amazonaws.com"
+                        },
+                        "Sid": ""
+                    }
+                    ],
+                    "Version": "2012-10-17"
+                })),
+            name="grafana-assume"
+        )
+        GrafanaWorkspace(self, "example",
+            account_access_type="CURRENT_ACCOUNT",
+            authentication_providers=["SAML"],
+            permission_type="SERVICE_MANAGED",
+            role_arn=assume.arn
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `account_access_type` - (Required) The type of account access for the workspace. Valid values are `CURRENT_ACCOUNT` and `ORGANIZATION`. If `ORGANIZATION` is specified, then `organizational_units` must also be present.
+* `authentication_providers` - (Required) The authentication providers for the workspace. Valid values are `AWS_SSO`, `SAML`, or both.
+* `permission_type` - (Required) The permission type of the workspace. If `SERVICE_MANAGED` is specified, the IAM roles and IAM policy attachments are generated automatically. If `CUSTOMER_MANAGED` is specified, the IAM roles and IAM policy attachments will not be created.
+
+The following arguments are optional:
+
+* `configuration` - (Optional) The configuration string for the workspace that you create. For more information about the format and configuration options available, see [Working in your Grafana workspace](https://docs.aws.amazon.com/grafana/latest/userguide/AMG-configure-workspace.html).
+* `data_sources` - (Optional) The data sources for the workspace. Valid values are `AMAZON_OPENSEARCH_SERVICE`, `ATHENA`, `CLOUDWATCH`, `PROMETHEUS`, `REDSHIFT`, `SITEWISE`, `TIMESTREAM`, `XRAY`
+* `description` - (Optional) The workspace description.
+* `grafana_version` - (Optional) Specifies the version of Grafana to support in the new workspace. Supported values are `8.4` and `9.4`. If not specified, defaults to `8.4`.
+* `name` - (Optional) The Grafana workspace name.
+* `network_access_control` - (Optional) Configuration for network access to your workspace.See [Network Access Control](#network-access-control) below.
+* `notification_destinations` - (Optional) The notification destinations. If a data source is specified here, Amazon Managed Grafana will create IAM roles and permissions needed to use these destinations. Must be set to `SNS`.
+* `organization_role_name` - (Optional) The role name that the workspace uses to access resources through Amazon Organizations.
+* `organizational_units` - (Optional) The Amazon Organizations organizational units that the workspace is authorized to use data sources from.
+* `role_arn` - (Optional) The IAM role ARN that the workspace assumes.
+* `stack_set_name` - (Optional) The AWS CloudFormation stack set name that provisions IAM roles to be used by the workspace.
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `vpc_configuration` - (Optional) The configuration settings for an Amazon VPC that contains data sources for your Grafana workspace to connect to. See [VPC Configuration](#vpc-configuration) below.
+
+### Network Access Control
+
+* `prefix_list_ids` - (Required) - An array of prefix list IDs.
+* `vpce_ids` - (Required) - An array of Amazon VPC endpoint IDs for the workspace. The only VPC endpoints that can be specified here are interface VPC endpoints for Grafana workspaces (using the com.amazonaws.[region].grafana-workspace service endpoint). Other VPC endpoints will be ignored.
+
+### VPC Configuration
+
+* `security_group_ids` - (Required) - The list of Amazon EC2 security group IDs attached to the Amazon VPC for your Grafana workspace to connect.
+* `subnet_ids` - (Required) - The list of Amazon EC2 subnet IDs created in the Amazon VPC for your Grafana workspace to connect.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the Grafana workspace.
+* `endpoint` - The endpoint of the Grafana workspace.
+* `grafana_version` - The version of Grafana running on the workspace.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Grafana Workspace using the workspace's `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Grafana Workspace using the workspace's `id`. For example:
+
+```console
+% terraform import aws_grafana_workspace.example g-2054c75a02
+```
+
+<!-- cache-key: cdktf-0.18.0 input-820d8fa60d26cc380b30e0e075e8870fa4551ee953fef3e08d695a7c4dd8f5a0 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/grafana_workspace_api_key.html.markdown b/website/docs/cdktf/python/r/grafana_workspace_api_key.html.markdown
new file mode 100644
index 00000000000..21f5b2e16fc
--- /dev/null
+++ b/website/docs/cdktf/python/r/grafana_workspace_api_key.html.markdown
@@ -0,0 +1,54 @@
+---
+subcategory: "Managed Grafana"
+layout: "aws"
+page_title: "AWS: aws_grafana_workspace_api_key"
+description: |-
+  Creates a Grafana API key for the workspace. This key can be used to authenticate requests sent to the workspace's HTTP API.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_grafana_workspace_api_key
+
+Provides an Amazon Managed Grafana workspace API Key resource.
+
+## Example Usage
+
+### Basic configuration
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.grafana_workspace_api_key import GrafanaWorkspaceApiKey
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        GrafanaWorkspaceApiKey(self, "key",
+            key_name="test-key",
+            key_role="VIEWER",
+            seconds_to_live=3600,
+            workspace_id=test.id
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+- `key_name` - (Required) Specifies the name of the API key. Key names must be unique to the workspace.
+- `key_role` - (Required) Specifies the permission level of the API key. Valid values are `VIEWER`, `EDITOR`, or `ADMIN`.
+- `seconds_to_live` - (Required) Specifies the time in seconds until the API key expires. Keys can be valid for up to 30 days.
+- `workspace_id` - (Required) The ID of the workspace that the API key is valid for.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `key` - The key token in JSON format. Use this value as a bearer token to authenticate HTTP requests to the workspace.
+
+<!-- cache-key: cdktf-0.18.0 input-9633668281b65801757ef3306eb1542f89dab699a63f4f4b2b48d996c5bf8f4b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/grafana_workspace_saml_configuration.html.markdown b/website/docs/cdktf/python/r/grafana_workspace_saml_configuration.html.markdown
new file mode 100644
index 00000000000..cdd5b8b6f6f
--- /dev/null
+++ b/website/docs/cdktf/python/r/grafana_workspace_saml_configuration.html.markdown
@@ -0,0 +1,111 @@
+---
+subcategory: "Managed Grafana"
+layout: "aws"
+page_title: "AWS: aws_grafana_workspace_saml_configuration"
+description: |-
+  Provides an Amazon Managed Grafana workspace SAML configuration resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_grafana_workspace_saml_configuration
+
+Provides an Amazon Managed Grafana workspace SAML configuration resource.
+
+## Example Usage
+
+### Basic configuration
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.grafana_workspace import GrafanaWorkspace
+from imports.aws.grafana_workspace_saml_configuration import GrafanaWorkspaceSamlConfiguration
+from imports.aws.iam_role import IamRole
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        assume = IamRole(self, "assume",
+            assume_role_policy=Token.as_string(
+                Fn.jsonencode({
+                    "Statement": [{
+                        "Action": "sts:AssumeRole",
+                        "Effect": "Allow",
+                        "Principal": {
+                            "Service": "grafana.amazonaws.com"
+                        },
+                        "Sid": ""
+                    }
+                    ],
+                    "Version": "2012-10-17"
+                })),
+            name="grafana-assume"
+        )
+        example = GrafanaWorkspace(self, "example",
+            account_access_type="CURRENT_ACCOUNT",
+            authentication_providers=["SAML"],
+            permission_type="SERVICE_MANAGED",
+            role_arn=assume.arn
+        )
+        aws_grafana_workspace_saml_configuration_example =
+        GrafanaWorkspaceSamlConfiguration(self, "example_2",
+            editor_role_values=["editor"],
+            idp_metadata_url="https://my_idp_metadata.url",
+            workspace_id=example.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_grafana_workspace_saml_configuration_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `editor_role_values` - (Required) The editor role values.
+* `workspace_id` - (Required) The workspace id.
+
+The following arguments are optional:
+
+* `admin_role_values` - (Optional) The admin role values.
+* `allowed_organizations` - (Optional) The allowed organizations.
+* `email_assertion` - (Optional) The email assertion.
+* `groups_assertion` - (Optional) The groups assertion.
+* `idp_metadata_url` - (Optional) The IDP Metadata URL. Note that either `idp_metadata_url` or `idp_metadata_xml` (but not both) must be specified.
+* `idp_metadata_xml` - (Optional) The IDP Metadata XML. Note that either `idp_metadata_url` or `idp_metadata_xml` (but not both) must be specified.
+* `login_assertion` - (Optional) The login assertion.
+* `login_validity_duration` - (Optional) The login validity duration.
+* `name_assertion` - (Optional) The name assertion.
+* `org_assertion` - (Optional) The org assertion.
+* `role_assertion` - (Optional) The role assertion.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `status` - The status of the SAML configuration.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Grafana Workspace SAML configuration using the workspace's `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Grafana Workspace SAML configuration using the workspace's `id`. For example:
+
+```console
+% terraform import aws_grafana_workspace_saml_configuration.example g-2054c75a02
+```
+
+<!-- cache-key: cdktf-0.18.0 input-8e2fc0417f74c403628b82a9ce17055a1086f9bba22d87c4e859c5d48f99d2cb -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/guardduty_detector.html.markdown b/website/docs/cdktf/python/r/guardduty_detector.html.markdown
new file mode 100644
index 00000000000..23c5a886b31
--- /dev/null
+++ b/website/docs/cdktf/python/r/guardduty_detector.html.markdown
@@ -0,0 +1,147 @@
+---
+subcategory: "GuardDuty"
+layout: "aws"
+page_title: "AWS: aws_guardduty_detector"
+description: |-
+  Provides a resource to manage an Amazon GuardDuty detector
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_guardduty_detector
+
+Provides a resource to manage an Amazon GuardDuty detector.
+
+~> **NOTE:** Deleting this resource is equivalent to "disabling" GuardDuty for an AWS region, which removes all existing findings. You can set the `enable` attribute to `false` to instead "suspend" monitoring and feedback reporting while keeping existing data. See the [Suspending or Disabling Amazon GuardDuty documentation](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_suspend-disable.html) for more information.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.guardduty_detector import GuarddutyDetector
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        GuarddutyDetector(self, "MyDetector",
+            datasources=GuarddutyDetectorDatasources(
+                kubernetes=GuarddutyDetectorDatasourcesKubernetes(
+                    audit_logs=GuarddutyDetectorDatasourcesKubernetesAuditLogs(
+                        enable=False
+                    )
+                ),
+                malware_protection=GuarddutyDetectorDatasourcesMalwareProtection(
+                    scan_ec2_instance_with_findings=GuarddutyDetectorDatasourcesMalwareProtectionScanEc2InstanceWithFindings(
+                        ebs_volumes=GuarddutyDetectorDatasourcesMalwareProtectionScanEc2InstanceWithFindingsEbsVolumes(
+                            enable=True
+                        )
+                    )
+                ),
+                s3_logs=GuarddutyDetectorDatasourcesS3Logs(
+                    enable=True
+                )
+            ),
+            enable=True
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `enable` - (Optional) Enable monitoring and feedback reporting. Setting to `false` is equivalent to "suspending" GuardDuty. Defaults to `true`.
+* `finding_publishing_frequency` - (Optional) Specifies the frequency of notifications sent for subsequent finding occurrences. If the detector is a GuardDuty member account, the value is determined by the GuardDuty primary account and cannot be modified, otherwise defaults to `SIX_HOURS`. For standalone and GuardDuty primary accounts, it must be configured in Terraform to enable drift detection. Valid values for standalone and primary accounts: `FIFTEEN_MINUTES`, `ONE_HOUR`, `SIX_HOURS`. See [AWS Documentation](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_findings_cloudwatch.html#guardduty_findings_cloudwatch_notification_frequency) for more information.
+* `datasources` - (Optional) Describes which data sources will be enabled for the detector. See [Data Sources](#data-sources) below for more details. [Deprecated](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-feature-object-api-changes-march2023.html) in favor of [`aws_guardduty_detector_feature` resources](guardduty_detector_feature.html).
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Data Sources
+
+The `datasources` block supports the following:
+
+* `s3_logs` - (Optional) Configures [S3 protection](https://docs.aws.amazon.com/guardduty/latest/ug/s3-protection.html).
+  See [S3 Logs](#s3-logs) below for more details.
+* `kubernetes` - (Optional) Configures [Kubernetes protection](https://docs.aws.amazon.com/guardduty/latest/ug/kubernetes-protection.html).
+  See [Kubernetes](#kubernetes) and [Kubernetes Audit Logs](#kubernetes-audit-logs) below for more details.
+* `malware_protection` - (Optional) Configures [Malware Protection](https://docs.aws.amazon.com/guardduty/latest/ug/malware-protection.html).
+  See [Malware Protection](#malware-protection), [Scan EC2 instance with findings](#scan-ec2-instance-with-findings) and [EBS volumes](#ebs-volumes) below for more details.
+
+The `datasources` block is deprecated since March 2023. Use the `features` block instead and [map each `datasources` block to the corresponding `features` block](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-feature-object-api-changes-march2023.html#guardduty-feature-enablement-datasource-relation).
+
+### S3 Logs
+
+The `s3_logs` block supports the following:
+
+* `enable` - (Required) If true, enables [S3 protection](https://docs.aws.amazon.com/guardduty/latest/ug/s3-protection.html).
+  Defaults to `true`.
+
+### Kubernetes
+
+The `kubernetes` block supports the following:
+
+* `audit_logs` - (Required) Configures Kubernetes audit logs as a data source for [Kubernetes protection](https://docs.aws.amazon.com/guardduty/latest/ug/kubernetes-protection.html).
+  See [Kubernetes Audit Logs](#kubernetes-audit-logs) below for more details.
+
+### Kubernetes Audit Logs
+
+The `audit_logs` block supports the following:
+
+* `enable` - (Required) If true, enables Kubernetes audit logs as a data source for [Kubernetes protection](https://docs.aws.amazon.com/guardduty/latest/ug/kubernetes-protection.html).
+  Defaults to `true`.
+
+### Malware Protection
+
+`malware_protection` block supports the following:
+
+* `scan_ec2_instance_with_findings` - (Required) Configure whether [Malware Protection](https://docs.aws.amazon.com/guardduty/latest/ug/malware-protection.html) is enabled as data source for EC2 instances with findings for the detector.
+  See [Scan EC2 instance with findings](#scan-ec2-instance-with-findings) below for more details.
+
+#### Scan EC2 instance with findings
+
+The `scan_ec2_instance_with_findings` block supports the following:
+
+* `ebs_volumes` - (Required) Configure whether scanning EBS volumes is enabled as data source for the detector for instances with findings.
+  See [EBS volumes](#ebs-volumes) below for more details.
+
+#### EBS volumes
+
+The `ebs_volumes` block supports the following:
+
+* `enable` - (Required) If true, enables [Malware Protection](https://docs.aws.amazon.com/guardduty/latest/ug/malware-protection.html) as data source for the detector.
+  Defaults to `true`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `account_id` - The AWS account ID of the GuardDuty detector
+* `arn` - Amazon Resource Name (ARN) of the GuardDuty detector
+* `id` - The ID of the GuardDuty detector
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import GuardDuty detectors using the detector ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import GuardDuty detectors using the detector ID. For example:
+
+```console
+% terraform import aws_guardduty_detector.MyDetector 00b00fd5aecc0ab60a708659477e9617
+```
+
+The ID of the detector can be retrieved via the [AWS CLI](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/guardduty/list-detectors.html) using `aws guardduty list-detectors`.
+
+<!-- cache-key: cdktf-0.18.0 input-302ad3286e382870d4c5a91d3567a07ae8a6c0466169ed1648e2acc9f1c51eaf -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/guardduty_detector_feature.html.markdown b/website/docs/cdktf/python/r/guardduty_detector_feature.html.markdown
new file mode 100644
index 00000000000..48c35d08eab
--- /dev/null
+++ b/website/docs/cdktf/python/r/guardduty_detector_feature.html.markdown
@@ -0,0 +1,67 @@
+---
+subcategory: "GuardDuty"
+layout: "aws"
+page_title: "AWS: aws_guardduty_detector_feature"
+description: |-
+  Provides a resource to manage an Amazon GuardDuty detector feature
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_guardduty_detector_feature
+
+Provides a resource to manage a single Amazon GuardDuty [detector feature](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-features-activation-model.html#guardduty-features).
+
+~> **NOTE:** Deleting this resource does not disable the detector feature, the resource in simply removed from state instead.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws. import GuarddutyDetectorFeature
+from imports.aws.guardduty_detector import GuarddutyDetector
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = GuarddutyDetector(self, "example",
+            enable=True
+        )
+        GuarddutyDetectorFeature(self, "eks_runtime_monitoring",
+            additional_configuration=[{
+                "name": "EKS_ADDON_MANAGEMENT",
+                "status": "ENABLED"
+            }
+            ],
+            detector_id=example.id,
+            name="EKS_RUNTIME_MONITORING",
+            status="ENABLED"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `detector_id` - (Required) Amazon GuardDuty detector ID.
+* `name` - (Required) The name of the detector feature. Valid values: `S3_DATA_EVENTS`, `EKS_AUDIT_LOGS`, `EBS_MALWARE_PROTECTION`, `RDS_LOGIN_EVENTS`, `EKS_RUNTIME_MONITORING`, `LAMBDA_NETWORK_LOGS`.
+* `status` - (Required) The status of the detector feature. Valid values: `ENABLED`, `DISABLED`.
+* `additional_configuration` - (Optional) Additional feature configuration block. See [below](#additional-configuration).
+
+### Additional Configuration
+
+The `additional_configuration` block supports the following:
+
+* `name` - (Required) The name of the additional configuration. Valid values: `EKS_ADDON_MANAGEMENT`.
+* `status` - (Required) The status of the additional configuration. Valid values: `ENABLED`, `DISABLED`.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+<!-- cache-key: cdktf-0.18.0 input-730bfa0c7a2b94ed5a34772f00e9b6d3c65956aa82ca10d129920a025e89eb3e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/guardduty_filter.html.markdown b/website/docs/cdktf/python/r/guardduty_filter.html.markdown
new file mode 100644
index 00000000000..6e095c682c0
--- /dev/null
+++ b/website/docs/cdktf/python/r/guardduty_filter.html.markdown
@@ -0,0 +1,105 @@
+---
+subcategory: "GuardDuty"
+layout: "aws"
+page_title: "AWS: aws_guardduty_filter"
+description: |-
+  Provides a resource to manage a GuardDuty filter
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_guardduty_filter
+
+Provides a resource to manage a GuardDuty filter.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.guardduty_filter import GuarddutyFilter
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        GuarddutyFilter(self, "MyFilter",
+            action="ARCHIVE",
+            detector_id=example.id,
+            finding_criteria=GuarddutyFilterFindingCriteria(
+                criterion=[GuarddutyFilterFindingCriteriaCriterion(
+                    equal_to=["eu-west-1"],
+                    field="region"
+                ), GuarddutyFilterFindingCriteriaCriterion(
+                    field="service.additionalInfo.threatListName",
+                    not_equals=["some-threat", "another-threat"]
+                ), GuarddutyFilterFindingCriteriaCriterion(
+                    field="updatedAt",
+                    greater_than="2020-01-01T00:00:00Z",
+                    less_than="2020-02-01T00:00:00Z"
+                ), GuarddutyFilterFindingCriteriaCriterion(
+                    field="severity",
+                    greater_than_or_equal="4"
+                )
+                ]
+            ),
+            name="MyFilter",
+            rank=1
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `detector_id` - (Required) ID of a GuardDuty detector, attached to your account.
+* `name` - (Required) The name of your filter.
+* `description` - (Optional) Description of the filter.
+* `rank` - (Required) Specifies the position of the filter in the list of current filters. Also specifies the order in which this filter is applied to the findings.
+* `action` - (Required) Specifies the action that is to be applied to the findings that match the filter. Can be one of `ARCHIVE` or `NOOP`.
+* `tags` (Optional) - The tags that you want to add to the Filter resource. A tag consists of a key and a value. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `finding_criteria` (Required) - Represents the criteria to be used in the filter for querying findings. Contains one or more `criterion` blocks, documented [below](#criterion).
+
+### criterion
+
+The `criterion` block suports the following:
+
+* `field` - (Required) The name of the field to be evaluated. The full list of field names can be found in [AWS documentation](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_filter-findings.html#filter_criteria).
+* `equals` - (Optional) List of string values to be evaluated.
+* `not_equals` - (Optional) List of string values to be evaluated.
+* `greater_than` - (Optional) A value to be evaluated. Accepts either an integer or a date in [RFC 3339 format](https://tools.ietf.org/html/rfc3339#section-5.8).
+* `greater_than_or_equal` - (Optional) A value to be evaluated. Accepts either an integer or a date in [RFC 3339 format](https://tools.ietf.org/html/rfc3339#section-5.8).
+* `less_than` - (Optional) A value to be evaluated. Accepts either an integer or a date in [RFC 3339 format](https://tools.ietf.org/html/rfc3339#section-5.8).
+* `less_than_or_equal` - (Optional) A value to be evaluated. Accepts either an integer or a date in [RFC 3339 format](https://tools.ietf.org/html/rfc3339#section-5.8).
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the GuardDuty filter.
+* `id` - A compound field, consisting of the ID of the GuardDuty detector and the name of the filter.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import GuardDuty filters using the detector ID and filter's name separated by a colon. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import GuardDuty filters using the detector ID and filter's name separated by a colon. For example:
+
+```console
+% terraform import aws_guardduty_filter.MyFilter 00b00fd5aecc0ab60a708659477e9617:MyFilter
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1e606d1888ce4c1d9fc3a9cf0b4de2053e508ab6db3e76bc7736c3226909e127 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/guardduty_invite_accepter.html.markdown b/website/docs/cdktf/python/r/guardduty_invite_accepter.html.markdown
new file mode 100644
index 00000000000..1bff43ea135
--- /dev/null
+++ b/website/docs/cdktf/python/r/guardduty_invite_accepter.html.markdown
@@ -0,0 +1,101 @@
+---
+subcategory: "GuardDuty"
+layout: "aws"
+page_title: "AWS: aws_guardduty_invite_accepter"
+description: |-
+  Provides a resource to accept a pending GuardDuty invite on creation, ensure the detector has the correct primary account on read, and disassociate with the primary account upon removal.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_guardduty_invite_accepter
+
+Provides a resource to accept a pending GuardDuty invite on creation, ensure the detector has the correct primary account on read, and disassociate with the primary account upon removal.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.guardduty_detector import GuarddutyDetector
+from imports.aws.guardduty_invite_accepter import GuarddutyInviteAccepter
+from imports.aws.guardduty_member import GuarddutyMember
+from imports.aws.provider import AwsProvider
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        primary = AwsProvider(self, "aws",
+            alias="primary"
+        )
+        member = AwsProvider(self, "aws_1",
+            alias="member"
+        )
+        aws_guardduty_detector_member = GuarddutyDetector(self, "member",
+            provider=member
+        )
+        aws_guardduty_detector_primary = GuarddutyDetector(self, "primary",
+            provider=primary
+        )
+        aws_guardduty_member_member = GuarddutyMember(self, "member_4",
+            account_id=Token.as_string(aws_guardduty_detector_member.account_id),
+            detector_id=Token.as_string(aws_guardduty_detector_primary.id),
+            email="required@example.com",
+            invite=True,
+            provider=primary
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_guardduty_member_member.override_logical_id("member")
+        aws_guardduty_invite_accepter_member = GuarddutyInviteAccepter(self, "member_5",
+            depends_on=[aws_guardduty_member_member],
+            detector_id=Token.as_string(aws_guardduty_detector_member.id),
+            master_account_id=Token.as_string(aws_guardduty_detector_primary.account_id),
+            provider=member
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_guardduty_invite_accepter_member.override_logical_id("member")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `detector_id` - (Required) The detector ID of the member GuardDuty account.
+* `master_account_id` - (Required) AWS account ID for primary account.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - GuardDuty member detector ID
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `1m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_guardduty_invite_accepter` using the member GuardDuty detector ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_guardduty_invite_accepter` using the member GuardDuty detector ID. For example:
+
+```console
+% terraform import aws_guardduty_invite_accepter.member 00b00fd5aecc0ab60a708659477e9617
+```
+
+<!-- cache-key: cdktf-0.18.0 input-b368eea7537bdd5e2ab4ccd975cb44eb377f3627dcb046e902234d27ed097808 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/guardduty_ipset.html.markdown b/website/docs/cdktf/python/r/guardduty_ipset.html.markdown
new file mode 100644
index 00000000000..7ae7cf08fbe
--- /dev/null
+++ b/website/docs/cdktf/python/r/guardduty_ipset.html.markdown
@@ -0,0 +1,94 @@
+---
+subcategory: "GuardDuty"
+layout: aws
+page_title: 'AWS: aws_guardduty_ipset'
+description: Provides a resource to manage a GuardDuty IPSet
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_guardduty_ipset
+
+Provides a resource to manage a GuardDuty IPSet.
+
+~> **Note:** Currently in GuardDuty, users from member accounts cannot upload and further manage IPSets. IPSets that are uploaded by the primary account are imposed on GuardDuty functionality in its member accounts. See the [GuardDuty API Documentation](https://docs.aws.amazon.com/guardduty/latest/ug/create-ip-set.html)
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.guardduty_detector import GuarddutyDetector
+from imports.aws.guardduty_ipset import GuarddutyIpset
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_acl import S3BucketAcl
+from imports.aws.s3_object import S3Object
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        primary = GuarddutyDetector(self, "primary",
+            enable=True
+        )
+        bucket = S3Bucket(self, "bucket")
+        S3BucketAcl(self, "bucket_acl",
+            acl="private",
+            bucket=bucket.id
+        )
+        my_ip_set = S3Object(self, "MyIPSet",
+            bucket=bucket.id,
+            content="10.0.0.0/8\n\n",
+            key="MyIPSet"
+        )
+        GuarddutyIpset(self, "example",
+            activate=True,
+            detector_id=primary.id,
+            format="TXT",
+            location="https://s3.amazonaws.com/${" + my_ip_set.bucket + "}/${" + my_ip_set.key + "}",
+            name="MyIPSet"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `activate` - (Required) Specifies whether GuardDuty is to start using the uploaded IPSet.
+* `detector_id` - (Required) The detector ID of the GuardDuty.
+* `format` - (Required) The format of the file that contains the IPSet. Valid values: `TXT` | `STIX` | `OTX_CSV` | `ALIEN_VAULT` | `PROOF_POINT` | `FIRE_EYE`
+* `location` - (Required) The URI of the file that contains the IPSet.
+* `name` - (Required) The friendly name to identify the IPSet.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the GuardDuty IPSet.
+* `id` - The ID of the GuardDuty IPSet.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import GuardDuty IPSet using the primary GuardDuty detector ID and IPSet ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import GuardDuty IPSet using the primary GuardDuty detector ID and IPSet ID. For example:
+
+```console
+% terraform import aws_guardduty_ipset.MyIPSet 00b00fd5aecc0ab60a708659477e9617:123456789012
+```
+
+<!-- cache-key: cdktf-0.18.0 input-5a9aeb8596a1584664d2e630a427541e8d151a5e9c5c5912959a88b2da9c2384 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/guardduty_member.html.markdown b/website/docs/cdktf/python/r/guardduty_member.html.markdown
new file mode 100644
index 00000000000..cd73c16cf8f
--- /dev/null
+++ b/website/docs/cdktf/python/r/guardduty_member.html.markdown
@@ -0,0 +1,92 @@
+---
+subcategory: "GuardDuty"
+layout: "aws"
+page_title: "AWS: aws_guardduty_member"
+description: |-
+  Provides a resource to manage a GuardDuty member
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_guardduty_member
+
+Provides a resource to manage a GuardDuty member. To accept invitations in member accounts, see the [`aws_guardduty_invite_accepter` resource](/docs/providers/aws/r/guardduty_invite_accepter.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.guardduty_detector import GuarddutyDetector
+from imports.aws.guardduty_member import GuarddutyMember
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        member = GuarddutyDetector(self, "member",
+            enable=True,
+            provider=dev
+        )
+        primary = GuarddutyDetector(self, "primary",
+            enable=True
+        )
+        aws_guardduty_member_member = GuarddutyMember(self, "member_2",
+            account_id=member.account_id,
+            detector_id=primary.id,
+            email="required@example.com",
+            invitation_message="please accept guardduty invitation",
+            invite=True
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_guardduty_member_member.override_logical_id("member")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `account_id` - (Required) AWS account ID for member account.
+* `detector_id` - (Required) The detector ID of the GuardDuty account where you want to create member accounts.
+* `email` - (Required) Email address for member account.
+* `invite` - (Optional) Boolean whether to invite the account to GuardDuty as a member. Defaults to `false`. To detect if an invitation needs to be (re-)sent, the Terraform state value is `true` based on a `relationship_status` of `Disabled`, `Enabled`, `Invited`, or `EmailVerificationInProgress`.
+* `invitation_message` - (Optional) Message for invitation.
+* `disable_email_notification` - (Optional) Boolean whether an email notification is sent to the accounts. Defaults to `false`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the GuardDuty member
+* `relationship_status` - The status of the relationship between the member account and its primary account. More information can be found in [Amazon GuardDuty API Reference](https://docs.aws.amazon.com/guardduty/latest/ug/get-members.html).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `1m`)
+- `update` - (Default `1m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import GuardDuty members using the primary GuardDuty detector ID and member AWS account ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import GuardDuty members using the primary GuardDuty detector ID and member AWS account ID. For example:
+
+```console
+% terraform import aws_guardduty_member.MyMember 00b00fd5aecc0ab60a708659477e9617:123456789012
+```
+
+<!-- cache-key: cdktf-0.18.0 input-8c795e9bdb95e2477dec1e7c539b60d6a51b31c90c42c663ecd2ece13c210023 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/guardduty_organization_admin_account.html.markdown b/website/docs/cdktf/python/r/guardduty_organization_admin_account.html.markdown
new file mode 100644
index 00000000000..3887e7ea6af
--- /dev/null
+++ b/website/docs/cdktf/python/r/guardduty_organization_admin_account.html.markdown
@@ -0,0 +1,78 @@
+---
+subcategory: "GuardDuty"
+layout: "aws"
+page_title: "AWS: aws_guardduty_organization_admin_account"
+description: |-
+  Manages a GuardDuty Organization Admin Account
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_guardduty_organization_admin_account
+
+Manages a GuardDuty Organization Admin Account. The AWS account utilizing this resource must be an Organizations primary account. More information about Organizations support in GuardDuty can be found in the [GuardDuty User Guide](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_organizations.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.guardduty_detector import GuarddutyDetector
+from imports.aws.guardduty_organization_admin_account import GuarddutyOrganizationAdminAccount
+from imports.aws.organizations_organization import OrganizationsOrganization
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        GuarddutyDetector(self, "example")
+        aws_organizations_organization_example = OrganizationsOrganization(self, "example_1",
+            aws_service_access_principals=["guardduty.amazonaws.com"],
+            feature_set="ALL"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_organizations_organization_example.override_logical_id("example")
+        aws_guardduty_organization_admin_account_example =
+        GuarddutyOrganizationAdminAccount(self, "example_2",
+            admin_account_id="123456789012",
+            depends_on=[aws_organizations_organization_example]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_guardduty_organization_admin_account_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `admin_account_id` - (Required) AWS account identifier to designate as a delegated administrator for GuardDuty.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - AWS account identifier.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import GuardDuty Organization Admin Account using the AWS account ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import GuardDuty Organization Admin Account using the AWS account ID. For example:
+
+```console
+% terraform import aws_guardduty_organization_admin_account.example 123456789012
+```
+
+<!-- cache-key: cdktf-0.18.0 input-9503edb267379cc704ded824b2c1ffae37e126e5b11a01a39000716b3a61347e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/guardduty_organization_configuration.html.markdown b/website/docs/cdktf/python/r/guardduty_organization_configuration.html.markdown
new file mode 100644
index 00000000000..5cfa2d8f3a3
--- /dev/null
+++ b/website/docs/cdktf/python/r/guardduty_organization_configuration.html.markdown
@@ -0,0 +1,144 @@
+---
+subcategory: "GuardDuty"
+layout: "aws"
+page_title: "AWS: aws_guardduty_organization_configuration"
+description: |-
+  Manages the GuardDuty Organization Configuration
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_guardduty_organization_configuration
+
+Manages the GuardDuty Organization Configuration in the current AWS Region. The AWS account utilizing this resource must have been assigned as a delegated Organization administrator account, e.g., via the [`aws_guardduty_organization_admin_account` resource](/docs/providers/aws/r/guardduty_organization_admin_account.html). More information about Organizations support in GuardDuty can be found in the [GuardDuty User Guide](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_organizations.html).
+
+~> **NOTE:** This is an advanced Terraform resource. Terraform will automatically assume management of the GuardDuty Organization Configuration without import and perform no actions on removal from the Terraform configuration.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.guardduty_detector import GuarddutyDetector
+from imports.aws.guardduty_organization_configuration import GuarddutyOrganizationConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = GuarddutyDetector(self, "example",
+            enable=True
+        )
+        aws_guardduty_organization_configuration_example =
+        GuarddutyOrganizationConfiguration(self, "example_1",
+            auto_enable_organization_members="ALL",
+            datasources=GuarddutyOrganizationConfigurationDatasources(
+                kubernetes=GuarddutyOrganizationConfigurationDatasourcesKubernetes(
+                    audit_logs=GuarddutyOrganizationConfigurationDatasourcesKubernetesAuditLogs(
+                        enable=True
+                    )
+                ),
+                malware_protection=GuarddutyOrganizationConfigurationDatasourcesMalwareProtection(
+                    scan_ec2_instance_with_findings=GuarddutyOrganizationConfigurationDatasourcesMalwareProtectionScanEc2InstanceWithFindings(
+                        ebs_volumes=GuarddutyOrganizationConfigurationDatasourcesMalwareProtectionScanEc2InstanceWithFindingsEbsVolumes(
+                            auto_enable=True
+                        )
+                    )
+                ),
+                s3_logs=GuarddutyOrganizationConfigurationDatasourcesS3Logs(
+                    auto_enable=True
+                )
+            ),
+            detector_id=example.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_guardduty_organization_configuration_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+~> **NOTE:** One of `auto_enable` or `auto_enable_organization_members` must be specified.
+
+This argument supports the following arguments:
+
+* `auto_enable` - (Optional) *Deprecated:* Use `auto_enable_organization_members` instead. When this setting is enabled, all new accounts that are created in, or added to, the organization are added as a member accounts of the organization’s GuardDuty delegated administrator and GuardDuty is enabled in that AWS Region.
+* `auto_enable_organization_members` - (Optional) Indicates the auto-enablement configuration of GuardDuty for the member accounts in the organization. Valid values are `ALL`, `NEW`, `NONE`.
+* `detector_id` - (Required) The detector ID of the GuardDuty account.
+* `datasources` - (Optional) Configuration for the collected datasources.
+
+`datasources` supports the following:
+
+* `s3_logs` - (Optional) Enable S3 Protection automatically for new member accounts.
+* `kubernetes` - (Optional) Enable Kubernetes Audit Logs Monitoring automatically for new member accounts.
+* `malware_protection` - (Optional) Enable Malware Protection automatically for new member accounts.
+
+### S3 Logs
+
+`s3_logs` block supports the following:
+
+* `auto_enable` - (Optional) Set to `true` if you want S3 data event logs to be automatically enabled for new members of the organization. Default: `false`
+
+### Kubernetes
+
+`kubernetes` block supports the following:
+
+* `audit_logs` - (Required) Enable Kubernetes Audit Logs Monitoring automatically for new member accounts. [Kubernetes protection](https://docs.aws.amazon.com/guardduty/latest/ug/kubernetes-protection.html).
+  See [Kubernetes Audit Logs](#kubernetes-audit-logs) below for more details.
+
+#### Kubernetes Audit Logs
+
+The `audit_logs` block supports the following:
+
+* `enable` - (Required) If true, enables Kubernetes audit logs as a data source for [Kubernetes protection](https://docs.aws.amazon.com/guardduty/latest/ug/kubernetes-protection.html).
+  Defaults to `true`.
+
+### Malware Protection
+
+`malware_protection` block supports the following:
+
+* `scan_ec2_instance_with_findings` - (Required) Configure whether [Malware Protection](https://docs.aws.amazon.com/guardduty/latest/ug/malware-protection.html) for EC2 instances with findings should be auto-enabled for new members joining the organization.
+   See [Scan EC2 instance with findings](#scan-ec2-instance-with-findings) below for more details.
+
+#### Scan EC2 instance with findings
+
+The `scan_ec2_instance_with_findings` block supports the following:
+
+* `ebs_volumes` - (Required) Configure whether scanning EBS volumes should be auto-enabled for new members joining the organization
+  See [EBS volumes](#ebs-volumes) below for more details.
+
+#### EBS volumes
+
+The `ebs_volumes` block supports the following:
+
+* `auto_enable` - (Required) If true, enables [Malware Protection](https://docs.aws.amazon.com/guardduty/latest/ug/malware-protection.html) for all new accounts joining the organization.
+  Defaults to `true`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Identifier of the GuardDuty Detector.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import GuardDuty Organization Configurations using the GuardDuty Detector ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import GuardDuty Organization Configurations using the GuardDuty Detector ID. For example:
+
+```console
+% terraform import aws_guardduty_organization_configuration.example 00b00fd5aecc0ab60a708659477e9617
+```
+
+<!-- cache-key: cdktf-0.18.0 input-445f6fbfec553e986e4f75415b80de0e8cbed40dec40a9dd732c3ede81c717e3 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/guardduty_organization_configuration_feature.html.markdown b/website/docs/cdktf/python/r/guardduty_organization_configuration_feature.html.markdown
new file mode 100644
index 00000000000..0ba40b29f30
--- /dev/null
+++ b/website/docs/cdktf/python/r/guardduty_organization_configuration_feature.html.markdown
@@ -0,0 +1,67 @@
+---
+subcategory: "GuardDuty"
+layout: "aws"
+page_title: "AWS: aws_guardduty_organization_configuration_feature"
+description: |-
+  Provides a resource to manage an Amazon GuardDuty organization configuration feature
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_guardduty_organization_configuration_feature
+
+Provides a resource to manage a single Amazon GuardDuty [organization configuration feature](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-features-activation-model.html#guardduty-features).
+
+~> **NOTE:** Deleting this resource does not disable the organization configuration feature, the resource in simply removed from state instead.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.guardduty_detector import GuarddutyDetector
+from imports.aws.guardduty_organization_configuration_feature import GuarddutyOrganizationConfigurationFeature
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = GuarddutyDetector(self, "example",
+            enable=True
+        )
+        GuarddutyOrganizationConfigurationFeature(self, "eks_runtime_monitoring",
+            additional_configuration=[GuarddutyOrganizationConfigurationFeatureAdditionalConfiguration(
+                auto_enable="NEW",
+                name="EKS_ADDON_MANAGEMENT"
+            )
+            ],
+            auto_enable="ALL",
+            detector_id=example.id,
+            name="EKS_RUNTIME_MONITORING"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `auto_enable` - (Required) The status of the feature that is configured for the member accounts within the organization. Valid values: `NEW`, `ALL`, `NONE`.
+* `detector_id` - (Required) The ID of the detector that configures the delegated administrator.
+* `name` - (Required) The name of the feature that will be configured for the organization. Valid values: `S3_DATA_EVENTS`, `EKS_AUDIT_LOGS`, `EBS_MALWARE_PROTECTION`, `RDS_LOGIN_EVENTS`, `EKS_RUNTIME_MONITORING`, `LAMBDA_NETWORK_LOGS`.
+* `additional_configuration` - (Optional) The additional information that will be configured for the organization See [below](#additional-configuration).
+
+### Additional Configuration
+
+The `additional_configuration` block supports the following:
+
+* `auto_enable` - (Required) The status of the additional configuration that will be configured for the organization. Valid values: `NEW`, `ALL`, `NONE`.
+* `name` - (Required) The name of the additional configuration that will be configured for the organization. Valid values: `EKS_ADDON_MANAGEMENT`.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+<!-- cache-key: cdktf-0.18.0 input-af534c2b9dc87ad328aeada98eac41421489586c67758449e011a8a7d6b7e223 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/guardduty_publishing_destination.html.markdown b/website/docs/cdktf/python/r/guardduty_publishing_destination.html.markdown
new file mode 100644
index 00000000000..18d67ab64c6
--- /dev/null
+++ b/website/docs/cdktf/python/r/guardduty_publishing_destination.html.markdown
@@ -0,0 +1,152 @@
+---
+subcategory: "GuardDuty"
+layout: aws
+page_title: 'AWS: aws_guardduty_publishing_destination'
+description: Provides a resource to manage a GuardDuty PublishingDestination
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_guardduty_publishing_destination
+
+Provides a resource to manage a GuardDuty PublishingDestination. Requires an existing GuardDuty Detector.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_caller_identity import DataAwsCallerIdentity
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.data_aws_region import DataAwsRegion
+from imports.aws.guardduty_detector import GuarddutyDetector
+from imports.aws.guardduty_publishing_destination import GuarddutyPublishingDestination
+from imports.aws.kms_key import KmsKey
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_acl import S3BucketAcl
+from imports.aws.s3_bucket_policy import S3BucketPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        test_gd = GuarddutyDetector(self, "test_gd",
+            enable=True
+        )
+        gd_bucket = S3Bucket(self, "gd_bucket",
+            bucket="example",
+            force_destroy=True
+        )
+        S3BucketAcl(self, "gd_bucket_acl",
+            acl="private",
+            bucket=gd_bucket.id
+        )
+        current = DataAwsCallerIdentity(self, "current")
+        bucket_pol = DataAwsIamPolicyDocument(self, "bucket_pol",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["s3:PutObject"],
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["guardduty.amazonaws.com"],
+                    type="Service"
+                )
+                ],
+                resources=["${" + gd_bucket.arn + "}/*"],
+                sid="Allow PutObject"
+            ), DataAwsIamPolicyDocumentStatement(
+                actions=["s3:GetBucketLocation"],
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["guardduty.amazonaws.com"],
+                    type="Service"
+                )
+                ],
+                resources=[gd_bucket.arn],
+                sid="Allow GetBucketLocation"
+            )
+            ]
+        )
+        data_aws_region_current = DataAwsRegion(self, "current_5")
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_region_current.override_logical_id("current")
+        gd_bucket_policy = S3BucketPolicy(self, "gd_bucket_policy",
+            bucket=gd_bucket.id,
+            policy=Token.as_string(bucket_pol.json)
+        )
+        kms_pol = DataAwsIamPolicyDocument(self, "kms_pol",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["kms:GenerateDataKey"],
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["guardduty.amazonaws.com"],
+                    type="Service"
+                )
+                ],
+                resources=["arn:aws:kms:${" + data_aws_region_current.name + "}:${" + current.account_id + "}:key/*"
+                ],
+                sid="Allow GuardDuty to encrypt findings"
+            ), DataAwsIamPolicyDocumentStatement(
+                actions=["kms:*"],
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["arn:aws:iam::${" + current.account_id + "}:root"],
+                    type="AWS"
+                )
+                ],
+                resources=["arn:aws:kms:${" + data_aws_region_current.name + "}:${" + current.account_id + "}:key/*"
+                ],
+                sid="Allow all users to modify/delete key (test only)"
+            )
+            ]
+        )
+        gd_key = KmsKey(self, "gd_key",
+            deletion_window_in_days=7,
+            description="Temporary key for AccTest of TF",
+            policy=Token.as_string(kms_pol.json)
+        )
+        GuarddutyPublishingDestination(self, "test",
+            depends_on=[gd_bucket_policy],
+            destination_arn=gd_bucket.arn,
+            detector_id=test_gd.id,
+            kms_key_arn=gd_key.arn
+        )
+```
+
+~> **Note:** Please do not use this simple example for Bucket-Policy and KMS Key Policy in a production environment. It is much too open for such a use-case. Refer to the AWS documentation here: https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_exportfindings.html
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `detector_id` - (Required) The detector ID of the GuardDuty.
+* `destination_arn` - (Required) The bucket arn and prefix under which the findings get exported. Bucket-ARN is required, the prefix is optional and will be `AWSLogs/[Account-ID]/GuardDuty/[Region]/` if not provided
+* `kms_key_arn` - (Required) The ARN of the KMS key used to encrypt GuardDuty findings. GuardDuty enforces this to be encrypted.
+* `destination_type`- (Optional) Currently there is only "S3" available as destination type which is also the default value
+
+~> **Note:** In case of missing permissions (S3 Bucket Policy _or_ KMS Key permissions) the resource will fail to create. If the permissions are changed after resource creation, this can be asked from the AWS API via the "DescribePublishingDestination" call (https://docs.aws.amazon.com/cli/latest/reference/guardduty/describe-publishing-destination.html).
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the GuardDuty PublishingDestination and the detector ID. Format: `<DetectorID>:<PublishingDestinationID>`
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import GuardDuty PublishingDestination using the master GuardDuty detector ID and PublishingDestinationID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import GuardDuty PublishingDestination using the master GuardDuty detector ID and PublishingDestinationID. For example:
+
+```console
+% terraform import aws_guardduty_publishing_destination.test a4b86f26fa42e7e7cf0d1c333ea77777:a4b86f27a0e464e4a7e0516d242f1234
+```
+
+<!-- cache-key: cdktf-0.18.0 input-62a290b6c0d879190b7ab5d6098de0abf59abd632ca625aa1c6a6b8f48e6ac47 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/guardduty_threatintelset.html.markdown b/website/docs/cdktf/python/r/guardduty_threatintelset.html.markdown
new file mode 100644
index 00000000000..db8ab266d4d
--- /dev/null
+++ b/website/docs/cdktf/python/r/guardduty_threatintelset.html.markdown
@@ -0,0 +1,98 @@
+---
+subcategory: "GuardDuty"
+layout: aws
+page_title: 'AWS: aws_guardduty_threatintelset'
+description: Provides a resource to manage a GuardDuty ThreatIntelSet
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_guardduty_threatintelset
+
+Provides a resource to manage a GuardDuty ThreatIntelSet.
+
+~> **Note:** Currently in GuardDuty, users from member accounts cannot upload and further manage ThreatIntelSets. ThreatIntelSets that are uploaded by the primary account are imposed on GuardDuty functionality in its member accounts. See the [GuardDuty API Documentation](https://docs.aws.amazon.com/guardduty/latest/ug/create-threat-intel-set.html)
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.guardduty_detector import GuarddutyDetector
+from imports.aws.guardduty_threatintelset import GuarddutyThreatintelset
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_acl import S3BucketAcl
+from imports.aws.s3_object import S3Object
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        primary = GuarddutyDetector(self, "primary",
+            enable=True
+        )
+        bucket = S3Bucket(self, "bucket")
+        S3BucketAcl(self, "bucket_acl",
+            acl="private",
+            bucket=bucket.id
+        )
+        my_threat_intel_set = S3Object(self, "MyThreatIntelSet",
+            acl="public-read",
+            bucket=bucket.id,
+            content="10.0.0.0/8\n\n",
+            key="MyThreatIntelSet"
+        )
+        aws_guardduty_threatintelset_my_threat_intel_set =
+        GuarddutyThreatintelset(self, "MyThreatIntelSet_4",
+            activate=True,
+            detector_id=primary.id,
+            format="TXT",
+            location="https://s3.amazonaws.com/${" + my_threat_intel_set.bucket + "}/${" + my_threat_intel_set.key + "}",
+            name="MyThreatIntelSet"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_guardduty_threatintelset_my_threat_intel_set.override_logical_id("MyThreatIntelSet")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `activate` - (Required) Specifies whether GuardDuty is to start using the uploaded ThreatIntelSet.
+* `detector_id` - (Required) The detector ID of the GuardDuty.
+* `format` - (Required) The format of the file that contains the ThreatIntelSet. Valid values: `TXT` | `STIX` | `OTX_CSV` | `ALIEN_VAULT` | `PROOF_POINT` | `FIRE_EYE`
+* `location` - (Required) The URI of the file that contains the ThreatIntelSet.
+* `name` - (Required) The friendly name to identify the ThreatIntelSet.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the GuardDuty ThreatIntelSet.
+* `id` - The ID of the GuardDuty ThreatIntelSet and the detector ID. Format: `<DetectorID>:<ThreatIntelSetID>`
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import GuardDuty ThreatIntelSet using the primary GuardDuty detector ID and ThreatIntelSetID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import GuardDuty ThreatIntelSet using the primary GuardDuty detector ID and ThreatIntelSetID. For example:
+
+```console
+% terraform import aws_guardduty_threatintelset.MyThreatIntelSet 00b00fd5aecc0ab60a708659477e9617:123456789012
+```
+
+<!-- cache-key: cdktf-0.18.0 input-cffb05b04bc89aa2a4faddb04a7472478095a1942cb1aa200f8f7a8b0848a9fd -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/iam_access_key.html.markdown b/website/docs/cdktf/python/r/iam_access_key.html.markdown
new file mode 100644
index 00000000000..e2dbb8768a1
--- /dev/null
+++ b/website/docs/cdktf/python/r/iam_access_key.html.markdown
@@ -0,0 +1,130 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_access_key"
+description: |-
+  Provides an IAM access key. This is a set of credentials that allow API requests to be made as an IAM user.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iam_access_key
+
+Provides an IAM access key. This is a set of credentials that allow API requests to be made as an IAM user.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformOutput, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.iam_access_key import IamAccessKey
+from imports.aws.iam_user import IamUser
+from imports.aws.iam_user_policy import IamUserPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        lb = IamUser(self, "lb",
+            name="loadbalancer",
+            path="/system/"
+        )
+        lb_ro = DataAwsIamPolicyDocument(self, "lb_ro",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["ec2:Describe*"],
+                effect="Allow",
+                resources=["*"]
+            )
+            ]
+        )
+        aws_iam_access_key_lb = IamAccessKey(self, "lb_2",
+            pgp_key="keybase:some_person_that_exists",
+            user=lb.name
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_access_key_lb.override_logical_id("lb")
+        aws_iam_user_policy_lb_ro = IamUserPolicy(self, "lb_ro_3",
+            name="test",
+            policy=Token.as_string(lb_ro.json),
+            user=lb.name
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_user_policy_lb_ro.override_logical_id("lb_ro")
+        TerraformOutput(self, "secret",
+            value=aws_iam_access_key_lb.encrypted_secret
+        )
+```
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformOutput, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.iam_access_key import IamAccessKey
+from imports.aws.iam_user import IamUser
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        test = IamUser(self, "test",
+            name="test",
+            path="/test/"
+        )
+        aws_iam_access_key_test = IamAccessKey(self, "test_1",
+            user=test.name
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_access_key_test.override_logical_id("test")
+        TerraformOutput(self, "aws_iam_smtp_password_v4",
+            value=aws_iam_access_key_test.ses_smtp_password_v4
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `pgp_key` - (Optional) Either a base-64 encoded PGP public key, or a keybase username in the form `keybase:some_person_that_exists`, for use in the `encrypted_secret` output attribute. If providing a base-64 encoded PGP public key, make sure to provide the "raw" version and not the "armored" one (e.g. avoid passing the `-a` option to `gpg --export`).
+* `status` - (Optional) Access key status to apply. Defaults to `Active`. Valid values are `Active` and `Inactive`.
+* `user` - (Required) IAM user to associate with this access key.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `create_date` - Date and time in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8) that the access key was created.
+* `encrypted_secret` - Encrypted secret, base64 encoded, if `pgp_key` was specified. This attribute is not available for imported resources. The encrypted secret may be decrypted using the command line, for example: `terraform output -raw encrypted_secret | base64 --decode | keybase pgp decrypt`.
+* `encrypted_ses_smtp_password_v4` - Encrypted SES SMTP password, base64 encoded, if `pgp_key` was specified. This attribute is not available for imported resources. The encrypted password may be decrypted using the command line, for example: `terraform output -raw encrypted_ses_smtp_password_v4 | base64 --decode | keybase pgp decrypt`.
+* `id` - Access key ID.
+* `key_fingerprint` - Fingerprint of the PGP key used to encrypt the secret. This attribute is not available for imported resources.
+* `secret` - Secret access key. This attribute is not available for imported resources. Note that this will be written to the state file. If you use this, please protect your backend state file judiciously. Alternatively, you may supply a `pgp_key` instead, which will prevent the secret from being stored in plaintext, at the cost of preventing the use of the secret key in automation.
+* `ses_smtp_password_v4` - Secret access key converted into an SES SMTP password by applying [AWS's documented Sigv4 conversion algorithm](https://docs.aws.amazon.com/ses/latest/DeveloperGuide/smtp-credentials.html#smtp-credentials-convert). This attribute is not available for imported resources. As SigV4 is region specific, valid Provider regions are `ap-south-1`, `ap-southeast-2`, `eu-central-1`, `eu-west-1`, `us-east-1` and `us-west-2`. See current [AWS SES regions](https://docs.aws.amazon.com/general/latest/gr/rande.html#ses_region).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IAM Access Keys using the identifier. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import IAM Access Keys using the identifier. For example:
+
+```console
+% terraform import aws_iam_access_key.example AKIA1234567890
+```
+
+Resource attributes such as `encrypted_secret`, `key_fingerprint`, `pgp_key`, `secret`, `ses_smtp_password_v4`, and `encrypted_ses_smtp_password_v4` are not available for imported resources as this information cannot be read from the IAM API.
+
+<!-- cache-key: cdktf-0.18.0 input-d8b11bcbc6ed9d15b50dbb95fe354dd4fff5e472be0814f1548e8af45e078918 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/iam_account_alias.html.markdown b/website/docs/cdktf/python/r/iam_account_alias.html.markdown
new file mode 100644
index 00000000000..13168574f6a
--- /dev/null
+++ b/website/docs/cdktf/python/r/iam_account_alias.html.markdown
@@ -0,0 +1,65 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_account_alias"
+description: |-
+  Manages the account alias for the AWS Account.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iam_account_alias
+
+-> **Note:** There is only a single account alias per AWS account.
+
+Manages the account alias for the AWS Account.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.iam_account_alias import IamAccountAlias
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        IamAccountAlias(self, "alias",
+            account_alias="my-account-alias"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `account_alias` - (Required) The account alias
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import the current Account Alias using the `account_alias`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import the current Account Alias using the `account_alias`. For example:
+
+```console
+% terraform import aws_iam_account_alias.alias my-account-alias
+```
+
+<!-- cache-key: cdktf-0.18.0 input-72640126c5720d6095332215b1cee0a5afc0db674ccec0642c743d28f1d7ef16 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/iam_account_password_policy.html.markdown b/website/docs/cdktf/python/r/iam_account_password_policy.html.markdown
new file mode 100644
index 00000000000..ac6e85ae57d
--- /dev/null
+++ b/website/docs/cdktf/python/r/iam_account_password_policy.html.markdown
@@ -0,0 +1,82 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_account_password_policy"
+description: |-
+  Manages Password Policy for the AWS Account.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iam_account_password_policy
+
+-> **Note:** There is only a single policy allowed per AWS account. An existing policy will be lost when using this resource as an effect of this limitation.
+
+Manages Password Policy for the AWS Account.
+See more about [Account Password Policy](http://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_passwords_account-policy.html)
+in the official AWS docs.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.iam_account_password_policy import IamAccountPasswordPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        IamAccountPasswordPolicy(self, "strict",
+            allow_users_to_change_password=True,
+            minimum_password_length=8,
+            require_lowercase_characters=True,
+            require_numbers=True,
+            require_symbols=True,
+            require_uppercase_characters=True
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `allow_users_to_change_password` - (Optional) Whether to allow users to change their own password
+* `hard_expiry` - (Optional) Whether users are prevented from setting a new password after their password has expired (i.e., require administrator reset)
+* `max_password_age` - (Optional) The number of days that an user password is valid.
+* `minimum_password_length` - (Optional) Minimum length to require for user passwords.
+* `password_reuse_prevention` - (Optional) The number of previous passwords that users are prevented from reusing.
+* `require_lowercase_characters` - (Optional) Whether to require lowercase characters for user passwords.
+* `require_numbers` - (Optional) Whether to require numbers for user passwords.
+* `require_symbols` - (Optional) Whether to require symbols for user passwords.
+* `require_uppercase_characters` - (Optional) Whether to require uppercase characters for user passwords.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `expire_passwords` - Indicates whether passwords in the account expire. Returns `true` if `max_password_age` contains a value greater than `0`. Returns `false` if it is `0` or _not present_.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IAM Account Password Policy using the word `iam-account-password-policy`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import IAM Account Password Policy using the word `iam-account-password-policy`. For example:
+
+```console
+% terraform import aws_iam_account_password_policy.strict iam-account-password-policy
+```
+
+<!-- cache-key: cdktf-0.18.0 input-bc08150f6477fe05b7c648840dff00a4154ffcf28a4c1cad6ceaf55d1d45f131 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/iam_group.html.markdown b/website/docs/cdktf/python/r/iam_group.html.markdown
new file mode 100644
index 00000000000..4c25691ab18
--- /dev/null
+++ b/website/docs/cdktf/python/r/iam_group.html.markdown
@@ -0,0 +1,75 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_group"
+description: |-
+  Provides an IAM group.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iam_group
+
+Provides an IAM group.
+
+~> **NOTE on user management:** Using `aws_iam_group_membership` or `aws_iam_user_group_membership` resources in addition to manually managing user/group membership using the console may lead to configuration drift or conflicts. For this reason, it's recommended to either manage membership entirely with Terraform or entirely within the AWS console.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.iam_group import IamGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        IamGroup(self, "developers",
+            name="developers",
+            path="/users/"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The group's name. The name must consist of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: `=,.@-_.`. Group names are not distinguished by case. For example, you cannot create groups named both "ADMINS" and "admins".
+* `path` - (Optional, default "/") Path in which to create the group.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The group's ID.
+* `arn` - The ARN assigned by AWS for this group.
+* `name` - The group's name.
+* `path` - The path of the group in IAM.
+* `unique_id` - The [unique ID][1] assigned by AWS.
+
+  [1]: https://docs.aws.amazon.com/IAM/latest/UserGuide/Using_Identifiers.html#GUIDs
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IAM Groups using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import IAM Groups using the `name`. For example:
+
+```console
+% terraform import aws_iam_group.developers developers
+```
+
+<!-- cache-key: cdktf-0.18.0 input-19922afba524eb368c46a00c530fc921f976515589b4b61def0e5a9b38c35831 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/iam_group_membership.html.markdown b/website/docs/cdktf/python/r/iam_group_membership.html.markdown
new file mode 100644
index 00000000000..3c0c99331f9
--- /dev/null
+++ b/website/docs/cdktf/python/r/iam_group_membership.html.markdown
@@ -0,0 +1,74 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_group_membership"
+description: |-
+  Provides a top level resource to manage IAM Group membership for IAM Users.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iam_group_membership
+
+~> **WARNING:** Multiple aws_iam_group_membership resources with the same group name will produce inconsistent behavior!
+
+Provides a top level resource to manage IAM Group membership for IAM Users. For
+more information on managing IAM Groups or IAM Users, see [IAM Groups][1] or
+[IAM Users][2]
+
+~> **Note:** `aws_iam_group_membership` will conflict with itself if used more than once with the same group. To non-exclusively manage the users in a group, see the
+[`aws_iam_user_group_membership` resource][3].
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.iam_group import IamGroup
+from imports.aws.iam_group_membership import IamGroupMembership
+from imports.aws.iam_user import IamUser
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        group = IamGroup(self, "group",
+            name="test-group"
+        )
+        user_one = IamUser(self, "user_one",
+            name="test-user"
+        )
+        user_two = IamUser(self, "user_two",
+            name="test-user-two"
+        )
+        IamGroupMembership(self, "team",
+            group=group.name,
+            name="tf-testing-group-membership",
+            users=[user_one.name, user_two.name]
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name to identify the Group Membership
+* `users` - (Required) A list of IAM User names to associate with the Group
+* `group` – (Required) The IAM Group name to attach the list of `users` to
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `name` - The name to identify the Group Membership
+* `users` - list of IAM User names
+* `group` – IAM Group name
+
+[1]: /docs/providers/aws/r/iam_group.html
+[2]: /docs/providers/aws/r/iam_user.html
+[3]: /docs/providers/aws/r/iam_user_group_membership.html
+
+<!-- cache-key: cdktf-0.18.0 input-a689283d8ede46a18e142c30b3c6d291ef7cbbe1e20ccd369bd2df00bb2f1499 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/iam_group_policy.html.markdown b/website/docs/cdktf/python/r/iam_group_policy.html.markdown
new file mode 100644
index 00000000000..61d551f02ce
--- /dev/null
+++ b/website/docs/cdktf/python/r/iam_group_policy.html.markdown
@@ -0,0 +1,89 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_group_policy"
+description: |-
+  Provides an IAM policy attached to a group.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iam_group_policy
+
+Provides an IAM policy attached to a group.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.iam_group import IamGroup
+from imports.aws.iam_group_policy import IamGroupPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        my_developers = IamGroup(self, "my_developers",
+            name="developers",
+            path="/users/"
+        )
+        IamGroupPolicy(self, "my_developer_policy",
+            group=my_developers.name,
+            name="my_developer_policy",
+            policy=Token.as_string(
+                Fn.jsonencode({
+                    "Statement": [{
+                        "Action": ["ec2:Describe*"],
+                        "Effect": "Allow",
+                        "Resource": "*"
+                    }
+                    ],
+                    "Version": "2012-10-17"
+                }))
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `policy` - (Required) The policy document. This is a JSON formatted string. For more information about building IAM policy documents with Terraform, see the [AWS IAM Policy Document Guide](https://learn.hashicorp.com/terraform/aws/iam-policy)
+* `name` - (Optional) The name of the policy. If omitted, Terraform will
+assign a random, unique name.
+* `name_prefix` - (Optional) Creates a unique name beginning with the specified
+  prefix. Conflicts with `name`.
+* `group` - (Required) The IAM group to attach to the policy.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The group policy ID.
+* `group` - The group to which this policy applies.
+* `name` - The name of the policy.
+* `policy` - The policy document attached to the group.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IAM Group Policies using the `group_name:group_policy_name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import IAM Group Policies using the `group_name:group_policy_name`. For example:
+
+```console
+% terraform import aws_iam_group_policy.mypolicy group_of_mypolicy_name:mypolicy_name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-5e50557b38027189b87fe0810dffacfa2a5e6acdca57bdc89c62e7ac5a8f3d50 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/iam_group_policy_attachment.html.markdown b/website/docs/cdktf/python/r/iam_group_policy_attachment.html.markdown
new file mode 100644
index 00000000000..c365e997033
--- /dev/null
+++ b/website/docs/cdktf/python/r/iam_group_policy_attachment.html.markdown
@@ -0,0 +1,77 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_group_policy_attachment"
+description: |-
+  Attaches a Managed IAM Policy to an IAM group
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iam_group_policy_attachment
+
+Attaches a Managed IAM Policy to an IAM group
+
+~> **NOTE:** The usage of this resource conflicts with the `aws_iam_policy_attachment` resource and will permanently show a difference if both are defined.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.iam_group import IamGroup
+from imports.aws.iam_group_policy_attachment import IamGroupPolicyAttachment
+from imports.aws.iam_policy import IamPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        group = IamGroup(self, "group",
+            name="test-group"
+        )
+        policy = IamPolicy(self, "policy",
+            description="A test policy",
+            name="test-policy",
+            policy="{ ... policy JSON ... }"
+        )
+        IamGroupPolicyAttachment(self, "test-attach",
+            group=group.name,
+            policy_arn=policy.arn
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `group`  (Required) - The group the policy should be applied to
+* `policy_arn`  (Required) - The ARN of the policy you want to apply
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IAM group policy attachments using the group name and policy arn separated by `/`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import IAM group policy attachments using the group name and policy arn separated by `/`. For example:
+
+```console
+% terraform import aws_iam_group_policy_attachment.test-attach test-group/arn:aws:iam::xxxxxxxxxxxx:policy/test-policy
+```
+
+<!-- cache-key: cdktf-0.18.0 input-3386ee59f151e68f1f49aa0bbe51aa6530bcb898108b669fb7540481f63c523b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/iam_group_policy_attachment.markdown b/website/docs/cdktf/python/r/iam_group_policy_attachment.markdown
new file mode 100644
index 00000000000..c365e997033
--- /dev/null
+++ b/website/docs/cdktf/python/r/iam_group_policy_attachment.markdown
@@ -0,0 +1,77 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_group_policy_attachment"
+description: |-
+  Attaches a Managed IAM Policy to an IAM group
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iam_group_policy_attachment
+
+Attaches a Managed IAM Policy to an IAM group
+
+~> **NOTE:** The usage of this resource conflicts with the `aws_iam_policy_attachment` resource and will permanently show a difference if both are defined.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.iam_group import IamGroup
+from imports.aws.iam_group_policy_attachment import IamGroupPolicyAttachment
+from imports.aws.iam_policy import IamPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        group = IamGroup(self, "group",
+            name="test-group"
+        )
+        policy = IamPolicy(self, "policy",
+            description="A test policy",
+            name="test-policy",
+            policy="{ ... policy JSON ... }"
+        )
+        IamGroupPolicyAttachment(self, "test-attach",
+            group=group.name,
+            policy_arn=policy.arn
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `group`  (Required) - The group the policy should be applied to
+* `policy_arn`  (Required) - The ARN of the policy you want to apply
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IAM group policy attachments using the group name and policy arn separated by `/`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import IAM group policy attachments using the group name and policy arn separated by `/`. For example:
+
+```console
+% terraform import aws_iam_group_policy_attachment.test-attach test-group/arn:aws:iam::xxxxxxxxxxxx:policy/test-policy
+```
+
+<!-- cache-key: cdktf-0.18.0 input-3386ee59f151e68f1f49aa0bbe51aa6530bcb898108b669fb7540481f63c523b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/iam_instance_profile.html.markdown b/website/docs/cdktf/python/r/iam_instance_profile.html.markdown
new file mode 100644
index 00000000000..100f15092e3
--- /dev/null
+++ b/website/docs/cdktf/python/r/iam_instance_profile.html.markdown
@@ -0,0 +1,95 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_instance_profile"
+description: |-
+  Provides an IAM instance profile.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iam_instance_profile
+
+Provides an IAM instance profile.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.iam_instance_profile import IamInstanceProfile
+from imports.aws.iam_role import IamRole
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        assume_role = DataAwsIamPolicyDocument(self, "assume_role",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["sts:AssumeRole"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["ec2.amazonaws.com"],
+                    type="Service"
+                )
+                ]
+            )
+            ]
+        )
+        role = IamRole(self, "role",
+            assume_role_policy=Token.as_string(assume_role.json),
+            name="test_role",
+            path="/"
+        )
+        IamInstanceProfile(self, "test_profile",
+            name="test_profile",
+            role=role.name
+        )
+```
+
+## Argument Reference
+
+The following arguments are optional:
+
+* `name` - (Optional, Forces new resource) Name of the instance profile. If omitted, Terraform will assign a random, unique name. Conflicts with `name_prefix`. Can be a string of characters consisting of upper and lowercase alphanumeric characters and these special characters: `_`, `+`, `=`, `,`, `.`, `@`, `-`. Spaces are not allowed.
+* `name_prefix` - (Optional, Forces new resource) Creates a unique name beginning with the specified prefix. Conflicts with `name`.
+* `path` - (Optional, default "/") Path to the instance profile. For more information about paths, see [IAM Identifiers](https://docs.aws.amazon.com/IAM/latest/UserGuide/Using_Identifiers.html) in the IAM User Guide. Can be a string of characters consisting of either a forward slash (`/`) by itself or a string that must begin and end with forward slashes. Can include any ASCII character from the ! (\u0021) through the DEL character (\u007F), including most punctuation characters, digits, and upper and lowercase letters.
+* `role` - (Optional) Name of the role to add to the profile.
+* `tags` - (Optional) Map of resource tags for the IAM Instance Profile. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN assigned by AWS to the instance profile.
+* `create_date` - Creation timestamp of the instance profile.
+* `id` - Instance profile's ID.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `unique_id` - [Unique ID][1] assigned by AWS.
+
+  [1]: https://docs.aws.amazon.com/IAM/latest/UserGuide/Using_Identifiers.html#GUIDs
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Instance Profiles using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Instance Profiles using the `name`. For example:
+
+```console
+% terraform import aws_iam_instance_profile.test_profile app-instance-profile-1
+```
+
+<!-- cache-key: cdktf-0.18.0 input-9284929ff4a8b7fdca667e6c3b83bbaacd7a03324ca86ba8dd74b6cd6b6ed7cd -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/iam_openid_connect_provider.html.markdown b/website/docs/cdktf/python/r/iam_openid_connect_provider.html.markdown
new file mode 100644
index 00000000000..3ff1b6660d9
--- /dev/null
+++ b/website/docs/cdktf/python/r/iam_openid_connect_provider.html.markdown
@@ -0,0 +1,72 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_openid_connect_provider"
+description: |-
+  Provides an IAM OpenID Connect provider.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iam_openid_connect_provider
+
+Provides an IAM OpenID Connect provider.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.iam_openid_connect_provider import IamOpenidConnectProvider
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        IamOpenidConnectProvider(self, "default",
+            client_id_list=["266362248691-342342xasdasdasda-apps.googleusercontent.com"
+            ],
+            thumbprint_list=["cf23df2207d99a74fbe169e3eba035e633b65d94"],
+            url="https://accounts.google.com"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `url` - (Required) The URL of the identity provider. Corresponds to the _iss_ claim.
+* `client_id_list` - (Required) A list of client IDs (also known as audiences). When a mobile or web app registers with an OpenID Connect provider, they establish a value that identifies the application. (This is the value that's sent as the client_id parameter on OAuth requests.)
+* `thumbprint_list` - (Required) A list of server certificate thumbprints for the OpenID Connect (OIDC) identity provider's server certificate(s).
+* `tags` - (Optional) Map of resource tags for the IAM OIDC provider. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN assigned by AWS for this provider.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IAM OpenID Connect Providers using the `arn`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import IAM OpenID Connect Providers using the `arn`. For example:
+
+```console
+% terraform import aws_iam_openid_connect_provider.default arn:aws:iam::123456789012:oidc-provider/accounts.google.com
+```
+
+<!-- cache-key: cdktf-0.18.0 input-33b7e2c218fb4d031c4c801faca746d16b9cc40881d30775314b91b34a9400be -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/iam_policy.html.markdown b/website/docs/cdktf/python/r/iam_policy.html.markdown
new file mode 100644
index 00000000000..0eca78871dd
--- /dev/null
+++ b/website/docs/cdktf/python/r/iam_policy.html.markdown
@@ -0,0 +1,90 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_policy"
+description: |-
+  Provides an IAM policy.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iam_policy
+
+Provides an IAM policy.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.iam_policy import IamPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        IamPolicy(self, "policy",
+            description="My test policy",
+            name="test_policy",
+            path="/",
+            policy=Token.as_string(
+                Fn.jsonencode({
+                    "Statement": [{
+                        "Action": ["ec2:Describe*"],
+                        "Effect": "Allow",
+                        "Resource": "*"
+                    }
+                    ],
+                    "Version": "2012-10-17"
+                }))
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `description` - (Optional, Forces new resource) Description of the IAM policy.
+* `name` - (Optional, Forces new resource) The name of the policy. If omitted, Terraform will assign a random, unique name.
+* `name_prefix` - (Optional, Forces new resource) Creates a unique name beginning with the specified prefix. Conflicts with `name`.
+* `path` - (Optional, default "/") Path in which to create the policy.
+  See [IAM Identifiers](https://docs.aws.amazon.com/IAM/latest/UserGuide/Using_Identifiers.html) for more information.
+* `policy` - (Required) The policy document. This is a JSON formatted string. For more information about building AWS IAM policy documents with Terraform, see the [AWS IAM Policy Document Guide](https://learn.hashicorp.com/terraform/aws/iam-policy)
+* `tags` - (Optional) Map of resource tags for the IAM Policy. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ARN assigned by AWS to this policy.
+* `arn` - The ARN assigned by AWS to this policy.
+* `description` - The description of the policy.
+* `name` - The name of the policy.
+* `path` - The path of the policy in IAM.
+* `policy` - The policy document.
+* `policy_id` - The policy's ID.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IAM Policies using the `arn`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import IAM Policies using the `arn`. For example:
+
+```console
+% terraform import aws_iam_policy.administrator arn:aws:iam::123456789012:policy/UsersManageOwnCredentials
+```
+
+<!-- cache-key: cdktf-0.18.0 input-2bcb7f3dcfa6d83ce1cbd25d9b62a51db1f0fa11161d9093fc0a960b5e42ffec -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/iam_policy_attachment.html.markdown b/website/docs/cdktf/python/r/iam_policy_attachment.html.markdown
new file mode 100644
index 00000000000..6cdfa34e9d6
--- /dev/null
+++ b/website/docs/cdktf/python/r/iam_policy_attachment.html.markdown
@@ -0,0 +1,103 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_policy_attachment"
+description: |-
+  Attaches a Managed IAM Policy to user(s), role(s), and/or group(s)
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iam_policy_attachment
+
+Attaches a Managed IAM Policy to user(s), role(s), and/or group(s)
+
+!> **WARNING:** The aws_iam_policy_attachment resource creates **exclusive** attachments of IAM policies. Across the entire AWS account, all of the users/roles/groups to which a single policy is attached must be declared by a single aws_iam_policy_attachment resource. This means that even any users/roles/groups that have the attached policy via any other mechanism (including other Terraform resources) will have that attached policy revoked by this resource. Consider `aws_iam_role_policy_attachment`, `aws_iam_user_policy_attachment`, or `aws_iam_group_policy_attachment` instead. These resources do not enforce exclusive attachment of an IAM policy.
+
+~> **NOTE:** The usage of this resource conflicts with the `aws_iam_group_policy_attachment`, `aws_iam_role_policy_attachment`, and `aws_iam_user_policy_attachment` resources and will permanently show a difference if both are defined.
+
+~> **NOTE:** For a given role, this resource is incompatible with using the [`aws_iam_role` resource](/docs/providers/aws/r/iam_role.html) `managed_policy_arns` argument. When using that argument and this resource, both will attempt to manage the role's managed policy attachments and Terraform will show a permanent difference.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.iam_group import IamGroup
+from imports.aws.iam_policy import IamPolicy
+from imports.aws.iam_policy_attachment import IamPolicyAttachment
+from imports.aws.iam_role import IamRole
+from imports.aws.iam_user import IamUser
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        group = IamGroup(self, "group",
+            name="test-group"
+        )
+        user = IamUser(self, "user",
+            name="test-user"
+        )
+        assume_role = DataAwsIamPolicyDocument(self, "assume_role",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["sts:AssumeRole"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["ec2.amazonaws.com"],
+                    type="Service"
+                )
+                ]
+            )
+            ]
+        )
+        policy = DataAwsIamPolicyDocument(self, "policy",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["ec2:Describe*"],
+                effect="Allow",
+                resources=["*"]
+            )
+            ]
+        )
+        aws_iam_policy_policy = IamPolicy(self, "policy_4",
+            description="A test policy",
+            name="test-policy",
+            policy=Token.as_string(policy.json)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_policy_policy.override_logical_id("policy")
+        role = IamRole(self, "role",
+            assume_role_policy=Token.as_string(assume_role.json),
+            name="test-role"
+        )
+        IamPolicyAttachment(self, "test-attach",
+            groups=[group.name],
+            name="test-attachment",
+            policy_arn=Token.as_string(aws_iam_policy_policy.arn),
+            roles=[role.name],
+            users=[user.name]
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name`    (Required) - The name of the attachment. This cannot be an empty string.
+* `users`   (Optional) - The user(s) the policy should be applied to
+* `roles`   (Optional) - The role(s) the policy should be applied to
+* `groups`  (Optional) - The group(s) the policy should be applied to
+* `policy_arn`  (Required) - The ARN of the policy you want to apply
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The policy's ID.
+* `name` - The name of the attachment.
+
+<!-- cache-key: cdktf-0.18.0 input-c752eb701a68e4598f3a6661db2c072cd7097ba8d948dc18d4d1833423b0719c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/iam_role.html.markdown b/website/docs/cdktf/python/r/iam_role.html.markdown
new file mode 100644
index 00000000000..0b7296cbd91
--- /dev/null
+++ b/website/docs/cdktf/python/r/iam_role.html.markdown
@@ -0,0 +1,292 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_role"
+description: |-
+  Provides an IAM role.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iam_role
+
+Provides an IAM role.
+
+~> **NOTE:** If policies are attached to the role via the [`aws_iam_policy_attachment` resource](/docs/providers/aws/r/iam_policy_attachment.html) and you are modifying the role `name` or `path`, the `force_detach_policies` argument must be set to `true` and applied before attempting the operation otherwise you will encounter a `DeleteConflict` error. The [`aws_iam_role_policy_attachment` resource (recommended)](/docs/providers/aws/r/iam_role_policy_attachment.html) does not have this requirement.
+
+~> **NOTE:** If you use this resource's `managed_policy_arns` argument or `inline_policy` configuration blocks, this resource will take over exclusive management of the role's respective policy types (e.g., both policy types if both arguments are used). These arguments are incompatible with other ways of managing a role's policies, such as [`aws_iam_policy_attachment`](/docs/providers/aws/r/iam_policy_attachment.html), [`aws_iam_role_policy_attachment`](/docs/providers/aws/r/iam_role_policy_attachment.html), and [`aws_iam_role_policy`](/docs/providers/aws/r/iam_role_policy.html). If you attempt to manage a role's policies by multiple means, you will get resource cycling and/or errors.
+
+## Example Usage
+
+### Basic Example
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.iam_role import IamRole
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        IamRole(self, "test_role",
+            assume_role_policy=Token.as_string(
+                Fn.jsonencode({
+                    "Statement": [{
+                        "Action": "sts:AssumeRole",
+                        "Effect": "Allow",
+                        "Principal": {
+                            "Service": "ec2.amazonaws.com"
+                        },
+                        "Sid": ""
+                    }
+                    ],
+                    "Version": "2012-10-17"
+                })),
+            name="test_role",
+            tags={
+                "tag-key": "tag-value"
+            }
+        )
+```
+
+### Example of Using Data Source for Assume Role Policy
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.iam_role import IamRole
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        instance_assume_role_policy = DataAwsIamPolicyDocument(self, "instance_assume_role_policy",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["sts:AssumeRole"],
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["ec2.amazonaws.com"],
+                    type="Service"
+                )
+                ]
+            )
+            ]
+        )
+        IamRole(self, "instance",
+            assume_role_policy=Token.as_string(instance_assume_role_policy.json),
+            name="instance_role",
+            path="/system/"
+        )
+```
+
+### Example of Exclusive Inline Policies
+
+This example creates an IAM role with two inline IAM policies. If someone adds another inline policy out-of-band, on the next apply, Terraform will remove that policy. If someone deletes these policies out-of-band, Terraform will recreate them.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, Fn, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.iam_role import IamRole
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        inline_policy = DataAwsIamPolicyDocument(self, "inline_policy",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["ec2:DescribeAccountAttributes"],
+                resources=["*"]
+            )
+            ]
+        )
+        IamRole(self, "example",
+            assume_role_policy=Token.as_string(instance_assume_role_policy.json),
+            inline_policy=[IamRoleInlinePolicy(
+                name="my_inline_policy",
+                policy=Token.as_string(
+                    Fn.jsonencode({
+                        "Statement": [{
+                            "Action": ["ec2:Describe*"],
+                            "Effect": "Allow",
+                            "Resource": "*"
+                        }
+                        ],
+                        "Version": "2012-10-17"
+                    }))
+            ), IamRoleInlinePolicy(
+                name="policy-8675309",
+                policy=Token.as_string(inline_policy.json)
+            )
+            ],
+            name="yak_role"
+        )
+```
+
+### Example of Removing Inline Policies
+
+This example creates an IAM role with what appears to be empty IAM `inline_policy` argument instead of using `inline_policy` as a configuration block. The result is that if someone were to add an inline policy out-of-band, on the next apply, Terraform will remove that policy.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.iam_role import IamRole
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        IamRole(self, "example",
+            assume_role_policy=Token.as_string(instance_assume_role_policy.json),
+            inline_policy=[IamRoleInlinePolicy()],
+            name="yak_role"
+        )
+```
+
+### Example of Exclusive Managed Policies
+
+This example creates an IAM role and attaches two managed IAM policies. If someone attaches another managed policy out-of-band, on the next apply, Terraform will detach that policy. If someone detaches these policies out-of-band, Terraform will attach them again.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.iam_policy import IamPolicy
+from imports.aws.iam_role import IamRole
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        policy_one = IamPolicy(self, "policy_one",
+            name="policy-618033",
+            policy=Token.as_string(
+                Fn.jsonencode({
+                    "Statement": [{
+                        "Action": ["ec2:Describe*"],
+                        "Effect": "Allow",
+                        "Resource": "*"
+                    }
+                    ],
+                    "Version": "2012-10-17"
+                }))
+        )
+        policy_two = IamPolicy(self, "policy_two",
+            name="policy-381966",
+            policy=Token.as_string(
+                Fn.jsonencode({
+                    "Statement": [{
+                        "Action": ["s3:ListAllMyBuckets", "s3:ListBucket", "s3:HeadBucket"],
+                        "Effect": "Allow",
+                        "Resource": "*"
+                    }
+                    ],
+                    "Version": "2012-10-17"
+                }))
+        )
+        IamRole(self, "example",
+            assume_role_policy=Token.as_string(instance_assume_role_policy.json),
+            managed_policy_arns=[policy_one.arn, policy_two.arn],
+            name="yak_role"
+        )
+```
+
+### Example of Removing Managed Policies
+
+This example creates an IAM role with an empty `managed_policy_arns` argument. If someone attaches a policy out-of-band, on the next apply, Terraform will detach that policy.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.iam_role import IamRole
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        IamRole(self, "example",
+            assume_role_policy=Token.as_string(instance_assume_role_policy.json),
+            managed_policy_arns=[],
+            name="yak_role"
+        )
+```
+
+## Argument Reference
+
+The following argument is required:
+
+* `assume_role_policy` - (Required) Policy that grants an entity permission to assume the role.
+
+~> **NOTE:** The `assume_role_policy` is very similar to but slightly different than a standard IAM policy and cannot use an `aws_iam_policy` resource.  However, it _can_ use an `aws_iam_policy_document` [data source](/docs/providers/aws/d/iam_policy_document.html). See the example above of how this works.
+
+The following arguments are optional:
+
+* `description` - (Optional) Description of the role.
+* `force_detach_policies` - (Optional) Whether to force detaching any policies the role has before destroying it. Defaults to `false`.
+* `inline_policy` - (Optional) Configuration block defining an exclusive set of IAM inline policies associated with the IAM role. See below. If no blocks are configured, Terraform will not manage any inline policies in this resource. Configuring one empty block (i.e., `inline_policy {}`) will cause Terraform to remove _all_ inline policies added out of band on `apply`.
+* `managed_policy_arns` - (Optional) Set of exclusive IAM managed policy ARNs to attach to the IAM role. If this attribute is not configured, Terraform will ignore policy attachments to this resource. When configured, Terraform will align the role's managed policy attachments with this set by attaching or detaching managed policies. Configuring an empty set (i.e., `managed_policy_arns = []`) will cause Terraform to remove _all_ managed policy attachments.
+* `max_session_duration` - (Optional) Maximum session duration (in seconds) that you want to set for the specified role. If you do not specify a value for this setting, the default maximum of one hour is applied. This setting can have a value from 1 hour to 12 hours.
+* `name` - (Optional, Forces new resource) Friendly name of the role. If omitted, Terraform will assign a random, unique name. See [IAM Identifiers](https://docs.aws.amazon.com/IAM/latest/UserGuide/Using_Identifiers.html) for more information.
+* `name_prefix` - (Optional, Forces new resource) Creates a unique friendly name beginning with the specified prefix. Conflicts with `name`.
+* `path` - (Optional) Path to the role. See [IAM Identifiers](https://docs.aws.amazon.com/IAM/latest/UserGuide/Using_Identifiers.html) for more information.
+* `permissions_boundary` - (Optional) ARN of the policy that is used to set the permissions boundary for the role.
+* `tags` - Key-value mapping of tags for the IAM role. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### inline_policy
+
+This configuration block supports the following:
+
+~> **NOTE:** Since one empty block (i.e., `inline_policy {}`) is valid syntactically to remove out of band policies on `apply`, `name` and `policy` are technically _optional_. However, they are both _required_ in order to manage actual inline policies. Not including one or the other may not result in Terraform errors but will result in unpredictable and incorrect behavior.
+
+* `name` - (Required) Name of the role policy.
+* `policy` - (Required) Policy document as a JSON formatted string. For more information about building IAM policy documents with Terraform, see the [AWS IAM Policy Document Guide](https://learn.hashicorp.com/tutorials/terraform/aws-iam-policy).
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) specifying the role.
+* `create_date` - Creation date of the IAM role.
+* `id` - Name of the role.
+* `name` - Name of the role.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `unique_id` - Stable and unique string identifying the role.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IAM Roles using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import IAM Roles using the `name`. For example:
+
+```console
+% terraform import aws_iam_role.developer developer_name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-bd6124ae737c542517c52e9bbb2eb3419c7ff3714d8593c811602ba81fff4809 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/iam_role_policy.html.markdown b/website/docs/cdktf/python/r/iam_role_policy.html.markdown
new file mode 100644
index 00000000000..3f8c49cdaa8
--- /dev/null
+++ b/website/docs/cdktf/python/r/iam_role_policy.html.markdown
@@ -0,0 +1,103 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_role_policy"
+description: |-
+  Provides an IAM role policy.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iam_role_policy
+
+Provides an IAM role inline policy.
+
+~> **NOTE:** For a given role, this resource is incompatible with using the [`aws_iam_role` resource](/docs/providers/aws/r/iam_role.html) `inline_policy` argument. When using that argument and this resource, both will attempt to manage the role's inline policies and Terraform will show a permanent difference.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.iam_role import IamRole
+from imports.aws.iam_role_policy import IamRolePolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        test_role = IamRole(self, "test_role",
+            assume_role_policy=Token.as_string(
+                Fn.jsonencode({
+                    "Statement": [{
+                        "Action": "sts:AssumeRole",
+                        "Effect": "Allow",
+                        "Principal": {
+                            "Service": "ec2.amazonaws.com"
+                        },
+                        "Sid": ""
+                    }
+                    ],
+                    "Version": "2012-10-17"
+                })),
+            name="test_role"
+        )
+        IamRolePolicy(self, "test_policy",
+            name="test_policy",
+            policy=Token.as_string(
+                Fn.jsonencode({
+                    "Statement": [{
+                        "Action": ["ec2:Describe*"],
+                        "Effect": "Allow",
+                        "Resource": "*"
+                    }
+                    ],
+                    "Version": "2012-10-17"
+                })),
+            role=test_role.id
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Optional) The name of the role policy. If omitted, Terraform will
+assign a random, unique name.
+* `name_prefix` - (Optional) Creates a unique name beginning with the specified
+  prefix. Conflicts with `name`.
+* `policy` - (Required) The inline policy document. This is a JSON formatted string. For more information about building IAM policy documents with Terraform, see the [AWS IAM Policy Document Guide](https://learn.hashicorp.com/terraform/aws/iam-policy)
+* `role` - (Required) The name of the IAM role to attach to the policy.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The role policy ID, in the form of `role_name:role_policy_name`.
+* `name` - The name of the policy.
+* `policy` - The policy document attached to the role.
+* `role` - The name of the role associated with the policy.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IAM Role Policies using the `role_name:role_policy_name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import IAM Role Policies using the `role_name:role_policy_name`. For example:
+
+```console
+% terraform import aws_iam_role_policy.mypolicy role_of_mypolicy_name:mypolicy_name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-9dd1f967613333456f478e1f20726a88afa276e76829289fff1efaec15c03f59 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/iam_role_policy_attachment.html.markdown b/website/docs/cdktf/python/r/iam_role_policy_attachment.html.markdown
new file mode 100644
index 00000000000..2512ead61de
--- /dev/null
+++ b/website/docs/cdktf/python/r/iam_role_policy_attachment.html.markdown
@@ -0,0 +1,103 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_role_policy_attachment"
+description: |-
+  Attaches a Managed IAM Policy to an IAM role
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iam_role_policy_attachment
+
+Attaches a Managed IAM Policy to an IAM role
+
+~> **NOTE:** The usage of this resource conflicts with the `aws_iam_policy_attachment` resource and will permanently show a difference if both are defined.
+
+~> **NOTE:** For a given role, this resource is incompatible with using the [`aws_iam_role` resource](/docs/providers/aws/r/iam_role.html) `managed_policy_arns` argument. When using that argument and this resource, both will attempt to manage the role's managed policy attachments and Terraform will show a permanent difference.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.iam_policy import IamPolicy
+from imports.aws.iam_role import IamRole
+from imports.aws.iam_role_policy_attachment import IamRolePolicyAttachment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        assume_role = DataAwsIamPolicyDocument(self, "assume_role",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["sts:AssumeRole"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["ec2.amazonaws.com"],
+                    type="Service"
+                )
+                ]
+            )
+            ]
+        )
+        policy = DataAwsIamPolicyDocument(self, "policy",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["ec2:Describe*"],
+                effect="Allow",
+                resources=["*"]
+            )
+            ]
+        )
+        aws_iam_policy_policy = IamPolicy(self, "policy_2",
+            description="A test policy",
+            name="test-policy",
+            policy=Token.as_string(policy.json)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_policy_policy.override_logical_id("policy")
+        role = IamRole(self, "role",
+            assume_role_policy=Token.as_string(assume_role.json),
+            name="test-role"
+        )
+        IamRolePolicyAttachment(self, "test-attach",
+            policy_arn=Token.as_string(aws_iam_policy_policy.arn),
+            role=role.name
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `role`  (Required) - The name of the IAM role to which the policy should be applied
+* `policy_arn` (Required) - The ARN of the policy you want to apply
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IAM role policy attachments using the role name and policy arn separated by `/`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import IAM role policy attachments using the role name and policy arn separated by `/`. For example:
+
+```console
+% terraform import aws_iam_role_policy_attachment.test-attach test-role/arn:aws:iam::xxxxxxxxxxxx:policy/test-policy
+```
+
+<!-- cache-key: cdktf-0.18.0 input-8fa8f1d0aab28daaa2f2296516256e63edd3a1f444a588a760d3d43847fd78f4 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/iam_role_policy_attachment.markdown b/website/docs/cdktf/python/r/iam_role_policy_attachment.markdown
new file mode 100644
index 00000000000..2512ead61de
--- /dev/null
+++ b/website/docs/cdktf/python/r/iam_role_policy_attachment.markdown
@@ -0,0 +1,103 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_role_policy_attachment"
+description: |-
+  Attaches a Managed IAM Policy to an IAM role
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iam_role_policy_attachment
+
+Attaches a Managed IAM Policy to an IAM role
+
+~> **NOTE:** The usage of this resource conflicts with the `aws_iam_policy_attachment` resource and will permanently show a difference if both are defined.
+
+~> **NOTE:** For a given role, this resource is incompatible with using the [`aws_iam_role` resource](/docs/providers/aws/r/iam_role.html) `managed_policy_arns` argument. When using that argument and this resource, both will attempt to manage the role's managed policy attachments and Terraform will show a permanent difference.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.iam_policy import IamPolicy
+from imports.aws.iam_role import IamRole
+from imports.aws.iam_role_policy_attachment import IamRolePolicyAttachment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        assume_role = DataAwsIamPolicyDocument(self, "assume_role",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["sts:AssumeRole"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["ec2.amazonaws.com"],
+                    type="Service"
+                )
+                ]
+            )
+            ]
+        )
+        policy = DataAwsIamPolicyDocument(self, "policy",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["ec2:Describe*"],
+                effect="Allow",
+                resources=["*"]
+            )
+            ]
+        )
+        aws_iam_policy_policy = IamPolicy(self, "policy_2",
+            description="A test policy",
+            name="test-policy",
+            policy=Token.as_string(policy.json)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_policy_policy.override_logical_id("policy")
+        role = IamRole(self, "role",
+            assume_role_policy=Token.as_string(assume_role.json),
+            name="test-role"
+        )
+        IamRolePolicyAttachment(self, "test-attach",
+            policy_arn=Token.as_string(aws_iam_policy_policy.arn),
+            role=role.name
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `role`  (Required) - The name of the IAM role to which the policy should be applied
+* `policy_arn` (Required) - The ARN of the policy you want to apply
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IAM role policy attachments using the role name and policy arn separated by `/`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import IAM role policy attachments using the role name and policy arn separated by `/`. For example:
+
+```console
+% terraform import aws_iam_role_policy_attachment.test-attach test-role/arn:aws:iam::xxxxxxxxxxxx:policy/test-policy
+```
+
+<!-- cache-key: cdktf-0.18.0 input-8fa8f1d0aab28daaa2f2296516256e63edd3a1f444a588a760d3d43847fd78f4 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/iam_saml_provider.html.markdown b/website/docs/cdktf/python/r/iam_saml_provider.html.markdown
new file mode 100644
index 00000000000..d65e95f727b
--- /dev/null
+++ b/website/docs/cdktf/python/r/iam_saml_provider.html.markdown
@@ -0,0 +1,70 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_saml_provider"
+description: |-
+  Provides an IAM SAML provider.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iam_saml_provider
+
+Provides an IAM SAML provider.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.iam_saml_provider import IamSamlProvider
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        IamSamlProvider(self, "default",
+            name="myprovider",
+            saml_metadata_document=Token.as_string(Fn.file("saml-metadata.xml"))
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the provider to create.
+* `saml_metadata_document` - (Required) An XML document generated by an identity provider that supports SAML 2.0.
+* `tags` - (Optional) Map of resource tags for the IAM SAML provider. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN assigned by AWS for this provider.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `valid_until` - The expiration date and time for the SAML provider in RFC1123 format, e.g., `Mon, 02 Jan 2006 15:04:05 MST`.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IAM SAML Providers using the `arn`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import IAM SAML Providers using the `arn`. For example:
+
+```console
+% terraform import aws_iam_saml_provider.default arn:aws:iam::123456789012:saml-provider/SAMLADFS
+```
+
+<!-- cache-key: cdktf-0.18.0 input-e9450a2287d5fbbd96a01461a632b203b4d1d9ef618d8b90a0586e0b7762feb9 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/iam_security_token_service_preferences.html.markdown b/website/docs/cdktf/python/r/iam_security_token_service_preferences.html.markdown
new file mode 100644
index 00000000000..8089dd1b9b9
--- /dev/null
+++ b/website/docs/cdktf/python/r/iam_security_token_service_preferences.html.markdown
@@ -0,0 +1,46 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_security_token_service_preferences"
+description: |-
+  Provides an IAM Security Token Service Preferences resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iam_security_token_service_preferences
+
+Provides an IAM Security Token Service Preferences resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.iam_security_token_service_preferences import IamSecurityTokenServicePreferences
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        IamSecurityTokenServicePreferences(self, "example",
+            global_endpoint_token_version="v2Token"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `global_endpoint_token_version` - (Required) The version of the STS global endpoint token. Valid values: `v1Token`, `v2Token`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The AWS Account ID.
+
+<!-- cache-key: cdktf-0.18.0 input-5fa3e32fa1a3cba47282a6eace02bd69c18b12299e55edef17829e4f27fde210 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/iam_server_certificate.html.markdown b/website/docs/cdktf/python/r/iam_server_certificate.html.markdown
new file mode 100644
index 00000000000..1665dd558af
--- /dev/null
+++ b/website/docs/cdktf/python/r/iam_server_certificate.html.markdown
@@ -0,0 +1,173 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_server_certificate"
+description: |-
+  Provides an IAM Server Certificate
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iam_server_certificate
+
+Provides an IAM Server Certificate resource to upload Server Certificates.
+Certs uploaded to IAM can easily work with other AWS services such as:
+
+- AWS Elastic Beanstalk
+- Elastic Load Balancing
+- CloudFront
+- AWS OpsWorks
+
+For information about server certificates in IAM, see [Managing Server
+Certificates][2] in AWS Documentation.
+
+~> **Note:** All arguments including the private key will be stored in the raw state as plain-text.
+[Read more about sensitive data in state](https://www.terraform.io/docs/state/sensitive-data.html).
+
+## Example Usage
+
+**Using certs on file:**
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.iam_server_certificate import IamServerCertificate
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        IamServerCertificate(self, "test_cert",
+            certificate_body=Token.as_string(Fn.file("self-ca-cert.pem")),
+            name="some_test_cert",
+            private_key=Token.as_string(Fn.file("test-key.pem"))
+        )
+```
+
+**Example with cert in-line:**
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.iam_server_certificate import IamServerCertificate
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        IamServerCertificate(self, "test_cert_alt",
+            certificate_body="-----BEGIN CERTIFICATE-----\n[......] # cert contents\n-----END CERTIFICATE-----\n\n",
+            name="alt_test_cert",
+            private_key="-----BEGIN RSA PRIVATE KEY-----\n[......] # cert contents\n-----END RSA PRIVATE KEY-----\n\n"
+        )
+```
+
+**Use in combination with an AWS ELB resource:**
+
+Some properties of an IAM Server Certificates cannot be updated while they are
+in use. In order for Terraform to effectively manage a Certificate in this situation, it is
+recommended you utilize the `name_prefix` attribute and enable the
+`create_before_destroy` [lifecycle block][lifecycle]. This will allow Terraform
+to create a new, updated `aws_iam_server_certificate` resource and replace it in
+dependant resources before attempting to destroy the old version.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from cdktf import TerraformResourceLifecycle
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.elb import Elb
+from imports.aws.iam_server_certificate import IamServerCertificate
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        test_cert = IamServerCertificate(self, "test_cert",
+            certificate_body=Token.as_string(Fn.file("self-ca-cert.pem")),
+            lifecycle=TerraformResourceLifecycle(
+                create_before_destroy=True
+            ),
+            name_prefix="example-cert",
+            private_key=Token.as_string(Fn.file("test-key.pem"))
+        )
+        Elb(self, "ourapp",
+            availability_zones=["us-west-2a"],
+            cross_zone_load_balancing=True,
+            listener=[ElbListener(
+                instance_port=8000,
+                instance_protocol="http",
+                lb_port=443,
+                lb_protocol="https",
+                ssl_certificate_id=test_cert.arn
+            )
+            ],
+            name="terraform-asg-deployment-example"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Optional) The name of the Server Certificate. Do not include the
+  path in this value. If omitted, Terraform will assign a random, unique name.
+* `name_prefix` - (Optional) Creates a unique name beginning with the specified
+  prefix. Conflicts with `name`.
+* `certificate_body` – (Required) The contents of the public key certificate in
+  PEM-encoded format.
+* `certificate_chain` – (Optional) The contents of the certificate chain.
+  This is typically a concatenation of the PEM-encoded public key certificates
+  of the chain.
+* `private_key` – (Required) The contents of the private key in PEM-encoded format.
+* `path` - (Optional) The IAM path for the server certificate.  If it is not
+    included, it defaults to a slash (/). If this certificate is for use with
+    AWS CloudFront, the path must be in format `/cloudfront/your_path_here`.
+    See [IAM Identifiers][1] for more details on IAM Paths.
+* `tags` - (Optional) Map of resource tags for the server certificate. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+~> **NOTE:** AWS performs behind-the-scenes modifications to some certificate files if they do not adhere to a specific format. These modifications will result in terraform forever believing that it needs to update the resources since the local and AWS file contents will not match after theses modifications occur. In order to prevent this from happening you must ensure that all your PEM-encoded files use UNIX line-breaks and that `certificate_body` contains only one certificate. All other certificates should go in `certificate_chain`. It is common for some Certificate Authorities to issue certificate files that have DOS line-breaks and that are actually multiple certificates concatenated together in order to form a full certificate chain.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) specifying the server certificate.
+* `expiration` - Date and time in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8) on which the certificate is set to expire.
+* `id` - The unique Server Certificate name
+* `name` - The name of the Server Certificate
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `upload_date` - Date and time in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8) when the server certificate was uploaded.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IAM Server Certificates using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import IAM Server Certificates using the `name`. For example:
+
+```console
+% terraform import aws_iam_server_certificate.certificate example.com-certificate-until-2018
+```
+
+[1]: https://docs.aws.amazon.com/IAM/latest/UserGuide/Using_Identifiers.html
+[2]: https://docs.aws.amazon.com/IAM/latest/UserGuide/ManagingServerCerts.html
+[lifecycle]: /docs/configuration/resources.html
+
+<!-- cache-key: cdktf-0.18.0 input-4e79a75d64fc823b8d2391e118523a861e5a2f30f4797410fdc70324a0c27272 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/iam_service_linked_role.html.markdown b/website/docs/cdktf/python/r/iam_service_linked_role.html.markdown
new file mode 100644
index 00000000000..e8ee7c0aa93
--- /dev/null
+++ b/website/docs/cdktf/python/r/iam_service_linked_role.html.markdown
@@ -0,0 +1,74 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_service_linked_role"
+description: |-
+  Provides an IAM service-linked role.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iam_service_linked_role
+
+Provides an [IAM service-linked role](https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.iam_service_linked_role import IamServiceLinkedRole
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        IamServiceLinkedRole(self, "elasticbeanstalk",
+            aws_service_name="elasticbeanstalk.amazonaws.com"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `aws_service_name` - (Required, Forces new resource) The AWS service to which this role is attached. You use a string similar to a URL but without the `http://` in front. For example: `elasticbeanstalk.amazonaws.com`. To find the full list of services that support service-linked roles, check [the docs](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_aws-services-that-work-with-iam.html).
+* `custom_suffix` - (Optional, forces new resource) Additional string appended to the role name. Not all AWS services support custom suffixes.
+* `description` - (Optional) The description of the role.
+* `tags` - Key-value mapping of tags for the IAM role. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Amazon Resource Name (ARN) of the role.
+* `arn` - The Amazon Resource Name (ARN) specifying the role.
+* `create_date` - The creation date of the IAM role.
+* `name` - The name of the role.
+* `path` - The path of the role.
+* `unique_id` - The stable and unique string identifying the role.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IAM service-linked roles using role ARN. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import IAM service-linked roles using role ARN. For example:
+
+```console
+% terraform import aws_iam_service_linked_role.elasticbeanstalk arn:aws:iam::123456789012:role/aws-service-role/elasticbeanstalk.amazonaws.com/AWSServiceRoleForElasticBeanstalk
+```
+
+<!-- cache-key: cdktf-0.18.0 input-53b8bf0058bf16f68c2476ca78ddb88722c438f564338bbb9af9fab3c2d80462 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/iam_service_specific_credential.html.markdown b/website/docs/cdktf/python/r/iam_service_specific_credential.html.markdown
new file mode 100644
index 00000000000..4ea726316b0
--- /dev/null
+++ b/website/docs/cdktf/python/r/iam_service_specific_credential.html.markdown
@@ -0,0 +1,78 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_service_specific_credential"
+description: |-
+  Provides an IAM Service Specific Credential.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iam_service_specific_credential
+
+Provides an IAM Service Specific Credential.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.iam_service_specific_credential import IamServiceSpecificCredential
+from imports.aws.iam_user import IamUser
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = IamUser(self, "example",
+            name="example"
+        )
+        aws_iam_service_specific_credential_example =
+        IamServiceSpecificCredential(self, "example_1",
+            service_name="codecommit.amazonaws.com",
+            user_name=example.name
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_service_specific_credential_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `service_name` - (Required) The name of the AWS service that is to be associated with the credentials. The service you specify here is the only service that can be accessed using these credentials.
+* `user_name` - (Required) The name of the IAM user that is to be associated with the credentials. The new service-specific credentials have the same permissions as the associated user except that they can be used only to access the specified service.
+* `status` - (Optional) The status to be assigned to the service-specific credential. Valid values are `Active` and `Inactive`. Default value is `Active`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The combination of `service_name` and `user_name` as such: `service_name:user_name:service_specific_credential_id`.
+* `service_password` - The generated password for the service-specific credential.
+* `service_user_name` - The generated user name for the service-specific credential. This value is generated by combining the IAM user's name combined with the ID number of the AWS account, as in `jane-at-123456789012`, for example.
+* `service_specific_credential_id` - The unique identifier for the service-specific credential.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IAM Service Specific Credentials using the `service_name:user_name:service_specific_credential_id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import IAM Service Specific Credentials using the `service_name:user_name:service_specific_credential_id`. For example:
+
+```console
+% terraform import aws_iam_service_specific_credential.default `codecommit.amazonaws.com:example:some-id`
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1e83847adc046bae947086c436bc6f0c678e2771941ae818199da71c13912bb2 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/iam_signing_certificate.html.markdown b/website/docs/cdktf/python/r/iam_signing_certificate.html.markdown
new file mode 100644
index 00000000000..6552b5fa8f2
--- /dev/null
+++ b/website/docs/cdktf/python/r/iam_signing_certificate.html.markdown
@@ -0,0 +1,96 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_signing_certificate"
+description: |-
+  Provides an IAM Signing Certificate
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iam_signing_certificate
+
+Provides an IAM Signing Certificate resource to upload Signing Certificates.
+
+~> **Note:** All arguments including the certificate body will be stored in the raw state as plain-text.
+[Read more about sensitive data in state](https://www.terraform.io/docs/state/sensitive-data.html).
+
+## Example Usage
+
+**Using certs on file:**
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.iam_signing_certificate import IamSigningCertificate
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, userName):
+        super().__init__(scope, name)
+        IamSigningCertificate(self, "test_cert",
+            certificate_body=Token.as_string(Fn.file("self-ca-cert.pem")),
+            username="some_test_cert",
+            user_name=user_name
+        )
+```
+
+**Example with cert in-line:**
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.iam_signing_certificate import IamSigningCertificate
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, userName):
+        super().__init__(scope, name)
+        IamSigningCertificate(self, "test_cert_alt",
+            certificate_body="-----BEGIN CERTIFICATE-----\n[......] # cert contents\n-----END CERTIFICATE-----\n\n",
+            username="some_test_cert",
+            user_name=user_name
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `certificate_body` – (Required) The contents of the signing certificate in PEM-encoded format.
+* `status` – (Optional)  The status you want to assign to the certificate. `Active` means that the certificate can be used for programmatic calls to Amazon Web Services `Inactive` means that the certificate cannot be used.
+* `user_name` – (Required) The name of the user the signing certificate is for.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `certificate_id` - The ID for the signing certificate.
+* `id` - The `certificate_id:user_name`
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IAM Signing Certificates using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import IAM Signing Certificates using the `id`. For example:
+
+```console
+% terraform import aws_iam_signing_certificate.certificate IDIDIDIDID:user-name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-5dd149e4ec34690d2d3d0ad3b6a7ed2784cb04247b33fd1ab71da3b19a32535c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/iam_user.html.markdown b/website/docs/cdktf/python/r/iam_user.html.markdown
new file mode 100644
index 00000000000..3b2bd0b1f9f
--- /dev/null
+++ b/website/docs/cdktf/python/r/iam_user.html.markdown
@@ -0,0 +1,105 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_user"
+description: |-
+  Provides an IAM user.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iam_user
+
+Provides an IAM user.
+
+~> *NOTE:* If policies are attached to the user via the [`aws_iam_policy_attachment` resource](/docs/providers/aws/r/iam_policy_attachment.html) and you are modifying the user `name` or `path`, the `force_destroy` argument must be set to `true` and applied before attempting the operation otherwise you will encounter a `DeleteConflict` error. The [`aws_iam_user_policy_attachment` resource (recommended)](/docs/providers/aws/r/iam_user_policy_attachment.html) does not have this requirement.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.iam_access_key import IamAccessKey
+from imports.aws.iam_user import IamUser
+from imports.aws.iam_user_policy import IamUserPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        lb = IamUser(self, "lb",
+            name="loadbalancer",
+            path="/system/",
+            tags={
+                "tag-key": "tag-value"
+            }
+        )
+        lb_ro = DataAwsIamPolicyDocument(self, "lb_ro",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["ec2:Describe*"],
+                effect="Allow",
+                resources=["*"]
+            )
+            ]
+        )
+        aws_iam_access_key_lb = IamAccessKey(self, "lb_2",
+            user=lb.name
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_access_key_lb.override_logical_id("lb")
+        aws_iam_user_policy_lb_ro = IamUserPolicy(self, "lb_ro_3",
+            name="test",
+            policy=Token.as_string(lb_ro.json),
+            user=lb.name
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_user_policy_lb_ro.override_logical_id("lb_ro")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The user's name. The name must consist of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: `=,.@-_.`. User names are not distinguished by case. For example, you cannot create users named both "TESTUSER" and "testuser".
+* `path` - (Optional, default "/") Path in which to create the user.
+* `permissions_boundary` - (Optional) The ARN of the policy that is used to set the permissions boundary for the user.
+* `force_destroy` - (Optional, default false) When destroying this user, destroy even if it
+  has non-Terraform-managed IAM access keys, login profile or MFA devices. Without `force_destroy`
+  a user with non-Terraform-managed access keys and login profile will fail to be destroyed.
+* `tags` - Key-value map of tags for the IAM user. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN assigned by AWS for this user.
+* `name` - The user's name.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `unique_id` - The [unique ID][1] assigned by AWS.
+
+  [1]: https://docs.aws.amazon.com/IAM/latest/UserGuide/Using_Identifiers.html#GUIDs
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IAM Users using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import IAM Users using the `name`. For example:
+
+```console
+% terraform import aws_iam_user.lb loadbalancer
+```
+
+<!-- cache-key: cdktf-0.18.0 input-7fa2a1117bc8c5d00748a3bbf9afeae418b9e72ed4e7d7c7c625a1d0f6a8b0b5 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/iam_user_group_membership.html.markdown b/website/docs/cdktf/python/r/iam_user_group_membership.html.markdown
new file mode 100644
index 00000000000..391745c1e7c
--- /dev/null
+++ b/website/docs/cdktf/python/r/iam_user_group_membership.html.markdown
@@ -0,0 +1,93 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_user_group_membership"
+description: |-
+  Provides a resource for adding an IAM User to IAM Groups without conflicting
+  with itself.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iam_user_group_membership
+
+Provides a resource for adding an [IAM User][2] to [IAM Groups][1]. This
+resource can be used multiple times with the same user for non-overlapping
+groups.
+
+To exclusively manage the users in a group, see the
+[`aws_iam_group_membership` resource][3].
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.iam_group import IamGroup
+from imports.aws.iam_user import IamUser
+from imports.aws.iam_user_group_membership import IamUserGroupMembership
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        group1 = IamGroup(self, "group1",
+            name="group1"
+        )
+        group2 = IamGroup(self, "group2",
+            name="group2"
+        )
+        group3 = IamGroup(self, "group3",
+            name="group3"
+        )
+        user1 = IamUser(self, "user1",
+            name="user1"
+        )
+        IamUserGroupMembership(self, "example1",
+            groups=[group1.name, group2.name],
+            user=user1.name
+        )
+        IamUserGroupMembership(self, "example2",
+            groups=[group3.name],
+            user=user1.name
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `user` - (Required) The name of the [IAM User][2] to add to groups
+* `groups` - (Required) A list of [IAM Groups][1] to add the user to
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+[1]: /docs/providers/aws/r/iam_group.html
+[2]: /docs/providers/aws/r/iam_user.html
+[3]: /docs/providers/aws/r/iam_group_membership.html
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IAM user group membership using the user name and group names separated by `/`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import IAM user group membership using the user name and group names separated by `/`. For example:
+
+```console
+% terraform import aws_iam_user_group_membership.example1 user1/group1/group2
+```
+
+<!-- cache-key: cdktf-0.18.0 input-14dd4765176954105a47943f6e53617581e2a060a1824a5c74af382ab83e177b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/iam_user_login_profile.html.markdown b/website/docs/cdktf/python/r/iam_user_login_profile.html.markdown
new file mode 100644
index 00000000000..85a006b75a3
--- /dev/null
+++ b/website/docs/cdktf/python/r/iam_user_login_profile.html.markdown
@@ -0,0 +1,110 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_user_login_profile"
+description: |-
+  Manages an IAM User Login Profile
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iam_user_login_profile
+
+Manages an IAM User Login Profile with limited support for password creation during Terraform resource creation. Uses PGP to encrypt the password for safe transport to the user. PGP keys can be obtained from Keybase.
+
+-> To reset an IAM User login password via Terraform, you can use the [`terraform taint` command](https://www.terraform.io/docs/commands/taint.html) or change any of the arguments.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformOutput, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.iam_user import IamUser
+from imports.aws.iam_user_login_profile import IamUserLoginProfile
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = IamUser(self, "example",
+            force_destroy=True,
+            name="example",
+            path="/"
+        )
+        aws_iam_user_login_profile_example = IamUserLoginProfile(self, "example_1",
+            pgp_key="keybase:some_person_that_exists",
+            user=example.name
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_user_login_profile_example.override_logical_id("example")
+        TerraformOutput(self, "password",
+            value=aws_iam_user_login_profile_example.encrypted_password
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `user` - (Required) The IAM user's name.
+* `pgp_key` - (Optional) Either a base-64 encoded PGP public key, or a keybase username in the form `keybase:username`. Only applies on resource creation. Drift detection is not possible with this argument.
+* `password_length` - (Optional) The length of the generated password on resource creation. Only applies on resource creation. Drift detection is not possible with this argument. Default value is `20`.
+* `password_reset_required` - (Optional) Whether the user should be forced to reset the generated password on resource creation. Only applies on resource creation.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `password` - The plain text password, only available when `pgp_key` is not provided.
+* `key_fingerprint` - The fingerprint of the PGP key used to encrypt the password. Only available if password was handled on Terraform resource creation, not import.
+* `encrypted_password` - The encrypted password, base64 encoded. Only available if password was handled on Terraform resource creation, not import.
+
+~> **NOTE:** The encrypted password may be decrypted using the command line,
+   for example: `terraform output password | base64 --decode | keybase pgp decrypt`.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IAM User Login Profiles without password information via the IAM User name. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import IAM User Login Profiles without password information via the IAM User name. For example:
+
+```console
+% terraform import aws_iam_user_login_profile.example myusername
+```
+
+Since Terraform has no method to read the PGP or password information during import, use the [Terraform resource `lifecycle` configuration block `ignore_changes` argument](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html#ignore_changes) to ignore them (unless you want to recreate a password). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from cdktf import TerraformResourceLifecycle
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.iam_user_login_profile import IamUserLoginProfile
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, user):
+        super().__init__(scope, name)
+        IamUserLoginProfile(self, "example",
+            lifecycle=TerraformResourceLifecycle(
+                ignore_changes=[password_length, password_reset_required, pgp_key]
+            ),
+            user=user
+        )
+```
+
+<!-- cache-key: cdktf-0.18.0 input-332beff043f3f89a7086471e863d83e0d7a3e4995b3f2b9abe9a879fd8d3778f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/iam_user_policy.html.markdown b/website/docs/cdktf/python/r/iam_user_policy.html.markdown
new file mode 100644
index 00000000000..fba9b17567a
--- /dev/null
+++ b/website/docs/cdktf/python/r/iam_user_policy.html.markdown
@@ -0,0 +1,91 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_user_policy"
+description: |-
+  Provides an IAM policy attached to a user.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iam_user_policy
+
+Provides an IAM policy attached to a user.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.iam_access_key import IamAccessKey
+from imports.aws.iam_user import IamUser
+from imports.aws.iam_user_policy import IamUserPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        lb = IamUser(self, "lb",
+            name="loadbalancer",
+            path="/system/"
+        )
+        IamUserPolicy(self, "lb_ro",
+            name="test",
+            policy=Token.as_string(
+                Fn.jsonencode({
+                    "Statement": [{
+                        "Action": ["ec2:Describe*"],
+                        "Effect": "Allow",
+                        "Resource": "*"
+                    }
+                    ],
+                    "Version": "2012-10-17"
+                })),
+            user=lb.name
+        )
+        aws_iam_access_key_lb = IamAccessKey(self, "lb_2",
+            user=lb.name
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_access_key_lb.override_logical_id("lb")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `policy` - (Required) The policy document. This is a JSON formatted string. For more information about building AWS IAM policy documents with Terraform, see the [AWS IAM Policy Document Guide](https://learn.hashicorp.com/terraform/aws/iam-policy).
+* `name` - (Optional) The name of the policy. If omitted, Terraform will assign a random, unique name.
+* `name_prefix` - (Optional, Forces new resource) Creates a unique name beginning with the specified prefix. Conflicts with `name`.
+* `user` - (Required) IAM user to which to attach this policy.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The user policy ID, in the form of `user_name:user_policy_name`.
+* `name` - The name of the policy (always set).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IAM User Policies using the `user_name:user_policy_name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import IAM User Policies using the `user_name:user_policy_name`. For example:
+
+```console
+% terraform import aws_iam_user_policy.mypolicy user_of_mypolicy_name:mypolicy_name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-0e7d9174e258c37b6b2bfd4094bb5d0f358c81bf66ad2ec394e1153843121ade -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/iam_user_policy_attachment.html.markdown b/website/docs/cdktf/python/r/iam_user_policy_attachment.html.markdown
new file mode 100644
index 00000000000..7ac00e3b34d
--- /dev/null
+++ b/website/docs/cdktf/python/r/iam_user_policy_attachment.html.markdown
@@ -0,0 +1,77 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_user_policy_attachment"
+description: |-
+  Attaches a Managed IAM Policy to an IAM user
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iam_user_policy_attachment
+
+Attaches a Managed IAM Policy to an IAM user
+
+~> **NOTE:** The usage of this resource conflicts with the `aws_iam_policy_attachment` resource and will permanently show a difference if both are defined.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.iam_policy import IamPolicy
+from imports.aws.iam_user import IamUser
+from imports.aws.iam_user_policy_attachment import IamUserPolicyAttachment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        policy = IamPolicy(self, "policy",
+            description="A test policy",
+            name="test-policy",
+            policy="{ ... policy JSON ... }"
+        )
+        user = IamUser(self, "user",
+            name="test-user"
+        )
+        IamUserPolicyAttachment(self, "test-attach",
+            policy_arn=policy.arn,
+            user=user.name
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `user`        (Required) - The user the policy should be applied to
+* `policy_arn`  (Required) - The ARN of the policy you want to apply
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IAM user policy attachments using the user name and policy arn separated by `/`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import IAM user policy attachments using the user name and policy arn separated by `/`. For example:
+
+```console
+% terraform import aws_iam_user_policy_attachment.test-attach test-user/arn:aws:iam::xxxxxxxxxxxx:policy/test-policy
+```
+
+<!-- cache-key: cdktf-0.18.0 input-be6384a6a6297b756a1ca1cf5fb8df33f6e76d728c5f3abe5755bef01c55790e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/iam_user_policy_attachment.markdown b/website/docs/cdktf/python/r/iam_user_policy_attachment.markdown
new file mode 100644
index 00000000000..7ac00e3b34d
--- /dev/null
+++ b/website/docs/cdktf/python/r/iam_user_policy_attachment.markdown
@@ -0,0 +1,77 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_user_policy_attachment"
+description: |-
+  Attaches a Managed IAM Policy to an IAM user
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iam_user_policy_attachment
+
+Attaches a Managed IAM Policy to an IAM user
+
+~> **NOTE:** The usage of this resource conflicts with the `aws_iam_policy_attachment` resource and will permanently show a difference if both are defined.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.iam_policy import IamPolicy
+from imports.aws.iam_user import IamUser
+from imports.aws.iam_user_policy_attachment import IamUserPolicyAttachment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        policy = IamPolicy(self, "policy",
+            description="A test policy",
+            name="test-policy",
+            policy="{ ... policy JSON ... }"
+        )
+        user = IamUser(self, "user",
+            name="test-user"
+        )
+        IamUserPolicyAttachment(self, "test-attach",
+            policy_arn=policy.arn,
+            user=user.name
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `user`        (Required) - The user the policy should be applied to
+* `policy_arn`  (Required) - The ARN of the policy you want to apply
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IAM user policy attachments using the user name and policy arn separated by `/`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import IAM user policy attachments using the user name and policy arn separated by `/`. For example:
+
+```console
+% terraform import aws_iam_user_policy_attachment.test-attach test-user/arn:aws:iam::xxxxxxxxxxxx:policy/test-policy
+```
+
+<!-- cache-key: cdktf-0.18.0 input-be6384a6a6297b756a1ca1cf5fb8df33f6e76d728c5f3abe5755bef01c55790e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/iam_user_ssh_key.html.markdown b/website/docs/cdktf/python/r/iam_user_ssh_key.html.markdown
new file mode 100644
index 00000000000..ced963784d7
--- /dev/null
+++ b/website/docs/cdktf/python/r/iam_user_ssh_key.html.markdown
@@ -0,0 +1,78 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_user_ssh_key"
+description: |-
+  Uploads an SSH public key and associates it with the specified IAM user.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iam_user_ssh_key
+
+Uploads an SSH public key and associates it with the specified IAM user.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.iam_user import IamUser
+from imports.aws.iam_user_ssh_key import IamUserSshKey
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        user = IamUser(self, "user",
+            name="test-user",
+            path="/"
+        )
+        aws_iam_user_ssh_key_user = IamUserSshKey(self, "user_1",
+            encoding="SSH",
+            public_key="ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQD3F6tyPEFEzV0LX3X8BsXdMsQz1x2cEikKDEY0aIj41qgxMCP/iteneqXSIFZBp5vizPvaoIR3Um9xK7PGoW8giupGn+EPuxIA4cDM4vzOqOkiMPhz5XK0whEjkVzTo4+S0puvDZuwIsdiW9mxhJc7tgBNL0cYlWSYVkz4G/fslNfRPW5mYAM49f4fhtxPb5ok4Q2Lg9dPKVHO/Bgeu5woMc7RY0p1ej6D4CKFE6lymSDJpW0YHX/wqE9+cfEauh7xZcG0q9t2ta6F6fmX0agvpFyZo8aFbXeUBr7osSCJNgvavWbM/06niWrOvYX2xwWdhXmXSrbX8ZbabVohBK41 mytest@mydomain.com",
+            username=user.name
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_user_ssh_key_user.override_logical_id("user")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `username` - (Required) The name of the IAM user to associate the SSH public key with.
+* `encoding` - (Required) Specifies the public key encoding format to use in the response. To retrieve the public key in ssh-rsa format, use `SSH`. To retrieve the public key in PEM format, use `PEM`.
+* `public_key` - (Required) The SSH public key. The public key must be encoded in ssh-rsa format or PEM format.
+* `status` - (Optional) The status to assign to the SSH public key. Active means the key can be used for authentication with an AWS CodeCommit repository. Inactive means the key cannot be used. Default is `active`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `ssh_public_key_id` - The unique identifier for the SSH public key.
+* `fingerprint` - The MD5 message digest of the SSH public key.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SSH public keys using the `username`, `ssh_public_key_id`, and `encoding`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import SSH public keys using the `username`, `ssh_public_key_id`, and `encoding`. For example:
+
+```console
+% terraform import aws_iam_user_ssh_key.user user:APKAJNCNNJICVN7CFKCA:SSH
+```
+
+<!-- cache-key: cdktf-0.18.0 input-4cbd112ce4d145630ce699ef62acae06fbe7da8a55f9e6ceccda5f739cb8e1fe -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/iam_virtual_mfa_device.html.markdown b/website/docs/cdktf/python/r/iam_virtual_mfa_device.html.markdown
new file mode 100644
index 00000000000..c4a3150f758
--- /dev/null
+++ b/website/docs/cdktf/python/r/iam_virtual_mfa_device.html.markdown
@@ -0,0 +1,81 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_virtual_mfa_device"
+description: |-
+  Provides an IAM Virtual MFA Device
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iam_virtual_mfa_device
+
+Provides an IAM Virtual MFA Device.
+
+~> **Note:** All attributes will be stored in the raw state as plain-text.
+[Read more about sensitive data in state](https://www.terraform.io/docs/state/sensitive-data.html).
+
+~> **Note:** A virtual MFA device cannot be directly associated with an IAM User from Terraform.
+  To associate the virtual MFA device with a user and enable it, use the code returned in either `base_32_string_seed` or `qr_code_png` to generate TOTP authentication codes.
+  The authentication codes can then be used with the AWS CLI command [`aws iam enable-mfa-device`](https://docs.aws.amazon.com/cli/latest/reference/iam/enable-mfa-device.html) or the AWS API call [`EnableMFADevice`](https://docs.aws.amazon.com/IAM/latest/APIReference/API_EnableMFADevice.html).
+
+## Example Usage
+
+**Using certs on file:**
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.iam_virtual_mfa_device import IamVirtualMfaDevice
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        IamVirtualMfaDevice(self, "example",
+            virtual_mfa_device_name="example"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `virtual_mfa_device_name` - (Required) The name of the virtual MFA device. Use with path to uniquely identify a virtual MFA device.
+* `path` – (Optional) The path for the virtual MFA device.
+* `tags` - (Optional) Map of resource tags for the virtual mfa device. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) specifying the virtual mfa device.
+* `base_32_string_seed` - The base32 seed defined as specified in [RFC3548](https://tools.ietf.org/html/rfc3548.txt). The `base_32_string_seed` is base64-encoded.
+* `enable_date` - The date and time when the virtual MFA device was enabled.
+* `qr_code_png` -  A QR code PNG image that encodes `otpauth://totp/$virtualMFADeviceName@$AccountName?secret=$Base32String` where `$virtualMFADeviceName` is one of the create call arguments. AccountName is the user name if set (otherwise, the account ID), and Base32String is the seed in base32 format.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `user_name` - The associated IAM User name if the virtual MFA device is enabled.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IAM Virtual MFA Devices using the `arn`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import IAM Virtual MFA Devices using the `arn`. For example:
+
+```console
+% terraform import aws_iam_virtual_mfa_device.example arn:aws:iam::123456789012:mfa/example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-e8a74071097a35d1fabe1f8e98c50def43b822970d49ce5d2336e31e57fe8b7c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/identitystore_group.html.markdown b/website/docs/cdktf/python/r/identitystore_group.html.markdown
new file mode 100644
index 00000000000..8102913bad1
--- /dev/null
+++ b/website/docs/cdktf/python/r/identitystore_group.html.markdown
@@ -0,0 +1,89 @@
+---
+subcategory: "SSO Identity Store"
+layout: "aws"
+page_title: "AWS: aws_identitystore_group"
+description: |-
+  Terraform resource for managing an AWS IdentityStore Group.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_identitystore_group
+
+Terraform resource for managing an AWS IdentityStore Group.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.identitystore_group import IdentitystoreGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        IdentitystoreGroup(self, "this",
+            description="Example description",
+            display_name="Example group",
+            identity_store_id=Token.as_string(
+                Fn.lookup_nested(Fn.tolist(example.identity_store_ids), ["0"]))
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `identity_store_id` - (Required) The globally unique identifier for the identity store.
+
+The following arguments are optional:
+
+* `display_name` - (Optional) A string containing the name of the group. This value is commonly displayed when the group is referenced.
+* `description` - (Optional) A string containing the description of the group.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `group_id` - The identifier of the newly created group in the identity store.
+* `external_ids` - A list of external IDs that contains the identifiers issued to this resource by an external identity provider. See [External IDs](#external-ids) below.
+
+### External IDs
+
+* `id` - The identifier issued to this resource by an external identity provider.
+* `issuer` - The issuer for an external identifier.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `60m`)
+* `update` - (Default `180m`)
+* `delete` - (Default `90m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import an Identity Store Group using the combination `identity_store_id/group_id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import an Identity Store Group using the combination `identity_store_id/group_id`. For example:
+
+```console
+% terraform import aws_identitystore_group.example d-9c6705e95c/b8a1c340-8031-7071-a2fb-7dc540320c30
+```
+
+<!-- cache-key: cdktf-0.18.0 input-77081370c526c7da03dc3c3f8a50e4bd16a1ba6cea9abd0f209e0c794a9106bf -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/identitystore_group_membership.html.markdown b/website/docs/cdktf/python/r/identitystore_group_membership.html.markdown
new file mode 100644
index 00000000000..71b66cf1d53
--- /dev/null
+++ b/website/docs/cdktf/python/r/identitystore_group_membership.html.markdown
@@ -0,0 +1,97 @@
+---
+subcategory: "SSO Identity Store"
+layout: "aws"
+page_title: "AWS: aws_identitystore_group_membership"
+description: |-
+  Terraform resource for managing an AWS IdentityStore Group Membership.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_identitystore_group_membership
+
+Terraform resource for managing an AWS IdentityStore Group Membership.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_ssoadmin_instances import DataAwsSsoadminInstances
+from imports.aws.identitystore_group import IdentitystoreGroup
+from imports.aws.identitystore_group_membership import IdentitystoreGroupMembership
+from imports.aws.identitystore_user import IdentitystoreUser
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = DataAwsSsoadminInstances(self, "example")
+        aws_identitystore_group_example = IdentitystoreGroup(self, "example_1",
+            description="Some group name",
+            display_name="MyGroup",
+            identity_store_id=Token.as_string(
+                Fn.lookup_nested(Fn.tolist(example.identity_store_ids), ["0"]))
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_identitystore_group_example.override_logical_id("example")
+        aws_identitystore_user_example = IdentitystoreUser(self, "example_2",
+            display_name="John Doe",
+            identity_store_id=Token.as_string(
+                Fn.lookup_nested(Fn.tolist(example.identity_store_ids), ["0"])),
+            name=IdentitystoreUserName(
+                family_name="Doe",
+                given_name="John"
+            ),
+            user_name="john.doe@example.com"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_identitystore_user_example.override_logical_id("example")
+        aws_identitystore_group_membership_example =
+        IdentitystoreGroupMembership(self, "example_3",
+            group_id=Token.as_string(aws_identitystore_group_example.group_id),
+            identity_store_id=Token.as_string(
+                Fn.lookup_nested(Fn.tolist(example.identity_store_ids), ["0"])),
+            member_id=Token.as_string(aws_identitystore_user_example.user_id)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_identitystore_group_membership_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `member_id` - (Required) The identifier for a user in the Identity Store.
+* `group_id` - (Required)  The identifier for a group in the Identity Store.
+* `identity_store_id` - (Required) Identity Store ID associated with the Single Sign-On Instance.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `membership_id` - The identifier of the newly created group membership in the Identity Store.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_identitystore_group_membership` using the `identity_store_id/membership_id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_identitystore_group_membership` using the `identity_store_id/membership_id`. For example:
+
+```console
+% terraform import aws_identitystore_group_membership.example d-0000000000/00000000-0000-0000-0000-000000000000
+```
+
+<!-- cache-key: cdktf-0.18.0 input-745ddbb430f05a4e5f0ba00082fd2e6025b969aa5422c002d78fa6aa6109ffff -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/identitystore_user.html.markdown b/website/docs/cdktf/python/r/identitystore_user.html.markdown
new file mode 100644
index 00000000000..a84e346ef25
--- /dev/null
+++ b/website/docs/cdktf/python/r/identitystore_user.html.markdown
@@ -0,0 +1,141 @@
+---
+subcategory: "SSO Identity Store"
+layout: "aws"
+page_title: "AWS: aws_identitystore_user"
+description: |-
+  Terraform resource for managing an AWS Identity Store User.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_identitystore_user
+
+This resource manages a User resource within an Identity Store.
+
+-> **Note:** If you use an external identity provider or Active Directory as your identity source,
+use this resource with caution. IAM Identity Center does not support outbound synchronization,
+so your identity source does not automatically update with the changes that you make to
+users using this resource.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.identitystore_user import IdentitystoreUser
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        IdentitystoreUser(self, "example",
+            display_name="John Doe",
+            emails=IdentitystoreUserEmails(
+                value="john@example.com"
+            ),
+            identity_store_id=Token.as_string(
+                Fn.lookup_nested(
+                    Fn.tolist(data_aws_ssoadmin_instances_example.identity_store_ids), ["0"])),
+            name=IdentitystoreUserName(
+                family_name="Doe",
+                given_name="John"
+            ),
+            user_name="johndoe"
+        )
+```
+
+## Argument Reference
+
+-> Unless specified otherwise, all fields can contain up to 1024 characters of free-form text.
+
+The following arguments are required:
+
+* `display_name` - (Required) The name that is typically displayed when the user is referenced.
+* `identity_store_id` - (Required, Forces new resource) The globally unique identifier for the identity store that this user is in.
+* `name` - (Required) Details about the user's full name. Detailed below.
+* `user_name` - (Required, Forces new resource) A unique string used to identify the user. This value can consist of letters, accented characters, symbols, numbers, and punctuation. This value is specified at the time the user is created and stored as an attribute of the user object in the identity store. The limit is 128 characters.
+
+The following arguments are optional:
+
+* `addresses` - (Optional) Details about the user's address. At most 1 address is allowed. Detailed below.
+* `emails` - (Optional) Details about the user's email. At most 1 email is allowed. Detailed below.
+* `locale` - (Optional) The user's geographical region or location.
+* `nickname` - (Optional) An alternate name for the user.
+* `phone_numbers` - (Optional) Details about the user's phone number. At most 1 phone number is allowed. Detailed below.
+* `preferred_language` - (Optional) The preferred language of the user.
+* `profile_url` - (Optional) An URL that may be associated with the user.
+* `timezone` - (Optional) The user's time zone.
+* `title` - (Optional) The user's title.
+* `user_type` - (Optional) The user type.
+
+### addresses Configuration Block
+
+* `country` - (Optional) The country that this address is in.
+* `formatted` - (Optional) The name that is typically displayed when the address is shown for display.
+* `locality` - (Optional) The address locality.
+* `postal_code` - (Optional) The postal code of the address.
+* `primary` - (Optional) When `true`, this is the primary address associated with the user.
+* `region` - (Optional) The region of the address.
+* `street_address` - (Optional) The street of the address.
+* `type` - (Optional) The type of address.
+
+### emails Configuration Block
+
+* `primary` - (Optional) When `true`, this is the primary email associated with the user.
+* `type` - (Optional) The type of email.
+* `value` - (Optional) The email address. This value must be unique across the identity store.
+
+### name Configuration Block
+
+The following arguments are required:
+
+* `family_name` - (Required) The family name of the user.
+* `given_name` - (Required) The given name of the user.
+
+The following arguments are optional:
+
+* `formatted` - (Optional) The name that is typically displayed when the name is shown for display.
+* `honorific_prefix` - (Optional) The honorific prefix of the user.
+* `honorific_suffix` - (Optional) The honorific suffix of the user.
+* `middle_name` - (Optional) The middle name of the user.
+
+### phone_numbers Configuration Block
+
+* `primary` - (Optional) When `true`, this is the primary phone number associated with the user.
+* `type` - (Optional) The type of phone number.
+* `value` - (Optional) The user's phone number.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `external_ids` - A list of identifiers issued to this resource by an external identity provider.
+    * `id` - The identifier issued to this resource by an external identity provider.
+    * `issuer` - The issuer for an external identifier.
+* `user_id` - The identifier for this user in the identity store.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import an Identity Store User using the combination `identity_store_id/user_id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import an Identity Store User using the combination `identity_store_id/user_id`. For example:
+
+```console
+% terraform import aws_identitystore_user.example d-9c6705e95c/065212b4-9061-703b-5876-13a517ae2a7c
+```
+
+<!-- cache-key: cdktf-0.18.0 input-c1ad083569cd581aba94dd285d2251f01db365c421ea22120e81c2b7c96de33c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/imagebuilder_component.html.markdown b/website/docs/cdktf/python/r/imagebuilder_component.html.markdown
new file mode 100644
index 00000000000..00195330fe7
--- /dev/null
+++ b/website/docs/cdktf/python/r/imagebuilder_component.html.markdown
@@ -0,0 +1,130 @@
+---
+subcategory: "EC2 Image Builder"
+layout: "aws"
+page_title: "AWS: aws_imagebuilder_component"
+description: |-
+    Manage an Image Builder Component
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_imagebuilder_component
+
+Manages an Image Builder Component.
+
+## Example Usage
+
+### Inline Data Document
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.imagebuilder_component import ImagebuilderComponent
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ImagebuilderComponent(self, "example",
+            data=Token.as_string(
+                Fn.yamlencode({
+                    "phases": [{
+                        "name": "build",
+                        "steps": [{
+                            "action": "ExecuteBash",
+                            "inputs": {
+                                "commands": ["echo 'hello world'"]
+                            },
+                            "name": "example",
+                            "on_failure": "Continue"
+                        }
+                        ]
+                    }
+                    ],
+                    "schema_version": 1
+                })),
+            name="example",
+            platform="Linux",
+            version="1.0.0"
+        )
+```
+
+### URI Document
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.imagebuilder_component import ImagebuilderComponent
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ImagebuilderComponent(self, "example",
+            name="example",
+            platform="Linux",
+            uri="s3://${" + aws_s3_object_example.bucket + "}/${" + aws_s3_object_example.key + "}",
+            version="1.0.0"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) Name of the component.
+* `platform` - (Required) Platform of the component.
+* `version` - (Required) Version of the component.
+
+The following attributes are optional:
+
+* `change_description` - (Optional) Change description of the component.
+* `data` - (Optional) Inline YAML string with data of the component. Exactly one of `data` and `uri` can be specified. Terraform will only perform drift detection of its value when present in a configuration.
+* `description` - (Optional) Description of the component.
+* `kms_key_id` - (Optional) Amazon Resource Name (ARN) of the Key Management Service (KMS) Key used to encrypt the component.
+* `skip_destroy` - (Optional) Whether to retain the old version when the resource is destroyed or replacement is necessary. Defaults to `false`.
+* `supported_os_versions` - (Optional) Set of Operating Systems (OS) supported by the component.
+* `tags` - (Optional) Key-value map of resource tags for the component. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `uri` - (Optional) S3 URI with data of the component. Exactly one of `data` and `uri` can be specified.
+
+~> **NOTE:** Updating `data` or `uri` requires specifying a new `version`. This causes replacement of the resource. The `skip_destroy` argument can be used to retain the old version.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - (Required) Amazon Resource Name (ARN) of the component.
+* `date_created` - Date the component was created.
+* `encrypted` - Encryption status of the component.
+* `owner` - Owner of the component.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `type` - Type of the component.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_imagebuilder_components` resources using the Amazon Resource Name (ARN). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_imagebuilder_components` resources using the Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_imagebuilder_component.example arn:aws:imagebuilder:us-east-1:123456789012:component/example/1.0.0/1
+```
+
+Certain resource arguments, such as `uri`, cannot be read via the API and imported into Terraform. Terraform will display a difference for these arguments the first run after import if declared in the Terraform configuration for an imported resource.
+
+<!-- cache-key: cdktf-0.18.0 input-7920aa22e67cfcf51eafb7a57251408d3c0e3878496f0aa735aa73051dd90d92 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/imagebuilder_container_recipe.html.markdown b/website/docs/cdktf/python/r/imagebuilder_container_recipe.html.markdown
new file mode 100644
index 00000000000..bb481570753
--- /dev/null
+++ b/website/docs/cdktf/python/r/imagebuilder_container_recipe.html.markdown
@@ -0,0 +1,156 @@
+---
+subcategory: "EC2 Image Builder"
+layout: "aws"
+page_title: "AWS: aws_imagebuilder_container_recipe"
+description: |-
+    Manage an Image Builder Container Recipe
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_imagebuilder_container_recipe
+
+Manages an Image Builder Container Recipe.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.imagebuilder_container_recipe import ImagebuilderContainerRecipe
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ImagebuilderContainerRecipe(self, "example",
+            component=[ImagebuilderContainerRecipeComponent(
+                component_arn=Token.as_string(aws_imagebuilder_component_example.arn),
+                parameter=[ImagebuilderContainerRecipeComponentParameter(
+                    name="Parameter1",
+                    value="Value1"
+                ), ImagebuilderContainerRecipeComponentParameter(
+                    name="Parameter2",
+                    value="Value2"
+                )
+                ]
+            )
+            ],
+            container_type="DOCKER",
+            dockerfile_template_data="FROM {{{ imagebuilder:parentImage }}}\n{{{ imagebuilder:environments }}}\n{{{ imagebuilder:components }}}\n\n",
+            name="example",
+            parent_image="arn:aws:imagebuilder:eu-central-1:aws:image/amazon-linux-x86-latest/x.x.x",
+            target_repository=ImagebuilderContainerRecipeTargetRepository(
+                repository_name=Token.as_string(aws_ecr_repository_example.name),
+                service="ECR"
+            ),
+            version="1.0.0"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `component` - (Required) Ordered configuration block(s) with components for the container recipe. Detailed below.
+* `container_type` - (Required) The type of the container to create. Valid values: `DOCKER`.
+* `name` - (Required) The name of the container recipe.
+* `parent_image` (Required) The base image for the container recipe.
+* `target_repository` (Required) The destination repository for the container image. Detailed below.
+* `version` (Required) Version of the container recipe.
+
+The following attributes are optional:
+
+* `description` - (Optional) The description of the container recipe.
+* `dockerfile_template_data` - (Optional) The Dockerfile template used to build the image as an inline data blob.
+* `dockerfile_template_uri` - (Optional) The Amazon S3 URI for the Dockerfile that will be used to build the container image.
+* `instance_configuration` - (Optional) Configuration block used to configure an instance for building and testing container images. Detailed below.
+* `kms_key_id` - (Optional) The KMS key used to encrypt the container image.
+* `platform_override` - (Optional) Specifies the operating system platform when you use a custom base image.
+* `tags` - (Optional) Key-value map of resource tags for the container recipe. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `working_directory` - (Optional) The working directory to be used during build and test workflows.
+
+### component
+
+The `component` block supports the following arguments:
+
+* `component_arn` - (Required) Amazon Resource Name (ARN) of the Image Builder Component to associate.
+* `parameter` - (Optional) Configuration block(s) for parameters to configure the component. Detailed below.
+
+### parameter
+
+The following arguments are required:
+
+* `name` - (Required) The name of the component parameter.
+* `value` - (Required) The value for the named component parameter.
+
+### target_repository
+
+The following arguments are required:
+
+* `repository_name` - (Required) The name of the container repository where the output container image is stored. This name is prefixed by the repository location.
+* `service` - (Required) The service in which this image is registered. Valid values: `ECR`.
+
+### instance_configuration
+
+The following arguments are optional:
+
+* `block_device_mapping` - (Optional) Configuration block(s) with block device mappings for the container recipe. Detailed below.
+* `image` - (Optional) The AMI ID to use as the base image for a container build and test instance. If not specified, Image Builder will use the appropriate ECS-optimized AMI as a base image.
+
+### block_device_mapping
+
+The following arguments are optional:
+
+* `device_name` - (Optional) Name of the device. For example, `/dev/sda` or `/dev/xvdb`.
+* `ebs` - (Optional) Configuration block with Elastic Block Storage (EBS) block device mapping settings. Detailed below.
+* `no_device` - (Optional) Set to `true` to remove a mapping from the parent image.
+* `virtual_name` - (Optional) Virtual device name. For example, `ephemeral0`. Instance store volumes are numbered starting from 0.
+
+#### ebs
+
+The following arguments are optional:
+
+* `delete_on_termination` - (Optional) Whether to delete the volume on termination. Defaults to unset, which is the value inherited from the parent image.
+* `encrypted` - (Optional) Whether to encrypt the volume. Defaults to unset, which is the value inherited from the parent image.
+* `iops` - (Optional) Number of Input/Output (I/O) operations per second to provision for an `io1` or `io2` volume.
+* `kms_key_id` - (Optional) Amazon Resource Name (ARN) of the Key Management Service (KMS) Key for encryption.
+* `snapshot_id` - (Optional) Identifier of the EC2 Volume Snapshot.
+* `throughput` - (Optional) For GP3 volumes only. The throughput in MiB/s that the volume supports.
+* `volume_size` - (Optional) Size of the volume, in GiB.
+* `volume_type` - (Optional) Type of the volume. For example, `gp2` or `io2`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - (Required) Amazon Resource Name (ARN) of the container recipe.
+* `date_created` - Date the container recipe was created.
+* `encrypted` - A flag that indicates if the target container is encrypted.
+* `owner` - Owner of the container recipe.
+* `platform` - Platform of the container recipe.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_imagebuilder_container_recipe` resources using the Amazon Resource Name (ARN). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_imagebuilder_container_recipe` resources using the Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_imagebuilder_container_recipe.example arn:aws:imagebuilder:us-east-1:123456789012:container-recipe/example/1.0.0
+```
+
+<!-- cache-key: cdktf-0.18.0 input-b616803b9b163166c8ca8e3572b4ae2a3b7520be71fb4d2736f37a4c59c66771 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/imagebuilder_distribution_configuration.html.markdown b/website/docs/cdktf/python/r/imagebuilder_distribution_configuration.html.markdown
new file mode 100644
index 00000000000..d50b0e7dca8
--- /dev/null
+++ b/website/docs/cdktf/python/r/imagebuilder_distribution_configuration.html.markdown
@@ -0,0 +1,160 @@
+---
+subcategory: "EC2 Image Builder"
+layout: "aws"
+page_title: "AWS: aws_imagebuilder_distribution_configuration"
+description: |-
+    Manage an Image Builder Distribution Configuration
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_imagebuilder_distribution_configuration
+
+Manages an Image Builder Distribution Configuration.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.imagebuilder_distribution_configuration import ImagebuilderDistributionConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ImagebuilderDistributionConfiguration(self, "example",
+            distribution=[ImagebuilderDistributionConfigurationDistribution(
+                ami_distribution_configuration=ImagebuilderDistributionConfigurationDistributionAmiDistributionConfiguration(
+                    ami_tags={
+                        "CostCenter": "IT"
+                    },
+                    launch_permission=ImagebuilderDistributionConfigurationDistributionAmiDistributionConfigurationLaunchPermission(
+                        user_ids=["123456789012"]
+                    ),
+                    name="example-{{ imagebuilder:buildDate }}"
+                ),
+                launch_template_configuration=[ImagebuilderDistributionConfigurationDistributionLaunchTemplateConfiguration(
+                    launch_template_id="lt-0aaa1bcde2ff3456"
+                )
+                ],
+                region="us-east-1"
+            )
+            ],
+            name="example"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) Name of the distribution configuration.
+* `distribution` - (Required) One or more configuration blocks with distribution settings. Detailed below.
+
+The following arguments are optional:
+
+* `description` - (Optional) Description of the distribution configuration.
+* `tags` - (Optional) Key-value map of resource tags for the distribution configuration. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### distribution
+
+The following arguments are required:
+
+* `region` - (Required) AWS Region for the distribution.
+
+The following arguments are optional:
+
+* `ami_distribution_configuration` - (Optional) Configuration block with Amazon Machine Image (AMI) distribution settings. Detailed below.
+* `container_distribution_configuration` - (Optional) Configuration block with container distribution settings. Detailed below.
+* `fast_launch_configuration` - (Optional) Set of Windows faster-launching configurations to use for AMI distribution. Detailed below.
+* `launch_template_configuration` - (Optional) Set of launch template configuration settings that apply to image distribution. Detailed below.
+* `license_configuration_arns` - (Optional) Set of Amazon Resource Names (ARNs) of License Manager License Configurations.
+
+### ami_distribution_configuration
+
+The following arguments are optional:
+
+* `ami_tags` - (Optional) Key-value map of tags to apply to the distributed AMI.
+* `description` - (Optional) Description to apply to the distributed AMI.
+* `kms_key_id` - (Optional) Amazon Resource Name (ARN) of the Key Management Service (KMS) Key to encrypt the distributed AMI.
+* `launch_permission` - (Optional) Configuration block of EC2 launch permissions to apply to the distributed AMI. Detailed below.
+* `name` - (Optional) Name to apply to the distributed AMI.
+* `target_account_ids` - (Optional) Set of AWS Account identifiers to distribute the AMI.
+
+### launch_permission
+
+The following arguments are optional:
+
+* `organization_arns` - (Optional) Set of AWS Organization ARNs to assign.
+* `organizational_unit_arns` - (Optional) Set of AWS Organizational Unit ARNs to assign.
+* `user_groups` - (Optional) Set of EC2 launch permission user groups to assign. Use `all` to distribute a public AMI.
+* `user_ids` - (Optional) Set of AWS Account identifiers to assign.
+
+### container_distribution_configuration
+
+* `container_tags` - (Optional) Set of tags that are attached to the container distribution configuration.
+* `description` - (Optional) Description of the container distribution configuration.
+* `target_repository` (Required) Configuration block with the destination repository for the container distribution configuration.
+
+### target_repository
+
+* `repository_name` - (Required) The name of the container repository where the output container image is stored. This name is prefixed by the repository location.
+* `service` - (Required) The service in which this image is registered. Valid values: `ECR`.
+
+### fast_launch_configuration
+
+* `account_id` - (Required) The owner account ID for the fast-launch enabled Windows AMI.
+* `enabled` - (Required) A Boolean that represents the current state of faster launching for the Windows AMI. Set to `true` to start using Windows faster launching, or `false` to stop using it.
+* `launch_template` - (Optional) Configuration block for the launch template that the fast-launch enabled Windows AMI uses when it launches Windows instances to create pre-provisioned snapshots. Detailed below.
+* `max_parallel_launches` - (Optional) The maximum number of parallel instances that are launched for creating resources.
+* `snapshot_configuration` - (Optional) Configuration block for managing the number of snapshots that are created from pre-provisioned instances for the Windows AMI when faster launching is enabled. Detailed below.
+
+### launch_template
+
+* `launch_template_id` - (Optional) The ID of the launch template to use for faster launching for a Windows AMI.
+* `launch_template_name` - (Optional) The name of the launch template to use for faster launching for a Windows AMI.
+* `launch_template_version` - (Optional) The version of the launch template to use for faster launching for a Windows AMI.
+
+### snapshot_configuration
+
+* `target_resource_count` - (Optional) The number of pre-provisioned snapshots to keep on hand for a fast-launch enabled Windows AMI.
+
+### launch_template_configuration
+
+* `default` - (Optional) Indicates whether to set the specified Amazon EC2 launch template as the default launch template. Defaults to `true`.
+* `account_id` - The account ID that this configuration applies to.
+* `launch_template_id` - (Required) The ID of the Amazon EC2 launch template to use.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - (Required) Amazon Resource Name (ARN) of the distribution configuration.
+* `date_created` - Date the distribution configuration was created.
+* `date_updated` - Date the distribution configuration was updated.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_imagebuilder_distribution_configurations` resources using the Amazon Resource Name (ARN). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_imagebuilder_distribution_configurations` resources using the Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_imagebuilder_distribution_configuration.example arn:aws:imagebuilder:us-east-1:123456789012:distribution-configuration/example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-6d8db82ff70fd71c294a27408592fa6427acf20679476b6f735995d9df579444 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/imagebuilder_image.html.markdown b/website/docs/cdktf/python/r/imagebuilder_image.html.markdown
new file mode 100644
index 00000000000..e41d0352ad3
--- /dev/null
+++ b/website/docs/cdktf/python/r/imagebuilder_image.html.markdown
@@ -0,0 +1,119 @@
+---
+subcategory: "EC2 Image Builder"
+layout: "aws"
+page_title: "AWS: aws_imagebuilder_image"
+description: |-
+    Manages an Image Builder Image
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_imagebuilder_image
+
+Manages an Image Builder Image.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.imagebuilder_image import ImagebuilderImage
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ImagebuilderImage(self, "example",
+            distribution_configuration_arn=Token.as_string(aws_imagebuilder_distribution_configuration_example.arn),
+            image_recipe_arn=Token.as_string(aws_imagebuilder_image_recipe_example.arn),
+            infrastructure_configuration_arn=Token.as_string(aws_imagebuilder_infrastructure_configuration_example.arn)
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `infrastructure_configuration_arn` - (Required) Amazon Resource Name (ARN) of the Image Builder Infrastructure Configuration.
+
+The following arguments are optional:
+
+* `container_recipe_arn` - (Optional) - Amazon Resource Name (ARN) of the container recipe.
+* `distribution_configuration_arn` - (Optional) Amazon Resource Name (ARN) of the Image Builder Distribution Configuration.
+* `enhanced_image_metadata_enabled` - (Optional) Whether additional information about the image being created is collected. Defaults to `true`.
+* `image_recipe_arn` - (Optional) Amazon Resource Name (ARN) of the image recipe.
+* `image_tests_configuration` - (Optional) Configuration block with image tests configuration. Detailed below.
+* `image_scanning_configuration` - (Optional) Configuration block with image scanning configuration. Detailed below.
+* `tags` - (Optional) Key-value map of resource tags for the Image Builder Image. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### image_tests_configuration
+
+The following arguments are optional:
+
+* `image_tests_enabled` - (Optional) Whether image tests are enabled. Defaults to `true`.
+* `timeout_minutes` - (Optional) Number of minutes before image tests time out. Valid values are between `60` and `1440`. Defaults to `720`.
+
+### image_scanning_configuration
+
+The following arguments are optional:
+
+* `image_scanning_enabled` - (Optional) Indicates whether Image Builder keeps a snapshot of the vulnerability scans that Amazon Inspector runs against the build instance when you create a new image. Defaults to `false`.
+* `ecr_configuration` - (Optional) Configuration block with ECR configuration. Detailed below.
+
+### ecr_configuration
+
+The following arguments are optional:
+
+* `repository_name` - (Optional) The name of the container repository that Amazon Inspector scans to identify findings for your container images.
+* `container_tags` - (Optional) Set of tags for Image Builder to apply to the output container image that that Amazon Inspector scans.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the image.
+* `date_created` - Date the image was created.
+* `platform` - Platform of the image.
+* `os_version` - Operating System version of the image.
+* `output_resources` - List of objects with resources created by the image.
+    * `amis` - Set of objects with each Amazon Machine Image (AMI) created.
+        * `account_id` - Account identifier of the AMI.
+        * `description` - Description of the AMI.
+        * `image` - Identifier of the AMI.
+        * `name` - Name of the AMI.
+        * `region` - Region of the AMI.
+    * `containers` - Set of objects with each container image created and stored in the output repository.
+        * `image_uris` - Set of URIs for created containers.
+        * `region` - Region of the container image.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `version` - Version of the image.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `60m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_imagebuilder_image` resources using the Amazon Resource Name (ARN). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_imagebuilder_image` resources using the Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_imagebuilder_image.example arn:aws:imagebuilder:us-east-1:123456789012:image/example/1.0.0/1
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1cfd36f8fabb6982d4f93c93832c07a2a2e26fd75759b9f073c07a7c18e7453f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/imagebuilder_image_pipeline.html.markdown b/website/docs/cdktf/python/r/imagebuilder_image_pipeline.html.markdown
new file mode 100644
index 00000000000..eebf4d92587
--- /dev/null
+++ b/website/docs/cdktf/python/r/imagebuilder_image_pipeline.html.markdown
@@ -0,0 +1,123 @@
+---
+subcategory: "EC2 Image Builder"
+layout: "aws"
+page_title: "AWS: aws_imagebuilder_image_pipeline"
+description: |-
+    Manages an Image Builder Image Pipeline
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_imagebuilder_image_pipeline
+
+Manages an Image Builder Image Pipeline.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.imagebuilder_image_pipeline import ImagebuilderImagePipeline
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ImagebuilderImagePipeline(self, "example",
+            image_recipe_arn=Token.as_string(aws_imagebuilder_image_recipe_example.arn),
+            infrastructure_configuration_arn=Token.as_string(aws_imagebuilder_infrastructure_configuration_example.arn),
+            name="example",
+            schedule=ImagebuilderImagePipelineSchedule(
+                schedule_expression="cron(0 0 * * ? *)"
+            )
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `infrastructure_configuration_arn` - (Required) Amazon Resource Name (ARN) of the Image Builder Infrastructure Configuration.
+* `name` - (Required) Name of the image pipeline.
+
+The following arguments are optional:
+
+* `container_recipe_arn` - (Optional) Amazon Resource Name (ARN) of the container recipe.
+* `description` - (Optional) Description of the image pipeline.
+* `distribution_configuration_arn` - (Optional) Amazon Resource Name (ARN) of the Image Builder Distribution Configuration.
+* `enhanced_image_metadata_enabled` - (Optional) Whether additional information about the image being created is collected. Defaults to `true`.
+* `image_recipe_arn` - (Optional) Amazon Resource Name (ARN) of the image recipe.
+* `image_scanning_configuration` - (Optional) Configuration block with image scanning configuration. Detailed below.
+* `image_tests_configuration` - (Optional) Configuration block with image tests configuration. Detailed below.
+* `schedule` - (Optional) Configuration block with schedule settings. Detailed below.
+* `status` - (Optional) Status of the image pipeline. Valid values are `DISABLED` and `ENABLED`. Defaults to `ENABLED`.
+* `tags` - (Optional) Key-value map of resource tags for the image pipeline. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### image_scanning_configuration
+
+The following arguments are optional:
+
+* `image_scanning_enabled` - (Optional) Whether image scans are enabled. Defaults to `false`.
+* `ecr_configuration` - (Optional) Configuration block with ECR configuration for image scanning. Detailed below.
+
+### ecr_configuration
+
+The following arguments are optional:
+
+* `container tags` - (Optional) list of tags to apply to scanned images
+* `repository_name` - (Optional) The name of the repository to scan
+
+### image_tests_configuration
+
+The following arguments are optional:
+
+* `image_tests_enabled` - (Optional) Whether image tests are enabled. Defaults to `true`.
+* `timeout_minutes` - (Optional) Number of minutes before image tests time out. Valid values are between `60` and `1440`. Defaults to `720`.
+
+### schedule
+
+The following arguments are required:
+
+* `schedule_expression` - (Required) Cron expression of how often the pipeline start condition is evaluated. For example, `cron(0 0 * * ? *)` is evaluated every day at midnight UTC. Configurations using the five field syntax that was previously accepted by the API, such as `cron(0 0 * * *)`, must be updated to the six field syntax. For more information, see the [Image Builder User Guide](https://docs.aws.amazon.com/imagebuilder/latest/userguide/cron-expressions.html).
+
+The following arguments are optional:
+
+* `pipeline_execution_start_condition` - (Optional) Condition when the pipeline should trigger a new image build. Valid values are `EXPRESSION_MATCH_AND_DEPENDENCY_UPDATES_AVAILABLE` and `EXPRESSION_MATCH_ONLY`. Defaults to `EXPRESSION_MATCH_AND_DEPENDENCY_UPDATES_AVAILABLE`.
+
+* `timezone` - (Optional) The timezone that applies to the scheduling expression. For example, "Etc/UTC", "America/Los_Angeles" in the [IANA timezone format](https://www.joda.org/joda-time/timezones.html). If not specified this defaults to UTC.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the image pipeline.
+* `date_created` - Date the image pipeline was created.
+* `date_last_run` - Date the image pipeline was last run.
+* `date_next_run` - Date the image pipeline will run next.
+* `date_updated` - Date the image pipeline was updated.
+* `platform` - Platform of the image pipeline.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_imagebuilder_image_pipeline` resources using the Amazon Resource Name (ARN). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_imagebuilder_image_pipeline` resources using the Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_imagebuilder_image_pipeline.example arn:aws:imagebuilder:us-east-1:123456789012:image-pipeline/example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-13e924ec569b627a02963bf24503600d1c77afb7d92500fcb19f3ff11c58c554 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/imagebuilder_image_recipe.html.markdown b/website/docs/cdktf/python/r/imagebuilder_image_recipe.html.markdown
new file mode 100644
index 00000000000..3ab1c738dc1
--- /dev/null
+++ b/website/docs/cdktf/python/r/imagebuilder_image_recipe.html.markdown
@@ -0,0 +1,146 @@
+---
+subcategory: "EC2 Image Builder"
+layout: "aws"
+page_title: "AWS: aws_imagebuilder_image_recipe"
+description: |-
+    Manage an Image Builder Image Recipe
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_imagebuilder_image_recipe
+
+Manages an Image Builder Image Recipe.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.imagebuilder_image_recipe import ImagebuilderImageRecipe
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ImagebuilderImageRecipe(self, "example",
+            block_device_mapping=[ImagebuilderImageRecipeBlockDeviceMapping(
+                device_name="/dev/xvdb",
+                ebs=ImagebuilderImageRecipeBlockDeviceMappingEbs(
+                    delete_on_termination=Token.as_string(True),
+                    volume_size=100,
+                    volume_type="gp2"
+                )
+            )
+            ],
+            component=[ImagebuilderImageRecipeComponent(
+                component_arn=Token.as_string(aws_imagebuilder_component_example.arn),
+                parameter=[ImagebuilderImageRecipeComponentParameter(
+                    name="Parameter1",
+                    value="Value1"
+                ), ImagebuilderImageRecipeComponentParameter(
+                    name="Parameter2",
+                    value="Value2"
+                )
+                ]
+            )
+            ],
+            name="example",
+            parent_image="arn:${" + current.partition + "}:imagebuilder:${" + data_aws_region_current.name + "}:aws:image/amazon-linux-2-x86/x.x.x",
+            version="1.0.0"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `component` - Ordered configuration block(s) with components for the image recipe. Detailed below.
+* `name` - Name of the image recipe.
+* `parent_image` - The image recipe uses this image as a base from which to build your customized image. The value can be the base image ARN or an AMI ID.
+* `version` - The semantic version of the image recipe, which specifies the version in the following format, with numeric values in each position to indicate a specific version: major.minor.patch. For example: 1.0.0.
+
+The following attributes are optional:
+
+* `block_device_mapping` - Configuration block(s) with block device mappings for the image recipe. Detailed below.
+* `description` - Description of the image recipe.
+* `systems_manager_agent` - Configuration block for the Systems Manager Agent installed by default by Image Builder. Detailed below.
+* `tags` - Key-value map of resource tags for the image recipe. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `user_data_base64` Base64 encoded user data. Use this to provide commands or a command script to run when you launch your build instance.
+* `working_directory` - The working directory to be used during build and test workflows.
+
+### block_device_mapping
+
+The following arguments are optional:
+
+* `device_name` - Name of the device. For example, `/dev/sda` or `/dev/xvdb`.
+* `ebs` - Configuration block with Elastic Block Storage (EBS) block device mapping settings. Detailed below.
+* `no_device` - Set to `true` to remove a mapping from the parent image.
+* `virtual_name` - Virtual device name. For example, `ephemeral0`. Instance store volumes are numbered starting from 0.
+
+#### ebs
+
+The following arguments are optional:
+
+* `delete_on_termination` - Whether to delete the volume on termination. Defaults to unset, which is the value inherited from the parent image.
+* `encrypted` - Whether to encrypt the volume. Defaults to unset, which is the value inherited from the parent image.
+* `iops` - Number of Input/Output (I/O) operations per second to provision for an `io1` or `io2` volume.
+* `kms_key_id` - Amazon Resource Name (ARN) of the Key Management Service (KMS) Key for encryption.
+* `snapshot_id` - Identifier of the EC2 Volume Snapshot.
+* `throughput` - For GP3 volumes only. The throughput in MiB/s that the volume supports.
+* `volume_size` - Size of the volume, in GiB.
+* `volume_type` - Type of the volume. For example, `gp2` or `io2`.
+
+### component
+
+The `component` block supports the following arguments:
+
+* `component_arn` - (Required) Amazon Resource Name (ARN) of the Image Builder Component to associate.
+* `parameter` - (Optional) Configuration block(s) for parameters to configure the component. Detailed below.
+
+### parameter
+
+The following arguments are required:
+
+* `name` - The name of the component parameter.
+* `value` - The value for the named component parameter.
+
+### systems_manager_agent
+
+The following arguments are required:
+
+* `uninstall_after_build` - Whether to remove the Systems Manager Agent after the image has been built. Defaults to `false`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - (Required) Amazon Resource Name (ARN) of the image recipe.
+* `date_created` - Date the image recipe was created.
+* `owner` - Owner of the image recipe.
+* `platform` - Platform of the image recipe.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_imagebuilder_image_recipe` resources using the Amazon Resource Name (ARN). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_imagebuilder_image_recipe` resources using the Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_imagebuilder_image_recipe.example arn:aws:imagebuilder:us-east-1:123456789012:image-recipe/example/1.0.0
+```
+
+<!-- cache-key: cdktf-0.18.0 input-dc715c7a06ef2521803576e2244cbd385c894a24475a5165a46fc8e1f4b1e0b6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/imagebuilder_infrastructure_configuration.html.markdown b/website/docs/cdktf/python/r/imagebuilder_infrastructure_configuration.html.markdown
new file mode 100644
index 00000000000..e552ced5b82
--- /dev/null
+++ b/website/docs/cdktf/python/r/imagebuilder_infrastructure_configuration.html.markdown
@@ -0,0 +1,124 @@
+---
+subcategory: "EC2 Image Builder"
+layout: "aws"
+page_title: "AWS: aws_imagebuilder_infrastructure_configuration"
+description: |-
+  Manages an Image Builder Infrastructure Configuration
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_imagebuilder_infrastructure_configuration
+
+Manages an Image Builder Infrastructure Configuration.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.imagebuilder_infrastructure_configuration import ImagebuilderInfrastructureConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ImagebuilderInfrastructureConfiguration(self, "example",
+            description="example description",
+            instance_profile_name=Token.as_string(aws_iam_instance_profile_example.name),
+            instance_types=["t2.nano", "t3.micro"],
+            key_pair=Token.as_string(aws_key_pair_example.key_name),
+            logging=ImagebuilderInfrastructureConfigurationLogging(
+                s3_logs=ImagebuilderInfrastructureConfigurationLoggingS3Logs(
+                    s3_bucket_name=Token.as_string(aws_s3_bucket_example.bucket),
+                    s3_key_prefix="logs"
+                )
+            ),
+            name="example",
+            security_group_ids=[Token.as_string(aws_security_group_example.id)],
+            sns_topic_arn=Token.as_string(aws_sns_topic_example.arn),
+            subnet_id=main.id,
+            tags={
+                "foo": "bar"
+            },
+            terminate_instance_on_failure=True
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `instance_profile_name` - (Required) Name of IAM Instance Profile.
+* `name` - (Required) Name for the configuration.
+
+The following arguments are optional:
+
+* `description` - (Optional) Description for the configuration.
+* `instance_metadata_options` - (Optional) Configuration block with instance metadata options for the HTTP requests that pipeline builds use to launch EC2 build and test instances. Detailed below.
+* `instance_types` - (Optional) Set of EC2 Instance Types.
+* `key_pair` - (Optional) Name of EC2 Key Pair.
+* `logging` - (Optional) Configuration block with logging settings. Detailed below.
+* `resource_tags` - (Optional) Key-value map of resource tags to assign to infrastructure created by the configuration.
+* `security_group_ids` - (Optional) Set of EC2 Security Group identifiers.
+* `sns_topic_arn` - (Optional) Amazon Resource Name (ARN) of SNS Topic.
+* `subnet_id` - (Optional) EC2 Subnet identifier. Also requires `security_group_ids` argument.
+* `tags` - (Optional) Key-value map of resource tags to assign to the configuration. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `terminate_instance_on_failure` - (Optional) Enable if the instance should be terminated when the pipeline fails. Defaults to `false`.
+
+### instance_metadata_options
+
+The following arguments are optional:
+
+* `http_put_response_hop_limit` - The number of hops that an instance can traverse to reach its destonation.
+* `http_tokens` - Whether a signed token is required for instance metadata retrieval requests. Valid values: `required`, `optional`.
+
+### logging
+
+The following arguments are required:
+
+* `s3_logs` - (Required) Configuration block with S3 logging settings. Detailed below.
+
+### s3_logs
+
+The following arguments are required:
+
+* `s3_bucket_name` - (Required) Name of the S3 Bucket.
+
+The following arguments are optional:
+
+* `s3_key_prefix` - (Optional) Prefix to use for S3 logs. Defaults to `/`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Amazon Resource Name (ARN) of the configuration.
+* `arn` - Amazon Resource Name (ARN) of the configuration.
+* `date_created` - Date when the configuration was created.
+* `date_updated` - Date when the configuration was updated.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_imagebuilder_infrastructure_configuration` using the Amazon Resource Name (ARN). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_imagebuilder_infrastructure_configuration` using the Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_imagebuilder_infrastructure_configuration.example arn:aws:imagebuilder:us-east-1:123456789012:infrastructure-configuration/example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-92ce8940a00b3a6132cb84f5e5797b0c5f3f5546af00335b30802f922e76f2ef -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/inspector2_delegated_admin_account.html.markdown b/website/docs/cdktf/python/r/inspector2_delegated_admin_account.html.markdown
new file mode 100644
index 00000000000..20810cb19f5
--- /dev/null
+++ b/website/docs/cdktf/python/r/inspector2_delegated_admin_account.html.markdown
@@ -0,0 +1,76 @@
+---
+subcategory: "Inspector"
+layout: "aws"
+page_title: "AWS: aws_inspector2_delegated_admin_account"
+description: |-
+  Terraform resource for managing an Amazon Inspector Delegated Admin Account.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_inspector2_delegated_admin_account
+
+Terraform resource for managing an Amazon Inspector Delegated Admin Account.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_caller_identity import DataAwsCallerIdentity
+from imports.aws.inspector2_delegated_admin_account import Inspector2DelegatedAdminAccount
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        current = DataAwsCallerIdentity(self, "current")
+        Inspector2DelegatedAdminAccount(self, "example",
+            account_id=Token.as_string(current.account_id)
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `account_id` - (Required) Account to enable as delegated admin account.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `relationship_status` - Status of this delegated admin account.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `15m`)
+* `delete` - (Default `15m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Inspector Delegated Admin Account using the `account_id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Inspector Delegated Admin Account using the `account_id`. For example:
+
+```console
+% terraform import aws_inspector2_delegated_admin_account.example 012345678901
+```
+
+<!-- cache-key: cdktf-0.18.0 input-5828f02fcb3f6e66bfb0cfe7ea840e097f0fe9fe69f8bc3e6a28d81ab8a5ab11 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/inspector2_enabler.html.markdown b/website/docs/cdktf/python/r/inspector2_enabler.html.markdown
new file mode 100644
index 00000000000..9504206be5b
--- /dev/null
+++ b/website/docs/cdktf/python/r/inspector2_enabler.html.markdown
@@ -0,0 +1,83 @@
+---
+subcategory: "Inspector"
+layout: "aws"
+page_title: "AWS: aws_inspector2_enabler"
+description: |-
+  Terraform resource for enabling Amazon Inspector resource scans.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_inspector2_enabler
+
+Terraform resource for enabling Amazon Inspector resource scans.
+
+This resource must be created in the Organization's Administrator Account.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.inspector2_enabler import Inspector2Enabler
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Inspector2Enabler(self, "example",
+            account_ids=["123456789012"],
+            resource_types=["EC2"]
+        )
+```
+
+### For the Calling Account
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_caller_identity import DataAwsCallerIdentity
+from imports.aws.inspector2_enabler import Inspector2Enabler
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        current = DataAwsCallerIdentity(self, "current")
+        Inspector2Enabler(self, "test",
+            account_ids=[Token.as_string(current.account_id)],
+            resource_types=["ECR", "EC2"]
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `account_ids` - (Required) Set of account IDs.
+  Can contain one of: the Organization's Administrator Account, or one or more Member Accounts.
+* `resource_types` - (Required) Type of resources to scan.
+  Valid values are `EC2`, `ECR`, `LAMBDA` and `LAMBDA_CODE`.
+  At least one item is required.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `5m`)
+* `update` - (Default `5m`)
+* `delete` - (Default `5m`)
+
+<!-- cache-key: cdktf-0.18.0 input-89c0c72a488b36e9c62f0a2c9cee15a41ab1fd5afcccb4a7f1813eef314ce9e8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/inspector2_member_association.html.markdown b/website/docs/cdktf/python/r/inspector2_member_association.html.markdown
new file mode 100644
index 00000000000..d93254f9559
--- /dev/null
+++ b/website/docs/cdktf/python/r/inspector2_member_association.html.markdown
@@ -0,0 +1,69 @@
+---
+subcategory: "Inspector"
+layout: "aws"
+page_title: "AWS: aws_inspector2_member_association"
+description: |-
+  Terraform resource for managing an Amazon Inspector Member Association.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_inspector2_member_association
+
+Terraform resource for associating accounts to existing Inspector instances.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.inspector2_member_association import Inspector2MemberAssociation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Inspector2MemberAssociation(self, "example",
+            account_id="123456789012"
+        )
+```
+
+## Argument Reference
+
+The following argument is required:
+
+* `account_id` - (Required) ID of the account to associate
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `delegated_admin_account_id` - Account ID of the delegated administrator account
+* `relationship_status` - Status of the member relationship
+* `updated_at` - Date and time of the last update of the relationship
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Amazon Inspector Member Association using the `account_id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Amazon Inspector Member Association using the `account_id`. For example:
+
+```console
+% terraform import aws_inspector2_member_association.example 123456789012
+```
+
+<!-- cache-key: cdktf-0.18.0 input-82d5942e4f4d61c9c5edbed4e78715cf0ac4b5f18beb3ce13b9684e5cadbbf9d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/inspector2_organization_configuration.html.markdown b/website/docs/cdktf/python/r/inspector2_organization_configuration.html.markdown
new file mode 100644
index 00000000000..7b244878fc9
--- /dev/null
+++ b/website/docs/cdktf/python/r/inspector2_organization_configuration.html.markdown
@@ -0,0 +1,70 @@
+---
+subcategory: "Inspector"
+layout: "aws"
+page_title: "AWS: aws_inspector2_organization_configuration"
+description: |-
+  Terraform resource for managing an Amazon Inspector Organization Configuration.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_inspector2_organization_configuration
+
+Terraform resource for managing an Amazon Inspector Organization Configuration.
+
+~> **NOTE:** In order for this resource to work, the account you use must be an Inspector Delegated Admin Account.
+
+~> **NOTE:** When this resource is deleted, EC2, ECR and Lambda scans will no longer be automatically enabled for new members of your Amazon Inspector organization.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.inspector2_organization_configuration import Inspector2OrganizationConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Inspector2OrganizationConfiguration(self, "example",
+            auto_enable=Inspector2OrganizationConfigurationAutoEnable(
+                ec2=True,
+                ecr=False,
+                lambda_=True
+            )
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `auto_enable` - (Required) Configuration block for auto enabling. See below.
+
+### `auto_enable`
+
+* `ec2` - (Required) Whether Amazon EC2 scans are automatically enabled for new members of your Amazon Inspector organization.
+* `ecr` - (Required) Whether Amazon ECR scans are automatically enabled for new members of your Amazon Inspector organization.
+* `lambda` - (Optional) Whether Lambda Function scans are automatically enabled for new members of your Amazon Inspector organization.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `max_account_limit_reached` - Whether your configuration reached the max account limit.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `5m`)
+* `update` - (Default `5m`)
+* `delete` - (Default `5m`)
+
+<!-- cache-key: cdktf-0.18.0 input-1df42ad521b947a3a7bc404e14d2e821f7165ae91c2768891bab4bde0121e345 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/inspector_assessment_target.html.markdown b/website/docs/cdktf/python/r/inspector_assessment_target.html.markdown
new file mode 100644
index 00000000000..d6bfdca20ac
--- /dev/null
+++ b/website/docs/cdktf/python/r/inspector_assessment_target.html.markdown
@@ -0,0 +1,74 @@
+---
+subcategory: "Inspector Classic"
+layout: "aws"
+page_title: "AWS: aws_inspector_assessment_target"
+description: |-
+  Provides an Inspector Classic Assessment Target.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_inspector_assessment_target
+
+Provides an Inspector Classic Assessment Target
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.inspector_assessment_target import InspectorAssessmentTarget
+from imports.aws.inspector_resource_group import InspectorResourceGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        bar = InspectorResourceGroup(self, "bar",
+            tags={
+                "Env": "bar",
+                "Name": "foo"
+            }
+        )
+        InspectorAssessmentTarget(self, "foo",
+            name="assessment target",
+            resource_group_arn=bar.arn
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the assessment target.
+* `resource_group_arn` (Optional) Inspector Resource Group Amazon Resource Name (ARN) stating tags for instance matching. If not specified, all EC2 instances in the current AWS account and region are included in the assessment target.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The target assessment ARN.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Inspector Classic Assessment Targets using their Amazon Resource Name (ARN). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Inspector Classic Assessment Targets using their Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_inspector_assessment_target.example arn:aws:inspector:us-east-1:123456789012:target/0-xxxxxxx
+```
+
+<!-- cache-key: cdktf-0.18.0 input-751090ce084efdbf0b345dca096fd95c6240e0d6d09be01dcacf39cbb869bd19 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/inspector_assessment_template.html.markdown b/website/docs/cdktf/python/r/inspector_assessment_template.html.markdown
new file mode 100644
index 00000000000..83a2eb798e1
--- /dev/null
+++ b/website/docs/cdktf/python/r/inspector_assessment_template.html.markdown
@@ -0,0 +1,87 @@
+---
+subcategory: "Inspector Classic"
+layout: "aws"
+page_title: "AWS: aws_inspector_assessment_template"
+description: |-
+  Provides an Inspector Classic Assessment Template.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_inspector_assessment_template
+
+Provides an Inspector Classic Assessment Template
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.inspector_assessment_template import InspectorAssessmentTemplate
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        InspectorAssessmentTemplate(self, "example",
+            duration=3600,
+            event_subscription=[InspectorAssessmentTemplateEventSubscription(
+                event="ASSESSMENT_RUN_COMPLETED",
+                topic_arn=Token.as_string(aws_sns_topic_example.arn)
+            )
+            ],
+            name="example",
+            rules_package_arns=["arn:aws:inspector:us-west-2:758058086616:rulespackage/0-9hgA516p", "arn:aws:inspector:us-west-2:758058086616:rulespackage/0-H5hpSawc", "arn:aws:inspector:us-west-2:758058086616:rulespackage/0-JJOtZiqQ", "arn:aws:inspector:us-west-2:758058086616:rulespackage/0-vg5GGHSD"
+            ],
+            target_arn=Token.as_string(aws_inspector_assessment_target_example.arn)
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the assessment template.
+* `target_arn` - (Required) The assessment target ARN to attach the template to.
+* `duration` - (Required) The duration of the inspector run.
+* `rules_package_arns` - (Required) The rules to be used during the run.
+* `event_subscription` - (Optional) A block that enables sending notifications about a specified assessment template event to a designated SNS topic. See [Event Subscriptions](#event-subscriptions) for details.
+* `tags` - (Optional) Key-value map of tags for the Inspector assessment template. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Event Subscriptions
+
+The event subscription configuration block supports the following arguments:
+
+* `event` - (Required) The event for which you want to receive SNS notifications. Valid values are `ASSESSMENT_RUN_STARTED`, `ASSESSMENT_RUN_COMPLETED`, `ASSESSMENT_RUN_STATE_CHANGED`, and `FINDING_REPORTED`.
+* `topic_arn` - (Required) The ARN of the SNS topic to which notifications are sent.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The template assessment ARN.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_inspector_assessment_template` using the template assessment ARN. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_inspector_assessment_template` using the template assessment ARN. For example:
+
+```console
+% terraform import aws_inspector_assessment_template.example arn:aws:inspector:us-west-2:123456789012:target/0-9IaAzhGR/template/0-WEcjR8CH
+```
+
+<!-- cache-key: cdktf-0.18.0 input-8ab910475a5ea18490628aba73cd2f6da8ce0d1a11648cd0f2169486753e2383 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/inspector_resource_group.html.markdown b/website/docs/cdktf/python/r/inspector_resource_group.html.markdown
new file mode 100644
index 00000000000..605064fab45
--- /dev/null
+++ b/website/docs/cdktf/python/r/inspector_resource_group.html.markdown
@@ -0,0 +1,49 @@
+---
+subcategory: "Inspector Classic"
+layout: "aws"
+page_title: "AWS: aws_inspector_resource_group"
+description: |-
+  Provides an Amazon Inspector Classic Resource Group.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_inspector_resource_group
+
+Provides an Amazon Inspector Classic Resource Group.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.inspector_resource_group import InspectorResourceGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        InspectorResourceGroup(self, "example",
+            tags={
+                "Env": "bar",
+                "Name": "foo"
+            }
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `tags` - (Required) Key-value map of tags that are used to select the EC2 instances to be included in an [Amazon Inspector assessment target](/docs/providers/aws/r/inspector_assessment_target.html).
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The resource group ARN.
+
+<!-- cache-key: cdktf-0.18.0 input-2e81e0db78f9615ccb5ac22138c773a37a41a7eac278a0a1a0e8c3b36c5946d7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/instance.html.markdown b/website/docs/cdktf/python/r/instance.html.markdown
new file mode 100644
index 00000000000..d9e2d79f66a
--- /dev/null
+++ b/website/docs/cdktf/python/r/instance.html.markdown
@@ -0,0 +1,517 @@
+---
+subcategory: "EC2 (Elastic Compute Cloud)"
+layout: "aws"
+page_title: "AWS: aws_instance"
+description: |-
+  Provides an EC2 instance resource. This allows instances to be created, updated, and deleted. Instances also support provisioning.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_instance
+
+Provides an EC2 instance resource. This allows instances to be created, updated, and deleted. Instances also support [provisioning](https://www.terraform.io/docs/provisioners/index.html).
+
+## Example Usage
+
+### Basic example using AMI lookup
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_ami import DataAwsAmi
+from imports.aws.instance import Instance
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ubuntu = DataAwsAmi(self, "ubuntu",
+            filter=[DataAwsAmiFilter(
+                name="name",
+                values=["ubuntu/images/hvm-ssd/ubuntu-focal-20.04-amd64-server-*"]
+            ), DataAwsAmiFilter(
+                name="virtualization-type",
+                values=["hvm"]
+            )
+            ],
+            most_recent=True,
+            owners=["099720109477"]
+        )
+        Instance(self, "web",
+            ami=Token.as_string(ubuntu.id),
+            instance_type="t3.micro",
+            tags={
+                "Name": "HelloWorld"
+            }
+        )
+```
+
+### Spot instance example
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_ami import DataAwsAmi
+from imports.aws.instance import Instance
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        this_var = DataAwsAmi(self, "this",
+            filter=[DataAwsAmiFilter(
+                name="architecture",
+                values=["arm64"]
+            ), DataAwsAmiFilter(
+                name="name",
+                values=["al2023-ami-2023*"]
+            )
+            ],
+            most_recent=True,
+            owners=["amazon"]
+        )
+        aws_instance_this = Instance(self, "this_1",
+            ami=Token.as_string(this_var.id),
+            instance_market_options=InstanceInstanceMarketOptions(
+                spot_options=InstanceInstanceMarketOptionsSpotOptions(
+                    max_price=Token.as_string(0.0031)
+                )
+            ),
+            instance_type="t4g.nano",
+            tags={
+                "Name": "test-spot"
+            }
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_instance_this.override_logical_id("this")
+```
+
+### Network and credit specification example
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.instance import Instance
+from imports.aws.network_interface import NetworkInterface
+from imports.aws.subnet import Subnet
+from imports.aws.vpc import Vpc
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        my_vpc = Vpc(self, "my_vpc",
+            cidr_block="172.16.0.0/16",
+            tags={
+                "Name": "tf-example"
+            }
+        )
+        my_subnet = Subnet(self, "my_subnet",
+            availability_zone="us-west-2a",
+            cidr_block="172.16.10.0/24",
+            tags={
+                "Name": "tf-example"
+            },
+            vpc_id=my_vpc.id
+        )
+        foo = NetworkInterface(self, "foo",
+            private_ips=["172.16.10.100"],
+            subnet_id=my_subnet.id,
+            tags={
+                "Name": "primary_network_interface"
+            }
+        )
+        aws_instance_foo = Instance(self, "foo_3",
+            ami="ami-005e54dee72cc1d00",
+            credit_specification=InstanceCreditSpecification(
+                cpu_credits="unlimited"
+            ),
+            instance_type="t2.micro",
+            network_interface=[InstanceNetworkInterface(
+                device_index=0,
+                network_interface_id=foo.id
+            )
+            ]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_instance_foo.override_logical_id("foo")
+```
+
+### CPU options example
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_ami import DataAwsAmi
+from imports.aws.instance import Instance
+from imports.aws.subnet import Subnet
+from imports.aws.vpc import Vpc
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = Vpc(self, "example",
+            cidr_block="172.16.0.0/16",
+            tags={
+                "Name": "tf-example"
+            }
+        )
+        amzn_linux2023_ami = DataAwsAmi(self, "amzn-linux-2023-ami",
+            filter=[DataAwsAmiFilter(
+                name="name",
+                values=["al2023-ami-2023.*-x86_64"]
+            )
+            ],
+            most_recent=True,
+            owners=["amazon"]
+        )
+        aws_subnet_example = Subnet(self, "example_2",
+            availability_zone="us-east-2a",
+            cidr_block="172.16.10.0/24",
+            tags={
+                "Name": "tf-example"
+            },
+            vpc_id=example.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_subnet_example.override_logical_id("example")
+        aws_instance_example = Instance(self, "example_3",
+            ami=Token.as_string(amzn_linux2023_ami.id),
+            cpu_options=InstanceCpuOptions(
+                core_count=2,
+                threads_per_core=2
+            ),
+            instance_type="c6a.2xlarge",
+            subnet_id=Token.as_string(aws_subnet_example.id),
+            tags={
+                "Name": "tf-example"
+            }
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_instance_example.override_logical_id("example")
+```
+
+### Host resource group or Licence Manager registered AMI example
+
+A host resource group is a collection of Dedicated Hosts that you can manage as a single entity. As you launch instances, License Manager allocates the hosts and launches instances on them based on the settings that you configured. You can add existing Dedicated Hosts to a host resource group and take advantage of automated host management through License Manager.
+
+-> **NOTE:** A dedicated host is automatically associated with a License Manager host resource group if **Allocate hosts automatically** is enabled. Otherwise, use the `host_resource_group_arn` argument to explicitly associate the instance with the host resource group.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.instance import Instance
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Instance(self, "this",
+            ami="ami-0dcc1e21636832c5d",
+            host_resource_group_arn="arn:aws:resource-groups:us-west-2:012345678901:group/win-testhost",
+            instance_type="m5.large",
+            tenancy="host"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `ami` - (Optional) AMI to use for the instance. Required unless `launch_template` is specified and the Launch Template specifes an AMI. If an AMI is specified in the Launch Template, setting `ami` will override the AMI specified in the Launch Template.
+* `associate_public_ip_address` - (Optional) Whether to associate a public IP address with an instance in a VPC.
+* `availability_zone` - (Optional) AZ to start the instance in.
+
+* `capacity_reservation_specification` - (Optional) Describes an instance's Capacity Reservation targeting option. See [Capacity Reservation Specification](#capacity-reservation-specification) below for more details.
+
+-> **NOTE:** Changing `cpu_core_count` and/or `cpu_threads_per_core` will cause the resource to be destroyed and re-created.
+
+* `cpu_core_count` - (Optional, **Deprecated** use the `cpu_options` argument instead) Sets the number of CPU cores for an instance. This option is only supported on creation of instance type that support CPU Options [CPU Cores and Threads Per CPU Core Per Instance Type](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-optimize-cpu.html#cpu-options-supported-instances-values) - specifying this option for unsupported instance types will return an error from the EC2 API.
+* `cpu_options` - (Optional) The CPU options for the instance. See [CPU Options](#cpu-options) below for more details.
+* `cpu_threads_per_core` - (Optional - has no effect unless `cpu_core_count` is also set, **Deprecated** use the `cpu_options` argument instead)  If set to 1, hyperthreading is disabled on the launched instance. Defaults to 2 if not set. See [Optimizing CPU Options](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-optimize-cpu.html) for more information.
+* `credit_specification` - (Optional) Configuration block for customizing the credit specification of the instance. See [Credit Specification](#credit-specification) below for more details. Terraform will only perform drift detection of its value when present in a configuration. Removing this configuration on existing instances will only stop managing it. It will not change the configuration back to the default for the instance type.
+* `disable_api_stop` - (Optional) If true, enables [EC2 Instance Stop Protection](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Stop_Start.html#Using_StopProtection).
+* `disable_api_termination` - (Optional) If true, enables [EC2 Instance Termination Protection](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/terminating-instances.html#Using_ChangingDisableAPITermination).
+* `ebs_block_device` - (Optional) One or more configuration blocks with additional EBS block devices to attach to the instance. Block device configurations only apply on resource creation. See [Block Devices](#ebs-ephemeral-and-root-block-devices) below for details on attributes and drift detection. When accessing this as an attribute reference, it is a set of objects.
+* `ebs_optimized` - (Optional) If true, the launched EC2 instance will be EBS-optimized. Note that if this is not set on an instance type that is optimized by default then this will show as disabled but if the instance type is optimized by default then there is no need to set this and there is no effect to disabling it. See the [EBS Optimized section](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSOptimized.html) of the AWS User Guide for more information.
+* `enclave_options` - (Optional) Enable Nitro Enclaves on launched instances. See [Enclave Options](#enclave-options) below for more details.
+* `ephemeral_block_device` - (Optional) One or more configuration blocks to customize Ephemeral (also known as "Instance Store") volumes on the instance. See [Block Devices](#ebs-ephemeral-and-root-block-devices) below for details. When accessing this as an attribute reference, it is a set of objects.
+* `get_password_data` - (Optional) If true, wait for password data to become available and retrieve it. Useful for getting the administrator password for instances running Microsoft Windows. The password data is exported to the `password_data` attribute. See [GetPasswordData](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_GetPasswordData.html) for more information.
+* `hibernation` - (Optional) If true, the launched EC2 instance will support hibernation.
+* `host_id` - (Optional) ID of a dedicated host that the instance will be assigned to. Use when an instance is to be launched on a specific dedicated host.
+* `host_resource_group_arn` - (Optional) ARN of the host resource group in which to launch the instances. If you specify an ARN, omit the `tenancy` parameter or set it to `host`.
+* `iam_instance_profile` - (Optional) IAM Instance Profile to launch the instance with. Specified as the name of the Instance Profile. Ensure your credentials have the correct permission to assign the instance profile according to the [EC2 documentation](http://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2.html#roles-usingrole-ec2instance-permissions), notably `iam:PassRole`.
+* `instance_initiated_shutdown_behavior` - (Optional) Shutdown behavior for the instance. Amazon defaults this to `stop` for EBS-backed instances and `terminate` for instance-store instances. Cannot be set on instance-store instances. See [Shutdown Behavior](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/terminating-instances.html#Using_ChangingInstanceInitiatedShutdownBehavior) for more information.
+* `instance_market_options` - (Optional) Describes the market (purchasing) option for the instances. See [Market Options](#market-options) below for details on attributes.
+* `instance_type` - (Optional) Instance type to use for the instance. Required unless `launch_template` is specified and the Launch Template specifies an instance type. If an instance type is specified in the Launch Template, setting `instance_type` will override the instance type specified in the Launch Template. Updates to this field will trigger a stop/start of the EC2 instance.
+* `ipv6_address_count`- (Optional) Number of IPv6 addresses to associate with the primary network interface. Amazon EC2 chooses the IPv6 addresses from the range of your subnet.
+* `ipv6_addresses` - (Optional) Specify one or more IPv6 addresses from the range of the subnet to associate with the primary network interface
+* `key_name` - (Optional) Key name of the Key Pair to use for the instance; which can be managed using [the `aws_key_pair` resource](key_pair.html).
+* `launch_template` - (Optional) Specifies a Launch Template to configure the instance. Parameters configured on this resource will override the corresponding parameters in the Launch Template. See [Launch Template Specification](#launch-template-specification) below for more details.
+* `maintenance_options` - (Optional) Maintenance and recovery options for the instance. See [Maintenance Options](#maintenance-options) below for more details.
+* `metadata_options` - (Optional) Customize the metadata options of the instance. See [Metadata Options](#metadata-options) below for more details.
+* `monitoring` - (Optional) If true, the launched EC2 instance will have detailed monitoring enabled. (Available since v0.6.0)
+* `network_interface` - (Optional) Customize network interfaces to be attached at instance boot time. See [Network Interfaces](#network-interfaces) below for more details.
+* `placement_group` - (Optional) Placement Group to start the instance in.
+* `placement_partition_number` - (Optional) Number of the partition the instance is in. Valid only if [the `aws_placement_group` resource's](placement_group.html) `strategy` argument is set to `"partition"`.
+* `private_dns_name_options` - (Optional) Options for the instance hostname. The default values are inherited from the subnet. See [Private DNS Name Options](#private-dns-name-options) below for more details.
+* `private_ip` - (Optional) Private IP address to associate with the instance in a VPC.
+* `root_block_device` - (Optional) Configuration block to customize details about the root block device of the instance. See [Block Devices](#ebs-ephemeral-and-root-block-devices) below for details. When accessing this as an attribute reference, it is a list containing one object.
+* `secondary_private_ips` - (Optional) List of secondary private IPv4 addresses to assign to the instance's primary network interface (eth0) in a VPC. Can only be assigned to the primary network interface (eth0) attached at instance creation, not a pre-existing network interface i.e., referenced in a `network_interface` block. Refer to the [Elastic network interfaces documentation](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-eni.html#AvailableIpPerENI) to see the maximum number of private IP addresses allowed per instance type.
+* `security_groups` - (Optional, EC2-Classic and default VPC only) List of security group names to associate with.
+
+-> **NOTE:** If you are creating Instances in a VPC, use `vpc_security_group_ids` instead.
+
+* `source_dest_check` - (Optional) Controls if traffic is routed to the instance when the destination address does not match the instance. Used for NAT or VPNs. Defaults true.
+* `subnet_id` - (Optional) VPC Subnet ID to launch in.
+* `tags` - (Optional) Map of tags to assign to the resource. Note that these tags apply to the instance and not block storage devices. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `tenancy` - (Optional) Tenancy of the instance (if the instance is running in a VPC). An instance with a tenancy of `dedicated` runs on single-tenant hardware. The `host` tenancy is not supported for the import-instance command. Valid values are `default`, `dedicated`, and `host`.
+* `user_data` - (Optional) User data to provide when launching the instance. Do not pass gzip-compressed data via this argument; see `user_data_base64` instead. Updates to this field will trigger a stop/start of the EC2 instance by default. If the `user_data_replace_on_change` is set then updates to this field will trigger a destroy and recreate.
+* `user_data_base64` - (Optional) Can be used instead of `user_data` to pass base64-encoded binary data directly. Use this instead of `user_data` whenever the value is not a valid UTF-8 string. For example, gzip-encoded user data must be base64-encoded and passed via this argument to avoid corruption. Updates to this field will trigger a stop/start of the EC2 instance by default. If the `user_data_replace_on_change` is set then updates to this field will trigger a destroy and recreate.
+* `user_data_replace_on_change` - (Optional) When used in combination with `user_data` or `user_data_base64` will trigger a destroy and recreate when set to `true`. Defaults to `false` if not set.
+* `volume_tags` - (Optional) Map of tags to assign, at instance-creation time, to root and EBS volumes.
+
+~> **NOTE:** Do not use `volume_tags` if you plan to manage block device tags outside the `aws_instance` configuration, such as using `tags` in an [`aws_ebs_volume`](/docs/providers/aws/r/ebs_volume.html) resource attached via [`aws_volume_attachment`](/docs/providers/aws/r/volume_attachment.html). Doing so will result in resource cycling and inconsistent behavior.
+
+* `vpc_security_group_ids` - (Optional, VPC only) List of security group IDs to associate with.
+
+### Capacity Reservation Specification
+
+~> **NOTE:** You can specify only one argument at a time. If you specify both `capacity_reservation_preference` and `capacity_reservation_target`, the request fails. Modifying `capacity_reservation_preference` or `capacity_reservation_target` in this block requires the instance to be in `stopped` state.
+
+Capacity reservation specification can be applied/modified to the EC2 Instance at creation time or when the instance is `stopped`.
+
+The `capacity_reservation_specification` block supports the following:
+
+* `capacity_reservation_preference` - (Optional) Indicates the instance's Capacity Reservation preferences. Can be `"open"` or `"none"`. (Default: `"open"`).
+* `capacity_reservation_target` - (Optional) Information about the target Capacity Reservation. See [Capacity Reservation Target](#capacity-reservation-target) below for more details.
+
+For more information, see the documentation on [Capacity Reservations](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/capacity-reservations-using.html).
+
+### Capacity Reservation Target
+
+~> **NOTE:** Modifying `capacity_reservation_id` in this block requires the instance to be in `stopped` state.
+
+Describes a target Capacity Reservation.
+
+This `capacity_reservation_target` block supports the following:
+
+* `capacity_reservation_id` - (Optional) ID of the Capacity Reservation in which to run the instance.
+* `capacity_reservation_resource_group_arn` - (Optional) ARN of the Capacity Reservation resource group in which to run the instance.
+
+### CPU Options
+
+-> **NOTE:** Changing any of `amd_sev_snp`, `core_count`, `threads_per_core` will cause the resource to be destroyed and re-created.
+
+CPU options apply to the instance at launch time.
+
+The `cpu_options` block supports the following:
+
+* `amd_sev_snp` - (Optional) Indicates whether to enable the instance for AMD SEV-SNP. AMD SEV-SNP is supported with M6a, R6a, and C6a instance types only. Valid values are `enabled` and `disabled`.
+* `core_count` - (Optional) Sets the number of CPU cores for an instance. This option is only supported on creation of instance type that support CPU Options [CPU Cores and Threads Per CPU Core Per Instance Type](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-optimize-cpu.html#cpu-options-supported-instances-values) - specifying this option for unsupported instance types will return an error from the EC2 API.
+* `threads_per_core` - (Optional - has no effect unless `core_count` is also set)  If set to 1, hyperthreading is disabled on the launched instance. Defaults to 2 if not set. See [Optimizing CPU Options](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-optimize-cpu.html) for more information.
+
+For more information, see the documentation on [Optimizing CPU options](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-optimize-cpu.html).
+
+### Credit Specification
+
+The `credit_specification` block supports the following:
+
+* `cpu_credits` - (Optional) Credit option for CPU usage. Valid values include `standard` or `unlimited`. T3 instances are launched as unlimited by default. T2 instances are launched as standard by default.
+
+### EBS, Ephemeral, and Root Block Devices
+
+Each of the `*_block_device` attributes control a portion of the EC2 Instance's "Block Device Mapping". For more information, see the [AWS Block Device Mapping documentation](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/block-device-mapping-concepts.html).
+
+The `root_block_device` block supports the following:
+
+* `delete_on_termination` - (Optional) Whether the volume should be destroyed on instance termination. Defaults to `true`.
+* `encrypted` - (Optional) Whether to enable volume encryption. Defaults to `false`. Must be configured to perform drift detection.
+* `iops` - (Optional) Amount of provisioned [IOPS](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-io-characteristics.html). Only valid for volume_type of `io1`, `io2` or `gp3`.
+* `kms_key_id` - (Optional) Amazon Resource Name (ARN) of the KMS Key to use when encrypting the volume. Must be configured to perform drift detection.
+* `tags` - (Optional) Map of tags to assign to the device.
+* `throughput` - (Optional) Throughput to provision for a volume in mebibytes per second (MiB/s). This is only valid for `volume_type` of `gp3`.
+* `volume_size` - (Optional) Size of the volume in gibibytes (GiB).
+* `volume_type` - (Optional) Type of volume. Valid values include `standard`, `gp2`, `gp3`, `io1`, `io2`, `sc1`, or `st1`. Defaults to the volume type that the AMI uses.
+
+Modifying the `encrypted` or `kms_key_id` settings of the `root_block_device` requires resource replacement.
+
+Each `ebs_block_device` block supports the following:
+
+* `delete_on_termination` - (Optional) Whether the volume should be destroyed on instance termination. Defaults to `true`.
+* `device_name` - (Required) Name of the device to mount.
+* `encrypted` - (Optional) Enables [EBS encryption](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html) on the volume. Defaults to `false`. Cannot be used with `snapshot_id`. Must be configured to perform drift detection.
+* `iops` - (Optional) Amount of provisioned [IOPS](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-io-characteristics.html). Only valid for volume_type of `io1`, `io2` or `gp3`.
+* `kms_key_id` - (Optional) Amazon Resource Name (ARN) of the KMS Key to use when encrypting the volume. Must be configured to perform drift detection.
+* `snapshot_id` - (Optional) Snapshot ID to mount.
+* `tags` - (Optional) Map of tags to assign to the device.
+* `throughput` - (Optional) Throughput to provision for a volume in mebibytes per second (MiB/s). This is only valid for `volume_type` of `gp3`.
+* `volume_size` - (Optional) Size of the volume in gibibytes (GiB).
+* `volume_type` - (Optional) Type of volume. Valid values include `standard`, `gp2`, `gp3`, `io1`, `io2`, `sc1`, or `st1`. Defaults to `gp2`.
+
+~> **NOTE:** Currently, changes to the `ebs_block_device` configuration of _existing_ resources cannot be automatically detected by Terraform. To manage changes and attachments of an EBS block to an instance, use the `aws_ebs_volume` and `aws_volume_attachment` resources instead. If you use `ebs_block_device` on an `aws_instance`, Terraform will assume management over the full set of non-root EBS block devices for the instance, treating additional block devices as drift. For this reason, `ebs_block_device` cannot be mixed with external `aws_ebs_volume` and `aws_volume_attachment` resources for a given instance.
+
+Each `ephemeral_block_device` block supports the following:
+
+* `device_name` - Name of the block device to mount on the instance.
+* `no_device` - (Optional) Suppresses the specified device included in the AMI's block device mapping.
+* `virtual_name` - (Optional) [Instance Store Device Name](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/InstanceStorage.html#InstanceStoreDeviceNames) (e.g., `ephemeral0`).
+
+Each AWS Instance type has a different set of Instance Store block devices available for attachment. AWS [publishes a list](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/InstanceStorage.html#StorageOnInstanceTypes) of which ephemeral devices are available on each type. The devices are always identified by the `virtual_name` in the format `ephemeral{0..N}`.
+
+### Enclave Options
+
+-> **NOTE:** Changing `enabled` will cause the resource to be destroyed and re-created.
+
+Enclave options apply to the instance at boot time.
+
+The `enclave_options` block supports the following:
+
+* `enabled` - (Optional) Whether Nitro Enclaves will be enabled on the instance. Defaults to `false`.
+
+For more information, see the documentation on [Nitro Enclaves](https://docs.aws.amazon.com/enclaves/latest/user/nitro-enclave.html).
+
+### Maintenance Options
+
+The `maintenance_options` block supports the following:
+
+* `auto_recovery` - (Optional) Automatic recovery behavior of the Instance. Can be `"default"` or `"disabled"`. See [Recover your instance](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-recover.html) for more details.
+
+### Market Options
+
+The `instance_market_options` block supports the following:
+
+* `market_type` - (Optional) Type of market for the instance. Valid value is `spot`. Defaults to `spot`.
+* `spot_options` - (Optional) Block to configure the options for Spot Instances. See [Spot Options](#spot-options) below for details on attributes.
+
+### Metadata Options
+
+Metadata options can be applied/modified to the EC2 Instance at any time.
+
+The `metadata_options` block supports the following:
+
+* `http_endpoint` - (Optional) Whether the metadata service is available. Valid values include `enabled` or `disabled`. Defaults to `enabled`.
+* `http_protocol_ipv6` - (Optional) Whether the IPv6 endpoint for the instance metadata service is enabled. Defaults to `disabled`.
+* `http_put_response_hop_limit` - (Optional) Desired HTTP PUT response hop limit for instance metadata requests. The larger the number, the further instance metadata requests can travel. Valid values are integer from `1` to `64`. Defaults to `1`.
+* `http_tokens` - (Optional) Whether or not the metadata service requires session tokens, also referred to as _Instance Metadata Service Version 2 (IMDSv2)_. Valid values include `optional` or `required`. Defaults to `optional`.
+* `instance_metadata_tags` - (Optional) Enables or disables access to instance tags from the instance metadata service. Valid values include `enabled` or `disabled`. Defaults to `disabled`.
+
+For more information, see the documentation on the [Instance Metadata Service](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html).
+
+### Network Interfaces
+
+Each of the `network_interface` blocks attach a network interface to an EC2 Instance during boot time. However, because the network interface is attached at boot-time, replacing/modifying the network interface **WILL** trigger a recreation of the EC2 Instance. If you should need at any point to detach/modify/re-attach a network interface to the instance, use the `aws_network_interface` or `aws_network_interface_attachment` resources instead.
+
+The `network_interface` configuration block _does_, however, allow users to supply their own network interface to be used as the default network interface on an EC2 Instance, attached at `eth0`.
+
+Each `network_interface` block supports the following:
+
+* `delete_on_termination` - (Optional) Whether or not to delete the network interface on instance termination. Defaults to `false`. Currently, the only valid value is `false`, as this is only supported when creating new network interfaces when launching an instance.
+* `device_index` - (Required) Integer index of the network interface attachment. Limited by instance type.
+* `network_card_index` - (Optional) Integer index of the network card. Limited by instance type. The default index is `0`.
+* `network_interface_id` - (Required) ID of the network interface to attach.
+
+### Private DNS Name Options
+
+The `private_dns_name_options` block supports the following:
+
+* `enable_resource_name_dns_aaaa_record` - Indicates whether to respond to DNS queries for instance hostnames with DNS AAAA records.
+* `enable_resource_name_dns_a_record` - Indicates whether to respond to DNS queries for instance hostnames with DNS A records.
+* `hostname_type` - Type of hostname for Amazon EC2 instances. For IPv4 only subnets, an instance DNS name must be based on the instance IPv4 address. For IPv6 native subnets, an instance DNS name must be based on the instance ID. For dual-stack subnets, you can specify whether DNS names use the instance IPv4 address or the instance ID. Valid values: `ip-name` and `resource-name`.
+
+### Spot Options
+
+The `spot_options` block supports the following:
+
+* `instance_interruption_behavior` - (Optional) The behavior when a Spot Instance is interrupted. Valid values include `hibernate`, `stop`, `terminate` . The default is `terminate`.
+* `max_price` - (Optional) The maximum hourly price that you're willing to pay for a Spot Instance.
+* `spot_instance_type` - (Optional) The Spot Instance request type. Valid values include `one-time`, `persistent`. Persistent Spot Instance requests are only supported when the instance interruption behavior is either hibernate or stop. The default is `one-time`.
+* `valid_until` - (Optional) The end date of the request, in UTC format (YYYY-MM-DDTHH:MM:SSZ). Supported only for persistent requests.
+
+### Launch Template Specification
+
+-> **Note:** Launch Template parameters will be used only once during instance creation. If you want to update existing instance you need to change parameters
+directly. Updating Launch Template specification will force a new instance.
+
+Any other instance parameters that you specify will override the same parameters in the launch template.
+
+The `launch_template` block supports the following:
+
+* `id` - ID of the launch template. Conflicts with `name`.
+* `name` - Name of the launch template. Conflicts with `id`.
+* `version` - Template version. Can be a specific version number, `$Latest` or `$Default`. The default value is `$Default`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the instance.
+* `capacity_reservation_specification` - Capacity reservation specification of the instance.
+* `instance_state` - State of the instance. One of: `pending`, `running`, `shutting-down`, `terminated`, `stopping`, `stopped`. See [Instance Lifecycle](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-lifecycle.html) for more information.
+* `outpost_arn` - ARN of the Outpost the instance is assigned to.
+* `password_data` - Base-64 encoded encrypted password data for the instance. Useful for getting the administrator password for instances running Microsoft Windows. This attribute is only exported if `get_password_data` is true. Note that this encrypted value will be stored in the state file, as with all exported attributes. See [GetPasswordData](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_GetPasswordData.html) for more information.
+* `primary_network_interface_id` - ID of the instance's primary network interface.
+* `private_dns` - Private DNS name assigned to the instance. Can only be used inside the Amazon EC2, and only available if you've enabled DNS hostnames for your VPC.
+* `public_dns` - Public DNS name assigned to the instance. For EC2-VPC, this is only available if you've enabled DNS hostnames for your VPC.
+* `public_ip` - Public IP address assigned to the instance, if applicable. **NOTE**: If you are using an [`aws_eip`](/docs/providers/aws/r/eip.html) with your instance, you should refer to the EIP's address directly and not use `public_ip` as this field will change after the EIP is attached.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+For `ebs_block_device`, in addition to the arguments above, the following attribute is exported:
+
+* `volume_id` - ID of the volume. For example, the ID can be accessed like this, `aws_instance.web.ebs_block_device.2.volume_id`.
+
+For `root_block_device`, in addition to the arguments above, the following attributes are exported:
+
+* `volume_id` - ID of the volume. For example, the ID can be accessed like this, `aws_instance.web.root_block_device.0.volume_id`.
+* `device_name` - Device name, e.g., `/dev/sdh` or `xvdh`.
+
+For `instance_market_options`, in addition to the arguments above, the following attributes are exported:
+
+* `instance_lifecycle` - Indicates whether this is a Spot Instance or a Scheduled Instance.
+* `spot_instance_request_id` - If the request is a Spot Instance request, the ID of the request.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `10m`)
+* `update` - (Default `10m`)
+* `delete` - (Default `20m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import instances using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import instances using the `id`. For example:
+
+```console
+% terraform import aws_instance.web i-12345678
+```
+
+<!-- cache-key: cdktf-0.18.0 input-3c65e83e2786a585ff91f7f409ce62e768ad71e9ab841a301904e25fdc0f6666 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/internet_gateway.html.markdown b/website/docs/cdktf/python/r/internet_gateway.html.markdown
new file mode 100644
index 00000000000..6e326316ecd
--- /dev/null
+++ b/website/docs/cdktf/python/r/internet_gateway.html.markdown
@@ -0,0 +1,103 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_internet_gateway"
+description: |-
+  Provides a resource to create a VPC Internet Gateway.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_internet_gateway
+
+Provides a resource to create a VPC Internet Gateway.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.internet_gateway import InternetGateway
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        InternetGateway(self, "gw",
+            tags={
+                "Name": "main"
+            },
+            vpc_id=main.id
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `vpc_id` - (Optional) The VPC ID to create in.  See the [aws_internet_gateway_attachment](internet_gateway_attachment.html) resource for an alternate way to attach an Internet Gateway to a VPC.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+-> **Note:** It's recommended to denote that the AWS Instance or Elastic IP depends on the Internet Gateway. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.instance import Instance
+from imports.aws.internet_gateway import InternetGateway
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        gw = InternetGateway(self, "gw",
+            vpc_id=main.id
+        )
+        Instance(self, "foo",
+            depends_on=[gw]
+        )
+```
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the Internet Gateway.
+* `arn` - The ARN of the Internet Gateway.
+* `owner_id` - The ID of the AWS account that owns the internet gateway.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `20m`)
+- `update` - (Default `20m`)
+- `delete` - (Default `20m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Internet Gateways using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Internet Gateways using the `id`. For example:
+
+```console
+% terraform import aws_internet_gateway.gw igw-c0a643a9
+```
+
+<!-- cache-key: cdktf-0.18.0 input-81f1e80b898b03aa78644b4608f5a5bf4c569724d3c844941b04df531a254c3a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/internet_gateway_attachment.html.markdown b/website/docs/cdktf/python/r/internet_gateway_attachment.html.markdown
new file mode 100644
index 00000000000..a14719c1e0a
--- /dev/null
+++ b/website/docs/cdktf/python/r/internet_gateway_attachment.html.markdown
@@ -0,0 +1,84 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_internet_gateway_attachment"
+description: |-
+  Provides a resource to create a VPC Internet Gateway Attachment.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_internet_gateway_attachment
+
+Provides a resource to create a VPC Internet Gateway Attachment.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.internet_gateway import InternetGateway
+from imports.aws.internet_gateway_attachment import InternetGatewayAttachment
+from imports.aws.vpc import Vpc
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = InternetGateway(self, "example")
+        aws_vpc_example = Vpc(self, "example_1",
+            cidr_block="10.1.0.0/16"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_vpc_example.override_logical_id("example")
+        aws_internet_gateway_attachment_example = InternetGatewayAttachment(self, "example_2",
+            internet_gateway_id=example.id,
+            vpc_id=Token.as_string(aws_vpc_example.id)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_internet_gateway_attachment_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `internet_gateway_id` - (Required) The ID of the internet gateway.
+* `vpc_id` - (Required) The ID of the VPC.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the VPC and Internet Gateway separated by a colon.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `20m`)
+- `delete` - (Default `20m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Internet Gateway Attachments using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Internet Gateway Attachments using the `id`. For example:
+
+```console
+% terraform import aws_internet_gateway_attachment.example igw-c0a643a9:vpc-123456
+```
+
+<!-- cache-key: cdktf-0.18.0 input-afa0ad650467b8c31da183ec77ac9779b620b292e7a92425cb2b77263075d02d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/internetmonitor_monitor.html.markdown b/website/docs/cdktf/python/r/internetmonitor_monitor.html.markdown
new file mode 100644
index 00000000000..a039d6912a5
--- /dev/null
+++ b/website/docs/cdktf/python/r/internetmonitor_monitor.html.markdown
@@ -0,0 +1,84 @@
+---
+subcategory: "CloudWatch Internet Monitor"
+layout: "aws"
+page_title: "AWS: aws_internetmonitor_monitor"
+description: |-
+  Provides a CloudWatch Internet Monitor Monitor resource
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_internetmonitor_monitor
+
+Provides a Internet Monitor Monitor resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.internetmonitor_monitor import InternetmonitorMonitor
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        InternetmonitorMonitor(self, "example",
+            monitor_name="exmple"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `monitor_name` - (Required) The name of the monitor.
+
+The following arguments are optional:
+
+* `health_events_config` - (Optional) Health event thresholds. A health event threshold percentage, for performance and availability, determines when Internet Monitor creates a health event when there's an internet issue that affects your application end users. See [Health Events Config](#health-events-config) below.
+* `internet_measurements_log_delivery` - (Optional) Publish internet measurements for Internet Monitor to an Amazon S3 bucket in addition to CloudWatch Logs.
+* `max_city_networks_to_monitor` - (Optional) The maximum number of city-networks to monitor for your resources. A city-network is the location (city) where clients access your application resources from and the network or ASN, such as an internet service provider (ISP), that clients access the resources through. This limit helps control billing costs.
+* `resources` - (Optional) The resources to include in a monitor, which you provide as a set of Amazon Resource Names (ARNs).
+* `status` - (Optional) The status for a monitor. The accepted values for Status with the UpdateMonitor API call are the following: `ACTIVE` and `INACTIVE`.
+* `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `traffic_percentage_to_monitor` - (Optional) The percentage of the internet-facing traffic for your application that you want to monitor with this monitor.
+
+### Health Events Config
+
+Defines the health event threshold percentages, for performance score and availability score. Amazon CloudWatch Internet Monitor creates a health event when there's an internet issue that affects your application end users where a health score percentage is at or below a set threshold. If you don't set a health event threshold, the default value is 95%.
+
+* `availability_score_threshold` - (Optional) The health event threshold percentage set for availability scores.
+* `performance_score_threshold` - (Optional) The health event threshold percentage set for performance scores.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Monitor.
+* `id` - Name of the monitor.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Internet Monitor Monitors using the `monitor_name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Internet Monitor Monitors using the `monitor_name`. For example:
+
+```console
+% terraform import aws_internetmonitor_monitor.some some-monitor
+```
+
+<!-- cache-key: cdktf-0.18.0 input-959844264023e663c6657a471798b74c5622af4b37ac96f4fafe7949bc5ed03b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/iot_authorizer.html.markdown b/website/docs/cdktf/python/r/iot_authorizer.html.markdown
new file mode 100644
index 00000000000..8d3e271f45c
--- /dev/null
+++ b/website/docs/cdktf/python/r/iot_authorizer.html.markdown
@@ -0,0 +1,77 @@
+---
+subcategory: "IoT Core"
+layout: "aws"
+page_title: "AWS: aws_iot_authorizer"
+description: |-
+    Creates and manages an AWS IoT Authorizer.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iot_authorizer
+
+Creates and manages an AWS IoT Authorizer.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, Fn, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.iot_authorizer import IotAuthorizer
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        IotAuthorizer(self, "example",
+            authorizer_function_arn=Token.as_string(aws_lambda_function_example.arn),
+            name="example",
+            signing_disabled=False,
+            status="ACTIVE",
+            token_key_name="Token-Header",
+            token_signing_public_keys={
+                "Key1": Token.as_string(
+                    Fn.file("test-fixtures/iot-authorizer-signing-key.pem"))
+            }
+        )
+```
+
+## Argument Reference
+
+* `authorizer_function_arn` - (Required) The ARN of the authorizer's Lambda function.
+* `enable_caching_for_http`  - (Optional) Specifies whether the HTTP caching is enabled or not. Default: `false`.
+* `name` - (Required) The name of the authorizer.
+* `signing_disabled` - (Optional) Specifies whether AWS IoT validates the token signature in an authorization request. Default: `false`.
+* `status` - (Optional) The status of Authorizer request at creation. Valid values: `ACTIVE`, `INACTIVE`. Default: `ACTIVE`.
+* `token_key_name` - (Optional) The name of the token key used to extract the token from the HTTP headers. This value is required if signing is enabled in your authorizer.
+* `token_signing_public_keys` - (Optional) The public keys used to verify the digital signature returned by your custom authentication service. This value is required if signing is enabled in your authorizer.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the authorizer.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IOT Authorizers using the name. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import IOT Authorizers using the name. For example:
+
+```console
+% terraform import aws_iot_authorizer.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-cf8f96f38c8639fbcddf19f56615da17a9607ba975bea77bb2b1ea3d089fe7c3 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/iot_certificate.html.markdown b/website/docs/cdktf/python/r/iot_certificate.html.markdown
new file mode 100644
index 00000000000..d4bfb521063
--- /dev/null
+++ b/website/docs/cdktf/python/r/iot_certificate.html.markdown
@@ -0,0 +1,101 @@
+---
+subcategory: "IoT Core"
+layout: "aws"
+page_title: "AWS: aws_iot_certificate"
+description: |-
+    Creates and manages an AWS IoT certificate.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iot_certificate
+
+Creates and manages an AWS IoT certificate.
+
+## Example Usage
+
+### With CSR
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.iot_certificate import IotCertificate
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        IotCertificate(self, "cert",
+            active=True,
+            csr=Token.as_string(Fn.file("/my/csr.pem"))
+        )
+```
+
+### Without CSR
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.iot_certificate import IotCertificate
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        IotCertificate(self, "cert",
+            active=True
+        )
+```
+
+### From existing certificate without a CA
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.iot_certificate import IotCertificate
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        IotCertificate(self, "cert",
+            active=True,
+            certificate_pem=Token.as_string(Fn.file("/my/cert.pem"))
+        )
+```
+
+## Argument Reference
+
+* `active` - (Required)  Boolean flag to indicate if the certificate should be active
+* `csr` - (Optional) The certificate signing request. Review
+  [CreateCertificateFromCsr](https://docs.aws.amazon.com/iot/latest/apireference/API_CreateCertificateFromCsr.html)
+  for more information on generating a certificate from a certificate signing request (CSR).
+  If none is specified both the certificate and keys will be generated, review [CreateKeysAndCertificate](https://docs.aws.amazon.com/iot/latest/apireference/API_CreateKeysAndCertificate.html)
+  for more information on generating keys and a certificate.
+* `certificate_pem` - (Optional) The certificate to be registered. If `ca_pem` is unspecified, review
+  [RegisterCertificateWithoutCA](https://docs.aws.amazon.com/iot/latest/apireference/API_RegisterCertificateWithoutCA.html).
+  If `ca_pem` is specified, review
+  [RegisterCertificate](https://docs.aws.amazon.com/iot/latest/apireference/API_RegisterCertificate.html)
+  for more information on registering a certificate.
+* `ca_pem` - (Optional) The CA certificate for the certificate to be registered. If this is set, the CA needs to be registered with AWS IoT beforehand.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The internal ID assigned to this certificate.
+* `arn` - The ARN of the created certificate.
+* `certificate_pem` - The certificate data, in PEM format.
+* `public_key` - When neither CSR nor certificate is provided, the public key.
+* `private_key` - When neither CSR nor certificate is provided, the private key.
+
+<!-- cache-key: cdktf-0.18.0 input-18d65d2043d283d5d12c775ce5c1b04cb6470c6818ca20175568246ddcc6c9cd -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/iot_domain_configuration.html.markdown b/website/docs/cdktf/python/r/iot_domain_configuration.html.markdown
new file mode 100644
index 00000000000..89d2352a3f1
--- /dev/null
+++ b/website/docs/cdktf/python/r/iot_domain_configuration.html.markdown
@@ -0,0 +1,85 @@
+---
+subcategory: "IoT Core"
+layout: "aws"
+page_title: "AWS: aws_iot_domain_configuration"
+description: |-
+    Creates and manages an AWS IoT domain configuration.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iot_domain_configuration
+
+Creates and manages an AWS IoT domain configuration.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.iot_domain_configuration import IotDomainConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        IotDomainConfiguration(self, "iot",
+            domain_name="iot.example.com",
+            name="iot-",
+            server_certificate_arns=[cert.arn],
+            service_type="DATA"
+        )
+```
+
+## Argument Reference
+
+* `authorizer_config` - (Optional) An object that specifies the authorization service for a domain. See below.
+* `domain_name` - (Optional) Fully-qualified domain name.
+* `name` - (Required) The name of the domain configuration. This value must be unique to a region.
+* `server_certificate_arns` - (Optional) The ARNs of the certificates that IoT passes to the device during the TLS handshake. Currently you can specify only one certificate ARN. This value is not required for Amazon Web Services-managed domains. When using a custom `domain_name`, the cert must include it.
+* `service_type` - (Optional) The type of service delivered by the endpoint. Note: Amazon Web Services IoT Core currently supports only the `DATA` service type.
+* `tags` - (Optional) Map of tags to assign to this resource. If configured with a provider [`default_tags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `tls_config` - (Optional) An object that specifies the TLS configuration for a domain. See below.
+* `validation_certificate_arn` - (Optional) The certificate used to validate the server certificate and prove domain name ownership. This certificate must be signed by a public certificate authority. This value is not required for Amazon Web Services-managed domains.
+
+### authorizer_config
+
+* `allow_authorizer_override` - (Optional) A Boolean that specifies whether the domain configuration's authorization service can be overridden.
+* `default_authorizer_name` - (Optional) The name of the authorization service for a domain configuration.
+
+### tls_config
+
+* `security_policy` - (Optional) The security policy for a domain configuration.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the domain configuration.
+* `domain_type` - The type of the domain.
+* `id` - The name of the created domain configuration.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IOT domain configurations using the name. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import domain configurations using the name. For example:
+
+```console
+% terraform import aws_iot_domain_configuration.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-2d5835d5848bd62e30c91cc17fabb8e78c6dfcf5b391c5c8303b7743fa49409e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/iot_indexing_configuration.html.markdown b/website/docs/cdktf/python/r/iot_indexing_configuration.html.markdown
new file mode 100644
index 00000000000..7addce01c5e
--- /dev/null
+++ b/website/docs/cdktf/python/r/iot_indexing_configuration.html.markdown
@@ -0,0 +1,98 @@
+---
+subcategory: "IoT Core"
+layout: "aws"
+page_title: "AWS: aws_iot_indexing_configuration"
+description: |-
+    Managing IoT Thing indexing.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iot_indexing_configuration
+
+Managing [IoT Thing indexing](https://docs.aws.amazon.com/iot/latest/developerguide/managing-index.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.iot_indexing_configuration import IotIndexingConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        IotIndexingConfiguration(self, "example",
+            thing_indexing_configuration=IotIndexingConfigurationThingIndexingConfiguration(
+                custom_field=[IotIndexingConfigurationThingIndexingConfigurationCustomField(
+                    name="shadow.desired.power",
+                    type="Boolean"
+                ), IotIndexingConfigurationThingIndexingConfigurationCustomField(
+                    name="attributes.version",
+                    type="Number"
+                ), IotIndexingConfigurationThingIndexingConfigurationCustomField(
+                    name="shadow.name.thing1shadow.desired.DefaultDesired",
+                    type="String"
+                ), IotIndexingConfigurationThingIndexingConfigurationCustomField(
+                    name="deviceDefender.securityProfile1.NUMBER_VALUE_BEHAVIOR.lastViolationValue.number",
+                    type="Number"
+                )
+                ],
+                device_defender_indexing_mode="VIOLATIONS",
+                filter=IotIndexingConfigurationThingIndexingConfigurationFilter(
+                    named_shadow_names=["thing1shadow"]
+                ),
+                named_shadow_indexing_mode="ON",
+                thing_connectivity_indexing_mode="STATUS",
+                thing_indexing_mode="REGISTRY_AND_SHADOW"
+            )
+        )
+```
+
+## Argument Reference
+
+* `thing_group_indexing_configuration` - (Optional) Thing group indexing configuration. See below.
+* `thing_indexing_configuration` - (Optional) Thing indexing configuration. See below.
+
+### thing_group_indexing_configuration
+
+The `thing_group_indexing_configuration` configuration block supports the following:
+
+* `custom_field` - (Optional) A list of thing group fields to index. This list cannot contain any managed fields. See below.
+* `managed_field` - (Optional) Contains fields that are indexed and whose types are already known by the Fleet Indexing service. See below.
+* `thing_group_indexing_mode` - (Required) Thing group indexing mode. Valid values: `OFF`, `ON`.
+
+### thing_indexing_configuration
+
+The `thing_indexing_configuration` configuration block supports the following:
+
+* `custom_field` - (Optional) Contains custom field names and their data type. See below.
+* `device_defender_indexing_mode` - (Optional) Device Defender indexing mode. Valid values: `VIOLATIONS`, `OFF`. Default: `OFF`.
+* `managed_field` - (Optional) Contains fields that are indexed and whose types are already known by the Fleet Indexing service. See below.
+* `named_shadow_indexing_mode` - (Optional) [Named shadow](https://docs.aws.amazon.com/iot/latest/developerguide/iot-device-shadows.html) indexing mode. Valid values: `ON`, `OFF`. Default: `OFF`.
+* `filter` - (Optional) Required if `named_shadow_indexing_mode` is `ON`. Enables to add named shadows filtered by `filter` to fleet indexing configuration.
+* `thing_connectivity_indexing_mode` - (Optional) Thing connectivity indexing mode. Valid values: `STATUS`, `OFF`. Default: `OFF`.
+* `thing_indexing_mode` - (Required) Thing indexing mode. Valid values: `REGISTRY`, `REGISTRY_AND_SHADOW`, `OFF`.
+
+### field
+
+The `custom_field` and `managed_field` configuration blocks supports the following:
+
+* `name` - (Optional) The name of the field.
+* `type` - (Optional) The data type of the field. Valid values: `Number`, `String`, `Boolean`.
+
+### filter
+
+The `filter` configuration block supports the following:
+
+* `named_shadow_names` - (Optional) List of shadow names that you select to index.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+<!-- cache-key: cdktf-0.18.0 input-632e1d902ca26f482ec035558f74be20583a22a0dee9c8e8349d7c76ef519f71 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/iot_logging_options.html.markdown b/website/docs/cdktf/python/r/iot_logging_options.html.markdown
new file mode 100644
index 00000000000..2400a0974f5
--- /dev/null
+++ b/website/docs/cdktf/python/r/iot_logging_options.html.markdown
@@ -0,0 +1,45 @@
+---
+subcategory: "IoT Core"
+layout: "aws"
+page_title: "AWS: aws_iot_logging_options"
+description: |-
+    Provides a resource to manage default logging options.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iot_logging_options
+
+Provides a resource to manage [default logging options](https://docs.aws.amazon.com/iot/latest/developerguide/configure-logging.html#configure-logging-console).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.iot_logging_options import IotLoggingOptions
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        IotLoggingOptions(self, "example",
+            default_log_level="WARN",
+            role_arn=Token.as_string(aws_iam_role_example.arn)
+        )
+```
+
+## Argument Reference
+
+* `default_log_level` - (Optional) The default logging level. Valid Values: `"DEBUG"`, `"INFO"`, `"ERROR"`, `"WARN"`, `"DISABLED"`.
+* `disable_all_logs` - (Optional) If `true` all logs are disabled. The default is `false`.
+* `role_arn` - (Required) The ARN of the role that allows IoT to write to Cloudwatch logs.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+<!-- cache-key: cdktf-0.18.0 input-8b571a8dda736dcc0ea1559b030643ae474e857abed2e70ef420990d6b076aa1 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/iot_policy.html.markdown b/website/docs/cdktf/python/r/iot_policy.html.markdown
new file mode 100644
index 00000000000..56544b48f16
--- /dev/null
+++ b/website/docs/cdktf/python/r/iot_policy.html.markdown
@@ -0,0 +1,79 @@
+---
+subcategory: "IoT Core"
+layout: "aws"
+page_title: "AWS: aws_iot_policy"
+description: |-
+  Provides an IoT policy.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iot_policy
+
+Provides an IoT policy.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.iot_policy import IotPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        IotPolicy(self, "pubsub",
+            name="PubSubToAnyTopic",
+            policy=Token.as_string(
+                Fn.jsonencode({
+                    "Statement": [{
+                        "Action": ["iot:*"],
+                        "Effect": "Allow",
+                        "Resource": "*"
+                    }
+                    ],
+                    "Version": "2012-10-17"
+                }))
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the policy.
+* `policy` - (Required) The policy document. This is a JSON formatted string. Use the [IoT Developer Guide](http://docs.aws.amazon.com/iot/latest/developerguide/iot-policies.html) for more information on IoT Policies. For more information about building AWS IAM policy documents with Terraform, see the [AWS IAM Policy Document Guide](https://learn.hashicorp.com/terraform/aws/iam-policy).
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN assigned by AWS to this policy.
+* `name` - The name of this policy.
+* `default_version_id` - The default version of this policy.
+* `policy` - The policy document.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IoT policies using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import IoT policies using the `name`. For example:
+
+```console
+% terraform import aws_iot_policy.pubsub PubSubToAnyTopic
+```
+
+<!-- cache-key: cdktf-0.18.0 input-aa26a18211ca20b7caee0ba0c439dfec03ce858e13ea7c24d060deccb352d0d2 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/iot_policy_attachment.html.markdown b/website/docs/cdktf/python/r/iot_policy_attachment.html.markdown
new file mode 100644
index 00000000000..13fe3f5e5b3
--- /dev/null
+++ b/website/docs/cdktf/python/r/iot_policy_attachment.html.markdown
@@ -0,0 +1,67 @@
+---
+subcategory: "IoT Core"
+layout: "aws"
+page_title: "AWS: aws_iot_policy_attachment"
+description: |-
+  Provides an IoT policy attachment.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iot_policy_attachment
+
+Provides an IoT policy attachment.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.iot_certificate import IotCertificate
+from imports.aws.iot_policy import IotPolicy
+from imports.aws.iot_policy_attachment import IotPolicyAttachment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        cert = IotCertificate(self, "cert",
+            active=True,
+            csr=Token.as_string(Fn.file("csr.pem"))
+        )
+        pubsub = DataAwsIamPolicyDocument(self, "pubsub",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["iot:*"],
+                effect="Allow",
+                resources=["*"]
+            )
+            ]
+        )
+        aws_iot_policy_pubsub = IotPolicy(self, "pubsub_2",
+            name="PubSubToAnyTopic",
+            policy=Token.as_string(pubsub.json)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iot_policy_pubsub.override_logical_id("pubsub")
+        IotPolicyAttachment(self, "att",
+            policy=Token.as_string(aws_iot_policy_pubsub.name),
+            target=cert.arn
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `policy` - (Required) The name of the policy to attach.
+* `target` - (Required) The identity to which the policy is attached.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+<!-- cache-key: cdktf-0.18.0 input-a5726ca95eb3899fc8547f4e9540090bfecb315bb5fb71039782d36fac25dc91 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/iot_provisioning_template.html.markdown b/website/docs/cdktf/python/r/iot_provisioning_template.html.markdown
new file mode 100644
index 00000000000..5117caaaba1
--- /dev/null
+++ b/website/docs/cdktf/python/r/iot_provisioning_template.html.markdown
@@ -0,0 +1,146 @@
+---
+subcategory: "IoT Core"
+layout: "aws"
+page_title: "AWS: aws_iot_provisioning_template"
+description: |-
+    Manages an IoT fleet provisioning template.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iot_provisioning_template
+
+Manages an IoT fleet provisioning template. For more info, see the AWS documentation on [fleet provisioning](https://docs.aws.amazon.com/iot/latest/developerguide/provision-wo-cert.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, Fn, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.iam_role import IamRole
+from imports.aws.iam_role_policy_attachment import IamRolePolicyAttachment
+from imports.aws.iot_policy import IotPolicy
+from imports.aws.iot_provisioning_template import IotProvisioningTemplate
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        device_policy = DataAwsIamPolicyDocument(self, "device_policy",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["iot:Subscribe"],
+                resources=["*"]
+            )
+            ]
+        )
+        iot_assume_role_policy = DataAwsIamPolicyDocument(self, "iot_assume_role_policy",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["sts:AssumeRole"],
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["iot.amazonaws.com"],
+                    type="Service"
+                )
+                ]
+            )
+            ]
+        )
+        iot_fleet_provisioning = IamRole(self, "iot_fleet_provisioning",
+            assume_role_policy=Token.as_string(iot_assume_role_policy.json),
+            name="IoTProvisioningServiceRole",
+            path="/service-role/"
+        )
+        IamRolePolicyAttachment(self, "iot_fleet_provisioning_registration",
+            policy_arn="arn:aws:iam::aws:policy/service-role/AWSIoTThingsRegistration",
+            role=iot_fleet_provisioning.name
+        )
+        aws_iot_policy_device_policy = IotPolicy(self, "device_policy_4",
+            name="DevicePolicy",
+            policy=Token.as_string(device_policy.json)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iot_policy_device_policy.override_logical_id("device_policy")
+        IotProvisioningTemplate(self, "fleet",
+            description="My provisioning template",
+            enabled=True,
+            name="FleetTemplate",
+            provisioning_role_arn=iot_fleet_provisioning.arn,
+            template_body=Token.as_string(
+                Fn.jsonencode({
+                    "Parameters": {
+                        "SerialNumber": {
+                            "Type": "String"
+                        }
+                    },
+                    "Resources": {
+                        "certificate": {
+                            "Properties": {
+                                "CertificateId": {
+                                    "Ref": "AWS::IoT::Certificate::Id"
+                                },
+                                "Status": "Active"
+                            },
+                            "Type": "AWS::IoT::Certificate"
+                        },
+                        "policy": {
+                            "Properties": {
+                                "PolicyName": aws_iot_policy_device_policy.name
+                            },
+                            "Type": "AWS::IoT::Policy"
+                        }
+                    }
+                }))
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the fleet provisioning template.
+* `description` - (Optional) The description of the fleet provisioning template.
+* `enabled` - (Optional) True to enable the fleet provisioning template, otherwise false.
+* `pre_provisioning_hook` - (Optional) Creates a pre-provisioning hook template. Details below.
+* `provisioning_role_arn` - (Required) The role ARN for the role associated with the fleet provisioning template. This IoT role grants permission to provision a device.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `template_body` - (Required) The JSON formatted contents of the fleet provisioning template.
+* `type` - (Optional) The type you define in a provisioning template.
+
+### pre_provisioning_hook
+
+The `pre_provisioning_hook` configuration block supports the following:
+
+* `payload_version` - (Optional) The version of the payload that was sent to the target function. The only valid (and the default) payload version is `"2020-04-01"`.
+* `target_arn` - (Optional) The ARN of the target function.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN that identifies the provisioning template.
+* `default_version_id` - The default version of the fleet provisioning template.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IoT fleet provisioning templates using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import IoT fleet provisioning templates using the `name`. For example:
+
+```console
+% terraform import aws_iot_provisioning_template.fleet FleetProvisioningTemplate
+```
+
+<!-- cache-key: cdktf-0.18.0 input-0caa47853f782deb3ce1c0adf39db30dd119e9251e987dbe84f960ceed581db6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/iot_role_alias.html.markdown b/website/docs/cdktf/python/r/iot_role_alias.html.markdown
new file mode 100644
index 00000000000..3fc20a182b2
--- /dev/null
+++ b/website/docs/cdktf/python/r/iot_role_alias.html.markdown
@@ -0,0 +1,83 @@
+---
+subcategory: "IoT Core"
+layout: "aws"
+page_title: "AWS: aws_iot_role_alias"
+description: |-
+  Provides an IoT role alias.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iot_role_alias
+
+Provides an IoT role alias.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.iam_role import IamRole
+from imports.aws.iot_role_alias import IotRoleAlias
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        assume_role = DataAwsIamPolicyDocument(self, "assume_role",
+            actions=["sts:AssumeRole"],
+            effect="Allow",
+            principals=[{
+                "identifiers": ["credentials.iot.amazonaws.com"],
+                "type": "Service"
+            }
+            ]
+        )
+        role = IamRole(self, "role",
+            assume_role_policy=Token.as_string(assume_role.json),
+            name="dynamodb-access-role"
+        )
+        IotRoleAlias(self, "alias",
+            alias="Thermostat-dynamodb-access-role-alias",
+            role_arn=role.arn
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `alias` - (Required) The name of the role alias.
+* `role_arn` - (Required) The identity of the role to which the alias refers.
+* `credential_duration` - (Optional) The duration of the credential, in seconds. If you do not specify a value for this setting, the default maximum of one hour is applied. This setting can have a value from 900 seconds (15 minutes) to 43200 seconds (12 hours).
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN assigned by AWS to this role alias.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IOT Role Alias using the alias. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import IOT Role Alias using the alias. For example:
+
+```console
+% terraform import aws_iot_role_alias.example myalias
+```
+
+<!-- cache-key: cdktf-0.18.0 input-0e141253bdc6f9dae9ea2a1248664027fe4a5da717a05f264db046de823136f7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/iot_thing.html.markdown b/website/docs/cdktf/python/r/iot_thing.html.markdown
new file mode 100644
index 00000000000..f147c66d084
--- /dev/null
+++ b/website/docs/cdktf/python/r/iot_thing.html.markdown
@@ -0,0 +1,70 @@
+---
+subcategory: "IoT Core"
+layout: "aws"
+page_title: "AWS: aws_iot_thing"
+description: |-
+    Creates and manages an AWS IoT Thing.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iot_thing
+
+Creates and manages an AWS IoT Thing.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.iot_thing import IotThing
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        IotThing(self, "example",
+            attributes={
+                "First": "examplevalue"
+            },
+            name="example"
+        )
+```
+
+## Argument Reference
+
+* `name` - (Required) The name of the thing.
+* `attributes` - (Optional) Map of attributes of the thing.
+* `thing_type_name` - (Optional) The thing type name.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `default_client_id` - The default client ID.
+* `version` - The current version of the thing record in the registry.
+* `arn` - The ARN of the thing.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IOT Things using the name. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import IOT Things using the name. For example:
+
+```console
+% terraform import aws_iot_thing.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-80ff616de83aba8dd5b8102e42172cd6cc340818bf3135b58cdb41c17424b73b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/iot_thing_group.html.markdown b/website/docs/cdktf/python/r/iot_thing_group.html.markdown
new file mode 100644
index 00000000000..082d1e0b869
--- /dev/null
+++ b/website/docs/cdktf/python/r/iot_thing_group.html.markdown
@@ -0,0 +1,93 @@
+---
+subcategory: "IoT Core"
+layout: "aws"
+page_title: "AWS: aws_iot_thing_group"
+description: |-
+    Manages an AWS IoT Thing Group.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iot_thing_group
+
+Manages an AWS IoT Thing Group.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.iot_thing_group import IotThingGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        parent = IotThingGroup(self, "parent",
+            name="parent"
+        )
+        IotThingGroup(self, "example",
+            name="example",
+            parent_group_name=parent.name,
+            properties=IotThingGroupProperties(
+                attribute_payload=IotThingGroupPropertiesAttributePayload(
+                    attributes={
+                        "One": "11111",
+                        "Two": "TwoTwo"
+                    }
+                ),
+                description="This is my thing group"
+            ),
+            tags={
+                "terraform": "true"
+            }
+        )
+```
+
+## Argument Reference
+
+* `name` - (Required) The name of the Thing Group.
+* `parent_group_name` - (Optional) The name of the parent Thing Group.
+* `properties` - (Optional) The Thing Group properties. Defined below.
+* `tags` - (Optional) Key-value mapping of resource tags
+
+### properties Reference
+
+* `attribute_payload` - (Optional) The Thing Group attributes. Defined below.
+* `description` - (Optional) A description of the Thing Group.
+
+### attribute_payload Reference
+
+* `attributes` - (Optional) Key-value map.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the Thing Group.
+* `id` - The Thing Group ID.
+* `version` - The current version of the Thing Group record in the registry.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IoT Things Groups using the name. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import IoT Things Groups using the name. For example:
+
+```console
+% terraform import aws_iot_thing_group.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-d40a8b9d3295130dee82fc924f5a78064a2bcbc1d9fdc3faf7a58c297c82b090 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/iot_thing_group_membership.html.markdown b/website/docs/cdktf/python/r/iot_thing_group_membership.html.markdown
new file mode 100644
index 00000000000..fc42189d59b
--- /dev/null
+++ b/website/docs/cdktf/python/r/iot_thing_group_membership.html.markdown
@@ -0,0 +1,67 @@
+---
+subcategory: "IoT Core"
+layout: "aws"
+page_title: "AWS: aws_iot_thing_group_membership"
+description: |-
+    Adds an IoT Thing to an IoT Thing Group.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iot_thing_group_membership
+
+Adds an IoT Thing to an IoT Thing Group.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.iot_thing_group_membership import IotThingGroupMembership
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        IotThingGroupMembership(self, "example",
+            override_dynamic_group=True,
+            thing_group_name="example-group",
+            thing_name="example-thing"
+        )
+```
+
+## Argument Reference
+
+* `thing_name` - (Required) The name of the thing to add to a group.
+* `thing_group_name` - (Required) The name of the group to which you are adding a thing.
+* `override_dynamic_group` - (Optional) Override dynamic thing groups with static thing groups when 10-group limit is reached. If a thing belongs to 10 thing groups, and one or more of those groups are dynamic thing groups, adding a thing to a static group removes the thing from the last dynamic group.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The membership ID.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IoT Thing Group Membership using the thing group name and thing name. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import IoT Thing Group Membership using the thing group name and thing name. For example:
+
+```console
+% terraform import aws_iot_thing_group_membership.example thing_group_name/thing_name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ad3a10105917dc5ba26af081c3974b83c7083d781b1a90314ae4c28a7e5779f5 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/iot_thing_principal_attachment.html.markdown b/website/docs/cdktf/python/r/iot_thing_principal_attachment.html.markdown
new file mode 100644
index 00000000000..41d91ac9006
--- /dev/null
+++ b/website/docs/cdktf/python/r/iot_thing_principal_attachment.html.markdown
@@ -0,0 +1,53 @@
+---
+subcategory: "IoT Core"
+layout: "aws"
+page_title: "AWS: aws_iot_thing_principal_attachment"
+description: |-
+    Provides AWS IoT Thing Principal attachment.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iot_thing_principal_attachment
+
+Attaches Principal to AWS IoT Thing.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.iot_certificate import IotCertificate
+from imports.aws.iot_thing import IotThing
+from imports.aws.iot_thing_principal_attachment import IotThingPrincipalAttachment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        cert = IotCertificate(self, "cert",
+            active=True,
+            csr=Token.as_string(Fn.file("csr.pem"))
+        )
+        example = IotThing(self, "example",
+            name="example"
+        )
+        IotThingPrincipalAttachment(self, "att",
+            principal=cert.arn,
+            thing=example.name
+        )
+```
+
+## Argument Reference
+
+* `principal` - (Required) The AWS IoT Certificate ARN or Amazon Cognito Identity ID.
+* `thing` - (Required) The name of the thing.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+<!-- cache-key: cdktf-0.18.0 input-c6b7343797508d980834fbffd7cd03e2ab8c65b3b6b1f437fd026a32bf4c5c8e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/iot_thing_type.html.markdown b/website/docs/cdktf/python/r/iot_thing_type.html.markdown
new file mode 100644
index 00000000000..bf3fd97b78f
--- /dev/null
+++ b/website/docs/cdktf/python/r/iot_thing_type.html.markdown
@@ -0,0 +1,69 @@
+---
+subcategory: "IoT Core"
+layout: "aws"
+page_title: "AWS: aws_iot_thing_type"
+description: |-
+    Creates and manages an AWS IoT Thing Type.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iot_thing_type
+
+Creates and manages an AWS IoT Thing Type.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.iot_thing_type import IotThingType
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        IotThingType(self, "foo",
+            name="my_iot_thing"
+        )
+```
+
+## Argument Reference
+
+* `name` - (Required, Forces New Resource) The name of the thing type.
+* `deprecated` - (Optional, Defaults to false) Whether the thing type is deprecated. If true, no new things could be associated with this type.
+* `properties` - (Optional), Configuration block that can contain the following properties of the thing type:
+    * `description` - (Optional, Forces New Resource) The description of the thing type.
+    * `searchable_attributes` - (Optional, Forces New Resource) A list of searchable thing attribute names.
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the created AWS IoT Thing Type.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IOT Thing Types using the name. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import IOT Thing Types using the name. For example:
+
+```console
+% terraform import aws_iot_thing_type.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-f6bb5e58ad214ec278c62df3ca0c39674a3e3f822552368c4b48cf6dedb96258 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/iot_topic_rule.html.markdown b/website/docs/cdktf/python/r/iot_topic_rule.html.markdown
new file mode 100644
index 00000000000..0427c8bc15d
--- /dev/null
+++ b/website/docs/cdktf/python/r/iot_topic_rule.html.markdown
@@ -0,0 +1,267 @@
+---
+subcategory: "IoT Core"
+layout: "aws"
+page_title: "AWS: aws_iot_topic_rule"
+description: |-
+    Creates and manages an AWS IoT topic rule
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iot_topic_rule
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.iam_role import IamRole
+from imports.aws.iam_role_policy import IamRolePolicy
+from imports.aws.iot_topic_rule import IotTopicRule
+from imports.aws.sns_topic import SnsTopic
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        myerrortopic = SnsTopic(self, "myerrortopic",
+            name="myerrortopic"
+        )
+        mytopic = SnsTopic(self, "mytopic",
+            name="mytopic"
+        )
+        assume_role = DataAwsIamPolicyDocument(self, "assume_role",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["sts:AssumeRole"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["iot.amazonaws.com"],
+                    type="Service"
+                )
+                ]
+            )
+            ]
+        )
+        iam_policy_for_lambda = DataAwsIamPolicyDocument(self, "iam_policy_for_lambda",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["sns:Publish"],
+                effect="Allow",
+                resources=[mytopic.arn]
+            )
+            ]
+        )
+        role = IamRole(self, "role",
+            assume_role_policy=Token.as_string(assume_role.json),
+            name="myrole"
+        )
+        aws_iam_role_policy_iam_policy_for_lambda = IamRolePolicy(self, "iam_policy_for_lambda_5",
+            name="mypolicy",
+            policy=Token.as_string(iam_policy_for_lambda.json),
+            role=role.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_role_policy_iam_policy_for_lambda.override_logical_id("iam_policy_for_lambda")
+        IotTopicRule(self, "rule",
+            description="Example rule",
+            enabled=True,
+            error_action=IotTopicRuleErrorAction(
+                sns=IotTopicRuleErrorActionSns(
+                    message_format="RAW",
+                    role_arn=role.arn,
+                    target_arn=myerrortopic.arn
+                )
+            ),
+            name="MyRule",
+            sns=[IotTopicRuleSns(
+                message_format="RAW",
+                role_arn=role.arn,
+                target_arn=mytopic.arn
+            )
+            ],
+            sql="SELECT * FROM 'topic/test'",
+            sql_version="2016-03-23"
+        )
+```
+
+## Argument Reference
+
+* `name` - (Required) The name of the rule.
+* `description` - (Optional) The description of the rule.
+* `enabled` - (Required) Specifies whether the rule is enabled.
+* `sql` - (Required) The SQL statement used to query the topic. For more information, see AWS IoT SQL Reference (http://docs.aws.amazon.com/iot/latest/developerguide/iot-rules.html#aws-iot-sql-reference) in the AWS IoT Developer Guide.
+* `sql_version` - (Required) The version of the SQL rules engine to use when evaluating the rule.
+* `error_action` - (Optional) Configuration block with error action to be associated with the rule. See the documentation for `cloudwatch_alarm`, `cloudwatch_logs`, `cloudwatch_metric`, `dynamodb`, `dynamodbv2`, `elasticsearch`, `firehose`, `http`, `iot_analytics`, `iot_events`, `kafka`, `kinesis`, `lambda`, `republish`, `s3`, `sns`, `sqs`, `step_functions`, `timestream` configuration blocks for further configuration details.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+The `cloudwatch_alarm` object takes the following arguments:
+
+* `alarm_name` - (Required) The CloudWatch alarm name.
+* `role_arn` - (Required) The IAM role ARN that allows access to the CloudWatch alarm.
+* `state_reason` - (Required) The reason for the alarm change.
+* `state_value` - (Required) The value of the alarm state. Acceptable values are: OK, ALARM, INSUFFICIENT_DATA.
+
+The `cloudwatch_logs` object takes the following arguments:
+
+* `log_group_name` - (Required) The CloudWatch log group name.
+* `role_arn` - (Required) The IAM role ARN that allows access to the CloudWatch alarm.
+
+The `cloudwatch_metric` object takes the following arguments:
+
+* `metric_name` - (Required) The CloudWatch metric name.
+* `metric_namespace` - (Required) The CloudWatch metric namespace name.
+* `metric_timestamp` - (Optional) An optional Unix timestamp (http://docs.aws.amazon.com/AmazonCloudWatch/latest/DeveloperGuide/cloudwatch_concepts.html#about_timestamp).
+* `metric_unit` - (Required) The metric unit (supported units can be found here: http://docs.aws.amazon.com/AmazonCloudWatch/latest/DeveloperGuide/cloudwatch_concepts.html#Unit)
+* `metric_value` - (Required) The CloudWatch metric value.
+* `role_arn` - (Required) The IAM role ARN that allows access to the CloudWatch metric.
+
+The `dynamodb` object takes the following arguments:
+
+* `hash_key_field` - (Required) The hash key name.
+* `hash_key_type` - (Optional) The hash key type. Valid values are "STRING" or "NUMBER".
+* `hash_key_value` - (Required) The hash key value.
+* `payload_field` - (Optional) The action payload.
+* `range_key_field` - (Optional) The range key name.
+* `range_key_type` - (Optional) The range key type. Valid values are "STRING" or "NUMBER".
+* `range_key_value` - (Optional) The range key value.
+* `operation` - (Optional) The operation. Valid values are "INSERT", "UPDATE", or "DELETE".
+* `role_arn` - (Required) The ARN of the IAM role that grants access to the DynamoDB table.
+* `table_name` - (Required) The name of the DynamoDB table.
+
+The `dynamodbv2` object takes the following arguments:
+
+* `put_item` - (Required) Configuration block with DynamoDB Table to which the message will be written. Nested arguments below.
+    * `table_name` - (Required) The name of the DynamoDB table.
+* `role_arn` - (Required) The ARN of the IAM role that grants access to the DynamoDB table.
+
+The `elasticsearch` object takes the following arguments:
+
+* `endpoint` - (Required) The endpoint of your Elasticsearch domain.
+* `id` - (Required) The unique identifier for the document you are storing.
+* `index` - (Required) The Elasticsearch index where you want to store your data.
+* `role_arn` - (Required) The IAM role ARN that has access to Elasticsearch.
+* `type` - (Required) The type of document you are storing.
+
+The `firehose` object takes the following arguments:
+
+* `delivery_stream_name` - (Required) The delivery stream name.
+* `role_arn` - (Required) The IAM role ARN that grants access to the Amazon Kinesis Firehose stream.
+* `separator` - (Optional) A character separator that is used to separate records written to the Firehose stream. Valid values are: '\n' (newline), '\t' (tab), '\r\n' (Windows newline), ',' (comma).
+* `batch_mode` - (Optional) The payload that contains a JSON array of records will be sent to Kinesis Firehose via a batch call.
+
+The `http` object takes the following arguments:
+
+* `url` - (Required) The HTTPS URL.
+* `confirmation_url` - (Optional) The HTTPS URL used to verify ownership of `url`.
+* `http_header` - (Optional) Custom HTTP header IoT Core should send. It is possible to define more than one custom header.
+
+The `http_header` object takes the following arguments:
+
+* `key` - (Required) The name of the HTTP header.
+* `value` - (Required) The value of the HTTP header.
+
+The `iot_analytics` object takes the following arguments:
+
+* `channel_name` - (Required) Name of AWS IOT Analytics channel.
+* `role_arn` - (Required) The ARN of the IAM role that grants access.
+* `batch_mode` - (Optional) The payload that contains a JSON array of records will be sent to IoT Analytics via a batch call.
+
+The `iot_events` object takes the following arguments:
+
+* `input_name` - (Required) The name of the AWS IoT Events input.
+* `role_arn` - (Required) The ARN of the IAM role that grants access.
+* `message_id` - (Optional) Use this to ensure that only one input (message) with a given messageId is processed by an AWS IoT Events detector.
+* `batch_mode` - (Optional) The payload that contains a JSON array of records will be sent to IoT Events via a batch call.
+
+The `kafka` object takes the following arguments:
+
+* `client_properties` - (Required) Properties of the Apache Kafka producer client. For more info, see the [AWS documentation](https://docs.aws.amazon.com/iot/latest/developerguide/apache-kafka-rule-action.html).
+* `destination_arn` - (Required) The ARN of Kafka action's VPC [`aws_iot_topic_rule_destination`](iot_topic_rule_destination.html) .
+* `key` - (Optional) The Kafka message key.
+* `partition` - (Optional) The Kafka message partition.
+* `topic` - (Optional) The Kafka topic for messages to be sent to the Kafka broker.
+
+The `kinesis` object takes the following arguments:
+
+* `partition_key` - (Optional) The partition key.
+* `role_arn` - (Required) The ARN of the IAM role that grants access to the Amazon Kinesis stream.
+* `stream_name` - (Required) The name of the Amazon Kinesis stream.
+
+The `lambda` object takes the following arguments:
+
+* `function_arn` - (Required) The ARN of the Lambda function.
+
+The `republish` object takes the following arguments:
+
+* `role_arn` - (Required) The ARN of the IAM role that grants access.
+* `topic` - (Required) The name of the MQTT topic the message should be republished to.
+* `qos` - (Optional) The Quality of Service (QoS) level to use when republishing messages. Valid values are 0 or 1. The default value is 0.
+
+The `s3` object takes the following arguments:
+
+* `bucket_name` - (Required) The Amazon S3 bucket name.
+* `canned_acl` - (Optional) The Amazon S3 canned ACL that controls access to the object identified by the object key. [Valid values](https://docs.aws.amazon.com/AmazonS3/latest/userguide/acl-overview.html#canned-acl).
+* `key` - (Required) The object key.
+* `role_arn` - (Required) The ARN of the IAM role that grants access.
+
+The `sns` object takes the following arguments:
+
+* `message_format` - (Required) The message format of the message to publish. Accepted values are "JSON" and "RAW".
+* `role_arn` - (Required) The ARN of the IAM role that grants access.
+* `target_arn` - (Required) The ARN of the SNS topic.
+
+The `sqs` object takes the following arguments:
+
+* `queue_url` - (Required) The URL of the Amazon SQS queue.
+* `role_arn` - (Required) The ARN of the IAM role that grants access.
+* `use_base64` - (Required) Specifies whether to use Base64 encoding.
+
+The `step_functions` object takes the following arguments:
+
+* `execution_name_prefix` - (Optional) The prefix used to generate, along with a UUID, the unique state machine execution name.
+* `state_machine_name` - (Required) The name of the Step Functions state machine whose execution will be started.
+* `role_arn` - (Required) The ARN of the IAM role that grants access to start execution of the state machine.
+
+The `timestream` object takes the following arguments:
+
+* `database_name` - (Required) The name of an Amazon Timestream database.
+* `dimension` - (Required) Configuration blocks with metadata attributes of the time series that are written in each measure record. Nested arguments below.
+    * `name` - (Required) The metadata dimension name. This is the name of the column in the Amazon Timestream database table record.
+    * `value` - (Required) The value to write in this column of the database record.
+* `role_arn` - (Required) The ARN of the role that grants permission to write to the Amazon Timestream database table.
+* `table_name` - (Required) The name of the database table into which to write the measure records.
+* `timestamp` - (Optional) Configuration block specifying an application-defined value to replace the default value assigned to the Timestream record's timestamp in the time column. Nested arguments below.
+    * `unit` - (Required) The precision of the timestamp value that results from the expression described in value. Valid values: `SECONDS`, `MILLISECONDS`, `MICROSECONDS`, `NANOSECONDS`.
+    * `value` - (Required) An expression that returns a long epoch time value.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name of the topic rule
+* `arn` - The ARN of the topic rule
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IoT Topic Rules using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import IoT Topic Rules using the `name`. For example:
+
+```console
+% terraform import aws_iot_topic_rule.rule <name>
+```
+
+<!-- cache-key: cdktf-0.18.0 input-4cb4989a57838eace08bc0e308834fdac933e38cc0625a3b13f328889b9cc2ff -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/iot_topic_rule_destination.html.markdown b/website/docs/cdktf/python/r/iot_topic_rule_destination.html.markdown
new file mode 100644
index 00000000000..ae9048a8ce5
--- /dev/null
+++ b/website/docs/cdktf/python/r/iot_topic_rule_destination.html.markdown
@@ -0,0 +1,74 @@
+---
+subcategory: "IoT Core"
+layout: "aws"
+page_title: "AWS: aws_iot_topic_rule_destination"
+description: |-
+    Creates and manages an AWS IoT topic rule destination
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iot_topic_rule_destination
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, Fn, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.iot_topic_rule_destination import IotTopicRuleDestination
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        IotTopicRuleDestination(self, "example",
+            vpc_configuration=IotTopicRuleDestinationVpcConfiguration(
+                role_arn=Token.as_string(aws_iam_role_example.arn),
+                security_groups=[Token.as_string(aws_security_group_example.id)],
+                subnet_ids=Token.as_list(Fn.lookup_nested(aws_subnet_example, ["*", "id"])),
+                vpc_id=Token.as_string(aws_vpc_example.id)
+            )
+        )
+```
+
+## Argument Reference
+
+* `enabled` - (Optional) Whether or not to enable the destination. Default: `true`.
+* `vpc_configuration` - (Required) Configuration of the virtual private cloud (VPC) connection. For more info, see the [AWS documentation](https://docs.aws.amazon.com/iot/latest/developerguide/vpc-rule-action.html).
+
+The `vpc_configuration` object takes the following arguments:
+
+* `role_arn` - (Required) The ARN of a role that has permission to create and attach to elastic network interfaces (ENIs).
+* `security_groups` - (Optional) The security groups of the VPC destination.
+* `subnet_ids` - (Required) The subnet IDs of the VPC destination.
+* `vpc_id` - (Required) The ID of the VPC.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the topic rule destination
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IoT topic rule destinations using the `arn`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import IoT topic rule destinations using the `arn`. For example:
+
+```console
+% terraform import aws_iot_topic_rule_destination.example arn:aws:iot:us-west-2:123456789012:ruledestination/vpc/2ce781c8-68a6-4c52-9c62-63fe489ecc60
+```
+
+<!-- cache-key: cdktf-0.18.0 input-84135101ecf33d388c99e663b26ee9c967e1ad73d124159690f4b098fc269b2c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ivs_channel.html.markdown b/website/docs/cdktf/python/r/ivs_channel.html.markdown
new file mode 100644
index 00000000000..affa7e9abcb
--- /dev/null
+++ b/website/docs/cdktf/python/r/ivs_channel.html.markdown
@@ -0,0 +1,83 @@
+---
+subcategory: "IVS (Interactive Video)"
+layout: "aws"
+page_title: "AWS: aws_ivs_channel"
+description: |-
+  Terraform resource for managing an AWS IVS (Interactive Video) Channel.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ivs_channel
+
+Terraform resource for managing an AWS IVS (Interactive Video) Channel.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ivs_channel import IvsChannel
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        IvsChannel(self, "example",
+            name="channel-1"
+        )
+```
+
+## Argument Reference
+
+The following arguments are optional:
+
+* `authorized` - (Optional) If `true`, channel is private (enabled for playback authorization).
+* `latency_mode` - (Optional) Channel latency mode. Valid values: `NORMAL`, `LOW`.
+* `name` - (Optional) Channel name.
+* `recording_configuration_arn` - (Optional) Recording configuration ARN.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `type` - (Optional) Channel type, which determines the allowable resolution and bitrate. Valid values: `STANDARD`, `BASIC`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Channel.
+* `ingest_endpoint` - Channel ingest endpoint, part of the definition of an ingest server, used when setting up streaming software.
+* `playback_url` - Channel playback URL.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://www.terraform.io/docs/configuration/blocks/resources/syntax.html#operation-timeouts):
+
+* `create` - (Default `5m`)
+* `update` - (Default `5m`)
+* `delete` - (Default `5m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IVS (Interactive Video) Channel using the ARN. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import IVS (Interactive Video) Channel using the ARN. For example:
+
+```console
+% terraform import aws_ivs_channel.example arn:aws:ivs:us-west-2:326937407773:channel/0Y1lcs4U7jk5
+```
+
+<!-- cache-key: cdktf-0.18.0 input-027eff160d9ed7f8a55e22eabe213339e7ec60ef328ae2f09043ed6203e4c8ab -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ivs_playback_key_pair.html.markdown b/website/docs/cdktf/python/r/ivs_playback_key_pair.html.markdown
new file mode 100644
index 00000000000..2a6c0f2dac8
--- /dev/null
+++ b/website/docs/cdktf/python/r/ivs_playback_key_pair.html.markdown
@@ -0,0 +1,81 @@
+---
+subcategory: "IVS (Interactive Video)"
+layout: "aws"
+page_title: "AWS: aws_ivs_playback_key_pair"
+description: |-
+  Terraform resource for managing an AWS IVS (Interactive Video) Playback Key Pair.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ivs_playback_key_pair
+
+Terraform resource for managing an AWS IVS (Interactive Video) Playback Key Pair.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ivs_playback_key_pair import IvsPlaybackKeyPair
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        IvsPlaybackKeyPair(self, "example",
+            public_key=Token.as_string(Fn.file("./public-key.pem"))
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `public_key` - (Required) Public portion of a customer-generated key pair. Must be an ECDSA public key in PEM format.
+
+The following arguments are optional:
+
+* `name` - (Optional) Playback Key Pair name.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Playback Key Pair.
+* `fingerprint` - Key-pair identifier.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://www.terraform.io/docs/configuration/blocks/resources/syntax.html#operation-timeouts):
+
+* `create` - (Default `5m`)
+* `delete` - (Default `5m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IVS (Interactive Video) Playback Key Pair using the ARN. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import IVS (Interactive Video) Playback Key Pair using the ARN. For example:
+
+```console
+% terraform import aws_ivs_playback_key_pair.example arn:aws:ivs:us-west-2:326937407773:playback-key/KDJRJNQhiQzA
+```
+
+<!-- cache-key: cdktf-0.18.0 input-7d629869f9647ea4bb2e6762ea0a06ac8cf1d19444905446ee0e3f95d7b62b08 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ivs_recording_configuration.html.markdown b/website/docs/cdktf/python/r/ivs_recording_configuration.html.markdown
new file mode 100644
index 00000000000..2462026d658
--- /dev/null
+++ b/website/docs/cdktf/python/r/ivs_recording_configuration.html.markdown
@@ -0,0 +1,92 @@
+---
+subcategory: "IVS (Interactive Video)"
+layout: "aws"
+page_title: "AWS: aws_ivs_recording_configuration"
+description: |-
+  Terraform resource for managing an AWS IVS (Interactive Video) Recording Configuration.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ivs_recording_configuration
+
+Terraform resource for managing an AWS IVS (Interactive Video) Recording Configuration.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ivs_recording_configuration import IvsRecordingConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        IvsRecordingConfiguration(self, "example",
+            destination_configuration=IvsRecordingConfigurationDestinationConfiguration(
+                s3=IvsRecordingConfigurationDestinationConfigurationS3(
+                    bucket_name="ivs-stream-archive"
+                )
+            ),
+            name="recording_configuration-1"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `destination_configuration` - Object containing destination configuration for where recorded video will be stored.
+    * `s3` - S3 destination configuration where recorded videos will be stored.
+        * `bucket_name` - S3 bucket name where recorded videos will be stored.
+
+The following arguments are optional:
+
+* `name` - (Optional) Recording Configuration name.
+* `recording_reconnect_window_seconds` - (Optional) If a broadcast disconnects and then reconnects within the specified interval, the multiple streams will be considered a single broadcast and merged together.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `thumbnail_configuration` - (Optional) Object containing information to enable/disable the recording of thumbnails for a live session and modify the interval at which thumbnails are generated for the live session.
+    * `recording_mode` - (Optional) Thumbnail recording mode. Valid values: `DISABLED`, `INTERVAL`.
+    * `target_interval_seconds` (Configurable [and required] only if `recording_mode` is `INTERVAL`) - The targeted thumbnail-generation interval in seconds.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Recording Configuration.
+* `state` -  The current state of the Recording Configuration.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://www.terraform.io/docs/configuration/blocks/resources/syntax.html#operation-timeouts):
+
+* `create` - (Default `10m`)
+* `delete` - (Default `10m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IVS (Interactive Video) Recording Configuration using the ARN. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import IVS (Interactive Video) Recording Configuration using the ARN. For example:
+
+```console
+% terraform import aws_ivs_recording_configuration.example arn:aws:ivs:us-west-2:326937407773:recording-configuration/KAk1sHBl2L47
+```
+
+<!-- cache-key: cdktf-0.18.0 input-df7c61620a9731f6911320162a0d1f3273caabbf2762a59eb62c9ab821ea994d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ivschat_logging_configuration.html.markdown b/website/docs/cdktf/python/r/ivschat_logging_configuration.html.markdown
new file mode 100644
index 00000000000..8b8e7f1ed97
--- /dev/null
+++ b/website/docs/cdktf/python/r/ivschat_logging_configuration.html.markdown
@@ -0,0 +1,201 @@
+---
+subcategory: "IVS (Interactive Video) Chat"
+layout: "aws"
+page_title: "AWS: aws_ivschat_logging_configuration"
+description: |-
+  Terraform resource for managing an AWS IVS (Interactive Video) Chat Logging Configuration.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ivschat_logging_configuration
+
+Terraform resource for managing an AWS IVS (Interactive Video) Chat Logging Configuration.
+
+## Example Usage
+
+### Basic Usage - Logging to CloudWatch
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudwatch_log_group import CloudwatchLogGroup
+from imports.aws.ivschat_logging_configuration import IvschatLoggingConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = CloudwatchLogGroup(self, "example")
+        aws_ivschat_logging_configuration_example =
+        IvschatLoggingConfiguration(self, "example_1",
+            destination_configuration=IvschatLoggingConfigurationDestinationConfiguration(
+                cloudwatch_logs=IvschatLoggingConfigurationDestinationConfigurationCloudwatchLogs(
+                    log_group_name=example.name
+                )
+            )
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_ivschat_logging_configuration_example.override_logical_id("example")
+```
+
+### Basic Usage - Logging to Kinesis Firehose with Extended S3
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.iam_role import IamRole
+from imports.aws.ivschat_logging_configuration import IvschatLoggingConfiguration
+from imports.aws.kinesis_firehose_delivery_stream import KinesisFirehoseDeliveryStream
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_acl import S3BucketAcl
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = S3Bucket(self, "example",
+            bucket_prefix="tf-ivschat-logging-bucket"
+        )
+        aws_s3_bucket_acl_example = S3BucketAcl(self, "example_1",
+            acl="private",
+            bucket=example.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_acl_example.override_logical_id("example")
+        assume_role = DataAwsIamPolicyDocument(self, "assume_role",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["sts:AssumeRole"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["firehose.amazonaws.com"],
+                    type="Service"
+                )
+                ]
+            )
+            ]
+        )
+        aws_iam_role_example = IamRole(self, "example_3",
+            assume_role_policy=Token.as_string(assume_role.json),
+            name="firehose_example_role"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_role_example.override_logical_id("example")
+        aws_kinesis_firehose_delivery_stream_example =
+        KinesisFirehoseDeliveryStream(self, "example_4",
+            destination="extended_s3",
+            extended_s3_configuration=KinesisFirehoseDeliveryStreamExtendedS3Configuration(
+                bucket_arn=example.arn,
+                role_arn=Token.as_string(aws_iam_role_example.arn)
+            ),
+            name="terraform-kinesis-firehose-extended-s3-example-stream",
+            tags={
+                "LogDeliveryEnabled": "true"
+            }
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_kinesis_firehose_delivery_stream_example.override_logical_id("example")
+        aws_ivschat_logging_configuration_example =
+        IvschatLoggingConfiguration(self, "example_5",
+            destination_configuration=IvschatLoggingConfigurationDestinationConfiguration(
+                firehose=IvschatLoggingConfigurationDestinationConfigurationFirehose(
+                    delivery_stream_name=Token.as_string(aws_kinesis_firehose_delivery_stream_example.name)
+                )
+            )
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_ivschat_logging_configuration_example.override_logical_id("example")
+```
+
+### Basic Usage - Logging to S3
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ivschat_logging_configuration import IvschatLoggingConfiguration
+from imports.aws.s3_bucket import S3Bucket
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = S3Bucket(self, "example",
+            bucket_name="tf-ivschat-logging",
+            force_destroy=True
+        )
+        aws_ivschat_logging_configuration_example =
+        IvschatLoggingConfiguration(self, "example_1",
+            destination_configuration=IvschatLoggingConfigurationDestinationConfiguration(
+                s3=IvschatLoggingConfigurationDestinationConfigurationS3(
+                    bucket_name=example.id
+                )
+            )
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_ivschat_logging_configuration_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `destination_configuration` - (Required) Object containing destination configuration for where chat activity will be logged. This object must contain exactly one of the following children arguments:
+    * `cloudwatch_logs` - An Amazon CloudWatch Logs destination configuration where chat activity will be logged.
+        * `log_group_name` - Name of the Amazon Cloudwatch Logs destination where chat activity will be logged.
+    * `firehose` - An Amazon Kinesis Data Firehose destination configuration where chat activity will be logged.
+        * `delivery_stream_name` - Name of the Amazon Kinesis Firehose delivery stream where chat activity will be logged.
+    * `s3` - An Amazon S3 destination configuration where chat activity will be logged.
+        * `bucket_name` - Name of the Amazon S3 bucket where chat activity will be logged.
+
+The following arguments are optional:
+
+* `name` - (Optional) Logging Configuration name.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Logging Configuration.
+* `id` - ID of the Logging Configuration.
+* `state` - State of the Logging Configuration.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://www.terraform.io/docs/configuration/blocks/resources/syntax.html#operation-timeouts):
+
+* `create` - (Default `5m`)
+* `update` - (Default `5m`)
+* `delete` - (Default `5m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IVS (Interactive Video) Chat Logging Configuration using the ARN. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import IVS (Interactive Video) Chat Logging Configuration using the ARN. For example:
+
+```console
+% terraform import aws_ivschat_logging_configuration.example arn:aws:ivschat:us-west-2:326937407773:logging-configuration/MMUQc8wcqZmC
+```
+
+<!-- cache-key: cdktf-0.18.0 input-bba8a6a4c3ad40b83127a5d0756507ed6f522126fec6a06bdf49e17484976b8d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ivschat_room.html.markdown b/website/docs/cdktf/python/r/ivschat_room.html.markdown
new file mode 100644
index 00000000000..96f53734a78
--- /dev/null
+++ b/website/docs/cdktf/python/r/ivschat_room.html.markdown
@@ -0,0 +1,136 @@
+---
+subcategory: "IVS (Interactive Video) Chat"
+layout: "aws"
+page_title: "AWS: aws_ivschat_room"
+description: |-
+  Terraform resource for managing an AWS IVS (Interactive Video) Chat Room.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ivschat_room
+
+Terraform resource for managing an AWS IVS (Interactive Video) Chat Room.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ivschat_room import IvschatRoom
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        IvschatRoom(self, "example",
+            name="tf-room"
+        )
+```
+
+## Usage with Logging Configuration to S3 Bucket
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from cdktf import TerraformResourceLifecycle
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ivschat_logging_configuration import IvschatLoggingConfiguration
+from imports.aws.ivschat_room import IvschatRoom
+from imports.aws.s3_bucket import S3Bucket
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = S3Bucket(self, "example",
+            bucket_prefix="tf-ivschat-logging-bucket-",
+            force_destroy=True
+        )
+        aws_ivschat_logging_configuration_example =
+        IvschatLoggingConfiguration(self, "example_1",
+            destination_configuration=IvschatLoggingConfigurationDestinationConfiguration(
+                s3=IvschatLoggingConfigurationDestinationConfigurationS3(
+                    bucket_name=example.id
+                )
+            ),
+            lifecycle=TerraformResourceLifecycle(
+                create_before_destroy=True
+            ),
+            name="tf-ivschat-loggingconfiguration"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_ivschat_logging_configuration_example.override_logical_id("example")
+        aws_ivschat_room_example = IvschatRoom(self, "example_2",
+            logging_configuration_identifiers=[
+                Token.as_string(aws_ivschat_logging_configuration_example.arn)
+            ],
+            name="tf-ivschat-room"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_ivschat_room_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+The following arguments are optional:
+
+* `logging_configuration_identifiers` - (Optional) List of Logging Configuration
+  ARNs to attach to the room.
+* `maximum_message_length` - (Optional) Maximum number of characters in a single
+  message. Messages are expected to be UTF-8 encoded and this limit applies
+  specifically to rune/code-point count, not number of bytes.
+* `maximum_message_rate_per_second` - (Optional) Maximum number of messages per
+  second that can be sent to the room (by all clients).
+* `message_review_handler` - (Optional) Configuration information for optional
+  review of messages.
+    * `fallback_result` - (Optional) The fallback behavior (whether the message
+    is allowed or denied) if the handler does not return a valid response,
+    encounters an error, or times out. Valid values: `ALLOW`, `DENY`.
+    * `uri` - (Optional) ARN of the lambda message review handler function.
+* `name` - (Optional) Room name.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Room.
+* `id` - Room ID
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://www.terraform.io/docs/configuration/blocks/resources/syntax.html#operation-timeouts):
+
+* `create` - (Default `5m`)
+* `update` - (Default `5m`)
+* `delete` - (Default `5m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IVS (Interactive Video) Chat Room using the ARN. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import IVS (Interactive Video) Chat Room using the ARN. For example:
+
+```console
+% terraform import aws_ivschat_room.example arn:aws:ivschat:us-west-2:326937407773:room/GoXEXyB4VwHb
+```
+
+<!-- cache-key: cdktf-0.18.0 input-3fca5b37b7d82ff4310bf108852e9d4ce3f8757446324b2c39d6248a58f1f8e6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/kendra_data_source.html.markdown b/website/docs/cdktf/python/r/kendra_data_source.html.markdown
new file mode 100644
index 00000000000..c0222870d78
--- /dev/null
+++ b/website/docs/cdktf/python/r/kendra_data_source.html.markdown
@@ -0,0 +1,652 @@
+---
+subcategory: "Kendra"
+layout: "aws"
+page_title: "AWS: aws_kendra_data_source"
+description: |-
+  Terraform resource for managing an AWS Kendra Data Source.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_kendra_data_source
+
+Terraform resource for managing an AWS Kendra Data Source.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.kendra_data_source import KendraDataSource
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        KendraDataSource(self, "example",
+            description="example",
+            index_id=Token.as_string(aws_kendra_index_example.id),
+            language_code="en",
+            name="example",
+            tags={
+                "hello": "world"
+            },
+            type="CUSTOM"
+        )
+```
+
+### S3 Connector
+
+#### With Schedule
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.kendra_data_source import KendraDataSource
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        KendraDataSource(self, "example",
+            configuration=KendraDataSourceConfiguration(
+                s3_configuration=KendraDataSourceConfigurationS3Configuration(
+                    bucket_name=Token.as_string(aws_s3_bucket_example.id)
+                )
+            ),
+            index_id=Token.as_string(aws_kendra_index_example.id),
+            name="example",
+            role_arn=Token.as_string(aws_iam_role_example.arn),
+            schedule="cron(9 10 1 * ? *)",
+            type="S3"
+        )
+```
+
+#### With Access Control List
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.kendra_data_source import KendraDataSource
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        KendraDataSource(self, "example",
+            configuration=KendraDataSourceConfiguration(
+                s3_configuration=KendraDataSourceConfigurationS3Configuration(
+                    access_control_list_configuration=KendraDataSourceConfigurationS3ConfigurationAccessControlListConfiguration(
+                        key_path="s3://${" + aws_s3_bucket_example.id + "}/path-1"
+                    ),
+                    bucket_name=Token.as_string(aws_s3_bucket_example.id)
+                )
+            ),
+            index_id=Token.as_string(aws_kendra_index_example.id),
+            name="example",
+            role_arn=Token.as_string(aws_iam_role_example.arn),
+            type="S3"
+        )
+```
+
+#### With Documents Metadata Configuration
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.kendra_data_source import KendraDataSource
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        KendraDataSource(self, "example",
+            configuration=KendraDataSourceConfiguration(
+                s3_configuration=KendraDataSourceConfigurationS3Configuration(
+                    bucket_name=Token.as_string(aws_s3_bucket_example.id),
+                    documents_metadata_configuration=KendraDataSourceConfigurationS3ConfigurationDocumentsMetadataConfiguration(
+                        s3_prefix="example"
+                    ),
+                    exclusion_patterns=["example"],
+                    inclusion_patterns=["hello"],
+                    inclusion_prefixes=["world"]
+                )
+            ),
+            index_id=Token.as_string(aws_kendra_index_example.id),
+            name="example",
+            role_arn=Token.as_string(aws_iam_role_example.arn),
+            type="S3"
+        )
+```
+
+### Web Crawler Connector
+
+#### With Seed URLs
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.kendra_data_source import KendraDataSource
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        KendraDataSource(self, "example",
+            configuration=KendraDataSourceConfiguration(
+                web_crawler_configuration=KendraDataSourceConfigurationWebCrawlerConfiguration(
+                    urls=KendraDataSourceConfigurationWebCrawlerConfigurationUrls(
+                        seed_url_configuration=KendraDataSourceConfigurationWebCrawlerConfigurationUrlsSeedUrlConfiguration(
+                            seed_urls=["REPLACE_WITH_YOUR_URL"]
+                        )
+                    )
+                )
+            ),
+            index_id=Token.as_string(aws_kendra_index_example.id),
+            name="example",
+            role_arn=Token.as_string(aws_iam_role_example.arn),
+            type="WEBCRAWLER"
+        )
+```
+
+#### With Site Maps
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.kendra_data_source import KendraDataSource
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        KendraDataSource(self, "example",
+            configuration=KendraDataSourceConfiguration(
+                web_crawler_configuration=KendraDataSourceConfigurationWebCrawlerConfiguration(
+                    urls=KendraDataSourceConfigurationWebCrawlerConfigurationUrls(
+                        site_maps_configuration=KendraDataSourceConfigurationWebCrawlerConfigurationUrlsSiteMapsConfiguration(
+                            site_maps=["REPLACE_WITH_YOUR_URL"]
+                        )
+                    )
+                )
+            ),
+            index_id=Token.as_string(aws_kendra_index_example.id),
+            name="example",
+            role_arn=Token.as_string(aws_iam_role_example.arn),
+            type="WEBCRAWLER"
+        )
+```
+
+#### With Web Crawler Mode
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.kendra_data_source import KendraDataSource
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        KendraDataSource(self, "example",
+            configuration=KendraDataSourceConfiguration(
+                web_crawler_configuration=KendraDataSourceConfigurationWebCrawlerConfiguration(
+                    urls=KendraDataSourceConfigurationWebCrawlerConfigurationUrls(
+                        seed_url_configuration=KendraDataSourceConfigurationWebCrawlerConfigurationUrlsSeedUrlConfiguration(
+                            seed_urls=["REPLACE_WITH_YOUR_URL"],
+                            web_crawler_mode="SUBDOMAINS"
+                        )
+                    )
+                )
+            ),
+            index_id=Token.as_string(aws_kendra_index_example.id),
+            name="example",
+            role_arn=Token.as_string(aws_iam_role_example.arn),
+            type="WEBCRAWLER"
+        )
+```
+
+#### With Authentication Configuration
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.kendra_data_source import KendraDataSource
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        KendraDataSource(self, "example",
+            configuration=KendraDataSourceConfiguration(
+                web_crawler_configuration=KendraDataSourceConfigurationWebCrawlerConfiguration(
+                    authentication_configuration=KendraDataSourceConfigurationWebCrawlerConfigurationAuthenticationConfiguration(
+                        basic_authentication=[KendraDataSourceConfigurationWebCrawlerConfigurationAuthenticationConfigurationBasicAuthentication(
+                            credentials=Token.as_string(aws_secretsmanager_secret_example.arn),
+                            host="a.example.com",
+                            port=Token.as_number("443")
+                        )
+                        ]
+                    ),
+                    urls=KendraDataSourceConfigurationWebCrawlerConfigurationUrls(
+                        seed_url_configuration=KendraDataSourceConfigurationWebCrawlerConfigurationUrlsSeedUrlConfiguration(
+                            seed_urls=["REPLACE_WITH_YOUR_URL"]
+                        )
+                    )
+                )
+            ),
+            depends_on=[aws_secretsmanager_secret_version_example],
+            index_id=Token.as_string(aws_kendra_index_example.id),
+            name="example",
+            role_arn=Token.as_string(aws_iam_role_example.arn),
+            type="WEBCRAWLER"
+        )
+```
+
+#### With Crawl Depth
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.kendra_data_source import KendraDataSource
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        KendraDataSource(self, "example",
+            configuration=KendraDataSourceConfiguration(
+                web_crawler_configuration=KendraDataSourceConfigurationWebCrawlerConfiguration(
+                    crawl_depth=3,
+                    urls=KendraDataSourceConfigurationWebCrawlerConfigurationUrls(
+                        seed_url_configuration=KendraDataSourceConfigurationWebCrawlerConfigurationUrlsSeedUrlConfiguration(
+                            seed_urls=["REPLACE_WITH_YOUR_URL"]
+                        )
+                    )
+                )
+            ),
+            index_id=Token.as_string(aws_kendra_index_example.id),
+            name="example",
+            role_arn=Token.as_string(aws_iam_role_example.arn),
+            type="WEBCRAWLER"
+        )
+```
+
+#### With Max Links Per Page
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.kendra_data_source import KendraDataSource
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        KendraDataSource(self, "example",
+            configuration=KendraDataSourceConfiguration(
+                web_crawler_configuration=KendraDataSourceConfigurationWebCrawlerConfiguration(
+                    max_links_per_page=100,
+                    urls=KendraDataSourceConfigurationWebCrawlerConfigurationUrls(
+                        seed_url_configuration=KendraDataSourceConfigurationWebCrawlerConfigurationUrlsSeedUrlConfiguration(
+                            seed_urls=["REPLACE_WITH_YOUR_URL"]
+                        )
+                    )
+                )
+            ),
+            index_id=Token.as_string(aws_kendra_index_example.id),
+            name="example",
+            role_arn=Token.as_string(aws_iam_role_example.arn),
+            type="WEBCRAWLER"
+        )
+```
+
+#### With Max Urls Per Minute Crawl Rate
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.kendra_data_source import KendraDataSource
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        KendraDataSource(self, "example",
+            configuration=KendraDataSourceConfiguration(
+                web_crawler_configuration=KendraDataSourceConfigurationWebCrawlerConfiguration(
+                    max_urls_per_minute_crawl_rate=300,
+                    urls=KendraDataSourceConfigurationWebCrawlerConfigurationUrls(
+                        seed_url_configuration=KendraDataSourceConfigurationWebCrawlerConfigurationUrlsSeedUrlConfiguration(
+                            seed_urls=["REPLACE_WITH_YOUR_URL"]
+                        )
+                    )
+                )
+            ),
+            index_id=Token.as_string(aws_kendra_index_example.id),
+            name="example",
+            role_arn=Token.as_string(aws_iam_role_example.arn),
+            type="WEBCRAWLER"
+        )
+```
+
+#### With Proxy Configuration
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.kendra_data_source import KendraDataSource
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        KendraDataSource(self, "example",
+            configuration=KendraDataSourceConfiguration(
+                web_crawler_configuration=KendraDataSourceConfigurationWebCrawlerConfiguration(
+                    proxy_configuration=KendraDataSourceConfigurationWebCrawlerConfigurationProxyConfiguration(
+                        credentials=Token.as_string(aws_secretsmanager_secret_example.arn),
+                        host="a.example.com",
+                        port=Token.as_number("443")
+                    ),
+                    urls=KendraDataSourceConfigurationWebCrawlerConfigurationUrls(
+                        seed_url_configuration=KendraDataSourceConfigurationWebCrawlerConfigurationUrlsSeedUrlConfiguration(
+                            seed_urls=["REPLACE_WITH_YOUR_URL"]
+                        )
+                    )
+                )
+            ),
+            depends_on=[aws_secretsmanager_secret_version_example],
+            index_id=Token.as_string(aws_kendra_index_example.id),
+            name="example",
+            role_arn=Token.as_string(aws_iam_role_example.arn),
+            type="WEBCRAWLER"
+        )
+```
+
+#### With URL Exclusion and Inclusion Patterns
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.kendra_data_source import KendraDataSource
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        KendraDataSource(self, "example",
+            configuration=KendraDataSourceConfiguration(
+                web_crawler_configuration=KendraDataSourceConfigurationWebCrawlerConfiguration(
+                    url_exclusion_patterns=["example"],
+                    url_inclusion_patterns=["hello"],
+                    urls=KendraDataSourceConfigurationWebCrawlerConfigurationUrls(
+                        seed_url_configuration=KendraDataSourceConfigurationWebCrawlerConfigurationUrlsSeedUrlConfiguration(
+                            seed_urls=["REPLACE_WITH_YOUR_URL"]
+                        )
+                    )
+                )
+            ),
+            index_id=Token.as_string(aws_kendra_index_example.id),
+            name="example",
+            role_arn=Token.as_string(aws_iam_role_example.arn),
+            type="WEBCRAWLER"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `index_id` - (Required, Forces new resource) The identifier of the index for your Amazon Kendra data source.
+* `name` - (Required) A name for your data source connector.
+* `role_arn` - (Required, Optional in one scenario) The Amazon Resource Name (ARN) of a role with permission to access the data source connector. For more information, see [IAM roles for Amazon Kendra](https://docs.aws.amazon.com/kendra/latest/dg/iam-roles.html). You can't specify the `role_arn` parameter when the `type` parameter is set to `CUSTOM`. The `role_arn` parameter is required for all other data sources.
+* `type` - (Required, Forces new resource) The type of data source repository. For an updated list of values, refer to [Valid Values for Type](https://docs.aws.amazon.com/kendra/latest/dg/API_CreateDataSource.html#Kendra-CreateDataSource-request-Type).
+
+The following arguments are optional:
+
+* `configuration` - (Optional) A block with the configuration information to connect to your Data Source repository. You can't specify the `configuration` block when the `type` parameter is set to `CUSTOM`. [Detailed below](#configuration-block).
+* `custom_document_enrichment_configuration` - (Optional) A block with the configuration information for altering document metadata and content during the document ingestion process. For more information on how to create, modify and delete document metadata, or make other content alterations when you ingest documents into Amazon Kendra, see [Customizing document metadata during the ingestion process](https://docs.aws.amazon.com/kendra/latest/dg/custom-document-enrichment.html). [Detailed below](#custom_document_enrichment_configuration-block).
+* `description` - (Optional) A description for the Data Source connector.
+* `language_code` - (Optional) The code for a language. This allows you to support a language for all documents when creating the Data Source connector. English is supported by default. For more information on supported languages, including their codes, see [Adding documents in languages other than English](https://docs.aws.amazon.com/kendra/latest/dg/in-adding-languages.html).
+* `schedule` - (Optional) Sets the frequency for Amazon Kendra to check the documents in your Data Source repository and update the index. If you don't set a schedule Amazon Kendra will not periodically update the index. You can call the `StartDataSourceSyncJob` API to update the index.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### configuration Block
+
+The `configuration` configuration block supports the following arguments:
+
+* `s3_configuration` - (Required if `type` is set to `S3`) A block that provides the configuration information to connect to an Amazon S3 bucket as your data source. [Detailed below](#s3_configuration-block).
+* `web_crawler_configuration` - (Required if `type` is set to `WEBCRAWLER`) A block that provides the configuration information required for Amazon Kendra Web Crawler. [Detailed below](#web_crawler_configuration-block).
+
+### s3_configuration Block
+
+The `s3_configuration` configuration block supports the following arguments:
+
+* `access_control_list_configuration` - (Optional) A block that provides the path to the S3 bucket that contains the user context filtering files for the data source. For the format of the file, see [Access control for S3 data sources](https://docs.aws.amazon.com/kendra/latest/dg/s3-acl.html). [Detailed below](#access_control_list_configuration-block).
+* `bucket_name` - (Required) The name of the bucket that contains the documents.
+* `documents_metadata_configuration` - (Optional) A block that defines the Document metadata files that contain information such as the document access control information, source URI, document author, and custom attributes. Each metadata file contains metadata about a single document. [Detailed below](#documents_metadata_configuration-block).
+* `exclusion_patterns` - (Optional) A list of glob patterns for documents that should not be indexed. If a document that matches an inclusion prefix or inclusion pattern also matches an exclusion pattern, the document is not indexed. Refer to [Exclusion Patterns for more examples](https://docs.aws.amazon.com/kendra/latest/dg/API_S3DataSourceConfiguration.html#Kendra-Type-S3DataSourceConfiguration-ExclusionPatterns).
+* `inclusion_patterns` - (Optional) A list of glob patterns for documents that should be indexed. If a document that matches an inclusion pattern also matches an exclusion pattern, the document is not indexed. Refer to [Inclusion Patterns for more examples](https://docs.aws.amazon.com/kendra/latest/dg/API_S3DataSourceConfiguration.html#Kendra-Type-S3DataSourceConfiguration-InclusionPatterns).
+* `inclusion_prefixes` - (Optional) A list of S3 prefixes for the documents that should be included in the index.
+
+### access_control_list_configuration Block
+
+The `access_control_list_configuration` configuration block supports the following arguments:
+
+* `key_path` - (Optional) Path to the AWS S3 bucket that contains the ACL files.
+
+### documents_metadata_configuration Block
+
+The `documents_metadata_configuration` configuration block supports the following arguments:
+
+* `s3_prefix` - (Optional) A prefix used to filter metadata configuration files in the AWS S3 bucket. The S3 bucket might contain multiple metadata files. Use `s3_prefix` to include only the desired metadata files.
+
+### web_crawler_configuration Block
+
+The `web_crawler_configuration` configuration block supports the following arguments:
+
+* `authentication_configuration` - (Optional) A block with the configuration information required to connect to websites using authentication. You can connect to websites using basic authentication of user name and password. You use a secret in AWS Secrets Manager to store your authentication credentials. You must provide the website host name and port number. For example, the host name of `https://a.example.com/page1.html` is `"a.example.com"` and the port is `443`, the standard port for HTTPS. [Detailed below](#authentication_configuration-block).
+* `crawl_depth` - (Optional) Specifies the number of levels in a website that you want to crawl. The first level begins from the website seed or starting point URL. For example, if a website has 3 levels – index level (i.e. seed in this example), sections level, and subsections level – and you are only interested in crawling information up to the sections level (i.e. levels 0-1), you can set your depth to 1. The default crawl depth is set to `2`. Minimum value of `0`. Maximum value of `10`.
+* `max_content_size_per_page_in_mega_bytes` - (Optional) The maximum size (in MB) of a webpage or attachment to crawl. Files larger than this size (in MB) are skipped/not crawled. The default maximum size of a webpage or attachment is set to `50` MB. Minimum value of `1.0e-06`. Maximum value of `50`.
+* `max_links_per_page` - (Optional) The maximum number of URLs on a webpage to include when crawling a website. This number is per webpage. As a website’s webpages are crawled, any URLs the webpages link to are also crawled. URLs on a webpage are crawled in order of appearance. The default maximum links per page is `100`. Minimum value of `1`. Maximum value of `1000`.
+* `max_urls_per_minute_crawl_rate` - (Optional) The maximum number of URLs crawled per website host per minute. The default maximum number of URLs crawled per website host per minute is `300`. Minimum value of `1`. Maximum value of `300`.
+* `proxy_configuration` - (Optional) Configuration information required to connect to your internal websites via a web proxy. You must provide the website host name and port number. For example, the host name of `https://a.example.com/page1.html` is `"a.example.com"` and the port is `443`, the standard port for HTTPS. Web proxy credentials are optional and you can use them to connect to a web proxy server that requires basic authentication. To store web proxy credentials, you use a secret in [AWS Secrets Manager](https://docs.aws.amazon.com/secretsmanager/latest/userguide/intro.html). [Detailed below](#proxy_configuration-block).
+* `url_exclusion_patterns` - (Optional) A list of regular expression patterns to exclude certain URLs to crawl. URLs that match the patterns are excluded from the index. URLs that don't match the patterns are included in the index. If a URL matches both an inclusion and exclusion pattern, the exclusion pattern takes precedence and the URL file isn't included in the index. Array Members: Minimum number of `0` items. Maximum number of `100` items. Length Constraints: Minimum length of `1`. Maximum length of `150`.
+* `url_inclusion_patterns` - (Optional) A list of regular expression patterns to include certain URLs to crawl. URLs that match the patterns are included in the index. URLs that don't match the patterns are excluded from the index. If a URL matches both an inclusion and exclusion pattern, the exclusion pattern takes precedence and the URL file isn't included in the index. Array Members: Minimum number of `0` items. Maximum number of `100` items. Length Constraints: Minimum length of `1`. Maximum length of `150`.
+* `urls` - (Required) A block that specifies the seed or starting point URLs of the websites or the sitemap URLs of the websites you want to crawl. You can include website subdomains. You can list up to `100` seed URLs and up to `3` sitemap URLs. You can only crawl websites that use the secure communication protocol, Hypertext Transfer Protocol Secure (HTTPS). If you receive an error when crawling a website, it could be that the website is blocked from crawling. When selecting websites to index, you must adhere to the [Amazon Acceptable Use Policy](https://aws.amazon.com/aup/) and all other Amazon terms. Remember that you must only use Amazon Kendra Web Crawler to index your own webpages, or webpages that you have authorization to index. [Detailed below](#urls-block).
+
+### authentication_configuration Block
+
+The `authentication_configuration` configuration block supports the following arguments:
+
+* `basic_authentication` - (Optional) The list of configuration information that's required to connect to and crawl a website host using basic authentication credentials. The list includes the name and port number of the website host. [Detailed below](#basic_authentication-block).
+
+### basic_authentication Block
+
+The `basic_authentication` configuration block supports the following arguments:
+
+* `credentials` - (Required) Your secret ARN, which you can create in AWS Secrets Manager. You use a secret if basic authentication credentials are required to connect to a website. The secret stores your credentials of user name and password.
+* `host` - (Required) The name of the website host you want to connect to using authentication credentials. For example, the host name of `https://a.example.com/page1.html` is `"a.example.com"`.
+* `port` - (Required) The port number of the website host you want to connect to using authentication credentials. For example, the port for `https://a.example.com/page1.html` is `443`, the standard port for HTTPS.
+
+### proxy_configuration Block
+
+The `proxy_configuration` configuration block supports the following arguments:
+
+* `credentials` - (Optional) Your secret ARN, which you can create in AWS Secrets Manager. The credentials are optional. You use a secret if web proxy credentials are required to connect to a website host. Amazon Kendra currently support basic authentication to connect to a web proxy server. The secret stores your credentials.
+* `host` - (Required) The name of the website host you want to connect to via a web proxy server. For example, the host name of `https://a.example.com/page1.html` is `"a.example.com"`.
+* `port` - (Required) The port number of the website host you want to connect to via a web proxy server. For example, the port for `https://a.example.com/page1.html` is `443`, the standard port for HTTPS.
+
+### urls Block
+
+The `urls` configuration block supports the following arguments:
+
+* `seed_url_configuration` - (Optional) A block that specifies the configuration of the seed or starting point URLs of the websites you want to crawl. You can choose to crawl only the website host names, or the website host names with subdomains, or the website host names with subdomains and other domains that the webpages link to. You can list up to `100` seed URLs. [Detailed below](#seed_url_configuration-block).
+* `site_maps_configuration` - (Optional) A block that specifies the configuration of the sitemap URLs of the websites you want to crawl. Only URLs belonging to the same website host names are crawled. You can list up to `3` sitemap URLs. [Detailed below](#site_maps_configuration-block).
+
+### seed_url_configuration Block
+
+The `seed_url_configuration` configuration block supports the following arguments:
+
+* `seed_urls` - (Required) The list of seed or starting point URLs of the websites you want to crawl. The list can include a maximum of `100` seed URLs. Array Members: Minimum number of `0` items. Maximum number of `100` items. Length Constraints: Minimum length of `1`. Maximum length of `2048`.
+* `web_crawler_mode` - (Optional) The default mode is set to `HOST_ONLY`. You can choose one of the following modes:
+    * `HOST_ONLY` – crawl only the website host names. For example, if the seed URL is `"abc.example.com"`, then only URLs with host name `"abc.example.com"` are crawled.
+    * `SUBDOMAINS` – crawl the website host names with subdomains. For example, if the seed URL is `"abc.example.com"`, then `"a.abc.example.com"` and `"b.abc.example.com"` are also crawled.
+    * `EVERYTHING` – crawl the website host names with subdomains and other domains that the webpages link to.
+
+### site_maps_configuration Block
+
+The `site_maps_configuration` configuration block supports the following arguments:
+
+* `site_maps` - (Required) The list of sitemap URLs of the websites you want to crawl. The list can include a maximum of `3` sitemap URLs.
+
+### custom_document_enrichment_configuration Block
+
+The `custom_document_enrichment_configuration` configuration block supports the following arguments:
+
+* `inline_configurations` - (Optional) Configuration information to alter document attributes or metadata fields and content when ingesting documents into Amazon Kendra. Minimum number of `0` items. Maximum number of `100` items. [Detailed below](#inline_configurations-block).
+* `post_extraction_hook_configuration` - (Optional) A block that specifies the configuration information for invoking a Lambda function in AWS Lambda on the structured documents with their metadata and text extracted. You can use a Lambda function to apply advanced logic for creating, modifying, or deleting document metadata and content. For more information, see [Advanced data manipulation](https://docs.aws.amazon.com/kendra/latest/dg/custom-document-enrichment.html#advanced-data-manipulation). [Detailed below](#pre_extraction_hook_configuration-and-post_extraction_hook_configuration-blocks).
+* `pre_extraction_hook_configuration` - (Optional) Configuration information for invoking a Lambda function in AWS Lambda on the original or raw documents before extracting their metadata and text. You can use a Lambda function to apply advanced logic for creating, modifying, or deleting document metadata and content. For more information, see [Advanced data manipulation](https://docs.aws.amazon.com/kendra/latest/dg/custom-document-enrichment.html#advanced-data-manipulation). [Detailed below](#pre_extraction_hook_configuration-and-post_extraction_hook_configuration-blocks).
+* `role_arn` - (Optional) The Amazon Resource Name (ARN) of a role with permission to run `pre_extraction_hook_configuration` and `post_extraction_hook_configuration` for altering document metadata and content during the document ingestion process. For more information, see [IAM roles for Amazon Kendra](https://docs.aws.amazon.com/kendra/latest/dg/iam-roles.html).
+
+### inline_configurations Block
+
+The `inline_configurations` configuration block supports the following arguments:
+
+* `condition` - (Optional) Configuration of the condition used for the target document attribute or metadata field when ingesting documents into Amazon Kendra. See [condition](#condition-block).
+* `document_content_deletion` - (Optional) `TRUE` to delete content if the condition used for the target attribute is met.
+* `target` - (Optional) Configuration of the target document attribute or metadata field when ingesting documents into Amazon Kendra. You can also include a value. [Detailed below](#target-block).
+
+### condition Block
+
+The `condition` configuration blocks supports the following arguments:
+
+* `condition_document_attribute_key` - (Required) The identifier of the document attribute used for the condition. For example, `_source_uri` could be an identifier for the attribute or metadata field that contains source URIs associated with the documents. Amazon Kendra currently does not support `_document_body` as an attribute key used for the condition.
+* `condition_on_value` - (Optional) The value used by the operator. For example, you can specify the value 'financial' for strings in the `_source_uri` field that partially match or contain this value. See [condition_on_value](#condition_on_value-block).
+* `operator` - (Required) The condition operator. For example, you can use `Contains` to partially match a string. Valid Values: `GreaterThan` | `GreaterThanOrEquals` | `LessThan` | `LessThanOrEquals` | `Equals` | `NotEquals` | `Contains` | `NotContains` | `Exists` | `NotExists` | `BeginsWith`.
+
+### target Block
+
+The `target` configuration block supports the following arguments:
+
+* `target_document_attribute_key` - (Optional) The identifier of the target document attribute or metadata field. For example, 'Department' could be an identifier for the target attribute or metadata field that includes the department names associated with the documents.
+* `target_document_attribute_value` - (Optional) The target value you want to create for the target attribute. For example, 'Finance' could be the target value for the target attribute key 'Department'. See [target_document_attribute_value](#target_document_attribute_value-block).
+* `target_document_attribute_value_deletion` - (Optional) `TRUE` to delete the existing target value for your specified target attribute key. You cannot create a target value and set this to `TRUE`. To create a target value (`TargetDocumentAttributeValue`), set this to `FALSE`.
+
+### target_document_attribute_value Block
+
+The `target_document_attribute_value` configuration blocks supports the following arguments:
+
+* `date_value` - (Optional) A date expressed as an ISO 8601 string. It is important for the time zone to be included in the ISO 8601 date-time format. As of this writing only UTC is supported. For example, `2012-03-25T12:30:10+00:00`.
+* `long_value` - (Optional) A long integer value.
+* `string_list_value` - (Optional) A list of strings.
+* `string` - (Optional) A string, such as "department".
+
+### pre_extraction_hook_configuration and post_extraction_hook_configuration Blocks
+
+The `pre_extraction_hook_configuration` and `post_extraction_hook_configuration` configuration blocks each supports the following arguments:
+
+* `invocation_condition` - (Optional) A block that specifies the condition used for when a Lambda function should be invoked. For example, you can specify a condition that if there are empty date-time values, then Amazon Kendra should invoke a function that inserts the current date-time. See [invocation_condition](#invocation_condition-block).
+* `lambda_arn` - (Required) The Amazon Resource Name (ARN) of a Lambda Function that can manipulate your document metadata fields or attributes and content.
+* `s3_bucket` - (Required) Stores the original, raw documents or the structured, parsed documents before and after altering them. For more information, see [Data contracts for Lambda functions](https://docs.aws.amazon.com/kendra/latest/dg/custom-document-enrichment.html#cde-data-contracts-lambda).
+
+### invocation_condition Block
+
+The `invocation_condition` configuration blocks supports the following arguments:
+
+* `condition_document_attribute_key` - (Required) The identifier of the document attribute used for the condition. For example, `_source_uri` could be an identifier for the attribute or metadata field that contains source URIs associated with the documents. Amazon Kendra currently does not support `_document_body` as an attribute key used for the condition.
+* `condition_on_value` - (Optional) The value used by the operator. For example, you can specify the value 'financial' for strings in the `_source_uri` field that partially match or contain this value. See [condition_on_value](#condition_on_value-block).
+* `operator` - (Required) The condition operator. For example, you can use `Contains` to partially match a string. Valid Values: `GreaterThan` | `GreaterThanOrEquals` | `LessThan` | `LessThanOrEquals` | `Equals` | `NotEquals` | `Contains` | `NotContains` | `Exists` | `NotExists` | `BeginsWith`.
+
+### condition_on_value Block
+
+The `condition_on_value` configuration blocks supports the following arguments:
+
+* `date_value` - (Optional) A date expressed as an ISO 8601 string. It is important for the time zone to be included in the ISO 8601 date-time format. As of this writing only UTC is supported. For example, `2012-03-25T12:30:10+00:00`.
+* `long_value` - (Optional) A long integer value.
+* `string_list_value` - (Optional) A list of strings.
+* `string` - (Optional) A string, such as "department".
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Data Source.
+* `created_at` - The Unix timestamp of when the Data Source was created.
+* `data_source_id` - The unique identifiers of the Data Source.
+* `error_message` - When the Status field value is `FAILED`, the ErrorMessage field contains a description of the error that caused the Data Source to fail.
+* `id` - The unique identifiers of the Data Source and index separated by a slash (`/`).
+* `status` - The current status of the Data Source. When the status is `ACTIVE` the Data Source is ready to use. When the status is `FAILED`, the `error_message` field contains the reason that the Data Source failed.
+* `updated_at` - The Unix timestamp of when the Data Source was last updated.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `30m`)
+* `update` - (Default `30m`)
+* `delete` - (Default `30m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Kendra Data Source using the unique identifiers of the data_source and index separated by a slash (`/`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Kendra Data Source using the unique identifiers of the data_source and index separated by a slash (`/`). For example:
+
+```console
+% terraform import aws_kendra_data_source.example 1045d08d-66ef-4882-b3ed-dfb7df183e90/b34dfdf7-1f2b-4704-9581-79e00296845f
+```
+
+<!-- cache-key: cdktf-0.18.0 input-3d8d2a0a2fb5b1865ed53ffa27e14132c1841e03d807830e180030cfe38f2630 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/kendra_experience.html.markdown b/website/docs/cdktf/python/r/kendra_experience.html.markdown
new file mode 100644
index 00000000000..1fc36e22f32
--- /dev/null
+++ b/website/docs/cdktf/python/r/kendra_experience.html.markdown
@@ -0,0 +1,125 @@
+---
+subcategory: "Kendra"
+layout: "aws"
+page_title: "AWS: aws_kendra_experience"
+description: |-
+  Terraform resource for managing an AWS Kendra Experience.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_kendra_experience
+
+Terraform resource for managing an AWS Kendra Experience.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.kendra_experience import KendraExperience
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        KendraExperience(self, "example",
+            configuration=KendraExperienceConfiguration(
+                content_source_configuration=KendraExperienceConfigurationContentSourceConfiguration(
+                    direct_put_content=True,
+                    faq_ids=[Token.as_string(aws_kendra_faq_example.faq_id)]
+                ),
+                user_identity_configuration=KendraExperienceConfigurationUserIdentityConfiguration(
+                    identity_attribute_name="12345ec453-1546651e-79c4-4554-91fa-00b43ccfa245"
+                )
+            ),
+            description="My Kendra Experience",
+            index_id=Token.as_string(aws_kendra_index_example.id),
+            name="example",
+            role_arn=Token.as_string(aws_iam_role_example.arn)
+        )
+```
+
+## Argument Reference
+
+~> **NOTE:** By default of the AWS Kendra API, updates to an existing `aws_kendra_experience` resource (e.g. updating the `name`) will also update the `configuration.content_source_configuration.direct_put_content` parameter to `false` if not already provided.
+
+The following arguments are required:
+
+* `index_id` - (Required, Forces new resource) The identifier of the index for your Amazon Kendra experience.
+* `name` - (Required) A name for your Amazon Kendra experience.
+* `role_arn` - (Required) The Amazon Resource Name (ARN) of a role with permission to access `Query API`, `QuerySuggestions API`, `SubmitFeedback API`, and `AWS SSO` that stores your user and group information. For more information, see [IAM roles for Amazon Kendra](https://docs.aws.amazon.com/kendra/latest/dg/iam-roles.html).
+
+The following arguments are optional:
+
+* `description` - (Optional, Forces new resource if removed) A description for your Amazon Kendra experience.
+* `configuration` - (Optional) Configuration information for your Amazon Kendra experience. Terraform will only perform drift detection of its value when present in a configuration. [Detailed below](#configuration).
+
+### `configuration`
+
+~> **NOTE:** By default of the AWS Kendra API, the `content_source_configuration.direct_put_content` parameter will be set to `false` if not provided.  
+
+The `configuration` configuration block supports the following arguments:
+
+* `content_source_configuration` - (Optional, Required if `user_identity_configuration` not provided) The identifiers of your data sources and FAQs. Or, you can specify that you want to use documents indexed via the `BatchPutDocument API`. Terraform will only perform drift detection of its value when present in a configuration. [Detailed below](#content_source_configuration).
+* `user_identity_configuration` - (Optional, Required if `content_source_configuration` not provided) The AWS SSO field name that contains the identifiers of your users, such as their emails. [Detailed below](#user_identity_configuration).
+
+### `content_source_configuration`
+
+The `content_source_configuration` configuration block supports the following arguments:
+
+* `data_source_ids` - (Optional) The identifiers of the data sources you want to use for your Amazon Kendra experience. Maximum number of 100 items.
+* `direct_put_content` - (Optional) Whether to use documents you indexed directly using the `BatchPutDocument API`. Defaults to `false`.
+* `faq_ids` - (Optional) The identifier of the FAQs that you want to use for your Amazon Kendra experience. Maximum number of 100 items.
+
+### `user_identity_configuration`
+
+The `user_identity_configuration` configuration block supports the following argument:
+
+* `identity_attribute_name` - (Required) The AWS SSO field name that contains the identifiers of your users, such as their emails.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The unique identifiers of the experience and index separated by a slash (`/`).
+* `arn` - ARN of the Experience.
+* `endpoints` - Shows the endpoint URLs for your Amazon Kendra experiences. The URLs are unique and fully hosted by AWS.
+    * `endpoint` - The endpoint of your Amazon Kendra experience.
+    * `endpoint_type` - The type of endpoint for your Amazon Kendra experience.
+* `experience_id` - The unique identifier of the experience.
+* `status` - The current processing status of your Amazon Kendra experience.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `30m`)
+* `update` - (Default `30m`)
+* `delete` - (Default `30m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Kendra Experience using the unique identifiers of the experience and index separated by a slash (`/`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Kendra Experience using the unique identifiers of the experience and index separated by a slash (`/`). For example:
+
+```console
+% terraform import aws_kendra_experience.example 1045d08d-66ef-4882-b3ed-dfb7df183e90/b34dfdf7-1f2b-4704-9581-79e00296845f
+```
+
+<!-- cache-key: cdktf-0.18.0 input-477863d25f90cf21db701a32b4767e8783661101976bd8e3bf55b7323f3e6452 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/kendra_faq.html.markdown b/website/docs/cdktf/python/r/kendra_faq.html.markdown
new file mode 100644
index 00000000000..bedaaa171a2
--- /dev/null
+++ b/website/docs/cdktf/python/r/kendra_faq.html.markdown
@@ -0,0 +1,157 @@
+---
+subcategory: "Kendra"
+layout: "aws"
+page_title: "AWS: aws_kendra_faq"
+description: |-
+  Terraform resource for managing an AWS Kendra FAQ.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_kendra_faq
+
+Terraform resource for managing an AWS Kendra FAQ.
+
+## Example Usage
+
+### Basic
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.kendra_faq import KendraFaq
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        KendraFaq(self, "example",
+            index_id=Token.as_string(aws_kendra_index_example.id),
+            name="Example",
+            role_arn=Token.as_string(aws_iam_role_example.arn),
+            s3_path=KendraFaqS3Path(
+                bucket=Token.as_string(aws_s3_bucket_example.id),
+                key=Token.as_string(aws_s3_object_example.key)
+            ),
+            tags={
+                "Name": "Example Kendra Faq"
+            }
+        )
+```
+
+### With File Format
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.kendra_faq import KendraFaq
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        KendraFaq(self, "example",
+            file_format="CSV",
+            index_id=Token.as_string(aws_kendra_index_example.id),
+            name="Example",
+            role_arn=Token.as_string(aws_iam_role_example.arn),
+            s3_path=KendraFaqS3Path(
+                bucket=Token.as_string(aws_s3_bucket_example.id),
+                key=Token.as_string(aws_s3_object_example.key)
+            )
+        )
+```
+
+### With Language Code
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.kendra_faq import KendraFaq
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        KendraFaq(self, "example",
+            index_id=Token.as_string(aws_kendra_index_example.id),
+            language_code="en",
+            name="Example",
+            role_arn=Token.as_string(aws_iam_role_example.arn),
+            s3_path=KendraFaqS3Path(
+                bucket=Token.as_string(aws_s3_bucket_example.id),
+                key=Token.as_string(aws_s3_object_example.key)
+            )
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `index_id`- (Required, Forces new resource) The identifier of the index for a FAQ.
+* `name` - (Required, Forces new resource) The name that should be associated with the FAQ.
+* `role_arn` - (Required, Forces new resource) The Amazon Resource Name (ARN) of a role with permission to access the S3 bucket that contains the FAQs. For more information, see [IAM Roles for Amazon Kendra](https://docs.aws.amazon.com/kendra/latest/dg/iam-roles.html).
+* `s3_path` - (Required, Forces new resource) The S3 location of the FAQ input data. Detailed below.
+
+The `s3_path` configuration block supports the following arguments:
+
+* `bucket` - (Required, Forces new resource) The name of the S3 bucket that contains the file.
+* `key` - (Required, Forces new resource) The name of the file.
+
+The following arguments are optional:
+
+* `description` - (Optional, Forces new resource) The description for a FAQ.
+* `file_format` - (Optional, Forces new resource) The file format used by the input files for the FAQ. Valid Values are `CSV`, `CSV_WITH_HEADER`, `JSON`.
+* `language_code` - (Optional, Forces new resource) The code for a language. This shows a supported language for the FAQ document. English is supported by default. For more information on supported languages, including their codes, see [Adding documents in languages other than English](https://docs.aws.amazon.com/kendra/latest/dg/in-adding-languages.html).
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the FAQ.
+* `created_at` - The Unix datetime that the FAQ was created.
+* `error_message` - When the Status field value is `FAILED`, this contains a message that explains why.
+* `faq_id` - The identifier of the FAQ.
+* `id` - The unique identifiers of the FAQ and index separated by a slash (`/`)
+* `status` - The status of the FAQ. It is ready to use when the status is ACTIVE.
+* `updated_at` - The date and time that the FAQ was last updated.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `30m`)
+* `delete` - (Default `30m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_kendra_faq` using the unique identifiers of the FAQ and index separated by a slash (`/`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_kendra_faq` using the unique identifiers of the FAQ and index separated by a slash (`/`). For example:
+
+```console
+% terraform import aws_kendra_faq.example faq-123456780/idx-8012925589
+```
+
+<!-- cache-key: cdktf-0.18.0 input-57f89e70ce17623b02f00b073b804b218ccbbb5d903a356e14ccc19a733fa5e6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/kendra_index.html.markdown b/website/docs/cdktf/python/r/kendra_index.html.markdown
new file mode 100644
index 00000000000..4673f23a9d4
--- /dev/null
+++ b/website/docs/cdktf/python/r/kendra_index.html.markdown
@@ -0,0 +1,762 @@
+---
+subcategory: "Kendra"
+layout: "aws"
+page_title: "AWS: aws_kendra_index"
+description: |-
+  Provides an Amazon Kendra Index resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_kendra_index
+
+Provides an Amazon Kendra Index resource.
+
+## Example Usage
+
+### Basic
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.kendra_index import KendraIndex
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        KendraIndex(self, "example",
+            description="example",
+            edition="DEVELOPER_EDITION",
+            name="example",
+            role_arn=this_var.arn,
+            tags={
+                "Key1": "Value1"
+            }
+        )
+```
+
+### With capacity units
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.kendra_index import KendraIndex
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        KendraIndex(self, "example",
+            capacity_units=KendraIndexCapacityUnits(
+                query_capacity_units=2,
+                storage_capacity_units=2
+            ),
+            edition="DEVELOPER_EDITION",
+            name="example",
+            role_arn=this_var.arn
+        )
+```
+
+### With server side encryption configuration
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.kendra_index import KendraIndex
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        KendraIndex(self, "example",
+            name="example",
+            role_arn=this_var.arn,
+            server_side_encryption_configuration=KendraIndexServerSideEncryptionConfiguration(
+                kms_key_id=Token.as_string(data_aws_kms_key_this.arn)
+            )
+        )
+```
+
+### With user group resolution configuration
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.kendra_index import KendraIndex
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        KendraIndex(self, "example",
+            name="example",
+            role_arn=this_var.arn,
+            user_group_resolution_configuration=KendraIndexUserGroupResolutionConfiguration(
+                user_group_resolution_mode="AWS_SSO"
+            )
+        )
+```
+
+### With Document Metadata Configuration Updates
+
+#### Specifying the predefined elements
+
+Refer to [Amazon Kendra documentation on built-in document fields](https://docs.aws.amazon.com/kendra/latest/dg/hiw-index.html#index-reserved-fields) for more information.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.kendra_index import KendraIndex
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        KendraIndex(self, "example",
+            document_metadata_configuration_updates=[KendraIndexDocumentMetadataConfigurationUpdates(
+                name="_authors",
+                relevance=KendraIndexDocumentMetadataConfigurationUpdatesRelevance(
+                    importance=1
+                ),
+                search=KendraIndexDocumentMetadataConfigurationUpdatesSearch(
+                    displayable=False,
+                    facetable=False,
+                    searchable=False,
+                    sortable=False
+                ),
+                type="STRING_LIST_VALUE"
+            ), KendraIndexDocumentMetadataConfigurationUpdates(
+                name="_category",
+                relevance=KendraIndexDocumentMetadataConfigurationUpdatesRelevance(
+                    importance=1,
+                    values_importance_map={}
+                ),
+                search=KendraIndexDocumentMetadataConfigurationUpdatesSearch(
+                    displayable=False,
+                    facetable=False,
+                    searchable=False,
+                    sortable=True
+                ),
+                type="STRING_VALUE"
+            ), KendraIndexDocumentMetadataConfigurationUpdates(
+                name="_created_at",
+                relevance=KendraIndexDocumentMetadataConfigurationUpdatesRelevance(
+                    duration="25920000s",
+                    freshness=False,
+                    importance=1,
+                    rank_order="ASCENDING"
+                ),
+                search=KendraIndexDocumentMetadataConfigurationUpdatesSearch(
+                    displayable=False,
+                    facetable=False,
+                    searchable=False,
+                    sortable=True
+                ),
+                type="DATE_VALUE"
+            ), KendraIndexDocumentMetadataConfigurationUpdates(
+                name="_data_source_id",
+                relevance=KendraIndexDocumentMetadataConfigurationUpdatesRelevance(
+                    importance=1,
+                    values_importance_map={}
+                ),
+                search=KendraIndexDocumentMetadataConfigurationUpdatesSearch(
+                    displayable=False,
+                    facetable=False,
+                    searchable=False,
+                    sortable=True
+                ),
+                type="STRING_VALUE"
+            ), KendraIndexDocumentMetadataConfigurationUpdates(
+                name="_document_title",
+                relevance=KendraIndexDocumentMetadataConfigurationUpdatesRelevance(
+                    importance=2,
+                    values_importance_map={}
+                ),
+                search=KendraIndexDocumentMetadataConfigurationUpdatesSearch(
+                    displayable=True,
+                    facetable=False,
+                    searchable=True,
+                    sortable=True
+                ),
+                type="STRING_VALUE"
+            ), KendraIndexDocumentMetadataConfigurationUpdates(
+                name="_excerpt_page_number",
+                relevance=KendraIndexDocumentMetadataConfigurationUpdatesRelevance(
+                    importance=2,
+                    rank_order="ASCENDING"
+                ),
+                search=KendraIndexDocumentMetadataConfigurationUpdatesSearch(
+                    displayable=False,
+                    facetable=False,
+                    searchable=False,
+                    sortable=False
+                ),
+                type="LONG_VALUE"
+            ), KendraIndexDocumentMetadataConfigurationUpdates(
+                name="_faq_id",
+                relevance=KendraIndexDocumentMetadataConfigurationUpdatesRelevance(
+                    importance=1,
+                    values_importance_map={}
+                ),
+                search=KendraIndexDocumentMetadataConfigurationUpdatesSearch(
+                    displayable=False,
+                    facetable=False,
+                    searchable=False,
+                    sortable=True
+                ),
+                type="STRING_VALUE"
+            ), KendraIndexDocumentMetadataConfigurationUpdates(
+                name="_file_type",
+                relevance=KendraIndexDocumentMetadataConfigurationUpdatesRelevance(
+                    importance=1,
+                    values_importance_map={}
+                ),
+                search=KendraIndexDocumentMetadataConfigurationUpdatesSearch(
+                    displayable=False,
+                    facetable=False,
+                    searchable=False,
+                    sortable=True
+                ),
+                type="STRING_VALUE"
+            ), KendraIndexDocumentMetadataConfigurationUpdates(
+                name="_language_code",
+                relevance=KendraIndexDocumentMetadataConfigurationUpdatesRelevance(
+                    importance=1,
+                    values_importance_map={}
+                ),
+                search=KendraIndexDocumentMetadataConfigurationUpdatesSearch(
+                    displayable=False,
+                    facetable=False,
+                    searchable=False,
+                    sortable=True
+                ),
+                type="STRING_VALUE"
+            ), KendraIndexDocumentMetadataConfigurationUpdates(
+                name="_last_updated_at",
+                relevance=KendraIndexDocumentMetadataConfigurationUpdatesRelevance(
+                    duration="25920000s",
+                    freshness=False,
+                    importance=1,
+                    rank_order="ASCENDING"
+                ),
+                search=KendraIndexDocumentMetadataConfigurationUpdatesSearch(
+                    displayable=False,
+                    facetable=False,
+                    searchable=False,
+                    sortable=True
+                ),
+                type="DATE_VALUE"
+            ), KendraIndexDocumentMetadataConfigurationUpdates(
+                name="_source_uri",
+                relevance=KendraIndexDocumentMetadataConfigurationUpdatesRelevance(
+                    importance=1,
+                    values_importance_map={}
+                ),
+                search=KendraIndexDocumentMetadataConfigurationUpdatesSearch(
+                    displayable=True,
+                    facetable=False,
+                    searchable=False,
+                    sortable=False
+                ),
+                type="STRING_VALUE"
+            ), KendraIndexDocumentMetadataConfigurationUpdates(
+                name="_tenant_id",
+                relevance=KendraIndexDocumentMetadataConfigurationUpdatesRelevance(
+                    importance=1,
+                    values_importance_map={}
+                ),
+                search=KendraIndexDocumentMetadataConfigurationUpdatesSearch(
+                    displayable=False,
+                    facetable=False,
+                    searchable=False,
+                    sortable=True
+                ),
+                type="STRING_VALUE"
+            ), KendraIndexDocumentMetadataConfigurationUpdates(
+                name="_version",
+                relevance=KendraIndexDocumentMetadataConfigurationUpdatesRelevance(
+                    importance=1,
+                    values_importance_map={}
+                ),
+                search=KendraIndexDocumentMetadataConfigurationUpdatesSearch(
+                    displayable=False,
+                    facetable=False,
+                    searchable=False,
+                    sortable=True
+                ),
+                type="STRING_VALUE"
+            ), KendraIndexDocumentMetadataConfigurationUpdates(
+                name="_view_count",
+                relevance=KendraIndexDocumentMetadataConfigurationUpdatesRelevance(
+                    importance=1,
+                    rank_order="ASCENDING"
+                ),
+                search=KendraIndexDocumentMetadataConfigurationUpdatesSearch(
+                    displayable=False,
+                    facetable=False,
+                    searchable=False,
+                    sortable=True
+                ),
+                type="LONG_VALUE"
+            )
+            ],
+            name="example",
+            role_arn=this_var.arn
+        )
+```
+
+#### Appending additional elements
+
+The example below shows additional elements with names, `example-string-value`, `example-long-value`, `example-string-list-value`, `example-date-value` representing the 4 types of `STRING_VALUE`, `LONG_VALUE`, `STRING_LIST_VALUE`, `DATE_VALUE` respectively.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.kendra_index import KendraIndex
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        KendraIndex(self, "example",
+            document_metadata_configuration_updates=[KendraIndexDocumentMetadataConfigurationUpdates(
+                name="_authors",
+                relevance=KendraIndexDocumentMetadataConfigurationUpdatesRelevance(
+                    importance=1
+                ),
+                search=KendraIndexDocumentMetadataConfigurationUpdatesSearch(
+                    displayable=False,
+                    facetable=False,
+                    searchable=False,
+                    sortable=False
+                ),
+                type="STRING_LIST_VALUE"
+            ), KendraIndexDocumentMetadataConfigurationUpdates(
+                name="_category",
+                relevance=KendraIndexDocumentMetadataConfigurationUpdatesRelevance(
+                    importance=1,
+                    values_importance_map={}
+                ),
+                search=KendraIndexDocumentMetadataConfigurationUpdatesSearch(
+                    displayable=False,
+                    facetable=False,
+                    searchable=False,
+                    sortable=True
+                ),
+                type="STRING_VALUE"
+            ), KendraIndexDocumentMetadataConfigurationUpdates(
+                name="_created_at",
+                relevance=KendraIndexDocumentMetadataConfigurationUpdatesRelevance(
+                    duration="25920000s",
+                    freshness=False,
+                    importance=1,
+                    rank_order="ASCENDING"
+                ),
+                search=KendraIndexDocumentMetadataConfigurationUpdatesSearch(
+                    displayable=False,
+                    facetable=False,
+                    searchable=False,
+                    sortable=True
+                ),
+                type="DATE_VALUE"
+            ), KendraIndexDocumentMetadataConfigurationUpdates(
+                name="_data_source_id",
+                relevance=KendraIndexDocumentMetadataConfigurationUpdatesRelevance(
+                    importance=1,
+                    values_importance_map={}
+                ),
+                search=KendraIndexDocumentMetadataConfigurationUpdatesSearch(
+                    displayable=False,
+                    facetable=False,
+                    searchable=False,
+                    sortable=True
+                ),
+                type="STRING_VALUE"
+            ), KendraIndexDocumentMetadataConfigurationUpdates(
+                name="_document_title",
+                relevance=KendraIndexDocumentMetadataConfigurationUpdatesRelevance(
+                    importance=2,
+                    values_importance_map={}
+                ),
+                search=KendraIndexDocumentMetadataConfigurationUpdatesSearch(
+                    displayable=True,
+                    facetable=False,
+                    searchable=True,
+                    sortable=True
+                ),
+                type="STRING_VALUE"
+            ), KendraIndexDocumentMetadataConfigurationUpdates(
+                name="_excerpt_page_number",
+                relevance=KendraIndexDocumentMetadataConfigurationUpdatesRelevance(
+                    importance=2,
+                    rank_order="ASCENDING"
+                ),
+                search=KendraIndexDocumentMetadataConfigurationUpdatesSearch(
+                    displayable=False,
+                    facetable=False,
+                    searchable=False,
+                    sortable=False
+                ),
+                type="LONG_VALUE"
+            ), KendraIndexDocumentMetadataConfigurationUpdates(
+                name="_faq_id",
+                relevance=KendraIndexDocumentMetadataConfigurationUpdatesRelevance(
+                    importance=1,
+                    values_importance_map={}
+                ),
+                search=KendraIndexDocumentMetadataConfigurationUpdatesSearch(
+                    displayable=False,
+                    facetable=False,
+                    searchable=False,
+                    sortable=True
+                ),
+                type="STRING_VALUE"
+            ), KendraIndexDocumentMetadataConfigurationUpdates(
+                name="_file_type",
+                relevance=KendraIndexDocumentMetadataConfigurationUpdatesRelevance(
+                    importance=1,
+                    values_importance_map={}
+                ),
+                search=KendraIndexDocumentMetadataConfigurationUpdatesSearch(
+                    displayable=False,
+                    facetable=False,
+                    searchable=False,
+                    sortable=True
+                ),
+                type="STRING_VALUE"
+            ), KendraIndexDocumentMetadataConfigurationUpdates(
+                name="_language_code",
+                relevance=KendraIndexDocumentMetadataConfigurationUpdatesRelevance(
+                    importance=1,
+                    values_importance_map={}
+                ),
+                search=KendraIndexDocumentMetadataConfigurationUpdatesSearch(
+                    displayable=False,
+                    facetable=False,
+                    searchable=False,
+                    sortable=True
+                ),
+                type="STRING_VALUE"
+            ), KendraIndexDocumentMetadataConfigurationUpdates(
+                name="_last_updated_at",
+                relevance=KendraIndexDocumentMetadataConfigurationUpdatesRelevance(
+                    duration="25920000s",
+                    freshness=False,
+                    importance=1,
+                    rank_order="ASCENDING"
+                ),
+                search=KendraIndexDocumentMetadataConfigurationUpdatesSearch(
+                    displayable=False,
+                    facetable=False,
+                    searchable=False,
+                    sortable=True
+                ),
+                type="DATE_VALUE"
+            ), KendraIndexDocumentMetadataConfigurationUpdates(
+                name="_source_uri",
+                relevance=KendraIndexDocumentMetadataConfigurationUpdatesRelevance(
+                    importance=1,
+                    values_importance_map={}
+                ),
+                search=KendraIndexDocumentMetadataConfigurationUpdatesSearch(
+                    displayable=True,
+                    facetable=False,
+                    searchable=False,
+                    sortable=False
+                ),
+                type="STRING_VALUE"
+            ), KendraIndexDocumentMetadataConfigurationUpdates(
+                name="_tenant_id",
+                relevance=KendraIndexDocumentMetadataConfigurationUpdatesRelevance(
+                    importance=1,
+                    values_importance_map={}
+                ),
+                search=KendraIndexDocumentMetadataConfigurationUpdatesSearch(
+                    displayable=False,
+                    facetable=False,
+                    searchable=False,
+                    sortable=True
+                ),
+                type="STRING_VALUE"
+            ), KendraIndexDocumentMetadataConfigurationUpdates(
+                name="_version",
+                relevance=KendraIndexDocumentMetadataConfigurationUpdatesRelevance(
+                    importance=1,
+                    values_importance_map={}
+                ),
+                search=KendraIndexDocumentMetadataConfigurationUpdatesSearch(
+                    displayable=False,
+                    facetable=False,
+                    searchable=False,
+                    sortable=True
+                ),
+                type="STRING_VALUE"
+            ), KendraIndexDocumentMetadataConfigurationUpdates(
+                name="_view_count",
+                relevance=KendraIndexDocumentMetadataConfigurationUpdatesRelevance(
+                    importance=1,
+                    rank_order="ASCENDING"
+                ),
+                search=KendraIndexDocumentMetadataConfigurationUpdatesSearch(
+                    displayable=False,
+                    facetable=False,
+                    searchable=False,
+                    sortable=True
+                ),
+                type="LONG_VALUE"
+            ), KendraIndexDocumentMetadataConfigurationUpdates(
+                name="example-string-value",
+                relevance=KendraIndexDocumentMetadataConfigurationUpdatesRelevance(
+                    importance=1,
+                    values_importance_map={}
+                ),
+                search=KendraIndexDocumentMetadataConfigurationUpdatesSearch(
+                    displayable=True,
+                    facetable=True,
+                    searchable=True,
+                    sortable=True
+                ),
+                type="STRING_VALUE"
+            ), KendraIndexDocumentMetadataConfigurationUpdates(
+                name="example-long-value",
+                relevance=KendraIndexDocumentMetadataConfigurationUpdatesRelevance(
+                    importance=1,
+                    rank_order="ASCENDING"
+                ),
+                search=KendraIndexDocumentMetadataConfigurationUpdatesSearch(
+                    displayable=True,
+                    facetable=True,
+                    searchable=False,
+                    sortable=True
+                ),
+                type="LONG_VALUE"
+            ), KendraIndexDocumentMetadataConfigurationUpdates(
+                name="example-string-list-value",
+                relevance=KendraIndexDocumentMetadataConfigurationUpdatesRelevance(
+                    importance=1
+                ),
+                search=KendraIndexDocumentMetadataConfigurationUpdatesSearch(
+                    displayable=True,
+                    facetable=True,
+                    searchable=True,
+                    sortable=False
+                ),
+                type="STRING_LIST_VALUE"
+            ), KendraIndexDocumentMetadataConfigurationUpdates(
+                name="example-date-value",
+                relevance=KendraIndexDocumentMetadataConfigurationUpdatesRelevance(
+                    duration="25920000s",
+                    freshness=False,
+                    importance=1,
+                    rank_order="ASCENDING"
+                ),
+                search=KendraIndexDocumentMetadataConfigurationUpdatesSearch(
+                    displayable=True,
+                    facetable=True,
+                    searchable=False,
+                    sortable=False
+                ),
+                type="DATE_VALUE"
+            )
+            ],
+            name="example",
+            role_arn=this_var.arn
+        )
+```
+
+### With JSON token type configuration
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.kendra_index import KendraIndex
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        KendraIndex(self, "example",
+            name="example",
+            role_arn=this_var.arn,
+            user_token_configurations=KendraIndexUserTokenConfigurations(
+                json_token_type_configuration=KendraIndexUserTokenConfigurationsJsonTokenTypeConfiguration(
+                    group_attribute_field="groups",
+                    user_name_attribute_field="username"
+                )
+            )
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `capacity_units` - (Optional) A block that sets the number of additional document storage and query capacity units that should be used by the index. [Detailed below](#capacity_units).
+* `description` - (Optional) The description of the Index.
+* `document_metadata_configuration_updates` - (Optional) One or more blocks that specify the configuration settings for any metadata applied to the documents in the index. Minimum number of 0 items. Maximum number of 500 items. If specified, you must define all elements, including those that are provided by default. These index fields are documented at [Amazon Kendra Index documentation](https://docs.aws.amazon.com/kendra/latest/dg/hiw-index.html). For an example resource that defines these default index fields, refer to the [default example above](#specifying-the-predefined-elements). For an example resource that appends additional index fields, refer to the [append example above](#appending-additional-elements). All arguments for each block must be specified. Note that blocks cannot be removed since index fields cannot be deleted. This argument is [detailed below](#document_metadata_configuration_updates).
+* `edition` - (Optional) The Amazon Kendra edition to use for the index. Choose `DEVELOPER_EDITION` for indexes intended for development, testing, or proof of concept. Use `ENTERPRISE_EDITION` for your production databases. Once you set the edition for an index, it can't be changed. Defaults to `ENTERPRISE_EDITION`
+* `name` - (Required) Specifies the name of the Index.
+* `role_arn` - (Required) An AWS Identity and Access Management (IAM) role that gives Amazon Kendra permissions to access your Amazon CloudWatch logs and metrics. This is also the role you use when you call the `BatchPutDocument` API to index documents from an Amazon S3 bucket.
+* `server_side_encryption_configuration` - (Optional) A block that specifies the identifier of the AWS KMS customer managed key (CMK) that's used to encrypt data indexed by Amazon Kendra. Amazon Kendra doesn't support asymmetric CMKs. [Detailed below](#server_side_encryption_configuration).
+* `user_context_policy` - (Optional) The user context policy. Valid values are `ATTRIBUTE_FILTER` or `USER_TOKEN`. For more information, refer to [UserContextPolicy](https://docs.aws.amazon.com/kendra/latest/APIReference/API_CreateIndex.html#kendra-CreateIndex-request-UserContextPolicy). Defaults to `ATTRIBUTE_FILTER`.
+* `user_group_resolution_configuration` - (Optional) A block that enables fetching access levels of groups and users from an AWS Single Sign-On identity source. To configure this, see [UserGroupResolutionConfiguration](https://docs.aws.amazon.com/kendra/latest/dg/API_UserGroupResolutionConfiguration.html). [Detailed below](#user_group_resolution_configuration).
+* `user_token_configurations` - (Optional) A block that specifies the user token configuration. [Detailed below](#user_token_configurations).
+* `tags` - (Optional) Tags to apply to the Index. If configured with a provider
+[`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### `capacity_units`
+
+A `capacity_units` block supports the following arguments:
+
+* `query_capacity_units` - (Required) The amount of extra query capacity for an index and GetQuerySuggestions capacity. For more information, refer to [QueryCapacityUnits](https://docs.aws.amazon.com/kendra/latest/dg/API_CapacityUnitsConfiguration.html#Kendra-Type-CapacityUnitsConfiguration-QueryCapacityUnits).
+* `storage_capacity_units` - (Required) The amount of extra storage capacity for an index. A single capacity unit provides 30 GB of storage space or 100,000 documents, whichever is reached first. Minimum value of 0.
+
+### `document_metadata_configuration_updates`
+
+A `document_metadata_configuration_updates` block supports the following arguments:
+
+* `name` - (Required) The name of the index field. Minimum length of 1. Maximum length of 30.
+* `relevance` - (Required) A block that provides manual tuning parameters to determine how the field affects the search results. [Detailed below](#relevance)
+* `search` - (Required) A block that provides information about how the field is used during a search. Documented below. [Detailed below](#search)
+* `type` - (Required) The data type of the index field. Valid values are `STRING_VALUE`, `STRING_LIST_VALUE`, `LONG_VALUE`, `DATE_VALUE`.
+
+#### `relevance`
+
+A `relevance` block supports the following attributes:
+
+* `duration` - (Required if type is of `DATE_VALUE`) Specifies the time period that the boost applies to. For more information, refer to [Duration](https://docs.aws.amazon.com/kendra/latest/dg/API_Relevance.html#Kendra-Type-Relevance-Duration).
+* `freshness` - (Required if type is of `DATE_VALUE`) Indicates that this field determines how "fresh" a document is. For more information, refer to [Freshness](https://docs.aws.amazon.com/kendra/latest/dg/API_Relevance.html#Kendra-Type-Relevance-Freshness).
+* `importance` - (Required for all types) The relative importance of the field in the search. Larger numbers provide more of a boost than smaller numbers. Minimum value of 1. Maximum value of 10.
+* `rank_order` - (Required if type is of `DATE_VALUE`, or `LONG_VALUE`) Determines how values should be interpreted. For more information, refer to [RankOrder](https://docs.aws.amazon.com/kendra/latest/dg/API_Relevance.html#Kendra-Type-Relevance-RankOrder).
+* `values_importance_map` - (Required if type is of `STRING_VALUE`) A list of values that should be given a different boost when they appear in the result list. For more information, refer to [ValueImportanceMap](https://docs.aws.amazon.com/kendra/latest/dg/API_Relevance.html#Kendra-Type-Relevance-ValueImportanceMap).
+
+#### `search`
+
+A `search` block supports the following attributes:
+
+* `displayable` - (Required) Determines whether the field is returned in the query response. The default is `true`.
+* `facetable` - (Required) Indicates that the field can be used to create search facets, a count of results for each value in the field. The default is `false`.
+* `searchable` - (Required) Determines whether the field is used in the search. If the Searchable field is true, you can use relevance tuning to manually tune how Amazon Kendra weights the field in the search. The default is `true` for `string` fields and `false` for `number` and `date` fields.
+* `sortable` - (Required) Determines whether the field can be used to sort the results of a query. If you specify sorting on a field that does not have Sortable set to true, Amazon Kendra returns an exception. The default is `false`.
+
+### `server_side_encryption_configuration`
+
+A `server_side_encryption_configuration` block supports the following arguments:
+
+* `kms_key_id` - (Optional) The identifier of the AWS KMScustomer master key (CMK). Amazon Kendra doesn't support asymmetric CMKs.
+
+### `user_group_resolution_configuration`
+
+A `user_group_resolution_configuration` block supports the following arguments:
+
+* `user_group_resolution_mode` - (Required) The identity store provider (mode) you want to use to fetch access levels of groups and users. AWS Single Sign-On is currently the only available mode. Your users and groups must exist in an AWS SSO identity source in order to use this mode. Valid Values are `AWS_SSO` or `NONE`.
+
+### `user_token_configurations`
+
+A `user_token_configurations` block supports the following arguments:
+
+* `json_token_type_configuration` - (Optional) A block that specifies the information about the JSON token type configuration. [Detailed below](#json_token_type_configuration).
+* `jwt_token_type_configuration` - (Optional) A block that specifies the information about the JWT token type configuration. [Detailed below](#jwt_token_type_configuration).
+
+#### `json_token_type_configuration`
+
+A `json_token_type_configuration` block supports the following arguments:
+
+* `group_attribute_field` - (Required) The group attribute field. Minimum length of 1. Maximum length of 2048.
+* `user_name_attribute_field` - (Required) The user name attribute field. Minimum length of 1. Maximum length of 2048.
+
+#### `jwt_token_type_configuration`
+
+A `jwt_token_type_configuration` block supports the following arguments:
+
+* `claim_regex` - (Optional) The regular expression that identifies the claim. Minimum length of 1. Maximum length of 100.
+* `group_attribute_field` - (Optional) The group attribute field. Minimum length of 1. Maximum length of 100.
+* `issuer` - (Optional) The issuer of the token. Minimum length of 1. Maximum length of 65.
+* `key_location` - (Required) The location of the key. Valid values are `URL` or `SECRET_MANAGER`
+* `secrets_manager_arn` - (Optional) The Amazon Resource Name (ARN) of the secret.
+* `url` - (Optional) The signing key URL. Valid pattern is `^(https?|ftp|file):\/\/([^\s]*)`
+* `user_name_attribute_field` - (Optional) The user name attribute field. Minimum length of 1. Maximum length of 100.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `40m`)
+* `delete` - (Default `40m`)
+* `update` - (Default `40m`)
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the Index.
+* `created_at` - The Unix datetime that the index was created.
+* `error_message` - When the Status field value is `FAILED`, this contains a message that explains why.
+* `id` - The identifier of the Index.
+* `index_statistics` - A block that provides information about the number of FAQ questions and answers and the number of text documents indexed. [Detailed below](#index_statistics).
+* `status` - The current status of the index. When the value is `ACTIVE`, the index is ready for use. If the Status field value is `FAILED`, the `error_message` field contains a message that explains why.
+* `updated_at` - The Unix datetime that the index was last updated.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+### `index_statistics`
+
+A `index_statistics` block supports the following attributes:
+
+* `faq_statistics` - A block that specifies the number of question and answer topics in the index. [Detailed below](#faq_statistics).
+* `text_document_statistics` - A block that specifies the number of text documents indexed. [Detailed below](#text_document_statistics).
+
+#### `faq_statistics`
+
+A `faq_statistics` block supports the following attributes:
+
+* `indexed_question_answers_count` - The total number of FAQ questions and answers contained in the index.
+
+#### `text_document_statistics`
+
+A `text_document_statistics` block supports the following attributes:
+
+* `indexed_text_bytes` - The total size, in bytes, of the indexed documents.
+* `indexed_text_documents_count` - The number of text documents indexed.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Amazon Kendra Indexes using its `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Amazon Kendra Indexes using its `id`. For example:
+
+```console
+% terraform import aws_kendra_index.example 12345678-1234-5678-9123-123456789123
+```
+
+<!-- cache-key: cdktf-0.18.0 input-00f20f85239aecb494058ad449f9a2170d10a5017c988607e2f0d4556b31b4f2 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/kendra_query_suggestions_block_list.html.markdown b/website/docs/cdktf/python/r/kendra_query_suggestions_block_list.html.markdown
new file mode 100644
index 00000000000..7cffc82aa63
--- /dev/null
+++ b/website/docs/cdktf/python/r/kendra_query_suggestions_block_list.html.markdown
@@ -0,0 +1,99 @@
+---
+subcategory: "Kendra"
+layout: "aws"
+page_title: "AWS: aws_kendra_query_suggestions_block_list"
+description: |-
+  Terraform resource for managing an AWS Kendra block list used for query suggestions for an index
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_kendra_query_suggestions_block_list
+
+Use the `aws_kendra_index_block_list` resource to manage an AWS Kendra block list used for query suggestions for an index.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.kendra_query_suggestions_block_list import KendraQuerySuggestionsBlockList
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        KendraQuerySuggestionsBlockList(self, "example",
+            index_id=Token.as_string(aws_kendra_index_example.id),
+            name="Example",
+            role_arn=Token.as_string(aws_iam_role_example.arn),
+            source_s3_path=KendraQuerySuggestionsBlockListSourceS3Path(
+                bucket=Token.as_string(aws_s3_bucket_example.id),
+                key="example/suggestions.txt"
+            ),
+            tags={
+                "Name": "Example Kendra Index"
+            }
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `index_id` - (Required, Forces New Resource) Identifier of the index for a block list.
+* `name` - (Required) Name for the block list.
+* `role_arn` - (Required) IAM (Identity and Access Management) role used to access the block list text file in S3.
+* `source_s3_path` - (Required) S3 path where your block list text file is located. See details below.
+
+The `source_s3_path` configuration block supports the following arguments:
+
+* `bucket` - (Required) Name of the S3 bucket that contains the file.
+* `key` - (Required) Name of the file.
+
+The following arguments are optional:
+
+* `description` - (Optional) Description for a block list.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block), tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the block list.
+* `query_suggestions_block_list_id` - Unique identifier of the block list.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider's [default_tags configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+Configuration options for operation timeouts can be found [here](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts).
+
+* `create` - (Default `30m`)
+* `update` - (Default `30m`)
+* `delete` - (Default `30m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import the `aws_kendra_query_suggestions_block_list` resource using the unique identifiers of the block list and index separated by a slash (`/`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import the `aws_kendra_query_suggestions_block_list` resource using the unique identifiers of the block list and index separated by a slash (`/`). For example:
+
+```console
+% terraform import aws_kendra_query_suggestions_block_list.example blocklist-123456780/idx-8012925589
+```
+
+<!-- cache-key: cdktf-0.18.0 input-6163688d652d44086864869ca5678b9e49c9f4dfd42ccb33a1b997d4692a3df0 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/kendra_thesaurus.html.markdown b/website/docs/cdktf/python/r/kendra_thesaurus.html.markdown
new file mode 100644
index 00000000000..2ae08caeb4d
--- /dev/null
+++ b/website/docs/cdktf/python/r/kendra_thesaurus.html.markdown
@@ -0,0 +1,98 @@
+---
+subcategory: "Kendra"
+layout: "aws"
+page_title: "AWS: aws_kendra_thesaurus"
+description: |-
+  Terraform resource for managing an AWS Kendra Thesaurus.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_kendra_thesaurus
+
+Terraform resource for managing an AWS Kendra Thesaurus.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.kendra_thesaurus import KendraThesaurus
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        KendraThesaurus(self, "example",
+            index_id=Token.as_string(aws_kendra_index_example.id),
+            name="Example",
+            role_arn=Token.as_string(aws_iam_role_example.arn),
+            source_s3_path=KendraThesaurusSourceS3Path(
+                bucket=Token.as_string(aws_s3_bucket_example.id),
+                key=Token.as_string(aws_s3_object_example.key)
+            ),
+            tags={
+                "Name": "Example Kendra Thesaurus"
+            }
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `index_id`- (Required, Forces new resource) The identifier of the index for a thesaurus.
+* `name` - (Required) The name for the thesaurus.
+* `role_arn` - (Required) The IAM (Identity and Access Management) role used to access the thesaurus file in S3.
+* `source_s3_path` - (Required) The S3 path where your thesaurus file sits in S3. Detailed below.
+
+The `source_s3_path` configuration block supports the following arguments:
+
+* `bucket` - (Required) The name of the S3 bucket that contains the file.
+* `key` - (Required) The name of the file.
+
+The following arguments are optional:
+
+* `description` - (Optional) The description for a thesaurus.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the thesaurus.
+* `id` - The unique identifiers of the thesaurus and index separated by a slash (`/`).
+* `status` - The current status of the thesaurus.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `30m`)
+* `update` - (Default `30m`)
+* `delete` - (Default `30m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_kendra_thesaurus` using the unique identifiers of the thesaurus and index separated by a slash (`/`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_kendra_thesaurus` using the unique identifiers of the thesaurus and index separated by a slash (`/`). For example:
+
+```console
+% terraform import aws_kendra_thesaurus.example thesaurus-123456780/idx-8012925589
+```
+
+<!-- cache-key: cdktf-0.18.0 input-c0dadf9d404f36bcb0eb8e47f42f731ded578d3015ecba91c35c34dacf029082 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/key_pair.html.markdown b/website/docs/cdktf/python/r/key_pair.html.markdown
new file mode 100644
index 00000000000..e61fd5599d9
--- /dev/null
+++ b/website/docs/cdktf/python/r/key_pair.html.markdown
@@ -0,0 +1,85 @@
+---
+subcategory: "EC2 (Elastic Compute Cloud)"
+layout: "aws"
+page_title: "AWS: aws_key_pair"
+description: |-
+  Provides a Key Pair resource. Currently this supports importing an existing key pair but not creating a new key pair.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_key_pair
+
+Provides an [EC2 key pair](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-key-pairs.html) resource. A key pair is used to control login access to EC2 instances.
+
+Currently this resource requires an existing user-supplied key pair. This key pair's public key will be registered with AWS to allow logging-in to EC2 instances.
+
+When importing an existing key pair the public key material may be in any format supported by AWS. Supported formats (per the [AWS documentation](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-key-pairs.html#how-to-generate-your-own-key-and-import-it-to-aws)) are:
+
+* OpenSSH public key format (the format in ~/.ssh/authorized_keys)
+* Base64 encoded DER format
+* SSH public key file format as specified in RFC4716
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.key_pair import KeyPair
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        KeyPair(self, "deployer",
+            key_name="deployer-key",
+            public_key="ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQD3F6tyPEFEzV0LX3X8BsXdMsQz1x2cEikKDEY0aIj41qgxMCP/iteneqXSIFZBp5vizPvaoIR3Um9xK7PGoW8giupGn+EPuxIA4cDM4vzOqOkiMPhz5XK0whEjkVzTo4+S0puvDZuwIsdiW9mxhJc7tgBNL0cYlWSYVkz4G/fslNfRPW5mYAM49f4fhtxPb5ok4Q2Lg9dPKVHO/Bgeu5woMc7RY0p1ej6D4CKFE6lymSDJpW0YHX/wqE9+cfEauh7xZcG0q9t2ta6F6fmX0agvpFyZo8aFbXeUBr7osSCJNgvavWbM/06niWrOvYX2xwWdhXmXSrbX8ZbabVohBK41 email@example.com"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `key_name` - (Optional) The name for the key pair. If neither `key_name` nor `key_name_prefix` is provided, Terraform will create a unique key name using the prefix `terraform-`.
+* `key_name_prefix` - (Optional) Creates a unique name beginning with the specified prefix. Conflicts with `key_name`. If neither `key_name` nor `key_name_prefix` is provided, Terraform will create a unique key name using the prefix `terraform-`.
+* `public_key` - (Required) The public key material.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The key pair name.
+* `arn` - The key pair ARN.
+* `key_name` - The key pair name.
+* `key_pair_id` - The key pair ID.
+* `key_type` - The type of key pair.
+* `fingerprint` - The MD5 public key fingerprint as specified in section 4 of RFC 4716.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Key Pairs using the `key_name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Key Pairs using the `key_name`. For example:
+
+```console
+% terraform import aws_key_pair.deployer deployer-key
+```
+
+~> **NOTE:** The AWS API does not include the public key in the response, so `terraform apply` will attempt to replace the key pair. There is currently no supported workaround for this limitation.
+
+<!-- cache-key: cdktf-0.18.0 input-bc4b2bf30b41e8b680f59b0e745bd630e891fca6baac140b343a76369eb3e8aa -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/keyspaces_keyspace.html.markdown b/website/docs/cdktf/python/r/keyspaces_keyspace.html.markdown
new file mode 100644
index 00000000000..37185a53c71
--- /dev/null
+++ b/website/docs/cdktf/python/r/keyspaces_keyspace.html.markdown
@@ -0,0 +1,80 @@
+---
+subcategory: "Keyspaces (for Apache Cassandra)"
+layout: "aws"
+page_title: "AWS: aws_keyspaces_keyspace"
+description: |-
+  Provides a Keyspaces Keyspace.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_keyspaces_keyspace
+
+Provides a Keyspaces Keyspace.
+
+More information about keyspaces can be found in the [Keyspaces User Guide](https://docs.aws.amazon.com/keyspaces/latest/devguide/what-is-keyspaces.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.keyspaces_keyspace import KeyspacesKeyspace
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        KeyspacesKeyspace(self, "example",
+            name="my_keyspace"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required, Forces new resource) The name of the keyspace to be created.
+
+The following arguments are optional:
+
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name of the keyspace.
+* `arn` - The ARN of the keyspace.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `1m`)
+- `delete` - (Default `1m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import a keyspace using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import a keyspace using the `name`. For example:
+
+```console
+% terraform import aws_keyspaces_keyspace.example my_keyspace
+```
+
+<!-- cache-key: cdktf-0.18.0 input-45356374226b4001cb8f4913ce874bd4156dabd51b8ab1e4fe9896d2e554989a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/keyspaces_table.html.markdown b/website/docs/cdktf/python/r/keyspaces_table.html.markdown
new file mode 100644
index 00000000000..029bc043e65
--- /dev/null
+++ b/website/docs/cdktf/python/r/keyspaces_table.html.markdown
@@ -0,0 +1,153 @@
+---
+subcategory: "Keyspaces (for Apache Cassandra)"
+layout: "aws"
+page_title: "AWS: aws_keyspaces_table"
+description: |-
+  Provides a Keyspaces Table.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_keyspaces_table
+
+Provides a Keyspaces Table.
+
+More information about Keyspaces tables can be found in the [Keyspaces Developer Guide](https://docs.aws.amazon.com/keyspaces/latest/devguide/working-with-tables.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.keyspaces_table import KeyspacesTable
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        KeyspacesTable(self, "example",
+            keyspace_name=Token.as_string(aws_keyspaces_keyspace_example.name),
+            schema_definition=KeyspacesTableSchemaDefinition(
+                column=[KeyspacesTableSchemaDefinitionColumn(
+                    name="Message",
+                    type="ASCII"
+                )
+                ],
+                partition_key=[KeyspacesTableSchemaDefinitionPartitionKey(
+                    name="Message"
+                )
+                ]
+            ),
+            table_name="my_table"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `keyspace_name` - (Required) The name of the keyspace that the table is going to be created in.
+* `table_name` - (Required) The name of the table.
+
+The following arguments are optional:
+
+* `capacity_specification` - (Optional) Specifies the read/write throughput capacity mode for the table.
+* `client_side_timestamps` - (Optional) Enables client-side timestamps for the table. By default, the setting is disabled.
+* `comment` - (Optional) A description of the table.
+* `default_time_to_live` - (Optional) The default Time to Live setting in seconds for the table. More information can be found in the [Developer Guide](https://docs.aws.amazon.com/keyspaces/latest/devguide/TTL-how-it-works.html#ttl-howitworks_default_ttl).
+* `encryption_specification` - (Optional) Specifies how the encryption key for encryption at rest is managed for the table. More information can be found in the [Developer Guide](https://docs.aws.amazon.com/keyspaces/latest/devguide/EncryptionAtRest.html).
+* `point_in_time_recovery` - (Optional) Specifies if point-in-time recovery is enabled or disabled for the table. More information can be found in the [Developer Guide](https://docs.aws.amazon.com/keyspaces/latest/devguide/PointInTimeRecovery.html).
+* `schema_definition` - (Optional) Describes the schema of the table.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `ttl` - (Optional) Enables Time to Live custom settings for the table. More information can be found in the [Developer Guide](https://docs.aws.amazon.com/keyspaces/latest/devguide/TTL.html).
+
+The `capacity_specification` object takes the following arguments:
+
+* `read_capacity_units` - (Optional) The throughput capacity specified for read operations defined in read capacity units (RCUs).
+* `throughput_mode` - (Optional) The read/write throughput capacity mode for a table. Valid values: `PAY_PER_REQUEST`, `PROVISIONED`. The default value is `PAY_PER_REQUEST`.
+* `write_capacity_units` - (Optional) The throughput capacity specified for write operations defined in write capacity units (WCUs).
+
+The `client_side_timestamps` object takes the following arguments:
+
+* `status` - (Required) Shows how to enable client-side timestamps settings for the specified table. Valid values: `ENABLED`.
+
+The `comment` object takes the following arguments:
+
+* `message` - (Required) A description of the table.
+
+The `encryption_specification` object takes the following arguments:
+
+* `kms_key_identifier` - (Optional) The Amazon Resource Name (ARN) of the customer managed KMS key.
+* `type` - (Optional) The encryption option specified for the table. Valid values: `AWS_OWNED_KMS_KEY`, `CUSTOMER_MANAGED_KMS_KEY`. The default value is `AWS_OWNED_KMS_KEY`.
+
+The `point_in_time_recovery` object takes the following arguments:
+
+* `status` - (Optional) Valid values: `ENABLED`, `DISABLED`. The default value is `DISABLED`.
+
+The `schema_definition` object takes the following arguments:
+
+* `column` - (Required) The regular columns of the table.
+* `partition_key` - (Required) The columns that are part of the partition key of the table .
+* `clustering_key` - (Required) The columns that are part of the clustering key of the table.
+* `static_column` - (Required) The columns that have been defined as `STATIC`. Static columns store values that are shared by all rows in the same partition.
+
+The `column` object takes the following arguments:
+
+* `name` - (Required) The name of the column.
+* `type` - (Required) The data type of the column. See the [Developer Guide](https://docs.aws.amazon.com/keyspaces/latest/devguide/cql.elements.html#cql.data-types) for a list of available data types.
+
+The `partition_key` object takes the following arguments:
+
+* `name` - (Required) The name of the partition key column.
+
+The `clustering_key` object takes the following arguments:
+
+* `name` - (Required) The name of the clustering key column.
+* `order_by` - (Required) The order modifier. Valid values: `ASC`, `DESC`.
+
+The `static_column` object takes the following arguments:
+
+* `name` - (Required) The name of the static column.
+
+The `ttl` object takes the following arguments:
+
+* `status` - (Optional) Valid values: `ENABLED`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the table.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `10m`)
+- `update` - (Default `30m`)
+- `delete` - (Default `10m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import a table using the `keyspace_name` and `table_name` separated by `/`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import a table using the `keyspace_name` and `table_name` separated by `/`. For example:
+
+```console
+% terraform import aws_keyspaces_table.example my_keyspace/my_table
+```
+
+<!-- cache-key: cdktf-0.18.0 input-e2a472d7a9fbc6d115fb0eeeff221a8837a9848972c20cbad7590570183d75aa -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/kinesis_analytics_application.html.markdown b/website/docs/cdktf/python/r/kinesis_analytics_application.html.markdown
new file mode 100644
index 00000000000..0edbe432f14
--- /dev/null
+++ b/website/docs/cdktf/python/r/kinesis_analytics_application.html.markdown
@@ -0,0 +1,394 @@
+---
+subcategory: "Kinesis Analytics"
+layout: "aws"
+page_title: "AWS: aws_kinesis_analytics_application"
+description: |-
+  Provides a AWS Kinesis Analytics Application
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_kinesis_analytics_application
+
+Provides a Kinesis Analytics Application resource. Kinesis Analytics is a managed service that
+allows processing and analyzing streaming data using standard SQL.
+
+For more details, see the [Amazon Kinesis Analytics Documentation][1].
+
+-> **Note:** To manage Amazon Kinesis Data Analytics for Apache Flink applications, use the [`aws_kinesisanalyticsv2_application`](/docs/providers/aws/r/kinesisanalyticsv2_application.html) resource.
+
+## Example Usage
+
+### Kinesis Stream Input
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.kinesis_analytics_application import KinesisAnalyticsApplication
+from imports.aws.kinesis_stream import KinesisStream
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        test_stream = KinesisStream(self, "test_stream",
+            name="terraform-kinesis-test",
+            shard_count=1
+        )
+        KinesisAnalyticsApplication(self, "test_application",
+            inputs=KinesisAnalyticsApplicationInputs(
+                kinesis_stream=KinesisAnalyticsApplicationInputsKinesisStream(
+                    resource_arn=test_stream.arn,
+                    role_arn=test.arn
+                ),
+                name_prefix="test_prefix",
+                parallelism=KinesisAnalyticsApplicationInputsParallelism(
+                    count=1
+                ),
+                schema=KinesisAnalyticsApplicationInputsSchema(
+                    record_columns=[KinesisAnalyticsApplicationInputsSchemaRecordColumns(
+                        mapping="$.test",
+                        name="test",
+                        sql_type="VARCHAR(8)"
+                    )
+                    ],
+                    record_encoding="UTF-8",
+                    record_format=KinesisAnalyticsApplicationInputsSchemaRecordFormat(
+                        mapping_parameters=KinesisAnalyticsApplicationInputsSchemaRecordFormatMappingParameters(
+                            json=KinesisAnalyticsApplicationInputsSchemaRecordFormatMappingParametersJson(
+                                record_row_path="$"
+                            )
+                        )
+                    )
+                )
+            ),
+            name="kinesis-analytics-application-test"
+        )
+```
+
+### Starting An Application
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudwatch_log_group import CloudwatchLogGroup
+from imports.aws.cloudwatch_log_stream import CloudwatchLogStream
+from imports.aws.kinesis_analytics_application import KinesisAnalyticsApplication
+from imports.aws.kinesis_firehose_delivery_stream import KinesisFirehoseDeliveryStream
+from imports.aws.kinesis_stream import KinesisStream
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = CloudwatchLogGroup(self, "example",
+            name="analytics"
+        )
+        aws_cloudwatch_log_stream_example = CloudwatchLogStream(self, "example_1",
+            log_group_name=example.name,
+            name="example-kinesis-application"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_cloudwatch_log_stream_example.override_logical_id("example")
+        aws_kinesis_firehose_delivery_stream_example =
+        KinesisFirehoseDeliveryStream(self, "example_2",
+            destination="extended_s3",
+            extended_s3_configuration=KinesisFirehoseDeliveryStreamExtendedS3Configuration(
+                bucket_arn=Token.as_string(aws_s3_bucket_example.arn),
+                role_arn=Token.as_string(aws_iam_role_example.arn)
+            ),
+            name="example-kinesis-delivery-stream"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_kinesis_firehose_delivery_stream_example.override_logical_id("example")
+        aws_kinesis_stream_example = KinesisStream(self, "example_3",
+            name="example-kinesis-stream",
+            shard_count=1
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_kinesis_stream_example.override_logical_id("example")
+        KinesisAnalyticsApplication(self, "test",
+            cloudwatch_logging_options=KinesisAnalyticsApplicationCloudwatchLoggingOptions(
+                log_stream_arn=Token.as_string(aws_cloudwatch_log_stream_example.arn),
+                role_arn=Token.as_string(aws_iam_role_example.arn)
+            ),
+            inputs=KinesisAnalyticsApplicationInputs(
+                kinesis_stream=KinesisAnalyticsApplicationInputsKinesisStream(
+                    resource_arn=Token.as_string(aws_kinesis_stream_example.arn),
+                    role_arn=Token.as_string(aws_iam_role_example.arn)
+                ),
+                name_prefix="example_prefix",
+                schema=KinesisAnalyticsApplicationInputsSchema(
+                    record_columns=[KinesisAnalyticsApplicationInputsSchemaRecordColumns(
+                        name="COLUMN_1",
+                        sql_type="INTEGER"
+                    )
+                    ],
+                    record_format=KinesisAnalyticsApplicationInputsSchemaRecordFormat(
+                        mapping_parameters=KinesisAnalyticsApplicationInputsSchemaRecordFormatMappingParameters(
+                            csv=KinesisAnalyticsApplicationInputsSchemaRecordFormatMappingParametersCsv(
+                                record_column_delimiter=",",
+                                record_row_delimiter="|"
+                            )
+                        )
+                    )
+                ),
+                starting_position_configuration=[KinesisAnalyticsApplicationInputsStartingPositionConfiguration(
+                    starting_position="NOW"
+                )
+                ]
+            ),
+            name="example-application",
+            outputs=[KinesisAnalyticsApplicationOutputs(
+                kinesis_firehose=KinesisAnalyticsApplicationOutputsKinesisFirehose(
+                    resource_arn=Token.as_string(aws_kinesis_firehose_delivery_stream_example.arn),
+                    role_arn=Token.as_string(aws_iam_role_example.arn)
+                ),
+                name="OUTPUT_1",
+                schema=KinesisAnalyticsApplicationOutputsSchema(
+                    record_format_type="CSV"
+                )
+            )
+            ],
+            start_application=True
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) Name of the Kinesis Analytics Application.
+* `code` - (Optional) SQL Code to transform input data, and generate output.
+* `description` - (Optional) Description of the application.
+* `cloudwatch_logging_options` - (Optional) The CloudWatch log stream options to monitor application errors.
+See [CloudWatch Logging Options](#cloudwatch-logging-options) below for more details.
+* `inputs` - (Optional) Input configuration of the application. See [Inputs](#inputs) below for more details.
+* `outputs` - (Optional) Output destination configuration of the application. See [Outputs](#outputs) below for more details.
+* `reference_data_sources` - (Optional) An S3 Reference Data Source for the application.
+See [Reference Data Sources](#reference-data-sources) below for more details.
+* `start_application` - (Optional) Whether to start or stop the Kinesis Analytics Application. To start an application, an input with a defined `starting_position` must be configured.
+To modify an application's starting position, first stop the application by setting `start_application = false`, then update `starting_position` and set `start_application = true`.
+* `tags` - Key-value map of tags for the Kinesis Analytics Application. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### CloudWatch Logging Options
+
+Configure a CloudWatch Log Stream to monitor application errors.
+
+The `cloudwatch_logging_options` block supports the following:
+
+* `log_stream_arn` - (Required) The ARN of the CloudWatch Log Stream.
+* `role_arn` - (Required) The ARN of the IAM Role used to send application messages.
+
+### Inputs
+
+Configure an Input for the Kinesis Analytics Application. You can only have 1 Input configured.
+
+The `inputs` block supports the following:
+
+* `name_prefix` - (Required) The Name Prefix to use when creating an in-application stream.
+* `schema` - (Required) The Schema format of the data in the streaming source. See [Source Schema](#source-schema) below for more details.
+* `kinesis_firehose` - (Optional) The Kinesis Firehose configuration for the streaming source. Conflicts with `kinesis_stream`.
+See [Kinesis Firehose](#kinesis-firehose) below for more details.
+* `kinesis_stream` - (Optional) The Kinesis Stream configuration for the streaming source. Conflicts with `kinesis_firehose`.
+See [Kinesis Stream](#kinesis-stream) below for more details.
+* `parallelism` - (Optional) The number of Parallel in-application streams to create.
+See [Parallelism](#parallelism) below for more details.
+* `processing_configuration` - (Optional) The Processing Configuration to transform records as they are received from the stream.
+See [Processing Configuration](#processing-configuration) below for more details.
+* `starting_position_configuration` (Optional) The point at which the application starts processing records from the streaming source.
+See [Starting Position Configuration](#starting-position-configuration) below for more details.
+
+### Outputs
+
+Configure Output destinations for the Kinesis Analytics Application. You can have a maximum of 3 destinations configured.
+
+The `outputs` block supports the following:
+
+* `name` - (Required) The Name of the in-application stream.
+* `schema` - (Required) The Schema format of the data written to the destination. See [Destination Schema](#destination-schema) below for more details.
+* `kinesis_firehose` - (Optional) The Kinesis Firehose configuration for the destination stream. Conflicts with `kinesis_stream`.
+See [Kinesis Firehose](#kinesis-firehose) below for more details.
+* `kinesis_stream` - (Optional) The Kinesis Stream configuration for the destination stream. Conflicts with `kinesis_firehose`.
+See [Kinesis Stream](#kinesis-stream) below for more details.
+* `lambda` - (Optional) The Lambda function destination. See [Lambda](#lambda) below for more details.
+
+### Reference Data Sources
+
+Add a Reference Data Source to the Kinesis Analytics Application. You can only have 1 Reference Data Source.
+
+The `reference_data_sources` block supports the following:
+
+* `schema` - (Required) The Schema format of the data in the streaming source. See [Source Schema](#source-schema) below for more details.
+* `table_name` - (Required) The in-application Table Name.
+* `s3` - (Optional) The S3 configuration for the reference data source. See [S3 Reference](#s3-reference) below for more details.
+
+#### Kinesis Firehose
+
+Configuration for a Kinesis Firehose delivery stream.
+
+The `kinesis_firehose` block supports the following:
+
+* `resource_arn` - (Required) The ARN of the Kinesis Firehose delivery stream.
+* `role_arn` - (Required) The ARN of the IAM Role used to access the stream.
+
+#### Kinesis Stream
+
+Configuration for a Kinesis Stream.
+
+The `kinesis_stream` block supports the following:
+
+* `resource_arn` - (Required) The ARN of the Kinesis Stream.
+* `role_arn` - (Required) The ARN of the IAM Role used to access the stream.
+
+#### Destination Schema
+
+The Schema format of the data in the destination.
+
+The `schema` block supports the following:
+
+* `record_format_type` - (Required) The Format Type of the records on the output stream. Can be `CSV` or `JSON`.
+
+#### Source Schema
+
+The Schema format of the data in the streaming source.
+
+The `schema` block supports the following:
+
+* `record_columns` - (Required) The Record Column mapping for the streaming source data element.
+See [Record Columns](#record-columns) below for more details.
+* `record_format` - (Required) The Record Format and mapping information to schematize a record.
+See [Record Format](#record-format) below for more details.
+* `record_encoding` - (Optional) The Encoding of the record in the streaming source.
+
+#### Parallelism
+
+Configures the number of Parallel in-application streams to create.
+
+The `parallelism` block supports the following:
+
+* `count` - (Required) The Count of streams.
+
+#### Processing Configuration
+
+The Processing Configuration to transform records as they are received from the stream.
+
+The `processing_configuration` block supports the following:
+
+* `lambda` - (Required) The Lambda function configuration. See [Lambda](#lambda) below for more details.
+
+#### Lambda
+
+The Lambda function that pre-processes records in the stream.
+
+The `lambda` block supports the following:
+
+* `resource_arn` - (Required) The ARN of the Lambda function.
+* `role_arn` - (Required) The ARN of the IAM Role used to access the Lambda function.
+
+#### Starting Position Configuration
+
+The point at which the application reads from the streaming source.
+
+The `starting_position_configuration` block supports the following:
+
+* `starting_position` - (Required) The starting position on the stream. Valid values: `LAST_STOPPED_POINT`, `NOW`, `TRIM_HORIZON`.
+
+#### Record Columns
+
+The Column mapping of each data element in the streaming source to the corresponding column in the in-application stream.
+
+The `record_columns` block supports the following:
+
+* `name` - (Required) Name of the column.
+* `sql_type` - (Required) The SQL Type of the column.
+* `mapping` - (Optional) The Mapping reference to the data element.
+
+#### Record Format
+
+The Record Format and relevant mapping information that should be applied to schematize the records on the stream.
+
+The `record_format` block supports the following:
+
+* `record_format_type` - (Required) The type of Record Format. Can be `CSV` or `JSON`.
+* `mapping_parameters` - (Optional) The Mapping Information for the record format.
+See [Mapping Parameters](#mapping-parameters) below for more details.
+
+#### Mapping Parameters
+
+Provides Mapping information specific to the record format on the streaming source.
+
+The `mapping_parameters` block supports the following:
+
+* `csv` - (Optional) Mapping information when the record format uses delimiters.
+See [CSV Mapping Parameters](#csv-mapping-parameters) below for more details.
+* `json` - (Optional) Mapping information when JSON is the record format on the streaming source.
+See [JSON Mapping Parameters](#json-mapping-parameters) below for more details.
+
+#### CSV Mapping Parameters
+
+Mapping information when the record format uses delimiters.
+
+The `csv` block supports the following:
+
+* `record_column_delimiter` - (Required) The Column Delimiter.
+* `record_row_delimiter` - (Required) The Row Delimiter.
+
+#### JSON Mapping Parameters
+
+Mapping information when JSON is the record format on the streaming source.
+
+The `json` block supports the following:
+
+* `record_row_path` - (Required) Path to the top-level parent that contains the records.
+
+#### S3 Reference
+
+Identifies the S3 bucket and object that contains the reference data.
+
+The `s3` blcok supports the following:
+
+* `bucket_arn` - (Required) The S3 Bucket ARN.
+* `file_key` - (Required) The File Key name containing reference data.
+* `role_arn` - (Required) The IAM Role ARN to read the data.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ARN of the Kinesis Analytics Application.
+* `arn` - The ARN of the Kinesis Analytics Appliation.
+* `create_timestamp` - The Timestamp when the application version was created.
+* `last_update_timestamp` - The Timestamp when the application was last updated.
+* `status` - The Status of the application.
+* `version` - The Version of the application.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+[1]: https://docs.aws.amazon.com/kinesisanalytics/latest/dev/what-is.html
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Kinesis Analytics Application using ARN. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Kinesis Analytics Application using ARN. For example:
+
+```console
+% terraform import aws_kinesis_analytics_application.example arn:aws:kinesisanalytics:us-west-2:1234567890:application/example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-14782ea879b9f73b5ee5ad2ef9ec8d20965c88da8a7cb0cb2534adfe79bb7ca6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/kinesis_firehose_delivery_stream.html.markdown b/website/docs/cdktf/python/r/kinesis_firehose_delivery_stream.html.markdown
new file mode 100644
index 00000000000..32a473f6868
--- /dev/null
+++ b/website/docs/cdktf/python/r/kinesis_firehose_delivery_stream.html.markdown
@@ -0,0 +1,976 @@
+---
+subcategory: "Kinesis Firehose"
+layout: "aws"
+page_title: "AWS: aws_kinesis_firehose_delivery_stream"
+description: |-
+  Provides a AWS Kinesis Firehose Delivery Stream
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_kinesis_firehose_delivery_stream
+
+Provides a Kinesis Firehose Delivery Stream resource. Amazon Kinesis Firehose is a fully managed, elastic service to easily deliver real-time data streams to destinations such as Amazon S3 and Amazon Redshift.
+
+For more details, see the [Amazon Kinesis Firehose Documentation][1].
+
+## Example Usage
+
+### Extended S3 Destination
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.iam_role import IamRole
+from imports.aws.kinesis_firehose_delivery_stream import KinesisFirehoseDeliveryStream
+from imports.aws.lambda_function import LambdaFunction
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_acl import S3BucketAcl
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        bucket = S3Bucket(self, "bucket",
+            bucket="tf-test-bucket"
+        )
+        S3BucketAcl(self, "bucket_acl",
+            acl="private",
+            bucket=bucket.id
+        )
+        firehose_assume_role = DataAwsIamPolicyDocument(self, "firehose_assume_role",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["sts:AssumeRole"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["firehose.amazonaws.com"],
+                    type="Service"
+                )
+                ]
+            )
+            ]
+        )
+        lambda_assume_role = DataAwsIamPolicyDocument(self, "lambda_assume_role",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["sts:AssumeRole"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["lambda.amazonaws.com"],
+                    type="Service"
+                )
+                ]
+            )
+            ]
+        )
+        firehose_role = IamRole(self, "firehose_role",
+            assume_role_policy=Token.as_string(firehose_assume_role.json),
+            name="firehose_test_role"
+        )
+        lambda_iam = IamRole(self, "lambda_iam",
+            assume_role_policy=Token.as_string(lambda_assume_role.json),
+            name="lambda_iam"
+        )
+        lambda_processor = LambdaFunction(self, "lambda_processor",
+            filename="lambda.zip",
+            function_name="firehose_lambda_processor",
+            handler="exports.handler",
+            role=lambda_iam.arn,
+            runtime="nodejs16.x"
+        )
+        KinesisFirehoseDeliveryStream(self, "extended_s3_stream",
+            destination="extended_s3",
+            extended_s3_configuration=KinesisFirehoseDeliveryStreamExtendedS3Configuration(
+                bucket_arn=bucket.arn,
+                processing_configuration=KinesisFirehoseDeliveryStreamExtendedS3ConfigurationProcessingConfiguration(
+                    enabled=Token.as_boolean("true"),
+                    processors=[KinesisFirehoseDeliveryStreamExtendedS3ConfigurationProcessingConfigurationProcessors(
+                        parameters=[KinesisFirehoseDeliveryStreamExtendedS3ConfigurationProcessingConfigurationProcessorsParameters(
+                            parameter_name="LambdaArn",
+                            parameter_value="${" + lambda_processor.arn + "}:$LATEST"
+                        )
+                        ],
+                        type="Lambda"
+                    )
+                    ]
+                ),
+                role_arn=firehose_role.arn
+            ),
+            name="terraform-kinesis-firehose-extended-s3-test-stream"
+        )
+```
+
+### Extended S3 Destination with dynamic partitioning
+
+These examples use built-in Firehose functionality, rather than requiring a lambda.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.kinesis_firehose_delivery_stream import KinesisFirehoseDeliveryStream
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        KinesisFirehoseDeliveryStream(self, "extended_s3_stream",
+            destination="extended_s3",
+            extended_s3_configuration=KinesisFirehoseDeliveryStreamExtendedS3Configuration(
+                bucket_arn=bucket.arn,
+                buffering_size=64,
+                dynamic_partitioning_configuration=KinesisFirehoseDeliveryStreamExtendedS3ConfigurationDynamicPartitioningConfiguration(
+                    enabled=Token.as_boolean("true")
+                ),
+                error_output_prefix="errors/year=!{timestamp:yyyy}/month=!{timestamp:MM}/day=!{timestamp:dd}/hour=!{timestamp:HH}/!{firehose:error-output-type}/",
+                prefix="data/customer_id=!{partitionKeyFromQuery:customer_id}/year=!{timestamp:yyyy}/month=!{timestamp:MM}/day=!{timestamp:dd}/hour=!{timestamp:HH}/",
+                processing_configuration=KinesisFirehoseDeliveryStreamExtendedS3ConfigurationProcessingConfiguration(
+                    enabled=Token.as_boolean("true"),
+                    processors=[KinesisFirehoseDeliveryStreamExtendedS3ConfigurationProcessingConfigurationProcessors(
+                        parameters=[KinesisFirehoseDeliveryStreamExtendedS3ConfigurationProcessingConfigurationProcessorsParameters(
+                            parameter_name="SubRecordType",
+                            parameter_value="JSON"
+                        )
+                        ],
+                        type="RecordDeAggregation"
+                    ), KinesisFirehoseDeliveryStreamExtendedS3ConfigurationProcessingConfigurationProcessors(
+                        type="AppendDelimiterToRecord"
+                    ), KinesisFirehoseDeliveryStreamExtendedS3ConfigurationProcessingConfigurationProcessors(
+                        parameters=[KinesisFirehoseDeliveryStreamExtendedS3ConfigurationProcessingConfigurationProcessorsParameters(
+                            parameter_name="JsonParsingEngine",
+                            parameter_value="JQ-1.6"
+                        ), KinesisFirehoseDeliveryStreamExtendedS3ConfigurationProcessingConfigurationProcessorsParameters(
+                            parameter_name="MetadataExtractionQuery",
+                            parameter_value="{customer_id:.customer_id}"
+                        )
+                        ],
+                        type="MetadataExtraction"
+                    )
+                    ]
+                ),
+                role_arn=firehose_role.arn
+            ),
+            name="terraform-kinesis-firehose-extended-s3-test-stream"
+        )
+```
+
+Multiple Dynamic Partitioning Keys (maximum of 50) can be added by comma separating the `parameter_value`.
+
+The following example adds the Dynamic Partitioning Keys: `store_id` and `customer_id` to the S3 prefix.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.kinesis_firehose_delivery_stream import KinesisFirehoseDeliveryStream
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        KinesisFirehoseDeliveryStream(self, "extended_s3_stream",
+            destination="extended_s3",
+            extended_s3_configuration=KinesisFirehoseDeliveryStreamExtendedS3Configuration(
+                bucket_arn=bucket.arn,
+                buffering_size=64,
+                dynamic_partitioning_configuration=KinesisFirehoseDeliveryStreamExtendedS3ConfigurationDynamicPartitioningConfiguration(
+                    enabled=Token.as_boolean("true")
+                ),
+                error_output_prefix="errors/year=!{timestamp:yyyy}/month=!{timestamp:MM}/day=!{timestamp:dd}/hour=!{timestamp:HH}/!{firehose:error-output-type}/",
+                prefix="data/store_id=!{partitionKeyFromQuery:store_id}/customer_id=!{partitionKeyFromQuery:customer_id}/year=!{timestamp:yyyy}/month=!{timestamp:MM}/day=!{timestamp:dd}/hour=!{timestamp:HH}/",
+                processing_configuration=KinesisFirehoseDeliveryStreamExtendedS3ConfigurationProcessingConfiguration(
+                    enabled=Token.as_boolean("true"),
+                    processors=[KinesisFirehoseDeliveryStreamExtendedS3ConfigurationProcessingConfigurationProcessors(
+                        parameters=[KinesisFirehoseDeliveryStreamExtendedS3ConfigurationProcessingConfigurationProcessorsParameters(
+                            parameter_name="JsonParsingEngine",
+                            parameter_value="JQ-1.6"
+                        ), KinesisFirehoseDeliveryStreamExtendedS3ConfigurationProcessingConfigurationProcessorsParameters(
+                            parameter_name="MetadataExtractionQuery",
+                            parameter_value="{store_id:.store_id,customer_id:.customer_id}"
+                        )
+                        ],
+                        type="MetadataExtraction"
+                    )
+                    ]
+                ),
+                role_arn=firehose_role.arn
+            ),
+            name="terraform-kinesis-firehose-extended-s3-test-stream"
+        )
+```
+
+### Redshift Destination
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.kinesis_firehose_delivery_stream import KinesisFirehoseDeliveryStream
+from imports.aws.redshift_cluster import RedshiftCluster
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        test_cluster = RedshiftCluster(self, "test_cluster",
+            cluster_identifier="tf-redshift-cluster",
+            cluster_type="single-node",
+            database_name="test",
+            master_password="T3stPass",
+            master_username="testuser",
+            node_type="dc1.large"
+        )
+        KinesisFirehoseDeliveryStream(self, "test_stream",
+            destination="redshift",
+            name="terraform-kinesis-firehose-test-stream",
+            redshift_configuration=KinesisFirehoseDeliveryStreamRedshiftConfiguration(
+                cluster_jdbcurl="jdbc:redshift://${" + test_cluster.endpoint + "}/${" + test_cluster.database_name + "}",
+                copy_options="delimiter '|'",
+                data_table_columns="test-col",
+                data_table_name="test-table",
+                password="T3stPass",
+                role_arn=firehose_role.arn,
+                s3_backup_configuration=KinesisFirehoseDeliveryStreamRedshiftConfigurationS3BackupConfiguration(
+                    bucket_arn=bucket.arn,
+                    buffering_interval=300,
+                    buffering_size=15,
+                    compression_format="GZIP",
+                    role_arn=firehose_role.arn
+                ),
+                s3_backup_mode="Enabled",
+                s3_configuration=KinesisFirehoseDeliveryStreamRedshiftConfigurationS3Configuration(
+                    bucket_arn=bucket.arn,
+                    buffering_interval=400,
+                    buffering_size=10,
+                    compression_format="GZIP",
+                    role_arn=firehose_role.arn
+                ),
+                username="testuser"
+            )
+        )
+```
+
+### Elasticsearch Destination
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.elasticsearch_domain import ElasticsearchDomain
+from imports.aws.kinesis_firehose_delivery_stream import KinesisFirehoseDeliveryStream
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        test_cluster = ElasticsearchDomain(self, "test_cluster",
+            domain_name="firehose-es-test"
+        )
+        KinesisFirehoseDeliveryStream(self, "test_stream",
+            destination="elasticsearch",
+            elasticsearch_configuration=KinesisFirehoseDeliveryStreamElasticsearchConfiguration(
+                domain_arn=test_cluster.arn,
+                index_name="test",
+                processing_configuration=KinesisFirehoseDeliveryStreamElasticsearchConfigurationProcessingConfiguration(
+                    enabled=Token.as_boolean("true"),
+                    processors=[KinesisFirehoseDeliveryStreamElasticsearchConfigurationProcessingConfigurationProcessors(
+                        parameters=[KinesisFirehoseDeliveryStreamElasticsearchConfigurationProcessingConfigurationProcessorsParameters(
+                            parameter_name="LambdaArn",
+                            parameter_value="${" + lambda_processor.arn + "}:$LATEST"
+                        )
+                        ],
+                        type="Lambda"
+                    )
+                    ]
+                ),
+                role_arn=firehose_role.arn,
+                s3_configuration=KinesisFirehoseDeliveryStreamElasticsearchConfigurationS3Configuration(
+                    bucket_arn=bucket.arn,
+                    buffering_interval=400,
+                    buffering_size=10,
+                    compression_format="GZIP",
+                    role_arn=firehose_role.arn
+                ),
+                type_name="test"
+            ),
+            name="terraform-kinesis-firehose-test-stream"
+        )
+```
+
+### Elasticsearch Destination With VPC
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.elasticsearch_domain import ElasticsearchDomain
+from imports.aws.iam_role_policy import IamRolePolicy
+from imports.aws.kinesis_firehose_delivery_stream import KinesisFirehoseDeliveryStream
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        test_cluster = ElasticsearchDomain(self, "test_cluster",
+            cluster_config=ElasticsearchDomainClusterConfig(
+                instance_count=2,
+                instance_type="t2.small.elasticsearch",
+                zone_awareness_enabled=True
+            ),
+            domain_name="es-test",
+            ebs_options=ElasticsearchDomainEbsOptions(
+                ebs_enabled=True,
+                volume_size=10
+            ),
+            vpc_options=ElasticsearchDomainVpcOptions(
+                security_group_ids=[first.id],
+                subnet_ids=[Token.as_string(aws_subnet_first.id), second.id]
+            )
+        )
+        firehose_elasticsearch = DataAwsIamPolicyDocument(self, "firehose-elasticsearch",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["es:*"],
+                effect="Allow",
+                resources=[test_cluster.arn, "${" + test_cluster.arn + "}/*"]
+            ), DataAwsIamPolicyDocumentStatement(
+                actions=["ec2:DescribeVpcs", "ec2:DescribeVpcAttribute", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "ec2:DescribeNetworkInterfaces", "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterface"
+                ],
+                effect="Allow",
+                resources=["*"]
+            )
+            ]
+        )
+        aws_iam_role_policy_firehose_elasticsearch = IamRolePolicy(self, "firehose-elasticsearch_2",
+            name="elasticsearch",
+            policy=Token.as_string(firehose_elasticsearch.json),
+            role=firehose.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_role_policy_firehose_elasticsearch.override_logical_id("firehose-elasticsearch")
+        KinesisFirehoseDeliveryStream(self, "test",
+            depends_on=[aws_iam_role_policy_firehose_elasticsearch],
+            destination="elasticsearch",
+            elasticsearch_configuration=KinesisFirehoseDeliveryStreamElasticsearchConfiguration(
+                domain_arn=test_cluster.arn,
+                index_name="test",
+                role_arn=firehose.arn,
+                s3_configuration=KinesisFirehoseDeliveryStreamElasticsearchConfigurationS3Configuration(
+                    bucket_arn=bucket.arn,
+                    role_arn=firehose.arn
+                ),
+                type_name="test",
+                vpc_config=KinesisFirehoseDeliveryStreamElasticsearchConfigurationVpcConfig(
+                    role_arn=firehose.arn,
+                    security_group_ids=[first.id],
+                    subnet_ids=[Token.as_string(aws_subnet_first.id), second.id]
+                )
+            ),
+            name="terraform-kinesis-firehose-es"
+        )
+```
+
+### OpenSearch Destination
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.kinesis_firehose_delivery_stream import KinesisFirehoseDeliveryStream
+from imports.aws.opensearch_domain import OpensearchDomain
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        test_cluster = OpensearchDomain(self, "test_cluster",
+            domain_name="firehose-os-test"
+        )
+        KinesisFirehoseDeliveryStream(self, "test_stream",
+            destination="opensearch",
+            name="terraform-kinesis-firehose-test-stream",
+            opensearch_configuration=KinesisFirehoseDeliveryStreamOpensearchConfiguration(
+                domain_arn=test_cluster.arn,
+                index_name="test",
+                processing_configuration=KinesisFirehoseDeliveryStreamOpensearchConfigurationProcessingConfiguration(
+                    enabled=Token.as_boolean("true"),
+                    processors=[KinesisFirehoseDeliveryStreamOpensearchConfigurationProcessingConfigurationProcessors(
+                        parameters=[KinesisFirehoseDeliveryStreamOpensearchConfigurationProcessingConfigurationProcessorsParameters(
+                            parameter_name="LambdaArn",
+                            parameter_value="${" + lambda_processor.arn + "}:$LATEST"
+                        )
+                        ],
+                        type="Lambda"
+                    )
+                    ]
+                ),
+                role_arn=firehose_role.arn,
+                s3_configuration=KinesisFirehoseDeliveryStreamOpensearchConfigurationS3Configuration(
+                    bucket_arn=bucket.arn,
+                    buffering_interval=400,
+                    buffering_size=10,
+                    compression_format="GZIP",
+                    role_arn=firehose_role.arn
+                )
+            )
+        )
+```
+
+### OpenSearch Destination With VPC
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.iam_role_policy import IamRolePolicy
+from imports.aws.kinesis_firehose_delivery_stream import KinesisFirehoseDeliveryStream
+from imports.aws.opensearch_domain import OpensearchDomain
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        test_cluster = OpensearchDomain(self, "test_cluster",
+            cluster_config=OpensearchDomainClusterConfig(
+                instance_count=2,
+                instance_type="m4.large.search",
+                zone_awareness_enabled=True
+            ),
+            domain_name="es-test",
+            ebs_options=OpensearchDomainEbsOptions(
+                ebs_enabled=True,
+                volume_size=10
+            ),
+            vpc_options=OpensearchDomainVpcOptions(
+                security_group_ids=[first.id],
+                subnet_ids=[Token.as_string(aws_subnet_first.id), second.id]
+            )
+        )
+        firehose_opensearch = IamRolePolicy(self, "firehose-opensearch",
+            name="opensearch",
+            policy="{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Effect\": \"Allow\",\n      \"Action\": [\n        \"es:*\"\n      ],\n      \"Resource\": [\n        \"${" + test_cluster.arn + "}\",\n        \"${" + test_cluster.arn + "}/*\"\n      ]\n        },\n        {\n          \"Effect\": \"Allow\",\n          \"Action\": [\n            \"ec2:DescribeVpcs\",\n            \"ec2:DescribeVpcAttribute\",\n            \"ec2:DescribeSubnets\",\n            \"ec2:DescribeSecurityGroups\",\n            \"ec2:DescribeNetworkInterfaces\",\n            \"ec2:CreateNetworkInterface\",\n            \"ec2:CreateNetworkInterfacePermission\",\n            \"ec2:DeleteNetworkInterface\"\n          ],\n          \"Resource\": [\n            \"*\"\n          ]\n        }\n  ]\n}\n\n",
+            role=firehose.id
+        )
+        KinesisFirehoseDeliveryStream(self, "test",
+            depends_on=[firehose_opensearch],
+            destination="opensearch",
+            name="terraform-kinesis-firehose-os",
+            opensearch_configuration=KinesisFirehoseDeliveryStreamOpensearchConfiguration(
+                domain_arn=test_cluster.arn,
+                index_name="test",
+                role_arn=firehose.arn,
+                s3_configuration=KinesisFirehoseDeliveryStreamOpensearchConfigurationS3Configuration(
+                    bucket_arn=bucket.arn,
+                    role_arn=firehose.arn
+                ),
+                vpc_config=KinesisFirehoseDeliveryStreamOpensearchConfigurationVpcConfig(
+                    role_arn=firehose.arn,
+                    security_group_ids=[first.id],
+                    subnet_ids=[Token.as_string(aws_subnet_first.id), second.id]
+                )
+            )
+        )
+```
+
+### OpenSearch Serverless Destination
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.kinesis_firehose_delivery_stream import KinesisFirehoseDeliveryStream
+from imports.aws.opensearchserverless_collection import OpensearchserverlessCollection
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        test_collection = OpensearchserverlessCollection(self, "test_collection",
+            name="firehose-osserverless-test"
+        )
+        KinesisFirehoseDeliveryStream(self, "test_stream",
+            destination="opensearchserverless",
+            name="terraform-kinesis-firehose-test-stream",
+            opensearchserverless_configuration=KinesisFirehoseDeliveryStreamOpensearchserverlessConfiguration(
+                collection_endpoint=test_collection.collection_endpoint,
+                index_name="test",
+                processing_configuration=KinesisFirehoseDeliveryStreamOpensearchserverlessConfigurationProcessingConfiguration(
+                    enabled=Token.as_boolean("true"),
+                    processors=[KinesisFirehoseDeliveryStreamOpensearchserverlessConfigurationProcessingConfigurationProcessors(
+                        parameters=[KinesisFirehoseDeliveryStreamOpensearchserverlessConfigurationProcessingConfigurationProcessorsParameters(
+                            parameter_name="LambdaArn",
+                            parameter_value="${" + lambda_processor.arn + "}:$LATEST"
+                        )
+                        ],
+                        type="Lambda"
+                    )
+                    ]
+                ),
+                role_arn=firehose_role.arn,
+                s3_configuration=KinesisFirehoseDeliveryStreamOpensearchserverlessConfigurationS3Configuration(
+                    bucket_arn=bucket.arn,
+                    buffering_interval=400,
+                    buffering_size=10,
+                    compression_format="GZIP",
+                    role_arn=firehose_role.arn
+                )
+            )
+        )
+```
+
+### Splunk Destination
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.kinesis_firehose_delivery_stream import KinesisFirehoseDeliveryStream
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        KinesisFirehoseDeliveryStream(self, "test_stream",
+            destination="splunk",
+            name="terraform-kinesis-firehose-test-stream",
+            splunk_configuration=KinesisFirehoseDeliveryStreamSplunkConfiguration(
+                hec_acknowledgment_timeout=600,
+                hec_endpoint="https://http-inputs-mydomain.splunkcloud.com:443",
+                hec_endpoint_type="Event",
+                hec_token="51D4DA16-C61B-4F5F-8EC7-ED4301342A4A",
+                s3_backup_mode="FailedEventsOnly",
+                s3_configuration=KinesisFirehoseDeliveryStreamSplunkConfigurationS3Configuration(
+                    bucket_arn=bucket.arn,
+                    buffering_interval=400,
+                    buffering_size=10,
+                    compression_format="GZIP",
+                    role_arn=firehose.arn
+                )
+            )
+        )
+```
+
+### HTTP Endpoint (e.g., New Relic) Destination
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.kinesis_firehose_delivery_stream import KinesisFirehoseDeliveryStream
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        KinesisFirehoseDeliveryStream(self, "test_stream",
+            destination="http_endpoint",
+            http_endpoint_configuration=KinesisFirehoseDeliveryStreamHttpEndpointConfiguration(
+                access_key="my-key",
+                buffering_interval=600,
+                buffering_size=15,
+                name="New Relic",
+                request_configuration=KinesisFirehoseDeliveryStreamHttpEndpointConfigurationRequestConfiguration(
+                    common_attributes=[KinesisFirehoseDeliveryStreamHttpEndpointConfigurationRequestConfigurationCommonAttributes(
+                        name="testname",
+                        value="testvalue"
+                    ), KinesisFirehoseDeliveryStreamHttpEndpointConfigurationRequestConfigurationCommonAttributes(
+                        name="testname2",
+                        value="testvalue2"
+                    )
+                    ],
+                    content_encoding="GZIP"
+                ),
+                role_arn=firehose.arn,
+                s3_backup_mode="FailedDataOnly",
+                s3_configuration=KinesisFirehoseDeliveryStreamHttpEndpointConfigurationS3Configuration(
+                    bucket_arn=bucket.arn,
+                    buffering_interval=400,
+                    buffering_size=10,
+                    compression_format="GZIP",
+                    role_arn=firehose.arn
+                ),
+                url="https://aws-api.newrelic.com/firehose/v1"
+            ),
+            name="terraform-kinesis-firehose-test-stream"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) A name to identify the stream. This is unique to the AWS account and region the Stream is created in. When using for WAF logging, name must be prefixed with `aws-waf-logs-`. See [AWS Documentation](https://docs.aws.amazon.com/waf/latest/developerguide/waf-policies.html#waf-policies-logging-config) for more details.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `kinesis_source_configuration` - (Optional) The stream and role Amazon Resource Names (ARNs) for a Kinesis data stream used as the source for a delivery stream. More details are given below.
+* `msk_source_configuration` - (Optional) The configuration for the Amazon MSK cluster to be used as the source for a delivery stream. More details are given below.
+* `server_side_encryption` - (Optional) Encrypt at rest options.
+Server-side encryption should not be enabled when a kinesis stream is configured as the source of the firehose delivery stream.
+* `destination` – (Required) This is the destination to where the data is delivered. The only options are `s3` (Deprecated, use `extended_s3` instead), `extended_s3`, `redshift`, `elasticsearch`, `splunk`, `http_endpoint`, `opensearch` and `opensearchserverless`.
+is redshift). More details are given below.
+* `elasticsearch_configuration` - (Optional) Configuration options when `destination` is `elasticsearch`. More details are given below.
+* `extended_s3_configuration` - (Optional, only Required when `destination` is `extended_s3`) Enhanced configuration options for the s3 destination. More details are given below.
+* `http_endpoint_configuration` - (Optional) Configuration options when `destination` is `http_endpoint`. Requires the user to also specify an `s3_configuration` block.  More details are given below.
+* `opensearch_configuration` - (Optional) Configuration options when `destination` is `opensearch`. More details are given below.
+* `opensearchserverless_configuration` - (Optional) Configuration options when `destination` is `opensearchserverless`. More details are given below.
+* `redshift_configuration` - (Optional) Configuration options when `destination` is `redshift`. Requires the user to also specify an `s3_configuration` block. More details are given below.
+* `splunk_configuration` - (Optional) Configuration options when `destination` is `splunk`. More details are given below.
+
+The `kinesis_source_configuration` object supports the following:
+
+* `kinesis_stream_arn` - (Required) The kinesis stream used as the source of the firehose delivery stream.
+* `role_arn` - (Required) The ARN of the role that provides access to the source Kinesis stream.
+
+The `msk_source_configuration` object supports the following:
+
+* `authentication_configuration` - (Required) The authentication configuration of the Amazon MSK cluster. More details are given below.
+* `msk_cluster_arn` - (Required) The ARN of the Amazon MSK cluster.
+* `topic_name` - (Required) The topic name within the Amazon MSK cluster.
+
+The `authentication_configuration` object supports the following:
+
+* `connectivity` - (Required) The type of connectivity used to access the Amazon MSK cluster. Valid values: `PUBLIC`, `PRIVATE`.
+* `role_arn` - (Required) The ARN of the role used to access the Amazon MSK cluster.
+
+The `server_side_encryption` object supports the following:
+
+* `enabled` - (Optional) Whether to enable encryption at rest. Default is `false`.
+* `key_type`- (Optional) Type of encryption key. Default is `AWS_OWNED_CMK`. Valid values are `AWS_OWNED_CMK` and `CUSTOMER_MANAGED_CMK`
+* `key_arn` - (Optional) Amazon Resource Name (ARN) of the encryption key. Required when `key_type` is `CUSTOMER_MANAGED_CMK`.
+
+The `extended_s3_configuration` object supports the same fields from [s3_configuration](#s3-configuration) as well as the following:
+
+* `data_format_conversion_configuration` - (Optional) Nested argument for the serializer, deserializer, and schema for converting data from the JSON format to the Parquet or ORC format before writing it to Amazon S3. More details given below.
+* `processing_configuration` - (Optional) The data processing configuration.  More details are given below.
+* `s3_backup_mode` - (Optional) The Amazon S3 backup mode.  Valid values are `Disabled` and `Enabled`.  Default value is `Disabled`.
+* `s3_backup_configuration` - (Optional) The configuration for backup in Amazon S3. Required if `s3_backup_mode` is `Enabled`. Supports the same fields as `s3_configuration` object.
+* `dynamic_partitioning_configuration` - (Optional) The configuration for dynamic partitioning. See [Dynamic Partitioning Configuration](#dynamic_partitioning_configuration) below for more details. Required when using dynamic partitioning.
+
+The `redshift_configuration` object supports the following:
+
+* `cluster_jdbcurl` - (Required) The jdbcurl of the redshift cluster.
+* `username` - (Required) The username that the firehose delivery stream will assume. It is strongly recommended that the username and password provided is used exclusively for Amazon Kinesis Firehose purposes, and that the permissions for the account are restricted for Amazon Redshift INSERT permissions.
+* `password` - (Required) The password for the username above.
+* `retry_duration` - (Optional) The length of time during which Firehose retries delivery after a failure, starting from the initial request and including the first attempt. The default value is 3600 seconds (60 minutes). Firehose does not retry if the value of DurationInSeconds is 0 (zero) or if the first delivery attempt takes longer than the current value.
+* `role_arn` - (Required) The arn of the role the stream assumes.
+* `s3_configuration` - (Required) The S3 Configuration. See [s3_configuration](#s3-configuration) for more details.
+* `s3_backup_mode` - (Optional) The Amazon S3 backup mode.  Valid values are `Disabled` and `Enabled`.  Default value is `Disabled`.
+* `s3_backup_configuration` - (Optional) The configuration for backup in Amazon S3. Required if `s3_backup_mode` is `Enabled`. Supports the same fields as `s3_configuration` object.
+* `data_table_name` - (Required) The name of the table in the redshift cluster that the s3 bucket will copy to.
+* `copy_options` - (Optional) Copy options for copying the data from the s3 intermediate bucket into redshift, for example to change the default delimiter. For valid values, see the [AWS documentation](http://docs.aws.amazon.com/firehose/latest/APIReference/API_CopyCommand.html)
+* `data_table_columns` - (Optional) The data table columns that will be targeted by the copy command.
+* `cloudwatch_logging_options` - (Optional) The CloudWatch Logging Options for the delivery stream. More details are given below
+* `processing_configuration` - (Optional) The data processing configuration.  More details are given below.
+
+The `elasticsearch_configuration` object supports the following:
+
+* `buffering_interval` - (Optional) Buffer incoming data for the specified period of time, in seconds between 60 to 900, before delivering it to the destination.  The default value is 300s.
+* `buffering_size` - (Optional) Buffer incoming data to the specified size, in MBs between 1 to 100, before delivering it to the destination.  The default value is 5MB.
+* `domain_arn` - (Optional) The ARN of the Amazon ES domain.  The pattern needs to be `arn:.*`.  Conflicts with `cluster_endpoint`.
+* `cluster_endpoint` - (Optional) The endpoint to use when communicating with the cluster. Conflicts with `domain_arn`.
+* `index_name` - (Required) The Elasticsearch index name.
+* `index_rotation_period` - (Optional) The Elasticsearch index rotation period.  Index rotation appends a timestamp to the IndexName to facilitate expiration of old data.  Valid values are `NoRotation`, `OneHour`, `OneDay`, `OneWeek`, and `OneMonth`.  The default value is `OneDay`.
+* `retry_duration` - (Optional) After an initial failure to deliver to Amazon Elasticsearch, the total amount of time, in seconds between 0 to 7200, during which Firehose re-attempts delivery (including the first attempt).  After this time has elapsed, the failed documents are written to Amazon S3.  The default value is 300s.  There will be no retry if the value is 0.
+* `role_arn` - (Required) The ARN of the IAM role to be assumed by Firehose for calling the Amazon ES Configuration API and for indexing documents.  The IAM role must have permission for `DescribeElasticsearchDomain`, `DescribeElasticsearchDomains`, and `DescribeElasticsearchDomainConfig`.  The pattern needs to be `arn:.*`.
+* `s3_configuration` - (Required) The S3 Configuration. See [s3_configuration](#s3-configuration) for more details.
+* `s3_backup_mode` - (Optional) Defines how documents should be delivered to Amazon S3.  Valid values are `FailedDocumentsOnly` and `AllDocuments`.  Default value is `FailedDocumentsOnly`.
+* `type_name` - (Optional) The Elasticsearch type name with maximum length of 100 characters.
+* `cloudwatch_logging_options` - (Optional) The CloudWatch Logging Options for the delivery stream. More details are given below
+* `vpc_config` - (Optional) The VPC configuration for the delivery stream to connect to Elastic Search associated with the VPC. More details are given below
+* `processing_configuration` - (Optional) The data processing configuration.  More details are given below.
+
+The `opensearch_configuration` object supports the following:
+
+* `buffering_interval` - (Optional) Buffer incoming data for the specified period of time, in seconds between 60 to 900, before delivering it to the destination.  The default value is 300s.
+* `buffering_size` - (Optional) Buffer incoming data to the specified size, in MBs between 1 to 100, before delivering it to the destination.  The default value is 5MB.
+* `domain_arn` - (Optional) The ARN of the Amazon ES domain.  The pattern needs to be `arn:.*`.  Conflicts with `cluster_endpoint`.
+* `cluster_endpoint` - (Optional) The endpoint to use when communicating with the cluster. Conflicts with `domain_arn`.
+* `index_name` - (Required) The OpenSearch index name.
+* `index_rotation_period` - (Optional) The OpenSearch index rotation period.  Index rotation appends a timestamp to the IndexName to facilitate expiration of old data.  Valid values are `NoRotation`, `OneHour`, `OneDay`, `OneWeek`, and `OneMonth`.  The default value is `OneDay`.
+* `retry_duration` - (Optional) After an initial failure to deliver to Amazon OpenSearch, the total amount of time, in seconds between 0 to 7200, during which Firehose re-attempts delivery (including the first attempt).  After this time has elapsed, the failed documents are written to Amazon S3.  The default value is 300s.  There will be no retry if the value is 0.
+* `role_arn` - (Required) The ARN of the IAM role to be assumed by Firehose for calling the Amazon ES Configuration API and for indexing documents.  The IAM role must have permission for `DescribeDomain`, `DescribeDomains`, and `DescribeDomainConfig`.  The pattern needs to be `arn:.*`.
+* `s3_configuration` - (Required) The S3 Configuration. See [s3_configuration](#s3-configuration) for more details.
+* `s3_backup_mode` - (Optional) Defines how documents should be delivered to Amazon S3.  Valid values are `FailedDocumentsOnly` and `AllDocuments`.  Default value is `FailedDocumentsOnly`.
+* `type_name` - (Optional) The Elasticsearch type name with maximum length of 100 characters. Types are deprecated in OpenSearch_1.1. TypeName must be empty.
+* `cloudwatch_logging_options` - (Optional) The CloudWatch Logging Options for the delivery stream. More details are given below
+* `vpc_config` - (Optional) The VPC configuration for the delivery stream to connect to OpenSearch associated with the VPC. More details are given below
+* `processing_configuration` - (Optional) The data processing configuration.  More details are given below.
+
+The `opensearchserverless_configuration` object supports the following:
+
+* `buffering_interval` - (Optional) Buffer incoming data for the specified period of time, in seconds between 60 to 900, before delivering it to the destination.  The default value is 300s.
+* `buffering_size` - (Optional) Buffer incoming data to the specified size, in MBs between 1 to 100, before delivering it to the destination.  The default value is 5MB.
+* `collection_endpoint` - (Required) The endpoint to use when communicating with the collection in the Serverless offering for Amazon OpenSearch Service.
+* `index_name` - (Required) The Serverless offering for Amazon OpenSearch Service index name.
+* `retry_duration` - (Optional) After an initial failure to deliver to the Serverless offering for Amazon OpenSearch Service, the total amount of time, in seconds between 0 to 7200, during which Kinesis Data Firehose retries delivery (including the first attempt).  After this time has elapsed, the failed documents are written to Amazon S3.  The default value is 300s.  There will be no retry if the value is 0.
+* `role_arn` - (Required) The Amazon Resource Name (ARN) of the IAM role to be assumed by Kinesis Data Firehose for calling the Serverless offering for Amazon OpenSearch Service Configuration API and for indexing documents.  The pattern needs to be `arn:.*`.
+* `s3_configuration` - (Required) The S3 Configuration. See [s3_configuration](#s3-configuration) for more details.
+* `s3_backup_mode` - (Optional) Defines how documents should be delivered to Amazon S3.  Valid values are `FailedDocumentsOnly` and `AllDocuments`.  Default value is `FailedDocumentsOnly`.
+* `cloudwatch_logging_options` - (Optional) The CloudWatch Logging Options for the delivery stream. More details are given below
+* `vpc_config` - (Optional) The VPC configuration for the delivery stream to connect to OpenSearch Serverless associated with the VPC. More details are given below
+* `processing_configuration` - (Optional) The data processing configuration.  More details are given below.
+
+The `splunk_configuration` objects supports the following:
+
+* `hec_acknowledgment_timeout` - (Optional) The amount of time, in seconds between 180 and 600, that Kinesis Firehose waits to receive an acknowledgment from Splunk after it sends it data.
+* `hec_endpoint` - (Required) The HTTP Event Collector (HEC) endpoint to which Kinesis Firehose sends your data.
+* `hec_endpoint_type` - (Optional) The HEC endpoint type. Valid values are `Raw` or `Event`. The default value is `Raw`.
+* `hec_token` - (Required) The GUID that you obtain from your Splunk cluster when you create a new HEC endpoint.
+* `s3_configuration` - (Required) The S3 Configuration. See [s3_configuration](#s3-configuration) for more details.
+* `s3_backup_mode` - (Optional) Defines how documents should be delivered to Amazon S3.  Valid values are `FailedEventsOnly` and `AllEvents`.  Default value is `FailedEventsOnly`.
+* `retry_duration` - (Optional) After an initial failure to deliver to Splunk, the total amount of time, in seconds between 0 to 7200, during which Firehose re-attempts delivery (including the first attempt).  After this time has elapsed, the failed documents are written to Amazon S3.  The default value is 300s.  There will be no retry if the value is 0.
+* `cloudwatch_logging_options` - (Optional) The CloudWatch Logging Options for the delivery stream. More details are given below.
+* `processing_configuration` - (Optional) The data processing configuration.  More details are given below.
+
+The `http_endpoint_configuration` objects supports the following:
+
+* `url` - (Required) The HTTP endpoint URL to which Kinesis Firehose sends your data.
+* `name` - (Optional) The HTTP endpoint name.
+* `access_key` - (Optional) The access key required for Kinesis Firehose to authenticate with the HTTP endpoint selected as the destination.
+* `role_arn` - (Required) Kinesis Data Firehose uses this IAM role for all the permissions that the delivery stream needs. The pattern needs to be `arn:.*`.
+* `s3_configuration` - (Required) The S3 Configuration. See [s3_configuration](#s3-configuration) for more details.
+* `s3_backup_mode` - (Optional) Defines how documents should be delivered to Amazon S3.  Valid values are `FailedDataOnly` and `AllData`.  Default value is `FailedDataOnly`.
+* `buffering_size` - (Optional) Buffer incoming data to the specified size, in MBs, before delivering it to the destination. The default value is 5.
+* `buffering_interval` - (Optional) Buffer incoming data for the specified period of time, in seconds, before delivering it to the destination. The default value is 300 (5 minutes).
+* `cloudwatch_logging_options` - (Optional) The CloudWatch Logging Options for the delivery stream. More details are given below.
+* `processing_configuration` - (Optional) The data processing configuration.  More details are given below.
+* `request_configuration` - (Optional) The request configuration.  More details are given below.
+* `retry_duration` - (Optional) Total amount of seconds Firehose spends on retries. This duration starts after the initial attempt fails, It does not include the time periods during which Firehose waits for acknowledgment from the specified destination after each attempt. Valid values between `0` and `7200`. Default is `300`.
+
+The `cloudwatch_logging_options` object supports the following:
+
+* `enabled` - (Optional) Enables or disables the logging. Defaults to `false`.
+* `log_group_name` - (Optional) The CloudWatch group name for logging. This value is required if `enabled` is true.
+* `log_stream_name` - (Optional) The CloudWatch log stream name for logging. This value is required if `enabled` is true.
+
+The `processing_configuration` object supports the following:
+
+* `enabled` - (Optional) Enables or disables data processing.
+* `processors` - (Optional) Array of data processors. More details are given below
+
+The `processors` array objects support the following:
+
+* `type` - (Required) The type of processor. Valid Values: `RecordDeAggregation`, `Lambda`, `MetadataExtraction`, `AppendDelimiterToRecord`. Validation is done against [AWS SDK constants](https://docs.aws.amazon.com/sdk-for-go/api/service/firehose/#pkg-constants); so that values not explicitly listed may also work.
+* `parameters` - (Optional) Array of processor parameters. More details are given below
+
+The `parameters` array objects support the following:
+
+* `parameter_name` - (Required) Parameter name. Valid Values: `LambdaArn`, `NumberOfRetries`, `MetadataExtractionQuery`, `JsonParsingEngine`, `RoleArn`, `BufferSizeInMBs`, `BufferIntervalInSeconds`, `SubRecordType`, `Delimiter`. Validation is done against [AWS SDK constants](https://docs.aws.amazon.com/sdk-for-go/api/service/firehose/#pkg-constants); so that values not explicitly listed may also work.
+* `parameter_value` - (Required) Parameter value. Must be between 1 and 512 length (inclusive). When providing a Lambda ARN, you should specify the resource version as well.
+
+~> **NOTE:** Parameters with default values, including `NumberOfRetries`(default: 3), `RoleArn`(default: firehose role ARN), `BufferSizeInMBs`(default: 3), and `BufferIntervalInSeconds`(default: 60), are not stored in terraform state. To prevent perpetual differences, it is therefore recommended to only include parameters with non-default values.
+
+The `request_configuration` object supports the following:
+
+* `content_encoding` - (Optional) Kinesis Data Firehose uses the content encoding to compress the body of a request before sending the request to the destination. Valid values are `NONE` and `GZIP`.  Default value is `NONE`.
+* `common_attributes` - (Optional) Describes the metadata sent to the HTTP endpoint destination. More details are given below
+
+The `common_attributes` array objects support the following:
+
+* `name` - (Required) The name of the HTTP endpoint common attribute.
+* `value` - (Required) The value of the HTTP endpoint common attribute.
+
+The `vpc_config` object supports the following:
+
+* `subnet_ids` - (Required) A list of subnet IDs to associate with Kinesis Firehose.
+* `security_group_ids` - (Required) A list of security group IDs to associate with Kinesis Firehose.
+* `role_arn` - (Required) The ARN of the IAM role to be assumed by Firehose for calling the Amazon EC2 configuration API and for creating network interfaces. Make sure role has necessary [IAM permissions](https://docs.aws.amazon.com/firehose/latest/dev/controlling-access.html#using-iam-es-vpc)
+
+### data_format_conversion_configuration
+
+~> **NOTE:** Once configured, the data format conversion configuration can only be disabled, in which the configuration values will remain, but will not be active. It is not currently possible to completely remove the configuration without recreating the resource.
+
+Example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.kinesis_firehose_delivery_stream import KinesisFirehoseDeliveryStream
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, bucketArn, roleArn, destination, name):
+        super().__init__(scope, name)
+        KinesisFirehoseDeliveryStream(self, "example",
+            extended_s3_configuration=KinesisFirehoseDeliveryStreamExtendedS3Configuration(
+                buffering_size=128,
+                data_format_conversion_configuration=KinesisFirehoseDeliveryStreamExtendedS3ConfigurationDataFormatConversionConfiguration(
+                    input_format_configuration=KinesisFirehoseDeliveryStreamExtendedS3ConfigurationDataFormatConversionConfigurationInputFormatConfiguration(
+                        deserializer=KinesisFirehoseDeliveryStreamExtendedS3ConfigurationDataFormatConversionConfigurationInputFormatConfigurationDeserializer(
+                            hive_json_ser_de=KinesisFirehoseDeliveryStreamExtendedS3ConfigurationDataFormatConversionConfigurationInputFormatConfigurationDeserializerHiveJsonSerDe()
+                        )
+                    ),
+                    output_format_configuration=KinesisFirehoseDeliveryStreamExtendedS3ConfigurationDataFormatConversionConfigurationOutputFormatConfiguration(
+                        serializer=KinesisFirehoseDeliveryStreamExtendedS3ConfigurationDataFormatConversionConfigurationOutputFormatConfigurationSerializer(
+                            orc_ser_de=KinesisFirehoseDeliveryStreamExtendedS3ConfigurationDataFormatConversionConfigurationOutputFormatConfigurationSerializerOrcSerDe()
+                        )
+                    ),
+                    schema_configuration=KinesisFirehoseDeliveryStreamExtendedS3ConfigurationDataFormatConversionConfigurationSchemaConfiguration(
+                        database_name=Token.as_string(aws_glue_catalog_table_example.database_name),
+                        role_arn=Token.as_string(aws_iam_role_example.arn),
+                        table_name=Token.as_string(aws_glue_catalog_table_example.name)
+                    )
+                ),
+                bucket_arn=bucket_arn,
+                role_arn=role_arn
+            ),
+            destination=destination,
+            name=name
+        )
+```
+
+* `input_format_configuration` - (Required) Nested argument that specifies the deserializer that you want Kinesis Data Firehose to use to convert the format of your data from JSON. More details below.
+* `output_format_configuration` - (Required) Nested argument that specifies the serializer that you want Kinesis Data Firehose to use to convert the format of your data to the Parquet or ORC format. More details below.
+* `schema_configuration` - (Required) Nested argument that specifies the AWS Glue Data Catalog table that contains the column information. More details below.
+* `enabled` - (Optional) Defaults to `true`. Set it to `false` if you want to disable format conversion while preserving the configuration details.
+
+#### S3 Configuration
+
+* `role_arn` - (Required) The ARN of the AWS credentials.
+* `bucket_arn` - (Required) The ARN of the S3 bucket
+* `prefix` - (Optional) The "YYYY/MM/DD/HH" time format prefix is automatically used for delivered S3 files. You can specify an extra prefix to be added in front of the time format prefix. Note that if the prefix ends with a slash, it appears as a folder in the S3 bucket
+* `buffering_size` - (Optional) Buffer incoming data to the specified size, in MBs, before delivering it to the destination. The default value is 5.
+  We recommend setting SizeInMBs to a value greater than the amount of data you typically ingest into the delivery stream in 10 seconds. For example, if you typically ingest data at 1 MB/sec set SizeInMBs to be 10 MB or higher.
+* `buffering_interval` - (Optional) Buffer incoming data for the specified period of time, in seconds, before delivering it to the destination. The default value is 300.
+* `compression_format` - (Optional) The compression format. If no value is specified, the default is `UNCOMPRESSED`. Other supported values are `GZIP`, `ZIP`, `Snappy`, & `HADOOP_SNAPPY`.
+* `error_output_prefix` - (Optional) Prefix added to failed records before writing them to S3. Not currently supported for `redshift` destination. This prefix appears immediately following the bucket name. For information about how to specify this prefix, see [Custom Prefixes for Amazon S3 Objects](https://docs.aws.amazon.com/firehose/latest/dev/s3-prefixes.html).
+* `kms_key_arn` - (Optional) Specifies the KMS key ARN the stream will use to encrypt data. If not set, no encryption will
+  be used.
+* `cloudwatch_logging_options` - (Optional) The CloudWatch Logging Options for the delivery stream. More details are given below
+
+#### input_format_configuration
+
+* `deserializer` - (Required) Nested argument that specifies which deserializer to use. You can choose either the Apache Hive JSON SerDe or the OpenX JSON SerDe. More details below.
+
+##### deserializer
+
+~> **NOTE:** One of the deserializers must be configured. If no nested configuration needs to occur simply declare as `XXX_json_ser_de = []` or `XXX_json_ser_de {}`.
+
+* `hive_json_ser_de` - (Optional) Nested argument that specifies the native Hive / HCatalog JsonSerDe. More details below.
+* `open_x_json_ser_de` - (Optional) Nested argument that specifies the OpenX SerDe. More details below.
+
+###### hive_json_ser_de
+
+* `timestamp_formats` - (Optional) A list of how you want Kinesis Data Firehose to parse the date and time stamps that may be present in your input data JSON. To specify these format strings, follow the pattern syntax of JodaTime's DateTimeFormat format strings. For more information, see [Class DateTimeFormat](https://www.joda.org/joda-time/apidocs/org/joda/time/format/DateTimeFormat.html). You can also use the special value millis to parse time stamps in epoch milliseconds. If you don't specify a format, Kinesis Data Firehose uses java.sql.Timestamp::valueOf by default.
+
+###### open_x_json_ser_de
+
+* `case_insensitive` - (Optional) When set to true, which is the default, Kinesis Data Firehose converts JSON keys to lowercase before deserializing them.
+* `column_to_json_key_mappings` - (Optional) A map of column names to JSON keys that aren't identical to the column names. This is useful when the JSON contains keys that are Hive keywords. For example, timestamp is a Hive keyword. If you have a JSON key named timestamp, set this parameter to `{ ts = "timestamp" }` to map this key to a column named ts.
+* `convert_dots_in_json_keys_to_underscores` - (Optional) When set to `true`, specifies that the names of the keys include dots and that you want Kinesis Data Firehose to replace them with underscores. This is useful because Apache Hive does not allow dots in column names. For example, if the JSON contains a key whose name is "a.b", you can define the column name to be "a_b" when using this option. Defaults to `false`.
+
+#### output_format_configuration
+
+* `serializer` - (Required) Nested argument that specifies which serializer to use. You can choose either the ORC SerDe or the Parquet SerDe. More details below.
+
+##### serializer
+
+~> **NOTE:** One of the serializers must be configured. If no nested configuration needs to occur simply declare as `XXX_ser_de = []` or `XXX_ser_de {}`.
+
+* `orc_ser_de` - (Optional) Nested argument that specifies converting data to the ORC format before storing it in Amazon S3. For more information, see [Apache ORC](https://orc.apache.org/docs/). More details below.
+* `parquet_ser_de` - (Optional) Nested argument that specifies converting data to the Parquet format before storing it in Amazon S3. For more information, see [Apache Parquet](https://parquet.apache.org/documentation/latest/). More details below.
+
+###### orc_ser_de
+
+* `block_size_bytes` - (Optional) The Hadoop Distributed File System (HDFS) block size. This is useful if you intend to copy the data from Amazon S3 to HDFS before querying. The default is 256 MiB and the minimum is 64 MiB. Kinesis Data Firehose uses this value for padding calculations.
+* `bloom_filter_columns` - (Optional) A list of column names for which you want Kinesis Data Firehose to create bloom filters.
+* `bloom_filter_false_positive_probability` - (Optional) The Bloom filter false positive probability (FPP). The lower the FPP, the bigger the Bloom filter. The default value is `0.05`, the minimum is `0`, and the maximum is `1`.
+* `compression` - (Optional) The compression code to use over data blocks. The default is `SNAPPY`.
+* `dictionary_key_threshold` - (Optional) A float that represents the fraction of the total number of non-null rows. To turn off dictionary encoding, set this fraction to a number that is less than the number of distinct keys in a dictionary. To always use dictionary encoding, set this threshold to `1`.
+* `enable_padding` - (Optional) Set this to `true` to indicate that you want stripes to be padded to the HDFS block boundaries. This is useful if you intend to copy the data from Amazon S3 to HDFS before querying. The default is `false`.
+* `format_version` - (Optional) The version of the file to write. The possible values are `V0_11` and `V0_12`. The default is `V0_12`.
+* `padding_tolerance` - (Optional) A float between 0 and 1 that defines the tolerance for block padding as a decimal fraction of stripe size. The default value is `0.05`, which means 5 percent of stripe size. For the default values of 64 MiB ORC stripes and 256 MiB HDFS blocks, the default block padding tolerance of 5 percent reserves a maximum of 3.2 MiB for padding within the 256 MiB block. In such a case, if the available size within the block is more than 3.2 MiB, a new, smaller stripe is inserted to fit within that space. This ensures that no stripe crosses block boundaries and causes remote reads within a node-local task. Kinesis Data Firehose ignores this parameter when `enable_padding` is `false`.
+* `row_index_stride` - (Optional) The number of rows between index entries. The default is `10000` and the minimum is `1000`.
+* `stripe_size_bytes` - (Optional) The number of bytes in each stripe. The default is 64 MiB and the minimum is 8 MiB.
+
+###### parquet_ser_de
+
+* `block_size_bytes` - (Optional) The Hadoop Distributed File System (HDFS) block size. This is useful if you intend to copy the data from Amazon S3 to HDFS before querying. The default is 256 MiB and the minimum is 64 MiB. Kinesis Data Firehose uses this value for padding calculations.
+* `compression` - (Optional) The compression code to use over data blocks. The possible values are `UNCOMPRESSED`, `SNAPPY`, and `GZIP`, with the default being `SNAPPY`. Use `SNAPPY` for higher decompression speed. Use `GZIP` if the compression ratio is more important than speed.
+* `enable_dictionary_compression` - (Optional) Indicates whether to enable dictionary compression.
+* `max_padding_bytes` - (Optional) The maximum amount of padding to apply. This is useful if you intend to copy the data from Amazon S3 to HDFS before querying. The default is `0`.
+* `page_size_bytes` - (Optional) The Parquet page size. Column chunks are divided into pages. A page is conceptually an indivisible unit (in terms of compression and encoding). The minimum value is 64 KiB and the default is 1 MiB.
+* `writer_version` - (Optional) Indicates the version of row format to output. The possible values are `V1` and `V2`. The default is `V1`.
+
+#### schema_configuration
+
+* `database_name` - (Required) Specifies the name of the AWS Glue database that contains the schema for the output data.
+* `role_arn` - (Required) The role that Kinesis Data Firehose can use to access AWS Glue. This role must be in the same account you use for Kinesis Data Firehose. Cross-account roles aren't allowed.
+* `table_name` - (Required) Specifies the AWS Glue table that contains the column information that constitutes your data schema.
+* `catalog_id` - (Optional) The ID of the AWS Glue Data Catalog. If you don't supply this, the AWS account ID is used by default.
+* `region` - (Optional) If you don't specify an AWS Region, the default is the current region.
+* `version_id` - (Optional) Specifies the table version for the output data schema. Defaults to `LATEST`.
+
+#### dynamic_partitioning_configuration
+
+Required when using [dynamic partitioning](https://docs.aws.amazon.com/firehose/latest/dev/dynamic-partitioning.html).
+
+* `enabled` - (Optional) Enables or disables dynamic partitioning. Defaults to `false`.
+* `retry_duration` - (Optional) Total amount of seconds Firehose spends on retries. Valid values between 0 and 7200. Default is 300.
+
+~> **NOTE:** You can enable dynamic partitioning only when you create a new delivery stream. Once you enable dynamic partitioning on a delivery stream, it cannot be disabled on this delivery stream. Therefore, Terraform will recreate the resource whenever dynamic partitioning is enabled or disabled.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) specifying the Stream
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+[1]: https://aws.amazon.com/documentation/firehose/
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `30m`)
+* `update` - (Default `10m`)
+* `delete` - (Default `30m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Kinesis Firehose Delivery streams using the stream ARN. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Kinesis Firehose Delivery streams using the stream ARN. For example:
+
+```console
+% terraform import aws_kinesis_firehose_delivery_stream.foo arn:aws:firehose:us-east-1:XXX:deliverystream/example
+```
+
+Note: Import does not work for stream destination `s3`. Consider using `extended_s3` since `s3` destination is deprecated.
+
+<!-- cache-key: cdktf-0.18.0 input-a1a8ee815e60ee19fc9869aa9b7d23a6638e58e958bfdba7f5657d2ac077f81b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/kinesis_stream.html.markdown b/website/docs/cdktf/python/r/kinesis_stream.html.markdown
new file mode 100644
index 00000000000..a6e89d4595d
--- /dev/null
+++ b/website/docs/cdktf/python/r/kinesis_stream.html.markdown
@@ -0,0 +1,106 @@
+---
+subcategory: "Kinesis"
+layout: "aws"
+page_title: "AWS: aws_kinesis_stream"
+description: |-
+  Provides a AWS Kinesis Stream
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_kinesis_stream
+
+Provides a Kinesis Stream resource. Amazon Kinesis is a managed service that
+scales elastically for real-time processing of streaming big data.
+
+For more details, see the [Amazon Kinesis Documentation][1].
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.kinesis_stream import KinesisStream
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        KinesisStream(self, "test_stream",
+            name="terraform-kinesis-test",
+            retention_period=48,
+            shard_count=1,
+            shard_level_metrics=["IncomingBytes", "OutgoingBytes"],
+            stream_mode_details=KinesisStreamStreamModeDetails(
+                stream_mode="PROVISIONED"
+            ),
+            tags={
+                "Environment": "test"
+            }
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) A name to identify the stream. This is unique to the AWS account and region the Stream is created in.
+* `shard_count` – (Optional) The number of shards that the stream will use. If the `stream_mode` is `PROVISIONED`, this field is required.
+Amazon has guidelines for specifying the Stream size that should be referenced when creating a Kinesis stream. See [Amazon Kinesis Streams][2] for more.
+* `retention_period` - (Optional) Length of time data records are accessible after they are added to the stream. The maximum value of a stream's retention period is 8760 hours. Minimum value is 24. Default is 24.
+* `shard_level_metrics` - (Optional) A list of shard-level CloudWatch metrics which can be enabled for the stream. See [Monitoring with CloudWatch][3] for more. Note that the value ALL should not be used; instead you should provide an explicit list of metrics you wish to enable.
+* `enforce_consumer_deletion` - (Optional) A boolean that indicates all registered consumers should be deregistered from the stream so that the stream can be destroyed without error. The default value is `false`.
+* `encryption_type` - (Optional) The encryption type to use. The only acceptable values are `NONE` or `KMS`. The default value is `NONE`.
+* `kms_key_id` - (Optional) The GUID for the customer-managed KMS key to use for encryption. You can also use a Kinesis-owned master key by specifying the alias `alias/aws/kinesis`.
+* `stream_mode_details` - (Optional) Indicates the [capacity mode](https://docs.aws.amazon.com/streams/latest/dev/how-do-i-size-a-stream.html) of the data stream. Detailed below.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### stream_mode_details Configuration Block
+
+* `stream_mode` - (Required) Specifies the capacity mode of the stream. Must be either `PROVISIONED` or `ON_DEMAND`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The unique Stream id
+* `name` - The unique Stream name
+* `shard_count` - The count of Shards for this Stream
+* `arn` - The Amazon Resource Name (ARN) specifying the Stream (same as `id`)
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `5m`)
+- `update` - (Default `120m`)
+- `delete` - (Default `120m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Kinesis Streams using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Kinesis Streams using the `name`. For example:
+
+```console
+% terraform import aws_kinesis_stream.test_stream terraform-kinesis-test
+```
+
+[1]: https://aws.amazon.com/documentation/kinesis/
+[2]: https://docs.aws.amazon.com/kinesis/latest/dev/amazon-kinesis-streams.html
+[3]: https://docs.aws.amazon.com/streams/latest/dev/monitoring-with-cloudwatch.html
+
+<!-- cache-key: cdktf-0.18.0 input-972fc2cd811ba5b65f65f723f0cb5a041ff08e4079315825ec1e475538220367 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/kinesis_stream_consumer.html.markdown b/website/docs/cdktf/python/r/kinesis_stream_consumer.html.markdown
new file mode 100644
index 00000000000..84a58b11288
--- /dev/null
+++ b/website/docs/cdktf/python/r/kinesis_stream_consumer.html.markdown
@@ -0,0 +1,82 @@
+---
+subcategory: "Kinesis"
+layout: "aws"
+page_title: "AWS: aws_kinesis_stream_consumer"
+description: |-
+  Manages a Kinesis Stream Consumer.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_kinesis_stream_consumer
+
+Provides a resource to manage a Kinesis Stream Consumer.
+
+-> **Note:** You can register up to 20 consumers per stream. A given consumer can only be registered with one stream at a time.
+
+For more details, see the [Amazon Kinesis Stream Consumer Documentation][1].
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.kinesis_stream import KinesisStream
+from imports.aws.kinesis_stream_consumer import KinesisStreamConsumer
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = KinesisStream(self, "example",
+            name="example-stream",
+            shard_count=1
+        )
+        aws_kinesis_stream_consumer_example = KinesisStreamConsumer(self, "example_1",
+            name="example-consumer",
+            stream_arn=example.arn
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_kinesis_stream_consumer_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required, Forces new resource) Name of the stream consumer.
+* `stream_arn` – (Required, Forces new resource) Amazon Resource Name (ARN) of the data stream the consumer is registered with.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the stream consumer.
+* `creation_timestamp` - Approximate timestamp in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8) of when the stream consumer was created.
+* `id` - Amazon Resource Name (ARN) of the stream consumer.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Kinesis Stream Consumers using the Amazon Resource Name (ARN). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Kinesis Stream Consumers using the Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_kinesis_stream_consumer.example arn:aws:kinesis:us-west-2:123456789012:stream/example/consumer/example:1616044553
+```
+
+[1]: https://docs.aws.amazon.com/streams/latest/dev/amazon-kinesis-consumers.html
+
+<!-- cache-key: cdktf-0.18.0 input-faf8b78eb95acfe75982d82f725f47823646882c37a340dc5040b02aee2f21f1 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/kinesis_video_stream.html.markdown b/website/docs/cdktf/python/r/kinesis_video_stream.html.markdown
new file mode 100644
index 00000000000..f60b7653127
--- /dev/null
+++ b/website/docs/cdktf/python/r/kinesis_video_stream.html.markdown
@@ -0,0 +1,95 @@
+---
+subcategory: "Kinesis Video"
+layout: "aws"
+page_title: "AWS: aws_kinesis_video_stream"
+description: |-
+  Provides a AWS Kinesis Video Stream
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_kinesis_video_stream
+
+Provides a Kinesis Video Stream resource. Amazon Kinesis Video Streams makes it easy to securely stream video from connected devices to AWS for analytics, machine learning (ML), playback, and other processing.
+
+For more details, see the [Amazon Kinesis Documentation][1].
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.kinesis_video_stream import KinesisVideoStream
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        KinesisVideoStream(self, "default",
+            data_retention_in_hours=1,
+            device_name="kinesis-video-device-name",
+            media_type="video/h264",
+            name="terraform-kinesis-video-stream",
+            tags={
+                "Name": "terraform-kinesis-video-stream"
+            }
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) A name to identify the stream. This is unique to the
+AWS account and region the Stream is created in.
+* `data_retention_in_hours` – (Optional) The number of hours that you want to retain the data in the stream. Kinesis Video Streams retains the data in a data store that is associated with the stream. The default value is `0`, indicating that the stream does not persist data.
+* `device_name` - (Optional) The name of the device that is writing to the stream. **In the current implementation, Kinesis Video Streams does not use this name.**
+* `kms_key_id` - (Optional) The ID of the AWS Key Management Service (AWS KMS) key that you want Kinesis Video Streams to use to encrypt stream data. If no key ID is specified, the default, Kinesis Video-managed key (`aws/kinesisvideo`) is used.
+* `media_type` - (Optional) The media type of the stream. Consumers of the stream can use this information when processing the stream. For more information about media types, see [Media Types][2]. If you choose to specify the MediaType, see [Naming Requirements][3] for guidelines.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The unique Stream id
+* `arn` - The Amazon Resource Name (ARN) specifying the Stream (same as `id`)
+* `creation_time` - A time stamp that indicates when the stream was created.
+* `version` - The version of the stream.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `5m`)
+- `update` - (Default `120m`)
+- `delete` - (Default `120m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Kinesis Streams using the `arn`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Kinesis Streams using the `arn`. For example:
+
+```console
+% terraform import aws_kinesis_video_stream.test_stream arn:aws:kinesisvideo:us-west-2:123456789012:stream/terraform-kinesis-test/1554978910975
+```
+
+[1]: https://aws.amazon.com/documentation/kinesis/
+[2]: http://www.iana.org/assignments/media-types/media-types.xhtml
+[3]: https://tools.ietf.org/html/rfc6838#section-4.2
+
+<!-- cache-key: cdktf-0.18.0 input-9e588c14e41b8ac56c1691ef835d73ed6f334b72a8ab742e2478725e27ff938c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/kinesisanalyticsv2_application.html.markdown b/website/docs/cdktf/python/r/kinesisanalyticsv2_application.html.markdown
new file mode 100644
index 00000000000..5ed78bc89ab
--- /dev/null
+++ b/website/docs/cdktf/python/r/kinesisanalyticsv2_application.html.markdown
@@ -0,0 +1,534 @@
+---
+subcategory: "Kinesis Analytics V2"
+layout: "aws"
+page_title: "AWS: aws_kinesisanalyticsv2_application"
+description: |-
+  Manages a Kinesis Analytics v2 Application.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_kinesisanalyticsv2_application
+
+Manages a Kinesis Analytics v2 Application.
+This resource can be used to manage both Kinesis Data Analytics for SQL applications and Kinesis Data Analytics for Apache Flink applications.
+
+-> **Note:** Kinesis Data Analytics for SQL applications created using this resource cannot currently be viewed in the AWS Console. To manage Kinesis Data Analytics for SQL applications that can also be viewed in the AWS Console, use the [`aws_kinesis_analytics_application`](/docs/providers/aws/r/kinesis_analytics_application.html) resource.
+
+## Example Usage
+
+### Apache Flink Application
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.kinesisanalyticsv2_application import Kinesisanalyticsv2Application
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_object import S3Object
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = S3Bucket(self, "example",
+            bucket="example-flink-application"
+        )
+        aws_s3_object_example = S3Object(self, "example_1",
+            bucket=example.id,
+            key="example-flink-application",
+            source="flink-app.jar"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_object_example.override_logical_id("example")
+        aws_kinesisanalyticsv2_application_example =
+        Kinesisanalyticsv2Application(self, "example_2",
+            application_configuration=Kinesisanalyticsv2ApplicationApplicationConfiguration(
+                application_code_configuration=Kinesisanalyticsv2ApplicationApplicationConfigurationApplicationCodeConfiguration(
+                    code_content=Kinesisanalyticsv2ApplicationApplicationConfigurationApplicationCodeConfigurationCodeContent(
+                        s3_content_location=Kinesisanalyticsv2ApplicationApplicationConfigurationApplicationCodeConfigurationCodeContentS3ContentLocation(
+                            bucket_arn=example.arn,
+                            file_key=Token.as_string(aws_s3_object_example.key)
+                        )
+                    ),
+                    code_content_type="ZIPFILE"
+                ),
+                environment_properties=Kinesisanalyticsv2ApplicationApplicationConfigurationEnvironmentProperties(
+                    property_group=[Kinesisanalyticsv2ApplicationApplicationConfigurationEnvironmentPropertiesPropertyGroup(
+                        property_group_id="PROPERTY-GROUP-1",
+                        property_map={
+                            "Key1": "Value1"
+                        }
+                    ), Kinesisanalyticsv2ApplicationApplicationConfigurationEnvironmentPropertiesPropertyGroup(
+                        property_group_id="PROPERTY-GROUP-2",
+                        property_map={
+                            "KeyA": "ValueA",
+                            "KeyB": "ValueB"
+                        }
+                    )
+                    ]
+                ),
+                flink_application_configuration=Kinesisanalyticsv2ApplicationApplicationConfigurationFlinkApplicationConfiguration(
+                    checkpoint_configuration=Kinesisanalyticsv2ApplicationApplicationConfigurationFlinkApplicationConfigurationCheckpointConfiguration(
+                        configuration_type="DEFAULT"
+                    ),
+                    monitoring_configuration=Kinesisanalyticsv2ApplicationApplicationConfigurationFlinkApplicationConfigurationMonitoringConfiguration(
+                        configuration_type="CUSTOM",
+                        log_level="DEBUG",
+                        metrics_level="TASK"
+                    ),
+                    parallelism_configuration=Kinesisanalyticsv2ApplicationApplicationConfigurationFlinkApplicationConfigurationParallelismConfiguration(
+                        auto_scaling_enabled=True,
+                        configuration_type="CUSTOM",
+                        parallelism=10,
+                        parallelism_per_kpu=4
+                    )
+                )
+            ),
+            name="example-flink-application",
+            runtime_environment="FLINK-1_8",
+            service_execution_role=Token.as_string(aws_iam_role_example.arn),
+            tags={
+                "Environment": "test"
+            }
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_kinesisanalyticsv2_application_example.override_logical_id("example")
+```
+
+### SQL Application
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudwatch_log_group import CloudwatchLogGroup
+from imports.aws.cloudwatch_log_stream import CloudwatchLogStream
+from imports.aws.kinesisanalyticsv2_application import Kinesisanalyticsv2Application
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = CloudwatchLogGroup(self, "example",
+            name="example-sql-application"
+        )
+        aws_cloudwatch_log_stream_example = CloudwatchLogStream(self, "example_1",
+            log_group_name=example.name,
+            name="example-sql-application"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_cloudwatch_log_stream_example.override_logical_id("example")
+        aws_kinesisanalyticsv2_application_example =
+        Kinesisanalyticsv2Application(self, "example_2",
+            application_configuration=Kinesisanalyticsv2ApplicationApplicationConfiguration(
+                application_code_configuration=Kinesisanalyticsv2ApplicationApplicationConfigurationApplicationCodeConfiguration(
+                    code_content=Kinesisanalyticsv2ApplicationApplicationConfigurationApplicationCodeConfigurationCodeContent(
+                        text_content="SELECT 1;\n\n"
+                    ),
+                    code_content_type="PLAINTEXT"
+                ),
+                sql_application_configuration=Kinesisanalyticsv2ApplicationApplicationConfigurationSqlApplicationConfiguration(
+                    input=Kinesisanalyticsv2ApplicationApplicationConfigurationSqlApplicationConfigurationInput(
+                        input_parallelism=Kinesisanalyticsv2ApplicationApplicationConfigurationSqlApplicationConfigurationInputInputParallelism(
+                            count=3
+                        ),
+                        input_schema=Kinesisanalyticsv2ApplicationApplicationConfigurationSqlApplicationConfigurationInputInputSchema(
+                            record_column=[Kinesisanalyticsv2ApplicationApplicationConfigurationSqlApplicationConfigurationInputInputSchemaRecordColumn(
+                                mapping="MAPPING-1",
+                                name="COLUMN_1",
+                                sql_type="VARCHAR(8)"
+                            ), Kinesisanalyticsv2ApplicationApplicationConfigurationSqlApplicationConfigurationInputInputSchemaRecordColumn(
+                                name="COLUMN_2",
+                                sql_type="DOUBLE"
+                            )
+                            ],
+                            record_encoding="UTF-8",
+                            record_format=Kinesisanalyticsv2ApplicationApplicationConfigurationSqlApplicationConfigurationInputInputSchemaRecordFormat(
+                                mapping_parameters=Kinesisanalyticsv2ApplicationApplicationConfigurationSqlApplicationConfigurationInputInputSchemaRecordFormatMappingParameters(
+                                    csv_mapping_parameters=Kinesisanalyticsv2ApplicationApplicationConfigurationSqlApplicationConfigurationInputInputSchemaRecordFormatMappingParametersCsvMappingParameters(
+                                        record_column_delimiter=",",
+                                        record_row_delimiter="\n\n"
+                                    )
+                                ),
+                                record_format_type="CSV"
+                            )
+                        ),
+                        kinesis_streams_input=Kinesisanalyticsv2ApplicationApplicationConfigurationSqlApplicationConfigurationInputKinesisStreamsInput(
+                            resource_arn=Token.as_string(aws_kinesis_stream_example.arn)
+                        ),
+                        name_prefix="PREFIX_1"
+                    ),
+                    output=[Kinesisanalyticsv2ApplicationApplicationConfigurationSqlApplicationConfigurationOutput(
+                        destination_schema=Kinesisanalyticsv2ApplicationApplicationConfigurationSqlApplicationConfigurationOutputDestinationSchema(
+                            record_format_type="JSON"
+                        ),
+                        lambda_output=Kinesisanalyticsv2ApplicationApplicationConfigurationSqlApplicationConfigurationOutputLambdaOutput(
+                            resource_arn=Token.as_string(aws_lambda_function_example.arn)
+                        ),
+                        name="OUTPUT_1"
+                    ), Kinesisanalyticsv2ApplicationApplicationConfigurationSqlApplicationConfigurationOutput(
+                        destination_schema=Kinesisanalyticsv2ApplicationApplicationConfigurationSqlApplicationConfigurationOutputDestinationSchema(
+                            record_format_type="CSV"
+                        ),
+                        kinesis_firehose_output=Kinesisanalyticsv2ApplicationApplicationConfigurationSqlApplicationConfigurationOutputKinesisFirehoseOutput(
+                            resource_arn=Token.as_string(aws_kinesis_firehose_delivery_stream_example.arn)
+                        ),
+                        name="OUTPUT_2"
+                    )
+                    ],
+                    reference_data_source=Kinesisanalyticsv2ApplicationApplicationConfigurationSqlApplicationConfigurationReferenceDataSource(
+                        reference_schema=Kinesisanalyticsv2ApplicationApplicationConfigurationSqlApplicationConfigurationReferenceDataSourceReferenceSchema(
+                            record_column=[Kinesisanalyticsv2ApplicationApplicationConfigurationSqlApplicationConfigurationReferenceDataSourceReferenceSchemaRecordColumn(
+                                name="COLUMN_1",
+                                sql_type="INTEGER"
+                            )
+                            ],
+                            record_format=Kinesisanalyticsv2ApplicationApplicationConfigurationSqlApplicationConfigurationReferenceDataSourceReferenceSchemaRecordFormat(
+                                mapping_parameters=Kinesisanalyticsv2ApplicationApplicationConfigurationSqlApplicationConfigurationReferenceDataSourceReferenceSchemaRecordFormatMappingParameters(
+                                    json_mapping_parameters=Kinesisanalyticsv2ApplicationApplicationConfigurationSqlApplicationConfigurationReferenceDataSourceReferenceSchemaRecordFormatMappingParametersJsonMappingParameters(
+                                        record_row_path="$"
+                                    )
+                                ),
+                                record_format_type="JSON"
+                            )
+                        ),
+                        s3_reference_data_source=Kinesisanalyticsv2ApplicationApplicationConfigurationSqlApplicationConfigurationReferenceDataSourceS3ReferenceDataSource(
+                            bucket_arn=Token.as_string(aws_s3_bucket_example.arn),
+                            file_key="KEY-1"
+                        ),
+                        table_name="TABLE-1"
+                    )
+                )
+            ),
+            cloudwatch_logging_options=Kinesisanalyticsv2ApplicationCloudwatchLoggingOptions(
+                log_stream_arn=Token.as_string(aws_cloudwatch_log_stream_example.arn)
+            ),
+            name="example-sql-application",
+            runtime_environment="SQL-1_0",
+            service_execution_role=Token.as_string(aws_iam_role_example.arn)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_kinesisanalyticsv2_application_example.override_logical_id("example")
+```
+
+### VPC Configuration
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, Fn, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.kinesisanalyticsv2_application import Kinesisanalyticsv2Application
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_object import S3Object
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = S3Bucket(self, "example",
+            bucket="example-flink-application"
+        )
+        aws_s3_object_example = S3Object(self, "example_1",
+            bucket=example.id,
+            key="example-flink-application",
+            source="flink-app.jar"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_object_example.override_logical_id("example")
+        aws_kinesisanalyticsv2_application_example =
+        Kinesisanalyticsv2Application(self, "example_2",
+            application_configuration=Kinesisanalyticsv2ApplicationApplicationConfiguration(
+                application_code_configuration=Kinesisanalyticsv2ApplicationApplicationConfigurationApplicationCodeConfiguration(
+                    code_content=Kinesisanalyticsv2ApplicationApplicationConfigurationApplicationCodeConfigurationCodeContent(
+                        s3_content_location=Kinesisanalyticsv2ApplicationApplicationConfigurationApplicationCodeConfigurationCodeContentS3ContentLocation(
+                            bucket_arn=example.arn,
+                            file_key=Token.as_string(aws_s3_object_example.key)
+                        )
+                    ),
+                    code_content_type="ZIPFILE"
+                ),
+                vpc_configuration=Kinesisanalyticsv2ApplicationApplicationConfigurationVpcConfiguration(
+                    security_group_ids=[
+                        Token.as_string(
+                            Fn.lookup_nested(aws_security_group_example, ["0", "id"])),
+                        Token.as_string(
+                            Fn.lookup_nested(aws_security_group_example, ["1", "id"]))
+                    ],
+                    subnet_ids=[Token.as_string(aws_subnet_example.id)]
+                )
+            ),
+            name="example-flink-application",
+            runtime_environment="FLINK-1_8",
+            service_execution_role=Token.as_string(aws_iam_role_example.arn)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_kinesisanalyticsv2_application_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the application.
+* `runtime_environment` - (Required) The runtime environment for the application. Valid values: `SQL-1_0`, `FLINK-1_6`, `FLINK-1_8`, `FLINK-1_11`, `FLINK-1_13`, `FLINK-1_15`.
+* `service_execution_role` - (Required) The ARN of the [IAM role](/docs/providers/aws/r/iam_role.html) used by the application to access Kinesis data streams, Kinesis Data Firehose delivery streams, Amazon S3 objects, and other external resources.
+* `application_configuration` - (Optional) The application's configuration
+* `cloudwatch_logging_options` - (Optional) A [CloudWatch log stream](/docs/providers/aws/r/cloudwatch_log_stream.html) to monitor application configuration errors.
+* `description` - (Optional) A summary description of the application.
+* `force_stop` - (Optional) Whether to force stop an unresponsive Flink-based application.
+* `start_application` - (Optional) Whether to start or stop the application.
+* `tags` - (Optional) A map of tags to assign to the application. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+The `application_configuration` object supports the following:
+
+* `application_code_configuration` - (Required) The code location and type parameters for the application.
+* `application_snapshot_configuration` - (Optional) Describes whether snapshots are enabled for a Flink-based application.
+* `environment_properties` - (Optional) Describes execution properties for a Flink-based application.
+* `flink_application_configuration` - (Optional) The configuration of a Flink-based application.
+* `run_configuration` - (Optional) Describes the starting properties for a Flink-based application.
+* `sql_application_configuration` - (Optional) The configuration of a SQL-based application.
+* `vpc_configuration` - (Optional) The VPC configuration of a Flink-based application.
+
+The `application_code_configuration` object supports the following:
+
+* `code_content_type` - (Required) Specifies whether the code content is in text or zip format. Valid values: `PLAINTEXT`, `ZIPFILE`.
+* `code_content` - (Optional) The location and type of the application code.
+
+The `code_content` object supports the following:
+
+* `s3_content_location` - (Optional) Information about the Amazon S3 bucket containing the application code.
+* `text_content` - (Optional) The text-format code for the application.
+
+The `s3_content_location` object supports the following:
+
+* `bucket_arn` - (Required) The ARN for the S3 bucket containing the application code.
+* `file_key` - (Required) The file key for the object containing the application code.
+* `object_version` - (Optional) The version of the object containing the application code.
+
+The `application_snapshot_configuration` object supports the following:
+
+* `snapshots_enabled` - (Required) Describes whether snapshots are enabled for a Flink-based Kinesis Data Analytics application.
+
+The `environment_properties` object supports the following:
+
+* `property_group` - (Required) Describes the execution property groups.
+
+The `property_group` object supports the following:
+
+* `property_group_id` - (Required) The key of the application execution property key-value map.
+* `property_map` - (Required) Application execution property key-value map.
+
+The `flink_application_configuration` object supports the following:
+
+* `checkpoint_configuration` - (Optional) Describes an application's checkpointing configuration.
+* `monitoring_configuration` - (Optional) Describes configuration parameters for CloudWatch logging for an application.
+* `parallelism_configuration` - (Optional) Describes parameters for how an application executes multiple tasks simultaneously.
+
+The `checkpoint_configuration` object supports the following:
+
+* `configuration_type` - (Required) Describes whether the application uses Kinesis Data Analytics' default checkpointing behavior. Valid values: `CUSTOM`, `DEFAULT`. Set this attribute to `CUSTOM` in order for any specified `checkpointing_enabled`, `checkpoint_interval`, or `min_pause_between_checkpoints` attribute values to be effective. If this attribute is set to `DEFAULT`, the application will always use the following values:
+    * `checkpointing_enabled = true`
+    * `checkpoint_interval = 60000`
+    * `min_pause_between_checkpoints = 5000`
+* `checkpointing_enabled` - (Optional) Describes whether checkpointing is enabled for a Flink-based Kinesis Data Analytics application.
+* `checkpoint_interval` - (Optional) Describes the interval in milliseconds between checkpoint operations.
+* `min_pause_between_checkpoints` - (Optional) Describes the minimum time in milliseconds after a checkpoint operation completes that a new checkpoint operation can start.
+
+The `monitoring_configuration` object supports the following:
+
+* `configuration_type` - (Required) Describes whether to use the default CloudWatch logging configuration for an application. Valid values: `CUSTOM`, `DEFAULT`. Set this attribute to `CUSTOM` in order for any specified `log_level` or `metrics_level` attribute values to be effective.
+* `log_level` - (Optional) Describes the verbosity of the CloudWatch Logs for an application. Valid values: `DEBUG`, `ERROR`, `INFO`, `WARN`.
+* `metrics_level` - (Optional) Describes the granularity of the CloudWatch Logs for an application. Valid values: `APPLICATION`, `OPERATOR`, `PARALLELISM`, `TASK`.
+
+The `parallelism_configuration` object supports the following:
+
+* `configuration_type` - (Required) Describes whether the application uses the default parallelism for the Kinesis Data Analytics service. Valid values: `CUSTOM`, `DEFAULT`. Set this attribute to `CUSTOM` in order for any specified `auto_scaling_enabled`, `parallelism`, or `parallelism_per_kpu` attribute values to be effective.
+* `auto_scaling_enabled` - (Optional) Describes whether the Kinesis Data Analytics service can increase the parallelism of the application in response to increased throughput.
+* `parallelism` - (Optional) Describes the initial number of parallel tasks that a Flink-based Kinesis Data Analytics application can perform.
+* `parallelism_per_kpu` - (Optional) Describes the number of parallel tasks that a Flink-based Kinesis Data Analytics application can perform per Kinesis Processing Unit (KPU) used by the application.
+
+The `run_configuration` object supports the following:
+
+* `application_restore_configuration` - (Optional) The restore behavior of a restarting application.
+* `flink_run_configuration` - (Optional) The starting parameters for a Flink-based Kinesis Data Analytics application.
+
+The `application_restore_configuration` object supports the following:
+
+* `application_restore_type` - (Required) Specifies how the application should be restored. Valid values: `RESTORE_FROM_CUSTOM_SNAPSHOT`, `RESTORE_FROM_LATEST_SNAPSHOT`, `SKIP_RESTORE_FROM_SNAPSHOT`.
+* `snapshot_name` - (Optional) The identifier of an existing snapshot of application state to use to restart an application. The application uses this value if `RESTORE_FROM_CUSTOM_SNAPSHOT` is specified for `application_restore_type`.
+
+The `flink_run_configuration` object supports the following:
+
+* `allow_non_restored_state` - (Optional) When restoring from a snapshot, specifies whether the runtime is allowed to skip a state that cannot be mapped to the new program. Default is `false`.
+
+The `sql_application_configuration` object supports the following:
+
+* `input` - (Optional) The input stream used by the application.
+* `output` - (Optional) The destination streams used by the application.
+* `reference_data_source` - (Optional) The reference data source used by the application.
+
+The `input` object supports the following:
+
+* `input_schema` - (Required) Describes the format of the data in the streaming source, and how each data element maps to corresponding columns in the in-application stream that is being created.
+* `name_prefix` - (Required) The name prefix to use when creating an in-application stream.
+* `input_parallelism` - (Optional) Describes the number of in-application streams to create.
+* `input_processing_configuration` - (Optional) The input processing configuration for the input.
+An input processor transforms records as they are received from the stream, before the application's SQL code executes.
+* `input_starting_position_configuration` (Optional) The point at which the application starts processing records from the streaming source.
+* `kinesis_firehose_input` - (Optional) If the streaming source is a [Kinesis Data Firehose delivery stream](/docs/providers/aws/r/kinesis_firehose_delivery_stream.html), identifies the delivery stream's ARN.
+* `kinesis_streams_input` - (Optional) If the streaming source is a [Kinesis data stream](/docs/providers/aws/r/kinesis_stream.html), identifies the stream's Amazon Resource Name (ARN).
+
+The `input_parallelism` object supports the following:
+
+* `count` - (Optional) The number of in-application streams to create.
+
+The `input_processing_configuration` object supports the following:
+
+* `input_lambda_processor` - (Required) Describes the [Lambda function](/docs/providers/aws/r/lambda_function.html) that is used to preprocess the records in the stream before being processed by your application code.
+
+The `input_lambda_processor` object supports the following:
+
+* `resource_arn` - (Required) The ARN of the Lambda function that operates on records in the stream.
+
+The `input_schema` object supports the following:
+
+* `record_column` - (Required) Describes the mapping of each data element in the streaming source to the corresponding column in the in-application stream.
+* `record_format` - (Required) Specifies the format of the records on the streaming source.
+* `record_encoding` - (Optional) Specifies the encoding of the records in the streaming source. For example, `UTF-8`.
+
+The `record_column` object supports the following:
+
+* `name` - (Required) The name of the column that is created in the in-application input stream or reference table.
+* `sql_type` - (Required) The type of column created in the in-application input stream or reference table.
+* `mapping` - (Optional) A reference to the data element in the streaming input or the reference data source.
+
+The `record_format` object supports the following:
+
+* `mapping_parameters` - (Required) Provides additional mapping information specific to the record format (such as JSON, CSV, or record fields delimited by some delimiter) on the streaming source.
+* `record_format_type` - (Required) The type of record format. Valid values: `CSV`, `JSON`.
+
+The `mapping_parameters` object supports the following:
+
+* `csv_mapping_parameters` - (Optional) Provides additional mapping information when the record format uses delimiters (for example, CSV).
+* `json_mapping_parameters` - (Optional) Provides additional mapping information when JSON is the record format on the streaming source.
+
+The `csv_mapping_parameters` object supports the following:
+
+* `record_column_delimiter` - (Required) The column delimiter. For example, in a CSV format, a comma (`,`) is the typical column delimiter.
+* `record_row_delimiter` - (Required) The row delimiter. For example, in a CSV format, `\n` is the typical row delimiter.
+
+The `json_mapping_parameters` object supports the following:
+
+* `record_row_path` - (Required) The path to the top-level parent that contains the records.
+
+The `input_starting_position_configuration` object supports the following:
+
+~> **NOTE:** To modify an application's starting position, first stop the application by setting `start_application = false`, then update `starting_position` and set `start_application = true`.
+
+* `input_starting_position` - (Required) The starting position on the stream. Valid values: `LAST_STOPPED_POINT`, `NOW`, `TRIM_HORIZON`.
+
+The `kinesis_firehose_input` object supports the following:
+
+* `resource_arn` - (Required) The ARN of the delivery stream.
+
+The `kinesis_streams_input` object supports the following:
+
+* `resource_arn` - (Required) The ARN of the input Kinesis data stream to read.
+
+The `output` object supports the following:
+
+* `destination_schema` - (Required) Describes the data format when records are written to the destination.
+* `name` - (Required) The name of the in-application stream.
+* `kinesis_firehose_output` - (Optional) Identifies a [Kinesis Data Firehose delivery stream](/docs/providers/aws/r/kinesis_firehose_delivery_stream.html) as the destination.
+* `kinesis_streams_output` - (Optional) Identifies a [Kinesis data stream](/docs/providers/aws/r/kinesis_stream.html) as the destination.
+* `lambda_output` - (Optional) Identifies a [Lambda function](/docs/providers/aws/r/lambda_function.html) as the destination.
+
+The `destination_schema` object supports the following:
+
+* `record_format_type` - (Required) Specifies the format of the records on the output stream. Valid values: `CSV`, `JSON`.
+
+The `kinesis_firehose_output` object supports the following:
+
+* `resource_arn` - (Required) The ARN of the destination delivery stream to write to.
+
+The `kinesis_streams_output` object supports the following:
+
+* `resource_arn` - (Required) The ARN of the destination Kinesis data stream to write to.
+
+The `lambda_output` object supports the following:
+
+* `resource_arn` - (Required) The ARN of the destination Lambda function to write to.
+
+The `reference_data_source` object supports the following:
+
+* `reference_schema` - (Required) Describes the format of the data in the streaming source, and how each data element maps to corresponding columns created in the in-application stream.
+* `s3_reference_data_source` - (Required) Identifies the S3 bucket and object that contains the reference data.
+* `table_name` - (Required) The name of the in-application table to create.
+
+The `reference_schema` object supports the following:
+
+* `record_column` - (Required) Describes the mapping of each data element in the streaming source to the corresponding column in the in-application stream.
+* `record_format` - (Required) Specifies the format of the records on the streaming source.
+* `record_encoding` - (Optional) Specifies the encoding of the records in the streaming source. For example, `UTF-8`.
+
+The `s3_reference_data_source` object supports the following:
+
+* `bucket_arn` - (Required) The ARN of the S3 bucket.
+* `file_key` - (Required) The object key name containing the reference data.
+
+The `vpc_configuration` object supports the following:
+
+* `security_group_ids` - (Required) The [Security Group](/docs/providers/aws/r/security_group.html) IDs used by the VPC configuration.
+* `subnet_ids` - (Required) The [Subnet](/docs/providers/aws/r/subnet.html) IDs used by the VPC configuration.
+
+The `cloudwatch_logging_options` object supports the following:
+
+* `log_stream_arn` - (Required) The ARN of the CloudWatch log stream to receive application messages.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The application identifier.
+* `arn` - The ARN of the application.
+* `create_timestamp` - The current timestamp when the application was created.
+* `last_update_timestamp` - The current timestamp when the application was last updated.
+* `status` - The status of the application.
+* `version_id` - The current application version. Kinesis Data Analytics updates the `version_id` each time the application is updated.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `10m`)
+- `update` - (Default `10m`)
+- `delete` - (Default `10m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_kinesisanalyticsv2_application` using the application ARN. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_kinesisanalyticsv2_application` using the application ARN. For example:
+
+```console
+% terraform import aws_kinesisanalyticsv2_application.example arn:aws:kinesisanalytics:us-west-2:123456789012:application/example-sql-application
+```
+
+<!-- cache-key: cdktf-0.18.0 input-6d238f855d065dc06f35d3883f4979e1a608611ece08c6d5911d2f7d1d7c3396 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/kinesisanalyticsv2_application_snapshot.html.markdown b/website/docs/cdktf/python/r/kinesisanalyticsv2_application_snapshot.html.markdown
new file mode 100644
index 00000000000..8fe05a59dec
--- /dev/null
+++ b/website/docs/cdktf/python/r/kinesisanalyticsv2_application_snapshot.html.markdown
@@ -0,0 +1,77 @@
+---
+subcategory: "Kinesis Analytics V2"
+layout: "aws"
+page_title: "AWS: aws_kinesisanalyticsv2_application_snapshot"
+description: |-
+  Manages a Kinesis Analytics v2 Application Snapshot.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_kinesisanalyticsv2_application_snapshot
+
+Manages a Kinesis Analytics v2 Application Snapshot.
+Snapshots are the AWS implementation of [Flink Savepoints](https://ci.apache.org/projects/flink/flink-docs-release-1.11/ops/state/savepoints.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.kinesisanalyticsv2_application_snapshot import Kinesisanalyticsv2ApplicationSnapshot
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Kinesisanalyticsv2ApplicationSnapshot(self, "example",
+            application_name=Token.as_string(aws_kinesisanalyticsv2_application_example.name),
+            snapshot_name="example-snapshot"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `application_name` - (Required) The name of an existing  [Kinesis Analytics v2 Application](/docs/providers/aws/r/kinesisanalyticsv2_application.html). Note that the application must be running for a snapshot to be created.
+* `snapshot_name` - (Required) The name of the application snapshot.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The application snapshot identifier.
+* `application_version_id` - The current application version ID when the snapshot was created.
+* `snapshot_creation_timestamp` - The timestamp of the application snapshot.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `10m`)
+- `delete` - (Default `10m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_kinesisanalyticsv2_application` using `application_name` together with `snapshot_name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_kinesisanalyticsv2_application` using `application_name` together with `snapshot_name`. For example:
+
+```console
+% terraform import aws_kinesisanalyticsv2_application_snapshot.example example-application/example-snapshot
+```
+
+<!-- cache-key: cdktf-0.18.0 input-bd3010fed4591275bcebfac88611f10eb5c9c79e722ef1789997282c4a9937ac -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/kms_alias.html.markdown b/website/docs/cdktf/python/r/kms_alias.html.markdown
new file mode 100644
index 00000000000..461f70d7149
--- /dev/null
+++ b/website/docs/cdktf/python/r/kms_alias.html.markdown
@@ -0,0 +1,76 @@
+---
+subcategory: "KMS (Key Management)"
+layout: "aws"
+page_title: "AWS: aws_kms_alias"
+description: |-
+  Provides a display name for a customer master key.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_kms_alias
+
+Provides an alias for a KMS customer master key. AWS Console enforces 1-to-1 mapping between aliases & keys,
+but API (hence Terraform too) allows you to create as many aliases as
+the [account limits](http://docs.aws.amazon.com/kms/latest/developerguide/limits.html) allow you.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.kms_alias import KmsAlias
+from imports.aws.kms_key import KmsKey
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        a = KmsKey(self, "a")
+        aws_kms_alias_a = KmsAlias(self, "a_1",
+            name="alias/my-key-alias",
+            target_key_id=a.key_id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_kms_alias_a.override_logical_id("a")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Optional) The display name of the alias. The name must start with the word "alias" followed by a forward slash (alias/)
+* `name_prefix` - (Optional) Creates an unique alias beginning with the specified prefix.
+The name must start with the word "alias" followed by a forward slash (alias/).  Conflicts with `name`.
+* `target_key_id` - (Required) Identifier for the key for which the alias is for, can be either an ARN or key_id.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the key alias.
+* `target_key_arn` - The Amazon Resource Name (ARN) of the target key identifier.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import KMS aliases using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import KMS aliases using the `name`. For example:
+
+```console
+% terraform import aws_kms_alias.a alias/my-key-alias
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ca20383ce5b8fdeb88071f1c945d966a1085da48052143ed4134dcc859d1ae7d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/kms_ciphertext.html.markdown b/website/docs/cdktf/python/r/kms_ciphertext.html.markdown
new file mode 100644
index 00000000000..c9139844e30
--- /dev/null
+++ b/website/docs/cdktf/python/r/kms_ciphertext.html.markdown
@@ -0,0 +1,60 @@
+---
+subcategory: "KMS (Key Management)"
+layout: "aws"
+page_title: "AWS: aws_kms_ciphertext"
+description: |-
+    Provides ciphertext encrypted using a KMS key
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_kms_ciphertext
+
+The KMS ciphertext resource allows you to encrypt plaintext into ciphertext
+by using an AWS KMS customer master key. The value returned by this resource
+is stable across every apply. For a changing ciphertext value each apply, see
+the [`aws_kms_ciphertext` data source](/docs/providers/aws/d/kms_ciphertext.html).
+
+~> **Note:** All arguments including the plaintext be stored in the raw state as plain-text.
+[Read more about sensitive data in state](https://www.terraform.io/docs/state/sensitive-data.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.kms_ciphertext import KmsCiphertext
+from imports.aws.kms_key import KmsKey
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        oauth_config = KmsKey(self, "oauth_config",
+            description="oauth config",
+            is_enabled=True
+        )
+        KmsCiphertext(self, "oauth",
+            key_id=oauth_config.key_id,
+            plaintext="{\n  \"client_id\": \"e587dbae22222f55da22\",\n  \"client_secret\": \"8289575d00000ace55e1815ec13673955721b8a5\"\n}\n\n"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `plaintext` - (Required) Data to be encrypted. Note that this may show up in logs, and it will be stored in the state file.
+* `key_id` - (Required) Globally unique key ID for the customer master key.
+* `context` - (Optional) An optional mapping that makes up the encryption context.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `ciphertext_blob` - Base64 encoded ciphertext
+
+<!-- cache-key: cdktf-0.18.0 input-ce598613e81130a177d236116781c8c718c56f4432df7d2ca84854a22e71b32b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/kms_custom_key_store.html.markdown b/website/docs/cdktf/python/r/kms_custom_key_store.html.markdown
new file mode 100644
index 00000000000..4a9f8638fef
--- /dev/null
+++ b/website/docs/cdktf/python/r/kms_custom_key_store.html.markdown
@@ -0,0 +1,81 @@
+---
+subcategory: "KMS (Key Management)"
+layout: "aws"
+page_title: "AWS: aws_kms_custom_key_store"
+description: |-
+  Terraform resource for managing an AWS KMS (Key Management) Custom Key Store.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_kms_custom_key_store
+
+Terraform resource for managing an AWS KMS (Key Management) Custom Key Store.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.kms_custom_key_store import KmsCustomKeyStore
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        KmsCustomKeyStore(self, "test",
+            cloud_hsm_cluster_id=cloud_hsm_cluster_id.string_value,
+            custom_key_store_name="kms-custom-key-store-test",
+            key_store_password="noplaintextpasswords1",
+            trust_anchor_certificate=Token.as_string(Fn.file("anchor-certificate.crt"))
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `cloud_hsm_cluster_id` - (Required) Cluster ID of CloudHSM.
+* `custom_key_store_name` - (Required) Unique name for Custom Key Store.
+* `key_store_password` - (Required) Password for `kmsuser` on CloudHSM.
+* `trust_anchor_certificate` - (Required) Customer certificate used for signing on CloudHSM.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Custom Key Store ID
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `15m`)
+* `update` - (Default `15m`)
+* `delete` - (Default `15m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import KMS (Key Management) Custom Key Store using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import KMS (Key Management) Custom Key Store using the `id`. For example:
+
+```console
+% terraform import aws_kms_custom_key_store.example cks-5ebd4ef395a96288e
+```
+
+<!-- cache-key: cdktf-0.18.0 input-9dcae02bd36df2fce9d93db2f8a904b6e54954716a7c73cfb8a2f6513817a111 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/kms_external_key.html.markdown b/website/docs/cdktf/python/r/kms_external_key.html.markdown
new file mode 100644
index 00000000000..f531f456fb2
--- /dev/null
+++ b/website/docs/cdktf/python/r/kms_external_key.html.markdown
@@ -0,0 +1,81 @@
+---
+subcategory: "KMS (Key Management)"
+layout: "aws"
+page_title: "AWS: aws_kms_external_key"
+description: |-
+  Manages a single-Region or multi-Region primary KMS key that uses external key material.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_kms_external_key
+
+Manages a single-Region or multi-Region primary KMS key that uses external key material.
+To instead manage a single-Region or multi-Region primary KMS key where AWS automatically generates and potentially rotates key material, see the [`aws_kms_key` resource](/docs/providers/aws/r/kms_key.html).
+
+~> **Note:** All arguments including the key material will be stored in the raw state as plain-text. [Read more about sensitive data in state](https://www.terraform.io/docs/state/sensitive-data.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.kms_external_key import KmsExternalKey
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        KmsExternalKey(self, "example",
+            description="KMS EXTERNAL for AMI encryption"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `bypass_policy_lockout_safety_check` - (Optional) Specifies whether to disable the policy lockout check performed when creating or updating the key's policy. Setting this value to `true` increases the risk that the key becomes unmanageable. For more information, refer to the scenario in the [Default Key Policy](https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default-allow-root-enable-iam) section in the AWS Key Management Service Developer Guide. Defaults to `false`.
+* `deletion_window_in_days` - (Optional) Duration in days after which the key is deleted after destruction of the resource. Must be between `7` and `30` days. Defaults to `30`.
+* `description` - (Optional) Description of the key.
+* `enabled` - (Optional) Specifies whether the key is enabled. Keys pending import can only be `false`. Imported keys default to `true` unless expired.
+* `key_material_base64` - (Optional) Base64 encoded 256-bit symmetric encryption key material to import. The CMK is permanently associated with this key material. The same key material can be reimported, but you cannot import different key material.
+* `multi_region` - (Optional) Indicates whether the KMS key is a multi-Region (`true`) or regional (`false`) key. Defaults to `false`.
+* `policy` - (Optional) A key policy JSON document. If you do not provide a key policy, AWS KMS attaches a default key policy to the CMK.
+* `tags` - (Optional) A key-value map of tags to assign to the key. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `valid_to` - (Optional) Time at which the imported key material expires. When the key material expires, AWS KMS deletes the key material and the CMK becomes unusable. If not specified, key material does not expire. Valid values: [RFC3339 time string](https://tools.ietf.org/html/rfc3339#section-5.8) (`YYYY-MM-DDTHH:MM:SSZ`)
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the key.
+* `expiration_model` - Whether the key material expires. Empty when pending key material import, otherwise `KEY_MATERIAL_EXPIRES` or `KEY_MATERIAL_DOES_NOT_EXPIRE`.
+* `id` - The unique identifier for the key.
+* `key_state` - The state of the CMK.
+* `key_usage` - The cryptographic operations for which you can use the CMK.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import KMS External Keys using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import KMS External Keys using the `id`. For example:
+
+```console
+% terraform import aws_kms_external_key.a arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab
+```
+
+<!-- cache-key: cdktf-0.18.0 input-0484ec46a723c1a6dff8e9bc90b1793826fc146b89008eced5df42a79df9f3c2 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/kms_grant.html.markdown b/website/docs/cdktf/python/r/kms_grant.html.markdown
new file mode 100644
index 00000000000..791a659bce6
--- /dev/null
+++ b/website/docs/cdktf/python/r/kms_grant.html.markdown
@@ -0,0 +1,112 @@
+---
+subcategory: "KMS (Key Management)"
+layout: "aws"
+page_title: "AWS: aws_kms_grant"
+description: |-
+  Provides a resource-based access control mechanism for KMS Customer Master Keys.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_kms_grant
+
+Provides a resource-based access control mechanism for a KMS customer master key.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.iam_role import IamRole
+from imports.aws.kms_grant import KmsGrant
+from imports.aws.kms_key import KmsKey
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        a = KmsKey(self, "a")
+        assume_role = DataAwsIamPolicyDocument(self, "assume_role",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["sts:AssumeRole"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=Token.as_list("lambda.amazonaws.com"),
+                    type="Service"
+                )
+                ]
+            )
+            ]
+        )
+        aws_iam_role_a = IamRole(self, "a_2",
+            assume_role_policy=Token.as_string(assume_role.json),
+            name="iam-role-for-grant"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_role_a.override_logical_id("a")
+        aws_kms_grant_a = KmsGrant(self, "a_3",
+            constraints=[KmsGrantConstraints(
+                encryption_context_equals={
+                    "Department": "Finance"
+                }
+            )
+            ],
+            grantee_principal=Token.as_string(aws_iam_role_a.arn),
+            key_id=a.key_id,
+            name="my-grant",
+            operations=["Encrypt", "Decrypt", "GenerateDataKey"]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_kms_grant_a.override_logical_id("a")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Optional, Forces new resources) A friendly name for identifying the grant.
+* `key_id` - (Required, Forces new resources) The unique identifier for the customer master key (CMK) that the grant applies to. Specify the key ID or the Amazon Resource Name (ARN) of the CMK. To specify a CMK in a different AWS account, you must use the key ARN.
+* `grantee_principal` - (Required, Forces new resources) The principal that is given permission to perform the operations that the grant permits in ARN format. Note that due to eventual consistency issues around IAM principals, terraform's state may not always be refreshed to reflect what is true in AWS.
+* `operations` - (Required, Forces new resources) A list of operations that the grant permits. The permitted values are: `Decrypt`, `Encrypt`, `GenerateDataKey`, `GenerateDataKeyWithoutPlaintext`, `ReEncryptFrom`, `ReEncryptTo`, `Sign`, `Verify`, `GetPublicKey`, `CreateGrant`, `RetireGrant`, `DescribeKey`, `GenerateDataKeyPair`, or `GenerateDataKeyPairWithoutPlaintext`.
+* `retiring_principal` - (Optional, Forces new resources) The principal that is given permission to retire the grant by using RetireGrant operation in ARN format. Note that due to eventual consistency issues around IAM principals, terraform's state may not always be refreshed to reflect what is true in AWS.
+* `constraints` - (Optional, Forces new resources) A structure that you can use to allow certain operations in the grant only when the desired encryption context is present. For more information about encryption context, see [Encryption Context](http://docs.aws.amazon.com/kms/latest/developerguide/encryption-context.html).
+* `grant_creation_tokens` - (Optional, Forces new resources) A list of grant tokens to be used when creating the grant. See [Grant Tokens](http://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#grant_token) for more information about grant tokens.
+* `retire_on_delete` -(Defaults to false, Forces new resources) If set to false (the default) the grants will be revoked upon deletion, and if set to true the grants will try to be retired upon deletion. Note that retiring grants requires special permissions, hence why we default to revoking grants.
+  See [RetireGrant](https://docs.aws.amazon.com/kms/latest/APIReference/API_RetireGrant.html) for more information.
+
+The `constraints` block supports the following arguments:
+
+* `encryption_context_equals` - (Optional) A list of key-value pairs that must match the encryption context in subsequent cryptographic operation requests. The grant allows the operation only when the encryption context in the request is the same as the encryption context specified in this constraint. Conflicts with `encryption_context_subset`.
+* `encryption_context_subset` - (Optional) A list of key-value pairs that must be included in the encryption context of subsequent cryptographic operation requests. The grant allows the cryptographic operation only when the encryption context in the request includes the key-value pairs specified in this constraint, although it can include additional key-value pairs. Conflicts with `encryption_context_equals`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `grant_id` - The unique identifier for the grant.
+* `grant_token` - The grant token for the created grant. For more information, see [Grant Tokens](http://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#grant_token).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import KMS Grants using the Key ID and Grant ID separated by a colon (`:`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import KMS Grants using the Key ID and Grant ID separated by a colon (`:`). For example:
+
+```console
+% terraform import aws_kms_grant.test 1234abcd-12ab-34cd-56ef-1234567890ab:abcde1237f76e4ba7987489ac329fbfba6ad343d6f7075dbd1ef191f0120514
+```
+
+<!-- cache-key: cdktf-0.18.0 input-9587e187df46d671340d0a3dbe282bc6f1942797aabd7b8c41cc9d9588d41d93 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/kms_key.html.markdown b/website/docs/cdktf/python/r/kms_key.html.markdown
new file mode 100644
index 00000000000..7d516a70e3b
--- /dev/null
+++ b/website/docs/cdktf/python/r/kms_key.html.markdown
@@ -0,0 +1,100 @@
+---
+subcategory: "KMS (Key Management)"
+layout: "aws"
+page_title: "AWS: aws_kms_key"
+description: |-
+  Manages a single-Region or multi-Region primary KMS key.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_kms_key
+
+Manages a single-Region or multi-Region primary KMS key.
+
+~> **NOTE on KMS Key Policy:** KMS Key Policy can be configured in either the standalone resource [`aws_kms_key_policy`](kms_key_policy.html)
+or with the parameter `policy` in this resource.
+Configuring with both will cause inconsistencies and may overwrite configuration.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.kms_key import KmsKey
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        KmsKey(self, "a",
+            deletion_window_in_days=10,
+            description="KMS key 1"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `description` - (Optional) The description of the key as viewed in AWS console.
+* `key_usage` - (Optional) Specifies the intended use of the key. Valid values: `ENCRYPT_DECRYPT`, `SIGN_VERIFY`, or `GENERATE_VERIFY_MAC`.
+Defaults to `ENCRYPT_DECRYPT`.
+* `custom_key_store_id` - (Optional) ID of the KMS [Custom Key Store](https://docs.aws.amazon.com/kms/latest/developerguide/create-cmk-keystore.html) where the key will be stored instead of KMS (eg CloudHSM).
+* `customer_master_key_spec` - (Optional) Specifies whether the key contains a symmetric key or an asymmetric key pair and the encryption algorithms or signing algorithms that the key supports.
+Valid values: `SYMMETRIC_DEFAULT`,  `RSA_2048`, `RSA_3072`, `RSA_4096`, `HMAC_256`, `ECC_NIST_P256`, `ECC_NIST_P384`, `ECC_NIST_P521`, or `ECC_SECG_P256K1`. Defaults to `SYMMETRIC_DEFAULT`. For help with choosing a key spec, see the [AWS KMS Developer Guide](https://docs.aws.amazon.com/kms/latest/developerguide/symm-asymm-choose.html).
+* `policy` - (Optional) A valid policy JSON document. Although this is a key policy, not an IAM policy, an [`aws_iam_policy_document`](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document), in the form that designates a principal, can be used. For more information about building policy documents with Terraform, see the [AWS IAM Policy Document Guide](https://learn.hashicorp.com/terraform/aws/iam-policy).
+
+~> **NOTE:** Note: All KMS keys must have a key policy. If a key policy is not specified, AWS gives the KMS key a [default key policy](https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default) that gives all principals in the owning account unlimited access to all KMS operations for the key. This default key policy effectively delegates all access control to IAM policies and KMS grants.
+
+* `bypass_policy_lockout_safety_check` - (Optional) A flag to indicate whether to bypass the key policy lockout safety check.
+Setting this value to true increases the risk that the KMS key becomes unmanageable. Do not set this value to true indiscriminately.
+For more information, refer to the scenario in the [Default Key Policy](https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default-allow-root-enable-iam) section in the _AWS Key Management Service Developer Guide_.
+The default value is `false`.
+* `deletion_window_in_days` - (Optional) The waiting period, specified in number of days. After the waiting period ends, AWS KMS deletes the KMS key.
+If you specify a value, it must be between `7` and `30`, inclusive. If you do not specify a value, it defaults to `30`.
+If the KMS key is a multi-Region primary key with replicas, the waiting period begins when the last of its replica keys is deleted. Otherwise, the waiting period begins immediately.
+* `is_enabled` - (Optional) Specifies whether the key is enabled. Defaults to `true`.
+* `enable_key_rotation` - (Optional) Specifies whether [key rotation](http://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html) is enabled. Defaults to `false`.
+* `multi_region` - (Optional) Indicates whether the KMS key is a multi-Region (`true`) or regional (`false`) key. Defaults to `false`.
+* `tags` - (Optional) A map of tags to assign to the object. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the key.
+* `key_id` - The globally unique identifier for the key.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+~> **Note:** There are a variety of default timeouts set internally. If you set a shorter custom timeout than one of the defaults, the custom timeout will not be respected as the longer of the custom or internal default will be used.
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `2m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import KMS Keys using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import KMS Keys using the `id`. For example:
+
+```console
+% terraform import aws_kms_key.a 1234abcd-12ab-34cd-56ef-1234567890ab
+```
+
+<!-- cache-key: cdktf-0.18.0 input-cadf26a57c86ad443716e9d493f3661a0240fbfa81abe024e3813fe0ac63a3dd -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/kms_key_policy.html.markdown b/website/docs/cdktf/python/r/kms_key_policy.html.markdown
new file mode 100644
index 00000000000..e81717c562c
--- /dev/null
+++ b/website/docs/cdktf/python/r/kms_key_policy.html.markdown
@@ -0,0 +1,91 @@
+---
+subcategory: "KMS (Key Management)"
+layout: "aws"
+page_title: "AWS: aws_kms_key_policy"
+description: |-
+  Attaches a policy to a KMS Key.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_kms_key_policy
+
+Attaches a policy to a KMS Key.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.kms_key import KmsKey
+from imports.aws.kms_key_policy import KmsKeyPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = KmsKey(self, "example",
+            description="example"
+        )
+        aws_kms_key_policy_example = KmsKeyPolicy(self, "example_1",
+            key_id=example.id,
+            policy=Token.as_string(
+                Fn.jsonencode({
+                    "Id": "example",
+                    "Statement": [{
+                        "Action": "kms:*",
+                        "Effect": "Allow",
+                        "Principal": {
+                            "AWS": "*"
+                        },
+                        "Resource": "*",
+                        "Sid": "Enable IAM User Permissions"
+                    }
+                    ],
+                    "Version": "2012-10-17"
+                }))
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_kms_key_policy_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `key_id` - (Required) The ID of the KMS Key to attach the policy.
+* `policy` - (Required) A valid policy JSON document. Although this is a key policy, not an IAM policy, an [`aws_iam_policy_document`](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document), in the form that designates a principal, can be used. For more information about building policy documents with Terraform, see the [AWS IAM Policy Document Guide](https://learn.hashicorp.com/terraform/aws/iam-policy).
+
+~> **NOTE:** Note: All KMS keys must have a key policy. If a key policy is not specified, or this resource is destroyed, AWS gives the KMS key a [default key policy](https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default) that gives all principals in the owning account unlimited access to all KMS operations for the key. This default key policy effectively delegates all access control to IAM policies and KMS grants.
+
+* `bypass_policy_lockout_safety_check` - (Optional) A flag to indicate whether to bypass the key policy lockout safety check.
+Setting this value to true increases the risk that the KMS key becomes unmanageable. Do not set this value to true indiscriminately. If this value is set, and the resource is destroyed, a warning will be shown, and the resource will be removed from state.
+For more information, refer to the scenario in the [Default Key Policy](https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default-allow-root-enable-iam) section in the _AWS Key Management Service Developer Guide_.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import KMS Key Policies using the `key_id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import KMS Key Policies using the `key_id`. For example:
+
+```console
+% terraform import aws_kms_key_policy.a 1234abcd-12ab-34cd-56ef-1234567890ab
+```
+
+<!-- cache-key: cdktf-0.18.0 input-93175acbae862906327f4f8a607a99ad40bcba6f894b59f1002cd44902d5932d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/kms_replica_external_key.html.markdown b/website/docs/cdktf/python/r/kms_replica_external_key.html.markdown
new file mode 100644
index 00000000000..14dda4d23e3
--- /dev/null
+++ b/website/docs/cdktf/python/r/kms_replica_external_key.html.markdown
@@ -0,0 +1,104 @@
+---
+subcategory: "KMS (Key Management)"
+layout: "aws"
+page_title: "AWS: aws_kms_replica_external_key"
+description: |-
+  Manages a KMS multi-Region replica key that uses external key material.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_kms_replica_external_key
+
+Manages a KMS multi-Region replica key that uses external key material.
+See the [AWS KMS Developer Guide](https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-import.html) for more information on importing key material into multi-Region keys.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.kms_external_key import KmsExternalKey
+from imports.aws.kms_replica_external_key import KmsReplicaExternalKey
+from imports.aws.provider import AwsProvider
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        primary = AwsProvider(self, "aws",
+            alias="primary",
+            region="us-east-1"
+        )
+        AwsProvider(self, "aws_1",
+            region="us-west-2"
+        )
+        KmsExternalKey(self, "primary",
+            deletion_window_in_days=30,
+            description="Multi-Region primary key",
+            enabled=True,
+            key_material_base64="...",
+            multi_region=True,
+            provider=primary
+        )
+        KmsReplicaExternalKey(self, "replica",
+            deletion_window_in_days=7,
+            description="Multi-Region replica key",
+            key_material_base64="...",
+            primary_key_arn=Token.as_string(aws_kms_external_primary.arn)
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `bypass_policy_lockout_safety_check` - (Optional) A flag to indicate whether to bypass the key policy lockout safety check.
+Setting this value to true increases the risk that the KMS key becomes unmanageable. Do not set this value to true indiscriminately.
+For more information, refer to the scenario in the [Default Key Policy](https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default-allow-root-enable-iam) section in the _AWS Key Management Service Developer Guide_.
+The default value is `false`.
+* `deletion_window_in_days` - (Optional) The waiting period, specified in number of days. After the waiting period ends, AWS KMS deletes the KMS key.
+If you specify a value, it must be between `7` and `30`, inclusive. If you do not specify a value, it defaults to `30`.
+* `description` - (Optional) A description of the KMS key.
+* `enabled` - (Optional) Specifies whether the replica key is enabled. Disabled KMS keys cannot be used in cryptographic operations. Keys pending import can only be `false`. Imported keys default to `true` unless expired.
+* `key_material_base64` - (Optional) Base64 encoded 256-bit symmetric encryption key material to import. The KMS key is permanently associated with this key material. The same key material can be [reimported](https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html#reimport-key-material), but you cannot import different key material.
+* `policy` - (Optional) The key policy to attach to the KMS key. If you do not specify a key policy, AWS KMS attaches the [default key policy](https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default) to the KMS key.
+For more information about building policy documents with Terraform, see the [AWS IAM Policy Document Guide](https://learn.hashicorp.com/terraform/aws/iam-policy).
+* `primary_key_arn` - (Required) The ARN of the multi-Region primary key to replicate. The primary key must be in a different AWS Region of the same AWS Partition. You can create only one replica of a given primary key in each AWS Region.
+* `tags` - (Optional) A map of tags to assign to the replica key. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `valid_to` - (Optional) Time at which the imported key material expires. When the key material expires, AWS KMS deletes the key material and the key becomes unusable. If not specified, key material does not expire. Valid values: [RFC3339 time string](https://tools.ietf.org/html/rfc3339#section-5.8) (`YYYY-MM-DDTHH:MM:SSZ`)
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the replica key. The key ARNs of related multi-Region keys differ only in the Region value.
+* `expiration_model` - Whether the key material expires. Empty when pending key material import, otherwise `KEY_MATERIAL_EXPIRES` or `KEY_MATERIAL_DOES_NOT_EXPIRE`.
+* `key_id` - The key ID of the replica key. Related multi-Region keys have the same key ID.
+* `key_state` - The state of the replica key.
+* `key_usage` - The [cryptographic operations](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations) for which you can use the KMS key. This is a shared property of multi-Region keys.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import KMS multi-Region replica keys using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import KMS multi-Region replica keys using the `id`. For example:
+
+```console
+% terraform import aws_kms_replica_external_key.example 1234abcd-12ab-34cd-56ef-1234567890ab
+```
+
+<!-- cache-key: cdktf-0.18.0 input-7ff58560e5d333c365657d94a76f29c733a88f3ce8d3e119a8f1086138e57a7c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/kms_replica_key.html.markdown b/website/docs/cdktf/python/r/kms_replica_key.html.markdown
new file mode 100644
index 00000000000..807e641a8bf
--- /dev/null
+++ b/website/docs/cdktf/python/r/kms_replica_key.html.markdown
@@ -0,0 +1,98 @@
+---
+subcategory: "KMS (Key Management)"
+layout: "aws"
+page_title: "AWS: aws_kms_replica_key"
+description: |-
+  Manages a KMS multi-Region replica key.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_kms_replica_key
+
+Manages a KMS multi-Region replica key.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.kms_key import KmsKey
+from imports.aws.kms_replica_key import KmsReplicaKey
+from imports.aws.provider import AwsProvider
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        primary = AwsProvider(self, "aws",
+            alias="primary",
+            region="us-east-1"
+        )
+        AwsProvider(self, "aws_1",
+            region="us-west-2"
+        )
+        aws_kms_key_primary = KmsKey(self, "primary",
+            deletion_window_in_days=30,
+            description="Multi-Region primary key",
+            multi_region=True,
+            provider=primary
+        )
+        KmsReplicaKey(self, "replica",
+            deletion_window_in_days=7,
+            description="Multi-Region replica key",
+            primary_key_arn=Token.as_string(aws_kms_key_primary.arn)
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `bypass_policy_lockout_safety_check` - (Optional) A flag to indicate whether to bypass the key policy lockout safety check.
+Setting this value to true increases the risk that the KMS key becomes unmanageable. Do not set this value to true indiscriminately.
+For more information, refer to the scenario in the [Default Key Policy](https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default-allow-root-enable-iam) section in the _AWS Key Management Service Developer Guide_.
+The default value is `false`.
+* `deletion_window_in_days` - (Optional) The waiting period, specified in number of days. After the waiting period ends, AWS KMS deletes the KMS key.
+If you specify a value, it must be between `7` and `30`, inclusive. If you do not specify a value, it defaults to `30`.
+* `description` - (Optional) A description of the KMS key.
+* `enabled` - (Optional) Specifies whether the replica key is enabled. Disabled KMS keys cannot be used in cryptographic operations. The default value is `true`.
+* `policy` - (Optional) The key policy to attach to the KMS key. If you do not specify a key policy, AWS KMS attaches the [default key policy](https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default) to the KMS key.
+For more information about building policy documents with Terraform, see the [AWS IAM Policy Document Guide](https://learn.hashicorp.com/terraform/aws/iam-policy).
+* `primary_key_arn` - (Required) The ARN of the multi-Region primary key to replicate. The primary key must be in a different AWS Region of the same AWS Partition. You can create only one replica of a given primary key in each AWS Region.
+* `tags` - (Optional) A map of tags to assign to the replica key. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the replica key. The key ARNs of related multi-Region keys differ only in the Region value.
+* `key_id` - The key ID of the replica key. Related multi-Region keys have the same key ID.
+* `key_rotation_enabled` - A Boolean value that specifies whether key rotation is enabled. This is a shared property of multi-Region keys.
+* `key_spec` - The type of key material in the KMS key. This is a shared property of multi-Region keys.
+* `key_usage` - The [cryptographic operations](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations) for which you can use the KMS key. This is a shared property of multi-Region keys.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import KMS multi-Region replica keys using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import KMS multi-Region replica keys using the `id`. For example:
+
+```console
+% terraform import aws_kms_replica_key.example 1234abcd-12ab-34cd-56ef-1234567890ab
+```
+
+<!-- cache-key: cdktf-0.18.0 input-d9e0bf46edfbeab8b46e2d9e97a2d761d4db8938a03b29da3f959636cabf71c7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/lakeformation_data_lake_settings.html.markdown b/website/docs/cdktf/python/r/lakeformation_data_lake_settings.html.markdown
new file mode 100644
index 00000000000..704d29bf855
--- /dev/null
+++ b/website/docs/cdktf/python/r/lakeformation_data_lake_settings.html.markdown
@@ -0,0 +1,136 @@
+---
+subcategory: "Lake Formation"
+layout: "aws"
+page_title: "AWS: aws_lakeformation_data_lake_settings"
+description: |-
+  Manages data lake administrators and default database and table permissions
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lakeformation_data_lake_settings
+
+Manages Lake Formation principals designated as data lake administrators and lists of principal permission entries for default create database and default create table permissions.
+
+~> **NOTE:** Lake Formation introduces fine-grained access control for data in your data lake. Part of the changes include the `IAMAllowedPrincipals` principal in order to make Lake Formation backwards compatible with existing IAM and Glue permissions. For more information, see [Changing the Default Security Settings for Your Data Lake](https://docs.aws.amazon.com/lake-formation/latest/dg/change-settings.html) and [Upgrading AWS Glue Data Permissions to the AWS Lake Formation Model](https://docs.aws.amazon.com/lake-formation/latest/dg/upgrade-glue-lake-formation.html).
+
+## Example Usage
+
+### Data Lake Admins
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.lakeformation_data_lake_settings import LakeformationDataLakeSettings
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        LakeformationDataLakeSettings(self, "example",
+            admins=[test.arn, Token.as_string(aws_iam_role_test.arn)]
+        )
+```
+
+### Create Default Permissions
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.lakeformation_data_lake_settings import LakeformationDataLakeSettings
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        LakeformationDataLakeSettings(self, "example",
+            admins=[test.arn, Token.as_string(aws_iam_role_test.arn)],
+            create_database_default_permissions=[LakeformationDataLakeSettingsCreateDatabaseDefaultPermissions(
+                permissions=["SELECT", "ALTER", "DROP"],
+                principal=test.arn
+            )
+            ],
+            create_table_default_permissions=[LakeformationDataLakeSettingsCreateTableDefaultPermissions(
+                permissions=["ALL"],
+                principal=Token.as_string(aws_iam_role_test.arn)
+            )
+            ]
+        )
+```
+
+### Enable EMR access to LakeFormation resources
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.lakeformation_data_lake_settings import LakeformationDataLakeSettings
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        LakeformationDataLakeSettings(self, "example",
+            admins=[test.arn, Token.as_string(aws_iam_role_test.arn)],
+            allow_external_data_filtering=True,
+            authorized_session_tag_value_list=["Amazon EMR"],
+            create_database_default_permissions=[LakeformationDataLakeSettingsCreateDatabaseDefaultPermissions(
+                permissions=["SELECT", "ALTER", "DROP"],
+                principal=test.arn
+            )
+            ],
+            create_table_default_permissions=[LakeformationDataLakeSettingsCreateTableDefaultPermissions(
+                permissions=["ALL"],
+                principal=Token.as_string(aws_iam_role_test.arn)
+            )
+            ],
+            external_data_filtering_allow_list=[
+                Token.as_string(current.account_id),
+                Token.as_string(third_party.account_id)
+            ]
+        )
+```
+
+## Argument Reference
+
+The following arguments are optional:
+
+* `admins` – (Optional) Set of ARNs of AWS Lake Formation principals (IAM users or roles).
+* `read_only_admins` – (Optional) Set of ARNs of AWS Lake Formation principals (IAM users or roles) with only view access to the resources.
+* `catalog_id` – (Optional) Identifier for the Data Catalog. By default, the account ID.
+* `create_database_default_permissions` - (Optional) Up to three configuration blocks of principal permissions for default create database permissions. Detailed below.
+* `create_table_default_permissions` - (Optional) Up to three configuration blocks of principal permissions for default create table permissions. Detailed below.
+* `trusted_resource_owners` – (Optional) List of the resource-owning account IDs that the caller's account can use to share their user access details (user ARNs).
+* `allow_external_data_filtering` - (Optional) Whether to allow Amazon EMR clusters to access data managed by Lake Formation.
+* `external_data_filtering_allow_list` - (Optional) A list of the account IDs of Amazon Web Services accounts with Amazon EMR clusters that are to perform data filtering.
+* `authorized_session_tag_value_list` - (Optional) Lake Formation relies on a privileged process secured by Amazon EMR or the third party integrator to tag the user's role while assuming it.
+
+~> **NOTE:** Although optional, not including `admins`, `create_database_default_permissions`, `create_table_default_permissions`, and/or `trusted_resource_owners` results in the setting being cleared.
+
+### create_database_default_permissions
+
+The following arguments are optional:
+
+* `permissions` - (Optional) List of permissions that are granted to the principal. Valid values may include `ALL`, `SELECT`, `ALTER`, `DROP`, `DELETE`, `INSERT`, `DESCRIBE`, and `CREATE_TABLE`. For more details, see [Lake Formation Permissions Reference](https://docs.aws.amazon.com/lake-formation/latest/dg/lf-permissions-reference.html).
+* `principal` - (Optional) Principal who is granted permissions. To enforce metadata and underlying data access control only by IAM on new databases and tables set `principal` to `IAM_ALLOWED_PRINCIPALS` and `permissions` to `["ALL"]`.
+
+### create_table_default_permissions
+
+The following arguments are optional:
+
+* `permissions` - (Optional) List of permissions that are granted to the principal. Valid values may include `ALL`, `SELECT`, `ALTER`, `DROP`, `DELETE`, `INSERT`, and `DESCRIBE`. For more details, see [Lake Formation Permissions Reference](https://docs.aws.amazon.com/lake-formation/latest/dg/lf-permissions-reference.html).
+* `principal` - (Optional) Principal who is granted permissions. To enforce metadata and underlying data access control only by IAM on new databases and tables set `principal` to `IAM_ALLOWED_PRINCIPALS` and `permissions` to `["ALL"]`.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+<!-- cache-key: cdktf-0.18.0 input-417a6f6da709dcf8d9f1bd94d43d2cf8836515780173f60b9dd4db641440c4d0 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/lakeformation_lf_tag.html.markdown b/website/docs/cdktf/python/r/lakeformation_lf_tag.html.markdown
new file mode 100644
index 00000000000..1f05a8d5042
--- /dev/null
+++ b/website/docs/cdktf/python/r/lakeformation_lf_tag.html.markdown
@@ -0,0 +1,68 @@
+---
+subcategory: "Lake Formation"
+layout: "aws"
+page_title: "AWS: aws_lakeformation_lf_tag"
+description: |-
+    Creates a tag with the specified name and values.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lakeformation_lf_tag
+
+Creates an LF-Tag with the specified name and values. Each key must have at least one value. The maximum number of values permitted is 15.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.lakeformation_lf_tag import LakeformationLfTag
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        LakeformationLfTag(self, "example",
+            key="module",
+            values=["Orders", "Sales", "Customers"]
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `catalog_id` - (Optional) ID of the Data Catalog to create the tag in. If omitted, this defaults to the AWS Account ID.
+* `key` - (Required) Key-name for the tag.
+* `values` - (Required) List of possible values an attribute can take.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Catalog ID and key-name of the tag
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Lake Formation LF-Tags using the `catalog_id:key`. If you have not set a Catalog ID specify the AWS Account ID that the database is in. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Lake Formation LF-Tags using the `catalog_id:key`. If you have not set a Catalog ID specify the AWS Account ID that the database is in. For example:
+
+```console
+% terraform import aws_lakeformation_lf_tag.example 123456789012:some_key
+```
+
+<!-- cache-key: cdktf-0.18.0 input-4f01d1c09d440237d766ec2a420e4ecbbbe63aaac04d99d046c18e4f145b3f8b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/lakeformation_permissions.html.markdown b/website/docs/cdktf/python/r/lakeformation_permissions.html.markdown
new file mode 100644
index 00000000000..a0f15011409
--- /dev/null
+++ b/website/docs/cdktf/python/r/lakeformation_permissions.html.markdown
@@ -0,0 +1,308 @@
+---
+subcategory: "Lake Formation"
+layout: "aws"
+page_title: "AWS: aws_lakeformation_permissions"
+description: |-
+    Grants permissions to the principal to access metadata in the Data Catalog and data organized in underlying data storage such as Amazon S3.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lakeformation_permissions
+
+Grants permissions to the principal to access metadata in the Data Catalog and data organized in underlying data storage such as Amazon S3. Permissions are granted to a principal, in a Data Catalog, relative to a Lake Formation resource, which includes the Data Catalog, databases, tables, LF-tags, and LF-tag policies. For more information, see [Security and Access Control to Metadata and Data in Lake Formation](https://docs.aws.amazon.com/lake-formation/latest/dg/security-data-access.html).
+
+!> **WARNING:** Lake Formation permissions are not in effect by default within AWS. Using this resource will not secure your data and will result in errors if you do not change the security settings for existing resources and the default security settings for new resources. See [Default Behavior and `IAMAllowedPrincipals`](#default-behavior-and-iamallowedprincipals) for additional details.
+
+~> **NOTE:** In general, the `principal` should _NOT_ be a Lake Formation administrator or the entity (e.g., IAM role) that is running Terraform. Administrators have implicit permissions. These should be managed by granting or not granting administrator rights using `aws_lakeformation_data_lake_settings`, _not_ with this resource.
+
+## Default Behavior and `IAMAllowedPrincipals`
+
+**_Lake Formation permissions are not in effect by default within AWS._** `IAMAllowedPrincipals` (i.e., `IAM_ALLOWED_PRINCIPALS`) conflicts with individual Lake Formation permissions (i.e., non-`IAMAllowedPrincipals` permissions), will cause unexpected behavior, and may result in errors.
+
+When using Lake Formation, choose ONE of the following options as they are mutually exclusive:
+
+1. Use this resource (`aws_lakeformation_permissions`), change the default security settings using [`aws_lakeformation_data_lake_settings`](/docs/providers/aws/r/lakeformation_data_lake_settings.html), and remove existing `IAMAllowedPrincipals` permissions
+2. Use `IAMAllowedPrincipals` without `aws_lakeformation_permissions`
+
+This example shows removing the `IAMAllowedPrincipals` default security settings and making the caller a Lake Formation admin. Since `create_database_default_permissions` and `create_table_default_permissions` are not set in the [`aws_lakeformation_data_lake_settings`](/docs/providers/aws/r/lakeformation_data_lake_settings.html) resource, they are cleared.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_caller_identity import DataAwsCallerIdentity
+from imports.aws.data_aws_iam_session_context import DataAwsIamSessionContext
+from imports.aws.lakeformation_data_lake_settings import LakeformationDataLakeSettings
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        current = DataAwsCallerIdentity(self, "current")
+        data_aws_iam_session_context_current = DataAwsIamSessionContext(self, "current_1",
+            arn=Token.as_string(current.arn)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_iam_session_context_current.override_logical_id("current")
+        LakeformationDataLakeSettings(self, "test",
+            admins=[Token.as_string(data_aws_iam_session_context_current.issuer_arn)]
+        )
+```
+
+To remove existing `IAMAllowedPrincipals` permissions, use the [AWS Lake Formation Console](https://console.aws.amazon.com/lakeformation/) or [AWS CLI](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/lakeformation/batch-revoke-permissions.html).
+
+`IAMAllowedPrincipals` is a hook to maintain backwards compatibility with AWS Glue. `IAMAllowedPrincipals` is a pseudo-entity group that acts like a Lake Formation principal. The group includes any IAM users and roles that are allowed access to your Data Catalog resources by your IAM policies.
+
+This is Lake Formation's default behavior:
+
+* Lake Formation grants `Super` permission to `IAMAllowedPrincipals` on all existing AWS Glue Data Catalog resources.
+* Lake Formation enables "Use only IAM access control" for new Data Catalog resources.
+
+For more details, see [Changing the Default Security Settings for Your Data Lake](https://docs.aws.amazon.com/lake-formation/latest/dg/change-settings.html).
+
+### Problem Using `IAMAllowedPrincipals`
+
+AWS does not support combining `IAMAllowedPrincipals` permissions and non-`IAMAllowedPrincipals` permissions. Doing so results in unexpected permissions and behaviors. For example, this configuration grants a user `SELECT` on a column in a table.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.glue_catalog_database import GlueCatalogDatabase
+from imports.aws.glue_catalog_table import GlueCatalogTable
+from imports.aws.lakeformation_permissions import LakeformationPermissions
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        GlueCatalogDatabase(self, "example",
+            name="sadabate"
+        )
+        aws_glue_catalog_table_example = GlueCatalogTable(self, "example_1",
+            database_name=test.name,
+            name="abelt",
+            storage_descriptor=GlueCatalogTableStorageDescriptor(
+                columns=[GlueCatalogTableStorageDescriptorColumns(
+                    name="event",
+                    type="string"
+                )
+                ]
+            )
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_glue_catalog_table_example.override_logical_id("example")
+        aws_lakeformation_permissions_example = LakeformationPermissions(self, "example_2",
+            permissions=["SELECT"],
+            principal="arn:aws:iam:us-east-1:123456789012:user/SanHolo",
+            table_with_columns=LakeformationPermissionsTableWithColumns(
+                column_names=["event"],
+                database_name=Token.as_string(aws_glue_catalog_table_example.database_name),
+                name=Token.as_string(aws_glue_catalog_table_example.name)
+            )
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_lakeformation_permissions_example.override_logical_id("example")
+```
+
+The resulting permissions depend on whether the table had `IAMAllowedPrincipals` (IAP) permissions or not.
+
+| Result With IAP | Result Without IAP |
+| ---- | ---- |
+| `SELECT` column wildcard (i.e., all columns) | `SELECT` on `"event"` (as expected) |
+
+## Using Lake Formation Permissions
+
+Lake Formation grants implicit permissions to data lake administrators, database creators, and table creators. These implicit permissions cannot be revoked _per se_. If this resource reads implicit permissions, it will attempt to revoke them, which causes an error when the resource is destroyed.
+
+There are two ways to avoid these errors. First, and the way we recommend, is to avoid using this resource with principals that have implicit permissions. A second, error-prone option, is to grant explicit permissions (and `permissions_with_grant_option`) to "overwrite" a principal's implicit permissions, which you can then revoke with this resource. For more information, see [Implicit Lake Formation Permissions](https://docs.aws.amazon.com/lake-formation/latest/dg/implicit-permissions.html).
+
+If the `principal` is also a data lake administrator, AWS grants implicit permissions that can cause errors using this resource. For example, AWS implicitly grants a `principal`/administrator `permissions` and `permissions_with_grant_option` of `ALL`, `ALTER`, `DELETE`, `DESCRIBE`, `DROP`, `INSERT`, and `SELECT` on a table. If you use this resource to explicitly grant the `principal`/administrator `permissions` but _not_ `permissions_with_grant_option` of `ALL`, `ALTER`, `DELETE`, `DESCRIBE`, `DROP`, `INSERT`, and `SELECT` on the table, this resource will read the implicit `permissions_with_grant_option` and attempt to revoke them when the resource is destroyed. Doing so will cause an `InvalidInputException: No permissions revoked` error because you cannot revoke implicit permissions _per se_. To workaround this problem, explicitly grant the `principal`/administrator `permissions` _and_ `permissions_with_grant_option`, which can then be revoked. Similarly, granting a `principal`/administrator permissions on a table with columns and providing `column_names`, will result in a `InvalidInputException: Permissions modification is invalid` error because you are narrowing the implicit permissions. Instead, set `wildcard` to `true` and remove the `column_names`.
+
+## Example Usage
+
+### Grant Permissions For A Lake Formation S3 Resource
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.lakeformation_permissions import LakeformationPermissions
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        LakeformationPermissions(self, "example",
+            data_location=LakeformationPermissionsDataLocation(
+                arn=Token.as_string(aws_lakeformation_resource_example.arn)
+            ),
+            permissions=["ALL"],
+            principal=workflow_role.arn
+        )
+```
+
+### Grant Permissions For A Glue Catalog Database
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.lakeformation_permissions import LakeformationPermissions
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        LakeformationPermissions(self, "example",
+            database=LakeformationPermissionsDatabase(
+                catalog_id="110376042874",
+                name=Token.as_string(aws_glue_catalog_database_example.name)
+            ),
+            permissions=["CREATE_TABLE", "ALTER", "DROP"],
+            principal=workflow_role.arn
+        )
+```
+
+### Grant Permissions Using Tag-Based Access Control
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.lakeformation_permissions import LakeformationPermissions
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        LakeformationPermissions(self, "test",
+            lf_tag_policy=LakeformationPermissionsLfTagPolicy(
+                expression=[LakeformationPermissionsLfTagPolicyExpression(
+                    key="Team",
+                    values=["Sales"]
+                ), LakeformationPermissionsLfTagPolicyExpression(
+                    key="Environment",
+                    values=["Dev", "Production"]
+                )
+                ],
+                resource_type="DATABASE"
+            ),
+            permissions=["CREATE_TABLE", "ALTER", "DROP"],
+            principal=sales_role.arn
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `permissions` – (Required) List of permissions granted to the principal. Valid values may include `ALL`, `ALTER`, `ASSOCIATE`, `CREATE_DATABASE`, `CREATE_TABLE`, `DATA_LOCATION_ACCESS`, `DELETE`, `DESCRIBE`, `DROP`, `INSERT`, and `SELECT`. For details on each permission, see [Lake Formation Permissions Reference](https://docs.aws.amazon.com/lake-formation/latest/dg/lf-permissions-reference.html).
+* `principal` – (Required) Principal to be granted the permissions on the resource. Supported principals include `IAM_ALLOWED_PRINCIPALS` (see [Default Behavior and `IAMAllowedPrincipals`](#default-behavior-and-iamallowedprincipals) above), IAM roles, users, groups, SAML groups and users, QuickSight groups, OUs, and organizations as well as AWS account IDs for cross-account permissions. For more information, see [Lake Formation Permissions Reference](https://docs.aws.amazon.com/lake-formation/latest/dg/lf-permissions-reference.html).
+
+~> **NOTE:** We highly recommend that the `principal` _NOT_ be a Lake Formation administrator (granted using `aws_lakeformation_data_lake_settings`). The entity (e.g., IAM role) running Terraform will most likely need to be a Lake Formation administrator. As such, the entity will have implicit permissions and does not need permissions granted through this resource.
+
+One of the following is required:
+
+* `catalog_resource` - (Optional) Whether the permissions are to be granted for the Data Catalog. Defaults to `false`.
+* `data_location` - (Optional) Configuration block for a data location resource. Detailed below.
+* `database` - (Optional) Configuration block for a database resource. Detailed below.
+* `lf_tag` - (Optional) Configuration block for an LF-tag resource. Detailed below.
+* `lf_tag_policy` - (Optional) Configuration block for an LF-tag policy resource. Detailed below.
+* `table` - (Optional) Configuration block for a table resource. Detailed below.
+* `table_with_columns` - (Optional) Configuration block for a table with columns resource. Detailed below.
+
+The following arguments are optional:
+
+* `catalog_id` – (Optional) Identifier for the Data Catalog. By default, the account ID. The Data Catalog is the persistent metadata store. It contains database definitions, table definitions, and other control information to manage your Lake Formation environment.
+* `permissions_with_grant_option` - (Optional) Subset of `permissions` which the principal can pass.
+
+### data_location
+
+The following argument is required:
+
+* `arn` – (Required) Amazon Resource Name (ARN) that uniquely identifies the data location resource.
+
+The following argument is optional:
+
+* `catalog_id` - (Optional) Identifier for the Data Catalog where the location is registered with Lake Formation. By default, it is the account ID of the caller.
+
+### database
+
+The following argument is required:
+
+* `name` – (Required) Name of the database resource. Unique to the Data Catalog.
+
+The following argument is optional:
+
+* `catalog_id` - (Optional) Identifier for the Data Catalog. By default, it is the account ID of the caller.
+
+### lf_tag
+
+The following arguments are required:
+
+* `key` – (Required) The key-name for the tag.
+* `values` - (Required) A list of possible values an attribute can take.
+
+The following argument is optional:
+
+* `catalog_id` - (Optional) Identifier for the Data Catalog. By default, it is the account ID of the caller.
+
+### lf_tag_policy
+
+The following arguments are required:
+
+* `resource_type` – (Required) The resource type for which the tag policy applies. Valid values are `DATABASE` and `TABLE`.
+* `expression` - (Required) A list of tag conditions that apply to the resource's tag policy. Configuration block for tag conditions that apply to the policy. See [`expression`](#expression) below.
+
+The following argument is optional:
+
+* `catalog_id` - (Optional) Identifier for the Data Catalog. By default, it is the account ID of the caller.
+
+#### expression
+
+* `key` – (Required) The key-name of an LF-Tag.
+* `values` - (Required) A list of possible values of an LF-Tag.
+
+### table
+
+The following argument is required:
+
+* `database_name` – (Required) Name of the database for the table. Unique to a Data Catalog.
+* `name` - (Required, at least one of `name` or `wildcard`) Name of the table.
+* `wildcard` - (Required, at least one of `name` or `wildcard`) Whether to use a wildcard representing every table under a database. Defaults to `false`.
+
+The following arguments are optional:
+
+* `catalog_id` - (Optional) Identifier for the Data Catalog. By default, it is the account ID of the caller.
+
+### table_with_columns
+
+The following arguments are required:
+
+* `column_names` - (Required, at least one of `column_names` or `wildcard`) Set of column names for the table.
+* `database_name` – (Required) Name of the database for the table with columns resource. Unique to the Data Catalog.
+* `name` – (Required) Name of the table resource.
+* `wildcard` - (Required, at least one of `column_names` or `wildcard`) Whether to use a column wildcard. If `excluded_column_names` is included, `wildcard` must be set to `true` to avoid Terraform reporting a difference.
+
+The following arguments are optional:
+
+* `catalog_id` - (Optional) Identifier for the Data Catalog. By default, it is the account ID of the caller.
+* `excluded_column_names` - (Optional) Set of column names for the table to exclude. If `excluded_column_names` is included, `wildcard` must be set to `true` to avoid Terraform reporting a difference.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+<!-- cache-key: cdktf-0.18.0 input-fd78e0884a6908a814356ab7d33f0f75b98fe926eb713d3c171ff4fd77586027 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/lakeformation_resource.html.markdown b/website/docs/cdktf/python/r/lakeformation_resource.html.markdown
new file mode 100644
index 00000000000..606871e6142
--- /dev/null
+++ b/website/docs/cdktf/python/r/lakeformation_resource.html.markdown
@@ -0,0 +1,55 @@
+---
+subcategory: "Lake Formation"
+layout: "aws"
+page_title: "AWS: aws_lakeformation_resource"
+description: |-
+  Registers a Lake Formation resource as managed by the Data Catalog.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lakeformation_resource
+
+Registers a Lake Formation resource (e.g., S3 bucket) as managed by the Data Catalog. In other words, the S3 path is added to the data lake.
+
+Choose a role that has read/write access to the chosen Amazon S3 path or use the service-linked role. When you register the S3 path, the service-linked role and a new inline policy are created on your behalf. Lake Formation adds the first path to the inline policy and attaches it to the service-linked role. When you register subsequent paths, Lake Formation adds the path to the existing policy.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_s3_bucket import DataAwsS3Bucket
+from imports.aws.lakeformation_resource import LakeformationResource
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = DataAwsS3Bucket(self, "example",
+            bucket="an-example-bucket"
+        )
+        aws_lakeformation_resource_example = LakeformationResource(self, "example_1",
+            arn=Token.as_string(example.arn)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_lakeformation_resource_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+* `arn` – (Required) Amazon Resource Name (ARN) of the resource, an S3 path.
+* `role_arn` – (Optional) Role that has read/write access to the resource. If not provided, the Lake Formation service-linked role must exist and is used.
+
+~> **NOTE:** AWS does not support registering an S3 location with an IAM role and subsequently updating the S3 location registration to a service-linked role.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `last_modified` - (Optional) The date and time the resource was last modified in [RFC 3339 format](https://tools.ietf.org/html/rfc3339#section-5.8).
+
+<!-- cache-key: cdktf-0.18.0 input-13bd8e71cdf5fa3e7a18a3d1a2e20ff12ed7d291e84a336a056ad1006100d7f8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/lakeformation_resource_lf_tags.html.markdown b/website/docs/cdktf/python/r/lakeformation_resource_lf_tags.html.markdown
new file mode 100644
index 00000000000..98177327ab5
--- /dev/null
+++ b/website/docs/cdktf/python/r/lakeformation_resource_lf_tags.html.markdown
@@ -0,0 +1,162 @@
+---
+subcategory: "Lake Formation"
+layout: "aws"
+page_title: "AWS: aws_lakeformation_resource_lf_tags"
+description: |-
+    Manages an attachment between one or more LF-tags and an existing Lake Formation resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lakeformation_resource_lf_tags
+
+Manages an attachment between one or more existing LF-tags and an existing Lake Formation resource.
+
+## Example Usage
+
+### Database Example
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.lakeformation_lf_tag import LakeformationLfTag
+from imports.aws.lakeformation_resource_lf_tags import LakeformationResourceLfTags
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = LakeformationLfTag(self, "example",
+            key="right",
+            values=["abbey", "village", "luffield", "woodcote", "copse", "chapel", "stowe", "club"
+            ]
+        )
+        aws_lakeformation_resource_lf_tags_example =
+        LakeformationResourceLfTags(self, "example_1",
+            database=LakeformationResourceLfTagsDatabase(
+                name=Token.as_string(aws_glue_catalog_database_example.name)
+            ),
+            lf_tag=[LakeformationResourceLfTagsLfTag(
+                key=example.key,
+                value="stowe"
+            )
+            ]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_lakeformation_resource_lf_tags_example.override_logical_id("example")
+```
+
+### Multiple Tags Example
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.lakeformation_lf_tag import LakeformationLfTag
+from imports.aws.lakeformation_resource_lf_tags import LakeformationResourceLfTags
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        LakeformationLfTag(self, "example",
+            key="right",
+            values=["abbey", "village", "luffield", "woodcote", "copse", "chapel", "stowe", "club"
+            ]
+        )
+        LakeformationLfTag(self, "example2",
+            key="left",
+            values=["farm", "theloop", "aintree", "brooklands", "maggotts", "becketts", "vale"
+            ]
+        )
+        aws_lakeformation_resource_lf_tags_example =
+        LakeformationResourceLfTags(self, "example_2",
+            database=LakeformationResourceLfTagsDatabase(
+                name=Token.as_string(aws_glue_catalog_database_example.name)
+            ),
+            lf_tag=[LakeformationResourceLfTagsLfTag(
+                key="right",
+                value="luffield"
+            ), LakeformationResourceLfTagsLfTag(
+                key="left",
+                value="aintree"
+            )
+            ]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_lakeformation_resource_lf_tags_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `lf_tag` – (Required) Set of LF-tags to attach to the resource. See below.
+
+Exactly one of the following is required:
+
+* `database` - (Optional) Configuration block for a database resource. See below.
+* `table` - (Optional) Configuration block for a table resource. See below.
+* `table_with_columns` - (Optional) Configuration block for a table with columns resource. See below.
+
+The following arguments are optional:
+
+* `catalog_id` – (Optional) Identifier for the Data Catalog. By default, the account ID. The Data Catalog is the persistent metadata store. It contains database definitions, table definitions, and other control information to manage your Lake Formation environment.
+
+### lf_tag
+
+The following arguments are required:
+
+* `key` – (Required) Key name for an existing LF-tag.
+* `value` - (Required) Value from the possible values for the LF-tag.
+
+The following argument is optional:
+
+* `catalog_id` - (Optional) Identifier for the Data Catalog. By default, it is the account ID of the caller.
+
+### database
+
+The following argument is required:
+
+* `name` – (Required) Name of the database resource. Unique to the Data Catalog.
+
+The following argument is optional:
+
+* `catalog_id` - (Optional) Identifier for the Data Catalog. By default, it is the account ID of the caller.
+
+### table
+
+The following argument is required:
+
+* `database_name` – (Required) Name of the database for the table. Unique to a Data Catalog.
+* `name` - (Required, at least one of `name` or `wildcard`) Name of the table.
+* `wildcard` - (Required, at least one of `name` or `wildcard`) Whether to use a wildcard representing every table under a database. Defaults to `false`.
+
+The following arguments are optional:
+
+* `catalog_id` - (Optional) Identifier for the Data Catalog. By default, it is the account ID of the caller.
+
+### table_with_columns
+
+The following arguments are required:
+
+* `column_names` - (Required, at least one of `column_names` or `wildcard`) Set of column names for the table.
+* `database_name` – (Required) Name of the database for the table with columns resource. Unique to the Data Catalog.
+* `name` – (Required) Name of the table resource.
+* `wildcard` - (Required, at least one of `column_names` or `wildcard`) Whether to use a column wildcard. If `excluded_column_names` is included, `wildcard` must be set to `true` to avoid Terraform reporting a difference.
+
+The following arguments are optional:
+
+* `catalog_id` - (Optional) Identifier for the Data Catalog. By default, it is the account ID of the caller.
+* `excluded_column_names` - (Optional) Set of column names for the table to exclude. If `excluded_column_names` is included, `wildcard` must be set to `true` to avoid Terraform reporting a difference.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+<!-- cache-key: cdktf-0.18.0 input-c545a08beff672f6286efb5bcffb1247151c3c8aba0ba2aa227296062430ce8a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/lambda_alias.html.markdown b/website/docs/cdktf/python/r/lambda_alias.html.markdown
new file mode 100644
index 00000000000..d272cf2cfb2
--- /dev/null
+++ b/website/docs/cdktf/python/r/lambda_alias.html.markdown
@@ -0,0 +1,87 @@
+---
+subcategory: "Lambda"
+layout: "aws"
+page_title: "AWS: aws_lambda_alias"
+description: |-
+  Creates a Lambda function alias.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lambda_alias
+
+Creates a Lambda function alias. Creates an alias that points to the specified Lambda function version.
+
+For information about Lambda and how to use it, see [What is AWS Lambda?][1]
+For information about function aliases, see [CreateAlias][2] and [AliasRoutingConfiguration][3] in the API docs.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.lambda_alias import LambdaAlias
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        LambdaAlias(self, "test_lambda_alias",
+            description="a sample description",
+            function_name=lambda_function_test.arn,
+            function_version="1",
+            name="my_alias",
+            routing_config=LambdaAliasRoutingConfig(
+                additional_version_weights={
+                    "2": 0.5
+                }
+            )
+        )
+```
+
+## Argument Reference
+
+* `name` - (Required) Name for the alias you are creating. Pattern: `(?!^[0-9]+$)([a-zA-Z0-9-_]+)`
+* `description` - (Optional) Description of the alias.
+* `function_name` - (Required) Lambda Function name or ARN.
+* `function_version` - (Required) Lambda function version for which you are creating the alias. Pattern: `(\$LATEST|[0-9]+)`.
+* `routing_config` - (Optional) The Lambda alias' route configuration settings. Fields documented below
+
+`routing_config` supports the following arguments:
+
+* `additional_version_weights` - (Optional) A map that defines the proportion of events that should be sent to different versions of a lambda function.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) identifying your Lambda function alias.
+* `invoke_arn` - The ARN to be used for invoking Lambda Function from API Gateway - to be used in [`aws_api_gateway_integration`](/docs/providers/aws/r/api_gateway_integration.html)'s `uri`
+
+[1]: http://docs.aws.amazon.com/lambda/latest/dg/welcome.html
+[2]: http://docs.aws.amazon.com/lambda/latest/dg/API_CreateAlias.html
+[3]: https://docs.aws.amazon.com/lambda/latest/dg/API_AliasRoutingConfiguration.html
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Lambda Function Aliases using the `function_name/alias`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Lambda Function Aliases using the `function_name/alias`. For example:
+
+```console
+% terraform import aws_lambda_alias.test_lambda_alias my_test_lambda_function/my_alias
+```
+
+<!-- cache-key: cdktf-0.18.0 input-8fb769e7276158548fab5fb93af4f2a28e9364558792a79cc5b94ffb6bf2c452 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/lambda_code_signing_config.html.markdown b/website/docs/cdktf/python/r/lambda_code_signing_config.html.markdown
new file mode 100644
index 00000000000..49d8cdac1fe
--- /dev/null
+++ b/website/docs/cdktf/python/r/lambda_code_signing_config.html.markdown
@@ -0,0 +1,85 @@
+---
+subcategory: "Lambda"
+layout: "aws"
+page_title: "AWS: aws_lambda_code_signing_config"
+description: |-
+  Provides a Lambda Code Signing Config resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lambda_code_signing_config
+
+Provides a Lambda Code Signing Config resource. A code signing configuration defines a list of allowed signing profiles and defines the code-signing validation policy (action to be taken if deployment validation checks fail).
+
+For information about Lambda code signing configurations and how to use them, see [configuring code signing for Lambda functions][1]
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.lambda_code_signing_config import LambdaCodeSigningConfig
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        LambdaCodeSigningConfig(self, "new_csc",
+            allowed_publishers=LambdaCodeSigningConfigAllowedPublishers(
+                signing_profile_version_arns=[example1.arn, example2.arn]
+            ),
+            description="My awesome code signing config.",
+            policies=LambdaCodeSigningConfigPolicies(
+                untrusted_artifact_on_deployment="Warn"
+            )
+        )
+```
+
+## Argument Reference
+
+* `allowed_publishers` (Required) A configuration block of allowed publishers as signing profiles for this code signing configuration. Detailed below.
+* `policies` (Optional) A configuration block of code signing policies that define the actions to take if the validation checks fail. Detailed below.
+* `description` - (Optional) Descriptive name for this code signing configuration.
+
+The `allowed_publishers` block supports the following argument:
+
+* `signing_profile_version_arns` - (Required) The Amazon Resource Name (ARN) for each of the signing profiles. A signing profile defines a trusted user who can sign a code package.
+
+The `policies` block supports the following argument:
+
+* `untrusted_artifact_on_deployment` - (Required) Code signing configuration policy for deployment validation failure. If you set the policy to Enforce, Lambda blocks the deployment request if code-signing validation checks fail. If you set the policy to Warn, Lambda allows the deployment and creates a CloudWatch log. Valid values: `Warn`, `Enforce`. Default value: `Warn`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the code signing configuration.
+* `config_id` - Unique identifier for the code signing configuration.
+* `last_modified` - The date and time that the code signing configuration was last modified.
+
+[1]: https://docs.aws.amazon.com/lambda/latest/dg/configuration-codesigning.html
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Code Signing Configs using their ARN. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Code Signing Configs using their ARN. For example:
+
+```console
+% terraform import aws_lambda_code_signing_config.imported_csc arn:aws:lambda:us-west-2:123456789012:code-signing-config:csc-0f6c334abcdea4d8b
+```
+
+<!-- cache-key: cdktf-0.18.0 input-b27a1e90446049f7c1773fd983c1f96949a20ac313e28f81bd237fd17f96c857 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/lambda_event_source_mapping.html.markdown b/website/docs/cdktf/python/r/lambda_event_source_mapping.html.markdown
new file mode 100644
index 00000000000..330e29e54e9
--- /dev/null
+++ b/website/docs/cdktf/python/r/lambda_event_source_mapping.html.markdown
@@ -0,0 +1,337 @@
+---
+subcategory: "Lambda"
+layout: "aws"
+page_title: "AWS: aws_lambda_event_source_mapping"
+description: |-
+  Provides a Lambda event source mapping. This allows Lambda functions to get events from Kinesis, DynamoDB, SQS, Amazon MQ and Managed Streaming for Apache Kafka (MSK).
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lambda_event_source_mapping
+
+Provides a Lambda event source mapping. This allows Lambda functions to get events from Kinesis, DynamoDB, SQS, Amazon MQ and Managed Streaming for Apache Kafka (MSK).
+
+For information about Lambda and how to use it, see [What is AWS Lambda?][1].
+For information about event source mappings, see [CreateEventSourceMapping][2] in the API docs.
+
+## Example Usage
+
+### DynamoDB
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.lambda_event_source_mapping import LambdaEventSourceMapping
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        LambdaEventSourceMapping(self, "example",
+            event_source_arn=Token.as_string(aws_dynamodb_table_example.stream_arn),
+            function_name=Token.as_string(aws_lambda_function_example.arn),
+            starting_position="LATEST"
+        )
+```
+
+### Kinesis
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.lambda_event_source_mapping import LambdaEventSourceMapping
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        LambdaEventSourceMapping(self, "example",
+            event_source_arn=Token.as_string(aws_kinesis_stream_example.arn),
+            function_name=Token.as_string(aws_lambda_function_example.arn),
+            starting_position="LATEST"
+        )
+```
+
+### Managed Streaming for Apache Kafka (MSK)
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.lambda_event_source_mapping import LambdaEventSourceMapping
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        LambdaEventSourceMapping(self, "example",
+            event_source_arn=Token.as_string(aws_msk_cluster_example.arn),
+            function_name=Token.as_string(aws_lambda_function_example.arn),
+            starting_position="TRIM_HORIZON",
+            topics=["Example"]
+        )
+```
+
+### Self Managed Apache Kafka
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.lambda_event_source_mapping import LambdaEventSourceMapping
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        LambdaEventSourceMapping(self, "example",
+            function_name=Token.as_string(aws_lambda_function_example.arn),
+            self_managed_event_source=LambdaEventSourceMappingSelfManagedEventSource(
+                endpoints={
+                    "KAFKA_BOOTSTRAP_SERVERS": "kafka1.example.com:9092,kafka2.example.com:9092"
+                }
+            ),
+            source_access_configuration=[LambdaEventSourceMappingSourceAccessConfiguration(
+                type="VPC_SUBNET",
+                uri="subnet:subnet-example1"
+            ), LambdaEventSourceMappingSourceAccessConfiguration(
+                type="VPC_SUBNET",
+                uri="subnet:subnet-example2"
+            ), LambdaEventSourceMappingSourceAccessConfiguration(
+                type="VPC_SECURITY_GROUP",
+                uri="security_group:sg-example"
+            )
+            ],
+            starting_position="TRIM_HORIZON",
+            topics=["Example"]
+        )
+```
+
+### SQS
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.lambda_event_source_mapping import LambdaEventSourceMapping
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        LambdaEventSourceMapping(self, "example",
+            event_source_arn=sqs_queue_test.arn,
+            function_name=Token.as_string(aws_lambda_function_example.arn)
+        )
+```
+
+### SQS with event filter
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.lambda_event_source_mapping import LambdaEventSourceMapping
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        LambdaEventSourceMapping(self, "example",
+            event_source_arn=sqs_queue_test.arn,
+            filter_criteria=LambdaEventSourceMappingFilterCriteria(
+                filter=[LambdaEventSourceMappingFilterCriteriaFilter(
+                    pattern=Token.as_string(
+                        Fn.jsonencode({
+                            "body": {
+                                "Location": ["New York"],
+                                "Temperature": [{
+                                    "numeric": [">", 0, "<=", 100]
+                                }
+                                ]
+                            }
+                        }))
+                )
+                ]
+            ),
+            function_name=Token.as_string(aws_lambda_function_example.arn)
+        )
+```
+
+### Amazon MQ (ActiveMQ)
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.lambda_event_source_mapping import LambdaEventSourceMapping
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        LambdaEventSourceMapping(self, "example",
+            batch_size=10,
+            enabled=True,
+            event_source_arn=Token.as_string(aws_mq_broker_example.arn),
+            function_name=Token.as_string(aws_lambda_function_example.arn),
+            queues=["example"],
+            source_access_configuration=[LambdaEventSourceMappingSourceAccessConfiguration(
+                type="BASIC_AUTH",
+                uri=Token.as_string(aws_secretsmanager_secret_version_example.arn)
+            )
+            ]
+        )
+```
+
+### Amazon MQ (RabbitMQ)
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.lambda_event_source_mapping import LambdaEventSourceMapping
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        LambdaEventSourceMapping(self, "example",
+            batch_size=1,
+            enabled=True,
+            event_source_arn=Token.as_string(aws_mq_broker_example.arn),
+            function_name=Token.as_string(aws_lambda_function_example.arn),
+            queues=["example"],
+            source_access_configuration=[LambdaEventSourceMappingSourceAccessConfiguration(
+                type="VIRTUAL_HOST",
+                uri="/example"
+            ), LambdaEventSourceMappingSourceAccessConfiguration(
+                type="BASIC_AUTH",
+                uri=Token.as_string(aws_secretsmanager_secret_version_example.arn)
+            )
+            ]
+        )
+```
+
+## Argument Reference
+
+* `amazon_managed_kafka_event_source_config` - (Optional) Additional configuration block for Amazon Managed Kafka sources. Incompatible with "self_managed_event_source" and "self_managed_kafka_event_source_config". Detailed below.
+* `batch_size` - (Optional) The largest number of records that Lambda will retrieve from your event source at the time of invocation. Defaults to `100` for DynamoDB, Kinesis, MQ and MSK, `10` for SQS.
+* `bisect_batch_on_function_error`: - (Optional) If the function returns an error, split the batch in two and retry. Only available for stream sources (DynamoDB and Kinesis). Defaults to `false`.
+* `destination_config`: - (Optional) An Amazon SQS queue or Amazon SNS topic destination for failed records. Only available for stream sources (DynamoDB and Kinesis). Detailed below.
+* `document_db_event_source_config`: - (Optional) Configuration settings for a DocumentDB event source. Detailed below.
+* `enabled` - (Optional) Determines if the mapping will be enabled on creation. Defaults to `true`.
+* `event_source_arn` - (Optional) The event source ARN - this is required for Kinesis stream, DynamoDB stream, SQS queue, MQ broker, MSK cluster or DocumentDB change stream.  It is incompatible with a Self Managed Kafka source.
+* `filter_criteria` - (Optional) The criteria to use for [event filtering](https://docs.aws.amazon.com/lambda/latest/dg/invocation-eventfiltering.html) Kinesis stream, DynamoDB stream, SQS queue event sources. Detailed below.
+* `function_name` - (Required) The name or the ARN of the Lambda function that will be subscribing to events.
+* `function_response_types` - (Optional) A list of current response type enums applied to the event source mapping for [AWS Lambda checkpointing](https://docs.aws.amazon.com/lambda/latest/dg/with-ddb.html#services-ddb-batchfailurereporting). Only available for SQS and stream sources (DynamoDB and Kinesis). Valid values: `ReportBatchItemFailures`.
+* `maximum_batching_window_in_seconds` - (Optional) The maximum amount of time to gather records before invoking the function, in seconds (between 0 and 300). Records will continue to buffer (or accumulate in the case of an SQS queue event source) until either `maximum_batching_window_in_seconds` expires or `batch_size` has been met. For streaming event sources, defaults to as soon as records are available in the stream. If the batch it reads from the stream/queue only has one record in it, Lambda only sends one record to the function. Only available for stream sources (DynamoDB and Kinesis) and SQS standard queues.
+* `maximum_record_age_in_seconds`: - (Optional) The maximum age of a record that Lambda sends to a function for processing. Only available for stream sources (DynamoDB and Kinesis). Must be either -1 (forever, and the default value) or between 60 and 604800 (inclusive).
+* `maximum_retry_attempts`: - (Optional) The maximum number of times to retry when the function returns an error. Only available for stream sources (DynamoDB and Kinesis). Minimum and default of -1 (forever), maximum of 10000.
+* `parallelization_factor`: - (Optional) The number of batches to process from each shard concurrently. Only available for stream sources (DynamoDB and Kinesis). Minimum and default of 1, maximum of 10.
+* `queues` - (Optional) The name of the Amazon MQ broker destination queue to consume. Only available for MQ sources. The list must contain exactly one queue name.
+* `scaling_config` - (Optional) Scaling configuration of the event source. Only available for SQS queues. Detailed below.
+* `self_managed_event_source`: - (Optional) For Self Managed Kafka sources, the location of the self managed cluster. If set, configuration must also include `source_access_configuration`. Detailed below.
+* `self_managed_kafka_event_source_config` - (Optional) Additional configuration block for Self Managed Kafka sources. Incompatible with "event_source_arn" and "amazon_managed_kafka_event_source_config". Detailed below.
+* `source_access_configuration`: (Optional) For Self Managed Kafka sources, the access configuration for the source. If set, configuration must also include `self_managed_event_source`. Detailed below.
+* `starting_position` - (Optional) The position in the stream where AWS Lambda should start reading. Must be one of `AT_TIMESTAMP` (Kinesis only), `LATEST` or `TRIM_HORIZON` if getting events from Kinesis, DynamoDB, MSK or Self Managed Apache Kafka. Must not be provided if getting events from SQS. More information about these positions can be found in the [AWS DynamoDB Streams API Reference](https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_streams_GetShardIterator.html) and [AWS Kinesis API Reference](https://docs.aws.amazon.com/kinesis/latest/APIReference/API_GetShardIterator.html#Kinesis-GetShardIterator-request-ShardIteratorType).
+* `starting_position_timestamp` - (Optional) A timestamp in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8) of the data record which to start reading when using `starting_position` set to `AT_TIMESTAMP`. If a record with this exact timestamp does not exist, the next later record is chosen. If the timestamp is older than the current trim horizon, the oldest available record is chosen.
+* `topics` - (Optional) The name of the Kafka topics. Only available for MSK sources. A single topic name must be specified.
+* `tumbling_window_in_seconds` - (Optional) The duration in seconds of a processing window for [AWS Lambda streaming analytics](https://docs.aws.amazon.com/lambda/latest/dg/with-kinesis.html#services-kinesis-windows). The range is between 1 second up to 900 seconds. Only available for stream sources (DynamoDB and Kinesis).
+
+### amazon_managed_kafka_event_source_config Configuration Block
+
+* `consumer_group_id` - (Optional) A Kafka consumer group ID between 1 and 200 characters for use when creating this event source mapping. If one is not specified, this value will be automatically generated. See [AmazonManagedKafkaEventSourceConfig Syntax](https://docs.aws.amazon.com/lambda/latest/dg/API_AmazonManagedKafkaEventSourceConfig.html).
+
+### destination_config Configuration Block
+
+* `on_failure` - (Optional) The destination configuration for failed invocations. Detailed below.
+
+#### destination_config on_failure Configuration Block
+
+* `destination_arn` - (Required) The Amazon Resource Name (ARN) of the destination resource.
+
+### document_db_event_source_config Configuration Block
+
+* `collection_name` - (Optional) The name of the collection to consume within the database. If you do not specify a collection, Lambda consumes all collections.
+* `database_name` - (Required) The name of the database to consume within the DocumentDB cluster.
+* `full_document` - (Optional) Determines what DocumentDB sends to your event stream during document update operations. If set to `UpdateLookup`, DocumentDB sends a delta describing the changes, along with a copy of the entire document. Otherwise, DocumentDB sends only a partial document that contains the changes. Valid values: `UpdateLookup`, `Default`.
+
+### filter_criteria Configuration Block
+
+* `filter` - (Optional) A set of up to 5 filter. If an event satisfies at least one, Lambda sends the event to the function or adds it to the next batch. Detailed below.
+
+#### filter_criteria filter Configuration Block
+
+* `pattern` - (Optional) A filter pattern up to 4096 characters. See [Filter Rule Syntax](https://docs.aws.amazon.com/lambda/latest/dg/invocation-eventfiltering.html#filtering-syntax).
+
+### scaling_config Configuration Block
+
+* `maximum_concurrency` - (Optional) Limits the number of concurrent instances that the Amazon SQS event source can invoke. Must be between `2` and `1000`. See [Configuring maximum concurrency for Amazon SQS event sources](https://docs.aws.amazon.com/lambda/latest/dg/with-sqs.html#events-sqs-max-concurrency).
+
+### self_managed_event_source Configuration Block
+
+* `endpoints` - (Required) A map of endpoints for the self managed source.  For Kafka self-managed sources, the key should be `KAFKA_BOOTSTRAP_SERVERS` and the value should be a string with a comma separated list of broker endpoints.
+
+### self_managed_kafka_event_source_config Configuration Block
+
+* `consumer_group_id` - (Optional) A Kafka consumer group ID between 1 and 200 characters for use when creating this event source mapping. If one is not specified, this value will be automatically generated. See [SelfManagedKafkaEventSourceConfig Syntax](https://docs.aws.amazon.com/lambda/latest/dg/API_SelfManagedKafkaEventSourceConfig.html).
+
+### source_access_configuration Configuration Block
+
+* `type` - (Required) The type of this configuration.  For Self Managed Kafka you will need to supply blocks for type `VPC_SUBNET` and `VPC_SECURITY_GROUP`.
+* `uri` - (Required) The URI for this configuration.  For type `VPC_SUBNET` the value should be `subnet:subnet_id` where `subnet_id` is the value you would find in an aws_subnet resource's id attribute.  For type `VPC_SECURITY_GROUP` the value should be `security_group:security_group_id` where `security_group_id` is the value you would find in an aws_security_group resource's id attribute.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `function_arn` - The the ARN of the Lambda function the event source mapping is sending events to. (Note: this is a computed value that differs from `function_name` above.)
+* `last_modified` - The date this resource was last modified.
+* `last_processing_result` - The result of the last AWS Lambda invocation of your Lambda function.
+* `state` - The state of the event source mapping.
+* `state_transition_reason` - The reason the event source mapping is in its current state.
+* `uuid` - The UUID of the created event source mapping.
+
+[1]: http://docs.aws.amazon.com/lambda/latest/dg/welcome.html
+[2]: http://docs.aws.amazon.com/lambda/latest/dg/API_CreateEventSourceMapping.html
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Lambda event source mappings using the `UUID` (event source mapping identifier). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Lambda event source mappings using the `UUID` (event source mapping identifier). For example:
+
+```console
+% terraform import aws_lambda_event_source_mapping.event_source_mapping 12345kxodurf3443
+```
+
+<!-- cache-key: cdktf-0.18.0 input-9d88b308e90e49cb5ae6f4d7a9dca76ab29540094caed5a76071a24309375e14 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/lambda_function.html.markdown b/website/docs/cdktf/python/r/lambda_function.html.markdown
new file mode 100644
index 00000000000..3ff24c839ee
--- /dev/null
+++ b/website/docs/cdktf/python/r/lambda_function.html.markdown
@@ -0,0 +1,430 @@
+---
+subcategory: "Lambda"
+layout: "aws"
+page_title: "AWS: aws_lambda_function"
+description: |-
+  Provides a Lambda Function resource. Lambda allows you to trigger execution of code in response to events in AWS, enabling serverless backend solutions. The Lambda Function itself includes source code and runtime configuration.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lambda_function
+
+Provides a Lambda Function resource. Lambda allows you to trigger execution of code in response to events in AWS, enabling serverless backend solutions. The Lambda Function itself includes source code and runtime configuration.
+
+For information about Lambda and how to use it, see [What is AWS Lambda?][1]
+
+For a detailed example of setting up Lambda and API Gateway, see [Serverless Applications with AWS Lambda and API Gateway.][11]
+
+~> **NOTE:** Due to [AWS Lambda improved VPC networking changes that began deploying in September 2019](https://aws.amazon.com/blogs/compute/announcing-improved-vpc-networking-for-aws-lambda-functions/), EC2 subnets and security groups associated with Lambda Functions can take up to 45 minutes to successfully delete. Terraform AWS Provider version 2.31.0 and later automatically handles this increased timeout, however prior versions require setting the customizable deletion timeouts of those Terraform resources to 45 minutes (`delete = "45m"`). AWS and HashiCorp are working together to reduce the amount of time required for resource deletion and updates can be tracked in this [GitHub issue](https://github.com/hashicorp/terraform-provider-aws/issues/10329).
+
+~> **NOTE:** If you get a `KMSAccessDeniedException: Lambda was unable to decrypt the environment variables because KMS access was denied` error when invoking an [`aws_lambda_function`](/docs/providers/aws/r/lambda_function.html) with environment variables, the IAM role associated with the function may have been deleted and recreated _after_ the function was created. You can fix the problem two ways: 1) updating the function's role to another role and then updating it back again to the recreated role, or 2) by using Terraform to `taint` the function and `apply` your configuration again to recreate the function. (When you create a function, Lambda grants permissions on the KMS key to the function's IAM role. If the IAM role is recreated, the grant is no longer valid. Changing the function's role or recreating the function causes Lambda to update the grant.)
+
+-> To give an external source (like an EventBridge Rule, SNS, or S3) permission to access the Lambda function, use the [`aws_lambda_permission`](lambda_permission.html) resource. See [Lambda Permission Model][4] for more details. On the other hand, the `role` argument of this resource is the function's execution role for identity and access to AWS services and resources.
+
+## Example Usage
+
+### Basic Example
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.archive.data_archive_file import DataArchiveFile
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.iam_role import IamRole
+from imports.aws.lambda_function import LambdaFunction
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        # The following providers are missing schema information and might need manual adjustments to synthesize correctly: archive.
+        #     For a more precise conversion please use the --provider flag in convert.
+        lambda_ = DataArchiveFile(self, "lambda",
+            output_path="lambda_function_payload.zip",
+            source_file="lambda.js",
+            type="zip"
+        )
+        assume_role = DataAwsIamPolicyDocument(self, "assume_role",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["sts:AssumeRole"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["lambda.amazonaws.com"],
+                    type="Service"
+                )
+                ]
+            )
+            ]
+        )
+        iam_for_lambda = IamRole(self, "iam_for_lambda",
+            assume_role_policy=Token.as_string(assume_role.json),
+            name="iam_for_lambda"
+        )
+        LambdaFunction(self, "test_lambda",
+            environment=LambdaFunctionEnvironment(
+                variables={
+                    "foo": "bar"
+                }
+            ),
+            filename="lambda_function_payload.zip",
+            function_name="lambda_function_name",
+            handler="index.test",
+            role=iam_for_lambda.arn,
+            runtime="nodejs18.x",
+            source_code_hash=Token.as_string(lambda_.output_base64_sha256)
+        )
+```
+
+### Lambda Layers
+
+~> **NOTE:** The `aws_lambda_layer_version` attribute values for `arn` and `layer_arn` were swapped in version 2.0.0 of the Terraform AWS Provider. For version 1.x, use `layer_arn` references. For version 2.x, use `arn` references.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.lambda_function import LambdaFunction
+from imports.aws.lambda_layer_version import LambdaLayerVersion
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, layerName, functionName, role):
+        super().__init__(scope, name)
+        example = LambdaLayerVersion(self, "example",
+            layer_name=layer_name
+        )
+        aws_lambda_function_example = LambdaFunction(self, "example_1",
+            layers=[example.arn],
+            function_name=function_name,
+            role=role
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_lambda_function_example.override_logical_id("example")
+```
+
+### Lambda Ephemeral Storage
+
+Lambda Function Ephemeral Storage(`/tmp`) allows you to configure the storage upto `10` GB. The default value set to `512` MB.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.iam_role import IamRole
+from imports.aws.lambda_function import LambdaFunction
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        assume_role = DataAwsIamPolicyDocument(self, "assume_role",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["sts:AssumeRole"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["lambda.amazonaws.com"],
+                    type="Service"
+                )
+                ]
+            )
+            ]
+        )
+        iam_for_lambda = IamRole(self, "iam_for_lambda",
+            assume_role_policy=Token.as_string(assume_role.json),
+            name="iam_for_lambda"
+        )
+        LambdaFunction(self, "test_lambda",
+            ephemeral_storage=LambdaFunctionEphemeralStorage(
+                size=10240
+            ),
+            filename="lambda_function_payload.zip",
+            function_name="lambda_function_name",
+            handler="index.test",
+            role=iam_for_lambda.arn,
+            runtime="nodejs18.x"
+        )
+```
+
+### Lambda File Systems
+
+Lambda File Systems allow you to connect an Amazon Elastic File System (EFS) file system to a Lambda function to share data across function invocations, access existing data including large files, and save function state.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.efs_access_point import EfsAccessPoint
+from imports.aws.efs_file_system import EfsFileSystem
+from imports.aws.efs_mount_target import EfsMountTarget
+from imports.aws.lambda_function import LambdaFunction
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, functionName, role):
+        super().__init__(scope, name)
+        efs_for_lambda = EfsFileSystem(self, "efs_for_lambda",
+            tags={
+                "Name": "efs_for_lambda"
+            }
+        )
+        alpha = EfsMountTarget(self, "alpha",
+            file_system_id=efs_for_lambda.id,
+            security_groups=[sg_for_lambda.id],
+            subnet_id=subnet_for_lambda.id
+        )
+        access_point_for_lambda = EfsAccessPoint(self, "access_point_for_lambda",
+            file_system_id=efs_for_lambda.id,
+            posix_user=EfsAccessPointPosixUser(
+                gid=1000,
+                uid=1000
+            ),
+            root_directory=EfsAccessPointRootDirectory(
+                creation_info=EfsAccessPointRootDirectoryCreationInfo(
+                    owner_gid=1000,
+                    owner_uid=1000,
+                    permissions="777"
+                ),
+                path="/lambda"
+            )
+        )
+        LambdaFunction(self, "example",
+            depends_on=[alpha],
+            file_system_config=LambdaFunctionFileSystemConfig(
+                arn=access_point_for_lambda.arn,
+                local_mount_path="/mnt/efs"
+            ),
+            vpc_config=LambdaFunctionVpcConfig(
+                security_group_ids=[sg_for_lambda.id],
+                subnet_ids=[subnet_for_lambda.id]
+            ),
+            function_name=function_name,
+            role=role
+        )
+```
+
+### Lambda retries
+
+Lambda Functions allow you to configure error handling for asynchronous invocation. The settings that it supports are `Maximum age of event` and `Retry attempts` as stated in [Lambda documentation for Configuring error handling for asynchronous invocation](https://docs.aws.amazon.com/lambda/latest/dg/invocation-async.html#invocation-async-errors). To configure these settings, refer to the [aws_lambda_function_event_invoke_config resource](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_function_event_invoke_config).
+
+## CloudWatch Logging and Permissions
+
+For more information about CloudWatch Logs for Lambda, see the [Lambda User Guide](https://docs.aws.amazon.com/lambda/latest/dg/monitoring-functions-logs.html).
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformVariable, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudwatch_log_group import CloudwatchLogGroup
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.iam_policy import IamPolicy
+from imports.aws.iam_role_policy_attachment import IamRolePolicyAttachment
+from imports.aws.lambda_function import LambdaFunction
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, role):
+        super().__init__(scope, name)
+        # Terraform Variables are not always the best fit for getting inputs in the context of Terraform CDK.
+        #     You can read more about this at https://cdk.tf/variables
+        lambda_function_name = TerraformVariable(self, "lambda_function_name",
+            default="lambda_function_name"
+        )
+        example = CloudwatchLogGroup(self, "example",
+            name="/aws/lambda/${" + lambda_function_name.value + "}",
+            retention_in_days=14
+        )
+        lambda_logging = DataAwsIamPolicyDocument(self, "lambda_logging",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents"
+                ],
+                effect="Allow",
+                resources=["arn:aws:logs:*:*:*"]
+            )
+            ]
+        )
+        aws_iam_policy_lambda_logging = IamPolicy(self, "lambda_logging_3",
+            description="IAM policy for logging from a lambda",
+            name="lambda_logging",
+            path="/",
+            policy=Token.as_string(lambda_logging.json)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_policy_lambda_logging.override_logical_id("lambda_logging")
+        lambda_logs = IamRolePolicyAttachment(self, "lambda_logs",
+            policy_arn=Token.as_string(aws_iam_policy_lambda_logging.arn),
+            role=iam_for_lambda.name
+        )
+        LambdaFunction(self, "test_lambda",
+            depends_on=[lambda_logs, example],
+            function_name=lambda_function_name.string_value,
+            role=role
+        )
+```
+
+## Specifying the Deployment Package
+
+AWS Lambda expects source code to be provided as a deployment package whose structure varies depending on which `runtime` is in use. See [Runtimes][6] for the valid values of `runtime`. The expected structure of the deployment package can be found in [the AWS Lambda documentation for each runtime][8].
+
+Once you have created your deployment package you can specify it either directly as a local file (using the `filename` argument) or indirectly via Amazon S3 (using the `s3_bucket`, `s3_key` and `s3_object_version` arguments). When providing the deployment package via S3 it may be useful to use [the `aws_s3_object` resource](s3_object.html) to upload it.
+
+For larger deployment packages it is recommended by Amazon to upload via S3, since the S3 API has better support for uploading large files efficiently.
+
+## Argument Reference
+
+The following arguments are required:
+
+* `function_name` - (Required) Unique name for your Lambda Function.
+* `role` - (Required) Amazon Resource Name (ARN) of the function's execution role. The role provides the function's identity and access to AWS services and resources.
+
+The following arguments are optional:
+
+* `architectures` - (Optional) Instruction set architecture for your Lambda function. Valid values are `["x86_64"]` and `["arm64"]`. Default is `["x86_64"]`. Removing this attribute, function's architecture stay the same.
+* `code_signing_config_arn` - (Optional) To enable code signing for this function, specify the ARN of a code-signing configuration. A code-signing configuration includes a set of signing profiles, which define the trusted publishers for this function.
+* `dead_letter_config` - (Optional) Configuration block. Detailed below.
+* `description` - (Optional) Description of what your Lambda Function does.
+* `environment` - (Optional) Configuration block. Detailed below.
+* `ephemeral_storage` - (Optional) The amount of Ephemeral storage(`/tmp`) to allocate for the Lambda Function in MB. This parameter is used to expand the total amount of Ephemeral storage available, beyond the default amount of `512`MB. Detailed below.
+* `file_system_config` - (Optional) Configuration block. Detailed below.
+* `filename` - (Optional) Path to the function's deployment package within the local filesystem. Exactly one of `filename`, `image_uri`, or `s3_bucket` must be specified.
+* `handler` - (Optional) Function [entrypoint][3] in your code.
+* `image_config` - (Optional) Configuration block. Detailed below.
+* `image_uri` - (Optional) ECR image URI containing the function's deployment package. Exactly one of `filename`, `image_uri`,  or `s3_bucket` must be specified.
+* `kms_key_arn` - (Optional) Amazon Resource Name (ARN) of the AWS Key Management Service (KMS) key that is used to encrypt environment variables. If this configuration is not provided when environment variables are in use, AWS Lambda uses a default service key. If this configuration is provided when environment variables are not in use, the AWS Lambda API does not save this configuration and Terraform will show a perpetual difference of adding the key. To fix the perpetual difference, remove this configuration.
+* `layers` - (Optional) List of Lambda Layer Version ARNs (maximum of 5) to attach to your Lambda Function. See [Lambda Layers][10]
+* `memory_size` - (Optional) Amount of memory in MB your Lambda Function can use at runtime. Defaults to `128`. See [Limits][5]
+* `package_type` - (Optional) Lambda deployment package type. Valid values are `Zip` and `Image`. Defaults to `Zip`.
+* `publish` - (Optional) Whether to publish creation/change as new Lambda Function Version. Defaults to `false`.
+* `reserved_concurrent_executions` - (Optional) Amount of reserved concurrent executions for this lambda function. A value of `0` disables lambda from being triggered and `-1` removes any concurrency limitations. Defaults to Unreserved Concurrency Limits `-1`. See [Managing Concurrency][9]
+* `replace_security_groups_on_destroy` - (Optional, **Deprecated**) **AWS no longer supports this operation. This attribute now has no effect and will be removed in a future major version.** Whether to replace the security groups on associated lambda network interfaces upon destruction. Removing these security groups from orphaned network interfaces can speed up security group deletion times by avoiding a dependency on AWS's internal cleanup operations. By default, the ENI security groups will be replaced with the `default` security group in the function's VPC. Set the `replacement_security_group_ids` attribute to use a custom list of security groups for replacement.
+* `replacement_security_group_ids` - (Optional, **Deprecated**) List of security group IDs to assign to orphaned Lambda function network interfaces upon destruction. `replace_security_groups_on_destroy` must be set to `true` to use this attribute.
+* `runtime` - (Optional) Identifier of the function's runtime. See [Runtimes][6] for valid values.
+* `s3_bucket` - (Optional) S3 bucket location containing the function's deployment package. This bucket must reside in the same AWS region where you are creating the Lambda function. Exactly one of `filename`, `image_uri`, or `s3_bucket` must be specified. When `s3_bucket` is set, `s3_key` is required.
+* `s3_key` - (Optional) S3 key of an object containing the function's deployment package. When `s3_bucket` is set, `s3_key` is required.
+* `s3_object_version` - (Optional) Object version containing the function's deployment package. Conflicts with `filename` and `image_uri`.
+* `skip_destroy` - (Optional) Set to true if you do not wish the function to be deleted at destroy time, and instead just remove the function from the Terraform state.
+* `source_code_hash` - (Optional) Used to trigger updates. Must be set to a base64-encoded SHA256 hash of the package file specified with either `filename` or `s3_key`. The usual way to set this is `filebase64sha256("file.zip")` (Terraform 0.11.12 and later) or `base64sha256(file("file.zip"))` (Terraform 0.11.11 and earlier), where "file.zip" is the local filename of the lambda function source archive.
+* `snap_start` - (Optional) Snap start settings block. Detailed below.
+* `tags` - (Optional) Map of tags to assign to the object. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `timeout` - (Optional) Amount of time your Lambda Function has to run in seconds. Defaults to `3`. See [Limits][5].
+* `tracing_config` - (Optional) Configuration block. Detailed below.
+* `vpc_config` - (Optional) Configuration block. Detailed below.
+
+### dead_letter_config
+
+Dead letter queue configuration that specifies the queue or topic where Lambda sends asynchronous events when they fail processing. For more information, see [Dead Letter Queues](https://docs.aws.amazon.com/lambda/latest/dg/invocation-async.html#dlq).
+
+* `target_arn` - (Required) ARN of an SNS topic or SQS queue to notify when an invocation fails. If this option is used, the function's IAM role must be granted suitable access to write to the target object, which means allowing either the `sns:Publish` or `sqs:SendMessage` action on this ARN, depending on which service is targeted.
+
+### environment
+
+* `variables` - (Optional) Map of environment variables that are accessible from the function code during execution. If provided at least one key must be present.
+
+### ephemeral_storage
+
+* `size` - (Required) The size of the Lambda function Ephemeral storage(`/tmp`) represented in MB. The minimum supported `ephemeral_storage` value defaults to `512`MB and the maximum supported value is `10240`MB.
+
+### file_system_config
+
+Connection settings for an EFS file system. Before creating or updating Lambda functions with `file_system_config`, EFS mount targets must be in available lifecycle state. Use `depends_on` to explicitly declare this dependency. See [Using Amazon EFS with Lambda][12].
+
+* `arn` - (Required) Amazon Resource Name (ARN) of the Amazon EFS Access Point that provides access to the file system.
+* `local_mount_path` - (Required) Path where the function can access the file system, starting with /mnt/.
+
+### image_config
+
+Container image configuration values that override the values in the container image Dockerfile.
+
+* `command` - (Optional) Parameters that you want to pass in with `entry_point`.
+* `entry_point` - (Optional) Entry point to your application, which is typically the location of the runtime executable.
+* `working_directory` - (Optional) Working directory.
+
+### snap_start
+
+Snap start settings for low-latency startups. This feature is currently only supported for `java11` and `java17` runtimes. Remove this block to delete the associated settings (rather than setting `apply_on = "None"`).
+
+* `apply_on` - (Required) Conditions where snap start is enabled. Valid values are `PublishedVersions`.
+
+### tracing_config
+
+* `mode` - (Required) Whether to sample and trace a subset of incoming requests with AWS X-Ray. Valid values are `PassThrough` and `Active`. If `PassThrough`, Lambda will only trace the request from an upstream service if it contains a tracing header with "sampled=1". If `Active`, Lambda will respect any tracing header it receives from an upstream service. If no tracing header is received, Lambda will call X-Ray for a tracing decision.
+
+### vpc_config
+
+For network connectivity to AWS resources in a VPC, specify a list of security groups and subnets in the VPC. When you connect a function to a VPC, it can only access resources and the internet through that VPC. See [VPC Settings][7].
+
+~> **NOTE:** If `subnet_ids`, `security_group_ids` and `ipv6_allowed_for_dual_stack` are empty then `vpc_config` is considered to be empty or unset.
+
+* `ipv6_allowed_for_dual_stack` - (Optional) Allows outbound IPv6 traffic on VPC functions that are connected to dual-stack subnets. Default is `false`.
+* `security_group_ids` - (Required) List of security group IDs associated with the Lambda function.
+* `subnet_ids` - (Required) List of subnet IDs associated with the Lambda function.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) identifying your Lambda Function.
+* `invoke_arn` - ARN to be used for invoking Lambda Function from API Gateway - to be used in [`aws_api_gateway_integration`](/docs/providers/aws/r/api_gateway_integration.html)'s `uri`.
+* `last_modified` - Date this resource was last modified.
+* `qualified_arn` - ARN identifying your Lambda Function Version (if versioning is enabled via `publish = true`).
+* `qualified_invoke_arn` - Qualified ARN (ARN with lambda version number) to be used for invoking Lambda Function from API Gateway - to be used in [`aws_api_gateway_integration`](/docs/providers/aws/r/api_gateway_integration.html)'s `uri`.
+* `signing_job_arn` - ARN of the signing job.
+* `signing_profile_version_arn` - ARN of the signing profile version.
+* `snap_start.optimization_status` - Optimization status of the snap start configuration. Valid values are `On` and `Off`.
+* `source_code_size` - Size in bytes of the function .zip file.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `version` - Latest published version of your Lambda Function.
+* `vpc_config.vpc_id` - ID of the VPC.
+
+[1]: https://docs.aws.amazon.com/lambda/latest/dg/welcome.html
+[3]: https://docs.aws.amazon.com/lambda/latest/dg/walkthrough-custom-events-create-test-function.html
+[4]: https://docs.aws.amazon.com/lambda/latest/dg/intro-permission-model.html
+[5]: https://docs.aws.amazon.com/lambda/latest/dg/limits.html
+[6]: https://docs.aws.amazon.com/lambda/latest/dg/API_CreateFunction.html#SSS-CreateFunction-request-Runtime
+[7]: https://docs.aws.amazon.com/lambda/latest/dg/configuration-vpc.html
+[8]: https://docs.aws.amazon.com/lambda/latest/dg/deployment-package-v2.html
+[9]: https://docs.aws.amazon.com/lambda/latest/dg/concurrent-executions.html
+[10]: https://docs.aws.amazon.com/lambda/latest/dg/configuration-layers.html
+[11]: https://learn.hashicorp.com/terraform/aws/lambda-api-gateway
+[12]: https://docs.aws.amazon.com/lambda/latest/dg/services-efs.html
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `10m`)
+* `update` - (Default `10m`)
+* `delete` - (Default `10m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Lambda Functions using the `function_name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Lambda Functions using the `function_name`. For example:
+
+```console
+% terraform import aws_lambda_function.test_lambda my_test_lambda_function
+```
+
+<!-- cache-key: cdktf-0.18.0 input-169b7bbe476a39e939fb773a4176feae6d770083a7a351a021d29d9dd52746cd -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/lambda_function_event_invoke_config.html.markdown b/website/docs/cdktf/python/r/lambda_function_event_invoke_config.html.markdown
new file mode 100644
index 00000000000..e5a8145b494
--- /dev/null
+++ b/website/docs/cdktf/python/r/lambda_function_event_invoke_config.html.markdown
@@ -0,0 +1,241 @@
+---
+subcategory: "Lambda"
+layout: "aws"
+page_title: "AWS: aws_lambda_function_event_invoke_config"
+description: |-
+  Manages an asynchronous invocation configuration for a Lambda Function or Alias.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lambda_function_event_invoke_config
+
+Manages an asynchronous invocation configuration for a Lambda Function or Alias. More information about asynchronous invocations and the configurable values can be found in the [Lambda Developer Guide](https://docs.aws.amazon.com/lambda/latest/dg/invocation-async.html).
+
+## Example Usage
+
+### Destination Configuration
+
+~> **NOTE:** Ensure the Lambda Function IAM Role has necessary permissions for the destination, such as `sqs:SendMessage` or `sns:Publish`, otherwise the API will return a generic `InvalidParameterValueException: The destination ARN arn:PARTITION:SERVICE:REGION:ACCOUNT:RESOURCE is invalid.` error.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.lambda_function_event_invoke_config import LambdaFunctionEventInvokeConfig
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        LambdaFunctionEventInvokeConfig(self, "example",
+            destination_config=LambdaFunctionEventInvokeConfigDestinationConfig(
+                on_failure=LambdaFunctionEventInvokeConfigDestinationConfigOnFailure(
+                    destination=Token.as_string(aws_sqs_queue_example.arn)
+                ),
+                on_success=LambdaFunctionEventInvokeConfigDestinationConfigOnSuccess(
+                    destination=Token.as_string(aws_sns_topic_example.arn)
+                )
+            ),
+            function_name=Token.as_string(aws_lambda_alias_example.function_name)
+        )
+```
+
+### Error Handling Configuration
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.lambda_function_event_invoke_config import LambdaFunctionEventInvokeConfig
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        LambdaFunctionEventInvokeConfig(self, "example",
+            function_name=Token.as_string(aws_lambda_alias_example.function_name),
+            maximum_event_age_in_seconds=60,
+            maximum_retry_attempts=0
+        )
+```
+
+### Configuration for Alias Name
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.lambda_function_event_invoke_config import LambdaFunctionEventInvokeConfig
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        LambdaFunctionEventInvokeConfig(self, "example",
+            function_name=Token.as_string(aws_lambda_alias_example.function_name),
+            qualifier=Token.as_string(aws_lambda_alias_example.name)
+        )
+```
+
+### Configuration for Function Latest Unpublished Version
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.lambda_function_event_invoke_config import LambdaFunctionEventInvokeConfig
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        LambdaFunctionEventInvokeConfig(self, "example",
+            function_name=Token.as_string(aws_lambda_function_example.function_name),
+            qualifier="$LATEST"
+        )
+```
+
+### Configuration for Function Published Version
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.lambda_function_event_invoke_config import LambdaFunctionEventInvokeConfig
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        LambdaFunctionEventInvokeConfig(self, "example",
+            function_name=Token.as_string(aws_lambda_function_example.function_name),
+            qualifier=Token.as_string(aws_lambda_function_example.version)
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `function_name` - (Required) Name or Amazon Resource Name (ARN) of the Lambda Function, omitting any version or alias qualifier.
+
+The following arguments are optional:
+
+* `destination_config` - (Optional) Configuration block with destination configuration. See below for details.
+* `maximum_event_age_in_seconds` - (Optional) Maximum age of a request that Lambda sends to a function for processing in seconds. Valid values between 60 and 21600.
+* `maximum_retry_attempts` - (Optional) Maximum number of times to retry when the function returns an error. Valid values between 0 and 2. Defaults to 2.
+* `qualifier` - (Optional) Lambda Function published version, `$LATEST`, or Lambda Alias name.
+
+### destination_config Configuration Block
+
+~> **NOTE:** At least one of `on_failure` or `on_success` must be configured when using this configuration block, otherwise remove it completely to prevent perpetual differences in Terraform runs.
+
+The following arguments are optional:
+
+* `on_failure` - (Optional) Configuration block with destination configuration for failed asynchronous invocations. See below for details.
+* `on_success` - (Optional) Configuration block with destination configuration for successful asynchronous invocations. See below for details.
+
+#### destination_config on_failure Configuration Block
+
+The following arguments are required:
+
+* `destination` - (Required) Amazon Resource Name (ARN) of the destination resource. See the [Lambda Developer Guide](https://docs.aws.amazon.com/lambda/latest/dg/invocation-async.html#invocation-async-destinations) for acceptable resource types and associated IAM permissions.
+
+#### destination_config on_success Configuration Block
+
+The following arguments are required:
+
+* `destination` - (Required) Amazon Resource Name (ARN) of the destination resource. See the [Lambda Developer Guide](https://docs.aws.amazon.com/lambda/latest/dg/invocation-async.html#invocation-async-destinations) for acceptable resource types and associated IAM permissions.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Fully qualified Lambda Function name or Amazon Resource Name (ARN)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Lambda Function Event Invoke Configs using the fully qualified Function name or Amazon Resource Name (ARN). For example:
+
+ARN without qualifier (all versions and aliases):
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+ARN with qualifier:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Name without qualifier (all versions and aliases):
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Name with qualifier:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+**Using `terraform import` to import** Lambda Function Event Invoke Configs using the fully qualified Function name or Amazon Resource Name (ARN). For example:
+
+ARN without qualifier (all versions and aliases):
+
+```console
+% terraform import aws_lambda_function_event_invoke_config.example arn:aws:us-east-1:123456789012:function:my_function
+```
+
+ARN with qualifier:
+
+```console
+% terraform import aws_lambda_function_event_invoke_config.example arn:aws:us-east-1:123456789012:function:my_function:production
+```
+
+Name without qualifier (all versions and aliases):
+
+```console
+% terraform import aws_lambda_function_event_invoke_config.example my_function
+```
+
+Name with qualifier:
+
+```console
+% terraform import aws_lambda_function_event_invoke_config.example my_function:production
+```
+
+<!-- cache-key: cdktf-0.18.0 input-609bc5423f52ca1abd7ee524d562fbd117b6915dd9a7b4012b252b00f563c6ac -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/lambda_function_url.html.markdown b/website/docs/cdktf/python/r/lambda_function_url.html.markdown
new file mode 100644
index 00000000000..28f4427ff33
--- /dev/null
+++ b/website/docs/cdktf/python/r/lambda_function_url.html.markdown
@@ -0,0 +1,96 @@
+---
+subcategory: "Lambda"
+layout: "aws"
+page_title: "AWS: aws_lambda_function_url"
+description: |-
+  Provides a Lambda function URL resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lambda_function_url
+
+Provides a Lambda function URL resource. A function URL is a dedicated HTTP(S) endpoint for a Lambda function.
+
+See the [AWS Lambda documentation](https://docs.aws.amazon.com/lambda/latest/dg/lambda-urls.html) for more information.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.lambda_function_url import LambdaFunctionUrl
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        LambdaFunctionUrl(self, "test_latest",
+            authorization_type="NONE",
+            function_name=test.function_name
+        )
+        LambdaFunctionUrl(self, "test_live",
+            authorization_type="AWS_IAM",
+            cors=LambdaFunctionUrlCors(
+                allow_credentials=True,
+                allow_headers=["date", "keep-alive"],
+                allow_methods=["*"],
+                allow_origins=["*"],
+                expose_headers=["keep-alive", "date"],
+                max_age=86400
+            ),
+            function_name=test.function_name,
+            qualifier="my_alias"
+        )
+```
+
+## Argument Reference
+
+* `authorization_type` - (Required) The type of authentication that the function URL uses. Set to `"AWS_IAM"` to restrict access to authenticated IAM users only. Set to `"NONE"` to bypass IAM authentication and create a public endpoint. See the [AWS documentation](https://docs.aws.amazon.com/lambda/latest/dg/urls-auth.html) for more details.
+* `cors` - (Optional) The [cross-origin resource sharing (CORS)](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS) settings for the function URL. Documented below.
+* `function_name` - (Required) The name (or ARN) of the Lambda function.
+* `invoke_mode` - (Optional) Determines how the Lambda function responds to an invocation. Valid values are `BUFFERED` (default) and `RESPONSE_STREAM`. See more in [Configuring a Lambda function to stream responses](https://docs.aws.amazon.com/lambda/latest/dg/configuration-response-streaming.html).
+* `qualifier` - (Optional) The alias name or `"$LATEST"`.
+
+### cors
+
+This configuration block supports the following attributes:
+
+* `allow_credentials` - (Optional) Whether to allow cookies or other credentials in requests to the function URL. The default is `false`.
+* `allow_headers` - (Optional) The HTTP headers that origins can include in requests to the function URL. For example: `["date", "keep-alive", "x-custom-header"]`.
+* `allow_methods` - (Optional) The HTTP methods that are allowed when calling the function URL. For example: `["GET", "POST", "DELETE"]`, or the wildcard character (`["*"]`).
+* `allow_origins` - (Optional) The origins that can access the function URL. You can list any number of specific origins (or the wildcard character (`"*"`)), separated by a comma. For example: `["https://www.example.com", "http://localhost:60905"]`.
+* `expose_headers` - (Optional) The HTTP headers in your function response that you want to expose to origins that call the function URL.
+* `max_age` - (Optional) The maximum amount of time, in seconds, that web browsers can cache results of a preflight request. By default, this is set to `0`, which means that the browser doesn't cache results. The maximum value is `86400`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `function_arn` - The Amazon Resource Name (ARN) of the function.
+* `function_url` - The HTTP URL endpoint for the function in the format `https://<url_id>.lambda-url.<region>.on.aws`.
+* `url_id` - A generated ID for the endpoint.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Lambda function URLs using the `function_name` or `function_name/qualifier`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Lambda function URLs using the `function_name` or `function_name/qualifier`. For example:
+
+```console
+% terraform import aws_lambda_function_url.test_lambda_url my_test_lambda_function
+```
+
+<!-- cache-key: cdktf-0.18.0 input-109acf5fac25dcc5daf91ea88836c775555057c7e2ea1a59edfd11a98e567940 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/lambda_invocation.html.markdown b/website/docs/cdktf/python/r/lambda_invocation.html.markdown
new file mode 100644
index 00000000000..743e8974407
--- /dev/null
+++ b/website/docs/cdktf/python/r/lambda_invocation.html.markdown
@@ -0,0 +1,175 @@
+---
+subcategory: "Lambda"
+layout: "aws"
+page_title: "AWS: aws_lambda_invocation"
+description: |-
+  Invoke AWS Lambda Function
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lambda_invocation
+
+Use this resource to invoke a lambda function. The lambda function is invoked with the [RequestResponse](https://docs.aws.amazon.com/lambda/latest/dg/API_Invoke.html#API_Invoke_RequestSyntax) invocation type.
+
+~> **NOTE:** By default this resource _only_ invokes the function when the arguments call for a create or replace. In other words, after an initial invocation on _apply_, if the arguments do not change, a subsequent _apply_ does not invoke the function again. To dynamically invoke the function, see the `triggers` example below. To always invoke a function on each _apply_, see the [`aws_lambda_invocation`](/docs/providers/aws/d/lambda_invocation.html) data source. To invoke the lambda function when the terraform resource is updated and deleted, see the [CRUD Lifecycle Scope](#crud-lifecycle-scope) example below.
+
+~> **NOTE:** If you get a `KMSAccessDeniedException: Lambda was unable to decrypt the environment variables because KMS access was denied` error when invoking an [`aws_lambda_function`](/docs/providers/aws/r/lambda_function.html) with environment variables, the IAM role associated with the function may have been deleted and recreated _after_ the function was created. You can fix the problem two ways: 1) updating the function's role to another role and then updating it back again to the recreated role, or 2) by using Terraform to `taint` the function and `apply` your configuration again to recreate the function. (When you create a function, Lambda grants permissions on the KMS key to the function's IAM role. If the IAM role is recreated, the grant is no longer valid. Changing the function's role or recreating the function causes Lambda to update the grant.)
+
+## Example Usage
+
+### Basic Example
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformOutput, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.lambda_invocation import LambdaInvocation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = LambdaInvocation(self, "example",
+            function_name=lambda_function_test.function_name,
+            input=Token.as_string(
+                Fn.jsonencode({
+                    "key1": "value1",
+                    "key2": "value2"
+                }))
+        )
+        TerraformOutput(self, "result_entry",
+            value=Fn.lookup_nested(Fn.jsondecode(example.result), ["\"key1\""])
+        )
+```
+
+### Dynamic Invocation Example Using Triggers
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.lambda_invocation import LambdaInvocation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        LambdaInvocation(self, "example",
+            function_name=lambda_function_test.function_name,
+            input=Token.as_string(
+                Fn.jsonencode({
+                    "key1": "value1",
+                    "key2": "value2"
+                })),
+            triggers={
+                "redeployment": Token.as_string(
+                    Fn.sha1(
+                        Token.as_string(
+                            Fn.jsonencode([aws_lambda_function_example.environment]))))
+            }
+        )
+```
+
+### CRUD Lifecycle Scope
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.lambda_invocation import LambdaInvocation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        LambdaInvocation(self, "example",
+            function_name=lambda_function_test.function_name,
+            input=Token.as_string(
+                Fn.jsonencode({
+                    "key1": "value1",
+                    "key2": "value2"
+                })),
+            lifecycle_scope="CRUD"
+        )
+```
+
+~> **NOTE:** `lifecycle_scope = "CRUD"` will inject a key `tf` in the input event to pass lifecycle information! This allows the lambda function to handle different lifecycle transitions uniquely.  If you need to use a key `tf` in your own input JSON, the default key name can be overridden with the `terraform_key` argument.
+
+The key `tf` gets added with subkeys:
+
+* `action` - Action Terraform performs on the resource. Values are `create`, `update`, or `delete`.
+* `prev_input` - Input JSON payload from the previous invocation. This can be used to handle update and delete events.
+
+When the resource from the example above is created, the Lambda will get following JSON payload:
+
+```json
+{
+  "key1": "value1",
+  "key2": "value2",
+  "tf": {
+    "action": "create",
+    "prev_input": null
+  }
+}
+```
+
+If the input value of `key1` changes to "valueB", then the lambda will be invoked again with the following JSON payload:
+
+```json
+{
+  "key1": "valueB",
+  "key2": "value2",
+  "tf": {
+    "action": "update",
+    "prev_input": {
+      "key1": "value1",
+      "key2": "value2"
+    }
+  }
+}
+```
+
+When the invocation resource is removed, the final invocation will have the following JSON payload:
+
+```json
+{
+  "key1": "valueB",
+  "key2": "value2",
+  "tf": {
+    "action": "delete",
+    "prev_input": {
+      "key1": "valueB",
+      "key2": "value2"
+    }
+  }
+}
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `function_name` - (Required) Name of the lambda function.
+* `input` - (Required) JSON payload to the lambda function.
+
+The following arguments are optional:
+
+* `lifecycle_scope` - (Optional) Lifecycle scope of the resource to manage. Valid values are `CREATE_ONLY` and `CRUD`. Defaults to `CREATE_ONLY`. `CREATE_ONLY` will invoke the function only on creation or replacement. `CRUD` will invoke the function on each lifecycle event, and augment the input JSON payload with additional lifecycle information.
+* `qualifier` - (Optional) Qualifier (i.e., version) of the lambda function. Defaults to `$LATEST`.
+* `terraform_key` - (Optional) The JSON key used to store lifecycle information in the input JSON payload. Defaults to `tf`. This additional key is only included when `lifecycle_scope` is set to `CRUD`.
+* `triggers` - (Optional) Map of arbitrary keys and values that, when changed, will trigger a re-invocation. To force a re-invocation without changing these keys/values, use the [`terraform taint` command](https://www.terraform.io/docs/commands/taint.html).
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `result` - String result of the lambda function invocation.
+
+<!-- cache-key: cdktf-0.18.0 input-7112258209b5478d3ef1a608e7acf55c35e00752fc231e672e536ec0d294422f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/lambda_layer_version.html.markdown b/website/docs/cdktf/python/r/lambda_layer_version.html.markdown
new file mode 100644
index 00000000000..7f6445c5e56
--- /dev/null
+++ b/website/docs/cdktf/python/r/lambda_layer_version.html.markdown
@@ -0,0 +1,108 @@
+---
+subcategory: "Lambda"
+layout: "aws"
+page_title: "AWS: aws_lambda_layer_version"
+description: |-
+  Provides a Lambda Layer Version resource. Lambda Layers allow you to reuse shared bits of code across multiple lambda functions.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lambda_layer_version
+
+Provides a Lambda Layer Version resource. Lambda Layers allow you to reuse shared bits of code across multiple lambda functions.
+
+For information about Lambda Layers and how to use them, see [AWS Lambda Layers][1].
+
+~> **NOTE:** Setting `skip_destroy` to `true` means that the AWS Provider will _not_ destroy any layer version, even when running `terraform destroy`. Layer versions are thus intentional dangling resources that are _not_ managed by Terraform and may incur extra expense in your AWS account.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.lambda_layer_version import LambdaLayerVersion
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        LambdaLayerVersion(self, "lambda_layer",
+            compatible_runtimes=["nodejs16.x"],
+            filename="lambda_layer_payload.zip",
+            layer_name="lambda_layer_name"
+        )
+```
+
+## Specifying the Deployment Package
+
+AWS Lambda Layers expect source code to be provided as a deployment package whose structure varies depending on which `compatible_runtimes` this layer specifies.
+See [Runtimes][2] for the valid values of `compatible_runtimes`.
+
+Once you have created your deployment package you can specify it either directly as a local file (using the `filename` argument) or
+indirectly via Amazon S3 (using the `s3_bucket`, `s3_key` and `s3_object_version` arguments). When providing the deployment
+package via S3 it may be useful to use [the `aws_s3_object` resource](s3_object.html) to upload it.
+
+For larger deployment packages it is recommended by Amazon to upload via S3, since the S3 API has better support for uploading large files efficiently.
+
+## Argument Reference
+
+The following arguments are required:
+
+* `layer_name` - (Required) Unique name for your Lambda Layer
+
+The following arguments are optional:
+
+* `compatible_architectures` - (Optional) List of [Architectures][4] this layer is compatible with. Currently `x86_64` and `arm64` can be specified.
+* `compatible_runtimes` - (Optional) List of [Runtimes][2] this layer is compatible with. Up to 5 runtimes can be specified.
+* `description` - (Optional) Description of what your Lambda Layer does.
+* `filename` (Optional) Path to the function's deployment package within the local filesystem. If defined, The `s3_`-prefixed options cannot be used.
+* `license_info` - (Optional) License info for your Lambda Layer. See [License Info][3].
+* `s3_bucket` - (Optional) S3 bucket location containing the function's deployment package. Conflicts with `filename`. This bucket must reside in the same AWS region where you are creating the Lambda function.
+* `s3_key` - (Optional) S3 key of an object containing the function's deployment package. Conflicts with `filename`.
+* `s3_object_version` - (Optional) Object version containing the function's deployment package. Conflicts with `filename`.
+* `skip_destroy` - (Optional) Whether to retain the old version of a previously deployed Lambda Layer. Default is `false`. When this is not set to `true`, changing any of `compatible_architectures`, `compatible_runtimes`, `description`, `filename`, `layer_name`, `license_info`, `s3_bucket`, `s3_key`, `s3_object_version`, or `source_code_hash` forces deletion of the existing layer version and creation of a new layer version.
+* `source_code_hash` - (Optional) Used to trigger updates. Must be set to a base64-encoded SHA256 hash of the package file specified with either `filename` or `s3_key`. The usual way to set this is `${filebase64sha256("file.zip")}` (Terraform 0.11.12 or later) or `${base64sha256(file("file.zip"))}` (Terraform 0.11.11 and earlier), where "file.zip" is the local filename of the lambda layer source archive.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Lambda Layer with version.
+* `created_date` - Date this resource was created.
+* `layer_arn` - ARN of the Lambda Layer without version.
+* `signing_job_arn` - ARN of a signing job.
+* `signing_profile_version_arn` - ARN for a signing profile version.
+* `source_code_size` - Size in bytes of the function .zip file.
+* `version` - Lambda Layer version.
+
+[1]: https://docs.aws.amazon.com/lambda/latest/dg/configuration-layers.html
+[2]: https://docs.aws.amazon.com/lambda/latest/dg/API_PublishLayerVersion.html#SSS-PublishLayerVersion-request-CompatibleRuntimes
+[3]: https://docs.aws.amazon.com/lambda/latest/dg/API_PublishLayerVersion.html#SSS-PublishLayerVersion-request-LicenseInfo
+[4]: https://docs.aws.amazon.com/lambda/latest/dg/API_PublishLayerVersion.html#SSS-PublishLayerVersion-request-CompatibleArchitectures
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Lambda Layers using `arn`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Lambda Layers using `arn`. For example:
+
+```console
+% terraform import \
+    aws_lambda_layer_version.test_layer \
+    arn:aws:lambda:_REGION_:_ACCOUNT_ID_:layer:_LAYER_NAME_:_LAYER_VERSION_
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1d7deb31d6f83afe8e8355fe2da3b01431626e21fd36c30f56c344343663f003 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/lambda_layer_version_permission.html.markdown b/website/docs/cdktf/python/r/lambda_layer_version_permission.html.markdown
new file mode 100644
index 00000000000..35d571cc317
--- /dev/null
+++ b/website/docs/cdktf/python/r/lambda_layer_version_permission.html.markdown
@@ -0,0 +1,83 @@
+---
+subcategory: "Lambda"
+layout: "aws"
+page_title: "AWS: aws_lambda_layer_version_permission"
+description: |-
+  Provides a Lambda Layer Version Permission resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lambda_layer_version_permission
+
+Provides a Lambda Layer Version Permission resource. It allows you to share you own Lambda Layers to another account by account ID, to all accounts in AWS organization or even to all AWS accounts.
+
+For information about Lambda Layer Permissions and how to use them, see [Using Resource-based Policies for AWS Lambda][1]
+
+~> **NOTE:** Setting `skip_destroy` to `true` means that the AWS Provider will _not_ destroy any layer version permission, even when running `terraform destroy`. Layer version permissions are thus intentional dangling resources that are _not_ managed by Terraform and may incur extra expense in your AWS account.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.lambda_layer_version_permission import LambdaLayerVersionPermission
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        LambdaLayerVersionPermission(self, "lambda_layer_permission",
+            action="lambda:GetLayerVersion",
+            layer_name="arn:aws:lambda:us-west-2:123456654321:layer:test_layer1",
+            principal="111111111111",
+            statement_id="dev-account",
+            version_number=1
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `action` - (Required) Action, which will be allowed. `lambda:GetLayerVersion` value is suggested by AWS documantation.
+* `layer_name` (Required) The name or ARN of the Lambda Layer, which you want to grant access to.
+* `organization_id` - (Optional) An identifier of AWS Organization, which should be able to use your Lambda Layer. `principal` should be equal to `*` if `organization_id` provided.
+* `principal` - (Required) AWS account ID which should be able to use your Lambda Layer. `*` can be used here, if you want to share your Lambda Layer widely.
+* `statement_id` - (Required) The name of Lambda Layer Permission, for example `dev-account` - human readable note about what is this permission for.
+* `version_number` (Required) Version of Lambda Layer, which you want to grant access to. Note: permissions only apply to a single version of a layer.
+* `skip_destroy` - (Optional) Whether to retain the old version of a previously deployed Lambda Layer. Default is `false`. When this is not set to `true`, changing any of `compatible_architectures`, `compatible_runtimes`, `description`, `filename`, `layer_name`, `license_info`, `s3_bucket`, `s3_key`, `s3_object_version`, or `source_code_hash` forces deletion of the existing layer version and creation of a new layer version.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The `layer_name` and `version_number`, separated by a comma (`,`).
+* `revision_id` - A unique identifier for the current revision of the policy.
+* `policy` - Full Lambda Layer Permission policy.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Lambda Layer Permissions using `layer_name` and `version_number`, separated by a comma (`,`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Lambda Layer Permissions using `layer_name` and `version_number`, separated by a comma (`,`). For example:
+
+```console
+% terraform import aws_lambda_layer_version_permission.example arn:aws:lambda:us-west-2:123456654321:layer:test_layer1,1
+```
+
+[1]: https://docs.aws.amazon.com/lambda/latest/dg/access-control-resource-based.html#permissions-resource-xaccountlayer
+
+<!-- cache-key: cdktf-0.18.0 input-fd22d59f7bda2ed8703c3b1fd6d5f0d467df5adf1b1fd76c0fa824d35f034051 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/lambda_permission.html.markdown b/website/docs/cdktf/python/r/lambda_permission.html.markdown
new file mode 100644
index 00000000000..6392965e1fe
--- /dev/null
+++ b/website/docs/cdktf/python/r/lambda_permission.html.markdown
@@ -0,0 +1,344 @@
+---
+subcategory: "Lambda"
+layout: "aws"
+page_title: "AWS: aws_lambda_permission"
+description: |-
+  Creates a Lambda function permission.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lambda_permission
+
+Gives an external source (like an EventBridge Rule, SNS, or S3) permission to access the Lambda function.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.iam_role import IamRole
+from imports.aws.lambda_alias import LambdaAlias
+from imports.aws.lambda_function import LambdaFunction
+from imports.aws.lambda_permission import LambdaPermission
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        iam_for_lambda = IamRole(self, "iam_for_lambda",
+            assume_role_policy=Token.as_string(
+                Fn.jsonencode({
+                    "Statement": [{
+                        "Action": "sts:AssumeRole",
+                        "Effect": "Allow",
+                        "Principal": {
+                            "Service": "lambda.amazonaws.com"
+                        },
+                        "Sid": ""
+                    }
+                    ],
+                    "Version": "2012-10-17"
+                })),
+            name="iam_for_lambda"
+        )
+        test_lambda = LambdaFunction(self, "test_lambda",
+            filename="lambdatest.zip",
+            function_name="lambda_function_name",
+            handler="exports.handler",
+            role=iam_for_lambda.arn,
+            runtime="nodejs16.x"
+        )
+        test_alias = LambdaAlias(self, "test_alias",
+            description="a sample description",
+            function_name=test_lambda.function_name,
+            function_version="$LATEST",
+            name="testalias"
+        )
+        LambdaPermission(self, "allow_cloudwatch",
+            action="lambda:InvokeFunction",
+            function_name=test_lambda.function_name,
+            principal="events.amazonaws.com",
+            qualifier=test_alias.name,
+            source_arn="arn:aws:events:eu-west-1:111122223333:rule/RunDaily",
+            statement_id="AllowExecutionFromCloudWatch"
+        )
+```
+
+### With SNS
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.iam_role import IamRole
+from imports.aws.lambda_function import LambdaFunction
+from imports.aws.lambda_permission import LambdaPermission
+from imports.aws.sns_topic import SnsTopic
+from imports.aws.sns_topic_subscription import SnsTopicSubscription
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        default_var = IamRole(self, "default",
+            assume_role_policy=Token.as_string(
+                Fn.jsonencode({
+                    "Statement": [{
+                        "Action": "sts:AssumeRole",
+                        "Effect": "Allow",
+                        "Principal": {
+                            "Service": "lambda.amazonaws.com"
+                        },
+                        "Sid": ""
+                    }
+                    ],
+                    "Version": "2012-10-17"
+                })),
+            name="iam_for_lambda_with_sns"
+        )
+        func = LambdaFunction(self, "func",
+            filename="lambdatest.zip",
+            function_name="lambda_called_from_sns",
+            handler="exports.handler",
+            role=default_var.arn,
+            runtime="python3.7"
+        )
+        aws_sns_topic_default = SnsTopic(self, "default_2",
+            name="call-lambda-maybe"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_sns_topic_default.override_logical_id("default")
+        SnsTopicSubscription(self, "lambda",
+            endpoint=func.arn,
+            protocol="lambda",
+            topic_arn=Token.as_string(aws_sns_topic_default.arn)
+        )
+        LambdaPermission(self, "with_sns",
+            action="lambda:InvokeFunction",
+            function_name=func.function_name,
+            principal="sns.amazonaws.com",
+            source_arn=Token.as_string(aws_sns_topic_default.arn),
+            statement_id="AllowExecutionFromSNS"
+        )
+```
+
+### With API Gateway REST API
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.api_gateway_rest_api import ApiGatewayRestApi
+from imports.aws.lambda_permission import LambdaPermission
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        my_demo_api = ApiGatewayRestApi(self, "MyDemoAPI",
+            description="This is my API for demonstration purposes",
+            name="MyDemoAPI"
+        )
+        LambdaPermission(self, "lambda_permission",
+            action="lambda:InvokeFunction",
+            function_name="MyDemoFunction",
+            principal="apigateway.amazonaws.com",
+            source_arn="${" + my_demo_api.execution_arn + "}/*",
+            statement_id="AllowMyDemoAPIInvoke"
+        )
+```
+
+### With CloudWatch Log Group
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudwatch_log_group import CloudwatchLogGroup
+from imports.aws.cloudwatch_log_subscription_filter import CloudwatchLogSubscriptionFilter
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.iam_role import IamRole
+from imports.aws.lambda_function import LambdaFunction
+from imports.aws.lambda_permission import LambdaPermission
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        default_var = CloudwatchLogGroup(self, "default",
+            name="/default"
+        )
+        assume_role = DataAwsIamPolicyDocument(self, "assume_role",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["sts:AssumeRole"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["lambda.amazonaws.com"],
+                    type="Service"
+                )
+                ]
+            )
+            ]
+        )
+        aws_iam_role_default = IamRole(self, "default_2",
+            assume_role_policy=Token.as_string(assume_role.json),
+            name="iam_for_lambda_called_from_cloudwatch_logs"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_role_default.override_logical_id("default")
+        logging = LambdaFunction(self, "logging",
+            filename="lamba_logging.zip",
+            function_name="lambda_called_from_cloudwatch_logs",
+            handler="exports.handler",
+            role=Token.as_string(aws_iam_role_default.arn),
+            runtime="python3.7"
+        )
+        aws_lambda_permission_logging = LambdaPermission(self, "logging_4",
+            action="lambda:InvokeFunction",
+            function_name=logging.function_name,
+            principal="logs.eu-west-1.amazonaws.com",
+            source_arn="${" + default_var.arn + "}:*"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_lambda_permission_logging.override_logical_id("logging")
+        aws_cloudwatch_log_subscription_filter_logging =
+        CloudwatchLogSubscriptionFilter(self, "logging_5",
+            depends_on=[aws_lambda_permission_logging],
+            destination_arn=logging.arn,
+            filter_pattern="",
+            log_group_name=default_var.name,
+            name="logging_default"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_cloudwatch_log_subscription_filter_logging.override_logical_id("logging")
+```
+
+### With Cross-Account Invocation Policy
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.lambda_function_url import LambdaFunctionUrl
+from imports.aws.lambda_permission import LambdaPermission
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        LambdaFunctionUrl(self, "url",
+            authorization_type="AWS_IAM",
+            function_name=example.function_name
+        )
+        aws_lambda_permission_url = LambdaPermission(self, "url_1",
+            action="lambda:InvokeFunctionUrl",
+            function_name=example.function_name,
+            function_url_auth_type="AWS_IAM",
+            principal="arn:aws:iam::444455556666:role/example",
+            source_account="444455556666"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_lambda_permission_url.override_logical_id("url")
+```
+
+### With `replace_triggered_by` Lifecycle Configuration
+
+If omitting the `qualifier` argument (which forces re-creation each time a function version is published), a `lifecycle` block can be used to ensure permissions are re-applied on any change to the underlying function.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from cdktf import TerraformResourceLifecycle
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.lambda_permission import LambdaPermission
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        LambdaPermission(self, "logging",
+            action="lambda:InvokeFunction",
+            function_name=example.function_name,
+            lifecycle=TerraformResourceLifecycle(
+                replace_triggered_by=[example]
+            ),
+            principal="events.amazonaws.com",
+            source_arn="arn:aws:events:eu-west-1:111122223333:rule/RunDaily"
+        )
+```
+
+## Argument Reference
+
+* `action` - (Required) The AWS Lambda action you want to allow in this statement. (e.g., `lambda:InvokeFunction`)
+* `event_source_token` - (Optional) The Event Source Token to validate.  Used with [Alexa Skills][1].
+* `function_name` - (Required) Name of the Lambda function whose resource policy you are updating
+* `function_url_auth_type` - (Optional) Lambda Function URLs [authentication type][3]. Valid values are: `AWS_IAM` or `NONE`. Only supported for `lambda:InvokeFunctionUrl` action.
+* `principal` - (Required) The principal who is getting this permission e.g., `s3.amazonaws.com`, an AWS account ID, or AWS IAM principal, or AWS service principal such as `events.amazonaws.com` or `sns.amazonaws.com`.
+* `qualifier` - (Optional) Query parameter to specify function version or alias name. The permission will then apply to the specific qualified ARN e.g., `arn:aws:lambda:aws-region:acct-id:function:function-name:2`
+* `source_account` - (Optional) This parameter is used when allowing cross-account access, or for S3 and SES. The AWS account ID (without a hyphen) of the source owner.
+* `source_arn` - (Optional) When the principal is an AWS service, the ARN of the specific resource within that service to grant permission to.
+  Without this, any resource from `principal` will be granted permission – even if that resource is from another account.
+  For S3, this should be the ARN of the S3 Bucket.
+  For EventBridge events, this should be the ARN of the EventBridge Rule.
+  For API Gateway, this should be the ARN of the API, as described [here][2].
+* `statement_id` - (Optional) A unique statement identifier. By default generated by Terraform.
+* `statement_id_prefix` - (Optional) A statement identifier prefix. Terraform will generate a unique suffix. Conflicts with `statement_id`.
+* `principal_org_id` - (Optional) The identifier for your organization in AWS Organizations. Use this to grant permissions to all the AWS accounts under this organization.
+
+[1]: https://developer.amazon.com/docs/custom-skills/host-a-custom-skill-as-an-aws-lambda-function.html#use-aws-cli
+[2]: https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-control-access-using-iam-policies-to-invoke-api.html
+[3]: https://docs.aws.amazon.com/lambda/latest/dg/urls-auth.html
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Lambda permission statements using function_name/statement_id with an optional qualifier. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Lambda permission statements using function_name/statement_id with an optional qualifier. For example:
+
+```console
+% terraform import aws_lambda_permission.test_lambda_permission my_test_lambda_function/AllowExecutionFromCloudWatch
+```
+
+```console
+% terraform import aws_lambda_permission.test_lambda_permission my_test_lambda_function:qualifier_name/AllowExecutionFromCloudWatch
+```
+
+<!-- cache-key: cdktf-0.18.0 input-d4a2087f351c8ca4a69a59ef6d0c60e38de8ab53ebfbaae17642d9753dcbe762 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/lambda_provisioned_concurrency_config.html.markdown b/website/docs/cdktf/python/r/lambda_provisioned_concurrency_config.html.markdown
new file mode 100644
index 00000000000..9c0c2709257
--- /dev/null
+++ b/website/docs/cdktf/python/r/lambda_provisioned_concurrency_config.html.markdown
@@ -0,0 +1,105 @@
+---
+subcategory: "Lambda"
+layout: "aws"
+page_title: "AWS: aws_lambda_provisioned_concurrency_config"
+description: |-
+  Manages a Lambda Provisioned Concurrency Configuration
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lambda_provisioned_concurrency_config
+
+Manages a Lambda Provisioned Concurrency Configuration.
+
+~> **NOTE:** Setting `skip_destroy` to `true` means that the AWS Provider will _not_ destroy a provisioned concurrency configuration, even when running `terraform destroy`. The configuration is thus an intentional dangling resource that is _not_ managed by Terraform and may incur extra expense in your AWS account.
+
+## Example Usage
+
+### Alias Name
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.lambda_provisioned_concurrency_config import LambdaProvisionedConcurrencyConfig
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        LambdaProvisionedConcurrencyConfig(self, "example",
+            function_name=Token.as_string(aws_lambda_alias_example.function_name),
+            provisioned_concurrent_executions=1,
+            qualifier=Token.as_string(aws_lambda_alias_example.name)
+        )
+```
+
+### Function Version
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.lambda_provisioned_concurrency_config import LambdaProvisionedConcurrencyConfig
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        LambdaProvisionedConcurrencyConfig(self, "example",
+            function_name=Token.as_string(aws_lambda_function_example.function_name),
+            provisioned_concurrent_executions=1,
+            qualifier=Token.as_string(aws_lambda_function_example.version)
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `function_name` - (Required) Name or Amazon Resource Name (ARN) of the Lambda Function.
+* `provisioned_concurrent_executions` - (Required) Amount of capacity to allocate. Must be greater than or equal to `1`.
+* `qualifier` - (Required) Lambda Function version or Lambda Alias name.
+
+The following arguments are optional:
+
+* `skip_destroy` - (Optional) Whether to retain the provisoned concurrency configuration upon destruction. Defaults to `false`. If set to `true`, the resource in simply removed from state instead.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Lambda Function name and qualifier separated by a comma (`,`).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `15m`)
+* `update` - (Default `15m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import a Lambda Provisioned Concurrency Configuration using the `function_name` and `qualifier` separated by a comma (`,`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import a Lambda Provisioned Concurrency Configuration using the `function_name` and `qualifier` separated by a comma (`,`). For example:
+
+```console
+% terraform import aws_lambda_provisioned_concurrency_config.example my_function,production
+```
+
+<!-- cache-key: cdktf-0.18.0 input-6f3c5baf959ae98fc63cc91293e15ccc2810987cf437f55d4ec7eeaf83152ac9 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/launch_configuration.html.markdown b/website/docs/cdktf/python/r/launch_configuration.html.markdown
new file mode 100644
index 00000000000..98225155318
--- /dev/null
+++ b/website/docs/cdktf/python/r/launch_configuration.html.markdown
@@ -0,0 +1,277 @@
+---
+subcategory: "Auto Scaling"
+layout: "aws"
+page_title: "AWS: aws_launch_configuration"
+description: |-
+  Provides a resource to create a new launch configuration, used for autoscaling groups.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_launch_configuration
+
+Provides a resource to create a new launch configuration, used for autoscaling groups.
+
+!> **WARNING:** The use of launch configurations is discouraged in favour of launch templates. Read more in the [AWS EC2 Documentation](https://docs.aws.amazon.com/autoscaling/ec2/userguide/launch-configurations.html).
+
+-> **Note** When using `aws_launch_configuration` with `aws_autoscaling_group`, it is recommended to use the `name_prefix` (Optional) instead of the `name` (Optional) attribute. This will allow Terraform lifecycles to detect changes to the launch configuration and update the autoscaling group correctly.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_ami import DataAwsAmi
+from imports.aws.launch_configuration import LaunchConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ubuntu = DataAwsAmi(self, "ubuntu",
+            filter=[DataAwsAmiFilter(
+                name="name",
+                values=["ubuntu/images/hvm-ssd/ubuntu-trusty-14.04-amd64-server-*"]
+            ), DataAwsAmiFilter(
+                name="virtualization-type",
+                values=["hvm"]
+            )
+            ],
+            most_recent=True,
+            owners=["099720109477"]
+        )
+        LaunchConfiguration(self, "as_conf",
+            image_id=Token.as_string(ubuntu.id),
+            instance_type="t2.micro",
+            name="web_config"
+        )
+```
+
+## Using with AutoScaling Groups
+
+Launch Configurations cannot be updated after creation with the Amazon
+Web Service API. In order to update a Launch Configuration, Terraform will
+destroy the existing resource and create a replacement. In order to effectively
+use a Launch Configuration resource with an [AutoScaling Group resource][1],
+it's recommended to specify `create_before_destroy` in a [lifecycle][2] block.
+Either omit the Launch Configuration `name` attribute, or specify a partial name
+with `name_prefix`.  Example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from cdktf import TerraformResourceLifecycle, TerraformResourceLifecycle
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.autoscaling_group import AutoscalingGroup
+from imports.aws.data_aws_ami import DataAwsAmi
+from imports.aws.launch_configuration import LaunchConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ubuntu = DataAwsAmi(self, "ubuntu",
+            filter=[DataAwsAmiFilter(
+                name="name",
+                values=["ubuntu/images/hvm-ssd/ubuntu-trusty-14.04-amd64-server-*"]
+            ), DataAwsAmiFilter(
+                name="virtualization-type",
+                values=["hvm"]
+            )
+            ],
+            most_recent=True,
+            owners=["099720109477"]
+        )
+        as_conf = LaunchConfiguration(self, "as_conf",
+            image_id=Token.as_string(ubuntu.id),
+            instance_type="t2.micro",
+            lifecycle=TerraformResourceLifecycle(
+                create_before_destroy=True
+            ),
+            name_prefix="terraform-lc-example-"
+        )
+        AutoscalingGroup(self, "bar",
+            launch_configuration=as_conf.name,
+            lifecycle=TerraformResourceLifecycle(
+                create_before_destroy=True
+            ),
+            max_size=2,
+            min_size=1,
+            name="terraform-asg-example"
+        )
+```
+
+With this setup Terraform generates a unique name for your Launch
+Configuration and can then update the AutoScaling Group without conflict before
+destroying the previous Launch Configuration.
+
+## Using with Spot Instances
+
+Launch configurations can set the spot instance pricing to be used for the
+Auto Scaling Group to reserve instances. Simply specifying the `spot_price`
+parameter will set the price on the Launch Configuration which will attempt to
+reserve your instances at this price.  See the [AWS Spot Instance
+documentation](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-spot-instances.html)
+for more information or how to launch [Spot Instances][3] with Terraform.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from cdktf import TerraformResourceLifecycle
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.autoscaling_group import AutoscalingGroup
+from imports.aws.data_aws_ami import DataAwsAmi
+from imports.aws.launch_configuration import LaunchConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, maxSize, minSize):
+        super().__init__(scope, name)
+        ubuntu = DataAwsAmi(self, "ubuntu",
+            filter=[DataAwsAmiFilter(
+                name="name",
+                values=["ubuntu/images/hvm-ssd/ubuntu-trusty-14.04-amd64-server-*"]
+            ), DataAwsAmiFilter(
+                name="virtualization-type",
+                values=["hvm"]
+            )
+            ],
+            most_recent=True,
+            owners=["099720109477"]
+        )
+        as_conf = LaunchConfiguration(self, "as_conf",
+            image_id=Token.as_string(ubuntu.id),
+            instance_type="m4.large",
+            lifecycle=TerraformResourceLifecycle(
+                create_before_destroy=True
+            ),
+            spot_price="0.001"
+        )
+        AutoscalingGroup(self, "bar",
+            launch_configuration=as_conf.name,
+            name="terraform-asg-example",
+            max_size=max_size,
+            min_size=min_size
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `image_id` - (Required) The EC2 image ID to launch.
+* `instance_type` - (Required) The size of instance to launch.
+
+The following arguments are optional:
+
+* `associate_public_ip_address` - (Optional) Associate a public ip address with an instance in a VPC.
+* `ebs_block_device` - (Optional) Additional EBS block devices to attach to the instance. See [Block Devices](#block-devices) below for details.
+* `ebs_optimized` - (Optional) If true, the launched EC2 instance will be EBS-optimized.
+* `enable_monitoring` - (Optional) Enables/disables detailed monitoring. This is enabled by default.
+* `ephemeral_block_device` - (Optional) Customize Ephemeral (also known as "Instance Store") volumes on the instance. See [Block Devices](#block-devices) below for details.
+* `iam_instance_profile` - (Optional) The name attribute of the IAM instance profile to associate with launched instances.
+* `key_name` - (Optional) The key name that should be used for the instance.
+* `metadata_options` - The metadata options for the instance.
+    * `http_endpoint` - The state of the metadata service: `enabled`, `disabled`.
+    * `http_tokens` - If session tokens are required: `optional`, `required`.
+    * `http_put_response_hop_limit` - The desired HTTP PUT response hop limit for instance metadata requests.
+* `name` - (Optional) The name of the launch configuration. If you leave this blank, Terraform will auto-generate a unique name. Conflicts with `name_prefix`.
+* `name_prefix` - (Optional) Creates a unique name beginning with the specified prefix. Conflicts with `name`.
+* `security_groups` - (Optional) A list of associated security group IDS.
+* `placement_tenancy` - (Optional) The tenancy of the instance. Valid values are `default` or `dedicated`, see [AWS's Create Launch Configuration](http://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_CreateLaunchConfiguration.html) for more details.
+* `root_block_device` - (Optional) Customize details about the root block device of the instance. See [Block Devices](#block-devices) below for details.
+* `spot_price` - (Optional; Default: On-demand price) The maximum price to use for reserving spot instances.
+* `user_data` - (Optional) The user data to provide when launching the instance. Do not pass gzip-compressed data via this argument; see `user_data_base64` instead.
+* `user_data_base64` - (Optional) Can be used instead of `user_data` to pass base64-encoded binary data directly. Use this instead of `user_data` whenever the value is not a valid UTF-8 string. For example, gzip-encoded user data must be base64-encoded and passed via this argument to avoid corruption.
+
+## Block devices
+
+Each of the `*_block_device` attributes controls a portion of the AWS
+Launch Configuration's "Block Device Mapping". It's a good idea to familiarize yourself with [AWS's Block Device
+Mapping docs](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/block-device-mapping-concepts.html)
+to understand the implications of using these attributes.
+
+Each AWS Instance type has a different set of Instance Store block devices
+available for attachment. AWS [publishes a
+list](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/InstanceStorage.html#StorageOnInstanceTypes)
+of which ephemeral devices are available on each type. The devices are always
+identified by the `virtual_name` in the format `ephemeral{0..N}`.
+
+~> **NOTE:** Changes to `*_block_device` configuration of _existing_ resources
+cannot currently be detected by Terraform. After updating to block device
+configuration, resource recreation can be manually triggered by using the
+[`taint` command](https://www.terraform.io/docs/commands/taint.html).
+  
+### ebs_block_device
+
+Modifying any of the `ebs_block_device` settings requires resource replacement.
+
+* `device_name` - (Required) The name of the device to mount.
+* `snapshot_id` - (Optional) The Snapshot ID to mount.
+* `volume_type` - (Optional) The type of volume. Can be `standard`, `gp2`, `gp3`, `st1`, `sc1` or `io1`.
+* `volume_size` - (Optional) The size of the volume in gigabytes.
+* `iops` - (Optional) The amount of provisioned
+  [IOPS](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-io-characteristics.html).
+  This must be set with a `volume_type` of `"io1"`.
+* `throughput` - (Optional) The throughput (MiBps) to provision for a `gp3` volume.
+* `delete_on_termination` - (Optional) Whether the volume should be destroyed
+  on instance termination (Default: `true`).
+* `encrypted` - (Optional) Whether the volume should be encrypted or not. Defaults to `false`.
+* `no_device` - (Optional) Whether the device in the block device mapping of the AMI is suppressed.
+
+### ephemeral_block_device
+
+* `device_name` - (Required) The name of the block device to mount on the instance.
+* `no_device` - (Optional) Whether the device in the block device mapping of the AMI is suppressed.
+* `virtual_name` - (Optional) The [Instance Store Device Name](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/InstanceStorage.html#InstanceStoreDeviceNames).
+
+### root_block_device
+
+-> Modifying any of the `root_block_device` settings requires resource replacement.
+
+* `delete_on_termination` - (Optional) Whether the volume should be destroyed on instance termination. Defaults to `true`.
+* `encrypted` - (Optional) Whether the volume should be encrypted or not. Defaults to `false`.
+* `iops` - (Optional) The amount of provisioned [IOPS](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-io-characteristics.html). This must be set with a `volume_type` of `io1`.
+* `throughput` - (Optional) The throughput (MiBps) to provision for a `gp3` volume.
+* `volume_size` - (Optional) The size of the volume in gigabytes.
+* `volume_type` - (Optional) The type of volume. Can be `standard`, `gp2`, `gp3`, `st1`, `sc1` or `io1`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the launch configuration.
+* `arn` - The Amazon Resource Name of the launch configuration.
+* `name` - The name of the launch configuration.
+
+[1]: /docs/providers/aws/r/autoscaling_group.html
+[2]: https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html
+[3]: /docs/providers/aws/r/spot_instance_request.html
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import launch configurations using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import launch configurations using the `name`. For example:
+
+```console
+% terraform import aws_launch_configuration.as_conf terraform-lg-123456
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1afc8a9c3b0aae557f61ece671e34889248cace0f6b278c49774c6baa830fa60 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/launch_template.html.markdown b/website/docs/cdktf/python/r/launch_template.html.markdown
new file mode 100644
index 00000000000..56e00fd2625
--- /dev/null
+++ b/website/docs/cdktf/python/r/launch_template.html.markdown
@@ -0,0 +1,515 @@
+---
+subcategory: "EC2 (Elastic Compute Cloud)"
+layout: "aws"
+page_title: "AWS: aws_launch_template"
+description: |-
+  Provides an EC2 launch template resource. Can be used to create instances or auto scaling groups.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_launch_template
+
+Provides an EC2 launch template resource. Can be used to create instances or auto scaling groups.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, Fn, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.launch_template import LaunchTemplate
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        LaunchTemplate(self, "foo",
+            block_device_mappings=[LaunchTemplateBlockDeviceMappings(
+                device_name="/dev/sdf",
+                ebs=LaunchTemplateBlockDeviceMappingsEbs(
+                    volume_size=20
+                )
+            )
+            ],
+            capacity_reservation_specification=LaunchTemplateCapacityReservationSpecification(
+                capacity_reservation_preference="open"
+            ),
+            cpu_options=LaunchTemplateCpuOptions(
+                core_count=4,
+                threads_per_core=2
+            ),
+            credit_specification=LaunchTemplateCreditSpecification(
+                cpu_credits="standard"
+            ),
+            disable_api_stop=True,
+            disable_api_termination=True,
+            ebs_optimized=Token.as_string(True),
+            elastic_gpu_specifications=[LaunchTemplateElasticGpuSpecifications(
+                type="test"
+            )
+            ],
+            elastic_inference_accelerator=LaunchTemplateElasticInferenceAccelerator(
+                type="eia1.medium"
+            ),
+            iam_instance_profile=LaunchTemplateIamInstanceProfile(
+                name="test"
+            ),
+            image_id="ami-test",
+            instance_initiated_shutdown_behavior="terminate",
+            instance_market_options=LaunchTemplateInstanceMarketOptions(
+                market_type="spot"
+            ),
+            instance_type="t2.micro",
+            kernel_id="test",
+            key_name="test",
+            license_specification=[LaunchTemplateLicenseSpecification(
+                license_configuration_arn="arn:aws:license-manager:eu-west-1:123456789012:license-configuration:lic-0123456789abcdef0123456789abcdef"
+            )
+            ],
+            metadata_options=LaunchTemplateMetadataOptions(
+                http_endpoint="enabled",
+                http_put_response_hop_limit=1,
+                http_tokens="required",
+                instance_metadata_tags="enabled"
+            ),
+            monitoring=LaunchTemplateMonitoring(
+                enabled=True
+            ),
+            name="foo",
+            network_interfaces=[LaunchTemplateNetworkInterfaces(
+                associate_public_ip_address=Token.as_string(True)
+            )
+            ],
+            placement=LaunchTemplatePlacement(
+                availability_zone="us-west-2a"
+            ),
+            ram_disk_id="test",
+            tag_specifications=[LaunchTemplateTagSpecifications(
+                resource_type="instance",
+                tags={
+                    "Name": "test"
+                }
+            )
+            ],
+            user_data=Token.as_string(Fn.filebase64("${path.module}/example.sh")),
+            vpc_security_group_ids=["sg-12345678"]
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `block_device_mappings` - (Optional) Specify volumes to attach to the instance besides the volumes specified by the AMI.
+  See [Block Devices](#block-devices) below for details.
+* `capacity_reservation_specification` - (Optional) Targeting for EC2 capacity reservations. See [Capacity Reservation Specification](#capacity-reservation-specification) below for more details.
+* `cpu_options` - (Optional) The CPU options for the instance. See [CPU Options](#cpu-options) below for more details.
+* `credit_specification` - (Optional) Customize the credit specification of the instance. See [Credit
+  Specification](#credit-specification) below for more details.
+* `default_version` - (Optional) Default Version of the launch template.
+* `description` - (Optional) Description of the launch template.
+* `disable_api_stop` - (Optional) If true, enables [EC2 Instance Stop Protection](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Stop_Start.html#Using_StopProtection).
+* `disable_api_termination` - (Optional) If `true`, enables [EC2 Instance
+  Termination Protection](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/terminating-instances.html#Using_ChangingDisableAPITermination)
+* `ebs_optimized` - (Optional) If `true`, the launched EC2 instance will be EBS-optimized.
+* `elastic_gpu_specifications` - (Optional) The elastic GPU to attach to the instance. See [Elastic GPU](#elastic-gpu)
+  below for more details.
+* `elastic_inference_accelerator` - (Optional) Configuration block containing an Elastic Inference Accelerator to attach to the instance. See [Elastic Inference Accelerator](#elastic-inference-accelerator) below for more details.
+* `enclave_options` - (Optional) Enable Nitro Enclaves on launched instances. See [Enclave Options](#enclave-options) below for more details.
+* `hibernation_options` - (Optional) The hibernation options for the instance. See [Hibernation Options](#hibernation-options) below for more details.
+* `iam_instance_profile` - (Optional) The IAM Instance Profile to launch the instance with. See [Instance Profile](#instance-profile)
+  below for more details.
+* `image_id` - (Optional) The AMI from which to launch the instance.
+* `instance_initiated_shutdown_behavior` - (Optional) Shutdown behavior for the instance. Can be `stop` or `terminate`.
+  (Default: `stop`).
+* `instance_market_options` - (Optional) The market (purchasing) option for the instance. See [Market Options](#market-options)
+  below for details.
+* `instance_requirements` - (Optional) The attribute requirements for the type of instance. If present then `instance_type` cannot be present.
+* `instance_type` - (Optional) The type of the instance. If present then `instance_requirements` cannot be present.
+* `kernel_id` - (Optional) The kernel ID.
+* `key_name` - (Optional) The key name to use for the instance.
+* `license_specification` - (Optional) A list of license specifications to associate with. See [License Specification](#license-specification) below for more details.
+* `maintenance_options` - (Optional) The maintenance options for the instance. See [Maintenance Options](#maintenance-options) below for more details.
+* `metadata_options` - (Optional) Customize the metadata options for the instance. See [Metadata Options](#metadata-options) below for more details.
+* `monitoring` - (Optional) The monitoring option for the instance. See [Monitoring](#monitoring) below for more details.
+* `name` - (Optional) The name of the launch template. If you leave this blank, Terraform will auto-generate a unique name.
+* `name_prefix` - (Optional) Creates a unique name beginning with the specified prefix. Conflicts with `name`.
+* `network_interfaces` - (Optional) Customize network interfaces to be attached at instance boot time. See [Network
+  Interfaces](#network-interfaces) below for more details.
+* `placement` - (Optional) The placement of the instance. See [Placement](#placement) below for more details.
+* `private_dns_name_options` - (Optional) The options for the instance hostname. The default values are inherited from the subnet. See [Private DNS Name Options](#private-dns-name-options) below for more details.
+* `ram_disk_id` - (Optional) The ID of the RAM disk.
+* `security_group_names` - (Optional) A list of security group names to associate with. If you are creating Instances in a VPC, use
+  `vpc_security_group_ids` instead.
+* `tag_specifications` - (Optional) The tags to apply to the resources during launch. See [Tag Specifications](#tag-specifications) below for more details.
+* `tags` - (Optional) A map of tags to assign to the launch template. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `update_default_version` - (Optional) Whether to update Default Version each update. Conflicts with `default_version`.
+* `user_data` - (Optional) The base64-encoded user data to provide when launching the instance.
+* `vpc_security_group_ids` - (Optional) A list of security group IDs to associate with. Conflicts with `network_interfaces.security_groups`
+
+### Block devices
+
+Configure additional volumes of the instance besides specified by the AMI. It's a good idea to familiarize yourself with
+  [AWS's Block Device Mapping docs](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/block-device-mapping-concepts.html)
+  to understand the implications of using these attributes.
+
+To find out more information for an existing AMI to override the configuration, such as `device_name`, you can use the [AWS CLI ec2 describe-images command](https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-images.html).
+
+Each `block_device_mappings` supports the following:
+
+* `device_name` - (Required) The name of the device to mount.
+* `ebs` - (Optional) Configure EBS volume properties.
+* `no_device` - (Optional) Suppresses the specified device included in the AMI's block device mapping.
+* `virtual_name` - (Optional) The [Instance Store Device
+  Name](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/InstanceStorage.html#InstanceStoreDeviceNames)
+  (e.g., `"ephemeral0"`).
+
+The `ebs` block supports the following:
+
+* `delete_on_termination` - (Optional) Whether the volume should be destroyed on instance termination.
+  See [Preserving Amazon EBS Volumes on Instance Termination](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/terminating-instances.html#preserving-volumes-on-termination) for more information.
+* `encrypted` - (Optional) Enables [EBS encryption](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html) on the volume.
+  Cannot be used with `snapshot_id`.
+* `iops` - (Optional) The amount of provisioned [IOPS](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-io-characteristics.html).
+  This must be set with a `volume_type` of `"io1/io2/gp3"`.
+* `kms_key_id` - (Optional) The ARN of the AWS Key Management Service (AWS KMS) customer master key (CMK) to use when creating the encrypted volume.
+  `encrypted` must be set to `true` when this is set.
+* `snapshot_id` - (Optional) The Snapshot ID to mount.
+* `throughput` - (Optional) The throughput to provision for a `gp3` volume in MiB/s (specified as an integer, e.g., 500), with a maximum of 1,000 MiB/s.
+* `volume_size` - (Optional) The size of the volume in gigabytes.
+* `volume_type` - (Optional) The volume type.
+  Can be one of `standard`, `gp2`, `gp3`, `io1`, `io2`, `sc1` or `st1`.
+
+### Capacity Reservation Specification
+
+The `capacity_reservation_specification` block supports the following:
+
+* `capacity_reservation_preference` - Indicates the instance's Capacity Reservation preferences. Can be `open` or `none`. (Default `none`).
+* `capacity_reservation_target` - Used to target a specific Capacity Reservation:
+
+The `capacity_reservation_target` block supports the following:
+
+* `capacity_reservation_id` - The ID of the Capacity Reservation in which to run the instance.
+* `capacity_reservation_resource_group_arn` - The ARN of the Capacity Reservation resource group in which to run the instance.
+
+### CPU Options
+
+The `cpu_options` block supports the following:
+
+* `amd_sev_snp` - Indicates whether to enable the instance for AMD SEV-SNP. AMD SEV-SNP is supported with M6a, R6a, and C6a instance types only. Valid values are `enabled` and `disabled`.
+* `core_count` - The number of CPU cores for the instance.
+* `threads_per_core` - The number of threads per CPU core.
+  To disable Intel Hyper-Threading Technology for the instance, specify a value of 1.
+  Otherwise, specify the default value of 2.
+
+Both number of CPU cores and threads per core must be specified. Valid number of CPU cores and threads per core for the instance type can be found in the [CPU Options Documentation](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-optimize-cpu.html?shortFooter=true#cpu-options-supported-instances-values)
+
+### Credit Specification
+
+Credit specification can be applied/modified to the EC2 Instance at any time.
+
+The `credit_specification` block supports the following:
+
+* `cpu_credits` - The credit option for CPU usage.
+  Can be `standard` or `unlimited`.
+  T3 instances are launched as `unlimited` by default.
+  T2 instances are launched as `standard` by default.
+
+### Elastic GPU
+
+Attach an elastic GPU the instance.
+
+The `elastic_gpu_specifications` block supports the following:
+
+* `type` - The [Elastic GPU Type](https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/elastic-gpus.html#elastic-gpus-basics)
+
+### Elastic Inference Accelerator
+
+Attach an Elastic Inference Accelerator to the instance. Additional information about Elastic Inference in EC2 can be found in the [EC2 User Guide](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/elastic-inference.html).
+
+The `elastic_inference_accelerator` configuration block supports the following:
+
+* `type` - (Required) Accelerator type.
+
+### Enclave Options
+
+The `enclave_options` block supports the following:
+
+* `enabled` - If set to `true`, Nitro Enclaves will be enabled on the instance.
+
+For more information, see the documentation on [Nitro Enclaves](https://docs.aws.amazon.com/enclaves/latest/user/nitro-enclave.html).
+
+### Hibernation Options
+
+The `hibernation_options` block supports the following:
+
+* `configured` - If set to `true`, the launched EC2 instance will hibernation enabled.
+
+### Instance Profile
+
+The [IAM Instance Profile](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2_instance-profiles.html)
+to attach.
+
+The `iam_instance_profile` block supports the following:
+
+* `arn` - The Amazon Resource Name (ARN) of the instance profile.
+* `name` - The name of the instance profile.
+
+### Instance Requirements
+
+This configuration block supports the following:
+
+~> **NOTE:** Both `memory_mib.min` and `vcpu_count.min` must be specified.
+
+* `accelerator_count` - (Optional) Block describing the minimum and maximum number of accelerators (GPUs, FPGAs, or AWS Inferentia chips). Default is no minimum or maximum.
+    * `min` - (Optional) Minimum.
+    * `max` - (Optional) Maximum. Set to `0` to exclude instance types with accelerators.
+* `accelerator_manufacturers` - (Optional) List of accelerator manufacturer names. Default is any manufacturer.
+
+    ```
+    Valid names:
+      * amazon-web-services
+      * amd
+      * nvidia
+      * xilinx
+    ```
+
+* `accelerator_names` - (Optional) List of accelerator names. Default is any acclerator.
+
+    ```
+    Valid names:
+      * a100            - NVIDIA A100 GPUs
+      * v100            - NVIDIA V100 GPUs
+      * k80             - NVIDIA K80 GPUs
+      * t4              - NVIDIA T4 GPUs
+      * m60             - NVIDIA M60 GPUs
+      * radeon-pro-v520 - AMD Radeon Pro V520 GPUs
+      * vu9p            - Xilinx VU9P FPGAs
+    ```
+
+* `accelerator_total_memory_mib` - (Optional) Block describing the minimum and maximum total memory of the accelerators. Default is no minimum or maximum.
+    * `min` - (Optional) Minimum.
+    * `max` - (Optional) Maximum.
+* `accelerator_types` - (Optional) List of accelerator types. Default is any accelerator type.
+
+    ```
+    Valid types:
+      * fpga
+      * gpu
+      * inference
+    ```
+
+* `allowed_instance_types` - (Optional) List of instance types to apply your specified attributes against. All other instance types are ignored, even if they match your specified attributes. You can use strings with one or more wild cards, represented by an asterisk (\*), to allow an instance type, size, or generation. The following are examples: `m5.8xlarge`, `c5*.*`, `m5a.*`, `r*`, `*3*`. For example, if you specify `c5*`, you are allowing the entire C5 instance family, which includes all C5a and C5n instance types. If you specify `m5a.*`, you are allowing all the M5a instance types, but not the M5n instance types. Maximum of 400 entries in the list; each entry is limited to 30 characters. Default is all instance types.
+
+    ~> **NOTE:** If you specify `allowed_instance_types`, you can't specify `excluded_instance_types`.
+
+* `bare_metal` - (Optional) Indicate whether bare metal instace types should be `included`, `excluded`, or `required`. Default is `excluded`.
+* `baseline_ebs_bandwidth_mbps` - (Optional) Block describing the minimum and maximum baseline EBS bandwidth, in Mbps. Default is no minimum or maximum.
+    * `min` - (Optional) Minimum.
+    * `max` - (Optional) Maximum.
+* `burstable_performance` - (Optional) Indicate whether burstable performance instance types should be `included`, `excluded`, or `required`. Default is `excluded`.
+* `cpu_manufacturers` (Optional) List of CPU manufacturer names. Default is any manufacturer.
+
+    ~> **NOTE:** Don't confuse the CPU hardware manufacturer with the CPU hardware architecture. Instances will be launched with a compatible CPU architecture based on the Amazon Machine Image (AMI) that you specify in your launch template.
+
+    ```
+    Valid names:
+      * amazon-web-services
+      * amd
+      * intel
+    ```
+
+* `excluded_instance_types` - (Optional) List of instance types to exclude. You can use strings with one or more wild cards, represented by an asterisk (\*), to exclude an instance type, size, or generation. The following are examples: `m5.8xlarge`, `c5*.*`, `m5a.*`, `r*`, `*3*`. For example, if you specify `c5*`, you are excluding the entire C5 instance family, which includes all C5a and C5n instance types. If you specify `m5a.*`, you are excluding all the M5a instance types, but not the M5n instance types. Maximum of 400 entries in the list; each entry is limited to 30 characters. Default is no excluded instance types.
+
+    ~> **NOTE:** If you specify `excluded_instance_types`, you can't specify `allowed_instance_types`.
+
+* `instance_generations` - (Optional) List of instance generation names. Default is any generation.
+
+    ```
+    Valid names:
+      * current  - Recommended for best performance.
+      * previous - For existing applications optimized for older instance types.
+    ```
+
+* `local_storage` - (Optional) Indicate whether instance types with local storage volumes are `included`, `excluded`, or `required`. Default is `included`.
+* `local_storage_types` - (Optional) List of local storage type names. Default any storage type.
+
+    ```
+    Value names:
+      * hdd - hard disk drive
+      * ssd - solid state drive
+    ```
+
+* `memory_gib_per_vcpu` - (Optional) Block describing the minimum and maximum amount of memory (GiB) per vCPU. Default is no minimum or maximum.
+    * `min` - (Optional) Minimum. May be a decimal number, e.g. `0.5`.
+    * `max` - (Optional) Maximum. May be a decimal number, e.g. `0.5`.
+* `memory_mib` - (Required) Block describing the minimum and maximum amount of memory (MiB). Default is no maximum.
+    * `min` - (Required) Minimum.
+    * `max` - (Optional) Maximum.
+* `network_bandwidth_gbps` - (Optional) Block describing the minimum and maximum amount of network bandwidth, in gigabits per second (Gbps). Default is no minimum or maximum.
+    * `min` - (Optional) Minimum.
+    * `max` - (Optional) Maximum.
+* `network_interface_count` - (Optional) Block describing the minimum and maximum number of network interfaces. Default is no minimum or maximum.
+    * `min` - (Optional) Minimum.
+    * `max` - (Optional) Maximum.
+* `on_demand_max_price_percentage_over_lowest_price` - (Optional) The price protection threshold for On-Demand Instances. This is the maximum you’ll pay for an On-Demand Instance, expressed as a percentage higher than the cheapest M, C, or R instance type with your specified attributes. When Amazon EC2 Auto Scaling selects instance types with your attributes, we will exclude instance types whose price is higher than your threshold. The parameter accepts an integer, which Amazon EC2 Auto Scaling interprets as a percentage. To turn off price protection, specify a high value, such as 999999. Default is 20.
+
+    If you set DesiredCapacityType to vcpu or memory-mib, the price protection threshold is applied based on the per vCPU or per memory price instead of the per instance price.
+* `require_hibernate_support` - (Optional) Indicate whether instance types must support On-Demand Instance Hibernation, either `true` or `false`. Default is `false`.
+* `spot_max_price_percentage_over_lowest_price` - (Optional) The price protection threshold for Spot Instances. This is the maximum you’ll pay for a Spot Instance, expressed as a percentage higher than the cheapest M, C, or R instance type with your specified attributes. When Amazon EC2 Auto Scaling selects instance types with your attributes, we will exclude instance types whose price is higher than your threshold. The parameter accepts an integer, which Amazon EC2 Auto Scaling interprets as a percentage. To turn off price protection, specify a high value, such as 999999. Default is 100.
+
+    If you set DesiredCapacityType to vcpu or memory-mib, the price protection threshold is applied based on the per vCPU or per memory price instead of the per instance price.
+* `total_local_storage_gb` - (Optional) Block describing the minimum and maximum total local storage (GB). Default is no minimum or maximum.
+    * `min` - (Optional) Minimum. May be a decimal number, e.g. `0.5`.
+    * `max` - (Optional) Maximum. May be a decimal number, e.g. `0.5`.
+* `vcpu_count` - (Required) Block describing the minimum and maximum number of vCPUs. Default is no maximum.
+    * `min` - (Required) Minimum.
+    * `max` - (Optional) Maximum.
+
+### License Specification
+
+Associate one of more license configurations.
+
+The `license_specification` block supports the following:
+
+* `license_configuration_arn` - (Required) ARN of the license configuration.
+
+### Maintenance Options
+
+The `maintenance_options` block supports the following:
+
+* `auto_recovery` - (Optional) Disables the automatic recovery behavior of your instance or sets it to default. Can be `"default"` or `"disabled"`. See [Recover your instance](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-recover.html) for more details.
+
+### Market Options
+
+The market (purchasing) option for the instances.
+
+The `instance_market_options` block supports the following:
+
+* `market_type` - The market type. Can be `spot`.
+* `spot_options` - The options for [Spot Instance](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-spot-instances.html)
+
+The `spot_options` block supports the following:
+
+* `block_duration_minutes` - The required duration in minutes. This value must be a multiple of 60.
+* `instance_interruption_behavior` - The behavior when a Spot Instance is interrupted. Can be `hibernate`,
+  `stop`, or `terminate`. (Default: `terminate`).
+* `max_price` - The maximum hourly price you're willing to pay for the Spot Instances.
+* `spot_instance_type` - The Spot Instance request type. Can be `one-time`, or `persistent`.
+* `valid_until` - The end date of the request.
+
+### Metadata Options
+
+The metadata options for the instances.
+
+The `metadata_options` block supports the following:
+
+* `http_endpoint` - (Optional) Whether the metadata service is available. Can be `"enabled"` or `"disabled"`. (Default: `"enabled"`).
+* `http_tokens` - (Optional) Whether or not the metadata service requires session tokens, also referred to as _Instance Metadata Service Version 2 (IMDSv2)_. Can be `"optional"` or `"required"`. (Default: `"optional"`).
+* `http_put_response_hop_limit` - (Optional) The desired HTTP PUT response hop limit for instance metadata requests. The larger the number, the further instance metadata requests can travel. Can be an integer from `1` to `64`. (Default: `1`).
+* `http_protocol_ipv6` - (Optional) Enables or disables the IPv6 endpoint for the instance metadata service. Can be `"enabled"` or `"disabled"`.
+* `instance_metadata_tags` - (Optional) Enables or disables access to instance tags from the instance metadata service. Can be `"enabled"` or `"disabled"`.
+
+For more information, see the documentation on the [Instance Metadata Service](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html).
+
+### Monitoring
+
+The `monitoring` block supports the following:
+
+* `enabled` - If `true`, the launched EC2 instance will have detailed monitoring enabled.
+
+### Network Interfaces
+
+Attaches one or more [Network Interfaces](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-eni.html) to the instance.
+
+Check limitations for autoscaling group in [Creating an Auto Scaling Group Using a Launch Template Guide](https://docs.aws.amazon.com/autoscaling/ec2/userguide/create-asg-launch-template.html#limitations)
+
+Each `network_interfaces` block supports the following:
+
+* `associate_carrier_ip_address` - (Optional) Associate a Carrier IP address with `eth0` for a new network interface.
+  Use this option when you launch an instance in a Wavelength Zone and want to associate a Carrier IP address with the network interface.
+  Boolean value, can be left unset.
+* `associate_public_ip_address` - (Optional) Associate a public ip address with the network interface.
+  Boolean value, can be left unset.
+* `delete_on_termination` - (Optional) Whether the network interface should be destroyed on instance termination.
+* `description` - (Optional) Description of the network interface.
+* `device_index` - (Optional) The integer index of the network interface attachment.
+* `interface_type` - (Optional) The type of network interface. To create an Elastic Fabric Adapter (EFA), specify `efa`.
+* `ipv4_prefix_count` - (Optional) The number of IPv4 prefixes to be automatically assigned to the network interface. Conflicts with `ipv4_prefixes`
+* `ipv4_prefixes` - (Optional) One or more IPv4 prefixes to be assigned to the network interface. Conflicts with `ipv4_prefix_count`
+* `ipv6_addresses` - (Optional) One or more specific IPv6 addresses from the IPv6 CIDR block range of your subnet. Conflicts with `ipv6_address_count`
+* `ipv6_address_count` - (Optional) The number of IPv6 addresses to assign to a network interface. Conflicts with `ipv6_addresses`
+* `ipv6_prefix_count` - (Optional) The number of IPv6 prefixes to be automatically assigned to the network interface. Conflicts with `ipv6_prefixes`
+* `ipv6_prefixes` - (Optional) One or more IPv6 prefixes to be assigned to the network interface. Conflicts with `ipv6_prefix_count`
+* `network_interface_id` - (Optional) The ID of the network interface to attach.
+* `network_card_index` - (Optional) The index of the network card. Some instance types support multiple network cards. The primary network interface must be assigned to network card index 0. The default is network card index 0.
+* `private_ip_address` - (Optional) The primary private IPv4 address.
+* `ipv4_address_count` - (Optional) The number of secondary private IPv4 addresses to assign to a network interface. Conflicts with `ipv4_addresses`
+* `ipv4_addresses` - (Optional) One or more private IPv4 addresses to associate. Conflicts with `ipv4_address_count`
+* `security_groups` - (Optional) A list of security group IDs to associate.
+* `subnet_id` - (Optional) The VPC Subnet ID to associate.
+
+### Placement
+
+The [Placement Group](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/placement-groups.html) of the instance.
+
+The `placement` block supports the following:
+
+* `affinity` - (Optional) The affinity setting for an instance on a Dedicated Host.
+* `availability_zone` - (Optional) The Availability Zone for the instance.
+* `group_name` - (Optional) The name of the placement group for the instance.
+* `host_id` - (Optional) The ID of the Dedicated Host for the instance.
+* `host_resource_group_arn` - (Optional) The ARN of the Host Resource Group in which to launch instances.
+* `spread_domain` - (Optional) Reserved for future use.
+* `tenancy` - (Optional) The tenancy of the instance (if the instance is running in a VPC). Can be `default`, `dedicated`, or `host`.
+* `partition_number` - (Optional) The number of the partition the instance should launch in. Valid only if the placement group strategy is set to partition.
+
+### Private DNS Name Options
+
+The `private_dns_name_options` block supports the following:
+
+* `enable_resource_name_dns_aaaa_record` - (Optional) Indicates whether to respond to DNS queries for instance hostnames with DNS AAAA records.
+* `enable_resource_name_dns_a_record` - (Optional) Indicates whether to respond to DNS queries for instance hostnames with DNS A records.
+* `hostname_type` - (Optional) The type of hostname for Amazon EC2 instances. For IPv4 only subnets, an instance DNS name must be based on the instance IPv4 address. For IPv6 native subnets, an instance DNS name must be based on the instance ID. For dual-stack subnets, you can specify whether DNS names use the instance IPv4 address or the instance ID. Valid values: `ip-name` and `resource-name`.
+
+### Tag Specifications
+
+The tags to apply to the resources during launch. You can tag instances, volumes, elastic GPUs and spot instance requests. More information can be found in the [EC2 API documentation](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_LaunchTemplateTagSpecificationRequest.html).
+
+Each `tag_specifications` block supports the following:
+
+* `resource_type` - (Optional) The type of resource to tag.
+* `tags` -(Optional)  A map of tags to assign to the resource.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the launch template.
+* `id` - The ID of the launch template.
+* `latest_version` - The latest version of the launch template.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Launch Templates using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Launch Templates using the `id`. For example:
+
+```console
+% terraform import aws_launch_template.web lt-12345678
+```
+
+<!-- cache-key: cdktf-0.18.0 input-a5333efb037c0df523bc8a52b27bb2917c678c42feabe7b2e32815b125c04e27 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/lb.html.markdown b/website/docs/cdktf/python/r/lb.html.markdown
new file mode 100644
index 00000000000..e443d0a7703
--- /dev/null
+++ b/website/docs/cdktf/python/r/lb.html.markdown
@@ -0,0 +1,221 @@
+---
+subcategory: "ELB (Elastic Load Balancing)"
+layout: "aws"
+page_title: "AWS: aws_lb"
+description: |-
+  Provides a Load Balancer resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lb
+
+Provides a Load Balancer resource.
+
+~> **Note:** `aws_alb` is known as `aws_lb`. The functionality is identical.
+
+## Example Usage
+
+### Application Load Balancer
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.lb import Lb
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Lb(self, "test",
+            access_logs=LbAccessLogs(
+                bucket=lb_logs.id,
+                enabled=True,
+                prefix="test-lb"
+            ),
+            enable_deletion_protection=True,
+            internal=False,
+            load_balancer_type="application",
+            name="test-lb-tf",
+            security_groups=[lb_sg.id],
+            subnets=Token.as_list("${[ for subnet in ${" + public.fqn + "} : subnet.id]}"),
+            tags={
+                "Environment": "production"
+            }
+        )
+```
+
+### Network Load Balancer
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.lb import Lb
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Lb(self, "test",
+            enable_deletion_protection=True,
+            internal=False,
+            load_balancer_type="network",
+            name="test-lb-tf",
+            subnets=Token.as_list("${[ for subnet in ${" + public.fqn + "} : subnet.id]}"),
+            tags={
+                "Environment": "production"
+            }
+        )
+```
+
+### Specifying Elastic IPs
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.lb import Lb
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Lb(self, "example",
+            load_balancer_type="network",
+            name="example",
+            subnet_mapping=[LbSubnetMapping(
+                allocation_id=example1.id,
+                subnet_id=Token.as_string(aws_subnet_example1.id)
+            ), LbSubnetMapping(
+                allocation_id=example2.id,
+                subnet_id=Token.as_string(aws_subnet_example2.id)
+            )
+            ]
+        )
+```
+
+### Specifying private IP addresses for an internal-facing load balancer
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.lb import Lb
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Lb(self, "example",
+            load_balancer_type="network",
+            name="example",
+            subnet_mapping=[LbSubnetMapping(
+                private_ipv4_address="10.0.1.15",
+                subnet_id=example1.id
+            ), LbSubnetMapping(
+                private_ipv4_address="10.0.2.15",
+                subnet_id=example2.id
+            )
+            ]
+        )
+```
+
+## Argument Reference
+
+~> **NOTE:** Please note that internal LBs can only use `ipv4` as the `ip_address_type`. You can only change to `dualstack` `ip_address_type` if the selected subnets are IPv6 enabled.
+
+~> **NOTE:** Please note that one of either `subnets` or `subnet_mapping` is required.
+
+This resource supports the following arguments:
+
+* `access_logs` - (Optional) An Access Logs block. Access Logs documented below.
+* `customer_owned_ipv4_pool` - (Optional) The ID of the customer owned ipv4 pool to use for this load balancer.
+* `desync_mitigation_mode` - (Optional) Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
+* `dns_record_client_routing_policy` - (Optional) Indicates how traffic is distributed among the load balancer Availability Zones. Possible values are `any_availability_zone` (default), `availability_zone_affinity`, or `partial_availability_zone_affinity`. See   [Availability Zone DNS affinity](https://docs.aws.amazon.com/elasticloadbalancing/latest/network/network-load-balancers.html#zonal-dns-affinity) for additional details. Only valid for `network` type load balancers.
+* `drop_invalid_header_fields` - (Optional) Indicates whether HTTP headers with header fields that are not valid are removed by the load balancer (true) or routed to targets (false). The default is false. Elastic Load Balancing requires that message header names contain only alphanumeric characters and hyphens. Only valid for Load Balancers of type `application`.
+* `enable_cross_zone_load_balancing` - (Optional) If true, cross-zone load balancing of the load balancer will be enabled. For `network` and `gateway` type load balancers, this feature is disabled by default (`false`). For `application` load balancer this feature is always enabled (`true`) and cannot be disabled. Defaults to `false`.
+* `enable_deletion_protection` - (Optional) If true, deletion of the load balancer will be disabled via the AWS API. This will prevent Terraform from deleting the load balancer. Defaults to `false`.
+* `enable_http2` - (Optional) Indicates whether HTTP/2 is enabled in `application` load balancers. Defaults to `true`.
+* `enable_tls_version_and_cipher_suite_headers` - (Optional) Indicates whether the two headers (`x-amzn-tls-version` and `x-amzn-tls-cipher-suite`), which contain information about the negotiated TLS version and cipher suite, are added to the client request before sending it to the target. Only valid for Load Balancers of type `application`. Defaults to `false`
+* `enable_xff_client_port` - (Optional) Indicates whether the X-Forwarded-For header should preserve the source port that the client used to connect to the load balancer in `application` load balancers. Defaults to `false`.
+* `enable_waf_fail_open` - (Optional) Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. Defaults to `false`.
+* `idle_timeout` - (Optional) The time in seconds that the connection is allowed to be idle. Only valid for Load Balancers of type `application`. Default: 60.
+* `internal` - (Optional) If true, the LB will be internal. Defaults to `false`.
+* `ip_address_type` - (Optional) The type of IP addresses used by the subnets for your load balancer. The possible values are `ipv4` and `dualstack`.
+* `load_balancer_type` - (Optional) The type of load balancer to create. Possible values are `application`, `gateway`, or `network`. The default value is `application`.
+* `name` - (Optional) The name of the LB. This name must be unique within your AWS account, can have a maximum of 32 characters,
+must contain only alphanumeric characters or hyphens, and must not begin or end with a hyphen. If not specified,
+Terraform will autogenerate a name beginning with `tf-lb`.
+* `name_prefix` - (Optional) Creates a unique name beginning with the specified prefix. Conflicts with `name`.
+* `security_groups` - (Optional) A list of security group IDs to assign to the LB. Only valid for Load Balancers of type `application` or `network`. For load balancers of type `network` security groups cannot be added if none are currently present, and cannot all be removed once added. If either of these conditions are met, this will force a recreation of the resource.
+* `preserve_host_header` - (Optional) Indicates whether the Application Load Balancer should preserve the Host header in the HTTP request and send it to the target without any change. Defaults to `false`.
+* `subnet_mapping` - (Optional) A subnet mapping block as documented below.
+* `subnets` - (Optional) A list of subnet IDs to attach to the LB. Subnets
+cannot be updated for Load Balancers of type `network`. Changing this value
+for load balancers of type `network` will force a recreation of the resource.
+* `xff_header_processing_mode` - (Optional) Determines how the load balancer modifies the `X-Forwarded-For` header in the HTTP request before sending the request to the target. The possible values are `append`, `preserve`, and `remove`. Only valid for Load Balancers of type `application`. The default is `append`.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### access_logs
+
+* `bucket` - (Required) The S3 bucket name to store the logs in.
+* `enabled` - (Optional) Boolean to enable / disable `access_logs`. Defaults to `false`, even when `bucket` is specified.
+* `prefix` - (Optional) The S3 bucket prefix. Logs are stored in the root if not configured.
+
+### subnet_mapping
+
+* `subnet_id` - (Required) ID of the subnet of which to attach to the load balancer. You can specify only one subnet per Availability Zone.
+* `allocation_id` - (Optional) The allocation ID of the Elastic IP address for an internet-facing load balancer.
+* `ipv6_address` - (Optional) The IPv6 address. You associate IPv6 CIDR blocks with your VPC and choose the subnets where you launch both internet-facing and internal Application Load Balancers or Network Load Balancers.
+* `private_ipv4_address` - (Optional) The private IPv4 address for an internal load balancer.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the load balancer (matches `id`).
+* `arn_suffix` - The ARN suffix for use with CloudWatch Metrics.
+* `dns_name` - The DNS name of the load balancer.
+* `id` - The ARN of the load balancer (matches `arn`).
+* `subnet_mapping.*.outpost_id` - ID of the Outpost containing the load balancer.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `zone_id` - The canonical hosted zone ID of the load balancer (to be used in a Route 53 Alias record).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `10m`)
+- `update` - (Default `10m`)
+- `delete` - (Default `10m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import LBs using their ARN. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import LBs using their ARN. For example:
+
+```console
+% terraform import aws_lb.bar arn:aws:elasticloadbalancing:us-west-2:123456789012:loadbalancer/app/my-load-balancer/50dc6c495c0c9188
+```
+
+<!-- cache-key: cdktf-0.18.0 input-11d928929bb1ef617daceb855e42b2dfca81e2f529334101c305ff8082f913d7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/lb_cookie_stickiness_policy.html.markdown b/website/docs/cdktf/python/r/lb_cookie_stickiness_policy.html.markdown
new file mode 100644
index 00000000000..0111ec4266d
--- /dev/null
+++ b/website/docs/cdktf/python/r/lb_cookie_stickiness_policy.html.markdown
@@ -0,0 +1,72 @@
+---
+subcategory: "ELB Classic"
+layout: "aws"
+page_title: "AWS: aws_lb_cookie_stickiness_policy"
+description: |-
+  Provides a load balancer cookie stickiness policy, which allows an ELB to control the sticky session lifetime of the browser.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lb_cookie_stickiness_policy
+
+Provides a load balancer cookie stickiness policy, which allows an ELB to control the sticky session lifetime of the browser.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.elb import Elb
+from imports.aws.lb_cookie_stickiness_policy import LbCookieStickinessPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        lb = Elb(self, "lb",
+            availability_zones=["us-east-1a"],
+            listener=[ElbListener(
+                instance_port=8000,
+                instance_protocol="http",
+                lb_port=80,
+                lb_protocol="http"
+            )
+            ],
+            name="test-lb"
+        )
+        LbCookieStickinessPolicy(self, "foo",
+            cookie_expiration_period=600,
+            lb_port=80,
+            load_balancer=lb.id,
+            name="foo-policy"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the stickiness policy.
+* `load_balancer` - (Required) The load balancer to which the policy
+  should be attached.
+* `lb_port` - (Required) The load balancer port to which the policy
+  should be applied. This must be an active listener on the load
+balancer.
+* `cookie_expiration_period` - (Optional) The time period after which
+  the session cookie should be considered stale, expressed in seconds.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the policy.
+* `name` - The name of the stickiness policy.
+* `load_balancer` - The load balancer to which the policy is attached.
+* `lb_port` - The load balancer port to which the policy is applied.
+* `cookie_expiration_period` - The time period after which the session cookie is considered stale, expressed in seconds.
+
+<!-- cache-key: cdktf-0.18.0 input-fab95ad5bcc2bdeffcc1f3be4d3e7e2ca90c885f10678f8fbce6e3f28c5c37b3 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/lb_listener.html.markdown b/website/docs/cdktf/python/r/lb_listener.html.markdown
new file mode 100644
index 00000000000..73c3c56e8a4
--- /dev/null
+++ b/website/docs/cdktf/python/r/lb_listener.html.markdown
@@ -0,0 +1,456 @@
+---
+subcategory: "ELB (Elastic Load Balancing)"
+layout: "aws"
+page_title: "AWS: aws_lb_listener"
+description: |-
+  Provides a Load Balancer Listener resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lb_listener
+
+Provides a Load Balancer Listener resource.
+
+~> **Note:** `aws_alb_listener` is known as `aws_lb_listener`. The functionality is identical.
+
+## Example Usage
+
+### Forward Action
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.lb import Lb
+from imports.aws.lb_listener import LbListener
+from imports.aws.lb_target_group import LbTargetGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        front_end = Lb(self, "front_end")
+        aws_lb_target_group_front_end = LbTargetGroup(self, "front_end_1")
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_lb_target_group_front_end.override_logical_id("front_end")
+        aws_lb_listener_front_end = LbListener(self, "front_end_2",
+            certificate_arn="arn:aws:iam::187416307283:server-certificate/test_cert_rab3wuqwgja25ct3n4jdj2tzu4",
+            default_action=[LbListenerDefaultAction(
+                target_group_arn=Token.as_string(aws_lb_target_group_front_end.arn),
+                type="forward"
+            )
+            ],
+            load_balancer_arn=front_end.arn,
+            port=Token.as_number("443"),
+            protocol="HTTPS",
+            ssl_policy="ELBSecurityPolicy-2016-08"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_lb_listener_front_end.override_logical_id("front_end")
+```
+
+To a NLB:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.lb_listener import LbListener
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        LbListener(self, "front_end",
+            alpn_policy="HTTP2Preferred",
+            certificate_arn="arn:aws:iam::187416307283:server-certificate/test_cert_rab3wuqwgja25ct3n4jdj2tzu4",
+            default_action=[LbListenerDefaultAction(
+                target_group_arn=Token.as_string(aws_lb_target_group_front_end.arn),
+                type="forward"
+            )
+            ],
+            load_balancer_arn=Token.as_string(aws_lb_front_end.arn),
+            port=Token.as_number("443"),
+            protocol="TLS"
+        )
+```
+
+### Redirect Action
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.lb import Lb
+from imports.aws.lb_listener import LbListener
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        front_end = Lb(self, "front_end")
+        aws_lb_listener_front_end = LbListener(self, "front_end_1",
+            default_action=[LbListenerDefaultAction(
+                redirect=LbListenerDefaultActionRedirect(
+                    port="443",
+                    protocol="HTTPS",
+                    status_code="HTTP_301"
+                ),
+                type="redirect"
+            )
+            ],
+            load_balancer_arn=front_end.arn,
+            port=Token.as_number("80"),
+            protocol="HTTP"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_lb_listener_front_end.override_logical_id("front_end")
+```
+
+### Fixed-response Action
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.lb import Lb
+from imports.aws.lb_listener import LbListener
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        front_end = Lb(self, "front_end")
+        aws_lb_listener_front_end = LbListener(self, "front_end_1",
+            default_action=[LbListenerDefaultAction(
+                fixed_response=LbListenerDefaultActionFixedResponse(
+                    content_type="text/plain",
+                    message_body="Fixed response content",
+                    status_code="200"
+                ),
+                type="fixed-response"
+            )
+            ],
+            load_balancer_arn=front_end.arn,
+            port=Token.as_number("80"),
+            protocol="HTTP"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_lb_listener_front_end.override_logical_id("front_end")
+```
+
+### Authenticate-cognito Action
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cognito_user_pool import CognitoUserPool
+from imports.aws.cognito_user_pool_client import CognitoUserPoolClient
+from imports.aws.cognito_user_pool_domain import CognitoUserPoolDomain
+from imports.aws.lb import Lb
+from imports.aws.lb_listener import LbListener
+from imports.aws.lb_target_group import LbTargetGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, name, name1, userPoolId, domain, userPoolId1):
+        super().__init__(scope, name)
+        pool = CognitoUserPool(self, "pool",
+            name=name
+        )
+        client = CognitoUserPoolClient(self, "client",
+            name=name1,
+            user_pool_id=user_pool_id
+        )
+        domain = CognitoUserPoolDomain(self, "domain",
+            domain=domain,
+            user_pool_id=user_pool_id1
+        )
+        front_end = Lb(self, "front_end")
+        aws_lb_target_group_front_end = LbTargetGroup(self, "front_end_4")
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_lb_target_group_front_end.override_logical_id("front_end")
+        aws_lb_listener_front_end = LbListener(self, "front_end_5",
+            default_action=[LbListenerDefaultAction(
+                authenticate_cognito=LbListenerDefaultActionAuthenticateCognito(
+                    user_pool_arn=pool.arn,
+                    user_pool_client_id=client.id,
+                    user_pool_domain=domain.domain
+                ),
+                type="authenticate-cognito"
+            ), LbListenerDefaultAction(
+                target_group_arn=Token.as_string(aws_lb_target_group_front_end.arn),
+                type="forward"
+            )
+            ],
+            load_balancer_arn=front_end.arn,
+            port=Token.as_number("80"),
+            protocol="HTTP"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_lb_listener_front_end.override_logical_id("front_end")
+```
+
+### Authenticate-OIDC Action
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.lb import Lb
+from imports.aws.lb_listener import LbListener
+from imports.aws.lb_target_group import LbTargetGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        front_end = Lb(self, "front_end")
+        aws_lb_target_group_front_end = LbTargetGroup(self, "front_end_1")
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_lb_target_group_front_end.override_logical_id("front_end")
+        aws_lb_listener_front_end = LbListener(self, "front_end_2",
+            default_action=[LbListenerDefaultAction(
+                authenticate_oidc=LbListenerDefaultActionAuthenticateOidc(
+                    authorization_endpoint="https://example.com/authorization_endpoint",
+                    client_id="client_id",
+                    client_secret="client_secret",
+                    issuer="https://example.com",
+                    token_endpoint="https://example.com/token_endpoint",
+                    user_info_endpoint="https://example.com/user_info_endpoint"
+                ),
+                type="authenticate-oidc"
+            ), LbListenerDefaultAction(
+                target_group_arn=Token.as_string(aws_lb_target_group_front_end.arn),
+                type="forward"
+            )
+            ],
+            load_balancer_arn=front_end.arn,
+            port=Token.as_number("80"),
+            protocol="HTTP"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_lb_listener_front_end.override_logical_id("front_end")
+```
+
+### Gateway Load Balancer Listener
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.lb import Lb
+from imports.aws.lb_listener import LbListener
+from imports.aws.lb_target_group import LbTargetGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = Lb(self, "example",
+            load_balancer_type="gateway",
+            name="example",
+            subnet_mapping=[LbSubnetMapping(
+                subnet_id=Token.as_string(aws_subnet_example.id)
+            )
+            ]
+        )
+        aws_lb_target_group_example = LbTargetGroup(self, "example_1",
+            health_check=LbTargetGroupHealthCheck(
+                port=Token.as_string(80),
+                protocol="HTTP"
+            ),
+            name="example",
+            port=6081,
+            protocol="GENEVE",
+            vpc_id=Token.as_string(aws_vpc_example.id)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_lb_target_group_example.override_logical_id("example")
+        aws_lb_listener_example = LbListener(self, "example_2",
+            default_action=[LbListenerDefaultAction(
+                target_group_arn=Token.as_string(aws_lb_target_group_example.id),
+                type="forward"
+            )
+            ],
+            load_balancer_arn=example.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_lb_listener_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `default_action` - (Required) Configuration block for default actions. Detailed below.
+* `load_balancer_arn` - (Required, Forces New Resource) ARN of the load balancer.
+
+The following arguments are optional:
+
+* `alpn_policy` - (Optional)  Name of the Application-Layer Protocol Negotiation (ALPN) policy. Can be set if `protocol` is `TLS`. Valid values are `HTTP1Only`, `HTTP2Only`, `HTTP2Optional`, `HTTP2Preferred`, and `None`.
+* `certificate_arn` - (Optional) ARN of the default SSL server certificate. Exactly one certificate is required if the protocol is HTTPS. For adding additional SSL certificates, see the [`aws_lb_listener_certificate` resource](/docs/providers/aws/r/lb_listener_certificate.html).
+* `port` - (Optional) Port on which the load balancer is listening. Not valid for Gateway Load Balancers.
+* `protocol` - (Optional) Protocol for connections from clients to the load balancer. For Application Load Balancers, valid values are `HTTP` and `HTTPS`, with a default of `HTTP`. For Network Load Balancers, valid values are `TCP`, `TLS`, `UDP`, and `TCP_UDP`. Not valid to use `UDP` or `TCP_UDP` if dual-stack mode is enabled. Not valid for Gateway Load Balancers.
+* `ssl_policy` - (Optional) Name of the SSL Policy for the listener. Required if `protocol` is `HTTPS` or `TLS`.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+~> **NOTE::** Please note that listeners that are attached to Application Load Balancers must use either `HTTP` or `HTTPS` protocols while listeners that are attached to Network Load Balancers must use the `TCP` protocol.
+
+### default_action
+
+The following arguments are required:
+
+* `type` - (Required) Type of routing action. Valid values are `forward`, `redirect`, `fixed-response`, `authenticate-cognito` and `authenticate-oidc`.
+
+The following arguments are optional:
+
+* `authenticate_cognito` - (Optional) Configuration block for using Amazon Cognito to authenticate users. Specify only when `type` is `authenticate-cognito`. Detailed below.
+* `authenticate_oidc` - (Optional) Configuration block for an identity provider that is compliant with OpenID Connect (OIDC). Specify only when `type` is `authenticate-oidc`. Detailed below.
+* `fixed_response` - (Optional) Information for creating an action that returns a custom HTTP response. Required if `type` is `fixed-response`.
+* `forward` - (Optional) Configuration block for creating an action that distributes requests among one or more target groups. Specify only if `type` is `forward`. If you specify both `forward` block and `target_group_arn` attribute, you can specify only one target group using `forward` and it must be the same target group specified in `target_group_arn`. Detailed below.
+* `order` - (Optional) Order for the action. This value is required for rules with multiple actions. The action with the lowest value for order is performed first. Valid values are between `1` and `50000`.
+* `redirect` - (Optional) Configuration block for creating a redirect action. Required if `type` is `redirect`. Detailed below.
+* `target_group_arn` - (Optional) ARN of the Target Group to which to route traffic. Specify only if `type` is `forward` and you want to route to a single target group. To route to one or more target groups, use a `forward` block instead.
+
+#### authenticate_cognito
+
+The following arguments are required:
+
+* `user_pool_arn` - (Required) ARN of the Cognito user pool.
+* `user_pool_client_id` - (Required) ID of the Cognito user pool client.
+* `user_pool_domain` - (Required) Domain prefix or fully-qualified domain name of the Cognito user pool.
+
+The following arguments are optional:
+
+* `authentication_request_extra_params` - (Optional) Query parameters to include in the redirect request to the authorization endpoint. Max: 10. Detailed below.
+* `on_unauthenticated_request` - (Optional) Behavior if the user is not authenticated. Valid values are `deny`, `allow` and `authenticate`.
+* `scope` - (Optional) Set of user claims to be requested from the IdP.
+* `session_cookie_name` - (Optional) Name of the cookie used to maintain session information.
+* `session_timeout` - (Optional) Maximum duration of the authentication session, in seconds.
+
+##### authentication_request_extra_params
+
+* `key` - (Required) Key of query parameter.
+* `value` - (Required) Value of query parameter.
+
+#### authenticate_oidc
+
+The following arguments are required:
+
+* `authorization_endpoint` - (Required) Authorization endpoint of the IdP.
+* `client_id` - (Required) OAuth 2.0 client identifier.
+* `client_secret` - (Required) OAuth 2.0 client secret.
+* `issuer` - (Required) OIDC issuer identifier of the IdP.
+* `token_endpoint` - (Required) Token endpoint of the IdP.
+* `user_info_endpoint` - (Required) User info endpoint of the IdP.
+
+The following arguments are optional:
+
+* `authentication_request_extra_params` - (Optional) Query parameters to include in the redirect request to the authorization endpoint. Max: 10.
+* `on_unauthenticated_request` - (Optional) Behavior if the user is not authenticated. Valid values: `deny`, `allow` and `authenticate`
+* `scope` - (Optional) Set of user claims to be requested from the IdP.
+* `session_cookie_name` - (Optional) Name of the cookie used to maintain session information.
+* `session_timeout` - (Optional) Maximum duration of the authentication session, in seconds.
+
+#### fixed_response
+
+The following arguments are required:
+
+* `content_type` - (Required) Content type. Valid values are `text/plain`, `text/css`, `text/html`, `application/javascript` and `application/json`.
+
+The following arguments are optional:
+
+* `message_body` - (Optional) Message body.
+* `status_code` - (Optional) HTTP response code. Valid values are `2XX`, `4XX`, or `5XX`.
+
+#### forward
+
+The following arguments are required:
+
+* `target_group` - (Required) Set of 1-5 target group blocks. Detailed below.
+
+The following arguments are optional:
+
+* `stickiness` - (Optional) Configuration block for target group stickiness for the rule. Detailed below.
+
+##### target_group
+
+The following arguments are required:
+
+* `arn` - (Required) ARN of the target group.
+
+The following arguments are optional:
+
+* `weight` - (Optional) Weight. The range is 0 to 999.
+
+##### stickiness
+
+The following arguments are required:
+
+* `duration` - (Required) Time period, in seconds, during which requests from a client should be routed to the same target group. The range is 1-604800 seconds (7 days).
+
+The following arguments are optional:
+
+* `enabled` - (Optional) Whether target group stickiness is enabled. Default is `false`.
+
+#### redirect
+
+~> **NOTE::** You can reuse URI components using the following reserved keywords: `#{protocol}`, `#{host}`, `#{port}`, `#{path}` (the leading "/" is removed) and `#{query}`.
+
+The following arguments are required:
+
+* `status_code` - (Required) HTTP redirect code. The redirect is either permanent (`HTTP_301`) or temporary (`HTTP_302`).
+
+The following arguments are optional:
+
+* `host` - (Optional) Hostname. This component is not percent-encoded. The hostname can contain `#{host}`. Defaults to `#{host}`.
+* `path` - (Optional) Absolute path, starting with the leading "/". This component is not percent-encoded. The path can contain #{host}, #{path}, and #{port}. Defaults to `/#{path}`.
+* `port` - (Optional) Port. Specify a value from `1` to `65535` or `#{port}`. Defaults to `#{port}`.
+* `protocol` - (Optional) Protocol. Valid values are `HTTP`, `HTTPS`, or `#{protocol}`. Defaults to `#{protocol}`.
+* `query` - (Optional) Query parameters, URL-encoded when necessary, but not percent-encoded. Do not include the leading "?". Defaults to `#{query}`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the listener (matches `id`).
+* `id` - ARN of the listener (matches `arn`).
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import listeners using their ARN. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import listeners using their ARN. For example:
+
+```console
+% terraform import aws_lb_listener.front_end arn:aws:elasticloadbalancing:us-west-2:187416307283:listener/app/front-end-alb/8e4497da625e2d8a/9ab28ade35828f96
+```
+
+<!-- cache-key: cdktf-0.18.0 input-b6c6fd51a4ec9b7cab514ce3099f9bf1c4efc96f7baaabe14176ce01751b5a09 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/lb_listener_certificate.html.markdown b/website/docs/cdktf/python/r/lb_listener_certificate.html.markdown
new file mode 100644
index 00000000000..ba3fe7838fa
--- /dev/null
+++ b/website/docs/cdktf/python/r/lb_listener_certificate.html.markdown
@@ -0,0 +1,84 @@
+---
+subcategory: "ELB (Elastic Load Balancing)"
+layout: "aws"
+page_title: "AWS: aws_lb_listener_certificate"
+description: |-
+  Provides a Load Balancer Listener Certificate resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lb_listener_certificate
+
+Provides a Load Balancer Listener Certificate resource.
+
+This resource is for additional certificates and does not replace the default certificate on the listener.
+
+~> **Note:** `aws_alb_listener_certificate` is known as `aws_lb_listener_certificate`. The functionality is identical.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.acm_certificate import AcmCertificate
+from imports.aws.lb import Lb
+from imports.aws.lb_listener import LbListener
+from imports.aws.lb_listener_certificate import LbListenerCertificate
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, defaultAction, loadBalancerArn):
+        super().__init__(scope, name)
+        example = AcmCertificate(self, "example")
+        Lb(self, "front_end")
+        aws_lb_listener_front_end = LbListener(self, "front_end_2",
+            default_action=default_action,
+            load_balancer_arn=load_balancer_arn
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_lb_listener_front_end.override_logical_id("front_end")
+        aws_lb_listener_certificate_example = LbListenerCertificate(self, "example_3",
+            certificate_arn=example.arn,
+            listener_arn=Token.as_string(aws_lb_listener_front_end.arn)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_lb_listener_certificate_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `listener_arn` - (Required, Forces New Resource) The ARN of the listener to which to attach the certificate.
+* `certificate_arn` - (Required, Forces New Resource) The ARN of the certificate to attach to the listener.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The `listener_arn` and `certificate_arn` separated by a `_`.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Listener Certificates using the listener arn and certificate arn, separated by an underscore (`_`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Listener Certificates using the listener arn and certificate arn, separated by an underscore (`_`). For example:
+
+```console
+% terraform import aws_lb_listener_certificate.example arn:aws:elasticloadbalancing:us-west-2:123456789012:listener/app/test/8e4497da625e2d8a/9ab28ade35828f96/67b3d2d36dd7c26b_arn:aws:iam::123456789012:server-certificate/tf-acc-test-6453083910015726063
+```
+
+<!-- cache-key: cdktf-0.18.0 input-010f8a2b1d22c8dc2a66a954423bfa17378f9f952397f5501786dea62742e9f7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/lb_listener_rule.html.markdown b/website/docs/cdktf/python/r/lb_listener_rule.html.markdown
new file mode 100644
index 00000000000..c5884604fc4
--- /dev/null
+++ b/website/docs/cdktf/python/r/lb_listener_rule.html.markdown
@@ -0,0 +1,338 @@
+---
+subcategory: "ELB (Elastic Load Balancing)"
+layout: "aws"
+page_title: "AWS: aws_lb_listener_rule"
+description: |-
+  Provides a Load Balancer Listener Rule resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lb_listener_rule
+
+Provides a Load Balancer Listener Rule resource.
+
+~> **Note:** `aws_alb_listener_rule` is known as `aws_lb_listener_rule`. The functionality is identical.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cognito_user_pool import CognitoUserPool
+from imports.aws.cognito_user_pool_client import CognitoUserPoolClient
+from imports.aws.cognito_user_pool_domain import CognitoUserPoolDomain
+from imports.aws.lb import Lb
+from imports.aws.lb_listener import LbListener
+from imports.aws.lb_listener_rule import LbListenerRule
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, name, name1, userPoolId, domain, userPoolId1, defaultAction, loadBalancerArn, condition, condition1):
+        super().__init__(scope, name)
+        pool = CognitoUserPool(self, "pool",
+            name=name
+        )
+        client = CognitoUserPoolClient(self, "client",
+            name=name1,
+            user_pool_id=user_pool_id
+        )
+        domain = CognitoUserPoolDomain(self, "domain",
+            domain=domain,
+            user_pool_id=user_pool_id1
+        )
+        Lb(self, "front_end")
+        aws_lb_listener_front_end = LbListener(self, "front_end_4",
+            default_action=default_action,
+            load_balancer_arn=load_balancer_arn
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_lb_listener_front_end.override_logical_id("front_end")
+        LbListenerRule(self, "admin",
+            action=[LbListenerRuleAction(
+                authenticate_cognito=LbListenerRuleActionAuthenticateCognito(
+                    user_pool_arn=pool.arn,
+                    user_pool_client_id=client.id,
+                    user_pool_domain=domain.domain
+                ),
+                type="authenticate-cognito"
+            ), LbListenerRuleAction(
+                target_group_arn=static.arn,
+                type="forward"
+            )
+            ],
+            listener_arn=Token.as_string(aws_lb_listener_front_end.arn),
+            condition=condition
+        )
+        LbListenerRule(self, "health_check",
+            action=[LbListenerRuleAction(
+                fixed_response=LbListenerRuleActionFixedResponse(
+                    content_type="text/plain",
+                    message_body="HEALTHY",
+                    status_code="200"
+                ),
+                type="fixed-response"
+            )
+            ],
+            condition=[LbListenerRuleCondition(
+                query_string=[LbListenerRuleConditionQueryString(
+                    key="health",
+                    value="check"
+                ), LbListenerRuleConditionQueryString(
+                    value="bar"
+                )
+                ]
+            )
+            ],
+            listener_arn=Token.as_string(aws_lb_listener_front_end.arn)
+        )
+        LbListenerRule(self, "host_based_routing",
+            action=[LbListenerRuleAction(
+                forward=LbListenerRuleActionForward(
+                    stickiness=LbListenerRuleActionForwardStickiness(
+                        duration=600,
+                        enabled=True
+                    ),
+                    target_group=[LbListenerRuleActionForwardTargetGroup(
+                        arn=main.arn,
+                        weight=80
+                    ), LbListenerRuleActionForwardTargetGroup(
+                        arn=canary.arn,
+                        weight=20
+                    )
+                    ]
+                ),
+                type="forward"
+            )
+            ],
+            condition=[LbListenerRuleCondition(
+                host_header=LbListenerRuleConditionHostHeader(
+                    values=["my-service.*.terraform.io"]
+                )
+            )
+            ],
+            listener_arn=Token.as_string(aws_lb_listener_front_end.arn),
+            priority=99
+        )
+        LbListenerRule(self, "host_based_weighted_routing",
+            action=[LbListenerRuleAction(
+                target_group_arn=static.arn,
+                type="forward"
+            )
+            ],
+            condition=[LbListenerRuleCondition(
+                host_header=LbListenerRuleConditionHostHeader(
+                    values=["my-service.*.terraform.io"]
+                )
+            )
+            ],
+            listener_arn=Token.as_string(aws_lb_listener_front_end.arn),
+            priority=99
+        )
+        LbListenerRule(self, "oidc",
+            action=[LbListenerRuleAction(
+                authenticate_oidc=LbListenerRuleActionAuthenticateOidc(
+                    authorization_endpoint="https://example.com/authorization_endpoint",
+                    client_id="client_id",
+                    client_secret="client_secret",
+                    issuer="https://example.com",
+                    token_endpoint="https://example.com/token_endpoint",
+                    user_info_endpoint="https://example.com/user_info_endpoint"
+                ),
+                type="authenticate-oidc"
+            ), LbListenerRuleAction(
+                target_group_arn=static.arn,
+                type="forward"
+            )
+            ],
+            listener_arn=Token.as_string(aws_lb_listener_front_end.arn),
+            condition=condition1
+        )
+        LbListenerRule(self, "redirect_http_to_https",
+            action=[LbListenerRuleAction(
+                redirect=LbListenerRuleActionRedirect(
+                    port="443",
+                    protocol="HTTPS",
+                    status_code="HTTP_301"
+                ),
+                type="redirect"
+            )
+            ],
+            condition=[LbListenerRuleCondition(
+                http_header=LbListenerRuleConditionHttpHeader(
+                    http_header_name="X-Forwarded-For",
+                    values=["192.168.1.*"]
+                )
+            )
+            ],
+            listener_arn=Token.as_string(aws_lb_listener_front_end.arn)
+        )
+        LbListenerRule(self, "static",
+            action=[LbListenerRuleAction(
+                target_group_arn=static.arn,
+                type="forward"
+            )
+            ],
+            condition=[LbListenerRuleCondition(
+                path_pattern=LbListenerRuleConditionPathPattern(
+                    values=["/static/*"]
+                )
+            ), LbListenerRuleCondition(
+                host_header=LbListenerRuleConditionHostHeader(
+                    values=["example.com"]
+                )
+            )
+            ],
+            listener_arn=Token.as_string(aws_lb_listener_front_end.arn),
+            priority=100
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `listener_arn` - (Required, Forces New Resource) The ARN of the listener to which to attach the rule.
+* `priority` - (Optional) The priority for the rule between `1` and `50000`. Leaving it unset will automatically set the rule with next available priority after currently existing highest rule. A listener can't have multiple rules with the same priority.
+* `action` - (Required) An Action block. Action blocks are documented below.
+* `condition` - (Required) A Condition block. Multiple condition blocks of different types can be set and all must be satisfied for the rule to match. Condition blocks are documented below.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Action Blocks
+
+Action Blocks (for `action`) support the following:
+
+* `type` - (Required) The type of routing action. Valid values are `forward`, `redirect`, `fixed-response`, `authenticate-cognito` and `authenticate-oidc`.
+* `target_group_arn` - (Optional) The ARN of the Target Group to which to route traffic. Specify only if `type` is `forward` and you want to route to a single target group. To route to one or more target groups, use a `forward` block instead.
+* `forward` - (Optional) Information for creating an action that distributes requests among one or more target groups. Specify only if `type` is `forward`. If you specify both `forward` block and `target_group_arn` attribute, you can specify only one target group using `forward` and it must be the same target group specified in `target_group_arn`.
+* `redirect` - (Optional) Information for creating a redirect action. Required if `type` is `redirect`.
+* `fixed_response` - (Optional) Information for creating an action that returns a custom HTTP response. Required if `type` is `fixed-response`.
+* `authenticate_cognito` - (Optional) Information for creating an authenticate action using Cognito. Required if `type` is `authenticate-cognito`.
+* `authenticate_oidc` - (Optional) Information for creating an authenticate action using OIDC. Required if `type` is `authenticate-oidc`.
+
+Forward Blocks (for `forward`) support the following:
+
+* `target_group` - (Required) One or more target groups block.
+* `stickiness` - (Optional) The target group stickiness for the rule.
+
+Target Group Blocks (for `target_group`) supports the following:
+
+* `arn` - (Required) The Amazon Resource Name (ARN) of the target group.
+* `weight` - (Optional) The weight. The range is 0 to 999.
+
+Target Group Stickiness Config Blocks (for `stickiness`) supports the following:
+
+* `enabled` - (Required) Indicates whether target group stickiness is enabled.
+* `duration` - (Optional) The time period, in seconds, during which requests from a client should be routed to the same target group. The range is 1-604800 seconds (7 days).
+
+Redirect Blocks (for `redirect`) support the following:
+
+~> **NOTE::** You can reuse URI components using the following reserved keywords: `#{protocol}`, `#{host}`, `#{port}`, `#{path}` (the leading "/" is removed) and `#{query}`.
+
+* `host` - (Optional) The hostname. This component is not percent-encoded. The hostname can contain `#{host}`. Defaults to `#{host}`.
+* `path` - (Optional) The absolute path, starting with the leading "/". This component is not percent-encoded. The path can contain #{host}, #{path}, and #{port}. Defaults to `/#{path}`.
+* `port` - (Optional) The port. Specify a value from `1` to `65535` or `#{port}`. Defaults to `#{port}`.
+* `protocol` - (Optional) The protocol. Valid values are `HTTP`, `HTTPS`, or `#{protocol}`. Defaults to `#{protocol}`.
+* `query` - (Optional) The query parameters, URL-encoded when necessary, but not percent-encoded. Do not include the leading "?". Defaults to `#{query}`.
+* `status_code` - (Required) The HTTP redirect code. The redirect is either permanent (`HTTP_301`) or temporary (`HTTP_302`).
+
+Fixed-response Blocks (for `fixed_response`) support the following:
+
+* `content_type` - (Required) The content type. Valid values are `text/plain`, `text/css`, `text/html`, `application/javascript` and `application/json`.
+* `message_body` - (Optional) The message body.
+* `status_code` - (Optional) The HTTP response code. Valid values are `2XX`, `4XX`, or `5XX`.
+
+Authenticate Cognito Blocks (for `authenticate_cognito`) supports the following:
+
+* `authentication_request_extra_params` - (Optional) The query parameters to include in the redirect request to the authorization endpoint. Max: 10.
+* `on_unauthenticated_request` - (Optional) The behavior if the user is not authenticated. Valid values: `deny`, `allow` and `authenticate`
+* `scope` - (Optional) The set of user claims to be requested from the IdP.
+* `session_cookie_name` - (Optional) The name of the cookie used to maintain session information.
+* `session_timeout` - (Optional) The maximum duration of the authentication session, in seconds.
+* `user_pool_arn` - (Required) The ARN of the Cognito user pool.
+* `user_pool_client_id` - (Required) The ID of the Cognito user pool client.
+* `user_pool_domain` - (Required) The domain prefix or fully-qualified domain name of the Cognito user pool.
+
+Authenticate OIDC Blocks (for `authenticate_oidc`) supports the following:
+
+* `authentication_request_extra_params` - (Optional) The query parameters to include in the redirect request to the authorization endpoint. Max: 10.
+* `authorization_endpoint` - (Required) The authorization endpoint of the IdP.
+* `client_id` - (Required) The OAuth 2.0 client identifier.
+* `client_secret` - (Required) The OAuth 2.0 client secret.
+* `issuer` - (Required) The OIDC issuer identifier of the IdP.
+* `on_unauthenticated_request` - (Optional) The behavior if the user is not authenticated. Valid values: `deny`, `allow` and `authenticate`
+* `scope` - (Optional) The set of user claims to be requested from the IdP.
+* `session_cookie_name` - (Optional) The name of the cookie used to maintain session information.
+* `session_timeout` - (Optional) The maximum duration of the authentication session, in seconds.
+* `token_endpoint` - (Required) The token endpoint of the IdP.
+* `user_info_endpoint` - (Required) The user info endpoint of the IdP.
+
+Authentication Request Extra Params Blocks (for `authentication_request_extra_params`) supports the following:
+
+* `key` - (Required) The key of query parameter
+* `value` - (Required) The value of query parameter
+
+### Condition Blocks
+
+One or more condition blocks can be set per rule. Most condition types can only be specified once per rule except for `http-header` and `query-string` which can be specified multiple times.
+
+Condition Blocks (for `condition`) support the following:
+
+* `host_header` - (Optional) Contains a single `values` item which is a list of host header patterns to match. The maximum size of each pattern is 128 characters. Comparison is case insensitive. Wildcard characters supported: * (matches 0 or more characters) and ? (matches exactly 1 character). Only one pattern needs to match for the condition to be satisfied.
+* `http_header` - (Optional) HTTP headers to match. [HTTP Header block](#http-header-blocks) fields documented below.
+* `http_request_method` - (Optional) Contains a single `values` item which is a list of HTTP request methods or verbs to match. Maximum size is 40 characters. Only allowed characters are A-Z, hyphen (-) and underscore (\_). Comparison is case sensitive. Wildcards are not supported. Only one needs to match for the condition to be satisfied. AWS recommends that GET and HEAD requests are routed in the same way because the response to a HEAD request may be cached.
+* `path_pattern` - (Optional) Contains a single `values` item which is a list of path patterns to match against the request URL. Maximum size of each pattern is 128 characters. Comparison is case sensitive. Wildcard characters supported: * (matches 0 or more characters) and ? (matches exactly 1 character). Only one pattern needs to match for the condition to be satisfied. Path pattern is compared only to the path of the URL, not to its query string. To compare against the query string, use a `query_string` condition.
+* `query_string` - (Optional) Query strings to match. [Query String block](#query-string-blocks) fields documented below.
+* `source_ip` - (Optional) Contains a single `values` item which is a list of source IP CIDR notations to match. You can use both IPv4 and IPv6 addresses. Wildcards are not supported. Condition is satisfied if the source IP address of the request matches one of the CIDR blocks. Condition is not satisfied by the addresses in the `X-Forwarded-For` header, use `http_header` condition instead.
+
+~> **NOTE::** Exactly one of `host_header`, `http_header`, `http_request_method`, `path_pattern`, `query_string` or `source_ip` must be set per condition.
+
+#### HTTP Header Blocks
+
+HTTP Header Blocks (for `http_header`) support the following:
+
+* `http_header_name` - (Required) Name of HTTP header to search. The maximum size is 40 characters. Comparison is case insensitive. Only RFC7240 characters are supported. Wildcards are not supported. You cannot use HTTP header condition to specify the host header, use a `host-header` condition instead.
+* `values` - (Required) List of header value patterns to match. Maximum size of each pattern is 128 characters. Comparison is case insensitive. Wildcard characters supported: * (matches 0 or more characters) and ? (matches exactly 1 character). If the same header appears multiple times in the request they will be searched in order until a match is found. Only one pattern needs to match for the condition to be satisfied. To require that all of the strings are a match, create one condition block per string.
+
+#### Query String Blocks
+
+Query String Blocks (for `query_string`) support the following:
+
+* `values` - (Required) Query string pairs or values to match. Query String Value blocks documented below. Multiple `values` blocks can be specified, see example above. Maximum size of each string is 128 characters. Comparison is case insensitive. Wildcard characters supported: * (matches 0 or more characters) and ? (matches exactly 1 character). To search for a literal '\*' or '?' character in a query string, escape the character with a backslash (\\). Only one pair needs to match for the condition to be satisfied.
+
+Query String Value Blocks (for `query_string.values`) support the following:
+
+* `key` - (Optional) Query string key pattern to match.
+* `value` - (Required) Query string value pattern to match.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ARN of the rule (matches `arn`)
+* `arn` - The ARN of the rule (matches `id`)
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import rules using their ARN. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import rules using their ARN. For example:
+
+```console
+% terraform import aws_lb_listener_rule.front_end arn:aws:elasticloadbalancing:us-west-2:187416307283:listener-rule/app/test/8e4497da625e2d8a/9ab28ade35828f96/67b3d2d36dd7c26b
+```
+
+<!-- cache-key: cdktf-0.18.0 input-12e9f21426e9efd89a154c6e8445b8894b184d7651322f0592349d28d0132dea -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/lb_ssl_negotiation_policy.html.markdown b/website/docs/cdktf/python/r/lb_ssl_negotiation_policy.html.markdown
new file mode 100644
index 00000000000..8a9e4442829
--- /dev/null
+++ b/website/docs/cdktf/python/r/lb_ssl_negotiation_policy.html.markdown
@@ -0,0 +1,101 @@
+---
+subcategory: "ELB Classic"
+layout: "aws"
+page_title: "AWS: aws_lb_ssl_negotiation_policy"
+description: |-
+  Provides a load balancer SSL negotiation policy, which allows an ELB to control which ciphers and protocols are supported during SSL negotiations between a client and a load balancer.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lb_ssl_negotiation_policy
+
+Provides a load balancer SSL negotiation policy, which allows an ELB to control the ciphers and protocols that are supported during SSL negotiations between a client and a load balancer.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.elb import Elb
+from imports.aws.lb_ssl_negotiation_policy import LbSslNegotiationPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        lb = Elb(self, "lb",
+            availability_zones=["us-east-1a"],
+            listener=[ElbListener(
+                instance_port=8000,
+                instance_protocol="https",
+                lb_port=443,
+                lb_protocol="https",
+                ssl_certificate_id="arn:aws:iam::123456789012:server-certificate/certName"
+            )
+            ],
+            name="test-lb"
+        )
+        LbSslNegotiationPolicy(self, "foo",
+            attribute=[LbSslNegotiationPolicyAttribute(
+                name="Protocol-TLSv1",
+                value="false"
+            ), LbSslNegotiationPolicyAttribute(
+                name="Protocol-TLSv1.1",
+                value="false"
+            ), LbSslNegotiationPolicyAttribute(
+                name="Protocol-TLSv1.2",
+                value="true"
+            ), LbSslNegotiationPolicyAttribute(
+                name="Server-Defined-Cipher-Order",
+                value="true"
+            ), LbSslNegotiationPolicyAttribute(
+                name="ECDHE-RSA-AES128-GCM-SHA256",
+                value="true"
+            ), LbSslNegotiationPolicyAttribute(
+                name="AES128-GCM-SHA256",
+                value="true"
+            ), LbSslNegotiationPolicyAttribute(
+                name="EDH-RSA-DES-CBC3-SHA",
+                value="false"
+            )
+            ],
+            lb_port=443,
+            load_balancer=lb.id,
+            name="foo-policy"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the SSL negotiation policy.
+* `load_balancer` - (Required) The load balancer to which the policy
+  should be attached.
+* `lb_port` - (Required) The load balancer port to which the policy
+  should be applied. This must be an active listener on the load
+balancer.
+* `attribute` - (Optional) An SSL Negotiation policy attribute. Each has two properties:
+    * `name` - The name of the attribute
+    * `value` - The value of the attribute
+* `triggers` - (Optional) Map of arbitrary keys and values that, when changed, will trigger a redeployment. To force a redeployment without changing these keys/values, use the [`terraform taint` command](https://www.terraform.io/docs/commands/taint.html).
+
+To set your attributes, please see the [AWS Elastic Load Balancing Developer Guide](http://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/elb-security-policy-table.html) for a listing of the supported SSL protocols, SSL options, and SSL ciphers.
+
+~> **NOTE:** The AWS documentation references Server Order Preference, which the AWS Elastic Load Balancing API refers to as `Server-Defined-Cipher-Order`. If you wish to set Server Order Preference, use this value instead.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the policy.
+* `name` - The name of the stickiness policy.
+* `load_balancer` - The load balancer to which the policy is attached.
+* `lb_port` - The load balancer port to which the policy is applied.
+* `attribute` - The SSL Negotiation policy attributes.
+
+<!-- cache-key: cdktf-0.18.0 input-594ecbf0ae1086664299c0bd8eab81534e805963be3a73733449f7041f731403 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/lb_target_group.html.markdown b/website/docs/cdktf/python/r/lb_target_group.html.markdown
new file mode 100644
index 00000000000..66846caab4d
--- /dev/null
+++ b/website/docs/cdktf/python/r/lb_target_group.html.markdown
@@ -0,0 +1,240 @@
+---
+subcategory: "ELB (Elastic Load Balancing)"
+layout: "aws"
+page_title: "AWS: aws_lb_target_group"
+description: |-
+  Provides a Target Group resource for use with Load Balancers.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lb_target_group
+
+Provides a Target Group resource for use with Load Balancer resources.
+
+~> **Note:** `aws_alb_target_group` is known as `aws_lb_target_group`. The functionality is identical.
+
+## Example Usage
+
+### Instance Target Group
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.lb_target_group import LbTargetGroup
+from imports.aws.vpc import Vpc
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        main = Vpc(self, "main",
+            cidr_block="10.0.0.0/16"
+        )
+        LbTargetGroup(self, "test",
+            name="tf-example-lb-tg",
+            port=80,
+            protocol="HTTP",
+            vpc_id=main.id
+        )
+```
+
+### IP Target Group
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.lb_target_group import LbTargetGroup
+from imports.aws.vpc import Vpc
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        main = Vpc(self, "main",
+            cidr_block="10.0.0.0/16"
+        )
+        LbTargetGroup(self, "ip-example",
+            name="tf-example-lb-tg",
+            port=80,
+            protocol="HTTP",
+            target_type="ip",
+            vpc_id=main.id
+        )
+```
+
+### Lambda Target Group
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.lb_target_group import LbTargetGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        LbTargetGroup(self, "lambda-example",
+            name="tf-example-lb-tg",
+            target_type="lambda"
+        )
+```
+
+### ALB Target Group
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.lb_target_group import LbTargetGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        LbTargetGroup(self, "alb-example",
+            name="tf-example-lb-alb-tg",
+            port=80,
+            protocol="TCP",
+            target_type="alb",
+            vpc_id=main.id
+        )
+```
+
+### Target group with unhealthy connection termination disabled
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.lb_target_group import LbTargetGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        LbTargetGroup(self, "tcp-example",
+            name="tf-example-lb-nlb-tg",
+            port=25,
+            protocol="TCP",
+            target_health_state=[LbTargetGroupTargetHealthState(
+                enable_unhealthy_connection_termination=False
+            )
+            ],
+            vpc_id=main.id
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `connection_termination` - (Optional) Whether to terminate connections at the end of the deregistration timeout on Network Load Balancers. See [doc](https://docs.aws.amazon.com/elasticloadbalancing/latest/network/load-balancer-target-groups.html#deregistration-delay) for more information. Default is `false`.
+* `deregistration_delay` - (Optional) Amount time for Elastic Load Balancing to wait before changing the state of a deregistering target from draining to unused. The range is 0-3600 seconds. The default value is 300 seconds.
+* `health_check` - (Optional, Maximum of 1) Health Check configuration block. Detailed below.
+* `lambda_multi_value_headers_enabled` - (Optional) Whether the request and response headers exchanged between the load balancer and the Lambda function include arrays of values or strings. Only applies when `target_type` is `lambda`. Default is `false`.
+* `load_balancing_algorithm_type` - (Optional) Determines how the load balancer selects targets when routing requests. Only applicable for Application Load Balancer Target Groups. The value is `round_robin` or `least_outstanding_requests`. The default is `round_robin`.
+* `load_balancing_cross_zone_enabled` - (Optional) Indicates whether cross zone load balancing is enabled. The value is `"true"`, `"false"` or `"use_load_balancer_configuration"`. The default is `"use_load_balancer_configuration"`.
+* `name_prefix` - (Optional, Forces new resource) Creates a unique name beginning with the specified prefix. Conflicts with `name`. Cannot be longer than 6 characters.
+* `name` - (Optional, Forces new resource) Name of the target group. If omitted, Terraform will assign a random, unique name. This name must be unique per region per account, can have a maximum of 32 characters, must contain only alphanumeric characters or hyphens, and must not begin or end with a hyphen.
+* `port` - (May be required, Forces new resource) Port on which targets receive traffic, unless overridden when registering a specific target. Required when `target_type` is `instance`, `ip` or `alb`. Does not apply when `target_type` is `lambda`.
+* `preserve_client_ip` - (Optional) Whether client IP preservation is enabled. See [doc](https://docs.aws.amazon.com/elasticloadbalancing/latest/network/load-balancer-target-groups.html#client-ip-preservation) for more information.
+* `protocol_version` - (Optional, Forces new resource) Only applicable when `protocol` is `HTTP` or `HTTPS`. The protocol version. Specify `GRPC` to send requests to targets using gRPC. Specify `HTTP2` to send requests to targets using HTTP/2. The default is `HTTP1`, which sends requests to targets using HTTP/1.1
+* `protocol` - (May be required, Forces new resource) Protocol to use for routing traffic to the targets. Should be one of `GENEVE`, `HTTP`, `HTTPS`, `TCP`, `TCP_UDP`, `TLS`, or `UDP`. Required when `target_type` is `instance`, `ip` or `alb`. Does not apply when `target_type` is `lambda`.
+* `proxy_protocol_v2` - (Optional) Whether to enable support for proxy protocol v2 on Network Load Balancers. See [doc](https://docs.aws.amazon.com/elasticloadbalancing/latest/network/load-balancer-target-groups.html#proxy-protocol) for more information. Default is `false`.
+* `slow_start` - (Optional) Amount time for targets to warm up before the load balancer sends them a full share of requests. The range is 30-900 seconds or 0 to disable. The default value is 0 seconds.
+* `stickiness` - (Optional, Maximum of 1) Stickiness configuration block. Detailed below.
+* `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `target_failover` - (Optional) Target failover block. Only applicable for Gateway Load Balancer target groups. See [target_failover](#target_failover) for more information.
+* `target_health_state` - (Optional) Target health state block. Only applicable for Network Load Balancer target groups when `protocol` is `TCP` or `TLS`. See [target_health_state](#target_health_state) for more information.
+* `target_type` - (May be required, Forces new resource) Type of target that you must specify when registering targets with this target group. See [doc](https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_CreateTargetGroup.html) for supported values. The default is `instance`.
+
+  Note that you can't specify targets for a target group using both instance IDs and IP addresses.
+
+  If the target type is `ip`, specify IP addresses from the subnets of the virtual private cloud (VPC) for the target group, the RFC 1918 range (10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16), and the RFC 6598 range (100.64.0.0/10). You can't specify publicly routable IP addresses.
+
+  Network Load Balancers do not support the `lambda` target type.
+
+  Application Load Balancers do not support the `alb` target type.
+* `ip_address_type` (Optional, forces new resource) The type of IP addresses used by the target group, only supported when target type is set to `ip`. Possible values are `ipv4` or `ipv6`.
+* `vpc_id` - (Optional, Forces new resource) Identifier of the VPC in which to create the target group. Required when `target_type` is `instance`, `ip` or `alb`. Does not apply when `target_type` is `lambda`.
+
+### health_check
+
+~> **Note:** The Health Check parameters you can set vary by the `protocol` of the Target Group. Many parameters cannot be set to custom values for `network` load balancers at this time. See http://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_CreateTargetGroup.html for a complete reference. Keep in mind, that health checks produce actual requests to the backend. The underlying function is invoked when `target_type` is set to `lambda`.
+
+* `enabled` - (Optional) Whether health checks are enabled. Defaults to `true`.
+* `healthy_threshold` - (Optional)  Number of consecutive health check successes required before considering a target healthy. The range is 2-10. Defaults to 3.
+* `interval` - (Optional) Approximate amount of time, in seconds, between health checks of an individual target. The range is 5-300. For `lambda` target groups, it needs to be greater than the timeout of the underlying `lambda`. Defaults to 30.
+* `matcher` (May be required) Response codes to use when checking for a healthy responses from a target. You can specify multiple values (for example, "200,202" for HTTP(s) or "0,12" for GRPC) or a range of values (for example, "200-299" or "0-99"). Required for HTTP/HTTPS/GRPC ALB. Only applies to Application Load Balancers (i.e., HTTP/HTTPS/GRPC) not Network Load Balancers (i.e., TCP).
+* `path` - (May be required) Destination for the health check request. Required for HTTP/HTTPS ALB and HTTP NLB. Only applies to HTTP/HTTPS.
+* `port` - (Optional) The port the load balancer uses when performing health checks on targets. Default is traffic-port.
+* `protocol` - (Optional) Protocol the load balancer uses when performing health checks on targets. Must be either `TCP`, `HTTP`, or `HTTPS`. The TCP protocol is not supported for health checks if the protocol of the target group is HTTP or HTTPS. Defaults to HTTP.
+* `timeout` - (optional) Amount of time, in seconds, during which no response from a target means a failed health check. The range is 2–120 seconds. For target groups with a protocol of HTTP, the default is 6 seconds. For target groups with a protocol of TCP, TLS or HTTPS, the default is 10 seconds. For target groups with a protocol of GENEVE, the default is 5 seconds. If the target type is lambda, the default is 30 seconds.
+* `unhealthy_threshold` - (Optional) Number of consecutive health check failures required before considering a target unhealthy. The range is 2-10. Defaults to 3.
+
+### stickiness
+
+~> **NOTE:** Currently, an NLB (i.e., protocol of `HTTP` or `HTTPS`) can have an invalid `stickiness` block with `type` set to `lb_cookie` as long as `enabled` is set to `false`. However, please update your configurations to avoid errors in a future version of the provider: either remove the invalid `stickiness` block or set the `type` to `source_ip`.
+
+* `cookie_duration` - (Optional) Only used when the type is `lb_cookie`. The time period, in seconds, during which requests from a client should be routed to the same target. After this time period expires, the load balancer-generated cookie is considered stale. The range is 1 second to 1 week (604800 seconds). The default value is 1 day (86400 seconds).
+* `cookie_name` - (Optional) Name of the application based cookie. AWSALB, AWSALBAPP, and AWSALBTG prefixes are reserved and cannot be used. Only needed when type is `app_cookie`.
+* `enabled` - (Optional) Boolean to enable / disable `stickiness`. Default is `true`.
+* `type` - (Required) The type of sticky sessions. The only current possible values are `lb_cookie`, `app_cookie` for ALBs, `source_ip` for NLBs, and `source_ip_dest_ip`, `source_ip_dest_ip_proto` for GWLBs.
+
+### target_failover
+
+~> **NOTE:** This block is only applicable for a Gateway Load Balancer (GWLB). The two attributes `on_deregistration` and `on_unhealthy` cannot be set independently. The value you set for both attributes must be the same.
+
+* `on_deregistration` - (Optional) Indicates how the GWLB handles existing flows when a target is deregistered. Possible values are `rebalance` and `no_rebalance`. Must match the attribute value set for `on_unhealthy`. Default: `no_rebalance`.
+* `on_unhealthy` - Indicates how the GWLB handles existing flows when a target is unhealthy. Possible values are `rebalance` and `no_rebalance`. Must match the attribute value set for `on_deregistration`. Default: `no_rebalance`.
+
+### target_health_state
+
+~> **NOTE:** This block is only valid for a Network Load Balancer (NLB) target group when `protocol` is `TCP` or `TLS`.
+
+* `enable_unhealthy_connection_termination` - (Optional) Indicates whether the load balancer terminates connections to unhealthy targets. Possible values are `true` or `false`. Default: `true`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn_suffix` - ARN suffix for use with CloudWatch Metrics.
+* `arn` - ARN of the Target Group (matches `id`).
+* `id` - ARN of the Target Group (matches `arn`).
+* `name` - Name of the Target Group.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Target Groups using their ARN. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Target Groups using their ARN. For example:
+
+```console
+% terraform import aws_lb_target_group.app_front_end arn:aws:elasticloadbalancing:us-west-2:187416307283:targetgroup/app-front-end/20cfe21448b66314
+```
+
+<!-- cache-key: cdktf-0.18.0 input-3eb6a0b53cb6c1b5567c421e59435e530f84dc8964724aea7f35f11efb516394 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/lb_target_group_attachment.html.markdown b/website/docs/cdktf/python/r/lb_target_group_attachment.html.markdown
new file mode 100644
index 00000000000..b29aafd1c8e
--- /dev/null
+++ b/website/docs/cdktf/python/r/lb_target_group_attachment.html.markdown
@@ -0,0 +1,158 @@
+---
+subcategory: "ELB (Elastic Load Balancing)"
+layout: "aws"
+page_title: "AWS: aws_lb_target_group_attachment"
+description: |-
+  Provides the ability to register instances and containers with a LB
+  target group
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lb_target_group_attachment
+
+Provides the ability to register instances and containers with an Application Load Balancer (ALB) or Network Load Balancer (NLB) target group. For attaching resources with Elastic Load Balancer (ELB), see the [`aws_elb_attachment` resource](/docs/providers/aws/r/elb_attachment.html).
+
+~> **Note:** `aws_alb_target_group_attachment` is known as `aws_lb_target_group_attachment`. The functionality is identical.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.instance import Instance
+from imports.aws.lb_target_group import LbTargetGroup
+from imports.aws.lb_target_group_attachment import LbTargetGroupAttachment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        test = Instance(self, "test")
+        aws_lb_target_group_test = LbTargetGroup(self, "test_1")
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_lb_target_group_test.override_logical_id("test")
+        aws_lb_target_group_attachment_test = LbTargetGroupAttachment(self, "test_2",
+            port=80,
+            target_group_arn=Token.as_string(aws_lb_target_group_test.arn),
+            target_id=test.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_lb_target_group_attachment_test.override_logical_id("test")
+```
+
+### Lambda Target
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.lambda_function import LambdaFunction
+from imports.aws.lambda_permission import LambdaPermission
+from imports.aws.lb_target_group import LbTargetGroup
+from imports.aws.lb_target_group_attachment import LbTargetGroupAttachment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, functionName, role):
+        super().__init__(scope, name)
+        test = LambdaFunction(self, "test",
+            function_name=function_name,
+            role=role
+        )
+        aws_lb_target_group_test = LbTargetGroup(self, "test_1",
+            name="test",
+            target_type="lambda"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_lb_target_group_test.override_logical_id("test")
+        with_lb = LambdaPermission(self, "with_lb",
+            action="lambda:InvokeFunction",
+            function_name=test.function_name,
+            principal="elasticloadbalancing.amazonaws.com",
+            source_arn=Token.as_string(aws_lb_target_group_test.arn),
+            statement_id="AllowExecutionFromlb"
+        )
+        aws_lb_target_group_attachment_test = LbTargetGroupAttachment(self, "test_3",
+            depends_on=[with_lb],
+            target_group_arn=Token.as_string(aws_lb_target_group_test.arn),
+            target_id=test.arn
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_lb_target_group_attachment_test.override_logical_id("test")
+```
+
+### Registering Multiple Targets
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformCount, TerraformIterator, Fn, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.instance import Instance
+from imports.aws.lb_target_group import LbTargetGroup
+from imports.aws.lb_target_group_attachment import LbTargetGroupAttachment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        # In most cases loops should be handled in the programming language context and
+        #     not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+        #     you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+        #     you need to keep this like it is.
+        example_count = TerraformCount.of(Token.as_number("3"))
+        example = Instance(self, "example",
+            count=example_count
+        )
+        aws_lb_target_group_example = LbTargetGroup(self, "example_1")
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_lb_target_group_example.override_logical_id("example")
+        # In most cases loops should be handled in the programming language context and
+        #     not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+        #     you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+        #     you need to keep this like it is.
+        example_for_each_iterator = TerraformIterator.from_list(
+            Token.as_any("${{ for k, v in ${" + example.fqn + "} : v.id => v}}"))
+        aws_lb_target_group_attachment_example = LbTargetGroupAttachment(self, "example_2",
+            port=80,
+            target_group_arn=Token.as_string(aws_lb_target_group_example.arn),
+            target_id=Token.as_string(
+                Fn.lookup_nested(example_for_each_iterator.value, ["id"])),
+            for_each=example_for_each_iterator
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_lb_target_group_attachment_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `target_group_arn` - (Required) The ARN of the target group with which to register targets.
+* `target_id` (Required) The ID of the target. This is the Instance ID for an instance, or the container ID for an ECS container. If the target type is `ip`, specify an IP address. If the target type is `lambda`, specify the Lambda function ARN. If the target type is `alb`, specify the ALB ARN.
+
+The following arguments are optional:
+
+* `availability_zone` - (Optional) The Availability Zone where the IP address of the target is to be registered. If the private IP address is outside of the VPC scope, this value must be set to `all`.
+* `port` - (Optional) The port on which targets receive traffic.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - A unique identifier for the attachment.
+
+## Import
+
+You cannot import Target Group Attachments.
+
+<!-- cache-key: cdktf-0.18.0 input-6a9d27eafb93acb313975b710f7a1fcae6eb952e788b12cf102506b713f35b5d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/lex_bot.html.markdown b/website/docs/cdktf/python/r/lex_bot.html.markdown
new file mode 100644
index 00000000000..43843ee5d8c
--- /dev/null
+++ b/website/docs/cdktf/python/r/lex_bot.html.markdown
@@ -0,0 +1,165 @@
+---
+subcategory: "Lex Model Building"
+layout: "aws"
+page_title: "AWS: aws_lex_bot"
+description: |-
+  Provides an Amazon Lex bot resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lex_bot
+
+Provides an Amazon Lex Bot resource. For more information see
+[Amazon Lex: How It Works](https://docs.aws.amazon.com/lex/latest/dg/how-it-works.html)
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.lex_bot import LexBot
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        LexBot(self, "order_flowers_bot",
+            abort_statement=LexBotAbortStatement(
+                message=[LexBotAbortStatementMessage(
+                    content="Sorry, I am not able to assist at this time",
+                    content_type="PlainText"
+                )
+                ]
+            ),
+            child_directed=False,
+            clarification_prompt=LexBotClarificationPrompt(
+                max_attempts=2,
+                message=[LexBotClarificationPromptMessage(
+                    content="I didn't understand you, what would you like to do?",
+                    content_type="PlainText"
+                )
+                ]
+            ),
+            create_version=False,
+            description="Bot to order flowers on the behalf of a user",
+            idle_session_ttl_in_seconds=600,
+            intent=[LexBotIntent(
+                intent_name="OrderFlowers",
+                intent_version="1"
+            )
+            ],
+            locale="en-US",
+            name="OrderFlowers",
+            process_behavior="BUILD",
+            voice_id="Salli"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `abort_statement` - (Required) The message that Amazon Lex uses to abort a conversation. Attributes are documented under [statement](#statement).
+* `child_directed` - (Required) By specifying true, you confirm that your use of Amazon Lex is related to a website, program, or other application that is directed or targeted, in whole or in part, to children under age 13 and subject to COPPA. For more information see the [Amazon Lex FAQ](https://aws.amazon.com/lex/faqs#data-security) and the [Amazon Lex PutBot API Docs](https://docs.aws.amazon.com/lex/latest/dg/API_PutBot.html#lex-PutBot-request-childDirected).
+* `clarification_prompt` - (Required) The message that Amazon Lex uses when it doesn't understand the user's request. Attributes are documented under [prompt](#prompt).
+* `create_version` - (Optional) Determines if a new bot version is created when the initial resource is created and on each update. Defaults to `false`.
+* `description` - (Optional) A description of the bot. Must be less than or equal to 200 characters in length.
+* `detect_sentiment` - (Optional) When set to true user utterances are sent to Amazon Comprehend for sentiment analysis. If you don't specify detectSentiment, the default is `false`.
+* `enable_model_improvements` - (Optional) Set to `true` to enable access to natural language understanding improvements. When you set the `enable_model_improvements` parameter to true you can use the `nlu_intent_confidence_threshold` parameter to configure confidence scores. For more information, see [Confidence Scores](https://docs.aws.amazon.com/lex/latest/dg/confidence-scores.html). You can only set the `enable_model_improvements` parameter in certain Regions. If you set the parameter to true, your bot has access to accuracy improvements. For more information see the [Amazon Lex Bot PutBot API Docs](https://docs.aws.amazon.com/lex/latest/dg/API_PutBot.html#lex-PutBot-request-enableModelImprovements).
+* `idle_session_ttl_in_seconds` - (Optional) The maximum time in seconds that Amazon Lex retains the data gathered in a conversation. Default is `300`. Must be a number between 60 and 86400 (inclusive).
+* `locale` - (Optional) Specifies the target locale for the bot. Any intent used in the bot must be compatible with the locale of the bot. For available locales, see [Amazon Lex Bot PutBot API Docs](https://docs.aws.amazon.com/lex/latest/dg/API_PutBot.html#lex-PutBot-request-locale). Default is `en-US`.
+* `intent` - (Required) A set of Intent objects. Each intent represents a command that a user can express. Attributes are documented under [intent](#intent). Can have up to 250 Intent objects.
+* `name` - (Required) The name of the bot that you want to create, case sensitive. Must be between 2 and 50 characters in length.
+* `nlu_intent_confidence_threshold` - (Optional) Determines the threshold where Amazon Lex will insert the AMAZON.FallbackIntent, AMAZON.KendraSearchIntent, or both when returning alternative intents in a PostContent or PostText response. AMAZON.FallbackIntent and AMAZON.KendraSearchIntent are only inserted if they are configured for the bot. For more information see [Amazon Lex Bot PutBot API Docs](https://docs.aws.amazon.com/lex/latest/dg/API_PutBot.html#lex-PutBot-request-nluIntentConfidenceThreshold) This value requires `enable_model_improvements` to be set to `true` and the default is `0`. Must be a float between 0 and 1.
+* `process_behavior` - (Optional) If you set the `process_behavior` element to `BUILD`, Amazon Lex builds the bot so that it can be run. If you set the element to `SAVE` Amazon Lex saves the bot, but doesn't build it. Default is `SAVE`.
+* `voice_id` - (Optional) The Amazon Polly voice ID that you want Amazon Lex to use for voice interactions with the user. The locale configured for the voice must match the locale of the bot. For more information, see [Available Voices](http://docs.aws.amazon.com/polly/latest/dg/voicelist.html) in the Amazon Polly Developer Guide.
+
+### intent
+
+Identifies the specific version of an intent.
+
+* `intent_name` - (Required) The name of the intent. Must be less than or equal to 100 characters in length.
+* `intent_version` - (Required) The version of the intent. Must be less than or equal to 64 characters in length.
+
+### message
+
+The message object that provides the message text and its type.
+
+* `content` - (Required) The text of the message.
+* `content_type` - (Required) The content type of the message string.
+* `group_number` - (Optional) Identifies the message group that the message belongs to. When a group
+is assigned to a message, Amazon Lex returns one message from each group in the response.
+
+### prompt
+
+Obtains information from the user. To define a prompt, provide one or more messages and specify the
+number of attempts to get information from the user. If you provide more than one message, Amazon
+Lex chooses one of the messages to use to prompt the user.
+
+* `max_attempts` - (Required) The number of times to prompt the user for information.
+* `message` - (Required) A set of messages, each of which provides a message string and its type.
+You can specify the message string in plain text or in Speech Synthesis Markup Language (SSML).
+Attributes are documented under [message](#message).
+* `response_card` - (Optional) The response card. Amazon Lex will substitute session attributes and
+slot values into the response card. For more information, see
+[Example: Using a Response Card](https://docs.aws.amazon.com/lex/latest/dg/ex-resp-card.html).
+
+### statement
+
+A statement is a map with a set of message maps and an optional response card string. Messages
+convey information to the user. At runtime, Amazon Lex selects the message to convey.
+
+* `message` - (Required) A set of messages, each of which provides a message string and its type. You
+can specify the message string in plain text or in Speech Synthesis Markup Language (SSML). Attributes
+are documented under [message](#message).
+* `response_card` - (Optional) The response card. Amazon Lex will substitute session attributes and
+slot values into the response card. For more information, see
+[Example: Using a Response Card](https://docs.aws.amazon.com/lex/latest/dg/ex-resp-card.html).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `5m`)
+* `update` - (Default `5m`)
+* `delete` - (Default `5m`)
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `checksum` - Checksum identifying the version of the bot that was created. The checksum is not
+included as an argument because the resource will add it automatically when updating the bot.
+* `created_date` - The date when the bot version was created.
+* `failure_reason` - If status is FAILED, Amazon Lex provides the reason that it failed to build the bot.
+* `last_updated_date` - The date when the $LATEST version of this bot was updated.
+* `status` - When you send a request to create or update a bot, Amazon Lex sets the status response
+element to BUILDING. After Amazon Lex builds the bot, it sets status to READY. If Amazon Lex can't
+build the bot, it sets status to FAILED. Amazon Lex returns the reason for the failure in the
+failure_reason response element.
+* `version` - The version of the bot.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import bots using their name. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import bots using their name. For example:
+
+```console
+% terraform import aws_lex_bot.order_flowers_bot OrderFlowers
+```
+
+<!-- cache-key: cdktf-0.18.0 input-e97de4060b2ca18f867fded9294c619effbd503e7c58dacacd804ae26ee28522 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/lex_bot_alias.html.markdown b/website/docs/cdktf/python/r/lex_bot_alias.html.markdown
new file mode 100644
index 00000000000..38bb5f0bf13
--- /dev/null
+++ b/website/docs/cdktf/python/r/lex_bot_alias.html.markdown
@@ -0,0 +1,101 @@
+---
+subcategory: "Lex Model Building"
+layout: "aws"
+page_title: "AWS: aws_lex_bot_alias"
+description: |-
+  Provides an Amazon Lex Bot Alias resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lex_bot_alias
+
+Provides an Amazon Lex Bot Alias resource. For more information see
+[Amazon Lex: How It Works](https://docs.aws.amazon.com/lex/latest/dg/how-it-works.html)
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.lex_bot_alias import LexBotAlias
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        LexBotAlias(self, "order_flowers_prod",
+            bot_name="OrderFlowers",
+            bot_version="1",
+            description="Production Version of the OrderFlowers Bot.",
+            name="OrderFlowersProd"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `bot_name` - (Required) The name of the bot.
+* `bot_version` - (Required) The name of the bot.
+* `conversation_logs` - (Optional) The settings that determine how Amazon Lex uses conversation logs for the alias. Attributes are documented under [conversation_logs](#conversation_logs).
+* `description` - (Optional) A description of the alias. Must be less than or equal to 200 characters in length.
+* `name` - (Required) The name of the alias. The name is not case sensitive. Must be less than or equal to 100 characters in length.
+
+### conversation_logs
+
+Contains information about conversation log settings.
+
+* `iam_role_arn` - (Required) The Amazon Resource Name (ARN) of the IAM role used to write your logs to CloudWatch Logs or an S3 bucket. Must be between 20 and 2048 characters in length.
+* `log_settings` - (Optional) The settings for your conversation logs. You can log text, audio, or both. Attributes are documented under [log_settings](#log_settings).
+
+### log_settings
+
+The settings for conversation logs.
+
+* `destination` - (Required) The destination where logs are delivered. Options are `CLOUDWATCH_LOGS` or `S3`.
+* `kms_key_arn` - (Optional) The Amazon Resource Name (ARN) of the key used to encrypt audio logs in an S3 bucket. This can only be specified when `destination` is set to `S3`. Must be between 20 and 2048 characters in length.
+* `log_type` - (Required) The type of logging that is enabled. Options are `AUDIO` or `TEXT`.
+* `resource_arn` - (Required) The Amazon Resource Name (ARN) of the CloudWatch Logs log group or S3 bucket where the logs are delivered. Must be less than or equal to 2048 characters in length.
+* `resource_prefix` - (Computed) The prefix of the S3 object key for `AUDIO` logs or the log stream name for `TEXT` logs.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the bot alias.
+* `checksum` - Checksum of the bot alias.
+* `created_date` - The date that the bot alias was created.
+* `last_updated_date` - The date that the bot alias was updated. When you create a resource, the creation date and the last updated date are the same.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `1m`)
+* `update` - (Default `1m`)
+* `delete` - (Default `5m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import bot aliases using an ID with the format `bot_name:bot_alias_name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import bot aliases using an ID with the format `bot_name:bot_alias_name`. For example:
+
+```console
+% terraform import aws_lex_bot_alias.order_flowers_prod OrderFlowers:OrderFlowersProd
+```
+
+<!-- cache-key: cdktf-0.18.0 input-45b5fa895e86b52a4a0265d1cd0006d748a86ae86a7462e4c4c8ab42d16123fc -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/lex_intent.html.markdown b/website/docs/cdktf/python/r/lex_intent.html.markdown
new file mode 100644
index 00000000000..1abe9b5b5f3
--- /dev/null
+++ b/website/docs/cdktf/python/r/lex_intent.html.markdown
@@ -0,0 +1,270 @@
+---
+subcategory: "Lex Model Building"
+layout: "aws"
+page_title: "AWS: aws_lex_intent"
+description: |-
+  Provides an Amazon Lex intent resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lex_intent
+
+Provides an Amazon Lex Intent resource. For more information see
+[Amazon Lex: How It Works](https://docs.aws.amazon.com/lex/latest/dg/how-it-works.html)
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.lex_intent import LexIntent
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        LexIntent(self, "order_flowers_intent",
+            confirmation_prompt=LexIntentConfirmationPrompt(
+                max_attempts=2,
+                message=[LexIntentConfirmationPromptMessage(
+                    content="Okay, your {FlowerType} will be ready for pickup by {PickupTime} on {PickupDate}.  Does this sound okay?",
+                    content_type="PlainText"
+                )
+                ]
+            ),
+            create_version=False,
+            description="Intent to order a bouquet of flowers for pick up",
+            fulfillment_activity=LexIntentFulfillmentActivity(
+                type="ReturnIntent"
+            ),
+            name="OrderFlowers",
+            rejection_statement=LexIntentRejectionStatement(
+                message=[LexIntentRejectionStatementMessage(
+                    content="Okay, I will not place your order.",
+                    content_type="PlainText"
+                )
+                ]
+            ),
+            sample_utterances=["I would like to order some flowers", "I would like to pick up flowers"
+            ],
+            slot=[LexIntentSlot(
+                description="The type of flowers to pick up",
+                name="FlowerType",
+                priority=1,
+                sample_utterances=["I would like to order {FlowerType}"],
+                slot_constraint="Required",
+                slot_type="FlowerTypes",
+                slot_type_version="$$LATEST",
+                value_elicitation_prompt=LexIntentSlotValueElicitationPrompt(
+                    max_attempts=2,
+                    message=[LexIntentSlotValueElicitationPromptMessage(
+                        content="What type of flowers would you like to order?",
+                        content_type="PlainText"
+                    )
+                    ]
+                )
+            ), LexIntentSlot(
+                description="The date to pick up the flowers",
+                name="PickupDate",
+                priority=2,
+                sample_utterances=["I would like to order {FlowerType}"],
+                slot_constraint="Required",
+                slot_type="AMAZON.DATE",
+                slot_type_version="$$LATEST",
+                value_elicitation_prompt=LexIntentSlotValueElicitationPrompt(
+                    max_attempts=2,
+                    message=[LexIntentSlotValueElicitationPromptMessage(
+                        content="What day do you want the {FlowerType} to be picked up?",
+                        content_type="PlainText"
+                    )
+                    ]
+                )
+            ), LexIntentSlot(
+                description="The time to pick up the flowers",
+                name="PickupTime",
+                priority=3,
+                sample_utterances=["I would like to order {FlowerType}"],
+                slot_constraint="Required",
+                slot_type="AMAZON.TIME",
+                slot_type_version="$$LATEST",
+                value_elicitation_prompt=LexIntentSlotValueElicitationPrompt(
+                    max_attempts=2,
+                    message=[LexIntentSlotValueElicitationPromptMessage(
+                        content="Pick up the {FlowerType} at what time on {PickupDate}?",
+                        content_type="PlainText"
+                    )
+                    ]
+                )
+            )
+            ]
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `conclusion_statement` - (Optional) The statement that you want Amazon Lex to convey to the user
+after the intent is successfully fulfilled by the Lambda function. This element is relevant only if
+you provide a Lambda function in the `fulfillment_activity`. If you return the intent to the client
+application, you can't specify this element. The `follow_up_prompt` and `conclusion_statement` are
+mutually exclusive. You can specify only one. Attributes are documented under [statement](#statement).
+* `confirmation_prompt` - (Optional) Prompts the user to confirm the intent. This question should
+have a yes or no answer. You you must provide both the `rejection_statement` and `confirmation_prompt`,
+or neither. Attributes are documented under [prompt](#prompt).
+* `create_version` - (Optional) Determines if a new slot type version is created when the initial
+resource is created and on each update. Defaults to `false`.
+* `description` - (Optional) A description of the intent. Must be less than or equal to 200 characters in length.
+* `dialog_code_hook` - (Optional) Specifies a Lambda function to invoke for each user input. You can
+invoke this Lambda function to personalize user interaction. Attributes are documented under [code_hook](#code_hook).
+* `follow_up_prompt` - (Optional) Amazon Lex uses this prompt to solicit additional activity after
+fulfilling an intent. For example, after the OrderPizza intent is fulfilled, you might prompt the
+user to order a drink. The `follow_up_prompt` field and the `conclusion_statement` field are mutually
+exclusive. You can specify only one. Attributes are documented under [follow_up_prompt](#follow_up_prompt).
+* `fulfillment_activity` - (Required) Describes how the intent is fulfilled. For example, after a
+user provides all of the information for a pizza order, `fulfillment_activity` defines how the bot
+places an order with a local pizza store. Attributes are documented under [fulfillment_activity](#fulfillment_activity).
+* `name` - (Required) The name of the intent, not case sensitive. Must be less than or equal to 100 characters in length.
+* `parent_intent_signature` - (Optional) A unique identifier for the built-in intent to base this
+intent on. To find the signature for an intent, see
+[Standard Built-in Intents](https://developer.amazon.com/public/solutions/alexa/alexa-skills-kit/docs/built-in-intent-ref/standard-intents)
+in the Alexa Skills Kit.
+* `rejection_statement` - (Optional) When the user answers "no" to the question defined in
+`confirmation_prompt`, Amazon Lex responds with this statement to acknowledge that the intent was
+canceled. You must provide both the `rejection_statement` and the `confirmation_prompt`, or neither.
+Attributes are documented under [statement](#statement).
+* `sample_utterances` - (Optional) An array of utterances (strings) that a user might say to signal
+the intent. For example, "I want {PizzaSize} pizza", "Order {Quantity} {PizzaSize} pizzas".
+In each utterance, a slot name is enclosed in curly braces. Must have between 1 and 10 items in the list, and each item must be less than or equal to 200 characters in length.
+* `slot` - (Optional) An list of intent slots. At runtime, Amazon Lex elicits required slot values
+from the user using prompts defined in the slots. Attributes are documented under [slot](#slot).
+
+### code_hook
+
+Specifies a Lambda function that verifies requests to a bot or fulfills the user's request to a bot.
+
+* `message_version` - (Required) The version of the request-response that you want Amazon Lex to use
+to invoke your Lambda function. For more information, see
+[Using Lambda Functions](https://docs.aws.amazon.com/lex/latest/dg/using-lambda.html). Must be less than or equal to 5 characters in length.
+* `uri` - (Required) The Amazon Resource Name (ARN) of the Lambda function.
+
+### follow_up_prompt
+
+A prompt for additional activity after an intent is fulfilled. For example, after the OrderPizza
+intent is fulfilled, you might prompt the user to find out whether the user wants to order drinks.
+
+* `prompt` - (Required) Prompts for information from the user. Attributes are documented under [prompt](#prompt).
+* `rejection_statement` - (Optional) If the user answers "no" to the question defined in the prompt field,
+Amazon Lex responds with this statement to acknowledge that the intent was canceled. Attributes are
+documented below under [statement](#statement).
+
+### fulfillment_activity
+
+Describes how the intent is fulfilled after the user provides all of the information required for the intent.
+
+* `type` - (Required) How the intent should be fulfilled, either by running a Lambda function or by
+returning the slot data to the client application. Type can be either `ReturnIntent` or `CodeHook`, as documented [here](https://docs.aws.amazon.com/lex/latest/dg/API_FulfillmentActivity.html).
+* `code_hook` - (Optional) A description of the Lambda function that is run to fulfill the intent.
+Required if type is CodeHook. Attributes are documented under [code_hook](#code_hook).
+
+### message
+
+The message object that provides the message text and its type.
+
+* `content` - (Required) The text of the message. Must be less than or equal to 1000 characters in length.
+* `content_type` - (Required) The content type of the message string.
+* `group_number` - (Optional) Identifies the message group that the message belongs to. When a group
+is assigned to a message, Amazon Lex returns one message from each group in the response. Must be a number between 1 and 5 (inclusive).
+
+### prompt
+
+Obtains information from the user. To define a prompt, provide one or more messages and specify the
+number of attempts to get information from the user. If you provide more than one message, Amazon
+Lex chooses one of the messages to use to prompt the user.
+
+* `max_attempts` - (Required) The number of times to prompt the user for information. Must be a number between 1 and 5 (inclusive).
+* `message` - (Required) A set of messages, each of which provides a message string and its type.
+You can specify the message string in plain text or in Speech Synthesis Markup Language (SSML).
+Attributes are documented under [message](#message). Must contain between 1 and 15 messages.
+* `response_card` - (Optional) The response card. Amazon Lex will substitute session attributes and
+slot values into the response card. For more information, see
+[Example: Using a Response Card](https://docs.aws.amazon.com/lex/latest/dg/ex-resp-card.html). Must be less than or equal to 50000 characters in length.
+
+### slot
+
+Identifies the version of a specific slot.
+
+* `name` - (Required) The name of the intent slot that you want to create. The name is case sensitive. Must be less than or equal to 100 characters in length.
+* `slot_constraint` - (Required) Specifies whether the slot is required or optional.
+* `description` - (Optional) A description of the bot. Must be less than or equal to 200 characters in length.
+* `priority` - (Optional) Directs Lex the order in which to elicit this slot value from the user.
+For example, if the intent has two slots with priorities 1 and 2, AWS Lex first elicits a value for
+the slot with priority 1. If multiple slots share the same priority, the order in which Lex elicits
+values is arbitrary. Must be between 1 and 100.
+* `response_card` - (Optional) The response card. Amazon Lex will substitute session attributes and
+slot values into the response card. For more information, see
+[Example: Using a Response Card](https://docs.aws.amazon.com/lex/latest/dg/ex-resp-card.html). Must be less than or equal to 50000 characters in length.
+* `sample_utterances` - (Optional) If you know a specific pattern with which users might respond to
+an Amazon Lex request for a slot value, you can provide those utterances to improve accuracy. This
+is optional. In most cases, Amazon Lex is capable of understanding user utterances. Must have between 1 and 10 items in the list, and each item must be less than or equal to 200 characters in length.
+* `slot_type` - (Optional) The type of the slot, either a custom slot type that you defined or one of
+the built-in slot types. Must be less than or equal to 100 characters in length.
+* `slot_type_version` - (Optional) The version of the slot type. Must be less than or equal to 64 characters in length.
+* `value_elicitation_prompt` - (Optional) The prompt that Amazon Lex uses to elicit the slot value
+from the user. Attributes are documented under [prompt](#prompt).
+
+### statement
+
+A statement is a map with a set of message maps and an optional response card string. Messages
+convey information to the user. At runtime, Amazon Lex selects the message to convey.
+
+* `message` - (Required) A set of messages, each of which provides a message string and its type.
+You can specify the message string in plain text or in Speech Synthesis Markup Language (SSML).
+Attributes are documented under [message](#message). Must contain between 1 and 15 messages.
+* `response_card` - (Optional) The response card. Amazon Lex will substitute session attributes and
+slot values into the response card. For more information, see
+[Example: Using a Response Card](https://docs.aws.amazon.com/lex/latest/dg/ex-resp-card.html). Must be less than or equal to 50000 characters in length.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the Lex intent.
+* `checksum` - Checksum identifying the version of the intent that was created. The checksum is not
+included as an argument because the resource will add it automatically when updating the intent.
+* `created_date` - The date when the intent version was created.
+* `last_updated_date` - The date when the $LATEST version of this intent was updated.
+* `version` - The version of the bot.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `1m`)
+* `update` - (Default `1m`)
+* `delete` - (Default `5m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import intents using their name. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import intents using their name. For example:
+
+```console
+% terraform import aws_lex_intent.order_flowers_intent OrderFlowers
+```
+
+<!-- cache-key: cdktf-0.18.0 input-bc4d0529031c21b9dbe67a57c70be3664c7edf7ad0c0512f13dbf0d1a13356b3 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/lex_slot_type.html.markdown b/website/docs/cdktf/python/r/lex_slot_type.html.markdown
new file mode 100644
index 00000000000..34bd15bc777
--- /dev/null
+++ b/website/docs/cdktf/python/r/lex_slot_type.html.markdown
@@ -0,0 +1,112 @@
+---
+subcategory: "Lex Model Building"
+layout: "aws"
+page_title: "AWS: aws_lex_slot_type"
+description: |-
+  Provides details about a specific Amazon Lex Slot Type
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lex_slot_type
+
+Provides an Amazon Lex Slot Type resource. For more information see
+[Amazon Lex: How It Works](https://docs.aws.amazon.com/lex/latest/dg/how-it-works.html)
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.lex_slot_type import LexSlotType
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        LexSlotType(self, "flower_types",
+            create_version=True,
+            description="Types of flowers to order",
+            enumeration_value=[LexSlotTypeEnumerationValue(
+                synonyms=["Lirium", "Martagon"],
+                value="lilies"
+            ), LexSlotTypeEnumerationValue(
+                synonyms=["Eduardoregelia", "Podonix"],
+                value="tulips"
+            )
+            ],
+            name="FlowerTypes",
+            value_selection_strategy="ORIGINAL_VALUE"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `enumeration_value` - (Required) A list of EnumerationValue objects that defines the values that
+the slot type can take. Each value can have a list of synonyms, which are additional values that help
+train the machine learning model about the values that it resolves for a slot. Attributes are
+documented under [enumeration_value](#enumeration_value).
+* `name` - (Required) The name of the slot type. The name is not case sensitive. Must be less than or equal to 100 characters in length.
+* `create_version` - (Optional)
+Determines if a new slot type version is created when the initial resource is created and on each
+update. Defaults to `false`.
+* `description` - (Optional) A description of the slot type. Must be less than or equal to 200 characters in length.
+* `value_selection_strategy` - (Optional) Determines the slot resolution strategy that Amazon Lex
+uses to return slot type values. `ORIGINAL_VALUE` returns the value entered by the user if the user
+value is similar to the slot value. `TOP_RESOLUTION` returns the first value in the resolution list
+if there is a resolution list for the slot, otherwise null is returned. Defaults to `ORIGINAL_VALUE`.
+
+### enumeration_value
+
+Each slot type can have a set of values. Each enumeration value represents a value the slot type
+can take.
+
+For example, a pizza ordering bot could have a slot type that specifies the type of crust that the
+pizza should have. The slot type could include the values: thick, thin, stuffed.
+
+* `synonyms` - (Optional) Additional values related to the slot type value. Each item must be less than or equal to 140 characters in length.
+* `value` - (Required) The value of the slot type. Must be less than or equal to 140 characters in length.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `1m`)
+* `update` - (Default `1m`)
+* `delete` - (Default `5m`)
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `checksum` - Checksum identifying the version of the slot type that was created. The checksum is
+not included as an argument because the resource will add it automatically when updating the slot type.
+* `created_date` - The date when the slot type version was created.
+* `last_updated_date` - The date when the `$LATEST` version of this slot type was updated.
+* `version` - The version of the slot type.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import slot types using their name. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import slot types using their name. For example:
+
+```console
+% terraform import aws_lex_slot_type.flower_types FlowerTypes
+```
+
+<!-- cache-key: cdktf-0.18.0 input-58681a55cb640f1116beebb5be5c7d0038c7e9b4981ccd70f4a9d065bd1b8d17 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/lexv2models_bot.html.markdown b/website/docs/cdktf/python/r/lexv2models_bot.html.markdown
new file mode 100644
index 00000000000..7c0965b8568
--- /dev/null
+++ b/website/docs/cdktf/python/r/lexv2models_bot.html.markdown
@@ -0,0 +1,104 @@
+---
+subcategory: "Lex V2 Models"
+layout: "aws"
+page_title: "AWS: aws_lexv2models_bot"
+description: |-
+  Terraform resource for managing an AWS Lex V2 Models Bot.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lexv2models_bot
+
+Terraform resource for managing an AWS Lex V2 Models Bot.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.lexv2_models_bot import Lexv2ModelsBot
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Lexv2ModelsBot(self, "example",
+            data_privacy=[{
+                "child_directed": Token.as_boolean("boolean")
+            }
+            ],
+            idle_session_ttl_in_seconds=10,
+            name="example",
+            role_arn="bot_example_arn"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - Name of the bot. The bot name must be unique in the account that creates the bot. Type String. Length Constraints: Minimum length of 1. Maximum length of 100.
+* `data_privacy` - Provides information on additional privacy protections Amazon Lex should use with the bot's data. See [`data_privacy`](#data-privacy)
+* `idle_session_ttl_in_seconds` - Time, in seconds, that Amazon Lex should keep information about a user's conversation with the bot. You can specify between 60 (1 minute) and 86,400 (24 hours) seconds.
+* `role_arn` - ARN of an IAM role that has permission to access the bot.
+
+The following arguments are optional:
+
+* `members` - List of bot members in a network to be created. See [`bot_members`](#bot-members).
+* `bot_tags` - List of tags to add to the bot. You can only add tags when you create a bot.
+* `bot_type` - Type of a bot to create.
+* `description` - Description of the bot. It appears in lists to help you identify a particular bot.
+* `test_bot_alias_tags` - List of tags to add to the test alias for a bot. You can only add tags when you create a bot.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Unique identifier for a particular bot.
+
+### Data Privacy
+
+* `child_directed` (Required) -  For each Amazon Lex bot created with the Amazon Lex Model Building Service, you must specify whether your use of Amazon Lex is related to a website, program, or other application that is directed or targeted, in whole or in part, to children under age 13 and subject to the Children's Online Privacy Protection Act (COPPA) by specifying true or false in the childDirected field.
+
+### Bot Members
+
+* `alias_id` (Required) - Alias ID of a bot that is a member of this network of bots.
+* `alias_name` (Required) - Alias name of a bot that is a member of this network of bots.
+* `id` (Required) - Unique ID of a bot that is a member of this network of bots.
+* `name` (Required) - Unique name of a bot that is a member of this network of bots.
+* `version` (Required) - Version of a bot that is a member of this network of bots.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `30m`)
+* `update` - (Default `30m`)
+* `delete` - (Default `30m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Lex V2 Models Bot using the `example_id_arg`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Lex V2 Models Bot using the `example_id_arg`. For example:
+
+```console
+% terraform import aws_lexv2models_bot.example bot-id-12345678
+```
+
+<!-- cache-key: cdktf-0.18.0 input-7e4e7c49f1d8375bbd057208e9ba1b16a7f2a964f4ba619719401e55ba5eb370 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/licensemanager_association.html.markdown b/website/docs/cdktf/python/r/licensemanager_association.html.markdown
new file mode 100644
index 00000000000..5c16d2a876a
--- /dev/null
+++ b/website/docs/cdktf/python/r/licensemanager_association.html.markdown
@@ -0,0 +1,95 @@
+---
+subcategory: "License Manager"
+layout: "aws"
+page_title: "AWS: aws_licensemanager_association"
+description: |-
+  Provides a License Manager association resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_licensemanager_association
+
+Provides a License Manager association.
+
+~> **Note:** License configurations can also be associated with launch templates by specifying the `license_specifications` block for an `aws_launch_template`.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_ami import DataAwsAmi
+from imports.aws.instance import Instance
+from imports.aws.licensemanager_association import LicensemanagerAssociation
+from imports.aws.licensemanager_license_configuration import LicensemanagerLicenseConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = LicensemanagerLicenseConfiguration(self, "example",
+            license_counting_type="Instance",
+            name="Example"
+        )
+        data_aws_ami_example = DataAwsAmi(self, "example_1",
+            filter=[DataAwsAmiFilter(
+                name="name",
+                values=["amzn-ami-vpc-nat*"]
+            )
+            ],
+            most_recent=True,
+            owners=["amazon"]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_ami_example.override_logical_id("example")
+        aws_instance_example = Instance(self, "example_2",
+            ami=Token.as_string(data_aws_ami_example.id),
+            instance_type="t2.micro"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_instance_example.override_logical_id("example")
+        aws_licensemanager_association_example = LicensemanagerAssociation(self, "example_3",
+            license_configuration_arn=example.arn,
+            resource_arn=Token.as_string(aws_instance_example.arn)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_licensemanager_association_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `license_configuration_arn` - (Required) ARN of the license configuration.
+* `resource_arn` - (Required) ARN of the resource associated with the license configuration.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The license configuration ARN.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import license configurations using `resource_arn,license_configuration_arn`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import license configurations using `resource_arn,license_configuration_arn`. For example:
+
+```console
+% terraform import aws_licensemanager_association.example arn:aws:ec2:eu-west-1:123456789012:image/ami-123456789abcdef01,arn:aws:license-manager:eu-west-1:123456789012:license-configuration:lic-0123456789abcdef0123456789abcdef
+```
+
+<!-- cache-key: cdktf-0.18.0 input-8b8e9ddcd676f43167920f5782ed96b9679e5a610aa31170c5d53aa2d9e1453d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/licensemanager_association.markdown b/website/docs/cdktf/python/r/licensemanager_association.markdown
new file mode 100644
index 00000000000..5c16d2a876a
--- /dev/null
+++ b/website/docs/cdktf/python/r/licensemanager_association.markdown
@@ -0,0 +1,95 @@
+---
+subcategory: "License Manager"
+layout: "aws"
+page_title: "AWS: aws_licensemanager_association"
+description: |-
+  Provides a License Manager association resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_licensemanager_association
+
+Provides a License Manager association.
+
+~> **Note:** License configurations can also be associated with launch templates by specifying the `license_specifications` block for an `aws_launch_template`.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_ami import DataAwsAmi
+from imports.aws.instance import Instance
+from imports.aws.licensemanager_association import LicensemanagerAssociation
+from imports.aws.licensemanager_license_configuration import LicensemanagerLicenseConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = LicensemanagerLicenseConfiguration(self, "example",
+            license_counting_type="Instance",
+            name="Example"
+        )
+        data_aws_ami_example = DataAwsAmi(self, "example_1",
+            filter=[DataAwsAmiFilter(
+                name="name",
+                values=["amzn-ami-vpc-nat*"]
+            )
+            ],
+            most_recent=True,
+            owners=["amazon"]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_ami_example.override_logical_id("example")
+        aws_instance_example = Instance(self, "example_2",
+            ami=Token.as_string(data_aws_ami_example.id),
+            instance_type="t2.micro"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_instance_example.override_logical_id("example")
+        aws_licensemanager_association_example = LicensemanagerAssociation(self, "example_3",
+            license_configuration_arn=example.arn,
+            resource_arn=Token.as_string(aws_instance_example.arn)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_licensemanager_association_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `license_configuration_arn` - (Required) ARN of the license configuration.
+* `resource_arn` - (Required) ARN of the resource associated with the license configuration.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The license configuration ARN.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import license configurations using `resource_arn,license_configuration_arn`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import license configurations using `resource_arn,license_configuration_arn`. For example:
+
+```console
+% terraform import aws_licensemanager_association.example arn:aws:ec2:eu-west-1:123456789012:image/ami-123456789abcdef01,arn:aws:license-manager:eu-west-1:123456789012:license-configuration:lic-0123456789abcdef0123456789abcdef
+```
+
+<!-- cache-key: cdktf-0.18.0 input-8b8e9ddcd676f43167920f5782ed96b9679e5a610aa31170c5d53aa2d9e1453d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/licensemanager_grant.html.markdown b/website/docs/cdktf/python/r/licensemanager_grant.html.markdown
new file mode 100644
index 00000000000..4386c268ed8
--- /dev/null
+++ b/website/docs/cdktf/python/r/licensemanager_grant.html.markdown
@@ -0,0 +1,78 @@
+---
+subcategory: "License Manager"
+layout: "aws"
+page_title: "AWS: aws_licensemanager_grant"
+description: |-
+  Provides a License Manager grant resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_licensemanager_grant
+
+Provides a License Manager grant. This allows for sharing licenses with other AWS accounts.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.licensemanager_grant import LicensemanagerGrant
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        LicensemanagerGrant(self, "test",
+            allowed_operations=["ListPurchasedLicenses", "CheckoutLicense", "CheckInLicense", "ExtendConsumptionLicense", "CreateToken"
+            ],
+            home_region="us-east-1",
+            license_arn="arn:aws:license-manager::111111111111:license:l-exampleARN",
+            name="share-license-with-account",
+            principal="arn:aws:iam::111111111112:root"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The Name of the grant.
+* `allowed_operations` - (Required) A list of the allowed operations for the grant. This is a subset of the allowed operations on the license.
+* `license_arn` - (Required) The ARN of the license to grant.
+* `principal` - (Required) The target account for the grant in the form of the ARN for an account principal of the root user.
+* `home_region` - (Required) The home region for the license.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The grant ARN (Same as `arn`).
+* `arn` - The grant ARN.
+* `parent_arn` - The parent ARN.
+* `status` - The grant status.
+* `version` - The grant version.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_licensemanager_grant` using the grant arn. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_licensemanager_grant` using the grant arn. For example:
+
+```console
+% terraform import aws_licensemanager_grant.test arn:aws:license-manager::123456789011:grant:g-01d313393d9e443d8664cc054db1e089
+```
+
+<!-- cache-key: cdktf-0.18.0 input-419b075350bd4a341920e7dd03004f5baac3d5ff8e519534de15249f89df44ab -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/licensemanager_grant_accepter.html.markdown b/website/docs/cdktf/python/r/licensemanager_grant_accepter.html.markdown
new file mode 100644
index 00000000000..03d9b94938a
--- /dev/null
+++ b/website/docs/cdktf/python/r/licensemanager_grant_accepter.html.markdown
@@ -0,0 +1,74 @@
+---
+subcategory: "License Manager"
+layout: "aws"
+page_title: "AWS: aws_licensemanager_grant_accepter"
+description: |-
+  Accepts a License Manager grant resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_licensemanager_grant_accepter
+
+Accepts a License Manager grant. This allows for sharing licenses with other aws accounts.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.licensemanager_grant_accepter import LicensemanagerGrantAccepter
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        LicensemanagerGrantAccepter(self, "test",
+            grant_arn="arn:aws:license-manager::123456789012:grant:g-1cf9fba4ba2f42dcab11c686c4b4d329"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `grant_arn` - (Required) The ARN of the grant to accept.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The grant ARN (Same as `arn`).
+* `arn` - The grant ARN.
+* `name` - The Name of the grant.
+* `allowed_operations` - A list of the allowed operations for the grant.
+* `license_arn` - The ARN of the license for the grant.
+* `principal` - The target account for the grant.
+* `home_region` - The home region for the license.
+* `parent_arn` - The parent ARN.
+* `status` - The grant status.
+* `version` - The grant version.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_licensemanager_grant_accepter` using the grant arn. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_licensemanager_grant_accepter` using the grant arn. For example:
+
+```console
+% terraform import aws_licensemanager_grant_accepter.test arn:aws:license-manager::123456789012:grant:g-1cf9fba4ba2f42dcab11c686c4b4d329
+```
+
+<!-- cache-key: cdktf-0.18.0 input-b6bc3dfd68fc5e40493efa8095e697e235b9281777309cc1fb51e9af52dca95d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/licensemanager_license_configuration.html.markdown b/website/docs/cdktf/python/r/licensemanager_license_configuration.html.markdown
new file mode 100644
index 00000000000..2d2aa8c4b4e
--- /dev/null
+++ b/website/docs/cdktf/python/r/licensemanager_license_configuration.html.markdown
@@ -0,0 +1,96 @@
+---
+subcategory: "License Manager"
+layout: "aws"
+page_title: "AWS: aws_licensemanager_license_configuration"
+description: |-
+  Provides a License Manager license configuration resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_licensemanager_license_configuration
+
+Provides a License Manager license configuration resource.
+
+~> **Note:** Removing the `license_count` attribute is not supported by the License Manager API - use `terraform taint aws_licensemanager_license_configuration.<id>` to recreate the resource instead.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.licensemanager_license_configuration import LicensemanagerLicenseConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        LicensemanagerLicenseConfiguration(self, "example",
+            description="Example",
+            license_count=10,
+            license_count_hard_limit=True,
+            license_counting_type="Socket",
+            license_rules=["#minimumSockets=2"],
+            name="Example",
+            tags={
+                "foo": "barr"
+            }
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) Name of the license configuration.
+* `description` - (Optional) Description of the license configuration.
+* `license_count` - (Optional) Number of licenses managed by the license configuration.
+* `license_count_hard_limit` - (Optional) Sets the number of available licenses as a hard limit.
+* `license_counting_type` - (Required) Dimension to use to track license inventory. Specify either `vCPU`, `Instance`, `Core` or `Socket`.
+* `license_rules` - (Optional) Array of configured License Manager rules.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Rules
+
+License rules should be in the format of `#RuleType=RuleValue`. Supported rule types:
+
+* `minimumVcpus` - Resource must have minimum vCPU count in order to use the license. Default: 1
+* `maximumVcpus` - Resource must have maximum vCPU count in order to use the license. Default: unbounded, limit: 10000
+* `minimumCores` - Resource must have minimum core count in order to use the license. Default: 1
+* `maximumCores` - Resource must have maximum core count in order to use the license. Default: unbounded, limit: 10000
+* `minimumSockets` - Resource must have minimum socket count in order to use the license. Default: 1
+* `maximumSockets` - Resource must have maximum socket count in order to use the license. Default: unbounded, limit: 10000
+* `allowedTenancy` - Defines where the license can be used. If set, restricts license usage to selected tenancies. Specify a comma delimited list of `EC2-Default`, `EC2-DedicatedHost`, `EC2-DedicatedInstance`
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The license configuration ARN.
+* `id` - The license configuration ARN.
+* `owner_account_id` - Account ID of the owner of the license configuration.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import license configurations using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import license configurations using the `id`. For example:
+
+```console
+% terraform import aws_licensemanager_license_configuration.example arn:aws:license-manager:eu-west-1:123456789012:license-configuration:lic-0123456789abcdef0123456789abcdef
+```
+
+<!-- cache-key: cdktf-0.18.0 input-5a8f27111f7375c06f96dc77659a24d2efcdd9bfe181e061904d734084d24650 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/licensemanager_license_configuration.markdown b/website/docs/cdktf/python/r/licensemanager_license_configuration.markdown
new file mode 100644
index 00000000000..2d2aa8c4b4e
--- /dev/null
+++ b/website/docs/cdktf/python/r/licensemanager_license_configuration.markdown
@@ -0,0 +1,96 @@
+---
+subcategory: "License Manager"
+layout: "aws"
+page_title: "AWS: aws_licensemanager_license_configuration"
+description: |-
+  Provides a License Manager license configuration resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_licensemanager_license_configuration
+
+Provides a License Manager license configuration resource.
+
+~> **Note:** Removing the `license_count` attribute is not supported by the License Manager API - use `terraform taint aws_licensemanager_license_configuration.<id>` to recreate the resource instead.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.licensemanager_license_configuration import LicensemanagerLicenseConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        LicensemanagerLicenseConfiguration(self, "example",
+            description="Example",
+            license_count=10,
+            license_count_hard_limit=True,
+            license_counting_type="Socket",
+            license_rules=["#minimumSockets=2"],
+            name="Example",
+            tags={
+                "foo": "barr"
+            }
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) Name of the license configuration.
+* `description` - (Optional) Description of the license configuration.
+* `license_count` - (Optional) Number of licenses managed by the license configuration.
+* `license_count_hard_limit` - (Optional) Sets the number of available licenses as a hard limit.
+* `license_counting_type` - (Required) Dimension to use to track license inventory. Specify either `vCPU`, `Instance`, `Core` or `Socket`.
+* `license_rules` - (Optional) Array of configured License Manager rules.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Rules
+
+License rules should be in the format of `#RuleType=RuleValue`. Supported rule types:
+
+* `minimumVcpus` - Resource must have minimum vCPU count in order to use the license. Default: 1
+* `maximumVcpus` - Resource must have maximum vCPU count in order to use the license. Default: unbounded, limit: 10000
+* `minimumCores` - Resource must have minimum core count in order to use the license. Default: 1
+* `maximumCores` - Resource must have maximum core count in order to use the license. Default: unbounded, limit: 10000
+* `minimumSockets` - Resource must have minimum socket count in order to use the license. Default: 1
+* `maximumSockets` - Resource must have maximum socket count in order to use the license. Default: unbounded, limit: 10000
+* `allowedTenancy` - Defines where the license can be used. If set, restricts license usage to selected tenancies. Specify a comma delimited list of `EC2-Default`, `EC2-DedicatedHost`, `EC2-DedicatedInstance`
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The license configuration ARN.
+* `id` - The license configuration ARN.
+* `owner_account_id` - Account ID of the owner of the license configuration.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import license configurations using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import license configurations using the `id`. For example:
+
+```console
+% terraform import aws_licensemanager_license_configuration.example arn:aws:license-manager:eu-west-1:123456789012:license-configuration:lic-0123456789abcdef0123456789abcdef
+```
+
+<!-- cache-key: cdktf-0.18.0 input-5a8f27111f7375c06f96dc77659a24d2efcdd9bfe181e061904d734084d24650 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/lightsail_bucket.html.markdown b/website/docs/cdktf/python/r/lightsail_bucket.html.markdown
new file mode 100644
index 00000000000..76ab18867d8
--- /dev/null
+++ b/website/docs/cdktf/python/r/lightsail_bucket.html.markdown
@@ -0,0 +1,75 @@
+---
+subcategory: "Lightsail"
+layout: "aws"
+page_title: "AWS: aws_lightsail_bucket"
+description: |-
+  Provides a lightsail bucket
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lightsail_bucket
+
+Provides a lightsail bucket.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.lightsail_bucket import LightsailBucket
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        LightsailBucket(self, "test",
+            bundle_id="small_1_0",
+            name="mytestbucket"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name for the bucket.
+* `bundle_id` - (Required) - The ID of the bundle to use for the bucket. A bucket bundle specifies the monthly cost, storage space, and data transfer quota for a bucket. Use the [get-bucket-bundles](https://docs.aws.amazon.com/cli/latest/reference/lightsail/get-bucket-bundles.html) cli command to get a list of bundle IDs that you can specify.
+* `force_delete` - (Optional) - Force Delete non-empty buckets using `terraform destroy`. AWS by default will not delete an s3 bucket which is not empty, to prevent losing bucket data and affecting other resources in lightsail. If `force_delete` is set to `true` the bucket will be deleted even when not empty.
+* `tags` - (Optional) A map of tags to assign to the resource. To create a key-only tag, use an empty string as the value. If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name used for this bucket (matches `name`).
+* `arn` - The ARN of the lightsail bucket.
+* `availability_zone` - The resource Availability Zone. Follows the format us-east-2a (case-sensitive).
+* `created_at` - The timestamp when the bucket was created.
+* `region` - The Amazon Web Services Region name.
+* `support_code` - The support code for the resource. Include this code in your email to support when you have questions about a resource in Lightsail. This code enables our support team to look up your Lightsail information more easily.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider `default_tags` configuration block.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_lightsail_bucket` using the `name` attribute. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_lightsail_bucket` using the `name` attribute. For example:
+
+```console
+% terraform import aws_lightsail_bucket.test example-bucket
+```
+
+<!-- cache-key: cdktf-0.18.0 input-d78cdd83a8835a614b707d0e291b7c234f89104b66f2a32a7706513d7cce144c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/lightsail_bucket_access_key.html.markdown b/website/docs/cdktf/python/r/lightsail_bucket_access_key.html.markdown
new file mode 100644
index 00000000000..7047481f10d
--- /dev/null
+++ b/website/docs/cdktf/python/r/lightsail_bucket_access_key.html.markdown
@@ -0,0 +1,77 @@
+---
+subcategory: "Lightsail"
+layout: "aws"
+page_title: "AWS: aws_lightsail_bucket_access_key"
+description: |-
+  Provides a lightsail bucket access key. This is a set of credentials that allow API requests to be made to the lightsail bucket.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lightsail_bucket_access_key
+
+Provides a lightsail bucket access key. This is a set of credentials that allow API requests to be made to the lightsail bucket.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws. import LightsailBucketAccessKeyAccessKey
+from imports.aws.lightsail_bucket import LightsailBucket
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        LightsailBucket(self, "test",
+            bundle_id="small_1_0",
+            name="mytestbucket"
+        )
+        aws_lightsail_bucket_access_key_access_key_test =
+        LightsailBucketAccessKeyAccessKey(self, "test_1",
+            bucket_name=aws_lightsail_bucket_access_key_test.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_lightsail_bucket_access_key_access_key_test.override_logical_id("test")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `bucket_name` - (Required) The name of the bucket that the new access key will belong to, and grant access to.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - A combination of attributes separated by a `,` to create a unique id: `bucket_name`,`access_key_id`
+* `access_key_id` - The ID of the access key.
+* `created_at` - The timestamp when the access key was created.
+* `secret_access_key` - The secret access key used to sign requests. This attribute is not available for imported resources. Note that this will be written to the state file.
+* `status` - The status of the access key.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_lightsail_bucket_access_key` using the `id` attribute. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_lightsail_bucket_access_key` using the `id` attribute. For example:
+
+```console
+% terraform import aws_lightsail_bucket_access_key.test example-bucket,AKIA47VOQ2KPR7LLRZ6D
+```
+
+<!-- cache-key: cdktf-0.18.0 input-4987b702ac9d88a7d12a903a50c895eccdf400c8ee70bccc957c21e050e1eb7f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/lightsail_bucket_resource_access.html.markdown b/website/docs/cdktf/python/r/lightsail_bucket_resource_access.html.markdown
new file mode 100644
index 00000000000..33c77318e7f
--- /dev/null
+++ b/website/docs/cdktf/python/r/lightsail_bucket_resource_access.html.markdown
@@ -0,0 +1,84 @@
+---
+subcategory: "Lightsail"
+layout: "aws"
+page_title: "AWS: aws_lightsail_bucket_resource_access"
+description: |-
+  Provides a lightsail resource access to a bucket.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lightsail_bucket_resource_access
+
+Provides a lightsail resource access to a bucket.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.lightsail_bucket import LightsailBucket
+from imports.aws.lightsail_bucket_resource_access import LightsailBucketResourceAccess
+from imports.aws.lightsail_instance import LightsailInstance
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        LightsailBucket(self, "test",
+            bundle_id="small_1_0",
+            name="mytestbucket"
+        )
+        aws_lightsail_bucket_resource_access_test =
+        LightsailBucketResourceAccess(self, "test_1",
+            bucket_name=Token.as_string(aws_lightsail_bucket_resource_access_test.id),
+            resource_name=id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_lightsail_bucket_resource_access_test.override_logical_id("test")
+        aws_lightsail_instance_test = LightsailInstance(self, "test_2",
+            availability_zone="us-east-1b",
+            blueprint_id="amazon_linux_2",
+            bundle_id="nano_1_0",
+            name="mytestinstance"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_lightsail_instance_test.override_logical_id("test")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `bucket_name` - (Required) The name of the bucket to grant access to.
+* `resource_name` - (Required) The name of the resource to be granted bucket access.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - A combination of attributes separated by a `,` to create a unique id: `bucket_name`,`resource_name`
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_lightsail_bucket_resource_access` using the `id` attribute. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_lightsail_bucket_resource_access` using the `id` attribute. For example:
+
+```console
+% terraform import aws_lightsail_bucket_resource_access.test example-bucket,example-instance
+```
+
+<!-- cache-key: cdktf-0.18.0 input-e66e2caf6e37ed190e4f20bfc333ee8f9ffb8ca628a14ba9a473ab2aa2e22e18 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/lightsail_certificate.html.markdown b/website/docs/cdktf/python/r/lightsail_certificate.html.markdown
new file mode 100644
index 00000000000..f10bb4bbd79
--- /dev/null
+++ b/website/docs/cdktf/python/r/lightsail_certificate.html.markdown
@@ -0,0 +1,74 @@
+---
+subcategory: "Lightsail"
+layout: "aws"
+page_title: "AWS: aws_lightsail_certificate"
+description: |-
+  Provides a lightsail certificate
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lightsail_certificate
+
+Provides a lightsail certificate.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.lightsail_certificate import LightsailCertificate
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        LightsailCertificate(self, "test",
+            domain_name="testdomain.com",
+            name="test",
+            subject_alternative_names=["www.testdomain.com"]
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the Lightsail load balancer.
+* `domain_name` - (Required) A domain name for which the certificate should be issued.
+* `subject_alternative_names` - (Optional) Set of domains that should be SANs in the issued certificate. `domain_name` attribute is automatically added as a Subject Alternative Name.
+* `tags` - (Optional) A map of tags to assign to the resource. To create a key-only tag, use an empty string as the value. If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name of the lightsail certificate (matches `name`).
+* `arn` - The ARN of the lightsail certificate.
+* `created_at` - The timestamp when the instance was created.
+* `domain_validation_options` - Set of domain validation objects which can be used to complete certificate validation. Can have more than one element, e.g., if SANs are defined.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider `default_tags` configuration block.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_lightsail_certificate` using the certificate name. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_lightsail_certificate` using the certificate name. For example:
+
+```console
+% terraform import aws_lightsail_certificate.test CertificateName
+```
+
+<!-- cache-key: cdktf-0.18.0 input-fa74f908bf0e275af92966e17e2db46d1735155118450df59ddb6d8e9735f416 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/lightsail_container_service.html.markdown b/website/docs/cdktf/python/r/lightsail_container_service.html.markdown
new file mode 100644
index 00000000000..f42ea634c91
--- /dev/null
+++ b/website/docs/cdktf/python/r/lightsail_container_service.html.markdown
@@ -0,0 +1,215 @@
+---
+subcategory: "Lightsail"
+layout: "aws"
+page_title: "AWS: aws_lightsail_container_service"
+description: |- 
+  Provides a resource to manage Lightsail container service
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lightsail_container_service
+
+An Amazon Lightsail container service is a highly scalable compute and networking resource on which you can deploy, run,
+and manage containers. For more information, see
+[Container services in Amazon Lightsail](https://lightsail.aws.amazon.com/ls/docs/en_us/articles/amazon-lightsail-container-services).
+
+~> **Note:** For more information about the AWS Regions in which you can create Amazon Lightsail container services,
+see ["Regions and Availability Zones in Amazon Lightsail"](https://lightsail.aws.amazon.com/ls/docs/overview/article/understanding-regions-and-availability-zones-in-amazon-lightsail).
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.lightsail_container_service import LightsailContainerService
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        LightsailContainerService(self, "my_container_service",
+            is_disabled=False,
+            name="container-service-1",
+            power="nano",
+            scale=1,
+            tags={
+                "foo1": "bar1",
+                "foo2": ""
+            }
+        )
+```
+
+### Public Domain Names
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.lightsail_container_service import LightsailContainerService
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, name, power, scale):
+        super().__init__(scope, name)
+        LightsailContainerService(self, "my_container_service",
+            public_domain_names=LightsailContainerServicePublicDomainNames(
+                certificate=[LightsailContainerServicePublicDomainNamesCertificate(
+                    certificate_name="example-certificate",
+                    domain_names=["www.example.com"]
+                )
+                ]
+            ),
+            name=name,
+            power=power,
+            scale=scale
+        )
+```
+
+### Private Registry Access
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.ecr_repository_policy import EcrRepositoryPolicy
+from imports.aws.lightsail_container_service import LightsailContainerService
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, name, power, scale):
+        super().__init__(scope, name)
+        default_var = LightsailContainerService(self, "default",
+            private_registry_access=LightsailContainerServicePrivateRegistryAccess(
+                ecr_image_puller_role=LightsailContainerServicePrivateRegistryAccessEcrImagePullerRole(
+                    is_active=True
+                )
+            ),
+            name=name,
+            power=power,
+            scale=scale
+        )
+        data_aws_iam_policy_document_default = DataAwsIamPolicyDocument(self, "default_1",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["ecr:BatchGetImage", "ecr:GetDownloadUrlForLayer"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=[
+                        Token.as_string(
+                            Fn.lookup_nested(default_var.private_registry_access, ["0", "ecr_image_puller_role", "0", "principal_arn"
+                            ]))
+                    ],
+                    type="AWS"
+                )
+                ]
+            )
+            ]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_iam_policy_document_default.override_logical_id("default")
+        aws_ecr_repository_policy_default = EcrRepositoryPolicy(self, "default_2",
+            policy=Token.as_string(data_aws_iam_policy_document_default.json),
+            repository=Token.as_string(aws_ecr_repository_default.name)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_ecr_repository_policy_default.override_logical_id("default")
+```
+
+## Argument Reference
+
+~> **NOTE:** You must create and validate an SSL/TLS certificate before you can use `public_domain_names` with your
+container service. For more information, see
+[Enabling and managing custom domains for your Amazon Lightsail container services](https://lightsail.aws.amazon.com/ls/docs/en_us/articles/amazon-lightsail-creating-container-services-certificates).
+
+This argument supports the following arguments:
+
+* `name` - (Required) The name for the container service. Names must be of length 1 to 63, and be
+  unique within each AWS Region in your Lightsail account.
+* `power` - (Required) The power specification for the container service. The power specifies the amount of memory,
+  the number of vCPUs, and the monthly price of each node of the container service.
+  Possible values: `nano`, `micro`, `small`, `medium`, `large`, `xlarge`.
+* `scale` - (Required) The scale specification for the container service. The scale specifies the allocated compute
+  nodes of the container service.
+* `is_disabled` - (Optional) A Boolean value indicating whether the container service is disabled. Defaults to `false`.
+* `public_domain_names` - (Optional) The public domain names to use with the container service, such as example.com
+  and www.example.com. You can specify up to four public domain names for a container service. The domain names that you
+  specify are used when you create a deployment with a container configured as the public endpoint of your container
+  service. If you don't specify public domain names, then you can use the default domain of the container service.
+  Defined below.
+* `private_registry_access` - (Optional) An object to describe the configuration for the container service to access private container image repositories, such as Amazon Elastic Container Registry (Amazon ECR) private repositories. See [Private Registry Access](#private-registry-access) below for more details.
+* `tags` - (Optional) Map of container service tags. To tag at launch, specify the tags in the Launch Template. If
+  configured with a provider
+  [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block)
+  present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Private Registry Access
+
+The `private_registry_access` block supports the following arguments:
+
+* `ecr_image_puller_role` - (Optional) Describes a request to configure an Amazon Lightsail container service to access private container image repositories, such as Amazon Elastic Container Registry (Amazon ECR) private repositories. See [ECR Image Puller Role](#ecr-image-puller-role) below for more details.
+
+### ECR Image Puller Role
+
+The `ecr_image_puller_role` blocks supports the following arguments:
+
+* `is_active` - (Optional) A Boolean value that indicates whether to activate the role. The default is `false`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the container service.
+* `availability_zone` - The Availability Zone. Follows the format us-east-2a (case-sensitive).
+* `id` - Same as `name`.
+* `power_id` - The ID of the power of the container service.
+* `principal_arn`- The principal ARN of the container service. The principal ARN can be used to create a trust
+  relationship between your standard AWS account and your Lightsail container service. This allows you to give your
+  service permission to access resources in your standard AWS account.
+* `private_domain_name` - The private domain name of the container service. The private domain name is accessible only
+  by other resources within the default virtual private cloud (VPC) of your Lightsail account.
+* `region_name` - The AWS Region name.
+* `resource_type` - The Lightsail resource type of the container service (i.e., ContainerService).
+* `state` - The current state of the container service.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider
+  [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `url` - The publicly accessible URL of the container service. If no public endpoint is specified in the
+  currentDeployment, this URL returns a 404 response.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `30m`)
+* `update` - (Default `30m`)
+* `delete` - (Default `30m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Lightsail Container Service using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Lightsail Container Service using the `name`. For example:
+
+```console
+% terraform import aws_lightsail_container_service.my_container_service container-service-1
+```
+
+<!-- cache-key: cdktf-0.18.0 input-a73e29d48c4928c341fdc728c20c41a3e699af1e8921fe46e3340cce9c056c70 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/lightsail_container_service_deployment_version.html.markdown b/website/docs/cdktf/python/r/lightsail_container_service_deployment_version.html.markdown
new file mode 100644
index 00000000000..f7e1f84f94a
--- /dev/null
+++ b/website/docs/cdktf/python/r/lightsail_container_service_deployment_version.html.markdown
@@ -0,0 +1,135 @@
+---
+subcategory: "Lightsail"
+layout: "aws"
+page_title: "AWS: aws_lightsail_container_service_deployment_version"
+description: |-
+  Provides a resource to manage a deployment version for your Amazon Lightsail container service.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lightsail_container_service_deployment_version
+
+Provides a resource to manage a deployment version for your Amazon Lightsail container service.
+
+~> **NOTE:** The Amazon Lightsail container service must be enabled to create a deployment.
+
+~> **NOTE:** This resource allows you to manage an Amazon Lightsail container service deployment version but Terraform cannot destroy it. Removing this resource from your configuration will remove it from your statefile and Terraform management.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.lightsail_container_service_deployment_version import LightsailContainerServiceDeploymentVersion
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        LightsailContainerServiceDeploymentVersion(self, "example",
+            container=[LightsailContainerServiceDeploymentVersionContainer(
+                command=[],
+                container_name="hello-world",
+                environment={
+                    "MY_ENVIRONMENT_VARIABLE": "my_value"
+                },
+                image="amazon/amazon-lightsail:hello-world",
+                ports={
+                    "80": "HTTP"
+                }
+            )
+            ],
+            public_endpoint=LightsailContainerServiceDeploymentVersionPublicEndpoint(
+                container_name="hello-world",
+                container_port=80,
+                health_check=LightsailContainerServiceDeploymentVersionPublicEndpointHealthCheck(
+                    healthy_threshold=2,
+                    interval_seconds=5,
+                    path="/",
+                    success_codes="200-499",
+                    timeout_seconds=2,
+                    unhealthy_threshold=2
+                )
+            ),
+            service_name=Token.as_string(aws_lightsail_container_service_example.name)
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `service_name` - (Required) The name for the container service.
+* `container` - (Required) A set of configuration blocks that describe the settings of the containers that will be launched on the container service. Maximum of 53. [Detailed below](#container).
+* `public_endpoint` - (Optional) A configuration block that describes the settings of the public endpoint for the container service. [Detailed below](#public_endpoint).
+
+### `container`
+
+The `container` configuration block supports the following arguments:
+
+* `container_name` - (Required) The name for the container.
+* `image` - (Required) The name of the image used for the container. Container images sourced from your Lightsail container service, that are registered and stored on your service, start with a colon (`:`). For example, `:container-service-1.mystaticwebsite.1`. Container images sourced from a public registry like Docker Hub don't start with a colon. For example, `nginx:latest` or `nginx`.
+* `command` - (Optional) The launch command for the container. A list of string.
+* `environment` - (Optional) A key-value map of the environment variables of the container.
+* `ports` - (Optional) A key-value map of the open firewall ports of the container. Valid values: `HTTP`, `HTTPS`, `TCP`, `UDP`.
+
+### `public_endpoint`
+
+The `public_endpoint` configuration block supports the following arguments:
+
+* `container_name` - (Required) The name of the container for the endpoint.
+* `container_port` - (Required) The port of the container to which traffic is forwarded to.
+* `health_check` - (Required) A configuration block that describes the health check configuration of the container. [Detailed below](#health_check).
+
+### `health_check`
+
+The `health_check` configuration block supports the following arguments:
+
+* `healthy_threshold` - (Optional) The number of consecutive health checks successes required before moving the container to the Healthy state. Defaults to 2.
+* `unhealthy_threshold` - (Optional) The number of consecutive health checks failures required before moving the container to the Unhealthy state. Defaults to 2.
+* `timeout_seconds` - (Optional) The amount of time, in seconds, during which no response means a failed health check. You can specify between 2 and 60 seconds. Defaults to 2.
+* `interval_seconds` - (Optional) The approximate interval, in seconds, between health checks of an individual container. You can specify between 5 and 300 seconds. Defaults to 5.
+* `path` - (Optional) The path on the container on which to perform the health check. Defaults to "/".
+* `success_codes` - (Optional) The HTTP codes to use when checking for a successful response from a container. You can specify values between 200 and 499. Defaults to "200-499".
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The `service_name` and `version` separation by a slash (`/`).
+* `created_at` - The timestamp when the deployment was created.
+* `state` - The current state of the container service.
+* `version` - The version number of the deployment.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `30m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Lightsail Container Service Deployment Version using the `service_name` and `version` separated by a slash (`/`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Lightsail Container Service Deployment Version using the `service_name` and `version` separated by a slash (`/`). For example:
+
+```console
+% terraform import aws_lightsail_container_service_deployment_version.example container-service-1/1
+```
+
+<!-- cache-key: cdktf-0.18.0 input-bb1ba480fb42ed01fcc93296f85d9bb0f9f2e3da82d84722d66da594585cd420 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/lightsail_database.html.markdown b/website/docs/cdktf/python/r/lightsail_database.html.markdown
new file mode 100644
index 00000000000..21a70782a47
--- /dev/null
+++ b/website/docs/cdktf/python/r/lightsail_database.html.markdown
@@ -0,0 +1,263 @@
+---
+subcategory: "Lightsail"
+layout: "aws"
+page_title: "AWS: aws_lightsail_database"
+description: |-
+  Provides a Lightsail Database
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lightsail_database
+
+Provides a Lightsail Database. Amazon Lightsail is a service to provide easy virtual private servers
+with custom software already setup. See [What is Amazon Lightsail?](https://lightsail.aws.amazon.com/ls/docs/getting-started/article/what-is-amazon-lightsail)
+for more information.
+
+~> **Note:** Lightsail is currently only supported in a limited number of AWS Regions, please see ["Regions and Availability Zones"](https://aws.amazon.com/about-aws/global-infrastructure/regional-product-services/) for more details
+
+## Example Usage
+
+### Basic mysql blueprint
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.lightsail_database import LightsailDatabase
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        LightsailDatabase(self, "test",
+            availability_zone="us-east-1a",
+            blueprint_id="mysql_8_0",
+            bundle_id="micro_1_0",
+            master_database_name="testdatabasename",
+            master_password="testdatabasepassword",
+            master_username="test",
+            relational_database_name="test"
+        )
+```
+
+### Basic postrgres blueprint
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.lightsail_database import LightsailDatabase
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        LightsailDatabase(self, "test",
+            availability_zone="us-east-1a",
+            blueprint_id="postgres_12",
+            bundle_id="micro_1_0",
+            master_database_name="testdatabasename",
+            master_password="testdatabasepassword",
+            master_username="test",
+            relational_database_name="test"
+        )
+```
+
+### Custom backup and maintenance windows
+
+Below is an example that sets a custom backup and maintenance window. Times are specified in UTC. This example will allow daily backups to take place between 16:00 and 16:30 each day. This example also requires any maintiance tasks (anything that would cause an outage, including changing some attributes) to take place on Tuesdays between 17:00 and 17:30. An action taken against this database that would cause an outage will wait until this time window to make the requested changes.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.lightsail_database import LightsailDatabase
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        LightsailDatabase(self, "test",
+            availability_zone="us-east-1a",
+            blueprint_id="postgres_12",
+            bundle_id="micro_1_0",
+            master_database_name="testdatabasename",
+            master_password="testdatabasepassword",
+            master_username="test",
+            preferred_backup_window="16:00-16:30",
+            preferred_maintenance_window="Tue:17:00-Tue:17:30",
+            relational_database_name="test"
+        )
+```
+
+### Final Snapshots
+
+To enable creating a final snapshot of your database on deletion, use the `final_snapshot_name` argument to provide a name to be used for the snapshot.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.lightsail_database import LightsailDatabase
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        LightsailDatabase(self, "test",
+            availability_zone="us-east-1a",
+            blueprint_id="postgres_12",
+            bundle_id="micro_1_0",
+            final_snapshot_name="MyFinalSnapshot",
+            master_database_name="testdatabasename",
+            master_password="testdatabasepassword",
+            master_username="test",
+            preferred_backup_window="16:00-16:30",
+            preferred_maintenance_window="Tue:17:00-Tue:17:30",
+            relational_database_name="test"
+        )
+```
+
+### Apply Immediately
+
+To enable applying changes immediately instead of waiting for a maintiance window, use the `apply_immediately` argument.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.lightsail_database import LightsailDatabase
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        LightsailDatabase(self, "test",
+            apply_immediately=True,
+            availability_zone="us-east-1a",
+            blueprint_id="postgres_12",
+            bundle_id="micro_1_0",
+            master_database_name="testdatabasename",
+            master_password="testdatabasepassword",
+            master_username="test",
+            relational_database_name="test"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `relational_database_name` - (Required) The name to use for your new Lightsail database resource. Names be unique within each AWS Region in your Lightsail account.
+* `availability_zone` - The Availability Zone in which to create your new database. Use the us-east-2a case-sensitive format.
+* `master_database_name` - (Required) The name of the master database created when the Lightsail database resource is created.
+* `master_password` - (Sensitive) The password for the master user of your new database. The password can include any printable ASCII character except "/", """, or "@".
+* `master_username` - The master user name for your new database.
+* `blueprint_id` - (Required) The blueprint ID for your new database. A blueprint describes the major engine version of a database. You can get a list of database blueprints IDs by using the AWS CLI command: `aws lightsail get-relational-database-blueprints`
+* `bundle_id` - (Required)  The bundle ID for your new database. A bundle describes the performance specifications for your database (see list below). You can get a list of database bundle IDs by using the AWS CLI command: `aws lightsail get-relational-database-bundles`.
+* `preferred_backup_window` - The daily time range during which automated backups are created for your new database if automated backups are enabled. Must be in the hh24:mi-hh24:mi format. Example: `16:00-16:30`. Specified in Coordinated Universal Time (UTC).
+* `preferred_maintenance_window` - The weekly time range during which system maintenance can occur on your new database. Must be in the ddd:hh24:mi-ddd:hh24:mi format. Specified in Coordinated Universal Time (UTC). Example: `Tue:17:00-Tue:17:30`
+* `publicly_accessible` - Specifies the accessibility options for your new database. A value of true specifies a database that is available to resources outside of your Lightsail account. A value of false specifies a database that is available only to your Lightsail resources in the same region as your database.
+* `apply_immediately` - When true , applies changes immediately. When false , applies changes during the preferred maintenance window. Some changes may cause an outage.
+* `backup_retention_enabled` - When true, enables automated backup retention for your database. When false, disables automated backup retention for your database. Disabling backup retention deletes all automated database backups. Before disabling this, you may want to create a snapshot of your database.
+* `skip_final_snapshot` - Determines whether a final database snapshot is created before your database is deleted. If true is specified, no database snapshot is created. If false is specified, a database snapshot is created before your database is deleted. You must specify the final relational database snapshot name parameter if the skip final snapshot parameter is false.
+* `final_snapshot_name` - (Required unless `skip_final_snapshot = true`) The name of the database snapshot created if skip final snapshot is false, which is the default value for that parameter.
+* `tags` - (Optional) A map of tags to assign to the resource. To create a key-only tag, use an empty string as the value.
+
+## Blueprint Ids
+
+A list of all available Lightsail Blueprints for Relational Databases the [aws lightsail get-relational-database-blueprints](https://docs.aws.amazon.com/cli/latest/reference/lightsail/get-relational-database-blueprints.html) aws cli command.
+
+### Examples
+
+- `mysql_8_0`
+- `postgres_12`
+
+### Prefix
+
+A Blueprint ID starts with a prefix of the engine type.
+
+### Suffix
+
+A Blueprint ID has a sufix of the engine version.
+
+## Bundles
+
+A list of all available Lightsail Bundles for Relational Databases the [aws lightsail get-relational-database-bundles](https://docs.aws.amazon.com/cli/latest/reference/lightsail/get-relational-database-bundles.html) aws cli command.
+
+### Examples
+
+- `small_1_0`
+- `small_ha_1_0`
+- `large_1_0`
+- `large_ha_1_0`
+
+### Prefix
+
+A Bundle ID starts with one of the below size prefixes:
+
+- `micro_`
+- `small_`
+- `medium_`
+- `large_`
+
+### Infixes (Optional for HA Database)
+
+A Bundle Id can have the following infix added in order to use the HA option of the selected bundle.
+
+- `ha_`
+
+### Suffix
+
+A Bundle ID ends with one of the following suffix: `1_0`
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ARN of the Lightsail instance (matches `arn`).
+* `arn` - The ARN of the Lightsail instance (matches `id`).
+* `ca_certificate_identifier` - The certificate associated with the database.
+* `created_at` - The timestamp when the instance was created.
+* `engine` - The database software (for example, MySQL).
+* `engine_version` - The database engine version (for example, 5.7.23).
+* `cpu_count` - The number of vCPUs for the database.
+* `ram_size` - The amount of RAM in GB for the database.
+* `disk_size` - The size of the disk for the database.
+* `master_endpoint_port` - The master endpoint network port for the database.
+* `master_endpoint_address` - The master endpoint fqdn for the database.
+* `secondary_availability_zone` - Describes the secondary Availability Zone of a high availability database. The secondary database is used for failover support of a high availability database.
+* `support_code` - The support code for the database. Include this code in your email to support when you have questions about a database in Lightsail. This code enables our support team to look up your Lightsail information more easily.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Lightsail Databases using their name. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Lightsail Databases using their name. For example:
+
+```console
+% terraform import aws_lightsail_database.foo 'bar'
+```
+
+<!-- cache-key: cdktf-0.18.0 input-c460ea904b2c519242690eaca4e01b78c0151a707412615588901072ae863f56 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/lightsail_disk.html.markdown b/website/docs/cdktf/python/r/lightsail_disk.html.markdown
new file mode 100644
index 00000000000..c95a7ff48a5
--- /dev/null
+++ b/website/docs/cdktf/python/r/lightsail_disk.html.markdown
@@ -0,0 +1,83 @@
+---
+subcategory: "Lightsail"
+layout: "aws"
+page_title: "AWS: aws_lightsail_disk"
+description: |-
+  Provides a Lightsail Disk resource
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lightsail_disk
+
+Provides a Lightsail Disk resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_availability_zones import DataAwsAvailabilityZones
+from imports.aws.lightsail_disk import LightsailDisk
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        available = DataAwsAvailabilityZones(self, "available",
+            filter=[DataAwsAvailabilityZonesFilter(
+                name="opt-in-status",
+                values=["opt-in-not-required"]
+            )
+            ],
+            state="available"
+        )
+        LightsailDisk(self, "test",
+            availability_zone=Token.as_string(Fn.lookup_nested(available.names, ["0"])),
+            name="test",
+            size_in_gb=8
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the Lightsail load balancer.
+* `size_in_gb` - (Required) The instance port the load balancer will connect.
+* `availability_zone` - (Required) The Availability Zone in which to create your disk.
+* `tags` - (Optional) A map of tags to assign to the resource. To create a key-only tag, use an empty string as the value. If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name of the disk  (matches `name`).
+* `arn` - The ARN of the Lightsail load balancer.
+* `created_at` - The timestamp when the load balancer was created.
+* `support_code` - The support code for the disk. Include this code in your email to support when you have questions about a disk in Lightsail. This code enables our support team to look up your Lightsail information more easily.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_lightsail_disk` using the name attribute. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_lightsail_disk` using the name attribute. For example:
+
+```console
+% terraform import aws_lightsail_disk.test test
+```
+
+<!-- cache-key: cdktf-0.18.0 input-7753e5e8b07d0ea697ccda6f53778fce21cb9f997c8e2dfbe4fb7552ab0ed771 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/lightsail_disk_attachment.html.markdown b/website/docs/cdktf/python/r/lightsail_disk_attachment.html.markdown
new file mode 100644
index 00000000000..0f954da5f03
--- /dev/null
+++ b/website/docs/cdktf/python/r/lightsail_disk_attachment.html.markdown
@@ -0,0 +1,95 @@
+---
+subcategory: "Lightsail"
+layout: "aws"
+page_title: "AWS: aws_lightsail_disk_attachment"
+description: |-
+  Attaches a Lightsail disk to a Lightsail Instance
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lightsail_disk_attachment
+
+Attaches a Lightsail disk to a Lightsail Instance
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_availability_zones import DataAwsAvailabilityZones
+from imports.aws.lightsail_disk import LightsailDisk
+from imports.aws.lightsail_disk_attachment import LightsailDiskAttachment
+from imports.aws.lightsail_instance import LightsailInstance
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        available = DataAwsAvailabilityZones(self, "available",
+            filter=[DataAwsAvailabilityZonesFilter(
+                name="opt-in-status",
+                values=["opt-in-not-required"]
+            )
+            ],
+            state="available"
+        )
+        test = LightsailDisk(self, "test",
+            availability_zone=Token.as_string(Fn.lookup_nested(available.names, ["0"])),
+            name="test-disk",
+            size_in_gb=8
+        )
+        aws_lightsail_instance_test = LightsailInstance(self, "test_2",
+            availability_zone=Token.as_string(Fn.lookup_nested(available.names, ["0"])),
+            blueprint_id="amazon_linux_2",
+            bundle_id="nano_1_0",
+            name="test-instance"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_lightsail_instance_test.override_logical_id("test")
+        aws_lightsail_disk_attachment_test = LightsailDiskAttachment(self, "test_3",
+            disk_name=test.name,
+            disk_path="/dev/xvdf",
+            instance_name=Token.as_string(aws_lightsail_instance_test.name)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_lightsail_disk_attachment_test.override_logical_id("test")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `disk_name` - (Required) The name of the Lightsail Disk.
+* `instance_name` - (Required) The name of the Lightsail Instance to attach to.
+* `disk_path` - (Required) The disk path to expose to the instance.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - A combination of attributes to create a unique id: `disk_name`,`instance_name`
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_lightsail_disk` using the id attribute. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_lightsail_disk` using the id attribute. For example:
+
+```console
+% terraform import aws_lightsail_disk_attachment.test test-disk,test-instance
+```
+
+<!-- cache-key: cdktf-0.18.0 input-8aa776f81865acd643ae2da7cb03aaafbc8afae9bb63c07ef0a52959cc6fe723 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/lightsail_distribution.html.markdown b/website/docs/cdktf/python/r/lightsail_distribution.html.markdown
new file mode 100644
index 00000000000..40ba73f557a
--- /dev/null
+++ b/website/docs/cdktf/python/r/lightsail_distribution.html.markdown
@@ -0,0 +1,306 @@
+---
+subcategory: "Lightsail"
+layout: "aws"
+page_title: "AWS: aws_lightsail_distribution"
+description: |-
+  Terraform resource for managing an AWS Lightsail Distribution.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lightsail_distribution
+
+Terraform resource for managing an AWS Lightsail Distribution.
+
+## Example Usage
+
+### Basic Usage
+
+Below is a basic example with a bucket as an origin.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.lightsail_bucket import LightsailBucket
+from imports.aws.lightsail_distribution import LightsailDistribution
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        test = LightsailBucket(self, "test",
+            bundle_id="small_1_0",
+            name="test-bucket"
+        )
+        aws_lightsail_distribution_test = LightsailDistribution(self, "test_1",
+            bundle_id="small_1_0",
+            cache_behavior_settings=LightsailDistributionCacheBehaviorSettings(
+                allowed_http_methods="GET,HEAD,OPTIONS,PUT,PATCH,POST,DELETE",
+                cached_http_methods="GET,HEAD",
+                default_ttl=86400,
+                forwarded_cookies=LightsailDistributionCacheBehaviorSettingsForwardedCookies(
+                    option="none"
+                ),
+                forwarded_headers=LightsailDistributionCacheBehaviorSettingsForwardedHeaders(
+                    option="default"
+                ),
+                forwarded_query_strings=LightsailDistributionCacheBehaviorSettingsForwardedQueryStrings(
+                    option=False
+                ),
+                maximum_ttl=31536000,
+                minimum_ttl=0
+            ),
+            default_cache_behavior=LightsailDistributionDefaultCacheBehavior(
+                behavior="cache"
+            ),
+            name="test-distribution",
+            origin=LightsailDistributionOrigin(
+                name=test.name,
+                region_name=test.region
+            )
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_lightsail_distribution_test.override_logical_id("test")
+```
+
+### instance origin example
+
+Below is an example of an instance as the origin.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_availability_zones import DataAwsAvailabilityZones
+from imports.aws.lightsail_distribution import LightsailDistribution
+from imports.aws.lightsail_instance import LightsailInstance
+from imports.aws.lightsail_static_ip import LightsailStaticIp
+from imports.aws.lightsail_static_ip_attachment import LightsailStaticIpAttachment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        test = LightsailStaticIp(self, "test",
+            name="test-static-ip"
+        )
+        available = DataAwsAvailabilityZones(self, "available",
+            filter=[DataAwsAvailabilityZonesFilter(
+                name="opt-in-status",
+                values=["opt-in-not-required"]
+            )
+            ],
+            state="available"
+        )
+        aws_lightsail_instance_test = LightsailInstance(self, "test_2",
+            availability_zone=Token.as_string(Fn.lookup_nested(available.names, ["0"])),
+            blueprint_id="amazon_linux_2",
+            bundle_id="micro_1_0",
+            name="test-instance"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_lightsail_instance_test.override_logical_id("test")
+        aws_lightsail_static_ip_attachment_test = LightsailStaticIpAttachment(self, "test_3",
+            instance_name=Token.as_string(aws_lightsail_instance_test.name),
+            static_ip_name=test.name
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_lightsail_static_ip_attachment_test.override_logical_id("test")
+        aws_lightsail_distribution_test = LightsailDistribution(self, "test_4",
+            bundle_id="small_1_0",
+            default_cache_behavior=LightsailDistributionDefaultCacheBehavior(
+                behavior="cache"
+            ),
+            depends_on=[aws_lightsail_static_ip_attachment_test],
+            name="test-distribution",
+            origin=LightsailDistributionOrigin(
+                name=Token.as_string(aws_lightsail_instance_test.name),
+                region_name=Token.as_string(available.id)
+            )
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_lightsail_distribution_test.override_logical_id("test")
+```
+
+### lb origin example
+
+Below is an example with a load balancer as an origin
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, Fn, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_availability_zones import DataAwsAvailabilityZones
+from imports.aws.lightsail_distribution import LightsailDistribution
+from imports.aws.lightsail_instance import LightsailInstance
+from imports.aws.lightsail_lb import LightsailLb
+from imports.aws.lightsail_lb_attachment import LightsailLbAttachment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        test = LightsailLb(self, "test",
+            health_check_path="/",
+            instance_port=Token.as_number("80"),
+            name="test-load-balancer",
+            tags={
+                "foo": "bar"
+            }
+        )
+        available = DataAwsAvailabilityZones(self, "available",
+            filter=[DataAwsAvailabilityZonesFilter(
+                name="opt-in-status",
+                values=["opt-in-not-required"]
+            )
+            ],
+            state="available"
+        )
+        aws_lightsail_instance_test = LightsailInstance(self, "test_2",
+            availability_zone=Token.as_string(Fn.lookup_nested(available.names, ["0"])),
+            blueprint_id="amazon_linux_2",
+            bundle_id="nano_1_0",
+            name="test-instance"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_lightsail_instance_test.override_logical_id("test")
+        aws_lightsail_lb_attachment_test = LightsailLbAttachment(self, "test_3",
+            instance_name=Token.as_string(aws_lightsail_instance_test.name),
+            lb_name=test.name
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_lightsail_lb_attachment_test.override_logical_id("test")
+        aws_lightsail_distribution_test = LightsailDistribution(self, "test_4",
+            bundle_id="small_1_0",
+            default_cache_behavior=LightsailDistributionDefaultCacheBehavior(
+                behavior="cache"
+            ),
+            depends_on=[aws_lightsail_lb_attachment_test],
+            name="test-distribution",
+            origin=LightsailDistributionOrigin(
+                name=test.name,
+                region_name=Token.as_string(available.id)
+            )
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_lightsail_distribution_test.override_logical_id("test")
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) Name of the distribution.
+* `bundle_id` - (Required) Bundle ID to use for the distribution.
+* `default_cache_behavior` - (Required) Object that describes the default cache behavior of the distribution. [Detailed below](#default_cache_behavior)
+* `origin` - (Required) Object that describes the origin resource of the distribution, such as a Lightsail instance, bucket, or load balancer. [Detailed below](#origin)
+* `cache_behavior_settings` - (Required) An object that describes the cache behavior settings of the distribution. [Detailed below](#cache_behavior_settings)
+
+The following arguments are optional:
+
+* `cache_behavior` - (Optional) A set of configuration blocks that describe the per-path cache behavior of the distribution. [Detailed below](#cache_behavior)
+* `certificate_name` - (Optional) The name of the SSL/TLS certificate attached to the distribution, if any.
+* `ip_address_type` - (Optional) The IP address type of the distribution. Default: `dualstack`.
+* `is_enabled` - (Optional) Indicates whether the distribution is enabled. Default: `true`.
+* `tags` - (Optional) Map of tags for the Lightsail Distribution. If
+  configured with a provider
+  [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block)
+  present, tags with matching keys will overwrite those defined at the provider-level.
+
+### default_cache_behavior
+
+* `behavior` - (Required) The cache behavior of the distribution. Valid values: `cache` and `dont-cache`.
+
+### origin
+
+* `name` - (Required) The name of the origin resource. Your origin can be an instance with an attached static IP, a bucket, or a load balancer that has at least one instance attached to it.
+* `protocol_policy` - (Optional) The protocol that your Amazon Lightsail distribution uses when establishing a connection with your origin to pull content.
+* `region_name` - (Required) The AWS Region name of the origin resource.
+* `resource_type` - (Computed) The resource type of the origin resource (e.g., Instance).
+
+### cache_behavior_settings
+
+* `allowed_http_methods` - (Optional) The HTTP methods that are processed and forwarded to the distribution's origin.
+* `cached_http_methods` - (Optional) The HTTP method responses that are cached by your distribution.
+* `default_ttl` - (Optional) The default amount of time that objects stay in the distribution's cache before the distribution forwards another request to the origin to determine whether the content has been updated.
+* `forwarded_cookies` - (Required) An object that describes the cookies that are forwarded to the origin. Your content is cached based on the cookies that are forwarded. [Detailed below](#forwarded_cookies)
+* `forwarded_headers` - (Required) An object that describes the headers that are forwarded to the origin. Your content is cached based on the headers that are forwarded. [Detailed below](#forwarded_headers)
+* `forwarded_query_strings` - (Required) An object that describes the query strings that are forwarded to the origin. Your content is cached based on the query strings that are forwarded. [Detailed below](#forwarded_query_strings)
+* `maximum_ttl` - (Optional) The maximum amount of time that objects stay in the distribution's cache before the distribution forwards another request to the origin to determine whether the object has been updated.
+* `minimum_ttl` - (Optional) The minimum amount of time that objects stay in the distribution's cache before the distribution forwards another request to the origin to determine whether the object has been updated.
+
+#### forwarded_cookies
+
+* `cookies_allow_list` - (Required) The specific cookies to forward to your distribution's origin.
+* `option` - (Optional) Specifies which cookies to forward to the distribution's origin for a cache behavior: all, none, or allow-list to forward only the cookies specified in the cookiesAllowList parameter.
+
+#### forwarded_headers
+
+* `headers_allow_list` - (Required) The specific headers to forward to your distribution's origin.
+* `option` - (Optional) The headers that you want your distribution to forward to your origin and base caching on.
+
+#### forwarded_query_strings
+
+* `option` - (Optional) Indicates whether the distribution forwards and caches based on query strings.
+* `query_strings_allowed_list` - (Required) The specific query strings that the distribution forwards to the origin.
+
+### cache_behavior
+
+* `behavior` - (Required) The cache behavior for the specified path.
+* `path` - (Required) The path to a directory or file to cached, or not cache. Use an asterisk symbol to specify wildcard directories (path/to/assets/\*), and file types (\*.html, \*jpg, \*js). Directories and file paths are case-sensitive.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `alternative_domain_names` - The alternate domain names of the distribution.
+* `arn` - The Amazon Resource Name (ARN) of the distribution.
+* `created_at` - The timestamp when the distribution was created.
+* `domain_name` - The domain name of the distribution.
+* `location` - An object that describes the location of the distribution, such as the AWS Region and Availability Zone. [Detailed below](#location)
+* `origin_public_dns` - The public DNS of the origin.
+* `resource_type` - The Lightsail resource type (e.g., Distribution).
+* `status` - The status of the distribution.
+* `support_code` - The support code. Include this code in your email to support when you have questions about your Lightsail distribution. This code enables our support team to look up your Lightsail information more easily.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+### location
+
+* `availability_zone` - The Availability Zone. Follows the format us-east-2a (case-sensitive).
+* `region_name` - The AWS Region name.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `60m`)
+* `update` - (Default `180m`)
+* `delete` - (Default `90m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Lightsail Distribution using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Lightsail Distribution using the `id`. For example:
+
+```console
+% terraform import aws_lightsail_distribution.example rft-8012925589
+```
+
+<!-- cache-key: cdktf-0.18.0 input-b44e08c4566f08d2f501b30c7bf2c5324fc78fc14f7f0e7e555cd7b0bc5ae99f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/lightsail_domain.html.markdown b/website/docs/cdktf/python/r/lightsail_domain.html.markdown
new file mode 100644
index 00000000000..7ed75985bff
--- /dev/null
+++ b/website/docs/cdktf/python/r/lightsail_domain.html.markdown
@@ -0,0 +1,53 @@
+---
+subcategory: "Lightsail"
+layout: "aws"
+page_title: "AWS: aws_lightsail_domain"
+description: |-
+  Provides an Lightsail Domain
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lightsail_domain
+
+Creates a domain resource for the specified domain (e.g., example.com).
+You cannot register a new domain name using Lightsail. You must register
+a domain name using Amazon Route 53 or another domain name registrar.
+If you have already registered your domain, you can enter its name in
+this parameter to manage the DNS records for that domain.
+
+~> **Note:** Lightsail is currently only supported in a limited number of AWS Regions, please see ["Regions and Availability Zones in Amazon Lightsail"](https://lightsail.aws.amazon.com/ls/docs/overview/article/understanding-regions-and-availability-zones-in-amazon-lightsail) for more details
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.lightsail_domain import LightsailDomain
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        LightsailDomain(self, "domain_test",
+            domain_name="mydomain.com"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `domain_name` - (Required) The name of the Lightsail domain to manage
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name used for this domain
+* `arn` - The ARN of the Lightsail domain
+
+<!-- cache-key: cdktf-0.18.0 input-ffbbbe97ecce19529f1dc27d99e86dc419c73490e72176bbf4fd342ce0c31d6d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/lightsail_domain_entry.html.markdown b/website/docs/cdktf/python/r/lightsail_domain_entry.html.markdown
new file mode 100644
index 00000000000..7e52c5a8652
--- /dev/null
+++ b/website/docs/cdktf/python/r/lightsail_domain_entry.html.markdown
@@ -0,0 +1,80 @@
+---
+subcategory: "Lightsail"
+layout: "aws"
+page_title: "AWS: aws_lightsail_domain_entry"
+description: |-
+  Provides an Lightsail Domain Entry
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lightsail_domain_entry
+
+Creates a domain entry resource
+
+~> **NOTE on `id`:** In an effort to simplify imports, this resource `id` field has been updated to the standard resource id separator, a comma (`,`). For backward compatibility, the previous separator (underscore `_`) can still be used to read and import existing resources. When state is refreshed, the `id` will be updated to use the new standard separator. The previous separator will be deprecated in a future major release.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.lightsail_domain import LightsailDomain
+from imports.aws.lightsail_domain_entry import LightsailDomainEntry
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        LightsailDomain(self, "test",
+            domain_name="mydomain.com"
+        )
+        aws_lightsail_domain_entry_test = LightsailDomainEntry(self, "test_1",
+            domain_name=domain_test.domain_name,
+            name="www",
+            target="127.0.0.1",
+            type="A"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_lightsail_domain_entry_test.override_logical_id("test")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `domain_name` - (Required) The name of the Lightsail domain in which to create the entry
+* `name` - (Required) Name of the entry record
+* `type` - (Required) Type of record
+* `target` - (Required) Target of the domain entry
+* `is_alias` - (Optional) If the entry should be an alias Defaults to `false`
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - A combination of attributes to create a unique id: `name`,`domain_name`,`type`,`target`
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_lightsail_domain_entry` using the id attribute. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_lightsail_domain_entry` using the id attribute. For example:
+
+```console
+% terraform import aws_lightsail_domain_entry.example www,mydomain.com,A,127.0.0.1
+```
+
+<!-- cache-key: cdktf-0.18.0 input-5611067be5b2911c504ce2dd0c0db39671077d1db16f1803538d003af55e4cb1 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/lightsail_instance.html.markdown b/website/docs/cdktf/python/r/lightsail_instance.html.markdown
new file mode 100644
index 00000000000..6fd876c2757
--- /dev/null
+++ b/website/docs/cdktf/python/r/lightsail_instance.html.markdown
@@ -0,0 +1,213 @@
+---
+subcategory: "Lightsail"
+layout: "aws"
+page_title: "AWS: aws_lightsail_instance"
+description: |-
+  Provides an Lightsail Instance
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lightsail_instance
+
+Provides a Lightsail Instance. Amazon Lightsail is a service to provide easy virtual private servers
+with custom software already setup. See [What is Amazon Lightsail?](https://lightsail.aws.amazon.com/ls/docs/getting-started/article/what-is-amazon-lightsail)
+for more information.
+
+~> **Note:** Lightsail is currently only supported in a limited number of AWS Regions, please see ["Regions and Availability Zones in Amazon Lightsail"](https://lightsail.aws.amazon.com/ls/docs/overview/article/understanding-regions-and-availability-zones-in-amazon-lightsail) for more details
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.lightsail_instance import LightsailInstance
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        LightsailInstance(self, "gitlab_test",
+            availability_zone="us-east-1b",
+            blueprint_id="amazon_linux_2",
+            bundle_id="nano_1_0",
+            key_pair_name="some_key_name",
+            name="custom_gitlab",
+            tags={
+                "foo": "bar"
+            }
+        )
+```
+
+### Example With User Data
+
+Lightsail user data is handled differently than ec2 user data. Lightsail user data only accepts a single lined string. The below example shows installing apache and creating the index page.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.lightsail_instance import LightsailInstance
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        LightsailInstance(self, "custom",
+            availability_zone="us-east-1b",
+            blueprint_id="amazon_linux_2",
+            bundle_id="nano_1_0",
+            name="custom",
+            user_data="sudo yum install -y httpd && sudo systemctl start httpd && sudo systemctl enable httpd && echo '<h1>Deployed via Terraform</h1>' | sudo tee /var/www/html/index.html"
+        )
+```
+
+### Enable Auto Snapshots
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.lightsail_instance import LightsailInstance
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        LightsailInstance(self, "test",
+            add_on=LightsailInstanceAddOn(
+                snapshot_time="06:00",
+                status="Enabled",
+                type="AutoSnapshot"
+            ),
+            availability_zone="us-east-1b",
+            blueprint_id="amazon_linux_2",
+            bundle_id="nano_1_0",
+            name="custom_instance",
+            tags={
+                "foo": "bar"
+            }
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the Lightsail Instance. Names be unique within each AWS Region in your Lightsail account.
+* `availability_zone` - (Required) The Availability Zone in which to create your
+instance (see list below)
+* `blueprint_id` - (Required) The ID for a virtual private server image. A list of available blueprint IDs can be obtained using the AWS CLI command: `aws lightsail get-blueprints`
+* `bundle_id` - (Required) The bundle of specification information (see list below)
+* `key_pair_name` - (Optional) The name of your key pair. Created in the
+Lightsail console (cannot use `aws_key_pair` at this time)
+* `user_data` - (Optional) Single lined launch script as a string to configure server with additional user data
+* `ip_address_type` - (Optional) The IP address type of the Lightsail Instance. Valid Values: `dualstack` | `ipv4`.
+* `add_on` - (Optional) The add on configuration for the instance. [Detailed below](#add_on).
+* `tags` - (Optional) A map of tags to assign to the resource. To create a key-only tag, use an empty string as the value. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### `add_on`
+
+Defines the add on configuration for the instance. The `add_on` configuration block supports the following arguments:
+
+* `type` - (Required) The add-on type. There is currently only one valid type `AutoSnapshot`.
+* `snapshot_time` - (Required) The daily time when an automatic snapshot will be created. Must be in HH:00 format, and in an hourly increment and specified in Coordinated Universal Time (UTC). The snapshot will be automatically created between the time specified and up to 45 minutes after.
+* `status` - (Required) The status of the add on. Valid Values: `Enabled`, `Disabled`.
+
+## Availability Zones
+
+Lightsail currently supports the following Availability Zones (e.g., `us-east-1a`):
+
+- `ap-northeast-1{a,c,d}`
+- `ap-northeast-2{a,c}`
+- `ap-south-1{a,b}`
+- `ap-southeast-1{a,b,c}`
+- `ap-southeast-2{a,b,c}`
+- `ca-central-1{a,b}`
+- `eu-central-1{a,b,c}`
+- `eu-west-1{a,b,c}`
+- `eu-west-2{a,b,c}`
+- `eu-west-3{a,b,c}`
+- `us-east-1{a,b,c,d,e,f}`
+- `us-east-2{a,b,c}`
+- `us-west-2{a,b,c}`
+
+## Bundles
+
+Lightsail currently supports the following Bundle IDs (e.g., an instance in `ap-northeast-1` would use `small_2_0`):
+
+### Prefix
+
+A Bundle ID starts with one of the below size prefixes:
+
+- `nano_`
+- `micro_`
+- `small_`
+- `medium_`
+- `large_`
+- `xlarge_`
+- `2xlarge_`
+
+### Suffix
+
+A Bundle ID ends with one of the following suffixes depending on Availability Zone:
+
+- ap-northeast-1: `2_0`
+- ap-northeast-2: `2_0`
+- ap-south-1: `2_1`
+- ap-southeast-1: `2_0`
+- ap-southeast-2: `2_2`
+- ca-central-1: `2_0`
+- eu-central-1: `2_0`
+- eu-west-1: `2_0`
+- eu-west-2: `2_0`
+- eu-west-3: `2_0`
+- us-east-1: `2_0`
+- us-east-2: `2_0`
+- us-west-2: `2_0`
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ARN of the Lightsail instance (matches `arn`).
+* `arn` - The ARN of the Lightsail instance (matches `id`).
+* `created_at` - The timestamp when the instance was created.
+* `cpu_count` - The number of vCPUs the instance has.
+* `ram_size` - The amount of RAM in GB on the instance (e.g., 1.0).
+* `ipv6_addresses` - List of IPv6 addresses for the Lightsail instance.
+* `private_ip_address` - The private IP address of the instance.
+* `public_ip_address` - The public IP address of the instance.
+* `is_static_ip` - A Boolean value indicating whether this instance has a static IP assigned to it.
+* `username` - The user name for connecting to the instance (e.g., ec2-user).
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Lightsail Instances using their name. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Lightsail Instances using their name. For example:
+
+```console
+% terraform import aws_lightsail_instance.gitlab_test 'custom_gitlab'
+```
+
+<!-- cache-key: cdktf-0.18.0 input-e45f06a6953879f3cfd81982aebd4f0e53550836431aaac4a1538503c4509c48 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/lightsail_instance_public_ports.html.markdown b/website/docs/cdktf/python/r/lightsail_instance_public_ports.html.markdown
new file mode 100644
index 00000000000..3c7552415e5
--- /dev/null
+++ b/website/docs/cdktf/python/r/lightsail_instance_public_ports.html.markdown
@@ -0,0 +1,80 @@
+---
+subcategory: "Lightsail"
+layout: "aws"
+page_title: "AWS: aws_lightsail_instance_public_ports"
+description: |-
+  Provides an Lightsail Instance
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lightsail_instance_public_ports
+
+Opens ports for a specific Amazon Lightsail instance, and specifies the IP addresses allowed to connect to the instance through the ports, and the protocol.
+
+-> See [What is Amazon Lightsail?](https://lightsail.aws.amazon.com/ls/docs/getting-started/article/what-is-amazon-lightsail) for more information.
+
+~> **Note:** Lightsail is currently only supported in a limited number of AWS Regions, please see ["Regions and Availability Zones in Amazon Lightsail"](https://lightsail.aws.amazon.com/ls/docs/overview/article/understanding-regions-and-availability-zones-in-amazon-lightsail) for more details.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.lightsail_instance import LightsailInstance
+from imports.aws.lightsail_instance_public_ports import LightsailInstancePublicPorts
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        test = LightsailInstance(self, "test",
+            availability_zone=Token.as_string(Fn.lookup_nested(available.names, ["0"])),
+            blueprint_id="amazon_linux_2",
+            bundle_id="nano_1_0",
+            name="yak_sail"
+        )
+        aws_lightsail_instance_public_ports_test =
+        LightsailInstancePublicPorts(self, "test_1",
+            instance_name=test.name,
+            port_info=[LightsailInstancePublicPortsPortInfo(
+                from_port=80,
+                protocol="tcp",
+                to_port=80
+            )
+            ]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_lightsail_instance_public_ports_test.override_logical_id("test")
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `instance_name` - (Required) Name of the Lightsail Instance.
+* `port_info` - (Required) Configuration block with port information. AWS closes all currently open ports that are not included in the `port_info`. Detailed below.
+
+### port_info
+
+The following arguments are required:
+
+* `from_port` - (Required) First port in a range of open ports on an instance.
+* `protocol` - (Required) IP protocol name. Valid values are `tcp`, `all`, `udp`, and `icmp`.
+* `to_port` - (Required) Last port in a range of open ports on an instance.
+
+The following arguments are optional:
+
+* `cidrs` - (Optional) Set of CIDR blocks.
+* `cidr_list_aliases` - (Optional) Set of CIDR aliases that define access for a preconfigured range of IP addresses.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the resource.
+
+<!-- cache-key: cdktf-0.18.0 input-e75c0ed1fb7d870f438bb0070ff3f05dfd9b9a1c05192739f74b37a508a5e0f0 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/lightsail_key_pair.html.markdown b/website/docs/cdktf/python/r/lightsail_key_pair.html.markdown
new file mode 100644
index 00000000000..70dc1e22027
--- /dev/null
+++ b/website/docs/cdktf/python/r/lightsail_key_pair.html.markdown
@@ -0,0 +1,107 @@
+---
+subcategory: "Lightsail"
+layout: "aws"
+page_title: "AWS: aws_lightsail_key_pair"
+description: |-
+  Provides an Lightsail Key Pair
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lightsail_key_pair
+
+Provides a Lightsail Key Pair, for use with Lightsail Instances. These key pairs
+are separate from EC2 Key Pairs, and must be created or imported for use with
+Lightsail.
+
+~> **Note:** Lightsail is currently only supported in a limited number of AWS Regions, please see ["Regions and Availability Zones in Amazon Lightsail"](https://lightsail.aws.amazon.com/ls/docs/overview/article/understanding-regions-and-availability-zones-in-amazon-lightsail) for more details
+
+## Example Usage
+
+### Create New Key Pair
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.lightsail_key_pair import LightsailKeyPair
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        LightsailKeyPair(self, "lg_key_pair",
+            name="lg_key_pair"
+        )
+```
+
+### Create New Key Pair with PGP Encrypted Private Key
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.lightsail_key_pair import LightsailKeyPair
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        LightsailKeyPair(self, "lg_key_pair",
+            name="lg_key_pair",
+            pgp_key="keybase:keybaseusername"
+        )
+```
+
+### Existing Public Key Import
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.lightsail_key_pair import LightsailKeyPair
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        LightsailKeyPair(self, "lg_key_pair",
+            name="importing",
+            public_key=Token.as_string(Fn.file("~/.ssh/id_rsa.pub"))
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Optional) The name of the Lightsail Key Pair. If omitted, a unique name will be generated by Terraform
+* `pgp_key` – (Optional) An optional PGP key to encrypt the resulting private key material. Only used when creating a new key pair
+* `public_key` - (Required) The public key material. This public key will be imported into Lightsail
+* `tags` - (Optional) A map of tags to assign to the collection. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+~> **NOTE:** a PGP key is not required, however it is strongly encouraged. Without a PGP key, the private key material will be stored in state unencrypted.`pgp_key` is ignored if `public_key` is supplied.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name used for this key pair.
+* `arn` - The ARN of the Lightsail key pair.
+* `encrypted_fingerprint` - The MD5 public key fingerprint for the encrypted private key.
+* `encrypted_private_key` – the private key material, base 64 encoded and encrypted with the given `pgp_key`. This is only populated when creating a new key and `pgp_key` is supplied.
+* `fingerprint` - The MD5 public key fingerprint as specified in section 4 of RFC 4716.
+* `public_key` - the public key, base64 encoded.
+* `private_key` - the private key, base64 encoded. This is only populated when creating a new key, and when no `pgp_key` is provided.
+
+## Import
+
+You cannot import Lightsail Key Pairs because the private and public key are only available on initial creation.
+
+<!-- cache-key: cdktf-0.18.0 input-8cae2556d64f4771d82c095c044dbe70b70e276ad81327c6dbb63347ff51050b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/lightsail_lb.html.markdown b/website/docs/cdktf/python/r/lightsail_lb.html.markdown
new file mode 100644
index 00000000000..a708aa0422c
--- /dev/null
+++ b/website/docs/cdktf/python/r/lightsail_lb.html.markdown
@@ -0,0 +1,80 @@
+---
+subcategory: "Lightsail"
+layout: "aws"
+page_title: "AWS: aws_lightsail_lb"
+description: |-
+  Provides a Lightsail Load Balancer
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lightsail_lb
+
+Creates a Lightsail load balancer resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.lightsail_lb import LightsailLb
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        LightsailLb(self, "test",
+            health_check_path="/",
+            instance_port=Token.as_number("80"),
+            name="test-load-balancer",
+            tags={
+                "foo": "bar"
+            }
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the Lightsail load balancer.
+* `instance_port` - (Required) The instance port the load balancer will connect.
+* `health_check_path` - (Optional) The health check path of the load balancer. Default value "/".
+* `tags` - (Optional) A map of tags to assign to the resource. To create a key-only tag, use an empty string as the value. If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name used for this load balancer (matches `name`).
+* `arn` - The ARN of the Lightsail load balancer.
+* `created_at` - The timestamp when the load balancer was created.
+* `dns_name` - The DNS name of the load balancer.
+* `protocol` - The protocol of the load balancer.
+* `public_ports` - The public ports of the load balancer.
+* `support_code` - The support code for the database. Include this code in your email to support when you have questions about a database in Lightsail. This code enables our support team to look up your Lightsail information more easily.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_lightsail_lb` using the name attribute. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_lightsail_lb` using the name attribute. For example:
+
+```console
+% terraform import aws_lightsail_lb.test example-load-balancer
+```
+
+<!-- cache-key: cdktf-0.18.0 input-557398008915861f1ead6c5648ac53e7bb70a90ed6370793a6f6d0800c69290d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/lightsail_lb_attachment.html.markdown b/website/docs/cdktf/python/r/lightsail_lb_attachment.html.markdown
new file mode 100644
index 00000000000..e373b43fab9
--- /dev/null
+++ b/website/docs/cdktf/python/r/lightsail_lb_attachment.html.markdown
@@ -0,0 +1,96 @@
+---
+subcategory: "Lightsail"
+layout: "aws"
+page_title: "AWS: aws_lightsail_lb_attachment"
+description: |-
+  Attaches a Lightsail Instance to a Lightsail Load Balancer
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lightsail_lb_attachment
+
+Attaches a Lightsail Instance to a Lightsail Load Balancer.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, Fn, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_availability_zones import DataAwsAvailabilityZones
+from imports.aws.lightsail_instance import LightsailInstance
+from imports.aws.lightsail_lb import LightsailLb
+from imports.aws.lightsail_lb_attachment import LightsailLbAttachment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        test = LightsailLb(self, "test",
+            health_check_path="/",
+            instance_port=Token.as_number("80"),
+            name="test-load-balancer",
+            tags={
+                "foo": "bar"
+            }
+        )
+        available = DataAwsAvailabilityZones(self, "available",
+            filter=[DataAwsAvailabilityZonesFilter(
+                name="opt-in-status",
+                values=["opt-in-not-required"]
+            )
+            ],
+            state="available"
+        )
+        aws_lightsail_instance_test = LightsailInstance(self, "test_2",
+            availability_zone=Token.as_string(Fn.lookup_nested(available.names, ["0"])),
+            blueprint_id="amazon_linux_2",
+            bundle_id="nano_1_0",
+            name="test-instance"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_lightsail_instance_test.override_logical_id("test")
+        aws_lightsail_lb_attachment_test = LightsailLbAttachment(self, "test_3",
+            instance_name=Token.as_string(aws_lightsail_instance_test.name),
+            lb_name=test.name
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_lightsail_lb_attachment_test.override_logical_id("test")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `lb_name` - (Required) The name of the Lightsail load balancer.
+* `instance_name` - (Required) The name of the instance to attach to the load balancer.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - A combination of attributes to create a unique id: `lb_name`,`instance_name`
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_lightsail_lb_attachment` using the name attribute. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_lightsail_lb_attachment` using the name attribute. For example:
+
+```console
+% terraform import aws_lightsail_lb_attachment.test example-load-balancer,example-instance
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1f5a78fef900db643827102ff8c8ece3850d79f4a93a4cdfb83fba4a5ff25956 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/lightsail_lb_certificate.html.markdown b/website/docs/cdktf/python/r/lightsail_lb_certificate.html.markdown
new file mode 100644
index 00000000000..e98bf2c4359
--- /dev/null
+++ b/website/docs/cdktf/python/r/lightsail_lb_certificate.html.markdown
@@ -0,0 +1,85 @@
+---
+subcategory: "Lightsail"
+layout: "aws"
+page_title: "AWS: aws_lightsail_lb_certificate"
+description: |-
+  Provides a Lightsail Load Balancer
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lightsail_lb_certificate
+
+Creates a Lightsail load balancer Certificate resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.lightsail_lb import LightsailLb
+from imports.aws.lightsail_lb_certificate import LightsailLbCertificate
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        test = LightsailLb(self, "test",
+            health_check_path="/",
+            instance_port=Token.as_number("80"),
+            name="test-load-balancer",
+            tags={
+                "foo": "bar"
+            }
+        )
+        aws_lightsail_lb_certificate_test = LightsailLbCertificate(self, "test_1",
+            domain_name="test.com",
+            lb_name=test.id,
+            name="test-load-balancer-certificate"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_lightsail_lb_certificate_test.override_logical_id("test")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `domain_name` - (Required) The domain name (e.g., example.com) for your SSL/TLS certificate.
+* `lb_name` - (Required) The load balancer name where you want to create the SSL/TLS certificate.
+* `name` - (Required) The SSL/TLS certificate name.
+* `name` - (Required) The SSL/TLS certificate name.
+* `subject_alternative_names` - (Optional) Set of domains that should be SANs in the issued certificate. `domain_name` attribute is automatically added as a Subject Alternative Name.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - A combination of attributes to create a unique id: `lb_name`,`name`
+* `arn` - The ARN of the lightsail certificate.
+* `created_at` - The timestamp when the instance was created.
+* `domain_validation_options` - Set of domain validation objects which can be used to complete certificate validation. Can have more than one element, e.g., if SANs are defined.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_lightsail_lb_certificate` using the id attribute. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_lightsail_lb_certificate` using the id attribute. For example:
+
+```console
+% terraform import aws_lightsail_lb_certificate.test example-load-balancer,example-load-balancer-certificate
+```
+
+<!-- cache-key: cdktf-0.18.0 input-6dd7f018be5db76314b7c107cdfa92a9e683d7eb41cf67a52fae3873bec4f0c6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/lightsail_lb_certificate_attachment.html.markdown b/website/docs/cdktf/python/r/lightsail_lb_certificate_attachment.html.markdown
new file mode 100644
index 00000000000..069be0d4d98
--- /dev/null
+++ b/website/docs/cdktf/python/r/lightsail_lb_certificate_attachment.html.markdown
@@ -0,0 +1,87 @@
+---
+subcategory: "Lightsail"
+layout: "aws"
+page_title: "AWS: aws_lightsail_lb_certificate_attachment"
+description: |-
+  Attaches a Lightsail Load Balancer Certificate to a Lightsail Load Balancer
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lightsail_lb_certificate_attachment
+
+Attaches a Lightsail Load Balancer Certificate to a Lightsail Load Balancer.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.lightsail_lb import LightsailLb
+from imports.aws.lightsail_lb_certificate import LightsailLbCertificate
+from imports.aws.lightsail_lb_certificate_attachment import LightsailLbCertificateAttachment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        test = LightsailLb(self, "test",
+            health_check_path="/",
+            instance_port=Token.as_number("80"),
+            name="test-load-balancer",
+            tags={
+                "foo": "bar"
+            }
+        )
+        aws_lightsail_lb_certificate_test = LightsailLbCertificate(self, "test_1",
+            domain_name="test.com",
+            lb_name=test.id,
+            name="test-load-balancer-certificate"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_lightsail_lb_certificate_test.override_logical_id("test")
+        aws_lightsail_lb_certificate_attachment_test =
+        LightsailLbCertificateAttachment(self, "test_2",
+            certificate_name=Token.as_string(aws_lightsail_lb_certificate_test.name),
+            lb_name=test.name
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_lightsail_lb_certificate_attachment_test.override_logical_id("test")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `lb_name` - (Required) The name of the load balancer to which you want to associate the SSL/TLS certificate.
+* `certificate_name` - (Required) The name of your SSL/TLS certificate.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - A combination of attributes to create a unique id: `lb_name`,`certificate_name`
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_lightsail_lb_certificate_attachment` using the name attribute. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_lightsail_lb_certificate_attachment` using the name attribute. For example:
+
+```console
+% terraform import aws_lightsail_lb_certificate_attachment.test example-load-balancer,example-certificate
+```
+
+<!-- cache-key: cdktf-0.18.0 input-e1b37be33554c8bddba19e3fcbe7cf21f86639e8dfc8c4cce57fb7c7d7bf6028 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/lightsail_lb_https_redirection_policy.html.markdown b/website/docs/cdktf/python/r/lightsail_lb_https_redirection_policy.html.markdown
new file mode 100644
index 00000000000..46af1065396
--- /dev/null
+++ b/website/docs/cdktf/python/r/lightsail_lb_https_redirection_policy.html.markdown
@@ -0,0 +1,95 @@
+---
+subcategory: "Lightsail"
+layout: "aws"
+page_title: "AWS: aws_lightsail_lb_https_redirection_policy"
+description: |-
+  Configures Https Redirection for a Lightsail Load Balancer
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lightsail_lb_https_redirection_policy
+
+Configures Https Redirection for a Lightsail Load Balancer. A valid Certificate must be attached to the load balancer in order to enable https redirection.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.lightsail_lb import LightsailLb
+from imports.aws.lightsail_lb_certificate import LightsailLbCertificate
+from imports.aws.lightsail_lb_certificate_attachment import LightsailLbCertificateAttachment
+from imports.aws.lightsail_lb_https_redirection_policy import LightsailLbHttpsRedirectionPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        test = LightsailLb(self, "test",
+            health_check_path="/",
+            instance_port=Token.as_number("80"),
+            name="test-load-balancer",
+            tags={
+                "foo": "bar"
+            }
+        )
+        aws_lightsail_lb_certificate_test = LightsailLbCertificate(self, "test_1",
+            domain_name="test.com",
+            lb_name=test.id,
+            name="test-load-balancer-certificate"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_lightsail_lb_certificate_test.override_logical_id("test")
+        aws_lightsail_lb_certificate_attachment_test =
+        LightsailLbCertificateAttachment(self, "test_2",
+            certificate_name=Token.as_string(aws_lightsail_lb_certificate_test.name),
+            lb_name=test.name
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_lightsail_lb_certificate_attachment_test.override_logical_id("test")
+        aws_lightsail_lb_https_redirection_policy_test =
+        LightsailLbHttpsRedirectionPolicy(self, "test_3",
+            enabled=True,
+            lb_name=test.name
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_lightsail_lb_https_redirection_policy_test.override_logical_id("test")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `lb_name` - (Required) The name of the load balancer to which you want to enable http to https redirection.
+* `enabled` - (Required) - The Https Redirection state of the load balancer. `true` to activate http to https redirection or `false` to deactivate http to https redirection.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name used for this load balancer (matches `lb_name`).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_lightsail_lb_https_redirection_policy` using the `lb_name` attribute. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_lightsail_lb_https_redirection_policy` using the `lb_name` attribute. For example:
+
+```console
+% terraform import aws_lightsail_lb_https_redirection_policy.test example-load-balancer
+```
+
+<!-- cache-key: cdktf-0.18.0 input-096d2aad822770675cf0db37d9363ce16e54bc7144846d6f81441f5de8d7d74a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/lightsail_lb_stickiness_policy.html.markdown b/website/docs/cdktf/python/r/lightsail_lb_stickiness_policy.html.markdown
new file mode 100644
index 00000000000..ae748fe7dcd
--- /dev/null
+++ b/website/docs/cdktf/python/r/lightsail_lb_stickiness_policy.html.markdown
@@ -0,0 +1,80 @@
+---
+subcategory: "Lightsail"
+layout: "aws"
+page_title: "AWS: aws_lightsail_lb_stickiness_policy"
+description: |-
+  Configures Session Stickiness for a Lightsail Load Balancer
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lightsail_lb_stickiness_policy
+
+Configures Session Stickiness for a Lightsail Load Balancer.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.lightsail_lb import LightsailLb
+from imports.aws.lightsail_lb_stickiness_policy import LightsailLbStickinessPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        test = LightsailLb(self, "test",
+            health_check_path="/",
+            instance_port=Token.as_number("80"),
+            name="test-load-balancer",
+            tags={
+                "foo": "bar"
+            }
+        )
+        aws_lightsail_lb_stickiness_policy_test = LightsailLbStickinessPolicy(self, "test_1",
+            cookie_duration=900,
+            enabled=True,
+            lb_name=test.name
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_lightsail_lb_stickiness_policy_test.override_logical_id("test")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `lb_name` - (Required) The name of the load balancer to which you want to enable session stickiness.
+* `cookie_duration` - (Required) The cookie duration in seconds. This determines the length of the session stickiness.
+* `enabled` - (Required) - The Session Stickiness state of the load balancer. `true` to activate session stickiness or `false` to deactivate session stickiness.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name used for this load balancer (matches `lb_name`).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_lightsail_lb_stickiness_policy` using the `lb_name` attribute. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_lightsail_lb_stickiness_policy` using the `lb_name` attribute. For example:
+
+```console
+% terraform import aws_lightsail_lb_stickiness_policy.test example-load-balancer
+```
+
+<!-- cache-key: cdktf-0.18.0 input-d81e14735db5f79619a49663b9e62b0556328959a952750a838262d10f6383c5 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/lightsail_static_ip.html.markdown b/website/docs/cdktf/python/r/lightsail_static_ip.html.markdown
new file mode 100644
index 00000000000..41cd28631aa
--- /dev/null
+++ b/website/docs/cdktf/python/r/lightsail_static_ip.html.markdown
@@ -0,0 +1,50 @@
+---
+subcategory: "Lightsail"
+layout: "aws"
+page_title: "AWS: aws_lightsail_static_ip"
+description: |-
+  Provides an Lightsail Static IP
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lightsail_static_ip
+
+Allocates a static IP address.
+
+~> **Note:** Lightsail is currently only supported in a limited number of AWS Regions, please see ["Regions and Availability Zones in Amazon Lightsail"](https://lightsail.aws.amazon.com/ls/docs/overview/article/understanding-regions-and-availability-zones-in-amazon-lightsail) for more details
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.lightsail_static_ip import LightsailStaticIp
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        LightsailStaticIp(self, "test",
+            name="example"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name for the allocated static IP
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the Lightsail static IP
+* `ip_address` - The allocated static IP address
+* `support_code` - The support code.
+
+<!-- cache-key: cdktf-0.18.0 input-ceefb04cc23d9c3d23bf8796be65f2fc424fa275759d495af1748286debe2c54 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/lightsail_static_ip_attachment.html.markdown b/website/docs/cdktf/python/r/lightsail_static_ip_attachment.html.markdown
new file mode 100644
index 00000000000..fe99c095f3f
--- /dev/null
+++ b/website/docs/cdktf/python/r/lightsail_static_ip_attachment.html.markdown
@@ -0,0 +1,66 @@
+---
+subcategory: "Lightsail"
+layout: "aws"
+page_title: "AWS: aws_lightsail_static_ip_attachment"
+description: |-
+  Provides an Lightsail Static IP Attachment
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lightsail_static_ip_attachment
+
+Provides a static IP address attachment - relationship between a Lightsail static IP & Lightsail instance.
+
+~> **Note:** Lightsail is currently only supported in a limited number of AWS Regions, please see ["Regions and Availability Zones in Amazon Lightsail"](https://lightsail.aws.amazon.com/ls/docs/overview/article/understanding-regions-and-availability-zones-in-amazon-lightsail) for more details
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.lightsail_instance import LightsailInstance
+from imports.aws.lightsail_static_ip import LightsailStaticIp
+from imports.aws.lightsail_static_ip_attachment import LightsailStaticIpAttachment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        test = LightsailInstance(self, "test",
+            availability_zone="us-east-1b",
+            blueprint_id="string",
+            bundle_id="string",
+            key_pair_name="some_key_name",
+            name="example"
+        )
+        aws_lightsail_static_ip_test = LightsailStaticIp(self, "test_1",
+            name="example"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_lightsail_static_ip_test.override_logical_id("test")
+        aws_lightsail_static_ip_attachment_test = LightsailStaticIpAttachment(self, "test_2",
+            instance_name=test.id,
+            static_ip_name=Token.as_string(aws_lightsail_static_ip_test.id)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_lightsail_static_ip_attachment_test.override_logical_id("test")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `static_ip_name` - (Required) The name of the allocated static IP
+* `instance_name` - (Required) The name of the Lightsail instance to attach the IP to
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `ip_address` - The allocated static IP address
+
+<!-- cache-key: cdktf-0.18.0 input-6383b2c1ce9e0d3f93e326883a08bc4696b5b00c508566ea4d895b90af237860 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/load_balancer_backend_server_policy.html.markdown b/website/docs/cdktf/python/r/load_balancer_backend_server_policy.html.markdown
new file mode 100644
index 00000000000..320c1c3a27e
--- /dev/null
+++ b/website/docs/cdktf/python/r/load_balancer_backend_server_policy.html.markdown
@@ -0,0 +1,89 @@
+---
+subcategory: "ELB Classic"
+layout: "aws"
+page_title: "AWS: aws_load_balancer_backend_server_policy"
+description: |-
+  Attaches a load balancer policy to an ELB backend server.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_load_balancer_backend_server_policy
+
+Attaches a load balancer policy to an ELB backend server.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.elb import Elb
+from imports.aws.load_balancer_backend_server_policy import LoadBalancerBackendServerPolicy
+from imports.aws.load_balancer_policy import LoadBalancerPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        wu_tang = Elb(self, "wu-tang",
+            availability_zones=["us-east-1a"],
+            listener=[ElbListener(
+                instance_port=443,
+                instance_protocol="http",
+                lb_port=443,
+                lb_protocol="https",
+                ssl_certificate_id="arn:aws:iam::000000000000:server-certificate/wu-tang.net"
+            )
+            ],
+            name="wu-tang",
+            tags={
+                "Name": "wu-tang"
+            }
+        )
+        LoadBalancerPolicy(self, "wu-tang-ca-pubkey-policy",
+            load_balancer_name=wu_tang.name,
+            policy_attribute=[LoadBalancerPolicyPolicyAttribute(
+                name="PublicKey",
+                value=Token.as_string(Fn.file("wu-tang-pubkey"))
+            )
+            ],
+            policy_name="wu-tang-ca-pubkey-policy",
+            policy_type_name="PublicKeyPolicyType"
+        )
+        wu_tang_root_ca_backend_auth_policy = LoadBalancerPolicy(self, "wu-tang-root-ca-backend-auth-policy",
+            load_balancer_name=wu_tang.name,
+            policy_attribute=[LoadBalancerPolicyPolicyAttribute(
+                name="PublicKeyPolicyName",
+                value=wu_tang_root_ca_pubkey_policy.policy_name
+            )
+            ],
+            policy_name="wu-tang-root-ca-backend-auth-policy",
+            policy_type_name="BackendServerAuthenticationPolicyType"
+        )
+        LoadBalancerBackendServerPolicy(self, "wu-tang-backend-auth-policies-443",
+            instance_port=443,
+            load_balancer_name=wu_tang.name,
+            policy_names=[wu_tang_root_ca_backend_auth_policy.policy_name]
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `load_balancer_name` - (Required) The load balancer to attach the policy to.
+* `policy_names` - (Required) List of Policy Names to apply to the backend server.
+* `instance_port` - (Required) The instance port to apply the policy to.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the policy.
+* `load_balancer_name` - The load balancer on which the policy is defined.
+* `instance_port` - The backend port the policies are applied to
+
+<!-- cache-key: cdktf-0.18.0 input-678615497775d54f0ebc1130f0cdc63541b64d9b7e8ee65aaf87facfc558da29 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/load_balancer_listener_policy.html.markdown b/website/docs/cdktf/python/r/load_balancer_listener_policy.html.markdown
new file mode 100644
index 00000000000..a19d991d32c
--- /dev/null
+++ b/website/docs/cdktf/python/r/load_balancer_listener_policy.html.markdown
@@ -0,0 +1,137 @@
+---
+subcategory: "ELB Classic"
+layout: "aws"
+page_title: "AWS: aws_load_balancer_listener_policy"
+description: |-
+  Attaches a load balancer policy to an ELB Listener.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_load_balancer_listener_policy
+
+Attaches a load balancer policy to an ELB Listener.
+
+## Example Usage
+
+### Custom Policy
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.elb import Elb
+from imports.aws.load_balancer_listener_policy import LoadBalancerListenerPolicy
+from imports.aws.load_balancer_policy import LoadBalancerPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        wu_tang = Elb(self, "wu-tang",
+            availability_zones=["us-east-1a"],
+            listener=[ElbListener(
+                instance_port=443,
+                instance_protocol="http",
+                lb_port=443,
+                lb_protocol="https",
+                ssl_certificate_id="arn:aws:iam::000000000000:server-certificate/wu-tang.net"
+            )
+            ],
+            name="wu-tang",
+            tags={
+                "Name": "wu-tang"
+            }
+        )
+        wu_tang_ssl = LoadBalancerPolicy(self, "wu-tang-ssl",
+            load_balancer_name=wu_tang.name,
+            policy_attribute=[LoadBalancerPolicyPolicyAttribute(
+                name="ECDHE-ECDSA-AES128-GCM-SHA256",
+                value="true"
+            ), LoadBalancerPolicyPolicyAttribute(
+                name="Protocol-TLSv1.2",
+                value="true"
+            )
+            ],
+            policy_name="wu-tang-ssl",
+            policy_type_name="SSLNegotiationPolicyType"
+        )
+        LoadBalancerListenerPolicy(self, "wu-tang-listener-policies-443",
+            load_balancer_name=wu_tang.name,
+            load_balancer_port=443,
+            policy_names=[wu_tang_ssl.policy_name]
+        )
+```
+
+This example shows how to customize the TLS settings of an HTTPS listener.
+
+### AWS Predefined Security Policy
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.elb import Elb
+from imports.aws.load_balancer_listener_policy import LoadBalancerListenerPolicy
+from imports.aws.load_balancer_policy import LoadBalancerPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        wu_tang = Elb(self, "wu-tang",
+            availability_zones=["us-east-1a"],
+            listener=[ElbListener(
+                instance_port=443,
+                instance_protocol="http",
+                lb_port=443,
+                lb_protocol="https",
+                ssl_certificate_id="arn:aws:iam::000000000000:server-certificate/wu-tang.net"
+            )
+            ],
+            name="wu-tang",
+            tags={
+                "Name": "wu-tang"
+            }
+        )
+        wu_tang_ssl_tls11 = LoadBalancerPolicy(self, "wu-tang-ssl-tls-1-1",
+            load_balancer_name=wu_tang.name,
+            policy_attribute=[LoadBalancerPolicyPolicyAttribute(
+                name="Reference-Security-Policy",
+                value="ELBSecurityPolicy-TLS-1-1-2017-01"
+            )
+            ],
+            policy_name="wu-tang-ssl",
+            policy_type_name="SSLNegotiationPolicyType"
+        )
+        LoadBalancerListenerPolicy(self, "wu-tang-listener-policies-443",
+            load_balancer_name=wu_tang.name,
+            load_balancer_port=443,
+            policy_names=[wu_tang_ssl_tls11.policy_name]
+        )
+```
+
+This example shows how to add a [Predefined Security Policy for ELBs](https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/elb-security-policy-table.html)
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `load_balancer_name` - (Required) The load balancer to attach the policy to.
+* `load_balancer_port` - (Required) The load balancer listener port to apply the policy to.
+* `policy_names` - (Required) List of Policy Names to apply to the backend server.
+* `triggers` - (Optional) Map of arbitrary keys and values that, when changed, will trigger an update. To force an update without changing these keys/values, use the [`terraform taint` command](https://www.terraform.io/docs/commands/taint.html).
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the policy.
+* `load_balancer_name` - The load balancer on which the policy is defined.
+* `load_balancer_port` - The load balancer listener port the policies are applied to
+
+<!-- cache-key: cdktf-0.18.0 input-4c93426530ea960507c237ed921eb478f8510b255d175bf0f6382d0d0d11adbe -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/load_balancer_policy.html.markdown b/website/docs/cdktf/python/r/load_balancer_policy.html.markdown
new file mode 100644
index 00000000000..dfc17871596
--- /dev/null
+++ b/website/docs/cdktf/python/r/load_balancer_policy.html.markdown
@@ -0,0 +1,120 @@
+---
+subcategory: "ELB Classic"
+layout: "aws"
+page_title: "AWS: aws_load_balancer_policy"
+description: |-
+  Provides a load balancer policy, which can be attached to an ELB listener or backend server.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_load_balancer_policy
+
+Provides a load balancer policy, which can be attached to an ELB listener or backend server.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.elb import Elb
+from imports.aws.load_balancer_backend_server_policy import LoadBalancerBackendServerPolicy
+from imports.aws.load_balancer_listener_policy import LoadBalancerListenerPolicy
+from imports.aws.load_balancer_policy import LoadBalancerPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        wu_tang = Elb(self, "wu-tang",
+            availability_zones=["us-east-1a"],
+            listener=[ElbListener(
+                instance_port=443,
+                instance_protocol="http",
+                lb_port=443,
+                lb_protocol="https",
+                ssl_certificate_id="arn:aws:iam::000000000000:server-certificate/wu-tang.net"
+            )
+            ],
+            name="wu-tang",
+            tags={
+                "Name": "wu-tang"
+            }
+        )
+        LoadBalancerPolicy(self, "wu-tang-ca-pubkey-policy",
+            load_balancer_name=wu_tang.name,
+            policy_attribute=[LoadBalancerPolicyPolicyAttribute(
+                name="PublicKey",
+                value=Token.as_string(Fn.file("wu-tang-pubkey"))
+            )
+            ],
+            policy_name="wu-tang-ca-pubkey-policy",
+            policy_type_name="PublicKeyPolicyType"
+        )
+        wu_tang_root_ca_backend_auth_policy = LoadBalancerPolicy(self, "wu-tang-root-ca-backend-auth-policy",
+            load_balancer_name=wu_tang.name,
+            policy_attribute=[LoadBalancerPolicyPolicyAttribute(
+                name="PublicKeyPolicyName",
+                value=wu_tang_root_ca_pubkey_policy.policy_name
+            )
+            ],
+            policy_name="wu-tang-root-ca-backend-auth-policy",
+            policy_type_name="BackendServerAuthenticationPolicyType"
+        )
+        wu_tang_ssl = LoadBalancerPolicy(self, "wu-tang-ssl",
+            load_balancer_name=wu_tang.name,
+            policy_attribute=[LoadBalancerPolicyPolicyAttribute(
+                name="ECDHE-ECDSA-AES128-GCM-SHA256",
+                value="true"
+            ), LoadBalancerPolicyPolicyAttribute(
+                name="Protocol-TLSv1.2",
+                value="true"
+            )
+            ],
+            policy_name="wu-tang-ssl",
+            policy_type_name="SSLNegotiationPolicyType"
+        )
+        LoadBalancerPolicy(self, "wu-tang-ssl-tls-1-1",
+            load_balancer_name=wu_tang.name,
+            policy_attribute=[LoadBalancerPolicyPolicyAttribute(
+                name="Reference-Security-Policy",
+                value="ELBSecurityPolicy-TLS-1-1-2017-01"
+            )
+            ],
+            policy_name="wu-tang-ssl",
+            policy_type_name="SSLNegotiationPolicyType"
+        )
+        LoadBalancerBackendServerPolicy(self, "wu-tang-backend-auth-policies-443",
+            instance_port=443,
+            load_balancer_name=wu_tang.name,
+            policy_names=[wu_tang_root_ca_backend_auth_policy.policy_name]
+        )
+        LoadBalancerListenerPolicy(self, "wu-tang-listener-policies-443",
+            load_balancer_name=wu_tang.name,
+            load_balancer_port=443,
+            policy_names=[wu_tang_ssl.policy_name]
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `load_balancer_name` - (Required) The load balancer on which the policy is defined.
+* `policy_name` - (Required) The name of the load balancer policy.
+* `policy_type_name` - (Required) The policy type.
+* `policy_attribute` - (Optional) Policy attribute to apply to the policy.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the policy.
+* `policy_name` - The name of the stickiness policy.
+* `policy_type_name` - The policy type of the policy.
+* `load_balancer_name` - The load balancer on which the policy is defined.
+
+<!-- cache-key: cdktf-0.18.0 input-1301aff03d8fcf31fd6731593f13d990b69c6ade1c5268a81e1297356d9df74a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/location_geofence_collection.html.markdown b/website/docs/cdktf/python/r/location_geofence_collection.html.markdown
new file mode 100644
index 00000000000..04fb1ec3ff2
--- /dev/null
+++ b/website/docs/cdktf/python/r/location_geofence_collection.html.markdown
@@ -0,0 +1,81 @@
+---
+subcategory: "Location"
+layout: "aws"
+page_title: "AWS: aws_location_geofence_collection"
+description: |-
+  Terraform resource for managing an AWS Location Geofence Collection.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_location_geofence_collection
+
+Terraform resource for managing an AWS Location Geofence Collection.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.location_geofence_collection import LocationGeofenceCollection
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        LocationGeofenceCollection(self, "example",
+            collection_name="example"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `collection_name` - (Required) The name of the geofence collection.
+
+The following arguments are optional:
+
+* `description` - (Optional) The optional description for the geofence collection.
+* `kms_key_id` - (Optional) A key identifier for an AWS KMS customer managed key assigned to the Amazon Location resource.
+* `tags` - (Optional) Key-value tags for the geofence collection. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `collection_arn` - The Amazon Resource Name (ARN) for the geofence collection resource. Used when you need to specify a resource across all AWS.
+* `create_time` - The timestamp for when the geofence collection resource was created in ISO 8601 format.
+* `update_time` - The timestamp for when the geofence collection resource was last updated in ISO 8601 format.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `30m`)
+* `update` - (Default `30m`)
+* `delete` - (Default `30m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Location Geofence Collection using the `collection_name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Location Geofence Collection using the `collection_name`. For example:
+
+```console
+% terraform import aws_location_geofence_collection.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-d5f8a31edd538788388ea70b948bf927302bc8710ba3768ffc3484e329693d37 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/location_map.html.markdown b/website/docs/cdktf/python/r/location_map.html.markdown
new file mode 100644
index 00000000000..45e761b9dcc
--- /dev/null
+++ b/website/docs/cdktf/python/r/location_map.html.markdown
@@ -0,0 +1,83 @@
+---
+subcategory: "Location"
+layout: "aws"
+page_title: "AWS: aws_location_map"
+description: |-
+    Provides a Location Service Map.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_location_map
+
+Provides a Location Service Map.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.location_map import LocationMap
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        LocationMap(self, "example",
+            configuration=LocationMapConfiguration(
+                style="VectorHereBerlin"
+            ),
+            map_name="example"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `configuration` - (Required) Configuration block with the map style selected from an available data provider. Detailed below.
+* `map_name` - (Required) The name for the map resource.
+
+The following arguments are optional:
+
+* `description` - (Optional) An optional description for the map resource.
+* `tags` - (Optional) Key-value tags for the map. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### configuration
+
+The following arguments are required:
+
+* `style` - (Required) Specifies the map style selected from an available data provider. Valid values can be found in the [Location Service CreateMap API Reference](https://docs.aws.amazon.com/location/latest/APIReference/API_CreateMap.html).
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `create_time` - The timestamp for when the map resource was created in ISO 8601 format.
+* `map_arn` - The Amazon Resource Name (ARN) for the map resource. Used to specify a resource across all AWS.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `update_time` - The timestamp for when the map resource was last updated in ISO 8601 format.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_location_map` resources using the map name. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_location_map` resources using the map name. For example:
+
+```console
+% terraform import aws_location_map.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-5dad74dad6d91da85c3886e29aba5949de61bde3e481fa21d1494017c8c095a9 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/location_place_index.html.markdown b/website/docs/cdktf/python/r/location_place_index.html.markdown
new file mode 100644
index 00000000000..70abdbb8e93
--- /dev/null
+++ b/website/docs/cdktf/python/r/location_place_index.html.markdown
@@ -0,0 +1,82 @@
+---
+subcategory: "Location"
+layout: "aws"
+page_title: "AWS: aws_location_place_index"
+description: |-
+    Provides a Location Service Place Index.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_location_place_index
+
+Provides a Location Service Place Index.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.location_place_index import LocationPlaceIndex
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        LocationPlaceIndex(self, "example",
+            data_source="Here",
+            index_name="example"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `data_source` - (Required) Specifies the geospatial data provider for the new place index.
+* `index_name` - (Required) The name of the place index resource.
+
+The following arguments are optional:
+
+* `data_source_configuration` - (Optional) Configuration block with the data storage option chosen for requesting Places. Detailed below.
+* `description` - (Optional) The optional description for the place index resource.
+* `tags` - (Optional) Key-value tags for the place index. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### data_source_configuration
+
+The following arguments are optional:
+
+* `intended_use` - (Optional) Specifies how the results of an operation will be stored by the caller. Valid values: `SingleUse`, `Storage`. Default: `SingleUse`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `create_time` - The timestamp for when the place index resource was created in ISO 8601 format.
+* `index_arn` - The Amazon Resource Name (ARN) for the place index resource. Used to specify a resource across AWS.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `update_time` - The timestamp for when the place index resource was last update in ISO 8601.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_location_place_index` resources using the place index name. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_location_place_index` resources using the place index name. For example:
+
+```console
+% terraform import aws_location_place_index.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-394c1ee28ef77e64cf06721c4fa5a97e00829ed4736062d9087e7923bfc8ee3a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/location_route_calculator.html.markdown b/website/docs/cdktf/python/r/location_route_calculator.html.markdown
new file mode 100644
index 00000000000..3fbb1d22775
--- /dev/null
+++ b/website/docs/cdktf/python/r/location_route_calculator.html.markdown
@@ -0,0 +1,83 @@
+---
+subcategory: "Location"
+layout: "aws"
+page_title: "AWS: aws_location_route_calculator"
+description: |-
+    Provides a Location Service Route Calculator.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_location_route_calculator
+
+Provides a Location Service Route Calculator.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.location_route_calculator import LocationRouteCalculator
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        LocationRouteCalculator(self, "example",
+            calculator_name="example",
+            data_source="Here"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `calculator_name` - (Required) The name of the route calculator resource.
+* `data_source` - (Required) Specifies the data provider of traffic and road network data.
+
+The following arguments are optional:
+
+* `description` - (Optional) The optional description for the route calculator resource.
+* `tags` - (Optional) Key-value tags for the route calculator. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `calculator_arn` - The Amazon Resource Name (ARN) for the Route calculator resource. Use the ARN when you specify a resource across AWS.
+* `create_time` - The timestamp for when the route calculator resource was created in ISO 8601 format.
+* `update_time` - The timestamp for when the route calculator resource was last update in ISO 8601.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `30m`)
+* `update` - (Default `30m`)
+* `delete` - (Default `30m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_location_route_calculator` using the route calculator name. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_location_route_calculator` using the route calculator name. For example:
+
+```console
+% terraform import aws_location_route_calculator.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-f35e811fd2c633c763e78f808cf0b9c4d35fac2d693f5e1526c62049823223eb -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/location_tracker.html.markdown b/website/docs/cdktf/python/r/location_tracker.html.markdown
new file mode 100644
index 00000000000..031c05f16d9
--- /dev/null
+++ b/website/docs/cdktf/python/r/location_tracker.html.markdown
@@ -0,0 +1,75 @@
+---
+subcategory: "Location"
+layout: "aws"
+page_title: "AWS: aws_location_tracker"
+description: |-
+    Provides a Location Service Tracker.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_location_tracker
+
+Provides a Location Service Tracker.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.location_tracker import LocationTracker
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        LocationTracker(self, "example",
+            tracker_name="example"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `tracker_name` - (Required) The name of the tracker resource.
+
+The following arguments are optional:
+
+* `description` - (Optional) The optional description for the tracker resource.
+* `kms_key_id` - (Optional) A key identifier for an AWS KMS customer managed key assigned to the Amazon Location resource.
+* `position_filtering` - (Optional) The position filtering method of the tracker resource. Valid values: `TimeBased`, `DistanceBased`, `AccuracyBased`. Default: `TimeBased`.
+* `tags` - (Optional) Key-value tags for the tracker. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `create_time` - The timestamp for when the tracker resource was created in ISO 8601 format.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `tracker_arn` - The Amazon Resource Name (ARN) for the tracker resource. Used when you need to specify a resource across all AWS.
+* `update_time` - The timestamp for when the tracker resource was last updated in ISO 8601 format.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_location_tracker` resources using the tracker name. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_location_tracker` resources using the tracker name. For example:
+
+```console
+% terraform import aws_location_tracker.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-92c1e9973bd9acd1e32bccee7a0c518d0693fd82125603fc93d69ca391807e92 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/location_tracker_association.html.markdown b/website/docs/cdktf/python/r/location_tracker_association.html.markdown
new file mode 100644
index 00000000000..c0053f7e89d
--- /dev/null
+++ b/website/docs/cdktf/python/r/location_tracker_association.html.markdown
@@ -0,0 +1,84 @@
+---
+subcategory: "Location"
+layout: "aws"
+page_title: "AWS: aws_location_tracker_association"
+description: |-
+  Terraform resource for managing an AWS Location Tracker Association.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_location_tracker_association
+
+Terraform resource for managing an AWS Location Tracker Association.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.location_geofence_collection import LocationGeofenceCollection
+from imports.aws.location_tracker import LocationTracker
+from imports.aws.location_tracker_association import LocationTrackerAssociation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = LocationGeofenceCollection(self, "example",
+            collection_name="example"
+        )
+        aws_location_tracker_example = LocationTracker(self, "example_1",
+            tracker_name="example"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_location_tracker_example.override_logical_id("example")
+        aws_location_tracker_association_example = LocationTrackerAssociation(self, "example_2",
+            consumer_arn=example.collection_arn,
+            tracker_name=Token.as_string(aws_location_tracker_example.tracker_name)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_location_tracker_association_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `consumer_arn` - (Required) The Amazon Resource Name (ARN) for the geofence collection to be associated to tracker resource. Used when you need to specify a resource across all AWS.
+* `tracker_name` - (Required) The name of the tracker resource to be associated with a geofence collection.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Timeouts
+
+`aws_location_tracker_association` provides the following [Timeouts](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts) configuration options:
+
+* `create` - (Optional, Default: `30m`)
+* `delete` - (Optional, Default: `30m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Location Tracker Association using the `tracker_name|consumer_arn`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Location Tracker Association using the `tracker_name|consumer_arn`. For example:
+
+```console
+% terraform import aws_location_tracker_association.example "tracker_name|consumer_arn"
+```
+
+<!-- cache-key: cdktf-0.18.0 input-4b73757483307c737f70b7bfb906a6a6449e1a0b838a9a4bb533c9ccf5e4bd2b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/macie2_account.html.markdown b/website/docs/cdktf/python/r/macie2_account.html.markdown
new file mode 100644
index 00000000000..0a710d890b1
--- /dev/null
+++ b/website/docs/cdktf/python/r/macie2_account.html.markdown
@@ -0,0 +1,70 @@
+---
+subcategory: "Macie"
+layout: "aws"
+page_title: "AWS: aws_macie2_account"
+description: |-
+  Provides a resource to manage Amazon Macie on an AWS Account.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_macie2_account
+
+Provides a resource to manage an [AWS Macie Account](https://docs.aws.amazon.com/macie/latest/APIReference/macie.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.macie2_account import Macie2Account
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Macie2Account(self, "test",
+            finding_publishing_frequency="FIFTEEN_MINUTES",
+            status="ENABLED"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `finding_publishing_frequency` -  (Optional) Specifies how often to publish updates to policy findings for the account. This includes publishing updates to AWS Security Hub and Amazon EventBridge (formerly called Amazon CloudWatch Events). Valid values are `FIFTEEN_MINUTES`, `ONE_HOUR` or `SIX_HOURS`.
+* `status` - (Optional) Specifies the status for the account. To enable Amazon Macie and start all Macie activities for the account, set this value to `ENABLED`. Valid values are `ENABLED` or `PAUSED`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The unique identifier (ID) of the macie account.
+* `service_role` - The Amazon Resource Name (ARN) of the service-linked role that allows Macie to monitor and analyze data in AWS resources for the account.
+* `created_at` - The date and time, in UTC and extended RFC 3339 format, when the Amazon Macie account was created.
+* `updated_at` - The date and time, in UTC and extended RFC 3339 format, of the most recent change to the status of the Macie account.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_macie2_account` using the id. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_macie2_account` using the id. For example:
+
+```console
+% terraform import aws_macie2_account.example abcd1
+```
+
+<!-- cache-key: cdktf-0.18.0 input-3bb36e9a7bd0b8871e777a031ed1a58fdb5d221c7af202cb42579fd8023356ae -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/macie2_classification_export_configuration.html.markdown b/website/docs/cdktf/python/r/macie2_classification_export_configuration.html.markdown
new file mode 100644
index 00000000000..b9a0e1f8787
--- /dev/null
+++ b/website/docs/cdktf/python/r/macie2_classification_export_configuration.html.markdown
@@ -0,0 +1,85 @@
+---
+subcategory: "Macie"
+layout: "aws"
+page_title: "AWS: aws_macie2_classification_export_configuration"
+description: |-
+  Provides a resource to manage Classification Results - Export Configuration
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_macie2_classification_export_configuration
+
+Provides a resource to manage an [Amazon Macie Classification Export Configuration](https://docs.aws.amazon.com/macie/latest/APIReference/classification-export-configuration.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.macie2_account import Macie2Account
+from imports.aws.macie2_classification_export_configuration import Macie2ClassificationExportConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = Macie2Account(self, "example")
+        aws_macie2_classification_export_configuration_example =
+        Macie2ClassificationExportConfiguration(self, "example_1",
+            depends_on=[example],
+            s3_destination=Macie2ClassificationExportConfigurationS3Destination(
+                bucket_name=Token.as_string(aws_s3_bucket_example.bucket),
+                key_prefix="exampleprefix/",
+                kms_key_arn=Token.as_string(aws_kms_key_example.arn)
+            )
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_macie2_classification_export_configuration_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `s3_destination` - (Required) Configuration block for a S3 Destination. Defined below
+
+### s3_destination Configuration Block
+
+The `s3_destination` configuration block supports the following arguments:
+
+* `bucket_name` - (Required) The Amazon S3 bucket name in which Amazon Macie exports the data classification results.
+* `key_prefix` - (Optional) The object key for the bucket in which Amazon Macie exports the data classification results.
+* `kms_key_arn` - (Required) Amazon Resource Name (ARN) of the KMS key to be used to encrypt the data.
+
+Additional information can be found in the [Storing and retaining sensitive data discovery results with Amazon Macie for AWS Macie documentation](https://docs.aws.amazon.com/macie/latest/user/discovery-results-repository-s3.html).
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The unique identifier (ID) of the configuration.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_macie2_classification_export_configuration` using the account ID and region. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_macie2_classification_export_configuration` using the account ID and region. For example:
+
+```console
+% terraform import aws_macie2_classification_export_configuration.example 123456789012:us-west-2
+```
+
+<!-- cache-key: cdktf-0.18.0 input-b790e975bbab64731657718f850f0c07a6901341522f2000f5f309d87096fb71 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/macie2_classification_job.html.markdown b/website/docs/cdktf/python/r/macie2_classification_job.html.markdown
new file mode 100644
index 00000000000..0b8c6a3fde2
--- /dev/null
+++ b/website/docs/cdktf/python/r/macie2_classification_job.html.markdown
@@ -0,0 +1,170 @@
+---
+subcategory: "Macie"
+layout: "aws"
+page_title: "AWS: aws_macie2_classification_job"
+description: |-
+  Provides a resource to manage an AWS Macie Classification Job.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_macie2_classification_job
+
+Provides a resource to manage an [AWS Macie Classification Job](https://docs.aws.amazon.com/macie/latest/APIReference/jobs.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.macie2_account import Macie2Account
+from imports.aws.macie2_classification_job import Macie2ClassificationJob
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        test = Macie2Account(self, "test")
+        aws_macie2_classification_job_test = Macie2ClassificationJob(self, "test_1",
+            depends_on=[test],
+            job_type="ONE_TIME",
+            name="NAME OF THE CLASSIFICATION JOB",
+            s3_job_definition=Macie2ClassificationJobS3JobDefinition(
+                bucket_definitions=[Macie2ClassificationJobS3JobDefinitionBucketDefinitions(
+                    account_id="ACCOUNT ID",
+                    buckets=["S3 BUCKET NAME"]
+                )
+                ]
+            )
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_macie2_classification_job_test.override_logical_id("test")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `schedule_frequency` -  (Optional) The recurrence pattern for running the job. To run the job only once, don't specify a value for this property and set the value for the `job_type` property to `ONE_TIME`. (documented below)
+* `custom_data_identifier_ids` -  (Optional) The custom data identifiers to use for data analysis and classification.
+* `sampling_percentage` -  (Optional) The sampling depth, as a percentage, to apply when processing objects. This value determines the percentage of eligible objects that the job analyzes. If this value is less than 100, Amazon Macie selects the objects to analyze at random, up to the specified percentage, and analyzes all the data in those objects.
+* `name` -  (Optional) A custom name for the job. The name can contain as many as 500 characters. If omitted, Terraform will assign a random, unique name. Conflicts with `name_prefix`.
+* `name_prefix` -  (Optional) Creates a unique name beginning with the specified prefix. Conflicts with `name`.
+* `description` -  (Optional) A custom description of the job. The description can contain as many as 200 characters.
+* `initial_run` -  (Optional) Specifies whether to analyze all existing, eligible objects immediately after the job is created.
+* `job_type` -  (Required) The schedule for running the job. Valid values are: `ONE_TIME` - Run the job only once. If you specify this value, don't specify a value for the `schedule_frequency` property. `SCHEDULED` - Run the job on a daily, weekly, or monthly basis. If you specify this value, use the `schedule_frequency` property to define the recurrence pattern for the job.
+* `s3_job_definition` -  (Optional) The S3 buckets that contain the objects to analyze, and the scope of that analysis. (documented below)
+* `tags` -  (Optional) A map of key-value pairs that specifies the tags to associate with the job. A job can have a maximum of 50 tags. Each tag consists of a tag key and an associated tag value. The maximum length of a tag key is 128 characters. The maximum length of a tag value is 256 characters.
+* `job_status` -  (Optional) The status for the job. Valid values are: `CANCELLED`, `RUNNING` and `USER_PAUSED`
+
+The `schedule_frequency` object supports the following:
+
+* `daily_schedule` -  (Optional) Specifies a daily recurrence pattern for running the job.
+* `weekly_schedule` -  (Optional) Specifies a weekly recurrence pattern for running the job.
+* `monthly_schedule` -  (Optional) Specifies a monthly recurrence pattern for running the job.
+
+The `s3_job_definition` object supports the following:
+
+* `bucket_criteria` - (Optional) The property- and tag-based conditions that determine which S3 buckets to include or exclude from the analysis. Conflicts with `bucket_definitions`. (documented below)
+* `bucket_definitions` -  (Optional) An array of objects, one for each AWS account that owns buckets to analyze. Each object specifies the account ID for an account and one or more buckets to analyze for the account. Conflicts with `bucket_criteria`. (documented below)
+* `scoping` -  (Optional) The property- and tag-based conditions that determine which objects to include or exclude from the analysis. (documented below)
+
+### bucket_criteria Configuration Block
+
+The `bucket_criteria` object supports the following:
+
+* `excludes` -  (Optional) The property- or tag-based conditions that determine which S3 buckets to exclude from the analysis. (documented below)
+* `includes` -  (Optional) The property- or tag-based conditions that determine which S3 buckets to include in the analysis. (documented below)
+
+The `excludes` and `includes` object supports the following:
+
+* `and` -  (Optional) An array of conditions, one for each condition that determines which S3 buckets to include or exclude from the job. (documented below)
+
+The `and` object supports the following:
+
+* `simple_criterion` -  (Optional) A property-based condition that defines a property, operator, and one or more values for including or excluding an S3 buckets from the job. (documented below)
+* `tag_criterion` -  (Optional) A tag-based condition that defines the operator and tag keys or tag key and value pairs for including or excluding an S3 buckets from the job. (documented below)
+
+The `simple_criterion` object supports the following:
+
+* `comparator` -  (Required) The operator to use in a condition. Valid combination of values are available in the [AWS Documentation](https://docs.aws.amazon.com/macie/latest/APIReference/jobs.html#jobs-model-jobcomparator)
+* `key` -  (Required) The object property to use in the condition. Valid combination of values are available in the [AWS Documentation](https://docs.aws.amazon.com/macie/latest/APIReference/jobs.html#jobs-model-simplecriterionkeyforjob)
+* `values` -  (Required) An array that lists the values to use in the condition. Valid combination of values are available in the [AWS Documentation](https://docs.aws.amazon.com/macie/latest/APIReference/jobs.html#jobs-model-simplecriterionforjob)
+
+The `tag_criterion` object supports the following:
+
+* `comparator` -  (Required) The operator to use in the condition. Valid combination and values are available in the [AWS Documentation](https://docs.aws.amazon.com/macie/latest/APIReference/jobs.html#jobs-model-jobcomparator)
+* `tag_values` -  (Required) The  tag key and value pairs to use in the condition. One or more blocks are allowed. (documented below)
+
+The `tag_values` object supports the following:
+
+* `key` - (Required) The tag key.
+* `value` - (Required) The tag value.
+
+### bucket_definitions Configuration Block
+
+The `bucket_definitions` object supports the following:
+
+* `account_id` -  (Required) The unique identifier for the AWS account that owns the buckets.
+* `buckets` -  (Required) An array that lists the names of the buckets.
+
+### scoping Configuration Block
+
+The `scoping` object supports the following:
+
+* `excludes` -  (Optional) The property- or tag-based conditions that determine which objects to exclude from the analysis. (documented below)
+* `includes` -  (Optional) The property- or tag-based conditions that determine which objects to include in the analysis. (documented below)
+
+The `excludes` and `includes` object supports the following:
+
+* `and` -  (Optional) An array of conditions, one for each condition that determines which objects to include or exclude from the job. (documented below)
+
+The `and` object supports the following:
+
+* `simple_scope_term` -  (Optional) A property-based condition that defines a property, operator, and one or more values for including or excluding an object from the job. (documented below)
+* `tag_scope_term` -  (Optional) A tag-based condition that defines the operator and tag keys or tag key and value pairs for including or excluding an object from the job. (documented below)
+
+The `simple_scope_term` object supports the following:
+
+* `comparator` -  (Optional) The operator to use in a condition. Valid values are: `EQ`, `GT`, `GTE`, `LT`, `LTE`, `NE`, `CONTAINS`, `STARTS_WITH`
+* `values` -  (Optional) An array that lists the values to use in the condition.
+* `key` -  (Optional) The object property to use in the condition.
+
+The `tag_scope_term` object supports the following:
+
+* `comparator` -  (Optional) The operator to use in the condition.
+* `tag_values` -  (Optional) The tag keys or tag key and value pairs to use in the condition.
+* `key` -  (Required) The tag key to use in the condition. The only valid value is `TAG`.
+* `target` -  (Required) The type of object to apply the condition to. The only valid value is `S3_OBJECT`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The unique identifier (ID) of the macie classification job.
+* `created_at` -  The date and time, in UTC and extended RFC 3339 format, when the job was created.
+* `user_paused_details` - If the current status of the job is `USER_PAUSED`, specifies when the job was paused and when the job or job run will expire and be cancelled if it isn't resumed. This value is present only if the value for `job-status` is `USER_PAUSED`.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_macie2_classification_job` using the id. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_macie2_classification_job` using the id. For example:
+
+```console
+% terraform import aws_macie2_classification_job.example abcd1
+```
+
+<!-- cache-key: cdktf-0.18.0 input-9a222992d46777a40eb5928a868c445f448ac2d2331bda106271060c834b0a4f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/macie2_custom_data_identifier.html.markdown b/website/docs/cdktf/python/r/macie2_custom_data_identifier.html.markdown
new file mode 100644
index 00000000000..0b55e6d1ae6
--- /dev/null
+++ b/website/docs/cdktf/python/r/macie2_custom_data_identifier.html.markdown
@@ -0,0 +1,85 @@
+---
+subcategory: "Macie"
+layout: "aws"
+page_title: "AWS: aws_macie2_custom_data_identifier"
+description: |-
+  Provides a resource to manage an AWS Macie Custom Data Identifier.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_macie2_custom_data_identifier
+
+Provides a resource to manage an [AWS Macie Custom Data Identifier](https://docs.aws.amazon.com/macie/latest/APIReference/custom-data-identifiers-id.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.macie2_account import Macie2Account
+from imports.aws.macie2_custom_data_identifier import Macie2CustomDataIdentifier
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Macie2Account(self, "example")
+        aws_macie2_custom_data_identifier_example = Macie2CustomDataIdentifier(self, "example_1",
+            depends_on=[test],
+            description="DESCRIPTION",
+            ignore_words=["ignore"],
+            keywords=["keyword"],
+            maximum_match_distance=10,
+            name="NAME OF CUSTOM DATA IDENTIFIER",
+            regex="[0-9]{3}-[0-9]{2}-[0-9]{4}"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_macie2_custom_data_identifier_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `regex` - (Optional) The regular expression (regex) that defines the pattern to match. The expression can contain as many as 512 characters.
+* `keywords` -  (Optional) An array that lists specific character sequences (keywords), one of which must be within proximity (`maximum_match_distance`) of the regular expression to match. The array can contain as many as 50 keywords. Each keyword can contain 3 - 90 characters. Keywords aren't case sensitive.
+* `ignore_words` - (Optional) An array that lists specific character sequences (ignore words) to exclude from the results. If the text matched by the regular expression is the same as any string in this array, Amazon Macie ignores it. The array can contain as many as 10 ignore words. Each ignore word can contain 4 - 90 characters. Ignore words are case sensitive.
+* `name` - (Optional) A custom name for the custom data identifier. The name can contain as many as 128 characters. If omitted, Terraform will assign a random, unique name. Conflicts with `name_prefix`.
+* `name_prefix` -  (Optional) Creates a unique name beginning with the specified prefix. Conflicts with `name`.
+* `description` - (Optional) A custom description of the custom data identifier. The description can contain as many as 512 characters.
+* `maximum_match_distance` - (Optional) The maximum number of characters that can exist between text that matches the regex pattern and the character sequences specified by the keywords array. Macie includes or excludes a result based on the proximity of a keyword to text that matches the regex pattern. The distance can be 1 - 300 characters. The default value is 50.
+* `tags` - (Optional) A map of key-value pairs that specifies the tags to associate with the custom data identifier.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The unique identifier (ID) of the macie custom data identifier.
+* `deleted` - Specifies whether the custom data identifier was deleted. If you delete a custom data identifier, Amazon Macie doesn't delete it permanently. Instead, it soft deletes the identifier.
+* `created_at` - The date and time, in UTC and extended RFC 3339 format, when the Amazon Macie account was created.
+* `arn` - The Amazon Resource Name (ARN) of the custom data identifier.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_macie2_custom_data_identifier` using the id. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_macie2_custom_data_identifier` using the id. For example:
+
+```console
+% terraform import aws_macie2_custom_data_identifier.example abcd1
+```
+
+<!-- cache-key: cdktf-0.18.0 input-7f26274861db2152fb5a3ebcdbcf38c145ad1a6560147c223131748340ff5d98 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/macie2_findings_filter.html.markdown b/website/docs/cdktf/python/r/macie2_findings_filter.html.markdown
new file mode 100644
index 00000000000..02422f34767
--- /dev/null
+++ b/website/docs/cdktf/python/r/macie2_findings_filter.html.markdown
@@ -0,0 +1,100 @@
+---
+subcategory: "Macie"
+layout: "aws"
+page_title: "AWS: aws_macie2_findings_filter"
+description: |-
+  Provides a resource to manage an Amazon Macie Findings Filter.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_macie2_findings_filter
+
+Provides a resource to manage an [Amazon Macie Findings Filter](https://docs.aws.amazon.com/macie/latest/APIReference/findingsfilters-id.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.macie2_account import Macie2Account
+from imports.aws.macie2_findings_filter import Macie2FindingsFilter
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Macie2Account(self, "example")
+        Macie2FindingsFilter(self, "test",
+            action="ARCHIVE",
+            depends_on=[aws_macie2_account_test],
+            description="DESCRIPTION",
+            finding_criteria=Macie2FindingsFilterFindingCriteria(
+                criterion=[Macie2FindingsFilterFindingCriteriaCriterion(
+                    eq=[Token.as_string(current.name)],
+                    field="region"
+                )
+                ]
+            ),
+            name="NAME OF THE FINDINGS FILTER",
+            position=1
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `finding_criteria` - (Required) The criteria to use to filter findings.
+* `name` - (Optional) A custom name for the filter. The name must contain at least 3 characters and can contain as many as 64 characters. If omitted, Terraform will assign a random, unique name. Conflicts with `name_prefix`.
+* `name_prefix` -  (Optional) Creates a unique name beginning with the specified prefix. Conflicts with `name`.
+* `description` - (Optional) A custom description of the filter. The description can contain as many as 512 characters.
+* `action` - (Required) The action to perform on findings that meet the filter criteria (`finding_criteria`). Valid values are: `ARCHIVE`, suppress (automatically archive) the findings; and, `NOOP`, don't perform any action on the findings.
+* `position` - (Optional) The position of the filter in the list of saved filters on the Amazon Macie console. This value also determines the order in which the filter is applied to findings, relative to other filters that are also applied to the findings.
+* `tags` - (Optional) A map of key-value pairs that specifies the tags to associate with the filter.
+
+The `finding_criteria` object supports the following:
+
+* `criterion` -  (Optional) A condition that specifies the property, operator, and one or more values to use to filter the results.  (documented below)
+
+The `criterion` object supports the following:
+
+* `field` - (Required) The name of the field to be evaluated.
+* `eq_exact_match` - (Optional) The value for the property exclusively matches (equals an exact match for) all the specified values. If you specify multiple values, Amazon Macie uses AND logic to join the values.
+* `eq` - (Optional) The value for the property matches (equals) the specified value. If you specify multiple values, Amazon Macie uses OR logic to join the values.
+* `neq` - (Optional) The value for the property doesn't match (doesn't equal) the specified value. If you specify multiple values, Amazon Macie uses OR logic to join the values.
+* `lt` - (Optional) The value for the property is less than the specified value.
+* `lte` - (Optional) The value for the property is less than or equal to the specified value.
+* `gt` - (Optional) The value for the property is greater than the specified value.
+* `gte` - (Optional) The value for the property is greater than or equal to the specified value.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The unique identifier (ID) of the macie Findings Filter.
+* `arn` - The Amazon Resource Name (ARN) of the Findings Filter.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_macie2_findings_filter` using the id. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_macie2_findings_filter` using the id. For example:
+
+```console
+% terraform import aws_macie2_findings_filter.example abcd1
+```
+
+<!-- cache-key: cdktf-0.18.0 input-922eadb42886940b99342f03a6f68d81b396a29ebaa5aa573f2d1fa24f21e6b5 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/macie2_invitation_accepter.html.markdown b/website/docs/cdktf/python/r/macie2_invitation_accepter.html.markdown
new file mode 100644
index 00000000000..68bd339f6c6
--- /dev/null
+++ b/website/docs/cdktf/python/r/macie2_invitation_accepter.html.markdown
@@ -0,0 +1,85 @@
+---
+subcategory: "Macie"
+layout: "aws"
+page_title: "AWS: aws_macie2_invitation_accepter"
+description: |-
+  Provides a resource to manage an Amazon Macie Invitation Accepter.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_macie2_invitation_accepter
+
+Provides a resource to manage an [Amazon Macie Invitation Accepter](https://docs.aws.amazon.com/macie/latest/APIReference/invitations-accept.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.macie2_account import Macie2Account
+from imports.aws.macie2_invitation_accepter import Macie2InvitationAccepter
+from imports.aws.macie2_member import Macie2Member
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Macie2Account(self, "member")
+        primary = Macie2Account(self, "primary",
+            provider="awsalternate"
+        )
+        aws_macie2_member_primary = Macie2Member(self, "primary_2",
+            account_id="ACCOUNT ID",
+            depends_on=[primary],
+            email="EMAIL",
+            invitation_message="Message of the invite",
+            invite=True,
+            provider="awsalternate"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_macie2_member_primary.override_logical_id("primary")
+        aws_macie2_invitation_accepter_member = Macie2InvitationAccepter(self, "member_3",
+            administrator_account_id="ADMINISTRATOR ACCOUNT ID",
+            depends_on=[aws_macie2_member_primary]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_macie2_invitation_accepter_member.override_logical_id("member")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `administrator_account_id` - (Required) The AWS account ID for the account that sent the invitation.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The unique identifier (ID) of the macie invitation accepter.
+* `invitation_id` - The unique identifier for the invitation.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_macie2_invitation_accepter` using the admin account ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_macie2_invitation_accepter` using the admin account ID. For example:
+
+```console
+% terraform import aws_macie2_invitation_accepter.example 123456789012
+```
+
+<!-- cache-key: cdktf-0.18.0 input-189b2215e9d38a524f24ee8ee99ac1bcf4754aa1be8a0ae0ca9033c2648b9b3d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/macie2_member.html.markdown b/website/docs/cdktf/python/r/macie2_member.html.markdown
new file mode 100644
index 00000000000..d29939d0481
--- /dev/null
+++ b/website/docs/cdktf/python/r/macie2_member.html.markdown
@@ -0,0 +1,85 @@
+---
+subcategory: "Macie"
+layout: "aws"
+page_title: "AWS: aws_macie2_member"
+description: |-
+  Provides a resource to manage an Amazon Macie Member.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_macie2_member
+
+Provides a resource to manage an [Amazon Macie Member](https://docs.aws.amazon.com/macie/latest/APIReference/members-id.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.macie2_account import Macie2Account
+from imports.aws.macie2_member import Macie2Member
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = Macie2Account(self, "example")
+        aws_macie2_member_example = Macie2Member(self, "example_1",
+            account_id="AWS ACCOUNT ID",
+            depends_on=[example],
+            email="EMAIL",
+            invitation_disable_email_notification=True,
+            invitation_message="Message of the invitation",
+            invite=True
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_macie2_member_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `account_id` - (Required) The AWS account ID for the account.
+* `email` - (Required) The email address for the account.
+* `tags` - (Optional) A map of key-value pairs that specifies the tags to associate with the account in Amazon Macie.
+* `status` - (Optional) Specifies the status for the account. To enable Amazon Macie and start all Macie activities for the account, set this value to `ENABLED`. Valid values are `ENABLED` or `PAUSED`.
+* `invite` - (Optional) Send an invitation to a member
+* `invitation_message` - (Optional) A custom message to include in the invitation. Amazon Macie adds this message to the standard content that it sends for an invitation.
+* `invitation_disable_email_notification` - (Optional) Specifies whether to send an email notification to the root user of each account that the invitation will be sent to. This notification is in addition to an alert that the root user receives in AWS Personal Health Dashboard. To send an email notification to the root user of each account, set this value to `true`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The unique identifier (ID) of the macie Member.
+* `arn` - The Amazon Resource Name (ARN) of the account.
+* `relationship_status` - The current status of the relationship between the account and the administrator account.
+* `administrator_account_id` - The AWS account ID for the administrator account.
+* `invited_at` - The date and time, in UTC and extended RFC 3339 format, when an Amazon Macie membership invitation was last sent to the account. This value is null if a Macie invitation hasn't been sent to the account.
+* `updated_at` - The date and time, in UTC and extended RFC 3339 format, of the most recent change to the status of the relationship between the account and the administrator account.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_macie2_member` using the account ID of the member account. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_macie2_member` using the account ID of the member account. For example:
+
+```console
+% terraform import aws_macie2_member.example 123456789012
+```
+
+<!-- cache-key: cdktf-0.18.0 input-270188c839fbbf61a15582b99048abc7d28b091c50c92930247fa2315358a77d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/macie2_organization_admin_account.html.markdown b/website/docs/cdktf/python/r/macie2_organization_admin_account.html.markdown
new file mode 100644
index 00000000000..c0917bd1e9e
--- /dev/null
+++ b/website/docs/cdktf/python/r/macie2_organization_admin_account.html.markdown
@@ -0,0 +1,71 @@
+---
+subcategory: "Macie"
+layout: "aws"
+page_title: "AWS: aws_macie2_organization_admin_account"
+description: |-
+  Provides a resource to manage an Amazon Macie Organization Admin Account.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_macie2_organization_admin_account
+
+Provides a resource to manage an [Amazon Macie Organization Admin Account](https://docs.aws.amazon.com/macie/latest/APIReference/admin.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.macie2_account import Macie2Account
+from imports.aws.macie2_organization_admin_account import Macie2OrganizationAdminAccount
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = Macie2Account(self, "example")
+        aws_macie2_organization_admin_account_example =
+        Macie2OrganizationAdminAccount(self, "example_1",
+            admin_account_id="ID OF THE ADMIN ACCOUNT",
+            depends_on=[example]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_macie2_organization_admin_account_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `admin_account_id` - (Required) The AWS account ID for the account to designate as the delegated Amazon Macie administrator account for the organization.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The unique identifier (ID) of the macie organization admin account.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_macie2_organization_admin_account` using the id. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_macie2_organization_admin_account` using the id. For example:
+
+```console
+% terraform import aws_macie2_organization_admin_account.example abcd1
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ce092bbcd6ad04e47b3e88a6f9f4f8d7424bc7880543e934e20790f46e48066f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/main_route_table_association.html.markdown b/website/docs/cdktf/python/r/main_route_table_association.html.markdown
new file mode 100644
index 00000000000..3ef0a4366af
--- /dev/null
+++ b/website/docs/cdktf/python/r/main_route_table_association.html.markdown
@@ -0,0 +1,74 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_main_route_table_association"
+description: |-
+  Provides a resource for managing the main routing table of a VPC.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_main_route_table_association
+
+Provides a resource for managing the main routing table of a VPC.
+
+~> **NOTE:** **Do not** use both `aws_default_route_table` to manage a default route table **and** `aws_main_route_table_association` with the same VPC due to possible route conflicts. See [aws_default_route_table][tf-default-route-table] documentation for more details.
+For more information, see the Amazon VPC User Guide on [Route Tables](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Route_Tables.html). For information about managing normal route tables in Terraform, see [`aws_route_table`](/docs/providers/aws/r/route_table.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.main_route_table_association import MainRouteTableAssociation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        MainRouteTableAssociation(self, "a",
+            route_table_id=bar.id,
+            vpc_id=foo.id
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `vpc_id` - (Required) The ID of the VPC whose main route table should be set
+* `route_table_id` - (Required) The ID of the Route Table to set as the new
+  main route table for the target VPC
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the Route Table Association
+* `original_route_table_id` - Used internally, see __Notes__ below
+
+## Notes
+
+On VPC creation, the AWS API always creates an initial Main Route Table. This
+resource records the ID of that Route Table under `original_route_table_id`.
+The "Delete" action for a `main_route_table_association` consists of resetting
+this original table as the Main Route Table for the VPC. You'll see this
+additional Route Table in the AWS console; it must remain intact in order for
+the `main_route_table_association` delete to work properly.
+
+[aws-route-tables]: http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Route_Tables.html#Route_Replacing_Main_Table
+[tf-route-tables]: /docs/providers/aws/r/route_table.html
+[tf-default-route-table]: /docs/providers/aws/r/default_route_table.html
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `5m`)
+- `update` - (Default `2m`)
+- `delete` - (Default `5m`)
+
+<!-- cache-key: cdktf-0.18.0 input-8a24f73bf17fe1ade6055be9d49a3b7dead4b56fe5a89302c4898ee7002090fc -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/media_convert_queue.html.markdown b/website/docs/cdktf/python/r/media_convert_queue.html.markdown
new file mode 100644
index 00000000000..abc41e3dc99
--- /dev/null
+++ b/website/docs/cdktf/python/r/media_convert_queue.html.markdown
@@ -0,0 +1,80 @@
+---
+subcategory: "Elemental MediaConvert"
+layout: "aws"
+page_title: "AWS: aws_media_convert_queue"
+description: |-
+  Provides an AWS Elemental MediaConvert Queue.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_media_convert_queue
+
+Provides an AWS Elemental MediaConvert Queue.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.media_convert_queue import MediaConvertQueue
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        MediaConvertQueue(self, "test",
+            name="tf-test-queue"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) A unique identifier describing the queue
+* `description` - (Optional) A description of the queue
+* `pricing_plan` - (Optional) Specifies whether the pricing plan for the queue is on-demand or reserved. Valid values are `ON_DEMAND` or `RESERVED`. Default to `ON_DEMAND`.
+* `reservation_plan_settings` - (Optional) A detail pricing plan of the  reserved queue. See below.
+* `status` - (Optional) A status of the queue. Valid values are `ACTIVE` or `RESERVED`. Default to `PAUSED`.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Nested Fields
+
+#### `reservation_plan_settings`
+
+* `commitment` - (Required) The length of the term of your reserved queue pricing plan commitment. Valid value is `ONE_YEAR`.
+* `renewal_type` - (Required) Specifies whether the term of your reserved queue pricing plan. Valid values are `AUTO_RENEW` or `EXPIRE`.
+* `reserved_slots` - (Required) Specifies the number of reserved transcode slots (RTS) for queue.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The same as `name`
+* `arn` - The Arn of the queue
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Media Convert Queue using the queue name. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Media Convert Queue using the queue name. For example:
+
+```console
+% terraform import aws_media_convert_queue.test tf-test-queue
+```
+
+<!-- cache-key: cdktf-0.18.0 input-4187cb7aae796644c39c65825e4388d40e4bbc13bb166ecba228fe64c9f6f4c9 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/media_package_channel.html.markdown b/website/docs/cdktf/python/r/media_package_channel.html.markdown
new file mode 100644
index 00000000000..5b180c6b9b8
--- /dev/null
+++ b/website/docs/cdktf/python/r/media_package_channel.html.markdown
@@ -0,0 +1,75 @@
+---
+subcategory: "Elemental MediaPackage"
+layout: "aws"
+page_title: "AWS: aws_media_package_channel"
+description: |-
+  Provides an AWS Elemental MediaPackage Channel.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_media_package_channel
+
+Provides an AWS Elemental MediaPackage Channel.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.media_package_channel import MediaPackageChannel
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        MediaPackageChannel(self, "kittens",
+            channel_id="kitten-channel",
+            description="A channel dedicated to amusing videos of kittens."
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `channel_id` - (Required) A unique identifier describing the channel
+* `description` - (Optional) A description of the channel
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The same as `channel_id`
+* `arn` - The ARN of the channel
+* `hls_ingest` - A single item list of HLS ingest information
+    * `ingest_endpoints` - A list of the ingest endpoints
+        * `password` - The password
+        * `url` - The URL
+        * `username` - The username
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Media Package Channels using the channel ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Media Package Channels using the channel ID. For example:
+
+```console
+% terraform import aws_media_package_channel.kittens kittens-channel
+```
+
+<!-- cache-key: cdktf-0.18.0 input-749270ff3fa0c6f15341b2b41f6c3363f04071edc7478cee4ebbc36cb5e14a07 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/media_store_container.html.markdown b/website/docs/cdktf/python/r/media_store_container.html.markdown
new file mode 100644
index 00000000000..16ee96dc518
--- /dev/null
+++ b/website/docs/cdktf/python/r/media_store_container.html.markdown
@@ -0,0 +1,68 @@
+---
+subcategory: "Elemental MediaStore"
+layout: "aws"
+page_title: "AWS: aws_media_store_container"
+description: |-
+  Provides a MediaStore Container.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_media_store_container
+
+Provides a MediaStore Container.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.media_store_container import MediaStoreContainer
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        MediaStoreContainer(self, "example",
+            name="example"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the container. Must contain alphanumeric characters or underscores.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the container.
+* `endpoint` - The DNS endpoint of the container.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import MediaStore Container using the MediaStore Container Name. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import MediaStore Container using the MediaStore Container Name. For example:
+
+```console
+% terraform import aws_media_store_container.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-534cdde6fc1c98559d9e005ae9cd5a252af07161d62318424cfe7000b0a2d854 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/media_store_container_policy.html.markdown b/website/docs/cdktf/python/r/media_store_container_policy.html.markdown
new file mode 100644
index 00000000000..c39c683d8d8
--- /dev/null
+++ b/website/docs/cdktf/python/r/media_store_container_policy.html.markdown
@@ -0,0 +1,101 @@
+---
+subcategory: "Elemental MediaStore"
+layout: "aws"
+page_title: "AWS: aws_media_store_container_policy"
+description: |-
+  Provides a MediaStore Container Policy.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_media_store_container_policy
+
+Provides a MediaStore Container Policy.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_caller_identity import DataAwsCallerIdentity
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.data_aws_region import DataAwsRegion
+from imports.aws.media_store_container import MediaStoreContainer
+from imports.aws.media_store_container_policy import MediaStoreContainerPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = MediaStoreContainer(self, "example",
+            name="example"
+        )
+        current = DataAwsCallerIdentity(self, "current")
+        data_aws_region_current = DataAwsRegion(self, "current_2")
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_region_current.override_logical_id("current")
+        data_aws_iam_policy_document_example = DataAwsIamPolicyDocument(self, "example_3",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["mediastore:*"],
+                condition=[DataAwsIamPolicyDocumentStatementCondition(
+                    test="Bool",
+                    values=["true"],
+                    variable="aws:SecureTransport"
+                )
+                ],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["arn:aws:iam::${" + current.account_id + "}:root"],
+                    type="AWS"
+                )
+                ],
+                resources=["arn:aws:mediastore:${" + data_aws_region_current.name + "}:${" + current.account_id + "}:container/${" + example.name + "}/*"
+                ],
+                sid="MediaStoreFullAccess"
+            )
+            ]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_iam_policy_document_example.override_logical_id("example")
+        aws_media_store_container_policy_example = MediaStoreContainerPolicy(self, "example_4",
+            container_name=example.name,
+            policy=Token.as_string(data_aws_iam_policy_document_example.json)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_media_store_container_policy_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `container_name` - (Required) The name of the container.
+* `policy` - (Required) The contents of the policy. For more information about building AWS IAM policy documents with Terraform, see the [AWS IAM Policy Document Guide](https://learn.hashicorp.com/terraform/aws/iam-policy).
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import MediaStore Container Policy using the MediaStore Container Name. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import MediaStore Container Policy using the MediaStore Container Name. For example:
+
+```console
+% terraform import aws_media_store_container_policy.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-addc870ae2e73534f5d560ba4934913eb5bf1ebcafc93b6e1cbf16f9a89254bc -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/medialive_channel.html.markdown b/website/docs/cdktf/python/r/medialive_channel.html.markdown
new file mode 100644
index 00000000000..5391b7f918f
--- /dev/null
+++ b/website/docs/cdktf/python/r/medialive_channel.html.markdown
@@ -0,0 +1,808 @@
+---
+subcategory: "Elemental MediaLive"
+layout: "aws"
+page_title: "AWS: aws_medialive_channel"
+description: |-
+  Terraform resource for managing an AWS MediaLive Channel.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_medialive_channel
+
+Terraform resource for managing an AWS MediaLive Channel.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.medialive_channel import MedialiveChannel
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        MedialiveChannel(self, "example",
+            channel_class="STANDARD",
+            destinations=[MedialiveChannelDestinations(
+                id="destination",
+                settings=[MedialiveChannelDestinationsSettings(
+                    url="s3://${" + main.id + "}/test1"
+                ), MedialiveChannelDestinationsSettings(
+                    url="s3://${" + main2.id + "}/test2"
+                )
+                ]
+            )
+            ],
+            encoder_settings=MedialiveChannelEncoderSettings(
+                audio_descriptions=[MedialiveChannelEncoderSettingsAudioDescriptions(
+                    audio_selector_name="example audio selector",
+                    name="audio-selector"
+                )
+                ],
+                output_groups=[MedialiveChannelEncoderSettingsOutputGroups(
+                    output_group_settings=MedialiveChannelEncoderSettingsOutputGroupsOutputGroupSettings(
+                        archive_group_settings=[MedialiveChannelEncoderSettingsOutputGroupsOutputGroupSettingsArchiveGroupSettings(
+                            destination=MedialiveChannelEncoderSettingsOutputGroupsOutputGroupSettingsArchiveGroupSettingsDestination(
+                                destination_ref_id="destination"
+                            )
+                        )
+                        ]
+                    ),
+                    outputs=[MedialiveChannelEncoderSettingsOutputGroupsOutputs(
+                        audio_description_names=["audio-selector"],
+                        output_name="example-name",
+                        output_settings=MedialiveChannelEncoderSettingsOutputGroupsOutputsOutputSettings(
+                            archive_output_settings=MedialiveChannelEncoderSettingsOutputGroupsOutputsOutputSettingsArchiveOutputSettings(
+                                container_settings=MedialiveChannelEncoderSettingsOutputGroupsOutputsOutputSettingsArchiveOutputSettingsContainerSettings(
+                                    m2_ts_settings=MedialiveChannelEncoderSettingsOutputGroupsOutputsOutputSettingsArchiveOutputSettingsContainerSettingsM2TsSettings(
+                                        audio_buffer_model="ATSC",
+                                        buffer_model="MULTIPLEX",
+                                        rate_mode="CBR"
+                                    )
+                                ),
+                                extension="m2ts",
+                                name_modifier="_1"
+                            )
+                        ),
+                        video_description_name="example-video"
+                    )
+                    ]
+                )
+                ],
+                timecode_config=MedialiveChannelEncoderSettingsTimecodeConfig(
+                    source="EMBEDDED"
+                ),
+                video_descriptions=[MedialiveChannelEncoderSettingsVideoDescriptions(
+                    name="example-video"
+                )
+                ]
+            ),
+            input_attachments=[MedialiveChannelInputAttachments(
+                input_attachment_name="example-input",
+                input_id=Token.as_string(aws_medialive_input_example.id)
+            )
+            ],
+            input_specification=MedialiveChannelInputSpecification(
+                codec="AVC",
+                input_resolution="HD",
+                maximum_bitrate="MAX_20_MBPS"
+            ),
+            name="example-channel",
+            role_arn=Token.as_string(aws_iam_role_example.arn)
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `channel_class` - (Required) Concise argument description.
+* `destinations` - (Required) Destinations for channel. See [Destinations](#destinations) for more details.
+* `encoder_settings` - (Required) Encoder settings. See [Encoder Settings](#encoder-settings) for more details.
+* `input_specification` - (Required) Specification of network and file inputs for the channel.
+* `name` - (Required) Name of the Channel.
+
+The following arguments are optional:
+
+* `cdi_input_specification` - (Optional) Specification of CDI inputs for this channel. See [CDI Input Specification](#cdi-input-specification) for more details.
+* `input_attachments` - (Optional) Input attachments for the channel. See [Input Attachments](#input-attachments) for more details.
+* `log_level` - (Optional) The log level to write to Cloudwatch logs.
+* `maintenance` - (Optional) Maintenance settings for this channel. See [Maintenance](#maintenance) for more details.
+* `role_arn` - (Optional) Concise argument description.
+* `start_channel` - (Optional) Whether to start/stop channel. Default: `false`
+* `tags` - (Optional) A map of tags to assign to the channel. If configured with a provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `vpc` - (Optional) Settings for the VPC outputs. See [VPC](#vpc) for more details.
+
+### CDI Input Specification
+
+* `resolution` - (Required) - Maximum CDI input resolution.
+
+### Destinations
+
+* `id` - (Required) User-specified id. Ths is used in an output group or an output.
+* `media_package_settings` - (Optional) Destination settings for a MediaPackage output; one destination for both encoders. See [Media Package Settings](#media-package-settings) for more details.
+* `multiplex_settings` - (Optional) Destination settings for a Multiplex output; one destination for both encoders. See [Multiplex Settings](#multiplex-settings) for more details.
+* `settings` - (Optional) Destination settings for a standard output; one destination for each redundant encoder. See [Settings](#settings) for more details.
+
+### Encoder Settings
+
+* `audio_descriptions` - (Required) Audio descriptions for the channel. See [Audio Descriptions](#audio-descriptions) for more details.
+* `output_groups` - (Required) Output groups for the channel. See [Output Groups](#output-groups) for more details.
+* `timecode_config` - (Required) Contains settings used to acquire and adjust timecode information from inputs. See [Timecode Config](#timecode-config) for more details.
+* `video_descriptions` - (Required) Video Descriptions. See [Video Descriptions](#video-descriptions) for more details.
+* `caption_descriptions` - (Optional) Caption Descriptions. See [Caption Descriptions](#caption-descriptions) for more details.
+* `global_configuration` - (Optional) Configuration settings that apply to the event as a whole. See [Global Configuration](#global-configuration) for more details.
+* `motion_graphics_configuration` - (Optional) Settings for motion graphics. See [Motion Graphics Configuration](#motion-graphics-configuration) for more details.
+* `nielsen_configuration` - (Optional) Nielsen configuration settings. See [Nielsen Configuration](#nielsen-configuration) for more details.
+* `avail_blanking` - (Optional) Settings for ad avail blanking. See [Avail Blanking](#avail-blanking) for more details.
+
+### Input Attachments
+
+* `input_attachment_name` - (Optional) User-specified name for the attachment.
+* `input_id` - (Required) The ID of the input.
+* `input_settings` - (Optional) Settings of an input. See [Input Settings](#input-settings) for more details.
+* `automatic_input_failover_settings` - (Optional) User-specified settings for defining what the conditions are for declaring the input unhealthy and failing over to a different input. See [Automatic Input Failover Settings](#automatic-input-failover-settings) for more details.
+
+### Input Settings
+
+* `audio_selectors` - (Optional) Used to select the audio stream to decode for inputs that have multiple. See [Audio Selectors](#audio-selectors) for more details.
+* `caption_selectors` - (Optional) Used to select the caption input to use for inputs that have multiple available. See [Caption Selectors](#caption-selectors) for more details.
+* `deblock_filter` - (Optional) Enable or disable the deblock filter when filtering.
+* `denoise_filter` - (Optional) Enable or disable the denoise filter when filtering.
+* `filter_strength` - (Optional) Adjusts the magnitude of filtering from 1 (minimal) to 5 (strongest).
+* `input_filter` - (Optional) Turns on the filter for the input.
+* `network_input_settings` - (Optional) Input settings. See [Network Input Settings](#network-input-settings) for more details.
+* `scte35_pid` - (Optional) PID from which to read SCTE-35 messages.
+* `smpte2038_data_preference` - (Optional) Specifies whether to extract applicable ancillary data from a SMPTE-2038 source in the input.
+* `source_end_behavior` - (Optional) Loop input if it is a file.
+
+### Audio Selectors
+
+* `name` - (Required) The name of the audio selector.
+* `selector_settings` - (Optional) The audio selector settings. See [Audio Selector Settings](#audio-selector-settings) for more details.
+
+### Audio Selector Settings
+
+* `audio_hls_rendition_selection` - (Optional) Audio HLS Rendition Selection. See [Audio HLS Rendition Selection](#audio-hls-rendition-selection) for more details.
+* `audio_language_selection` - (Optional) Audio Language Selection. See [Audio Language Selection](#audio-language-selection) for more details.
+* `audio_pid_selection` - (Optional) Audio Pid Selection. See [Audio PID Selection](#audio-pid-selection) for more details.
+* `audio_track_selection` - (Optional) Audio Track Selection. See [Audio Track Selection](#audio-track-selection) for more details.
+
+### Audio HLS Rendition Selection
+
+* `group_id` - (Required) Specifies the GROUP-ID in the #EXT-X-MEDIA tag of the target HLS audio rendition.
+* `name` - (Required) Specifies the NAME in the #EXT-X-MEDIA tag of the target HLS audio rendition.
+
+### Audio Language Selection
+
+* `language_code` - (Required) Selects a specific three-letter language code from within an audio source.
+* `language_selection_policy` - (Optional) When set to “strict”, the transport stream demux strictly identifies audio streams by their language descriptor. If a PMT update occurs such that an audio stream matching the initially selected language is no longer present then mute will be encoded until the language returns. If “loose”, then on a PMT update the demux will choose another audio stream in the program with the same stream type if it can’t find one with the same language.
+
+### Audio PID Selection
+
+* `pid` - (Required) Selects a specific PID from within a source.
+
+### Audio Track Selection
+
+* `tracks` - (Required) Selects one or more unique audio tracks from within a source. See [Audio Tracks](#audio-tracks) for more details.
+* `dolby_e_decode` - (Optional) Configure decoding options for Dolby E streams - these should be Dolby E frames carried in PCM streams tagged with SMPTE-337. See [Dolby E Decode](#dolby-e-decode) for more details.
+
+### Audio Tracks
+
+* `track` - (Required) 1-based integer value that maps to a specific audio track.
+
+### Dolby E Decode
+
+* `program_selection` - (Required) Applies only to Dolby E. Enter the program ID (according to the metadata in the audio) of the Dolby E program to extract from the specified track. One program extracted per audio selector. To select multiple programs, create multiple selectors with the same Track and different Program numbers. “All channels” means to ignore the program IDs and include all the channels in this selector; useful if metadata is known to be incorrect.
+
+### Caption Selectors
+
+* `name` - (Optional) The name of the caption selector.
+* `language_code` - (Optional) When specified this field indicates the three letter language code of the caption track to extract from the source.
+* `selector_settings` - (Optional) Caption selector settings. See [Caption Selector Settings](#caption-selector-settings) for more details.
+
+### Caption Selector Settings
+
+* `ancillary_source_settings` - (Optional) Ancillary Source Settings. See [Ancillary Source Settings](#ancillary-source-settings) for more details.
+* `arib_source_settings` - (Optional) ARIB Source Settings.
+* `dvb_sub_source_settings` - (Optional) DVB Sub Source Settings. See [DVB Sub Source Settings](#dvb-sub-source-settings) for more details.
+* `embedded_source_settings` - (Optional) Embedded Source Settings. See [Embedded Source Settings](#embedded-source-settings) for more details.
+* `scte20_source_settings` - (Optional) SCTE20 Source Settings. See [SCTE 20 Source Settings](#scte-20-source-settings) for more details.
+* `scte27_source_settings` - (Optional) SCTE27 Source Settings. See [SCTE 27 Source Settings](#scte-27-source-settings) for more details.
+* `teletext_source_settings` - (Optional) Teletext Source Settings. See [Teletext Source Settings](#teletext-source-settings) for more details.
+
+### Ancillary Source Settings
+
+* `source_ancillary_channel_number` - (Optional) Specifies the number (1 to 4) of the captions channel you want to extract from the ancillary captions. If you plan to convert the ancillary captions to another format, complete this field. If you plan to choose Embedded as the captions destination in the output (to pass through all the channels in the ancillary captions), leave this field blank because MediaLive ignores the field.
+
+### DVB Sub Source Settings
+
+* `ocr_language` - (Optional) If you will configure a WebVTT caption description that references this caption selector, use this field to provide the language to consider when translating the image-based source to text.
+* `pid` - (Optional) When using DVB-Sub with Burn-In or SMPTE-TT, use this PID for the source content. Unused for DVB-Sub passthrough. All DVB-Sub content is passed through, regardless of selectors.
+
+### Embedded Source Settings
+
+* `convert_608_to_708` - (Optional) If upconvert, 608 data is both passed through via the “608 compatibility bytes” fields of the 708 wrapper as well as translated into 708. 708 data present in the source content will be discarded.
+* `scte20_detection` - (Optional) Set to “auto” to handle streams with intermittent and/or non-aligned SCTE-20 and Embedded captions.
+* `source_608_channel_number` - (Optional) Specifies the 608/708 channel number within the video track from which to extract captions. Unused for passthrough.
+
+### SCTE 20 Source Settings
+
+* `convert_608_to_708` – (Optional) If upconvert, 608 data is both passed through via the “608 compatibility bytes” fields of the 708 wrapper as well as translated into 708. 708 data present in the source content will be discarded.
+* `source_608_channel_number` - (Optional) Specifies the 608/708 channel number within the video track from which to extract captions. Unused for passthrough.
+
+### SCTE 27 Source Settings
+
+* `ocr_language` - (Optional) If you will configure a WebVTT caption description that references this caption selector, use this field to provide the language to consider when translating the image-based source to text.
+* `pid` - (Optional) The pid field is used in conjunction with the caption selector languageCode field as follows: - Specify PID and Language: Extracts captions from that PID; the language is "informational". - Specify PID and omit Language: Extracts the specified PID. - Omit PID and specify Language: Extracts the specified language, whichever PID that happens to be. - Omit PID and omit Language: Valid only if source is DVB-Sub that is being passed through; all languages will be passed through.
+
+### Teletext Source Settings
+
+* `output_rectangle` - (Optional) Optionally defines a region where TTML style captions will be displayed. See [Caption Rectangle](#caption-rectangle) for more details.
+* `page_number` - (Optional) Specifies the teletext page number within the data stream from which to extract captions. Range of 0x100 (256) to 0x8FF (2303). Unused for passthrough. Should be specified as a hexadecimal string with no “0x” prefix.
+
+### Caption Rectangle
+
+* `height` - (Required) See the description in left\_offset. For height, specify the entire height of the rectangle as a percentage of the underlying frame height. For example, "80" means the rectangle height is 80% of the underlying frame height. The top\_offset and rectangle\_height must add up to 100% or less. This field corresponds to tts:extent - Y in the TTML standard.
+* `left_offset` - (Required) Applies only if you plan to convert these source captions to EBU-TT-D or TTML in an output. (Make sure to leave the default if you don’t have either of these formats in the output.) You can define a display rectangle for the captions that is smaller than the underlying video frame. You define the rectangle by specifying the position of the left edge, top edge, bottom edge, and right edge of the rectangle, all within the underlying video frame. The units for the measurements are percentages. If you specify a value for one of these fields, you must specify a value for all of them. For leftOffset, specify the position of the left edge of the rectangle, as a percentage of the underlying frame width, and relative to the left edge of the frame. For example, "10" means the measurement is 10% of the underlying frame width. The rectangle left edge starts at that position from the left edge of the frame. This field corresponds to tts:origin - X in the TTML standard.
+* `top_offset` - (Required) See the description in left\_offset. For top\_offset, specify the position of the top edge of the rectangle, as a percentage of the underlying frame height, and relative to the top edge of the frame. For example, "10" means the measurement is 10% of the underlying frame height. The rectangle top edge starts at that position from the top edge of the frame. This field corresponds to tts:origin - Y in the TTML standard.
+* `width` - (Required) See the description in left\_offset. For width, specify the entire width of the rectangle as a percentage of the underlying frame width. For example, "80" means the rectangle width is 80% of the underlying frame width. The left\_offset and rectangle\_width must add up to 100% or less. This field corresponds to tts:extent - X in the TTML standard.
+
+### Network Input Settings
+
+* `hls_input_settings` - (Optional) Specifies HLS input settings when the uri is for a HLS manifest. See [HLS Input Settings](#hls-input-settings) for more details.
+* `server_validation` - (Optional) Check HTTPS server certificates.
+
+### HLS Input Settings
+
+* `bandwidth` - (Optional) The bitrate is specified in bits per second, as in an HLS manifest.
+* `buffer_segments` - (Optional) Buffer segments.
+* `retries` - (Optional) The number of consecutive times that attempts to read a manifest or segment must fail before the input is considered unavailable.
+* `retry_interval` - (Optional) The number of seconds between retries when an attempt to read a manifest or segment fails.
+* `scte35_source_type` - (Optional) Identifies the source for the SCTE-35 messages that MediaLive will ingest.
+
+### Automatic Input Failover Settings
+
+* `secondary_input_id` - (Required) The input ID of the secondary input in the automatic input failover pair.
+* `error_clear_time_msec` - (Optional) This clear time defines the requirement a recovered input must meet to be considered healthy. The input must have no failover conditions for this length of time. Enter a time in milliseconds. This value is particularly important if the input\_preference for the failover pair is set to PRIMARY\_INPUT\_PREFERRED, because after this time, MediaLive will switch back to the primary input.
+* `failover_conditions` - (Optional) A list of failover conditions. If any of these conditions occur, MediaLive will perform a failover to the other input. See [Failover Conditions](#failover-conditions) for more details.
+* `input_preference` - (Optional) Input preference when deciding which input to make active when a previously failed input has recovered.
+
+### Failover Conditions
+
+* `failover_condition_settings` - (Optional) Failover condition type-specific settings. See [Failover Condition Settings](#failover-condition-settings) for more details.
+
+### Failover Condition Settings
+
+* `audio_silence_settings` - (Optional) MediaLive will perform a failover if the specified audio selector is silent for the specified period. See [Audio Silence Failover Settings](#audio-silence-failover-settings) for more details.
+* `input_loss_settings` - (Optional) MediaLive will perform a failover if content is not detected in this input for the specified period. See [Input Loss Failover Settings](#input-loss-failover-settings) for more details.
+* `video_black_settings` - (Optional) MediaLive will perform a failover if content is considered black for the specified period. See [Video Black Failover Settings](#video-black-failover-settings) for more details.
+
+### Audio Silence Failover Settings
+
+* `audio_selector_name` - (Required) The name of the audio selector in the input that MediaLive should monitor to detect silence. Select your most important rendition. If you didn't create an audio selector in this input, leave blank.
+* `audio_silence_threshold_msec` - (Optional) The amount of time (in milliseconds) that the active input must be silent before automatic input failover occurs. Silence is defined as audio loss or audio quieter than -50 dBFS.
+
+### Input Loss Failover Settings
+
+* `input_loss_threshold_msec` - (Optional) The amount of time (in milliseconds) that no input is detected. After that time, an input failover will occur.
+
+### Video Black Failover Settings
+
+* `black_detect_threshold` - (Optional) A value used in calculating the threshold below which MediaLive considers a pixel to be 'black'. For the input to be considered black, every pixel in a frame must be below this threshold. The threshold is calculated as a percentage (expressed as a decimal) of white. Therefore .1 means 10% white (or 90% black). Note how the formula works for any color depth. For example, if you set this field to 0.1 in 10-bit color depth: (10230.1=102.3), which means a pixel value of 102 or less is 'black'. If you set this field to .1 in an 8-bit color depth: (2550.1=25.5), which means a pixel value of 25 or less is 'black'. The range is 0.0 to 1.0, with any number of decimal places.
+* `video_black_threshold_msec` - (Optional) The amount of time (in milliseconds) that the active input must be black before automatic input failover occurs.
+
+### Maintenance
+
+* `maintenance_day` - (Optional) The day of the week to use for maintenance.
+* `maintenance_start_time` - (Optional) The hour maintenance will start.
+
+### Media Package Settings
+
+* `channel_id` - (Required) ID of the channel in MediaPackage that is the destination for this output group.
+
+### Multiplex Settings
+
+* `multiplex_id` - (Required) The ID of the Multiplex that the encoder is providing output to.
+* `program_name` - (Optional) The program name of the Multiplex program that the encoder is providing output to.
+
+### Settings
+
+* `password_param` - (Optional) Key used to extract the password from EC2 Parameter store.
+* `stream_name` - (Optional) Stream name RTMP destinations (URLs of type rtmp://)
+* `url` - (Optional) A URL specifying a destination.
+* `username` - (Optional) Username for destination.
+
+### Audio Descriptions
+
+* `audio_selector_name` - (Required) The name of the audio selector used as the source for this AudioDescription.
+* `name` - (Required) The name of this audio description.
+* `audio_normalization_settings` - (Optional) Advanced audio normalization settings. See [Audio Normalization Settings](#audio-normalization-settings) for more details.
+* `audio_type` - (Optional) Applies only if audioTypeControl is useConfigured. The values for audioType are defined in ISO-IEC 13818-1.
+* `audio_type_control` - (Optional) Determined how audio type is determined.
+* `audio_watermark_settings` - (Optional) Settings to configure one or more solutions that insert audio watermarks in the audio encode. See [Audio Watermark Settings](#audio-watermark-settings) for more details.
+* `codec_settings` - (Optional) Audio codec settings. See [Audio Codec Settings](#audio-codec-settings) for more details.
+
+### Audio Normalization Settings
+
+* `algorithm` - (Optional) Audio normalization algorithm to use. itu17701 conforms to the CALM Act specification, itu17702 to the EBU R-128 specification.
+* `algorithm_control` - (Optional) Algorithm control for the audio description.
+* `target_lkfs` - (Optional) Target LKFS (loudness) to adjust volume to.
+
+### Audio Watermark Settings
+
+* `nielsen_watermark_settings` - (Optional) Settings to configure Nielsen Watermarks in the audio encode. See [Nielsen Watermark Settings](#nielsen-watermark-settings) for more details.
+
+### Audio Codec Settings
+
+* `aac_settings` - (Optional) Aac Settings. See [AAC Settings](#aac-settings) for more details.
+* `ac3_settings` - (Optional) Ac3 Settings. See [AC3 Settings](#ac3-settings) for more details.
+* `eac3_atmos_settings` - (Optional) - Eac3 Atmos Settings. See [EAC3 Atmos Settings](#eac3-atmos-settings)
+* `eac3_settings` - (Optional) - Eac3 Settings. See [EAC3 Settings](#eac3-settings)
+
+### AAC Settings
+
+* `bitrate` - (Optional) Average bitrate in bits/second.
+* `coding_mode` - (Optional) Mono, Stereo, or 5.1 channel layout.
+* `input_type` - (Optional) Set to "broadcasterMixedAd" when input contains pre-mixed main audio + AD (narration) as a stereo pair.
+* `profile` - (Optional) AAC profile.
+* `rate_control_mode` - (Optional) The rate control mode.
+* `raw_format` - (Optional) Sets LATM/LOAS AAC output for raw containers.
+* `sample_rate` - (Optional) Sample rate in Hz.
+* `spec` - (Optional) Use MPEG-2 AAC audio instead of MPEG-4 AAC audio for raw or MPEG-2 Transport Stream containers.
+* `vbr_quality` - (Optional) VBR Quality Level - Only used if rateControlMode is VBR.
+
+### AC3 Settings
+
+* `bitrate` - (Optional) Average bitrate in bits/second.
+* `bitstream_mode` - (Optional) Specifies the bitstream mode (bsmod) for the emitted AC-3 stream.
+* `coding_mode` - (Optional) Dolby Digital coding mode.
+* `dialnorm` - (Optional) Sets the dialnorm of the output.
+* `drc_profile` - (Optional) If set to filmStandard, adds dynamic range compression signaling to the output bitstream as defined in the Dolby Digital specification.
+* `lfe_filter` - (Optional) When set to enabled, applies a 120Hz lowpass filter to the LFE channel prior to encoding.
+* `metadata_control` - (Optional) Metadata control.
+
+### EAC3 Atmos Settings
+
+* `bitrate` - (Optional) Average bitrate in bits/second.
+* `coding_mode` - (Optional) Dolby Digital Plus with Dolby Atmos coding mode.
+* `dialnorm` - (Optional) Sets the dialnorm for the output.
+* `drc_line` - (Optional) Sets the Dolby dynamic range compression profile.
+* `drc_rf` - (Optional) Sets the profile for heavy Dolby dynamic range compression.
+* `height_trim` - (Optional) Height dimensional trim.
+* `surround_trim` - (Optional) Surround dimensional trim.
+
+### EAC3 Settings
+
+* `attenuation_control` - (Optional) Sets the attenuation control.
+* `bitrate` - (Optional) Average bitrate in bits/second.
+* `bitstream_mode` - (Optional) Specifies the bitstream mode (bsmod) for the emitted AC-3 stream.
+* `coding_mode` - (Optional) Dolby Digital Plus coding mode.
+
+### Nielsen Watermark Settings
+
+* `nielsen_cbet_settings` - (Optional) Used to insert watermarks of type Nielsen CBET. See [Nielsen CBET Settings](#nielsen-cbet-settings) for more details.
+* `nielsen_distribution_type` - (Optional) Distribution types to assign to the watermarks. Options are `PROGRAM_CONTENT` and `FINAL_DISTRIBUTOR`.
+* `nielsen_naes_ii_nw_settings` - (Optional) Used to insert watermarks of type Nielsen NAES, II (N2) and Nielsen NAES VI (NW). See [Nielsen NAES II NW Settings](#nielsen-naes-ii-nw-settings) for more details.
+
+### Nielsen CBET Settings
+
+* `cbet_check_digit` - (Required) CBET check digits to use for the watermark.
+* `cbet_stepaside` - (Required) Determines the method of CBET insertion mode when prior encoding is detected on the same layer.
+* `csid` - (Required) CBET source ID to use in the watermark.
+
+### Nielsen NAES II NW Settings
+
+* `check_digit` - (Required) Check digit string for the watermark.
+* `sid` - (Required) The Nielsen Source ID to include in the watermark.
+
+### Output Groups
+
+* `output_group_settings` - (Required) Settings associated with the output group. See [Output Group Settings](#output-group-settings) for more details.
+* `outputs` - (Required) List of outputs. See [Outputs](#outputs) for more details.
+* `name` - (Optional) Custom output group name defined by the user.
+
+### Output Group Settings
+
+* `archive_group_settings` - (Optional) Archive group settings. See [Archive Group Settings](#archive-group-settings) for more details.
+* `media_package_group_settings` - (Optional) Media package group settings. See [Media Package Group Settings](#media-package-group-settings) for more details.
+* `multiplex_group_sttings` - (Optional) Multiplex group settings. Attribute can be passed as an empty block.
+* `rtmp_group_settings` - (Optional) RTMP group settings. See [RTMP Group Settings](#rtmp-group-settings) for more details.
+* `udp_group_sttings` - (Optional) UDP group settings. See [UDP Group Settings](#udp-group-settings) for more details.
+
+### Outputs
+
+* `output_settings` - (Required) Settings for output. See [Output Settings](#output-settings) for more details.
+* `audio_description_names` - (Optional) The names of the audio descriptions used as audio sources for the output.
+* `caption_description_names` - (Optional) The names of the caption descriptions used as caption sources for the output.
+* `output_name` - (Required) The name used to identify an output.
+* `video_description_name` - (Optional) The name of the video description used as video source for the output.
+
+### Timecode Config
+
+* `source` - (Optional) The source for the timecode that will be associated with the events outputs.
+* `sync_threshold` - (Optional) Threshold in frames beyond which output timecode is resynchronized to the input timecode.
+
+### Video Descriptions
+
+* `name` - (Required) The name of the video description.
+* `codec_settings` - (Optional) The video codec settings. See [Video Codec Settings](#video-codec-settings) for more details.
+* `height` - Output video height in pixels.
+* `respond_to_afd` - (Optional) Indicate how to respond to the AFD values that might be in the input video.
+* `scaling_behavior` - (Optional) Behavior on how to scale.
+* `sharpness` - (Optional) Changes the strength of the anti-alias filter used for scaling.
+* `width` - (Optional) Output video width in pixels.
+
+### Video Codec Settings
+
+* `frame_capture_settings` - (Optional) Frame capture settings. See [Frame Capture Settings](#frame-capture-settings) for more details.
+* `h264_settings` - (Optional) H264 settings. See [H264 Settings](#h264-settings) for more details.
+
+### Frame Capture Settings
+
+* `capture_interval` - (Optional) The frequency at which to capture frames for inclusion in the output.
+* `capture_interval_units` - (Optional) Unit for the frame capture interval.
+
+### H264 Settings
+
+* `adaptive_quantization` - (Optional) Enables or disables adaptive quantization.
+* `afd_signaling` - (Optional) Indicates that AFD values will be written into the output stream.
+* `bitrate` - (Optional) Average bitrate in bits/second.
+* `buf_fil_pct` - (Optional) Percentage of the buffer that should initially be filled.
+* `buf_size` - (Optional) Size of buffer in bits.
+* `color_metadata` - (Optional) Includes color space metadata in the output.
+* `entropy_encoding` - (Optional) Entropy encoding mode.
+* `filter_settings` - (Optional) Filters to apply to an encode. See [H264 Filter Settings](#h264-filter-settings) for more details.
+* `fixed_afd` - (Optional) Four bit AFD value to write on all frames of video in the output stream.
+* `flicer_aq` - (Optional) Makes adjustments within each frame to reduce flicker on the I-frames.
+* `force_field_pictures` - (Optional) Controls whether coding is performed on a field basis or on a frame basis.
+* `framerate_control` - (Optional) Indicates how the output video frame rate is specified.
+* `framerate_denominator` - (Optional) Framerate denominator.
+* `framerate_numerator` - (Optional) Framerate numerator.
+* `gop_b_reference` - (Optional) GOP-B reference.
+* `gop_closed_cadence` - (Optional) Frequency of closed GOPs.
+* `gop_num_b_frames` - (Optional) Number of B-frames between reference frames.
+* `gop_size` - (Optional) GOP size in units of either frames of seconds per `gop_size_units`.
+* `gop_size_units` - (Optional) Indicates if the `gop_size` is specified in frames or seconds.
+* `level` - (Optional) H264 level.
+* `look_ahead_rate_control` - (Optional) Amount of lookahead.
+* `max_bitrate` - (Optional) Set the maximum bitrate in order to accommodate expected spikes in the complexity of the video.
+* `min_interval` - (Optional) Min interval.
+* `num_ref_frames` - (Optional) Number of reference frames to use.
+* `par_control` - (Optional) Indicates how the output pixel aspect ratio is specified.
+* `par_denominator` - (Optional) Pixel Aspect Ratio denominator.
+* `par_numerator` - (Optional) Pixel Aspect Ratio numerator.
+* `profile` - (Optional) H264 profile.
+* `quality_level` - (Optional) Quality level.
+* `qvbr_quality_level` - (Optional) Controls the target quality for the video encode.
+* `rate_control_mode` - (Optional) Rate control mode.
+* `scan_type` - (Optional) Sets the scan type of the output.
+* `scene_change_detect` - (Optional) Scene change detection.
+* `slices` - (Optional) Number of slices per picture.
+* `softness` - (Optional) Softness.
+* `spatial_aq` - (Optional) Makes adjustments within each frame based on spatial variation of content complexity.
+* `subgop_length` - (Optional) Subgop length.
+* `syntax` - (Optional) Produces a bitstream compliant with SMPTE RP-2027.
+* `temporal_aq` - (Optional) Makes adjustments within each frame based on temporal variation of content complexity.
+* `timecode_insertion` - (Optional) Determines how timecodes should be inserted into the video elementary stream.
+
+### H264 Filter Settings
+
+* `temporal_filter_settings` - (Optional) Temporal filter settings. See [Temporal Filter Settings](#temporal-filter-settings)
+
+### H265 Settings
+
+* `adaptive_quantization` - (Optional) Enables or disables adaptive quantization.
+* `afd_signaling` - (Optional) Indicates that AFD values will be written into the output stream.
+* `alternative_transfer_function` - (Optional) Whether or not EML should insert an Alternative Transfer Function SEI message.
+* `bitrate` - (Required) Average bitrate in bits/second.
+* `buf_size` - (Optional) Size of buffer in bits.
+* `color_metadata` - (Optional) Includes color space metadata in the output.
+* `color_space_settings` (Optional) Define the color metadata for the output. [H265 Color Space Settings](#h265-color-space-settings) for more details.
+* `filter_settings` - (Optional) Filters to apply to an encode. See [H265 Filter Settings](#h265-filter-settings) for more details.
+* `fixed_afd` - (Optional) Four bit AFD value to write on all frames of video in the output stream.
+* `flicer_aq` - (Optional) Makes adjustments within each frame to reduce flicker on the I-frames.
+* `framerate_denominator` - (Required) Framerate denominator.
+* `framerate_numerator` - (Required) Framerate numerator.
+* `gop_closed_cadence` - (Optional) Frequency of closed GOPs.
+* `gop_size` - (Optional) GOP size in units of either frames of seconds per `gop_size_units`.
+* `gop_size_units` - (Optional) Indicates if the `gop_size` is specified in frames or seconds.
+* `level` - (Optional) H265 level.
+* `look_ahead_rate_control` - (Optional) Amount of lookahead.
+* `max_bitrate` - (Optional) Set the maximum bitrate in order to accommodate expected spikes in the complexity of the video.
+* `min_interval` - (Optional) Min interval.
+* `par_denominator` - (Optional) Pixel Aspect Ratio denominator.
+* `par_numerator` - (Optional) Pixel Aspect Ratio numerator.
+* `profile` - (Optional) H265 profile.
+* `qvbr_quality_level` - (Optional) Controls the target quality for the video encode.
+* `rate_control_mode` - (Optional) Rate control mode.
+* `scan_type` - (Optional) Sets the scan type of the output.
+* `scene_change_detect` - (Optional) Scene change detection.
+* `slices` - (Optional) Number of slices per picture.
+* `tier` - (Optional) Set the H265 tier in the output.
+* `timecode_burnin_settings` - (Optional) Apply a burned in timecode. See [H265 Timecode Burnin Settings](#h265-timecode-burnin-settings) for more details.
+* `timecode_insertion` - (Optional) Determines how timecodes should be inserted into the video elementary stream.
+
+### H265 Color Space Settings
+
+* `color_space_passthrough_settings` - (Optional) Sets the colorspace metadata to be passed through.
+* `dolby_vision81_settings` - (Optional) Set the colorspace to Dolby Vision81.
+* `hdr10_settings` - (Optional) Set the colorspace to be HDR10. See [H265 HDR10 Settings](#h265-hdr10-settings) for more details.
+* `rec601_settings` - (Optional) Set the colorspace to Rec. 601.
+* `rec709_settings` - (Optional) Set the colorspace to Rec. 709.
+
+### H265 HDR10 Settings
+
+* `max_cll` - (Optional) Sets the MaxCLL value for HDR10.
+* `max_fall` - (Optional) Sets the MaxFALL value for HDR10.
+
+### H265 Filter Settings
+
+* `temporal_filter_settings` - (Optional) Temporal filter settings. See [Temporal Filter Settings](#temporal-filter-settings)
+
+### H265 Timecode Burnin Settings
+
+* `timecode_burnin_font_size` - (Optional) Sets the size of the burned in timecode.
+* `timecode_burnin_position` - (Optional) Sets the position of the burned in timecode.
+* `prefix` - (Optional) Set a prefix on the burned in timecode.
+
+### Temporal Filter Settings
+
+* `post_filter_sharpening` - (Optional) Post filter sharpening.
+* `strength` - (Optional) Filter strength.
+
+### Caption Descriptions
+
+* `accessibility` - (Optional) Indicates whether the caption track implements accessibility features such as written descriptions of spoken dialog, music, and sounds.
+* `caption_selector_name` - (Required) Specifies which input caption selector to use as a caption source when generating output captions. This field should match a captionSelector name.
+* `destination_settings` - (Optional) Additional settings for captions destination that depend on the destination type. See [Destination Settings](#destination-settings) for more details.
+* `language_code` - (Optional) ISO 639-2 three-digit code.
+* `language_description` - (Optional) Human readable information to indicate captions available for players (eg. English, or Spanish).
+* `name` - (Required) Name of the caption description. Used to associate a caption description with an output. Names must be unique within an event.
+
+### Destination Settings
+
+* `arib_destination_settings` - (Optional) ARIB Destination Settings.
+* `burn_in_destination_settings` - (Optional) Burn In Destination Settings. See [Burn In Destination Settings](#burn-in-destination-settings) for more details.
+* `dvb_sub_destination_settings` - (Optional) DVB Sub Destination Settings. See [DVB Sub Destination Settings](#dvb-sub-destination-settings) for more details.
+* `ebu_tt_d_destination_settings` - (Optional) EBU TT D Destination Settings. See [EBU TT D Destination Settings](#ebu-tt-d-destination-settings) for more details.
+* `embedded_destination_settings` - (Optional) Embedded Destination Settings.
+* `embedded_plus_scte20_destination_settings` - (Optional) Embedded Plus SCTE20 Destination Settings.
+* `rtmp_caption_info_destination_settings` - (Optional) RTMP Caption Info Destination Settings.
+* `scte20_plus_embedded_destination_settings` - (Optional) SCTE20 Plus Embedded Destination Settings.
+* `scte27_destination_settings` – (Optional) SCTE27 Destination Settings.
+* `smpte_tt_destination_settings` – (Optional) SMPTE TT Destination Settings.
+* `teletext_destination_settings` – (Optional) Teletext Destination Settings.
+* `ttml_destination_settings` – (Optional) TTML Destination Settings. See [TTML Destination Settings](#ttml-destination-settings) for more details.
+* `webvtt_destination_settings` - (Optional) WebVTT Destination Settings. See [WebVTT Destination Settings](#webvtt-destination-settings) for more details.
+
+### Burn In Destination Settings
+
+* `alignment` – (Optional) If no explicit xPosition or yPosition is provided, setting alignment to centered will place the captions at the bottom center of the output. Similarly, setting a left alignment will align captions to the bottom left of the output. If x and y positions are given in conjunction with the alignment parameter, the font will be justified (either left or centered) relative to those coordinates. Selecting “smart” justification will left-justify live subtitles and center-justify pre-recorded subtitles. All burn-in and DVB-Sub font settings must match.
+* `background_color` – (Optional) Specifies the color of the rectangle behind the captions. All burn-in and DVB-Sub font settings must match.
+* `background_opacity` – (Optional) Specifies the opacity of the background rectangle. 255 is opaque; 0 is transparent. Leaving this parameter out is equivalent to setting it to 0 (transparent). All burn-in and DVB-Sub font settings must match.
+* `font` – (Optional) External font file used for caption burn-in. File extension must be ‘ttf’ or ‘tte’. Although the user can select output fonts for many different types of input captions, embedded, STL and teletext sources use a strict grid system. Using external fonts with these caption sources could cause unexpected display of proportional fonts. All burn-in and DVB-Sub font settings must match. See [Font](#font) for more details.
+* `font_color` – (Optional) Specifies the color of the burned-in captions. This option is not valid for source captions that are STL, 608/embedded or teletext. These source settings are already pre-defined by the caption stream. All burn-in and DVB-Sub font settings must match.
+* `font_opacity` – (Optional) Specifies the opacity of the burned-in captions. 255 is opaque; 0 is transparent. All burn-in and DVB-Sub font settings must match.
+* `font_resolution` – (Optional) Font resolution in DPI (dots per inch); default is 96 dpi. All burn-in and DVB-Sub font settings must match.
+* `font_size` – (Optional) When set to ‘auto’ fontSize will scale depending on the size of the output. Giving a positive integer will specify the exact font size in points. All burn-in and DVB-Sub font settings must match.
+* `outline_color` – (Optional) Specifies font outline color. This option is not valid for source captions that are either 608/embedded or teletext. These source settings are already pre-defined by the caption stream. All burn-in and DVB-Sub font settings must match.
+* `outline_size` – (Optional) Specifies font outline size in pixels. This option is not valid for source captions that are either 608/embedded or teletext. These source settings are already pre-defined by the caption stream. All burn-in and DVB-Sub font settings must match.
+* `shadow_color` – (Optional) Specifies the color of the shadow cast by the captions. All burn-in and DVB-Sub font settings must match.
+* `shadow_opacity` – (Optional) Specifies the opacity of the shadow. 255 is opaque; 0 is transparent. Leaving this parameter out is equivalent to setting it to 0 (transparent). All burn-in and DVB-Sub font settings must match.
+* `shadow_x_offset` – (Optional) Specifies the horizontal offset of the shadow relative to the captions in pixels. A value of -2 would result in a shadow offset 2 pixels to the left. All burn-in and DVB-Sub font settings must match.
+* `shadow_y_offset` – (Optional) Specifies the vertical offset of the shadow relative to the captions in pixels. A value of -2 would result in a shadow offset 2 pixels above the text. All burn-in and DVB-Sub font settings must match.
+* `teletext_grid_control` – (Optional) Controls whether a fixed grid size will be used to generate the output subtitles bitmap. Only applicable for Teletext inputs and DVB-Sub/Burn-in outputs.
+* `x_position` – (Optional) Specifies the horizontal position of the caption relative to the left side of the output in pixels. A value of 10 would result in the captions starting 10 pixels from the left of the output. If no explicit xPosition is provided, the horizontal caption position will be determined by the alignment parameter. All burn-in and DVB-Sub font settings must match.
+* `y_position` – (Optional) Specifies the vertical position of the caption relative to the top of the output in pixels. A value of 10 would result in the captions starting 10 pixels from the top of the output. If no explicit yPosition is provided, the caption will be positioned towards the bottom of the output. All burn-in and DVB-Sub font settings must match.
+
+### DVB Sub Destination Settings
+
+* `alignment` – (Optional) If no explicit xPosition or yPosition is provided, setting alignment to centered will place the captions at the bottom center of the output. Similarly, setting a left alignment will align captions to the bottom left of the output. If x and y positions are given in conjunction with the alignment parameter, the font will be justified (either left or centered) relative to those coordinates. Selecting “smart” justification will left-justify live subtitles and center-justify pre-recorded subtitles. This option is not valid for source captions that are STL or 608/embedded. These source settings are already pre-defined by the caption stream. All burn-in and DVB-Sub font settings must match.
+* `background_color` – (Optional) Specifies the color of the rectangle behind the captions. All burn-in and DVB-Sub font settings must match.
+* `background_opacity` – (Optional) Specifies the opacity of the background rectangle. 255 is opaque; 0 is transparent. Leaving this parameter blank is equivalent to setting it to 0 (transparent). All burn-in and DVB-Sub font settings must match.
+* `font` – (Optional) External font file used for caption burn-in. File extension must be ‘ttf’ or ‘tte’. Although the user can select output fonts for many different types of input captions, embedded, STL and teletext sources use a strict grid system. Using external fonts with these caption sources could cause unexpected display of proportional fonts. All burn-in and DVB-Sub font settings must match. See [Font](#font) for more details.
+* `font_color` – (Optional) Specifies the color of the burned-in captions. This option is not valid for source captions that are STL, 608/embedded or teletext. These source settings are already pre-defined by the caption stream. All burn-in and DVB-Sub font settings must match.
+* `font_opacity` – (Optional) Specifies the opacity of the burned-in captions. 255 is opaque; 0 is transparent. All burn-in and DVB-Sub font settings must match.
+* `font_resolution` – (Optional) Font resolution in DPI (dots per inch); default is 96 dpi. All burn-in and DVB-Sub font settings must match.
+* `font_size` – (Optional) When set to auto fontSize will scale depending on the size of the output. Giving a positive integer will specify the exact font size in points. All burn-in and DVB-Sub font settings must match.
+* `outline_color` – (Optional) Specifies font outline color. This option is not valid for source captions that are either 608/embedded or teletext. These source settings are already pre-defined by the caption stream. All burn-in and DVB-Sub font settings must match.
+* `outline_size` – (Optional) Specifies font outline size in pixels. This option is not valid for source captions that are either 608/embedded or teletext. These source settings are already pre-defined by the caption stream. All burn-in and DVB-Sub font settings must match.
+* `shadow_color` – (Optional) Specifies the color of the shadow cast by the captions. All burn-in and DVB-Sub font settings must match.
+* `shadow_opacity` – (Optional) Specifies the opacity of the shadow. 255 is opaque; 0 is transparent. Leaving this parameter blank is equivalent to setting it to 0 (transparent). All burn-in and DVB-Sub font settings must match.
+* `shadow_x_offset` – (Optional) Specifies the horizontal offset of the shadow relative to the captions in pixels. A value of -2 would result in a shadow offset 2 pixels to the left. All burn-in and DVB-Sub font settings must match.
+* `shadow_y_offset` – (Optional) Specifies the vertical offset of the shadow relative to the captions in pixels. A value of -2 would result in a shadow offset 2 pixels above the text. All burn-in and DVB-Sub font settings must match.
+* `teletext_grid_control` – (Optional) Controls whether a fixed grid size will be used to generate the output subtitles bitmap. Only applicable for Teletext inputs and DVB-Sub/Burn-in outputs.
+* `x_position` – (Optional) Specifies the horizontal position of the caption relative to the left side of the output in pixels. A value of 10 would result in the captions starting 10 pixels from the left of the output. If no explicit xPosition is provided, the horizontal caption position will be determined by the alignment parameter. This option is not valid for source captions that are STL, 608/embedded or teletext. These source settings are already pre-defined by the caption stream. All burn-in and DVB-Sub font settings must match.
+* `y_position` – (Optional) Specifies the vertical position of the caption relative to the top of the output in pixels. A value of 10 would result in the captions starting 10 pixels from the top of the output. If no explicit yPosition is provided, the caption will be positioned towards the bottom of the output. This option is not valid for source captions that are STL, 608/embedded or teletext. These source settings are already pre-defined by the caption stream. All burn-in and DVB-Sub font settings must match.
+
+### EBU TT D Destination Settings
+
+* `copyright_holder` – (Optional) Complete this field if you want to include the name of the copyright holder in the copyright tag in the captions metadata.
+* `fill_line_gap` – (Optional) Specifies how to handle the gap between the lines (in multi-line captions). - enabled: Fill with the captions background color (as specified in the input captions). - disabled: Leave the gap unfilled.
+* `font_family` – (Optional) Specifies the font family to include in the font data attached to the EBU-TT captions. Valid only if styleControl is set to include. If you leave this field empty, the font family is set to “monospaced”. (If styleControl is set to exclude, the font family is always set to “monospaced”.) You specify only the font family. All other style information (color, bold, position and so on) is copied from the input captions. The size is always set to 100% to allow the downstream player to choose the size. - Enter a list of font families, as a comma-separated list of font names, in order of preference. The name can be a font family (such as “Arial”), or a generic font family (such as “serif”), or “default” (to let the downstream player choose the font). - Leave blank to set the family to “monospace”.
+* `style_control` – (Optional) Specifies the style information (font color, font position, and so on) to include in the font data that is attached to the EBU-TT captions. - include: Take the style information (font color, font position, and so on) from the source captions and include that information in the font data attached to the EBU-TT captions. This option is valid only if the source captions are Embedded or Teletext. - exclude: In the font data attached to the EBU-TT captions, set the font family to “monospaced”. Do not include any other style information.
+
+### TTML Destination Settings
+
+* `style_control` – (Optional) This field is not currently supported and will not affect the output styling. Leave the default value.
+
+### WebVTT Destination Settings
+
+* `style_control` - (Optional) Controls whether the color and position of the source captions is passed through to the WebVTT output captions. PASSTHROUGH - Valid only if the source captions are EMBEDDED or TELETEXT. NO\_STYLE\_DATA - Don’t pass through the style. The output captions will not contain any font styling information.
+
+### Font
+
+* `password_param` – (Optional) Key used to extract the password from EC2 Parameter store.
+* `uri` – (Required) Path to a file accessible to the live stream.
+* `username` – (Optional) Username to be used.
+
+### Global Configuration
+
+* `initial_audio_gain` – (Optional) Value to set the initial audio gain for the Live Event.
+* `input_end_action` – (Optional) Indicates the action to take when the current input completes (e.g. end-of-file). When switchAndLoopInputs is configured the encoder will restart at the beginning of the first input. When “none” is configured the encoder will transcode either black, a solid color, or a user specified slate images per the “Input Loss Behavior” configuration until the next input switch occurs (which is controlled through the Channel Schedule API).
+* `input_loss_behavior` - (Optional) Settings for system actions when input is lost. See [Input Loss Behavior](#input-loss-behavior) for more details.
+* `output_locking_mode` – (Optional) Indicates how MediaLive pipelines are synchronized. PIPELINE\_LOCKING - MediaLive will attempt to synchronize the output of each pipeline to the other. EPOCH\_LOCKING - MediaLive will attempt to synchronize the output of each pipeline to the Unix epoch.
+* `output_timing_source` – (Optional) Indicates whether the rate of frames emitted by the Live encoder should be paced by its system clock (which optionally may be locked to another source via NTP) or should be locked to the clock of the source that is providing the input stream.
+* `support_low_framerate_inputs` – (Optional) Adjusts video input buffer for streams with very low video framerates. This is commonly set to enabled for music channels with less than one video frame per second.
+
+### Input Loss Behavior
+
+* `password_param` – (Optional) Key used to extract the password from EC2 Parameter store.
+* `uri` – (Required) Path to a file accessible to the live stream.
+* `username` – (Optional) Username to be used.
+
+### Motion Graphics Configuration
+
+* `motion_graphics_insertion` – (Optional) Motion Graphics Insertion.
+* `motion_graphics_settings`– (Required) Motion Graphics Settings. See [Motion Graphics Settings](#motion-graphics-settings) for more details.
+
+### Motion Graphics Settings
+
+* `html_motion_graphics_settings` – (Optional) Html Motion Graphics Settings.
+
+### Nielsen Configuration
+
+* `distributor_id` – (Optional) Enter the Distributor ID assigned to your organization by Nielsen.
+* `nielsen_pcm_to_id3_tagging` – (Optional) Enables Nielsen PCM to ID3 tagging.
+
+### Avail Blanking
+
+* `avail_blanking_image` - (Optional) Blanking image to be used. See [Avail Blanking Image](#avail-blanking-image) for more details.
+* `state` - (Optional) When set to enabled, causes video, audio and captions to be blanked when insertion metadata is added.
+
+### Avail Blanking Image
+
+* `uri` - (Required) Path to a file accessible to the live stream.
+* `password_param` - (Optional) Key used to extract the password from EC2 Parameter store.
+* `username` - (Optional). Username to be used.
+
+### Archive Group Settings
+
+* `destination` - (Required) A director and base filename where archive files should be written. See [Destination](#destination) for more details.
+* `archive_cdn_settings` - (Optional) Parameters that control the interactions with the CDN. See [Archive CDN Settings](#archive-cdn-settings) for more details.
+* `rollover_interval` - (Optional) Number of seconds to write to archive file before closing and starting a new one.
+
+### Media Package Group Settings
+
+* `destination` - (Required) A director and base filename where archive files should be written. See [Destination](#destination) for more details.
+
+### RTMP Group Settings
+
+* `ad_markers` - (Optional) The ad marker type for this output group.
+* `authentication_scheme` - (Optional) Authentication scheme to use when connecting with CDN.
+* `cache_full_behavior` - (Optional) Controls behavior when content cache fills up.
+* `cache_length` - (Optional) Cache length in seconds, is used to calculate buffer size.
+* `caption_data` - (Optional) Controls the types of data that passes to onCaptionInfo outputs.
+* `input_loss_action` - (Optional) Controls the behavior of the RTMP group if input becomes unavailable.
+* `restart_delay` - (Optional) Number of seconds to wait until a restart is initiated.
+
+### UDP Group Settings
+
+* `input_loss_action` - (Optional) Specifies behavior of last resort when input video os lost.
+* `timed_metadata_id3_frame` - (Optional) Indicates ID3 frame that has the timecode.
+* `timed_metadta_id3_period`- (Optional) Timed metadata interval in seconds.
+
+### Destination
+
+* `destination_ref_id` - (Required) Reference ID for the destination.
+
+### Archive CDN Settings
+
+* `archive_s3_settings` - (Optional) Archive S3 Settings. See [Archive S3 Settings](#archive-s3-settings) for more details.
+
+### Archive S3 Settings
+
+* `canned_acl` - (Optional) Specify the canned ACL to apply to each S3 request.
+
+### Output Settings
+
+* `archive_output_settings` - (Optional) Archive output settings. See [Archive Output Settings](#archive-output-settings) for more details.
+* `media_package_output_settings` - (Optional) Media package output settings. This can be set as an empty block.
+* `multiplex_output_settings` - (Optional) Multiplex output settings. See [Multiplex Output Settings](#multiplex-output-settings) for more details.
+* `rtmp_output_settings` - (Optional) RTMP output settings. See [RTMP Output Settings](#rtmp-output-settings) for more details.
+* `udp_output_settings` - (Optional) UDP output settings. See [UDP Output Settings](#udp-output-settings) for more details.
+
+### Archive Output Settings
+
+* `container_settings` - (Required) Settings specific to the container type of the file. See [Container Settings](#container-settings) for more details.
+* `extension` - (Optional) Output file extension.
+* `name_modifier` - (Optional) String concatenated to the end of the destination filename. Required for multiple outputs of the same type.
+
+### Multiplex Output Settings
+
+* `destination` - (Required) Destination is a multiplex. See [Destination](#destination) for more details.
+
+### RTMP Output Settings
+
+- `destination` - (Required) The RTMP endpoint excluding the stream name. See [Destination](#destination) for more details.
+- `certificate_mode` - (Optional) Setting to allow self signed or verified RTMP certificates.
+- `connection_retry_interval` - (Optional) Number of seconds to wait before retrying connection to the flash media server if the connection is lost.
+- `num_retries` - (Optional) Number of retry attempts.
+
+### Container Settings
+
+* `m2ts_settings` - (Optional) M2TS Settings. See [M2TS Settings](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-medialive-channel-m2tssettings.html) for more details.
+* `raw_settings`- (Optional) Raw Settings. This can be set as an empty block.
+
+### UDP Output Settings
+
+* `container_settings` - (Required) UDP container settings. See [Container Settings](#container-settings) for more details.
+* `destination` - (Required) Destination address and port number for RTP or UDP packets. See [Destination](#destination) for more details.
+* `buffer_msec` - (Optional) UDP output buffering in milliseconds.
+* `fec_output_setting` - (Optional) Settings for enabling and adjusting Forward Error Correction on UDP outputs. See [FEC Output Settings](#fec-output-settings) for more details.
+
+### FEC Output Settings
+
+* `column_depth` - (Optional) The height of the FEC protection matrix.
+* `include_fec` - (Optional) Enables column only or column and row based FEC.
+* `row_length` - (Optional) The width of the FEC protection matrix.
+
+### VPC
+
+* `subnet_ids` - (Required) A list of VPC subnet IDs from the same VPC. If STANDARD channel, subnet IDs must be mapped to two unique availability zones (AZ).
+* `public_address_allocation_ids` - (Required) List of public address allocation ids to associate with ENIs that will be created in Output VPC. Must specify one for SINGLE_PIPELINE, two for STANDARD channels.
+* `security_group_ids` - (Optional) A list of up to 5 EC2 VPC security group IDs to attach to the Output VPC network interfaces. If none are specified then the VPC default security group will be used.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Channel.
+* `channel_id` - ID of the Channel.
+
+## Timeouts
+
+[Configuration options](https://www.terraform.io/docs/configuration/blocks/resources/syntax.html#operation-timeouts):
+
+* `create` - (Default `15m`)
+* `update` - (Default `15m`)
+* `delete` - (Default `15m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import MediaLive Channel using the `channel_id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import MediaLive Channel using the `channel_id`. For example:
+
+```console
+% terraform import aws_medialive_channel.example 1234567
+```
+
+<!-- cache-key: cdktf-0.18.0 input-d3f7e093a01633975d88f239894e4bccf4a8cd3abaf84dcdf67f0af047ec3f42 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/medialive_input.html.markdown b/website/docs/cdktf/python/r/medialive_input.html.markdown
new file mode 100644
index 00000000000..4e064a072e6
--- /dev/null
+++ b/website/docs/cdktf/python/r/medialive_input.html.markdown
@@ -0,0 +1,131 @@
+---
+subcategory: "Elemental MediaLive"
+layout: "aws"
+page_title: "AWS: aws_medialive_input"
+description: |-
+  Terraform resource for managing an AWS MediaLive Input.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_medialive_input
+
+Terraform resource for managing an AWS MediaLive Input.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.medialive_input import MedialiveInput
+from imports.aws.medialive_input_security_group import MedialiveInputSecurityGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = MedialiveInputSecurityGroup(self, "example",
+            tags={
+                "ENVIRONMENT": "prod"
+            },
+            whitelist_rules=[MedialiveInputSecurityGroupWhitelistRules(
+                cidr="10.0.0.8/32"
+            )
+            ]
+        )
+        aws_medialive_input_example = MedialiveInput(self, "example_1",
+            input_security_groups=[example.id],
+            name="example-input",
+            tags={
+                "ENVIRONMENT": "prod"
+            },
+            type="UDP_PUSH"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_medialive_input_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) Name of the input.
+* `input_security_groups` - (Required) List of input security groups.
+* `type` - (Required) The different types of inputs that AWS Elemental MediaLive supports.
+
+The following arguments are optional:
+
+* `destinations` - (Optional) Destination settings for PUSH type inputs. See [Destinations](#destinations) for more details.
+* `input_devices` - (Optional) Settings for the devices. See [Input Devices](#input-devices) for more details.
+* `media_connect_flows` - (Optional) A list of the MediaConnect Flows. See [Media Connect Flows](#media-connect-flows) for more details.
+* `role_arn` - (Optional) The ARN of the role this input assumes during and after creation.
+* `sources` - (Optional) The source URLs for a PULL-type input. See [Sources](#sources) for more details.
+* `tags`- (Optional) A map of tags to assign to the Input. If configured with a provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `vpc` - (Optional) Settings for a private VPC Input. See [VPC](#vpc) for more details.
+
+### Destinations
+
+* `stream_name` - A unique name for the location the RTMP stream is being pushed to.
+
+### Input Devices
+
+* `id` - The unique ID for the device.
+
+### Media Connect Flows
+
+* `flow_arn` - The ARN of the MediaConnect Flow
+
+### Sources
+
+* `password_param` - The key used to extract the password from EC2 Parameter store.
+* `url` - The URL where the stream is pulled from.
+* `username` - The username for the input source.
+
+### VPC
+
+* `subnet_ids` - A list of 2 VPC subnet IDs from the same VPC.
+* `security_group_ids` - A list of up to 5 EC2 VPC security group IDs to attach to the Input.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Input.
+* `attached_channels` - Channels attached to Input.
+* `input_class` - The input class.
+* `input_partner_ids` - A list of IDs for all Inputs which are partners of this one.
+* `input_source_type` - Source type of the input.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `30m`)
+* `update` - (Default `30m`)
+* `delete` - (Default `30m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import MediaLive Input using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import MediaLive Input using the `id`. For example:
+
+```console
+% terraform import aws_medialive_input.example 12345678
+```
+
+<!-- cache-key: cdktf-0.18.0 input-e7c2ee81ba845515caa1acd230663186d94a15faebb59c803051c3bdd77ad5df -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/medialive_input_security_group.html.markdown b/website/docs/cdktf/python/r/medialive_input_security_group.html.markdown
new file mode 100644
index 00000000000..85d9fedd022
--- /dev/null
+++ b/website/docs/cdktf/python/r/medialive_input_security_group.html.markdown
@@ -0,0 +1,91 @@
+---
+subcategory: "Elemental MediaLive"
+layout: "aws"
+page_title: "AWS: aws_medialive_input_security_group"
+description: |-
+  Terraform resource for managing an AWS MediaLive InputSecurityGroup.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_medialive_input_security_group
+
+Terraform resource for managing an AWS MediaLive InputSecurityGroup.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.medialive_input_security_group import MedialiveInputSecurityGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        MedialiveInputSecurityGroup(self, "example",
+            tags={
+                "ENVIRONMENT": "prod"
+            },
+            whitelist_rules=[MedialiveInputSecurityGroupWhitelistRules(
+                cidr="10.0.0.8/32"
+            )
+            ]
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `whitelist_rules` - (Required) Whitelist rules. See [Whitelist Rules](#whitelist-rules) for more details.
+
+The following arguments are optional:
+
+* `tags` - (Optional) A map of tags to assign to the InputSecurityGroup. If configured with a provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Whitelist Rules
+
+* `cidr` (Required) - The IPv4 CIDR that's whitelisted.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - InputSecurityGroup Id.
+* `arn` - ARN of the InputSecurityGroup.
+* `inputs` - The list of inputs currently using this InputSecurityGroup.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `5m`)
+* `update` - (Default `5m`)
+* `delete` - (Default `5m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import MediaLive InputSecurityGroup using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import MediaLive InputSecurityGroup using the `id`. For example:
+
+```console
+% terraform import aws_medialive_input_security_group.example 123456
+```
+
+<!-- cache-key: cdktf-0.18.0 input-9f6c1160cb47fd911bf8108f99b94f58136c37097f8518ea694bbfb001e3a753 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/medialive_multiplex.html.markdown b/website/docs/cdktf/python/r/medialive_multiplex.html.markdown
new file mode 100644
index 00000000000..3a6591efef9
--- /dev/null
+++ b/website/docs/cdktf/python/r/medialive_multiplex.html.markdown
@@ -0,0 +1,107 @@
+---
+subcategory: "Elemental MediaLive"
+layout: "aws"
+page_title: "AWS: aws_medialive_multiplex"
+description: |-
+  Terraform resource for managing an AWS MediaLive Multiplex.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_medialive_multiplex
+
+Terraform resource for managing an AWS MediaLive Multiplex.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_availability_zones import DataAwsAvailabilityZones
+from imports.aws.medialive_multiplex import MedialiveMultiplex
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        available = DataAwsAvailabilityZones(self, "available",
+            state="available"
+        )
+        MedialiveMultiplex(self, "example",
+            availability_zones=[
+                Token.as_string(Fn.lookup_nested(available.names, ["0"])),
+                Token.as_string(Fn.lookup_nested(available.names, ["1"]))
+            ],
+            multiplex_settings=MedialiveMultiplexMultiplexSettings(
+                maximum_video_buffer_delay_milliseconds=1000,
+                transport_stream_bitrate=1000000,
+                transport_stream_id=1,
+                transport_stream_reserved_bitrate=1
+            ),
+            name="example-multiplex-changed",
+            start_multiplex=True,
+            tags={
+                "tag1": "value1"
+            }
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `availability_zones` - (Required) A list of availability zones. You must specify exactly two.
+* `multiplex_settings`- (Required) Multiplex settings. See [Multiplex Settings](#multiplex-settings) for more details.
+* `name` - (Required) name of Multiplex.
+
+The following arguments are optional:
+
+* `start_multiplex` - (Optional) Whether to start the Multiplex. Defaults to `false`.
+* `tags` - (Optional) A map of tags to assign to the Multiplex. If configured with a provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Multiplex Settings
+
+* `transport_stream_bitrate` - (Required) Transport stream bit rate.
+* `transport_stream_id` - (Required) Unique ID for each multiplex.
+* `transport_stream_reserved_bitrate` - (Optional) Transport stream reserved bit rate.
+* `maximum_video_buffer_delay_milliseconds` - (Optional) Maximum video buffer delay.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Multiplex.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `30m`)
+* `update` - (Default `30m`)
+* `delete` - (Default `30m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import MediaLive Multiplex using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import MediaLive Multiplex using the `id`. For example:
+
+```console
+% terraform import aws_medialive_multiplex.example 12345678
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ef0b0248360f7c92f3d75bdb422730873d3e865bff521828049e013dc339473a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/medialive_multiplex_program.html.markdown b/website/docs/cdktf/python/r/medialive_multiplex_program.html.markdown
new file mode 100644
index 00000000000..d7dc1734e4b
--- /dev/null
+++ b/website/docs/cdktf/python/r/medialive_multiplex_program.html.markdown
@@ -0,0 +1,129 @@
+---
+subcategory: "Elemental MediaLive"
+layout: "aws"
+page_title: "AWS: aws_medialive_multiplex_program"
+description: |-
+  Terraform resource for managing an AWS MediaLive MultiplexProgram.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_medialive_multiplex_program
+
+Terraform resource for managing an AWS MediaLive MultiplexProgram.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_availability_zones import DataAwsAvailabilityZones
+from imports.aws.medialive_multiplex import MedialiveMultiplex
+from imports.aws.medialive_multiplex_program import MedialiveMultiplexProgram
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        available = DataAwsAvailabilityZones(self, "available",
+            state="available"
+        )
+        example = MedialiveMultiplex(self, "example",
+            availability_zones=[
+                Token.as_string(Fn.lookup_nested(available.names, ["0"])),
+                Token.as_string(Fn.lookup_nested(available.names, ["1"]))
+            ],
+            multiplex_settings=MedialiveMultiplexMultiplexSettings(
+                maximum_video_buffer_delay_milliseconds=1000,
+                transport_stream_bitrate=1000000,
+                transport_stream_id=1,
+                transport_stream_reserved_bitrate=1
+            ),
+            name="example-multiplex-changed",
+            start_multiplex=True,
+            tags={
+                "tag1": "value1"
+            }
+        )
+        aws_medialive_multiplex_program_example = MedialiveMultiplexProgram(self, "example_2",
+            multiplex_id=example.id,
+            multiplex_program_settings=[MedialiveMultiplexProgramMultiplexProgramSettings(
+                preferred_channel_pipeline="CURRENTLY_ACTIVE",
+                program_number=1,
+                video_settings=[MedialiveMultiplexProgramMultiplexProgramSettingsVideoSettings(
+                    constant_bitrate=100000
+                )
+                ]
+            )
+            ],
+            program_name="example_program"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_medialive_multiplex_program_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `multiplex_id` - (Required) Multiplex ID.
+* `program_name` - (Required) Unique program name.
+* `multiplex_program_settings` - (Required) MultiplexProgram settings. See [Multiplex Program Settings](#multiple-program-settings) for more details.
+
+The following arguments are optional:
+
+### Multiple Program Settings
+
+* `program_number` - (Required) Unique program number.
+* `preferred_channel_pipeline` - (Required) Enum for preferred channel pipeline. Options are `CURRENTLY_ACTIVE`, `PIPELINE_0`, or `PIPELINE_1`.
+* `service_descriptor` - (Optional) Service Descriptor. See [Service Descriptor](#service-descriptor) for more details.
+* `video_settings` - (Optional) Video settings. See [Video Settings](#video-settings) for more details.
+
+### Service Descriptor
+
+* `provider_name` - (Required) Unique provider name.
+* `service_name` - (Required) Unique service name.
+
+### Video Settings
+
+* `constant_bitrate` - (Optional) Constant bitrate value.
+* `statmux_settings` - (Optional) Statmux settings. See [Statmux Settings](#statmux-settings) for more details.
+
+### Statmux Settings
+
+* `minimum_bitrate` - (Optional) Minimum bitrate.
+* `maximum_bitrate` - (Optional) Maximum bitrate.
+* `priority` - (Optional) Priority value.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the MultiplexProgram.
+* `example_attribute` - Concise description.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import MediaLive MultiplexProgram using the `id`, or a combination of "`program_name`/`multiplex_id`". For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import MediaLive MultiplexProgram using the `id`, or a combination of "`program_name`/`multiplex_id`". For example:
+
+```console
+% terraform import aws_medialive_multiplex_program.example example_program/1234567
+```
+
+<!-- cache-key: cdktf-0.18.0 input-d0f4d6ecf5fbb8e34c4bfcc4ff4baddff29c0893a211fa29af99ff4cfade72b1 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/memorydb_acl.html.markdown b/website/docs/cdktf/python/r/memorydb_acl.html.markdown
new file mode 100644
index 00000000000..8e895ef206b
--- /dev/null
+++ b/website/docs/cdktf/python/r/memorydb_acl.html.markdown
@@ -0,0 +1,74 @@
+---
+subcategory: "MemoryDB for Redis"
+layout: "aws"
+page_title: "AWS: aws_memorydb_acl"
+description: |-
+  Provides a MemoryDB ACL.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_memorydb_acl
+
+Provides a MemoryDB ACL.
+
+More information about users and ACL-s can be found in the [MemoryDB User Guide](https://docs.aws.amazon.com/memorydb/latest/devguide/clusters.acls.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.memorydb_acl import MemorydbAcl
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        MemorydbAcl(self, "example",
+            name="my-acl",
+            user_names=["my-user-1", "my-user-2"]
+        )
+```
+
+## Argument Reference
+
+The following arguments are optional:
+
+* `name` - (Optional, Forces new resource) Name of the ACL. If omitted, Terraform will assign a random, unique name. Conflicts with `name_prefix`.
+* `name_prefix` - (Optional, Forces new resource) Creates a unique name beginning with the specified prefix. Conflicts with `name`.
+* `user_names` - (Optional) Set of MemoryDB user names to be included in this ACL.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Same as `name`.
+* `arn` - The ARN of the ACL.
+* `minimum_engine_version` - The minimum engine version supported by the ACL.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import an ACL using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import an ACL using the `name`. For example:
+
+```console
+% terraform import aws_memorydb_acl.example my-acl
+```
+
+<!-- cache-key: cdktf-0.18.0 input-c0b11cab2ffda49ddaeadbf6cc9362150372c08b03e6b84d1bd545de5d3072f1 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/memorydb_cluster.html.markdown b/website/docs/cdktf/python/r/memorydb_cluster.html.markdown
new file mode 100644
index 00000000000..dcad3909516
--- /dev/null
+++ b/website/docs/cdktf/python/r/memorydb_cluster.html.markdown
@@ -0,0 +1,124 @@
+---
+subcategory: "MemoryDB for Redis"
+layout: "aws"
+page_title: "AWS: aws_memorydb_cluster"
+description: |-
+  Provides a MemoryDB Cluster.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_memorydb_cluster
+
+Provides a MemoryDB Cluster.
+
+More information about MemoryDB can be found in the [Developer Guide](https://docs.aws.amazon.com/memorydb/latest/devguide/what-is-memorydb-for-redis.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.memorydb_cluster import MemorydbCluster
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        MemorydbCluster(self, "example",
+            acl_name="open-access",
+            name="my-cluster",
+            node_type="db.t4g.small",
+            num_shards=2,
+            security_group_ids=[Token.as_string(aws_security_group_example.id)],
+            snapshot_retention_limit=7,
+            subnet_group_name=Token.as_string(aws_memorydb_subnet_group_example.id)
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `acl_name` - (Required) The name of the Access Control List to associate with the cluster.
+* `node_type` - (Required) The compute and memory capacity of the nodes in the cluster. See AWS documentation on [supported node types](https://docs.aws.amazon.com/memorydb/latest/devguide/nodes.supportedtypes.html) as well as [vertical scaling](https://docs.aws.amazon.com/memorydb/latest/devguide/cluster-vertical-scaling.html).
+
+The following arguments are optional:
+
+* `auto_minor_version_upgrade` - (Optional, Forces new resource) When set to `true`, the cluster will automatically receive minor engine version upgrades after launch. Defaults to `true`.
+* `data_tiering` - (Optional, Forces new resource) Enables data tiering. This option is not supported by all instance types. For more information, see [Data tiering](https://docs.aws.amazon.com/memorydb/latest/devguide/data-tiering.html).
+* `description` - (Optional) Description for the cluster. Defaults to `"Managed by Terraform"`.
+* `engine_version` - (Optional) Version number of the Redis engine to be used for the cluster. Downgrades are not supported.
+* `final_snapshot_name` - (Optional) Name of the final cluster snapshot to be created when this resource is deleted. If omitted, no final snapshot will be made.
+* `kms_key_arn` - (Optional, Forces new resource) ARN of the KMS key used to encrypt the cluster at rest.
+* `maintenance_window` - (Optional) Specifies the weekly time range during which maintenance on the cluster is performed. Specify as a range in the format `ddd:hh24:mi-ddd:hh24:mi` (24H Clock UTC). The minimum maintenance window is a 60 minute period. Example: `sun:23:00-mon:01:30`.
+* `name` - (Optional, Forces new resource) Name of the cluster. If omitted, Terraform will assign a random, unique name. Conflicts with `name_prefix`.
+* `name_prefix` - (Optional, Forces new resource) Creates a unique name beginning with the specified prefix. Conflicts with `name`.
+* `num_replicas_per_shard` - (Optional) The number of replicas to apply to each shard, up to a maximum of 5. Defaults to `1` (i.e. 2 nodes per shard).
+* `num_shards` - (Optional) The number of shards in the cluster. Defaults to `1`.
+* `parameter_group_name` - (Optional) The name of the parameter group associated with the cluster.
+* `port` - (Optional, Forces new resource) The port number on which each of the nodes accepts connections. Defaults to `6379`.
+* `security_group_ids` - (Optional) Set of VPC Security Group ID-s to associate with this cluster.
+* `snapshot_arns` - (Optional, Forces new resource) List of ARN-s that uniquely identify RDB snapshot files stored in S3. The snapshot files will be used to populate the new cluster. Object names in the ARN-s cannot contain any commas.
+* `snapshot_name` - (Optional, Forces new resource) The name of a snapshot from which to restore data into the new cluster.
+* `snapshot_retention_limit` - (Optional) The number of days for which MemoryDB retains automatic snapshots before deleting them. When set to `0`, automatic backups are disabled. Defaults to `0`.
+* `snapshot_window` - (Optional) The daily time range (in UTC) during which MemoryDB begins taking a daily snapshot of your shard. Example: `05:00-09:00`.
+* `sns_topic_arn` - (Optional) ARN of the SNS topic to which cluster notifications are sent.
+* `subnet_group_name` - (Optional, Forces new resource) The name of the subnet group to be used for the cluster. Defaults to a subnet group consisting of default VPC subnets.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `tls_enabled` - (Optional, Forces new resource) A flag to enable in-transit encryption on the cluster. When set to `false`, the `acl_name` must be `open-access`. Defaults to `true`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Same as `name`.
+* `arn` - The ARN of the cluster.
+* `cluster_endpoint`
+    * `address` - DNS hostname of the cluster configuration endpoint.
+    * `port` - Port number that the cluster configuration endpoint is listening on.
+* `engine_patch_version` - Patch version number of the Redis engine used by the cluster.
+* `shards` - Set of shards in this cluster.
+    * `name` - Name of this shard.
+    * `num_nodes` - Number of individual nodes in this shard.
+    * `slots` - Keyspace for this shard. Example: `0-16383`.
+    * `nodes` - Set of nodes in this shard.
+        * `availability_zone` - The Availability Zone in which the node resides.
+        * `create_time` - The date and time when the node was created. Example: `2022-01-01T21:00:00Z`.
+        * `name` - Name of this node.
+        * `endpoint`
+            * `address` - DNS hostname of the node.
+            * `port` - Port number that this node is listening on.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `120m`)
+- `update` - (Default `120m`)
+- `delete` - (Default `120m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import a cluster using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import a cluster using the `name`. For example:
+
+```console
+% terraform import aws_memorydb_cluster.example my-cluster
+```
+
+<!-- cache-key: cdktf-0.18.0 input-d6818a9008412346bdaa4fa4b26d098dea2f660a578683a93af8623986328ed6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/memorydb_parameter_group.html.markdown b/website/docs/cdktf/python/r/memorydb_parameter_group.html.markdown
new file mode 100644
index 00000000000..81af87200e5
--- /dev/null
+++ b/website/docs/cdktf/python/r/memorydb_parameter_group.html.markdown
@@ -0,0 +1,88 @@
+---
+subcategory: "MemoryDB for Redis"
+layout: "aws"
+page_title: "AWS: aws_memorydb_parameter_group"
+description: |-
+  Provides a MemoryDB Parameter Group.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_memorydb_parameter_group
+
+Provides a MemoryDB Parameter Group.
+
+More information about parameter groups can be found in the [MemoryDB User Guide](https://docs.aws.amazon.com/memorydb/latest/devguide/parametergroups.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.memorydb_parameter_group import MemorydbParameterGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        MemorydbParameterGroup(self, "example",
+            family="memorydb_redis6",
+            name="my-parameter-group",
+            parameter=[MemorydbParameterGroupParameter(
+                name="activedefrag",
+                value="yes"
+            )
+            ]
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `family` - (Required, Forces new resource) The engine version that the parameter group can be used with.
+
+The following arguments are optional:
+
+* `name` - (Optional, Forces new resource) Name of the parameter group. If omitted, Terraform will assign a random, unique name. Conflicts with `name_prefix`.
+* `name_prefix` - (Optional, Forces new resource) Creates a unique name beginning with the specified prefix. Conflicts with `name`.
+* `description` - (Optional, Forces new resource) Description for the parameter group. Defaults to `"Managed by Terraform"`.
+* `parameter` - (Optional) Set of MemoryDB parameters to apply. Any parameters not specified will fall back to their family defaults. Detailed below.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### parameter Configuration Block
+
+* `name` - (Required) The name of the parameter.
+* `value` - (Required) The value of the parameter.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Same as `name`.
+* `arn` - The ARN of the parameter group.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import a parameter group using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import a parameter group using the `name`. For example:
+
+```console
+% terraform import aws_memorydb_parameter_group.example my-parameter-group
+```
+
+<!-- cache-key: cdktf-0.18.0 input-8e9e3599e180f75dd2d3f6d66e99565f9996fadbf7ea8fdbbfa56522a00edac7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/memorydb_snapshot.html.markdown b/website/docs/cdktf/python/r/memorydb_snapshot.html.markdown
new file mode 100644
index 00000000000..bbab32988cd
--- /dev/null
+++ b/website/docs/cdktf/python/r/memorydb_snapshot.html.markdown
@@ -0,0 +1,96 @@
+---
+subcategory: "MemoryDB for Redis"
+layout: "aws"
+page_title: "AWS: aws_memorydb_snapshot"
+description: |-
+  Provides a MemoryDB Snapshot.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_memorydb_snapshot
+
+Provides a MemoryDB Snapshot.
+
+More information about snapshot and restore can be found in the [MemoryDB User Guide](https://docs.aws.amazon.com/memorydb/latest/devguide/snapshots.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.memorydb_snapshot import MemorydbSnapshot
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        MemorydbSnapshot(self, "example",
+            cluster_name=Token.as_string(aws_memorydb_cluster_example.name),
+            name="my-snapshot"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `cluster_name` - (Required, Forces new resource) Name of the MemoryDB cluster to take a snapshot of.
+* `name` - (Optional, Forces new resource) Name of the snapshot. If omitted, Terraform will assign a random, unique name. Conflicts with `name_prefix`.
+* `name_prefix` - (Optional, Forces new resource) Creates a unique name beginning with the specified prefix. Conflicts with `name`.
+* `kms_key_arn` - (Optional, Forces new resource) ARN of the KMS key used to encrypt the snapshot at rest.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name of the snapshot.
+* `arn` - The ARN of the snapshot.
+* `cluster_configuration` - The configuration of the cluster from which the snapshot was taken.
+    * `description` - Description for the cluster.
+    * `engine_version` - Version number of the Redis engine used by the cluster.
+    * `maintenance_window` - The weekly time range during which maintenance on the cluster is performed.
+    * `name` - Name of the cluster.
+    * `node_type` - Compute and memory capacity of the nodes in the cluster.
+    * `num_shards` - Number of shards in the cluster.
+    * `parameter_group_name` - Name of the parameter group associated with the cluster.
+    * `port` - Port number on which the cluster accepts connections.
+    * `snapshot_retention_limit` - Number of days for which MemoryDB retains automatic snapshots before deleting them.
+    * `snapshot_window` - The daily time range (in UTC) during which MemoryDB begins taking a daily snapshot of the shard.
+    * `subnet_group_name` - Name of the subnet group used by the cluster.
+    * `topic_arn` - ARN of the SNS topic to which cluster notifications are sent.
+    * `vpc_id` - The VPC in which the cluster exists.
+* `source` - Indicates whether the snapshot is from an automatic backup (`automated`) or was created manually (`manual`).
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `120m`)
+- `delete` - (Default `120m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import a snapshot using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import a snapshot using the `name`. For example:
+
+```console
+% terraform import aws_memorydb_snapshot.example my-snapshot
+```
+
+<!-- cache-key: cdktf-0.18.0 input-540eb2f7a447881028486dd90d40cbfa1d108e80be222d8149c4c844371b23d5 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/memorydb_subnet_group.html.markdown b/website/docs/cdktf/python/r/memorydb_subnet_group.html.markdown
new file mode 100644
index 00000000000..0734fd49010
--- /dev/null
+++ b/website/docs/cdktf/python/r/memorydb_subnet_group.html.markdown
@@ -0,0 +1,92 @@
+---
+subcategory: "MemoryDB for Redis"
+layout: "aws"
+page_title: "AWS: aws_memorydb_subnet_group"
+description: |-
+  Provides a MemoryDB Subnet Group.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_memorydb_subnet_group
+
+Provides a MemoryDB Subnet Group.
+
+More information about subnet groups can be found in the [MemoryDB User Guide](https://docs.aws.amazon.com/memorydb/latest/devguide/subnetgroups.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.memorydb_subnet_group import MemorydbSubnetGroup
+from imports.aws.subnet import Subnet
+from imports.aws.vpc import Vpc
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = Vpc(self, "example",
+            cidr_block="10.0.0.0/16"
+        )
+        aws_subnet_example = Subnet(self, "example_1",
+            availability_zone="us-west-2a",
+            cidr_block="10.0.0.0/24",
+            vpc_id=example.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_subnet_example.override_logical_id("example")
+        aws_memorydb_subnet_group_example = MemorydbSubnetGroup(self, "example_2",
+            name="my-subnet-group",
+            subnet_ids=[Token.as_string(aws_subnet_example.id)]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_memorydb_subnet_group_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `subnet_ids` - (Required) Set of VPC Subnet ID-s for the subnet group. At least one subnet must be provided.
+
+The following arguments are optional:
+
+* `name` - (Optional, Forces new resource) Name of the subnet group. If omitted, Terraform will assign a random, unique name. Conflicts with `name_prefix`.
+* `name_prefix` - (Optional, Forces new resource) Creates a unique name beginning with the specified prefix. Conflicts with `name`.
+* `description` - (Optional) Description for the subnet group. Defaults to `"Managed by Terraform"`.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name of the subnet group.
+* `arn` - The ARN of the subnet group.
+* `vpc_id` - The VPC in which the subnet group exists.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import a subnet group using its `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import a subnet group using its `name`. For example:
+
+```console
+% terraform import aws_memorydb_subnet_group.example my-subnet-group
+```
+
+<!-- cache-key: cdktf-0.18.0 input-d868401aa8e04d4973ff0ffe4eb6c8770dd89bad3180e6917e7e0015e53618af -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/memorydb_user.html.markdown b/website/docs/cdktf/python/r/memorydb_user.html.markdown
new file mode 100644
index 00000000000..508f814d163
--- /dev/null
+++ b/website/docs/cdktf/python/r/memorydb_user.html.markdown
@@ -0,0 +1,101 @@
+---
+subcategory: "MemoryDB for Redis"
+layout: "aws"
+page_title: "AWS: aws_memorydb_user"
+description: |-
+  Provides a MemoryDB User.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_memorydb_user
+
+Provides a MemoryDB User.
+
+More information about users and ACL-s can be found in the [MemoryDB User Guide](https://docs.aws.amazon.com/memorydb/latest/devguide/clusters.acls.html).
+
+~> **Note:** All arguments including the username and passwords will be stored in the raw state as plain-text.
+[Read more about sensitive data in state](https://www.terraform.io/docs/state/sensitive-data.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.memorydb_user import MemorydbUser
+from imports.random.password import Password
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        # The following providers are missing schema information and might need manual adjustments to synthesize correctly: random.
+        #     For a more precise conversion please use the --provider flag in convert.
+        example = Password(self, "example",
+            length=16
+        )
+        aws_memorydb_user_example = MemorydbUser(self, "example_1",
+            access_string="on ~* &* +@all",
+            authentication_mode=MemorydbUserAuthenticationMode(
+                passwords=[Token.as_string(example.result)],
+                type="password"
+            ),
+            user_name="my-user"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_memorydb_user_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `access_string` - (Required) The access permissions string used for this user.
+* `authentication_mode` - (Required) Denotes the user's authentication properties. Detailed below.
+* `user_name` - (Required, Forces new resource) Name of the MemoryDB user. Up to 40 characters.
+
+The following arguments are optional:
+
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### authentication_mode Configuration Block
+
+* `passwords` - (Required) The set of passwords used for authentication. You can create up to two passwords for each user.
+* `type` - (Required) Indicates whether the user requires a password to authenticate. Must be set to `password`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Same as `user_name`.
+* `arn` - The ARN of the user.
+* `minimum_engine_version` - The minimum engine version supported for the user.
+* `authentication_mode` configuration block
+    * `password_count` - The number of passwords belonging to the user.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import a user using the `user_name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import a user using the `user_name`. For example:
+
+```console
+% terraform import aws_memorydb_user.example my-user
+```
+
+The `passwords` are not available for imported resources, as this information cannot be read back from the MemoryDB API.
+
+<!-- cache-key: cdktf-0.18.0 input-f5d027129bff54db7aaaaecf18b5e8da10653dddeb0e00e2f474bf78aa1508d7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/mq_broker.html.markdown b/website/docs/cdktf/python/r/mq_broker.html.markdown
new file mode 100644
index 00000000000..069eeaa2f58
--- /dev/null
+++ b/website/docs/cdktf/python/r/mq_broker.html.markdown
@@ -0,0 +1,221 @@
+---
+subcategory: "MQ"
+layout: "aws"
+page_title: "AWS: aws_mq_broker"
+description: |-
+  Provides an MQ Broker Resource
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_mq_broker
+
+Provides an Amazon MQ broker resource. This resources also manages users for the broker.
+
+-> For more information on Amazon MQ, see [Amazon MQ documentation](https://docs.aws.amazon.com/amazon-mq/latest/developer-guide/welcome.html).
+
+~> **NOTE:** Amazon MQ currently places limits on **RabbitMQ** brokers. For example, a RabbitMQ broker cannot have: instances with an associated IP address of an ENI attached to the broker, an associated LDAP server to authenticate and authorize broker connections, storage type `EFS`, or audit logging. Although this resource allows you to create RabbitMQ users, RabbitMQ users cannot have console access or groups. Also, Amazon MQ does not return information about RabbitMQ users so drift detection is not possible.
+
+~> **NOTE:** Changes to an MQ Broker can occur when you change a parameter, such as `configuration` or `user`, and are reflected in the next maintenance window. Because of this, Terraform may report a difference in its planning phase because a modification has not yet taken place. You can use the `apply_immediately` flag to instruct the service to apply the change immediately (see documentation below). Using `apply_immediately` can result in a brief downtime as the broker reboots.
+
+~> **NOTE:** All arguments including the username and password will be stored in the raw state as plain-text. [Read more about sensitive data in state](https://www.terraform.io/docs/state/sensitive-data.html).
+
+## Example Usage
+
+### Basic Example
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.mq_broker import MqBroker
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        MqBroker(self, "example",
+            broker_name="example",
+            configuration=MqBrokerConfiguration(
+                id=test.id,
+                revision=test.latest_revision
+            ),
+            engine_type="ActiveMQ",
+            engine_version="5.15.9",
+            host_instance_type="mq.t2.micro",
+            security_groups=[Token.as_string(aws_security_group_test.id)],
+            user=[MqBrokerUser(
+                password="MindTheGap",
+                username="ExampleUser"
+            )
+            ]
+        )
+```
+
+### High-throughput Optimized Example
+
+This example shows the use of EBS storage for high-throughput optimized performance.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.mq_broker import MqBroker
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        MqBroker(self, "example",
+            broker_name="example",
+            configuration=MqBrokerConfiguration(
+                id=test.id,
+                revision=test.latest_revision
+            ),
+            engine_type="ActiveMQ",
+            engine_version="5.15.9",
+            host_instance_type="mq.m5.large",
+            security_groups=[Token.as_string(aws_security_group_test.id)],
+            storage_type="ebs",
+            user=[MqBrokerUser(
+                password="MindTheGap",
+                username="ExampleUser"
+            )
+            ]
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `broker_name` - (Required) Name of the broker.
+* `engine_type` - (Required) Type of broker engine. Valid values are `ActiveMQ` and `RabbitMQ`.
+* `engine_version` - (Required) Version of the broker engine. See the [AmazonMQ Broker Engine docs](https://docs.aws.amazon.com/amazon-mq/latest/developer-guide/broker-engine.html) for supported versions. For example, `5.15.0`.
+* `host_instance_type` - (Required) Broker's instance type. For example, `mq.t3.micro`, `mq.m5.large`.
+* `user` - (Required) Configuration block for broker users. For `engine_type` of `RabbitMQ`, Amazon MQ does not return broker users preventing this resource from making user updates and drift detection. Detailed below.
+
+The following arguments are optional:
+
+* `apply_immediately` - (Optional) Specifies whether any broker modifications are applied immediately, or during the next maintenance window. Default is `false`.
+* `authentication_strategy` - (Optional) Authentication strategy used to secure the broker. Valid values are `simple` and `ldap`. `ldap` is not supported for `engine_type` `RabbitMQ`.
+* `auto_minor_version_upgrade` - (Optional) Whether to automatically upgrade to new minor versions of brokers as Amazon MQ makes releases available.
+* `configuration` - (Optional) Configuration block for broker configuration. Applies to `engine_type` of `ActiveMQ` and `RabbitMQ` only. Detailed below.
+* `deployment_mode` - (Optional) Deployment mode of the broker. Valid values are `SINGLE_INSTANCE`, `ACTIVE_STANDBY_MULTI_AZ`, and `CLUSTER_MULTI_AZ`. Default is `SINGLE_INSTANCE`.
+* `encryption_options` - (Optional) Configuration block containing encryption options. Detailed below.
+* `ldap_server_metadata` - (Optional) Configuration block for the LDAP server used to authenticate and authorize connections to the broker. Not supported for `engine_type` `RabbitMQ`. Detailed below. (Currently, AWS may not process changes to LDAP server metadata.)
+* `logs` - (Optional) Configuration block for the logging configuration of the broker. Detailed below.
+* `maintenance_window_start_time` - (Optional) Configuration block for the maintenance window start time. Detailed below.
+* `publicly_accessible` - (Optional) Whether to enable connections from applications outside of the VPC that hosts the broker's subnets.
+* `security_groups` - (Optional) List of security group IDs assigned to the broker.
+* `storage_type` - (Optional) Storage type of the broker. For `engine_type` `ActiveMQ`, the valid values are `efs` and `ebs`, and the AWS-default is `efs`. For `engine_type` `RabbitMQ`, only `ebs` is supported. When using `ebs`, only the `mq.m5` broker instance type family is supported.
+* `subnet_ids` - (Optional) List of subnet IDs in which to launch the broker. A `SINGLE_INSTANCE` deployment requires one subnet. An `ACTIVE_STANDBY_MULTI_AZ` deployment requires multiple subnets.
+* `tags` - (Optional) Map of tags to assign to the broker. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### configuration
+
+The following arguments are optional:
+
+* `id` - (Optional) The Configuration ID.
+* `revision` - (Optional) Revision of the Configuration.
+
+### encryption_options
+
+The following arguments are optional:
+
+* `kms_key_id` - (Optional) Amazon Resource Name (ARN) of Key Management Service (KMS) Customer Master Key (CMK) to use for encryption at rest. Requires setting `use_aws_owned_key` to `false`. To perform drift detection when AWS-managed CMKs or customer-managed CMKs are in use, this value must be configured.
+* `use_aws_owned_key` - (Optional) Whether to enable an AWS-owned KMS CMK that is not in your account. Defaults to `true`. Setting to `false` without configuring `kms_key_id` will create an AWS-managed CMK aliased to `aws/mq` in your account.
+
+### ldap_server_metadata
+
+The following arguments are optional:
+
+* `hosts` - (Optional) List of a fully qualified domain name of the LDAP server and an optional failover server.
+* `role_base` - (Optional) Fully qualified name of the directory to search for a user’s groups.
+* `role_name` - (Optional) Specifies the LDAP attribute that identifies the group name attribute in the object returned from the group membership query.
+* `role_search_matching` - (Optional) Search criteria for groups.
+* `role_search_subtree` - (Optional) Whether the directory search scope is the entire sub-tree.
+* `service_account_password` - (Optional) Service account password.
+* `service_account_username` - (Optional) Service account username.
+* `user_base` - (Optional) Fully qualified name of the directory where you want to search for users.
+* `user_role_name` - (Optional) Specifies the name of the LDAP attribute for the user group membership.
+* `user_search_matching` - (Optional) Search criteria for users.
+* `user_search_subtree` - (Optional) Whether the directory search scope is the entire sub-tree.
+
+### logs
+
+The following arguments are optional:
+
+* `audit` - (Optional) Enables audit logging. Auditing is only possible for `engine_type` of `ActiveMQ`. User management action made using JMX or the ActiveMQ Web Console is logged. Defaults to `false`.
+* `general` - (Optional) Enables general logging via CloudWatch. Defaults to `false`.
+
+### maintenance_window_start_time
+
+The following arguments are required:
+
+* `day_of_week` - (Required) Day of the week, e.g., `MONDAY`, `TUESDAY`, or `WEDNESDAY`.
+* `time_of_day` - (Required) Time, in 24-hour format, e.g., `02:00`.
+* `time_zone` - (Required) Time zone in either the Country/City format or the UTC offset format, e.g., `CET`.
+
+### user
+
+* `console_access` - (Optional) Whether to enable access to the [ActiveMQ Web Console](http://activemq.apache.org/web-console.html) for the user. Applies to `engine_type` of `ActiveMQ` only.
+* `groups` - (Optional) List of groups (20 maximum) to which the ActiveMQ user belongs. Applies to `engine_type` of `ActiveMQ` only.
+* `password` - (Required) Password of the user. It must be 12 to 250 characters long, at least 4 unique characters, and must not contain commas.
+* `replication_user` - (Optional) Whether to set set replication user. Defaults to `false`.
+* `username` - (Required) Username of the user.
+
+~> **NOTE:** AWS currently does not support updating RabbitMQ users. Updates to users can only be in the RabbitMQ UI.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the broker.
+* `id` - Unique ID that Amazon MQ generates for the broker.
+* `instances` - List of information about allocated brokers (both active & standby).
+    * `instances.0.console_url` - The URL of the [ActiveMQ Web Console](http://activemq.apache.org/web-console.html) or the [RabbitMQ Management UI](https://www.rabbitmq.com/management.html#external-monitoring) depending on `engine_type`.
+    * `instances.0.ip_address` - IP Address of the broker.
+    * `instances.0.endpoints` - Broker's wire-level protocol endpoints in the following order & format referenceable e.g., as `instances.0.endpoints.0` (SSL):
+        * For `ActiveMQ`:
+            * `ssl://broker-id.mq.us-west-2.amazonaws.com:61617`
+            * `amqp+ssl://broker-id.mq.us-west-2.amazonaws.com:5671`
+            * `stomp+ssl://broker-id.mq.us-west-2.amazonaws.com:61614`
+            * `mqtt+ssl://broker-id.mq.us-west-2.amazonaws.com:8883`
+            * `wss://broker-id.mq.us-west-2.amazonaws.com:61619`
+        * For `RabbitMQ`:
+            * `amqps://broker-id.mq.us-west-2.amazonaws.com:5671`
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `30m`)
+* `update` - (Default `30m`)
+* `delete` - (Default `30m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import MQ Brokers using their broker id. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import MQ Brokers using their broker id. For example:
+
+```console
+% terraform import aws_mq_broker.example a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
+```
+
+<!-- cache-key: cdktf-0.18.0 input-e4ac8cdba2a86a52d15d44c9fa76955d14e86f7fe0c194e7077682ba082c4e20 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/mq_configuration.html.markdown b/website/docs/cdktf/python/r/mq_configuration.html.markdown
new file mode 100644
index 00000000000..1d6f10b99b1
--- /dev/null
+++ b/website/docs/cdktf/python/r/mq_configuration.html.markdown
@@ -0,0 +1,108 @@
+---
+subcategory: "MQ"
+layout: "aws"
+page_title: "AWS: aws_mq_configuration"
+description: |-
+  Provides an MQ configuration Resource
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_mq_configuration
+
+Provides an MQ Configuration Resource.
+
+For more information on Amazon MQ, see [Amazon MQ documentation](https://docs.aws.amazon.com/amazon-mq/latest/developer-guide/welcome.html).
+
+## Example Usage
+
+### ActiveMQ
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.mq_configuration import MqConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        MqConfiguration(self, "example",
+            data="<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n<broker xmlns=\"http://activemq.apache.org/schema/core\">\n  <plugins>\n    <forcePersistencyModeBrokerPlugin persistenceFlag=\"true\"/>\n    <statisticsBrokerPlugin/>\n    <timeStampingBrokerPlugin ttlCeiling=\"86400000\" zeroExpirationOverride=\"86400000\"/>\n  </plugins>\n</broker>\n\n",
+            description="Example Configuration",
+            engine_type="ActiveMQ",
+            engine_version="5.15.0",
+            name="example"
+        )
+```
+
+### RabbitMQ
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.mq_configuration import MqConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        MqConfiguration(self, "example",
+            data="# Default RabbitMQ delivery acknowledgement timeout is 30 minutes in milliseconds\nconsumer_timeout = 1800000\n\n",
+            description="Example Configuration",
+            engine_type="RabbitMQ",
+            engine_version="3.11.16",
+            name="example"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `data` - (Required) Broker configuration in XML format for `ActiveMQ` or [Cuttlefish](https://github.com/Kyorai/cuttlefish) format for `RabbitMQ`. See [official docs](https://docs.aws.amazon.com/amazon-mq/latest/developer-guide/amazon-mq-broker-configuration-parameters.html) for supported parameters and format of the XML.
+* `engine_type` - (Required) Type of broker engine. Valid values are `ActiveMQ` and `RabbitMQ`.
+* `engine_version` - (Required) Version of the broker engine.
+* `name` - (Required) Name of the configuration.
+
+The following arguments are optional:
+
+* `authentication_strategy` - (Optional) Authentication strategy associated with the configuration. Valid values are `simple` and `ldap`. `ldap` is not supported for `engine_type` `RabbitMQ`.
+* `description` - (Optional) Description of the configuration.
+* `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the configuration.
+* `id` - Unique ID that Amazon MQ generates for the configuration.
+* `latest_revision` - Latest revision of the configuration.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import MQ Configurations using the configuration ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import MQ Configurations using the configuration ID. For example:
+
+```console
+% terraform import aws_mq_configuration.example c-0187d1eb-88c8-475a-9b79-16ef5a10c94f
+```
+
+<!-- cache-key: cdktf-0.18.0 input-04eb0aa6dff9d0a504fd0ee6b546bf9faa3350cf68b6f6ead258a17890bff141 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/msk_cluster.html.markdown b/website/docs/cdktf/python/r/msk_cluster.html.markdown
new file mode 100644
index 00000000000..a3adbb5fc42
--- /dev/null
+++ b/website/docs/cdktf/python/r/msk_cluster.html.markdown
@@ -0,0 +1,384 @@
+---
+subcategory: "Managed Streaming for Kafka"
+layout: "aws"
+page_title: "AWS: aws_msk_cluster"
+description: |-
+  Terraform resource for managing an AWS Managed Streaming for Kafka cluster.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_msk_cluster
+
+Manages an Amazon MSK cluster.
+
+-> **Note:** This resource manages _provisioned_ clusters. To manage a _serverless_ Amazon MSK cluster, use the [`aws_msk_serverless_cluster`](/docs/providers/aws/r/msk_serverless_cluster.html) resource.
+
+## Example Usage
+
+### Basic
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from cdktf import TerraformResourceLifecycle
+from constructs import Construct
+from cdktf import Token, Fn, TerraformOutput, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudwatch_log_group import CloudwatchLogGroup
+from imports.aws.data_aws_availability_zones import DataAwsAvailabilityZones
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.iam_role import IamRole
+from imports.aws.kinesis_firehose_delivery_stream import KinesisFirehoseDeliveryStream
+from imports.aws.kms_key import KmsKey
+from imports.aws.msk_cluster import MskCluster
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_acl import S3BucketAcl
+from imports.aws.security_group import SecurityGroup
+from imports.aws.subnet import Subnet
+from imports.aws.vpc import Vpc
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        test = CloudwatchLogGroup(self, "test",
+            name="msk_broker_logs"
+        )
+        kms = KmsKey(self, "kms",
+            description="example"
+        )
+        bucket = S3Bucket(self, "bucket",
+            bucket="msk-broker-logs-bucket"
+        )
+        S3BucketAcl(self, "bucket_acl",
+            acl="private",
+            bucket=bucket.id
+        )
+        vpc = Vpc(self, "vpc",
+            cidr_block="192.168.0.0/22"
+        )
+        azs = DataAwsAvailabilityZones(self, "azs",
+            state="available"
+        )
+        assume_role = DataAwsIamPolicyDocument(self, "assume_role",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["sts:AssumeRole"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["firehose.amazonaws.com"],
+                    type="Service"
+                )
+                ]
+            )
+            ]
+        )
+        firehose_role = IamRole(self, "firehose_role",
+            assume_role_policy=Token.as_string(assume_role.json),
+            name="firehose_test_role"
+        )
+        test_stream = KinesisFirehoseDeliveryStream(self, "test_stream",
+            destination="extended_s3",
+            extended_s3_configuration=KinesisFirehoseDeliveryStreamExtendedS3Configuration(
+                bucket_arn=bucket.arn,
+                role_arn=firehose_role.arn
+            ),
+            lifecycle=TerraformResourceLifecycle(
+                ignore_changes=["logDeliveryEnabled"]
+            ),
+            name="terraform-kinesis-firehose-msk-broker-logs-stream",
+            tags={
+                "LogDeliveryEnabled": "placeholder"
+            }
+        )
+        sg = SecurityGroup(self, "sg",
+            vpc_id=vpc.id
+        )
+        subnet_az1 = Subnet(self, "subnet_az1",
+            availability_zone=Token.as_string(Fn.lookup_nested(azs.names, ["0"])),
+            cidr_block="192.168.0.0/24",
+            vpc_id=vpc.id
+        )
+        subnet_az2 = Subnet(self, "subnet_az2",
+            availability_zone=Token.as_string(Fn.lookup_nested(azs.names, ["1"])),
+            cidr_block="192.168.1.0/24",
+            vpc_id=vpc.id
+        )
+        subnet_az3 = Subnet(self, "subnet_az3",
+            availability_zone=Token.as_string(Fn.lookup_nested(azs.names, ["2"])),
+            cidr_block="192.168.2.0/24",
+            vpc_id=vpc.id
+        )
+        example = MskCluster(self, "example",
+            broker_node_group_info=MskClusterBrokerNodeGroupInfo(
+                client_subnets=[subnet_az1.id, subnet_az2.id, subnet_az3.id],
+                instance_type="kafka.m5.large",
+                security_groups=[sg.id],
+                storage_info=MskClusterBrokerNodeGroupInfoStorageInfo(
+                    ebs_storage_info=MskClusterBrokerNodeGroupInfoStorageInfoEbsStorageInfo(
+                        volume_size=1000
+                    )
+                )
+            ),
+            cluster_name="example",
+            encryption_info=MskClusterEncryptionInfo(
+                encryption_at_rest_kms_key_arn=kms.arn
+            ),
+            kafka_version="3.2.0",
+            logging_info=MskClusterLoggingInfo(
+                broker_logs=MskClusterLoggingInfoBrokerLogs(
+                    cloudwatch_logs=MskClusterLoggingInfoBrokerLogsCloudwatchLogs(
+                        enabled=True,
+                        log_group=test.name
+                    ),
+                    firehose=MskClusterLoggingInfoBrokerLogsFirehose(
+                        delivery_stream=test_stream.name,
+                        enabled=True
+                    ),
+                    s3=MskClusterLoggingInfoBrokerLogsS3(
+                        bucket=bucket.id,
+                        enabled=True,
+                        prefix="logs/msk-"
+                    )
+                )
+            ),
+            number_of_broker_nodes=3,
+            open_monitoring=MskClusterOpenMonitoring(
+                prometheus=MskClusterOpenMonitoringPrometheus(
+                    jmx_exporter=MskClusterOpenMonitoringPrometheusJmxExporter(
+                        enabled_in_broker=True
+                    ),
+                    node_exporter=MskClusterOpenMonitoringPrometheusNodeExporter(
+                        enabled_in_broker=True
+                    )
+                )
+            ),
+            tags={
+                "foo": "bar"
+            }
+        )
+        TerraformOutput(self, "bootstrap_brokers_tls",
+            value=example.bootstrap_brokers_tls,
+            description="TLS connection host:port pairs"
+        )
+        TerraformOutput(self, "zookeeper_connect_string",
+            value=example.zookeeper_connect_string
+        )
+```
+
+### With volume_throughput argument
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.msk_cluster import MskCluster
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        MskCluster(self, "example",
+            broker_node_group_info=MskClusterBrokerNodeGroupInfo(
+                client_subnets=[subnet_az1.id, subnet_az2.id, subnet_az3.id],
+                instance_type="kafka.m5.4xlarge",
+                security_groups=[sg.id],
+                storage_info=MskClusterBrokerNodeGroupInfoStorageInfo(
+                    ebs_storage_info=MskClusterBrokerNodeGroupInfoStorageInfoEbsStorageInfo(
+                        provisioned_throughput=MskClusterBrokerNodeGroupInfoStorageInfoEbsStorageInfoProvisionedThroughput(
+                            enabled=True,
+                            volume_throughput=250
+                        ),
+                        volume_size=1000
+                    )
+                )
+            ),
+            cluster_name="example",
+            kafka_version="2.7.1",
+            number_of_broker_nodes=3
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `broker_node_group_info` - (Required) Configuration block for the broker nodes of the Kafka cluster.
+* `cluster_name` - (Required) Name of the MSK cluster.
+* `kafka_version` - (Required) Specify the desired Kafka software version.
+* `number_of_broker_nodes` - (Required) The desired total number of broker nodes in the kafka cluster.  It must be a multiple of the number of specified client subnets.
+* `client_authentication` - (Optional) Configuration block for specifying a client authentication. See below.
+* `configuration_info` - (Optional) Configuration block for specifying a MSK Configuration to attach to Kafka brokers. See below.
+* `encryption_info` - (Optional) Configuration block for specifying encryption. See below.
+* `enhanced_monitoring` - (Optional) Specify the desired enhanced MSK CloudWatch monitoring level. See [Monitoring Amazon MSK with Amazon CloudWatch](https://docs.aws.amazon.com/msk/latest/developerguide/monitoring.html)
+* `open_monitoring` - (Optional) Configuration block for JMX and Node monitoring for the MSK cluster. See below.
+* `logging_info` - (Optional) Configuration block for streaming broker logs to Cloudwatch/S3/Kinesis Firehose. See below.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### broker_node_group_info Argument Reference
+
+* `client_subnets` - (Required) A list of subnets to connect to in client VPC ([documentation](https://docs.aws.amazon.com/msk/1.0/apireference/clusters.html#clusters-prop-brokernodegroupinfo-clientsubnets)).
+* `instance_type` - (Required) Specify the instance type to use for the kafka brokersE.g., kafka.m5.large. ([Pricing info](https://aws.amazon.com/msk/pricing/))
+* `security_groups` - (Required) A list of the security groups to associate with the elastic network interfaces to control who can communicate with the cluster.
+* `az_distribution` - (Optional) The distribution of broker nodes across availability zones ([documentation](https://docs.aws.amazon.com/msk/1.0/apireference/clusters.html#clusters-model-brokerazdistribution)). Currently the only valid value is `DEFAULT`.
+* `connectivity_info` - (Optional) Information about the cluster access configuration. See below. For security reasons, you can't turn on public access while creating an MSK cluster. However, you can update an existing cluster to make it publicly accessible. You can also create a new cluster and then update it to make it publicly accessible ([documentation](https://docs.aws.amazon.com/msk/latest/developerguide/public-access.html)).
+* `storage_info` - (Optional) A block that contains information about storage volumes attached to MSK broker nodes. See below.
+
+### broker_node_group_info connectivity_info Argument Reference
+
+* `public_access` - (Optional) Access control settings for brokers. See below.
+* `vpc_connectivity` - (Optional) VPC connectivity access control for brokers. See below.
+
+### connectivity_info public_access Argument Reference
+
+* `type` - (Optional) Public access type. Valid values: `DISABLED`, `SERVICE_PROVIDED_EIPS`.
+
+### connectivity_info vpc_connectivity Argument Reference
+
+* `client_authentication` - (Optional) Includes all client authentication information for VPC connectivity. See below.
+
+### vpc_connectivity client_authentication Argument Reference
+
+* `sasl` - (Optional) SASL authentication type details for VPC connectivity. See below.
+* `tls` - (Optional) Enables TLS authentication for VPC connectivity.
+
+### vpc_connectivity client_authentication sasl Argument Reference
+
+* `iam` - (Optional) Enables SASL/IAM authentication for VPC connectivity.
+* `scram` - (Optional) Enables SASL/SCRAM authentication for VPC connectivity.
+
+### broker_node_group_info storage_info Argument Reference
+
+* `ebs_storage_info` - (Optional) A block that contains EBS volume information. See below.
+
+### storage_info ebs_storage_info Argument Reference
+
+* `provisioned_throughput` - (Optional) A block that contains EBS volume provisioned throughput information. To provision storage throughput, you must choose broker type kafka.m5.4xlarge or larger. See below.
+* `volume_size` - (Optional) The size in GiB of the EBS volume for the data drive on each broker node. Minimum value of `1` and maximum value of `16384`.
+
+### ebs_storage_info provisioned_throughput Argument Reference
+
+* `enabled` - (Optional) Controls whether provisioned throughput is enabled or not. Default value: `false`.
+* `volume_throughput` - (Optional) Throughput value of the EBS volumes for the data drive on each kafka broker node in MiB per second. The minimum value is `250`. The maximum value varies between broker type. You can refer to the valid values for the maximum volume throughput at the following [documentation on throughput bottlenecks](https://docs.aws.amazon.com/msk/latest/developerguide/msk-provision-throughput.html#throughput-bottlenecks)
+
+### client_authentication Argument Reference
+
+* `sasl` - (Optional) Configuration block for specifying SASL client authentication. See below.
+* `tls` - (Optional) Configuration block for specifying TLS client authentication. See below.
+* `unauthenticated` - (Optional) Enables unauthenticated access.
+
+#### client_authentication sasl Argument Reference
+
+* `iam` - (Optional) Enables IAM client authentication. Defaults to `false`.
+* `scram` - (Optional) Enables SCRAM client authentication via AWS Secrets Manager. Defaults to `false`.
+
+#### client_authentication tls Argument Reference
+
+* `certificate_authority_arns` - (Optional) List of ACM Certificate Authority Amazon Resource Names (ARNs).
+
+### configuration_info Argument Reference
+
+* `arn` - (Required) Amazon Resource Name (ARN) of the MSK Configuration to use in the cluster.
+* `revision` - (Required) Revision of the MSK Configuration to use in the cluster.
+
+### encryption_info Argument Reference
+
+* `encryption_in_transit` - (Optional) Configuration block to specify encryption in transit. See below.
+* `encryption_at_rest_kms_key_arn` - (Optional) You may specify a KMS key short ID or ARN (it will always output an ARN) to use for encrypting your data at rest.  If no key is specified, an AWS managed KMS ('aws/msk' managed service) key will be used for encrypting the data at rest.
+
+#### encryption_info encryption_in_transit Argument Reference
+
+* `client_broker` - (Optional) Encryption setting for data in transit between clients and brokers. Valid values: `TLS`, `TLS_PLAINTEXT`, and `PLAINTEXT`. Default value is `TLS`.
+* `in_cluster` - (Optional) Whether data communication among broker nodes is encrypted. Default value: `true`.
+
+#### open_monitoring Argument Reference
+
+* `prometheus` - (Required) Configuration block for Prometheus settings for open monitoring. See below.
+
+#### open_monitoring prometheus Argument Reference
+
+* `jmx_exporter` - (Optional) Configuration block for JMX Exporter. See below.
+* `node_exporter` - (Optional) Configuration block for Node Exporter. See below.
+
+#### open_monitoring prometheus jmx_exporter Argument Reference
+
+* `enabled_in_broker` - (Required) Indicates whether you want to enable or disable the JMX Exporter.
+
+#### open_monitoring prometheus node_exporter Argument Reference
+
+* `enabled_in_broker` - (Required) Indicates whether you want to enable or disable the Node Exporter.
+
+#### logging_info Argument Reference
+
+* `broker_logs` - (Required) Configuration block for Broker Logs settings for logging info. See below.
+
+#### logging_info broker_logs cloudwatch_logs Argument Reference
+
+* `enabled` - (Optional) Indicates whether you want to enable or disable streaming broker logs to Cloudwatch Logs.
+* `log_group` - (Optional) Name of the Cloudwatch Log Group to deliver logs to.
+
+#### logging_info broker_logs firehose Argument Reference
+
+* `enabled` - (Optional) Indicates whether you want to enable or disable streaming broker logs to Kinesis Data Firehose.
+* `delivery_stream` - (Optional) Name of the Kinesis Data Firehose delivery stream to deliver logs to.
+
+#### logging_info broker_logs s3 Argument Reference
+
+* `enabled` - (Optional) Indicates whether you want to enable or disable streaming broker logs to S3.
+* `bucket` - (Optional) Name of the S3 bucket to deliver logs to.
+* `prefix` - (Optional) Prefix to append to the folder name.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the MSK cluster.
+* `bootstrap_brokers` - Comma separated list of one or more hostname:port pairs of kafka brokers suitable to bootstrap connectivity to the kafka cluster. Contains a value if `encryption_info.0.encryption_in_transit.0.client_broker` is set to `PLAINTEXT` or `TLS_PLAINTEXT`. The resource sorts values alphabetically. AWS may not always return all endpoints so this value is not guaranteed to be stable across applies.
+* `bootstrap_brokers_public_sasl_iam` - One or more DNS names (or IP addresses) and SASL IAM port pairs. For example, `b-1-public.exampleClusterName.abcde.c2.kafka.us-east-1.amazonaws.com:9198,b-2-public.exampleClusterName.abcde.c2.kafka.us-east-1.amazonaws.com:9198,b-3-public.exampleClusterName.abcde.c2.kafka.us-east-1.amazonaws.com:9198`. This attribute will have a value if `encryption_info.0.encryption_in_transit.0.client_broker` is set to `TLS_PLAINTEXT` or `TLS` and `client_authentication.0.sasl.0.iam` is set to `true` and `broker_node_group_info.0.connectivity_info.0.public_access.0.type` is set to `SERVICE_PROVIDED_EIPS` and the cluster fulfill all other requirements for public access. The resource sorts the list alphabetically. AWS may not always return all endpoints so the values may not be stable across applies.
+* `bootstrap_brokers_public_sasl_scram` - One or more DNS names (or IP addresses) and SASL SCRAM port pairs. For example, `b-1-public.exampleClusterName.abcde.c2.kafka.us-east-1.amazonaws.com:9196,b-2-public.exampleClusterName.abcde.c2.kafka.us-east-1.amazonaws.com:9196,b-3-public.exampleClusterName.abcde.c2.kafka.us-east-1.amazonaws.com:9196`. This attribute will have a value if `encryption_info.0.encryption_in_transit.0.client_broker` is set to `TLS_PLAINTEXT` or `TLS` and `client_authentication.0.sasl.0.scram` is set to `true` and `broker_node_group_info.0.connectivity_info.0.public_access.0.type` is set to `SERVICE_PROVIDED_EIPS` and the cluster fulfill all other requirements for public access. The resource sorts the list alphabetically. AWS may not always return all endpoints so the values may not be stable across applies.
+* `bootstrap_brokers_public_tls` - One or more DNS names (or IP addresses) and TLS port pairs. For example, `b-1-public.exampleClusterName.abcde.c2.kafka.us-east-1.amazonaws.com:9194,b-2-public.exampleClusterName.abcde.c2.kafka.us-east-1.amazonaws.com:9194,b-3-public.exampleClusterName.abcde.c2.kafka.us-east-1.amazonaws.com:9194`. This attribute will have a value if `encryption_info.0.encryption_in_transit.0.client_broker` is set to `TLS_PLAINTEXT` or `TLS` and `broker_node_group_info.0.connectivity_info.0.public_access.0.type` is set to `SERVICE_PROVIDED_EIPS` and the cluster fulfill all other requirements for public access. The resource sorts the list alphabetically. AWS may not always return all endpoints so the values may not be stable across applies.
+* `bootstrap_brokers_sasl_iam` - One or more DNS names (or IP addresses) and SASL IAM port pairs. For example, `b-1.exampleClusterName.abcde.c2.kafka.us-east-1.amazonaws.com:9098,b-2.exampleClusterName.abcde.c2.kafka.us-east-1.amazonaws.com:9098,b-3.exampleClusterName.abcde.c2.kafka.us-east-1.amazonaws.com:9098`. This attribute will have a value if `encryption_info.0.encryption_in_transit.0.client_broker` is set to `TLS_PLAINTEXT` or `TLS` and `client_authentication.0.sasl.0.iam` is set to `true`. The resource sorts the list alphabetically. AWS may not always return all endpoints so the values may not be stable across applies.
+* `bootstrap_brokers_sasl_scram` - One or more DNS names (or IP addresses) and SASL SCRAM port pairs. For example, `b-1.exampleClusterName.abcde.c2.kafka.us-east-1.amazonaws.com:9096,b-2.exampleClusterName.abcde.c2.kafka.us-east-1.amazonaws.com:9096,b-3.exampleClusterName.abcde.c2.kafka.us-east-1.amazonaws.com:9096`. This attribute will have a value if `encryption_info.0.encryption_in_transit.0.client_broker` is set to `TLS_PLAINTEXT` or `TLS` and `client_authentication.0.sasl.0.scram` is set to `true`. The resource sorts the list alphabetically. AWS may not always return all endpoints so the values may not be stable across applies.
+* `bootstrap_brokers_tls` - One or more DNS names (or IP addresses) and TLS port pairs. For example, `b-1.exampleClusterName.abcde.c2.kafka.us-east-1.amazonaws.com:9094,b-2.exampleClusterName.abcde.c2.kafka.us-east-1.amazonaws.com:9094,b-3.exampleClusterName.abcde.c2.kafka.us-east-1.amazonaws.com:9094`. This attribute will have a value if `encryption_info.0.encryption_in_transit.0.client_broker` is set to `TLS_PLAINTEXT` or `TLS`. The resource sorts the list alphabetically. AWS may not always return all endpoints so the values may not be stable across applies.
+* `bootstrap_brokers_vpc_connectivity_sasl_iam` - A string containing one or more DNS names (or IP addresses) and SASL IAM port pairs for VPC connectivity. AWS may not always return all endpoints so the values may not be stable across applies.
+* `bootstrap_brokers_vpc_connectivity_sasl_scram` - A string containing one or more DNS names (or IP addresses) and SASL SCRAM port pairs for VPC connectivity. AWS may not always return all endpoints so the values may not be stable across applies.
+* `bootstrap_brokers_vpc_connectivity_tls` - A string containing one or more DNS names (or IP addresses) and TLS port pairs for VPC connectivity. AWS may not always return all endpoints so the values may not be stable across applies.
+* `cluster_uuid` - UUID of the MSK cluster, for use in IAM policies.
+* `current_version` - Current version of the MSK Cluster used for updates, e.g., `K13V1IB3VIYZZH`
+* `encryption_info.0.encryption_at_rest_kms_key_arn` - The ARN of the KMS key used for encryption at rest of the broker data volumes.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `storage_mode` - Controls storage mode for supported storage tiers. Valid values are: `LOCAL` or `TIERED`.
+* `zookeeper_connect_string` - A comma separated list of one or more hostname:port pairs to use to connect to the Apache Zookeeper cluster. The returned values are sorted alphabetically. The AWS API may not return all endpoints, so this value is not guaranteed to be stable across applies.
+* `zookeeper_connect_string_tls` - A comma separated list of one or more hostname:port pairs to use to connect to the Apache Zookeeper cluster via TLS. The returned values are sorted alphabetically. The AWS API may not return all endpoints, so this value is not guaranteed to be stable across applies.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `120m`)
+* `update` - (Default `120m`)
+Note that the `update` timeout is used separately for `storage_info`, `instance_type`, `number_of_broker_nodes`, `configuration_info`, `kafka_version` and monitoring and logging update timeouts.
+* `delete` - (Default `120m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import MSK clusters using the cluster `arn`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import MSK clusters using the cluster `arn`. For example:
+
+```console
+% terraform import aws_msk_cluster.example arn:aws:kafka:us-west-2:123456789012:cluster/example/279c0212-d057-4dba-9aa9-1c4e5a25bfc7-3
+```
+
+<!-- cache-key: cdktf-0.18.0 input-d74467505dc35d807d612607ba3f66d806ec402f358078d3397150e5e6466657 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/msk_cluster_policy.html.markdown b/website/docs/cdktf/python/r/msk_cluster_policy.html.markdown
new file mode 100644
index 00000000000..3bad29636df
--- /dev/null
+++ b/website/docs/cdktf/python/r/msk_cluster_policy.html.markdown
@@ -0,0 +1,87 @@
+---
+subcategory: "Managed Streaming for Kafka"
+layout: "aws"
+page_title: "AWS: aws_msk_cluster_policy"
+description: |-
+  Terraform resource for managing an AWS Managed Streaming for Kafka Cluster Policy.
+---
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_msk_cluster_policy
+
+Terraform resource for managing an AWS Managed Streaming for Kafka Cluster Policy.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws. import MskClusterPolicy
+from imports.aws.data_aws_caller_identity import DataAwsCallerIdentity
+from imports.aws.data_aws_partition import DataAwsPartition
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        current = DataAwsCallerIdentity(self, "current")
+        data_aws_partition_current = DataAwsPartition(self, "current_1")
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_partition_current.override_logical_id("current")
+        MskClusterPolicy(self, "example",
+            cluster_arn=aws_msk_cluster_example.arn,
+            policy=Fn.jsonencode({
+                "Statement": [{
+                    "Action": ["kafka:Describe*", "kafka:Get*", "kafka:CreateVpcConnection", "kafka:GetBootstrapBrokers"
+                    ],
+                    "Effect": "Allow",
+                    "Principal": {
+                        "AWS": "arn:${" + data_aws_partition_current.partition + "}:iam::${" + current.account_id + "}:root"
+                    },
+                    "Resource": aws_msk_cluster_example.arn,
+                    "Sid": "ExampleMskClusterPolicy"
+                }
+                ],
+                "Version": "2012-10-17"
+            })
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `cluster_arn` - (Required) The Amazon Resource Name (ARN) that uniquely identifies the cluster.
+* `policy` - (Required) Resource policy for cluster.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Same as `cluster_arn`.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Managed Streaming for Kafka Cluster Policy using the `cluster_arn. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Managed Streaming for Kafka Cluster Policy using the `cluster_arn`. For example:
+
+```console
+% terraform import aws_msk_cluster_policy.example arn:aws:kafka:us-west-2:123456789012:cluster/example/279c0212-d057-4dba-9aa9-1c4e5a25bfc7-3
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1d0af5714d8c3f37bc8001ce239abd95f2f1a370064fc908a9872519c5f9e04e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/msk_configuration.html.markdown b/website/docs/cdktf/python/r/msk_configuration.html.markdown
new file mode 100644
index 00000000000..a43ad457638
--- /dev/null
+++ b/website/docs/cdktf/python/r/msk_configuration.html.markdown
@@ -0,0 +1,71 @@
+---
+subcategory: "Managed Streaming for Kafka"
+layout: "aws"
+page_title: "AWS: aws_msk_configuration"
+description: |-
+  Terraform resource for managing an Amazon Managed Streaming for Kafka configuration
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_msk_configuration
+
+Manages an Amazon Managed Streaming for Kafka configuration. More information can be found on the [MSK Developer Guide](https://docs.aws.amazon.com/msk/latest/developerguide/msk-configuration.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.msk_configuration import MskConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        MskConfiguration(self, "example",
+            kafka_versions=["2.1.0"],
+            name="example",
+            server_properties="auto.create.topics.enable = true\ndelete.topic.enable = true\n\n"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `server_properties` - (Required) Contents of the server.properties file. Supported properties are documented in the [MSK Developer Guide](https://docs.aws.amazon.com/msk/latest/developerguide/msk-configuration-properties.html).
+* `kafka_versions` - (Required) List of Apache Kafka versions which can use this configuration.
+* `name` - (Required) Name of the configuration.
+* `description` - (Optional) Description of the configuration.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the configuration.
+* `latest_revision` - Latest revision of the configuration.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import MSK configurations using the configuration ARN. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import MSK configurations using the configuration ARN. For example:
+
+```console
+% terraform import aws_msk_configuration.example arn:aws:kafka:us-west-2:123456789012:configuration/example/279c0212-d057-4dba-9aa9-1c4e5a25bfc7-3
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ec6fa52ad14d67e345a130b8ceb2e54616e97c5f4cb7c72faeeba7b9d508bcfc -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/msk_replicator.html.markdown b/website/docs/cdktf/python/r/msk_replicator.html.markdown
new file mode 100644
index 00000000000..63b4153a31b
--- /dev/null
+++ b/website/docs/cdktf/python/r/msk_replicator.html.markdown
@@ -0,0 +1,151 @@
+---
+subcategory: "Managed Streaming for Kafka"
+layout: "aws"
+page_title: "AWS: aws_msk_replicator"
+description: |-
+  Terraform resource for managing an AWS Managed Streaming for Kafka Replicator.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_msk_replicator
+
+Terraform resource for managing an AWS Managed Streaming for Kafka Replicator.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, Fn, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.msk_replicator import MskReplicator
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        MskReplicator(self, "test",
+            description="test-description",
+            kafka_cluster=[MskReplicatorKafkaCluster(
+                amazon_msk_cluster=MskReplicatorKafkaClusterAmazonMskCluster(
+                    msk_cluster_arn=source.arn
+                ),
+                vpc_config=MskReplicatorKafkaClusterVpcConfig(
+                    security_groups_ids=[Token.as_string(aws_security_group_source.id)],
+                    subnet_ids=Token.as_list(
+                        Fn.lookup_nested(aws_subnet_source, ["*", "id"]))
+                )
+            ), MskReplicatorKafkaCluster(
+                amazon_msk_cluster=MskReplicatorKafkaClusterAmazonMskCluster(
+                    msk_cluster_arn=target.arn
+                ),
+                vpc_config=MskReplicatorKafkaClusterVpcConfig(
+                    security_groups_ids=[Token.as_string(aws_security_group_target.id)],
+                    subnet_ids=Token.as_list(
+                        Fn.lookup_nested(aws_subnet_target, ["*", "id"]))
+                )
+            )
+            ],
+            replication_info_list=MskReplicatorReplicationInfoListStruct(
+                consumer_group_replication=[MskReplicatorReplicationInfoListConsumerGroupReplication(
+                    consumer_groups_to_replicate=[".*"]
+                )
+                ],
+                source_kafka_cluster_arn=source.arn,
+                target_compression_type="NONE",
+                target_kafka_cluster_arn=target.arn,
+                topic_replication=[MskReplicatorReplicationInfoListTopicReplication(
+                    topics_to_replicate=[".*"]
+                )
+                ]
+            ),
+            replicator_name="test-name",
+            service_execution_role_arn=Token.as_string(aws_iam_role_source.arn)
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `replicator_name` - (Required) The name of the replicator.
+* `kafka_cluster` - (Required) A list of Kafka clusters which are targets of the replicator.
+* `service_execution_role_arn` - (Required) The ARN of the IAM role used by the replicator to access resources in the customer's account (e.g source and target clusters).
+* `replication_info_list` - (Required) A list of replication configurations, where each configuration targets a given source cluster to target cluster replication flow.
+* `description` - (Optional) A summary description of the replicator.
+
+### kafka_cluster Argument Reference
+
+* `amazon_msk_cluster` - (Required) Details of an Amazon MSK cluster.
+* `vpc_config` - (Required) Details of an Amazon VPC which has network connectivity to the Apache Kafka cluster.
+
+### amazon_msk_cluster Argument Reference
+
+* `msk_cluster_arn` - (Required) The ARN of an Amazon MSK cluster.
+
+### vpc_config Argument Reference
+
+* `subnet_ids` - (Required) The list of subnets to connect to in the virtual private cloud (VPC). AWS creates elastic network interfaces inside these subnets to allow communication between your Kafka Cluster and the replicator.
+* `security_groups_ids` - (Required) The AWS security groups to associate with the ENIs used by the replicator. If a security group is not specified, the default security group associated with the VPC is used.
+
+### replication_info_list Argument Reference
+
+* `source_kafka_cluster_arn` - (Required) The ARN of the source Kafka cluster.
+* `target_kafka_cluster_arn` - (Required) The ARN of the target Kafka cluster.
+* `target_compression_type` - (Required) The type of compression to use writing records to target Kafka cluster.
+* `topic_replication` - (Required) Configuration relating to topic replication.
+* `consumer_group_replication` - (Required) Confguration relating to consumer group replication.
+
+### topic_replication Argument Reference
+
+* `topics_to_replicate` - (Required) List of regular expression patterns indicating the topics to copy.
+* `topics_to_exclude` - (Optional) List of regular expression patterns indicating the topics that should not be replica.
+* `detect_and_copy_new_topics` - (Optional) Whether to periodically check for new topics and partitions.
+* `copy_access_control_lists_for_topics` - (Optional) Whether to periodically configure remote topic ACLs to match their corresponding upstream topics.
+* `copy_topic_configurations` - (Optional) Whether to periodically configure remote topics to match their corresponding upstream topics.
+
+### consumer_group_replication Argument Reference
+
+* `consumer_groups_to_replicate` - (Required) List of regular expression patterns indicating the consumer groups to copy.
+* `consumer_groups_to_exclude` - (Optional) List of regular expression patterns indicating the consumer groups that should not be replicated.
+* `detect_and_copy_new_consumer_groups` - (Optional) Whether to periodically check for new consumer groups.
+* `synchronise_consumer_group_offsets` - (Optional) Whether to periodically write the translated offsets to __consumer_offsets topic in target cluster.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Replicator. Do not begin the description with "An", "The", "Defines", "Indicates", or "Specifies," as these are verbose. In other words, "Indicates the amount of storage," can be rewritten as "Amount of storage," without losing any information.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `60m`)
+* `update` - (Default `180m`)
+* `delete` - (Default `90m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import MSK relicators using the replicator ARN. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import MSK replicators using the replicator ARN. For example:
+
+```console
+% terraform import aws_msk_replicator.example arn:aws:kafka:us-west-2:123456789012:configuration/example/279c0212-d057-4dba-9aa9-1c4e5a25bfc7-3
+```
+
+<!-- cache-key: cdktf-0.18.0 input-63ad67b2d16605e26ce5adafa9257f85ab5b20fe8bf73b9375562f9cc014c260 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/msk_scram_secret_association.html.markdown b/website/docs/cdktf/python/r/msk_scram_secret_association.html.markdown
new file mode 100644
index 00000000000..b56ff3af04f
--- /dev/null
+++ b/website/docs/cdktf/python/r/msk_scram_secret_association.html.markdown
@@ -0,0 +1,141 @@
+---
+subcategory: "Managed Streaming for Kafka"
+layout: "aws"
+page_title: "AWS: aws_msk_scram_secret_association"
+description: |-
+  Associates SCRAM secrets with a Managed Streaming for Kafka (MSK) cluster.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_msk_scram_secret_association
+
+Associates SCRAM secrets stored in the Secrets Manager service with a Managed Streaming for Kafka (MSK) cluster.
+
+-> **Note:** The following assumes the MSK cluster has SASL/SCRAM authentication enabled. See below for example usage or refer to the [Username/Password Authentication](https://docs.aws.amazon.com/msk/latest/developerguide/msk-password.html) section of the MSK Developer Guide for more details.
+
+To set up username and password authentication for a cluster, create an [`aws_secretsmanager_secret` resource](/docs/providers/aws/r/secretsmanager_secret.html) and associate
+a username and password with the secret with an [`aws_secretsmanager_secret_version` resource](/docs/providers/aws/r/secretsmanager_secret_version.html). When creating a secret for the cluster,
+the `name` must have the prefix `AmazonMSK_` and you must either use an existing custom AWS KMS key or create a new
+custom AWS KMS key for your secret with the [`aws_kms_key` resource](/docs/providers/aws/r/kms_key.html). It is important to note that a policy is required for the `aws_secretsmanager_secret`
+resource in order for Kafka to be able to read it. This policy is attached automatically when the `aws_msk_scram_secret_association` is used,
+however, this policy will not be in terraform and as such, will present a diff on plan/apply. For that reason, you must use the [`aws_secretsmanager_secret_policy`
+resource](/docs/providers/aws/r/secretsmanager_secret_policy.html) as shown below in order to ensure that the state is in a clean state after the creation of secret and the association to the cluster.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, Fn, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.kms_key import KmsKey
+from imports.aws.msk_cluster import MskCluster
+from imports.aws.msk_scram_secret_association import MskScramSecretAssociation
+from imports.aws.secretsmanager_secret import SecretsmanagerSecret
+from imports.aws.secretsmanager_secret_policy import SecretsmanagerSecretPolicy
+from imports.aws.secretsmanager_secret_version import SecretsmanagerSecretVersion
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, brokerNodeGroupInfo, kafkaVersion, numberOfBrokerNodes):
+        super().__init__(scope, name)
+        example = KmsKey(self, "example",
+            description="Example Key for MSK Cluster Scram Secret Association"
+        )
+        aws_msk_cluster_example = MskCluster(self, "example_1",
+            client_authentication=MskClusterClientAuthentication(
+                sasl=MskClusterClientAuthenticationSasl(
+                    scram=True
+                )
+            ),
+            cluster_name="example",
+            broker_node_group_info=broker_node_group_info,
+            kafka_version=kafka_version,
+            number_of_broker_nodes=number_of_broker_nodes
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_msk_cluster_example.override_logical_id("example")
+        aws_secretsmanager_secret_example = SecretsmanagerSecret(self, "example_2",
+            kms_key_id=example.key_id,
+            name="AmazonMSK_example"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_secretsmanager_secret_example.override_logical_id("example")
+        aws_secretsmanager_secret_version_example =
+        SecretsmanagerSecretVersion(self, "example_3",
+            secret_id=Token.as_string(aws_secretsmanager_secret_example.id),
+            secret_string=Token.as_string(
+                Fn.jsonencode({
+                    "password": "pass",
+                    "username": "user"
+                }))
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_secretsmanager_secret_version_example.override_logical_id("example")
+        data_aws_iam_policy_document_example = DataAwsIamPolicyDocument(self, "example_4",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["secretsmanager:getSecretValue"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["kafka.amazonaws.com"],
+                    type="Service"
+                )
+                ],
+                resources=[Token.as_string(aws_secretsmanager_secret_example.arn)],
+                sid="AWSKafkaResourcePolicy"
+            )
+            ]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_iam_policy_document_example.override_logical_id("example")
+        aws_msk_scram_secret_association_example = MskScramSecretAssociation(self, "example_5",
+            cluster_arn=Token.as_string(aws_msk_cluster_example.arn),
+            depends_on=[aws_secretsmanager_secret_version_example],
+            secret_arn_list=[Token.as_string(aws_secretsmanager_secret_example.arn)]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_msk_scram_secret_association_example.override_logical_id("example")
+        aws_secretsmanager_secret_policy_example = SecretsmanagerSecretPolicy(self, "example_6",
+            policy=Token.as_string(data_aws_iam_policy_document_example.json),
+            secret_arn=Token.as_string(aws_secretsmanager_secret_example.arn)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_secretsmanager_secret_policy_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `cluster_arn` - (Required, Forces new resource) Amazon Resource Name (ARN) of the MSK cluster.
+* `secret_arn_list` - (Required) List of AWS Secrets Manager secret ARNs.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Amazon Resource Name (ARN) of the MSK cluster.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import MSK SCRAM Secret Associations using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import MSK SCRAM Secret Associations using the `id`. For example:
+
+```console
+% terraform import aws_msk_scram_secret_association.example arn:aws:kafka:us-west-2:123456789012:cluster/example/279c0212-d057-4dba-9aa9-1c4e5a25bfc7-3
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ec732cf5141cf9fb92cf842bde1f6a37b2aeeb88245a75584896a69388c8d988 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/msk_serverless_cluster.html.markdown b/website/docs/cdktf/python/r/msk_serverless_cluster.html.markdown
new file mode 100644
index 00000000000..90dab7e47bd
--- /dev/null
+++ b/website/docs/cdktf/python/r/msk_serverless_cluster.html.markdown
@@ -0,0 +1,109 @@
+---
+subcategory: "Managed Streaming for Kafka"
+layout: "aws"
+page_title: "AWS: aws_msk_serverless_cluster"
+description: |-
+  Terraform resource for managing an Amazon MSK Serverless cluster.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_msk_serverless_cluster
+
+Manages an Amazon MSK Serverless cluster.
+
+-> **Note:** To manage a _provisioned_ Amazon MSK cluster, use the [`aws_msk_cluster`](/docs/providers/aws/r/msk_cluster.html) resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, Fn, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.msk_serverless_cluster import MskServerlessCluster
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        MskServerlessCluster(self, "example",
+            client_authentication=MskServerlessClusterClientAuthentication(
+                sasl=MskServerlessClusterClientAuthenticationSasl(
+                    iam=MskServerlessClusterClientAuthenticationSaslIam(
+                        enabled=True
+                    )
+                )
+            ),
+            cluster_name="Example",
+            vpc_config=[MskServerlessClusterVpcConfig(
+                security_group_ids=[Token.as_string(aws_security_group_example.id)],
+                subnet_ids=Token.as_list(
+                    Fn.lookup_nested(aws_subnet_example, ["*", "id"]))
+            )
+            ]
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `client_authentication` - (Required) Specifies client authentication information for the serverless cluster. See below.
+* `cluster_name` - (Required) The name of the serverless cluster.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `vpc_config` - (Required) VPC configuration information. See below.
+
+### client_authentication Argument Reference
+
+* `sasl` - (Required) Details for client authentication using SASL. See below.
+
+### sasl Argument Reference
+
+* `iam` - (Required) Details for client authentication using IAM. See below.
+
+### iam Argument Reference
+
+* `enabled` - (Required) Whether SASL/IAM authentication is enabled or not.
+
+### vpc_config Argument Reference
+
+* `security_group_ids` - (Optional) Specifies up to five security groups that control inbound and outbound traffic for the serverless cluster.
+* `subnet_ids` - (Required) A list of subnets in at least two different Availability Zones that host your client applications.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the serverless cluster.
+* `cluster_uuid` - UUID of the serverless cluster, for use in IAM policies.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `120m`)
+* `delete` - (Default `120m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import MSK serverless clusters using the cluster `arn`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import MSK serverless clusters using the cluster `arn`. For example:
+
+```console
+% terraform import aws_msk_serverless_cluster.example arn:aws:kafka:us-west-2:123456789012:cluster/example/279c0212-d057-4dba-9aa9-1c4e5a25bfc7-3
+```
+
+<!-- cache-key: cdktf-0.18.0 input-e874f0cb80a0744435c987dbba0dd6d2b31f5d0aeda927db3722774f9b044561 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/msk_vpc_connection.html.markdown b/website/docs/cdktf/python/r/msk_vpc_connection.html.markdown
new file mode 100644
index 00000000000..8f3033251cd
--- /dev/null
+++ b/website/docs/cdktf/python/r/msk_vpc_connection.html.markdown
@@ -0,0 +1,82 @@
+---
+subcategory: "Managed Streaming for Kafka"
+layout: "aws"
+page_title: "AWS: aws_msk_vpc_connection"
+description: |-
+  Terraform resource for managing an AWS Managed Streaming for Kafka VPC Connection.
+---
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_msk_vpc_connection
+
+Terraform resource for managing an AWS Managed Streaming for Kafka VPC Connection.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.msk_vpc_connection import MskVpcConnection
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        MskVpcConnection(self, "test",
+            authentication="SASL_IAM",
+            client_subnets=Token.as_list(Fn.lookup_nested(aws_subnet_test, ["*", "id"])),
+            security_groups=[Token.as_string(aws_security_group_test.id)],
+            target_cluster_arn="aws_msk_cluster.arn",
+            vpc_id=Token.as_string(aws_vpc_test.id)
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `authentication` - (Required) The authentication type for the client VPC connection. Specify one of these auth type strings: SASL_IAM, SASL_SCRAM, or TLS.
+* `client_subnets` - (Required) The list of subnets in the client VPC to connect to.
+* `security_groups` - (Required) The security groups to attach to the ENIs for the broker nodes.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `target_cluster_arn` - (Required) The Amazon Resource Name (ARN) of the cluster.
+* `vpc_id` - (Required) The VPC ID of the remote client.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the VPC connection.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `60m`)
+* `update` - (Default `180m`)
+* `delete` - (Default `90m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import MSK configurations using the configuration ARN. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import MSK configurations using the configuration ARN. For example:
+
+```console
+% terraform import aws_msk_vpc_connection.example arn:aws:kafka:eu-west-2:123456789012:vpc-connection/123456789012/example/38173259-79cd-4ee8-87f3-682ea6023f48-2
+```
+
+<!-- cache-key: cdktf-0.18.0 input-b1983aad22e07fb109f5b2adb453a2e83d036de6685d43ca610e71d747466b69 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/mskconnect_connector.html.markdown b/website/docs/cdktf/python/r/mskconnect_connector.html.markdown
new file mode 100644
index 00000000000..5a5051afe37
--- /dev/null
+++ b/website/docs/cdktf/python/r/mskconnect_connector.html.markdown
@@ -0,0 +1,217 @@
+---
+subcategory: "Managed Streaming for Kafka Connect"
+layout: "aws"
+page_title: "AWS: aws_mskconnect_connector"
+description: |-
+  Provides an Amazon MSK Connect Connector resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_mskconnect_connector
+
+Provides an Amazon MSK Connect Connector resource.
+
+## Example Usage
+
+### Basic configuration
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.mskconnect_connector import MskconnectConnector
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        MskconnectConnector(self, "example",
+            capacity=MskconnectConnectorCapacity(
+                autoscaling=MskconnectConnectorCapacityAutoscaling(
+                    max_worker_count=2,
+                    mcu_count=1,
+                    min_worker_count=1,
+                    scale_in_policy=MskconnectConnectorCapacityAutoscalingScaleInPolicy(
+                        cpu_utilization_percentage=20
+                    ),
+                    scale_out_policy=MskconnectConnectorCapacityAutoscalingScaleOutPolicy(
+                        cpu_utilization_percentage=80
+                    )
+                )
+            ),
+            connector_configuration={
+                "connector.class": "com.github.jcustenborder.kafka.connect.simulator.SimulatorSinkConnector",
+                "tasks.max": "1",
+                "topics": "example"
+            },
+            kafka_cluster=MskconnectConnectorKafkaCluster(
+                apache_kafka_cluster=MskconnectConnectorKafkaClusterApacheKafkaCluster(
+                    bootstrap_servers=Token.as_string(aws_msk_cluster_example.bootstrap_brokers_tls),
+                    vpc=MskconnectConnectorKafkaClusterApacheKafkaClusterVpc(
+                        security_groups=[Token.as_string(aws_security_group_example.id)],
+                        subnets=[example1.id, example2.id, example3.id]
+                    )
+                )
+            ),
+            kafka_cluster_client_authentication=MskconnectConnectorKafkaClusterClientAuthentication(
+                authentication_type="NONE"
+            ),
+            kafka_cluster_encryption_in_transit=MskconnectConnectorKafkaClusterEncryptionInTransit(
+                encryption_type="TLS"
+            ),
+            kafkaconnect_version="2.7.1",
+            name="example",
+            plugin=[MskconnectConnectorPlugin(
+                custom_plugin=MskconnectConnectorPluginCustomPlugin(
+                    arn=Token.as_string(aws_mskconnect_custom_plugin_example.arn),
+                    revision=Token.as_number(aws_mskconnect_custom_plugin_example.latest_revision)
+                )
+            )
+            ],
+            service_execution_role_arn=Token.as_string(aws_iam_role_example.arn)
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `capacity` - (Required) Information about the capacity allocated to the connector. See below.
+* `connector_configuration` - (Required) A map of keys to values that represent the configuration for the connector.
+* `description` - (Optional) A summary description of the connector.
+* `kafka_cluster` - (Required) Specifies which Apache Kafka cluster to connect to. See below.
+* `kafka_cluster_client_authentication` - (Required) Details of the client authentication used by the Apache Kafka cluster. See below.
+* `kafka_cluster_encryption_in_transit` - (Required) Details of encryption in transit to the Apache Kafka cluster. See below.
+* `kafkaconnect_version` - (Required) The version of Kafka Connect. It has to be compatible with both the Apache Kafka cluster's version and the plugins.
+* `log_delivery` - (Optional) Details about log delivery. See below.
+* `name` - (Required) The name of the connector.
+* `plugin` - (Required) Specifies which plugins to use for the connector. See below.
+* `service_execution_role_arn` - (Required) The Amazon Resource Name (ARN) of the IAM role used by the connector to access the Amazon Web Services resources that it needs. The types of resources depends on the logic of the connector. For example, a connector that has Amazon S3 as a destination must have permissions that allow it to write to the S3 destination bucket.
+* `worker_configuration` - (Optional) Specifies which worker configuration to use with the connector. See below.
+
+### capacity Configuration Block
+
+* `autoscaling` - (Optional) Information about the auto scaling parameters for the connector. See below.
+* `provisioned_capacity` - (Optional) Details about a fixed capacity allocated to a connector. See below.
+
+### autoscaling Configuration Block
+
+* `max_worker_count` - (Required) The maximum number of workers allocated to the connector.
+* `mcu_count` - (Optional) The number of microcontroller units (MCUs) allocated to each connector worker. Valid values: `1`, `2`, `4`, `8`. The default value is `1`.
+* `min_worker_count` - (Required) The minimum number of workers allocated to the connector.
+* `scale_in_policy` - (Optional) The scale-in policy for the connector. See below.
+* `scale_out_policy` - (Optional) The scale-out policy for the connector. See below.
+
+### scale_in_policy Configuration Block
+
+* `cpu_utilization_percentage` - (Required) Specifies the CPU utilization percentage threshold at which you want connector scale in to be triggered.
+
+### scale_out_policy Configuration Block
+
+* `cpu_utilization_percentage` - (Required) The CPU utilization percentage threshold at which you want connector scale out to be triggered.
+
+### provisioned_capacity Configuration Block
+
+* `mcu_count` - (Optional) The number of microcontroller units (MCUs) allocated to each connector worker. Valid values: `1`, `2`, `4`, `8`. The default value is `1`.
+* `worker_count` - (Required) The number of workers that are allocated to the connector.
+
+### kafka_cluster Configuration Block
+
+* `apache_kafka_cluster` - (Required) The Apache Kafka cluster to which the connector is connected.
+
+### apache_kafka_cluster Configuration Block
+
+* `bootstrap_servers` - (Required) The bootstrap servers of the cluster.
+* `vpc` - (Required) Details of an Amazon VPC which has network connectivity to the Apache Kafka cluster.
+
+### vpc Configuration Block
+
+* `security_groups` - (Required) The security groups for the connector.
+* `subnets` - (Required) The subnets for the connector.
+
+### kafka_cluster_client_authentication Configuration Block
+
+* `authentication_type` - (Optional) The type of client authentication used to connect to the Apache Kafka cluster. Valid values: `IAM`, `NONE`. A value of `NONE` means that no client authentication is used. The default value is `NONE`.
+
+### kafka_cluster_encryption_in_transit Configuration Block
+
+* `encryption_type` - (Optional) The type of encryption in transit to the Apache Kafka cluster. Valid values: `PLAINTEXT`, `TLS`. The default values is `PLAINTEXT`.
+
+### log_delivery Configuration Block
+
+* `worker_log_delivery` - (Required) The workers can send worker logs to different destination types. This configuration specifies the details of these destinations. See below.
+
+### worker_log_delivery Configuration Block
+
+* `cloudwatch_logs` - (Optional) Details about delivering logs to Amazon CloudWatch Logs. See below.
+* `firehose` - (Optional) Details about delivering logs to Amazon Kinesis Data Firehose. See below.
+* `s3` - (Optional) Details about delivering logs to Amazon S3. See below.
+
+### cloudwatch_logs Configuration Block
+
+* `enabled` - (Optional) Whether log delivery to Amazon CloudWatch Logs is enabled.
+* `log_group` - (Required) The name of the CloudWatch log group that is the destination for log delivery.
+
+### firehose Configuration Block
+
+* `delivery_stream` - (Optional) The name of the Kinesis Data Firehose delivery stream that is the destination for log delivery.
+* `enabled` - (Required) Specifies whether connector logs get delivered to Amazon Kinesis Data Firehose.
+
+### s3 Configuration Block
+
+* `bucket` - (Optional) The name of the S3 bucket that is the destination for log delivery.
+* `enabled` - (Required) Specifies whether connector logs get sent to the specified Amazon S3 destination.
+* `prefix` - (Optional) The S3 prefix that is the destination for log delivery.
+
+### plugin Configuration Block
+
+* `custom_plugin` - (Required) Details about a custom plugin. See below.
+
+### custom_plugin Configuration Block
+
+* `arn` - (Required) The Amazon Resource Name (ARN) of the custom plugin.
+* `revision` - (Required) The revision of the custom plugin.
+
+### worker_configuration Configuration Block
+
+* `arn` - (Required) The Amazon Resource Name (ARN) of the worker configuration.
+* `revision` - (Required) The revision of the worker configuration.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the connector.
+* `version` - The current version of the connector.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `20m`)
+* `update` - (Default `20m`)
+* `delete` - (Default `10m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import MSK Connect Connector using the connector's `arn`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import MSK Connect Connector using the connector's `arn`. For example:
+
+```console
+% terraform import aws_mskconnect_connector.example 'arn:aws:kafkaconnect:eu-central-1:123456789012:connector/example/264edee4-17a3-412e-bd76-6681cfc93805-3'
+```
+
+<!-- cache-key: cdktf-0.18.0 input-40619f08de26cd7fcad3cf70d7685484652ad1f0806e16438690dce5d953aa3a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/mskconnect_custom_plugin.html.markdown b/website/docs/cdktf/python/r/mskconnect_custom_plugin.html.markdown
new file mode 100644
index 00000000000..5ad9e7e4eef
--- /dev/null
+++ b/website/docs/cdktf/python/r/mskconnect_custom_plugin.html.markdown
@@ -0,0 +1,113 @@
+---
+subcategory: "Managed Streaming for Kafka Connect"
+layout: "aws"
+page_title: "AWS: aws_mskconnect_custom_plugin"
+description: |-
+  Provides an Amazon MSK Connect custom plugin resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_mskconnect_custom_plugin
+
+Provides an Amazon MSK Connect Custom Plugin Resource.
+
+## Example Usage
+
+### Basic configuration
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.mskconnect_custom_plugin import MskconnectCustomPlugin
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_object import S3Object
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = S3Bucket(self, "example",
+            bucket="example"
+        )
+        aws_s3_object_example = S3Object(self, "example_1",
+            bucket=example.id,
+            key="debezium.zip",
+            source="debezium.zip"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_object_example.override_logical_id("example")
+        aws_mskconnect_custom_plugin_example = MskconnectCustomPlugin(self, "example_2",
+            content_type="ZIP",
+            location=MskconnectCustomPluginLocation(
+                s3=MskconnectCustomPluginLocationS3(
+                    bucket_arn=example.arn,
+                    file_key=Token.as_string(aws_s3_object_example.key)
+                )
+            ),
+            name="debezium-example"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_mskconnect_custom_plugin_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) The name of the custom plugin..
+* `content_type` - (Required) The type of the plugin file. Allowed values are `ZIP` and `JAR`.
+* `location` - (Required) Information about the location of a custom plugin. See below.
+
+The following arguments are optional:
+
+* `description` - (Optional) A summary description of the custom plugin.
+
+### location Argument Reference
+
+* `s3` - (Required) Information of the plugin file stored in Amazon S3. See below.
+
+#### location s3 Argument Reference
+
+* `bucket_arn` - (Required) The Amazon Resource Name (ARN) of an S3 bucket.
+* `file_key` - (Required) The file key for an object in an S3 bucket.
+* `object_version` - (Optional) The version of an object in an S3 bucket.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - the Amazon Resource Name (ARN) of the custom plugin.
+* `latest_revision` - an ID of the latest successfully created revision of the custom plugin.
+* `state` - the state of the custom plugin.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `10m`)
+* `delete` - (Default `10m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import MSK Connect Custom Plugin using the plugin's `arn`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import MSK Connect Custom Plugin using the plugin's `arn`. For example:
+
+```console
+% terraform import aws_mskconnect_custom_plugin.example 'arn:aws:kafkaconnect:eu-central-1:123456789012:custom-plugin/debezium-example/abcdefgh-1234-5678-9abc-defghijklmno-4'
+```
+
+<!-- cache-key: cdktf-0.18.0 input-fa6ff218273ad9d6a29b1b6d47850b35e3eb2ccea8af6818ee7abaf4e10e3981 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/mskconnect_worker_configuration.html.markdown b/website/docs/cdktf/python/r/mskconnect_worker_configuration.html.markdown
new file mode 100644
index 00000000000..fecc59c4e4b
--- /dev/null
+++ b/website/docs/cdktf/python/r/mskconnect_worker_configuration.html.markdown
@@ -0,0 +1,74 @@
+---
+subcategory: "Managed Streaming for Kafka Connect"
+layout: "aws"
+page_title: "AWS: aws_mskconnect_worker_configuration"
+description: |-
+  Provides an Amazon MSK Connect worker configuration resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_mskconnect_worker_configuration
+
+Provides an Amazon MSK Connect Worker Configuration Resource.
+
+## Example Usage
+
+### Basic configuration
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.mskconnect_worker_configuration import MskconnectWorkerConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        MskconnectWorkerConfiguration(self, "example",
+            name="example",
+            properties_file_content="key.converter=org.apache.kafka.connect.storage.StringConverter\nvalue.converter=org.apache.kafka.connect.storage.StringConverter\n\n"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) The name of the worker configuration.
+* `properties_file_content` - (Required) Contents of connect-distributed.properties file. The value can be either base64 encoded or in raw format.
+
+The following arguments are optional:
+
+* `description` - (Optional) A summary description of the worker configuration.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - the Amazon Resource Name (ARN) of the worker configuration.
+* `latest_revision` - an ID of the latest successfully created revision of the worker configuration.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import MSK Connect Worker Configuration using the plugin's `arn`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import MSK Connect Worker Configuration using the plugin's `arn`. For example:
+
+```console
+% terraform import aws_mskconnect_worker_configuration.example 'arn:aws:kafkaconnect:eu-central-1:123456789012:worker-configuration/example/8848493b-7fcc-478c-a646-4a52634e3378-4'
+```
+
+<!-- cache-key: cdktf-0.18.0 input-bc7b92333857615efcf55495814a13f7f290beda82616db5a0a69a043449491a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/mwaa_environment.html.markdown b/website/docs/cdktf/python/r/mwaa_environment.html.markdown
new file mode 100644
index 00000000000..5382e97f817
--- /dev/null
+++ b/website/docs/cdktf/python/r/mwaa_environment.html.markdown
@@ -0,0 +1,245 @@
+---
+subcategory: "MWAA (Managed Workflows for Apache Airflow)"
+layout: "aws"
+page_title: "AWS: aws_mwaa_environment"
+description: |-
+  Creates a MWAA Environment
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_mwaa_environment
+
+Creates a MWAA Environment resource.
+
+## Example Usage
+
+A MWAA Environment requires an IAM role (`aws_iam_role`), two subnets in the private zone (`aws_subnet`) and a versioned S3 bucket (`aws_s3_bucket`).
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, Fn, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.mwaa_environment import MwaaEnvironment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        MwaaEnvironment(self, "example",
+            dag_s3_path="dags/",
+            execution_role_arn=Token.as_string(aws_iam_role_example.arn),
+            name="example",
+            network_configuration=MwaaEnvironmentNetworkConfiguration(
+                security_group_ids=[Token.as_string(aws_security_group_example.id)],
+                subnet_ids=Token.as_list(Fn.lookup_nested(private, ["*", "id"]))
+            ),
+            source_bucket_arn=Token.as_string(aws_s3_bucket_example.arn)
+        )
+```
+
+### Example with Airflow configuration options
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, Fn, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.mwaa_environment import MwaaEnvironment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        MwaaEnvironment(self, "example",
+            airflow_configuration_options={
+                "core.default_task_retries": Token.as_string(16),
+                "core.parallelism": Token.as_string(1)
+            },
+            dag_s3_path="dags/",
+            execution_role_arn=Token.as_string(aws_iam_role_example.arn),
+            name="example",
+            network_configuration=MwaaEnvironmentNetworkConfiguration(
+                security_group_ids=[Token.as_string(aws_security_group_example.id)],
+                subnet_ids=Token.as_list(Fn.lookup_nested(private, ["*", "id"]))
+            ),
+            source_bucket_arn=Token.as_string(aws_s3_bucket_example.arn)
+        )
+```
+
+### Example with logging configurations
+
+Note that Airflow task logs are enabled by default with the `INFO` log level.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, Fn, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.mwaa_environment import MwaaEnvironment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        MwaaEnvironment(self, "example",
+            dag_s3_path="dags/",
+            execution_role_arn=Token.as_string(aws_iam_role_example.arn),
+            logging_configuration=MwaaEnvironmentLoggingConfiguration(
+                dag_processing_logs=MwaaEnvironmentLoggingConfigurationDagProcessingLogs(
+                    enabled=True,
+                    log_level="DEBUG"
+                ),
+                scheduler_logs=MwaaEnvironmentLoggingConfigurationSchedulerLogs(
+                    enabled=True,
+                    log_level="INFO"
+                ),
+                task_logs=MwaaEnvironmentLoggingConfigurationTaskLogs(
+                    enabled=True,
+                    log_level="WARNING"
+                ),
+                webserver_logs=MwaaEnvironmentLoggingConfigurationWebserverLogs(
+                    enabled=True,
+                    log_level="ERROR"
+                ),
+                worker_logs=MwaaEnvironmentLoggingConfigurationWorkerLogs(
+                    enabled=True,
+                    log_level="CRITICAL"
+                )
+            ),
+            name="example",
+            network_configuration=MwaaEnvironmentNetworkConfiguration(
+                security_group_ids=[Token.as_string(aws_security_group_example.id)],
+                subnet_ids=Token.as_list(Fn.lookup_nested(private, ["*", "id"]))
+            ),
+            source_bucket_arn=Token.as_string(aws_s3_bucket_example.arn)
+        )
+```
+
+### Example with tags
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, Fn, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.mwaa_environment import MwaaEnvironment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        MwaaEnvironment(self, "example",
+            dag_s3_path="dags/",
+            execution_role_arn=Token.as_string(aws_iam_role_example.arn),
+            name="example",
+            network_configuration=MwaaEnvironmentNetworkConfiguration(
+                security_group_ids=[Token.as_string(aws_security_group_example.id)],
+                subnet_ids=Token.as_list(Fn.lookup_nested(private, ["*", "id"]))
+            ),
+            source_bucket_arn=Token.as_string(aws_s3_bucket_example.arn),
+            tags={
+                "Environment": "production",
+                "Name": "example"
+            }
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `airflow_configuration_options` - (Optional) The `airflow_configuration_options` parameter specifies airflow override options. Check the [Official documentation](https://docs.aws.amazon.com/mwaa/latest/userguide/configuring-env-variables.html#configuring-env-variables-reference) for all possible configuration options.
+* `airflow_version` - (Optional) Airflow version of your environment, will be set by default to the latest version that MWAA supports.
+* `dag_s3_path` - (Required) The relative path to the DAG folder on your Amazon S3 storage bucket. For example, dags. For more information, see [Importing DAGs on Amazon MWAA](https://docs.aws.amazon.com/mwaa/latest/userguide/configuring-dag-import.html).
+* `environment_class` - (Optional) Environment class for the cluster. Possible options are `mw1.small`, `mw1.medium`, `mw1.large`. Will be set by default to `mw1.small`. Please check the [AWS Pricing](https://aws.amazon.com/de/managed-workflows-for-apache-airflow/pricing/) for more information about the environment classes.
+* `execution_role_arn` - (Required) The Amazon Resource Name (ARN) of the task execution role that the Amazon MWAA and its environment can assume. Check the [official AWS documentation](https://docs.aws.amazon.com/mwaa/latest/userguide/mwaa-create-role.html) for the detailed role specification.
+* `kms_key` - (Optional) The Amazon Resource Name (ARN) of your KMS key that you want to use for encryption. Will be set to the ARN of the managed KMS key `aws/airflow` by default. Please check the [Official Documentation](https://docs.aws.amazon.com/mwaa/latest/userguide/custom-keys-certs.html) for more information.
+* `logging_configuration` - (Optional) The Apache Airflow logs you want to send to Amazon CloudWatch Logs.
+* `max_workers` - (Optional) The maximum number of workers that can be automatically scaled up. Value need to be between `1` and `25`. Will be `10` by default.
+* `min_workers` - (Optional) The minimum number of workers that you want to run in your environment. Will be `1` by default.
+* `name` - (Required) The name of the Apache Airflow Environment
+* `network_configuration` - (Required) Specifies the network configuration for your Apache Airflow Environment. This includes two private subnets as well as security groups for the Airflow environment. Each subnet requires internet connection, otherwise the deployment will fail. See [Network configuration](#network-configuration) below for details.
+* `plugins_s3_object_version` - (Optional) The plugins.zip file version you want to use.
+* `plugins_s3_path` - (Optional) The relative path to the plugins.zip file on your Amazon S3 storage bucket. For example, plugins.zip. If a relative path is provided in the request, then plugins_s3_object_version is required. For more information, see [Importing DAGs on Amazon MWAA](https://docs.aws.amazon.com/mwaa/latest/userguide/configuring-dag-import.html).
+* `requirements_s3_object_version` - (Optional) The requirements.txt file version you want to use.
+* `requirements_s3_path` - (Optional) The relative path to the requirements.txt file on your Amazon S3 storage bucket. For example, requirements.txt. If a relative path is provided in the request, then requirements_s3_object_version is required. For more information, see [Importing DAGs on Amazon MWAA](https://docs.aws.amazon.com/mwaa/latest/userguide/configuring-dag-import.html).
+* `schedulers` - (Optional) The number of schedulers that you want to run in your environment. v2.0.2 and above accepts `2` - `5`, default `2`. v1.10.12 accepts `1`.
+* `source_bucket_arn` - (Required) The Amazon Resource Name (ARN) of your Amazon S3 storage bucket. For example, arn:aws:s3:::airflow-mybucketname.
+* `startup_script_s3_object_version` - (Optional) The version of the startup shell script you want to use. You must specify the version ID that Amazon S3 assigns to the file every time you update the script.
+* `startup_script_s3_path` - (Optional) The relative path to the script hosted in your bucket. The script runs as your environment starts before starting the Apache Airflow process. Use this script to install dependencies, modify configuration options, and set environment variables. See [Using a startup script](https://docs.aws.amazon.com/mwaa/latest/userguide/using-startup-script.html). Supported for environment versions 2.x and later.
+* `webserver_access_mode` - (Optional) Specifies whether the webserver should be accessible over the internet or via your specified VPC. Possible options: `PRIVATE_ONLY` (default) and `PUBLIC_ONLY`.
+* `weekly_maintenance_window_start` - (Optional) Specifies the start date for the weekly maintenance window.
+* `tags` - (Optional) A map of resource tags to associate with the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Logging configurations
+
+The `logging_configuration` block supports the following arguments.
+
+* `dag_processing_logs` - (Optional) (Optional) Log configuration options for processing DAGs. See [Module logging configuration](#module-logging-configuration) for more information. Disabled by default.
+* `scheduler_logs` - (Optional) Log configuration options for the schedulers. See [Module logging configuration](#module-logging-configuration) for more information. Disabled by default.
+* `task_logs` - (Optional) Log configuration options for DAG tasks. See [Module logging configuration](#module-logging-configuration) for more information. Enabled by default with `INFO` log level.
+* `webserver_logs` - (Optional) Log configuration options for the webservers. See [Module logging configuration](#module-logging-configuration) for more information. Disabled by default.
+* `worker_logs` - (Optional) Log configuration options for the workers. See [Module logging configuration](#module-logging-configuration) for more information. Disabled by default.
+
+### Module logging configuration
+
+A configuration block to use for logging with respect to the various Apache Airflow services: DagProcessingLogs, SchedulerLogs, TaskLogs, WebserverLogs, and WorkerLogs. It supports the following arguments.
+
+* `enabled` - (Required) Enabling or disabling the collection of logs
+* `log_level` - (Optional) Logging level. Valid values: `CRITICAL`, `ERROR`, `WARNING`, `INFO`, `DEBUG`. Will be `INFO` by default.
+
+### Network configuration
+
+The `network_configuration` block supports the following arguments. More information about the required subnet and security group settings can be found in the [official AWS documentation](https://docs.aws.amazon.com/mwaa/latest/userguide/vpc-create.html).
+
+* `security_group_ids` - (Required) Security groups IDs for the environment. At least one of the security group needs to allow MWAA resources to talk to each other, otherwise MWAA cannot be provisioned.
+* `subnet_ids` - (Required)  The private subnet IDs in which the environment should be created. MWAA requires two subnets.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the MWAA Environment
+* `created_at` - The Created At date of the MWAA Environment
+* `logging_configuration[0].<LOG_CONFIGURATION_TYPE>[0].cloud_watch_log_group_arn` - Provides the ARN for the CloudWatch group where the logs will be published
+* `service_role_arn` - The Service Role ARN of the Amazon MWAA Environment
+* `status` - The status of the Amazon MWAA Environment
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `webserver_url` - The webserver URL of the MWAA Environment
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `120m`)
+- `update` - (Default `90m`)
+- `delete` - (Default `90m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import MWAA Environment using `Name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import MWAA Environment using `Name`. For example:
+
+```console
+% terraform import aws_mwaa_environment.example MyAirflowEnvironment
+```
+
+<!-- cache-key: cdktf-0.18.0 input-d3002c93c3e9fc1e98e7cfbd839e153f618d73c8c38a32a37712a4061c84cbe9 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/nat_gateway.html.markdown b/website/docs/cdktf/python/r/nat_gateway.html.markdown
new file mode 100644
index 00000000000..ac1d7d3c25f
--- /dev/null
+++ b/website/docs/cdktf/python/r/nat_gateway.html.markdown
@@ -0,0 +1,154 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_nat_gateway"
+description: |-
+  Provides a resource to create a VPC NAT Gateway.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_nat_gateway
+
+Provides a resource to create a VPC NAT Gateway.
+
+## Example Usage
+
+### Public NAT
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.nat_gateway import NatGateway
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        NatGateway(self, "example",
+            allocation_id=Token.as_string(aws_eip_example.id),
+            depends_on=[aws_internet_gateway_example],
+            subnet_id=Token.as_string(aws_subnet_example.id),
+            tags={
+                "Name": "gw NAT"
+            }
+        )
+```
+
+### Public NAT with Secondary Private IP Addresses
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.nat_gateway import NatGateway
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        NatGateway(self, "example",
+            allocation_id=Token.as_string(aws_eip_example.id),
+            secondary_allocation_ids=[secondary.id],
+            secondary_private_ip_addresses=["10.0.1.5"],
+            subnet_id=Token.as_string(aws_subnet_example.id)
+        )
+```
+
+### Private NAT
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.nat_gateway import NatGateway
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        NatGateway(self, "example",
+            connectivity_type="private",
+            subnet_id=Token.as_string(aws_subnet_example.id)
+        )
+```
+
+### Private NAT with Secondary Private IP Addresses
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.nat_gateway import NatGateway
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        NatGateway(self, "example",
+            connectivity_type="private",
+            secondary_private_ip_address_count=7,
+            subnet_id=Token.as_string(aws_subnet_example.id)
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `allocation_id` - (Optional) The Allocation ID of the Elastic IP address for the NAT Gateway. Required for `connectivity_type` of `public`.
+* `connectivity_type` - (Optional) Connectivity type for the NAT Gateway. Valid values are `private` and `public`. Defaults to `public`.
+* `private_ip` - (Optional) The private IPv4 address to assign to the NAT Gateway. If you don't provide an address, a private IPv4 address will be automatically assigned.
+* `subnet_id` - (Required) The Subnet ID of the subnet in which to place the NAT Gateway.
+* `secondary_allocation_ids` - (Optional) A list of secondary allocation EIP IDs for this NAT Gateway.
+* `secondary_private_ip_address_count` - (Optional) [Private NAT Gateway only] The number of secondary private IPv4 addresses you want to assign to the NAT Gateway.
+* `secondary_private_ip_addresses` - (Optional) A list of secondary private IPv4 addresses to assign to the NAT Gateway.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `association_id` - The association ID of the Elastic IP address that's associated with the NAT Gateway. Only available when `connectivity_type` is `public`.
+* `id` - The ID of the NAT Gateway.
+* `network_interface_id` - The ID of the network interface associated with the NAT Gateway.
+* `public_ip` - The Elastic IP address associated with the NAT Gateway.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `10m`)
+- `update` - (Default `10m`)
+- `delete` - (Default `30m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import NAT Gateways using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import NAT Gateways using the `id`. For example:
+
+```console
+% terraform import aws_nat_gateway.private_gw nat-05dba92075d71c408
+```
+
+<!-- cache-key: cdktf-0.18.0 input-6e34b90b4993bab91f851a578e7ddb84ebd6aef6d8220655a1d5b45186bd1edf -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/neptune_cluster.html.markdown b/website/docs/cdktf/python/r/neptune_cluster.html.markdown
new file mode 100644
index 00000000000..8471d0ed3ae
--- /dev/null
+++ b/website/docs/cdktf/python/r/neptune_cluster.html.markdown
@@ -0,0 +1,166 @@
+---
+subcategory: "Neptune"
+layout: "aws"
+page_title: "AWS: aws_neptune_cluster"
+description: |-
+  Provides an Neptune Cluster Resource
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_neptune_cluster
+
+Provides an Neptune Cluster Resource. A Cluster Resource defines attributes that are
+applied to the entire cluster of Neptune Cluster Instances.
+
+Changes to a Neptune Cluster can occur when you manually change a
+parameter, such as `backup_retention_period`, and are reflected in the next maintenance
+window. Because of this, Terraform may report a difference in its planning
+phase because a modification has not yet taken place. You can use the
+`apply_immediately` flag to instruct the service to apply the change immediately
+(see documentation below).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.neptune_cluster import NeptuneCluster
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        NeptuneCluster(self, "default",
+            apply_immediately=True,
+            backup_retention_period=5,
+            cluster_identifier="neptune-cluster-demo",
+            engine="neptune",
+            iam_database_authentication_enabled=True,
+            preferred_backup_window="07:00-09:00",
+            skip_final_snapshot=True
+        )
+```
+
+~> **Note:** AWS Neptune does not support user name/password–based access control.
+See the AWS [Docs](https://docs.aws.amazon.com/neptune/latest/userguide/limits.html) for more information.
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `allow_major_version_upgrade` - (Optional) Specifies whether upgrades between different major versions are allowed. You must set it to `true` when providing an `engine_version` parameter that uses a different major version than the DB cluster's current version. Default is `false`.
+* `apply_immediately` - (Optional) Specifies whether any cluster modifications are applied immediately, or during the next maintenance window. Default is `false`.
+* `availability_zones` - (Optional) A list of EC2 Availability Zones that instances in the Neptune cluster can be created in.
+* `backup_retention_period` - (Optional) The days to retain backups for. Default `1`
+* `cluster_identifier` - (Optional, Forces new resources) The cluster identifier. If omitted, Terraform will assign a random, unique identifier.
+* `cluster_identifier_prefix` - (Optional, Forces new resource) Creates a unique cluster identifier beginning with the specified prefix. Conflicts with `cluster_identifier`.
+* `copy_tags_to_snapshot` - (Optional) If set to true, tags are copied to any snapshot of the DB cluster that is created.
+* `enable_cloudwatch_logs_exports` - (Optional) A list of the log types this DB cluster is configured to export to Cloudwatch Logs. Currently only supports `audit` and `slowquery`.
+* `engine` - (Optional) The name of the database engine to be used for this Neptune cluster. Defaults to `neptune`.
+* `engine_version` - (Optional) The database engine version.
+* `final_snapshot_identifier` - (Optional) The name of your final Neptune snapshot when this Neptune cluster is deleted. If omitted, no final snapshot will be made.
+* `global_cluster_identifier` - (Optional) The global cluster identifier specified on [`aws_neptune_global_cluster`](/docs/providers/aws/r/neptune_global_cluster.html).
+* `iam_roles` - (Optional) A List of ARNs for the IAM roles to associate to the Neptune Cluster.
+* `iam_database_authentication_enabled` - (Optional) Specifies whether or not mappings of AWS Identity and Access Management (IAM) accounts to database accounts is enabled.
+* `kms_key_arn` - (Optional) The ARN for the KMS encryption key. When specifying `kms_key_arn`, `storage_encrypted` needs to be set to true.
+* `neptune_subnet_group_name` - (Optional) A Neptune subnet group to associate with this Neptune instance.
+* `neptune_cluster_parameter_group_name` - (Optional) A cluster parameter group to associate with the cluster.
+* `neptune_instance_parameter_group_name` - (Optional) The name of the DB parameter group to apply to all instances of the DB cluster.
+* `preferred_backup_window` - (Optional) The daily time range during which automated backups are created if automated backups are enabled using the BackupRetentionPeriod parameter. Time in UTC. Default: A 30-minute window selected at random from an 8-hour block of time per regionE.g., 04:00-09:00
+* `preferred_maintenance_window` - (Optional) The weekly time range during which system maintenance can occur, in (UTC) e.g., wed:04:00-wed:04:30
+* `port` - (Optional) The port on which the Neptune accepts connections. Default is `8182`.
+* `replication_source_identifier` - (Optional) ARN of a source Neptune cluster or Neptune instance if this Neptune cluster is to be created as a Read Replica.
+* `skip_final_snapshot` - (Optional) Determines whether a final Neptune snapshot is created before the Neptune cluster is deleted. If true is specified, no Neptune snapshot is created. If false is specified, a Neptune snapshot is created before the Neptune cluster is deleted, using the value from `final_snapshot_identifier`. Default is `false`.
+* `snapshot_identifier` - (Optional) Specifies whether or not to create this cluster from a snapshot. You can use either the name or ARN when specifying a Neptune cluster snapshot, or the ARN when specifying a Neptune snapshot. Automated snapshots **should not** be used for this attribute, unless from a different cluster. Automated snapshots are deleted as part of cluster destruction when the resource is replaced.
+* `storage_encrypted` - (Optional) Specifies whether the Neptune cluster is encrypted. The default is `false` if not specified.
+* `tags` - (Optional) A map of tags to assign to the Neptune cluster. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `vpc_security_group_ids` - (Optional) List of VPC security groups to associate with the Cluster
+* `deletion_protection` - (Optional) A value that indicates whether the DB cluster has deletion protection enabled.The database can't be deleted when deletion protection is enabled. By default, deletion protection is disabled.
+* `serverless_v2_scaling_configuration` - (Optional) If set, create the Neptune cluster as a serverless one. See [Serverless](#serverless) for example block attributes.
+
+### Serverless
+
+**Neptune serverless has some limitations. Please see the [limitations on the AWS documentation](https://docs.aws.amazon.com/neptune/latest/userguide/neptune-serverless.html#neptune-serverless-limitations) before jumping into Neptune Serverless.**
+
+Neptune serverless requires that the `engine_version` attribute must be `1.2.0.1` or above. Also, you need to provide a cluster parameter group compatible with the family `neptune1.2`. In the example below, the default cluster parameter group is used.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.neptune_cluster import NeptuneCluster
+from imports.aws.neptune_cluster_instance import NeptuneClusterInstance
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = NeptuneCluster(self, "example",
+            apply_immediately=True,
+            cluster_identifier="neptune-cluster-development",
+            engine="neptune",
+            engine_version="1.2.0.1",
+            neptune_cluster_parameter_group_name="default.neptune1.2",
+            serverless_v2_scaling_configuration=NeptuneClusterServerlessV2ScalingConfiguration(),
+            skip_final_snapshot=True
+        )
+        aws_neptune_cluster_instance_example = NeptuneClusterInstance(self, "example_1",
+            cluster_identifier=example.cluster_identifier,
+            instance_class="db.serverless",
+            neptune_parameter_group_name="default.neptune1.2"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_neptune_cluster_instance_example.override_logical_id("example")
+```
+
+* `min_capacity`: (default: **2.5**) The minimum Neptune Capacity Units (NCUs) for this cluster. Must be greater or equal than **1**. See [AWS Documentation](https://docs.aws.amazon.com/neptune/latest/userguide/neptune-serverless-capacity-scaling.html) for more details.
+* `max_capacity`: (default: **128**) The maximum Neptune Capacity Units (NCUs) for this cluster. Must be lower or equal than **128**. See [AWS Documentation](https://docs.aws.amazon.com/neptune/latest/userguide/neptune-serverless-capacity-scaling.html) for more details.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Neptune Cluster Amazon Resource Name (ARN)
+* `cluster_resource_id` - The Neptune Cluster Resource ID
+* `cluster_members` – List of Neptune Instances that are a part of this cluster
+* `endpoint` - The DNS address of the Neptune instance
+* `hosted_zone_id` - The Route53 Hosted Zone ID of the endpoint
+* `id` - The Neptune Cluster Identifier
+* `reader_endpoint` - A read-only endpoint for the Neptune cluster, automatically load-balanced across replicas
+* `status` - The Neptune instance status
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `120m`)
+- `update` - (Default `120m`)
+- `delete` - (Default `120m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_neptune_cluster` using the cluster identifier. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_neptune_cluster` using the cluster identifier. For example:
+
+```console
+% terraform import aws_neptune_cluster.example my-cluster
+```
+
+<!-- cache-key: cdktf-0.18.0 input-b833b76b4e488cf6764ff463cd042f6a681a719ec523ce181193b508df5cc588 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/neptune_cluster_endpoint.html.markdown b/website/docs/cdktf/python/r/neptune_cluster_endpoint.html.markdown
new file mode 100644
index 00000000000..cbb5155468a
--- /dev/null
+++ b/website/docs/cdktf/python/r/neptune_cluster_endpoint.html.markdown
@@ -0,0 +1,75 @@
+---
+subcategory: "Neptune"
+layout: "aws"
+page_title: "AWS: aws_neptune_cluster_endpoint"
+description: |-
+  Provides an Neptune Cluster Endpoint Resource
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_neptune_cluster_endpoint
+
+Provides an Neptune Cluster Endpoint Resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.neptune_cluster_endpoint import NeptuneClusterEndpoint
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        NeptuneClusterEndpoint(self, "example",
+            cluster_endpoint_identifier="example",
+            cluster_identifier=test.cluster_identifier,
+            endpoint_type="READER"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `cluster_identifier` - (Required, Forces new resources) The DB cluster identifier of the DB cluster associated with the endpoint.
+* `cluster_endpoint_identifier` - (Required, Forces new resources) The identifier of the endpoint.
+* `endpoint_type` - (Required) The type of the endpoint. One of: `READER`, `WRITER`, `ANY`.
+* `excluded_members` - (Optional) List of DB instance identifiers that aren't part of the custom endpoint group. All other eligible instances are reachable through the custom endpoint. Only relevant if the list of static members is empty.
+* `static_members` - (Optional) List of DB instance identifiers that are part of the custom endpoint group.
+* `tags` - (Optional) A map of tags to assign to the Neptune cluster. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Neptune Cluster Endpoint Amazon Resource Name (ARN).
+* `endpoint` - The DNS address of the endpoint.
+* `id` - The Neptune Cluster Endpoint Identifier.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_neptune_cluster_endpoint` using the `cluster-identifier:endpoint-identfier`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_neptune_cluster_endpoint` using the `cluster-identifier:endpoint-identfier`. For example:
+
+```console
+% terraform import aws_neptune_cluster_endpoint.example my-cluster:my-endpoint
+```
+
+<!-- cache-key: cdktf-0.18.0 input-fe62dbee474ec48b5d17927f8e8d3998a36b2d1c434288d6e385def0ac966409 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/neptune_cluster_instance.html.markdown b/website/docs/cdktf/python/r/neptune_cluster_instance.html.markdown
new file mode 100644
index 00000000000..2112cfe6474
--- /dev/null
+++ b/website/docs/cdktf/python/r/neptune_cluster_instance.html.markdown
@@ -0,0 +1,125 @@
+---
+subcategory: "Neptune"
+layout: "aws"
+page_title: "AWS: aws_neptune_cluster_instance"
+description: |-
+  Provides an Neptune Cluster Resource Instance
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_neptune_cluster_instance
+
+A Cluster Instance Resource defines attributes that are specific to a single instance in a Neptune Cluster.
+
+You can simply add neptune instances and Neptune manages the replication. You can use the [count][1]
+meta-parameter to make multiple instances and join them all to the same Neptune Cluster, or you may specify different Cluster Instance resources with various `instance_class` sizes.
+
+## Example Usage
+
+The following example will create a neptune cluster with two neptune instances(one writer and one reader).
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformCount, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.neptune_cluster import NeptuneCluster
+from imports.aws.neptune_cluster_instance import NeptuneClusterInstance
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        default_var = NeptuneCluster(self, "default",
+            apply_immediately=True,
+            backup_retention_period=5,
+            cluster_identifier="neptune-cluster-demo",
+            engine="neptune",
+            iam_database_authentication_enabled=True,
+            preferred_backup_window="07:00-09:00",
+            skip_final_snapshot=True
+        )
+        # In most cases loops should be handled in the programming language context and
+        #     not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+        #     you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+        #     you need to keep this like it is.
+        example_count = TerraformCount.of(Token.as_number("2"))
+        NeptuneClusterInstance(self, "example",
+            apply_immediately=True,
+            cluster_identifier=default_var.id,
+            engine="neptune",
+            instance_class="db.r4.large",
+            count=example_count
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `apply_immediately` - (Optional) Specifies whether any instance modifications
+  are applied immediately, or during the next maintenance window. Default is`false`.
+* `auto_minor_version_upgrade` - (Optional) Indicates that minor engine upgrades will be applied automatically to the instance during the maintenance window. Default is `true`.
+* `availability_zone` - (Optional) The EC2 Availability Zone that the neptune instance is created in.
+* `cluster_identifier` - (Required) The identifier of the [`aws_neptune_cluster`](/docs/providers/aws/r/neptune_cluster.html) in which to launch this instance.
+* `engine` - (Optional) The name of the database engine to be used for the neptune instance. Defaults to `neptune`. Valid Values: `neptune`.
+* `engine_version` - (Optional) The neptune engine version. Currently configuring this argumnet has no effect.
+* `identifier` - (Optional, Forces new resource) The identifier for the neptune instance, if omitted, Terraform will assign a random, unique identifier.
+* `identifier_prefix` - (Optional, Forces new resource) Creates a unique identifier beginning with the specified prefix. Conflicts with `identifier`.
+* `instance_class` - (Required) The instance class to use.
+* `neptune_subnet_group_name` - (Required if `publicly_accessible = false`, Optional otherwise) A subnet group to associate with this neptune instance. **NOTE:** This must match the `neptune_subnet_group_name` of the attached [`aws_neptune_cluster`](/docs/providers/aws/r/neptune_cluster.html).
+* `neptune_parameter_group_name` - (Optional) The name of the neptune parameter group to associate with this instance.
+* `port` - (Optional) The port on which the DB accepts connections. Defaults to `8182`.
+* `preferred_backup_window` - (Optional) The daily time range during which automated backups are created if automated backups are enabled. Eg: "04:00-09:00"
+* `preferred_maintenance_window` - (Optional) The window to perform maintenance in.
+  Syntax: "ddd:hh24:mi-ddd:hh24:mi". Eg: "Mon:00:00-Mon:03:00".
+* `promotion_tier` - (Optional) Default 0. Failover Priority setting on instance level. The reader who has lower tier has higher priority to get promoter to writer.
+* `publicly_accessible` - (Optional) Bool to control if instance is publicly accessible. Default is `false`.
+* `tags` - (Optional) A map of tags to assign to the instance. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `address` - The hostname of the instance. See also `endpoint` and `port`.
+* `arn` - Amazon Resource Name (ARN) of neptune instance
+* `dbi_resource_id` - The region-unique, immutable identifier for the neptune instance.
+* `endpoint` - The connection endpoint in `address:port` format.
+* `id` - The Instance identifier
+* `kms_key_arn` - The ARN for the KMS encryption key if one is set to the neptune cluster.
+* `storage_encrypted` - Specifies whether the neptune cluster is encrypted.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `writer` – Boolean indicating if this instance is writable. `False` indicates this instance is a read replica.
+
+[1]: https://www.terraform.io/docs/configuration/meta-arguments/count.html
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `90m`)
+- `update` - (Default `90m`)
+- `delete` - (Default `90m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_neptune_cluster_instance` using the instance identifier. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_neptune_cluster_instance` using the instance identifier. For example:
+
+```console
+% terraform import aws_neptune_cluster_instance.example my-instance
+```
+
+<!-- cache-key: cdktf-0.18.0 input-c9fbfba9a3319bef7009738e3db57be0a358b60956afc9ca57b4650ac05f9ef1 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/neptune_cluster_parameter_group.html.markdown b/website/docs/cdktf/python/r/neptune_cluster_parameter_group.html.markdown
new file mode 100644
index 00000000000..07cf5406c88
--- /dev/null
+++ b/website/docs/cdktf/python/r/neptune_cluster_parameter_group.html.markdown
@@ -0,0 +1,85 @@
+---
+subcategory: "Neptune"
+layout: "aws"
+page_title: "AWS: aws_neptune_cluster_parameter_group"
+description: |-
+  Manages a Neptune Cluster Parameter Group
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_neptune_cluster_parameter_group
+
+Manages a Neptune Cluster Parameter Group
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.neptune_cluster_parameter_group import NeptuneClusterParameterGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        NeptuneClusterParameterGroup(self, "example",
+            description="neptune cluster parameter group",
+            family="neptune1",
+            name="example",
+            parameter=[NeptuneClusterParameterGroupParameter(
+                name="neptune_enable_audit_log",
+                value=Token.as_string(1)
+            )
+            ]
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Optional, Forces new resource) The name of the neptune cluster parameter group. If omitted, Terraform will assign a random, unique name.
+* `name_prefix` - (Optional, Forces new resource) Creates a unique name beginning with the specified prefix. Conflicts with `name`.
+* `family` - (Required) The family of the neptune cluster parameter group.
+* `description` - (Optional) The description of the neptune cluster parameter group. Defaults to "Managed by Terraform".
+* `parameter` - (Optional) A list of neptune parameters to apply.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+Parameter blocks support the following:
+
+* `name` - (Required) The name of the neptune parameter.
+* `value` - (Required) The value of the neptune parameter.
+* `apply_method` - (Optional) Valid values are `immediate` and `pending-reboot`. Defaults to `pending-reboot`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The neptune cluster parameter group name.
+* `arn` - The ARN of the neptune cluster parameter group.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Neptune Cluster Parameter Groups using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Neptune Cluster Parameter Groups using the `name`. For example:
+
+```console
+% terraform import aws_neptune_cluster_parameter_group.cluster_pg production-pg-1
+```
+
+<!-- cache-key: cdktf-0.18.0 input-3c39999f95e5475d491571cada3c79f247de16c4aa849b9cba8ecd969f7df95d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/neptune_cluster_snapshot.html.markdown b/website/docs/cdktf/python/r/neptune_cluster_snapshot.html.markdown
new file mode 100644
index 00000000000..89ab4e499d8
--- /dev/null
+++ b/website/docs/cdktf/python/r/neptune_cluster_snapshot.html.markdown
@@ -0,0 +1,84 @@
+---
+subcategory: "Neptune"
+layout: "aws"
+page_title: "AWS: aws_neptune_cluster_snapshot"
+description: |-
+  Manages a Neptune database cluster snapshot.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_neptune_cluster_snapshot
+
+Manages a Neptune database cluster snapshot.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.neptune_cluster_snapshot import NeptuneClusterSnapshot
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        NeptuneClusterSnapshot(self, "example",
+            db_cluster_identifier=Token.as_string(aws_neptune_cluster_example.id),
+            db_cluster_snapshot_identifier="resourcetestsnapshot1234"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `db_cluster_identifier` - (Required) The DB Cluster Identifier from which to take the snapshot.
+* `db_cluster_snapshot_identifier` - (Required) The Identifier for the snapshot.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `allocated_storage` - Specifies the allocated storage size in gigabytes (GB).
+* `availability_zones` - List of EC2 Availability Zones that instances in the DB cluster snapshot can be restored in.
+* `db_cluster_snapshot_arn` - The Amazon Resource Name (ARN) for the DB Cluster Snapshot.
+* `engine` - Specifies the name of the database engine.
+* `engine_version` - Version of the database engine for this DB cluster snapshot.
+* `kms_key_id` - If storage_encrypted is true, the AWS KMS key identifier for the encrypted DB cluster snapshot.
+* `license_model` - License model information for the restored DB cluster.
+* `port` - Port that the DB cluster was listening on at the time of the snapshot.
+* `source_db_cluster_snapshot_identifier` - The DB Cluster Snapshot Arn that the DB Cluster Snapshot was copied from. It only has value in case of cross customer or cross region copy.
+* `storage_encrypted` - Specifies whether the DB cluster snapshot is encrypted.
+* `status` - The status of this DB Cluster Snapshot.
+* `vpc_id` - The VPC ID associated with the DB cluster snapshot.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `20m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_neptune_cluster_snapshot` using the cluster snapshot identifier. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_neptune_cluster_snapshot` using the cluster snapshot identifier. For example:
+
+```console
+% terraform import aws_neptune_cluster_snapshot.example my-cluster-snapshot
+```
+
+<!-- cache-key: cdktf-0.18.0 input-9b22118c6b5ba9d2b522df8534493a26e09fc274f5e840772d7cfddb43741365 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/neptune_event_subscription.html.markdown b/website/docs/cdktf/python/r/neptune_event_subscription.html.markdown
new file mode 100644
index 00000000000..54892e33c5e
--- /dev/null
+++ b/website/docs/cdktf/python/r/neptune_event_subscription.html.markdown
@@ -0,0 +1,114 @@
+---
+subcategory: "Neptune"
+layout: "aws"
+page_title: "AWS: aws_neptune_event_subscription"
+description: |-
+  Provides a Neptune event subscription resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_neptune_event_subscription
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.neptune_cluster import NeptuneCluster
+from imports.aws.neptune_cluster_instance import NeptuneClusterInstance
+from imports.aws.neptune_event_subscription import NeptuneEventSubscription
+from imports.aws.sns_topic import SnsTopic
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        default_var = NeptuneCluster(self, "default",
+            apply_immediately=Token.as_boolean("true"),
+            backup_retention_period=5,
+            cluster_identifier="neptune-cluster-demo",
+            engine="neptune",
+            iam_database_authentication_enabled=Token.as_boolean("true"),
+            preferred_backup_window="07:00-09:00",
+            skip_final_snapshot=True
+        )
+        example = NeptuneClusterInstance(self, "example",
+            apply_immediately=Token.as_boolean("true"),
+            cluster_identifier=default_var.id,
+            engine="neptune",
+            instance_class="db.r4.large"
+        )
+        aws_sns_topic_default = SnsTopic(self, "default_2",
+            name="neptune-events"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_sns_topic_default.override_logical_id("default")
+        aws_neptune_event_subscription_default = NeptuneEventSubscription(self, "default_3",
+            event_categories=["maintenance", "availability", "creation", "backup", "restoration", "recovery", "deletion", "failover", "failure", "notification", "configuration change", "read replica"
+            ],
+            name="neptune-event-sub",
+            sns_topic_arn=Token.as_string(aws_sns_topic_default.arn),
+            source_ids=[example.id],
+            source_type="db-instance",
+            tags={
+                "env": "test"
+            }
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_neptune_event_subscription_default.override_logical_id("default")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `enabled` - (Optional) A boolean flag to enable/disable the subscription. Defaults to true.
+* `event_categories` - (Optional) A list of event categories for a `source_type` that you want to subscribe to. Run `aws neptune describe-event-categories` to find all the event categories.
+* `name` - (Optional) The name of the Neptune event subscription. By default generated by Terraform.
+* `name_prefix` - (Optional) The name of the Neptune event subscription. Conflicts with `name`.
+* `sns_topic_arn` - (Required) The ARN of the SNS topic to send events to.
+* `source_ids` - (Optional) A list of identifiers of the event sources for which events will be returned. If not specified, then all sources are included in the response. If specified, a `source_type` must also be specified.
+* `source_type` - (Optional) The type of source that will be generating the events. Valid options are `db-instance`, `db-security-group`, `db-parameter-group`, `db-snapshot`, `db-cluster` or `db-cluster-snapshot`. If not set, all sources will be subscribed to.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name of the Neptune event notification subscription.
+* `arn` - The Amazon Resource Name of the Neptune event notification subscription.
+* `customer_aws_id` - The AWS customer account associated with the Neptune event notification subscription.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `40m`)
+- `delete` - (Default `40m`)
+- `update` - (Default `40m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_neptune_event_subscription` using the event subscription name. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_neptune_event_subscription` using the event subscription name. For example:
+
+```console
+% terraform import aws_neptune_event_subscription.example my-event-subscription
+```
+
+<!-- cache-key: cdktf-0.18.0 input-e328d5c2f0ddd8aeab59e5a796150d1bafdd5b04018dd038f0bce4cd0cb07a04 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/neptune_global_cluster.html.markdown b/website/docs/cdktf/python/r/neptune_global_cluster.html.markdown
new file mode 100644
index 00000000000..f0365d7cf9c
--- /dev/null
+++ b/website/docs/cdktf/python/r/neptune_global_cluster.html.markdown
@@ -0,0 +1,192 @@
+---
+subcategory: "Neptune"
+layout: "aws"
+page_title: "AWS: aws_neptune_global_cluster"
+description: |-
+  Provides an Neptune Global Cluster Resource
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_neptune_global_cluster
+
+Manages a Neptune Global Cluster. A global cluster consists of one primary region and up to five read-only secondary regions. You issue write operations directly to the primary cluster in the primary region and Amazon Neptune automatically replicates the data to the secondary regions using dedicated infrastructure.
+
+More information about Neptune Global Clusters can be found in the [Neptune User Guide](https://docs.aws.amazon.com/neptune/latest/userguide/neptune-global-database.html).
+
+## Example Usage
+
+### New Neptune Global Cluster
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.neptune_cluster import NeptuneCluster
+from imports.aws.neptune_cluster_instance import NeptuneClusterInstance
+from imports.aws.neptune_global_cluster import NeptuneGlobalCluster
+from imports.aws.provider import AwsProvider
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        primary = AwsProvider(self, "aws",
+            alias="primary",
+            region="us-east-2"
+        )
+        secondary = AwsProvider(self, "aws_1",
+            alias="secondary",
+            region="us-east-1"
+        )
+        example = NeptuneGlobalCluster(self, "example",
+            engine="neptune",
+            engine_version="1.2.0.0",
+            global_cluster_identifier="global-test"
+        )
+        aws_neptune_cluster_primary = NeptuneCluster(self, "primary",
+            cluster_identifier="test-primary-cluster",
+            engine=example.engine,
+            engine_version=example.engine_version,
+            global_cluster_identifier=example.id,
+            neptune_subnet_group_name="default",
+            provider=primary
+        )
+        aws_neptune_cluster_secondary = NeptuneCluster(self, "secondary",
+            cluster_identifier="test-secondary-cluster",
+            engine=example.engine,
+            engine_version=example.engine_version,
+            global_cluster_identifier=example.id,
+            neptune_subnet_group_name="default",
+            provider=secondary
+        )
+        aws_neptune_cluster_instance_primary = NeptuneClusterInstance(self, "primary_5",
+            cluster_identifier=Token.as_string(aws_neptune_cluster_primary.id),
+            engine=example.engine,
+            engine_version=example.engine_version,
+            identifier="test-primary-cluster-instance",
+            instance_class="db.r5.large",
+            neptune_subnet_group_name="default",
+            provider=primary
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_neptune_cluster_instance_primary.override_logical_id("primary")
+        aws_neptune_cluster_instance_secondary = NeptuneClusterInstance(self, "secondary_6",
+            cluster_identifier=Token.as_string(aws_neptune_cluster_secondary.id),
+            depends_on=[aws_neptune_cluster_instance_primary],
+            engine=example.engine,
+            engine_version=example.engine_version,
+            identifier="test-secondary-cluster-instance",
+            instance_class="db.r5.large",
+            neptune_subnet_group_name="default",
+            provider=secondary
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_neptune_cluster_instance_secondary.override_logical_id("secondary")
+```
+
+### New Global Cluster From Existing DB Cluster
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from cdktf import TerraformResourceLifecycle
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.neptune_cluster import NeptuneCluster
+from imports.aws.neptune_global_cluster import NeptuneGlobalCluster
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = NeptuneCluster(self, "example",
+            lifecycle=TerraformResourceLifecycle(
+                ignore_changes=[global_cluster_identifier]
+            )
+        )
+        aws_neptune_global_cluster_example = NeptuneGlobalCluster(self, "example_1",
+            global_cluster_identifier="example",
+            source_db_cluster_identifier=example.arn
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_neptune_global_cluster_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `global_cluster_identifier` - (Required, Forces new resources) The global cluster identifier.
+* `deletion_protection` - (Optional) If the Global Cluster should have deletion protection enabled. The database can't be deleted when this value is set to `true`. The default is `false`.
+* `engine` - (Optional, Forces new resources) Name of the database engine to be used for this DB cluster. Terraform will only perform drift detection if a configuration value is provided. Current Valid values: `neptune`. Conflicts with `source_db_cluster_identifier`.
+* `engine_version` - (Optional) Engine version of the global database. Upgrading the engine version will result in all cluster members being immediately updated and will.
+    * **NOTE:** Upgrading major versions is not supported.
+* `source_db_cluster_identifier` - (Optional) Amazon Resource Name (ARN) to use as the primary DB Cluster of the Global Cluster on creation. Terraform cannot perform drift detection of this value.
+* `storage_encrypted` - (Optional, Forces new resources) Specifies whether the DB cluster is encrypted. The default is `false` unless `source_db_cluster_identifier` is specified and encrypted. Terraform will only perform drift detection if a configuration value is provided.
+
+### Timeouts
+
+The `timeouts` block allows you to specify [timeouts](https://www.terraform.io/docs/configuration/blocks/resources/syntax.html#operation-timeouts) for certain actions:
+
+* `create` - (Defaults to 5 mins) Used when creating the Global Cluster
+* `update` - (Defaults to 120 mins) Used when updating the Global Cluster members (time is per member)
+* `delete` - (Defaults to 5 mins) Used when deleting the Global Cluster members (time is per member)
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Global Cluster Amazon Resource Name (ARN)
+* `global_cluster_members` - Set of objects containing Global Cluster members.
+    * `db_cluster_arn` - Amazon Resource Name (ARN) of member DB Cluster.
+    * `is_writer` - Whether the member is the primary DB Cluster.
+* `global_cluster_resource_id` - AWS Region-unique, immutable identifier for the global database cluster. This identifier is found in AWS CloudTrail log entries whenever the AWS KMS key for the DB cluster is accessed.
+* `id` - Neptune Global Cluster.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_neptune_global_cluster` using the Global Cluster identifier. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_neptune_global_cluster` using the Global Cluster identifier. For example:
+
+```console
+% terraform import aws_neptune_global_cluster.example example
+```
+
+Certain resource arguments, like `source_db_cluster_identifier`, do not have an API method for reading the information after creation. If the argument is set in the Terraform configuration on an imported resource, Terraform will always show a difference. To workaround this behavior, either omit the argument from the Terraform configuration or use [`ignore_changes`](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html#ignore_changes) to hide the difference. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from cdktf import TerraformResourceLifecycle
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.neptune_global_cluster import NeptuneGlobalCluster
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, globalClusterIdentifier):
+        super().__init__(scope, name)
+        NeptuneGlobalCluster(self, "example",
+            lifecycle=TerraformResourceLifecycle(
+                ignore_changes=[source_db_cluster_identifier]
+            ),
+            global_cluster_identifier=global_cluster_identifier
+        )
+```
+
+<!-- cache-key: cdktf-0.18.0 input-8950ed9539f8cfa73cf920a0d999502a62c1a0cc78e2fc0e44cf362c351b01bc -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/neptune_parameter_group.html.markdown b/website/docs/cdktf/python/r/neptune_parameter_group.html.markdown
new file mode 100644
index 00000000000..a2493cc510d
--- /dev/null
+++ b/website/docs/cdktf/python/r/neptune_parameter_group.html.markdown
@@ -0,0 +1,83 @@
+---
+subcategory: "Neptune"
+layout: "aws"
+page_title: "AWS: aws_neptune_parameter_group"
+description: |-
+  Manages a Neptune Parameter Group
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_neptune_parameter_group
+
+Manages a Neptune Parameter Group
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.neptune_parameter_group import NeptuneParameterGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        NeptuneParameterGroup(self, "example",
+            family="neptune1",
+            name="example",
+            parameter=[NeptuneParameterGroupParameter(
+                name="neptune_query_timeout",
+                value="25"
+            )
+            ]
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required, Forces new resource) The name of the Neptune parameter group.
+* `family` - (Required) The family of the Neptune parameter group.
+* `description` - (Optional) The description of the Neptune parameter group. Defaults to "Managed by Terraform".
+* `parameter` - (Optional) A list of Neptune parameters to apply.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+Parameter blocks support the following:
+
+* `name`  - (Required) The name of the Neptune parameter.
+* `value` - (Required) The value of the Neptune parameter.
+* `apply_method` - (Optional) The apply method of the Neptune parameter. Valid values are `immediate` and `pending-reboot`. Defaults to `pending-reboot`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Neptune parameter group name.
+* `arn` - The Neptune parameter group Amazon Resource Name (ARN).
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Neptune Parameter Groups using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Neptune Parameter Groups using the `name`. For example:
+
+```console
+% terraform import aws_neptune_parameter_group.some_pg some-pg
+```
+
+<!-- cache-key: cdktf-0.18.0 input-a1cb01e0292301b60c4b212670b59774de132158f48ab1dd04de5f6d3fa58b10 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/neptune_subnet_group.html.markdown b/website/docs/cdktf/python/r/neptune_subnet_group.html.markdown
new file mode 100644
index 00000000000..d52a00879d3
--- /dev/null
+++ b/website/docs/cdktf/python/r/neptune_subnet_group.html.markdown
@@ -0,0 +1,75 @@
+---
+subcategory: "Neptune"
+layout: "aws"
+page_title: "AWS: aws_neptune_subnet_group"
+description: |-
+  Provides an Neptune subnet group resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_neptune_subnet_group
+
+Provides an Neptune subnet group resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.neptune_subnet_group import NeptuneSubnetGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        NeptuneSubnetGroup(self, "default",
+            name="main",
+            subnet_ids=[frontend.id, backend.id],
+            tags={
+                "Name": "My neptune subnet group"
+            }
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Optional, Forces new resource) The name of the neptune subnet group. If omitted, Terraform will assign a random, unique name.
+* `name_prefix` - (Optional, Forces new resource) Creates a unique name beginning with the specified prefix. Conflicts with `name`.
+* `description` - (Optional) The description of the neptune subnet group. Defaults to "Managed by Terraform".
+* `subnet_ids` - (Required) A list of VPC subnet IDs.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The neptune subnet group name.
+* `arn` - The ARN of the neptune subnet group.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Neptune Subnet groups using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Neptune Subnet groups using the `name`. For example:
+
+```console
+% terraform import aws_neptune_subnet_group.default production-subnet-group
+```
+
+<!-- cache-key: cdktf-0.18.0 input-53e6d83abbeef75d682c8e96e0c61b5253d9fcdeb05d7a8efb0eea6a96d2b5d2 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/network_acl.html.markdown b/website/docs/cdktf/python/r/network_acl.html.markdown
new file mode 100644
index 00000000000..60a3168db99
--- /dev/null
+++ b/website/docs/cdktf/python/r/network_acl.html.markdown
@@ -0,0 +1,126 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_network_acl"
+description: |-
+  Provides an network ACL resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_network_acl
+
+Provides an network ACL resource. You might set up network ACLs with rules similar
+to your security groups in order to add an additional layer of security to your VPC.
+
+~> **NOTE on Network ACLs and Network ACL Rules:** Terraform currently
+provides both a standalone [Network ACL Rule](network_acl_rule.html) resource and a Network ACL resource with rules
+defined in-line. At this time you cannot use a Network ACL with in-line rules
+in conjunction with any Network ACL Rule resources. Doing so will cause
+a conflict of rule settings and will overwrite rules.
+
+~> **NOTE on Network ACLs and Network ACL Associations:** Terraform provides both a standalone [network ACL association](network_acl_association.html)
+resource and a network ACL resource with a `subnet_ids` attribute. Do not use the same subnet ID in both a network ACL
+resource and a network ACL association resource. Doing so will cause a conflict of associations and will overwrite the association.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.network_acl import NetworkAcl
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        NetworkAcl(self, "main",
+            egress=[NetworkAclEgress(
+                action="allow",
+                cidr_block="10.3.0.0/18",
+                from_port=443,
+                protocol="tcp",
+                rule_no=200,
+                to_port=443
+            )
+            ],
+            ingress=[NetworkAclIngress(
+                action="allow",
+                cidr_block="10.3.0.0/18",
+                from_port=80,
+                protocol="tcp",
+                rule_no=100,
+                to_port=80
+            )
+            ],
+            tags={
+                "Name": "main"
+            },
+            vpc_id=Token.as_string(aws_vpc_main.id)
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `vpc_id` - (Required) The ID of the associated VPC.
+* `subnet_ids` - (Optional) A list of Subnet IDs to apply the ACL to
+* `ingress` - (Optional) Specifies an ingress rule. Parameters defined below.
+  This argument is processed in [attribute-as-blocks mode](https://www.terraform.io/docs/configuration/attr-as-blocks.html).
+* `egress` - (Optional) Specifies an egress rule. Parameters defined below.
+  This argument is processed in [attribute-as-blocks mode](https://www.terraform.io/docs/configuration/attr-as-blocks.html).
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### egress and ingress
+
+Both arguments are processed in [attribute-as-blocks mode](https://www.terraform.io/docs/configuration/attr-as-blocks.html).
+
+Both `egress` and `ingress` support the following keys:
+
+* `from_port` - (Required) The from port to match.
+* `to_port` - (Required) The to port to match.
+* `rule_no` - (Required) The rule number. Used for ordering.
+* `action` - (Required) The action to take.
+* `protocol` - (Required) The protocol to match. If using the -1 'all'
+protocol, you must specify a from and to port of 0.
+* `cidr_block` - (Optional) The CIDR block to match. This must be a
+valid network mask.
+* `ipv6_cidr_block` - (Optional) The IPv6 CIDR block.
+* `icmp_type` - (Optional) The ICMP type to be used. Default 0.
+* `icmp_code` - (Optional) The ICMP type code to be used. Default 0.
+
+~> Note: For more information on ICMP types and codes, see here: https://www.iana.org/assignments/icmp-parameters/icmp-parameters.xhtml
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the network ACL
+* `arn` - The ARN of the network ACL
+* `owner_id` - The ID of the AWS account that owns the network ACL.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Network ACLs using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Network ACLs using the `id`. For example:
+
+```console
+% terraform import aws_network_acl.main acl-7aaabd18
+```
+
+<!-- cache-key: cdktf-0.18.0 input-5b9f089b5a06ae7544fcc277d74d9e0edb7b4bb28c855db30503815cfb46f3a1 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/network_acl_association.html.markdown b/website/docs/cdktf/python/r/network_acl_association.html.markdown
new file mode 100644
index 00000000000..79b34e14b17
--- /dev/null
+++ b/website/docs/cdktf/python/r/network_acl_association.html.markdown
@@ -0,0 +1,52 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_network_acl_association"
+description: |-
+  Provides an network ACL association resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_network_acl_association
+
+Provides an network ACL association resource which allows you to associate your network ACL with any subnet(s).
+
+~> **NOTE on Network ACLs and Network ACL Associations:** Terraform provides both a standalone network ACL association resource
+and a [network ACL](network_acl.html) resource with a `subnet_ids` attribute. Do not use the same subnet ID in both a network ACL
+resource and a network ACL association resource. Doing so will cause a conflict of associations and will overwrite the association.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.network_acl_association import NetworkAclAssociation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        NetworkAclAssociation(self, "main",
+            network_acl_id=Token.as_string(aws_network_acl_main.id),
+            subnet_id=Token.as_string(aws_subnet_main.id)
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `network_acl_id` - (Required) The ID of the network ACL.
+* `subnet_id` - (Required) The ID of the associated Subnet.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the network ACL association
+
+<!-- cache-key: cdktf-0.18.0 input-92947d863f3641bf06816a6812d14a2026718b19daf92b58b0b433978e506cb9 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/network_acl_rule.html.markdown b/website/docs/cdktf/python/r/network_acl_rule.html.markdown
new file mode 100644
index 00000000000..e1f28839526
--- /dev/null
+++ b/website/docs/cdktf/python/r/network_acl_rule.html.markdown
@@ -0,0 +1,125 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_network_acl_rule"
+description: |-
+  Provides an network ACL Rule resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_network_acl_rule
+
+Creates an entry (a rule) in a network ACL with the specified rule number.
+
+~> **NOTE on Network ACLs and Network ACL Rules:** Terraform currently
+provides both a standalone Network ACL Rule resource and a [Network ACL](network_acl.html) resource with rules
+defined in-line. At this time you cannot use a Network ACL with in-line rules
+in conjunction with any Network ACL Rule resources. Doing so will cause
+a conflict of rule settings and will overwrite rules.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.network_acl import NetworkAcl
+from imports.aws.network_acl_rule import NetworkAclRule
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        bar = NetworkAcl(self, "bar",
+            vpc_id=foo.id
+        )
+        aws_network_acl_rule_bar = NetworkAclRule(self, "bar_1",
+            cidr_block=foo.cidr_block,
+            egress=False,
+            from_port=22,
+            network_acl_id=bar.id,
+            protocol="tcp",
+            rule_action="allow",
+            rule_number=200,
+            to_port=22
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_network_acl_rule_bar.override_logical_id("bar")
+```
+
+~> **Note:** One of either `cidr_block` or `ipv6_cidr_block` is required.
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `network_acl_id` - (Required) The ID of the network ACL.
+* `rule_number` - (Required) The rule number for the entry (for example, 100). ACL entries are processed in ascending order by rule number.
+* `egress` - (Optional, bool) Indicates whether this is an egress rule (rule is applied to traffic leaving the subnet). Default `false`.
+* `protocol` - (Required) The protocol. A value of -1 means all protocols.
+* `rule_action` - (Required) Indicates whether to allow or deny the traffic that matches the rule. Accepted values: `allow` | `deny`
+* `cidr_block` - (Optional) The network range to allow or deny, in CIDR notation (for example 172.16.0.0/24 ).
+* `ipv6_cidr_block` - (Optional) The IPv6 CIDR block to allow or deny.
+* `from_port` - (Optional) The from port to match.
+* `to_port` - (Optional) The to port to match.
+* `icmp_type` - (Optional) ICMP protocol: The ICMP type. Required if specifying ICMP for the protocolE.g., -1
+* `icmp_code` - (Optional) ICMP protocol: The ICMP code. Required if specifying ICMP for the protocolE.g., -1
+
+~> **NOTE:** If the value of `protocol` is `-1` or `all`, the `from_port` and `to_port` values will be ignored and the rule will apply to all ports.
+
+~> **NOTE:** If the value of `icmp_type` is `-1` (which results in a wildcard ICMP type), the `icmp_code` must also be set to `-1` (wildcard ICMP code).
+
+~> Note: For more information on ICMP types and codes, see here: https://www.iana.org/assignments/icmp-parameters/icmp-parameters.xhtml
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the network ACL Rule
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import individual rules using `NETWORK_ACL_ID:RULE_NUMBER:PROTOCOL:EGRESS`, where `PROTOCOL` can be a decimal (such as "6") or string (such as "tcp") value. For example:
+
+**NOTE:** If importing a rule previously provisioned by Terraform, the `PROTOCOL` must be the input value used at creation time. For more information on protocol numbers and keywords, see here: https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml.
+
+Using the procotol's string value:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using the procotol's decimal value:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+**Using `terraform import` to import** individual rules using `NETWORK_ACL_ID:RULE_NUMBER:PROTOCOL:EGRESS`, where `PROTOCOL` can be a decimal (such as "6") or string (such as "tcp") value. For example:
+
+Using the procotol's string value:
+
+```console
+% terraform import aws_network_acl_rule.my_rule acl-7aaabd18:100:tcp:false
+```
+
+Using the procotol's decimal value:
+
+```console
+% terraform import aws_network_acl_rule.my_rule acl-7aaabd18:100:6:false
+```
+
+<!-- cache-key: cdktf-0.18.0 input-0bee1d657a21ade598a9d4b01c7ed38ce1ada8aeab9c5dd0de56c1ba6dff131d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/network_interface.html.markdown b/website/docs/cdktf/python/r/network_interface.html.markdown
new file mode 100644
index 00000000000..fccda7c8d2e
--- /dev/null
+++ b/website/docs/cdktf/python/r/network_interface.html.markdown
@@ -0,0 +1,122 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_network_interface"
+description: |-
+  Provides an Elastic network interface (ENI) resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_network_interface
+
+Provides an Elastic network interface (ENI) resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.network_interface import NetworkInterface
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        NetworkInterface(self, "test",
+            attachment=[NetworkInterfaceAttachment(
+                device_index=1,
+                instance=Token.as_string(aws_instance_test.id)
+            )
+            ],
+            private_ips=["10.0.0.50"],
+            security_groups=[web.id],
+            subnet_id=public_a.id
+        )
+```
+
+### Example of Managing Multiple IPs on a Network Interface
+
+By default, private IPs are managed through the `private_ips` and `private_ips_count` arguments which manage IPs as a set of IPs that are configured without regard to order. For a new network interface, the same primary IP address is consistently selected from a given set of addresses, regardless of the order provided. However, modifications of the set of addresses of an existing interface will not alter the current primary IP address unless it has been removed from the set.
+
+In order to manage the private IPs as a sequentially ordered list, configure `private_ip_list_enabled` to `true` and use `private_ip_list` to manage the IPs. This will disable the `private_ips` and `private_ips_count` settings, which must be removed from the config file but are still exported. Note that changing the first address of `private_ip_list`, which is the primary, always requires a new interface.
+
+If you are managing a specific set or list of IPs, instead of just using `private_ips_count`, this is a potential workflow for also leveraging `private_ips_count` to have AWS automatically assign additional IP addresses:
+
+1. Comment out `private_ips`, `private_ip_list`, `private_ip_list_enabled` in your configuration
+2. Set the desired `private_ips_count` (count of the number of secondaries, the primary is not included)
+3. Apply to assign the extra IPs
+4. Remove `private_ips_count` and restore your settings from the first step
+5. Add the new IPs to your current settings
+6. Apply again to update the stored state
+
+This process can also be used to remove IP addresses in addition to the option of manually removing them. Adding IP addresses in a manually is more difficult because it requires knowledge of which addresses are available.
+
+## Argument Reference
+
+The following arguments are required:
+
+* `subnet_id` - (Required) Subnet ID to create the ENI in.
+
+The following arguments are optional:
+
+* `attachment` - (Optional) Configuration block to define the attachment of the ENI. See [Attachment](#attachment) below for more details!
+* `description` - (Optional) Description for the network interface.
+* `interface_type` - (Optional) Type of network interface to create. Set to `efa` for Elastic Fabric Adapter. Changing `interface_type` will cause the resource to be destroyed and re-created.
+* `ipv4_prefix_count` - (Optional) Number of IPv4 prefixes that AWS automatically assigns to the network interface.
+* `ipv4_prefixes` - (Optional) One or more IPv4 prefixes assigned to the network interface.
+* `ipv6_address_count` - (Optional) Number of IPv6 addresses to assign to a network interface. You can't use this option if specifying specific `ipv6_addresses`. If your subnet has the AssignIpv6AddressOnCreation attribute set to `true`, you can specify `0` to override this setting.
+* `ipv6_address_list_enabled` - (Optional) Whether `ipv6_address_list` is allowed and controls the IPs to assign to the ENI and `ipv6_addresses` and `ipv6_address_count` become read-only. Default false.
+* `ipv6_address_list` - (Optional) List of private IPs to assign to the ENI in sequential order.
+* `ipv6_addresses` - (Optional) One or more specific IPv6 addresses from the IPv6 CIDR block range of your subnet. Addresses are assigned without regard to order. You can't use this option if you're specifying `ipv6_address_count`.
+* `ipv6_prefix_count` - (Optional) Number of IPv6 prefixes that AWS automatically assigns to the network interface.
+* `ipv6_prefixes` - (Optional) One or more IPv6 prefixes assigned to the network interface.
+* `private_ip_list` - (Optional) List of private IPs to assign to the ENI in sequential order. Requires setting `private_ip_list_enabled` to `true`.
+* `private_ip_list_enabled` - (Optional) Whether `private_ip_list` is allowed and controls the IPs to assign to the ENI and `private_ips` and `private_ips_count` become read-only. Default false.
+* `private_ips` - (Optional) List of private IPs to assign to the ENI without regard to order.
+* `private_ips_count` - (Optional) Number of secondary private IPs to assign to the ENI. The total number of private IPs will be 1 + `private_ips_count`, as a primary private IP will be assiged to an ENI by default.
+* `security_groups` - (Optional) List of security group IDs to assign to the ENI.
+* `source_dest_check` - (Optional) Whether to enable source destination checking for the ENI. Default true.
+* `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Attachment
+
+The `attachment` block supports the following:
+
+* `instance` - (Required) ID of the instance to attach to.
+* `device_index` - (Required) Integer to define the devices index.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the network interface.
+* `id` - ID of the network interface.
+* `mac_address` - MAC address of the network interface.
+* `owner_id` - AWS account ID of the owner of the network interface.
+* `private_dns_name` - Private DNS name of the network interface (IPv4).
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Network Interfaces using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Network Interfaces using the `id`. For example:
+
+```console
+% terraform import aws_network_interface.test eni-e5aa89a3
+```
+
+<!-- cache-key: cdktf-0.18.0 input-7f2ff19c4ccb49477839bee2fe3fa02741d97eacf5edb9c2e7ff7560c3a15031 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/network_interface.markdown b/website/docs/cdktf/python/r/network_interface.markdown
new file mode 100644
index 00000000000..fccda7c8d2e
--- /dev/null
+++ b/website/docs/cdktf/python/r/network_interface.markdown
@@ -0,0 +1,122 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_network_interface"
+description: |-
+  Provides an Elastic network interface (ENI) resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_network_interface
+
+Provides an Elastic network interface (ENI) resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.network_interface import NetworkInterface
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        NetworkInterface(self, "test",
+            attachment=[NetworkInterfaceAttachment(
+                device_index=1,
+                instance=Token.as_string(aws_instance_test.id)
+            )
+            ],
+            private_ips=["10.0.0.50"],
+            security_groups=[web.id],
+            subnet_id=public_a.id
+        )
+```
+
+### Example of Managing Multiple IPs on a Network Interface
+
+By default, private IPs are managed through the `private_ips` and `private_ips_count` arguments which manage IPs as a set of IPs that are configured without regard to order. For a new network interface, the same primary IP address is consistently selected from a given set of addresses, regardless of the order provided. However, modifications of the set of addresses of an existing interface will not alter the current primary IP address unless it has been removed from the set.
+
+In order to manage the private IPs as a sequentially ordered list, configure `private_ip_list_enabled` to `true` and use `private_ip_list` to manage the IPs. This will disable the `private_ips` and `private_ips_count` settings, which must be removed from the config file but are still exported. Note that changing the first address of `private_ip_list`, which is the primary, always requires a new interface.
+
+If you are managing a specific set or list of IPs, instead of just using `private_ips_count`, this is a potential workflow for also leveraging `private_ips_count` to have AWS automatically assign additional IP addresses:
+
+1. Comment out `private_ips`, `private_ip_list`, `private_ip_list_enabled` in your configuration
+2. Set the desired `private_ips_count` (count of the number of secondaries, the primary is not included)
+3. Apply to assign the extra IPs
+4. Remove `private_ips_count` and restore your settings from the first step
+5. Add the new IPs to your current settings
+6. Apply again to update the stored state
+
+This process can also be used to remove IP addresses in addition to the option of manually removing them. Adding IP addresses in a manually is more difficult because it requires knowledge of which addresses are available.
+
+## Argument Reference
+
+The following arguments are required:
+
+* `subnet_id` - (Required) Subnet ID to create the ENI in.
+
+The following arguments are optional:
+
+* `attachment` - (Optional) Configuration block to define the attachment of the ENI. See [Attachment](#attachment) below for more details!
+* `description` - (Optional) Description for the network interface.
+* `interface_type` - (Optional) Type of network interface to create. Set to `efa` for Elastic Fabric Adapter. Changing `interface_type` will cause the resource to be destroyed and re-created.
+* `ipv4_prefix_count` - (Optional) Number of IPv4 prefixes that AWS automatically assigns to the network interface.
+* `ipv4_prefixes` - (Optional) One or more IPv4 prefixes assigned to the network interface.
+* `ipv6_address_count` - (Optional) Number of IPv6 addresses to assign to a network interface. You can't use this option if specifying specific `ipv6_addresses`. If your subnet has the AssignIpv6AddressOnCreation attribute set to `true`, you can specify `0` to override this setting.
+* `ipv6_address_list_enabled` - (Optional) Whether `ipv6_address_list` is allowed and controls the IPs to assign to the ENI and `ipv6_addresses` and `ipv6_address_count` become read-only. Default false.
+* `ipv6_address_list` - (Optional) List of private IPs to assign to the ENI in sequential order.
+* `ipv6_addresses` - (Optional) One or more specific IPv6 addresses from the IPv6 CIDR block range of your subnet. Addresses are assigned without regard to order. You can't use this option if you're specifying `ipv6_address_count`.
+* `ipv6_prefix_count` - (Optional) Number of IPv6 prefixes that AWS automatically assigns to the network interface.
+* `ipv6_prefixes` - (Optional) One or more IPv6 prefixes assigned to the network interface.
+* `private_ip_list` - (Optional) List of private IPs to assign to the ENI in sequential order. Requires setting `private_ip_list_enabled` to `true`.
+* `private_ip_list_enabled` - (Optional) Whether `private_ip_list` is allowed and controls the IPs to assign to the ENI and `private_ips` and `private_ips_count` become read-only. Default false.
+* `private_ips` - (Optional) List of private IPs to assign to the ENI without regard to order.
+* `private_ips_count` - (Optional) Number of secondary private IPs to assign to the ENI. The total number of private IPs will be 1 + `private_ips_count`, as a primary private IP will be assiged to an ENI by default.
+* `security_groups` - (Optional) List of security group IDs to assign to the ENI.
+* `source_dest_check` - (Optional) Whether to enable source destination checking for the ENI. Default true.
+* `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Attachment
+
+The `attachment` block supports the following:
+
+* `instance` - (Required) ID of the instance to attach to.
+* `device_index` - (Required) Integer to define the devices index.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the network interface.
+* `id` - ID of the network interface.
+* `mac_address` - MAC address of the network interface.
+* `owner_id` - AWS account ID of the owner of the network interface.
+* `private_dns_name` - Private DNS name of the network interface (IPv4).
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Network Interfaces using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Network Interfaces using the `id`. For example:
+
+```console
+% terraform import aws_network_interface.test eni-e5aa89a3
+```
+
+<!-- cache-key: cdktf-0.18.0 input-7f2ff19c4ccb49477839bee2fe3fa02741d97eacf5edb9c2e7ff7560c3a15031 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/network_interface_attachment.html.markdown b/website/docs/cdktf/python/r/network_interface_attachment.html.markdown
new file mode 100644
index 00000000000..2363e9d0726
--- /dev/null
+++ b/website/docs/cdktf/python/r/network_interface_attachment.html.markdown
@@ -0,0 +1,72 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_network_interface_attachment"
+description: |-
+  Attach an Elastic network interface (ENI) resource with EC2 instance.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_network_interface_attachment
+
+Attach an Elastic network interface (ENI) resource with EC2 instance.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.network_interface_attachment import NetworkInterfaceAttachmentA
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        NetworkInterfaceAttachmentA(self, "test",
+            device_index=0,
+            instance_id=Token.as_string(aws_instance_test.id),
+            network_interface_id=Token.as_string(aws_network_interface_test.id)
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `instance_id` - (Required) Instance ID to attach.
+* `network_interface_id` - (Required) ENI ID to attach.
+* `device_index` - (Required) Network interface index (int).
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `instance_id` - Instance ID.
+* `network_interface_id` - Network interface ID.
+* `attachment_id` - The ENI Attachment ID.
+* `status` - The status of the Network Interface Attachment.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Elastic network interface (ENI) Attachments using its Attachment ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Elastic network interface (ENI) Attachments using its Attachment ID. For example:
+
+```console
+% terraform import aws_network_interface_attachment.secondary_nic eni-attach-0a33842b4ec347c4c
+```
+
+<!-- cache-key: cdktf-0.18.0 input-c857f5e1172a1f296e98c2334fec654cb012784f50f94349ede0b2f1a99701bf -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/network_interface_sg_attachment.html.markdown b/website/docs/cdktf/python/r/network_interface_sg_attachment.html.markdown
new file mode 100644
index 00000000000..61ce957a59f
--- /dev/null
+++ b/website/docs/cdktf/python/r/network_interface_sg_attachment.html.markdown
@@ -0,0 +1,137 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_network_interface_sg_attachment"
+description: |-
+  Associates a security group with a network interface.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_network_interface_sg_attachment
+
+This resource attaches a security group to an Elastic Network Interface (ENI).
+It can be used to attach a security group to any existing ENI, be it a
+secondary ENI or one attached as the primary interface on an instance.
+
+~> **NOTE on instances, interfaces, and security groups:** Terraform currently
+provides the capability to assign security groups via the [`aws_instance`][1]
+and the [`aws_network_interface`][2] resources. Using this resource in
+conjunction with security groups provided in-line in those resources will cause
+conflicts, and will lead to spurious diffs and undefined behavior - please use
+one or the other.
+
+[1]: /docs/providers/aws/d/instance.html
+[2]: /docs/providers/aws/r/network_interface.html
+
+## Example Usage
+
+The following provides a very basic example of setting up an instance (provided
+by `instance`) in the default security group, creating a security group
+(provided by `sg`) and then attaching the security group to the instance's
+primary network interface via the `aws_network_interface_sg_attachment` resource,
+named `sg_attachment`:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_ami import DataAwsAmi
+from imports.aws.instance import Instance
+from imports.aws.network_interface_sg_attachment import NetworkInterfaceSgAttachment
+from imports.aws.security_group import SecurityGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        sg = SecurityGroup(self, "sg",
+            tags={
+                "type": "terraform-test-security-group"
+            }
+        )
+        ami = DataAwsAmi(self, "ami",
+            filter=[DataAwsAmiFilter(
+                name="name",
+                values=["amzn-ami-hvm-*"]
+            )
+            ],
+            most_recent=True,
+            owners=["amazon"]
+        )
+        instance = Instance(self, "instance",
+            ami=Token.as_string(ami.id),
+            instance_type="t2.micro",
+            tags={
+                "type": "terraform-test-instance"
+            }
+        )
+        NetworkInterfaceSgAttachment(self, "sg_attachment",
+            network_interface_id=instance.primary_network_interface_id,
+            security_group_id=sg.id
+        )
+```
+
+In this example, `instance` is provided by the `aws_instance` data source,
+fetching an external instance, possibly not managed by Terraform.
+`sg_attachment` then attaches to the output instance's `network_interface_id`:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_instance import DataAwsInstance
+from imports.aws.network_interface_sg_attachment import NetworkInterfaceSgAttachment
+from imports.aws.security_group import SecurityGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        sg = SecurityGroup(self, "sg",
+            tags={
+                "type": "terraform-test-security-group"
+            }
+        )
+        instance = DataAwsInstance(self, "instance",
+            instance_id="i-1234567890abcdef0"
+        )
+        NetworkInterfaceSgAttachment(self, "sg_attachment",
+            network_interface_id=Token.as_string(instance.network_interface_id),
+            security_group_id=sg.id
+        )
+```
+
+## Argument Reference
+
+* `security_group_id` - (Required) The ID of the security group.
+* `network_interface_id` - (Required) The ID of the network interface to attach to.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Network Interface Security Group attachments using the associated network interface ID and security group ID, separated by an underscore (`_`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Network Interface Security Group attachments using the associated network interface ID and security group ID, separated by an underscore (`_`). For example:
+
+```console
+% terraform import aws_network_interface_sg_attachment.sg_attachment eni-1234567890abcdef0_sg-1234567890abcdef0
+```
+
+<!-- cache-key: cdktf-0.18.0 input-42a38bfce28cae01d1d650740e7e33388caa9a68bec2272acf8014a3939bb8a8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/networkfirewall_firewall.html.markdown b/website/docs/cdktf/python/r/networkfirewall_firewall.html.markdown
new file mode 100644
index 00000000000..caf66a0a380
--- /dev/null
+++ b/website/docs/cdktf/python/r/networkfirewall_firewall.html.markdown
@@ -0,0 +1,120 @@
+---
+subcategory: "Network Firewall"
+layout: "aws"
+page_title: "AWS: aws_networkfirewall_firewall"
+description: |-
+  Provides an AWS Network Firewall Firewall resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_networkfirewall_firewall
+
+Provides an AWS Network Firewall Firewall Resource
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.networkfirewall_firewall import NetworkfirewallFirewall
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        NetworkfirewallFirewall(self, "example",
+            firewall_policy_arn=Token.as_string(aws_networkfirewall_firewall_policy_example.arn),
+            name="example",
+            subnet_mapping=[NetworkfirewallFirewallSubnetMapping(
+                subnet_id=Token.as_string(aws_subnet_example.id)
+            )
+            ],
+            tags={
+                "Tag1": "Value1",
+                "Tag2": "Value2"
+            },
+            vpc_id=Token.as_string(aws_vpc_example.id)
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `delete_protection` - (Optional) A boolean flag indicating whether it is possible to delete the firewall. Defaults to `false`.
+
+* `description` - (Optional) A friendly description of the firewall.
+
+* `encryption_configuration` - (Optional) KMS encryption configuration settings. See [Encryption Configuration](#encryption-configuration) below for details.
+
+* `firewall_policy_arn` - (Required) The Amazon Resource Name (ARN) of the VPC Firewall policy.
+
+* `firewall_policy_change_protection` - (Option) A boolean flag indicating whether it is possible to change the associated firewall policy. Defaults to `false`.
+
+* `name` - (Required, Forces new resource) A friendly name of the firewall.
+
+* `subnet_change_protection` - (Optional) A boolean flag indicating whether it is possible to change the associated subnet(s). Defaults to `false`.
+
+* `subnet_mapping` - (Required) Set of configuration blocks describing the public subnets. Each subnet must belong to a different Availability Zone in the VPC. AWS Network Firewall creates a firewall endpoint in each subnet. See [Subnet Mapping](#subnet-mapping) below for details.
+
+* `tags` - (Optional) Map of resource tags to associate with the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+* `vpc_id` - (Required, Forces new resource) The unique identifier of the VPC where AWS Network Firewall should create the firewall.
+
+### Encryption Configuration
+
+`encryption_configuration` settings for customer managed KMS keys. Remove this block to use the default AWS-managed KMS encryption (rather than setting `type` to `AWS_OWNED_KMS_KEY`).
+
+* `key_id` - (Optional) The ID of the customer managed key. You can use any of the [key identifiers](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-id) that KMS supports, unless you're using a key that's managed by another account. If you're using a key managed by another account, then specify the key ARN.
+* `type` - (Required) The type of AWS KMS key to use for encryption of your Network Firewall resources. Valid values are `CUSTOMER_KMS` and `AWS_OWNED_KMS_KEY`.
+
+### Subnet Mapping
+
+The `subnet_mapping` block supports the following arguments:
+
+* `ip_address_type` - (Optional) The subnet's IP address type. Valida values: `"DUALSTACK"`, `"IPV4"`.
+* `subnet_id` - (Required) The unique identifier for the subnet.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Amazon Resource Name (ARN) that identifies the firewall.
+
+* `arn` - The Amazon Resource Name (ARN) that identifies the firewall.
+
+* `firewall_status` - Nested list of information about the current status of the firewall.
+    * `sync_states` - Set of subnets configured for use by the firewall.
+        * `attachment` - Nested list describing the attachment status of the firewall's association with a single VPC subnet.
+            * `endpoint_id` - The identifier of the firewall endpoint that AWS Network Firewall has instantiated in the subnet. You use this to identify the firewall endpoint in the VPC route tables, when you redirect the VPC traffic through the endpoint.
+            * `subnet_id` - The unique identifier of the subnet that you've specified to be used for a firewall endpoint.
+        * `availability_zone` - The Availability Zone where the subnet is configured.
+
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+* `update_token` - A string token used when updating a firewall.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Network Firewall Firewalls using their `arn`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Network Firewall Firewalls using their `arn`. For example:
+
+```console
+% terraform import aws_networkfirewall_firewall.example arn:aws:network-firewall:us-west-1:123456789012:firewall/example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-2f79b5ba62479f655245def84991cac49da81f4de5c0c95cba76b91f27bb118b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/networkfirewall_firewall_policy.html.markdown b/website/docs/cdktf/python/r/networkfirewall_firewall_policy.html.markdown
new file mode 100644
index 00000000000..cc85b35be4c
--- /dev/null
+++ b/website/docs/cdktf/python/r/networkfirewall_firewall_policy.html.markdown
@@ -0,0 +1,269 @@
+---
+subcategory: "Network Firewall"
+layout: "aws"
+page_title: "AWS: aws_networkfirewall_firewall_policy"
+description: |-
+  Provides an AWS Network Firewall Policy resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_networkfirewall_firewall_policy
+
+Provides an AWS Network Firewall Firewall Policy Resource
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.networkfirewall_firewall_policy import NetworkfirewallFirewallPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        NetworkfirewallFirewallPolicy(self, "example",
+            firewall_policy=NetworkfirewallFirewallPolicyFirewallPolicy(
+                stateless_default_actions=["aws:pass"],
+                stateless_fragment_default_actions=["aws:drop"],
+                stateless_rule_group_reference=[NetworkfirewallFirewallPolicyFirewallPolicyStatelessRuleGroupReference(
+                    priority=1,
+                    resource_arn=Token.as_string(aws_networkfirewall_rule_group_example.arn)
+                )
+                ]
+            ),
+            name="example",
+            tags={
+                "Tag1": "Value1",
+                "Tag2": "Value2"
+            }
+        )
+```
+
+## Policy with a HOME_NET Override
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.networkfirewall_firewall_policy import NetworkfirewallFirewallPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        NetworkfirewallFirewallPolicy(self, "example",
+            firewall_policy=NetworkfirewallFirewallPolicyFirewallPolicy(
+                policy_variables=NetworkfirewallFirewallPolicyFirewallPolicyPolicyVariables(
+                    rule_variables=[NetworkfirewallFirewallPolicyFirewallPolicyPolicyVariablesRuleVariables(
+                        ip_set=NetworkfirewallFirewallPolicyFirewallPolicyPolicyVariablesRuleVariablesIpSet(
+                            definition=["10.0.0.0/16", "10.1.0.0/24"]
+                        ),
+                        key="HOME_NET"
+                    )
+                    ]
+                ),
+                stateless_default_actions=["aws:pass"],
+                stateless_fragment_default_actions=["aws:drop"],
+                stateless_rule_group_reference=[NetworkfirewallFirewallPolicyFirewallPolicyStatelessRuleGroupReference(
+                    priority=1,
+                    resource_arn=Token.as_string(aws_networkfirewall_rule_group_example.arn)
+                )
+                ]
+            ),
+            name="example",
+            tags={
+                "Tag1": "Value1",
+                "Tag2": "Value2"
+            }
+        )
+```
+
+## Policy with a Custom Action for Stateless Inspection
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.networkfirewall_firewall_policy import NetworkfirewallFirewallPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        NetworkfirewallFirewallPolicy(self, "test",
+            firewall_policy=NetworkfirewallFirewallPolicyFirewallPolicy(
+                stateless_custom_action=[NetworkfirewallFirewallPolicyFirewallPolicyStatelessCustomAction(
+                    action_definition=NetworkfirewallFirewallPolicyFirewallPolicyStatelessCustomActionActionDefinition(
+                        publish_metric_action=NetworkfirewallFirewallPolicyFirewallPolicyStatelessCustomActionActionDefinitionPublishMetricAction(
+                            dimension=[NetworkfirewallFirewallPolicyFirewallPolicyStatelessCustomActionActionDefinitionPublishMetricActionDimension(
+                                value="1"
+                            )
+                            ]
+                        )
+                    ),
+                    action_name="ExampleCustomAction"
+                )
+                ],
+                stateless_default_actions=["aws:pass", "ExampleCustomAction"],
+                stateless_fragment_default_actions=["aws:drop"]
+            ),
+            name="example"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `description` - (Optional) A friendly description of the firewall policy.
+
+* `encryption_configuration` - (Optional) KMS encryption configuration settings. See [Encryption Configuration](#encryption-configuration) below for details.
+
+* `firewall_policy` - (Required) A configuration block describing the rule groups and policy actions to use in the firewall policy. See [Firewall Policy](#firewall-policy) below for details.
+
+* `name` - (Required, Forces new resource) A friendly name of the firewall policy.
+
+* `tags` - (Optional) Map of resource tags to associate with the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Encryption Configuration
+
+`encryption_configuration` settings for customer managed KMS keys. Remove this block to use the default AWS-managed KMS encryption (rather than setting `type` to `AWS_OWNED_KMS_KEY`).
+
+* `key_id` - (Optional) The ID of the customer managed key. You can use any of the [key identifiers](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-id) that KMS supports, unless you're using a key that's managed by another account. If you're using a key managed by another account, then specify the key ARN.
+* `type` - (Required) The type of AWS KMS key to use for encryption of your Network Firewall resources. Valid values are `CUSTOMER_KMS` and `AWS_OWNED_KMS_KEY`.
+
+### Firewall Policy
+
+The `firewall_policy` block supports the following arguments:
+
+* `policy_variables` - (Optional). Contains variables that you can use to override default Suricata settings in your firewall policy. See [Rule Variables](#rule-variables) for details.
+
+* `stateful_default_actions` - (Optional) Set of actions to take on a packet if it does not match any stateful rules in the policy. This can only be specified if the policy has a `stateful_engine_options` block with a `rule_order` value of `STRICT_ORDER`. You can specify one of either or neither values of `aws:drop_strict` or `aws:drop_established`, as well as any combination of `aws:alert_strict` and `aws:alert_established`.
+
+* `stateful_engine_options` - (Optional) A configuration block that defines options on how the policy handles stateful rules. See [Stateful Engine Options](#stateful-engine-options) below for details.
+
+* `stateful_rule_group_reference` - (Optional) Set of configuration blocks containing references to the stateful rule groups that are used in the policy. See [Stateful Rule Group Reference](#stateful-rule-group-reference) below for details.
+
+* `stateless_custom_action` - (Optional) Set of configuration blocks describing the custom action definitions that are available for use in the firewall policy's `stateless_default_actions`. See [Stateless Custom Action](#stateless-custom-action) below for details.
+
+* `stateless_default_actions` - (Required) Set of actions to take on a packet if it does not match any of the stateless rules in the policy. You must specify one of the standard actions including: `aws:drop`, `aws:pass`, or `aws:forward_to_sfe`.
+In addition, you can specify custom actions that are compatible with your standard action choice. If you want non-matching packets to be forwarded for stateful inspection, specify `aws:forward_to_sfe`.
+
+* `stateless_fragment_default_actions` - (Required) Set of actions to take on a fragmented packet if it does not match any of the stateless rules in the policy. You must specify one of the standard actions including: `aws:drop`, `aws:pass`, or `aws:forward_to_sfe`.
+In addition, you can specify custom actions that are compatible with your standard action choice. If you want non-matching packets to be forwarded for stateful inspection, specify `aws:forward_to_sfe`.
+
+* `stateless_rule_group_reference` - (Optional) Set of configuration blocks containing references to the stateless rule groups that are used in the policy. See [Stateless Rule Group Reference](#stateless-rule-group-reference) below for details.
+
+### Rule Variables
+
+The `rule_variables` block supports the following arguments:
+
+* `key` - (Required) An alphanumeric string to identify the `ip_set`. Valid values: `HOME_NET`
+
+* `ip_set` - (Required) A configuration block that defines a set of IP addresses. See [IP Set](#ip-set) below for details.
+
+### IP Set
+
+The `ip_set` block supports the following argument:
+
+* `definition` - (Required) Set of IPv4 or IPv6 addresses in CIDR notation to use for the Suricata `HOME_NET` variable.
+
+### Stateful Engine Options
+
+The `stateful_engine_options` block supports the following argument:
+
+~> **NOTE:** If the `STRICT_ORDER` rule order is specified, this firewall policy can only reference stateful rule groups that utilize `STRICT_ORDER`.
+
+* `rule_order` - Indicates how to manage the order of stateful rule evaluation for the policy. Default value: `DEFAULT_ACTION_ORDER`. Valid values: `DEFAULT_ACTION_ORDER`, `STRICT_ORDER`.
+
+* `stream_exception_policy` - Describes how to treat traffic which has broken midstream. Default value: `DROP`. Valid values: `DROP`, `CONTINUE`, `REJECT`.
+
+### Stateful Rule Group Reference
+
+The `stateful_rule_group_reference` block supports the following arguments:
+
+* `priority` - (Optional) An integer setting that indicates the order in which to apply the stateful rule groups in a single policy. This argument must be specified if the policy has a `stateful_engine_options` block with a `rule_order` value of `STRICT_ORDER`. AWS Network Firewall applies each stateful rule group to a packet starting with the group that has the lowest priority setting.
+
+* `resource_arn` - (Required) The Amazon Resource Name (ARN) of the stateful rule group.
+
+* `override` - (Optional) Configuration block for override values
+
+#### Override
+
+* `action` - (Optional) The action that changes the rule group from DROP to ALERT . This only applies to managed rule groups.
+
+### Stateless Custom Action
+
+The `stateless_custom_action` block supports the following arguments:
+
+* `action_definition` - (Required) A configuration block describing the custom action associated with the `action_name`. See [Action Definition](#action-definition) below for details.
+
+* `action_name` - (Required, Forces new resource) A friendly name of the custom action.
+
+### Stateless Rule Group Reference
+
+The `stateless_rule_group_reference` block supports the following arguments:
+
+* `priority` - (Required) An integer setting that indicates the order in which to run the stateless rule groups in a single policy. AWS Network Firewall applies each stateless rule group to a packet starting with the group that has the lowest priority setting.
+
+* `resource_arn` - (Required) The Amazon Resource Name (ARN) of the stateless rule group.
+
+### Action Definition
+
+The `action_definition` block supports the following argument:
+
+* `publish_metric_action` - (Required) A configuration block describing the stateless inspection criteria that publishes the specified metrics to Amazon CloudWatch for the matching packet. You can pair this custom action with any of the standard stateless rule actions. See [Publish Metric Action](#publish-metric-action) below for details.
+
+### Publish Metric Action
+
+The `publish_metric_action` block supports the following argument:
+
+* `dimension` - (Required) Set of configuration blocks describing dimension settings to use for Amazon CloudWatch custom metrics. See [Dimension](#dimension) below for more details.
+
+### Dimension
+
+The `dimension` block supports the following argument:
+
+* `value` - (Required) The string value to use in the custom metric dimension.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Amazon Resource Name (ARN) that identifies the firewall policy.
+
+* `arn` - The Amazon Resource Name (ARN) that identifies the firewall policy.
+
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+* `update_token` - A string token used when updating a firewall policy.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Network Firewall Policies using their `arn`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Network Firewall Policies using their `arn`. For example:
+
+```console
+% terraform import aws_networkfirewall_firewall_policy.example arn:aws:network-firewall:us-west-1:123456789012:firewall-policy/example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-17c12b43543ae699c6f2d03a7c541a3ec74530e26b24b77254c63fb4dd0c7b37 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/networkfirewall_logging_configuration.html.markdown b/website/docs/cdktf/python/r/networkfirewall_logging_configuration.html.markdown
new file mode 100644
index 00000000000..6086d268677
--- /dev/null
+++ b/website/docs/cdktf/python/r/networkfirewall_logging_configuration.html.markdown
@@ -0,0 +1,157 @@
+---
+subcategory: "Network Firewall"
+layout: "aws"
+page_title: "AWS: aws_networkfirewall_logging_configuration"
+description: |-
+  Provides an AWS Network Firewall Logging Configuration resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_networkfirewall_logging_configuration
+
+Provides an AWS Network Firewall Logging Configuration Resource
+
+## Example Usage
+
+### Logging to S3
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.networkfirewall_logging_configuration import NetworkfirewallLoggingConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        NetworkfirewallLoggingConfiguration(self, "example",
+            firewall_arn=Token.as_string(aws_networkfirewall_firewall_example.arn),
+            logging_configuration=NetworkfirewallLoggingConfigurationLoggingConfiguration(
+                log_destination_config=[NetworkfirewallLoggingConfigurationLoggingConfigurationLogDestinationConfig(
+                    log_destination={
+                        "bucket_name": Token.as_string(aws_s3_bucket_example.bucket),
+                        "prefix": "/example"
+                    },
+                    log_destination_type="S3",
+                    log_type="FLOW"
+                )
+                ]
+            )
+        )
+```
+
+### Logging to CloudWatch
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.networkfirewall_logging_configuration import NetworkfirewallLoggingConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        NetworkfirewallLoggingConfiguration(self, "example",
+            firewall_arn=Token.as_string(aws_networkfirewall_firewall_example.arn),
+            logging_configuration=NetworkfirewallLoggingConfigurationLoggingConfiguration(
+                log_destination_config=[NetworkfirewallLoggingConfigurationLoggingConfigurationLogDestinationConfig(
+                    log_destination={
+                        "log_group": Token.as_string(aws_cloudwatch_log_group_example.name)
+                    },
+                    log_destination_type="CloudWatchLogs",
+                    log_type="ALERT"
+                )
+                ]
+            )
+        )
+```
+
+### Logging to Kinesis Data Firehose
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.networkfirewall_logging_configuration import NetworkfirewallLoggingConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        NetworkfirewallLoggingConfiguration(self, "example",
+            firewall_arn=Token.as_string(aws_networkfirewall_firewall_example.arn),
+            logging_configuration=NetworkfirewallLoggingConfigurationLoggingConfiguration(
+                log_destination_config=[NetworkfirewallLoggingConfigurationLoggingConfigurationLogDestinationConfig(
+                    log_destination={
+                        "delivery_stream": Token.as_string(aws_kinesis_firehose_delivery_stream_example.name)
+                    },
+                    log_destination_type="KinesisDataFirehose",
+                    log_type="ALERT"
+                )
+                ]
+            )
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `firewall_arn` - (Required, Forces new resource) The Amazon Resource Name (ARN) of the Network Firewall firewall.
+
+* `logging_configuration` - (Required) A configuration block describing how AWS Network Firewall performs logging for a firewall. See [Logging Configuration](#logging-configuration) below for details.
+
+### Logging Configuration
+
+The `logging_configuration` block supports the following arguments:
+
+* `log_destination_config` - (Required) Set of configuration blocks describing the logging details for a firewall. See [Log Destination Config](#log-destination-config) below for details. At most, only two blocks can be specified; one for `FLOW` logs and one for `ALERT` logs.
+
+### Log Destination Config
+
+The `log_destination_config` block supports the following arguments:
+
+* `log_destination` - (Required) A map describing the logging destination for the chosen `log_destination_type`.
+    * For an Amazon S3 bucket, specify the key `bucketName` with the name of the bucket and optionally specify the key `prefix` with a path.
+    * For a CloudWatch log group, specify the key `logGroup` with the name of the CloudWatch log group.
+    * For a Kinesis Data Firehose delivery stream, specify the key `deliveryStream` with the name of the delivery stream.
+
+* `log_destination_type` - (Required) The location to send logs to. Valid values: `S3`, `CloudWatchLogs`, `KinesisDataFirehose`.
+
+* `log_type` - (Required) The type of log to send. Valid values: `ALERT` or `FLOW`. Alert logs report traffic that matches a `StatefulRule` with an action setting that sends a log message. Flow logs are standard network traffic flow logs.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Amazon Resource Name (ARN) of the associated firewall.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Network Firewall Logging Configurations using the `firewall_arn`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Network Firewall Logging Configurations using the `firewall_arn`. For example:
+
+```console
+% terraform import aws_networkfirewall_logging_configuration.example arn:aws:network-firewall:us-west-1:123456789012:firewall/example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-2700cb50e1d426b15657fe101c09e1dc07bb26140cf98ca4ff2db12e4a6d391e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/networkfirewall_resource_policy.html.markdown b/website/docs/cdktf/python/r/networkfirewall_resource_policy.html.markdown
new file mode 100644
index 00000000000..7f0ba1ce00d
--- /dev/null
+++ b/website/docs/cdktf/python/r/networkfirewall_resource_policy.html.markdown
@@ -0,0 +1,116 @@
+---
+subcategory: "Network Firewall"
+layout: "aws"
+page_title: "AWS: aws_networkfirewall_resource_policy"
+description: |-
+  Provides an AWS Network Firewall Resource Policy resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_networkfirewall_resource_policy
+
+Provides an AWS Network Firewall Resource Policy Resource for a rule group or firewall policy.
+
+## Example Usage
+
+### For a Firewall Policy resource
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.networkfirewall_resource_policy import NetworkfirewallResourcePolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        NetworkfirewallResourcePolicy(self, "example",
+            policy=Token.as_string(
+                Fn.jsonencode({
+                    "Statement": [{
+                        "Action": ["network-firewall:ListFirewallPolicies", "network-firewall:CreateFirewall", "network-firewall:UpdateFirewall", "network-firewall:AssociateFirewallPolicy"
+                        ],
+                        "Effect": "Allow",
+                        "Principal": {
+                            "AWS": "arn:aws:iam::123456789012:root"
+                        },
+                        "Resource": aws_networkfirewall_firewall_policy_example.arn
+                    }
+                    ],
+                    "Version": "2012-10-17"
+                })),
+            resource_arn=Token.as_string(aws_networkfirewall_firewall_policy_example.arn)
+        )
+```
+
+### For a Rule Group resource
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.networkfirewall_resource_policy import NetworkfirewallResourcePolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        NetworkfirewallResourcePolicy(self, "example",
+            policy=Token.as_string(
+                Fn.jsonencode({
+                    "Statement": [{
+                        "Action": ["network-firewall:ListRuleGroups", "network-firewall:CreateFirewallPolicy", "network-firewall:UpdateFirewallPolicy"
+                        ],
+                        "Effect": "Allow",
+                        "Principal": {
+                            "AWS": "arn:aws:iam::123456789012:root"
+                        },
+                        "Resource": aws_networkfirewall_rule_group_example.arn
+                    }
+                    ],
+                    "Version": "2012-10-17"
+                })),
+            resource_arn=Token.as_string(aws_networkfirewall_rule_group_example.arn)
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `policy` - (Required) JSON formatted policy document that controls access to the Network Firewall resource. The policy must be provided **without whitespaces**.  We recommend using [jsonencode](https://www.terraform.io/docs/configuration/functions/jsonencode.html) for formatting as seen in the examples above. For more details, including available policy statement Actions, see the [Policy](https://docs.aws.amazon.com/network-firewall/latest/APIReference/API_PutResourcePolicy.html#API_PutResourcePolicy_RequestSyntax) parameter in the AWS API documentation.
+
+* `resource_arn` - (Required, Forces new resource) The Amazon Resource Name (ARN) of the rule group or firewall policy.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Amazon Resource Name (ARN) of the rule group or firewall policy associated with the resource policy.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Network Firewall Resource Policies using the `resource_arn`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Network Firewall Resource Policies using the `resource_arn`. For example:
+
+```console
+% terraform import aws_networkfirewall_resource_policy.example aws_networkfirewall_rule_group.example arn:aws:network-firewall:us-west-1:123456789012:stateful-rulegroup/example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-c5fa671486177fa4e87a6bb581a11477626a302a6be68b0b30edb7287b73cc5c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/networkfirewall_rule_group.html.markdown b/website/docs/cdktf/python/r/networkfirewall_rule_group.html.markdown
new file mode 100644
index 00000000000..29ac45b8c16
--- /dev/null
+++ b/website/docs/cdktf/python/r/networkfirewall_rule_group.html.markdown
@@ -0,0 +1,638 @@
+---
+subcategory: "Network Firewall"
+layout: "aws"
+page_title: "AWS: aws_networkfirewall_rule_group"
+description: |-
+  Provides an AWS Network Firewall Rule Group resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_networkfirewall_rule_group
+
+Provides an AWS Network Firewall Rule Group Resource
+
+## Example Usage
+
+### Stateful Inspection for denying access to a domain
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.networkfirewall_rule_group import NetworkfirewallRuleGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        NetworkfirewallRuleGroup(self, "example",
+            capacity=100,
+            name="example",
+            rule_group=NetworkfirewallRuleGroupRuleGroup(
+                rules_source=NetworkfirewallRuleGroupRuleGroupRulesSource(
+                    rules_source_list=NetworkfirewallRuleGroupRuleGroupRulesSourceRulesSourceListStruct(
+                        generated_rules_type="DENYLIST",
+                        target_types=["HTTP_HOST"],
+                        targets=["test.example.com"]
+                    )
+                )
+            ),
+            tags={
+                "Tag1": "Value1",
+                "Tag2": "Value2"
+            },
+            type="STATEFUL"
+        )
+```
+
+### Stateful Inspection for permitting packets from a source IP address
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformIterator, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.networkfirewall_rule_group import NetworkfirewallRuleGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ips = ["1.1.1.1/32", "1.0.0.1/32"]
+        # In most cases loops should be handled in the programming language context and
+        #     not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+        #     you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+        #     you need to keep this like it is.
+        example_dynamic_iterator0 = TerraformIterator.from_list(
+            Token.as_any(ips))
+        NetworkfirewallRuleGroup(self, "example",
+            capacity=50,
+            description="Permits http traffic from source",
+            name="example",
+            rule_group=NetworkfirewallRuleGroupRuleGroup(
+                rules_source=NetworkfirewallRuleGroupRuleGroupRulesSource(
+                    stateful_rule=example_dynamic_iterator0.dynamic({
+                        "action": "PASS",
+                        "header": [{
+                            "destination": "ANY",
+                            "destination_port": "ANY",
+                            "direction": "ANY",
+                            "protocol": "HTTP",
+                            "source": example_dynamic_iterator0.value,
+                            "source_port": "ANY"
+                        }
+                        ],
+                        "rule_option": [{
+                            "keyword": "sid",
+                            "settings": ["1"]
+                        }
+                        ]
+                    })
+                )
+            ),
+            tags={
+                "Name": "permit HTTP from source"
+            },
+            type="STATEFUL"
+        )
+```
+
+### Stateful Inspection for blocking packets from going to an intended destination
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.networkfirewall_rule_group import NetworkfirewallRuleGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        NetworkfirewallRuleGroup(self, "example",
+            capacity=100,
+            name="example",
+            rule_group=NetworkfirewallRuleGroupRuleGroup(
+                rules_source=NetworkfirewallRuleGroupRuleGroupRulesSource(
+                    stateful_rule=[NetworkfirewallRuleGroupRuleGroupRulesSourceStatefulRule(
+                        action="DROP",
+                        header=NetworkfirewallRuleGroupRuleGroupRulesSourceStatefulRuleHeader(
+                            destination="124.1.1.24/32",
+                            destination_port=Token.as_string(53),
+                            direction="ANY",
+                            protocol="TCP",
+                            source="1.2.3.4/32",
+                            source_port=Token.as_string(53)
+                        ),
+                        rule_option=[NetworkfirewallRuleGroupRuleGroupRulesSourceStatefulRuleRuleOption(
+                            keyword="sid",
+                            settings=["1"]
+                        )
+                        ]
+                    )
+                    ]
+                )
+            ),
+            tags={
+                "Tag1": "Value1",
+                "Tag2": "Value2"
+            },
+            type="STATEFUL"
+        )
+```
+
+### Stateful Inspection from rules specifications defined in Suricata flat format
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.networkfirewall_rule_group import NetworkfirewallRuleGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        NetworkfirewallRuleGroup(self, "example",
+            capacity=100,
+            name="example",
+            rules=Token.as_string(Fn.file("example.rules")),
+            tags={
+                "Tag1": "Value1",
+                "Tag2": "Value2"
+            },
+            type="STATEFUL"
+        )
+```
+
+### Stateful Inspection from rule group specifications using rule variables and Suricata format rules
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.networkfirewall_rule_group import NetworkfirewallRuleGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        NetworkfirewallRuleGroup(self, "example",
+            capacity=100,
+            name="example",
+            rule_group=NetworkfirewallRuleGroupRuleGroup(
+                rule_variables=NetworkfirewallRuleGroupRuleGroupRuleVariables(
+                    ip_sets=[NetworkfirewallRuleGroupRuleGroupRuleVariablesIpSets(
+                        ip_set=NetworkfirewallRuleGroupRuleGroupRuleVariablesIpSetsIpSet(
+                            definition=["10.0.0.0/16", "10.0.1.0/24", "192.168.0.0/16"]
+                        ),
+                        key="WEBSERVERS_HOSTS"
+                    ), NetworkfirewallRuleGroupRuleGroupRuleVariablesIpSets(
+                        ip_set=NetworkfirewallRuleGroupRuleGroupRuleVariablesIpSetsIpSet(
+                            definition=["1.2.3.4/32"]
+                        ),
+                        key="EXTERNAL_HOST"
+                    )
+                    ],
+                    port_sets=[NetworkfirewallRuleGroupRuleGroupRuleVariablesPortSets(
+                        key="HTTP_PORTS",
+                        port_set=NetworkfirewallRuleGroupRuleGroupRuleVariablesPortSetsPortSet(
+                            definition=["443", "80"]
+                        )
+                    )
+                    ]
+                ),
+                rules_source=NetworkfirewallRuleGroupRuleGroupRulesSource(
+                    rules_string=Token.as_string(Fn.file("suricata_rules_file"))
+                )
+            ),
+            tags={
+                "Tag1": "Value1",
+                "Tag2": "Value2"
+            },
+            type="STATEFUL"
+        )
+```
+
+### Stateless Inspection with a Custom Action
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.networkfirewall_rule_group import NetworkfirewallRuleGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        NetworkfirewallRuleGroup(self, "example",
+            capacity=100,
+            description="Stateless Rate Limiting Rule",
+            name="example",
+            rule_group=NetworkfirewallRuleGroupRuleGroup(
+                rules_source=NetworkfirewallRuleGroupRuleGroupRulesSource(
+                    stateless_rules_and_custom_actions=NetworkfirewallRuleGroupRuleGroupRulesSourceStatelessRulesAndCustomActions(
+                        custom_action=[NetworkfirewallRuleGroupRuleGroupRulesSourceStatelessRulesAndCustomActionsCustomAction(
+                            action_definition=NetworkfirewallRuleGroupRuleGroupRulesSourceStatelessRulesAndCustomActionsCustomActionActionDefinition(
+                                publish_metric_action=NetworkfirewallRuleGroupRuleGroupRulesSourceStatelessRulesAndCustomActionsCustomActionActionDefinitionPublishMetricAction(
+                                    dimension=[NetworkfirewallRuleGroupRuleGroupRulesSourceStatelessRulesAndCustomActionsCustomActionActionDefinitionPublishMetricActionDimension(
+                                        value="2"
+                                    )
+                                    ]
+                                )
+                            ),
+                            action_name="ExampleMetricsAction"
+                        )
+                        ],
+                        stateless_rule=[NetworkfirewallRuleGroupRuleGroupRulesSourceStatelessRulesAndCustomActionsStatelessRule(
+                            priority=1,
+                            rule_definition=NetworkfirewallRuleGroupRuleGroupRulesSourceStatelessRulesAndCustomActionsStatelessRuleRuleDefinition(
+                                actions=["aws:pass", "ExampleMetricsAction"],
+                                match_attributes=NetworkfirewallRuleGroupRuleGroupRulesSourceStatelessRulesAndCustomActionsStatelessRuleRuleDefinitionMatchAttributes(
+                                    destination=[NetworkfirewallRuleGroupRuleGroupRulesSourceStatelessRulesAndCustomActionsStatelessRuleRuleDefinitionMatchAttributesDestination(
+                                        address_definition="124.1.1.5/32"
+                                    )
+                                    ],
+                                    destination_port=[NetworkfirewallRuleGroupRuleGroupRulesSourceStatelessRulesAndCustomActionsStatelessRuleRuleDefinitionMatchAttributesDestinationPort(
+                                        from_port=443,
+                                        to_port=443
+                                    )
+                                    ],
+                                    protocols=[6],
+                                    source=[NetworkfirewallRuleGroupRuleGroupRulesSourceStatelessRulesAndCustomActionsStatelessRuleRuleDefinitionMatchAttributesSource(
+                                        address_definition="1.2.3.4/32"
+                                    )
+                                    ],
+                                    source_port=[NetworkfirewallRuleGroupRuleGroupRulesSourceStatelessRulesAndCustomActionsStatelessRuleRuleDefinitionMatchAttributesSourcePort(
+                                        from_port=443,
+                                        to_port=443
+                                    )
+                                    ],
+                                    tcp_flag=[NetworkfirewallRuleGroupRuleGroupRulesSourceStatelessRulesAndCustomActionsStatelessRuleRuleDefinitionMatchAttributesTcpFlag(
+                                        flags=["SYN"],
+                                        masks=["SYN", "ACK"]
+                                    )
+                                    ]
+                                )
+                            )
+                        )
+                        ]
+                    )
+                )
+            ),
+            tags={
+                "Tag1": "Value1",
+                "Tag2": "Value2"
+            },
+            type="STATELESS"
+        )
+```
+
+### IP Set References to the Rule Group
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.networkfirewall_rule_group import NetworkfirewallRuleGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        NetworkfirewallRuleGroup(self, "example",
+            capacity=100,
+            name="example",
+            rule_group=NetworkfirewallRuleGroupRuleGroup(
+                reference_sets=NetworkfirewallRuleGroupRuleGroupReferenceSets(
+                    ip_set_references=[NetworkfirewallRuleGroupRuleGroupReferenceSetsIpSetReferences(
+                        ip_set_reference=[NetworkfirewallRuleGroupRuleGroupReferenceSetsIpSetReferencesIpSetReference(
+                            reference_arn=this_var.arn
+                        )
+                        ],
+                        key="example"
+                    )
+                    ]
+                ),
+                rules_source=NetworkfirewallRuleGroupRuleGroupRulesSource(
+                    rules_source_list=NetworkfirewallRuleGroupRuleGroupRulesSourceRulesSourceListStruct(
+                        generated_rules_type="DENYLIST",
+                        target_types=["HTTP_HOST"],
+                        targets=["test.example.com"]
+                    )
+                )
+            ),
+            tags={
+                "Tag1": "Value1",
+                "Tag2": "Value2"
+            },
+            type="STATEFUL"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `capacity` - (Required, Forces new resource) The maximum number of operating resources that this rule group can use. For a stateless rule group, the capacity required is the sum of the capacity requirements of the individual rules. For a stateful rule group, the minimum capacity required is the number of individual rules.
+
+* `description` - (Optional) A friendly description of the rule group.
+
+* `encryption_configuration` - (Optional) KMS encryption configuration settings. See [Encryption Configuration](#encryption-configuration) below for details.
+
+* `name` - (Required, Forces new resource) A friendly name of the rule group.
+
+* `rule_group` - (Optional) A configuration block that defines the rule group rules. Required unless `rules` is specified. See [Rule Group](#rule-group) below for details.
+
+* `rules` - (Optional) The stateful rule group rules specifications in Suricata file format, with one rule per line. Use this to import your existing Suricata compatible rule groups. Required unless `rule_group` is specified.
+
+* `tags` - (Optional) A map of key:value pairs to associate with the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+* `type` - (Required) Whether the rule group is stateless (containing stateless rules) or stateful (containing stateful rules). Valid values include: `STATEFUL` or `STATELESS`.
+
+### Encryption Configuration
+
+`encryption_configuration` settings for customer managed KMS keys. Remove this block to use the default AWS-managed KMS encryption (rather than setting `type` to `AWS_OWNED_KMS_KEY`).
+
+* `key_id` - (Optional) The ID of the customer managed key. You can use any of the [key identifiers](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-id) that KMS supports, unless you're using a key that's managed by another account. If you're using a key managed by another account, then specify the key ARN.
+* `type` - (Required) The type of AWS KMS key to use for encryption of your Network Firewall resources. Valid values are `CUSTOMER_KMS` and `AWS_OWNED_KMS_KEY`.
+
+### Rule Group
+
+The `rule_group` block supports the following argument:
+
+* `reference_sets` - (Optional) A configuration block that defines the IP Set References for the rule group. See [Reference Sets](#reference-sets) below for details. Please notes that there can only be a maximum of 5 `reference_sets` in a `rule_group`. See the [AWS documentation](https://docs.aws.amazon.com/network-firewall/latest/developerguide/rule-groups-ip-set-references.html#rule-groups-ip-set-reference-limits) for details.
+
+* `rule_variables` - (Optional) A configuration block that defines additional settings available to use in the rules defined in the rule group. Can only be specified for **stateful** rule groups. See [Rule Variables](#rule-variables) below for details.
+
+* `rules_source` - (Required) A configuration block that defines the stateful or stateless rules for the rule group. See [Rules Source](#rules-source) below for details.
+
+* `stateful_rule_options` - (Optional) A configuration block that defines stateful rule options for the rule group. See [Stateful Rule Options](#stateful-rule-options) below for details.
+
+### Reference Sets
+
+The `reference_sets` block supports the following arguments:
+
+* `ip_set_reference` - (Optional) Set of configuration blocks that define the IP Reference information. See [IP Set Reference](#ip-set-reference) below for details.
+
+### Rule Variables
+
+The `rule_variables` block supports the following arguments:
+
+* `ip_sets` - (Optional) Set of configuration blocks that define IP address information. See [IP Sets](#ip-sets) below for details.
+
+* `port_sets` - (Optional) Set of configuration blocks that define port range information. See [Port Sets](#port-sets) below for details.
+
+### IP Sets
+
+The `ip_sets` block supports the following arguments:
+
+* `key` - (Required) A unique alphanumeric string to identify the `ip_set`.
+
+* `ip_set` - (Required) A configuration block that defines a set of IP addresses. See [IP Set](#ip-set) below for details.
+
+### IP Set
+
+The `ip_set` configuration block supports the following argument:
+
+* `definition` - (Required) Set of IP addresses and address ranges, in CIDR notation.
+
+### IP Set Reference
+
+The `ip_set_reference` configuration block supports the following argument:
+
+* `key` - (Required) A unique alphanumeric string to identify the `ip_set`.
+
+* `reference_arn` - (Required) Set of Managed Prefix IP ARN(s)
+
+### Port Sets
+
+The `port_sets` block supports the following arguments:
+
+* `key` - (Required) An unique alphanumeric string to identify the `port_set`.
+
+* `port_set` - (Required) A configuration block that defines a set of port ranges. See [Port Set](#port-set) below for details.
+
+### Port Set
+
+The `port_set` configuration block suppports the following argument:
+
+* `definition` - (Required) Set of port ranges.
+
+### Rules Source
+
+The `rules_source` block supports the following arguments:
+
+~> **NOTE:** Only one of `rules_source_list`, `rules_string`, `stateful_rule`, or `stateless_rules_and_custom_actions` must be specified.
+
+* `rules_source_list` - (Optional) A configuration block containing **stateful** inspection criteria for a domain list rule group. See [Rules Source List](#rules-source-list) below for details.
+
+* `rules_string` - (Optional) The fully qualified name of a file in an S3 bucket that contains Suricata compatible intrusion preventions system (IPS) rules or the Suricata rules as a string. These rules contain **stateful** inspection criteria and the action to take for traffic that matches the criteria.
+
+* `stateful_rule` - (Optional) Set of configuration blocks containing **stateful** inspection criteria for 5-tuple rules to be used together in a rule group. See [Stateful Rule](#stateful-rule) below for details.
+
+* `stateless_rules_and_custom_actions` - (Optional) A configuration block containing **stateless** inspection criteria for a stateless rule group. See [Stateless Rules and Custom Actions](#stateless-rules-and-custom-actions) below for details.
+
+### Stateful Rule Options
+
+The `stateful_rule_options` block supports the following argument:
+
+~> **NOTE:** If the `STRICT_ORDER` rule order is specified, this rule group can only be referenced in firewall policies that also utilize `STRICT_ORDER` for the stateful engine. `STRICT_ORDER` can only be specified when using a `rules_source` of `rules_string` or `stateful_rule`.
+
+* `rule_order` - (Required) Indicates how to manage the order of the rule evaluation for the rule group. Default value: `DEFAULT_ACTION_ORDER`. Valid values: `DEFAULT_ACTION_ORDER`, `STRICT_ORDER`.
+
+### Rules Source List
+
+The `rules_source_list` block supports the following arguments:
+
+* `generated_rules_type` - (Required) String value to specify whether domains in the target list are allowed or denied access. Valid values: `ALLOWLIST`, `DENYLIST`.
+
+* `target_types` - (Required) Set of types of domain specifications that are provided in the `targets` argument. Valid values: `HTTP_HOST`, `TLS_SNI`.
+
+* `targets` - (Required) Set of domains that you want to inspect for in your traffic flows.
+
+### Stateful Rule
+
+The `stateful_rule` block supports the following arguments:
+
+* `action` - (Required) Action to take with packets in a traffic flow when the flow matches the stateful rule criteria. For all actions, AWS Network Firewall performs the specified action and discontinues stateful inspection of the traffic flow. Valid values: `ALERT`, `DROP`, `PASS`, or `REJECT`.
+
+* `header` - (Required) A configuration block containing the stateful 5-tuple inspection criteria for the rule, used to inspect traffic flows. See [Header](#header) below for details.
+
+* `rule_option` - (Required) Set of configuration blocks containing additional settings for a stateful rule. See [Rule Option](#rule-option) below for details.
+
+### Stateless Rules and Custom Actions
+
+The `stateless_rules_and_custom_actions` block supports the following arguments:
+
+* `custom_action` - (Optional) Set of configuration blocks containing custom action definitions that are available for use by the set of `stateless rule`. See [Custom Action](#custom-action) below for details.
+
+* `stateless_rule` - (Required) Set of configuration blocks containing the stateless rules for use in the stateless rule group. See [Stateless Rule](#stateless-rule) below for details.
+
+### Header
+
+The `header` block supports the following arguments:
+
+* `destination` - (Required) The destination IP address or address range to inspect for, in CIDR notation. To match with any address, specify `ANY`.
+
+* `destination_port` - (Required) The destination port to inspect for. To match with any address, specify `ANY`.
+
+* `direction` - (Required) The direction of traffic flow to inspect. Valid values: `ANY` or `FORWARD`.
+
+* `protocol` - (Required) The protocol to inspect. Valid values: `IP`, `TCP`, `UDP`, `ICMP`, `HTTP`, `FTP`, `TLS`, `SMB`, `DNS`, `DCERPC`, `SSH`, `SMTP`, `IMAP`, `MSN`, `KRB5`, `IKEV2`, `TFTP`, `NTP`, `DHCP`.
+
+* `source` - (Required) The source IP address or address range for, in CIDR notation. To match with any address, specify `ANY`.
+
+* `source_port` - (Required) The source port to inspect for. To match with any address, specify `ANY`.
+
+### Rule Option
+
+The `rule_option` block supports the following arguments:
+
+* `keyword` - (Required) Keyword defined by open source detection systems like Snort or Suricata for stateful rule inspection.
+See [Snort General Rule Options](http://manual-snort-org.s3-website-us-east-1.amazonaws.com/node31.html) or [Suricata Rule Options](https://suricata.readthedocs.io/en/suricata-5.0.1/rules/intro.html#rule-options) for more details.
+* `settings` - (Optional) Set of strings for additional settings to use in stateful rule inspection.
+
+### Custom Action
+
+The `custom_action` block supports the following arguments:
+
+* `action_definition` - (Required) A configuration block describing the custom action associated with the `action_name`. See [Action Definition](#action-definition) below for details.
+
+* `action_name` - (Required, Forces new resource) A friendly name of the custom action.
+
+### Stateless Rule
+
+The `stateless_rule` block supports the following arguments:
+
+* `priority` - (Required) A setting that indicates the order in which to run this rule relative to all of the rules that are defined for a stateless rule group. AWS Network Firewall evaluates the rules in a rule group starting with the lowest priority setting.
+
+* `rule_definition` - (Required) A configuration block defining the stateless 5-tuple packet inspection criteria and the action to take on a packet that matches the criteria. See [Rule Definition](#rule-definition) below for details.
+
+### Rule Definition
+
+The `rule_definition` block supports the following arguments:
+
+* `actions` - (Required) Set of actions to take on a packet that matches one of the stateless rule definition's `match_attributes`. For every rule you must specify 1 standard action, and you can add custom actions. Standard actions include: `aws:pass`, `aws:drop`, `aws:forward_to_sfe`.
+
+* `match_attributes` - (Required) A configuration block containing criteria for AWS Network Firewall to use to inspect an individual packet in stateless rule inspection. See [Match Attributes](#match-attributes) below for details.
+
+### Match Attributes
+
+The `match_attributes` block supports the following arguments:
+
+* `destination` - (Optional) Set of configuration blocks describing the destination IP address and address ranges to inspect for, in CIDR notation. If not specified, this matches with any destination address. See [Destination](#destination) below for details.
+
+* `destination_port` - (Optional) Set of configuration blocks describing the destination ports to inspect for. If not specified, this matches with any destination port. See [Destination Port](#destination-port) below for details.
+
+* `protocols` - (Optional) Set of protocols to inspect for, specified using the protocol's assigned internet protocol number (IANA). If not specified, this matches with any protocol.
+
+* `source` - (Optional) Set of configuration blocks describing the source IP address and address ranges to inspect for, in CIDR notation. If not specified, this matches with any source address. See [Source](#source) below for details.
+
+* `source_port` - (Optional) Set of configuration blocks describing the source ports to inspect for. If not specified, this matches with any source port. See [Source Port](#source-port) below for details.
+
+* `tcp_flag` - (Optional) Set of configuration blocks containing the TCP flags and masks to inspect for. If not specified, this matches with any settings.
+
+### Action Definition
+
+The `action_definition` block supports the following argument:
+
+* `publish_metric_action` - (Required) A configuration block describing the stateless inspection criteria that publishes the specified metrics to Amazon CloudWatch for the matching packet. You can pair this custom action with any of the standard stateless rule actions. See [Publish Metric Action](#publish-metric-action) below for details.
+
+### Publish Metric Action
+
+The `publish_metric_action` block supports the following argument:
+
+* `dimension` - (Required) Set of configuration blocks containing the dimension settings to use for Amazon CloudWatch custom metrics. See [Dimension](#dimension) below for details.
+
+### Dimension
+
+The `dimension` block supports the following argument:
+
+* `value` - (Required) The value to use in the custom metric dimension.
+
+### Destination
+
+The `destination` block supports the following argument:
+
+* `address_definition` - (Required)  An IP address or a block of IP addresses in CIDR notation. AWS Network Firewall supports all address ranges for IPv4.
+
+### Destination Port
+
+The `destination_port` block supports the following arguments:
+
+* `from_port` - (Required) The lower limit of the port range. This must be less than or equal to the `to_port`.
+
+* `to_port` - (Optional) The upper limit of the port range. This must be greater than or equal to the `from_port`.
+
+### Source
+
+The `source` block supports the following argument:
+
+* `address_definition` - (Required)  An IP address or a block of IP addresses in CIDR notation. AWS Network Firewall supports all address ranges for IPv4.
+
+### Source Port
+
+The `source_port` block supports the following arguments:
+
+* `from_port` - (Required) The lower limit of the port range. This must be less than or equal to the `to_port`.
+
+* `to_port` - (Optional) The upper limit of the port range. This must be greater than or equal to the `from_port`.
+
+### TCP Flag
+
+The `tcp_flag` block supports the following arguments:
+
+* `flags` - (Required) Set of flags to look for in a packet. This setting can only specify values that are also specified in `masks`.
+Valid values: `FIN`, `SYN`, `RST`, `PSH`, `ACK`, `URG`, `ECE`, `CWR`.
+
+* `masks` - (Optional) Set of flags to consider in the inspection. To inspect all flags, leave this empty.
+Valid values: `FIN`, `SYN`, `RST`, `PSH`, `ACK`, `URG`, `ECE`, `CWR`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Amazon Resource Name (ARN) that identifies the rule group.
+
+* `arn` - The Amazon Resource Name (ARN) that identifies the rule group.
+
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+* `update_token` - A string token used when updating the rule group.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Network Firewall Rule Groups using their `arn`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Network Firewall Rule Groups using their `arn`. For example:
+
+```console
+% terraform import aws_networkfirewall_rule_group.example arn:aws:network-firewall:us-west-1:123456789012:stateful-rulegroup/example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ef93e2bf518258ff78b58b7d51462d1757a12fe5ecae8c6b421815590aa49874 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/networkmanager_attachment_accepter.html.markdown b/website/docs/cdktf/python/r/networkmanager_attachment_accepter.html.markdown
new file mode 100644
index 00000000000..0e8a20e3870
--- /dev/null
+++ b/website/docs/cdktf/python/r/networkmanager_attachment_accepter.html.markdown
@@ -0,0 +1,77 @@
+---
+subcategory: "Network Manager"
+layout: "aws"
+page_title: "AWS: aws_networkmanager_attachment_accepter"
+description: |-
+  Terraform resource for managing an AWS NetworkManager Attachment Accepter.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_networkmanager_attachment_accepter
+
+Terraform resource for managing an AWS NetworkManager Attachment Accepter.
+
+## Example Usage
+
+### Example with VPC attachment
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.networkmanager_attachment_accepter import NetworkmanagerAttachmentAccepter
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        NetworkmanagerAttachmentAccepter(self, "test",
+            attachment_id=vpc.id,
+            attachment_type=vpc.attachment_type
+        )
+```
+
+### Example with site-to-site VPN attachment
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.networkmanager_attachment_accepter import NetworkmanagerAttachmentAccepter
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        NetworkmanagerAttachmentAccepter(self, "test",
+            attachment_id=vpn.id,
+            attachment_type=vpn.attachment_type
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+- `attachment_id` - (Required) The ID of the attachment.
+- `attachment_type` - (Required) The type of attachment. Valid values can be found in the [AWS Documentation](https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_ListAttachments.html#API_ListAttachments_RequestSyntax)
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+- `attachment_policy_rule_number` - The policy rule number associated with the attachment.
+- `core_network_arn` - The ARN of a core network.
+- `core_network_id` - The id of a core network.
+- `edge_location` - The Region where the edge is located.
+- `owner_account_id` - The ID of the attachment account owner.
+- `resource_arn` - The attachment resource ARN.
+- `segment_name` - The name of the segment attachment.
+- `state` - The state of the attachment.
+
+<!-- cache-key: cdktf-0.18.0 input-b61e3d1e0402ca6c95ad2bb8ec92a7c9a9eb878f9b4a262494c1d80ad87d6549 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/networkmanager_connect_attachment.html.markdown b/website/docs/cdktf/python/r/networkmanager_connect_attachment.html.markdown
new file mode 100644
index 00000000000..bbd37607aae
--- /dev/null
+++ b/website/docs/cdktf/python/r/networkmanager_connect_attachment.html.markdown
@@ -0,0 +1,149 @@
+---
+subcategory: "Network Manager"
+layout: "aws"
+page_title: "AWS: aws_networkmanager_connect_attachment"
+description: |-
+  Terraform resource for managing an AWS NetworkManager ConnectAttachment.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_networkmanager_connect_attachment
+
+Terraform resource for managing an AWS NetworkManager ConnectAttachment.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, Fn, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.networkmanager_connect_attachment import NetworkmanagerConnectAttachment
+from imports.aws.networkmanager_vpc_attachment import NetworkmanagerVpcAttachment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = NetworkmanagerVpcAttachment(self, "example",
+            core_network_id=Token.as_string(awscc_networkmanager_core_network_example.id),
+            subnet_arns=Token.as_list(Fn.lookup_nested(aws_subnet_example, ["*", "arn"])),
+            vpc_arn=Token.as_string(aws_vpc_example.arn)
+        )
+        aws_networkmanager_connect_attachment_example =
+        NetworkmanagerConnectAttachment(self, "example_1",
+            core_network_id=Token.as_string(awscc_networkmanager_core_network_example.id),
+            edge_location=example.edge_location,
+            options=NetworkmanagerConnectAttachmentOptions(
+                protocol="GRE"
+            ),
+            transport_attachment_id=example.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_networkmanager_connect_attachment_example.override_logical_id("example")
+```
+
+### Usage with attachment accepter
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, Fn, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.networkmanager_attachment_accepter import NetworkmanagerAttachmentAccepter
+from imports.aws.networkmanager_connect_attachment import NetworkmanagerConnectAttachment
+from imports.aws.networkmanager_vpc_attachment import NetworkmanagerVpcAttachment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = NetworkmanagerVpcAttachment(self, "example",
+            core_network_id=Token.as_string(awscc_networkmanager_core_network_example.id),
+            subnet_arns=Token.as_list(Fn.lookup_nested(aws_subnet_example, ["*", "arn"])),
+            vpc_arn=Token.as_string(aws_vpc_example.arn)
+        )
+        aws_networkmanager_attachment_accepter_example =
+        NetworkmanagerAttachmentAccepter(self, "example_1",
+            attachment_id=example.id,
+            attachment_type=example.attachment_type
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_networkmanager_attachment_accepter_example.override_logical_id("example")
+        aws_networkmanager_connect_attachment_example =
+        NetworkmanagerConnectAttachment(self, "example_2",
+            core_network_id=Token.as_string(awscc_networkmanager_core_network_example.id),
+            depends_on=["aws_networkmanager_attachment_accepter.test"],
+            edge_location=example.edge_location,
+            options=NetworkmanagerConnectAttachmentOptions(
+                protocol="GRE"
+            ),
+            transport_attachment_id=example.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_networkmanager_connect_attachment_example.override_logical_id("example")
+        NetworkmanagerAttachmentAccepter(self, "example2",
+            attachment_id=Token.as_string(aws_networkmanager_connect_attachment_example.id),
+            attachment_type=Token.as_string(aws_networkmanager_connect_attachment_example.attachment_type)
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+- `core_network_id` - (Required) The ID of a core network where you want to create the attachment.
+- `transport_attachment_id` - (Required) The ID of the attachment between the two connections.
+- `edge_location` - (Required) The Region where the edge is located.
+- `options` - (Required) Options block. See [options](#options) for more information.
+
+The following arguments are optional:
+
+- `tags` - (Optional) Key-value tags for the attachment. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### options
+
+* `protocol` - (Required) The protocol used for the attachment connection. Possible values are `GRE` and `NO_ENCAP`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+- `arn` - The ARN of the attachment.
+- `attachment_policy_rule_number` - The policy rule number associated with the attachment.
+- `attachment_type` - The type of attachment.
+- `core_network_arn` - The ARN of a core network.
+- `core_network_id` - The ID of a core network
+- `edge_location` - The Region where the edge is located.
+- `id` - The ID of the attachment.
+- `owner_account_id` - The ID of the attachment account owner.
+- `resource_arn` - The attachment resource ARN.
+- `segment_name` - The name of the segment attachment.
+- `state` - The state of the attachment.
+- `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_networkmanager_connect_attachment` using the attachment ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_networkmanager_connect_attachment` using the attachment ID. For example:
+
+```console
+% terraform import aws_networkmanager_connect_attachment.example attachment-0f8fa60d2238d1bd8
+```
+
+<!-- cache-key: cdktf-0.18.0 input-2fa317624ffa5a6fd592516211f62a2c5fd04acb1f1cab83fc9a598feab08b2d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/networkmanager_connect_peer.html.markdown b/website/docs/cdktf/python/r/networkmanager_connect_peer.html.markdown
new file mode 100644
index 00000000000..350f87343b3
--- /dev/null
+++ b/website/docs/cdktf/python/r/networkmanager_connect_peer.html.markdown
@@ -0,0 +1,210 @@
+---
+subcategory: "Network Manager"
+layout: "aws"
+page_title: "AWS: aws_networkmanager_connect_peer"
+description: |-
+  Terraform resource for managing an AWS NetworkManager Connect Peer.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_networkmanager_connect_peer
+
+Terraform resource for managing an AWS NetworkManager Connect Peer.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, Fn, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.networkmanager_connect_attachment import NetworkmanagerConnectAttachment
+from imports.aws.networkmanager_connect_peer import NetworkmanagerConnectPeer
+from imports.aws.networkmanager_vpc_attachment import NetworkmanagerVpcAttachment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = NetworkmanagerVpcAttachment(self, "example",
+            core_network_id=Token.as_string(awscc_networkmanager_core_network_example.id),
+            subnet_arns=Token.as_list(Fn.lookup_nested(aws_subnet_example, ["*", "arn"])),
+            vpc_arn=Token.as_string(aws_vpc_example.arn)
+        )
+        aws_networkmanager_connect_attachment_example =
+        NetworkmanagerConnectAttachment(self, "example_1",
+            core_network_id=Token.as_string(awscc_networkmanager_core_network_example.id),
+            edge_location=example.edge_location,
+            options=NetworkmanagerConnectAttachmentOptions(
+                protocol="GRE"
+            ),
+            transport_attachment_id=example.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_networkmanager_connect_attachment_example.override_logical_id("example")
+        aws_networkmanager_connect_peer_example = NetworkmanagerConnectPeer(self, "example_2",
+            bgp_options=NetworkmanagerConnectPeerBgpOptions(
+                peer_asn=65000
+            ),
+            connect_attachment_id=Token.as_string(aws_networkmanager_connect_attachment_example.id),
+            inside_cidr_blocks=["172.16.0.0/16"],
+            peer_address="127.0.0.1"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_networkmanager_connect_peer_example.override_logical_id("example")
+```
+
+### Usage with attachment accepter
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, Fn, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.networkmanager_attachment_accepter import NetworkmanagerAttachmentAccepter
+from imports.aws.networkmanager_connect_attachment import NetworkmanagerConnectAttachment
+from imports.aws.networkmanager_connect_peer import NetworkmanagerConnectPeer
+from imports.aws.networkmanager_vpc_attachment import NetworkmanagerVpcAttachment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = NetworkmanagerVpcAttachment(self, "example",
+            core_network_id=Token.as_string(awscc_networkmanager_core_network_example.id),
+            subnet_arns=Token.as_list(Fn.lookup_nested(aws_subnet_example, ["*", "arn"])),
+            vpc_arn=Token.as_string(aws_vpc_example.arn)
+        )
+        aws_networkmanager_attachment_accepter_example =
+        NetworkmanagerAttachmentAccepter(self, "example_1",
+            attachment_id=example.id,
+            attachment_type=example.attachment_type
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_networkmanager_attachment_accepter_example.override_logical_id("example")
+        aws_networkmanager_connect_attachment_example =
+        NetworkmanagerConnectAttachment(self, "example_2",
+            core_network_id=Token.as_string(awscc_networkmanager_core_network_example.id),
+            depends_on=["aws_networkmanager_attachment_accepter.test"],
+            edge_location=example.edge_location,
+            options=NetworkmanagerConnectAttachmentOptions(
+                protocol="GRE"
+            ),
+            transport_attachment_id=example.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_networkmanager_connect_attachment_example.override_logical_id("example")
+        aws_networkmanager_connect_peer_example = NetworkmanagerConnectPeer(self, "example_3",
+            bgp_options=NetworkmanagerConnectPeerBgpOptions(
+                peer_asn=65500
+            ),
+            connect_attachment_id=Token.as_string(aws_networkmanager_connect_attachment_example.id),
+            depends_on=["aws_networkmanager_attachment_accepter.example2"],
+            inside_cidr_blocks=["172.16.0.0/16"],
+            peer_address="127.0.0.1"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_networkmanager_connect_peer_example.override_logical_id("example")
+        NetworkmanagerAttachmentAccepter(self, "example2",
+            attachment_id=Token.as_string(aws_networkmanager_connect_attachment_example.id),
+            attachment_type=Token.as_string(aws_networkmanager_connect_attachment_example.attachment_type)
+        )
+```
+
+### Usage with a Tunnel-less Connect attachment
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, Fn, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.networkmanager_connect_attachment import NetworkmanagerConnectAttachment
+from imports.aws.networkmanager_connect_peer import NetworkmanagerConnectPeer
+from imports.aws.networkmanager_vpc_attachment import NetworkmanagerVpcAttachment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, insideCidrBlocks):
+        super().__init__(scope, name)
+        example = NetworkmanagerVpcAttachment(self, "example",
+            core_network_id=Token.as_string(awscc_networkmanager_core_network_example.id),
+            subnet_arns=Token.as_list(Fn.lookup_nested(aws_subnet_example, ["*", "arn"])),
+            vpc_arn=Token.as_string(aws_vpc_example.arn)
+        )
+        aws_networkmanager_connect_attachment_example =
+        NetworkmanagerConnectAttachment(self, "example_1",
+            core_network_id=Token.as_string(awscc_networkmanager_core_network_example.id),
+            edge_location=example.edge_location,
+            options=NetworkmanagerConnectAttachmentOptions(
+                protocol="NO_ENCAP"
+            ),
+            transport_attachment_id=example.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_networkmanager_connect_attachment_example.override_logical_id("example")
+        aws_networkmanager_connect_peer_example = NetworkmanagerConnectPeer(self, "example_2",
+            bgp_options=NetworkmanagerConnectPeerBgpOptions(
+                peer_asn=65000
+            ),
+            connect_attachment_id=Token.as_string(aws_networkmanager_connect_attachment_example.id),
+            peer_address="127.0.0.1",
+            subnet_arn=test2.arn,
+            inside_cidr_blocks=inside_cidr_blocks
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_networkmanager_connect_peer_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+- `connect_attachment_id` - (Required) The ID of the connection attachment.
+- `peer_address` - (Required) The Connect peer address.
+
+The following arguments are optional:
+
+- `bgp_options` (Optional) The Connect peer BGP options.
+- `core_network_address` (Optional) A Connect peer core network address.
+- `inside_cidr_blocks` - (Optional) The inside IP addresses used for BGP peering. Required when the Connect attachment protocol is `GRE`. See [`aws_networkmanager_connect_attachment`](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/networkmanager_connect_attachment) for details.
+- `subnet_arn` - (Optional) The subnet ARN for the Connect peer. Required when the Connect attachment protocol is `NO_ENCAP`. See [`aws_networkmanager_connect_attachment`](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/networkmanager_connect_attachment) for details.
+- `tags` - (Optional) Key-value tags for the attachment. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+- `arn` - The ARN of the attachment.
+- `configuration` - The configuration of the Connect peer.
+- `core_network_id` - The ID of a core network.
+- `edge_location` - The Region where the peer is located.
+- `id` - The ID of the Connect peer.
+- `state` - The state of the Connect peer.
+- `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_networkmanager_connect_peer` using the connect peer ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_networkmanager_connect_peer` using the connect peer ID. For example:
+
+```console
+% terraform import aws_networkmanager_connect_peer.example connect-peer-061f3e96275db1acc
+```
+
+<!-- cache-key: cdktf-0.18.0 input-010c7af9870efaa2d4e70fcf20dd0a8279a972e0005dd5005199d0f3752a0ded -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/networkmanager_connection.html.markdown b/website/docs/cdktf/python/r/networkmanager_connection.html.markdown
new file mode 100644
index 00000000000..867ad0500e6
--- /dev/null
+++ b/website/docs/cdktf/python/r/networkmanager_connection.html.markdown
@@ -0,0 +1,75 @@
+---
+subcategory: "Network Manager"
+layout: "aws"
+page_title: "AWS: aws_networkmanager_connection"
+description: |-
+  Creates a connection between two devices.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_networkmanager_connection
+
+Creates a connection between two devices.
+The devices can be a physical or virtual appliance that connects to a third-party appliance in a VPC, or a physical appliance that connects to another physical appliance in an on-premises network.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.networkmanager_connection import NetworkmanagerConnection
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        NetworkmanagerConnection(self, "example",
+            connected_device_id=example2.id,
+            device_id=example1.id,
+            global_network_id=Token.as_string(aws_networkmanager_global_network_example.id)
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `connected_device_id` - (Required) The ID of the second device in the connection.
+* `connected_link_id` - (Optional) The ID of the link for the second device.
+* `description` - (Optional) A description of the connection.
+* `device_id` - (Required) The ID of the first device in the connection.
+* `global_network_id` - (Required) The ID of the global network.
+* `link_id` - (Optional) The ID of the link for the first device.
+* `tags` - (Optional) Key-value tags for the connection. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the connection.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_networkmanager_connection` using the connection ARN. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_networkmanager_connection` using the connection ARN. For example:
+
+```console
+% terraform import aws_networkmanager_connection.example arn:aws:networkmanager::123456789012:device/global-network-0d47f6t230mz46dy4/connection-07f6fd08867abc123
+```
+
+<!-- cache-key: cdktf-0.18.0 input-950e6f1e6e30f9c05d70308c91abfbf81e3cb619be3e1bdef3b486654d0ee394 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/networkmanager_core_network.html.markdown b/website/docs/cdktf/python/r/networkmanager_core_network.html.markdown
new file mode 100644
index 00000000000..d8e22b99b09
--- /dev/null
+++ b/website/docs/cdktf/python/r/networkmanager_core_network.html.markdown
@@ -0,0 +1,524 @@
+---
+subcategory: "Network Manager"
+layout: "aws"
+page_title: "AWS: aws_networkmanager_core_network"
+description: |-
+  Provides a core network resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_networkmanager_core_network
+
+Provides a core network resource.
+
+## Example Usage
+
+### Basic
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.networkmanager_core_network import NetworkmanagerCoreNetwork
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        NetworkmanagerCoreNetwork(self, "example",
+            global_network_id=Token.as_string(aws_networkmanager_global_network_example.id)
+        )
+```
+
+### With description
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.networkmanager_core_network import NetworkmanagerCoreNetwork
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        NetworkmanagerCoreNetwork(self, "example",
+            description="example",
+            global_network_id=Token.as_string(aws_networkmanager_global_network_example.id)
+        )
+```
+
+### With tags
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.networkmanager_core_network import NetworkmanagerCoreNetwork
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        NetworkmanagerCoreNetwork(self, "example",
+            global_network_id=Token.as_string(aws_networkmanager_global_network_example.id),
+            tags={
+                "hello": "world"
+            }
+        )
+```
+
+### With VPC Attachment (Single Region)
+
+The example below illustrates the scenario where your policy document has static routes pointing to VPC attachments and you want to attach your VPCs to the core network before applying the desired policy document. Set the `create_base_policy` argument to `true` if your core network does not currently have any `LIVE` policies (e.g. this is the first `terraform apply` with the core network resource), since a `LIVE` policy is required before VPCs can be attached to the core network. Otherwise, if your core network already has a `LIVE` policy, you may exclude the `create_base_policy` argument. There are 2 options to implement this:
+
+- Option 1: Use the `base_policy_document` argument that allows the most customizations to a base policy. Use this to customize the `edge_locations` `asn`. In the example below, `us-west-2` and ASN `65500` are used in the base policy.
+- Option 2: Use the `create_base_policy` argument only. This creates a base policy in the region specified in the `provider` block.
+
+#### Option 1 - using base_policy_document
+
+If you require a custom ASN for the edge location, please use the `base_policy_document` argument to pass a specific ASN. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, Fn, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_networkmanager_core_network_policy_document import DataAwsNetworkmanagerCoreNetworkPolicyDocument
+from imports.aws.networkmanager_core_network import NetworkmanagerCoreNetwork
+from imports.aws.networkmanager_core_network_policy_attachment import NetworkmanagerCoreNetworkPolicyAttachment
+from imports.aws.networkmanager_global_network import NetworkmanagerGlobalNetwork
+from imports.aws.networkmanager_vpc_attachment import NetworkmanagerVpcAttachment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = NetworkmanagerGlobalNetwork(self, "example")
+        base = DataAwsNetworkmanagerCoreNetworkPolicyDocument(self, "base",
+            core_network_configuration=[DataAwsNetworkmanagerCoreNetworkPolicyDocumentCoreNetworkConfiguration(
+                asn_ranges=["65022-65534"],
+                edge_locations=[DataAwsNetworkmanagerCoreNetworkPolicyDocumentCoreNetworkConfigurationEdgeLocations(
+                    asn="65500",
+                    location="us-west-2"
+                )
+                ]
+            )
+            ],
+            segments=[DataAwsNetworkmanagerCoreNetworkPolicyDocumentSegments(
+                name="segment"
+            )
+            ]
+        )
+        aws_networkmanager_core_network_example = NetworkmanagerCoreNetwork(self, "example_2",
+            base_policy_document=Token.as_string(base.json),
+            create_base_policy=True,
+            global_network_id=example.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_networkmanager_core_network_example.override_logical_id("example")
+        aws_networkmanager_vpc_attachment_example =
+        NetworkmanagerVpcAttachment(self, "example_3",
+            core_network_id=Token.as_string(aws_networkmanager_core_network_example.id),
+            subnet_arns=Token.as_list(
+                Fn.lookup_nested(aws_subnet_example, ["*", "arn"])),
+            vpc_arn=Token.as_string(aws_vpc_example.arn)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_networkmanager_vpc_attachment_example.override_logical_id("example")
+        data_aws_networkmanager_core_network_policy_document_example =
+        DataAwsNetworkmanagerCoreNetworkPolicyDocument(self, "example_4",
+            core_network_configuration=[DataAwsNetworkmanagerCoreNetworkPolicyDocumentCoreNetworkConfiguration(
+                asn_ranges=["65022-65534"],
+                edge_locations=[DataAwsNetworkmanagerCoreNetworkPolicyDocumentCoreNetworkConfigurationEdgeLocations(
+                    asn="65500",
+                    location="us-west-2"
+                )
+                ]
+            )
+            ],
+            segment_actions=[DataAwsNetworkmanagerCoreNetworkPolicyDocumentSegmentActions(
+                action="create-route",
+                destination_cidr_blocks=["0.0.0.0/0"],
+                destinations=[
+                    Token.as_string(aws_networkmanager_vpc_attachment_example.id)
+                ],
+                segment="segment"
+            )
+            ],
+            segments=[DataAwsNetworkmanagerCoreNetworkPolicyDocumentSegments(
+                name="segment"
+            )
+            ]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_networkmanager_core_network_policy_document_example.override_logical_id("example")
+        aws_networkmanager_core_network_policy_attachment_example =
+        NetworkmanagerCoreNetworkPolicyAttachment(self, "example_5",
+            core_network_id=Token.as_string(aws_networkmanager_core_network_example.id),
+            policy_document=Token.as_string(data_aws_networkmanager_core_network_policy_document_example.json)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_networkmanager_core_network_policy_attachment_example.override_logical_id("example")
+```
+
+#### Option 2 - create_base_policy only
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, Fn, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_networkmanager_core_network_policy_document import DataAwsNetworkmanagerCoreNetworkPolicyDocument
+from imports.aws.networkmanager_core_network import NetworkmanagerCoreNetwork
+from imports.aws.networkmanager_core_network_policy_attachment import NetworkmanagerCoreNetworkPolicyAttachment
+from imports.aws.networkmanager_global_network import NetworkmanagerGlobalNetwork
+from imports.aws.networkmanager_vpc_attachment import NetworkmanagerVpcAttachment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = NetworkmanagerGlobalNetwork(self, "example")
+        aws_networkmanager_core_network_example = NetworkmanagerCoreNetwork(self, "example_1",
+            create_base_policy=True,
+            global_network_id=example.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_networkmanager_core_network_example.override_logical_id("example")
+        aws_networkmanager_vpc_attachment_example =
+        NetworkmanagerVpcAttachment(self, "example_2",
+            core_network_id=Token.as_string(aws_networkmanager_core_network_example.id),
+            subnet_arns=Token.as_list(
+                Fn.lookup_nested(aws_subnet_example, ["*", "arn"])),
+            vpc_arn=Token.as_string(aws_vpc_example.arn)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_networkmanager_vpc_attachment_example.override_logical_id("example")
+        data_aws_networkmanager_core_network_policy_document_example =
+        DataAwsNetworkmanagerCoreNetworkPolicyDocument(self, "example_3",
+            core_network_configuration=[DataAwsNetworkmanagerCoreNetworkPolicyDocumentCoreNetworkConfiguration(
+                asn_ranges=["65022-65534"],
+                edge_locations=[DataAwsNetworkmanagerCoreNetworkPolicyDocumentCoreNetworkConfigurationEdgeLocations(
+                    location="us-west-2"
+                )
+                ]
+            )
+            ],
+            segment_actions=[DataAwsNetworkmanagerCoreNetworkPolicyDocumentSegmentActions(
+                action="create-route",
+                destination_cidr_blocks=["0.0.0.0/0"],
+                destinations=[
+                    Token.as_string(aws_networkmanager_vpc_attachment_example.id)
+                ],
+                segment="segment"
+            )
+            ],
+            segments=[DataAwsNetworkmanagerCoreNetworkPolicyDocumentSegments(
+                name="segment"
+            )
+            ]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_networkmanager_core_network_policy_document_example.override_logical_id("example")
+        aws_networkmanager_core_network_policy_attachment_example =
+        NetworkmanagerCoreNetworkPolicyAttachment(self, "example_4",
+            core_network_id=Token.as_string(aws_networkmanager_core_network_example.id),
+            policy_document=Token.as_string(data_aws_networkmanager_core_network_policy_document_example.json)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_networkmanager_core_network_policy_attachment_example.override_logical_id("example")
+```
+
+### With VPC Attachment (Multi-Region)
+
+The example below illustrates the scenario where your policy document has static routes pointing to VPC attachments and you want to attach your VPCs to the core network before applying the desired policy document. Set the `create_base_policy` argument of the [`aws_networkmanager_core_network` resource](/docs/providers/aws/r/networkmanager_core_network.html) to `true` if your core network does not currently have any `LIVE` policies (e.g. this is the first `terraform apply` with the core network resource), since a `LIVE` policy is required before VPCs can be attached to the core network. Otherwise, if your core network already has a `LIVE` policy, you may exclude the `create_base_policy` argument. For multi-region in a core network that does not yet have a `LIVE` policy, there are 2 options:
+
+- Option 1: Use the `base_policy_document` argument that allows the most customizations to a base policy. Use this to customize the `edge_locations` `asn`. In the example below, `us-west-2`, `us-east-1` and specific ASNs are used in the base policy.
+- Option 2: Pass a list of regions to the `aws_networkmanager_core_network` `base_policy_regions` argument. In the example below, `us-west-2` and `us-east-1` are specified in the base policy.
+
+#### Option 1 - using base_policy_document
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, Fn, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_networkmanager_core_network_policy_document import DataAwsNetworkmanagerCoreNetworkPolicyDocument
+from imports.aws.networkmanager_core_network import NetworkmanagerCoreNetwork
+from imports.aws.networkmanager_core_network_policy_attachment import NetworkmanagerCoreNetworkPolicyAttachment
+from imports.aws.networkmanager_global_network import NetworkmanagerGlobalNetwork
+from imports.aws.networkmanager_vpc_attachment import NetworkmanagerVpcAttachment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = NetworkmanagerGlobalNetwork(self, "example")
+        base = DataAwsNetworkmanagerCoreNetworkPolicyDocument(self, "base",
+            core_network_configuration=[DataAwsNetworkmanagerCoreNetworkPolicyDocumentCoreNetworkConfiguration(
+                asn_ranges=["65022-65534"],
+                edge_locations=[DataAwsNetworkmanagerCoreNetworkPolicyDocumentCoreNetworkConfigurationEdgeLocations(
+                    asn="65500",
+                    location="us-west-2"
+                ), DataAwsNetworkmanagerCoreNetworkPolicyDocumentCoreNetworkConfigurationEdgeLocations(
+                    asn="65501",
+                    location="us-east-1"
+                )
+                ]
+            )
+            ],
+            segments=[DataAwsNetworkmanagerCoreNetworkPolicyDocumentSegments(
+                name="segment"
+            )
+            ]
+        )
+        aws_networkmanager_core_network_example = NetworkmanagerCoreNetwork(self, "example_2",
+            base_policy_document=Token.as_string(base.json),
+            create_base_policy=True,
+            global_network_id=example.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_networkmanager_core_network_example.override_logical_id("example")
+        example_us_east1 = NetworkmanagerVpcAttachment(self, "example_us_east_1",
+            core_network_id=Token.as_string(aws_networkmanager_core_network_example.id),
+            provider="alternate",
+            subnet_arns=Token.as_list(
+                Fn.lookup_nested(aws_subnet_example_us_east1, ["*", "arn"])),
+            vpc_arn=Token.as_string(aws_vpc_example_us_east1.arn)
+        )
+        example_us_west2 = NetworkmanagerVpcAttachment(self, "example_us_west_2",
+            core_network_id=Token.as_string(aws_networkmanager_core_network_example.id),
+            subnet_arns=Token.as_list(
+                Fn.lookup_nested(aws_subnet_example_us_west2, ["*", "arn"])),
+            vpc_arn=Token.as_string(aws_vpc_example_us_west2.arn)
+        )
+        data_aws_networkmanager_core_network_policy_document_example =
+        DataAwsNetworkmanagerCoreNetworkPolicyDocument(self, "example_5",
+            core_network_configuration=[DataAwsNetworkmanagerCoreNetworkPolicyDocumentCoreNetworkConfiguration(
+                asn_ranges=["65022-65534"],
+                edge_locations=[DataAwsNetworkmanagerCoreNetworkPolicyDocumentCoreNetworkConfigurationEdgeLocations(
+                    asn="65500",
+                    location="us-west-2"
+                ), DataAwsNetworkmanagerCoreNetworkPolicyDocumentCoreNetworkConfigurationEdgeLocations(
+                    asn="65501",
+                    location="us-east-1"
+                )
+                ]
+            )
+            ],
+            segment_actions=[DataAwsNetworkmanagerCoreNetworkPolicyDocumentSegmentActions(
+                action="create-route",
+                destination_cidr_blocks=["10.0.0.0/16"],
+                destinations=[example_us_west2.id],
+                segment="segment"
+            ), DataAwsNetworkmanagerCoreNetworkPolicyDocumentSegmentActions(
+                action="create-route",
+                destination_cidr_blocks=["10.1.0.0/16"],
+                destinations=[example_us_east1.id],
+                segment="segment"
+            )
+            ],
+            segments=[DataAwsNetworkmanagerCoreNetworkPolicyDocumentSegments(
+                name="segment"
+            ), DataAwsNetworkmanagerCoreNetworkPolicyDocumentSegments(
+                name="segment2"
+            )
+            ]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_networkmanager_core_network_policy_document_example.override_logical_id("example")
+        aws_networkmanager_core_network_policy_attachment_example =
+        NetworkmanagerCoreNetworkPolicyAttachment(self, "example_6",
+            core_network_id=Token.as_string(aws_networkmanager_core_network_example.id),
+            policy_document=Token.as_string(data_aws_networkmanager_core_network_policy_document_example.json)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_networkmanager_core_network_policy_attachment_example.override_logical_id("example")
+```
+
+#### Option 2 - using base_policy_regions
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, Fn, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_networkmanager_core_network_policy_document import DataAwsNetworkmanagerCoreNetworkPolicyDocument
+from imports.aws.networkmanager_core_network import NetworkmanagerCoreNetwork
+from imports.aws.networkmanager_core_network_policy_attachment import NetworkmanagerCoreNetworkPolicyAttachment
+from imports.aws.networkmanager_global_network import NetworkmanagerGlobalNetwork
+from imports.aws.networkmanager_vpc_attachment import NetworkmanagerVpcAttachment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = NetworkmanagerGlobalNetwork(self, "example")
+        aws_networkmanager_core_network_example = NetworkmanagerCoreNetwork(self, "example_1",
+            base_policy_regions=["us-west-2", "us-east-1"],
+            create_base_policy=True,
+            global_network_id=example.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_networkmanager_core_network_example.override_logical_id("example")
+        example_us_east1 = NetworkmanagerVpcAttachment(self, "example_us_east_1",
+            core_network_id=Token.as_string(aws_networkmanager_core_network_example.id),
+            provider="alternate",
+            subnet_arns=Token.as_list(
+                Fn.lookup_nested(aws_subnet_example_us_east1, ["*", "arn"])),
+            vpc_arn=Token.as_string(aws_vpc_example_us_east1.arn)
+        )
+        example_us_west2 = NetworkmanagerVpcAttachment(self, "example_us_west_2",
+            core_network_id=Token.as_string(aws_networkmanager_core_network_example.id),
+            subnet_arns=Token.as_list(
+                Fn.lookup_nested(aws_subnet_example_us_west2, ["*", "arn"])),
+            vpc_arn=Token.as_string(aws_vpc_example_us_west2.arn)
+        )
+        data_aws_networkmanager_core_network_policy_document_example =
+        DataAwsNetworkmanagerCoreNetworkPolicyDocument(self, "example_4",
+            core_network_configuration=[DataAwsNetworkmanagerCoreNetworkPolicyDocumentCoreNetworkConfiguration(
+                asn_ranges=["65022-65534"],
+                edge_locations=[DataAwsNetworkmanagerCoreNetworkPolicyDocumentCoreNetworkConfigurationEdgeLocations(
+                    location="us-west-2"
+                ), DataAwsNetworkmanagerCoreNetworkPolicyDocumentCoreNetworkConfigurationEdgeLocations(
+                    location="us-east-1"
+                )
+                ]
+            )
+            ],
+            segment_actions=[DataAwsNetworkmanagerCoreNetworkPolicyDocumentSegmentActions(
+                action="create-route",
+                destination_cidr_blocks=["10.0.0.0/16"],
+                destinations=[example_us_west2.id],
+                segment="segment"
+            ), DataAwsNetworkmanagerCoreNetworkPolicyDocumentSegmentActions(
+                action="create-route",
+                destination_cidr_blocks=["10.1.0.0/16"],
+                destinations=[example_us_east1.id],
+                segment="segment"
+            )
+            ],
+            segments=[DataAwsNetworkmanagerCoreNetworkPolicyDocumentSegments(
+                name="segment"
+            ), DataAwsNetworkmanagerCoreNetworkPolicyDocumentSegments(
+                name="segment2"
+            )
+            ]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_networkmanager_core_network_policy_document_example.override_logical_id("example")
+        aws_networkmanager_core_network_policy_attachment_example =
+        NetworkmanagerCoreNetworkPolicyAttachment(self, "example_5",
+            core_network_id=Token.as_string(aws_networkmanager_core_network_example.id),
+            policy_document=Token.as_string(data_aws_networkmanager_core_network_policy_document_example.json)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_networkmanager_core_network_policy_attachment_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `description` - (Optional) Description of the Core Network.
+* `base_policy_document` - (Optional, conflicts with `base_policy_region`, `base_policy_regions`) Sets the base policy document for the core network. Refer to the [Core network policies documentation](https://docs.aws.amazon.com/network-manager/latest/cloudwan/cloudwan-policy-change-sets.html) for more information.
+* `base_policy_region` - (Optional, **Deprecated** use the `base_policy_regions` or `base_policy_document` argument instead) The base policy created by setting the `create_base_policy` argument to `true` requires a region to be set in the `edge-locations`, `location` key. If `base_policy_region` is not specified, the region used in the base policy defaults to the region specified in the `provider` block.
+* `base_policy_regions` - (Optional, conflicts with `base_policy_region`, `base_policy_document`) A list of regions to add to the base policy. The base policy created by setting the `create_base_policy` argument to `true` requires one or more regions to be set in the `edge-locations`, `location` key. If `base_policy_regions` is not specified, the region used in the base policy defaults to the region specified in the `provider` block.
+* `create_base_policy` - (Optional) Specifies whether to create a base policy when a core network is created or updated. A base policy is created and set to `LIVE` to allow attachments to the core network (e.g. VPC Attachments) before applying a policy document provided using the [`aws_networkmanager_core_network_policy_attachment` resource](/docs/providers/aws/r/networkmanager_core_network_policy_attachment.html). This base policy is needed if your core network does not have any `LIVE` policies and your policy document has static routes pointing to VPC attachments and you want to attach your VPCs to the core network before applying the desired policy document. Valid values are `true` or `false`. An example of this Terraform snippet can be found above [for VPC Attachment in a single region](#with-vpc-attachment-single-region) and [for VPC Attachment multi-region](#with-vpc-attachment-multi-region). An example base policy is shown below. This base policy is overridden with the policy that you specify in the [`aws_networkmanager_core_network_policy_attachment` resource](/docs/providers/aws/r/networkmanager_core_network_policy_attachment.html).
+
+```json
+{
+  "version": "2021.12",
+  "core-network-configuration": {
+    "asn-ranges": [
+      "64512-65534"
+    ],
+    "vpn-ecmp-support": false,
+    "edge-locations": [
+      {
+        "location": "us-east-1"
+      }
+    ]
+  },
+  "segments": [
+    {
+      "name": "segment",
+      "description": "base-policy",
+      "isolate-attachments": false,
+      "require-attachment-acceptance": false
+    }
+  ]
+}
+```
+
+* `global_network_id` - (Required) The ID of the global network that a core network will be a part of.
+* `tags` - (Optional) Key-value tags for the Core Network. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `30m`)
+* `delete` - (Default `30m`)
+* `update` - (Default `30m`)
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Core Network Amazon Resource Name (ARN).
+* `created_at` - Timestamp when a core network was created.
+* `edges` - One or more blocks detailing the edges within a core network. [Detailed below](#edges).
+* `id` - Core Network ID.
+* `segments` - One or more blocks detailing the segments within a core network. [Detailed below](#segments).
+* `state` - Current state of a core network.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+### `edges`
+
+The `edges` configuration block supports the following arguments:
+
+* `asn` - ASN of a core network edge.
+* `edge_location` - Region where a core network edge is located.
+* `inside_cidr_blocks` - Inside IP addresses used for core network edges.
+
+### `segments`
+
+The `segments` configuration block supports the following arguments:
+
+* `edge_locations` - Regions where the edges are located.
+* `name` - Name of a core network segment.
+* `shared_segments` - Shared segments of a core network.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_networkmanager_core_network` using the core network ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_networkmanager_core_network` using the core network ID. For example:
+
+```console
+% terraform import aws_networkmanager_core_network.example core-network-0d47f6t230mz46dy4
+```
+
+<!-- cache-key: cdktf-0.18.0 input-65bc1bb6eff4f779705d87b8ae3f33739b14d06acb55ff16a01c2f5413f72a00 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/networkmanager_core_network_policy_attachment.html.markdown b/website/docs/cdktf/python/r/networkmanager_core_network_policy_attachment.html.markdown
new file mode 100644
index 00000000000..967166ecf33
--- /dev/null
+++ b/website/docs/cdktf/python/r/networkmanager_core_network_policy_attachment.html.markdown
@@ -0,0 +1,435 @@
+---
+subcategory: "Network Manager"
+layout: "aws"
+page_title: "AWS: aws_networkmanager_core_network_policy_attachment"
+description: |-
+  Provides a Core Network Policy Attachment resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_networkmanager_core_network_policy_attachment
+
+Provides a Core Network Policy Attachment resource. This puts a Core Network Policy to an existing Core Network and executes the change set, which deploys changes globally based on the policy submitted (Sets the policy to `LIVE`).
+
+~> **NOTE:** Deleting this resource will not delete the current policy defined in this resource. Deleting this resource will also not revert the current `LIVE` policy to the previous version.
+
+## Example Usage
+
+### Basic
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.networkmanager_core_network import NetworkmanagerCoreNetwork
+from imports.aws.networkmanager_core_network_policy_attachment import NetworkmanagerCoreNetworkPolicyAttachment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = NetworkmanagerCoreNetwork(self, "example",
+            global_network_id=Token.as_string(aws_networkmanager_global_network_example.id)
+        )
+        aws_networkmanager_core_network_policy_attachment_example =
+        NetworkmanagerCoreNetworkPolicyAttachment(self, "example_1",
+            core_network_id=example.id,
+            policy_document=Token.as_string(data_aws_networkmanager_core_network_policy_document_example.json)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_networkmanager_core_network_policy_attachment_example.override_logical_id("example")
+```
+
+### With VPC Attachment (Single Region)
+
+The example below illustrates the scenario where your policy document has static routes pointing to VPC attachments and you want to attach your VPCs to the core network before applying the desired policy document. Set the `create_base_policy` argument of the [`aws_networkmanager_core_network` resource](/docs/providers/aws/r/networkmanager_core_network.html) to `true` if your core network does not currently have any `LIVE` policies (e.g. this is the first `terraform apply` with the core network resource), since a `LIVE` policy is required before VPCs can be attached to the core network. Otherwise, if your core network already has a `LIVE` policy, you may exclude the `create_base_policy` argument. There are 2 options to implement this:
+
+- Option 1: Use the `base_policy_document` argument in the [`aws_networkmanager_core_network` resource](/docs/providers/aws/r/networkmanager_core_network.html) that allows the most customizations to a base policy. Use this to customize the `edge_locations` `asn`. In the example below, `us-west-2` and ASN `65500` are used in the base policy.
+- Option 2: Use the `create_base_policy` argument only. This creates a base policy in the region specified in the `provider` block.
+
+#### Option 1 - using base_policy_document
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, Fn, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_networkmanager_core_network_policy_document import DataAwsNetworkmanagerCoreNetworkPolicyDocument
+from imports.aws.networkmanager_core_network import NetworkmanagerCoreNetwork
+from imports.aws.networkmanager_core_network_policy_attachment import NetworkmanagerCoreNetworkPolicyAttachment
+from imports.aws.networkmanager_global_network import NetworkmanagerGlobalNetwork
+from imports.aws.networkmanager_vpc_attachment import NetworkmanagerVpcAttachment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = NetworkmanagerGlobalNetwork(self, "example")
+        base = DataAwsNetworkmanagerCoreNetworkPolicyDocument(self, "base",
+            core_network_configuration=[DataAwsNetworkmanagerCoreNetworkPolicyDocumentCoreNetworkConfiguration(
+                asn_ranges=["65022-65534"],
+                edge_locations=[DataAwsNetworkmanagerCoreNetworkPolicyDocumentCoreNetworkConfigurationEdgeLocations(
+                    asn="65500",
+                    location="us-west-2"
+                )
+                ]
+            )
+            ],
+            segments=[DataAwsNetworkmanagerCoreNetworkPolicyDocumentSegments(
+                name="segment"
+            )
+            ]
+        )
+        aws_networkmanager_core_network_example = NetworkmanagerCoreNetwork(self, "example_2",
+            base_policy_document=Token.as_string(base.json),
+            create_base_policy=True,
+            global_network_id=example.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_networkmanager_core_network_example.override_logical_id("example")
+        aws_networkmanager_vpc_attachment_example =
+        NetworkmanagerVpcAttachment(self, "example_3",
+            core_network_id=Token.as_string(aws_networkmanager_core_network_example.id),
+            subnet_arns=Token.as_list(
+                Fn.lookup_nested(aws_subnet_example, ["*", "arn"])),
+            vpc_arn=Token.as_string(aws_vpc_example.arn)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_networkmanager_vpc_attachment_example.override_logical_id("example")
+        data_aws_networkmanager_core_network_policy_document_example =
+        DataAwsNetworkmanagerCoreNetworkPolicyDocument(self, "example_4",
+            core_network_configuration=[DataAwsNetworkmanagerCoreNetworkPolicyDocumentCoreNetworkConfiguration(
+                asn_ranges=["65022-65534"],
+                edge_locations=[DataAwsNetworkmanagerCoreNetworkPolicyDocumentCoreNetworkConfigurationEdgeLocations(
+                    asn="65500",
+                    location="us-west-2"
+                )
+                ]
+            )
+            ],
+            segment_actions=[DataAwsNetworkmanagerCoreNetworkPolicyDocumentSegmentActions(
+                action="create-route",
+                destination_cidr_blocks=["0.0.0.0/0"],
+                destinations=[
+                    Token.as_string(aws_networkmanager_vpc_attachment_example.id)
+                ],
+                segment="segment"
+            )
+            ],
+            segments=[DataAwsNetworkmanagerCoreNetworkPolicyDocumentSegments(
+                name="segment"
+            )
+            ]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_networkmanager_core_network_policy_document_example.override_logical_id("example")
+        aws_networkmanager_core_network_policy_attachment_example =
+        NetworkmanagerCoreNetworkPolicyAttachment(self, "example_5",
+            core_network_id=Token.as_string(aws_networkmanager_core_network_example.id),
+            policy_document=Token.as_string(data_aws_networkmanager_core_network_policy_document_example.json)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_networkmanager_core_network_policy_attachment_example.override_logical_id("example")
+```
+
+#### Option 2 - create_base_policy only
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, Fn, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_networkmanager_core_network_policy_document import DataAwsNetworkmanagerCoreNetworkPolicyDocument
+from imports.aws.networkmanager_core_network import NetworkmanagerCoreNetwork
+from imports.aws.networkmanager_core_network_policy_attachment import NetworkmanagerCoreNetworkPolicyAttachment
+from imports.aws.networkmanager_global_network import NetworkmanagerGlobalNetwork
+from imports.aws.networkmanager_vpc_attachment import NetworkmanagerVpcAttachment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = NetworkmanagerGlobalNetwork(self, "example")
+        aws_networkmanager_core_network_example = NetworkmanagerCoreNetwork(self, "example_1",
+            create_base_policy=True,
+            global_network_id=example.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_networkmanager_core_network_example.override_logical_id("example")
+        aws_networkmanager_vpc_attachment_example =
+        NetworkmanagerVpcAttachment(self, "example_2",
+            core_network_id=Token.as_string(aws_networkmanager_core_network_example.id),
+            subnet_arns=Token.as_list(
+                Fn.lookup_nested(aws_subnet_example, ["*", "arn"])),
+            vpc_arn=Token.as_string(aws_vpc_example.arn)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_networkmanager_vpc_attachment_example.override_logical_id("example")
+        data_aws_networkmanager_core_network_policy_document_example =
+        DataAwsNetworkmanagerCoreNetworkPolicyDocument(self, "example_3",
+            core_network_configuration=[DataAwsNetworkmanagerCoreNetworkPolicyDocumentCoreNetworkConfiguration(
+                asn_ranges=["65022-65534"],
+                edge_locations=[DataAwsNetworkmanagerCoreNetworkPolicyDocumentCoreNetworkConfigurationEdgeLocations(
+                    location="us-west-2"
+                )
+                ]
+            )
+            ],
+            segment_actions=[DataAwsNetworkmanagerCoreNetworkPolicyDocumentSegmentActions(
+                action="create-route",
+                destination_cidr_blocks=["0.0.0.0/0"],
+                destinations=[
+                    Token.as_string(aws_networkmanager_vpc_attachment_example.id)
+                ],
+                segment="segment"
+            )
+            ],
+            segments=[DataAwsNetworkmanagerCoreNetworkPolicyDocumentSegments(
+                name="segment"
+            )
+            ]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_networkmanager_core_network_policy_document_example.override_logical_id("example")
+        aws_networkmanager_core_network_policy_attachment_example =
+        NetworkmanagerCoreNetworkPolicyAttachment(self, "example_4",
+            core_network_id=Token.as_string(aws_networkmanager_core_network_example.id),
+            policy_document=Token.as_string(data_aws_networkmanager_core_network_policy_document_example.json)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_networkmanager_core_network_policy_attachment_example.override_logical_id("example")
+```
+
+### With VPC Attachment (Multi-Region)
+
+The example below illustrates the scenario where your policy document has static routes pointing to VPC attachments and you want to attach your VPCs to the core network before applying the desired policy document. Set the `create_base_policy` argument of the [`aws_networkmanager_core_network` resource](/docs/providers/aws/r/networkmanager_core_network.html) to `true` if your core network does not currently have any `LIVE` policies (e.g. this is the first `terraform apply` with the core network resource), since a `LIVE` policy is required before VPCs can be attached to the core network. Otherwise, if your core network already has a `LIVE` policy, you may exclude the `create_base_policy` argument. For multi-region in a core network that does not yet have a `LIVE` policy, there are 2 options:
+
+- Option 1: Use the `base_policy_document` argument that allows the most customizations to a base policy. Use this to customize the `edge_locations` `asn`. In the example below, `us-west-2`, `us-east-1` and specific ASNs are used in the base policy.
+- Option 2: Pass a list of regions to the [`aws_networkmanager_core_network` resource](/docs/providers/aws/r/networkmanager_core_network.html) `base_policy_regions` argument. In the example below, `us-west-2` and `us-east-1` are specified in the base policy.
+
+#### Option 1 - using base_policy_document
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, Fn, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_networkmanager_core_network_policy_document import DataAwsNetworkmanagerCoreNetworkPolicyDocument
+from imports.aws.networkmanager_core_network import NetworkmanagerCoreNetwork
+from imports.aws.networkmanager_core_network_policy_attachment import NetworkmanagerCoreNetworkPolicyAttachment
+from imports.aws.networkmanager_global_network import NetworkmanagerGlobalNetwork
+from imports.aws.networkmanager_vpc_attachment import NetworkmanagerVpcAttachment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = NetworkmanagerGlobalNetwork(self, "example")
+        base = DataAwsNetworkmanagerCoreNetworkPolicyDocument(self, "base",
+            core_network_configuration=[DataAwsNetworkmanagerCoreNetworkPolicyDocumentCoreNetworkConfiguration(
+                asn_ranges=["65022-65534"],
+                edge_locations=[DataAwsNetworkmanagerCoreNetworkPolicyDocumentCoreNetworkConfigurationEdgeLocations(
+                    asn="65500",
+                    location="us-west-2"
+                ), DataAwsNetworkmanagerCoreNetworkPolicyDocumentCoreNetworkConfigurationEdgeLocations(
+                    asn="65501",
+                    location="us-east-1"
+                )
+                ]
+            )
+            ],
+            segments=[DataAwsNetworkmanagerCoreNetworkPolicyDocumentSegments(
+                name="segment"
+            )
+            ]
+        )
+        aws_networkmanager_core_network_example = NetworkmanagerCoreNetwork(self, "example_2",
+            base_policy_document=Token.as_string(base.json),
+            create_base_policy=True,
+            global_network_id=example.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_networkmanager_core_network_example.override_logical_id("example")
+        example_us_east1 = NetworkmanagerVpcAttachment(self, "example_us_east_1",
+            core_network_id=Token.as_string(aws_networkmanager_core_network_example.id),
+            provider="alternate",
+            subnet_arns=Token.as_list(
+                Fn.lookup_nested(aws_subnet_example_us_east1, ["*", "arn"])),
+            vpc_arn=Token.as_string(aws_vpc_example_us_east1.arn)
+        )
+        example_us_west2 = NetworkmanagerVpcAttachment(self, "example_us_west_2",
+            core_network_id=Token.as_string(aws_networkmanager_core_network_example.id),
+            subnet_arns=Token.as_list(
+                Fn.lookup_nested(aws_subnet_example_us_west2, ["*", "arn"])),
+            vpc_arn=Token.as_string(aws_vpc_example_us_west2.arn)
+        )
+        data_aws_networkmanager_core_network_policy_document_example =
+        DataAwsNetworkmanagerCoreNetworkPolicyDocument(self, "example_5",
+            core_network_configuration=[DataAwsNetworkmanagerCoreNetworkPolicyDocumentCoreNetworkConfiguration(
+                asn_ranges=["65022-65534"],
+                edge_locations=[DataAwsNetworkmanagerCoreNetworkPolicyDocumentCoreNetworkConfigurationEdgeLocations(
+                    asn="65500",
+                    location="us-west-2"
+                ), DataAwsNetworkmanagerCoreNetworkPolicyDocumentCoreNetworkConfigurationEdgeLocations(
+                    asn="65501",
+                    location="us-east-1"
+                )
+                ]
+            )
+            ],
+            segment_actions=[DataAwsNetworkmanagerCoreNetworkPolicyDocumentSegmentActions(
+                action="create-route",
+                destination_cidr_blocks=["10.0.0.0/16"],
+                destinations=[example_us_west2.id],
+                segment="segment"
+            ), DataAwsNetworkmanagerCoreNetworkPolicyDocumentSegmentActions(
+                action="create-route",
+                destination_cidr_blocks=["10.1.0.0/16"],
+                destinations=[example_us_east1.id],
+                segment="segment"
+            )
+            ],
+            segments=[DataAwsNetworkmanagerCoreNetworkPolicyDocumentSegments(
+                name="segment"
+            ), DataAwsNetworkmanagerCoreNetworkPolicyDocumentSegments(
+                name="segment2"
+            )
+            ]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_networkmanager_core_network_policy_document_example.override_logical_id("example")
+        aws_networkmanager_core_network_policy_attachment_example =
+        NetworkmanagerCoreNetworkPolicyAttachment(self, "example_6",
+            core_network_id=Token.as_string(aws_networkmanager_core_network_example.id),
+            policy_document=Token.as_string(data_aws_networkmanager_core_network_policy_document_example.json)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_networkmanager_core_network_policy_attachment_example.override_logical_id("example")
+```
+
+#### Option 2 - using base_policy_regions
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, Fn, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_networkmanager_core_network_policy_document import DataAwsNetworkmanagerCoreNetworkPolicyDocument
+from imports.aws.networkmanager_core_network import NetworkmanagerCoreNetwork
+from imports.aws.networkmanager_core_network_policy_attachment import NetworkmanagerCoreNetworkPolicyAttachment
+from imports.aws.networkmanager_global_network import NetworkmanagerGlobalNetwork
+from imports.aws.networkmanager_vpc_attachment import NetworkmanagerVpcAttachment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = NetworkmanagerGlobalNetwork(self, "example")
+        aws_networkmanager_core_network_example = NetworkmanagerCoreNetwork(self, "example_1",
+            base_policy_regions=["us-west-2", "us-east-1"],
+            create_base_policy=True,
+            global_network_id=example.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_networkmanager_core_network_example.override_logical_id("example")
+        example_us_east1 = NetworkmanagerVpcAttachment(self, "example_us_east_1",
+            core_network_id=Token.as_string(aws_networkmanager_core_network_example.id),
+            provider="alternate",
+            subnet_arns=Token.as_list(
+                Fn.lookup_nested(aws_subnet_example_us_east1, ["*", "arn"])),
+            vpc_arn=Token.as_string(aws_vpc_example_us_east1.arn)
+        )
+        example_us_west2 = NetworkmanagerVpcAttachment(self, "example_us_west_2",
+            core_network_id=Token.as_string(aws_networkmanager_core_network_example.id),
+            subnet_arns=Token.as_list(
+                Fn.lookup_nested(aws_subnet_example_us_west2, ["*", "arn"])),
+            vpc_arn=Token.as_string(aws_vpc_example_us_west2.arn)
+        )
+        data_aws_networkmanager_core_network_policy_document_example =
+        DataAwsNetworkmanagerCoreNetworkPolicyDocument(self, "example_4",
+            core_network_configuration=[DataAwsNetworkmanagerCoreNetworkPolicyDocumentCoreNetworkConfiguration(
+                asn_ranges=["65022-65534"],
+                edge_locations=[DataAwsNetworkmanagerCoreNetworkPolicyDocumentCoreNetworkConfigurationEdgeLocations(
+                    location="us-west-2"
+                ), DataAwsNetworkmanagerCoreNetworkPolicyDocumentCoreNetworkConfigurationEdgeLocations(
+                    location="us-east-1"
+                )
+                ]
+            )
+            ],
+            segment_actions=[DataAwsNetworkmanagerCoreNetworkPolicyDocumentSegmentActions(
+                action="create-route",
+                destination_cidr_blocks=["10.0.0.0/16"],
+                destinations=[example_us_west2.id],
+                segment="segment"
+            ), DataAwsNetworkmanagerCoreNetworkPolicyDocumentSegmentActions(
+                action="create-route",
+                destination_cidr_blocks=["10.1.0.0/16"],
+                destinations=[example_us_east1.id],
+                segment="segment"
+            )
+            ],
+            segments=[DataAwsNetworkmanagerCoreNetworkPolicyDocumentSegments(
+                name="segment"
+            ), DataAwsNetworkmanagerCoreNetworkPolicyDocumentSegments(
+                name="segment2"
+            )
+            ]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_networkmanager_core_network_policy_document_example.override_logical_id("example")
+        aws_networkmanager_core_network_policy_attachment_example =
+        NetworkmanagerCoreNetworkPolicyAttachment(self, "example_5",
+            core_network_id=Token.as_string(aws_networkmanager_core_network_example.id),
+            policy_document=Token.as_string(data_aws_networkmanager_core_network_policy_document_example.json)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_networkmanager_core_network_policy_attachment_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `core_network_id` - (Required) The ID of the core network that a policy will be attached to and made `LIVE`.
+* `policy_document` - (Required) Policy document for creating a core network. Note that updating this argument will result in the new policy document version being set as the `LATEST` and `LIVE` policy document. Refer to the [Core network policies documentation](https://docs.aws.amazon.com/network-manager/latest/cloudwan/cloudwan-policy-change-sets.html) for more information.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `update` - (Default `30m`). If this is the first time attaching a policy to a core network then this timeout value is also used as the `create` timeout value.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `state` - Current state of a core network.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_networkmanager_core_network_policy_attachment` using the core network ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_networkmanager_core_network_policy_attachment` using the core network ID. For example:
+
+```console
+% terraform import aws_networkmanager_core_network_policy_attachment.example core-network-0d47f6t230mz46dy4
+```
+
+<!-- cache-key: cdktf-0.18.0 input-34a808698d2a9df593aff61b1eaca0c1844cef8687a30e103f1a946e027e2540 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/networkmanager_customer_gateway_association.html.markdown b/website/docs/cdktf/python/r/networkmanager_customer_gateway_association.html.markdown
new file mode 100644
index 00000000000..cd576064609
--- /dev/null
+++ b/website/docs/cdktf/python/r/networkmanager_customer_gateway_association.html.markdown
@@ -0,0 +1,121 @@
+---
+subcategory: "Network Manager"
+layout: "aws"
+page_title: "AWS: aws_networkmanager_customer_gateway_association"
+description: |-
+  Associates a customer gateway with a device and optionally, with a link.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_networkmanager_customer_gateway_association
+
+Associates a customer gateway with a device and optionally, with a link.
+If you specify a link, it must be associated with the specified device.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.customer_gateway import CustomerGateway
+from imports.aws.ec2_transit_gateway import Ec2TransitGateway
+from imports.aws.networkmanager_customer_gateway_association import NetworkmanagerCustomerGatewayAssociation
+from imports.aws.networkmanager_device import NetworkmanagerDevice
+from imports.aws.networkmanager_global_network import NetworkmanagerGlobalNetwork
+from imports.aws.networkmanager_site import NetworkmanagerSite
+from imports.aws.networkmanager_transit_gateway_registration import NetworkmanagerTransitGatewayRegistration
+from imports.aws.vpn_connection import VpnConnection
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = CustomerGateway(self, "example",
+            bgp_asn=Token.as_string(65000),
+            ip_address="172.83.124.10",
+            type="ipsec.1"
+        )
+        aws_ec2_transit_gateway_example = Ec2TransitGateway(self, "example_1")
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_ec2_transit_gateway_example.override_logical_id("example")
+        aws_networkmanager_global_network_example =
+        NetworkmanagerGlobalNetwork(self, "example_2",
+            description="example"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_networkmanager_global_network_example.override_logical_id("example")
+        aws_networkmanager_site_example = NetworkmanagerSite(self, "example_3",
+            global_network_id=Token.as_string(aws_networkmanager_global_network_example.id)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_networkmanager_site_example.override_logical_id("example")
+        aws_vpn_connection_example = VpnConnection(self, "example_4",
+            customer_gateway_id=example.id,
+            static_routes_only=True,
+            transit_gateway_id=Token.as_string(aws_ec2_transit_gateway_example.id),
+            type=example.type
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_vpn_connection_example.override_logical_id("example")
+        aws_networkmanager_device_example = NetworkmanagerDevice(self, "example_5",
+            global_network_id=Token.as_string(aws_networkmanager_global_network_example.id),
+            site_id=Token.as_string(aws_networkmanager_site_example.id)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_networkmanager_device_example.override_logical_id("example")
+        aws_networkmanager_transit_gateway_registration_example =
+        NetworkmanagerTransitGatewayRegistration(self, "example_6",
+            depends_on=[aws_vpn_connection_example],
+            global_network_id=Token.as_string(aws_networkmanager_global_network_example.id),
+            transit_gateway_arn=Token.as_string(aws_ec2_transit_gateway_example.arn)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_networkmanager_transit_gateway_registration_example.override_logical_id("example")
+        aws_networkmanager_customer_gateway_association_example =
+        NetworkmanagerCustomerGatewayAssociation(self, "example_7",
+            customer_gateway_arn=example.arn,
+            depends_on=[aws_networkmanager_transit_gateway_registration_example],
+            device_id=Token.as_string(aws_networkmanager_device_example.id),
+            global_network_id=Token.as_string(aws_networkmanager_global_network_example.id)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_networkmanager_customer_gateway_association_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `customer_gateway_arn` - (Required) The Amazon Resource Name (ARN) of the customer gateway.
+* `device_id` - (Required) The ID of the device.
+* `global_network_id` - (Required) The ID of the global network.
+* `link_id` - (Optional) The ID of the link.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_networkmanager_customer_gateway_association` using the global network ID and customer gateway ARN. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_networkmanager_customer_gateway_association` using the global network ID and customer gateway ARN. For example:
+
+```console
+% terraform import aws_networkmanager_customer_gateway_association.example global-network-0d47f6t230mz46dy4,arn:aws:ec2:us-west-2:123456789012:customer-gateway/cgw-123abc05e04123abc
+```
+
+<!-- cache-key: cdktf-0.18.0 input-cd1a421b3c65ae404d64a476a24edb9bade1479a58410f9962263fcdb24c17e1 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/networkmanager_device.html.markdown b/website/docs/cdktf/python/r/networkmanager_device.html.markdown
new file mode 100644
index 00000000000..fdc531e6d07
--- /dev/null
+++ b/website/docs/cdktf/python/r/networkmanager_device.html.markdown
@@ -0,0 +1,88 @@
+---
+subcategory: "Network Manager"
+layout: "aws"
+page_title: "AWS: aws_networkmanager_device"
+description: |-
+  Creates a device in a global network.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_networkmanager_device
+
+Creates a device in a global network. If you specify both a site ID and a location,
+the location of the site is used for visualization in the Network Manager console.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.networkmanager_device import NetworkmanagerDevice
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        NetworkmanagerDevice(self, "example",
+            global_network_id=Token.as_string(aws_networkmanager_global_network_example.id),
+            site_id=Token.as_string(aws_networkmanager_site_example.id)
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `aws_location` - (Optional) The AWS location of the device. Documented below.
+* `description` - (Optional) A description of the device.
+* `global_network_id` - (Required) The ID of the global network.
+* `location` - (Optional) The location of the device. Documented below.
+* `model` - (Optional) The model of device.
+* `serial_number` - (Optional) The serial number of the device.
+* `site_id` - (Optional) The ID of the site.
+* `tags` - (Optional) Key-value tags for the device. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `type` - (Optional) The type of device.
+* `vendor` - (Optional) The vendor of the device.
+
+The `aws_location` object supports the following:
+
+* `subnet_arn` - (Optional) The Amazon Resource Name (ARN) of the subnet that the device is located in.
+* `zone` - (Optional) The Zone that the device is located in. Specify the ID of an Availability Zone, Local Zone, Wavelength Zone, or an Outpost.
+
+The `location` object supports the following:
+
+* `address` - (Optional) The physical address.
+* `latitude` - (Optional) The latitude.
+* `longitude` - (Optional) The longitude.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the device.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_networkmanager_device` using the device ARN. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_networkmanager_device` using the device ARN. For example:
+
+```console
+% terraform import aws_networkmanager_device.example arn:aws:networkmanager::123456789012:device/global-network-0d47f6t230mz46dy4/device-07f6fd08867abc123
+```
+
+<!-- cache-key: cdktf-0.18.0 input-75ef73ba82c65c2eb02fee62646d84caef3f0d89552cdf12c29281e3363f4d2e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/networkmanager_global_network.html.markdown b/website/docs/cdktf/python/r/networkmanager_global_network.html.markdown
new file mode 100644
index 00000000000..af80584165e
--- /dev/null
+++ b/website/docs/cdktf/python/r/networkmanager_global_network.html.markdown
@@ -0,0 +1,67 @@
+---
+subcategory: "Network Manager"
+layout: "aws"
+page_title: "AWS: aws_networkmanager_global_network"
+description: |-
+  Provides a global network resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_networkmanager_global_network
+
+Provides a global network resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.networkmanager_global_network import NetworkmanagerGlobalNetwork
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        NetworkmanagerGlobalNetwork(self, "example",
+            description="example"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `description` - (Optional) Description of the Global Network.
+* `tags` - (Optional) Key-value tags for the Global Network. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Global Network Amazon Resource Name (ARN)
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_networkmanager_global_network` using the global network ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_networkmanager_global_network` using the global network ID. For example:
+
+```console
+% terraform import aws_networkmanager_global_network.example global-network-0d47f6t230mz46dy4
+```
+
+<!-- cache-key: cdktf-0.18.0 input-45d9523e4e6abfc2c3ebc1524528ff8ab02a7954716f34dfbebd84a6acf5efeb -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/networkmanager_link.html.markdown b/website/docs/cdktf/python/r/networkmanager_link.html.markdown
new file mode 100644
index 00000000000..d09be1ff5f5
--- /dev/null
+++ b/website/docs/cdktf/python/r/networkmanager_link.html.markdown
@@ -0,0 +1,83 @@
+---
+subcategory: "Network Manager"
+layout: "aws"
+page_title: "AWS: aws_networkmanager_link"
+description: |-
+  Creates a link for a site.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_networkmanager_link
+
+Creates a link for a site.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.networkmanager_link import NetworkmanagerLink
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        NetworkmanagerLink(self, "example",
+            bandwidth=NetworkmanagerLinkBandwidth(
+                download_speed=50,
+                upload_speed=10
+            ),
+            global_network_id=Token.as_string(aws_networkmanager_global_network_example.id),
+            provider_name="MegaCorp",
+            site_id=Token.as_string(aws_networkmanager_site_example.id)
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `bandwidth` - (Required) The upload speed and download speed in Mbps. Documented below.
+* `description` - (Optional) A description of the link.
+* `global_network_id` - (Required) The ID of the global network.
+* `provider_name` - (Optional) The provider of the link.
+* `site_id` - (Required) The ID of the site.
+* `tags` - (Optional) Key-value tags for the link. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `type` - (Optional) The type of the link.
+
+The `bandwidth` object supports the following:
+
+* `download_speed` - (Optional) Download speed in Mbps.
+* `upload_speed` - (Optional) Upload speed in Mbps.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Link Amazon Resource Name (ARN).
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_networkmanager_link` using the link ARN. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_networkmanager_link` using the link ARN. For example:
+
+```console
+% terraform import aws_networkmanager_link.example arn:aws:networkmanager::123456789012:link/global-network-0d47f6t230mz46dy4/link-444555aaabbb11223
+```
+
+<!-- cache-key: cdktf-0.18.0 input-b3264437514e087e6c9a780921c3cabb87dacb7cfc4e78ab6211866e572c1219 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/networkmanager_link_association.html.markdown b/website/docs/cdktf/python/r/networkmanager_link_association.html.markdown
new file mode 100644
index 00000000000..46f7d5d4c05
--- /dev/null
+++ b/website/docs/cdktf/python/r/networkmanager_link_association.html.markdown
@@ -0,0 +1,69 @@
+---
+subcategory: "Network Manager"
+layout: "aws"
+page_title: "AWS: aws_networkmanager_link_association"
+description: |-
+  Associates a link to a device.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_networkmanager_link_association
+
+Associates a link to a device.
+A device can be associated to multiple links and a link can be associated to multiple devices.
+The device and link must be in the same global network and the same site.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.networkmanager_link_association import NetworkmanagerLinkAssociation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        NetworkmanagerLinkAssociation(self, "example",
+            device_id=Token.as_string(aws_networkmanager_device_example.id),
+            global_network_id=Token.as_string(aws_networkmanager_global_network_example.id),
+            link_id=Token.as_string(aws_networkmanager_link_example.id)
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `device_id` - (Required) The ID of the device.
+* `global_network_id` - (Required) The ID of the global network.
+* `link_id` - (Required) The ID of the link.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_networkmanager_link_association` using the global network ID, link ID and device ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_networkmanager_link_association` using the global network ID, link ID and device ID. For example:
+
+```console
+% terraform import aws_networkmanager_link_association.example global-network-0d47f6t230mz46dy4,link-444555aaabbb11223,device-07f6fd08867abc123
+```
+
+<!-- cache-key: cdktf-0.18.0 input-40890ea635a372c98a61314c53c85c42d78dfac875eaa1ee3c91ed911965df30 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/networkmanager_site.html.markdown b/website/docs/cdktf/python/r/networkmanager_site.html.markdown
new file mode 100644
index 00000000000..12034788eb9
--- /dev/null
+++ b/website/docs/cdktf/python/r/networkmanager_site.html.markdown
@@ -0,0 +1,79 @@
+---
+subcategory: "Network Manager"
+layout: "aws"
+page_title: "AWS: aws_networkmanager_site"
+description: |-
+  Creates a site in a global network.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_networkmanager_site
+
+Creates a site in a global network.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.networkmanager_global_network import NetworkmanagerGlobalNetwork
+from imports.aws.networkmanager_site import NetworkmanagerSite
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = NetworkmanagerGlobalNetwork(self, "example")
+        aws_networkmanager_site_example = NetworkmanagerSite(self, "example_1",
+            global_network_id=example.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_networkmanager_site_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `global_network_id` - (Required) The ID of the Global Network to create the site in.
+* `description` - (Optional) Description of the Site.
+* `location` - (Optional) The site location as documented below.
+* `tags` - (Optional) Key-value tags for the Site. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+The `location` object supports the following:
+
+* `address` - (Optional) Address of the location.
+* `latitude` - (Optional) Latitude of the location.
+* `longitude` - (Optional) Longitude of the location.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Site Amazon Resource Name (ARN)
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_networkmanager_site` using the site ARN. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_networkmanager_site` using the site ARN. For example:
+
+```console
+% terraform import aws_networkmanager_site.example arn:aws:networkmanager::123456789012:site/global-network-0d47f6t230mz46dy4/site-444555aaabbb11223
+```
+
+<!-- cache-key: cdktf-0.18.0 input-e2d6d4d05d7119f51cca78b0e0f7b23a8b934476305b572e9b2f32c6097b5694 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/networkmanager_site_to_site_vpn_attachment.html.markdown b/website/docs/cdktf/python/r/networkmanager_site_to_site_vpn_attachment.html.markdown
new file mode 100644
index 00000000000..d14e12dd4f6
--- /dev/null
+++ b/website/docs/cdktf/python/r/networkmanager_site_to_site_vpn_attachment.html.markdown
@@ -0,0 +1,198 @@
+---
+subcategory: "Network Manager"
+layout: "aws"
+page_title: "AWS: aws_networkmanager_site_to_site_vpn_attachment"
+description: |-
+  Terraform resource for managing an AWS NetworkManager SiteToSiteAttachment.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_networkmanager_site_to_site_vpn_attachment
+
+Terraform resource for managing an AWS NetworkManager SiteToSiteAttachment.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.networkmanager_site_to_site_vpn_attachment import NetworkmanagerSiteToSiteVpnAttachment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        NetworkmanagerSiteToSiteVpnAttachment(self, "example",
+            core_network_id=Token.as_string(awscc_networkmanager_core_network_example.id),
+            vpn_connection_arn=Token.as_string(aws_vpn_connection_example.arn)
+        )
+```
+
+### Full Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, Fn, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.customer_gateway import CustomerGateway
+from imports.aws.data_aws_networkmanager_core_network_policy_document import DataAwsNetworkmanagerCoreNetworkPolicyDocument
+from imports.aws.networkmanager_attachment_accepter import NetworkmanagerAttachmentAccepter
+from imports.aws.networkmanager_global_network import NetworkmanagerGlobalNetwork
+from imports.aws.networkmanager_site_to_site_vpn_attachment import NetworkmanagerSiteToSiteVpnAttachment
+from imports.aws.vpn_connection import VpnConnection
+from imports.awscc.networkmanager_core_network import NetworkmanagerCoreNetwork
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        # The following providers are missing schema information and might need manual adjustments to synthesize correctly: awscc.
+        #     For a more precise conversion please use the --provider flag in convert.
+        test = CustomerGateway(self, "test",
+            bgp_asn=Token.as_string(65000),
+            ip_address="172.0.0.1",
+            type="ipsec.1"
+        )
+        aws_networkmanager_global_network_test = NetworkmanagerGlobalNetwork(self, "test_1",
+            tags={
+                "Name": "test"
+            }
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_networkmanager_global_network_test.override_logical_id("test")
+        aws_vpn_connection_test = VpnConnection(self, "test_2",
+            customer_gateway_id=test.id,
+            tags={
+                "Name": "test"
+            },
+            type="ipsec.1"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_vpn_connection_test.override_logical_id("test")
+        data_aws_networkmanager_core_network_policy_document_test =
+        DataAwsNetworkmanagerCoreNetworkPolicyDocument(self, "test_3",
+            attachment_policies=[DataAwsNetworkmanagerCoreNetworkPolicyDocumentAttachmentPolicies(
+                action=DataAwsNetworkmanagerCoreNetworkPolicyDocumentAttachmentPoliciesAction(
+                    association_method="constant",
+                    segment="shared"
+                ),
+                condition_logic="or",
+                conditions=[DataAwsNetworkmanagerCoreNetworkPolicyDocumentAttachmentPoliciesConditions(
+                    key="segment",
+                    operator="equals",
+                    type="tag-value",
+                    value="shared"
+                )
+                ],
+                rule_number=1
+            )
+            ],
+            core_network_configuration=[DataAwsNetworkmanagerCoreNetworkPolicyDocumentCoreNetworkConfiguration(
+                asn_ranges=["64512-64555"],
+                edge_locations=[DataAwsNetworkmanagerCoreNetworkPolicyDocumentCoreNetworkConfigurationEdgeLocations(
+                    asn=Token.as_string(64512),
+                    location=Token.as_string(current.name)
+                )
+                ],
+                vpn_ecmp_support=False
+            )
+            ],
+            segment_actions=[DataAwsNetworkmanagerCoreNetworkPolicyDocumentSegmentActions(
+                action="share",
+                mode="attachment-route",
+                segment="shared",
+                share_with=["*"]
+            )
+            ],
+            segments=[DataAwsNetworkmanagerCoreNetworkPolicyDocumentSegments(
+                description="SegmentForSharedServices",
+                name="shared",
+                require_attachment_acceptance=True
+            )
+            ]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_networkmanager_core_network_policy_document_test.override_logical_id("test")
+        awscc_networkmanager_core_network_test = NetworkmanagerCoreNetwork(self, "test_4",
+            global_network_id=aws_networkmanager_global_network_test.id,
+            policy_document=Fn.jsonencode(
+                Fn.jsondecode(
+                    Token.as_string(data_aws_networkmanager_core_network_policy_document_test.json)))
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        awscc_networkmanager_core_network_test.override_logical_id("test")
+        aws_networkmanager_site_to_site_vpn_attachment_test =
+        NetworkmanagerSiteToSiteVpnAttachment(self, "test_5",
+            core_network_id=Token.as_string(awscc_networkmanager_core_network_test.id),
+            tags={
+                "segment": "shared"
+            },
+            vpn_connection_arn=Token.as_string(aws_vpn_connection_test.arn)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_networkmanager_site_to_site_vpn_attachment_test.override_logical_id("test")
+        aws_networkmanager_attachment_accepter_test =
+        NetworkmanagerAttachmentAccepter(self, "test_6",
+            attachment_id=Token.as_string(aws_networkmanager_site_to_site_vpn_attachment_test.id),
+            attachment_type=Token.as_string(aws_networkmanager_site_to_site_vpn_attachment_test.attachment_type)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_networkmanager_attachment_accepter_test.override_logical_id("test")
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+- `core_network_id` - (Required) The ID of a core network for the VPN attachment.
+- `vpn_connection_arn` - (Required) The ARN of the site-to-site VPN connection.
+
+The following arguments are optional:
+
+- `tags` - (Optional) Key-value tags for the attachment. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+- `arn` - The ARN of the attachment.
+- `attachment_policy_rule_number` - The policy rule number associated with the attachment.
+- `attachment_type` - The type of attachment.
+- `core_network_arn` - The ARN of a core network.
+- `core_network_id` - The ID of a core network
+- `edge_location` - The Region where the edge is located.
+- `id` - The ID of the attachment.
+- `owner_account_id` - The ID of the attachment account owner.
+- `resource_arn` - The attachment resource ARN.
+- `segment_name` - The name of the segment attachment.
+- `state` - The state of the attachment.
+- `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_networkmanager_site_to_site_vpn_attachment` using the attachment ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_networkmanager_site_to_site_vpn_attachment` using the attachment ID. For example:
+
+```console
+% terraform import aws_networkmanager_site_to_site_vpn_attachment.example attachment-0f8fa60d2238d1bd8
+```
+
+<!-- cache-key: cdktf-0.18.0 input-8d596e286a25ca280c4219b11ff4ee7e96e1f115294bc53f7b30dbfae1998f54 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/networkmanager_transit_gateway_connect_peer_association.html.markdown b/website/docs/cdktf/python/r/networkmanager_transit_gateway_connect_peer_association.html.markdown
new file mode 100644
index 00000000000..9fbb04cb538
--- /dev/null
+++ b/website/docs/cdktf/python/r/networkmanager_transit_gateway_connect_peer_association.html.markdown
@@ -0,0 +1,69 @@
+---
+subcategory: "Network Manager"
+layout: "aws"
+page_title: "AWS: aws_networkmanager_transit_gateway_connect_peer_association"
+description: |-
+  Associates a transit gateway Connect peer with a device, and optionally, with a link.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_networkmanager_transit_gateway_connect_peer_association
+
+Associates a transit gateway Connect peer with a device, and optionally, with a link.
+If you specify a link, it must be associated with the specified device.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.networkmanager_transit_gateway_connect_peer_association import NetworkmanagerTransitGatewayConnectPeerAssociation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        NetworkmanagerTransitGatewayConnectPeerAssociation(self, "example",
+            device_id=Token.as_string(aws_networkmanager_device_example.id),
+            global_network_id=Token.as_string(aws_networkmanager_global_network_example.id),
+            transit_gateway_connect_peer_arn=Token.as_string(aws_ec2_transit_gateway_connect_peer_example.arn)
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `device_id` - (Required) The ID of the device.
+* `global_network_id` - (Required) The ID of the global network.
+* `link_id` - (Optional) The ID of the link.
+* `transit_gateway_connect_peer_arn` - (Required) The Amazon Resource Name (ARN) of the Connect peer.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_networkmanager_transit_gateway_connect_peer_association` using the global network ID and customer gateway ARN. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_networkmanager_transit_gateway_connect_peer_association` using the global network ID and customer gateway ARN. For example:
+
+```console
+% terraform import aws_networkmanager_transit_gateway_connect_peer_association.example global-network-0d47f6t230mz46dy4,arn:aws:ec2:us-west-2:123456789012:transit-gateway-connect-peer/tgw-connect-peer-12345678
+```
+
+<!-- cache-key: cdktf-0.18.0 input-863f9d20566b9aac9a5ea20d426d5a2e936d36dc5871ea1c3796a2beebaed7ea -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/networkmanager_transit_gateway_peering.html.markdown b/website/docs/cdktf/python/r/networkmanager_transit_gateway_peering.html.markdown
new file mode 100644
index 00000000000..67835378414
--- /dev/null
+++ b/website/docs/cdktf/python/r/networkmanager_transit_gateway_peering.html.markdown
@@ -0,0 +1,76 @@
+---
+subcategory: "Network Manager"
+layout: "aws"
+page_title: "AWS: aws_networkmanager_transit_gateway_peering"
+description: |-
+  Creates a peering connection between an AWS Cloud WAN core network and an AWS Transit Gateway.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_networkmanager_transit_gateway_peering
+
+Creates a peering connection between an AWS Cloud WAN core network and an AWS Transit Gateway.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.networkmanager_transit_gateway_peering import NetworkmanagerTransitGatewayPeering
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        NetworkmanagerTransitGatewayPeering(self, "example",
+            core_network_id=Token.as_string(awscc_networkmanager_core_network_example.id),
+            transit_gateway_arn=Token.as_string(aws_ec2_transit_gateway_example.arn)
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `core_network_id` - (Required) The ID of a core network.
+* `tags` - (Optional) Key-value tags for the peering. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `transit_gateway_arn` - (Required) The ARN of the transit gateway for the peering request.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Peering Amazon Resource Name (ARN).
+* `core_network_arn` - The ARN of the core network.
+* `edge_location` - The edge location for the peer.
+* `id` - Peering ID.
+* `owner_account_id` - The ID of the account owner.
+* `peering_type` - The type of peering. This will be `TRANSIT_GATEWAY`.
+* `resource_arn` - The resource ARN of the peer.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `transit_gateway_peering_attachment_id` - The ID of the transit gateway peering attachment.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_networkmanager_transit_gateway_peering` using the peering ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_networkmanager_transit_gateway_peering` using the peering ID. For example:
+
+```console
+% terraform import aws_networkmanager_transit_gateway_peering.example peering-444555aaabbb11223
+```
+
+<!-- cache-key: cdktf-0.18.0 input-850761bfb6bc5f1c587cc31180329d6f710f011b3f0be9c3b8ba3055502f296f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/networkmanager_transit_gateway_registration.html.markdown b/website/docs/cdktf/python/r/networkmanager_transit_gateway_registration.html.markdown
new file mode 100644
index 00000000000..cff9521c774
--- /dev/null
+++ b/website/docs/cdktf/python/r/networkmanager_transit_gateway_registration.html.markdown
@@ -0,0 +1,79 @@
+---
+subcategory: "Network Manager"
+layout: "aws"
+page_title: "AWS: aws_networkmanager_transit_gateway_registration"
+description: |-
+  Registers a transit gateway to a global network.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_networkmanager_transit_gateway_registration
+
+Registers a transit gateway to a global network. The transit gateway can be in any AWS Region,
+but it must be owned by the same AWS account that owns the global network.
+You cannot register a transit gateway in more than one global network.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ec2_transit_gateway import Ec2TransitGateway
+from imports.aws.networkmanager_global_network import NetworkmanagerGlobalNetwork
+from imports.aws.networkmanager_transit_gateway_registration import NetworkmanagerTransitGatewayRegistration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = Ec2TransitGateway(self, "example")
+        aws_networkmanager_global_network_example =
+        NetworkmanagerGlobalNetwork(self, "example_1",
+            description="example"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_networkmanager_global_network_example.override_logical_id("example")
+        aws_networkmanager_transit_gateway_registration_example =
+        NetworkmanagerTransitGatewayRegistration(self, "example_2",
+            global_network_id=Token.as_string(aws_networkmanager_global_network_example.id),
+            transit_gateway_arn=example.arn
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_networkmanager_transit_gateway_registration_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `global_network_id` - (Required) The ID of the Global Network to register to.
+* `transit_gateway_arn` - (Required) The ARN of the Transit Gateway to register.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_networkmanager_transit_gateway_registration` using the global network ID and transit gateway ARN. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_networkmanager_transit_gateway_registration` using the global network ID and transit gateway ARN. For example:
+
+```console
+% terraform import aws_networkmanager_transit_gateway_registration.example global-network-0d47f6t230mz46dy4,arn:aws:ec2:us-west-2:123456789012:transit-gateway/tgw-123abc05e04123abc
+```
+
+<!-- cache-key: cdktf-0.18.0 input-8baed1ca903bd794c7c27da978d545077eb8d2bb46a566626335caaaaad7c781 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/networkmanager_transit_gateway_route_table_attachment.html.markdown b/website/docs/cdktf/python/r/networkmanager_transit_gateway_route_table_attachment.html.markdown
new file mode 100644
index 00000000000..7be2c34ee19
--- /dev/null
+++ b/website/docs/cdktf/python/r/networkmanager_transit_gateway_route_table_attachment.html.markdown
@@ -0,0 +1,79 @@
+---
+subcategory: "Network Manager"
+layout: "aws"
+page_title: "AWS: aws_networkmanager_transit_gateway_route_table_attachment"
+description: |-
+  Creates a transit gateway route table attachment.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_networkmanager_transit_gateway_route_table_attachment
+
+Creates a transit gateway route table attachment.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.networkmanager_transit_gateway_route_table_attachment import NetworkmanagerTransitGatewayRouteTableAttachment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        NetworkmanagerTransitGatewayRouteTableAttachment(self, "example",
+            peering_id=Token.as_string(aws_networkmanager_transit_gateway_peering_example.id),
+            transit_gateway_route_table_arn=Token.as_string(aws_ec2_transit_gateway_route_table_example.arn)
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `peering_id` - (Required) The ID of the peer for the attachment.
+* `tags` - (Optional) Key-value tags for the attachment. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `transit_gateway_route_table_arn` - (Required) The ARN of the transit gateway route table for the attachment.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Attachment Amazon Resource Name (ARN).
+* `attachment_policy_rule_number` - The policy rule number associated with the attachment.
+* `attachment_type` - The type of attachment.
+* `core_network_arn` - The ARN of the core network.
+* `core_network_id` - The ID of the core network.
+* `edge_location` - The edge location for the peer.
+* `id` - The ID of the attachment.
+* `owner_account_id` - The ID of the attachment account owner.
+* `resource_arn` - The attachment resource ARN.
+* `segment_name` - The name of the segment attachment.
+* `state` - The state of the attachment.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_networkmanager_transit_gateway_route_table_attachment` using the attachment ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_networkmanager_transit_gateway_route_table_attachment` using the attachment ID. For example:
+
+```console
+% terraform import aws_networkmanager_transit_gateway_route_table_attachment.example attachment-0f8fa60d2238d1bd8
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1ea4ce87abed77ca848c109f032b462efb14526d9c3148fc83fd547b44feb72e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/networkmanager_vpc_attachment.html.markdown b/website/docs/cdktf/python/r/networkmanager_vpc_attachment.html.markdown
new file mode 100644
index 00000000000..ca951dfbcb0
--- /dev/null
+++ b/website/docs/cdktf/python/r/networkmanager_vpc_attachment.html.markdown
@@ -0,0 +1,91 @@
+---
+subcategory: "Network Manager"
+layout: "aws"
+page_title: "AWS: aws_networkmanager_vpc_attachment"
+description: |-
+  Terraform resource for managing an AWS NetworkManager VpcAttachment.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_networkmanager_vpc_attachment
+
+Terraform resource for managing an AWS NetworkManager VpcAttachment.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.networkmanager_vpc_attachment import NetworkmanagerVpcAttachment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        NetworkmanagerVpcAttachment(self, "example",
+            core_network_id=Token.as_string(awscc_networkmanager_core_network_example.id),
+            subnet_arns=[Token.as_string(aws_subnet_example.arn)],
+            vpc_arn=Token.as_string(aws_vpc_example.arn)
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `core_network_id` - (Required) The ID of a core network for the VPC attachment.
+* `subnet_arns` - (Required) The subnet ARN of the VPC attachment.
+* `vpc_arn` - (Required) The ARN of the VPC.
+
+The following arguments are optional:
+
+* `options` - (Optional) Options for the VPC attachment.
+* `tags` - (Optional) Key-value tags for the attachment. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### options
+
+* `appliance_mode_support` - (Optional) Indicates whether appliance mode is supported. If enabled, traffic flow between a source and destination use the same Availability Zone for the VPC attachment for the lifetime of that flow.
+* `ipv6_support` - (Optional) Indicates whether IPv6 is supported.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the attachment.
+* `attachment_policy_rule_number` - The policy rule number associated with the attachment.
+* `attachment_type` - The type of attachment.
+* `core_network_arn` - The ARN of a core network.
+* `edge_location` - The Region where the edge is located.
+* `id` - The ID of the attachment.
+* `owner_account_id` - The ID of the attachment account owner.
+* `resource_arn` - The attachment resource ARN.
+* `segment_name` - The name of the segment attachment.
+* `state` - The state of the attachment.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_networkmanager_vpc_attachment` using the attachment ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_networkmanager_vpc_attachment` using the attachment ID. For example:
+
+```console
+% terraform import aws_networkmanager_vpc_attachment.example attachment-0f8fa60d2238d1bd8
+```
+
+<!-- cache-key: cdktf-0.18.0 input-51496cec261cc73e7833584a7c4c9acbbf6b57c40ae69eab70820ff738d73283 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/oam_link.html.markdown b/website/docs/cdktf/python/r/oam_link.html.markdown
new file mode 100644
index 00000000000..3e2dbd36446
--- /dev/null
+++ b/website/docs/cdktf/python/r/oam_link.html.markdown
@@ -0,0 +1,89 @@
+---
+subcategory: "CloudWatch Observability Access Manager"
+layout: "aws"
+page_title: "AWS: aws_oam_link"
+description: |-
+  Terraform resource for managing an AWS CloudWatch Observability Access Manager Link.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_oam_link
+
+Terraform resource for managing an AWS CloudWatch Observability Access Manager Link.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.oam_link import OamLink
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        OamLink(self, "example",
+            label_template="$AccountName",
+            resource_types=["AWS::CloudWatch::Metric"],
+            sink_identifier=test.id,
+            tags={
+                "Env": "prod"
+            }
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `label_template` - (Required) Human-readable name to use to identify this source account when you are viewing data from it in the monitoring account.
+* `resource_types` - (Required) Types of data that the source account shares with the monitoring account.
+* `sink_identifier` - (Required) Identifier of the sink to use to create this link.
+
+The following arguments are optional:
+
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the link.
+* `label` - Label that is assigned to this link.
+* `link_id` - ID string that AWS generated as part of the link ARN.
+* `sink_arn` - ARN of the sink that is used for this link.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `1m`)
+* `update` - (Default `1m`)
+* `delete` - (Default `1m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudWatch Observability Access Manager Link using the `arn`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import CloudWatch Observability Access Manager Link using the `arn`. For example:
+
+```console
+% terraform import aws_oam_link.example arn:aws:oam:us-west-2:123456789012:link/link-id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ff78965c47d628d5cd420e2503ed25c914c1d4493bc3eefc1a9e530ca1d58967 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/oam_sink.html.markdown b/website/docs/cdktf/python/r/oam_sink.html.markdown
new file mode 100644
index 00000000000..0bc91ef0de8
--- /dev/null
+++ b/website/docs/cdktf/python/r/oam_sink.html.markdown
@@ -0,0 +1,83 @@
+---
+subcategory: "CloudWatch Observability Access Manager"
+layout: "aws"
+page_title: "AWS: aws_oam_sink"
+description: |-
+  Terraform resource for managing an AWS CloudWatch Observability Access Manager Sink.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_oam_sink
+
+Terraform resource for managing an AWS CloudWatch Observability Access Manager Sink.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.oam_sink import OamSink
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        OamSink(self, "example",
+            name="ExampleSink",
+            tags={
+                "Env": "prod"
+            }
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) Name for the sink.
+
+The following arguments are optional:
+
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Sink.
+* `sink_id` - ID string that AWS generated as part of the sink ARN.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `1m`)
+* `update` - (Default `1m`)
+* `delete` - (Default `1m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudWatch Observability Access Manager Sink using the `arn`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import CloudWatch Observability Access Manager Sink using the `arn`. For example:
+
+```console
+% terraform import aws_oam_sink.example arn:aws:oam:us-west-2:123456789012:sink/sink-id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-bfac1b8a7916df1eba20033d354f70066d912081ba258d1753faa7d442661fb5 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/oam_sink_policy.html.markdown b/website/docs/cdktf/python/r/oam_sink_policy.html.markdown
new file mode 100644
index 00000000000..31c1b80498e
--- /dev/null
+++ b/website/docs/cdktf/python/r/oam_sink_policy.html.markdown
@@ -0,0 +1,101 @@
+---
+subcategory: "CloudWatch Observability Access Manager"
+layout: "aws"
+page_title: "AWS: aws_oam_sink_policy"
+description: |-
+  Terraform resource for managing an AWS CloudWatch Observability Access Manager Sink Policy.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_oam_sink_policy
+
+Terraform resource for managing an AWS CloudWatch Observability Access Manager Sink Policy.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.oam_sink import OamSink
+from imports.aws.oam_sink_policy import OamSinkPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = OamSink(self, "example",
+            name="ExampleSink"
+        )
+        aws_oam_sink_policy_example = OamSinkPolicy(self, "example_1",
+            policy=Token.as_string(
+                Fn.jsonencode({
+                    "Statement": [{
+                        "Action": ["oam:CreateLink", "oam:UpdateLink"],
+                        "Condition": {
+                            "ForAllValues:StringEquals": {
+                                "oam:_resource_types": ["AWS::CloudWatch::Metric", "AWS::Logs::LogGroup"
+                                ]
+                            }
+                        },
+                        "Effect": "Allow",
+                        "Principal": {
+                            "AWS": ["1111111111111", "222222222222"]
+                        },
+                        "Resource": "*"
+                    }
+                    ],
+                    "Version": "2012-10-17"
+                })),
+            sink_identifier=example.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_oam_sink_policy_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `sink_identifier` - (Required) ARN of the sink to attach this policy to.
+* `policy` - (Required) JSON policy to use. If you are updating an existing policy, the entire existing policy is replaced by what you specify here.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Sink.
+* `sink_id` - ID string that AWS generated as part of the sink ARN.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `1m`)
+* `update` - (Default `1m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudWatch Observability Access Manager Sink Policy using the `sink_identifier`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import CloudWatch Observability Access Manager Sink Policy using the `sink_identifier`. For example:
+
+```console
+% terraform import aws_oam_sink_policy.example arn:aws:oam:us-west-2:123456789012:sink/sink-id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-037a8f8dc069aa1440effe505f18867c58c5234b21b04bc16839e7f70855a4b1 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/opensearch_domain.html.markdown b/website/docs/cdktf/python/r/opensearch_domain.html.markdown
new file mode 100644
index 00000000000..f306bccc0b2
--- /dev/null
+++ b/website/docs/cdktf/python/r/opensearch_domain.html.markdown
@@ -0,0 +1,573 @@
+---
+subcategory: "OpenSearch"
+layout: "aws"
+page_title: "AWS: aws_opensearch_domain"
+description: |-
+  Terraform resource for managing an AWS OpenSearch Domain.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_opensearch_domain
+
+Manages an Amazon OpenSearch Domain.
+
+## Elasticsearch vs. OpenSearch
+
+Amazon OpenSearch Service is the successor to Amazon Elasticsearch Service and supports OpenSearch and legacy Elasticsearch OSS (up to 7.10, the final open source version of the software).
+
+OpenSearch Domain configurations are similar in many ways to Elasticsearch Domain configurations. However, there are important differences including these:
+
+* OpenSearch has `engine_version` while Elasticsearch has `elasticsearch_version`
+* Versions are specified differently - _e.g._, `Elasticsearch_7.10` with OpenSearch vs. `7.10` for Elasticsearch.
+* `instance_type` argument values end in `search` for OpenSearch vs. `elasticsearch` for Elasticsearch (_e.g._, `t2.micro.search` vs. `t2.micro.elasticsearch`).
+* The AWS-managed service-linked role for OpenSearch is called `AWSServiceRoleForAmazonOpenSearchService` instead of `AWSServiceRoleForAmazonElasticsearchService` for Elasticsearch.
+
+There are also some potentially unexpected similarities in configurations:
+
+* ARNs for both are prefaced with `arn:aws:es:`.
+* Both OpenSearch and Elasticsearch use assume role policies that refer to the `Principal` `Service` as `es.amazonaws.com`.
+* IAM policy actions, such as those you will find in `access_policies`, are prefaced with `es:` for both.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.opensearch_domain import OpensearchDomain
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        OpensearchDomain(self, "example",
+            cluster_config=OpensearchDomainClusterConfig(
+                instance_type="r4.large.search"
+            ),
+            domain_name="example",
+            engine_version="Elasticsearch_7.10",
+            tags={
+                "Domain": "TestDomain"
+            }
+        )
+```
+
+### Access Policy
+
+-> See also: [`aws_opensearch_domain_policy` resource](/docs/providers/aws/r/opensearch_domain_policy.html)
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformVariable, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_caller_identity import DataAwsCallerIdentity
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.data_aws_region import DataAwsRegion
+from imports.aws.opensearch_domain import OpensearchDomain
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        # Terraform Variables are not always the best fit for getting inputs in the context of Terraform CDK.
+        #     You can read more about this at https://cdk.tf/variables
+        domain = TerraformVariable(self, "domain",
+            default="tf-test"
+        )
+        current = DataAwsCallerIdentity(self, "current")
+        data_aws_region_current = DataAwsRegion(self, "current_2")
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_region_current.override_logical_id("current")
+        example = DataAwsIamPolicyDocument(self, "example",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["es:*"],
+                condition=[DataAwsIamPolicyDocumentStatementCondition(
+                    test="IpAddress",
+                    values=["66.193.100.22/32"],
+                    variable="aws:SourceIp"
+                )
+                ],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["*"],
+                    type="*"
+                )
+                ],
+                resources=["arn:aws:es:${" + data_aws_region_current.name + "}:${" + current.account_id + "}:domain/${" + domain.value + "}/*"
+                ]
+            )
+            ]
+        )
+        aws_opensearch_domain_example = OpensearchDomain(self, "example_4",
+            access_policies=Token.as_string(example.json),
+            domain_name=domain.string_value
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_opensearch_domain_example.override_logical_id("example")
+```
+
+### Log publishing to CloudWatch Logs
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudwatch_log_group import CloudwatchLogGroup
+from imports.aws.cloudwatch_log_resource_policy import CloudwatchLogResourcePolicy
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.opensearch_domain import OpensearchDomain
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, domainName):
+        super().__init__(scope, name)
+        example = CloudwatchLogGroup(self, "example",
+            name="example"
+        )
+        aws_opensearch_domain_example = OpensearchDomain(self, "example_1",
+            log_publishing_options=[OpensearchDomainLogPublishingOptions(
+                cloudwatch_log_group_arn=example.arn,
+                log_type="INDEX_SLOW_LOGS"
+            )
+            ],
+            domain_name=domain_name
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_opensearch_domain_example.override_logical_id("example")
+        data_aws_iam_policy_document_example = DataAwsIamPolicyDocument(self, "example_2",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["logs:PutLogEvents", "logs:PutLogEventsBatch", "logs:CreateLogStream"
+                ],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["es.amazonaws.com"],
+                    type="Service"
+                )
+                ],
+                resources=["arn:aws:logs:*"]
+            )
+            ]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_iam_policy_document_example.override_logical_id("example")
+        aws_cloudwatch_log_resource_policy_example =
+        CloudwatchLogResourcePolicy(self, "example_3",
+            policy_document=Token.as_string(data_aws_iam_policy_document_example.json),
+            policy_name="example"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_cloudwatch_log_resource_policy_example.override_logical_id("example")
+```
+
+### VPC based OpenSearch
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformVariable, Token, Fn, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_caller_identity import DataAwsCallerIdentity
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.data_aws_region import DataAwsRegion
+from imports.aws.data_aws_subnets import DataAwsSubnets
+from imports.aws.data_aws_vpc import DataAwsVpc
+from imports.aws.iam_service_linked_role import IamServiceLinkedRole
+from imports.aws.opensearch_domain import OpensearchDomain
+from imports.aws.security_group import SecurityGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        # Terraform Variables are not always the best fit for getting inputs in the context of Terraform CDK.
+        #     You can read more about this at https://cdk.tf/variables
+        domain = TerraformVariable(self, "domain",
+            default="tf-test"
+        )
+        vpc = TerraformVariable(self, "vpc")
+        example = IamServiceLinkedRole(self, "example",
+            aws_service_name="opensearchservice.amazonaws.com"
+        )
+        current = DataAwsCallerIdentity(self, "current")
+        data_aws_region_current = DataAwsRegion(self, "current_4")
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_region_current.override_logical_id("current")
+        data_aws_vpc_example = DataAwsVpc(self, "example_5",
+            tags={
+                "Name": vpc.string_value
+            }
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_vpc_example.override_logical_id("example")
+        aws_security_group_example = SecurityGroup(self, "example_6",
+            description="Managed by Terraform",
+            ingress=[SecurityGroupIngress(
+                cidr_blocks=[Token.as_string(data_aws_vpc_example.cidr_block)],
+                from_port=443,
+                protocol="tcp",
+                to_port=443
+            )
+            ],
+            name="${" + vpc.value + "}-opensearch-${" + domain.value + "}",
+            vpc_id=Token.as_string(data_aws_vpc_example.id)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_security_group_example.override_logical_id("example")
+        data_aws_iam_policy_document_example = DataAwsIamPolicyDocument(self, "example_7",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["es:*"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["*"],
+                    type="*"
+                )
+                ],
+                resources=["arn:aws:es:${" + data_aws_region_current.name + "}:${" + current.account_id + "}:domain/${" + domain.value + "}/*"
+                ]
+            )
+            ]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_iam_policy_document_example.override_logical_id("example")
+        data_aws_subnets_example = DataAwsSubnets(self, "example_8",
+            filter=[DataAwsSubnetsFilter(
+                name="vpc-id",
+                values=[Token.as_string(data_aws_vpc_example.id)]
+            )
+            ],
+            tags={
+                "Tier": "private"
+            }
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_subnets_example.override_logical_id("example")
+        aws_opensearch_domain_example = OpensearchDomain(self, "example_9",
+            access_policies=Token.as_string(data_aws_iam_policy_document_example.json),
+            advanced_options={
+                "rest.action.multi.allow_explicit_index": "true"
+            },
+            cluster_config=OpensearchDomainClusterConfig(
+                instance_type="m4.large.search",
+                zone_awareness_enabled=True
+            ),
+            depends_on=[example],
+            domain_name=domain.string_value,
+            engine_version="OpenSearch_1.0",
+            tags={
+                "Domain": "TestDomain"
+            },
+            vpc_options=OpensearchDomainVpcOptions(
+                security_group_ids=[Token.as_string(aws_security_group_example.id)],
+                subnet_ids=[
+                    Token.as_string(Fn.lookup_nested(data_aws_subnets_example.ids, ["0"])),
+                    Token.as_string(Fn.lookup_nested(data_aws_subnets_example.ids, ["1"]))
+                ]
+            )
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_opensearch_domain_example.override_logical_id("example")
+```
+
+### Enabling fine-grained access control on an existing domain
+
+This example shows two configurations: one to create a domain without fine-grained access control and the second to modify the domain to enable fine-grained access control. For more information, see [Enabling fine-grained access control](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/fgac.html).
+
+#### First apply
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.opensearch_domain import OpensearchDomain
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        OpensearchDomain(self, "example",
+            advanced_security_options=OpensearchDomainAdvancedSecurityOptions(
+                anonymous_auth_enabled=True,
+                enabled=False,
+                internal_user_database_enabled=True,
+                master_user_options=OpensearchDomainAdvancedSecurityOptionsMasterUserOptions(
+                    master_user_name="example",
+                    master_user_password="Barbarbarbar1!"
+                )
+            ),
+            cluster_config=OpensearchDomainClusterConfig(
+                instance_type="r5.large.search"
+            ),
+            domain_endpoint_options=OpensearchDomainDomainEndpointOptions(
+                enforce_https=True,
+                tls_security_policy="Policy-Min-TLS-1-2-2019-07"
+            ),
+            domain_name="ggkitty",
+            ebs_options=OpensearchDomainEbsOptions(
+                ebs_enabled=True,
+                volume_size=10
+            ),
+            encrypt_at_rest=OpensearchDomainEncryptAtRest(
+                enabled=True
+            ),
+            engine_version="Elasticsearch_7.1",
+            node_to_node_encryption=OpensearchDomainNodeToNodeEncryption(
+                enabled=True
+            )
+        )
+```
+
+#### Second apply
+
+Notice that the only change is `advanced_security_options.0.enabled` is now set to `true`.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.opensearch_domain import OpensearchDomain
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        OpensearchDomain(self, "example",
+            advanced_security_options=OpensearchDomainAdvancedSecurityOptions(
+                anonymous_auth_enabled=True,
+                enabled=True,
+                internal_user_database_enabled=True,
+                master_user_options=OpensearchDomainAdvancedSecurityOptionsMasterUserOptions(
+                    master_user_name="example",
+                    master_user_password="Barbarbarbar1!"
+                )
+            ),
+            cluster_config=OpensearchDomainClusterConfig(
+                instance_type="r5.large.search"
+            ),
+            domain_endpoint_options=OpensearchDomainDomainEndpointOptions(
+                enforce_https=True,
+                tls_security_policy="Policy-Min-TLS-1-2-2019-07"
+            ),
+            domain_name="ggkitty",
+            ebs_options=OpensearchDomainEbsOptions(
+                ebs_enabled=True,
+                volume_size=10
+            ),
+            encrypt_at_rest=OpensearchDomainEncryptAtRest(
+                enabled=True
+            ),
+            engine_version="Elasticsearch_7.1",
+            node_to_node_encryption=OpensearchDomainNodeToNodeEncryption(
+                enabled=True
+            )
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `domain_name` - (Required) Name of the domain.
+
+The following arguments are optional:
+
+* `access_policies` - (Optional) IAM policy document specifying the access policies for the domain.
+* `advanced_options` - (Optional) Key-value string pairs to specify advanced configuration options. Note that the values for these configuration options must be strings (wrapped in quotes) or they may be wrong and cause a perpetual diff, causing Terraform to want to recreate your OpenSearch domain on every apply.
+* `advanced_security_options` - (Optional) Configuration block for [fine-grained access control](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/fgac.html). Detailed below.
+* `auto_tune_options` - (Optional) Configuration block for the Auto-Tune options of the domain. Detailed below.
+* `cluster_config` - (Optional) Configuration block for the cluster of the domain. Detailed below.
+* `cognito_options` - (Optional) Configuration block for authenticating dashboard with Cognito. Detailed below.
+* `domain_endpoint_options` - (Optional) Configuration block for domain endpoint HTTP(S) related options. Detailed below.
+* `ebs_options` - (Optional) Configuration block for EBS related options, may be required based on chosen [instance size](https://aws.amazon.com/opensearch-service/pricing/). Detailed below.
+* `engine_version` - (Optional) Either `Elasticsearch_X.Y` or `OpenSearch_X.Y` to specify the engine version for the Amazon OpenSearch Service domain. For example, `OpenSearch_1.0` or `Elasticsearch_7.9`.
+  See [Creating and managing Amazon OpenSearch Service domains](http://docs.aws.amazon.com/opensearch-service/latest/developerguide/createupdatedomains.html#createdomains).
+  Defaults to the lastest version of OpenSearch.
+* `encrypt_at_rest` - (Optional) Configuration block for encrypt at rest options. Only available for [certain instance types](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/encryption-at-rest.html). Detailed below.
+* `log_publishing_options` - (Optional) Configuration block for publishing slow and application logs to CloudWatch Logs. This block can be declared multiple times, for each log_type, within the same resource. Detailed below.
+* `node_to_node_encryption` - (Optional) Configuration block for node-to-node encryption options. Detailed below.
+* `snapshot_options` - (Optional) Configuration block for snapshot related options. Detailed below. DEPRECATED. For domains running OpenSearch 5.3 and later, Amazon OpenSearch takes hourly automated snapshots, making this setting irrelevant. For domains running earlier versions, OpenSearch takes daily automated snapshots.
+* `software_update_options` - (Optional) Software update options for the domain. Detailed below.
+* `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `vpc_options` - (Optional) Configuration block for VPC related options. Adding or removing this configuration forces a new resource ([documentation](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/vpc.html)). Detailed below.
+* `off_peak_window_options` - (Optional) Configuration to add Off Peak update options. ([documentation](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/off-peak.html)). Detailed below.
+
+### advanced_security_options
+
+* `anonymous_auth_enabled` - (Optional) Whether Anonymous auth is enabled. Enables fine-grained access control on an existing domain. Ignored unless `advanced_security_options` are enabled. _Can only be enabled on an existing domain._
+* `enabled` - (Required, Forces new resource when changing from `true` to `false`) Whether advanced security is enabled.
+* `internal_user_database_enabled` - (Optional) Whether the internal user database is enabled. Default is `false`.
+* `master_user_options` - (Optional) Configuration block for the main user. Detailed below.
+
+#### master_user_options
+
+* `master_user_arn` - (Optional) ARN for the main user. Only specify if `internal_user_database_enabled` is not set or set to `false`.
+* `master_user_name` - (Optional) Main user's username, which is stored in the Amazon OpenSearch Service domain's internal database. Only specify if `internal_user_database_enabled` is set to `true`.
+* `master_user_password` - (Optional) Main user's password, which is stored in the Amazon OpenSearch Service domain's internal database. Only specify if `internal_user_database_enabled` is set to `true`.
+
+### auto_tune_options
+
+* `desired_state` - (Required) Auto-Tune desired state for the domain. Valid values: `ENABLED` or `DISABLED`.
+* `maintenance_schedule` - (Required if `rollback_on_disable` is set to `DEFAULT_ROLLBACK`) Configuration block for Auto-Tune maintenance windows. Can be specified multiple times for each maintenance window. Detailed below.
+* `rollback_on_disable` - (Optional) Whether to roll back to default Auto-Tune settings when disabling Auto-Tune. Valid values: `DEFAULT_ROLLBACK` or `NO_ROLLBACK`.
+
+#### maintenance_schedule
+
+* `start_at` - (Required) Date and time at which to start the Auto-Tune maintenance schedule in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8).
+* `duration` - (Required) Configuration block for the duration of the Auto-Tune maintenance window. Detailed below.
+* `cron_expression_for_recurrence` - (Required) A cron expression specifying the recurrence pattern for an Auto-Tune maintenance schedule.
+
+##### duration
+
+* `value` - (Required) An integer specifying the value of the duration of an Auto-Tune maintenance window.
+* `unit` - (Required) Unit of time specifying the duration of an Auto-Tune maintenance window. Valid values: `HOURS`.
+
+### cluster_config
+
+* `cold_storage_options` - (Optional) Configuration block containing cold storage configuration. Detailed below.
+* `dedicated_master_count` - (Optional) Number of dedicated main nodes in the cluster.
+* `dedicated_master_enabled` - (Optional) Whether dedicated main nodes are enabled for the cluster.
+* `dedicated_master_type` - (Optional) Instance type of the dedicated main nodes in the cluster.
+* `instance_count` - (Optional) Number of instances in the cluster.
+* `instance_type` - (Optional) Instance type of data nodes in the cluster.
+* `warm_count` - (Optional) Number of warm nodes in the cluster. Valid values are between `2` and `150`. `warm_count` can be only and must be set when `warm_enabled` is set to `true`.
+* `warm_enabled` - (Optional) Whether to enable warm storage.
+* `warm_type` - (Optional) Instance type for the OpenSearch cluster's warm nodes. Valid values are `ultrawarm1.medium.search`, `ultrawarm1.large.search` and `ultrawarm1.xlarge.search`. `warm_type` can be only and must be set when `warm_enabled` is set to `true`.
+* `zone_awareness_config` - (Optional) Configuration block containing zone awareness settings. Detailed below.
+* `zone_awareness_enabled` - (Optional) Whether zone awareness is enabled, set to `true` for multi-az deployment. To enable awareness with three Availability Zones, the `availability_zone_count` within the `zone_awareness_config` must be set to `3`.
+
+#### cold_storage_options
+
+* `enabled` - (Optional) Boolean to enable cold storage for an OpenSearch domain. Defaults to `false`. Master and ultrawarm nodes must be enabled for cold storage.
+
+#### zone_awareness_config
+
+* `availability_zone_count` - (Optional) Number of Availability Zones for the domain to use with `zone_awareness_enabled`. Defaults to `2`. Valid values: `2` or `3`.
+
+### cognito_options
+
+AWS documentation: [Amazon Cognito Authentication for Dashboard](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/es-cognito-auth.html)
+
+* `enabled` - (Optional) Whether Amazon Cognito authentication with Dashboard is enabled or not. Default is `false`.
+* `identity_pool_id` - (Required) ID of the Cognito Identity Pool to use.
+* `role_arn` - (Required) ARN of the IAM role that has the AmazonOpenSearchServiceCognitoAccess policy attached.
+* `user_pool_id` - (Required) ID of the Cognito User Pool to use.
+
+### domain_endpoint_options
+
+* `custom_endpoint_certificate_arn` - (Optional) ACM certificate ARN for your custom endpoint.
+* `custom_endpoint_enabled` - (Optional) Whether to enable custom endpoint for the OpenSearch domain.
+* `custom_endpoint` - (Optional) Fully qualified domain for your custom endpoint.
+* `enforce_https` - (Optional) Whether or not to require HTTPS. Defaults to `true`.
+* `tls_security_policy` - (Optional) Name of the TLS security policy that needs to be applied to the HTTPS endpoint. Valid values:  `Policy-Min-TLS-1-0-2019-07` and `Policy-Min-TLS-1-2-2019-07`. Terraform will only perform drift detection if a configuration value is provided.
+
+### ebs_options
+
+* `ebs_enabled` - (Required) Whether EBS volumes are attached to data nodes in the domain.
+* `iops` - (Optional) Baseline input/output (I/O) performance of EBS volumes attached to data nodes. Applicable only for the GP3 and Provisioned IOPS EBS volume types.
+* `throughput` - (Required if `volume_type` is set to `gp3`) Specifies the throughput (in MiB/s) of the EBS volumes attached to data nodes. Applicable only for the gp3 volume type.
+* `volume_size` - (Required if `ebs_enabled` is set to `true`.) Size of EBS volumes attached to data nodes (in GiB).
+* `volume_type` - (Optional) Type of EBS volumes attached to data nodes.
+
+### encrypt_at_rest
+
+~> **Note:** You can enable `encrypt_at_rest` _in place_ for an existing, unencrypted domain only if you are using OpenSearch or your Elasticsearch version is 6.7 or greater. For other versions, if you enable `encrypt_at_rest`, Terraform with recreate the domain, potentially causing data loss. For any version, if you disable `encrypt_at_rest` for an existing, encrypted domain, Terraform will recreate the domain, potentially causing data loss. If you change the `kms_key_id`, Terraform will also recreate the domain, potentially causing data loss.
+
+* `enabled` - (Required) Whether to enable encryption at rest. If the `encrypt_at_rest` block is not provided then this defaults to `false`. Enabling encryption on new domains requires an `engine_version` of `OpenSearch_X.Y` or `Elasticsearch_5.1` or greater.
+* `kms_key_id` - (Optional) KMS key ARN to encrypt the Elasticsearch domain with. If not specified then it defaults to using the `aws/es` service KMS key. Note that KMS will accept a KMS key ID but will return the key ARN. To prevent Terraform detecting unwanted changes, use the key ARN instead.
+
+### log_publishing_options
+
+* `cloudwatch_log_group_arn` - (Required) ARN of the Cloudwatch log group to which log needs to be published.
+* `enabled` - (Optional, Default: true) Whether given log publishing option is enabled or not.
+* `log_type` - (Required) Type of OpenSearch log. Valid values: `INDEX_SLOW_LOGS`, `SEARCH_SLOW_LOGS`, `ES_APPLICATION_LOGS`, `AUDIT_LOGS`.
+
+### node_to_node_encryption
+
+~> **Note:** You can enable `node_to_node_encryption` _in place_ for an existing, unencrypted domain only if you are using OpenSearch or your Elasticsearch version is 6.7 or greater. For other versions, if you enable `node_to_node_encryption`, Terraform will recreate the domain, potentially causing data loss. For any version, if you disable `node_to_node_encryption` for an existing, node-to-node encrypted domain, Terraform will recreate the domain, potentially causing data loss.
+
+* `enabled` - (Required) Whether to enable node-to-node encryption. If the `node_to_node_encryption` block is not provided then this defaults to `false`. Enabling node-to-node encryption of a new domain requires an `engine_version` of `OpenSearch_X.Y` or `Elasticsearch_6.0` or greater.
+
+### snapshot_options
+
+* `automated_snapshot_start_hour` - (Required) Hour during which the service takes an automated daily snapshot of the indices in the domain.
+
+### software_update_options
+
+* `auto_software_update_enabled` - (Optional) Whether automatic service software updates are enabled for the domain. Defaults to `false`.
+
+### vpc_options
+
+AWS documentation: [VPC Support for Amazon OpenSearch Service Domains](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/es-vpc.html)
+
+~> **Note:** You must have created the service linked role for the OpenSearch service to use `vpc_options`. If you need to create the service linked role at the same time as the OpenSearch domain then you must use `depends_on` to make sure that the role is created before the OpenSearch domain. See the [VPC based ES domain example](#vpc-based-opensearch) above.
+
+-> Security Groups and Subnets referenced in these attributes must all be within the same VPC. This determines what VPC the endpoints are created in.
+
+* `security_group_ids` - (Optional) List of VPC Security Group IDs to be applied to the OpenSearch domain endpoints. If omitted, the default Security Group for the VPC will be used.
+* `subnet_ids` - (Required) List of VPC Subnet IDs for the OpenSearch domain endpoints to be created in.
+
+### off_peak_window_options
+
+AWS documentation: [Off Peak Hours Support for Amazon OpenSearch Service Domains](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/off-peak.html)
+
+* `enabled` - (Optional) Enabled disabled toggle for off-peak update window.
+* `off_peak_window` - (Optional)
+    * `window_start_time` - (Optional) 10h window for updates
+        * `hours` - (Required) Starting hour of the 10-hour window for updates
+        * `minutes` - (Required) Starting minute of the 10-hour window for updates
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the domain.
+* `domain_id` - Unique identifier for the domain.
+* `domain_name` - Name of the OpenSearch domain.
+* `endpoint` - Domain-specific endpoint used to submit index, search, and data upload requests.
+* `dashboard_endpoint` - Domain-specific endpoint for Dashboard without https scheme.
+* `kibana_endpoint` - (**Deprecated**) Domain-specific endpoint for kibana without https scheme. Use the `dashboard_endpoint` attribute instead.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `vpc_options.0.availability_zones` - If the domain was created inside a VPC, the names of the availability zones the configured `subnet_ids` were created inside.
+* `vpc_options.0.vpc_id` - If the domain was created inside a VPC, the ID of the VPC.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `60m`)
+* `update` - (Default `180m`)
+* `delete` - (Default `90m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import OpenSearch domains using the `domain_name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import OpenSearch domains using the `domain_name`. For example:
+
+```console
+% terraform import aws_opensearch_domain.example domain_name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-6be783c117732ccc247a91f3a21b873ce34ae5384be5834b261ffa5d5d287402 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/opensearch_domain_policy.html.markdown b/website/docs/cdktf/python/r/opensearch_domain_policy.html.markdown
new file mode 100644
index 00000000000..aaa5cae4fd3
--- /dev/null
+++ b/website/docs/cdktf/python/r/opensearch_domain_policy.html.markdown
@@ -0,0 +1,80 @@
+---
+subcategory: "OpenSearch"
+layout: "aws"
+page_title: "AWS: aws_opensearch_domain_policy"
+description: |-
+  Provides an OpenSearch Domain Policy.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_opensearch_domain_policy
+
+Allows setting policy to an OpenSearch domain while referencing domain attributes (e.g., ARN).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.opensearch_domain import OpensearchDomain
+from imports.aws.opensearch_domain_policy import OpensearchDomainPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = OpensearchDomain(self, "example",
+            domain_name="tf-test",
+            engine_version="OpenSearch_1.1"
+        )
+        main = DataAwsIamPolicyDocument(self, "main",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["es:*"],
+                condition=[DataAwsIamPolicyDocumentStatementCondition(
+                    test="IpAddress",
+                    values=["127.0.0.1/32"],
+                    variable="aws:SourceIp"
+                )
+                ],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["*"],
+                    type="*"
+                )
+                ],
+                resources=["${" + example.arn + "}/*"]
+            )
+            ]
+        )
+        aws_opensearch_domain_policy_main = OpensearchDomainPolicy(self, "main_2",
+            access_policies=Token.as_string(main.json),
+            domain_name=example.domain_name
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_opensearch_domain_policy_main.override_logical_id("main")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `access_policies` - (Optional) IAM policy document specifying the access policies for the domain
+* `domain_name` - (Required) Name of the domain.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `update` - (Default `180m`)
+* `delete` - (Default `90m`)
+
+<!-- cache-key: cdktf-0.18.0 input-cbfe389ed128278e78c309bf8bace7ca0adbb492e5276f6865e240b0cf869bef -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/opensearch_domain_saml_options.html.markdown b/website/docs/cdktf/python/r/opensearch_domain_saml_options.html.markdown
new file mode 100644
index 00000000000..aa5bce7e3b4
--- /dev/null
+++ b/website/docs/cdktf/python/r/opensearch_domain_saml_options.html.markdown
@@ -0,0 +1,117 @@
+---
+subcategory: "OpenSearch"
+layout: "aws"
+page_title: "AWS: aws_opensearch_domain_saml_options"
+description: |-
+  Terraform resource for managing SAML authentication options for an AWS OpenSearch Domain.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_opensearch_domain_saml_options
+
+Manages SAML authentication options for an AWS OpenSearch Domain.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.opensearch_domain import OpensearchDomain
+from imports.aws.opensearch_domain_saml_options import OpensearchDomainSamlOptions
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = OpensearchDomain(self, "example",
+            cluster_config=OpensearchDomainClusterConfig(
+                instance_type="r4.large.search"
+            ),
+            domain_name="example",
+            engine_version="OpenSearch_1.1",
+            snapshot_options=OpensearchDomainSnapshotOptions(
+                automated_snapshot_start_hour=23
+            ),
+            tags={
+                "Domain": "TestDomain"
+            }
+        )
+        aws_opensearch_domain_saml_options_example =
+        OpensearchDomainSamlOptions(self, "example_1",
+            domain_name=example.domain_name,
+            saml_options=OpensearchDomainSamlOptionsSamlOptions(
+                enabled=True,
+                idp=OpensearchDomainSamlOptionsSamlOptionsIdp(
+                    entity_id="https://example.com",
+                    metadata_content=Token.as_string(Fn.file("./saml-metadata.xml"))
+                )
+            )
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_opensearch_domain_saml_options_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `domain_name` - (Required) Name of the domain.
+
+The following arguments are optional:
+
+* `saml_options` - (Optional) SAML authentication options for an AWS OpenSearch Domain.
+
+### saml_options
+
+* `enabled` - (Required) Whether SAML authentication is enabled.
+* `idp` - (Optional) Information from your identity provider.
+* `master_backend_role` - (Optional) This backend role from the SAML IdP receives full permissions to the cluster, equivalent to a new master user.
+* `master_user_name` - (Optional) This username from the SAML IdP receives full permissions to the cluster, equivalent to a new master user.
+* `roles_key` - (Optional) Element of the SAML assertion to use for backend roles. Default is roles.
+* `session_timeout_minutes` - (Optional) Duration of a session in minutes after a user logs in. Default is 60. Maximum value is 1,440.
+* `subject_key` - (Optional) Element of the SAML assertion to use for username. Default is NameID.
+
+#### idp
+
+* `entity_id` - (Required) Unique Entity ID of the application in SAML Identity Provider.
+* `metadata_content` - (Required) Metadata of the SAML application in xml format.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Name of the domain the SAML options are associated with.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `update` - (Default `180m`)
+* `delete` - (Default `90m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import OpenSearch domains using the `domain_name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import OpenSearch domains using the `domain_name`. For example:
+
+```console
+% terraform import aws_opensearch_domain_saml_options.example domain_name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-522ab8a3e642cd68e52068b5493dbf1fe749aa3105041d3745357f60bcae42f1 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/opensearch_inbound_connection_accepter.html.markdown b/website/docs/cdktf/python/r/opensearch_inbound_connection_accepter.html.markdown
new file mode 100644
index 00000000000..1e64c3ec5d3
--- /dev/null
+++ b/website/docs/cdktf/python/r/opensearch_inbound_connection_accepter.html.markdown
@@ -0,0 +1,98 @@
+---
+subcategory: "OpenSearch"
+layout: "aws"
+page_title: "AWS: aws_opensearch_inbound_connection_accepter"
+description: |-
+  Terraform resource for managing an AWS OpenSearch Inbound Connection Accepter.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_opensearch_inbound_connection_accepter
+
+Manages an [AWS Opensearch Inbound Connection Accepter](https://docs.aws.amazon.com/opensearch-service/latest/APIReference/API_AcceptInboundConnection.html). If connecting domains from different AWS accounts, ensure that the accepter is configured to use the AWS account where the _remote_ opensearch domain exists.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_caller_identity import DataAwsCallerIdentity
+from imports.aws.data_aws_region import DataAwsRegion
+from imports.aws.opensearch_inbound_connection_accepter import OpensearchInboundConnectionAccepter
+from imports.aws.opensearch_outbound_connection import OpensearchOutboundConnection
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        current = DataAwsCallerIdentity(self, "current")
+        data_aws_region_current = DataAwsRegion(self, "current_1")
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_region_current.override_logical_id("current")
+        foo = OpensearchOutboundConnection(self, "foo",
+            connection_alias="outbound_connection",
+            local_domain_info=OpensearchOutboundConnectionLocalDomainInfo(
+                domain_name=local_domain.domain_name,
+                owner_id=Token.as_string(current.account_id),
+                region=Token.as_string(data_aws_region_current.name)
+            ),
+            remote_domain_info=OpensearchOutboundConnectionRemoteDomainInfo(
+                domain_name=remote_domain.domain_name,
+                owner_id=Token.as_string(current.account_id),
+                region=Token.as_string(data_aws_region_current.name)
+            )
+        )
+        aws_opensearch_inbound_connection_accepter_foo =
+        OpensearchInboundConnectionAccepter(self, "foo_3",
+            connection_id=foo.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_opensearch_inbound_connection_accepter_foo.override_logical_id("foo")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `connection_id` - (Required, Forces new resource) Specifies the ID of the connection to accept.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Id of the connection to accept.
+* `connection_status` - Status of the connection request.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `5m`)
+* `delete` - (Default `5m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AWS Opensearch Inbound Connection Accepters using the Inbound Connection ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import AWS Opensearch Inbound Connection Accepters using the Inbound Connection ID. For example:
+
+```console
+% terraform import aws_opensearch_inbound_connection_accepter.foo connection-id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-55e95b97c434786498b87477ae28b40538814eb9c17d405e3c6f2aa8f4d59ff6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/opensearch_outbound_connection.html.markdown b/website/docs/cdktf/python/r/opensearch_outbound_connection.html.markdown
new file mode 100644
index 00000000000..ba628689e9f
--- /dev/null
+++ b/website/docs/cdktf/python/r/opensearch_outbound_connection.html.markdown
@@ -0,0 +1,121 @@
+---
+subcategory: "OpenSearch"
+layout: "aws"
+page_title: "AWS: aws_opensearch_outbound_connection"
+description: |-
+  Terraform resource for managing an AWS OpenSearch Outbound Connection.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_opensearch_outbound_connection
+
+Manages an AWS Opensearch Outbound Connection.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_caller_identity import DataAwsCallerIdentity
+from imports.aws.data_aws_region import DataAwsRegion
+from imports.aws.opensearch_outbound_connection import OpensearchOutboundConnection
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        current = DataAwsCallerIdentity(self, "current")
+        data_aws_region_current = DataAwsRegion(self, "current_1")
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_region_current.override_logical_id("current")
+        OpensearchOutboundConnection(self, "foo",
+            connection_alias="outbound_connection",
+            connection_mode="DIRECT",
+            local_domain_info=OpensearchOutboundConnectionLocalDomainInfo(
+                domain_name=local_domain.domain_name,
+                owner_id=Token.as_string(current.account_id),
+                region=Token.as_string(data_aws_region_current.name)
+            ),
+            remote_domain_info=OpensearchOutboundConnectionRemoteDomainInfo(
+                domain_name=remote_domain.domain_name,
+                owner_id=Token.as_string(current.account_id),
+                region=Token.as_string(data_aws_region_current.name)
+            )
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `connection_alias` - (Required, Forces new resource) Specifies the connection alias that will be used by the customer for this connection.
+* `connection_mode` - (Required, Forces new resource) Specifies the connection mode. Accepted values are `DIRECT` or `VPC_ENDPOINT`.
+* `accept_connection` - (Optional, Forces new resource) Accepts the connection.
+* `connection_properties` - (Optional, Forces new resource) Configuration block for the outbound connection.
+* `local_domain_info` - (Required, Forces new resource) Configuration block for the local Opensearch domain.
+* `remote_domain_info` - (Required, Forces new resource) Configuration block for the remote Opensearch domain.
+
+### connection_properties
+
+* `cross_cluster_search` - (Optional, Forces new resource) Configuration block for cross cluster search.
+
+### cross_cluster_search
+
+* `skip_unavailable` - (Optional, Forces new resource) Skips unavailable clusters and can only be used for cross-cluster searches. Accepted values are `ENABLED` or `DISABLED`.
+
+### local_domain_info
+
+* `owner_id` - (Required, Forces new resource) The Account ID of the owner of the local domain.
+* `domain_name` - (Required, Forces new resource) The name of the local domain.
+* `region` - (Required, Forces new resource) The region of the local domain.
+
+### remote_domain_info
+
+* `owner_id` - (Required, Forces new resource) The Account ID of the owner of the remote domain.
+* `domain_name` - (Required, Forces new resource) The name of the remote domain.
+* `region` - (Required, Forces new resource) The region of the remote domain.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Id of the connection.
+* `connection_status` - Status of the connection request.
+
+`connection_properties` block exports the following:
+
+* `endpoint` - The endpoint of the remote domain, is only set when `connection_mode` is `VPC_ENDPOINT` and `accept_connection` is `TRUE`.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `5m`)
+* `delete` - (Default `5m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AWS Opensearch Outbound Connections using the Outbound Connection ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import AWS Opensearch Outbound Connections using the Outbound Connection ID. For example:
+
+```console
+% terraform import aws_opensearch_outbound_connection.foo connection-id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-22357101732120a510373c3e4ffc6057617f56b27aa4b15000ded430bddb956a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/opensearch_package.html.markdown b/website/docs/cdktf/python/r/opensearch_package.html.markdown
new file mode 100644
index 00000000000..2b201baf3dc
--- /dev/null
+++ b/website/docs/cdktf/python/r/opensearch_package.html.markdown
@@ -0,0 +1,94 @@
+---
+subcategory: "OpenSearch"
+layout: "aws"
+page_title: "AWS: aws_opensearch_package"
+description: |-
+  Terraform resource for managing an AWS OpenSearch package.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_opensearch_package
+
+Manages an AWS Opensearch Package.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.opensearch_package import OpensearchPackage
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_object import S3Object
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        my_opensearch_packages = S3Bucket(self, "my_opensearch_packages",
+            bucket="my-opensearch-packages"
+        )
+        example = S3Object(self, "example",
+            bucket=my_opensearch_packages.bucket,
+            etag=Token.as_string(Fn.filemd5("./example.txt")),
+            key="example.txt",
+            source="./example.txt"
+        )
+        aws_opensearch_package_example = OpensearchPackage(self, "example_2",
+            package_name="example-txt",
+            package_source=OpensearchPackagePackageSource(
+                s3_bucket_name=my_opensearch_packages.bucket,
+                s3_key=example.key
+            ),
+            package_type="TXT-DICTIONARY"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_opensearch_package_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `package_name` - (Required, Forces new resource) Unique name for the package.
+* `package_type` - (Required, Forces new resource) The type of package.
+* `package_source` - (Required, Forces new resource) Configuration block for the package source options.
+* `package_description` - (Optional, Forces new resource) Description of the package.
+
+### package_source
+
+* `s3_bucket_name` - (Required, Forces new resource) The name of the Amazon S3 bucket containing the package.
+* `s3_key` - (Required, Forces new resource) Key (file name) of the package.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Id of the package.
+* `available_package_version` - The current version of the package.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AWS Opensearch Packages using the Package ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import AWS Opensearch Packages using the Package ID. For example:
+
+```console
+% terraform import aws_opensearch_package.example package-id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-2ab49a0830ef6a746b9a1be0c59b35031692a911e2d8fee6ae0c1e34af4efbe8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/opensearch_package_association.html.markdown b/website/docs/cdktf/python/r/opensearch_package_association.html.markdown
new file mode 100644
index 00000000000..c6a6e399347
--- /dev/null
+++ b/website/docs/cdktf/python/r/opensearch_package_association.html.markdown
@@ -0,0 +1,77 @@
+---
+subcategory: "OpenSearch"
+layout: "aws"
+page_title: "AWS: aws_opensearch_package_association"
+description: |-
+  Terraform resource for managing an AWS OpenSearch package association.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_opensearch_package_association
+
+Manages an AWS Opensearch Package Association.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.opensearch_domain import OpensearchDomain
+from imports.aws.opensearch_package import OpensearchPackage
+from imports.aws.opensearch_package_association import OpensearchPackageAssociation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        my_domain = OpensearchDomain(self, "my_domain",
+            cluster_config=OpensearchDomainClusterConfig(
+                instance_type="r4.large.search"
+            ),
+            domain_name="my-opensearch-domain",
+            engine_version="Elasticsearch_7.10"
+        )
+        example = OpensearchPackage(self, "example",
+            package_name="example-txt",
+            package_source=OpensearchPackagePackageSource(
+                s3_bucket_name=my_opensearch_packages.bucket,
+                s3_key=Token.as_string(aws_s3_object_example.key)
+            ),
+            package_type="TXT-DICTIONARY"
+        )
+        aws_opensearch_package_association_example =
+        OpensearchPackageAssociation(self, "example_2",
+            domain_name=my_domain.domain_name,
+            package_id=example.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_opensearch_package_association_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `package_id` - (Required, Forces new resource) Internal ID of the package to associate with a domain.
+* `domain_name` - (Required, Forces new resource) Name of the domain to associate the package with.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Id of the package association.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `10m`)
+* `delete` - (Default `10m`)
+
+<!-- cache-key: cdktf-0.18.0 input-4bf4fb6525081557853e76c5738da147fbc00142214c947d610c2b6a03303e42 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/opensearch_vpc_endpoint.html.markdown b/website/docs/cdktf/python/r/opensearch_vpc_endpoint.html.markdown
new file mode 100644
index 00000000000..535938f2c90
--- /dev/null
+++ b/website/docs/cdktf/python/r/opensearch_vpc_endpoint.html.markdown
@@ -0,0 +1,87 @@
+---
+subcategory: "OpenSearch"
+layout: "aws"
+page_title: "AWS: aws_opensearch_vpc_endpoint"
+description: |-
+  Terraform resource for managing an AWS OpenSearch VPC Endpoint.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_opensearch_vpc_endpoint
+
+Manages an [AWS Opensearch VPC Endpoint](https://docs.aws.amazon.com/opensearch-service/latest/APIReference/API_CreateVpcEndpoint.html). Creates an Amazon OpenSearch Service-managed VPC endpoint.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws. import OpensearchVpcEndpoint
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        OpensearchVpcEndpoint(self, "foo",
+            domain_arn=domain1.arn,
+            vpc_options=[{
+                "security_group_ids": [test.id, test2.id],
+                "subnet_ids": [aws_subnet_test.id, aws_subnet_test2.id]
+            }
+            ]
+        )
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `domain_arn` - (Required, Forces new resource) Specifies the Amazon Resource Name (ARN) of the domain to create the endpoint for
+* `vpc_options` - (Required) Options to specify the subnets and security groups for the endpoint.
+
+### vpc_options
+
+* `security_group_ids` - (Optional) The list of security group IDs associated with the VPC endpoints for the domain. If you do not provide a security group ID, OpenSearch Service uses the default security group for the VPC.
+* `subnet_ids` - (Required) A list of subnet IDs associated with the VPC endpoints for the domain. If your domain uses multiple Availability Zones, you need to provide two subnet IDs, one per zone. Otherwise, provide only one.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The unique identifier of the endpoint.
+* `endpoint` - The connection endpoint ID for connecting to the domain.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `60m`)
+* `update` - (Default `60m`)
+* `delete` - (Default `90m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import OpenSearch VPC endpoint connections using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import OpenSearch VPC endpoint connections using the `id`. For example:
+
+```console
+% terraform import aws_opensearch_vpc_endpoint_connection.example endpoint-id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-0cbd9462478b83364b91f1d0bd36ff42057d2b1fcd8ca135100e7948f9224f93 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/opensearchserverless_access_policy.html.markdown b/website/docs/cdktf/python/r/opensearchserverless_access_policy.html.markdown
new file mode 100644
index 00000000000..581698e9a0e
--- /dev/null
+++ b/website/docs/cdktf/python/r/opensearchserverless_access_policy.html.markdown
@@ -0,0 +1,167 @@
+---
+subcategory: "OpenSearch Serverless"
+layout: "aws"
+page_title: "AWS: aws_opensearchserverless_access_policy"
+description: |-
+  Terraform resource for managing an AWS OpenSearch Serverless Access Policy.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_opensearchserverless_access_policy
+
+Terraform resource for managing an AWS OpenSearch Serverless Access Policy. See AWS documentation for [data access policies](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/serverless-data-access.html) and [supported data access policy permissions](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/serverless-data-access.html#serverless-data-supported-permissions).
+
+## Example Usage
+
+### Grant all collection and index permissions
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_caller_identity import DataAwsCallerIdentity
+from imports.aws.opensearchserverless_access_policy import OpensearchserverlessAccessPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        current = DataAwsCallerIdentity(self, "current")
+        OpensearchserverlessAccessPolicy(self, "example",
+            description="read and write permissions",
+            name="example",
+            policy=Token.as_string(
+                Fn.jsonencode([{
+                    "Principal": [current.arn],
+                    "Rules": [{
+                        "Permission": ["aoss:*"],
+                        "Resource": ["index/example-collection/*"],
+                        "ResourceType": "index"
+                    }, {
+                        "Permission": ["aoss:*"],
+                        "Resource": ["collection/example-collection"],
+                        "ResourceType": "collection"
+                    }
+                    ]
+                }
+                ])),
+            type="data"
+        )
+```
+
+### Grant read-only collection and index permissions
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_caller_identity import DataAwsCallerIdentity
+from imports.aws.opensearchserverless_access_policy import OpensearchserverlessAccessPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        current = DataAwsCallerIdentity(self, "current")
+        OpensearchserverlessAccessPolicy(self, "example",
+            description="read-only permissions",
+            name="example",
+            policy=Token.as_string(
+                Fn.jsonencode([{
+                    "Principal": [current.arn],
+                    "Rules": [{
+                        "Permission": ["aoss:DescribeIndex", "aoss:ReadDocument"],
+                        "Resource": ["index/example-collection/*"],
+                        "ResourceType": "index"
+                    }, {
+                        "Permission": ["aoss:DescribeCollectionItems"],
+                        "Resource": ["collection/example-collection"],
+                        "ResourceType": "collection"
+                    }
+                    ]
+                }
+                ])),
+            type="data"
+        )
+```
+
+### Grant SAML identity permissions
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.opensearchserverless_access_policy import OpensearchserverlessAccessPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        OpensearchserverlessAccessPolicy(self, "example",
+            description="saml permissions",
+            name="example",
+            policy=Token.as_string(
+                Fn.jsonencode([{
+                    "Principal": ["saml/123456789012/myprovider/user/Annie", "saml/123456789012/anotherprovider/group/Accounting"
+                    ],
+                    "Rules": [{
+                        "Permission": ["aoss:*"],
+                        "Resource": ["index/example-collection/*"],
+                        "ResourceType": "index"
+                    }, {
+                        "Permission": ["aoss:*"],
+                        "Resource": ["collection/example-collection"],
+                        "ResourceType": "collection"
+                    }
+                    ]
+                }
+                ])),
+            type="data"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) Name of the policy.
+* `policy` - (Required) JSON policy document to use as the content for the new policy
+* `type` - (Required) Type of access policy. Must be `data`.
+
+The following arguments are optional:
+
+* `description` - (Optional) Description of the policy. Typically used to store information about the permissions defined in the policy.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `policy_version` - Version of the policy.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import OpenSearchServerless Access Policy using the `name` and `type` arguments separated by a slash (`/`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import OpenSearchServerless Access Policy using the `name` and `type` arguments separated by a slash (`/`). For example:
+
+```console
+% terraform import aws_opensearchserverless_access_policy.example example/data
+```
+
+<!-- cache-key: cdktf-0.18.0 input-025702799f46af465a8f782db7f780da1b73dd0220b3ff605a2cb05cd1fc3137 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/opensearchserverless_collection.html.markdown b/website/docs/cdktf/python/r/opensearchserverless_collection.html.markdown
new file mode 100644
index 00000000000..eb252de815c
--- /dev/null
+++ b/website/docs/cdktf/python/r/opensearchserverless_collection.html.markdown
@@ -0,0 +1,106 @@
+---
+subcategory: "OpenSearch Serverless"
+layout: "aws"
+page_title: "AWS: aws_opensearchserverless_collection"
+description: |-
+  Terraform resource for managing an AWS OpenSearch Collection.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_opensearchserverless_collection
+
+Terraform resource for managing an AWS OpenSearch Serverless Collection.
+
+~> **NOTE:** An `aws_opensearchserverless_collection` cannot be created without having an applicable [encryption security policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/opensearchserverless_security_policy). Use the [`depends_on`](https://developer.hashicorp.com/terraform/language/meta-arguments/depends_on) meta-argument to define this dependency.
+
+~> **NOTE:** An `aws_opensearchserverless_collection` is not accessible without configuring an applicable [network security policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/opensearchserverless_security_policy). Data cannot be accessed without configuring an applicable [data access policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/opensearchserverless_access_policy).
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.opensearchserverless_collection import OpensearchserverlessCollection
+from imports.aws.opensearchserverless_security_policy import OpensearchserverlessSecurityPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = OpensearchserverlessSecurityPolicy(self, "example",
+            name="example",
+            policy=Token.as_string(
+                Fn.jsonencode({
+                    "AWSOwnedKey": True,
+                    "Rules": [{
+                        "Resource": ["collection/example"],
+                        "ResourceType": "collection"
+                    }
+                    ]
+                })),
+            type="encryption"
+        )
+        aws_opensearchserverless_collection_example =
+        OpensearchserverlessCollection(self, "example_1",
+            depends_on=[example],
+            name="example"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_opensearchserverless_collection_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) Name of the collection.
+
+The following arguments are optional:
+
+* `description` - (Optional) Description of the collection.
+* `tags` - (Optional) A map of tags to assign to the collection. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `type` - (Optional) Type of collection. One of `SEARCH`, `TIMESERIES`, or `VECTORSEARCH`. Defaults to `TIMESERIES`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the collection.
+* `collection_endpoint` - Collection-specific endpoint used to submit index, search, and data upload requests to an OpenSearch Serverless collection.
+* `dashboard_endpoint` - Collection-specific endpoint used to access OpenSearch Dashboards.
+* `kms_key_arn` - The ARN of the Amazon Web Services KMS key used to encrypt the collection.
+* `id` - Unique identifier for the collection.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `20m`)
+- `delete` - (Default `20m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import OpenSearchServerless Collection using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import OpenSearchServerless Collection using the `id`. For example:
+
+```console
+% terraform import aws_opensearchserverless_collection.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-6228d2d8e91060f7235e5e926282f581119f807883b0fd65b2ee82f2cc330709 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/opensearchserverless_security_config.html.markdown b/website/docs/cdktf/python/r/opensearchserverless_security_config.html.markdown
new file mode 100644
index 00000000000..4b16d944a97
--- /dev/null
+++ b/website/docs/cdktf/python/r/opensearchserverless_security_config.html.markdown
@@ -0,0 +1,85 @@
+---
+subcategory: "OpenSearch Serverless"
+layout: "aws"
+page_title: "AWS: aws_opensearchserverless_security_config"
+description: |-
+  Terraform resource for managing an AWS OpenSearch Serverless Security Config.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_opensearchserverless_security_config
+
+Terraform resource for managing an AWS OpenSearch Serverless Security Config.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.opensearchserverless_security_config import OpensearchserverlessSecurityConfig
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        OpensearchserverlessSecurityConfig(self, "example",
+            name="example",
+            saml_options=[{
+                "metadata": Token.as_string(Fn.file("${path.module}/idp-metadata.xml"))
+            }
+            ],
+            type="saml"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required, Forces new resource) Name of the policy.
+* `saml_options` - (Required) Configuration block for SAML options.
+* `type` - (Required) Type of configuration. Must be `saml`.
+
+The following arguments are optional:
+
+* `description` - (Optional) Description of the security configuration.
+
+### saml_options
+
+* `group_attribute` - (Optional) Group attribute for this SAML integration.
+* `metadata` - (Required) The XML IdP metadata file generated from your identity provider.
+* `session_timeout` - (Optional) Session timeout, in minutes. Minimum is 5 minutes and maximum is 720 minutes (12 hours). Default is 60 minutes.
+* `user_attribute` - (Optional) User attribute for this SAML integration.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `config_version` - Version of the configuration.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import OpenSearchServerless Access Policy using the `name` argument prefixed with the string `saml/account_id/`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import OpenSearchServerless Access Policy using the `name` argument prefixed with the string `saml/account_id/`. For example:
+
+```console
+% terraform import aws_opensearchserverless_security_config.example saml/123456789012/example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-e97ed43190ce4b1c367d53c0c942b49ca04c3b1646b849a93a8705b0516e690f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/opensearchserverless_security_policy.html.markdown b/website/docs/cdktf/python/r/opensearchserverless_security_policy.html.markdown
new file mode 100644
index 00000000000..d34ad97d4ea
--- /dev/null
+++ b/website/docs/cdktf/python/r/opensearchserverless_security_policy.html.markdown
@@ -0,0 +1,264 @@
+---
+subcategory: "OpenSearch Serverless"
+layout: "aws"
+page_title: "AWS: aws_opensearchserverless_security_policy"
+description: |-
+  Terraform resource for managing an AWS OpenSearch Serverless Security Policy.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_opensearchserverless_security_policy
+
+Terraform resource for managing an AWS OpenSearch Serverless Security Policy. See AWS documentation for [encryption policies](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/serverless-encryption.html#serverless-encryption-policies) and [network policies](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/serverless-network.html#serverless-network-policies).
+
+## Example Usage
+
+### Encryption Security Policy
+
+#### Applies to a single collection
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.opensearchserverless_security_policy import OpensearchserverlessSecurityPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        OpensearchserverlessSecurityPolicy(self, "example",
+            description="encryption security policy for example-collection",
+            name="example",
+            policy=Token.as_string(
+                Fn.jsonencode({
+                    "AWSOwnedKey": True,
+                    "Rules": [{
+                        "Resource": ["collection/example-collection"],
+                        "ResourceType": "collection"
+                    }
+                    ]
+                })),
+            type="encryption"
+        )
+```
+
+#### Applies to multiple collections
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.opensearchserverless_security_policy import OpensearchserverlessSecurityPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        OpensearchserverlessSecurityPolicy(self, "example",
+            description="encryption security policy for collections that begin with \\\"example\\\"",
+            name="example",
+            policy=Token.as_string(
+                Fn.jsonencode({
+                    "AWSOwnedKey": True,
+                    "Rules": [{
+                        "Resource": ["collection/example*"],
+                        "ResourceType": "collection"
+                    }
+                    ]
+                })),
+            type="encryption"
+        )
+```
+
+#### Using a customer managed key
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.opensearchserverless_security_policy import OpensearchserverlessSecurityPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        OpensearchserverlessSecurityPolicy(self, "example",
+            description="encryption security policy using customer KMS key",
+            name="example",
+            policy=Token.as_string(
+                Fn.jsonencode({
+                    "AWSOwnedKey": False,
+                    "KmsARN": "arn:aws:kms:us-east-1:123456789012:key/93fd6da4-a317-4c17-bfe9-382b5d988b36",
+                    "Rules": [{
+                        "Resource": ["collection/customer-managed-key-collection"],
+                        "ResourceType": "collection"
+                    }
+                    ]
+                })),
+            type="encryption"
+        )
+```
+
+### Network Security Policy
+
+#### Allow public access to the collection endpoint and the Dashboards endpoint
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.opensearchserverless_security_policy import OpensearchserverlessSecurityPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        OpensearchserverlessSecurityPolicy(self, "example",
+            description="Public access",
+            name="example",
+            policy=Token.as_string(
+                Fn.jsonencode([{
+                    "AllowFromPublic": True,
+                    "Description": "Public access to collection and Dashboards endpoint for example collection",
+                    "Rules": [{
+                        "Resource": ["collection/example-collection"],
+                        "ResourceType": "collection"
+                    }, {
+                        "Resource": ["collection/example-collection"],
+                        "ResourceType": "dashboard"
+                    }
+                    ]
+                }
+                ])),
+            type="network"
+        )
+```
+
+#### Allow VPC access to the collection endpoint and the Dashboards endpoint
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.opensearchserverless_security_policy import OpensearchserverlessSecurityPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        OpensearchserverlessSecurityPolicy(self, "example",
+            description="VPC access",
+            name="example",
+            policy=Token.as_string(
+                Fn.jsonencode([{
+                    "AllowFromPublic": False,
+                    "Description": "VPC access to collection and Dashboards endpoint for example collection",
+                    "Rules": [{
+                        "Resource": ["collection/example-collection"],
+                        "ResourceType": "collection"
+                    }, {
+                        "Resource": ["collection/example-collection"],
+                        "ResourceType": "dashboard"
+                    }
+                    ],
+                    "SourceVPCEs": ["vpce-050f79086ee71ac05"]
+                }
+                ])),
+            type="network"
+        )
+```
+
+#### Mixed access for different collections
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.opensearchserverless_security_policy import OpensearchserverlessSecurityPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        OpensearchserverlessSecurityPolicy(self, "example",
+            description="Mixed access for marketing and sales",
+            name="example",
+            policy=Token.as_string(
+                Fn.jsonencode([{
+                    "AllowFromPublic": False,
+                    "Description": "Marketing access",
+                    "Rules": [{
+                        "Resource": ["collection/marketing*"],
+                        "ResourceType": "collection"
+                    }, {
+                        "Resource": ["collection/marketing*"],
+                        "ResourceType": "dashboard"
+                    }
+                    ],
+                    "SourceVPCEs": ["vpce-050f79086ee71ac05"]
+                }, {
+                    "AllowFromPublic": True,
+                    "Description": "Sales access",
+                    "Rules": [{
+                        "Resource": ["collection/finance"],
+                        "ResourceType": "collection"
+                    }
+                    ]
+                }
+                ])),
+            type="network"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) Name of the policy.
+* `policy` - (Required) JSON policy document to use as the content for the new policy
+* `type` - (Required) Type of security policy. One of `encryption` or `network`.
+
+The following arguments are optional:
+
+* `description` - (Optional) Description of the policy. Typically used to store information about the permissions defined in the policy.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `policy_version` - Version of the policy.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import OpenSearchServerless Security Policy using the `name` and `type` arguments separated by a slash (`/`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import OpenSearchServerless Security Policy using the `name` and `type` arguments separated by a slash (`/`). For example:
+
+```console
+% terraform import aws_opensearchserverless_security_policy.example example/encryption
+```
+
+<!-- cache-key: cdktf-0.18.0 input-becd08ee3f6a3b334c7cc8143eed41d3094a5e44bfbffe39e37ab8c8a317620e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/opensearchserverless_vpc_endpoint.html.markdown b/website/docs/cdktf/python/r/opensearchserverless_vpc_endpoint.html.markdown
new file mode 100644
index 00000000000..8f8e50de5bd
--- /dev/null
+++ b/website/docs/cdktf/python/r/opensearchserverless_vpc_endpoint.html.markdown
@@ -0,0 +1,83 @@
+---
+subcategory: "OpenSearch Serverless"
+layout: "aws"
+page_title: "AWS: aws_opensearchserverless_vpc_endpoint"
+description: |-
+  Terraform resource for managing an AWS OpenSearch Serverless VPC Endpoint.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_opensearchserverless_vpc_endpoint
+
+Terraform resource for managing an AWS OpenSearchServerless VPC Endpoint.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.opensearchserverless_vpc_endpoint import OpensearchserverlessVpcEndpoint
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        OpensearchserverlessVpcEndpoint(self, "example",
+            name="myendpoint",
+            subnet_ids=[Token.as_string(aws_subnet_example.id)],
+            vpc_id=Token.as_string(aws_vpc_example.id)
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) Name of the interface endpoint.
+* `subnet_ids` - (Required) One or more subnet IDs from which you'll access OpenSearch Serverless. Up to 6 subnets can be provided.
+* `vpc_id` - (Required) ID of the VPC from which you'll access OpenSearch Serverless.
+
+The following arguments are optional:
+
+* `security_group_ids` - (Optional) One or more security groups that define the ports, protocols, and sources for inbound traffic that you are authorizing into your endpoint. Up to 5 security groups can be provided.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Unique identified of the Vpc Endpoint.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `30m`)
+* `update` - (Default `30m`)
+* `delete` - (Default `30m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import OpenSearchServerless Vpc Endpointa using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import OpenSearchServerless Vpc Endpointa using the `id`. For example:
+
+```console
+% terraform import aws_opensearchserverless_vpc_endpoint.example vpce-8012925589
+```
+
+<!-- cache-key: cdktf-0.18.0 input-b9fcf6e6b2846dfbeed5befbc44e2dec7f3e97c4887cfb35c50e0ab28f293279 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/opsworks_application.html.markdown b/website/docs/cdktf/python/r/opsworks_application.html.markdown
new file mode 100644
index 00000000000..0957f47c358
--- /dev/null
+++ b/website/docs/cdktf/python/r/opsworks_application.html.markdown
@@ -0,0 +1,128 @@
+---
+subcategory: "OpsWorks"
+layout: "aws"
+page_title: "AWS: aws_opsworks_application"
+description: |-
+  Provides an OpsWorks application resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_opsworks_application
+
+Provides an OpsWorks application resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, Fn, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.opsworks_application import OpsworksApplication
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        OpsworksApplication(self, "foo-app",
+            app_source=[OpsworksApplicationAppSource(
+                revision="master",
+                type="git",
+                url="https://github.com/example.git"
+            )
+            ],
+            auto_bundle_on_deploy=Token.as_string(True),
+            description="This is a Rails application",
+            document_root="public",
+            domains=["example.com", "sub.example.com"],
+            enable_ssl=True,
+            environment=[OpsworksApplicationEnvironment(
+                key="key",
+                secure=False,
+                value="value"
+            )
+            ],
+            name="foobar application",
+            rails_env="staging",
+            short_name="foobar",
+            ssl_configuration=[OpsworksApplicationSslConfiguration(
+                certificate=Token.as_string(Fn.file("./foobar.crt")),
+                private_key=Token.as_string(Fn.file("./foobar.key"))
+            )
+            ],
+            stack_id=main.id,
+            type="rails"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) A human-readable name for the application.
+* `short_name` - (Required) A short, machine-readable name for the application. This can only be defined on resource creation and ignored on resource update.
+* `stack_id` - (Required) ID of the stack the application will belong to.
+* `type` - (Required) Opsworks application type. One of `aws-flow-ruby`, `java`, `rails`, `php`, `nodejs`, `static` or `other`.
+* `description` - (Optional) A description of the app.
+* `environment` - (Optional) Object to define environment variables.  Object is described below.
+* `enable_ssl` - (Optional) Whether to enable SSL for the app. This must be set in order to let `ssl_configuration.private_key`, `ssl_configuration.certificate` and `ssl_configuration.chain` take effect.
+* `ssl_configuration` - (Optional) The SSL configuration of the app. Object is described below.
+* `app_source` - (Optional) SCM configuration of the app as described below.
+* `data_source_arn` - (Optional) The data source's ARN.
+* `data_source_type` - (Optional) The data source's type one of `AutoSelectOpsworksMysqlInstance`, `OpsworksMysqlInstance`, or `RdsDbInstance`.
+* `data_source_database_name` - (Optional) The database name.
+* `domains` -  (Optional) A list of virtual host alias.
+* `document_root` - (Optional) Subfolder for the document root for application of type `rails`.
+* `auto_bundle_on_deploy` - (Optional) Run bundle install when deploying for application of type `rails`.
+* `rails_env` - (Required if `type` = `rails`) The name of the Rails environment for application of type `rails`.
+* `aws_flow_ruby_settings` - (Optional) Specify activity and workflow workers for your app using the aws-flow gem.
+
+An `app_source` block supports the following arguments (can only be defined once per resource):
+
+* `type` - (Required) The type of source to use. For example, "archive".
+* `url` - (Required) The URL where the app resource can be found.
+* `username` - (Optional) Username to use when authenticating to the source.
+* `password` - (Optional) Password to use when authenticating to the source. Terraform cannot perform drift detection of this configuration.
+* `ssh_key` - (Optional) SSH key to use when authenticating to the source. Terraform cannot perform drift detection of this configuration.
+* `revision` - (Optional) For sources that are version-aware, the revision to use.
+
+An `environment` block supports the following arguments:
+
+* `key` - (Required) Variable name.
+* `value` - (Required) Variable value.
+* `secure` - (Optional) Set visibility of the variable value to `true` or `false`.
+
+A `ssl_configuration` block supports the following arguments (can only be defined once per resource):
+
+* `private_key` - (Required) The private key; the contents of the certificate's domain.key file.
+* `certificate` - (Required) The contents of the certificate's domain.crt file.
+* `chain` - (Optional)  Can be used to specify an intermediate certificate authority key or client authentication.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The id of the application.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Opsworks Application using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Opsworks Application using the `id`. For example:
+
+```console
+% terraform import aws_opsworks_application.test <id>
+```
+
+<!-- cache-key: cdktf-0.18.0 input-4eedaae0cb4e4e8acfb36a8488b25242904e757fb2ce525f27f16d8958622f8a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/opsworks_custom_layer.html.markdown b/website/docs/cdktf/python/r/opsworks_custom_layer.html.markdown
new file mode 100644
index 00000000000..211383023af
--- /dev/null
+++ b/website/docs/cdktf/python/r/opsworks_custom_layer.html.markdown
@@ -0,0 +1,144 @@
+---
+subcategory: "OpsWorks"
+layout: "aws"
+page_title: "AWS: aws_opsworks_custom_layer"
+description: |-
+  Provides an OpsWorks custom layer resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_opsworks_custom_layer
+
+Provides an OpsWorks custom layer resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.opsworks_custom_layer import OpsworksCustomLayer
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        OpsworksCustomLayer(self, "custlayer",
+            name="My Awesome Custom Layer",
+            short_name="awesome",
+            stack_id=main.id
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) A human-readable name for the layer.
+* `short_name` - (Required) A short, machine-readable name for the layer, which will be used to identify it in the Chef node JSON.
+* `stack_id` - (Required) ID of the stack the layer will belong to.
+* `auto_assign_elastic_ips` - (Optional) Whether to automatically assign an elastic IP address to the layer's instances.
+* `auto_assign_public_ips` - (Optional) For stacks belonging to a VPC, whether to automatically assign a public IP address to each of the layer's instances.
+* `cloudwatch_configuration` - (Optional) Will create an EBS volume and connect it to the layer's instances. See [Cloudwatch Configuration](#cloudwatch-configuration).
+* `custom_instance_profile_arn` - (Optional) The ARN of an IAM profile that will be used for the layer's instances.
+* `custom_security_group_ids` - (Optional) Ids for a set of security groups to apply to the layer's instances.
+* `auto_healing` - (Optional) Whether to enable auto-healing for the layer.
+* `install_updates_on_boot` - (Optional) Whether to install OS and package updates on each instance when it boots.
+* `instance_shutdown_timeout` - (Optional) The time, in seconds, that OpsWorks will wait for Chef to complete after triggering the Shutdown event.
+* `elastic_load_balancer` - (Optional) Name of an Elastic Load Balancer to attach to this layer
+* `drain_elb_on_shutdown` - (Optional) Whether to enable Elastic Load Balancing connection draining.
+* `load_based_auto_scaling` - (Optional) Load-based auto scaling configuration. See [Load Based AutoScaling](#load-based-autoscaling)
+* `system_packages` - (Optional) Names of a set of system packages to install on the layer's instances.
+* `use_ebs_optimized_instances` - (Optional) Whether to use EBS-optimized instances.
+* `ebs_volume` - (Optional) Will create an EBS volume and connect it to the layer's instances. See [EBS Volume](#ebs-volume).
+* `custom_json` - (Optional) Custom JSON attributes to apply to the layer.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+The following extra optional arguments, all lists of Chef recipe names, allow
+custom Chef recipes to be applied to layer instances at the five different
+lifecycle events, if custom cookbooks are enabled on the layer's stack:
+
+* `custom_configure_recipes`
+* `custom_deploy_recipes`
+* `custom_setup_recipes`
+* `custom_shutdown_recipes`
+* `custom_undeploy_recipes`
+
+### EBS Volume
+
+* `mount_point` - (Required) The path to mount the EBS volume on the layer's instances.
+* `size` - (Required) The size of the volume in gigabytes.
+* `number_of_disks` - (Required) The number of disks to use for the EBS volume.
+* `raid_level` - (Required) The RAID level to use for the volume.
+* `type` - (Optional) The type of volume to create. This may be `standard` (the default), `io1` or `gp2`.
+* `iops` - (Optional) For PIOPS volumes, the IOPS per disk.
+* `encrypted` - (Optional) Encrypt the volume.
+
+### Cloudwatch Configuration
+
+* `enabled` - (Optional)
+* `log_streams` - (Optional) A block the specifies how an opsworks logs look like. See [Log Streams](#log-streams).
+
+#### Log Streams
+
+* `file` - (Required) Specifies log files that you want to push to CloudWatch Logs. File can point to a specific file or multiple files (by using wild card characters such as /var/log/system.log*).
+* `log_group_name` - (Required) Specifies the destination log group. A log group is created automatically if it doesn't already exist.
+* `batch_count` - (Optional) Specifies the max number of log events in a batch, up to `10000`. The default value is `1000`.
+* `batch_size` - (Optional) Specifies the maximum size of log events in a batch, in bytes, up to `1048576` bytes. The default value is `32768` bytes.
+* `buffer_duration` - (Optional) Specifies the time duration for the batching of log events. The minimum value is `5000` and default value is `5000`.
+* `datetime_format` - (Optional) Specifies how the timestamp is extracted from logs. For more information, see the CloudWatch Logs Agent Reference (https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/AgentReference.html).
+* `encoding` - (Optional) Specifies the encoding of the log file so that the file can be read correctly. The default is `utf_8`.
+* `file_fingerprint_lines` - (Optional) Specifies the range of lines for identifying a file. The valid values are one number, or two dash-delimited numbers, such as `1`, `2-5`. The default value is `1`.
+* `initial_position` - (Optional) Specifies where to start to read data (`start_of_file` or `end_of_file`). The default is `start_of_file`.
+* `multiline_start_pattern` - (Optional) Specifies the pattern for identifying the start of a log message.
+* `time_zone` - (Optional) Specifies the time zone of log event time stamps.
+
+### Load Based Autoscaling
+
+* `downscaling` - (Optional) The downscaling settings, as defined below, used for load-based autoscaling
+* `enable` - (Optional) Whether load-based auto scaling is enabled for the layer.
+* `upscaling` - (Optional) The upscaling settings, as defined below, used for load-based autoscaling
+
+The `downscaling` and `upscaling` blocks supports the following arguments:
+
+Though the three thresholds are optional, at least one threshold must be set when using load-based autoscaling.
+
+* `alarms` - (Optional) Custom Cloudwatch auto scaling alarms, to be used as thresholds. This parameter takes a list of up to five alarm names, which are case sensitive and must be in the same region as the stack.
+* `cpu_threshold` - (Optional) The CPU utilization threshold, as a percent of the available CPU. A value of -1 disables the threshold.
+* `ignore_metrics_time` - (Optional) The amount of time (in minutes) after a scaling event occurs that AWS OpsWorks Stacks should ignore metrics and suppress additional scaling events.
+* `instance_count` - (Optional) The number of instances to add or remove when the load exceeds a threshold.
+* `load_threshold` - (Optional) The load threshold. A value of -1 disables the threshold.
+* `memory_threshold` - (Optional) The memory utilization threshold, as a percent of the available memory. A value of -1 disables the threshold.
+* `thresholds_wait_time` - (Optional) The amount of time, in minutes, that the load must exceed a threshold before more instances are added or removed.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The id of the layer.
+* `arn` - The Amazon Resource Name(ARN) of the layer.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import OpsWorks Custom Layers using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import OpsWorks Custom Layers using the `id`. For example:
+
+```console
+% terraform import aws_opsworks_custom_layer.bar 00000000-0000-0000-0000-000000000000
+```
+
+<!-- cache-key: cdktf-0.18.0 input-8a4b8054a10e74606cd1ea0e8f3f2e390b16a4d6d2acbbb8ade4b0281ed80aa3 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/opsworks_ecs_cluster_layer.html.markdown b/website/docs/cdktf/python/r/opsworks_ecs_cluster_layer.html.markdown
new file mode 100644
index 00000000000..85bd865150d
--- /dev/null
+++ b/website/docs/cdktf/python/r/opsworks_ecs_cluster_layer.html.markdown
@@ -0,0 +1,83 @@
+---
+subcategory: "OpsWorks"
+layout: "aws"
+page_title: "AWS: aws_opsworks_ecs_cluster_layer"
+description: |-
+  Provides an OpsWorks HAProxy layer resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_opsworks_ecs_cluster_layer
+
+Provides an OpsWorks ECS Cluster layer resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.opsworks_ecs_cluster_layer import OpsworksEcsClusterLayer
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        OpsworksEcsClusterLayer(self, "example",
+            ecs_cluster_arn=Token.as_string(aws_ecs_cluster_example.arn),
+            stack_id=Token.as_string(aws_opsworks_stack_example.id)
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `stack_id` - (Required) ID of the stack the layer will belong to.
+* `ecs_cluster_arn` - (Required) The ECS Cluster ARN of the layer.
+* `name` - (Optional) A human-readable name for the layer.
+* `auto_assign_elastic_ips` - (Optional) Whether to automatically assign an elastic IP address to the layer's instances.
+* `auto_assign_public_ips` - (Optional) For stacks belonging to a VPC, whether to automatically assign a public IP address to each of the layer's instances.
+* `custom_instance_profile_arn` - (Optional) The ARN of an IAM profile that will be used for the layer's instances.
+* `custom_security_group_ids` - (Optional) Ids for a set of security groups to apply to the layer's instances.
+* `auto_healing` - (Optional) Whether to enable auto-healing for the layer.
+* `install_updates_on_boot` - (Optional) Whether to install OS and package updates on each instance when it boots.
+* `instance_shutdown_timeout` - (Optional) The time, in seconds, that OpsWorks will wait for Chef to complete after triggering the Shutdown event.
+* `elastic_load_balancer` - (Optional) Name of an Elastic Load Balancer to attach to this layer
+* `drain_elb_on_shutdown` - (Optional) Whether to enable Elastic Load Balancing connection draining.
+* `system_packages` - (Optional) Names of a set of system packages to install on the layer's instances.
+* `use_ebs_optimized_instances` - (Optional) Whether to use EBS-optimized instances.
+* `ebs_volume` - (Optional) `ebs_volume` blocks, as described below, will each create an EBS volume and connect it to the layer's instances.
+* `custom_json` - (Optional) Custom JSON attributes to apply to the layer.
+* `tags` - (Optional) A mapping of tags to assign to the resource.
+
+The following extra optional arguments, all lists of Chef recipe names, allow
+custom Chef recipes to be applied to layer instances at the five different
+lifecycle events, if custom cookbooks are enabled on the layer's stack:
+
+* `custom_configure_recipes`
+* `custom_deploy_recipes`
+* `custom_setup_recipes`
+* `custom_shutdown_recipes`
+* `custom_undeploy_recipes`
+
+An `ebs_volume` block supports the following arguments:
+
+* `mount_point` - (Required) The path to mount the EBS volume on the layer's instances.
+* `size` - (Required) The size of the volume in gigabytes.
+* `number_of_disks` - (Required) The number of disks to use for the EBS volume.
+* `raid_level` - (Required) The RAID level to use for the volume.
+* `type` - (Optional) The type of volume to create. This may be `standard` (the default), `io1` or `gp2`.
+* `iops` - (Optional) For PIOPS volumes, the IOPS per disk.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The id of the layer.
+* `arn` - The Amazon Resource Name(ARN) of the layer.
+
+<!-- cache-key: cdktf-0.18.0 input-c41ce615eb693afa2fd19a1947549ef7ba89f9ef8c5826b9d872e80f1d738e7f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/opsworks_ganglia_layer.html.markdown b/website/docs/cdktf/python/r/opsworks_ganglia_layer.html.markdown
new file mode 100644
index 00000000000..81299052817
--- /dev/null
+++ b/website/docs/cdktf/python/r/opsworks_ganglia_layer.html.markdown
@@ -0,0 +1,86 @@
+---
+subcategory: "OpsWorks"
+layout: "aws"
+page_title: "AWS: aws_opsworks_ganglia_layer"
+description: |-
+  Provides an OpsWorks Ganglia layer resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_opsworks_ganglia_layer
+
+Provides an OpsWorks Ganglia layer resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.opsworks_ganglia_layer import OpsworksGangliaLayer
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        OpsworksGangliaLayer(self, "monitor",
+            password="foobarbaz",
+            stack_id=main.id
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `stack_id` - (Required) ID of the stack the layer will belong to.
+* `password` - (Required) The password to use for Ganglia.
+* `name` - (Optional) A human-readable name for the layer.
+* `auto_assign_elastic_ips` - (Optional) Whether to automatically assign an elastic IP address to the layer's instances.
+* `auto_assign_public_ips` - (Optional) For stacks belonging to a VPC, whether to automatically assign a public IP address to each of the layer's instances.
+* `custom_instance_profile_arn` - (Optional) The ARN of an IAM profile that will be used for the layer's instances.
+* `custom_security_group_ids` - (Optional) Ids for a set of security groups to apply to the layer's instances.
+* `auto_healing` - (Optional) Whether to enable auto-healing for the layer.
+* `install_updates_on_boot` - (Optional) Whether to install OS and package updates on each instance when it boots.
+* `instance_shutdown_timeout` - (Optional) The time, in seconds, that OpsWorks will wait for Chef to complete after triggering the Shutdown event.
+* `elastic_load_balancer` - (Optional) Name of an Elastic Load Balancer to attach to this layer
+* `drain_elb_on_shutdown` - (Optional) Whether to enable Elastic Load Balancing connection draining.
+* `system_packages` - (Optional) Names of a set of system packages to install on the layer's instances.
+* `url` - (Optional) The URL path to use for Ganglia. Defaults to "/ganglia".
+* `username` - (Optiona) The username to use for Ganglia. Defaults to "opsworks".
+* `use_ebs_optimized_instances` - (Optional) Whether to use EBS-optimized instances.
+* `ebs_volume` - (Optional) `ebs_volume` blocks, as described below, will each create an EBS volume and connect it to the layer's instances.
+* `custom_json` - (Optional) Custom JSON attributes to apply to the layer.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+The following extra optional arguments, all lists of Chef recipe names, allow
+custom Chef recipes to be applied to layer instances at the five different
+lifecycle events, if custom cookbooks are enabled on the layer's stack:
+
+* `custom_configure_recipes`
+* `custom_deploy_recipes`
+* `custom_setup_recipes`
+* `custom_shutdown_recipes`
+* `custom_undeploy_recipes`
+
+An `ebs_volume` block supports the following arguments:
+
+* `mount_point` - (Required) The path to mount the EBS volume on the layer's instances.
+* `size` - (Required) The size of the volume in gigabytes.
+* `number_of_disks` - (Required) The number of disks to use for the EBS volume.
+* `raid_level` - (Required) The RAID level to use for the volume.
+* `type` - (Optional) The type of volume to create. This may be `standard` (the default), `io1` or `gp2`.
+* `iops` - (Optional) For PIOPS volumes, the IOPS per disk.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The id of the layer.
+* `arn` - The Amazon Resource Name(ARN) of the layer.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+<!-- cache-key: cdktf-0.18.0 input-cd3f72f3fcce85e722f3f818cc5881919d478fd39c4c26ac44c9940408fce59f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/opsworks_haproxy_layer.html.markdown b/website/docs/cdktf/python/r/opsworks_haproxy_layer.html.markdown
new file mode 100644
index 00000000000..f92f5d3c27b
--- /dev/null
+++ b/website/docs/cdktf/python/r/opsworks_haproxy_layer.html.markdown
@@ -0,0 +1,89 @@
+---
+subcategory: "OpsWorks"
+layout: "aws"
+page_title: "AWS: aws_opsworks_haproxy_layer"
+description: |-
+  Provides an OpsWorks HAProxy layer resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_opsworks_haproxy_layer
+
+Provides an OpsWorks haproxy layer resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.opsworks_haproxy_layer import OpsworksHaproxyLayer
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        OpsworksHaproxyLayer(self, "lb",
+            stack_id=main.id,
+            stats_password="foobarbaz"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `stack_id` - (Required) ID of the stack the layer will belong to.
+* `stats_password` - (Required) The password to use for HAProxy stats.
+* `name` - (Optional) A human-readable name for the layer.
+* `auto_assign_elastic_ips` - (Optional) Whether to automatically assign an elastic IP address to the layer's instances.
+* `auto_assign_public_ips` - (Optional) For stacks belonging to a VPC, whether to automatically assign a public IP address to each of the layer's instances.
+* `custom_instance_profile_arn` - (Optional) The ARN of an IAM profile that will be used for the layer's instances.
+* `custom_security_group_ids` - (Optional) Ids for a set of security groups to apply to the layer's instances.
+* `auto_healing` - (Optional) Whether to enable auto-healing for the layer.
+* `healthcheck_method` - (Optional) HTTP method to use for instance healthchecks. Defaults to "OPTIONS".
+* `healthcheck_url` - (Optional) URL path to use for instance healthchecks. Defaults to "/".
+* `install_updates_on_boot` - (Optional) Whether to install OS and package updates on each instance when it boots.
+* `instance_shutdown_timeout` - (Optional) The time, in seconds, that OpsWorks will wait for Chef to complete after triggering the Shutdown event.
+* `elastic_load_balancer` - (Optional) Name of an Elastic Load Balancer to attach to this layer
+* `drain_elb_on_shutdown` - (Optional) Whether to enable Elastic Load Balancing connection draining.
+* `stats_enabled` - (Optional) Whether to enable HAProxy stats.
+* `stats_url` - (Optional) The HAProxy stats URL. Defaults to "/haproxy?stats".
+* `stats_user` - (Optional) The username for HAProxy stats. Defaults to "opsworks".
+* `system_packages` - (Optional) Names of a set of system packages to install on the layer's instances.
+* `use_ebs_optimized_instances` - (Optional) Whether to use EBS-optimized instances.
+* `ebs_volume` - (Optional) `ebs_volume` blocks, as described below, will each create an EBS volume and connect it to the layer's instances.
+* `custom_json` - (Optional) Custom JSON attributes to apply to the layer.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+The following extra optional arguments, all lists of Chef recipe names, allow
+custom Chef recipes to be applied to layer instances at the five different
+lifecycle events, if custom cookbooks are enabled on the layer's stack:
+
+* `custom_configure_recipes`
+* `custom_deploy_recipes`
+* `custom_setup_recipes`
+* `custom_shutdown_recipes`
+* `custom_undeploy_recipes`
+
+An `ebs_volume` block supports the following arguments:
+
+* `mount_point` - (Required) The path to mount the EBS volume on the layer's instances.
+* `size` - (Required) The size of the volume in gigabytes.
+* `number_of_disks` - (Required) The number of disks to use for the EBS volume.
+* `raid_level` - (Required) The RAID level to use for the volume.
+* `type` - (Optional) The type of volume to create. This may be `standard` (the default), `io1` or `gp2`.
+* `iops` - (Optional) For PIOPS volumes, the IOPS per disk.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The id of the layer.
+* `arn` - The Amazon Resource Name(ARN) of the layer.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+<!-- cache-key: cdktf-0.18.0 input-d7e3b606c224ad4d900794b3922f5773ba5b6e0545823dc60bc75ee69f563826 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/opsworks_instance.html.markdown b/website/docs/cdktf/python/r/opsworks_instance.html.markdown
new file mode 100644
index 00000000000..6c5cd833b2b
--- /dev/null
+++ b/website/docs/cdktf/python/r/opsworks_instance.html.markdown
@@ -0,0 +1,168 @@
+---
+subcategory: "OpsWorks"
+layout: "aws"
+page_title: "AWS: aws_opsworks_instance"
+description: |-
+  Provides an OpsWorks instance resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_opsworks_instance
+
+Provides an OpsWorks instance resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.opsworks_instance import OpsworksInstance
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        OpsworksInstance(self, "my-instance",
+            instance_type="t2.micro",
+            layer_ids=[my_layer.id],
+            os="Amazon Linux 2015.09",
+            stack_id=main.id,
+            state="stopped"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `layer_ids` - (Required) List of the layers the instance will belong to.
+* `stack_id` - (Required) Identifier of the stack the instance will belong to.
+
+The following arguments are optional:
+
+* `agent_version` - (Optional) OpsWorks agent to install. Default is `INHERIT`.
+* `ami_id` - (Optional) AMI to use for the instance.  If an AMI is specified, `os` must be `Custom`.
+* `architecture` - (Optional) Machine architecture for created instances.  Valid values are `x86_64` or `i386`. The default is `x86_64`.
+* `auto_scaling_type` - (Optional) Creates load-based or time-based instances.  Valid values are `load`, `timer`.
+* `availability_zone` - (Optional) Name of the availability zone where instances will be created by default.
+* `delete_ebs` - (Optional) Whether to delete EBS volume on deletion. Default is `true`.
+* `delete_eip` - (Optional) Whether to delete the Elastic IP on deletion.
+* `ebs_block_device` - (Optional) Configuration block for additional EBS block devices to attach to the instance. See [Block Devices](#block-devices) below.
+* `ebs_optimized` - (Optional) Whether the launched EC2 instance will be EBS-optimized.
+* `ecs_cluster_arn` - (Optional) ECS cluster's ARN for container instances.
+* `elastic_ip` - (Optional) Instance Elastic IP address.
+* `ephemeral_block_device` - (Optional) Configuration block for ephemeral (also known as "Instance Store") volumes on the instance. See [Block Devices](#block-devices) below.
+* `hostname` - (Optional) Instance's host name.
+* `infrastructure_class` - (Optional) For registered instances, infrastructure class: ec2 or on-premises.
+* `install_updates_on_boot` - (Optional) Controls where to install OS and package updates when the instance boots.  Default is `true`.
+* `instance_profile_arn` - (Optional) ARN of the instance's IAM profile.
+* `instance_type` - (Optional) Type of instance to start.
+* `os` - (Optional) Name of operating system that will be installed.
+* `root_block_device` - (Optional) Configuration block for the root block device of the instance. See [Block Devices](#block-devices) below.
+* `root_device_type` - (Optional) Name of the type of root device instances will have by default. Valid values are `ebs` or `instance-store`.
+* `ssh_key_name` - (Optional) Name of the SSH keypair that instances will have by default.
+* `state` - (Optional) Desired state of the instance. Valid values are `running` or `stopped`.
+* `subnet_id` - (Optional) Subnet ID to attach to.
+* `tenancy` - (Optional) Instance tenancy to use. Valid values are `default`, `dedicated` or `host`.
+* `virtualization_type` - (Optional) Keyword to choose what virtualization mode created instances will use. Valid values are `paravirtual` or `hvm`.
+
+## Block devices
+
+Each of the `*_block_device` attributes controls a portion of the AWS
+Instance's "Block Device Mapping". It's a good idea to familiarize yourself with [AWS's Block Device
+Mapping docs](http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/block-device-mapping-concepts.html)
+to understand the implications of using these attributes.
+
+### `ebs_block_device`
+
+* `delete_on_termination` - (Optional) Whether the volume should be destroyed on instance termination. Default is `true`.
+* `device_name` - (Required) Name of the device to mount.
+* `iops` - (Optional) Amount of provisioned [IOPS](http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-io-characteristics.html). This must be set with a `volume_type` of `io1`.
+* `snapshot_id` - (Optional) Snapshot ID to mount.
+* `volume_size` - (Optional) Size of the volume in gigabytes.
+* `volume_type` - (Optional) Type of volume. Valid values are `standard`, `gp2`, or `io1`. Default is `standard`.
+
+Modifying any `ebs_block_device` currently requires resource replacement.
+
+### `ephemeral_block_device`
+
+* `device_name` - Name of the block device to mount on the instance.
+* `virtual_name` - The [Instance Store Device Name](http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/InstanceStorage.html#InstanceStoreDeviceNames) (e.g., `ephemeral0`).
+
+Each AWS Instance type has a different set of Instance Store block devices
+available for attachment. AWS [publishes a
+list](http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/InstanceStorage.html#StorageOnInstanceTypes)
+of which ephemeral devices are available on each type. The devices are always
+identified by the `virtual_name` in the format `ephemeral{0..N}`.
+
+### `root_block_device`
+
+* `delete_on_termination` - (Optional) Whether the volume should be destroyed on instance termination. Default is `true`.
+* `iops` - (Optional) Amount of provisioned [IOPS](http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-io-characteristics.html). This must be set with a `volume_type` of `io1`.
+* `volume_size` - (Optional) Size of the volume in gigabytes.
+* `volume_type` - (Optional) Type of volume. Valid values are `standard`, `gp2`, or `io1`. Default is `standard`.
+
+Modifying any of the `root_block_device` settings requires resource
+replacement.
+
+~> **NOTE:** Currently, changes to `*_block_device` configuration of _existing_
+resources cannot be automatically detected by Terraform. After making updates
+to block device configuration, resource recreation can be manually triggered by
+using the [`taint` command](https://www.terraform.io/docs/commands/taint.html).
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `created_at` - Time that the instance was created.
+* `ec2_instance_id` - EC2 instance ID.
+* `id` - ID of the OpsWorks instance.
+* `last_service_error_id` - ID of the last service error.
+* `platform` - Instance's platform.
+* `private_dns` - Private DNS name assigned to the instance. Can only be used inside the Amazon EC2, and only available if you've enabled DNS hostnames for your VPC.
+* `private_ip` - Private IP address assigned to the instance.
+* `public_dns` - Public DNS name assigned to the instance. For EC2-VPC, this is only available if you've enabled DNS hostnames for your VPC.
+* `public_ip` - Public IP address assigned to the instance, if applicable.
+* `registered_by` - For registered instances, who performed the registration.
+* `reported_agent_version` - Instance's reported AWS OpsWorks Stacks agent version.
+* `reported_os_family` - For registered instances, the reported operating system family.
+* `reported_os_name` - For registered instances, the reported operating system name.
+* `reported_os_version` - For registered instances, the reported operating system version.
+* `root_device_volume_id` - Root device volume ID.
+* `security_group_ids` - Associated security groups.
+* `ssh_host_dsa_key_fingerprint` - SSH key's Deep Security Agent (DSA) fingerprint.
+* `ssh_host_rsa_key_fingerprint` - SSH key's RSA fingerprint.
+* `status` - Instance status. Will be one of `booting`, `connection_lost`, `online`, `pending`, `rebooting`, `requested`, `running_setup`, `setup_failed`, `shutting_down`, `start_failed`, `stop_failed`, `stopped`, `stopping`, `terminated`, or `terminating`.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `10m`)
+- `delete` - (Default `10m`)
+- `update` - (Default `10m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Opsworks Instances using the instance `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Opsworks Instances using the instance `id`. For example:
+
+```console
+% terraform import aws_opsworks_instance.my_instance 4d6d1710-ded9-42a1-b08e-b043ad7af1e2
+```
+
+<!-- cache-key: cdktf-0.18.0 input-760182d76d218ceaf2aa97bf60861140665a51f7861d5210b509e78e8f84b58d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/opsworks_java_app_layer.html.markdown b/website/docs/cdktf/python/r/opsworks_java_app_layer.html.markdown
new file mode 100644
index 00000000000..572b87effb8
--- /dev/null
+++ b/website/docs/cdktf/python/r/opsworks_java_app_layer.html.markdown
@@ -0,0 +1,87 @@
+---
+subcategory: "OpsWorks"
+layout: "aws"
+page_title: "AWS: aws_opsworks_java_app_layer"
+description: |-
+  Provides an OpsWorks Java application layer resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_opsworks_java_app_layer
+
+Provides an OpsWorks Java application layer resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.opsworks_java_app_layer import OpsworksJavaAppLayer
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        OpsworksJavaAppLayer(self, "app",
+            stack_id=main.id
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `stack_id` - (Required) ID of the stack the layer will belong to.
+* `name` - (Optional) A human-readable name for the layer.
+* `app_server` - (Optional) Keyword for the application container to use. Defaults to "tomcat".
+* `app_server_version` - (Optional) Version of the selected application container to use. Defaults to "7".
+* `auto_assign_elastic_ips` - (Optional) Whether to automatically assign an elastic IP address to the layer's instances.
+* `auto_assign_public_ips` - (Optional) For stacks belonging to a VPC, whether to automatically assign a public IP address to each of the layer's instances.
+* `custom_instance_profile_arn` - (Optional) The ARN of an IAM profile that will be used for the layer's instances.
+* `custom_security_group_ids` - (Optional) Ids for a set of security groups to apply to the layer's instances.
+* `auto_healing` - (Optional) Whether to enable auto-healing for the layer.
+* `install_updates_on_boot` - (Optional) Whether to install OS and package updates on each instance when it boots.
+* `instance_shutdown_timeout` - (Optional) The time, in seconds, that OpsWorks will wait for Chef to complete after triggering the Shutdown event.
+* `jvm_type` - (Optional) Keyword for the type of JVM to use. Defaults to `openjdk`.
+* `jvm_options` - (Optional) Options to set for the JVM.
+* `jvm_version` - (Optional) Version of JVM to use. Defaults to "7".
+* `elastic_load_balancer` - (Optional) Name of an Elastic Load Balancer to attach to this layer
+* `drain_elb_on_shutdown` - (Optional) Whether to enable Elastic Load Balancing connection draining.
+* `system_packages` - (Optional) Names of a set of system packages to install on the layer's instances.
+* `use_ebs_optimized_instances` - (Optional) Whether to use EBS-optimized instances.
+* `ebs_volume` - (Optional) `ebs_volume` blocks, as described below, will each create an EBS volume and connect it to the layer's instances.
+* `custom_json` - (Optional) Custom JSON attributes to apply to the layer.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+The following extra optional arguments, all lists of Chef recipe names, allow
+custom Chef recipes to be applied to layer instances at the five different
+lifecycle events, if custom cookbooks are enabled on the layer's stack:
+
+* `custom_configure_recipes`
+* `custom_deploy_recipes`
+* `custom_setup_recipes`
+* `custom_shutdown_recipes`
+* `custom_undeploy_recipes`
+
+An `ebs_volume` block supports the following arguments:
+
+* `mount_point` - (Required) The path to mount the EBS volume on the layer's instances.
+* `size` - (Required) The size of the volume in gigabytes.
+* `number_of_disks` - (Required) The number of disks to use for the EBS volume.
+* `raid_level` - (Required) The RAID level to use for the volume.
+* `type` - (Optional) The type of volume to create. This may be `standard` (the default), `io1` or `gp2`.
+* `iops` - (Optional) For PIOPS volumes, the IOPS per disk.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The id of the layer.
+* `arn` - The Amazon Resource Name(ARN) of the layer.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+<!-- cache-key: cdktf-0.18.0 input-22f1dac0366505ea416dcd52815ba922756da61064d917cfb0310e814c99266a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/opsworks_memcached_layer.html.markdown b/website/docs/cdktf/python/r/opsworks_memcached_layer.html.markdown
new file mode 100644
index 00000000000..bf443444d56
--- /dev/null
+++ b/website/docs/cdktf/python/r/opsworks_memcached_layer.html.markdown
@@ -0,0 +1,83 @@
+---
+subcategory: "OpsWorks"
+layout: "aws"
+page_title: "AWS: aws_opsworks_memcached_layer"
+description: |-
+  Provides an OpsWorks memcached layer resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_opsworks_memcached_layer
+
+Provides an OpsWorks memcached layer resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.opsworks_memcached_layer import OpsworksMemcachedLayer
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        OpsworksMemcachedLayer(self, "cache",
+            stack_id=main.id
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `stack_id` - (Required) ID of the stack the layer will belong to.
+* `name` - (Optional) A human-readable name for the layer.
+* `allocated_memory` - (Optional) Amount of memory to allocate for the cache on each instance, in megabytes. Defaults to 512MB.
+* `auto_assign_elastic_ips` - (Optional) Whether to automatically assign an elastic IP address to the layer's instances.
+* `auto_assign_public_ips` - (Optional) For stacks belonging to a VPC, whether to automatically assign a public IP address to each of the layer's instances.
+* `custom_instance_profile_arn` - (Optional) The ARN of an IAM profile that will be used for the layer's instances.
+* `custom_security_group_ids` - (Optional) Ids for a set of security groups to apply to the layer's instances.
+* `auto_healing` - (Optional) Whether to enable auto-healing for the layer.
+* `install_updates_on_boot` - (Optional) Whether to install OS and package updates on each instance when it boots.
+* `instance_shutdown_timeout` - (Optional) The time, in seconds, that OpsWorks will wait for Chef to complete after triggering the Shutdown event.
+* `elastic_load_balancer` - (Optional) Name of an Elastic Load Balancer to attach to this layer
+* `drain_elb_on_shutdown` - (Optional) Whether to enable Elastic Load Balancing connection draining.
+* `system_packages` - (Optional) Names of a set of system packages to install on the layer's instances.
+* `use_ebs_optimized_instances` - (Optional) Whether to use EBS-optimized instances.
+* `ebs_volume` - (Optional) `ebs_volume` blocks, as described below, will each create an EBS volume and connect it to the layer's instances.
+* `custom_json` - (Optional) Custom JSON attributes to apply to the layer.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+The following extra optional arguments, all lists of Chef recipe names, allow
+custom Chef recipes to be applied to layer instances at the five different
+lifecycle events, if custom cookbooks are enabled on the layer's stack:
+
+* `custom_configure_recipes`
+* `custom_deploy_recipes`
+* `custom_setup_recipes`
+* `custom_shutdown_recipes`
+* `custom_undeploy_recipes`
+
+An `ebs_volume` block supports the following arguments:
+
+* `mount_point` - (Required) The path to mount the EBS volume on the layer's instances.
+* `size` - (Required) The size of the volume in gigabytes.
+* `number_of_disks` - (Required) The number of disks to use for the EBS volume.
+* `raid_level` - (Required) The RAID level to use for the volume.
+* `type` - (Optional) The type of volume to create. This may be `standard` (the default), `io1` or `gp2`.
+* `iops` - (Optional) For PIOPS volumes, the IOPS per disk.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The id of the layer.
+* `arn` - The Amazon Resource Name(ARN) of the layer.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+<!-- cache-key: cdktf-0.18.0 input-05a372e54fd07197c1f42442567c63b5866c6980883edb9054bbf50151850fd4 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/opsworks_mysql_layer.html.markdown b/website/docs/cdktf/python/r/opsworks_mysql_layer.html.markdown
new file mode 100644
index 00000000000..c6f254c9afb
--- /dev/null
+++ b/website/docs/cdktf/python/r/opsworks_mysql_layer.html.markdown
@@ -0,0 +1,87 @@
+---
+subcategory: "OpsWorks"
+layout: "aws"
+page_title: "AWS: aws_opsworks_mysql_layer"
+description: |-
+  Provides an OpsWorks MySQL layer resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_opsworks_mysql_layer
+
+Provides an OpsWorks MySQL layer resource.
+
+~> **Note:** All arguments including the root password will be stored in the raw state as plain-text.
+[Read more about sensitive data in state](https://www.terraform.io/docs/state/sensitive-data.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.opsworks_mysql_layer import OpsworksMysqlLayer
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        OpsworksMysqlLayer(self, "db",
+            stack_id=main.id
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `stack_id` - (Required) ID of the stack the layer will belong to.
+* `name` - (Optional) A human-readable name for the layer.
+* `auto_assign_elastic_ips` - (Optional) Whether to automatically assign an elastic IP address to the layer's instances.
+* `auto_assign_public_ips` - (Optional) For stacks belonging to a VPC, whether to automatically assign a public IP address to each of the layer's instances.
+* `custom_instance_profile_arn` - (Optional) The ARN of an IAM profile that will be used for the layer's instances.
+* `custom_security_group_ids` - (Optional) Ids for a set of security groups to apply to the layer's instances.
+* `auto_healing` - (Optional) Whether to enable auto-healing for the layer.
+* `install_updates_on_boot` - (Optional) Whether to install OS and package updates on each instance when it boots.
+* `instance_shutdown_timeout` - (Optional) The time, in seconds, that OpsWorks will wait for Chef to complete after triggering the Shutdown event.
+* `elastic_load_balancer` - (Optional) Name of an Elastic Load Balancer to attach to this layer
+* `drain_elb_on_shutdown` - (Optional) Whether to enable Elastic Load Balancing connection draining.
+* `root_password` - (Optional) Root password to use for MySQL.
+* `root_password_on_all_instances` - (Optional) Whether to set the root user password to all instances in the stack so they can access the instances in this layer.
+* `system_packages` - (Optional) Names of a set of system packages to install on the layer's instances.
+* `use_ebs_optimized_instances` - (Optional) Whether to use EBS-optimized instances.
+* `ebs_volume` - (Optional) `ebs_volume` blocks, as described below, will each create an EBS volume and connect it to the layer's instances.
+* `custom_json` - (Optional) Custom JSON attributes to apply to the layer.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+The following extra optional arguments, all lists of Chef recipe names, allow
+custom Chef recipes to be applied to layer instances at the five different
+lifecycle events, if custom cookbooks are enabled on the layer's stack:
+
+* `custom_configure_recipes`
+* `custom_deploy_recipes`
+* `custom_setup_recipes`
+* `custom_shutdown_recipes`
+* `custom_undeploy_recipes`
+
+An `ebs_volume` block supports the following arguments:
+
+* `mount_point` - (Required) The path to mount the EBS volume on the layer's instances.
+* `size` - (Required) The size of the volume in gigabytes.
+* `number_of_disks` - (Required) The number of disks to use for the EBS volume.
+* `raid_level` - (Required) The RAID level to use for the volume.
+* `type` - (Optional) The type of volume to create. This may be `standard` (the default), `io1` or `gp2`.
+* `iops` - (Optional) For PIOPS volumes, the IOPS per disk.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The id of the layer.
+* `arn` - The Amazon Resource Name(ARN) of the layer.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+<!-- cache-key: cdktf-0.18.0 input-6fb3f9c0066341ee3cdf3144e8a066c0d6087b4103a19b780640998ecba59777 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/opsworks_nodejs_app_layer.html.markdown b/website/docs/cdktf/python/r/opsworks_nodejs_app_layer.html.markdown
new file mode 100644
index 00000000000..d52012cbe34
--- /dev/null
+++ b/website/docs/cdktf/python/r/opsworks_nodejs_app_layer.html.markdown
@@ -0,0 +1,83 @@
+---
+subcategory: "OpsWorks"
+layout: "aws"
+page_title: "AWS: aws_opsworks_nodejs_app_layer"
+description: |-
+  Provides an OpsWorks NodeJS application layer resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_opsworks_nodejs_app_layer
+
+Provides an OpsWorks NodeJS application layer resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.opsworks_nodejs_app_layer import OpsworksNodejsAppLayer
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        OpsworksNodejsAppLayer(self, "app",
+            stack_id=main.id
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `stack_id` - (Required) ID of the stack the layer will belong to.
+* `name` - (Optional) A human-readable name for the layer.
+* `auto_assign_elastic_ips` - (Optional) Whether to automatically assign an elastic IP address to the layer's instances.
+* `auto_assign_public_ips` - (Optional) For stacks belonging to a VPC, whether to automatically assign a public IP address to each of the layer's instances.
+* `custom_instance_profile_arn` - (Optional) The ARN of an IAM profile that will be used for the layer's instances.
+* `custom_security_group_ids` - (Optional) Ids for a set of security groups to apply to the layer's instances.
+* `auto_healing` - (Optional) Whether to enable auto-healing for the layer.
+* `install_updates_on_boot` - (Optional) Whether to install OS and package updates on each instance when it boots.
+* `instance_shutdown_timeout` - (Optional) The time, in seconds, that OpsWorks will wait for Chef to complete after triggering the Shutdown event.
+* `elastic_load_balancer` - (Optional) Name of an Elastic Load Balancer to attach to this layer
+* `drain_elb_on_shutdown` - (Optional) Whether to enable Elastic Load Balancing connection draining.
+* `nodejs_version` - (Optional) The version of NodeJS to use. Defaults to "0.10.38".
+* `system_packages` - (Optional) Names of a set of system packages to install on the layer's instances.
+* `use_ebs_optimized_instances` - (Optional) Whether to use EBS-optimized instances.
+* `ebs_volume` - (Optional) `ebs_volume` blocks, as described below, will each create an EBS volume and connect it to the layer's instances.
+* `custom_json` - (Optional) Custom JSON attributes to apply to the layer.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+The following extra optional arguments, all lists of Chef recipe names, allow
+custom Chef recipes to be applied to layer instances at the five different
+lifecycle events, if custom cookbooks are enabled on the layer's stack:
+
+* `custom_configure_recipes`
+* `custom_deploy_recipes`
+* `custom_setup_recipes`
+* `custom_shutdown_recipes`
+* `custom_undeploy_recipes`
+
+An `ebs_volume` block supports the following arguments:
+
+* `mount_point` - (Required) The path to mount the EBS volume on the layer's instances.
+* `size` - (Required) The size of the volume in gigabytes.
+* `number_of_disks` - (Required) The number of disks to use for the EBS volume.
+* `raid_level` - (Required) The RAID level to use for the volume.
+* `type` - (Optional) The type of volume to create. This may be `standard` (the default), `io1` or `gp2`.
+* `iops` - (Optional) For PIOPS volumes, the IOPS per disk.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The id of the layer.
+* `arn` - The Amazon Resource Name(ARN) of the layer.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+<!-- cache-key: cdktf-0.18.0 input-1df307b6876d1bd2e727d6c0695efb82596dffc396372dbe164d5ffca9daf825 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/opsworks_permission.html.markdown b/website/docs/cdktf/python/r/opsworks_permission.html.markdown
new file mode 100644
index 00000000000..5e0692adb78
--- /dev/null
+++ b/website/docs/cdktf/python/r/opsworks_permission.html.markdown
@@ -0,0 +1,54 @@
+---
+subcategory: "OpsWorks"
+layout: "aws"
+page_title: "AWS: aws_opsworks_permission"
+description: |-
+  Provides an OpsWorks permission resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_opsworks_permission
+
+Provides an OpsWorks permission resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.opsworks_permission import OpsworksPermission
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        OpsworksPermission(self, "my_stack_permission",
+            allow_ssh=True,
+            allow_sudo=True,
+            level="iam_only",
+            stack_id=stack.id,
+            user_arn=user.arn
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `allow_ssh` - (Optional) Whether the user is allowed to use SSH to communicate with the instance
+* `allow_sudo` - (Optional) Whether the user is allowed to use sudo to elevate privileges
+* `user_arn` - (Required) The user's IAM ARN to set permissions for
+* `level` - (Optional) The users permission level. Mus be one of `deny`, `show`, `deploy`, `manage`, `iam_only`
+* `stack_id` - (Required) The stack to set the permissions for
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The computed id of the permission. Please note that this is only used internally to identify the permission. This value is not used in aws.
+
+<!-- cache-key: cdktf-0.18.0 input-97b4069bc5171903caa09804dda516e141af05be716dec07a132aa54f9470e02 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/opsworks_php_app_layer.html.markdown b/website/docs/cdktf/python/r/opsworks_php_app_layer.html.markdown
new file mode 100644
index 00000000000..00815b39017
--- /dev/null
+++ b/website/docs/cdktf/python/r/opsworks_php_app_layer.html.markdown
@@ -0,0 +1,101 @@
+---
+subcategory: "OpsWorks"
+layout: "aws"
+page_title: "AWS: aws_opsworks_php_app_layer"
+description: |-
+  Provides an OpsWorks PHP application layer resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_opsworks_php_app_layer
+
+Provides an OpsWorks PHP application layer resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.opsworks_php_app_layer import OpsworksPhpAppLayer
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        OpsworksPhpAppLayer(self, "app",
+            stack_id=main.id
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `stack_id` - (Required) ID of the stack the layer will belong to.
+* `name` - (Optional) A human-readable name for the layer.
+* `auto_assign_elastic_ips` - (Optional) Whether to automatically assign an elastic IP address to the layer's instances.
+* `auto_assign_public_ips` - (Optional) For stacks belonging to a VPC, whether to automatically assign a public IP address to each of the layer's instances.
+* `custom_instance_profile_arn` - (Optional) The ARN of an IAM profile that will be used for the layer's instances.
+* `custom_security_group_ids` - (Optional) Ids for a set of security groups to apply to the layer's instances.
+* `auto_healing` - (Optional) Whether to enable auto-healing for the layer.
+* `install_updates_on_boot` - (Optional) Whether to install OS and package updates on each instance when it boots.
+* `instance_shutdown_timeout` - (Optional) The time, in seconds, that OpsWorks will wait for Chef to complete after triggering the Shutdown event.
+* `elastic_load_balancer` - (Optional) Name of an Elastic Load Balancer to attach to this layer
+* `drain_elb_on_shutdown` - (Optional) Whether to enable Elastic Load Balancing connection draining.
+* `system_packages` - (Optional) Names of a set of system packages to install on the layer's instances.
+* `use_ebs_optimized_instances` - (Optional) Whether to use EBS-optimized instances.
+* `ebs_volume` - (Optional) `ebs_volume` blocks, as described below, will each create an EBS volume and connect it to the layer's instances.
+* `custom_json` - (Optional) Custom JSON attributes to apply to the layer.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+The following extra optional arguments, all lists of Chef recipe names, allow
+custom Chef recipes to be applied to layer instances at the five different
+lifecycle events, if custom cookbooks are enabled on the layer's stack:
+
+* `custom_configure_recipes`
+* `custom_deploy_recipes`
+* `custom_setup_recipes`
+* `custom_shutdown_recipes`
+* `custom_undeploy_recipes`
+
+An `ebs_volume` block supports the following arguments:
+
+* `mount_point` - (Required) The path to mount the EBS volume on the layer's instances.
+* `size` - (Required) The size of the volume in gigabytes.
+* `number_of_disks` - (Required) The number of disks to use for the EBS volume.
+* `raid_level` - (Required) The RAID level to use for the volume.
+* `type` - (Optional) The type of volume to create. This may be `standard` (the default), `io1` or `gp2`.
+* `iops` - (Optional) For PIOPS volumes, the IOPS per disk.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The id of the layer.
+* `arn` - The Amazon Resource Name(ARN) of the layer.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import OpsWorks PHP Application Layers using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import OpsWorks PHP Application Layers using the `id`. For example:
+
+```console
+% terraform import aws_opsworks_php_app_layer.bar 00000000-0000-0000-0000-000000000000
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ac5e291147ea7833ab078073c4e098f41fa5009ff6f6cd79bf2e60602b07f542 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/opsworks_rails_app_layer.html.markdown b/website/docs/cdktf/python/r/opsworks_rails_app_layer.html.markdown
new file mode 100644
index 00000000000..74867966489
--- /dev/null
+++ b/website/docs/cdktf/python/r/opsworks_rails_app_layer.html.markdown
@@ -0,0 +1,88 @@
+---
+subcategory: "OpsWorks"
+layout: "aws"
+page_title: "AWS: aws_opsworks_rails_app_layer"
+description: |-
+  Provides an OpsWorks Ruby on Rails application layer resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_opsworks_rails_app_layer
+
+Provides an OpsWorks Ruby on Rails application layer resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.opsworks_rails_app_layer import OpsworksRailsAppLayer
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        OpsworksRailsAppLayer(self, "app",
+            stack_id=main.id
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `stack_id` - (Required) ID of the stack the layer will belong to.
+* `name` - (Optional) A human-readable name for the layer.
+* `app_server` - (Optional) Keyword for the app server to use. Defaults to "apache_passenger".
+* `auto_assign_elastic_ips` - (Optional) Whether to automatically assign an elastic IP address to the layer's instances.
+* `auto_assign_public_ips` - (Optional) For stacks belonging to a VPC, whether to automatically assign a public IP address to each of the layer's instances.
+* `bundler_version` - (Optional) When OpsWorks is managing Bundler, which version to use. Defaults to "1.5.3".
+* `custom_instance_profile_arn` - (Optional) The ARN of an IAM profile that will be used for the layer's instances.
+* `custom_security_group_ids` - (Optional) Ids for a set of security groups to apply to the layer's instances.
+* `auto_healing` - (Optional) Whether to enable auto-healing for the layer.
+* `install_updates_on_boot` - (Optional) Whether to install OS and package updates on each instance when it boots.
+* `instance_shutdown_timeout` - (Optional) The time, in seconds, that OpsWorks will wait for Chef to complete after triggering the Shutdown event.
+* `elastic_load_balancer` - (Optional) Name of an Elastic Load Balancer to attach to this layer
+* `drain_elb_on_shutdown` - (Optional) Whether to enable Elastic Load Balancing connection draining.
+* `manage_bundler` - (Optional) Whether OpsWorks should manage bundler. On by default.
+* `passenger_version` - (Optional) The version of Passenger to use. Defaults to "4.0.46".
+* `ruby_version` - (Optional) The version of Ruby to use. Defaults to "2.0.0".
+* `rubygems_version` - (Optional) The version of RubyGems to use. Defaults to "2.2.2".
+* `system_packages` - (Optional) Names of a set of system packages to install on the layer's instances.
+* `use_ebs_optimized_instances` - (Optional) Whether to use EBS-optimized instances.
+* `ebs_volume` - (Optional) `ebs_volume` blocks, as described below, will each create an EBS volume and connect it to the layer's instances.
+* `custom_json` - (Optional) Custom JSON attributes to apply to the layer.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+The following extra optional arguments, all lists of Chef recipe names, allow
+custom Chef recipes to be applied to layer instances at the five different
+lifecycle events, if custom cookbooks are enabled on the layer's stack:
+
+* `custom_configure_recipes`
+* `custom_deploy_recipes`
+* `custom_setup_recipes`
+* `custom_shutdown_recipes`
+* `custom_undeploy_recipes`
+
+An `ebs_volume` block supports the following arguments:
+
+* `mount_point` - (Required) The path to mount the EBS volume on the layer's instances.
+* `size` - (Required) The size of the volume in gigabytes.
+* `number_of_disks` - (Required) The number of disks to use for the EBS volume.
+* `raid_level` - (Required) The RAID level to use for the volume.
+* `type` - (Optional) The type of volume to create. This may be `standard` (the default), `io1` or `gp2`.
+* `iops` - (Optional) For PIOPS volumes, the IOPS per disk.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The id of the layer.
+* `arn` - The Amazon Resource Name(ARN) of the layer.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+<!-- cache-key: cdktf-0.18.0 input-0f3775b22189f8a94dca97cbbedc1243db234478a6e520629d72fc3e43b825a7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/opsworks_rds_db_instance.html.markdown b/website/docs/cdktf/python/r/opsworks_rds_db_instance.html.markdown
new file mode 100644
index 00000000000..fcb6b819e9e
--- /dev/null
+++ b/website/docs/cdktf/python/r/opsworks_rds_db_instance.html.markdown
@@ -0,0 +1,55 @@
+---
+subcategory: "OpsWorks"
+layout: "aws"
+page_title: "AWS: aws_opsworks_rds_db_instance"
+description: |-
+  Provides an OpsWorks RDS DB Instance resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_opsworks_rds_db_instance
+
+Provides an OpsWorks RDS DB Instance resource.
+
+~> **Note:** All arguments including the username and password will be stored in the raw state as plain-text.
+[Read more about sensitive data in state](https://www.terraform.io/docs/state/sensitive-data.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.opsworks_rds_db_instance import OpsworksRdsDbInstance
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        OpsworksRdsDbInstance(self, "my_instance",
+            db_password="somePass",
+            db_user="someUser",
+            rds_db_instance_arn=Token.as_string(aws_db_instance_my_instance.arn),
+            stack_id=my_stack.id
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `stack_id` - (Required) The stack to register a db instance for. Changing this will force a new resource.
+* `rds_db_instance_arn` - (Required) The db instance to register for this stack. Changing this will force a new resource.
+* `db_user` - (Required) A db username
+* `db_password` - (Required) A db password
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The computed id. Please note that this is only used internally to identify the stack <-> instance relation. This value is not used in aws.
+
+<!-- cache-key: cdktf-0.18.0 input-817f20cc1cc9aa2f73aef052eaf0556b740b93e3bb7a4c3f68cb42d1fde8afc2 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/opsworks_stack.html.markdown b/website/docs/cdktf/python/r/opsworks_stack.html.markdown
new file mode 100644
index 00000000000..a6bcc2c1831
--- /dev/null
+++ b/website/docs/cdktf/python/r/opsworks_stack.html.markdown
@@ -0,0 +1,108 @@
+---
+subcategory: "OpsWorks"
+layout: "aws"
+page_title: "AWS: aws_opsworks_stack"
+description: |-
+  Provides an OpsWorks stack resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_opsworks_stack
+
+Provides an OpsWorks stack resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.opsworks_stack import OpsworksStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        OpsworksStack(self, "main",
+            custom_json="{\n \"foobar\": {\n    \"version\": \"1.0.0\"\n  }\n}\n\n",
+            default_instance_profile_arn=opsworks.arn,
+            name="awesome-stack",
+            region="us-west-1",
+            service_role_arn=Token.as_string(aws_iam_role_opsworks.arn),
+            tags={
+                "Name": "foobar-terraform-stack"
+            }
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the stack.
+* `region` - (Required) The name of the region where the stack will exist.
+* `service_role_arn` - (Required) The ARN of an IAM role that the OpsWorks service will act as.
+* `default_instance_profile_arn` - (Required) The ARN of an IAM Instance Profile that created instances will have by default.
+* `agent_version` - (Optional) If set to `"LATEST"`, OpsWorks will automatically install the latest version.
+* `berkshelf_version` - (Optional) If `manage_berkshelf` is enabled, the version of Berkshelf to use.
+* `color` - (Optional) Color to paint next to the stack's resources in the OpsWorks console.
+* `configuration_manager_name` - (Optional) Name of the configuration manager to use. Defaults to "Chef".
+* `configuration_manager_version` - (Optional) Version of the configuration manager to use. Defaults to "11.4".
+* `custom_cookbooks_source` - (Optional) When `use_custom_cookbooks` is set, provide this sub-object as described below.
+* `custom_json` - (Optional) User defined JSON passed to "Chef". Use a "here doc" for multiline JSON.
+* `default_availability_zone` - (Optional) Name of the availability zone where instances will be created by default.
+  Cannot be set when `vpc_id` is set.
+* `default_os` - (Optional) Name of OS that will be installed on instances by default.
+* `default_root_device_type` - (Optional) Name of the type of root device instances will have by default.
+* `default_ssh_key_name` - (Optional) Name of the SSH keypair that instances will have by default.
+* `default_subnet_id` - (Optional) ID of the subnet in which instances will be created by default.
+  Required if `vpc_id` is set to a VPC other than the default VPC, and forbidden if it isn't.
+* `hostname_theme` - (Optional) Keyword representing the naming scheme that will be used for instance hostnames within this stack.
+* `manage_berkshelf` - (Optional) Boolean value controlling whether Opsworks will run Berkshelf for this stack.
+* `tags` - (Optional) A map of tags to assign to the resource.
+  If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `use_custom_cookbooks` - (Optional) Boolean value controlling whether the custom cookbook settings are enabled.
+* `use_opsworks_security_groups` - (Optional) Boolean value controlling whether the standard OpsWorks security groups apply to created instances.
+* `vpc_id` - (Optional) ID of the VPC that this stack belongs to.
+  Defaults to the region's default VPC.
+* `custom_json` - (Optional) Custom JSON attributes to apply to the entire stack.
+
+The `custom_cookbooks_source` block supports the following arguments:
+
+* `type` - (Required) The type of source to use. For example, "archive".
+* `url` - (Required) The URL where the cookbooks resource can be found.
+* `username` - (Optional) Username to use when authenticating to the source.
+* `password` - (Optional) Password to use when authenticating to the source. Terraform cannot perform drift detection of this configuration.
+* `ssh_key` - (Optional) SSH key to use when authenticating to the source. Terraform cannot perform drift detection of this configuration.
+* `revision` - (Optional) For sources that are version-aware, the revision to use.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The id of the stack.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import OpsWorks stacks using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import OpsWorks stacks using the `id`. For example:
+
+```console
+% terraform import aws_opsworks_stack.bar 00000000-0000-0000-0000-000000000000
+```
+
+<!-- cache-key: cdktf-0.18.0 input-cbf03513c58946c4bc846b656ee35719904926d5e3f1cfba67219305564f8a4f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/opsworks_static_web_layer.html.markdown b/website/docs/cdktf/python/r/opsworks_static_web_layer.html.markdown
new file mode 100644
index 00000000000..bd665fbd9a3
--- /dev/null
+++ b/website/docs/cdktf/python/r/opsworks_static_web_layer.html.markdown
@@ -0,0 +1,100 @@
+---
+subcategory: "OpsWorks"
+layout: "aws"
+page_title: "AWS: aws_opsworks_static_web_layer"
+description: |-
+  Provides an OpsWorks static web server layer resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_opsworks_static_web_layer
+
+Provides an OpsWorks static web server layer resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.opsworks_static_web_layer import OpsworksStaticWebLayer
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        OpsworksStaticWebLayer(self, "web",
+            stack_id=main.id
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `stack_id` - (Required) ID of the stack the layer will belong to.
+* `name` - (Optional) A human-readable name for the layer.
+* `auto_assign_elastic_ips` - (Optional) Whether to automatically assign an elastic IP address to the layer's instances.
+* `auto_assign_public_ips` - (Optional) For stacks belonging to a VPC, whether to automatically assign a public IP address to each of the layer's instances.
+* `custom_instance_profile_arn` - (Optional) The ARN of an IAM profile that will be used for the layer's instances.
+* `custom_security_group_ids` - (Optional) Ids for a set of security groups to apply to the layer's instances.
+* `auto_healing` - (Optional) Whether to enable auto-healing for the layer.
+* `install_updates_on_boot` - (Optional) Whether to install OS and package updates on each instance when it boots.
+* `instance_shutdown_timeout` - (Optional) The time, in seconds, that OpsWorks will wait for Chef to complete after triggering the Shutdown event.
+* `elastic_load_balancer` - (Optional) Name of an Elastic Load Balancer to attach to this layer
+* `drain_elb_on_shutdown` - (Optional) Whether to enable Elastic Load Balancing connection draining.
+* `system_packages` - (Optional) Names of a set of system packages to install on the layer's instances.
+* `use_ebs_optimized_instances` - (Optional) Whether to use EBS-optimized instances.
+* `ebs_volume` - (Optional) `ebs_volume` blocks, as described below, will each create an EBS volume and connect it to the layer's instances.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+The following extra optional arguments, all lists of Chef recipe names, allow
+custom Chef recipes to be applied to layer instances at the five different
+lifecycle events, if custom cookbooks are enabled on the layer's stack:
+
+* `custom_configure_recipes`
+* `custom_deploy_recipes`
+* `custom_setup_recipes`
+* `custom_shutdown_recipes`
+* `custom_undeploy_recipes`
+
+An `ebs_volume` block supports the following arguments:
+
+* `mount_point` - (Required) The path to mount the EBS volume on the layer's instances.
+* `size` - (Required) The size of the volume in gigabytes.
+* `number_of_disks` - (Required) The number of disks to use for the EBS volume.
+* `raid_level` - (Required) The RAID level to use for the volume.
+* `type` - (Optional) The type of volume to create. This may be `standard` (the default), `io1` or `gp2`.
+* `iops` - (Optional) For PIOPS volumes, the IOPS per disk.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The id of the layer.
+* `arn` - The Amazon Resource Name(ARN) of the layer.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import OpsWorks static web server Layers using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import OpsWorks static web server Layers using the `id`. For example:
+
+```console
+% terraform import aws_opsworks_static_web_layer.bar 00000000-0000-0000-0000-000000000000
+```
+
+<!-- cache-key: cdktf-0.18.0 input-b665b8ab1c91c89ecda4cd4ed2a377ea3926ce423b0553dcf7179d8cd94006c6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/opsworks_user_profile.html.markdown b/website/docs/cdktf/python/r/opsworks_user_profile.html.markdown
new file mode 100644
index 00000000000..aa2db78428d
--- /dev/null
+++ b/website/docs/cdktf/python/r/opsworks_user_profile.html.markdown
@@ -0,0 +1,50 @@
+---
+subcategory: "OpsWorks"
+layout: "aws"
+page_title: "AWS: aws_opsworks_user_profile"
+description: |-
+  Provides an OpsWorks User Profile resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_opsworks_user_profile
+
+Provides an OpsWorks User Profile resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.opsworks_user_profile import OpsworksUserProfile
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        OpsworksUserProfile(self, "my_profile",
+            ssh_username="my_user",
+            user_arn=user.arn
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `user_arn` - (Required) The user's IAM ARN
+* `allow_self_management` - (Optional) Whether users can specify their own SSH public key through the My Settings page
+* `ssh_username` - (Required) The ssh username, with witch this user wants to log in
+* `ssh_public_key` - (Optional) The users public key
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Same value as `user_arn`
+
+<!-- cache-key: cdktf-0.18.0 input-731328ff75f486df9bef040dc213e2c98c675ba2402982b18b6e320cea2b89f9 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/organizations_account.html.markdown b/website/docs/cdktf/python/r/organizations_account.html.markdown
new file mode 100644
index 00000000000..9cd8cf0cf56
--- /dev/null
+++ b/website/docs/cdktf/python/r/organizations_account.html.markdown
@@ -0,0 +1,108 @@
+---
+subcategory: "Organizations"
+layout: "aws"
+page_title: "AWS: aws_organizations_account"
+description: |-
+  Provides a resource to create a member account in the current AWS Organization.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_organizations_account
+
+Provides a resource to create a member account in the current organization.
+
+~> **Note:** Account management must be done from the organization's root account.
+
+~> **Note:** By default, deleting this Terraform resource will only remove an AWS account from an organization. You must set the `close_on_deletion` flag to true to close the account. It is worth noting that quotas are enforced when using the `close_on_deletion` argument, which can produce a [CLOSE_ACCOUNT_QUOTA_EXCEEDED](https://docs.aws.amazon.com/organizations/latest/APIReference/API_CloseAccount.html) error, and require you to close the account manually.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.organizations_account import OrganizationsAccount
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        OrganizationsAccount(self, "account",
+            email="john@doe.org",
+            name="my_new_account"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `email` - (Required) Email address of the owner to assign to the new member account. This email address must not already be associated with another AWS account.
+* `name` - (Required) Friendly name for the member account.
+
+The following arguments are optional:
+
+* `close_on_deletion` - (Optional) If true, a deletion event will close the account. Otherwise, it will only remove from the organization. This is not supported for GovCloud accounts.
+* `create_govcloud` - (Optional) Whether to also create a GovCloud account. The GovCloud account is tied to the main (commercial) account this resource creates. If `true`, the GovCloud account ID is available in the `govcloud_id` attribute. The only way to manage the GovCloud account with Terraform is to subsequently import the account using this resource.
+* `iam_user_access_to_billing` - (Optional) If set to `ALLOW`, the new account enables IAM users and roles to access account billing information if they have the required permissions. If set to `DENY`, then only the root user (and no roles) of the new account can access account billing information. If this is unset, the AWS API will default this to `ALLOW`. If the resource is created and this option is changed, it will try to recreate the account.
+* `parent_id` - (Optional) Parent Organizational Unit ID or Root ID for the account. Defaults to the Organization default Root ID. A configuration must be present for this argument to perform drift detection.
+* `role_name` - (Optional) The name of an IAM role that Organizations automatically preconfigures in the new member account. This role trusts the root account, allowing users in the root account to assume the role, as permitted by the root account administrator. The role has administrator permissions in the new member account. The Organizations API provides no method for reading this information after account creation, so Terraform cannot perform drift detection on its value and will always show a difference for a configured value after import unless [`ignore_changes`](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html#ignore_changes) is used.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN for this account.
+* `govcloud_id` - ID for a GovCloud account created with the account.
+* `id` - The AWS account id
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import the AWS member account using the `account_id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import the AWS member account using the `account_id`. For example:
+
+```console
+% terraform import aws_organizations_account.my_account 111111111111
+```
+
+Certain resource arguments, like `role_name`, do not have an Organizations API method for reading the information after account creation. If the argument is set in the Terraform configuration on an imported resource, Terraform will always show a difference. To workaround this behavior, either omit the argument from the Terraform configuration or use [`ignore_changes`](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html#ignore_changes) to hide the difference. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from cdktf import TerraformResourceLifecycle
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.organizations_account import OrganizationsAccount
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        OrganizationsAccount(self, "account",
+            email="john@doe.org",
+            lifecycle=TerraformResourceLifecycle(
+                ignore_changes=[role_name]
+            ),
+            name="my_new_account",
+            role_name="myOrganizationRole"
+        )
+```
+
+<!-- cache-key: cdktf-0.18.0 input-89da6aca32443c4e344056b6e4e5713d71a00388c00bb09afc4a3dcf0c828f09 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/organizations_delegated_administrator.html.markdown b/website/docs/cdktf/python/r/organizations_delegated_administrator.html.markdown
new file mode 100644
index 00000000000..10aab82d8b9
--- /dev/null
+++ b/website/docs/cdktf/python/r/organizations_delegated_administrator.html.markdown
@@ -0,0 +1,74 @@
+---
+subcategory: "Organizations"
+layout: "aws"
+page_title: "AWS: aws_organizations_delegated_administrator"
+description: |-
+  Provides a resource to manage an AWS Organizations Delegated Administrator.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_organizations_delegated_administrator
+
+Provides a resource to manage an [AWS Organizations Delegated Administrator](https://docs.aws.amazon.com/organizations/latest/APIReference/API_RegisterDelegatedAdministrator.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.organizations_delegated_administrator import OrganizationsDelegatedAdministrator
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        OrganizationsDelegatedAdministrator(self, "example",
+            account_id="123456789012",
+            service_principal="principal"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `account_id` - (Required) The account ID number of the member account in the organization to register as a delegated administrator.
+* `service_principal` - (Required) The service principal of the AWS service for which you want to make the member account a delegated administrator.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The unique identifier (ID) of the delegated administrator.
+* `arn` - The Amazon Resource Name (ARN) of the delegated administrator's account.
+* `delegation_enabled_date` - The date when the account was made a delegated administrator.
+* `email` - The email address that is associated with the delegated administrator's AWS account.
+* `joined_method` - The method by which the delegated administrator's account joined the organization.
+* `joined_timestamp` - The date when the delegated administrator's account became a part of the organization.
+* `name` - The friendly name of the delegated administrator's account.
+* `status` - The status of the delegated administrator's account in the organization.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_organizations_delegated_administrator` using the account ID and its service principal. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_organizations_delegated_administrator` using the account ID and its service principal. For example:
+
+```console
+% terraform import aws_organizations_delegated_administrator.example 123456789012/config.amazonaws.com
+```
+
+<!-- cache-key: cdktf-0.18.0 input-745d938c3be3fdd51b8f44d7c0633f240dd4da83077531ec5a373a21b8a1ceb8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/organizations_organization.html.markdown b/website/docs/cdktf/python/r/organizations_organization.html.markdown
new file mode 100644
index 00000000000..e440144179d
--- /dev/null
+++ b/website/docs/cdktf/python/r/organizations_organization.html.markdown
@@ -0,0 +1,96 @@
+---
+subcategory: "Organizations"
+layout: "aws"
+page_title: "AWS: aws_organizations_organization"
+description: |-
+  Provides a resource to create an organization.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_organizations_organization
+
+Provides a resource to create an organization.
+
+!> **WARNING:** When migrating from a `feature_set` of `CONSOLIDATED_BILLING` to `ALL`, the Organization account owner will received an email stating the following: "You started the process to enable all features for your AWS organization. As part of that process, all member accounts that joined your organization by invitation must approve the change. You don’t need approval from member accounts that you directly created from within your AWS organization." After all member accounts have accepted the invitation, the Organization account owner must then finalize the changes via the [AWS Console](https://console.aws.amazon.com/organizations/home#/organization/settings/migration-progress). Until these steps are performed, Terraform will perpetually show a difference, and the `DescribeOrganization` API will continue to show the `FeatureSet` as `CONSOLIDATED_BILLING`. See the [AWS Organizations documentation](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_org_support-all-features.html) for more information.
+
+!> **WARNING:** [Warning from the AWS Docs](https://docs.aws.amazon.com/organizations/latest/APIReference/API_EnableAWSServiceAccess.html): "We recommend that you enable integration between AWS Organizations and the specified AWS service by using the console or commands that are provided by the specified service. Doing so ensures that the service is aware that it can create the resources that are required for the integration. How the service creates those resources in the organization's accounts depends on that service. For more information, see the documentation for the other AWS service."
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.organizations_organization import OrganizationsOrganization
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        OrganizationsOrganization(self, "org",
+            aws_service_access_principals=["cloudtrail.amazonaws.com", "config.amazonaws.com"
+            ],
+            feature_set="ALL"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `aws_service_access_principals` - (Optional) List of AWS service principal names for which you want to enable integration with your organization. This is typically in the form of a URL, such as service-abbreviation.amazonaws.com. Organization must have `feature_set` set to `ALL`. Some services do not support enablement via this endpoint, see [warning in aws docs](https://docs.aws.amazon.com/organizations/latest/APIReference/API_EnableAWSServiceAccess.html).
+* `enabled_policy_types` - (Optional) List of Organizations policy types to enable in the Organization Root. Organization must have `feature_set` set to `ALL`. For additional information about valid policy types (e.g., `AISERVICES_OPT_OUT_POLICY`, `BACKUP_POLICY`, `SERVICE_CONTROL_POLICY`, and `TAG_POLICY`), see the [AWS Organizations API Reference](https://docs.aws.amazon.com/organizations/latest/APIReference/API_EnablePolicyType.html).
+* `feature_set` - (Optional) Specify "ALL" (default) or "CONSOLIDATED_BILLING".
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `accounts` - List of organization accounts including the master account. For a list excluding the master account, see the `non_master_accounts` attribute. All elements have these attributes:
+    * `arn` - ARN of the account
+    * `email` - Email of the account
+    * `id` - Identifier of the account
+    * `name` - Name of the account
+    * `status` - Current status of the account
+* `arn` - ARN of the organization
+* `id` - Identifier of the organization
+* `master_account_arn` - ARN of the master account
+* `master_account_email` - Email address of the master account
+* `master_account_id` - Identifier of the master account
+* `non_master_accounts` - List of organization accounts excluding the master account. For a list including the master account, see the `accounts` attribute. All elements have these attributes:
+    * `arn` - ARN of the account
+    * `email` - Email of the account
+    * `id` - Identifier of the account
+    * `name` - Name of the account
+    * `status` - Current status of the account
+* `roots` - List of organization roots. All elements have these attributes:
+    * `arn` - ARN of the root
+    * `id` - Identifier of the root
+    * `name` - Name of the root
+    * `policy_types` - List of policy types enabled for this root. All elements have these attributes:
+        * `name` - The name of the policy type
+        * `status` - The status of the policy type as it relates to the associated root
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import the AWS organization using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import the AWS organization using the `id`. For example:
+
+```console
+% terraform import aws_organizations_organization.my_org o-1234567
+```
+
+<!-- cache-key: cdktf-0.18.0 input-94624882d07e9da3b0a6aac6dc0902e40fde096b01acc4c3e884c266bbfd7a56 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/organizations_organizational_unit.html.markdown b/website/docs/cdktf/python/r/organizations_organizational_unit.html.markdown
new file mode 100644
index 00000000000..f8bad98f13f
--- /dev/null
+++ b/website/docs/cdktf/python/r/organizations_organizational_unit.html.markdown
@@ -0,0 +1,76 @@
+---
+subcategory: "Organizations"
+layout: "aws"
+page_title: "AWS: aws_organizations_organizational_unit"
+description: |-
+  Provides a resource to create an organizational unit.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_organizations_organizational_unit
+
+Provides a resource to create an organizational unit.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.organizations_organizational_unit import OrganizationsOrganizationalUnit
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        OrganizationsOrganizationalUnit(self, "example",
+            name="example",
+            parent_id=Token.as_string(
+                Fn.lookup_nested(aws_organizations_organization_example.roots, ["0", "id"]))
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - The name for the organizational unit
+* `parent_id` - ID of the parent organizational unit, which may be the root
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `accounts` - List of child accounts for this Organizational Unit. Does not return account information for child Organizational Units. All elements have these attributes:
+    * `arn` - ARN of the account
+    * `email` - Email of the account
+    * `id` - Identifier of the account
+    * `name` - Name of the account
+* `arn` - ARN of the organizational unit
+* `id` - Identifier of the organization unit
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AWS Organizations Organizational Units using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import AWS Organizations Organizational Units using the `id`. For example:
+
+```console
+% terraform import aws_organizations_organizational_unit.example ou-1234567
+```
+
+<!-- cache-key: cdktf-0.18.0 input-e83646b093e28cb1e4ec4a1afa0a1e1832d418c207b7f14b799f6e614b256dc8 -->
diff --git a/website/docs/cdktf/python/r/organizations_policy.html.markdown b/website/docs/cdktf/python/r/organizations_policy.html.markdown
new file mode 100644
index 00000000000..569b4f12a64
--- /dev/null
+++ b/website/docs/cdktf/python/r/organizations_policy.html.markdown
@@ -0,0 +1,84 @@
+---
+subcategory: "Organizations"
+layout: "aws"
+page_title: "AWS: aws_organizations_policy"
+description: |-
+  Provides a resource to manage an AWS Organizations policy.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_organizations_policy
+
+Provides a resource to manage an [AWS Organizations policy](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.organizations_policy import OrganizationsPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = DataAwsIamPolicyDocument(self, "example",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["*"],
+                effect="Allow",
+                resources=["*"]
+            )
+            ]
+        )
+        aws_organizations_policy_example = OrganizationsPolicy(self, "example_1",
+            content=Token.as_string(example.json),
+            name="example"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_organizations_policy_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `content` - (Required) The policy content to add to the new policy. For example, if you create a [service control policy (SCP)](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scp.html), this string must be JSON text that specifies the permissions that admins in attached accounts can delegate to their users, groups, and roles. For more information about the SCP syntax, see the [Service Control Policy Syntax documentation](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_reference_scp-syntax.html) and for more information on the Tag Policy syntax, see the [Tag Policy Syntax documentation](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_example-tag-policies.html).
+* `name` - (Required) The friendly name to assign to the policy.
+* `description` - (Optional) A description to assign to the policy.
+* `skip_destroy` - (Optional) If set to `true`, destroy will **not** delete the policy and instead just remove the resource from state. This can be useful in situations where the policies (and the associated attachment) must be preserved to meet the AWS minimum requirement of 1 attached policy.
+* `type` - (Optional) The type of policy to create. Valid values are `AISERVICES_OPT_OUT_POLICY`, `BACKUP_POLICY`, `SERVICE_CONTROL_POLICY` (SCP), and `TAG_POLICY`. Defaults to `SERVICE_CONTROL_POLICY`.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The unique identifier (ID) of the policy.
+* `arn` - Amazon Resource Name (ARN) of the policy.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_organizations_policy` using the policy ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_organizations_policy` using the policy ID. For example:
+
+```console
+% terraform import aws_organizations_policy.example p-12345678
+```
+
+<!-- cache-key: cdktf-0.18.0 input-128c9bb3bbac2ba8788017312dc8562e953ffd4a69f70d461a1f9b33a72a9acc -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/organizations_policy_attachment.html.markdown b/website/docs/cdktf/python/r/organizations_policy_attachment.html.markdown
new file mode 100644
index 00000000000..37633b03204
--- /dev/null
+++ b/website/docs/cdktf/python/r/organizations_policy_attachment.html.markdown
@@ -0,0 +1,113 @@
+---
+subcategory: "Organizations"
+layout: "aws"
+page_title: "AWS: aws_organizations_policy_attachment"
+description: |-
+  Provides a resource to attach an AWS Organizations policy to an organization account, root, or unit.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_organizations_policy_attachment
+
+Provides a resource to attach an AWS Organizations policy to an organization account, root, or unit.
+
+## Example Usage
+
+### Organization Account
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.organizations_policy_attachment import OrganizationsPolicyAttachment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        OrganizationsPolicyAttachment(self, "account",
+            policy_id=example.id,
+            target_id="123456789012"
+        )
+```
+
+### Organization Root
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.organizations_policy_attachment import OrganizationsPolicyAttachment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        OrganizationsPolicyAttachment(self, "root",
+            policy_id=example.id,
+            target_id=Token.as_string(
+                Fn.lookup_nested(aws_organizations_organization_example.roots, ["0", "id"]))
+        )
+```
+
+### Organization Unit
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.organizations_policy_attachment import OrganizationsPolicyAttachment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        OrganizationsPolicyAttachment(self, "unit",
+            policy_id=example.id,
+            target_id=Token.as_string(aws_organizations_organizational_unit_example.id)
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `policy_id` - (Required) The unique identifier (ID) of the policy that you want to attach to the target.
+* `target_id` - (Required) The unique identifier (ID) of the root, organizational unit, or account number that you want to attach the policy to.
+* `skip_destroy` - (Optional) If set to `true`, destroy will **not** detach the policy and instead just remove the resource from state. This can be useful in situations where the attachment must be preserved to meet the AWS minimum requirement of 1 attached policy.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_organizations_policy_attachment` using the target ID and policy ID. For example:
+
+With an account target:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_organizations_policy_attachment` using the target ID and policy ID. For example:
+
+With an account target:
+
+```console
+% terraform import aws_organizations_policy_attachment.account 123456789012:p-12345678
+```
+
+<!-- cache-key: cdktf-0.18.0 input-3828ee0215ac304d4e2eeebab26c79536b060060799e87c63d57f977fbfbfab6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/organizations_resource_policy.html.markdown b/website/docs/cdktf/python/r/organizations_resource_policy.html.markdown
new file mode 100644
index 00000000000..85fb44fdd89
--- /dev/null
+++ b/website/docs/cdktf/python/r/organizations_resource_policy.html.markdown
@@ -0,0 +1,68 @@
+---
+subcategory: "Organizations"
+layout: "aws"
+page_title: "AWS: aws_organizations_resource_policy"
+description: |-
+  Provides a resource to manage an AWS Organizations resource policy.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_organizations_resource_policy
+
+Provides a resource to manage a resource-based delegation policy that can be used to delegate policy management for AWS Organizations to specified member accounts to perform policy actions that are by default available only to the management account. See the [_AWS Organizations User Guide_](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_delegate_policies.html) for more information.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.organizations_resource_policy import OrganizationsResourcePolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        OrganizationsResourcePolicy(self, "example",
+            content="{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Sid\": \"DelegatingNecessaryDescribeListActions\",\n      \"Effect\": \"Allow\",\n      \"Principal\": {\n        \"AWS\": \"arn:aws:iam::123456789012:root\"\n      },\n      \"Action\": [\n        \"organizations:DescribeOrganization\",\n        \"organizations:DescribeOrganizationalUnit\",\n        \"organizations:DescribeAccount\",\n        \"organizations:DescribePolicy\",\n        \"organizations:DescribeEffectivePolicy\",\n        \"organizations:ListRoots\",\n        \"organizations:ListOrganizationalUnitsForParent\",\n        \"organizations:ListParents\",\n        \"organizations:ListChildren\",\n        \"organizations:ListAccounts\",\n        \"organizations:ListAccountsForParent\",\n        \"organizations:ListPolicies\",\n        \"organizations:ListPoliciesForTarget\",\n        \"organizations:ListTargetsForPolicy\",\n        \"organizations:ListTagsForResource\"\n      ],\n      \"Resource\": \"*\"\n    }\n  ]\n}\n\n"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `content` - (Required) Content for the resource policy. The text must be correctly formatted JSON that complies with the syntax for the resource policy's type. See the [_AWS Organizations User Guide_](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_delegate_examples.html) for examples.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the resource policy.
+* `id` - The unique identifier (ID) of the resource policy.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_organizations_resource_policy` using the resource policy ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_organizations_resource_policy` using the resource policy ID. For example:
+
+```console
+% terraform import aws_organizations_resource_policy.example rp-12345678
+```
+
+<!-- cache-key: cdktf-0.18.0 input-8ab0a24a6a925579576b2c3639c5565582765d7c5d8c19ab463df7b7d85f9483 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/pinpoint_adm_channel.html.markdown b/website/docs/cdktf/python/r/pinpoint_adm_channel.html.markdown
new file mode 100644
index 00000000000..e7598a70b75
--- /dev/null
+++ b/website/docs/cdktf/python/r/pinpoint_adm_channel.html.markdown
@@ -0,0 +1,74 @@
+---
+subcategory: "Pinpoint"
+layout: "aws"
+page_title: "AWS: aws_pinpoint_adm_channel"
+description: |-
+  Provides a Pinpoint ADM Channel resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_pinpoint_adm_channel
+
+Provides a Pinpoint ADM (Amazon Device Messaging) Channel resource.
+
+~> **Note:** All arguments including the Client ID and Client Secret will be stored in the raw state as plain-text.
+[Read more about sensitive data in state](https://www.terraform.io/docs/state/sensitive-data.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.pinpoint_adm_channel import PinpointAdmChannel
+from imports.aws.pinpoint_app import PinpointApp
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        app = PinpointApp(self, "app")
+        PinpointAdmChannel(self, "channel",
+            application_id=app.application_id,
+            client_id="",
+            client_secret="",
+            enabled=True
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `application_id` - (Required) The application ID.
+* `client_id` - (Required) Client ID (part of OAuth Credentials) obtained via Amazon Developer Account.
+* `client_secret` - (Required) Client Secret (part of OAuth Credentials) obtained via Amazon Developer Account.
+* `enabled` - (Optional) Specifies whether to enable the channel. Defaults to `true`.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Pinpoint ADM Channel using the `application-id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Pinpoint ADM Channel using the `application-id`. For example:
+
+```console
+% terraform import aws_pinpoint_adm_channel.channel application-id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-e30cdacbcd0d1d318a6eb43fc0d36eaf1fd763528beb84e0e7303428d7cdffa4 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/pinpoint_adm_channel.markdown b/website/docs/cdktf/python/r/pinpoint_adm_channel.markdown
new file mode 100644
index 00000000000..e7598a70b75
--- /dev/null
+++ b/website/docs/cdktf/python/r/pinpoint_adm_channel.markdown
@@ -0,0 +1,74 @@
+---
+subcategory: "Pinpoint"
+layout: "aws"
+page_title: "AWS: aws_pinpoint_adm_channel"
+description: |-
+  Provides a Pinpoint ADM Channel resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_pinpoint_adm_channel
+
+Provides a Pinpoint ADM (Amazon Device Messaging) Channel resource.
+
+~> **Note:** All arguments including the Client ID and Client Secret will be stored in the raw state as plain-text.
+[Read more about sensitive data in state](https://www.terraform.io/docs/state/sensitive-data.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.pinpoint_adm_channel import PinpointAdmChannel
+from imports.aws.pinpoint_app import PinpointApp
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        app = PinpointApp(self, "app")
+        PinpointAdmChannel(self, "channel",
+            application_id=app.application_id,
+            client_id="",
+            client_secret="",
+            enabled=True
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `application_id` - (Required) The application ID.
+* `client_id` - (Required) Client ID (part of OAuth Credentials) obtained via Amazon Developer Account.
+* `client_secret` - (Required) Client Secret (part of OAuth Credentials) obtained via Amazon Developer Account.
+* `enabled` - (Optional) Specifies whether to enable the channel. Defaults to `true`.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Pinpoint ADM Channel using the `application-id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Pinpoint ADM Channel using the `application-id`. For example:
+
+```console
+% terraform import aws_pinpoint_adm_channel.channel application-id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-e30cdacbcd0d1d318a6eb43fc0d36eaf1fd763528beb84e0e7303428d7cdffa4 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/pinpoint_apns_channel.html.markdown b/website/docs/cdktf/python/r/pinpoint_apns_channel.html.markdown
new file mode 100644
index 00000000000..7494e397b29
--- /dev/null
+++ b/website/docs/cdktf/python/r/pinpoint_apns_channel.html.markdown
@@ -0,0 +1,89 @@
+---
+subcategory: "Pinpoint"
+layout: "aws"
+page_title: "AWS: aws_pinpoint_apns_channel"
+description: |-
+  Provides a Pinpoint APNs Channel resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_pinpoint_apns_channel
+
+Provides a Pinpoint APNs Channel resource.
+
+~> **Note:** All arguments, including certificates and tokens, will be stored in the raw state as plain-text.
+[Read more about sensitive data in state](https://www.terraform.io/docs/state/sensitive-data.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.pinpoint_apns_channel import PinpointApnsChannel
+from imports.aws.pinpoint_app import PinpointApp
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        app = PinpointApp(self, "app")
+        PinpointApnsChannel(self, "apns",
+            application_id=app.application_id,
+            certificate=Token.as_string(Fn.file("./certificate.pem")),
+            private_key=Token.as_string(Fn.file("./private_key.key"))
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `application_id` - (Required) The application ID.
+* `enabled` - (Optional) Whether the channel is enabled or disabled. Defaults to `true`.
+* `default_authentication_method` - (Optional) The default authentication method used for APNs.
+  __NOTE__: Amazon Pinpoint uses this default for every APNs push notification that you send using the console.
+  You can override the default when you send a message programmatically using the Amazon Pinpoint API, the AWS CLI, or an AWS SDK.
+  If your default authentication type fails, Amazon Pinpoint doesn't attempt to use the other authentication type.
+
+One of the following sets of credentials is also required.
+
+If you choose to use __Certificate credentials__ you will have to provide:
+
+* `certificate` - (Required) The pem encoded TLS Certificate from Apple.
+* `private_key` - (Required) The Certificate Private Key file (ie. `.key` file).
+
+If you choose to use __Key credentials__ you will have to provide:
+
+* `bundle_id` - (Required) The ID assigned to your iOS app. To find this value, choose Certificates, IDs & Profiles, choose App IDs in the Identifiers section, and choose your app.
+* `team_id` - (Required) The ID assigned to your Apple developer account team. This value is provided on the Membership page.
+* `token_key` - (Required) The `.p8` file that you download from your Apple developer account when you create an authentication key.
+* `token_key_id` - (Required) The ID assigned to your signing key. To find this value, choose Certificates, IDs & Profiles, and choose your key in the Keys section.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Pinpoint APNs Channel using the `application-id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Pinpoint APNs Channel using the `application-id`. For example:
+
+```console
+% terraform import aws_pinpoint_apns_channel.apns application-id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-7eba307ddd3d08953ef6f0e4866c8fec850eff4727157433a3de2bca6b525fba -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/pinpoint_apns_channel.markdown b/website/docs/cdktf/python/r/pinpoint_apns_channel.markdown
new file mode 100644
index 00000000000..7494e397b29
--- /dev/null
+++ b/website/docs/cdktf/python/r/pinpoint_apns_channel.markdown
@@ -0,0 +1,89 @@
+---
+subcategory: "Pinpoint"
+layout: "aws"
+page_title: "AWS: aws_pinpoint_apns_channel"
+description: |-
+  Provides a Pinpoint APNs Channel resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_pinpoint_apns_channel
+
+Provides a Pinpoint APNs Channel resource.
+
+~> **Note:** All arguments, including certificates and tokens, will be stored in the raw state as plain-text.
+[Read more about sensitive data in state](https://www.terraform.io/docs/state/sensitive-data.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.pinpoint_apns_channel import PinpointApnsChannel
+from imports.aws.pinpoint_app import PinpointApp
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        app = PinpointApp(self, "app")
+        PinpointApnsChannel(self, "apns",
+            application_id=app.application_id,
+            certificate=Token.as_string(Fn.file("./certificate.pem")),
+            private_key=Token.as_string(Fn.file("./private_key.key"))
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `application_id` - (Required) The application ID.
+* `enabled` - (Optional) Whether the channel is enabled or disabled. Defaults to `true`.
+* `default_authentication_method` - (Optional) The default authentication method used for APNs.
+  __NOTE__: Amazon Pinpoint uses this default for every APNs push notification that you send using the console.
+  You can override the default when you send a message programmatically using the Amazon Pinpoint API, the AWS CLI, or an AWS SDK.
+  If your default authentication type fails, Amazon Pinpoint doesn't attempt to use the other authentication type.
+
+One of the following sets of credentials is also required.
+
+If you choose to use __Certificate credentials__ you will have to provide:
+
+* `certificate` - (Required) The pem encoded TLS Certificate from Apple.
+* `private_key` - (Required) The Certificate Private Key file (ie. `.key` file).
+
+If you choose to use __Key credentials__ you will have to provide:
+
+* `bundle_id` - (Required) The ID assigned to your iOS app. To find this value, choose Certificates, IDs & Profiles, choose App IDs in the Identifiers section, and choose your app.
+* `team_id` - (Required) The ID assigned to your Apple developer account team. This value is provided on the Membership page.
+* `token_key` - (Required) The `.p8` file that you download from your Apple developer account when you create an authentication key.
+* `token_key_id` - (Required) The ID assigned to your signing key. To find this value, choose Certificates, IDs & Profiles, and choose your key in the Keys section.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Pinpoint APNs Channel using the `application-id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Pinpoint APNs Channel using the `application-id`. For example:
+
+```console
+% terraform import aws_pinpoint_apns_channel.apns application-id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-7eba307ddd3d08953ef6f0e4866c8fec850eff4727157433a3de2bca6b525fba -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/pinpoint_apns_sandbox_channel.html.markdown b/website/docs/cdktf/python/r/pinpoint_apns_sandbox_channel.html.markdown
new file mode 100644
index 00000000000..54edd0b12ce
--- /dev/null
+++ b/website/docs/cdktf/python/r/pinpoint_apns_sandbox_channel.html.markdown
@@ -0,0 +1,89 @@
+---
+subcategory: "Pinpoint"
+layout: "aws"
+page_title: "AWS: aws_pinpoint_apns_sandbox_channel"
+description: |-
+  Provides a Pinpoint APNs Sandbox Channel resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_pinpoint_apns_sandbox_channel
+
+Provides a Pinpoint APNs Sandbox Channel resource.
+
+~> **Note:** All arguments, including certificates and tokens, will be stored in the raw state as plain-text.
+[Read more about sensitive data in state](https://www.terraform.io/docs/state/sensitive-data.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.pinpoint_apns_sandbox_channel import PinpointApnsSandboxChannel
+from imports.aws.pinpoint_app import PinpointApp
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        app = PinpointApp(self, "app")
+        PinpointApnsSandboxChannel(self, "apns_sandbox",
+            application_id=app.application_id,
+            certificate=Token.as_string(Fn.file("./certificate.pem")),
+            private_key=Token.as_string(Fn.file("./private_key.key"))
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `application_id` - (Required) The application ID.
+* `enabled` - (Optional) Whether the channel is enabled or disabled. Defaults to `true`.
+* `default_authentication_method` - (Optional) The default authentication method used for APNs Sandbox.
+  __NOTE__: Amazon Pinpoint uses this default for every APNs push notification that you send using the console.
+  You can override the default when you send a message programmatically using the Amazon Pinpoint API, the AWS CLI, or an AWS SDK.
+  If your default authentication type fails, Amazon Pinpoint doesn't attempt to use the other authentication type.
+
+One of the following sets of credentials is also required.
+
+If you choose to use __Certificate credentials__ you will have to provide:
+
+* `certificate` - (Required) The pem encoded TLS Certificate from Apple.
+* `private_key` - (Required) The Certificate Private Key file (ie. `.key` file).
+
+If you choose to use __Key credentials__ you will have to provide:
+
+* `bundle_id` - (Required) The ID assigned to your iOS app. To find this value, choose Certificates, IDs & Profiles, choose App IDs in the Identifiers section, and choose your app.
+* `team_id` - (Required) The ID assigned to your Apple developer account team. This value is provided on the Membership page.
+* `token_key` - (Required) The `.p8` file that you download from your Apple developer account when you create an authentication key.
+* `token_key_id` - (Required) The ID assigned to your signing key. To find this value, choose Certificates, IDs & Profiles, and choose your key in the Keys section.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Pinpoint APNs Sandbox Channel using the `application-id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Pinpoint APNs Sandbox Channel using the `application-id`. For example:
+
+```console
+% terraform import aws_pinpoint_apns_sandbox_channel.apns_sandbox application-id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-9b39128a0fb5f80f620d484ded1a0f9f54b7b1afaaffa50e404146a69d92c38f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/pinpoint_apns_sandbox_channel.markdown b/website/docs/cdktf/python/r/pinpoint_apns_sandbox_channel.markdown
new file mode 100644
index 00000000000..54edd0b12ce
--- /dev/null
+++ b/website/docs/cdktf/python/r/pinpoint_apns_sandbox_channel.markdown
@@ -0,0 +1,89 @@
+---
+subcategory: "Pinpoint"
+layout: "aws"
+page_title: "AWS: aws_pinpoint_apns_sandbox_channel"
+description: |-
+  Provides a Pinpoint APNs Sandbox Channel resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_pinpoint_apns_sandbox_channel
+
+Provides a Pinpoint APNs Sandbox Channel resource.
+
+~> **Note:** All arguments, including certificates and tokens, will be stored in the raw state as plain-text.
+[Read more about sensitive data in state](https://www.terraform.io/docs/state/sensitive-data.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.pinpoint_apns_sandbox_channel import PinpointApnsSandboxChannel
+from imports.aws.pinpoint_app import PinpointApp
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        app = PinpointApp(self, "app")
+        PinpointApnsSandboxChannel(self, "apns_sandbox",
+            application_id=app.application_id,
+            certificate=Token.as_string(Fn.file("./certificate.pem")),
+            private_key=Token.as_string(Fn.file("./private_key.key"))
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `application_id` - (Required) The application ID.
+* `enabled` - (Optional) Whether the channel is enabled or disabled. Defaults to `true`.
+* `default_authentication_method` - (Optional) The default authentication method used for APNs Sandbox.
+  __NOTE__: Amazon Pinpoint uses this default for every APNs push notification that you send using the console.
+  You can override the default when you send a message programmatically using the Amazon Pinpoint API, the AWS CLI, or an AWS SDK.
+  If your default authentication type fails, Amazon Pinpoint doesn't attempt to use the other authentication type.
+
+One of the following sets of credentials is also required.
+
+If you choose to use __Certificate credentials__ you will have to provide:
+
+* `certificate` - (Required) The pem encoded TLS Certificate from Apple.
+* `private_key` - (Required) The Certificate Private Key file (ie. `.key` file).
+
+If you choose to use __Key credentials__ you will have to provide:
+
+* `bundle_id` - (Required) The ID assigned to your iOS app. To find this value, choose Certificates, IDs & Profiles, choose App IDs in the Identifiers section, and choose your app.
+* `team_id` - (Required) The ID assigned to your Apple developer account team. This value is provided on the Membership page.
+* `token_key` - (Required) The `.p8` file that you download from your Apple developer account when you create an authentication key.
+* `token_key_id` - (Required) The ID assigned to your signing key. To find this value, choose Certificates, IDs & Profiles, and choose your key in the Keys section.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Pinpoint APNs Sandbox Channel using the `application-id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Pinpoint APNs Sandbox Channel using the `application-id`. For example:
+
+```console
+% terraform import aws_pinpoint_apns_sandbox_channel.apns_sandbox application-id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-9b39128a0fb5f80f620d484ded1a0f9f54b7b1afaaffa50e404146a69d92c38f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/pinpoint_apns_voip_channel.html.markdown b/website/docs/cdktf/python/r/pinpoint_apns_voip_channel.html.markdown
new file mode 100644
index 00000000000..fa9bb46b192
--- /dev/null
+++ b/website/docs/cdktf/python/r/pinpoint_apns_voip_channel.html.markdown
@@ -0,0 +1,89 @@
+---
+subcategory: "Pinpoint"
+layout: "aws"
+page_title: "AWS: aws_pinpoint_apns_voip_channel"
+description: |-
+  Provides a Pinpoint APNs VoIP Channel resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_pinpoint_apns_voip_channel
+
+Provides a Pinpoint APNs VoIP Channel resource.
+
+~> **Note:** All arguments, including certificates and tokens, will be stored in the raw state as plain-text.
+[Read more about sensitive data in state](https://www.terraform.io/docs/state/sensitive-data.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.pinpoint_apns_voip_channel import PinpointApnsVoipChannel
+from imports.aws.pinpoint_app import PinpointApp
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        app = PinpointApp(self, "app")
+        PinpointApnsVoipChannel(self, "apns_voip",
+            application_id=app.application_id,
+            certificate=Token.as_string(Fn.file("./certificate.pem")),
+            private_key=Token.as_string(Fn.file("./private_key.key"))
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `application_id` - (Required) The application ID.
+* `enabled` - (Optional) Whether the channel is enabled or disabled. Defaults to `true`.
+* `default_authentication_method` - (Optional) The default authentication method used for APNs.
+  __NOTE__: Amazon Pinpoint uses this default for every APNs push notification that you send using the console.
+  You can override the default when you send a message programmatically using the Amazon Pinpoint API, the AWS CLI, or an AWS SDK.
+  If your default authentication type fails, Amazon Pinpoint doesn't attempt to use the other authentication type.
+
+One of the following sets of credentials is also required.
+
+If you choose to use __Certificate credentials__ you will have to provide:
+
+* `certificate` - (Required) The pem encoded TLS Certificate from Apple.
+* `private_key` - (Required) The Certificate Private Key file (ie. `.key` file).
+
+If you choose to use __Key credentials__ you will have to provide:
+
+* `bundle_id` - (Required) The ID assigned to your iOS app. To find this value, choose Certificates, IDs & Profiles, choose App IDs in the Identifiers section, and choose your app.
+* `team_id` - (Required) The ID assigned to your Apple developer account team. This value is provided on the Membership page.
+* `token_key` - (Required) The `.p8` file that you download from your Apple developer account when you create an authentication key.
+* `token_key_id` - (Required) The ID assigned to your signing key. To find this value, choose Certificates, IDs & Profiles, and choose your key in the Keys section.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Pinpoint APNs VoIP Channel using the `application-id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Pinpoint APNs VoIP Channel using the `application-id`. For example:
+
+```console
+% terraform import aws_pinpoint_apns_voip_channel.apns_voip application-id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-0ffc83fe4540fc67436e7989e5cf3564705d88e89adc4f3fda68412be44cfc00 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/pinpoint_apns_voip_channel.markdown b/website/docs/cdktf/python/r/pinpoint_apns_voip_channel.markdown
new file mode 100644
index 00000000000..fa9bb46b192
--- /dev/null
+++ b/website/docs/cdktf/python/r/pinpoint_apns_voip_channel.markdown
@@ -0,0 +1,89 @@
+---
+subcategory: "Pinpoint"
+layout: "aws"
+page_title: "AWS: aws_pinpoint_apns_voip_channel"
+description: |-
+  Provides a Pinpoint APNs VoIP Channel resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_pinpoint_apns_voip_channel
+
+Provides a Pinpoint APNs VoIP Channel resource.
+
+~> **Note:** All arguments, including certificates and tokens, will be stored in the raw state as plain-text.
+[Read more about sensitive data in state](https://www.terraform.io/docs/state/sensitive-data.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.pinpoint_apns_voip_channel import PinpointApnsVoipChannel
+from imports.aws.pinpoint_app import PinpointApp
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        app = PinpointApp(self, "app")
+        PinpointApnsVoipChannel(self, "apns_voip",
+            application_id=app.application_id,
+            certificate=Token.as_string(Fn.file("./certificate.pem")),
+            private_key=Token.as_string(Fn.file("./private_key.key"))
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `application_id` - (Required) The application ID.
+* `enabled` - (Optional) Whether the channel is enabled or disabled. Defaults to `true`.
+* `default_authentication_method` - (Optional) The default authentication method used for APNs.
+  __NOTE__: Amazon Pinpoint uses this default for every APNs push notification that you send using the console.
+  You can override the default when you send a message programmatically using the Amazon Pinpoint API, the AWS CLI, or an AWS SDK.
+  If your default authentication type fails, Amazon Pinpoint doesn't attempt to use the other authentication type.
+
+One of the following sets of credentials is also required.
+
+If you choose to use __Certificate credentials__ you will have to provide:
+
+* `certificate` - (Required) The pem encoded TLS Certificate from Apple.
+* `private_key` - (Required) The Certificate Private Key file (ie. `.key` file).
+
+If you choose to use __Key credentials__ you will have to provide:
+
+* `bundle_id` - (Required) The ID assigned to your iOS app. To find this value, choose Certificates, IDs & Profiles, choose App IDs in the Identifiers section, and choose your app.
+* `team_id` - (Required) The ID assigned to your Apple developer account team. This value is provided on the Membership page.
+* `token_key` - (Required) The `.p8` file that you download from your Apple developer account when you create an authentication key.
+* `token_key_id` - (Required) The ID assigned to your signing key. To find this value, choose Certificates, IDs & Profiles, and choose your key in the Keys section.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Pinpoint APNs VoIP Channel using the `application-id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Pinpoint APNs VoIP Channel using the `application-id`. For example:
+
+```console
+% terraform import aws_pinpoint_apns_voip_channel.apns_voip application-id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-0ffc83fe4540fc67436e7989e5cf3564705d88e89adc4f3fda68412be44cfc00 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/pinpoint_apns_voip_sandbox_channel.html.markdown b/website/docs/cdktf/python/r/pinpoint_apns_voip_sandbox_channel.html.markdown
new file mode 100644
index 00000000000..dba0241e81f
--- /dev/null
+++ b/website/docs/cdktf/python/r/pinpoint_apns_voip_sandbox_channel.html.markdown
@@ -0,0 +1,89 @@
+---
+subcategory: "Pinpoint"
+layout: "aws"
+page_title: "AWS: aws_pinpoint_apns_voip_sandbox_channel"
+description: |-
+  Provides a Pinpoint APNs VoIP Sandbox Channel resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_pinpoint_apns_voip_sandbox_channel
+
+Provides a Pinpoint APNs VoIP Sandbox Channel resource.
+
+~> **Note:** All arguments, including certificates and tokens, will be stored in the raw state as plain-text.
+[Read more about sensitive data in state](https://www.terraform.io/docs/state/sensitive-data.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.pinpoint_apns_voip_sandbox_channel import PinpointApnsVoipSandboxChannel
+from imports.aws.pinpoint_app import PinpointApp
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        app = PinpointApp(self, "app")
+        PinpointApnsVoipSandboxChannel(self, "apns_voip_sandbox",
+            application_id=app.application_id,
+            certificate=Token.as_string(Fn.file("./certificate.pem")),
+            private_key=Token.as_string(Fn.file("./private_key.key"))
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `application_id` - (Required) The application ID.
+* `enabled` - (Optional) Whether the channel is enabled or disabled. Defaults to `true`.
+* `default_authentication_method` - (Optional) The default authentication method used for APNs.
+  __NOTE__: Amazon Pinpoint uses this default for every APNs push notification that you send using the console.
+  You can override the default when you send a message programmatically using the Amazon Pinpoint API, the AWS CLI, or an AWS SDK.
+  If your default authentication type fails, Amazon Pinpoint doesn't attempt to use the other authentication type.
+
+One of the following sets of credentials is also required.
+
+If you choose to use __Certificate credentials__ you will have to provide:
+
+* `certificate` - (Required) The pem encoded TLS Certificate from Apple.
+* `private_key` - (Required) The Certificate Private Key file (ie. `.key` file).
+
+If you choose to use __Key credentials__ you will have to provide:
+
+* `bundle_id` - (Required) The ID assigned to your iOS app. To find this value, choose Certificates, IDs & Profiles, choose App IDs in the Identifiers section, and choose your app.
+* `team_id` - (Required) The ID assigned to your Apple developer account team. This value is provided on the Membership page.
+* `token_key` - (Required) The `.p8` file that you download from your Apple developer account when you create an authentication key.
+* `token_key_id` - (Required) The ID assigned to your signing key. To find this value, choose Certificates, IDs & Profiles, and choose your key in the Keys section.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Pinpoint APNs VoIP Sandbox Channel using the `application-id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Pinpoint APNs VoIP Sandbox Channel using the `application-id`. For example:
+
+```console
+% terraform import aws_pinpoint_apns_voip_sandbox_channel.apns_voip_sandbox application-id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-10a8793c57ea80faa1bcc8e11505f01ac9d61ce493402a8a9a145cb769e2c84c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/pinpoint_apns_voip_sandbox_channel.markdown b/website/docs/cdktf/python/r/pinpoint_apns_voip_sandbox_channel.markdown
new file mode 100644
index 00000000000..dba0241e81f
--- /dev/null
+++ b/website/docs/cdktf/python/r/pinpoint_apns_voip_sandbox_channel.markdown
@@ -0,0 +1,89 @@
+---
+subcategory: "Pinpoint"
+layout: "aws"
+page_title: "AWS: aws_pinpoint_apns_voip_sandbox_channel"
+description: |-
+  Provides a Pinpoint APNs VoIP Sandbox Channel resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_pinpoint_apns_voip_sandbox_channel
+
+Provides a Pinpoint APNs VoIP Sandbox Channel resource.
+
+~> **Note:** All arguments, including certificates and tokens, will be stored in the raw state as plain-text.
+[Read more about sensitive data in state](https://www.terraform.io/docs/state/sensitive-data.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.pinpoint_apns_voip_sandbox_channel import PinpointApnsVoipSandboxChannel
+from imports.aws.pinpoint_app import PinpointApp
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        app = PinpointApp(self, "app")
+        PinpointApnsVoipSandboxChannel(self, "apns_voip_sandbox",
+            application_id=app.application_id,
+            certificate=Token.as_string(Fn.file("./certificate.pem")),
+            private_key=Token.as_string(Fn.file("./private_key.key"))
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `application_id` - (Required) The application ID.
+* `enabled` - (Optional) Whether the channel is enabled or disabled. Defaults to `true`.
+* `default_authentication_method` - (Optional) The default authentication method used for APNs.
+  __NOTE__: Amazon Pinpoint uses this default for every APNs push notification that you send using the console.
+  You can override the default when you send a message programmatically using the Amazon Pinpoint API, the AWS CLI, or an AWS SDK.
+  If your default authentication type fails, Amazon Pinpoint doesn't attempt to use the other authentication type.
+
+One of the following sets of credentials is also required.
+
+If you choose to use __Certificate credentials__ you will have to provide:
+
+* `certificate` - (Required) The pem encoded TLS Certificate from Apple.
+* `private_key` - (Required) The Certificate Private Key file (ie. `.key` file).
+
+If you choose to use __Key credentials__ you will have to provide:
+
+* `bundle_id` - (Required) The ID assigned to your iOS app. To find this value, choose Certificates, IDs & Profiles, choose App IDs in the Identifiers section, and choose your app.
+* `team_id` - (Required) The ID assigned to your Apple developer account team. This value is provided on the Membership page.
+* `token_key` - (Required) The `.p8` file that you download from your Apple developer account when you create an authentication key.
+* `token_key_id` - (Required) The ID assigned to your signing key. To find this value, choose Certificates, IDs & Profiles, and choose your key in the Keys section.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Pinpoint APNs VoIP Sandbox Channel using the `application-id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Pinpoint APNs VoIP Sandbox Channel using the `application-id`. For example:
+
+```console
+% terraform import aws_pinpoint_apns_voip_sandbox_channel.apns_voip_sandbox application-id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-10a8793c57ea80faa1bcc8e11505f01ac9d61ce493402a8a9a145cb769e2c84c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/pinpoint_app.html.markdown b/website/docs/cdktf/python/r/pinpoint_app.html.markdown
new file mode 100644
index 00000000000..09f1df779e2
--- /dev/null
+++ b/website/docs/cdktf/python/r/pinpoint_app.html.markdown
@@ -0,0 +1,97 @@
+---
+subcategory: "Pinpoint"
+layout: "aws"
+page_title: "AWS: aws_pinpoint_app"
+description: |-
+  Provides a Pinpoint App resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_pinpoint_app
+
+Provides a Pinpoint App resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.pinpoint_app import PinpointApp
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        PinpointApp(self, "example",
+            limits=PinpointAppLimits(
+                maximum_duration=600
+            ),
+            name="test-app",
+            quiet_time=PinpointAppQuietTime(
+                end="06:00",
+                start="00:00"
+            )
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Optional) The application name. By default generated by Terraform
+* `name_prefix` - (Optional) The name of the Pinpoint application. Conflicts with `name`
+* `campaign_hook` - (Optional) Specifies settings for invoking an AWS Lambda function that customizes a segment for a campaign
+* `limits` - (Optional) The default campaign limits for the app. These limits apply to each campaign for the app, unless the campaign overrides the default with limits of its own
+* `quiet_time` - (Optional) The default quiet time for the app. Each campaign for this app sends no messages during this time unless the campaign overrides the default with a quiet time of its own
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+`campaign_hook` supports the following:
+
+* `lambda_function_name` - (Optional) Lambda function name or ARN to be called for delivery. Conflicts with `web_url`
+* `mode` - (Required if `lambda_function_name` or `web_url` are provided) What mode Lambda should be invoked in. Valid values for this parameter are `DELIVERY`, `FILTER`.  
+* `web_url` - (Optional) Web URL to call for hook. If the URL has authentication specified it will be added as authentication to the request. Conflicts with `lambda_function_name`
+
+`limits` supports the following:
+
+* `daily` - (Optional) The maximum number of messages that the campaign can send daily.
+* `maximum_duration` - (Optional) The length of time (in seconds) that the campaign can run before it ends and message deliveries stop. This duration begins at the scheduled start time for the campaign. The minimum value is 60.
+* `messages_per_second` - (Optional) The number of messages that the campaign can send per second. The minimum value is 50, and the maximum is 20000.
+* `total` - (Optional) The maximum total number of messages that the campaign can send.
+
+`quiet_time` supports the following:
+
+* `end` - (Optional) The default end time for quiet time in ISO 8601 format. Required if `start` is set
+* `start` - (Optional) The default start time for quiet time in ISO 8601 format. Required if `end` is set
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `application_id` - The Application ID of the Pinpoint App.
+* `arn` - Amazon Resource Name (ARN) of the PinPoint Application
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Pinpoint App using the `application-id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Pinpoint App using the `application-id`. For example:
+
+```console
+% terraform import aws_pinpoint_app.name application-id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-69252b714649cc19bbfedeb89aa6fa806e2f32d0df2739664cb86bc692aacfc6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/pinpoint_app.markdown b/website/docs/cdktf/python/r/pinpoint_app.markdown
new file mode 100644
index 00000000000..09f1df779e2
--- /dev/null
+++ b/website/docs/cdktf/python/r/pinpoint_app.markdown
@@ -0,0 +1,97 @@
+---
+subcategory: "Pinpoint"
+layout: "aws"
+page_title: "AWS: aws_pinpoint_app"
+description: |-
+  Provides a Pinpoint App resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_pinpoint_app
+
+Provides a Pinpoint App resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.pinpoint_app import PinpointApp
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        PinpointApp(self, "example",
+            limits=PinpointAppLimits(
+                maximum_duration=600
+            ),
+            name="test-app",
+            quiet_time=PinpointAppQuietTime(
+                end="06:00",
+                start="00:00"
+            )
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Optional) The application name. By default generated by Terraform
+* `name_prefix` - (Optional) The name of the Pinpoint application. Conflicts with `name`
+* `campaign_hook` - (Optional) Specifies settings for invoking an AWS Lambda function that customizes a segment for a campaign
+* `limits` - (Optional) The default campaign limits for the app. These limits apply to each campaign for the app, unless the campaign overrides the default with limits of its own
+* `quiet_time` - (Optional) The default quiet time for the app. Each campaign for this app sends no messages during this time unless the campaign overrides the default with a quiet time of its own
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+`campaign_hook` supports the following:
+
+* `lambda_function_name` - (Optional) Lambda function name or ARN to be called for delivery. Conflicts with `web_url`
+* `mode` - (Required if `lambda_function_name` or `web_url` are provided) What mode Lambda should be invoked in. Valid values for this parameter are `DELIVERY`, `FILTER`.  
+* `web_url` - (Optional) Web URL to call for hook. If the URL has authentication specified it will be added as authentication to the request. Conflicts with `lambda_function_name`
+
+`limits` supports the following:
+
+* `daily` - (Optional) The maximum number of messages that the campaign can send daily.
+* `maximum_duration` - (Optional) The length of time (in seconds) that the campaign can run before it ends and message deliveries stop. This duration begins at the scheduled start time for the campaign. The minimum value is 60.
+* `messages_per_second` - (Optional) The number of messages that the campaign can send per second. The minimum value is 50, and the maximum is 20000.
+* `total` - (Optional) The maximum total number of messages that the campaign can send.
+
+`quiet_time` supports the following:
+
+* `end` - (Optional) The default end time for quiet time in ISO 8601 format. Required if `start` is set
+* `start` - (Optional) The default start time for quiet time in ISO 8601 format. Required if `end` is set
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `application_id` - The Application ID of the Pinpoint App.
+* `arn` - Amazon Resource Name (ARN) of the PinPoint Application
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Pinpoint App using the `application-id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Pinpoint App using the `application-id`. For example:
+
+```console
+% terraform import aws_pinpoint_app.name application-id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-69252b714649cc19bbfedeb89aa6fa806e2f32d0df2739664cb86bc692aacfc6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/pinpoint_baidu_channel.html.markdown b/website/docs/cdktf/python/r/pinpoint_baidu_channel.html.markdown
new file mode 100644
index 00000000000..44cd79be54f
--- /dev/null
+++ b/website/docs/cdktf/python/r/pinpoint_baidu_channel.html.markdown
@@ -0,0 +1,73 @@
+---
+subcategory: "Pinpoint"
+layout: "aws"
+page_title: "AWS: aws_pinpoint_baidu_channel"
+description: |-
+  Provides a Pinpoint Baidu Channel resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_pinpoint_baidu_channel
+
+Provides a Pinpoint Baidu Channel resource.
+
+~> **Note:** All arguments including the Api Key and Secret Key will be stored in the raw state as plain-text.
+[Read more about sensitive data in state](https://www.terraform.io/docs/state/sensitive-data.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.pinpoint_app import PinpointApp
+from imports.aws.pinpoint_baidu_channel import PinpointBaiduChannel
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        app = PinpointApp(self, "app")
+        PinpointBaiduChannel(self, "channel",
+            api_key="",
+            application_id=app.application_id,
+            secret_key=""
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `application_id` - (Required) The application ID.
+* `enabled` - (Optional) Specifies whether to enable the channel. Defaults to `true`.
+* `api_key` - (Required) Platform credential API key from Baidu.
+* `secret_key` - (Required) Platform credential Secret key from Baidu.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Pinpoint Baidu Channel using the `application-id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Pinpoint Baidu Channel using the `application-id`. For example:
+
+```console
+% terraform import aws_pinpoint_baidu_channel.channel application-id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-0f0737a2ecf3441f3760954b544512dca7098ae0198bf9673837a1b43aafd321 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/pinpoint_baidu_channel.markdown b/website/docs/cdktf/python/r/pinpoint_baidu_channel.markdown
new file mode 100644
index 00000000000..44cd79be54f
--- /dev/null
+++ b/website/docs/cdktf/python/r/pinpoint_baidu_channel.markdown
@@ -0,0 +1,73 @@
+---
+subcategory: "Pinpoint"
+layout: "aws"
+page_title: "AWS: aws_pinpoint_baidu_channel"
+description: |-
+  Provides a Pinpoint Baidu Channel resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_pinpoint_baidu_channel
+
+Provides a Pinpoint Baidu Channel resource.
+
+~> **Note:** All arguments including the Api Key and Secret Key will be stored in the raw state as plain-text.
+[Read more about sensitive data in state](https://www.terraform.io/docs/state/sensitive-data.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.pinpoint_app import PinpointApp
+from imports.aws.pinpoint_baidu_channel import PinpointBaiduChannel
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        app = PinpointApp(self, "app")
+        PinpointBaiduChannel(self, "channel",
+            api_key="",
+            application_id=app.application_id,
+            secret_key=""
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `application_id` - (Required) The application ID.
+* `enabled` - (Optional) Specifies whether to enable the channel. Defaults to `true`.
+* `api_key` - (Required) Platform credential API key from Baidu.
+* `secret_key` - (Required) Platform credential Secret key from Baidu.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Pinpoint Baidu Channel using the `application-id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Pinpoint Baidu Channel using the `application-id`. For example:
+
+```console
+% terraform import aws_pinpoint_baidu_channel.channel application-id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-0f0737a2ecf3441f3760954b544512dca7098ae0198bf9673837a1b43aafd321 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/pinpoint_email_channel.html.markdown b/website/docs/cdktf/python/r/pinpoint_email_channel.html.markdown
new file mode 100644
index 00000000000..ec3b369722b
--- /dev/null
+++ b/website/docs/cdktf/python/r/pinpoint_email_channel.html.markdown
@@ -0,0 +1,112 @@
+---
+subcategory: "Pinpoint"
+layout: "aws"
+page_title: "AWS: aws_pinpoint_email_channel"
+description: |-
+  Provides a Pinpoint Email Channel resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_pinpoint_email_channel
+
+Provides a Pinpoint Email Channel resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.iam_role import IamRole
+from imports.aws.iam_role_policy import IamRolePolicy
+from imports.aws.pinpoint_app import PinpointApp
+from imports.aws.pinpoint_email_channel import PinpointEmailChannel
+from imports.aws.ses_domain_identity import SesDomainIdentity
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, identity):
+        super().__init__(scope, name)
+        app = PinpointApp(self, "app")
+        SesDomainIdentity(self, "identity",
+            domain="example.com"
+        )
+        assume_role = DataAwsIamPolicyDocument(self, "assume_role",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["sts:AssumeRole"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["pinpoint.amazonaws.com"],
+                    type="Service"
+                )
+                ]
+            )
+            ]
+        )
+        role_policy = DataAwsIamPolicyDocument(self, "role_policy",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["mobileanalytics:PutEvents", "mobileanalytics:PutItems"],
+                effect="Allow",
+                resources=["*"]
+            )
+            ]
+        )
+        role = IamRole(self, "role",
+            assume_role_policy=Token.as_string(assume_role.json)
+        )
+        aws_iam_role_policy_role_policy = IamRolePolicy(self, "role_policy_5",
+            name="role_policy",
+            policy=Token.as_string(role_policy.json),
+            role=role.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_role_policy_role_policy.override_logical_id("role_policy")
+        PinpointEmailChannel(self, "email",
+            application_id=app.application_id,
+            from_address="user@example.com",
+            role_arn=role.arn,
+            identity=identity
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `application_id` - (Required) The application ID.
+* `enabled` - (Optional) Whether the channel is enabled or disabled. Defaults to `true`.
+* `configuration_set` - (Optional) The ARN of the Amazon SES configuration set that you want to apply to messages that you send through the channel.
+* `from_address` - (Required) The email address used to send emails from. You can use email only (`user@example.com`) or friendly address (`User <user@example.com>`). This field comply with [RFC 5322](https://www.ietf.org/rfc/rfc5322.txt).
+* `identity` - (Required) The ARN of an identity verified with SES.
+* `role_arn` - (Optional) The ARN of an IAM Role used to submit events to Mobile Analytics' event ingestion service.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `messages_per_second` - Messages per second that can be sent.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Pinpoint Email Channel using the `application-id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Pinpoint Email Channel using the `application-id`. For example:
+
+```console
+% terraform import aws_pinpoint_email_channel.email application-id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-669b9a713da9a2dec982762fd0942f91a639ba307f5affad6cecab1234f05e8f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/pinpoint_email_channel.markdown b/website/docs/cdktf/python/r/pinpoint_email_channel.markdown
new file mode 100644
index 00000000000..ec3b369722b
--- /dev/null
+++ b/website/docs/cdktf/python/r/pinpoint_email_channel.markdown
@@ -0,0 +1,112 @@
+---
+subcategory: "Pinpoint"
+layout: "aws"
+page_title: "AWS: aws_pinpoint_email_channel"
+description: |-
+  Provides a Pinpoint Email Channel resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_pinpoint_email_channel
+
+Provides a Pinpoint Email Channel resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.iam_role import IamRole
+from imports.aws.iam_role_policy import IamRolePolicy
+from imports.aws.pinpoint_app import PinpointApp
+from imports.aws.pinpoint_email_channel import PinpointEmailChannel
+from imports.aws.ses_domain_identity import SesDomainIdentity
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, identity):
+        super().__init__(scope, name)
+        app = PinpointApp(self, "app")
+        SesDomainIdentity(self, "identity",
+            domain="example.com"
+        )
+        assume_role = DataAwsIamPolicyDocument(self, "assume_role",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["sts:AssumeRole"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["pinpoint.amazonaws.com"],
+                    type="Service"
+                )
+                ]
+            )
+            ]
+        )
+        role_policy = DataAwsIamPolicyDocument(self, "role_policy",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["mobileanalytics:PutEvents", "mobileanalytics:PutItems"],
+                effect="Allow",
+                resources=["*"]
+            )
+            ]
+        )
+        role = IamRole(self, "role",
+            assume_role_policy=Token.as_string(assume_role.json)
+        )
+        aws_iam_role_policy_role_policy = IamRolePolicy(self, "role_policy_5",
+            name="role_policy",
+            policy=Token.as_string(role_policy.json),
+            role=role.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_role_policy_role_policy.override_logical_id("role_policy")
+        PinpointEmailChannel(self, "email",
+            application_id=app.application_id,
+            from_address="user@example.com",
+            role_arn=role.arn,
+            identity=identity
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `application_id` - (Required) The application ID.
+* `enabled` - (Optional) Whether the channel is enabled or disabled. Defaults to `true`.
+* `configuration_set` - (Optional) The ARN of the Amazon SES configuration set that you want to apply to messages that you send through the channel.
+* `from_address` - (Required) The email address used to send emails from. You can use email only (`user@example.com`) or friendly address (`User <user@example.com>`). This field comply with [RFC 5322](https://www.ietf.org/rfc/rfc5322.txt).
+* `identity` - (Required) The ARN of an identity verified with SES.
+* `role_arn` - (Optional) The ARN of an IAM Role used to submit events to Mobile Analytics' event ingestion service.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `messages_per_second` - Messages per second that can be sent.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Pinpoint Email Channel using the `application-id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Pinpoint Email Channel using the `application-id`. For example:
+
+```console
+% terraform import aws_pinpoint_email_channel.email application-id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-669b9a713da9a2dec982762fd0942f91a639ba307f5affad6cecab1234f05e8f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/pinpoint_event_stream.html.markdown b/website/docs/cdktf/python/r/pinpoint_event_stream.html.markdown
new file mode 100644
index 00000000000..77055fcf31a
--- /dev/null
+++ b/website/docs/cdktf/python/r/pinpoint_event_stream.html.markdown
@@ -0,0 +1,107 @@
+---
+subcategory: "Pinpoint"
+layout: "aws"
+page_title: "AWS: aws_pinpoint_event_stream"
+description: |-
+  Provides a Pinpoint Event Stream resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_pinpoint_event_stream
+
+Provides a Pinpoint Event Stream resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.iam_role import IamRole
+from imports.aws.iam_role_policy import IamRolePolicy
+from imports.aws.kinesis_stream import KinesisStream
+from imports.aws.pinpoint_app import PinpointApp
+from imports.aws.pinpoint_event_stream import PinpointEventStream
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        test_stream = KinesisStream(self, "test_stream",
+            name="pinpoint-kinesis-test",
+            shard_count=1
+        )
+        app = PinpointApp(self, "app")
+        assume_role = DataAwsIamPolicyDocument(self, "assume_role",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["sts:AssumeRole"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["pinpoint.us-east-1.amazonaws.com"],
+                    type="Service"
+                )
+                ]
+            )
+            ]
+        )
+        test_role_policy = DataAwsIamPolicyDocument(self, "test_role_policy",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["kinesis:PutRecords", "kinesis:DescribeStream"],
+                effect="Allow",
+                resources=["arn:aws:kinesis:us-east-1:*:*/*"]
+            )
+            ]
+        )
+        test_role = IamRole(self, "test_role",
+            assume_role_policy=Token.as_string(assume_role.json)
+        )
+        aws_iam_role_policy_test_role_policy = IamRolePolicy(self, "test_role_policy_5",
+            name="test_policy",
+            policy=Token.as_string(test_role_policy.json),
+            role=test_role.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_role_policy_test_role_policy.override_logical_id("test_role_policy")
+        PinpointEventStream(self, "stream",
+            application_id=app.application_id,
+            destination_stream_arn=test_stream.arn,
+            role_arn=test_role.arn
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `application_id` - (Required) The application ID.
+* `destination_stream_arn` - (Required) The Amazon Resource Name (ARN) of the Amazon Kinesis stream or Firehose delivery stream to which you want to publish events.
+* `role_arn` - (Required) The IAM role that authorizes Amazon Pinpoint to publish events to the stream in your account.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Pinpoint Event Stream using the `application-id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Pinpoint Event Stream using the `application-id`. For example:
+
+```console
+% terraform import aws_pinpoint_event_stream.stream application-id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-781c351d9404f1abba2f962888a231281d00739d19baa3253947f07c74cba124 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/pinpoint_event_stream.markdown b/website/docs/cdktf/python/r/pinpoint_event_stream.markdown
new file mode 100644
index 00000000000..77055fcf31a
--- /dev/null
+++ b/website/docs/cdktf/python/r/pinpoint_event_stream.markdown
@@ -0,0 +1,107 @@
+---
+subcategory: "Pinpoint"
+layout: "aws"
+page_title: "AWS: aws_pinpoint_event_stream"
+description: |-
+  Provides a Pinpoint Event Stream resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_pinpoint_event_stream
+
+Provides a Pinpoint Event Stream resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.iam_role import IamRole
+from imports.aws.iam_role_policy import IamRolePolicy
+from imports.aws.kinesis_stream import KinesisStream
+from imports.aws.pinpoint_app import PinpointApp
+from imports.aws.pinpoint_event_stream import PinpointEventStream
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        test_stream = KinesisStream(self, "test_stream",
+            name="pinpoint-kinesis-test",
+            shard_count=1
+        )
+        app = PinpointApp(self, "app")
+        assume_role = DataAwsIamPolicyDocument(self, "assume_role",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["sts:AssumeRole"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["pinpoint.us-east-1.amazonaws.com"],
+                    type="Service"
+                )
+                ]
+            )
+            ]
+        )
+        test_role_policy = DataAwsIamPolicyDocument(self, "test_role_policy",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["kinesis:PutRecords", "kinesis:DescribeStream"],
+                effect="Allow",
+                resources=["arn:aws:kinesis:us-east-1:*:*/*"]
+            )
+            ]
+        )
+        test_role = IamRole(self, "test_role",
+            assume_role_policy=Token.as_string(assume_role.json)
+        )
+        aws_iam_role_policy_test_role_policy = IamRolePolicy(self, "test_role_policy_5",
+            name="test_policy",
+            policy=Token.as_string(test_role_policy.json),
+            role=test_role.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_role_policy_test_role_policy.override_logical_id("test_role_policy")
+        PinpointEventStream(self, "stream",
+            application_id=app.application_id,
+            destination_stream_arn=test_stream.arn,
+            role_arn=test_role.arn
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `application_id` - (Required) The application ID.
+* `destination_stream_arn` - (Required) The Amazon Resource Name (ARN) of the Amazon Kinesis stream or Firehose delivery stream to which you want to publish events.
+* `role_arn` - (Required) The IAM role that authorizes Amazon Pinpoint to publish events to the stream in your account.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Pinpoint Event Stream using the `application-id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Pinpoint Event Stream using the `application-id`. For example:
+
+```console
+% terraform import aws_pinpoint_event_stream.stream application-id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-781c351d9404f1abba2f962888a231281d00739d19baa3253947f07c74cba124 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/pinpoint_gcm_channel.html.markdown b/website/docs/cdktf/python/r/pinpoint_gcm_channel.html.markdown
new file mode 100644
index 00000000000..ab1897fabfc
--- /dev/null
+++ b/website/docs/cdktf/python/r/pinpoint_gcm_channel.html.markdown
@@ -0,0 +1,71 @@
+---
+subcategory: "Pinpoint"
+layout: "aws"
+page_title: "AWS: aws_pinpoint_gcm_channel"
+description: |-
+  Provides a Pinpoint GCM Channel resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_pinpoint_gcm_channel
+
+Provides a Pinpoint GCM Channel resource.
+
+~> **Note:** Api Key argument will be stored in the raw state as plain-text.
+[Read more about sensitive data in state](https://www.terraform.io/docs/state/sensitive-data.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.pinpoint_app import PinpointApp
+from imports.aws.pinpoint_gcm_channel import PinpointGcmChannel
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        app = PinpointApp(self, "app")
+        PinpointGcmChannel(self, "gcm",
+            api_key="api_key",
+            application_id=app.application_id
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `application_id` - (Required) The application ID.
+* `api_key` - (Required) Platform credential API key from Google.
+* `enabled` - (Optional) Whether the channel is enabled or disabled. Defaults to `true`.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Pinpoint GCM Channel using the `application-id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Pinpoint GCM Channel using the `application-id`. For example:
+
+```console
+% terraform import aws_pinpoint_gcm_channel.gcm application-id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-9d29303e7e3a9234396e32f826ea21b0d3e961ff30d693722c663578c7f20fd5 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/pinpoint_gcm_channel.markdown b/website/docs/cdktf/python/r/pinpoint_gcm_channel.markdown
new file mode 100644
index 00000000000..ab1897fabfc
--- /dev/null
+++ b/website/docs/cdktf/python/r/pinpoint_gcm_channel.markdown
@@ -0,0 +1,71 @@
+---
+subcategory: "Pinpoint"
+layout: "aws"
+page_title: "AWS: aws_pinpoint_gcm_channel"
+description: |-
+  Provides a Pinpoint GCM Channel resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_pinpoint_gcm_channel
+
+Provides a Pinpoint GCM Channel resource.
+
+~> **Note:** Api Key argument will be stored in the raw state as plain-text.
+[Read more about sensitive data in state](https://www.terraform.io/docs/state/sensitive-data.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.pinpoint_app import PinpointApp
+from imports.aws.pinpoint_gcm_channel import PinpointGcmChannel
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        app = PinpointApp(self, "app")
+        PinpointGcmChannel(self, "gcm",
+            api_key="api_key",
+            application_id=app.application_id
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `application_id` - (Required) The application ID.
+* `api_key` - (Required) Platform credential API key from Google.
+* `enabled` - (Optional) Whether the channel is enabled or disabled. Defaults to `true`.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Pinpoint GCM Channel using the `application-id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Pinpoint GCM Channel using the `application-id`. For example:
+
+```console
+% terraform import aws_pinpoint_gcm_channel.gcm application-id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-9d29303e7e3a9234396e32f826ea21b0d3e961ff30d693722c663578c7f20fd5 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/pinpoint_sms_channel.html.markdown b/website/docs/cdktf/python/r/pinpoint_sms_channel.html.markdown
new file mode 100644
index 00000000000..59335cac9af
--- /dev/null
+++ b/website/docs/cdktf/python/r/pinpoint_sms_channel.html.markdown
@@ -0,0 +1,71 @@
+---
+subcategory: "Pinpoint"
+layout: "aws"
+page_title: "AWS: aws_pinpoint_sms_channel"
+description: |-
+  Use the `aws_pinpoint_sms_channel` resource to manage Pinpoint SMS Channels.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_pinpoint_sms_channel
+
+Use the `aws_pinpoint_sms_channel` resource to manage Pinpoint SMS Channels.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.pinpoint_app import PinpointApp
+from imports.aws.pinpoint_sms_channel import PinpointSmsChannel
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        app = PinpointApp(self, "app")
+        PinpointSmsChannel(self, "sms",
+            application_id=app.application_id
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `application_id` - (Required) ID of the application.
+* `enabled` - (Optional) Whether the channel is enabled or disabled. By default, it is set to `true`.
+* `sender_id` - (Optional) Identifier of the sender for your messages.
+* `short_code` - (Optional) Short Code registered with the phone provider.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `promotional_messages_per_second` - Maximum number of promotional messages that can be sent per second.
+* `transactional_messages_per_second` - Maximum number of transactional messages per second that can be sent.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import the Pinpoint SMS Channel using the `application_id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import the Pinpoint SMS Channel using the `application_id`. For example:
+
+```console
+% terraform import aws_pinpoint_sms_channel.sms application-id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ea56c3123c88d22610a676fad9316e38ebe652689672bf9c9b82ddae2c457e61 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/pinpoint_sms_channel.markdown b/website/docs/cdktf/python/r/pinpoint_sms_channel.markdown
new file mode 100644
index 00000000000..59335cac9af
--- /dev/null
+++ b/website/docs/cdktf/python/r/pinpoint_sms_channel.markdown
@@ -0,0 +1,71 @@
+---
+subcategory: "Pinpoint"
+layout: "aws"
+page_title: "AWS: aws_pinpoint_sms_channel"
+description: |-
+  Use the `aws_pinpoint_sms_channel` resource to manage Pinpoint SMS Channels.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_pinpoint_sms_channel
+
+Use the `aws_pinpoint_sms_channel` resource to manage Pinpoint SMS Channels.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.pinpoint_app import PinpointApp
+from imports.aws.pinpoint_sms_channel import PinpointSmsChannel
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        app = PinpointApp(self, "app")
+        PinpointSmsChannel(self, "sms",
+            application_id=app.application_id
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `application_id` - (Required) ID of the application.
+* `enabled` - (Optional) Whether the channel is enabled or disabled. By default, it is set to `true`.
+* `sender_id` - (Optional) Identifier of the sender for your messages.
+* `short_code` - (Optional) Short Code registered with the phone provider.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `promotional_messages_per_second` - Maximum number of promotional messages that can be sent per second.
+* `transactional_messages_per_second` - Maximum number of transactional messages per second that can be sent.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import the Pinpoint SMS Channel using the `application_id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import the Pinpoint SMS Channel using the `application_id`. For example:
+
+```console
+% terraform import aws_pinpoint_sms_channel.sms application-id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ea56c3123c88d22610a676fad9316e38ebe652689672bf9c9b82ddae2c457e61 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/pipes_pipe.html.markdown b/website/docs/cdktf/python/r/pipes_pipe.html.markdown
new file mode 100644
index 00000000000..b3819a2fe83
--- /dev/null
+++ b/website/docs/cdktf/python/r/pipes_pipe.html.markdown
@@ -0,0 +1,594 @@
+---
+subcategory: "EventBridge Pipes"
+layout: "aws"
+page_title: "AWS: aws_pipes_pipe"
+description: |-
+  Terraform resource for managing an AWS EventBridge Pipes Pipe.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_pipes_pipe
+
+Terraform resource for managing an AWS EventBridge Pipes Pipe.
+
+You can find out more about EventBridge Pipes in the [User Guide](https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-pipes.html).
+
+EventBridge Pipes are very configurable, and may require IAM permissions to work correctly. More information on the configuration options and IAM permissions can be found in the [User Guide](https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-pipes.html).
+
+~> **Note:** EventBridge was formerly known as CloudWatch Events. The functionality is identical.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_caller_identity import DataAwsCallerIdentity
+from imports.aws.iam_role import IamRole
+from imports.aws.iam_role_policy import IamRolePolicy
+from imports.aws.pipes_pipe import PipesPipe
+from imports.aws.sqs_queue import SqsQueue
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        source = SqsQueue(self, "source")
+        target = SqsQueue(self, "target")
+        main = DataAwsCallerIdentity(self, "main")
+        example = IamRole(self, "example",
+            assume_role_policy=Token.as_string(
+                Fn.jsonencode({
+                    "Statement": {
+                        "Action": "sts:AssumeRole",
+                        "Condition": {
+                            "StringEquals": {
+                                "aws:_source_account": main.account_id
+                            }
+                        },
+                        "Effect": "Allow",
+                        "Principal": {
+                            "Service": "pipes.amazonaws.com"
+                        }
+                    },
+                    "Version": "2012-10-17"
+                }))
+        )
+        aws_iam_role_policy_source = IamRolePolicy(self, "source_4",
+            policy=Token.as_string(
+                Fn.jsonencode({
+                    "Statement": [{
+                        "Action": ["sqs:DeleteMessage", "sqs:GetQueueAttributes", "sqs:ReceiveMessage"
+                        ],
+                        "Effect": "Allow",
+                        "Resource": [source.arn]
+                    }
+                    ],
+                    "Version": "2012-10-17"
+                })),
+            role=example.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_role_policy_source.override_logical_id("source")
+        aws_iam_role_policy_target = IamRolePolicy(self, "target_5",
+            policy=Token.as_string(
+                Fn.jsonencode({
+                    "Statement": [{
+                        "Action": ["sqs:SendMessage"],
+                        "Effect": "Allow",
+                        "Resource": [target.arn]
+                    }
+                    ],
+                    "Version": "2012-10-17"
+                })),
+            role=example.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_role_policy_target.override_logical_id("target")
+        aws_pipes_pipe_example = PipesPipe(self, "example_6",
+            depends_on=[aws_iam_role_policy_source, aws_iam_role_policy_target],
+            name="example-pipe",
+            role_arn=example.arn,
+            source=source.arn,
+            target=target.arn
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_pipes_pipe_example.override_logical_id("example")
+```
+
+### Enrichment Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.pipes_pipe import PipesPipe
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        PipesPipe(self, "example",
+            enrichment=Token.as_string(aws_cloudwatch_event_api_destination_example.arn),
+            enrichment_parameters=PipesPipeEnrichmentParameters(
+                http_parameters=PipesPipeEnrichmentParametersHttpParameters(
+                    header_parameters={
+                        "example-header": "example-value",
+                        "second-example-header": "second-example-value"
+                    },
+                    path_parameter_values=["example-path-param"],
+                    query_string_parameters={
+                        "example-query-string": "example-value",
+                        "second-example-query-string": "second-example-value"
+                    }
+                )
+            ),
+            name="example-pipe",
+            role_arn=Token.as_string(aws_iam_role_example.arn),
+            source=source.arn,
+            target=target.arn
+        )
+```
+
+### Filter Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, Fn, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.pipes_pipe import PipesPipe
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        PipesPipe(self, "example",
+            name="example-pipe",
+            role_arn=Token.as_string(aws_iam_role_example.arn),
+            source=source.arn,
+            source_parameters=PipesPipeSourceParameters(
+                filter_criteria=PipesPipeSourceParametersFilterCriteria(
+                    filter=[PipesPipeSourceParametersFilterCriteriaFilter(
+                        pattern=Token.as_string(
+                            Fn.jsonencode({
+                                "source": ["event-source"]
+                            }))
+                    )
+                    ]
+                )
+            ),
+            target=target.arn
+        )
+```
+
+### SQS Source and Target Configuration Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.pipes_pipe import PipesPipe
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        PipesPipe(self, "example",
+            name="example-pipe",
+            role_arn=Token.as_string(aws_iam_role_example.arn),
+            source=source.arn,
+            source_parameters=PipesPipeSourceParameters(
+                sqs_queue_parameters=PipesPipeSourceParametersSqsQueueParameters(
+                    batch_size=1,
+                    maximum_batching_window_in_seconds=2
+                )
+            ),
+            target=target.arn,
+            target_parameters=PipesPipeTargetParameters(
+                sqs_queue=[{
+                    "message_deduplication_id": "example-dedupe",
+                    "message_group_id": "example-group"
+                }
+                ]
+            )
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `role_arn` - (Required) ARN of the role that allows the pipe to send data to the target.
+* `source` - (Required) Source resource of the pipe (typically an ARN).
+* `target` - (Required) Target resource of the pipe (typically an ARN).
+
+The following arguments are optional:
+
+* `description` - (Optional) A description of the pipe. At most 512 characters.
+* `desired_state` - (Optional) The state the pipe should be in. One of: `RUNNING`, `STOPPED`.
+* `enrichment` - (Optional) Enrichment resource of the pipe (typically an ARN). Read more about enrichment in the [User Guide](https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-pipes.html#pipes-enrichment).
+* `enrichment_parameters` - (Optional) Parameters to configure enrichment for your pipe. Detailed below.
+* `name` - (Optional) Name of the pipe. If omitted, Terraform will assign a random, unique name. Conflicts with `name_prefix`.
+* `name_prefix` - (Optional) Creates a unique name beginning with the specified prefix. Conflicts with `name`.
+* `source_parameters` - (Optional) Parameters to configure a source for the pipe. Detailed below.
+* `target_parameters` - (Optional) Parameters to configure a target for your pipe. Detailed below.
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### enrichment_parameters Configuration Block
+
+You can find out more about EventBridge Pipes Enrichment in the [User Guide](https://docs.aws.amazon.com/eventbridge/latest/userguide/pipes-enrichment.html).
+
+* `input_template` - (Optional) Valid JSON text passed to the target. In this case, nothing from the event itself is passed to the target. Maximum length of 8192 characters.
+* `http_parameters` - (Optional) Contains the HTTP parameters to use when the target is a API Gateway REST endpoint or EventBridge ApiDestination. If you specify an API Gateway REST API or EventBridge ApiDestination as a target, you can use this parameter to specify headers, path parameters, and query string keys/values as part of your target invoking request. If you're using ApiDestinations, the corresponding Connection can also have these values configured. In case of any conflicting keys, values from the Connection take precedence. Detailed below.
+
+#### enrichment_parameters.http_parameters Configuration Block
+
+* `header_parameters` - (Optional) Key-value mapping of the headers that need to be sent as part of request invoking the API Gateway REST API or EventBridge ApiDestination.
+* `path_parameter_values` - (Optional) The path parameter values to be used to populate API Gateway REST API or EventBridge ApiDestination path wildcards ("*").
+* `query_string_parameters` - (Optional) Key-value mapping of the query strings that need to be sent as part of request invoking the API Gateway REST API or EventBridge ApiDestination.
+
+### source_parameters Configuration Block
+
+You can find out more about EventBridge Pipes Sources in the [User Guide](https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-pipes-event-source.html).
+
+* `activemq_broker_parameters` - (Optional) The parameters for using an Active MQ broker as a source. Detailed below.
+* `dynamodb_stream_parameters` - (Optional) The parameters for using a DynamoDB stream as a source.  Detailed below.
+* `filter_criteria` - (Optional) The collection of event patterns used to [filter events](https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-pipes-event-filtering.html). Detailed below.
+* `kinesis_stream_parameters` - (Optional) The parameters for using a Kinesis stream as a source. Detailed below.
+* `managed_streaming_kafka_parameters` - (Optional) The parameters for using an MSK stream as a source. Detailed below.
+* `rabbitmq_broker_parameters` - (Optional) The parameters for using a Rabbit MQ broker as a source. Detailed below.
+* `self_managed_kafka_parameters` - (Optional) The parameters for using a self-managed Apache Kafka stream as a source. Detailed below.
+* `sqs_queue_parameters` - (Optional) The parameters for using a Amazon SQS stream as a source. Detailed below.
+
+#### source_parameters.filter_criteria Configuration Block
+
+* `filter` - (Optional) An array of up to 5 event patterns. Detailed below.
+
+##### source_parameters.filter_criteria.filter Configuration Block
+
+* `pattern` - (Required) The event pattern. At most 4096 characters.
+
+#### source_parameters.activemq_broker_parameters Configuration Block
+
+* `batch_size` - (Optional) The maximum number of records to include in each batch. Maximum value of 10000.
+* `credentials` - (Required) The credentials needed to access the resource. Detailed below.
+* `maximum_batching_window_in_seconds` - (Optional) The maximum length of a time to wait for events. Maximum value of 300.
+* `queue_name` - (Required) The name of the destination queue to consume. Maximum length of 1000.
+
+##### source_parameters.activemq_broker_parameters.credentials Configuration Block
+
+* `basic_auth` - (Required) The ARN of the Secrets Manager secret containing the basic auth credentials.
+
+#### source_parameters.dynamodb_stream_parameters Configuration Block
+
+* `batch_size` - (Optional) The maximum number of records to include in each batch. Maximum value of 10000.
+* `dead_letter_config` - (Optional) Define the target queue to send dead-letter queue events to. Detailed below.
+* `maximum_batching_window_in_seconds` - (Optional) The maximum length of a time to wait for events. Maximum value of 300.
+* `maximum_record_age_in_seconds` - (Optional) Discard records older than the specified age. The default value is -1, which sets the maximum age to infinite. When the value is set to infinite, EventBridge never discards old records. Maximum value of 604,800.
+* `maximum_retry_attempts` - (Optional) Discard records after the specified number of retries. The default value is -1, which sets the maximum number of retries to infinite. When MaximumRetryAttempts is infinite, EventBridge retries failed records until the record expires in the event source. Maximum value of 10,000.
+* `on_partial_batch_item_failure` - (Optional) Define how to handle item process failures. AUTOMATIC_BISECT halves each batch and retry each half until all the records are processed or there is one failed message left in the batch. Valid values: AUTOMATIC_BISECT.
+* `parallelization_factor` - (Optional)The number of batches to process concurrently from each shard. The default value is 1. Maximum value of 10.
+* `starting_position` - (Optional) The position in a stream from which to start reading. Valid values: TRIM_HORIZON, LATEST.
+
+##### source_parameters.dynamodb_stream_parameters.dead_letter_config Configuration Block
+
+* `arn` - (Optional) The ARN of the Amazon SQS queue specified as the target for the dead-letter queue.
+
+#### source_parameters.kinesis_stream_parameters Configuration Block
+
+* `batch_size` - (Optional) The maximum number of records to include in each batch. Maximum value of 10000.
+* `dead_letter_config` - (Optional) Define the target queue to send dead-letter queue events to. Detailed below.
+* `maximum_batching_window_in_seconds` - (Optional) The maximum length of a time to wait for events. Maximum value of 300.
+* `maximum_record_age_in_seconds` - (Optional) Discard records older than the specified age. The default value is -1, which sets the maximum age to infinite. When the value is set to infinite, EventBridge never discards old records. Maximum value of 604,800.
+* `maximum_retry_attempts` - (Optional) Discard records after the specified number of retries. The default value is -1, which sets the maximum number of retries to infinite. When MaximumRetryAttempts is infinite, EventBridge retries failed records until the record expires in the event source. Maximum value of 10,000.
+* `on_partial_batch_item_failure` - (Optional) Define how to handle item process failures. AUTOMATIC_BISECT halves each batch and retry each half until all the records are processed or there is one failed message left in the batch. Valid values: AUTOMATIC_BISECT.
+* `parallelization_factor` - (Optional)The number of batches to process concurrently from each shard. The default value is 1. Maximum value of 10.
+* `starting_position` - (Required) The position in a stream from which to start reading. Valid values: TRIM_HORIZON, LATEST, AT_TIMESTAMP.
+* `starting_position_timestamp` - (Optional) With StartingPosition set to AT_TIMESTAMP, the time from which to start reading, in Unix time seconds.
+
+##### source_parameters.kinesis_stream_parameters.dead_letter_config Configuration Block
+
+* `arn` - (Optional) The ARN of the Amazon SQS queue specified as the target for the dead-letter queue.
+
+#### source_parameters.managed_streaming_kafka_parameters Configuration Block
+
+* `batch_size` - (Optional) The maximum number of records to include in each batch. Maximum value of 10000.
+* `consumer_group_id` - (Optional) The name of the destination queue to consume. Maximum value of 200.
+* `credentials` - (Optional) The credentials needed to access the resource. Detailed below.
+* `maximum_batching_window_in_seconds` - (Optional) The maximum length of a time to wait for events. Maximum value of 300.
+* `starting_position` - (Optional) The position in a stream from which to start reading. Valid values: TRIM_HORIZON, LATEST.
+* `topic_name` - (Required) The name of the topic that the pipe will read from. Maximum length of 249.
+
+##### source_parameters.managed_streaming_kafka_parameters.credentials Configuration Block
+
+* `client_certificate_tls_auth` - (Optional) The ARN of the Secrets Manager secret containing the credentials.
+* `sasl_scram_512_auth` - (Optional) The ARN of the Secrets Manager secret containing the credentials.
+
+#### source_parameters.rabbitmq_broker_parameters Configuration Block
+
+* `batch_size` - (Optional) The maximum number of records to include in each batch. Maximum value of 10000.
+* `credentials` - (Required) The credentials needed to access the resource. Detailed below.
+* `maximum_batching_window_in_seconds` - (Optional) The maximum length of a time to wait for events. Maximum value of 300.
+* `queue_name` - (Required) The name of the destination queue to consume. Maximum length of 1000.
+* `virtual_host` - (Optional) The name of the virtual host associated with the source broker. Maximum length of 200.
+
+##### source_parameters.rabbitmq_broker_parameters.credentials Configuration Block
+
+* `basic_auth` - (Required) The ARN of the Secrets Manager secret containing the credentials.
+
+#### source_parameters.self_managed_kafka_parameters Configuration Block
+
+* `additional_bootstrap_servers` - (Optional) An array of server URLs. Maximum number of 2 items, each of maximum length 300.
+* `batch_size` - (Optional) The maximum number of records to include in each batch. Maximum value of 10000.
+* `consumer_group_id` - (Optional) The name of the destination queue to consume. Maximum value of 200.
+* `credentials` - (Optional) The credentials needed to access the resource. Detailed below.
+* `maximum_batching_window_in_seconds` - (Optional) The maximum length of a time to wait for events. Maximum value of 300.
+* `server_root_ca_certificate` - (Optional) The ARN of the Secrets Manager secret used for certification.
+* `starting_position` - (Optional) The position in a stream from which to start reading. Valid values: TRIM_HORIZON, LATEST.
+* `topic_name` - (Required) The name of the topic that the pipe will read from. Maximum length of 249.
+* `vpc` - (Optional) This structure specifies the VPC subnets and security groups for the stream, and whether a public IP address is to be used. Detailed below.
+
+##### source_parameters.self_managed_kafka_parameters.credentials Configuration Block
+
+* `basic_auth` - (Optional) The ARN of the Secrets Manager secret containing the credentials.
+* `client_certificate_tls_auth` - (Optional) The ARN of the Secrets Manager secret containing the credentials.
+* `sasl_scram_256_auth` - (Optional) The ARN of the Secrets Manager secret containing the credentials.
+* `sasl_scram_512_auth` - (Optional) The ARN of the Secrets Manager secret containing the credentials.
+
+##### source_parameters.self_managed_kafka_parameters.vpc Configuration Block
+
+* `security_groups` - (Optional) List of security groups associated with the stream. These security groups must all be in the same VPC. You can specify as many as five security groups. If you do not specify a security group, the default security group for the VPC is used.
+* `subnets` - (Optional) List of the subnets associated with the stream. These subnets must all be in the same VPC. You can specify as many as 16 subnets.
+
+#### source_parameters.sqs_queue_parameters Configuration Block
+
+* `batch_size` - (Optional) The maximum number of records to include in each batch. Maximum value of 10000.
+* `maximum_batching_window_in_seconds` - (Optional) The maximum length of a time to wait for events. Maximum value of 300.
+
+### target_parameters Configuration Block
+
+You can find out more about EventBridge Pipes Targets in the [User Guide](https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-pipes-event-target.html).
+
+* `batch_job_parameters` - (Optional) The parameters for using an AWS Batch job as a target. Detailed below.
+* `cloudwatch_logs_parameters` - (Optional) The parameters for using an CloudWatch Logs log stream as a target. Detailed below.
+* `ecs_task_parameters` - (Optional) The parameters for using an Amazon ECS task as a target. Detailed below.
+* `eventbridge_event_bus_parameters` - (Optional) The parameters for using an EventBridge event bus as a target. Detailed below.
+* `http_parameters` - (Optional) These are custom parameter to be used when the target is an API Gateway REST APIs or EventBridge ApiDestinations. Detailed below.
+* `input_template` - (Optional) Valid JSON text passed to the target. In this case, nothing from the event itself is passed to the target. Maximum length of 8192 characters.
+* `kinesis_stream_parameters` - (Optional) The parameters for using a Kinesis stream as a source. Detailed below.
+* `lambda_function_parameters` - (Optional) The parameters for using a Lambda function as a target. Detailed below.
+* `redshift_data_parameters` - (Optional) These are custom parameters to be used when the target is a Amazon Redshift cluster to invoke the Amazon Redshift Data API BatchExecuteStatement. Detailed below.
+* `sagemaker_pipeline_parameters` - (Optional) The parameters for using a SageMaker pipeline as a target. Detailed below.
+* `sqs_queue_parameters` - (Optional) The parameters for using a Amazon SQS stream as a target. Detailed below.
+* `step_function_state_machine_parameters` - (Optional) The parameters for using a Step Functions state machine as a target. Detailed below.
+
+#### target_parameters.batch_job_parameters Configuration Block
+
+* `array_properties` - (Optional) The array properties for the submitted job, such as the size of the array. The array size can be between 2 and 10,000. If you specify array properties for a job, it becomes an array job. This parameter is used only if the target is an AWS Batch job. Detailed below.
+* `container_overrides` - (Optional) The overrides that are sent to a container. Detailed below.
+* `depends_on` - (Optional) A list of dependencies for the job. A job can depend upon a maximum of 20 jobs. You can specify a SEQUENTIAL type dependency without specifying a job ID for array jobs so that each child array job completes sequentially, starting at index 0. You can also specify an N_TO_N type dependency with a job ID for array jobs. In that case, each index child of this job must wait for the corresponding index child of each dependency to complete before it can begin. Detailed below.
+* `job_definition` - (Required) The job definition used by this job. This value can be one of name, name:revision, or the Amazon Resource Name (ARN) for the job definition. If name is specified without a revision then the latest active revision is used.
+* `job_name` - (Required) The name of the job. It can be up to 128 letters long.
+* `parameters` - (Optional) Additional parameters passed to the job that replace parameter substitution placeholders that are set in the job definition. Parameters are specified as a key and value pair mapping. Parameters included here override any corresponding parameter defaults from the job definition. Detailed below.
+* `retry_strategy` - (Optional) The retry strategy to use for failed jobs. When a retry strategy is specified here, it overrides the retry strategy defined in the job definition. Detailed below.
+
+##### target_parameters.batch_job_parameters.array_properties Configuration Block
+
+* `size` - (Optional) The size of the array, if this is an array batch job. Minimum value of 2. Maximum value of 10,000.
+
+##### target_parameters.batch_job_parameters.container_overrides Configuration Block
+
+* `command` - (Optional) List of commands to send to the container that overrides the default command from the Docker image or the task definition.
+* `environment` - (Optional) The environment variables to send to the container. You can add new environment variables, which are added to the container at launch, or you can override the existing environment variables from the Docker image or the task definition. Environment variables cannot start with " AWS Batch ". This naming convention is reserved for variables that AWS Batch sets. Detailed below.
+* `instance_type` - (Optional) The instance type to use for a multi-node parallel job. This parameter isn't applicable to single-node container jobs or jobs that run on Fargate resources, and shouldn't be provided.
+* `resource_requirement` - (Optional) The type and amount of resources to assign to a container. This overrides the settings in the job definition. The supported resources include GPU, MEMORY, and VCPU. Detailed below.
+
+###### target_parameters.batch_job_parameters.container_overrides.environment Configuration Block
+
+* `name` - (Optional) The name of the key-value pair. For environment variables, this is the name of the environment variable.
+* `value` - (Optional) The value of the key-value pair. For environment variables, this is the value of the environment variable.
+
+###### target_parameters.batch_job_parameters.container_overrides.resource_requirement Configuration Block
+
+* `type` - (Optional) The type of resource to assign to a container. The supported resources include GPU, MEMORY, and VCPU.
+* `value` - (Optional) The quantity of the specified resource to reserve for the container. [The values vary based on the type specified](https://docs.aws.amazon.com/eventbridge/latest/pipes-reference/API_BatchResourceRequirement.html).
+
+##### target_parameters.batch_job_parameters.depends_on Configuration Block
+
+* `job_id` - (Optional) The job ID of the AWS Batch job that's associated with this dependency.
+* `type` - (Optional) The type of the job dependency. Valid Values: N_TO_N, SEQUENTIAL.
+
+##### target_parameters.batch_job_parameters.retry_strategy Configuration Block
+
+* `attempts` - (Optional) The number of times to move a job to the RUNNABLE status. If the value of attempts is greater than one, the job is retried on failure the same number of attempts as the value. Maximum value of 10.
+
+#### target_parameters.cloudwatch_logs_parameters Configuration Block
+
+* `log_stream_name` - (Optional) The name of the log stream.
+* `timestamp` - (Optional) The time the event occurred, expressed as the number of milliseconds after Jan 1, 1970 00:00:00 UTC. This is the JSON path to the field in the event e.g. $.detail.timestamp
+
+#### target_parameters.ecs_task_parameters Configuration Block
+
+* `capacity_provider_strategy` - (Optional) List of capacity provider strategies to use for the task. If a capacityProviderStrategy is specified, the launchType parameter must be omitted. If no capacityProviderStrategy or launchType is specified, the defaultCapacityProviderStrategy for the cluster is used. Detailed below.
+* `enable_ecs_managed_tags` - (Optional) Specifies whether to enable Amazon ECS managed tags for the task. Valid values: true, false.
+* `enable_execute_command` - (Optional) Whether or not to enable the execute command functionality for the containers in this task. If true, this enables execute command functionality on all containers in the task. Valid values: true, false.
+* `group` - (Optional) Specifies an Amazon ECS task group for the task. The maximum length is 255 characters.
+* `launch_type` - (Optional) Specifies the launch type on which your task is running. The launch type that you specify here must match one of the launch type (compatibilities) of the target task. The FARGATE value is supported only in the Regions where AWS Fargate with Amazon ECS is supported. Valid Values: EC2, FARGATE, EXTERNAL
+* `network_configuration` - (Optional) Use this structure if the Amazon ECS task uses the awsvpc network mode. This structure specifies the VPC subnets and security groups associated with the task, and whether a public IP address is to be used. This structure is required if LaunchType is FARGATE because the awsvpc mode is required for Fargate tasks. If you specify NetworkConfiguration when the target ECS task does not use the awsvpc network mode, the task fails. Detailed below.
+* `overrides` - (Optional) The overrides that are associated with a task. Detailed below.
+* `placement_constraint` - (Optional) An array of placement constraint objects to use for the task. You can specify up to 10 constraints per task (including constraints in the task definition and those specified at runtime). Detailed below.
+* `placement_strategy` - (Optional) The placement strategy objects to use for the task. You can specify a maximum of five strategy rules per task. Detailed below.
+* `platform_version` - (Optional) Specifies the platform version for the task. Specify only the numeric portion of the platform version, such as 1.1.0. This structure is used only if LaunchType is FARGATE.
+* `propagate_tags` - (Optional) Specifies whether to propagate the tags from the task definition to the task. If no value is specified, the tags are not propagated. Tags can only be propagated to the task during task creation. To add tags to a task after task creation, use the TagResource API action. Valid Values: TASK_DEFINITION
+* `reference_id` - (Optional) The reference ID to use for the task. Maximum length of 1,024.
+* `tags` - (Optional) Key-value map of tags that you apply to the task to help you categorize and organize them.
+* `task_count` - (Optional) The number of tasks to create based on TaskDefinition. The default is 1.
+* `task_definition_arn` - (Optional) The ARN of the task definition to use if the event target is an Amazon ECS task.
+
+##### target_parameters.ecs_task_parameters.capacity_provider_strategy Configuration Block
+
+* `base` - (Optional) The base value designates how many tasks, at a minimum, to run on the specified capacity provider. Only one capacity provider in a capacity provider strategy can have a base defined. If no value is specified, the default value of 0 is used. Maximum value of 100,000.
+* `capacity_provider` - (Optional) The short name of the capacity provider. Maximum value of 255.
+* `weight` - (Optional) The weight value designates the relative percentage of the total number of tasks launched that should use the specified capacity provider. The weight value is taken into consideration after the base value, if defined, is satisfied. Maximum value of 1,000.
+
+##### target_parameters.ecs_task_parameters.network_configuration Configuration Block
+
+* `aws_vpc_configuration` - (Optional) Use this structure to specify the VPC subnets and security groups for the task, and whether a public IP address is to be used. This structure is relevant only for ECS tasks that use the awsvpc network mode. Detailed below.
+
+###### target_parameters.ecs_task_parameters.network_configuration.aws_vpc_configuration Configuration Block
+
+* `assign_public_ip` - (Optional) Specifies whether the task's elastic network interface receives a public IP address. You can specify ENABLED only when LaunchType in EcsParameters is set to FARGATE. Valid Values: ENABLED, DISABLED.
+* `security_groups` - (Optional) Specifies the security groups associated with the task. These security groups must all be in the same VPC. You can specify as many as five security groups. If you do not specify a security group, the default security group for the VPC is used.
+* `subnets` - (Optional) Specifies the subnets associated with the task. These subnets must all be in the same VPC. You can specify as many as 16 subnets.
+
+##### target_parameters.ecs_task_parameters.overrides Configuration Block
+
+* `container_override` - (Optional) One or more container overrides that are sent to a task. Detailed below.
+* `cpu` - (Optional) The cpu override for the task.
+* `ephemeral_storage` - (Optional) The ephemeral storage setting override for the task.  Detailed below.
+* `execution_role_arn` - (Optional) The Amazon Resource Name (ARN) of the task execution IAM role override for the task.
+* `inference_accelerator_override` - (Optional) List of Elastic Inference accelerator overrides for the task. Detailed below.
+* `memory` - (Optional) The memory override for the task.
+* `task_role_arn` - (Optional) The Amazon Resource Name (ARN) of the IAM role that containers in this task can assume. All containers in this task are granted the permissions that are specified in this role.
+
+###### target_parameters.ecs_task_parameters.overrides.container_override Configuration Block
+
+* `command` - (Optional) List of commands to send to the container that overrides the default command from the Docker image or the task definition. You must also specify a container name.
+* `cpu` - (Optional) The number of cpu units reserved for the container, instead of the default value from the task definition. You must also specify a container name.
+* `environment` - (Optional) The environment variables to send to the container. You can add new environment variables, which are added to the container at launch, or you can override the existing environment variables from the Docker image or the task definition. You must also specify a container name. Detailed below.
+* `environment_file` - (Optional) A list of files containing the environment variables to pass to a container, instead of the value from the container definition. Detailed below.
+* `memory` - (Optional) The hard limit (in MiB) of memory to present to the container, instead of the default value from the task definition. If your container attempts to exceed the memory specified here, the container is killed. You must also specify a container name.
+* `memory_reservation` - (Optional) The soft limit (in MiB) of memory to reserve for the container, instead of the default value from the task definition. You must also specify a container name.
+* `name` - (Optional) The name of the container that receives the override. This parameter is required if any override is specified.
+* `resource_requirement` - (Optional) The type and amount of a resource to assign to a container, instead of the default value from the task definition. The only supported resource is a GPU. Detailed below.
+
+###### target_parameters.ecs_task_parameters.overrides.container_override.environment Configuration Block
+
+* `name` - (Optional) The name of the key-value pair. For environment variables, this is the name of the environment variable.
+* `value` - (Optional) The value of the key-value pair. For environment variables, this is the value of the environment variable.
+
+###### target_parameters.ecs_task_parameters.overrides.container_override.environment_file Configuration Block
+
+* `type` - (Optional) The file type to use. The only supported value is s3.
+* `value` - (Optional) The Amazon Resource Name (ARN) of the Amazon S3 object containing the environment variable file.
+
+###### target_parameters.ecs_task_parameters.overrides.container_override.resource_requirement Configuration Block
+
+* `type` - (Optional) The type of resource to assign to a container. The supported values are GPU or InferenceAccelerator.
+* `value` - (Optional) The value for the specified resource type. If the GPU type is used, the value is the number of physical GPUs the Amazon ECS container agent reserves for the container. The number of GPUs that's reserved for all containers in a task can't exceed the number of available GPUs on the container instance that the task is launched on. If the InferenceAccelerator type is used, the value matches the deviceName for an InferenceAccelerator specified in a task definition.
+
+###### target_parameters.ecs_task_parameters.overrides.ephemeral_storage Configuration Block
+
+* `size_in_gib` - (Required) The total amount, in GiB, of ephemeral storage to set for the task. The minimum supported value is 21 GiB and the maximum supported value is 200 GiB.
+
+###### target_parameters.ecs_task_parameters.overrides.inference_accelerator_override Configuration Block
+
+* `device_name` - (Optional) The Elastic Inference accelerator device name to override for the task. This parameter must match a deviceName specified in the task definition.
+* `device_type` - (Optional) The Elastic Inference accelerator type to use.
+
+##### target_parameters.ecs_task_parameters.placement_constraint Configuration Block
+
+* `expression` - (Optional) A cluster query language expression to apply to the constraint. You cannot specify an expression if the constraint type is distinctInstance. Maximum length of 2,000.
+* `type` - (Optional) The type of constraint. Use distinctInstance to ensure that each task in a particular group is running on a different container instance. Use memberOf to restrict the selection to a group of valid candidates. Valid Values: distinctInstance, memberOf.
+
+##### target_parameters.ecs_task_parameters.placement_strategy Configuration Block
+
+* `field` - (Optional) The field to apply the placement strategy against. For the spread placement strategy, valid values are instanceId (or host, which has the same effect), or any platform or custom attribute that is applied to a container instance, such as attribute:ecs.availability-zone. For the binpack placement strategy, valid values are cpu and memory. For the random placement strategy, this field is not used. Maximum length of 255.
+* `type` - (Optional) The type of placement strategy. The random placement strategy randomly places tasks on available candidates. The spread placement strategy spreads placement across available candidates evenly based on the field parameter. The binpack strategy places tasks on available candidates that have the least available amount of the resource that is specified with the field parameter. For example, if you binpack on memory, a task is placed on the instance with the least amount of remaining memory (but still enough to run the task). Valid Values: random, spread, binpack.
+
+#### target_parameters.eventbridge_event_bus_parameters Configuration Block
+
+* `detail_type` - (Optional) A free-form string, with a maximum of 128 characters, used to decide what fields to expect in the event detail.
+* `endpoint_id` - (Optional) The URL subdomain of the endpoint. For example, if the URL for Endpoint is https://abcde.veo.endpoints.event.amazonaws.com, then the EndpointId is abcde.veo.
+* `resources` - (Optional) List of AWS resources, identified by Amazon Resource Name (ARN), which the event primarily concerns. Any number, including zero, may be present.
+* `source` - (Optional) The source of the event. Maximum length of 256.
+* `time` - (Optional) The time stamp of the event, per RFC3339. If no time stamp is provided, the time stamp of the PutEvents call is used. This is the JSON path to the field in the event e.g. $.detail.timestamp
+
+#### target_parameters.http_parameters Configuration Block
+
+* `header_parameters` - (Optional) Key-value mapping of the headers that need to be sent as part of request invoking the API Gateway REST API or EventBridge ApiDestination. Detailed below.
+* `path_parameter_values` - (Optional) The path parameter values to be used to populate API Gateway REST API or EventBridge ApiDestination path wildcards ("*").
+* `query_string_parameters` - (Optional) Key-value mapping of the query strings that need to be sent as part of request invoking the API Gateway REST API or EventBridge ApiDestination. Detailed below.
+
+#### target_parameters.kinesis_stream_parameters Configuration Block
+
+* `partition_key` - (Required) Determines which shard in the stream the data record is assigned to. Partition keys are Unicode strings with a maximum length limit of 256 characters for each key. Amazon Kinesis Data Streams uses the partition key as input to a hash function that maps the partition key and associated data to a specific shard. Specifically, an MD5 hash function is used to map partition keys to 128-bit integer values and to map associated data records to shards. As a result of this hashing mechanism, all data records with the same partition key map to the same shard within the stream.
+
+#### target_parameters.lambda_function_parameters Configuration Block
+
+* `invocation_type` - (Optional) Specify whether to invoke the function synchronously or asynchronously. Valid Values: REQUEST_RESPONSE, FIRE_AND_FORGET.
+
+#### target_parameters.redshift_data_parameters Configuration Block
+
+* `database` - (Required) The name of the database. Required when authenticating using temporary credentials.
+* `db_user` - (Optional) The database user name. Required when authenticating using temporary credentials.
+* `secret_manager_arn` - (Optional) The name or ARN of the secret that enables access to the database. Required when authenticating using Secrets Manager.
+* `sqls` - (Optional) List of SQL statements text to run, each of maximum length of 100,000.
+* `statement_name` - (Optional) The name of the SQL statement. You can name the SQL statement when you create it to identify the query.
+* `with_event` - (Optional) Indicates whether to send an event back to EventBridge after the SQL statement runs.
+
+#### target_parameters.sagemaker_pipeline_parameters Configuration Block
+
+* `pipeline_parameter` - (Optional) List of Parameter names and values for SageMaker Model Building Pipeline execution. Detailed below.
+
+##### target_parameters.sagemaker_pipeline_parameters.parameters Configuration Block
+
+* `name` - (Optional) Name of parameter to start execution of a SageMaker Model Building Pipeline. Maximum length of 256.
+* `value` - (Optional) Value of parameter to start execution of a SageMaker Model Building Pipeline. Maximum length of 1024.
+
+#### target_parameters.sqs_queue_parameters Configuration Block
+
+* `message_deduplication_id` - (Optional) This parameter applies only to FIFO (first-in-first-out) queues. The token used for deduplication of sent messages.
+* `message_group_id` - (Optional) The FIFO message group ID to use as the target.
+
+#### target_parameters.step_function_state_machine_parameters Configuration Block
+
+* `invocation_type` - (Optional) Specify whether to invoke the function synchronously or asynchronously. Valid Values: REQUEST_RESPONSE, FIRE_AND_FORGET.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of this pipe.
+* `id` - Same as `name`.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `30m`)
+* `update` - (Default `30m`)
+* `delete` - (Default `30m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import pipes using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import pipes using the `name`. For example:
+
+```console
+% terraform import aws_pipes_pipe.example my-pipe
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1a860b54f52a7aaa05aba46c72e3c39fe95c80a585397250f041eb4e41a13d7f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/placement_group.html.markdown b/website/docs/cdktf/python/r/placement_group.html.markdown
new file mode 100644
index 00000000000..e9aa6fee93f
--- /dev/null
+++ b/website/docs/cdktf/python/r/placement_group.html.markdown
@@ -0,0 +1,77 @@
+---
+subcategory: "EC2 (Elastic Compute Cloud)"
+layout: "aws"
+page_title: "AWS: aws_placement_group"
+description: |-
+  Provides an EC2 placement group.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_placement_group
+
+Provides an EC2 placement group. Read more about placement groups
+in [AWS Docs](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/placement-groups.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.placement_group import PlacementGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        PlacementGroup(self, "web",
+            name="hunky-dory-pg",
+            strategy="cluster"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the placement group.
+* `partition_count` - (Optional) The number of partitions to create in the
+  placement group.  Can only be specified when the `strategy` is set to
+  `partition`.  Valid values are 1 - 7 (default is `2`).
+* `spread_level` - (Optional) Determines how placement groups spread instances. Can only be used
+   when the `strategy` is set to `spread`. Can be `host` or `rack`. `host` can only be used for Outpost placement groups. Defaults to `rack`.
+* `strategy` - (Required) The placement strategy. Can be `cluster`, `partition` or `spread`.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the placement group.
+* `id` - The name of the placement group.
+* `placement_group_id` - The ID of the placement group.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import placement groups using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import placement groups using the `name`. For example:
+
+```console
+% terraform import aws_placement_group.prod_pg production-placement-group
+```
+
+<!-- cache-key: cdktf-0.18.0 input-2db42e50344643d73d88a7291c495c78556f7f0f63349d8e602e23a0b1bdb180 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/prometheus_alert_manager_definition.html.markdown b/website/docs/cdktf/python/r/prometheus_alert_manager_definition.html.markdown
new file mode 100644
index 00000000000..26bbb35dd0d
--- /dev/null
+++ b/website/docs/cdktf/python/r/prometheus_alert_manager_definition.html.markdown
@@ -0,0 +1,70 @@
+---
+subcategory: "AMP (Managed Prometheus)"
+layout: "aws"
+page_title: "AWS: aws_prometheus_alert_manager_definition"
+description: |-
+  Manages an Amazon Managed Service for Prometheus (AMP) Alert Manager Definition
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_prometheus_alert_manager_definition
+
+Manages an Amazon Managed Service for Prometheus (AMP) Alert Manager Definition
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.prometheus_alert_manager_definition import PrometheusAlertManagerDefinition
+from imports.aws.prometheus_workspace import PrometheusWorkspace
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        demo = PrometheusWorkspace(self, "demo")
+        aws_prometheus_alert_manager_definition_demo =
+        PrometheusAlertManagerDefinition(self, "demo_1",
+            definition="alertmanager_config: |\n  route:\n    receiver: 'default'\n  receivers:\n    - name: 'default'\n\n",
+            workspace_id=demo.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_prometheus_alert_manager_definition_demo.override_logical_id("demo")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `workspace_id` - (Required) ID of the prometheus workspace the alert manager definition should be linked to
+* `definition` - (Required) the alert manager definition that you want to be applied. See more [in AWS Docs](https://docs.aws.amazon.com/prometheus/latest/userguide/AMP-alert-manager.html).
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import the prometheus alert manager definition using the workspace identifier. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import the prometheus alert manager definition using the workspace identifier. For example:
+
+```console
+% terraform import aws_prometheus_alert_manager_definition.demo ws-C6DCB907-F2D7-4D96-957B-66691F865D8B
+```
+
+<!-- cache-key: cdktf-0.18.0 input-6a4a52d7d4acb917f5c7ab057a46d8d09f6db1143f23bbfd0bbd195ab2a7b439 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/prometheus_rule_group_namespace.html.markdown b/website/docs/cdktf/python/r/prometheus_rule_group_namespace.html.markdown
new file mode 100644
index 00000000000..49ad02eaf8a
--- /dev/null
+++ b/website/docs/cdktf/python/r/prometheus_rule_group_namespace.html.markdown
@@ -0,0 +1,72 @@
+---
+subcategory: "AMP (Managed Prometheus)"
+layout: "aws"
+page_title: "AWS: aws_prometheus_rule_group_namespace"
+description: |-
+  Manages an Amazon Managed Service for Prometheus (AMP) Rule Group Namespace
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_prometheus_rule_group_namespace
+
+Manages an Amazon Managed Service for Prometheus (AMP) Rule Group Namespace
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.prometheus_rule_group_namespace import PrometheusRuleGroupNamespace
+from imports.aws.prometheus_workspace import PrometheusWorkspace
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        demo = PrometheusWorkspace(self, "demo")
+        aws_prometheus_rule_group_namespace_demo =
+        PrometheusRuleGroupNamespace(self, "demo_1",
+            data="groups:\n  - name: test\n    rules:\n    - record: metric:recording_rule\n      expr: avg(rate(container_cpu_usage_seconds_total[5m]))\n\n",
+            name="rules",
+            workspace_id=demo.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_prometheus_rule_group_namespace_demo.override_logical_id("demo")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the rule group namespace
+* `workspace_id` - (Required) ID of the prometheus workspace the rule group namespace should be linked to
+* `data` - (Required) the rule group namespace data that you want to be applied. See more [in AWS Docs](https://docs.aws.amazon.com/prometheus/latest/userguide/AMP-Ruler.html).
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import the prometheus rule group namespace using the arn. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import the prometheus rule group namespace using the arn. For example:
+
+```console
+% terraform import aws_prometheus_rule_group_namespace.demo arn:aws:aps:us-west-2:123456789012:rulegroupsnamespace/IDstring/namespace_name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-4744fbde8b8a0aa11fdd4a09abcef647630425256c23ba232641a4e6fbd803ac -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/prometheus_workspace.html.markdown b/website/docs/cdktf/python/r/prometheus_workspace.html.markdown
new file mode 100644
index 00000000000..bd227add9f4
--- /dev/null
+++ b/website/docs/cdktf/python/r/prometheus_workspace.html.markdown
@@ -0,0 +1,106 @@
+---
+subcategory: "AMP (Managed Prometheus)"
+layout: "aws"
+page_title: "AWS: aws_prometheus_workspace"
+description: |-
+  Manages an Amazon Managed Service for Prometheus (AMP) Workspace
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_prometheus_workspace
+
+Manages an Amazon Managed Service for Prometheus (AMP) Workspace.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.prometheus_workspace import PrometheusWorkspace
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        PrometheusWorkspace(self, "example",
+            alias="example",
+            tags={
+                "Environment": "production"
+            }
+        )
+```
+
+### CloudWatch Logging
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudwatch_log_group import CloudwatchLogGroup
+from imports.aws.prometheus_workspace import PrometheusWorkspace
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = CloudwatchLogGroup(self, "example",
+            name="example"
+        )
+        aws_prometheus_workspace_example = PrometheusWorkspace(self, "example_1",
+            logging_configuration=PrometheusWorkspaceLoggingConfiguration(
+                log_group_arn="${" + example.arn + "}:*"
+            )
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_prometheus_workspace_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `alias` - (Optional) The alias of the prometheus workspace. See more [in AWS Docs](https://docs.aws.amazon.com/prometheus/latest/userguide/AMP-onboard-create-workspace.html).
+* `logging_configuration` - (Optional) Logging configuration for the workspace. See [Logging Configuration](#logging-configuration) below for details.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Logging Configuration
+
+The `logging_configuration` block supports the following arguments:
+
+* `log_group_arn` - (Required) The ARN of the CloudWatch log group to which the vended log data will be published. This log group must exist.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the workspace.
+* `id` - Identifier of the workspace
+* `prometheus_endpoint` - Prometheus endpoint available for this workspace.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AMP Workspaces using the identifier. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import AMP Workspaces using the identifier. For example:
+
+```console
+% terraform import aws_prometheus_workspace.demo ws-C6DCB907-F2D7-4D96-957B-66691F865D8B
+```
+
+<!-- cache-key: cdktf-0.18.0 input-94364fd09dc8c162f82df7a4b9553955564416fc93204755b5fec4873553516a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/proxy_protocol_policy.html.markdown b/website/docs/cdktf/python/r/proxy_protocol_policy.html.markdown
new file mode 100644
index 00000000000..d511e588de8
--- /dev/null
+++ b/website/docs/cdktf/python/r/proxy_protocol_policy.html.markdown
@@ -0,0 +1,68 @@
+---
+subcategory: "ELB Classic"
+layout: "aws"
+page_title: "AWS: aws_proxy_protocol_policy"
+description: |-
+  Provides a proxy protocol policy, which allows an ELB to carry a client connection information to a backend.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_proxy_protocol_policy
+
+Provides a proxy protocol policy, which allows an ELB to carry a client connection information to a backend.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.elb import Elb
+from imports.aws.proxy_protocol_policy import ProxyProtocolPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        lb = Elb(self, "lb",
+            availability_zones=["us-east-1a"],
+            listener=[ElbListener(
+                instance_port=25,
+                instance_protocol="tcp",
+                lb_port=25,
+                lb_protocol="tcp"
+            ), ElbListener(
+                instance_port=587,
+                instance_protocol="tcp",
+                lb_port=587,
+                lb_protocol="tcp"
+            )
+            ],
+            name="test-lb"
+        )
+        ProxyProtocolPolicy(self, "smtp",
+            instance_ports=["25", "587"],
+            load_balancer=lb.name
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `load_balancer` - (Required) The load balancer to which the policy
+  should be attached.
+* `instance_ports` - (Required) List of instance ports to which the policy
+  should be applied. This can be specified if the protocol is SSL or TCP.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the policy.
+* `load_balancer` - The load balancer to which the policy is attached.
+
+<!-- cache-key: cdktf-0.18.0 input-09e9cd566d935abe3b4ff77b122a6204ff1a06eaa08a5a2dd8ec25b2cb1a5e20 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/qldb_ledger.html.markdown b/website/docs/cdktf/python/r/qldb_ledger.html.markdown
new file mode 100644
index 00000000000..1dfe444187b
--- /dev/null
+++ b/website/docs/cdktf/python/r/qldb_ledger.html.markdown
@@ -0,0 +1,81 @@
+---
+subcategory: "QLDB (Quantum Ledger Database)"
+layout: "aws"
+page_title: "AWS: aws_qldb_ledger"
+description: |-
+  Provides an QLDB Resource resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_qldb_ledger
+
+Provides an AWS Quantum Ledger Database (QLDB) resource
+
+~> **NOTE:** Deletion protection is enabled by default. To successfully delete this resource via Terraform, `deletion_protection = false` must be applied before attempting deletion.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.qldb_ledger import QldbLedger
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        QldbLedger(self, "sample-ledger",
+            name="sample-ledger",
+            permissions_mode="STANDARD"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `deletion_protection` - (Optional) The deletion protection for the QLDB Ledger instance. By default it is `true`. To delete this resource via Terraform, this value must be configured to `false` and applied first before attempting deletion.
+* `kms_key` - (Optional) The key in AWS Key Management Service (AWS KMS) to use for encryption of data at rest in the ledger. For more information, see the [AWS documentation](https://docs.aws.amazon.com/qldb/latest/developerguide/encryption-at-rest.html). Valid values are `"AWS_OWNED_KMS_KEY"` to use an AWS KMS key that is owned and managed by AWS on your behalf, or the ARN of a valid symmetric customer managed KMS key.
+* `name` - (Optional) The friendly name for the QLDB Ledger instance. By default generated by Terraform.
+* `permissions_mode` - (Required) The permissions mode for the QLDB ledger instance. Specify either `ALLOW_ALL` or `STANDARD`.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Name of the QLDB Ledger
+* `arn` - The ARN of the QLDB Ledger
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `10m`)
+- `delete` - (Default `10m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import QLDB Ledgers using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import QLDB Ledgers using the `name`. For example:
+
+```console
+% terraform import aws_qldb_ledger.sample-ledger sample-ledger
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ce649e87d3aa63512d24a26f84548ecb8485e38743e2428127ead04a1c91c863 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/qldb_stream.html.markdown b/website/docs/cdktf/python/r/qldb_stream.html.markdown
new file mode 100644
index 00000000000..d9177b91b4e
--- /dev/null
+++ b/website/docs/cdktf/python/r/qldb_stream.html.markdown
@@ -0,0 +1,78 @@
+---
+subcategory: "QLDB (Quantum Ledger Database)"
+layout: "aws"
+page_title: "AWS: aws_qldb_stream"
+description: |-
+  Provides a QLDB Stream resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_qldb_stream
+
+Provides an AWS Quantum Ledger Database (QLDB) Stream resource
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.qldb_stream import QldbStream
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        QldbStream(self, "example",
+            inclusive_start_time="2021-01-01T00:00:00Z",
+            kinesis_configuration=QldbStreamKinesisConfiguration(
+                aggregation_enabled=False,
+                stream_arn="arn:aws:kinesis:us-east-1:xxxxxxxxxxxx:stream/example-kinesis-stream"
+            ),
+            ledger_name="existing-ledger-name",
+            role_arn="sample-role-arn",
+            stream_name="sample-ledger-stream",
+            tags={
+                "example": "tag"
+            }
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `exclusive_end_time` - (Optional) The exclusive date and time that specifies when the stream ends. If you don't define this parameter, the stream runs indefinitely until you cancel it. It must be in ISO 8601 date and time format and in Universal Coordinated Time (UTC). For example: `"2019-06-13T21:36:34Z"`.
+* `inclusive_start_time` - (Required) The inclusive start date and time from which to start streaming journal data. This parameter must be in ISO 8601 date and time format and in Universal Coordinated Time (UTC). For example: `"2019-06-13T21:36:34Z"`.  This cannot be in the future and must be before `exclusive_end_time`.  If you provide a value that is before the ledger's `CreationDateTime`, QLDB effectively defaults it to the ledger's `CreationDateTime`.
+* `kinesis_configuration` - (Required) The configuration settings of the Kinesis Data Streams destination for your stream request. Documented below.
+* `ledger_name` - (Required) The name of the QLDB ledger.
+* `role_arn` - (Required) The Amazon Resource Name (ARN) of the IAM role that grants QLDB permissions for a journal stream to write data records to a Kinesis Data Streams resource.
+* `stream_name` - (Required) The name that you want to assign to the QLDB journal stream. User-defined names can help identify and indicate the purpose of a stream.  Your stream name must be unique among other active streams for a given ledger. Stream names have the same naming constraints as ledger names, as defined in the [Amazon QLDB Developer Guide](https://docs.aws.amazon.com/qldb/latest/developerguide/limits.html#limits.naming).
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### kinesis_configuration
+
+The `kinesis_configuration` block supports the following arguments:
+
+* `aggregation_enabled` - (Optional) Enables QLDB to publish multiple data records in a single Kinesis Data Streams record, increasing the number of records sent per API call. Default: `true`.
+* `stream_arn` - (Required) The Amazon Resource Name (ARN) of the Kinesis Data Streams resource.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the QLDB Stream.
+* `arn` - The ARN of the QLDB Stream.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `8m`)
+- `delete` - (Default `5m`)
+
+<!-- cache-key: cdktf-0.18.0 input-35ccfcf2d29f7f918b217c8f22a5948a35ed05cac3acbaacc55e0a1fd3e71f2a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/quicksight_account_subscription.html.markdown b/website/docs/cdktf/python/r/quicksight_account_subscription.html.markdown
new file mode 100644
index 00000000000..26e5b5dddc3
--- /dev/null
+++ b/website/docs/cdktf/python/r/quicksight_account_subscription.html.markdown
@@ -0,0 +1,77 @@
+---
+subcategory: "QuickSight"
+layout: "aws"
+page_title: "AWS: aws_quicksight_account_subscription"
+description: |-
+  Terraform resource for managing an AWS QuickSight Account Subscription.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_quicksight_account_subscription
+
+Terraform resource for managing an AWS QuickSight Account Subscription.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.quicksight_account_subscription import QuicksightAccountSubscription
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        QuicksightAccountSubscription(self, "subscription",
+            account_name="quicksight-terraform",
+            authentication_method="IAM_AND_QUICKSIGHT",
+            edition="ENTERPRISE",
+            notification_email="notification@email.com"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `account_name` - (Required) Name of your Amazon QuickSight account. This name is unique over all of AWS, and it appears only when users sign in.
+* `authentication_method` - (Required) Method that you want to use to authenticate your Amazon QuickSight account. Currently, the valid values for this parameter are `IAM_AND_QUICKSIGHT`, `IAM_ONLY`, and `ACTIVE_DIRECTORY`.
+* `edition` - (Required) Edition of Amazon QuickSight that you want your account to have. Currently, you can choose from `STANDARD`, `ENTERPRISE` or `ENTERPRISE_AND_Q`.
+* `notification_email` - (Required) Email address that you want Amazon QuickSight to send notifications to regarding your Amazon QuickSight account or Amazon QuickSight subscription.
+
+The following arguments are optional:
+
+* `active_directory_name` - (Optional) Name of your Active Directory. This field is required if `ACTIVE_DIRECTORY` is the selected authentication method of the new Amazon QuickSight account.
+* `admin_group` - (Optional) Admin group associated with your Active Directory. This field is required if `ACTIVE_DIRECTORY` is the selected authentication method of the new Amazon QuickSight account.
+* `author_group` - (Optional) Author group associated with your Active Directory.
+* `aws_account_id` - (Optional) AWS account ID hosting the QuickSight account. Default to provider account.
+* `contact_number` - (Optional) A 10-digit phone number for the author of the Amazon QuickSight account to use for future communications. This field is required if `ENTERPPRISE_AND_Q` is the selected edition of the new Amazon QuickSight account.
+* `directory_id` - (Optional) Active Directory ID that is associated with your Amazon QuickSight account.
+* `email_address` - (Optional) Email address of the author of the Amazon QuickSight account to use for future communications. This field is required if `ENTERPPRISE_AND_Q` is the selected edition of the new Amazon QuickSight account.
+* `first_name` - (Optional) First name of the author of the Amazon QuickSight account to use for future communications. This field is required if `ENTERPPRISE_AND_Q` is the selected edition of the new Amazon QuickSight account.
+* `last_name` - (Optional) Last name of the author of the Amazon QuickSight account to use for future communications. This field is required if `ENTERPPRISE_AND_Q` is the selected edition of the new Amazon QuickSight account.
+* `reader_group` - (Optional) Reader group associated with your Active Direcrtory.
+* `realm` - (Optional) Realm of the Active Directory that is associated with your Amazon QuickSight account.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `account_subscription_status` - Status of the Amazon QuickSight account's subscription.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `10m`)
+* `delete` - (Default `10m`)
+
+## Import
+
+You cannot import this resource.
+
+<!-- cache-key: cdktf-0.18.0 input-875d75585da05795e23c019e0ffaab500682447eb4464a05a6d4c3ae31219bd9 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/quicksight_analysis.html.markdown b/website/docs/cdktf/python/r/quicksight_analysis.html.markdown
new file mode 100644
index 00000000000..910745c8e66
--- /dev/null
+++ b/website/docs/cdktf/python/r/quicksight_analysis.html.markdown
@@ -0,0 +1,209 @@
+---
+subcategory: "QuickSight"
+layout: "aws"
+page_title: "AWS: aws_quicksight_analysis"
+description: |-
+  Manages a QuickSight Analysis.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_quicksight_analysis
+
+Resource for managing a QuickSight Analysis.
+
+## Example Usage
+
+### From Source Template
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.quicksight_analysis import QuicksightAnalysis
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        QuicksightAnalysis(self, "example",
+            analysis_id="example-id",
+            name="example-name",
+            source_entity=QuicksightAnalysisSourceEntity(
+                source_template=QuicksightAnalysisSourceEntitySourceTemplate(
+                    arn=source.arn,
+                    data_set_references=[QuicksightAnalysisSourceEntitySourceTemplateDataSetReferences(
+                        data_set_arn=dataset.arn,
+                        data_set_placeholder="1"
+                    )
+                    ]
+                )
+            )
+        )
+```
+
+### With Definition
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.quicksight_analysis import QuicksightAnalysis
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        QuicksightAnalysis(self, "example",
+            analysis_id="example-id",
+            definition={
+                "data_set_identifiers_declarations": [{
+                    "data_set_arn": dataset.arn,
+                    "identifier": "1"
+                }
+                ],
+                "sheets": [{
+                    "sheet_id": "Example1",
+                    "title": "Example",
+                    "visuals": [{
+                        "line_chart_visual": {
+                            "chart_configuration": {
+                                "field_wells": {
+                                    "line_chart_aggregated_field_wells": {
+                                        "category": [{
+                                            "categorical_dimension_field": {
+                                                "column": {
+                                                    "column_name": "Column1",
+                                                    "data_set_identifier": "1"
+                                                },
+                                                "field_id": "1"
+                                            }
+                                        }
+                                        ],
+                                        "values": [{
+                                            "categorical_measure_field": {
+                                                "aggregation_function": "COUNT",
+                                                "column": {
+                                                    "column_name": "Column1",
+                                                    "data_set_identifier": "1"
+                                                },
+                                                "field_id": "2"
+                                            }
+                                        }
+                                        ]
+                                    }
+                                }
+                            },
+                            "title": {
+                                "format_text": {
+                                    "plain_text": "Line Chart Example"
+                                }
+                            },
+                            "visual_id": "LineChart"
+                        }
+                    }
+                    ]
+                }
+                ]
+            },
+            name="example-name"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `analysis_id` - (Required, Forces new resource) Identifier for the analysis.
+* `name` - (Required) Display name for the analysis.
+
+The following arguments are optional:
+
+* `aws_account_id` - (Optional, Forces new resource) AWS account ID.
+* `definition` - (Optional) A detailed analysis definition. Only one of `definition` or `source_entity` should be configured. See [definition](#definition).
+* `parameters` - (Optional) The parameters for the creation of the analysis, which you want to use to override the default settings. An analysis can have any type of parameters, and some parameters might accept multiple values. See [parameters](#parameters).
+* `permissions` - (Optional) A set of resource permissions on the analysis. Maximum of 64 items. See [permissions](#permissions).
+* `recovery_window_in_days` - (Optional) A value that specifies the number of days that Amazon QuickSight waits before it deletes the analysis. Use `0` to force deletion without recovery. Minimum value of `7`. Maximum value of `30`. Default to `30`.
+* `source_entity` - (Optional) The entity that you are using as a source when you create the analysis (template). Only one of `definition` or `source_entity` should be configured. See [source_entity](#source_entity).
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `theme_arn` - (Optional) The Amazon Resource Name (ARN) of the theme that is being used for this analysis. The theme ARN must exist in the same AWS account where you create the analysis.
+
+### permissions
+
+* `actions` - (Required) List of IAM actions to grant or revoke permissions on.
+* `principal` - (Required) ARN of the principal. See the [ResourcePermission documentation](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_ResourcePermission.html) for the applicable ARN values.
+
+### source_entity
+
+* `source_template` - (Optional) The source template. See [source_template](#source_template).
+
+### source_template
+
+* `arn` - (Required) The Amazon Resource Name (ARN) of the resource.
+* `data_set_references` - (Required) List of dataset references. See [data_set_references](#data_set_references).
+
+### data_set_references
+
+* `data_set_arn` - (Required) Dataset Amazon Resource Name (ARN).
+* `data_set_placeholder` - (Required) Dataset placeholder.
+
+### parameters
+
+* `date_time_parameters` - (Optional) A list of parameters that have a data type of date-time. See [AWS API Documentation for complete description](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DateTimeParameter.html).
+* `decimal_parameters` - (Optional) A list of parameters that have a data type of decimal. See [AWS API Documentation for complete description](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DecimalParameter.html).
+* `integer_parameters` - (Optional) A list of parameters that have a data type of integer. See [AWS API Documentation for complete description](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_IntegerParameter.html).
+* `string_parameters` - (Optional) A list of parameters that have a data type of string. See [AWS API Documentation for complete description](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_StringParameter.html).
+
+### definition
+
+* `data_set_identifiers_declarations` - (Required) A list dataset identifier declarations. With this mapping,you can use dataset identifiers instead of dataset Amazon Resource Names (ARNs) throughout the analysis sub-structures. See [AWS API Documentation for complete description](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DataSetIdentifierDeclaration.html).
+* `analysis_defaults` - (Optional) The configuration for default analysis settings. See [AWS API Documentation for complete description](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_AnalysisDefaults.html).
+* `calculated_fields` - (Optional) A list of calculated field definitions for the analysis. See [AWS API Documentation for complete description](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_CalculatedField.html).
+* `column_configurations` - (Optional) A list of analysis-level column configurations. Column configurations are used to set default formatting for a column that's used throughout an analysis. See [AWS API Documentation for complete description](ttps://docs.aws.amazon.com/quicksight/latest/APIReference/API_ColumnConfiguration.html).
+* `filter_groups` - (Optional) A list of filter definitions for an analysis. See [AWS API Documentation for complete description](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_FilterGroup.html). For more information, see [Filtering Data](https://docs.aws.amazon.com/quicksight/latest/user/filtering-visual-data.html) in Amazon QuickSight User Guide.
+* `parameters_declarations` - (Optional) A list of parameter declarations for an analysis. Parameters are named variables that can transfer a value for use by an action or an object. See [AWS API Documentation for complete description](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_ParameterDeclaration.html). For more information, see [Parameters in Amazon QuickSight](https://docs.aws.amazon.com/quicksight/latest/user/parameters-in-quicksight.html) in the Amazon QuickSight User Guide.
+* `sheets` - (Optional) A list of sheet definitions for an analysis. See [AWS API Documentation for complete description](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_SheetDefinition.html).
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the analysis.
+* `created_time` - The time that the analysis was created.
+* `id` - A comma-delimited string joining AWS account ID and analysis ID.
+* `last_updated_time` - The time that the analysis was last updated.
+* `status` - The analysis creation status.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `5m`)
+* `update` - (Default `5m`)
+* `delete` - (Default `5m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import a QuickSight Analysis using the AWS account ID and analysis ID separated by a comma (`,`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import a QuickSight Analysis using the AWS account ID and analysis ID separated by a comma (`,`). For example:
+
+```console
+% terraform import aws_quicksight_analysis.example 123456789012,example-id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-da63973c1a54eccd64c52cb6d2329e99e5d72cb15c08eeb0242091234a75ffbf -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/quicksight_dashboard.html.markdown b/website/docs/cdktf/python/r/quicksight_dashboard.html.markdown
new file mode 100644
index 00000000000..80250c8b03c
--- /dev/null
+++ b/website/docs/cdktf/python/r/quicksight_dashboard.html.markdown
@@ -0,0 +1,267 @@
+---
+subcategory: "QuickSight"
+layout: "aws"
+page_title: "AWS: aws_quicksight_dashboard"
+description: |-
+  Manages a QuickSight Dashboard.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_quicksight_dashboard
+
+Resource for managing a QuickSight Dashboard.
+
+## Example Usage
+
+### From Source Template
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.quicksight_dashboard import QuicksightDashboard
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        QuicksightDashboard(self, "example",
+            dashboard_id="example-id",
+            name="example-name",
+            source_entity=QuicksightDashboardSourceEntity(
+                source_template=QuicksightDashboardSourceEntitySourceTemplate(
+                    arn=source.arn,
+                    data_set_references=[QuicksightDashboardSourceEntitySourceTemplateDataSetReferences(
+                        data_set_arn=dataset.arn,
+                        data_set_placeholder="1"
+                    )
+                    ]
+                )
+            ),
+            version_description="version"
+        )
+```
+
+### With Definition
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.quicksight_dashboard import QuicksightDashboard
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        QuicksightDashboard(self, "example",
+            dashboard_id="example-id",
+            definition={
+                "data_set_identifiers_declarations": [{
+                    "data_set_arn": dataset.arn,
+                    "identifier": "1"
+                }
+                ],
+                "sheets": [{
+                    "sheet_id": "Example1",
+                    "title": "Example",
+                    "visuals": [{
+                        "line_chart_visual": {
+                            "chart_configuration": {
+                                "field_wells": {
+                                    "line_chart_aggregated_field_wells": {
+                                        "category": [{
+                                            "categorical_dimension_field": {
+                                                "column": {
+                                                    "column_name": "Column1",
+                                                    "data_set_identifier": "1"
+                                                },
+                                                "field_id": "1"
+                                            }
+                                        }
+                                        ],
+                                        "values": [{
+                                            "categorical_measure_field": {
+                                                "aggregation_function": "COUNT",
+                                                "column": {
+                                                    "column_name": "Column1",
+                                                    "data_set_identifier": "1"
+                                                },
+                                                "field_id": "2"
+                                            }
+                                        }
+                                        ]
+                                    }
+                                }
+                            },
+                            "title": {
+                                "format_text": {
+                                    "plain_text": "Line Chart Example"
+                                }
+                            },
+                            "visual_id": "LineChart"
+                        }
+                    }
+                    ]
+                }
+                ]
+            },
+            name="example-name",
+            version_description="version"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `dashboard_id` - (Required, Forces new resource) Identifier for the dashboard.
+* `name` - (Required) Display name for the dashboard.
+* `version_description` - (Required) A description of the current dashboard version being created/updated.
+
+The following arguments are optional:
+
+* `aws_account_id` - (Optional, Forces new resource) AWS account ID.
+* `dashboard_publish_options` - (Optional) Options for publishing the dashboard. See [dashboard_publish_options](#dashboard_publish_options).
+* `definition` - (Optional) A detailed dashboard definition. Only one of `definition` or `source_entity` should be configured. See [definition](#definition).
+* `parameters` - (Optional) The parameters for the creation of the dashboard, which you want to use to override the default settings. A dashboard can have any type of parameters, and some parameters might accept multiple values. See [parameters](#parameters).
+* `permissions` - (Optional) A set of resource permissions on the dashboard. Maximum of 64 items. See [permissions](#permissions).
+* `source_entity` - (Optional) The entity that you are using as a source when you create the dashboard (template). Only one of `definition` or `source_entity` should be configured. See [source_entity](#source_entity).
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `theme_arn` - (Optional) The Amazon Resource Name (ARN) of the theme that is being used for this dashboard. The theme ARN must exist in the same AWS account where you create the dashboard.
+
+### permissions
+
+* `actions` - (Required) List of IAM actions to grant or revoke permissions on.
+* `principal` - (Required) ARN of the principal. See the [ResourcePermission documentation](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_ResourcePermission.html) for the applicable ARN values.
+
+### source_entity
+
+* `source_template` - (Optional) The source template. See [source_template](#source_template).
+
+### source_template
+
+* `arn` - (Required) The Amazon Resource Name (ARN) of the resource.
+* `data_set_references` - (Required) List of dataset references. See [data_set_references](#data_set_references).
+
+### data_set_references
+
+* `data_set_arn` - (Required) Dataset Amazon Resource Name (ARN).
+* `data_set_placeholder` - (Required) Dataset placeholder.
+
+### dashboard_publish_options
+
+* `ad_hoc_filtering_option` - (Optional) Ad hoc (one-time) filtering option. See [ad_hoc_filtering_option](#ad_hoc_filtering_option).
+* `data_point_drill_up_down_option` - (Optional) The drill-down options of data points in a dashboard. See [data_point_drill_up_down_option](#data_point_drill_up_down_option).
+* `data_point_menu_label_option` - (Optional) The data point menu label options of a dashboard. See [data_point_menu_label_option](#data_point_menu_label_option).
+* `data_point_tooltip_option` - (Optional) The data point tool tip options of a dashboard. See [data_point_tooltip_option](#data_point_tooltip_option).
+* `export_to_csv_option` - (Optional) Export to .csv option. See [export_to_csv_option](#export_to_csv_option).
+* `export_with_hidden_fields_option` - (Optional) Determines if hidden fields are exported with a dashboard. See [export_with_hidden_fields_option](#export_with_hidden_fields_option).
+* `sheet_controls_option` - (Optional) Sheet controls option. See [sheet_controls_option](#sheet_controls_option).
+* `sheet_layout_element_maximization_option` - (Optional) The sheet layout maximization options of a dashboard. See [sheet_layout_element_maximization_option](#sheet_layout_element_maximization_option).
+* `visual_axis_sort_option` - (Optional) The axis sort options of a dashboard. See [visual_axis_sort_option](#visual_axis_sort_option).
+* `visual_menu_option` - (Optional) The menu options of a visual in a dashboard. See [visual_menu_option](#visual_menu_option).
+
+### ad_hoc_filtering_option
+
+* `availability_status` - (Optional) Availability status. Possibles values: ENABLED, DISABLED.
+
+### data_point_drill_up_down_option
+
+* `availability_status` - (Optional) Availability status. Possibles values: ENABLED, DISABLED.
+
+### data_point_menu_label_option
+
+* `availability_status` - (Optional) Availability status. Possibles values: ENABLED, DISABLED.
+
+### data_point_tooltip_option
+
+* `availability_status` - (Optional) Availability status. Possibles values: ENABLED, DISABLED.
+
+### export_to_csv_option
+
+* `availability_status` - (Optional) Availability status. Possibles values: ENABLED, DISABLED.
+
+### export_with_hidden_fields_option
+
+* `availability_status` - (Optional) Availability status. Possibles values: ENABLED, DISABLED.
+
+### sheet_controls_option
+
+* `visibility_state` - (Optional) Visibility state. Possibles values: EXPANDED, COLLAPSED.
+
+### sheet_layout_element_maximization_option
+
+* `availability_status` - (Optional) Availability status. Possibles values: ENABLED, DISABLED.
+
+### visual_axis_sort_option
+
+* `availability_status` - (Optional) Availability status. Possibles values: ENABLED, DISABLED.
+
+### visual_menu_option
+
+* `availability_status` - (Optional) Availability status. Possibles values: ENABLED, DISABLED.
+
+### parameters
+
+* `date_time_parameters` - (Optional) A list of parameters that have a data type of date-time. See [AWS API Documentation for complete description](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DateTimeParameter.html).
+* `decimal_parameters` - (Optional) A list of parameters that have a data type of decimal. See [AWS API Documentation for complete description](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DecimalParameter.html).
+* `integer_parameters` - (Optional) A list of parameters that have a data type of integer. See [AWS API Documentation for complete description](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_IntegerParameter.html).
+* `string_parameters` - (Optional) A list of parameters that have a data type of string. See [AWS API Documentation for complete description](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_StringParameter.html).
+
+### definition
+
+* `data_set_identifiers_declarations` - (Required) A list dataset identifier declarations. With this mapping,you can use dataset identifiers instead of dataset Amazon Resource Names (ARNs) throughout the dashboard's sub-structures. See [AWS API Documentation for complete description](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DataSetIdentifierDeclaration.html).
+* `analysis_defaults` - (Optional) The configuration for default analysis settings. See [AWS API Documentation for complete description](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_AnalysisDefaults.html).
+* `calculated_fields` - (Optional) A list of calculated field definitions for the dashboard. See [AWS API Documentation for complete description](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_CalculatedField.html).
+* `column_configurations` - (Optional) A list of dashboard-level column configurations. Column configurations are used to set default formatting for a column that's used throughout a dashboard. See [AWS API Documentation for complete description](ttps://docs.aws.amazon.com/quicksight/latest/APIReference/API_ColumnConfiguration.html).
+* `filter_groups` - (Optional) A list of filter definitions for a dashboard. See [AWS API Documentation for complete description](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_FilterGroup.html). For more information, see [Filtering Data](https://docs.aws.amazon.com/quicksight/latest/user/filtering-visual-data.html) in Amazon QuickSight User Guide.
+* `parameters_declarations` - (Optional) A list of parameter declarations for a dashboard. Parameters are named variables that can transfer a value for use by an action or an object. See [AWS API Documentation for complete description](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_ParameterDeclaration.html). For more information, see [Parameters in Amazon QuickSight](https://docs.aws.amazon.com/quicksight/latest/user/parameters-in-quicksight.html) in the Amazon QuickSight User Guide.
+* `sheets` - (Optional) A list of sheet definitions for a dashboard. See [AWS API Documentation for complete description](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_SheetDefinition.html).
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the dashboard.
+* `created_time` - The time that the dashboard was created.
+* `id` - A comma-delimited string joining AWS account ID and dashboard ID.
+* `last_updated_time` - The time that the dashboard was last updated.
+* `source_entity_arn` - Amazon Resource Name (ARN) of a template that was used to create this dashboard.
+* `status` - The dashboard creation status.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block).
+* `version_number` - The version number of the dashboard version.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `5m`)
+* `update` - (Default `5m`)
+* `delete` - (Default `5m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import a QuickSight Dashboard using the AWS account ID and dashboard ID separated by a comma (`,`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import a QuickSight Dashboard using the AWS account ID and dashboard ID separated by a comma (`,`). For example:
+
+```console
+% terraform import aws_quicksight_dashboard.example 123456789012,example-id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-9f686a697583cc68bcdda01d77c43a8c130a26f2d273f19d6b15acb81c7b6b53 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/quicksight_data_set.html.markdown b/website/docs/cdktf/python/r/quicksight_data_set.html.markdown
new file mode 100644
index 00000000000..e8f08f39283
--- /dev/null
+++ b/website/docs/cdktf/python/r/quicksight_data_set.html.markdown
@@ -0,0 +1,479 @@
+---
+subcategory: "QuickSight"
+layout: "aws"
+page_title: "AWS: aws_quicksight_data_set"
+description: |-
+  Manages a Resource QuickSight Data Set.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_quicksight_data_set
+
+Resource for managing a QuickSight Data Set.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.quicksight_data_set import QuicksightDataSet
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        QuicksightDataSet(self, "example",
+            data_set_id="example-id",
+            import_mode="SPICE",
+            name="example-name",
+            physical_table_map=[QuicksightDataSetPhysicalTableMap(
+                physical_table_map_id="example-id",
+                s3_source=QuicksightDataSetPhysicalTableMapS3Source(
+                    data_source_arn=Token.as_string(aws_quicksight_data_source_example.arn),
+                    input_columns=[QuicksightDataSetPhysicalTableMapS3SourceInputColumns(
+                        name="Column1",
+                        type="STRING"
+                    )
+                    ],
+                    upload_settings=QuicksightDataSetPhysicalTableMapS3SourceUploadSettings(
+                        format="JSON"
+                    )
+                )
+            )
+            ]
+        )
+```
+
+### With Column Level Permission Rules
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.quicksight_data_set import QuicksightDataSet
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        QuicksightDataSet(self, "example",
+            column_level_permission_rules=[QuicksightDataSetColumnLevelPermissionRules(
+                column_names=["Column1"],
+                principals=[Token.as_string(aws_quicksight_user_example.arn)]
+            )
+            ],
+            data_set_id="example-id",
+            import_mode="SPICE",
+            name="example-name",
+            physical_table_map=[QuicksightDataSetPhysicalTableMap(
+                physical_table_map_id="example-id",
+                s3_source=QuicksightDataSetPhysicalTableMapS3Source(
+                    data_source_arn=Token.as_string(aws_quicksight_data_source_example.arn),
+                    input_columns=[QuicksightDataSetPhysicalTableMapS3SourceInputColumns(
+                        name="Column1",
+                        type="STRING"
+                    )
+                    ],
+                    upload_settings=QuicksightDataSetPhysicalTableMapS3SourceUploadSettings(
+                        format="JSON"
+                    )
+                )
+            )
+            ]
+        )
+```
+
+### With Field Folders
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.quicksight_data_set import QuicksightDataSet
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        QuicksightDataSet(self, "example",
+            data_set_id="example-id",
+            field_folders=[QuicksightDataSetFieldFolders(
+                columns=["Column1"],
+                description="example description",
+                field_folders_id="example-id"
+            )
+            ],
+            import_mode="SPICE",
+            name="example-name",
+            physical_table_map=[QuicksightDataSetPhysicalTableMap(
+                physical_table_map_id="example-id",
+                s3_source=QuicksightDataSetPhysicalTableMapS3Source(
+                    data_source_arn=Token.as_string(aws_quicksight_data_source_example.arn),
+                    input_columns=[QuicksightDataSetPhysicalTableMapS3SourceInputColumns(
+                        name="Column1",
+                        type="STRING"
+                    )
+                    ],
+                    upload_settings=QuicksightDataSetPhysicalTableMapS3SourceUploadSettings(
+                        format="JSON"
+                    )
+                )
+            )
+            ]
+        )
+```
+
+### With Permissions
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.quicksight_data_set import QuicksightDataSet
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        QuicksightDataSet(self, "example",
+            data_set_id="example-id",
+            import_mode="SPICE",
+            name="example-name",
+            permissions=[QuicksightDataSetPermissions(
+                actions=["quicksight:DescribeDataSet", "quicksight:DescribeDataSetPermissions", "quicksight:PassDataSet", "quicksight:DescribeIngestion", "quicksight:ListIngestions"
+                ],
+                principal=Token.as_string(aws_quicksight_user_example.arn)
+            )
+            ],
+            physical_table_map=[QuicksightDataSetPhysicalTableMap(
+                physical_table_map_id="example-id",
+                s3_source=QuicksightDataSetPhysicalTableMapS3Source(
+                    data_source_arn=Token.as_string(aws_quicksight_data_source_example.arn),
+                    input_columns=[QuicksightDataSetPhysicalTableMapS3SourceInputColumns(
+                        name="Column1",
+                        type="STRING"
+                    )
+                    ],
+                    upload_settings=QuicksightDataSetPhysicalTableMapS3SourceUploadSettings(
+                        format="JSON"
+                    )
+                )
+            )
+            ]
+        )
+```
+
+### With Row Level Permission Tag Configuration
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.quicksight_data_set import QuicksightDataSet
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        QuicksightDataSet(self, "example",
+            data_set_id="example-id",
+            import_mode="SPICE",
+            name="example-name",
+            physical_table_map=[QuicksightDataSetPhysicalTableMap(
+                physical_table_map_id="example-id",
+                s3_source=QuicksightDataSetPhysicalTableMapS3Source(
+                    data_source_arn=Token.as_string(aws_quicksight_data_source_example.arn),
+                    input_columns=[QuicksightDataSetPhysicalTableMapS3SourceInputColumns(
+                        name="Column1",
+                        type="STRING"
+                    )
+                    ],
+                    upload_settings=QuicksightDataSetPhysicalTableMapS3SourceUploadSettings(
+                        format="JSON"
+                    )
+                )
+            )
+            ],
+            row_level_permission_tag_configuration=QuicksightDataSetRowLevelPermissionTagConfiguration(
+                status="ENABLED",
+                tag_rules=[QuicksightDataSetRowLevelPermissionTagConfigurationTagRules(
+                    column_name="Column1",
+                    match_all_value="*",
+                    tag_key="tagkey",
+                    tag_multi_value_delimiter=","
+                )
+                ]
+            )
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `data_set_id` - (Required, Forces new resource) Identifier for the data set.
+* `import_mode` - (Required) Indicates whether you want to import the data into SPICE. Valid values are `SPICE` and `DIRECT_QUERY`.
+* `name` - (Required) Display name for the dataset.
+* `physical_table_map` - (Required) Declares the physical tables that are available in the underlying data sources. See [physical_table_map](#physical_table_map).
+
+The following arguments are optional:
+
+* `aws_account_id` - (Optional, Forces new resource) AWS account ID.
+* `column_groups` - (Optional) Groupings of columns that work together in certain Amazon QuickSight features. Currently, only geospatial hierarchy is supported. See [column_groups](#column_groups).
+* `column_level_permission_rules` - (Optional) A set of 1 or more definitions of a [ColumnLevelPermissionRule](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_ColumnLevelPermissionRule.html). See [column_level_permission_rules](#column_level_permission_rules).
+* `data_set_usage_configuration` - (Optional) The usage configuration to apply to child datasets that reference this dataset as a source. See [data_set_usage_configuration](#data_set_usage_configuration).
+* `field_folders` - (Optional) The folder that contains fields and nested subfolders for your dataset. See [field_folders](#field_folders).
+* `logical_table_map` - (Optional) Configures the combination and transformation of the data from the physical tables. Maximum of 1 entry. See [logical_table_map](#logical_table_map).
+* `permissions` - (Optional) A set of resource permissions on the data source. Maximum of 64 items. See [permissions](#permissions).
+* `row_level_permission_data_set` - (Optional) The row-level security configuration for the data that you want to create. See [row_level_permission_data_set](#row_level_permission_data_set).
+* `row_level_permission_tag_configuration` - (Optional) The configuration of tags on a dataset to set row-level security. Row-level security tags are currently supported for anonymous embedding only. See [row_level_permission_tag_configuration](#row_level_permission_tag_configuration).
+* `refresh_properties` - (Optional) The refresh properties for the data set. **NOTE**: Only valid when `import_mode` is set to `SPICE`. See [refresh_properties](#refresh_properties).
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### physical_table_map
+
+For a `physical_table_map` item to be valid, only one of `custom_sql`, `relational_table`, or `s3_source` should be configured.
+
+* `physical_table_map_id` - (Required) Key of the physical table map.
+* `custom_sql` - (Optional) A physical table type built from the results of the custom SQL query. See [custom_sql](#custom_sql).
+* `relational_table` - (Optional) A physical table type for relational data sources. See [relational_table](#relational_table).
+* `s3_source` - (Optional) A physical table type for as S3 data source. See [s3_source](#s3_source).
+
+### custom_sql
+
+* `data_source_arn` - (Required) ARN of the data source.
+* `name` - (Required) Display name for the SQL query result.
+* `sql_query` - (Required) SQL query.
+* `columns` - (Optional) Column schema from the SQL query result set. See [columns](#columns).
+
+### columns
+
+* `name` - (Required) Name of this column in the underlying data source.
+* `type` - (Required) Data type of the column.
+
+### relational_table
+
+* `data_source_arn` - (Required) ARN of the data source.
+* `input_columns` - (Required) Column schema of the table. See [input_columns](#input_columns).
+* `name` - (Required) Name of the relational table.
+* `catalog` - (Optional) Catalog associated with the table.
+* `schema` - (Optional) Schema name. This name applies to certain relational database engines.
+
+### input_columns
+
+* `name` - (Required) Name of this column in the underlying data source.
+* `type` - (Required) Data type of the column.
+
+### s3_source
+
+* `data_source_arn` - (Required) ARN of the data source.
+* `input_columns` - (Required) Column schema of the table. See [input_columns](#input_columns).
+* `upload_settings` - (Required) Information about the format for the S3 source file or files. See [upload_settings](#upload_settings).
+
+### upload_settings
+
+* `contains_header` - (Optional) Whether the file has a header row, or the files each have a header row.
+* `delimiter` - (Optional) Delimiter between values in the file.
+* `format` - (Optional) File format. Valid values are `CSV`, `TSV`, `CLF`, `ELF`, `XLSX`, and `JSON`.
+* `start_from_row` - (Optional) A row number to start reading data from.
+* `text_qualifier` - (Optional) Text qualifier. Valid values are `DOUBLE_QUOTE` and `SINGLE_QUOTE`.
+
+### column_groups
+
+* `geo_spatial_column_group` - (Optional) Geospatial column group that denotes a hierarchy. See [geo_spatial_column_group](#geo_spatial_column_group).
+
+### geo_spatial_column_group
+
+* `columns` - (Required) Columns in this hierarchy.
+* `country_code` - (Required) Country code. Valid values are `US`.
+* `name` - (Required) A display name for the hierarchy.
+
+### column_level_permission_rules
+
+* `column_names` - (Optional) An array of column names.
+* `principals` - (Optional) An array of ARNs for Amazon QuickSight users or groups.
+
+### data_set_usage_configuration
+
+* `disable_use_as_direct_query_source` - (Optional) Controls whether a child dataset of a direct query can use this dataset as a source.
+* `disable_use_as_imported_source` - (Optional) Controls whether a child dataset that's stored in QuickSight can use this dataset as a source.
+
+### field_folders
+
+* `field_folders_id` - (Required) Key of the field folder map.
+* `columns` - (Optional) An array of column names to add to the folder. A column can only be in one folder.
+* `description` - (Optional) Field folder description.
+
+### logical_table_map
+
+* `alias` - (Required) A display name for the logical table.
+* `logical_table_map_id` - (Required) Key of the logical table map.
+* `data_transforms` - (Optional) Transform operations that act on this logical table. For this structure to be valid, only one of the attributes can be non-null. See [data_transforms](#data_transforms).
+* `source` - (Optional) Source of this logical table. See [source](#source).
+
+### data_transforms
+
+* `cast_column_type_operation` - (Optional) A transform operation that casts a column to a different type. See [cast_column_type_operation](#cast_column_type_operation).
+* `create_columns_operation` - (Optional) An operation that creates calculated columns. Columns created in one such operation form a lexical closure. See [create_columns_operation](#create_columns_operation).
+* `filter_operation` - (Optional) An operation that filters rows based on some condition. See [filter_operation](#filter_operation).
+* `project_operation` - (Optional) An operation that projects columns. Operations that come after a projection can only refer to projected columns. See [project_operation](#project_operation).
+* `rename_column_operation` - (Optional) An operation that renames a column. See [rename_column_operation](#rename_column_operation).
+* `tag_column_operation` - (Optional) An operation that tags a column with additional information. See [tag_column_operation](#tag_column_operation).
+* `untag_column_operation` - (Optional) A transform operation that removes tags associated with a column. See [untag_column_operation](#untag_column_operation).
+
+### cast_column_type_operation
+
+* `column_name` - (Required) Column name.
+* `new_column_type` - (Required) New column data type. Valid values are `STRING`, `INTEGER`, `DECIMAL`, `DATETIME`.
+* `format` - (Optional) When casting a column from string to datetime type, you can supply a string in a format supported by Amazon QuickSight to denote the source data format.
+
+### create_columns_operation
+
+* `columns` - (Required) Calculated columns to create. See [columns](#columns-1).
+
+### columns
+
+* `column_id` - (Required) A unique ID to identify a calculated column. During a dataset update, if the column ID of a calculated column matches that of an existing calculated column, Amazon QuickSight preserves the existing calculated column.
+* `column_name` - (Required) Column name.
+* `expression` - (Required) An expression that defines the calculated column.
+
+### filter_operation
+
+* `condition_expression` - (Required) An expression that must evaluate to a Boolean value. Rows for which the expression evaluates to true are kept in the dataset.
+
+### project_operation
+
+* `projected_columns` - (Required) Projected columns.
+
+### rename_column_operation
+
+* `column_name` - (Required) Column to be renamed.
+* `new_column_name` - (Required) New name for the column.
+
+### tag_column_operation
+
+* `column_name` - (Required) Column name.
+* `tags` - (Required) The dataset column tag, currently only used for geospatial type tagging. See [tags](#tags).
+
+### tags
+
+* `column_description` - (Optional) A description for a column. See [column_description](#column_description).
+* `column_geographic_role` - (Optional) A geospatial role for a column. Valid values are `COUNTRY`, `STATE`, `COUNTY`, `CITY`, `POSTCODE`, `LONGITUDE`, and `LATITUDE`.
+
+### column_description
+
+* `text` - (Optional) The text of a description for a column.
+
+### untag_column_operation
+
+* `column_name` - (Required) Column name.
+* `tag_names` - (Required) The column tags to remove from this column.
+
+### source
+
+* `data_set_arn` - (Optional) ARN of the parent data set.
+* `join_instruction` - (Optional) Specifies the result of a join of two logical tables. See [join_instruction](#join_instruction).
+* `physical_table_id` - (Optional) Physical table ID.
+
+### join_instruction
+
+* `left_operand` - (Required) Operand on the left side of a join.
+* `on_clause` - (Required) Join instructions provided in the ON clause of a join.
+* `right_operand` - (Required) Operand on the right side of a join.
+* `type` - (Required) Type of join. Valid values are `INNER`, `OUTER`, `LEFT`, and `RIGHT`.
+* `left_join_key_properties` - (Optional) Join key properties of the left operand. See [left_join_key_properties](#left_join_key_properties).
+* `right_join_key_properties` - (Optional) Join key properties of the right operand. See [right_join_key_properties](#right_join_key_properties).
+
+### left_join_key_properties
+
+* `unique_key` - (Optional) A value that indicates that a row in a table is uniquely identified by the columns in a join key. This is used by Amazon QuickSight to optimize query performance.
+
+### right_join_key_properties
+
+* `unique_key` - (Optional) A value that indicates that a row in a table is uniquely identified by the columns in a join key. This is used by Amazon QuickSight to optimize query performance.
+
+### permissions
+
+* `actions` - (Required) List of IAM actions to grant or revoke permissions on.
+* `principal` - (Required) ARN of the principal. See the [ResourcePermission documentation](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_ResourcePermission.html) for the applicable ARN values.
+
+### row_level_permission_data_set
+
+* `arn` - (Required) ARN of the dataset that contains permissions for RLS.
+* `permission_policy` - (Required) Type of permissions to use when interpreting the permissions for RLS. Valid values are `GRANT_ACCESS` and `DENY_ACCESS`.
+* `format_version` - (Optional) User or group rules associated with the dataset that contains permissions for RLS.
+* `namespace` - (Optional) Namespace associated with the dataset that contains permissions for RLS.
+* `status` - (Optional) Status of the row-level security permission dataset. If enabled, the status is `ENABLED`. If disabled, the status is `DISABLED`.
+
+### row_level_permission_tag_configuration
+
+* `tag_rules` - (Required) A set of rules associated with row-level security, such as the tag names and columns that they are assigned to. See [tag_rules](#tag_rules).
+* `status` - (Optional) The status of row-level security tags. If enabled, the status is `ENABLED`. If disabled, the status is `DISABLED`.
+
+### refresh_properties
+
+* `refresh_configuration` - (Required) The refresh configuration for the data set. See [refresh_configuration](#refresh_configuration).
+
+### refresh_configuration
+
+* `incremental_refresh` - (Required) The incremental refresh for the data set. See [incremental_refresh](#incremental_refresh).
+
+### incremental_refresh
+
+* `lookback_window` - (Required) The lookback window setup for an incremental refresh configuration. See [lookback_window](#lookback_window).
+
+### lookback_window
+
+* `column_name` - (Required) The name of the lookback window column.
+* `size` - (Required) The lookback window column size.
+* `size_unit` - (Required) The size unit that is used for the lookback window column. Valid values for this structure are `HOUR`, `DAY`, and `WEEK`.
+
+### tag_rules
+
+* `column_name` - (Required) Column name that a tag key is assigned to.
+* `tag_key` - (Required) Unique key for a tag.
+* `match_all_value` - (Optional) A string that you want to use to filter by all the values in a column in the dataset and don’t want to list the values one by one.
+* `tag_multi_value_delimiter` - (Optional) A string that you want to use to delimit the values when you pass the values at run time.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the data set.
+* `id` - A comma-delimited string joining AWS account ID and data set ID.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import a QuickSight Data Set using the AWS account ID and data set ID separated by a comma (`,`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import a QuickSight Data Set using the AWS account ID and data set ID separated by a comma (`,`). For example:
+
+```console
+% terraform import aws_quicksight_data_set.example 123456789012,example-id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1a8603f1407762c148dd6779a52ba1f5c1ee5c07434a0e03886d6f8b8bec1425 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/quicksight_data_source.html.markdown b/website/docs/cdktf/python/r/quicksight_data_source.html.markdown
new file mode 100644
index 00000000000..93950f83103
--- /dev/null
+++ b/website/docs/cdktf/python/r/quicksight_data_source.html.markdown
@@ -0,0 +1,248 @@
+---
+subcategory: "QuickSight"
+layout: "aws"
+page_title: "AWS: aws_quicksight_data_source"
+description: |-
+  Manages a Resource QuickSight Data Source.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_quicksight_data_source
+
+Resource for managing QuickSight Data Source
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.quicksight_data_source import QuicksightDataSource
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        QuicksightDataSource(self, "default",
+            data_source_id="example-id",
+            name="My Cool Data in S3",
+            parameters=QuicksightDataSourceParameters(
+                s3=QuicksightDataSourceParametersS3(
+                    manifest_file_location=QuicksightDataSourceParametersS3ManifestFileLocation(
+                        bucket="my-bucket",
+                        key="path/to/manifest.json"
+                    )
+                )
+            ),
+            type="S3"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `data_source_id` - (Required, Forces new resource) An identifier for the data source.
+* `name` - (Required) A name for the data source, maximum of 128 characters.
+* `parameters` - (Required) The [parameters](#parameters-argument-reference) used to connect to this data source (exactly one).
+* `type` - (Required) The type of the data source. See the [AWS Documentation](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_CreateDataSource.html#QS-CreateDataSource-request-Type) for the complete list of valid values.
+
+The following arguments are optional:
+
+* `aws_account_id` - (Optional, Forces new resource) The ID for the AWS account that the data source is in. Currently, you use the ID for the AWS account that contains your Amazon QuickSight account.
+* `credentials` - (Optional) The credentials Amazon QuickSight uses to connect to your underlying source. Currently, only credentials based on user name and password are supported. See [Credentials](#credentials-argument-reference) below for more details.
+* `permission` - (Optional) A set of resource permissions on the data source. Maximum of 64 items. See [Permission](#permission-argument-reference) below for more details.
+* `ssl_properties` - (Optional) Secure Socket Layer (SSL) properties that apply when Amazon QuickSight connects to your underlying source. See [SSL Properties](#ssl_properties-argument-reference) below for more details.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `vpc_connection_properties`- (Optional) Use this parameter only when you want Amazon QuickSight to use a VPC connection when connecting to your underlying source. See [VPC Connection Properties](#vpc_connection_properties-argument-reference) below for more details.
+
+### credentials Argument Reference
+
+* `copy_source_arn` (Optional, Conflicts with `credential_pair`) - The Amazon Resource Name (ARN) of a data source that has the credential pair that you want to use.
+When the value is not null, the `credential_pair` from the data source in the ARN is used.
+* `credential_pair` (Optional, Conflicts with `copy_source_arn`) - Credential pair. See [Credential Pair](#credential_pair-argument-reference) below for more details.
+
+### credential_pair Argument Reference
+
+* `password` - (Required) Password, maximum length of 1024 characters.
+* `username` - (Required) User name, maximum length of 64 characters.
+
+### parameters Argument Reference
+
+To specify data source connection parameters, exactly one of the following sub-objects must be provided.
+
+* `amazon_elasticsearch` - (Optional) [Parameters](#amazon_elasticsearch-argument-reference) for connecting to Amazon Elasticsearch.
+* `athena` - (Optional) [Parameters](#athena-argument-reference) for connecting to Athena.
+* `aurora` - (Optional) [Parameters](#aurora-argument-reference) for connecting to Aurora MySQL.
+* `aurora_postgresql` - (Optional) [Parameters](#aurora_postgresql-argument-reference) for connecting to Aurora Postgresql.
+* `aws_iot_analytics` - (Optional) [Parameters](#aws_iot_analytics-argument-reference) for connecting to AWS IOT Analytics.
+* `jira` - (Optional) [Parameters](#jira-fargument-reference) for connecting to Jira.
+* `maria_db` - (Optional) [Parameters](#maria_db-argument-reference) for connecting to MariaDB.
+* `mysql` - (Optional) [Parameters](#mysql-argument-reference) for connecting to MySQL.
+* `oracle` - (Optional) [Parameters](#oracle-argument-reference) for connecting to Oracle.
+* `postgresql` - (Optional) [Parameters](#postgresql-argument-reference) for connecting to Postgresql.
+* `presto` - (Optional) [Parameters](#presto-argument-reference) for connecting to Presto.
+* `rds` - (Optional) [Parameters](#rds-argument-reference) for connecting to RDS.
+* `redshift` - (Optional) [Parameters](#redshift-argument-reference) for connecting to Redshift.
+* `s3` - (Optional) [Parameters](#s3-argument-reference) for connecting to S3.
+* `service_now` - (Optional) [Parameters](#service_now-argument-reference) for connecting to ServiceNow.
+* `snowflake` - (Optional) [Parameters](#snowflake-argument-reference) for connecting to Snowflake.
+* `spark` - (Optional) [Parameters](#spark-argument-reference) for connecting to Spark.
+* `sql_server` - (Optional) [Parameters](#sql_server-argument-reference) for connecting to SQL Server.
+* `teradata` - (Optional) [Parameters](#teradata-argument-reference) for connecting to Teradata.
+* `twitter` - (Optional) [Parameters](#twitter-argument-reference) for connecting to Twitter.
+
+### permission Argument Reference
+
+* `actions` - (Required) Set of IAM actions to grant or revoke permissions on. Max of 16 items.
+* `principal` - (Required) The Amazon Resource Name (ARN) of the principal.
+
+### ssl_properties Argument Reference
+
+* `disable_ssl` - (Required) A Boolean option to control whether SSL should be disabled.
+
+### vpc_connection_properties Argument Reference
+
+* `vpc_connection_arn` - (Required) The Amazon Resource Name (ARN) for the VPC connection.
+
+### amazon_elasticsearch Argument Reference
+
+* `domain` - (Required) The OpenSearch domain.
+
+### athena Argument Reference
+
+* `work_group` - (Optional) The work-group to which to connect.
+
+### aurora Argument Reference
+
+* `database` - (Required) The database to which to connect.
+* `host` - (Required) The host to which to connect.
+* `port` - (Required) The port to which to connect.
+
+### aurora_postgresql Argument Reference
+
+* `database` - (Required) The database to which to connect.
+* `host` - (Required) The host to which to connect.
+* `port` - (Required) The port to which to connect.
+
+### aws_iot_analytics Argument Reference
+
+* `data_set_name` - (Required) The name of the data set to which to connect.
+
+### jira fArgument Reference
+
+* `site_base_url` - (Required) The base URL of the Jira instance's site to which to connect.
+
+### maria_db Argument Reference
+
+* `database` - (Required) The database to which to connect.
+* `host` - (Required) The host to which to connect.
+* `port` - (Required) The port to which to connect.
+
+### mysql Argument Reference
+
+* `database` - (Required) The database to which to connect.
+* `host` - (Required) The host to which to connect.
+* `port` - (Required) The port to which to connect.
+
+### oracle Argument Reference
+
+* `database` - (Required) The database to which to connect.
+* `host` - (Required) The host to which to connect.
+* `port` - (Required) The port to which to connect.
+
+### postgresql Argument Reference
+
+* `database` - (Required) The database to which to connect.
+* `host` - (Required) The host to which to connect.
+* `port` - (Required) The port to which to connect.
+
+### presto Argument Reference
+
+* `catalog` - (Required) The catalog to which to connect.
+* `host` - (Required) The host to which to connect.
+* `port` - (Required) The port to which to connect.
+
+### rds Argument Reference
+
+* `database` - (Required) The database to which to connect.
+* `instance_id` - (Optional) The instance ID to which to connect.
+
+### redshift Argument Reference
+
+* `cluster_id` - (Optional, Required if `host` and `port` are not provided) The ID of the cluster to which to connect.
+* `database` - (Required) The database to which to connect.
+* `host` - (Optional, Required if `cluster_id` is not provided) The host to which to connect.
+* `port` - (Optional, Required if `cluster_id` is not provided) The port to which to connect.
+
+### s3 Argument Reference
+
+* `manifest_file_location` - (Required) An [object containing the S3 location](#manifest_file_location-argument-reference) of the S3 manifest file.
+
+### manifest_file_location Argument Reference
+
+* `bucket` - (Required) The name of the bucket that contains the manifest file.
+* `key` - (Required) The key of the manifest file within the bucket.
+
+### service_now Argument Reference
+
+* `site_base_url` - (Required) The base URL of the Jira instance's site to which to connect.
+
+### snowflake Argument Reference
+
+* `database` - (Required) The database to which to connect.
+* `host` - (Required) The host to which to connect.
+* `warehouse` - (Required) The warehouse to which to connect.
+
+### spark Argument Reference
+
+* `host` - (Required) The host to which to connect.
+* `port` - (Required) The warehouse to which to connect.
+
+### sql_server Argument Reference
+
+* `database` - (Required) The database to which to connect.
+* `host` - (Required) The host to which to connect.
+* `port` - (Required) The warehouse to which to connect.
+
+### teradata Argument Reference
+
+* `database` - (Required) The database to which to connect.
+* `host` - (Required) The host to which to connect.
+* `port` - (Required) The warehouse to which to connect.
+
+#### twitter Argument Reference
+
+* `max_rows` - (Required) The maximum number of rows to query.
+* `query` - (Required) The Twitter query to retrieve the data.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the data source
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import a QuickSight data source using the AWS account ID, and data source ID separated by a slash (`/`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import a QuickSight data source using the AWS account ID, and data source ID separated by a slash (`/`). For example:
+
+```console
+% terraform import aws_quicksight_data_source.example 123456789123/my-data-source-id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-2de42ab036dbf7d192e1e61ccf217d0b3cc58fb437a7906bb08bf538070833e7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/quicksight_folder.html.markdown b/website/docs/cdktf/python/r/quicksight_folder.html.markdown
new file mode 100644
index 00000000000..1c8614d51ba
--- /dev/null
+++ b/website/docs/cdktf/python/r/quicksight_folder.html.markdown
@@ -0,0 +1,147 @@
+---
+subcategory: "QuickSight"
+layout: "aws"
+page_title: "AWS: aws_quicksight_folder"
+description: |-
+  Manages a QuickSight Folder.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_quicksight_folder
+
+Resource for managing a QuickSight Folder.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.quicksight_folder import QuicksightFolder
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        QuicksightFolder(self, "example",
+            folder_id="example-id",
+            name="example-name"
+        )
+```
+
+### With Permissions
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.quicksight_folder import QuicksightFolder
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        QuicksightFolder(self, "example",
+            folder_id="example-id",
+            name="example-name",
+            permissions=[QuicksightFolderPermissions(
+                actions=["quicksight:CreateFolder", "quicksight:DescribeFolder", "quicksight:UpdateFolder", "quicksight:DeleteFolder", "quicksight:CreateFolderMembership", "quicksight:DeleteFolderMembership", "quicksight:DescribeFolderPermissions", "quicksight:UpdateFolderPermissions"
+                ],
+                principal=Token.as_string(aws_quicksight_user_example.arn)
+            )
+            ]
+        )
+```
+
+### With Parent Folder
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.quicksight_folder import QuicksightFolder
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        parent = QuicksightFolder(self, "parent",
+            folder_id="parent-id",
+            name="parent-name"
+        )
+        QuicksightFolder(self, "example",
+            folder_id="example-id",
+            name="example-name",
+            parent_folder_arn=parent.arn
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `folder_id` - (Required, Forces new resource) Identifier for the folder.
+* `name` - (Required) Display name for the folder.
+
+The following arguments are optional:
+
+* `aws_account_id` - (Optional, Forces new resource) AWS account ID.
+* `folder_type` - (Optional) The type of folder. By default, it is `SHARED`. Valid values are: `SHARED`.
+* `parent_folder_arn` - (Optional) The Amazon Resource Name (ARN) for the parent folder. If not set, creates a root-level folder.
+* `permissions` - (Optional) A set of resource permissions on the folder. Maximum of 64 items. See [permissions](#permissions).
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### permissions
+
+* `actions` - (Required) List of IAM actions to grant or revoke permissions on.
+* `principal` - (Required) ARN of the principal. See the [ResourcePermission documentation](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_ResourcePermission.html) for the applicable ARN values.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the folder.
+* `created_time` - The time that the folder was created.
+* `folder_path` - An array of ancestor ARN strings for the folder. Empty for root-level folders.
+* `id` - A comma-delimited string joining AWS account ID and folder ID.
+* `last_updated_time` - The time that the folder was last updated.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `5m`)
+* `read`   - (Default `5m`)
+* `update` - (Default `5m`)
+* `delete` - (Default `5m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import a QuickSight folder using the AWS account ID and folder ID name separated by a comma (`,`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import a QuickSight folder using the AWS account ID and folder ID name separated by a comma (`,`). For example:
+
+```console
+% terraform import aws_quicksight_folder.example 123456789012,example-id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-bfe67ec1b66703fe4dec29123039432b9ff61c08d31438163738103ae03db233 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/quicksight_folder_membership.html.markdown b/website/docs/cdktf/python/r/quicksight_folder_membership.html.markdown
new file mode 100644
index 00000000000..725a9d29574
--- /dev/null
+++ b/website/docs/cdktf/python/r/quicksight_folder_membership.html.markdown
@@ -0,0 +1,75 @@
+---
+subcategory: "QuickSight"
+layout: "aws"
+page_title: "AWS: aws_quicksight_folder_membership"
+description: |-
+  Terraform resource for managing an AWS QuickSight Folder Membership.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_quicksight_folder_membership
+
+Terraform resource for managing an AWS QuickSight Folder Membership.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.quicksight_folder_membership import QuicksightFolderMembership
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        QuicksightFolderMembership(self, "example",
+            folder_id=Token.as_string(aws_quicksight_folder_example.folder_id),
+            member_id=Token.as_string(aws_quicksight_data_set_example.data_set_id),
+            member_type="DATASET"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `folder_id` - (Required, Forces new resource) Identifier for the folder.
+* `member_id` - (Required, Forces new resource) ID of the asset (the dashboard, analysis, or dataset).
+* `member_type` - (Required, Forces new resource) Type of the member. Valid values are `ANALYSIS`, `DASHBOARD`, and `DATASET`.
+
+The following arguments are optional:
+
+* `aws_account_id` - (Optional, Forces new resource) AWS account ID.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - A comma-delimited string joining AWS account ID, folder ID, member type, and member ID.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import QuickSight Folder Membership using the AWS account ID, folder ID, member type, and member ID separated by commas (`,`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import QuickSight Folder Membership using the AWS account ID, folder ID, member type, and member ID separated by commas (`,`). For example:
+
+```console
+% terraform import aws_quicksight_folder_membership.example 123456789012,example-folder,DATASET,example-dataset
+```
+
+<!-- cache-key: cdktf-0.18.0 input-d86c3016c2fb02ce6bbff475bfb57b5c2ef1344603d2a5e1e68e88605800f66c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/quicksight_group.html.markdown b/website/docs/cdktf/python/r/quicksight_group.html.markdown
new file mode 100644
index 00000000000..b361d01bb10
--- /dev/null
+++ b/website/docs/cdktf/python/r/quicksight_group.html.markdown
@@ -0,0 +1,68 @@
+---
+subcategory: "QuickSight"
+layout: "aws"
+page_title: "AWS: aws_quicksight_group"
+description: |-
+  Manages a Resource QuickSight Group.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_quicksight_group
+
+Resource for managing QuickSight Group
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.quicksight_group import QuicksightGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        QuicksightGroup(self, "example",
+            group_name="tf-example"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `group_name` - (Required) A name for the group.
+* `aws_account_id` - (Optional) The ID for the AWS account that the group is in. Currently, you use the ID for the AWS account that contains your Amazon QuickSight account.
+* `description` - (Optional) A description for the group.
+* `namespace` - (Optional) The namespace. Currently, you should set this to `default`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of group
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import QuickSight Group using the aws account id, namespace and group name separated by `/`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import QuickSight Group using the aws account id, namespace and group name separated by `/`. For example:
+
+```console
+% terraform import aws_quicksight_group.example 123456789123/default/tf-example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-4b80dc7995b3a3364f054a8bfdf88c630ccdea1d94a035f1e6fe2bcf10868632 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/quicksight_group_membership.html.markdown b/website/docs/cdktf/python/r/quicksight_group_membership.html.markdown
new file mode 100644
index 00000000000..4c3ffe23470
--- /dev/null
+++ b/website/docs/cdktf/python/r/quicksight_group_membership.html.markdown
@@ -0,0 +1,67 @@
+---
+subcategory: "QuickSight"
+layout: "aws"
+page_title: "AWS: aws_quicksight_group_membership"
+description: |-
+  Manages a Resource QuickSight Group Membership.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_quicksight_group_membership
+
+Resource for managing QuickSight Group Membership
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.quicksight_group_membership import QuicksightGroupMembership
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        QuicksightGroupMembership(self, "example",
+            group_name="all-access-users",
+            member_name="john_smith"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `group_name` - (Required) The name of the group in which the member will be added.
+* `member_name` - (Required) The name of the member to add to the group.
+* `aws_account_id` - (Optional) The ID for the AWS account that the group is in. Currently, you use the ID for the AWS account that contains your Amazon QuickSight account.
+* `namespace` - (Required) The namespace that you want the user to be a part of. Defaults to `default`.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import QuickSight Group membership using the AWS account ID, namespace, group name and member name separated by `/`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import QuickSight Group membership using the AWS account ID, namespace, group name and member name separated by `/`. For example:
+
+```console
+% terraform import aws_quicksight_group_membership.example 123456789123/default/all-access-users/john_smith
+```
+
+<!-- cache-key: cdktf-0.18.0 input-725ded78aa4f9a51cf1cc232f77bcbabe71212866930b64d5720ec0459e6dc9a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/quicksight_iam_policy_assignment.html.markdown b/website/docs/cdktf/python/r/quicksight_iam_policy_assignment.html.markdown
new file mode 100644
index 00000000000..3ae452a308f
--- /dev/null
+++ b/website/docs/cdktf/python/r/quicksight_iam_policy_assignment.html.markdown
@@ -0,0 +1,87 @@
+---
+subcategory: "QuickSight"
+layout: "aws"
+page_title: "AWS: aws_quicksight_iam_policy_assignment"
+description: |-
+  Terraform resource for managing an AWS QuickSight IAM Policy Assignment.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_quicksight_iam_policy_assignment
+
+Terraform resource for managing an AWS QuickSight IAM Policy Assignment.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.quicksight_iam_policy_assignment import QuicksightIamPolicyAssignment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        QuicksightIamPolicyAssignment(self, "example",
+            assignment_name="example",
+            assignment_status="ENABLED",
+            identities=[QuicksightIamPolicyAssignmentIdentities(
+                user=[Token.as_string(aws_quicksight_user_example.user_name)]
+            )
+            ],
+            policy_arn=Token.as_string(aws_iam_policy_example.arn)
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `assignment_name` - (Required) Name of the assignment.
+* `assignment_status` - (Required) Status of the assignment. Valid values are `ENABLED`, `DISABLED`, and `DRAFT`.
+
+The following arguments are optional:
+
+* `aws_account_id` - (Optional) AWS account ID.
+* `identities` - (Optional) Amazon QuickSight users, groups, or both to assign the policy to. See [`identities`](#identities).
+* `namespace` - (Optional) Namespace that contains the assignment. Defaults to `default`.
+* `policy_arn` - (Optional) ARN of the IAM policy to apply to the Amazon QuickSight users and groups specified in this assignment.
+
+### identities
+
+* `groups` - (Optional) Array of Quicksight group names to assign the policy to.
+* `user` - (Optional) Array of Quicksight user names to assign the policy to.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `assignment_id` - Assignment ID.
+* `id` - A comma-delimited string joining AWS account ID, namespace, and assignment name.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import QuickSight IAM Policy Assignment using the AWS account ID, namespace, and assignment name separated by commas (`,`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import QuickSight IAM Policy Assignment using the AWS account ID, namespace, and assignment name separated by commas (`,`). For example:
+
+```console
+% terraform import aws_quicksight_iam_policy_assignment.example 123456789012,default,example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ef52d922a126d93b554f19d053cc37acca38aa991f703b223e6f2532c3d630d9 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/quicksight_ingestion.html.markdown b/website/docs/cdktf/python/r/quicksight_ingestion.html.markdown
new file mode 100644
index 00000000000..6372bc99ef0
--- /dev/null
+++ b/website/docs/cdktf/python/r/quicksight_ingestion.html.markdown
@@ -0,0 +1,77 @@
+---
+subcategory: "QuickSight"
+layout: "aws"
+page_title: "AWS: aws_quicksight_ingestion"
+description: |-
+  Terraform resource for managing an AWS QuickSight Ingestion.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_quicksight_ingestion
+
+Terraform resource for managing an AWS QuickSight Ingestion.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.quicksight_ingestion import QuicksightIngestion
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        QuicksightIngestion(self, "example",
+            data_set_id=Token.as_string(aws_quicksight_data_set_example.data_set_id),
+            ingestion_id="example-id",
+            ingestion_type="FULL_REFRESH"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `data_set_id` - (Required) ID of the dataset used in the ingestion.
+* `ingestion_id` - (Required) ID for the ingestion.
+* `ingestion_type` - (Required) Type of ingestion to be created. Valid values are `INCREMENTAL_REFRESH` and `FULL_REFRESH`.
+
+The following arguments are optional:
+
+* `aws_account_id` - (Optional) AWS account ID.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Ingestion.
+* `id` - A comma-delimited string joining AWS account ID, data set ID, and ingestion ID.
+* `ingestion_status` - Ingestion status.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import QuickSight Ingestion using the AWS account ID, data set ID, and ingestion ID separated by commas (`,`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import QuickSight Ingestion using the AWS account ID, data set ID, and ingestion ID separated by commas (`,`). For example:
+
+```console
+% terraform import aws_quicksight_ingestion.example 123456789012,example-dataset-id,example-ingestion-id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-31d890ca0d6ed00093cbbdafdda99150291ae49c1b91bc06892ea8eaaaf8c038 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/quicksight_namespace.html.markdown b/website/docs/cdktf/python/r/quicksight_namespace.html.markdown
new file mode 100644
index 00000000000..eda5d3f9ad9
--- /dev/null
+++ b/website/docs/cdktf/python/r/quicksight_namespace.html.markdown
@@ -0,0 +1,84 @@
+---
+subcategory: "QuickSight"
+layout: "aws"
+page_title: "AWS: aws_quicksight_namespace"
+description: |-
+  Terraform resource for managing an AWS QuickSight Namespace.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_quicksight_namespace
+
+Terraform resource for managing an AWS QuickSight Namespace.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.quicksight_namespace import QuicksightNamespace
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        QuicksightNamespace(self, "example",
+            namespace="example"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `namespace` - (Required) Name of the namespace.
+
+The following arguments are optional:
+
+* `aws_account_id` - (Optional) AWS account ID.
+* `identity_store` - (Optional) User identity directory type. Defaults to `QUICKSIGHT`, the only current valid value.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Namespace.
+* `capacity_region` - Namespace AWS Region.
+* `creation_status` - Creation status of the namespace.
+* `id` - A comma-delimited string joining AWS account ID and namespace.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `2m`)
+* `delete` - (Default `2m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import QuickSight Namespace using the AWS account ID and namespace separated by commas (`,`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import QuickSight Namespace using the AWS account ID and namespace separated by commas (`,`). For example:
+
+```console
+% terraform import aws_quicksight_namespace.example 123456789012,example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-beca84265f5d628caa51b3d90e20696177b38adfc69e699a485ae67302774c9f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/quicksight_refresh_schedule.html.markdown b/website/docs/cdktf/python/r/quicksight_refresh_schedule.html.markdown
new file mode 100644
index 00000000000..b8ecf0736ed
--- /dev/null
+++ b/website/docs/cdktf/python/r/quicksight_refresh_schedule.html.markdown
@@ -0,0 +1,169 @@
+---
+subcategory: "QuickSight"
+layout: "aws"
+page_title: "AWS: aws_quicksight_refresh_schedule"
+description: |-
+  Manages a Resource QuickSight Refresh Schedule.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_quicksight_refresh_schedule
+
+Resource for managing a QuickSight Refresh Schedule.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.quicksight_refresh_schedule import QuicksightRefreshSchedule
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        QuicksightRefreshSchedule(self, "example",
+            data_set_id="dataset-id",
+            schedule=[QuicksightRefreshScheduleSchedule(
+                refresh_type="FULL_REFRESH",
+                schedule_frequency=[QuicksightRefreshScheduleScheduleScheduleFrequency(
+                    interval="HOURLY"
+                )
+                ]
+            )
+            ],
+            schedule_id="schedule-id"
+        )
+```
+
+### With Weekly Refresh
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.quicksight_refresh_schedule import QuicksightRefreshSchedule
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        QuicksightRefreshSchedule(self, "example",
+            data_set_id="dataset-id",
+            schedule=[QuicksightRefreshScheduleSchedule(
+                refresh_type="INCREMENTAL_REFRESH",
+                schedule_frequency=[QuicksightRefreshScheduleScheduleScheduleFrequency(
+                    interval="WEEKLY",
+                    refresh_on_day=[QuicksightRefreshScheduleScheduleScheduleFrequencyRefreshOnDay(
+                        day_of_week="MONDAY"
+                    )
+                    ],
+                    time_of_the_day="01:00",
+                    timezone="Europe/London"
+                )
+                ]
+            )
+            ],
+            schedule_id="schedule-id"
+        )
+```
+
+### With Monthly Refresh
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.quicksight_refresh_schedule import QuicksightRefreshSchedule
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        QuicksightRefreshSchedule(self, "example",
+            data_set_id="dataset-id",
+            schedule=[QuicksightRefreshScheduleSchedule(
+                refresh_type="INCREMENTAL_REFRESH",
+                schedule_frequency=[QuicksightRefreshScheduleScheduleScheduleFrequency(
+                    interval="MONTHLY",
+                    refresh_on_day=[QuicksightRefreshScheduleScheduleScheduleFrequencyRefreshOnDay(
+                        day_of_month="1"
+                    )
+                    ],
+                    time_of_the_day="01:00",
+                    timezone="Europe/London"
+                )
+                ]
+            )
+            ],
+            schedule_id="schedule-id"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `data_set_id` - (Required, Forces new resource) The ID of the dataset.
+* `schedule_id` - (Required, Forces new resource) The ID of the refresh schedule.
+* `schedule` - (Required) The [refresh schedule](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_RefreshSchedule.html). See [schedule](#schedule)
+
+The following arguments are optional:
+
+* `aws_account_id` - (Optional, Forces new resource) AWS account ID.
+
+### schedule
+
+* `refresh_type` - (Required) The type of refresh that the dataset undergoes. Valid values are `INCREMENTAL_REFRESH` and `FULL_REFRESH`.
+* `start_after_date_time` (Optional) Time after which the refresh schedule can be started, expressed in `YYYY-MM-DDTHH:MM:SS` format.
+* `schedule_frequency` - (Optional) The configuration of the [schedule frequency](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_RefreshFrequency.html). See [schedule_frequency](#schedule_frequency).
+
+### schedule_frequency
+
+* `interval` - (Required) The interval between scheduled refreshes. Valid values are `MINUTE15`, `MINUTE30`, `HOURLY`, `DAILY`, `WEEKLY` and `MONTHLY`.
+* `time_of_the_day` - (Optional) The time of day that you want the dataset to refresh. This value is expressed in `HH:MM` format. This field is not required for schedules that refresh hourly.
+* `timezone` - (Optional) The timezone that you want the refresh schedule to use.
+* `refresh_on_day` - (Optional) The [refresh on entity](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_ScheduleRefreshOnEntity.html) configuration for weekly or monthly schedules. See [refresh_on_day](#refresh_on_day).
+
+### refresh_on_day
+
+* `day_of_month` - (Optional) The day of the month that you want to schedule refresh on.
+* `day_of_week` - (Optional) The day of the week that you want to schedule a refresh on. Valid values are `SUNDAY`, `MONDAY`, `TUESDAY`, `WEDNESDAY`, `THURSDAY`, `FRIDAY` and `SATURDAY`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the refresh schedule.
+* `id` - A comma-delimited string joining AWS account ID, data set ID & refresh schedule ID.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import a QuickSight Refresh Schedule using the AWS account ID, data set ID and schedule ID separated by commas (`,`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import a QuickSight Refresh Schedule using the AWS account ID, data set ID and schedule ID separated by commas (`,`). For example:
+
+```console
+% terraform import aws_quicksight_refresh_schedule.example 123456789012,dataset-id,schedule-id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-883bce749fc26eb189d4bb33cee6fff44b81f594e4f17aefe99500bd5e24ebe3 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/quicksight_template.html.markdown b/website/docs/cdktf/python/r/quicksight_template.html.markdown
new file mode 100644
index 00000000000..1b590c84e61
--- /dev/null
+++ b/website/docs/cdktf/python/r/quicksight_template.html.markdown
@@ -0,0 +1,210 @@
+---
+subcategory: "QuickSight"
+layout: "aws"
+page_title: "AWS: aws_quicksight_template"
+description: |-
+  Manages a QuickSight Template.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_quicksight_template
+
+Resource for managing a QuickSight Template.
+
+## Example Usage
+
+### From Source Template
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.quicksight_template import QuicksightTemplate
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        QuicksightTemplate(self, "example",
+            name="example-name",
+            source_entity=QuicksightTemplateSourceEntity(
+                source_template=QuicksightTemplateSourceEntitySourceTemplate(
+                    arn=source.arn
+                )
+            ),
+            template_id="example-id",
+            version_description="version"
+        )
+```
+
+### With Definition
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.quicksight_template import QuicksightTemplate
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        QuicksightTemplate(self, "example",
+            definition={
+                "data_set_configuration": [{
+                    "data_set_schema": {
+                        "column_schema_list": [{
+                            "data_type": "STRING",
+                            "name": "Column1"
+                        }, {
+                            "data_type": "INTEGER",
+                            "name": "Column2"
+                        }
+                        ]
+                    },
+                    "placeholder": "1"
+                }
+                ],
+                "sheets": [{
+                    "sheet_id": "Test1",
+                    "title": "Test",
+                    "visuals": [{
+                        "bar_chart_visual": {
+                            "chart_configuration": {
+                                "field_wells": {
+                                    "bar_chart_aggregated_field_wells": {
+                                        "category": [{
+                                            "categorical_dimension_field": {
+                                                "column": {
+                                                    "column_name": "Column1",
+                                                    "data_set_identifier": "1"
+                                                },
+                                                "field_id": "1"
+                                            }
+                                        }
+                                        ],
+                                        "values": [{
+                                            "numerical_measure_field": {
+                                                "aggregation_function": {
+                                                    "simple_numerical_aggregation": "SUM"
+                                                },
+                                                "column": {
+                                                    "column_name": "Column2",
+                                                    "data_set_identifier": "1"
+                                                },
+                                                "field_id": "2"
+                                            }
+                                        }
+                                        ]
+                                    }
+                                }
+                            },
+                            "visual_id": "BarChart"
+                        }
+                    }
+                    ]
+                }
+                ]
+            },
+            name="example-name",
+            template_id="example-id",
+            version_description="version"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `template_id` - (Required, Forces new resource) Identifier for the template.
+* `name` - (Required) Display name for the template.
+* `version_description` - (Required) A description of the current template version being created/updated.
+
+The following arguments are optional:
+
+* `aws_account_id` - (Optional, Forces new resource) AWS account ID.
+* `definition` - (Optional) A detailed template definition. Only one of `definition` or `source_entity` should be configured. See [definition](#definition).
+* `permissions` - (Optional) A set of resource permissions on the template. Maximum of 64 items. See [permissions](#permissions).
+* `source_entity` - (Optional) The entity that you are using as a source when you create the template (analysis or template). Only one of `definition` or `source_entity` should be configured. See [source_entity](#source_entity).
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### permissions
+
+* `actions` - (Required) List of IAM actions to grant or revoke permissions on.
+* `principal` - (Required) ARN of the principal. See the [ResourcePermission documentation](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_ResourcePermission.html) for the applicable ARN values.
+
+### source_entity
+
+* `source_analysis` - (Optional) The source analysis, if it is based on an analysis.. Only one of `source_analysis` or `source_template` should be configured. See [source_analysis](#source_analysis).
+* `source_template` - (Optional) The source template, if it is based on an template.. Only one of `source_analysis` or `source_template` should be configured. See [source_template](#source_template).
+
+### source_analysis
+
+* `arn` - (Required) The Amazon Resource Name (ARN) of the resource.
+* `data_set_references` - (Required) A list of dataset references used as placeholders in the template. See [data_set_references](#data_set_references).
+
+### data_set_references
+
+* `data_set_arn` - (Required) Dataset Amazon Resource Name (ARN).
+* `data_set_placeholder` - (Required) Dataset placeholder.
+
+### source_template
+
+* `arn` - (Required) The Amazon Resource Name (ARN) of the resource.
+
+### definition
+
+* `data_set_configuration` - (Required) A list of dataset configurations. These configurations define the required columns for each dataset used within a template. See [AWS API Documentation for complete description](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DataSetConfiguration.html).
+* `analysis_defaults` - (Optional) The configuration for default analysis settings. See [AWS API Documentation for complete description](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_AnalysisDefaults.html).
+* `calculated_fields` - (Optional) A list of calculated field definitions for the template. See [AWS API Documentation for complete description](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_CalculatedField.html).
+* `column_configurations` - (Optional) A list of template-level column configurations. Column configurations are used to set default formatting for a column that's used throughout a template. See [AWS API Documentation for complete description](ttps://docs.aws.amazon.com/quicksight/latest/APIReference/API_ColumnConfiguration.html).
+* `filter_groups` - (Optional) A list of filter definitions for a template. See [AWS API Documentation for complete description](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_FilterGroup.html). For more information, see [Filtering Data](https://docs.aws.amazon.com/quicksight/latest/user/filtering-visual-data.html) in Amazon QuickSight User Guide.
+* `parameters_declarations` - (Optional) A list of parameter declarations for a template. Parameters are named variables that can transfer a value for use by an action or an object. See [AWS API Documentation for complete description](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_ParameterDeclaration.html). For more information, see [Parameters in Amazon QuickSight](https://docs.aws.amazon.com/quicksight/latest/user/parameters-in-quicksight.html) in the Amazon QuickSight User Guide.
+* `sheets` - (Optional) A list of sheet definitions for a template. See [AWS API Documentation for complete description](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_SheetDefinition.html).
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the template.
+* `created_time` - The time that the template was created.
+* `id` - A comma-delimited string joining AWS account ID and template ID.
+* `last_updated_time` - The time that the template was last updated.
+* `source_entity_arn` - Amazon Resource Name (ARN) of an analysis or template that was used to create this template.
+* `status` - The template creation status.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block).
+* `version_number` - The version number of the template version.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `5m`)
+* `update` - (Default `5m`)
+* `delete` - (Default `5m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import a QuickSight Template using the AWS account ID and template ID separated by a comma (`,`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import a QuickSight Template using the AWS account ID and template ID separated by a comma (`,`). For example:
+
+```console
+% terraform import aws_quicksight_template.example 123456789012,example-id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-684fee6425d01e2059464d789630cbb0f5fd11eece6c679b299e9511a988d107 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/quicksight_template_alias.html.markdown b/website/docs/cdktf/python/r/quicksight_template_alias.html.markdown
new file mode 100644
index 00000000000..aaaf95e31d1
--- /dev/null
+++ b/website/docs/cdktf/python/r/quicksight_template_alias.html.markdown
@@ -0,0 +1,76 @@
+---
+subcategory: "QuickSight"
+layout: "aws"
+page_title: "AWS: aws_quicksight_template_alias"
+description: |-
+  Terraform resource for managing an AWS QuickSight Template Alias.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_quicksight_template_alias
+
+Terraform resource for managing an AWS QuickSight Template Alias.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.quicksight_template_alias import QuicksightTemplateAlias
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        QuicksightTemplateAlias(self, "example",
+            alias_name="example-alias",
+            template_id=test.template_id,
+            template_version_number=test.version_number
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `alias_name` - (Required, Forces new resource) Display name of the template alias.
+* `template_id` - (Required, Forces new resource) ID of the template.
+* `template_version_number` - (Required) Version number of the template.
+
+The following arguments are optional:
+
+* `aws_account_id` - (Optional, Forces new resource) AWS account ID.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the template alias.
+* `id` - A comma-delimited string joining AWS account ID, template ID, and alias name.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import QuickSight Template Alias using the AWS account ID, template ID, and alias name separated by a comma (`,`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import QuickSight Template Alias using the AWS account ID, template ID, and alias name separated by a comma (`,`). For example:
+
+```console
+% terraform import aws_quicksight_template_alias.example 123456789012,example-id,example-alias
+```
+
+<!-- cache-key: cdktf-0.18.0 input-0ef4c7dd40f38e995959bc39fcd14ea01fdf8e036b7c872e0812d2486af788e0 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/quicksight_theme.html.markdown b/website/docs/cdktf/python/r/quicksight_theme.html.markdown
new file mode 100644
index 00000000000..9d19e1bcd18
--- /dev/null
+++ b/website/docs/cdktf/python/r/quicksight_theme.html.markdown
@@ -0,0 +1,172 @@
+---
+subcategory: "QuickSight"
+layout: "aws"
+page_title: "AWS: aws_quicksight_theme"
+description: |-
+  Manages a QuickSight Theme.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_quicksight_theme
+
+Resource for managing a QuickSight Theme.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.quicksight_theme import QuicksightTheme
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        QuicksightTheme(self, "example",
+            base_theme_id="MIDNIGHT",
+            configuration=QuicksightThemeConfiguration(
+                data_color_palette=QuicksightThemeConfigurationDataColorPalette(
+                    colors=["#FFFFFF", "#111111", "#222222", "#333333", "#444444", "#555555", "#666666", "#777777", "#888888", "#999999"
+                    ],
+                    empty_fill_color="#FFFFFF",
+                    min_max_gradient=["#FFFFFF", "#111111"]
+                )
+            ),
+            name="example",
+            theme_id="example"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `theme_id` - (Required, Forces new resource) Identifier of the theme.
+* `base_theme_id` - (Required) The ID of the theme that a custom theme will inherit from. All themes inherit from one of the starting themes defined by Amazon QuickSight. For a list of the starting themes, use ListThemes or choose Themes from within an analysis.
+* `name` - (Required) Display name of the theme.
+* `configuration` - (Required) The theme configuration, which contains the theme display properties. See [configuration](#configuration).
+
+The following arguments are optional:
+
+* `aws_account_id` - (Optional, Forces new resource) AWS account ID.
+* `permissions` - (Optional) A set of resource permissions on the theme. Maximum of 64 items. See [permissions](#permissions).
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `version_description` - (Optional) A description of the current theme version being created/updated.
+
+### permissions
+
+* `actions` - (Required) List of IAM actions to grant or revoke permissions on.
+* `principal` - (Required) ARN of the principal. See the [ResourcePermission documentation](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_ResourcePermission.html) for the applicable ARN values.
+
+### configuration
+
+* `data_color_palette` - (Optional) Color properties that apply to chart data colors. See [data_color_palette](#data_color_palette).
+* `sheet` - (Optional) Display options related to sheets. See [sheet](#sheet).
+* `typography` - (Optional) Determines the typography options. See [typography](#typography).
+* `ui_color_palette` - (Optional) Color properties that apply to the UI and to charts, excluding the colors that apply to data. See [ui_color_palette](#ui_color_palette).
+
+### data_color_palette
+
+* `colors` - (Optional) List of hexadecimal codes for the colors. Minimum of 8 items and maximum of 20 items.
+* `empty_fill_color` - (Optional) The hexadecimal code of a color that applies to charts where a lack of data is highlighted.
+* `min_max_gradient` - (Optional) The minimum and maximum hexadecimal codes that describe a color gradient. List of exactly 2 items.
+
+### sheet
+
+* `tile` - (Optional) The display options for tiles. See [tile](#tile).
+* `tile_layout` - (Optional) The layout options for tiles. See [tile_layout](#tile_layout).
+
+### tile
+
+* `border` - (Optional) The border around a tile. See [border](#border).
+
+### border
+
+* `show` - (Optional) The option to enable display of borders for visuals.
+
+### tile_layout
+
+* `gutter` - (Optional) The gutter settings that apply between tiles. See [gutter](#gutter).
+* `margin` - (Optional) The margin settings that apply around the outside edge of sheets. See [margin](#margin).
+
+### gutter
+
+* `show` - (Optional) This Boolean value controls whether to display a gutter space between sheet tiles.
+
+### margin
+
+* `show` - (Optional) This Boolean value controls whether to display sheet margins.
+
+### typography
+
+* `font_families` - (Optional) Determines the list of font families. Maximum number of 5 items. See [font_families](#font_families).
+
+### font_families
+
+* `font_family` - (Optional) Font family name.
+
+### ui_color_palette
+
+* `accent` - (Optional) Color (hexadecimal) that applies to selected states and buttons.
+* `accent_foreground` - (Optional) Color (hexadecimal) that applies to any text or other elements that appear over the accent color.
+* `danger` - (Optional) Color (hexadecimal) that applies to error messages.
+* `danger_foreground` - (Optional) Color (hexadecimal) that applies to any text or other elements that appear over the error color.
+* `dimension` - (Optional) Color (hexadecimal) that applies to the names of fields that are identified as dimensions.
+* `dimension_foreground` - (Optional) Color (hexadecimal) that applies to any text or other elements that appear over the dimension color.
+* `measure` - (Optional) Color (hexadecimal) that applies to the names of fields that are identified as measures.
+* `measure_foreground` - (Optional) Color (hexadecimal) that applies to any text or other elements that appear over the measure color.
+* `primary_background` - (Optional) Color (hexadecimal) that applies to visuals and other high emphasis UI.
+* `primary_foreground` - (Optional) Color (hexadecimal) of text and other foreground elements that appear over the primary background regions, such as grid lines, borders, table banding, icons, and so on.
+* `secondary_background` - (Optional) Color (hexadecimal) that applies to the sheet background and sheet controls.
+* `secondary_foreground` - (Optional) Color (hexadecimal) that applies to any sheet title, sheet control text, or UI that appears over the secondary background.
+* `success` - (Optional) Color (hexadecimal) that applies to success messages, for example the check mark for a successful download.
+* `success_foreground` - (Optional) Color (hexadecimal) that applies to any text or other elements that appear over the success color.
+* `warning` - (Optional) Color (hexadecimal) that applies to warning and informational messages.
+* `warning_foreground` - (Optional) Color (hexadecimal) that applies to any text or other elements that appear over the warning color.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the theme.
+* `created_time` - The time that the theme was created.
+* `id` - A comma-delimited string joining AWS account ID and theme ID.
+* `last_updated_time` - The time that the theme was last updated.
+* `status` - The theme creation status.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block).
+* `version_number` - The version number of the theme version.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `5m`)
+* `update` - (Default `5m`)
+* `delete` - (Default `5m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import a QuickSight Theme using the AWS account ID and theme ID separated by a comma (`,`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import a QuickSight Theme using the AWS account ID and theme ID separated by a comma (`,`). For example:
+
+```console
+% terraform import aws_quicksight_theme.example 123456789012,example-id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-aa652dec5ece740b9a748611a9a30b95144c3c47e65363b38cd20d01eab3af22 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/quicksight_user.html.markdown b/website/docs/cdktf/python/r/quicksight_user.html.markdown
new file mode 100644
index 00000000000..2119eebe121
--- /dev/null
+++ b/website/docs/cdktf/python/r/quicksight_user.html.markdown
@@ -0,0 +1,62 @@
+---
+subcategory: "QuickSight"
+layout: "aws"
+page_title: "AWS: aws_quicksight_user"
+description: |-
+  Manages a Resource QuickSight User.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_quicksight_user
+
+Resource for managing QuickSight User
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.quicksight_user import QuicksightUser
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        QuicksightUser(self, "example",
+            email="author@example.com",
+            iam_arn="arn:aws:iam::123456789012:user/Example",
+            identity_type="IAM",
+            namespace="foo",
+            session_name="an-author",
+            user_role="AUTHOR"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `email` - (Required) The email address of the user that you want to register.
+* `identity_type` - (Required) Amazon QuickSight supports several ways of managing the identity of users. This parameter accepts either  `IAM` or `QUICKSIGHT`. If `IAM` is specified, the `iam_arn` must also be specified.
+* `user_role` - (Required) The Amazon QuickSight role of the user. The user role can be one of the following: `READER`, `AUTHOR`, or `ADMIN`
+* `user_name` - (Optional) The Amazon QuickSight user name that you want to create for the user you are registering. Only valid for registering a user with `identity_type` set to `QUICKSIGHT`.
+* `aws_account_id` - (Optional) The ID for the AWS account that the user is in. Currently, you use the ID for the AWS account that contains your Amazon QuickSight account.
+* `iam_arn` - (Optional) The ARN of the IAM user or role that you are registering with Amazon QuickSight.
+* `namespace`  - (Optional) The Amazon Quicksight namespace to create the user in. Defaults to `default`.
+* `session_name` - (Optional) The name of the IAM session to use when assuming roles that can embed QuickSight dashboards. Only valid for registering users using an assumed IAM role. Additionally, if registering multiple users using the same IAM role, each user needs to have a unique session name.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the user
+
+## Import
+
+You cannot import this resource.
+
+<!-- cache-key: cdktf-0.18.0 input-9dc8c87fc6da12d6f8933cfaeb31b94be75e8878bade439becdab1a05ff17eaa -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/quicksight_vpc_connection.html.markdown b/website/docs/cdktf/python/r/quicksight_vpc_connection.html.markdown
new file mode 100644
index 00000000000..8e19de50245
--- /dev/null
+++ b/website/docs/cdktf/python/r/quicksight_vpc_connection.html.markdown
@@ -0,0 +1,122 @@
+---
+subcategory: "QuickSight"
+layout: "aws"
+page_title: "AWS: aws_quicksight_vpc_connection"
+description: |-
+  Terraform resource for managing an AWS QuickSight VPC Connection.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_quicksight_vpc_connection
+
+Terraform resource for managing an AWS QuickSight VPC Connection.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.iam_role import IamRole
+from imports.aws.quicksight_vpc_connection import QuicksightVpcConnection
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        vpc_connection_role = IamRole(self, "vpc_connection_role",
+            assume_role_policy=Token.as_string(
+                Fn.jsonencode({
+                    "Statement": [{
+                        "Action": "sts:AssumeRole",
+                        "Effect": "Allow",
+                        "Principal": {
+                            "Service": "quicksight.amazonaws.com"
+                        }
+                    }
+                    ],
+                    "Version": "2012-10-17"
+                })),
+            inline_policy=[IamRoleInlinePolicy(
+                name="QuickSightVPCConnectionRolePolicy",
+                policy=Token.as_string(
+                    Fn.jsonencode({
+                        "Statement": [{
+                            "Action": ["ec2:CreateNetworkInterface", "ec2:ModifyNetworkInterfaceAttribute", "ec2:DeleteNetworkInterface", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups"
+                            ],
+                            "Effect": "Allow",
+                            "Resource": ["*"]
+                        }
+                        ],
+                        "Version": "2012-10-17"
+                    }))
+            )
+            ]
+        )
+        QuicksightVpcConnection(self, "example",
+            name="Example Connection",
+            role_arn=vpc_connection_role.arn,
+            security_group_ids=["sg-00000000000000000"],
+            subnet_ids=["subnet-00000000000000000", "subnet-00000000000000001"],
+            vpc_connection_id="example-connection-id"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `vpc_connection_id` - (Required) The ID of the VPC connection.
+* `name` - (Required) The display name for the VPC connection.
+* `role_arn` - (Required) The IAM role to associate with the VPC connection.
+* `security_group_ids` - (Required) A list of security group IDs for the VPC connection.
+* `subnet_ids` - (Required) A list of subnet IDs for the VPC connection.
+
+The following arguments are optional:
+
+* `aws_account_id` - (Optional) AWS account ID.
+* `dns_resolvers` - (Optional) A list of IP addresses of DNS resolver endpoints for the VPC connection.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the VPC connection.
+* `availability_status` - The availability status of the VPC connection. Valid values are `AVAILABLE`, `UNAVAILABLE` or `PARTIALLY_AVAILABLE`.
+* `id` - A comma-delimited string joining AWS account ID and VPC connection ID.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `5m`)
+* `update` - (Default `5m`)
+* `delete` - (Default `5m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import QuickSight VPC connection using the AWS account ID and VPC connection ID separated by commas (`,`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import QuickSight VPC connection using the AWS account ID and VPC connection ID separated by commas (`,`). For example:
+
+```console
+% terraform import aws_quicksight_vpc_connection.example 123456789012,example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1a701376d2bcc1e947dddba8bc678a08ec6fbb9c8fee2196563da6dc0a40c77f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ram_principal_association.html.markdown b/website/docs/cdktf/python/r/ram_principal_association.html.markdown
new file mode 100644
index 00000000000..6a0d705441d
--- /dev/null
+++ b/website/docs/cdktf/python/r/ram_principal_association.html.markdown
@@ -0,0 +1,106 @@
+---
+subcategory: "RAM (Resource Access Manager)"
+layout: "aws"
+page_title: "AWS: aws_ram_principal_association"
+description: |-
+  Provides a Resource Access Manager (RAM) principal association.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ram_principal_association
+
+Provides a Resource Access Manager (RAM) principal association. Depending if [RAM Sharing with AWS Organizations is enabled](https://docs.aws.amazon.com/ram/latest/userguide/getting-started-sharing.html#getting-started-sharing-orgs), the RAM behavior with different principal types changes.
+
+When RAM Sharing with AWS Organizations is enabled:
+
+- For AWS Account ID, Organization, and Organizational Unit principals within the same AWS Organization, no resource share invitation is sent and resources become available automatically after creating the association.
+- For AWS Account ID principals outside the AWS Organization, a resource share invitation is sent and must be accepted before resources become available. See the [`aws_ram_resource_share_accepter` resource](/docs/providers/aws/r/ram_resource_share_accepter.html) to accept these invitations.
+
+When RAM Sharing with AWS Organizations is not enabled:
+
+- Organization and Organizational Unit principals cannot be used.
+- For AWS Account ID principals, a resource share invitation is sent and must be accepted before resources become available. See the [`aws_ram_resource_share_accepter` resource](/docs/providers/aws/r/ram_resource_share_accepter.html) to accept these invitations.
+
+## Example Usage
+
+### AWS Account ID
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ram_principal_association import RamPrincipalAssociation
+from imports.aws.ram_resource_share import RamResourceShare
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, name):
+        super().__init__(scope, name)
+        example = RamResourceShare(self, "example",
+            allow_external_principals=True,
+            name=name
+        )
+        aws_ram_principal_association_example = RamPrincipalAssociation(self, "example_1",
+            principal="111111111111",
+            resource_share_arn=example.arn
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_ram_principal_association_example.override_logical_id("example")
+```
+
+### AWS Organization
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ram_principal_association import RamPrincipalAssociation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        RamPrincipalAssociation(self, "example",
+            principal=Token.as_string(aws_organizations_organization_example.arn),
+            resource_share_arn=Token.as_string(aws_ram_resource_share_example.arn)
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `principal` - (Required) The principal to associate with the resource share. Possible values are an AWS account ID, an AWS Organizations Organization ARN, or an AWS Organizations Organization Unit ARN.
+* `resource_share_arn` - (Required) The Amazon Resource Name (ARN) of the resource share.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Amazon Resource Name (ARN) of the Resource Share and the principal, separated by a comma.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import RAM Principal Associations using their Resource Share ARN and the `principal` separated by a comma. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import RAM Principal Associations using their Resource Share ARN and the `principal` separated by a comma. For example:
+
+```console
+% terraform import aws_ram_principal_association.example arn:aws:ram:eu-west-1:123456789012:resource-share/73da1ab9-b94a-4ba3-8eb4-45917f7f4b12,123456789012
+```
+
+<!-- cache-key: cdktf-0.18.0 input-623c2b071e2dcf8be643331968c3fa3f7507a8b07a6370bcf13bd342be258453 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ram_principal_association.markdown b/website/docs/cdktf/python/r/ram_principal_association.markdown
new file mode 100644
index 00000000000..6a0d705441d
--- /dev/null
+++ b/website/docs/cdktf/python/r/ram_principal_association.markdown
@@ -0,0 +1,106 @@
+---
+subcategory: "RAM (Resource Access Manager)"
+layout: "aws"
+page_title: "AWS: aws_ram_principal_association"
+description: |-
+  Provides a Resource Access Manager (RAM) principal association.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ram_principal_association
+
+Provides a Resource Access Manager (RAM) principal association. Depending if [RAM Sharing with AWS Organizations is enabled](https://docs.aws.amazon.com/ram/latest/userguide/getting-started-sharing.html#getting-started-sharing-orgs), the RAM behavior with different principal types changes.
+
+When RAM Sharing with AWS Organizations is enabled:
+
+- For AWS Account ID, Organization, and Organizational Unit principals within the same AWS Organization, no resource share invitation is sent and resources become available automatically after creating the association.
+- For AWS Account ID principals outside the AWS Organization, a resource share invitation is sent and must be accepted before resources become available. See the [`aws_ram_resource_share_accepter` resource](/docs/providers/aws/r/ram_resource_share_accepter.html) to accept these invitations.
+
+When RAM Sharing with AWS Organizations is not enabled:
+
+- Organization and Organizational Unit principals cannot be used.
+- For AWS Account ID principals, a resource share invitation is sent and must be accepted before resources become available. See the [`aws_ram_resource_share_accepter` resource](/docs/providers/aws/r/ram_resource_share_accepter.html) to accept these invitations.
+
+## Example Usage
+
+### AWS Account ID
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ram_principal_association import RamPrincipalAssociation
+from imports.aws.ram_resource_share import RamResourceShare
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, name):
+        super().__init__(scope, name)
+        example = RamResourceShare(self, "example",
+            allow_external_principals=True,
+            name=name
+        )
+        aws_ram_principal_association_example = RamPrincipalAssociation(self, "example_1",
+            principal="111111111111",
+            resource_share_arn=example.arn
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_ram_principal_association_example.override_logical_id("example")
+```
+
+### AWS Organization
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ram_principal_association import RamPrincipalAssociation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        RamPrincipalAssociation(self, "example",
+            principal=Token.as_string(aws_organizations_organization_example.arn),
+            resource_share_arn=Token.as_string(aws_ram_resource_share_example.arn)
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `principal` - (Required) The principal to associate with the resource share. Possible values are an AWS account ID, an AWS Organizations Organization ARN, or an AWS Organizations Organization Unit ARN.
+* `resource_share_arn` - (Required) The Amazon Resource Name (ARN) of the resource share.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Amazon Resource Name (ARN) of the Resource Share and the principal, separated by a comma.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import RAM Principal Associations using their Resource Share ARN and the `principal` separated by a comma. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import RAM Principal Associations using their Resource Share ARN and the `principal` separated by a comma. For example:
+
+```console
+% terraform import aws_ram_principal_association.example arn:aws:ram:eu-west-1:123456789012:resource-share/73da1ab9-b94a-4ba3-8eb4-45917f7f4b12,123456789012
+```
+
+<!-- cache-key: cdktf-0.18.0 input-623c2b071e2dcf8be643331968c3fa3f7507a8b07a6370bcf13bd342be258453 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ram_resource_association.html.markdown b/website/docs/cdktf/python/r/ram_resource_association.html.markdown
new file mode 100644
index 00000000000..d424a0a4877
--- /dev/null
+++ b/website/docs/cdktf/python/r/ram_resource_association.html.markdown
@@ -0,0 +1,69 @@
+---
+subcategory: "RAM (Resource Access Manager)"
+layout: "aws"
+page_title: "AWS: aws_ram_resource_association"
+description: |-
+  Manages a Resource Access Manager (RAM) Resource Association.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ram_resource_association
+
+Manages a Resource Access Manager (RAM) Resource Association.
+
+~> *NOTE:* Certain AWS resources (e.g., EC2 Subnets) can only be shared in an AWS account that is a member of an AWS Organizations organization with organization-wide Resource Access Manager functionality enabled. See the [Resource Access Manager User Guide](https://docs.aws.amazon.com/ram/latest/userguide/what-is.html) and AWS service specific documentation for additional information.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ram_resource_association import RamResourceAssociation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        RamResourceAssociation(self, "example",
+            resource_arn=Token.as_string(aws_subnet_example.arn),
+            resource_share_arn=Token.as_string(aws_ram_resource_share_example.arn)
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `resource_arn` - (Required) Amazon Resource Name (ARN) of the resource to associate with the RAM Resource Share.
+* `resource_share_arn` - (Required) Amazon Resource Name (ARN) of the RAM Resource Share.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Amazon Resource Name (ARN) of the resource share.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import RAM Resource Associations using their Resource Share ARN and Resource ARN separated by a comma. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import RAM Resource Associations using their Resource Share ARN and Resource ARN separated by a comma. For example:
+
+```console
+% terraform import aws_ram_resource_association.example arn:aws:ram:eu-west-1:123456789012:resource-share/73da1ab9-b94a-4ba3-8eb4-45917f7f4b12,arn:aws:ec2:eu-west-1:123456789012:subnet/subnet-12345678
+```
+
+<!-- cache-key: cdktf-0.18.0 input-f89af00a7e0729a1d228ab9768d7122c9cd30990cc8c1dcb4c038628bf33b34d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ram_resource_share.html.markdown b/website/docs/cdktf/python/r/ram_resource_share.html.markdown
new file mode 100644
index 00000000000..6f574d4deed
--- /dev/null
+++ b/website/docs/cdktf/python/r/ram_resource_share.html.markdown
@@ -0,0 +1,74 @@
+---
+subcategory: "RAM (Resource Access Manager)"
+layout: "aws"
+page_title: "AWS: aws_ram_resource_share"
+description: |-
+  Manages a Resource Access Manager (RAM) Resource Share.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ram_resource_share
+
+Manages a Resource Access Manager (RAM) Resource Share. To associate principals with the share, see the [`aws_ram_principal_association` resource](/docs/providers/aws/r/ram_principal_association.html). To associate resources with the share, see the [`aws_ram_resource_association` resource](/docs/providers/aws/r/ram_resource_association.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ram_resource_share import RamResourceShare
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        RamResourceShare(self, "example",
+            allow_external_principals=True,
+            name="example",
+            tags={
+                "Environment": "Production"
+            }
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the resource share.
+* `allow_external_principals` - (Optional) Indicates whether principals outside your organization can be associated with a resource share.
+* `permission_arns` - (Optional) Specifies the Amazon Resource Names (ARNs) of the RAM permission to associate with the resource share. If you do not specify an ARN for the permission, RAM automatically attaches the default version of the permission for each resource type. You can associate only one permission with each resource type included in the resource share.
+* `tags` - (Optional) A map of tags to assign to the resource share. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the resource share.
+* `id` - The Amazon Resource Name (ARN) of the resource share.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import resource shares using the `arn` of the resource share. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import resource shares using the `arn` of the resource share. For example:
+
+```console
+% terraform import aws_ram_resource_share.example arn:aws:ram:eu-west-1:123456789012:resource-share/73da1ab9-b94a-4ba3-8eb4-45917f7f4b12
+```
+
+<!-- cache-key: cdktf-0.18.0 input-d1b95a08fc3018c7477d3c340484bf53d1729e6c175ec03ca5c9a53c81d97b1e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ram_resource_share.markdown b/website/docs/cdktf/python/r/ram_resource_share.markdown
new file mode 100644
index 00000000000..6f574d4deed
--- /dev/null
+++ b/website/docs/cdktf/python/r/ram_resource_share.markdown
@@ -0,0 +1,74 @@
+---
+subcategory: "RAM (Resource Access Manager)"
+layout: "aws"
+page_title: "AWS: aws_ram_resource_share"
+description: |-
+  Manages a Resource Access Manager (RAM) Resource Share.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ram_resource_share
+
+Manages a Resource Access Manager (RAM) Resource Share. To associate principals with the share, see the [`aws_ram_principal_association` resource](/docs/providers/aws/r/ram_principal_association.html). To associate resources with the share, see the [`aws_ram_resource_association` resource](/docs/providers/aws/r/ram_resource_association.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ram_resource_share import RamResourceShare
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        RamResourceShare(self, "example",
+            allow_external_principals=True,
+            name="example",
+            tags={
+                "Environment": "Production"
+            }
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the resource share.
+* `allow_external_principals` - (Optional) Indicates whether principals outside your organization can be associated with a resource share.
+* `permission_arns` - (Optional) Specifies the Amazon Resource Names (ARNs) of the RAM permission to associate with the resource share. If you do not specify an ARN for the permission, RAM automatically attaches the default version of the permission for each resource type. You can associate only one permission with each resource type included in the resource share.
+* `tags` - (Optional) A map of tags to assign to the resource share. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the resource share.
+* `id` - The Amazon Resource Name (ARN) of the resource share.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import resource shares using the `arn` of the resource share. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import resource shares using the `arn` of the resource share. For example:
+
+```console
+% terraform import aws_ram_resource_share.example arn:aws:ram:eu-west-1:123456789012:resource-share/73da1ab9-b94a-4ba3-8eb4-45917f7f4b12
+```
+
+<!-- cache-key: cdktf-0.18.0 input-d1b95a08fc3018c7477d3c340484bf53d1729e6c175ec03ca5c9a53c81d97b1e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ram_resource_share_accepter.html.markdown b/website/docs/cdktf/python/r/ram_resource_share_accepter.html.markdown
new file mode 100644
index 00000000000..c9118f5f577
--- /dev/null
+++ b/website/docs/cdktf/python/r/ram_resource_share_accepter.html.markdown
@@ -0,0 +1,100 @@
+---
+subcategory: "RAM (Resource Access Manager)"
+layout: "aws"
+page_title: "AWS: aws_ram_resource_share_accepter"
+description: |-
+  Manages accepting a Resource Access Manager (RAM) Resource Share invitation.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ram_resource_share_accepter
+
+Manage accepting a Resource Access Manager (RAM) Resource Share invitation. From a _receiver_ AWS account, accept an invitation to share resources that were shared by a _sender_ AWS account. To create a resource share in the _sender_, see the [`aws_ram_resource_share` resource](/docs/providers/aws/r/ram_resource_share.html).
+
+~> **Note:** If both AWS accounts are in the same Organization and [RAM Sharing with AWS Organizations is enabled](https://docs.aws.amazon.com/ram/latest/userguide/getting-started-sharing.html#getting-started-sharing-orgs), this resource is not necessary as RAM Resource Share invitations are not used.
+
+## Example Usage
+
+This configuration provides an example of using multiple Terraform AWS providers to configure two different AWS accounts. In the _sender_ account, the configuration creates a `aws_ram_resource_share` and uses a data source in the _receiver_ account to create a `aws_ram_principal_association` resource with the _receiver's_ account ID. In the _receiver_ account, the configuration accepts the invitation to share resources with the `aws_ram_resource_share_accepter`.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_caller_identity import DataAwsCallerIdentity
+from imports.aws.provider import AwsProvider
+from imports.aws.ram_principal_association import RamPrincipalAssociation
+from imports.aws.ram_resource_share import RamResourceShare
+from imports.aws.ram_resource_share_accepter import RamResourceShareAccepter
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AwsProvider(self, "aws",
+            profile="profile2"
+        )
+        alternate = AwsProvider(self, "aws_1",
+            alias="alternate",
+            profile="profile1"
+        )
+        sender_share = RamResourceShare(self, "sender_share",
+            allow_external_principals=True,
+            name="tf-test-resource-share",
+            provider=alternate,
+            tags={
+                "Name": "tf-test-resource-share"
+            }
+        )
+        receiver = DataAwsCallerIdentity(self, "receiver")
+        sender_invite = RamPrincipalAssociation(self, "sender_invite",
+            principal=Token.as_string(receiver.account_id),
+            provider=alternate,
+            resource_share_arn=sender_share.arn
+        )
+        RamResourceShareAccepter(self, "receiver_accept",
+            share_arn=sender_invite.resource_share_arn
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `share_arn` - (Required) The ARN of the resource share.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `invitation_arn` - The ARN of the resource share invitation.
+* `share_id` - The ID of the resource share as displayed in the console.
+* `status` - The status of the resource share (ACTIVE, PENDING, FAILED, DELETING, DELETED).
+* `receiver_account_id` - The account ID of the receiver account which accepts the invitation.
+* `sender_account_id` - The account ID of the sender account which submits the invitation.
+* `share_name` - The name of the resource share.
+* `resources` - A list of the resource ARNs shared via the resource share.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import resource share accepters using the resource share ARN. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import resource share accepters using the resource share ARN. For example:
+
+```console
+% terraform import aws_ram_resource_share_accepter.example arn:aws:ram:us-east-1:123456789012:resource-share/c4b56393-e8d9-89d9-6dc9-883752de4767
+```
+
+<!-- cache-key: cdktf-0.18.0 input-20035f07d897cc355e9d9455de1abcd873b5f6ec8141f34f4260f32e299d71a7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ram_resource_share_accepter.markdown b/website/docs/cdktf/python/r/ram_resource_share_accepter.markdown
new file mode 100644
index 00000000000..c9118f5f577
--- /dev/null
+++ b/website/docs/cdktf/python/r/ram_resource_share_accepter.markdown
@@ -0,0 +1,100 @@
+---
+subcategory: "RAM (Resource Access Manager)"
+layout: "aws"
+page_title: "AWS: aws_ram_resource_share_accepter"
+description: |-
+  Manages accepting a Resource Access Manager (RAM) Resource Share invitation.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ram_resource_share_accepter
+
+Manage accepting a Resource Access Manager (RAM) Resource Share invitation. From a _receiver_ AWS account, accept an invitation to share resources that were shared by a _sender_ AWS account. To create a resource share in the _sender_, see the [`aws_ram_resource_share` resource](/docs/providers/aws/r/ram_resource_share.html).
+
+~> **Note:** If both AWS accounts are in the same Organization and [RAM Sharing with AWS Organizations is enabled](https://docs.aws.amazon.com/ram/latest/userguide/getting-started-sharing.html#getting-started-sharing-orgs), this resource is not necessary as RAM Resource Share invitations are not used.
+
+## Example Usage
+
+This configuration provides an example of using multiple Terraform AWS providers to configure two different AWS accounts. In the _sender_ account, the configuration creates a `aws_ram_resource_share` and uses a data source in the _receiver_ account to create a `aws_ram_principal_association` resource with the _receiver's_ account ID. In the _receiver_ account, the configuration accepts the invitation to share resources with the `aws_ram_resource_share_accepter`.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_caller_identity import DataAwsCallerIdentity
+from imports.aws.provider import AwsProvider
+from imports.aws.ram_principal_association import RamPrincipalAssociation
+from imports.aws.ram_resource_share import RamResourceShare
+from imports.aws.ram_resource_share_accepter import RamResourceShareAccepter
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AwsProvider(self, "aws",
+            profile="profile2"
+        )
+        alternate = AwsProvider(self, "aws_1",
+            alias="alternate",
+            profile="profile1"
+        )
+        sender_share = RamResourceShare(self, "sender_share",
+            allow_external_principals=True,
+            name="tf-test-resource-share",
+            provider=alternate,
+            tags={
+                "Name": "tf-test-resource-share"
+            }
+        )
+        receiver = DataAwsCallerIdentity(self, "receiver")
+        sender_invite = RamPrincipalAssociation(self, "sender_invite",
+            principal=Token.as_string(receiver.account_id),
+            provider=alternate,
+            resource_share_arn=sender_share.arn
+        )
+        RamResourceShareAccepter(self, "receiver_accept",
+            share_arn=sender_invite.resource_share_arn
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `share_arn` - (Required) The ARN of the resource share.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `invitation_arn` - The ARN of the resource share invitation.
+* `share_id` - The ID of the resource share as displayed in the console.
+* `status` - The status of the resource share (ACTIVE, PENDING, FAILED, DELETING, DELETED).
+* `receiver_account_id` - The account ID of the receiver account which accepts the invitation.
+* `sender_account_id` - The account ID of the sender account which submits the invitation.
+* `share_name` - The name of the resource share.
+* `resources` - A list of the resource ARNs shared via the resource share.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import resource share accepters using the resource share ARN. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import resource share accepters using the resource share ARN. For example:
+
+```console
+% terraform import aws_ram_resource_share_accepter.example arn:aws:ram:us-east-1:123456789012:resource-share/c4b56393-e8d9-89d9-6dc9-883752de4767
+```
+
+<!-- cache-key: cdktf-0.18.0 input-20035f07d897cc355e9d9455de1abcd873b5f6ec8141f34f4260f32e299d71a7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ram_sharing_with_organization.html.markdown b/website/docs/cdktf/python/r/ram_sharing_with_organization.html.markdown
new file mode 100644
index 00000000000..c65c442ee14
--- /dev/null
+++ b/website/docs/cdktf/python/r/ram_sharing_with_organization.html.markdown
@@ -0,0 +1,63 @@
+---
+subcategory: "RAM (Resource Access Manager)"
+layout: "aws"
+page_title: "AWS: aws_ram_sharing_with_organization"
+description: |-
+  Manages Resource Access Manager (RAM) Resource Sharing with AWS Organizations.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ram_sharing_with_organization
+
+Manages Resource Access Manager (RAM) Resource Sharing with AWS Organizations. If you enable sharing with your organization, you can share resources without using invitations. Refer to the [AWS RAM user guide](https://docs.aws.amazon.com/ram/latest/userguide/getting-started-sharing.html#getting-started-sharing-orgs) for more details.
+
+~> **NOTE:** Use this resource to manage resource sharing within your organization, **not** the [`aws_organizations_organization`](organizations_organization.html) resource with `ram.amazonaws.com` configured in `aws_service_access_principals`.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ram_sharing_with_organization import RamSharingWithOrganization
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        RamSharingWithOrganization(self, "example")
+```
+
+## Argument Reference
+
+This resource does not support any arguments.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - AWS Account ID.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import the resource using the current AWS account ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import the resource using the current AWS account ID. For example:
+
+```console
+% terraform import aws_ram_sharing_with_organization.example 123456789012
+```
+
+<!-- cache-key: cdktf-0.18.0 input-0c4fa7fe1ef6a2bea6e88c0be32053d41d723ebfb97b9b5e06eddaaf8a239ae7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ram_sharing_with_organization.markdown b/website/docs/cdktf/python/r/ram_sharing_with_organization.markdown
new file mode 100644
index 00000000000..60908532bca
--- /dev/null
+++ b/website/docs/cdktf/python/r/ram_sharing_with_organization.markdown
@@ -0,0 +1,63 @@
+---
+subcategory: "RAM (Resource Access Manager)"
+layout: "aws"
+page_title: "AWS: aws_ram_sharing_with_organization"
+description: |-
+  Manages Resource Access Manager (RAM) Resource Sharing with AWS Organizations.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ram_sharing_with_organization
+
+Manages Resource Access Manager (RAM) Resource Sharing with AWS Organizations. If you enable sharing with your organization, you can share resources without using invitations. Refer to the [AWS RAM user guide](https://docs.aws.amazon.com/ram/latest/userguide/getting-started-sharing.html#getting-started-sharing-orgs) for more details.
+
+~> **NOTE:** Use this resource to manage resource sharing within your organization, **not** the [`aws_organizations_organization`](organizations_organization.html) resource with `ram.amazonaws.com` configured in `aws_service_access_principals`.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws. import RamSharingWithOrganization
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        RamSharingWithOrganization(self, "example")
+```
+
+## Argument Reference
+
+This resource does not support any arguments.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - AWS Account ID.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import the resource using the current AWS account ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import the resource using the current AWS account ID. For example:
+
+```console
+% terraform import aws_ram_sharing_with_organization.example 123456789012
+```
+
+<!-- cache-key: cdktf-0.18.0 input-0c4fa7fe1ef6a2bea6e88c0be32053d41d723ebfb97b9b5e06eddaaf8a239ae7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/rbin_rule.html.markdown b/website/docs/cdktf/python/r/rbin_rule.html.markdown
new file mode 100644
index 00000000000..4687d9b1c49
--- /dev/null
+++ b/website/docs/cdktf/python/r/rbin_rule.html.markdown
@@ -0,0 +1,120 @@
+---
+subcategory: "Recycle Bin (RBin)"
+layout: "aws"
+page_title: "AWS: aws_rbin_rule"
+description: |-
+  Terraform resource for managing an AWS RBin Rule.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_rbin_rule
+
+Terraform resource for managing an AWS RBin Rule.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.rbin_rule import RbinRule
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        RbinRule(self, "example",
+            description="example_rule",
+            resource_tags=[RbinRuleResourceTags(
+                resource_tag_key="tag_key",
+                resource_tag_value="tag_value"
+            )
+            ],
+            resource_type="EBS_SNAPSHOT",
+            retention_period=RbinRuleRetentionPeriod(
+                retention_period_unit="DAYS",
+                retention_period_value=10
+            ),
+            tags={
+                "test_tag_key": "test_tag_value"
+            }
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `resource_type` - (Required) The resource type to be retained by the retention rule. Valid values are `EBS_SNAPSHOT` and `EC2_IMAGE`.
+* `retention_period` - (Required) Information about the retention period for which the retention rule is to retain resources. See [`retention_period`](#retention_period) below.
+
+The following arguments are optional:
+
+* `description` - (Optional) The retention rule description.
+* `resource_tags` - (Optional) Specifies the resource tags to use to identify resources that are to be retained by a tag-level retention rule. See [`resource_tags`](#resource_tags) below.
+* `lock_configuration` - (Optional) Information about the retention rule lock configuration. See [`lock_configuration`](#lock_configuration) below.
+
+### retention_period
+
+The following arguments are required:
+
+* `retention_period_unit` - (Required) The unit of time in which the retention period is measured. Currently, only DAYS is supported.
+* `retention_period_value` - (Required) The period value for which the retention rule is to retain resources. The period is measured using the unit specified for RetentionPeriodUnit.
+
+### resource_tags
+
+The following argument is required:
+
+* `resource_tag_key` - (Required) The tag key.
+
+The following argument is optional:
+
+* `resource_tag_value` - (Optional) The tag value.
+
+### lock_configuration
+
+The following argument is required:
+
+* `unlock_delay` - (Required) Information about the retention rule unlock delay. See [`unlock_delay`](#unlock_delay) below.
+
+### unlock_delay
+
+The following arguments are required:
+
+* `unlock_delay_unit` - (Required) The unit of time in which to measure the unlock delay. Currently, the unlock delay can be measure only in days.
+* `unlock_delay_value` - (Required) The unlock delay period, measured in the unit specified for UnlockDelayUnit.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - (String) ID of the Rule.
+* `lock_end_time` - (Timestamp) The date and time at which the unlock delay is set to expire. Only returned for retention rules that have been unlocked and that are still within the unlock delay period.
+* `lock_state` - (Optional) The lock state of the retention rules to list. Only retention rules with the specified lock state are returned. Valid values are `locked`, `pending_unlock`, `unlocked`.
+* `status` - (String) The state of the retention rule. Only retention rules that are in the `available` state retain resources. Valid values include `pending` and `available`.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import RBin Rule using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import RBin Rule using the `id`. For example:
+
+```console
+% terraform import aws_rbin_rule.example examplerule
+```
+
+<!-- cache-key: cdktf-0.18.0 input-fa128f027cec3535b461f4a8bc2a7d6697d0113ab8d96009de17320fb4fdffe0 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/rds_cluster.html.markdown b/website/docs/cdktf/python/r/rds_cluster.html.markdown
new file mode 100644
index 00000000000..5bea040d8ef
--- /dev/null
+++ b/website/docs/cdktf/python/r/rds_cluster.html.markdown
@@ -0,0 +1,591 @@
+---
+subcategory: "RDS (Relational Database)"
+layout: "aws"
+page_title: "AWS: aws_rds_cluster"
+description: |-
+  Manages an RDS Aurora Cluster
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_rds_cluster
+
+Manages a [RDS Aurora Cluster][2]. To manage cluster instances that inherit configuration from the cluster (when not running the cluster in `serverless` engine mode), see the [`aws_rds_cluster_instance` resource](/docs/providers/aws/r/rds_cluster_instance.html). To manage non-Aurora databases (e.g., MySQL, PostgreSQL, SQL Server, etc.), see the [`aws_db_instance` resource](/docs/providers/aws/r/db_instance.html).
+
+For information on the difference between the available Aurora MySQL engines
+see [Comparison between Aurora MySQL 1 and Aurora MySQL 2](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/AuroraMySQL.Updates.20180206.html)
+in the Amazon RDS User Guide.
+
+Changes to an RDS Cluster can occur when you manually change a
+parameter, such as `port`, and are reflected in the next maintenance
+window. Because of this, Terraform may report a difference in its planning
+phase because a modification has not yet taken place. You can use the
+`apply_immediately` flag to instruct the service to apply the change immediately
+(see documentation below).
+
+~> **Note:** using `apply_immediately` can result in a
+brief downtime as the server reboots. See the AWS Docs on [RDS Maintenance][4]
+for more information.
+
+~> **Note:** All arguments including the username and password will be stored in the raw state as plain-text.
+[Read more about sensitive data in state](https://www.terraform.io/docs/state/sensitive-data.html).
+
+~> **NOTE on RDS Clusters and RDS Cluster Role Associations:** Terraform provides both a standalone [RDS Cluster Role Association](rds_cluster_role_association.html) - (an association between an RDS Cluster and a single IAM Role) and
+an RDS Cluster resource with `iam_roles` attributes.
+Use one resource or the other to associate IAM Roles and RDS Clusters.
+Not doing so will cause a conflict of associations and will result in the association being overwritten.
+
+## Example Usage
+
+### Aurora MySQL 2.x (MySQL 5.7)
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.rds_cluster import RdsCluster
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        RdsCluster(self, "default",
+            availability_zones=["us-west-2a", "us-west-2b", "us-west-2c"],
+            backup_retention_period=5,
+            cluster_identifier="aurora-cluster-demo",
+            database_name="mydb",
+            engine="aurora-mysql",
+            engine_version="5.7.mysql_aurora.2.03.2",
+            master_password="bar",
+            master_username="foo",
+            preferred_backup_window="07:00-09:00"
+        )
+```
+
+### Aurora MySQL 1.x (MySQL 5.6)
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.rds_cluster import RdsCluster
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, engine):
+        super().__init__(scope, name)
+        RdsCluster(self, "default",
+            availability_zones=["us-west-2a", "us-west-2b", "us-west-2c"],
+            backup_retention_period=5,
+            cluster_identifier="aurora-cluster-demo",
+            database_name="mydb",
+            master_password="bar",
+            master_username="foo",
+            preferred_backup_window="07:00-09:00",
+            engine=engine
+        )
+```
+
+### Aurora with PostgreSQL engine
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.rds_cluster import RdsCluster
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        RdsCluster(self, "postgresql",
+            availability_zones=["us-west-2a", "us-west-2b", "us-west-2c"],
+            backup_retention_period=5,
+            cluster_identifier="aurora-cluster-demo",
+            database_name="mydb",
+            engine="aurora-postgresql",
+            master_password="bar",
+            master_username="foo",
+            preferred_backup_window="07:00-09:00"
+        )
+```
+
+### Aurora Multi-Master Cluster
+
+-> More information about Aurora Multi-Master Clusters can be found in the [RDS User Guide](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/aurora-multi-master.html).
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.rds_cluster import RdsCluster
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, engine):
+        super().__init__(scope, name)
+        RdsCluster(self, "example",
+            cluster_identifier="example",
+            db_subnet_group_name=Token.as_string(aws_db_subnet_group_example.name),
+            engine_mode="multimaster",
+            master_password="barbarbarbar",
+            master_username="foo",
+            skip_final_snapshot=True,
+            engine=engine
+        )
+```
+
+### RDS Multi-AZ Cluster
+
+-> More information about RDS Multi-AZ Clusters can be found in the [RDS User Guide](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/multi-az-db-clusters-concepts.html).
+
+To create a Multi-AZ RDS cluster, you must additionally specify the `engine`, `storage_type`, `allocated_storage`, `iops` and `db_cluster_instance_class` attributes.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.rds_cluster import RdsCluster
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        RdsCluster(self, "example",
+            allocated_storage=100,
+            availability_zones=["us-west-2a", "us-west-2b", "us-west-2c"],
+            cluster_identifier="example",
+            db_cluster_instance_class="db.r6gd.xlarge",
+            engine="mysql",
+            iops=1000,
+            master_password="mustbeeightcharaters",
+            master_username="test",
+            storage_type="io1"
+        )
+```
+
+### RDS Serverless v2 Cluster
+
+-> More information about RDS Serverless v2 Clusters can be found in the [RDS User Guide](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/aurora-serverless-v2.html).
+
+To create a Serverless v2 RDS cluster, you must additionally specify the `engine_mode` and `serverlessv2_scaling_configuration` attributes. An `aws_rds_cluster_instance` resource must also be added to the cluster with the `instance_class` attribute specified.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.rds_cluster import RdsCluster
+from imports.aws.rds_cluster_instance import RdsClusterInstance
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = RdsCluster(self, "example",
+            cluster_identifier="example",
+            database_name="test",
+            engine="aurora-postgresql",
+            engine_mode="provisioned",
+            engine_version="13.6",
+            master_password="must_be_eight_characters",
+            master_username="test",
+            serverlessv2_scaling_configuration=RdsClusterServerlessv2ScalingConfiguration(
+                max_capacity=1,
+                min_capacity=0.5
+            )
+        )
+        aws_rds_cluster_instance_example = RdsClusterInstance(self, "example_1",
+            cluster_identifier=example.id,
+            engine=example.engine,
+            engine_version=example.engine_version,
+            instance_class="db.serverless"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_rds_cluster_instance_example.override_logical_id("example")
+```
+
+### RDS/Aurora Managed Master Passwords via Secrets Manager, default KMS Key
+
+-> More information about RDS/Aurora Aurora integrates with Secrets Manager to manage master user passwords for your DB clusters can be found in the [RDS User Guide](https://aws.amazon.com/about-aws/whats-new/2022/12/amazon-rds-integration-aws-secrets-manager/) and [Aurora User Guide](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/rds-secrets-manager.html).
+
+You can specify the `manage_master_user_password` attribute to enable managing the master password with Secrets Manager. You can also update an existing cluster to use Secrets Manager by specify the `manage_master_user_password` attribute and removing the `master_password` attribute (removal is required).
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.rds_cluster import RdsCluster
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, engine):
+        super().__init__(scope, name)
+        RdsCluster(self, "test",
+            cluster_identifier="example",
+            database_name="test",
+            manage_master_user_password=True,
+            master_username="test",
+            engine=engine
+        )
+```
+
+### RDS/Aurora Managed Master Passwords via Secrets Manager, specific KMS Key
+
+-> More information about RDS/Aurora Aurora integrates with Secrets Manager to manage master user passwords for your DB clusters can be found in the [RDS User Guide](https://aws.amazon.com/about-aws/whats-new/2022/12/amazon-rds-integration-aws-secrets-manager/) and [Aurora User Guide](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/rds-secrets-manager.html).
+
+You can specify the `master_user_secret_kms_key_id` attribute to specify a specific KMS Key.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.kms_key import KmsKey
+from imports.aws.rds_cluster import RdsCluster
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, engine):
+        super().__init__(scope, name)
+        example = KmsKey(self, "example",
+            description="Example KMS Key"
+        )
+        RdsCluster(self, "test",
+            cluster_identifier="example",
+            database_name="test",
+            manage_master_user_password=True,
+            master_user_secret_kms_key_id=example.key_id,
+            master_username="test",
+            engine=engine
+        )
+```
+
+### Global Cluster Restored From Snapshot
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from cdktf import TerraformResourceLifecycle
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_db_cluster_snapshot import DataAwsDbClusterSnapshot
+from imports.aws.rds_cluster import RdsCluster
+from imports.aws.rds_global_cluster import RdsGlobalCluster
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = DataAwsDbClusterSnapshot(self, "example",
+            db_cluster_identifier="example-original-cluster",
+            most_recent=True
+        )
+        aws_rds_cluster_example = RdsCluster(self, "example_1",
+            cluster_identifier="example",
+            engine="aurora",
+            engine_version="5.6.mysql_aurora.1.22.4",
+            lifecycle=TerraformResourceLifecycle(
+                ignore_changes=[snapshot_identifier, global_cluster_identifier]
+            ),
+            snapshot_identifier=Token.as_string(example.id)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_rds_cluster_example.override_logical_id("example")
+        aws_rds_global_cluster_example = RdsGlobalCluster(self, "example_2",
+            force_destroy=True,
+            global_cluster_identifier="example",
+            source_db_cluster_identifier=Token.as_string(aws_rds_cluster_example.arn)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_rds_global_cluster_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+For more detailed documentation about each argument, refer to
+the AWS official documentation :
+
+* [create-db-cluster](https://docs.aws.amazon.com/cli/latest/reference/rds/create-db-cluster.html)
+* [modify-db-cluster](https://docs.aws.amazon.com/cli/latest/reference/rds/modify-db-cluster.html)
+
+This argument supports the following arguments:
+
+* `allocated_storage` - (Optional, Required for Multi-AZ DB cluster) The amount of storage in gibibytes (GiB) to allocate to each DB instance in the Multi-AZ DB cluster.
+* `allow_major_version_upgrade` - (Optional) Enable to allow major engine version upgrades when changing engine versions. Defaults to `false`.
+* `apply_immediately` - (Optional) Specifies whether any cluster modifications are applied immediately, or during the next maintenance window. Default is `false`. See [Amazon RDS Documentation for more information.](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.DBInstance.Modifying.html)
+* `availability_zones` - (Optional) List of EC2 Availability Zones for the DB cluster storage where DB cluster instances can be created.
+  RDS automatically assigns 3 AZs if less than 3 AZs are configured, which will show as a difference requiring resource recreation next Terraform apply.
+  We recommend specifying 3 AZs or using [the `lifecycle` configuration block `ignore_changes` argument](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html#ignore_changes) if necessary.
+  A maximum of 3 AZs can be configured.
+* `backtrack_window` - (Optional) Target backtrack window, in seconds. Only available for `aurora` and `aurora-mysql` engines currently. To disable backtracking, set this value to `0`. Defaults to `0`. Must be between `0` and `259200` (72 hours)
+* `backup_retention_period` - (Optional) Days to retain backups for. Default `1`
+* `cluster_identifier_prefix` - (Optional, Forces new resource) Creates a unique cluster identifier beginning with the specified prefix. Conflicts with `cluster_identifier`.
+* `cluster_identifier` - (Optional, Forces new resources) The cluster identifier. If omitted, Terraform will assign a random, unique identifier.
+* `copy_tags_to_snapshot` – (Optional, boolean) Copy all Cluster `tags` to snapshots. Default is `false`.
+* `database_name` - (Optional) Name for an automatically created database on cluster creation. There are different naming restrictions per database engine: [RDS Naming Constraints][5]
+* `db_cluster_instance_class` - (Optional, Required for Multi-AZ DB cluster) The compute and memory capacity of each DB instance in the Multi-AZ DB cluster, for example `db.m6g.xlarge`. Not all DB instance classes are available in all AWS Regions, or for all database engines. For the full list of DB instance classes and availability for your engine, see [DB instance class](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Concepts.DBInstanceClass.html) in the Amazon RDS User Guide.
+* `db_cluster_parameter_group_name` - (Optional) A cluster parameter group to associate with the cluster.
+* `db_instance_parameter_group_name` - (Optional) Instance parameter group to associate with all instances of the DB cluster. The `db_instance_parameter_group_name` parameter is only valid in combination with the `allow_major_version_upgrade` parameter.
+* `db_subnet_group_name` - (Optional) DB subnet group to associate with this DB cluster.
+  **NOTE:** This must match the `db_subnet_group_name` specified on every [`aws_rds_cluster_instance`](/docs/providers/aws/r/rds_cluster_instance.html) in the cluster.
+* `db_system_id` - (Optional) For use with RDS Custom.
+* `deletion_protection` - (Optional) If the DB cluster should have deletion protection enabled.
+  The database can't be deleted when this value is set to `true`.
+  The default is `false`.
+* `enable_global_write_forwarding` - (Optional) Whether cluster should forward writes to an associated global cluster. Applied to secondary clusters to enable them to forward writes to an [`aws_rds_global_cluster`](/docs/providers/aws/r/rds_global_cluster.html)'s primary cluster. See the [Aurora Userguide documentation](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/aurora-global-database-write-forwarding.html) for more information.
+* `enable_http_endpoint` - (Optional) Enable HTTP endpoint (data API). Only valid when `engine_mode` is set to `serverless`.
+* `enabled_cloudwatch_logs_exports` - (Optional) Set of log types to export to cloudwatch. If omitted, no logs will be exported. The following log types are supported: `audit`, `error`, `general`, `slowquery`, `postgresql` (PostgreSQL).
+* `engine_mode` - (Optional) Database engine mode. Valid values: `global` (only valid for Aurora MySQL 1.21 and earlier), `multimaster`, `parallelquery`, `provisioned`, `serverless`. Defaults to: `provisioned`. See the [RDS User Guide](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/aurora-serverless.html) for limitations when using `serverless`.
+* `engine_version` - (Optional) Database engine version. Updating this argument results in an outage. See the [Aurora MySQL](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/AuroraMySQL.Updates.html) and [Aurora Postgres](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/AuroraPostgreSQL.Updates.html) documentation for your configured engine to determine this value, or by running `aws rds describe-db-engine-versions`. For example with Aurora MySQL 2, a potential value for this argument is `5.7.mysql_aurora.2.03.2`. The value can contain a partial version where supported by the API. The actual engine version used is returned in the attribute `engine_version_actual`, , see [Attribute Reference](#attribute-reference) below.
+* `engine` - (Required) Name of the database engine to be used for this DB cluster. Valid Values: `aurora-mysql`, `aurora-postgresql`, `mysql`, `postgres`. (Note that `mysql` and `postgres` are Multi-AZ RDS clusters).
+* `final_snapshot_identifier` - (Optional) Name of your final DB snapshot when this DB cluster is deleted. If omitted, no final snapshot will be made.
+* `global_cluster_identifier` - (Optional) Global cluster identifier specified on [`aws_rds_global_cluster`](/docs/providers/aws/r/rds_global_cluster.html).
+* `iam_database_authentication_enabled` - (Optional) Specifies whether or not mappings of AWS Identity and Access Management (IAM) accounts to database accounts is enabled. Please see [AWS Documentation](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/UsingWithRDS.IAMDBAuth.html) for availability and limitations.
+* `iam_roles` - (Optional) List of ARNs for the IAM roles to associate to the RDS Cluster.
+* `iops` - (Optional) Amount of Provisioned IOPS (input/output operations per second) to be initially allocated for each DB instance in the Multi-AZ DB cluster. For information about valid Iops values, see [Amazon RDS Provisioned IOPS storage to improve performance](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_Storage.html#USER_PIOPS) in the Amazon RDS User Guide. (This setting is required to create a Multi-AZ DB cluster). Must be a multiple between .5 and 50 of the storage amount for the DB cluster.
+* `kms_key_id` - (Optional) ARN for the KMS encryption key. When specifying `kms_key_id`, `storage_encrypted` needs to be set to true.
+* `manage_master_user_password` - (Optional) Set to true to allow RDS to manage the master user password in Secrets Manager. Cannot be set if `master_password` is provided.
+* `master_password` - (Required unless `manage_master_user_password` is set to true or unless a `snapshot_identifier` or `replication_source_identifier` is provided or unless a `global_cluster_identifier` is provided when the cluster is the "secondary" cluster of a global database) Password for the master DB user. Note that this may show up in logs, and it will be stored in the state file. Please refer to the [RDS Naming Constraints][5]. Cannot be set if `manage_master_user_password` is set to `true`.
+* `master_user_secret_kms_key_id` - (Optional) Amazon Web Services KMS key identifier is the key ARN, key ID, alias ARN, or alias name for the KMS key. To use a KMS key in a different Amazon Web Services account, specify the key ARN or alias ARN. If not specified, the default KMS key for your Amazon Web Services account is used.
+* `master_username` - (Required unless a `snapshot_identifier` or `replication_source_identifier` is provided or unless a `global_cluster_identifier` is provided when the cluster is the "secondary" cluster of a global database) Username for the master DB user. Please refer to the [RDS Naming Constraints][5]. This argument does not support in-place updates and cannot be changed during a restore from snapshot.
+* `network_type` - (Optional) Network type of the cluster. Valid values: `IPV4`, `DUAL`.
+* `port` - (Optional) Port on which the DB accepts connections
+* `preferred_backup_window` - (Optional) Daily time range during which automated backups are created if automated backups are enabled using the BackupRetentionPeriod parameter.Time in UTC. Default: A 30-minute window selected at random from an 8-hour block of time per regionE.g., 04:00-09:00
+* `preferred_maintenance_window` - (Optional) Weekly time range during which system maintenance can occur, in (UTC) e.g., wed:04:00-wed:04:30
+* `replication_source_identifier` - (Optional) ARN of a source DB cluster or DB instance if this DB cluster is to be created as a Read Replica. If DB Cluster is part of a Global Cluster, use the [`lifecycle` configuration block `ignore_changes` argument](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html#ignore_changes) to prevent Terraform from showing differences for this argument instead of configuring this value.
+* `restore_to_point_in_time` - (Optional) Nested attribute for [point in time restore](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/USER_PIT.html). More details below.
+* `scaling_configuration` - (Optional) Nested attribute with scaling properties. Only valid when `engine_mode` is set to `serverless`. More details below.
+* `serverlessv2_scaling_configuration`- (Optional) Nested attribute with scaling properties for ServerlessV2. Only valid when `engine_mode` is set to `provisioned`. More details below.
+* `skip_final_snapshot` - (Optional) Determines whether a final DB snapshot is created before the DB cluster is deleted. If true is specified, no DB snapshot is created. If false is specified, a DB snapshot is created before the DB cluster is deleted, using the value from `final_snapshot_identifier`. Default is `false`.
+* `snapshot_identifier` - (Optional) Specifies whether or not to create this cluster from a snapshot. You can use either the name or ARN when specifying a DB cluster snapshot, or the ARN when specifying a DB snapshot. Conflicts with `global_cluster_identifier`. Clusters cannot be restored from snapshot **and** joined to an existing global cluster in a single operation. See the [AWS documentation](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/aurora-global-database-getting-started.html#aurora-global-database.use-snapshot) or the [Global Cluster Restored From Snapshot example](#global-cluster-restored-from-snapshot) for instructions on building a global cluster starting with a snapshot.
+* `source_region` - (Optional) The source region for an encrypted replica DB cluster.
+* `storage_encrypted` - (Optional) Specifies whether the DB cluster is encrypted. The default is `false` for `provisioned` `engine_mode` and `true` for `serverless` `engine_mode`. When restoring an unencrypted `snapshot_identifier`, the `kms_key_id` argument must be provided to encrypt the restored cluster. Terraform will only perform drift detection if a configuration value is provided.
+* `storage_type` - (Optional, Required for Multi-AZ DB cluster) (Forces new for Multi-AZ DB clusters) Specifies the storage type to be associated with the DB cluster. For Aurora DB clusters, `storage_type` modifications can be done in-place. For Multi-AZ DB Clusters, the `iops` argument must also be set. Valid values are: `""`, `aurora-iopt1` (Aurora DB Clusters); `io1` (Multi-AZ DB Clusters). Default: `""` (Aurora DB Clusters); `io1` (Multi-AZ DB Clusters).
+* `tags` - (Optional) A map of tags to assign to the DB cluster. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `vpc_security_group_ids` - (Optional) List of VPC security groups to associate with the Cluster
+
+### S3 Import Options
+
+Full details on the core parameters and impacts are in the API Docs: [RestoreDBClusterFromS3](https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_RestoreDBClusterFromS3.html). Requires that the S3 bucket be in the same region as the RDS cluster you're trying to create. Sample:
+
+~> **NOTE:** RDS Aurora Serverless does not support loading data from S3, so its not possible to directly use `engine_mode` set to `serverless` with `s3_import`.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.rds_cluster import RdsCluster
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        RdsCluster(self, "db",
+            engine="aurora",
+            s3_import=RdsClusterS3Import(
+                bucket_name="mybucket",
+                bucket_prefix="backups",
+                ingestion_role="arn:aws:iam::1234567890:role/role-xtrabackup-rds-restore",
+                source_engine="mysql",
+                source_engine_version="5.6"
+            )
+        )
+```
+
+* `bucket_name` - (Required) Bucket name where your backup is stored
+* `bucket_prefix` - (Optional) Can be blank, but is the path to your backup
+* `ingestion_role` - (Required) Role applied to load the data.
+* `source_engine` - (Required) Source engine for the backup
+* `source_engine_version` - (Required) Version of the source engine used to make the backup
+
+This will not recreate the resource if the S3 object changes in some way. It's only used to initialize the database. This only works currently with the aurora engine. See AWS for currently supported engines and options. See [Aurora S3 Migration Docs](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/AuroraMySQL.Migrating.ExtMySQL.html#AuroraMySQL.Migrating.ExtMySQL.S3).
+
+### restore_to_point_in_time Argument Reference
+
+~> **NOTE:**  The DB cluster is created from the source DB cluster with the same configuration as the original DB cluster, except that the new DB cluster is created with the default DB security group. Thus, the following arguments should only be specified with the source DB cluster's respective values: `database_name`, `master_username`, `storage_encrypted`, `replication_source_identifier`, and `source_region`.
+
+Example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.rds_cluster import RdsCluster
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, engine):
+        super().__init__(scope, name)
+        RdsCluster(self, "example-clone",
+            restore_to_point_in_time=RdsClusterRestoreToPointInTime(
+                restore_type="copy-on-write",
+                source_cluster_identifier="example",
+                use_latest_restorable_time=True
+            ),
+            engine=engine
+        )
+```
+
+* `source_cluster_identifier` - (Required) Identifier of the source database cluster from which to restore. When restoring from a cluster in another AWS account, the identifier is the ARN of that cluster.
+* `restore_type` - (Optional) Type of restore to be performed.
+   Valid options are `full-copy` (default) and `copy-on-write`.
+* `use_latest_restorable_time` - (Optional) Set to true to restore the database cluster to the latest restorable backup time. Defaults to false. Conflicts with `restore_to_time`.
+* `restore_to_time` - (Optional) Date and time in UTC format to restore the database cluster to. Conflicts with `use_latest_restorable_time`.
+
+### scaling_configuration Argument Reference
+
+~> **NOTE:** `scaling_configuration` configuration is only valid when `engine_mode` is set to `serverless`.
+
+Example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.rds_cluster import RdsCluster
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, engine):
+        super().__init__(scope, name)
+        RdsCluster(self, "example",
+            engine_mode="serverless",
+            scaling_configuration=RdsClusterScalingConfiguration(
+                auto_pause=True,
+                max_capacity=256,
+                min_capacity=2,
+                seconds_until_auto_pause=300,
+                timeout_action="ForceApplyCapacityChange"
+            ),
+            engine=engine
+        )
+```
+
+* `auto_pause` - (Optional) Whether to enable automatic pause. A DB cluster can be paused only when it's idle (it has no connections). If a DB cluster is paused for more than seven days, the DB cluster might be backed up with a snapshot. In this case, the DB cluster is restored when there is a request to connect to it. Defaults to `true`.
+* `max_capacity` - (Optional) Maximum capacity for an Aurora DB cluster in `serverless` DB engine mode. The maximum capacity must be greater than or equal to the minimum capacity. Valid Aurora MySQL capacity values are `1`, `2`, `4`, `8`, `16`, `32`, `64`, `128`, `256`. Valid Aurora PostgreSQL capacity values are (`2`, `4`, `8`, `16`, `32`, `64`, `192`, and `384`). Defaults to `16`.
+* `min_capacity` - (Optional) Minimum capacity for an Aurora DB cluster in `serverless` DB engine mode. The minimum capacity must be lesser than or equal to the maximum capacity. Valid Aurora MySQL capacity values are `1`, `2`, `4`, `8`, `16`, `32`, `64`, `128`, `256`. Valid Aurora PostgreSQL capacity values are (`2`, `4`, `8`, `16`, `32`, `64`, `192`, and `384`). Defaults to `1`.
+* `seconds_until_auto_pause` - (Optional) Time, in seconds, before an Aurora DB cluster in serverless mode is paused. Valid values are `300` through `86400`. Defaults to `300`.
+* `timeout_action` - (Optional) Action to take when the timeout is reached. Valid values: `ForceApplyCapacityChange`, `RollbackCapacityChange`. Defaults to `RollbackCapacityChange`. See [documentation](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/aurora-serverless.how-it-works.html#aurora-serverless.how-it-works.timeout-action).
+
+### serverlessv2_scaling_configuration Argument Reference
+
+~> **NOTE:** serverlessv2_scaling_configuration configuration is only valid when engine_mode is set to provisioned
+
+Example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.rds_cluster import RdsCluster
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, engine):
+        super().__init__(scope, name)
+        RdsCluster(self, "example",
+            serverlessv2_scaling_configuration=RdsClusterServerlessv2ScalingConfiguration(
+                max_capacity=128,
+                min_capacity=0.5
+            ),
+            engine=engine
+        )
+```
+
+* `max_capacity` - (Required) Maximum capacity for an Aurora DB cluster in `provisioned` DB engine mode. The maximum capacity must be greater than or equal to the minimum capacity. Valid capacity values are in a range of `0.5` up to `128` in steps of `0.5`.
+* `min_capacity` - (Required) Minimum capacity for an Aurora DB cluster in `provisioned` DB engine mode. The minimum capacity must be lesser than or equal to the maximum capacity. Valid capacity values are in a range of `0.5` up to `128` in steps of `0.5`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of cluster
+* `id` - RDS Cluster Identifier
+* `cluster_identifier` - RDS Cluster Identifier
+* `cluster_resource_id` - RDS Cluster Resource ID
+* `cluster_members` – List of RDS Instances that are a part of this cluster
+* `availability_zones` - Availability zone of the instance
+* `backup_retention_period` - Backup retention period
+* `preferred_backup_window` - Daily time range during which the backups happen
+* `preferred_maintenance_window` - Maintenance window
+* `endpoint` - DNS address of the RDS instance
+* `reader_endpoint` - Read-only endpoint for the Aurora cluster, automatically
+load-balanced across replicas
+* `engine` - Database engine
+* `engine_version_actual` - Running version of the database.
+* `database_name` - Database name
+* `port` - Database port
+* `master_username` - Master username for the database
+* `master_user_secret` - Block that specifies the master user secret. Only available when `manage_master_user_password` is set to true. [Documented below](#master_user_secret).
+* `storage_encrypted` - Specifies whether the DB cluster is encrypted
+* `replication_source_identifier` - ARN of the source DB cluster or DB instance if this DB cluster is created as a Read Replica.
+* `hosted_zone_id` - Route53 Hosted Zone ID of the endpoint
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+[1]: https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.Replication.html
+[2]: https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_Aurora.html
+[3]: /docs/providers/aws/r/rds_cluster_instance.html
+[4]: https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_UpgradeDBInstance.Maintenance.html
+[5]: http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_Limits.html#RDS_Limits.Constraints
+
+### master_user_secret
+
+The `master_user_secret` configuration block supports the following attributes:
+
+* `kms_key_id` - Amazon Web Services KMS key identifier that is used to encrypt the secret.
+* `secret_arn` - Amazon Resource Name (ARN) of the secret.
+* `secret_status` - Status of the secret. Valid Values: `creating` | `active` | `rotating` | `impaired`.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `120m`)
+- `update` - (Default `120m`)
+- `delete` - (Default `120m`)
+any cleanup task during the destroying process.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import RDS Clusters using the `cluster_identifier`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import RDS Clusters using the `cluster_identifier`. For example:
+
+```console
+% terraform import aws_rds_cluster.aurora_cluster aurora-prod-cluster
+```
+
+<!-- cache-key: cdktf-0.18.0 input-a76812360c43b35e98c5b13afa036fb8cb63cbbf7dbd975d84293aab1f4fed49 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/rds_cluster_activity_stream.html.markdown b/website/docs/cdktf/python/r/rds_cluster_activity_stream.html.markdown
new file mode 100644
index 00000000000..72316cad286
--- /dev/null
+++ b/website/docs/cdktf/python/r/rds_cluster_activity_stream.html.markdown
@@ -0,0 +1,114 @@
+---
+subcategory: "RDS (Relational Database)"
+layout: "aws"
+page_title: "AWS: aws_rds_cluster_activity_stream"
+description: |-
+  Manages RDS Aurora Cluster Database Activity Streams
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_rds_cluster_activity_stream
+
+Manages RDS Aurora Cluster Database Activity Streams.
+
+Database Activity Streams have some limits and requirements, refer to the [Monitoring Amazon Aurora using Database Activity Streams][1] documentation for detailed limitations and requirements.
+
+~> **Note:** This resource always calls the RDS [`StartActivityStream`][2] API with the `ApplyImmediately` parameter set to `true`. This is because the Terraform needs the activity stream to be started in order for it to get the associated attributes.
+
+~> **Note:** This resource depends on having at least one `aws_rds_cluster_instance` created. To avoid race conditions when all resources are being created together, add an explicit resource reference using the [resource `depends_on` meta-argument](https://www.terraform.io/docs/configuration/resources.html#depends_on-explicit-resource-dependencies).
+
+~> **Note:** This resource is available in all regions except the following: `cn-north-1`, `cn-northwest-1`, `us-gov-east-1`, `us-gov-west-1`
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.kms_key import KmsKey
+from imports.aws.rds_cluster import RdsCluster
+from imports.aws.rds_cluster_activity_stream import RdsClusterActivityStream
+from imports.aws.rds_cluster_instance import RdsClusterInstance
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        default_var = KmsKey(self, "default",
+            description="AWS KMS Key to encrypt Database Activity Stream"
+        )
+        aws_rds_cluster_default = RdsCluster(self, "default_1",
+            availability_zones=["us-west-2a", "us-west-2b", "us-west-2c"],
+            cluster_identifier="aurora-cluster-demo",
+            database_name="mydb",
+            engine="aurora-postgresql",
+            engine_version="13.4",
+            master_password="mustbeeightcharaters",
+            master_username="foo"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_rds_cluster_default.override_logical_id("default")
+        aws_rds_cluster_instance_default = RdsClusterInstance(self, "default_2",
+            cluster_identifier=Token.as_string(aws_rds_cluster_default.cluster_identifier),
+            engine=Token.as_string(aws_rds_cluster_default.engine),
+            identifier="aurora-instance-demo",
+            instance_class="db.r6g.large"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_rds_cluster_instance_default.override_logical_id("default")
+        aws_rds_cluster_activity_stream_default = RdsClusterActivityStream(self, "default_3",
+            depends_on=[aws_rds_cluster_instance_default],
+            kms_key_id=default_var.key_id,
+            mode="async",
+            resource_arn=Token.as_string(aws_rds_cluster_default.arn)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_rds_cluster_activity_stream_default.override_logical_id("default")
+```
+
+## Argument Reference
+
+For more detailed documentation about each argument, refer to
+the [AWS official documentation][3].
+
+This argument supports the following arguments:
+
+* `resource_arn` - (Required, Forces new resources) The Amazon Resource Name (ARN) of the DB cluster.
+* `mode` - (Required, Forces new resources) Specifies the mode of the database activity stream. Database events such as a change or access generate an activity stream event. The database session can handle these events either synchronously or asynchronously. One of: `sync`, `async`.
+* `kms_key_id` - (Required, Forces new resources) The AWS KMS key identifier for encrypting messages in the database activity stream. The AWS KMS key identifier is the key ARN, key ID, alias ARN, or alias name for the KMS key.
+* `engine_native_audit_fields_included` - (Optional, Forces new resources) Specifies whether the database activity stream includes engine-native audit fields. This option only applies to an Oracle DB instance. By default, no engine-native audit fields are included. Defaults `false`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Amazon Resource Name (ARN) of the DB cluster.
+* `kinesis_stream_name` - The name of the Amazon Kinesis data stream to be used for the database activity stream.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import RDS Aurora Cluster Database Activity Streams using the `resource_arn`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import RDS Aurora Cluster Database Activity Streams using the `resource_arn`. For example:
+
+```console
+% terraform import aws_rds_cluster_activity_stream.default arn:aws:rds:us-west-2:123456789012:cluster:aurora-cluster-demo
+```
+
+[1]: https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/DBActivityStreams.html
+[2]: https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_StartActivityStream.html
+[3]: https://docs.aws.amazon.com/cli/latest/reference/rds/start-activity-stream.html
+
+<!-- cache-key: cdktf-0.18.0 input-fcf3731d612996fd4027d7e88ab025bc39f9569cb19372c8fee944d11a24a797 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/rds_cluster_endpoint.html.markdown b/website/docs/cdktf/python/r/rds_cluster_endpoint.html.markdown
new file mode 100644
index 00000000000..0eeda68d3f8
--- /dev/null
+++ b/website/docs/cdktf/python/r/rds_cluster_endpoint.html.markdown
@@ -0,0 +1,124 @@
+---
+subcategory: "RDS (Relational Database)"
+layout: "aws"
+page_title: "AWS: aws_rds_cluster_endpoint"
+description: |-
+  Manages an RDS Aurora Cluster Endpoint
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_rds_cluster_endpoint
+
+Manages an RDS Aurora Cluster Endpoint.
+You can refer to the [User Guide][1].
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.rds_cluster import RdsCluster
+from imports.aws.rds_cluster_endpoint import RdsClusterEndpoint
+from imports.aws.rds_cluster_instance import RdsClusterInstance
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, engine):
+        super().__init__(scope, name)
+        default_var = RdsCluster(self, "default",
+            availability_zones=["us-west-2a", "us-west-2b", "us-west-2c"],
+            backup_retention_period=5,
+            cluster_identifier="aurora-cluster-demo",
+            database_name="mydb",
+            master_password="bar",
+            master_username="foo",
+            preferred_backup_window="07:00-09:00",
+            engine=engine
+        )
+        test1 = RdsClusterInstance(self, "test1",
+            apply_immediately=True,
+            cluster_identifier=default_var.id,
+            engine=default_var.engine,
+            engine_version=default_var.engine_version,
+            identifier="test1",
+            instance_class="db.t2.small"
+        )
+        test2 = RdsClusterInstance(self, "test2",
+            apply_immediately=True,
+            cluster_identifier=default_var.id,
+            engine=default_var.engine,
+            engine_version=default_var.engine_version,
+            identifier="test2",
+            instance_class="db.t2.small"
+        )
+        test3 = RdsClusterInstance(self, "test3",
+            apply_immediately=True,
+            cluster_identifier=default_var.id,
+            engine=default_var.engine,
+            engine_version=default_var.engine_version,
+            identifier="test3",
+            instance_class="db.t2.small"
+        )
+        RdsClusterEndpoint(self, "eligible",
+            cluster_endpoint_identifier="reader",
+            cluster_identifier=default_var.id,
+            custom_endpoint_type="READER",
+            excluded_members=[test1.id, test2.id]
+        )
+        RdsClusterEndpoint(self, "static",
+            cluster_endpoint_identifier="static",
+            cluster_identifier=default_var.id,
+            custom_endpoint_type="READER",
+            static_members=[test1.id, test3.id]
+        )
+```
+
+## Argument Reference
+
+For more detailed documentation about each argument, refer to
+the [AWS official documentation](https://docs.aws.amazon.com/cli/latest/reference/rds/create-db-cluster-endpoint.html).
+
+This argument supports the following arguments:
+
+* `cluster_identifier` - (Required, Forces new resources) The cluster identifier.
+* `cluster_endpoint_identifier` - (Required, Forces new resources) The identifier to use for the new endpoint. This parameter is stored as a lowercase string.
+* `custom_endpoint_type` - (Required) The type of the endpoint. One of: READER , ANY .
+* `static_members` - (Optional) List of DB instance identifiers that are part of the custom endpoint group. Conflicts with `excluded_members`.
+* `excluded_members` - (Optional) List of DB instance identifiers that aren't part of the custom endpoint group. All other eligible instances are reachable through the custom endpoint. Only relevant if the list of static members is empty. Conflicts with `static_members`.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of cluster
+* `id` - The RDS Cluster Endpoint Identifier
+* `endpoint` - A custom endpoint for the Aurora cluster
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import RDS Clusters Endpoint using the `cluster_endpoint_identifier`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import RDS Clusters Endpoint using the `cluster_endpoint_identifier`. For example:
+
+```console
+% terraform import aws_rds_cluster_endpoint.custom_reader aurora-prod-cluster-custom-reader
+```
+
+[1]: https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/Aurora.Overview.Endpoints.html#Aurora.Endpoints.Cluster
+
+<!-- cache-key: cdktf-0.18.0 input-434900fb7bad99c986024771dc6f6eede1b08db3846985a86234a5c3c5be241e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/rds_cluster_instance.html.markdown b/website/docs/cdktf/python/r/rds_cluster_instance.html.markdown
new file mode 100644
index 00000000000..c833d3f7eab
--- /dev/null
+++ b/website/docs/cdktf/python/r/rds_cluster_instance.html.markdown
@@ -0,0 +1,156 @@
+---
+subcategory: "RDS (Relational Database)"
+layout: "aws"
+page_title: "AWS: aws_rds_cluster_instance"
+description: |-
+  Provides an RDS Cluster Resource Instance
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_rds_cluster_instance
+
+Provides an RDS Cluster Instance Resource. A Cluster Instance Resource defines
+attributes that are specific to a single instance in a [RDS Cluster][3],
+specifically running Amazon Aurora.
+
+Unlike other RDS resources that support replication, with Amazon Aurora you do
+not designate a primary and subsequent replicas. Instead, you simply add RDS
+Instances and Aurora manages the replication. You can use the [count][5]
+meta-parameter to make multiple instances and join them all to the same RDS
+Cluster, or you may specify different Cluster Instance resources with various
+`instance_class` sizes.
+
+For more information on Amazon Aurora, see [Aurora on Amazon RDS][2] in the Amazon RDS User Guide.
+
+~> **NOTE:** Deletion Protection from the RDS service can only be enabled at the cluster level, not for individual cluster instances. You can still add the [`prevent_destroy` lifecycle behavior](https://www.terraform.io/language/meta-arguments/lifecycle#prevent_destroy) to your Terraform resource configuration if you desire protection from accidental deletion.
+
+~> **NOTE:** `aurora` is no longer a valid `engine` because of [Amazon Aurora's MySQL-Compatible Edition version 1 end of life](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/Aurora.MySQL56.EOL.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformCount, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.rds_cluster import RdsCluster
+from imports.aws.rds_cluster_instance import RdsClusterInstance
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, engine):
+        super().__init__(scope, name)
+        default_var = RdsCluster(self, "default",
+            availability_zones=["us-west-2a", "us-west-2b", "us-west-2c"],
+            cluster_identifier="aurora-cluster-demo",
+            database_name="mydb",
+            master_password="barbut8chars",
+            master_username="foo",
+            engine=engine
+        )
+        # In most cases loops should be handled in the programming language context and
+        #     not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+        #     you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+        #     you need to keep this like it is.
+        cluster_instances_count = TerraformCount.of(Token.as_number("2"))
+        RdsClusterInstance(self, "cluster_instances",
+            cluster_identifier=default_var.id,
+            engine=default_var.engine,
+            engine_version=default_var.engine_version,
+            identifier="aurora-cluster-demo-${" + cluster_instances_count.index + "}",
+            instance_class="db.r4.large",
+            count=cluster_instances_count
+        )
+```
+
+## Argument Reference
+
+For more detailed documentation about each argument, refer to
+the [AWS official documentation](https://docs.aws.amazon.com/cli/latest/reference/rds/create-db-instance.html).
+
+This argument supports the following arguments:
+
+* `apply_immediately` - (Optional) Specifies whether any database modifications are applied immediately, or during the next maintenance window. Default is`false`.
+* `auto_minor_version_upgrade` - (Optional) Indicates that minor engine upgrades will be applied automatically to the DB instance during the maintenance window. Default `true`.
+* `availability_zone` - (Optional, Computed, Forces new resource) EC2 Availability Zone that the DB instance is created in. See [docs](https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_CreateDBInstance.html) about the details.
+* `ca_cert_identifier` - (Optional) Identifier of the CA certificate for the DB instance.
+* `cluster_identifier` - (Required, Forces new resource) Identifier of the [`aws_rds_cluster`](/docs/providers/aws/r/rds_cluster.html) in which to launch this instance.
+* `copy_tags_to_snapshot` – (Optional, boolean) Indicates whether to copy all of the user-defined tags from the DB instance to snapshots of the DB instance. Default `false`.
+* `custom_iam_instance_profile` - (Optional) Instance profile associated with the underlying Amazon EC2 instance of an RDS Custom DB instance.
+* `db_parameter_group_name` - (Optional) Name of the DB parameter group to associate with this instance.
+* `db_subnet_group_name` - (Required if `publicly_accessible = false`, Optional otherwise, Forces new resource) DB subnet group to associate with this DB instance. **NOTE:** This must match the `db_subnet_group_name` of the attached [`aws_rds_cluster`](/docs/providers/aws/r/rds_cluster.html).
+* `engine_version` - (Optional) Database engine version.
+* `engine` - (Required, Forces new resource) Name of the database engine to be used for the RDS instance. Valid Values: `aurora-mysql`, `aurora-postgresql`, `mysql`, `postgres`.
+* `identifier_prefix` - (Optional, Forces new resource) Creates a unique identifier beginning with the specified prefix. Conflicts with `identifier`.
+* `identifier` - (Optional, Forces new resource) Identifier for the RDS instance, if omitted, Terraform will assign a random, unique identifier.
+* `instance_class` - (Required) Instance class to use. For details on CPU and memory, see [Scaling Aurora DB Instances][4]. Aurora uses `db.*` instance classes/types. Please see [AWS Documentation][7] for currently available instance classes and complete details.
+* `monitoring_interval` - (Optional) Interval, in seconds, between points when Enhanced Monitoring metrics are collected for the DB instance. To disable collecting Enhanced Monitoring metrics, specify 0. The default is 0. Valid Values: 0, 1, 5, 10, 15, 30, 60.
+* `monitoring_role_arn` - (Optional) ARN for the IAM role that permits RDS to send enhanced monitoring metrics to CloudWatch Logs. You can find more information on the [AWS Documentation](http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Monitoring.html) what IAM permissions are needed to allow Enhanced Monitoring for RDS Instances.
+* `performance_insights_enabled` - (Optional) Specifies whether Performance Insights is enabled or not.
+* `performance_insights_kms_key_id` - (Optional) ARN for the KMS key to encrypt Performance Insights data. When specifying `performance_insights_kms_key_id`, `performance_insights_enabled` needs to be set to true.
+* `performance_insights_retention_period` - (Optional) Amount of time in days to retain Performance Insights data. Valid values are `7`, `731` (2 years) or a multiple of `31`. When specifying `performance_insights_retention_period`, `performance_insights_enabled` needs to be set to true. Defaults to '7'.
+* `preferred_backup_window` - (Optional) Daily time range during which automated backups are created if automated backups are enabled. Eg: "04:00-09:00". **NOTE:** If `preferred_backup_window` is set at the cluster level, this argument **must** be omitted.
+* `preferred_maintenance_window` - (Optional) Window to perform maintenance in. Syntax: "ddd:hh24:mi-ddd:hh24:mi". Eg: "Mon:00:00-Mon:03:00".
+* `promotion_tier` - (Optional) Default 0. Failover Priority setting on instance level. The reader who has lower tier has higher priority to get promoted to writer.
+* `publicly_accessible` - (Optional) Bool to control if instance is publicly accessible. Default `false`. See the documentation on [Creating DB Instances][6] for more details on controlling this property.
+* `tags` - (Optional) Map of tags to assign to the instance. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of cluster instance
+* `cluster_identifier` - RDS Cluster Identifier
+* `identifier` - Instance identifier
+* `id` - Instance identifier
+* `writer` – Boolean indicating if this instance is writable. `False` indicates this instance is a read replica.
+* `availability_zone` - Availability zone of the instance
+* `endpoint` - DNS address for this instance. May not be writable
+* `engine` - Database engine
+* `engine_version_actual` - Database engine version
+* `port` - Database port
+* `storage_encrypted` - Specifies whether the DB cluster is encrypted.
+* `kms_key_id` - ARN for the KMS encryption key if one is set to the cluster.
+* `network_type` - Network type of the DB instance.
+* `dbi_resource_id` - Region-unique, immutable identifier for the DB instance.
+* `performance_insights_enabled` - Specifies whether Performance Insights is enabled or not.
+* `performance_insights_kms_key_id` - ARN for the KMS encryption key used by Performance Insights.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+[2]: https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_Aurora.html
+[3]: /docs/providers/aws/r/rds_cluster.html
+[4]: https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Aurora.Managing.html
+[5]: https://www.terraform.io/docs/configuration/meta-arguments/count.html
+[6]: https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_CreateDBInstance.html
+[7]: https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Concepts.DBInstanceClass.html
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `90m`)
+- `update` - (Default `90m`)
+- `delete` - (Default `90m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import RDS Cluster Instances using the `identifier`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import RDS Cluster Instances using the `identifier`. For example:
+
+```console
+% terraform import aws_rds_cluster_instance.prod_instance_1 aurora-cluster-instance-1
+```
+
+<!-- cache-key: cdktf-0.18.0 input-78df55554844c35c7b0301574cb78e36bb9d052650f72b31ee4ebbcccc0b9af7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/rds_cluster_parameter_group.html.markdown b/website/docs/cdktf/python/r/rds_cluster_parameter_group.html.markdown
new file mode 100644
index 00000000000..b6f8e928ab9
--- /dev/null
+++ b/website/docs/cdktf/python/r/rds_cluster_parameter_group.html.markdown
@@ -0,0 +1,93 @@
+---
+subcategory: "RDS (Relational Database)"
+layout: "aws"
+page_title: "AWS: aws_rds_cluster_parameter_group"
+description: |-
+  Provides an RDS DB cluster parameter group resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_rds_cluster_parameter_group
+
+Provides an RDS DB cluster parameter group resource. Documentation of the available parameters for various Aurora engines can be found at:
+
+* [Aurora MySQL Parameters](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/AuroraMySQL.Reference.html)
+* [Aurora PostgreSQL Parameters](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/AuroraPostgreSQL.Reference.html)
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.rds_cluster_parameter_group import RdsClusterParameterGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        RdsClusterParameterGroup(self, "default",
+            description="RDS default cluster parameter group",
+            family="aurora5.6",
+            name="rds-cluster-pg",
+            parameter=[RdsClusterParameterGroupParameter(
+                name="character_set_server",
+                value="utf8"
+            ), RdsClusterParameterGroupParameter(
+                name="character_set_client",
+                value="utf8"
+            )
+            ]
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Optional, Forces new resource) The name of the DB cluster parameter group. If omitted, Terraform will assign a random, unique name.
+* `name_prefix` - (Optional, Forces new resource) Creates a unique name beginning with the specified prefix. Conflicts with `name`.
+* `family` - (Required) The family of the DB cluster parameter group.
+* `description` - (Optional) The description of the DB cluster parameter group. Defaults to "Managed by Terraform".
+* `parameter` - (Optional) A list of DB parameters to apply. Note that parameters may differ from a family to an other. Full list of all parameters can be discovered via [`aws rds describe-db-cluster-parameters`](https://docs.aws.amazon.com/cli/latest/reference/rds/describe-db-cluster-parameters.html) after initial creation of the group.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+Parameter blocks support the following:
+
+* `name` - (Required) The name of the DB parameter.
+* `value` - (Required) The value of the DB parameter.
+* `apply_method` - (Optional) "immediate" (default), or "pending-reboot". Some
+    engines can't apply some parameters without a reboot, and you will need to
+    specify "pending-reboot" here.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The db cluster parameter group name.
+* `arn` - The ARN of the db cluster parameter group.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import RDS Cluster Parameter Groups using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import RDS Cluster Parameter Groups using the `name`. For example:
+
+```console
+% terraform import aws_rds_cluster_parameter_group.cluster_pg production-pg-1
+```
+
+<!-- cache-key: cdktf-0.18.0 input-33eec3977c5897f5b40f1eded02e4088f9efa632caa433fa14e96d5badc226bb -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/rds_cluster_parameter_group.markdown b/website/docs/cdktf/python/r/rds_cluster_parameter_group.markdown
new file mode 100644
index 00000000000..b6f8e928ab9
--- /dev/null
+++ b/website/docs/cdktf/python/r/rds_cluster_parameter_group.markdown
@@ -0,0 +1,93 @@
+---
+subcategory: "RDS (Relational Database)"
+layout: "aws"
+page_title: "AWS: aws_rds_cluster_parameter_group"
+description: |-
+  Provides an RDS DB cluster parameter group resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_rds_cluster_parameter_group
+
+Provides an RDS DB cluster parameter group resource. Documentation of the available parameters for various Aurora engines can be found at:
+
+* [Aurora MySQL Parameters](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/AuroraMySQL.Reference.html)
+* [Aurora PostgreSQL Parameters](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/AuroraPostgreSQL.Reference.html)
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.rds_cluster_parameter_group import RdsClusterParameterGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        RdsClusterParameterGroup(self, "default",
+            description="RDS default cluster parameter group",
+            family="aurora5.6",
+            name="rds-cluster-pg",
+            parameter=[RdsClusterParameterGroupParameter(
+                name="character_set_server",
+                value="utf8"
+            ), RdsClusterParameterGroupParameter(
+                name="character_set_client",
+                value="utf8"
+            )
+            ]
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Optional, Forces new resource) The name of the DB cluster parameter group. If omitted, Terraform will assign a random, unique name.
+* `name_prefix` - (Optional, Forces new resource) Creates a unique name beginning with the specified prefix. Conflicts with `name`.
+* `family` - (Required) The family of the DB cluster parameter group.
+* `description` - (Optional) The description of the DB cluster parameter group. Defaults to "Managed by Terraform".
+* `parameter` - (Optional) A list of DB parameters to apply. Note that parameters may differ from a family to an other. Full list of all parameters can be discovered via [`aws rds describe-db-cluster-parameters`](https://docs.aws.amazon.com/cli/latest/reference/rds/describe-db-cluster-parameters.html) after initial creation of the group.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+Parameter blocks support the following:
+
+* `name` - (Required) The name of the DB parameter.
+* `value` - (Required) The value of the DB parameter.
+* `apply_method` - (Optional) "immediate" (default), or "pending-reboot". Some
+    engines can't apply some parameters without a reboot, and you will need to
+    specify "pending-reboot" here.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The db cluster parameter group name.
+* `arn` - The ARN of the db cluster parameter group.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import RDS Cluster Parameter Groups using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import RDS Cluster Parameter Groups using the `name`. For example:
+
+```console
+% terraform import aws_rds_cluster_parameter_group.cluster_pg production-pg-1
+```
+
+<!-- cache-key: cdktf-0.18.0 input-33eec3977c5897f5b40f1eded02e4088f9efa632caa433fa14e96d5badc226bb -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/rds_cluster_role_association.html.markdown b/website/docs/cdktf/python/r/rds_cluster_role_association.html.markdown
new file mode 100644
index 00000000000..d341131eecc
--- /dev/null
+++ b/website/docs/cdktf/python/r/rds_cluster_role_association.html.markdown
@@ -0,0 +1,79 @@
+---
+subcategory: "RDS (Relational Database)"
+layout: "aws"
+page_title: "AWS: aws_rds_cluster_role_association"
+description: |-
+  Manages a RDS DB Cluster association with an IAM Role.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_rds_cluster_role_association
+
+Manages a RDS DB Cluster association with an IAM Role. Example use cases:
+
+* [Creating an IAM Role to Allow Amazon Aurora to Access AWS Services](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/AuroraMySQL.Integrating.Authorizing.IAM.CreateRole.html)
+* [Importing Amazon S3 Data into an RDS PostgreSQL DB Cluster](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_PostgreSQL.S3Import.html)
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.rds_cluster_role_association import RdsClusterRoleAssociation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        RdsClusterRoleAssociation(self, "example",
+            db_cluster_identifier=Token.as_string(aws_rds_cluster_example.id),
+            feature_name="S3_INTEGRATION",
+            role_arn=Token.as_string(aws_iam_role_example.arn)
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `db_cluster_identifier` - (Required) DB Cluster Identifier to associate with the IAM Role.
+* `feature_name` - (Required) Name of the feature for association. This can be found in the AWS documentation relevant to the integration or a full list is available in the `SupportedFeatureNames` list returned by [AWS CLI rds describe-db-engine-versions](https://docs.aws.amazon.com/cli/latest/reference/rds/describe-db-engine-versions.html).
+* `role_arn` - (Required) Amazon Resource Name (ARN) of the IAM Role to associate with the DB Cluster.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - DB Cluster Identifier and IAM Role ARN separated by a comma (`,`)
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `10m`)
+- `delete` - (Default `10m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_rds_cluster_role_association` using the DB Cluster Identifier and IAM Role ARN separated by a comma (`,`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_rds_cluster_role_association` using the DB Cluster Identifier and IAM Role ARN separated by a comma (`,`). For example:
+
+```console
+% terraform import aws_rds_cluster_role_association.example my-db-cluster,arn:aws:iam::123456789012:role/my-role
+```
+
+<!-- cache-key: cdktf-0.18.0 input-f164c7c9d93e5509da4cca9e9ef20bfa3b9c5d4d57057579c41a0162d8f04659 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/rds_custom_db_engine_version.markdown b/website/docs/cdktf/python/r/rds_custom_db_engine_version.markdown
new file mode 100644
index 00000000000..5342c359023
--- /dev/null
+++ b/website/docs/cdktf/python/r/rds_custom_db_engine_version.markdown
@@ -0,0 +1,191 @@
+---
+subcategory: "RDS (Relational Database)"
+layout: "aws"
+page_title: "AWS: aws_rds_custom_db_engine_version"
+description: |-
+  Provides an custom engine version (CEV) resource for Amazon RDS Custom.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_rds_custom_db_engine_version
+
+Provides an custom engine version (CEV) resource for Amazon RDS Custom. For additional information, see [Working with CEVs for RDS Custom for Oracle](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/custom-cev.html) and [Working with CEVs for RDS Custom for SQL Server](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/custom-cev-sqlserver.html) in the the [RDS User Guide](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Welcome.html).
+
+## Example Usage
+
+### RDS Custom for Oracle Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.kms_key import KmsKey
+from imports.aws.rds_custom_db_engine_version import RdsCustomDbEngineVersion
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = KmsKey(self, "example",
+            description="KMS symmetric key for RDS Custom for Oracle"
+        )
+        aws_rds_custom_db_engine_version_example = RdsCustomDbEngineVersion(self, "example_1",
+            database_installation_files_s3_bucket_name="DOC-EXAMPLE-BUCKET",
+            database_installation_files_s3_prefix="1915_GI/",
+            engine="custom-oracle-ee-cdb",
+            engine_version="19.cdb_cev1",
+            kms_key_id=example.arn,
+            manifest="  {\n\t\"databaseInstallationFileNames\":[\"V982063-01.zip\"]\n  }\n\n",
+            tags={
+                "Key": "value",
+                "Name": "example"
+            }
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_rds_custom_db_engine_version_example.override_logical_id("example")
+```
+
+### RDS Custom for Oracle External Manifest Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.kms_key import KmsKey
+from imports.aws.rds_custom_db_engine_version import RdsCustomDbEngineVersion
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = KmsKey(self, "example",
+            description="KMS symmetric key for RDS Custom for Oracle"
+        )
+        aws_rds_custom_db_engine_version_example = RdsCustomDbEngineVersion(self, "example_1",
+            database_installation_files_s3_bucket_name="DOC-EXAMPLE-BUCKET",
+            database_installation_files_s3_prefix="1915_GI/",
+            engine="custom-oracle-ee-cdb",
+            engine_version="19.cdb_cev1",
+            filename="manifest_1915_GI.json",
+            kms_key_id=example.arn,
+            manifest_hash=Token.as_string(Fn.filebase64sha256(json)),
+            tags={
+                "Key": "value",
+                "Name": "example"
+            }
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_rds_custom_db_engine_version_example.override_logical_id("example")
+```
+
+### RDS Custom for SQL Server Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.rds_custom_db_engine_version import RdsCustomDbEngineVersion
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        RdsCustomDbEngineVersion(self, "test",
+            engine="custom-sqlserver-se",
+            engine_version="15.00.4249.2.cev-1",
+            source_image_id="ami-0aa12345678a12ab1"
+        )
+```
+
+### RDS Custom for SQL Server Usage with AMI from another region
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ami_copy import AmiCopy
+from imports.aws.rds_custom_db_engine_version import RdsCustomDbEngineVersion
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = AmiCopy(self, "example",
+            description="A copy of ami-xxxxxxxx",
+            name="sqlserver-se-2019-15.00.4249.2",
+            source_ami_id="ami-xxxxxxxx",
+            source_ami_region="us-east-1"
+        )
+        RdsCustomDbEngineVersion(self, "test",
+            engine="custom-sqlserver-se",
+            engine_version="15.00.4249.2.cev-1",
+            source_image_id=example.id
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `database_installation_files_s3_bucket_name` - (Required) The name of the Amazon S3 bucket that contains the database installation files.
+* `database_installation_files_s3_prefix` - (Required) The prefix for the Amazon S3 bucket that contains the database installation files.
+* `description` - (Optional) The description of the CEV.
+* `engine` - (Required) The name of the database engine. Valid values are `custom-oracle*`, `custom-sqlserver*`.
+* `engine_version` - (Required) The version of the database engine.
+* `filename` - (Optional) The name of the manifest file within the local filesystem. Conflicts with `manifest`.
+* `kms_key_id` - (Optional) The ARN of the AWS KMS key that is used to encrypt the database installation files. Required for RDS Custom for Oracle.
+* `manifest` - (Optional) The manifest file, in JSON format, that contains the list of database installation files. Conflicts with `filename`.
+* `manifest_hash` - (Optional) Used to trigger updates. Must be set to a base64-encoded SHA256 hash of the manifest source specified with `filename`. The usual way to set this is filebase64sha256("manifest.json") where "manifest.json" is the local filename of the manifest source.
+* `status` - (Optional) The status of the CEV. Valid values are `available`, `inactive`, `inactive-except-restore`.
+* `source_image_id` - (Optional) The ID of the AMI to create the CEV from. Required for RDS Custom for SQL Server. For RDS Custom for Oracle, you can specify an AMI ID that was used in a different Oracle CEV.
+* `tags` - (Optional) A mapping of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) for the custom engine version.
+* `create_time` - The date and time that the CEV was created.
+* `db_parameter_group_family` - The name of the DB parameter group family for the CEV.
+* `image_id` - The ID of the AMI that was created with the CEV.
+* `major_engine_version` - The major version of the database engine.
+* `manifest_computed` - The returned manifest file, in JSON format, service generated and often different from input `manifest`.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `240m`)
+- `update` - (Default `10m`)
+- `delete` - (Default `60m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import custom engine versions for Amazon RDS custom using the `engine` and `engine_version` separated by a colon (`:`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import custom engine versions for Amazon RDS custom using the `engine` and `engine_version` separated by a colon (`:`). For example:
+
+```console
+% terraform import aws_rds_custom_db_engine_version.example custom-oracle-ee-cdb:19.cdb_cev1
+```
+
+<!-- cache-key: cdktf-0.18.0 input-dae41bd3880415fe2e096d70a45f580b6bfa6f14fe785ee0edae92bb5abec604 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/rds_export_task.html.markdown b/website/docs/cdktf/python/r/rds_export_task.html.markdown
new file mode 100644
index 00000000000..efc19fd08bd
--- /dev/null
+++ b/website/docs/cdktf/python/r/rds_export_task.html.markdown
@@ -0,0 +1,204 @@
+---
+subcategory: "RDS (Relational Database)"
+layout: "aws"
+page_title: "AWS: aws_rds_export_task"
+description: |-
+  Terraform resource for managing an AWS RDS (Relational Database) Export Task.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_rds_export_task
+
+Terraform resource for managing an AWS RDS (Relational Database) Export Task.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.rds_export_task import RdsExportTask
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        RdsExportTask(self, "example",
+            export_task_identifier="example",
+            iam_role_arn=Token.as_string(aws_iam_role_example.arn),
+            kms_key_id=Token.as_string(aws_kms_key_example.arn),
+            s3_bucket_name=Token.as_string(aws_s3_bucket_example.id),
+            source_arn=Token.as_string(aws_db_snapshot_example.db_snapshot_arn)
+        )
+```
+
+### Complete Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.db_instance import DbInstance
+from imports.aws.db_snapshot import DbSnapshot
+from imports.aws.iam_policy import IamPolicy
+from imports.aws.iam_role import IamRole
+from imports.aws.iam_role_policy_attachment import IamRolePolicyAttachment
+from imports.aws.kms_key import KmsKey
+from imports.aws.rds_export_task import RdsExportTask
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_acl import S3BucketAcl
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = DbInstance(self, "example",
+            allocated_storage=10,
+            db_name="test",
+            engine="mysql",
+            engine_version="5.7",
+            identifier="example",
+            instance_class="db.t3.micro",
+            parameter_group_name="default.mysql5.7",
+            password="foobarbaz",
+            skip_final_snapshot=True,
+            username="foo"
+        )
+        aws_db_snapshot_example = DbSnapshot(self, "example_1",
+            db_instance_identifier=example.identifier,
+            db_snapshot_identifier="example"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_db_snapshot_example.override_logical_id("example")
+        aws_iam_role_example = IamRole(self, "example_2",
+            assume_role_policy=Token.as_string(
+                Fn.jsonencode({
+                    "Statement": [{
+                        "Action": "sts:AssumeRole",
+                        "Effect": "Allow",
+                        "Principal": {
+                            "Service": "export.rds.amazonaws.com"
+                        },
+                        "Sid": ""
+                    }
+                    ],
+                    "Version": "2012-10-17"
+                })),
+            name="example"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_role_example.override_logical_id("example")
+        aws_kms_key_example = KmsKey(self, "example_3",
+            deletion_window_in_days=10
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_kms_key_example.override_logical_id("example")
+        aws_s3_bucket_example = S3Bucket(self, "example_4",
+            bucket="example",
+            force_destroy=True
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_example.override_logical_id("example")
+        aws_s3_bucket_acl_example = S3BucketAcl(self, "example_5",
+            acl="private",
+            bucket=Token.as_string(aws_s3_bucket_example.id)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_acl_example.override_logical_id("example")
+        data_aws_iam_policy_document_example = DataAwsIamPolicyDocument(self, "example_6",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["s3:ListAllMyBuckets"],
+                resources=["*"]
+            ), DataAwsIamPolicyDocumentStatement(
+                actions=["s3:GetBucketLocation", "s3:ListBucket"],
+                resources=[Token.as_string(aws_s3_bucket_example.arn)]
+            ), DataAwsIamPolicyDocumentStatement(
+                actions=["s3:GetObject", "s3:PutObject", "s3:DeleteObject"],
+                resources=["${" + aws_s3_bucket_example.arn + "}/*"]
+            )
+            ]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_iam_policy_document_example.override_logical_id("example")
+        aws_iam_policy_example = IamPolicy(self, "example_7",
+            name="example",
+            policy=Token.as_string(data_aws_iam_policy_document_example.json)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_policy_example.override_logical_id("example")
+        aws_iam_role_policy_attachment_example = IamRolePolicyAttachment(self, "example_8",
+            policy_arn=Token.as_string(aws_iam_policy_example.arn),
+            role=Token.as_string(aws_iam_role_example.name)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_role_policy_attachment_example.override_logical_id("example")
+        aws_rds_export_task_example = RdsExportTask(self, "example_9",
+            export_only=["database"],
+            export_task_identifier="example",
+            iam_role_arn=Token.as_string(aws_iam_role_example.arn),
+            kms_key_id=Token.as_string(aws_kms_key_example.arn),
+            s3_bucket_name=Token.as_string(aws_s3_bucket_example.id),
+            s3_prefix="my_prefix/example",
+            source_arn=Token.as_string(aws_db_snapshot_example.db_snapshot_arn)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_rds_export_task_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `export_task_identifier` - (Required) Unique identifier for the snapshot export task.
+* `iam_role_arn` - (Required) ARN of the IAM role to use for writing to the Amazon S3 bucket.
+* `kms_key_id` - (Required) ID of the Amazon Web Services KMS key to use to encrypt the snapshot.
+* `s3_bucket_name` - (Required) Name of the Amazon S3 bucket to export the snapshot to.
+* `source_arn` - (Required) Amazon Resource Name (ARN) of the snapshot to export.
+
+The following arguments are optional:
+
+* `export_only` - (Optional) Data to be exported from the snapshot. If this parameter is not provided, all the snapshot data is exported. Valid values are documented in the [AWS StartExportTask API documentation](https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_StartExportTask.html#API_StartExportTask_RequestParameters).
+* `s3_prefix` - (Optional) Amazon S3 bucket prefix to use as the file name and path of the exported snapshot.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `failure_cause` - Reason the export failed, if it failed.
+* `id` - Unique identifier for the snapshot export task (same value as `export_task_identifier`).
+* `percent_progress` - Progress of the snapshot export task as a percentage.
+* `snapshot_time` - Time that the snapshot was created.
+* `source_type` - Type of source for the export.
+* `status` - Status of the export task.
+* `task_end_time` - Time that the snapshot export task completed.
+* `task_start_time` - Time that the snapshot export task started.
+* `warning_message` - Warning about the snapshot export task, if any.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import a RDS (Relational Database) Export Task using the `export_task_identifier`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import a RDS (Relational Database) Export Task using the `export_task_identifier`. For example:
+
+```console
+% terraform import aws_rds_export_task.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-85f7fbc39b14c8bc604a74daa69a5c20b76d661a4af3a134d17931198e7cd32a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/rds_global_cluster.html.markdown b/website/docs/cdktf/python/r/rds_global_cluster.html.markdown
new file mode 100644
index 00000000000..29561f961da
--- /dev/null
+++ b/website/docs/cdktf/python/r/rds_global_cluster.html.markdown
@@ -0,0 +1,319 @@
+---
+subcategory: "RDS (Relational Database)"
+layout: "aws"
+page_title: "AWS: aws_rds_global_cluster"
+description: |-
+  Manages an RDS Global Cluster
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_rds_global_cluster
+
+Manages an RDS Global Cluster, which is an Aurora global database spread across multiple regions. The global database contains a single primary cluster with read-write capability, and a read-only secondary cluster that receives data from the primary cluster through high-speed replication performed by the Aurora storage subsystem.
+
+More information about Aurora global databases can be found in the [Aurora User Guide](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/aurora-global-database.html#aurora-global-database-creating).
+
+## Example Usage
+
+### New MySQL Global Cluster
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.rds_cluster import RdsCluster
+from imports.aws.rds_cluster_instance import RdsClusterInstance
+from imports.aws.rds_global_cluster import RdsGlobalCluster
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = RdsGlobalCluster(self, "example",
+            database_name="example_db",
+            engine="aurora",
+            engine_version="5.6.mysql_aurora.1.22.2",
+            global_cluster_identifier="global-test"
+        )
+        primary = RdsCluster(self, "primary",
+            cluster_identifier="test-primary-cluster",
+            database_name="example_db",
+            db_subnet_group_name="default",
+            engine=example.engine,
+            engine_version=example.engine_version,
+            global_cluster_identifier=example.id,
+            master_password="somepass123",
+            master_username="username",
+            provider=aws_primary
+        )
+        aws_rds_cluster_instance_primary = RdsClusterInstance(self, "primary_2",
+            cluster_identifier=primary.id,
+            db_subnet_group_name="default",
+            engine=example.engine,
+            engine_version=example.engine_version,
+            identifier="test-primary-cluster-instance",
+            instance_class="db.r4.large",
+            provider=aws_primary
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_rds_cluster_instance_primary.override_logical_id("primary")
+        secondary = RdsCluster(self, "secondary",
+            cluster_identifier="test-secondary-cluster",
+            db_subnet_group_name="default",
+            depends_on=[aws_rds_cluster_instance_primary],
+            engine=example.engine,
+            engine_version=example.engine_version,
+            global_cluster_identifier=example.id,
+            provider=aws_secondary
+        )
+        aws_rds_cluster_instance_secondary = RdsClusterInstance(self, "secondary_4",
+            cluster_identifier=secondary.id,
+            db_subnet_group_name="default",
+            engine=example.engine,
+            engine_version=example.engine_version,
+            identifier="test-secondary-cluster-instance",
+            instance_class="db.r4.large",
+            provider=aws_secondary
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_rds_cluster_instance_secondary.override_logical_id("secondary")
+```
+
+### New PostgreSQL Global Cluster
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.provider import AwsProvider
+from imports.aws.rds_cluster import RdsCluster
+from imports.aws.rds_cluster_instance import RdsClusterInstance
+from imports.aws.rds_global_cluster import RdsGlobalCluster
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        primary = AwsProvider(self, "aws",
+            alias="primary",
+            region="us-east-2"
+        )
+        secondary = AwsProvider(self, "aws_1",
+            alias="secondary",
+            region="us-east-1"
+        )
+        example = RdsGlobalCluster(self, "example",
+            database_name="example_db",
+            engine="aurora-postgresql",
+            engine_version="11.9",
+            global_cluster_identifier="global-test"
+        )
+        aws_rds_cluster_primary = RdsCluster(self, "primary",
+            cluster_identifier="test-primary-cluster",
+            database_name="example_db",
+            db_subnet_group_name="default",
+            engine=example.engine,
+            engine_version=example.engine_version,
+            global_cluster_identifier=example.id,
+            master_password="somepass123",
+            master_username="username",
+            provider=primary
+        )
+        aws_rds_cluster_instance_primary = RdsClusterInstance(self, "primary_4",
+            cluster_identifier=Token.as_string(aws_rds_cluster_primary.id),
+            db_subnet_group_name="default",
+            engine=example.engine,
+            engine_version=example.engine_version,
+            identifier="test-primary-cluster-instance",
+            instance_class="db.r4.large",
+            provider=primary
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_rds_cluster_instance_primary.override_logical_id("primary")
+        aws_rds_cluster_secondary = RdsCluster(self, "secondary",
+            cluster_identifier="test-secondary-cluster",
+            db_subnet_group_name="default",
+            depends_on=[aws_rds_cluster_instance_primary],
+            engine=example.engine,
+            engine_version=example.engine_version,
+            global_cluster_identifier=example.id,
+            provider=secondary,
+            skip_final_snapshot=True
+        )
+        aws_rds_cluster_instance_secondary = RdsClusterInstance(self, "secondary_6",
+            cluster_identifier=Token.as_string(aws_rds_cluster_secondary.id),
+            db_subnet_group_name="default",
+            engine=example.engine,
+            engine_version=example.engine_version,
+            identifier="test-secondary-cluster-instance",
+            instance_class="db.r4.large",
+            provider=secondary
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_rds_cluster_instance_secondary.override_logical_id("secondary")
+```
+
+### New Global Cluster From Existing DB Cluster
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from cdktf import TerraformResourceLifecycle
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.rds_cluster import RdsCluster
+from imports.aws.rds_global_cluster import RdsGlobalCluster
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, engine):
+        super().__init__(scope, name)
+        example = RdsCluster(self, "example",
+            lifecycle=TerraformResourceLifecycle(
+                ignore_changes=[global_cluster_identifier]
+            ),
+            engine=engine
+        )
+        aws_rds_global_cluster_example = RdsGlobalCluster(self, "example_1",
+            force_destroy=True,
+            global_cluster_identifier="example",
+            source_db_cluster_identifier=example.arn
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_rds_global_cluster_example.override_logical_id("example")
+```
+
+### Upgrading Engine Versions
+
+When you upgrade the version of an `aws_rds_global_cluster`, Terraform will attempt to in-place upgrade the engine versions of all associated clusters. Since the `aws_rds_cluster` resource is being updated through the `aws_rds_global_cluster`, you are likely to get an error (`Provider produced inconsistent final plan`). To avoid this, use the `lifecycle` `ignore_changes` meta argument as shown below on the `aws_rds_cluster`.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from cdktf import TerraformResourceLifecycle
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.rds_cluster import RdsCluster
+from imports.aws.rds_cluster_instance import RdsClusterInstance
+from imports.aws.rds_global_cluster import RdsGlobalCluster
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = RdsGlobalCluster(self, "example",
+            engine="aurora-mysql",
+            engine_version="5.7.mysql_aurora.2.07.5",
+            global_cluster_identifier="kyivkharkiv"
+        )
+        primary = RdsCluster(self, "primary",
+            allow_major_version_upgrade=True,
+            apply_immediately=True,
+            cluster_identifier="odessadnipro",
+            database_name="totoro",
+            engine=example.engine,
+            engine_version=example.engine_version,
+            global_cluster_identifier=example.id,
+            lifecycle=TerraformResourceLifecycle(
+                ignore_changes=[engine_version]
+            ),
+            master_password="satsukimae",
+            master_username="maesatsuki",
+            skip_final_snapshot=True
+        )
+        aws_rds_cluster_instance_primary = RdsClusterInstance(self, "primary_2",
+            apply_immediately=True,
+            cluster_identifier=primary.id,
+            engine=primary.engine,
+            engine_version=primary.engine_version,
+            identifier="donetsklviv",
+            instance_class="db.r4.large"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_rds_cluster_instance_primary.override_logical_id("primary")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `global_cluster_identifier` - (Required, Forces new resources) Global cluster identifier.
+* `database_name` - (Optional, Forces new resources) Name for an automatically created database on cluster creation.
+* `deletion_protection` - (Optional) If the Global Cluster should have deletion protection enabled. The database can't be deleted when this value is set to `true`. The default is `false`.
+* `engine` - (Optional, Forces new resources) Name of the database engine to be used for this DB cluster. Terraform will only perform drift detection if a configuration value is provided. Valid values: `aurora`, `aurora-mysql`, `aurora-postgresql`. Defaults to `aurora`. Conflicts with `source_db_cluster_identifier`.
+* `engine_version` - (Optional) Engine version of the Aurora global database. The `engine`, `engine_version`, and `instance_class` (on the `aws_rds_cluster_instance`) must together support global databases. See [Using Amazon Aurora global databases](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/aurora-global-database.html) for more information. By upgrading the engine version, Terraform will upgrade cluster members. **NOTE:** To avoid an `inconsistent final plan` error while upgrading, use the `lifecycle` `ignore_changes` for `engine_version` meta argument on the associated `aws_rds_cluster` resource as shown above in [Upgrading Engine Versions](#upgrading-engine-versions) example.
+* `force_destroy` - (Optional) Enable to remove DB Cluster members from Global Cluster on destroy. Required with `source_db_cluster_identifier`.
+* `source_db_cluster_identifier` - (Optional) Amazon Resource Name (ARN) to use as the primary DB Cluster of the Global Cluster on creation. Terraform cannot perform drift detection of this value.
+* `storage_encrypted` - (Optional, Forces new resources) Specifies whether the DB cluster is encrypted. The default is `false` unless `source_db_cluster_identifier` is specified and encrypted. Terraform will only perform drift detection if a configuration value is provided.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - RDS Global Cluster Amazon Resource Name (ARN)
+* `global_cluster_members` - Set of objects containing Global Cluster members.
+    * `db_cluster_arn` - Amazon Resource Name (ARN) of member DB Cluster
+    * `is_writer` - Whether the member is the primary DB Cluster
+* `global_cluster_resource_id` - AWS Region-unique, immutable identifier for the global database cluster. This identifier is found in AWS CloudTrail log entries whenever the AWS KMS key for the DB cluster is accessed
+* `id` - RDS Global Cluster identifier
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `30m`)
+- `update` - (Default `90m`)
+- `delete` - (Default `30m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_rds_global_cluster` using the RDS Global Cluster identifier. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_rds_global_cluster` using the RDS Global Cluster identifier. For example:
+
+```console
+% terraform import aws_rds_global_cluster.example example
+```
+
+Certain resource arguments, like `force_destroy`, only exist within Terraform. If the argument is set in the Terraform configuration on an imported resource, Terraform will show a difference on the first plan after import to update the state value. This change is safe to apply immediately so the state matches the desired configuration.
+
+Certain resource arguments, like `source_db_cluster_identifier`, do not have an API method for reading the information after creation. If the argument is set in the Terraform configuration on an imported resource, Terraform will always show a difference. To workaround this behavior, either omit the argument from the Terraform configuration or use [`ignore_changes`](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html#ignore_changes) to hide the difference. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from cdktf import TerraformResourceLifecycle
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.rds_global_cluster import RdsGlobalCluster
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, globalClusterIdentifier):
+        super().__init__(scope, name)
+        RdsGlobalCluster(self, "example",
+            lifecycle=TerraformResourceLifecycle(
+                ignore_changes=[source_db_cluster_identifier]
+            ),
+            global_cluster_identifier=global_cluster_identifier
+        )
+```
+
+<!-- cache-key: cdktf-0.18.0 input-fa44dd874493ca45cccbd24a626a6b3f65869bfad4964390e5844ded01172f4f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/rds_reserved_instance.html.markdown b/website/docs/cdktf/python/r/rds_reserved_instance.html.markdown
new file mode 100644
index 00000000000..3cc6aa06aa0
--- /dev/null
+++ b/website/docs/cdktf/python/r/rds_reserved_instance.html.markdown
@@ -0,0 +1,107 @@
+---
+subcategory: "RDS (Relational Database)"
+layout: "aws"
+page_title: "AWS: aws_rds_reserved_instance"
+description: |-
+  Manages an RDS DB Reserved Instance
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_rds_reserved_instance
+
+Manages an RDS DB Reserved Instance.
+
+~> **NOTE:** Once created, a reservation is valid for the `duration` of the provided `offering_id` and cannot be deleted. Performing a `destroy` will only remove the resource from state. For more information see [RDS Reserved Instances Documentation](https://aws.amazon.com/rds/reserved-instances/) and [PurchaseReservedDBInstancesOffering](https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_PurchaseReservedDBInstancesOffering.html).
+
+~> **NOTE:** Due to the expense of testing this resource, we provide it as best effort. If you find it useful, and have the ability to help test or notice issues, consider reaching out to us on [GitHub](https://github.com/hashicorp/terraform-provider-aws).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_rds_reserved_instance_offering import DataAwsRdsReservedInstanceOffering
+from imports.aws.rds_reserved_instance import RdsReservedInstance
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        test = DataAwsRdsReservedInstanceOffering(self, "test",
+            db_instance_class="db.t2.micro",
+            duration=31536000,
+            multi_az=False,
+            offering_type="All Upfront",
+            product_description="mysql"
+        )
+        RdsReservedInstance(self, "example",
+            instance_count=3,
+            offering_id=Token.as_string(test.offering_id),
+            reservation_id="optionalCustomReservationID"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `offering_id` - (Required) ID of the Reserved DB instance offering to purchase. To determine an `offering_id`, see the `aws_rds_reserved_instance_offering` data source.
+
+The following arguments are optional:
+
+* `instance_count` - (Optional) Number of instances to reserve. Default value is `1`.
+* `reservation_id` - (Optional) Customer-specified identifier to track this reservation.
+* `tags` - (Optional) Map of tags to assign to the DB reservation. If configured with a provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN for the reserved DB instance.
+* `id` - Unique identifier for the reservation. same as `reservation_id`.
+* `currency_code` - Currency code for the reserved DB instance.
+* `duration` - Duration of the reservation in seconds.
+* `fixed_price` – Fixed price charged for this reserved DB instance.
+* `db_instance_class` - DB instance class for the reserved DB instance.
+* `lease_id` - Unique identifier for the lease associated with the reserved DB instance. Amazon Web Services Support might request the lease ID for an issue related to a reserved DB instance.
+* `multi_az` - Whether the reservation applies to Multi-AZ deployments.
+* `offering_type` - Offering type of this reserved DB instance.
+* `product_description` - Description of the reserved DB instance.
+* `recurring_charges` - Recurring price charged to run this reserved DB instance.
+* `start_time` - Time the reservation started.
+* `state` - State of the reserved DB instance.
+* `usage_price` - Hourly price charged for this reserved DB instance.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `30m`)
+- `update` - (Default `10m`)
+- `delete` - (Default `1m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import RDS DB Instance Reservations using the `instance_id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import RDS DB Instance Reservations using the `instance_id`. For example:
+
+```console
+% terraform import aws_rds_reserved_instance.reservation_instance CustomReservationID
+```
+
+<!-- cache-key: cdktf-0.18.0 input-9dbbdcfda3d089826e7a92e8f50666a47a4fc86a9f471174038919028f7ff28a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/redshift_authentication_profile.html.markdown b/website/docs/cdktf/python/r/redshift_authentication_profile.html.markdown
new file mode 100644
index 00000000000..f7ca25f50f2
--- /dev/null
+++ b/website/docs/cdktf/python/r/redshift_authentication_profile.html.markdown
@@ -0,0 +1,72 @@
+---
+subcategory: "Redshift"
+layout: "aws"
+page_title: "AWS: aws_redshift_authentication_profile"
+description: |-
+  Creates a Redshift authentication profile
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_redshift_authentication_profile
+
+Creates a Redshift authentication profile
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.redshift_authentication_profile import RedshiftAuthenticationProfile
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        RedshiftAuthenticationProfile(self, "example",
+            authentication_profile_content=Token.as_string(
+                Fn.jsonencode({
+                    "AllowDBUserOverride": "1",
+                    "App_ID": "example",
+                    "Client_ID": "ExampleClientID"
+                })),
+            authentication_profile_name="example"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `authentication_profile_name` - (Required, Forces new resource) The name of the authentication profile.
+* `authentication_profile_content` - (Required) The content of the authentication profile in JSON format. The maximum length of the JSON string is determined by a quota for your account.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name of the authentication profile.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Redshift Authentication by `authentication_profile_name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Redshift Authentication by `authentication_profile_name`. For example:
+
+```console
+% terraform import aws_redshift_authentication_profile.test example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-dc99cb7420c5de511051f2f61b1ee290d874bf0770374a9047ba240fbb6ae37e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/redshift_cluster.html.markdown b/website/docs/cdktf/python/r/redshift_cluster.html.markdown
new file mode 100644
index 00000000000..45bb1e1526d
--- /dev/null
+++ b/website/docs/cdktf/python/r/redshift_cluster.html.markdown
@@ -0,0 +1,175 @@
+---
+subcategory: "Redshift"
+layout: "aws"
+page_title: "AWS: aws_redshift_cluster"
+description: |-
+  Provides a Redshift Cluster resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_redshift_cluster
+
+Provides a Redshift Cluster Resource.
+
+~> **Note:** All arguments including the username and password will be stored in the raw state as plain-text.
+[Read more about sensitive data in state](https://www.terraform.io/docs/state/sensitive-data.html).
+
+~> **NOTE:** A Redshift cluster's default IAM role can be managed both by this resource's `default_iam_role_arn` argument and the [`aws_redshift_cluster_iam_roles`](redshift_cluster_iam_roles.html) resource's `default_iam_role_arn` argument. Do not configure different values for both arguments. Doing so will cause a conflict of default IAM roles.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.redshift_cluster import RedshiftCluster
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        RedshiftCluster(self, "example",
+            cluster_identifier="tf-redshift-cluster",
+            cluster_type="single-node",
+            database_name="mydb",
+            master_password="Mustbe8characters",
+            master_username="exampleuser",
+            node_type="dc1.large"
+        )
+```
+
+## Argument Reference
+
+For more detailed documentation about each argument, refer to
+the [AWS official documentation](http://docs.aws.amazon.com/cli/latest/reference/redshift/index.html#cli-aws-redshift).
+
+This argument supports the following arguments:
+
+* `cluster_identifier` - (Required) The Cluster Identifier. Must be a lower case string.
+* `database_name` - (Optional) The name of the first database to be created when the cluster is created.
+  If you do not provide a name, Amazon Redshift will create a default database called `dev`.
+* `default_iam_role_arn` - (Optional) The Amazon Resource Name (ARN) for the IAM role that was set as default for the cluster when the cluster was created.
+* `node_type` - (Required) The node type to be provisioned for the cluster.
+* `cluster_type` - (Optional) The cluster type to use. Either `single-node` or `multi-node`.
+* `master_password` - (Required unless a `snapshot_identifier` is provided) Password for the master DB user.
+  Note that this may show up in logs, and it will be stored in the state file. Password must contain at least 8 chars and
+  contain at least one uppercase letter, one lowercase letter, and one number.
+* `master_username` - (Required unless a `snapshot_identifier` is provided) Username for the master DB user.
+* `vpc_security_group_ids` - (Optional) A list of Virtual Private Cloud (VPC) security groups to be associated with the cluster.
+* `cluster_subnet_group_name` - (Optional) The name of a cluster subnet group to be associated with this cluster. If this parameter is not provided the resulting cluster will be deployed outside virtual private cloud (VPC).
+* `availability_zone` - (Optional) The EC2 Availability Zone (AZ) in which you want Amazon Redshift to provision the cluster. For example, if you have several EC2 instances running in a specific Availability Zone, then you might want the cluster to be provisioned in the same zone in order to decrease network latency. Can only be changed if `availability_zone_relocation_enabled` is `true`.
+* `availability_zone_relocation_enabled` - (Optional) If true, the cluster can be relocated to another availabity zone, either automatically by AWS or when requested. Default is `false`. Available for use on clusters from the RA3 instance family.
+* `preferred_maintenance_window` - (Optional) The weekly time range (in UTC) during which automated cluster maintenance can occur.
+  Format: ddd:hh24:mi-ddd:hh24:mi
+* `cluster_parameter_group_name` - (Optional) The name of the parameter group to be associated with this cluster.
+* `automated_snapshot_retention_period` - (Optional) The number of days that automated snapshots are retained. If the value is 0, automated snapshots are disabled. Even if automated snapshots are disabled, you can still create manual snapshots when you want with create-cluster-snapshot. Default is 1.
+* `port` - (Optional) The port number on which the cluster accepts incoming connections. Valid values are between `1115` and `65535`.
+  The cluster is accessible only via the JDBC and ODBC connection strings.
+  Part of the connection string requires the port on which the cluster will listen for incoming connections.
+  Default port is `5439`.
+* `cluster_version` - (Optional) The version of the Amazon Redshift engine software that you want to deploy on the cluster.
+  The version selected runs on all the nodes in the cluster.
+* `allow_version_upgrade` - (Optional) If true , major version upgrades can be applied during the maintenance window to the Amazon Redshift engine that is running on the cluster. Default is `true`.
+* `apply_immediately` - (Optional) Specifies whether any cluster modifications are applied immediately, or during the next maintenance window. Default is `false`.
+* `aqua_configuration_status` - (Optional, **Deprecated**) The value represents how the cluster is configured to use AQUA (Advanced Query Accelerator) after the cluster is restored.
+  No longer supported by the AWS API.
+  Always returns `auto`.
+* `number_of_nodes` - (Optional) The number of compute nodes in the cluster. This parameter is required when the ClusterType parameter is specified as multi-node. Default is 1.
+* `publicly_accessible` - (Optional) If true, the cluster can be accessed from a public network. Default is `true`.
+* `encrypted` - (Optional) If true , the data in the cluster is encrypted at rest.
+* `enhanced_vpc_routing` - (Optional) If true , enhanced VPC routing is enabled.
+* `kms_key_id` - (Optional) The ARN for the KMS encryption key. When specifying `kms_key_id`, `encrypted` needs to be set to true.
+* `elastic_ip` - (Optional) The Elastic IP (EIP) address for the cluster.
+* `skip_final_snapshot` - (Optional) Determines whether a final snapshot of the cluster is created before Amazon Redshift deletes the cluster. If true , a final cluster snapshot is not created. If false , a final cluster snapshot is created before the cluster is deleted. Default is false.
+* `final_snapshot_identifier` - (Optional) The identifier of the final snapshot that is to be created immediately before deleting the cluster. If this parameter is provided, `skip_final_snapshot` must be false.
+* `snapshot_identifier` - (Optional) The name of the snapshot from which to create the new cluster.
+* `snapshot_cluster_identifier` - (Optional) The name of the cluster the source snapshot was created from.
+* `owner_account` - (Optional) The AWS customer account used to create or copy the snapshot. Required if you are restoring a snapshot you do not own, optional if you own the snapshot.
+* `iam_roles` - (Optional) A list of IAM Role ARNs to associate with the cluster. A Maximum of 10 can be associated to the cluster at any time.
+* `logging` - (Optional) Logging, documented below.
+* `maintenance_track_name` - (Optional) The name of the maintenance track for the restored cluster. When you take a snapshot, the snapshot inherits the MaintenanceTrack value from the cluster. The snapshot might be on a different track than the cluster that was the source for the snapshot. For example, suppose that you take a snapshot of  a cluster that is on the current track and then change the cluster to be on the trailing track. In this case, the snapshot and the source cluster are on different tracks. Default value is `current`.
+* `manual_snapshot_retention_period` - (Optional)  The default number of days to retain a manual snapshot. If the value is -1, the snapshot is retained indefinitely. This setting doesn't change the retention period of existing snapshots. Valid values are between `-1` and `3653`. Default value is `-1`.
+* `snapshot_copy` - (Optional) Configuration of automatic copy of snapshots from one region to another. Documented below.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Nested Blocks
+
+#### `logging`
+
+* `enable` - (Required) Enables logging information such as queries and connection attempts, for the specified Amazon Redshift cluster.
+* `bucket_name` - (Optional, required when `enable` is `true` and `log_destination_type` is `s3`) The name of an existing S3 bucket where the log files are to be stored. Must be in the same region as the cluster and the cluster must have read bucket and put object permissions.
+For more information on the permissions required for the bucket, please read the AWS [documentation](http://docs.aws.amazon.com/redshift/latest/mgmt/db-auditing.html#db-auditing-enable-logging)
+* `s3_key_prefix` - (Optional) The prefix applied to the log file names.
+* `log_destination_type` - (Optional) The log destination type. An enum with possible values of `s3` and `cloudwatch`.
+* `log_exports` - (Optional) The collection of exported log types. Log types include the connection log, user log and user activity log. Required when `log_destination_type` is `cloudwatch`. Valid log types are `connectionlog`, `userlog`, and `useractivitylog`.
+
+#### `snapshot_copy`
+
+* `destination_region` - (Required) The destination region that you want to copy snapshots to.
+* `retention_period` - (Optional) The number of days to retain automated snapshots in the destination region after they are copied from the source region. Defaults to `7`.
+* `grant_name` - (Optional) The name of the snapshot copy grant to use when snapshots of an AWS KMS-encrypted cluster are copied to the destination region.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of cluster
+* `id` - The Redshift Cluster ID.
+* `cluster_identifier` - The Cluster Identifier
+* `cluster_type` - The cluster type
+* `node_type` - The type of nodes in the cluster
+* `database_name` - The name of the default database in the Cluster
+* `availability_zone` - The availability zone of the Cluster
+* `automated_snapshot_retention_period` - The backup retention period
+* `preferred_maintenance_window` - The backup window
+* `endpoint` - The connection endpoint
+* `encrypted` - Whether the data in the cluster is encrypted
+* `vpc_security_group_ids` - The VPC security group Ids associated with the cluster
+* `dns_name` - The DNS name of the cluster
+* `port` - The Port the cluster responds on
+* `cluster_version` - The version of Redshift engine software
+* `cluster_parameter_group_name` - The name of the parameter group to be associated with this cluster
+* `cluster_subnet_group_name` - The name of a cluster subnet group to be associated with this cluster
+* `cluster_public_key` - The public key for the cluster
+* `cluster_revision_number` - The specific revision number of the database in the cluster
+* `cluster_nodes` - The nodes in the cluster. Cluster node blocks are documented below
+* `cluster_namespace_arn` - The namespace Amazon Resource Name (ARN) of the cluster
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+Cluster nodes (for `cluster_nodes`) support the following attributes:
+
+* `node_role` - Whether the node is a leader node or a compute node
+* `private_ip_address` - The private IP address of a node within a cluster
+* `public_ip_address` - The public IP address of a node within a cluster
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `75m`)
+- `update` - (Default `75m`)
+- `delete` - (Default `40m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Redshift Clusters using the `cluster_identifier`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Redshift Clusters using the `cluster_identifier`. For example:
+
+```console
+% terraform import aws_redshift_cluster.myprodcluster tf-redshift-cluster-12345
+```
+
+<!-- cache-key: cdktf-0.18.0 input-a58a67b0f3251c111e73eb20948353a4c7ae321a95f9bf867e49b06ddc38bf5c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/redshift_cluster_iam_roles.html.markdown b/website/docs/cdktf/python/r/redshift_cluster_iam_roles.html.markdown
new file mode 100644
index 00000000000..434ccbfc230
--- /dev/null
+++ b/website/docs/cdktf/python/r/redshift_cluster_iam_roles.html.markdown
@@ -0,0 +1,70 @@
+---
+subcategory: "Redshift"
+layout: "aws"
+page_title: "AWS: aws_redshift_cluster_iam_roles"
+description: |-
+  Provides a Redshift Cluster IAM Roles resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_redshift_cluster_iam_roles
+
+Provides a Redshift Cluster IAM Roles resource.
+
+~> **NOTE:** A Redshift cluster's default IAM role can be managed both by this resource's `default_iam_role_arn` argument and the [`aws_redshift_cluster`](redshift_cluster.html) resource's `default_iam_role_arn` argument. Do not configure different values for both arguments. Doing so will cause a conflict of default IAM roles.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.redshift_cluster_iam_roles import RedshiftClusterIamRoles
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        RedshiftClusterIamRoles(self, "example",
+            cluster_identifier=Token.as_string(aws_redshift_cluster_example.cluster_identifier),
+            iam_role_arns=[Token.as_string(aws_iam_role_example.arn)]
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `cluster_identifier` - (Required) The name of the Redshift Cluster IAM Roles.
+* `iam_role_arns` - (Optional) A list of IAM Role ARNs to associate with the cluster. A Maximum of 10 can be associated to the cluster at any time.
+* `default_iam_role_arn` - (Optional) The Amazon Resource Name (ARN) for the IAM role that was set as default for the cluster when the cluster was created.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Redshift Cluster ID.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Redshift Cluster IAM Roless using the `cluster_identifier`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Redshift Cluster IAM Roless using the `cluster_identifier`. For example:
+
+```console
+% terraform import aws_redshift_cluster_iam_roles.examplegroup1 example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-91240022530f469d269e463be72eba257c8ec52cf957eb83d56ddf8c04d98dc9 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/redshift_cluster_snapshot.html.markdown b/website/docs/cdktf/python/r/redshift_cluster_snapshot.html.markdown
new file mode 100644
index 00000000000..3fdd291a178
--- /dev/null
+++ b/website/docs/cdktf/python/r/redshift_cluster_snapshot.html.markdown
@@ -0,0 +1,79 @@
+---
+subcategory: "Redshift"
+layout: "aws"
+page_title: "AWS: aws_redshift_cluster_snapshot"
+description: |-
+  Creates a Redshift cluster snapshot
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_redshift_cluster_snapshot
+
+Creates a Redshift cluster snapshot
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.redshift_cluster_snapshot import RedshiftClusterSnapshot
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, clusterIdentifier, snapshotIdentifier):
+        super().__init__(scope, name)
+        RedshiftClusterSnapshot(self, "example",
+            cluster_snapshot_content=Fn.jsonencode({
+                "AllowDBUserOverride": "1",
+                "App_ID": "example",
+                "Client_ID": "ExampleClientID"
+            }),
+            cluster_snapshot_name="example",
+            cluster_identifier=cluster_identifier,
+            snapshot_identifier=snapshot_identifier
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `cluster_identifier` - (Required, Forces new resource) The cluster identifier for which you want a snapshot.
+* `snapshot_identifier` - (Required, Forces new resource) A unique identifier for the snapshot that you are requesting. This identifier must be unique for all snapshots within the Amazon Web Services account.
+* `manual_snapshot_retention_period` - (Optional) The number of days that a manual snapshot is retained. If the value is `-1`, the manual snapshot is retained indefinitely. Valid values are -1 and between `1` and `3653`.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the snapshot.
+* `id` - A unique identifier for the snapshot that you are requesting. This identifiermust be unique for all snapshots within the Amazon Web Services account.
+* `kms_key_id` - The Key Management Service (KMS) key ID of the encryption key that was used to encrypt data in the cluster from which the snapshot was taken.
+* `owner_account` - For manual snapshots, the Amazon Web Services account used to create or copy the snapshot. For automatic snapshots, the owner of the cluster. The owner can perform all snapshot actions, such as sharing a manual snapshot.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Redshift Cluster Snapshots using `snapshot_identifier`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Redshift Cluster Snapshots using `snapshot_identifier`. For example:
+
+```console
+% terraform import aws_redshift_cluster_snapshot.test example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-a09e33c45529d48fc1c9c42a16cb50804ddf0e3d8b2c1c227d16889af8efa09b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/redshift_endpoint_access.html.markdown b/website/docs/cdktf/python/r/redshift_endpoint_access.html.markdown
new file mode 100644
index 00000000000..b7be9f28e10
--- /dev/null
+++ b/website/docs/cdktf/python/r/redshift_endpoint_access.html.markdown
@@ -0,0 +1,87 @@
+---
+subcategory: "Redshift"
+layout: "aws"
+page_title: "AWS: aws_redshift_endpoint_access"
+description: |-
+  Provides a Redshift Endpoint Access resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_redshift_endpoint_access
+
+Creates a new Amazon Redshift endpoint access.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.redshift_endpoint_access import RedshiftEndpointAccess
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        RedshiftEndpointAccess(self, "example",
+            cluster_identifier=Token.as_string(aws_redshift_cluster_example.cluster_identifier),
+            endpoint_name="example",
+            subnet_group_name=Token.as_string(aws_redshift_subnet_group_example.id)
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `cluster_identifier` - (Required) The cluster identifier of the cluster to access.
+* `endpoint_name` - (Required) The Redshift-managed VPC endpoint name.
+* `resource_owner` - (Optional) The Amazon Web Services account ID of the owner of the cluster. This is only required if the cluster is in another Amazon Web Services account.
+* `subnet_group_name` - (Required) The subnet group from which Amazon Redshift chooses the subnet to deploy the endpoint.
+* `vpc_security_group_ids` - (Optional) The security group that defines the ports, protocols, and sources for inbound traffic that you are authorizing into your endpoint.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `address` - The DNS address of the endpoint.
+* `id` - The Redshift-managed VPC endpoint name.
+* `port` - The port number on which the cluster accepts incoming connections.
+* `vpc_endpoint` - The connection endpoint for connecting to an Amazon Redshift cluster through the proxy. See details below.
+
+### VPC Endpoint
+
+* `network_interface` - One or more network interfaces of the endpoint. Also known as an interface endpoint. See details below.
+* `vpc_endpoint_id` - The connection endpoint ID for connecting an Amazon Redshift cluster through the proxy.
+* `vpc_id` - The VPC identifier that the endpoint is associated.
+
+### Network Interface
+
+* `availability_zone` - The Availability Zone.
+* `network_interface_id` - The network interface identifier.
+* `private_ip_address` - The IPv4 address of the network interface within the subnet.
+* `subnet_id` - The subnet identifier.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Redshift endpoint access using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Redshift endpoint access using the `name`. For example:
+
+```console
+% terraform import aws_redshift_endpoint_access.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-b1a23f712abf5e70b5e09afe1545b494b878b5bffe5195cca6310e786a254ca9 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/redshift_endpoint_authorization.html.markdown b/website/docs/cdktf/python/r/redshift_endpoint_authorization.html.markdown
new file mode 100644
index 00000000000..aa200d20e06
--- /dev/null
+++ b/website/docs/cdktf/python/r/redshift_endpoint_authorization.html.markdown
@@ -0,0 +1,73 @@
+---
+subcategory: "Redshift"
+layout: "aws"
+page_title: "AWS: aws_redshift_endpoint_authorization"
+description: |-
+  Provides a Redshift Endpoint Authorization resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_redshift_endpoint_authorization
+
+Creates a new Amazon Redshift endpoint authorization.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.redshift_endpoint_authorization import RedshiftEndpointAuthorization
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        RedshiftEndpointAuthorization(self, "example",
+            account="01234567910",
+            cluster_identifier=Token.as_string(aws_redshift_cluster_example.cluster_identifier)
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `account` - (Required) The Amazon Web Services account ID to grant access to.
+* `cluster_identifier` - (Required) The cluster identifier of the cluster to grant access to.
+* `force_delete` - (Optional) Indicates whether to force the revoke action. If true, the Redshift-managed VPC endpoints associated with the endpoint authorization are also deleted. Default value is `false`.
+* `vpc_ids` - (Optional) The virtual private cloud (VPC) identifiers to grant access to. If none are specified all VPCs in shared account are allowed.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `allowed_all_vpcs` - Indicates whether all VPCs in the grantee account are allowed access to the cluster.
+* `id` - The identifier of the Redshift Endpoint Authorization, `account`, and `cluster_identifier` separated by a colon (`:`).
+* `endpoint_count` - The number of Redshift-managed VPC endpoints created for the authorization.
+* `grantee` - The Amazon Web Services account ID of the grantee of the cluster.
+* `grantor` - The Amazon Web Services account ID of the cluster owner.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Redshift endpoint authorization using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Redshift endpoint authorization using the `id`. For example:
+
+```console
+% terraform import aws_redshift_endpoint_authorization.example 01234567910:cluster-example-id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-b9e5ce4e1f7abe40dbf21f61540bacd5f31c67c081dc3bdd6f2ce8318ce44e5e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/redshift_event_subscription.html.markdown b/website/docs/cdktf/python/r/redshift_event_subscription.html.markdown
new file mode 100644
index 00000000000..c3ef8ae7417
--- /dev/null
+++ b/website/docs/cdktf/python/r/redshift_event_subscription.html.markdown
@@ -0,0 +1,98 @@
+---
+subcategory: "Redshift"
+layout: "aws"
+page_title: "AWS: aws_redshift_event_subscription"
+description: |-
+  Provides a Redshift event subscription resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_redshift_event_subscription
+
+Provides a Redshift event subscription resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.redshift_cluster import RedshiftCluster
+from imports.aws.redshift_event_subscription import RedshiftEventSubscription
+from imports.aws.sns_topic import SnsTopic
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, nodeType):
+        super().__init__(scope, name)
+        default_var = RedshiftCluster(self, "default",
+            cluster_identifier="default",
+            database_name="default",
+            node_type=node_type
+        )
+        aws_sns_topic_default = SnsTopic(self, "default_1",
+            name="redshift-events"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_sns_topic_default.override_logical_id("default")
+        aws_redshift_event_subscription_default = RedshiftEventSubscription(self, "default_2",
+            event_categories=["configuration", "management", "monitoring", "security"
+            ],
+            name="redshift-event-sub",
+            severity="INFO",
+            sns_topic_arn=Token.as_string(aws_sns_topic_default.arn),
+            source_ids=[default_var.id],
+            source_type="cluster",
+            tags={
+                "Name": "default"
+            }
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_redshift_event_subscription_default.override_logical_id("default")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the Redshift event subscription.
+* `sns_topic_arn` - (Required) The ARN of the SNS topic to send events to.
+* `source_ids` - (Optional) A list of identifiers of the event sources for which events will be returned. If not specified, then all sources are included in the response. If specified, a `source_type` must also be specified.
+* `source_type` - (Optional) The type of source that will be generating the events. Valid options are `cluster`, `cluster-parameter-group`, `cluster-security-group`, `cluster-snapshot`, or `scheduled-action`. If not set, all sources will be subscribed to.
+* `severity` - (Optional) The event severity to be published by the notification subscription. Valid options are `INFO` or `ERROR`. Default value of `INFO`.
+* `event_categories` - (Optional) A list of event categories for a SourceType that you want to subscribe to. See https://docs.aws.amazon.com/redshift/latest/mgmt/working-with-event-notifications.html or run `aws redshift describe-event-categories`.
+* `enabled` - (Optional) A boolean flag to enable/disable the subscription. Defaults to `true`.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the Redshift event notification subscription
+* `id` - The name of the Redshift event notification subscription
+* `customer_aws_id` - The AWS customer account associated with the Redshift event notification subscription
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Redshift Event Subscriptions using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Redshift Event Subscriptions using the `name`. For example:
+
+```console
+% terraform import aws_redshift_event_subscription.default redshift-event-sub
+```
+
+<!-- cache-key: cdktf-0.18.0 input-15f307fc07a5350a90201b05a1ab1284198872ef394e5f0b141e17d35b730070 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/redshift_hsm_client_certificate.html.markdown b/website/docs/cdktf/python/r/redshift_hsm_client_certificate.html.markdown
new file mode 100644
index 00000000000..1a54c742fd0
--- /dev/null
+++ b/website/docs/cdktf/python/r/redshift_hsm_client_certificate.html.markdown
@@ -0,0 +1,68 @@
+---
+subcategory: "Redshift"
+layout: "aws"
+page_title: "AWS: aws_redshift_hsm_client_certificate"
+description: |-
+  Creates an HSM client certificate that an Amazon Redshift cluster will use to connect to the client's HSM in order to store and retrieve the keys used to encrypt the cluster databases.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_redshift_hsm_client_certificate
+
+Creates an HSM client certificate that an Amazon Redshift cluster will use to connect to the client's HSM in order to store and retrieve the keys used to encrypt the cluster databases.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.redshift_hsm_client_certificate import RedshiftHsmClientCertificate
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        RedshiftHsmClientCertificate(self, "example",
+            hsm_client_certificate_identifier="example"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `hsm_client_certificate_identifier` - (Required, Forces new resource) The identifier of the HSM client certificate.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the Hsm Client Certificate.
+* `hsm_client_certificate_public_key` - The public key that the Amazon Redshift cluster will use to connect to the HSM. You must register the public key in the HSM.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Redshift HSM Client Certificates using `hsm_client_certificate_identifier`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Redshift HSM Client Certificates using `hsm_client_certificate_identifier`. For example:
+
+```console
+% terraform import aws_redshift_hsm_client_certificate.test example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-5c66db327c1839116bd09ae2b35aec09129f16566c516184eda37641b0d7234e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/redshift_hsm_configuration.html.markdown b/website/docs/cdktf/python/r/redshift_hsm_configuration.html.markdown
new file mode 100644
index 00000000000..857503d3a44
--- /dev/null
+++ b/website/docs/cdktf/python/r/redshift_hsm_configuration.html.markdown
@@ -0,0 +1,78 @@
+---
+subcategory: "Redshift"
+layout: "aws"
+page_title: "AWS: aws_redshift_hsm_configuration"
+description: |-
+  Creates an HSM configuration that contains the information required by an Amazon Redshift cluster to store and use database encryption keys in a Hardware Security Module (HSM).
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_redshift_hsm_configuration
+
+  Creates an HSM configuration that contains the information required by an Amazon Redshift cluster to store and use database encryption keys in a Hardware Security Module (HSM).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.redshift_hsm_configuration import RedshiftHsmConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        RedshiftHsmConfiguration(self, "example",
+            description="example",
+            hsm_configuration_identifier="example",
+            hsm_ip_address="10.0.0.1",
+            hsm_partition_name="aws",
+            hsm_partition_password="example",
+            hsm_server_public_certificate="example"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `description` - (Required, Forces new resource) A text description of the HSM configuration to be created.
+* `hsm_configuration_identifier` - (Required, Forces new resource) The identifier to be assigned to the new Amazon Redshift HSM configuration.
+* `hsm_ip_address` - (Required, Forces new resource) The IP address that the Amazon Redshift cluster must use to access the HSM.
+* `hsm_partition_name` - (Required, Forces new resource) The name of the partition in the HSM where the Amazon Redshift clusters will store their database encryption keys.
+* `hsm_partition_password` - (Required, Forces new resource) The password required to access the HSM partition.
+* `hsm_server_public_certificate` - (Required, Forces new resource) The HSMs public certificate file. When using Cloud HSM, the file name is server.pem.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the Hsm Client Certificate.
+* `hsm_configuration_public_key` - The public key that the Amazon Redshift cluster will use to connect to the HSM. You must register the public key in the HSM.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Redshift HSM Client Certificates using `hsm_configuration_identifier`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Redshift HSM Client Certificates using `hsm_configuration_identifier`. For example:
+
+```console
+% terraform import aws_redshift_hsm_configuration.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-bd8a362c2861dd8693c1edee0bfc416d38b5b6843e0fe94fad4b67e8798aa729 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/redshift_parameter_group.html.markdown b/website/docs/cdktf/python/r/redshift_parameter_group.html.markdown
new file mode 100644
index 00000000000..00296500921
--- /dev/null
+++ b/website/docs/cdktf/python/r/redshift_parameter_group.html.markdown
@@ -0,0 +1,90 @@
+---
+subcategory: "Redshift"
+layout: "aws"
+page_title: "AWS: aws_redshift_parameter_group"
+description: |-
+  Provides a Redshift Cluster parameter group resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_redshift_parameter_group
+
+Provides a Redshift Cluster parameter group resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.redshift_parameter_group import RedshiftParameterGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        RedshiftParameterGroup(self, "bar",
+            family="redshift-1.0",
+            name="parameter-group-test-terraform",
+            parameter=[RedshiftParameterGroupParameter(
+                name="require_ssl",
+                value="true"
+            ), RedshiftParameterGroupParameter(
+                name="query_group",
+                value="example"
+            ), RedshiftParameterGroupParameter(
+                name="enable_user_activity_logging",
+                value="true"
+            )
+            ]
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the Redshift parameter group.
+* `family` - (Required) The family of the Redshift parameter group.
+* `description` - (Optional) The description of the Redshift parameter group. Defaults to "Managed by Terraform".
+* `parameter` - (Optional) A list of Redshift parameters to apply.
+
+Parameter blocks support the following:
+
+* `name` - (Required) The name of the Redshift parameter.
+* `value` - (Required) The value of the Redshift parameter.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+You can read more about the parameters that Redshift supports in the [documentation](http://docs.aws.amazon.com/redshift/latest/mgmt/working-with-parameter-groups.html)
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of parameter group
+* `id` - The Redshift parameter group name.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Redshift Parameter Groups using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Redshift Parameter Groups using the `name`. For example:
+
+```console
+% terraform import aws_redshift_parameter_group.paramgroup1 parameter-group-test-terraform
+```
+
+<!-- cache-key: cdktf-0.18.0 input-8fbf52bda44476ea1fcc81df655088804c5cc233d70ed33ebca6dd6caf8a3a7a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/redshift_partner.html.markdown b/website/docs/cdktf/python/r/redshift_partner.html.markdown
new file mode 100644
index 00000000000..082d859cd53
--- /dev/null
+++ b/website/docs/cdktf/python/r/redshift_partner.html.markdown
@@ -0,0 +1,73 @@
+---
+subcategory: "Redshift"
+layout: "aws"
+page_title: "AWS: aws_redshift_partner"
+description: |-
+  Provides a Redshift Partner resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_redshift_partner
+
+Creates a new Amazon Redshift Partner Integration.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.redshift_partner import RedshiftPartner
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        RedshiftPartner(self, "example",
+            account_id=Token.as_string(1234567910),
+            cluster_identifier=Token.as_string(aws_redshift_cluster_example.id),
+            database_name=Token.as_string(aws_redshift_cluster_example.database_name),
+            partner_name="example"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `account_id` - (Required) The Amazon Web Services account ID that owns the cluster.
+* `cluster_identifier` - (Required) The cluster identifier of the cluster that receives data from the partner.
+* `database_name` - (Required) The name of the database that receives data from the partner.
+* `partner_name` - (Required) The name of the partner that is authorized to send data.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The identifier of the Redshift partner, `account_id`, `cluster_identifier`, `database_name`, `partner_name` separated by a colon (`:`).
+* `status` - (Optional) The partner integration status.
+* `status_message` - (Optional) The status message provided by the partner.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Redshift usage limits using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Redshift usage limits using the `id`. For example:
+
+```console
+% terraform import aws_redshift_partner.example 01234567910:cluster-example-id:example:example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-d4438832cfe9bd08e76f7dbce4113e2e512ea90f05f4a5914f89a70db35ad904 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/redshift_scheduled_action.html.markdown b/website/docs/cdktf/python/r/redshift_scheduled_action.html.markdown
new file mode 100644
index 00000000000..7e9a29a98d1
--- /dev/null
+++ b/website/docs/cdktf/python/r/redshift_scheduled_action.html.markdown
@@ -0,0 +1,177 @@
+---
+subcategory: "Redshift"
+layout: "aws"
+page_title: "AWS: aws_redshift_scheduled_action"
+description: |-
+  Provides a Redshift Scheduled Action resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_redshift_scheduled_action
+
+## Example Usage
+
+### Pause Cluster Action
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.iam_policy import IamPolicy
+from imports.aws.iam_role import IamRole
+from imports.aws.iam_role_policy_attachment import IamRolePolicyAttachment
+from imports.aws.redshift_scheduled_action import RedshiftScheduledAction
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        assume_role = DataAwsIamPolicyDocument(self, "assume_role",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["sts:AssumeRole"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["scheduler.redshift.amazonaws.com"],
+                    type="Service"
+                )
+                ]
+            )
+            ]
+        )
+        example = DataAwsIamPolicyDocument(self, "example",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["redshift:PauseCluster", "redshift:ResumeCluster", "redshift:ResizeCluster"
+                ],
+                effect="Allow",
+                resources=["*"]
+            )
+            ]
+        )
+        aws_iam_policy_example = IamPolicy(self, "example_2",
+            name="redshift_scheduled_action",
+            policy=Token.as_string(example.json)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_policy_example.override_logical_id("example")
+        aws_iam_role_example = IamRole(self, "example_3",
+            assume_role_policy=Token.as_string(assume_role.json),
+            name="redshift_scheduled_action"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_role_example.override_logical_id("example")
+        aws_iam_role_policy_attachment_example = IamRolePolicyAttachment(self, "example_4",
+            policy_arn=Token.as_string(aws_iam_policy_example.arn),
+            role=Token.as_string(aws_iam_role_example.name)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_role_policy_attachment_example.override_logical_id("example")
+        aws_redshift_scheduled_action_example = RedshiftScheduledAction(self, "example_5",
+            iam_role=Token.as_string(aws_iam_role_example.arn),
+            name="tf-redshift-scheduled-action",
+            schedule="cron(00 23 * * ? *)",
+            target_action=RedshiftScheduledActionTargetAction(
+                pause_cluster=RedshiftScheduledActionTargetActionPauseCluster(
+                    cluster_identifier="tf-redshift001"
+                )
+            )
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_redshift_scheduled_action_example.override_logical_id("example")
+```
+
+### Resize Cluster Action
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.redshift_scheduled_action import RedshiftScheduledAction
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        RedshiftScheduledAction(self, "example",
+            iam_role=Token.as_string(aws_iam_role_example.arn),
+            name="tf-redshift-scheduled-action",
+            schedule="cron(00 23 * * ? *)",
+            target_action=RedshiftScheduledActionTargetAction(
+                resize_cluster=RedshiftScheduledActionTargetActionResizeCluster(
+                    cluster_identifier="tf-redshift001",
+                    cluster_type="multi-node",
+                    node_type="dc1.large",
+                    number_of_nodes=2
+                )
+            )
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The scheduled action name.
+* `description` - (Optional) The description of the scheduled action.
+* `enable` - (Optional) Whether to enable the scheduled action. Default is `true` .
+* `start_time` - (Optional) The start time in UTC when the schedule is active, in UTC RFC3339 format(for example, YYYY-MM-DDTHH:MM:SSZ).
+* `end_time` - (Optional) The end time in UTC when the schedule is active, in UTC RFC3339 format(for example, YYYY-MM-DDTHH:MM:SSZ).
+* `schedule` - (Required) The schedule of action. The schedule is defined format of "at expression" or "cron expression", for example `at(2016-03-04T17:27:00)` or `cron(0 10 ? * MON *)`. See [Scheduled Action](https://docs.aws.amazon.com/redshift/latest/APIReference/API_ScheduledAction.html) for more information.
+* `iam_role` - (Required) The IAM role to assume to run the scheduled action.
+* `target_action` - (Required) Target action. Documented below.
+
+### Nested Blocks
+
+#### `target_action`
+
+* `pause_cluster` - (Optional) An action that runs a `PauseCluster` API operation. Documented below.
+* `resize_cluster` - (Optional) An action that runs a `ResizeCluster` API operation. Documented below.
+* `resume_cluster` - (Optional) An action that runs a `ResumeCluster` API operation. Documented below.
+
+### `pause_cluster`
+
+* `cluster_identifier` - (Required) The identifier of the cluster to be paused.
+
+### `resize_cluster`
+
+* `cluster_identifier` - (Required) The unique identifier for the cluster to resize.
+* `classic` - (Optional) A boolean value indicating whether the resize operation is using the classic resize process. Default: `false`.
+* `cluster_type` - (Optional)　The new cluster type for the specified cluster.
+* `node_type` - (Optional) The new node type for the nodes you are adding.
+* `number_of_nodes` - (Optional) The new number of nodes for the cluster.
+
+### `resume_cluster`
+
+* `cluster_identifier` - (Required) The identifier of the cluster to be resumed.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Redshift Scheduled Action name.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Redshift Scheduled Action using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Redshift Scheduled Action using the `name`. For example:
+
+```console
+% terraform import aws_redshift_scheduled_action.example tf-redshift-scheduled-action
+```
+
+<!-- cache-key: cdktf-0.18.0 input-bb46dc91c30f3bd0e92ef6f30fbb8c2c42b66b25bd27c78c262e5e212679b4d1 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/redshift_snapshot_copy_grant.html.markdown b/website/docs/cdktf/python/r/redshift_snapshot_copy_grant.html.markdown
new file mode 100644
index 00000000000..082ead4c31b
--- /dev/null
+++ b/website/docs/cdktf/python/r/redshift_snapshot_copy_grant.html.markdown
@@ -0,0 +1,81 @@
+---
+subcategory: "Redshift"
+layout: "aws"
+page_title: "AWS: aws_redshift_snapshot_copy_grant"
+description: |-
+  Creates a snapshot copy grant that allows AWS Redshift to encrypt copied snapshots with a customer master key from AWS KMS in a destination region.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_redshift_snapshot_copy_grant
+
+Creates a snapshot copy grant that allows AWS Redshift to encrypt copied snapshots with a customer master key from AWS KMS in a destination region.
+
+Note that the grant must exist in the destination region, and not in the region of the cluster.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.redshift_cluster import RedshiftCluster
+from imports.aws.redshift_snapshot_copy_grant import RedshiftSnapshotCopyGrant
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, clusterIdentifier, nodeType):
+        super().__init__(scope, name)
+        test = RedshiftSnapshotCopyGrant(self, "test",
+            snapshot_copy_grant_name="my-grant"
+        )
+        aws_redshift_cluster_test = RedshiftCluster(self, "test_1",
+            snapshot_copy=RedshiftClusterSnapshotCopy(
+                destination_region="us-east-2",
+                grant_name=test.snapshot_copy_grant_name
+            ),
+            cluster_identifier=cluster_identifier,
+            node_type=node_type
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_redshift_cluster_test.override_logical_id("test")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `snapshot_copy_grant_name` - (Required, Forces new resource) A friendly name for identifying the grant.
+* `kms_key_id` - (Optional, Forces new resource) The unique identifier for the customer master key (CMK) that the grant applies to. Specify the key ID or the Amazon Resource Name (ARN) of the CMK. To specify a CMK in a different AWS account, you must use the key ARN. If not specified, the default key is used.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of snapshot copy grant
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Redshift Snapshot Copy Grants by name. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Redshift Snapshot Copy Grants by name. For example:
+
+```console
+% terraform import aws_redshift_snapshot_copy_grant.test my-grant
+```
+
+<!-- cache-key: cdktf-0.18.0 input-7132ffb13bb997106c250daca68bcc8d4f28e5d2bd7fcb63ef1d3441a64c72d3 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/redshift_snapshot_schedule.html.markdown b/website/docs/cdktf/python/r/redshift_snapshot_schedule.html.markdown
new file mode 100644
index 00000000000..ea7cde66082
--- /dev/null
+++ b/website/docs/cdktf/python/r/redshift_snapshot_schedule.html.markdown
@@ -0,0 +1,71 @@
+---
+subcategory: "Redshift"
+layout: "aws"
+page_title: "AWS: aws_redshift_snapshot_schedule"
+description: |-
+  Provides an Redshift Snapshot Schedule resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_redshift_snapshot_schedule
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.redshift_snapshot_schedule import RedshiftSnapshotSchedule
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        RedshiftSnapshotSchedule(self, "default",
+            definitions=["rate(12 hours)"],
+            identifier="tf-redshift-snapshot-schedule"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `identifier` - (Optional, Forces new resource) The snapshot schedule identifier. If omitted, Terraform will assign a random, unique identifier.
+* `identifier_prefix` - (Optional, Forces new resource) Creates a unique
+identifier beginning with the specified prefix. Conflicts with `identifier`.
+* `description` - (Optional) The description of the snapshot schedule.
+* `definitions` - (Optional) The definition of the snapshot schedule. The definition is made up of schedule expressions, for example `cron(30 12 *)` or `rate(12 hours)`.
+* `force_destroy` - (Optional) Whether to destroy all associated clusters with this snapshot schedule on deletion. Must be enabled and applied before attempting deletion.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the Redshift Snapshot Schedule.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Redshift Snapshot Schedule using the `identifier`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Redshift Snapshot Schedule using the `identifier`. For example:
+
+```console
+% terraform import aws_redshift_snapshot_schedule.default tf-redshift-snapshot-schedule
+```
+
+<!-- cache-key: cdktf-0.18.0 input-0efaf47bc050c3417ad21dec274dd17ba88abe8c5b011ce8e99d3a0223fa2ffa -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/redshift_snapshot_schedule_association.html.markdown b/website/docs/cdktf/python/r/redshift_snapshot_schedule_association.html.markdown
new file mode 100644
index 00000000000..3aa85007f1f
--- /dev/null
+++ b/website/docs/cdktf/python/r/redshift_snapshot_schedule_association.html.markdown
@@ -0,0 +1,82 @@
+---
+subcategory: "Redshift"
+layout: "aws"
+page_title: "AWS: aws_redshift_snapshot_schedule_association"
+description: |-
+  Provides an Association Redshift Cluster and Snapshot Schedule resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_redshift_snapshot_schedule_association
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.redshift_cluster import RedshiftCluster
+from imports.aws.redshift_snapshot_schedule import RedshiftSnapshotSchedule
+from imports.aws.redshift_snapshot_schedule_association import RedshiftSnapshotScheduleAssociation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        default_var = RedshiftCluster(self, "default",
+            cluster_identifier="tf-redshift-cluster",
+            cluster_type="single-node",
+            database_name="mydb",
+            master_password="Mustbe8characters",
+            master_username="foo",
+            node_type="dc1.large"
+        )
+        aws_redshift_snapshot_schedule_default = RedshiftSnapshotSchedule(self, "default_1",
+            definitions=["rate(12 hours)"],
+            identifier="tf-redshift-snapshot-schedule"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_redshift_snapshot_schedule_default.override_logical_id("default")
+        aws_redshift_snapshot_schedule_association_default =
+        RedshiftSnapshotScheduleAssociation(self, "default_2",
+            cluster_identifier=default_var.id,
+            schedule_identifier=Token.as_string(aws_redshift_snapshot_schedule_default.id)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_redshift_snapshot_schedule_association_default.override_logical_id("default")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `cluster_identifier` - (Required, Forces new resource) The cluster identifier.
+* `schedule_identifier` - (Required, Forces new resource) The snapshot schedule identifier.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Redshift Snapshot Schedule Association using the `<cluster-identifier>/<schedule-identifier>`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Redshift Snapshot Schedule Association using the `<cluster-identifier>/<schedule-identifier>`. For example:
+
+```console
+% terraform import aws_redshift_snapshot_schedule_association.default tf-redshift-cluster/tf-redshift-snapshot-schedule
+```
+
+<!-- cache-key: cdktf-0.18.0 input-cfbb9314d7e41451bce6ec8e24e4375625bd63ba89df980d70fe96df9cca5e41 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/redshift_subnet_group.html.markdown b/website/docs/cdktf/python/r/redshift_subnet_group.html.markdown
new file mode 100644
index 00000000000..6dca9ad70ee
--- /dev/null
+++ b/website/docs/cdktf/python/r/redshift_subnet_group.html.markdown
@@ -0,0 +1,99 @@
+---
+subcategory: "Redshift"
+layout: "aws"
+page_title: "AWS: aws_redshift_subnet_group"
+description: |-
+  Provides a Redshift Subnet Group resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_redshift_subnet_group
+
+Creates a new Amazon Redshift subnet group. You must provide a list of one or more subnets in your existing Amazon Virtual Private Cloud (Amazon VPC) when creating Amazon Redshift subnet group.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.redshift_subnet_group import RedshiftSubnetGroup
+from imports.aws.subnet import Subnet
+from imports.aws.vpc import Vpc
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        foo = Vpc(self, "foo",
+            cidr_block="10.1.0.0/16"
+        )
+        bar = Subnet(self, "bar",
+            availability_zone="us-west-2b",
+            cidr_block="10.1.2.0/24",
+            tags={
+                "Name": "tf-dbsubnet-test-2"
+            },
+            vpc_id=foo.id
+        )
+        aws_subnet_foo = Subnet(self, "foo_2",
+            availability_zone="us-west-2a",
+            cidr_block="10.1.1.0/24",
+            tags={
+                "Name": "tf-dbsubnet-test-1"
+            },
+            vpc_id=foo.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_subnet_foo.override_logical_id("foo")
+        aws_redshift_subnet_group_foo = RedshiftSubnetGroup(self, "foo_3",
+            name="foo",
+            subnet_ids=[Token.as_string(aws_subnet_foo.id), bar.id],
+            tags={
+                "environment": "Production"
+            }
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_redshift_subnet_group_foo.override_logical_id("foo")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the Redshift Subnet group.
+* `description` - (Optional) The description of the Redshift Subnet group. Defaults to "Managed by Terraform".
+* `subnet_ids` - (Required) An array of VPC subnet IDs.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the Redshift Subnet group name
+* `id` - The Redshift Subnet group ID.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Redshift subnet groups using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Redshift subnet groups using the `name`. For example:
+
+```console
+% terraform import aws_redshift_subnet_group.testgroup1 test-cluster-subnet-group
+```
+
+<!-- cache-key: cdktf-0.18.0 input-3d603e489c1bb01bdc966a54771f0f1ba11b9496fe058472a61fd0520c9b7c8c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/redshift_usage_limit.html.markdown b/website/docs/cdktf/python/r/redshift_usage_limit.html.markdown
new file mode 100644
index 00000000000..143357e5ef0
--- /dev/null
+++ b/website/docs/cdktf/python/r/redshift_usage_limit.html.markdown
@@ -0,0 +1,76 @@
+---
+subcategory: "Redshift"
+layout: "aws"
+page_title: "AWS: aws_redshift_usage_limit"
+description: |-
+  Provides a Redshift Usage Limit resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_redshift_usage_limit
+
+Creates a new Amazon Redshift Usage Limit.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.redshift_usage_limit import RedshiftUsageLimit
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        RedshiftUsageLimit(self, "example",
+            amount=60,
+            cluster_identifier=Token.as_string(aws_redshift_cluster_example.id),
+            feature_type="concurrency-scaling",
+            limit_type="time"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `amount` - (Required) The limit amount. If time-based, this amount is in minutes. If data-based, this amount is in terabytes (TB). The value must be a positive number.
+* `breach_action` - (Optional) The action that Amazon Redshift takes when the limit is reached. The default is `log`. Valid values are `log`, `emit-metric`, and `disable`.
+* `cluster_identifier` - (Required) The identifier of the cluster that you want to limit usage.
+* `feature_type` - (Required) The Amazon Redshift feature that you want to limit. Valid values are `spectrum`, `concurrency-scaling`, and `cross-region-datasharing`.
+* `limit_type` - (Required) The type of limit. Depending on the feature type, this can be based on a time duration or data size. If FeatureType is `spectrum`, then LimitType must be `data-scanned`. If FeatureType is `concurrency-scaling`, then LimitType must be `time`. If FeatureType is `cross-region-datasharing`, then LimitType must be `data-scanned`. Valid values are `data-scanned`, and `time`.
+* `period` - (Optional) The time period that the amount applies to. A weekly period begins on Sunday. The default is `monthly`. Valid values are `daily`, `weekly`, and `monthly`.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the Redshift Usage Limit.
+* `id` - The Redshift Usage Limit ID.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Redshift usage limits using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Redshift usage limits using the `id`. For example:
+
+```console
+% terraform import aws_redshift_usage_limit.example example-id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-66b262f3ea166c96e47be520f77ad628bb0cc4e80252fff83651756e7d728428 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/redshiftdata_statement.html.markdown b/website/docs/cdktf/python/r/redshiftdata_statement.html.markdown
new file mode 100644
index 00000000000..25a9b3f5b0c
--- /dev/null
+++ b/website/docs/cdktf/python/r/redshiftdata_statement.html.markdown
@@ -0,0 +1,101 @@
+---
+subcategory: "Redshift Data"
+layout: "aws"
+page_title: "AWS: aws_redshiftdata_statement"
+description: |-
+  Provides a Redshift Data Statement execution resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_redshiftdata_statement
+
+Executes a Redshift Data Statement.
+
+## Example Usage
+
+### cluster_identifier
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.redshiftdata_statement import RedshiftdataStatement
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        RedshiftdataStatement(self, "example",
+            cluster_identifier=Token.as_string(aws_redshift_cluster_example.cluster_identifier),
+            database=Token.as_string(aws_redshift_cluster_example.database_name),
+            db_user=Token.as_string(aws_redshift_cluster_example.master_username),
+            sql="CREATE GROUP group_name;"
+        )
+```
+
+### workgroup_name
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.redshiftdata_statement import RedshiftdataStatement
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        RedshiftdataStatement(self, "example",
+            database="dev",
+            sql="CREATE GROUP group_name;",
+            workgroup_name=Token.as_string(aws_redshiftserverless_workgroup_example.workgroup_name)
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `database` - (Required) The name of the database.
+* `sql` - (Required) The SQL statement text to run.
+
+The following arguments are optional:
+
+* `cluster_identifier` - (Optional) The cluster identifier. This parameter is required when connecting to a cluster and authenticating using either Secrets Manager or temporary credentials.
+* `db_user` - (Optional) The database user name.
+* `secret_arn` - (Optional) The name or ARN of the secret that enables access to the database.
+* `statement_name` - (Optional) The name of the SQL statement. You can name the SQL statement when you create it to identify the query.
+* `with_event` - (Optional) A value that indicates whether to send an event to the Amazon EventBridge event bus after the SQL statement runs.
+* `workgroup_name` - (Optional) The serverless workgroup name. This parameter is required when connecting to a serverless workgroup and authenticating using either Secrets Manager or temporary credentials.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Redshift Data Statement ID.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Redshift Data Statements using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Redshift Data Statements using the `id`. For example:
+
+```console
+% terraform import aws_redshiftdata_statement.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-890483d136320a7936958ee447618d785135e348982c003fa40f68a3e28cefbc -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/redshiftserverless_endpoint_access.html.markdown b/website/docs/cdktf/python/r/redshiftserverless_endpoint_access.html.markdown
new file mode 100644
index 00000000000..4aa03bf9460
--- /dev/null
+++ b/website/docs/cdktf/python/r/redshiftserverless_endpoint_access.html.markdown
@@ -0,0 +1,87 @@
+---
+subcategory: "Redshift Serverless"
+layout: "aws"
+page_title: "AWS: aws_redshiftserverless_endpoint_access"
+description: |-
+  Provides a Redshift Serverless Endpoint Access resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_redshiftserverless_endpoint_access
+
+Creates a new Amazon Redshift Serverless Endpoint Access.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.redshiftserverless_endpoint_access import RedshiftserverlessEndpointAccess
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, subnetIds):
+        super().__init__(scope, name)
+        RedshiftserverlessEndpointAccess(self, "example",
+            endpoint_name="example",
+            workgroup_name="example",
+            subnet_ids=subnet_ids
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `endpoint_name` - (Required) The name of the endpoint.
+* `subnet_ids` - (Required) An array of VPC subnet IDs to associate with the endpoint.
+* `vpc_security_group_ids` - (Optional) An array of security group IDs to associate with the workgroup.
+* `workgroup_name` - (Required) The name of the workgroup.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the Redshift Serverless Endpoint Access.
+* `id` - The Redshift Endpoint Access Name.
+* `address` - The DNS address of the VPC endpoint.
+* `port` - The port that Amazon Redshift Serverless listens on.
+* `vpc_endpoint` - The VPC endpoint or the Redshift Serverless workgroup. See `VPC Endpoint` below.
+
+#### VPC Endpoint
+
+* `vpc_endpoint_id` - The DNS address of the VPC endpoint.
+* `vpc_id` - The port that Amazon Redshift Serverless listens on.
+* `network_interface` - The network interfaces of the endpoint.. See `Network Interface` below.
+
+##### Network Interface
+
+* `availability_zone` - The availability Zone.
+* `network_interface_id` - The unique identifier of the network interface.
+* `private_ip_address` - The IPv4 address of the network interface within the subnet.
+* `subnet_id` - The unique identifier of the subnet.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Redshift Serverless Endpoint Access using the `endpoint_name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Redshift Serverless Endpoint Access using the `endpoint_name`. For example:
+
+```console
+% terraform import aws_redshiftserverless_endpoint_access.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-a869e2502d87c1ead378782f8a695ae513642420fec05b7e7f019308555ddb33 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/redshiftserverless_namespace.html.markdown b/website/docs/cdktf/python/r/redshiftserverless_namespace.html.markdown
new file mode 100644
index 00000000000..b7d327389cf
--- /dev/null
+++ b/website/docs/cdktf/python/r/redshiftserverless_namespace.html.markdown
@@ -0,0 +1,76 @@
+---
+subcategory: "Redshift Serverless"
+layout: "aws"
+page_title: "AWS: aws_redshiftserverless_namespace"
+description: |-
+  Provides a Redshift Serverless Namespace resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_redshiftserverless_namespace
+
+Creates a new Amazon Redshift Serverless Namespace.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.redshiftserverless_namespace import RedshiftserverlessNamespace
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        RedshiftserverlessNamespace(self, "example",
+            namespace_name="concurrency-scaling"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `admin_user_password` - (Optional) The password of the administrator for the first database created in the namespace.
+* `admin_username` - (Optional) The username of the administrator for the first database created in the namespace.
+* `db_name` - (Optional) The name of the first database created in the namespace.
+* `default_iam_role_arn` - (Optional) The Amazon Resource Name (ARN) of the IAM role to set as a default in the namespace. When specifying `default_iam_role_arn`, it also must be part of `iam_roles`.
+* `iam_roles` - (Optional) A list of IAM roles to associate with the namespace.
+* `kms_key_id` - (Optional) The ARN of the Amazon Web Services Key Management Service key used to encrypt your data.
+* `log_exports` - (Optional) The types of logs the namespace can export. Available export types are `userlog`, `connectionlog`, and `useractivitylog`.
+* `namespace_name` - (Required) The name of the namespace.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the Redshift Serverless Namespace.
+* `id` - The Redshift Namespace Name.
+* `namespace_id` - The Redshift Namespace ID.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Redshift Serverless Namespaces using the `namespace_name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Redshift Serverless Namespaces using the `namespace_name`. For example:
+
+```console
+% terraform import aws_redshiftserverless_namespace.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-3fa05a19a9755fb51145df09f985b4240171d15c6da3e7aaeeaa933a19f41ff3 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/redshiftserverless_resource_policy.html.markdown b/website/docs/cdktf/python/r/redshiftserverless_resource_policy.html.markdown
new file mode 100644
index 00000000000..f4893217ccf
--- /dev/null
+++ b/website/docs/cdktf/python/r/redshiftserverless_resource_policy.html.markdown
@@ -0,0 +1,79 @@
+---
+subcategory: "Redshift Serverless"
+layout: "aws"
+page_title: "AWS: aws_redshiftserverless_resource_policy"
+description: |-
+  Provides a Redshift Serverless Resource Policy resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_redshiftserverless_resource_policy
+
+Creates a new Amazon Redshift Serverless Resource Policy.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.redshiftserverless_resource_policy import RedshiftserverlessResourcePolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        RedshiftserverlessResourcePolicy(self, "example",
+            policy=Token.as_string(
+                Fn.jsonencode({
+                    "Statement": [{
+                        "Action": ["redshift-serverless:RestoreFromSnapshot"],
+                        "Effect": "Allow",
+                        "Principal": {
+                            "AWS": ["12345678901"]
+                        },
+                        "Sid": ""
+                    }
+                    ],
+                    "Version": "2012-10-17"
+                })),
+            resource_arn=Token.as_string(aws_redshiftserverless_snapshot_example.arn)
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `resource_arn` - (Required) The Amazon Resource Name (ARN) of the account to create or update a resource policy for.
+* `policy` - (Required) The policy to create or update. For example, the following policy grants a user authorization to restore a snapshot.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Amazon Resource Name (ARN) of the account to create or update a resource policy for.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Redshift Serverless Resource Policies using the `resource_arn`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Redshift Serverless Resource Policies using the `resource_arn`. For example:
+
+```console
+% terraform import aws_redshiftserverless_resource_policy.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-a616ab40a392ade8fb2ac2a0656140773e5db2656ed7fdddaff9050c933530e7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/redshiftserverless_snapshot.html.markdown b/website/docs/cdktf/python/r/redshiftserverless_snapshot.html.markdown
new file mode 100644
index 00000000000..248e36bd01f
--- /dev/null
+++ b/website/docs/cdktf/python/r/redshiftserverless_snapshot.html.markdown
@@ -0,0 +1,75 @@
+---
+subcategory: "Redshift Serverless"
+layout: "aws"
+page_title: "AWS: aws_redshiftserverless_snapshot"
+description: |-
+  Provides a Redshift Serverless Snapshot resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_redshiftserverless_snapshot
+
+Creates a new Amazon Redshift Serverless Snapshot.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.redshiftserverless_snapshot import RedshiftserverlessSnapshot
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        RedshiftserverlessSnapshot(self, "example",
+            namespace_name=Token.as_string(aws_redshiftserverless_workgroup_example.namespace_name),
+            snapshot_name="example"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `namespace_name` - (Required) The namespace to create a snapshot for.
+* `snapshot_name` - (Required) The name of the snapshot.
+* `retention_period` - (Optional) How long to retain the created snapshot. Default value is `-1`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `accounts_with_provisioned_restore_access` - All of the Amazon Web Services accounts that have access to restore a snapshot to a provisioned cluster.
+* `accounts_with_restore_access` - All of the Amazon Web Services accounts that have access to restore a snapshot to a namespace.
+* `admin_username` - The username of the database within a snapshot.
+* `arn` - The Amazon Resource Name (ARN) of the snapshot.
+* `id` - The name of the snapshot.
+* `kms_key_id` - The unique identifier of the KMS key used to encrypt the snapshot.
+* `namespace_arn` - The Amazon Resource Name (ARN) of the namespace the snapshot was created from.
+* `owner_account` - The owner Amazon Web Services; account of the snapshot.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Redshift Serverless Snapshots using the `snapshot_name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Redshift Serverless Snapshots using the `snapshot_name`. For example:
+
+```console
+% terraform import aws_redshiftserverless_snapshot.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-8cdad9004cc5bbc08f27efbdc59cce26713d56ad09ff5203e21e04db05d9916b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/redshiftserverless_usage_limit.html.markdown b/website/docs/cdktf/python/r/redshiftserverless_usage_limit.html.markdown
new file mode 100644
index 00000000000..4503646f656
--- /dev/null
+++ b/website/docs/cdktf/python/r/redshiftserverless_usage_limit.html.markdown
@@ -0,0 +1,80 @@
+---
+subcategory: "Redshift Serverless"
+layout: "aws"
+page_title: "AWS: aws_redshiftserverless_usage_limit"
+description: |-
+  Provides a Redshift Serverless Usage Limit resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_redshiftserverless_usage_limit
+
+Creates a new Amazon Redshift Serverless Usage Limit.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.redshiftserverless_usage_limit import RedshiftserverlessUsageLimit
+from imports.aws.redshiftserverless_workgroup import RedshiftserverlessWorkgroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = RedshiftserverlessWorkgroup(self, "example",
+            namespace_name=Token.as_string(aws_redshiftserverless_namespace_example.namespace_name),
+            workgroup_name="example"
+        )
+        aws_redshiftserverless_usage_limit_example =
+        RedshiftserverlessUsageLimit(self, "example_1",
+            amount=60,
+            resource_arn=example.arn,
+            usage_type="serverless-compute"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_redshiftserverless_usage_limit_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `amount` - (Required) The limit amount. If time-based, this amount is in Redshift Processing Units (RPU) consumed per hour. If data-based, this amount is in terabytes (TB) of data transferred between Regions in cross-account sharing. The value must be a positive number.
+* `breach_action` - (Optional) The action that Amazon Redshift Serverless takes when the limit is reached. Valid values are `log`, `emit-metric`, and `deactivate`. The default is `log`.
+* `period` - (Optional) The time period that the amount applies to. A weekly period begins on Sunday. Valid values are `daily`, `weekly`, and `monthly`. The default is `monthly`.
+* `resource_arn` - (Required) The Amazon Resource Name (ARN) of the Amazon Redshift Serverless resource to create the usage limit for.
+* `usage_type` - (Required) The type of Amazon Redshift Serverless usage to create a usage limit for. Valid values are `serverless-compute` or `cross-region-datasharing`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the Redshift Serverless Usage Limit.
+* `id` - The Redshift Usage Limit id.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Redshift Serverless Usage Limits using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Redshift Serverless Usage Limits using the `id`. For example:
+
+```console
+% terraform import aws_redshiftserverless_usage_limit.example example-id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-84a424322614113d9d70f498bff96348f7b00d895883170bcacbcdfd508f8a95 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/redshiftserverless_workgroup.html.markdown b/website/docs/cdktf/python/r/redshiftserverless_workgroup.html.markdown
new file mode 100644
index 00000000000..37d2e218363
--- /dev/null
+++ b/website/docs/cdktf/python/r/redshiftserverless_workgroup.html.markdown
@@ -0,0 +1,113 @@
+---
+subcategory: "Redshift Serverless"
+layout: "aws"
+page_title: "AWS: aws_redshiftserverless_workgroup"
+description: |-
+  Provides a Redshift Serverless Workgroup resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_redshiftserverless_workgroup
+
+Creates a new Amazon Redshift Serverless Workgroup.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.redshiftserverless_workgroup import RedshiftserverlessWorkgroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        RedshiftserverlessWorkgroup(self, "example",
+            namespace_name="concurrency-scaling",
+            workgroup_name="concurrency-scaling"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `namespace_name` - (Required) The name of the namespace.
+* `workgroup_name` - (Required) The name of the workgroup.
+
+The following arguments are optional:
+
+* `base_capacity` - (Optional) The base data warehouse capacity of the workgroup in Redshift Processing Units (RPUs).
+* `config_parameter` - (Optional) An array of parameters to set for more control over a serverless database. See `Config Parameter` below.
+* `enhanced_vpc_routing` - (Optional) The value that specifies whether to turn on enhanced virtual private cloud (VPC) routing, which forces Amazon Redshift Serverless to route traffic through your VPC instead of over the internet.
+* `publicly_accessible` - (Optional) A value that specifies whether the workgroup can be accessed from a public network.
+* `security_group_ids` - (Optional) An array of security group IDs to associate with the workgroup.
+* `subnet_ids` - (Optional) An array of VPC subnet IDs to associate with the workgroup. When set, must contain at least three subnets spanning three Availability Zones. A minimum number of IP addresses is required and scales with the Base Capacity. For more information, see the following [AWS document](https://docs.aws.amazon.com/redshift/latest/mgmt/serverless-known-issues.html).
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Config Parameter
+
+* `parameter_key` - (Required) The key of the parameter. The options are `auto_mv`, `datestyle`, `enable_case_sensitive_identifier`, `enable_user_activity_logging`, `query_group`, `search_path`, `require_ssl`, `use_fips_ssl`, and [query monitoring metrics](https://docs.aws.amazon.com/redshift/latest/dg/cm-c-wlm-query-monitoring-rules.html#cm-c-wlm-query-monitoring-metrics-serverless) that let you define performance boundaries: `max_query_cpu_time`, `max_query_blocks_read`, `max_scan_row_count`, `max_query_execution_time`, `max_query_queue_time`, `max_query_cpu_usage_percent`, `max_query_temp_blocks_to_disk`, `max_join_row_count` and `max_nested_loop_join_row_count`.
+* `parameter_value` - (Required) The value of the parameter to set.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the Redshift Serverless Workgroup.
+* `id` - The Redshift Workgroup Name.
+* `workgroup_id` - The Redshift Workgroup ID.
+* `endpoint` - The endpoint that is created from the workgroup. See `Endpoint` below.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+### Endpoint
+
+* `address` - The DNS address of the VPC endpoint.
+* `port` - The port that Amazon Redshift Serverless listens on.
+* `vpc_endpoint` - The VPC endpoint or the Redshift Serverless workgroup. See `VPC Endpoint` below.
+
+#### VPC Endpoint
+
+* `vpc_endpoint_id` - The DNS address of the VPC endpoint.
+* `vpc_id` - The port that Amazon Redshift Serverless listens on.
+* `network_interface` - The network interfaces of the endpoint.. See `Network Interface` below.
+
+##### Network Interface
+
+* `availability_zone` - The availability Zone.
+* `network_interface_id` - The unique identifier of the network interface.
+* `private_ip_address` - The IPv4 address of the network interface within the subnet.
+* `subnet_id` - The unique identifier of the subnet.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `20m`)
+- `update` - (Default `20m`)
+- `delete` - (Default `20m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Redshift Serverless Workgroups using the `workgroup_name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Redshift Serverless Workgroups using the `workgroup_name`. For example:
+
+```console
+% terraform import aws_redshiftserverless_workgroup.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-f8191fced5005bdb54568b11bf8280442d2128c6ce0381714a2d602f4d39f748 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/resourceexplorer2_index.html.markdown b/website/docs/cdktf/python/r/resourceexplorer2_index.html.markdown
new file mode 100644
index 00000000000..45cf6ef5cfc
--- /dev/null
+++ b/website/docs/cdktf/python/r/resourceexplorer2_index.html.markdown
@@ -0,0 +1,75 @@
+---
+subcategory: "Resource Explorer"
+layout: "aws"
+page_title: "AWS: aws_resourceexplorer2_index"
+description: |-
+  Provides a resource to manage a Resource Explorer index in the current AWS Region.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_resourceexplorer2_index
+
+Provides a resource to manage a Resource Explorer index in the current AWS Region.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.resourceexplorer2_index import Resourceexplorer2Index
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Resourceexplorer2Index(self, "example",
+            type="LOCAL"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `type` - (Required) The type of the index. Valid values: `AGGREGATOR`, `LOCAL`. To understand the difference between `LOCAL` and `AGGREGATOR`, see the [_AWS Resource Explorer User Guide_](https://docs.aws.amazon.com/resource-explorer/latest/userguide/manage-aggregator-region.html).
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `2h`)
+- `update` - (Default `2h`)
+- `delete` - (Default `10m`)
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the Resource Explorer index.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Resource Explorer indexes using the `arn`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Resource Explorer indexes using the `arn`. For example:
+
+```console
+% terraform import aws_resourceexplorer2_index.example arn:aws:resource-explorer-2:us-east-1:123456789012:index/6047ac4e-207e-4487-9bcf-cb53bb0ff5cc
+```
+
+<!-- cache-key: cdktf-0.18.0 input-15aba15c558147fe93e81fd33df5a092fce89b9a9fad5f53b520dc3c70e79bbd -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/resourceexplorer2_view.html.markdown b/website/docs/cdktf/python/r/resourceexplorer2_view.html.markdown
new file mode 100644
index 00000000000..40b1d9d6278
--- /dev/null
+++ b/website/docs/cdktf/python/r/resourceexplorer2_view.html.markdown
@@ -0,0 +1,97 @@
+---
+subcategory: "Resource Explorer"
+layout: "aws"
+page_title: "AWS: aws_resourceexplorer2_view"
+description: |-
+  Provides a resource to manage a Resource Explorer view.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_resourceexplorer2_view
+
+Provides a resource to manage a Resource Explorer view.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.resourceexplorer2_index import Resourceexplorer2Index
+from imports.aws.resourceexplorer2_view import Resourceexplorer2View
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = Resourceexplorer2Index(self, "example",
+            type="LOCAL"
+        )
+        aws_resourceexplorer2_view_example = Resourceexplorer2View(self, "example_1",
+            depends_on=[example],
+            filters=[Resourceexplorer2ViewFilters(
+                filter_string="resourcetype:ec2:instance"
+            )
+            ],
+            included_property=[Resourceexplorer2ViewIncludedProperty(
+                name="tags"
+            )
+            ],
+            name="exampleview"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_resourceexplorer2_view_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `default_view` - (Optional) Specifies whether the view is the [_default view_](https://docs.aws.amazon.com/resource-explorer/latest/userguide/manage-views-about.html#manage-views-about-default) for the AWS Region. Default: `false`.
+* `filters` - (Optional) Specifies which resources are included in the results of queries made using this view. See [Filters](#filters) below for more details.
+* `included_property` - (Optional) Optional fields to be included in search results from this view. See [Included Properties](#included-properties) below for more details.
+* `name` - (Required) The name of the view. The name must be no more than 64 characters long, and can include letters, digits, and the dash (-) character. The name must be unique within its AWS Region.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Filters
+
+The `filters` block supports the following:
+
+* `filter_string` - (Required) The string that contains the search keywords, prefixes, and operators to control the results that can be returned by a search operation. For more details, see [Search query syntax](https://docs.aws.amazon.com/resource-explorer/latest/userguide/using-search-query-syntax.html).
+
+### Included Properties
+
+The `included_property` block supports the following:
+
+* `name` - (Required) The name of the property that is included in this view. Valid values: `tags`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the Resource Explorer view.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Resource Explorer views using the `arn`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Resource Explorer views using the `arn`. For example:
+
+```console
+% terraform import aws_resourceexplorer2_view.example arn:aws:resource-explorer-2:us-west-2:123456789012:view/exampleview/e0914f6c-6c27-4b47-b5d4-6b28381a2421
+```
+
+<!-- cache-key: cdktf-0.18.0 input-9a55ae10af14ad8a58159e050eea5de7e647cddfd344de98c968a90f50d26575 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/resourcegroups_group.html.markdown b/website/docs/cdktf/python/r/resourcegroups_group.html.markdown
new file mode 100644
index 00000000000..304576ffe8d
--- /dev/null
+++ b/website/docs/cdktf/python/r/resourcegroups_group.html.markdown
@@ -0,0 +1,88 @@
+---
+subcategory: "Resource Groups"
+layout: "aws"
+page_title: "AWS: aws_resourcegroups_group"
+description: |-
+  Provides a Resource Group.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_resourcegroups_group
+
+Provides a Resource Group.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.resourcegroups_group import ResourcegroupsGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ResourcegroupsGroup(self, "test",
+            name="test-group",
+            resource_query=ResourcegroupsGroupResourceQuery(
+                query="{\n  \"ResourceTypeFilters\": [\n    \"AWS::EC2::Instance\"\n  ],\n  \"TagFilters\": [\n    {\n      \"Key\": \"Stage\",\n      \"Values\": [\"Test\"]\n    }\n  ]\n}\n\n"
+            )
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The resource group's name. A resource group name can have a maximum of 127 characters, including letters, numbers, hyphens, dots, and underscores. The name cannot start with `AWS` or `aws`.
+* `configuration` - (Optional) A configuration associates the resource group with an AWS service and specifies how the service can interact with the resources in the group. See below for details.
+* `description` - (Optional) A description of the resource group.
+* `resource_query` - (Required) A `resource_query` block. Resource queries are documented below.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+The `resource_query` block supports the following arguments:
+
+* `query` - (Required) The resource query as a JSON string.
+* `type` - (Required) The type of the resource query. Defaults to `TAG_FILTERS_1_0`.
+
+The `configuration` block supports the following arguments:
+
+* `type` - (Required) Specifies the type of group configuration item.
+* `parameters` - (Optional) A collection of parameters for this group configuration item. See below for details.
+
+The `parameters` block supports the following arguments:
+
+* `name` - (Required) The name of the group configuration parameter.
+* `values` - (Optional) The value or values to be used for the specified parameter.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN assigned by AWS for this resource group.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import resource groups using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import resource groups using the `name`. For example:
+
+```console
+% terraform import aws_resourcegroups_group.foo resource-group-name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ffd6b1c7348fc0bfb39edb3c57aaf4b3dc4b1a11fa63096a13a4a4883d2ab21d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/resourcegroups_resource.html.markdown b/website/docs/cdktf/python/r/resourcegroups_resource.html.markdown
new file mode 100644
index 00000000000..0d64717cd36
--- /dev/null
+++ b/website/docs/cdktf/python/r/resourcegroups_resource.html.markdown
@@ -0,0 +1,75 @@
+---
+subcategory: "Resource Groups"
+layout: "aws"
+page_title: "AWS: aws_resourcegroups_resource"
+description: |-
+  Terraform resource for managing an AWS Resource Groups Resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_resourcegroups_resource
+
+Terraform resource for managing an AWS Resource Groups Resource.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ec2_host import Ec2Host
+from imports.aws.resourcegroups_group import ResourcegroupsGroup
+from imports.aws.resourcegroups_resource import ResourcegroupsResource
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = Ec2Host(self, "example",
+            auto_placement="on",
+            availability_zone="us-east-1a",
+            host_recovery="off",
+            instance_family="t3"
+        )
+        aws_resourcegroups_group_example = ResourcegroupsGroup(self, "example_1",
+            name="example"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_resourcegroups_group_example.override_logical_id("example")
+        aws_resourcegroups_resource_example = ResourcegroupsResource(self, "example_2",
+            group_arn=Token.as_string(aws_resourcegroups_group_example.arn),
+            resource_arn=example.arn
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_resourcegroups_resource_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `group_arn` - (Required) The name or the ARN of the resource group to add resources to.
+
+The following arguments are optional:
+
+* `resource_arn` - (Required) The ARN of the resource to be added to the group.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `resource_type` - The resource type of a resource, such as `AWS::EC2::Instance`.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `5m`)
+* `delete` - (Default `5m`)
+
+<!-- cache-key: cdktf-0.18.0 input-aab29303cb0c6f71f3aadcea2dab227a35feb39e7e6c9a2b0ecaf85e8c6d91ff -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/rolesanywhere_profile.html.markdown b/website/docs/cdktf/python/r/rolesanywhere_profile.html.markdown
new file mode 100644
index 00000000000..6041a70f441
--- /dev/null
+++ b/website/docs/cdktf/python/r/rolesanywhere_profile.html.markdown
@@ -0,0 +1,96 @@
+---
+subcategory: "Roles Anywhere"
+layout: "aws"
+page_title: "AWS: aws_rolesanywhere_profile"
+description: |-
+  Provides a Roles Anywhere Profile resource
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_rolesanywhere_profile
+
+Terraform resource for managing a Roles Anywhere Profile.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.iam_role import IamRole
+from imports.aws.rolesanywhere_profile import RolesanywhereProfile
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        test = IamRole(self, "test",
+            assume_role_policy=Token.as_string(
+                Fn.jsonencode({
+                    "Statement": [{
+                        "Action": ["sts:AssumeRole", "sts:TagSession", "sts:SetSourceIdentity"
+                        ],
+                        "Effect": "Allow",
+                        "Principal": {
+                            "Service": "rolesanywhere.amazonaws.com"
+                        },
+                        "Sid": ""
+                    }
+                    ],
+                    "Version": "2012-10-17"
+                })),
+            name="test",
+            path="/"
+        )
+        aws_rolesanywhere_profile_test = RolesanywhereProfile(self, "test_1",
+            name="example",
+            role_arns=[test.arn]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_rolesanywhere_profile_test.override_logical_id("test")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `duration_seconds` - (Optional) The number of seconds the vended session credentials are valid for. Defaults to 3600.
+* `enabled` - (Optional) Whether or not the Profile is enabled.
+* `managed_policy_arns` - (Optional) A list of managed policy ARNs that apply to the vended session credentials.
+* `name` - (Required) The name of the Profile.
+* `require_instance_properties` - (Optional) Specifies whether instance properties are required in [CreateSession](https://docs.aws.amazon.com/rolesanywhere/latest/APIReference/API_CreateSession.html) requests with this profile.
+* `role_arns` - (Required) A list of IAM roles that this profile can assume
+* `session_policy` - (Optional) A session policy that applies to the trust boundary of the vended session credentials.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the Profile
+* `id` - The Profile ID.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_rolesanywhere_profile` using its `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_rolesanywhere_profile` using its `id`. For example:
+
+```console
+% terraform import aws_rolesanywhere_profile.example db138a85-8925-4f9f-a409-08231233cacf
+```
+
+<!-- cache-key: cdktf-0.18.0 input-6014aa495fc385a2acfb6b7b4cb2e96800954c65d55817afa8439b60e41c2538 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/rolesanywhere_trust_anchor.html.markdown b/website/docs/cdktf/python/r/rolesanywhere_trust_anchor.html.markdown
new file mode 100644
index 00000000000..ba15f7f54af
--- /dev/null
+++ b/website/docs/cdktf/python/r/rolesanywhere_trust_anchor.html.markdown
@@ -0,0 +1,125 @@
+---
+subcategory: "Roles Anywhere"
+layout: "aws"
+page_title: "AWS: aws_rolesanywhere_trust_anchor"
+description: |-
+  Provides a Roles Anywhere Trust Anchor resource
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_rolesanywhere_trust_anchor
+
+Terraform resource for managing a Roles Anywhere Trust Anchor.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.acmpca_certificate import AcmpcaCertificate
+from imports.aws.acmpca_certificate_authority import AcmpcaCertificateAuthority
+from imports.aws.acmpca_certificate_authority_certificate import AcmpcaCertificateAuthorityCertificate
+from imports.aws.data_aws_partition import DataAwsPartition
+from imports.aws.rolesanywhere_trust_anchor import RolesanywhereTrustAnchor
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = AcmpcaCertificateAuthority(self, "example",
+            certificate_authority_configuration=AcmpcaCertificateAuthorityCertificateAuthorityConfiguration(
+                key_algorithm="RSA_4096",
+                signing_algorithm="SHA512WITHRSA",
+                subject=AcmpcaCertificateAuthorityCertificateAuthorityConfigurationSubject(
+                    common_name="example.com"
+                )
+            ),
+            permanent_deletion_time_in_days=7,
+            type="ROOT"
+        )
+        aws_acmpca_certificate_authority_certificate_example =
+        AcmpcaCertificateAuthorityCertificate(self, "example_1",
+            certificate=Token.as_string(aws_acmpca_certificate_example.certificate),
+            certificate_authority_arn=example.arn,
+            certificate_chain=Token.as_string(aws_acmpca_certificate_example.certificate_chain)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_acmpca_certificate_authority_certificate_example.override_logical_id("example")
+        RolesanywhereTrustAnchor(self, "test",
+            depends_on=[aws_acmpca_certificate_authority_certificate_example],
+            name="example",
+            source=RolesanywhereTrustAnchorSource(
+                source_data=RolesanywhereTrustAnchorSourceSourceData(
+                    acm_pca_arn=example.arn
+                ),
+                source_type="AWS_ACM_PCA"
+            )
+        )
+        current = DataAwsPartition(self, "current")
+        aws_acmpca_certificate_test = AcmpcaCertificate(self, "test_4",
+            certificate_authority_arn=example.arn,
+            certificate_signing_request=example.certificate_signing_request,
+            signing_algorithm="SHA512WITHRSA",
+            template_arn="arn:${" + current.partition + "}:acm-pca:::template/RootCACertificate/V1",
+            validity=AcmpcaCertificateValidity(
+                type="YEARS",
+                value=Token.as_string(1)
+            )
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_acmpca_certificate_test.override_logical_id("test")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `enabled` - (Optional) Whether or not the Trust Anchor should be enabled.
+* `name` - (Required) The name of the Trust Anchor.
+* `source` - (Required) The source of trust, documented below
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Nested Blocks
+
+#### `source`
+
+* `source_data` - (Required) The data denoting the source of trust, documented below
+* `source_type` - (Required) The type of the source of trust. Must be either `AWS_ACM_PCA` or `CERTIFICATE_BUNDLE`.
+
+#### `source_data`
+
+* `acm_pca_arn` - (Optional, required when `source_type` is `AWS_ACM_PCA`) The ARN of an ACM Private Certificate Authority.
+* `x509_certificate_data` - (Optional, required when `source_type` is `CERTIFICATE_BUNDLE`)
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the Trust Anchor
+* `id` - The Trust Anchor ID.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_rolesanywhere_trust_anchor` using its `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_rolesanywhere_trust_anchor` using its `id`. For example:
+
+```console
+% terraform import aws_rolesanywhere_trust_anchor.example 92b2fbbb-984d-41a3-a765-e3cbdb69ebb1
+```
+
+<!-- cache-key: cdktf-0.18.0 input-89d8cc3f15e0773b9fe438113eea5ac563a091c5c19d681db300ed32379fb0a0 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/route.html.markdown b/website/docs/cdktf/python/r/route.html.markdown
new file mode 100644
index 00000000000..f1ed5fc20da
--- /dev/null
+++ b/website/docs/cdktf/python/r/route.html.markdown
@@ -0,0 +1,175 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_route"
+description: |-
+  Provides a resource to create a routing entry in a VPC routing table.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_route
+
+Provides a resource to create a routing table entry (a route) in a VPC routing table.
+
+~> **NOTE on Route Tables and Routes:** Terraform currently provides both a standalone Route resource and a [Route Table](route_table.html) resource with routes defined in-line. At this time you cannot use a Route Table with in-line routes in conjunction with any Route resources. Doing so will cause a conflict of rule settings and will overwrite rules.
+
+~> **NOTE on `gateway_id` attribute:** The AWS API is very forgiving with the resource ID passed in the `gateway_id` attribute. For example an `aws_route` resource can be created with an [`aws_nat_gateway`](nat_gateway.html) or [`aws_egress_only_internet_gateway`](egress_only_internet_gateway.html) ID specified for the `gateway_id` attribute. Specifying anything other than an [`aws_internet_gateway`](internet_gateway.html) or [`aws_vpn_gateway`](vpn_gateway.html) ID will lead to Terraform reporting a permanent diff between your configuration and recorded state, as the AWS API returns the more-specific attribute. If you are experiencing constant diffs with an `aws_route` resource, the first thing to check is that the correct attribute is being specified.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.route import Route
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Route(self, "r",
+            depends_on=[testing],
+            destination_cidr_block="10.0.1.0/22",
+            route_table_id="rtb-4fbb3ac4",
+            vpc_peering_connection_id="pcx-45ff3dc1"
+        )
+```
+
+## Example IPv6 Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.egress_only_internet_gateway import EgressOnlyInternetGateway
+from imports.aws.route import Route
+from imports.aws.vpc import Vpc
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        vpc = Vpc(self, "vpc",
+            assign_generated_ipv6_cidr_block=True,
+            cidr_block="10.1.0.0/16"
+        )
+        egress = EgressOnlyInternetGateway(self, "egress",
+            vpc_id=vpc.id
+        )
+        Route(self, "r",
+            destination_ipv6_cidr_block="::/0",
+            egress_only_gateway_id=egress.id,
+            route_table_id="rtb-4fbb3ac4"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `route_table_id` - (Required) The ID of the routing table.
+
+One of the following destination arguments must be supplied:
+
+* `destination_cidr_block` - (Optional) The destination CIDR block.
+* `destination_ipv6_cidr_block` - (Optional) The destination IPv6 CIDR block.
+* `destination_prefix_list_id` - (Optional) The ID of a [managed prefix list](ec2_managed_prefix_list.html) destination.
+
+One of the following target arguments must be supplied:
+
+* `carrier_gateway_id` - (Optional) Identifier of a carrier gateway. This attribute can only be used when the VPC contains a subnet which is associated with a Wavelength Zone.
+* `core_network_arn` - (Optional) The Amazon Resource Name (ARN) of a core network.
+* `egress_only_gateway_id` - (Optional) Identifier of a VPC Egress Only Internet Gateway.
+* `gateway_id` - (Optional) Identifier of a VPC internet gateway or a virtual private gateway. Specify `local` when updating a previously [imported](#import) local route.
+* `nat_gateway_id` - (Optional) Identifier of a VPC NAT gateway.
+* `local_gateway_id` - (Optional) Identifier of a Outpost local gateway.
+* `network_interface_id` - (Optional) Identifier of an EC2 network interface.
+* `transit_gateway_id` - (Optional) Identifier of an EC2 Transit Gateway.
+* `vpc_endpoint_id` - (Optional) Identifier of a VPC Endpoint.
+* `vpc_peering_connection_id` - (Optional) Identifier of a VPC peering connection.
+
+Note that the default route, mapping the VPC's CIDR block to "local", is created implicitly and cannot be specified.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+~> **NOTE:** Only the arguments that are configured (one of the above) will be exported as an attribute once the resource is created.
+
+* `id` - Route identifier computed from the routing table identifier and route destination.
+* `instance_id` - Identifier of an EC2 instance.
+* `instance_owner_id` - The AWS account ID of the owner of the EC2 instance.
+* `origin` - How the route was created - `CreateRouteTable`, `CreateRoute` or `EnableVgwRoutePropagation`.
+* `state` - The state of the route - `active` or `blackhole`.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `5m`)
+- `update` - (Default `2m`)
+- `delete` - (Default `5m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import individual routes using `ROUTETABLEID_DESTINATION`. Import [local routes](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Route_Tables.html#RouteTables) using the VPC's IPv4 or IPv6 CIDR blocks. For example:
+
+Import a route in route table `rtb-656C65616E6F72` with an IPv4 destination CIDR of `10.42.0.0/16`:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Import a route in route table `rtb-656C65616E6F72` with an IPv6 destination CIDR of `2620:0:2d0:200::8/125`:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Import a route in route table `rtb-656C65616E6F72` with a managed prefix list destination of `pl-0570a1d2d725c16be`:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+**Using `terraform import` to import** individual routes using `ROUTETABLEID_DESTINATION`. Import [local routes](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Route_Tables.html#RouteTables) using the VPC's IPv4 or IPv6 CIDR blocks. For example:
+
+Import a route in route table `rtb-656C65616E6F72` with an IPv4 destination CIDR of `10.42.0.0/16`:
+
+```console
+% terraform import aws_route.my_route rtb-656C65616E6F72_10.42.0.0/16
+```
+
+Import a route in route table `rtb-656C65616E6F72` with an IPv6 destination CIDR of `2620:0:2d0:200::8/125`:
+
+```console
+% terraform import aws_route.my_route rtb-656C65616E6F72_2620:0:2d0:200::8/125
+```
+
+Import a route in route table `rtb-656C65616E6F72` with a managed prefix list destination of `pl-0570a1d2d725c16be`:
+
+```console
+% terraform import aws_route.my_route rtb-656C65616E6F72_pl-0570a1d2d725c16be
+```
+
+<!-- cache-key: cdktf-0.18.0 input-53c7f6fd35f56da19c62820b7371f087d7dfdcf3dc6ba0a873a118f63167b0a4 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/route53_cidr_collection.html.markdown b/website/docs/cdktf/python/r/route53_cidr_collection.html.markdown
new file mode 100644
index 00000000000..a670fef1077
--- /dev/null
+++ b/website/docs/cdktf/python/r/route53_cidr_collection.html.markdown
@@ -0,0 +1,67 @@
+---
+subcategory: "Route 53"
+layout: "aws"
+page_title: "AWS: aws_route53_cidr_collection"
+description: |-
+  Provides a Route53 CIDR collection resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_route53_cidr_collection
+
+Provides a Route53 CIDR collection resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.route53_cidr_collection import Route53CidrCollection
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Route53CidrCollection(self, "example",
+            name="collection-1"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) Unique name for the CIDR collection.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the CIDR collection.
+* `id` - The CIDR collection ID.
+* `version` - The lastest version of the CIDR collection.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CIDR collections using their ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import CIDR collections using their ID. For example:
+
+```console
+% terraform import aws_route53_cidr_collection.example 9ac32814-3e67-0932-6048-8d779cc6f511
+```
+
+<!-- cache-key: cdktf-0.18.0 input-a80f886fcccf8c08717c63639feaa22b07614aee2f4ebbbbcae7b48c9718f5a1 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/route53_cidr_location.html.markdown b/website/docs/cdktf/python/r/route53_cidr_location.html.markdown
new file mode 100644
index 00000000000..d521a041041
--- /dev/null
+++ b/website/docs/cdktf/python/r/route53_cidr_location.html.markdown
@@ -0,0 +1,75 @@
+---
+subcategory: "Route 53"
+layout: "aws"
+page_title: "AWS: aws_route53_cidr_location"
+description: |-
+  Provides a Route53 CIDR location resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_route53_cidr_location
+
+Provides a Route53 CIDR location resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.route53_cidr_collection import Route53CidrCollection
+from imports.aws.route53_cidr_location import Route53CidrLocation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = Route53CidrCollection(self, "example",
+            name="collection-1"
+        )
+        aws_route53_cidr_location_example = Route53CidrLocation(self, "example_1",
+            cidr_blocks=["200.5.3.0/24", "200.6.3.0/24"],
+            cidr_collection_id=example.id,
+            name="office"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_route53_cidr_location_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `cidr_blocks` - (Required) CIDR blocks for the location.
+* `cidr_collection_id` - (Required) The ID of the CIDR collection to update.
+* `name` - (Required) Name for the CIDR location.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The CIDR location ID.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CIDR locations using their the CIDR collection ID and location name. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import CIDR locations using their the CIDR collection ID and location name. For example:
+
+```console
+% terraform import aws_route53_cidr_location.example 9ac32814-3e67-0932-6048-8d779cc6f511,office
+```
+
+<!-- cache-key: cdktf-0.18.0 input-31ac6f8e84b90ca850c2546849f62b830a0e3054286c7dd59d0dfb835b14de38 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/route53_delegation_set.html.markdown b/website/docs/cdktf/python/r/route53_delegation_set.html.markdown
new file mode 100644
index 00000000000..4d213aed60d
--- /dev/null
+++ b/website/docs/cdktf/python/r/route53_delegation_set.html.markdown
@@ -0,0 +1,78 @@
+---
+subcategory: "Route 53"
+layout: "aws"
+page_title: "AWS: aws_route53_delegation_set"
+description: |-
+  Provides a Route53 Delegation Set resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_route53_delegation_set
+
+Provides a [Route53 Delegation Set](https://docs.aws.amazon.com/Route53/latest/APIReference/API-actions-by-function.html#actions-by-function-reusable-delegation-sets) resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.route53_delegation_set import Route53DelegationSet
+from imports.aws.route53_zone import Route53Zone
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        main = Route53DelegationSet(self, "main",
+            reference_name="DynDNS"
+        )
+        Route53Zone(self, "primary",
+            delegation_set_id=main.id,
+            name="hashicorp.com"
+        )
+        Route53Zone(self, "secondary",
+            delegation_set_id=main.id,
+            name="terraform.io"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `reference_name` - (Optional) This is a reference name used in Caller Reference
+  (helpful for identifying single delegation set amongst others)
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the Delegation Set.
+* `id` - The delegation set ID
+* `name_servers` - A list of authoritative name servers for the hosted zone
+  (effectively a list of NS records).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Route53 Delegation Sets using the delegation set `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Route53 Delegation Sets using the delegation set `id`. For example:
+
+```console
+% terraform import aws_route53_delegation_set.set1 N1PA6795SAMPLE
+```
+
+<!-- cache-key: cdktf-0.18.0 input-b6d9fea678079df840cfe605eac21d9ef068f83b613ae7a6bc209863fccfe750 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/route53_health_check.html.markdown b/website/docs/cdktf/python/r/route53_health_check.html.markdown
new file mode 100644
index 00000000000..9911300fcaa
--- /dev/null
+++ b/website/docs/cdktf/python/r/route53_health_check.html.markdown
@@ -0,0 +1,187 @@
+---
+subcategory: "Route 53"
+layout: "aws"
+page_title: "AWS: aws_route53_health_check"
+description: |-
+  Provides a Route53 health check.
+---
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_route53_health_check
+
+Provides a Route53 health check.
+
+## Example Usage
+
+### Connectivity and HTTP Status Code Check
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.route53_health_check import Route53HealthCheck
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Route53HealthCheck(self, "example",
+            failure_threshold=Token.as_number("5"),
+            fqdn="example.com",
+            port=80,
+            request_interval=Token.as_number("30"),
+            resource_path="/",
+            tags={
+                "Name": "tf-test-health-check"
+            },
+            type="HTTP"
+        )
+```
+
+### Connectivity and String Matching Check
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.route53_health_check import Route53HealthCheck
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Route53HealthCheck(self, "example",
+            failure_threshold=Token.as_number("5"),
+            fqdn="example.com",
+            port=443,
+            request_interval=Token.as_number("30"),
+            resource_path="/",
+            search_string="example",
+            type="HTTPS_STR_MATCH"
+        )
+```
+
+### Aggregate Check
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.route53_health_check import Route53HealthCheck
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Route53HealthCheck(self, "parent",
+            child_health_threshold=1,
+            child_healthchecks=[child.id],
+            tags={
+                "Name": "tf-test-calculated-health-check"
+            },
+            type="CALCULATED"
+        )
+```
+
+### CloudWatch Alarm Check
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudwatch_metric_alarm import CloudwatchMetricAlarm
+from imports.aws.route53_health_check import Route53HealthCheck
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        foobar = CloudwatchMetricAlarm(self, "foobar",
+            alarm_description="This metric monitors ec2 cpu utilization",
+            alarm_name="terraform-test-foobar5",
+            comparison_operator="GreaterThanOrEqualToThreshold",
+            evaluation_periods=Token.as_number("2"),
+            metric_name="CPUUtilization",
+            namespace="AWS/EC2",
+            period=Token.as_number("120"),
+            statistic="Average",
+            threshold=Token.as_number("80")
+        )
+        Route53HealthCheck(self, "foo",
+            cloudwatch_alarm_name=foobar.alarm_name,
+            cloudwatch_alarm_region="us-west-2",
+            insufficient_data_health_status="Healthy",
+            type="CLOUDWATCH_METRIC"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+~> **Note:** At least one of either `fqdn` or `ip_address` must be specified.
+
+* `reference_name` - (Optional) This is a reference name used in Caller Reference
+    (helpful for identifying single health_check set amongst others)
+* `fqdn` - (Optional) The fully qualified domain name of the endpoint to be checked. If a value is set for `ip_address`, the value set for `fqdn` will be passed in the `Host` header.
+* `ip_address` - (Optional) The IP address of the endpoint to be checked.
+* `port` - (Optional) The port of the endpoint to be checked.
+* `type` - (Required) The protocol to use when performing health checks. Valid values are `HTTP`, `HTTPS`, `HTTP_STR_MATCH`, `HTTPS_STR_MATCH`, `TCP`, `CALCULATED`, `CLOUDWATCH_METRIC` and `RECOVERY_CONTROL`.
+* `failure_threshold` - (Optional) The number of consecutive health checks that an endpoint must pass or fail.
+* `request_interval` - (Required) The number of seconds between the time that Amazon Route 53 gets a response from your endpoint and the time that it sends the next health-check request.
+* `resource_path` - (Optional) The path that you want Amazon Route 53 to request when performing health checks.
+* `search_string` - (Optional) String searched in the first 5120 bytes of the response body for check to be considered healthy. Only valid with `HTTP_STR_MATCH` and `HTTPS_STR_MATCH`.
+* `measure_latency` - (Optional) A Boolean value that indicates whether you want Route 53 to measure the latency between health checkers in multiple AWS regions and your endpoint and to display CloudWatch latency graphs in the Route 53 console.
+* `invert_healthcheck` - (Optional) A boolean value that indicates whether the status of health check should be inverted. For example, if a health check is healthy but Inverted is True , then Route 53 considers the health check to be unhealthy.
+* `disabled` - (Optional) A boolean value that stops Route 53 from performing health checks. When set to true, Route 53 will do the following depending on the type of health check:
+    * For health checks that check the health of endpoints, Route5 53 stops submitting requests to your application, server, or other resource.
+    * For calculated health checks, Route 53 stops aggregating the status of the referenced health checks.
+    * For health checks that monitor CloudWatch alarms, Route 53 stops monitoring the corresponding CloudWatch metrics.
+
+    ~> **Note:** After you disable a health check, Route 53 considers the status of the health check to always be healthy. If you configured DNS failover, Route 53 continues to route traffic to the corresponding resources. If you want to stop routing traffic to a resource, change the value of `invert_healthcheck`.
+* `enable_sni` - (Optional) A boolean value that indicates whether Route53 should send the `fqdn` to the endpoint when performing the health check. This defaults to AWS' defaults: when the `type` is "HTTPS" `enable_sni` defaults to `true`, when `type` is anything else `enable_sni` defaults to `false`.
+* `child_healthchecks` - (Optional) For a specified parent health check, a list of HealthCheckId values for the associated child health checks.
+* `child_health_threshold` - (Optional) The minimum number of child health checks that must be healthy for Route 53 to consider the parent health check to be healthy. Valid values are integers between 0 and 256, inclusive
+* `cloudwatch_alarm_name` - (Optional) The name of the CloudWatch alarm.
+* `cloudwatch_alarm_region` - (Optional) The CloudWatchRegion that the CloudWatch alarm was created in.
+* `insufficient_data_health_status` - (Optional) The status of the health check when CloudWatch has insufficient data about the state of associated alarm. Valid values are `Healthy` , `Unhealthy` and `LastKnownStatus`.
+* `regions` - (Optional) A list of AWS regions that you want Amazon Route 53 health checkers to check the specified endpoint from.
+* `routing_control_arn` - (Optional) The Amazon Resource Name (ARN) for the Route 53 Application Recovery Controller routing control. This is used when health check type is `RECOVERY_CONTROL`
+* `tags` - (Optional) A map of tags to assign to the health check. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the Health Check.
+* `id` - The id of the health check
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Route53 Health Checks using the health check `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Route53 Health Checks using the health check `id`. For example:
+
+```console
+% terraform import aws_route53_health_check.http_check abcdef11-2222-3333-4444-555555fedcba
+```
+
+<!-- cache-key: cdktf-0.18.0 input-77cb2549229efadce71f35371e65ef572daabb8208abd05dfd647f7309112065 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/route53_hosted_zone_dnssec.html.markdown b/website/docs/cdktf/python/r/route53_hosted_zone_dnssec.html.markdown
new file mode 100644
index 00000000000..33fed47ddb2
--- /dev/null
+++ b/website/docs/cdktf/python/r/route53_hosted_zone_dnssec.html.markdown
@@ -0,0 +1,125 @@
+---
+subcategory: "Route 53"
+layout: "aws"
+page_title: "AWS: aws_route53_hosted_zone_dnssec"
+description: |-
+    Manages Route 53 Hosted Zone DNSSEC
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_route53_hosted_zone_dnssec
+
+Manages Route 53 Hosted Zone Domain Name System Security Extensions (DNSSEC). For more information about managing DNSSEC in Route 53, see the [Route 53 Developer Guide](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/dns-configuring-dnssec.html).
+
+!> **WARNING:** If you disable DNSSEC signing for your hosted zone before the DNS changes have propagated, your domain could become unavailable on the internet. When you remove the DS records, you must wait until the longest TTL for the DS records that you remove has expired before you complete the step to disable DNSSEC signing. Please refer to the [Route 53 Developer Guide - Disable DNSSEC](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/dns-configuring-dnssec-disable.html) for a detailed breakdown on the steps required to disable DNSSEC safely for a hosted zone.
+
+~> **Note:** Route53 hosted zones are global resources, and as such any `aws_kms_key` that you use as part of a signing key needs to be located in the `us-east-1` region. In the example below, the main AWS provider declaration is for `us-east-1`, however if you are provisioning your AWS resources in a different region, you will need to specify a provider alias and use that attached to the `aws_kms_key` resource as described in the [provider alias documentation](https://developer.hashicorp.com/terraform/language/providers/configuration#alias-multiple-provider-configurations).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_caller_identity import DataAwsCallerIdentity
+from imports.aws.kms_key import KmsKey
+from imports.aws.provider import AwsProvider
+from imports.aws.route53_hosted_zone_dnssec import Route53HostedZoneDnssec
+from imports.aws.route53_key_signing_key import Route53KeySigningKey
+from imports.aws.route53_zone import Route53Zone
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AwsProvider(self, "aws",
+            region="us-east-1"
+        )
+        example = Route53Zone(self, "example",
+            name="example.com"
+        )
+        current = DataAwsCallerIdentity(self, "current")
+        aws_kms_key_example = KmsKey(self, "example_3",
+            customer_master_key_spec="ECC_NIST_P256",
+            deletion_window_in_days=7,
+            key_usage="SIGN_VERIFY",
+            policy=Token.as_string(
+                Fn.jsonencode({
+                    "Statement": [{
+                        "Action": ["kms:DescribeKey", "kms:GetPublicKey", "kms:Sign", "kms:Verify"
+                        ],
+                        "Effect": "Allow",
+                        "Principal": {
+                            "Service": "dnssec-route53.amazonaws.com"
+                        },
+                        "Resource": "*",
+                        "Sid": "Allow Route 53 DNSSEC Service"
+                    }, {
+                        "Action": "kms:*",
+                        "Effect": "Allow",
+                        "Principal": {
+                            "AWS": "arn:aws:iam::${" + current.account_id + "}:root"
+                        },
+                        "Resource": "*",
+                        "Sid": "Enable IAM User Permissions"
+                    }
+                    ],
+                    "Version": "2012-10-17"
+                }))
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_kms_key_example.override_logical_id("example")
+        aws_route53_key_signing_key_example = Route53KeySigningKey(self, "example_4",
+            hosted_zone_id=example.id,
+            key_management_service_arn=Token.as_string(aws_kms_key_example.arn),
+            name="example"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_route53_key_signing_key_example.override_logical_id("example")
+        aws_route53_hosted_zone_dnssec_example = Route53HostedZoneDnssec(self, "example_5",
+            depends_on=[aws_route53_key_signing_key_example],
+            hosted_zone_id=Token.as_string(aws_route53_key_signing_key_example.hosted_zone_id)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_route53_hosted_zone_dnssec_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `hosted_zone_id` - (Required) Identifier of the Route 53 Hosted Zone.
+
+The following arguments are optional:
+
+* `signing_status` - (Optional) Hosted Zone signing status. Valid values: `SIGNING`, `NOT_SIGNING`. Defaults to `SIGNING`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Route 53 Hosted Zone identifier.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_route53_hosted_zone_dnssec` resources using the Route 53 Hosted Zone identifier. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_route53_hosted_zone_dnssec` resources using the Route 53 Hosted Zone identifier. For example:
+
+```console
+% terraform import aws_route53_hosted_zone_dnssec.example Z1D633PJN98FT9
+```
+
+<!-- cache-key: cdktf-0.18.0 input-c4b8c382f2fc6f33c01f94157d7d27795ecb00847b3a43f8ebf7840f68ff3214 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/route53_key_signing_key.html.markdown b/website/docs/cdktf/python/r/route53_key_signing_key.html.markdown
new file mode 100644
index 00000000000..915a443bbad
--- /dev/null
+++ b/website/docs/cdktf/python/r/route53_key_signing_key.html.markdown
@@ -0,0 +1,153 @@
+---
+subcategory: "Route 53"
+layout: "aws"
+page_title: "AWS: aws_route53_key_signing_key"
+description: |-
+    Manages an Route 53 Key Signing Key
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_route53_key_signing_key
+
+Manages a Route 53 Key Signing Key. To manage Domain Name System Security Extensions (DNSSEC) for a Hosted Zone, see the [`aws_route53_hosted_zone_dnssec` resource](route53_hosted_zone_dnssec.html). For more information about managing DNSSEC in Route 53, see the [Route 53 Developer Guide](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/dns-configuring-dnssec.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, Fn, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_caller_identity import DataAwsCallerIdentity
+from imports.aws.kms_key import KmsKey
+from imports.aws.provider import AwsProvider
+from imports.aws.route53_hosted_zone_dnssec import Route53HostedZoneDnssec
+from imports.aws.route53_key_signing_key import Route53KeySigningKey
+from imports.aws.route53_zone import Route53Zone
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AwsProvider(self, "aws",
+            region="us-east-1"
+        )
+        example = Route53KeySigningKey(self, "example",
+            hosted_zone_id=test.id,
+            key_management_service_arn=Token.as_string(aws_kms_key_test.arn),
+            name="example"
+        )
+        aws_route53_zone_example = Route53Zone(self, "example_2",
+            name="example.com"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_route53_zone_example.override_logical_id("example")
+        current = DataAwsCallerIdentity(self, "current")
+        aws_kms_key_example = KmsKey(self, "example_4",
+            customer_master_key_spec="ECC_NIST_P256",
+            deletion_window_in_days=7,
+            key_usage="SIGN_VERIFY",
+            policy=Token.as_string(
+                Fn.jsonencode({
+                    "Statement": [{
+                        "Action": ["kms:DescribeKey", "kms:GetPublicKey", "kms:Sign"],
+                        "Condition": {
+                            "ArnLike": {
+                                "aws:_source_arn": "arn:aws:route53:::hostedzone/*"
+                            },
+                            "StringEquals": {
+                                "aws:_source_account": current.account_id
+                            }
+                        },
+                        "Effect": "Allow",
+                        "Principal": {
+                            "Service": "dnssec-route53.amazonaws.com"
+                        },
+                        "Resource": "*",
+                        "Sid": "Allow Route 53 DNSSEC Service"
+                    }, {
+                        "Action": "kms:CreateGrant",
+                        "Condition": {
+                            "Bool": {
+                                "kms:_grant_is_for_aWSResource": "true"
+                            }
+                        },
+                        "Effect": "Allow",
+                        "Principal": {
+                            "Service": "dnssec-route53.amazonaws.com"
+                        },
+                        "Resource": "*",
+                        "Sid": "Allow Route 53 DNSSEC Service to CreateGrant"
+                    }, {
+                        "Action": "kms:*",
+                        "Effect": "Allow",
+                        "Principal": {
+                            "AWS": "arn:aws:iam::${" + current.account_id + "}:root"
+                        },
+                        "Resource": "*",
+                        "Sid": "Enable IAM User Permissions"
+                    }
+                    ],
+                    "Version": "2012-10-17"
+                }))
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_kms_key_example.override_logical_id("example")
+        aws_route53_hosted_zone_dnssec_example = Route53HostedZoneDnssec(self, "example_5",
+            depends_on=[example],
+            hosted_zone_id=example.hosted_zone_id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_route53_hosted_zone_dnssec_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `hosted_zone_id` - (Required) Identifier of the Route 53 Hosted Zone.
+* `key_management_service_arn` - (Required) Amazon Resource Name (ARN) of the Key Management Service (KMS) Key. This must be unique for each key-signing key (KSK) in a single hosted zone. This key must be in the `us-east-1` Region and meet certain requirements, which are described in the [Route 53 Developer Guide](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/dns-configuring-dnssec-cmk-requirements.html) and [Route 53 API Reference](https://docs.aws.amazon.com/Route53/latest/APIReference/API_CreateKeySigningKey.html).
+* `name` - (Required) Name of the key-signing key (KSK). Must be unique for each key-singing key in the same hosted zone.
+
+The following arguments are optional:
+
+* `status` - (Optional) Status of the key-signing key (KSK). Valid values: `ACTIVE`, `INACTIVE`. Defaults to `ACTIVE`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `digest_algorithm_mnemonic` - A string used to represent the delegation signer digest algorithm. This value must follow the guidelines provided by [RFC-8624 Section 3.3](https://tools.ietf.org/html/rfc8624#section-3.3).
+* `digest_algorithm_type` - An integer used to represent the delegation signer digest algorithm. This value must follow the guidelines provided by [RFC-8624 Section 3.3](https://tools.ietf.org/html/rfc8624#section-3.3).
+* `digest_value` - A cryptographic digest of a DNSKEY resource record (RR). DNSKEY records are used to publish the public key that resolvers can use to verify DNSSEC signatures that are used to secure certain kinds of information provided by the DNS system.
+* `dnskey_record` - A string that represents a DNSKEY record.
+* `ds_record` - A string that represents a delegation signer (DS) record.
+* `flag` - An integer that specifies how the key is used. For key-signing key (KSK), this value is always 257.
+* `id` - Route 53 Hosted Zone identifier and KMS Key identifier, separated by a comma (`,`).
+* `key_tag` - An integer used to identify the DNSSEC record for the domain name. The process used to calculate the value is described in [RFC-4034 Appendix B](https://tools.ietf.org/rfc/rfc4034.txt).
+* `public_key` - The public key, represented as a Base64 encoding, as required by [RFC-4034 Page 5](https://tools.ietf.org/rfc/rfc4034.txt).
+* `signing_algorithm_mnemonic` - A string used to represent the signing algorithm. This value must follow the guidelines provided by [RFC-8624 Section 3.1](https://tools.ietf.org/html/rfc8624#section-3.1).
+* `signing_algorithm_type` - An integer used to represent the signing algorithm. This value must follow the guidelines provided by [RFC-8624 Section 3.1](https://tools.ietf.org/html/rfc8624#section-3.1).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_route53_key_signing_key` resources using the Route 53 Hosted Zone identifier and KMS Key identifier, separated by a comma (`,`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_route53_key_signing_key` resources using the Route 53 Hosted Zone identifier and KMS Key identifier, separated by a comma (`,`). For example:
+
+```console
+% terraform import aws_route53_key_signing_key.example Z1D633PJN98FT9,example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-eeafa23f3b2cf9c292211ba55ca229ed45cfe8d510a9b973ce0489a244999fd8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/route53_query_log.html.markdown b/website/docs/cdktf/python/r/route53_query_log.html.markdown
new file mode 100644
index 00000000000..a47f7eb7222
--- /dev/null
+++ b/website/docs/cdktf/python/r/route53_query_log.html.markdown
@@ -0,0 +1,114 @@
+---
+subcategory: "Route 53"
+layout: "aws"
+page_title: "AWS: aws_route53_query_log"
+description: |-
+  Provides a Route53 query logging configuration resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_route53_query_log
+
+Provides a Route53 query logging configuration resource.
+
+~> **NOTE:** There are restrictions on the configuration of query logging. Notably,
+the CloudWatch log group must be in the `us-east-1` region,
+a permissive CloudWatch log resource policy must be in place, and
+the Route53 hosted zone must be public.
+See [Configuring Logging for DNS Queries](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/query-logs.html?console_help=true#query-logs-configuring) for additional details.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudwatch_log_group import CloudwatchLogGroup
+from imports.aws.cloudwatch_log_resource_policy import CloudwatchLogResourcePolicy
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.provider import AwsProvider
+from imports.aws.route53_query_log import Route53QueryLog
+from imports.aws.route53_zone import Route53Zone
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        us_east1 = AwsProvider(self, "aws",
+            alias="us-east-1",
+            region="us-east-1"
+        )
+        example_com = Route53Zone(self, "example_com",
+            name="example.com"
+        )
+        route53_query_logging_policy = DataAwsIamPolicyDocument(self, "route53-query-logging-policy",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["logs:CreateLogStream", "logs:PutLogEvents"],
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["route53.amazonaws.com"],
+                    type="Service"
+                )
+                ],
+                resources=["arn:aws:logs:*:*:log-group:/aws/route53/*"]
+            )
+            ]
+        )
+        aws_route53_example_com = CloudwatchLogGroup(self, "aws_route53_example_com",
+            name="/aws/route53/${" + example_com.name + "}",
+            provider=us_east1,
+            retention_in_days=30
+        )
+        aws_cloudwatch_log_resource_policy_route53_query_logging_policy =
+        CloudwatchLogResourcePolicy(self, "route53-query-logging-policy_4",
+            policy_document=Token.as_string(route53_query_logging_policy.json),
+            policy_name="route53-query-logging-policy",
+            provider=us_east1
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_cloudwatch_log_resource_policy_route53_query_logging_policy.override_logical_id("route53-query-logging-policy")
+        aws_route53_query_log_example_com = Route53QueryLog(self, "example_com_5",
+            cloudwatch_log_group_arn=aws_route53_example_com.arn,
+            depends_on=[aws_cloudwatch_log_resource_policy_route53_query_logging_policy],
+            zone_id=example_com.zone_id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_route53_query_log_example_com.override_logical_id("example_com")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `cloudwatch_log_group_arn` - (Required) CloudWatch log group ARN to send query logs.
+* `zone_id` - (Required) Route53 hosted zone ID to enable query logs.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the Query Logging Config.
+* `id` - The query logging configuration ID
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Route53 query logging configurations using their ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Route53 query logging configurations using their ID. For example:
+
+```console
+% terraform import aws_route53_query_log.example_com xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
+```
+
+<!-- cache-key: cdktf-0.18.0 input-d9656f2fc1e20251769a3e2a3d8099ca32009721211d5ef362901f305ddc7e9e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/route53_record.html.markdown b/website/docs/cdktf/python/r/route53_record.html.markdown
new file mode 100644
index 00000000000..feae40ed3b0
--- /dev/null
+++ b/website/docs/cdktf/python/r/route53_record.html.markdown
@@ -0,0 +1,272 @@
+---
+subcategory: "Route 53"
+layout: "aws"
+page_title: "AWS: aws_route53_record"
+description: |-
+  Provides a Route53 record resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_route53_record
+
+Provides a Route53 record resource.
+
+## Example Usage
+
+### Simple routing policy
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.route53_record import Route53Record
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Route53Record(self, "www",
+            name="www.example.com",
+            records=[lb.public_ip],
+            ttl=300,
+            type="A",
+            zone_id=primary.zone_id
+        )
+```
+
+### Weighted routing policy
+
+Other routing policies are configured similarly. See [Amazon Route 53 Developer Guide](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-policy.html) for details.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.route53_record import Route53Record
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Route53Record(self, "www-dev",
+            name="www",
+            records=["dev.example.com"],
+            set_identifier="dev",
+            ttl=5,
+            type="CNAME",
+            weighted_routing_policy=Route53RecordWeightedRoutingPolicy(
+                weight=10
+            ),
+            zone_id=primary.zone_id
+        )
+        Route53Record(self, "www-live",
+            name="www",
+            records=["live.example.com"],
+            set_identifier="live",
+            ttl=5,
+            type="CNAME",
+            weighted_routing_policy=Route53RecordWeightedRoutingPolicy(
+                weight=90
+            ),
+            zone_id=primary.zone_id
+        )
+```
+
+### Alias record
+
+See [related part of Amazon Route 53 Developer Guide](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resource-record-sets-choosing-alias-non-alias.html)
+to understand differences between alias and non-alias records.
+
+TTL for all alias records is [60 seconds](https://aws.amazon.com/route53/faqs/#dns_failover_do_i_need_to_adjust),
+you cannot change this, therefore `ttl` has to be omitted in alias records.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.elb import Elb
+from imports.aws.route53_record import Route53Record
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        main = Elb(self, "main",
+            availability_zones=["us-east-1c"],
+            listener=[ElbListener(
+                instance_port=80,
+                instance_protocol="http",
+                lb_port=80,
+                lb_protocol="http"
+            )
+            ],
+            name="foobar-terraform-elb"
+        )
+        Route53Record(self, "www",
+            alias=Route53RecordAlias(
+                evaluate_target_health=True,
+                name=main.dns_name,
+                zone_id=main.zone_id
+            ),
+            name="example.com",
+            type="A",
+            zone_id=primary.zone_id
+        )
+```
+
+### NS and SOA Record Management
+
+When creating Route 53 zones, the `NS` and `SOA` records for the zone are automatically created. Enabling the `allow_overwrite` argument will allow managing these records in a single Terraform run without the requirement for `terraform import`.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.route53_record import Route53Record
+from imports.aws.route53_zone import Route53Zone
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = Route53Zone(self, "example",
+            name="test.example.com"
+        )
+        aws_route53_record_example = Route53Record(self, "example_1",
+            allow_overwrite=True,
+            name="test.example.com",
+            records=[
+                Token.as_string(Fn.lookup_nested(example.name_servers, ["0"])),
+                Token.as_string(Fn.lookup_nested(example.name_servers, ["1"])),
+                Token.as_string(Fn.lookup_nested(example.name_servers, ["2"])),
+                Token.as_string(Fn.lookup_nested(example.name_servers, ["3"]))
+            ],
+            ttl=172800,
+            type="NS",
+            zone_id=example.zone_id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_route53_record_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `zone_id` - (Required) The ID of the hosted zone to contain this record.
+* `name` - (Required) The name of the record.
+* `type` - (Required) The record type. Valid values are `A`, `AAAA`, `CAA`, `CNAME`, `DS`, `MX`, `NAPTR`, `NS`, `PTR`, `SOA`, `SPF`, `SRV` and `TXT`.
+* `ttl` - (Required for non-alias records) The TTL of the record.
+* `records` - (Required for non-alias records) A string list of records. To specify a single record value longer than 255 characters such as a TXT record for DKIM, add `\"\"` inside the Terraform configuration string (e.g., `"first255characters\"\"morecharacters"`).
+* `set_identifier` - (Optional) Unique identifier to differentiate records with routing policies from one another. Required if using `cidr_routing_policy`, `failover_routing_policy`, `geolocation_routing_policy`, `latency_routing_policy`, `multivalue_answer_routing_policy`, or `weighted_routing_policy`.
+* `health_check_id` - (Optional) The health check the record should be associated with.
+* `alias` - (Optional) An alias block. Conflicts with `ttl` & `records`.
+  [Documented below](#alias).
+* `cidr_routing_policy` - (Optional) A block indicating a routing policy based on the IP network ranges of requestors. Conflicts with any other routing policy. [Documented below](#cidr-routing-policy).
+* `failover_routing_policy` - (Optional) A block indicating the routing behavior when associated health check fails. Conflicts with any other routing policy. [Documented below](#failover-routing-policy).
+* `geolocation_routing_policy` - (Optional) A block indicating a routing policy based on the geolocation of the requestor. Conflicts with any other routing policy. [Documented below](#geolocation-routing-policy).
+* `latency_routing_policy` - (Optional) A block indicating a routing policy based on the latency between the requestor and an AWS region. Conflicts with any other routing policy. [Documented below](#latency-routing-policy).
+* `multivalue_answer_routing_policy` - (Optional) Set to `true` to indicate a multivalue answer routing policy. Conflicts with any other routing policy.
+* `weighted_routing_policy` - (Optional) A block indicating a weighted routing policy. Conflicts with any other routing policy. [Documented below](#weighted-routing-policy).
+* `allow_overwrite` - (Optional) Allow creation of this record in Terraform to overwrite an existing record, if any. This does not affect the ability to update the record in Terraform and does not prevent other resources within Terraform or manual Route 53 changes outside Terraform from overwriting this record. `false` by default. This configuration is not recommended for most environments.
+
+Exactly one of `records` or `alias` must be specified: this determines whether it's an alias record.
+
+### Alias
+
+Alias records support the following:
+
+* `name` - (Required) DNS domain name for a CloudFront distribution, S3 bucket, ELB, or another resource record set in this hosted zone.
+* `zone_id` - (Required) Hosted zone ID for a CloudFront distribution, S3 bucket, ELB, or Route 53 hosted zone. See [`resource_elb.zone_id`](/docs/providers/aws/r/elb.html#zone_id) for example.
+* `evaluate_target_health` - (Required) Set to `true` if you want Route 53 to determine whether to respond to DNS queries using this resource record set by checking the health of the resource record set. Some resources have special requirements, see [related part of documentation](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resource-record-sets-values.html#rrsets-values-alias-evaluate-target-health).
+
+### CIDR Routing Policy
+
+CIDR routing policies support the following:
+
+* `collection_id` - (Required) The CIDR collection ID. See the [`aws_route53_cidr_collection` resource](route53_cidr_collection.html) for more details.
+* `location_name` - (Required) The CIDR collection location name. See the [`aws_route53_cidr_location` resource](route53_cidr_location.html) for more details. A `location_name` with an asterisk `"*"` can be used to create a default CIDR record. `collection_id` is still required for default record.
+
+### Failover Routing Policy
+
+Failover routing policies support the following:
+
+* `type` - (Required) `PRIMARY` or `SECONDARY`. A `PRIMARY` record will be served if its healthcheck is passing, otherwise the `SECONDARY` will be served. See http://docs.aws.amazon.com/Route53/latest/DeveloperGuide/dns-failover-configuring-options.html#dns-failover-failover-rrsets
+
+### Geolocation Routing Policy
+
+Geolocation routing policies support the following:
+
+* `continent` - A two-letter continent code. See http://docs.aws.amazon.com/Route53/latest/APIReference/API_GetGeoLocation.html for code details. Either `continent` or `country` must be specified.
+* `country` - A two-character country code or `*` to indicate a default resource record set.
+* `subdivision` - (Optional) A subdivision code for a country.
+
+### Latency Routing Policy
+
+Latency routing policies support the following:
+
+* `region` - (Required) An AWS region from which to measure latency. See http://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-policy.html#routing-policy-latency
+
+### Weighted Routing Policy
+
+Weighted routing policies support the following:
+
+* `weight` - (Required) A numeric value indicating the relative weight of the record. See http://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-policy.html#routing-policy-weighted.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `name` - The name of the record.
+* `fqdn` - [FQDN](https://en.wikipedia.org/wiki/Fully_qualified_domain_name) built using the zone domain and `name`.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Route53 Records using the ID of the record, record name, record type, and set identifier. For example:
+
+Using the ID of the record, which is the zone identifier, record name, and record type, separated by underscores (`_`):
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+If the record also contains a set identifier, append it:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+**Using `terraform import` to import** Route53 Records using the ID of the record, record name, record type, and set identifier. For example:
+
+Using the ID of the record, which is the zone identifier, record name, and record type, separated by underscores (`_`):
+
+```console
+% terraform import aws_route53_record.myrecord Z4KAPRWWNC7JR_dev.example.com_NS
+```
+
+If the record also contains a set identifier, append it:
+
+```console
+% terraform import aws_route53_record.myrecord Z4KAPRWWNC7JR_dev.example.com_NS_dev
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ff3c2884016714726f134a120fd1d35b335e3a18fa3df771cb63253090a4eb1e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/route53_resolver_config.html.markdown b/website/docs/cdktf/python/r/route53_resolver_config.html.markdown
new file mode 100644
index 00000000000..a16918a9a33
--- /dev/null
+++ b/website/docs/cdktf/python/r/route53_resolver_config.html.markdown
@@ -0,0 +1,76 @@
+---
+subcategory: "Route 53 Resolver"
+layout: "aws"
+page_title: "AWS: aws_route53_resolver_config"
+description: |-
+  Provides a Route 53 Resolver config resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_route53_resolver_config
+
+Provides a Route 53 Resolver config resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.route53_resolver_config import Route53ResolverConfig
+from imports.aws.vpc import Vpc
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = Vpc(self, "example",
+            cidr_block="10.0.0.0/16",
+            enable_dns_hostnames=True,
+            enable_dns_support=True
+        )
+        aws_route53_resolver_config_example = Route53ResolverConfig(self, "example_1",
+            autodefined_reverse_flag="DISABLE",
+            resource_id=example.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_route53_resolver_config_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `resource_id` - (Required) The ID of the VPC that the configuration is for.
+* `autodefined_reverse_flag` - (Required) Indicates whether or not the Resolver will create autodefined rules for reverse DNS lookups. Valid values: `ENABLE`, `DISABLE`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the resolver configuration.
+* `owner_id` - The AWS account ID of the owner of the VPC that this resolver configuration applies to.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Route 53 Resolver configs using the Route 53 Resolver config ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Route 53 Resolver configs using the Route 53 Resolver config ID. For example:
+
+```console
+% terraform import aws_route53_resolver_config.example rslvr-rc-715aa20c73a23da7
+```
+
+<!-- cache-key: cdktf-0.18.0 input-9e9ab64717f5492816cdea672c9253b6943b2cad6b967b971fcb44194acec4cf -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/route53_resolver_dnssec_config.html.markdown b/website/docs/cdktf/python/r/route53_resolver_dnssec_config.html.markdown
new file mode 100644
index 00000000000..ab595cea652
--- /dev/null
+++ b/website/docs/cdktf/python/r/route53_resolver_dnssec_config.html.markdown
@@ -0,0 +1,77 @@
+---
+subcategory: "Route 53 Resolver"
+layout: "aws"
+page_title: "AWS: aws_route53_resolver_dnssec_config"
+description: |-
+  Provides a Route 53 Resolver DNSSEC config resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_route53_resolver_dnssec_config
+
+Provides a Route 53 Resolver DNSSEC config resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.route53_resolver_dnssec_config import Route53ResolverDnssecConfig
+from imports.aws.vpc import Vpc
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = Vpc(self, "example",
+            cidr_block="10.0.0.0/16",
+            enable_dns_hostnames=True,
+            enable_dns_support=True
+        )
+        aws_route53_resolver_dnssec_config_example =
+        Route53ResolverDnssecConfig(self, "example_1",
+            resource_id=example.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_route53_resolver_dnssec_config_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `resource_id` - (Required) The ID of the virtual private cloud (VPC) that you're updating the DNSSEC validation status for.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN for a configuration for DNSSEC validation.
+* `id` - The ID for a configuration for DNSSEC validation.
+* `owner_id` - The owner account ID of the virtual private cloud (VPC) for a configuration for DNSSEC validation.
+* `validation_status` - The validation status for a DNSSEC configuration. The status can be one of the following: `ENABLING`, `ENABLED`, `DISABLING` and `DISABLED`.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import  Route 53 Resolver DNSSEC configs using the Route 53 Resolver DNSSEC config ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import  Route 53 Resolver DNSSEC configs using the Route 53 Resolver DNSSEC config ID. For example:
+
+```console
+% terraform import aws_route53_resolver_dnssec_config.example rdsc-be1866ecc1683e95
+```
+
+<!-- cache-key: cdktf-0.18.0 input-65576be1323a01047ddd84b194036361eced4cbe29a22e9031f40a7283d1af9a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/route53_resolver_endpoint.html.markdown b/website/docs/cdktf/python/r/route53_resolver_endpoint.html.markdown
new file mode 100644
index 00000000000..59e5e06e093
--- /dev/null
+++ b/website/docs/cdktf/python/r/route53_resolver_endpoint.html.markdown
@@ -0,0 +1,100 @@
+---
+subcategory: "Route 53 Resolver"
+layout: "aws"
+page_title: "AWS: aws_route53_resolver_endpoint"
+description: |-
+  Provides a Route 53 Resolver endpoint resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_route53_resolver_endpoint
+
+Provides a Route 53 Resolver endpoint resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.route53_resolver_endpoint import Route53ResolverEndpoint
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Route53ResolverEndpoint(self, "foo",
+            direction="INBOUND",
+            ip_address=[Route53ResolverEndpointIpAddress(
+                subnet_id=sn1.id
+            ), Route53ResolverEndpointIpAddress(
+                ip="10.0.64.4",
+                subnet_id=sn2.id
+            )
+            ],
+            name="foo",
+            security_group_ids=[sg1.id, sg2.id],
+            tags={
+                "Environment": "Prod"
+            }
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `direction` - (Required) The direction of DNS queries to or from the Route 53 Resolver endpoint.
+Valid values are `INBOUND` (resolver forwards DNS queries to the DNS service for a VPC from your network or another VPC)
+or `OUTBOUND` (resolver forwards DNS queries from the DNS service for a VPC to your network or another VPC).
+* `ip_address` - (Required) The subnets and IP addresses in your VPC that you want DNS queries to pass through on the way from your VPCs
+to your network (for outbound endpoints) or on the way from your network to your VPCs (for inbound endpoints). Described below.
+* `security_group_ids` - (Required) The ID of one or more security groups that you want to use to control access to this VPC.
+* `name` - (Optional) The friendly name of the Route 53 Resolver endpoint.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+The `ip_address` object supports the following:
+
+* `subnet_id` - (Required) The ID of the subnet that contains the IP address.
+* `ip` - (Optional) The IP address in the subnet that you want to use for DNS queries.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the Route 53 Resolver endpoint.
+* `arn` - The ARN of the Route 53 Resolver endpoint.
+* `host_vpc_id` - The ID of the VPC that you want to create the resolver endpoint in.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `10m`)
+- `update` - (Default `10m`)
+- `delete` - (Default `10m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import  Route 53 Resolver endpoints using the Route 53 Resolver endpoint ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import  Route 53 Resolver endpoints using the Route 53 Resolver endpoint ID. For example:
+
+```console
+% terraform import aws_route53_resolver_endpoint.foo rslvr-in-abcdef01234567890
+```
+
+<!-- cache-key: cdktf-0.18.0 input-17a9ce982f1bbb8ea75dad88b3aa989a8f0aad667032d40125014dcc640c486e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/route53_resolver_firewall_config.html.markdown b/website/docs/cdktf/python/r/route53_resolver_firewall_config.html.markdown
new file mode 100644
index 00000000000..ccbb9619146
--- /dev/null
+++ b/website/docs/cdktf/python/r/route53_resolver_firewall_config.html.markdown
@@ -0,0 +1,77 @@
+---
+subcategory: "Route 53 Resolver"
+layout: "aws"
+page_title: "AWS: aws_route53_resolver_firewall_config"
+description: |-
+  Provides a Route 53 Resolver DNS Firewall config resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_route53_resolver_firewall_config
+
+Provides a Route 53 Resolver DNS Firewall config resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.route53_resolver_firewall_config import Route53ResolverFirewallConfig
+from imports.aws.vpc import Vpc
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = Vpc(self, "example",
+            cidr_block="10.0.0.0/16",
+            enable_dns_hostnames=True,
+            enable_dns_support=True
+        )
+        aws_route53_resolver_firewall_config_example =
+        Route53ResolverFirewallConfig(self, "example_1",
+            firewall_fail_open="ENABLED",
+            resource_id=example.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_route53_resolver_firewall_config_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `resource_id` - (Required) The ID of the VPC that the configuration is for.
+* `firewall_fail_open` - (Required) Determines how Route 53 Resolver handles queries during failures, for example when all traffic that is sent to DNS Firewall fails to receive a reply. By default, fail open is disabled, which means the failure mode is closed. This approach favors security over availability. DNS Firewall blocks queries that it is unable to evaluate properly. If you enable this option, the failure mode is open. This approach favors availability over security. DNS Firewall allows queries to proceed if it is unable to properly evaluate them. Valid values: `ENABLED`, `DISABLED`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the firewall configuration.
+* `owner_id` - The AWS account ID of the owner of the VPC that this firewall configuration applies to.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Route 53 Resolver DNS Firewall configs using the Route 53 Resolver DNS Firewall config ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Route 53 Resolver DNS Firewall configs using the Route 53 Resolver DNS Firewall config ID. For example:
+
+```console
+% terraform import aws_route53_resolver_firewall_config.example rdsc-be1866ecc1683e95
+```
+
+<!-- cache-key: cdktf-0.18.0 input-47300e21e1334742b1c6242fae853e95ab5ebc4549ee0296560b626b37cb47ed -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/route53_resolver_firewall_config.markdown b/website/docs/cdktf/python/r/route53_resolver_firewall_config.markdown
new file mode 100644
index 00000000000..ccbb9619146
--- /dev/null
+++ b/website/docs/cdktf/python/r/route53_resolver_firewall_config.markdown
@@ -0,0 +1,77 @@
+---
+subcategory: "Route 53 Resolver"
+layout: "aws"
+page_title: "AWS: aws_route53_resolver_firewall_config"
+description: |-
+  Provides a Route 53 Resolver DNS Firewall config resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_route53_resolver_firewall_config
+
+Provides a Route 53 Resolver DNS Firewall config resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.route53_resolver_firewall_config import Route53ResolverFirewallConfig
+from imports.aws.vpc import Vpc
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = Vpc(self, "example",
+            cidr_block="10.0.0.0/16",
+            enable_dns_hostnames=True,
+            enable_dns_support=True
+        )
+        aws_route53_resolver_firewall_config_example =
+        Route53ResolverFirewallConfig(self, "example_1",
+            firewall_fail_open="ENABLED",
+            resource_id=example.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_route53_resolver_firewall_config_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `resource_id` - (Required) The ID of the VPC that the configuration is for.
+* `firewall_fail_open` - (Required) Determines how Route 53 Resolver handles queries during failures, for example when all traffic that is sent to DNS Firewall fails to receive a reply. By default, fail open is disabled, which means the failure mode is closed. This approach favors security over availability. DNS Firewall blocks queries that it is unable to evaluate properly. If you enable this option, the failure mode is open. This approach favors availability over security. DNS Firewall allows queries to proceed if it is unable to properly evaluate them. Valid values: `ENABLED`, `DISABLED`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the firewall configuration.
+* `owner_id` - The AWS account ID of the owner of the VPC that this firewall configuration applies to.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Route 53 Resolver DNS Firewall configs using the Route 53 Resolver DNS Firewall config ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Route 53 Resolver DNS Firewall configs using the Route 53 Resolver DNS Firewall config ID. For example:
+
+```console
+% terraform import aws_route53_resolver_firewall_config.example rdsc-be1866ecc1683e95
+```
+
+<!-- cache-key: cdktf-0.18.0 input-47300e21e1334742b1c6242fae853e95ab5ebc4549ee0296560b626b37cb47ed -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/route53_resolver_firewall_domain_list.html.markdown b/website/docs/cdktf/python/r/route53_resolver_firewall_domain_list.html.markdown
new file mode 100644
index 00000000000..56bd5e63691
--- /dev/null
+++ b/website/docs/cdktf/python/r/route53_resolver_firewall_domain_list.html.markdown
@@ -0,0 +1,69 @@
+---
+subcategory: "Route 53 Resolver"
+layout: "aws"
+page_title: "AWS: aws_route53_resolver_firewall_domain_list"
+description: |-
+  Provides a Route 53 Resolver DNS Firewall domain list resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_route53_resolver_firewall_domain_list
+
+Provides a Route 53 Resolver DNS Firewall domain list resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.route53_resolver_firewall_domain_list import Route53ResolverFirewallDomainList
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Route53ResolverFirewallDomainList(self, "example",
+            name="example"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) A name that lets you identify the domain list, to manage and use it.
+* `domains` - (Optional) A array of domains for the firewall domain list.
+* `tags` - (Optional) A map of tags to assign to the resource. f configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN (Amazon Resource Name) of the domain list.
+* `id` - The ID of the domain list.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import  Route 53 Resolver DNS Firewall domain lists using the Route 53 Resolver DNS Firewall domain list ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import  Route 53 Resolver DNS Firewall domain lists using the Route 53 Resolver DNS Firewall domain list ID. For example:
+
+```console
+% terraform import aws_route53_resolver_firewall_domain_list.example rslvr-fdl-0123456789abcdef
+```
+
+<!-- cache-key: cdktf-0.18.0 input-3154f1bdcac6cbca6a0b5ed4de8e5f387de71af6809cbe31b5fc56bec0e07a22 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/route53_resolver_firewall_domain_list.markdown b/website/docs/cdktf/python/r/route53_resolver_firewall_domain_list.markdown
new file mode 100644
index 00000000000..56bd5e63691
--- /dev/null
+++ b/website/docs/cdktf/python/r/route53_resolver_firewall_domain_list.markdown
@@ -0,0 +1,69 @@
+---
+subcategory: "Route 53 Resolver"
+layout: "aws"
+page_title: "AWS: aws_route53_resolver_firewall_domain_list"
+description: |-
+  Provides a Route 53 Resolver DNS Firewall domain list resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_route53_resolver_firewall_domain_list
+
+Provides a Route 53 Resolver DNS Firewall domain list resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.route53_resolver_firewall_domain_list import Route53ResolverFirewallDomainList
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Route53ResolverFirewallDomainList(self, "example",
+            name="example"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) A name that lets you identify the domain list, to manage and use it.
+* `domains` - (Optional) A array of domains for the firewall domain list.
+* `tags` - (Optional) A map of tags to assign to the resource. f configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN (Amazon Resource Name) of the domain list.
+* `id` - The ID of the domain list.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import  Route 53 Resolver DNS Firewall domain lists using the Route 53 Resolver DNS Firewall domain list ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import  Route 53 Resolver DNS Firewall domain lists using the Route 53 Resolver DNS Firewall domain list ID. For example:
+
+```console
+% terraform import aws_route53_resolver_firewall_domain_list.example rslvr-fdl-0123456789abcdef
+```
+
+<!-- cache-key: cdktf-0.18.0 input-3154f1bdcac6cbca6a0b5ed4de8e5f387de71af6809cbe31b5fc56bec0e07a22 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/route53_resolver_firewall_rule.html.markdown b/website/docs/cdktf/python/r/route53_resolver_firewall_rule.html.markdown
new file mode 100644
index 00000000000..445bbd10316
--- /dev/null
+++ b/website/docs/cdktf/python/r/route53_resolver_firewall_rule.html.markdown
@@ -0,0 +1,98 @@
+---
+subcategory: "Route 53 Resolver"
+layout: "aws"
+page_title: "AWS: aws_route53_resolver_firewall_rule"
+description: |-
+  Provides a Route 53 Resolver DNS Firewall rule resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_route53_resolver_firewall_rule
+
+Provides a Route 53 Resolver DNS Firewall rule resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.route53_resolver_firewall_domain_list import Route53ResolverFirewallDomainList
+from imports.aws.route53_resolver_firewall_rule import Route53ResolverFirewallRule
+from imports.aws.route53_resolver_firewall_rule_group import Route53ResolverFirewallRuleGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = Route53ResolverFirewallDomainList(self, "example",
+            domains=["example.com"],
+            name="example",
+            tags={}
+        )
+        aws_route53_resolver_firewall_rule_group_example =
+        Route53ResolverFirewallRuleGroup(self, "example_1",
+            name="example",
+            tags={}
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_route53_resolver_firewall_rule_group_example.override_logical_id("example")
+        aws_route53_resolver_firewall_rule_example =
+        Route53ResolverFirewallRule(self, "example_2",
+            action="BLOCK",
+            block_override_dns_type="CNAME",
+            block_override_domain="example.com",
+            block_override_ttl=1,
+            block_response="OVERRIDE",
+            firewall_domain_list_id=example.id,
+            firewall_rule_group_id=Token.as_string(aws_route53_resolver_firewall_rule_group_example.id),
+            name="example",
+            priority=100
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_route53_resolver_firewall_rule_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) A name that lets you identify the rule, to manage and use it.
+* `action` - (Required) The action that DNS Firewall should take on a DNS query when it matches one of the domains in the rule's domain list. Valid values: `ALLOW`, `BLOCK`, `ALERT`.
+* `block_override_dns_type` - (Required if `block_response` is `OVERRIDE`) The DNS record's type. This determines the format of the record value that you provided in BlockOverrideDomain. Value values: `CNAME`.
+* `block_override_domain` - (Required if `block_response` is `OVERRIDE`) The custom DNS record to send back in response to the query.
+* `block_override_ttl` - (Required if `block_response` is `OVERRIDE`) The recommended amount of time, in seconds, for the DNS resolver or web browser to cache the provided override record. Minimum value of 0. Maximum value of 604800.
+* `block_response` - (Required if `action` is `BLOCK`) The way that you want DNS Firewall to block the request. Valid values: `NODATA`, `NXDOMAIN`, `OVERRIDE`.
+* `firewall_domain_list_id` - (Required) The ID of the domain list that you want to use in the rule.
+* `firewall_rule_group_id` - (Required) The unique identifier of the firewall rule group where you want to create the rule.
+* `priority` - (Required) The setting that determines the processing order of the rule in the rule group. DNS Firewall processes the rules in a rule group by order of priority, starting from the lowest setting.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the rule.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import  Route 53 Resolver DNS Firewall rules using the Route 53 Resolver DNS Firewall rule group ID and domain list ID separated by ':'. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import  Route 53 Resolver DNS Firewall rules using the Route 53 Resolver DNS Firewall rule group ID and domain list ID separated by ':'. For example:
+
+```console
+% terraform import aws_route53_resolver_firewall_rule.example rslvr-frg-0123456789abcdef:rslvr-fdl-0123456789abcdef
+```
+
+<!-- cache-key: cdktf-0.18.0 input-91abb2b9b51d1173006c0a1458d5a94bbfd790f314498d4abce090eaa02a7e45 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/route53_resolver_firewall_rule.markdown b/website/docs/cdktf/python/r/route53_resolver_firewall_rule.markdown
new file mode 100644
index 00000000000..445bbd10316
--- /dev/null
+++ b/website/docs/cdktf/python/r/route53_resolver_firewall_rule.markdown
@@ -0,0 +1,98 @@
+---
+subcategory: "Route 53 Resolver"
+layout: "aws"
+page_title: "AWS: aws_route53_resolver_firewall_rule"
+description: |-
+  Provides a Route 53 Resolver DNS Firewall rule resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_route53_resolver_firewall_rule
+
+Provides a Route 53 Resolver DNS Firewall rule resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.route53_resolver_firewall_domain_list import Route53ResolverFirewallDomainList
+from imports.aws.route53_resolver_firewall_rule import Route53ResolverFirewallRule
+from imports.aws.route53_resolver_firewall_rule_group import Route53ResolverFirewallRuleGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = Route53ResolverFirewallDomainList(self, "example",
+            domains=["example.com"],
+            name="example",
+            tags={}
+        )
+        aws_route53_resolver_firewall_rule_group_example =
+        Route53ResolverFirewallRuleGroup(self, "example_1",
+            name="example",
+            tags={}
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_route53_resolver_firewall_rule_group_example.override_logical_id("example")
+        aws_route53_resolver_firewall_rule_example =
+        Route53ResolverFirewallRule(self, "example_2",
+            action="BLOCK",
+            block_override_dns_type="CNAME",
+            block_override_domain="example.com",
+            block_override_ttl=1,
+            block_response="OVERRIDE",
+            firewall_domain_list_id=example.id,
+            firewall_rule_group_id=Token.as_string(aws_route53_resolver_firewall_rule_group_example.id),
+            name="example",
+            priority=100
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_route53_resolver_firewall_rule_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) A name that lets you identify the rule, to manage and use it.
+* `action` - (Required) The action that DNS Firewall should take on a DNS query when it matches one of the domains in the rule's domain list. Valid values: `ALLOW`, `BLOCK`, `ALERT`.
+* `block_override_dns_type` - (Required if `block_response` is `OVERRIDE`) The DNS record's type. This determines the format of the record value that you provided in BlockOverrideDomain. Value values: `CNAME`.
+* `block_override_domain` - (Required if `block_response` is `OVERRIDE`) The custom DNS record to send back in response to the query.
+* `block_override_ttl` - (Required if `block_response` is `OVERRIDE`) The recommended amount of time, in seconds, for the DNS resolver or web browser to cache the provided override record. Minimum value of 0. Maximum value of 604800.
+* `block_response` - (Required if `action` is `BLOCK`) The way that you want DNS Firewall to block the request. Valid values: `NODATA`, `NXDOMAIN`, `OVERRIDE`.
+* `firewall_domain_list_id` - (Required) The ID of the domain list that you want to use in the rule.
+* `firewall_rule_group_id` - (Required) The unique identifier of the firewall rule group where you want to create the rule.
+* `priority` - (Required) The setting that determines the processing order of the rule in the rule group. DNS Firewall processes the rules in a rule group by order of priority, starting from the lowest setting.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the rule.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import  Route 53 Resolver DNS Firewall rules using the Route 53 Resolver DNS Firewall rule group ID and domain list ID separated by ':'. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import  Route 53 Resolver DNS Firewall rules using the Route 53 Resolver DNS Firewall rule group ID and domain list ID separated by ':'. For example:
+
+```console
+% terraform import aws_route53_resolver_firewall_rule.example rslvr-frg-0123456789abcdef:rslvr-fdl-0123456789abcdef
+```
+
+<!-- cache-key: cdktf-0.18.0 input-91abb2b9b51d1173006c0a1458d5a94bbfd790f314498d4abce090eaa02a7e45 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/route53_resolver_firewall_rule_group.html.markdown b/website/docs/cdktf/python/r/route53_resolver_firewall_rule_group.html.markdown
new file mode 100644
index 00000000000..43031baa121
--- /dev/null
+++ b/website/docs/cdktf/python/r/route53_resolver_firewall_rule_group.html.markdown
@@ -0,0 +1,70 @@
+---
+subcategory: "Route 53 Resolver"
+layout: "aws"
+page_title: "AWS: aws_route53_resolver_firewall_rule_group"
+description: |-
+  Provides a Route 53 Resolver DNS Firewall rule group resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_route53_resolver_firewall_rule_group
+
+Provides a Route 53 Resolver DNS Firewall rule group resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.route53_resolver_firewall_rule_group import Route53ResolverFirewallRuleGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Route53ResolverFirewallRuleGroup(self, "example",
+            name="example"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) A name that lets you identify the rule group, to manage and use it.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN (Amazon Resource Name) of the rule group.
+* `id` - The ID of the rule group.
+* `owner_id` - The AWS account ID for the account that created the rule group. When a rule group is shared with your account, this is the account that has shared the rule group with you.
+* `share_status` - Whether the rule group is shared with other AWS accounts, or was shared with the current account by another AWS account. Sharing is configured through AWS Resource Access Manager (AWS RAM). Valid values: `NOT_SHARED`, `SHARED_BY_ME`, `SHARED_WITH_ME`
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import  Route 53 Resolver DNS Firewall rule groups using the Route 53 Resolver DNS Firewall rule group ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import  Route 53 Resolver DNS Firewall rule groups using the Route 53 Resolver DNS Firewall rule group ID. For example:
+
+```console
+% terraform import aws_route53_resolver_firewall_rule_group.example rslvr-frg-0123456789abcdef
+```
+
+<!-- cache-key: cdktf-0.18.0 input-a7027280b0156439ca87c0646923dbb1f2fe11c7d16f7cb2dd4b81387e289185 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/route53_resolver_firewall_rule_group.markdown b/website/docs/cdktf/python/r/route53_resolver_firewall_rule_group.markdown
new file mode 100644
index 00000000000..43031baa121
--- /dev/null
+++ b/website/docs/cdktf/python/r/route53_resolver_firewall_rule_group.markdown
@@ -0,0 +1,70 @@
+---
+subcategory: "Route 53 Resolver"
+layout: "aws"
+page_title: "AWS: aws_route53_resolver_firewall_rule_group"
+description: |-
+  Provides a Route 53 Resolver DNS Firewall rule group resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_route53_resolver_firewall_rule_group
+
+Provides a Route 53 Resolver DNS Firewall rule group resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.route53_resolver_firewall_rule_group import Route53ResolverFirewallRuleGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Route53ResolverFirewallRuleGroup(self, "example",
+            name="example"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) A name that lets you identify the rule group, to manage and use it.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN (Amazon Resource Name) of the rule group.
+* `id` - The ID of the rule group.
+* `owner_id` - The AWS account ID for the account that created the rule group. When a rule group is shared with your account, this is the account that has shared the rule group with you.
+* `share_status` - Whether the rule group is shared with other AWS accounts, or was shared with the current account by another AWS account. Sharing is configured through AWS Resource Access Manager (AWS RAM). Valid values: `NOT_SHARED`, `SHARED_BY_ME`, `SHARED_WITH_ME`
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import  Route 53 Resolver DNS Firewall rule groups using the Route 53 Resolver DNS Firewall rule group ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import  Route 53 Resolver DNS Firewall rule groups using the Route 53 Resolver DNS Firewall rule group ID. For example:
+
+```console
+% terraform import aws_route53_resolver_firewall_rule_group.example rslvr-frg-0123456789abcdef
+```
+
+<!-- cache-key: cdktf-0.18.0 input-a7027280b0156439ca87c0646923dbb1f2fe11c7d16f7cb2dd4b81387e289185 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/route53_resolver_firewall_rule_group_association.html.markdown b/website/docs/cdktf/python/r/route53_resolver_firewall_rule_group_association.html.markdown
new file mode 100644
index 00000000000..ac4e7791e41
--- /dev/null
+++ b/website/docs/cdktf/python/r/route53_resolver_firewall_rule_group_association.html.markdown
@@ -0,0 +1,82 @@
+---
+subcategory: "Route 53 Resolver"
+layout: "aws"
+page_title: "AWS: aws_route53_resolver_firewall_rule_group_association"
+description: |-
+  Provides a Route 53 Resolver DNS Firewall rule group association resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_route53_resolver_firewall_rule_group_association
+
+Provides a Route 53 Resolver DNS Firewall rule group association resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.route53_resolver_firewall_rule_group import Route53ResolverFirewallRuleGroup
+from imports.aws.route53_resolver_firewall_rule_group_association import Route53ResolverFirewallRuleGroupAssociation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = Route53ResolverFirewallRuleGroup(self, "example",
+            name="example"
+        )
+        aws_route53_resolver_firewall_rule_group_association_example =
+        Route53ResolverFirewallRuleGroupAssociation(self, "example_1",
+            firewall_rule_group_id=example.id,
+            name="example",
+            priority=100,
+            vpc_id=Token.as_string(aws_vpc_example.id)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_route53_resolver_firewall_rule_group_association_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) A name that lets you identify the rule group association, to manage and use it.
+* `firewall_rule_group_id` - (Required) The unique identifier of the firewall rule group.
+* `mutation_protection` - (Optional) If enabled, this setting disallows modification or removal of the association, to help prevent against accidentally altering DNS firewall protections. Valid values: `ENABLED`, `DISABLED`.
+* `priority` - (Required) The setting that determines the processing order of the rule group among the rule groups that you associate with the specified VPC. DNS Firewall filters VPC traffic starting from the rule group with the lowest numeric priority setting.
+* `vpc_id` - (Required) The unique identifier of the VPC that you want to associate with the rule group.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN (Amazon Resource Name) of the firewall rule group association.
+* `id` - The identifier for the association.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Route 53 Resolver DNS Firewall rule group associations using the Route 53 Resolver DNS Firewall rule group association ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Route 53 Resolver DNS Firewall rule group associations using the Route 53 Resolver DNS Firewall rule group association ID. For example:
+
+```console
+% terraform import aws_route53_resolver_firewall_rule_group_association.example rslvr-frgassoc-0123456789abcdef
+```
+
+<!-- cache-key: cdktf-0.18.0 input-51bb172b49b6d58bc2272c4f5a68cd66487cbbaeb7680be17082513297427b44 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/route53_resolver_firewall_rule_group_association.markdown b/website/docs/cdktf/python/r/route53_resolver_firewall_rule_group_association.markdown
new file mode 100644
index 00000000000..ac4e7791e41
--- /dev/null
+++ b/website/docs/cdktf/python/r/route53_resolver_firewall_rule_group_association.markdown
@@ -0,0 +1,82 @@
+---
+subcategory: "Route 53 Resolver"
+layout: "aws"
+page_title: "AWS: aws_route53_resolver_firewall_rule_group_association"
+description: |-
+  Provides a Route 53 Resolver DNS Firewall rule group association resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_route53_resolver_firewall_rule_group_association
+
+Provides a Route 53 Resolver DNS Firewall rule group association resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.route53_resolver_firewall_rule_group import Route53ResolverFirewallRuleGroup
+from imports.aws.route53_resolver_firewall_rule_group_association import Route53ResolverFirewallRuleGroupAssociation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = Route53ResolverFirewallRuleGroup(self, "example",
+            name="example"
+        )
+        aws_route53_resolver_firewall_rule_group_association_example =
+        Route53ResolverFirewallRuleGroupAssociation(self, "example_1",
+            firewall_rule_group_id=example.id,
+            name="example",
+            priority=100,
+            vpc_id=Token.as_string(aws_vpc_example.id)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_route53_resolver_firewall_rule_group_association_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) A name that lets you identify the rule group association, to manage and use it.
+* `firewall_rule_group_id` - (Required) The unique identifier of the firewall rule group.
+* `mutation_protection` - (Optional) If enabled, this setting disallows modification or removal of the association, to help prevent against accidentally altering DNS firewall protections. Valid values: `ENABLED`, `DISABLED`.
+* `priority` - (Required) The setting that determines the processing order of the rule group among the rule groups that you associate with the specified VPC. DNS Firewall filters VPC traffic starting from the rule group with the lowest numeric priority setting.
+* `vpc_id` - (Required) The unique identifier of the VPC that you want to associate with the rule group.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN (Amazon Resource Name) of the firewall rule group association.
+* `id` - The identifier for the association.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Route 53 Resolver DNS Firewall rule group associations using the Route 53 Resolver DNS Firewall rule group association ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Route 53 Resolver DNS Firewall rule group associations using the Route 53 Resolver DNS Firewall rule group association ID. For example:
+
+```console
+% terraform import aws_route53_resolver_firewall_rule_group_association.example rslvr-frgassoc-0123456789abcdef
+```
+
+<!-- cache-key: cdktf-0.18.0 input-51bb172b49b6d58bc2272c4f5a68cd66487cbbaeb7680be17082513297427b44 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/route53_resolver_query_log_config.html.markdown b/website/docs/cdktf/python/r/route53_resolver_query_log_config.html.markdown
new file mode 100644
index 00000000000..c48855be408
--- /dev/null
+++ b/website/docs/cdktf/python/r/route53_resolver_query_log_config.html.markdown
@@ -0,0 +1,78 @@
+---
+subcategory: "Route 53 Resolver"
+layout: "aws"
+page_title: "AWS: aws_route53_resolver_query_log_config"
+description: |-
+  Provides a Route 53 Resolver query logging configuration resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_route53_resolver_query_log_config
+
+Provides a Route 53 Resolver query logging configuration resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.route53_resolver_query_log_config import Route53ResolverQueryLogConfig
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Route53ResolverQueryLogConfig(self, "example",
+            destination_arn=Token.as_string(aws_s3_bucket_example.arn),
+            name="example",
+            tags={
+                "Environment": "Prod"
+            }
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `destination_arn` - (Required) The ARN of the resource that you want Route 53 Resolver to send query logs.
+You can send query logs to an [S3 bucket](s3_bucket.html), a [CloudWatch Logs log group](cloudwatch_log_group.html), or a [Kinesis Data Firehose delivery stream](kinesis_firehose_delivery_stream.html).
+* `name` - (Required) The name of the Route 53 Resolver query logging configuration.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the Route 53 Resolver query logging configuration.
+* `arn` - The ARN (Amazon Resource Name) of the Route 53 Resolver query logging configuration.
+* `owner_id` - The AWS account ID of the account that created the query logging configuration.
+* `share_status` - An indication of whether the query logging configuration is shared with other AWS accounts, or was shared with the current account by another AWS account.
+Sharing is configured through AWS Resource Access Manager (AWS RAM).
+Values are `NOT_SHARED`, `SHARED_BY_ME` or `SHARED_WITH_ME`
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import  Route 53 Resolver query logging configurations using the Route 53 Resolver query logging configuration ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import  Route 53 Resolver query logging configurations using the Route 53 Resolver query logging configuration ID. For example:
+
+```console
+% terraform import aws_route53_resolver_query_log_config.example rqlc-92edc3b1838248bf
+```
+
+<!-- cache-key: cdktf-0.18.0 input-5223f85f64c286cf17d4b87baa9cc06e62338ab91d82d959ba69e32ab94b1a4d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/route53_resolver_query_log_config_association.html.markdown b/website/docs/cdktf/python/r/route53_resolver_query_log_config_association.html.markdown
new file mode 100644
index 00000000000..59be420e918
--- /dev/null
+++ b/website/docs/cdktf/python/r/route53_resolver_query_log_config_association.html.markdown
@@ -0,0 +1,67 @@
+---
+subcategory: "Route 53 Resolver"
+layout: "aws"
+page_title: "AWS: aws_route53_resolver_query_log_config_association"
+description: |-
+  Provides a Route 53 Resolver query logging configuration association resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_route53_resolver_query_log_config_association
+
+Provides a Route 53 Resolver query logging configuration association resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.route53_resolver_query_log_config_association import Route53ResolverQueryLogConfigAssociation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Route53ResolverQueryLogConfigAssociation(self, "example",
+            resolver_query_log_config_id=Token.as_string(aws_route53_resolver_query_log_config_example.id),
+            resource_id=Token.as_string(aws_vpc_example.id)
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `resolver_query_log_config_id` - (Required) The ID of the [Route 53 Resolver query logging configuration](route53_resolver_query_log_config.html) that you want to associate a VPC with.
+* `resource_id` - (Required) The ID of a VPC that you want this query logging configuration to log queries for.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` -The ID of the Route 53 Resolver query logging configuration association.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import  Route 53 Resolver query logging configuration associations using the Route 53 Resolver query logging configuration association ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import  Route 53 Resolver query logging configuration associations using the Route 53 Resolver query logging configuration association ID. For example:
+
+```console
+% terraform import aws_route53_resolver_query_log_config_association.example rqlca-b320624fef3c4d70
+```
+
+<!-- cache-key: cdktf-0.18.0 input-6f62f5b9b4259b2643b1af4febefb7ddfdc7693ad36af9e17d0e6b9e0c1fd40c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/route53_resolver_rule.html.markdown b/website/docs/cdktf/python/r/route53_resolver_rule.html.markdown
new file mode 100644
index 00000000000..7727a1ffe30
--- /dev/null
+++ b/website/docs/cdktf/python/r/route53_resolver_rule.html.markdown
@@ -0,0 +1,114 @@
+---
+subcategory: "Route 53 Resolver"
+layout: "aws"
+page_title: "AWS: aws_route53_resolver_rule"
+description: |-
+  Provides a Route53 Resolver rule.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_route53_resolver_rule
+
+Provides a Route53 Resolver rule.
+
+## Example Usage
+
+### System rule
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.route53_resolver_rule import Route53ResolverRule
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Route53ResolverRule(self, "sys",
+            domain_name="subdomain.example.com",
+            rule_type="SYSTEM"
+        )
+```
+
+### Forward rule
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.route53_resolver_rule import Route53ResolverRule
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Route53ResolverRule(self, "fwd",
+            domain_name="example.com",
+            name="example",
+            resolver_endpoint_id=foo.id,
+            rule_type="FORWARD",
+            tags={
+                "Environment": "Prod"
+            },
+            target_ip=[Route53ResolverRuleTargetIp(
+                ip="123.45.67.89"
+            )
+            ]
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `domain_name` - (Required) DNS queries for this domain name are forwarded to the IP addresses that are specified using `target_ip`.
+* `rule_type` - (Required) The rule type. Valid values are `FORWARD`, `SYSTEM` and `RECURSIVE`.
+* `name` - (Optional) A friendly name that lets you easily find a rule in the Resolver dashboard in the Route 53 console.
+* `resolver_endpoint_id` (Optional) The ID of the outbound resolver endpoint that you want to use to route DNS queries to the IP addresses that you specify using `target_ip`.
+This argument should only be specified for `FORWARD` type rules.
+* `target_ip` - (Optional) Configuration block(s) indicating the IPs that you want Resolver to forward DNS queries to (documented below).
+This argument should only be specified for `FORWARD` type rules.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+The `target_ip` object supports the following:
+
+* `ip` - (Required) One IP address that you want to forward DNS queries to. You can specify only IPv4 addresses.
+* `port` - (Optional) The port at `ip` that you want to forward DNS queries to. Default value is `53`
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the resolver rule.
+* `arn` - The ARN (Amazon Resource Name) for the resolver rule.
+* `owner_id` - When a rule is shared with another AWS account, the account ID of the account that the rule is shared with.
+* `share_status` - Whether the rules is shared and, if so, whether the current account is sharing the rule with another account, or another account is sharing the rule with the current account.
+Values are `NOT_SHARED`, `SHARED_BY_ME` or `SHARED_WITH_ME`
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Route53 Resolver rules using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Route53 Resolver rules using the `id`. For example:
+
+```console
+% terraform import aws_route53_resolver_rule.sys rslvr-rr-0123456789abcdef0
+```
+
+<!-- cache-key: cdktf-0.18.0 input-e232908c083dc3536781f9aa9a4349eb098e85ae4ceb668269e5774249391222 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/route53_resolver_rule_association.html.markdown b/website/docs/cdktf/python/r/route53_resolver_rule_association.html.markdown
new file mode 100644
index 00000000000..108caea4ccc
--- /dev/null
+++ b/website/docs/cdktf/python/r/route53_resolver_rule_association.html.markdown
@@ -0,0 +1,68 @@
+---
+subcategory: "Route 53 Resolver"
+layout: "aws"
+page_title: "AWS: aws_route53_resolver_rule_association"
+description: |-
+  Provides a Route53 Resolver rule association.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_route53_resolver_rule_association
+
+Provides a Route53 Resolver rule association.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.route53_resolver_rule_association import Route53ResolverRuleAssociation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Route53ResolverRuleAssociation(self, "example",
+            resolver_rule_id=sys.id,
+            vpc_id=foo.id
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `resolver_rule_id` - (Required) The ID of the resolver rule that you want to associate with the VPC.
+* `vpc_id` - (Required) The ID of the VPC that you want to associate the resolver rule with.
+* `name` - (Optional) A name for the association that you're creating between a resolver rule and a VPC.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the resolver rule association.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Route53 Resolver rule associations using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Route53 Resolver rule associations using the `id`. For example:
+
+```console
+% terraform import aws_route53_resolver_rule_association.example rslvr-rrassoc-97242eaf88example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-8c7e93b46c5b9235d6779fd392935a48ebd6544409cadb4a6bb0f7b6f8660fa4 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/route53_traffic_policy.html.markdown b/website/docs/cdktf/python/r/route53_traffic_policy.html.markdown
new file mode 100644
index 00000000000..725b56841c6
--- /dev/null
+++ b/website/docs/cdktf/python/r/route53_traffic_policy.html.markdown
@@ -0,0 +1,74 @@
+---
+subcategory: "Route 53"
+layout: "aws"
+page_title: "AWS: aws_route53_traffic_policy"
+description: |-
+    Manages a Route53 Traffic Policy
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_route53_traffic_policy
+
+Manages a Route53 Traffic Policy.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.route53_traffic_policy import Route53TrafficPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Route53TrafficPolicy(self, "example",
+            comment="example comment",
+            document="{\n  \"AWSPolicyFormatVersion\": \"2015-10-01\",\n  \"RecordType\": \"A\",\n  \"Endpoints\": {\n    \"endpoint-start-NkPh\": {\n      \"Type\": \"value\",\n      \"Value\": \"10.0.0.2\"\n    }\n  },\n  \"StartEndpoint\": \"endpoint-start-NkPh\"\n}\n\n",
+            name="example"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) Name of the traffic policy.
+* `document` - (Required) Policy document. This is a JSON formatted string. For more information about building Route53 traffic policy documents, see the [AWS Route53 Traffic Policy document format](https://docs.aws.amazon.com/Route53/latest/APIReference/api-policies-traffic-policy-document-format.html)
+
+The following arguments are optional:
+
+* `comment` - (Optional) Comment for the traffic policy.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the traffic policy
+* `type` - DNS type of the resource record sets that Amazon Route 53 creates when you use a traffic policy to create a traffic policy instance.
+* `version` - Version number of the traffic policy. This value is automatically incremented by AWS after each update of this resource.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Route53 Traffic Policy using the `id` and `version`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Route53 Traffic Policy using the `id` and `version`. For example:
+
+```console
+% terraform import aws_route53_traffic_policy.example 01a52019-d16f-422a-ae72-c306d2b6df7e/1
+```
+
+<!-- cache-key: cdktf-0.18.0 input-b96db7d2de859a1798fa4d7060a0fcce7e3e2591a6bc52e84df625b66db068e3 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/route53_traffic_policy_instance.html.markdown b/website/docs/cdktf/python/r/route53_traffic_policy_instance.html.markdown
new file mode 100644
index 00000000000..1a07f27fff5
--- /dev/null
+++ b/website/docs/cdktf/python/r/route53_traffic_policy_instance.html.markdown
@@ -0,0 +1,73 @@
+---
+subcategory: "Route 53"
+layout: "aws"
+page_title: "AWS: aws_route53_traffic_policy_instance"
+description: |-
+    Provides a Route53 traffic policy instance resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_route53_traffic_policy_instance
+
+Provides a Route53 traffic policy instance resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.route53_traffic_policy_instance import Route53TrafficPolicyInstance
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Route53TrafficPolicyInstance(self, "test",
+            hosted_zone_id="Z033120931TAQO548OGJC",
+            name="test.example.com",
+            traffic_policy_id="b3gb108f-ea6f-45a5-baab-9d112d8b4037",
+            traffic_policy_version=1,
+            ttl=360
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) Domain name for which Amazon Route 53 responds to DNS queries by using the resource record sets that Route 53 creates for this traffic policy instance.
+* `traffic_policy_id` - (Required) ID of the traffic policy that you want to use to create resource record sets in the specified hosted zone.
+* `traffic_policy_version` - (Required) Version of the traffic policy
+* `hosted_zone_id` - (Required) ID of the hosted zone that you want Amazon Route 53 to create resource record sets in by using the configuration in a traffic policy.
+* `ttl` - (Required) TTL that you want Amazon Route 53 to assign to all the resource record sets that it creates in the specified hosted zone.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - ID of traffic policy instance.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Route53 traffic policy instance using its id. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Route53 traffic policy instance using its id. For example:
+
+```console
+% terraform import aws_route53_traffic_policy_instance.test df579d9a-6396-410e-ac22-e7ad60cf9e7e
+```
+
+<!-- cache-key: cdktf-0.18.0 input-d3c778104dc6693266cba8a3fa2a37e8caea6700bf6cf446a41a6e4012311f41 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/route53_vpc_association_authorization.html.markdown b/website/docs/cdktf/python/r/route53_vpc_association_authorization.html.markdown
new file mode 100644
index 00000000000..f93917d97e2
--- /dev/null
+++ b/website/docs/cdktf/python/r/route53_vpc_association_authorization.html.markdown
@@ -0,0 +1,110 @@
+---
+subcategory: "Route 53"
+layout: "aws"
+page_title: "AWS: aws_route53_vpc_association_authorization"
+description: |-
+  Authorizes a VPC in a different account to be associated with a local Route53 Hosted Zone
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_route53_vpc_association_authorization
+
+Authorizes a VPC in a different account to be associated with a local Route53 Hosted Zone.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from cdktf import TerraformResourceLifecycle
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.provider import AwsProvider
+from imports.aws.route53_vpc_association_authorization import Route53VpcAssociationAuthorization
+from imports.aws.route53_zone import Route53Zone
+from imports.aws.route53_zone_association import Route53ZoneAssociation
+from imports.aws.vpc import Vpc
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AwsProvider(self, "aws")
+        alternate = AwsProvider(self, "aws_1",
+            alias="alternate"
+        )
+        aws_vpc_alternate = Vpc(self, "alternate",
+            cidr_block="10.7.0.0/16",
+            enable_dns_hostnames=True,
+            enable_dns_support=True,
+            provider=alternate
+        )
+        example = Vpc(self, "example",
+            cidr_block="10.6.0.0/16",
+            enable_dns_hostnames=True,
+            enable_dns_support=True
+        )
+        aws_route53_zone_example = Route53Zone(self, "example_4",
+            lifecycle=TerraformResourceLifecycle(
+                ignore_changes=[vpc]
+            ),
+            name="example.com",
+            vpc=[Route53ZoneVpc(
+                vpc_id=example.id
+            )
+            ]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_route53_zone_example.override_logical_id("example")
+        aws_route53_vpc_association_authorization_example =
+        Route53VpcAssociationAuthorization(self, "example_5",
+            vpc_id=Token.as_string(aws_vpc_alternate.id),
+            zone_id=Token.as_string(aws_route53_zone_example.id)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_route53_vpc_association_authorization_example.override_logical_id("example")
+        aws_route53_zone_association_example = Route53ZoneAssociation(self, "example_6",
+            provider=alternate,
+            vpc_id=Token.as_string(aws_route53_vpc_association_authorization_example.vpc_id),
+            zone_id=Token.as_string(aws_route53_vpc_association_authorization_example.zone_id)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_route53_zone_association_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `zone_id` - (Required) The ID of the private hosted zone that you want to authorize associating a VPC with.
+* `vpc_id` - (Required) The VPC to authorize for association with the private hosted zone.
+* `vpc_region` - (Optional) The VPC's region. Defaults to the region of the AWS provider.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The calculated unique identifier for the association.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Route 53 VPC Association Authorizations using the Hosted Zone ID and VPC ID, separated by a colon (`:`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Route 53 VPC Association Authorizations using the Hosted Zone ID and VPC ID, separated by a colon (`:`). For example:
+
+```console
+% terraform import aws_route53_vpc_association_authorization.example Z123456ABCDEFG:vpc-12345678
+```
+
+<!-- cache-key: cdktf-0.18.0 input-5538910c15da1bdf9d215131a092f3a81fc71383f121c9a24ab62a7757345a40 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/route53_zone.html.markdown b/website/docs/cdktf/python/r/route53_zone.html.markdown
new file mode 100644
index 00000000000..dccb8386ed3
--- /dev/null
+++ b/website/docs/cdktf/python/r/route53_zone.html.markdown
@@ -0,0 +1,146 @@
+---
+subcategory: "Route 53"
+layout: "aws"
+page_title: "AWS: aws_route53_zone"
+description: |-
+  Manages a Route53 Hosted Zone
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_route53_zone
+
+Manages a Route53 Hosted Zone. For managing Domain Name System Security Extensions (DNSSEC), see the [`aws_route53_key_signing_key`](route53_key_signing_key.html) and [`aws_route53_hosted_zone_dnssec`](route53_hosted_zone_dnssec.html) resources.
+
+## Example Usage
+
+### Public Zone
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.route53_zone import Route53Zone
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Route53Zone(self, "primary",
+            name="example.com"
+        )
+```
+
+### Public Subdomain Zone
+
+For use in subdomains, note that you need to create a
+`aws_route53_record` of type `NS` as well as the subdomain
+zone.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.route53_record import Route53Record
+from imports.aws.route53_zone import Route53Zone
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        dev = Route53Zone(self, "dev",
+            name="dev.example.com",
+            tags={
+                "Environment": "dev"
+            }
+        )
+        main = Route53Zone(self, "main",
+            name="example.com"
+        )
+        Route53Record(self, "dev-ns",
+            name="dev.example.com",
+            records=Token.as_list(dev.name_servers),
+            ttl=Token.as_number("30"),
+            type="NS",
+            zone_id=main.zone_id
+        )
+```
+
+### Private Zone
+
+~> **NOTE:** Terraform provides both exclusive VPC associations defined in-line in this resource via `vpc` configuration blocks and a separate [Zone VPC Association](/docs/providers/aws/r/route53_zone_association.html) resource. At this time, you cannot use in-line VPC associations in conjunction with any `aws_route53_zone_association` resources with the same zone ID otherwise it will cause a perpetual difference in plan output. You can optionally use the generic Terraform resource [lifecycle configuration block](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html) with `ignore_changes` to manage additional associations via the `aws_route53_zone_association` resource.
+
+~> **NOTE:** Private zones require at least one VPC association at all times.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.route53_zone import Route53Zone
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Route53Zone(self, "private",
+            name="example.com",
+            vpc=[Route53ZoneVpc(
+                vpc_id=example.id
+            )
+            ]
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) This is the name of the hosted zone.
+* `comment` - (Optional) A comment for the hosted zone. Defaults to 'Managed by Terraform'.
+* `delegation_set_id` - (Optional) The ID of the reusable delegation set whose NS records you want to assign to the hosted zone. Conflicts with `vpc` as delegation sets can only be used for public zones.
+* `force_destroy` - (Optional) Whether to destroy all records (possibly managed outside of Terraform) in the zone when destroying the zone.
+* `tags` - (Optional) A map of tags to assign to the zone. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `vpc` - (Optional) Configuration block(s) specifying VPC(s) to associate with a private hosted zone. Conflicts with the `delegation_set_id` argument in this resource and any [`aws_route53_zone_association` resource](/docs/providers/aws/r/route53_zone_association.html) specifying the same zone ID. Detailed below.
+
+### vpc Argument Reference
+
+* `vpc_id` - (Required) ID of the VPC to associate.
+* `vpc_region` - (Optional) Region of the VPC to associate. Defaults to AWS provider region.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the Hosted Zone.
+* `zone_id` - The Hosted Zone ID. This can be referenced by zone records.
+* `name_servers` - A list of name servers in associated (or default) delegation set.
+  Find more about delegation sets in [AWS docs](https://docs.aws.amazon.com/Route53/latest/APIReference/actions-on-reusable-delegation-sets.html).
+* `primary_name_server` - The Route 53 name server that created the SOA record.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Route53 Zones using the zone `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Route53 Zones using the zone `id`. For example:
+
+```console
+% terraform import aws_route53_zone.myzone Z1D633PJN98FT9
+```
+
+<!-- cache-key: cdktf-0.18.0 input-8a7477da45196901e3ea8ac68ebc92bd2954c60b50b24acf390c93289191b92e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/route53_zone_association.html.markdown b/website/docs/cdktf/python/r/route53_zone_association.html.markdown
new file mode 100644
index 00000000000..a4a7a50f06a
--- /dev/null
+++ b/website/docs/cdktf/python/r/route53_zone_association.html.markdown
@@ -0,0 +1,119 @@
+---
+subcategory: "Route 53"
+layout: "aws"
+page_title: "AWS: aws_route53_zone_association"
+description: |-
+  Manages a Route53 Hosted Zone VPC association
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_route53_zone_association
+
+Manages a Route53 Hosted Zone VPC association. VPC associations can only be made on private zones. See the [`aws_route53_vpc_association_authorization` resource](route53_vpc_association_authorization.html) for setting up cross-account associations.
+
+~> **NOTE:** Unless explicit association ordering is required (e.g., a separate cross-account association authorization), usage of this resource is not recommended. Use the `vpc` configuration blocks available within the [`aws_route53_zone` resource](/docs/providers/aws/r/route53_zone.html) instead.
+
+~> **NOTE:** Terraform provides both this standalone Zone VPC Association resource and exclusive VPC associations defined in-line in the [`aws_route53_zone` resource](/docs/providers/aws/r/route53_zone.html) via `vpc` configuration blocks. At this time, you cannot use those in-line VPC associations in conjunction with this resource and the same zone ID otherwise it will cause a perpetual difference in plan output. You can optionally use the generic Terraform resource [lifecycle configuration block](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html) with `ignore_changes` in the `aws_route53_zone` resource to manage additional associations via this resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from cdktf import TerraformResourceLifecycle
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.route53_zone import Route53Zone
+from imports.aws.route53_zone_association import Route53ZoneAssociation
+from imports.aws.vpc import Vpc
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        primary = Vpc(self, "primary",
+            cidr_block="10.6.0.0/16",
+            enable_dns_hostnames=True,
+            enable_dns_support=True
+        )
+        secondary = Vpc(self, "secondary",
+            cidr_block="10.7.0.0/16",
+            enable_dns_hostnames=True,
+            enable_dns_support=True
+        )
+        example = Route53Zone(self, "example",
+            lifecycle=TerraformResourceLifecycle(
+                ignore_changes=[vpc]
+            ),
+            name="example.com",
+            vpc=[Route53ZoneVpc(
+                vpc_id=primary.id
+            )
+            ]
+        )
+        aws_route53_zone_association_secondary = Route53ZoneAssociation(self, "secondary_3",
+            vpc_id=secondary.id,
+            zone_id=example.zone_id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_route53_zone_association_secondary.override_logical_id("secondary")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `zone_id` - (Required) The private hosted zone to associate.
+* `vpc_id` - (Required) The VPC to associate with the private hosted zone.
+* `vpc_region` - (Optional) The VPC's region. Defaults to the region of the AWS provider.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The calculated unique identifier for the association.
+* `owning_account` - The account ID of the account that created the hosted zone.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Route 53 Hosted Zone Associations using the Hosted Zone ID and VPC ID, separated by a colon (`:`). For example:
+
+The VPC is in the same region where you have configured the Terraform AWS Provider:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+The VPC is _not_ in the same region where you have configured the Terraform AWS Provider:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+**Using `terraform import` to import** Route 53 Hosted Zone Associations using the Hosted Zone ID and VPC ID, separated by a colon (`:`). For example:
+
+The VPC is in the same region where you have configured the Terraform AWS Provider:
+
+```console
+% terraform import aws_route53_zone_association.example Z123456ABCDEFG:vpc-12345678
+```
+
+The VPC is _not_ in the same region where you have configured the Terraform AWS Provider:
+
+```console
+% terraform import aws_route53_zone_association.example Z123456ABCDEFG:vpc-12345678:us-east-2
+```
+
+<!-- cache-key: cdktf-0.18.0 input-062f0d7494a763d26f38527047af28c7a1a99d322901f96a55935e7336484f49 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/route53domains_registered_domain.html.markdown b/website/docs/cdktf/python/r/route53domains_registered_domain.html.markdown
new file mode 100644
index 00000000000..819170d28a3
--- /dev/null
+++ b/website/docs/cdktf/python/r/route53domains_registered_domain.html.markdown
@@ -0,0 +1,111 @@
+---
+subcategory: "Route 53 Domains"
+layout: "aws"
+page_title: "AWS: aws_route53domains_registered_domain"
+description: |-
+  Provides a resource to manage a domain that has been registered and associated with the current AWS account.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_route53domains_registered_domain
+
+Provides a resource to manage a domain that has been [registered](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/registrar-tld-list.html) and associated with the current AWS account.
+
+**This is an advanced resource** and has special caveats to be aware of when using it. Please read this document in its entirety before using this resource.
+
+The `aws_route53domains_registered_domain` resource behaves differently from normal resources in that if a domain has been registered, Terraform does not _register_ this domain, but instead "adopts" it into management. `terraform destroy` does not delete the domain but does remove the resource from Terraform state.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.route53_domains_registered_domain import Route53DomainsRegisteredDomain
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Route53DomainsRegisteredDomain(self, "example",
+            domain_name="example.com",
+            name_server=[{
+                "name": "ns-195.awsdns-24.com"
+            }, {
+                "name": "ns-874.awsdns-45.net"
+            }
+            ],
+            tags={
+                "Environment": "test"
+            }
+        )
+```
+
+## Argument Reference
+
+~> **NOTE:** You must specify the same privacy setting for `admin_privacy`, `registrant_privacy` and `tech_privacy`.
+
+This argument supports the following arguments:
+
+* `admin_contact` - (Optional) Details about the domain administrative contact.
+* `admin_privacy` - (Optional) Whether domain administrative contact information is concealed from WHOIS queries. Default: `true`.
+* `auto_renew` - (Optional) Whether the domain registration is set to renew automatically. Default: `true`.
+* `domain_name` - (Required) The name of the registered domain.
+* `name_server` - (Optional) The list of nameservers for the domain.
+* `registrant_contact` - (Optional) Details about the domain registrant.
+* `registrant_privacy` - (Optional) Whether domain registrant contact information is concealed from WHOIS queries. Default: `true`.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `tech_contact` - (Optional) Details about the domain technical contact.
+* `tech_privacy` - (Optional) Whether domain technical contact information is concealed from WHOIS queries. Default: `true`.
+* `transfer_lock` - (Optional) Whether the domain is locked for transfer. Default: `true`.
+
+The `admin_contact`, `registrant_contact` and `tech_contact` objects support the following:
+
+* `address_line_1` - (Optional) First line of the contact's address.
+* `address_line_2` - (Optional) Second line of contact's address, if any.
+* `city` - (Optional) The city of the contact's address.
+* `contact_type` - (Optional) Indicates whether the contact is a person, company, association, or public organization. See the [AWS API documentation](https://docs.aws.amazon.com/Route53/latest/APIReference/API_domains_ContactDetail.html#Route53Domains-Type-domains_ContactDetail-ContactType) for valid values.
+* `country_code` - (Optional) Code for the country of the contact's address. See the [AWS API documentation](https://docs.aws.amazon.com/Route53/latest/APIReference/API_domains_ContactDetail.html#Route53Domains-Type-domains_ContactDetail-CountryCode) for valid values.
+* `email` - (Optional) Email address of the contact.
+* `extra_params` - (Optional) A key-value map of parameters required by certain top-level domains.
+* `fax` - (Optional) Fax number of the contact. Phone number must be specified in the format "+[country dialing code].[number including any area code]".
+* `first_name` - (Optional) First name of contact.
+* `last_name` - (Optional) Last name of contact.
+* `organization_name` - (Optional) Name of the organization for contact types other than `PERSON`.
+* `phone_number` - (Optional) The phone number of the contact. Phone number must be specified in the format "+[country dialing code].[number including any area code]".
+* `state` - (Optional) The state or province of the contact's city.
+* `zip_code` - (Optional) The zip or postal code of the contact's address.
+
+The `name_server` object supports the following:
+
+* `glue_ips` - (Optional) Glue IP addresses of a name server. The list can contain only one IPv4 and one IPv6 address.
+* `name` - (Required) The fully qualified host name of the name server.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The domain name.
+* `abuse_contact_email` - Email address to contact to report incorrect contact information for a domain, to report that the domain is being used to send spam, to report that someone is cybersquatting on a domain name, or report some other type of abuse.
+* `abuse_contact_phone` - Phone number for reporting abuse.
+* `creation_date` - The date when the domain was created as found in the response to a WHOIS query.
+* `expiration_date` - The date when the registration for the domain is set to expire.
+* `registrar_name` - Name of the registrar of the domain as identified in the registry.
+* `registrar_url` - Web address of the registrar.
+* `reseller` - Reseller of the domain.
+* `status_list` - List of [domain name status codes](https://www.icann.org/resources/pages/epp-status-codes-2014-06-16-en).
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `updated_date` - The last updated date of the domain as found in the response to a WHOIS query.
+* `whois_server` - The fully qualified name of the WHOIS server that can answer the WHOIS query for the domain.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `30m`)
+- `update` - (Default `30m`)
+
+<!-- cache-key: cdktf-0.18.0 input-98a8952abfb9875700e225d9486f8339896363be535628d57f8d8ab898718bdc -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/route53recoverycontrolconfig_cluster.html.markdown b/website/docs/cdktf/python/r/route53recoverycontrolconfig_cluster.html.markdown
new file mode 100644
index 00000000000..d1b91540c30
--- /dev/null
+++ b/website/docs/cdktf/python/r/route53recoverycontrolconfig_cluster.html.markdown
@@ -0,0 +1,72 @@
+---
+subcategory: "Route 53 Recovery Control Config"
+layout: "aws"
+page_title: "AWS: aws_route53recoverycontrolconfig_cluster"
+description: |-
+  Provides an AWS Route 53 Recovery Control Config Cluster
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_route53recoverycontrolconfig_cluster
+
+Provides an AWS Route 53 Recovery Control Config Cluster.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.route53_recoverycontrolconfig_cluster import Route53RecoverycontrolconfigCluster
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Route53RecoverycontrolconfigCluster(self, "example",
+            name="georgefitzgerald"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) Unique name describing the cluster.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the cluster
+* `cluster_endpoints` - List of 5 endpoints in 5 regions that can be used to talk to the cluster. See below.
+* `status` - Status of cluster. `PENDING` when it is being created, `PENDING_DELETION` when it is being deleted and `DEPLOYED` otherwise.
+
+### cluster_endpoints
+
+* `endpoint` - Cluster endpoint.
+* `region` - Region of the endpoint.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Route53 Recovery Control Config cluster using the cluster ARN. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Route53 Recovery Control Config cluster using the cluster ARN. For example:
+
+```console
+% terraform import aws_route53recoverycontrolconfig_cluster.mycluster arn:aws:route53-recovery-control::313517334327:cluster/f9ae13be-a11e-4ec7-8522-94a70468e6ea
+```
+
+<!-- cache-key: cdktf-0.18.0 input-4f9ee8256b3a92970727893900eccbfd348f2d0fcefd370211ce5756a28dbab1 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/route53recoverycontrolconfig_control_panel.html.markdown b/website/docs/cdktf/python/r/route53recoverycontrolconfig_control_panel.html.markdown
new file mode 100644
index 00000000000..c8a87302c61
--- /dev/null
+++ b/website/docs/cdktf/python/r/route53recoverycontrolconfig_control_panel.html.markdown
@@ -0,0 +1,70 @@
+---
+subcategory: "Route 53 Recovery Control Config"
+layout: "aws"
+page_title: "AWS: aws_route53recoverycontrolconfig_control_panel"
+description: |-
+  Provides an AWS Route 53 Recovery Control Config Control Panel
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_route53recoverycontrolconfig_control_panel
+
+Provides an AWS Route 53 Recovery Control Config Control Panel.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.route53_recoverycontrolconfig_control_panel import Route53RecoverycontrolconfigControlPanel
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Route53RecoverycontrolconfigControlPanel(self, "example",
+            cluster_arn="arn:aws:route53-recovery-control::123456789012:cluster/8d47920e-d789-437d-803a-2dcc4b204393",
+            name="balmorhea"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `cluster_arn` - (Required) ARN of the cluster in which this control panel will reside.
+* `name` - (Required) Name describing the control panel.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the control panel.
+* `default_control_panel` - Whether a control panel is default.
+* `routing_control_count` - Number routing controls in a control panel.
+* `status` - Status of control panel: `PENDING` when it is being created/updated, `PENDING_DELETION` when it is being deleted, and `DEPLOYED` otherwise.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Route53 Recovery Control Config Control Panel using the control panel arn. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Route53 Recovery Control Config Control Panel using the control panel arn. For example:
+
+```console
+% terraform import aws_route53recoverycontrolconfig_control_panel.mypanel arn:aws:route53-recovery-control::313517334327:controlpanel/1bfba17df8684f5dab0467b71424f7e8
+```
+
+<!-- cache-key: cdktf-0.18.0 input-2684118596a4f1a5ee55c039284d0ef47e9b181e6c6212004319ac88f885b5d3 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/route53recoverycontrolconfig_routing_control.html.markdown b/website/docs/cdktf/python/r/route53recoverycontrolconfig_routing_control.html.markdown
new file mode 100644
index 00000000000..00ad4430809
--- /dev/null
+++ b/website/docs/cdktf/python/r/route53recoverycontrolconfig_routing_control.html.markdown
@@ -0,0 +1,91 @@
+---
+subcategory: "Route 53 Recovery Control Config"
+layout: "aws"
+page_title: "AWS: aws_route53recoverycontrolconfig_routing_control"
+description: |-
+  Provides an AWS Route 53 Recovery Control Config Routing Control
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_route53recoverycontrolconfig_routing_control
+
+Provides an AWS Route 53 Recovery Control Config Routing Control.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.route53_recoverycontrolconfig_routing_control import Route53RecoverycontrolconfigRoutingControl
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Route53RecoverycontrolconfigRoutingControl(self, "example",
+            cluster_arn="arn:aws:route53-recovery-control::881188118811:cluster/8d47920e-d789-437d-803a-2dcc4b204393",
+            name="tinlicker"
+        )
+```
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.route53_recoverycontrolconfig_routing_control import Route53RecoverycontrolconfigRoutingControl
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Route53RecoverycontrolconfigRoutingControl(self, "example",
+            cluster_arn="arn:aws:route53-recovery-control::881188118811:cluster/8d47920e-d789-437d-803a-2dcc4b204393",
+            control_panel_arn="arn:aws:route53-recovery-control::428113431245:controlpanel/abd5fbfc052d4844a082dbf400f61da8",
+            name="thomasoliver"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `cluster_arn` - (Required) ARN of the cluster in which this routing control will reside.
+* `name` - (Required) The name describing the routing control.
+
+The following arguments are optional:
+
+* `control_panel_arn` - (Optional) ARN of the control panel in which this routing control will reside.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the routing control.
+* `status` - Status of routing control. `PENDING` when it is being created/updated, `PENDING_DELETION` when it is being deleted, and `DEPLOYED` otherwise.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Route53 Recovery Control Config Routing Control using the routing control arn. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Route53 Recovery Control Config Routing Control using the routing control arn. For example:
+
+```console
+% terraform import aws_route53recoverycontrolconfig_routing_control.mycontrol arn:aws:route53-recovery-control::313517334327:controlpanel/abd5fbfc052d4844a082dbf400f61da8/routingcontrol/d5d90e587870494b
+```
+
+<!-- cache-key: cdktf-0.18.0 input-44029090e1d737aa2993a65bdf6f51189fa5530e97833ff3676aa4c17b194564 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/route53recoverycontrolconfig_safety_rule.html.markdown b/website/docs/cdktf/python/r/route53recoverycontrolconfig_safety_rule.html.markdown
new file mode 100644
index 00000000000..d8c01c51e4e
--- /dev/null
+++ b/website/docs/cdktf/python/r/route53recoverycontrolconfig_safety_rule.html.markdown
@@ -0,0 +1,121 @@
+---
+subcategory: "Route 53 Recovery Control Config"
+layout: "aws"
+page_title: "AWS: aws_route53recoverycontrolconfig_safety_rule"
+description: |-
+  Provides an AWS Route 53 Recovery Control Config Safety Rule
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_route53recoverycontrolconfig_safety_rule
+
+Provides an AWS Route 53 Recovery Control Config Safety Rule
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.route53_recoverycontrolconfig_safety_rule import Route53RecoverycontrolconfigSafetyRule
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Route53RecoverycontrolconfigSafetyRule(self, "example",
+            asserted_controls=[
+                Token.as_string(aws_route53_recoverycontrolconfig_routing_control_example.arn)
+            ],
+            control_panel_arn="arn:aws:route53-recovery-control::313517334327:controlpanel/abd5fbfc052d4844a082dbf400f61da8",
+            name="daisyguttridge",
+            rule_config={
+                "inverted": False,
+                "threshold": 1,
+                "type": "ATLEAST"
+            },
+            wait_period_ms=5000
+        )
+```
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.route53_recoverycontrolconfig_safety_rule import Route53RecoverycontrolconfigSafetyRule
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Route53RecoverycontrolconfigSafetyRule(self, "example",
+            control_panel_arn="arn:aws:route53-recovery-control::313517334327:controlpanel/abd5fbfc052d4844a082dbf400f61da8",
+            gating_controls=[
+                Token.as_string(aws_route53_recoverycontrolconfig_routing_control_example.arn)
+            ],
+            name="i_o",
+            rule_config={
+                "inverted": False,
+                "threshold": 1,
+                "type": "ATLEAST"
+            },
+            target_controls=[
+                Token.as_string(aws_route53_recoverycontrolconfig_routing_control_example.arn)
+            ],
+            wait_period_ms=5000
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `control_panel_arn` - (Required) ARN of the control panel in which this safety rule will reside.
+* `name` - (Required) Name describing the safety rule.
+* `rule_config` - (Required) Configuration block for safety rule criteria. See below.
+* `wait_period_ms` - (Required) Evaluation period, in milliseconds (ms), during which any request against the target routing controls will fail.
+
+The following arguments are optional:
+
+* `asserted_controls` - (Optional) Routing controls that are part of transactions that are evaluated to determine if a request to change a routing control state is allowed.
+* `gating_controls` - (Optional) Gating controls for the new gating rule. That is, routing controls that are evaluated by the rule configuration that you specify.
+* `target_controls` - (Optional) Routing controls that can only be set or unset if the specified `rule_config` evaluates to true for the specified `gating_controls`.
+
+### rule_config
+
+* `inverted` - (Required) Logical negation of the rule.
+* `threshold` - (Required) Number of controls that must be set when you specify an `ATLEAST` type rule.
+* `type` - (Required) Rule type. Valid values are `ATLEAST`, `AND`, and `OR`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the safety rule.
+* `status` - Status of the safety rule. `PENDING` when it is being created/updated, `PENDING_DELETION` when it is being deleted, and `DEPLOYED` otherwise.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Route53 Recovery Control Config Safety Rule using the safety rule ARN. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Route53 Recovery Control Config Safety Rule using the safety rule ARN. For example:
+
+```console
+% terraform import aws_route53recoverycontrolconfig_safety_rule.myrule arn:aws:route53-recovery-control::313517334327:controlpanel/1bfba17df8684f5dab0467b71424f7e8/safetyrule/3bacc77003364c0f
+```
+
+<!-- cache-key: cdktf-0.18.0 input-7fff1efee90763bc95e5e1aa7048eaa46466d5f09d9ca28fd68052bc48898c54 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/route53recoveryreadiness_cell.html.markdown b/website/docs/cdktf/python/r/route53recoveryreadiness_cell.html.markdown
new file mode 100644
index 00000000000..a5b076cab4c
--- /dev/null
+++ b/website/docs/cdktf/python/r/route53recoveryreadiness_cell.html.markdown
@@ -0,0 +1,78 @@
+---
+subcategory: "Route 53 Recovery Readiness"
+layout: "aws"
+page_title: "AWS: aws_route53recoveryreadiness_cell"
+description: |-
+  Provides an AWS Route 53 Recovery Readiness Cell
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_route53recoveryreadiness_cell
+
+Provides an AWS Route 53 Recovery Readiness Cell.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.route53_recoveryreadiness_cell import Route53RecoveryreadinessCell
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Route53RecoveryreadinessCell(self, "example",
+            cell_name="us-west-2-failover-cell"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `cell_name` - (Required) Unique name describing the cell.
+
+The following arguments are optional:
+
+* `cells` - (Optional) List of cell arns to add as nested fault domains within this cell.
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the cell
+* `parent_readiness_scopes` - List of readiness scopes (recovery groups or cells) that contain this cell.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `delete` - (Default `5m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Route53 Recovery Readiness cells using the cell name. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Route53 Recovery Readiness cells using the cell name. For example:
+
+```console
+% terraform import aws_route53recoveryreadiness_cell.us-west-2-failover-cell us-west-2-failover-cell
+```
+
+<!-- cache-key: cdktf-0.18.0 input-d2ac826652336fbe8c626518574803e2477f46155743addd2076ff30e66c3364 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/route53recoveryreadiness_readiness_check.html.markdown b/website/docs/cdktf/python/r/route53recoveryreadiness_readiness_check.html.markdown
new file mode 100644
index 00000000000..7a55eae637d
--- /dev/null
+++ b/website/docs/cdktf/python/r/route53recoveryreadiness_readiness_check.html.markdown
@@ -0,0 +1,78 @@
+---
+subcategory: "Route 53 Recovery Readiness"
+layout: "aws"
+page_title: "AWS: aws_route53recoveryreadiness_readiness_check"
+description: |-
+  Provides an AWS Route 53 Recovery Readiness Readiness Check
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_route53recoveryreadiness_readiness_check
+
+Provides an AWS Route 53 Recovery Readiness Readiness Check.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.route53_recoveryreadiness_readiness_check import Route53RecoveryreadinessReadinessCheck
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Route53RecoveryreadinessReadinessCheck(self, "example",
+            readiness_check_name=my_cw_alarm_check,
+            resource_set_name=my_cw_alarm_set
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `readiness_check_name` - (Required) Unique name describing the readiness check.
+* `resource_set_name` - (Required) Name describing the resource set that will be monitored for readiness.
+
+The following arguments are optional:
+
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the readiness_check
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `delete` - (Default `5m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Route53 Recovery Readiness readiness checks using the readiness check name. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Route53 Recovery Readiness readiness checks using the readiness check name. For example:
+
+```console
+% terraform import aws_route53recoveryreadiness_readiness_check.my-cw-alarm-check example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-d22917e33ca4565e013cd0a41cc427014bd53fd12e040a9c38042c7bc3197b49 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/route53recoveryreadiness_recovery_group.html.markdown b/website/docs/cdktf/python/r/route53recoveryreadiness_recovery_group.html.markdown
new file mode 100644
index 00000000000..4d06f4480dc
--- /dev/null
+++ b/website/docs/cdktf/python/r/route53recoveryreadiness_recovery_group.html.markdown
@@ -0,0 +1,77 @@
+---
+subcategory: "Route 53 Recovery Readiness"
+layout: "aws"
+page_title: "AWS: aws_route53recoveryreadiness_recovery_group"
+description: |-
+  Provides an AWS Route 53 Recovery Readiness Recovery Group
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_route53recoveryreadiness_recovery_group
+
+Provides an AWS Route 53 Recovery Readiness Recovery Group.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.route53_recoveryreadiness_recovery_group import Route53RecoveryreadinessRecoveryGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Route53RecoveryreadinessRecoveryGroup(self, "example",
+            recovery_group_name="my-high-availability-app"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `recovery_group_name` - (Required) A unique name describing the recovery group.
+
+The following argument are optional:
+
+* `cells` - (Optional) List of cell arns to add as nested fault domains within this recovery group
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the recovery group
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `delete` - (Default `5m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Route53 Recovery Readiness recovery groups using the recovery group name. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Route53 Recovery Readiness recovery groups using the recovery group name. For example:
+
+```console
+% terraform import aws_route53recoveryreadiness_recovery_group.my-high-availability-app my-high-availability-app
+```
+
+<!-- cache-key: cdktf-0.18.0 input-8dde4cc1d205a94cf5f5ad34c54ed11d8cdcf8e43195fafdf486d08bbe56f97b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/route53recoveryreadiness_resource_set.html.markdown b/website/docs/cdktf/python/r/route53recoveryreadiness_resource_set.html.markdown
new file mode 100644
index 00000000000..1cf31461df2
--- /dev/null
+++ b/website/docs/cdktf/python/r/route53recoveryreadiness_resource_set.html.markdown
@@ -0,0 +1,112 @@
+---
+subcategory: "Route 53 Recovery Readiness"
+layout: "aws"
+page_title: "AWS: aws_route53recoveryreadiness_resource_set"
+description: |-
+  Provides an AWS Route 53 Recovery Readiness Resource Set
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_route53recoveryreadiness_resource_set
+
+Provides an AWS Route 53 Recovery Readiness Resource Set.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.route53_recoveryreadiness_resource_set import Route53RecoveryreadinessResourceSet
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Route53RecoveryreadinessResourceSet(self, "example",
+            resource_set_name=my_cw_alarm_set,
+            resource_set_type="AWS::CloudWatch::Alarm",
+            resources=[{
+                "resource_arn": Token.as_string(aws_cloudwatch_metric_alarm_example.arn)
+            }
+            ]
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `resource_set_name` - (Required) Unique name describing the resource set.
+* `resource_set_type` - (Required) Type of the resources in the resource set.
+* `resources` - (Required) List of resources to add to this resource set. See below.
+
+The following arguments are optional:
+
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### resources
+
+* `dns_target_resource` - (Required if `resource_arn` is not set) Component for DNS/Routing Control Readiness Checks.
+* `readiness_scopes` - (Optional) Recovery group ARN or cell ARN that contains this resource set.
+* `resource_arn` - (Required if `dns_target_resource` is not set) ARN of the resource.
+
+### dns_target_resource
+
+* `domain_name` - (Optional) DNS Name that acts as the ingress point to a portion of application.
+* `hosted_zone_arn` - (Optional) Hosted Zone ARN that contains the DNS record with the provided name of target resource.
+* `record_set_id` - (Optional) Route53 record set id to uniquely identify a record given a `domain_name` and a `record_type`.
+* `record_type` - (Optional) Type of DNS Record of target resource.
+* `target_resource` - (Optional) Target resource the R53 record specified with the above params points to.
+
+### target_resource
+
+* `nlb_resource` - (Optional) NLB resource a DNS Target Resource points to. Required if `r53_resource` is not set.
+* `r53_resource` - (Optional) Route53 resource a DNS Target Resource record points to.
+
+### nlb_resource
+
+* `arn` - (Required) NLB resource ARN.
+
+### r53_resource
+
+* `domain_name` - (Optional) Domain name that is targeted.
+* `record_set_id` - (Optional) Resource record set ID that is targeted.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the resource set
+* `resources.#.component_id` - Unique identified for DNS Target Resources, use for readiness checks.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `delete` - (Default `5m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Route53 Recovery Readiness resource set name using the resource set name. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Route53 Recovery Readiness resource set name using the resource set name. For example:
+
+```console
+% terraform import aws_route53recoveryreadiness_resource_set.my-cw-alarm-set example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-3088ad6ae6c23ba549c55a78d09934efb83080fc584e0fbb75e37b7be8ec0715 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/route_table.html.markdown b/website/docs/cdktf/python/r/route_table.html.markdown
new file mode 100644
index 00000000000..71ba3439bdf
--- /dev/null
+++ b/website/docs/cdktf/python/r/route_table.html.markdown
@@ -0,0 +1,242 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_route_table"
+description: |-
+  Provides a resource to create a VPC routing table.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_route_table
+
+Provides a resource to create a VPC routing table.
+
+~> **NOTE on Route Tables and Routes:** Terraform currently
+provides both a standalone [Route resource](route.html) and a Route Table resource with routes
+defined in-line. At this time you cannot use a Route Table with in-line routes
+in conjunction with any Route resources. Doing so will cause
+a conflict of rule settings and will overwrite rules.
+
+~> **NOTE on `gateway_id` and `nat_gateway_id`:** The AWS API is very forgiving with these two
+attributes and the `aws_route_table` resource can be created with a NAT ID specified as a Gateway ID attribute.
+This _will_ lead to a permanent diff between your configuration and statefile, as the API returns the correct
+parameters in the returned route table. If you're experiencing constant diffs in your `aws_route_table` resources,
+the first thing to check is whether or not you're specifying a NAT ID instead of a Gateway ID, or vice-versa.
+
+~> **NOTE on `propagating_vgws` and the `aws_vpn_gateway_route_propagation` resource:**
+If the `propagating_vgws` argument is present, it's not supported to _also_
+define route propagations using `aws_vpn_gateway_route_propagation`, since
+this resource will delete any propagating gateways not explicitly listed in
+`propagating_vgws`. Omit this argument when defining route propagation using
+the separate resource.
+
+## Example Usage
+
+### Basic example
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.route_table import RouteTable
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        RouteTable(self, "example",
+            route=[RouteTableRoute(
+                cidr_block="10.0.1.0/24",
+                gateway_id=Token.as_string(aws_internet_gateway_example.id)
+            ), RouteTableRoute(
+                egress_only_gateway_id=Token.as_string(aws_egress_only_internet_gateway_example.id),
+                ipv6_cidr_block="::/0"
+            )
+            ],
+            tags={
+                "Name": "example"
+            },
+            vpc_id=Token.as_string(aws_vpc_example.id)
+        )
+```
+
+To subsequently remove all managed routes:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.route_table import RouteTable
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        RouteTable(self, "example",
+            route=[],
+            tags={
+                "Name": "example"
+            },
+            vpc_id=Token.as_string(aws_vpc_example.id)
+        )
+```
+
+### Adopting an existing local route
+
+AWS creates certain routes that the AWS provider mostly ignores. You can manage them by importing or adopting them. See [Import](#import) below for information on importing. This example shows adopting a route and then updating its target.
+
+First, adopt an existing AWS-created route:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.route_table import RouteTable
+from imports.aws.vpc import Vpc
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        test = Vpc(self, "test",
+            cidr_block="10.1.0.0/16"
+        )
+        aws_route_table_test = RouteTable(self, "test_1",
+            route=[RouteTableRoute(
+                cidr_block="10.1.0.0/16",
+                gateway_id="local"
+            )
+            ],
+            vpc_id=test.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_route_table_test.override_logical_id("test")
+```
+
+Next, update the target of the route:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.network_interface import NetworkInterface
+from imports.aws.route_table import RouteTable
+from imports.aws.subnet import Subnet
+from imports.aws.vpc import Vpc
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        test = Vpc(self, "test",
+            cidr_block="10.1.0.0/16"
+        )
+        aws_subnet_test = Subnet(self, "test_1",
+            cidr_block="10.1.1.0/24",
+            vpc_id=test.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_subnet_test.override_logical_id("test")
+        aws_network_interface_test = NetworkInterface(self, "test_2",
+            subnet_id=Token.as_string(aws_subnet_test.id)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_network_interface_test.override_logical_id("test")
+        aws_route_table_test = RouteTable(self, "test_3",
+            route=[RouteTableRoute(
+                cidr_block=test.cidr_block,
+                network_interface_id=Token.as_string(aws_network_interface_test.id)
+            )
+            ],
+            vpc_id=test.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_route_table_test.override_logical_id("test")
+```
+
+The target could then be updated again back to `local`.
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `vpc_id` - (Required) The VPC ID.
+* `route` - (Optional) A list of route objects. Their keys are documented below. This argument is processed in [attribute-as-blocks mode](https://www.terraform.io/docs/configuration/attr-as-blocks.html).
+This means that omitting this argument is interpreted as ignoring any existing routes. To remove all managed routes an empty list should be specified. See the example above.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `propagating_vgws` - (Optional) A list of virtual gateways for propagation.
+
+### route Argument Reference
+
+This argument is processed in [attribute-as-blocks mode](https://www.terraform.io/docs/configuration/attr-as-blocks.html).
+
+One of the following destination arguments must be supplied:
+
+* `cidr_block` - (Required) The CIDR block of the route.
+* `ipv6_cidr_block` - (Optional) The Ipv6 CIDR block of the route.
+* `destination_prefix_list_id` - (Optional) The ID of a [managed prefix list](ec2_managed_prefix_list.html) destination of the route.
+
+One of the following target arguments must be supplied:
+
+* `carrier_gateway_id` - (Optional) Identifier of a carrier gateway. This attribute can only be used when the VPC contains a subnet which is associated with a Wavelength Zone.
+* `core_network_arn` - (Optional) The Amazon Resource Name (ARN) of a core network.
+* `egress_only_gateway_id` - (Optional) Identifier of a VPC Egress Only Internet Gateway.
+* `gateway_id` - (Optional) Identifier of a VPC internet gateway, virtual private gateway, or `local`. `local` routes cannot be created but can be adopted or imported. See the [example](#adopting-an-existing-local-route) above.
+* `local_gateway_id` - (Optional) Identifier of a Outpost local gateway.
+* `nat_gateway_id` - (Optional) Identifier of a VPC NAT gateway.
+* `network_interface_id` - (Optional) Identifier of an EC2 network interface.
+* `transit_gateway_id` - (Optional) Identifier of an EC2 Transit Gateway.
+* `vpc_endpoint_id` - (Optional) Identifier of a VPC Endpoint.
+* `vpc_peering_connection_id` - (Optional) Identifier of a VPC peering connection.
+
+Note that the default route, mapping the VPC's CIDR block to "local", is created implicitly and cannot be specified.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+~> **NOTE:** Only the target that is entered is exported as a readable
+attribute once the route resource is created.
+
+* `id` - The ID of the routing table.
+* `arn` - The ARN of the route table.
+* `owner_id` - The ID of the AWS account that owns the route table.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `5m`)
+- `update` - (Default `2m`)
+- `delete` - (Default `5m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Route Tables using the route table `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Route Tables using the route table `id`. For example:
+
+```console
+% terraform import aws_route_table.public_rt rtb-4e616f6d69
+```
+
+<!-- cache-key: cdktf-0.18.0 input-d300bb2babcdde7f3a257080c421d049a58a89200afecf3485288c3ad0d30c6d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/route_table_association.html.markdown b/website/docs/cdktf/python/r/route_table_association.html.markdown
new file mode 100644
index 00000000000..bb20de9a98d
--- /dev/null
+++ b/website/docs/cdktf/python/r/route_table_association.html.markdown
@@ -0,0 +1,120 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_route_table_association"
+description: |-
+  Provides a resource to create an association between a route table and a subnet or a route table and an internet gateway or virtual private gateway.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_route_table_association
+
+Provides a resource to create an association between a route table and a subnet or a route table and an
+internet gateway or virtual private gateway.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.route_table_association import RouteTableAssociation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        RouteTableAssociation(self, "a",
+            route_table_id=bar.id,
+            subnet_id=foo.id
+        )
+```
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.route_table_association import RouteTableAssociation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        RouteTableAssociation(self, "b",
+            gateway_id=foo.id,
+            route_table_id=bar.id
+        )
+```
+
+## Argument Reference
+
+~> **NOTE:** Please note that one of either `subnet_id` or `gateway_id` is required.
+
+This argument supports the following arguments:
+
+* `subnet_id` - (Optional) The subnet ID to create an association. Conflicts with `gateway_id`.
+* `gateway_id` - (Optional) The gateway ID to create an association. Conflicts with `subnet_id`.
+* `route_table_id` - (Required) The ID of the routing table to associate with.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the association
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `5m`)
+- `update` - (Default `2m`)
+- `delete` - (Default `5m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EC2 Route Table Associations using the associated resource ID and Route Table ID separated by a forward slash (`/`). For example:
+
+~> **NOTE:** Attempting to associate a route table with a subnet or gateway, where either is already associated, will result in an error (e.g., `Resource.AlreadyAssociated: the specified association for route table rtb-4176657279 conflicts with an existing association`) unless you first import the original association.
+
+With EC2 Subnets:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+With EC2 Internet Gateways:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+**Using `terraform import` to import** EC2 Route Table Associations using the associated resource ID and Route Table ID separated by a forward slash (`/`). For example:
+
+With EC2 Subnets:
+
+```console
+% terraform import aws_route_table_association.assoc subnet-6777656e646f6c796e/rtb-656c65616e6f72
+```
+
+With EC2 Internet Gateways:
+
+```console
+% terraform import aws_route_table_association.assoc igw-01b3a60780f8d034a/rtb-656c65616e6f72
+```
+
+<!-- cache-key: cdktf-0.18.0 input-4552818b4878e80d058998466d30965c95d752e528e046f4f7a9999a8dfcb719 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/rum_app_monitor.html.markdown b/website/docs/cdktf/python/r/rum_app_monitor.html.markdown
new file mode 100644
index 00000000000..dacdbc0483e
--- /dev/null
+++ b/website/docs/cdktf/python/r/rum_app_monitor.html.markdown
@@ -0,0 +1,91 @@
+---
+subcategory: "CloudWatch RUM"
+layout: "aws"
+page_title: "AWS: aws_rum_app_monitor"
+description: |-
+  Provides a CloudWatch RUM App Monitor resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_rum_app_monitor
+
+Provides a CloudWatch RUM App Monitor resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.rum_app_monitor import RumAppMonitor
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        RumAppMonitor(self, "example",
+            domain="localhost",
+            name="example"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the log stream.
+* `domain` - (Required) The top-level internet domain name for which your application has administrative authority.
+* `app_monitor_configuration` - (Optional) configuration data for the app monitor. See [app_monitor_configuration](#app_monitor_configuration) below.
+* `cw_log_enabled` - (Optional) Data collected by RUM is kept by RUM for 30 days and then deleted. This parameter  specifies whether RUM sends a copy of this telemetry data to Amazon CloudWatch Logs in your account. This enables you to keep the telemetry data for more than 30 days, but it does incur Amazon CloudWatch Logs charges. Default value is `false`.
+* `custom_events` - (Optional) Specifies whether this app monitor allows the web client to define and send custom events. If you omit this parameter, custom events are `DISABLED`. See [custom_events](#custom_events) below.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### app_monitor_configuration
+
+* `allow_cookies` - (Optional) If you set this to `true`, RUM web client sets two cookies, a session cookie  and a user cookie. The cookies allow the RUM web client to collect data relating to the number of users an application has and the behavior of the application across a sequence of events. Cookies are stored in the top-level domain of the current page.
+* `enable_xray` - (Optional) If you set this to `true`, RUM enables X-Ray tracing for the user sessions  that RUM samples. RUM adds an X-Ray trace header to allowed HTTP requests. It also records an X-Ray segment for allowed HTTP requests.
+* `excluded_pages` - (Optional) A list of URLs in your website or application to exclude from RUM data collection.
+* `favorite_pages` - (Optional) A list of pages in the CloudWatch RUM console that are to be displayed with a "favorite" icon.
+* `guest_role_arn` - (Optional) The ARN of the guest IAM role that is attached to the Amazon Cognito identity pool that is used to authorize the sending of data to RUM.
+* `identity_pool_id` - (Optional) The ID of the Amazon Cognito identity pool that is used to authorize the sending of data to RUM.
+* `included_pages` - (Optional)  If this app monitor is to collect data from only certain pages in your application, this structure lists those pages.
+* `session_sample_rate` - (Optional) Specifies the percentage of user sessions to use for RUM data collection. Choosing a higher percentage gives you more data but also incurs more costs. The number you specify is the percentage of user sessions that will be used. Default value is `0.1`.
+* `telemetries` - (Optional) An array that lists the types of telemetry data that this app monitor is to collect. Valid values are `errors`, `performance`, and `http`.
+
+### custom_events
+
+* `status` - (Optional) Specifies whether this app monitor allows the web client to define and send custom events. The default is for custom events to be `DISABLED`. Valid values are `DISABLED` and `ENABLED`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) specifying the app monitor.
+* `id` - The CloudWatch RUM name as it is the identifier of a RUM.
+* `app_monitor_id` - The unique ID of the app monitor. Useful for JS templates.
+* `cw_log_group` - The name of the log group where the copies are stored.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Cloudwatch RUM App Monitor using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Cloudwatch RUM App Monitor using the `name`. For example:
+
+```console
+% terraform import aws_rum_app_monitor.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-b381cc3a01207454edb5a73b4ffe67c1902d1625465d5195b0a31d7bc968ed4e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/rum_metrics_destination.html.markdown b/website/docs/cdktf/python/r/rum_metrics_destination.html.markdown
new file mode 100644
index 00000000000..c5c369758bb
--- /dev/null
+++ b/website/docs/cdktf/python/r/rum_metrics_destination.html.markdown
@@ -0,0 +1,69 @@
+---
+subcategory: "CloudWatch RUM"
+layout: "aws"
+page_title: "AWS: aws_rum_metrics_destination"
+description: |-
+  Provides a CloudWatch RUM Metrics Destination resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_rum_metrics_destination
+
+Provides a CloudWatch RUM Metrics Destination resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.rum_metrics_destination import RumMetricsDestination
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        RumMetricsDestination(self, "example",
+            app_monitor_name=Token.as_string(aws_rum_app_monitor_example.name),
+            destination="CloudWatch"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `app_monitor_name` - (Required) The name of the CloudWatch RUM app monitor that will send the metrics.
+* `destination` - (Required)  Defines the destination to send the metrics to. Valid values are `CloudWatch` and `Evidently`. If you specify `Evidently`, you must also specify the ARN of the CloudWatchEvidently experiment that is to be the destination and an IAM role that has permission to write to the experiment.
+* `destination_arn` - (Optional) Use this parameter only if Destination is Evidently. This parameter specifies the ARN of the Evidently experiment that will receive the extended metrics.
+* `iam_role_arn` - (Optional) This parameter is required if Destination is Evidently. If Destination is CloudWatch, do not use this parameter.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name of the CloudWatch RUM app monitor that will send the metrics.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Cloudwatch RUM Metrics Destination using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Cloudwatch RUM Metrics Destination using the `id`. For example:
+
+```console
+% terraform import aws_rum_metrics_destination.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-b0a8bc87eed073c64dab3eea6177045d7d17087af1a9092e3e8b592be02eb910 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/s3_access_point.html.markdown b/website/docs/cdktf/python/r/s3_access_point.html.markdown
new file mode 100644
index 00000000000..a400c679659
--- /dev/null
+++ b/website/docs/cdktf/python/r/s3_access_point.html.markdown
@@ -0,0 +1,172 @@
+---
+subcategory: "S3 Control"
+layout: "aws"
+page_title: "AWS: aws_s3_access_point"
+description: |-
+  Manages an S3 Access Point.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_s3_access_point
+
+Provides a resource to manage an S3 Access Point.
+
+~> **NOTE on Access Points and Access Point Policies:** Terraform provides both a standalone [Access Point Policy](s3control_access_point_policy.html) resource and an Access Point resource with a resource policy defined in-line. You cannot use an Access Point with in-line resource policy in conjunction with an Access Point Policy resource. Doing so will cause a conflict of policies and will overwrite the access point's resource policy.
+
+-> Advanced usage: To use a custom API endpoint for this Terraform resource, use the [`s3control` endpoint provider configuration](/docs/providers/aws/index.html#s3control), not the `s3` endpoint provider configuration.
+
+## Example Usage
+
+### AWS Partition Bucket
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_access_point import S3AccessPoint
+from imports.aws.s3_bucket import S3Bucket
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = S3Bucket(self, "example",
+            bucket="example"
+        )
+        aws_s3_access_point_example = S3AccessPoint(self, "example_1",
+            bucket=example.id,
+            name="example"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_access_point_example.override_logical_id("example")
+```
+
+### S3 on Outposts Bucket
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_access_point import S3AccessPoint
+from imports.aws.s3_control_bucket import S3ControlBucket
+from imports.aws.vpc import Vpc
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, outpostId):
+        super().__init__(scope, name)
+        example = S3ControlBucket(self, "example",
+            bucket="example",
+            outpost_id=outpost_id
+        )
+        aws_vpc_example = Vpc(self, "example_1",
+            cidr_block="10.0.0.0/16"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_vpc_example.override_logical_id("example")
+        aws_s3_access_point_example = S3AccessPoint(self, "example_2",
+            bucket=example.arn,
+            name="example",
+            vpc_configuration=S3AccessPointVpcConfiguration(
+                vpc_id=Token.as_string(aws_vpc_example.id)
+            )
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_access_point_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `bucket` - (Required) Name of an AWS Partition S3 Bucket or the ARN of S3 on Outposts Bucket that you want to associate this access point with.
+* `name` - (Required) Name you want to assign to this access point.
+
+The following arguments are optional:
+
+* `account_id` - (Optional) AWS account ID for the owner of the bucket for which you want to create an access point. Defaults to automatically determined account ID of the Terraform AWS provider.
+* `bucket_account_id` - (Optional) AWS account ID associated with the S3 bucket associated with this access point.
+* `policy` - (Optional) Valid JSON document that specifies the policy that you want to apply to this access point. Removing `policy` from your configuration or setting `policy` to null or an empty string (i.e., `policy = ""`) _will not_ delete the policy since it could have been set by `aws_s3control_access_point_policy`. To remove the `policy`, set it to `"{}"` (an empty JSON document).
+* `public_access_block_configuration` - (Optional) Configuration block to manage the `PublicAccessBlock` configuration that you want to apply to this Amazon S3 bucket. You can enable the configuration options in any combination. Detailed below.
+* `vpc_configuration` - (Optional) Configuration block to restrict access to this access point to requests from the specified Virtual Private Cloud (VPC). Required for S3 on Outposts. Detailed below.
+
+### public_access_block_configuration Configuration Block
+
+The following arguments are optional:
+
+* `block_public_acls` - (Optional) Whether Amazon S3 should block public ACLs for buckets in this account. Defaults to `true`. Enabling this setting does not affect existing policies or ACLs. When set to `true` causes the following behavior:
+    * PUT Bucket acl and PUT Object acl calls fail if the specified ACL is public.
+    * PUT Object calls fail if the request includes a public ACL.
+    * PUT Bucket calls fail if the request includes a public ACL.
+* `block_public_policy` - (Optional) Whether Amazon S3 should block public bucket policies for buckets in this account. Defaults to `true`. Enabling this setting does not affect existing bucket policies. When set to `true` causes Amazon S3 to:
+    * Reject calls to PUT Bucket policy if the specified bucket policy allows public access.
+* `ignore_public_acls` - (Optional) Whether Amazon S3 should ignore public ACLs for buckets in this account. Defaults to `true`. Enabling this setting does not affect the persistence of any existing ACLs and doesn't prevent new public ACLs from being set. When set to `true` causes Amazon S3 to:
+    * Ignore all public ACLs on buckets in this account and any objects that they contain.
+* `restrict_public_buckets` - (Optional) Whether Amazon S3 should restrict public bucket policies for buckets in this account. Defaults to `true`. Enabling this setting does not affect previously stored bucket policies, except that public and cross-account access within any public bucket policy, including non-public delegation to specific accounts, is blocked. When set to `true`:
+    * Only the bucket owner and AWS Services can access buckets with public policies.
+
+### vpc_configuration Configuration Block
+
+The following arguments are required:
+
+* `vpc_id` - (Required)  This access point will only allow connections from the specified VPC ID.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `alias` - Alias of the S3 Access Point.
+* `arn` - ARN of the S3 Access Point.
+* `domain_name` - DNS domain name of the S3 Access Point in the format _`name`_-_`account_id`_.s3-accesspoint._region_.amazonaws.com.
+Note: S3 access points only support secure access by HTTPS. HTTP isn't supported.
+* `endpoints` - VPC endpoints for the S3 Access Point.
+* `has_public_access_policy` - Indicates whether this access point currently has a policy that allows public access.
+* `id` - For Access Point of an AWS Partition S3 Bucket, the AWS account ID and access point name separated by a colon (`:`). For S3 on Outposts Bucket, the ARN of the Access Point.
+* `network_origin` - Indicates whether this access point allows access from the public Internet. Values are `VPC` (the access point doesn't allow access from the public Internet) and `Internet` (the access point allows access from the public Internet, subject to the access point and bucket access policies).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import this resource using the `account_id` and `name` separated by a colon (`:`) for Access Points associated with an AWS Partition S3 Bucket or the ARN for Access Points associated with an S3 on Outposts Bucket. For example:
+
+Import using the `account_id` and `name` separated by a colon (`:`) for Access Points associated with an AWS Partition S3 Bucket:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Import using the ARN for Access Points associated with an S3 on Outposts Bucket:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+**Using `terraform import` to import.** For example:
+
+Import using the `account_id` and `name` separated by a colon (`:`) for Access Points associated with an AWS Partition S3 Bucket:
+
+```console
+% terraform import aws_s3_access_point.example 123456789012:example
+```
+
+Import using the ARN for Access Points associated with an S3 on Outposts Bucket:
+
+```console
+% terraform import aws_s3_access_point.example arn:aws:s3-outposts:us-east-1:123456789012:outpost/op-1234567890123456/accesspoint/example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-62226ef5a5030fd4e742702fe5b17f262b9a0edbc8724a758784c5289d1270af -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/s3_account_public_access_block.html.markdown b/website/docs/cdktf/python/r/s3_account_public_access_block.html.markdown
new file mode 100644
index 00000000000..8d4523eda24
--- /dev/null
+++ b/website/docs/cdktf/python/r/s3_account_public_access_block.html.markdown
@@ -0,0 +1,79 @@
+---
+subcategory: "S3 Control"
+layout: "aws"
+page_title: "AWS: aws_s3_account_public_access_block"
+description: |-
+  Manages S3 account-level Public Access Block Configuration
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_s3_account_public_access_block
+
+Manages S3 account-level Public Access Block configuration. For more information about these settings, see the [AWS S3 Block Public Access documentation](https://docs.aws.amazon.com/AmazonS3/latest/dev/access-control-block-public-access.html).
+
+~> **NOTE:** Each AWS account may only have one S3 Public Access Block configuration. Multiple configurations of the resource against the same AWS account will cause a perpetual difference.
+
+-> Advanced usage: To use a custom API endpoint for this Terraform resource, use the [`s3control` endpoint provider configuration](/docs/providers/aws/index.html#s3control), not the `s3` endpoint provider configuration.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_account_public_access_block import S3AccountPublicAccessBlock
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        S3AccountPublicAccessBlock(self, "example",
+            block_public_acls=True,
+            block_public_policy=True
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `account_id` - (Optional) AWS account ID to configure. Defaults to automatically determined account ID of the Terraform AWS provider.
+* `block_public_acls` - (Optional) Whether Amazon S3 should block public ACLs for buckets in this account. Defaults to `false`. Enabling this setting does not affect existing policies or ACLs. When set to `true` causes the following behavior:
+    * PUT Bucket acl and PUT Object acl calls will fail if the specified ACL allows public access.
+    * PUT Object calls fail if the request includes a public ACL.
+* `block_public_policy` - (Optional) Whether Amazon S3 should block public bucket policies for buckets in this account. Defaults to `false`. Enabling this setting does not affect existing bucket policies. When set to `true` causes Amazon S3 to:
+    * Reject calls to PUT Bucket policy if the specified bucket policy allows public access.
+* `ignore_public_acls` - (Optional) Whether Amazon S3 should ignore public ACLs for buckets in this account. Defaults to `false`. Enabling this setting does not affect the persistence of any existing ACLs and doesn't prevent new public ACLs from being set. When set to `true` causes Amazon S3 to:
+    * Ignore all public ACLs on buckets in this account and any objects that they contain.
+* `restrict_public_buckets` - (Optional) Whether Amazon S3 should restrict public bucket policies for buckets in this account. Defaults to `false`. Enabling this setting does not affect previously stored bucket policies, except that public and cross-account access within any public bucket policy, including non-public delegation to specific accounts, is blocked. When set to `true`:
+    * Only the bucket owner and AWS Services can access buckets with public policies.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - AWS account ID
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_s3_account_public_access_block` using the AWS account ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_s3_account_public_access_block` using the AWS account ID. For example:
+
+```console
+% terraform import aws_s3_account_public_access_block.example 123456789012
+```
+
+<!-- cache-key: cdktf-0.18.0 input-0e7f009405cc9f18e00601a618698df4875b5d3f926795da6704f8e3a7160217 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/s3_bucket.html.markdown b/website/docs/cdktf/python/r/s3_bucket.html.markdown
new file mode 100644
index 00000000000..45c2e4ede25
--- /dev/null
+++ b/website/docs/cdktf/python/r/s3_bucket.html.markdown
@@ -0,0 +1,395 @@
+---
+subcategory: "S3 (Simple Storage)"
+layout: "aws"
+page_title: "AWS: aws_s3_bucket"
+description: |-
+  Provides a S3 bucket resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_s3_bucket
+
+Provides a S3 bucket resource.
+
+-> This functionality is for managing S3 in an AWS Partition. To manage [S3 on Outposts](https://docs.aws.amazon.com/AmazonS3/latest/dev/S3onOutposts.html), see the [`aws_s3control_bucket`](/docs/providers/aws/r/s3control_bucket.html) resource.
+
+-> In April 2023, [AWS introduced](https://aws.amazon.com/about-aws/whats-new/2022/12/amazon-s3-automatically-enable-block-public-access-disable-access-control-lists-buckets-april-2023/) updated security defaults for new S3 buckets. See [this issue](https://github.com/hashicorp/terraform-provider-aws/issues/28353) for a information on how this affects the `aws_s3_bucket` resource.
+
+## Example Usage
+
+### Private Bucket With Tags
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        S3Bucket(self, "example",
+            bucket="my-tf-test-bucket",
+            tags={
+                "Environment": "Dev",
+                "Name": "My bucket"
+            }
+        )
+```
+
+### Static Website Hosting
+
+-> **NOTE:** The `website` attribute is deprecated.
+See [`aws_s3_bucket_website_configuration`](s3_bucket_website_configuration.html.markdown) for examples with static website hosting configured.
+
+### CORS Rules
+
+-> **NOTE:** The `cors_rule` attribute is deprecated.
+See [`aws_s3_bucket_cors_configuration`](s3_bucket_cors_configuration.html.markdown) for examples with CORS rules configured.
+
+### Versioning
+
+-> **NOTE:** The `versioning` attribute is deprecated.
+See [`aws_s3_bucket_versioning`](s3_bucket_versioning.html.markdown) for examples with versioning configured.
+
+### Logging
+
+-> **NOTE:** The `logging` attribute is deprecated.
+See [`aws_s3_bucket_logging`](s3_bucket_logging.html.markdown) for examples with logging enabled.
+
+### Object Lifecycle Rules
+
+-> **NOTE:** The `lifecycle_rule` attribute is deprecated.
+See [`aws_s3_bucket_lifecycle_configuration`](s3_bucket_lifecycle_configuration.html.markdown) for examples with object lifecycle rules.
+
+### Object Lock Configuration
+
+-> **NOTE:** The `object_lock_configuration` attribute is deprecated.
+See [`aws_s3_bucket_object_lock_configuration`](s3_bucket_object_lock_configuration.html.markdown) for examples with object lock configurations on both new and existing buckets.
+
+### Replication Configuration
+
+-> **NOTE:** The `replication_configuration` attribute is deprecated.
+See [`aws_s3_bucket_replication_configuration`](s3_bucket_replication_configuration.html.markdown) for examples with replication configured.
+
+### Enable SSE-KMS Server Side Encryption
+
+-> **NOTE:** The `server_side_encryption_configuration` attribute is deprecated.
+See [`aws_s3_bucket_server_side_encryption_configuration`](s3_bucket_server_side_encryption_configuration.html.markdown) for examples with server side encryption configured.
+
+### ACL Policy Grants
+
+-> **NOTE:** The `acl` and `grant` attributes are deprecated.
+See [`aws_s3_bucket_acl`](s3_bucket_acl.html.markdown) for examples with ACL grants.
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `bucket` - (Optional, Forces new resource) Name of the bucket. If omitted, Terraform will assign a random, unique name. Must be lowercase and less than or equal to 63 characters in length. A full list of bucket naming rules [may be found here](https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucketnamingrules.html).
+* `bucket_prefix` - (Optional, Forces new resource) Creates a unique bucket name beginning with the specified prefix. Conflicts with `bucket`. Must be lowercase and less than or equal to 37 characters in length. A full list of bucket naming rules [may be found here](https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucketnamingrules.html).
+* `force_destroy` - (Optional, Default:`false`) Boolean that indicates all objects (including any [locked objects](https://docs.aws.amazon.com/AmazonS3/latest/dev/object-lock-overview.html)) should be deleted from the bucket *when the bucket is destroyed* so that the bucket can be destroyed without error. These objects are *not* recoverable. This only deletes objects when the bucket is destroyed, *not* when setting this parameter to `true`. Once this parameter is set to `true`, there must be a successful `terraform apply` run before a destroy is required to update this value in the resource state. Without a successful `terraform apply` after this parameter is set, this flag will have no effect. If setting this field in the same operation that would require replacing the bucket or destroying the bucket, this flag will not work. Additionally when importing a bucket, a successful `terraform apply` is required to set this value in state before it will take effect on a destroy operation.
+* `object_lock_enabled` - (Optional, Forces new resource) Indicates whether this bucket has an Object Lock configuration enabled. Valid values are `true` or `false`. This argument is not supported in all regions or partitions.
+* `tags` - (Optional) Map of tags to assign to the bucket. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+The following arguments are deprecated, and will be removed in a future major version:
+
+* `acceleration_status` - (Optional, **Deprecated**) Sets the accelerate configuration of an existing bucket. Can be `Enabled` or `Suspended`. Cannot be used in `cn-north-1` or `us-gov-west-1`. Terraform will only perform drift detection if a configuration value is provided.
+  Use the resource [`aws_s3_bucket_accelerate_configuration`](s3_bucket_accelerate_configuration.html) instead.
+* `acl` - (Optional, **Deprecated**) The [canned ACL](https://docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html#canned-acl) to apply. Valid values are `private`, `public-read`, `public-read-write`, `aws-exec-read`, `authenticated-read`, and `log-delivery-write`. Defaults to `private`.  Conflicts with `grant`. Terraform will only perform drift detection if a configuration value is provided. Use the resource [`aws_s3_bucket_acl`](s3_bucket_acl.html.markdown) instead.
+* `grant` - (Optional, **Deprecated**) An [ACL policy grant](https://docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html#sample-acl). See [Grant](#grant) below for details. Conflicts with `acl`. Terraform will only perform drift detection if a configuration value is provided. Use the resource [`aws_s3_bucket_acl`](s3_bucket_acl.html.markdown) instead.
+* `cors_rule` - (Optional, **Deprecated**) Rule of [Cross-Origin Resource Sharing](https://docs.aws.amazon.com/AmazonS3/latest/dev/cors.html). See [CORS rule](#cors-rule) below for details. Terraform will only perform drift detection if a configuration value is provided. Use the resource [`aws_s3_bucket_cors_configuration`](s3_bucket_cors_configuration.html.markdown) instead.
+* `lifecycle_rule` - (Optional, **Deprecated**) Configuration of [object lifecycle management](http://docs.aws.amazon.com/AmazonS3/latest/dev/object-lifecycle-mgmt.html). See [Lifecycle Rule](#lifecycle-rule) below for details. Terraform will only perform drift detection if a configuration value is provided.
+  Use the resource [`aws_s3_bucket_lifecycle_configuration`](s3_bucket_lifecycle_configuration.html) instead.
+* `logging` - (Optional, **Deprecated**) Configuration of [S3 bucket logging](https://docs.aws.amazon.com/AmazonS3/latest/UG/ManagingBucketLogging.html) parameters. See [Logging](#logging) below for details. Terraform will only perform drift detection if a configuration value is provided.
+  Use the resource [`aws_s3_bucket_logging`](s3_bucket_logging.html.markdown) instead.
+* `object_lock_configuration` - (Optional, **Deprecated**) Configuration of [S3 object locking](https://docs.aws.amazon.com/AmazonS3/latest/dev/object-lock.html). See [Object Lock Configuration](#object-lock-configuration) below for details.
+  Terraform wil only perform drift detection if a configuration value is provided.
+  Use the `object_lock_enabled` parameter and the resource [`aws_s3_bucket_object_lock_configuration`](s3_bucket_object_lock_configuration.html.markdown) instead.
+* `policy` - (Optional, **Deprecated**) Valid [bucket policy](https://docs.aws.amazon.com/AmazonS3/latest/dev/example-bucket-policies.html) JSON document. Note that if the policy document is not specific enough (but still valid), Terraform may view the policy as constantly changing in a `terraform plan`. In this case, please make sure you use the verbose/specific version of the policy. For more information about building AWS IAM policy documents with Terraform, see the [AWS IAM Policy Document Guide](https://learn.hashicorp.com/terraform/aws/iam-policy).
+  Terraform will only perform drift detection if a configuration value is provided.
+  Use the resource [`aws_s3_bucket_policy`](s3_bucket_policy.html) instead.
+* `replication_configuration` - (Optional, **Deprecated**) Configuration of [replication configuration](http://docs.aws.amazon.com/AmazonS3/latest/dev/crr.html). See [Replication Configuration](#replication-configuration) below for details. Terraform will only perform drift detection if a configuration value is provided.
+  Use the resource [`aws_s3_bucket_replication_configuration`](s3_bucket_replication_configuration.html) instead.
+* `request_payer` - (Optional, **Deprecated**) Specifies who should bear the cost of Amazon S3 data transfer.
+  Can be either `BucketOwner` or `Requester`. By default, the owner of the S3 bucket would incur the costs of any data transfer.
+  See [Requester Pays Buckets](http://docs.aws.amazon.com/AmazonS3/latest/dev/RequesterPaysBuckets.html) developer guide for more information.
+  Terraform will only perform drift detection if a configuration value is provided.
+  Use the resource [`aws_s3_bucket_request_payment_configuration`](s3_bucket_request_payment_configuration.html) instead.
+* `server_side_encryption_configuration` - (Optional, **Deprecated**) Configuration of [server-side encryption configuration](http://docs.aws.amazon.com/AmazonS3/latest/dev/bucket-encryption.html). See [Server Side Encryption Configuration](#server-side-encryption-configuration) below for details.
+  Terraform will only perform drift detection if a configuration value is provided.
+  Use the resource [`aws_s3_bucket_server_side_encryption_configuration`](s3_bucket_server_side_encryption_configuration.html) instead.
+* `versioning` - (Optional, **Deprecated**) Configuration of the [S3 bucket versioning state](https://docs.aws.amazon.com/AmazonS3/latest/dev/Versioning.html). See [Versioning](#versioning) below for details. Terraform will only perform drift detection if a configuration value is provided. Use the resource [`aws_s3_bucket_versioning`](s3_bucket_versioning.html.markdown) instead.
+* `website` - (Optional, **Deprecated**) Configuration of the [S3 bucket website](https://docs.aws.amazon.com/AmazonS3/latest/userguide/WebsiteHosting.html). See [Website](#website) below for details. Terraform will only perform drift detection if a configuration value is provided.
+  Use the resource [`aws_s3_bucket_website_configuration`](s3_bucket_website_configuration.html.markdown) instead.
+
+### CORS Rule
+
+~> **NOTE:** Currently, changes to the `cors_rule` configuration of *existing* resources cannot be automatically detected by Terraform. To manage changes of CORS rules to an S3 bucket, use the `aws_s3_bucket_cors_configuration` resource instead. If you use `cors_rule` on an `aws_s3_bucket`, Terraform will assume management over the full set of CORS rules for the S3 bucket, treating additional CORS rules as drift. For this reason, `cors_rule` cannot be mixed with the external `aws_s3_bucket_cors_configuration` resource for a given S3 bucket.
+
+The `cors_rule` configuration block supports the following arguments:
+
+* `allowed_headers` - (Optional) List of headers allowed.
+* `allowed_methods` - (Required) One or more HTTP methods that you allow the origin to execute. Can be `GET`, `PUT`, `POST`, `DELETE` or `HEAD`.
+* `allowed_origins` - (Required) One or more origins you want customers to be able to access the bucket from.
+* `expose_headers` - (Optional) One or more headers in the response that you want customers to be able to access from their applications (for example, from a JavaScript `XMLHttpRequest` object).
+* `max_age_seconds` - (Optional) Specifies time in seconds that browser can cache the response for a preflight request.
+
+### Grant
+
+~> **NOTE:** Currently, changes to the `grant` configuration of *existing* resources cannot be automatically detected by Terraform. To manage changes of ACL grants to an S3 bucket, use the `aws_s3_bucket_acl` resource instead. If you use `grant` on an `aws_s3_bucket`, Terraform will assume management over the full set of ACL grants for the S3 bucket, treating additional ACL grants as drift. For this reason, `grant` cannot be mixed with the external `aws_s3_bucket_acl` resource for a given S3 bucket.
+
+The `grant` configuration block supports the following arguments:
+
+* `id` - (Optional) Canonical user id to grant for. Used only when `type` is `CanonicalUser`.
+* `type` - (Required) Type of grantee to apply for. Valid values are `CanonicalUser` and `Group`. `AmazonCustomerByEmail` is not supported.
+* `permissions` - (Required) List of permissions to apply for grantee. Valid values are `READ`, `WRITE`, `READ_ACP`, `WRITE_ACP`, `FULL_CONTROL`.
+* `uri` - (Optional) Uri address to grant for. Used only when `type` is `Group`.
+
+### Lifecycle Rule
+
+~> **NOTE:** Currently, changes to the `lifecycle_rule` configuration of *existing* resources cannot be automatically detected by Terraform. To manage changes of Lifecycle rules to an S3 bucket, use the `aws_s3_bucket_lifecycle_configuration` resource instead. If you use `lifecycle_rule` on an `aws_s3_bucket`, Terraform will assume management over the full set of Lifecycle rules for the S3 bucket, treating additional Lifecycle rules as drift. For this reason, `lifecycle_rule` cannot be mixed with the external `aws_s3_bucket_lifecycle_configuration` resource for a given S3 bucket.
+
+~> **NOTE:** At least one of `abort_incomplete_multipart_upload_days`, `expiration`, `transition`, `noncurrent_version_expiration`, `noncurrent_version_transition` must be specified.
+
+The `lifecycle_rule` configuration block supports the following arguments:
+
+* `id` - (Optional) Unique identifier for the rule. Must be less than or equal to 255 characters in length.
+* `prefix` - (Optional) Object key prefix identifying one or more objects to which the rule applies.
+* `tags` - (Optional) Specifies object tags key and value.
+* `enabled` - (Required) Specifies lifecycle rule status.
+* `abort_incomplete_multipart_upload_days` (Optional) Specifies the number of days after initiating a multipart upload when the multipart upload must be completed.
+* `expiration` - (Optional) Specifies a period in the object's expire. See [Expiration](#expiration) below for details.
+* `transition` - (Optional) Specifies a period in the object's transitions. See [Transition](#transition) below for details.
+* `noncurrent_version_expiration` - (Optional) Specifies when noncurrent object versions expire. See [Noncurrent Version Expiration](#noncurrent-version-expiration) below for details.
+* `noncurrent_version_transition` - (Optional) Specifies when noncurrent object versions transitions. See [Noncurrent Version Transition](#noncurrent-version-transition) below for details.
+
+### Expiration
+
+The `expiration` configuration block supports the following arguments:
+
+* `date` - (Optional) Specifies the date after which you want the corresponding action to take effect.
+* `days` - (Optional) Specifies the number of days after object creation when the specific rule action takes effect.
+* `expired_object_delete_marker` - (Optional) On a versioned bucket (versioning-enabled or versioning-suspended bucket), you can add this element in the lifecycle configuration to direct Amazon S3 to delete expired object delete markers. This cannot be specified with Days or Date in a Lifecycle Expiration Policy.
+
+### Transition
+
+The `transition` configuration block supports the following arguments:
+
+* `date` - (Optional) Specifies the date after which you want the corresponding action to take effect.
+* `days` - (Optional) Specifies the number of days after object creation when the specific rule action takes effect.
+* `storage_class` - (Required) Specifies the Amazon S3 [storage class](https://docs.aws.amazon.com/AmazonS3/latest/API/API_Transition.html#AmazonS3-Type-Transition-StorageClass) to which you want the object to transition.
+
+### Noncurrent Version Expiration
+
+The `noncurrent_version_expiration` configuration block supports the following arguments:
+
+* `days` - (Required) Specifies the number of days noncurrent object versions expire.
+
+### Noncurrent Version Transition
+
+The `noncurrent_version_transition` configuration supports the following arguments:
+
+* `days` - (Required) Specifies the number of days noncurrent object versions transition.
+* `storage_class` - (Required) Specifies the Amazon S3 [storage class](https://docs.aws.amazon.com/AmazonS3/latest/API/API_Transition.html#AmazonS3-Type-Transition-StorageClass) to which you want the object to transition.
+
+### Logging
+
+~> **NOTE:** Currently, changes to the `logging` configuration of *existing* resources cannot be automatically detected by Terraform. To manage changes of logging parameters to an S3 bucket, use the `aws_s3_bucket_logging` resource instead. If you use `logging` on an `aws_s3_bucket`, Terraform will assume management over the full set of logging parameters for the S3 bucket, treating additional logging parameters as drift. For this reason, `logging` cannot be mixed with the external `aws_s3_bucket_logging` resource for a given S3 bucket.
+
+The `logging` configuration block supports the following arguments:
+
+* `target_bucket` - (Required) Name of the bucket that will receive the log objects.
+* `target_prefix` - (Optional) To specify a key prefix for log objects.
+
+### Object Lock Configuration
+
+~> **NOTE:** You can only **enable** S3 Object Lock for **new** buckets. If you need to **enable** S3 Object Lock for an **existing** bucket, please contact AWS Support.
+When you create a bucket with S3 Object Lock enabled, Amazon S3 automatically enables versioning for the bucket.
+Once you create a bucket with S3 Object Lock enabled, you can't disable Object Lock or suspend versioning for the bucket.
+
+~> **NOTE:** Currently, changes to the `object_lock_configuration` configuration of *existing* resources cannot be automatically detected by Terraform. To manage changes of Object Lock settings to an S3 bucket, use the `aws_s3_bucket_object_lock_configuration` resource instead. If you use `object_lock_configuration` on an `aws_s3_bucket`, Terraform will assume management over the full set of Object Lock configuration parameters for the S3 bucket, treating additional Object Lock configuration parameters as drift. For this reason, `object_lock_configuration` cannot be mixed with the external `aws_s3_bucket_object_lock_configuration` resource for a given S3 bucket.
+
+The `object_lock_configuration` configuration block supports the following arguments:
+
+* `object_lock_enabled` - (Optional, **Deprecated**) Indicates whether this bucket has an Object Lock configuration enabled. Valid value is `Enabled`. Use the top-level argument `object_lock_enabled` instead.
+* `rule` - (Optional) Object Lock rule in place for this bucket ([documented below](#rule)).
+
+#### Rule
+
+The `rule` configuration block supports the following argument:
+
+* `default_retention` - (Required) Default retention period that you want to apply to new objects placed in this bucket ([documented below](#default-retention)).
+
+#### Default Retention
+
+The `default_retention` configuration block supports the following arguments:
+
+~> **NOTE:** Either `days` or `years` must be specified, but not both.
+
+* `mode` - (Required) Default Object Lock retention mode you want to apply to new objects placed in this bucket. Valid values are `GOVERNANCE` and `COMPLIANCE`.
+* `days` - (Optional) Number of days that you want to specify for the default retention period.
+* `years` - (Optional) Number of years that you want to specify for the default retention period.
+
+### Replication Configuration
+
+~> **NOTE:** Currently, changes to the `replication_configuration` configuration of *existing* resources cannot be automatically detected by Terraform. To manage replication configuration changes to an S3 bucket, use the `aws_s3_bucket_replication_configuration` resource instead. If you use `replication_configuration` on an `aws_s3_bucket`, Terraform will assume management over the full replication configuration for the S3 bucket, treating additional replication configuration rules as drift. For this reason, `replication_configuration` cannot be mixed with the external `aws_s3_bucket_replication_configuration` resource for a given S3 bucket.
+
+The `replication_configuration` configuration block supports the following arguments:
+
+* `role` - (Required) ARN of the IAM role for Amazon S3 to assume when replicating the objects.
+* `rules` - (Required) Specifies the rules managing the replication ([documented below](#rules)).
+
+#### Rules
+
+The `rules` configuration block supports the following arguments:
+
+~> **NOTE:** Amazon S3's latest version of the replication configuration is V2, which includes the `filter` attribute for replication rules.
+With the `filter` attribute, you can specify object filters based on the object key prefix, tags, or both to scope the objects that the rule applies to.
+Replication configuration V1 supports filtering based on only the `prefix` attribute. For backwards compatibility, Amazon S3 continues to support the V1 configuration.
+
+* `delete_marker_replication_status` - (Optional) Whether delete markers are replicated. The only valid value is `Enabled`. To disable, omit this argument. This argument is only valid with V2 replication configurations (i.e., when `filter` is used).
+* `destination` - (Required) Specifies the destination for the rule ([documented below](#destination)).
+* `filter` - (Optional, Conflicts with `prefix`) Filter that identifies subset of objects to which the replication rule applies ([documented below](#filter)).
+* `id` - (Optional) Unique identifier for the rule. Must be less than or equal to 255 characters in length.
+* `prefix` - (Optional, Conflicts with `filter`) Object keyname prefix identifying one or more objects to which the rule applies. Must be less than or equal to 1024 characters in length.
+* `priority` - (Optional) Priority associated with the rule. Priority should only be set if `filter` is configured. If not provided, defaults to `0`. Priority must be unique between multiple rules.
+* `source_selection_criteria` - (Optional) Specifies special object selection criteria ([documented below](#source-selection-criteria)).
+* `status` - (Required) Status of the rule. Either `Enabled` or `Disabled`. The rule is ignored if status is not Enabled.
+
+#### Filter
+
+The `filter` configuration block supports the following arguments:
+
+* `prefix` - (Optional) Object keyname prefix that identifies subset of objects to which the rule applies. Must be less than or equal to 1024 characters in length.
+* `tags` - (Optional)  A map of tags that identifies subset of objects to which the rule applies.
+  The rule applies only to objects having all the tags in its tagset.
+
+#### Destination
+
+~> **NOTE:** Replication to multiple destination buckets requires that `priority` is specified in the `rules` object. If the corresponding rule requires no filter, an empty configuration block `filter {}` must be specified.
+
+The `destination` configuration block supports the following arguments:
+
+* `bucket` - (Required) ARN of the S3 bucket where you want Amazon S3 to store replicas of the object identified by the rule.
+* `storage_class` - (Optional) The [storage class](https://docs.aws.amazon.com/AmazonS3/latest/API/API_Destination.html#AmazonS3-Type-Destination-StorageClass) used to store the object. By default, Amazon S3 uses the storage class of the source object to create the object replica.
+* `replica_kms_key_id` - (Optional) Destination KMS encryption key ARN for SSE-KMS replication. Must be used in conjunction with
+  `sse_kms_encrypted_objects` source selection criteria.
+* `access_control_translation` - (Optional) Specifies the overrides to use for object owners on replication. Must be used in conjunction with `account_id` owner override configuration.
+* `account_id` - (Optional) Account ID to use for overriding the object owner on replication. Must be used in conjunction with `access_control_translation` override configuration.
+* `replication_time` - (Optional) Enables S3 Replication Time Control (S3 RTC) ([documented below](#replication-time)).
+* `metrics` - (Optional) Enables replication metrics (required for S3 RTC) ([documented below](#metrics)).
+
+#### Replication Time
+
+The `replication_time` configuration block supports the following arguments:
+
+* `status` - (Optional) Status of RTC. Either `Enabled` or `Disabled`.
+* `minutes` - (Optional) Threshold within which objects are to be replicated. The only valid value is `15`.
+
+#### Metrics
+
+The `metrics` configuration block supports the following arguments:
+
+* `status` - (Optional) Status of replication metrics. Either `Enabled` or `Disabled`.
+* `minutes` - (Optional) Threshold within which objects are to be replicated. The only valid value is `15`.
+
+#### Source Selection Criteria
+
+The `source_selection_criteria` configuration block supports the following argument:
+
+* `sse_kms_encrypted_objects` - (Optional) Match SSE-KMS encrypted objects ([documented below](#sse-kms-encrypted-objects)). If specified, `replica_kms_key_id`
+  in `destination` must be specified as well.
+
+#### SSE KMS Encrypted Objects
+
+The `sse_kms_encrypted_objects` configuration block supports the following argument:
+
+* `enabled` - (Required) Boolean which indicates if this criteria is enabled.
+
+### Server Side Encryption Configuration
+
+~> **NOTE:** Currently, changes to the `server_side_encryption_configuration` configuration of *existing* resources cannot be automatically detected by Terraform. To manage changes in encryption of an S3 bucket, use the `aws_s3_bucket_server_side_encryption_configuration` resource instead. If you use `server_side_encryption_configuration` on an `aws_s3_bucket`, Terraform will assume management over the encryption configuration for the S3 bucket, treating additional encryption changes as drift. For this reason, `server_side_encryption_configuration` cannot be mixed with the external `aws_s3_bucket_server_side_encryption_configuration` resource for a given S3 bucket.
+
+The `server_side_encryption_configuration` configuration block supports the following argument:
+
+* `rule` - (Required) Single object for server-side encryption by default configuration. (documented below)
+
+The `rule` configuration block supports the following arguments:
+
+* `apply_server_side_encryption_by_default` - (Required) Single object for setting server-side encryption by default. (documented below)
+* `bucket_key_enabled` - (Optional) Whether or not to use [Amazon S3 Bucket Keys](https://docs.aws.amazon.com/AmazonS3/latest/dev/bucket-key.html) for SSE-KMS.
+
+The `apply_server_side_encryption_by_default` configuration block supports the following arguments:
+
+* `sse_algorithm` - (Required) Server-side encryption algorithm to use. Valid values are `AES256` and `aws:kms`
+* `kms_master_key_id` - (Optional) AWS KMS master key ID used for the SSE-KMS encryption. This can only be used when you set the value of `sse_algorithm` as `aws:kms`. The default `aws/s3` AWS KMS master key is used if this element is absent while the `sse_algorithm` is `aws:kms`.
+
+### Versioning
+
+~> **NOTE:** Currently, changes to the `versioning` configuration of *existing* resources cannot be automatically detected by Terraform. To manage changes of versioning state to an S3 bucket, use the `aws_s3_bucket_versioning` resource instead. If you use `versioning` on an `aws_s3_bucket`, Terraform will assume management over the versioning state of the S3 bucket, treating additional versioning state changes as drift. For this reason, `versioning` cannot be mixed with the external `aws_s3_bucket_versioning` resource for a given S3 bucket.
+
+The `versioning` configuration block supports the following arguments:
+
+* `enabled` - (Optional) Enable versioning. Once you version-enable a bucket, it can never return to an unversioned state. You can, however, suspend versioning on that bucket.
+* `mfa_delete` - (Optional) Enable MFA delete for either `Change the versioning state of your bucket` or `Permanently delete an object version`. Default is `false`. This cannot be used to toggle this setting but is available to allow managed buckets to reflect the state in AWS
+
+### Website
+
+~> **NOTE:** Currently, changes to the `website` configuration of *existing* resources cannot be automatically detected by Terraform. To manage changes to the website configuration of an S3 bucket, use the `aws_s3_bucket_website_configuration` resource instead. If you use `website` on an `aws_s3_bucket`, Terraform will assume management over the configuration of the website of the S3 bucket, treating additional website configuration changes as drift. For this reason, `website` cannot be mixed with the external `aws_s3_bucket_website_configuration` resource for a given S3 bucket.
+
+The `website` configuration block supports the following arguments:
+
+* `index_document` - (Required, unless using `redirect_all_requests_to`) Amazon S3 returns this index document when requests are made to the root domain or any of the subfolders.
+* `error_document` - (Optional) Absolute path to the document to return in case of a 4XX error.
+* `redirect_all_requests_to` - (Optional) Hostname to redirect all website requests for this bucket to. Hostname can optionally be prefixed with a protocol (`http://` or `https://`) to use when redirecting requests. The default is the protocol that is used in the original request.
+* `routing_rules` - (Optional) JSON array containing [routing rules](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-s3-websiteconfiguration-routingrules.html)
+  describing redirect behavior and when redirects are applied.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Name of the bucket.
+* `arn` - ARN of the bucket. Will be of format `arn:aws:s3:::bucketname`.
+* `bucket_domain_name` - Bucket domain name. Will be of format `bucketname.s3.amazonaws.com`.
+* `bucket_regional_domain_name` - The bucket region-specific domain name. The bucket domain name including the region name. Please refer to the [S3 endpoints reference](https://docs.aws.amazon.com/general/latest/gr/s3.html#s3_region) for format. Note: AWS CloudFront allows specifying an S3 region-specific endpoint when creating an S3 origin. This will prevent redirect issues from CloudFront to the S3 Origin URL. For more information, see the [Virtual Hosted-Style Requests for Other Regions](https://docs.aws.amazon.com/AmazonS3/latest/userguide/VirtualHosting.html#deprecated-global-endpoint) section in the AWS S3 User Guide.
+* `hosted_zone_id` - [Route 53 Hosted Zone ID](https://docs.aws.amazon.com/general/latest/gr/rande.html#s3_website_region_endpoints) for this bucket's region.
+* `region` - AWS region this bucket resides in.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `website_endpoint` - (**Deprecated**) Website endpoint, if the bucket is configured with a website. If not, this will be an empty string. Use the resource [`aws_s3_bucket_website_configuration`](s3_bucket_website_configuration.html.markdown) instead.
+* `website_domain` - (**Deprecated**) Domain of the website endpoint, if the bucket is configured with a website. If not, this will be an empty string. This is used to create Route 53 alias records. Use the resource [`aws_s3_bucket_website_configuration`](s3_bucket_website_configuration.html.markdown) instead.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `20m`)
+- `read` - (Default `20m`)
+- `update` - (Default `20m`)
+- `delete` - (Default `60m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import S3 bucket using the `bucket`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import S3 bucket using the `bucket`. For example:
+
+```console
+% terraform import aws_s3_bucket.bucket bucket-name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-23efd238c67c3da85ca9dd5d54b26a2bc3bb62edb2ea9528d1db9a9d3e044ad2 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/s3_bucket_accelerate_configuration.html.markdown b/website/docs/cdktf/python/r/s3_bucket_accelerate_configuration.html.markdown
new file mode 100644
index 00000000000..0190831333e
--- /dev/null
+++ b/website/docs/cdktf/python/r/s3_bucket_accelerate_configuration.html.markdown
@@ -0,0 +1,93 @@
+---
+subcategory: "S3 (Simple Storage)"
+layout: "aws"
+page_title: "AWS: aws_s3_bucket_accelerate_configuration"
+description: |-
+  Provides an S3 bucket accelerate configuration resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_s3_bucket_accelerate_configuration
+
+Provides an S3 bucket accelerate configuration resource. See the [Requirements for using Transfer Acceleration](https://docs.aws.amazon.com/AmazonS3/latest/userguide/transfer-acceleration.html#transfer-acceleration-requirements) for more details.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_accelerate_configuration import S3BucketAccelerateConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        mybucket = S3Bucket(self, "mybucket",
+            bucket="mybucket"
+        )
+        S3BucketAccelerateConfiguration(self, "example",
+            bucket=mybucket.id,
+            status="Enabled"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `bucket` - (Required, Forces new resource) Name of the bucket.
+* `expected_bucket_owner` - (Optional, Forces new resource) Account ID of the expected bucket owner.
+* `status` - (Required) Transfer acceleration state of the bucket. Valid values: `Enabled`, `Suspended`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The `bucket` or `bucket` and `expected_bucket_owner` separated by a comma (`,`) if the latter is provided.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import S3 bucket accelerate configuration using the `bucket` or using the `bucket` and `expected_bucket_owner` separated by a comma (`,`). For example:
+
+If the owner (account ID) of the source bucket is the same account used to configure the Terraform AWS Provider, import using the `bucket`:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+If the owner (account ID) of the source bucket differs from the account used to configure the Terraform AWS Provider, import using the `bucket` and `expected_bucket_owner` separated by a comma (`,`):
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+**Using `terraform import` to import.** For example:
+
+If the owner (account ID) of the source bucket is the same account used to configure the Terraform AWS Provider, import using the `bucket`:
+
+```console
+% terraform import aws_s3_bucket_accelerate_configuration.example bucket-name
+```
+
+If the owner (account ID) of the source bucket differs from the account used to configure the Terraform AWS Provider, import using the `bucket` and `expected_bucket_owner` separated by a comma (`,`):
+
+```console
+% terraform import aws_s3_bucket_accelerate_configuration.example bucket-name,123456789012
+```
+
+<!-- cache-key: cdktf-0.18.0 input-d5969f8a31c3a0cabfdc95aa5af8e4294acf1e21e3704ef66fc529acc0c176b8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/s3_bucket_acl.html.markdown b/website/docs/cdktf/python/r/s3_bucket_acl.html.markdown
new file mode 100644
index 00000000000..5f5e660f786
--- /dev/null
+++ b/website/docs/cdktf/python/r/s3_bucket_acl.html.markdown
@@ -0,0 +1,286 @@
+---
+subcategory: "S3 (Simple Storage)"
+layout: "aws"
+page_title: "AWS: aws_s3_bucket_acl"
+description: |-
+  Provides an S3 bucket ACL resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_s3_bucket_acl
+
+Provides an S3 bucket ACL resource.
+
+~> **Note:** `terraform destroy` does not delete the S3 Bucket ACL but does remove the resource from Terraform state.
+
+## Example Usage
+
+### With `private` ACL
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_acl import S3BucketAcl
+from imports.aws.s3_bucket_ownership_controls import S3BucketOwnershipControls
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = S3Bucket(self, "example",
+            bucket="my-tf-example-bucket"
+        )
+        aws_s3_bucket_ownership_controls_example = S3BucketOwnershipControls(self, "example_1",
+            bucket=example.id,
+            rule=S3BucketOwnershipControlsRule(
+                object_ownership="BucketOwnerPreferred"
+            )
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_ownership_controls_example.override_logical_id("example")
+        aws_s3_bucket_acl_example = S3BucketAcl(self, "example_2",
+            acl="private",
+            bucket=example.id,
+            depends_on=[aws_s3_bucket_ownership_controls_example]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_acl_example.override_logical_id("example")
+```
+
+### With `public-read` ACL
+
+-> This example explicitly disables the default S3 bucket security settings. This
+should be done with caution, as all bucket objects become publicly exposed.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_acl import S3BucketAcl
+from imports.aws.s3_bucket_ownership_controls import S3BucketOwnershipControls
+from imports.aws.s3_bucket_public_access_block import S3BucketPublicAccessBlock
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = S3Bucket(self, "example",
+            bucket="my-tf-example-bucket"
+        )
+        aws_s3_bucket_ownership_controls_example = S3BucketOwnershipControls(self, "example_1",
+            bucket=example.id,
+            rule=S3BucketOwnershipControlsRule(
+                object_ownership="BucketOwnerPreferred"
+            )
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_ownership_controls_example.override_logical_id("example")
+        aws_s3_bucket_public_access_block_example = S3BucketPublicAccessBlock(self, "example_2",
+            block_public_acls=False,
+            block_public_policy=False,
+            bucket=example.id,
+            ignore_public_acls=False,
+            restrict_public_buckets=False
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_public_access_block_example.override_logical_id("example")
+        aws_s3_bucket_acl_example = S3BucketAcl(self, "example_3",
+            acl="public-read",
+            bucket=example.id,
+            depends_on=[aws_s3_bucket_ownership_controls_example, aws_s3_bucket_public_access_block_example
+            ]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_acl_example.override_logical_id("example")
+```
+
+### With Grants
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_canonical_user_id import DataAwsCanonicalUserId
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_acl import S3BucketAcl
+from imports.aws.s3_bucket_ownership_controls import S3BucketOwnershipControls
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = S3Bucket(self, "example",
+            bucket="my-tf-example-bucket"
+        )
+        aws_s3_bucket_ownership_controls_example = S3BucketOwnershipControls(self, "example_1",
+            bucket=example.id,
+            rule=S3BucketOwnershipControlsRule(
+                object_ownership="BucketOwnerPreferred"
+            )
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_ownership_controls_example.override_logical_id("example")
+        current = DataAwsCanonicalUserId(self, "current")
+        aws_s3_bucket_acl_example = S3BucketAcl(self, "example_3",
+            access_control_policy=S3BucketAclAccessControlPolicy(
+                grant=[S3BucketAclAccessControlPolicyGrant(
+                    grantee=S3BucketAclAccessControlPolicyGrantGrantee(
+                        id=Token.as_string(current.id),
+                        type="CanonicalUser"
+                    ),
+                    permission="READ"
+                ), S3BucketAclAccessControlPolicyGrant(
+                    grantee=S3BucketAclAccessControlPolicyGrantGrantee(
+                        type="Group",
+                        uri="http://acs.amazonaws.com/groups/s3/LogDelivery"
+                    ),
+                    permission="READ_ACP"
+                )
+                ],
+                owner=S3BucketAclAccessControlPolicyOwner(
+                    id=Token.as_string(current.id)
+                )
+            ),
+            bucket=example.id,
+            depends_on=[aws_s3_bucket_ownership_controls_example]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_acl_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `acl` - (Optional, Conflicts with `access_control_policy`) Canned ACL to apply to the bucket.
+* `access_control_policy` - (Optional, Conflicts with `acl`) Configuration block that sets the ACL permissions for an object per grantee. [See below](#access_control_policy).
+* `bucket` - (Required, Forces new resource) Name of the bucket.
+* `expected_bucket_owner` - (Optional, Forces new resource) Account ID of the expected bucket owner.
+
+### access_control_policy
+
+The `access_control_policy` configuration block supports the following arguments:
+
+* `grant` - (Required) Set of `grant` configuration blocks. [See below](#grant).
+* `owner` - (Required) Configuration block of the bucket owner's display name and ID. [See below](#owner).
+
+### grant
+
+The `grant` configuration block supports the following arguments:
+
+* `grantee` - (Required) Configuration block for the person being granted permissions. [See below](#grantee).
+* `permission` - (Required) Logging permissions assigned to the grantee for the bucket.
+
+### owner
+
+The `owner` configuration block supports the following arguments:
+
+* `id` - (Required) ID of the owner.
+* `display_name` - (Optional) Display name of the owner.
+
+### grantee
+
+The `grantee` configuration block supports the following arguments:
+
+* `email_address` - (Optional) Email address of the grantee. See [Regions and Endpoints](https://docs.aws.amazon.com/general/latest/gr/rande.html#s3_region) for supported AWS regions where this argument can be specified.
+* `id` - (Optional) Canonical user ID of the grantee.
+* `type` - (Required) Type of grantee. Valid values: `CanonicalUser`, `AmazonCustomerByEmail`, `Group`.
+* `uri` - (Optional) URI of the grantee group.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The `bucket`, `expected_bucket_owner` (if configured), and `acl` (if configured) separated by commas (`,`).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import S3 bucket ACL using `bucket`, `expected_bucket_owner`, and/or `acl`, depending on your situation. For example:
+
+If the owner (account ID) of the source bucket is the _same_ account used to configure the Terraform AWS Provider, and the source bucket is **not configured** with a
+[canned ACL][1] (i.e. predefined grant), import using the `bucket`:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+If the owner (account ID) of the source bucket is the _same_ account used to configure the Terraform AWS Provider, and the source bucket is **configured** with a
+[canned ACL][1] (i.e. predefined grant), import using the `bucket` and `acl` separated by a comma (`,`):
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+If the owner (account ID) of the source bucket _differs_ from the account used to configure the Terraform AWS Provider, and the source bucket is **not configured** with a [canned ACL][1] (i.e. predefined grant), imported using the `bucket` and `expected_bucket_owner` separated by a comma (`,`):
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+If the owner (account ID) of the source bucket _differs_ from the account used to configure the Terraform AWS Provider, and the source bucket is **configured** with a
+[canned ACL][1] (i.e. predefined grant), imported using the `bucket`, `expected_bucket_owner`, and `acl` separated by commas (`,`):
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+**Using `terraform import` to import** using `bucket`, `expected_bucket_owner`, and/or `acl`, depending on your situation. For example:
+
+If the owner (account ID) of the source bucket is the _same_ account used to configure the Terraform AWS Provider, and the source bucket is **not configured** with a
+[canned ACL][1] (i.e. predefined grant), import using the `bucket`:
+
+```console
+% terraform import aws_s3_bucket_acl.example bucket-name
+```
+
+If the owner (account ID) of the source bucket is the _same_ account used to configure the Terraform AWS Provider, and the source bucket is **configured** with a [canned ACL][1] (i.e. predefined grant), import using the `bucket` and `acl` separated by a comma (`,`):
+
+```console
+% terraform import aws_s3_bucket_acl.example bucket-name,private
+```
+
+If the owner (account ID) of the source bucket _differs_ from the account used to configure the Terraform AWS Provider, and the source bucket is **not configured** with a [canned ACL][1] (i.e. predefined grant), imported using the `bucket` and `expected_bucket_owner` separated by a comma (`,`):
+
+```console
+% terraform import aws_s3_bucket_acl.example bucket-name,123456789012
+```
+
+If the owner (account ID) of the source bucket _differs_ from the account used to configure the Terraform AWS Provider, and the source bucket is **configured** with a [canned ACL][1] (i.e. predefined grant), imported using the `bucket`, `expected_bucket_owner`, and `acl` separated by commas (`,`):
+
+```console
+% terraform import aws_s3_bucket_acl.example bucket-name,123456789012,private
+```
+
+[1]: https://docs.aws.amazon.com/AmazonS3/latest/userguide/acl-overview.html#canned-acl
+
+<!-- cache-key: cdktf-0.18.0 input-7e8c0c7d553a8dc18f376cb79615d94086a2767d34d0f7c570f4a8267a6021d2 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/s3_bucket_analytics_configuration.html.markdown b/website/docs/cdktf/python/r/s3_bucket_analytics_configuration.html.markdown
new file mode 100644
index 00000000000..b99fe6e4bde
--- /dev/null
+++ b/website/docs/cdktf/python/r/s3_bucket_analytics_configuration.html.markdown
@@ -0,0 +1,141 @@
+---
+subcategory: "S3 (Simple Storage)"
+layout: "aws"
+page_title: "AWS: aws_s3_bucket_analytics_configuration"
+description: |-
+  Provides a S3 bucket analytics configuration resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_s3_bucket_analytics_configuration
+
+Provides a S3 bucket [analytics configuration](https://docs.aws.amazon.com/AmazonS3/latest/dev/analytics-storage-class.html) resource.
+
+## Example Usage
+
+### Add analytics configuration for entire S3 bucket and export results to a second S3 bucket
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_analytics_configuration import S3BucketAnalyticsConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        analytics = S3Bucket(self, "analytics",
+            bucket="analytics destination"
+        )
+        example = S3Bucket(self, "example",
+            bucket="example"
+        )
+        S3BucketAnalyticsConfiguration(self, "example-entire-bucket",
+            bucket=example.id,
+            name="EntireBucket",
+            storage_class_analysis=S3BucketAnalyticsConfigurationStorageClassAnalysis(
+                data_export=S3BucketAnalyticsConfigurationStorageClassAnalysisDataExport(
+                    destination=S3BucketAnalyticsConfigurationStorageClassAnalysisDataExportDestination(
+                        s3_bucket_destination=S3BucketAnalyticsConfigurationStorageClassAnalysisDataExportDestinationS3BucketDestination(
+                            bucket_arn=analytics.arn
+                        )
+                    )
+                )
+            )
+        )
+```
+
+### Add analytics configuration with S3 object filter
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_analytics_configuration import S3BucketAnalyticsConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = S3Bucket(self, "example",
+            bucket="example"
+        )
+        S3BucketAnalyticsConfiguration(self, "example-filtered",
+            bucket=example.id,
+            filter=S3BucketAnalyticsConfigurationFilter(
+                prefix="documents/",
+                tags={
+                    "class": "blue",
+                    "priority": "high"
+                }
+            ),
+            name="ImportantBlueDocuments"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `bucket` - (Required) Name of the bucket this analytics configuration is associated with.
+* `name` - (Required) Unique identifier of the analytics configuration for the bucket.
+* `filter` - (Optional) Object filtering that accepts a prefix, tags, or a logical AND of prefix and tags (documented below).
+* `storage_class_analysis` - (Optional) Configuration for the analytics data export (documented below).
+
+The `filter` configuration supports the following:
+
+* `prefix` - (Optional) Object prefix for filtering.
+* `tags` - (Optional) Set of object tags for filtering.
+
+The `storage_class_analysis` configuration supports the following:
+
+* `data_export` - (Required) Data export configuration (documented below).
+
+The `data_export` configuration supports the following:
+
+* `output_schema_version` - (Optional) Schema version of exported analytics data. Allowed values: `V_1`. Default value: `V_1`.
+* `destination` - (Required) Specifies the destination for the exported analytics data (documented below).
+
+The `destination` configuration supports the following:
+
+* `s3_bucket_destination` - (Required) Analytics data export currently only supports an S3 bucket destination (documented below).
+
+The `s3_bucket_destination` configuration supports the following:
+
+* `bucket_arn` - (Required) ARN of the destination bucket.
+* `bucket_account_id` - (Optional) Account ID that owns the destination bucket.
+* `format` - (Optional) Output format of exported analytics data. Allowed values: `CSV`. Default value: `CSV`.
+* `prefix` - (Optional) Prefix to append to exported analytics data.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import S3 bucket analytics configurations using `bucket:analytics`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import S3 bucket analytics configurations using `bucket:analytics`. For example:
+
+```console
+% terraform import aws_s3_bucket_analytics_configuration.my-bucket-entire-bucket my-bucket:EntireBucket
+```
+
+<!-- cache-key: cdktf-0.18.0 input-e6e60be173d72b9dbbe3cb220b8b14c97464931aea892e1e32c68720b8bf5012 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/s3_bucket_cors_configuration.html.markdown b/website/docs/cdktf/python/r/s3_bucket_cors_configuration.html.markdown
new file mode 100644
index 00000000000..acfef126eae
--- /dev/null
+++ b/website/docs/cdktf/python/r/s3_bucket_cors_configuration.html.markdown
@@ -0,0 +1,118 @@
+---
+subcategory: "S3 (Simple Storage)"
+layout: "aws"
+page_title: "AWS: aws_s3_bucket_cors_configuration"
+description: |-
+  Provides an S3 bucket CORS configuration resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_s3_bucket_cors_configuration
+
+Provides an S3 bucket CORS configuration resource. For more information about CORS, go to [Enabling Cross-Origin Resource Sharing](https://docs.aws.amazon.com/AmazonS3/latest/userguide/cors.html) in the Amazon S3 User Guide.
+
+~> **NOTE:** S3 Buckets only support a single CORS configuration. Declaring multiple `aws_s3_bucket_cors_configuration` resources to the same S3 Bucket will cause a perpetual difference in configuration.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_cors_configuration import S3BucketCorsConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = S3Bucket(self, "example",
+            bucket="mybucket"
+        )
+        aws_s3_bucket_cors_configuration_example = S3BucketCorsConfiguration(self, "example_1",
+            bucket=example.id,
+            cors_rule=[S3BucketCorsConfigurationCorsRule(
+                allowed_headers=["*"],
+                allowed_methods=["PUT", "POST"],
+                allowed_origins=["https://s3-website-test.hashicorp.com"],
+                expose_headers=["ETag"],
+                max_age_seconds=3000
+            ), S3BucketCorsConfigurationCorsRule(
+                allowed_methods=["GET"],
+                allowed_origins=["*"]
+            )
+            ]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_cors_configuration_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `bucket` - (Required, Forces new resource) Name of the bucket.
+* `expected_bucket_owner` - (Optional, Forces new resource) Account ID of the expected bucket owner.
+* `cors_rule` - (Required) Set of origins and methods (cross-origin access that you want to allow). [See below](#cors_rule). You can configure up to 100 rules.
+
+### cors_rule
+
+The `cors_rule` configuration block supports the following arguments:
+
+* `allowed_headers` - (Optional) Set of Headers that are specified in the `Access-Control-Request-Headers` header.
+* `allowed_methods` - (Required) Set of HTTP methods that you allow the origin to execute. Valid values are `GET`, `PUT`, `HEAD`, `POST`, and `DELETE`.
+* `allowed_origins` - (Required) Set of origins you want customers to be able to access the bucket from.
+* `expose_headers` - (Optional) Set of headers in the response that you want customers to be able to access from their applications (for example, from a JavaScript `XMLHttpRequest` object).
+* `id` - (Optional) Unique identifier for the rule. The value cannot be longer than 255 characters.
+* `max_age_seconds` - (Optional) Time in seconds that your browser is to cache the preflight response for the specified resource.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The `bucket` or `bucket` and `expected_bucket_owner` separated by a comma (`,`) if the latter is provided.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import S3 bucket CORS configuration using the `bucket` or using the `bucket` and `expected_bucket_owner` separated by a comma (`,`). For example:
+
+If the owner (account ID) of the source bucket is the same account used to configure the Terraform AWS Provider, import using the `bucket`:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+If the owner (account ID) of the source bucket differs from the account used to configure the Terraform AWS Provider, import using the `bucket` and `expected_bucket_owner` separated by a comma (`,`):
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+**Using `terraform import` to import** S3 bucket CORS configuration using the `bucket` or using the `bucket` and `expected_bucket_owner` separated by a comma (`,`). For example:
+
+If the owner (account ID) of the source bucket is the same account used to configure the Terraform AWS Provider, import using the `bucket`:
+
+```console
+% terraform import aws_s3_bucket_cors_configuration.example bucket-name
+```
+
+If the owner (account ID) of the source bucket differs from the account used to configure the Terraform AWS Provider, import using the `bucket` and `expected_bucket_owner` separated by a comma (`,`):
+
+```console
+% terraform import aws_s3_bucket_cors_configuration.example bucket-name,123456789012
+```
+
+<!-- cache-key: cdktf-0.18.0 input-c6297f41c25d6847931e27891b8cdabf38a1ff8d7e24e15087330868928e32e8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/s3_bucket_intelligent_tiering_configuration.html.markdown b/website/docs/cdktf/python/r/s3_bucket_intelligent_tiering_configuration.html.markdown
new file mode 100644
index 00000000000..62e68f7c774
--- /dev/null
+++ b/website/docs/cdktf/python/r/s3_bucket_intelligent_tiering_configuration.html.markdown
@@ -0,0 +1,129 @@
+---
+subcategory: "S3 (Simple Storage)"
+layout: "aws"
+page_title: "AWS: aws_s3_bucket_intelligent_tiering_configuration"
+description: |-
+  Provides an S3 Intelligent-Tiering configuration resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_s3_bucket_intelligent_tiering_configuration
+
+Provides an [S3 Intelligent-Tiering](https://docs.aws.amazon.com/AmazonS3/latest/userguide/intelligent-tiering.html) configuration resource.
+
+## Example Usage
+
+### Add intelligent tiering configuration for entire S3 bucket
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_intelligent_tiering_configuration import S3BucketIntelligentTieringConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = S3Bucket(self, "example",
+            bucket="example"
+        )
+        S3BucketIntelligentTieringConfiguration(self, "example-entire-bucket",
+            bucket=example.id,
+            name="EntireBucket",
+            tiering=[S3BucketIntelligentTieringConfigurationTiering(
+                access_tier="DEEP_ARCHIVE_ACCESS",
+                days=180
+            ), S3BucketIntelligentTieringConfigurationTiering(
+                access_tier="ARCHIVE_ACCESS",
+                days=125
+            )
+            ]
+        )
+```
+
+### Add intelligent tiering configuration with S3 object filter
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_intelligent_tiering_configuration import S3BucketIntelligentTieringConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = S3Bucket(self, "example",
+            bucket="example"
+        )
+        S3BucketIntelligentTieringConfiguration(self, "example-filtered",
+            bucket=example.id,
+            filter=S3BucketIntelligentTieringConfigurationFilter(
+                prefix="documents/",
+                tags={
+                    "class": "blue",
+                    "priority": "high"
+                }
+            ),
+            name="ImportantBlueDocuments",
+            status="Disabled",
+            tiering=[S3BucketIntelligentTieringConfigurationTiering(
+                access_tier="ARCHIVE_ACCESS",
+                days=125
+            )
+            ]
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `bucket` - (Required) Name of the bucket this intelligent tiering configuration is associated with.
+* `name` - (Required) Unique name used to identify the S3 Intelligent-Tiering configuration for the bucket.
+* `status` - (Optional) Specifies the status of the configuration. Valid values: `Enabled`, `Disabled`.
+* `filter` - (Optional) Bucket filter. The configuration only includes objects that meet the filter's criteria (documented below).
+* `tiering` - (Required) S3 Intelligent-Tiering storage class tiers of the configuration (documented below).
+
+The `filter` configuration supports the following:
+
+* `prefix` - (Optional) Object key name prefix that identifies the subset of objects to which the configuration applies.
+* `tags` - (Optional) All of these tags must exist in the object's tag set in order for the configuration to apply.
+
+The `tiering` configuration supports the following:
+
+* `access_tier` - (Required) S3 Intelligent-Tiering access tier. Valid values: `ARCHIVE_ACCESS`, `DEEP_ARCHIVE_ACCESS`.
+* `days` - (Required) Number of consecutive days of no access after which an object will be eligible to be transitioned to the corresponding tier.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import S3 bucket intelligent tiering configurations using `bucket:name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import S3 bucket intelligent tiering configurations using `bucket:name`. For example:
+
+```console
+% terraform import aws_s3_bucket_intelligent_tiering_configuration.my-bucket-entire-bucket my-bucket:EntireBucket
+```
+
+<!-- cache-key: cdktf-0.18.0 input-b6b169e601dae3b6976c4585bd3676643529f574da01b5ad3983daea051c81f0 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/s3_bucket_inventory.html.markdown b/website/docs/cdktf/python/r/s3_bucket_inventory.html.markdown
new file mode 100644
index 00000000000..66745cf42dd
--- /dev/null
+++ b/website/docs/cdktf/python/r/s3_bucket_inventory.html.markdown
@@ -0,0 +1,162 @@
+---
+subcategory: "S3 (Simple Storage)"
+layout: "aws"
+page_title: "AWS: aws_s3_bucket_inventory"
+description: |-
+  Provides a S3 bucket inventory configuration resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_s3_bucket_inventory
+
+Provides a S3 bucket [inventory configuration](https://docs.aws.amazon.com/AmazonS3/latest/dev/storage-inventory.html) resource.
+
+## Example Usage
+
+### Add inventory configuration
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_inventory import S3BucketInventory
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        inventory = S3Bucket(self, "inventory",
+            bucket="my-tf-inventory-bucket"
+        )
+        test = S3Bucket(self, "test",
+            bucket="my-tf-test-bucket"
+        )
+        aws_s3_bucket_inventory_test = S3BucketInventory(self, "test_2",
+            bucket=test.id,
+            destination=S3BucketInventoryDestination(
+                bucket=S3BucketInventoryDestinationBucket(
+                    bucket_arn=inventory.arn,
+                    format="ORC"
+                )
+            ),
+            included_object_versions="All",
+            name="EntireBucketDaily",
+            schedule=S3BucketInventorySchedule(
+                frequency="Daily"
+            )
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_inventory_test.override_logical_id("test")
+```
+
+### Add inventory configuration with S3 object prefix
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_inventory import S3BucketInventory
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        inventory = S3Bucket(self, "inventory",
+            bucket="my-tf-inventory-bucket"
+        )
+        test = S3Bucket(self, "test",
+            bucket="my-tf-test-bucket"
+        )
+        S3BucketInventory(self, "test-prefix",
+            bucket=test.id,
+            destination=S3BucketInventoryDestination(
+                bucket=S3BucketInventoryDestinationBucket(
+                    bucket_arn=inventory.arn,
+                    format="ORC",
+                    prefix="inventory"
+                )
+            ),
+            filter=S3BucketInventoryFilter(
+                prefix="documents/"
+            ),
+            included_object_versions="All",
+            name="DocumentsWeekly",
+            schedule=S3BucketInventorySchedule(
+                frequency="Daily"
+            )
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `bucket` - (Required) Name of the source bucket that inventory lists the objects for.
+* `name` - (Required) Unique identifier of the inventory configuration for the bucket.
+* `included_object_versions` - (Required) Object versions to include in the inventory list. Valid values: `All`, `Current`.
+* `schedule` - (Required) Specifies the schedule for generating inventory results (documented below).
+* `destination` - (Required) Contains information about where to publish the inventory results (documented below).
+* `enabled` - (Optional, Default: `true`) Specifies whether the inventory is enabled or disabled.
+* `filter` - (Optional) Specifies an inventory filter. The inventory only includes objects that meet the filter's criteria (documented below).
+* `optional_fields` - (Optional) List of optional fields that are included in the inventory results. Please refer to the S3 [documentation](https://docs.aws.amazon.com/AmazonS3/latest/API/API_InventoryConfiguration.html#AmazonS3-Type-InventoryConfiguration-OptionalFields) for more details.
+
+The `filter` configuration supports the following:
+
+* `prefix` - (Optional) Prefix that an object must have to be included in the inventory results.
+
+The `schedule` configuration supports the following:
+
+* `frequency` - (Required) Specifies how frequently inventory results are produced. Valid values: `Daily`, `Weekly`.
+
+The `destination` configuration supports the following:
+
+* `bucket` - (Required) S3 bucket configuration where inventory results are published (documented below).
+
+The `bucket` configuration supports the following:
+
+* `bucket_arn` - (Required) Amazon S3 bucket ARN of the destination.
+* `format` - (Required) Specifies the output format of the inventory results. Can be `CSV`, [`ORC`](https://orc.apache.org/) or [`Parquet`](https://parquet.apache.org/).
+* `account_id` - (Optional) ID of the account that owns the destination bucket. Recommended to be set to prevent problems if the destination bucket ownership changes.
+* `prefix` - (Optional) Prefix that is prepended to all inventory results.
+* `encryption` - (Optional) Contains the type of server-side encryption to use to encrypt the inventory (documented below).
+
+The `encryption` configuration supports the following:
+
+* `sse_kms` - (Optional) Specifies to use server-side encryption with AWS KMS-managed keys to encrypt the inventory file (documented below).
+* `sse_s3` - (Optional) Specifies to use server-side encryption with Amazon S3-managed keys (SSE-S3) to encrypt the inventory file.
+
+The `sse_kms` configuration supports the following:
+
+* `key_id` - (Required) ARN of the KMS customer master key (CMK) used to encrypt the inventory file.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import S3 bucket inventory configurations using `bucket:inventory`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import S3 bucket inventory configurations using `bucket:inventory`. For example:
+
+```console
+% terraform import aws_s3_bucket_inventory.my-bucket-entire-bucket my-bucket:EntireBucket
+```
+
+<!-- cache-key: cdktf-0.18.0 input-b32aad34f97db0c4f5b57fbaab467ab8861aa26c814563550d6c606734ebbc3c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/s3_bucket_lifecycle_configuration.html.markdown b/website/docs/cdktf/python/r/s3_bucket_lifecycle_configuration.html.markdown
new file mode 100644
index 00000000000..6b56bcf3401
--- /dev/null
+++ b/website/docs/cdktf/python/r/s3_bucket_lifecycle_configuration.html.markdown
@@ -0,0 +1,553 @@
+---
+subcategory: "S3 (Simple Storage)"
+layout: "aws"
+page_title: "AWS: aws_s3_bucket_lifecycle_configuration"
+description: |-
+  Provides a S3 bucket lifecycle configuration resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_s3_bucket_lifecycle_configuration
+
+Provides an independent configuration resource for S3 bucket [lifecycle configuration](https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lifecycle-mgmt.html).
+
+An S3 Lifecycle configuration consists of one or more Lifecycle rules. Each rule consists of the following:
+
+* Rule metadata (`id` and `status`)
+* [Filter](#filter) identifying objects to which the rule applies
+* One or more transition or expiration actions
+
+For more information see the Amazon S3 User Guide on [`Lifecycle Configuration Elements`](https://docs.aws.amazon.com/AmazonS3/latest/userguide/intro-lifecycle-rules.html).
+
+~> **NOTE:** S3 Buckets only support a single lifecycle configuration. Declaring multiple `aws_s3_bucket_lifecycle_configuration` resources to the same S3 Bucket will cause a perpetual difference in configuration.
+
+~> **NOTE:** Lifecycle configurations may take some time to fully propagate to all AWS S3 systems.
+Running Terraform operations shortly after creating a lifecycle configuration may result in changes that affect configuration idempotence.
+See the Amazon S3 User Guide on [setting lifecycle configuration on a bucket](https://docs.aws.amazon.com/AmazonS3/latest/userguide/how-to-set-lifecycle-configuration-intro.html).
+
+## Example Usage
+
+### With neither a filter nor prefix specified
+
+The Lifecycle rule applies to a subset of objects based on the key name prefix (`""`).
+
+This configuration is intended to replicate the default behavior of the `lifecycle_rule`
+parameter in the Terraform AWS Provider `aws_s3_bucket` resource prior to `v4.0`.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket_lifecycle_configuration import S3BucketLifecycleConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        S3BucketLifecycleConfiguration(self, "example",
+            bucket=bucket.id,
+            rule=[S3BucketLifecycleConfigurationRule(
+                id="rule-1",
+                status="Enabled"
+            )
+            ]
+        )
+```
+
+### Specifying an empty filter
+
+The Lifecycle rule applies to all objects in the bucket.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket_lifecycle_configuration import S3BucketLifecycleConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        S3BucketLifecycleConfiguration(self, "example",
+            bucket=bucket.id,
+            rule=[S3BucketLifecycleConfigurationRule(
+                filter=S3BucketLifecycleConfigurationRuleFilter(),
+                id="rule-1",
+                status="Enabled"
+            )
+            ]
+        )
+```
+
+### Specifying a filter using key prefixes
+
+The Lifecycle rule applies to a subset of objects based on the key name prefix (`logs/`).
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket_lifecycle_configuration import S3BucketLifecycleConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        S3BucketLifecycleConfiguration(self, "example",
+            bucket=bucket.id,
+            rule=[S3BucketLifecycleConfigurationRule(
+                filter=S3BucketLifecycleConfigurationRuleFilter(
+                    prefix="logs/"
+                ),
+                id="rule-1",
+                status="Enabled"
+            )
+            ]
+        )
+```
+
+If you want to apply a Lifecycle action to a subset of objects based on different key name prefixes, specify separate rules.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket_lifecycle_configuration import S3BucketLifecycleConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        S3BucketLifecycleConfiguration(self, "example",
+            bucket=bucket.id,
+            rule=[S3BucketLifecycleConfigurationRule(
+                filter=S3BucketLifecycleConfigurationRuleFilter(
+                    prefix="logs/"
+                ),
+                id="rule-1",
+                status="Enabled"
+            ), S3BucketLifecycleConfigurationRule(
+                filter=S3BucketLifecycleConfigurationRuleFilter(
+                    prefix="tmp/"
+                ),
+                id="rule-2",
+                status="Enabled"
+            )
+            ]
+        )
+```
+
+### Specifying a filter based on an object tag
+
+The Lifecycle rule specifies a filter based on a tag key and value. The rule then applies only to a subset of objects with the specific tag.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket_lifecycle_configuration import S3BucketLifecycleConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        S3BucketLifecycleConfiguration(self, "example",
+            bucket=bucket.id,
+            rule=[S3BucketLifecycleConfigurationRule(
+                filter=S3BucketLifecycleConfigurationRuleFilter(
+                    tag=S3BucketLifecycleConfigurationRuleFilterTag(
+                        key="Name",
+                        value="Staging"
+                    )
+                ),
+                id="rule-1",
+                status="Enabled"
+            )
+            ]
+        )
+```
+
+### Specifying a filter based on multiple tags
+
+The Lifecycle rule directs Amazon S3 to perform lifecycle actions on objects with two tags (with the specific tag keys and values). Notice `tags` is wrapped in the `and` configuration block.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket_lifecycle_configuration import S3BucketLifecycleConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        S3BucketLifecycleConfiguration(self, "example",
+            bucket=bucket.id,
+            rule=[S3BucketLifecycleConfigurationRule(
+                filter=S3BucketLifecycleConfigurationRuleFilter(
+                    and=S3BucketLifecycleConfigurationRuleFilterAnd(
+                        tags={
+                            "key1": "Value1",
+                            "key2": "Value2"
+                        }
+                    )
+                ),
+                id="rule-1",
+                status="Enabled"
+            )
+            ]
+        )
+```
+
+### Specifying a filter based on both prefix and one or more tags
+
+The Lifecycle rule directs Amazon S3 to perform lifecycle actions on objects with the specified prefix and two tags (with the specific tag keys and values). Notice both `prefix` and `tags` are wrapped in the `and` configuration block.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket_lifecycle_configuration import S3BucketLifecycleConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        S3BucketLifecycleConfiguration(self, "example",
+            bucket=bucket.id,
+            rule=[S3BucketLifecycleConfigurationRule(
+                filter=S3BucketLifecycleConfigurationRuleFilter(
+                    and=S3BucketLifecycleConfigurationRuleFilterAnd(
+                        prefix="logs/",
+                        tags={
+                            "key1": "Value1",
+                            "key2": "Value2"
+                        }
+                    )
+                ),
+                id="rule-1",
+                status="Enabled"
+            )
+            ]
+        )
+```
+
+### Specifying a filter based on object size
+
+Object size values are in bytes. Maximum filter size is 5TB. Some storage classes have minimum object size limitations, for more information, see [Comparing the Amazon S3 storage classes](https://docs.aws.amazon.com/AmazonS3/latest/userguide/storage-class-intro.html#sc-compare).
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket_lifecycle_configuration import S3BucketLifecycleConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        S3BucketLifecycleConfiguration(self, "example",
+            bucket=bucket.id,
+            rule=[S3BucketLifecycleConfigurationRule(
+                filter=S3BucketLifecycleConfigurationRuleFilter(
+                    object_size_greater_than=Token.as_string(500)
+                ),
+                id="rule-1",
+                status="Enabled"
+            )
+            ]
+        )
+```
+
+### Specifying a filter based on object size range and prefix
+
+The `object_size_greater_than` must be less than the `object_size_less_than`. Notice both the object size range and prefix are wrapped in the `and` configuration block.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket_lifecycle_configuration import S3BucketLifecycleConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        S3BucketLifecycleConfiguration(self, "example",
+            bucket=bucket.id,
+            rule=[S3BucketLifecycleConfigurationRule(
+                filter=S3BucketLifecycleConfigurationRuleFilter(
+                    and=S3BucketLifecycleConfigurationRuleFilterAnd(
+                        object_size_greater_than=500,
+                        object_size_less_than=64000,
+                        prefix="logs/"
+                    )
+                ),
+                id="rule-1",
+                status="Enabled"
+            )
+            ]
+        )
+```
+
+### Creating a Lifecycle Configuration for a bucket with versioning
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_acl import S3BucketAcl
+from imports.aws.s3_bucket_lifecycle_configuration import S3BucketLifecycleConfiguration
+from imports.aws.s3_bucket_versioning import S3BucketVersioningA
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        bucket = S3Bucket(self, "bucket",
+            bucket="my-bucket"
+        )
+        versioning_bucket = S3Bucket(self, "versioning_bucket",
+            bucket="my-versioning-bucket"
+        )
+        S3BucketAcl(self, "bucket_acl",
+            acl="private",
+            bucket=bucket.id
+        )
+        S3BucketAcl(self, "versioning_bucket_acl",
+            acl="private",
+            bucket=versioning_bucket.id
+        )
+        S3BucketLifecycleConfiguration(self, "bucket-config",
+            bucket=bucket.id,
+            rule=[S3BucketLifecycleConfigurationRule(
+                expiration=S3BucketLifecycleConfigurationRuleExpiration(
+                    days=90
+                ),
+                filter=S3BucketLifecycleConfigurationRuleFilter(
+                    and=S3BucketLifecycleConfigurationRuleFilterAnd(
+                        prefix="log/",
+                        tags={
+                            "autoclean": "true",
+                            "rule": "log"
+                        }
+                    )
+                ),
+                id="log",
+                status="Enabled",
+                transition=[S3BucketLifecycleConfigurationRuleTransition(
+                    days=30,
+                    storage_class="STANDARD_IA"
+                ), S3BucketLifecycleConfigurationRuleTransition(
+                    days=60,
+                    storage_class="GLACIER"
+                )
+                ]
+            ), S3BucketLifecycleConfigurationRule(
+                expiration=S3BucketLifecycleConfigurationRuleExpiration(
+                    date="2023-01-13T00:00:00Z"
+                ),
+                filter=S3BucketLifecycleConfigurationRuleFilter(
+                    prefix="tmp/"
+                ),
+                id="tmp",
+                status="Enabled"
+            )
+            ]
+        )
+        versioning = S3BucketVersioningA(self, "versioning",
+            bucket=versioning_bucket.id,
+            versioning_configuration=S3BucketVersioningVersioningConfiguration(
+                status="Enabled"
+            )
+        )
+        S3BucketLifecycleConfiguration(self, "versioning-bucket-config",
+            bucket=versioning_bucket.id,
+            depends_on=[versioning],
+            rule=[S3BucketLifecycleConfigurationRule(
+                filter=S3BucketLifecycleConfigurationRuleFilter(
+                    prefix="config/"
+                ),
+                id="config",
+                noncurrent_version_expiration=S3BucketLifecycleConfigurationRuleNoncurrentVersionExpiration(
+                    noncurrent_days=90
+                ),
+                noncurrent_version_transition=[S3BucketLifecycleConfigurationRuleNoncurrentVersionTransition(
+                    noncurrent_days=30,
+                    storage_class="STANDARD_IA"
+                ), S3BucketLifecycleConfigurationRuleNoncurrentVersionTransition(
+                    noncurrent_days=60,
+                    storage_class="GLACIER"
+                )
+                ],
+                status="Enabled"
+            )
+            ]
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `bucket` - (Required) Name of the source S3 bucket you want Amazon S3 to monitor.
+* `expected_bucket_owner` - (Optional) Account ID of the expected bucket owner. If the bucket is owned by a different account, the request will fail with an HTTP 403 (Access Denied) error.
+* `rule` - (Required) List of configuration blocks describing the rules managing the replication. [See below](#rule).
+
+### rule
+
+~> **NOTE:** The `filter` argument, while Optional, is required if the `rule` configuration block does not contain a `prefix` **and** you intend to override the default behavior of setting the rule to filter objects with the empty string prefix (`""`).
+Since `prefix` is deprecated by Amazon S3 and will be removed in the next major version of the Terraform AWS Provider, we recommend users either specify `filter` or leave both `filter` and `prefix` unspecified.
+
+~> **NOTE:** A rule cannot be updated from having a filter (via either the `rule.filter` parameter or when neither `rule.filter` and `rule.prefix` are specified) to only having a prefix via the `rule.prefix` parameter.
+
+~> **NOTE** Terraform cannot distinguish a difference between configurations that use `rule.filter {}` and configurations that neither use `rule.filter` nor `rule.prefix`, so a rule cannot be updated from applying to all objects in the bucket via `rule.filter {}` to applying to a subset of objects based on the key prefix `""` and vice versa.
+
+The `rule` configuration block supports the following arguments:
+
+* `abort_incomplete_multipart_upload` - (Optional) Configuration block that specifies the days since the initiation of an incomplete multipart upload that Amazon S3 will wait before permanently removing all parts of the upload. [See below](#abort_incomplete_multipart_upload).
+* `expiration` - (Optional) Configuration block that specifies the expiration for the lifecycle of the object in the form of date, days and, whether the object has a delete marker. [See below](#expiration).
+* `filter` - (Optional) Configuration block used to identify objects that a Lifecycle Rule applies to. [See below](#filter). If not specified, the `rule` will default to using `prefix`.
+* `id` - (Required) Unique identifier for the rule. The value cannot be longer than 255 characters.
+* `noncurrent_version_expiration` - (Optional) Configuration block that specifies when noncurrent object versions expire. [See below](#noncurrent_version_expiration).
+* `noncurrent_version_transition` - (Optional) Set of configuration blocks that specify the transition rule for the lifecycle rule that describes when noncurrent objects transition to a specific storage class. [See below](#noncurrent_version_transition).
+* `prefix` - (Optional) **DEPRECATED** Use `filter` instead. This has been deprecated by Amazon S3. Prefix identifying one or more objects to which the rule applies. Defaults to an empty string (`""`) if `filter` is not specified.
+* `status` - (Required) Whether the rule is currently being applied. Valid values: `Enabled` or `Disabled`.
+* `transition` - (Optional) Set of configuration blocks that specify when an Amazon S3 object transitions to a specified storage class. [See below](#transition).
+
+### abort_incomplete_multipart_upload
+
+The `abort_incomplete_multipart_upload` configuration block supports the following arguments:
+
+* `days_after_initiation` - Number of days after which Amazon S3 aborts an incomplete multipart upload.
+
+### expiration
+
+The `expiration` configuration block supports the following arguments:
+
+* `date` - (Optional) Date the object is to be moved or deleted. The date value must be in [RFC3339 full-date format](https://datatracker.ietf.org/doc/html/rfc3339#section-5.6) e.g. `2023-08-22`.
+* `days` - (Optional) Lifetime, in days, of the objects that are subject to the rule. The value must be a non-zero positive integer.
+* `expired_object_delete_marker` - (Optional, Conflicts with `date` and `days`) Indicates whether Amazon S3 will remove a delete marker with no noncurrent versions. If set to `true`, the delete marker will be expired; if set to `false` the policy takes no action.
+
+### filter
+
+~> **NOTE:** The `filter` configuration block must either be specified as the empty configuration block (`filter {}`) or with exactly one of `prefix`, `tag`, `and`, `object_size_greater_than` or `object_size_less_than` specified.
+
+The `filter` configuration block supports the following arguments:
+
+* `and`- (Optional) Configuration block used to apply a logical `AND` to two or more predicates. [See below](#and). The Lifecycle Rule will apply to any object matching all the predicates configured inside the `and` block.
+* `object_size_greater_than` - (Optional) Minimum object size (in bytes) to which the rule applies.
+* `object_size_less_than` - (Optional) Maximum object size (in bytes) to which the rule applies.
+* `prefix` - (Optional) Prefix identifying one or more objects to which the rule applies. Defaults to an empty string (`""`) if not specified.
+* `tag` - (Optional) Configuration block for specifying a tag key and value. [See below](#tag).
+
+### noncurrent_version_expiration
+
+The `noncurrent_version_expiration` configuration block supports the following arguments:
+
+* `newer_noncurrent_versions` - (Optional) Number of noncurrent versions Amazon S3 will retain. Must be a non-zero positive integer.
+* `noncurrent_days` - (Optional) Number of days an object is noncurrent before Amazon S3 can perform the associated action. Must be a positive integer.
+
+### noncurrent_version_transition
+
+The `noncurrent_version_transition` configuration block supports the following arguments:
+
+* `newer_noncurrent_versions` - (Optional) Number of noncurrent versions Amazon S3 will retain. Must be a non-zero positive integer.
+* `noncurrent_days` - (Optional) Number of days an object is noncurrent before Amazon S3 can perform the associated action.
+* `storage_class` - (Required) Class of storage used to store the object. Valid Values: `GLACIER`, `STANDARD_IA`, `ONEZONE_IA`, `INTELLIGENT_TIERING`, `DEEP_ARCHIVE`, `GLACIER_IR`.
+
+### transition
+
+The `transition` configuration block supports the following arguments:
+
+~> **Note:** Only one of `date` or `days` should be specified. If neither are specified, the `transition` will default to 0 `days`.
+
+* `date` - (Optional, Conflicts with `days`) Date objects are transitioned to the specified storage class. The date value must be in [RFC3339 full-date format](https://datatracker.ietf.org/doc/html/rfc3339#section-5.6) e.g. `2023-08-22`.
+* `days` - (Optional, Conflicts with `date`) Number of days after creation when objects are transitioned to the specified storage class. The value must be a positive integer. If both `days` and `date` are not specified, defaults to `0`. Valid values depend on `storage_class`, see [Transition objects using Amazon S3 Lifecycle](https://docs.aws.amazon.com/AmazonS3/latest/userguide/lifecycle-transition-general-considerations.html) for more details.
+* `storage_class` - Class of storage used to store the object. Valid Values: `GLACIER`, `STANDARD_IA`, `ONEZONE_IA`, `INTELLIGENT_TIERING`, `DEEP_ARCHIVE`, `GLACIER_IR`.
+
+### and
+
+The `and` configuration block supports the following arguments:
+
+* `object_size_greater_than` - (Optional) Minimum object size to which the rule applies. Value must be at least `0` if specified.
+* `object_size_less_than` - (Optional) Maximum object size to which the rule applies. Value must be at least `1` if specified.
+* `prefix` - (Optional) Prefix identifying one or more objects to which the rule applies.
+* `tags` - (Optional) Key-value map of resource tags. All of these tags must exist in the object's tag set in order for the rule to apply.
+
+### tag
+
+The `tag` configuration block supports the following arguments:
+
+* `key` - (Required) Name of the object key.
+* `value` - (Required) Value of the tag.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The `bucket` or `bucket` and `expected_bucket_owner` separated by a comma (`,`) if the latter is provided.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import S3 bucket lifecycle configuration using the `bucket` or using the `bucket` and `expected_bucket_owner` separated by a comma (`,`). For example:
+
+If the owner (account ID) of the source bucket is the same account used to configure the Terraform AWS Provider, import using the `bucket`:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+If the owner (account ID) of the source bucket differs from the account used to configure the Terraform AWS Provider, import using the `bucket` and `expected_bucket_owner` separated by a comma (`,`):
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+**Using `terraform import` to import** S3 bucket lifecycle configuration using the `bucket` or using the `bucket` and `expected_bucket_owner` separated by a comma (`,`). For example:
+
+If the owner (account ID) of the source bucket is the same account used to configure the Terraform AWS Provider, import using the `bucket`:
+
+```console
+% terraform import aws_s3_bucket_lifecycle_configuration.example bucket-name
+```
+
+If the owner (account ID) of the source bucket differs from the account used to configure the Terraform AWS Provider, import using the `bucket` and `expected_bucket_owner` separated by a comma (`,`):
+
+```console
+% terraform import aws_s3_bucket_lifecycle_configuration.example bucket-name,123456789012
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ebcc41b345ec5d3bba0fcf9e93a6e372a400f2139471f2e6a527ebe13fe61bd7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/s3_bucket_logging.html.markdown b/website/docs/cdktf/python/r/s3_bucket_logging.html.markdown
new file mode 100644
index 00000000000..b0dcd3dddc5
--- /dev/null
+++ b/website/docs/cdktf/python/r/s3_bucket_logging.html.markdown
@@ -0,0 +1,132 @@
+---
+subcategory: "S3 (Simple Storage)"
+layout: "aws"
+page_title: "AWS: aws_s3_bucket_logging"
+description: |-
+  Provides an S3 bucket (server access) logging resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_s3_bucket_logging
+
+Provides an S3 bucket (server access) logging resource. For more information, see [Logging requests using server access logging](https://docs.aws.amazon.com/AmazonS3/latest/userguide/ServerLogs.html)
+in the AWS S3 User Guide.
+
+~> **Note:** Amazon S3 supports server access logging, AWS CloudTrail, or a combination of both. Refer to the [Logging options for Amazon S3](https://docs.aws.amazon.com/AmazonS3/latest/userguide/logging-with-S3.html)
+to decide which method meets your requirements.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_acl import S3BucketAcl
+from imports.aws.s3_bucket_logging import S3BucketLoggingA
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = S3Bucket(self, "example",
+            bucket="my-tf-example-bucket"
+        )
+        log_bucket = S3Bucket(self, "log_bucket",
+            bucket="my-tf-log-bucket"
+        )
+        aws_s3_bucket_acl_example = S3BucketAcl(self, "example_2",
+            acl="private",
+            bucket=example.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_acl_example.override_logical_id("example")
+        S3BucketAcl(self, "log_bucket_acl",
+            acl="log-delivery-write",
+            bucket=log_bucket.id
+        )
+        aws_s3_bucket_logging_example = S3BucketLoggingA(self, "example_4",
+            bucket=example.id,
+            target_bucket=log_bucket.id,
+            target_prefix="log/"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_logging_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `bucket` - (Required, Forces new resource) Name of the bucket.
+* `expected_bucket_owner` - (Optional, Forces new resource) Account ID of the expected bucket owner.
+* `target_bucket` - (Required) Name of the bucket where you want Amazon S3 to store server access logs.
+* `target_prefix` - (Required) Prefix for all log object keys.
+* `target_grant` - (Optional) Set of configuration blocks with information for granting permissions. [See below](#target_grant).
+
+### target_grant
+
+The `target_grant` configuration block supports the following arguments:
+
+* `grantee` - (Required) Configuration block for the person being granted permissions. [See below](#grantee).
+* `permission` - (Required) Logging permissions assigned to the grantee for the bucket. Valid values: `FULL_CONTROL`, `READ`, `WRITE`.
+
+### grantee
+
+The `grantee` configuration block supports the following arguments:
+
+* `email_address` - (Optional) Email address of the grantee. See [Regions and Endpoints](https://docs.aws.amazon.com/general/latest/gr/rande.html#s3_region) for supported AWS regions where this argument can be specified.
+* `id` - (Optional) Canonical user ID of the grantee.
+* `type` - (Required) Type of grantee. Valid values: `CanonicalUser`, `AmazonCustomerByEmail`, `Group`.
+* `uri` - (Optional) URI of the grantee group.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The `bucket` or `bucket` and `expected_bucket_owner` separated by a comma (`,`) if the latter is provided.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import S3 bucket logging using the `bucket` or using the `bucket` and `expected_bucket_owner` separated by a comma (`,`). For example:
+
+If the owner (account ID) of the source bucket is the same account used to configure the Terraform AWS Provider, import using the `bucket`:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+If the owner (account ID) of the source bucket differs from the account used to configure the Terraform AWS Provider, import using the `bucket` and `expected_bucket_owner` separated by a comma (`,`):
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+**Using `terraform import` to import** S3 bucket logging using the `bucket` or using the `bucket` and `expected_bucket_owner` separated by a comma (`,`). For example:
+
+If the owner (account ID) of the source bucket is the same account used to configure the Terraform AWS Provider, import using the `bucket`:
+
+```console
+% terraform import aws_s3_bucket_logging.example bucket-name
+```
+
+If the owner (account ID) of the source bucket differs from the account used to configure the Terraform AWS Provider, import using the `bucket` and `expected_bucket_owner` separated by a comma (`,`):
+
+```console
+% terraform import aws_s3_bucket_logging.example bucket-name,123456789012
+```
+
+<!-- cache-key: cdktf-0.18.0 input-3cba2dd83f76e650304ea09cc4ee162c5bf05b0006a74f1eff49c0cb39bfcded -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/s3_bucket_metric.html.markdown b/website/docs/cdktf/python/r/s3_bucket_metric.html.markdown
new file mode 100644
index 00000000000..228708c695a
--- /dev/null
+++ b/website/docs/cdktf/python/r/s3_bucket_metric.html.markdown
@@ -0,0 +1,110 @@
+---
+subcategory: "S3 (Simple Storage)"
+layout: "aws"
+page_title: "AWS: aws_s3_bucket_metric"
+description: |-
+  Provides a S3 bucket metrics configuration resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_s3_bucket_metric
+
+Provides a S3 bucket [metrics configuration](http://docs.aws.amazon.com/AmazonS3/latest/dev/metrics-configurations.html) resource.
+
+## Example Usage
+
+### Add metrics configuration for entire S3 bucket
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_metric import S3BucketMetric
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = S3Bucket(self, "example",
+            bucket="example"
+        )
+        S3BucketMetric(self, "example-entire-bucket",
+            bucket=example.id,
+            name="EntireBucket"
+        )
+```
+
+### Add metrics configuration with S3 object filter
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_metric import S3BucketMetric
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = S3Bucket(self, "example",
+            bucket="example"
+        )
+        S3BucketMetric(self, "example-filtered",
+            bucket=example.id,
+            filter=S3BucketMetricFilter(
+                prefix="documents/",
+                tags={
+                    "class": "blue",
+                    "priority": "high"
+                }
+            ),
+            name="ImportantBlueDocuments"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `bucket` - (Required) Name of the bucket to put metric configuration.
+* `name` - (Required) Unique identifier of the metrics configuration for the bucket. Must be less than or equal to 64 characters in length.
+* `filter` - (Optional) [Object filtering](http://docs.aws.amazon.com/AmazonS3/latest/dev/metrics-configurations.html#metrics-configurations-filter) that accepts a prefix, tags, or a logical AND of prefix and tags (documented below).
+
+The `filter` metric configuration supports the following:
+
+~> **NOTE:** At least one of `prefix` or `tags` is required when specifying a `filter`
+
+* `prefix` - (Optional) Object prefix for filtering (singular).
+* `tags` - (Optional) Object tags for filtering (up to 10).
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import S3 bucket metric configurations using `bucket:metric`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import S3 bucket metric configurations using `bucket:metric`. For example:
+
+```console
+% terraform import aws_s3_bucket_metric.my-bucket-entire-bucket my-bucket:EntireBucket
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1091c69fa9fb93d148c9ff3885128f11e533b402052266873576f08369f6d546 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/s3_bucket_notification.html.markdown b/website/docs/cdktf/python/r/s3_bucket_notification.html.markdown
new file mode 100644
index 00000000000..22e2b470c93
--- /dev/null
+++ b/website/docs/cdktf/python/r/s3_bucket_notification.html.markdown
@@ -0,0 +1,444 @@
+---
+subcategory: "S3 (Simple Storage)"
+layout: "aws"
+page_title: "AWS: aws_s3_bucket_notification"
+description: |-
+  Manages a S3 Bucket Notification Configuration
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_s3_bucket_notification
+
+Manages a S3 Bucket Notification Configuration. For additional information, see the [Configuring S3 Event Notifications section in the Amazon S3 Developer Guide](https://docs.aws.amazon.com/AmazonS3/latest/dev/NotificationHowTo.html).
+
+~> **NOTE:** S3 Buckets only support a single notification configuration. Declaring multiple `aws_s3_bucket_notification` resources to the same S3 Bucket will cause a perpetual difference in configuration. See the example "Trigger multiple Lambda functions" for an option.
+
+## Example Usage
+
+### Add notification configuration to SNS Topic
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_notification import S3BucketNotification
+from imports.aws.sns_topic import SnsTopic
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        bucket = S3Bucket(self, "bucket",
+            bucket="your-bucket-name"
+        )
+        topic = DataAwsIamPolicyDocument(self, "topic",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["SNS:Publish"],
+                condition=[DataAwsIamPolicyDocumentStatementCondition(
+                    test="ArnLike",
+                    values=[bucket.arn],
+                    variable="aws:SourceArn"
+                )
+                ],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["s3.amazonaws.com"],
+                    type="Service"
+                )
+                ],
+                resources=["arn:aws:sns:*:*:s3-event-notification-topic"]
+            )
+            ]
+        )
+        aws_sns_topic_topic = SnsTopic(self, "topic_2",
+            name="s3-event-notification-topic",
+            policy=Token.as_string(topic.json)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_sns_topic_topic.override_logical_id("topic")
+        S3BucketNotification(self, "bucket_notification",
+            bucket=bucket.id,
+            topic=[S3BucketNotificationTopic(
+                events=["s3:ObjectCreated:*"],
+                filter_suffix=".log",
+                topic_arn=Token.as_string(aws_sns_topic_topic.arn)
+            )
+            ]
+        )
+```
+
+### Add notification configuration to SQS Queue
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_notification import S3BucketNotification
+from imports.aws.sqs_queue import SqsQueue
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        bucket = S3Bucket(self, "bucket",
+            bucket="your-bucket-name"
+        )
+        queue = DataAwsIamPolicyDocument(self, "queue",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["sqs:SendMessage"],
+                condition=[DataAwsIamPolicyDocumentStatementCondition(
+                    test="ArnEquals",
+                    values=[bucket.arn],
+                    variable="aws:SourceArn"
+                )
+                ],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["*"],
+                    type="*"
+                )
+                ],
+                resources=["arn:aws:sqs:*:*:s3-event-notification-queue"]
+            )
+            ]
+        )
+        aws_sqs_queue_queue = SqsQueue(self, "queue_2",
+            name="s3-event-notification-queue",
+            policy=Token.as_string(queue.json)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_sqs_queue_queue.override_logical_id("queue")
+        S3BucketNotification(self, "bucket_notification",
+            bucket=bucket.id,
+            queue=[S3BucketNotificationQueue(
+                events=["s3:ObjectCreated:*"],
+                filter_suffix=".log",
+                queue_arn=Token.as_string(aws_sqs_queue_queue.arn)
+            )
+            ]
+        )
+```
+
+### Add notification configuration to Lambda Function
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.iam_role import IamRole
+from imports.aws.lambda_function import LambdaFunction
+from imports.aws.lambda_permission import LambdaPermission
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_notification import S3BucketNotification
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        bucket = S3Bucket(self, "bucket",
+            bucket="your-bucket-name"
+        )
+        assume_role = DataAwsIamPolicyDocument(self, "assume_role",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["sts:AssumeRole"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["lambda.amazonaws.com"],
+                    type="Service"
+                )
+                ]
+            )
+            ]
+        )
+        iam_for_lambda = IamRole(self, "iam_for_lambda",
+            assume_role_policy=Token.as_string(assume_role.json),
+            name="iam_for_lambda"
+        )
+        func = LambdaFunction(self, "func",
+            filename="your-function.zip",
+            function_name="example_lambda_name",
+            handler="exports.example",
+            role=iam_for_lambda.arn,
+            runtime="go1.x"
+        )
+        allow_bucket = LambdaPermission(self, "allow_bucket",
+            action="lambda:InvokeFunction",
+            function_name=func.arn,
+            principal="s3.amazonaws.com",
+            source_arn=bucket.arn,
+            statement_id="AllowExecutionFromS3Bucket"
+        )
+        S3BucketNotification(self, "bucket_notification",
+            bucket=bucket.id,
+            depends_on=[allow_bucket],
+            lambda_function=[S3BucketNotificationLambdaFunction(
+                events=["s3:ObjectCreated:*"],
+                filter_prefix="AWSLogs/",
+                filter_suffix=".log",
+                lambda_function_arn=func.arn
+            )
+            ]
+        )
+```
+
+### Trigger multiple Lambda functions
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.iam_role import IamRole
+from imports.aws.lambda_function import LambdaFunction
+from imports.aws.lambda_permission import LambdaPermission
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_notification import S3BucketNotification
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        bucket = S3Bucket(self, "bucket",
+            bucket="your-bucket-name"
+        )
+        assume_role = DataAwsIamPolicyDocument(self, "assume_role",
+            actions=["sts:AssumeRole"],
+            effect="Allow",
+            principals=[{
+                "identifiers": ["lambda.amazonaws.com"],
+                "type": "Service"
+            }
+            ]
+        )
+        iam_for_lambda = IamRole(self, "iam_for_lambda",
+            assume_role_policy=Token.as_string(assume_role.json),
+            name="iam_for_lambda"
+        )
+        func1 = LambdaFunction(self, "func1",
+            filename="your-function1.zip",
+            function_name="example_lambda_name1",
+            handler="exports.example",
+            role=iam_for_lambda.arn,
+            runtime="go1.x"
+        )
+        func2 = LambdaFunction(self, "func2",
+            filename="your-function2.zip",
+            function_name="example_lambda_name2",
+            handler="exports.example",
+            role=iam_for_lambda.arn
+        )
+        allow_bucket1 = LambdaPermission(self, "allow_bucket1",
+            action="lambda:InvokeFunction",
+            function_name=func1.arn,
+            principal="s3.amazonaws.com",
+            source_arn=bucket.arn,
+            statement_id="AllowExecutionFromS3Bucket1"
+        )
+        allow_bucket2 = LambdaPermission(self, "allow_bucket2",
+            action="lambda:InvokeFunction",
+            function_name=func2.arn,
+            principal="s3.amazonaws.com",
+            source_arn=bucket.arn,
+            statement_id="AllowExecutionFromS3Bucket2"
+        )
+        S3BucketNotification(self, "bucket_notification",
+            bucket=bucket.id,
+            depends_on=[allow_bucket1, allow_bucket2],
+            lambda_function=[S3BucketNotificationLambdaFunction(
+                events=["s3:ObjectCreated:*"],
+                filter_prefix="AWSLogs/",
+                filter_suffix=".log",
+                lambda_function_arn=func1.arn
+            ), S3BucketNotificationLambdaFunction(
+                events=["s3:ObjectCreated:*"],
+                filter_prefix="OtherLogs/",
+                filter_suffix=".log",
+                lambda_function_arn=func2.arn
+            )
+            ]
+        )
+```
+
+### Add multiple notification configurations to SQS Queue
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_notification import S3BucketNotification
+from imports.aws.sqs_queue import SqsQueue
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        bucket = S3Bucket(self, "bucket",
+            bucket="your-bucket-name"
+        )
+        queue = DataAwsIamPolicyDocument(self, "queue",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["sqs:SendMessage"],
+                condition=[DataAwsIamPolicyDocumentStatementCondition(
+                    test="ArnEquals",
+                    values=[bucket.arn],
+                    variable="aws:SourceArn"
+                )
+                ],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["*"],
+                    type="*"
+                )
+                ],
+                resources=["arn:aws:sqs:*:*:s3-event-notification-queue"]
+            )
+            ]
+        )
+        aws_sqs_queue_queue = SqsQueue(self, "queue_2",
+            name="s3-event-notification-queue",
+            policy=Token.as_string(queue.json)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_sqs_queue_queue.override_logical_id("queue")
+        S3BucketNotification(self, "bucket_notification",
+            bucket=bucket.id,
+            queue=[S3BucketNotificationQueue(
+                events=["s3:ObjectCreated:*"],
+                filter_prefix="images/",
+                id="image-upload-event",
+                queue_arn=Token.as_string(aws_sqs_queue_queue.arn)
+            ), S3BucketNotificationQueue(
+                events=["s3:ObjectCreated:*"],
+                filter_prefix="videos/",
+                id="video-upload-event",
+                queue_arn=Token.as_string(aws_sqs_queue_queue.arn)
+            )
+            ]
+        )
+```
+
+For Terraform's [JSON syntax](https://www.terraform.io/docs/configuration/syntax.html), use an array instead of defining the `queue` key twice.
+
+```json
+{
+	"bucket": "${aws_s3_bucket.bucket.id}",
+	"queue": [
+		{
+			"id": "image-upload-event",
+			"queue_arn": "${aws_sqs_queue.queue.arn}",
+			"events": ["s3:ObjectCreated:*"],
+			"filter_prefix": "images/"
+		},
+		{
+			"id": "video-upload-event",
+			"queue_arn": "${aws_sqs_queue.queue.arn}",
+			"events": ["s3:ObjectCreated:*"],
+			"filter_prefix": "videos/"
+		}
+	]
+}
+```
+
+### Emit events to EventBridge
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_notification import S3BucketNotification
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        bucket = S3Bucket(self, "bucket",
+            bucket="your-bucket-name"
+        )
+        S3BucketNotification(self, "bucket_notification",
+            bucket=bucket.id,
+            eventbridge=True
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `bucket` - (Required) Name of the bucket for notification configuration.
+
+The following arguments are optional:
+
+* `eventbridge` - (Optional) Whether to enable Amazon EventBridge notifications. Defaults to `false`.
+* `lambda_function` - (Optional, Multiple) Used to configure notifications to a Lambda Function. See below.
+* `queue` - (Optional) Notification configuration to SQS Queue. See below.
+* `topic` - (Optional) Notification configuration to SNS Topic. See below.
+
+### `lambda_function`
+
+* `events` - (Required) [Event](http://docs.aws.amazon.com/AmazonS3/latest/dev/NotificationHowTo.html#notification-how-to-event-types-and-destinations) for which to send notifications.
+* `filter_prefix` - (Optional) Object key name prefix.
+* `filter_suffix` - (Optional) Object key name suffix.
+* `id` - (Optional) Unique identifier for each of the notification configurations.
+* `lambda_function_arn` - (Required) Lambda function ARN.
+
+### `queue`
+
+* `events` - (Required) Specifies [event](http://docs.aws.amazon.com/AmazonS3/latest/dev/NotificationHowTo.html#notification-how-to-event-types-and-destinations) for which to send notifications.
+* `filter_prefix` - (Optional) Object key name prefix.
+* `filter_suffix` - (Optional) Object key name suffix.
+* `id` - (Optional) Unique identifier for each of the notification configurations.
+* `queue_arn` - (Required) SQS queue ARN.
+
+### `topic`
+
+* `events` - (Required) [Event](http://docs.aws.amazon.com/AmazonS3/latest/dev/NotificationHowTo.html#notification-how-to-event-types-and-destinations) for which to send notifications.
+* `filter_prefix` - (Optional) Object key name prefix.
+* `filter_suffix` - (Optional) Object key name suffix.
+* `id` - (Optional) Unique identifier for each of the notification configurations.
+* `topic_arn` - (Required) SNS topic ARN.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import S3 bucket notification using the `bucket`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import S3 bucket notification using the `bucket`. For example:
+
+```console
+% terraform import aws_s3_bucket_notification.bucket_notification bucket-name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-2b3d5922ed8d8483ab9bf6365c4cf548c1d93fbe385ee90435be6dfab425db07 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/s3_bucket_object.html.markdown b/website/docs/cdktf/python/r/s3_bucket_object.html.markdown
new file mode 100644
index 00000000000..98a68e8f154
--- /dev/null
+++ b/website/docs/cdktf/python/r/s3_bucket_object.html.markdown
@@ -0,0 +1,279 @@
+---
+subcategory: "S3 (Simple Storage)"
+layout: "aws"
+page_title: "AWS: aws_s3_bucket_object"
+description: |-
+  Provides an S3 object resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_s3_bucket_object
+
+~> **NOTE:** The `aws_s3_bucket_object` resource is DEPRECATED and will be removed in a future version! Use `aws_s3_object` instead, where new features and fixes will be added. When replacing `aws_s3_bucket_object` with `aws_s3_object` in your configuration, on the next apply, Terraform will recreate the object. If you prefer to not have Terraform recreate the object, import the object using `aws_s3_object`.
+
+Provides an S3 object resource.
+
+## Example Usage
+
+### Uploading a file to a bucket
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket_object import S3BucketObject
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        S3BucketObject(self, "object",
+            bucket="your_bucket_name",
+            etag=Token.as_string(Fn.filemd5("path/to/file")),
+            key="new_object_key",
+            source="path/to/file"
+        )
+```
+
+### Encrypting with KMS Key
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.kms_key import KmsKey
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_acl import S3BucketAcl
+from imports.aws.s3_bucket_object import S3BucketObject
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        examplekms = KmsKey(self, "examplekms",
+            deletion_window_in_days=7,
+            description="KMS key 1"
+        )
+        examplebucket = S3Bucket(self, "examplebucket",
+            bucket="examplebuckettftest"
+        )
+        S3BucketAcl(self, "example",
+            acl="private",
+            bucket=examplebucket.id
+        )
+        aws_s3_bucket_object_example = S3BucketObject(self, "example_3",
+            bucket=examplebucket.id,
+            key="someobject",
+            kms_key_id=examplekms.arn,
+            source="index.html"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_object_example.override_logical_id("example")
+```
+
+### Server Side Encryption with S3 Default Master Key
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_acl import S3BucketAcl
+from imports.aws.s3_bucket_object import S3BucketObject
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        examplebucket = S3Bucket(self, "examplebucket",
+            bucket="examplebuckettftest"
+        )
+        S3BucketAcl(self, "example",
+            acl="private",
+            bucket=examplebucket.id
+        )
+        aws_s3_bucket_object_example = S3BucketObject(self, "example_2",
+            bucket=examplebucket.id,
+            key="someobject",
+            server_side_encryption="aws:kms",
+            source="index.html"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_object_example.override_logical_id("example")
+```
+
+### Server Side Encryption with AWS-Managed Key
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_acl import S3BucketAcl
+from imports.aws.s3_bucket_object import S3BucketObject
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        examplebucket = S3Bucket(self, "examplebucket",
+            bucket="examplebuckettftest"
+        )
+        S3BucketAcl(self, "example",
+            acl="private",
+            bucket=examplebucket.id
+        )
+        aws_s3_bucket_object_example = S3BucketObject(self, "example_2",
+            bucket=examplebucket.id,
+            key="someobject",
+            server_side_encryption="AES256",
+            source="index.html"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_object_example.override_logical_id("example")
+```
+
+### S3 Object Lock
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_acl import S3BucketAcl
+from imports.aws.s3_bucket_object import S3BucketObject
+from imports.aws.s3_bucket_versioning import S3BucketVersioningA
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        examplebucket = S3Bucket(self, "examplebucket",
+            bucket="examplebuckettftest",
+            object_lock_enabled=True
+        )
+        S3BucketAcl(self, "example",
+            acl="private",
+            bucket=examplebucket.id
+        )
+        aws_s3_bucket_versioning_example = S3BucketVersioningA(self, "example_2",
+            bucket=examplebucket.id,
+            versioning_configuration=S3BucketVersioningVersioningConfiguration(
+                status="Enabled"
+            )
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_versioning_example.override_logical_id("example")
+        aws_s3_bucket_object_example = S3BucketObject(self, "example_3",
+            bucket=examplebucket.id,
+            depends_on=[aws_s3_bucket_versioning_example],
+            force_destroy=True,
+            key="someobject",
+            object_lock_legal_hold_status="ON",
+            object_lock_mode="GOVERNANCE",
+            object_lock_retain_until_date="2021-12-31T23:59:60Z",
+            source="important.txt"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_object_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+-> **Note:** If you specify `content_encoding` you are responsible for encoding the body appropriately. `source`, `content`, and `content_base64` all expect already encoded/compressed bytes.
+
+The following arguments are required:
+
+* `bucket` - (Required) Name of the bucket to put the file in. Alternatively, an [S3 access point](https://docs.aws.amazon.com/AmazonS3/latest/dev/using-access-points.html) ARN can be specified.
+* `key` - (Required) Name of the object once it is in the bucket.
+
+The following arguments are optional:
+
+* `acl` - (Optional) [Canned ACL](https://docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html#canned-acl) to apply. Valid values are `private`, `public-read`, `public-read-write`, `aws-exec-read`, `authenticated-read`, `bucket-owner-read`, and `bucket-owner-full-control`. Defaults to `private`.
+* `bucket_key_enabled` - (Optional) Whether or not to use [Amazon S3 Bucket Keys](https://docs.aws.amazon.com/AmazonS3/latest/dev/bucket-key.html) for SSE-KMS.
+* `cache_control` - (Optional) Caching behavior along the request/reply chain Read [w3c cache_control](http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.9) for further details.
+* `content_base64` - (Optional, conflicts with `source` and `content`) Base64-encoded data that will be decoded and uploaded as raw bytes for the object content. This allows safely uploading non-UTF8 binary data, but is recommended only for small content such as the result of the `gzipbase64` function with small text strings. For larger objects, use `source` to stream the content from a disk file.
+* `content_disposition` - (Optional) Presentational information for the object. Read [w3c content_disposition](http://www.w3.org/Protocols/rfc2616/rfc2616-sec19.html#sec19.5.1) for further information.
+* `content_encoding` - (Optional) Content encodings that have been applied to the object and thus what decoding mechanisms must be applied to obtain the media-type referenced by the Content-Type header field. Read [w3c content encoding](http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.11) for further information.
+* `content_language` - (Optional) Language the content is in e.g., en-US or en-GB.
+* `content_type` - (Optional) Standard MIME type describing the format of the object data, e.g., application/octet-stream. All Valid MIME Types are valid for this input.
+* `content` - (Optional, conflicts with `source` and `content_base64`) Literal string value to use as the object content, which will be uploaded as UTF-8-encoded text.
+* `etag` - (Optional) Triggers updates when the value changes. The only meaningful value is `filemd5("path/to/file")` (Terraform 0.11.12 or later) or `${md5(file("path/to/file"))}` (Terraform 0.11.11 or earlier). This attribute is not compatible with KMS encryption, `kms_key_id` or `server_side_encryption = "aws:kms"` (see `source_hash` instead).
+* `force_destroy` - (Optional) Whether to allow the object to be deleted by removing any legal hold on any object version. Default is `false`. This value should be set to `true` only if the bucket has S3 object lock enabled.
+* `kms_key_id` - (Optional) ARN of the KMS Key to use for object encryption. If the S3 Bucket has server-side encryption enabled, that value will automatically be used. If referencing the `aws_kms_key` resource, use the `arn` attribute. If referencing the `aws_kms_alias` data source or resource, use the `target_key_arn` attribute. Terraform will only perform drift detection if a configuration value is provided.
+* `metadata` - (Optional) Map of keys/values to provision metadata (will be automatically prefixed by `x-amz-meta-`, note that only lowercase label are currently supported by the AWS Go API).
+* `object_lock_legal_hold_status` - (Optional) [Legal hold](https://docs.aws.amazon.com/AmazonS3/latest/dev/object-lock-overview.html#object-lock-legal-holds) status that you want to apply to the specified object. Valid values are `ON` and `OFF`.
+* `object_lock_mode` - (Optional) Object lock [retention mode](https://docs.aws.amazon.com/AmazonS3/latest/dev/object-lock-overview.html#object-lock-retention-modes) that you want to apply to this object. Valid values are `GOVERNANCE` and `COMPLIANCE`.
+* `object_lock_retain_until_date` - (Optional) Date and time, in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8), when this object's object lock will [expire](https://docs.aws.amazon.com/AmazonS3/latest/dev/object-lock-overview.html#object-lock-retention-periods).
+* `server_side_encryption` - (Optional) Server-side encryption of the object in S3. Valid values are "`AES256`" and "`aws:kms`".
+* `source_hash` - (Optional) Triggers updates like `etag` but useful to address `etag` encryption limitations. Set using `filemd5("path/to/source")` (Terraform 0.11.12 or later). (The value is only stored in state and not saved by AWS.)
+* `source` - (Optional, conflicts with `content` and `content_base64`) Path to a file that will be read and uploaded as raw bytes for the object content.
+* `storage_class` - (Optional) [Storage Class](https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutObject.html#AmazonS3-PutObject-request-header-StorageClass) for the object. Defaults to "`STANDARD`".
+* `tags` - (Optional) Map of tags to assign to the object. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `website_redirect` - (Optional) Target URL for [website redirect](http://docs.aws.amazon.com/AmazonS3/latest/dev/how-to-page-redirect.html).
+
+If no content is provided through `source`, `content` or `content_base64`, then the object will be empty.
+
+-> **Note:** Terraform ignores all leading `/`s in the object's `key` and treats multiple `/`s in the rest of the object's `key` as a single `/`, so values of `/index.html` and `index.html` correspond to the same S3 object as do `first//second///third//` and `first/second/third/`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `etag` - ETag generated for the object (an MD5 sum of the object content). For plaintext objects or objects encrypted with an AWS-managed key, the hash is an MD5 digest of the object data. For objects encrypted with a KMS key or objects created by either the Multipart Upload or Part Copy operation, the hash is not an MD5 digest, regardless of the method of encryption. More information on possible values can be found on [Common Response Headers](https://docs.aws.amazon.com/AmazonS3/latest/API/RESTCommonResponseHeaders.html).
+* `id` - `key` of the resource supplied above
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `version_id` - Unique version ID value for the object, if bucket versioning is enabled.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import objects using the `id` or S3 URL. For example:
+
+Import using the `id`, which is the bucket name and the key together:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Import using S3 URL syntax:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+**Using `terraform import` to import** objects using the `id` or S3 URL. For example:
+
+Import using the `id`, which is the bucket name and the key together:
+
+```console
+% terraform import aws_s3_bucket_object.example some-bucket-name/some/key.txt
+```
+
+Import using S3 URL syntax:
+
+```console
+% terraform import aws_s3_bucket_object.example s3://some-bucket-name/some/key.txt
+```
+
+<!-- cache-key: cdktf-0.18.0 input-14589e1ae162949ae3f6416dd42328f66eec724846549bb78e39459ea85cd9c1 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/s3_bucket_object_lock_configuration.html.markdown b/website/docs/cdktf/python/r/s3_bucket_object_lock_configuration.html.markdown
new file mode 100644
index 00000000000..d3dfe719a98
--- /dev/null
+++ b/website/docs/cdktf/python/r/s3_bucket_object_lock_configuration.html.markdown
@@ -0,0 +1,185 @@
+---
+subcategory: "S3 (Simple Storage)"
+layout: "aws"
+page_title: "AWS: aws_s3_bucket_object_lock_configuration"
+description: |-
+  Provides an S3 bucket Object Lock configuration resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_s3_bucket_object_lock_configuration
+
+Provides an S3 bucket Object Lock configuration resource. For more information about Object Locking, go to [Using S3 Object Lock](https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock.html) in the Amazon S3 User Guide.
+
+~> **NOTE:** This resource **does not enable** Object Lock for **new** buckets. It configures a default retention period for objects placed in the specified bucket.
+Thus, to **enable** Object Lock for a **new** bucket, see the [Using object lock configuration](s3_bucket.html.markdown#using-object-lock-configuration) section in  the `aws_s3_bucket` resource or the [Object Lock configuration for a new bucket](#object-lock-configuration-for-a-new-bucket) example below.
+If you want to **enable** Object Lock for an **existing** bucket, contact AWS Support and see the [Object Lock configuration for an existing bucket](#object-lock-configuration-for-an-existing-bucket) example below.
+
+## Example Usage
+
+### Object Lock configuration for a new bucket
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_object_lock_configuration import S3BucketObjectLockConfigurationA
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = S3Bucket(self, "example",
+            bucket="mybucket",
+            object_lock_enabled=True
+        )
+        aws_s3_bucket_object_lock_configuration_example =
+        S3BucketObjectLockConfigurationA(self, "example_1",
+            bucket=example.id,
+            rule=S3BucketObjectLockConfigurationRuleA(
+                default_retention=S3BucketObjectLockConfigurationRuleDefaultRetentionA(
+                    days=5,
+                    mode="COMPLIANCE"
+                )
+            )
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_object_lock_configuration_example.override_logical_id("example")
+```
+
+### Object Lock configuration for an existing bucket
+
+This is a multistep process that requires AWS Support intervention.
+
+1. Enable versioning on your S3 bucket, if you have not already done so.
+Doing so will generate an "Object Lock token" in the back-end.
+
+<!-- markdownlint-disable MD029 -->
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_versioning import S3BucketVersioningA
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = S3Bucket(self, "example",
+            bucket="mybucket"
+        )
+        aws_s3_bucket_versioning_example = S3BucketVersioningA(self, "example_1",
+            bucket=example.id,
+            versioning_configuration=S3BucketVersioningVersioningConfiguration(
+                status="Enabled"
+            )
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_versioning_example.override_logical_id("example")
+```
+<!-- markdownlint-disable MD029 -->
+
+2. Contact AWS Support to provide you with the "Object Lock token" for the specified bucket and use the token (or token ID) within your new `aws_s3_bucket_object_lock_configuration` resource.
+   Notice the `object_lock_enabled` argument does not need to be specified as it defaults to `Enabled`.
+
+<!-- markdownlint-disable MD029 -->
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket_object_lock_configuration import S3BucketObjectLockConfigurationA
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        S3BucketObjectLockConfigurationA(self, "example",
+            bucket=Token.as_string(aws_s3_bucket_example.id),
+            rule=S3BucketObjectLockConfigurationRuleA(
+                default_retention=S3BucketObjectLockConfigurationRuleDefaultRetentionA(
+                    days=5,
+                    mode="COMPLIANCE"
+                )
+            ),
+            token="NG2MKsfoLqV3A+aquXneSG4LOu/ekrlXkRXwIPFVfERT7XOPos+/k444d7RIH0E3W3p5QU6ml2exS2F/eYCFmMWHJ3hFZGk6al1sIJkmNhUMYmsv0jYVQyTTZNLM+DnfooA6SATt39mM1VW1yJh4E+XljMlWzaBwHKbss3/EjlGDjOmVhaSs4Z6427mMCaFD0RLwsYY7zX49gEc31YfOMJGxbXCXSeyNwAhhM/A8UH7gQf38RmjHjjAFbbbLtl8arsxTPW8F1IYohqwmKIr9DnotLLj8Tg44U2SPwujVaqmlKKP9s41rfgb4UbIm7khSafDBng0LGfxC4pMlT9Ny2w=="
+        )
+```
+<!-- markdownlint-disable MD029 -->
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `bucket` - (Required, Forces new resource) Name of the bucket.
+* `expected_bucket_owner` - (Optional, Forces new resource) Account ID of the expected bucket owner.
+* `object_lock_enabled` - (Optional, Forces new resource) Indicates whether this bucket has an Object Lock configuration enabled. Defaults to `Enabled`. Valid values: `Enabled`.
+* `rule` - (Optional) Configuration block for specifying the Object Lock rule for the specified object. [See below](#rule).
+* `token` - (Optional) Token to allow Object Lock to be enabled for an existing bucket. You must contact AWS support for the bucket's "Object Lock token".
+The token is generated in the back-end when [versioning](https://docs.aws.amazon.com/AmazonS3/latest/userguide/manage-versioning-examples.html) is enabled on a bucket. For more details on versioning, see the [`aws_s3_bucket_versioning` resource](s3_bucket_versioning.html.markdown).
+
+### rule
+
+The `rule` configuration block supports the following arguments:
+
+* `default_retention` - (Required) Configuration block for specifying the default Object Lock retention settings for new objects placed in the specified bucket. [See below](#default_retention).
+
+### default_retention
+
+The `default_retention` configuration block supports the following arguments:
+
+* `days` - (Optional, Required if `years` is not specified) Number of days that you want to specify for the default retention period.
+* `mode` - (Required) Default Object Lock retention mode you want to apply to new objects placed in the specified bucket. Valid values: `COMPLIANCE`, `GOVERNANCE`.
+* `years` - (Optional, Required if `days` is not specified) Number of years that you want to specify for the default retention period.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The `bucket` or `bucket` and `expected_bucket_owner` separated by a comma (`,`) if the latter is provided.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import S3 bucket Object Lock configuration using the `bucket` or using the `bucket` and `expected_bucket_owner` separated by a comma (`,`). For example:
+
+If the owner (account ID) of the source bucket is the same account used to configure the Terraform AWS Provider, import using the `bucket`:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+If the owner (account ID) of the source bucket differs from the account used to configure the Terraform AWS Provider, import using the `bucket` and `expected_bucket_owner` separated by a comma (`,`):
+
+import {
+  to = aws_s3_bucket_object_lock_configuration.example
+  id = "bucket-name,123456789012"
+}
+
+**Using `terraform import` to import** S3 bucket Object Lock configuration using the `bucket` or using the `bucket` and `expected_bucket_owner` separated by a comma (`,`). For example:
+
+If the owner (account ID) of the source bucket is the same account used to configure the Terraform AWS Provider, import using the `bucket`:
+
+```console
+% terraform import aws_s3_bucket_object_lock_configuration.example bucket-name
+```
+
+If the owner (account ID) of the source bucket differs from the account used to configure the Terraform AWS Provider, import using the `bucket` and `expected_bucket_owner` separated by a comma (`,`):
+
+```console
+% terraform import aws_s3_bucket_object_lock_configuration.example bucket-name,123456789012
+```
+
+<!-- cache-key: cdktf-0.18.0 input-48934903e4041e09bace32f0ac7c06d12e2ec061fd285d0370242e8daf326808 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/s3_bucket_ownership_controls.html.markdown b/website/docs/cdktf/python/r/s3_bucket_ownership_controls.html.markdown
new file mode 100644
index 00000000000..475ec6f407d
--- /dev/null
+++ b/website/docs/cdktf/python/r/s3_bucket_ownership_controls.html.markdown
@@ -0,0 +1,84 @@
+---
+subcategory: "S3 (Simple Storage)"
+layout: "aws"
+page_title: "AWS: aws_s3_bucket_ownership_controls"
+description: |-
+  Manages S3 Bucket Ownership Controls.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_s3_bucket_ownership_controls
+
+Provides a resource to manage S3 Bucket Ownership Controls. For more information, see the [S3 Developer Guide](https://docs.aws.amazon.com/AmazonS3/latest/dev/about-object-ownership.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_ownership_controls import S3BucketOwnershipControls
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = S3Bucket(self, "example",
+            bucket="example"
+        )
+        aws_s3_bucket_ownership_controls_example = S3BucketOwnershipControls(self, "example_1",
+            bucket=example.id,
+            rule=S3BucketOwnershipControlsRule(
+                object_ownership="BucketOwnerPreferred"
+            )
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_ownership_controls_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `bucket` - (Required) Name of the bucket that you want to associate this access point with.
+* `rule` - (Required) Configuration block(s) with Ownership Controls rules. Detailed below.
+
+### rule Configuration Block
+
+The following arguments are required:
+
+* `object_ownership` - (Required) Object ownership. Valid values: `BucketOwnerPreferred`, `ObjectWriter` or `BucketOwnerEnforced`
+    * `BucketOwnerPreferred` - Objects uploaded to the bucket change ownership to the bucket owner if the objects are uploaded with the `bucket-owner-full-control` canned ACL.
+    * `ObjectWriter` - Uploading account will own the object if the object is uploaded with the `bucket-owner-full-control` canned ACL.
+    * `BucketOwnerEnforced` - Bucket owner automatically owns and has full control over every object in the bucket. ACLs no longer affect permissions to data in the S3 bucket.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - S3 Bucket name.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import S3 Bucket Ownership Controls using S3 Bucket name. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import S3 Bucket Ownership Controls using S3 Bucket name. For example:
+
+```console
+% terraform import aws_s3_bucket_ownership_controls.example my-bucket
+```
+
+<!-- cache-key: cdktf-0.18.0 input-efb4f4321500cf116368caed3eeb4a2c9b6076d8246ed5f36076a0ed3015eaff -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/s3_bucket_policy.html.markdown b/website/docs/cdktf/python/r/s3_bucket_policy.html.markdown
new file mode 100644
index 00000000000..c84da739e83
--- /dev/null
+++ b/website/docs/cdktf/python/r/s3_bucket_policy.html.markdown
@@ -0,0 +1,86 @@
+---
+subcategory: "S3 (Simple Storage)"
+layout: "aws"
+page_title: "AWS: aws_s3_bucket_policy"
+description: |-
+  Attaches a policy to an S3 bucket resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_s3_bucket_policy
+
+Attaches a policy to an S3 bucket resource.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_policy import S3BucketPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = S3Bucket(self, "example",
+            bucket="my-tf-test-bucket"
+        )
+        allow_access_from_another_account = DataAwsIamPolicyDocument(self, "allow_access_from_another_account",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["s3:GetObject", "s3:ListBucket"],
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["123456789012"],
+                    type="AWS"
+                )
+                ],
+                resources=[example.arn, "${" + example.arn + "}/*"]
+            )
+            ]
+        )
+        aws_s3_bucket_policy_allow_access_from_another_account = S3BucketPolicy(self, "allow_access_from_another_account_2",
+            bucket=example.id,
+            policy=Token.as_string(allow_access_from_another_account.json)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_policy_allow_access_from_another_account.override_logical_id("allow_access_from_another_account")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `bucket` - (Required) Name of the bucket to which to apply the policy.
+* `policy` - (Required) Text of the policy. Although this is a bucket policy rather than an IAM policy, the [`aws_iam_policy_document`](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) data source may be used, so long as it specifies a principal. For more information about building AWS IAM policy documents with Terraform, see the [AWS IAM Policy Document Guide](https://learn.hashicorp.com/terraform/aws/iam-policy). Note: Bucket policies are limited to 20 KB in size.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import S3 bucket policies using the bucket name. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import S3 bucket policies using the bucket name. For example:
+
+```console
+% terraform import aws_s3_bucket_policy.allow_access_from_another_account my-tf-test-bucket
+```
+
+<!-- cache-key: cdktf-0.18.0 input-78dda90d0687f88ff8f30cf20c2b7dab5c85cc20a65eb0998240609b14380055 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/s3_bucket_public_access_block.html.markdown b/website/docs/cdktf/python/r/s3_bucket_public_access_block.html.markdown
new file mode 100644
index 00000000000..0db8e666bd4
--- /dev/null
+++ b/website/docs/cdktf/python/r/s3_bucket_public_access_block.html.markdown
@@ -0,0 +1,84 @@
+---
+subcategory: "S3 (Simple Storage)"
+layout: "aws"
+page_title: "AWS: aws_s3_bucket_public_access_block"
+description: |-
+  Manages S3 bucket-level Public Access Block Configuration
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_s3_bucket_public_access_block
+
+Manages S3 bucket-level Public Access Block configuration. For more information about these settings, see the [AWS S3 Block Public Access documentation](https://docs.aws.amazon.com/AmazonS3/latest/dev/access-control-block-public-access.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_public_access_block import S3BucketPublicAccessBlock
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = S3Bucket(self, "example",
+            bucket="example"
+        )
+        aws_s3_bucket_public_access_block_example = S3BucketPublicAccessBlock(self, "example_1",
+            block_public_acls=True,
+            block_public_policy=True,
+            bucket=example.id,
+            ignore_public_acls=True,
+            restrict_public_buckets=True
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_public_access_block_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `bucket` - (Required) S3 Bucket to which this Public Access Block configuration should be applied.
+* `block_public_acls` - (Optional) Whether Amazon S3 should block public ACLs for this bucket. Defaults to `false`. Enabling this setting does not affect existing policies or ACLs. When set to `true` causes the following behavior:
+    * PUT Bucket acl and PUT Object acl calls will fail if the specified ACL allows public access.
+    * PUT Object calls will fail if the request includes an object ACL.
+* `block_public_policy` - (Optional) Whether Amazon S3 should block public bucket policies for this bucket. Defaults to `false`. Enabling this setting does not affect the existing bucket policy. When set to `true` causes Amazon S3 to:
+    * Reject calls to PUT Bucket policy if the specified bucket policy allows public access.
+* `ignore_public_acls` - (Optional) Whether Amazon S3 should ignore public ACLs for this bucket. Defaults to `false`. Enabling this setting does not affect the persistence of any existing ACLs and doesn't prevent new public ACLs from being set. When set to `true` causes Amazon S3 to:
+    * Ignore public ACLs on this bucket and any objects that it contains.
+* `restrict_public_buckets` - (Optional) Whether Amazon S3 should restrict public bucket policies for this bucket. Defaults to `false`. Enabling this setting does not affect the previously stored bucket policy, except that public and cross-account access within the public bucket policy, including non-public delegation to specific accounts, is blocked. When set to `true`:
+    * Only the bucket owner and AWS Services can access this buckets if it has a public policy.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Name of the S3 bucket the configuration is attached to
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_s3_bucket_public_access_block` using the bucket name. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_s3_bucket_public_access_block` using the bucket name. For example:
+
+```console
+% terraform import aws_s3_bucket_public_access_block.example my-bucket
+```
+
+<!-- cache-key: cdktf-0.18.0 input-2e16c719c6f0cfe951257236cc5f5c735596db2bb7566ee8238215516c15c3f7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/s3_bucket_replication_configuration.html.markdown b/website/docs/cdktf/python/r/s3_bucket_replication_configuration.html.markdown
new file mode 100644
index 00000000000..8ff22cfaf26
--- /dev/null
+++ b/website/docs/cdktf/python/r/s3_bucket_replication_configuration.html.markdown
@@ -0,0 +1,455 @@
+---
+subcategory: "S3 (Simple Storage)"
+layout: "aws"
+page_title: "AWS: aws_s3_bucket_replication_configuration"
+description: |-
+  Provides a S3 bucket replication configuration resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_s3_bucket_replication_configuration
+
+Provides an independent configuration resource for S3 bucket [replication configuration](http://docs.aws.amazon.com/AmazonS3/latest/dev/crr.html).
+
+~> **NOTE:** S3 Buckets only support a single replication configuration. Declaring multiple `aws_s3_bucket_replication_configuration` resources to the same S3 Bucket will cause a perpetual difference in configuration.
+
+## Example Usage
+
+### Using replication configuration
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.iam_policy import IamPolicy
+from imports.aws.iam_role import IamRole
+from imports.aws.iam_role_policy_attachment import IamRolePolicyAttachment
+from imports.aws.provider import AwsProvider
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_acl import S3BucketAcl
+from imports.aws.s3_bucket_replication_configuration import S3BucketReplicationConfigurationA
+from imports.aws.s3_bucket_versioning import S3BucketVersioningA
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AwsProvider(self, "aws",
+            region="eu-west-1"
+        )
+        central = AwsProvider(self, "aws_1",
+            alias="central",
+            region="eu-central-1"
+        )
+        destination = S3Bucket(self, "destination",
+            bucket="tf-test-bucket-destination-12345"
+        )
+        source = S3Bucket(self, "source",
+            bucket="tf-test-bucket-source-12345",
+            provider=central
+        )
+        S3BucketAcl(self, "source_bucket_acl",
+            acl="private",
+            bucket=source.id,
+            provider=central
+        )
+        aws_s3_bucket_versioning_destination = S3BucketVersioningA(self, "destination_5",
+            bucket=destination.id,
+            versioning_configuration=S3BucketVersioningVersioningConfiguration(
+                status="Enabled"
+            )
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_versioning_destination.override_logical_id("destination")
+        aws_s3_bucket_versioning_source = S3BucketVersioningA(self, "source_6",
+            bucket=source.id,
+            provider=central,
+            versioning_configuration=S3BucketVersioningVersioningConfiguration(
+                status="Enabled"
+            )
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_versioning_source.override_logical_id("source")
+        assume_role = DataAwsIamPolicyDocument(self, "assume_role",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["sts:AssumeRole"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["s3.amazonaws.com"],
+                    type="Service"
+                )
+                ]
+            )
+            ]
+        )
+        replication = DataAwsIamPolicyDocument(self, "replication",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["s3:GetReplicationConfiguration", "s3:ListBucket"],
+                effect="Allow",
+                resources=[source.arn]
+            ), DataAwsIamPolicyDocumentStatement(
+                actions=["s3:GetObjectVersionForReplication", "s3:GetObjectVersionAcl", "s3:GetObjectVersionTagging"
+                ],
+                effect="Allow",
+                resources=["${" + source.arn + "}/*"]
+            ), DataAwsIamPolicyDocumentStatement(
+                actions=["s3:ReplicateObject", "s3:ReplicateDelete", "s3:ReplicateTags"
+                ],
+                effect="Allow",
+                resources=["${" + destination.arn + "}/*"]
+            )
+            ]
+        )
+        aws_iam_policy_replication = IamPolicy(self, "replication_9",
+            name="tf-iam-role-policy-replication-12345",
+            policy=Token.as_string(replication.json)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_policy_replication.override_logical_id("replication")
+        aws_iam_role_replication = IamRole(self, "replication_10",
+            assume_role_policy=Token.as_string(assume_role.json),
+            name="tf-iam-role-replication-12345"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_role_replication.override_logical_id("replication")
+        aws_iam_role_policy_attachment_replication = IamRolePolicyAttachment(self, "replication_11",
+            policy_arn=Token.as_string(aws_iam_policy_replication.arn),
+            role=Token.as_string(aws_iam_role_replication.name)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_role_policy_attachment_replication.override_logical_id("replication")
+        aws_s3_bucket_replication_configuration_replication =
+        S3BucketReplicationConfigurationA(self, "replication_12",
+            bucket=source.id,
+            depends_on=[aws_s3_bucket_versioning_source],
+            provider=central,
+            role=Token.as_string(aws_iam_role_replication.arn),
+            rule=[S3BucketReplicationConfigurationRule(
+                destination=S3BucketReplicationConfigurationRuleDestination(
+                    bucket=destination.arn,
+                    storage_class="STANDARD"
+                ),
+                filter=S3BucketReplicationConfigurationRuleFilter(
+                    prefix="foo"
+                ),
+                id="foobar",
+                status="Enabled"
+            )
+            ]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_replication_configuration_replication.override_logical_id("replication")
+```
+
+### Bi-Directional Replication
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_replication_configuration import S3BucketReplicationConfigurationA
+from imports.aws.s3_bucket_versioning import S3BucketVersioningA
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        east = S3Bucket(self, "east",
+            bucket="tf-test-bucket-east-12345"
+        )
+        west = S3Bucket(self, "west",
+            bucket="tf-test-bucket-west-12345",
+            provider=aws_west
+        )
+        aws_s3_bucket_versioning_east = S3BucketVersioningA(self, "east_2",
+            bucket=east.id,
+            versioning_configuration=S3BucketVersioningVersioningConfiguration(
+                status="Enabled"
+            )
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_versioning_east.override_logical_id("east")
+        aws_s3_bucket_versioning_west = S3BucketVersioningA(self, "west_3",
+            bucket=west.id,
+            provider=aws_west,
+            versioning_configuration=S3BucketVersioningVersioningConfiguration(
+                status="Enabled"
+            )
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_versioning_west.override_logical_id("west")
+        S3BucketReplicationConfigurationA(self, "east_to_west",
+            bucket=east.id,
+            depends_on=[aws_s3_bucket_versioning_east],
+            role=east_replication.arn,
+            rule=[S3BucketReplicationConfigurationRule(
+                destination=S3BucketReplicationConfigurationRuleDestination(
+                    bucket=west.arn,
+                    storage_class="STANDARD"
+                ),
+                filter=S3BucketReplicationConfigurationRuleFilter(
+                    prefix="foo"
+                ),
+                id="foobar",
+                status="Enabled"
+            )
+            ]
+        )
+        S3BucketReplicationConfigurationA(self, "west_to_east",
+            bucket=west.id,
+            depends_on=[aws_s3_bucket_versioning_west],
+            provider=aws_west,
+            role=west_replication.arn,
+            rule=[S3BucketReplicationConfigurationRule(
+                destination=S3BucketReplicationConfigurationRuleDestination(
+                    bucket=east.arn,
+                    storage_class="STANDARD"
+                ),
+                filter=S3BucketReplicationConfigurationRuleFilter(
+                    prefix="foo"
+                ),
+                id="foobar",
+                status="Enabled"
+            )
+            ]
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `bucket` - (Required) Name of the source S3 bucket you want Amazon S3 to monitor.
+* `role` - (Required) ARN of the IAM role for Amazon S3 to assume when replicating the objects.
+* `rule` - (Required) List of configuration blocks describing the rules managing the replication. [See below](#rule).
+* `token` - (Optional) Token to allow replication to be enabled on an Object Lock-enabled bucket. You must contact AWS support for the bucket's "Object Lock token".
+For more details, see [Using S3 Object Lock with replication](https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock-managing.html#object-lock-managing-replication).
+
+### rule
+
+~> **NOTE:** Replication to multiple destination buckets requires that `priority` is specified in the `rule` object. If the corresponding rule requires no filter, an empty configuration block `filter {}` must be specified.
+
+~> **NOTE:** Amazon S3's latest version of the replication configuration is V2, which includes the `filter` attribute for replication rules.
+
+~> **NOTE:** The `existing_object_replication` parameter is not supported by Amazon S3 at this time and should not be included in your `rule` configurations. Specifying this parameter will result in `MalformedXML` errors.
+To replicate existing objects, please refer to the [Replicating existing objects with S3 Batch Replication](https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-batch-replication-batch.html) documentation in the Amazon S3 User Guide.
+
+The `rule` configuration block supports the following arguments:
+
+* `delete_marker_replication` - (Optional) Whether delete markers are replicated. This argument is only valid with V2 replication configurations (i.e., when `filter` is used)[documented below](#delete_marker_replication).
+* `destination` - (Required) Specifies the destination for the rule. [See below](#destination).
+* `existing_object_replication` - (Optional) Replicate existing objects in the source bucket according to the rule configurations. [See below](#existing_object_replication).
+* `filter` - (Optional, Conflicts with `prefix`) Filter that identifies subset of objects to which the replication rule applies. [See below](#filter). If not specified, the `rule` will default to using `prefix`.
+* `id` - (Optional) Unique identifier for the rule. Must be less than or equal to 255 characters in length.
+* `prefix` - (Optional, Conflicts with `filter`, **Deprecated**) Object key name prefix identifying one or more objects to which the rule applies. Must be less than or equal to 1024 characters in length. Defaults to an empty string (`""`) if `filter` is not specified.
+* `priority` - (Optional) Priority associated with the rule. Priority should only be set if `filter` is configured. If not provided, defaults to `0`. Priority must be unique between multiple rules.
+* `source_selection_criteria` - (Optional) Specifies special object selection criteria. [See below](#source_selection_criteria).
+* `status` - (Required) Status of the rule. Either `"Enabled"` or `"Disabled"`. The rule is ignored if status is not "Enabled".
+
+### delete_marker_replication
+
+~> **NOTE:** This argument is only available with V2 replication configurations.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+The `delete_marker_replication` configuration block supports the following arguments:
+
+* `status` - (Required) Whether delete markers should be replicated. Either `"Enabled"` or `"Disabled"`.
+
+### destination
+
+The `destination` configuration block supports the following arguments:
+
+* `access_control_translation` - (Optional) Configuration block that specifies the overrides to use for object owners on replication. [See below](#access_control_translation). Specify this only in a cross-account scenario (where source and destination bucket owners are not the same), and you want to change replica ownership to the AWS account that owns the destination bucket. If this is not specified in the replication configuration, the replicas are owned by same AWS account that owns the source object. Must be used in conjunction with `account` owner override configuration.
+* `account` - (Optional) Account ID to specify the replica ownership. Must be used in conjunction with `access_control_translation` override configuration.
+* `bucket` - (Required) ARN of the bucket where you want Amazon S3 to store the results.
+* `encryption_configuration` - (Optional) Configuration block that provides information about encryption. [See below](#encryption_configuration). If `source_selection_criteria` is specified, you must specify this element.
+* `metrics` - (Optional) Configuration block that specifies replication metrics-related settings enabling replication metrics and events. [See below](#metrics).
+* `replication_time` - (Optional) Configuration block that specifies S3 Replication Time Control (S3 RTC), including whether S3 RTC is enabled and the time when all objects and operations on objects must be replicated. [See below](#replication_time). Replication Time Control must be used in conjunction with `metrics`.
+* `storage_class` - (Optional) The [storage class](https://docs.aws.amazon.com/AmazonS3/latest/API/API_Destination.html#AmazonS3-Type-Destination-StorageClass) used to store the object. By default, Amazon S3 uses the storage class of the source object to create the object replica.
+
+### access_control_translation
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+The `access_control_translation` configuration block supports the following arguments:
+
+* `owner` - (Required) Specifies the replica ownership. For default and valid values, see [PUT bucket replication](https://docs.aws.amazon.com/AmazonS3/latest/API/RESTBucketPUTreplication.html) in the Amazon S3 API Reference. Valid values: `Destination`.
+
+### encryption_configuration
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+The `encryption_configuration` configuration block supports the following arguments:
+
+* `replica_kms_key_id` - (Required) ID (Key ARN or Alias ARN) of the customer managed AWS KMS key stored in AWS Key Management Service (KMS) for the destination bucket.
+
+### metrics
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+The `metrics` configuration block supports the following arguments:
+
+* `event_threshold` - (Optional) Configuration block that specifies the time threshold for emitting the `s3:Replication:OperationMissedThreshold` event. [See below](#event_threshold).
+* `status` - (Required) Status of the Destination Metrics. Either `"Enabled"` or `"Disabled"`.
+
+### event_threshold
+
+The `event_threshold` configuration block supports the following arguments:
+
+* `minutes` - (Required) Time in minutes. Valid values: `15`.
+
+### replication_time
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+The `replication_time` configuration block supports the following arguments:
+
+* `status` - (Required) Status of the Replication Time Control. Either `"Enabled"` or `"Disabled"`.
+* `time` - (Required) Configuration block specifying the time by which replication should be complete for all objects and operations on objects. [See below](#time).
+
+### time
+
+The `time` configuration block supports the following arguments:
+
+* `minutes` - (Required) Time in minutes. Valid values: `15`.
+
+### existing_object_replication
+
+~> **NOTE:** Replication for existing objects requires activation by AWS Support.  See [userguide/replication-what-is-isnot-replicated](https://docs.aws.amazon.com/AmazonS3/latest/userguide/replication-what-is-isnot-replicated.html#existing-object-replication)
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+The `existing_object_replication` configuration block supports the following arguments:
+
+* `status` - (Required) Whether the existing objects should be replicated. Either `"Enabled"` or `"Disabled"`.
+
+### filter
+
+~> **NOTE:** The `filter` argument must be specified as either an empty configuration block (`filter {}`) to imply the rule requires no filter or with exactly one of `prefix`, `tag`, or `and`.
+Replication configuration V1 supports filtering based on only the `prefix` attribute. For backwards compatibility, Amazon S3 continues to support the V1 configuration.
+
+The `filter` configuration block supports the following arguments:
+
+* `and` - (Optional) Configuration block for specifying rule filters. This element is required only if you specify more than one filter. See [and](#and) below for more details.
+* `prefix` - (Optional) Object key name prefix that identifies subset of objects to which the rule applies. Must be less than or equal to 1024 characters in length.
+* `tag` - (Optional) Configuration block for specifying a tag key and value. [See below](#tag).
+
+### and
+
+The `and` configuration block supports the following arguments:
+
+* `prefix` - (Optional) Object key name prefix that identifies subset of objects to which the rule applies. Must be less than or equal to 1024 characters in length.
+* `tags` - (Optional, Required if `prefix` is configured) Map of tags (key and value pairs) that identifies a subset of objects to which the rule applies. The rule applies only to objects having all the tags in its tagset.
+
+### tag
+
+The `tag` configuration block supports the following arguments:
+
+* `key` - (Required) Name of the object key.
+* `value` - (Required) Value of the tag.
+
+### source_selection_criteria
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+The `source_selection_criteria` configuration block supports the following arguments:
+
+* `replica_modifications` - (Optional) Configuration block that you can specify for selections for modifications on replicas. Amazon S3 doesn't replicate replica modifications by default. In the latest version of replication configuration (when `filter` is specified), you can specify this element and set the status to `Enabled` to replicate modifications on replicas.
+
+* `sse_kms_encrypted_objects` - (Optional) Configuration block for filter information for the selection of Amazon S3 objects encrypted with AWS KMS. If specified, `replica_kms_key_id` in `destination` `encryption_configuration` must be specified as well.
+
+### replica_modifications
+
+The `replica_modifications` configuration block supports the following arguments:
+
+* `status` - (Required) Whether the existing objects should be replicated. Either `"Enabled"` or `"Disabled"`.
+
+### sse_kms_encrypted_objects
+
+The `sse_kms_encrypted_objects` configuration block supports the following arguments:
+
+* `status` - (Required) Whether the existing objects should be replicated. Either `"Enabled"` or `"Disabled"`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - S3 source bucket name.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import S3 bucket replication configuration using the `bucket`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import S3 bucket replication configuration using the `bucket`. For example:
+
+```console
+% terraform import aws_s3_bucket_replication_configuration.replication bucket-name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-fb3dd63caebf8f9a5354d73fe9c5e62bdefe563725f98aa597f6c1c77451e28c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/s3_bucket_request_payment_configuration.html.markdown b/website/docs/cdktf/python/r/s3_bucket_request_payment_configuration.html.markdown
new file mode 100644
index 00000000000..6e61151fb65
--- /dev/null
+++ b/website/docs/cdktf/python/r/s3_bucket_request_payment_configuration.html.markdown
@@ -0,0 +1,91 @@
+---
+subcategory: "S3 (Simple Storage)"
+layout: "aws"
+page_title: "AWS: aws_s3_bucket_request_payment_configuration"
+description: |-
+  Provides an S3 bucket request payment configuration resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_s3_bucket_request_payment_configuration
+
+Provides an S3 bucket request payment configuration resource. For more information, see [Requester Pays Buckets](https://docs.aws.amazon.com/AmazonS3/latest/dev/RequesterPaysBuckets.html).
+
+~> **NOTE:** Destroying an `aws_s3_bucket_request_payment_configuration` resource resets the bucket's `payer` to the S3 default: the bucket owner.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket_request_payment_configuration import S3BucketRequestPaymentConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        S3BucketRequestPaymentConfiguration(self, "example",
+            bucket=Token.as_string(aws_s3_bucket_example.id),
+            payer="Requester"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `bucket` - (Required, Forces new resource) Name of the bucket.
+* `expected_bucket_owner` - (Optional, Forces new resource) Account ID of the expected bucket owner.
+* `payer` - (Required) Specifies who pays for the download and request fees. Valid values: `BucketOwner`, `Requester`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The `bucket` or `bucket` and `expected_bucket_owner` separated by a comma (`,`) if the latter is provided.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import S3 bucket request payment configuration using the `bucket` or using the `bucket` and `expected_bucket_owner` separated by a comma (`,`). For example:
+
+If the owner (account ID) of the source bucket is the same account used to configure the Terraform AWS Provider, import using the `bucket`:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+If the owner (account ID) of the source bucket differs from the account used to configure the Terraform AWS Provider, import using the `bucket` and `expected_bucket_owner` separated by a comma (`,`):
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+**Using `terraform import` to import** S3 bucket request payment configuration using the `bucket` or using the `bucket` and `expected_bucket_owner` separated by a comma (`,`). For example:
+
+If the owner (account ID) of the source bucket is the same account used to configure the Terraform AWS Provider, import using the `bucket`:
+
+```console
+% terraform import aws_s3_bucket_request_payment_configuration.example bucket-name
+```
+
+If the owner (account ID) of the source bucket differs from the account used to configure the Terraform AWS Provider, import using the `bucket` and `expected_bucket_owner` separated by a comma (`,`):
+
+```console
+% terraform import aws_s3_bucket_request_payment_configuration.example bucket-name,123456789012
+```
+
+<!-- cache-key: cdktf-0.18.0 input-924fef526db0a2463aa429766935ae82fbffff4fc791593d59efff4dfb0debed -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/s3_bucket_server_side_encryption_configuration.html.markdown b/website/docs/cdktf/python/r/s3_bucket_server_side_encryption_configuration.html.markdown
new file mode 100644
index 00000000000..40aa342a307
--- /dev/null
+++ b/website/docs/cdktf/python/r/s3_bucket_server_side_encryption_configuration.html.markdown
@@ -0,0 +1,120 @@
+---
+subcategory: "S3 (Simple Storage)"
+layout: "aws"
+page_title: "AWS: aws_s3_bucket_server_side_encryption_configuration"
+description: |-
+  Provides a S3 bucket server-side encryption configuration resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_s3_bucket_server_side_encryption_configuration
+
+Provides a S3 bucket server-side encryption configuration resource.
+
+~> **NOTE:** Destroying an `aws_s3_bucket_server_side_encryption_configuration` resource resets the bucket to [Amazon S3 bucket default encryption](https://docs.aws.amazon.com/AmazonS3/latest/userguide/default-encryption-faq.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.kms_key import KmsKey
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_server_side_encryption_configuration import S3BucketServerSideEncryptionConfigurationA
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        mykey = KmsKey(self, "mykey",
+            deletion_window_in_days=10,
+            description="This key is used to encrypt bucket objects"
+        )
+        mybucket = S3Bucket(self, "mybucket",
+            bucket="mybucket"
+        )
+        S3BucketServerSideEncryptionConfigurationA(self, "example",
+            bucket=mybucket.id,
+            rule=[S3BucketServerSideEncryptionConfigurationRuleA(
+                apply_server_side_encryption_by_default=S3BucketServerSideEncryptionConfigurationRuleApplyServerSideEncryptionByDefaultA(
+                    kms_master_key_id=mykey.arn,
+                    sse_algorithm="aws:kms"
+                )
+            )
+            ]
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `bucket` - (Required, Forces new resource) ID (name) of the bucket.
+* `expected_bucket_owner` - (Optional, Forces new resource) Account ID of the expected bucket owner.
+* `rule` - (Required) Set of server-side encryption configuration rules. [See below](#rule). Currently, only a single rule is supported.
+
+### rule
+
+The `rule` configuration block supports the following arguments:
+
+* `apply_server_side_encryption_by_default` - (Optional) Single object for setting server-side encryption by default. [See below](#apply_server_side_encryption_by_default).
+* `bucket_key_enabled` - (Optional) Whether or not to use [Amazon S3 Bucket Keys](https://docs.aws.amazon.com/AmazonS3/latest/dev/bucket-key.html) for SSE-KMS.
+
+### apply_server_side_encryption_by_default
+
+The `apply_server_side_encryption_by_default` configuration block supports the following arguments:
+
+* `sse_algorithm` - (Required) Server-side encryption algorithm to use. Valid values are `AES256`, `aws:kms`, and `aws:kms:dsse`
+* `kms_master_key_id` - (Optional) AWS KMS master key ID used for the SSE-KMS encryption. This can only be used when you set the value of `sse_algorithm` as `aws:kms`. The default `aws/s3` AWS KMS master key is used if this element is absent while the `sse_algorithm` is `aws:kms`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The `bucket` or `bucket` and `expected_bucket_owner` separated by a comma (`,`) if the latter is provided.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import S3 bucket server-side encryption configuration using the `bucket` or using the `bucket` and `expected_bucket_owner` separated by a comma (`,`). For example:
+
+If the owner (account ID) of the source bucket is the same account used to configure the Terraform AWS Provider, import using the `bucket`:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+If the owner (account ID) of the source bucket differs from the account used to configure the Terraform AWS Provider, import using the `bucket` and `expected_bucket_owner` separated by a comma (`,`):
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+**Using `terraform import` to import** S3 bucket server-side encryption configuration using the `bucket` or using the `bucket` and `expected_bucket_owner` separated by a comma (`,`). For example:
+
+If the owner (account ID) of the source bucket is the same account used to configure the Terraform AWS Provider, import using the `bucket`:
+
+```console
+% terraform import aws_s3_bucket_server_side_encryption_configuration.example bucket-name
+```
+
+If the owner (account ID) of the source bucket differs from the account used to configure the Terraform AWS Provider, import using the `bucket` and `expected_bucket_owner` separated by a comma (`,`):
+
+```console
+% terraform import aws_s3_bucket_server_side_encryption_configuration.example bucket-name,123456789012
+```
+
+<!-- cache-key: cdktf-0.18.0 input-20fc65b1b77aa12edd3562b565214ad5b0b456226cc87c90a6ba2cfb792b9ea9 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/s3_bucket_versioning.html.markdown b/website/docs/cdktf/python/r/s3_bucket_versioning.html.markdown
new file mode 100644
index 00000000000..05685e4c69e
--- /dev/null
+++ b/website/docs/cdktf/python/r/s3_bucket_versioning.html.markdown
@@ -0,0 +1,196 @@
+---
+subcategory: "S3 (Simple Storage)"
+layout: "aws"
+page_title: "AWS: aws_s3_bucket_versioning"
+description: |-
+  Provides an S3 bucket versioning resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_s3_bucket_versioning
+
+Provides a resource for controlling versioning on an S3 bucket.
+Deleting this resource will either suspend versioning on the associated S3 bucket or
+simply remove the resource from Terraform state if the associated S3 bucket is unversioned.
+
+For more information, see [How S3 versioning works](https://docs.aws.amazon.com/AmazonS3/latest/userguide/manage-versioning-examples.html).
+
+~> **NOTE:** If you are enabling versioning on the bucket for the first time, AWS recommends that you wait for 15 minutes after enabling versioning before issuing write operations (PUT or DELETE) on objects in the bucket.
+
+## Example Usage
+
+### With Versioning Enabled
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_acl import S3BucketAcl
+from imports.aws.s3_bucket_versioning import S3BucketVersioningA
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = S3Bucket(self, "example",
+            bucket="example-bucket"
+        )
+        aws_s3_bucket_acl_example = S3BucketAcl(self, "example_1",
+            acl="private",
+            bucket=example.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_acl_example.override_logical_id("example")
+        S3BucketVersioningA(self, "versioning_example",
+            bucket=example.id,
+            versioning_configuration=S3BucketVersioningVersioningConfiguration(
+                status="Enabled"
+            )
+        )
+```
+
+### With Versioning Disabled
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_acl import S3BucketAcl
+from imports.aws.s3_bucket_versioning import S3BucketVersioningA
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = S3Bucket(self, "example",
+            bucket="example-bucket"
+        )
+        aws_s3_bucket_acl_example = S3BucketAcl(self, "example_1",
+            acl="private",
+            bucket=example.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_acl_example.override_logical_id("example")
+        S3BucketVersioningA(self, "versioning_example",
+            bucket=example.id,
+            versioning_configuration=S3BucketVersioningVersioningConfiguration(
+                status="Disabled"
+            )
+        )
+```
+
+### Object Dependency On Versioning
+
+When you create an object whose `version_id` you need and an `aws_s3_bucket_versioning` resource in the same configuration, you are more likely to have success by ensuring the `s3_object` depends either implicitly (see below) or explicitly (i.e., using `depends_on = [aws_s3_bucket_versioning.example]`) on the `aws_s3_bucket_versioning` resource.
+
+~> **NOTE:** For critical and/or production S3 objects, do not create a bucket, enable versioning, and create an object in the bucket within the same configuration. Doing so will not allow the AWS-recommended 15 minutes between enabling versioning and writing to the bucket.
+
+This example shows the `aws_s3_object.example` depending implicitly on the versioning resource through the reference to `aws_s3_bucket_versioning.example.bucket` to define `bucket`:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_versioning import S3BucketVersioningA
+from imports.aws.s3_object import S3Object
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = S3Bucket(self, "example",
+            bucket="yotto"
+        )
+        aws_s3_bucket_versioning_example = S3BucketVersioningA(self, "example_1",
+            bucket=example.id,
+            versioning_configuration=S3BucketVersioningVersioningConfiguration(
+                status="Enabled"
+            )
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_versioning_example.override_logical_id("example")
+        aws_s3_object_example = S3Object(self, "example_2",
+            bucket=Token.as_string(aws_s3_bucket_versioning_example.id),
+            key="droeloe",
+            source="example.txt"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_object_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `bucket` - (Required, Forces new resource) Name of the S3 bucket.
+* `versioning_configuration` - (Required) Configuration block for the versioning parameters. [See below](#versioning_configuration).
+* `expected_bucket_owner` - (Optional, Forces new resource) Account ID of the expected bucket owner.
+* `mfa` - (Optional, Required if `versioning_configuration` `mfa_delete` is enabled) Concatenation of the authentication device's serial number, a space, and the value that is displayed on your authentication device.
+
+### versioning_configuration
+
+~> **Note:** While the `versioning_configuration.status` parameter supports `Disabled`, this value is only intended for _creating_ or _importing_ resources that correspond to unversioned S3 buckets.
+Updating the value from `Enabled` or `Suspended` to `Disabled` will result in errors as the AWS S3 API does not support returning buckets to an unversioned state.
+
+The `versioning_configuration` configuration block supports the following arguments:
+
+* `status` - (Required) Versioning state of the bucket. Valid values: `Enabled`, `Suspended`, or `Disabled`. `Disabled` should only be used when creating or importing resources that correspond to unversioned S3 buckets.
+* `mfa_delete` - (Optional) Specifies whether MFA delete is enabled in the bucket versioning configuration. Valid values: `Enabled` or `Disabled`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The `bucket` or `bucket` and `expected_bucket_owner` separated by a comma (`,`) if the latter is provided.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import S3 bucket versioning using the `bucket` or using the `bucket` and `expected_bucket_owner` separated by a comma (`,`). For example:
+
+If the owner (account ID) of the source bucket is the same account used to configure the Terraform AWS Provider, import using the `bucket`:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+If the owner (account ID) of the source bucket differs from the account used to configure the Terraform AWS Provider, import using the `bucket` and `expected_bucket_owner` separated by a comma (`,`):
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+**Using `terraform import` to import** S3 bucket versioning using the `bucket` or using the `bucket` and `expected_bucket_owner` separated by a comma (`,`). For example:
+
+If the owner (account ID) of the source bucket is the same account used to configure the Terraform AWS Provider, import using the `bucket`:
+
+```console
+% terraform import aws_s3_bucket_versioning.example bucket-name
+```
+
+If the owner (account ID) of the source bucket differs from the account used to configure the Terraform AWS Provider, import using the `bucket` and `expected_bucket_owner` separated by a comma (`,`):
+
+```console
+% terraform import aws_s3_bucket_versioning.example bucket-name,123456789012
+```
+
+<!-- cache-key: cdktf-0.18.0 input-3f84c98fe9b700bccf273478828122f05fe2e305acb212ed114e7d70a9c33251 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/s3_bucket_website_configuration.html.markdown b/website/docs/cdktf/python/r/s3_bucket_website_configuration.html.markdown
new file mode 100644
index 00000000000..a1f7492f479
--- /dev/null
+++ b/website/docs/cdktf/python/r/s3_bucket_website_configuration.html.markdown
@@ -0,0 +1,183 @@
+---
+subcategory: "S3 (Simple Storage)"
+layout: "aws"
+page_title: "AWS: aws_s3_bucket_website_configuration"
+description: |-
+  Provides an S3 bucket website configuration resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_s3_bucket_website_configuration
+
+Provides an S3 bucket website configuration resource. For more information, see [Hosting Websites on S3](https://docs.aws.amazon.com/AmazonS3/latest/dev/WebsiteHosting.html).
+
+## Example Usage
+
+### With `routing_rule` configured
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket_website_configuration import S3BucketWebsiteConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        S3BucketWebsiteConfiguration(self, "example",
+            bucket=Token.as_string(aws_s3_bucket_example.id),
+            error_document=S3BucketWebsiteConfigurationErrorDocument(
+                key="error.html"
+            ),
+            index_document=S3BucketWebsiteConfigurationIndexDocument(
+                suffix="index.html"
+            ),
+            routing_rule=[S3BucketWebsiteConfigurationRoutingRule(
+                condition=S3BucketWebsiteConfigurationRoutingRuleCondition(
+                    key_prefix_equals="docs/"
+                ),
+                redirect=S3BucketWebsiteConfigurationRoutingRuleRedirect(
+                    replace_key_prefix_with="documents/"
+                )
+            )
+            ]
+        )
+```
+
+### With `routing_rules` configured
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket_website_configuration import S3BucketWebsiteConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        S3BucketWebsiteConfiguration(self, "example",
+            bucket=Token.as_string(aws_s3_bucket_example.id),
+            error_document=S3BucketWebsiteConfigurationErrorDocument(
+                key="error.html"
+            ),
+            index_document=S3BucketWebsiteConfigurationIndexDocument(
+                suffix="index.html"
+            ),
+            routing_rules="[{\n    \"Condition\": {\n        \"KeyPrefixEquals\": \"docs/\"\n    },\n    \"Redirect\": {\n        \"ReplaceKeyPrefixWith\": \"\"\n    }\n}]\n\n"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `bucket` - (Required, Forces new resource) Name of the bucket.
+* `error_document` - (Optional, Conflicts with `redirect_all_requests_to`) Name of the error document for the website. [See below](#error_document).
+* `expected_bucket_owner` - (Optional, Forces new resource) Account ID of the expected bucket owner.
+* `index_document` - (Optional, Required if `redirect_all_requests_to` is not specified) Name of the index document for the website. [See below](#index_document).
+* `redirect_all_requests_to` - (Optional, Required if `index_document` is not specified) Redirect behavior for every request to this bucket's website endpoint. [See below](#redirect_all_requests_to). Conflicts with `error_document`, `index_document`, and `routing_rule`.
+* `routing_rule` - (Optional, Conflicts with `redirect_all_requests_to` and `routing_rules`) List of rules that define when a redirect is applied and the redirect behavior. [See below](#routing_rule).
+* `routing_rules` - (Optional, Conflicts with `routing_rule` and `redirect_all_requests_to`) JSON array containing [routing rules](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-s3-websiteconfiguration-routingrules.html)
+  describing redirect behavior and when redirects are applied. Use this parameter when your routing rules contain empty String values (`""`) as seen in the [example above](#with-routing_rules-configured).
+
+### error_document
+
+The `error_document` configuration block supports the following arguments:
+
+* `key` - (Required) Object key name to use when a 4XX class error occurs.
+
+### index_document
+
+The `index_document` configuration block supports the following arguments:
+
+* `suffix` - (Required) Suffix that is appended to a request that is for a directory on the website endpoint.
+For example, if the suffix is `index.html` and you make a request to `samplebucket/images/`, the data that is returned will be for the object with the key name `images/index.html`.
+The suffix must not be empty and must not include a slash character.
+
+### redirect_all_requests_to
+
+The `redirect_all_requests_to` configuration block supports the following arguments:
+
+* `host_name` - (Required) Name of the host where requests are redirected.
+* `protocol` - (Optional) Protocol to use when redirecting requests. The default is the protocol that is used in the original request. Valid values: `http`, `https`.
+
+### routing_rule
+
+The `routing_rule` configuration block supports the following arguments:
+
+* `condition` - (Optional) Configuration block for describing a condition that must be met for the specified redirect to apply. [See below](#condition).
+* `redirect` - (Required) Configuration block for redirect information. [See below](#redirect).
+
+### condition
+
+The `condition` configuration block supports the following arguments:
+
+* `http_error_code_returned_equals` - (Optional, Required if `key_prefix_equals` is not specified) HTTP error code when the redirect is applied. If specified with `key_prefix_equals`, then both must be true for the redirect to be applied.
+* `key_prefix_equals` - (Optional, Required if `http_error_code_returned_equals` is not specified) Object key name prefix when the redirect is applied. If specified with `http_error_code_returned_equals`, then both must be true for the redirect to be applied.
+
+### redirect
+
+The `redirect` configuration block supports the following arguments:
+
+* `host_name` - (Optional) Host name to use in the redirect request.
+* `http_redirect_code` - (Optional) HTTP redirect code to use on the response.
+* `protocol` - (Optional) Protocol to use when redirecting requests. The default is the protocol that is used in the original request. Valid values: `http`, `https`.
+* `replace_key_prefix_with` - (Optional, Conflicts with `replace_key_with`) Object key prefix to use in the redirect request. For example, to redirect requests for all pages with prefix `docs/` (objects in the `docs/` folder) to `documents/`, you can set a `condition` block with `key_prefix_equals` set to `docs/` and in the `redirect` set `replace_key_prefix_with` to `/documents`.
+* `replace_key_with` - (Optional, Conflicts with `replace_key_prefix_with`) Specific object key to use in the redirect request. For example, redirect request to `error.html`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The `bucket` or `bucket` and `expected_bucket_owner` separated by a comma (`,`) if the latter is provided.
+* `website_domain` - Domain of the website endpoint. This is used to create Route 53 alias records.
+* `website_endpoint` - Website endpoint.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import S3 bucket website configuration using the `bucket` or using the `bucket` and `expected_bucket_owner` separated by a comma (`,`). For example:
+
+If the owner (account ID) of the source bucket is the same account used to configure the Terraform AWS Provider, import using the `bucket`:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+If the owner (account ID) of the source bucket differs from the account used to configure the Terraform AWS Provider, import using the `bucket` and `expected_bucket_owner` separated by a comma (`,`):
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+**Using `terraform import` to import** S3 bucket website configuration using the `bucket` or using the `bucket` and `expected_bucket_owner` separated by a comma (`,`). For example:
+
+If the owner (account ID) of the source bucket is the same account used to configure the Terraform AWS Provider, import using the `bucket`:
+
+```console
+% terraform import aws_s3_bucket_website_configuration.example bucket-name
+```
+
+If the owner (account ID) of the source bucket differs from the account used to configure the Terraform AWS Provider, import using the `bucket` and `expected_bucket_owner` separated by a comma (`,`):
+
+```console
+% terraform import aws_s3_bucket_website_configuration.example bucket-name,123456789012
+```
+
+<!-- cache-key: cdktf-0.18.0 input-41a0e7bf7a7343429d1d7cf6e55d272d2709263fda9bdf55fa57e0879a7d920a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/s3_object.html.markdown b/website/docs/cdktf/python/r/s3_object.html.markdown
new file mode 100644
index 00000000000..7be7307eade
--- /dev/null
+++ b/website/docs/cdktf/python/r/s3_object.html.markdown
@@ -0,0 +1,280 @@
+---
+subcategory: "S3 (Simple Storage)"
+layout: "aws"
+page_title: "AWS: aws_s3_object"
+description: |-
+  Provides an S3 object resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_s3_object
+
+Provides an S3 object resource.
+
+## Example Usage
+
+### Uploading a file to a bucket
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_object import S3Object
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        S3Object(self, "object",
+            bucket="your_bucket_name",
+            etag=Token.as_string(Fn.filemd5("path/to/file")),
+            key="new_object_key",
+            source="path/to/file"
+        )
+```
+
+### Encrypting with KMS Key
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.kms_key import KmsKey
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_acl import S3BucketAcl
+from imports.aws.s3_object import S3Object
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        examplekms = KmsKey(self, "examplekms",
+            deletion_window_in_days=7,
+            description="KMS key 1"
+        )
+        examplebucket = S3Bucket(self, "examplebucket",
+            bucket="examplebuckettftest"
+        )
+        S3BucketAcl(self, "example",
+            acl="private",
+            bucket=examplebucket.id
+        )
+        aws_s3_object_example = S3Object(self, "example_3",
+            bucket=examplebucket.id,
+            key="someobject",
+            kms_key_id=examplekms.arn,
+            source="index.html"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_object_example.override_logical_id("example")
+```
+
+### Server Side Encryption with S3 Default Master Key
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_acl import S3BucketAcl
+from imports.aws.s3_object import S3Object
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        examplebucket = S3Bucket(self, "examplebucket",
+            bucket="examplebuckettftest"
+        )
+        S3BucketAcl(self, "example",
+            acl="private",
+            bucket=examplebucket.id
+        )
+        aws_s3_object_example = S3Object(self, "example_2",
+            bucket=examplebucket.id,
+            key="someobject",
+            server_side_encryption="aws:kms",
+            source="index.html"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_object_example.override_logical_id("example")
+```
+
+### Server Side Encryption with AWS-Managed Key
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_acl import S3BucketAcl
+from imports.aws.s3_object import S3Object
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        examplebucket = S3Bucket(self, "examplebucket",
+            bucket="examplebuckettftest"
+        )
+        S3BucketAcl(self, "example",
+            acl="private",
+            bucket=examplebucket.id
+        )
+        aws_s3_object_example = S3Object(self, "example_2",
+            bucket=examplebucket.id,
+            key="someobject",
+            server_side_encryption="AES256",
+            source="index.html"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_object_example.override_logical_id("example")
+```
+
+### S3 Object Lock
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_acl import S3BucketAcl
+from imports.aws.s3_bucket_versioning import S3BucketVersioningA
+from imports.aws.s3_object import S3Object
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        examplebucket = S3Bucket(self, "examplebucket",
+            bucket="examplebuckettftest",
+            object_lock_enabled=True
+        )
+        S3BucketAcl(self, "example",
+            acl="private",
+            bucket=examplebucket.id
+        )
+        aws_s3_bucket_versioning_example = S3BucketVersioningA(self, "example_2",
+            bucket=examplebucket.id,
+            versioning_configuration=S3BucketVersioningVersioningConfiguration(
+                status="Enabled"
+            )
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_versioning_example.override_logical_id("example")
+        S3Object(self, "examplebucket_object",
+            bucket=examplebucket.id,
+            depends_on=[aws_s3_bucket_versioning_example],
+            force_destroy=True,
+            key="someobject",
+            object_lock_legal_hold_status="ON",
+            object_lock_mode="GOVERNANCE",
+            object_lock_retain_until_date="2021-12-31T23:59:60Z",
+            source="important.txt"
+        )
+```
+
+## Argument Reference
+
+-> **Note:** If you specify `content_encoding` you are responsible for encoding the body appropriately. `source`, `content`, and `content_base64` all expect already encoded/compressed bytes.
+
+The following arguments are required:
+
+* `bucket` - (Required) Name of the bucket to put the file in. Alternatively, an [S3 access point](https://docs.aws.amazon.com/AmazonS3/latest/dev/using-access-points.html) ARN can be specified.
+* `key` - (Required) Name of the object once it is in the bucket.
+
+The following arguments are optional:
+
+* `acl` - (Optional) [Canned ACL](https://docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html#canned-acl) to apply. Valid values are `private`, `public-read`, `public-read-write`, `aws-exec-read`, `authenticated-read`, `bucket-owner-read`, and `bucket-owner-full-control`.
+* `bucket_key_enabled` - (Optional) Whether or not to use [Amazon S3 Bucket Keys](https://docs.aws.amazon.com/AmazonS3/latest/dev/bucket-key.html) for SSE-KMS.
+* `cache_control` - (Optional) Caching behavior along the request/reply chain Read [w3c cache_control](http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.9) for further details.
+* `checksum_algorithm` - (Optional) Indicates the algorithm used to create the checksum for the object. If a value is specified and the object is encrypted with KMS, you must have permission to use the `kms:Decrypt` action. Valid values: `CRC32`, `CRC32C`, `SHA1`, `SHA256`.
+* `content_base64` - (Optional, conflicts with `source` and `content`) Base64-encoded data that will be decoded and uploaded as raw bytes for the object content. This allows safely uploading non-UTF8 binary data, but is recommended only for small content such as the result of the `gzipbase64` function with small text strings. For larger objects, use `source` to stream the content from a disk file.
+* `content_disposition` - (Optional) Presentational information for the object. Read [w3c content_disposition](http://www.w3.org/Protocols/rfc2616/rfc2616-sec19.html#sec19.5.1) for further information.
+* `content_encoding` - (Optional) Content encodings that have been applied to the object and thus what decoding mechanisms must be applied to obtain the media-type referenced by the Content-Type header field. Read [w3c content encoding](http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.11) for further information.
+* `content_language` - (Optional) Language the content is in e.g., en-US or en-GB.
+* `content_type` - (Optional) Standard MIME type describing the format of the object data, e.g., application/octet-stream. All Valid MIME Types are valid for this input.
+* `content` - (Optional, conflicts with `source` and `content_base64`) Literal string value to use as the object content, which will be uploaded as UTF-8-encoded text.
+* `etag` - (Optional) Triggers updates when the value changes. The only meaningful value is `filemd5("path/to/file")` (Terraform 0.11.12 or later) or `${md5(file("path/to/file"))}` (Terraform 0.11.11 or earlier). This attribute is not compatible with KMS encryption, `kms_key_id` or `server_side_encryption = "aws:kms"`, also if an object is larger than 16 MB, the AWS Management Console will upload or copy that object as a Multipart Upload, and therefore the ETag will not be an MD5 digest (see `source_hash` instead).
+* `force_destroy` - (Optional) Whether to allow the object to be deleted by removing any legal hold on any object version. Default is `false`. This value should be set to `true` only if the bucket has S3 object lock enabled.
+* `kms_key_id` - (Optional) ARN of the KMS Key to use for object encryption. If the S3 Bucket has server-side encryption enabled, that value will automatically be used. If referencing the `aws_kms_key` resource, use the `arn` attribute. If referencing the `aws_kms_alias` data source or resource, use the `target_key_arn` attribute. Terraform will only perform drift detection if a configuration value is provided.
+* `metadata` - (Optional) Map of keys/values to provision metadata (will be automatically prefixed by `x-amz-meta-`, note that only lowercase label are currently supported by the AWS Go API).
+* `object_lock_legal_hold_status` - (Optional) [Legal hold](https://docs.aws.amazon.com/AmazonS3/latest/dev/object-lock-overview.html#object-lock-legal-holds) status that you want to apply to the specified object. Valid values are `ON` and `OFF`.
+* `object_lock_mode` - (Optional) Object lock [retention mode](https://docs.aws.amazon.com/AmazonS3/latest/dev/object-lock-overview.html#object-lock-retention-modes) that you want to apply to this object. Valid values are `GOVERNANCE` and `COMPLIANCE`.
+* `object_lock_retain_until_date` - (Optional) Date and time, in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8), when this object's object lock will [expire](https://docs.aws.amazon.com/AmazonS3/latest/dev/object-lock-overview.html#object-lock-retention-periods).
+* `server_side_encryption` - (Optional) Server-side encryption of the object in S3. Valid values are "`AES256`" and "`aws:kms`".
+* `source_hash` - (Optional) Triggers updates like `etag` but useful to address `etag` encryption limitations. Set using `filemd5("path/to/source")` (Terraform 0.11.12 or later). (The value is only stored in state and not saved by AWS.)
+* `source` - (Optional, conflicts with `content` and `content_base64`) Path to a file that will be read and uploaded as raw bytes for the object content.
+* `storage_class` - (Optional) [Storage Class](https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutObject.html#AmazonS3-PutObject-request-header-StorageClass) for the object. Defaults to "`STANDARD`".
+* `tags` - (Optional) Map of tags to assign to the object. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `website_redirect` - (Optional) Target URL for [website redirect](http://docs.aws.amazon.com/AmazonS3/latest/dev/how-to-page-redirect.html).
+
+If no content is provided through `source`, `content` or `content_base64`, then the object will be empty.
+
+-> **Note:** Terraform ignores all leading `/`s in the object's `key` and treats multiple `/`s in the rest of the object's `key` as a single `/`, so values of `/index.html` and `index.html` correspond to the same S3 object as do `first//second///third//` and `first/second/third/`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `checksum_crc32` - The base64-encoded, 32-bit CRC32 checksum of the object.
+* `checksum_crc32c` - The base64-encoded, 32-bit CRC32C checksum of the object.
+* `checksum_sha1` - The base64-encoded, 160-bit SHA-1 digest of the object.
+* `checksum_sha256` - The base64-encoded, 256-bit SHA-256 digest of the object.
+* `etag` - ETag generated for the object (an MD5 sum of the object content). For plaintext objects or objects encrypted with an AWS-managed key, the hash is an MD5 digest of the object data. For objects encrypted with a KMS key or objects created by either the Multipart Upload or Part Copy operation, the hash is not an MD5 digest, regardless of the method of encryption. More information on possible values can be found on [Common Response Headers](https://docs.aws.amazon.com/AmazonS3/latest/API/RESTCommonResponseHeaders.html).
+* `id` - `key` of the resource supplied above
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `version_id` - Unique version ID value for the object, if bucket versioning is enabled.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import objects using the `id` or S3 URL. For example:
+
+Import using the `id`, which is the bucket name and the key together:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Import using S3 URL syntax:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+**Using `terraform import` to import** objects using the `id` or S3 URL. For example:
+
+Import using the `id`, which is the bucket name and the key together:
+
+```console
+% terraform import aws_s3_object.example some-bucket-name/some/key.txt
+```
+
+Import using S3 URL syntax:
+
+```console
+% terraform import aws_s3_object.example s3://some-bucket-name/some/key.txt
+```
+
+<!-- cache-key: cdktf-0.18.0 input-313d011adadfcc4b1dac5806690d7004dca8bb94690486322b189890ab15b7de -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/s3_object_copy.html.markdown b/website/docs/cdktf/python/r/s3_object_copy.html.markdown
new file mode 100644
index 00000000000..6cec9d94bba
--- /dev/null
+++ b/website/docs/cdktf/python/r/s3_object_copy.html.markdown
@@ -0,0 +1,122 @@
+---
+subcategory: "S3 (Simple Storage)"
+layout: "aws"
+page_title: "AWS: aws_s3_object_copy"
+description: |-
+  Provides a resource for copying an S3 object.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_s3_object_copy
+
+Provides a resource for copying an S3 object.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_object_copy import S3ObjectCopy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        S3ObjectCopy(self, "test",
+            bucket="destination_bucket",
+            grant=[S3ObjectCopyGrant(
+                permissions=["READ"],
+                type="Group",
+                uri="http://acs.amazonaws.com/groups/global/AllUsers"
+            )
+            ],
+            key="destination_key",
+            source="source_bucket/source_key"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `bucket` - (Required) Name of the bucket to put the file in.
+* `key` - (Required) Name of the object once it is in the bucket.
+* `source` - (Required) Specifies the source object for the copy operation. You specify the value in one of two formats. For objects not accessed through an access point, specify the name of the source bucket and the key of the source object, separated by a slash (`/`). For example, `testbucket/test1.json`. For objects accessed through access points, specify the ARN of the object as accessed through the access point, in the format `arn:aws:s3:<Region>:<account-id>:accesspoint/<access-point-name>/object/<key>`. For example, `arn:aws:s3:us-west-2:9999912999:accesspoint/my-access-point/object/testbucket/test1.json`.
+
+The following arguments are optional:
+
+* `acl` - (Optional) [Canned ACL](https://docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html#canned-acl) to apply. Valid values are `private`, `public-read`, `public-read-write`, `authenticated-read`, `aws-exec-read`, `bucket-owner-read`, and `bucket-owner-full-control`. Conflicts with `grant`.
+* `cache_control` - (Optional) Specifies caching behavior along the request/reply chain Read [w3c cache_control](http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.9) for further details.
+* `checksum_algorithm` - (Optional) Indicates the algorithm used to create the checksum for the object. If a value is specified and the object is encrypted with KMS, you must have permission to use the `kms:Decrypt` action. Valid values: `CRC32`, `CRC32C`, `SHA1`, `SHA256`.
+* `content_disposition` - (Optional) Specifies presentational information for the object. Read [w3c content_disposition](http://www.w3.org/Protocols/rfc2616/rfc2616-sec19.html#sec19.5.1) for further information.
+* `content_encoding` - (Optional) Specifies what content encodings have been applied to the object and thus what decoding mechanisms must be applied to obtain the media-type referenced by the Content-Type header field. Read [w3c content encoding](http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.11) for further information.
+* `content_language` - (Optional) Language the content is in e.g., en-US or en-GB.
+* `content_type` - (Optional) Standard MIME type describing the format of the object data, e.g., `application/octet-stream`. All Valid MIME Types are valid for this input.
+* `copy_if_match` - (Optional) Copies the object if its entity tag (ETag) matches the specified tag.
+* `copy_if_modified_since` - (Optional) Copies the object if it has been modified since the specified time, in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8).
+* `copy_if_none_match` - (Optional) Copies the object if its entity tag (ETag) is different than the specified ETag.
+* `copy_if_unmodified_since` - (Optional) Copies the object if it hasn't been modified since the specified time, in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8).
+* `customer_algorithm` - (Optional) Specifies the algorithm to use to when encrypting the object (for example, AES256).
+* `customer_key` - (Optional) Specifies the customer-provided encryption key for Amazon S3 to use in encrypting data. This value is used to store the object and then it is discarded; Amazon S3 does not store the encryption key. The key must be appropriate for use with the algorithm specified in the x-amz-server-side-encryption-customer-algorithm header.
+* `customer_key_md5` - (Optional) Specifies the 128-bit MD5 digest of the encryption key according to RFC 1321. Amazon S3 uses this header for a message integrity check to ensure that the encryption key was transmitted without error.
+* `expected_bucket_owner` - (Optional) Account id of the expected destination bucket owner. If the destination bucket is owned by a different account, the request will fail with an HTTP 403 (Access Denied) error.
+* `expected_source_bucket_owner` - (Optional) Account id of the expected source bucket owner. If the source bucket is owned by a different account, the request will fail with an HTTP 403 (Access Denied) error.
+* `expires` - (Optional) Date and time at which the object is no longer cacheable, in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8).
+* `force_destroy` - (Optional) Allow the object to be deleted by removing any legal hold on any object version. Default is `false`. This value should be set to `true` only if the bucket has S3 object lock enabled.
+* `grant` - (Optional) Configuration block for header grants. Documented below. Conflicts with `acl`.
+* `kms_encryption_context` - (Optional) Specifies the AWS KMS Encryption Context to use for object encryption. The value is a base64-encoded UTF-8 string holding JSON with the encryption context key-value pairs.
+* `kms_key_id` - (Optional) Specifies the AWS KMS Key ARN to use for object encryption. This value is a fully qualified **ARN** of the KMS Key. If using `aws_kms_key`, use the exported `arn` attribute: `kms_key_id = aws_kms_key.foo.arn`
+* `metadata` - (Optional) Map of keys/values to provision metadata (will be automatically prefixed by `x-amz-meta-`, note that only lowercase label are currently supported by the AWS Go API).
+* `metadata_directive` - (Optional) Specifies whether the metadata is copied from the source object or replaced with metadata provided in the request. Valid values are `COPY` and `REPLACE`.
+* `object_lock_legal_hold_status` - (Optional) The [legal hold](https://docs.aws.amazon.com/AmazonS3/latest/dev/object-lock-overview.html#object-lock-legal-holds) status that you want to apply to the specified object. Valid values are `ON` and `OFF`.
+* `object_lock_mode` - (Optional) Object lock [retention mode](https://docs.aws.amazon.com/AmazonS3/latest/dev/object-lock-overview.html#object-lock-retention-modes) that you want to apply to this object. Valid values are `GOVERNANCE` and `COMPLIANCE`.
+* `object_lock_retain_until_date` - (Optional) Date and time, in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8), when this object's object lock will [expire](https://docs.aws.amazon.com/AmazonS3/latest/dev/object-lock-overview.html#object-lock-retention-periods).
+* `request_payer` - (Optional) Confirms that the requester knows that they will be charged for the request. Bucket owners need not specify this parameter in their requests. For information about downloading objects from requester pays buckets, see Downloading Objects in Requestor Pays Buckets (https://docs.aws.amazon.com/AmazonS3/latest/dev/ObjectsinRequesterPaysBuckets.html) in the Amazon S3 Developer Guide. If included, the only valid value is `requester`.
+* `server_side_encryption` - (Optional) Specifies server-side encryption of the object in S3. Valid values are `AES256` and `aws:kms`.
+* `source_customer_algorithm` - (Optional) Specifies the algorithm to use when decrypting the source object (for example, AES256).
+* `source_customer_key` - (Optional) Specifies the customer-provided encryption key for Amazon S3 to use to decrypt the source object. The encryption key provided in this header must be one that was used when the source object was created.
+* `source_customer_key_md5` - (Optional) Specifies the 128-bit MD5 digest of the encryption key according to RFC 1321. Amazon S3 uses this header for a message integrity check to ensure that the encryption key was transmitted without error.
+* `storage_class` - (Optional) Specifies the desired [storage class](https://docs.aws.amazon.com/AmazonS3/latest/API/API_CopyObject.html#AmazonS3-CopyObject-request-header-StorageClass) for the object. Defaults to `STANDARD`.
+* `tagging_directive` - (Optional) Specifies whether the object tag-set are copied from the source object or replaced with tag-set provided in the request. Valid values are `COPY` and `REPLACE`.
+* `tags` - (Optional) Map of tags to assign to the object. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `website_redirect` - (Optional) Specifies a target URL for [website redirect](http://docs.aws.amazon.com/AmazonS3/latest/dev/how-to-page-redirect.html).
+
+### grant
+
+-> For more information on header grants, see the Amazon Simple Storage Service (S3) [API Reference: PutObjectAcl](https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutObjectAcl.html).
+
+This configuration block has the following required arguments:
+
+* `permissions` - (Required) List of permissions to grant to grantee. Valid values are `READ`, `READ_ACP`, `WRITE_ACP`, `FULL_CONTROL`.
+* `type` - (Required) - Type of grantee. Valid values are `CanonicalUser`, `Group`, and `AmazonCustomerByEmail`.
+
+This configuration block has the following optional arguments (one of the three is required):
+
+* `email` - (Optional) Email address of the grantee. Used only when `type` is `AmazonCustomerByEmail`.  
+* `id` - (Optional) Canonical user ID of the grantee. Used only when `type` is `CanonicalUser`.  
+* `uri` - (Optional) URI of the grantee group. Used only when `type` is `Group`.
+
+-> **Note:** Terraform ignores all leading `/`s in the object's `key` and treats multiple `/`s in the rest of the object's `key` as a single `/`, so values of `/index.html` and `index.html` correspond to the same S3 object as do `first//second///third//` and `first/second/third/`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `checksum_crc32` - The base64-encoded, 32-bit CRC32 checksum of the object.
+* `checksum_crc32c` - The base64-encoded, 32-bit CRC32C checksum of the object.
+* `checksum_sha1` - The base64-encoded, 160-bit SHA-1 digest of the object.
+* `checksum_sha256` - The base64-encoded, 256-bit SHA-256 digest of the object.
+* `etag` - ETag generated for the object (an MD5 sum of the object content). For plaintext objects or objects encrypted with an AWS-managed key, the hash is an MD5 digest of the object data. For objects encrypted with a KMS key or objects created by either the Multipart Upload or Part Copy operation, the hash is not an MD5 digest, regardless of the method of encryption. More information on possible values can be found on [Common Response Headers](https://docs.aws.amazon.com/AmazonS3/latest/API/RESTCommonResponseHeaders.html).
+* `expiration` - If the object expiration is configured, this attribute will be set.
+* `id` - The `key` of the resource supplied above.
+* `last_modified` - Returns the date that the object was last modified, in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8).
+* `request_charged` - If present, indicates that the requester was successfully charged for the request.
+* `source_version_id` - Version of the copied object in the source bucket.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `version_id` - Version ID of the newly created copy.
+
+<!-- cache-key: cdktf-0.18.0 input-a85f1ab646454d1b2a5db0ee8a76202e123a448298b840089b1ec7bd23a4c87c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/s3control_access_point_policy.html.markdown b/website/docs/cdktf/python/r/s3control_access_point_policy.html.markdown
new file mode 100644
index 00000000000..43fccebde8d
--- /dev/null
+++ b/website/docs/cdktf/python/r/s3control_access_point_policy.html.markdown
@@ -0,0 +1,105 @@
+---
+subcategory: "S3 Control"
+layout: "aws"
+page_title: "AWS: aws_s3control_access_point_policy"
+description: |-
+  Provides a resource to manage an S3 Access Point resource policy.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_s3control_access_point_policy
+
+Provides a resource to manage an S3 Access Point resource policy.
+
+~> **NOTE on Access Points and Access Point Policies:** Terraform provides both a standalone Access Point Policy resource and an [Access Point](s3_access_point.html) resource with a resource policy defined in-line. You cannot use an Access Point with in-line resource policy in conjunction with an Access Point Policy resource. Doing so will cause a conflict of policies and will overwrite the access point's resource policy.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from cdktf import TerraformResourceLifecycle
+from constructs import Construct
+from cdktf import Token, Fn, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_access_point import S3AccessPoint
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_control_access_point_policy import S3ControlAccessPointPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = S3Bucket(self, "example",
+            bucket="example"
+        )
+        aws_s3_access_point_example = S3AccessPoint(self, "example_1",
+            bucket=example.id,
+            lifecycle=TerraformResourceLifecycle(
+                ignore_changes=[policy]
+            ),
+            name="example",
+            public_access_block_configuration=S3AccessPointPublicAccessBlockConfiguration(
+                block_public_acls=True,
+                block_public_policy=False,
+                ignore_public_acls=True,
+                restrict_public_buckets=False
+            )
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_access_point_example.override_logical_id("example")
+        aws_s3_control_access_point_policy_example = S3ControlAccessPointPolicy(self, "example_2",
+            access_point_arn=Token.as_string(aws_s3_access_point_example.arn),
+            policy=Token.as_string(
+                Fn.jsonencode({
+                    "Statement": [{
+                        "Action": "s3:GetObjectTagging",
+                        "Effect": "Allow",
+                        "Principal": {
+                            "AWS": "*"
+                        },
+                        "Resource": "${" + aws_s3_access_point_example.arn + "}/object/*"
+                    }
+                    ],
+                    "Version": "2008-10-17"
+                }))
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_control_access_point_policy_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `access_point_arn` - (Required) The ARN of the access point that you want to associate with the specified policy.
+* `policy` - (Required) The policy that you want to apply to the specified access point.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `has_public_access_policy` - Indicates whether this access point currently has a policy that allows public access.
+* `id` - The AWS account ID and access point name separated by a colon (`:`).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Access Point policies using the `access_point_arn`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Access Point policies using the `access_point_arn`. For example:
+
+```console
+% terraform import aws_s3control_access_point_policy.example arn:aws:s3:us-west-2:123456789012:accesspoint/example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-e5c457db50c72d6b30534efccf23fc63cd4d7f721d03d7a1b36a6e8875fa8261 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/s3control_bucket.html.markdown b/website/docs/cdktf/python/r/s3control_bucket.html.markdown
new file mode 100644
index 00000000000..f526714fd82
--- /dev/null
+++ b/website/docs/cdktf/python/r/s3control_bucket.html.markdown
@@ -0,0 +1,74 @@
+---
+subcategory: "S3 Control"
+layout: "aws"
+page_title: "AWS: aws_s3control_bucket"
+description: |-
+  Manages an S3 Control Bucket.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_s3control_bucket
+
+Provides a resource to manage an S3 Control Bucket.
+
+-> This functionality is for managing [S3 on Outposts](https://docs.aws.amazon.com/AmazonS3/latest/dev/S3onOutposts.html). To manage S3 Buckets in an AWS Partition, see the [`aws_s3_bucket` resource](/docs/providers/aws/r/s3_bucket.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_control_bucket import S3ControlBucket
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        S3ControlBucket(self, "example",
+            bucket="example",
+            outpost_id=Token.as_string(data_aws_outposts_outpost_example.id)
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `bucket` - (Required) Name of the bucket.
+* `outpost_id` - (Required) Identifier of the Outpost to contain this bucket.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the bucket.
+* `creation_date` - UTC creation date in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8).
+* `id` - Amazon Resource Name (ARN) of the bucket.
+* `public_access_block_enabled` - Boolean whether Public Access Block is enabled.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import S3 Control Buckets using Amazon Resource Name (ARN). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import S3 Control Buckets using Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_s3control_bucket.example arn:aws:s3-outposts:us-east-1:123456789012:outpost/op-12345678/bucket/example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-2e4677b75d6cbb099b0dd2b2385879475c02ebb3643475b93a119fd3833d7929 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/s3control_bucket_lifecycle_configuration.html.markdown b/website/docs/cdktf/python/r/s3control_bucket_lifecycle_configuration.html.markdown
new file mode 100644
index 00000000000..7882b89e44a
--- /dev/null
+++ b/website/docs/cdktf/python/r/s3control_bucket_lifecycle_configuration.html.markdown
@@ -0,0 +1,99 @@
+---
+subcategory: "S3 Control"
+layout: "aws"
+page_title: "AWS: aws_s3control_bucket_lifecycle_configuration"
+description: |-
+  Manages an S3 Control Bucket Lifecycle Configuration.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_s3control_bucket_lifecycle_configuration
+
+Provides a resource to manage an S3 Control Bucket Lifecycle Configuration.
+
+~> **NOTE:** Each S3 Control Bucket can only have one Lifecycle Configuration. Using multiple of this resource against the same S3 Control Bucket will result in perpetual differences each Terraform run.
+
+-> This functionality is for managing [S3 on Outposts](https://docs.aws.amazon.com/AmazonS3/latest/dev/S3onOutposts.html). To manage S3 Bucket Lifecycle Configurations in an AWS Partition, see the [`aws_s3_bucket` resource](/docs/providers/aws/r/s3_bucket.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_control_bucket_lifecycle_configuration import S3ControlBucketLifecycleConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        S3ControlBucketLifecycleConfiguration(self, "example",
+            bucket=Token.as_string(aws_s3_control_bucket_example.arn),
+            rule=[{
+                "expiration": {
+                    "days": 365
+                },
+                "filter": {
+                    "prefix": "logs/"
+                },
+                "id": "logs"
+            }, {
+                "expiration": {
+                    "days": 7
+                },
+                "filter": {
+                    "prefix": "temp/"
+                },
+                "id": "temp"
+            }
+            ]
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `bucket` - (Required) Amazon Resource Name (ARN) of the bucket.
+* `rule` - (Required) Configuration block(s) containing lifecycle rules for the bucket.
+    * `abort_incomplete_multipart_upload` - (Optional) Configuration block containing settings for abort incomplete multipart upload.
+        * `days_after_initiation` - (Required) Number of days after which Amazon S3 aborts an incomplete multipart upload.
+    * `expiration` - (Optional) Configuration block containing settings for expiration of objects.
+        * `date` - (Optional) Date the object is to be deleted. Should be in `YYYY-MM-DD` date format, e.g., `2020-09-30`.
+        * `days` - (Optional) Number of days before the object is to be deleted.
+        * `expired_object_delete_marker` - (Optional) Enable to remove a delete marker with no noncurrent versions. Cannot be specified with `date` or `days`.
+    * `filter` - (Optional) Configuration block containing settings for filtering.
+        * `prefix` - (Optional) Object prefix for rule filtering.
+        * `tags` - (Optional) Key-value map of object tags for rule filtering.
+    * `id` - (Required) Unique identifier for the rule.
+    * `status` - (Optional) Status of the rule. Valid values: `Enabled` and `Disabled`. Defaults to `Enabled`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Amazon Resource Name (ARN) of the bucket.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import S3 Control Bucket Lifecycle Configurations using the Amazon Resource Name (ARN). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import S3 Control Bucket Lifecycle Configurations using the Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_s3control_bucket_lifecycle_configuration.example arn:aws:s3-outposts:us-east-1:123456789012:outpost/op-12345678/bucket/example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-edd708f39cae61085d23015d0a484630286f25fd5088717d8cc3d17bdb735870 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/s3control_bucket_policy.html.markdown b/website/docs/cdktf/python/r/s3control_bucket_policy.html.markdown
new file mode 100644
index 00000000000..7a0b9a7e63d
--- /dev/null
+++ b/website/docs/cdktf/python/r/s3control_bucket_policy.html.markdown
@@ -0,0 +1,83 @@
+---
+subcategory: "S3 Control"
+layout: "aws"
+page_title: "AWS: aws_s3control_bucket_policy"
+description: |-
+  Manages an S3 Control Bucket Policy.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_s3control_bucket_policy
+
+Provides a resource to manage an S3 Control Bucket Policy.
+
+-> This functionality is for managing [S3 on Outposts](https://docs.aws.amazon.com/AmazonS3/latest/dev/S3onOutposts.html). To manage S3 Bucket Policies in an AWS Partition, see the [`aws_s3_bucket_policy` resource](/docs/providers/aws/r/s3_bucket_policy.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, Fn, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_control_bucket_policy import S3ControlBucketPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        S3ControlBucketPolicy(self, "example",
+            bucket=Token.as_string(aws_s3_control_bucket_example.arn),
+            policy=Token.as_string(
+                Fn.jsonencode({
+                    "Id": "testBucketPolicy",
+                    "Statement": [{
+                        "Action": "s3-outposts:PutBucketLifecycleConfiguration",
+                        "Effect": "Deny",
+                        "Principal": {
+                            "AWS": "*"
+                        },
+                        "Resource": aws_s3_control_bucket_example.arn,
+                        "Sid": "statement1"
+                    }
+                    ],
+                    "Version": "2012-10-17"
+                }))
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `bucket` - (Required) Amazon Resource Name (ARN) of the bucket.
+* `policy` - (Required) JSON string of the resource policy. For more information about building AWS IAM policy documents with Terraform, see the [AWS IAM Policy Document Guide](https://learn.hashicorp.com/terraform/aws/iam-policy).
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Amazon Resource Name (ARN) of the bucket.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import S3 Control Bucket Policies using the Amazon Resource Name (ARN). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import S3 Control Bucket Policies using the Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_s3control_bucket_policy.example arn:aws:s3-outposts:us-east-1:123456789012:outpost/op-12345678/bucket/example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-476caf1030f6a6d008cc6514d741ddf15b7e806dd275bf24bf545b7689e2f554 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/s3control_multi_region_access_point.html.markdown b/website/docs/cdktf/python/r/s3control_multi_region_access_point.html.markdown
new file mode 100644
index 00000000000..2d8eab5c8f7
--- /dev/null
+++ b/website/docs/cdktf/python/r/s3control_multi_region_access_point.html.markdown
@@ -0,0 +1,137 @@
+---
+subcategory: "S3 Control"
+layout: "aws"
+page_title: "AWS: aws_s3control_multi_region_access_point"
+description: |-
+  Provides a resource to manage an S3 Multi-Region Access Point associated with specified buckets.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_s3control_multi_region_access_point
+
+Provides a resource to manage an S3 Multi-Region Access Point associated with specified buckets.
+
+## Example Usage
+
+### Multiple AWS Buckets in Different Regions
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.provider import AwsProvider
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_control_multi_region_access_point import S3ControlMultiRegionAccessPoint
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        primary_region = AwsProvider(self, "aws",
+            alias="primary_region",
+            region="us-east-1"
+        )
+        secondary_region = AwsProvider(self, "aws_1",
+            alias="secondary_region",
+            region="us-west-2"
+        )
+        bar_bucket = S3Bucket(self, "bar_bucket",
+            bucket="example-bucket-bar",
+            provider=secondary_region
+        )
+        foo_bucket = S3Bucket(self, "foo_bucket",
+            bucket="example-bucket-foo",
+            provider=primary_region
+        )
+        S3ControlMultiRegionAccessPoint(self, "example",
+            details={
+                "name": "example",
+                "region": [{
+                    "bucket": foo_bucket.id
+                }, {
+                    "bucket": bar_bucket.id
+                }
+                ]
+            }
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `account_id` - (Optional) The AWS account ID for the owner of the buckets for which you want to create a Multi-Region Access Point. Defaults to automatically determined account ID of the Terraform AWS provider.
+* `details` - (Required) A configuration block containing details about the Multi-Region Access Point. See [Details Configuration Block](#details-configuration) below for more details
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `60m`)
+* `delete` - (Default `15m`)
+
+### Details Configuration
+
+The `details` block supports the following:
+
+* `name` - (Required) The name of the Multi-Region Access Point.
+* `public_access_block` - (Optional) Configuration block to manage the `PublicAccessBlock` configuration that you want to apply to this Multi-Region Access Point. You can enable the configuration options in any combination. See [Public Access Block Configuration](#public-access-block-configuration) below for more details.
+* `region` - (Required) The Region configuration block to specify the bucket associated with the Multi-Region Access Point. See [Region Configuration](#region-configuration) below for more details.
+
+For more information, see the documentation on [Multi-Region Access Points](https://docs.aws.amazon.com/AmazonS3/latest/userguide/MultiRegionAccessPoints.html).
+
+### Public Access Block Configuration
+
+The `public_access_block` block supports the following:
+
+* `block_public_acls` - (Optional) Whether Amazon S3 should block public ACLs for buckets in this account. Defaults to `true`. Enabling this setting does not affect existing policies or ACLs. When set to `true` causes the following behavior:
+    * PUT Bucket acl and PUT Object acl calls fail if the specified ACL is public.
+    * PUT Object calls fail if the request includes a public ACL.
+    * PUT Bucket calls fail if the request includes a public ACL.
+* `block_public_policy` - (Optional) Whether Amazon S3 should block public bucket policies for buckets in this account. Defaults to `true`. Enabling this setting does not affect existing bucket policies. When set to `true` causes Amazon S3 to:
+    * Reject calls to PUT Bucket policy if the specified bucket policy allows public access.
+* `ignore_public_acls` - (Optional) Whether Amazon S3 should ignore public ACLs for buckets in this account. Defaults to `true`. Enabling this setting does not affect the persistence of any existing ACLs and doesn't prevent new public ACLs from being set. When set to `true` causes Amazon S3 to:
+    * Ignore all public ACLs on buckets in this account and any objects that they contain.
+* `restrict_public_buckets` - (Optional) Whether Amazon S3 should restrict public bucket policies for buckets in this account. Defaults to `true`. Enabling this setting does not affect previously stored bucket policies, except that public and cross-account access within any public bucket policy, including non-public delegation to specific accounts, is blocked. When set to `true`:
+    * Only the bucket owner and AWS Services can access buckets with public policies.
+
+### Region Configuration
+
+The `region` block supports the following:
+
+* `bucket` - (Required) The name of the associated bucket for the Region.
+* `bucket_account_id` - (Optional) The AWS account ID that owns the Amazon S3 bucket that's associated with this Multi-Region Access Point.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `alias` - The alias for the Multi-Region Access Point.
+* `arn` - Amazon Resource Name (ARN) of the Multi-Region Access Point.
+* `domain_name` - The DNS domain name of the S3 Multi-Region Access Point in the format _`alias`_.accesspoint.s3-global.amazonaws.com. For more information, see the documentation on [Multi-Region Access Point Requests](https://docs.aws.amazon.com/AmazonS3/latest/userguide/MultiRegionAccessPointRequests.html).
+* `id` - The AWS account ID and access point name separated by a colon (`:`).
+* `status` - The current status of the Multi-Region Access Point. One of: `READY`, `INCONSISTENT_ACROSS_REGIONS`, `CREATING`, `PARTIALLY_CREATED`, `PARTIALLY_DELETED`, `DELETING`.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Multi-Region Access Points using the `account_id` and `name` of the Multi-Region Access Point separated by a colon (`:`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Multi-Region Access Points using the `account_id` and `name` of the Multi-Region Access Point separated by a colon (`:`). For example:
+
+```console
+% terraform import aws_s3control_multi_region_access_point.example 123456789012:example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-561f76eaf08b8898b3aa821b8c028e27dcb6512218497d376c771b48c1350f6b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/s3control_multi_region_access_point_policy.html.markdown b/website/docs/cdktf/python/r/s3control_multi_region_access_point_policy.html.markdown
new file mode 100644
index 00000000000..cbe6fa3318c
--- /dev/null
+++ b/website/docs/cdktf/python/r/s3control_multi_region_access_point_policy.html.markdown
@@ -0,0 +1,125 @@
+---
+subcategory: "S3 Control"
+layout: "aws"
+page_title: "AWS: aws_s3control_multi_region_access_point_policy"
+description: |-
+  Provides a resource to manage an S3 Multi-Region Access Point access control policy.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_s3control_multi_region_access_point_policy
+
+Provides a resource to manage an S3 Multi-Region Access Point access control policy.
+
+## Example Usage
+
+### Basic Example
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_caller_identity import DataAwsCallerIdentity
+from imports.aws.data_aws_partition import DataAwsPartition
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_control_multi_region_access_point import S3ControlMultiRegionAccessPoint
+from imports.aws.s3_control_multi_region_access_point_policy import S3ControlMultiRegionAccessPointPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        foo_bucket = S3Bucket(self, "foo_bucket",
+            bucket="example-bucket-foo"
+        )
+        example = S3ControlMultiRegionAccessPoint(self, "example",
+            details={
+                "name": "example",
+                "region": [{
+                    "bucket": foo_bucket.id
+                }
+                ]
+            }
+        )
+        current = DataAwsCallerIdentity(self, "current")
+        data_aws_partition_current = DataAwsPartition(self, "current_3")
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_partition_current.override_logical_id("current")
+        aws_s3_control_multi_region_access_point_policy_example =
+        S3ControlMultiRegionAccessPointPolicy(self, "example_4",
+            details={
+                "name": Token.as_string(Fn.element(Fn.split(":", example.id), 1)),
+                "policy": Token.as_string(
+                    Fn.jsonencode({
+                        "Statement": [{
+                            "Action": ["s3:GetObject", "s3:PutObject"],
+                            "Effect": "Allow",
+                            "Principal": {
+                                "AWS": current.account_id
+                            },
+                            "Resource": "arn:${" + data_aws_partition_current.partition + "}:s3::${" + current.account_id + "}:accesspoint/${" + example.alias + "}/object/*",
+                            "Sid": "Example"
+                        }
+                        ],
+                        "Version": "2012-10-17"
+                    }))
+            }
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_control_multi_region_access_point_policy_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `account_id` - (Optional) The AWS account ID for the owner of the Multi-Region Access Point. Defaults to automatically determined account ID of the Terraform AWS provider.
+* `details` - (Required) A configuration block containing details about the policy for the Multi-Region Access Point. See [Details Configuration Block](#details-configuration) below for more details
+
+### Details Configuration
+
+The `details` block supports the following:
+
+* `name` - (Required) The name of the Multi-Region Access Point.
+* `policy` - (Required) A valid JSON document that specifies the policy that you want to associate with this Multi-Region Access Point. Once applied, the policy can be edited, but not deleted. For more information, see the documentation on [Multi-Region Access Point Permissions](https://docs.aws.amazon.com/AmazonS3/latest/userguide/MultiRegionAccessPointPermissions.html).
+
+-> **NOTE:** When you update the `policy`, the update is first listed as the proposed policy. After the update is finished and all Regions have been updated, the proposed policy is listed as the established policy. If both policies have the same version number, the proposed policy is the established policy.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `established` - The last established policy for the Multi-Region Access Point.
+* `id` - The AWS account ID and access point name separated by a colon (`:`).
+* `proposed` - The proposed policy for the Multi-Region Access Point.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `15m`)
+* `update` - (Default `15m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Multi-Region Access Point Policies using the `account_id` and `name` of the Multi-Region Access Point separated by a colon (`:`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Multi-Region Access Point Policies using the `account_id` and `name` of the Multi-Region Access Point separated by a colon (`:`). For example:
+
+```console
+% terraform import aws_s3control_multi_region_access_point_policy.example 123456789012:example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-6d84687c8ce8ec13e291535641985a9d28347a18d016dfb47e30527efbd4dfec -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/s3control_object_lambda_access_point.html.markdown b/website/docs/cdktf/python/r/s3control_object_lambda_access_point.html.markdown
new file mode 100644
index 00000000000..1fa9f2b2b5b
--- /dev/null
+++ b/website/docs/cdktf/python/r/s3control_object_lambda_access_point.html.markdown
@@ -0,0 +1,125 @@
+---
+subcategory: "S3 Control"
+layout: "aws"
+page_title: "AWS: aws_s3control_object_lambda_access_point"
+description: |-
+  Provides a resource to manage an S3 Object Lambda Access Point.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_s3control_object_lambda_access_point
+
+Provides a resource to manage an S3 Object Lambda Access Point.
+An Object Lambda access point is associated with exactly one [standard access point](s3_access_point.html) and thus one Amazon S3 bucket.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_access_point import S3AccessPoint
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_control_object_lambda_access_point import S3ControlObjectLambdaAccessPoint
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = S3Bucket(self, "example",
+            bucket="example"
+        )
+        aws_s3_access_point_example = S3AccessPoint(self, "example_1",
+            bucket=example.id,
+            name="example"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_access_point_example.override_logical_id("example")
+        aws_s3_control_object_lambda_access_point_example =
+        S3ControlObjectLambdaAccessPoint(self, "example_2",
+            configuration={
+                "supporting_access_point": Token.as_string(aws_s3_access_point_example.arn),
+                "transformation_configuration": [{
+                    "actions": ["GetObject"],
+                    "content_transformation": {
+                        "aws_lambda": {
+                            "function_arn": Token.as_string(aws_lambda_function_example.arn)
+                        }
+                    }
+                }
+                ]
+            },
+            name="example"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_control_object_lambda_access_point_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `account_id` - (Optional) The AWS account ID for the owner of the bucket for which you want to create an Object Lambda Access Point. Defaults to automatically determined account ID of the Terraform AWS provider.
+* `configuration` - (Required) A configuration block containing details about the Object Lambda Access Point. See [Configuration](#configuration) below for more details.
+* `name` - (Required) The name for this Object Lambda Access Point.
+
+### Configuration
+
+The `configuration` block supports the following:
+
+* `allowed_features` - (Optional) Allowed features. Valid values: `GetObject-Range`, `GetObject-PartNumber`.
+* `cloud_watch_metrics_enabled` - (Optional) Whether or not the CloudWatch metrics configuration is enabled.
+* `supporting_access_point` - (Required) Standard access point associated with the Object Lambda Access Point.
+* `transformation_configuration` - (Required) List of transformation configurations for the Object Lambda Access Point. See [Transformation Configuration](#transformation-configuration) below for more details.
+
+### Transformation Configuration
+
+The `transformation_configuration` block supports the following:
+
+* `actions` - (Required) The actions of an Object Lambda Access Point configuration. Valid values: `GetObject`.
+* `content_transformation` - (Required) The content transformation of an Object Lambda Access Point configuration. See [Content Transformation](#content-transformation) below for more details.
+
+### Content Transformation
+
+The `content_transformation` block supports the following:
+
+* `aws_lambda` - (Required) Configuration for an AWS Lambda function. See [AWS Lambda](#aws-lambda) below for more details.
+
+### AWS Lambda
+
+The `aws_lambda` block supports the following:
+
+* `function_arn` - (Required) The Amazon Resource Name (ARN) of the AWS Lambda function.
+* `function_payload` - (Optional) Additional JSON that provides supplemental data to the Lambda function used to transform objects.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `alias` - Alias for the S3 Object Lambda Access Point.
+* `arn` - Amazon Resource Name (ARN) of the Object Lambda Access Point.
+* `id` - The AWS account ID and access point name separated by a colon (`:`).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Object Lambda Access Points using the `account_id` and `name`, separated by a colon (`:`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Object Lambda Access Points using the `account_id` and `name`, separated by a colon (`:`). For example:
+
+```console
+% terraform import aws_s3control_object_lambda_access_point.example 123456789012:example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1722496a257bb581d51080c0ab0b09b859a573051013001e69e87f94d3f99bed -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/s3control_object_lambda_access_point_policy.html.markdown b/website/docs/cdktf/python/r/s3control_object_lambda_access_point_policy.html.markdown
new file mode 100644
index 00000000000..dc9472a9063
--- /dev/null
+++ b/website/docs/cdktf/python/r/s3control_object_lambda_access_point_policy.html.markdown
@@ -0,0 +1,114 @@
+---
+subcategory: "S3 Control"
+layout: "aws"
+page_title: "AWS: aws_s3control_object_lambda_access_point_policy"
+description: |-
+  Provides a resource to manage an S3 Object Lambda Access Point resource policy.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_s3control_object_lambda_access_point_policy
+
+Provides a resource to manage an S3 Object Lambda Access Point resource policy.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, Fn, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_access_point import S3AccessPoint
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_control_object_lambda_access_point import S3ControlObjectLambdaAccessPoint
+from imports.aws.s3_control_object_lambda_access_point_policy import S3ControlObjectLambdaAccessPointPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = S3Bucket(self, "example",
+            bucket="example"
+        )
+        aws_s3_access_point_example = S3AccessPoint(self, "example_1",
+            bucket=example.id,
+            name="example"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_access_point_example.override_logical_id("example")
+        aws_s3_control_object_lambda_access_point_example =
+        S3ControlObjectLambdaAccessPoint(self, "example_2",
+            configuration={
+                "supporting_access_point": Token.as_string(aws_s3_access_point_example.arn),
+                "transformation_configuration": [{
+                    "actions": ["GetObject"],
+                    "content_transformation": {
+                        "aws_lambda": {
+                            "function_arn": Token.as_string(aws_lambda_function_example.arn)
+                        }
+                    }
+                }
+                ]
+            },
+            name="example"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_control_object_lambda_access_point_example.override_logical_id("example")
+        aws_s3_control_object_lambda_access_point_policy_example =
+        S3ControlObjectLambdaAccessPointPolicy(self, "example_3",
+            name=Token.as_string(aws_s3_control_object_lambda_access_point_example.name),
+            policy=Token.as_string(
+                Fn.jsonencode({
+                    "Statement": [{
+                        "Action": "s3-object-lambda:GetObject",
+                        "Effect": "Allow",
+                        "Principal": {
+                            "AWS": current.account_id
+                        },
+                        "Resource": aws_s3_control_object_lambda_access_point_example.arn
+                    }
+                    ],
+                    "Version": "2008-10-17"
+                }))
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_control_object_lambda_access_point_policy_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `account_id` - (Optional) The AWS account ID for the account that owns the Object Lambda Access Point. Defaults to automatically determined account ID of the Terraform AWS provider.
+* `name` - (Required) The name of the Object Lambda Access Point.
+* `policy` - (Required) The Object Lambda Access Point resource policy document.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `has_public_access_policy` - Indicates whether this access point currently has a policy that allows public access.
+* `id` - The AWS account ID and access point name separated by a colon (`:`).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Object Lambda Access Point policies using the `account_id` and `name`, separated by a colon (`:`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Object Lambda Access Point policies using the `account_id` and `name`, separated by a colon (`:`). For example:
+
+```console
+% terraform import aws_s3control_object_lambda_access_point_policy.example 123456789012:example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-5b9c13a7dd0a431d893638258adc51525d5b10d18a0ee8ec93b51bafe8ccf083 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/s3control_storage_lens_configuration.html.markdown b/website/docs/cdktf/python/r/s3control_storage_lens_configuration.html.markdown
new file mode 100644
index 00000000000..60c73399242
--- /dev/null
+++ b/website/docs/cdktf/python/r/s3control_storage_lens_configuration.html.markdown
@@ -0,0 +1,235 @@
+---
+subcategory: "S3 Control"
+layout: "aws"
+page_title: "AWS: aws_s3control_storage_lens_configuration"
+description: |-
+  Provides a resource to manage an S3 Storage Lens configuration.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_s3control_storage_lens_configuration
+
+Provides a resource to manage an S3 Storage Lens configuration.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_caller_identity import DataAwsCallerIdentity
+from imports.aws.s3_control_storage_lens_configuration import S3ControlStorageLensConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        current = DataAwsCallerIdentity(self, "current")
+        S3ControlStorageLensConfiguration(self, "example",
+            config_id="example-1",
+            storage_lens_configuration={
+                "account_level": {
+                    "activity_metrics": {
+                        "enabled": True
+                    },
+                    "bucket_level": {
+                        "activity_metrics": {
+                            "enabled": True
+                        }
+                    }
+                },
+                "data_export": {
+                    "cloud_watch_metrics": {
+                        "enabled": True
+                    },
+                    "s3_bucket_destination": {
+                        "account_id": Token.as_string(current.account_id),
+                        "arn": target.arn,
+                        "encryption": {
+                            "sse_s3": [{}]
+                        },
+                        "format": "CSV",
+                        "output_schema_version": "V_1"
+                    }
+                },
+                "enabled": True,
+                "exclude": {
+                    "buckets": [b1.arn, b2.arn],
+                    "regions": ["us-east-2"]
+                }
+            }
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `account_id` - (Optional) The AWS account ID for the S3 Storage Lens configuration. Defaults to automatically determined account ID of the Terraform AWS provider.
+* `config_id` - (Required) The ID of the S3 Storage Lens configuration.
+* `storage_lens_configuration` - (Required) The S3 Storage Lens configuration. See [Storage Lens Configuration](#storage-lens-configuration) below for more details.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Storage Lens Configuration
+
+The `storage_lens_configuration` block supports the following:
+
+* `account_level` (Required) The account-level configurations of the S3 Storage Lens configuration. See [Account Level](#account-level) below for more details.
+* `aws_org` (Optional) The Amazon Web Services organization for the S3 Storage Lens configuration. See [AWS Org](#aws-org) below for more details.
+* `data_export` (Optional) Properties of S3 Storage Lens metrics export including the destination, schema and format. See [Data Export](#data-export) below for more details.
+* `enabled` (Required) Whether the S3 Storage Lens configuration is enabled.
+* `exclude` (Optional) What is excluded in this configuration. Conflicts with `include`. See [Exclude](#exclude) below for more details.
+* `include` (Optional) What is included in this configuration. Conflicts with `exclude`. See [Include](#include) below for more details.
+
+### Account Level
+
+The `account_level` block supports the following:
+
+* `activity_metrics` (Optional) S3 Storage Lens activity metrics. See [Activity Metrics](#activity-metrics) below for more details.
+* `advanced_cost_optimization_metrics` (Optional) Advanced cost-optimization metrics for S3 Storage Lens. See [Advanced Cost-Optimization Metrics](#advanced-cost-optimization-metrics) below for more details.
+* `advanced_data_protection_metrics` (Optional) Advanced data-protection metrics for S3 Storage Lens. See [Advanced Data-Protection Metrics](#advanced-data-protection-metrics) below for more details.
+* `bucket_level` (Required) S3 Storage Lens bucket-level configuration. See [Bucket Level](#bucket-level) below for more details.
+* `detailed_status_code_metrics` (Optional) Detailed status code metrics for S3 Storage Lens. See [Detailed Status Code Metrics](#detailed-status-code-metrics) below for more details.
+
+### Activity Metrics
+
+The `activity_metrics` block supports the following:
+
+* `enabled` (Optional) Whether the activity metrics are enabled.
+
+### Advanced Cost-Optimization Metrics
+
+The `advanced_cost_optimization_metrics` block supports the following:
+
+* `enabled` (Optional) Whether advanced cost-optimization metrics are enabled.
+
+### Advanced Data-Protection Metrics
+
+The `advanced_data_protection_metrics` block supports the following:
+
+* `enabled` (Optional) Whether advanced data-protection metrics are enabled.
+
+### Detailed Status Code Metrics
+
+The `detailed_status_code_metrics` block supports the following:
+
+* `enabled` (Optional) Whether detailed status code metrics are enabled.
+
+### Bucket Level
+
+The `bucket_level` block supports the following:
+
+* `activity_metrics` (Optional) S3 Storage Lens activity metrics. See [Activity Metrics](#activity-metrics) above for more details.
+* `advanced_cost_optimization_metrics` (Optional) Advanced cost-optimization metrics for S3 Storage Lens. See [Advanced Cost-Optimization Metrics](#advanced-cost-optimization-metrics) above for more details.
+* `advanced_data_protection_metrics` (Optional) Advanced data-protection metrics for S3 Storage Lens. See [Advanced Data-Protection Metrics](#advanced-data-protection-metrics) above for more details.
+* `detailed_status_code_metrics` (Optional) Detailed status code metrics for S3 Storage Lens. See [Detailed Status Code Metrics](#detailed-status-code-metrics) above for more details.
+* `prefix_level` (Optional) Prefix-level metrics for S3 Storage Lens. See [Prefix Level](#prefix-level) below for more details.
+
+### Prefix Level
+
+The `prefix_level` block supports the following:
+
+* `storage_metrics` (Required) Prefix-level storage metrics for S3 Storage Lens. See [Prefix Level Storage Metrics](#prefix-level-storage-metrics) below for more details.
+
+### Prefix Level Storage Metrics
+
+The `storage_metrics` block supports the following:
+
+* `enabled` (Optional) Whether prefix-level storage metrics are enabled.
+* `selection_criteria` (Optional) Selection criteria. See [Selection Criteria](#selection-criteria) below for more details.
+
+### Selection Criteria
+
+The `selection_criteria` block supports the following:
+
+* `delimiter` (Optional) The delimiter of the selection criteria being used.
+* `max_depth` (Optional) The max depth of the selection criteria.
+* `min_storage_bytes_percentage` (Optional) The minimum number of storage bytes percentage whose metrics will be selected.
+
+### AWS Org
+
+The `aws_org` block supports the following:
+
+* `arn` (Required) The Amazon Resource Name (ARN) of the Amazon Web Services organization.
+
+### Data Export
+
+The `data_export` block supports the following:
+
+* `cloud_watch_metrics` (Optional) Amazon CloudWatch publishing for S3 Storage Lens metrics. See [Cloud Watch Metrics](#cloud-watch-metrics) below for more details.
+* `s3_bucket_destination` (Optional) The bucket where the S3 Storage Lens metrics export will be located. See [S3 Bucket Destination](#s3-bucket-destination) below for more details.
+
+### Cloud Watch Metrics
+
+The `cloud_watch_metrics` block supports the following:
+
+* `enabled` (Required) Whether CloudWatch publishing for S3 Storage Lens metrics is enabled.
+
+### S3 Bucket Destination
+
+The `s3_bucket_destination` block supports the following:
+
+* `account_id` (Required) The account ID of the owner of the S3 Storage Lens metrics export bucket.
+* `arn` (Required) The Amazon Resource Name (ARN) of the bucket.
+* `encryption` (Optional) Encryption of the metrics exports in this bucket. See [Encryption](#encryption) below for more details.
+* `format` (Required) The export format. Valid values: `CSV`, `Parquet`.
+* `output_schema_version` (Required) The schema version of the export file. Valid values: `V_1`.
+* `prefix` (Optional) The prefix of the destination bucket where the metrics export will be delivered.
+
+### Encryption
+
+The `encryption` block supports the following:
+
+* `sse_kms` (Optional) SSE-KMS encryption. See [SSE KMS](#sse-kms) below for more details.
+* `sse_s3` (Optional) SSE-S3 encryption. An empty configuration block `{}` should be used.
+
+### SSE KMS
+
+The `sse_kms` block supports the following:
+
+* `key_id` (Required) KMS key ARN.
+
+### Exclude
+
+The `exclude` block supports the following:
+
+* `buckets` (Optional) List of S3 bucket ARNs.
+* `regions` (Optional) List of AWS Regions.
+
+### Include
+
+The `include` block supports the following:
+
+* `buckets` (Optional) List of S3 bucket ARNs.
+* `regions` (Optional) List of AWS Regions.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the S3 Storage Lens configuration.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import S3 Storage Lens configurations using the `account_id` and `config_id`, separated by a colon (`:`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import S3 Storage Lens configurations using the `account_id` and `config_id`, separated by a colon (`:`). For example:
+
+```console
+% terraform import aws_s3control_storage_lens_configuration.example 123456789012:example-1
+```
+
+<!-- cache-key: cdktf-0.18.0 input-9a78e0cfb3d6a96dedf49697ad6a9c2449a751f987c0e874d9a0f885a390fd34 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/s3outposts_endpoint.html.markdown b/website/docs/cdktf/python/r/s3outposts_endpoint.html.markdown
new file mode 100644
index 00000000000..54de8297f27
--- /dev/null
+++ b/website/docs/cdktf/python/r/s3outposts_endpoint.html.markdown
@@ -0,0 +1,76 @@
+---
+subcategory: "S3 on Outposts"
+layout: "aws"
+page_title: "AWS: aws_s3outposts_endpoint"
+description: |-
+  Manages an S3 Outposts Endpoint.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_s3outposts_endpoint
+
+Provides a resource to manage an S3 Outposts Endpoint.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_outposts_endpoint import S3OutpostsEndpoint
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        S3OutpostsEndpoint(self, "example",
+            outpost_id=Token.as_string(data_aws_outposts_outpost_example.id),
+            security_group_id=Token.as_string(aws_security_group_example.id),
+            subnet_id=Token.as_string(aws_subnet_example.id)
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `outpost_id` - (Required) Identifier of the Outpost to contain this endpoint.
+* `security_group_id` - (Required) Identifier of the EC2 Security Group.
+* `subnet_id` - (Required) Identifier of the EC2 Subnet.
+* `access_type` - (Optional) Type of access for the network connectivity. Valid values are `Private` or `CustomerOwnedIp`.
+* `customer_owned_ipv4_pool` - (Optional) The ID of a Customer Owned IP Pool. For more on customer owned IP addresses see the [User Guide](https://docs.aws.amazon.com/outposts/latest/userguide/local-rack.html#local-gateway-subnet).
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the endpoint.
+* `cidr_block` - VPC CIDR block of the endpoint.
+* `creation_time` - UTC creation time in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8).
+* `id` - Amazon Resource Name (ARN) of the endpoint.
+* `network_interfaces` - Set of nested attributes for associated Elastic Network Interfaces (ENIs).
+    * `network_interface_id` - Identifier of the Elastic Network Interface (ENI).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import S3 Outposts Endpoints using Amazon Resource Name (ARN), EC2 Security Group identifier, and EC2 Subnet identifier, separated by commas (`,`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import S3 Outposts Endpoints using Amazon Resource Name (ARN), EC2 Security Group identifier, and EC2 Subnet identifier, separated by commas (`,`). For example:
+
+```console
+% terraform import aws_s3outposts_endpoint.example arn:aws:s3-outposts:us-east-1:123456789012:outpost/op-12345678/endpoint/0123456789abcdef,sg-12345678,subnet-12345678
+```
+
+<!-- cache-key: cdktf-0.18.0 input-b93127d0ddadbf29aad3870a10cc0f25e4ba9456be004933e642fe9c8e38df8b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/sagemaker_app.html.markdown b/website/docs/cdktf/python/r/sagemaker_app.html.markdown
new file mode 100644
index 00000000000..98aa1976d58
--- /dev/null
+++ b/website/docs/cdktf/python/r/sagemaker_app.html.markdown
@@ -0,0 +1,85 @@
+---
+subcategory: "SageMaker"
+layout: "aws"
+page_title: "AWS: aws_sagemaker_app"
+description: |-
+  Provides a SageMaker App resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sagemaker_app
+
+Provides a SageMaker App resource.
+
+## Example Usage
+
+### Basic usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.sagemaker_app import SagemakerApp
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SagemakerApp(self, "example",
+            app_name="example",
+            app_type="JupyterServer",
+            domain_id=Token.as_string(aws_sagemaker_domain_example.id),
+            user_profile_name=Token.as_string(aws_sagemaker_user_profile_example.user_profile_name)
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `app_name` - (Required) The name of the app.
+* `app_type` - (Required) The type of app. Valid values are `JupyterServer`, `KernelGateway`, `RStudioServerPro`, `RSessionGateway` and `TensorBoard`.
+* `domain_id` - (Required) The domain ID.
+* `user_profile_name` - (Optional) The user profile name. At least one of `user_profile_name` or `space_name` required.
+* `resource_spec` - (Optional) The instance type and the Amazon Resource Name (ARN) of the SageMaker image created on the instance.See [Resource Spec](#resource-spec) below.
+* `space_name` - (Optional) The name of the space. At least one of `user_profile_name` or `space_name` required.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Resource Spec
+
+* `instance_type` - (Optional) The instance type that the image version runs on. For valid values see [SageMaker Instance Types](https://docs.aws.amazon.com/sagemaker/latest/dg/notebooks-available-instance-types.html).
+* `lifecycle_config_arn` - (Optional) The Amazon Resource Name (ARN) of the Lifecycle Configuration attached to the Resource.
+* `sagemaker_image_arn` - (Optional) The ARN of the SageMaker image that the image version belongs to.
+* `sagemaker_image_version_arn` - (Optional) The ARN of the image version created on the instance.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Amazon Resource Name (ARN) of the app.
+* `arn` - The Amazon Resource Name (ARN) of the app.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SageMaker Apps using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import SageMaker Apps using the `id`. For example:
+
+```console
+% terraform import aws_sagemaker_app.example arn:aws:sagemaker:us-west-2:012345678912:app/domain-id/user-profile-name/app-type/app-name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-4688869d2d0264f189f117e28cdcaf279c2dff5e6217ac2d39772da0562dc585 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/sagemaker_app_image_config.html.markdown b/website/docs/cdktf/python/r/sagemaker_app_image_config.html.markdown
new file mode 100644
index 00000000000..8cc56cf7727
--- /dev/null
+++ b/website/docs/cdktf/python/r/sagemaker_app_image_config.html.markdown
@@ -0,0 +1,119 @@
+---
+subcategory: "SageMaker"
+layout: "aws"
+page_title: "AWS: aws_sagemaker_app_image_config"
+description: |-
+  Provides a SageMaker App Image Config resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sagemaker_app_image_config
+
+Provides a SageMaker App Image Config resource.
+
+## Example Usage
+
+### Basic usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.sagemaker_app_image_config import SagemakerAppImageConfig
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SagemakerAppImageConfig(self, "test",
+            app_image_config_name="example",
+            kernel_gateway_image_config=SagemakerAppImageConfigKernelGatewayImageConfig(
+                kernel_spec=SagemakerAppImageConfigKernelGatewayImageConfigKernelSpec(
+                    name="example"
+                )
+            )
+        )
+```
+
+### Default File System Config
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.sagemaker_app_image_config import SagemakerAppImageConfig
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SagemakerAppImageConfig(self, "test",
+            app_image_config_name="example",
+            kernel_gateway_image_config=SagemakerAppImageConfigKernelGatewayImageConfig(
+                file_system_config=SagemakerAppImageConfigKernelGatewayImageConfigFileSystemConfig(),
+                kernel_spec=SagemakerAppImageConfigKernelGatewayImageConfigKernelSpec(
+                    name="example"
+                )
+            )
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `app_image_config_name` - (Required) The name of the App Image Config.
+* `kernel_gateway_image_config` - (Optional) The configuration for the file system and kernels in a SageMaker image running as a KernelGateway app. See [Kernel Gateway Image Config](#kernel-gateway-image-config) details below.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Kernel Gateway Image Config
+
+* `file_system_config` - (Optional) The URL where the Git repository is located. See [File System Config](#file-system-config) details below.
+* `kernel_spec` - (Required) The default branch for the Git repository. See [Kernel Spec](#kernel-spec) details below.
+
+#### File System Config
+
+* `default_gid` - (Optional) The default POSIX group ID (GID). If not specified, defaults to `100`. Valid values are `0` and `100`.
+* `default_uid` - (Optional) The default POSIX user ID (UID). If not specified, defaults to `1000`. Valid values are `0` and `1000`.
+* `mount_path` - (Optional) The path within the image to mount the user's EFS home directory. The directory should be empty. If not specified, defaults to `/home/sagemaker-user`.
+
+~> **Note:** When specifying `default_gid` and `default_uid`, Valid value pairs are [`0`, `0`] and [`100`, `1000`].
+
+#### Kernel Spec
+
+* `name` - (Required) The name of the kernel.
+* `display_name` - (Optional) The display name of the kernel.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name of the App Image Config.
+* `arn` - The Amazon Resource Name (ARN) assigned by AWS to this App Image Config.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SageMaker App Image Configs using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import SageMaker App Image Configs using the `name`. For example:
+
+```console
+% terraform import aws_sagemaker_app_image_config.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-14b8c3e01271c34e8ad48f2ba367733e64aa64d95172742acd5b077fbda38cb8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/sagemaker_code_repository.html.markdown b/website/docs/cdktf/python/r/sagemaker_code_repository.html.markdown
new file mode 100644
index 00000000000..6c6f7e00769
--- /dev/null
+++ b/website/docs/cdktf/python/r/sagemaker_code_repository.html.markdown
@@ -0,0 +1,122 @@
+---
+subcategory: "SageMaker"
+layout: "aws"
+page_title: "AWS: aws_sagemaker_code_repository"
+description: |-
+  Provides a SageMaker Code Repository resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sagemaker_code_repository
+
+Provides a SageMaker Code Repository resource.
+
+## Example Usage
+
+### Basic usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.sagemaker_code_repository import SagemakerCodeRepository
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SagemakerCodeRepository(self, "example",
+            code_repository_name="example",
+            git_config=SagemakerCodeRepositoryGitConfig(
+                repository_url="https://github.com/hashicorp/terraform-provider-aws.git"
+            )
+        )
+```
+
+### Example with Secret
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.sagemaker_code_repository import SagemakerCodeRepository
+from imports.aws.secretsmanager_secret import SecretsmanagerSecret
+from imports.aws.secretsmanager_secret_version import SecretsmanagerSecretVersion
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = SecretsmanagerSecret(self, "example",
+            name="example"
+        )
+        aws_secretsmanager_secret_version_example =
+        SecretsmanagerSecretVersion(self, "example_1",
+            secret_id=example.id,
+            secret_string=Token.as_string(
+                Fn.jsonencode({
+                    "password": "example",
+                    "username": "example"
+                }))
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_secretsmanager_secret_version_example.override_logical_id("example")
+        aws_sagemaker_code_repository_example = SagemakerCodeRepository(self, "example_2",
+            code_repository_name="example",
+            depends_on=[aws_secretsmanager_secret_version_example],
+            git_config=SagemakerCodeRepositoryGitConfig(
+                repository_url="https://github.com/hashicorp/terraform-provider-aws.git",
+                secret_arn=example.arn
+            )
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_sagemaker_code_repository_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `code_repository_name` - (Required) The name of the Code Repository (must be unique).
+* `git_config` - (Required) Specifies details about the repository. see [Git Config](#git-config) details below.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Git Config
+
+* `repository_url` - (Required) The URL where the Git repository is located.
+* `branch` - (Optional) The default branch for the Git repository.
+* `secret_arn` - (Optional) The Amazon Resource Name (ARN) of the AWS Secrets Manager secret that contains the credentials used to access the git repository. The secret must have a staging label of AWSCURRENT and must be in the following format: `{"username": UserName, "password": Password}`
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name of the Code Repository.
+* `arn` - The Amazon Resource Name (ARN) assigned by AWS to this Code Repository.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SageMaker Code Repositories using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import SageMaker Code Repositories using the `name`. For example:
+
+```console
+% terraform import aws_sagemaker_code_repository.test_code_repository my-code-repo
+```
+
+<!-- cache-key: cdktf-0.18.0 input-f41c8a9771692edb44a7045ff9315ec42a11e03a25966ecdac6ca144a79c5a90 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/sagemaker_data_quality_job_definition.html.markdown b/website/docs/cdktf/python/r/sagemaker_data_quality_job_definition.html.markdown
new file mode 100644
index 00000000000..7b8c7d05ed4
--- /dev/null
+++ b/website/docs/cdktf/python/r/sagemaker_data_quality_job_definition.html.markdown
@@ -0,0 +1,195 @@
+---
+subcategory: "SageMaker"
+layout: "aws"
+page_title: "AWS: aws_sagemaker_data_quality_job_definition"
+description: |-
+  Provides a SageMaker Data Quality Job Definition resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sagemaker_data_quality_job_definition
+
+Provides a SageMaker data quality job definition resource.
+
+## Example Usage
+
+Basic usage:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.sagemaker_data_quality_job_definition import SagemakerDataQualityJobDefinition
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SagemakerDataQualityJobDefinition(self, "test",
+            data_quality_app_specification=SagemakerDataQualityJobDefinitionDataQualityAppSpecification(
+                image_uri=Token.as_string(monitor.registry_path)
+            ),
+            data_quality_job_input=SagemakerDataQualityJobDefinitionDataQualityJobInput(
+                endpoint_input=SagemakerDataQualityJobDefinitionDataQualityJobInputEndpointInput(
+                    endpoint_name=my_endpoint.name
+                )
+            ),
+            data_quality_job_output_config=SagemakerDataQualityJobDefinitionDataQualityJobOutputConfig(
+                monitoring_outputs=SagemakerDataQualityJobDefinitionDataQualityJobOutputConfigMonitoringOutputs(
+                    s3_output=SagemakerDataQualityJobDefinitionDataQualityJobOutputConfigMonitoringOutputsS3Output(
+                        s3_uri="https://${" + my_bucket.bucket_regional_domain_name + "}/output"
+                    )
+                )
+            ),
+            job_resources=SagemakerDataQualityJobDefinitionJobResources(
+                cluster_config=SagemakerDataQualityJobDefinitionJobResourcesClusterConfig(
+                    instance_count=1,
+                    instance_type="ml.t3.medium",
+                    volume_size_in_gb=20
+                )
+            ),
+            name="my-data-quality-job-definition",
+            role_arn=my_role.arn
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `data_quality_app_specification` - (Required) Specifies the container that runs the monitoring job. Fields are documented below.
+* `data_quality_baseline_config` - (Optional) Configures the constraints and baselines for the monitoring job. Fields are documented below.
+* `data_quality_job_input` - (Required) A list of inputs for the monitoring job. Fields are documented below.
+* `data_quality_job_output_config` - (Required) The output configuration for monitoring jobs. Fields are documented below.
+* `job_resources` - (Required) Identifies the resources to deploy for a monitoring job. Fields are documented below.
+* `name` - (Optional) The name of the data quality job definition. If omitted, Terraform will assign a random, unique name.
+* `network_config` - (Optional) Specifies networking configuration for the monitoring job. Fields are documented below.
+* `role_arn` - (Required) The Amazon Resource Name (ARN) of an IAM role that Amazon SageMaker can assume to perform tasks on your behalf.
+* `stopping_condition` - (Optional) A time limit for how long the monitoring job is allowed to run before stopping. Fields are documented below.
+* `tags` - (Optional) A mapping of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### data_quality_app_specification
+
+* `environment` - (Optional) Sets the environment variables in the container that the monitoring job runs. A list of key value pairs.
+* `image_uri` - (Required) The container image that the data quality monitoring job runs.
+* `post_analytics_processor_source_uri` - (Optional) An Amazon S3 URI to a script that is called after analysis has been performed. Applicable only for the built-in (first party) containers.
+* `record_preprocessor_source_uri` - (Optional) An Amazon S3 URI to a script that is called per row prior to running analysis. It can base64 decode the payload and convert it into a flatted json so that the built-in container can use the converted data. Applicable only for the built-in (first party) containers.
+
+### data_quality_baseline_config
+
+* `constraints_resource` - (Optional) The constraints resource for a monitoring job. Fields are documented below.
+* `statistics_resource` - (Optional) The statistics resource for a monitoring job. Fields are documented below.
+
+#### constraints_resource
+
+* `s3_uri` - (Optional) The Amazon S3 URI for the constraints resource.
+
+#### statistics_resource
+
+* `s3_uri` - (Optional) The Amazon S3 URI for the statistics resource.
+
+### data_quality_job_input
+
+* `batch_transform_input` - (Optional) Input object for the batch transform job. Fields are documented below.
+* `endpoint_input` - (Optional) Input object for the endpoint. Fields are documented below.
+
+#### batch_transform_input
+
+* `data_captured_destination_s3_uri` - (Required) The Amazon S3 location being used to capture the data.
+* `dataset_format` - (Required) The dataset format for your batch transform job. Fields are documented below.
+* `local_path` - (Optional) Path to the filesystem where the batch transform data is available to the container. Defaults to `/opt/ml/processing/input`.
+* `s3_data_distribution_type` - (Optional) Whether input data distributed in Amazon S3 is fully replicated or sharded by an S3 key. Defaults to `FullyReplicated`. Valid values are `FullyReplicated` or `ShardedByS3Key`
+* `s3_input_mode` - (Optional) Whether the `Pipe` or `File` is used as the input mode for transferring data for the monitoring job. `Pipe` mode is recommended for large datasets. `File` mode is useful for small files that fit in memory. Defaults to `File`.  Valid values are `Pipe` or `File`
+
+##### dataset_format
+
+* `csv` - (Optional) The CSV dataset used in the monitoring job. Fields are documented below.
+* `json` - (Optional) The JSON dataset used in the monitoring job. Fields are documented below.
+
+###### csv
+
+* `header` - (Optional) Indicates if the CSV data has a header.
+
+###### json
+
+* `line` - (Optional) Indicates if the file should be read as a json object per line.
+
+#### endpoint_input
+
+* `endpoint_name` - (Required) An endpoint in customer's account which has `data_capture_config` enabled.
+* `local_path` - (Optional) Path to the filesystem where the endpoint data is available to the container. Defaults to `/opt/ml/processing/input`.
+* `s3_data_distribution_type` - (Optional) Whether input data distributed in Amazon S3 is fully replicated or sharded by an S3 key. Defaults to `FullyReplicated`. Valid values are `FullyReplicated` or `ShardedByS3Key`
+* `s3_input_mode` - (Optional) Whether the `Pipe` or `File` is used as the input mode for transferring data for the monitoring job. `Pipe` mode is recommended for large datasets. `File` mode is useful for small files that fit in memory. Defaults to `File`.  Valid values are `Pipe` or `File`
+
+### data_quality_job_output_config
+
+* `kms_key_id` - (Optional) The AWS Key Management Service (AWS KMS) key that Amazon SageMaker uses to encrypt the model artifacts at rest using Amazon S3 server-side encryption.
+* `monitoring_outputs` - (Required) Monitoring outputs for monitoring jobs. This is where the output of the periodic monitoring jobs is uploaded. Fields are documented below.
+
+#### monitoring_outputs
+
+* `s3_output` - (Required) The Amazon S3 storage location where the results of a monitoring job are saved. Fields are documented below.
+
+##### s3_output
+
+* `local_path` - (Optional) The local path to the Amazon S3 storage location where Amazon SageMaker saves the results of a monitoring job. LocalPath is an absolute path for the output data. Defaults to `/opt/ml/processing/output`.
+* `s3_upload_mode` - (Optional) Whether to upload the results of the monitoring job continuously or after the job completes. Valid values are `Continuous` or `EndOfJob`
+* `s3_uri` - (Required) A URI that identifies the Amazon S3 storage location where Amazon SageMaker saves the results of a monitoring job.
+
+### job_resources
+
+* `cluster_config` - (Required) The configuration for the cluster resources used to run the processing job. Fields are documented below.
+
+#### cluster_config
+
+* `instance_count` - (Required) The number of ML compute instances to use in the model monitoring job. For distributed processing jobs, specify a value greater than 1.
+* `instance_type` - (Required) The ML compute instance type for the processing job.
+* `volume_kms_key_id` - (Optional) The AWS Key Management Service (AWS KMS) key that Amazon SageMaker uses to encrypt data on the storage volume attached to the ML compute instance(s) that run the model monitoring job.
+* `volume_size_in_gb` - (Required) The size of the ML storage volume, in gigabytes, that you want to provision. You must specify sufficient ML storage for your scenario.
+
+### network_config
+
+* `enable_inter_container_traffic_encryption` - (Optional) Whether to encrypt all communications between the instances used for the monitoring jobs. Choose `true` to encrypt communications. Encryption provides greater security for distributed jobs, but the processing might take longer.
+* `enable_network_isolation` - (Optional) Whether to allow inbound and outbound network calls to and from the containers used for the monitoring job.
+* `vpc_config` - (Optional) Specifies a VPC that your training jobs and hosted models have access to. Control access to and from your training and model containers by configuring the VPC. Fields are documented below.
+
+#### vpc_config
+
+* `security_group_ids` - (Required) The VPC security group IDs, in the form sg-xxxxxxxx. Specify the security groups for the VPC that is specified in the `subnets` field.
+* `subnets` - (Required) The ID of the subnets in the VPC to which you want to connect your training job or model.
+
+### stopping_condition
+
+* `max_runtime_in_seconds` - (Required) The maximum runtime allowed in seconds.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) assigned by AWS to this data quality job definition.
+* `name` - The name of the data quality job definition.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import data quality job definitions using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import data quality job definitions using the `name`. For example:
+
+```console
+% terraform import aws_sagemaker_data_quality_job_definition.test_data_quality_job_definition data-quality-job-definition-foo
+```
+
+<!-- cache-key: cdktf-0.18.0 input-89befb37e0c306bddb162e6069b25cc35d269452c0d563034978f681c073a661 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/sagemaker_device.html.markdown b/website/docs/cdktf/python/r/sagemaker_device.html.markdown
new file mode 100644
index 00000000000..d32f24aee20
--- /dev/null
+++ b/website/docs/cdktf/python/r/sagemaker_device.html.markdown
@@ -0,0 +1,78 @@
+---
+subcategory: "SageMaker"
+layout: "aws"
+page_title: "AWS: aws_sagemaker_device"
+description: |-
+  Provides a SageMaker Device resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sagemaker_device
+
+Provides a SageMaker Device resource.
+
+## Example Usage
+
+### Basic usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.sagemaker_device import SagemakerDevice
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SagemakerDevice(self, "example",
+            device=SagemakerDeviceDevice(
+                device_name="example"
+            ),
+            device_fleet_name=Token.as_string(aws_sagemaker_device_fleet_example.device_fleet_name)
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `device_fleet_name` - (Required) The name of the Device Fleet.
+* `device` - (Required) The device to register with SageMaker Edge Manager. See [Device](#device) details below.
+
+### Device
+
+* `description` - (Required) A description for the device.
+* `device_name` - (Optional) The name of the device.
+* `iot_thing_name` - (Optional) Amazon Web Services Internet of Things (IoT) object name.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The id is constructed from `device-fleet-name/device-name`.
+* `arn` - The Amazon Resource Name (ARN) assigned by AWS to this Device.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SageMaker Devices using the `device-fleet-name/device-name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import SageMaker Devices using the `device-fleet-name/device-name`. For example:
+
+```console
+% terraform import aws_sagemaker_device.example my-fleet/my-device
+```
+
+<!-- cache-key: cdktf-0.18.0 input-baa6c522eea0c7f933208c4fefa045d0c6a31387586c39061b3b1a1c768ab3ca -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/sagemaker_device_fleet.html.markdown b/website/docs/cdktf/python/r/sagemaker_device_fleet.html.markdown
new file mode 100644
index 00000000000..f69236d8f95
--- /dev/null
+++ b/website/docs/cdktf/python/r/sagemaker_device_fleet.html.markdown
@@ -0,0 +1,83 @@
+---
+subcategory: "SageMaker"
+layout: "aws"
+page_title: "AWS: aws_sagemaker_device_fleet"
+description: |-
+  Provides a SageMaker Device Fleet resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sagemaker_device_fleet
+
+Provides a SageMaker Device Fleet resource.
+
+## Example Usage
+
+### Basic usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.sagemaker_device_fleet import SagemakerDeviceFleet
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SagemakerDeviceFleet(self, "example",
+            device_fleet_name="example",
+            output_config=SagemakerDeviceFleetOutputConfig(
+                s3_output_location="s3://${" + aws_s3_bucket_example.bucket + "}/prefix/"
+            ),
+            role_arn=test.arn
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `device_fleet_name` - (Required) The name of the Device Fleet (must be unique).
+* `role_arn` - (Required) The Amazon Resource Name (ARN) that has access to AWS Internet of Things (IoT).
+* `output_config` - (Required) Specifies details about the repository. see [Output Config](#output-config) details below.
+* `description` - (Optional) A description of the fleet.
+* `enable_iot_role_alias` - (Optional) Whether to create an AWS IoT Role Alias during device fleet creation. The name of the role alias generated will match this pattern: "SageMakerEdge-{DeviceFleetName}".
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Output Config
+
+* `s3_output_location` - (Required) The Amazon Simple Storage (S3) bucker URI.
+* `kms_key_id` - (Optional) The AWS Key Management Service (AWS KMS) key that Amazon SageMaker uses to encrypt data on the storage volume after compilation job. If you don't provide a KMS key ID, Amazon SageMaker uses the default KMS key for Amazon S3 for your role's account.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name of the Device Fleet.
+* `arn` - The Amazon Resource Name (ARN) assigned by AWS to this Device Fleet.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SageMaker Device Fleets using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import SageMaker Device Fleets using the `name`. For example:
+
+```console
+% terraform import aws_sagemaker_device_fleet.example my-fleet
+```
+
+<!-- cache-key: cdktf-0.18.0 input-02fc3724649faa5d99b8102304ae3dbcf8bf2eccc9a7bae5038774ad140d380e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/sagemaker_domain.html.markdown b/website/docs/cdktf/python/r/sagemaker_domain.html.markdown
new file mode 100644
index 00000000000..28c965f8892
--- /dev/null
+++ b/website/docs/cdktf/python/r/sagemaker_domain.html.markdown
@@ -0,0 +1,278 @@
+---
+subcategory: "SageMaker"
+layout: "aws"
+page_title: "AWS: aws_sagemaker_domain"
+description: |-
+  Provides a SageMaker Domain resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sagemaker_domain
+
+Provides a SageMaker Domain resource.
+
+## Example Usage
+
+### Basic usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.iam_role import IamRole
+from imports.aws.sagemaker_domain import SagemakerDomain
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = DataAwsIamPolicyDocument(self, "example",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["sts:AssumeRole"],
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["sagemaker.amazonaws.com"],
+                    type="Service"
+                )
+                ]
+            )
+            ]
+        )
+        aws_iam_role_example = IamRole(self, "example_1",
+            assume_role_policy=Token.as_string(example.json),
+            name="example",
+            path="/"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_role_example.override_logical_id("example")
+        aws_sagemaker_domain_example = SagemakerDomain(self, "example_2",
+            auth_mode="IAM",
+            default_user_settings=SagemakerDomainDefaultUserSettings(
+                execution_role=Token.as_string(aws_iam_role_example.arn)
+            ),
+            domain_name="example",
+            subnet_ids=[Token.as_string(aws_subnet_example.id)],
+            vpc_id=Token.as_string(aws_vpc_example.id)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_sagemaker_domain_example.override_logical_id("example")
+```
+
+### Using Custom Images
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.sagemaker_app_image_config import SagemakerAppImageConfig
+from imports.aws.sagemaker_domain import SagemakerDomain
+from imports.aws.sagemaker_image import SagemakerImage
+from imports.aws.sagemaker_image_version import SagemakerImageVersion
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = SagemakerAppImageConfig(self, "example",
+            app_image_config_name="example",
+            kernel_gateway_image_config=SagemakerAppImageConfigKernelGatewayImageConfig(
+                kernel_spec=SagemakerAppImageConfigKernelGatewayImageConfigKernelSpec(
+                    name="example"
+                )
+            )
+        )
+        aws_sagemaker_image_example = SagemakerImage(self, "example_1",
+            image_name="example",
+            role_arn=Token.as_string(aws_iam_role_example.arn)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_sagemaker_image_example.override_logical_id("example")
+        aws_sagemaker_image_version_example = SagemakerImageVersion(self, "example_2",
+            base_image="base-image",
+            image_name=Token.as_string(aws_sagemaker_image_example.id)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_sagemaker_image_version_example.override_logical_id("example")
+        aws_sagemaker_domain_example = SagemakerDomain(self, "example_3",
+            auth_mode="IAM",
+            default_user_settings=SagemakerDomainDefaultUserSettings(
+                execution_role=Token.as_string(aws_iam_role_example.arn),
+                kernel_gateway_app_settings=SagemakerDomainDefaultUserSettingsKernelGatewayAppSettings(
+                    custom_image=[SagemakerDomainDefaultUserSettingsKernelGatewayAppSettingsCustomImage(
+                        app_image_config_name=example.app_image_config_name,
+                        image_name=Token.as_string(aws_sagemaker_image_version_example.image_name)
+                    )
+                    ]
+                )
+            ),
+            domain_name="example",
+            subnet_ids=[Token.as_string(aws_subnet_example.id)],
+            vpc_id=Token.as_string(aws_vpc_example.id)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_sagemaker_domain_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `auth_mode` - (Required) The mode of authentication that members use to access the domain. Valid values are `IAM` and `SSO`.
+* `default_space_settings` - (Required) The default space settings. See [Default Space Settings](#default_space_settings) below.
+* `default_user_settings` - (Required) The default user settings. See [Default User Settings](#default_user_settings) below.* `domain_name` - (Required) The domain name.
+* `subnet_ids` - (Required) The VPC subnets that Studio uses for communication.
+* `vpc_id` - (Required) The ID of the Amazon Virtual Private Cloud (VPC) that Studio uses for communication.
+
+The following arguments are optional:
+
+* `app_network_access_type` - (Optional) Specifies the VPC used for non-EFS traffic. The default value is `PublicInternetOnly`. Valid values are `PublicInternetOnly` and `VpcOnly`.
+* `app_security_group_management` - (Optional) The entity that creates and manages the required security groups for inter-app communication in `VPCOnly` mode. Valid values are `Service` and `Customer`.
+* `domain_settings` - (Optional) The domain settings. See [Domain Settings](#domain_settings) below.
+* `domain_settings` - (Optional) The domain's settings.
+* `kms_key_id` - (Optional) The AWS KMS customer managed CMK used to encrypt the EFS volume attached to the domain.
+* `retention_policy` - (Optional) The retention policy for this domain, which specifies whether resources will be retained after the Domain is deleted. By default, all resources are retained. See [Retention Policy](#retention_policy) below.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### default_space_settings
+
+* `execution_role` - (Required) The execution role for the space.
+* `jupyter_server_app_settings` - (Optional) The Jupyter server's app settings. See [Jupyter Server App Settings](#jupyter_server_app_settings) below.
+* `kernel_gateway_app_settings` - (Optional) The kernel gateway app settings. See [Kernel Gateway App Settings](#kernel_gateway_app_settings) below.
+* `security_groups` - (Optional) The security groups for the Amazon Virtual Private Cloud that the space uses for communication.
+
+### default_user_settings
+
+* `execution_role` - (Required) The execution role ARN for the user.
+* `canvas_app_settings` - (Optional) The Canvas app settings. See [Canvas App Settings](#canvas_app_settings) below.
+* `jupyter_server_app_settings` - (Optional) The Jupyter server's app settings. See [Jupyter Server App Settings](#jupyter_server_app_settings) below.
+* `kernel_gateway_app_settings` - (Optional) The kernel gateway app settings. See [Kernel Gateway App Settings](#kernel_gateway_app_settings) below.
+* `r_session_app_settings` - (Optional) The RSession app settings. See [RSession App Settings](#r_session_app_settings) below.
+* `r_studio_server_pro_app_settings` - (Optional) A collection of settings that configure user interaction with the RStudioServerPro app. See [RStudioServerProAppSettings](#r_studio_server_pro_app_settings) below.
+* `security_groups` - (Optional) A list of security group IDs that will be attached to the user.
+* `sharing_settings` - (Optional) The sharing settings. See [Sharing Settings](#sharing_settings) below.
+* `tensor_board_app_settings` - (Optional) The TensorBoard app settings. See [TensorBoard App Settings](#tensor_board_app_settings) below.
+
+#### r_studio_server_pro_app_settings
+
+* `access_status` - (Optional) Indicates whether the current user has access to the RStudioServerPro app. Valid values are `ENABLED` and `DISABLED`.
+* `user_group` - (Optional) The level of permissions that the user has within the RStudioServerPro app. This value defaults to `R_STUDIO_USER`. The `R_STUDIO_ADMIN` value allows the user access to the RStudio Administrative Dashboard. Valid values are `R_STUDIO_USER` and `R_STUDIO_ADMIN`.
+
+#### canvas_app_settings
+
+* `model_register_settings` - (Optional) The model registry settings for the SageMaker Canvas application. See [Model Register Settings](#model_register_settings) below.
+* `time_series_forecasting_settings` - (Optional) Time series forecast settings for the Canvas app. See [Time Series Forecasting Settings](#time_series_forecasting_settings) below.
+* `workspace_settings` - (Optional) The workspace settings for the SageMaker Canvas application. See [Workspace Settings](#workspace_settings) below.
+
+##### model_register_settings
+
+* `cross_account_model_register_role_arn` - (Optional) The Amazon Resource Name (ARN) of the SageMaker model registry account. Required only to register model versions created by a different SageMaker Canvas AWS account than the AWS account in which SageMaker model registry is set up.
+* `status` - (Optional) Describes whether the integration to the model registry is enabled or disabled in the Canvas application. Valid values are `ENABLED` and `DISABLED`.
+
+##### time_series_forecasting_settings
+
+* `amazon_forecast_role_arn` - (Optional) The IAM role that Canvas passes to Amazon Forecast for time series forecasting. By default, Canvas uses the execution role specified in the UserProfile that launches the Canvas app. If an execution role is not specified in the UserProfile, Canvas uses the execution role specified in the Domain that owns the UserProfile. To allow time series forecasting, this IAM role should have the [AmazonSageMakerCanvasForecastAccess](https://docs.aws.amazon.com/sagemaker/latest/dg/security-iam-awsmanpol-canvas.html#security-iam-awsmanpol-AmazonSageMakerCanvasForecastAccess) policy attached and forecast.amazonaws.com added in the trust relationship as a service principal.
+* `status` - (Optional) Describes whether time series forecasting is enabled or disabled in the Canvas app. Valid values are `ENABLED` and `DISABLED`.
+
+##### workspace_settings
+
+* `s3_artifact_path` - (Optional) The Amazon S3 bucket used to store artifacts generated by Canvas. Updating the Amazon S3 location impacts existing configuration settings, and Canvas users no longer have access to their artifacts. Canvas users must log out and log back in to apply the new location.
+* `s3_kms_key_id` - (Optional) The Amazon Web Services Key Management Service (KMS) encryption key ID that is used to encrypt artifacts generated by Canvas in the Amazon S3 bucket.
+
+#### sharing_settings
+
+* `notebook_output_option` - (Optional) Whether to include the notebook cell output when sharing the notebook. The default is `Disabled`. Valid values are `Allowed` and `Disabled`.
+* `s3_kms_key_id` - (Optional) When `notebook_output_option` is Allowed, the AWS Key Management Service (KMS) encryption key ID used to encrypt the notebook cell output in the Amazon S3 bucket.
+* `s3_output_path` - (Optional) When `notebook_output_option` is Allowed, the Amazon S3 bucket used to save the notebook cell output.
+
+#### tensor_board_app_settings
+
+* `default_resource_spec` - (Optional) The default instance type and the Amazon Resource Name (ARN) of the SageMaker image created on the instance. see [Default Resource Spec](#default_resource_spec) below.
+
+#### kernel_gateway_app_settings
+
+* `custom_image` - (Optional) A list of custom SageMaker images that are configured to run as a KernelGateway app. see [Custom Image](#custom_image) below.
+* `default_resource_spec` - (Optional) The default instance type and the Amazon Resource Name (ARN) of the SageMaker image created on the instance. see [Default Resource Spec](#default_resource_spec) below.
+* `lifecycle_config_arns` - (Optional) The Amazon Resource Name (ARN) of the Lifecycle Configurations.
+
+#### jupyter_server_app_settings
+
+* `code_repository` - (Optional) A list of Git repositories that SageMaker automatically displays to users for cloning in the JupyterServer application. see [Code Repository](#code_repository) below.
+* `default_resource_spec` - (Optional) The default instance type and the Amazon Resource Name (ARN) of the SageMaker image created on the instance. see [Default Resource Spec](#default_resource_spec) below.
+* `lifecycle_config_arns` - (Optional) The Amazon Resource Name (ARN) of the Lifecycle Configurations.
+
+##### code_repository
+
+* `repository_url` - (Optional) The URL of the Git repository.
+
+##### default_resource_spec
+
+* `instance_type` - (Optional) The instance type that the image version runs on.. For valid values see [SageMaker Instance Types](https://docs.aws.amazon.com/sagemaker/latest/dg/notebooks-available-instance-types.html).
+* `lifecycle_config_arn` - (Optional) The Amazon Resource Name (ARN) of the Lifecycle Configuration attached to the Resource.
+* `sagemaker_image_arn` - (Optional) The ARN of the SageMaker image that the image version belongs to.
+* `sagemaker_image_version_arn` - (Optional) The ARN of the image version created on the instance.
+
+#### r_session_app_settings
+
+* `custom_image` - (Optional) A list of custom SageMaker images that are configured to run as a KernelGateway app. see [Custom Image](#custom_image) below.
+* `default_resource_spec` - (Optional) The default instance type and the Amazon Resource Name (ARN) of the SageMaker image created on the instance. see [Default Resource Spec](#default_resource_spec) below.
+
+##### custom_image
+
+* `app_image_config_name` - (Required) The name of the App Image Config.
+* `image_name` - (Required) The name of the Custom Image.
+* `image_version_number` - (Optional) The version number of the Custom Image.
+
+### domain_settings
+
+* `execution_role_identity_config` - (Optional) The configuration for attaching a SageMaker user profile name to the execution role as a sts:SourceIdentity key [AWS Docs](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_control-access_monitor.html). Valid values are `USER_PROFILE_NAME` and `DISABLED`.
+* `r_studio_server_pro_domain_settings` - (Optional) A collection of settings that configure the RStudioServerPro Domain-level app. see [RStudioServerProDomainSettings](#r_studio_server_pro_domain_settings) below.
+* `security_group_ids` - (Optional) The security groups for the Amazon Virtual Private Cloud that the Domain uses for communication between Domain-level apps and user apps.
+
+#### r_studio_server_pro_domain_settings
+
+* `default_resource_spec` - (Optional) The default instance type and the Amazon Resource Name (ARN) of the SageMaker image created on the instance. see [Default Resource Spec](#default_resource_spec) below.
+* `domain_execution_role_arn` - (Required) The ARN of the execution role for the RStudioServerPro Domain-level app.
+* `r_studio_connect_url` - (Optional) A URL pointing to an RStudio Connect server.
+* `r_studio_package_manager_url` - (Optional) A URL pointing to an RStudio Package Manager server.
+
+### retention_policy
+
+* `home_efs_file_system` - (Optional) The retention policy for data stored on an Amazon Elastic File System (EFS) volume. Valid values are `Retain` or `Delete`.  Default value is `Retain`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the Domain.
+* `arn` - The Amazon Resource Name (ARN) assigned by AWS to this Domain.
+* `url` - The domain's URL.
+* `single_sign_on_managed_application_instance_id` - The SSO managed application instance ID.
+* `security_group_id_for_domain_boundary` - The ID of the security group that authorizes traffic between the RSessionGateway apps and the RStudioServerPro app.
+* `home_efs_file_system_id` - The ID of the Amazon Elastic File System (EFS) managed by this Domain.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SageMaker Domains using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import SageMaker Domains using the `id`. For example:
+
+```console
+% terraform import aws_sagemaker_domain.test_domain d-8jgsjtilstu8
+```
+
+<!-- cache-key: cdktf-0.18.0 input-19db5ea50c6e2c5430e3020c46bbc94271da9af4b5dcb1c6e538ebe50443f56a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/sagemaker_endpoint.html.markdown b/website/docs/cdktf/python/r/sagemaker_endpoint.html.markdown
new file mode 100644
index 00000000000..d3d48ca85a4
--- /dev/null
+++ b/website/docs/cdktf/python/r/sagemaker_endpoint.html.markdown
@@ -0,0 +1,130 @@
+---
+subcategory: "SageMaker"
+layout: "aws"
+page_title: "AWS: aws_sagemaker_endpoint"
+description: |-
+  Provides a SageMaker Endpoint resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sagemaker_endpoint
+
+Provides a SageMaker Endpoint resource.
+
+## Example Usage
+
+Basic usage:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.sagemaker_endpoint import SagemakerEndpoint
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SagemakerEndpoint(self, "e",
+            endpoint_config_name=ec.name,
+            name="my-endpoint",
+            tags={
+                "Name": "foo"
+            }
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `endpoint_config_name` - (Required) The name of the endpoint configuration to use.
+* `deployment_config` - (Optional) The deployment configuration for an endpoint, which contains the desired deployment strategy and rollback configurations. See [Deployment Config](#deployment-config).
+* `name` - (Optional) The name of the endpoint. If omitted, Terraform will assign a random, unique name.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Deployment Config
+
+* `blue_green_update_policy` - (Optional) Update policy for a blue/green deployment. If this update policy is specified, SageMaker creates a new fleet during the deployment while maintaining the old fleet. SageMaker flips traffic to the new fleet according to the specified traffic routing configuration. Only one update policy should be used in the deployment configuration. If no update policy is specified, SageMaker uses a blue/green deployment strategy with all at once traffic shifting by default. See [Blue Green Update Config](#blue-green-update-config).
+* `auto_rollback_configuration` - (Optional) Automatic rollback configuration for handling endpoint deployment failures and recovery. See [Auto Rollback Configuration](#auto-rollback-configuration).
+* `rolling_update_policy` - (Optional) Specifies a rolling deployment strategy for updating a SageMaker endpoint. See [Rolling Update Policy](#rolling-update-policy).
+
+#### Blue Green Update Config
+
+* `traffic_routing_configuration` - (Required) Defines the traffic routing strategy to shift traffic from the old fleet to the new fleet during an endpoint deployment. See [Traffic Routing Configuration](#traffic-routing-configuration).
+* `maximum_execution_timeout_in_seconds` - (Optional) Maximum execution timeout for the deployment. Note that the timeout value should be larger than the total waiting time specified in `termination_wait_in_seconds` and `wait_interval_in_seconds`. Valid values are between `600` and `14400`.
+* `termination_wait_in_seconds` - (Optional) Additional waiting time in seconds after the completion of an endpoint deployment before terminating the old endpoint fleet. Default is `0`. Valid values are between `0` and `3600`.
+
+#### Rolling Update Policy
+
+* `maximum_batch_size` - (Required) Batch size for each rolling step to provision capacity and turn on traffic on the new endpoint fleet, and terminate capacity on the old endpoint fleet. Value must be between 5% to 50% of the variant's total instance count. See [Maximum Batch Size](#maximum-batch-size).
+* `maximum_execution_timeout_in_seconds` - (Optional) The time limit for the total deployment. Exceeding this limit causes a timeout. Valid values are between `600` and `14400`.
+* `rollback_maximum_batch_size` - (Optional) Batch size for rollback to the old endpoint fleet. Each rolling step to provision capacity and turn on traffic on the old endpoint fleet, and terminate capacity on the new endpoint fleet. If this field is absent, the default value will be set to 100% of total capacity which means to bring up the whole capacity of the old fleet at once during rollback. See [Rollback Maximum Batch Size](#rollback-maximum-batch-size).
+* `wait_interval_in_seconds` - (Required) The length of the baking period, during which SageMaker monitors alarms for each batch on the new fleet. Valid values are between `0` and `3600`.
+
+##### Traffic Routing Configuration
+
+* `type` - (Required) Traffic routing strategy type. Valid values are: `ALL_AT_ONCE`, `CANARY`, and `LINEAR`.
+* `wait_interval_in_seconds` - (Required) The waiting time (in seconds) between incremental steps to turn on traffic on the new endpoint fleet. Valid values are between `0` and `3600`.
+* `canary_size` - (Optional) Batch size for the first step to turn on traffic on the new endpoint fleet. Value must be less than or equal to 50% of the variant's total instance count. See [Canary Size](#canary-size).
+* `linear_step_size` - (Optional) Batch size for each step to turn on traffic on the new endpoint fleet. Value must be 10-50% of the variant's total instance count. See [Linear Step Size](#linear-step-size).
+
+###### Maximum Batch Size
+
+* `type` - (Required) Specifies the endpoint capacity type. Valid values are: `INSTANCE_COUNT`, or `CAPACITY_PERCENT`.
+* `value` - (Required) Defines the capacity size, either as a number of instances or a capacity percentage.
+
+###### Rollback Maximum Batch Size
+
+* `type` - (Required) Specifies the endpoint capacity type. Valid values are: `INSTANCE_COUNT`, or `CAPACITY_PERCENT`.
+* `value` - (Required) Defines the capacity size, either as a number of instances or a capacity percentage.
+
+###### Canary Size
+
+* `type` - (Required) Specifies the endpoint capacity type. Valid values are: `INSTANCE_COUNT`, or `CAPACITY_PERCENT`.
+* `value` - (Required) Defines the capacity size, either as a number of instances or a capacity percentage.
+
+###### Linear Step Size
+
+* `type` - (Required) Specifies the endpoint capacity type. Valid values are: `INSTANCE_COUNT`, or `CAPACITY_PERCENT`.
+* `value` - (Required) Defines the capacity size, either as a number of instances or a capacity percentage.
+
+#### Auto Rollback Configuration
+
+* `alarms` - (Required) List of CloudWatch alarms in your account that are configured to monitor metrics on an endpoint. If any alarms are tripped during a deployment, SageMaker rolls back the deployment. See [Alarms](#alarms).
+
+##### Alarms
+
+* `alarm_name` - (Required) The name of a CloudWatch alarm in your account.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) assigned by AWS to this endpoint.
+* `name` - The name of the endpoint.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import endpoints using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import endpoints using the `name`. For example:
+
+```console
+% terraform import aws_sagemaker_endpoint.test_endpoint my-endpoint
+```
+
+<!-- cache-key: cdktf-0.18.0 input-6f77eb68ca400c61f27b4fe0845a1a77a41772c28e3c6f22dc1c8cd4be29cc30 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/sagemaker_endpoint_configuration.html.markdown b/website/docs/cdktf/python/r/sagemaker_endpoint_configuration.html.markdown
new file mode 100644
index 00000000000..d7232ddacaf
--- /dev/null
+++ b/website/docs/cdktf/python/r/sagemaker_endpoint_configuration.html.markdown
@@ -0,0 +1,152 @@
+---
+subcategory: "SageMaker"
+layout: "aws"
+page_title: "AWS: aws_sagemaker_endpoint_configuration"
+description: |-
+  Provides a SageMaker Endpoint Configuration resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sagemaker_endpoint_configuration
+
+Provides a SageMaker endpoint configuration resource.
+
+## Example Usage
+
+Basic usage:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.sagemaker_endpoint_configuration import SagemakerEndpointConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SagemakerEndpointConfiguration(self, "ec",
+            name="my-endpoint-config",
+            production_variants=[SagemakerEndpointConfigurationProductionVariants(
+                initial_instance_count=1,
+                instance_type="ml.t2.medium",
+                model_name=m.name,
+                variant_name="variant-1"
+            )
+            ],
+            tags={
+                "Name": "foo"
+            }
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `production_variants` - (Required) An list of ProductionVariant objects, one for each model that you want to host at this endpoint. Fields are documented below.
+* `kms_key_arn` - (Optional) Amazon Resource Name (ARN) of a AWS Key Management Service key that Amazon SageMaker uses to encrypt data on the storage volume attached to the ML compute instance that hosts the endpoint.
+* `name` - (Optional) The name of the endpoint configuration. If omitted, Terraform will assign a random, unique name. Conflicts with `name_prefix`.
+* `name_prefix` - (Optional) Creates a unique endpoint configuration name beginning with the specified prefix. Conflicts with `name`.
+* `tags` - (Optional) A mapping of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `data_capture_config` - (Optional) Specifies the parameters to capture input/output of SageMaker models endpoints. Fields are documented below.
+* `async_inference_config` - (Optional) Specifies configuration for how an endpoint performs asynchronous inference.
+* `shadow_production_variants` - (Optional) Array of ProductionVariant objects. There is one for each model that you want to host at this endpoint in shadow mode with production traffic replicated from the model specified on ProductionVariants.If you use this field, you can only specify one variant for ProductionVariants and one variant for ShadowProductionVariants. Fields are documented below.
+
+### production_variants
+
+* `accelerator_type` - (Optional) The size of the Elastic Inference (EI) instance to use for the production variant.
+* `container_startup_health_check_timeout_in_seconds` - (Optional) The timeout value, in seconds, for your inference container to pass health check by SageMaker Hosting. For more information about health check, see [How Your Container Should Respond to Health Check (Ping) Requests](https://docs.aws.amazon.com/sagemaker/latest/dg/your-algorithms-inference-code.html#your-algorithms-inference-algo-ping-requests). Valid values between `60` and `3600`.
+* `core_dump_config` - (Optional) Specifies configuration for a core dump from the model container when the process crashes. Fields are documented below.
+* `enable_ssm_access` - (Optional) You can use this parameter to turn on native Amazon Web Services Systems Manager (SSM) access for a production variant behind an endpoint. By default, SSM access is disabled for all production variants behind an endpoints.
+* `initial_instance_count` - (Optional) Initial number of instances used for auto-scaling.
+* `instance_type` - (Optional)  The type of instance to start.
+* `initial_variant_weight` - (Optional) Determines initial traffic distribution among all of the models that you specify in the endpoint configuration. If unspecified, it defaults to `1.0`.
+* `model_data_download_timeout_in_seconds` - (Optional) The timeout value, in seconds, to download and extract the model that you want to host from Amazon S3 to the individual inference instance associated with this production variant. Valid values between `60` and `3600`.
+* `model_name` - (Required) The name of the model to use.
+* `serverless_config` - (Optional) Specifies configuration for how an endpoint performs asynchronous inference.
+* `variant_name` - (Optional) The name of the variant. If omitted, Terraform will assign a random, unique name.
+* `volume_size_in_gb` - (Optional) The size, in GB, of the ML storage volume attached to individual inference instance associated with the production variant. Valid values between `1` and `512`.
+
+#### core_dump_config
+
+* `destination_s3_uri` - (Required) The Amazon S3 bucket to send the core dump to.
+* `kms_key_id` - (Required) The Amazon Web Services Key Management Service (Amazon Web Services KMS) key that SageMaker uses to encrypt the core dump data at rest using Amazon S3 server-side encryption.
+
+#### serverless_config
+
+* `max_concurrency` - (Required) The maximum number of concurrent invocations your serverless endpoint can process. Valid values are between `1` and `200`.
+* `memory_size_in_mb` - (Required) The memory size of your serverless endpoint. Valid values are in 1 GB increments: `1024` MB, `2048` MB, `3072` MB, `4096` MB, `5120` MB, or `6144` MB.
+* `provisioned_concurrency` - The amount of provisioned concurrency to allocate for the serverless endpoint. Should be less than or equal to `max_concurrency`. Valid values are between `1` and `200`.
+
+### data_capture_config
+
+* `initial_sampling_percentage` - (Required) Portion of data to capture. Should be between 0 and 100.
+* `destination_s3_uri` - (Required) The URL for S3 location where the captured data is stored.
+* `capture_options` - (Required) Specifies what data to capture. Fields are documented below.
+* `kms_key_id` - (Optional) Amazon Resource Name (ARN) of a AWS Key Management Service key that Amazon SageMaker uses to encrypt the captured data on Amazon S3.
+* `enable_capture` - (Optional) Flag to enable data capture. Defaults to `false`.
+* `capture_content_type_header` - (Optional) The content type headers to capture. Fields are documented below.
+
+#### capture_options
+
+* `capture_mode` - (Required) Specifies the data to be captured. Should be one of `Input` or `Output`.
+
+#### capture_content_type_header
+
+* `csv_content_types` - (Optional) The CSV content type headers to capture.
+* `json_content_types` - (Optional) The JSON content type headers to capture.
+
+### async_inference_config
+
+* `output_config` - (Required) Specifies the configuration for asynchronous inference invocation outputs.
+* `client_config` - (Optional) Configures the behavior of the client used by Amazon SageMaker to interact with the model container during asynchronous inference.
+
+#### client_config
+
+* `max_concurrent_invocations_per_instance` - (Optional) The maximum number of concurrent requests sent by the SageMaker client to the model container. If no value is provided, Amazon SageMaker will choose an optimal value for you.
+
+#### output_config
+
+* `s3_output_path` - (Required) The Amazon S3 location to upload inference responses to.
+* `s3_failure_path` - (Optional) The Amazon S3 location to upload failure inference responses to.
+* `kms_key_id` - (Optional) The Amazon Web Services Key Management Service (Amazon Web Services KMS) key that Amazon SageMaker uses to encrypt the asynchronous inference output in Amazon S3.
+* `notification_config` - (Optional) Specifies the configuration for notifications of inference results for asynchronous inference.
+
+##### notification_config
+
+* `include_inference_response_in` - (Optional) The Amazon SNS topics where you want the inference response to be included. Valid values are `SUCCESS_NOTIFICATION_TOPIC` and `ERROR_NOTIFICATION_TOPIC`.
+* `error_topic` - (Optional) Amazon SNS topic to post a notification to when inference fails. If no topic is provided, no notification is sent on failure.
+* `success_topic` - (Optional) Amazon SNS topic to post a notification to when inference completes successfully. If no topic is provided, no notification is sent on success.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) assigned by AWS to this endpoint configuration.
+* `name` - The name of the endpoint configuration.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import endpoint configurations using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import endpoint configurations using the `name`. For example:
+
+```console
+% terraform import aws_sagemaker_endpoint_configuration.test_endpoint_config endpoint-config-foo
+```
+
+<!-- cache-key: cdktf-0.18.0 input-a480c542052fe4577930c727244f5ec85cceca16de58e98751ed63acbfadd2a7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/sagemaker_feature_group.html.markdown b/website/docs/cdktf/python/r/sagemaker_feature_group.html.markdown
new file mode 100644
index 00000000000..6cafd123671
--- /dev/null
+++ b/website/docs/cdktf/python/r/sagemaker_feature_group.html.markdown
@@ -0,0 +1,120 @@
+---
+subcategory: "SageMaker"
+layout: "aws"
+page_title: "AWS: aws_sagemaker_feature_group"
+description: |-
+  Provides a SageMaker Feature Group resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sagemaker_feature_group
+
+Provides a SageMaker Feature Group resource.
+
+## Example Usage
+
+Basic usage:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.sagemaker_feature_group import SagemakerFeatureGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SagemakerFeatureGroup(self, "example",
+            event_time_feature_name="example",
+            feature_definition=[SagemakerFeatureGroupFeatureDefinition(
+                feature_name="example",
+                feature_type="String"
+            )
+            ],
+            feature_group_name="example",
+            online_store_config=SagemakerFeatureGroupOnlineStoreConfig(
+                enable_online_store=True
+            ),
+            record_identifier_feature_name="example",
+            role_arn=test.arn
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `feature_group_name` - (Required) The name of the Feature Group. The name must be unique within an AWS Region in an AWS account.
+* `record_identifier_feature_name` - (Required) The name of the Feature whose value uniquely identifies a Record defined in the Feature Store. Only the latest record per identifier value will be stored in the Online Store.
+* `event_time_feature_name` - (Required) The name of the feature that stores the EventTime of a Record in a Feature Group.
+* `description` (Optional) - A free-form description of a Feature Group.
+* `role_arn` (Required) - The Amazon Resource Name (ARN) of the IAM execution role used to persist data into the Offline Store if an `offline_store_config` is provided.
+* `feature_definition` (Optional) - A list of Feature names and types. See [Feature Definition](#feature-definition) Below.
+* `offline_store_config` (Optional) - The Offline Feature Store Configuration. See [Offline Store Config](#offline-store-config) Below.
+* `online_store_config` (Optional) - The Online Feature Store Configuration. See [Online Store Config](#online-store-config) Below.
+* `tags` - (Optional) Map of resource tags for the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Feature Definition
+
+* `feature_name` - (Required) The name of a feature. `feature_name` cannot be any of the following: `is_deleted`, `write_time`, `api_invocation_time`.
+* `feature_type` - (Required) The value type of a feature. Valid values are `Integral`, `Fractional`, or `String`.
+
+### Offline Store Config
+
+* `enable_online_store` - (Optional) Set to `true` to disable the automatic creation of an AWS Glue table when configuring an OfflineStore.
+* `s3_storage_config` - (Required) The Amazon Simple Storage (Amazon S3) location of OfflineStore. See [S3 Storage Config](#s3-storage-config) Below.
+* `data_catalog_config` - (Optional) The meta data of the Glue table that is autogenerated when an OfflineStore is created. See [Data Catalog Config](#data-catalog-config) Below.
+* `table_format` - (Optional) Format for the offline store table. Supported formats are `Glue` (Default) and Apache `Iceberg` (https://iceberg.apache.org/).
+
+### Online Store Config
+
+* `disable_glue_table_creation` - (Optional) Set to `true` to turn Online Store On.
+* `security_config` - (Required) Security config for at-rest encryption of your OnlineStore. See [Security Config](#security-config) Below.
+
+#### S3 Storage Config
+
+* `kms_key_id` - (Optional) The AWS Key Management Service (KMS) key ID of the key used to encrypt any objects written into the OfflineStore S3 location.
+* `s3_uri` - (Required) The S3 URI, or location in Amazon S3, of OfflineStore.
+
+#### Data Catalog Config
+
+* `catalog` - (Optional) The name of the Glue table catalog.
+* `database` - (Optional) The name of the Glue table database.
+* `table_name` - (Optional) The name of the Glue table.
+
+#### Security Config
+
+* `kms_key_id` - (Optional) The ID of the AWS Key Management Service (AWS KMS) key that SageMaker Feature Store uses to encrypt the Amazon S3 objects at rest using Amazon S3 server-side encryption.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `name` - The name of the Feature Group.
+* `arn` - The Amazon Resource Name (ARN) assigned by AWS to this feature_group.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Feature Groups using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Feature Groups using the `name`. For example:
+
+```console
+% terraform import aws_sagemaker_feature_group.test_feature_group feature_group-foo
+```
+
+<!-- cache-key: cdktf-0.18.0 input-eefb539961fb646527b2555da9a1fead250ca66d7e9a8832078ebf9470d482a3 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/sagemaker_flow_definition.html.markdown b/website/docs/cdktf/python/r/sagemaker_flow_definition.html.markdown
new file mode 100644
index 00000000000..2d892d28c59
--- /dev/null
+++ b/website/docs/cdktf/python/r/sagemaker_flow_definition.html.markdown
@@ -0,0 +1,202 @@
+---
+subcategory: "SageMaker"
+layout: "aws"
+page_title: "AWS: aws_sagemaker_flow_definition"
+description: |-
+  Provides a SageMaker Flow Definition resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sagemaker_flow_definition
+
+Provides a SageMaker Flow Definition resource.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.sagemaker_flow_definition import SagemakerFlowDefinition
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SagemakerFlowDefinition(self, "example",
+            flow_definition_name="example",
+            human_loop_config=SagemakerFlowDefinitionHumanLoopConfig(
+                human_task_ui_arn=Token.as_string(aws_sagemaker_human_task_ui_example.arn),
+                task_availability_lifetime_in_seconds=1,
+                task_count=1,
+                task_description="example",
+                task_title="example",
+                workteam_arn=Token.as_string(aws_sagemaker_workteam_example.arn)
+            ),
+            output_config=SagemakerFlowDefinitionOutputConfig(
+                s3_output_path="s3://${" + aws_s3_bucket_example.bucket + "}/"
+            ),
+            role_arn=Token.as_string(aws_iam_role_example.arn)
+        )
+```
+
+### Public Workteam Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.sagemaker_flow_definition import SagemakerFlowDefinition
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SagemakerFlowDefinition(self, "example",
+            flow_definition_name="example",
+            human_loop_config=SagemakerFlowDefinitionHumanLoopConfig(
+                human_task_ui_arn=Token.as_string(aws_sagemaker_human_task_ui_example.arn),
+                public_workforce_task_price=SagemakerFlowDefinitionHumanLoopConfigPublicWorkforceTaskPrice(
+                    amount_in_usd=SagemakerFlowDefinitionHumanLoopConfigPublicWorkforceTaskPriceAmountInUsd(
+                        cents=1,
+                        tenth_fractions_of_aCent=2
+                    )
+                ),
+                task_availability_lifetime_in_seconds=1,
+                task_count=1,
+                task_description="example",
+                task_title="example",
+                workteam_arn="arn:aws:sagemaker:${" + current.name + "}:394669845002:workteam/public-crowd/default"
+            ),
+            output_config=SagemakerFlowDefinitionOutputConfig(
+                s3_output_path="s3://${" + aws_s3_bucket_example.bucket + "}/"
+            ),
+            role_arn=Token.as_string(aws_iam_role_example.arn)
+        )
+```
+
+### Human Loop Activation Config Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.sagemaker_flow_definition import SagemakerFlowDefinition
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SagemakerFlowDefinition(self, "example",
+            flow_definition_name="example",
+            human_loop_activation_config=SagemakerFlowDefinitionHumanLoopActivationConfig(
+                human_loop_activation_conditions_config=SagemakerFlowDefinitionHumanLoopActivationConfigHumanLoopActivationConditionsConfig(
+                    human_loop_activation_conditions="        {\n\t\t\t\"Conditions\": [\n\t\t\t  {\n\t\t\t\t\"ConditionType\": \"Sampling\",\n\t\t\t\t\"ConditionParameters\": {\n\t\t\t\t  \"RandomSamplingPercentage\": 5\n\t\t\t\t}\n\t\t\t  }\n\t\t\t]\n\t\t}\n\n"
+                )
+            ),
+            human_loop_config=SagemakerFlowDefinitionHumanLoopConfig(
+                human_task_ui_arn=Token.as_string(aws_sagemaker_human_task_ui_example.arn),
+                task_availability_lifetime_in_seconds=1,
+                task_count=1,
+                task_description="example",
+                task_title="example",
+                workteam_arn=Token.as_string(aws_sagemaker_workteam_example.arn)
+            ),
+            human_loop_request_source=SagemakerFlowDefinitionHumanLoopRequestSource(
+                aws_managed_human_loop_request_source="AWS/Textract/AnalyzeDocument/Forms/V1"
+            ),
+            output_config=SagemakerFlowDefinitionOutputConfig(
+                s3_output_path="s3://${" + aws_s3_bucket_example.bucket + "}/"
+            ),
+            role_arn=Token.as_string(aws_iam_role_example.arn)
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `flow_definition_name` - (Required) The name of your flow definition.
+* `human_loop_config` - (Required)  An object containing information about the tasks the human reviewers will perform. See [Human Loop Config](#human-loop-config) details below.
+* `role_arn` - (Required) The Amazon Resource Name (ARN) of the role needed to call other services on your behalf.
+* `output_config` - (Required) An object containing information about where the human review results will be uploaded. See [Output Config](#output-config) details below.
+* `human_loop_activation_config` - (Optional) An object containing information about the events that trigger a human workflow. See [Human Loop Activation Config](#human-loop-activation-config) details below.
+* `human_loop_request_source` - (Optional) Container for configuring the source of human task requests. Use to specify if Amazon Rekognition or Amazon Textract is used as an integration source. See [Human Loop Request Source](#human-loop-request-source) details below.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Human Loop Config
+
+* `human_task_ui_arn` - (Required) The Amazon Resource Name (ARN) of the human task user interface.
+* `public_workforce_task_price` - (Optional) Defines the amount of money paid to an Amazon Mechanical Turk worker for each task performed. See [Public Workforce Task Price](#public-workforce-task-price) details below.
+* `task_availability_lifetime_in_seconds` - (Required) The length of time that a task remains available for review by human workers. Valid value range between `1` and `864000`.
+* `task_count` - (Required) The number of distinct workers who will perform the same task on each object. Valid value range between `1` and `3`.
+* `task_description` - (Required) A description for the human worker task.
+* `task_keywords` - (Optional) An array of keywords used to describe the task so that workers can discover the task.
+* `task_time_limit_in_seconds` - (Optional) The amount of time that a worker has to complete a task. The default value is `3600` seconds.
+* `task_title` - (Required) A title for the human worker task.
+* `workteam_arn` - (Required) The Amazon Resource Name (ARN) of the human task user interface. Amazon Resource Name (ARN) of a team of workers. For Public workforces see [AWS Docs](https://docs.aws.amazon.com/sagemaker/latest/dg/sms-workforce-management-public.html).
+
+#### Public Workforce Task Price
+
+* `amount_in_usd` - (Optional) Defines the amount of money paid to an Amazon Mechanical Turk worker in United States dollars. See [Amount In Usd](#amount-in-usd) details below.
+
+##### Amount In Usd
+
+* `cents` - (Optional) The fractional portion, in cents, of the amount. Valid value range between `0` and `99`.
+* `dollars` - (Optional) The whole number of dollars in the amount. Valid value range between `0` and `2`.
+* `tenth_fractions_of_a_cent` - (Optional) Fractions of a cent, in tenths. Valid value range between `0` and `9`.
+
+### Human Loop Activation Config
+
+* `human_loop_activation_conditions_config` - (Required) defines under what conditions SageMaker creates a human loop. See [Human Loop Activation Conditions Config](#human-loop-activation-conditions-config) details below.
+
+#### Human Loop Activation Conditions Config
+
+* `human_loop_activation_conditions` - (Required) A JSON expressing use-case specific conditions declaratively. If any condition is matched, atomic tasks are created against the configured work team. For more information about how to structure the JSON, see [JSON Schema for Human Loop Activation Conditions in Amazon Augmented AI](https://docs.aws.amazon.com/sagemaker/latest/dg/a2i-human-fallback-conditions-json-schema.html).
+
+### Human Loop Request Source
+
+* `aws_managed_human_loop_request_source` - (Required) Specifies whether Amazon Rekognition or Amazon Textract are used as the integration source. Valid values are: `AWS/Rekognition/DetectModerationLabels/Image/V3` and `AWS/Textract/AnalyzeDocument/Forms/V1`.
+
+### Output Config
+
+* `s3_output_path` - (Required) The Amazon S3 path where the object containing human output will be made available.
+* `kms_key_id` - (Optional) The Amazon Key Management Service (KMS) key ARN for server-side encryption.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) assigned by AWS to this Flow Definition.
+* `id` - The name of the Flow Definition.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SageMaker Flow Definitions using the `flow_definition_name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import SageMaker Flow Definitions using the `flow_definition_name`. For example:
+
+```console
+% terraform import aws_sagemaker_flow_definition.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-e8fd07fc83ab3a1b65cb95209fcf2268f33197e551f1560760b16e1b34bf135b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/sagemaker_human_task_ui.html.markdown b/website/docs/cdktf/python/r/sagemaker_human_task_ui.html.markdown
new file mode 100644
index 00000000000..8669c142b47
--- /dev/null
+++ b/website/docs/cdktf/python/r/sagemaker_human_task_ui.html.markdown
@@ -0,0 +1,83 @@
+---
+subcategory: "SageMaker"
+layout: "aws"
+page_title: "AWS: aws_sagemaker_human_task_ui"
+description: |-
+  Provides a SageMaker Human Task UI resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sagemaker_human_task_ui
+
+Provides a SageMaker Human Task UI resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.sagemaker_human_task_ui import SagemakerHumanTaskUi
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SagemakerHumanTaskUi(self, "example",
+            human_task_ui_name="example",
+            ui_template=SagemakerHumanTaskUiUiTemplate(
+                content=Token.as_string(
+                    Fn.file("sagemaker-human-task-ui-template.html"))
+            )
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `human_task_ui_name` - (Required) The name of the Human Task UI.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `ui_template` - (Required) The Liquid template for the worker user interface. See [UI Template](#ui-template) below.
+
+### UI Template
+
+* `content` - (Required) The content of the Liquid template for the worker user interface.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) assigned by AWS to this Human Task UI.
+* `id` - The name of the Human Task UI.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `ui_template` - (Required) The Liquid template for the worker user interface. See [UI Template](#ui-template) below.
+
+### UI Template
+
+* `content_sha256` - The SHA-256 digest of the contents of the template.
+* `url` - The URL for the user interface template.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SageMaker Human Task UIs using the `human_task_ui_name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import SageMaker Human Task UIs using the `human_task_ui_name`. For example:
+
+```console
+% terraform import aws_sagemaker_human_task_ui.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-0347aefb03f4de7b1e49c0835befda079c2fb5ecf326b1ae8183cd0caffa6dc5 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/sagemaker_image.html.markdown b/website/docs/cdktf/python/r/sagemaker_image.html.markdown
new file mode 100644
index 00000000000..f6e3d649305
--- /dev/null
+++ b/website/docs/cdktf/python/r/sagemaker_image.html.markdown
@@ -0,0 +1,74 @@
+---
+subcategory: "SageMaker"
+layout: "aws"
+page_title: "AWS: aws_sagemaker_image"
+description: |-
+  Provides a SageMaker Image resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sagemaker_image
+
+Provides a SageMaker Image resource.
+
+## Example Usage
+
+### Basic usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.sagemaker_image import SagemakerImage
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SagemakerImage(self, "example",
+            image_name="example",
+            role_arn=test.arn
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `image_name` - (Required) The name of the image. Must be unique to your account.
+* `role_arn` - (Required) The Amazon Resource Name (ARN) of an IAM role that enables Amazon SageMaker to perform tasks on your behalf.
+* `display_name` - (Optional) The display name of the image. When the image is added to a domain (must be unique to the domain).
+* `description` - (Optional) The description of the image.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name of the Image.
+* `arn` - The Amazon Resource Name (ARN) assigned by AWS to this Image.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SageMaker Code Images using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import SageMaker Code Images using the `name`. For example:
+
+```console
+% terraform import aws_sagemaker_image.test_image my-code-repo
+```
+
+<!-- cache-key: cdktf-0.18.0 input-472a9b03f1ba8f793494df35ff1917699a39c258036a86d840cd026d9a0bfc60 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/sagemaker_image_version.html.markdown b/website/docs/cdktf/python/r/sagemaker_image_version.html.markdown
new file mode 100644
index 00000000000..d221dc3bfaf
--- /dev/null
+++ b/website/docs/cdktf/python/r/sagemaker_image_version.html.markdown
@@ -0,0 +1,72 @@
+---
+subcategory: "SageMaker"
+layout: "aws"
+page_title: "AWS: aws_sagemaker_image_version"
+description: |-
+  Provides a SageMaker Image Version resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sagemaker_image_version
+
+Provides a SageMaker Image Version resource.
+
+## Example Usage
+
+### Basic usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.sagemaker_image_version import SagemakerImageVersion
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SagemakerImageVersion(self, "test",
+            base_image="012345678912.dkr.ecr.us-west-2.amazonaws.com/image:latest",
+            image_name=Token.as_string(aws_sagemaker_image_test.id)
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `image_name` - (Required) The name of the image. Must be unique to your account.
+* `base_image` - (Required) The registry path of the container image on which this image version is based.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name of the Image.
+* `arn` - The Amazon Resource Name (ARN) assigned by AWS to this Image Version.
+* `image_arn`- The Amazon Resource Name (ARN) of the image the version is based on.
+* `container_image` - The registry path of the container image that contains this image version.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SageMaker Image Versions using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import SageMaker Image Versions using the `name`. For example:
+
+```console
+% terraform import aws_sagemaker_image_version.test_image my-code-repo
+```
+
+<!-- cache-key: cdktf-0.18.0 input-76269e9df5df1c846e439fc126e26d818b1de6f9baec3ce92b8c2bf4480e0909 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/sagemaker_model.html.markdown b/website/docs/cdktf/python/r/sagemaker_model.html.markdown
new file mode 100644
index 00000000000..bf4e06361bd
--- /dev/null
+++ b/website/docs/cdktf/python/r/sagemaker_model.html.markdown
@@ -0,0 +1,126 @@
+---
+subcategory: "SageMaker"
+layout: "aws"
+page_title: "AWS: aws_sagemaker_model"
+description: |-
+  Provides a SageMaker model resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sagemaker_model
+
+Provides a SageMaker model resource.
+
+## Example Usage
+
+Basic usage:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.data_aws_sagemaker_prebuilt_ecr_image import DataAwsSagemakerPrebuiltEcrImage
+from imports.aws.iam_role import IamRole
+from imports.aws.sagemaker_model import SagemakerModel
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        assume_role = DataAwsIamPolicyDocument(self, "assume_role",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["sts:AssumeRole"],
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["sagemaker.amazonaws.com"],
+                    type="Service"
+                )
+                ]
+            )
+            ]
+        )
+        test = DataAwsSagemakerPrebuiltEcrImage(self, "test",
+            repository_name="kmeans"
+        )
+        example = IamRole(self, "example",
+            assume_role_policy=Token.as_string(assume_role.json)
+        )
+        aws_sagemaker_model_example = SagemakerModel(self, "example_3",
+            execution_role_arn=example.arn,
+            name="my-model",
+            primary_container=SagemakerModelPrimaryContainer(
+                image=Token.as_string(test.registry_path)
+            )
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_sagemaker_model_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Optional) The name of the model (must be unique). If omitted, Terraform will assign a random, unique name.
+* `primary_container` - (Optional) The primary docker image containing inference code that is used when the model is deployed for predictions.  If not specified, the `container` argument is required. Fields are documented below.
+* `execution_role_arn` - (Required) A role that SageMaker can assume to access model artifacts and docker images for deployment.
+* `inference_execution_config` - (Optional) Specifies details of how containers in a multi-container endpoint are called. see [Inference Execution Config](#inference-execution-config).
+* `container` (Optional) -  Specifies containers in the inference pipeline. If not specified, the `primary_container` argument is required. Fields are documented below.
+* `enable_network_isolation` (Optional) - Isolates the model container. No inbound or outbound network calls can be made to or from the model container.
+* `vpc_config` (Optional) - Specifies the VPC that you want your model to connect to. VpcConfig is used in hosting services and in batch transform.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+The `primary_container` and `container` block both support:
+
+* `image` - (Optional) The registry path where the inference code image is stored in Amazon ECR.
+* `mode` - (Optional) The container hosts value `SingleModel/MultiModel`. The default value is `SingleModel`.
+* `model_data_url` - (Optional) The URL for the S3 location where model artifacts are stored.
+* `model_package_name` - (Optional) The Amazon Resource Name (ARN) of the model package to use to create the model.
+* `container_hostname` - (Optional) The DNS host name for the container.
+* `environment` - (Optional) Environment variables for the Docker container.
+   A list of key value pairs.
+* `image_config` - (Optional) Specifies whether the model container is in Amazon ECR or a private Docker registry accessible from your Amazon Virtual Private Cloud (VPC). For more information see [Using a Private Docker Registry for Real-Time Inference Containers](https://docs.aws.amazon.com/sagemaker/latest/dg/your-algorithms-containers-inference-private.html). see [Image Config](#image-config).
+
+### Image Config
+
+* `repository_access_mode` - (Required) Specifies whether the model container is in Amazon ECR or a private Docker registry accessible from your Amazon Virtual Private Cloud (VPC). Allowed values are: `Platform` and `Vpc`.
+* `repository_auth_config` - (Optional) Specifies an authentication configuration for the private docker registry where your model image is hosted. Specify a value for this property only if you specified Vpc as the value for the RepositoryAccessMode field, and the private Docker registry where the model image is hosted requires authentication. see [Repository Auth Config](#repository-auth-config).
+
+#### Repository Auth Config
+
+* `repository_credentials_provider_arn` - (Required) The Amazon Resource Name (ARN) of an AWS Lambda function that provides credentials to authenticate to the private Docker registry where your model image is hosted. For information about how to create an AWS Lambda function, see [Create a Lambda function with the console](https://docs.aws.amazon.com/lambda/latest/dg/getting-started-create-function.html) in the _AWS Lambda Developer Guide_.
+
+## Inference Execution Config
+
+* `mode` - (Required) How containers in a multi-container are run. The following values are valid `Serial` and `Direct`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `name` - The name of the model.
+* `arn` - The Amazon Resource Name (ARN) assigned by AWS to this model.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import models using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import models using the `name`. For example:
+
+```console
+% terraform import aws_sagemaker_model.test_model model-foo
+```
+
+<!-- cache-key: cdktf-0.18.0 input-53d6c468eddd1f29a98ecc8fc36ce24bea38081a6d6c05a93d9d1f563dbc5e78 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/sagemaker_model_package_group.html.markdown b/website/docs/cdktf/python/r/sagemaker_model_package_group.html.markdown
new file mode 100644
index 00000000000..8870c678821
--- /dev/null
+++ b/website/docs/cdktf/python/r/sagemaker_model_package_group.html.markdown
@@ -0,0 +1,71 @@
+---
+subcategory: "SageMaker"
+layout: "aws"
+page_title: "AWS: aws_sagemaker_model_package_group"
+description: |-
+  Provides a SageMaker Model Package Group resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sagemaker_model_package_group
+
+Provides a SageMaker Model Package Group resource.
+
+## Example Usage
+
+### Basic usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.sagemaker_model_package_group import SagemakerModelPackageGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SagemakerModelPackageGroup(self, "example",
+            model_package_group_name="example"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `model_package_group_name` - (Required) The name of the model group.
+* `model_package_group_description` - (Optional) A description for the model group.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name of the Model Package Group.
+* `arn` - The Amazon Resource Name (ARN) assigned by AWS to this Model Package Group.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SageMaker Model Package Groups using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import SageMaker Model Package Groups using the `name`. For example:
+
+```console
+% terraform import aws_sagemaker_model_package_group.test_model_package_group my-code-repo
+```
+
+<!-- cache-key: cdktf-0.18.0 input-6cbdd92d6f2cf691b1eaf71a2be21368117e7d969b21a38c0f34bdf3312ebe2d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/sagemaker_model_package_group_policy.html.markdown b/website/docs/cdktf/python/r/sagemaker_model_package_group_policy.html.markdown
new file mode 100644
index 00000000000..af83dafdbf9
--- /dev/null
+++ b/website/docs/cdktf/python/r/sagemaker_model_package_group_policy.html.markdown
@@ -0,0 +1,96 @@
+---
+subcategory: "SageMaker"
+layout: "aws"
+page_title: "AWS: aws_sagemaker_model_package_group_policy"
+description: |-
+  Provides a SageMaker Model Package Group Policy resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sagemaker_model_package_group_policy
+
+Provides a SageMaker Model Package Group Policy resource.
+
+## Example Usage
+
+### Basic usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, Fn, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_caller_identity import DataAwsCallerIdentity
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.sagemaker_model_package_group import SagemakerModelPackageGroup
+from imports.aws.sagemaker_model_package_group_policy import SagemakerModelPackageGroupPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = SagemakerModelPackageGroup(self, "example",
+            model_package_group_name="example"
+        )
+        current = DataAwsCallerIdentity(self, "current")
+        data_aws_iam_policy_document_example = DataAwsIamPolicyDocument(self, "example_2",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["sagemaker:DescribeModelPackage", "sagemaker:ListModelPackages"
+                ],
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=[Token.as_string(current.account_id)],
+                    type="AWS"
+                )
+                ],
+                resources=[example.arn],
+                sid="AddPermModelPackageGroup"
+            )
+            ]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_iam_policy_document_example.override_logical_id("example")
+        aws_sagemaker_model_package_group_policy_example =
+        SagemakerModelPackageGroupPolicy(self, "example_3",
+            model_package_group_name=example.model_package_group_name,
+            resource_policy=Token.as_string(
+                Fn.jsonencode(
+                    Fn.jsondecode(Token.as_string(data_aws_iam_policy_document_example.json))))
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_sagemaker_model_package_group_policy_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `model_package_group_name` - (Required) The name of the model package group.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name of the Model Package Package Group.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SageMaker Model Package Groups using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import SageMaker Model Package Groups using the `name`. For example:
+
+```console
+% terraform import aws_sagemaker_model_package_group_policy.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-46286c0641f184f18c019c6248020bf4125d9e8e0f2d0db78bf45be76f1e8205 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/sagemaker_monitoring_schedule.html.markdown b/website/docs/cdktf/python/r/sagemaker_monitoring_schedule.html.markdown
new file mode 100644
index 00000000000..c23013cf261
--- /dev/null
+++ b/website/docs/cdktf/python/r/sagemaker_monitoring_schedule.html.markdown
@@ -0,0 +1,85 @@
+---
+subcategory: "SageMaker"
+layout: "aws"
+page_title: "AWS: aws_sagemaker_monitoring_schedule"
+description: |-
+  Provides a SageMaker Monitoring Schedule resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sagemaker_monitoring_schedule
+
+Provides a SageMaker monitoring schedule resource.
+
+## Example Usage
+
+Basic usage:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.sagemaker_monitoring_schedule import SagemakerMonitoringSchedule
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SagemakerMonitoringSchedule(self, "test",
+            monitoring_schedule_config=SagemakerMonitoringScheduleMonitoringScheduleConfig(
+                monitoring_job_definition_name=Token.as_string(aws_sagemaker_data_quality_job_definition_test.name),
+                monitoring_type="DataQuality"
+            ),
+            name="my-monitoring-schedule"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `monitoring_schedule_config` - (Required) The configuration object that specifies the monitoring schedule and defines the monitoring job. Fields are documented below.
+* `name` - (Optional) The name of the monitoring schedule. The name must be unique within an AWS Region within an AWS account. If omitted, Terraform will assign a random, unique name.
+* `tags` - (Optional) A mapping of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### monitoring_schedule_config
+
+* `monitoring_job_definition_name` - (Required) The name of the monitoring job definition to schedule.
+* `monitoring_type` - (Required) The type of the monitoring job definition to schedule. Valid values are `DataQuality`, `ModelQuality`, `ModelBias` or `ModelExplainability`
+* `schedule_config` - (Optional) Configures the monitoring schedule. Fields are documented below.
+
+#### schedule_config
+
+* `schedule_expression` - (Required) A cron expression that describes details about the monitoring schedule. For example, and hourly schedule would be `cron(0 * ? * * *)`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) assigned by AWS to this monitoring schedule.
+* `name` - The name of the monitoring schedule.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import monitoring schedules using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import monitoring schedules using the `name`. For example:
+
+```console
+% terraform import aws_sagemaker_monitoring_schedule.test_monitoring_schedule monitoring-schedule-foo
+```
+
+<!-- cache-key: cdktf-0.18.0 input-7596aa085f871099e9a876409d5f5ffeface2d09e575c3ce7a5e6974cf591269 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/sagemaker_notebook_instance.html.markdown b/website/docs/cdktf/python/r/sagemaker_notebook_instance.html.markdown
new file mode 100644
index 00000000000..70271d7e933
--- /dev/null
+++ b/website/docs/cdktf/python/r/sagemaker_notebook_instance.html.markdown
@@ -0,0 +1,128 @@
+---
+subcategory: "SageMaker"
+layout: "aws"
+page_title: "AWS: aws_sagemaker_notebook_instance"
+description: |-
+  Provides a SageMaker Notebook Instance resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sagemaker_notebook_instance
+
+Provides a SageMaker Notebook Instance resource.
+
+## Example Usage
+
+### Basic usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.sagemaker_notebook_instance import SagemakerNotebookInstance
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SagemakerNotebookInstance(self, "ni",
+            instance_type="ml.t2.medium",
+            name="my-notebook-instance",
+            role_arn=role.arn,
+            tags={
+                "Name": "foo"
+            }
+        )
+```
+
+### Code repository usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.sagemaker_code_repository import SagemakerCodeRepository
+from imports.aws.sagemaker_notebook_instance import SagemakerNotebookInstance
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = SagemakerCodeRepository(self, "example",
+            code_repository_name="my-notebook-instance-code-repo",
+            git_config=SagemakerCodeRepositoryGitConfig(
+                repository_url="https://github.com/hashicorp/terraform-provider-aws.git"
+            )
+        )
+        SagemakerNotebookInstance(self, "ni",
+            default_code_repository=example.code_repository_name,
+            instance_type="ml.t2.medium",
+            name="my-notebook-instance",
+            role_arn=role.arn,
+            tags={
+                "Name": "foo"
+            }
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the notebook instance (must be unique).
+* `role_arn` - (Required) The ARN of the IAM role to be used by the notebook instance which allows SageMaker to call other services on your behalf.
+* `instance_type` - (Required) The name of ML compute instance type.
+* `platform_identifier` - (Optional) The platform identifier of the notebook instance runtime environment. This value can be either `notebook-al1-v1`, `notebook-al2-v1`, or  `notebook-al2-v2`, depending on which version of Amazon Linux you require.
+* `volume_size` - (Optional) The size, in GB, of the ML storage volume to attach to the notebook instance. The default value is 5 GB.
+* `subnet_id` - (Optional) The VPC subnet ID.
+* `security_groups` - (Optional) The associated security groups.
+* `accelerator_types` - (Optional) A list of Elastic Inference (EI) instance types to associate with this notebook instance. See [Elastic Inference Accelerator](https://docs.aws.amazon.com/sagemaker/latest/dg/ei.html) for more details. Valid values: `ml.eia1.medium`, `ml.eia1.large`, `ml.eia1.xlarge`, `ml.eia2.medium`, `ml.eia2.large`, `ml.eia2.xlarge`.
+* `additional_code_repositories` - (Optional) An array of up to three Git repositories to associate with the notebook instance.
+ These can be either the names of Git repositories stored as resources in your account, or the URL of Git repositories in [AWS CodeCommit](https://docs.aws.amazon.com/codecommit/latest/userguide/welcome.html) or in any other Git repository. These repositories are cloned at the same level as the default repository of your notebook instance.
+* `default_code_repository` - (Optional) The Git repository associated with the notebook instance as its default code repository. This can be either the name of a Git repository stored as a resource in your account, or the URL of a Git repository in [AWS CodeCommit](https://docs.aws.amazon.com/codecommit/latest/userguide/welcome.html) or in any other Git repository.
+* `direct_internet_access` - (Optional) Set to `Disabled` to disable internet access to notebook. Requires `security_groups` and `subnet_id` to be set. Supported values: `Enabled` (Default) or `Disabled`. If set to `Disabled`, the notebook instance will be able to access resources only in your VPC, and will not be able to connect to Amazon SageMaker training and endpoint services unless your configure a NAT Gateway in your VPC.
+* `instance_metadata_service_configuration` - (Optional) Information on the IMDS configuration of the notebook instance. Conflicts with `instance_metadata_service_configuration`. see details below.
+* `kms_key_id` - (Optional) The AWS Key Management Service (AWS KMS) key that Amazon SageMaker uses to encrypt the model artifacts at rest using Amazon S3 server-side encryption.
+* `lifecycle_config_name` - (Optional) The name of a lifecycle configuration to associate with the notebook instance.
+* `root_access` - (Optional) Whether root access is `Enabled` or `Disabled` for users of the notebook instance. The default value is `Enabled`.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### instance_metadata_service_configuration
+
+* `minimum_instance_metadata_service_version` - (Optional) Indicates the minimum IMDS version that the notebook instance supports. When passed "1" is passed. This means that both IMDSv1 and IMDSv2 are supported. Valid values are `1` and `2`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name of the notebook instance.
+* `arn` - The Amazon Resource Name (ARN) assigned by AWS to this notebook instance.
+* `url` - The URL that you use to connect to the Jupyter notebook that is running in your notebook instance.
+* `network_interface_id` - The network interface ID that Amazon SageMaker created at the time of creating the instance. Only available when setting `subnet_id`.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SageMaker Notebook Instances using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import SageMaker Notebook Instances using the `name`. For example:
+
+```console
+% terraform import aws_sagemaker_notebook_instance.test_notebook_instance my-notebook-instance
+```
+
+<!-- cache-key: cdktf-0.18.0 input-5e252144d6a5568e5371adc34a319d772ad3c8b4f238312ded06d5c31a1b0f15 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/sagemaker_notebook_instance_lifecycle_configuration.html.markdown b/website/docs/cdktf/python/r/sagemaker_notebook_instance_lifecycle_configuration.html.markdown
new file mode 100644
index 00000000000..aed651c6a3c
--- /dev/null
+++ b/website/docs/cdktf/python/r/sagemaker_notebook_instance_lifecycle_configuration.html.markdown
@@ -0,0 +1,71 @@
+---
+subcategory: "SageMaker"
+layout: "aws"
+page_title: "AWS: aws_sagemaker_notebook_instance_lifecycle_configuration"
+description: |-
+  Provides a lifecycle configuration for SageMaker Notebook Instances.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sagemaker_notebook_instance_lifecycle_configuration
+
+Provides a lifecycle configuration for SageMaker Notebook Instances.
+
+## Example Usage
+
+Usage:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.sagemaker_notebook_instance_lifecycle_configuration import SagemakerNotebookInstanceLifecycleConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SagemakerNotebookInstanceLifecycleConfiguration(self, "lc",
+            name="foo",
+            on_create=Token.as_string(Fn.base64encode("echo foo")),
+            on_start=Token.as_string(Fn.base64encode("echo bar"))
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Optional) The name of the lifecycle configuration (must be unique). If omitted, Terraform will assign a random, unique name.
+* `on_create` - (Optional) A shell script (base64-encoded) that runs only once when the SageMaker Notebook Instance is created.
+* `on_start` - (Optional) A shell script (base64-encoded) that runs every time the SageMaker Notebook Instance is started including the time it's created.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) assigned by AWS to this lifecycle configuration.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import models using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import models using the `name`. For example:
+
+```console
+% terraform import aws_sagemaker_notebook_instance_lifecycle_configuration.lc foo
+```
+
+<!-- cache-key: cdktf-0.18.0 input-5e110cd77e6a012eaab724d615a7f74ade584854ae6093e0bce3c82605f33152 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/sagemaker_pipeline.html.markdown b/website/docs/cdktf/python/r/sagemaker_pipeline.html.markdown
new file mode 100644
index 00000000000..e60a5004361
--- /dev/null
+++ b/website/docs/cdktf/python/r/sagemaker_pipeline.html.markdown
@@ -0,0 +1,100 @@
+---
+subcategory: "SageMaker"
+layout: "aws"
+page_title: "AWS: aws_sagemaker_pipeline"
+description: |-
+  Provides a SageMaker Pipeline resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sagemaker_pipeline
+
+Provides a SageMaker Pipeline resource.
+
+## Example Usage
+
+### Basic usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.sagemaker_pipeline import SagemakerPipeline
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SagemakerPipeline(self, "example",
+            pipeline_definition=Token.as_string(
+                Fn.jsonencode({
+                    "Steps": [{
+                        "Arguments": {
+                            "ErrorMessage": "test"
+                        },
+                        "Name": "Test",
+                        "Type": "Fail"
+                    }
+                    ],
+                    "Version": "2020-12-01"
+                })),
+            pipeline_display_name="example",
+            pipeline_name="example",
+            role_arn=Token.as_string(aws_iam_role_example.arn)
+        )
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `pipeline_name` - (Required) The name of the pipeline.
+* `pipeline_description` - (Optional) A description of the pipeline.
+* `pipeline_display_name` - (Required) The display name of the pipeline.
+* `pipeline_definition` - (Optional) The [JSON pipeline definition](https://aws-sagemaker-mlops.github.io/sagemaker-model-building-pipeline-definition-JSON-schema/) of the pipeline.
+* `pipeline_definition_s3_location` - (Optional) The location of the pipeline definition stored in Amazon S3. If specified, SageMaker will retrieve the pipeline definition from this location. see [Pipeline Definition S3 Location](#pipeline-definition-s3-location) details below.
+* `role_arn` - (Required) The name of the Pipeline (must be unique).
+* `parallelism_configuration` - (Optional) This is the configuration that controls the parallelism of the pipeline. If specified, it applies to all runs of this pipeline by default. see [Parallelism Configuration](#parallelism-configuration) details below.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Parallelism Configuration
+
+* `max_parallel_execution_steps` - (Required) The max number of steps that can be executed in parallel.
+
+### Pipeline Definition S3 Location
+
+* `bucket` - (Required) Name of the S3 bucket.
+* `object_key` - (Required) The object key (or key name) uniquely identifies the object in an S3 bucket.
+* `version_id` - (Optional) Version Id of the pipeline definition file. If not specified, Amazon SageMaker will retrieve the latest version.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name of the Pipeline.
+* `arn` - The Amazon Resource Name (ARN) assigned by AWS to this Pipeline.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import pipelines using the `pipeline_name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import pipelines using the `pipeline_name`. For example:
+
+```console
+% terraform import aws_sagemaker_pipeline.test_pipeline pipeline
+```
+
+<!-- cache-key: cdktf-0.18.0 input-77df217f0bd5424f0de8e1484ad88c9938cdb5dd0e244c67997eeafb13cfaed4 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/sagemaker_project.html.markdown b/website/docs/cdktf/python/r/sagemaker_project.html.markdown
new file mode 100644
index 00000000000..147e9378472
--- /dev/null
+++ b/website/docs/cdktf/python/r/sagemaker_project.html.markdown
@@ -0,0 +1,88 @@
+---
+subcategory: "SageMaker"
+layout: "aws"
+page_title: "AWS: aws_sagemaker_project"
+description: |-
+  Provides a SageMaker Project resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sagemaker_project
+
+Provides a SageMaker Project resource.
+
+ -> Note: If you are trying to use SageMaker projects with SageMaker studio you will need to add a tag with the key `sagemaker:studio-visibility` with value `true`. For more on requirements to use projects and permission needed see [AWS Docs](https://docs.aws.amazon.com/sagemaker/latest/dg/sagemaker-projects-templates-custom.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.sagemaker_project import SagemakerProject
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SagemakerProject(self, "example",
+            project_name="example",
+            service_catalog_provisioning_details=SagemakerProjectServiceCatalogProvisioningDetails(
+                product_id=Token.as_string(aws_servicecatalog_product_example.id)
+            )
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `project_name` - (Required) The name of the Project.
+* `project_description` - (Optional) A description for the project.
+* `service_catalog_provisioning_details` - (Required) The product ID and provisioning artifact ID to provision a service catalog. See [Service Catalog Provisioning Details](#service-catalog-provisioning-details) below.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Service Catalog Provisioning Details
+
+* `path_id` - (Optional) The path identifier of the product. This value is optional if the product has a default path, and required if the product has more than one path.
+* `product_id` - (Required) The ID of the product to provision.
+* `provisioning_artifact_id` - (Optional) The ID of the provisioning artifact.
+* `provisioning_parameter` - (Optional) A list of key value pairs that you specify when you provision a product. See [Provisioning Parameter](#provisioning-parameter) below.
+
+#### Provisioning Parameter
+
+* `key` - (Required) The key that identifies a provisioning parameter.
+* `value` - (Optional) The value of the provisioning parameter.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) assigned by AWS to this Project.
+* `id` - The name of the Project.
+* `project_id` - The ID of the project.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SageMaker Projects using the `project_name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import SageMaker Projects using the `project_name`. For example:
+
+```console
+% terraform import aws_sagemaker_project.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-5d67b37f736cf104db6893c21c2531fd0183fe8f2dd008b379c345da42e3802b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/sagemaker_servicecatalog_portfolio_status.html.markdown b/website/docs/cdktf/python/r/sagemaker_servicecatalog_portfolio_status.html.markdown
new file mode 100644
index 00000000000..ebd05dde9fd
--- /dev/null
+++ b/website/docs/cdktf/python/r/sagemaker_servicecatalog_portfolio_status.html.markdown
@@ -0,0 +1,67 @@
+---
+subcategory: "SageMaker"
+layout: "aws"
+page_title: "AWS: aws_sagemaker_servicecatalog_portfolio_status"
+description: |-
+  Manages status of Service Catalog in SageMaker. Service Catalog is used to create SageMaker projects.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sagemaker_servicecatalog_portfolio_status
+
+Manages status of Service Catalog in SageMaker. Service Catalog is used to create SageMaker projects.
+
+## Example Usage
+
+Usage:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.sagemaker_servicecatalog_portfolio_status import SagemakerServicecatalogPortfolioStatus
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SagemakerServicecatalogPortfolioStatus(self, "example",
+            status="Enabled"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `status` - (Required) Whether Service Catalog is enabled or disabled in SageMaker. Valid values are `Enabled` and `Disabled`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The AWS Region the Servicecatalog portfolio status resides in.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import models using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import models using the `id`. For example:
+
+```console
+% terraform import aws_sagemaker_servicecatalog_portfolio_status.example us-east-1
+```
+
+<!-- cache-key: cdktf-0.18.0 input-2e0548d06e23711e11dc17dd10cee2ad35217d3c9b0c59bd26f59909041dd9a9 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/sagemaker_space.html.markdown b/website/docs/cdktf/python/r/sagemaker_space.html.markdown
new file mode 100644
index 00000000000..ff8f46de296
--- /dev/null
+++ b/website/docs/cdktf/python/r/sagemaker_space.html.markdown
@@ -0,0 +1,108 @@
+---
+subcategory: "SageMaker"
+layout: "aws"
+page_title: "AWS: aws_sagemaker_space"
+description: |-
+  Provides a SageMaker Space resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sagemaker_space
+
+Provides a SageMaker Space resource.
+
+## Example Usage
+
+### Basic usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.sagemaker_space import SagemakerSpace
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SagemakerSpace(self, "example",
+            domain_id=test.id,
+            space_name="example"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `space_name` - (Required) The name of the space.
+* `domain_id` - (Required) The ID of the associated Domain.
+* `space_settings` - (Required) A collection of space settings. See [Space Settings](#space-settings) below.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Space Settings
+
+* `jupyter_server_app_settings` - (Optional) The Jupyter server's app settings. See [Jupyter Server App Settings](#jupyter-server-app-settings) below.
+* `kernel_gateway_app_settings` - (Optional) The kernel gateway app settings. See [Kernel Gateway App Settings](#kernel-gateway-app-settings) below.
+
+#### Kernel Gateway App Settings
+
+* `default_resource_spec` - (Optional) The default instance type and the Amazon Resource Name (ARN) of the SageMaker image created on the instance. see [Default Resource Spec](#default-resource-spec) below.
+* `custom_image` - (Optional) A list of custom SageMaker images that are configured to run as a KernelGateway app. see [Custom Image](#custom-image) below.
+* `lifecycle_config_arns` - (Optional) The Amazon Resource Name (ARN) of the Lifecycle Configurations.
+
+#### Jupyter Server App Settings
+
+* `code_repository` - (Optional) A list of Git repositories that SageMaker automatically displays to users for cloning in the JupyterServer application. see [Code Repository](#code-repository) below.
+* `default_resource_spec` - (Optional) The default instance type and the Amazon Resource Name (ARN) of the SageMaker image created on the instance. see [Default Resource Spec](#default-resource-spec) below.
+* `lifecycle_config_arns` - (Optional) The Amazon Resource Name (ARN) of the Lifecycle Configurations.
+
+##### Code Repository
+
+* `repository_url` - (Optional) The URL of the Git repository.
+
+##### Default Resource Spec
+
+* `instance_type` - (Optional) The instance type.
+* `lifecycle_config_arn` - (Optional) The Amazon Resource Name (ARN) of the Lifecycle Configuration attached to the Resource.
+* `sagemaker_image_arn` - (Optional) The Amazon Resource Name (ARN) of the SageMaker image created on the instance.
+* `sagemaker_image_version_arn` - (Optional) The ARN of the image version created on the instance.
+
+##### Custom Image
+
+* `app_image_config_name` - (Required) The name of the App Image Config.
+* `image_name` - (Required) The name of the Custom Image.
+* `image_version_number` - (Optional) The version number of the Custom Image.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The space's Amazon Resource Name (ARN).
+* `arn` - The space's Amazon Resource Name (ARN).
+* `home_efs_file_system_uid` - The ID of the space's profile in the Amazon Elastic File System volume.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SageMaker Spaces using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import SageMaker Spaces using the `id`. For example:
+
+```console
+% terraform import aws_sagemaker_space.test_space arn:aws:sagemaker:us-west-2:123456789012:space/domain-id/space-name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-8d8bef8d2f394c96f9e18caac696a38bb4da69984c3c443105f8620c1e13b1be -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/sagemaker_studio_lifecycle_config.html.markdown b/website/docs/cdktf/python/r/sagemaker_studio_lifecycle_config.html.markdown
new file mode 100644
index 00000000000..0f4968dcb51
--- /dev/null
+++ b/website/docs/cdktf/python/r/sagemaker_studio_lifecycle_config.html.markdown
@@ -0,0 +1,75 @@
+---
+subcategory: "SageMaker"
+layout: "aws"
+page_title: "AWS: aws_sagemaker_studio_lifecycle_config"
+description: |-
+  Provides a SageMaker Studio Lifecycle Config resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sagemaker_studio_lifecycle_config
+
+Provides a SageMaker Studio Lifecycle Config resource.
+
+## Example Usage
+
+### Basic usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.sagemaker_studio_lifecycle_config import SagemakerStudioLifecycleConfig
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SagemakerStudioLifecycleConfig(self, "example",
+            studio_lifecycle_config_app_type="JupyterServer",
+            studio_lifecycle_config_content=Token.as_string(
+                Fn.base64encode("echo Hello")),
+            studio_lifecycle_config_name="example"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `studio_lifecycle_config_name` - (Required) The name of the Studio Lifecycle Configuration to create.
+* `studio_lifecycle_config_app_type` - (Required) The App type that the Lifecycle Configuration is attached to. Valid values are `JupyterServer` and `KernelGateway`.
+* `studio_lifecycle_config_content` - (Required) The content of your Studio Lifecycle Configuration script. This content must be base64 encoded.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name of the Studio Lifecycle Config.
+* `arn` - The Amazon Resource Name (ARN) assigned by AWS to this Studio Lifecycle Config.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SageMaker Studio Lifecycle Configs using the `studio_lifecycle_config_name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import SageMaker Studio Lifecycle Configs using the `studio_lifecycle_config_name`. For example:
+
+```console
+% terraform import aws_sagemaker_studio_lifecycle_config.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-00bef775048f861308f13944fa8e3c7a8115b71e1ec29477cd558e7cfbe782d8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/sagemaker_user_profile.html.markdown b/website/docs/cdktf/python/r/sagemaker_user_profile.html.markdown
new file mode 100644
index 00000000000..ef374a825fa
--- /dev/null
+++ b/website/docs/cdktf/python/r/sagemaker_user_profile.html.markdown
@@ -0,0 +1,158 @@
+---
+subcategory: "SageMaker"
+layout: "aws"
+page_title: "AWS: aws_sagemaker_user_profile"
+description: |-
+  Provides a SageMaker User Profile resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sagemaker_user_profile
+
+Provides a SageMaker User Profile resource.
+
+## Example Usage
+
+### Basic usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.sagemaker_user_profile import SagemakerUserProfile
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SagemakerUserProfile(self, "example",
+            domain_id=test.id,
+            user_profile_name="example"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `user_profile_name` - (Required) The name for the User Profile.
+* `domain_id` - (Required) The ID of the associated Domain.
+* `single_sign_on_user_identifier` - (Optional) A specifier for the type of value specified in `single_sign_on_user_value`. Currently, the only supported value is `UserName`. If the Domain's AuthMode is SSO, this field is required. If the Domain's AuthMode is not SSO, this field cannot be specified.
+* `single_sign_on_user_value` - (Required) The username of the associated AWS Single Sign-On User for this User Profile. If the Domain's AuthMode is SSO, this field is required, and must match a valid username of a user in your directory. If the Domain's AuthMode is not SSO, this field cannot be specified.
+* `user_settings` - (Required) The user settings. See [User Settings](#user-settings) below.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### User Settings
+
+* `execution_role` - (Required) The execution role ARN for the user.
+* `security_groups` - (Optional) The security groups.
+* `sharing_settings` - (Optional) The sharing settings. See [Sharing Settings](#sharing-settings) below.
+* `tensor_board_app_settings` - (Optional) The TensorBoard app settings. See [TensorBoard App Settings](#tensorboard-app-settings) below.
+* `jupyter_server_app_settings` - (Optional) The Jupyter server's app settings. See [Jupyter Server App Settings](#jupyter-server-app-settings) below.
+* `kernel_gateway_app_settings` - (Optional) The kernel gateway app settings. See [Kernel Gateway App Settings](#kernel-gateway-app-settings) below.
+* `r_session_app_settings` - (Optional) The RSession app settings. See [RSession App Settings](#rsession-app-settings) below.
+* `r_studio_server_pro_app_settings` - (Optional) A collection of settings that configure user interaction with the RStudioServerPro app. See [RStudio Server Pro App Settings](#rstudio-server-pro-app-settings) below.
+* `canvas_app_settings` - (Optional) The Canvas app settings. See [Canvas App Settings](#canvas-app-settings) below.
+
+#### Canvas App Settings
+
+* `model_register_settings` - (Optional) The model registry settings for the SageMaker Canvas application. See [Model Register Settings](#model-register-settings) below.
+* `time_series_forecasting_settings` - (Optional) Time series forecast settings for the Canvas app. see [Time Series Forecasting Settings](#time-series-forecasting-settings) below.
+* `workspace_settings` - (Optional) The workspace settings for the SageMaker Canvas application. See [Workspace Settings](#workspace-settings) below.
+
+#### Sharing Settings
+
+* `notebook_output_option` - (Optional) Whether to include the notebook cell output when sharing the notebook. The default is `Disabled`. Valid values are `Allowed` and `Disabled`.
+* `s3_kms_key_id` - (Optional) When `notebook_output_option` is Allowed, the AWS Key Management Service (KMS) encryption key ID used to encrypt the notebook cell output in the Amazon S3 bucket.
+* `s3_output_path` - (Optional) When `notebook_output_option` is Allowed, the Amazon S3 bucket used to save the notebook cell output.
+
+#### TensorBoard App Settings
+
+* `default_resource_spec` - (Optional) The default instance type and the Amazon Resource Name (ARN) of the SageMaker image created on the instance. see [Default Resource Spec](#default-resource-spec) below.
+
+#### Kernel Gateway App Settings
+
+* `default_resource_spec` - (Optional) The default instance type and the Amazon Resource Name (ARN) of the SageMaker image created on the instance. see [Default Resource Spec](#default-resource-spec) below.
+* `custom_image` - (Optional) A list of custom SageMaker images that are configured to run as a KernelGateway app. see [Custom Image](#custom-image) below.
+* `lifecycle_config_arns` - (Optional) The Amazon Resource Name (ARN) of the Lifecycle Configurations.
+
+#### Jupyter Server App Settings
+
+* `code_repository` - (Optional) A list of Git repositories that SageMaker automatically displays to users for cloning in the JupyterServer application. see [Code Repository](#code-repository) below.
+* `default_resource_spec` - (Optional) The default instance type and the Amazon Resource Name (ARN) of the SageMaker image created on the instance. see [Default Resource Spec](#default-resource-spec) below.
+* `lifecycle_config_arns` - (Optional) The Amazon Resource Name (ARN) of the Lifecycle Configurations.
+
+#### RSession App Settings
+
+* `default_resource_spec` - (Optional) The default instance type and the Amazon Resource Name (ARN) of the SageMaker image created on the instance. see [Default Resource Spec](#default-resource-spec) below.
+* `custom_image` - (Optional) A list of custom SageMaker images that are configured to run as a KernelGateway app. see [Custom Image](#custom-image) below.
+
+#### RStudio Server Pro App Settings
+
+* `access_status` - (Optional) Indicates whether the current user has access to the RStudioServerPro app. Valid values are `ENABLED` and `DISABLED`.
+* `user_group` - (Optional) The level of permissions that the user has within the RStudioServerPro app. This value defaults to `R_STUDIO_USER`. The `R_STUDIO_ADMIN` value allows the user access to the RStudio Administrative Dashboard. Valid values are `R_STUDIO_USER` and `R_STUDIO_ADMIN`.
+
+##### Code Repository
+
+* `repository_url` - (Optional) The URL of the Git repository.
+
+##### Default Resource Spec
+
+* `instance_type` - (Optional) The instance type.
+* `lifecycle_config_arn` - (Optional) The Amazon Resource Name (ARN) of the Lifecycle Configuration attached to the Resource.
+* `sagemaker_image_arn` - (Optional) The Amazon Resource Name (ARN) of the SageMaker image created on the instance.
+* `sagemaker_image_version_arn` - (Optional) The ARN of the image version created on the instance.
+
+##### Custom Image
+
+* `app_image_config_name` - (Required) The name of the App Image Config.
+* `image_name` - (Required) The name of the Custom Image.
+* `image_version_number` - (Optional) The version number of the Custom Image.
+
+##### Time Series Forecasting Settings
+
+* `amazon_forecast_role_arn` - (Optional)  The IAM role that Canvas passes to Amazon Forecast for time series forecasting. By default, Canvas uses the execution role specified in the UserProfile that launches the Canvas app. If an execution role is not specified in the UserProfile, Canvas uses the execution role specified in the Domain that owns the UserProfile. To allow time series forecasting, this IAM role should have the [AmazonSageMakerCanvasForecastAccess](https://docs.aws.amazon.com/sagemaker/latest/dg/security-iam-awsmanpol-canvas.html#security-iam-awsmanpol-AmazonSageMakerCanvasForecastAccess) policy attached and forecast.amazonaws.com added in the trust relationship as a service principal.
+* `status` - (Optional) Describes whether time series forecasting is enabled or disabled in the Canvas app. Valid values are `ENABLED` and `DISABLED`.
+
+##### Model Register Settings
+
+* `cross_account_model_register_role_arn` - (Optional) The Amazon Resource Name (ARN) of the SageMaker model registry account. Required only to register model versions created by a different SageMaker Canvas AWS account than the AWS account in which SageMaker model registry is set up.
+* `status` - (Optional) Describes whether the integration to the model registry is enabled or disabled in the Canvas application. Valid values are `ENABLED` and `DISABLED`.
+
+##### Workspace Settings
+
+* `s3_artifact_path` - (Optional) The Amazon S3 bucket used to store artifacts generated by Canvas. Updating the Amazon S3 location impacts existing configuration settings, and Canvas users no longer have access to their artifacts. Canvas users must log out and log back in to apply the new location.
+* `s3_kms_key_id` - (Optional) The Amazon Web Services Key Management Service (KMS) encryption key ID that is used to encrypt artifacts generated by Canvas in the Amazon S3 bucket.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The user profile Amazon Resource Name (ARN).
+* `arn` - The user profile Amazon Resource Name (ARN).
+* `home_efs_file_system_uid` - The ID of the user's profile in the Amazon Elastic File System (EFS) volume.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SageMaker User Profiles using the `arn`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import SageMaker User Profiles using the `arn`. For example:
+
+```console
+% terraform import aws_sagemaker_user_profile.test_user_profile arn:aws:sagemaker:us-west-2:123456789012:user-profile/domain-id/profile-name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1492833bb8413e9155281273553ca4896e7889971ba95eee58026c164fc0fdb7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/sagemaker_workforce.html.markdown b/website/docs/cdktf/python/r/sagemaker_workforce.html.markdown
new file mode 100644
index 00000000000..ce5f9ec47c4
--- /dev/null
+++ b/website/docs/cdktf/python/r/sagemaker_workforce.html.markdown
@@ -0,0 +1,154 @@
+---
+subcategory: "SageMaker"
+layout: "aws"
+page_title: "AWS: aws_sagemaker_workforce"
+description: |-
+  Provides a SageMaker Workforce resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sagemaker_workforce
+
+Provides a SageMaker Workforce resource.
+
+## Example Usage
+
+### Cognito Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cognito_user_pool import CognitoUserPool
+from imports.aws.cognito_user_pool_client import CognitoUserPoolClient
+from imports.aws.cognito_user_pool_domain import CognitoUserPoolDomain
+from imports.aws.sagemaker_workforce import SagemakerWorkforce
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = CognitoUserPool(self, "example",
+            name="example"
+        )
+        aws_cognito_user_pool_client_example = CognitoUserPoolClient(self, "example_1",
+            generate_secret=True,
+            name="example",
+            user_pool_id=example.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_cognito_user_pool_client_example.override_logical_id("example")
+        aws_cognito_user_pool_domain_example = CognitoUserPoolDomain(self, "example_2",
+            domain="example",
+            user_pool_id=example.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_cognito_user_pool_domain_example.override_logical_id("example")
+        aws_sagemaker_workforce_example = SagemakerWorkforce(self, "example_3",
+            cognito_config=SagemakerWorkforceCognitoConfig(
+                client_id=Token.as_string(aws_cognito_user_pool_client_example.id),
+                user_pool=Token.as_string(aws_cognito_user_pool_domain_example.user_pool_id)
+            ),
+            workforce_name="example"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_sagemaker_workforce_example.override_logical_id("example")
+```
+
+### Oidc Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.sagemaker_workforce import SagemakerWorkforce
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SagemakerWorkforce(self, "example",
+            oidc_config=SagemakerWorkforceOidcConfig(
+                authorization_endpoint="https://example.com",
+                client_id="example",
+                client_secret="example",
+                issuer="https://example.com",
+                jwks_uri="https://example.com",
+                logout_endpoint="https://example.com",
+                token_endpoint="https://example.com",
+                user_info_endpoint="https://example.com"
+            ),
+            workforce_name="example"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `workforce_name` - (Required) The name of the Workforce (must be unique).
+* `cognito_config` - (Optional) Use this parameter to configure an Amazon Cognito private workforce. A single Cognito workforce is created using and corresponds to a single Amazon Cognito user pool. Conflicts with `oidc_config`. see [Cognito Config](#cognito-config) details below.
+* `oidc_config` - (Optional) Use this parameter to configure a private workforce using your own OIDC Identity Provider. Conflicts with `cognito_config`. see [OIDC Config](#oidc-config) details below.
+* `source_ip_config` - (Optional) A list of IP address ranges Used to create an allow list of IP addresses for a private workforce. By default, a workforce isn't restricted to specific IP addresses. see [Source Ip Config](#source-ip-config) details below.
+* `workforce_vpc_config` - (Optional) configure a workforce using VPC. see [Workforce VPC Config](#workforce-vpc-config) details below.
+
+### Cognito Config
+
+* `client_id` - (Required) The client ID for your Amazon Cognito user pool.
+* `user_pool` - (Required) ID for your Amazon Cognito user pool.
+
+### Oidc Config
+
+* `authorization_endpoint` - (Required) The OIDC IdP authorization endpoint used to configure your private workforce.
+* `client_id` - (Required) The OIDC IdP client ID used to configure your private workforce.
+* `client_secret` - (Required) The OIDC IdP client secret used to configure your private workforce.
+* `issuer` - (Required) The OIDC IdP issuer used to configure your private workforce.
+* `jwks_uri` - (Required) The OIDC IdP JSON Web Key Set (Jwks) URI used to configure your private workforce.
+* `logout_endpoint` - (Required) The OIDC IdP logout endpoint used to configure your private workforce.
+* `token_endpoint` - (Required) The OIDC IdP token endpoint used to configure your private workforce.
+* `user_info_endpoint` - (Required) The OIDC IdP user information endpoint used to configure your private workforce.
+
+### Source Ip Config
+
+* `cidrs` - (Required) A list of up to 10 CIDR values.
+
+### Workforce VPC Config
+
+* `security_group_ids` - (Optional) The VPC security group IDs. The security groups must be for the same VPC as specified in the subnet.
+* `subnets` - (Optional) The ID of the subnets in the VPC that you want to connect.
+* `vpc_id` - (Optional) The ID of the VPC that the workforce uses for communication.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) assigned by AWS to this Workforce.
+* `id` - The name of the Workforce.
+* `subdomain` - The subdomain for your OIDC Identity Provider.
+* `workforce_vpc_config.0.vpc_endpoint_id` - The IDs for the VPC service endpoints of your VPC workforce.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SageMaker Workforces using the `workforce_name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import SageMaker Workforces using the `workforce_name`. For example:
+
+```console
+% terraform import aws_sagemaker_workforce.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-b4c9ab9708ddac7777a4511e715674b772e0a778ceb4beb60491fda22462d138 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/sagemaker_workteam.html.markdown b/website/docs/cdktf/python/r/sagemaker_workteam.html.markdown
new file mode 100644
index 00000000000..d4d60ae275f
--- /dev/null
+++ b/website/docs/cdktf/python/r/sagemaker_workteam.html.markdown
@@ -0,0 +1,131 @@
+---
+subcategory: "SageMaker"
+layout: "aws"
+page_title: "AWS: aws_sagemaker_workteam"
+description: |-
+  Provides a SageMaker Workteam resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sagemaker_workteam
+
+Provides a SageMaker Workteam resource.
+
+## Example Usage
+
+### Cognito Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.sagemaker_workteam import SagemakerWorkteam
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SagemakerWorkteam(self, "example",
+            description="example",
+            member_definition=[SagemakerWorkteamMemberDefinition(
+                cognito_member_definition=SagemakerWorkteamMemberDefinitionCognitoMemberDefinition(
+                    client_id=Token.as_string(aws_cognito_user_pool_client_example.id),
+                    user_group=Token.as_string(aws_cognito_user_group_example.id),
+                    user_pool=Token.as_string(aws_cognito_user_pool_domain_example.user_pool_id)
+                )
+            )
+            ],
+            workforce_name=Token.as_string(aws_sagemaker_workforce_example.id),
+            workteam_name="example"
+        )
+```
+
+### Oidc Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.sagemaker_workteam import SagemakerWorkteam
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SagemakerWorkteam(self, "example",
+            description="example",
+            member_definition=[SagemakerWorkteamMemberDefinition(
+                oidc_member_definition=SagemakerWorkteamMemberDefinitionOidcMemberDefinition(
+                    groups=["example"]
+                )
+            )
+            ],
+            workforce_name=Token.as_string(aws_sagemaker_workforce_example.id),
+            workteam_name="example"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `description` - (Required) A description of the work team.
+* `workforce_name` - (Required) The name of the Workteam (must be unique).
+* `workteam_name` - (Required) The name of the workforce.
+* `member_definition` - (Required) A list of Member Definitions that contains objects that identify the workers that make up the work team. Workforces can be created using Amazon Cognito or your own OIDC Identity Provider (IdP). For private workforces created using Amazon Cognito use `cognito_member_definition`. For workforces created using your own OIDC identity provider (IdP) use `oidc_member_definition`. Do not provide input for both of these parameters in a single request. see [Member Definition](#member-definition) details below.
+* `notification_configuration` - (Optional) Configures notification of workers regarding available or expiring work items. see [Notification Configuration](#notification-configuration) details below.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Member Definition
+
+* `cognito_member_definition` - (Optional) The Amazon Cognito user group that is part of the work team. See [Cognito Member Definition](#cognito-member-definition) details below.
+* `oidc_member_definition` - (Optional) A list user groups that exist in your OIDC Identity Provider (IdP). One to ten groups can be used to create a single private work team. See [Cognito Member Definition](#oidc-member-definition) details below.
+
+#### Cognito Member Definition
+
+* `client_id` - (Required) An identifier for an application client. You must create the app client ID using Amazon Cognito.
+* `user_pool` - (Required) An identifier for a user pool. The user pool must be in the same region as the service that you are calling.
+* `user_group` - (Required) An identifier for a user group.
+
+#### Oidc Member Definition
+
+* `groups` - (Required) A list of comma separated strings that identifies user groups in your OIDC IdP. Each user group is made up of a group of private workers.
+
+### Notification Configuration
+
+* `notification_topic_arn` - (Required) The ARN for the SNS topic to which notifications should be published.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) assigned by AWS to this Workteam.
+* `id` - The name of the Workteam.
+* `subdomain` - The subdomain for your OIDC Identity Provider.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SageMaker Workteams using the `workteam_name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import SageMaker Workteams using the `workteam_name`. For example:
+
+```console
+% terraform import aws_sagemaker_workteam.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-3a7cf1fb125ebeb37f30bd90666ac5def329d2504804e10053f90547efe5df34 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/scheduler_schedule.html.markdown b/website/docs/cdktf/python/r/scheduler_schedule.html.markdown
new file mode 100644
index 00000000000..7fe2d517b00
--- /dev/null
+++ b/website/docs/cdktf/python/r/scheduler_schedule.html.markdown
@@ -0,0 +1,229 @@
+---
+subcategory: "EventBridge Scheduler"
+layout: "aws"
+page_title: "AWS: aws_scheduler_schedule"
+description: |-
+  Provides an EventBridge Scheduler Schedule resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_scheduler_schedule
+
+Provides an EventBridge Scheduler Schedule resource.
+
+You can find out more about EventBridge Scheduler in the [User Guide](https://docs.aws.amazon.com/scheduler/latest/UserGuide/what-is-scheduler.html).
+
+~> **Note:** EventBridge was formerly known as CloudWatch Events. The functionality is identical.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.scheduler_schedule import SchedulerSchedule
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SchedulerSchedule(self, "example",
+            flexible_time_window=SchedulerScheduleFlexibleTimeWindow(
+                mode="OFF"
+            ),
+            group_name="default",
+            name="my-schedule",
+            schedule_expression="rate(1 hours)",
+            target=SchedulerScheduleTarget(
+                arn=Token.as_string(aws_sqs_queue_example.arn),
+                role_arn=Token.as_string(aws_iam_role_example.arn)
+            )
+        )
+```
+
+### Universal Target
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.scheduler_schedule import SchedulerSchedule
+from imports.aws.sqs_queue import SqsQueue
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = SqsQueue(self, "example")
+        aws_scheduler_schedule_example = SchedulerSchedule(self, "example_1",
+            flexible_time_window=SchedulerScheduleFlexibleTimeWindow(
+                mode="OFF"
+            ),
+            name="my-schedule",
+            schedule_expression="rate(1 hours)",
+            target=SchedulerScheduleTarget(
+                arn="arn:aws:scheduler:::aws-sdk:sqs:sendMessage",
+                input=Token.as_string(
+                    Fn.jsonencode({
+                        "MessageBody": "Greetings, programs!",
+                        "QueueUrl": example.url
+                    })),
+                role_arn=Token.as_string(aws_iam_role_example.arn)
+            )
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_scheduler_schedule_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `flexible_time_window` - (Required) Configures a time window during which EventBridge Scheduler invokes the schedule. Detailed below.
+* `schedule_expression` - (Required) Defines when the schedule runs. Read more in [Schedule types on EventBridge Scheduler](https://docs.aws.amazon.com/scheduler/latest/UserGuide/schedule-types.html).
+* `target` - (Required) Configures the target of the schedule. Detailed below.
+
+The following arguments are optional:
+
+* `description` - (Optional) Brief description of the schedule.
+* `end_date` - (Optional) The date, in UTC, before which the schedule can invoke its target. Depending on the schedule's recurrence expression, invocations might stop on, or before, the end date you specify. EventBridge Scheduler ignores the end date for one-time schedules. Example: `2030-01-01T01:00:00Z`.
+* `group_name` - (Optional, Forces new resource) Name of the schedule group to associate with this schedule. When omitted, the `default` schedule group is used.
+* `kms_key_arn` - (Optional) ARN for the customer managed KMS key that EventBridge Scheduler will use to encrypt and decrypt your data.
+* `name` - (Optional, Forces new resource) Name of the schedule. If omitted, Terraform will assign a random, unique name. Conflicts with `name_prefix`.
+* `name_prefix` - (Optional, Forces new resource) Creates a unique name beginning with the specified prefix. Conflicts with `name`.
+* `schedule_expression_timezone` - (Optional) Timezone in which the scheduling expression is evaluated. Defaults to `UTC`. Example: `Australia/Sydney`.
+* `start_date` - (Optional) The date, in UTC, after which the schedule can begin invoking its target. Depending on the schedule's recurrence expression, invocations might occur on, or after, the start date you specify. EventBridge Scheduler ignores the start date for one-time schedules. Example: `2030-01-01T01:00:00Z`.
+* `state` - (Optional) Specifies whether the schedule is enabled or disabled. One of: `ENABLED` (default), `DISABLED`.
+
+### flexible_time_window Configuration Block
+
+* `maximum_window_in_minutes` - (Optional) Maximum time window during which a schedule can be invoked. Ranges from `1` to `1440` minutes.
+* `mode` - (Required) Determines whether the schedule is invoked within a flexible time window. One of: `OFF`, `FLEXIBLE`.
+
+### target Configuration Block
+
+The following arguments are required:
+
+* `arn` - (Required) ARN of the target of this schedule, such as a SQS queue or ECS cluster. For universal targets, this is a [Service ARN specific to the target service](https://docs.aws.amazon.com/scheduler/latest/UserGuide/managing-targets-universal.html#supported-universal-targets).
+* `role_arn` - (Required) ARN of the IAM role that EventBridge Scheduler will use for this target when the schedule is invoked. Read more in [Set up the execution role](https://docs.aws.amazon.com/scheduler/latest/UserGuide/setting-up.html#setting-up-execution-role).
+
+The following arguments are optional:
+
+* `dead_letter_config` - (Optional) Information about an Amazon SQS queue that EventBridge Scheduler uses as a dead-letter queue for your schedule. If specified, EventBridge Scheduler delivers failed events that could not be successfully delivered to a target to the queue. Detailed below.
+* `ecs_parameters` - (Optional) Templated target type for the Amazon ECS [`RunTask`](https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_RunTask.html) API operation. Detailed below.
+* `eventbridge_parameters` - (Optional) Templated target type for the EventBridge [`PutEvents`](https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_PutEvents.html) API operation. Detailed below.
+* `input` - (Optional) Text, or well-formed JSON, passed to the target. Read more in [Universal target](https://docs.aws.amazon.com/scheduler/latest/UserGuide/managing-targets-universal.html).
+* `kinesis_parameters` - (Optional) Templated target type for the Amazon Kinesis [`PutRecord`](https://docs.aws.amazon.com/kinesis/latest/APIReference/API_PutRecord.html) API operation. Detailed below.
+* `retry_policy` - (Optional) Information about the retry policy settings. Detailed below.
+* `sagemaker_pipeline_parameters` - (Optional) Templated target type for the Amazon SageMaker [`StartPipelineExecution`](https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_StartPipelineExecution.html) API operation. Detailed below.
+* `sqs_parameters` - (Optional) The templated target type for the Amazon SQS [`SendMessage`](https://docs.aws.amazon.com/AWSSimpleQueueService/latest/APIReference/API_SendMessage.html) API operation. Detailed below.
+
+#### dead_letter_config Configuration Block
+
+* `arn` - (Required) ARN of the SQS queue specified as the destination for the dead-letter queue.
+
+#### ecs_parameters Configuration Block
+
+The following arguments are required:
+
+* `task_definition_arn` - (Required) ARN of the task definition to use.
+
+The following arguments are optional:
+
+* `capacity_provider_strategy` - (Optional) Up to `6` capacity provider strategies to use for the task. Detailed below.
+* `enable_ecs_managed_tags` - (Optional) Specifies whether to enable Amazon ECS managed tags for the task. For more information, see [Tagging Your Amazon ECS Resources](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/ecs-using-tags.html) in the Amazon ECS Developer Guide.
+* `enable_execute_command` - (Optional) Specifies whether to enable the execute command functionality for the containers in this task.
+* `group` - (Optional) Specifies an ECS task group for the task. At most 255 characters.
+* `launch_type` - (Optional) Specifies the launch type on which your task is running. The launch type that you specify here must match one of the launch type (compatibilities) of the target task. One of: `EC2`, `FARGATE`, `EXTERNAL`.
+* `network_configuration` - (Optional) Configures the networking associated with the task. Detailed below.
+* `placement_constraints` - (Optional) A set of up to 10 placement constraints to use for the task. Detailed below.
+* `placement_strategy` - (Optional) A set of up to 5 placement strategies. Detailed below.
+* `platform_version` - (Optional) Specifies the platform version for the task. Specify only the numeric portion of the platform version, such as `1.1.0`.
+* `propagate_tags` - (Optional) Specifies whether to propagate the tags from the task definition to the task. One of: `TASK_DEFINITION`.
+* `reference_id` - (Optional) Reference ID to use for the task.
+* `tags` - (Optional) The metadata that you apply to the task. Each tag consists of a key and an optional value. For more information, see [`RunTask`](https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_RunTask.html) in the Amazon ECS API Reference.
+* `task_count` - (Optional) The number of tasks to create. Ranges from `1` (default) to `10`.
+
+##### capacity_provider_strategy Configuration Block
+
+* `base` - (Optional) How many tasks, at a minimum, to run on the specified capacity provider. Only one capacity provider in a capacity provider strategy can have a base defined. Ranges from `0` (default) to `100000`.
+* `capacity_provider` - (Required) Short name of the capacity provider.
+* `weight` - (Optional) Designates the relative percentage of the total number of tasks launched that should use the specified capacity provider. The weight value is taken into consideration after the base value, if defined, is satisfied. Ranges from from `0` to `1000`.
+
+##### network_configuration Configuration Block
+
+* `assign_public_ip` - (Optional) Specifies whether the task's elastic network interface receives a public IP address. This attribute is a boolean type, where `true` maps to `ENABLED` and `false` to `DISABLED`. You can specify `true` only when the `launch_type` is set to `FARGATE`.
+* `security_groups` - (Optional) Set of 1 to 5 Security Group ID-s to be associated with the task. These security groups must all be in the same VPC.
+* `subnets` - (Optional) Set of 1 to 16 subnets to be associated with the task. These subnets must all be in the same VPC.
+
+##### placement_constraints Configuration Block
+
+* `expression` - (Optional) A cluster query language expression to apply to the constraint. You cannot specify an expression if the constraint type is `distinctInstance`. For more information, see [Cluster query language](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/cluster-query-language.html) in the Amazon ECS Developer Guide.
+* `type` - (Required) The type of constraint. One of: `distinctInstance`, `memberOf`.
+
+##### placement_strategy Configuration Block
+
+* `field` - (Optional) The field to apply the placement strategy against.
+* `type` - (Required) The type of placement strategy. One of: `random`, `spread`, `binpack`.
+
+#### eventbridge_parameters Configuration Block
+
+* `detail_type` - (Required) Free-form string used to decide what fields to expect in the event detail. Up to 128 characters.
+* `source` - (Required) Source of the event.
+
+#### kinesis_parameters Configuration Block
+
+* `partition_key` - (Required) Specifies the shard to which EventBridge Scheduler sends the event. Up to 256 characters.
+
+#### retry_policy Configuration Block
+
+* `maximum_event_age_in_seconds` - (Optional) Maximum amount of time, in seconds, to continue to make retry attempts. Ranges from `60` to `86400` (default).
+* `maximum_retry_attempts` - (Optional) Maximum number of retry attempts to make before the request fails. Ranges from `0` to `185` (default).
+
+#### sagemaker_pipeline_parameters Configuration Block
+
+* `pipeline_parameter` - (Optional) Set of up to 200 parameter names and values to use when executing the SageMaker Model Building Pipeline. Detailed below.
+
+##### pipeline_parameter Configuration Block
+
+* `name` - (Required) Name of parameter to start execution of a SageMaker Model Building Pipeline.
+* `value` - (Required) Value of parameter to start execution of a SageMaker Model Building Pipeline.
+
+#### sqs_parameters Configuration Block
+
+* `message_group_id` - (Optional) FIFO message group ID to use as the target.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Name of the schedule.
+* `arn` - ARN of the schedule.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import schedules using the combination `group_name/name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import schedules using the combination `group_name/name`. For example:
+
+```console
+% terraform import aws_scheduler_schedule.example my-schedule-group/my-schedule
+```
+
+<!-- cache-key: cdktf-0.18.0 input-95ba3e7c2dcc364c2b888e21f8830e94c2d1a70691fedb123bb008ebd8c952d3 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/scheduler_schedule_group.html.markdown b/website/docs/cdktf/python/r/scheduler_schedule_group.html.markdown
new file mode 100644
index 00000000000..bc0fcfd96c7
--- /dev/null
+++ b/website/docs/cdktf/python/r/scheduler_schedule_group.html.markdown
@@ -0,0 +1,83 @@
+---
+subcategory: "EventBridge Scheduler"
+layout: "aws"
+page_title: "AWS: aws_scheduler_schedule_group"
+description: |-
+  Provides an EventBridge Scheduler Schedule Group resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_scheduler_schedule_group
+
+Provides an EventBridge Scheduler Schedule Group resource.
+
+You can find out more about EventBridge Scheduler in the [User Guide](https://docs.aws.amazon.com/scheduler/latest/UserGuide/what-is-scheduler.html).
+
+~> **Note:** EventBridge was formerly known as CloudWatch Events. The functionality is identical.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.scheduler_schedule_group import SchedulerScheduleGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SchedulerScheduleGroup(self, "example",
+            name="my-schedule-group"
+        )
+```
+
+## Argument Reference
+
+The following arguments are optional:
+
+* `name` - (Optional, Forces new resource) Name of the schedule group. If omitted, Terraform will assign a random, unique name. Conflicts with `name_prefix`.
+* `name_prefix` - (Optional, Forces new resource) Creates a unique name beginning with the specified prefix. Conflicts with `name`.
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Name of the schedule group.
+* `arn` - ARN of the schedule group.
+* `creation_date` - Time at which the schedule group was created.
+* `last_modification_date` - Time at which the schedule group was last modified.
+* `state` - State of the schedule group. Can be `ACTIVE` or `DELETING`.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `5m`)
+- `delete` - (Default `5m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import schedule groups using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import schedule groups using the `name`. For example:
+
+```console
+% terraform import aws_scheduler_schedule_group.example my-schedule-group
+```
+
+<!-- cache-key: cdktf-0.18.0 input-10168b28a6e4905d4caa31ec8a7ac8f50e27b681fd289f91d98f6ade6ba63b5c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/schemas_discoverer.html.markdown b/website/docs/cdktf/python/r/schemas_discoverer.html.markdown
new file mode 100644
index 00000000000..9d1e3cfe545
--- /dev/null
+++ b/website/docs/cdktf/python/r/schemas_discoverer.html.markdown
@@ -0,0 +1,76 @@
+---
+subcategory: "EventBridge Schemas"
+layout: "aws"
+page_title: "AWS: aws_schemas_discoverer"
+description: |-
+  Provides an EventBridge Schema Discoverer resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_schemas_discoverer
+
+Provides an EventBridge Schema Discoverer resource.
+
+~> **Note:** EventBridge was formerly known as CloudWatch Events. The functionality is identical.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudwatch_event_bus import CloudwatchEventBus
+from imports.aws.schemas_discoverer import SchemasDiscoverer
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        messenger = CloudwatchEventBus(self, "messenger",
+            name="chat-messages"
+        )
+        SchemasDiscoverer(self, "test",
+            description="Auto discover event schemas",
+            source_arn=messenger.arn
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `source_arn` - (Required) The ARN of the event bus to discover event schemas on.
+* `description` - (Optional) The description of the discoverer. Maximum of 256 characters.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the discoverer.
+* `id` - The ID of the discoverer.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EventBridge discoverers using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import EventBridge discoverers using the `id`. For example:
+
+```console
+% terraform import aws_schemas_discoverer.test 123
+```
+
+<!-- cache-key: cdktf-0.18.0 input-5d0121c0f1733e52e29ed11dfdf085e2536a62771b5c5d2f16c8193227f29a29 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/schemas_registry.html.markdown b/website/docs/cdktf/python/r/schemas_registry.html.markdown
new file mode 100644
index 00000000000..605bd4d87d4
--- /dev/null
+++ b/website/docs/cdktf/python/r/schemas_registry.html.markdown
@@ -0,0 +1,71 @@
+---
+subcategory: "EventBridge Schemas"
+layout: "aws"
+page_title: "AWS: aws_schemas_registry"
+description: |-
+  Provides an EventBridge Custom Schema Registry resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_schemas_registry
+
+Provides an EventBridge Custom Schema Registry resource.
+
+~> **Note:** EventBridge was formerly known as CloudWatch Events. The functionality is identical.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.schemas_registry import SchemasRegistry
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SchemasRegistry(self, "test",
+            description="A custom schema registry",
+            name="my_own_registry"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the custom event schema registry. Maximum of 64 characters consisting of lower case letters, upper case letters, 0-9, ., -, _.
+* `description` - (Optional) The description of the discoverer. Maximum of 256 characters.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the discoverer.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EventBridge schema registries using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import EventBridge schema registries using the `name`. For example:
+
+```console
+% terraform import aws_schemas_registry.test my_own_registry
+```
+
+<!-- cache-key: cdktf-0.18.0 input-5af6f76005b958271bcf75ab6df88eb3a8ded497a3eed14e2d8ed999dcc783d2 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/schemas_registry_policy.html.markdown b/website/docs/cdktf/python/r/schemas_registry_policy.html.markdown
new file mode 100644
index 00000000000..bf9afb500d7
--- /dev/null
+++ b/website/docs/cdktf/python/r/schemas_registry_policy.html.markdown
@@ -0,0 +1,93 @@
+---
+subcategory: "EventBridge Schemas"
+layout: "aws"
+page_title: "AWS: aws_schemas_registry_policy"
+description: |-
+  Terraform resource for managing an AWS EventBridge Schemas Registry Policy.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_schemas_registry_policy
+
+Terraform resource for managing an AWS EventBridge Schemas Registry Policy.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.schemas_registry_policy import SchemasRegistryPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = DataAwsIamPolicyDocument(self, "example",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["schemas:*"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["109876543210"],
+                    type="AWS"
+                )
+                ],
+                resources=["arn:aws:schemas:us-east-1:012345678901:registry/example", "arn:aws:schemas:us-east-1:012345678901:schema/example*"
+                ],
+                sid="example"
+            )
+            ]
+        )
+        aws_schemas_registry_policy_example = SchemasRegistryPolicy(self, "example_1",
+            policy=Token.as_string(example.json),
+            registry_name="example"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_schemas_registry_policy_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `registry_name` - (Required) Name of EventBridge Schema Registry
+* `policy` - (Required) Resource Policy for EventBridge Schema Registry
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Timeouts
+
+[Configuration options](https://www.terraform.io/docs/configuration/blocks/resources/syntax.html#operation-timeouts):
+
+* `create` - (Default `5m`)
+* `update` - (Default `5m`)
+* `delete` - (Default `5m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EventBridge Schema Registry Policy using the `registry_name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import EventBridge Schema Registry Policy using the `registry_name`. For example:
+
+```console
+% terraform import aws_schemas_registry_policy.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-9012f6db2847612db1042a8a2bfd8eded85a88882cdbccfc86d64bfed094f01b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/schemas_schema.html.markdown b/website/docs/cdktf/python/r/schemas_schema.html.markdown
new file mode 100644
index 00000000000..fa2b3817a69
--- /dev/null
+++ b/website/docs/cdktf/python/r/schemas_schema.html.markdown
@@ -0,0 +1,106 @@
+---
+subcategory: "EventBridge Schemas"
+layout: "aws"
+page_title: "AWS: aws_schemas_schema"
+description: |-
+  Provides an EventBridge Schema resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_schemas_schema
+
+Provides an EventBridge Schema resource.
+
+~> **Note:** EventBridge was formerly known as CloudWatch Events. The functionality is identical.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.schemas_registry import SchemasRegistry
+from imports.aws.schemas_schema import SchemasSchema
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        test = SchemasRegistry(self, "test",
+            name="my_own_registry"
+        )
+        aws_schemas_schema_test = SchemasSchema(self, "test_1",
+            content=Token.as_string(
+                Fn.jsonencode({
+                    "components": {
+                        "schemas": {
+                            "Event": {
+                                "properties": {
+                                    "name": {
+                                        "type": "string"
+                                    }
+                                },
+                                "type": "object"
+                            }
+                        }
+                    },
+                    "info": {
+                        "title": "Event",
+                        "version": "1.0.0"
+                    },
+                    "openapi": "3.0.0",
+                    "paths": {}
+                })),
+            description="The schema definition for my event",
+            name="my_schema",
+            registry_name=test.name,
+            type="OpenApi3"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_schemas_schema_test.override_logical_id("test")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the schema. Maximum of 385 characters consisting of lower case letters, upper case letters, ., -, _, @.
+* `content` - (Required) The schema specification. Must be a valid Open API 3.0 spec.
+* `registry_name` - (Required) The name of the registry in which this schema belongs.
+* `type` - (Required) The type of the schema. Valid values: `OpenApi3` or `JSONSchemaDraft4`.
+* `description` - (Optional) The description of the schema. Maximum of 256 characters.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the discoverer.
+* `last_modified` - The last modified date of the schema.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `version` - The version of the schema.
+* `version_created_date` - The created date of the version of the schema.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EventBridge schema using the `name` and `registry_name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import EventBridge schema using the `name` and `registry_name`. For example:
+
+```console
+% terraform import aws_schemas_schema.test name/registry
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ebc2fd95aa82c21b5b6f551a7043512b14e59815f8ffb599ebc2d14cfbaf7eb8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/secretsmanager_secret.html.markdown b/website/docs/cdktf/python/r/secretsmanager_secret.html.markdown
new file mode 100644
index 00000000000..333fefe4bc5
--- /dev/null
+++ b/website/docs/cdktf/python/r/secretsmanager_secret.html.markdown
@@ -0,0 +1,89 @@
+---
+subcategory: "Secrets Manager"
+layout: "aws"
+page_title: "AWS: aws_secretsmanager_secret"
+description: |-
+  Provides a resource to manage AWS Secrets Manager secret metadata
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_secretsmanager_secret
+
+Provides a resource to manage AWS Secrets Manager secret metadata. To manage secret rotation, see the [`aws_secretsmanager_secret_rotation` resource](/docs/providers/aws/r/secretsmanager_secret_rotation.html). To manage a secret value, see the [`aws_secretsmanager_secret_version` resource](/docs/providers/aws/r/secretsmanager_secret_version.html).
+
+## Example Usage
+
+### Basic
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.secretsmanager_secret import SecretsmanagerSecret
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SecretsmanagerSecret(self, "example",
+            name="example"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `description` - (Optional) Description of the secret.
+* `kms_key_id` - (Optional) ARN or Id of the AWS KMS key to be used to encrypt the secret values in the versions stored in this secret. If you need to reference a CMK in a different account, you can use only the key ARN. If you don't specify this value, then Secrets Manager defaults to using the AWS account's default KMS key (the one named `aws/secretsmanager`). If the default KMS key with that name doesn't yet exist, then AWS Secrets Manager creates it for you automatically the first time.
+* `name_prefix` - (Optional) Creates a unique name beginning with the specified prefix. Conflicts with `name`.
+* `name` - (Optional) Friendly name of the new secret. The secret name can consist of uppercase letters, lowercase letters, digits, and any of the following characters: `/_+=.@-` Conflicts with `name_prefix`.
+* `policy` - (Optional) Valid JSON document representing a [resource policy](https://docs.aws.amazon.com/secretsmanager/latest/userguide/auth-and-access_resource-based-policies.html). For more information about building AWS IAM policy documents with Terraform, see the [AWS IAM Policy Document Guide](https://learn.hashicorp.com/terraform/aws/iam-policy). Removing `policy` from your configuration or setting `policy` to null or an empty string (i.e., `policy = ""`) _will not_ delete the policy since it could have been set by `aws_secretsmanager_secret_policy`. To delete the `policy`, set it to `"{}"` (an empty JSON document).
+* `recovery_window_in_days` - (Optional) Number of days that AWS Secrets Manager waits before it can delete the secret. This value can be `0` to force deletion without recovery or range from `7` to `30` days. The default value is `30`.
+* `replica` - (Optional) Configuration block to support secret replication. See details below.
+* `force_overwrite_replica_secret` - (Optional) Accepts boolean value to specify whether to overwrite a secret with the same name in the destination Region.
+* `tags` - (Optional) Key-value map of user-defined tags that are attached to the secret. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### replica
+
+* `kms_key_id` - (Optional) ARN, Key ID, or Alias of the AWS KMS key within the region secret is replicated to. If one is not specified, then Secrets Manager defaults to using the AWS account's default KMS key (`aws/secretsmanager`) in the region or creates one for use if non-existent.
+* `region` - (Required) Region for replicating the secret.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - ARN of the secret.
+* `arn` - ARN of the secret.
+* `replica` - Attributes of a replica are described below.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+### replica
+
+* `last_accessed_date` - Date that you last accessed the secret in the Region.
+* `status` - Status can be `InProgress`, `Failed`, or `InSync`.
+* `status_message` - Message such as `Replication succeeded` or `Secret with this name already exists in this region`.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_secretsmanager_secret` using the secret Amazon Resource Name (ARN). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_secretsmanager_secret` using the secret Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_secretsmanager_secret.example arn:aws:secretsmanager:us-east-1:123456789012:secret:example-123456
+```
+
+<!-- cache-key: cdktf-0.18.0 input-f44bb9eb3bae8b018f7e6a78dcbe04e2e4a77f8946d831c31f854ca198346489 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/secretsmanager_secret_policy.html.markdown b/website/docs/cdktf/python/r/secretsmanager_secret_policy.html.markdown
new file mode 100644
index 00000000000..8fa2124424c
--- /dev/null
+++ b/website/docs/cdktf/python/r/secretsmanager_secret_policy.html.markdown
@@ -0,0 +1,96 @@
+---
+subcategory: "Secrets Manager"
+layout: "aws"
+page_title: "AWS: aws_secretsmanager_secret_policy"
+description: |-
+  Provides a resource to manage AWS Secrets Manager secret policy
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_secretsmanager_secret_policy
+
+Provides a resource to manage AWS Secrets Manager secret policy.
+
+## Example Usage
+
+### Basic
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.secretsmanager_secret import SecretsmanagerSecret
+from imports.aws.secretsmanager_secret_policy import SecretsmanagerSecretPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = SecretsmanagerSecret(self, "example",
+            name="example"
+        )
+        data_aws_iam_policy_document_example = DataAwsIamPolicyDocument(self, "example_1",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["secretsmanager:GetSecretValue"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["arn:aws:iam::123456789012:root"],
+                    type="AWS"
+                )
+                ],
+                resources=["*"],
+                sid="EnableAnotherAWSAccountToReadTheSecret"
+            )
+            ]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_iam_policy_document_example.override_logical_id("example")
+        aws_secretsmanager_secret_policy_example = SecretsmanagerSecretPolicy(self, "example_2",
+            policy=Token.as_string(data_aws_iam_policy_document_example.json),
+            secret_arn=example.arn
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_secretsmanager_secret_policy_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `policy` - (Required) Valid JSON document representing a [resource policy](https://docs.aws.amazon.com/secretsmanager/latest/userguide/auth-and-access_resource-based-policies.html). For more information about building AWS IAM policy documents with Terraform, see the [AWS IAM Policy Document Guide](https://learn.hashicorp.com/terraform/aws/iam-policy). Unlike `aws_secretsmanager_secret`, where `policy` can be set to `"{}"` to delete the policy, `"{}"` is not a valid policy since `policy` is required.
+* `secret_arn` - (Required) Secret ARN.
+
+The following arguments are optional:
+
+* `block_public_policy` - (Optional) Makes an optional API call to Zelkova to validate the Resource Policy to prevent broad access to your secret.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Amazon Resource Name (ARN) of the secret.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_secretsmanager_secret_policy` using the secret Amazon Resource Name (ARN). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_secretsmanager_secret_policy` using the secret Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_secretsmanager_secret_policy.example arn:aws:secretsmanager:us-east-1:123456789012:secret:example-123456
+```
+
+<!-- cache-key: cdktf-0.18.0 input-645c813817dc94994f91896c0dc33ab5185045f6665587858a142de45a69dfb5 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/secretsmanager_secret_rotation.html.markdown b/website/docs/cdktf/python/r/secretsmanager_secret_rotation.html.markdown
new file mode 100644
index 00000000000..58ca5857ad1
--- /dev/null
+++ b/website/docs/cdktf/python/r/secretsmanager_secret_rotation.html.markdown
@@ -0,0 +1,89 @@
+---
+subcategory: "Secrets Manager"
+layout: "aws"
+page_title: "AWS: aws_secretsmanager_secret_rotation"
+description: |-
+  Provides a resource to manage AWS Secrets Manager secret rotation
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_secretsmanager_secret_rotation
+
+Provides a resource to manage AWS Secrets Manager secret rotation. To manage a secret, see the [`aws_secretsmanager_secret` resource](/docs/providers/aws/r/secretsmanager_secret.html). To manage a secret value, see the [`aws_secretsmanager_secret_version` resource](/docs/providers/aws/r/secretsmanager_secret_version.html).
+
+## Example Usage
+
+### Basic
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.secretsmanager_secret_rotation import SecretsmanagerSecretRotation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SecretsmanagerSecretRotation(self, "example",
+            rotation_lambda_arn=Token.as_string(aws_lambda_function_example.arn),
+            rotation_rules=SecretsmanagerSecretRotationRotationRules(
+                automatically_after_days=30
+            ),
+            secret_id=Token.as_string(aws_secretsmanager_secret_example.id)
+        )
+```
+
+### Rotation Configuration
+
+To enable automatic secret rotation, the Secrets Manager service requires usage of a Lambda function. The [Rotate Secrets section in the Secrets Manager User Guide](https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotating-secrets.html) provides additional information about deploying a prebuilt Lambda functions for supported credential rotation (e.g., RDS) or deploying a custom Lambda function.
+
+~> **NOTE:** Configuring rotation causes the secret to rotate once as soon as you enable rotation. Before you do this, you must ensure that all of your applications that use the credentials stored in the secret are updated to retrieve the secret from AWS Secrets Manager. The old credentials might no longer be usable after the initial rotation and any applications that you fail to update will break as soon as the old credentials are no longer valid.
+
+~> **NOTE:** If you cancel a rotation that is in progress (by removing the `rotation` configuration), it can leave the VersionStage labels in an unexpected state. Depending on what step of the rotation was in progress, you might need to remove the staging label AWSPENDING from the partially created version, specified by the SecretVersionId response value. You should also evaluate the partially rotated new version to see if it should be deleted, which you can do by removing all staging labels from the new version's VersionStage field.
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `secret_id` - (Required) Specifies the secret to which you want to add a new version. You can specify either the Amazon Resource Name (ARN) or the friendly name of the secret. The secret must already exist.
+* `rotation_lambda_arn` - (Required) Specifies the ARN of the Lambda function that can rotate the secret.
+* `rotation_rules` - (Required) A structure that defines the rotation configuration for this secret. Defined below.
+
+### rotation_rules
+
+* `automatically_after_days` - (Optional) Specifies the number of days between automatic scheduled rotations of the secret. Either `automatically_after_days` or `schedule_expression` must be specified.
+* `duration` - (Optional) - The length of the rotation window in hours. For example, `3h` for a three hour window.
+* `schedule_expression` - (Optional) A `cron()` or `rate()` expression that defines the schedule for rotating your secret. Either `automatically_after_days` or `schedule_expression` must be specified.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Amazon Resource Name (ARN) of the secret.
+* `arn` - Amazon Resource Name (ARN) of the secret.
+* `rotation_enabled` - Specifies whether automatic rotation is enabled for this secret.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_secretsmanager_secret_rotation` using the secret Amazon Resource Name (ARN). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_secretsmanager_secret_rotation` using the secret Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_secretsmanager_secret_rotation.example arn:aws:secretsmanager:us-east-1:123456789012:secret:example-123456
+```
+
+<!-- cache-key: cdktf-0.18.0 input-cc47ff7adf2afa181189161981103bc0665261d0e6839ac663513dfdf24e3c49 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/secretsmanager_secret_version.html.markdown b/website/docs/cdktf/python/r/secretsmanager_secret_version.html.markdown
new file mode 100644
index 00000000000..e98077b26c6
--- /dev/null
+++ b/website/docs/cdktf/python/r/secretsmanager_secret_version.html.markdown
@@ -0,0 +1,128 @@
+---
+subcategory: "Secrets Manager"
+layout: "aws"
+page_title: "AWS: aws_secretsmanager_secret_version"
+description: |-
+  Provides a resource to manage AWS Secrets Manager secret version including its secret value
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_secretsmanager_secret_version
+
+Provides a resource to manage AWS Secrets Manager secret version including its secret value. To manage secret metadata, see the [`aws_secretsmanager_secret` resource](/docs/providers/aws/r/secretsmanager_secret.html).
+
+~> **NOTE:** If the `AWSCURRENT` staging label is present on this version during resource deletion, that label cannot be removed and will be skipped to prevent errors when fully deleting the secret. That label will leave this secret version active even after the resource is deleted from Terraform unless the secret itself is deleted. Move the `AWSCURRENT` staging label before or after deleting this resource from Terraform to fully trigger version deprecation if necessary.
+
+## Example Usage
+
+### Simple String Value
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.secretsmanager_secret_version import SecretsmanagerSecretVersion
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SecretsmanagerSecretVersion(self, "example",
+            secret_id=Token.as_string(aws_secretsmanager_secret_example.id),
+            secret_string="example-string-to-protect"
+        )
+```
+
+### Key-Value Pairs
+
+Secrets Manager also accepts key-value pairs in JSON.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import VariableType, TerraformVariable, Token, Fn, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.secretsmanager_secret_version import SecretsmanagerSecretVersion
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        # Terraform Variables are not always the best fit for getting inputs in the context of Terraform CDK.
+        #     You can read more about this at https://cdk.tf/variables
+        example = TerraformVariable(self, "example",
+            default=[{
+                "key1": "value1",
+                "key2": "value2"
+            }
+            ],
+            type=VariableType.map(VariableType.STRING)
+        )
+        aws_secretsmanager_secret_version_example =
+        SecretsmanagerSecretVersion(self, "example_1",
+            secret_id=Token.as_string(aws_secretsmanager_secret_example.id),
+            secret_string=Token.as_string(Fn.jsonencode(example.value))
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_secretsmanager_secret_version_example.override_logical_id("example")
+```
+
+-> **Note:** In Terraform 0.14 and later, use `sensitive = true` to protect the values of the variable from being printed in logs and console output (see [Protect Sensitive Input Variables](https://learn.hashicorp.com/tutorials/terraform/sensitive-variables)).
+
+Reading key-value pairs from JSON back into a native Terraform map can be accomplished in Terraform 0.12 and later with the [`jsondecode()` function](https://www.terraform.io/docs/configuration/functions/jsondecode.html):
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformOutput, Fn, TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        TerraformOutput(self, "example",
+            value=Fn.lookup_nested(Fn.jsondecode(example.secret_string), ["\"key1\""])
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `secret_id` - (Required) Specifies the secret to which you want to add a new version. You can specify either the Amazon Resource Name (ARN) or the friendly name of the secret. The secret must already exist.
+* `secret_string` - (Optional) Specifies text data that you want to encrypt and store in this version of the secret. This is required if secret_binary is not set.
+* `secret_binary` - (Optional) Specifies binary data that you want to encrypt and store in this version of the secret. This is required if secret_string is not set. Needs to be encoded to base64.
+* `version_stages` - (Optional) Specifies a list of staging labels that are attached to this version of the secret. A staging label must be unique to a single version of the secret. If you specify a staging label that's already associated with a different version of the same secret then that staging label is automatically removed from the other version and attached to this version. If you do not specify a value, then AWS Secrets Manager automatically moves the staging label `AWSCURRENT` to this new version on creation.
+
+~> **NOTE:** If `version_stages` is configured, you must include the `AWSCURRENT` staging label if this secret version is the only version or if the label is currently present on this secret version, otherwise Terraform will show a perpetual difference.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the secret.
+* `id` - A pipe delimited combination of secret ID and version ID.
+* `version_id` - The unique identifier of the version of the secret.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_secretsmanager_secret_version` using the secret ID and version ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_secretsmanager_secret_version` using the secret ID and version ID. For example:
+
+```console
+% terraform import aws_secretsmanager_secret_version.example 'arn:aws:secretsmanager:us-east-1:123456789012:secret:example-123456|xxxxx-xxxxxxx-xxxxxxx-xxxxx'
+```
+
+<!-- cache-key: cdktf-0.18.0 input-5f65f3c5e87dc3ce9fac6b2ac4088089f1f88f7a6df546f616bc7e3d7b3fd19d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/security_group.html.markdown b/website/docs/cdktf/python/r/security_group.html.markdown
new file mode 100644
index 00000000000..b688d2ab783
--- /dev/null
+++ b/website/docs/cdktf/python/r/security_group.html.markdown
@@ -0,0 +1,390 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_security_group"
+description: |-
+  Provides a security group resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_security_group
+
+Provides a security group resource.
+
+~> **NOTE on Security Groups and Security Group Rules:** Terraform currently provides a Security Group resource with `ingress` and `egress` rules defined in-line and a [Security Group Rule resource](security_group_rule.html) which manages one or more `ingress` or `egress` rules. Both of these resource were added before AWS assigned a [security group rule unique ID](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/security-group-rules.html), and they do not work well in all scenarios using the`description` and `tags` attributes, which rely on the unique ID. The [`aws_vpc_security_group_egress_rule`](vpc_security_group_egress_rule.html) and [`aws_vpc_security_group_ingress_rule`](vpc_security_group_ingress_rule.html) resources have been added to address these limitations and should be used for all new security group rules. You should not use the `aws_vpc_security_group_egress_rule` and `aws_vpc_security_group_ingress_rule` resources in conjunction with an `aws_security_group` resource with in-line rules or with `aws_security_group_rule` resources defined for the same Security Group, as rule conflicts may occur and rules will be overwritten.
+
+~> **NOTE:** Referencing Security Groups across VPC peering has certain restrictions. More information is available in the [VPC Peering User Guide](https://docs.aws.amazon.com/vpc/latest/peering/vpc-peering-security-groups.html).
+
+~> **NOTE:** Due to [AWS Lambda improved VPC networking changes that began deploying in September 2019](https://aws.amazon.com/blogs/compute/announcing-improved-vpc-networking-for-aws-lambda-functions/), security groups associated with Lambda Functions can take up to 45 minutes to successfully delete. Terraform AWS Provider version 2.31.0 and later automatically handles this increased timeout, however prior versions require setting the [customizable deletion timeout](#timeouts) to 45 minutes (`delete = "45m"`). AWS and HashiCorp are working together to reduce the amount of time required for resource deletion and updates can be tracked in this [GitHub issue](https://github.com/hashicorp/terraform-provider-aws/issues/10329).
+
+~> **NOTE:** The `cidr_blocks` and `ipv6_cidr_blocks` parameters are optional in the `ingress` and `egress` blocks. If nothing is specified, traffic will be blocked as described in _NOTE on Egress rules_ later.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.security_group import SecurityGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SecurityGroup(self, "allow_tls",
+            description="Allow TLS inbound traffic",
+            egress=[SecurityGroupEgress(
+                cidr_blocks=["0.0.0.0/0"],
+                from_port=0,
+                ipv6_cidr_blocks=["::/0"],
+                protocol="-1",
+                to_port=0
+            )
+            ],
+            ingress=[SecurityGroupIngress(
+                cidr_blocks=[main.cidr_block],
+                description="TLS from VPC",
+                from_port=443,
+                ipv6_cidr_blocks=[main.ipv6_cidr_block],
+                protocol="tcp",
+                to_port=443
+            )
+            ],
+            name="allow_tls",
+            tags={
+                "Name": "allow_tls"
+            },
+            vpc_id=main.id
+        )
+```
+
+~> **NOTE on Egress rules:** By default, AWS creates an `ALLOW ALL` egress rule when creating a new Security Group inside of a VPC. When creating a new Security Group inside a VPC, **Terraform will remove this default rule**, and require you specifically re-create it if you desire that rule. We feel this leads to fewer surprises in terms of controlling your egress rules. If you desire this rule to be in place, you can use this `egress` block:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.security_group import SecurityGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SecurityGroup(self, "example",
+            egress=[SecurityGroupEgress(
+                cidr_blocks=["0.0.0.0/0"],
+                from_port=0,
+                ipv6_cidr_blocks=["::/0"],
+                protocol="-1",
+                to_port=0
+            )
+            ]
+        )
+```
+
+### Usage With Prefix List IDs
+
+Prefix Lists are either managed by AWS internally, or created by the customer using a
+[Prefix List resource](ec2_managed_prefix_list.html). Prefix Lists provided by
+AWS are associated with a prefix list name, or service name, that is linked to a specific region.
+Prefix list IDs are exported on VPC Endpoints, so you can use this format:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.security_group import SecurityGroup
+from imports.aws.vpc_endpoint import VpcEndpoint
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, serviceName, vpcId):
+        super().__init__(scope, name)
+        my_endpoint = VpcEndpoint(self, "my_endpoint",
+            service_name=service_name,
+            vpc_id=vpc_id
+        )
+        SecurityGroup(self, "example",
+            egress=[SecurityGroupEgress(
+                from_port=0,
+                prefix_list_ids=[my_endpoint.prefix_list_id],
+                protocol="-1",
+                to_port=0
+            )
+            ]
+        )
+```
+
+You can also find a specific Prefix List using the `aws_prefix_list` data source.
+
+### Removing All Ingress and Egress Rules
+
+The `ingress` and `egress` arguments are processed in [attributes-as-blocks](https://developer.hashicorp.com/terraform/language/attr-as-blocks) mode. Due to this, removing these arguments from the configuration will **not** cause Terraform to destroy the managed rules. To subsequently remove all managed ingress and egress rules:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.security_group import SecurityGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SecurityGroup(self, "example",
+            egress=[],
+            ingress=[],
+            name="sg",
+            vpc_id=Token.as_string(aws_vpc_example.id)
+        )
+```
+
+### Recreating a Security Group
+
+A simple security group `name` change "forces new" the security group--Terraform destroys the security group and creates a new one. (Likewise, `description`, `name_prefix`, or `vpc_id` [cannot be changed](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/working-with-security-groups.html#creating-security-group).) Attempting to recreate the security group leads to a variety of complications depending on how it is used.
+
+Security groups are generally associated with other resources--**more than 100** AWS Provider resources reference security groups. Referencing a resource from another resource creates a one-way dependency. For example, if you create an EC2 `aws_instance` that has a `vpc_security_group_ids` argument that refers to an `aws_security_group` resource, the `aws_security_group` is a dependent of the `aws_instance`. Because of this, Terraform will create the security group first so that it can then be associated with the EC2 instance.
+
+However, the dependency relationship actually goes both directions causing the _Security Group Deletion Problem_. AWS does not allow you to delete the security group associated with another resource (_e.g._, the `aws_instance`).
+
+Terraform does [not model bi-directional dependencies](https://developer.hashicorp.com/terraform/internals/graph) like this, but, even if it did, simply knowing the dependency situation would not be enough to solve it. For example, some resources must always have an associated security group while others don't need to. In addition, when the `aws_security_group` resource attempts to recreate, it receives a dependent object error, which does not provide information on whether the dependent object is a security group rule or, for example, an associated EC2 instance. Within Terraform, the associated resource (_e.g._, `aws_instance`) does not receive an error when the `aws_security_group` is trying to recreate even though that is where changes to the associated resource would need to take place (_e.g._, removing the security group association).
+
+Despite these sticky problems, below are some ways to improve your experience when you find it necessary to recreate a security group.
+
+#### `create_before_destroy`
+
+(This example is one approach to [recreating security groups](#recreating-a-security-group). For more information on the challenges and the _Security Group Deletion Problem_, see [the section above](#recreating-a-security-group).)
+
+Normally, Terraform first deletes the existing security group resource and then creates a new one. When a security group is associated with a resource, the delete won't succeed. You can invert the default behavior using the [`create_before_destroy` meta argument](https://www.terraform.io/language/meta-arguments/lifecycle#create_before_destroy):
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from cdktf import TerraformResourceLifecycle
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.security_group import SecurityGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SecurityGroup(self, "example",
+            lifecycle=TerraformResourceLifecycle(
+                create_before_destroy=True
+            ),
+            name="changeable-name"
+        )
+```
+
+#### `replace_triggered_by`
+
+(This example is one approach to [recreating security groups](#recreating-a-security-group). For more information on the challenges and the _Security Group Deletion Problem_, see [the section above](#recreating-a-security-group).)
+
+To replace a resource when a security group changes, use the [`replace_triggered_by` meta argument](https://www.terraform.io/language/meta-arguments/lifecycle#replace_triggered_by). Note that in this example, the `aws_instance` will be destroyed and created again when the `aws_security_group` changes.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from cdktf import TerraformResourceLifecycle
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.instance import Instance
+from imports.aws.security_group import SecurityGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = SecurityGroup(self, "example",
+            name="sg"
+        )
+        aws_instance_example = Instance(self, "example_1",
+            instance_type="t3.small",
+            lifecycle=TerraformResourceLifecycle(
+                replace_triggered_by=[example]
+            ),
+            vpc_security_group_ids=[test.id]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_instance_example.override_logical_id("example")
+```
+
+#### Shorter timeout
+
+(This example is one approach to [recreating security groups](#recreating-a-security-group). For more information on the challenges and the _Security Group Deletion Problem_, see [the section above](#recreating-a-security-group).)
+
+If destroying a security group takes a long time, it may be because Terraform cannot distinguish between a dependent object (_e.g._, a security group rule or EC2 instance) that is _in the process of being deleted_ and one that is not. In other words, it may be waiting for a train that isn't scheduled to arrive. To fail faster, shorten the `delete` [timeout](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts) from the default timeout:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.security_group import SecurityGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SecurityGroup(self, "example",
+            name="izizavle",
+            timeouts=[{
+                "delete": "2m"
+            }
+            ]
+        )
+```
+
+#### Provisioners
+
+(This example is one approach to [recreating security groups](#recreating-a-security-group). For more information on the challenges and the _Security Group Deletion Problem_, see [the section above](#recreating-a-security-group).)
+
+**DISCLAIMER:** We **_HIGHLY_** recommend using one of the above approaches and _NOT_ using local provisioners. Provisioners, like the one shown below, should be considered a **last resort** since they are _not readable_, _require skills outside standard Terraform configuration_, are _error prone_ and _difficult to maintain_, are not compatible with cloud environments and upgrade tools, require AWS CLI installation, and are subject to AWS CLI and Terraform changes outside the AWS Provider.
+
+```terraform
+data "aws_security_group" "default" {
+  name = "default"
+  # ... other configuration ...
+}
+
+resource "aws_security_group" "example" {
+  name = "sg"
+  # ... other configuration ...
+
+  # The downstream resource must have at least one SG attached, therefore we
+  # attach the default SG of the VPC temporarily and remove it later on
+  provisioner "local-exec" {
+    when       = destroy
+    command    = <<DOC
+            ENDPOINT_ID=`aws ec2 describe-vpc-endpoints --filters "Name=tag:Name,Values=${self.tags.workaround1}" --query "VpcEndpoints[0].VpcEndpointId" --output text` &&
+            aws ec2 modify-vpc-endpoint --vpc-endpoint-id $${ENDPOINT_ID} --add-security-group-ids ${self.tags.workaround2} --remove-security-group-ids ${self.id}
+        DOC
+    on_failure = continue
+  }
+
+  tags = {
+    workaround1 = "tagged-name"
+    workaround2 = data.aws_security_group.default.id
+  }
+}
+
+resource "null_resource" "example" {
+  provisioner "local-exec" {
+    command    = <<DOC
+            aws ec2 modify-vpc-endpoint --vpc-endpoint-id ${aws_vpc_endpoint.example.id} --remove-security-group-ids ${data.aws_security_group.default.id}
+        DOC
+    on_failure = continue
+  }
+
+  triggers = {
+    rerun_upon_change_of = join(",", aws_vpc_endpoint.example.security_group_ids)
+  }
+}
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `description` - (Optional, Forces new resource) Security group description. Defaults to `Managed by Terraform`. Cannot be `""`. **NOTE**: This field maps to the AWS `GroupDescription` attribute, for which there is no Update API. If you'd like to classify your security groups in a way that can be updated, use `tags`.
+* `egress` - (Optional, VPC only) Configuration block for egress rules. Can be specified multiple times for each egress rule. Each egress block supports fields documented below. This argument is processed in [attribute-as-blocks mode](https://www.terraform.io/docs/configuration/attr-as-blocks.html).
+* `ingress` - (Optional) Configuration block for ingress rules. Can be specified multiple times for each ingress rule. Each ingress block supports fields documented below. This argument is processed in [attribute-as-blocks mode](https://www.terraform.io/docs/configuration/attr-as-blocks.html).
+* `name_prefix` - (Optional, Forces new resource) Creates a unique name beginning with the specified prefix. Conflicts with `name`.
+* `name` - (Optional, Forces new resource) Name of the security group. If omitted, Terraform will assign a random, unique name.
+* `revoke_rules_on_delete` - (Optional) Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. This is normally not needed, however certain AWS services such as Elastic Map Reduce may automatically add required rules to security groups used with the service, and those rules may contain a cyclic dependency that prevent the security groups from being destroyed without removing the dependency first. Default `false`.
+* `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `vpc_id` - (Optional, Forces new resource) VPC ID. Defaults to the region's default VPC.
+
+### ingress
+
+This argument is processed in [attribute-as-blocks mode](https://www.terraform.io/docs/configuration/attr-as-blocks.html).
+
+The following arguments are required:
+
+* `from_port` - (Required) Start port (or ICMP type number if protocol is `icmp` or `icmpv6`).
+* `to_port` - (Required) End range port (or ICMP code if protocol is `icmp`).
+* `protocol` - (Required) Protocol. If you select a protocol of `-1` (semantically equivalent to `all`, which is not a valid value here), you must specify a `from_port` and `to_port` equal to 0.  The supported values are defined in the `IpProtocol` argument on the [IpPermission](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_IpPermission.html) API reference. This argument is normalized to a lowercase value to match the AWS API requirement when using with Terraform 0.12.x and above, please make sure that the value of the protocol is specified as lowercase when using with older version of Terraform to avoid an issue during upgrade.
+
+The following arguments are optional:
+
+~> **Note** Although `cidr_blocks`, `ipv6_cidr_blocks`, `prefix_list_ids`, and `security_groups` are all marked as optional, you _must_ provide one of them in order to configure the source of the traffic.
+
+* `cidr_blocks` - (Optional) List of CIDR blocks.
+* `description` - (Optional) Description of this ingress rule.
+* `ipv6_cidr_blocks` - (Optional) List of IPv6 CIDR blocks.
+* `prefix_list_ids` - (Optional) List of Prefix List IDs.
+* `security_groups` - (Optional) List of security groups. A group name can be used relative to the default VPC. Otherwise, group ID.
+* `self` - (Optional) Whether the security group itself will be added as a source to this ingress rule.
+
+### egress
+
+This argument is processed in [attribute-as-blocks mode](https://www.terraform.io/docs/configuration/attr-as-blocks.html).
+
+The following arguments are required:
+
+* `from_port` - (Required) Start port (or ICMP type number if protocol is `icmp`)
+* `to_port` - (Required) End range port (or ICMP code if protocol is `icmp`).
+
+The following arguments are optional:
+
+~> **Note** Although `cidr_blocks`, `ipv6_cidr_blocks`, `prefix_list_ids`, and `security_groups` are all marked as optional, you _must_ provide one of them in order to configure the destination of the traffic.
+
+* `cidr_blocks` - (Optional) List of CIDR blocks.
+* `description` - (Optional) Description of this egress rule.
+* `ipv6_cidr_blocks` - (Optional) List of IPv6 CIDR blocks.
+* `prefix_list_ids` - (Optional) List of Prefix List IDs.
+* `protocol` - (Required) Protocol. If you select a protocol of `-1` (semantically equivalent to `all`, which is not a valid value here), you must specify a `from_port` and `to_port` equal to 0.  The supported values are defined in the `IpProtocol` argument in the [IpPermission](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_IpPermission.html) API reference. This argument is normalized to a lowercase value to match the AWS API requirement when using Terraform 0.12.x and above. Please make sure that the value of the protocol is specified as lowercase when used with older version of Terraform to avoid issues during upgrade.
+* `security_groups` - (Optional) List of security groups. A group name can be used relative to the default VPC. Otherwise, group ID.
+* `self` - (Optional) Whether the security group itself will be added as a source to this egress rule.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the security group.
+* `id` - ID of the security group.
+* `owner_id` - Owner ID.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `10m`)
+- `delete` - (Default `15m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Security Groups using the security group `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Security Groups using the security group `id`. For example:
+
+```console
+% terraform import aws_security_group.elb_sg sg-903004f8
+```
+
+<!-- cache-key: cdktf-0.18.0 input-6bcc9835f16447ac7bb124f5ed74bb0497f70dd790dd17824e05e55e14536c7a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/security_group_rule.html.markdown b/website/docs/cdktf/python/r/security_group_rule.html.markdown
new file mode 100644
index 00000000000..3ecb8bffe99
--- /dev/null
+++ b/website/docs/cdktf/python/r/security_group_rule.html.markdown
@@ -0,0 +1,283 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_security_group_rule"
+description: |-
+  Provides an security group rule resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_security_group_rule
+
+Provides a security group rule resource. Represents a single `ingress` or
+`egress` group rule, which can be added to external Security Groups.
+
+~> **NOTE on Security Groups and Security Group Rules:** Terraform currently provides a [Security Group resource](security_group.html) with `ingress` and `egress` rules defined in-line and a Security Group Rule resource which manages one or more `ingress` or
+`egress` rules. Both of these resource were added before AWS assigned a [security group rule unique ID](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/security-group-rules.html), and they do not work well in all scenarios using the`description` and `tags` attributes, which rely on the unique ID.
+The [`aws_vpc_security_group_egress_rule`](vpc_security_group_egress_rule.html) and [`aws_vpc_security_group_ingress_rule`](vpc_security_group_ingress_rule.html) resources have been added to address these limitations and should be used for all new security group rules.
+You should not use the `aws_vpc_security_group_egress_rule` and `aws_vpc_security_group_ingress_rule` resources in conjunction with an `aws_security_group` resource with in-line rules or with `aws_security_group_rule` resources defined for the same Security Group, as rule conflicts may occur and rules will be overwritten.
+
+~> **NOTE:** Setting `protocol = "all"` or `protocol = -1` with `from_port` and `to_port` will result in the EC2 API creating a security group rule with all ports open. This API behavior cannot be controlled by Terraform and may generate warnings in the future.
+
+~> **NOTE:** Referencing Security Groups across VPC peering has certain restrictions. More information is available in the [VPC Peering User Guide](https://docs.aws.amazon.com/vpc/latest/peering/vpc-peering-security-groups.html).
+
+## Example Usage
+
+Basic usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.security_group_rule import SecurityGroupRule
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SecurityGroupRule(self, "example",
+            cidr_blocks=[Token.as_string(aws_vpc_example.cidr_block)],
+            from_port=0,
+            ipv6_cidr_blocks=[Token.as_string(aws_vpc_example.ipv6_cidr_block)],
+            protocol="tcp",
+            security_group_id="sg-123456",
+            to_port=65535,
+            type="ingress"
+        )
+```
+
+### Usage With Prefix List IDs
+
+Prefix Lists are either managed by AWS internally, or created by the customer using a
+[Managed Prefix List resource](ec2_managed_prefix_list.html). Prefix Lists provided by
+AWS are associated with a prefix list name, or service name, that is linked to a specific region.
+
+Prefix list IDs are exported on VPC Endpoints, so you can use this format:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.security_group_rule import SecurityGroupRule
+from imports.aws.vpc_endpoint import VpcEndpoint
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, serviceName, vpcId):
+        super().__init__(scope, name)
+        my_endpoint = VpcEndpoint(self, "my_endpoint",
+            service_name=service_name,
+            vpc_id=vpc_id
+        )
+        SecurityGroupRule(self, "allow_all",
+            from_port=0,
+            prefix_list_ids=[my_endpoint.prefix_list_id],
+            protocol="-1",
+            security_group_id="sg-123456",
+            to_port=0,
+            type="egress"
+        )
+```
+
+You can also find a specific Prefix List using the [`aws_prefix_list`](/docs/providers/aws/d/prefix_list.html)
+or [`ec2_managed_prefix_list`](/docs/providers/aws/d/ec2_managed_prefix_list.html) data sources:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_prefix_list import DataAwsPrefixList
+from imports.aws.data_aws_region import DataAwsRegion
+from imports.aws.security_group_rule import SecurityGroupRule
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        current = DataAwsRegion(self, "current")
+        s3 = DataAwsPrefixList(self, "s3",
+            name="com.amazonaws.${" + current.name + "}.s3"
+        )
+        SecurityGroupRule(self, "s3_gateway_egress",
+            description="S3 Gateway Egress",
+            from_port=443,
+            prefix_list_ids=[Token.as_string(s3.id)],
+            protocol="tcp",
+            security_group_id="sg-123456",
+            to_port=443,
+            type="egress"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `from_port` - (Required) Start port (or ICMP type number if protocol is "icmp" or "icmpv6").
+* `protocol` - (Required) Protocol. If not icmp, icmpv6, tcp, udp, or all use the [protocol number](https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml)
+* `security_group_id` - (Required) Security group to apply this rule to.
+* `to_port` - (Required) End port (or ICMP code if protocol is "icmp").
+* `type` - (Required) Type of rule being created. Valid options are `ingress` (inbound)
+or `egress` (outbound).
+
+The following arguments are optional:
+
+~> **Note** Although `cidr_blocks`, `ipv6_cidr_blocks`, `prefix_list_ids`, and `source_security_group_id` are all marked as optional, you _must_ provide one of them in order to configure the source of the traffic.
+
+* `cidr_blocks` - (Optional) List of CIDR blocks. Cannot be specified with `source_security_group_id` or `self`.
+* `description` - (Optional) Description of the rule.
+* `ipv6_cidr_blocks` - (Optional) List of IPv6 CIDR blocks. Cannot be specified with `source_security_group_id` or `self`.
+* `prefix_list_ids` - (Optional) List of Prefix List IDs.
+* `self` - (Optional) Whether the security group itself will be added as a source to this ingress rule. Cannot be specified with `cidr_blocks`, `ipv6_cidr_blocks`, or `source_security_group_id`.
+* `source_security_group_id` - (Optional) Security group id to allow access to/from, depending on the `type`. Cannot be specified with `cidr_blocks`, `ipv6_cidr_blocks`, or `self`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the security group rule.
+* `security_group_rule_id` - If the `aws_security_group_rule` resource has a single source or destination then this is the AWS Security Group Rule resource ID. Otherwise it is empty.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `5m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Security Group Rules using the `security_group_id`, `type`, `protocol`, `from_port`, `to_port`, and source(s)/destination(s) (such as a `cidr_block`) separated by underscores (`_`). All parts are required. For example:
+
+**NOTE:** Not all rule permissions (e.g., not all of a rule's CIDR blocks) need to be imported for Terraform to manage rule permissions. However, importing some of a rule's permissions but not others, and then making changes to the rule will result in the creation of an additional rule to capture the updated permissions. Rule permissions that were not imported are left intact in the original rule.
+
+Import an ingress rule in security group `sg-6e616f6d69` for TCP port 8000 with an IPv4 destination CIDR of `10.0.3.0/24`:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Import a rule with various IPv4 and IPv6 source CIDR blocks:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Import a rule, applicable to all ports, with a protocol other than TCP/UDP/ICMP/ICMPV6/ALL, e.g., Multicast Transport Protocol (MTP), using the IANA protocol number. For example: 92.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Import a default any/any egress rule to 0.0.0.0/0:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Import an egress rule with a prefix list ID destination:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Import a rule applicable to all protocols and ports with a security group source:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Import a rule that has itself and an IPv6 CIDR block as sources:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+**Using `terraform import` to import** Security Group Rules using the `security_group_id`, `type`, `protocol`, `from_port`, `to_port`, and source(s)/destination(s) (such as a `cidr_block`) separated by underscores (`_`). All parts are required. For example:
+
+**NOTE:** Not all rule permissions (e.g., not all of a rule's CIDR blocks) need to be imported for Terraform to manage rule permissions. However, importing some of a rule's permissions but not others, and then making changes to the rule will result in the creation of an additional rule to capture the updated permissions. Rule permissions that were not imported are left intact in the original rule.
+
+Import an ingress rule in security group `sg-6e616f6d69` for TCP port 8000 with an IPv4 destination CIDR of `10.0.3.0/24`:
+
+```console
+% terraform import aws_security_group_rule.ingress sg-6e616f6d69_ingress_tcp_8000_8000_10.0.3.0/24
+```
+
+Import a rule with various IPv4 and IPv6 source CIDR blocks:
+
+```console
+% terraform import aws_security_group_rule.ingress sg-4973616163_ingress_tcp_100_121_10.1.0.0/16_2001:db8::/48_10.2.0.0/16_2002:db8::/48
+```
+
+Import a rule, applicable to all ports, with a protocol other than TCP/UDP/ICMP/ICMPV6/ALL, e.g., Multicast Transport Protocol (MTP), using the IANA protocol number. For example: 92.
+
+```console
+% terraform import aws_security_group_rule.ingress sg-6777656e646f6c796e_ingress_92_0_65536_10.0.3.0/24_10.0.4.0/24
+```
+
+Import a default any/any egress rule to 0.0.0.0/0:
+
+```console
+% terraform import aws_security_group_rule.default_egress sg-6777656e646f6c796e_egress_all_0_0_0.0.0.0/0
+```
+
+Import an egress rule with a prefix list ID destination:
+
+```console
+% terraform import aws_security_group_rule.egress sg-62726f6479_egress_tcp_8000_8000_pl-6469726b
+```
+
+Import a rule applicable to all protocols and ports with a security group source:
+
+```console
+% terraform import aws_security_group_rule.ingress_rule sg-7472697374616e_ingress_all_0_65536_sg-6176657279
+```
+
+Import a rule that has itself and an IPv6 CIDR block as sources:
+
+```console
+% terraform import aws_security_group_rule.rule_name sg-656c65616e6f72_ingress_tcp_80_80_self_2001:db8::/48
+```
+
+<!-- cache-key: cdktf-0.18.0 input-db0dbf623f1a56f51f8c29803443104e878f48f4aaaba90059e21bccd58f7112 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/securityhub_account.html.markdown b/website/docs/cdktf/python/r/securityhub_account.html.markdown
new file mode 100644
index 00000000000..67aee769f8b
--- /dev/null
+++ b/website/docs/cdktf/python/r/securityhub_account.html.markdown
@@ -0,0 +1,66 @@
+---
+subcategory: "Security Hub"
+layout: "aws"
+page_title: "AWS: aws_securityhub_account"
+description: |-
+  Enables Security Hub for an AWS account.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_securityhub_account
+
+Enables Security Hub for this AWS account.
+
+~> **NOTE:** Destroying this resource will disable Security Hub for this AWS account.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.securityhub_account import SecurityhubAccount
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SecurityhubAccount(self, "example")
+```
+
+## Argument Reference
+
+* `enable_default_standards` - (Optional) Whether to enable the security standards that Security Hub has designated as automatically enabled including: ` AWS Foundational Security Best Practices v1.0.0` and `CIS AWS Foundations Benchmark v1.2.0`. Defaults to `true`.
+* `control_finding_generator` - (Optional) Updates whether the calling account has consolidated control findings turned on. If the value for this field is set to `SECURITY_CONTROL`, Security Hub generates a single finding for a control check even when the check applies to multiple enabled standards. If the value for this field is set to `STANDARD_CONTROL`, Security Hub generates separate findings for a control check when the check applies to multiple enabled standards. For accounts that are part of an organization, this value can only be updated in the administrator account.
+* `auto_enable_controls` - (Optional) Whether to automatically enable new controls when they are added to standards that are enabled. By default, this is set to true, and new controls are enabled automatically. To not automatically enable new controls, set this to false.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - AWS Account ID.
+* `arn` - ARN of the SecurityHub Hub created in the account.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import an existing Security Hub enabled account using the AWS account ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import an existing Security Hub enabled account using the AWS account ID. For example:
+
+```console
+% terraform import aws_securityhub_account.example 123456789012
+```
+
+<!-- cache-key: cdktf-0.18.0 input-3c29f6fa3b1da1b294f8e57fd126a24487344bdb5307bd88d0e5c955b64f2338 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/securityhub_account.markdown b/website/docs/cdktf/python/r/securityhub_account.markdown
new file mode 100644
index 00000000000..67aee769f8b
--- /dev/null
+++ b/website/docs/cdktf/python/r/securityhub_account.markdown
@@ -0,0 +1,66 @@
+---
+subcategory: "Security Hub"
+layout: "aws"
+page_title: "AWS: aws_securityhub_account"
+description: |-
+  Enables Security Hub for an AWS account.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_securityhub_account
+
+Enables Security Hub for this AWS account.
+
+~> **NOTE:** Destroying this resource will disable Security Hub for this AWS account.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.securityhub_account import SecurityhubAccount
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SecurityhubAccount(self, "example")
+```
+
+## Argument Reference
+
+* `enable_default_standards` - (Optional) Whether to enable the security standards that Security Hub has designated as automatically enabled including: ` AWS Foundational Security Best Practices v1.0.0` and `CIS AWS Foundations Benchmark v1.2.0`. Defaults to `true`.
+* `control_finding_generator` - (Optional) Updates whether the calling account has consolidated control findings turned on. If the value for this field is set to `SECURITY_CONTROL`, Security Hub generates a single finding for a control check even when the check applies to multiple enabled standards. If the value for this field is set to `STANDARD_CONTROL`, Security Hub generates separate findings for a control check when the check applies to multiple enabled standards. For accounts that are part of an organization, this value can only be updated in the administrator account.
+* `auto_enable_controls` - (Optional) Whether to automatically enable new controls when they are added to standards that are enabled. By default, this is set to true, and new controls are enabled automatically. To not automatically enable new controls, set this to false.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - AWS Account ID.
+* `arn` - ARN of the SecurityHub Hub created in the account.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import an existing Security Hub enabled account using the AWS account ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import an existing Security Hub enabled account using the AWS account ID. For example:
+
+```console
+% terraform import aws_securityhub_account.example 123456789012
+```
+
+<!-- cache-key: cdktf-0.18.0 input-3c29f6fa3b1da1b294f8e57fd126a24487344bdb5307bd88d0e5c955b64f2338 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/securityhub_action_target.html.markdown b/website/docs/cdktf/python/r/securityhub_action_target.html.markdown
new file mode 100644
index 00000000000..c1eebc55c05
--- /dev/null
+++ b/website/docs/cdktf/python/r/securityhub_action_target.html.markdown
@@ -0,0 +1,74 @@
+---
+subcategory: "Security Hub"
+layout: "aws"
+page_title: "AWS: aws_securityhub_action_target"
+description: |-
+  Creates Security Hub custom action.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_securityhub_action_target
+
+Creates Security Hub custom action.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.securityhub_account import SecurityhubAccount
+from imports.aws.securityhub_action_target import SecurityhubActionTarget
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = SecurityhubAccount(self, "example")
+        aws_securityhub_action_target_example = SecurityhubActionTarget(self, "example_1",
+            depends_on=[example],
+            description="This is custom action sends selected findings to chat",
+            identifier="SendToChat",
+            name="Send notification to chat"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_securityhub_action_target_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The description for the custom action target.
+* `identifier` - (Required) The ID for the custom action target.
+* `description` - (Required) The name of the custom action target.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the Security Hub custom action target.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Security Hub custom action using the action target ARN. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Security Hub custom action using the action target ARN. For example:
+
+```console
+% terraform import aws_securityhub_action_target.example arn:aws:securityhub:eu-west-1:312940875350:action/custom/a
+```
+
+<!-- cache-key: cdktf-0.18.0 input-f331888c82c7ef74de6bccfde47e4f271fbed25da322bc1a1b5a3647406b7908 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/securityhub_finding_aggregator.html.markdown b/website/docs/cdktf/python/r/securityhub_finding_aggregator.html.markdown
new file mode 100644
index 00000000000..d99d66bc1b7
--- /dev/null
+++ b/website/docs/cdktf/python/r/securityhub_finding_aggregator.html.markdown
@@ -0,0 +1,132 @@
+---
+subcategory: "Security Hub"
+layout: "aws"
+page_title: "AWS: aws_securityhub_finding_aggregator"
+description: |-
+  Manages a Security Hub finding aggregator
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_securityhub_finding_aggregator
+
+Manages a Security Hub finding aggregator. Security Hub needs to be enabled in a region in order for the aggregator to pull through findings.
+
+## Example Usage
+
+### All Regions Usage
+
+The following example will enable the aggregator for every region.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.securityhub_account import SecurityhubAccount
+from imports.aws.securityhub_finding_aggregator import SecurityhubFindingAggregator
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = SecurityhubAccount(self, "example")
+        aws_securityhub_finding_aggregator_example =
+        SecurityhubFindingAggregator(self, "example_1",
+            depends_on=[example],
+            linking_mode="ALL_REGIONS"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_securityhub_finding_aggregator_example.override_logical_id("example")
+```
+
+### All Regions Except Specified Regions Usage
+
+The following example will enable the aggregator for every region except those specified in `specified_regions`.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.securityhub_account import SecurityhubAccount
+from imports.aws.securityhub_finding_aggregator import SecurityhubFindingAggregator
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = SecurityhubAccount(self, "example")
+        aws_securityhub_finding_aggregator_example =
+        SecurityhubFindingAggregator(self, "example_1",
+            depends_on=[example],
+            linking_mode="ALL_REGIONS_EXCEPT_SPECIFIED",
+            specified_regions=["eu-west-1", "eu-west-2"]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_securityhub_finding_aggregator_example.override_logical_id("example")
+```
+
+### Specified Regions Usage
+
+The following example will enable the aggregator for every region specified in `specified_regions`.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.securityhub_account import SecurityhubAccount
+from imports.aws.securityhub_finding_aggregator import SecurityhubFindingAggregator
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = SecurityhubAccount(self, "example")
+        aws_securityhub_finding_aggregator_example =
+        SecurityhubFindingAggregator(self, "example_1",
+            depends_on=[example],
+            linking_mode="SPECIFIED_REGIONS",
+            specified_regions=["eu-west-1", "eu-west-2"]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_securityhub_finding_aggregator_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+- `linking_mode` - (Required) Indicates whether to aggregate findings from all of the available Regions or from a specified list. The options are `ALL_REGIONS`, `ALL_REGIONS_EXCEPT_SPECIFIED` or `SPECIFIED_REGIONS`. When `ALL_REGIONS` or `ALL_REGIONS_EXCEPT_SPECIFIED` are used, Security Hub will automatically aggregate findings from new Regions as Security Hub supports them and you opt into them.
+- `specified_regions` - (Optional) List of regions to include or exclude (required if `linking_mode` is set to `ALL_REGIONS_EXCEPT_SPECIFIED` or `SPECIFIED_REGIONS`)
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+- `arn` - Amazon Resource Name (ARN) of the Security Hub finding aggregator.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import an existing Security Hub finding aggregator using the `arn`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import an existing Security Hub finding aggregator using the `arn`. For example:
+
+```console
+% terraform import aws_securityhub_finding_aggregator.example arn:aws:securityhub:eu-west-1:123456789098:finding-aggregator/abcd1234-abcd-1234-1234-abcdef123456
+```
+
+<!-- cache-key: cdktf-0.18.0 input-b0a0cef9ae9a2e4ba102b890bdf1e0083eb9b71a497b601f823d3d520dd935aa -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/securityhub_finding_aggregator.markdown b/website/docs/cdktf/python/r/securityhub_finding_aggregator.markdown
new file mode 100644
index 00000000000..d99d66bc1b7
--- /dev/null
+++ b/website/docs/cdktf/python/r/securityhub_finding_aggregator.markdown
@@ -0,0 +1,132 @@
+---
+subcategory: "Security Hub"
+layout: "aws"
+page_title: "AWS: aws_securityhub_finding_aggregator"
+description: |-
+  Manages a Security Hub finding aggregator
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_securityhub_finding_aggregator
+
+Manages a Security Hub finding aggregator. Security Hub needs to be enabled in a region in order for the aggregator to pull through findings.
+
+## Example Usage
+
+### All Regions Usage
+
+The following example will enable the aggregator for every region.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.securityhub_account import SecurityhubAccount
+from imports.aws.securityhub_finding_aggregator import SecurityhubFindingAggregator
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = SecurityhubAccount(self, "example")
+        aws_securityhub_finding_aggregator_example =
+        SecurityhubFindingAggregator(self, "example_1",
+            depends_on=[example],
+            linking_mode="ALL_REGIONS"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_securityhub_finding_aggregator_example.override_logical_id("example")
+```
+
+### All Regions Except Specified Regions Usage
+
+The following example will enable the aggregator for every region except those specified in `specified_regions`.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.securityhub_account import SecurityhubAccount
+from imports.aws.securityhub_finding_aggregator import SecurityhubFindingAggregator
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = SecurityhubAccount(self, "example")
+        aws_securityhub_finding_aggregator_example =
+        SecurityhubFindingAggregator(self, "example_1",
+            depends_on=[example],
+            linking_mode="ALL_REGIONS_EXCEPT_SPECIFIED",
+            specified_regions=["eu-west-1", "eu-west-2"]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_securityhub_finding_aggregator_example.override_logical_id("example")
+```
+
+### Specified Regions Usage
+
+The following example will enable the aggregator for every region specified in `specified_regions`.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.securityhub_account import SecurityhubAccount
+from imports.aws.securityhub_finding_aggregator import SecurityhubFindingAggregator
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = SecurityhubAccount(self, "example")
+        aws_securityhub_finding_aggregator_example =
+        SecurityhubFindingAggregator(self, "example_1",
+            depends_on=[example],
+            linking_mode="SPECIFIED_REGIONS",
+            specified_regions=["eu-west-1", "eu-west-2"]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_securityhub_finding_aggregator_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+- `linking_mode` - (Required) Indicates whether to aggregate findings from all of the available Regions or from a specified list. The options are `ALL_REGIONS`, `ALL_REGIONS_EXCEPT_SPECIFIED` or `SPECIFIED_REGIONS`. When `ALL_REGIONS` or `ALL_REGIONS_EXCEPT_SPECIFIED` are used, Security Hub will automatically aggregate findings from new Regions as Security Hub supports them and you opt into them.
+- `specified_regions` - (Optional) List of regions to include or exclude (required if `linking_mode` is set to `ALL_REGIONS_EXCEPT_SPECIFIED` or `SPECIFIED_REGIONS`)
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+- `arn` - Amazon Resource Name (ARN) of the Security Hub finding aggregator.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import an existing Security Hub finding aggregator using the `arn`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import an existing Security Hub finding aggregator using the `arn`. For example:
+
+```console
+% terraform import aws_securityhub_finding_aggregator.example arn:aws:securityhub:eu-west-1:123456789098:finding-aggregator/abcd1234-abcd-1234-1234-abcdef123456
+```
+
+<!-- cache-key: cdktf-0.18.0 input-b0a0cef9ae9a2e4ba102b890bdf1e0083eb9b71a497b601f823d3d520dd935aa -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/securityhub_insight.html.markdown b/website/docs/cdktf/python/r/securityhub_insight.html.markdown
new file mode 100644
index 00000000000..e484fedb0e3
--- /dev/null
+++ b/website/docs/cdktf/python/r/securityhub_insight.html.markdown
@@ -0,0 +1,369 @@
+---
+subcategory: "Security Hub"
+layout: "aws"
+page_title: "AWS: aws_securityhub_insight"
+description: |-
+  Provides a Security Hub custom insight resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_securityhub_insight
+
+Provides a Security Hub custom insight resource. See the [Managing custom insights section](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-custom-insights.html) of the AWS User Guide for more information.
+
+## Example Usage
+
+### Filter by AWS account ID
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.securityhub_account import SecurityhubAccount
+from imports.aws.securityhub_insight import SecurityhubInsight
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = SecurityhubAccount(self, "example")
+        aws_securityhub_insight_example = SecurityhubInsight(self, "example_1",
+            depends_on=[example],
+            filters=SecurityhubInsightFilters(
+                aws_account_id=[SecurityhubInsightFiltersAwsAccountId(
+                    comparison="EQUALS",
+                    value="1234567890"
+                ), SecurityhubInsightFiltersAwsAccountId(
+                    comparison="EQUALS",
+                    value="09876543210"
+                )
+                ]
+            ),
+            group_by_attribute="AwsAccountId",
+            name="example-insight"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_securityhub_insight_example.override_logical_id("example")
+```
+
+### Filter by date range
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.securityhub_account import SecurityhubAccount
+from imports.aws.securityhub_insight import SecurityhubInsight
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = SecurityhubAccount(self, "example")
+        aws_securityhub_insight_example = SecurityhubInsight(self, "example_1",
+            depends_on=[example],
+            filters=SecurityhubInsightFilters(
+                created_at=[SecurityhubInsightFiltersCreatedAt(
+                    date_range=SecurityhubInsightFiltersCreatedAtDateRange(
+                        unit="DAYS",
+                        value=5
+                    )
+                )
+                ]
+            ),
+            group_by_attribute="CreatedAt",
+            name="example-insight"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_securityhub_insight_example.override_logical_id("example")
+```
+
+### Filter by destination IPv4 address
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.securityhub_account import SecurityhubAccount
+from imports.aws.securityhub_insight import SecurityhubInsight
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = SecurityhubAccount(self, "example")
+        aws_securityhub_insight_example = SecurityhubInsight(self, "example_1",
+            depends_on=[example],
+            filters=SecurityhubInsightFilters(
+                network_destination_ipv4=[SecurityhubInsightFiltersNetworkDestinationIpv4(
+                    cidr="10.0.0.0/16"
+                )
+                ]
+            ),
+            group_by_attribute="NetworkDestinationIpV4",
+            name="example-insight"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_securityhub_insight_example.override_logical_id("example")
+```
+
+### Filter by finding's confidence
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.securityhub_account import SecurityhubAccount
+from imports.aws.securityhub_insight import SecurityhubInsight
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = SecurityhubAccount(self, "example")
+        aws_securityhub_insight_example = SecurityhubInsight(self, "example_1",
+            depends_on=[example],
+            filters=SecurityhubInsightFilters(
+                confidence=[SecurityhubInsightFiltersConfidence(
+                    gte="80"
+                )
+                ]
+            ),
+            group_by_attribute="Confidence",
+            name="example-insight"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_securityhub_insight_example.override_logical_id("example")
+```
+
+### Filter by resource tags
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.securityhub_account import SecurityhubAccount
+from imports.aws.securityhub_insight import SecurityhubInsight
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = SecurityhubAccount(self, "example")
+        aws_securityhub_insight_example = SecurityhubInsight(self, "example_1",
+            depends_on=[example],
+            filters=SecurityhubInsightFilters(
+                resource_tags=[SecurityhubInsightFiltersResourceTags(
+                    comparison="EQUALS",
+                    key="Environment",
+                    value="Production"
+                )
+                ]
+            ),
+            group_by_attribute="ResourceTags",
+            name="example-insight"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_securityhub_insight_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `filters` - (Required) A configuration block including one or more (up to 10 distinct) attributes used to filter the findings included in the insight. The insight only includes findings that match criteria defined in the filters. See [filters](#filters) below for more details.
+* `group_by_attribute` - (Required) The attribute used to group the findings for the insight e.g., if an insight is grouped by `ResourceId`, then the insight produces a list of resource identifiers.
+* `name` - (Required) The name of the custom insight.
+
+### filters
+
+The `filters` configuration block supports the following arguments:
+
+~> **NOTE:** For each argument below, up to 20 can be provided.
+
+* `aws_account_id` - (Optional) AWS account ID that a finding is generated in. See [String_Filter](#string-filter-argument-reference) below for more details.
+* `company_name` - (Optional) The name of the findings provider (company) that owns the solution (product) that generates findings. See [String_Filter](#string-filter-argument-reference) below for more details.
+* `compliance_status` - (Optional) Exclusive to findings that are generated as the result of a check run against a specific rule in a supported standard, such as CIS AWS Foundations. Contains security standard-related finding details. See [String Filter](#string-filter-argument-reference) below for more details.
+* `confidence` - (Optional) A finding's confidence. Confidence is defined as the likelihood that a finding accurately identifies the behavior or issue that it was intended to identify. Confidence is scored on a 0-100 basis using a ratio scale, where 0 means zero percent confidence and 100 means 100 percent confidence. See [Number Filter](#number-filter-argument-reference) below for more details.
+* `created_at` - (Optional) An ISO8601-formatted timestamp that indicates when the security-findings provider captured the potential security issue that a finding captured. See [Date Filter](#date-filter-argument-reference) below for more details.
+* `criticality` - (Optional) The level of importance assigned to the resources associated with the finding. A score of 0 means that the underlying resources have no criticality, and a score of 100 is reserved for the most critical resources. See [Number Filter](#number-filter-argument-reference) below for more details.
+* `description` - (Optional) A finding's description. See [String Filter](#string-filter-argument-reference) below for more details.
+* `finding_provider_fields_confidence` - (Optional) The finding provider value for the finding confidence. Confidence is defined as the likelihood that a finding accurately identifies the behavior or issue that it was intended to identify. Confidence is scored on a 0-100 basis using a ratio scale, where 0 means zero percent confidence and 100 means 100 percent confidence. See [Number Filter](#number-filter-argument-reference) below for more details.
+* `finding_provider_fields_criticality` - (Optional) The finding provider value for the level of importance assigned to the resources associated with the findings. A score of 0 means that the underlying resources have no criticality, and a score of 100 is reserved for the most critical resources. See [Number Filter](#number-filter-argument-reference) below for more details.
+* `finding_provider_fields_related_findings_id` - (Optional) The finding identifier of a related finding that is identified by the finding provider. See [String Filter](#string-filter-argument-reference) below for more details.
+* `finding_provider_fields_related_findings_product_arn` - (Optional) The ARN of the solution that generated a related finding that is identified by the finding provider. See [String Filter](#string-filter-argument-reference) below for more details.
+* `finding_provider_fields_severity_label` - (Optional) The finding provider value for the severity label. See [String Filter](#string-filter-argument-reference) below for more details.
+* `finding_provider_fields_severity_original` - (Optional) The finding provider's original value for the severity. See [String Filter](#string-filter-argument-reference) below for more details.
+* `finding_provider_fields_types` - (Optional) One or more finding types that the finding provider assigned to the finding. Uses the format of `namespace/category/classifier` that classify a finding. Valid namespace values include: `Software and Configuration Checks`, `TTPs`, `Effects`, `Unusual Behaviors`, and `Sensitive Data Identifications`. See [String Filter](#string-filter-argument-reference) below for more details.
+* `first_observed_at` - (Optional) An ISO8601-formatted timestamp that indicates when the security-findings provider first observed the potential security issue that a finding captured. See [Date Filter](#date-filter-argument-reference) below for more details.
+* `generator_id` - (Optional) The identifier for the solution-specific component (a discrete unit of logic) that generated a finding. See [String Filter](#string-filter-argument-reference) below for more details.
+* `id` - (Optional) The security findings provider-specific identifier for a finding. See [String Filter](#string-filter-argument-reference) below for more details.
+* `keyword` - (Optional) A keyword for a finding. See [Keyword Filter](#keyword-filter-argument-reference) below for more details.
+* `last_observed_at` - (Optional) An ISO8601-formatted timestamp that indicates when the security-findings provider most recently observed the potential security issue that a finding captured. See [Date Filter](#date-filter-argument-reference) below for more details.
+* `malware_name` - (Optional) The name of the malware that was observed. See [String Filter](#string-filter-argument-reference) below for more details.
+* `malware_path` - (Optional) The filesystem path of the malware that was observed. See [String Filter](#string-filter-argument-reference) below for more details.
+* `malware_state` - (Optional) The state of the malware that was observed. See [String Filter](#string-filter-argument-reference) below for more details.
+* `malware_type` - (Optional) The type of the malware that was observed. See [String Filter](#string-filter-argument-reference) below for more details.
+* `network_destination_domain` - (Optional) The destination domain of network-related information about a finding. See [String Filter](#string-filter-argument-reference) below for more details.
+* `network_destination_ipv4` - (Optional) The destination IPv4 address of network-related information about a finding. See [Ip Filter](#ip-filter-argument-reference) below for more details.
+* `network_destination_ipv6` - (Optional) The destination IPv6 address of network-related information about a finding. See [Ip Filter](#ip-filter-argument-reference) below for more details.
+* `network_destination_port` - (Optional) The destination port of network-related information about a finding. See [Number Filter](#number-filter-argument-reference) below for more details.
+* `network_direction` - (Optional) Indicates the direction of network traffic associated with a finding. See [String Filter](#string-filter-argument-reference) below for more details.
+* `network_protocol` - (Optional) The protocol of network-related information about a finding. See [String Filter](#string-filter-argument-reference) below for more details.
+* `network_source_domain` - (Optional) The source domain of network-related information about a finding. See [String Filter](#string-filter-argument-reference) below for more details.
+* `network_source_ipv4` - (Optional) The source IPv4 address of network-related information about a finding. See [Ip Filter](#ip-filter-argument-reference) below for more details.
+* `network_source_ipv6` - (Optional) The source IPv6 address of network-related information about a finding. See [Ip Filter](#ip-filter-argument-reference) below for more details.
+* `network_source_mac` - (Optional) The source media access control (MAC) address of network-related information about a finding. See [String Filter](#string-filter-argument-reference) below for more details.
+* `network_source_port` - (Optional) The source port of network-related information about a finding. See [Number Filter](#number-filter-argument-reference) below for more details.
+* `note_text` - (Optional) The text of a note. See [String Filter](#string-filter-argument-reference) below for more details.
+* `note_updated_at` - (Optional) The timestamp of when the note was updated. See [Date Filter](#date-filter-argument-reference) below for more details.
+* `note_updated_by` - (Optional) The principal that created a note. See [String Filter](#string-filter-argument-reference) below for more details.
+* `process_launched_at` - (Optional) The date/time that the process was launched. See [Date Filter](#date-filter-argument-reference) below for more details.
+* `process_name` - (Optional) The name of the process. See [String Filter](#string-filter-argument-reference) below for more details.
+* `process_parent_pid` - (Optional) The parent process ID. See [Number Filter](#number-filter-argument-reference) below for more details.
+* `process_path` - (Optional) The path to the process executable. See [String Filter](#string-filter-argument-reference) below for more details.
+* `process_pid` - (Optional) The process ID. See [Number Filter](#number-filter-argument-reference) below for more details.
+* `process_terminated_at` - (Optional) The date/time that the process was terminated. See [Date Filter](#date-filter-argument-reference) below for more details.
+* `product_arn` - (Optional) The ARN generated by Security Hub that uniquely identifies a third-party company (security findings provider) after this provider's product (solution that generates findings) is registered with Security Hub. See [String Filter](#string-filter-argument-reference) below for more details.
+* `product_fields` - (Optional) A data type where security-findings providers can include additional solution-specific details that aren't part of the defined `AwsSecurityFinding` format. See [Map Filter](#map-filter-argument-reference) below for more details.
+* `product_name` - (Optional) The name of the solution (product) that generates findings. See [String Filter](#string-filter-argument-reference) below for more details.
+* `recommendation_text` - (Optional) The recommendation of what to do about the issue described in a finding. See [String Filter](#string-filter-argument-reference) below for more details.
+* `record_state` - (Optional) The updated record state for the finding. See [String Filter](#string-filter-argument-reference) below for more details.
+* `related_findings_id` - (Optional) The solution-generated identifier for a related finding. See [String Filter](#string-filter-argument-reference) below for more details.
+* `related_findings_product_arn` - (Optional) The ARN of the solution that generated a related finding. See [String Filter](#string-filter-argument-reference) below for more details.
+* `resource_aws_ec2_instance_iam_instance_profile_arn` - (Optional) The IAM profile ARN of the instance. See [String Filter](#string-filter-argument-reference) below for more details.
+* `resource_aws_ec2_instance_image_id` - (Optional) The Amazon Machine Image (AMI) ID of the instance. See [String Filter](#string-filter-argument-reference) below for more details.
+* `resource_aws_ec2_instance_ipv4_addresses` - (Optional) The IPv4 addresses associated with the instance. See [Ip Filter](#ip-filter-argument-reference) below for more details.
+* `resource_aws_ec2_instance_ipv6_addresses` - (Optional) The IPv6 addresses associated with the instance. See [Ip Filter](#ip-filter-argument-reference) below for more details.
+* `resource_aws_ec2_instance_key_name` - (Optional) The key name associated with the instance. See [String Filter](#string-filter-argument-reference) below for more details.
+* `resource_aws_ec2_instance_launched_at` - (Optional) The date and time the instance was launched. See [Date Filter](#date-filter-argument-reference) below for more details.
+* `resource_aws_ec2_instance_subnet_id` - (Optional) The identifier of the subnet that the instance was launched in. See [String Filter](#string-filter-argument-reference) below for more details.
+* `resource_aws_ec2_instance_type` - (Optional) The instance type of the instance. See [String Filter](#string-filter-argument-reference) below for more details.
+* `resource_aws_ec2_instance_vpc_id` - (Optional) The identifier of the VPC that the instance was launched in. See [String Filter](#string-filter-argument-reference) below for more details.
+* `resource_aws_iam_access_key_created_at` - (Optional) The creation date/time of the IAM access key related to a finding. See [Date Filter](#date-filter-argument-reference) below for more details.
+* `resource_aws_iam_access_key_status` - (Optional) The status of the IAM access key related to a finding. See [String Filter](#string-filter-argument-reference) below for more details.
+* `resource_aws_iam_access_key_user_name` - (Optional) The user associated with the IAM access key related to a finding. See [String Filter](#string-filter-argument-reference) below for more details.
+* `resource_aws_s3_bucket_owner_id` - (Optional) The canonical user ID of the owner of the S3 bucket. See [String Filter](#string-filter-argument-reference) below for more details.
+* `resource_aws_s3_bucket_owner_name` - (Optional) The display name of the owner of the S3 bucket. See [String Filter](#string-filter-argument-reference) below for more details.
+* `resource_container_image_id` - (Optional) The identifier of the image related to a finding. See [String Filter](#string-filter-argument-reference) below for more details.
+* `resource_container_image_name` - (Optional) The name of the image related to a finding. See [String Filter](#string-filter-argument-reference) below for more details.
+* `resource_container_launched_at` - (Optional) The date/time that the container was started. See [Date Filter](#date-filter-argument-reference) below for more details.
+* `resource_container_name` - (Optional) The name of the container related to a finding. See [String Filter](#string-filter-argument-reference) below for more details.
+* `resource_details_other` - (Optional) The details of a resource that doesn't have a specific subfield for the resource type defined. See [Map Filter](#map-filter-argument-reference) below for more details.
+* `resource_id` - (Optional) The canonical identifier for the given resource type. See [String Filter](#string-filter-argument-reference) below for more details.
+* `resource_partition` - (Optional) The canonical AWS partition name that the Region is assigned to. See [String Filter](#string-filter-argument-reference) below for more details.
+* `resource_region` - (Optional) The canonical AWS external Region name where this resource is located. See [String Filter](#string-filter-argument-reference) below for more details.
+* `resource_tags` - (Optional) A list of AWS tags associated with a resource at the time the finding was processed. See [Map Filter](#map-filter-argument-reference) below for more details.
+* `resource_type` - (Optional) Specifies the type of the resource that details are provided for. See [String Filter](#string-filter-argument-reference) below for more details.
+* `severity_label` - (Optional) The label of a finding's severity. See [String Filter](#string-filter-argument-reference) below for more details.
+* `source_url` - (Optional) A URL that links to a page about the current finding in the security-findings provider's solution. See [String Filter](#string-filter-argument-reference) below for more details.
+* `threat_intel_indicator_category` - (Optional) The category of a threat intelligence indicator. See [String Filter](#string-filter-argument-reference) below for more details.
+* `threat_intel_indicator_last_observed_at` - (Optional) The date/time of the last observation of a threat intelligence indicator. See [Date Filter](#date-filter-argument-reference) below for more details.
+* `threat_intel_indicator_source` - (Optional) The source of the threat intelligence. See [String Filter](#string-filter-argument-reference) below for more details.
+* `threat_intel_indicator_source_url` - (Optional) The URL for more details from the source of the threat intelligence. See [String Filter](#string-filter-argument-reference) below for more details.
+* `threat_intel_indicator_type` - (Optional) The type of a threat intelligence indicator. See [String Filter](#string-filter-argument-reference) below for more details.
+* `threat_intel_indicator_value` - (Optional) The value of a threat intelligence indicator. See [String Filter](#string-filter-argument-reference) below for more details.
+* `title` - (Optional) A finding's title. See [String Filter](#string-filter-argument-reference) below for more details.
+* `type` - (Optional) A finding type in the format of `namespace/category/classifier` that classifies a finding. See [String Filter](#string-filter-argument-reference) below for more details.
+* `updated_at` - (Optional) An ISO8601-formatted timestamp that indicates when the security-findings provider last updated the finding record. See [Date Filter](#date-filter-argument-reference) below for more details.
+* `user_defined_values` - (Optional) A list of name/value string pairs associated with the finding. These are custom, user-defined fields added to a finding. See [Map Filter](#map-filter-argument-reference) below for more details.
+* `verification_state` - (Optional) The veracity of a finding. See [String Filter](#string-filter-argument-reference) below for more details.
+* `workflow_status` - (Optional) The status of the investigation into a finding. See [Workflow Status Filter](#workflow-status-filter-argument-reference) below for more details.
+
+### Date Filter Argument reference
+
+The date filter configuration block supports the following arguments:
+
+* `date_range` - (Optional) A configuration block of the date range for the date filter. See [date_range](#date_range-argument-reference) below for more details.
+* `end` - (Optional) An end date for the date filter. Required with `start` if `date_range` is not specified.
+* `start` - (Optional) A start date for the date filter. Required with `end` if `date_range` is not specified.
+
+### date_range Argument reference
+
+The `date_range` configuration block supports the following arguments:
+
+* `unit` - (Required) A date range unit for the date filter. Valid values: `DAYS`.
+* `value` - (Required) A date range value for the date filter, provided as an Integer.
+
+### Ip Filter Argument Reference
+
+The Ip filter configuration block supports the following arguments:
+
+* `cidr` - (Required) A finding's CIDR value.
+
+### Keyword Filter Argument Reference
+
+The keyword filter configuration block supports the following arguments:
+
+* `value` - (Required) A value for the keyword.
+
+### Map Filter Argument reference
+
+The map filter configuration block supports the following arguments:
+
+* `comparison` - (Required) The condition to apply to a string value when querying for findings. Valid values include: `EQUALS` and `NOT_EQUALS`.
+* `key` - (Required) The key of the map filter. For example, for `ResourceTags`, `Key` identifies the name of the tag. For `UserDefinedFields`, `Key` is the name of the field.
+* `value` - (Required) The value for the key in the map filter. Filter values are case sensitive. For example, one of the values for a tag called `Department` might be `Security`. If you provide `security` as the filter value, then there is no match.
+
+### Number Filter Argument reference
+
+The number filter configuration block supports the following arguments:
+
+~> **NOTE:** Only one of `eg`, `gte`, or `lte` must be specified.
+
+* `eq` - (Optional) The equal-to condition to be applied to a single field when querying for findings, provided as a String.
+* `gte` - (Optional) The greater-than-equal condition to be applied to a single field when querying for findings, provided as a String.
+* `lte` - (Optional) The less-than-equal condition to be applied to a single field when querying for findings, provided as a String.
+
+### String Filter Argument reference
+
+The string filter configuration block supports the following arguments:
+
+* `comparison` - (Required) The condition to apply to a string value when querying for findings. Valid values include: `EQUALS`, `PREFIX`, `NOT_EQUALS`, `PREFIX_NOT_EQUALS`.
+* `value` - (Required) The string filter value. Filter values are case sensitive.
+
+### Workflow Status Filter Argument reference
+
+The workflow status filter configuration block supports the following arguments:
+
+* `comparison` - (Required) The condition to apply to a string value when querying for findings. Valid values include: `EQUALS`, `PREFIX`, `NOT_EQUALS`, `PREFIX_NOT_EQUALS`.
+* `value` - (Required) The string filter value. Valid values include: `NEW`, `NOTIFIED`, `SUPPRESSED`, and `RESOLVED`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - ARN of the insight.
+* `arn` - ARN of the insight.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Security Hub insights using the ARN. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Security Hub insights using the ARN. For example:
+
+```console
+% terraform import aws_securityhub_insight.example arn:aws:securityhub:us-west-2:1234567890:insight/1234567890/custom/91299ed7-abd0-4e44-a858-d0b15e37141a
+```
+
+<!-- cache-key: cdktf-0.18.0 input-d3d847819c495e43242ec5ec238846c5d4424861a5d61bc30612afcfd23a2887 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/securityhub_invite_accepter.html.markdown b/website/docs/cdktf/python/r/securityhub_invite_accepter.html.markdown
new file mode 100644
index 00000000000..6094f11faf4
--- /dev/null
+++ b/website/docs/cdktf/python/r/securityhub_invite_accepter.html.markdown
@@ -0,0 +1,84 @@
+---
+subcategory: "Security Hub"
+layout: "aws"
+page_title: "AWS: aws_securityhub_invite_accepter"
+description: |-
+  Accepts a Security Hub invitation.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_securityhub_invite_accepter
+
+-> **Note:** AWS accounts can only be associated with a single Security Hub master account. Destroying this resource will disassociate the member account from the master account.
+
+Accepts a Security Hub invitation.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.securityhub_account import SecurityhubAccount
+from imports.aws.securityhub_invite_accepter import SecurityhubInviteAccepter
+from imports.aws.securityhub_member import SecurityhubMember
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SecurityhubAccount(self, "example")
+        invitee = SecurityhubAccount(self, "invitee",
+            provider="aws.invitee"
+        )
+        aws_securityhub_member_example = SecurityhubMember(self, "example_2",
+            account_id="123456789012",
+            email="example@example.com",
+            invite=True
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_securityhub_member_example.override_logical_id("example")
+        aws_securityhub_invite_accepter_invitee = SecurityhubInviteAccepter(self, "invitee_3",
+            depends_on=[invitee],
+            master_id=Token.as_string(aws_securityhub_member_example.master_id),
+            provider="aws.invitee"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_securityhub_invite_accepter_invitee.override_logical_id("invitee")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `master_id` - (Required) The account ID of the master Security Hub account whose invitation you're accepting.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `invitation_id` - The ID of the invitation.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Security Hub invite acceptance using the account ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Security Hub invite acceptance using the account ID. For example:
+
+```console
+% terraform import aws_securityhub_invite_accepter.example 123456789012
+```
+
+<!-- cache-key: cdktf-0.18.0 input-47799ffb1b46661d89c8c190f8ee1ae51146d3c40022d01eb9ce32bcbbe707ae -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/securityhub_invite_accepter.markdown b/website/docs/cdktf/python/r/securityhub_invite_accepter.markdown
new file mode 100644
index 00000000000..6094f11faf4
--- /dev/null
+++ b/website/docs/cdktf/python/r/securityhub_invite_accepter.markdown
@@ -0,0 +1,84 @@
+---
+subcategory: "Security Hub"
+layout: "aws"
+page_title: "AWS: aws_securityhub_invite_accepter"
+description: |-
+  Accepts a Security Hub invitation.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_securityhub_invite_accepter
+
+-> **Note:** AWS accounts can only be associated with a single Security Hub master account. Destroying this resource will disassociate the member account from the master account.
+
+Accepts a Security Hub invitation.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.securityhub_account import SecurityhubAccount
+from imports.aws.securityhub_invite_accepter import SecurityhubInviteAccepter
+from imports.aws.securityhub_member import SecurityhubMember
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SecurityhubAccount(self, "example")
+        invitee = SecurityhubAccount(self, "invitee",
+            provider="aws.invitee"
+        )
+        aws_securityhub_member_example = SecurityhubMember(self, "example_2",
+            account_id="123456789012",
+            email="example@example.com",
+            invite=True
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_securityhub_member_example.override_logical_id("example")
+        aws_securityhub_invite_accepter_invitee = SecurityhubInviteAccepter(self, "invitee_3",
+            depends_on=[invitee],
+            master_id=Token.as_string(aws_securityhub_member_example.master_id),
+            provider="aws.invitee"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_securityhub_invite_accepter_invitee.override_logical_id("invitee")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `master_id` - (Required) The account ID of the master Security Hub account whose invitation you're accepting.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `invitation_id` - The ID of the invitation.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Security Hub invite acceptance using the account ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Security Hub invite acceptance using the account ID. For example:
+
+```console
+% terraform import aws_securityhub_invite_accepter.example 123456789012
+```
+
+<!-- cache-key: cdktf-0.18.0 input-47799ffb1b46661d89c8c190f8ee1ae51146d3c40022d01eb9ce32bcbbe707ae -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/securityhub_member.html.markdown b/website/docs/cdktf/python/r/securityhub_member.html.markdown
new file mode 100644
index 00000000000..ac297ab9771
--- /dev/null
+++ b/website/docs/cdktf/python/r/securityhub_member.html.markdown
@@ -0,0 +1,76 @@
+---
+subcategory: "Security Hub"
+layout: "aws"
+page_title: "AWS: aws_securityhub_member"
+description: |-
+  Provides a Security Hub member resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_securityhub_member
+
+Provides a Security Hub member resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.securityhub_account import SecurityhubAccount
+from imports.aws.securityhub_member import SecurityhubMember
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = SecurityhubAccount(self, "example")
+        aws_securityhub_member_example = SecurityhubMember(self, "example_1",
+            account_id="123456789012",
+            depends_on=[example],
+            email="example@example.com",
+            invite=True
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_securityhub_member_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `account_id` - (Required) The ID of the member AWS account.
+* `email` - (Optional) The email of the member AWS account.
+* `invite` - (Optional) Boolean whether to invite the account to Security Hub as a member. Defaults to `false`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the member AWS account (matches `account_id`).
+* `master_id` - The ID of the master Security Hub AWS account.
+* `member_status` - The status of the member account relationship.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Security Hub members using their account ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Security Hub members using their account ID. For example:
+
+```console
+% terraform import aws_securityhub_member.example 123456789012
+```
+
+<!-- cache-key: cdktf-0.18.0 input-b2f811f0ff3e2bff9fde29d7ad1d4c2d9fa7578b2c00bebd2e51ff8635a9fa1c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/securityhub_member.markdown b/website/docs/cdktf/python/r/securityhub_member.markdown
new file mode 100644
index 00000000000..ac297ab9771
--- /dev/null
+++ b/website/docs/cdktf/python/r/securityhub_member.markdown
@@ -0,0 +1,76 @@
+---
+subcategory: "Security Hub"
+layout: "aws"
+page_title: "AWS: aws_securityhub_member"
+description: |-
+  Provides a Security Hub member resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_securityhub_member
+
+Provides a Security Hub member resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.securityhub_account import SecurityhubAccount
+from imports.aws.securityhub_member import SecurityhubMember
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = SecurityhubAccount(self, "example")
+        aws_securityhub_member_example = SecurityhubMember(self, "example_1",
+            account_id="123456789012",
+            depends_on=[example],
+            email="example@example.com",
+            invite=True
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_securityhub_member_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `account_id` - (Required) The ID of the member AWS account.
+* `email` - (Optional) The email of the member AWS account.
+* `invite` - (Optional) Boolean whether to invite the account to Security Hub as a member. Defaults to `false`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the member AWS account (matches `account_id`).
+* `master_id` - The ID of the master Security Hub AWS account.
+* `member_status` - The status of the member account relationship.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Security Hub members using their account ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Security Hub members using their account ID. For example:
+
+```console
+% terraform import aws_securityhub_member.example 123456789012
+```
+
+<!-- cache-key: cdktf-0.18.0 input-b2f811f0ff3e2bff9fde29d7ad1d4c2d9fa7578b2c00bebd2e51ff8635a9fa1c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/securityhub_organization_admin_account.html.markdown b/website/docs/cdktf/python/r/securityhub_organization_admin_account.html.markdown
new file mode 100644
index 00000000000..dbb85f3b43d
--- /dev/null
+++ b/website/docs/cdktf/python/r/securityhub_organization_admin_account.html.markdown
@@ -0,0 +1,85 @@
+---
+subcategory: "Security Hub"
+layout: "aws"
+page_title: "AWS: aws_securityhub_organization_admin_account"
+description: |-
+  Manages a Security Hub administrator account for an organization.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_securityhub_organization_admin_account
+
+Manages a Security Hub administrator account for an organization. The AWS account utilizing this resource must be an Organizations primary account. More information about Organizations support in Security Hub can be found in the [Security Hub User Guide](https://docs.aws.amazon.com/securityhub/latest/userguide/designate-orgs-admin-account.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.organizations_organization import OrganizationsOrganization
+from imports.aws.securityhub_account import SecurityhubAccount
+from imports.aws.securityhub_organization_admin_account import SecurityhubOrganizationAdminAccount
+from imports.aws.securityhub_organization_configuration import SecurityhubOrganizationConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = OrganizationsOrganization(self, "example",
+            aws_service_access_principals=["securityhub.amazonaws.com"],
+            feature_set="ALL"
+        )
+        aws_securityhub_account_example = SecurityhubAccount(self, "example_1")
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_securityhub_account_example.override_logical_id("example")
+        aws_securityhub_organization_admin_account_example =
+        SecurityhubOrganizationAdminAccount(self, "example_2",
+            admin_account_id="123456789012",
+            depends_on=[example]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_securityhub_organization_admin_account_example.override_logical_id("example")
+        aws_securityhub_organization_configuration_example =
+        SecurityhubOrganizationConfiguration(self, "example_3",
+            auto_enable=True
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_securityhub_organization_configuration_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `admin_account_id` - (Required) The AWS account identifier of the account to designate as the Security Hub administrator account.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - AWS account identifier.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Security Hub Organization Admin Accounts using the AWS account ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Security Hub Organization Admin Accounts using the AWS account ID. For example:
+
+```console
+% terraform import aws_securityhub_organization_admin_account.example 123456789012
+```
+
+<!-- cache-key: cdktf-0.18.0 input-83f23d6f1c3f73f98991d420d396e1f7a78ea374e63126ce3c3d410cf5917cbd -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/securityhub_organization_configuration.html.markdown b/website/docs/cdktf/python/r/securityhub_organization_configuration.html.markdown
new file mode 100644
index 00000000000..d2bafd8ac8d
--- /dev/null
+++ b/website/docs/cdktf/python/r/securityhub_organization_configuration.html.markdown
@@ -0,0 +1,86 @@
+---
+subcategory: "Security Hub"
+layout: "aws"
+page_title: "AWS: aws_securityhub_organization_configuration"
+description: |-
+  Manages the Security Hub Organization Configuration
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_securityhub_organization_configuration
+
+Manages the Security Hub Organization Configuration.
+
+~> **NOTE:** This resource requires an [`aws_securityhub_organization_admin_account`](/docs/providers/aws/r/securityhub_organization_admin_account.html) to be configured (not necessarily with Terraform). More information about managing Security Hub in an organization can be found in the [Managing administrator and member accounts](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-accounts.html) documentation
+
+~> **NOTE:** This is an advanced Terraform resource. Terraform will automatically assume management of the Security Hub Organization Configuration without import and perform no actions on removal from the Terraform configuration.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.organizations_organization import OrganizationsOrganization
+from imports.aws.securityhub_organization_admin_account import SecurityhubOrganizationAdminAccount
+from imports.aws.securityhub_organization_configuration import SecurityhubOrganizationConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = OrganizationsOrganization(self, "example",
+            aws_service_access_principals=["securityhub.amazonaws.com"],
+            feature_set="ALL"
+        )
+        aws_securityhub_organization_admin_account_example =
+        SecurityhubOrganizationAdminAccount(self, "example_1",
+            admin_account_id="123456789012",
+            depends_on=[example]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_securityhub_organization_admin_account_example.override_logical_id("example")
+        aws_securityhub_organization_configuration_example =
+        SecurityhubOrganizationConfiguration(self, "example_2",
+            auto_enable=True
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_securityhub_organization_configuration_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `auto_enable` - (Required) Whether to automatically enable Security Hub for new accounts in the organization.
+* `auto_enable_standards` - (Optional) Whether to automatically enable Security Hub default standards for new member accounts in the organization. By default, this parameter is equal to `DEFAULT`, and new member accounts are automatically enabled with default Security Hub standards. To opt out of enabling default standards for new member accounts, set this parameter equal to `NONE`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - AWS Account ID.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import an existing Security Hub enabled account using the AWS account ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import an existing Security Hub enabled account using the AWS account ID. For example:
+
+```console
+% terraform import aws_securityhub_organization_configuration.example 123456789012
+```
+
+<!-- cache-key: cdktf-0.18.0 input-5b0a80355870042433f0256e95b1b1ca23a8a89ac8d72a202dca64a9bd9f9132 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/securityhub_organization_configuration.markdown b/website/docs/cdktf/python/r/securityhub_organization_configuration.markdown
new file mode 100644
index 00000000000..d2bafd8ac8d
--- /dev/null
+++ b/website/docs/cdktf/python/r/securityhub_organization_configuration.markdown
@@ -0,0 +1,86 @@
+---
+subcategory: "Security Hub"
+layout: "aws"
+page_title: "AWS: aws_securityhub_organization_configuration"
+description: |-
+  Manages the Security Hub Organization Configuration
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_securityhub_organization_configuration
+
+Manages the Security Hub Organization Configuration.
+
+~> **NOTE:** This resource requires an [`aws_securityhub_organization_admin_account`](/docs/providers/aws/r/securityhub_organization_admin_account.html) to be configured (not necessarily with Terraform). More information about managing Security Hub in an organization can be found in the [Managing administrator and member accounts](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-accounts.html) documentation
+
+~> **NOTE:** This is an advanced Terraform resource. Terraform will automatically assume management of the Security Hub Organization Configuration without import and perform no actions on removal from the Terraform configuration.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.organizations_organization import OrganizationsOrganization
+from imports.aws.securityhub_organization_admin_account import SecurityhubOrganizationAdminAccount
+from imports.aws.securityhub_organization_configuration import SecurityhubOrganizationConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = OrganizationsOrganization(self, "example",
+            aws_service_access_principals=["securityhub.amazonaws.com"],
+            feature_set="ALL"
+        )
+        aws_securityhub_organization_admin_account_example =
+        SecurityhubOrganizationAdminAccount(self, "example_1",
+            admin_account_id="123456789012",
+            depends_on=[example]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_securityhub_organization_admin_account_example.override_logical_id("example")
+        aws_securityhub_organization_configuration_example =
+        SecurityhubOrganizationConfiguration(self, "example_2",
+            auto_enable=True
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_securityhub_organization_configuration_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `auto_enable` - (Required) Whether to automatically enable Security Hub for new accounts in the organization.
+* `auto_enable_standards` - (Optional) Whether to automatically enable Security Hub default standards for new member accounts in the organization. By default, this parameter is equal to `DEFAULT`, and new member accounts are automatically enabled with default Security Hub standards. To opt out of enabling default standards for new member accounts, set this parameter equal to `NONE`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - AWS Account ID.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import an existing Security Hub enabled account using the AWS account ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import an existing Security Hub enabled account using the AWS account ID. For example:
+
+```console
+% terraform import aws_securityhub_organization_configuration.example 123456789012
+```
+
+<!-- cache-key: cdktf-0.18.0 input-5b0a80355870042433f0256e95b1b1ca23a8a89ac8d72a202dca64a9bd9f9132 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/securityhub_product_subscription.html.markdown b/website/docs/cdktf/python/r/securityhub_product_subscription.html.markdown
new file mode 100644
index 00000000000..e7499fcf8f5
--- /dev/null
+++ b/website/docs/cdktf/python/r/securityhub_product_subscription.html.markdown
@@ -0,0 +1,111 @@
+---
+subcategory: "Security Hub"
+layout: "aws"
+page_title: "AWS: aws_securityhub_product_subscription"
+description: |-
+  Subscribes to a Security Hub product.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_securityhub_product_subscription
+
+Subscribes to a Security Hub product.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_region import DataAwsRegion
+from imports.aws.securityhub_account import SecurityhubAccount
+from imports.aws.securityhub_product_subscription import SecurityhubProductSubscription
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = SecurityhubAccount(self, "example")
+        current = DataAwsRegion(self, "current")
+        aws_securityhub_product_subscription_example =
+        SecurityhubProductSubscription(self, "example_2",
+            depends_on=[example],
+            product_arn="arn:aws:securityhub:${" + current.name + "}:733251395267:product/alertlogic/althreatmanagement"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_securityhub_product_subscription_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `product_arn` - (Required) The ARN of the product that generates findings that you want to import into Security Hub - see below.
+
+Amazon maintains a list of [Product integrations in AWS Security Hub](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-findings-providers.html) that changes over time. Any of the products on the linked [Available AWS service integrations](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-internal-providers.html) or [Available third-party partner product integrations](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-partner-providers.html) can be configured using `aws_securityhub_product_subscription`.
+
+Available products can also be listed by running the AWS CLI command `aws securityhub describe-products`.
+
+A subset of currently available products (remember to replace `${var.region}` as appropriate) includes:
+
+* `arn:aws:securityhub:${var.region}::product/aws/guardduty`
+* `arn:aws:securityhub:${var.region}::product/aws/inspector`
+* `arn:aws:securityhub:${var.region}::product/aws/macie`
+* `arn:aws:securityhub:${var.region}::product/alertlogic/althreatmanagement`
+* `arn:aws:securityhub:${var.region}::product/armordefense/armoranywhere`
+* `arn:aws:securityhub:${var.region}::product/barracuda/cloudsecurityguardian`
+* `arn:aws:securityhub:${var.region}::product/checkpoint/cloudguard-iaas`
+* `arn:aws:securityhub:${var.region}::product/checkpoint/dome9-arc`
+* `arn:aws:securityhub:${var.region}::product/crowdstrike/crowdstrike-falcon`
+* `arn:aws:securityhub:${var.region}::product/cyberark/cyberark-pta`
+* `arn:aws:securityhub:${var.region}::product/f5networks/f5-advanced-waf`
+* `arn:aws:securityhub:${var.region}::product/fortinet/fortigate`
+* `arn:aws:securityhub:${var.region}::product/guardicore/aws-infection-monkey`
+* `arn:aws:securityhub:${var.region}::product/guardicore/guardicore`
+* `arn:aws:securityhub:${var.region}::product/ibm/qradar-siem`
+* `arn:aws:securityhub:${var.region}::product/imperva/imperva-attack-analytics`
+* `arn:aws:securityhub:${var.region}::product/mcafee-skyhigh/mcafee-mvision-cloud-aws`
+* `arn:aws:securityhub:${var.region}::product/paloaltonetworks/redlock`
+* `arn:aws:securityhub:${var.region}::product/paloaltonetworks/vm-series`
+* `arn:aws:securityhub:${var.region}::product/qualys/qualys-pc`
+* `arn:aws:securityhub:${var.region}::product/qualys/qualys-vm`
+* `arn:aws:securityhub:${var.region}::product/rapid7/insightvm`
+* `arn:aws:securityhub:${var.region}::product/sophos/sophos-server-protection`
+* `arn:aws:securityhub:${var.region}::product/splunk/splunk-enterprise`
+* `arn:aws:securityhub:${var.region}::product/splunk/splunk-phantom`
+* `arn:aws:securityhub:${var.region}::product/sumologicinc/sumologic-mda`
+* `arn:aws:securityhub:${var.region}::product/symantec-corp/symantec-cwp`
+* `arn:aws:securityhub:${var.region}::product/tenable/tenable-io`
+* `arn:aws:securityhub:${var.region}::product/trend-micro/deep-security`
+* `arn:aws:securityhub:${var.region}::product/turbot/turbot`
+* `arn:aws:securityhub:${var.region}::product/twistlock/twistlock-enterprise`
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of a resource that represents your subscription to the product that generates the findings that you want to import into Security Hub.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Security Hub product subscriptions using `product_arn,arn`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Security Hub product subscriptions using `product_arn,arn`. For example:
+
+```console
+% terraform import aws_securityhub_product_subscription.example arn:aws:securityhub:eu-west-1:733251395267:product/alertlogic/althreatmanagement,arn:aws:securityhub:eu-west-1:123456789012:product-subscription/alertlogic/althreatmanagement
+```
+
+<!-- cache-key: cdktf-0.18.0 input-e197181eaf1cbe693f21b8aefda6622e11891c6a8de2cc04fb6a75cee9693f4c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/securityhub_product_subscription.markdown b/website/docs/cdktf/python/r/securityhub_product_subscription.markdown
new file mode 100644
index 00000000000..e7499fcf8f5
--- /dev/null
+++ b/website/docs/cdktf/python/r/securityhub_product_subscription.markdown
@@ -0,0 +1,111 @@
+---
+subcategory: "Security Hub"
+layout: "aws"
+page_title: "AWS: aws_securityhub_product_subscription"
+description: |-
+  Subscribes to a Security Hub product.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_securityhub_product_subscription
+
+Subscribes to a Security Hub product.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_region import DataAwsRegion
+from imports.aws.securityhub_account import SecurityhubAccount
+from imports.aws.securityhub_product_subscription import SecurityhubProductSubscription
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = SecurityhubAccount(self, "example")
+        current = DataAwsRegion(self, "current")
+        aws_securityhub_product_subscription_example =
+        SecurityhubProductSubscription(self, "example_2",
+            depends_on=[example],
+            product_arn="arn:aws:securityhub:${" + current.name + "}:733251395267:product/alertlogic/althreatmanagement"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_securityhub_product_subscription_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `product_arn` - (Required) The ARN of the product that generates findings that you want to import into Security Hub - see below.
+
+Amazon maintains a list of [Product integrations in AWS Security Hub](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-findings-providers.html) that changes over time. Any of the products on the linked [Available AWS service integrations](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-internal-providers.html) or [Available third-party partner product integrations](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-partner-providers.html) can be configured using `aws_securityhub_product_subscription`.
+
+Available products can also be listed by running the AWS CLI command `aws securityhub describe-products`.
+
+A subset of currently available products (remember to replace `${var.region}` as appropriate) includes:
+
+* `arn:aws:securityhub:${var.region}::product/aws/guardduty`
+* `arn:aws:securityhub:${var.region}::product/aws/inspector`
+* `arn:aws:securityhub:${var.region}::product/aws/macie`
+* `arn:aws:securityhub:${var.region}::product/alertlogic/althreatmanagement`
+* `arn:aws:securityhub:${var.region}::product/armordefense/armoranywhere`
+* `arn:aws:securityhub:${var.region}::product/barracuda/cloudsecurityguardian`
+* `arn:aws:securityhub:${var.region}::product/checkpoint/cloudguard-iaas`
+* `arn:aws:securityhub:${var.region}::product/checkpoint/dome9-arc`
+* `arn:aws:securityhub:${var.region}::product/crowdstrike/crowdstrike-falcon`
+* `arn:aws:securityhub:${var.region}::product/cyberark/cyberark-pta`
+* `arn:aws:securityhub:${var.region}::product/f5networks/f5-advanced-waf`
+* `arn:aws:securityhub:${var.region}::product/fortinet/fortigate`
+* `arn:aws:securityhub:${var.region}::product/guardicore/aws-infection-monkey`
+* `arn:aws:securityhub:${var.region}::product/guardicore/guardicore`
+* `arn:aws:securityhub:${var.region}::product/ibm/qradar-siem`
+* `arn:aws:securityhub:${var.region}::product/imperva/imperva-attack-analytics`
+* `arn:aws:securityhub:${var.region}::product/mcafee-skyhigh/mcafee-mvision-cloud-aws`
+* `arn:aws:securityhub:${var.region}::product/paloaltonetworks/redlock`
+* `arn:aws:securityhub:${var.region}::product/paloaltonetworks/vm-series`
+* `arn:aws:securityhub:${var.region}::product/qualys/qualys-pc`
+* `arn:aws:securityhub:${var.region}::product/qualys/qualys-vm`
+* `arn:aws:securityhub:${var.region}::product/rapid7/insightvm`
+* `arn:aws:securityhub:${var.region}::product/sophos/sophos-server-protection`
+* `arn:aws:securityhub:${var.region}::product/splunk/splunk-enterprise`
+* `arn:aws:securityhub:${var.region}::product/splunk/splunk-phantom`
+* `arn:aws:securityhub:${var.region}::product/sumologicinc/sumologic-mda`
+* `arn:aws:securityhub:${var.region}::product/symantec-corp/symantec-cwp`
+* `arn:aws:securityhub:${var.region}::product/tenable/tenable-io`
+* `arn:aws:securityhub:${var.region}::product/trend-micro/deep-security`
+* `arn:aws:securityhub:${var.region}::product/turbot/turbot`
+* `arn:aws:securityhub:${var.region}::product/twistlock/twistlock-enterprise`
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of a resource that represents your subscription to the product that generates the findings that you want to import into Security Hub.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Security Hub product subscriptions using `product_arn,arn`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Security Hub product subscriptions using `product_arn,arn`. For example:
+
+```console
+% terraform import aws_securityhub_product_subscription.example arn:aws:securityhub:eu-west-1:733251395267:product/alertlogic/althreatmanagement,arn:aws:securityhub:eu-west-1:123456789012:product-subscription/alertlogic/althreatmanagement
+```
+
+<!-- cache-key: cdktf-0.18.0 input-e197181eaf1cbe693f21b8aefda6622e11891c6a8de2cc04fb6a75cee9693f4c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/securityhub_standards_control.html.markdown b/website/docs/cdktf/python/r/securityhub_standards_control.html.markdown
new file mode 100644
index 00000000000..23f74020444
--- /dev/null
+++ b/website/docs/cdktf/python/r/securityhub_standards_control.html.markdown
@@ -0,0 +1,69 @@
+---
+subcategory: "Security Hub"
+layout: "aws"
+page_title: "AWS: aws_securityhub_standards_control"
+description: |-
+  Enable/disable Security Hub standards controls.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_securityhub_standards_control
+
+Disable/enable Security Hub standards control in the current region.
+
+The `aws_securityhub_standards_control` behaves differently from normal resources, in that
+Terraform does not _create_ this resource, but instead "adopts" it
+into management. When you _delete_ this resource configuration, Terraform "abandons" resource as is and just removes it from the state.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.securityhub_account import SecurityhubAccount
+from imports.aws.securityhub_standards_control import SecurityhubStandardsControl
+from imports.aws.securityhub_standards_subscription import SecurityhubStandardsSubscription
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = SecurityhubAccount(self, "example")
+        cis_aws_foundations_benchmark = SecurityhubStandardsSubscription(self, "cis_aws_foundations_benchmark",
+            depends_on=[example],
+            standards_arn="arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0"
+        )
+        SecurityhubStandardsControl(self, "ensure_iam_password_policy_prevents_password_reuse",
+            control_status="DISABLED",
+            depends_on=[cis_aws_foundations_benchmark],
+            disabled_reason="We handle password policies within Okta",
+            standards_control_arn="arn:aws:securityhub:us-east-1:111111111111:control/cis-aws-foundations-benchmark/v/1.2.0/1.10"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `standards_control_arn` - (Required) The standards control ARN. See the AWS documentation for how to list existing controls using [`get-enabled-standards`](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/securityhub/get-enabled-standards.html) and [`describe-standards-controls`](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/securityhub/describe-standards-controls.html).
+* `control_status` – (Required) The control status could be `ENABLED` or `DISABLED`. You have to specify `disabled_reason` argument for `DISABLED` control status.
+* `disabled_reason` – (Optional) A description of the reason why you are disabling a security standard control. If you specify this attribute, `control_status` will be set to `DISABLED` automatically.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The standard control ARN.
+* `control_id` – The identifier of the security standard control.
+* `control_status_updated_at` – The date and time that the status of the security standard control was most recently updated.
+* `description` – The standard control longer description. Provides information about what the control is checking for.
+* `related_requirements` – The list of requirements that are related to this control.
+* `remediation_url` – A link to remediation information for the control in the Security Hub user documentation.
+* `severity_rating` – The severity of findings generated from this security standard control.
+* `title` – The standard control title.
+
+<!-- cache-key: cdktf-0.18.0 input-4f2686dbc145e094fc564010e6dbf6ac103f5be38f045e92ccb633c43bb96b39 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/securityhub_standards_control.markdown b/website/docs/cdktf/python/r/securityhub_standards_control.markdown
new file mode 100644
index 00000000000..23f74020444
--- /dev/null
+++ b/website/docs/cdktf/python/r/securityhub_standards_control.markdown
@@ -0,0 +1,69 @@
+---
+subcategory: "Security Hub"
+layout: "aws"
+page_title: "AWS: aws_securityhub_standards_control"
+description: |-
+  Enable/disable Security Hub standards controls.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_securityhub_standards_control
+
+Disable/enable Security Hub standards control in the current region.
+
+The `aws_securityhub_standards_control` behaves differently from normal resources, in that
+Terraform does not _create_ this resource, but instead "adopts" it
+into management. When you _delete_ this resource configuration, Terraform "abandons" resource as is and just removes it from the state.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.securityhub_account import SecurityhubAccount
+from imports.aws.securityhub_standards_control import SecurityhubStandardsControl
+from imports.aws.securityhub_standards_subscription import SecurityhubStandardsSubscription
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = SecurityhubAccount(self, "example")
+        cis_aws_foundations_benchmark = SecurityhubStandardsSubscription(self, "cis_aws_foundations_benchmark",
+            depends_on=[example],
+            standards_arn="arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0"
+        )
+        SecurityhubStandardsControl(self, "ensure_iam_password_policy_prevents_password_reuse",
+            control_status="DISABLED",
+            depends_on=[cis_aws_foundations_benchmark],
+            disabled_reason="We handle password policies within Okta",
+            standards_control_arn="arn:aws:securityhub:us-east-1:111111111111:control/cis-aws-foundations-benchmark/v/1.2.0/1.10"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `standards_control_arn` - (Required) The standards control ARN. See the AWS documentation for how to list existing controls using [`get-enabled-standards`](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/securityhub/get-enabled-standards.html) and [`describe-standards-controls`](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/securityhub/describe-standards-controls.html).
+* `control_status` – (Required) The control status could be `ENABLED` or `DISABLED`. You have to specify `disabled_reason` argument for `DISABLED` control status.
+* `disabled_reason` – (Optional) A description of the reason why you are disabling a security standard control. If you specify this attribute, `control_status` will be set to `DISABLED` automatically.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The standard control ARN.
+* `control_id` – The identifier of the security standard control.
+* `control_status_updated_at` – The date and time that the status of the security standard control was most recently updated.
+* `description` – The standard control longer description. Provides information about what the control is checking for.
+* `related_requirements` – The list of requirements that are related to this control.
+* `remediation_url` – A link to remediation information for the control in the Security Hub user documentation.
+* `severity_rating` – The severity of findings generated from this security standard control.
+* `title` – The standard control title.
+
+<!-- cache-key: cdktf-0.18.0 input-4f2686dbc145e094fc564010e6dbf6ac103f5be38f045e92ccb633c43bb96b39 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/securityhub_standards_subscription.html.markdown b/website/docs/cdktf/python/r/securityhub_standards_subscription.html.markdown
new file mode 100644
index 00000000000..dab94bdb11b
--- /dev/null
+++ b/website/docs/cdktf/python/r/securityhub_standards_subscription.html.markdown
@@ -0,0 +1,110 @@
+---
+subcategory: "Security Hub"
+layout: "aws"
+page_title: "AWS: aws_securityhub_standards_subscription"
+description: |-
+  Subscribes to a Security Hub standard.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_securityhub_standards_subscription
+
+Subscribes to a Security Hub standard.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_region import DataAwsRegion
+from imports.aws.securityhub_account import SecurityhubAccount
+from imports.aws.securityhub_standards_subscription import SecurityhubStandardsSubscription
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = SecurityhubAccount(self, "example")
+        SecurityhubStandardsSubscription(self, "cis",
+            depends_on=[example],
+            standards_arn="arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0"
+        )
+        current = DataAwsRegion(self, "current")
+        SecurityhubStandardsSubscription(self, "pci_321",
+            depends_on=[example],
+            standards_arn="arn:aws:securityhub:${" + current.name + "}::standards/pci-dss/v/3.2.1"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `standards_arn` - (Required) The ARN of a standard - see below.
+
+Currently available standards (remember to replace `${var.region}` as appropriate):
+
+| Name                                     | ARN                                                                                             |
+|------------------------------------------|-------------------------------------------------------------------------------------------------|
+| AWS Foundational Security Best Practices | `arn:aws:securityhub:${var.region}::standards/aws-foundational-security-best-practices/v/1.0.0` |
+| CIS AWS Foundations Benchmark v1.2.0     | `arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0`                           |
+| CIS AWS Foundations Benchmark v1.4.0     | `arn:aws:securityhub:${var.region}::standards/cis-aws-foundations-benchmark/v/1.4.0`            |
+| NIST SP 800-53 Rev. 5                    | `arn:aws:securityhub:${var.region}::standards/nist-800-53/v/5.0.0`                              |
+| PCI DSS                                  | `arn:aws:securityhub:${var.region}::standards/pci-dss/v/3.2.1`                                  |
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ARN of a resource that represents your subscription to a supported standard.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Security Hub standards subscriptions using the standards subscription ARN. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Security Hub standards subscriptions using the standards subscription ARN. For example:
+
+```console
+% terraform import aws_securityhub_standards_subscription.cis arn:aws:securityhub:eu-west-1:123456789012:subscription/cis-aws-foundations-benchmark/v/1.2.0
+```
+
+```console
+% terraform import aws_securityhub_standards_subscription.pci_321 arn:aws:securityhub:eu-west-1:123456789012:subscription/pci-dss/v/3.2.1
+```
+
+```console
+% terraform import aws_securityhub_standards_subscription.nist_800_53_rev_5 arn:aws:securityhub:eu-west-1:123456789012:subscription/nist-800-53/v/5.0.0
+```
+
+<!-- cache-key: cdktf-0.18.0 input-87f38b34c6cd1e5a8b36b0f50996b817110ec2206abee08341de02841e9f3b5f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/securityhub_standards_subscription.markdown b/website/docs/cdktf/python/r/securityhub_standards_subscription.markdown
new file mode 100644
index 00000000000..dab94bdb11b
--- /dev/null
+++ b/website/docs/cdktf/python/r/securityhub_standards_subscription.markdown
@@ -0,0 +1,110 @@
+---
+subcategory: "Security Hub"
+layout: "aws"
+page_title: "AWS: aws_securityhub_standards_subscription"
+description: |-
+  Subscribes to a Security Hub standard.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_securityhub_standards_subscription
+
+Subscribes to a Security Hub standard.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_region import DataAwsRegion
+from imports.aws.securityhub_account import SecurityhubAccount
+from imports.aws.securityhub_standards_subscription import SecurityhubStandardsSubscription
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = SecurityhubAccount(self, "example")
+        SecurityhubStandardsSubscription(self, "cis",
+            depends_on=[example],
+            standards_arn="arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0"
+        )
+        current = DataAwsRegion(self, "current")
+        SecurityhubStandardsSubscription(self, "pci_321",
+            depends_on=[example],
+            standards_arn="arn:aws:securityhub:${" + current.name + "}::standards/pci-dss/v/3.2.1"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `standards_arn` - (Required) The ARN of a standard - see below.
+
+Currently available standards (remember to replace `${var.region}` as appropriate):
+
+| Name                                     | ARN                                                                                             |
+|------------------------------------------|-------------------------------------------------------------------------------------------------|
+| AWS Foundational Security Best Practices | `arn:aws:securityhub:${var.region}::standards/aws-foundational-security-best-practices/v/1.0.0` |
+| CIS AWS Foundations Benchmark v1.2.0     | `arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0`                           |
+| CIS AWS Foundations Benchmark v1.4.0     | `arn:aws:securityhub:${var.region}::standards/cis-aws-foundations-benchmark/v/1.4.0`            |
+| NIST SP 800-53 Rev. 5                    | `arn:aws:securityhub:${var.region}::standards/nist-800-53/v/5.0.0`                              |
+| PCI DSS                                  | `arn:aws:securityhub:${var.region}::standards/pci-dss/v/3.2.1`                                  |
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ARN of a resource that represents your subscription to a supported standard.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Security Hub standards subscriptions using the standards subscription ARN. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Security Hub standards subscriptions using the standards subscription ARN. For example:
+
+```console
+% terraform import aws_securityhub_standards_subscription.cis arn:aws:securityhub:eu-west-1:123456789012:subscription/cis-aws-foundations-benchmark/v/1.2.0
+```
+
+```console
+% terraform import aws_securityhub_standards_subscription.pci_321 arn:aws:securityhub:eu-west-1:123456789012:subscription/pci-dss/v/3.2.1
+```
+
+```console
+% terraform import aws_securityhub_standards_subscription.nist_800_53_rev_5 arn:aws:securityhub:eu-west-1:123456789012:subscription/nist-800-53/v/5.0.0
+```
+
+<!-- cache-key: cdktf-0.18.0 input-87f38b34c6cd1e5a8b36b0f50996b817110ec2206abee08341de02841e9f3b5f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/serverlessapplicationrepository_cloudformation_stack.html.markdown b/website/docs/cdktf/python/r/serverlessapplicationrepository_cloudformation_stack.html.markdown
new file mode 100644
index 00000000000..98e252cdff9
--- /dev/null
+++ b/website/docs/cdktf/python/r/serverlessapplicationrepository_cloudformation_stack.html.markdown
@@ -0,0 +1,84 @@
+---
+subcategory: "Serverless Application Repository"
+layout: "aws"
+page_title: "AWS: aws_serverlessapplicationrepository_cloudformation_stack"
+description: |-
+  Deploys an Application CloudFormation Stack from the Serverless Application Repository.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_serverlessapplicationrepository_cloudformation_stack
+
+Deploys an Application CloudFormation Stack from the Serverless Application Repository.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_partition import DataAwsPartition
+from imports.aws.data_aws_region import DataAwsRegion
+from imports.aws.serverlessapplicationrepository_cloudformation_stack import ServerlessapplicationrepositoryCloudformationStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        current = DataAwsPartition(self, "current")
+        data_aws_region_current = DataAwsRegion(self, "current_1")
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_region_current.override_logical_id("current")
+        ServerlessapplicationrepositoryCloudformationStack(self, "postgres-rotator",
+            application_id="arn:aws:serverlessrepo:us-east-1:297356227824:applications/SecretsManagerRDSPostgreSQLRotationSingleUser",
+            capabilities=["CAPABILITY_IAM", "CAPABILITY_RESOURCE_POLICY"],
+            name="postgres-rotator",
+            parameters={
+                "endpoint": "secretsmanager.${" + data_aws_region_current.name + "}.${" + current.dns_suffix + "}",
+                "function_name": "func-postgres-rotator"
+            }
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the stack to create. The resource deployed in AWS will be prefixed with `serverlessrepo-`
+* `application_id` - (Required) The ARN of the application from the Serverless Application Repository.
+* `capabilities` - (Required) A list of capabilities. Valid values are `CAPABILITY_IAM`, `CAPABILITY_NAMED_IAM`, `CAPABILITY_RESOURCE_POLICY`, or `CAPABILITY_AUTO_EXPAND`
+* `parameters` - (Optional) A map of Parameter structures that specify input parameters for the stack.
+* `semantic_version` - (Optional) The version of the application to deploy. If not supplied, deploys the latest version.
+* `tags` - (Optional) A list of tags to associate with this stack. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - A unique identifier of the stack.
+* `outputs` - A map of outputs from the stack.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Serverless Application Repository Stack using the CloudFormation Stack name (with or without the `serverlessrepo-` prefix) or the CloudFormation Stack ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Serverless Application Repository Stack using the CloudFormation Stack name (with or without the `serverlessrepo-` prefix) or the CloudFormation Stack ID. For example:
+
+```console
+% terraform import aws_serverlessapplicationrepository_cloudformation_stack.example serverlessrepo-postgres-rotator
+```
+
+<!-- cache-key: cdktf-0.18.0 input-3c56c5981c41da613753a417692699808c2eda591b3a00277762ed97e8d26af7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/service_discovery_http_namespace.html.markdown b/website/docs/cdktf/python/r/service_discovery_http_namespace.html.markdown
new file mode 100644
index 00000000000..a1936c0f2c8
--- /dev/null
+++ b/website/docs/cdktf/python/r/service_discovery_http_namespace.html.markdown
@@ -0,0 +1,69 @@
+---
+subcategory: "Cloud Map"
+layout: "aws"
+page_title: "AWS: aws_service_discovery_http_namespace"
+description: |-
+  Provides a Service Discovery HTTP Namespace resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_service_discovery_http_namespace
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.service_discovery_http_namespace import ServiceDiscoveryHttpNamespace
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ServiceDiscoveryHttpNamespace(self, "example",
+            description="example",
+            name="development"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the http namespace.
+* `description` - (Optional) The description that you specify for the namespace when you create it.
+* `tags` - (Optional) A map of tags to assign to the namespace. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of a namespace.
+* `arn` - The ARN that Amazon Route 53 assigns to the namespace when you create it.
+* `http_name` - The name of an HTTP namespace.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Service Discovery HTTP Namespace using the namespace ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Service Discovery HTTP Namespace using the namespace ID. For example:
+
+```console
+% terraform import aws_service_discovery_http_namespace.example ns-1234567890
+```
+
+<!-- cache-key: cdktf-0.18.0 input-72ee12af572418f0c5d18cd5ae2d5d173e51de9928465723b81dfdbd70c4804b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/service_discovery_instance.html.markdown b/website/docs/cdktf/python/r/service_discovery_instance.html.markdown
new file mode 100644
index 00000000000..ebda5f501ad
--- /dev/null
+++ b/website/docs/cdktf/python/r/service_discovery_instance.html.markdown
@@ -0,0 +1,142 @@
+---
+subcategory: "Cloud Map"
+layout: "aws"
+page_title: "AWS: aws_service_discovery_instance"
+description: |-
+  Provides a Service Discovery Instance resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_service_discovery_instance
+
+Provides a Service Discovery Instance resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.service_discovery_instance import ServiceDiscoveryInstance
+from imports.aws.service_discovery_private_dns_namespace import ServiceDiscoveryPrivateDnsNamespace
+from imports.aws.service_discovery_service import ServiceDiscoveryService
+from imports.aws.vpc import Vpc
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = Vpc(self, "example",
+            cidr_block="10.0.0.0/16",
+            enable_dns_hostnames=True,
+            enable_dns_support=True
+        )
+        aws_service_discovery_private_dns_namespace_example =
+        ServiceDiscoveryPrivateDnsNamespace(self, "example_1",
+            description="example",
+            name="example.terraform.local",
+            vpc=example.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_service_discovery_private_dns_namespace_example.override_logical_id("example")
+        aws_service_discovery_service_example = ServiceDiscoveryService(self, "example_2",
+            dns_config=ServiceDiscoveryServiceDnsConfig(
+                dns_records=[ServiceDiscoveryServiceDnsConfigDnsRecords(
+                    ttl=10,
+                    type="A"
+                )
+                ],
+                namespace_id=Token.as_string(aws_service_discovery_private_dns_namespace_example.id),
+                routing_policy="MULTIVALUE"
+            ),
+            health_check_custom_config=ServiceDiscoveryServiceHealthCheckCustomConfig(
+                failure_threshold=1
+            ),
+            name="example"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_service_discovery_service_example.override_logical_id("example")
+        aws_service_discovery_instance_example = ServiceDiscoveryInstance(self, "example_3",
+            attributes={
+                "AWS_INSTANCE_IPV4": "172.18.0.1",
+                "custom_attribute": "custom"
+            },
+            instance_id="example-instance-id",
+            service_id=Token.as_string(aws_service_discovery_service_example.id)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_service_discovery_instance_example.override_logical_id("example")
+```
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.service_discovery_http_namespace import ServiceDiscoveryHttpNamespace
+from imports.aws.service_discovery_instance import ServiceDiscoveryInstance
+from imports.aws.service_discovery_service import ServiceDiscoveryService
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = ServiceDiscoveryHttpNamespace(self, "example",
+            description="example",
+            name="example.terraform.com"
+        )
+        aws_service_discovery_service_example = ServiceDiscoveryService(self, "example_1",
+            name="example",
+            namespace_id=example.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_service_discovery_service_example.override_logical_id("example")
+        aws_service_discovery_instance_example = ServiceDiscoveryInstance(self, "example_2",
+            attributes={
+                "AWS_EC2_INSTANCE_ID": "i-0abdg374kd892cj6dl"
+            },
+            instance_id="example-instance-id",
+            service_id=Token.as_string(aws_service_discovery_service_example.id)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_service_discovery_instance_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `instance_id` - (Required, ForceNew) The ID of the service instance.
+* `service_id` - (Required, ForceNew) The ID of the service that you want to use to create the instance.
+* `attributes` - (Required) A map contains the attributes of the instance. Check the [doc](https://docs.aws.amazon.com/cloud-map/latest/api/API_RegisterInstance.html#API_RegisterInstance_RequestSyntax) for the supported attributes and syntax.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the instance.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Service Discovery Instance using the service ID and instance ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Service Discovery Instance using the service ID and instance ID. For example:
+
+```console
+% terraform import aws_service_discovery_instance.example 0123456789/i-0123
+```
+
+<!-- cache-key: cdktf-0.18.0 input-81e46074d207df4789822f0bad31c495113362f2fbc8b6456fb894ad88def8b7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/service_discovery_private_dns_namespace.html.markdown b/website/docs/cdktf/python/r/service_discovery_private_dns_namespace.html.markdown
new file mode 100644
index 00000000000..08b5057c6ce
--- /dev/null
+++ b/website/docs/cdktf/python/r/service_discovery_private_dns_namespace.html.markdown
@@ -0,0 +1,80 @@
+---
+subcategory: "Cloud Map"
+layout: "aws"
+page_title: "AWS: aws_service_discovery_private_dns_namespace"
+description: |-
+  Provides a Service Discovery Private DNS Namespace resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_service_discovery_private_dns_namespace
+
+Provides a Service Discovery Private DNS Namespace resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.service_discovery_private_dns_namespace import ServiceDiscoveryPrivateDnsNamespace
+from imports.aws.vpc import Vpc
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = Vpc(self, "example",
+            cidr_block="10.0.0.0/16"
+        )
+        aws_service_discovery_private_dns_namespace_example =
+        ServiceDiscoveryPrivateDnsNamespace(self, "example_1",
+            description="example",
+            name="hoge.example.local",
+            vpc=example.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_service_discovery_private_dns_namespace_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the namespace.
+* `vpc` - (Required) The ID of VPC that you want to associate the namespace with.
+* `description` - (Optional) The description that you specify for the namespace when you create it.
+* `tags` - (Optional) A map of tags to assign to the namespace. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of a namespace.
+* `arn` - The ARN that Amazon Route 53 assigns to the namespace when you create it.
+* `hosted_zone` - The ID for the hosted zone that Amazon Route 53 creates when you create a namespace.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Service Discovery Private DNS Namespace using the namespace ID and VPC ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Service Discovery Private DNS Namespace using the namespace ID and VPC ID. For example:
+
+```console
+% terraform import aws_service_discovery_private_dns_namespace.example 0123456789:vpc-123345
+```
+
+<!-- cache-key: cdktf-0.18.0 input-6f146701ebde1d502a5742b49eee835afec6daf02f5ca55955ff340c638c7c5b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/service_discovery_public_dns_namespace.html.markdown b/website/docs/cdktf/python/r/service_discovery_public_dns_namespace.html.markdown
new file mode 100644
index 00000000000..54565c947f2
--- /dev/null
+++ b/website/docs/cdktf/python/r/service_discovery_public_dns_namespace.html.markdown
@@ -0,0 +1,71 @@
+---
+subcategory: "Cloud Map"
+layout: "aws"
+page_title: "AWS: aws_service_discovery_public_dns_namespace"
+description: |-
+  Provides a Service Discovery Public DNS Namespace resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_service_discovery_public_dns_namespace
+
+Provides a Service Discovery Public DNS Namespace resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.service_discovery_public_dns_namespace import ServiceDiscoveryPublicDnsNamespace
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ServiceDiscoveryPublicDnsNamespace(self, "example",
+            description="example",
+            name="hoge.example.com"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the namespace.
+* `description` - (Optional) The description that you specify for the namespace when you create it.
+* `tags` - (Optional) A map of tags to assign to the namespace. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of a namespace.
+* `arn` - The ARN that Amazon Route 53 assigns to the namespace when you create it.
+* `hosted_zone` - The ID for the hosted zone that Amazon Route 53 creates when you create a namespace.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Service Discovery Public DNS Namespace using the namespace ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Service Discovery Public DNS Namespace using the namespace ID. For example:
+
+```console
+% terraform import aws_service_discovery_public_dns_namespace.example 0123456789
+```
+
+<!-- cache-key: cdktf-0.18.0 input-3f12246f59ce121e0bff5235dbb078efa0ee1d1e73f30312abd5b446e223694a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/service_discovery_service.html.markdown b/website/docs/cdktf/python/r/service_discovery_service.html.markdown
new file mode 100644
index 00000000000..3be54b0688e
--- /dev/null
+++ b/website/docs/cdktf/python/r/service_discovery_service.html.markdown
@@ -0,0 +1,170 @@
+---
+subcategory: "Cloud Map"
+layout: "aws"
+page_title: "AWS: aws_service_discovery_service"
+description: |-
+  Provides a Service Discovery Service resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_service_discovery_service
+
+Provides a Service Discovery Service resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.service_discovery_private_dns_namespace import ServiceDiscoveryPrivateDnsNamespace
+from imports.aws.service_discovery_service import ServiceDiscoveryService
+from imports.aws.vpc import Vpc
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = Vpc(self, "example",
+            cidr_block="10.0.0.0/16",
+            enable_dns_hostnames=True,
+            enable_dns_support=True
+        )
+        aws_service_discovery_private_dns_namespace_example =
+        ServiceDiscoveryPrivateDnsNamespace(self, "example_1",
+            description="example",
+            name="example.terraform.local",
+            vpc=example.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_service_discovery_private_dns_namespace_example.override_logical_id("example")
+        aws_service_discovery_service_example = ServiceDiscoveryService(self, "example_2",
+            dns_config=ServiceDiscoveryServiceDnsConfig(
+                dns_records=[ServiceDiscoveryServiceDnsConfigDnsRecords(
+                    ttl=10,
+                    type="A"
+                )
+                ],
+                namespace_id=Token.as_string(aws_service_discovery_private_dns_namespace_example.id),
+                routing_policy="MULTIVALUE"
+            ),
+            health_check_custom_config=ServiceDiscoveryServiceHealthCheckCustomConfig(
+                failure_threshold=1
+            ),
+            name="example"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_service_discovery_service_example.override_logical_id("example")
+```
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.service_discovery_public_dns_namespace import ServiceDiscoveryPublicDnsNamespace
+from imports.aws.service_discovery_service import ServiceDiscoveryService
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = ServiceDiscoveryPublicDnsNamespace(self, "example",
+            description="example",
+            name="example.terraform.com"
+        )
+        aws_service_discovery_service_example = ServiceDiscoveryService(self, "example_1",
+            dns_config=ServiceDiscoveryServiceDnsConfig(
+                dns_records=[ServiceDiscoveryServiceDnsConfigDnsRecords(
+                    ttl=10,
+                    type="A"
+                )
+                ],
+                namespace_id=example.id
+            ),
+            health_check_config=ServiceDiscoveryServiceHealthCheckConfig(
+                failure_threshold=10,
+                resource_path="path",
+                type="HTTP"
+            ),
+            name="example"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_service_discovery_service_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required, ForceNew) The name of the service.
+* `description` - (Optional) The description of the service.
+* `dns_config` - (Optional) A complex type that contains information about the resource record sets that you want Amazon Route 53 to create when you register an instance.
+* `health_check_config` - (Optional) A complex type that contains settings for an optional health check. Only for Public DNS namespaces.
+* `force_destroy` - (Optional, Default:false ) A boolean that indicates all instances should be deleted from the service so that the service can be destroyed without error. These instances are not recoverable.
+* `health_check_custom_config` - (Optional, ForceNew) A complex type that contains settings for ECS managed health checks.
+* `namespace_id` - (Optional) The ID of the namespace that you want to use to create the service.
+* `type` - (Optional) If present, specifies that the service instances are only discoverable using the `DiscoverInstances` API operation. No DNS records is registered for the service instances. The only valid value is `HTTP`.
+* `tags` - (Optional) A map of tags to assign to the service. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### dns_config
+
+This argument supports the following arguments:
+
+* `namespace_id` - (Required, ForceNew) The ID of the namespace to use for DNS configuration.
+* `dns_records` - (Required) An array that contains one DnsRecord object for each resource record set.
+* `routing_policy` - (Optional) The routing policy that you want to apply to all records that Route 53 creates when you register an instance and specify the service. Valid Values: MULTIVALUE, WEIGHTED
+
+#### dns_records
+
+This argument supports the following arguments:
+
+* `ttl` - (Required) The amount of time, in seconds, that you want DNS resolvers to cache the settings for this resource record set.
+* `type` - (Required, ForceNew) The type of the resource, which indicates the value that Amazon Route 53 returns in response to DNS queries. Valid Values: A, AAAA, SRV, CNAME
+
+### health_check_config
+
+This argument supports the following arguments:
+
+* `failure_threshold` - (Optional) The number of consecutive health checks. Maximum value of 10.
+* `resource_path` - (Optional) The path that you want Route 53 to request when performing health checks. Route 53 automatically adds the DNS name for the service. If you don't specify a value, the default value is /.
+* `type` - (Optional, ForceNew) The type of health check that you want to create, which indicates how Route 53 determines whether an endpoint is healthy. Valid Values: HTTP, HTTPS, TCP
+
+### health_check_custom_config
+
+This argument supports the following arguments:
+
+* `failure_threshold` - (Optional, ForceNew) The number of 30-second intervals that you want service discovery to wait before it changes the health status of a service instance.  Maximum value of 10.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the service.
+* `arn` - The ARN of the service.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Service Discovery Service using the service ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Service Discovery Service using the service ID. For example:
+
+```console
+% terraform import aws_service_discovery_service.example 0123456789
+```
+
+<!-- cache-key: cdktf-0.18.0 input-5ade767584d977305ecc43e9b30413e85a11a275bc3038025a2c51ba270c6462 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/servicecatalog_budget_resource_association.html.markdown b/website/docs/cdktf/python/r/servicecatalog_budget_resource_association.html.markdown
new file mode 100644
index 00000000000..2200167a924
--- /dev/null
+++ b/website/docs/cdktf/python/r/servicecatalog_budget_resource_association.html.markdown
@@ -0,0 +1,79 @@
+---
+subcategory: "Service Catalog"
+layout: "aws"
+page_title: "AWS: aws_servicecatalog_budget_resource_association"
+description: |-
+  Manages a Service Catalog Budget Resource Association
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_servicecatalog_budget_resource_association
+
+Manages a Service Catalog Budget Resource Association.
+
+-> **Tip:** A "resource" is either a Service Catalog portfolio or product.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.servicecatalog_budget_resource_association import ServicecatalogBudgetResourceAssociation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ServicecatalogBudgetResourceAssociation(self, "example",
+            budget_name="budget-pjtvyakdlyo3m",
+            resource_id="prod-dnigbtea24ste"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `budget_name` - (Required) Budget name.
+* `resource_id` - (Required) Resource identifier.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Identifier of the association.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `3m`)
+- `read` - (Default `10m`)
+- `delete` - (Default `3m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_servicecatalog_budget_resource_association` using the budget name and resource ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_servicecatalog_budget_resource_association` using the budget name and resource ID. For example:
+
+```console
+% terraform import aws_servicecatalog_budget_resource_association.example budget-pjtvyakdlyo3m:prod-dnigbtea24ste
+```
+
+<!-- cache-key: cdktf-0.18.0 input-a2e52fd530130cd91bdd5732dbafc57e0d37162974732ff3d849486e557d12fa -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/servicecatalog_constraint.html.markdown b/website/docs/cdktf/python/r/servicecatalog_constraint.html.markdown
new file mode 100644
index 00000000000..23578269ccf
--- /dev/null
+++ b/website/docs/cdktf/python/r/servicecatalog_constraint.html.markdown
@@ -0,0 +1,128 @@
+---
+subcategory: "Service Catalog"
+layout: "aws"
+page_title: "AWS: aws_servicecatalog_constraint"
+description: |-
+  Manages a Service Catalog Constraint
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_servicecatalog_constraint
+
+Manages a Service Catalog Constraint.
+
+~> **NOTE:** This resource does not associate a Service Catalog product and portfolio. However, the product and portfolio must be associated (see the `aws_servicecatalog_product_portfolio_association` resource) prior to creating a constraint or you will receive an error.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.servicecatalog_constraint import ServicecatalogConstraint
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ServicecatalogConstraint(self, "example",
+            description="Back off, man. I'm a scientist.",
+            parameters=Token.as_string(
+                Fn.jsonencode({
+                    "RoleArn": "arn:aws:iam::123456789012:role/LaunchRole"
+                })),
+            portfolio_id=Token.as_string(aws_servicecatalog_portfolio_example.id),
+            product_id=Token.as_string(aws_servicecatalog_product_example.id),
+            type="LAUNCH"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `parameters` - (Required) Constraint parameters in JSON format. The syntax depends on the constraint type. See details below.
+* `portfolio_id` - (Required) Portfolio identifier.
+* `product_id` - (Required) Product identifier.
+* `type` - (Required) Type of constraint. Valid values are `LAUNCH`, `NOTIFICATION`, `RESOURCE_UPDATE`, `STACKSET`, and `TEMPLATE`.
+
+The following arguments are optional:
+
+* `accept_language` - (Optional) Language code. Valid values: `en` (English), `jp` (Japanese), `zh` (Chinese). Default value is `en`.
+* `description` - (Optional) Description of the constraint.
+
+### `parameters`
+
+The `type` you specify determines what must be included in the `parameters` JSON:
+
+* `LAUNCH`: You are required to specify either the RoleArn or the LocalRoleName but can't use both. If you specify the `LocalRoleName` property, when an account uses the launch constraint, the IAM role with that name in the account will be used. This allows launch-role constraints to be account-agnostic so the administrator can create fewer resources per shared account. The given role name must exist in the account used to create the launch constraint and the account of the user who launches a product with this launch constraint. You cannot have both a `LAUNCH` and a `STACKSET` constraint. You also cannot have more than one `LAUNCH` constraint on an `aws_servicecatalog_product` and `aws_servicecatalog_portfolio`. Specify the `RoleArn` and `LocalRoleName` properties as follows:
+
+```json
+{ "RoleArn" : "arn:aws:iam::123456789012:role/LaunchRole" }
+```
+
+```json
+{ "LocalRoleName" : "SCBasicLaunchRole" }
+```
+
+* `NOTIFICATION`: Specify the `NotificationArns` property as follows:
+
+```json
+{ "NotificationArns" : ["arn:aws:sns:us-east-1:123456789012:Topic"] }
+```
+
+* `RESOURCE_UPDATE`: Specify the `TagUpdatesOnProvisionedProduct` property as follows. The `TagUpdatesOnProvisionedProduct` property accepts a string value of `ALLOWED` or `NOT_ALLOWED`.
+
+```json
+{ "Version" : "2.0","Properties" :{ "TagUpdateOnProvisionedProduct" : "String" }}
+```
+
+* `STACKSET`: Specify the Parameters property as follows. You cannot have both a `LAUNCH` and a `STACKSET` constraint. You also cannot have more than one `STACKSET` constraint on on an `aws_servicecatalog_product` and `aws_servicecatalog_portfolio`. Products with a `STACKSET` constraint will launch an AWS CloudFormation stack set.
+
+```json
+{ "Version" : "String", "Properties" : { "AccountList" : [ "String" ], "RegionList" : [ "String" ], "AdminRole" : "String", "ExecutionRole" : "String" }}
+```
+
+* `TEMPLATE`: Specify the Rules property. For more information, see [Template Constraint Rules](http://docs.aws.amazon.com/servicecatalog/latest/adminguide/reference-template_constraint_rules.html).
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Constraint identifier.
+* `owner` - Owner of the constraint.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `3m`)
+- `read` - (Default `10m`)
+- `update` - (Default `3m`)
+- `delete` - (Default `3m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_servicecatalog_constraint` using the constraint ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_servicecatalog_constraint` using the constraint ID. For example:
+
+```console
+% terraform import aws_servicecatalog_constraint.example cons-nmdkb6cgxfcrs
+```
+
+<!-- cache-key: cdktf-0.18.0 input-f391e00f1f29453b1e81c01e36db6ce37af9e3b44513a1ffefd379e9b7d4ba13 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/servicecatalog_organizations_access.html.markdown b/website/docs/cdktf/python/r/servicecatalog_organizations_access.html.markdown
new file mode 100644
index 00000000000..55e192fbefe
--- /dev/null
+++ b/website/docs/cdktf/python/r/servicecatalog_organizations_access.html.markdown
@@ -0,0 +1,56 @@
+---
+subcategory: "Service Catalog"
+layout: "aws"
+page_title: "AWS: aws_servicecatalog_organizations_access"
+description: |-
+  Manages Service Catalog Organizations Access
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_servicecatalog_organizations_access
+
+Manages Service Catalog AWS Organizations Access, a portfolio sharing feature through AWS Organizations. This allows Service Catalog to receive updates on your organization in order to sync your shares with the current structure. This resource will prompt AWS to set `organizations:EnableAWSServiceAccess` on your behalf so that your shares can be in sync with any changes in your AWS Organizations structure.
+
+~> **NOTE:** This resource can only be used by the management account in the organization. In other words, a delegated administrator is not authorized to use the resource.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.servicecatalog_organizations_access import ServicecatalogOrganizationsAccess
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ServicecatalogOrganizationsAccess(self, "example",
+            enabled=Token.as_boolean("true")
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `enabled` - (Required) Whether to enable AWS Organizations access.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Account ID for the account using the resource.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `10m`)
+
+<!-- cache-key: cdktf-0.18.0 input-d1af255796a486bb9a3bd8cc8478755ac5b38d989c70b85aaacdec5fc40b2642 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/servicecatalog_portfolio.html.markdown b/website/docs/cdktf/python/r/servicecatalog_portfolio.html.markdown
new file mode 100644
index 00000000000..03a6ed4c16c
--- /dev/null
+++ b/website/docs/cdktf/python/r/servicecatalog_portfolio.html.markdown
@@ -0,0 +1,80 @@
+---
+subcategory: "Service Catalog"
+layout: "aws"
+page_title: "AWS: aws_servicecatalog_portfolio"
+description: |-
+  Provides a resource to create a Service Catalog portfolio
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_servicecatalog_portfolio
+
+Provides a resource to create a Service Catalog Portfolio.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.servicecatalog_portfolio import ServicecatalogPortfolio
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ServicecatalogPortfolio(self, "portfolio",
+            description="List of my organizations apps",
+            name="My App Portfolio",
+            provider_name="Brett"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the portfolio.
+* `description` - (Required) Description of the portfolio
+* `provider_name` - (Required) Name of the person or organization who owns the portfolio.
+* `tags` - (Optional) Tags to apply to the connection. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the Service Catalog Portfolio.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `30m`)
+- `read` - (Default `10m`)
+- `update` - (Default `30m`)
+- `delete` - (Default `30m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Service Catalog Portfolios using the Service Catalog Portfolio `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Service Catalog Portfolios using the Service Catalog Portfolio `id`. For example:
+
+```console
+% terraform import aws_servicecatalog_portfolio.testfolio port-12344321
+```
+
+<!-- cache-key: cdktf-0.18.0 input-da174375baa38ca503a2ff97599b160bf147cf7877cecc0642771beb1b8b5543 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/servicecatalog_portfolio_share.html.markdown b/website/docs/cdktf/python/r/servicecatalog_portfolio_share.html.markdown
new file mode 100644
index 00000000000..68936b956ac
--- /dev/null
+++ b/website/docs/cdktf/python/r/servicecatalog_portfolio_share.html.markdown
@@ -0,0 +1,95 @@
+---
+subcategory: "Service Catalog"
+layout: "aws"
+page_title: "AWS: aws_servicecatalog_portfolio_share"
+description: |-
+  Manages a Service Catalog Portfolio Share
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_servicecatalog_portfolio_share
+
+Manages a Service Catalog Portfolio Share. Shares the specified portfolio with the specified account or organization node. You can share portfolios to an organization, an organizational unit, or a specific account.
+
+If the portfolio share with the specified account or organization node already exists, using this resource to re-create the share will have no effect and will not return an error. You can then use this resource to update the share.
+
+~> **NOTE:** Shares to an organization node can only be created by the management account of an organization or by a delegated administrator. If a delegated admin is de-registered, they can no longer create portfolio shares.
+
+~> **NOTE:** AWSOrganizationsAccess must be enabled in order to create a portfolio share to an organization node.
+
+~> **NOTE:** You can't share a shared resource, including portfolios that contain a shared product.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.servicecatalog_portfolio_share import ServicecatalogPortfolioShare
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ServicecatalogPortfolioShare(self, "example",
+            portfolio_id=Token.as_string(aws_servicecatalog_portfolio_example.id),
+            principal_id="012128675309",
+            type="ACCOUNT"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `portfolio_id` - (Required) Portfolio identifier.
+* `principal_id` - (Required) Identifier of the principal with whom you will share the portfolio. Valid values AWS account IDs and ARNs of AWS Organizations and organizational units.
+* `type` - (Required) Type of portfolio share. Valid values are `ACCOUNT` (an external account), `ORGANIZATION` (a share to every account in an organization), `ORGANIZATIONAL_UNIT`, `ORGANIZATION_MEMBER_ACCOUNT` (a share to an account in an organization).
+
+The following arguments are optional:
+
+* `accept_language` - (Optional) Language code. Valid values: `en` (English), `jp` (Japanese), `zh` (Chinese). Default value is `en`.
+* `share_principals` - (Optional) Enables or disables Principal sharing when creating the portfolio share. If this flag is not provided, principal sharing is disabled.
+* `share_tag_options` - (Optional) Whether to enable sharing of `aws_servicecatalog_tag_option` resources when creating the portfolio share.
+* `wait_for_acceptance` - (Optional) Whether to wait (up to the timeout) for the share to be accepted. Organizational shares are automatically accepted.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `accepted` - Whether the shared portfolio is imported by the recipient account. If the recipient is organizational, the share is automatically imported, and the field is always set to true.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `3m`)
+- `read` - (Default `10m`)
+- `update` - (Default `3m`)
+- `delete` - (Default `3m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_servicecatalog_portfolio_share` using the portfolio share ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_servicecatalog_portfolio_share` using the portfolio share ID. For example:
+
+```console
+% terraform import aws_servicecatalog_portfolio_share.example port-12344321:ACCOUNT:123456789012
+```
+
+<!-- cache-key: cdktf-0.18.0 input-2bfc4e872e821217e1db9b54e4495ec060f98eb8c8810ca144d89c25443c542e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/servicecatalog_principal_portfolio_association.html.markdown b/website/docs/cdktf/python/r/servicecatalog_principal_portfolio_association.html.markdown
new file mode 100644
index 00000000000..56b5518fc75
--- /dev/null
+++ b/website/docs/cdktf/python/r/servicecatalog_principal_portfolio_association.html.markdown
@@ -0,0 +1,82 @@
+---
+subcategory: "Service Catalog"
+layout: "aws"
+page_title: "AWS: aws_servicecatalog_principal_portfolio_association"
+description: |-
+  Manages a Service Catalog Principal Portfolio Association
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_servicecatalog_principal_portfolio_association
+
+Manages a Service Catalog Principal Portfolio Association.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.servicecatalog_principal_portfolio_association import ServicecatalogPrincipalPortfolioAssociation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ServicecatalogPrincipalPortfolioAssociation(self, "example",
+            portfolio_id="port-68656c6c6f",
+            principal_arn="arn:aws:iam::123456789012:user/Eleanor"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `portfolio_id` - (Required) Portfolio identifier.
+* `principal_arn` - (Required) Principal ARN.
+
+The following arguments are optional:
+
+* `accept_language` - (Optional) Language code. Valid values: `en` (English), `jp` (Japanese), `zh` (Chinese). Default value is `en`.
+* `principal_type` - (Optional) Principal type. Setting this argument empty (e.g., `principal_type = ""`) will result in an error. Valid values are `IAM` and `IAM_PATTERN`. Default is `IAM`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Identifier of the association.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `3m`)
+- `read` - (Default `10m`)
+- `delete` - (Default `3m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_servicecatalog_principal_portfolio_association` using `accept_language`, `principal_arn`, `portfolio_id`, and `principal_type` separated by a comma. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_servicecatalog_principal_portfolio_association` using `accept_language`, `principal_arn`, `portfolio_id`, and `principal_type` separated by a comma. For example:
+
+```console
+% terraform import aws_servicecatalog_principal_portfolio_association.example en,arn:aws:iam::123456789012:user/Eleanor,port-68656c6c6f,IAM
+```
+
+<!-- cache-key: cdktf-0.18.0 input-e6d6f9fdac81517f3102dae36363cdc0c25088bd03ba2f1ace568fed9c2cef49 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/servicecatalog_product.html.markdown b/website/docs/cdktf/python/r/servicecatalog_product.html.markdown
new file mode 100644
index 00000000000..5e57a8b48b3
--- /dev/null
+++ b/website/docs/cdktf/python/r/servicecatalog_product.html.markdown
@@ -0,0 +1,117 @@
+---
+subcategory: "Service Catalog"
+layout: "aws"
+page_title: "AWS: aws_servicecatalog_product"
+description: |-
+  Manages a Service Catalog Product
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_servicecatalog_product
+
+Manages a Service Catalog Product.
+
+~> **NOTE:** The user or role that uses this resources must have the `cloudformation:GetTemplate` IAM policy permission. This policy permission is required when using the `template_physical_id` argument.
+
+-> A "provisioning artifact" is also referred to as a "version." A "distributor" is also referred to as a "vendor."
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.servicecatalog_product import ServicecatalogProduct
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ServicecatalogProduct(self, "example",
+            name="example",
+            owner="example-owner",
+            provisioning_artifact_parameters=ServicecatalogProductProvisioningArtifactParameters(
+                template_url="https://s3.amazonaws.com/cf-templates-ozkq9d3hgiq2-us-east-1/temp1.json"
+            ),
+            tags={
+                "foo": "bar"
+            },
+            type="CLOUD_FORMATION_TEMPLATE"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) Name of the product.
+* `owner` - (Required) Owner of the product.
+* `provisioning_artifact_parameters` - (Required) Configuration block for provisioning artifact (i.e., version) parameters. Detailed below.
+* `type` - (Required) Type of product. See [AWS Docs](https://docs.aws.amazon.com/servicecatalog/latest/dg/API_CreateProduct.html#API_CreateProduct_RequestSyntax) for valid list of values.
+
+The following arguments are optional:
+
+* `accept_language` - (Optional) Language code. Valid values: `en` (English), `jp` (Japanese), `zh` (Chinese). Default value is `en`.
+* `description` - (Optional) Description of the product.
+* `distributor` - (Optional) Distributor (i.e., vendor) of the product.
+* `support_description` - (Optional) Support information about the product.
+* `support_email` - (Optional) Contact email for product support.
+* `support_url` - (Optional) Contact URL for product support.
+* `tags` - (Optional) Tags to apply to the product. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### provisioning_artifact_parameters
+
+This argument supports the following arguments:
+
+* `description` - (Optional) Description of the provisioning artifact (i.e., version), including how it differs from the previous provisioning artifact.
+* `disable_template_validation` - (Optional) Whether AWS Service Catalog stops validating the specified provisioning artifact template even if it is invalid.
+* `name` - (Optional) Name of the provisioning artifact (for example, `v1`, `v2beta`). No spaces are allowed.
+* `template_physical_id` - (Required if `template_url` is not provided) Template source as the physical ID of the resource that contains the template. Currently only supports CloudFormation stack ARN. Specify the physical ID as `arn:[partition]:cloudformation:[region]:[account ID]:stack/[stack name]/[resource ID]`.
+* `template_url` - (Required if `template_physical_id` is not provided) Template source as URL of the CloudFormation template in Amazon S3.
+* `type` - (Optional) Type of provisioning artifact. See [AWS Docs](https://docs.aws.amazon.com/servicecatalog/latest/dg/API_ProvisioningArtifactProperties.html) for valid list of values.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the product.
+* `created_time` - Time when the product was created.
+* `has_default_path` - Whether the product has a default path. If the product does not have a default path, call `ListLaunchPaths` to disambiguate between paths.  Otherwise, `ListLaunchPaths` is not required, and the output of ProductViewSummary can be used directly with `DescribeProvisioningParameters`.
+* `id` - Product ID. For example, `prod-dnigbtea24ste`.
+* `status` - Status of the product.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `5m`)
+- `read` - (Default `10m`)
+- `update` - (Default `5m`)
+- `delete` - (Default `5m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_servicecatalog_product` using the product ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_servicecatalog_product` using the product ID. For example:
+
+```console
+% terraform import aws_servicecatalog_product.example prod-dnigbtea24ste
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1f4523af61444a389c63a7aa67dc5375eed39f2f4564f496463f6674fac90f74 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/servicecatalog_product_portfolio_association.html.markdown b/website/docs/cdktf/python/r/servicecatalog_product_portfolio_association.html.markdown
new file mode 100644
index 00000000000..c0aad2c15f8
--- /dev/null
+++ b/website/docs/cdktf/python/r/servicecatalog_product_portfolio_association.html.markdown
@@ -0,0 +1,80 @@
+---
+subcategory: "Service Catalog"
+layout: "aws"
+page_title: "AWS: aws_servicecatalog_product_portfolio_association"
+description: |-
+  Manages a Service Catalog Product Portfolio Association
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_servicecatalog_product_portfolio_association
+
+Manages a Service Catalog Product Portfolio Association.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.servicecatalog_product_portfolio_association import ServicecatalogProductPortfolioAssociation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ServicecatalogProductPortfolioAssociation(self, "example",
+            portfolio_id="port-68656c6c6f",
+            product_id="prod-dnigbtea24ste"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `portfolio_id` - (Required) Portfolio identifier.
+* `product_id` - (Required) Product identifier.
+
+The following arguments are optional:
+
+* `accept_language` - (Optional) Language code. Valid values: `en` (English), `jp` (Japanese), `zh` (Chinese). Default value is `en`.
+* `source_portfolio_id` - (Optional) Identifier of the source portfolio.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Identifier of the association.
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `3m`)
+- `read` - (Default `10m`)
+- `delete` - (Default `3m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_servicecatalog_product_portfolio_association` using the accept language, portfolio ID, and product ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_servicecatalog_product_portfolio_association` using the accept language, portfolio ID, and product ID. For example:
+
+```console
+% terraform import aws_servicecatalog_product_portfolio_association.example en:port-68656c6c6f:prod-dnigbtea24ste
+```
+
+<!-- cache-key: cdktf-0.18.0 input-a3af1254e2031bb30383dd299c3aac7b7de830390f5b4d5f6d57c3f44312464e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/servicecatalog_provisioned_product.html.markdown b/website/docs/cdktf/python/r/servicecatalog_provisioned_product.html.markdown
new file mode 100644
index 00000000000..3a0c15cb68b
--- /dev/null
+++ b/website/docs/cdktf/python/r/servicecatalog_provisioned_product.html.markdown
@@ -0,0 +1,154 @@
+---
+subcategory: "Service Catalog"
+layout: "aws"
+page_title: "AWS: aws_servicecatalog_provisioned_product"
+description: |-
+  Manages a Service Catalog Provisioned Product
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_servicecatalog_provisioned_product
+
+This resource provisions and manages a Service Catalog provisioned product.
+
+A provisioned product is a resourced instance of a product. For example, provisioning a product based on a CloudFormation template launches a CloudFormation stack and its underlying resources.
+
+Like this resource, the `aws_servicecatalog_record` data source also provides information about a provisioned product. Although a Service Catalog record provides some overlapping information with this resource, a record is tied to a provisioned product event, such as provisioning, termination, and updating.
+
+-> **Tip:** If you include conflicted keys as tags, AWS will report an error, "Parameter validation failed: Missing required parameter in Tags[N]:Value".
+
+-> **Tip:** A "provisioning artifact" is also referred to as a "version." A "distributor" is also referred to as a "vendor."
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.servicecatalog_provisioned_product import ServicecatalogProvisionedProduct
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ServicecatalogProvisionedProduct(self, "example",
+            name="example",
+            product_name="Example product",
+            provisioning_artifact_name="Example version",
+            provisioning_parameters=[ServicecatalogProvisionedProductProvisioningParameters(
+                key="foo",
+                value="bar"
+            )
+            ],
+            tags={
+                "foo": "bar"
+            }
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) User-friendly name of the provisioned product.
+
+The following arguments are optional:
+
+* `accept_language` - (Optional) Language code. Valid values: `en` (English), `jp` (Japanese), `zh` (Chinese). Default value is `en`.
+* `ignore_errors` - (Optional) _Only applies to deleting._ If set to `true`, AWS Service Catalog stops managing the specified provisioned product even if it cannot delete the underlying resources. The default value is `false`.
+* `notification_arns` - (Optional) Passed to CloudFormation. The SNS topic ARNs to which to publish stack-related events.
+* `path_id` - (Optional) Path identifier of the product. This value is optional if the product has a default path, and required if the product has more than one path. To list the paths for a product, use `aws_servicecatalog_launch_paths`. When required, you must provide `path_id` or `path_name`, but not both.
+* `path_name` - (Optional) Name of the path. You must provide `path_id` or `path_name`, but not both.
+* `product_id` - (Optional) Product identifier. For example, `prod-abcdzk7xy33qa`. You must provide `product_id` or `product_name`, but not both.
+* `product_name` - (Optional) Name of the product. You must provide `product_id` or `product_name`, but not both.
+* `provisioning_artifact_id` - (Optional) Identifier of the provisioning artifact. For example, `pa-4abcdjnxjj6ne`. You must provide the `provisioning_artifact_id` or `provisioning_artifact_name`, but not both.
+* `provisioning_artifact_name` - (Optional) Name of the provisioning artifact. You must provide the `provisioning_artifact_id` or `provisioning_artifact_name`, but not both.
+* `provisioning_parameters` - (Optional) Configuration block with parameters specified by the administrator that are required for provisioning the product. See details below.
+* `retain_physical_resources` - (Optional) _Only applies to deleting._ Whether to delete the Service Catalog provisioned product but leave the CloudFormation stack, stack set, or the underlying resources of the deleted provisioned product. The default value is `false`.
+* `stack_set_provisioning_preferences` - (Optional) Configuration block with information about the provisioning preferences for a stack set. See details below.
+* `tags` - (Optional) Tags to apply to the provisioned product. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### provisioning_parameters
+
+This argument supports the following arguments:
+
+* `key` - (Required) Parameter key.
+* `use_previous_value` - (Optional) Whether to ignore `value` and keep the previous parameter value. Ignored when initially provisioning a product.
+* `value` - (Optional) Parameter value.
+
+### stack_set_provisioning_preferences
+
+All of the `stack_set_provisioning_preferences` are only applicable to a `CFN_STACKSET` provisioned product type.
+
+This argument supports the following arguments:
+
+* `accounts` - (Optional) One or more AWS accounts that will have access to the provisioned product. The AWS accounts specified should be within the list of accounts in the STACKSET constraint. To get the list of accounts in the STACKSET constraint, use the `aws_servicecatalog_provisioning_parameters` data source. If no values are specified, the default value is all accounts from the STACKSET constraint.
+* `failure_tolerance_count` - (Optional) Number of accounts, per region, for which this operation can fail before AWS Service Catalog stops the operation in that region. If the operation is stopped in a region, AWS Service Catalog doesn't attempt the operation in any subsequent regions. You must specify either `failure_tolerance_count` or `failure_tolerance_percentage`, but not both. The default value is 0 if no value is specified.
+* `failure_tolerance_percentage` - (Optional) Percentage of accounts, per region, for which this stack operation can fail before AWS Service Catalog stops the operation in that region. If the operation is stopped in a region, AWS Service Catalog doesn't attempt the operation in any subsequent regions. When calculating the number of accounts based on the specified percentage, AWS Service Catalog rounds down to the next whole number. You must specify either `failure_tolerance_count` or `failure_tolerance_percentage`, but not both.
+* `max_concurrency_count` - (Optional) Maximum number of accounts in which to perform this operation at one time. This is dependent on the value of `failure_tolerance_count`. `max_concurrency_count` is at most one more than the `failure_tolerance_count`. Note that this setting lets you specify the maximum for operations. For large deployments, under certain circumstances the actual number of accounts acted upon concurrently may be lower due to service throttling. You must specify either `max_concurrency_count` or `max_concurrency_percentage`, but not both.
+* `max_concurrency_percentage` - (Optional) Maximum percentage of accounts in which to perform this operation at one time. When calculating the number of accounts based on the specified percentage, AWS Service Catalog rounds down to the next whole number. This is true except in cases where rounding down would result is zero. In this case, AWS Service Catalog sets the number as 1 instead. Note that this setting lets you specify the maximum for operations. For large deployments, under certain circumstances the actual number of accounts acted upon concurrently may be lower due to service throttling. You must specify either `max_concurrency_count` or `max_concurrency_percentage`, but not both.
+* `regions` - (Optional) One or more AWS Regions where the provisioned product will be available. The specified regions should be within the list of regions from the STACKSET constraint. To get the list of regions in the STACKSET constraint, use the `aws_servicecatalog_provisioning_parameters` data source. If no values are specified, the default value is all regions from the STACKSET constraint.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the provisioned product.
+* `cloudwatch_dashboard_names` - Set of CloudWatch dashboards that were created when provisioning the product.
+* `created_time` - Time when the provisioned product was created.
+* `id` - Provisioned Product ID.
+* `last_provisioning_record_id` - Record identifier of the last request performed on this provisioned product of the following types: `ProvisionedProduct`, `UpdateProvisionedProduct`, `ExecuteProvisionedProductPlan`, `TerminateProvisionedProduct`.
+* `last_record_id` - Record identifier of the last request performed on this provisioned product.
+* `last_successful_provisioning_record_id` - Record identifier of the last successful request performed on this provisioned product of the following types: `ProvisionedProduct`, `UpdateProvisionedProduct`, `ExecuteProvisionedProductPlan`, `TerminateProvisionedProduct`.
+* `launch_role_arn` - ARN of the launch role associated with the provisioned product.
+* `outputs` - The set of outputs for the product created.
+    * `description` -  The description of the output.
+    * `key` - The output key.
+    * `value` - The output value.
+* `status` - Current status of the provisioned product. See meanings below.
+* `status_message` - Current status message of the provisioned product.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `type` - Type of provisioned product. Valid values are `CFN_STACK` and `CFN_STACKSET`.
+
+### `status` Meanings
+
+* `AVAILABLE` - Stable state, ready to perform any operation. The most recent operation succeeded and completed.
+* `UNDER_CHANGE` - Transitive state. Operations performed might not have valid results. Wait for an `AVAILABLE` status before performing operations.
+* `TAINTED` - Stable state, ready to perform any operation. The stack has completed the requested operation but is not exactly what was requested. For example, a request to update to a new version failed and the stack rolled back to the current version.
+* `ERROR` - An unexpected error occurred. The provisioned product exists but the stack is not running. For example, CloudFormation received a parameter value that was not valid and could not launch the stack.
+* `PLAN_IN_PROGRESS` - Transitive state. The plan operations were performed to provision a new product, but resources have not yet been created. After reviewing the list of resources to be created, execute the plan. Wait for an `AVAILABLE` status before performing operations.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `30m`)
+- `read` - (Default `10m`)
+- `update` - (Default `30m`)
+- `delete` - (Default `30m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_servicecatalog_provisioned_product` using the provisioned product ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_servicecatalog_provisioned_product` using the provisioned product ID. For example:
+
+```console
+% terraform import aws_servicecatalog_provisioned_product.example pp-dnigbtea24ste
+```
+
+<!-- cache-key: cdktf-0.18.0 input-edd3b705e95bac2e25f2eb97a79b3f04705398287d665fe5f005143d89f697e6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/servicecatalog_provisioning_artifact.html.markdown b/website/docs/cdktf/python/r/servicecatalog_provisioning_artifact.html.markdown
new file mode 100644
index 00000000000..b45e3c4594c
--- /dev/null
+++ b/website/docs/cdktf/python/r/servicecatalog_provisioning_artifact.html.markdown
@@ -0,0 +1,100 @@
+---
+subcategory: "Service Catalog"
+layout: "aws"
+page_title: "AWS: aws_servicecatalog_provisioning_artifact"
+description: |-
+  Manages a Service Catalog Provisioning Artifact
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_servicecatalog_provisioning_artifact
+
+Manages a Service Catalog Provisioning Artifact for a specified product.
+
+-> A "provisioning artifact" is also referred to as a "version."
+
+~> **NOTE:** You cannot create a provisioning artifact for a product that was shared with you.
+
+~> **NOTE:** The user or role that use this resource must have the `cloudformation:GetTemplate` IAM policy permission. This policy permission is required when using the `template_physical_id` argument.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.servicecatalog_provisioning_artifact import ServicecatalogProvisioningArtifact
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ServicecatalogProvisioningArtifact(self, "example",
+            name="example",
+            product_id=Token.as_string(aws_servicecatalog_product_example.id),
+            template_url="https://${" + aws_s3_bucket_example.bucket_regional_domain_name + "}/${" + aws_s3_object_example.key + "}",
+            type="CLOUD_FORMATION_TEMPLATE"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `product_id` - (Required) Identifier of the product.
+* `template_physical_id` - (Required if `template_url` is not provided) Template source as the physical ID of the resource that contains the template. Currently only supports CloudFormation stack ARN. Specify the physical ID as `arn:[partition]:cloudformation:[region]:[account ID]:stack/[stack name]/[resource ID]`.
+* `template_url` - (Required if `template_physical_id` is not provided) Template source as URL of the CloudFormation template in Amazon S3.
+
+The following arguments are optional:
+
+* `accept_language` - (Optional) Language code. Valid values: `en` (English), `jp` (Japanese), `zh` (Chinese). The default value is `en`.
+* `active` - (Optional) Whether the product version is active. Inactive provisioning artifacts are invisible to end users. End users cannot launch or update a provisioned product from an inactive provisioning artifact. Default is `true`.
+* `description` - (Optional) Description of the provisioning artifact (i.e., version), including how it differs from the previous provisioning artifact.
+* `disable_template_validation` - (Optional) Whether AWS Service Catalog stops validating the specified provisioning artifact template even if it is invalid.
+* `guidance` - (Optional) Information set by the administrator to provide guidance to end users about which provisioning artifacts to use. Valid values are `DEFAULT` and `DEPRECATED`. The default is `DEFAULT`. Users are able to make updates to a provisioned product of a deprecated version but cannot launch new provisioned products using a deprecated version.
+* `name` - (Optional) Name of the provisioning artifact (for example, `v1`, `v2beta`). No spaces are allowed.
+* `type` - (Optional) Type of provisioning artifact. See [AWS Docs](https://docs.aws.amazon.com/servicecatalog/latest/dg/API_ProvisioningArtifactProperties.html) for valid list of values.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `created_time` - Time when the provisioning artifact was created.
+* `id` - Provisioning artifact identifier and product identifier separated by a colon.
+* `provisioning_artifact_id` - Provisioning artifact identifier.
+* `status` - Status of the provisioning artifact.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `3m`)
+- `read` - (Default `10m`)
+- `update` - (Default `3m`)
+- `delete` - (Default `3m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_servicecatalog_provisioning_artifact` using the provisioning artifact ID and product ID separated by a colon. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_servicecatalog_provisioning_artifact` using the provisioning artifact ID and product ID separated by a colon. For example:
+
+```console
+% terraform import aws_servicecatalog_provisioning_artifact.example pa-ij2b6lusy6dec:prod-el3an0rma3
+```
+
+<!-- cache-key: cdktf-0.18.0 input-a7d327a6dfcafe1faac099b2d4490b5d1603912ff87a7717d27d809de4e883f3 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/servicecatalog_service_action.html.markdown b/website/docs/cdktf/python/r/servicecatalog_service_action.html.markdown
new file mode 100644
index 00000000000..0c6843166a6
--- /dev/null
+++ b/website/docs/cdktf/python/r/servicecatalog_service_action.html.markdown
@@ -0,0 +1,97 @@
+---
+subcategory: "Service Catalog"
+layout: "aws"
+page_title: "AWS: aws_servicecatalog_service_action"
+description: |-
+  Manages a Service Catalog Service Action
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_servicecatalog_service_action
+
+Manages a Service Catalog self-service action.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.servicecatalog_service_action import ServicecatalogServiceAction
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, version):
+        super().__init__(scope, name)
+        ServicecatalogServiceAction(self, "example",
+            definition=ServicecatalogServiceActionDefinition(
+                name="AWS-RestartEC2Instance",
+                version=version
+            ),
+            description="Motor generator unit",
+            name="MGU"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `definition` - (Required) Self-service action definition configuration block. Detailed below.
+* `name` - (Required) Self-service action name.
+
+The following arguments are optional:
+
+* `accept_language` - (Optional) Language code. Valid values are `en` (English), `jp` (Japanese), and `zh` (Chinese). Default is `en`.
+* `description` - (Optional) Self-service action description.
+
+### `definition`
+
+The `definition` configuration block supports the following attributes:
+
+* `assume_role` - (Optional) ARN of the role that performs the self-service actions on your behalf. For example, `arn:aws:iam::12345678910:role/ActionRole`. To reuse the provisioned product launch role, set to `LAUNCH_ROLE`.
+* `name` - (Required) Name of the SSM document. For example, `AWS-RestartEC2Instance`. If you are using a shared SSM document, you must provide the ARN instead of the name.
+* `parameters` - (Optional) List of parameters in JSON format. For example: `[{\"Name\":\"InstanceId\",\"Type\":\"TARGET\"}]` or `[{\"Name\":\"InstanceId\",\"Type\":\"TEXT_VALUE\"}]`.
+* `type` - (Optional) Service action definition type. Valid value is `SSM_AUTOMATION`. Default is `SSM_AUTOMATION`.
+* `version` - (Required) SSM document version. For example, `1`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Identifier of the service action.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `3m`)
+- `read` - (Default `10m`)
+- `update` - (Default `3m`)
+- `delete` - (Default `3m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_servicecatalog_service_action` using the service action ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_servicecatalog_service_action` using the service action ID. For example:
+
+```console
+% terraform import aws_servicecatalog_service_action.example act-f1w12eperfslh
+```
+
+<!-- cache-key: cdktf-0.18.0 input-b03d24933f6fa4d9688080ccdcaa7ae9e07d0a55178d18a59825eb23b87e379c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/servicecatalog_tag_option.html.markdown b/website/docs/cdktf/python/r/servicecatalog_tag_option.html.markdown
new file mode 100644
index 00000000000..ba31b5a5798
--- /dev/null
+++ b/website/docs/cdktf/python/r/servicecatalog_tag_option.html.markdown
@@ -0,0 +1,83 @@
+---
+subcategory: "Service Catalog"
+layout: "aws"
+page_title: "AWS: aws_servicecatalog_tag_option"
+description: |-
+  Manages a Service Catalog Tag Option
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_servicecatalog_tag_option
+
+Manages a Service Catalog Tag Option.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.servicecatalog_tag_option import ServicecatalogTagOption
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ServicecatalogTagOption(self, "example",
+            key="nyckel",
+            value="värde"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `key` - (Required) Tag option key.
+* `value` - (Required) Tag option value.
+
+The following arguments are optional:
+
+* `active` - (Optional) Whether tag option is active. Default is `true`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Identifier (e.g., `tag-pjtvagohlyo3m`).
+* `owner_id` - AWS account ID of the owner account that created the tag option.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `3m`)
+- `read` - (Default `10m`)
+- `update` - (Default `3m`)
+- `delete` - (Default `3m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_servicecatalog_tag_option` using the tag option ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_servicecatalog_tag_option` using the tag option ID. For example:
+
+```console
+% terraform import aws_servicecatalog_tag_option.example tag-pjtvagohlyo3m
+```
+
+<!-- cache-key: cdktf-0.18.0 input-728b29f4f06d3333a9bc0717ffd7b59ae4e6dcb209ccc4e9ac76b0b4c6cfb651 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/servicecatalog_tag_option_resource_association.html.markdown b/website/docs/cdktf/python/r/servicecatalog_tag_option_resource_association.html.markdown
new file mode 100644
index 00000000000..1947cf3a106
--- /dev/null
+++ b/website/docs/cdktf/python/r/servicecatalog_tag_option_resource_association.html.markdown
@@ -0,0 +1,83 @@
+---
+subcategory: "Service Catalog"
+layout: "aws"
+page_title: "AWS: aws_servicecatalog_tag_option_resource_association"
+description: |-
+  Manages a Service Catalog Tag Option Resource Association
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_servicecatalog_tag_option_resource_association
+
+Manages a Service Catalog Tag Option Resource Association.
+
+-> **Tip:** A "resource" is either a Service Catalog portfolio or product.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.servicecatalog_tag_option_resource_association import ServicecatalogTagOptionResourceAssociation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ServicecatalogTagOptionResourceAssociation(self, "example",
+            resource_id="prod-dnigbtea24ste",
+            tag_option_id="tag-pjtvyakdlyo3m"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `resource_id` - (Required) Resource identifier.
+* `tag_option_id` - (Required) Tag Option identifier.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Identifier of the association.
+* `resource_arn` - ARN of the resource.
+* `resource_created_time` - Creation time of the resource.
+* `resource_description` - Description of the resource.
+* `resource_name` - Description of the resource.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `3m`)
+- `read` - (Default `10m`)
+- `delete` - (Default `3m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_servicecatalog_tag_option_resource_association` using the tag option ID and resource ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_servicecatalog_tag_option_resource_association` using the tag option ID and resource ID. For example:
+
+```console
+% terraform import aws_servicecatalog_tag_option_resource_association.example tag-pjtvyakdlyo3m:prod-dnigbtea24ste
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ae36ed874f6f516a2530c784f0fe767eaadd12cbb9e4007a768baa831153ddc9 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/servicequotas_service_quota.html.markdown b/website/docs/cdktf/python/r/servicequotas_service_quota.html.markdown
new file mode 100644
index 00000000000..d27231b535d
--- /dev/null
+++ b/website/docs/cdktf/python/r/servicequotas_service_quota.html.markdown
@@ -0,0 +1,89 @@
+---
+subcategory: "Service Quotas"
+layout: "aws"
+page_title: "AWS: aws_servicequotas_service_quota"
+description: |-
+  Manages an individual Service Quota
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_servicequotas_service_quota
+
+Manages an individual Service Quota.
+
+~> **NOTE:** Global quotas apply to all AWS regions, but can only be accessed in `us-east-1` in the Commercial partition or `us-gov-west-1` in the GovCloud partition. In other regions, the AWS API will return the error `The request failed because the specified service does not exist.`
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.servicequotas_service_quota import ServicequotasServiceQuota
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ServicequotasServiceQuota(self, "example",
+            quota_code="L-F678F1CE",
+            service_code="vpc",
+            value=75
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `quota_code` - (Required) Code of the service quota to track. For example: `L-F678F1CE`. Available values can be found with the [AWS CLI service-quotas list-service-quotas command](https://docs.aws.amazon.com/cli/latest/reference/service-quotas/list-service-quotas.html).
+* `service_code` - (Required) Code of the service to track. For example: `vpc`. Available values can be found with the [AWS CLI service-quotas list-services command](https://docs.aws.amazon.com/cli/latest/reference/service-quotas/list-services.html).
+* `value` - (Required) Float specifying the desired value for the service quota. If the desired value is higher than the current value, a quota increase request is submitted. When a known request is submitted and pending, the value reflects the desired value of the pending request.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `adjustable` - Whether the service quota can be increased.
+* `arn` - Amazon Resource Name (ARN) of the service quota.
+* `default_value` - Default value of the service quota.
+* `id` - Service code and quota code, separated by a front slash (`/`)
+* `quota_name` - Name of the quota.
+* `service_name` - Name of the service.
+* `usage_metric` - Information about the measurement.
+    * `metric_dimensions` - The metric dimensions.
+        * `class`
+        * `resource`
+        * `service`
+        * `type`
+    * `metric_name` - The name of the metric.
+    * `metric_namespace` - The namespace of the metric.
+    * `metric_statistic_recommendation` - The metric statistic that AWS recommend you use when determining quota usage.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_servicequotas_service_quota` using the service code and quota code, separated by a front slash (`/`). For example:
+
+~> **NOTE:** This resource does not require explicit import and will assume management of an existing service quota on Terraform resource creation.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_servicequotas_service_quota` using the service code and quota code, separated by a front slash (`/`). For example:
+
+~> **NOTE:** This resource does not require explicit import and will assume management of an existing service quota on Terraform resource creation.
+
+```console
+% terraform import aws_servicequotas_service_quota.example vpc/L-F678F1CE
+```
+
+<!-- cache-key: cdktf-0.18.0 input-8925c6b8aa699116dcad422ba2332dd43139659327e20ceb1d3df872c9c113ea -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/servicequotas_template.html.markdown b/website/docs/cdktf/python/r/servicequotas_template.html.markdown
new file mode 100644
index 00000000000..d919bd715ec
--- /dev/null
+++ b/website/docs/cdktf/python/r/servicequotas_template.html.markdown
@@ -0,0 +1,78 @@
+---
+subcategory: "Service Quotas"
+layout: "aws"
+page_title: "AWS: aws_servicequotas_template"
+description: |-
+  Terraform resource for managing an AWS Service Quotas Template.
+---
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_servicequotas_template
+
+Terraform resource for managing an AWS Service Quotas Template.
+
+-> Only the management account of an organization can alter Service Quota templates, and this must be done from the `us-east-1` region.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.servicequotas_template import ServicequotasTemplate
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ServicequotasTemplate(self, "example",
+            quota_code="L-2ACBD22F",
+            region="us-east-1",
+            service_code="lambda",
+            value=Token.as_number("80")
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `region` - (Required) AWS Region to which the template applies.
+* `quota_code` - (Required) Quota identifier. To find the quota code for a specific quota, use the [aws_servicequotas_service_quota](../d/servicequotas_service_quota.html.markdown) data source.
+* `service_code` - (Required) Service identifier. To find the service code value for an AWS service, use the [aws_servicequotas_service](../d/servicequotas_service.html.markdown) data source.
+* `value` - (Required) The new, increased value for the quota.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `global_quota` - Indicates whether the quota is global.
+* `id` - Unique identifier for the resource, which is a comma-delimited string separating `region`, `quota_code`, and `service_code`.
+* `quota_name` - Quota name.
+* `service_name` - Service name.
+* `unit` - Unit of measurement.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Service Quotas Template using the `example_id_arg`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Service Quotas Template using the `id`. For example:
+
+```console
+% terraform import aws_servicequotas_template.example us-east-1,L-2ACBD22F,lambda
+```
+
+<!-- cache-key: cdktf-0.18.0 input-59282bf548034739d1f0003d1269d0e89ecfc39f7eb69a22de9c8d495c122b6f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/servicequotas_template_association.html.markdown b/website/docs/cdktf/python/r/servicequotas_template_association.html.markdown
new file mode 100644
index 00000000000..15900aa7215
--- /dev/null
+++ b/website/docs/cdktf/python/r/servicequotas_template_association.html.markdown
@@ -0,0 +1,67 @@
+---
+subcategory: "Service Quotas"
+layout: "aws"
+page_title: "AWS: aws_servicequotas_template_association"
+description: |-
+  Terraform resource for managing an AWS Service Quotas Template Association.
+---
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_servicequotas_template_association
+
+Terraform resource for managing an AWS Service Quotas Template Association.
+
+-> Only the management account of an organization can associate Service Quota templates, and this must be done from the `us-east-1` region.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.servicequotas_template_association import ServicequotasTemplateAssociation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ServicequotasTemplateAssociation(self, "example")
+```
+
+## Argument Reference
+
+The following arguments are optional:
+
+* `skip_destroy` - (Optional) Skip disassociating the quota increase template upon destruction. This will remove the resource from Terraform state, but leave the remote association in place.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - AWS account ID.
+* `status` - Association status. Creating this resource will result in an `ASSOCIATED` status, and quota increase requests in the template are automatically applied to new AWS accounts in the organization.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Service Quotas Template Association using the `example_id_arg`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Service Quotas Template Association using the `id`. For example:
+
+```console
+% terraform import aws_servicequotas_template_association.example 012345678901 
+```
+
+<!-- cache-key: cdktf-0.18.0 input-fdad063536f53c98a55bc859f198823854c380bdaf86b74a52d56b0f744c6e20 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ses_active_receipt_rule_set.html.markdown b/website/docs/cdktf/python/r/ses_active_receipt_rule_set.html.markdown
new file mode 100644
index 00000000000..b7e95e1465b
--- /dev/null
+++ b/website/docs/cdktf/python/r/ses_active_receipt_rule_set.html.markdown
@@ -0,0 +1,66 @@
+---
+subcategory: "SES (Simple Email)"
+layout: "aws"
+page_title: "AWS: aws_ses_active_receipt_rule_set"
+description: |-
+  Provides a resource to designate the active SES receipt rule set
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ses_active_receipt_rule_set
+
+Provides a resource to designate the active SES receipt rule set
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ses_active_receipt_rule_set import SesActiveReceiptRuleSet
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SesActiveReceiptRuleSet(self, "main",
+            rule_set_name="primary-rules"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `rule_set_name` - (Required) The name of the rule set
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The SES receipt rule set name.
+* `arn` - The SES receipt rule set ARN.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import active SES receipt rule sets using the rule set name. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import active SES receipt rule sets using the rule set name. For example:
+
+```console
+% terraform import aws_ses_active_receipt_rule_set.my_rule_set my_rule_set_name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-8aa116a29d3ebaa80524e2c31efd1f8f2d61078377ae336e09f4241a5b71237e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ses_configuration_set.html.markdown b/website/docs/cdktf/python/r/ses_configuration_set.html.markdown
new file mode 100644
index 00000000000..38c1327cc0b
--- /dev/null
+++ b/website/docs/cdktf/python/r/ses_configuration_set.html.markdown
@@ -0,0 +1,104 @@
+---
+subcategory: "SES (Simple Email)"
+layout: "aws"
+page_title: "AWS: aws_ses_configuration_set"
+description: |-
+  Provides an SES configuration set
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ses_configuration_set
+
+Provides an SES configuration set resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ses_configuration_set import SesConfigurationSet
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SesConfigurationSet(self, "test",
+            name="some-configuration-set-test"
+        )
+```
+
+### Require TLS Connections
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ses_configuration_set import SesConfigurationSet
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SesConfigurationSet(self, "test",
+            delivery_options=SesConfigurationSetDeliveryOptions(
+                tls_policy="Require"
+            ),
+            name="some-configuration-set-test"
+        )
+```
+
+## Argument Reference
+
+The following argument is required:
+
+* `name` - (Required) Name of the configuration set.
+
+The following argument is optional:
+
+* `delivery_options` - (Optional) Whether messages that use the configuration set are required to use TLS. See below.
+* `reputation_metrics_enabled` - (Optional) Whether or not Amazon SES publishes reputation metrics for the configuration set, such as bounce and complaint rates, to Amazon CloudWatch. The default value is `false`.
+* `sending_enabled` - (Optional) Whether email sending is enabled or disabled for the configuration set. The default value is `true`.
+* `tracking_options` - (Optional) Domain that is used to redirect email recipients to an Amazon SES-operated domain. See below. **NOTE:** This functionality is best effort.
+
+### delivery_options
+
+* `tls_policy` - (Optional) Whether messages that use the configuration set are required to use Transport Layer Security (TLS). If the value is `Require`, messages are only delivered if a TLS connection can be established. If the value is `Optional`, messages can be delivered in plain text if a TLS connection can't be established. Valid values: `Require` or `Optional`. Defaults to `Optional`.
+
+### tracking_options
+
+* `custom_redirect_domain` - (Optional) Custom subdomain that is used to redirect email recipients to the Amazon SES event tracking domain.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - SES configuration set ARN.
+* `id` - SES configuration set name.
+* `last_fresh_start` - Date and time at which the reputation metrics for the configuration set were last reset. Resetting these metrics is known as a fresh start.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SES Configuration Sets using their `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import SES Configuration Sets using their `name`. For example:
+
+```console
+% terraform import aws_ses_configuration_set.test some-configuration-set-test
+```
+
+<!-- cache-key: cdktf-0.18.0 input-f167d5f7a447e1e139965df3ad14d43f4a2543a8bacced24d5237b68849262b5 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ses_domain_dkim.html.markdown b/website/docs/cdktf/python/r/ses_domain_dkim.html.markdown
new file mode 100644
index 00000000000..382167687c5
--- /dev/null
+++ b/website/docs/cdktf/python/r/ses_domain_dkim.html.markdown
@@ -0,0 +1,100 @@
+---
+subcategory: "SES (Simple Email)"
+layout: "aws"
+page_title: "AWS: aws_ses_domain_dkim"
+description: |-
+  Provides an SES domain DKIM generation resource
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ses_domain_dkim
+
+Provides an SES domain DKIM generation resource.
+
+Domain ownership needs to be confirmed first using [ses_domain_identity Resource](/docs/providers/aws/r/ses_domain_identity.html)
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `domain` - (Required) Verified domain name to generate DKIM tokens for.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `dkim_tokens` - DKIM tokens generated by SES.
+  These tokens should be used to create CNAME records used to verify SES Easy DKIM.
+  See below for an example of how this might be achieved
+  when the domain is hosted in Route 53 and managed by Terraform.
+  Find out more about verifying domains in Amazon SES
+  in the [AWS SES docs](http://docs.aws.amazon.com/ses/latest/DeveloperGuide/easy-dkim-dns-records.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformCount, Fn, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.route53_record import Route53Record
+from imports.aws.ses_domain_dkim import SesDomainDkim
+from imports.aws.ses_domain_identity import SesDomainIdentity
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = SesDomainIdentity(self, "example",
+            domain="example.com"
+        )
+        aws_ses_domain_dkim_example = SesDomainDkim(self, "example_1",
+            domain=example.domain
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_ses_domain_dkim_example.override_logical_id("example")
+        # In most cases loops should be handled in the programming language context and
+        #     not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+        #     you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+        #     you need to keep this like it is.
+        example_amazonses_dkim_record_count = TerraformCount.of(
+            Token.as_number("3"))
+        Route53Record(self, "example_amazonses_dkim_record",
+            name=
+            Token.as_string(
+                Fn.lookup_nested(aws_ses_domain_dkim_example.dkim_tokens, [example_amazonses_dkim_record_count.index
+                ])) + "._domainkey",
+            records=[
+                Token.as_string(
+                    Fn.lookup_nested(aws_ses_domain_dkim_example.dkim_tokens, [example_amazonses_dkim_record_count.index
+                    ])) + ".dkim.amazonses.com"
+            ],
+            ttl=Token.as_number("600"),
+            type="CNAME",
+            zone_id="ABCDEFGHIJ123",
+            count=example_amazonses_dkim_record_count
+        )
+```
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DKIM tokens using the `domain` attribute. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import DKIM tokens using the `domain` attribute. For example:
+
+```console
+% terraform import aws_ses_domain_dkim.example example.com
+```
+
+<!-- cache-key: cdktf-0.18.0 input-39725dfa611ba6cca577c30709217ceb82a4f67575d3367fd44ba5c674ea4983 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ses_domain_identity.html.markdown b/website/docs/cdktf/python/r/ses_domain_identity.html.markdown
new file mode 100644
index 00000000000..92cc711b07f
--- /dev/null
+++ b/website/docs/cdktf/python/r/ses_domain_identity.html.markdown
@@ -0,0 +1,102 @@
+---
+subcategory: "SES (Simple Email)"
+layout: "aws"
+page_title: "AWS: aws_ses_domain_identity"
+description: |-
+  Provides an SES domain identity resource
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ses_domain_identity
+
+Provides an SES domain identity resource
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ses_domain_identity import SesDomainIdentity
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SesDomainIdentity(self, "example",
+            domain="example.com"
+        )
+```
+
+### With Route53 Record
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.route53_record import Route53Record
+from imports.aws.ses_domain_identity import SesDomainIdentity
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = SesDomainIdentity(self, "example",
+            domain="example.com"
+        )
+        Route53Record(self, "example_amazonses_verification_record",
+            name="_amazonses.example.com",
+            records=[example.verification_token],
+            ttl=Token.as_number("600"),
+            type="TXT",
+            zone_id="ABCDEFGHIJ123"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `domain` - (Required) The domain name to assign to SES
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the domain identity.
+* `verification_token` - A code which when added to the domain as a TXT record
+  will signal to SES that the owner of the domain has authorised SES to act on
+  their behalf. The domain identity will be in state "verification pending"
+  until this is done. See the [With Route53 Record](#with-route53-record) example
+  for how this might be achieved when the domain is hosted in Route 53 and
+  managed by Terraform.  Find out more about verifying domains in Amazon
+  SES in the [AWS SES
+  docs](http://docs.aws.amazon.com/ses/latest/DeveloperGuide/verify-domains.html).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SES domain identities using the domain name. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import SES domain identities using the domain name. For example:
+
+```console
+% terraform import aws_ses_domain_identity.example example.com
+```
+
+<!-- cache-key: cdktf-0.18.0 input-cc2858bb0b9356bccdccc74446c2439c161fce45d5adfa4eb3e71a8f789e30b8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ses_domain_identity_verification.html.markdown b/website/docs/cdktf/python/r/ses_domain_identity_verification.html.markdown
new file mode 100644
index 00000000000..a3976432f58
--- /dev/null
+++ b/website/docs/cdktf/python/r/ses_domain_identity_verification.html.markdown
@@ -0,0 +1,72 @@
+---
+subcategory: "SES (Simple Email)"
+layout: "aws"
+page_title: "AWS: aws_ses_domain_identity_verification"
+description: |-
+  Waits for and checks successful verification of an SES domain identity.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ses_domain_identity_verification
+
+Represents a successful verification of an SES domain identity.
+
+Most commonly, this resource is used together with [`aws_route53_record`](route53_record.html) and
+[`aws_ses_domain_identity`](ses_domain_identity.html) to request an SES domain identity,
+deploy the required DNS verification records, and wait for verification to complete.
+
+~> **WARNING:** This resource implements a part of the verification workflow. It does not represent a real-world entity in AWS, therefore changing or deleting this resource on its own has no immediate effect.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.route53_record import Route53Record
+from imports.aws.ses_domain_identity import SesDomainIdentity
+from imports.aws.ses_domain_identity_verification import SesDomainIdentityVerification
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = SesDomainIdentity(self, "example",
+            domain="example.com"
+        )
+        example_amazonses_verification_record = Route53Record(self, "example_amazonses_verification_record",
+            name="_amazonses.${" + example.id + "}",
+            records=[example.verification_token],
+            ttl=Token.as_number("600"),
+            type="TXT",
+            zone_id=Token.as_string(aws_route53_zone_example.zone_id)
+        )
+        SesDomainIdentityVerification(self, "example_verification",
+            depends_on=[example_amazonses_verification_record],
+            domain=example.id
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `domain` - (Required) The domain name of the SES domain identity to verify.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The domain name of the domain identity.
+* `arn` - The ARN of the domain identity.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `45m`)
+
+<!-- cache-key: cdktf-0.18.0 input-01264da5e2e5cedeff8b5da6bb3720236b99d8827e99483d8586f6e5626fdcb4 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ses_domain_mail_from.html.markdown b/website/docs/cdktf/python/r/ses_domain_mail_from.html.markdown
new file mode 100644
index 00000000000..abb30ace0f1
--- /dev/null
+++ b/website/docs/cdktf/python/r/ses_domain_mail_from.html.markdown
@@ -0,0 +1,122 @@
+---
+subcategory: "SES (Simple Email)"
+layout: "aws"
+page_title: "AWS: aws_ses_domain_mail_from"
+description: |-
+  Provides an SES domain MAIL FROM resource
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ses_domain_mail_from
+
+Provides an SES domain MAIL FROM resource.
+
+~> **NOTE:** For the MAIL FROM domain to be fully usable, this resource should be paired with the [aws_ses_domain_identity resource](/docs/providers/aws/r/ses_domain_identity.html). To validate the MAIL FROM domain, a DNS MX record is required. To pass SPF checks, a DNS TXT record may also be required. See the [Amazon SES MAIL FROM documentation](https://docs.aws.amazon.com/ses/latest/dg/mail-from.html) for more information.
+
+## Example Usage
+
+### Domain Identity MAIL FROM
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.route53_record import Route53Record
+from imports.aws.ses_domain_identity import SesDomainIdentity
+from imports.aws.ses_domain_mail_from import SesDomainMailFrom
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = SesDomainIdentity(self, "example",
+            domain="example.com"
+        )
+        aws_ses_domain_mail_from_example = SesDomainMailFrom(self, "example_1",
+            domain=example.domain,
+            mail_from_domain="bounce.${" + example.domain + "}"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_ses_domain_mail_from_example.override_logical_id("example")
+        Route53Record(self, "example_ses_domain_mail_from_mx",
+            name=Token.as_string(aws_ses_domain_mail_from_example.mail_from_domain),
+            records=["10 feedback-smtp.us-east-1.amazonses.com"],
+            ttl=Token.as_number("600"),
+            type="MX",
+            zone_id=Token.as_string(aws_route53_zone_example.id)
+        )
+        Route53Record(self, "example_ses_domain_mail_from_txt",
+            name=Token.as_string(aws_ses_domain_mail_from_example.mail_from_domain),
+            records=["v=spf1 include:amazonses.com -all"],
+            ttl=Token.as_number("600"),
+            type="TXT",
+            zone_id=Token.as_string(aws_route53_zone_example.id)
+        )
+```
+
+### Email Identity MAIL FROM
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ses_domain_mail_from import SesDomainMailFrom
+from imports.aws.ses_email_identity import SesEmailIdentity
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = SesEmailIdentity(self, "example",
+            email="user@example.com"
+        )
+        aws_ses_domain_mail_from_example = SesDomainMailFrom(self, "example_1",
+            domain=example.email,
+            mail_from_domain="mail.example.com"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_ses_domain_mail_from_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `domain` - (Required) Verified domain name or email identity to generate DKIM tokens for.
+* `mail_from_domain` - (Required) Subdomain (of above domain) which is to be used as MAIL FROM address (Required for DMARC validation)
+
+The following arguments are optional:
+
+* `behavior_on_mx_failure` - (Optional) The action that you want Amazon SES to take if it cannot successfully read the required MX record when you send an email. Defaults to `UseDefaultValue`. See the [SES API documentation](https://docs.aws.amazon.com/ses/latest/APIReference/API_SetIdentityMailFromDomain.html) for more information.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The domain name.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import MAIL FROM domain using the `domain` attribute. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import MAIL FROM domain using the `domain` attribute. For example:
+
+```console
+% terraform import aws_ses_domain_mail_from.example example.com
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ca24fb442521ea4cf6a544f70a00738a2579cf348f475450dda372fb8e1b83f2 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ses_email_identity.html.markdown b/website/docs/cdktf/python/r/ses_email_identity.html.markdown
new file mode 100644
index 00000000000..28155ef674a
--- /dev/null
+++ b/website/docs/cdktf/python/r/ses_email_identity.html.markdown
@@ -0,0 +1,65 @@
+---
+subcategory: "SES (Simple Email)"
+layout: "aws"
+page_title: "AWS: aws_ses_email_identity"
+description: |-
+  Provides an SES email identity resource
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ses_email_identity
+
+Provides an SES email identity resource
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `email` - (Required) The email address to assign to SES.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the email identity.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ses_email_identity import SesEmailIdentity
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SesEmailIdentity(self, "example",
+            email="email@example.com"
+        )
+```
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SES email identities using the email address. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import SES email identities using the email address. For example:
+
+```console
+% terraform import aws_ses_email_identity.example email@example.com
+```
+
+<!-- cache-key: cdktf-0.18.0 input-9ee137609ad9cb08db52c9c4a87855644f4683c0869afce90196dedff75a0c90 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ses_event_destination.html.markdown b/website/docs/cdktf/python/r/ses_event_destination.html.markdown
new file mode 100644
index 00000000000..d34b3dca323
--- /dev/null
+++ b/website/docs/cdktf/python/r/ses_event_destination.html.markdown
@@ -0,0 +1,151 @@
+---
+subcategory: "SES (Simple Email)"
+layout: "aws"
+page_title: "AWS: aws_ses_event_destination"
+description: |-
+  Provides an SES event destination
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ses_event_destination
+
+Provides an SES event destination
+
+## Example Usage
+
+### CloudWatch Destination
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ses_event_destination import SesEventDestination
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SesEventDestination(self, "cloudwatch",
+            cloudwatch_destination=[SesEventDestinationCloudwatchDestination(
+                default_value="default",
+                dimension_name="dimension",
+                value_source="emailHeader"
+            )
+            ],
+            configuration_set_name=example.name,
+            enabled=True,
+            matching_types=["bounce", "send"],
+            name="event-destination-cloudwatch"
+        )
+```
+
+### Kinesis Destination
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ses_event_destination import SesEventDestination
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SesEventDestination(self, "kinesis",
+            configuration_set_name=example.name,
+            enabled=True,
+            kinesis_destination=SesEventDestinationKinesisDestination(
+                role_arn=Token.as_string(aws_iam_role_example.arn),
+                stream_arn=Token.as_string(aws_kinesis_firehose_delivery_stream_example.arn)
+            ),
+            matching_types=["bounce", "send"],
+            name="event-destination-kinesis"
+        )
+```
+
+### SNS Destination
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ses_event_destination import SesEventDestination
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SesEventDestination(self, "sns",
+            configuration_set_name=example.name,
+            enabled=True,
+            matching_types=["bounce", "send"],
+            name="event-destination-sns",
+            sns_destination=SesEventDestinationSnsDestination(
+                topic_arn=Token.as_string(aws_sns_topic_example.arn)
+            )
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the event destination
+* `configuration_set_name` - (Required) The name of the configuration set
+* `enabled` - (Optional) If true, the event destination will be enabled
+* `matching_types` - (Required) A list of matching types. May be any of `"send"`, `"reject"`, `"bounce"`, `"complaint"`, `"delivery"`, `"open"`, `"click"`, or `"renderingFailure"`.
+* `cloudwatch_destination` - (Optional) CloudWatch destination for the events
+* `kinesis_destination` - (Optional) Send the events to a kinesis firehose destination
+* `sns_destination` - (Optional) Send the events to an SNS Topic destination
+
+~> **NOTE:** You can specify `"cloudwatch_destination"` or `"kinesis_destination"` but not both
+
+### cloudwatch_destination Argument Reference
+
+* `default_value` - (Required) The default value for the event
+* `dimension_name` - (Required) The name for the dimension
+* `value_source` - (Required) The source for the value. May be any of `"messageTag"`, `"emailHeader"` or `"linkTag"`.
+
+### kinesis_destination Argument Reference
+
+* `stream_arn` - (Required) The ARN of the Kinesis Stream
+* `role_arn` - (Required) The ARN of the role that has permissions to access the Kinesis Stream
+
+### sns_destination Argument Reference
+
+* `topic_arn` - (Required) The ARN of the SNS topic
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The SES event destination name.
+* `arn` - The SES event destination ARN.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SES event destinations using `configuration_set_name` together with the event destination's `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import SES event destinations using `configuration_set_name` together with the event destination's `name`. For example:
+
+```console
+% terraform import aws_ses_event_destination.sns some-configuration-set-test/event-destination-sns
+```
+
+<!-- cache-key: cdktf-0.18.0 input-03d0657b4ec477015386f442c464924c2a2cf73364ec9a281d1dab9658fde299 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ses_identity_notification_topic.html.markdown b/website/docs/cdktf/python/r/ses_identity_notification_topic.html.markdown
new file mode 100644
index 00000000000..17600ede71e
--- /dev/null
+++ b/website/docs/cdktf/python/r/ses_identity_notification_topic.html.markdown
@@ -0,0 +1,69 @@
+---
+subcategory: "SES (Simple Email)"
+layout: "aws"
+page_title: "AWS: aws_ses_identity_notification_topic"
+description: |-
+  Setting AWS SES Identity Notification Topic
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ses_identity_notification_topic
+
+Resource for managing SES Identity Notification Topics
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ses_identity_notification_topic import SesIdentityNotificationTopic
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SesIdentityNotificationTopic(self, "test",
+            identity=example.domain,
+            include_original_headers=True,
+            notification_type="Bounce",
+            topic_arn=Token.as_string(aws_sns_topic_example.arn)
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `topic_arn` - (Optional) The Amazon Resource Name (ARN) of the Amazon SNS topic. Can be set to `""` (an empty string) to disable publishing.
+* `notification_type` - (Required) The type of notifications that will be published to the specified Amazon SNS topic. Valid Values: `Bounce`, `Complaint` or `Delivery`.
+* `identity` - (Required) The identity for which the Amazon SNS topic will be set. You can specify an identity by using its name or by using its Amazon Resource Name (ARN).
+* `include_original_headers` - (Optional) Whether SES should include original email headers in SNS notifications of this type. `false` by default.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Identity Notification Topics using the ID of the record. The ID is made up as `IDENTITY|TYPE` where `IDENTITY` is the SES Identity and `TYPE` is the Notification Type. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Identity Notification Topics using the ID of the record. The ID is made up as `IDENTITY|TYPE` where `IDENTITY` is the SES Identity and `TYPE` is the Notification Type. For example:
+
+```console
+% terraform import aws_ses_identity_notification_topic.test 'example.com|Bounce'
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1fd58b89206153f067a3a6422fdd5ac0bb0cbc19db85bec1ae6fff15e992d4ac -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ses_identity_notification_topic.markdown b/website/docs/cdktf/python/r/ses_identity_notification_topic.markdown
new file mode 100644
index 00000000000..17600ede71e
--- /dev/null
+++ b/website/docs/cdktf/python/r/ses_identity_notification_topic.markdown
@@ -0,0 +1,69 @@
+---
+subcategory: "SES (Simple Email)"
+layout: "aws"
+page_title: "AWS: aws_ses_identity_notification_topic"
+description: |-
+  Setting AWS SES Identity Notification Topic
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ses_identity_notification_topic
+
+Resource for managing SES Identity Notification Topics
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ses_identity_notification_topic import SesIdentityNotificationTopic
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SesIdentityNotificationTopic(self, "test",
+            identity=example.domain,
+            include_original_headers=True,
+            notification_type="Bounce",
+            topic_arn=Token.as_string(aws_sns_topic_example.arn)
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `topic_arn` - (Optional) The Amazon Resource Name (ARN) of the Amazon SNS topic. Can be set to `""` (an empty string) to disable publishing.
+* `notification_type` - (Required) The type of notifications that will be published to the specified Amazon SNS topic. Valid Values: `Bounce`, `Complaint` or `Delivery`.
+* `identity` - (Required) The identity for which the Amazon SNS topic will be set. You can specify an identity by using its name or by using its Amazon Resource Name (ARN).
+* `include_original_headers` - (Optional) Whether SES should include original email headers in SNS notifications of this type. `false` by default.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Identity Notification Topics using the ID of the record. The ID is made up as `IDENTITY|TYPE` where `IDENTITY` is the SES Identity and `TYPE` is the Notification Type. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Identity Notification Topics using the ID of the record. The ID is made up as `IDENTITY|TYPE` where `IDENTITY` is the SES Identity and `TYPE` is the Notification Type. For example:
+
+```console
+% terraform import aws_ses_identity_notification_topic.test 'example.com|Bounce'
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1fd58b89206153f067a3a6422fdd5ac0bb0cbc19db85bec1ae6fff15e992d4ac -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ses_identity_policy.html.markdown b/website/docs/cdktf/python/r/ses_identity_policy.html.markdown
new file mode 100644
index 00000000000..d600b9f3a35
--- /dev/null
+++ b/website/docs/cdktf/python/r/ses_identity_policy.html.markdown
@@ -0,0 +1,88 @@
+---
+subcategory: "SES (Simple Email)"
+layout: "aws"
+page_title: "AWS: aws_ses_identity_policy"
+description: |-
+  Manages a SES Identity Policy
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ses_identity_policy
+
+Manages a SES Identity Policy. More information about SES Sending Authorization Policies can be found in the [SES Developer Guide](https://docs.aws.amazon.com/ses/latest/DeveloperGuide/sending-authorization-policies.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.ses_domain_identity import SesDomainIdentity
+from imports.aws.ses_identity_policy import SesIdentityPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = SesDomainIdentity(self, "example",
+            domain="example.com"
+        )
+        data_aws_iam_policy_document_example = DataAwsIamPolicyDocument(self, "example_1",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["SES:SendEmail", "SES:SendRawEmail"],
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["*"],
+                    type="AWS"
+                )
+                ],
+                resources=[example.arn]
+            )
+            ]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_iam_policy_document_example.override_logical_id("example")
+        aws_ses_identity_policy_example = SesIdentityPolicy(self, "example_2",
+            identity=example.arn,
+            name="example",
+            policy=Token.as_string(data_aws_iam_policy_document_example.json)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_ses_identity_policy_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `identity` - (Required) Name or Amazon Resource Name (ARN) of the SES Identity.
+* `name` - (Required) Name of the policy.
+* `policy` - (Required) JSON string of the policy. For more information about building AWS IAM policy documents with Terraform, see the [AWS IAM Policy Document Guide](https://learn.hashicorp.com/terraform/aws/iam-policy).
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SES Identity Policies using the identity and policy name, separated by a pipe character (`|`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import SES Identity Policies using the identity and policy name, separated by a pipe character (`|`). For example:
+
+```console
+% terraform import aws_ses_identity_policy.example 'example.com|example'
+```
+
+<!-- cache-key: cdktf-0.18.0 input-2c45ba1c268b42067effb76b3698082d64f075923127efb622a58e4e81a1ba1a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ses_receipt_filter.html.markdown b/website/docs/cdktf/python/r/ses_receipt_filter.html.markdown
new file mode 100644
index 00000000000..4edb073fed1
--- /dev/null
+++ b/website/docs/cdktf/python/r/ses_receipt_filter.html.markdown
@@ -0,0 +1,70 @@
+---
+subcategory: "SES (Simple Email)"
+layout: "aws"
+page_title: "AWS: aws_ses_receipt_filter"
+description: |-
+  Provides an SES receipt filter
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ses_receipt_filter
+
+Provides an SES receipt filter resource
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ses_receipt_filter import SesReceiptFilter
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SesReceiptFilter(self, "filter",
+            cidr="10.10.10.10",
+            name="block-spammer",
+            policy="Block"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the filter
+* `cidr` - (Required) The IP address or address range to filter, in CIDR notation
+* `policy` - (Required) Block or Allow
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The SES receipt filter name.
+* `arn` - The SES receipt filter ARN.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SES Receipt Filter using their `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import SES Receipt Filter using their `name`. For example:
+
+```console
+% terraform import aws_ses_receipt_filter.test some-filter
+```
+
+<!-- cache-key: cdktf-0.18.0 input-8c7377efc81dac65453231c48c63abd93967d88ece4a6461b108dcb4049f1c6b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ses_receipt_rule.html.markdown b/website/docs/cdktf/python/r/ses_receipt_rule.html.markdown
new file mode 100644
index 00000000000..f1a85f2be66
--- /dev/null
+++ b/website/docs/cdktf/python/r/ses_receipt_rule.html.markdown
@@ -0,0 +1,142 @@
+---
+subcategory: "SES (Simple Email)"
+layout: "aws"
+page_title: "AWS: aws_ses_receipt_rule"
+description: |-
+  Provides an SES receipt rule resource
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ses_receipt_rule
+
+Provides an SES receipt rule resource
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ses_receipt_rule import SesReceiptRule
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SesReceiptRule(self, "store",
+            add_header_action=[SesReceiptRuleAddHeaderAction(
+                header_name="Custom-Header",
+                header_value="Added by SES",
+                position=1
+            )
+            ],
+            enabled=True,
+            name="store",
+            recipients=["karen@example.com"],
+            rule_set_name="default-rule-set",
+            s3_action=[SesReceiptRuleS3Action(
+                bucket_name="emails",
+                position=2
+            )
+            ],
+            scan_enabled=True
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the rule
+* `rule_set_name` - (Required) The name of the rule set
+* `after` - (Optional) The name of the rule to place this rule after
+* `enabled` - (Optional) If true, the rule will be enabled
+* `recipients` - (Optional) A list of email addresses
+* `scan_enabled` - (Optional) If true, incoming emails will be scanned for spam and viruses
+* `tls_policy` - (Optional) `Require` or `Optional`
+* `add_header_action` - (Optional) A list of Add Header Action blocks. Documented below.
+* `bounce_action` - (Optional) A list of Bounce Action blocks. Documented below.
+* `lambda_action` - (Optional) A list of Lambda Action blocks. Documented below.
+* `s3_action` - (Optional) A list of S3 Action blocks. Documented below.
+* `sns_action` - (Optional) A list of SNS Action blocks. Documented below.
+* `stop_action` - (Optional) A list of Stop Action blocks. Documented below.
+* `workmail_action` - (Optional) A list of WorkMail Action blocks. Documented below.
+
+Add header actions support the following:
+
+* `header_name` - (Required) The name of the header to add
+* `header_value` - (Required) The value of the header to add
+* `position` - (Required) The position of the action in the receipt rule
+
+Bounce actions support the following:
+
+* `message` - (Required) The message to send
+* `sender` - (Required) The email address of the sender
+* `smtp_reply_code` - (Required) The RFC 5321 SMTP reply code
+* `status_code` - (Optional) The RFC 3463 SMTP enhanced status code
+* `topic_arn` - (Optional) The ARN of an SNS topic to notify
+* `position` - (Required) The position of the action in the receipt rule
+
+Lambda actions support the following:
+
+* `function_arn` - (Required) The ARN of the Lambda function to invoke
+* `invocation_type` - (Optional) `Event` or `RequestResponse`
+* `topic_arn` - (Optional) The ARN of an SNS topic to notify
+* `position` - (Required) The position of the action in the receipt rule
+
+S3 actions support the following:
+
+* `bucket_name` - (Required) The name of the S3 bucket
+* `kms_key_arn` - (Optional) The ARN of the KMS key
+* `object_key_prefix` - (Optional) The key prefix of the S3 bucket
+* `topic_arn` - (Optional) The ARN of an SNS topic to notify
+* `position` - (Required) The position of the action in the receipt rule
+
+SNS actions support the following:
+
+* `topic_arn` - (Required) The ARN of an SNS topic to notify
+* `position` - (Required) The position of the action in the receipt rule
+* `encoding` - (Optional) The encoding to use for the email within the Amazon SNS notification. Default value is `UTF-8`.
+
+Stop actions support the following:
+
+* `scope` - (Required) The scope to apply. The only acceptable value is `RuleSet`.
+* `topic_arn` - (Optional) The ARN of an SNS topic to notify
+* `position` - (Required) The position of the action in the receipt rule
+
+WorkMail actions support the following:
+
+* `organization_arn` - (Required) The ARN of the WorkMail organization
+* `topic_arn` - (Optional) The ARN of an SNS topic to notify
+* `position` - (Required) The position of the action in the receipt rule
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The SES receipt rule name.
+* `arn` - The SES receipt rule ARN.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SES receipt rules using the ruleset name and rule name separated by `:`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import SES receipt rules using the ruleset name and rule name separated by `:`. For example:
+
+```console
+% terraform import aws_ses_receipt_rule.my_rule my_rule_set:my_rule
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ab45199c3afbc7c5a3c72ec3d4ff7c87e01a23be591b82978865a7ece9fb3494 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ses_receipt_rule_set.html.markdown b/website/docs/cdktf/python/r/ses_receipt_rule_set.html.markdown
new file mode 100644
index 00000000000..c8ec9d37469
--- /dev/null
+++ b/website/docs/cdktf/python/r/ses_receipt_rule_set.html.markdown
@@ -0,0 +1,66 @@
+---
+subcategory: "SES (Simple Email)"
+layout: "aws"
+page_title: "AWS: aws_ses_receipt_rule_set"
+description: |-
+  Provides an SES receipt rule set resource
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ses_receipt_rule_set
+
+Provides an SES receipt rule set resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ses_receipt_rule_set import SesReceiptRuleSet
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SesReceiptRuleSet(self, "main",
+            rule_set_name="primary-rules"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `rule_set_name` - (Required) Name of the rule set.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - SES receipt rule set ARN.
+* `id` - SES receipt rule set name.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SES receipt rule sets using the rule set name. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import SES receipt rule sets using the rule set name. For example:
+
+```console
+% terraform import aws_ses_receipt_rule_set.my_rule_set my_rule_set_name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-0d877bac24ed87212b80e2c78837bf3e21a1e3f3f1043d12a6eba7d226aa1682 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ses_template.html.markdown b/website/docs/cdktf/python/r/ses_template.html.markdown
new file mode 100644
index 00000000000..2aec15ea9f0
--- /dev/null
+++ b/website/docs/cdktf/python/r/ses_template.html.markdown
@@ -0,0 +1,72 @@
+---
+subcategory: "SES (Simple Email)"
+layout: "aws"
+page_title: "AWS: aws_ses_template"
+description: |-
+  Provides a resource to create a SES template
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ses_template
+
+Provides a resource to create a SES template.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ses_template import SesTemplate
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SesTemplate(self, "MyTemplate",
+            html="<h1>Hello {{name}},</h1><p>Your favorite animal is {{favoriteanimal}}.</p>",
+            name="MyTemplate",
+            subject="Greetings, {{name}}!",
+            text="Hello {{name}},\r\nYour favorite animal is {{favoriteanimal}}.\n"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the template. Cannot exceed 64 characters. You will refer to this name when you send email.
+* `html` - (Optional) The HTML body of the email. Must be less than 500KB in size, including both the text and HTML parts.
+* `subject` - (Optional) The subject line of the email.
+* `text` - (Optional) The email body that will be visible to recipients whose email clients do not display HTML. Must be less than 500KB in size, including both the text and HTML parts.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the SES template
+* `id` - The name of the SES template
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SES templates using the template name. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import SES templates using the template name. For example:
+
+```console
+% terraform import aws_ses_template.MyTemplate MyTemplate
+```
+
+<!-- cache-key: cdktf-0.18.0 input-89f6a47e22acad1bd893a7574f8e49d30c8778128ae5a667746ded2b1f55f3f8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/sesv2_account_vdm_attributes.html.markdown b/website/docs/cdktf/python/r/sesv2_account_vdm_attributes.html.markdown
new file mode 100644
index 00000000000..30c19491fad
--- /dev/null
+++ b/website/docs/cdktf/python/r/sesv2_account_vdm_attributes.html.markdown
@@ -0,0 +1,84 @@
+---
+subcategory: "SESv2 (Simple Email V2)"
+layout: "aws"
+page_title: "AWS: aws_sesv2_account_vdm_attributes"
+description: |-
+  Terraform resource for managing an AWS SESv2 (Simple Email V2) Account VDM Attributes.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sesv2_account_vdm_attributes
+
+Terraform resource for managing an AWS SESv2 (Simple Email V2) Account VDM Attributes.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.sesv2_account_vdm_attributes import Sesv2AccountVdmAttributes
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Sesv2AccountVdmAttributes(self, "example",
+            dashboard_attributes=Sesv2AccountVdmAttributesDashboardAttributes(
+                engagement_metrics="ENABLED"
+            ),
+            guardian_attributes=Sesv2AccountVdmAttributesGuardianAttributes(
+                optimized_shared_delivery="ENABLED"
+            ),
+            vdm_enabled="ENABLED"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `vdm_enabled` - (Required) Specifies the status of your VDM configuration. Valid values: `ENABLED`, `DISABLED`.
+
+The following arguments are optional:
+
+* `dashboard_attributes` - (Optional) Specifies additional settings for your VDM configuration as applicable to the Dashboard.
+* `guardian_attributes` - (Optional) Specifies additional settings for your VDM configuration as applicable to the Guardian.
+
+### dashboard_attributes
+
+* `engagement_metrics` - (Optional) Specifies the status of your VDM engagement metrics collection. Valid values: `ENABLED`, `DISABLED`.
+
+### guardian_attributes
+
+* `optimized_shared_delivery` - (Optional) Specifies the status of your VDM optimized shared delivery. Valid values: `ENABLED`, `DISABLED`.
+
+## Attribute Reference
+
+This data source exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SESv2 (Simple Email V2) Account VDM Attributes using the word `ses-account-vdm-attributes`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import SESv2 (Simple Email V2) Account VDM Attributes using the word `ses-account-vdm-attributes`. For example:
+
+```console
+% terraform import aws_sesv2_account_vdm_attributes.example ses-account-vdm-attributes
+```
+
+<!-- cache-key: cdktf-0.18.0 input-b4d0b06f4304f2a2394a2efa012918dd4528d7fc4bfc11ed8de9b1f68d2751e1 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/sesv2_configuration_set.html.markdown b/website/docs/cdktf/python/r/sesv2_configuration_set.html.markdown
new file mode 100644
index 00000000000..1e428ca2303
--- /dev/null
+++ b/website/docs/cdktf/python/r/sesv2_configuration_set.html.markdown
@@ -0,0 +1,131 @@
+---
+subcategory: "SESv2 (Simple Email V2)"
+layout: "aws"
+page_title: "AWS: aws_sesv2_configuration_set"
+description: |-
+  Terraform resource for managing an AWS SESv2 (Simple Email V2) Configuration Set.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sesv2_configuration_set
+
+Terraform resource for managing an AWS SESv2 (Simple Email V2) Configuration Set.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.sesv2_configuration_set import Sesv2ConfigurationSet
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Sesv2ConfigurationSet(self, "example",
+            configuration_set_name="example",
+            delivery_options=Sesv2ConfigurationSetDeliveryOptions(
+                tls_policy="REQUIRE"
+            ),
+            reputation_options=Sesv2ConfigurationSetReputationOptions(
+                reputation_metrics_enabled=False
+            ),
+            sending_options=Sesv2ConfigurationSetSendingOptions(
+                sending_enabled=True
+            ),
+            suppression_options=Sesv2ConfigurationSetSuppressionOptions(
+                suppressed_reasons=["BOUNCE", "COMPLAINT"]
+            ),
+            tracking_options=Sesv2ConfigurationSetTrackingOptions(
+                custom_redirect_domain="example.com"
+            )
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `configuration_set_name` - (Required) The name of the configuration set.
+* `delivery_options` - (Optional) An object that defines the dedicated IP pool that is used to send emails that you send using the configuration set.
+* `reputation_options` - (Optional) An object that defines whether or not Amazon SES collects reputation metrics for the emails that you send that use the configuration set.
+* `sending_options` - (Optional) An object that defines whether or not Amazon SES can send email that you send using the configuration set.
+* `suppression_options` - (Optional) An object that contains information about the suppression list preferences for your account.
+* `tags` - (Optional) A map of tags to assign to the service. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `tracking_options` - (Optional) An object that defines the open and click tracking options for emails that you send using the configuration set.
+* `vdm_options` - (Optional) An object that defines the VDM settings that apply to emails that you send using the configuration set.
+
+### delivery_options
+
+This argument supports the following arguments:
+
+* `sending_pool_name` - (Optional) The name of the dedicated IP pool to associate with the configuration set.
+* `tls_policy` - (Optional) Specifies whether messages that use the configuration set are required to use Transport Layer Security (TLS). Valid values: `REQUIRE`, `OPTIONAL`.
+
+### reputation_options
+
+This argument supports the following arguments:
+
+* `reputation_metrics_enabled` - (Optional) If `true`, tracking of reputation metrics is enabled for the configuration set. If `false`, tracking of reputation metrics is disabled for the configuration set.
+
+### sending_options
+
+This argument supports the following arguments:
+
+* `sending_enabled` - (Optional) If `true`, email sending is enabled for the configuration set. If `false`, email sending is disabled for the configuration set.
+
+### suppression_options
+
+* `suppressed_reasons` - (Optional) A list that contains the reasons that email addresses are automatically added to the suppression list for your account. Valid values: `BOUNCE`, `COMPLAINT`.
+
+### tracking_options
+
+* `custom_redirect_domain` - (Required) The domain to use for tracking open and click events.
+
+### vdm_options
+
+* `dashboard_options` - (Optional) Specifies additional settings for your VDM configuration as applicable to the Dashboard.
+* `guardian_options` - (Optional) Specifies additional settings for your VDM configuration as applicable to the Guardian.
+
+### dashboard_options
+
+* `engagement_metrics` - (Optional) Specifies the status of your VDM engagement metrics collection. Valid values: `ENABLED`, `DISABLED`.
+
+### guardian_options
+
+* `optimized_shared_delivery` - (Optional) Specifies the status of your VDM optimized shared delivery. Valid values: `ENABLED`, `DISABLED`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Configuration Set.
+* `reputation_options` - An object that defines whether or not Amazon SES collects reputation metrics for the emails that you send that use the configuration set.
+    * `last_fresh_start` - The date and time (in Unix time) when the reputation metrics were last given a fresh start. When your account is given a fresh start, your reputation metrics are calculated starting from the date of the fresh start.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SESv2 (Simple Email V2) Configuration Set using the `configuration_set_name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import SESv2 (Simple Email V2) Configuration Set using the `configuration_set_name`. For example:
+
+```console
+% terraform import aws_sesv2_configuration_set.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-10e28775dfdb49d09b8bd0c0f6dc69fead8aab4b14b0a6b4b6476ac6de7c155d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/sesv2_configuration_set_event_destination.html.markdown b/website/docs/cdktf/python/r/sesv2_configuration_set_event_destination.html.markdown
new file mode 100644
index 00000000000..a3a77b87730
--- /dev/null
+++ b/website/docs/cdktf/python/r/sesv2_configuration_set_event_destination.html.markdown
@@ -0,0 +1,239 @@
+---
+subcategory: "SESv2 (Simple Email V2)"
+layout: "aws"
+page_title: "AWS: aws_sesv2_configuration_set_event_destination"
+description: |-
+  Terraform resource for managing an AWS SESv2 (Simple Email V2) Configuration Set Event Destination.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sesv2_configuration_set_event_destination
+
+Terraform resource for managing an AWS SESv2 (Simple Email V2) Configuration Set Event Destination.
+
+## Example Usage
+
+### Cloud Watch Destination
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.sesv2_configuration_set import Sesv2ConfigurationSet
+from imports.aws.sesv2_configuration_set_event_destination import Sesv2ConfigurationSetEventDestination
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = Sesv2ConfigurationSet(self, "example",
+            configuration_set_name="example"
+        )
+        aws_sesv2_configuration_set_event_destination_example =
+        Sesv2ConfigurationSetEventDestination(self, "example_1",
+            configuration_set_name=example.configuration_set_name,
+            event_destination=Sesv2ConfigurationSetEventDestinationEventDestination(
+                cloud_watch_destination=Sesv2ConfigurationSetEventDestinationEventDestinationCloudWatchDestination(
+                    dimension_configuration=[Sesv2ConfigurationSetEventDestinationEventDestinationCloudWatchDestinationDimensionConfiguration(
+                        default_dimension_value="example",
+                        dimension_name="example",
+                        dimension_value_source="MESSAGE_TAG"
+                    )
+                    ]
+                ),
+                enabled=True,
+                matching_event_types=["SEND"]
+            ),
+            event_destination_name="example"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_sesv2_configuration_set_event_destination_example.override_logical_id("example")
+```
+
+### Kinesis Firehose Destination
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.sesv2_configuration_set import Sesv2ConfigurationSet
+from imports.aws.sesv2_configuration_set_event_destination import Sesv2ConfigurationSetEventDestination
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = Sesv2ConfigurationSet(self, "example",
+            configuration_set_name="example"
+        )
+        aws_sesv2_configuration_set_event_destination_example =
+        Sesv2ConfigurationSetEventDestination(self, "example_1",
+            configuration_set_name=example.configuration_set_name,
+            event_destination=Sesv2ConfigurationSetEventDestinationEventDestination(
+                enabled=True,
+                kinesis_firehose_destination=Sesv2ConfigurationSetEventDestinationEventDestinationKinesisFirehoseDestination(
+                    delivery_stream_arn=Token.as_string(aws_kinesis_firehose_delivery_stream_example.arn),
+                    iam_role_arn=Token.as_string(aws_iam_role_example.arn)
+                ),
+                matching_event_types=["SEND"]
+            ),
+            event_destination_name="example"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_sesv2_configuration_set_event_destination_example.override_logical_id("example")
+```
+
+### Pinpoint Destination
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.sesv2_configuration_set import Sesv2ConfigurationSet
+from imports.aws.sesv2_configuration_set_event_destination import Sesv2ConfigurationSetEventDestination
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = Sesv2ConfigurationSet(self, "example",
+            configuration_set_name="example"
+        )
+        aws_sesv2_configuration_set_event_destination_example =
+        Sesv2ConfigurationSetEventDestination(self, "example_1",
+            configuration_set_name=example.configuration_set_name,
+            event_destination=Sesv2ConfigurationSetEventDestinationEventDestination(
+                enabled=True,
+                matching_event_types=["SEND"],
+                pinpoint_destination=Sesv2ConfigurationSetEventDestinationEventDestinationPinpointDestination(
+                    application_arn=Token.as_string(aws_pinpoint_app_example.arn)
+                )
+            ),
+            event_destination_name="example"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_sesv2_configuration_set_event_destination_example.override_logical_id("example")
+```
+
+### SNS Destination
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.sesv2_configuration_set import Sesv2ConfigurationSet
+from imports.aws.sesv2_configuration_set_event_destination import Sesv2ConfigurationSetEventDestination
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = Sesv2ConfigurationSet(self, "example",
+            configuration_set_name="example"
+        )
+        aws_sesv2_configuration_set_event_destination_example =
+        Sesv2ConfigurationSetEventDestination(self, "example_1",
+            configuration_set_name=example.configuration_set_name,
+            event_destination=Sesv2ConfigurationSetEventDestinationEventDestination(
+                enabled=True,
+                matching_event_types=["SEND"],
+                sns_destination=Sesv2ConfigurationSetEventDestinationEventDestinationSnsDestination(
+                    topic_arn=Token.as_string(aws_sns_topic_example.arn)
+                )
+            ),
+            event_destination_name="example"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_sesv2_configuration_set_event_destination_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `configuration_set_name` - (Required) The name of the configuration set.
+* `event_destination` - (Required) A name that identifies the event destination within the configuration set.
+* `event_destination_name` - (Required) An object that defines the event destination. See [event_destination](#event_destination) below.
+
+### event_destination
+
+The following arguments are required:
+
+* `matching_event_types` - (Required) - An array that specifies which events the Amazon SES API v2 should send to the destinations. Valid values: `SEND`, `REJECT`, `BOUNCE`, `COMPLAINT`, `DELIVERY`, `OPEN`, `CLICK`, `RENDERING_FAILURE`, `DELIVERY_DELAY`, `SUBSCRIPTION`.
+
+The following arguments are optional:
+
+* `cloud_watch_destination` - (Optional) An object that defines an Amazon CloudWatch destination for email events. See [cloud_watch_destination](#cloud_watch_destination) below
+* `enabled` - (Optional) When the event destination is enabled, the specified event types are sent to the destinations. Default: `false`.
+* `kinesis_firehose_destination` - (Optional) An object that defines an Amazon Kinesis Data Firehose destination for email events. See [kinesis_firehose_destination](#kinesis_firehose_destination) below.
+* `pinpoint_destination` - (Optional) An object that defines an Amazon Pinpoint project destination for email events. See [pinpoint_destination](#pinpoint_destination) below.
+* `sns_destination` - (Optional) An object that defines an Amazon SNS destination for email events. See [sns_destination](#sns_destination) below.
+
+### cloud_watch_destination
+
+The following arguments are required:
+
+* `dimension_configuration` - (Required) An array of objects that define the dimensions to use when you send email events to Amazon CloudWatch. See [dimension_configuration](#dimension_configuration) below.
+
+### dimension_configuration
+
+The following arguments are required:
+
+* `default_dimension_value` - (Required) The default value of the dimension that is published to Amazon CloudWatch if you don't provide the value of the dimension when you send an email.
+* `dimension_name` - (Required) The name of an Amazon CloudWatch dimension associated with an email sending metric.
+* `dimension_value_source` - (Required) The location where the Amazon SES API v2 finds the value of a dimension to publish to Amazon CloudWatch. Valid values: `MESSAGE_TAG`, `EMAIL_HEADER`, `LINK_TAG`.
+
+### kinesis_firehose_destination
+
+The following arguments are required:
+
+* `delivery_stream_arn` - (Required) The Amazon Resource Name (ARN) of the Amazon Kinesis Data Firehose stream that the Amazon SES API v2 sends email events to.
+* `iam_role_arn` - (Required) The Amazon Resource Name (ARN) of the IAM role that the Amazon SES API v2 uses to send email events to the Amazon Kinesis Data Firehose stream.
+
+### pinpoint_destination
+
+The following arguments are required:
+
+* `pinpoint_application_arn` - (Required) The Amazon Resource Name (ARN) of the Amazon Pinpoint project to send email events to.
+
+### sns_destination
+
+The following arguments are required:
+
+* `topic_arn` - (Required) The Amazon Resource Name (ARN) of the Amazon SNS topic to publish email events to.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - A pipe-delimited string combining `configuration_set_name` and `event_destination_name`.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SESv2 (Simple Email V2) Configuration Set Event Destination using the `id` (`configuration_set_name|event_destination_name`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import SESv2 (Simple Email V2) Configuration Set Event Destination using the `id` (`configuration_set_name|event_destination_name`). For example:
+
+```console
+% terraform import aws_sesv2_configuration_set_event_destination.example example_configuration_set|example_event_destination
+```
+
+<!-- cache-key: cdktf-0.18.0 input-cad711a1f404bc31687becda354a170176c8e53426698806bef4713eb256b918 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/sesv2_contact_list.html.markdown b/website/docs/cdktf/python/r/sesv2_contact_list.html.markdown
new file mode 100644
index 00000000000..4802d8a2b2f
--- /dev/null
+++ b/website/docs/cdktf/python/r/sesv2_contact_list.html.markdown
@@ -0,0 +1,113 @@
+---
+subcategory: "SESv2 (Simple Email V2)"
+layout: "aws"
+page_title: "AWS: aws_sesv2_contact_list"
+description: |-
+  Terraform resource for managing an AWS SESv2 (Simple Email V2) Contact List.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sesv2_contact_list
+
+Terraform resource for managing an AWS SESv2 (Simple Email V2) Contact List.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.sesv2_contact_list import Sesv2ContactList
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Sesv2ContactList(self, "example",
+            contact_list_name="example"
+        )
+```
+
+### Extended Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.sesv2_contact_list import Sesv2ContactList
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Sesv2ContactList(self, "example",
+            contact_list_name="example",
+            description="description",
+            topic=[Sesv2ContactListTopic(
+                default_subscription_status="OPT_IN",
+                description="topic description",
+                display_name="Example Topic",
+                topic_name="example-topic"
+            )
+            ]
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `contact_list_name` - (Required) The name of the contact list.
+
+The following arguments are optional:
+
+* `description` - (Optional) A description of what the contact list is about.
+* `tags` - (Optional) Key-value map of resource tags for the contact list. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `topic` - (Optional) Configuration block(s) with topic for the contact list. Detailed below.
+
+### topic
+
+The following arguments are required:
+
+* `default_subscription_status` - (Required) The default subscription status to be applied to a contact if the contact has not noted their preference for subscribing to a topic.
+* `display_name` - (Required) The name of the topic the contact will see.
+* `topic_name` - (Required) The name of the topic.
+
+The following arguments are optional:
+
+* `description` - (Optional) A description of what the topic is about, which the contact will see.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `created_timestamp` - A timestamp noting when the contact list was created in ISO 8601 format.
+* `last_updated_timestamp` - A timestamp noting the last time the contact list was updated in ISO 8601 format.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SESv2 (Simple Email V2) Contact List using the `example_id_arg`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import SESv2 (Simple Email V2) Contact List using the `example_id_arg`. For example:
+
+```console
+% terraform import aws_sesv2_contact_list.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-bf6ee9d89685af78292cb0d5392a6357f5844d7e092a1f578086fbf6539e59a5 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/sesv2_dedicated_ip_assignment.html.markdown b/website/docs/cdktf/python/r/sesv2_dedicated_ip_assignment.html.markdown
new file mode 100644
index 00000000000..03b5344a8b3
--- /dev/null
+++ b/website/docs/cdktf/python/r/sesv2_dedicated_ip_assignment.html.markdown
@@ -0,0 +1,78 @@
+---
+subcategory: "SESv2 (Simple Email V2)"
+layout: "aws"
+page_title: "AWS: aws_sesv2_dedicated_ip_assignment"
+description: |-
+  Terraform resource for managing an AWS SESv2 (Simple Email V2) Dedicated IP Assignment.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sesv2_dedicated_ip_assignment
+
+Terraform resource for managing an AWS SESv2 (Simple Email V2) Dedicated IP Assignment.
+
+This resource is used with "Standard" dedicated IP addresses. This includes addresses [requested and relinquished manually](https://docs.aws.amazon.com/ses/latest/dg/dedicated-ip-case.html) via an AWS support case, or [Bring Your Own IP](https://docs.aws.amazon.com/ses/latest/dg/dedicated-ip-byo.html) addresses. Once no longer assigned, this resource returns the IP to the [`ses-default-dedicated-pool`](https://docs.aws.amazon.com/ses/latest/dg/managing-ip-pools.html), managed by AWS.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.sesv2_dedicated_ip_assignment import Sesv2DedicatedIpAssignment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Sesv2DedicatedIpAssignment(self, "example",
+            destination_pool_name="my-pool",
+            ip="0.0.0.0"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `ip` - (Required) Dedicated IP address.
+* `destination_pool_name` - (Required) Dedicated IP address.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - A comma-separated string made up of `ip` and `destination_pool_name`.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `30m`)
+* `delete` - (Default `30m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SESv2 (Simple Email V2) Dedicated IP Assignment using the `id`, which is a comma-separated string made up of `ip` and `destination_pool_name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import SESv2 (Simple Email V2) Dedicated IP Assignment using the `id`, which is a comma-separated string made up of `ip` and `destination_pool_name`. For example:
+
+```console
+% terraform import aws_sesv2_dedicated_ip_assignment.example "0.0.0.0,my-pool"
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ad1eca5879354d37ff31d84910a7c75bc98ff4e0846d438b18b1ca96ed71fe9f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/sesv2_dedicated_ip_pool.html.markdown b/website/docs/cdktf/python/r/sesv2_dedicated_ip_pool.html.markdown
new file mode 100644
index 00000000000..33e12f0667f
--- /dev/null
+++ b/website/docs/cdktf/python/r/sesv2_dedicated_ip_pool.html.markdown
@@ -0,0 +1,100 @@
+---
+subcategory: "SESv2 (Simple Email V2)"
+layout: "aws"
+page_title: "AWS: aws_sesv2_dedicated_ip_pool"
+description: |-
+  Terraform resource for managing an AWS SESv2 (Simple Email V2) Dedicated IP Pool.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sesv2_dedicated_ip_pool
+
+Terraform resource for managing an AWS SESv2 (Simple Email V2) Dedicated IP Pool.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.sesv2_dedicated_ip_pool import Sesv2DedicatedIpPool
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Sesv2DedicatedIpPool(self, "example",
+            pool_name="my-pool"
+        )
+```
+
+### Managed Pool
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.sesv2_dedicated_ip_pool import Sesv2DedicatedIpPool
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Sesv2DedicatedIpPool(self, "example",
+            pool_name="my-managed-pool",
+            scaling_mode="MANAGED"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `pool_name` - (Required) Name of the dedicated IP pool.
+
+The following arguments are optional:
+
+* `scaling_mode` - (Optional) IP pool scaling mode. Valid values: `STANDARD`, `MANAGED`. If omitted, the AWS API will default to a standard pool.
+* `tags` - (Optional) A map of tags to assign to the pool. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Dedicated IP Pool.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `30m`)
+* `update` - (Default `30m`)
+* `delete` - (Default `30m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SESv2 (Simple Email V2) Dedicated IP Pool using the `pool_name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import SESv2 (Simple Email V2) Dedicated IP Pool using the `pool_name`. For example:
+
+```console
+% terraform import aws_sesv2_dedicated_ip_pool.example my-pool
+```
+
+<!-- cache-key: cdktf-0.18.0 input-0803493a6210a46636d12167a1f3177b733cfc4fbdc40d4043f26a173d0508db -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/sesv2_email_identity.html.markdown b/website/docs/cdktf/python/r/sesv2_email_identity.html.markdown
new file mode 100644
index 00000000000..3304a6e5603
--- /dev/null
+++ b/website/docs/cdktf/python/r/sesv2_email_identity.html.markdown
@@ -0,0 +1,162 @@
+---
+subcategory: "SESv2 (Simple Email V2)"
+layout: "aws"
+page_title: "AWS: aws_sesv2_email_identity"
+description: |-
+  Terraform resource for managing an AWS SESv2 (Simple Email V2) Email Identity.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sesv2_email_identity
+
+Terraform resource for managing an AWS SESv2 (Simple Email V2) Email Identity.
+
+## Example Usage
+
+### Basic Usage
+
+#### Email Address Identity
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.sesv2_email_identity import Sesv2EmailIdentity
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Sesv2EmailIdentity(self, "example",
+            email_identity="testing@example.com"
+        )
+```
+
+#### Domain Identity
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.sesv2_email_identity import Sesv2EmailIdentity
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Sesv2EmailIdentity(self, "example",
+            email_identity="example.com"
+        )
+```
+
+#### Configuration Set
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.sesv2_configuration_set import Sesv2ConfigurationSet
+from imports.aws.sesv2_email_identity import Sesv2EmailIdentity
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = Sesv2ConfigurationSet(self, "example",
+            configuration_set_name="example"
+        )
+        aws_sesv2_email_identity_example = Sesv2EmailIdentity(self, "example_1",
+            configuration_set_name=example.configuration_set_name,
+            email_identity="example.com"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_sesv2_email_identity_example.override_logical_id("example")
+```
+
+#### DKIM Signing Attributes (BYODKIM)
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.sesv2_email_identity import Sesv2EmailIdentity
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Sesv2EmailIdentity(self, "example",
+            dkim_signing_attributes=Sesv2EmailIdentityDkimSigningAttributes(
+                domain_signing_private_key="MIIJKAIBAAKCAgEA2Se7p8zvnI4yh+Gh9j2rG5e2aRXjg03Y8saiupLnadPH9xvM...",
+                domain_signing_selector="example"
+            ),
+            email_identity="example.com"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `email_identity` - (Required) The email address or domain to verify.
+
+The following arguments are optional:
+
+* `configuration_set_name` - (Optional) The configuration set to use by default when sending from this identity. Note that any configuration set defined in the email sending request takes precedence.
+* `dkim_signing_attributes` - (Optional) The configuration of the DKIM authentication settings for an email domain identity.
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### dkim_signing_attributes
+
+* `domain_signing_private_key` - (Optional, Sensitive) [Bring Your Own DKIM] A private key that's used to generate a DKIM signature. The private key must use 1024 or 2048-bit RSA encryption, and must be encoded using base64 encoding.
+
+-> **NOTE:** You have to delete the first and last lines ('-----BEGIN PRIVATE KEY-----' and '-----END PRIVATE KEY-----', respectively) of the generated private key. Additionally, you have to remove the line breaks in the generated private key. The resulting value is a string of characters with no spaces or line breaks.
+
+* `domain_signing_selector` - (Optional) [Bring Your Own DKIM] A string that's used to identify a public key in the DNS configuration for a domain.
+* `next_signing_key_length` - (Optional) [Easy DKIM] The key length of the future DKIM key pair to be generated. This can be changed at most once per day. Valid values: `RSA_1024_BIT`, `RSA_2048_BIT`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Email Identity.
+* `dkim_signing_attributes` - A list of objects that contains at most one element with information about the private key and selector that you want to use to configure DKIM for the identity for Bring Your Own DKIM (BYODKIM) for the identity, or, configures the key length to be used for Easy DKIM.
+    * `current_signing_key_length` - [Easy DKIM] The key length of the DKIM key pair in use.
+    * `last_key_generation_timestamp` - [Easy DKIM] The last time a key pair was generated for this identity.
+    * `next_signing_key_length` - [Easy DKIM] The key length of the future DKIM key pair to be generated. This can be changed at most once per day.
+    * `signing_attributes_origin` - A string that indicates how DKIM was configured for the identity. `AWS_SES` indicates that DKIM was configured for the identity by using Easy DKIM. `EXTERNAL` indicates that DKIM was configured for the identity by using Bring Your Own DKIM (BYODKIM).
+    * `status` - Describes whether or not Amazon SES has successfully located the DKIM records in the DNS records for the domain. See the [AWS SES API v2 Reference](https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_DkimAttributes.html#SES-Type-DkimAttributes-Status) for supported statuses.
+    * `tokens` - If you used Easy DKIM to configure DKIM authentication for the domain, then this object contains a set of unique strings that you use to create a set of CNAME records that you add to the DNS configuration for your domain. When Amazon SES detects these records in the DNS configuration for your domain, the DKIM authentication process is complete. If you configured DKIM authentication for the domain by providing your own public-private key pair, then this object contains the selector for the public key.
+* `identity_type` - The email identity type. Valid values: `EMAIL_ADDRESS`, `DOMAIN`.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block).
+* `verified_for_sending_status` - Specifies whether or not the identity is verified.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SESv2 (Simple Email V2) Email Identity using the `email_identity`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import SESv2 (Simple Email V2) Email Identity using the `email_identity`. For example:
+
+```console
+% terraform import aws_sesv2_email_identity.example example.com
+```
+
+<!-- cache-key: cdktf-0.18.0 input-28f1021df6e78a4dec2007cff0687b2638fab5bbf6cfb378ee2edfc2129cd0b1 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/sesv2_email_identity_feedback_attributes.html.markdown b/website/docs/cdktf/python/r/sesv2_email_identity_feedback_attributes.html.markdown
new file mode 100644
index 00000000000..3d3020fb147
--- /dev/null
+++ b/website/docs/cdktf/python/r/sesv2_email_identity_feedback_attributes.html.markdown
@@ -0,0 +1,74 @@
+---
+subcategory: "SESv2 (Simple Email V2)"
+layout: "aws"
+page_title: "AWS: aws_sesv2_email_identity_feedback_attributes"
+description: |-
+  Terraform resource for managing an AWS SESv2 (Simple Email V2) Email Identity Feedback Attributes.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sesv2_email_identity_feedback_attributes
+
+Terraform resource for managing an AWS SESv2 (Simple Email V2) Email Identity Feedback Attributes.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.sesv2_email_identity import Sesv2EmailIdentity
+from imports.aws.sesv2_email_identity_feedback_attributes import Sesv2EmailIdentityFeedbackAttributes
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = Sesv2EmailIdentity(self, "example",
+            email_identity="example.com"
+        )
+        aws_sesv2_email_identity_feedback_attributes_example =
+        Sesv2EmailIdentityFeedbackAttributes(self, "example_1",
+            email_forwarding_enabled=True,
+            email_identity=example.email_identity
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_sesv2_email_identity_feedback_attributes_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `email_identity` - (Required) The email identity.
+* `email_forwarding_enabled` - (Optional) Sets the feedback forwarding configuration for the identity.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SESv2 (Simple Email V2) Email Identity Feedback Attributes using the `email_identity`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import SESv2 (Simple Email V2) Email Identity Feedback Attributes using the `email_identity`. For example:
+
+```console
+% terraform import aws_sesv2_email_identity_feedback_attributes.example example.com
+```
+
+<!-- cache-key: cdktf-0.18.0 input-a16fc314df24381c673aaaa9609cba3c1505976385baba55655cc1f20a10ac61 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/sesv2_email_identity_mail_from_attributes.html.markdown b/website/docs/cdktf/python/r/sesv2_email_identity_mail_from_attributes.html.markdown
new file mode 100644
index 00000000000..8e6d5c311f8
--- /dev/null
+++ b/website/docs/cdktf/python/r/sesv2_email_identity_mail_from_attributes.html.markdown
@@ -0,0 +1,76 @@
+---
+subcategory: "SESv2 (Simple Email V2)"
+layout: "aws"
+page_title: "AWS: aws_sesv2_email_identity_mail_from_attributes"
+description: |-
+  Terraform resource for managing an AWS SESv2 (Simple Email V2) Email Identity Mail From Attributes.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sesv2_email_identity_mail_from_attributes
+
+Terraform resource for managing an AWS SESv2 (Simple Email V2) Email Identity Mail From Attributes.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.sesv2_email_identity import Sesv2EmailIdentity
+from imports.aws.sesv2_email_identity_mail_from_attributes import Sesv2EmailIdentityMailFromAttributes
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = Sesv2EmailIdentity(self, "example",
+            email_identity="example.com"
+        )
+        aws_sesv2_email_identity_mail_from_attributes_example =
+        Sesv2EmailIdentityMailFromAttributes(self, "example_1",
+            behavior_on_mx_failure="REJECT_MESSAGE",
+            email_identity=example.email_identity,
+            mail_from_domain="subdomain.${" + example.email_identity + "}"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_sesv2_email_identity_mail_from_attributes_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `email_identity` - (Required) The verified email identity.
+* `behavior_on_mx_failure` - (Optional) The action to take if the required MX record isn't found when you send an email. Valid values: `USE_DEFAULT_VALUE`, `REJECT_MESSAGE`.
+* `mail_from_domain` - (Optional) The custom MAIL FROM domain that you want the verified identity to use. Required if `behavior_on_mx_failure` is `REJECT_MESSAGE`.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SESv2 (Simple Email V2) Email Identity Mail From Attributes using the `email_identity`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import SESv2 (Simple Email V2) Email Identity Mail From Attributes using the `email_identity`. For example:
+
+```console
+% terraform import aws_sesv2_email_identity_mail_from_attributes.example example.com
+```
+
+<!-- cache-key: cdktf-0.18.0 input-3a9a88db16593e085c12ffe4c38e264061edc67814a816a38867c84c36efd10f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/sfn_activity.html.markdown b/website/docs/cdktf/python/r/sfn_activity.html.markdown
new file mode 100644
index 00000000000..08efb8a2687
--- /dev/null
+++ b/website/docs/cdktf/python/r/sfn_activity.html.markdown
@@ -0,0 +1,69 @@
+---
+subcategory: "SFN (Step Functions)"
+layout: "aws"
+page_title: "AWS: aws_sfn_activity"
+description: |-
+  Provides a Step Function Activity resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sfn_activity
+
+Provides a Step Function Activity resource
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.sfn_activity import SfnActivity
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SfnActivity(self, "sfn_activity",
+            name="my-activity"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the activity to create.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Amazon Resource Name (ARN) that identifies the created activity.
+* `name` - The name of the activity.
+* `creation_date` - The date the activity was created.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import activities using the `arn`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import activities using the `arn`. For example:
+
+```console
+% terraform import aws_sfn_activity.foo arn:aws:states:eu-west-1:123456789098:activity:bar
+```
+
+<!-- cache-key: cdktf-0.18.0 input-b746a508f0ba70e5e33d2b67354b7a5e7df87f2c17e0b40685ebc5ce6df1ca33 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/sfn_alias.html.markdown b/website/docs/cdktf/python/r/sfn_alias.html.markdown
new file mode 100644
index 00000000000..edf19d6b39e
--- /dev/null
+++ b/website/docs/cdktf/python/r/sfn_alias.html.markdown
@@ -0,0 +1,91 @@
+---
+subcategory: "SFN (Step Functions)"
+layout: "aws"
+page_title: "AWS: aws_sfn_alias"
+description: |-
+  Provides a Step Function State Machine Alias.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sfn_alias
+
+Provides a Step Function State Machine Alias.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.sfn_alias import SfnAlias
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SfnAlias(self, "my_sfn_alias",
+            name="my_sfn_alias",
+            routing_configuration=[SfnAliasRoutingConfiguration(
+                state_machine_version_arn="arn:aws:states:us-east-1:12345:stateMachine:demo:3",
+                weight=50
+            ), SfnAliasRoutingConfiguration(
+                state_machine_version_arn="arn:aws:states:us-east-1:12345:stateMachine:demo:2",
+                weight=50
+            )
+            ]
+        )
+        SfnAlias(self, "sfn_alias",
+            name="my_sfn_alias",
+            routing_configuration=[SfnAliasRoutingConfiguration(
+                state_machine_version_arn=sfn_test.state_machine_version_arn,
+                weight=100
+            )
+            ]
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) Name for the alias you are creating.
+* `description` - (Optional) Description of the alias.
+* `routing_configuration` - (Required) The StateMachine alias' route configuration settings. Fields documented below
+
+`routing_configuration` supports the following arguments:
+
+* `state_machine_version_arn` - (Required) The Amazon Resource Name (ARN) of the state machine version.
+* `weight` - (Required) Percentage of traffic routed to the state machine version.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) identifying your state machine alias.
+* `creation_date` - The date the state machine alias was created.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SFN (Step Functions) Alias using the `arn`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import SFN (Step Functions) Alias using the `arn`. For example:
+
+```console
+% terraform import aws_sfn_alias.foo arn:aws:states:us-east-1:123456789098:stateMachine:myStateMachine:foo
+```
+
+<!-- cache-key: cdktf-0.18.0 input-bfd0b99447354a387498343e81e37140646e8c656cabd51886388e3b57f53683 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/sfn_state_machine.html.markdown b/website/docs/cdktf/python/r/sfn_state_machine.html.markdown
new file mode 100644
index 00000000000..a2f759e4f78
--- /dev/null
+++ b/website/docs/cdktf/python/r/sfn_state_machine.html.markdown
@@ -0,0 +1,172 @@
+---
+subcategory: "SFN (Step Functions)"
+layout: "aws"
+page_title: "AWS: aws_sfn_state_machine"
+description: |-
+  Provides a Step Function State Machine resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sfn_state_machine
+
+Provides a Step Function State Machine resource
+
+## Example Usage
+
+### Basic (Standard Workflow)
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.sfn_state_machine import SfnStateMachine
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SfnStateMachine(self, "sfn_state_machine",
+            definition="{\n  \"Comment\": \"A Hello World example of the Amazon States Language using an AWS Lambda Function\",\n  \"StartAt\": \"HelloWorld\",\n  \"States\": {\n    \"HelloWorld\": {\n      \"Type\": \"Task\",\n      \"Resource\": \"${" + lambda_.arn + "}\",\n      \"End\": true\n    }\n  }\n}\n\n",
+            name="my-state-machine",
+            role_arn=iam_for_sfn.arn
+        )
+```
+
+### Basic (Express Workflow)
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.sfn_state_machine import SfnStateMachine
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SfnStateMachine(self, "sfn_state_machine",
+            definition="{\n  \"Comment\": \"A Hello World example of the Amazon States Language using an AWS Lambda Function\",\n  \"StartAt\": \"HelloWorld\",\n  \"States\": {\n    \"HelloWorld\": {\n      \"Type\": \"Task\",\n      \"Resource\": \"${" + lambda_.arn + "}\",\n      \"End\": true\n    }\n  }\n}\n\n",
+            name="my-state-machine",
+            role_arn=iam_for_sfn.arn,
+            type="EXPRESS"
+        )
+```
+
+### Publish (Publish SFN version)
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.sfn_state_machine import SfnStateMachine
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SfnStateMachine(self, "sfn_state_machine",
+            definition="{\n  \"Comment\": \"A Hello World example of the Amazon States Language using an AWS Lambda Function\",\n  \"StartAt\": \"HelloWorld\",\n  \"States\": {\n    \"HelloWorld\": {\n      \"Type\": \"Task\",\n      \"Resource\": \"${" + lambda_.arn + "}\",\n      \"End\": true\n    }\n  }\n}\n\n",
+            name="my-state-machine",
+            publish=True,
+            role_arn=iam_for_sfn.arn,
+            type="EXPRESS"
+        )
+```
+
+### Logging
+
+~> *NOTE:* See the [AWS Step Functions Developer Guide](https://docs.aws.amazon.com/step-functions/latest/dg/welcome.html) for more information about enabling Step Function logging.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.sfn_state_machine import SfnStateMachine
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SfnStateMachine(self, "sfn_state_machine",
+            definition="{\n  \"Comment\": \"A Hello World example of the Amazon States Language using an AWS Lambda Function\",\n  \"StartAt\": \"HelloWorld\",\n  \"States\": {\n    \"HelloWorld\": {\n      \"Type\": \"Task\",\n      \"Resource\": \"${" + lambda_.arn + "}\",\n      \"End\": true\n    }\n  }\n}\n\n",
+            logging_configuration=SfnStateMachineLoggingConfiguration(
+                include_execution_data=True,
+                level="ERROR",
+                log_destination="${" + log_group_for_sfn.arn + "}:*"
+            ),
+            name="my-state-machine",
+            role_arn=iam_for_sfn.arn
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `definition` - (Required) The [Amazon States Language](https://docs.aws.amazon.com/step-functions/latest/dg/concepts-amazon-states-language.html) definition of the state machine.
+* `logging_configuration` - (Optional) Defines what execution history events are logged and where they are logged. The `logging_configuration` parameter is only valid when `type` is set to `EXPRESS`. Defaults to `OFF`. For more information see [Logging Express Workflows](https://docs.aws.amazon.com/step-functions/latest/dg/cw-logs.html) and [Log Levels](https://docs.aws.amazon.com/step-functions/latest/dg/cloudwatch-log-level.html) in the AWS Step Functions User Guide.
+* `name` - (Optional) The name of the state machine. The name should only contain `0`-`9`, `A`-`Z`, `a`-`z`, `-` and `_`. If omitted, Terraform will assign a random, unique name.
+* `name_prefix` - (Optional) Creates a unique name beginning with the specified prefix. Conflicts with `name`.
+* `publish` - (Optional) Set to true to publish a version of the state machine during creation. Default: false.
+* `role_arn` - (Required) The Amazon Resource Name (ARN) of the IAM role to use for this state machine.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `tracing_configuration` - (Optional) Selects whether AWS X-Ray tracing is enabled.
+* `type` - (Optional) Determines whether a Standard or Express state machine is created. The default is `STANDARD`. You cannot update the type of a state machine once it has been created. Valid values: `STANDARD`, `EXPRESS`.
+
+### `logging_configuration` Configuration Block
+
+* `include_execution_data` - (Optional) Determines whether execution data is included in your log. When set to `false`, data is excluded.
+* `level` - (Optional) Defines which category of execution history events are logged. Valid values: `ALL`, `ERROR`, `FATAL`, `OFF`
+* `log_destination` - (Optional) Amazon Resource Name (ARN) of a CloudWatch log group. Make sure the State Machine has the correct IAM policies for logging. The ARN must end with `:*`
+
+### `tracing_configuration` Configuration Block
+
+* `enabled` - (Optional) When set to `true`, AWS X-Ray tracing is enabled. Make sure the State Machine has the correct IAM policies for logging. See the [AWS Step Functions Developer Guide](https://docs.aws.amazon.com/step-functions/latest/dg/xray-iam.html) for details.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ARN of the state machine.
+* `arn` - The ARN of the state machine.
+* `creation_date` - The date the state machine was created.
+* `status` - The current status of the state machine. Either `ACTIVE` or `DELETING`.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `5m`)
+* `update` - (Default `1m`)
+* `delete` - (Default `5m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import State Machines using the `arn`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import State Machines using the `arn`. For example:
+
+```console
+% terraform import aws_sfn_state_machine.foo arn:aws:states:eu-west-1:123456789098:stateMachine:bar
+```
+
+<!-- cache-key: cdktf-0.18.0 input-f08ea369e176242c031d2aef1b09ffa720bc2fe422b8ec36899abd05e99d76aa -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/shield_application_layer_automatic_response.html.markdown b/website/docs/cdktf/python/r/shield_application_layer_automatic_response.html.markdown
new file mode 100644
index 00000000000..2aedf1adaf8
--- /dev/null
+++ b/website/docs/cdktf/python/r/shield_application_layer_automatic_response.html.markdown
@@ -0,0 +1,58 @@
+---
+subcategory: "Shield"
+layout: "aws"
+page_title: "AWS: aws_shield_application_layer_automatic_response"
+description: |-
+  Terraform resource for managing an AWS Shield Application Layer Automatic Response.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_shield_application_layer_automatic_response
+
+Terraform resource for managing an AWS Shield Application Layer Automatic Response for automatic DDoS mitigation.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_caller_identity import DataAwsCallerIdentity
+from imports.aws.data_aws_partition import DataAwsPartition
+from imports.aws.data_aws_region import DataAwsRegion
+from imports.aws.shield_application_layer_automatic_response import ShieldApplicationLayerAutomaticResponse
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        current = DataAwsCallerIdentity(self, "current")
+        data_aws_partition_current = DataAwsPartition(self, "current_1")
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_partition_current.override_logical_id("current")
+        data_aws_region_current = DataAwsRegion(self, "current_2")
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_region_current.override_logical_id("current")
+        ShieldApplicationLayerAutomaticResponse(self, "example",
+            action="COUNT",
+            resource_arn="arn:${" + data_aws_partition_current.partition + "}:cloudfront:${" + current.account_id + "}:distribution/${" + distribution_id.value + "}"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `resource_arn` - (Required) ARN of the resource to protect (Cloudfront Distributions and ALBs only at this time).
+* `action` - (Required) One of `COUNT` or `BLOCK`
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+<!-- cache-key: cdktf-0.18.0 input-f7a331080867c085f8aaa43e07461e7380ab4d874abfb04d35ff548376c8399b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/shield_drt_access_log_bucket_association.html.markdown b/website/docs/cdktf/python/r/shield_drt_access_log_bucket_association.html.markdown
new file mode 100644
index 00000000000..576c0bc4291
--- /dev/null
+++ b/website/docs/cdktf/python/r/shield_drt_access_log_bucket_association.html.markdown
@@ -0,0 +1,54 @@
+---
+subcategory: "Shield"
+layout: "aws"
+page_title: "AWS: aws_shield_drt_access_log_bucket_association"
+description: |-
+  Terraform resource for managing an AWS Shield DRT Access Log Bucket Association.
+---
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_shield_drt_access_log_bucket_association
+
+Terraform resource for managing an AWS Shield DRT Access Log Bucket Association. Up to 10 log buckets can be associated for DRT Access sharing with the Shield Response Team (SRT).
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.shield_drt_access_log_bucket_association import ShieldDrtAccessLogBucketAssociation
+from imports.aws.shield_drt_access_role_arn_association import ShieldDrtAccessRoleArnAssociation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        test = ShieldDrtAccessRoleArnAssociation(self, "test",
+            role_arn="arn:aws:iam:${" + current.name + "}:${" + data_aws_caller_identity_current.account_id + "}:${" + shield_drt_access_role_name.value + "}"
+        )
+        aws_shield_drt_access_log_bucket_association_test =
+        ShieldDrtAccessLogBucketAssociation(self, "test_1",
+            log_bucket=shield_drt_access_log_bucket.string_value,
+            role_arn_association_id=test.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_shield_drt_access_log_bucket_association_test.override_logical_id("test")
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `log_bucket` - (Required) The Amazon S3 bucket that contains the logs that you want to share.
+* `role_arn_association_id` - (Required) The ID of the Role Arn association used for allowing Shield DRT Access.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+<!-- cache-key: cdktf-0.18.0 input-656b1afbb8775b70190efdaf5f68489d2af84b003cf6a6c301a6cbe7edd709fe -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/shield_drt_access_role_arn_association.html.markdown b/website/docs/cdktf/python/r/shield_drt_access_role_arn_association.html.markdown
new file mode 100644
index 00000000000..daceb950e66
--- /dev/null
+++ b/website/docs/cdktf/python/r/shield_drt_access_role_arn_association.html.markdown
@@ -0,0 +1,72 @@
+---
+subcategory: "Shield"
+layout: "aws"
+page_title: "AWS: aws_shield_drt_access_role_arn_association"
+description: |-
+  Terraform resource for managing an AWS Shield DRT Access Role Arn Association.
+---
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_shield_drt_access_role_arn_association
+
+Authorizes the Shield Response Team (SRT) using the specified role, to access your AWS account to assist with DDoS attack mitigation during potential attacks. For more information see [Configure AWS SRT Support](https://docs.aws.amazon.com/waf/latest/developerguide/authorize-srt.html)
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.iam_role import IamRole
+from imports.aws.iam_role_policy_attachment import IamRolePolicyAttachment
+from imports.aws.shield_drt_access_role_arn_association import ShieldDrtAccessRoleArnAssociation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        test = IamRole(self, "test",
+            assume_role_policy=Token.as_string(
+                Fn.jsonencode({
+                    "Statement": [{
+                        "Action": "sts:AssumeRole",
+                        "Effect": "Allow",
+                        "Principal": {
+                            "Service": "drt.shield.amazonaws.com"
+                        },
+                        "Sid": ""
+                    }
+                    ],
+                    "Version": "2012-10-17"
+                })),
+            name=aws_shield_drt_access_role_arn.string_value
+        )
+        aws_iam_role_policy_attachment_test = IamRolePolicyAttachment(self, "test_1",
+            policy_arn="arn:aws:iam::aws:policy/service-role/AWSShieldDRTAccessPolicy",
+            role=test.name
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_role_policy_attachment_test.override_logical_id("test")
+        aws_shield_drt_access_role_arn_association_test =
+        ShieldDrtAccessRoleArnAssociation(self, "test_2",
+            role_arn=test.arn
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_shield_drt_access_role_arn_association_test.override_logical_id("test")
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `role_arn` - (Required) The Amazon Resource Name (ARN) of the role the SRT will use to access your AWS account. Prior to making the AssociateDRTRole request, you must attach the `AWSShieldDRTAccessPolicy` managed policy to this role.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+<!-- cache-key: cdktf-0.18.0 input-87f4a7efb72b32010cf15694804e32b6ba653e7f1593d4f49f88dd39db828bfb -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/shield_protection.html.markdown b/website/docs/cdktf/python/r/shield_protection.html.markdown
new file mode 100644
index 00000000000..122496c0208
--- /dev/null
+++ b/website/docs/cdktf/python/r/shield_protection.html.markdown
@@ -0,0 +1,90 @@
+---
+subcategory: "Shield"
+layout: "aws"
+page_title: "AWS: aws_shield_protection"
+description: |-
+  Enables AWS Shield Advanced for a specific AWS resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_shield_protection
+
+Enables AWS Shield Advanced for a specific AWS resource.
+The resource can be an Amazon CloudFront distribution, Elastic Load Balancing load balancer, AWS Global Accelerator accelerator, Elastic IP Address, or an Amazon Route 53 hosted zone.
+
+## Example Usage
+
+### Create protection
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_availability_zones import DataAwsAvailabilityZones
+from imports.aws.data_aws_caller_identity import DataAwsCallerIdentity
+from imports.aws.data_aws_region import DataAwsRegion
+from imports.aws.eip import Eip
+from imports.aws.shield_protection import ShieldProtection
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = Eip(self, "example",
+            domain="vpc"
+        )
+        DataAwsAvailabilityZones(self, "available")
+        current = DataAwsCallerIdentity(self, "current")
+        data_aws_region_current = DataAwsRegion(self, "current_3")
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_region_current.override_logical_id("current")
+        aws_shield_protection_example = ShieldProtection(self, "example_4",
+            name="example",
+            resource_arn="arn:aws:ec2:${" + data_aws_region_current.name + "}:${" + current.account_id + "}:eip-allocation/${" + example.id + "}",
+            tags={
+                "Environment": "Dev"
+            }
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_shield_protection_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) A friendly name for the Protection you are creating.
+* `resource_arn` - (Required) The ARN (Amazon Resource Name) of the resource to be protected.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The unique identifier (ID) for the Protection object that is created.
+* `arn` - The ARN of the Protection.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Shield protection resources using specifying their ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Shield protection resources using specifying their ID. For example:
+
+```console
+% terraform import aws_shield_protection.example ff9592dc-22f3-4e88-afa1-7b29fde9669a
+```
+
+<!-- cache-key: cdktf-0.18.0 input-35847768aaaa80ceec4dd0e0320b0024c8b87792dc136354d8b49f64094399b6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/shield_protection_group.html.markdown b/website/docs/cdktf/python/r/shield_protection_group.html.markdown
new file mode 100644
index 00000000000..8d4d78b0baf
--- /dev/null
+++ b/website/docs/cdktf/python/r/shield_protection_group.html.markdown
@@ -0,0 +1,142 @@
+---
+subcategory: "Shield"
+layout: "aws"
+page_title: "AWS: aws_shield_protection_group"
+description: |-
+  Creates a grouping of protected resources so they can be handled as a collective.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_shield_protection_group
+
+Creates a grouping of protected resources so they can be handled as a collective.
+This resource grouping improves the accuracy of detection and reduces false positives. For more information see
+[Managing AWS Shield Advanced protection groups](https://docs.aws.amazon.com/waf/latest/developerguide/manage-protection-group.html)
+
+## Example Usage
+
+### Create protection group for all resources
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.shield_protection_group import ShieldProtectionGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ShieldProtectionGroup(self, "example",
+            aggregation="MAX",
+            pattern="ALL",
+            protection_group_id="example"
+        )
+```
+
+### Create protection group for arbitrary number of resources
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_caller_identity import DataAwsCallerIdentity
+from imports.aws.data_aws_region import DataAwsRegion
+from imports.aws.eip import Eip
+from imports.aws.shield_protection import ShieldProtection
+from imports.aws.shield_protection_group import ShieldProtectionGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = Eip(self, "example",
+            domain="vpc"
+        )
+        current = DataAwsCallerIdentity(self, "current")
+        data_aws_region_current = DataAwsRegion(self, "current_2")
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_region_current.override_logical_id("current")
+        aws_shield_protection_example = ShieldProtection(self, "example_3",
+            name="example",
+            resource_arn="arn:aws:ec2:${" + data_aws_region_current.name + "}:${" + current.account_id + "}:eip-allocation/${" + example.id + "}"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_shield_protection_example.override_logical_id("example")
+        aws_shield_protection_group_example = ShieldProtectionGroup(self, "example_4",
+            aggregation="MEAN",
+            depends_on=[aws_shield_protection_example],
+            members=["arn:aws:ec2:${" + data_aws_region_current.name + "}:${" + current.account_id + "}:eip-allocation/${" + example.id + "}"
+            ],
+            pattern="ARBITRARY",
+            protection_group_id="example"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_shield_protection_group_example.override_logical_id("example")
+```
+
+### Create protection group for a type of resource
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.shield_protection_group import ShieldProtectionGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ShieldProtectionGroup(self, "example",
+            aggregation="SUM",
+            pattern="BY_RESOURCE_TYPE",
+            protection_group_id="example",
+            resource_type="ELASTIC_IP_ALLOCATION"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `aggregation` - (Required) Defines how AWS Shield combines resource data for the group in order to detect, mitigate, and report events.
+* `members` - (Optional) The Amazon Resource Names (ARNs) of the resources to include in the protection group. You must set this when you set `pattern` to ARBITRARY and you must not set it for any other `pattern` setting.
+* `pattern` - (Required) The criteria to use to choose the protected resources for inclusion in the group.
+* `protection_group_id` - (Required) The name of the protection group.
+* `resource_type` - (Optional) The resource type to include in the protection group. You must set this when you set `pattern` to BY_RESOURCE_TYPE and you must not set it for any other `pattern` setting.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `protection_group_arn` - The ARN (Amazon Resource Name) of the protection group.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Shield protection group resources using their protection group id. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Shield protection group resources using their protection group id. For example:
+
+```console
+% terraform import aws_shield_protection_group.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-9103f77296ecb9a47e4f678129df33c848d457b7cd5625270622bbbb051fbbf4 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/shield_protection_health_check_association.html.markdown b/website/docs/cdktf/python/r/shield_protection_health_check_association.html.markdown
new file mode 100644
index 00000000000..5e904b1095f
--- /dev/null
+++ b/website/docs/cdktf/python/r/shield_protection_health_check_association.html.markdown
@@ -0,0 +1,113 @@
+---
+subcategory: "Shield"
+layout: "aws"
+page_title: "AWS: aws_shield_protection_health_check_association"
+description: |-
+  Creates an association between a Route53 Health Check and a Shield Advanced protected resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_shield_protection_health_check_association
+
+Creates an association between a Route53 Health Check and a Shield Advanced protected resource.
+This association uses the health of your applications to improve responsiveness and accuracy in attack detection and mitigation.
+
+Blog post: [AWS Shield Advanced now supports Health Based Detection](https://aws.amazon.com/about-aws/whats-new/2020/02/aws-shield-advanced-now-supports-health-based-detection/)
+
+## Example Usage
+
+### Create an association between a protected EIP and a Route53 Health Check
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_caller_identity import DataAwsCallerIdentity
+from imports.aws.data_aws_partition import DataAwsPartition
+from imports.aws.data_aws_region import DataAwsRegion
+from imports.aws.eip import Eip
+from imports.aws.route53_health_check import Route53HealthCheck
+from imports.aws.shield_protection import ShieldProtection
+from imports.aws.shield_protection_health_check_association import ShieldProtectionHealthCheckAssociation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = Eip(self, "example",
+            domain="vpc",
+            tags={
+                "Name": "example"
+            }
+        )
+        aws_route53_health_check_example = Route53HealthCheck(self, "example_1",
+            failure_threshold=Token.as_number("3"),
+            ip_address=example.public_ip,
+            port=80,
+            request_interval=Token.as_number("30"),
+            resource_path="/ready",
+            tags={
+                "Name": "tf-example-health-check"
+            },
+            type="HTTP"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_route53_health_check_example.override_logical_id("example")
+        current = DataAwsCallerIdentity(self, "current")
+        data_aws_partition_current = DataAwsPartition(self, "current_3")
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_partition_current.override_logical_id("current")
+        data_aws_region_current = DataAwsRegion(self, "current_4")
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_region_current.override_logical_id("current")
+        aws_shield_protection_example = ShieldProtection(self, "example_5",
+            name="example-protection",
+            resource_arn="arn:${" + data_aws_partition_current.partition + "}:ec2:${" + data_aws_region_current.name + "}:${" + current.account_id + "}:eip-allocation/${" + example.id + "}"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_shield_protection_example.override_logical_id("example")
+        aws_shield_protection_health_check_association_example =
+        ShieldProtectionHealthCheckAssociation(self, "example_6",
+            health_check_arn=Token.as_string(aws_route53_health_check_example.arn),
+            shield_protection_id=Token.as_string(aws_shield_protection_example.id)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_shield_protection_health_check_association_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `health_check_arn` - (Required) The ARN (Amazon Resource Name) of the Route53 Health Check resource which will be associated to the protected resource.
+* `shield_protection_id` - (Required) The ID of the protected resource.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The unique identifier (ID) for the Protection object that is created.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Shield protection health check association resources using the `shield_protection_id` and `health_check_arn`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Shield protection health check association resources using the `shield_protection_id` and `health_check_arn`. For example:
+
+```console
+% terraform import aws_shield_protection_health_check_association.example ff9592dc-22f3-4e88-afa1-7b29fde9669a+arn:aws:route53:::healthcheck/3742b175-edb9-46bc-9359-f53e3b794b1b
+```
+
+<!-- cache-key: cdktf-0.18.0 input-478a1032d8fe5c2226eef877393c56223519392521f48d921b8d7bf25f16a9aa -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/signer_signing_job.html.markdown b/website/docs/cdktf/python/r/signer_signing_job.html.markdown
new file mode 100644
index 00000000000..3f0f6527eae
--- /dev/null
+++ b/website/docs/cdktf/python/r/signer_signing_job.html.markdown
@@ -0,0 +1,124 @@
+---
+subcategory: "Signer"
+layout: "aws"
+page_title: "AWS: aws_signer_signing_job"
+description: |-
+  Creates a Signer Signing Job.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_signer_signing_job
+
+Creates a Signer Signing Job.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.signer_signing_job import SignerSigningJob
+from imports.aws.signer_signing_profile import SignerSigningProfile
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        test_sp = SignerSigningProfile(self, "test_sp",
+            platform_id="AWSLambda-SHA384-ECDSA"
+        )
+        SignerSigningJob(self, "build_signing_job",
+            destination=SignerSigningJobDestination(
+                s3=SignerSigningJobDestinationS3(
+                    bucket="s3-bucket-name",
+                    prefix="signed/"
+                )
+            ),
+            ignore_signing_job_failure=True,
+            profile_name=test_sp.name,
+            source=SignerSigningJobSource(
+                s3=SignerSigningJobSourceS3(
+                    bucket="s3-bucket-name",
+                    key="object-to-be-signed.zip",
+                    version="jADjFYYYEXAMPLETszPjOmCMFDzd9dN1"
+                )
+            )
+        )
+```
+
+## Argument Reference
+
+* `profile_name` - (Required) The name of the profile to initiate the signing operation.
+* `source` - (Required) The S3 bucket that contains the object to sign. See [Source](#source) below for details.
+* `destination` - (Required) The S3 bucket in which to save your signed object. See [Destination](#destination) below for details.
+* `ignore_signing_job_failure` - (Optional) Set this argument to `true` to ignore signing job failures and retrieve failed status and reason. Default `false`.
+
+### Source
+
+The source configuration block supports the following arguments:
+
+* `s3` - (Required) A configuration block describing the S3 Source object: See [S3 Source](#s3-source) below for details.
+
+### S3 Source
+
+The configuration block supports the following arguments:
+
+* `bucket` - (Required) Name of the S3 bucket.
+* `key` - (Required) Key name of the object that contains your unsigned code.
+* `version` - (Required) Version of your source image in your version enabled S3 bucket.
+
+### Destination
+
+The destination configuration block supports the following arguments:
+
+* `s3` - (Required) A configuration block describing the S3 Destination object: See [S3 Destination](#s3-destination) below for details.
+
+### S3 Destination
+
+The configuration block supports the following arguments:
+
+* `bucket` - (Required) Name of the S3 bucket.
+* `prefix` - (Optional) An Amazon S3 object key prefix that you can use to limit signed objects keys to begin with the specified prefix.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `completed_at` - Date and time in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8) that the signing job was completed.
+* `created_at` - Date and time in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8) that the signing job was created.
+* `job_id` - The ID of the signing job on output.
+* `job_invoker` - The IAM entity that initiated the signing job.
+* `job_owner` - The AWS account ID of the job owner.
+* `platform_display_name` - A human-readable name for the signing platform associated with the signing job.
+* `platform_id` - The platform to which your signed code image will be distributed.
+* `profile_version` - The version of the signing profile used to initiate the signing job.
+* `requested_by` - The IAM principal that requested the signing job.
+* `revocation_record` - A revocation record if the signature generated by the signing job has been revoked. Contains a timestamp and the ID of the IAM entity that revoked the signature.
+* `signature_expires_at` - The time when the signature of a signing job expires.
+* `signed_object` - Name of the S3 bucket where the signed code image is saved by code signing.
+* `status` - Status of the signing job.
+* `status_reason` - String value that contains the status reason.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Signer signing jobs using the `job_id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Signer signing jobs using the `job_id`. For example:
+
+```console
+% terraform import aws_signer_signing_job.test_signer_signing_job 9ed7e5c3-b8d4-4da0-8459-44e0b068f7ee
+```
+
+<!-- cache-key: cdktf-0.18.0 input-c1b438ff5be624709d7988f68eee2a0f8bb3759d4c25af0f1c443c2548e0904f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/signer_signing_profile.html.markdown b/website/docs/cdktf/python/r/signer_signing_profile.html.markdown
new file mode 100644
index 00000000000..fec20bb1e0a
--- /dev/null
+++ b/website/docs/cdktf/python/r/signer_signing_profile.html.markdown
@@ -0,0 +1,86 @@
+---
+subcategory: "Signer"
+layout: "aws"
+page_title: "AWS: aws_signer_signing_profile"
+description: |-
+  Creates a Signer Signing Profile.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_signer_signing_profile
+
+Creates a Signer Signing Profile. A signing profile contains information about the code signing configuration parameters that can be used by a given code signing user.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.signer_signing_profile import SignerSigningProfile
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SignerSigningProfile(self, "prod_sp",
+            name_prefix="prod_sp_",
+            platform_id="AWSLambda-SHA384-ECDSA",
+            signature_validity_period=SignerSigningProfileSignatureValidityPeriod(
+                type="YEARS",
+                value=5
+            ),
+            tags={
+                "tag1": "value1",
+                "tag2": "value2"
+            }
+        )
+        SignerSigningProfile(self, "test_sp",
+            platform_id="AWSLambda-SHA384-ECDSA"
+        )
+```
+
+## Argument Reference
+
+* `platform_id` - (Required) The ID of the platform that is used by the target signing profile.
+* `name` - (Optional) A unique signing profile name. By default generated by Terraform. Signing profile names are immutable and cannot be reused after canceled.
+* `name_prefix` - (Optional) A signing profile name prefix. Terraform will generate a unique suffix. Conflicts with `name`.
+* `signature_validity_period` - (Optional) The validity period for a signing job.
+* `tags` - (Optional) A list of tags associated with the signing profile. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) for the signing profile.
+* `name` - The name of the target signing profile.
+* `platform_display_name` - A human-readable name for the signing platform associated with the signing profile.
+* `revocation_record` - Revocation information for a signing profile.
+* `status` - The status of the target signing profile.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `version` - The current version of the signing profile.
+* `version_arn` - The signing profile ARN, including the profile version.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Signer signing profiles using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Signer signing profiles using the `name`. For example:
+
+```console
+% terraform import aws_signer_signing_profile.test_signer_signing_profile test_sp_DdW3Mk1foYL88fajut4mTVFGpuwfd4ACO6ANL0D1uIj7lrn8adK
+```
+
+<!-- cache-key: cdktf-0.18.0 input-57f63022a116376a3735a2b30f488c72b5caa6858cda3ba458b57d9add75c8c7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/signer_signing_profile_permission.html.markdown b/website/docs/cdktf/python/r/signer_signing_profile_permission.html.markdown
new file mode 100644
index 00000000000..e8b933de1e9
--- /dev/null
+++ b/website/docs/cdktf/python/r/signer_signing_profile_permission.html.markdown
@@ -0,0 +1,94 @@
+---
+subcategory: "Signer"
+layout: "aws"
+page_title: "AWS: aws_signer_signing_profile_permission"
+description: |-
+  Creates a Signer Signing Profile Permission.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_signer_signing_profile_permission
+
+Creates a Signer Signing Profile Permission. That is, a cross-account permission for a signing profile.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.signer_signing_profile import SignerSigningProfile
+from imports.aws.signer_signing_profile_permission import SignerSigningProfilePermission
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        prod_sp = SignerSigningProfile(self, "prod_sp",
+            name_prefix="prod_sp_",
+            platform_id="AWSLambda-SHA384-ECDSA",
+            signature_validity_period=SignerSigningProfileSignatureValidityPeriod(
+                type="YEARS",
+                value=5
+            ),
+            tags={
+                "tag1": "value1",
+                "tag2": "value2"
+            }
+        )
+        SignerSigningProfilePermission(self, "sp_permission_1",
+            action="signer:StartSigningJob",
+            principal=aws_account.string_value,
+            profile_name=prod_sp.name
+        )
+        SignerSigningProfilePermission(self, "sp_permission_2",
+            action="signer:GetSigningProfile",
+            principal=aws_team_role_arn.string_value,
+            profile_name=prod_sp.name,
+            statement_id="ProdAccountStartSigningJob_StatementId"
+        )
+        SignerSigningProfilePermission(self, "sp_permission_3",
+            action="signer:RevokeSignature",
+            principal="123456789012",
+            profile_name=prod_sp.name,
+            profile_version=prod_sp.version,
+            statement_id_prefix="version-permission-"
+        )
+```
+
+## Argument Reference
+
+* `profile_name` - (Required) Name of the signing profile to add the cross-account permissions.
+* `action` - (Required) An AWS Signer action permitted as part of cross-account permissions. Valid values: `signer:StartSigningJob`, `signer:GetSigningProfile`, `signer:RevokeSignature`, or `signer:SignPayload`.
+* `principal` - (Required) The AWS principal to be granted a cross-account permission.
+* `profile_version` - (Optional) The signing profile version that a permission applies to.
+* `statement_id` - (Optional) A unique statement identifier. By default generated by Terraform.
+* `statement_id_prefix` - (Optional) A statement identifier prefix. Terraform will generate a unique suffix. Conflicts with `statement_id`.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Signer signing profile permission statements using profile_name/statement_id. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Signer signing profile permission statements using profile_name/statement_id. For example:
+
+```console
+% terraform import aws_signer_signing_profile_permission.test_signer_signing_profile_permission prod_profile_DdW3Mk1foYL88fajut4mTVFGpuwfd4ACO6ANL0D1uIj7lrn8adK/ProdAccountStartSigningJobStatementId
+```
+
+<!-- cache-key: cdktf-0.18.0 input-7edfee662c248d246aee9cd63641e317eed424d97a2a7b8b34328c55504385f6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/simpledb_domain.html.markdown b/website/docs/cdktf/python/r/simpledb_domain.html.markdown
new file mode 100644
index 00000000000..37b79441bfc
--- /dev/null
+++ b/website/docs/cdktf/python/r/simpledb_domain.html.markdown
@@ -0,0 +1,65 @@
+---
+subcategory: "SDB (SimpleDB)"
+layout: "aws"
+page_title: "AWS: aws_simpledb_domain"
+description: |-
+  Provides a SimpleDB domain resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_simpledb_domain
+
+Provides a SimpleDB domain resource
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.simpledb_domain import SimpledbDomain
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SimpledbDomain(self, "users",
+            name="users"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the SimpleDB domain
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name of the SimpleDB domain
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SimpleDB Domains using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import SimpleDB Domains using the `name`. For example:
+
+```console
+% terraform import aws_simpledb_domain.users users
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1ecaa39696110cd8e92af5219414c477bbcb42224f0ea02ced4ca49a594cc2e2 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/snapshot_create_volume_permission.html.markdown b/website/docs/cdktf/python/r/snapshot_create_volume_permission.html.markdown
new file mode 100644
index 00000000000..ac1749c24e0
--- /dev/null
+++ b/website/docs/cdktf/python/r/snapshot_create_volume_permission.html.markdown
@@ -0,0 +1,57 @@
+---
+subcategory: "EBS (EC2)"
+layout: "aws"
+page_title: "AWS: aws_snapshot_create_volume_permission"
+description: |-
+  Adds create volume permission to an EBS Snapshot
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_snapshot_create_volume_permission
+
+Adds permission to create volumes off of a given EBS Snapshot.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ebs_snapshot import EbsSnapshot
+from imports.aws.ebs_volume import EbsVolume
+from imports.aws.snapshot_create_volume_permission import SnapshotCreateVolumePermission
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = EbsVolume(self, "example",
+            availability_zone="us-west-2a",
+            size=40
+        )
+        example_snapshot = EbsSnapshot(self, "example_snapshot",
+            volume_id=example.id
+        )
+        SnapshotCreateVolumePermission(self, "example_perm",
+            account_id="12345678",
+            snapshot_id=example_snapshot.id
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `snapshot_id` - (Required) A snapshot ID
+* `account_id` - (Required) An AWS Account ID to add create volume permissions. The AWS Account cannot be the snapshot's owner
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - A combination of "`snapshot_id`-`account_id`".
+
+<!-- cache-key: cdktf-0.18.0 input-1dcd90ebf6e64f894d48700c8915b1ac0302acfb0e05cf97d2a2a97312bf066c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/sns_platform_application.html.markdown b/website/docs/cdktf/python/r/sns_platform_application.html.markdown
new file mode 100644
index 00000000000..4f657d61abf
--- /dev/null
+++ b/website/docs/cdktf/python/r/sns_platform_application.html.markdown
@@ -0,0 +1,134 @@
+---
+subcategory: "SNS (Simple Notification)"
+layout: "aws"
+page_title: "AWS: aws_sns_platform_application"
+description: |-
+  Provides an SNS platform application resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sns_platform_application
+
+Provides an SNS platform application resource
+
+## Example Usage
+
+### Apple Push Notification Service (APNS) using certificate-based authentication
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.sns_platform_application import SnsPlatformApplication
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SnsPlatformApplication(self, "apns_application",
+            name="apns_application",
+            platform="APNS",
+            platform_credential="<APNS PRIVATE KEY>",
+            platform_principal="<APNS CERTIFICATE>"
+        )
+```
+
+### Apple Push Notification Service (APNS) using token-based authentication
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.sns_platform_application import SnsPlatformApplication
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SnsPlatformApplication(self, "apns_application",
+            apple_platform_bundle_id="<APPLE BUNDLE ID>",
+            apple_platform_team_id="<APPLE TEAM ID>",
+            name="apns_application",
+            platform="APNS",
+            platform_credential="<APNS SIGNING KEY>",
+            platform_principal="<APNS SIGNING KEY ID>"
+        )
+```
+
+### Google Cloud Messaging (GCM)
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.sns_platform_application import SnsPlatformApplication
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SnsPlatformApplication(self, "gcm_application",
+            name="gcm_application",
+            platform="GCM",
+            platform_credential="<GCM API KEY>"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The friendly name for the SNS platform application
+* `platform` - (Required) The platform that the app is registered with. See [Platform][1] for supported platforms.
+* `platform_credential` - (Required) Application Platform credential. See [Credential][1] for type of credential required for platform. The value of this attribute when stored into the Terraform state is only a hash of the real value, so therefore it is not practical to use this as an attribute for other resources.
+* `event_delivery_failure_topic_arn` - (Optional) The ARN of the SNS Topic triggered when a delivery to any of the platform endpoints associated with your platform application encounters a permanent failure.
+* `event_endpoint_created_topic_arn` - (Optional) The ARN of the SNS Topic triggered when a new platform endpoint is added to your platform application.
+* `event_endpoint_deleted_topic_arn` - (Optional) The ARN of the SNS Topic triggered when an existing platform endpoint is deleted from your platform application.
+* `event_endpoint_updated_topic_arn` - (Optional) The ARN of the SNS Topic triggered when an existing platform endpoint is changed from your platform application.
+* `failure_feedback_role_arn` - (Optional) The IAM role ARN permitted to receive failure feedback for this application and give SNS write access to use CloudWatch logs on your behalf.
+* `platform_principal` - (Optional) Application Platform principal. See [Principal][2] for type of principal required for platform. The value of this attribute when stored into the Terraform state is only a hash of the real value, so therefore it is not practical to use this as an attribute for other resources.
+* `success_feedback_role_arn` - (Optional) The IAM role ARN permitted to receive success feedback for this application and give SNS write access to use CloudWatch logs on your behalf.
+* `success_feedback_sample_rate` - (Optional) The sample rate percentage (0-100) of successfully delivered messages.
+
+The following attributes are needed only when using APNS token credentials:
+
+* `apple_platform_team_id` - (Required) The identifier that's assigned to your Apple developer account team. Must be 10 alphanumeric characters.
+* `apple_platform_bundle_id` - (Required) The bundle identifier that's assigned to your iOS app. May only include alphanumeric characters, hyphens (-), and periods (.).
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ARN of the SNS platform application
+* `arn` - The ARN of the SNS platform application
+
+[1]: http://docs.aws.amazon.com/sns/latest/dg/mobile-push-send-register.html
+[2]: http://docs.aws.amazon.com/sns/latest/api/API_CreatePlatformApplication.html
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SNS platform applications using the ARN. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import SNS platform applications using the ARN. For example:
+
+```console
+% terraform import aws_sns_platform_application.gcm_application arn:aws:sns:us-west-2:0123456789012:app/GCM/gcm_application
+```
+
+<!-- cache-key: cdktf-0.18.0 input-cab192bfd8c23eada362cd924116cfcfef5154b99069d7d8bda52c652e5e8436 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/sns_sms_preferences.html.markdown b/website/docs/cdktf/python/r/sns_sms_preferences.html.markdown
new file mode 100644
index 00000000000..6bdad0c081a
--- /dev/null
+++ b/website/docs/cdktf/python/r/sns_sms_preferences.html.markdown
@@ -0,0 +1,47 @@
+---
+subcategory: "SNS (Simple Notification)"
+layout: "aws"
+page_title: "AWS: aws_sns_sms_preferences"
+description: |-
+  Provides a way to set SNS SMS preferences.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sns_sms_preferences
+
+Provides a way to set SNS SMS preferences.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.sns_sms_preferences import SnsSmsPreferences
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SnsSmsPreferences(self, "update_sms_prefs")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `monthly_spend_limit` - (Optional) The maximum amount in USD that you are willing to spend each month to send SMS messages.
+* `delivery_status_iam_role_arn` - (Optional) The ARN of the IAM role that allows Amazon SNS to write logs about SMS deliveries in CloudWatch Logs.
+* `delivery_status_success_sampling_rate` - (Optional) The percentage of successful SMS deliveries for which Amazon SNS will write logs in CloudWatch Logs. The value must be between 0 and 100.
+* `default_sender_id` - (Optional) A string, such as your business brand, that is displayed as the sender on the receiving device.
+* `default_sms_type` - (Optional) The type of SMS message that you will send by default. Possible values are: Promotional, Transactional
+* `usage_report_s3_bucket` - (Optional) The name of the Amazon S3 bucket to receive daily SMS usage reports from Amazon SNS.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+<!-- cache-key: cdktf-0.18.0 input-fb3841d6bcaa58c6f6663ac36ae2dd4fc2b84b493c3c7984f840593cb184fb68 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/sns_topic.html.markdown b/website/docs/cdktf/python/r/sns_topic.html.markdown
new file mode 100644
index 00000000000..1f981cc1f21
--- /dev/null
+++ b/website/docs/cdktf/python/r/sns_topic.html.markdown
@@ -0,0 +1,158 @@
+---
+subcategory: "SNS (Simple Notification)"
+layout: "aws"
+page_title: "AWS: aws_sns_topic"
+description: |-
+  Provides an SNS topic resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sns_topic
+
+Provides an SNS topic resource
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.sns_topic import SnsTopic
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SnsTopic(self, "user_updates",
+            name="user-updates-topic"
+        )
+```
+
+## Example with Delivery Policy
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.sns_topic import SnsTopic
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SnsTopic(self, "user_updates",
+            delivery_policy="{\n  \"http\": {\n    \"defaultHealthyRetryPolicy\": {\n      \"minDelayTarget\": 20,\n      \"maxDelayTarget\": 20,\n      \"numRetries\": 3,\n      \"numMaxDelayRetries\": 0,\n      \"numNoDelayRetries\": 0,\n      \"numMinDelayRetries\": 0,\n      \"backoffFunction\": \"linear\"\n    },\n    \"disableSubscriptionOverrides\": false,\n    \"defaultThrottlePolicy\": {\n      \"maxReceivesPerSecond\": 1\n    }\n  }\n}\n\n",
+            name="user-updates-topic"
+        )
+```
+
+## Example with Server-side encryption (SSE)
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.sns_topic import SnsTopic
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SnsTopic(self, "user_updates",
+            kms_master_key_id="alias/aws/sns",
+            name="user-updates-topic"
+        )
+```
+
+## Example with First-In-First-Out (FIFO)
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.sns_topic import SnsTopic
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SnsTopic(self, "user_updates",
+            content_based_deduplication=True,
+            fifo_topic=True,
+            name="user-updates-topic.fifo"
+        )
+```
+
+## Message Delivery Status Arguments
+
+The `<endpoint>_success_feedback_role_arn` and `<endpoint>_failure_feedback_role_arn` arguments are used to give Amazon SNS write access to use CloudWatch Logs on your behalf. The `<endpoint>_success_feedback_sample_rate` argument is for specifying the sample rate percentage (0-100) of successfully delivered messages. After you configure the  `<endpoint>_failure_feedback_role_arn` argument, then all failed message deliveries generate CloudWatch Logs.
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Optional) The name of the topic. Topic names must be made up of only uppercase and lowercase ASCII letters, numbers, underscores, and hyphens, and must be between 1 and 256 characters long. For a FIFO (first-in-first-out) topic, the name must end with the `.fifo` suffix. If omitted, Terraform will assign a random, unique name. Conflicts with `name_prefix`
+* `name_prefix` - (Optional) Creates a unique name beginning with the specified prefix. Conflicts with `name`
+* `display_name` - (Optional) The display name for the topic
+* `policy` - (Optional) The fully-formed AWS policy as JSON. For more information about building AWS IAM policy documents with Terraform, see the [AWS IAM Policy Document Guide](https://learn.hashicorp.com/terraform/aws/iam-policy).
+* `delivery_policy` - (Optional) The SNS delivery policy. More on [AWS documentation](https://docs.aws.amazon.com/sns/latest/dg/DeliveryPolicies.html)
+* `application_success_feedback_role_arn` - (Optional) The IAM role permitted to receive success feedback for this topic
+* `application_success_feedback_sample_rate` - (Optional) Percentage of success to sample
+* `application_failure_feedback_role_arn` - (Optional) IAM role for failure feedback
+* `http_success_feedback_role_arn` - (Optional) The IAM role permitted to receive success feedback for this topic
+* `http_success_feedback_sample_rate` - (Optional) Percentage of success to sample
+* `http_failure_feedback_role_arn` - (Optional) IAM role for failure feedback
+* `kms_master_key_id` - (Optional) The ID of an AWS-managed customer master key (CMK) for Amazon SNS or a custom CMK. For more information, see [Key Terms](https://docs.aws.amazon.com/sns/latest/dg/sns-server-side-encryption.html#sse-key-terms)
+* `signature_version` - (Optional) If `SignatureVersion` should be [1 (SHA1) or 2 (SHA256)](https://docs.aws.amazon.com/sns/latest/dg/sns-verify-signature-of-message.html). The signature version corresponds to the hashing algorithm used while creating the signature of the notifications, subscription confirmations, or unsubscribe confirmation messages sent by Amazon SNS.
+* `tracing_config` - (Optional) Tracing mode of an Amazon SNS topic. Valid values: `"PassThrough"`, `"Active"`.
+* `fifo_topic` - (Optional) Boolean indicating whether or not to create a FIFO (first-in-first-out) topic (default is `false`).
+* `content_based_deduplication` - (Optional) Enables content-based deduplication for FIFO topics. For more information, see the [related documentation](https://docs.aws.amazon.com/sns/latest/dg/fifo-message-dedup.html)
+* `lambda_success_feedback_role_arn` - (Optional) The IAM role permitted to receive success feedback for this topic
+* `lambda_success_feedback_sample_rate` - (Optional) Percentage of success to sample
+* `lambda_failure_feedback_role_arn` - (Optional) IAM role for failure feedback
+* `sqs_success_feedback_role_arn` - (Optional) The IAM role permitted to receive success feedback for this topic
+* `sqs_success_feedback_sample_rate` - (Optional) Percentage of success to sample
+* `sqs_failure_feedback_role_arn` - (Optional) IAM role for failure feedback
+* `firehose_success_feedback_role_arn` - (Optional) The IAM role permitted to receive success feedback for this topic
+* `firehose_success_feedback_sample_rate` - (Optional) Percentage of success to sample
+* `firehose_failure_feedback_role_arn` - (Optional) IAM role for failure feedback
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ARN of the SNS topic
+* `arn` - The ARN of the SNS topic, as a more obvious property (clone of id)
+* `owner` - The AWS Account ID of the SNS topic owner
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SNS Topics using the topic `arn`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import SNS Topics using the topic `arn`. For example:
+
+```console
+% terraform import aws_sns_topic.user_updates arn:aws:sns:us-west-2:0123456789012:my-topic
+```
+
+<!-- cache-key: cdktf-0.18.0 input-0d5a35abbfaca86d4dd3ed7192fda282da053dc7b804f69b6b227e9ae60cda2f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/sns_topic_data_protection_policy.html.markdown b/website/docs/cdktf/python/r/sns_topic_data_protection_policy.html.markdown
new file mode 100644
index 00000000000..21683a71428
--- /dev/null
+++ b/website/docs/cdktf/python/r/sns_topic_data_protection_policy.html.markdown
@@ -0,0 +1,88 @@
+---
+subcategory: "SNS (Simple Notification)"
+layout: "aws"
+page_title: "AWS: aws_sns_topic_data_protection_policy"
+description: |-
+  Provides an SNS data protection topic policy resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sns_topic_data_protection_policy
+
+Provides an SNS data protection topic policy resource
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.sns_topic import SnsTopic
+from imports.aws.sns_topic_data_protection_policy import SnsTopicDataProtectionPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = SnsTopic(self, "example",
+            name="example"
+        )
+        aws_sns_topic_data_protection_policy_example =
+        SnsTopicDataProtectionPolicy(self, "example_1",
+            arn=example.arn,
+            policy=Token.as_string(
+                Fn.jsonencode({
+                    "Description": "Example data protection policy",
+                    "Name": "__example_data_protection_policy",
+                    "Statement": [{
+                        "DataDirection": "Inbound",
+                        "DataIdentifier": ["arn:aws:dataprotection::aws:data-identifier/EmailAddress"
+                        ],
+                        "Operation": {
+                            "Deny": {}
+                        },
+                        "Principal": ["*"],
+                        "Sid": "__deny_statement_11ba9d96"
+                    }
+                    ],
+                    "Version": "2021-06-01"
+                }))
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_sns_topic_data_protection_policy_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `arn` - (Required) The ARN of the SNS topic
+* `policy` - (Required) The fully-formed AWS policy as JSON. For more information about building AWS IAM policy documents with Terraform, see the [AWS IAM Policy Document Guide](https://learn.hashicorp.com/terraform/aws/iam-policy).
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SNS Data Protection Topic Policy using the topic ARN. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import SNS Data Protection Topic Policy using the topic ARN. For example:
+
+```console
+% terraform import aws_sns_topic_data_protection_policy.example arn:aws:sns:us-west-2:0123456789012:example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-9873cc188a9eeb3e1e9911705d4e32ec2577e6f0a3d25c0c52f1bdca092cd422 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/sns_topic_policy.html.markdown b/website/docs/cdktf/python/r/sns_topic_policy.html.markdown
new file mode 100644
index 00000000000..8be20afb57e
--- /dev/null
+++ b/website/docs/cdktf/python/r/sns_topic_policy.html.markdown
@@ -0,0 +1,96 @@
+---
+subcategory: "SNS (Simple Notification)"
+layout: "aws"
+page_title: "AWS: aws_sns_topic_policy"
+description: |-
+  Provides an SNS topic policy resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sns_topic_policy
+
+Provides an SNS topic policy resource
+
+~> **NOTE:** If a Principal is specified as just an AWS account ID rather than an ARN, AWS silently converts it to the ARN for the root user, causing future terraform plans to differ. To avoid this problem, just specify the full ARN, e.g., `arn:aws:iam::123456789012:root`
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.sns_topic import SnsTopic
+from imports.aws.sns_topic_policy import SnsTopicPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        test = SnsTopic(self, "test",
+            name="my-topic-with-policy"
+        )
+        sns_topic_policy = DataAwsIamPolicyDocument(self, "sns_topic_policy",
+            policy_id="__default_policy_ID",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["SNS:Subscribe", "SNS:SetTopicAttributes", "SNS:RemovePermission", "SNS:Receive", "SNS:Publish", "SNS:ListSubscriptionsByTopic", "SNS:GetTopicAttributes", "SNS:DeleteTopic", "SNS:AddPermission"
+                ],
+                condition=[DataAwsIamPolicyDocumentStatementCondition(
+                    test="StringEquals",
+                    values=[account_id.string_value],
+                    variable="AWS:SourceOwner"
+                )
+                ],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["*"],
+                    type="AWS"
+                )
+                ],
+                resources=[test.arn],
+                sid="__default_statement_ID"
+            )
+            ]
+        )
+        SnsTopicPolicy(self, "default",
+            arn=test.arn,
+            policy=Token.as_string(sns_topic_policy.json)
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `arn` - (Required) The ARN of the SNS topic
+* `policy` - (Required) The fully-formed AWS policy as JSON. For more information about building AWS IAM policy documents with Terraform, see the [AWS IAM Policy Document Guide](https://learn.hashicorp.com/terraform/aws/iam-policy).
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `owner` - The AWS Account ID of the SNS topic owner
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SNS Topic Policy using the topic ARN. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import SNS Topic Policy using the topic ARN. For example:
+
+```console
+% terraform import aws_sns_topic_policy.user_updates arn:aws:sns:us-west-2:0123456789012:my-topic
+```
+
+<!-- cache-key: cdktf-0.18.0 input-5367b280c7c37833f246feb7e18158b32cf70822bccb3de74447a6068d898a1b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/sns_topic_subscription.html.markdown b/website/docs/cdktf/python/r/sns_topic_subscription.html.markdown
new file mode 100644
index 00000000000..123e204e9af
--- /dev/null
+++ b/website/docs/cdktf/python/r/sns_topic_subscription.html.markdown
@@ -0,0 +1,326 @@
+---
+subcategory: "SNS (Simple Notification)"
+layout: "aws"
+page_title: "AWS: aws_sns_topic_subscription"
+description: |-
+  Provides a resource for subscribing to SNS topics.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sns_topic_subscription
+
+Provides a resource for subscribing to SNS topics. Requires that an SNS topic exist for the subscription to attach to. This resource allows you to automatically place messages sent to SNS topics in SQS queues, send them as HTTP(S) POST requests to a given endpoint, send SMS messages, or notify devices / applications. The most likely use case for Terraform users will probably be SQS queues.
+
+~> **NOTE:** If the SNS topic and SQS queue are in different AWS regions, the `aws_sns_topic_subscription` must use an AWS provider that is in the same region as the SNS topic. If the `aws_sns_topic_subscription` uses a provider with a different region than the SNS topic, Terraform will fail to create the subscription.
+
+~> **NOTE:** Setup of cross-account subscriptions from SNS topics to SQS queues requires Terraform to have access to BOTH accounts.
+
+~> **NOTE:** If an SNS topic and SQS queue are in different AWS accounts but the same region, the `aws_sns_topic_subscription` must use the AWS provider for the account with the SQS queue. If `aws_sns_topic_subscription` uses a Provider with a different account than the SQS queue, Terraform creates the subscription but does not keep state and tries to re-create the subscription at every `apply`.
+
+~> **NOTE:** If an SNS topic and SQS queue are in different AWS accounts and different AWS regions, the subscription needs to be initiated from the account with the SQS queue but in the region of the SNS topic.
+
+~> **NOTE:** You cannot unsubscribe to a subscription that is pending confirmation. If you use `email`, `email-json`, or `http`/`https` (without auto-confirmation enabled), until the subscription is confirmed (e.g., outside of Terraform), AWS does not allow Terraform to delete / unsubscribe the subscription. If you `destroy` an unconfirmed subscription, Terraform will remove the subscription from its state but the subscription will still exist in AWS. However, if you delete an SNS topic, SNS [deletes all the subscriptions](https://docs.aws.amazon.com/sns/latest/dg/sns-delete-subscription-topic.html) associated with the topic. Also, you can import a subscription after confirmation and then have the capability to delete it.
+
+## Example Usage
+
+You can directly supply a topic and ARN by hand in the `topic_arn` property along with the queue ARN:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.sns_topic_subscription import SnsTopicSubscription
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SnsTopicSubscription(self, "user_updates_sqs_target",
+            endpoint="arn:aws:sqs:us-west-2:432981146916:terraform-queue-too",
+            protocol="sqs",
+            topic_arn="arn:aws:sns:us-west-2:432981146916:user-updates-topic"
+        )
+```
+
+Alternatively you can use the ARN properties of a managed SNS topic and SQS queue:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.sns_topic import SnsTopic
+from imports.aws.sns_topic_subscription import SnsTopicSubscription
+from imports.aws.sqs_queue import SqsQueue
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        user_updates = SnsTopic(self, "user_updates",
+            name="user-updates-topic"
+        )
+        user_updates_queue = SqsQueue(self, "user_updates_queue",
+            name="user-updates-queue"
+        )
+        SnsTopicSubscription(self, "user_updates_sqs_target",
+            endpoint=user_updates_queue.arn,
+            protocol="sqs",
+            topic_arn=user_updates.arn
+        )
+```
+
+You can subscribe SNS topics to SQS queues in different Amazon accounts and regions:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformVariable, Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.provider import AwsProvider
+from imports.aws.sns_topic import SnsTopic
+from imports.aws.sns_topic_subscription import SnsTopicSubscription
+from imports.aws.sqs_queue import SqsQueue
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        # Terraform Variables are not always the best fit for getting inputs in the context of Terraform CDK.
+        #     You can read more about this at https://cdk.tf/variables
+        sns = TerraformVariable(self, "sns",
+            default=[{
+                "account-id": "111111111111",
+                "display_name": "example",
+                "name": "example-sns-topic",
+                "region": "us-west-1",
+                "role-name": "service/service-hashicorp-terraform"
+            }
+            ]
+        )
+        sqs = TerraformVariable(self, "sqs",
+            default=[{
+                "account-id": "222222222222",
+                "name": "example-sqs-queue",
+                "region": "us-east-1",
+                "role-name": "service/service-hashicorp-terraform"
+            }
+            ]
+        )
+        sns_topic_policy = DataAwsIamPolicyDocument(self, "sns-topic-policy",
+            policy_id="__default_policy_ID",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["SNS:Subscribe", "SNS:SetTopicAttributes", "SNS:RemovePermission", "SNS:Publish", "SNS:ListSubscriptionsByTopic", "SNS:GetTopicAttributes", "SNS:DeleteTopic", "SNS:AddPermission"
+                ],
+                condition=[DataAwsIamPolicyDocumentStatementCondition(
+                    test="StringEquals",
+                    values=[
+                        Token.as_string(Fn.lookup_nested(sns.value, ["\"account-id\""]))
+                    ],
+                    variable="AWS:SourceOwner"
+                )
+                ],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["*"],
+                    type="AWS"
+                )
+                ],
+                resources=["arn:aws:sns:" +
+                    Token.as_string(Fn.lookup_nested(sns.value, ["\"region\""])) + ":" +
+                    Token.as_string(Fn.lookup_nested(sns.value, ["\"account-id\""])) + ":" +
+                    Token.as_string(Fn.lookup_nested(sns.value, ["\"name\""]))
+                ],
+                sid="__default_statement_ID"
+            ), DataAwsIamPolicyDocumentStatement(
+                actions=["SNS:Subscribe", "SNS:Receive"],
+                condition=[DataAwsIamPolicyDocumentStatementCondition(
+                    test="StringLike",
+                    values=["arn:aws:sqs:" +
+                        Token.as_string(Fn.lookup_nested(sqs.value, ["\"region\""])) + ":" +
+                        Token.as_string(
+                            Fn.lookup_nested(sqs.value, ["\"account-id\""])) + ":" +
+                        Token.as_string(Fn.lookup_nested(sqs.value, ["\"name\""]))
+                    ],
+                    variable="SNS:Endpoint"
+                )
+                ],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["*"],
+                    type="AWS"
+                )
+                ],
+                resources=["arn:aws:sns:" +
+                    Token.as_string(Fn.lookup_nested(sns.value, ["\"region\""])) + ":" +
+                    Token.as_string(Fn.lookup_nested(sns.value, ["\"account-id\""])) + ":" +
+                    Token.as_string(Fn.lookup_nested(sns.value, ["\"name\""]))
+                ],
+                sid="__console_sub_0"
+            )
+            ]
+        )
+        sqs_queue_policy = DataAwsIamPolicyDocument(self, "sqs-queue-policy",
+            policy_id="arn:aws:sqs:" +
+            Token.as_string(Fn.lookup_nested(sqs.value, ["\"region\""])) + ":" +
+            Token.as_string(Fn.lookup_nested(sqs.value, ["\"account-id\""])) + ":" +
+            Token.as_string(Fn.lookup_nested(sqs.value, ["\"name\""])) + "/SQSDefaultPolicy",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["SQS:SendMessage"],
+                condition=[DataAwsIamPolicyDocumentStatementCondition(
+                    test="ArnEquals",
+                    values=["arn:aws:sns:" +
+                        Token.as_string(Fn.lookup_nested(sns.value, ["\"region\""])) + ":" +
+                        Token.as_string(
+                            Fn.lookup_nested(sns.value, ["\"account-id\""])) + ":" +
+                        Token.as_string(Fn.lookup_nested(sns.value, ["\"name\""]))
+                    ],
+                    variable="aws:SourceArn"
+                )
+                ],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["*"],
+                    type="AWS"
+                )
+                ],
+                resources=["arn:aws:sqs:" +
+                    Token.as_string(Fn.lookup_nested(sqs.value, ["\"region\""])) + ":" +
+                    Token.as_string(Fn.lookup_nested(sqs.value, ["\"account-id\""])) + ":" +
+                    Token.as_string(Fn.lookup_nested(sqs.value, ["\"name\""]))
+                ],
+                sid="example-sns-topic"
+            )
+            ]
+        )
+        aws_sns = AwsProvider(self, "aws",
+            alias="sns",
+            assume_role=[AwsProviderAssumeRole(
+                role_arn="arn:aws:iam::" +
+                Token.as_string(Fn.lookup_nested(sns.value, ["\"account-id\""])) + ":role/" +
+                Token.as_string(Fn.lookup_nested(sns.value, ["\"role-name\""])),
+                session_name="sns-" + Token.as_string(Fn.lookup_nested(sns.value, ["\"region\""]))
+            )
+            ],
+            region=Token.as_string(Fn.lookup_nested(sns.value, ["\"region\""]))
+        )
+        aws_sqs = AwsProvider(self, "aws_5",
+            alias="sqs",
+            assume_role=[AwsProviderAssumeRole(
+                role_arn="arn:aws:iam::" +
+                Token.as_string(Fn.lookup_nested(sqs.value, ["\"account-id\""])) + ":role/" +
+                Token.as_string(Fn.lookup_nested(sqs.value, ["\"role-name\""])),
+                session_name="sqs-" + Token.as_string(Fn.lookup_nested(sqs.value, ["\"region\""]))
+            )
+            ],
+            region=Token.as_string(Fn.lookup_nested(sqs.value, ["\"region\""]))
+        )
+        sns2_sqs = AwsProvider(self, "aws_6",
+            alias="sns2sqs",
+            assume_role=[AwsProviderAssumeRole(
+                role_arn="arn:aws:iam::" +
+                Token.as_string(Fn.lookup_nested(sqs.value, ["\"account-id\""])) + ":role/" +
+                Token.as_string(Fn.lookup_nested(sqs.value, ["\"role-name\""])),
+                session_name="sns2sqs-" +
+                Token.as_string(Fn.lookup_nested(sns.value, ["\"region\""]))
+            )
+            ],
+            region=Token.as_string(Fn.lookup_nested(sns.value, ["\"region\""]))
+        )
+        sns_topic = SnsTopic(self, "sns-topic",
+            display_name=Token.as_string(
+                Fn.lookup_nested(sns.value, ["\"display_name\""])),
+            name=Token.as_string(Fn.lookup_nested(sns.value, ["\"name\""])),
+            policy=Token.as_string(sns_topic_policy.json),
+            provider="${aws.sns}"
+        )
+        sqs_queue = SqsQueue(self, "sqs-queue",
+            name=Token.as_string(Fn.lookup_nested(sqs.value, ["\"name\""])),
+            policy=Token.as_string(sqs_queue_policy.json),
+            provider="${aws.sqs}"
+        )
+        aws_sns_topic_subscription_sns_topic = SnsTopicSubscription(self, "sns-topic_9",
+            endpoint=sqs_queue.arn,
+            protocol="sqs",
+            provider=sns2_sqs,
+            topic_arn=sns_topic.arn
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_sns_topic_subscription_sns_topic.override_logical_id("sns-topic")
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `endpoint` - (Required) Endpoint to send data to. The contents vary with the protocol. See details below.
+* `protocol` - (Required) Protocol to use. Valid values are: `sqs`, `sms`, `lambda`, `firehose`, and `application`. Protocols `email`, `email-json`, `http` and `https` are also valid but partially supported. See details below.
+* `subscription_role_arn` - (Required if `protocol` is `firehose`) ARN of the IAM role to publish to Kinesis Data Firehose delivery stream. Refer to [SNS docs](https://docs.aws.amazon.com/sns/latest/dg/sns-firehose-as-subscriber.html).
+* `topic_arn` - (Required) ARN of the SNS topic to subscribe to.
+
+The following arguments are optional:
+
+* `confirmation_timeout_in_minutes` - (Optional) Integer indicating number of minutes to wait in retrying mode for fetching subscription arn before marking it as failure. Only applicable for http and https protocols. Default is `1`.
+* `delivery_policy` - (Optional) JSON String with the delivery policy (retries, backoff, etc.) that will be used in the subscription - this only applies to HTTP/S subscriptions. Refer to the [SNS docs](https://docs.aws.amazon.com/sns/latest/dg/DeliveryPolicies.html) for more details.
+* `endpoint_auto_confirms` - (Optional) Whether the endpoint is capable of [auto confirming subscription](http://docs.aws.amazon.com/sns/latest/dg/SendMessageToHttp.html#SendMessageToHttp.prepare) (e.g., PagerDuty). Default is `false`.
+* `filter_policy` - (Optional) JSON String with the filter policy that will be used in the subscription to filter messages seen by the target resource. Refer to the [SNS docs](https://docs.aws.amazon.com/sns/latest/dg/message-filtering.html) for more details.
+* `filter_policy_scope` - (Optional) Whether the `filter_policy` applies to `MessageAttributes` (default) or `MessageBody`.
+* `raw_message_delivery` - (Optional) Whether to enable raw message delivery (the original message is directly passed, not wrapped in JSON with the original message in the message property). Default is `false`.
+* `redrive_policy` - (Optional) JSON String with the redrive policy that will be used in the subscription. Refer to the [SNS docs](https://docs.aws.amazon.com/sns/latest/dg/sns-dead-letter-queues.html#how-messages-moved-into-dead-letter-queue) for more details.
+
+### Protocol support
+
+Supported values for `protocol` include:
+
+* `application` - Delivers JSON-encoded messages. `endpoint` is the endpoint ARN of a mobile app and device.
+* `firehose` - Delivers JSON-encoded messages. `endpoint` is the ARN of an Amazon Kinesis Data Firehose delivery stream (e.g.,
+`arn:aws:firehose:us-east-1:123456789012:deliverystream/ticketUploadStream`).
+* `lambda` - Delivers JSON-encoded messages. `endpoint` is the ARN of an AWS Lambda function.
+* `sms` - Delivers text messages via SMS. `endpoint` is the phone number of an SMS-enabled device.
+* `sqs` - Delivers JSON-encoded messages. `endpoint` is the ARN of an Amazon SQS queue (e.g., `arn:aws:sqs:us-west-2:123456789012:terraform-queue-too`).
+
+Partially supported values for `protocol` include:
+
+~> **NOTE:** If an `aws_sns_topic_subscription` uses a partially-supported protocol and the subscription is not confirmed, either through automatic confirmation or means outside of Terraform (e.g., clicking on a "Confirm Subscription" link in an email), Terraform cannot delete / unsubscribe the subscription. Attempting to `destroy` an unconfirmed subscription will remove the `aws_sns_topic_subscription` from Terraform's state but **_will not_** remove the subscription from AWS. The `pending_confirmation` attribute provides confirmation status.
+
+* `email` - Delivers messages via SMTP. `endpoint` is an email address.
+* `email-json` - Delivers JSON-encoded messages via SMTP. `endpoint` is an email address.
+* `http` -- Delivers JSON-encoded messages via HTTP POST. `endpoint` is a URL beginning with `http://`.
+* `https` -- Delivers JSON-encoded messages via HTTPS POST. `endpoint` is a URL beginning with `https://`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the subscription.
+* `confirmation_was_authenticated` - Whether the subscription confirmation request was authenticated.
+* `id` - ARN of the subscription.
+* `owner_id` - AWS account ID of the subscription's owner.
+* `pending_confirmation` - Whether the subscription has not been confirmed.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SNS Topic Subscriptions using the subscription `arn`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import SNS Topic Subscriptions using the subscription `arn`. For example:
+
+```console
+% terraform import aws_sns_topic_subscription.user_updates_sqs_target arn:aws:sns:us-west-2:0123456789012:my-topic:8a21d249-4329-4871-acc6-7be709c6ea7f
+```
+
+<!-- cache-key: cdktf-0.18.0 input-5b34e1ee5476100d66df854cd8d8f41ffb1973a2919f7c877f7e67fbb902e1f0 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/spot_datafeed_subscription.html.markdown b/website/docs/cdktf/python/r/spot_datafeed_subscription.html.markdown
new file mode 100644
index 00000000000..8509912ff0a
--- /dev/null
+++ b/website/docs/cdktf/python/r/spot_datafeed_subscription.html.markdown
@@ -0,0 +1,72 @@
+---
+subcategory: "EC2 (Elastic Compute Cloud)"
+layout: "aws"
+page_title: "AWS: aws_spot_datafeed_subscription"
+description: |-
+  Provides a Spot Datafeed Subscription resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_spot_datafeed_subscription
+
+-> **Note:** There is only a single subscription allowed per account.
+
+To help you understand the charges for your Spot instances, Amazon EC2 provides a data feed that describes your Spot instance usage and pricing.
+This data feed is sent to an Amazon S3 bucket that you specify when you subscribe to the data feed.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.spot_datafeed_subscription import SpotDatafeedSubscription
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        default_var = S3Bucket(self, "default",
+            bucket="tf-spot-datafeed"
+        )
+        aws_spot_datafeed_subscription_default = SpotDatafeedSubscription(self, "default_1",
+            bucket=default_var.id,
+            prefix="my_subdirectory"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_spot_datafeed_subscription_default.override_logical_id("default")
+```
+
+## Argument Reference
+
+* `bucket` - (Required) The Amazon S3 bucket in which to store the Spot instance data feed.
+* `prefix` - (Optional) Path of folder inside bucket to place spot pricing data.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import a Spot Datafeed Subscription using the word `spot-datafeed-subscription`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import a Spot Datafeed Subscription using the word `spot-datafeed-subscription`. For example:
+
+```console
+% terraform import aws_spot_datafeed_subscription.mysubscription spot-datafeed-subscription
+```
+
+<!-- cache-key: cdktf-0.18.0 input-70bf26be611a3ee0c49d03716734469d118e9b44f2ed7494fad6b135c57c3c2e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/spot_fleet_request.html.markdown b/website/docs/cdktf/python/r/spot_fleet_request.html.markdown
new file mode 100644
index 00000000000..acd66b24aa7
--- /dev/null
+++ b/website/docs/cdktf/python/r/spot_fleet_request.html.markdown
@@ -0,0 +1,490 @@
+---
+subcategory: "EC2 (Elastic Compute Cloud)"
+layout: "aws"
+page_title: "AWS: aws_spot_fleet_request"
+description: |-
+  Provides a Spot Fleet Request resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_spot_fleet_request
+
+Provides an EC2 Spot Fleet Request resource. This allows a fleet of Spot
+instances to be requested on the Spot market.
+
+~> **NOTE [AWS strongly discourages](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/spot-best-practices.html#which-spot-request-method-to-use) the use of the legacy APIs called by this resource.
+We recommend using the [EC2 Fleet](ec2_fleet.html) or [Auto Scaling Group](autoscaling_group.html) resources instead.
+
+## Example Usage
+
+### Using launch specifications
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.spot_fleet_request import SpotFleetRequest
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SpotFleetRequest(self, "cheap_compute",
+            allocation_strategy="diversified",
+            iam_fleet_role="arn:aws:iam::12345678:role/spot-fleet",
+            launch_specification=[SpotFleetRequestLaunchSpecification(
+                ami="ami-1234",
+                iam_instance_profile_arn=example.arn,
+                instance_type="m4.10xlarge",
+                placement_tenancy="dedicated",
+                spot_price="2.793"
+            ), SpotFleetRequestLaunchSpecification(
+                ami="ami-5678",
+                availability_zone="us-west-1a",
+                iam_instance_profile_arn=example.arn,
+                instance_type="m4.4xlarge",
+                key_name="my-key",
+                root_block_device=[SpotFleetRequestLaunchSpecificationRootBlockDevice(
+                    volume_size=Token.as_number("300"),
+                    volume_type="gp2"
+                )
+                ],
+                spot_price="1.117",
+                subnet_id="subnet-1234",
+                tags={
+                    "Name": "spot-fleet-example"
+                },
+                weighted_capacity=Token.as_string(35)
+            )
+            ],
+            spot_price="0.03",
+            target_capacity=6,
+            valid_until="2019-11-04T20:44:20Z"
+        )
+```
+
+### Using launch templates
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.launch_template import LaunchTemplate
+from imports.aws.spot_fleet_request import SpotFleetRequest
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        foo = LaunchTemplate(self, "foo",
+            image_id="ami-516b9131",
+            instance_type="m1.small",
+            key_name="some-key",
+            name="launch-template"
+        )
+        aws_spot_fleet_request_foo = SpotFleetRequest(self, "foo_1",
+            depends_on=[test_attach],
+            iam_fleet_role="arn:aws:iam::12345678:role/spot-fleet",
+            launch_template_config=[SpotFleetRequestLaunchTemplateConfig(
+                launch_template_specification=SpotFleetRequestLaunchTemplateConfigLaunchTemplateSpecification(
+                    id=foo.id,
+                    version=Token.as_string(foo.latest_version)
+                )
+            )
+            ],
+            spot_price="0.005",
+            target_capacity=2,
+            valid_until="2019-11-04T20:44:20Z"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_spot_fleet_request_foo.override_logical_id("foo")
+```
+
+~> **NOTE:** Terraform does not support the functionality where multiple `subnet_id` or `availability_zone` parameters can be specified in the same
+launch configuration block. If you want to specify multiple values, then separate launch configuration blocks should be used or launch template overrides should be configured, one per subnet:
+
+### Using multiple launch specifications
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.spot_fleet_request import SpotFleetRequest
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SpotFleetRequest(self, "foo",
+            iam_fleet_role="arn:aws:iam::12345678:role/spot-fleet",
+            launch_specification=[SpotFleetRequestLaunchSpecification(
+                ami="ami-d06a90b0",
+                availability_zone="us-west-2a",
+                instance_type="m1.small",
+                key_name="my-key"
+            ), SpotFleetRequestLaunchSpecification(
+                ami="ami-d06a90b0",
+                availability_zone="us-west-2a",
+                instance_type="m5.large",
+                key_name="my-key"
+            )
+            ],
+            spot_price="0.005",
+            target_capacity=2,
+            valid_until="2019-11-04T20:44:20Z"
+        )
+```
+
+-> In this example, we use a [`dynamic` block](https://www.terraform.io/language/expressions/dynamic-blocks) to define zero or more `launch_specification` blocks, producing one for each element in the list of subnet ids.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformVariable, Token, TerraformIterator, Fn, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.spot_fleet_request import SpotFleetRequest
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        # Terraform Variables are not always the best fit for getting inputs in the context of Terraform CDK.
+        #     You can read more about this at https://cdk.tf/variables
+        subnets = TerraformVariable(self, "subnets")
+        # In most cases loops should be handled in the programming language context and
+        #     not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+        #     you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+        #     you need to keep this like it is.
+        example_dynamic_iterator0 = TerraformIterator.from_list(
+            Token.as_any("${[ for s in ${" + subnets.value + "} : {\n      subnet_id = s[1]\n    }]}"))
+        SpotFleetRequest(self, "example",
+            allocation_strategy="lowestPrice",
+            fleet_type="request",
+            iam_fleet_role="arn:aws:iam::12345678:role/spot-fleet",
+            target_capacity=3,
+            terminate_instances_with_expiration=Token.as_boolean("true"),
+            valid_until="2019-11-04T20:44:20Z",
+            wait_for_fulfillment=Token.as_boolean("true"),
+            launch_specification=example_dynamic_iterator0.dynamic({
+                "ami": "ami-1234",
+                "instance_type": "m4.4xlarge",
+                "root_block_device": [{
+                    "delete_on_termination": "true",
+                    "volume_size": "8",
+                    "volume_type": "gp2"
+                }
+                ],
+                "subnet_id": Fn.lookup_nested(example_dynamic_iterator0.value, ["subnet_id"
+                ]),
+                "tags": {
+                    "Name": "Spot Node",
+                    "tag_builder": "builder"
+                },
+                "vpc_security_group_ids": "sg-123456"
+            })
+        )
+```
+
+### Using multiple launch configurations
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, Fn, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_subnets import DataAwsSubnets
+from imports.aws.launch_template import LaunchTemplate
+from imports.aws.spot_fleet_request import SpotFleetRequest
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        foo = LaunchTemplate(self, "foo",
+            image_id="ami-516b9131",
+            instance_type="m1.small",
+            key_name="some-key",
+            name="launch-template"
+        )
+        example = DataAwsSubnets(self, "example",
+            filter=[DataAwsSubnetsFilter(
+                name="vpc-id",
+                values=[vpc_id.string_value]
+            )
+            ]
+        )
+        aws_spot_fleet_request_foo = SpotFleetRequest(self, "foo_2",
+            depends_on=[test_attach],
+            iam_fleet_role="arn:aws:iam::12345678:role/spot-fleet",
+            launch_template_config=[SpotFleetRequestLaunchTemplateConfig(
+                launch_template_specification=SpotFleetRequestLaunchTemplateConfigLaunchTemplateSpecification(
+                    id=foo.id,
+                    version=Token.as_string(foo.latest_version)
+                ),
+                overrides=[SpotFleetRequestLaunchTemplateConfigOverrides(
+                    subnet_id=Token.as_string(Fn.lookup_nested(example.ids, ["0"]))
+                ), SpotFleetRequestLaunchTemplateConfigOverrides(
+                    subnet_id=Token.as_string(Fn.lookup_nested(example.ids, ["1"]))
+                ), SpotFleetRequestLaunchTemplateConfigOverrides(
+                    subnet_id=Token.as_string(Fn.lookup_nested(example.ids, ["2"]))
+                )
+                ]
+            )
+            ],
+            spot_price="0.005",
+            target_capacity=2,
+            valid_until="2019-11-04T20:44:20Z"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_spot_fleet_request_foo.override_logical_id("foo")
+```
+
+## Argument Reference
+
+Most of these arguments directly correspond to the
+[official API](http://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_SpotFleetRequestConfigData.html).
+
+* `iam_fleet_role` - (Required) Grants the Spot fleet permission to terminate
+  Spot instances on your behalf when you cancel its Spot fleet request using
+CancelSpotFleetRequests or when the Spot fleet request expires, if you set
+terminateInstancesWithExpiration.
+* `context` - (Optional) Reserved.
+* `replace_unhealthy_instances` - (Optional) Indicates whether Spot fleet should replace unhealthy instances. Default `false`.
+* `launch_specification` - (Optional) Used to define the launch configuration of the
+  spot-fleet request. Can be specified multiple times to define different bids
+across different markets and instance types. Conflicts with `launch_template_config`. At least one of `launch_specification` or `launch_template_config` is required.
+
+    **Note**: This takes in similar but not
+    identical inputs as [`aws_instance`](instance.html).  There are limitations on
+    what you can specify. See the list of officially supported inputs in the
+    [reference documentation](http://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_SpotFleetLaunchSpecification.html). Any normal [`aws_instance`](instance.html) parameter that corresponds to those inputs may be used and it have
+    a additional parameter `iam_instance_profile_arn` takes `aws_iam_instance_profile` attribute `arn` as input.
+
+* `launch_template_config` - (Optional) Launch template configuration block. See [Launch Template Configs](#launch-template-configs) below for more details. Conflicts with `launch_specification`. At least one of `launch_specification` or `launch_template_config` is required.
+* `spot_maintenance_strategies` - (Optional) Nested argument containing maintenance strategies for managing your Spot Instances that are at an elevated risk of being interrupted. Defined below.
+* `spot_price` - (Optional; Default: On-demand price) The maximum bid price per unit hour.
+* `wait_for_fulfillment` - (Optional; Default: false) If set, Terraform will
+  wait for the Spot Request to be fulfilled, and will throw an error if the
+  timeout of 10m is reached.
+* `target_capacity` - The number of units to request. You can choose to set the
+  target capacity in terms of instances or a performance characteristic that is
+  important to your application workload, such as vCPUs, memory, or I/O.
+* `target_capacity_unit_type` - (Optional) The unit for the target capacity. This can only be done with `instance_requirements` defined
+* `allocation_strategy` - Indicates how to allocate the target capacity across
+  the Spot pools specified by the Spot fleet request. Valid values: `lowestPrice`, `diversified`, `capacityOptimized`, `capacityOptimizedPrioritized`, and `priceCapacityOptimized`. The default is
+  `lowestPrice`.
+* `instance_pools_to_use_count` - (Optional; Default: 1)
+  The number of Spot pools across which to allocate your target Spot capacity.
+  Valid only when `allocation_strategy` is set to `lowestPrice`. Spot Fleet selects
+  the cheapest Spot pools and evenly allocates your target Spot capacity across
+  the number of Spot pools that you specify.
+* `excess_capacity_termination_policy` - Indicates whether running Spot
+  instances should be terminated if the target capacity of the Spot fleet
+  request is decreased below the current size of the Spot fleet.
+* `terminate_instances_with_expiration` - (Optional) Indicates whether running Spot
+  instances should be terminated when the Spot fleet request expires.
+* `terminate_instances_on_delete` - (Optional) Indicates whether running Spot
+  instances should be terminated when the resource is deleted (and the Spot fleet request cancelled).
+  If no value is specified, the value of the `terminate_instances_with_expiration` argument is used.
+* `instance_interruption_behaviour` - (Optional) Indicates whether a Spot
+  instance stops or terminates when it is interrupted. Default is
+  `terminate`.
+* `fleet_type` - (Optional) The type of fleet request. Indicates whether the Spot Fleet only requests the target
+  capacity or also attempts to maintain it. Default is `maintain`.
+* `valid_until` - (Optional) The end date and time of the request, in UTC [RFC3339](https://tools.ietf.org/html/rfc3339#section-5.8) format(for example, YYYY-MM-DDTHH:MM:SSZ). At this point, no new Spot instance requests are placed or enabled to fulfill the request.
+* `valid_from` - (Optional) The start date and time of the request, in UTC [RFC3339](https://tools.ietf.org/html/rfc3339#section-5.8) format(for example, YYYY-MM-DDTHH:MM:SSZ). The default is to start fulfilling the request immediately.
+* `load_balancers` (Optional) A list of elastic load balancer names to add to the Spot fleet.
+* `target_group_arns` (Optional) A list of `aws_alb_target_group` ARNs, for use with Application Load Balancing.
+* `on_demand_allocation_strategy` - The order of the launch template overrides to use in fulfilling On-Demand capacity. the possible values are: `lowestPrice` and `prioritized`. the default is `lowestPrice`.
+* `on_demand_max_total_price` - The maximum amount per hour for On-Demand Instances that you're willing to pay. When the maximum amount you're willing to pay is reached, the fleet stops launching instances even if it hasn’t met the target capacity.
+* `on_demand_target_capacity` - The number of On-Demand units to request. If the request type is `maintain`, you can specify a target capacity of 0 and add capacity later.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Launch Template Configs
+
+The `launch_template_config` block supports the following:
+
+* `launch_template_specification` - (Required) Launch template specification. See [Launch Template Specification](#launch-template-specification) below for more details.
+* `overrides` - (Optional) One or more override configurations. See [Overrides](#overrides) below for more details.
+
+### Launch Template Specification
+
+* `id` - The ID of the launch template. Conflicts with `name`.
+* `name` - The name of the launch template. Conflicts with `id`.
+* `version` - (Optional) Template version. Unlike the autoscaling equivalent, does not support `$Latest` or `$Default`, so use the launch_template resource's attribute, e.g., `"${aws_launch_template.foo.latest_version}"`. It will use the default version if omitted.
+
+    **Note:** The specified launch template can specify only a subset of the
+    inputs of [`aws_launch_template`](launch_template.html).  There are limitations on
+    what you can specify as spot fleet does not support all the attributes that are supported by autoscaling groups. [AWS documentation](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-launch-templates.html#launch-templates-spot-fleet) is currently sparse, but at least `instance_initiated_shutdown_behavior` is confirmed unsupported.
+
+### spot_maintenance_strategies
+
+* `capacity_rebalance` - (Optional) Nested argument containing the capacity rebalance for your fleet request. Defined below.
+
+### capacity_rebalance
+
+* `replacement_strategy` - (Optional) The replacement strategy to use. Only available for spot fleets with `fleet_type` set to `maintain`. Valid values: `launch`.
+
+### Overrides
+
+* `availability_zone` - (Optional) The availability zone in which to place the request.
+* `instance_requirements` - (Optional) The instance requirements. See below.
+* `instance_type` - (Optional) The type of instance to request.
+* `priority` - (Optional) The priority for the launch template override. The lower the number, the higher the priority. If no number is set, the launch template override has the lowest priority.
+* `spot_price` - (Optional) The maximum spot bid for this override request.
+* `subnet_id` - (Optional) The subnet in which to launch the requested instance.
+* `weighted_capacity` - (Optional) The capacity added to the fleet by a fulfilled request.
+
+### Instance Requirements
+
+This configuration block supports the following:
+
+* `accelerator_count` - (Optional) Block describing the minimum and maximum number of accelerators (GPUs, FPGAs, or AWS Inferentia chips). Default is no minimum or maximum.
+    * `min` - (Optional) Minimum.
+    * `max` - (Optional) Maximum. Set to `0` to exclude instance types with accelerators.
+* `accelerator_manufacturers` - (Optional) List of accelerator manufacturer names. Default is any manufacturer.
+
+    ```
+    Valid names:
+      * amazon-web-services
+      * amd
+      * nvidia
+      * xilinx
+    ```
+
+* `accelerator_names` - (Optional) List of accelerator names. Default is any acclerator.
+
+    ```
+    Valid names:
+      * a100            - NVIDIA A100 GPUs
+      * v100            - NVIDIA V100 GPUs
+      * k80             - NVIDIA K80 GPUs
+      * t4              - NVIDIA T4 GPUs
+      * m60             - NVIDIA M60 GPUs
+      * radeon-pro-v520 - AMD Radeon Pro V520 GPUs
+      * vu9p            - Xilinx VU9P FPGAs
+    ```
+
+* `accelerator_total_memory_mib` - (Optional) Block describing the minimum and maximum total memory of the accelerators. Default is no minimum or maximum.
+    * `min` - (Optional) Minimum.
+    * `max` - (Optional) Maximum.
+* `accelerator_types` - (Optional) List of accelerator types. Default is any accelerator type.
+
+    ```
+    Valid types:
+      * fpga
+      * gpu
+      * inference
+    ```
+
+* `allowed_instance_types` - (Optional) List of instance types to apply your specified attributes against. All other instance types are ignored, even if they match your specified attributes. You can use strings with one or more wild cards, represented by an asterisk (\*), to allow an instance type, size, or generation. The following are examples: `m5.8xlarge`, `c5*.*`, `m5a.*`, `r*`, `*3*`. For example, if you specify `c5*`, you are allowing the entire C5 instance family, which includes all C5a and C5n instance types. If you specify `m5a.*`, you are allowing all the M5a instance types, but not the M5n instance types. Maximum of 400 entries in the list; each entry is limited to 30 characters. Default is all instance types.
+
+    ~> **NOTE:** If you specify `allowed_instance_types`, you can't specify `excluded_instance_types`.
+
+* `bare_metal` - (Optional) Indicate whether bare metal instace types should be `included`, `excluded`, or `required`. Default is `excluded`.
+* `baseline_ebs_bandwidth_mbps` - (Optional) Block describing the minimum and maximum baseline EBS bandwidth, in Mbps. Default is no minimum or maximum.
+    * `min` - (Optional) Minimum.
+    * `max` - (Optional) Maximum.
+* `burstable_performance` - (Optional) Indicate whether burstable performance instance types should be `included`, `excluded`, or `required`. Default is `excluded`.
+* `cpu_manufacturers` (Optional) List of CPU manufacturer names. Default is any manufacturer.
+
+    ~> **NOTE:** Don't confuse the CPU hardware manufacturer with the CPU hardware architecture. Instances will be launched with a compatible CPU architecture based on the Amazon Machine Image (AMI) that you specify in your launch template.
+
+    ```
+    Valid names:
+      * amazon-web-services
+      * amd
+      * intel
+    ```
+
+* `excluded_instance_types` - (Optional) List of instance types to exclude. You can use strings with one or more wild cards, represented by an asterisk (\*), to exclude an instance type, size, or generation. The following are examples: `m5.8xlarge`, `c5*.*`, `m5a.*`, `r*`, `*3*`. For example, if you specify `c5*`, you are excluding the entire C5 instance family, which includes all C5a and C5n instance types. If you specify `m5a.*`, you are excluding all the M5a instance types, but not the M5n instance types. Maximum of 400 entries in the list; each entry is limited to 30 characters. Default is no excluded instance types.
+
+    ~> **NOTE:** If you specify `excluded_instance_types`, you can't specify `allowed_instance_types`.
+
+* `instance_generations` - (Optional) List of instance generation names. Default is any generation.
+
+    ```
+    Valid names:
+      * current  - Recommended for best performance.
+      * previous - For existing applications optimized for older instance types.
+    ```
+
+* `local_storage` - (Optional) Indicate whether instance types with local storage volumes are `included`, `excluded`, or `required`. Default is `included`.
+* `local_storage_types` - (Optional) List of local storage type names. Default any storage type.
+
+    ```
+    Value names:
+      * hdd - hard disk drive
+      * ssd - solid state drive
+    ```
+
+* `memory_gib_per_vcpu` - (Optional) Block describing the minimum and maximum amount of memory (GiB) per vCPU. Default is no minimum or maximum.
+    * `min` - (Optional) Minimum. May be a decimal number, e.g. `0.5`.
+    * `max` - (Optional) Maximum. May be a decimal number, e.g. `0.5`.
+* `memory_mib` - (Optional) Block describing the minimum and maximum amount of memory (MiB). Default is no maximum.
+    * `min` - (Optional) Minimum.
+    * `max` - (Optional) Maximum.
+* `network_bandwidth_gbps` - (Optional) Block describing the minimum and maximum amount of network bandwidth, in gigabits per second (Gbps). Default is no minimum or maximum.
+    * `min` - (Optional) Minimum.
+    * `max` - (Optional) Maximum.
+* `network_interface_count` - (Optional) Block describing the minimum and maximum number of network interfaces. Default is no minimum or maximum.
+    * `min` - (Optional) Minimum.
+    * `max` - (Optional) Maximum.
+* `on_demand_max_price_percentage_over_lowest_price` - (Optional) The price protection threshold for On-Demand Instances. This is the maximum you’ll pay for an On-Demand Instance, expressed as a percentage higher than the cheapest M, C, or R instance type with your specified attributes. When Amazon EC2 Auto Scaling selects instance types with your attributes, we will exclude instance types whose price is higher than your threshold. The parameter accepts an integer, which Amazon EC2 Auto Scaling interprets as a percentage. To turn off price protection, specify a high value, such as 999999. Default is 20.
+
+    If you set DesiredCapacityType to vcpu or memory-mib, the price protection threshold is applied based on the per vCPU or per memory price instead of the per instance price.
+* `require_hibernate_support` - (Optional) Indicate whether instance types must support On-Demand Instance Hibernation, either `true` or `false`. Default is `false`.
+* `spot_max_price_percentage_over_lowest_price` - (Optional) The price protection threshold for Spot Instances. This is the maximum you’ll pay for a Spot Instance, expressed as a percentage higher than the cheapest M, C, or R instance type with your specified attributes. When Amazon EC2 Auto Scaling selects instance types with your attributes, we will exclude instance types whose price is higher than your threshold. The parameter accepts an integer, which Amazon EC2 Auto Scaling interprets as a percentage. To turn off price protection, specify a high value, such as 999999. Default is 100.
+
+    If you set DesiredCapacityType to vcpu or memory-mib, the price protection threshold is applied based on the per vCPU or per memory price instead of the per instance price.
+* `total_local_storage_gb` - (Optional) Block describing the minimum and maximum total local storage (GB). Default is no minimum or maximum.
+    * `min` - (Optional) Minimum. May be a decimal number, e.g. `0.5`.
+    * `max` - (Optional) Maximum. May be a decimal number, e.g. `0.5`.
+* `vcpu_count` - (Optional) Block describing the minimum and maximum number of vCPUs. Default is no maximum.
+    * `min` - (Optional) Minimum.
+    * `max` - (Optional) Maximum.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Spot fleet request ID
+* `spot_request_state` - The state of the Spot fleet request.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `10m`)
+* `delete` - (Default `15m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Spot Fleet Requests using `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Spot Fleet Requests using `id`. For example:
+
+```console
+% terraform import aws_spot_fleet_request.fleet sfr-005e9ec8-5546-4c31-b317-31a62325411e
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1ecd23c004a4840044b58f08e2d76b93455d0e78ffddfd4a1e1ae619c9c18174 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/spot_instance_request.html.markdown b/website/docs/cdktf/python/r/spot_instance_request.html.markdown
new file mode 100644
index 00000000000..dbde465b0b8
--- /dev/null
+++ b/website/docs/cdktf/python/r/spot_instance_request.html.markdown
@@ -0,0 +1,117 @@
+---
+subcategory: "EC2 (Elastic Compute Cloud)"
+layout: "aws"
+page_title: "AWS: aws_spot_instance_request"
+description: |-
+  Provides a Spot Instance Request resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_spot_instance_request
+
+Provides an EC2 Spot Instance Request resource. This allows instances to be
+requested on the spot market.
+
+By default Terraform creates Spot Instance Requests with a `persistent` type,
+which means that for the duration of their lifetime, AWS will launch an
+instance with the configured details if and when the spot market will accept
+the requested price.
+
+On destruction, Terraform will make an attempt to terminate the associated Spot
+Instance if there is one present.
+
+Spot Instances requests with a `one-time` type will close the spot request
+when the instance is terminated either by the request being below the current spot
+price availability or by a user.
+
+~> **NOTE:** Because their behavior depends on the live status of the spot
+market, Spot Instance Requests have a unique lifecycle that makes them behave
+differently than other Terraform resources. Most importantly: there is __no
+guarantee__ that a Spot Instance exists to fulfill the request at any given
+point in time. See the [AWS Spot Instance
+documentation](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-spot-instances.html)
+for more information.
+
+~> **NOTE [AWS strongly discourages](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/spot-best-practices.html#which-spot-request-method-to-use) the use of the legacy APIs called by this resource.
+We recommend using the [EC2 Instance](instance.html) resource with `instance_market_options` instead.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.spot_instance_request import SpotInstanceRequest
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SpotInstanceRequest(self, "cheap_worker",
+            ami="ami-1234",
+            instance_type="c4.xlarge",
+            spot_price="0.03",
+            tags={
+                "Name": "CheapWorker"
+            }
+        )
+```
+
+## Argument Reference
+
+Spot Instance Requests support all the same arguments as
+[`aws_instance`](instance.html), with the addition of:
+
+* `spot_price` - (Optional; Default: On-demand price) The maximum price to request on the spot market.
+* `wait_for_fulfillment` - (Optional; Default: false) If set, Terraform will
+  wait for the Spot Request to be fulfilled, and will throw an error if the
+  timeout of 10m is reached.
+* `spot_type` - (Optional; Default: `persistent`) If set to `one-time`, after
+  the instance is terminated, the spot request will be closed.
+* `launch_group` - (Optional) A launch group is a group of spot instances that launch together and terminate together.
+  If left empty instances are launched and terminated individually.
+* `block_duration_minutes` - (Optional) The required duration for the Spot instances, in minutes. This value must be a multiple of 60 (60, 120, 180, 240, 300, or 360).
+  The duration period starts as soon as your Spot instance receives its instance ID. At the end of the duration period, Amazon EC2 marks the Spot instance for termination and provides a Spot instance termination notice, which gives the instance a two-minute warning before it terminates.
+  Note that you can't specify an Availability Zone group or a launch group if you specify a duration.
+* `instance_interruption_behavior` - (Optional) Indicates Spot instance behavior when it is interrupted. Valid values are `terminate`, `stop`, or `hibernate`. Default value is `terminate`.
+* `valid_until` - (Optional) The end date and time of the request, in UTC [RFC3339](https://tools.ietf.org/html/rfc3339#section-5.8) format(for example, YYYY-MM-DDTHH:MM:SSZ). At this point, no new Spot instance requests are placed or enabled to fulfill the request. The default end date is 7 days from the current date.
+* `valid_from` - (Optional) The start date and time of the request, in UTC [RFC3339](https://tools.ietf.org/html/rfc3339#section-5.8) format(for example, YYYY-MM-DDTHH:MM:SSZ). The default is to start fulfilling the request immediately.
+* `tags` - (Optional) A map of tags to assign to the Spot Instance Request. These tags are not automatically applied to the launched Instance. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Spot Instance Request ID.
+
+These attributes are exported, but they are expected to change over time and so
+should only be used for informational purposes, not for resource dependencies:
+
+* `spot_bid_status` - The current [bid
+  status](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/spot-bid-status.html)
+  of the Spot Instance Request.
+* `spot_request_state` The current [request
+  state](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/spot-requests.html#creating-spot-request-status)
+  of the Spot Instance Request.
+* `spot_instance_id` - The Instance ID (if any) that is currently fulfilling
+  the Spot Instance request.
+* `public_dns` - The public DNS name assigned to the instance. For EC2-VPC, this
+  is only available if you've enabled DNS hostnames for your VPC
+* `public_ip` - The public IP address assigned to the instance, if applicable.
+* `private_dns` - The private DNS name assigned to the instance. Can only be
+  used inside the Amazon EC2, and only available if you've enabled DNS hostnames
+  for your VPC
+* `private_ip` - The private IP address assigned to the instance
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `10m`)
+* `delete` - (Default `20m`)
+
+<!-- cache-key: cdktf-0.18.0 input-c3c3583217fff10aa06f5c451738196ae8dc39997f2223d31cdbbf7593fbebc2 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/sqs_queue.html.markdown b/website/docs/cdktf/python/r/sqs_queue.html.markdown
new file mode 100644
index 00000000000..d7dd747672d
--- /dev/null
+++ b/website/docs/cdktf/python/r/sqs_queue.html.markdown
@@ -0,0 +1,205 @@
+---
+subcategory: "SQS (Simple Queue)"
+layout: "aws"
+page_title: "AWS: aws_sqs_queue"
+description: |-
+  Provides a SQS resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sqs_queue
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.sqs_queue import SqsQueue
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SqsQueue(self, "terraform_queue",
+            delay_seconds=90,
+            max_message_size=2048,
+            message_retention_seconds=86400,
+            name="terraform-example-queue",
+            receive_wait_time_seconds=10,
+            redrive_policy=Token.as_string(
+                Fn.jsonencode({
+                    "dead_letter_target_arn": terraform_queue_deadletter.arn,
+                    "max_receive_count": 4
+                })),
+            tags={
+                "Environment": "production"
+            }
+        )
+```
+
+## FIFO queue
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.sqs_queue import SqsQueue
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SqsQueue(self, "terraform_queue",
+            content_based_deduplication=True,
+            fifo_queue=True,
+            name="terraform-example-queue.fifo"
+        )
+```
+
+## High-throughput FIFO queue
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.sqs_queue import SqsQueue
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SqsQueue(self, "terraform_queue",
+            deduplication_scope="messageGroup",
+            fifo_queue=True,
+            fifo_throughput_limit="perMessageGroupId",
+            name="terraform-example-queue.fifo"
+        )
+```
+
+## Dead-letter queue
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.sqs_queue import SqsQueue
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SqsQueue(self, "terraform_queue_deadletter",
+            name="terraform-example-deadletter-queue",
+            redrive_allow_policy=Token.as_string(
+                Fn.jsonencode({
+                    "redrive_permission": "byQueue",
+                    "source_queue_arns": [terraform_queue.arn]
+                }))
+        )
+```
+
+## Server-side encryption (SSE)
+
+Using [SSE-SQS](https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-configure-sqs-sse-queue.html):
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.sqs_queue import SqsQueue
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SqsQueue(self, "terraform_queue",
+            name="terraform-example-queue",
+            sqs_managed_sse_enabled=True
+        )
+```
+
+Using [SSE-KMS](https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-configure-sse-existing-queue.html):
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.sqs_queue import SqsQueue
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SqsQueue(self, "terraform_queue",
+            kms_data_key_reuse_period_seconds=300,
+            kms_master_key_id="alias/aws/sqs",
+            name="terraform-example-queue"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Optional) The name of the queue. Queue names must be made up of only uppercase and lowercase ASCII letters, numbers, underscores, and hyphens, and must be between 1 and 80 characters long. For a FIFO (first-in-first-out) queue, the name must end with the `.fifo` suffix. If omitted, Terraform will assign a random, unique name. Conflicts with `name_prefix`
+* `name_prefix` - (Optional) Creates a unique name beginning with the specified prefix. Conflicts with `name`
+* `visibility_timeout_seconds` - (Optional) The visibility timeout for the queue. An integer from 0 to 43200 (12 hours). The default for this attribute is 30. For more information about visibility timeout, see [AWS docs](https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/AboutVT.html).
+* `message_retention_seconds` - (Optional) The number of seconds Amazon SQS retains a message. Integer representing seconds, from 60 (1 minute) to 1209600 (14 days). The default for this attribute is 345600 (4 days).
+* `max_message_size` - (Optional) The limit of how many bytes a message can contain before Amazon SQS rejects it. An integer from 1024 bytes (1 KiB) up to 262144 bytes (256 KiB). The default for this attribute is 262144 (256 KiB).
+* `delay_seconds` - (Optional) The time in seconds that the delivery of all messages in the queue will be delayed. An integer from 0 to 900 (15 minutes). The default for this attribute is 0 seconds.
+* `receive_wait_time_seconds` - (Optional) The time for which a ReceiveMessage call will wait for a message to arrive (long polling) before returning. An integer from 0 to 20 (seconds). The default for this attribute is 0, meaning that the call will return immediately.
+* `policy` - (Optional) The JSON policy for the SQS queue. For more information about building AWS IAM policy documents with Terraform, see the [AWS IAM Policy Document Guide](https://learn.hashicorp.com/terraform/aws/iam-policy).
+* `redrive_policy` - (Optional) The JSON policy to set up the Dead Letter Queue, see [AWS docs](https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/SQSDeadLetterQueue.html). **Note:** when specifying `maxReceiveCount`, you must specify it as an integer (`5`), and not a string (`"5"`).
+* `redrive_allow_policy` - (Optional) The JSON policy to set up the Dead Letter Queue redrive permission, see [AWS docs](https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/SQSDeadLetterQueue.html).
+* `fifo_queue` - (Optional) Boolean designating a FIFO queue. If not set, it defaults to `false` making it standard.
+* `content_based_deduplication` - (Optional) Enables content-based deduplication for FIFO queues. For more information, see the [related documentation](http://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/FIFO-queues.html#FIFO-queues-exactly-once-processing)
+* `sqs_managed_sse_enabled` - (Optional) Boolean to enable server-side encryption (SSE) of message content with SQS-owned encryption keys. See [Encryption at rest](https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-server-side-encryption.html). Terraform will only perform drift detection of its value when present in a configuration.
+* `kms_master_key_id` - (Optional) The ID of an AWS-managed customer master key (CMK) for Amazon SQS or a custom CMK. For more information, see [Key Terms](http://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-server-side-encryption.html#sqs-sse-key-terms).
+* `kms_data_key_reuse_period_seconds` - (Optional) The length of time, in seconds, for which Amazon SQS can reuse a data key to encrypt or decrypt messages before calling AWS KMS again. An integer representing seconds, between 60 seconds (1 minute) and 86,400 seconds (24 hours). The default is 300 (5 minutes).
+* `deduplication_scope` - (Optional) Specifies whether message deduplication occurs at the message group or queue level. Valid values are `messageGroup` and `queue` (default).
+* `fifo_throughput_limit` - (Optional) Specifies whether the FIFO queue throughput quota applies to the entire queue or per message group. Valid values are `perQueue` (default) and `perMessageGroupId`.
+* `tags` - (Optional) A map of tags to assign to the queue. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The URL for the created Amazon SQS queue.
+* `arn` - The ARN of the SQS queue
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `url` - Same as `id`: The URL for the created Amazon SQS queue.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SQS Queues using the queue `url`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import SQS Queues using the queue `url`. For example:
+
+```console
+% terraform import aws_sqs_queue.public_queue https://queue.amazonaws.com/80398EXAMPLE/MyQueue
+```
+
+<!-- cache-key: cdktf-0.18.0 input-61c8bbd892ec566ac1dba66044b682f7399f3a0480c812df8151302e52b9e635 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/sqs_queue_policy.html.markdown b/website/docs/cdktf/python/r/sqs_queue_policy.html.markdown
new file mode 100644
index 00000000000..62c81487c6e
--- /dev/null
+++ b/website/docs/cdktf/python/r/sqs_queue_policy.html.markdown
@@ -0,0 +1,93 @@
+---
+subcategory: "SQS (Simple Queue)"
+layout: "aws"
+page_title: "AWS: aws_sqs_queue_policy"
+description: |-
+  Provides a SQS Queue Policy resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sqs_queue_policy
+
+Allows you to set a policy of an SQS Queue
+while referencing ARN of the queue within the policy.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.sqs_queue import SqsQueue
+from imports.aws.sqs_queue_policy import SqsQueuePolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        q = SqsQueue(self, "q",
+            name="examplequeue"
+        )
+        test = DataAwsIamPolicyDocument(self, "test",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["sqs:SendMessage"],
+                condition=[DataAwsIamPolicyDocumentStatementCondition(
+                    test="ArnEquals",
+                    values=[example.arn],
+                    variable="aws:SourceArn"
+                )
+                ],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["*"],
+                    type="*"
+                )
+                ],
+                resources=[q.arn],
+                sid="First"
+            )
+            ]
+        )
+        aws_sqs_queue_policy_test = SqsQueuePolicy(self, "test_2",
+            policy=Token.as_string(test.json),
+            queue_url=q.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_sqs_queue_policy_test.override_logical_id("test")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `queue_url` - (Required) The URL of the SQS Queue to which to attach the policy
+* `policy` - (Required) The JSON policy for the SQS queue. For more information about building AWS IAM policy documents with Terraform, see the [AWS IAM Policy Document Guide](https://learn.hashicorp.com/terraform/aws/iam-policy).
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SQS Queue Policies using the queue URL. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import SQS Queue Policies using the queue URL. For example:
+
+```console
+% terraform import aws_sqs_queue_policy.test https://queue.amazonaws.com/0123456789012/myqueue
+```
+
+<!-- cache-key: cdktf-0.18.0 input-07637ff0b9efc607148fb133417a818d191130d7adbc072b948e54c46e471ace -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/sqs_queue_redrive_allow_policy.html.markdown b/website/docs/cdktf/python/r/sqs_queue_redrive_allow_policy.html.markdown
new file mode 100644
index 00000000000..2123d7442dd
--- /dev/null
+++ b/website/docs/cdktf/python/r/sqs_queue_redrive_allow_policy.html.markdown
@@ -0,0 +1,83 @@
+---
+subcategory: "SQS (Simple Queue)"
+layout: "aws"
+page_title: "AWS: aws_sqs_queue_redrive_allow_policy"
+description: |-
+  Provides a SQS Queue Redrive Allow Policy resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sqs_queue_redrive_allow_policy
+
+Provides a SQS Queue Redrive Allow Policy resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.sqs_queue import SqsQueue
+from imports.aws.sqs_queue_redrive_allow_policy import SqsQueueRedriveAllowPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = SqsQueue(self, "example",
+            name="examplequeue"
+        )
+        src = SqsQueue(self, "src",
+            name="srcqueue",
+            redrive_policy=Token.as_string(
+                Fn.jsonencode({
+                    "dead_letter_target_arn": example.arn,
+                    "max_receive_count": 4
+                }))
+        )
+        aws_sqs_queue_redrive_allow_policy_example = SqsQueueRedriveAllowPolicy(self, "example_2",
+            queue_url=example.id,
+            redrive_allow_policy=Token.as_string(
+                Fn.jsonencode({
+                    "redrive_permission": "byQueue",
+                    "source_queue_arns": [src.arn]
+                }))
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_sqs_queue_redrive_allow_policy_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `queue_url` - (Required) The URL of the SQS Queue to which to attach the policy
+* `redrive_allow_policy` - (Required) The JSON redrive allow policy for the SQS queue. Learn more in the [Amazon SQS dead-letter queues documentation](https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-dead-letter-queues.html).
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SQS Queue Redrive Allow Policies using the queue URL. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import SQS Queue Redrive Allow Policies using the queue URL. For example:
+
+```console
+% terraform import aws_sqs_queue_redrive_allow_policy.test https://queue.amazonaws.com/0123456789012/myqueue
+```
+
+<!-- cache-key: cdktf-0.18.0 input-20610df5ca53af34101414784f648f77a8c2ab89455909b2c2cae249011aae9c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/sqs_queue_redrive_policy.html.markdown b/website/docs/cdktf/python/r/sqs_queue_redrive_policy.html.markdown
new file mode 100644
index 00000000000..b4523adf0f4
--- /dev/null
+++ b/website/docs/cdktf/python/r/sqs_queue_redrive_policy.html.markdown
@@ -0,0 +1,88 @@
+---
+subcategory: "SQS (Simple Queue)"
+layout: "aws"
+page_title: "AWS: aws_sqs_queue_redrive_policy"
+description: |-
+  Provides a SQS Queue Redrive Policy resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sqs_queue_redrive_policy
+
+Allows you to set a redrive policy of an SQS Queue
+while referencing ARN of the dead letter queue inside the redrive policy.
+
+This is useful when you want to set a dedicated
+dead letter queue for a standard or FIFO queue, but need
+the dead letter queue to exist before setting the redrive policy.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.sqs_queue import SqsQueue
+from imports.aws.sqs_queue_redrive_policy import SqsQueueRedrivePolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        q = SqsQueue(self, "q",
+            name="examplequeue"
+        )
+        ddl = SqsQueue(self, "ddl",
+            name="examplequeue-ddl",
+            redrive_allow_policy=Token.as_string(
+                Fn.jsonencode({
+                    "redrive_permission": "byQueue",
+                    "source_queue_arns": [q.arn]
+                }))
+        )
+        aws_sqs_queue_redrive_policy_q = SqsQueueRedrivePolicy(self, "q_2",
+            queue_url=q.id,
+            redrive_policy=Token.as_string(
+                Fn.jsonencode({
+                    "dead_letter_target_arn": ddl.arn,
+                    "max_receive_count": 4
+                }))
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_sqs_queue_redrive_policy_q.override_logical_id("q")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `queue_url` - (Required) The URL of the SQS Queue to which to attach the policy
+* `redrive_policy` - (Required) The JSON redrive policy for the SQS queue. Accepts two key/val pairs: `deadLetterTargetArn` and `maxReceiveCount`. Learn more in the [Amazon SQS dead-letter queues documentation](https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-dead-letter-queues.html).
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SQS Queue Redrive Policies using the queue URL. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import SQS Queue Redrive Policies using the queue URL. For example:
+
+```console
+% terraform import aws_sqs_queue_redrive_policy.test https://queue.amazonaws.com/0123456789012/myqueue
+```
+
+<!-- cache-key: cdktf-0.18.0 input-e7f48e464819827bf219c6c6888346afabe01cbaae381206aa80f3e9ec43811a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ssm_activation.html.markdown b/website/docs/cdktf/python/r/ssm_activation.html.markdown
new file mode 100644
index 00000000000..39be9a44808
--- /dev/null
+++ b/website/docs/cdktf/python/r/ssm_activation.html.markdown
@@ -0,0 +1,108 @@
+---
+subcategory: "SSM (Systems Manager)"
+layout: "aws"
+page_title: "AWS: aws_ssm_activation"
+description: |-
+  Registers an on-premises server or virtual machine with Amazon EC2 so that it can be managed using Run Command.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ssm_activation
+
+Registers an on-premises server or virtual machine with Amazon EC2 so that it can be managed using Run Command.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.iam_role import IamRole
+from imports.aws.iam_role_policy_attachment import IamRolePolicyAttachment
+from imports.aws.ssm_activation import SsmActivation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        assume_role = DataAwsIamPolicyDocument(self, "assume_role",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["sts:AssumeRole"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["ssm.amazonaws.com"],
+                    type="Service"
+                )
+                ]
+            )
+            ]
+        )
+        test_role = IamRole(self, "test_role",
+            assume_role_policy=Token.as_string(assume_role.json),
+            name="test_role"
+        )
+        test_attach = IamRolePolicyAttachment(self, "test_attach",
+            policy_arn="arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore",
+            role=test_role.name
+        )
+        SsmActivation(self, "foo",
+            depends_on=[test_attach],
+            description="Test",
+            iam_role=test_role.id,
+            name="test_ssm_activation",
+            registration_limit=Token.as_number("5")
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Optional) The default name of the registered managed instance.
+* `description` - (Optional) The description of the resource that you want to register.
+* `expiration_date` - (Optional) UTC timestamp in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8) by which this activation request should expire. The default value is 24 hours from resource creation time. Terraform will only perform drift detection of its value when present in a configuration.
+* `iam_role` - (Required) The IAM Role to attach to the managed instance.
+* `registration_limit` - (Optional) The maximum number of managed instances you want to register. The default value is 1 instance.
+* `tags` - (Optional) A map of tags to assign to the object. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The activation ID.
+* `activation_code` - The code the system generates when it processes the activation.
+* `name` - The default name of the registered managed instance.
+* `description` - The description of the resource that was registered.
+* `expired` - If the current activation has expired.
+* `expiration_date` - The date by which this activation request should expire. The default value is 24 hours.
+* `iam_role` - The IAM Role attached to the managed instance.
+* `registration_limit` - The maximum number of managed instances you want to be registered. The default value is 1 instance.
+* `registration_count` - The number of managed instances that are currently registered using this activation.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AWS SSM Activation using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import AWS SSM Activation using the `id`. For example:
+
+```console
+% terraform import aws_ssm_activation.example e488f2f6-e686-4afb-8a04-ef6dfEXAMPLE
+```
+
+-> **Note:** The `activation_code` attribute cannot be imported.
+
+<!-- cache-key: cdktf-0.18.0 input-e0dcbe52e67919de9e8b8b10107faae656e18b0e36f4833aba51256613ff37fd -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ssm_association.html.markdown b/website/docs/cdktf/python/r/ssm_association.html.markdown
new file mode 100644
index 00000000000..3d2140c0973
--- /dev/null
+++ b/website/docs/cdktf/python/r/ssm_association.html.markdown
@@ -0,0 +1,180 @@
+---
+subcategory: "SSM (Systems Manager)"
+layout: "aws"
+page_title: "AWS: aws_ssm_association"
+description: |-
+  Associates an SSM Document to an instance or EC2 tag.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ssm_association
+
+Associates an SSM Document to an instance or EC2 tag.
+
+## Example Usage
+
+### Create an association for a specific instance
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ssm_association import SsmAssociation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SsmAssociation(self, "example",
+            name=Token.as_string(aws_ssm_document_example.name),
+            targets=[SsmAssociationTargets(
+                key="InstanceIds",
+                values=[Token.as_string(aws_instance_example.id)]
+            )
+            ]
+        )
+```
+
+### Create an association for all managed instances in an AWS account
+
+To target all managed instances in an AWS account, set the `key` as `"InstanceIds"` with `values` set as `["*"]`. This example also illustrates how to use an Amazon owned SSM document named `AmazonCloudWatch-ManageAgent`.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ssm_association import SsmAssociation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SsmAssociation(self, "example",
+            name="AmazonCloudWatch-ManageAgent",
+            targets=[SsmAssociationTargets(
+                key="InstanceIds",
+                values=["*"]
+            )
+            ]
+        )
+```
+
+### Create an association for a specific tag
+
+This example shows how to target all managed instances that are assigned a tag key of `Environment` and value of `Development`.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ssm_association import SsmAssociation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SsmAssociation(self, "example",
+            name="AmazonCloudWatch-ManageAgent",
+            targets=[SsmAssociationTargets(
+                key="tag:Environment",
+                values=["Development"]
+            )
+            ]
+        )
+```
+
+### Create an association with a specific schedule
+
+This example shows how to schedule an association in various ways.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ssm_association import SsmAssociation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SsmAssociation(self, "example",
+            name=Token.as_string(aws_ssm_document_example.name),
+            schedule_expression="cron(0 2 ? * SUN *)",
+            targets=[SsmAssociationTargets(
+                key="InstanceIds",
+                values=[Token.as_string(aws_instance_example.id)]
+            )
+            ]
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the SSM document to apply.
+* `apply_only_at_cron_interval` - (Optional) By default, when you create a new or update associations, the system runs it immediately and then according to the schedule you specified. Enable this option if you do not want an association to run immediately after you create or update it. This parameter is not supported for rate expressions. Default: `false`.
+* `association_name` - (Optional) The descriptive name for the association.
+* `automation_target_parameter_name` - (Optional) Specify the target for the association. This target is required for associations that use an `Automation` document and target resources by using rate controls. This should be set to the SSM document `parameter` that will define how your automation will branch out.
+* `compliance_severity` - (Optional) The compliance severity for the association. Can be one of the following: `UNSPECIFIED`, `LOW`, `MEDIUM`, `HIGH` or `CRITICAL`
+* `document_version` - (Optional) The document version you want to associate with the target(s). Can be a specific version or the default version.
+* `instance_id` - (Optional, **Deprecated**) The instance ID to apply an SSM document to. Use `targets` with key `InstanceIds` for document schema versions 2.0 and above. Use the `targets` attribute instead.
+* `max_concurrency` - (Optional) The maximum number of targets allowed to run the association at the same time. You can specify a number, for example 10, or a percentage of the target set, for example 10%.
+* `max_errors` - (Optional) The number of errors that are allowed before the system stops sending requests to run the association on additional targets. You can specify a number, for example 10, or a percentage of the target set, for example 10%. If you specify a threshold of 3, the stop command is sent when the fourth error is returned. If you specify a threshold of 10% for 50 associations, the stop command is sent when the sixth error is returned.
+* `output_location` - (Optional) An output location block. Output Location is documented below.
+* `parameters` - (Optional) A block of arbitrary string parameters to pass to the SSM document.
+* `schedule_expression` - (Optional) A [cron or rate expression](https://docs.aws.amazon.com/systems-manager/latest/userguide/reference-cron-and-rate-expressions.html) that specifies when the association runs.
+* `sync_compliance` - (Optional) The mode for generating association compliance. You can specify `AUTO` or `MANUAL`.
+* `targets` - (Optional) A block containing the targets of the SSM association. Targets are documented below. AWS currently supports a maximum of 5 targets.
+* `wait_for_success_timeout_seconds` - (Optional) The number of seconds to wait for the association status to be `Success`. If `Success` status is not reached within the given time, create opration will fail.
+
+Output Location (`output_location`) is an S3 bucket where you want to store the results of this association:
+
+* `s3_bucket_name` - (Required) The S3 bucket name.
+* `s3_key_prefix` - (Optional) The S3 bucket prefix. Results stored in the root if not configured.
+* `s3_region` - (Optional) The S3 bucket region.
+
+Targets specify what instance IDs or tags to apply the document to and has these keys:
+
+* `key` - (Required) Either `InstanceIds` or `tag:Tag Name` to specify an EC2 tag.
+* `values` - (Required) A list of instance IDs or tag values. AWS currently limits this list size to one value.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the SSM association
+* `association_id` - The ID of the SSM association.
+* `instance_id` - The instance id that the SSM document was applied to.
+* `name` - The name of the SSM document to apply.
+* `parameters` - Additional parameters passed to the SSM document.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SSM associations using the `association_id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import SSM associations using the `association_id`. For example:
+
+```console
+% terraform import aws_ssm_association.test-association 10abcdef-0abc-1234-5678-90abcdef123456
+```
+
+<!-- cache-key: cdktf-0.18.0 input-10e8a92532503c7bcda87673db04c7e87ed3c1cf117ab0f43ec4186c48be49c7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ssm_default_patch_baseline.html.markdown b/website/docs/cdktf/python/r/ssm_default_patch_baseline.html.markdown
new file mode 100644
index 00000000000..7c3a1697c14
--- /dev/null
+++ b/website/docs/cdktf/python/r/ssm_default_patch_baseline.html.markdown
@@ -0,0 +1,128 @@
+---
+subcategory: "SSM (Systems Manager)"
+layout: "aws"
+page_title: "AWS: aws_ssm_default_patch_baseline"
+description: |-
+  Terraform resource for managing an AWS Systems Manager Default Patch Baseline.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ssm_default_patch_baseline
+
+Terraform resource for registering an AWS Systems Manager Default Patch Baseline.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ssm_default_patch_baseline import SsmDefaultPatchBaseline
+from imports.aws.ssm_patch_baseline import SsmPatchBaseline
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = SsmPatchBaseline(self, "example",
+            approved_patches=["KB123456"],
+            name="example"
+        )
+        aws_ssm_default_patch_baseline_example = SsmDefaultPatchBaseline(self, "example_1",
+            baseline_id=example.id,
+            operating_system=example.operating_system
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_ssm_default_patch_baseline_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `baseline_id` - (Required) ID of the patch baseline.
+  Can be an ID or an ARN.
+  When specifying an AWS-provided patch baseline, must be the ARN.
+* `operating_system` - (Required) The operating system the patch baseline applies to.
+  Valid values are
+  `AMAZON_LINUX`,
+  `AMAZON_LINUX_2`,
+  `AMAZON_LINUX_2022`,
+  `CENTOS`,
+  `DEBIAN`,
+  `MACOS`,
+  `ORACLE_LINUX`,
+  `RASPBIAN`,
+  `REDHAT_ENTERPRISE_LINUX`,
+  `ROCKY_LINUX`,
+  `SUSE`,
+  `UBUNTU`, and
+  `WINDOWS`.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import the Systems Manager Default Patch Baseline using the patch baseline ID, patch baseline ARN, or the operating system value. For example:
+
+Using the patch baseline ID:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using the patch baseline ARN:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using the operating system value:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+**Using `terraform import` to import** the Systems Manager Default Patch Baseline using the patch baseline ID, patch baseline ARN, or the operating system value. For example:
+
+Using the patch baseline ID:
+
+```console
+% terraform import aws_ssm_default_patch_baseline.example pb-1234567890abcdef1
+```
+
+Using the patch baseline ARN:
+
+```console
+% terraform import aws_ssm_default_patch_baseline.example arn:aws:ssm:us-west-2:123456789012:patchbaseline/pb-1234567890abcdef1
+```
+
+Using the operating system value:
+
+```console
+% terraform import aws_ssm_default_patch_baseline.example CENTOS
+```
+
+<!-- cache-key: cdktf-0.18.0 input-c7888a2bf80f497e5fee504012a5094fc9dc5491b266b6f048528ab317dd5ecd -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ssm_document.html.markdown b/website/docs/cdktf/python/r/ssm_document.html.markdown
new file mode 100644
index 00000000000..eca87d5c1be
--- /dev/null
+++ b/website/docs/cdktf/python/r/ssm_document.html.markdown
@@ -0,0 +1,166 @@
+---
+subcategory: "SSM (Systems Manager)"
+layout: "aws"
+page_title: "AWS: aws_ssm_document"
+description: |-
+  Provides an SSM Document resource
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ssm_document
+
+Provides an SSM Document resource
+
+~> **NOTE on updating SSM documents:** Only documents with a schema version of 2.0
+or greater can update their content once created, see [SSM Schema Features][1]. To update a document with an older schema version you must recreate the resource. Not all document types support a schema version of 2.0 or greater. Refer to [SSM document schema features and examples][2] for information about which schema versions are supported for the respective `document_type`.
+
+## Example Usage
+
+### Create an ssm document in JSON format
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ssm_document import SsmDocument
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SsmDocument(self, "foo",
+            content="  {\n    \"schemaVersion\": \"1.2\",\n    \"description\": \"Check ip configuration of a Linux instance.\",\n    \"parameters\": {\n\n    },\n    \"runtimeConfig\": {\n      \"aws:runShellScript\": {\n        \"properties\": [\n          {\n            \"id\": \"0.aws:runShellScript\",\n            \"runCommand\": [\"ifconfig\"]\n          }\n        ]\n      }\n    }\n  }\n\n",
+            document_type="Command",
+            name="test_document"
+        )
+```
+
+### Create an ssm document in YAML format
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ssm_document import SsmDocument
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SsmDocument(self, "foo",
+            content="schemaVersion: '1.2'\ndescription: Check ip configuration of a Linux instance.\nparameters: {}\nruntimeConfig:\n  'aws:runShellScript':\n    properties:\n      - id: '0.aws:runShellScript'\n        runCommand:\n          - ifconfig\n\n",
+            document_format="YAML",
+            document_type="Command",
+            name="test_document"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the document.
+* `attachments_source` - (Optional) One or more configuration blocks describing attachments sources to a version of a document. Defined below.
+* `content` - (Required) The JSON or YAML content of the document.
+* `document_format` - (Optional, defaults to JSON) The format of the document. Valid document types include: `JSON` and `YAML`
+* `document_type` - (Required) The type of the document. Valid document types include: `Automation`, `Command`, `Package`, `Policy`, and `Session`
+* `permissions` - (Optional) Additional Permissions to attach to the document. See [Permissions](#permissions) below for details.
+* `target_type` - (Optional) The target type which defines the kinds of resources the document can run on. For example, /AWS::EC2::Instance. For a list of valid resource types, see AWS Resource Types Reference (http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-template-resource-type-ref.html)
+* `tags` - (Optional) A map of tags to assign to the object. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `version_name` - (Optional) A field specifying the version of the artifact you are creating with the document. For example, "Release 12, Update 6". This value is unique across all versions of a document and cannot be changed for an existing document version.
+
+## attachments_source
+
+The `attachments_source` block supports the following:
+
+* `key` - (Required) The key describing the location of an attachment to a document. Valid key types include: `SourceUrl` and `S3FileUrl`
+* `values` - (Required) The value describing the location of an attachment to a document
+* `name` - (Optional) The name of the document attachment file
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `created_date` - The date the document was created.
+* `description` - The description of the document.
+* `schema_version` - The schema version of the document.
+* `default_version` - The default version of the document.
+* `document_version` - The document version.
+* `hash` - The sha1 or sha256 of the document content
+* `hash_type` - "Sha1" "Sha256". The hashing algorithm used when hashing the content.
+* `latest_version` - The latest version of the document.
+* `owner` - The AWS user account of the person who created the document.
+* `status` - "Creating", "Active" or "Deleting". The current status of the document.
+* `parameter` - The parameters that are available to this document.
+* `platform_types` - A list of OS platforms compatible with this SSM document, either "Windows" or "Linux".
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+[1]: http://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-ssm-docs.html#document-schemas-features
+[2]: https://docs.aws.amazon.com/systems-manager/latest/userguide/document-schemas-features.html
+
+## Permissions
+
+The permissions attribute specifies how you want to share the document. If you share a document privately,
+you must specify the AWS user account IDs for those people who can use the document. If you share a document
+publicly, you must specify All as the account ID.
+
+The permissions mapping supports the following:
+
+* `type` - The permission type for the document. The permission type can be `Share`.
+* `account_ids` - The AWS user accounts that should have access to the document. The account IDs can either be a group of account IDs or `All`.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SSM Documents using the name. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import SSM Documents using the name. For example:
+
+```console
+% terraform import aws_ssm_document.example example
+```
+
+The `attachments_source` argument does not have an SSM API method for reading the attachment information detail after creation. If the argument is set in the Terraform configuration on an imported resource, Terraform will always show a difference. To workaround this behavior, either omit the argument from the Terraform configuration or use [`ignore_changes`](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html#ignore_changes) to hide the difference. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from cdktf import TerraformResourceLifecycle
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ssm_document import SsmDocument
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, content):
+        super().__init__(scope, name)
+        SsmDocument(self, "test",
+            attachments_source=[SsmDocumentAttachmentsSource(
+                key="SourceUrl",
+                values=["s3://${" + object_bucket.bucket + "}/test.zip"]
+            )
+            ],
+            document_type="Package",
+            lifecycle=TerraformResourceLifecycle(
+                ignore_changes=[attachments_source]
+            ),
+            name="test_document",
+            content=content
+        )
+```
+
+<!-- cache-key: cdktf-0.18.0 input-0f47ccad709627d6f83189f2b6d41b8032365327e11d5385345cf2f96e8c2bad -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ssm_maintenance_window.html.markdown b/website/docs/cdktf/python/r/ssm_maintenance_window.html.markdown
new file mode 100644
index 00000000000..ce98032ca38
--- /dev/null
+++ b/website/docs/cdktf/python/r/ssm_maintenance_window.html.markdown
@@ -0,0 +1,80 @@
+---
+subcategory: "SSM (Systems Manager)"
+layout: "aws"
+page_title: "AWS: aws_ssm_maintenance_window"
+description: |-
+  Provides an SSM Maintenance Window resource
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ssm_maintenance_window
+
+Provides an SSM Maintenance Window resource
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ssm_maintenance_window import SsmMaintenanceWindow
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SsmMaintenanceWindow(self, "production",
+            cutoff=1,
+            duration=3,
+            name="maintenance-window-application",
+            schedule="cron(0 16 ? * TUE *)"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the maintenance window.
+* `schedule` - (Required) The schedule of the Maintenance Window in the form of a [cron or rate expression](https://docs.aws.amazon.com/systems-manager/latest/userguide/reference-cron-and-rate-expressions.html).
+* `cutoff` - (Required) The number of hours before the end of the Maintenance Window that Systems Manager stops scheduling new tasks for execution.
+* `duration` - (Required) The duration of the Maintenance Window in hours.
+* `description` - (Optional) A description for the maintenance window.
+* `allow_unassociated_targets` - (Optional) Whether targets must be registered with the Maintenance Window before tasks can be defined for those targets.
+* `enabled` - (Optional) Whether the maintenance window is enabled. Default: `true`.
+* `end_date` - (Optional) Timestamp in [ISO-8601 extended format](https://www.iso.org/iso-8601-date-and-time-format.html) when to no longer run the maintenance window.
+* `schedule_timezone` - (Optional) Timezone for schedule in [Internet Assigned Numbers Authority (IANA) Time Zone Database format](https://www.iana.org/time-zones). For example: `America/Los_Angeles`, `etc/UTC`, or `Asia/Seoul`.
+* `schedule_offset` - (Optional) The number of days to wait after the date and time specified by a CRON expression before running the maintenance window.
+* `start_date` - (Optional) Timestamp in [ISO-8601 extended format](https://www.iso.org/iso-8601-date-and-time-format.html) when to begin the maintenance window.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the maintenance window.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SSM  Maintenance Windows using the maintenance window `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import SSM  Maintenance Windows using the maintenance window `id`. For example:
+
+```console
+% terraform import aws_ssm_maintenance_window.imported-window mw-0123456789
+```
+
+<!-- cache-key: cdktf-0.18.0 input-07f87819be5fb27d9bf208fabda5d907108534ce8f73af29e7515be2e194f293 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ssm_maintenance_window_target.html.markdown b/website/docs/cdktf/python/r/ssm_maintenance_window_target.html.markdown
new file mode 100644
index 00000000000..0b58bdf1f58
--- /dev/null
+++ b/website/docs/cdktf/python/r/ssm_maintenance_window_target.html.markdown
@@ -0,0 +1,122 @@
+---
+subcategory: "SSM (Systems Manager)"
+layout: "aws"
+page_title: "AWS: aws_ssm_maintenance_window_target"
+description: |-
+  Provides an SSM Maintenance Window Target resource
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ssm_maintenance_window_target
+
+Provides an SSM Maintenance Window Target resource
+
+## Example Usage
+
+### Instance Target
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ssm_maintenance_window import SsmMaintenanceWindow
+from imports.aws.ssm_maintenance_window_target import SsmMaintenanceWindowTarget
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        window = SsmMaintenanceWindow(self, "window",
+            cutoff=1,
+            duration=3,
+            name="maintenance-window-webapp",
+            schedule="cron(0 16 ? * TUE *)"
+        )
+        SsmMaintenanceWindowTarget(self, "target1",
+            description="This is a maintenance window target",
+            name="maintenance-window-target",
+            resource_type="INSTANCE",
+            targets=[SsmMaintenanceWindowTargetTargets(
+                key="tag:Name",
+                values=["acceptance_test"]
+            )
+            ],
+            window_id=window.id
+        )
+```
+
+### Resource Group Target
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ssm_maintenance_window import SsmMaintenanceWindow
+from imports.aws.ssm_maintenance_window_target import SsmMaintenanceWindowTarget
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        window = SsmMaintenanceWindow(self, "window",
+            cutoff=1,
+            duration=3,
+            name="maintenance-window-webapp",
+            schedule="cron(0 16 ? * TUE *)"
+        )
+        SsmMaintenanceWindowTarget(self, "target1",
+            description="This is a maintenance window target",
+            name="maintenance-window-target",
+            resource_type="RESOURCE_GROUP",
+            targets=[SsmMaintenanceWindowTargetTargets(
+                key="resource-groups:ResourceTypeFilters",
+                values=["AWS::EC2::Instance"]
+            )
+            ],
+            window_id=window.id
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `window_id` - (Required) The Id of the maintenance window to register the target with.
+* `name` - (Optional) The name of the maintenance window target.
+* `description` - (Optional) The description of the maintenance window target.
+* `resource_type` - (Required) The type of target being registered with the Maintenance Window. Possible values are `INSTANCE` and `RESOURCE_GROUP`.
+* `targets` - (Required) The targets to register with the maintenance window. In other words, the instances to run commands on when the maintenance window runs. You can specify targets using instance IDs, resource group names, or tags that have been applied to instances. For more information about these examples formats see
+ (https://docs.aws.amazon.com/systems-manager/latest/userguide/mw-cli-tutorial-targets-examples.html)
+* `owner_information` - (Optional) User-provided value that will be included in any CloudWatch events raised while running tasks for these targets in this Maintenance Window.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the maintenance window target.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SSM Maintenance Window targets using `WINDOW_ID/WINDOW_TARGET_ID`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import SSM Maintenance Window targets using `WINDOW_ID/WINDOW_TARGET_ID`. For example:
+
+```console
+% terraform import aws_ssm_maintenance_window_target.example mw-0c50858d01EXAMPLE/23639a0b-ddbc-4bca-9e72-78d96EXAMPLE
+```
+
+<!-- cache-key: cdktf-0.18.0 input-23b182db6aa7bfeef9866d68456e0abddd9b0255898371206b63dfe63dfee54e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ssm_maintenance_window_task.html.markdown b/website/docs/cdktf/python/r/ssm_maintenance_window_task.html.markdown
new file mode 100644
index 00000000000..606c17c8fae
--- /dev/null
+++ b/website/docs/cdktf/python/r/ssm_maintenance_window_task.html.markdown
@@ -0,0 +1,270 @@
+---
+subcategory: "SSM (Systems Manager)"
+layout: "aws"
+page_title: "AWS: aws_ssm_maintenance_window_task"
+description: |-
+  Provides an SSM Maintenance Window Task resource
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ssm_maintenance_window_task
+
+Provides an SSM Maintenance Window Task resource
+
+## Example Usage
+
+### Automation Tasks
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ssm_maintenance_window_task import SsmMaintenanceWindowTask
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SsmMaintenanceWindowTask(self, "example",
+            max_concurrency=Token.as_string(2),
+            max_errors=Token.as_string(1),
+            priority=1,
+            targets=[SsmMaintenanceWindowTaskTargets(
+                key="InstanceIds",
+                values=[Token.as_string(aws_instance_example.id)]
+            )
+            ],
+            task_arn="AWS-RestartEC2Instance",
+            task_invocation_parameters=SsmMaintenanceWindowTaskTaskInvocationParameters(
+                automation_parameters=SsmMaintenanceWindowTaskTaskInvocationParametersAutomationParameters(
+                    document_version="$LATEST",
+                    parameter=[SsmMaintenanceWindowTaskTaskInvocationParametersAutomationParametersParameter(
+                        name="InstanceId",
+                        values=[Token.as_string(aws_instance_example.id)]
+                    )
+                    ]
+                )
+            ),
+            task_type="AUTOMATION",
+            window_id=Token.as_string(aws_ssm_maintenance_window_example.id)
+        )
+```
+
+### Lambda Tasks
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, Fn, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ssm_maintenance_window_task import SsmMaintenanceWindowTask
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SsmMaintenanceWindowTask(self, "example",
+            max_concurrency=Token.as_string(2),
+            max_errors=Token.as_string(1),
+            priority=1,
+            targets=[SsmMaintenanceWindowTaskTargets(
+                key="InstanceIds",
+                values=[Token.as_string(aws_instance_example.id)]
+            )
+            ],
+            task_arn=Token.as_string(aws_lambda_function_example.arn),
+            task_invocation_parameters=SsmMaintenanceWindowTaskTaskInvocationParameters(
+                lambda_parameters=SsmMaintenanceWindowTaskTaskInvocationParametersLambdaParameters(
+                    client_context=Token.as_string(
+                        Fn.base64encode("{\\\"key1\\\":\\\"value1\\\"}")),
+                    payload="{\\\"key1\\\":\\\"value1\\\"}"
+                )
+            ),
+            task_type="LAMBDA",
+            window_id=Token.as_string(aws_ssm_maintenance_window_example.id)
+        )
+```
+
+### Run Command Tasks
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ssm_maintenance_window_task import SsmMaintenanceWindowTask
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SsmMaintenanceWindowTask(self, "example",
+            max_concurrency=Token.as_string(2),
+            max_errors=Token.as_string(1),
+            priority=1,
+            targets=[SsmMaintenanceWindowTaskTargets(
+                key="InstanceIds",
+                values=[Token.as_string(aws_instance_example.id)]
+            )
+            ],
+            task_arn="AWS-RunShellScript",
+            task_invocation_parameters=SsmMaintenanceWindowTaskTaskInvocationParameters(
+                run_command_parameters=SsmMaintenanceWindowTaskTaskInvocationParametersRunCommandParameters(
+                    notification_config=SsmMaintenanceWindowTaskTaskInvocationParametersRunCommandParametersNotificationConfig(
+                        notification_arn=Token.as_string(aws_sns_topic_example.arn),
+                        notification_events=["All"],
+                        notification_type="Command"
+                    ),
+                    output_s3_bucket=Token.as_string(aws_s3_bucket_example.id),
+                    output_s3_key_prefix="output",
+                    parameter=[SsmMaintenanceWindowTaskTaskInvocationParametersRunCommandParametersParameter(
+                        name="commands",
+                        values=["date"]
+                    )
+                    ],
+                    service_role_arn=Token.as_string(aws_iam_role_example.arn),
+                    timeout_seconds=600
+                )
+            ),
+            task_type="RUN_COMMAND",
+            window_id=Token.as_string(aws_ssm_maintenance_window_example.id)
+        )
+```
+
+### Step Function Tasks
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ssm_maintenance_window_task import SsmMaintenanceWindowTask
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SsmMaintenanceWindowTask(self, "example",
+            max_concurrency=Token.as_string(2),
+            max_errors=Token.as_string(1),
+            priority=1,
+            targets=[SsmMaintenanceWindowTaskTargets(
+                key="InstanceIds",
+                values=[Token.as_string(aws_instance_example.id)]
+            )
+            ],
+            task_arn=Token.as_string(aws_sfn_activity_example.id),
+            task_invocation_parameters=SsmMaintenanceWindowTaskTaskInvocationParameters(
+                step_functions_parameters=SsmMaintenanceWindowTaskTaskInvocationParametersStepFunctionsParameters(
+                    input="{\\\"key1\\\":\\\"value1\\\"}",
+                    name="example"
+                )
+            ),
+            task_type="STEP_FUNCTIONS",
+            window_id=Token.as_string(aws_ssm_maintenance_window_example.id)
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `window_id` - (Required) The Id of the maintenance window to register the task with.
+* `max_concurrency` - (Optional) The maximum number of targets this task can be run for in parallel.
+* `max_errors` - (Optional) The maximum number of errors allowed before this task stops being scheduled.
+* `cutoff_behavior` - (Optional) Indicates whether tasks should continue to run after the cutoff time specified in the maintenance windows is reached. Valid values are `CONTINUE_TASK` and `CANCEL_TASK`.
+* `task_type` - (Required) The type of task being registered. Valid values: `AUTOMATION`, `LAMBDA`, `RUN_COMMAND` or `STEP_FUNCTIONS`.
+* `task_arn` - (Required) The ARN of the task to execute.
+* `service_role_arn` - (Optional) The role that should be assumed when executing the task. If a role is not provided, Systems Manager uses your account's service-linked role. If no service-linked role for Systems Manager exists in your account, it is created for you.
+* `name` - (Optional) The name of the maintenance window task.
+* `description` - (Optional) The description of the maintenance window task.
+* `targets` - (Optional) The targets (either instances or window target ids). Instances are specified using Key=InstanceIds,Values=instanceid1,instanceid2. Window target ids are specified using Key=WindowTargetIds,Values=window target id1, window target id2.
+* `priority` - (Optional) The priority of the task in the Maintenance Window, the lower the number the higher the priority. Tasks in a Maintenance Window are scheduled in priority order with tasks that have the same priority scheduled in parallel.
+* `task_invocation_parameters` - (Optional) Configuration block with parameters for task execution.
+
+`task_invocation_parameters` supports the following:
+
+* `automation_parameters` - (Optional) The parameters for an AUTOMATION task type. Documented below.
+* `lambda_parameters` - (Optional) The parameters for a LAMBDA task type. Documented below.
+* `run_command_parameters` - (Optional) The parameters for a RUN_COMMAND task type. Documented below.
+* `step_functions_parameters` - (Optional) The parameters for a STEP_FUNCTIONS task type. Documented below.
+
+`automation_parameters` supports the following:
+
+* `document_version` - (Optional) The version of an Automation document to use during task execution.
+* `parameter` - (Optional) The parameters for the RUN_COMMAND task execution. Documented below.
+
+`lambda_parameters` supports the following:
+
+* `client_context` - (Optional) Pass client-specific information to the Lambda function that you are invoking.
+* `payload` - (Optional) JSON to provide to your Lambda function as input.
+* `qualifier` - (Optional) Specify a Lambda function version or alias name.
+
+`run_command_parameters` supports the following:
+
+* `comment` - (Optional) Information about the command(s) to execute.
+* `document_hash` - (Optional) The SHA-256 or SHA-1 hash created by the system when the document was created. SHA-1 hashes have been deprecated.
+* `document_hash_type` - (Optional) SHA-256 or SHA-1. SHA-1 hashes have been deprecated. Valid values: `Sha256` and `Sha1`
+* `notification_config` - (Optional) Configurations for sending notifications about command status changes on a per-instance basis. Documented below.
+* `output_s3_bucket` - (Optional) The name of the Amazon S3 bucket.
+* `output_s3_key_prefix` - (Optional) The Amazon S3 bucket subfolder.
+* `parameter` - (Optional) The parameters for the RUN_COMMAND task execution. Documented below.
+* `service_role_arn` - (Optional) The Amazon Resource Name (ARN) of the AWS Identity and Access Management (IAM) service role to use to publish Amazon Simple Notification Service (Amazon SNS) notifications for maintenance window Run Command tasks.
+* `timeout_seconds` - (Optional) If this time is reached and the command has not already started executing, it doesn't run.
+* `cloudwatch_config` - (Optional) Configuration options for sending command output to CloudWatch Logs. Documented below.
+
+`step_functions_parameters` supports the following:
+
+* `input` - (Optional) The inputs for the STEP_FUNCTION task.
+* `name` - (Optional) The name of the STEP_FUNCTION task.
+
+`notification_config` supports the following:
+
+* `notification_arn` - (Optional) An Amazon Resource Name (ARN) for a Simple Notification Service (SNS) topic. Run Command pushes notifications about command status changes to this topic.
+* `notification_events` - (Optional) The different events for which you can receive notifications. Valid values: `All`, `InProgress`, `Success`, `TimedOut`, `Cancelled`, and `Failed`
+* `notification_type` - (Optional) When specified with `Command`, receive notification when the status of a command changes. When specified with `Invocation`, for commands sent to multiple instances, receive notification on a per-instance basis when the status of a command changes. Valid values: `Command` and `Invocation`
+
+`cloudwatch_config` supports the following:
+
+* `cloudwatch_log_group_name` - (Optional) The name of the CloudWatch log group where you want to send command output. If you don't specify a group name, Systems Manager automatically creates a log group for you. The log group uses the following naming format: aws/ssm/SystemsManagerDocumentName.
+* `cloudwatch_output_enabled` - (Optional) Enables Systems Manager to send command output to CloudWatch Logs.
+
+`parameter` supports the following:
+
+* `name` - (Required) The parameter name.
+* `values` - (Required) The array of strings.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the maintenance window task.
+* `id` - The ID of the maintenance window task.
+* `window_task_id` - The ID of the maintenance window task.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AWS Maintenance Window Task using the `window_id` and `window_task_id` separated by `/`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import AWS Maintenance Window Task using the `window_id` and `window_task_id` separated by `/`. For example:
+
+```console
+% terraform import aws_ssm_maintenance_window_task.task <window_id>/<window_task_id>
+```
+
+<!-- cache-key: cdktf-0.18.0 input-c897099591bdcacb9f61cf4c76d292fedaf9671e665a81bf657daf724fcf0e5c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ssm_parameter.html.markdown b/website/docs/cdktf/python/r/ssm_parameter.html.markdown
new file mode 100644
index 00000000000..743c6121257
--- /dev/null
+++ b/website/docs/cdktf/python/r/ssm_parameter.html.markdown
@@ -0,0 +1,129 @@
+---
+subcategory: "SSM (Systems Manager)"
+layout: "aws"
+page_title: "AWS: aws_ssm_parameter"
+description: |-
+  Provides a SSM Parameter resource
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ssm_parameter
+
+Provides an SSM Parameter resource.
+
+~> **Note:** `overwrite` also makes it possible to overwrite an existing SSM Parameter that's not created by Terraform before. This argument has been deprecated and will be removed in v6.0.0 of the provider. For more information on how this affects the behavior of this resource, see [this issue comment](https://github.com/hashicorp/terraform-provider-aws/issues/25636#issuecomment-1623661159).
+
+## Example Usage
+
+### Basic example
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ssm_parameter import SsmParameter
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SsmParameter(self, "foo",
+            name="foo",
+            type="String",
+            value="bar"
+        )
+```
+
+### Encrypted string using default SSM KMS key
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.db_instance import DbInstance
+from imports.aws.ssm_parameter import SsmParameter
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        DbInstance(self, "default",
+            allocated_storage=10,
+            db_name="mydb",
+            db_subnet_group_name="my_database_subnet_group",
+            engine="mysql",
+            engine_version="5.7.16",
+            instance_class="db.t2.micro",
+            parameter_group_name="default.mysql5.7",
+            password=database_master_password.string_value,
+            storage_type="gp2",
+            username="foo"
+        )
+        SsmParameter(self, "secret",
+            description="The parameter description",
+            name="/production/database/password/master",
+            tags={
+                "environment": "production"
+            },
+            type="SecureString",
+            value=database_master_password.string_value
+        )
+```
+
+~> **Note:** The unencrypted value of a SecureString will be stored in the raw state as plain-text.
+[Read more about sensitive data in state](https://www.terraform.io/docs/state/sensitive-data.html).
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) Name of the parameter. If the name contains a path (e.g., any forward slashes (`/`)), it must be fully qualified with a leading forward slash (`/`). For additional requirements and constraints, see the [AWS SSM User Guide](https://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-parameter-name-constraints.html).
+* `type` - (Required) Type of the parameter. Valid types are `String`, `StringList` and `SecureString`.
+
+The following arguments are optional:
+
+* `allowed_pattern` - (Optional) Regular expression used to validate the parameter value.
+* `data_type` - (Optional) Data type of the parameter. Valid values: `text`, `aws:ssm:integration` and `aws:ec2:image` for AMI format, see the [Native parameter support for Amazon Machine Image IDs](https://docs.aws.amazon.com/systems-manager/latest/userguide/parameter-store-ec2-aliases.html).
+* `description` - (Optional) Description of the parameter.
+* `insecure_value` - (Optional, exactly one of `value` or `insecure_value` is required) Value of the parameter. **Use caution:** This value is _never_ marked as sensitive in the Terraform plan output. This argument is not valid with a `type` of `SecureString`.
+* `key_id` - (Optional) KMS key ID or ARN for encrypting a SecureString.
+* `overwrite` - (Optional, **Deprecated**) Overwrite an existing parameter. If not specified, defaults to `false` if the resource has not been created by Terraform to avoid overwrite of existing resource, and will default to `true` otherwise (Terraform lifecycle rules should then be used to manage the update behavior).
+* `tags` - (Optional) Map of tags to assign to the object. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `tier` - (Optional) Parameter tier to assign to the parameter. If not specified, will use the default parameter tier for the region. Valid tiers are `Standard`, `Advanced`, and `Intelligent-Tiering`. Downgrading an `Advanced` tier parameter to `Standard` will recreate the resource. For more information on parameter tiers, see the [AWS SSM Parameter tier comparison and guide](https://docs.aws.amazon.com/systems-manager/latest/userguide/parameter-store-advanced-parameters.html).
+* `value` - (Optional, exactly one of `value` or `insecure_value` is required) Value of the parameter. This value is always marked as sensitive in the Terraform plan output, regardless of `type`. In Terraform CLI version 0.15 and later, this may require additional configuration handling for certain scenarios. For more information, see the [Terraform v0.15 Upgrade Guide](https://www.terraform.io/upgrade-guides/0-15.html#sensitive-output-values).
+
+~> **NOTE:** `aws:ssm:integration` data_type parameters must be of the type `SecureString` and the name must start with the prefix `/d9d01087-4a3f-49e0-b0b4-d568d7826553/ssm/integrations/webhook/`. See [here](https://docs.aws.amazon.com/systems-manager/latest/userguide/creating-integrations.html) for information on the usage of `aws:ssm:integration` parameters.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the parameter.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `version` - Version of the parameter.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SSM Parameters using the parameter store `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import SSM Parameters using the parameter store `name`. For example:
+
+```console
+% terraform import aws_ssm_parameter.my_param /my_path/my_paramname
+```
+
+<!-- cache-key: cdktf-0.18.0 input-a457572541c0a51d72bd59e88605ac40f08c24ad59c69cf3a0bfb414556b5891 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ssm_patch_baseline.html.markdown b/website/docs/cdktf/python/r/ssm_patch_baseline.html.markdown
new file mode 100644
index 00000000000..39044236722
--- /dev/null
+++ b/website/docs/cdktf/python/r/ssm_patch_baseline.html.markdown
@@ -0,0 +1,279 @@
+---
+subcategory: "SSM (Systems Manager)"
+layout: "aws"
+page_title: "AWS: aws_ssm_patch_baseline"
+description: |-
+  Provides an SSM Patch Baseline resource
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ssm_patch_baseline
+
+Provides an SSM Patch Baseline resource.
+
+~> **NOTE on Patch Baselines:** The `approved_patches` and `approval_rule` are
+both marked as optional fields, but the Patch Baseline requires that at least one
+of them is specified.
+
+## Example Usage
+
+### Basic Usage
+
+Using `approved_patches` only.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ssm_patch_baseline import SsmPatchBaseline
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SsmPatchBaseline(self, "production",
+            approved_patches=["KB123456"],
+            name="patch-baseline"
+        )
+```
+
+### Advanced Usage, specifying patch filters
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ssm_patch_baseline import SsmPatchBaseline
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SsmPatchBaseline(self, "production",
+            approval_rule=[SsmPatchBaselineApprovalRule(
+                approve_after_days=7,
+                compliance_level="HIGH",
+                patch_filter=[SsmPatchBaselineApprovalRulePatchFilter(
+                    key="PRODUCT",
+                    values=["WindowsServer2016"]
+                ), SsmPatchBaselineApprovalRulePatchFilter(
+                    key="CLASSIFICATION",
+                    values=["CriticalUpdates", "SecurityUpdates", "Updates"]
+                ), SsmPatchBaselineApprovalRulePatchFilter(
+                    key="MSRC_SEVERITY",
+                    values=["Critical", "Important", "Moderate"]
+                )
+                ]
+            ), SsmPatchBaselineApprovalRule(
+                approve_after_days=7,
+                patch_filter=[SsmPatchBaselineApprovalRulePatchFilter(
+                    key="PRODUCT",
+                    values=["WindowsServer2012"]
+                )
+                ]
+            )
+            ],
+            approved_patches=["KB123456", "KB456789"],
+            description="Patch Baseline Description",
+            global_filter=[SsmPatchBaselineGlobalFilter(
+                key="PRODUCT",
+                values=["WindowsServer2008"]
+            ), SsmPatchBaselineGlobalFilter(
+                key="CLASSIFICATION",
+                values=["ServicePacks"]
+            ), SsmPatchBaselineGlobalFilter(
+                key="MSRC_SEVERITY",
+                values=["Low"]
+            )
+            ],
+            name="patch-baseline",
+            rejected_patches=["KB987654"]
+        )
+```
+
+### Advanced usage, specifying Microsoft application and Windows patch rules
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ssm_patch_baseline import SsmPatchBaseline
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SsmPatchBaseline(self, "windows_os_apps",
+            approval_rule=[SsmPatchBaselineApprovalRule(
+                approve_after_days=7,
+                patch_filter=[SsmPatchBaselineApprovalRulePatchFilter(
+                    key="CLASSIFICATION",
+                    values=["CriticalUpdates", "SecurityUpdates"]
+                ), SsmPatchBaselineApprovalRulePatchFilter(
+                    key="MSRC_SEVERITY",
+                    values=["Critical", "Important"]
+                )
+                ]
+            ), SsmPatchBaselineApprovalRule(
+                approve_after_days=7,
+                patch_filter=[SsmPatchBaselineApprovalRulePatchFilter(
+                    key="PATCH_SET",
+                    values=["APPLICATION"]
+                ), SsmPatchBaselineApprovalRulePatchFilter(
+                    key="PRODUCT",
+                    values=["Office 2013", "Office 2016"]
+                )
+                ]
+            )
+            ],
+            description="Patch both Windows and Microsoft apps",
+            name="WindowsOSAndMicrosoftApps",
+            operating_system="WINDOWS"
+        )
+```
+
+### Advanced usage, specifying alternate patch source repository
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ssm_patch_baseline import SsmPatchBaseline
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, patchFilter):
+        super().__init__(scope, name)
+        SsmPatchBaseline(self, "al_2017_09",
+            approval_rule=[SsmPatchBaselineApprovalRule(
+                patch_filter=patch_filter
+            )
+            ],
+            description="My patch repository for Amazon Linux 2017.09",
+            name="Amazon-Linux-2017.09",
+            operating_system="AMAZON_LINUX",
+            source=[SsmPatchBaselineSource(
+                configuration="[amzn-main]\nname=amzn-main-Base\nmirrorlist=http://repo./$awsregion./$awsdomain//$releasever/main/mirror.list\nmirrorlist_expire=300\nmetadata_expire=300\npriority=10\nfailovermethod=priority\nfastestmirror_enabled=0\ngpgcheck=1\ngpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-amazon-ga\nenabled=1\nretries=3\ntimeout=5\nreport_instanceid=yes\n\n",
+                name="My-AL2017.09",
+                products=["AmazonLinux2017.09"]
+            )
+            ]
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the patch baseline.
+* `description` - (Optional) The description of the patch baseline.
+* `operating_system` - (Optional) The operating system the patch baseline applies to.
+  Valid values are
+  `ALMA_LINUX`,
+  `AMAZON_LINUX`,
+  `AMAZON_LINUX_2`,
+  `AMAZON_LINUX_2022`,
+  `AMAZON_LINUX_2023`,
+  `CENTOS`,
+  `DEBIAN`,
+  `MACOS`,
+  `ORACLE_LINUX`,
+  `RASPBIAN`,
+  `REDHAT_ENTERPRISE_LINUX`,
+  `ROCKY_LINUX`,
+  `SUSE`,
+  `UBUNTU`, and
+  `WINDOWS`.
+  The default value is `WINDOWS`.
+* `approved_patches_compliance_level` - (Optional) The compliance level for approved patches.
+  This means that if an approved patch is reported as missing, this is the severity of the compliance violation.
+  Valid values are `CRITICAL`, `HIGH`, `MEDIUM`, `LOW`, `INFORMATIONAL`, `UNSPECIFIED`.
+  The default value is `UNSPECIFIED`.
+* `approved_patches` - (Optional) A list of explicitly approved patches for the baseline.
+  Cannot be specified with `approval_rule`.
+* `rejected_patches` - (Optional) A list of rejected patches.
+* `global_filter` - (Optional) A set of global filters used to exclude patches from the baseline.
+  Up to 4 global filters can be specified using Key/Value pairs.
+  Valid Keys are `PRODUCT`, `CLASSIFICATION`, `MSRC_SEVERITY`, and `PATCH_ID`.
+* `approval_rule` - (Optional) A set of rules used to include patches in the baseline.
+  Up to 10 approval rules can be specified.
+  See [`approval_rule`](#approval_rule-block) below.
+* `source` - (Optional) Configuration block with alternate sources for patches.
+  Applies to Linux instances only.
+  See [`source`](#source-block) below.
+* `rejected_patches_action` - (Optional) The action for Patch Manager to take on patches included in the `rejected_patches` list.
+  Valid values are `ALLOW_AS_DEPENDENCY` and `BLOCK`.
+* `approved_patches_enable_non_security` - (Optional) Indicates whether the list of approved patches includes non-security updates that should be applied to the instances.
+  Applies to Linux instances only.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### `approval_rule` Block
+
+The `approval_rule` block supports:
+
+* `approve_after_days` - (Optional) The number of days after the release date of each patch matched by the rule the patch is marked as approved in the patch baseline.
+  Valid Range: 0 to 100.
+  Conflicts with `approve_until_date`.
+* `approve_until_date` - (Optional) The cutoff date for auto approval of released patches.
+  Any patches released on or before this date are installed automatically.
+  Date is formatted as `YYYY-MM-DD`.
+  Conflicts with `approve_after_days`
+* `patch_filter` - (Required) The patch filter group that defines the criteria for the rule.
+  Up to 5 patch filters can be specified per approval rule using Key/Value pairs.
+  Valid combinations of these Keys and the `operating_system` value can be found in the [SSM DescribePatchProperties API Reference](https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DescribePatchProperties.html).
+  Valid Values are exact values for the patch property given as the key, or a wildcard `*`, which matches all values.
+    * `PATCH_SET` defaults to `OS` if unspecified
+* `compliance_level` - (Optional) The compliance level for patches approved by this rule.
+  Valid values are `CRITICAL`, `HIGH`, `MEDIUM`, `LOW`, `INFORMATIONAL`, and `UNSPECIFIED`.
+  The default value is `UNSPECIFIED`.
+* `enable_non_security` - (Optional) Boolean enabling the application of non-security updates.
+  The default value is `false`.
+  Valid for Linux instances only.
+
+### `source` Block
+
+The `source` block supports:
+
+* `name` - (Required) The name specified to identify the patch source.
+* `configuration` - (Required) The value of the yum repo configuration.
+  For information about other options available for your yum repository configuration, see the [`dnf.conf` documentation](https://man7.org/linux/man-pages/man5/dnf.conf.5.html)
+* `products` - (Required) The specific operating system versions a patch repository applies to, such as `"Ubuntu16.04"`, `"AmazonLinux2016.09"`, `"RedhatEnterpriseLinux7.2"` or `"Suse12.7"`.
+  For lists of supported product values, see [PatchFilter](https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_PatchFilter.html).
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the patch baseline.
+* `arn` - The ARN of the patch baseline.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SSM Patch Baselines using their baseline ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import SSM Patch Baselines using their baseline ID. For example:
+
+```console
+% terraform import aws_ssm_patch_baseline.example pb-12345678
+```
+
+<!-- cache-key: cdktf-0.18.0 input-8564c1040b94d2bca2a77bd1f5497dbfad332cf94b1bfaa55582ef2dc819bc93 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ssm_patch_group.html.markdown b/website/docs/cdktf/python/r/ssm_patch_group.html.markdown
new file mode 100644
index 00000000000..b373b62b1f8
--- /dev/null
+++ b/website/docs/cdktf/python/r/ssm_patch_group.html.markdown
@@ -0,0 +1,53 @@
+---
+subcategory: "SSM (Systems Manager)"
+layout: "aws"
+page_title: "AWS: aws_ssm_patch_group"
+description: |-
+  Provides an SSM Patch Group resource
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ssm_patch_group
+
+Provides an SSM Patch Group resource
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ssm_patch_baseline import SsmPatchBaseline
+from imports.aws.ssm_patch_group import SsmPatchGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        production = SsmPatchBaseline(self, "production",
+            approved_patches=["KB123456"],
+            name="patch-baseline"
+        )
+        SsmPatchGroup(self, "patchgroup",
+            baseline_id=production.id,
+            patch_group="patch-group-name"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `baseline_id` - (Required) The ID of the patch baseline to register the patch group with.
+* `patch_group` - (Required) The name of the patch group that should be registered with the patch baseline.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name of the patch group and ID of the patch baseline separated by a comma (`,`).
+
+<!-- cache-key: cdktf-0.18.0 input-8fb71b4f9d0ba4c81e7e46ea58c2d79b16be2c22faf937bdd4e9cd0fb98b0c0d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ssm_resource_data_sync.html.markdown b/website/docs/cdktf/python/r/ssm_resource_data_sync.html.markdown
new file mode 100644
index 00000000000..4bb6843201e
--- /dev/null
+++ b/website/docs/cdktf/python/r/ssm_resource_data_sync.html.markdown
@@ -0,0 +1,122 @@
+---
+subcategory: "SSM (Systems Manager)"
+layout: "aws"
+page_title: "AWS: aws_ssm_resource_data_sync"
+description: |-
+  Provides a SSM resource data sync.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ssm_resource_data_sync
+
+Provides a SSM resource data sync.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_bucket_policy import S3BucketPolicy
+from imports.aws.ssm_resource_data_sync import SsmResourceDataSync
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        hoge = S3Bucket(self, "hoge",
+            bucket="tf-test-bucket-1234"
+        )
+        SsmResourceDataSync(self, "foo",
+            name="foo",
+            s3_destination=SsmResourceDataSyncS3Destination(
+                bucket_name=hoge.bucket,
+                region=hoge.region
+            )
+        )
+        data_aws_iam_policy_document_hoge = DataAwsIamPolicyDocument(self, "hoge_2",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["s3:GetBucketAcl"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["ssm.amazonaws.com"],
+                    type="Service"
+                )
+                ],
+                resources=["arn:aws:s3:::tf-test-bucket-1234"],
+                sid="SSMBucketPermissionsCheck"
+            ), DataAwsIamPolicyDocumentStatement(
+                actions=["s3:PutObject"],
+                condition=[DataAwsIamPolicyDocumentStatementCondition(
+                    test="StringEquals",
+                    values=["bucket-owner-full-control"],
+                    variable="s3:x-amz-acl"
+                )
+                ],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["ssm.amazonaws.com"],
+                    type="Service"
+                )
+                ],
+                resources=["arn:aws:s3:::tf-test-bucket-1234/*"],
+                sid="SSMBucketDelivery"
+            )
+            ]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_iam_policy_document_hoge.override_logical_id("hoge")
+        aws_s3_bucket_policy_hoge = S3BucketPolicy(self, "hoge_3",
+            bucket=hoge.id,
+            policy=Token.as_string(data_aws_iam_policy_document_hoge.json)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_s3_bucket_policy_hoge.override_logical_id("hoge")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) Name for the configuration.
+* `s3_destination` - (Required) Amazon S3 configuration details for the sync.
+
+## s3_destination
+
+`s3_destination` supports the following:
+
+* `bucket_name` - (Required) Name of S3 bucket where the aggregated data is stored.
+* `region` - (Required) Region with the bucket targeted by the Resource Data Sync.
+* `kms_key_arn` - (Optional) ARN of an encryption key for a destination in Amazon S3.
+* `prefix` - (Optional) Prefix for the bucket.
+* `sync_format` - (Optional) A supported sync format. Only JsonSerDe is currently supported. Defaults to JsonSerDe.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SSM resource data sync using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import SSM resource data sync using the `name`. For example:
+
+```console
+% terraform import aws_ssm_resource_data_sync.example example-name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1ca6cbc4ead65662883453fcaa95a776d79c46af9c730c2c622c39264e48c38b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ssm_service_setting.html.markdown b/website/docs/cdktf/python/r/ssm_service_setting.html.markdown
new file mode 100644
index 00000000000..2f39ff3bb42
--- /dev/null
+++ b/website/docs/cdktf/python/r/ssm_service_setting.html.markdown
@@ -0,0 +1,68 @@
+---
+subcategory: "SSM (Systems Manager)"
+layout: "aws"
+page_title: "AWS: aws_ssm_service_setting"
+description: |-
+  Defines how a user interacts with or uses a service or a feature of a service.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ssm_service_setting
+
+This setting defines how a user interacts with or uses a service or a feature of a service.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ssm_service_setting import SsmServiceSetting
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SsmServiceSetting(self, "test_setting",
+            setting_id="arn:aws:ssm:us-east-1:123456789012:servicesetting/ssm/parameter-store/high-throughput-enabled",
+            setting_value="true"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `setting_id` - (Required) ID of the service setting.
+* `setting_value` - (Required) Value of the service setting.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the service setting.
+* `status` - Status of the service setting. Value can be `Default`, `Customized` or `PendingUpdate`.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AWS SSM Service Setting using the `setting_id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import AWS SSM Service Setting using the `setting_id`. For example:
+
+```console
+% terraform import aws_ssm_service_setting.example arn:aws:ssm:us-east-1:123456789012:servicesetting/ssm/parameter-store/high-throughput-enabled
+```
+
+<!-- cache-key: cdktf-0.18.0 input-489362aa670f8e29ed8ee958af1a046523f1410820fe12b9bf0f827690afb34c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ssmcontacts_contact.html.markdown b/website/docs/cdktf/python/r/ssmcontacts_contact.html.markdown
new file mode 100644
index 00000000000..a733fd5f87e
--- /dev/null
+++ b/website/docs/cdktf/python/r/ssmcontacts_contact.html.markdown
@@ -0,0 +1,107 @@
+---
+subcategory: "SSM Contacts"
+layout: "aws"
+page_title: "AWS: aws_ssmcontacts_contact"
+description: |-
+  Terraform resource for managing an AWS SSM Contact.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ssmcontacts_contact
+
+Terraform resource for managing an AWS SSM Contact.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ssmcontacts_contact import SsmcontactsContact
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SsmcontactsContact(self, "example",
+            alias="alias",
+            depends_on=[aws_ssmincidents_replication_set_example],
+            type="PERSONAL"
+        )
+```
+
+### Usage With All Fields
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ssmcontacts_contact import SsmcontactsContact
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SsmcontactsContact(self, "example",
+            alias="alias",
+            depends_on=[aws_ssmincidents_replication_set_example],
+            display_name="displayName",
+            tags={
+                "key": "value"
+            },
+            type="ESCALATION"
+        )
+```
+
+## Argument Reference
+
+~> **NOTE:** A contact implicitly depends on a replication set. If you configured your replication set in Terraform, we recommend you add it to the `depends_on` argument for the Terraform Contact Resource.
+
+The following arguments are required:
+
+- `alias` - (Required) A unique and identifiable alias for the contact or escalation plan. Must be between 1 and 255 characters, and may contain alphanumerics, underscores (`_`), and hyphens (`-`).
+
+- `type` - (Required) The type of contact engaged. A single contact is type PERSONAL and an escalation
+  plan is type ESCALATION.
+
+The following arguments are optional:
+
+- `display_name` - (Optional) Full friendly name of the contact or escalation plan. If set, must be between 1 and 255 characters, and may contain alphanumerics, underscores (`_`), hyphens (`-`), periods (`.`), and spaces.
+
+- `tags` - (Optional) Map of tags to assign to the resource.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+- `arn` - The Amazon Resource Name (ARN) of the contact or escalation plan.
+
+- `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SSM Contact using the `ARN`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import SSM Contact using the `ARN`. For example:
+
+```console
+% terraform import aws_ssmcontacts_contact.example {ARNValue}
+```
+
+<!-- cache-key: cdktf-0.18.0 input-2663536b417f222904b9f9c62ac959d51fabe5b14bf73e4c198bb18616b00366 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ssmcontacts_contact_channel.html.markdown b/website/docs/cdktf/python/r/ssmcontacts_contact_channel.html.markdown
new file mode 100644
index 00000000000..6bf5228f6e1
--- /dev/null
+++ b/website/docs/cdktf/python/r/ssmcontacts_contact_channel.html.markdown
@@ -0,0 +1,115 @@
+---
+subcategory: "SSM Contacts"
+layout: "aws"
+page_title: "AWS: aws_ssmcontacts_contact_channel"
+description: |-
+  Terraform resource for managing an AWS SSM Contacts Contact Channel.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ssmcontacts_contact_channel
+
+Terraform resource for managing an AWS SSM Contacts Contact Channel.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ssmcontacts_contact_channel import SsmcontactsContactChannel
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SsmcontactsContactChannel(self, "example",
+            contact_id="arn:aws:ssm-contacts:us-west-2:123456789012:contact/contactalias",
+            delivery_address=SsmcontactsContactChannelDeliveryAddress(
+                simple_address="email@example.com"
+            ),
+            name="Example contact channel",
+            type="EMAIL"
+        )
+```
+
+### Usage with SSM Contact
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ssmcontacts_contact import SsmcontactsContact
+from imports.aws.ssmcontacts_contact_channel import SsmcontactsContactChannel
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example_contact = SsmcontactsContact(self, "example_contact",
+            alias="example_contact",
+            type="PERSONAL"
+        )
+        SsmcontactsContactChannel(self, "example",
+            contact_id=example_contact.arn,
+            delivery_address=SsmcontactsContactChannelDeliveryAddress(
+                simple_address="email@example.com"
+            ),
+            name="Example contact channel",
+            type="EMAIL"
+        )
+```
+
+## Argument Reference
+
+~> **NOTE:** The contact channel needs to be activated in the AWS Systems Manager console, otherwise it can't be used to engage the contact. See the [Contacts section of the Incident Manager User Guide](https://docs.aws.amazon.com/incident-manager/latest/userguide/contacts.html) for more information.
+
+The following arguments are required:
+
+- `contact_id` - (Required) Amazon Resource Name (ARN) of the AWS SSM Contact that the contact channel belongs to.
+
+- `delivery_address` - (Required) Block that contains contact engagement details. See details below.
+
+- `name` - (Required) Name of the contact channel. Must be between 1 and 255 characters, and may contain alphanumerics, underscores (`_`), hyphens (`-`), periods (`.`), and spaces.
+
+- `type` - (Required) Type of the contact channel. One of `SMS`, `VOICE` or `EMAIL`.
+
+### delivery_address
+
+- `simple_address` - (Required) Details to engage this contact channel. The expected format depends on the contact channel type and is described in the [`ContactChannelAddress` section of the SSM Contacts API Reference](https://docs.aws.amazon.com/incident-manager/latest/APIReference/API_SSMContacts_ContactChannelAddress.html).
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+- `activation_status` - Whether the contact channel is activated. The contact channel must be activated to use it to engage the contact. One of `ACTIVATED` or `NOT_ACTIVATED`.
+
+- `arn` - Amazon Resource Name (ARN) of the contact channel.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SSM Contact Channel using the `ARN`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import SSM Contact Channel using the `ARN`. For example:
+
+```console
+% terraform import aws_ssmcontacts_contact_channel.example arn:aws:ssm-contacts:us-west-2:123456789012:contact-channel/example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-875a737831eeadb1d936d18c2cf26aad7a60fef9a50f2c0c60f64676b0763b4f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ssmcontacts_plan.html.markdown b/website/docs/cdktf/python/r/ssmcontacts_plan.html.markdown
new file mode 100644
index 00000000000..53af218655a
--- /dev/null
+++ b/website/docs/cdktf/python/r/ssmcontacts_plan.html.markdown
@@ -0,0 +1,146 @@
+---
+subcategory: "SSM Contacts"
+layout: "aws"
+page_title: "AWS: aws_ssmcontacts_plan"
+description: |-
+  Terraform resource for managing an AWS SSM Contact Plan.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ssmcontacts_plan
+
+Terraform resource for managing an AWS SSM Contact Plan.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ssmcontacts_plan import SsmcontactsPlan
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SsmcontactsPlan(self, "example",
+            contact_id="arn:aws:ssm-contacts:us-west-2:123456789012:contact/contactalias",
+            stage=[SsmcontactsPlanStage(
+                duration_in_minutes=1
+            )
+            ]
+        )
+```
+
+### Usage with SSM Contact
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ssmcontacts_contact import SsmcontactsContact
+from imports.aws.ssmcontacts_plan import SsmcontactsPlan
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        contact = SsmcontactsContact(self, "contact",
+            alias="alias",
+            type="PERSONAL"
+        )
+        SsmcontactsPlan(self, "plan",
+            contact_id=contact.arn,
+            stage=[SsmcontactsPlanStage(
+                duration_in_minutes=1
+            )
+            ]
+        )
+```
+
+### Usage With All Fields
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ssmcontacts_contact import SsmcontactsContact
+from imports.aws.ssmcontacts_plan import SsmcontactsPlan
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        contact_one = SsmcontactsContact(self, "contact_one",
+            alias="alias",
+            type="PERSONAL"
+        )
+        contact_two = SsmcontactsContact(self, "contact_two",
+            alias="alias",
+            type="PERSONAL"
+        )
+        escalation_plan = SsmcontactsContact(self, "escalation_plan",
+            alias="escalation-plan-alias",
+            type="ESCALATION"
+        )
+        SsmcontactsPlan(self, "test",
+            contact_id=escalation_plan.arn,
+            stage=[SsmcontactsPlanStage(
+                duration_in_minutes=0,
+                target=[SsmcontactsPlanStageTarget(
+                    contact_target_info=SsmcontactsPlanStageTargetContactTargetInfo(
+                        contact_id=contact_one.arn,
+                        is_essential=False
+                    )
+                ), SsmcontactsPlanStageTarget(
+                    contact_target_info=SsmcontactsPlanStageTargetContactTargetInfo(
+                        contact_id=contact_two.arn,
+                        is_essential=True
+                    )
+                )
+                ]
+            )
+            ]
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `contact_id` - (Required) The Amazon Resource Name (ARN) of the contact or escalation plan.
+* `stage` - (Required) List of stages. A contact has an engagement plan with stages that contact specified contact channels. An escalation plan uses stages that contact specified contacts.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SSM Contact Plan using the Contact ARN. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import SSM Contact Plan using the Contact ARN. For example:
+
+```console
+% terraform import aws_ssmcontacts_plan.example {ARNValue}
+```
+
+<!-- cache-key: cdktf-0.18.0 input-b4cf46452def53401430a7de3b756aa75f94fe3fbe79d237dcc4e08ea43938c8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ssmincidents_replication_set.html.markdown b/website/docs/cdktf/python/r/ssmincidents_replication_set.html.markdown
new file mode 100644
index 00000000000..529f0730e6f
--- /dev/null
+++ b/website/docs/cdktf/python/r/ssmincidents_replication_set.html.markdown
@@ -0,0 +1,197 @@
+---
+subcategory: "SSM Incident Manager Incidents"
+layout: "aws"
+page_title: "AWS: aws_ssmincidents_replication_set"
+description: |-
+  Terraform resource for managing an incident replication set for AWS Systems Manager Incident Manager.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ssmincidents_replication_set
+
+Provides a resource for managing a replication set in AWS Systems Manager Incident Manager.
+
+~> **NOTE:** Deleting a replication set also deletes all Incident Manager related data including response plans, incident records, contacts and escalation plans.
+
+## Example Usage
+
+### Basic Usage
+
+Create a replication set.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ssmincidents_replication_set import SsmincidentsReplicationSet
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SsmincidentsReplicationSet(self, "replicationSetName",
+            region=[SsmincidentsReplicationSetRegion(
+                name="us-west-2"
+            )
+            ],
+            tags={
+                "example_tag": "exampleValue"
+            }
+        )
+```
+
+Add a Region to a replication set. (You can add only one Region at a time.)
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ssmincidents_replication_set import SsmincidentsReplicationSet
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SsmincidentsReplicationSet(self, "replicationSetName",
+            region=[SsmincidentsReplicationSetRegion(
+                name="us-west-2"
+            ), SsmincidentsReplicationSetRegion(
+                name="ap-southeast-2"
+            )
+            ]
+        )
+```
+
+Delete a Region from a replication set. (You can delete only one Region at a time.)
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ssmincidents_replication_set import SsmincidentsReplicationSet
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SsmincidentsReplicationSet(self, "replicationSetName",
+            region=[SsmincidentsReplicationSetRegion(
+                name="us-west-2"
+            )
+            ]
+        )
+```
+
+## Basic Usage with an AWS Customer Managed Key
+
+Create a replication set with an AWS Key Management Service (AWS KMS) customer manager key:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.kms_key import KmsKey
+from imports.aws.ssmincidents_replication_set import SsmincidentsReplicationSet
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example_key = KmsKey(self, "example_key")
+        SsmincidentsReplicationSet(self, "replicationSetName",
+            region=[SsmincidentsReplicationSetRegion(
+                kms_key_arn=example_key.arn,
+                name="us-west-2"
+            )
+            ],
+            tags={
+                "example_tag": "exampleValue"
+            }
+        )
+```
+
+## Argument Reference
+
+~> **NOTE:** The Region specified by a Terraform provider must always be one of the Regions specified for the replication set. This is especially important when you perform complex update operations.
+
+~> **NOTE:** After a replication set is created, you can add or delete only one Region at a time.
+
+~> **NOTE:** Incident Manager does not support updating the customer managed key associated with a replication set. Instead, for a replication set with multiple Regions, you must first delete a Region from the replication set, then re-add it with a different customer managed key in separate `terraform apply` operations. For a replication set with only one Region, the entire replication set must be deleted and recreated. To do this, comment out the replication set and all response plans, and then run the `terraform apply` command to recreate the replication set with the new customer managed key.
+
+~> **NOTE:** You must either use AWS-owned keys on all regions of a replication set, or customer managed keys. To change between an AWS owned key and a customer managed key, a replication set and it associated data must be deleted and recreated.
+
+~> **NOTE:** If possible, create all the customer managed keys you need (using the `terraform apply` command) before you create the replication set, or create the keys and replication set in the same `terraform apply` command. Otherwise, to delete a replication set, you must run one `terraform apply` command to delete the replication set and another to delete the AWS KMS keys used by the replication set. Deleting the AWS KMS keys before deleting the replication set results in an error. In that case, you must manually reenable the deleted key using the AWS Management Console before you can delete the replication set.
+
+The `region` configuration block is required and supports the following arguments:
+
+* `name` - (Required) The name of the Region, such as `ap-southeast-2`.
+* `kms_key_arn` - (Optional) The Amazon Resource name (ARN) of the customer managed key. If omitted, AWS manages the AWS KMS keys for you, using an AWS owned key, as indicated by a default value of `DefaultKey`.
+
+The following arguments are optional:
+
+* `tags` - Tags applied to the replication set.
+
+For information about the maximum allowed number of Regions and tag value constraints, see [CreateReplicationSet in the *AWS Systems Manager Incident Manager API Reference*](https://docs.aws.amazon.com/incident-manager/latest/APIReference/API_CreateReplicationSet.html).
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the replication set.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `created_by` - The ARN of the user who created the replication set.
+* `created_time` - A timestamp showing when the replication set was created.
+* `deletion_protected` - If `true`, the last region in a replication set cannot be deleted.
+* `last_modified_by` - A timestamp showing when the replication set was last modified.
+* `last_modified_time` - When the replication set was last modified
+* `status` - The overall status of a replication set.
+    * Valid Values: `ACTIVE` | `CREATING` | `UPDATING` | `DELETING` | `FAILED`
+
+In addition to the preceding arguments, the `region` configuration block exports the following attributes for each Region:
+
+* `status` - The current status of the Region.
+    * Valid Values: `ACTIVE` | `CREATING` | `UPDATING` | `DELETING` | `FAILED`
+* `status_update_time` - A timestamp showing when the Region status was last updated.
+* `status_message` - More information about the status of a Region.
+
+## Timeouts
+
+~> **NOTE:** `Update` and `Delete` operations applied to replication sets with large numbers of response plans and data take longer to complete. We recommend that you configure custom timeouts for this situation.
+
+~> **NOTE:** Each additional Region included when you create a replication set increases the amount of time required to complete the `create` operation.
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `120m`)
+* `update` - (Default `120m`)
+* `delete` - (Default `120m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import an Incident Manager replication. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import an Incident Manager replication. For example:
+
+```console
+% terraform import aws_ssmincidents_replication_set.replicationSetName import
+```
+
+<!-- cache-key: cdktf-0.18.0 input-db40342720668c450b5bd2187447758810506f9aa388358f6b3d9c52cf3d9ebf -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ssmincidents_response_plan.html.markdown b/website/docs/cdktf/python/r/ssmincidents_response_plan.html.markdown
new file mode 100644
index 00000000000..ac8364df302
--- /dev/null
+++ b/website/docs/cdktf/python/r/ssmincidents_response_plan.html.markdown
@@ -0,0 +1,189 @@
+---
+subcategory: "SSM Incident Manager Incidents"
+layout: "aws"
+page_title: "AWS: aws_ssmincidents_response_plan"
+description: |-
+  Terraform resource for managing an incident response plan in AWS Systems Manager Incident Manager.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ssmincidents_response_plan
+
+Provides a Terraform resource to manage response plans in AWS Systems Manager Incident Manager.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ssmincidents_response_plan import SsmincidentsResponsePlan
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SsmincidentsResponsePlan(self, "example",
+            depends_on=[aws_ssmincidents_replication_set_example],
+            incident_template=SsmincidentsResponsePlanIncidentTemplate(
+                impact=Token.as_number("3"),
+                title="title"
+            ),
+            name="name",
+            tags={
+                "key": "value"
+            }
+        )
+```
+
+### Usage With All Fields
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ssmincidents_response_plan import SsmincidentsResponsePlan
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SsmincidentsResponsePlan(self, "example",
+            action=SsmincidentsResponsePlanAction(
+                ssm_automation=[SsmincidentsResponsePlanActionSsmAutomation(
+                    document_name=document1.name,
+                    document_version="version1",
+                    dynamic_parameters={
+                        "another_key": "INCIDENT_RECORD_ARN",
+                        "some_key": "INVOLVED_RESOURCES"
+                    },
+                    parameter=[SsmincidentsResponsePlanActionSsmAutomationParameter(
+                        name="key",
+                        values=["value1", "value2"]
+                    ), SsmincidentsResponsePlanActionSsmAutomationParameter(
+                        name="foo",
+                        values=["bar"]
+                    )
+                    ],
+                    role_arn=role1.arn,
+                    target_account="RESPONSE_PLAN_OWNER_ACCOUNT"
+                )
+                ]
+            ),
+            chat_channel=[topic.arn],
+            depends_on=[aws_ssmincidents_replication_set_example],
+            display_name="display name",
+            engagements=["arn:aws:ssm-contacts:us-east-2:111122223333:contact/test1"
+            ],
+            incident_template=SsmincidentsResponsePlanIncidentTemplate(
+                dedupe_string="dedupe",
+                impact=Token.as_number("3"),
+                incident_tags={
+                    "key": "value"
+                },
+                notification_target=[SsmincidentsResponsePlanIncidentTemplateNotificationTarget(
+                    sns_topic_arn=example1.arn
+                ), SsmincidentsResponsePlanIncidentTemplateNotificationTarget(
+                    sns_topic_arn=example2.arn
+                )
+                ],
+                summary="summary",
+                title="title"
+            ),
+            integration=SsmincidentsResponsePlanIntegration(
+                pagerduty=[SsmincidentsResponsePlanIntegrationPagerduty(
+                    name="pagerdutyIntergration",
+                    secret_id="example",
+                    service_id="example"
+                )
+                ]
+            ),
+            name="name",
+            tags={
+                "key": "value"
+            }
+        )
+```
+
+## Argument Reference
+
+~> NOTE: A response plan implicitly depends on a replication set. If you configured your replication set in Terraform,
+we recommend you add it to the `depends_on` argument for the Terraform ResponsePlan Resource.
+
+The following arguments are required:
+
+* `name` - (Required) The name of the response plan.
+
+The `incident_template` configuration block is required and supports the following arguments:
+
+* `title` - (Required) The title of a generated incident.
+* `impact` - (Required) The impact value of a generated incident. The following values are supported:
+    * `1` - Severe Impact
+    * `2` - High Impact
+    * `3` - Medium Impact
+    * `4` - Low Impact
+    * `5` - No Impact
+* `dedupe_string` - (Optional) A string used to stop Incident Manager from creating multiple incident records for the same incident.
+* `incident_tags` - (Optional) The tags assigned to an incident template. When an incident starts, Incident Manager assigns the tags specified in the template to the incident.
+* `summary` - (Optional) The summary of an incident.
+* `notification_target` - (Optional) The Amazon Simple Notification Service (Amazon SNS) targets that this incident notifies when it is updated. The `notification_target` configuration block supports the following argument:
+    * `sns_topic_arn` - (Required) The ARN of the Amazon SNS topic.
+
+The following arguments are optional:
+
+* `tags` - (Optional) The tags applied to the response plan.
+* `display_name` - (Optional) The long format of the response plan name. This field can contain spaces.
+* `chat_channel` - (Optional) The Chatbot chat channel used for collaboration during an incident.
+* `engagements` - (Optional) The Amazon Resource Name (ARN) for the contacts and escalation plans that the response plan engages during an incident.
+* `action` - (Optional) The actions that the response plan starts at the beginning of an incident.
+    * `ssm_automation` - (Optional) The Systems Manager automation document to start as the runbook at the beginning of the incident. The following values are supported:
+        * `document_name` - (Required) The automation document's name.
+        * `role_arn` - (Required) The Amazon Resource Name (ARN) of the role that the automation document assumes when it runs commands.
+        * `document_version` - (Optional) The version of the automation document to use at runtime.
+        * `target_account` -  (Optional) The account that the automation document runs in. This can be in either the management account or an application account.
+        * `parameter` - (Optional) The key-value pair parameters to use when the automation document runs. The following values are supported:
+            * `name` - The name of parameter.
+            * `values` - The values for the associated parameter name.
+        * `dynamic_parameters` - (Optional) The key-value pair to resolve dynamic parameter values when processing a Systems Manager Automation runbook.
+* `integration` - (Optional) Information about third-party services integrated into the response plan. The following values are supported:
+    * `pagerduty` - (Optional) Details about the PagerDuty configuration for a response plan. The following values are supported:
+        * `name` - (Required) The name of the PagerDuty configuration.
+        * `service_id` - (Required) The ID of the PagerDuty service that the response plan associated with the incident at launch.
+        * `secret_id` - (Required) The ID of the AWS Secrets Manager secret that stores your PagerDuty key &mdash; either a General Access REST API Key or User Token REST API Key &mdash; and other user credentials.
+
+For more information about the constraints for each field, see [CreateResponsePlan](https://docs.aws.amazon.com/incident-manager/latest/APIReference/API_CreateResponsePlan.html) in the *AWS Systems Manager Incident Manager API Reference*.
+  
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the response plan.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import an Incident Manager response plan using the response plan ARN. You can find the response plan ARN in the AWS Management Console. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import an Incident Manager response plan using the response plan ARN. You can find the response plan ARN in the AWS Management Console. For example:
+
+```console
+% terraform import aws_ssmincidents_response_plan.responsePlanName ARNValue
+```
+
+<!-- cache-key: cdktf-0.18.0 input-5361abe938254390d796107fc777680b0ac2ec3e08a7c3e24cc29d54aae3c456 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ssoadmin_account_assignment.html.markdown b/website/docs/cdktf/python/r/ssoadmin_account_assignment.html.markdown
new file mode 100644
index 00000000000..9c02b4ce33b
--- /dev/null
+++ b/website/docs/cdktf/python/r/ssoadmin_account_assignment.html.markdown
@@ -0,0 +1,109 @@
+---
+subcategory: "SSO Admin"
+layout: "aws"
+page_title: "AWS: aws_ssoadmin_account_assignment"
+description: |-
+  Manages a Single Sign-On (SSO) Account Assignment
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ssoadmin_account_assignment
+
+Provides a Single Sign-On (SSO) Account Assignment resource
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_identitystore_group import DataAwsIdentitystoreGroup
+from imports.aws.data_aws_ssoadmin_instances import DataAwsSsoadminInstances
+from imports.aws.data_aws_ssoadmin_permission_set import DataAwsSsoadminPermissionSet
+from imports.aws.ssoadmin_account_assignment import SsoadminAccountAssignment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = DataAwsSsoadminInstances(self, "example")
+        data_aws_ssoadmin_permission_set_example =
+        DataAwsSsoadminPermissionSet(self, "example_1",
+            instance_arn=Token.as_string(
+                Fn.lookup_nested(Fn.tolist(example.arns), ["0"])),
+            name="AWSReadOnlyAccess"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_ssoadmin_permission_set_example.override_logical_id("example")
+        data_aws_identitystore_group_example = DataAwsIdentitystoreGroup(self, "example_2",
+            alternate_identifier=DataAwsIdentitystoreGroupAlternateIdentifier(
+                unique_attribute=DataAwsIdentitystoreGroupAlternateIdentifierUniqueAttribute(
+                    attribute_path="DisplayName",
+                    attribute_value="ExampleGroup"
+                )
+            ),
+            identity_store_id=Token.as_string(
+                Fn.lookup_nested(Fn.tolist(example.identity_store_ids), ["0"]))
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_identitystore_group_example.override_logical_id("example")
+        aws_ssoadmin_account_assignment_example = SsoadminAccountAssignment(self, "example_3",
+            instance_arn=Token.as_string(
+                Fn.lookup_nested(Fn.tolist(example.arns), ["0"])),
+            permission_set_arn=Token.as_string(data_aws_ssoadmin_permission_set_example.arn),
+            principal_id=Token.as_string(data_aws_identitystore_group_example.group_id),
+            principal_type="GROUP",
+            target_id="012347678910",
+            target_type="AWS_ACCOUNT"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_ssoadmin_account_assignment_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `instance_arn` - (Required, Forces new resource) The Amazon Resource Name (ARN) of the SSO Instance.
+* `permission_set_arn` - (Required, Forces new resource) The Amazon Resource Name (ARN) of the Permission Set that the admin wants to grant the principal access to.
+* `principal_id` - (Required, Forces new resource) An identifier for an object in SSO, such as a user or group. PrincipalIds are GUIDs (For example, `f81d4fae-7dec-11d0-a765-00a0c91e6bf6`).
+* `principal_type` - (Required, Forces new resource) The entity type for which the assignment will be created. Valid values: `USER`, `GROUP`.
+* `target_id` - (Required, Forces new resource) An AWS account identifier, typically a 10-12 digit string.
+* `target_type` - (Optional, Forces new resource) The entity type for which the assignment will be created. Valid values: `AWS_ACCOUNT`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The identifier of the Account Assignment i.e., `principal_id`, `principal_type`, `target_id`, `target_type`, `permission_set_arn`, `instance_arn` separated by commas (`,`).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `5m`)
+- `delete` - (Default `5m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SSO Account Assignments using the `principal_id`, `principal_type`, `target_id`, `target_type`, `permission_set_arn`, `instance_arn` separated by commas (`,`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import SSO Account Assignments using the `principal_id`, `principal_type`, `target_id`, `target_type`, `permission_set_arn`, `instance_arn` separated by commas (`,`). For example:
+
+```console
+% terraform import aws_ssoadmin_account_assignment.example f81d4fae-7dec-11d0-a765-00a0c91e6bf6,GROUP,1234567890,AWS_ACCOUNT,arn:aws:sso:::permissionSet/ssoins-0123456789abcdef/ps-0123456789abcdef,arn:aws:sso:::instance/ssoins-0123456789abcdef
+```
+
+<!-- cache-key: cdktf-0.18.0 input-8b452aa69c7edc6b5216675cd1c17412026fe86f918609ce3cea201495fc2f0e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ssoadmin_customer_managed_policy_attachment.html.markdown b/website/docs/cdktf/python/r/ssoadmin_customer_managed_policy_attachment.html.markdown
new file mode 100644
index 00000000000..c7b955d9151
--- /dev/null
+++ b/website/docs/cdktf/python/r/ssoadmin_customer_managed_policy_attachment.html.markdown
@@ -0,0 +1,119 @@
+---
+subcategory: "SSO Admin"
+layout: "aws"
+page_title: "AWS: aws_ssoadmin_customer_managed_policy_attachment"
+description: |-
+  Manages a customer managed policy for a Single Sign-On (SSO) Permission Set
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ssoadmin_customer_managed_policy_attachment
+
+Provides a customer managed policy attachment for a Single Sign-On (SSO) Permission Set resource
+
+~> **NOTE:** Creating this resource will automatically [Provision the Permission Set](https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_ProvisionPermissionSet.html) to apply the corresponding updates to all assigned accounts.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_ssoadmin_instances import DataAwsSsoadminInstances
+from imports.aws.iam_policy import IamPolicy
+from imports.aws.ssoadmin_customer_managed_policy_attachment import SsoadminCustomerManagedPolicyAttachment
+from imports.aws.ssoadmin_permission_set import SsoadminPermissionSet
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = IamPolicy(self, "example",
+            description="My test policy",
+            name="TestPolicy",
+            policy=Token.as_string(
+                Fn.jsonencode({
+                    "Statement": [{
+                        "Action": ["ec2:Describe*"],
+                        "Effect": "Allow",
+                        "Resource": "*"
+                    }
+                    ],
+                    "Version": "2012-10-17"
+                }))
+        )
+        data_aws_ssoadmin_instances_example = DataAwsSsoadminInstances(self, "example_1")
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_ssoadmin_instances_example.override_logical_id("example")
+        aws_ssoadmin_permission_set_example = SsoadminPermissionSet(self, "example_2",
+            instance_arn=Token.as_string(
+                Fn.lookup_nested(Fn.tolist(data_aws_ssoadmin_instances_example.arns), ["0"
+                ])),
+            name="Example"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_ssoadmin_permission_set_example.override_logical_id("example")
+        aws_ssoadmin_customer_managed_policy_attachment_example =
+        SsoadminCustomerManagedPolicyAttachment(self, "example_3",
+            customer_managed_policy_reference=SsoadminCustomerManagedPolicyAttachmentCustomerManagedPolicyReference(
+                name=example.name,
+                path="/"
+            ),
+            instance_arn=Token.as_string(aws_ssoadmin_permission_set_example.instance_arn),
+            permission_set_arn=Token.as_string(aws_ssoadmin_permission_set_example.arn)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_ssoadmin_customer_managed_policy_attachment_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `instance_arn` - (Required, Forces new resource) The Amazon Resource Name (ARN) of the SSO Instance under which the operation will be executed.
+* `permission_set_arn` - (Required, Forces new resource) The Amazon Resource Name (ARN) of the Permission Set.
+* `customer_managed_policy_reference` - (Required, Forces new resource) Specifies the name and path of a customer managed policy. See below.
+
+### Customer Managed Policy Reference
+
+The `customer_managed_policy_reference` config block describes a customer managed IAM policy. You must have an IAM policy that matches the name and path in each AWS account where you want to deploy your specified permission set.
+
+* `name` - (Required, Forces new resource) Name of the customer managed IAM Policy to be attached.
+* `path` - (Optional, Forces new resource) The path to the IAM policy to be attached. The default is `/`. See [IAM Identifiers](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html#identifiers-friendly-names) for more information.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Policy Name, Policy Path, Permission Set Amazon Resource Name (ARN), and SSO Instance ARN, each separated by a comma (`,`).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `10m`)
+- `delete` - (Default `10m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SSO Managed Policy Attachments using the `name`, `path`, `permission_set_arn`, and `instance_arn` separated by a comma (`,`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import SSO Managed Policy Attachments using the `name`, `path`, `permission_set_arn`, and `instance_arn` separated by a comma (`,`). For example:
+
+```console
+% terraform import aws_ssoadmin_customer_managed_policy_attachment.example TestPolicy,/,arn:aws:sso:::permissionSet/ssoins-2938j0x8920sbj72/ps-80383020jr9302rk,arn:aws:sso:::instance/ssoins-2938j0x8920sbj72
+```
+
+<!-- cache-key: cdktf-0.18.0 input-a04c10d6fcfe1554e5e21b7e379b1eef18d14ec57155c17e159d69d18e318c3e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ssoadmin_instance_access_control_attributes.html.markdown b/website/docs/cdktf/python/r/ssoadmin_instance_access_control_attributes.html.markdown
new file mode 100644
index 00000000000..80af84ba2de
--- /dev/null
+++ b/website/docs/cdktf/python/r/ssoadmin_instance_access_control_attributes.html.markdown
@@ -0,0 +1,95 @@
+---
+subcategory: "SSO Admin"
+layout: "aws"
+page_title: "AWS: aws_ssoadmin_instance_access_control_attributes"
+description: |-
+  Provides a Single Sign-On (SSO) ABAC Resource: https://docs.aws.amazon.com/singlesignon/latest/userguide/abac.html
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ssoadmin_instance_access_control_attributes
+
+Provides a Single Sign-On (SSO) ABAC Resource: https://docs.aws.amazon.com/singlesignon/latest/userguide/abac.html
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_ssoadmin_instances import DataAwsSsoadminInstances
+from imports.aws.ssoadmin_instance_access_control_attributes import SsoadminInstanceAccessControlAttributes
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = DataAwsSsoadminInstances(self, "example")
+        aws_ssoadmin_instance_access_control_attributes_example =
+        SsoadminInstanceAccessControlAttributes(self, "example_1",
+            attribute=[SsoadminInstanceAccessControlAttributesAttribute(
+                key="name",
+                value=[SsoadminInstanceAccessControlAttributesAttributeValue(
+                    source=["$${path:name.givenName}"]
+                )
+                ]
+            ), SsoadminInstanceAccessControlAttributesAttribute(
+                key="last",
+                value=[SsoadminInstanceAccessControlAttributesAttributeValue(
+                    source=["$${path:name.familyName}"]
+                )
+                ]
+            )
+            ],
+            instance_arn=Token.as_string(
+                Fn.lookup_nested(Fn.tolist(example.arns), ["0"]))
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_ssoadmin_instance_access_control_attributes_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `instance_arn` - (Required, Forces new resource) The Amazon Resource Name (ARN) of the SSO Instance.
+* `attribute` - (Required) See [AccessControlAttribute](#accesscontrolattribute) for more details.
+
+### AccessControlAttribute
+
+* `key` - (Required) The name of the attribute associated with your identities in your identity source. This is used to map a specified attribute in your identity source with an attribute in AWS SSO.
+* `value` - (Required) The value used for mapping a specified attribute to an identity source. See [AccessControlAttributeValue](#accesscontrolattributevalue)
+
+### AccessControlAttributeValue
+
+* `source` - (Required) The identity source to use when mapping a specified attribute to AWS SSO.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The identifier of the Instance Access Control Attribute `instance_arn`.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SSO Account Assignments using the `instance_arn`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import SSO Account Assignments using the `instance_arn`. For example:
+
+```console
+% terraform import aws_ssoadmin_instance_access_control_attributes.example arn:aws:sso:::instance/ssoins-0123456789abcdef
+```
+
+<!-- cache-key: cdktf-0.18.0 input-0555b8646d1cd7133c5af6d918c5eb794a739e08734bb46a2e6ae815ff87af3f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ssoadmin_managed_policy_attachment.html.markdown b/website/docs/cdktf/python/r/ssoadmin_managed_policy_attachment.html.markdown
new file mode 100644
index 00000000000..52afd9ba996
--- /dev/null
+++ b/website/docs/cdktf/python/r/ssoadmin_managed_policy_attachment.html.markdown
@@ -0,0 +1,93 @@
+---
+subcategory: "SSO Admin"
+layout: "aws"
+page_title: "AWS: aws_ssoadmin_managed_policy_attachment"
+description: |-
+  Manages an IAM managed policy for a Single Sign-On (SSO) Permission Set
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ssoadmin_managed_policy_attachment
+
+Provides an IAM managed policy for a Single Sign-On (SSO) Permission Set resource
+
+~> **NOTE:** Creating this resource will automatically [Provision the Permission Set](https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_ProvisionPermissionSet.html) to apply the corresponding updates to all assigned accounts.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_ssoadmin_instances import DataAwsSsoadminInstances
+from imports.aws.ssoadmin_managed_policy_attachment import SsoadminManagedPolicyAttachment
+from imports.aws.ssoadmin_permission_set import SsoadminPermissionSet
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = DataAwsSsoadminInstances(self, "example")
+        aws_ssoadmin_permission_set_example = SsoadminPermissionSet(self, "example_1",
+            instance_arn=Token.as_string(
+                Fn.lookup_nested(Fn.tolist(example.arns), ["0"])),
+            name="Example"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_ssoadmin_permission_set_example.override_logical_id("example")
+        aws_ssoadmin_managed_policy_attachment_example =
+        SsoadminManagedPolicyAttachment(self, "example_2",
+            instance_arn=Token.as_string(
+                Fn.lookup_nested(Fn.tolist(example.arns), ["0"])),
+            managed_policy_arn="arn:aws:iam::aws:policy/AlexaForBusinessDeviceSetup",
+            permission_set_arn=Token.as_string(aws_ssoadmin_permission_set_example.arn)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_ssoadmin_managed_policy_attachment_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `instance_arn` - (Required, Forces new resource) The Amazon Resource Name (ARN) of the SSO Instance under which the operation will be executed.
+* `managed_policy_arn` - (Required, Forces new resource) The IAM managed policy Amazon Resource Name (ARN) to be attached to the Permission Set.
+* `permission_set_arn` - (Required, Forces new resource) The Amazon Resource Name (ARN) of the Permission Set.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Amazon Resource Names (ARNs) of the Managed Policy, Permission Set, and SSO Instance, separated by a comma (`,`).
+* `managed_policy_name` - The name of the IAM Managed Policy.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `10m`)
+- `delete` - (Default `10m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SSO Managed Policy Attachments using the `managed_policy_arn`, `permission_set_arn`, and `instance_arn` separated by a comma (`,`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import SSO Managed Policy Attachments using the `managed_policy_arn`, `permission_set_arn`, and `instance_arn` separated by a comma (`,`). For example:
+
+```console
+% terraform import aws_ssoadmin_managed_policy_attachment.example arn:aws:iam::aws:policy/AlexaForBusinessDeviceSetup,arn:aws:sso:::permissionSet/ssoins-2938j0x8920sbj72/ps-80383020jr9302rk,arn:aws:sso:::instance/ssoins-2938j0x8920sbj72
+```
+
+<!-- cache-key: cdktf-0.18.0 input-804f184ebfee68df4dc2222676baddc797e81d49b0ca41f4f287c92a6ac426ca -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ssoadmin_permission_set.html.markdown b/website/docs/cdktf/python/r/ssoadmin_permission_set.html.markdown
new file mode 100644
index 00000000000..63dfc549dd4
--- /dev/null
+++ b/website/docs/cdktf/python/r/ssoadmin_permission_set.html.markdown
@@ -0,0 +1,90 @@
+---
+subcategory: "SSO Admin"
+layout: "aws"
+page_title: "AWS: aws_ssoadmin_permission_set"
+description: |-
+  Manages a Single Sign-On (SSO) Permission Set
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ssoadmin_permission_set
+
+Provides a Single Sign-On (SSO) Permission Set resource
+
+~> **NOTE:** Updating this resource will automatically [Provision the Permission Set](https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_ProvisionPermissionSet.html) to apply the corresponding updates to all assigned accounts.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_ssoadmin_instances import DataAwsSsoadminInstances
+from imports.aws.ssoadmin_permission_set import SsoadminPermissionSet
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = DataAwsSsoadminInstances(self, "example")
+        aws_ssoadmin_permission_set_example = SsoadminPermissionSet(self, "example_1",
+            description="An example",
+            instance_arn=Token.as_string(
+                Fn.lookup_nested(Fn.tolist(example.arns), ["0"])),
+            name="Example",
+            relay_state="https://s3.console.aws.amazon.com/s3/home?region=us-east-1#",
+            session_duration="PT2H"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_ssoadmin_permission_set_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `description` - (Optional) The description of the Permission Set.
+* `instance_arn` - (Required, Forces new resource) The Amazon Resource Name (ARN) of the SSO Instance under which the operation will be executed.
+* `name` - (Required, Forces new resource) The name of the Permission Set.
+* `relay_state` - (Optional) The relay state URL used to redirect users within the application during the federation authentication process.
+* `session_duration` - (Optional) The length of time that the application user sessions are valid in the ISO-8601 standard. Default: `PT1H`.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the Permission Set.
+* `id` - The Amazon Resource Names (ARNs) of the Permission Set and SSO Instance, separated by a comma (`,`).
+* `created_date` - The date the Permission Set was created in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8).
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `update` - (Default `10m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SSO Permission Sets using the `arn` and `instance_arn` separated by a comma (`,`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import SSO Permission Sets using the `arn` and `instance_arn` separated by a comma (`,`). For example:
+
+```console
+% terraform import aws_ssoadmin_permission_set.example arn:aws:sso:::permissionSet/ssoins-2938j0x8920sbj72/ps-80383020jr9302rk,arn:aws:sso:::instance/ssoins-2938j0x8920sbj72
+```
+
+<!-- cache-key: cdktf-0.18.0 input-2c1f2076ed612356260a73ee4a57bd14c4cf5a5dd7d59da0d248e8cda59c8f43 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ssoadmin_permission_set_inline_policy.html.markdown b/website/docs/cdktf/python/r/ssoadmin_permission_set_inline_policy.html.markdown
new file mode 100644
index 00000000000..9a13e9014e7
--- /dev/null
+++ b/website/docs/cdktf/python/r/ssoadmin_permission_set_inline_policy.html.markdown
@@ -0,0 +1,106 @@
+---
+subcategory: "SSO Admin"
+layout: "aws"
+page_title: "AWS: aws_ssoadmin_permission_set_inline_policy"
+description: |-
+  Manages an IAM inline policy for a Single Sign-On (SSO) Permission Set
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ssoadmin_permission_set_inline_policy
+
+Provides an IAM inline policy for a Single Sign-On (SSO) Permission Set resource
+
+~> **NOTE:** AWS Single Sign-On (SSO) only supports one IAM inline policy per [`aws_ssoadmin_permission_set`](ssoadmin_permission_set.html) resource.
+Creating or updating this resource will automatically [Provision the Permission Set](https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_ProvisionPermissionSet.html) to apply the corresponding updates to all assigned accounts.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.data_aws_ssoadmin_instances import DataAwsSsoadminInstances
+from imports.aws.ssoadmin_permission_set import SsoadminPermissionSet
+from imports.aws.ssoadmin_permission_set_inline_policy import SsoadminPermissionSetInlinePolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = DataAwsIamPolicyDocument(self, "example",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["s3:ListAllMyBuckets", "s3:GetBucketLocation"],
+                resources=["arn:aws:s3:::*"],
+                sid="1"
+            )
+            ]
+        )
+        data_aws_ssoadmin_instances_example = DataAwsSsoadminInstances(self, "example_1")
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_ssoadmin_instances_example.override_logical_id("example")
+        aws_ssoadmin_permission_set_example = SsoadminPermissionSet(self, "example_2",
+            instance_arn=Token.as_string(
+                Fn.lookup_nested(Fn.tolist(data_aws_ssoadmin_instances_example.arns), ["0"
+                ])),
+            name="Example"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_ssoadmin_permission_set_example.override_logical_id("example")
+        aws_ssoadmin_permission_set_inline_policy_example =
+        SsoadminPermissionSetInlinePolicy(self, "example_3",
+            inline_policy=Token.as_string(example.json),
+            instance_arn=Token.as_string(
+                Fn.lookup_nested(Fn.tolist(data_aws_ssoadmin_instances_example.arns), ["0"
+                ])),
+            permission_set_arn=Token.as_string(aws_ssoadmin_permission_set_example.arn)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_ssoadmin_permission_set_inline_policy_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `inline_policy` - (Required) The IAM inline policy to attach to a Permission Set.
+* `instance_arn` - (Required, Forces new resource) The Amazon Resource Name (ARN) of the SSO Instance under which the operation will be executed.
+* `permission_set_arn` - (Required, Forces new resource) The Amazon Resource Name (ARN) of the Permission Set.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Amazon Resource Names (ARNs) of the Permission Set and SSO Instance, separated by a comma (`,`).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `10m`)
+- `delete` - (Default `10m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SSO Permission Set Inline Policies using the `permission_set_arn` and `instance_arn` separated by a comma (`,`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import SSO Permission Set Inline Policies using the `permission_set_arn` and `instance_arn` separated by a comma (`,`). For example:
+
+```console
+% terraform import aws_ssoadmin_permission_set_inline_policy.example arn:aws:sso:::permissionSet/ssoins-2938j0x8920sbj72/ps-80383020jr9302rk,arn:aws:sso:::instance/ssoins-2938j0x8920sbj72
+```
+
+<!-- cache-key: cdktf-0.18.0 input-f84fb52afb87edc6b7246f6e44d458f33af2b054e17ae0d967f945cade307d27 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/ssoadmin_permissions_boundary_attachment.html.markdown b/website/docs/cdktf/python/r/ssoadmin_permissions_boundary_attachment.html.markdown
new file mode 100644
index 00000000000..056912fd125
--- /dev/null
+++ b/website/docs/cdktf/python/r/ssoadmin_permissions_boundary_attachment.html.markdown
@@ -0,0 +1,153 @@
+---
+subcategory: "SSO Admin"
+layout: "aws"
+page_title: "AWS: aws_ssoadmin_permissions_boundary_attachment"
+description: |-
+  Attaches a permissions boundary policy to a Single Sign-On (SSO) Permission Set resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ssoadmin_permissions_boundary_attachment
+
+Attaches a permissions boundary policy to a Single Sign-On (SSO) Permission Set resource.
+
+~> **NOTE:** A permission set can have at most one permissions boundary attached; using more than one `aws_ssoadmin_permissions_boundary_attachment` references the same permission set will show a permanent difference.
+
+## Example Usage
+
+### Attaching a customer-managed policy
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_ssoadmin_instances import DataAwsSsoadminInstances
+from imports.aws.iam_policy import IamPolicy
+from imports.aws.ssoadmin_permission_set import SsoadminPermissionSet
+from imports.aws.ssoadmin_permissions_boundary_attachment import SsoadminPermissionsBoundaryAttachment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = IamPolicy(self, "example",
+            description="My test policy",
+            name="TestPolicy",
+            policy=Token.as_string(
+                Fn.jsonencode({
+                    "Statement": [{
+                        "Action": ["ec2:Describe*"],
+                        "Effect": "Allow",
+                        "Resource": "*"
+                    }
+                    ],
+                    "Version": "2012-10-17"
+                }))
+        )
+        data_aws_ssoadmin_instances_example = DataAwsSsoadminInstances(self, "example_1")
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_ssoadmin_instances_example.override_logical_id("example")
+        aws_ssoadmin_permission_set_example = SsoadminPermissionSet(self, "example_2",
+            instance_arn=Token.as_string(
+                Fn.lookup_nested(Fn.tolist(data_aws_ssoadmin_instances_example.arns), ["0"
+                ])),
+            name="Example"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_ssoadmin_permission_set_example.override_logical_id("example")
+        aws_ssoadmin_permissions_boundary_attachment_example =
+        SsoadminPermissionsBoundaryAttachment(self, "example_3",
+            instance_arn=Token.as_string(aws_ssoadmin_permission_set_example.instance_arn),
+            permission_set_arn=Token.as_string(aws_ssoadmin_permission_set_example.arn),
+            permissions_boundary=SsoadminPermissionsBoundaryAttachmentPermissionsBoundary(
+                customer_managed_policy_reference=SsoadminPermissionsBoundaryAttachmentPermissionsBoundaryCustomerManagedPolicyReference(
+                    name=example.name,
+                    path="/"
+                )
+            )
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_ssoadmin_permissions_boundary_attachment_example.override_logical_id("example")
+```
+
+### Attaching an AWS-managed policy
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ssoadmin_permissions_boundary_attachment import SsoadminPermissionsBoundaryAttachment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SsoadminPermissionsBoundaryAttachment(self, "example",
+            instance_arn=Token.as_string(aws_ssoadmin_permission_set_example.instance_arn),
+            permission_set_arn=Token.as_string(aws_ssoadmin_permission_set_example.arn),
+            permissions_boundary=SsoadminPermissionsBoundaryAttachmentPermissionsBoundary(
+                managed_policy_arn="arn:aws:iam::aws:policy/ReadOnlyAccess"
+            )
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `instance_arn` - (Required, Forces new resource) The Amazon Resource Name (ARN) of the SSO Instance under which the operation will be executed.
+* `permission_set_arn` - (Required, Forces new resource) The Amazon Resource Name (ARN) of the Permission Set.
+* `permissions_boundary` - (Required, Forces new resource) The permissions boundary policy. See below.
+
+### Permissions Boundary
+
+The `permissions_boundary` config block describes the permissions boundary policy to attach. You can reference either an AWS-managed policy, or a customer managed policy, but only one may be set.
+
+* `managed_policy_arn` - (Optional) AWS-managed IAM policy ARN to use as the permissions boundary.
+* `customer_managed_policy_reference` - (Optional) Specifies the name and path of a customer managed policy. See below.
+
+### Customer Managed Policy Reference
+
+The `customer_managed_policy_reference` config block describes a customer managed IAM policy. You must have an IAM policy that matches the name and path in each AWS account where you want to deploy your specified permission set.
+
+* `name` - (Required, Forces new resource) Name of the customer managed IAM Policy to be attached.
+* `path` - (Optional, Forces new resource) The path to the IAM policy to be attached. The default is `/`. See [IAM Identifiers](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html#identifiers-friendly-names) for more information.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Permission Set Amazon Resource Name (ARN) and SSO Instance ARN, separated by a comma (`,`).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `10m`)
+- `delete` - (Default `10m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SSO Admin Permissions Boundary Attachments using the `permission_set_arn` and `instance_arn`, separated by a comma (`,`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import SSO Admin Permissions Boundary Attachments using the `permission_set_arn` and `instance_arn`, separated by a comma (`,`). For example:
+
+```console
+% terraform import aws_ssoadmin_permissions_boundary_attachment.example arn:aws:sso:::permissionSet/ssoins-2938j0x8920sbj72/ps-80383020jr9302rk,arn:aws:sso:::instance/ssoins-2938j0x8920sbj72
+```
+
+<!-- cache-key: cdktf-0.18.0 input-b18b40e74ac6a4c483e12a6c4261d755ba4289cd16e5a156898b6ed4b6af7691 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/storagegateway_cache.html.markdown b/website/docs/cdktf/python/r/storagegateway_cache.html.markdown
new file mode 100644
index 00000000000..245413b5777
--- /dev/null
+++ b/website/docs/cdktf/python/r/storagegateway_cache.html.markdown
@@ -0,0 +1,69 @@
+---
+subcategory: "Storage Gateway"
+layout: "aws"
+page_title: "AWS: aws_storagegateway_cache"
+description: |-
+  Manages an AWS Storage Gateway cache
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_storagegateway_cache
+
+Manages an AWS Storage Gateway cache.
+
+~> **NOTE:** The Storage Gateway API provides no method to remove a cache disk. Destroying this Terraform resource does not perform any Storage Gateway actions.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.storagegateway_cache import StoragegatewayCache
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        StoragegatewayCache(self, "example",
+            disk_id=Token.as_string(data_aws_storagegateway_local_disk_example.id),
+            gateway_arn=Token.as_string(aws_storagegateway_gateway_example.arn)
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `disk_id` - (Required) Local disk identifier. For example, `pci-0000:03:00.0-scsi-0:0:0:0`.
+* `gateway_arn` - (Required) The Amazon Resource Name (ARN) of the gateway.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Combined gateway Amazon Resource Name (ARN) and local disk identifier.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_storagegateway_cache` using the gateway Amazon Resource Name (ARN) and local disk identifier separated with a colon (`:`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_storagegateway_cache` using the gateway Amazon Resource Name (ARN) and local disk identifier separated with a colon (`:`). For example:
+
+```console
+% terraform import aws_storagegateway_cache.example arn:aws:storagegateway:us-east-1:123456789012:gateway/sgw-12345678:pci-0000:03:00.0-scsi-0:0:0:0
+```
+
+<!-- cache-key: cdktf-0.18.0 input-71c425b426e8be6b2795e6720d1217aa0af1c682498abb9c938909327c75ac67 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/storagegateway_cached_iscsi_volume.html.markdown b/website/docs/cdktf/python/r/storagegateway_cached_iscsi_volume.html.markdown
new file mode 100644
index 00000000000..c8c09d620ee
--- /dev/null
+++ b/website/docs/cdktf/python/r/storagegateway_cached_iscsi_volume.html.markdown
@@ -0,0 +1,140 @@
+---
+subcategory: "Storage Gateway"
+layout: "aws"
+page_title: "AWS: aws_storagegateway_cached_iscsi_volume"
+description: |-
+  Manages an AWS Storage Gateway cached iSCSI volume
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_storagegateway_cached_iscsi_volume
+
+Manages an AWS Storage Gateway cached iSCSI volume.
+
+~> **NOTE:** The gateway must have cache added (e.g., via the [`aws_storagegateway_cache`](/docs/providers/aws/r/storagegateway_cache.html) resource) before creating volumes otherwise the Storage Gateway API will return an error.
+
+~> **NOTE:** The gateway must have an upload buffer added (e.g., via the [`aws_storagegateway_upload_buffer`](/docs/providers/aws/r/storagegateway_upload_buffer.html) resource) before the volume is operational to clients, however the Storage Gateway API will allow volume creation without error in that case and return volume status as `UPLOAD BUFFER NOT CONFIGURED`.
+
+## Example Usage
+
+~> **NOTE:** These examples are referencing the [`aws_storagegateway_cache`](/docs/providers/aws/r/storagegateway_cache.html) resource `gateway_arn` attribute to ensure Terraform properly adds cache before creating the volume. If you are not using this method, you may need to declare an expicit dependency (e.g., via `depends_on = [aws_storagegateway_cache.example]`) to ensure proper ordering.
+
+### Create Empty Cached iSCSI Volume
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.storagegateway_cached_iscsi_volume import StoragegatewayCachedIscsiVolume
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        StoragegatewayCachedIscsiVolume(self, "example",
+            gateway_arn=Token.as_string(aws_storagegateway_cache_example.gateway_arn),
+            network_interface_id=Token.as_string(aws_instance_example.private_ip),
+            target_name="example",
+            volume_size_in_bytes=5368709120
+        )
+```
+
+### Create Cached iSCSI Volume From Snapshot
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, Op, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.storagegateway_cached_iscsi_volume import StoragegatewayCachedIscsiVolume
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        StoragegatewayCachedIscsiVolume(self, "example",
+            gateway_arn=Token.as_string(aws_storagegateway_cache_example.gateway_arn),
+            network_interface_id=Token.as_string(aws_instance_example.private_ip),
+            snapshot_id=Token.as_string(aws_ebs_snapshot_example.id),
+            target_name="example",
+            volume_size_in_bytes=Token.as_number(
+                Op.mul(
+                    Op.mul(Op.mul(aws_ebs_snapshot_example.volume_size, 1024), 1024), 1024))
+        )
+```
+
+### Create Cached iSCSI Volume From Source Volume
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.storagegateway_cached_iscsi_volume import StoragegatewayCachedIscsiVolume
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        StoragegatewayCachedIscsiVolume(self, "example",
+            gateway_arn=Token.as_string(aws_storagegateway_cache_example.gateway_arn),
+            network_interface_id=Token.as_string(aws_instance_example.private_ip),
+            source_volume_arn=existing.arn,
+            target_name="example",
+            volume_size_in_bytes=existing.volume_size_in_bytes
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `gateway_arn` - (Required) The Amazon Resource Name (ARN) of the gateway.
+* `network_interface_id` - (Required) The network interface of the gateway on which to expose the iSCSI target. Only IPv4 addresses are accepted.
+* `target_name` - (Required) The name of the iSCSI target used by initiators to connect to the target and as a suffix for the target ARN. The target name must be unique across all volumes of a gateway.
+* `volume_size_in_bytes` - (Required) The size of the volume in bytes.
+* `snapshot_id` - (Optional) The snapshot ID of the snapshot to restore as the new cached volumeE.g., `snap-1122aabb`.
+* `source_volume_arn` - (Optional) The ARN for an existing volume. Specifying this ARN makes the new volume into an exact copy of the specified existing volume's latest recovery point. The `volume_size_in_bytes` value for this new volume must be equal to or larger than the size of the existing volume, in bytes.
+* `kms_encrypted` - (Optional) Set to `true` to use Amazon S3 server side encryption with your own AWS KMS key, or `false` to use a key managed by Amazon S3.
+* `kms_key` - (Optional) The Amazon Resource Name (ARN) of the AWS KMS key used for Amazon S3 server side encryption. Is required when `kms_encrypted` is set.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Volume Amazon Resource Name (ARN), e.g., `arn:aws:storagegateway:us-east-1:123456789012:gateway/sgw-12345678/volume/vol-12345678`.
+* `chap_enabled` - Whether mutual CHAP is enabled for the iSCSI target.
+* `id` - Volume Amazon Resource Name (ARN), e.g., `arn:aws:storagegateway:us-east-1:123456789012:gateway/sgw-12345678/volume/vol-12345678`.
+* `lun_number` - Logical disk number.
+* `network_interface_port` - The port used to communicate with iSCSI targets.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `target_arn` - Target Amazon Resource Name (ARN), e.g., `arn:aws:storagegateway:us-east-1:123456789012:gateway/sgw-12345678/target/iqn.1997-05.com.amazon:TargetName`.
+* `volume_arn` - Volume Amazon Resource Name (ARN), e.g., `arn:aws:storagegateway:us-east-1:123456789012:gateway/sgw-12345678/volume/vol-12345678`.
+* `volume_id` - Volume ID, e.g., `vol-12345678`.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_storagegateway_cached_iscsi_volume` using the volume Amazon Resource Name (ARN). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_storagegateway_cached_iscsi_volume` using the volume Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_storagegateway_cached_iscsi_volume.example arn:aws:storagegateway:us-east-1:123456789012:gateway/sgw-12345678/volume/vol-12345678
+```
+
+<!-- cache-key: cdktf-0.18.0 input-fbd53663d449fd1b382a8d59bc64c857ce61a3216c6189065bd24cb002807e26 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/storagegateway_file_system_association.html.markdown b/website/docs/cdktf/python/r/storagegateway_file_system_association.html.markdown
new file mode 100644
index 00000000000..a8fbe1d8501
--- /dev/null
+++ b/website/docs/cdktf/python/r/storagegateway_file_system_association.html.markdown
@@ -0,0 +1,149 @@
+---
+subcategory: "Storage Gateway"
+layout: "aws"
+page_title: "AWS: aws_storagegateway_file_system_association"
+description: |-
+  Mananges an association between an Amazon FSx file system and an Amazon FSx File Gateway.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_storagegateway_file_system_association
+
+Associate an Amazon FSx file system with the FSx File Gateway. After the association process is complete, the file shares on the Amazon FSx file system are available for access through the gateway. This operation only supports the FSx File Gateway type.
+
+[FSx File Gateway requirements](https://docs.aws.amazon.com/filegateway/latest/filefsxw/Requirements.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.storagegateway_file_system_association import StoragegatewayFileSystemAssociation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        StoragegatewayFileSystemAssociation(self, "example",
+            audit_destination_arn=Token.as_string(aws_s3_bucket_example.arn),
+            gateway_arn=Token.as_string(aws_storagegateway_gateway_example.arn),
+            location_arn=Token.as_string(aws_fsx_windows_file_system_example.arn),
+            password="avoid-plaintext-passwords",
+            username="Admin"
+        )
+```
+
+## Required Services Example
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, Fn, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_ssm_parameter import DataAwsSsmParameter
+from imports.aws.fsx_windows_file_system import FsxWindowsFileSystem
+from imports.aws.instance import Instance
+from imports.aws.storagegateway_file_system_association import StoragegatewayFileSystemAssociation
+from imports.aws.storagegateway_gateway import StoragegatewayGateway
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        test = FsxWindowsFileSystem(self, "test",
+            active_directory_id=Token.as_string(aws_directory_service_directory_test.id),
+            security_group_ids=[Token.as_string(aws_security_group_test.id)],
+            skip_final_backup=True,
+            storage_capacity=32,
+            subnet_ids=[Token.as_string(Fn.lookup_nested(aws_subnet_test, ["0", "id"]))],
+            throughput_capacity=8
+        )
+        aws_service_storagegateway_ami_file_s3_latest = DataAwsSsmParameter(self, "aws_service_storagegateway_ami_FILE_S3_latest",
+            name="/aws/service/storagegateway/ami/FILE_S3/latest"
+        )
+        aws_instance_test = Instance(self, "test_2",
+            ami=Token.as_string(aws_service_storagegateway_ami_file_s3_latest.value),
+            associate_public_ip_address=True,
+            depends_on=[aws_route_test, aws_vpc_dhcp_options_association_test],
+            instance_type=Token.as_string(available.instance_type),
+            subnet_id=Token.as_string(Fn.lookup_nested(aws_subnet_test, ["0", "id"])),
+            vpc_security_group_ids=[Token.as_string(aws_security_group_test.id)]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_instance_test.override_logical_id("test")
+        aws_storagegateway_gateway_test = StoragegatewayGateway(self, "test_3",
+            gateway_ip_address=Token.as_string(aws_instance_test.public_ip),
+            gateway_name="test-sgw",
+            gateway_timezone="GMT",
+            gateway_type="FILE_FSX_SMB",
+            smb_active_directory_settings=StoragegatewayGatewaySmbActiveDirectorySettings(
+                domain_name=Token.as_string(aws_directory_service_directory_test.name),
+                password=Token.as_string(aws_directory_service_directory_test.password),
+                username="Admin"
+            )
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_storagegateway_gateway_test.override_logical_id("test")
+        StoragegatewayFileSystemAssociation(self, "fsx",
+            audit_destination_arn=Token.as_string(aws_cloudwatch_log_group_test.arn),
+            cache_attributes=StoragegatewayFileSystemAssociationCacheAttributes(
+                cache_stale_timeout_in_seconds=400
+            ),
+            gateway_arn=Token.as_string(aws_storagegateway_gateway_test.arn),
+            location_arn=test.arn,
+            password=Token.as_string(aws_directory_service_directory_test.password),
+            username="Admin"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `gateway_arn` - (Required) The Amazon Resource Name (ARN) of the gateway.
+* `location_arn` - (Required) The Amazon Resource Name (ARN) of the Amazon FSx file system to associate with the FSx File Gateway.
+* `username` - (Required) The user name of the user credential that has permission to access the root share of the Amazon FSx file system. The user account must belong to the Amazon FSx delegated admin user group.
+* `password` - (Required, sensitive) The password of the user credential.
+* `audit_destination_arn` - (Optional) The Amazon Resource Name (ARN) of the storage used for the audit logs.
+* `cache_attributes` - (Optional) Refresh cache information. see [Cache Attributes](#cache_attributes) for more details.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### cache_attributes
+
+* `cache_stale_timeout_in_seconds` - (Optional) Refreshes a file share's cache by using Time To Live (TTL).
+ TTL is the length of time since the last refresh after which access to the directory would cause the file gateway
+  to first refresh that directory's contents from the Amazon S3 bucket. Valid Values: `0` or `300` to `2592000` seconds (5 minutes to 30 days). Defaults to `0`
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Amazon Resource Name (ARN) of the FSx file system association
+* `arn` - Amazon Resource Name (ARN) of the newly created file system association.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_storagegateway_file_system_association` using the FSx file system association Amazon Resource Name (ARN). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_storagegateway_file_system_association` using the FSx file system association Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_storagegateway_file_system_association.example arn:aws:storagegateway:us-east-1:123456789012:fs-association/fsa-0DA347732FDB40125
+```
+
+<!-- cache-key: cdktf-0.18.0 input-25ffcf0143f211628c624df50a48a4f56f62a6e23545b746731989404c66e06e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/storagegateway_gateway.html.markdown b/website/docs/cdktf/python/r/storagegateway_gateway.html.markdown
new file mode 100644
index 00000000000..5d01f099e31
--- /dev/null
+++ b/website/docs/cdktf/python/r/storagegateway_gateway.html.markdown
@@ -0,0 +1,287 @@
+---
+subcategory: "Storage Gateway"
+layout: "aws"
+page_title: "AWS: aws_storagegateway_gateway"
+description: |-
+  Manages an AWS Storage Gateway file, tape, or volume gateway in the provider region
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_storagegateway_gateway
+
+Manages an AWS Storage Gateway file, tape, or volume gateway in the provider region.
+
+~> **NOTE:** The Storage Gateway API requires the gateway to be connected to properly return information after activation. If you are receiving `The specified gateway is not connected` errors during resource creation (gateway activation), ensure your gateway instance meets the [Storage Gateway requirements](https://docs.aws.amazon.com/storagegateway/latest/userguide/Requirements.html).
+
+## Example Usage
+
+### Local Cache
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_storagegateway_local_disk import DataAwsStoragegatewayLocalDisk
+from imports.aws.storagegateway_cache import StoragegatewayCache
+from imports.aws.volume_attachment import VolumeAttachment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        VolumeAttachment(self, "test",
+            device_name="/dev/xvdb",
+            instance_id=Token.as_string(aws_instance_test.id),
+            volume_id=Token.as_string(aws_ebs_volume_test.id)
+        )
+        data_aws_storagegateway_local_disk_test =
+        DataAwsStoragegatewayLocalDisk(self, "test_1",
+            disk_node=Token.as_string(data_aws_volume_attachment_test.device_name),
+            gateway_arn=Token.as_string(aws_storagegateway_gateway_test.arn)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_storagegateway_local_disk_test.override_logical_id("test")
+        aws_storagegateway_cache_test = StoragegatewayCache(self, "test_2",
+            disk_id=Token.as_string(data_aws_storagegateway_local_disk_test.disk_id),
+            gateway_arn=Token.as_string(aws_storagegateway_gateway_test.arn)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_storagegateway_cache_test.override_logical_id("test")
+```
+
+### FSx File Gateway
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.storagegateway_gateway import StoragegatewayGateway
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        StoragegatewayGateway(self, "example",
+            gateway_ip_address="1.2.3.4",
+            gateway_name="example",
+            gateway_timezone="GMT",
+            gateway_type="FILE_FSX_SMB",
+            smb_active_directory_settings=StoragegatewayGatewaySmbActiveDirectorySettings(
+                domain_name="corp.example.com",
+                password="avoid-plaintext-passwords",
+                username="Admin"
+            )
+        )
+```
+
+### S3 File Gateway
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.storagegateway_gateway import StoragegatewayGateway
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        StoragegatewayGateway(self, "example",
+            gateway_ip_address="1.2.3.4",
+            gateway_name="example",
+            gateway_timezone="GMT",
+            gateway_type="FILE_S3"
+        )
+```
+
+### Tape Gateway
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.storagegateway_gateway import StoragegatewayGateway
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        StoragegatewayGateway(self, "example",
+            gateway_ip_address="1.2.3.4",
+            gateway_name="example",
+            gateway_timezone="GMT",
+            gateway_type="VTL",
+            medium_changer_type="AWS-Gateway-VTL",
+            tape_drive_type="IBM-ULT3580-TD5"
+        )
+```
+
+### Volume Gateway (Cached)
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.storagegateway_gateway import StoragegatewayGateway
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        StoragegatewayGateway(self, "example",
+            gateway_ip_address="1.2.3.4",
+            gateway_name="example",
+            gateway_timezone="GMT",
+            gateway_type="CACHED"
+        )
+```
+
+### Volume Gateway (Stored)
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.storagegateway_gateway import StoragegatewayGateway
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        StoragegatewayGateway(self, "example",
+            gateway_ip_address="1.2.3.4",
+            gateway_name="example",
+            gateway_timezone="GMT",
+            gateway_type="STORED"
+        )
+```
+
+## Argument Reference
+
+~> **NOTE:** One of `activation_key` or `gateway_ip_address` must be provided for resource creation (gateway activation). Neither is required for resource import. If using `gateway_ip_address`, Terraform must be able to make an HTTP (port 80) GET request to the specified IP address from where it is running.
+
+This argument supports the following arguments:
+
+* `gateway_name` - (Required) Name of the gateway.
+* `gateway_timezone` - (Required) Time zone for the gateway. The time zone is of the format "GMT", "GMT-hr:mm", or "GMT+hr:mm". For example, `GMT-4:00` indicates the time is 4 hours behind GMT. The time zone is used, for example, for scheduling snapshots and your gateway's maintenance schedule.
+* `activation_key` - (Optional) Gateway activation key during resource creation. Conflicts with `gateway_ip_address`. Additional information is available in the [Storage Gateway User Guide](https://docs.aws.amazon.com/storagegateway/latest/userguide/get-activation-key.html).
+* `average_download_rate_limit_in_bits_per_sec` - (Optional) The average download bandwidth rate limit in bits per second. This is supported for the `CACHED`, `STORED`, and `VTL` gateway types.
+* `average_upload_rate_limit_in_bits_per_sec` - (Optional) The average upload bandwidth rate limit in bits per second. This is supported for the `CACHED`, `STORED`, and `VTL` gateway types.
+* `gateway_ip_address` - (Optional) Gateway IP address to retrieve activation key during resource creation. Conflicts with `activation_key`. Gateway must be accessible on port 80 from where Terraform is running. Additional information is available in the [Storage Gateway User Guide](https://docs.aws.amazon.com/storagegateway/latest/userguide/get-activation-key.html).
+* `gateway_type` - (Optional) Type of the gateway. The default value is `STORED`. Valid values: `CACHED`, `FILE_FSX_SMB`, `FILE_S3`, `STORED`, `VTL`.
+* `gateway_vpc_endpoint` - (Optional) VPC endpoint address to be used when activating your gateway. This should be used when your instance is in a private subnet. Requires HTTP access from client computer running terraform. More info on what ports are required by your VPC Endpoint Security group in [Activating a Gateway in a Virtual Private Cloud](https://docs.aws.amazon.com/storagegateway/latest/userguide/gateway-private-link.html).
+* `cloudwatch_log_group_arn` - (Optional) The Amazon Resource Name (ARN) of the Amazon CloudWatch log group to use to monitor and log events in the gateway.
+* `maintenance_start_time` - (Optional) The gateway's weekly maintenance start time information, including day and time of the week. The maintenance time is the time in your gateway's time zone. More details below.
+* `medium_changer_type` - (Optional) Type of medium changer to use for tape gateway. Terraform cannot detect drift of this argument. Valid values: `STK-L700`, `AWS-Gateway-VTL`, `IBM-03584L32-0402`.
+* `smb_active_directory_settings` - (Optional) Nested argument with Active Directory domain join information for Server Message Block (SMB) file shares. Only valid for `FILE_S3` and `FILE_FSX_SMB` gateway types. Must be set before creating `ActiveDirectory` authentication SMB file shares. More details below.
+* `smb_guest_password` - (Optional) Guest password for Server Message Block (SMB) file shares. Only valid for `FILE_S3` and `FILE_FSX_SMB` gateway types. Must be set before creating `GuestAccess` authentication SMB file shares. Terraform can only detect drift of the existence of a guest password, not its actual value from the gateway. Terraform can however update the password with changing the argument.
+* `smb_security_strategy` - (Optional) Specifies the type of security strategy. Valid values are: `ClientSpecified`, `MandatorySigning`, and `MandatoryEncryption`. See [Setting a Security Level for Your Gateway](https://docs.aws.amazon.com/storagegateway/latest/userguide/managing-gateway-file.html#security-strategy) for more information.
+* `smb_file_share_visibility` - (Optional) Specifies whether the shares on this gateway appear when listing shares.
+* `tape_drive_type` - (Optional) Type of tape drive to use for tape gateway. Terraform cannot detect drift of this argument. Valid values: `IBM-ULT3580-TD5`.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### maintenance_start_time
+
+* `day_of_month` - (Optional) The day of the month component of the maintenance start time represented as an ordinal number from 1 to 28, where 1 represents the first day of the month and 28 represents the last day of the month.
+* `day_of_week` - (Optional) The day of the week component of the maintenance start time week represented as an ordinal number from 0 to 6, where 0 represents Sunday and 6 Saturday.
+* `hour_of_day` - (Required) The hour component of the maintenance start time represented as _hh_, where _hh_ is the hour (00 to 23). The hour of the day is in the time zone of the gateway.
+* `minute_of_hour` - (Required) The minute component of the maintenance start time represented as _mm_, where _mm_ is the minute (00 to 59). The minute of the hour is in the time zone of the gateway.
+
+### smb_active_directory_settings
+
+Information to join the gateway to an Active Directory domain for Server Message Block (SMB) file shares.
+
+~> **NOTE** It is not possible to unconfigure this setting without recreating the gateway. Also, Terraform can only detect drift of the `domain_name` argument from the gateway.
+
+~> **NOTE:** The Storage Gateway needs to be able to resolve the name of your Active Directory Domain Controller. If the gateway is hosted on EC2, ensure that DNS/DHCP is configured prior to creating the EC2 instance. If you are receiving `NETWORK_ERROR` errors during resource creation (gateway joining the domain), ensure your gateway instance meets the [FSx File Gateway requirements](https://docs.aws.amazon.com/filegateway/latest/filefsxw/Requirements.html).
+
+* `domain_name` - (Required) The name of the domain that you want the gateway to join.
+* `password` - (Required) The password of the user who has permission to add the gateway to the Active Directory domain.
+* `username` - (Required) The user name of user who has permission to add the gateway to the Active Directory domain.
+* `timeout_in_seconds` - (Optional) Specifies the time in seconds, in which the JoinDomain operation must complete. The default is `20` seconds.
+* `organizational_unit` - (Optional) The organizational unit (OU) is a container in an Active Directory that can hold users, groups,
+ computers, and other OUs and this parameter specifies the OU that the gateway will join within the AD domain.
+* `domain_controllers` - (Optional) List of IPv4 addresses, NetBIOS names, or host names of your domain server.
+ If you need to specify the port number include it after the colon (“:”). For example, `mydc.mydomain.com:389`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Amazon Resource Name (ARN) of the gateway.
+* `arn` - Amazon Resource Name (ARN) of the gateway.
+* `gateway_id` - Identifier of the gateway.
+* `ec2_instance_id` - The ID of the Amazon EC2 instance that was used to launch the gateway.
+* `endpoint_type` - The type of endpoint for your gateway.
+* `host_environment` - The type of hypervisor environment used by the host.
+* `gateway_network_interface` - An array that contains descriptions of the gateway network interfaces. See [Gateway Network Interface](#gateway-network-interface).
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+### Gateway Network Interface
+
+* `ipv4_address` - The Internet Protocol version 4 (IPv4) address of the interface.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `10m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_storagegateway_gateway` using the gateway Amazon Resource Name (ARN). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_storagegateway_gateway` using the gateway Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_storagegateway_gateway.example arn:aws:storagegateway:us-east-1:123456789012:gateway/sgw-12345678
+```
+
+Certain resource arguments, like `gateway_ip_address` do not have a Storage Gateway API method for reading the information after creation, either omit the argument from the Terraform configuration or use [`ignore_changes`](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html#ignore_changes) to hide the difference. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from cdktf import TerraformResourceLifecycle
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.storagegateway_gateway import StoragegatewayGateway
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, gatewayName, gatewayTimezone):
+        super().__init__(scope, name)
+        StoragegatewayGateway(self, "example",
+            gateway_ip_address=sgw.private_ip,
+            lifecycle=TerraformResourceLifecycle(
+                ignore_changes=["gateway_ip_address"]
+            ),
+            gateway_name=gateway_name,
+            gateway_timezone=gateway_timezone
+        )
+```
+
+<!-- cache-key: cdktf-0.18.0 input-187ed7975b77b44dfe286243ecbc501bccd2e04c4172f96f87a4eb47a54fcf77 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/storagegateway_nfs_file_share.html.markdown b/website/docs/cdktf/python/r/storagegateway_nfs_file_share.html.markdown
new file mode 100644
index 00000000000..00849486ead
--- /dev/null
+++ b/website/docs/cdktf/python/r/storagegateway_nfs_file_share.html.markdown
@@ -0,0 +1,114 @@
+---
+subcategory: "Storage Gateway"
+layout: "aws"
+page_title: "AWS: aws_storagegateway_nfs_file_share"
+description: |-
+  Manages an AWS Storage Gateway NFS File Share
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_storagegateway_nfs_file_share
+
+Manages an AWS Storage Gateway NFS File Share.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.storagegateway_nfs_file_share import StoragegatewayNfsFileShare
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        StoragegatewayNfsFileShare(self, "example",
+            client_list=["0.0.0.0/0"],
+            gateway_arn=Token.as_string(aws_storagegateway_gateway_example.arn),
+            location_arn=Token.as_string(aws_s3_bucket_example.arn),
+            role_arn=Token.as_string(aws_iam_role_example.arn)
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `client_list` - (Required) The list of clients that are allowed to access the file gateway. The list must contain either valid IP addresses or valid CIDR blocks. Set to `["0.0.0.0/0"]` to not limit access. Minimum 1 item. Maximum 100 items.
+* `gateway_arn` - (Required) Amazon Resource Name (ARN) of the file gateway.
+* `location_arn` - (Required) The ARN of the backed storage used for storing file data.
+* `vpc_endpoint_dns_name` - (Optional) The DNS name of the VPC endpoint for S3 PrivateLink.
+* `bucket_region` - (Optional) The region of the S3 bucket used by the file share. Required when specifying `vpc_endpoint_dns_name`.
+* `role_arn` - (Required) The ARN of the AWS Identity and Access Management (IAM) role that a file gateway assumes when it accesses the underlying storage.
+* `audit_destination_arn` - (Optional) The Amazon Resource Name (ARN) of the storage used for audit logs.
+* `default_storage_class` - (Optional) The default [storage class](https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_CreateNFSFileShare.html#StorageGateway-CreateNFSFileShare-request-DefaultStorageClass) for objects put into an Amazon S3 bucket by the file gateway. Defaults to `S3_STANDARD`.
+* `guess_mime_type_enabled` - (Optional) Boolean value that enables guessing of the MIME type for uploaded objects based on file extensions. Defaults to `true`.
+* `kms_encrypted` - (Optional) Boolean value if `true` to use Amazon S3 server side encryption with your own AWS KMS key, or `false` to use a key managed by Amazon S3. Defaults to `false`.
+* `kms_key_arn` - (Optional) Amazon Resource Name (ARN) for KMS key used for Amazon S3 server side encryption. This value can only be set when `kms_encrypted` is true.
+* `nfs_file_share_defaults` - (Optional) Nested argument with file share default values. More information below. see [NFS File Share Defaults](#nfs_file_share_defaults) for more details.
+* `cache_attributes` - (Optional) Refresh cache information. see [Cache Attributes](#cache_attributes) for more details.
+* `object_acl` - (Optional) Access Control List permission for S3 objects. Defaults to `private`.
+* `read_only` - (Optional) Boolean to indicate write status of file share. File share does not accept writes if `true`. Defaults to `false`.
+* `requester_pays` - (Optional) Boolean who pays the cost of the request and the data download from the Amazon S3 bucket. Set this value to `true` if you want the requester to pay instead of the bucket owner. Defaults to `false`.
+* `squash` - (Optional) Maps a user to anonymous user. Defaults to `RootSquash`. Valid values: `RootSquash` (only root is mapped to anonymous user), `NoSquash` (no one is mapped to anonymous user), `AllSquash` (everyone is mapped to anonymous user)
+* `file_share_name` - (Optional) The name of the file share. Must be set if an S3 prefix name is set in `location_arn`.
+* `notification_policy` - (Optional) The notification policy of the file share. For more information see the [AWS Documentation](https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_CreateNFSFileShare.html#StorageGateway-CreateNFSFileShare-request-NotificationPolicy). Default value is `{}`.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### nfs_file_share_defaults
+
+Files and folders stored as Amazon S3 objects in S3 buckets don't, by default, have Unix file permissions assigned to them. Upon discovery in an S3 bucket by Storage Gateway, the S3 objects that represent files and folders are assigned these default Unix permissions.
+
+* `directory_mode` - (Optional) The Unix directory mode in the string form "nnnn". Defaults to `"0777"`.
+* `file_mode` - (Optional) The Unix file mode in the string form "nnnn". Defaults to `"0666"`.
+* `group_id` - (Optional) The default group ID for the file share (unless the files have another group ID specified). Defaults to `65534` (`nfsnobody`). Valid values: `0` through `4294967294`.
+* `owner_id` - (Optional) The default owner ID for the file share (unless the files have another owner ID specified). Defaults to `65534` (`nfsnobody`). Valid values: `0` through `4294967294`.
+
+### cache_attributes
+
+* `cache_stale_timeout_in_seconds` - (Optional) Refreshes a file share's cache by using Time To Live (TTL).
+ TTL is the length of time since the last refresh after which access to the directory would cause the file gateway
+  to first refresh that directory's contents from the Amazon S3 bucket. Valid Values: 300 to 2,592,000 seconds (5 minutes to 30 days)
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Amazon Resource Name (ARN) of the NFS File Share.
+* `arn` - Amazon Resource Name (ARN) of the NFS File Share.
+* `fileshare_id` - ID of the NFS File Share.
+* `path` - File share path used by the NFS client to identify the mount point.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `10m`)
+* `update` - (Default `10m`)
+* `delete` - (Default `10m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_storagegateway_nfs_file_share` using the NFS File Share Amazon Resource Name (ARN). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_storagegateway_nfs_file_share` using the NFS File Share Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_storagegateway_nfs_file_share.example arn:aws:storagegateway:us-east-1:123456789012:share/share-12345678
+```
+
+<!-- cache-key: cdktf-0.18.0 input-37dcb9904d5b8589febdac999a43883747910390dad15f3d634a4d7806b3b88b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/storagegateway_smb_file_share.html.markdown b/website/docs/cdktf/python/r/storagegateway_smb_file_share.html.markdown
new file mode 100644
index 00000000000..c759541ca89
--- /dev/null
+++ b/website/docs/cdktf/python/r/storagegateway_smb_file_share.html.markdown
@@ -0,0 +1,138 @@
+---
+subcategory: "Storage Gateway"
+layout: "aws"
+page_title: "AWS: aws_storagegateway_smb_file_share"
+description: |-
+  Manages an AWS Storage Gateway SMB File Share
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_storagegateway_smb_file_share
+
+Manages an AWS Storage Gateway SMB File Share.
+
+## Example Usage
+
+### Active Directory Authentication
+
+~> **NOTE:** The gateway must have already joined the Active Directory domain prior to SMB file share creationE.g., via "SMB Settings" in the AWS Storage Gateway console or `smb_active_directory_settings` in the [`aws_storagegateway_gateway` resource](/docs/providers/aws/r/storagegateway_gateway.html).
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.storagegateway_smb_file_share import StoragegatewaySmbFileShare
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        StoragegatewaySmbFileShare(self, "example",
+            authentication="ActiveDirectory",
+            gateway_arn=Token.as_string(aws_storagegateway_gateway_example.arn),
+            location_arn=Token.as_string(aws_s3_bucket_example.arn),
+            role_arn=Token.as_string(aws_iam_role_example.arn)
+        )
+```
+
+### Guest Authentication
+
+~> **NOTE:** The gateway must have already had the SMB guest password set prior to SMB file share creationE.g., via "SMB Settings" in the AWS Storage Gateway console or `smb_guest_password` in the [`aws_storagegateway_gateway` resource](/docs/providers/aws/r/storagegateway_gateway.html).
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.storagegateway_smb_file_share import StoragegatewaySmbFileShare
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        StoragegatewaySmbFileShare(self, "example",
+            authentication="GuestAccess",
+            gateway_arn=Token.as_string(aws_storagegateway_gateway_example.arn),
+            location_arn=Token.as_string(aws_s3_bucket_example.arn),
+            role_arn=Token.as_string(aws_iam_role_example.arn)
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `gateway_arn` - (Required) Amazon Resource Name (ARN) of the file gateway.
+* `location_arn` - (Required) The ARN of the backed storage used for storing file data.
+* `vpc_endpoint_dns_name` - (Optional) The DNS name of the VPC endpoint for S3 private link.
+* `bucket_region` - (Optional) The region of the S3 buck used by the file share. Required when specifying a `vpc_endpoint_dns_name`.
+* `role_arn` - (Required) The ARN of the AWS Identity and Access Management (IAM) role that a file gateway assumes when it accesses the underlying storage.
+* `admin_user_list` - (Optional) A list of users in the Active Directory that have admin access to the file share. Only valid if `authentication` is set to `ActiveDirectory`.
+* `authentication` - (Optional) The authentication method that users use to access the file share. Defaults to `ActiveDirectory`. Valid values: `ActiveDirectory`, `GuestAccess`.
+* `audit_destination_arn` - (Optional) The Amazon Resource Name (ARN) of the CloudWatch Log Group used for the audit logs.
+* `default_storage_class` - (Optional) The default [storage class](https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_CreateNFSFileShare.html#StorageGateway-CreateNFSFileShare-request-DefaultStorageClass) for objects put into an Amazon S3 bucket by the file gateway. Defaults to `S3_STANDARD`.
+* `file_share_name` - (Optional) The name of the file share. Must be set if an S3 prefix name is set in `location_arn`.
+* `guess_mime_type_enabled` - (Optional) Boolean value that enables guessing of the MIME type for uploaded objects based on file extensions. Defaults to `true`.
+* `invalid_user_list` - (Optional) A list of users in the Active Directory that are not allowed to access the file share. Only valid if `authentication` is set to `ActiveDirectory`.
+* `kms_encrypted` - (Optional) Boolean value if `true` to use Amazon S3 server side encryption with your own AWS KMS key, or `false` to use a key managed by Amazon S3. Defaults to `false`.
+* `kms_key_arn` - (Optional) Amazon Resource Name (ARN) for KMS key used for Amazon S3 server side encryption. This value can only be set when `kms_encrypted` is true.
+* `object_acl` - (Optional) Access Control List permission for S3 objects. Defaults to `private`.
+* `oplocks_enabled` - (Optional) Boolean to indicate Opportunistic lock (oplock) status. Defaults to `true`.
+* `cache_attributes` - (Optional) Refresh cache information. see [Cache Attributes](#cache_attributes) for more details.
+* `read_only` - (Optional) Boolean to indicate write status of file share. File share does not accept writes if `true`. Defaults to `false`.
+* `requester_pays` - (Optional) Boolean who pays the cost of the request and the data download from the Amazon S3 bucket. Set this value to `true` if you want the requester to pay instead of the bucket owner. Defaults to `false`.
+* `smb_acl_enabled` - (Optional) Set this value to `true` to enable ACL (access control list) on the SMB fileshare. Set it to `false` to map file and directory permissions to the POSIX permissions. This setting applies only to `ActiveDirectory` authentication type.
+* `case_sensitivity` - (Optional) The case of an object name in an Amazon S3 bucket. For `ClientSpecified`, the client determines the case sensitivity. For `CaseSensitive`, the gateway determines the case sensitivity. The default value is `ClientSpecified`.
+* `valid_user_list` - (Optional) A list of users in the Active Directory that are allowed to access the file share. If you need to specify an Active directory group, add '@' before the name of the group. It will be set on Allowed group in AWS console. Only valid if `authentication` is set to `ActiveDirectory`.
+* `access_based_enumeration` - (Optional) The files and folders on this share will only be visible to users with read access. Default value is `false`.
+* `notification_policy` - (Optional) The notification policy of the file share. For more information see the [AWS Documentation](https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_CreateNFSFileShare.html#StorageGateway-CreateNFSFileShare-request-NotificationPolicy). Default value is `{}`.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### cache_attributes
+
+* `cache_stale_timeout_in_seconds` - (Optional) Refreshes a file share's cache by using Time To Live (TTL).
+ TTL is the length of time since the last refresh after which access to the directory would cause the file gateway
+  to first refresh that directory's contents from the Amazon S3 bucket. Valid Values: 300 to 2,592,000 seconds (5 minutes to 30 days)
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Amazon Resource Name (ARN) of the SMB File Share.
+* `arn` - Amazon Resource Name (ARN) of the SMB File Share.
+* `fileshare_id` - ID of the SMB File Share.
+* `path` - File share path used by the NFS client to identify the mount point.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `10m`)
+* `update` - (Default `10m`)
+* `delete` - (Default `15m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_storagegateway_smb_file_share` using the SMB File Share Amazon Resource Name (ARN). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_storagegateway_smb_file_share` using the SMB File Share Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_storagegateway_smb_file_share.example arn:aws:storagegateway:us-east-1:123456789012:share/share-12345678
+```
+
+<!-- cache-key: cdktf-0.18.0 input-f3a37c6e0c1b6271a67b3fb55500798b56d200124be7a8d27c9e48b68c4fc362 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/storagegateway_stored_iscsi_volume.html.markdown b/website/docs/cdktf/python/r/storagegateway_stored_iscsi_volume.html.markdown
new file mode 100644
index 00000000000..7c3ea6bd42c
--- /dev/null
+++ b/website/docs/cdktf/python/r/storagegateway_stored_iscsi_volume.html.markdown
@@ -0,0 +1,117 @@
+---
+subcategory: "Storage Gateway"
+layout: "aws"
+page_title: "AWS: aws_storagegateway_stored_iscsi_volume"
+description: |-
+  Manages an AWS Storage Gateway stored iSCSI volume
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_storagegateway_stored_iscsi_volume
+
+Manages an AWS Storage Gateway stored iSCSI volume.
+
+~> **NOTE:** The gateway must have a working storage added (e.g., via the [`aws_storagegateway_working_storage`](/docs/providers/aws/r/storagegateway_working_storage.html) resource) before the volume is operational to clients, however the Storage Gateway API will allow volume creation without error in that case and return volume status as `WORKING STORAGE NOT CONFIGURED`.
+
+## Example Usage
+
+### Create Empty Stored iSCSI Volume
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.storagegateway_stored_iscsi_volume import StoragegatewayStoredIscsiVolume
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        StoragegatewayStoredIscsiVolume(self, "example",
+            disk_id=Token.as_string(test.id),
+            gateway_arn=Token.as_string(aws_storagegateway_cache_example.gateway_arn),
+            network_interface_id=Token.as_string(aws_instance_example.private_ip),
+            preserve_existing_data=False,
+            target_name="example"
+        )
+```
+
+### Create Stored iSCSI Volume From Snapshot
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.storagegateway_stored_iscsi_volume import StoragegatewayStoredIscsiVolume
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        StoragegatewayStoredIscsiVolume(self, "example",
+            disk_id=Token.as_string(test.id),
+            gateway_arn=Token.as_string(aws_storagegateway_cache_example.gateway_arn),
+            network_interface_id=Token.as_string(aws_instance_example.private_ip),
+            preserve_existing_data=False,
+            snapshot_id=Token.as_string(aws_ebs_snapshot_example.id),
+            target_name="example"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `gateway_arn` - (Required) The Amazon Resource Name (ARN) of the gateway.
+* `network_interface_id` - (Required) The network interface of the gateway on which to expose the iSCSI target. Only IPv4 addresses are accepted.
+* `target_name` - (Required) The name of the iSCSI target used by initiators to connect to the target and as a suffix for the target ARN. The target name must be unique across all volumes of a gateway.
+* `disk_id` - (Required) The unique identifier for the gateway local disk that is configured as a stored volume.
+* `preserve_existing_data` - (Required) Specify this field as `true` if you want to preserve the data on the local disk. Otherwise, specifying this field as false creates an empty volume.
+* `snapshot_id` - (Optional) The snapshot ID of the snapshot to restore as the new stored volumeE.g., `snap-1122aabb`.
+* `kms_encrypted` - (Optional) `true` to use Amazon S3 server side encryption with your own AWS KMS key, or `false` to use a key managed by Amazon S3. Optional.
+* `kms_key` - (Optional) The Amazon Resource Name (ARN) of the AWS KMS key used for Amazon S3 server side encryption. This value can only be set when `kms_encrypted` is `true`.
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Volume Amazon Resource Name (ARN), e.g., `arn:aws:storagegateway:us-east-1:123456789012:gateway/sgw-12345678/volume/vol-12345678`.
+* `chap_enabled` - Whether mutual CHAP is enabled for the iSCSI target.
+* `id` - Volume Amazon Resource Name (ARN), e.g., `arn:aws:storagegateway:us-east-1:123456789012:gateway/sgw-12345678/volume/vol-12345678`.
+* `lun_number` - Logical disk number.
+* `network_interface_port` - The port used to communicate with iSCSI targets.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `target_arn` - Target Amazon Resource Name (ARN), e.g., `arn:aws:storagegateway:us-east-1:123456789012:gateway/sgw-12345678/target/iqn.1997-05.com.amazon:TargetName`.
+* `volume_arn` - Volume Amazon Resource Name (ARN), e.g., `arn:aws:storagegateway:us-east-1:123456789012:gateway/sgw-12345678/volume/vol-12345678`.
+* `volume_id` - Volume ID, e.g., `vol-12345678`.
+* `volume_status` - indicates the state of the storage volume.
+* `volume_type` - indicates the type of the volume.
+* `volume_size_in_bytes` - The size of the data stored on the volume in bytes.
+* `volume_attachment_status` - A value that indicates whether a storage volume is attached to, detached from, or is in the process of detaching from a gateway.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_storagegateway_stored_iscsi_volume` using the volume Amazon Resource Name (ARN). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_storagegateway_stored_iscsi_volume` using the volume Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_storagegateway_stored_iscsi_volume.example arn:aws:storagegateway:us-east-1:123456789012:gateway/sgw-12345678/volume/vol-12345678
+```
+
+<!-- cache-key: cdktf-0.18.0 input-6fe2ebb39bb0b37be955143dd7b495f22fd2e46c96d511b682dd5411c04272ed -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/storagegateway_tape_pool.html.markdown b/website/docs/cdktf/python/r/storagegateway_tape_pool.html.markdown
new file mode 100644
index 00000000000..c3f478e1ad6
--- /dev/null
+++ b/website/docs/cdktf/python/r/storagegateway_tape_pool.html.markdown
@@ -0,0 +1,71 @@
+---
+subcategory: "Storage Gateway"
+layout: "aws"
+page_title: "AWS: aws_storagegateway_tape_pool"
+description: |-
+  Manages an AWS Storage Gateway Tape Pool
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_storagegateway_tape_pool
+
+Manages an AWS Storage Gateway Tape Pool.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.storagegateway_tape_pool import StoragegatewayTapePool
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        StoragegatewayTapePool(self, "example",
+            pool_name="example",
+            storage_class="GLACIER"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `pool_name` - (Required) The name of the new custom tape pool.
+* `storage_class` - (Required) The storage class that is associated with the new custom pool. When you use your backup application to eject the tape, the tape is archived directly into the storage class that corresponds to the pool. Possible values are `DEEP_ARCHIVE` or `GLACIER`.
+* `retention_lock_type` - (Required) Tape retention lock can be configured in two modes. When configured in governance mode, AWS accounts with specific IAM permissions are authorized to remove the tape retention lock from archived virtual tapes. When configured in compliance mode, the tape retention lock cannot be removed by any user, including the root AWS account. Possible values are `COMPLIANCE`, `GOVERNANCE`, and `NONE`. Default value is `NONE`.
+* `retention_lock_time_in_days` - (Optional) Tape retention lock time is set in days. Tape retention lock can be enabled for up to 100 years (36,500 days). Default value is 0.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Volume Amazon Resource Name (ARN), e.g., `aws_storagegateway_tape_pool.example arn:aws:storagegateway:us-east-1:123456789012:tapepool/pool-12345678`.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_storagegateway_tape_pool` using the volume Amazon Resource Name (ARN). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_storagegateway_tape_pool` using the volume Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_storagegateway_tape_pool.example arn:aws:storagegateway:us-east-1:123456789012:tapepool/pool-12345678
+```
+
+<!-- cache-key: cdktf-0.18.0 input-dba7df3eb905d7a9811189b7532fba2b7eb6c8127d9f909ad0446160863c1c13 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/storagegateway_upload_buffer.html.markdown b/website/docs/cdktf/python/r/storagegateway_upload_buffer.html.markdown
new file mode 100644
index 00000000000..4d56404771e
--- /dev/null
+++ b/website/docs/cdktf/python/r/storagegateway_upload_buffer.html.markdown
@@ -0,0 +1,104 @@
+---
+subcategory: "Storage Gateway"
+layout: "aws"
+page_title: "AWS: aws_storagegateway_upload_buffer"
+description: |-
+  Manages an AWS Storage Gateway upload buffer
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_storagegateway_upload_buffer
+
+Manages an AWS Storage Gateway upload buffer.
+
+~> **NOTE:** The Storage Gateway API provides no method to remove an upload buffer disk. Destroying this Terraform resource does not perform any Storage Gateway actions.
+
+## Example Usage
+
+### Cached and VTL Gateway Type
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_storagegateway_local_disk import DataAwsStoragegatewayLocalDisk
+from imports.aws.storagegateway_upload_buffer import StoragegatewayUploadBuffer
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        test = DataAwsStoragegatewayLocalDisk(self, "test",
+            disk_node=Token.as_string(aws_volume_attachment_test.device_name),
+            gateway_arn=Token.as_string(aws_storagegateway_gateway_test.arn)
+        )
+        aws_storagegateway_upload_buffer_test = StoragegatewayUploadBuffer(self, "test_1",
+            disk_path=Token.as_string(test.disk_path),
+            gateway_arn=Token.as_string(aws_storagegateway_gateway_test.arn)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_storagegateway_upload_buffer_test.override_logical_id("test")
+```
+
+### Stored Gateway Type
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_storagegateway_local_disk import DataAwsStoragegatewayLocalDisk
+from imports.aws.storagegateway_upload_buffer import StoragegatewayUploadBuffer
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        StoragegatewayUploadBuffer(self, "example",
+            disk_id=Token.as_string(data_aws_storagegateway_local_disk_example.id),
+            gateway_arn=Token.as_string(aws_storagegateway_gateway_example.arn)
+        )
+        DataAwsStoragegatewayLocalDisk(self, "test",
+            disk_node=Token.as_string(aws_volume_attachment_test.device_name),
+            gateway_arn=Token.as_string(aws_storagegateway_gateway_test.arn)
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `disk_id` - (Optional) Local disk identifier. For example, `pci-0000:03:00.0-scsi-0:0:0:0`.
+* `disk_path` - (Optional) Local disk path. For example, `/dev/nvme1n1`.
+* `gateway_arn` - (Required) The Amazon Resource Name (ARN) of the gateway.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Combined gateway Amazon Resource Name (ARN) and local disk identifier.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_storagegateway_upload_buffer` using the gateway Amazon Resource Name (ARN) and local disk identifier separated with a colon (`:`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_storagegateway_upload_buffer` using the gateway Amazon Resource Name (ARN) and local disk identifier separated with a colon (`:`). For example:
+
+```console
+% terraform import aws_storagegateway_upload_buffer.example arn:aws:storagegateway:us-east-1:123456789012:gateway/sgw-12345678:pci-0000:03:00.0-scsi-0:0:0:0
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ae944e6e1a1a59199a21cc4f4ff9f7913523ee122e7485caccc7b645c0699488 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/storagegateway_working_storage.html.markdown b/website/docs/cdktf/python/r/storagegateway_working_storage.html.markdown
new file mode 100644
index 00000000000..d97fb68c71a
--- /dev/null
+++ b/website/docs/cdktf/python/r/storagegateway_working_storage.html.markdown
@@ -0,0 +1,69 @@
+---
+subcategory: "Storage Gateway"
+layout: "aws"
+page_title: "AWS: aws_storagegateway_working_storage"
+description: |-
+  Manages an AWS Storage Gateway working storage
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_storagegateway_working_storage
+
+Manages an AWS Storage Gateway working storage.
+
+~> **NOTE:** The Storage Gateway API provides no method to remove a working storage disk. Destroying this Terraform resource does not perform any Storage Gateway actions.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.storagegateway_working_storage import StoragegatewayWorkingStorage
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        StoragegatewayWorkingStorage(self, "example",
+            disk_id=Token.as_string(data_aws_storagegateway_local_disk_example.id),
+            gateway_arn=Token.as_string(aws_storagegateway_gateway_example.arn)
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `disk_id` - (Required) Local disk identifier. For example, `pci-0000:03:00.0-scsi-0:0:0:0`.
+* `gateway_arn` - (Required) The Amazon Resource Name (ARN) of the gateway.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Combined gateway Amazon Resource Name (ARN) and local disk identifier.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_storagegateway_working_storage` using the gateway Amazon Resource Name (ARN) and local disk identifier separated with a colon (`:`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_storagegateway_working_storage` using the gateway Amazon Resource Name (ARN) and local disk identifier separated with a colon (`:`). For example:
+
+```console
+% terraform import aws_storagegateway_working_storage.example arn:aws:storagegateway:us-east-1:123456789012:gateway/sgw-12345678:pci-0000:03:00.0-scsi-0:0:0:0
+```
+
+<!-- cache-key: cdktf-0.18.0 input-70cd2153af665dbf7aff736700a2d421553e7a7e40d49fdf71a96c7ff2a5aa9d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/subnet.html.markdown b/website/docs/cdktf/python/r/subnet.html.markdown
new file mode 100644
index 00000000000..34d9b5167bf
--- /dev/null
+++ b/website/docs/cdktf/python/r/subnet.html.markdown
@@ -0,0 +1,133 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_subnet"
+description: |-
+  Provides an VPC subnet resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_subnet
+
+Provides an VPC subnet resource.
+
+~> **NOTE:** Due to [AWS Lambda improved VPC networking changes that began deploying in September 2019](https://aws.amazon.com/blogs/compute/announcing-improved-vpc-networking-for-aws-lambda-functions/), subnets associated with Lambda Functions can take up to 45 minutes to successfully delete. Terraform AWS Provider version 2.31.0 and later automatically handles this increased timeout, however prior versions require setting the [customizable deletion timeout](#timeouts) to 45 minutes (`delete = "45m"`). AWS and HashiCorp are working together to reduce the amount of time required for resource deletion and updates can be tracked in this [GitHub issue](https://github.com/hashicorp/terraform-provider-aws/issues/10329).
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.subnet import Subnet
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Subnet(self, "main",
+            cidr_block="10.0.1.0/24",
+            tags={
+                "Name": "Main"
+            },
+            vpc_id=Token.as_string(aws_vpc_main.id)
+        )
+```
+
+### Subnets In Secondary VPC CIDR Blocks
+
+When managing subnets in one of a VPC's secondary CIDR blocks created using a [`aws_vpc_ipv4_cidr_block_association`](vpc_ipv4_cidr_block_association.html)
+resource, it is recommended to reference that resource's `vpc_id` attribute to ensure correct dependency ordering.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.subnet import Subnet
+from imports.aws.vpc_ipv4_cidr_block_association import VpcIpv4CidrBlockAssociation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        secondary_cidr = VpcIpv4CidrBlockAssociation(self, "secondary_cidr",
+            cidr_block="172.20.0.0/16",
+            vpc_id=main.id
+        )
+        Subnet(self, "in_secondary_cidr",
+            cidr_block="172.20.0.0/24",
+            vpc_id=secondary_cidr.vpc_id
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `assign_ipv6_address_on_creation` - (Optional) Specify true to indicate
+    that network interfaces created in the specified subnet should be
+    assigned an IPv6 address. Default is `false`
+* `availability_zone` - (Optional) AZ for the subnet.
+* `availability_zone_id` - (Optional) AZ ID of the subnet. This argument is not supported in all regions or partitions. If necessary, use `availability_zone` instead.
+* `cidr_block` - (Optional) The IPv4 CIDR block for the subnet.
+* `customer_owned_ipv4_pool` - (Optional) The customer owned IPv4 address pool. Typically used with the `map_customer_owned_ip_on_launch` argument. The `outpost_arn` argument must be specified when configured.
+* `enable_dns64` - (Optional) Indicates whether DNS queries made to the Amazon-provided DNS Resolver in this subnet should return synthetic IPv6 addresses for IPv4-only destinations. Default: `false`.
+* `enable_lni_at_device_index` - (Optional) Indicates the device position for local network interfaces in this subnet. For example, 1 indicates local network interfaces in this subnet are the secondary network interface (eth1). A local network interface cannot be the primary network interface (eth0).
+* `enable_resource_name_dns_aaaa_record_on_launch` - (Optional) Indicates whether to respond to DNS queries for instance hostnames with DNS AAAA records. Default: `false`.
+* `enable_resource_name_dns_a_record_on_launch` - (Optional) Indicates whether to respond to DNS queries for instance hostnames with DNS A records. Default: `false`.
+* `ipv6_cidr_block` - (Optional) The IPv6 network range for the subnet,
+    in CIDR notation. The subnet size must use a /64 prefix length.
+* `ipv6_native` - (Optional) Indicates whether to create an IPv6-only subnet. Default: `false`.
+* `map_customer_owned_ip_on_launch` -  (Optional) Specify `true` to indicate that network interfaces created in the subnet should be assigned a customer owned IP address. The `customer_owned_ipv4_pool` and `outpost_arn` arguments must be specified when set to `true`. Default is `false`.
+* `map_public_ip_on_launch` -  (Optional) Specify true to indicate
+    that instances launched into the subnet should be assigned
+    a public IP address. Default is `false`.
+* `outpost_arn` - (Optional) The Amazon Resource Name (ARN) of the Outpost.
+* `private_dns_hostname_type_on_launch` - (Optional) The type of hostnames to assign to instances in the subnet at launch. For IPv6-only subnets, an instance DNS name must be based on the instance ID. For dual-stack and IPv4-only subnets, you can specify whether DNS names use the instance IPv4 address or the instance ID. Valid values: `ip-name`, `resource-name`.
+* `vpc_id` - (Required) The VPC ID.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the subnet
+* `arn` - The ARN of the subnet.
+* `ipv6_cidr_block_association_id` - The association ID for the IPv6 CIDR block.
+* `owner_id` - The ID of the AWS account that owns the subnet.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `10m`)
+- `delete` - (Default `20m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import subnets using the subnet `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import subnets using the subnet `id`. For example:
+
+```console
+% terraform import aws_subnet.public_subnet subnet-9d4a7b6c
+```
+
+<!-- cache-key: cdktf-0.18.0 input-800b4894a44d3fb10c7ed4e02828a98cc6bb1ba25ee4607e803d5cddf8afc2ed -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/swf_domain.html.markdown b/website/docs/cdktf/python/r/swf_domain.html.markdown
new file mode 100644
index 00000000000..ec8bdbd061b
--- /dev/null
+++ b/website/docs/cdktf/python/r/swf_domain.html.markdown
@@ -0,0 +1,75 @@
+---
+subcategory: "SWF (Simple Workflow)"
+layout: "aws"
+page_title: "AWS: aws_swf_domain"
+description: |-
+  Provides an SWF Domain resource
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_swf_domain
+
+Provides an SWF Domain resource.
+
+## Example Usage
+
+To register a basic SWF domain:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.swf_domain import SwfDomain
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SwfDomain(self, "foo",
+            description="Terraform SWF Domain",
+            name="foo",
+            workflow_execution_retention_period_in_days=Token.as_string(30)
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Optional, Forces new resource) The name of the domain. If omitted, Terraform will assign a random, unique name.
+* `name_prefix` - (Optional, Forces new resource) Creates a unique name beginning with the specified prefix. Conflicts with `name`.
+* `description` - (Optional, Forces new resource) The domain description.
+* `workflow_execution_retention_period_in_days` - (Required, Forces new resource) Length of time that SWF will continue to retain information about the workflow execution after the workflow execution is complete, must be between 0 and 90 days.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name of the domain.
+* `arn` - Amazon Resource Name (ARN)
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SWF Domains using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import SWF Domains using the `name`. For example:
+
+```console
+% terraform import aws_swf_domain.foo test-domain
+```
+
+<!-- cache-key: cdktf-0.18.0 input-54abbc51f16eec052393c1102198887c7a517cee82c16898c2f3b8d0f149a603 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/synthetics_canary.html.markdown b/website/docs/cdktf/python/r/synthetics_canary.html.markdown
new file mode 100644
index 00000000000..d1e0a0e167e
--- /dev/null
+++ b/website/docs/cdktf/python/r/synthetics_canary.html.markdown
@@ -0,0 +1,140 @@
+---
+subcategory: "CloudWatch Synthetics"
+layout: "aws"
+page_title: "AWS: aws_synthetics_canary"
+description: |-
+  Provides a Synthetics Canary resource
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_synthetics_canary
+
+Provides a Synthetics Canary resource.
+
+~> **NOTE:** When you create a canary, AWS creates supporting implicit resources. See the Amazon CloudWatch Synthetics documentation on [DeleteCanary](https://docs.aws.amazon.com/AmazonSynthetics/latest/APIReference/API_DeleteCanary.html) for a full list. Neither AWS nor Terraform deletes these implicit resources automatically when the canary is deleted. Before deleting a canary, ensure you have all the information about the canary that you need to delete the implicit resources using Terraform shell commands, the AWS Console, or AWS CLI.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.synthetics_canary import SyntheticsCanary
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SyntheticsCanary(self, "some",
+            artifact_s3_location="s3://some-bucket/",
+            execution_role_arn="some-role",
+            handler="exports.handler",
+            name="some-canary",
+            runtime_version="syn-1.0",
+            schedule=SyntheticsCanarySchedule(
+                expression="rate(0 minute)"
+            ),
+            zip_file="test-fixtures/lambdatest.zip"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `artifact_s3_location` - (Required) Location in Amazon S3 where Synthetics stores artifacts from the test runs of this canary.
+* `execution_role_arn` - (Required) ARN of the IAM role to be used to run the canary. see [AWS Docs](https://docs.aws.amazon.com/AmazonSynthetics/latest/APIReference/API_CreateCanary.html#API_CreateCanary_RequestSyntax) for permissions needs for IAM Role.
+* `handler` - (Required) Entry point to use for the source code when running the canary. This value must end with the string `.handler` .
+* `name` - (Required) Name for this canary. Has a maximum length of 21 characters. Valid characters are lowercase alphanumeric, hyphen, or underscore.
+* `runtime_version` - (Required) Runtime version to use for the canary. Versions change often so consult the [Amazon CloudWatch documentation](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch_Synthetics_Canaries_Library.html) for the latest valid versions. Values include `syn-python-selenium-1.0`, `syn-nodejs-puppeteer-3.0`, `syn-nodejs-2.2`, `syn-nodejs-2.1`, `syn-nodejs-2.0`, and `syn-1.0`.
+* `schedule` -  (Required) Configuration block providing how often the canary is to run and when these test runs are to stop. Detailed below.
+
+The following arguments are optional:
+
+* `delete_lambda` - (Optional)  Specifies whether to also delete the Lambda functions and layers used by this canary. The default is `false`.
+* `vpc_config` - (Optional) Configuration block. Detailed below.
+* `failure_retention_period` - (Optional) Number of days to retain data about failed runs of this canary. If you omit this field, the default of 31 days is used. The valid range is 1 to 455 days.
+* `run_config` - (Optional) Configuration block for individual canary runs. Detailed below.
+* `s3_bucket` - (Optional) Full bucket name which is used if your canary script is located in S3. The bucket must already exist. **Conflicts with `zip_file`.**
+* `s3_key` - (Optional) S3 key of your script. **Conflicts with `zip_file`.**
+* `s3_version` - (Optional) S3 version ID of your script. **Conflicts with `zip_file`.**
+* `start_canary` - (Optional) Whether to run or stop the canary.
+* `success_retention_period` - (Optional) Number of days to retain data about successful runs of this canary. If you omit this field, the default of 31 days is used. The valid range is 1 to 455 days.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `artifact_config` - (Optional) configuration for canary artifacts, including the encryption-at-rest settings for artifacts that the canary uploads to Amazon S3. See [Artifact Config](#artifact_config).
+* `zip_file` - (Optional) ZIP file that contains the script, if you input your canary script directly into the canary instead of referring to an S3 location. It can be up to 225KB. **Conflicts with `s3_bucket`, `s3_key`, and `s3_version`.**
+
+### artifact_config
+
+* `s3_encryption` - (Optional) Configuration of the encryption-at-rest settings for artifacts that the canary uploads to Amazon S3. See [S3 Encryption](#s3_encryption).
+
+### s3_encryption
+
+* `encryption_mode` - (Optional) The encryption method to use for artifacts created by this canary. Valid values are: `SSE_S3` and `SSE_KMS`.
+* `kms_key_arn` - (Optional) The ARN of the customer-managed KMS key to use, if you specify `SSE_KMS` for `encryption_mode`.
+
+### schedule
+
+* `expression` - (Required) Rate expression or cron expression that defines how often the canary is to run. For rate expression, the syntax is `rate(number unit)`. _unit_ can be `minute`, `minutes`, or `hour`. For cron expression, the syntax is `cron(expression)`. For more information about the syntax for cron expressions, see [Scheduling canary runs using cron](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch_Synthetics_Canaries_cron.html).
+* `duration_in_seconds` - (Optional) Duration in seconds, for the canary to continue making regular runs according to the schedule in the Expression value.
+
+### run_config
+
+* `timeout_in_seconds` - (Optional) Number of seconds the canary is allowed to run before it must stop. If you omit this field, the frequency of the canary is used, up to a maximum of 840 (14 minutes).
+* `memory_in_mb` - (Optional) Maximum amount of memory available to the canary while it is running, in MB. The value you specify must be a multiple of 64.
+* `active_tracing` - (Optional) Whether this canary is to use active AWS X-Ray tracing when it runs. You can enable active tracing only for canaries that use version syn-nodejs-2.0 or later for their canary runtime.
+* `environment_variables` - (Optional) Map of environment variables that are accessible from the canary during execution. Please see [AWS Docs](https://docs.aws.amazon.com/lambda/latest/dg/configuration-envvars.html#configuration-envvars-runtime) for variables reserved for Lambda.
+
+### vpc_config
+
+If this canary tests an endpoint in a VPC, this structure contains information about the subnet and security groups of the VPC endpoint. For more information, see [Running a Canary in a VPC](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch_Synthetics_Canaries_VPC.html).
+
+* `subnet_ids` - (Required) IDs of the subnets where this canary is to run.
+* `security_group_ids` - (Required) IDs of the security groups for this canary.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the Canary.
+* `engine_arn` - ARN of the Lambda function that is used as your canary's engine.
+* `id` - Name for this canary.
+* `source_location_arn` - ARN of the Lambda layer where Synthetics stores the canary script code.
+* `status` - Canary status.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `timeline` - Structure that contains information about when the canary was created, modified, and most recently run. see [Timeline](#timeline).
+
+### vpc_config
+
+* `vpc_id` - ID of the VPC where this canary is to run.
+
+### timeline
+
+* `created` - Date and time the canary was created.
+* `last_modified` - Date and time the canary was most recently modified.
+* `last_started` - Date and time that the canary's most recent run started.
+* `last_stopped` - Date and time that the canary's most recent run ended.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Synthetics Canaries using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Synthetics Canaries using the `name`. For example:
+
+```console
+% terraform import aws_synthetics_canary.some some-canary
+```
+
+<!-- cache-key: cdktf-0.18.0 input-7a9e3e1413440a0151e0d113031ae787861be1f778da70a162639b9434cfd1fb -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/synthetics_group.html.markdown b/website/docs/cdktf/python/r/synthetics_group.html.markdown
new file mode 100644
index 00000000000..984a1e68cc6
--- /dev/null
+++ b/website/docs/cdktf/python/r/synthetics_group.html.markdown
@@ -0,0 +1,73 @@
+---
+subcategory: "CloudWatch Synthetics"
+layout: "aws"
+page_title: "AWS: aws_synthetics_group"
+description: |-
+  Provides a Synthetics Group resource
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_synthetics_group
+
+Provides a Synthetics Group resource.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.synthetics_group import SyntheticsGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SyntheticsGroup(self, "example",
+            name="example"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) Name of the group.
+
+The following arguments are optional:
+
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Group.
+* `group_id` - ID of the Group.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudWatch Synthetics Group using the `name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import CloudWatch Synthetics Group using the `name`. For example:
+
+```console
+% terraform import aws_synthetics_group.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-a60f694e7f99a87c98a47c4127d04528abd45230d213848a0dd79453012e6e75 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/synthetics_group_association.html.markdown b/website/docs/cdktf/python/r/synthetics_group_association.html.markdown
new file mode 100644
index 00000000000..81aa0c0b711
--- /dev/null
+++ b/website/docs/cdktf/python/r/synthetics_group_association.html.markdown
@@ -0,0 +1,70 @@
+---
+subcategory: "CloudWatch Synthetics"
+layout: "aws"
+page_title: "AWS: aws_synthetics_group_association"
+description: |-
+  Provides a Synthetics Group Association resource
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_synthetics_group_association
+
+Provides a Synthetics Group Association resource.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.synthetics_group_association import SyntheticsGroupAssociation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        SyntheticsGroupAssociation(self, "example",
+            canary_arn=Token.as_string(aws_synthetics_canary_example.arn),
+            group_name=Token.as_string(aws_synthetics_group_example.name)
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `group_name` - (Required) Name of the group that the canary will be associated with.
+* `canary_arn` - (Required) ARN of the canary.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `group_name` - Name of the Group.
+* `group_id` - ID of the Group.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudWatch Synthetics Group Association using the `canary_arn,group_name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import CloudWatch Synthetics Group Association using the `canary_arn,group_name`. For example:
+
+```console
+% terraform import aws_synthetics_group_association.example arn:aws:synthetics:us-west-2:123456789012:canary:tf-acc-test-abcd1234,examplename
+```
+
+<!-- cache-key: cdktf-0.18.0 input-586109c93710a862721820ba7c1a1a3dc69aaa17f27c7d2609f2031c6672b318 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/timestreamwrite_database.html.markdown b/website/docs/cdktf/python/r/timestreamwrite_database.html.markdown
new file mode 100644
index 00000000000..00e9420a14f
--- /dev/null
+++ b/website/docs/cdktf/python/r/timestreamwrite_database.html.markdown
@@ -0,0 +1,96 @@
+---
+subcategory: "Timestream Write"
+layout: "aws"
+page_title: "AWS: aws_timestreamwrite_database"
+description: |-
+  Provides a Timestream database resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_timestreamwrite_database
+
+Provides a Timestream database resource.
+
+## Example Usage
+
+### Basic usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.timestreamwrite_database import TimestreamwriteDatabase
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        TimestreamwriteDatabase(self, "example",
+            database_name="database-example"
+        )
+```
+
+### Full usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.timestreamwrite_database import TimestreamwriteDatabase
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        TimestreamwriteDatabase(self, "example",
+            database_name="database-example",
+            kms_key_id=Token.as_string(aws_kms_key_example.arn),
+            tags={
+                "Name": "value"
+            }
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `database_name` – (Required) The name of the Timestream database. Minimum length of 3. Maximum length of 64.
+* `kms_key_id` - (Optional) The ARN (not Alias ARN) of the KMS key to be used to encrypt the data stored in the database. If the KMS key is not specified, the database will be encrypted with a Timestream managed KMS key located in your account. Refer to [AWS managed KMS keys](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk) for more info.
+* `tags` - (Optional) Map of tags to assign to this resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name of the Timestream database.
+* `arn` - The ARN that uniquely identifies this database.
+* `kms_key_id` - The ARN of the KMS key used to encrypt the data stored in the database.
+* `table_count` - The total number of tables found within the Timestream database.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Timestream databases using the `database_name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Timestream databases using the `database_name`. For example:
+
+```console
+% terraform import aws_timestreamwrite_database.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-f9e466cc597e77e2955216c4193bd02e93e398df89c5fb4b6c43b2048b014651 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/timestreamwrite_table.html.markdown b/website/docs/cdktf/python/r/timestreamwrite_table.html.markdown
new file mode 100644
index 00000000000..14d54221551
--- /dev/null
+++ b/website/docs/cdktf/python/r/timestreamwrite_table.html.markdown
@@ -0,0 +1,172 @@
+---
+subcategory: "Timestream Write"
+layout: "aws"
+page_title: "AWS: aws_timestreamwrite_table"
+description: |-
+  Provides a Timestream table resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_timestreamwrite_table
+
+Provides a Timestream table resource.
+
+## Example Usage
+
+### Basic usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.timestreamwrite_table import TimestreamwriteTable
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        TimestreamwriteTable(self, "example",
+            database_name=Token.as_string(aws_timestreamwrite_database_example.database_name),
+            table_name="example"
+        )
+```
+
+### Full usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.timestreamwrite_table import TimestreamwriteTable
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        TimestreamwriteTable(self, "example",
+            database_name=Token.as_string(aws_timestreamwrite_database_example.database_name),
+            retention_properties=TimestreamwriteTableRetentionProperties(
+                magnetic_store_retention_period_in_days=30,
+                memory_store_retention_period_in_hours=8
+            ),
+            table_name="example",
+            tags={
+                "Name": "example-timestream-table"
+            }
+        )
+```
+
+### Customer-defined Partition Key
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.timestreamwrite_table import TimestreamwriteTable
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        TimestreamwriteTable(self, "example",
+            database_name=Token.as_string(aws_timestreamwrite_database_example.database_name),
+            schema=TimestreamwriteTableSchema(
+                composite_partition_key=TimestreamwriteTableSchemaCompositePartitionKey(
+                    enforcement_in_record="REQUIRED",
+                    name="attr1",
+                    type="DIMENSION"
+                )
+            ),
+            table_name="example"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `database_name` – (Required) The name of the Timestream database.
+* `magnetic_store_write_properties` - (Optional) Contains properties to set on the table when enabling magnetic store writes. See [Magnetic Store Write Properties](#magnetic-store-write-properties) below for more details.
+* `retention_properties` - (Optional) The retention duration for the memory store and magnetic store. See [Retention Properties](#retention-properties) below for more details. If not provided, `magnetic_store_retention_period_in_days` default to 73000 and `memory_store_retention_period_in_hours` defaults to 6.
+* `schema` - (Optional) The schema of the table. See [Schema](#schema) below for more details.
+* `table_name` - (Required) The name of the Timestream table.
+* `tags` - (Optional) Map of tags to assign to this resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Magnetic Store Write Properties
+
+The `magnetic_store_write_properties` block supports the following arguments:
+
+* `enable_magnetic_store_writes` - (Required) A flag to enable magnetic store writes.
+* `magnetic_store_rejected_data_location` - (Optional) The location to write error reports for records rejected asynchronously during magnetic store writes. See [Magnetic Store Rejected Data Location](#magnetic-store-rejected-data-location) below for more details.
+
+#### Magnetic Store Rejected Data Location
+
+The `magnetic_store_rejected_data_location` block supports the following arguments:
+
+* `s3_configuration` - (Optional) Configuration of an S3 location to write error reports for records rejected, asynchronously, during magnetic store writes. See [S3 Configuration](#s3-configuration) below for more details.
+
+##### S3 Configuration
+
+The `s3_configuration` block supports the following arguments:
+
+* `bucket_name` - (Optional) Bucket name of the customer S3 bucket.
+* `encryption_option` - (Optional) Encryption option for the customer s3 location. Options are S3 server side encryption with an S3-managed key or KMS managed key. Valid values are `SSE_KMS` and `SSE_S3`.
+* `kms_key_id` - (Optional) KMS key arn for the customer s3 location when encrypting with a KMS managed key.
+* `object_key_prefix` - (Optional) Object key prefix for the customer S3 location.
+
+### Retention Properties
+
+The `retention_properties` block supports the following arguments:
+
+* `magnetic_store_retention_period_in_days` - (Required) The duration for which data must be stored in the magnetic store. Minimum value of 1. Maximum value of 73000.
+* `memory_store_retention_period_in_hours` - (Required) The duration for which data must be stored in the memory store. Minimum value of 1. Maximum value of 8766.
+
+### Schema
+
+The `schema` block supports the following arguments:
+
+* `composite_partition_key` - (Required) A non-empty list of partition keys defining the attributes used to partition the table data. The order of the list determines the partition hierarchy. The name and type of each partition key as well as the partition key order cannot be changed after the table is created. However, the enforcement level of each partition key can be changed. See [Composite Partition Key](#composite-partition-key) below for more details.
+
+### Composite Partition Key
+
+The `composite_partition_key` block supports the following arguments:
+
+* `enforcement_in_record` - (Optional) The level of enforcement for the specification of a dimension key in ingested records. Valid values: `REQUIRED`, `OPTIONAL`.
+* `name` - (Optional) The name of the attribute used for a dimension key.
+* `type` - (Required) The type of the partition key. Valid values: `DIMENSION`, `MEASURE`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The `table_name` and `database_name` separated by a colon (`:`).
+* `arn` - The ARN that uniquely identifies this table.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Timestream tables using the `table_name` and `database_name` separate by a colon (`:`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Timestream tables using the `table_name` and `database_name` separate by a colon (`:`). For example:
+
+```console
+% terraform import aws_timestreamwrite_table.example ExampleTable:ExampleDatabase
+```
+
+<!-- cache-key: cdktf-0.18.0 input-f3b0a12c378c166ac42527e7ddfa6ae43b71b326a2b2a3f2abcf892be6820171 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/transcribe_language_model.html.markdown b/website/docs/cdktf/python/r/transcribe_language_model.html.markdown
new file mode 100644
index 00000000000..dce06569639
--- /dev/null
+++ b/website/docs/cdktf/python/r/transcribe_language_model.html.markdown
@@ -0,0 +1,147 @@
+---
+subcategory: "Transcribe"
+layout: "aws"
+page_title: "AWS: aws_transcribe_language_model"
+description: |-
+  Terraform resource for managing an AWS Transcribe LanguageModel.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_transcribe_language_model
+
+Terraform resource for managing an AWS Transcribe LanguageModel.
+
+-> This resource can take a significant amount of time to provision. See Language Model [FAQ](https://aws.amazon.com/transcribe/faqs/) for more details.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, Fn, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.iam_role import IamRole
+from imports.aws.iam_role_policy import IamRolePolicy
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_object import S3Object
+from imports.aws.transcribe_language_model import TranscribeLanguageModel
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = S3Bucket(self, "example",
+            bucket="example-transcribe",
+            force_destroy=True
+        )
+        S3Object(self, "object",
+            bucket=example.id,
+            key="transcribe/test1.txt",
+            source="test1.txt"
+        )
+        data_aws_iam_policy_document_example = DataAwsIamPolicyDocument(self, "example_2",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["sts:AssumeRole"],
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["transcribe.amazonaws.com"],
+                    type="Service"
+                )
+                ]
+            )
+            ]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_iam_policy_document_example.override_logical_id("example")
+        aws_iam_role_example = IamRole(self, "example_3",
+            assume_role_policy=Token.as_string(data_aws_iam_policy_document_example.json),
+            name="example"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_role_example.override_logical_id("example")
+        IamRolePolicy(self, "test_policy",
+            name="example",
+            policy=Token.as_string(
+                Fn.jsonencode({
+                    "Statement": [{
+                        "Action": ["s3:GetObject", "s3:ListBucket"],
+                        "Effect": "Allow",
+                        "Resource": ["*"]
+                    }
+                    ],
+                    "Version": "2012-10-17"
+                })),
+            role=Token.as_string(aws_iam_role_example.id)
+        )
+        aws_transcribe_language_model_example = TranscribeLanguageModel(self, "example_5",
+            base_model_name="NarrowBand",
+            input_data_config=TranscribeLanguageModelInputDataConfig(
+                data_access_role_arn=Token.as_string(aws_iam_role_example.arn),
+                s3_uri="s3://${" + example.id + "}/transcribe/"
+            ),
+            language_code="en-US",
+            model_name="example",
+            tags={
+                "ENVIRONMENT": "development"
+            }
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_transcribe_language_model_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `base_model_name` - (Required) Name of reference base model.
+* `input_data_config` - (Required) The input data config for the LanguageModel. See [Input Data Config](#input-data-config) for more details.
+* `language_code` - (Required) The language code you selected for your language model. Refer to the [supported languages](https://docs.aws.amazon.com/transcribe/latest/dg/supported-languages.html) page for accepted codes.
+* `model_name` - (Required) The model name.
+
+### Input Data Config
+
+* `data_access_role_arn` - (Required) IAM role with access to S3 bucket.
+* `s3_uri` - (Required) S3 URI where training data is located.
+* `tuning_data_s3_uri` - (Optional) S3 URI where tuning data is located.
+
+The following arguments are optional:
+
+* `tags` - (Optional) A map of tags to assign to the LanguageModel. If configured with a provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - LanguageModel name.
+* `arn` - ARN of the LanguageModel.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `600m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Transcribe LanguageModel using the `model_name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Transcribe LanguageModel using the `model_name`. For example:
+
+```console
+% terraform import aws_transcribe_language_model.example example-name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-85a81f3a3aae68cdb05de1abee14c19e807278023470592c0e052318dc2bff47 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/transcribe_medical_vocabulary.html.markdown b/website/docs/cdktf/python/r/transcribe_medical_vocabulary.html.markdown
new file mode 100644
index 00000000000..940b272f451
--- /dev/null
+++ b/website/docs/cdktf/python/r/transcribe_medical_vocabulary.html.markdown
@@ -0,0 +1,104 @@
+---
+subcategory: "Transcribe"
+layout: "aws"
+page_title: "AWS: aws_transcribe_medical_vocabulary"
+description: |-
+  Terraform resource for managing an AWS Transcribe MedicalVocabulary.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_transcribe_medical_vocabulary
+
+Terraform resource for managing an AWS Transcribe MedicalVocabulary.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_object import S3Object
+from imports.aws.transcribe_medical_vocabulary import TranscribeMedicalVocabulary
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = S3Bucket(self, "example",
+            bucket="example-medical-vocab-123",
+            force_destroy=True
+        )
+        object = S3Object(self, "object",
+            bucket=example.id,
+            key="transcribe/test1.txt",
+            source="test.txt"
+        )
+        aws_transcribe_medical_vocabulary_example =
+        TranscribeMedicalVocabulary(self, "example_2",
+            depends_on=[object],
+            language_code="en-US",
+            tags={
+                "tag1": "value1",
+                "tag2": "value3"
+            },
+            vocabulary_file_uri="s3://${" + example.id + "}/${" + object.key + "}",
+            vocabulary_name="example"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_transcribe_medical_vocabulary_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `language_code` - (Required) The language code you selected for your medical vocabulary. US English (en-US) is the only language supported with Amazon Transcribe Medical.
+* `vocabulary_file_uri` - (Required) The Amazon S3 location (URI) of the text file that contains your custom medical vocabulary.
+* `vocabulary_name` - (Required) The name of the Medical Vocabulary.
+
+The following arguments are optional:
+
+* `tags` - (Optional) A map of tags to assign to the MedicalVocabulary. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Name of the MedicalVocabulary.
+* `arn` - ARN of the MedicalVocabulary.
+* `download_uri` - Generated download URI.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `30m`)
+* `update` - (Default `30m`)
+* `delete` - (Default `30m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Transcribe MedicalVocabulary using the `vocabulary_name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Transcribe MedicalVocabulary using the `vocabulary_name`. For example:
+
+```console
+% terraform import aws_transcribe_medical_vocabulary.example example-name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ec2666cdcba506c91a439366946ad3db8a956be1cc1dfb2a6e10b62b3551dac0 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/transcribe_vocabulary.html.markdown b/website/docs/cdktf/python/r/transcribe_vocabulary.html.markdown
new file mode 100644
index 00000000000..1dc5dff24f9
--- /dev/null
+++ b/website/docs/cdktf/python/r/transcribe_vocabulary.html.markdown
@@ -0,0 +1,105 @@
+---
+subcategory: "Transcribe"
+layout: "aws"
+page_title: "AWS: aws_transcribe_vocabulary"
+description: |-
+  Terraform resource for managing an AWS Transcribe Vocabulary.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_transcribe_vocabulary
+
+Terraform resource for managing an AWS Transcribe Vocabulary.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.s3_bucket import S3Bucket
+from imports.aws.s3_object import S3Object
+from imports.aws.transcribe_vocabulary import TranscribeVocabulary
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = S3Bucket(self, "example",
+            bucket="example-vocab-123",
+            force_destroy=True
+        )
+        object = S3Object(self, "object",
+            bucket=example.id,
+            key="transcribe/test1.txt",
+            source="test.txt"
+        )
+        aws_transcribe_vocabulary_example = TranscribeVocabulary(self, "example_2",
+            depends_on=[object],
+            language_code="en-US",
+            tags={
+                "tag1": "value1",
+                "tag2": "value3"
+            },
+            vocabulary_file_uri="s3://${" + example.id + "}/${" + object.key + "}",
+            vocabulary_name="example"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_transcribe_vocabulary_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `language_code` - (Required) The language code you selected for your vocabulary.
+* `vocabulary_file_uri` - (Required) The Amazon S3 location (URI) of the text file that contains your custom vocabulary.
+* `vocabulary_name` - (Required) The name of the Vocabulary.
+
+The following arguments are optional:
+
+* `phrases` - (Optional) - A list of terms to include in the vocabulary. Conflicts with `vocabulary_file_uri`
+* `vocabulary_file_uri` - (Optional) The Amazon S3 location (URI) of the text file that contains your custom vocabulary. Conflicts wth `phrases`.
+* `tags` - (Optional) A map of tags to assign to the Vocabulary. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Name of the Vocabulary.
+* `arn` - ARN of the Vocabulary.
+* `download_uri` - Generated download URI.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `30m`)
+* `update` - (Default `30m`)
+* `delete` - (Default `30m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Transcribe Vocabulary using the `vocabulary_name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Transcribe Vocabulary using the `vocabulary_name`. For example:
+
+```console
+% terraform import aws_transcribe_vocabulary.example example-name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-4a63881191c0f51840ddf42c0326273b5b41ebbdda248795a18439aec52f460c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/transcribe_vocabulary_filter.html.markdown b/website/docs/cdktf/python/r/transcribe_vocabulary_filter.html.markdown
new file mode 100644
index 00000000000..ed6415e51c8
--- /dev/null
+++ b/website/docs/cdktf/python/r/transcribe_vocabulary_filter.html.markdown
@@ -0,0 +1,82 @@
+---
+subcategory: "Transcribe"
+layout: "aws"
+page_title: "AWS: aws_transcribe_vocabulary_filter"
+description: |-
+  Terraform resource for managing an AWS Transcribe VocabularyFilter.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_transcribe_vocabulary_filter
+
+Terraform resource for managing an AWS Transcribe VocabularyFilter.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.transcribe_vocabulary_filter import TranscribeVocabularyFilter
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        TranscribeVocabularyFilter(self, "example",
+            language_code="en-US",
+            tags={
+                "tag1": "value1",
+                "tag2": "value3"
+            },
+            vocabulary_filter_name="example",
+            words=["cars", "bucket"]
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `language_code` - (Required) The language code you selected for your vocabulary filter. Refer to the [supported languages](https://docs.aws.amazon.com/transcribe/latest/dg/supported-languages.html) page for accepted codes.
+* `vocabulary_filter_name` - (Required) The name of the VocabularyFilter.
+
+The following arguments are optional:
+
+* `vocabulary_filter_file_uri` - (Optional) The Amazon S3 location (URI) of the text file that contains your custom VocabularyFilter. Conflicts with `words` argument.
+* `tags` - (Optional) A map of tags to assign to the VocabularyFilter. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `words` - (Optional) - A list of terms to include in the vocabulary. Conflicts with `vocabulary_filter_file_uri` argument.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - VocabularyFilter name.
+* `arn` - ARN of the VocabularyFilter.
+* `download_uri` - Generated download URI.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Transcribe VocabularyFilter using the `vocabulary_filter_name`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Transcribe VocabularyFilter using the `vocabulary_filter_name`. For example:
+
+```console
+% terraform import aws_transcribe_vocabulary_filter.example example-name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-16b5be2fa7e21b3d5f8eb7e880ca04a14415ca27a321bb6d553621e84cea648d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/transfer_access.html.markdown b/website/docs/cdktf/python/r/transfer_access.html.markdown
new file mode 100644
index 00000000000..81255fa63d3
--- /dev/null
+++ b/website/docs/cdktf/python/r/transfer_access.html.markdown
@@ -0,0 +1,114 @@
+---
+subcategory: "Transfer Family"
+layout: "aws"
+page_title: "AWS: aws_transfer_access"
+description: |-
+  Provides a AWS Transfer Access resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_transfer_access
+
+Provides a AWS Transfer Access resource.
+
+## Example Usage
+
+### Basic S3
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.transfer_access import TransferAccess
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        TransferAccess(self, "example",
+            external_id="S-1-1-12-1234567890-123456789-1234567890-1234",
+            home_directory="/${" + aws_s3_bucket_example.id + "}/",
+            role=Token.as_string(aws_iam_role_example.arn),
+            server_id=Token.as_string(aws_transfer_server_example.id)
+        )
+```
+
+### Basic EFS
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.transfer_access import TransferAccess
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        TransferAccess(self, "test",
+            external_id="S-1-1-12-1234567890-123456789-1234567890-1234",
+            home_directory="/${" + aws_efs_file_system_test.id + "}/",
+            posix_profile=TransferAccessPosixProfile(
+                gid=1000,
+                uid=1000
+            ),
+            role=Token.as_string(aws_iam_role_test.arn),
+            server_id=Token.as_string(aws_transfer_server_test.id)
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `external_id` - (Required) The SID of a group in the directory connected to the Transfer Server (e.g., `S-1-1-12-1234567890-123456789-1234567890-1234`)
+* `server_id` - (Required) The Server ID of the Transfer Server (e.g., `s-12345678`)
+* `home_directory` - (Optional) The landing directory (folder) for a user when they log in to the server using their SFTP client.  It should begin with a `/`.  The first item in the path is the name of the home bucket (accessible as `${Transfer:HomeBucket}` in the policy) and the rest is the home directory (accessible as `${Transfer:HomeDirectory}` in the policy). For example, `/example-bucket-1234/username` would set the home bucket to `example-bucket-1234` and the home directory to `username`.
+* `home_directory_mappings` - (Optional) Logical directory mappings that specify what S3 paths and keys should be visible to your user and how you want to make them visible. See [Home Directory Mappings](#home-directory-mappings) below.
+* `home_directory_type` - (Optional) The type of landing directory (folder) you mapped for your users' home directory. Valid values are `PATH` and `LOGICAL`.
+* `policy` - (Optional) An IAM JSON policy document that scopes down user access to portions of their Amazon S3 bucket. IAM variables you can use inside this policy include `${Transfer:UserName}`, `${Transfer:HomeDirectory}`, and `${Transfer:HomeBucket}`. Since the IAM variable syntax matches Terraform's interpolation syntax, they must be escaped inside Terraform configuration strings (`$${Transfer:UserName}`).  These are evaluated on-the-fly when navigating the bucket.
+* `posix_profile` - (Optional) Specifies the full POSIX identity, including user ID (Uid), group ID (Gid), and any secondary groups IDs (SecondaryGids), that controls your users' access to your Amazon EFS file systems. See [Posix Profile](#posix-profile) below.
+* `role` - (Required) Amazon Resource Name (ARN) of an IAM role that allows the service to controls your user’s access to your Amazon S3 bucket.
+
+### Home Directory Mappings
+
+* `entry` - (Required) Represents an entry and a target.
+* `target` - (Required) Represents the map target.
+
+### Posix Profile
+
+* `gid` - (Required) The POSIX group ID used for all EFS operations by this user.
+* `uid` - (Required) The POSIX user ID used for all EFS operations by this user.
+* `secondary_gids` - (Optional) The secondary POSIX group IDs used for all EFS operations by this user.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id`  - The ID of the resource
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Transfer Accesses using the `server_id` and `external_id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Transfer Accesses using the `server_id` and `external_id`. For example:
+
+```console
+% terraform import aws_transfer_access.example s-12345678/S-1-1-12-1234567890-123456789-1234567890-1234
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ff8299ab25d391a1af99874bcb28fb7deeeece3c742e6251e861258034467d2f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/transfer_agreement.html.markdown b/website/docs/cdktf/python/r/transfer_agreement.html.markdown
new file mode 100644
index 00000000000..b72cbc30872
--- /dev/null
+++ b/website/docs/cdktf/python/r/transfer_agreement.html.markdown
@@ -0,0 +1,80 @@
+---
+subcategory: "Transfer Family"
+layout: "aws"
+page_title: "AWS: aws_transfer_agreement"
+description: |-
+  Provides a AWS Transfer AS2 Agreement Resource
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_transfer_agreement
+
+Provides a AWS Transfer AS2 Agreement resource.
+
+## Example Usage
+
+### Basic
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.transfer_agreement import TransferAgreement
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        TransferAgreement(self, "example",
+            access_role=test.arn,
+            base_directory="/DOC-EXAMPLE-BUCKET/home/mydirectory",
+            description="example",
+            local_profile_id=local.profile_id,
+            partner_profile_id=partner.profile_id,
+            server_id=Token.as_string(aws_transfer_server_test.id)
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `access_role` - (Required) The IAM Role which provides read and write access to the parent directory of the file location mentioned in the StartFileTransfer request.
+* `base_directory` - (Required) The landing directory for the files transferred by using the AS2 protocol.
+* `description` - (Optional) The Optional description of the transdfer.
+* `local_profile_id` - (Required) The unique identifier for the AS2 local profile.
+* `partner_profile_id` - (Required) The unique identifier for the AS2 partner profile.
+* `server_id` - (Required) The unique server identifier for the server instance. This is the specific server the agreement uses.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `agreement_id`  - The unique identifier for the AS2 agreement.
+* `arn` - The ARN of the agreement.
+* `staus`  - The staus of the agreement which is either ACTIVE or INACTIVE.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Transfer AS2 Agreement using the `server_id/agreement_id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Transfer AS2 Agreement using the `server_id/agreement_id`. For example:
+
+```console
+% terraform import aws_transfer_agreement.example s-4221a88afd5f4362a/a-4221a88afd5f4362a
+```
+
+<!-- cache-key: cdktf-0.18.0 input-68e33cbd7ad4965dddc102db9b300dde49f777c8ef6bfaa3845050362aa8992d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/transfer_certificate.html.markdown b/website/docs/cdktf/python/r/transfer_certificate.html.markdown
new file mode 100644
index 00000000000..bb5cfc560a7
--- /dev/null
+++ b/website/docs/cdktf/python/r/transfer_certificate.html.markdown
@@ -0,0 +1,82 @@
+---
+subcategory: "Transfer Family"
+layout: "aws"
+page_title: "AWS: aws_transfer_certificate"
+description: |-
+  Provides a AWS Transfer AS2 Certificate Resource
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_transfer_certificate
+
+Provides a AWS Transfer AS2 Certificate resource.
+
+## Example Usage
+
+### Basic
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.transfer_certificate import TransferCertificate
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        TransferCertificate(self, "example",
+            certificate=Token.as_string(
+                Fn.file("${path.module}/example.com/example.crt")),
+            certificate_chain=Token.as_string(
+                Fn.file("${path.module}/example.com/ca.crt")),
+            description="example",
+            private_key=Token.as_string(
+                Fn.file("${path.module}/example.com/example.key")),
+            usage="SIGNING"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `certificate` - (Required) The valid certificate file required for the transfer.
+* `certificate_chain` - (Optional) The optional list of certificate that make up the chain for the certificate that is being imported.
+* `description` - (Optional) A short description that helps identify the certificate.
+* `private_key` - (Optional) The private key associated with the certificate being imported.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `usage` - (Required) Specifies if a certificate is being used for signing or encryption. The valid values are SIGNING and ENCRYPTION.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the certificate
+* `certificate_id` - The unique identifier for the AS2 certificate
+* `active_date` - An date when the certificate becomes active
+* `inactive_date` - An date when the certificate becomes inactive
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Transfer AS2 Certificate using the `certificate_id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Transfer AS2 Certificate using the `certificate_id`. For example:
+
+```console
+% terraform import aws_transfer_certificate.example c-4221a88afd5f4362a
+```
+
+<!-- cache-key: cdktf-0.18.0 input-9e7f080d0a6c4946e22084c4f2ae3c03144eb7cd8a58f89d9fd2f1afa2ea612e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/transfer_connector.html.markdown b/website/docs/cdktf/python/r/transfer_connector.html.markdown
new file mode 100644
index 00000000000..ebd986ca5e0
--- /dev/null
+++ b/website/docs/cdktf/python/r/transfer_connector.html.markdown
@@ -0,0 +1,124 @@
+---
+subcategory: "Transfer Family"
+layout: "aws"
+page_title: "AWS: aws_transfer_connector"
+description: |-
+  Provides a AWS Transfer AS2 Connector Resource
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_transfer_connector
+
+Provides a AWS Transfer AS2 Connector resource.
+
+## Example Usage
+
+### Basic
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.transfer_connector import TransferConnector
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        TransferConnector(self, "example",
+            access_role=test.arn,
+            as2_config=TransferConnectorAs2Config(
+                compression="DISABLED",
+                encryption_algorithm="AWS128_CBC",
+                local_profile_id=local.profile_id,
+                mdn_response="NONE",
+                mdn_signing_algorithm="NONE",
+                message_subject="For Connector",
+                partner_profile_id=partner.profile_id,
+                signing_algorithm="NONE"
+            ),
+            url="http://www.test.com"
+        )
+```
+
+### SFTP Connector
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.transfer_connector import TransferConnector
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        TransferConnector(self, "example",
+            access_role=test.arn,
+            sftp_config=TransferConnectorSftpConfig(
+                trusted_host_keys=["ssh-rsa AAAAB3NYourKeysHere"],
+                user_secret_id=Token.as_string(aws_secretsmanager_secret_example.id)
+            ),
+            url="sftp://test.com"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `access_role` - (Required) The IAM Role which provides read and write access to the parent directory of the file location mentioned in the StartFileTransfer request.
+* `as2_config` - (Optional) Either SFTP or AS2 is configured.The parameters to configure for the connector object. Fields documented below.
+* `logging_role` - (Optional) The IAM Role which is required for allowing the connector to turn on CloudWatch logging for Amazon S3 events.
+* `sftp_config` - (Optional) Either SFTP or AS2 is configured.The parameters to configure for the connector object. Fields documented below.
+* `url` - (Required) The URL of the partners AS2 endpoint or SFTP endpoint.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### As2Config Details
+
+* `compression` - (Required) Specifies weather AS2 file is compressed. The valud values are ZLIB and  DISABLED.
+* `encryption_algorithm` - (Required) The algorithm that is used to encrypt the file. The valid values are AES128_CBC | AES192_CBC | AES256_CBC | NONE.
+* `local_profile_id` - (Required) The unique identifier for the AS2 local profile.
+* `mdn_response` - (Required) Used for outbound requests to determine if a partner response for transfers is synchronous or asynchronous. The valid values are SYNC and NONE.
+* `mdn_signing_algorithm` - (Optional) The signing algorithm for the Mdn response. The valid values are SHA256 | SHA384 | SHA512 | SHA1 | NONE | DEFAULT.
+* `message_subject` - (Optional) Used as the subject HTTP header attribute in AS2 messages that are being sent with the connector.
+* `partner_profile_id` - (Required) The unique identifier for the AS2 partner profile.
+* `signing_algorithm` - (Required) The algorithm that is used to sign AS2 messages sent with the connector. The valid values are SHA256 | SHA384 | SHA512 | SHA1 | NONE .
+
+### SftpConfig Details
+
+* `trusted_host_keys` - (Required) A list of public portion of the host key, or keys, that are used to authenticate the user to the external server to which you are connecting.(https://docs.aws.amazon.com/transfer/latest/userguide/API_SftpConnectorConfig.html)
+* `user_secret_id` - (Required) The identifier for the secret (in AWS Secrets Manager) that contains the SFTP user's private key, password, or both. The identifier can be either the Amazon Resource Name (ARN) or the name of the secret.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the connector.
+* `connector_id`  - The unique identifier for the AS2 profile or SFTP Profile.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Transfer AS2 Connector using the `connector_id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Transfer AS2 Connector using the `connector_id`. For example:
+
+```console
+% terraform import aws_transfer_connector.example c-4221a88afd5f4362a
+```
+
+<!-- cache-key: cdktf-0.18.0 input-08a2d3ed33597d19d5aea6b0a9938d36219bbcfc9565866ef46ddd1ae4b69a1b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/transfer_profile.html.markdown b/website/docs/cdktf/python/r/transfer_profile.html.markdown
new file mode 100644
index 00000000000..fae0e545212
--- /dev/null
+++ b/website/docs/cdktf/python/r/transfer_profile.html.markdown
@@ -0,0 +1,76 @@
+---
+subcategory: "Transfer Family"
+layout: "aws"
+page_title: "AWS: aws_transfer_profile"
+description: |-
+  Provides a AWS Transfer AS2 Profile Resource
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_transfer_profile
+
+Provides a AWS Transfer AS2 Profile resource.
+
+## Example Usage
+
+### Basic
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.transfer_profile import TransferProfile
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, profileType):
+        super().__init__(scope, name)
+        TransferProfile(self, "example",
+            as2_id="example",
+            certificate_ids=[
+                Token.as_string(aws_transfer_certificate_example.certificate_id)
+            ],
+            usage="LOCAL",
+            profile_type=profile_type
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `as2_id` - (Required) The As2Id is the AS2 name as defined in the RFC 4130. For inbound ttransfers this is the AS2 From Header for the AS2 messages sent from the partner. For Outbound messages this is the AS2 To Header for the AS2 messages sent to the partner. his ID cannot include spaces.
+* `certificate_ids` - (Optional) The list of certificate Ids from the imported certificate operation.
+* `profile_type` - (Required) The profile type should be LOCAL or PARTNER.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the profile.
+* `profile_id`  - The unique identifier for the AS2 profile.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Transfer AS2 Profile using the `profile_id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Transfer AS2 Profile using the `profile_id`. For example:
+
+```console
+% terraform import aws_transfer_profile.example p-4221a88afd5f4362a
+```
+
+<!-- cache-key: cdktf-0.18.0 input-16bf118d7f42726eb3b4479223e202a1b8630bdd949a41b0aec899a9608267bf -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/transfer_server.html.markdown b/website/docs/cdktf/python/r/transfer_server.html.markdown
new file mode 100644
index 00000000000..312318574d3
--- /dev/null
+++ b/website/docs/cdktf/python/r/transfer_server.html.markdown
@@ -0,0 +1,285 @@
+---
+subcategory: "Transfer Family"
+layout: "aws"
+page_title: "AWS: aws_transfer_server"
+description: |-
+  Provides a AWS Transfer Server resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_transfer_server
+
+Provides a AWS Transfer Server resource.
+
+~> **NOTE on AWS IAM permissions:** If the `endpoint_type` is set to `VPC`, the `ec2:DescribeVpcEndpoints` and `ec2:ModifyVpcEndpoint` [actions](https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonec2.html#amazonec2-actions-as-permissions) are used.
+
+~> **NOTE:** Use the [`aws_transfer_tag`](transfer_tag.html) resource to manage the system tags used for [custom hostnames](https://docs.aws.amazon.com/transfer/latest/userguide/requirements-dns.html#tag-custom-hostname-cdk).
+
+## Example Usage
+
+### Basic
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.transfer_server import TransferServer
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        TransferServer(self, "example",
+            tags={
+                "Name": "Example"
+            }
+        )
+```
+
+### Security Policy Name
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.transfer_server import TransferServer
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        TransferServer(self, "example",
+            security_policy_name="TransferSecurityPolicy-2020-06"
+        )
+```
+
+### VPC Endpoint
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.transfer_server import TransferServer
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        TransferServer(self, "example",
+            endpoint_details=TransferServerEndpointDetails(
+                address_allocation_ids=[Token.as_string(aws_eip_example.id)],
+                subnet_ids=[Token.as_string(aws_subnet_example.id)],
+                vpc_id=Token.as_string(aws_vpc_example.id)
+            ),
+            endpoint_type="VPC"
+        )
+```
+
+### AWS Directory authentication
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.transfer_server import TransferServer
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        TransferServer(self, "example",
+            directory_id=Token.as_string(aws_directory_service_directory_example.id),
+            identity_provider_type="AWS_DIRECTORY_SERVICE"
+        )
+```
+
+### AWS Lambda authentication
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.transfer_server import TransferServer
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        TransferServer(self, "example",
+            function=Token.as_string(aws_lambda_identity_provider_example.arn),
+            identity_provider_type="AWS_LAMBDA"
+        )
+```
+
+### Protocols
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.transfer_server import TransferServer
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        TransferServer(self, "example",
+            certificate=Token.as_string(aws_acm_certificate_example.arn),
+            endpoint_details=TransferServerEndpointDetails(
+                subnet_ids=[Token.as_string(aws_subnet_example.id)],
+                vpc_id=Token.as_string(aws_vpc_example.id)
+            ),
+            endpoint_type="VPC",
+            identity_provider_type="API_GATEWAY",
+            protocols=["FTP", "FTPS"],
+            url="${" + aws_api_gateway_deployment_example.invoke_url + "${" + aws_api_gateway_resource_example.path + "}"
+        )
+```
+
+### Using Structured Logging Destinations
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudwatch_log_group import CloudwatchLogGroup
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.iam_role import IamRole
+from imports.aws.transfer_server import TransferServer
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        transfer = CloudwatchLogGroup(self, "transfer",
+            name_prefix="transfer_test_"
+        )
+        transfer_assume_role = DataAwsIamPolicyDocument(self, "transfer_assume_role",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["sts:AssumeRole"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["transfer.amazonaws.com"],
+                    type="Service"
+                )
+                ]
+            )
+            ]
+        )
+        iam_for_transfer = IamRole(self, "iam_for_transfer",
+            assume_role_policy=Token.as_string(transfer_assume_role.json),
+            managed_policy_arns=["arn:aws:iam::aws:policy/service-role/AWSTransferLoggingAccess"
+            ],
+            name_prefix="iam_for_transfer_"
+        )
+        aws_transfer_server_transfer = TransferServer(self, "transfer_3",
+            endpoint_type="PUBLIC",
+            logging_role=iam_for_transfer.arn,
+            protocols=["SFTP"],
+            structured_log_destinations=["${" + transfer.arn + "}:*"]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_transfer_server_transfer.override_logical_id("transfer")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `certificate` - (Optional) The Amazon Resource Name (ARN) of the AWS Certificate Manager (ACM) certificate. This is required when `protocols` is set to `FTPS`
+* `domain` - (Optional) The domain of the storage system that is used for file transfers. Valid values are: `S3` and `EFS`. The default value is `S3`.
+* `protocols` - (Optional) Specifies the file transfer protocol or protocols over which your file transfer protocol client can connect to your server's endpoint. This defaults to `SFTP` . The available protocols are:
+    * `AS2`: File transfer over Applicability Statement 2
+    * `SFTP`: File transfer over SSH
+    * `FTPS`: File transfer with TLS encryption
+    * `FTP`: Unencrypted file transfer
+* `endpoint_details` - (Optional) The virtual private cloud (VPC) endpoint settings that you want to configure for your SFTP server. Fields documented below.
+* `endpoint_type` - (Optional) The type of endpoint that you want your SFTP server connect to. If you connect to a `VPC` (or `VPC_ENDPOINT`), your SFTP server isn't accessible over the public internet. If you want to connect your SFTP server via public internet, set `PUBLIC`.  Defaults to `PUBLIC`.
+* `invocation_role` - (Optional) Amazon Resource Name (ARN) of the IAM role used to authenticate the user account with an `identity_provider_type` of `API_GATEWAY`.
+* `host_key` - (Optional) RSA, ECDSA, or ED25519 private key (e.g., as generated by the `ssh-keygen -t rsa -b 2048 -N "" -m PEM -f my-new-server-key`, `ssh-keygen -t ecdsa -b 256 -N "" -m PEM -f my-new-server-key` or `ssh-keygen -t ed25519 -N "" -f my-new-server-key` commands).
+* `url` - (Optional) - URL of the service endpoint used to authenticate users with an `identity_provider_type` of `API_GATEWAY`.
+* `identity_provider_type` - (Optional) The mode of authentication enabled for this service. The default value is `SERVICE_MANAGED`, which allows you to store and access SFTP user credentials within the service. `API_GATEWAY` indicates that user authentication requires a call to an API Gateway endpoint URL provided by you to integrate an identity provider of your choice. Using `AWS_DIRECTORY_SERVICE` will allow for authentication against AWS Managed Active Directory or Microsoft Active Directory in your on-premises environment, or in AWS using AD Connectors. Use the `AWS_LAMBDA` value to directly use a Lambda function as your identity provider. If you choose this value, you must specify the ARN for the lambda function in the `function` argument.
+* `directory_id` - (Optional) The directory service ID of the directory service you want to connect to with an `identity_provider_type` of `AWS_DIRECTORY_SERVICE`.
+* `function` - (Optional) The ARN for a lambda function to use for the Identity provider.
+* `logging_role` - (Optional) Amazon Resource Name (ARN) of an IAM role that allows the service to write your SFTP users’ activity to your Amazon CloudWatch logs for monitoring and auditing purposes.
+* `force_destroy` - (Optional) A boolean that indicates all users associated with the server should be deleted so that the Server can be destroyed without error. The default value is `false`. This option only applies to servers configured with a `SERVICE_MANAGED` `identity_provider_type`.
+* `post_authentication_login_banner`- (Optional) Specify a string to display when users connect to a server. This string is displayed after the user authenticates. The SFTP protocol does not support post-authentication display banners.
+* `pre_authentication_login_banner`- (Optional) Specify a string to display when users connect to a server. This string is displayed before the user authenticates.
+* `protocol_details`- (Optional) The protocol settings that are configured for your server.
+* `security_policy_name` - (Optional) Specifies the name of the security policy that is attached to the server. Possible values are `TransferSecurityPolicy-2018-11`, `TransferSecurityPolicy-2020-06`, `TransferSecurityPolicy-FIPS-2020-06`, `TransferSecurityPolicy-2022-03` and `TransferSecurityPolicy-2023-05`. Default value is: `TransferSecurityPolicy-2018-11`.
+* `structured_log_destinations` - (Optional) A set of ARNs of destinations that will receive structured logs from the transfer server such as CloudWatch Log Group ARNs. If provided this enables the transfer server to emit structured logs to the specified locations.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `workflow_details` - (Optional) Specifies the workflow details. See Workflow Details below.
+
+### Endpoint Details
+
+* `address_allocation_ids` - (Optional) A list of address allocation IDs that are required to attach an Elastic IP address to your SFTP server's endpoint. This property can only be used when `endpoint_type` is set to `VPC`.
+* `security_group_ids` - (Optional) A list of security groups IDs that are available to attach to your server's endpoint. If no security groups are specified, the VPC's default security groups are automatically assigned to your endpoint. This property can only be used when `endpoint_type` is set to `VPC`.
+* `subnet_ids` - (Optional) A list of subnet IDs that are required to host your SFTP server endpoint in your VPC. This property can only be used when `endpoint_type` is set to `VPC`.
+* `vpc_endpoint_id` - (Optional) The ID of the VPC endpoint. This property can only be used when `endpoint_type` is set to `VPC_ENDPOINT`
+* `vpc_id` - (Optional) The VPC ID of the virtual private cloud in which the SFTP server's endpoint will be hosted. This property can only be used when `endpoint_type` is set to `VPC`.
+
+### Protocol Details
+
+* `as2_transports` - (Optional) Indicates the transport method for the AS2 messages. Currently, only `HTTP` is supported.
+* `passive_ip` - (Optional) Indicates passive mode, for FTP and FTPS protocols. Enter a single IPv4 address, such as the public IP address of a firewall, router, or load balancer.
+* `set_stat_option` - (Optional) Use to ignore the error that is generated when the client attempts to use `SETSTAT` on a file you are uploading to an S3 bucket. Valid values: `DEFAULT`, `ENABLE_NO_OP`.
+* `tls_session_resumption_mode` - (Optional) A property used with Transfer Family servers that use the FTPS protocol. Provides a mechanism to resume or share a negotiated secret key between the control and data connection for an FTPS session. Valid values: `DISABLED`, `ENABLED`, `ENFORCED`.
+  
+### Workflow Details
+
+* `on_upload` - (Optional) A trigger that starts a workflow: the workflow begins to execute after a file is uploaded. See Workflow Detail below.
+* `on_partial_upload` - (Optional) A trigger that starts a workflow if a file is only partially uploaded. See Workflow Detail below.
+
+#### Workflow Detail
+
+* `execution_role` - (Required) Includes the necessary permissions for S3, EFS, and Lambda operations that Transfer can assume, so that all workflow steps can operate on the required resources.
+* `workflow_id` - (Required)  A unique identifier for the workflow.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of Transfer Server
+* `id`  - The Server ID of the Transfer Server (e.g., `s-12345678`)
+* `endpoint` - The endpoint of the Transfer Server (e.g., `s-12345678.server.transfer.REGION.amazonaws.com`)
+* `host_key_fingerprint` - This value contains the message-digest algorithm (MD5) hash of the server's host key. This value is equivalent to the output of the `ssh-keygen -l -E md5 -f my-new-server-key` command.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Transfer Servers using the server `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Transfer Servers using the server `id`. For example:
+
+```console
+% terraform import aws_transfer_server.example s-12345678
+```
+
+Certain resource arguments, such as `host_key`, cannot be read via the API and imported into Terraform. Terraform will display a difference for these arguments the first run after import if declared in the Terraform configuration for an imported resource.
+
+<!-- cache-key: cdktf-0.18.0 input-ad0054a3522d24a16b0248e7bf252083058382ba661c98eb47eb333f6a02723b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/transfer_ssh_key.html.markdown b/website/docs/cdktf/python/r/transfer_ssh_key.html.markdown
new file mode 100644
index 00000000000..5ee57593493
--- /dev/null
+++ b/website/docs/cdktf/python/r/transfer_ssh_key.html.markdown
@@ -0,0 +1,126 @@
+---
+subcategory: "Transfer Family"
+layout: "aws"
+page_title: "AWS: aws_transfer_ssh_key"
+description: |-
+  Provides a AWS Transfer SSH Public Key resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_transfer_ssh_key
+
+Provides a AWS Transfer User SSH Key resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.iam_role import IamRole
+from imports.aws.iam_role_policy import IamRolePolicy
+from imports.aws.transfer_server import TransferServer
+from imports.aws.transfer_ssh_key import TransferSshKey
+from imports.aws.transfer_user import TransferUser
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = TransferServer(self, "example",
+            identity_provider_type="SERVICE_MANAGED",
+            tags={
+                "NAME": "tf-acc-test-transfer-server"
+            }
+        )
+        assume_role = DataAwsIamPolicyDocument(self, "assume_role",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["sts:AssumeRole"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["transfer.amazonaws.com"],
+                    type="Service"
+                )
+                ]
+            )
+            ]
+        )
+        data_aws_iam_policy_document_example = DataAwsIamPolicyDocument(self, "example_2",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["s3:*"],
+                effect="Allow",
+                resources=["*"],
+                sid="AllowFullAccesstoS3"
+            )
+            ]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_iam_policy_document_example.override_logical_id("example")
+        aws_iam_role_example = IamRole(self, "example_3",
+            assume_role_policy=Token.as_string(assume_role.json),
+            name="tf-test-transfer-user-iam-role"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_role_example.override_logical_id("example")
+        aws_iam_role_policy_example = IamRolePolicy(self, "example_4",
+            name="tf-test-transfer-user-iam-policy",
+            policy=Token.as_string(data_aws_iam_policy_document_example.json),
+            role=Token.as_string(aws_iam_role_example.id)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_role_policy_example.override_logical_id("example")
+        aws_transfer_user_example = TransferUser(self, "example_5",
+            role=Token.as_string(aws_iam_role_example.arn),
+            server_id=example.id,
+            tags={
+                "NAME": "tftestuser"
+            },
+            user_name="tftestuser"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_transfer_user_example.override_logical_id("example")
+        aws_transfer_ssh_key_example = TransferSshKey(self, "example_6",
+            body="... SSH key ...",
+            server_id=example.id,
+            user_name=Token.as_string(aws_transfer_user_example.user_name)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_transfer_ssh_key_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `server_id` - (Requirement) The Server ID of the Transfer Server (e.g., `s-12345678`)
+* `user_name` - (Requirement) The name of the user account that is assigned to one or more servers.
+* `body` - (Requirement) The public key portion of an SSH key pair.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Transfer SSH Public Key using the `server_id` and `user_name` and `ssh_public_key_id` separated by `/`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Transfer SSH Public Key using the `server_id` and `user_name` and `ssh_public_key_id` separated by `/`. For example:
+
+```console
+% terraform import aws_transfer_ssh_key.bar s-12345678/test-username/key-12345
+```
+
+<!-- cache-key: cdktf-0.18.0 input-f16407da495aabd5e5cb11259213032844864d47c447730f78f40b9901749b2e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/transfer_tag.html.markdown b/website/docs/cdktf/python/r/transfer_tag.html.markdown
new file mode 100644
index 00000000000..4a6de42f3e8
--- /dev/null
+++ b/website/docs/cdktf/python/r/transfer_tag.html.markdown
@@ -0,0 +1,82 @@
+---
+subcategory: "Transfer Family"
+layout: "aws"
+page_title: "AWS: aws_transfer_tag"
+description: |-
+  Manages an individual Transfer Family resource tag
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_transfer_tag
+
+Manages an individual Transfer Family resource tag. This resource should only be used in cases where Transfer Family resources are created outside Terraform (e.g., Servers without AWS Management Console) or the tag key has the `aws:` prefix.
+
+~> **NOTE:** This tagging resource should not be combined with the Terraform resource for managing the parent resource. For example, using `aws_transfer_server` and `aws_transfer_tag` to manage tags of the same server will cause a perpetual difference where the `aws_transfer_server` resource will try to remove the tag being added by the `aws_transfer_tag` resource.
+
+~> **NOTE:** This tagging resource does not use the [provider `ignore_tags` configuration](/docs/providers/aws/index.html#ignore_tags).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.transfer_server import TransferServer
+from imports.aws.transfer_tag import TransferTag
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = TransferServer(self, "example",
+            identity_provider_type="SERVICE_MANAGED"
+        )
+        TransferTag(self, "hostname",
+            key="aws:transfer:customHostname",
+            resource_arn=example.arn,
+            value="example.com"
+        )
+        TransferTag(self, "zone_id",
+            key="aws:transfer:route53HostedZoneId",
+            resource_arn=example.arn,
+            value="/hostedzone/MyHostedZoneId"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `resource_arn` - (Required) Amazon Resource Name (ARN) of the Transfer Family resource to tag.
+* `key` - (Required) Tag name.
+* `value` - (Required) Tag value.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Transfer Family resource identifier and key, separated by a comma (`,`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_transfer_tag` using the Transfer Family resource identifier and key, separated by a comma (`,`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_transfer_tag` using the Transfer Family resource identifier and key, separated by a comma (`,`). For example:
+
+```console
+% terraform import aws_transfer_tag.example arn:aws:transfer:us-east-1:123456789012:server/s-1234567890abcdef0,Name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-e2764988d2c43be249db77ec49fff55b3d8ec29f4531f3fe791ef9e27ae5b2a6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/transfer_user.html.markdown b/website/docs/cdktf/python/r/transfer_user.html.markdown
new file mode 100644
index 00000000000..d497f5c69f8
--- /dev/null
+++ b/website/docs/cdktf/python/r/transfer_user.html.markdown
@@ -0,0 +1,158 @@
+---
+subcategory: "Transfer Family"
+layout: "aws"
+page_title: "AWS: aws_transfer_user"
+description: |-
+  Provides a AWS Transfer User resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_transfer_user
+
+Provides a AWS Transfer User resource. Managing SSH keys can be accomplished with the [`aws_transfer_ssh_key` resource](/docs/providers/aws/r/transfer_ssh_key.html).
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.iam_role import IamRole
+from imports.aws.iam_role_policy import IamRolePolicy
+from imports.aws.transfer_server import TransferServer
+from imports.aws.transfer_user import TransferUser
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        foo = TransferServer(self, "foo",
+            identity_provider_type="SERVICE_MANAGED",
+            tags={
+                "NAME": "tf-acc-test-transfer-server"
+            }
+        )
+        assume_role = DataAwsIamPolicyDocument(self, "assume_role",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["sts:AssumeRole"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["transfer.amazonaws.com"],
+                    type="Service"
+                )
+                ]
+            )
+            ]
+        )
+        data_aws_iam_policy_document_foo = DataAwsIamPolicyDocument(self, "foo_2",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["s3:*"],
+                effect="Allow",
+                resources=["*"],
+                sid="AllowFullAccesstoS3"
+            )
+            ]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_iam_policy_document_foo.override_logical_id("foo")
+        aws_iam_role_foo = IamRole(self, "foo_3",
+            assume_role_policy=Token.as_string(assume_role.json),
+            name="tf-test-transfer-user-iam-role"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_role_foo.override_logical_id("foo")
+        aws_iam_role_policy_foo = IamRolePolicy(self, "foo_4",
+            name="tf-test-transfer-user-iam-policy",
+            policy=Token.as_string(data_aws_iam_policy_document_foo.json),
+            role=Token.as_string(aws_iam_role_foo.id)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_iam_role_policy_foo.override_logical_id("foo")
+        aws_transfer_user_foo = TransferUser(self, "foo_5",
+            home_directory_mappings=[TransferUserHomeDirectoryMappings(
+                entry="/test.pdf",
+                target="/bucket3/test-path/tftestuser.pdf"
+            )
+            ],
+            home_directory_type="LOGICAL",
+            role=Token.as_string(aws_iam_role_foo.arn),
+            server_id=foo.id,
+            user_name="tftestuser"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_transfer_user_foo.override_logical_id("foo")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `server_id` - (Required) The Server ID of the Transfer Server (e.g., `s-12345678`)
+* `user_name` - (Required) The name used for log in to your SFTP server.
+* `home_directory` - (Optional) The landing directory (folder) for a user when they log in to the server using their SFTP client.  It should begin with a `/`.  The first item in the path is the name of the home bucket (accessible as `${Transfer:HomeBucket}` in the policy) and the rest is the home directory (accessible as `${Transfer:HomeDirectory}` in the policy). For example, `/example-bucket-1234/username` would set the home bucket to `example-bucket-1234` and the home directory to `username`.
+* `home_directory_mappings` - (Optional) Logical directory mappings that specify what S3 paths and keys should be visible to your user and how you want to make them visible. See [Home Directory Mappings](#home-directory-mappings) below.
+* `home_directory_type` - (Optional) The type of landing directory (folder) you mapped for your users' home directory. Valid values are `PATH` and `LOGICAL`.
+* `policy` - (Optional) An IAM JSON policy document that scopes down user access to portions of their Amazon S3 bucket. IAM variables you can use inside this policy include `${Transfer:UserName}`, `${Transfer:HomeDirectory}`, and `${Transfer:HomeBucket}`. Since the IAM variable syntax matches Terraform's interpolation syntax, they must be escaped inside Terraform configuration strings (`$${Transfer:UserName}`).  These are evaluated on-the-fly when navigating the bucket.
+* `posix_profile` - (Optional) Specifies the full POSIX identity, including user ID (Uid), group ID (Gid), and any secondary groups IDs (SecondaryGids), that controls your users' access to your Amazon EFS file systems. See [Posix Profile](#posix-profile) below.
+* `role` - (Required) Amazon Resource Name (ARN) of an IAM role that allows the service to control your user’s access to your Amazon S3 bucket.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Home Directory Mappings
+
+* `entry` - (Required) Represents an entry and a target.
+* `target` - (Required) Represents the map target.
+
+The `Restricted` option is achieved using the following mapping:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+### Posix Profile
+
+* `gid` - (Required) The POSIX group ID used for all EFS operations by this user.
+* `uid` - (Required) The POSIX user ID used for all EFS operations by this user.
+* `secondary_gids` - (Optional) The secondary POSIX group IDs used for all EFS operations by this user.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of Transfer User
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `delete` - (Default `10m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Transfer Users using the `server_id` and `user_name` separated by `/`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Transfer Users using the `server_id` and `user_name` separated by `/`. For example:
+
+```console
+% terraform import aws_transfer_user.bar s-12345678/test-username
+```
+
+<!-- cache-key: cdktf-0.18.0 input-20283ed3a3e6abff667008f255442da0f4606486f3db71039d382ec9cd99e4b2 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/transfer_workflow.html.markdown b/website/docs/cdktf/python/r/transfer_workflow.html.markdown
new file mode 100644
index 00000000000..79bd5eee54c
--- /dev/null
+++ b/website/docs/cdktf/python/r/transfer_workflow.html.markdown
@@ -0,0 +1,180 @@
+---
+subcategory: "Transfer Family"
+layout: "aws"
+page_title: "AWS: aws_transfer_workflow"
+description: |-
+  Provides a AWS Transfer Workflow resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_transfer_workflow
+
+Provides a AWS Transfer Workflow resource.
+
+## Example Usage
+
+### Basic single step example
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.transfer_workflow import TransferWorkflow
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        TransferWorkflow(self, "example",
+            steps=[TransferWorkflowSteps(
+                delete_step_details=TransferWorkflowStepsDeleteStepDetails(
+                    name="example",
+                    source_file_location="$${original.file}"
+                ),
+                type="DELETE"
+            )
+            ]
+        )
+```
+
+### Multistep example
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.transfer_workflow import TransferWorkflow
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        TransferWorkflow(self, "example",
+            steps=[TransferWorkflowSteps(
+                custom_step_details=TransferWorkflowStepsCustomStepDetails(
+                    name="example",
+                    source_file_location="$${original.file}",
+                    target=Token.as_string(aws_lambda_function_example.arn),
+                    timeout_seconds=60
+                ),
+                type="CUSTOM"
+            ), TransferWorkflowSteps(
+                tag_step_details=TransferWorkflowStepsTagStepDetails(
+                    name="example",
+                    source_file_location="$${original.file}",
+                    tags=[TransferWorkflowStepsTagStepDetailsTags(
+                        key="Name",
+                        value="Hello World"
+                    )
+                    ]
+                ),
+                type="TAG"
+            )
+            ]
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `description` - (Optional) A textual description for the workflow.
+* `on_exception_steps` - (Optional) Specifies the steps (actions) to take if errors are encountered during execution of the workflow. See Workflow Steps below.
+* `steps` - (Required) Specifies the details for the steps that are in the specified workflow. See Workflow Steps below.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Workflow Steps
+
+* `copy_step_details` - (Optional) Details for a step that performs a file copy. See Copy Step Details below.
+* `custom_step_details` - (Optional) Details for a step that invokes a lambda function.
+* `decrypt_step_details` - (Optional) Details for a step that decrypts the file.
+* `delete_step_details` - (Optional) Details for a step that deletes the file.
+* `tag_step_details` - (Optional) Details for a step that creates one or more tags.
+* `type` - (Required) One of the following step types are supported. `COPY`, `CUSTOM`, `DECRYPT`, `DELETE`, and `TAG`.
+
+#### Copy Step Details
+
+* `destination_file_location` - (Optional) Specifies the location for the file being copied. Use ${Transfer:username} in this field to parametrize the destination prefix by username.
+* `name` - (Optional) The name of the step, used as an identifier.
+* `overwrite_existing` - (Optional) A flag that indicates whether or not to overwrite an existing file of the same name. The default is `FALSE`. Valid values are `TRUE` and `FALSE`.
+* `source_file_location` - (Optional) Specifies which file to use as input to the workflow step: either the output from the previous step, or the originally uploaded file for the workflow. Enter ${previous.file} to use the previous file as the input. In this case, this workflow step uses the output file from the previous workflow step as input. This is the default value. Enter ${original.file} to use the originally-uploaded file location as input for this step.
+
+#### Custom Step Details
+
+* `name` - (Optional) The name of the step, used as an identifier.
+* `source_file_location` - (Optional) Specifies which file to use as input to the workflow step: either the output from the previous step, or the originally uploaded file for the workflow. Enter ${previous.file} to use the previous file as the input. In this case, this workflow step uses the output file from the previous workflow step as input. This is the default value. Enter ${original.file} to use the originally-uploaded file location as input for this step.
+* `target` - (Optional) The ARN for the lambda function that is being called.
+* `timeout_seconds` - (Optional) Timeout, in seconds, for the step.
+
+#### Decrypt Step Details
+
+* `destination_file_location` - (Optional) Specifies the location for the file being copied. Use ${Transfer:username} in this field to parametrize the destination prefix by username.
+* `name` - (Optional) The name of the step, used as an identifier.
+* `overwrite_existing` - (Optional) A flag that indicates whether or not to overwrite an existing file of the same name. The default is `FALSE`. Valid values are `TRUE` and `FALSE`.
+* `source_file_location` - (Optional) Specifies which file to use as input to the workflow step: either the output from the previous step, or the originally uploaded file for the workflow. Enter ${previous.file} to use the previous file as the input. In this case, this workflow step uses the output file from the previous workflow step as input. This is the default value. Enter ${original.file} to use the originally-uploaded file location as input for this step.
+* `type` - (Required) The type of encryption used. Currently, this value must be `"PGP"`.
+
+#### Delete Step Details
+
+* `name` - (Optional) The name of the step, used as an identifier.
+* `source_file_location` - (Optional) Specifies which file to use as input to the workflow step: either the output from the previous step, or the originally uploaded file for the workflow. Enter ${previous.file} to use the previous file as the input. In this case, this workflow step uses the output file from the previous workflow step as input. This is the default value. Enter ${original.file} to use the originally-uploaded file location as input for this step.
+
+#### Tag Step Details
+
+* `name` - (Optional) The name of the step, used as an identifier.
+* `source_file_location` - (Optional) Specifies which file to use as input to the workflow step: either the output from the previous step, or the originally uploaded file for the workflow. Enter ${previous.file} to use the previous file as the input. In this case, this workflow step uses the output file from the previous workflow step as input. This is the default value. Enter ${original.file} to use the originally-uploaded file location as input for this step.
+* `tags` - (Optional) Array that contains from 1 to 10 key/value pairs. See S3 Tags below.
+
+##### Destination File Location
+
+* `efs_file_location` - (Optional) Specifies the details for the EFS file being copied.
+* `s3_file_location` - (Optional) Specifies the details for the S3 file being copied.
+
+###### EFS File Location
+
+* `file_system_id` - (Optional) The ID of the file system, assigned by Amazon EFS.
+* `path` - (Optional) The pathname for the folder being used by a workflow.
+
+###### S3 File Location
+
+* `bucket` - (Optional) Specifies the S3 bucket for the customer input file.
+* `key` - (Optional) The name assigned to the file when it was created in S3. You use the object key to retrieve the object.
+
+##### S3 Tag
+
+* `key` - (Required) The name assigned to the tag that you create.
+* `value` - (Required) The value that corresponds to the key.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Workflow ARN.
+* `id` - The Workflow id.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Transfer Workflows using the `worflow_id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Transfer Workflows using the `worflow_id`. For example:
+
+```console
+% terraform import aws_transfer_workflow.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-cd26b4eb2c7b6d9241f3db734757f36018a8ddd76361c4116bc6c49c94847364 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/verifiedaccess_group.html.markdown b/website/docs/cdktf/python/r/verifiedaccess_group.html.markdown
new file mode 100644
index 00000000000..0b5acd2825f
--- /dev/null
+++ b/website/docs/cdktf/python/r/verifiedaccess_group.html.markdown
@@ -0,0 +1,67 @@
+---
+subcategory: "Verified Access"
+layout: "aws"
+page_title: "AWS: aws_verifiedaccess_group"
+description: |-
+  Terraform resource for managing a Verified Access Group.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_verifiedaccess_group
+
+Terraform resource for managing a Verified Access Group.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.verifiedaccess_group import VerifiedaccessGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        VerifiedaccessGroup(self, "example",
+            verifiedaccess_instance_id=Token.as_string(aws_verifiedaccess_instance_example.id)
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `verifiedaccess_instance_id` - (Required) The id of the verified access instance this group is associated with.
+
+The following arguments are optional:
+
+* `description` - (Optional) Description of the verified access group.
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `policy_docment` - (Optional) The policy document that is associated with this resource.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `creation_time` - Timestamp when the access group was created.
+* `deletion_time` - Timestamp when the access group was deleted.
+* `last_updated_time` - Timestamp when the access group was last updated.
+* `owner` - AWS account number owning this resource.
+* `verifiedaccess_group_arn` - ARN of this verified acess group.
+* `verifiedaccess_group_id` - ID of this verified access group.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `60m`)
+* `update` - (Default `180m`)
+* `delete` - (Default `90m`)
+
+<!-- cache-key: cdktf-0.18.0 input-74642a11cfb0cd052c78234e7ffeb2b3744dcc462e3e42eceff666725d831322 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/verifiedaccess_instance.html.markdown b/website/docs/cdktf/python/r/verifiedaccess_instance.html.markdown
new file mode 100644
index 00000000000..8fe076d1f01
--- /dev/null
+++ b/website/docs/cdktf/python/r/verifiedaccess_instance.html.markdown
@@ -0,0 +1,104 @@
+---
+subcategory: "Verified Access"
+layout: "aws"
+page_title: "AWS: aws_verifiedaccess_instance"
+description: |-
+  Terraform resource for managing a Verified Access Instance.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_verifiedaccess_instance
+
+Terraform resource for managing a Verified Access Instance.
+
+## Example Usage
+
+### Basic
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.verifiedaccess_instance import VerifiedaccessInstance
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        VerifiedaccessInstance(self, "example",
+            description="example",
+            tags={
+                "Name": "example"
+            }
+        )
+```
+
+### With `fips_enabled`
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.verifiedaccess_instance import VerifiedaccessInstance
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        VerifiedaccessInstance(self, "example",
+            fips_enabled=True
+        )
+```
+
+## Argument Reference
+
+The following arguments are optional:
+
+* `description` - (Optional) A description for the AWS Verified Access Instance.
+* `fips_enabled` - (Optional, Forces new resource) Enable or disable support for Federal Information Processing Standards (FIPS) on the AWS Verified Access Instance.
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `creation_time` - The time that the Verified Access Instance was created.
+* `id` - The ID of the AWS Verified Access Instance.
+* `last_updated_time` - The time that the Verified Access Instance was last updated.
+* `verified_access_trust_providers` - One or more blocks of providing information about the AWS Verified Access Trust Providers. See [verified_access_trust_providers](#verified_access_trust_providers) below for details.One or more blocks
+
+### verified_access_trust_providers
+
+Each `verified_access_trust_providers` supports the following argument:
+
+* `description` - The description of trust provider.
+* `device_trust_provider_type` - The type of device-based trust provider.
+* `trust_provider_type` - The type of trust provider (user- or device-based).
+* `user_trust_provider_type` - The type of user-based trust provider.
+* `verified_access_trust_provider_id` - The ID of the trust provider.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Verified Access Instances using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Verified Access Instances using the  `id`. For example:
+
+```console
+% terraform import aws_verifiedaccess_instance.example vai-1234567890abcdef0
+```
+
+<!-- cache-key: cdktf-0.18.0 input-c933a4a83a27d8a7c453603ace502b409683c5a0ec3444abd304067d056ba8ad -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/verifiedaccess_instance_logging_configuration.html.markdown b/website/docs/cdktf/python/r/verifiedaccess_instance_logging_configuration.html.markdown
new file mode 100644
index 00000000000..66978f0aa77
--- /dev/null
+++ b/website/docs/cdktf/python/r/verifiedaccess_instance_logging_configuration.html.markdown
@@ -0,0 +1,233 @@
+---
+subcategory: "Verified Access"
+layout: "aws"
+page_title: "AWS: aws_verifiedaccess_instance_logging_configuration"
+description: |-
+  Terraform resource for managing a Verified Access Instance Logging Configuration.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_verifiedaccess_instance_logging_configuration
+
+Terraform resource for managing a Verified Access Logging Configuration.
+
+## Example Usage
+
+### With CloudWatch Logging
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.verifiedaccess_instance_logging_configuration import VerifiedaccessInstanceLoggingConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        VerifiedaccessInstanceLoggingConfiguration(self, "example",
+            access_logs=VerifiedaccessInstanceLoggingConfigurationAccessLogs(
+                cloudwatch_logs=VerifiedaccessInstanceLoggingConfigurationAccessLogsCloudwatchLogs(
+                    enabled=True,
+                    log_group=Token.as_string(aws_cloudwatch_log_group_example.id)
+                )
+            ),
+            verifiedaccess_instance_id=Token.as_string(aws_verifiedaccess_instance_example.id)
+        )
+```
+
+### With Kinesis Data Firehose Logging
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.verifiedaccess_instance_logging_configuration import VerifiedaccessInstanceLoggingConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        VerifiedaccessInstanceLoggingConfiguration(self, "example",
+            access_logs=VerifiedaccessInstanceLoggingConfigurationAccessLogs(
+                kinesis_data_firehose=VerifiedaccessInstanceLoggingConfigurationAccessLogsKinesisDataFirehose(
+                    delivery_stream=Token.as_string(aws_kinesis_firehose_delivery_stream_example.name),
+                    enabled=True
+                )
+            ),
+            verifiedaccess_instance_id=Token.as_string(aws_verifiedaccess_instance_example.id)
+        )
+```
+
+### With S3 logging
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.verifiedaccess_instance_logging_configuration import VerifiedaccessInstanceLoggingConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        VerifiedaccessInstanceLoggingConfiguration(self, "example",
+            access_logs=VerifiedaccessInstanceLoggingConfigurationAccessLogs(
+                s3=VerifiedaccessInstanceLoggingConfigurationAccessLogsS3(
+                    bucket_name=Token.as_string(aws_s3_bucket_example.id),
+                    enabled=True,
+                    prefix="example"
+                )
+            ),
+            verifiedaccess_instance_id=Token.as_string(aws_verifiedaccess_instance_example.id)
+        )
+```
+
+### With all three logging options
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.verifiedaccess_instance_logging_configuration import VerifiedaccessInstanceLoggingConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        VerifiedaccessInstanceLoggingConfiguration(self, "example",
+            access_logs=VerifiedaccessInstanceLoggingConfigurationAccessLogs(
+                cloudwatch_logs=VerifiedaccessInstanceLoggingConfigurationAccessLogsCloudwatchLogs(
+                    enabled=True,
+                    log_group=Token.as_string(aws_cloudwatch_log_group_example.id)
+                ),
+                kinesis_data_firehose=VerifiedaccessInstanceLoggingConfigurationAccessLogsKinesisDataFirehose(
+                    delivery_stream=Token.as_string(aws_kinesis_firehose_delivery_stream_example.name),
+                    enabled=True
+                ),
+                s3=VerifiedaccessInstanceLoggingConfigurationAccessLogsS3(
+                    bucket_name=Token.as_string(aws_s3_bucket_example.id),
+                    enabled=True
+                )
+            ),
+            verifiedaccess_instance_id=Token.as_string(aws_verifiedaccess_instance_example.id)
+        )
+```
+
+### With `include_trust_context`
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.verifiedaccess_instance_logging_configuration import VerifiedaccessInstanceLoggingConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        VerifiedaccessInstanceLoggingConfiguration(self, "example",
+            access_logs=VerifiedaccessInstanceLoggingConfigurationAccessLogs(
+                include_trust_context=True
+            ),
+            verifiedaccess_instance_id=Token.as_string(aws_verifiedaccess_instance_example.id)
+        )
+```
+
+### With `log_version`
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.verifiedaccess_instance_logging_configuration import VerifiedaccessInstanceLoggingConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        VerifiedaccessInstanceLoggingConfiguration(self, "example",
+            access_logs=VerifiedaccessInstanceLoggingConfigurationAccessLogs(
+                log_version="ocsf-1.0.0-rc.2"
+            ),
+            verifiedaccess_instance_id=Token.as_string(aws_verifiedaccess_instance_example.id)
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `access_logs` - (Required) A block that specifies the configuration options for Verified Access instances. [Detailed below](#access_logs).
+* `verifiedaccess_instance_id` - (Required - Forces New resource) The ID of the Verified Access instance.
+
+### access_logs
+
+A `access_logs` block supports the following arguments:
+
+* `cloudwatch_logs` - (Optional) A block that specifies configures sending Verified Access logs to CloudWatch Logs. [Detailed below](#cloudwatch_logs).
+* `include_trust_context` - (Optional) Include trust data sent by trust providers into the logs.
+* `kinesis_data_firehose` - (Optional) A block that specifies configures sending Verified Access logs to Kinesis. [Detailed below](#kinesis_data_firehose).
+* `log_version` - (Optional) The logging version to use. Refer to [VerifiedAccessLogOptions](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_VerifiedAccessLogOptions.html) for the allowed values.
+* `s3` - (Optional) A block that specifies configures sending Verified Access logs to S3. [Detailed below](#s3).
+
+#### cloudwatch_logs
+
+A `cloudwatch_logs` block supports the following arguments:
+
+* `enabled` - (Required) Indicates whether logging is enabled.
+* `log_group` - (Optional) The name of the CloudWatch Logs Log Group.
+
+#### kinesis_data_firehose
+
+A `kinesis_data_firehose` block supports the following arguments:
+
+* `delivery_stream` - (Optional) The name of the delivery stream.
+* `enabled` - (Required) Indicates whether logging is enabled.
+
+#### s3
+
+A `s3` block supports the following arguments:
+
+* `bucket_name` - (Optional) The name of S3 bucket.
+* `bucket_owner` - (Optional) The ID of the AWS account that owns the Amazon S3 bucket.
+* `enabled` - (Required) Indicates whether logging is enabled.
+* `prefix` - (Optional) The bucket prefix.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Verified Access Logging Configuration using the Verified Access Instance `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Verified Access Logging Configuration using the Verified Access Instance `id`. For example:
+
+```console
+% terraform import aws_verifiedaccess_instance_logging_configuration.example vai-1234567890abcdef0
+```
+
+<!-- cache-key: cdktf-0.18.0 input-79065eedd6b6f9585bd07a6cdc493096940c3c74f302f0f330a123cc337d069b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/verifiedaccess_instance_trust_provider_attachment.html.markdown b/website/docs/cdktf/python/r/verifiedaccess_instance_trust_provider_attachment.html.markdown
new file mode 100644
index 00000000000..aa8a6220bb6
--- /dev/null
+++ b/website/docs/cdktf/python/r/verifiedaccess_instance_trust_provider_attachment.html.markdown
@@ -0,0 +1,84 @@
+---
+subcategory: "Verified Access"
+layout: "aws"
+page_title: "AWS: aws_verifiedaccess_instance_trust_provider_attachment"
+description: |-
+  Terraform resource for managing a Verified Access Instance Trust Provider Attachment.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_verifiedaccess_instance_trust_provider_attachment
+
+Terraform resource for managing a Verified Access Instance Trust Provider Attachment.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.verifiedaccess_instance import VerifiedaccessInstance
+from imports.aws.verifiedaccess_instance_trust_provider_attachment import VerifiedaccessInstanceTrustProviderAttachment
+from imports.aws.verifiedaccess_trust_provider import VerifiedaccessTrustProvider
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = VerifiedaccessInstance(self, "example")
+        aws_verifiedaccess_trust_provider_example =
+        VerifiedaccessTrustProvider(self, "example_1",
+            device_options=VerifiedaccessTrustProviderDeviceOptions(
+                tenant_id="example"
+            ),
+            device_trust_provider_type="jamf",
+            policy_reference_name="example",
+            trust_provider_type="device"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_verifiedaccess_trust_provider_example.override_logical_id("example")
+        aws_verifiedaccess_instance_trust_provider_attachment_example =
+        VerifiedaccessInstanceTrustProviderAttachment(self, "example_2",
+            verifiedaccess_instance_id=example.id,
+            verifiedaccess_trust_provider_id=Token.as_string(aws_verifiedaccess_trust_provider_example.id)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_verifiedaccess_instance_trust_provider_attachment_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `verifiedaccess_instance_id` - (Required) The ID of the Verified Access instance to attach the Trust Provider to.
+* `verifiedaccess_trust_provider_id` - (Required) The ID of the Verified Access trust provider.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - A combination of attributes, separated by a `/` to create a unique id: `verifiedaccess_instance_id`,`verifiedaccess_trust_provider_id`
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Verified Access Instance Trust Provider Attachments using the `verifiedaccess_instance_id` and `verifiedaccess_trust_provider_id` separated by a forward slash (`/`). For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Verified Access Instance Trust Provider Attachments using the `verifiedaccess_instance_id` and `verifiedaccess_trust_provider_id` separated by a forward slash (`/`). For example:
+
+```console
+% terraform import aws_verifiedaccess_instance_trust_provider_attachment.example vai-1234567890abcdef0/vatp-8012925589
+```
+
+<!-- cache-key: cdktf-0.18.0 input-0166dda69fa58c229770979a9c41f2063a0855d337e923d65532e9982cc3d392 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/verifiedaccess_trust_provider.html.markdown b/website/docs/cdktf/python/r/verifiedaccess_trust_provider.html.markdown
new file mode 100644
index 00000000000..4a8016f3a42
--- /dev/null
+++ b/website/docs/cdktf/python/r/verifiedaccess_trust_provider.html.markdown
@@ -0,0 +1,85 @@
+---
+subcategory: "Verified Access"
+layout: "aws"
+page_title: "AWS: aws_verifiedaccess_trust_provider"
+description: |-
+  Terraform resource for managing a Verified Access Trust Provider.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_verifiedaccess_trust_provider
+
+Terraform resource for managing a Verified Access Trust Provider.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.verifiedaccess_trust_provider import VerifiedaccessTrustProvider
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        VerifiedaccessTrustProvider(self, "example",
+            policy_reference_name="example",
+            trust_provider_type="user",
+            user_trust_provider_type="iam-identity-center"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `policy_reference_name` - (Required) The identifier to be used when working with policy rules.
+* `trust_provider_type` - (Required) The type of trust provider can be either user or device-based.
+
+The following arguments are optional:
+
+* `description` - (Optional) A description for the AWS Verified Access trust provider.
+* `device_options` - (Optional) A block of options for device identity based trust providers.
+* `device_trust_provider_type` (Optional) The type of device-based trust provider.
+* `oidc_options` - (Optional) The OpenID Connect details for an oidc-type, user-identity based trust provider.
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `user_trust_provider_type` - (Optional) The type of user-based trust provider.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the AWS Verified Access trust provider.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `60m`)
+* `update` - (Default `180m`)
+* `delete` - (Default `90m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Transfer Workflows using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Transfer Workflows using the  `id`. For example:
+
+```console
+% terraform import aws_verifiedaccess_trust_provider.example vatp-8012925589
+```
+
+<!-- cache-key: cdktf-0.18.0 input-2750aebf3d558cbde0da2f4c4cdd13becc482ee01d0d3f03dd896dff73393961 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/volume_attachment.html.markdown b/website/docs/cdktf/python/r/volume_attachment.html.markdown
new file mode 100644
index 00000000000..c705f9a853a
--- /dev/null
+++ b/website/docs/cdktf/python/r/volume_attachment.html.markdown
@@ -0,0 +1,104 @@
+---
+subcategory: "EBS (EC2)"
+layout: "aws"
+page_title: "AWS: aws_volume_attachment"
+description: |-
+  Provides an AWS EBS Volume Attachment
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_volume_attachment
+
+Provides an AWS EBS Volume Attachment as a top level resource, to attach and
+detach volumes from AWS Instances.
+
+~> **NOTE on EBS block devices:** If you use `ebs_block_device` on an `aws_instance`, Terraform will assume management over the full set of non-root EBS block devices for the instance, and treats additional block devices as drift. For this reason, `ebs_block_device` cannot be mixed with external `aws_ebs_volume` + `aws_volume_attachment` resources for a given instance.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.ebs_volume import EbsVolume
+from imports.aws.instance import Instance
+from imports.aws.volume_attachment import VolumeAttachment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = EbsVolume(self, "example",
+            availability_zone="us-west-2a",
+            size=1
+        )
+        web = Instance(self, "web",
+            ami="ami-21f78e11",
+            availability_zone="us-west-2a",
+            instance_type="t2.micro",
+            tags={
+                "Name": "HelloWorld"
+            }
+        )
+        VolumeAttachment(self, "ebs_att",
+            device_name="/dev/sdh",
+            instance_id=web.id,
+            volume_id=example.id
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `device_name` - (Required) The device name to expose to the instance (for
+example, `/dev/sdh` or `xvdh`).  See [Device Naming on Linux Instances][1] and [Device Naming on Windows Instances][2] for more information.
+* `instance_id` - (Required) ID of the Instance to attach to
+* `volume_id` - (Required) ID of the Volume to be attached
+* `force_detach` - (Optional, Boolean) Set to `true` if you want to force the
+volume to detach. Useful if previous attempts failed, but use this option only
+as a last resort, as this can result in **data loss**. See
+[Detaching an Amazon EBS Volume from an Instance][3] for more information.
+* `skip_destroy` - (Optional, Boolean) Set this to true if you do not wish
+to detach the volume from the instance to which it is attached at destroy
+time, and instead just remove the attachment from Terraform state. This is
+useful when destroying an instance which has volumes created by some other
+means attached.
+* `stop_instance_before_detaching` - (Optional, Boolean) Set this to true to ensure that the target instance is stopped
+before trying to detach the volume. Stops the instance, if it is not already stopped.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `device_name` - The device name exposed to the instance
+* `instance_id` - ID of the Instance
+* `volume_id` - ID of the Volume
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EBS Volume Attachments using `DEVICE_NAME:VOLUME_ID:INSTANCE_ID`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import EBS Volume Attachments using `DEVICE_NAME:VOLUME_ID:INSTANCE_ID`. For example:
+
+```console
+% terraform import aws_volume_attachment.example /dev/sdh:vol-049df61146c4d7901:i-12345678
+```
+
+[1]: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/device_naming.html#available-ec2-device-names
+[2]: https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/device_naming.html#available-ec2-device-names
+[3]: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-detaching-volume.html
+
+<!-- cache-key: cdktf-0.18.0 input-8d70c75bb952f6c2a4ba80ab20190c8861ad57f287b2752a94e208c0c56f0a76 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/vpc.html.markdown b/website/docs/cdktf/python/r/vpc.html.markdown
new file mode 100644
index 00000000000..fa7e81563c8
--- /dev/null
+++ b/website/docs/cdktf/python/r/vpc.html.markdown
@@ -0,0 +1,164 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_vpc"
+description: |-
+  Provides a VPC resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_vpc
+
+Provides a VPC resource.
+
+## Example Usage
+
+Basic usage:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.vpc import Vpc
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Vpc(self, "main",
+            cidr_block="10.0.0.0/16"
+        )
+```
+
+Basic usage with tags:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.vpc import Vpc
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Vpc(self, "main",
+            cidr_block="10.0.0.0/16",
+            instance_tenancy="default",
+            tags={
+                "Name": "main"
+            }
+        )
+```
+
+VPC with CIDR from AWS IPAM:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_region import DataAwsRegion
+from imports.aws.vpc import Vpc
+from imports.aws.vpc_ipam import VpcIpam
+from imports.aws.vpc_ipam_pool import VpcIpamPool
+from imports.aws.vpc_ipam_pool_cidr import VpcIpamPoolCidr
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        current = DataAwsRegion(self, "current")
+        test = VpcIpam(self, "test",
+            operating_regions=[VpcIpamOperatingRegions(
+                region_name=Token.as_string(current.name)
+            )
+            ]
+        )
+        aws_vpc_ipam_pool_test = VpcIpamPool(self, "test_2",
+            address_family="ipv4",
+            ipam_scope_id=test.private_default_scope_id,
+            locale=Token.as_string(current.name)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_vpc_ipam_pool_test.override_logical_id("test")
+        aws_vpc_ipam_pool_cidr_test = VpcIpamPoolCidr(self, "test_3",
+            cidr="172.20.0.0/16",
+            ipam_pool_id=Token.as_string(aws_vpc_ipam_pool_test.id)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_vpc_ipam_pool_cidr_test.override_logical_id("test")
+        aws_vpc_test = Vpc(self, "test_4",
+            depends_on=[aws_vpc_ipam_pool_cidr_test],
+            ipv4_ipam_pool_id=Token.as_string(aws_vpc_ipam_pool_test.id),
+            ipv4_netmask_length=28
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_vpc_test.override_logical_id("test")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `cidr_block` - (Optional) The IPv4 CIDR block for the VPC. CIDR can be explicitly set or it can be derived from IPAM using `ipv4_netmask_length`.
+* `instance_tenancy` - (Optional) A tenancy option for instances launched into the VPC. Default is `default`, which ensures that EC2 instances launched in this VPC use the EC2 instance tenancy attribute specified when the EC2 instance is launched. The only other option is `dedicated`, which ensures that EC2 instances launched in this VPC are run on dedicated tenancy instances regardless of the tenancy attribute specified at launch. This has a dedicated per region fee of $2 per hour, plus an hourly per instance usage fee.
+* `ipv4_ipam_pool_id` - (Optional) The ID of an IPv4 IPAM pool you want to use for allocating this VPC's CIDR. IPAM is a VPC feature that you can use to automate your IP address management workflows including assigning, tracking, troubleshooting, and auditing IP addresses across AWS Regions and accounts. Using IPAM you can monitor IP address usage throughout your AWS Organization.
+* `ipv4_netmask_length` - (Optional) The netmask length of the IPv4 CIDR you want to allocate to this VPC. Requires specifying a `ipv4_ipam_pool_id`.
+* `ipv6_cidr_block` - (Optional) IPv6 CIDR block to request from an IPAM Pool. Can be set explicitly or derived from IPAM using `ipv6_netmask_length`.
+* `ipv6_ipam_pool_id` - (Optional) IPAM Pool ID for a IPv6 pool. Conflicts with `assign_generated_ipv6_cidr_block`.
+* `ipv6_netmask_length` - (Optional) Netmask length to request from IPAM Pool. Conflicts with `ipv6_cidr_block`. This can be omitted if IPAM pool as a `allocation_default_netmask_length` set. Valid values: `56`.
+* `ipv6_cidr_block_network_border_group` - (Optional) By default when an IPv6 CIDR is assigned to a VPC a default ipv6_cidr_block_network_border_group will be set to the region of the VPC. This can be changed to restrict advertisement of public addresses to specific Network Border Groups such as LocalZones.
+* `enable_dns_support` - (Optional) A boolean flag to enable/disable DNS support in the VPC. Defaults to true.
+* `enable_network_address_usage_metrics` - (Optional) Indicates whether Network Address Usage metrics are enabled for your VPC. Defaults to false.
+* `enable_dns_hostnames` - (Optional) A boolean flag to enable/disable DNS hostnames in the VPC. Defaults false.
+* `assign_generated_ipv6_cidr_block` - (Optional) Requests an Amazon-provided IPv6 CIDR block with a /56 prefix length for the VPC. You cannot specify the range of IP addresses, or the size of the CIDR block. Default is `false`. Conflicts with `ipv6_ipam_pool_id`
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of VPC
+* `id` - The ID of the VPC
+* `instance_tenancy` - Tenancy of instances spin up within VPC
+* `enable_dns_support` - Whether or not the VPC has DNS support
+* `enable_network_address_usage_metrics` - Whether Network Address Usage metrics are enabled for the VPC
+* `enable_dns_hostnames` - Whether or not the VPC has DNS hostname support
+* `main_route_table_id` - The ID of the main route table associated with
+     this VPC. Note that you can change a VPC's main route table by using an
+     [`aws_main_route_table_association`](/docs/providers/aws/r/main_route_table_association.html).
+* `default_network_acl_id` - The ID of the network ACL created by default on VPC creation
+* `default_security_group_id` - The ID of the security group created by default on VPC creation
+* `default_route_table_id` - The ID of the route table created by default on VPC creation
+* `ipv6_association_id` - The association ID for the IPv6 CIDR block.
+* `ipv6_cidr_block_network_border_group` - The Network Border Group Zone name
+* `owner_id` - The ID of the AWS account that owns the VPC.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import VPCs using the VPC `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import VPCs using the VPC `id`. For example:
+
+```console
+% terraform import aws_vpc.test_vpc vpc-a01106c2
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ae6df6e7b2fd061f8aef4637ee76c64d6bc7f7657d175ee9d2e9140d0df3c94b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/vpc_dhcp_options.html.markdown b/website/docs/cdktf/python/r/vpc_dhcp_options.html.markdown
new file mode 100644
index 00000000000..ab034856a5e
--- /dev/null
+++ b/website/docs/cdktf/python/r/vpc_dhcp_options.html.markdown
@@ -0,0 +1,112 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_vpc_dhcp_options"
+description: |-
+  Provides a VPC DHCP Options resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_vpc_dhcp_options
+
+Provides a VPC DHCP Options resource.
+
+## Example Usage
+
+Basic usage:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.vpc_dhcp_options import VpcDhcpOptions
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        VpcDhcpOptions(self, "dns_resolver",
+            domain_name_servers=["8.8.8.8", "8.8.4.4"]
+        )
+```
+
+Full usage:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.vpc_dhcp_options import VpcDhcpOptions
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        VpcDhcpOptions(self, "foo",
+            domain_name="service.consul",
+            domain_name_servers=["127.0.0.1", "10.0.0.2"],
+            netbios_name_servers=["127.0.0.1"],
+            netbios_node_type=Token.as_string(2),
+            ntp_servers=["127.0.0.1"],
+            tags={
+                "Name": "foo-name"
+            }
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `domain_name` - (Optional) the suffix domain name to use by default when resolving non Fully Qualified Domain Names. In other words, this is what ends up being the `search` value in the `/etc/resolv.conf` file.
+* `domain_name_servers` - (Optional) List of name servers to configure in `/etc/resolv.conf`. If you want to use the default AWS nameservers you should set this to `AmazonProvidedDNS`.
+* `ntp_servers` - (Optional) List of NTP servers to configure.
+* `netbios_name_servers` - (Optional) List of NETBIOS name servers.
+* `netbios_node_type` - (Optional) The NetBIOS node type (1, 2, 4, or 8). AWS recommends to specify 2 since broadcast and multicast are not supported in their network. For more information about these node types, see [RFC 2132](http://www.ietf.org/rfc/rfc2132.txt).
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Remarks
+
+* Notice that all arguments are optional but you have to specify at least one argument.
+* `domain_name_servers`, `netbios_name_servers`, `ntp_servers` are limited by AWS to maximum four servers only.
+* To actually use the DHCP Options Set you need to associate it to a VPC using [`aws_vpc_dhcp_options_association`](/docs/providers/aws/r/vpc_dhcp_options_association.html).
+* If you delete a DHCP Options Set, all VPCs using it will be associated to AWS's `default` DHCP Option Set.
+* In most cases unless you're configuring your own DNS you'll want to set `domain_name_servers` to `AmazonProvidedDNS`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the DHCP Options Set.
+* `arn` - The ARN of the DHCP Options Set.
+* `owner_id` - The ID of the AWS account that owns the DHCP options set.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+You can find more technical documentation about DHCP Options Set in the
+official [AWS User Guide](https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_DHCP_Options.html).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import VPC DHCP Options using the DHCP Options `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import VPC DHCP Options using the DHCP Options `id`. For example:
+
+```console
+% terraform import aws_vpc_dhcp_options.my_options dopt-d9070ebb
+```
+
+<!-- cache-key: cdktf-0.18.0 input-e86ad5600e185c6fcfac37962334f477301d705d06ab42100c161640170994e2 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/vpc_dhcp_options_association.html.markdown b/website/docs/cdktf/python/r/vpc_dhcp_options_association.html.markdown
new file mode 100644
index 00000000000..80922306502
--- /dev/null
+++ b/website/docs/cdktf/python/r/vpc_dhcp_options_association.html.markdown
@@ -0,0 +1,72 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_vpc_dhcp_options_association"
+description: |-
+  Provides a VPC DHCP Options Association resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_vpc_dhcp_options_association
+
+Provides a VPC DHCP Options Association resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.vpc_dhcp_options_association import VpcDhcpOptionsAssociation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        VpcDhcpOptionsAssociation(self, "dns_resolver",
+            dhcp_options_id=foo.id,
+            vpc_id=Token.as_string(aws_vpc_foo.id)
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `vpc_id` - (Required) The ID of the VPC to which we would like to associate a DHCP Options Set.
+* `dhcp_options_id` - (Required) The ID of the DHCP Options Set to associate to the VPC.
+
+## Remarks
+
+* You can only associate one DHCP Options Set to a given VPC ID.
+* Removing the DHCP Options Association automatically sets AWS's `default` DHCP Options Set to the VPC.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the DHCP Options Set Association.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DHCP associations using the VPC ID associated with the options. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import DHCP associations using the VPC ID associated with the options. For example:
+
+```console
+% terraform import aws_vpc_dhcp_options_association.imported vpc-0f001273ec18911b1
+```
+
+<!-- cache-key: cdktf-0.18.0 input-38bb6adf7a2cdaed08e8a7d0f22e47d0c02836ef15bfce74b53d370722c7efd7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/vpc_endpoint.html.markdown b/website/docs/cdktf/python/r/vpc_endpoint.html.markdown
new file mode 100644
index 00000000000..a1af5ad8a6f
--- /dev/null
+++ b/website/docs/cdktf/python/r/vpc_endpoint.html.markdown
@@ -0,0 +1,239 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_vpc_endpoint"
+description: |-
+  Provides a VPC Endpoint resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_vpc_endpoint
+
+Provides a VPC Endpoint resource.
+
+~> **NOTE on VPC Endpoints and VPC Endpoint Associations:** Terraform provides both standalone VPC Endpoint Associations for
+[Route Tables](vpc_endpoint_route_table_association.html) - (an association between a VPC endpoint and a single `route_table_id`),
+[Security Groups](vpc_endpoint_security_group_association.html) - (an association between a VPC endpoint and a single `security_group_id`),
+and [Subnets](vpc_endpoint_subnet_association.html) - (an association between a VPC endpoint and a single `subnet_id`) and
+a VPC Endpoint resource with `route_table_ids` and `subnet_ids` attributes.
+Do not use the same resource ID in both a VPC Endpoint resource and a VPC Endpoint Association resource.
+Doing so will cause a conflict of associations and will overwrite the association.
+
+## Example Usage
+
+### Basic
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.vpc_endpoint import VpcEndpoint
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        VpcEndpoint(self, "s3",
+            service_name="com.amazonaws.us-west-2.s3",
+            vpc_id=main.id
+        )
+```
+
+### Basic w/ Tags
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.vpc_endpoint import VpcEndpoint
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        VpcEndpoint(self, "s3",
+            service_name="com.amazonaws.us-west-2.s3",
+            tags={
+                "Environment": "test"
+            },
+            vpc_id=main.id
+        )
+```
+
+### Interface Endpoint Type
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.vpc_endpoint import VpcEndpoint
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        VpcEndpoint(self, "ec2",
+            private_dns_enabled=True,
+            security_group_ids=[sg1.id],
+            service_name="com.amazonaws.us-west-2.ec2",
+            vpc_endpoint_type="Interface",
+            vpc_id=main.id
+        )
+```
+
+### Gateway Load Balancer Endpoint Type
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_caller_identity import DataAwsCallerIdentity
+from imports.aws.vpc_endpoint import VpcEndpoint
+from imports.aws.vpc_endpoint_service import VpcEndpointService
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        current = DataAwsCallerIdentity(self, "current")
+        example = VpcEndpointService(self, "example",
+            acceptance_required=False,
+            allowed_principals=[Token.as_string(current.arn)],
+            gateway_load_balancer_arns=[Token.as_string(aws_lb_example.arn)]
+        )
+        aws_vpc_endpoint_example = VpcEndpoint(self, "example_2",
+            service_name=example.service_name,
+            subnet_ids=[Token.as_string(aws_subnet_example.id)],
+            vpc_endpoint_type=example.service_type,
+            vpc_id=Token.as_string(aws_vpc_example.id)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_vpc_endpoint_example.override_logical_id("example")
+```
+
+### Non-AWS Service
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, Fn, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_route53_zone import DataAwsRoute53Zone
+from imports.aws.route53_record import Route53Record
+from imports.aws.vpc_endpoint import VpcEndpoint
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ptfe_service = VpcEndpoint(self, "ptfe_service",
+            private_dns_enabled=False,
+            security_group_ids=[Token.as_string(aws_security_group_ptfe_service.id)],
+            service_name=Token.as_string(var_ptfe_service.value),
+            subnet_ids=[subnet_ids],
+            vpc_endpoint_type="Interface",
+            vpc_id=vpc_id.string_value
+        )
+        internal = DataAwsRoute53Zone(self, "internal",
+            name="vpc.internal.",
+            private_zone=True,
+            vpc_id=vpc_id.string_value
+        )
+        aws_route53_record_ptfe_service = Route53Record(self, "ptfe_service_2",
+            name="ptfe.${" + internal.name + "}",
+            records=[
+                Token.as_string(
+                    Fn.lookup_nested(ptfe_service.dns_entry, ["0", "\"dns_name\""]))
+            ],
+            ttl=Token.as_number("300"),
+            type="CNAME",
+            zone_id=Token.as_string(internal.zone_id)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_route53_record_ptfe_service.override_logical_id("ptfe_service")
+```
+
+~> **NOTE The `dns_entry` output is a list of maps:** Terraform interpolation support for lists of maps requires the `lookup` and `[]` until full support of lists of maps is available
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `service_name` - (Required) The service name. For AWS services the service name is usually in the form `com.amazonaws.<region>.<service>` (the SageMaker Notebook service is an exception to this rule, the service name is in the form `aws.sagemaker.<region>.notebook`).
+* `vpc_id` - (Required) The ID of the VPC in which the endpoint will be used.
+* `auto_accept` - (Optional) Accept the VPC endpoint (the VPC endpoint and service need to be in the same AWS account).
+* `policy` - (Optional) A policy to attach to the endpoint that controls access to the service. This is a JSON formatted string. Defaults to full access. All `Gateway` and some `Interface` endpoints support policies - see the [relevant AWS documentation](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-endpoints-access.html) for more details. For more information about building AWS IAM policy documents with Terraform, see the [AWS IAM Policy Document Guide](https://learn.hashicorp.com/terraform/aws/iam-policy).
+* `private_dns_enabled` - (Optional; AWS services and AWS Marketplace partner services only) Whether or not to associate a private hosted zone with the specified VPC. Applicable for endpoints of type `Interface`.
+Defaults to `false`.
+* `dns_options` - (Optional) The DNS options for the endpoint. See dns_options below.
+* `ip_address_type` - (Optional) The IP address type for the endpoint. Valid values are `ipv4`, `dualstack`, and `ipv6`.
+* `route_table_ids` - (Optional) One or more route table IDs. Applicable for endpoints of type `Gateway`.
+* `subnet_ids` - (Optional) The ID of one or more subnets in which to create a network interface for the endpoint. Applicable for endpoints of type `GatewayLoadBalancer` and `Interface`.
+* `security_group_ids` - (Optional) The ID of one or more security groups to associate with the network interface. Applicable for endpoints of type `Interface`.
+If no security groups are specified, the VPC's [default security group](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html#DefaultSecurityGroup) is associated with the endpoint.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `vpc_endpoint_type` - (Optional) The VPC endpoint type, `Gateway`, `GatewayLoadBalancer`, or `Interface`. Defaults to `Gateway`.
+
+### dns_options
+
+* `dns_record_ip_type` - (Optional) The DNS records created for the endpoint. Valid values are `ipv4`, `dualstack`, `service-defined`, and `ipv6`.
+* `private_dns_only_for_inbound_resolver_endpoint` - (Optional) Indicates whether to enable private DNS only for inbound endpoints. This option is available only for services that support both gateway and interface endpoints. It routes traffic that originates from the VPC to the gateway endpoint and traffic that originates from on-premises to the interface endpoint. Default is `false`. Can only be specified if private_dns_enabled is `true`.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `10m`)
+- `update` - (Default `10m`)
+- `delete` - (Default `10m`)
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the VPC endpoint.
+* `arn` - The Amazon Resource Name (ARN) of the VPC endpoint.
+* `cidr_blocks` - The list of CIDR blocks for the exposed AWS service. Applicable for endpoints of type `Gateway`.
+* `dns_entry` - The DNS entries for the VPC Endpoint. Applicable for endpoints of type `Interface`. DNS blocks are documented below.
+* `network_interface_ids` - One or more network interfaces for the VPC Endpoint. Applicable for endpoints of type `Interface`.
+* `owner_id` - The ID of the AWS account that owns the VPC endpoint.
+* `prefix_list_id` - The prefix list ID of the exposed AWS service. Applicable for endpoints of type `Gateway`.
+* `requester_managed` -  Whether or not the VPC Endpoint is being managed by its service - `true` or `false`.
+* `state` - The state of the VPC endpoint.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+DNS blocks (for `dns_entry`) support the following attributes:
+
+* `dns_name` - The DNS name.
+* `hosted_zone_id` - The ID of the private hosted zone.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import VPC Endpoints using the VPC endpoint `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import VPC Endpoints using the VPC endpoint `id`. For example:
+
+```console
+% terraform import aws_vpc_endpoint.endpoint1 vpce-3ecf2a57
+```
+
+<!-- cache-key: cdktf-0.18.0 input-f297fba86f49311b28d9ad61069addf2f69a6357bfa1356f16d2fce2023ca56d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/vpc_endpoint_connection_accepter.html.markdown b/website/docs/cdktf/python/r/vpc_endpoint_connection_accepter.html.markdown
new file mode 100644
index 00000000000..d2f5934ea09
--- /dev/null
+++ b/website/docs/cdktf/python/r/vpc_endpoint_connection_accepter.html.markdown
@@ -0,0 +1,89 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_vpc_endpoint_connection_accepter"
+description: |-
+  Provides a resource to accept a pending VPC Endpoint accept request to VPC Endpoint Service.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_vpc_endpoint_connection_accepter
+
+Provides a resource to accept a pending VPC Endpoint Connection accept request to VPC Endpoint Service.
+
+## Example Usage
+
+### Accept cross-account request
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.vpc_endpoint import VpcEndpoint
+from imports.aws.vpc_endpoint_connection_accepter import VpcEndpointConnectionAccepter
+from imports.aws.vpc_endpoint_service import VpcEndpointService
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = VpcEndpoint(self, "example",
+            private_dns_enabled=False,
+            provider=alternate,
+            security_group_ids=[test.id],
+            service_name=Token.as_string(aws_vpc_endpoint_service_test.service_name),
+            vpc_endpoint_type="Interface",
+            vpc_id=test_alternate.id
+        )
+        aws_vpc_endpoint_service_example = VpcEndpointService(self, "example_1",
+            acceptance_required=False,
+            network_load_balancer_arns=[Token.as_string(aws_lb_example.arn)]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_vpc_endpoint_service_example.override_logical_id("example")
+        aws_vpc_endpoint_connection_accepter_example =
+        VpcEndpointConnectionAccepter(self, "example_2",
+            vpc_endpoint_id=example.id,
+            vpc_endpoint_service_id=Token.as_string(aws_vpc_endpoint_service_example.id)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_vpc_endpoint_connection_accepter_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `vpc_endpoint_id` - (Required) AWS VPC Endpoint ID.
+* `vpc_endpoint_service_id` - (Required) AWS VPC Endpoint Service ID.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the VPC Endpoint Connection.
+* `vpc_endpoint_state` - State of the VPC Endpoint.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import VPC Endpoint Services using ID of the connection, which is the `VPC Endpoint Service ID` and `VPC Endpoint ID` separated by underscore (`_`).. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import VPC Endpoint Services using ID of the connection, which is the `VPC Endpoint Service ID` and `VPC Endpoint ID` separated by underscore (`_`).. For example:
+
+```console
+% terraform import aws_vpc_endpoint_connection_accepter.foo vpce-svc-0f97a19d3fa8220bc_vpce-010601a6db371e263
+```
+
+<!-- cache-key: cdktf-0.18.0 input-34b764c039bd7ffaa91905d63054f3f94f3c9291f5e1d627a203fd2af7e505b7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/vpc_endpoint_connection_notification.html.markdown b/website/docs/cdktf/python/r/vpc_endpoint_connection_notification.html.markdown
new file mode 100644
index 00000000000..16c09cd9c56
--- /dev/null
+++ b/website/docs/cdktf/python/r/vpc_endpoint_connection_notification.html.markdown
@@ -0,0 +1,104 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_vpc_endpoint_connection_notification"
+description: |-
+  Provides a VPC Endpoint connection notification resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_vpc_endpoint_connection_notification
+
+Provides a VPC Endpoint connection notification resource.
+Connection notifications notify subscribers of VPC Endpoint events.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.sns_topic import SnsTopic
+from imports.aws.vpc_endpoint_connection_notification import VpcEndpointConnectionNotification
+from imports.aws.vpc_endpoint_service import VpcEndpointService
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        foo = VpcEndpointService(self, "foo",
+            acceptance_required=False,
+            network_load_balancer_arns=[test.arn]
+        )
+        topic = DataAwsIamPolicyDocument(self, "topic",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["SNS:Publish"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["vpce.amazonaws.com"],
+                    type="Service"
+                )
+                ],
+                resources=["arn:aws:sns:*:*:vpce-notification-topic"]
+            )
+            ]
+        )
+        aws_sns_topic_topic = SnsTopic(self, "topic_2",
+            name="vpce-notification-topic",
+            policy=Token.as_string(topic.json)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_sns_topic_topic.override_logical_id("topic")
+        aws_vpc_endpoint_connection_notification_foo =
+        VpcEndpointConnectionNotification(self, "foo_3",
+            connection_events=["Accept", "Reject"],
+            connection_notification_arn=Token.as_string(aws_sns_topic_topic.arn),
+            vpc_endpoint_service_id=foo.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_vpc_endpoint_connection_notification_foo.override_logical_id("foo")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `vpc_endpoint_service_id` - (Optional) The ID of the VPC Endpoint Service to receive notifications for.
+* `vpc_endpoint_id` - (Optional) The ID of the VPC Endpoint to receive notifications for.
+* `connection_notification_arn` - (Required) The ARN of the SNS topic for the notifications.
+* `connection_events` - (Required) One or more endpoint [events](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateVpcEndpointConnectionNotification.html#API_CreateVpcEndpointConnectionNotification_RequestParameters) for which to receive notifications.
+
+~> **NOTE:** One of `vpc_endpoint_service_id` or `vpc_endpoint_id` must be specified.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the VPC connection notification.
+* `state` - The state of the notification.
+* `notification_type` - The type of notification.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import VPC Endpoint connection notifications using the VPC endpoint connection notification `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import VPC Endpoint connection notifications using the VPC endpoint connection notification `id`. For example:
+
+```console
+% terraform import aws_vpc_endpoint_connection_notification.foo vpce-nfn-09e6ed3b4efba2263
+```
+
+<!-- cache-key: cdktf-0.18.0 input-0a73ca44fb468e8731df240f6476acb6d3f8563d6140121d0844ddbde55b7aff -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/vpc_endpoint_policy.html.markdown b/website/docs/cdktf/python/r/vpc_endpoint_policy.html.markdown
new file mode 100644
index 00000000000..046eb4b70cf
--- /dev/null
+++ b/website/docs/cdktf/python/r/vpc_endpoint_policy.html.markdown
@@ -0,0 +1,99 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_vpc_endpoint_policy"
+description: |-
+  Provides a VPC Endpoint Policy resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_vpc_endpoint_policy
+
+Provides a VPC Endpoint Policy resource.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, Fn, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_vpc_endpoint_service import DataAwsVpcEndpointService
+from imports.aws.vpc import Vpc
+from imports.aws.vpc_endpoint import VpcEndpoint
+from imports.aws.vpc_endpoint_policy import VpcEndpointPolicy
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = Vpc(self, "example",
+            cidr_block="10.0.0.0/16"
+        )
+        data_aws_vpc_endpoint_service_example = DataAwsVpcEndpointService(self, "example_1",
+            service="dynamodb"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_vpc_endpoint_service_example.override_logical_id("example")
+        aws_vpc_endpoint_example = VpcEndpoint(self, "example_2",
+            service_name=Token.as_string(data_aws_vpc_endpoint_service_example.service_name),
+            vpc_id=example.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_vpc_endpoint_example.override_logical_id("example")
+        aws_vpc_endpoint_policy_example = VpcEndpointPolicy(self, "example_3",
+            policy=Token.as_string(
+                Fn.jsonencode({
+                    "Statement": [{
+                        "Action": ["dynamodb:*"],
+                        "Effect": "Allow",
+                        "Principal": {
+                            "AWS": "*"
+                        },
+                        "Resource": "*",
+                        "Sid": "AllowAll"
+                    }
+                    ],
+                    "Version": "2012-10-17"
+                })),
+            vpc_endpoint_id=Token.as_string(aws_vpc_endpoint_example.id)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_vpc_endpoint_policy_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `vpc_endpoint_id` - (Required) The VPC Endpoint ID.
+* `policy` - (Optional) A policy to attach to the endpoint that controls access to the service. Defaults to full access. All `Gateway` and some `Interface` endpoints support policies - see the [relevant AWS documentation](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-endpoints-access.html) for more details. For more information about building AWS IAM policy documents with Terraform, see the [AWS IAM Policy Document Guide](https://learn.hashicorp.com/terraform/aws/iam-policy).
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the VPC endpoint.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import VPC Endpoint Policies using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import VPC Endpoint Policies using the `id`. For example:
+
+```console
+% terraform import aws_vpc_endpoint_policy.example vpce-3ecf2a57
+```
+
+<!-- cache-key: cdktf-0.18.0 input-a5b2784f8f44ade8f56c203390d38d1010def6c1bdaafcb341605772236d19d6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/vpc_endpoint_route_table_association.html.markdown b/website/docs/cdktf/python/r/vpc_endpoint_route_table_association.html.markdown
new file mode 100644
index 00000000000..a43b498655f
--- /dev/null
+++ b/website/docs/cdktf/python/r/vpc_endpoint_route_table_association.html.markdown
@@ -0,0 +1,67 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_vpc_endpoint_route_table_association"
+description: |-
+  Manages a VPC Endpoint Route Table Association
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_vpc_endpoint_route_table_association
+
+Manages a VPC Endpoint Route Table Association
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.vpc_endpoint_route_table_association import VpcEndpointRouteTableAssociation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        VpcEndpointRouteTableAssociation(self, "example",
+            route_table_id=Token.as_string(aws_route_table_example.id),
+            vpc_endpoint_id=Token.as_string(aws_vpc_endpoint_example.id)
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `route_table_id` - (Required) Identifier of the EC2 Route Table to be associated with the VPC Endpoint.
+* `vpc_endpoint_id` - (Required) Identifier of the VPC Endpoint with which the EC2 Route Table will be associated.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - A hash of the EC2 Route Table and VPC Endpoint identifiers.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import VPC Endpoint Route Table Associations using `vpc_endpoint_id` together with `route_table_id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import VPC Endpoint Route Table Associations using `vpc_endpoint_id` together with `route_table_id`. For example:
+
+```console
+% terraform import aws_vpc_endpoint_route_table_association.example vpce-aaaaaaaa/rtb-bbbbbbbb
+```
+
+<!-- cache-key: cdktf-0.18.0 input-9279baef908b3e9fb91a1e81d78619bda99e30247b0ce7926ced7862a33683e2 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/vpc_endpoint_security_group_association.html.markdown b/website/docs/cdktf/python/r/vpc_endpoint_security_group_association.html.markdown
new file mode 100644
index 00000000000..1e92eaae05b
--- /dev/null
+++ b/website/docs/cdktf/python/r/vpc_endpoint_security_group_association.html.markdown
@@ -0,0 +1,57 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_vpc_endpoint_security_group_association"
+description: |-
+  Provides a resource to create an association between a VPC endpoint and a security group.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_vpc_endpoint_security_group_association
+
+Provides a resource to create an association between a VPC endpoint and a security group.
+
+~> **NOTE on VPC Endpoints and VPC Endpoint Security Group Associations:** Terraform provides
+both a standalone VPC Endpoint Security Group Association (an association between a VPC endpoint
+and a single `security_group_id`) and a [VPC Endpoint](vpc_endpoint.html) resource with a `security_group_ids`
+attribute. Do not use the same security group ID in both a VPC Endpoint resource and a VPC Endpoint Security
+Group Association resource. Doing so will cause a conflict of associations and will overwrite the association.
+
+## Example Usage
+
+Basic usage:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.vpc_endpoint_security_group_association import VpcEndpointSecurityGroupAssociation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        VpcEndpointSecurityGroupAssociation(self, "sg_ec2",
+            security_group_id=sg.id,
+            vpc_endpoint_id=ec2.id
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `security_group_id` - (Required) The ID of the security group to be associated with the VPC endpoint.
+* `vpc_endpoint_id` - (Required) The ID of the VPC endpoint with which the security group will be associated.
+* `replace_default_association` - (Optional) Whether this association should replace the association with the VPC's default security group that is created when no security groups are specified during VPC endpoint creation. At most 1 association per-VPC endpoint should be configured with `replace_default_association = true`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the association.
+
+<!-- cache-key: cdktf-0.18.0 input-e0b24d11f8b79893f0c7abf7d276f5c7e882e53eb0977668d0e09c4fa0c3576b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/vpc_endpoint_service.html.markdown b/website/docs/cdktf/python/r/vpc_endpoint_service.html.markdown
new file mode 100644
index 00000000000..2c44f3eec19
--- /dev/null
+++ b/website/docs/cdktf/python/r/vpc_endpoint_service.html.markdown
@@ -0,0 +1,114 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_vpc_endpoint_service"
+description: |-
+  Provides a VPC Endpoint Service resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_vpc_endpoint_service
+
+Provides a VPC Endpoint Service resource.
+Service consumers can create an _Interface_ [VPC Endpoint](vpc_endpoint.html) to connect to the service.
+
+~> **NOTE on VPC Endpoint Services and VPC Endpoint Service Allowed Principals:** Terraform provides
+both a standalone [VPC Endpoint Service Allowed Principal](vpc_endpoint_service_allowed_principal.html) resource
+and a VPC Endpoint Service resource with an `allowed_principals` attribute. Do not use the same principal ARN in both
+a VPC Endpoint Service resource and a VPC Endpoint Service Allowed Principal resource. Doing so will cause a conflict
+and will overwrite the association.
+
+## Example Usage
+
+### Network Load Balancers
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.vpc_endpoint_service import VpcEndpointService
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        VpcEndpointService(self, "example",
+            acceptance_required=False,
+            network_load_balancer_arns=[Token.as_string(aws_lb_example.arn)]
+        )
+```
+
+### Gateway Load Balancers
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.vpc_endpoint_service import VpcEndpointService
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        VpcEndpointService(self, "example",
+            acceptance_required=False,
+            gateway_load_balancer_arns=[Token.as_string(aws_lb_example.arn)]
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `acceptance_required` - (Required) Whether or not VPC endpoint connection requests to the service must be accepted by the service owner - `true` or `false`.
+* `allowed_principals` - (Optional) The ARNs of one or more principals allowed to discover the endpoint service.
+* `gateway_load_balancer_arns` - (Optional) Amazon Resource Names (ARNs) of one or more Gateway Load Balancers for the endpoint service.
+* `network_load_balancer_arns` - (Optional) Amazon Resource Names (ARNs) of one or more Network Load Balancers for the endpoint service.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `private_dns_name` - (Optional) The private DNS name for the service.
+* `supported_ip_address_types` - (Optional) The supported IP address types. The possible values are `ipv4` and `ipv6`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the VPC endpoint service.
+* `availability_zones` - A set of Availability Zones in which the service is available.
+* `arn` - The Amazon Resource Name (ARN) of the VPC endpoint service.
+* `base_endpoint_dns_names` - A set of DNS names for the service.
+* `manages_vpc_endpoints` - Whether or not the service manages its VPC endpoints - `true` or `false`.
+* `service_name` - The service name.
+* `service_type` - The service type, `Gateway` or `Interface`.
+* `state` - The state of the VPC endpoint service.
+* `private_dns_name_configuration` - List of objects containing information about the endpoint service private DNS name configuration.
+    * `name` - Name of the record subdomain the service provider needs to create.
+    * `state` - Verification state of the VPC endpoint service. Consumers of the endpoint service can use the private name only when the state is `verified`.
+    * `type` - Endpoint service verification type, for example `TXT`.
+    * `value` - Value the service provider adds to the private DNS name domain record before verification.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import VPC Endpoint Services using the VPC endpoint service `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import VPC Endpoint Services using the VPC endpoint service `id`. For example:
+
+```console
+% terraform import aws_vpc_endpoint_service.foo vpce-svc-0f97a19d3fa8220bc
+```
+
+<!-- cache-key: cdktf-0.18.0 input-c09a7b5d8b527c0d1b6c1d63d0ebeee104d7dd496159317437a0efb2c6008154 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/vpc_endpoint_service_allowed_principal.html.markdown b/website/docs/cdktf/python/r/vpc_endpoint_service_allowed_principal.html.markdown
new file mode 100644
index 00000000000..497336bdd7f
--- /dev/null
+++ b/website/docs/cdktf/python/r/vpc_endpoint_service_allowed_principal.html.markdown
@@ -0,0 +1,58 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_vpc_endpoint_service_allowed_principal"
+description: |-
+  Provides a resource to allow a principal to discover a VPC endpoint service.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_vpc_endpoint_service_allowed_principal
+
+Provides a resource to allow a principal to discover a VPC endpoint service.
+
+~> **NOTE on VPC Endpoint Services and VPC Endpoint Service Allowed Principals:** Terraform provides
+both a standalone [VPC Endpoint Service Allowed Principal](vpc_endpoint_service_allowed_principal.html) resource
+and a VPC Endpoint Service resource with an `allowed_principals` attribute. Do not use the same principal ARN in both
+a VPC Endpoint Service resource and a VPC Endpoint Service Allowed Principal resource. Doing so will cause a conflict
+and will overwrite the association.
+
+## Example Usage
+
+Basic usage:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_caller_identity import DataAwsCallerIdentity
+from imports.aws.vpc_endpoint_service_allowed_principal import VpcEndpointServiceAllowedPrincipal
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        current = DataAwsCallerIdentity(self, "current")
+        VpcEndpointServiceAllowedPrincipal(self, "allow_me_to_foo",
+            principal_arn=Token.as_string(current.arn),
+            vpc_endpoint_service_id=foo.id
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `vpc_endpoint_service_id` - (Required) The ID of the VPC endpoint service to allow permission.
+* `principal_arn` - (Required) The ARN of the principal to allow permissions.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the association.
+
+<!-- cache-key: cdktf-0.18.0 input-8ff7831d801343519ca1bf1af9bc9600a8326d54f66a019278e06cc2bc3ebf39 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/vpc_endpoint_subnet_association.html.markdown b/website/docs/cdktf/python/r/vpc_endpoint_subnet_association.html.markdown
new file mode 100644
index 00000000000..231c40924e9
--- /dev/null
+++ b/website/docs/cdktf/python/r/vpc_endpoint_subnet_association.html.markdown
@@ -0,0 +1,82 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_vpc_endpoint_subnet_association"
+description: |-
+  Provides a resource to create an association between a VPC endpoint and a subnet.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_vpc_endpoint_subnet_association
+
+Provides a resource to create an association between a VPC endpoint and a subnet.
+
+~> **NOTE on VPC Endpoints and VPC Endpoint Subnet Associations:** Terraform provides
+both a standalone VPC Endpoint Subnet Association (an association between a VPC endpoint
+and a single `subnet_id`) and a [VPC Endpoint](vpc_endpoint.html) resource with a `subnet_ids`
+attribute. Do not use the same subnet ID in both a VPC Endpoint resource and a VPC Endpoint Subnet
+Association resource. Doing so will cause a conflict of associations and will overwrite the association.
+
+## Example Usage
+
+Basic usage:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.vpc_endpoint_subnet_association import VpcEndpointSubnetAssociation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        VpcEndpointSubnetAssociation(self, "sn_ec2",
+            subnet_id=sn.id,
+            vpc_endpoint_id=ec2.id
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `vpc_endpoint_id` - (Required) The ID of the VPC endpoint with which the subnet will be associated.
+* `subnet_id` - (Required) The ID of the subnet to be associated with the VPC endpoint.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the association.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `10m`)
+- `delete` - (Default `10m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import VPC Endpoint Subnet Associations using `vpc_endpoint_id` together with `subnet_id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import VPC Endpoint Subnet Associations using `vpc_endpoint_id` together with `subnet_id`. For example:
+
+```console
+% terraform import aws_vpc_endpoint_subnet_association.example vpce-aaaaaaaa/subnet-bbbbbbbbbbbbbbbbb
+```
+
+<!-- cache-key: cdktf-0.18.0 input-5669b71eb1929dcdffdde12d53b4824d055cb34a6173d0e6db8bbbcb9c7d5708 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/vpc_ipam.html.markdown b/website/docs/cdktf/python/r/vpc_ipam.html.markdown
new file mode 100644
index 00000000000..044880ace50
--- /dev/null
+++ b/website/docs/cdktf/python/r/vpc_ipam.html.markdown
@@ -0,0 +1,129 @@
+---
+subcategory: "VPC IPAM (IP Address Manager)"
+layout: "aws"
+page_title: "AWS: aws_vpc_ipam"
+description: |-
+  Provides an IPAM resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_vpc_ipam
+
+Provides an IPAM resource.
+
+## Example Usage
+
+Basic usage:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_region import DataAwsRegion
+from imports.aws.vpc_ipam import VpcIpam
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        current = DataAwsRegion(self, "current")
+        VpcIpam(self, "main",
+            description="My IPAM",
+            operating_regions=[VpcIpamOperatingRegions(
+                region_name=Token.as_string(current.name)
+            )
+            ],
+            tags={
+                "Test": "Main"
+            }
+        )
+```
+
+Shared with multiple operating_regions:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import VariableType, TerraformVariable, Fn, Token, TerraformIterator, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_region import DataAwsRegion
+from imports.aws.vpc_ipam import VpcIpam
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        # Terraform Variables are not always the best fit for getting inputs in the context of Terraform CDK.
+        #     You can read more about this at https://cdk.tf/variables
+        ipam_regions = TerraformVariable(self, "ipam_regions",
+            default=["us-east-1", "us-west-2"],
+            type=VariableType.ANY
+        )
+        current = DataAwsRegion(self, "current")
+        all_ipam_regions = Fn.distinct(
+            Token.as_any(Fn.concat([[current.name], ipam_regions.value])))
+        # In most cases loops should be handled in the programming language context and
+        #     not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+        #     you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+        #     you need to keep this like it is.
+        main_dynamic_iterator0 = TerraformIterator.from_list(
+            Token.as_any(all_ipam_regions))
+        VpcIpam(self, "main",
+            description="multi region ipam",
+            operating_regions=main_dynamic_iterator0.dynamic({
+                "region_name": main_dynamic_iterator0.value
+            })
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `description` - (Optional) A description for the IPAM.
+* `operating_regions` - (Required) Determines which locales can be chosen when you create pools. Locale is the Region where you want to make an IPAM pool available for allocations. You can only create pools with locales that match the operating Regions of the IPAM. You can only create VPCs from a pool whose locale matches the VPC's Region. You specify a region using the [region_name](#operating_regions) parameter. You **must** set your provider block region as an operating_region.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `cascade` - (Optional) Enables you to quickly delete an IPAM, private scopes, pools in private scopes, and any allocations in the pools in private scopes.
+
+### operating_regions
+
+* `region_name` - (Required) The name of the Region you want to add to the IPAM.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of IPAM
+* `id` - The ID of the IPAM
+* `default_resource_discovery_id` - The IPAM's default resource discovery ID.
+* `default_resource_discovery_association_id` - The IPAM's default resource discovery association ID.
+* `private_default_scope_id` - The ID of the IPAM's private scope. A scope is a top-level container in IPAM. Each scope represents an IP-independent network. Scopes enable you to represent networks where you have overlapping IP space. When you create an IPAM, IPAM automatically creates two scopes: public and private. The private scope is intended for private IP space. The public scope is intended for all internet-routable IP space.
+* `public_default_scope_id` - The ID of the IPAM's public scope. A scope is a top-level container in IPAM. Each scope represents an IP-independent network. Scopes enable you to represent networks where you have overlapping IP space. When you create an IPAM, IPAM automatically creates two scopes: public and private. The private scope is intended for private
+IP space. The public scope is intended for all internet-routable IP space.
+* `scope_count` - The number of scopes in the IPAM.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IPAMs using the IPAM `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import IPAMs using the IPAM `id`. For example:
+
+```console
+% terraform import aws_vpc_ipam.example ipam-0178368ad2146a492
+```
+
+<!-- cache-key: cdktf-0.18.0 input-84aa9bd97b463b7e0ef48338b382158ae378ddfa622a5c06c2b8e8c82c2fa598 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/vpc_ipam_organization_admin_account.html.markdown b/website/docs/cdktf/python/r/vpc_ipam_organization_admin_account.html.markdown
new file mode 100644
index 00000000000..7f1bf534344
--- /dev/null
+++ b/website/docs/cdktf/python/r/vpc_ipam_organization_admin_account.html.markdown
@@ -0,0 +1,79 @@
+---
+subcategory: "VPC IPAM (IP Address Manager)"
+layout: "aws"
+page_title: "AWS: aws_vpc_ipam_organization_admin_account"
+description: |-
+  Enables the IPAM Service and promotes an account to delegated administrator for the service.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_vpc_ipam_organization_admin_account
+
+Enables the IPAM Service and promotes a delegated administrator.
+
+## Example Usage
+
+Basic usage:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_caller_identity import DataAwsCallerIdentity
+from imports.aws.provider import AwsProvider
+from imports.aws.vpc_ipam_organization_admin_account import VpcIpamOrganizationAdminAccount
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ipam_delegate_account = AwsProvider(self, "aws",
+            alias="ipam_delegate_account"
+        )
+        delegated = DataAwsCallerIdentity(self, "delegated",
+            provider=ipam_delegate_account
+        )
+        VpcIpamOrganizationAdminAccount(self, "example",
+            delegated_admin_account_id=Token.as_string(delegated.account_id)
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `delegated_admin_account_id` - (Required)
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Organizations ARN for the delegate account.
+* `id` - The Organizations member account ID that you want to enable as the IPAM account.
+* `email` - The Organizations email for the delegate account.
+* `name` - The Organizations name for the delegate account.
+* `service_principal` - The AWS service principal.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IPAMs using the delegate account `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import IPAMs using the delegate account `id`. For example:
+
+```console
+% terraform import aws_vpc_ipam_organization_admin_account.example 12345678901
+```
+
+<!-- cache-key: cdktf-0.18.0 input-756ca0efb94e8ad92deb19a5ce28731120d9b49f07ca56b39bba452b2ffecbdd -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/vpc_ipam_pool.html.markdown b/website/docs/cdktf/python/r/vpc_ipam_pool.html.markdown
new file mode 100644
index 00000000000..08827413b2a
--- /dev/null
+++ b/website/docs/cdktf/python/r/vpc_ipam_pool.html.markdown
@@ -0,0 +1,141 @@
+---
+subcategory: "VPC IPAM (IP Address Manager)"
+layout: "aws"
+page_title: "AWS: aws_vpc_ipam_pool"
+description: |-
+  Provides a IP address pool resource for IPAM.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_vpc_ipam_pool
+
+Provides an IP address pool resource for IPAM.
+
+## Example Usage
+
+Basic usage:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_region import DataAwsRegion
+from imports.aws.vpc_ipam import VpcIpam
+from imports.aws.vpc_ipam_pool import VpcIpamPool
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        current = DataAwsRegion(self, "current")
+        example = VpcIpam(self, "example",
+            operating_regions=[VpcIpamOperatingRegions(
+                region_name=Token.as_string(current.name)
+            )
+            ]
+        )
+        aws_vpc_ipam_pool_example = VpcIpamPool(self, "example_2",
+            address_family="ipv4",
+            ipam_scope_id=example.private_default_scope_id,
+            locale=Token.as_string(current.name)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_vpc_ipam_pool_example.override_logical_id("example")
+```
+
+Nested Pools:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_region import DataAwsRegion
+from imports.aws.vpc_ipam import VpcIpam
+from imports.aws.vpc_ipam_pool import VpcIpamPool
+from imports.aws.vpc_ipam_pool_cidr import VpcIpamPoolCidr
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        current = DataAwsRegion(self, "current")
+        example = VpcIpam(self, "example",
+            operating_regions=[VpcIpamOperatingRegions(
+                region_name=Token.as_string(current.name)
+            )
+            ]
+        )
+        parent = VpcIpamPool(self, "parent",
+            address_family="ipv4",
+            ipam_scope_id=example.private_default_scope_id
+        )
+        VpcIpamPoolCidr(self, "parent_test",
+            cidr="172.20.0.0/16",
+            ipam_pool_id=parent.id
+        )
+        child = VpcIpamPool(self, "child",
+            address_family="ipv4",
+            ipam_scope_id=example.private_default_scope_id,
+            locale=Token.as_string(current.name),
+            source_ipam_pool_id=parent.id
+        )
+        VpcIpamPoolCidr(self, "child_test",
+            cidr="172.20.0.0/24",
+            ipam_pool_id=child.id
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `address_family` - (Optional) The IP protocol assigned to this pool. You must choose either IPv4 or IPv6 protocol for a pool.
+* `allocation_default_netmask_length` - (Optional) A default netmask length for allocations added to this pool. If, for example, the CIDR assigned to this pool is 10.0.0.0/8 and you enter 16 here, new allocations will default to 10.0.0.0/16 (unless you provide a different netmask value when you create the new allocation).
+* `allocation_max_netmask_length` - (Optional) The maximum netmask length that will be required for CIDR allocations in this pool.
+* `allocation_min_netmask_length` - (Optional) The minimum netmask length that will be required for CIDR allocations in this pool.
+* `allocation_resource_tags` - (Optional) Tags that are required for resources that use CIDRs from this IPAM pool. Resources that do not have these tags will not be allowed to allocate space from the pool. If the resources have their tags changed after they have allocated space or if the allocation tagging requirements are changed on the pool, the resource may be marked as noncompliant.
+* `auto_import` - (Optional) If you include this argument, IPAM automatically imports any VPCs you have in your scope that fall
+within the CIDR range in the pool.
+* `aws_service` - (Optional) Limits which AWS service the pool can be used in. Only useable on public scopes. Valid Values: `ec2`.
+* `description` - (Optional) A description for the IPAM pool.
+* `ipam_scope_id` - (Optional) The ID of the scope in which you would like to create the IPAM pool.
+* `locale` - (Optional) The locale in which you would like to create the IPAM pool. Locale is the Region where you want to make an IPAM pool available for allocations. You can only create pools with locales that match the operating Regions of the IPAM. You can only create VPCs from a pool whose locale matches the VPC's Region. Possible values: Any AWS region, such as `us-east-1`.
+* `publicly_advertisable` - (Optional) Defines whether or not IPv6 pool space is publicly advertisable over the internet. This argument is required if `address_family = "ipv6"` and `public_ip_source = "byoip"`, default is `false`. This option is not available for IPv4 pool space or if `public_ip_source = "amazon"`.
+* `public_ip_source` - (Optional) The IP address source for pools in the public scope. Only used for provisioning IP address CIDRs to pools in the public scope. Valid values are `byoip` or `amazon`. Default is `byoip`.
+* `source_ipam_pool_id` - (Optional) The ID of the source IPAM pool. Use this argument to create a child pool within an existing pool.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of IPAM
+* `id` - The ID of the IPAM
+* `state` - The ID of the IPAM
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IPAMs using the IPAM pool `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import IPAMs using the IPAM pool `id`. For example:
+
+```console
+% terraform import aws_vpc_ipam_pool.example ipam-pool-0958f95207d978e1e
+```
+
+<!-- cache-key: cdktf-0.18.0 input-b9340bd3375bf2193e4b206451c8af86918bbc16f3f51661ef310d88085a12de -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/vpc_ipam_pool_cidr.html.markdown b/website/docs/cdktf/python/r/vpc_ipam_pool_cidr.html.markdown
new file mode 100644
index 00000000000..3e36d674b18
--- /dev/null
+++ b/website/docs/cdktf/python/r/vpc_ipam_pool_cidr.html.markdown
@@ -0,0 +1,146 @@
+---
+subcategory: "VPC IPAM (IP Address Manager)"
+layout: "aws"
+page_title: "AWS: aws_vpc_ipam_pool_cidr"
+description: |-
+  Provisions a CIDR from an IPAM address pool.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_vpc_ipam_pool_cidr
+
+Provisions a CIDR from an IPAM address pool.
+
+~> **NOTE:** Provisioning Public IPv4 or Public IPv6 require [steps outside the scope of this resource](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-byoip.html#prepare-for-byoip). The resource accepts `message` and `signature` as part of the `cidr_authorization_context` attribute but those must be generated ahead of time. Public IPv6 CIDRs that are provisioned into a Pool with `publicly_advertisable = true` and all public IPv4 CIDRs also require creating a Route Origin Authorization (ROA) object in your Regional Internet Registry (RIR).
+
+~> **NOTE:** In order to deprovision CIDRs all Allocations must be released. Allocations created by a VPC take up to 30 minutes to be released. However, for IPAM to properly manage the removal of allocation records created by VPCs and other resources, you must [grant it permissions](https://docs.aws.amazon.com/vpc/latest/ipam/choose-single-user-or-orgs-ipam.html) in
+either a single account or organizationally. If you are unable to deprovision a cidr after waiting over 30 minutes, you may be missing the Service Linked Role.
+
+## Example Usage
+
+Basic usage:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_region import DataAwsRegion
+from imports.aws.vpc_ipam import VpcIpam
+from imports.aws.vpc_ipam_pool import VpcIpamPool
+from imports.aws.vpc_ipam_pool_cidr import VpcIpamPoolCidr
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        current = DataAwsRegion(self, "current")
+        example = VpcIpam(self, "example",
+            operating_regions=[VpcIpamOperatingRegions(
+                region_name=Token.as_string(current.name)
+            )
+            ]
+        )
+        aws_vpc_ipam_pool_example = VpcIpamPool(self, "example_2",
+            address_family="ipv4",
+            ipam_scope_id=example.private_default_scope_id,
+            locale=Token.as_string(current.name)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_vpc_ipam_pool_example.override_logical_id("example")
+        aws_vpc_ipam_pool_cidr_example = VpcIpamPoolCidr(self, "example_3",
+            cidr="172.20.0.0/16",
+            ipam_pool_id=Token.as_string(aws_vpc_ipam_pool_example.id)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_vpc_ipam_pool_cidr_example.override_logical_id("example")
+```
+
+Provision Public IPv6 Pool CIDRs:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_region import DataAwsRegion
+from imports.aws.vpc_ipam import VpcIpam
+from imports.aws.vpc_ipam_pool import VpcIpamPool
+from imports.aws.vpc_ipam_pool_cidr import VpcIpamPoolCidr
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        current = DataAwsRegion(self, "current")
+        example = VpcIpam(self, "example",
+            operating_regions=[VpcIpamOperatingRegions(
+                region_name=Token.as_string(current.name)
+            )
+            ]
+        )
+        ipv6_test_public = VpcIpamPool(self, "ipv6_test_public",
+            address_family="ipv6",
+            aws_service="ec2",
+            description="public ipv6",
+            ipam_scope_id=example.public_default_scope_id,
+            locale="us-east-1",
+            public_ip_source="amazon",
+            publicly_advertisable=False
+        )
+        aws_vpc_ipam_pool_cidr_ipv6_test_public = VpcIpamPoolCidr(self, "ipv6_test_public_3",
+            ipam_pool_id=ipv6_test_public.id,
+            netmask_length=52
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_vpc_ipam_pool_cidr_ipv6_test_public.override_logical_id("ipv6_test_public")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `cidr` - (Optional) The CIDR you want to assign to the pool. Conflicts with `netmask_length`.
+* `cidr_authorization_context` - (Optional) A signed document that proves that you are authorized to bring the specified IP address range to Amazon using BYOIP. This is not stored in the state file. See [cidr_authorization_context](#cidr_authorization_context) for more information.
+* `ipam_pool_id` - (Required) The ID of the pool to which you want to assign a CIDR.
+* `netmask_length` - (Optional) If provided, the cidr provisioned into the specified pool will be the next available cidr given this declared netmask length. Conflicts with `cidr`.
+
+### cidr_authorization_context
+
+* `message` - (Optional) The plain-text authorization message for the prefix and account.
+* `signature` - (Optional) The signed authorization message for the prefix and account.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the IPAM Pool Cidr concatenated with the IPAM Pool ID.
+* `ipam_pool_cidr_id` - The unique ID generated by AWS for the pool cidr. Typically this is the resource `id` but this attribute was added to the API calls after the fact and is therefore not used as the terraform resource id.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IPAMs using the `<cidr>_<ipam-pool-id>`. For example:
+
+**NOTE:** Do not use the IPAM Pool Cidr ID as this was introduced after the resource already existed.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import IPAMs using the `<cidr>_<ipam-pool-id>`. For example:
+
+**NOTE:** Do not use the IPAM Pool Cidr ID as this was introduced after the resource already existed.
+
+```console
+% terraform import aws_vpc_ipam_pool_cidr.example 172.20.0.0/24_ipam-pool-0e634f5a1517cccdc
+```
+
+<!-- cache-key: cdktf-0.18.0 input-9510d76ea7d66c26049583f9c5d435912df190bc1c3c78f5fda73a13a93912cc -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/vpc_ipam_pool_cidr_allocation.html.markdown b/website/docs/cdktf/python/r/vpc_ipam_pool_cidr_allocation.html.markdown
new file mode 100644
index 00000000000..0cd5af73400
--- /dev/null
+++ b/website/docs/cdktf/python/r/vpc_ipam_pool_cidr_allocation.html.markdown
@@ -0,0 +1,150 @@
+---
+subcategory: "VPC IPAM (IP Address Manager)"
+layout: "aws"
+page_title: "AWS: aws_vpc_ipam_pool_cidr_allocation"
+description: |-
+  Allocates (reserves) a CIDR from an IPAM address pool, preventing usage by IPAM.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_vpc_ipam_pool_cidr_allocation
+
+Allocates (reserves) a CIDR from an IPAM address pool, preventing usage by IPAM. Only works for private IPv4.
+
+## Example Usage
+
+Basic usage:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_region import DataAwsRegion
+from imports.aws.vpc_ipam import VpcIpam
+from imports.aws.vpc_ipam_pool import VpcIpamPool
+from imports.aws.vpc_ipam_pool_cidr import VpcIpamPoolCidr
+from imports.aws.vpc_ipam_pool_cidr_allocation import VpcIpamPoolCidrAllocation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        current = DataAwsRegion(self, "current")
+        example = VpcIpam(self, "example",
+            operating_regions=[VpcIpamOperatingRegions(
+                region_name=Token.as_string(current.name)
+            )
+            ]
+        )
+        aws_vpc_ipam_pool_example = VpcIpamPool(self, "example_2",
+            address_family="ipv4",
+            ipam_scope_id=example.private_default_scope_id,
+            locale=Token.as_string(current.name)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_vpc_ipam_pool_example.override_logical_id("example")
+        aws_vpc_ipam_pool_cidr_example = VpcIpamPoolCidr(self, "example_3",
+            cidr="172.20.0.0/16",
+            ipam_pool_id=Token.as_string(aws_vpc_ipam_pool_example.id)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_vpc_ipam_pool_cidr_example.override_logical_id("example")
+        aws_vpc_ipam_pool_cidr_allocation_example = VpcIpamPoolCidrAllocation(self, "example_4",
+            cidr="172.20.0.0/24",
+            depends_on=[aws_vpc_ipam_pool_cidr_example],
+            ipam_pool_id=Token.as_string(aws_vpc_ipam_pool_example.id)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_vpc_ipam_pool_cidr_allocation_example.override_logical_id("example")
+```
+
+With the `disallowed_cidrs` attribute:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_region import DataAwsRegion
+from imports.aws.vpc_ipam import VpcIpam
+from imports.aws.vpc_ipam_pool import VpcIpamPool
+from imports.aws.vpc_ipam_pool_cidr import VpcIpamPoolCidr
+from imports.aws.vpc_ipam_pool_cidr_allocation import VpcIpamPoolCidrAllocation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        current = DataAwsRegion(self, "current")
+        example = VpcIpam(self, "example",
+            operating_regions=[VpcIpamOperatingRegions(
+                region_name=Token.as_string(current.name)
+            )
+            ]
+        )
+        aws_vpc_ipam_pool_example = VpcIpamPool(self, "example_2",
+            address_family="ipv4",
+            ipam_scope_id=example.private_default_scope_id,
+            locale=Token.as_string(current.name)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_vpc_ipam_pool_example.override_logical_id("example")
+        aws_vpc_ipam_pool_cidr_example = VpcIpamPoolCidr(self, "example_3",
+            cidr="172.20.0.0/16",
+            ipam_pool_id=Token.as_string(aws_vpc_ipam_pool_example.id)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_vpc_ipam_pool_cidr_example.override_logical_id("example")
+        aws_vpc_ipam_pool_cidr_allocation_example = VpcIpamPoolCidrAllocation(self, "example_4",
+            depends_on=[aws_vpc_ipam_pool_cidr_example],
+            disallowed_cidrs=["172.20.0.0/28"],
+            ipam_pool_id=Token.as_string(aws_vpc_ipam_pool_example.id),
+            netmask_length=28
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_vpc_ipam_pool_cidr_allocation_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `cidr` - (Optional) The CIDR you want to assign to the pool.
+* `description` - (Optional) The description for the allocation.
+* `disallowed_cidrs` - (Optional) Exclude a particular CIDR range from being returned by the pool.
+* `ipam_pool_id` - (Required) The ID of the pool to which you want to assign a CIDR.
+* `netmask_length` - (Optional) The netmask length of the CIDR you would like to allocate to the IPAM pool. Valid Values: `0-128`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the allocation.
+* `resource_id` - The ID of the resource.
+* `resource_owner` - The owner of the resource.
+* `resource_type` - The type of the resource.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IPAM allocations using the allocation `id` and `pool id`, separated by `_`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import IPAM allocations using the allocation `id` and `pool id`, separated by `_`. For example:
+
+```console
+% terraform import aws_vpc_ipam_pool_cidr_allocation.example ipam-pool-alloc-0dc6d196509c049ba8b549ff99f639736_ipam-pool-07cfb559e0921fcbe
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ddd73bf852bf7f559291762467aeca147a50810e7c21dd054f1b8efa8376bf13 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/vpc_ipam_preview_next_cidr.html.markdown b/website/docs/cdktf/python/r/vpc_ipam_preview_next_cidr.html.markdown
new file mode 100644
index 00000000000..f719eb7bd8b
--- /dev/null
+++ b/website/docs/cdktf/python/r/vpc_ipam_preview_next_cidr.html.markdown
@@ -0,0 +1,80 @@
+---
+subcategory: "VPC IPAM (IP Address Manager)"
+layout: "aws"
+page_title: "AWS: aws_vpc_ipam_preview_next_cidr"
+description: |-
+  Previews a CIDR from an IPAM address pool.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_vpc_ipam_preview_next_cidr
+
+Previews a CIDR from an IPAM address pool. Only works for private IPv4.
+
+## Example Usage
+
+Basic usage:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_region import DataAwsRegion
+from imports.aws.vpc_ipam import VpcIpam
+from imports.aws.vpc_ipam_pool import VpcIpamPool
+from imports.aws.vpc_ipam_pool_cidr import VpcIpamPoolCidr
+from imports.aws.vpc_ipam_preview_next_cidr import VpcIpamPreviewNextCidr
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        current = DataAwsRegion(self, "current")
+        example = VpcIpam(self, "example",
+            operating_regions=[VpcIpamOperatingRegions(
+                region_name=Token.as_string(current.name)
+            )
+            ]
+        )
+        aws_vpc_ipam_pool_example = VpcIpamPool(self, "example_2",
+            address_family="ipv4",
+            ipam_scope_id=example.private_default_scope_id,
+            locale=Token.as_string(current.name)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_vpc_ipam_pool_example.override_logical_id("example")
+        aws_vpc_ipam_pool_cidr_example = VpcIpamPoolCidr(self, "example_3",
+            cidr="172.20.0.0/16",
+            ipam_pool_id=Token.as_string(aws_vpc_ipam_pool_example.id)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_vpc_ipam_pool_cidr_example.override_logical_id("example")
+        aws_vpc_ipam_preview_next_cidr_example = VpcIpamPreviewNextCidr(self, "example_4",
+            depends_on=[aws_vpc_ipam_pool_cidr_example],
+            disallowed_cidrs=["172.2.0.0/32"],
+            ipam_pool_id=Token.as_string(aws_vpc_ipam_pool_example.id),
+            netmask_length=28
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_vpc_ipam_preview_next_cidr_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `disallowed_cidrs` - (Optional) Exclude a particular CIDR range from being returned by the pool.
+* `ipam_pool_id` - (Required) The ID of the pool to which you want to assign a CIDR.
+* `netmask_length` - (Optional) The netmask length of the CIDR you would like to preview from the IPAM pool.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `cidr` - The previewed CIDR from the pool.
+* `id` - The ID of the preview.
+
+<!-- cache-key: cdktf-0.18.0 input-db4b1871b5157cc9d4a7fcfd29b8fc4970d630b294fcf9dd81f44145d3e4f936 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/vpc_ipam_resource_discovery.html.markdown b/website/docs/cdktf/python/r/vpc_ipam_resource_discovery.html.markdown
new file mode 100644
index 00000000000..8df55f23a85
--- /dev/null
+++ b/website/docs/cdktf/python/r/vpc_ipam_resource_discovery.html.markdown
@@ -0,0 +1,87 @@
+---
+subcategory: "VPC IPAM (IP Address Manager)"
+layout: "aws"
+page_title: "AWS: aws_vpc_ipam_resource_discovery"
+description: |-
+  Provides an IPAM Resource Discovery resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_vpc_ipam_resource_discovery
+
+Provides an IPAM Resource Discovery resource. IPAM Resource Discoveries are resources meant for multi-organization customers. If you wish to use a single IPAM across multiple orgs, a resource discovery can be created and shared from a subordinate organization to the management organizations IPAM delegated admin account. For a full deployment example, see `aws_vpc_ipam_resource_discovery_association` resource.
+
+## Example Usage
+
+Basic usage:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_region import DataAwsRegion
+from imports.aws.vpc_ipam_resource_discovery import VpcIpamResourceDiscovery
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        current = DataAwsRegion(self, "current")
+        VpcIpamResourceDiscovery(self, "main",
+            description="My IPAM Resource Discovery",
+            operating_regions=[VpcIpamResourceDiscoveryOperatingRegions(
+                region_name=Token.as_string(current.name)
+            )
+            ],
+            tags={
+                "Test": "Main"
+            }
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `description` - (Optional) A description for the IPAM Resource Discovery.
+* `operating_regions` - (Required) Determines which regions the Resource Discovery will enable IPAM features for usage and monitoring. Locale is the Region where you want to make an IPAM pool available for allocations. You can only create pools with locales that match the operating Regions of the IPAM Resource Discovery. You can only create VPCs from a pool whose locale matches the VPC's Region. You specify a region using the [region_name](#operating_regions) parameter. **You must set your provider block region as an operating_region.**
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### operating_regions
+
+* `region_name` - (Required) The name of the Region you want to add to the IPAM.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of IPAM Resource Discovery
+* `id` - The ID of the IPAM Resource Discovery
+* `is_default` - A boolean to identify if the Resource Discovery is the accounts default resource discovery
+* `owner_id` - The account ID for the account that manages the Resource Discovery
+* `ipam_resource_discovery_region` - The home region of the Resource Discovery
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IPAMs using the IPAM resource discovery `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import IPAMs using the IPAM resource discovery `id`. For example:
+
+```console
+% terraform import aws_vpc_ipam_resource_discovery.example ipam-res-disco-0178368ad2146a492
+```
+
+<!-- cache-key: cdktf-0.18.0 input-e397380d953ebd30e61a0c3d1b2b84c946cea9f478b02e0627708ce5f413dc35 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/vpc_ipam_resource_discovery_association.html.markdown b/website/docs/cdktf/python/r/vpc_ipam_resource_discovery_association.html.markdown
new file mode 100644
index 00000000000..cbd7e5164cc
--- /dev/null
+++ b/website/docs/cdktf/python/r/vpc_ipam_resource_discovery_association.html.markdown
@@ -0,0 +1,82 @@
+---
+subcategory: "VPC IPAM (IP Address Manager)"
+layout: "aws"
+page_title: "AWS: aws_vpc_ipam_resource_discovery_association"
+description: |-
+  Provides an IPAM Resource Discovery Association resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_vpc_ipam_resource_discovery_association
+
+Provides an association between an Amazon IP Address Manager (IPAM) and a IPAM Resource Discovery. IPAM Resource Discoveries are resources meant for multi-organization customers. If you wish to use a single IPAM across multiple orgs, a resource discovery can be created and shared from a subordinate organization to the management organizations IPAM delegated admin account.
+
+Once an association is created between two organizations via IPAM & a IPAM Resource Discovery, IPAM Pools can be shared via Resource Access Manager (RAM) to accounts in the subordinate organization; these RAM shares must be accepted by the end user account. Pools can then also discover and monitor IPAM resources in the subordinate organization.
+
+## Example Usage
+
+Basic usage:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.vpc_ipam_resource_discovery_association import VpcIpamResourceDiscoveryAssociation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        VpcIpamResourceDiscoveryAssociation(self, "test",
+            ipam_id=Token.as_string(aws_vpc_ipam_test.id),
+            ipam_resource_discovery_id=Token.as_string(aws_vpc_ipam_resource_discovery_test.id),
+            tags={
+                "Name": "test"
+            }
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `ipam_id` - (Required) The ID of the IPAM to associate.
+* `ipam_resource_discovery_id` - (Required) The ID of the Resource Discovery to associate.
+* `tags` - (Optional) A map of tags to add to the IPAM resource discovery association resource.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of IPAM Resource Discovery Association.
+* `id` - The ID of the IPAM Resource Discovery Association.
+* `owner_id` - The account ID for the account that manages the Resource Discovery
+* `ipam_arn` - The Amazon Resource Name (ARN) of the IPAM.
+* `ipam_region` - The home region of the IPAM.
+* `is_default` - A boolean to identify if the Resource Discovery is the accounts default resource discovery.
+* `state` - The lifecycle state of the association when you associate or disassociate a resource discovery.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IPAMs using the IPAM resource discovery association `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import IPAMs using the IPAM resource discovery association `id`. For example:
+
+```console
+% terraform import aws_vpc_ipam_resource_discovery_association.example ipam-res-disco-assoc-0178368ad2146a492
+```
+
+<!-- cache-key: cdktf-0.18.0 input-f38914c02b6478a3d1a5d0b4590df76302aa42ccd4610ae8d1077dfd286db5df -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/vpc_ipam_scope.html.markdown b/website/docs/cdktf/python/r/vpc_ipam_scope.html.markdown
new file mode 100644
index 00000000000..a41ffa448a8
--- /dev/null
+++ b/website/docs/cdktf/python/r/vpc_ipam_scope.html.markdown
@@ -0,0 +1,86 @@
+---
+subcategory: "VPC IPAM (IP Address Manager)"
+layout: "aws"
+page_title: "AWS: aws_vpc_ipam_scope"
+description: |-
+  Creates a scope for AWS IPAM.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_vpc_ipam_scope
+
+Creates a scope for AWS IPAM.
+
+## Example Usage
+
+Basic usage:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_region import DataAwsRegion
+from imports.aws.vpc_ipam import VpcIpam
+from imports.aws.vpc_ipam_scope import VpcIpamScope
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        current = DataAwsRegion(self, "current")
+        example = VpcIpam(self, "example",
+            operating_regions=[VpcIpamOperatingRegions(
+                region_name=Token.as_string(current.name)
+            )
+            ]
+        )
+        aws_vpc_ipam_scope_example = VpcIpamScope(self, "example_2",
+            description="Another Scope",
+            ipam_id=example.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_vpc_ipam_scope_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `ipam_id` - The ID of the IPAM for which you're creating this scope.
+* `description` - (Optional) A description for the scope you're creating.
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the scope.
+* `id` - The ID of the IPAM Scope.
+* `ipam_arn` - The ARN of the IPAM for which you're creating this scope.
+* `is_default` - Defines if the scope is the default scope or not.
+* `pool_count` - The number of pools in the scope.
+* `type` - The type of the scope.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IPAMs using the `scope_id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import IPAMs using the `scope_id`. For example:
+
+```console
+% terraform import aws_vpc_ipam_scope.example ipam-scope-0513c69f283d11dfb
+```
+
+<!-- cache-key: cdktf-0.18.0 input-68c08f61045d93ee20b37304de2497b2ea7ce59df7aaa4d8e18944d3dc0ddf4e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/vpc_ipv4_cidr_block_association.html.markdown b/website/docs/cdktf/python/r/vpc_ipv4_cidr_block_association.html.markdown
new file mode 100644
index 00000000000..8458e6d7f22
--- /dev/null
+++ b/website/docs/cdktf/python/r/vpc_ipv4_cidr_block_association.html.markdown
@@ -0,0 +1,83 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_vpc_ipv4_cidr_block_association"
+description: |-
+  Associate additional IPv4 CIDR blocks with a VPC
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_vpc_ipv4_cidr_block_association
+
+Provides a resource to associate additional IPv4 CIDR blocks with a VPC.
+
+When a VPC is created, a primary IPv4 CIDR block for the VPC must be specified.
+The `aws_vpc_ipv4_cidr_block_association` resource allows further IPv4 CIDR blocks to be added to the VPC.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.vpc import Vpc
+from imports.aws.vpc_ipv4_cidr_block_association import VpcIpv4CidrBlockAssociation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        main = Vpc(self, "main",
+            cidr_block="10.0.0.0/16"
+        )
+        VpcIpv4CidrBlockAssociation(self, "secondary_cidr",
+            cidr_block="172.20.0.0/16",
+            vpc_id=main.id
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `cidr_block` - (Optional) The IPv4 CIDR block for the VPC. CIDR can be explicitly set or it can be derived from IPAM using `ipv4_netmask_length`.
+* `ipv4_ipam_pool_id` - (Optional) The ID of an IPv4 IPAM pool you want to use for allocating this VPC's CIDR. IPAM is a VPC feature that you can use to automate your IP address management workflows including assigning, tracking, troubleshooting, and auditing IP addresses across AWS Regions and accounts. Using IPAM you can monitor IP address usage throughout your AWS Organization.
+* `ipv4_netmask_length` - (Optional) The netmask length of the IPv4 CIDR you want to allocate to this VPC. Requires specifying a `ipv4_ipam_pool_id`.
+* `vpc_id` - (Required) The ID of the VPC to make the association with.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the VPC CIDR association
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `10m`)
+- `delete` - (Default `10m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_vpc_ipv4_cidr_block_association` using the VPC CIDR Association ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_vpc_ipv4_cidr_block_association` using the VPC CIDR Association ID. For example:
+
+```console
+% terraform import aws_vpc_ipv4_cidr_block_association.example vpc-cidr-assoc-xxxxxxxx
+```
+
+<!-- cache-key: cdktf-0.18.0 input-e6e4470001cf2936d2999e896d3abef4818433b72b60c96368624c0b9f649444 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/vpc_ipv6_cidr_block_association.html.markdown b/website/docs/cdktf/python/r/vpc_ipv6_cidr_block_association.html.markdown
new file mode 100644
index 00000000000..90ec1e32521
--- /dev/null
+++ b/website/docs/cdktf/python/r/vpc_ipv6_cidr_block_association.html.markdown
@@ -0,0 +1,84 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_vpc_ipv6_cidr_block_association"
+description: |-
+  Associate additional IPv6 CIDR blocks with a VPC
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_vpc_ipv6_cidr_block_association
+
+Provides a resource to associate additional IPv6 CIDR blocks with a VPC.
+
+The `aws_vpc_ipv6_cidr_block_association` resource allows IPv6 CIDR blocks to be added to the VPC.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.vpc import Vpc
+from imports.aws.vpc_ipv6_cidr_block_association import VpcIpv6CidrBlockAssociation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        test = Vpc(self, "test",
+            cidr_block="10.0.0.0/16"
+        )
+        aws_vpc_ipv6_cidr_block_association_test = VpcIpv6CidrBlockAssociation(self, "test_1",
+            ipv6_ipam_pool_id=Token.as_string(aws_vpc_ipam_pool_test.id),
+            vpc_id=test.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_vpc_ipv6_cidr_block_association_test.override_logical_id("test")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `ipv6_cidr_block` - (Optional) The IPv6 CIDR block for the VPC. CIDR can be explicitly set or it can be derived from IPAM using `ipv6_netmask_length`. This parameter is required if `ipv6_netmask_length` is not set and the IPAM pool does not have `allocation_default_netmask` set.
+* `ipv6_ipam_pool_id` - (Required) The ID of an IPv6 IPAM pool you want to use for allocating this VPC's CIDR. IPAM is a VPC feature that you can use to automate your IP address management workflows including assigning, tracking, troubleshooting, and auditing IP addresses across AWS Regions and accounts.
+* `ipv6_netmask_length` - (Optional) The netmask length of the IPv6 CIDR you want to allocate to this VPC. Requires specifying a `ipv6_ipam_pool_id`. This parameter is optional if the IPAM pool has `allocation_default_netmask` set, otherwise it or `cidr_block` are required
+* `vpc_id` - (Required) The ID of the VPC to make the association with.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `10m`)
+- `delete` - (Default `10m`)
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the VPC CIDR association
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_vpc_ipv6_cidr_block_association` using the VPC CIDR Association ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import `aws_vpc_ipv6_cidr_block_association` using the VPC CIDR Association ID. For example:
+
+```console
+% terraform import aws_vpc_ipv6_cidr_block_association.example vpc-cidr-assoc-xxxxxxxx
+```
+
+<!-- cache-key: cdktf-0.18.0 input-2a201569794abd4dddb78258ff009909eca49be072f28d838cf246ae7161cc63 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/vpc_network_performance_metric_subscription.html.markdown b/website/docs/cdktf/python/r/vpc_network_performance_metric_subscription.html.markdown
new file mode 100644
index 00000000000..fea45e3103c
--- /dev/null
+++ b/website/docs/cdktf/python/r/vpc_network_performance_metric_subscription.html.markdown
@@ -0,0 +1,50 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_vpc_network_performance_metric_subscription"
+description: |-
+  Provides a resource to manage an Infrastructure Performance subscription.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_vpc_network_performance_metric_subscription
+
+Provides a resource to manage an Infrastructure Performance subscription.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.vpc_network_performance_metric_subscription import VpcNetworkPerformanceMetricSubscription
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        VpcNetworkPerformanceMetricSubscription(self, "example",
+            destination="us-west-1",
+            source="us-east-1"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `destination` - (Required) The target Region or Availability Zone that the metric subscription is enabled for. For example, `eu-west-1`.
+* `metric` - (Optional) The metric used for the enabled subscription. Valid values: `aggregate-latency`. Default: `aggregate-latency`.
+* `source` - (Required) The source Region or Availability Zone that the metric subscription is enabled for. For example, `us-east-1`.
+* `statistic` - (Optional) The statistic used for the enabled subscription. Valid values: `p50`. Default: `p50`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `period` - The data aggregation time for the subscription.
+
+<!-- cache-key: cdktf-0.18.0 input-9d68b5453f7e730fab6a7906222b20f270436a0a63a8e8c8fed51dab43b1b2e7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/vpc_peering_connection.html.markdown b/website/docs/cdktf/python/r/vpc_peering_connection.html.markdown
new file mode 100644
index 00000000000..0e86ba65c6a
--- /dev/null
+++ b/website/docs/cdktf/python/r/vpc_peering_connection.html.markdown
@@ -0,0 +1,217 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_vpc_peering_connection"
+description: |-
+  Provides a resource to manage a VPC peering connection.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_vpc_peering_connection
+
+Provides a resource to manage a VPC peering connection.
+
+~> **NOTE on VPC Peering Connections and VPC Peering Connection Options:** Terraform provides
+both a standalone [VPC Peering Connection Options](vpc_peering_connection_options.html) and a VPC Peering Connection
+resource with `accepter` and `requester` attributes. Do not manage options for the same VPC peering
+connection in both a VPC Peering Connection resource and a VPC Peering Connection Options resource.
+Doing so will cause a conflict of options and will overwrite the options.
+Using a VPC Peering Connection Options resource decouples management of the connection options from
+management of the VPC Peering Connection and allows options to be set correctly in cross-account scenarios.
+
+-> **Note:** For cross-account (requester's AWS account differs from the accepter's AWS account) or inter-region
+VPC Peering Connections use the `aws_vpc_peering_connection` resource to manage the requester's side of the
+connection and use the `aws_vpc_peering_connection_accepter` resource to manage the accepter's side of the connection.
+
+-> **Note:** Creating multiple `aws_vpc_peering_connection` resources with the same `peer_vpc_id` and `vpc_id` will not produce an error. Instead, AWS will return the connection `id` that already exists, resulting in multiple `aws_vpc_peering_connection` resources with the same `id`.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.vpc_peering_connection import VpcPeeringConnection
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        VpcPeeringConnection(self, "foo",
+            peer_owner_id=peer_owner_id.string_value,
+            peer_vpc_id=bar.id,
+            vpc_id=Token.as_string(aws_vpc_foo.id)
+        )
+```
+
+Basic usage with connection options:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.vpc_peering_connection import VpcPeeringConnection
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        VpcPeeringConnection(self, "foo",
+            accepter=VpcPeeringConnectionAccepter(
+                allow_remote_vpc_dns_resolution=True
+            ),
+            peer_owner_id=peer_owner_id.string_value,
+            peer_vpc_id=bar.id,
+            requester=VpcPeeringConnectionRequester(
+                allow_remote_vpc_dns_resolution=True
+            ),
+            vpc_id=Token.as_string(aws_vpc_foo.id)
+        )
+```
+
+Basic usage with tags:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.vpc import Vpc
+from imports.aws.vpc_peering_connection import VpcPeeringConnection
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        bar = Vpc(self, "bar",
+            cidr_block="10.2.0.0/16"
+        )
+        foo = Vpc(self, "foo",
+            cidr_block="10.1.0.0/16"
+        )
+        aws_vpc_peering_connection_foo = VpcPeeringConnection(self, "foo_2",
+            auto_accept=True,
+            peer_owner_id=peer_owner_id.string_value,
+            peer_vpc_id=bar.id,
+            tags={
+                "Name": "VPC Peering between foo and bar"
+            },
+            vpc_id=foo.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_vpc_peering_connection_foo.override_logical_id("foo")
+```
+
+Basic usage with region:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.vpc import Vpc
+from imports.aws.vpc_peering_connection import VpcPeeringConnection
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        bar = Vpc(self, "bar",
+            cidr_block="10.2.0.0/16",
+            provider=us_east1
+        )
+        foo = Vpc(self, "foo",
+            cidr_block="10.1.0.0/16",
+            provider=us_west2
+        )
+        aws_vpc_peering_connection_foo = VpcPeeringConnection(self, "foo_2",
+            peer_owner_id=peer_owner_id.string_value,
+            peer_region="us-east-1",
+            peer_vpc_id=bar.id,
+            vpc_id=foo.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_vpc_peering_connection_foo.override_logical_id("foo")
+```
+
+## Argument Reference
+
+-> **Note:** Modifying the VPC Peering Connection options requires peering to be active. An automatic activation
+can be done using the [`auto_accept`](vpc_peering_connection.html#auto_accept) attribute. Alternatively, the VPC Peering
+Connection has to be made active manually using other means. See [notes](vpc_peering_connection.html#notes) below for
+more information.
+
+This argument supports the following arguments:
+
+* `peer_owner_id` - (Optional) The AWS account ID of the owner of the peer VPC.
+   Defaults to the account ID the [AWS provider][1] is currently connected to.
+* `peer_vpc_id` - (Required) The ID of the VPC with which you are creating the VPC Peering Connection.
+* `vpc_id` - (Required) The ID of the requester VPC.
+* `auto_accept` - (Optional) Accept the peering (both VPCs need to be in the same AWS account and region).
+* `peer_region` - (Optional) The region of the accepter VPC of the VPC Peering Connection. `auto_accept` must be `false`,
+and use the `aws_vpc_peering_connection_accepter` to manage the accepter side.
+* `accepter` (Optional) - An optional configuration block that allows for [VPC Peering Connection](https://docs.aws.amazon.com/vpc/latest/peering/what-is-vpc-peering.html) options to be set for the VPC that accepts
+the peering connection (a maximum of one).
+* `requester` (Optional) - A optional configuration block that allows for [VPC Peering Connection](https://docs.aws.amazon.com/vpc/latest/peering/what-is-vpc-peering.html) options to be set for the VPC that requests
+the peering connection (a maximum of one).
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+#### Accepter and Requester Arguments
+
+-> **Note:** When enabled, the DNS resolution feature requires that VPCs participating in the peering
+must have support for the DNS hostnames enabled. This can be done using the [`enable_dns_hostnames`](vpc.html#enable_dns_hostnames) attribute in the [`aws_vpc`](vpc.html) resource. See [Using DNS with Your VPC](http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/vpc-dns.html) user guide for more information.
+
+* `allow_remote_vpc_dns_resolution` - (Optional) Allow a local VPC to resolve public DNS hostnames to
+private IP addresses when queried from instances in the peer VPC.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the VPC Peering Connection.
+* `accept_status` - The status of the VPC Peering Connection request.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Notes
+
+If both VPCs are not in the same AWS account and region do not enable the `auto_accept` attribute.
+The accepter can manage its side of the connection using the `aws_vpc_peering_connection_accepter` resource
+or accept the connection manually using the AWS Management Console, AWS CLI, through SDKs, etc.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `1m`)
+- `update` - (Default `1m`)
+- `delete` - (Default `1m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import VPC Peering resources using the VPC peering `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import VPC Peering resources using the VPC peering `id`. For example:
+
+```console
+% terraform import aws_vpc_peering_connection.test_connection pcx-111aaa111
+```
+
+[1]: /docs/providers/aws/index.html
+
+<!-- cache-key: cdktf-0.18.0 input-73a508d459b90465fa5267c1055341add54eefba044dcb055a7d430ee33449de -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/vpc_peering_connection_accepter.html.markdown b/website/docs/cdktf/python/r/vpc_peering_connection_accepter.html.markdown
new file mode 100644
index 00000000000..80288f0f9bc
--- /dev/null
+++ b/website/docs/cdktf/python/r/vpc_peering_connection_accepter.html.markdown
@@ -0,0 +1,163 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_vpc_peering_connection_accepter"
+description: |-
+  Manage the accepter's side of a VPC Peering Connection.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_vpc_peering_connection_accepter
+
+Provides a resource to manage the accepter's side of a VPC Peering Connection.
+
+When a cross-account (requester's AWS account differs from the accepter's AWS account) or an inter-region
+VPC Peering Connection is created, a VPC Peering Connection resource is automatically created in the
+accepter's account.
+The requester can use the `aws_vpc_peering_connection` resource to manage its side of the connection
+and the accepter can use the `aws_vpc_peering_connection_accepter` resource to "adopt" its side of the
+connection into management.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_caller_identity import DataAwsCallerIdentity
+from imports.aws.provider import AwsProvider
+from imports.aws.vpc import Vpc
+from imports.aws.vpc_peering_connection import VpcPeeringConnection
+from imports.aws.vpc_peering_connection_accepter import VpcPeeringConnectionAccepterA
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        AwsProvider(self, "aws",
+            region="us-east-1"
+        )
+        peer = AwsProvider(self, "aws_1",
+            alias="peer",
+            region="us-west-2"
+        )
+        main = Vpc(self, "main",
+            cidr_block="10.0.0.0/16"
+        )
+        aws_vpc_peer = Vpc(self, "peer",
+            cidr_block="10.1.0.0/16",
+            provider=peer
+        )
+        data_aws_caller_identity_peer = DataAwsCallerIdentity(self, "peer_4",
+            provider=peer
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_caller_identity_peer.override_logical_id("peer")
+        aws_vpc_peering_connection_peer = VpcPeeringConnection(self, "peer_5",
+            auto_accept=False,
+            peer_owner_id=Token.as_string(data_aws_caller_identity_peer.account_id),
+            peer_region="us-west-2",
+            peer_vpc_id=Token.as_string(aws_vpc_peer.id),
+            tags={
+                "Side": "Requester"
+            },
+            vpc_id=main.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_vpc_peering_connection_peer.override_logical_id("peer")
+        aws_vpc_peering_connection_accepter_peer =
+        VpcPeeringConnectionAccepterA(self, "peer_6",
+            auto_accept=True,
+            provider=peer,
+            tags={
+                "Side": "Accepter"
+            },
+            vpc_peering_connection_id=Token.as_string(aws_vpc_peering_connection_peer.id)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_vpc_peering_connection_accepter_peer.override_logical_id("peer")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `vpc_peering_connection_id` - (Required) The VPC Peering Connection ID to manage.
+* `auto_accept` - (Optional) Whether or not to accept the peering request. Defaults to `false`.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Removing `aws_vpc_peering_connection_accepter` from your configuration
+
+AWS allows a cross-account VPC Peering Connection to be deleted from either the requester's or accepter's side.
+However, Terraform only allows the VPC Peering Connection to be deleted from the requester's side
+by removing the corresponding `aws_vpc_peering_connection` resource from your configuration.
+Removing a `aws_vpc_peering_connection_accepter` resource from your configuration will remove it
+from your statefile and management, **but will not destroy the VPC Peering Connection.**
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the VPC Peering Connection.
+* `accept_status` - The status of the VPC Peering Connection request.
+* `vpc_id` - The ID of the accepter VPC.
+* `peer_vpc_id` - The ID of the requester VPC.
+* `peer_owner_id` - The AWS account ID of the owner of the requester VPC.
+* `peer_region` - The region of the accepter VPC.
+* `accepter` - A configuration block that describes [VPC Peering Connection]
+(https://docs.aws.amazon.com/vpc/latest/peering/what-is-vpc-peering.html) options set for the accepter VPC.
+* `requester` - A configuration block that describes [VPC Peering Connection]
+(https://docs.aws.amazon.com/vpc/latest/peering/what-is-vpc-peering.html) options set for the requester VPC.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+#### Accepter and Requester Attribute Reference
+
+* `allow_remote_vpc_dns_resolution` - Indicates whether a local VPC can resolve public DNS hostnames to
+private IP addresses when queried from instances in a peer VPC.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import VPC Peering Connection Accepters using the Peering Connection ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import VPC Peering Connection Accepters using the Peering Connection ID. For example:
+
+```console
+% terraform import aws_vpc_peering_connection_accepter.example pcx-12345678
+```
+
+Certain resource arguments, like `auto_accept`, do not have an EC2 API method for reading the information after peering connection creation. If the argument is set in the Terraform configuration on an imported resource, Terraform will always show a difference. To workaround this behavior, either omit the argument from the Terraform configuration or use [`ignore_changes`](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html#ignore_changes) to hide the difference. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from cdktf import TerraformResourceLifecycle
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.vpc_peering_connection_accepter import VpcPeeringConnectionAccepterA
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, vpcPeeringConnectionId):
+        super().__init__(scope, name)
+        VpcPeeringConnectionAccepterA(self, "example",
+            lifecycle=TerraformResourceLifecycle(
+                ignore_changes=[auto_accept]
+            ),
+            vpc_peering_connection_id=vpc_peering_connection_id
+        )
+```
+
+<!-- cache-key: cdktf-0.18.0 input-dbb400c8499f3d1bd1cf4007a705760a09da1d8679355ddec9917b7f40b9f101 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/vpc_peering_connection_options.html.markdown b/website/docs/cdktf/python/r/vpc_peering_connection_options.html.markdown
new file mode 100644
index 00000000000..e7196fd31f5
--- /dev/null
+++ b/website/docs/cdktf/python/r/vpc_peering_connection_options.html.markdown
@@ -0,0 +1,185 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_vpc_peering_connection_options"
+description: |-
+  Provides a resource to manage VPC peering connection options.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_vpc_peering_connection_options
+
+Provides a resource to manage VPC peering connection options.
+
+~> **NOTE on VPC Peering Connections and VPC Peering Connection Options:** Terraform provides
+both a standalone VPC Peering Connection Options and a [VPC Peering Connection](vpc_peering_connection.html)
+resource with `accepter` and `requester` attributes. Do not manage options for the same VPC peering
+connection in both a VPC Peering Connection resource and a VPC Peering Connection Options resource.
+Doing so will cause a conflict of options and will overwrite the options.
+Using a VPC Peering Connection Options resource decouples management of the connection options from
+management of the VPC Peering Connection and allows options to be set correctly in cross-region and
+cross-account scenarios.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.vpc import Vpc
+from imports.aws.vpc_peering_connection import VpcPeeringConnection
+from imports.aws.vpc_peering_connection_options import VpcPeeringConnectionOptions
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        bar = Vpc(self, "bar",
+            cidr_block="10.1.0.0/16"
+        )
+        foo = Vpc(self, "foo",
+            cidr_block="10.0.0.0/16"
+        )
+        aws_vpc_peering_connection_foo = VpcPeeringConnection(self, "foo_2",
+            auto_accept=True,
+            peer_vpc_id=bar.id,
+            vpc_id=foo.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_vpc_peering_connection_foo.override_logical_id("foo")
+        aws_vpc_peering_connection_options_foo = VpcPeeringConnectionOptions(self, "foo_3",
+            accepter=VpcPeeringConnectionOptionsAccepter(
+                allow_remote_vpc_dns_resolution=True
+            ),
+            vpc_peering_connection_id=Token.as_string(aws_vpc_peering_connection_foo.id)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_vpc_peering_connection_options_foo.override_logical_id("foo")
+```
+
+### Cross-Account Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_caller_identity import DataAwsCallerIdentity
+from imports.aws.provider import AwsProvider
+from imports.aws.vpc import Vpc
+from imports.aws.vpc_peering_connection import VpcPeeringConnection
+from imports.aws.vpc_peering_connection_accepter import VpcPeeringConnectionAccepterA
+from imports.aws.vpc_peering_connection_options import VpcPeeringConnectionOptions
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        requester = AwsProvider(self, "aws",
+            alias="requester"
+        )
+        accepter = AwsProvider(self, "aws_1",
+            alias="accepter"
+        )
+        main = Vpc(self, "main",
+            cidr_block="10.0.0.0/16",
+            enable_dns_hostnames=True,
+            enable_dns_support=True,
+            provider=requester
+        )
+        peer = Vpc(self, "peer",
+            cidr_block="10.1.0.0/16",
+            enable_dns_hostnames=True,
+            enable_dns_support=True,
+            provider=accepter
+        )
+        data_aws_caller_identity_peer = DataAwsCallerIdentity(self, "peer_4",
+            provider=accepter
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_caller_identity_peer.override_logical_id("peer")
+        aws_vpc_peering_connection_peer = VpcPeeringConnection(self, "peer_5",
+            auto_accept=False,
+            peer_owner_id=Token.as_string(data_aws_caller_identity_peer.account_id),
+            peer_vpc_id=peer.id,
+            provider=requester,
+            tags={
+                "Side": "Requester"
+            },
+            vpc_id=main.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_vpc_peering_connection_peer.override_logical_id("peer")
+        aws_vpc_peering_connection_accepter_peer =
+        VpcPeeringConnectionAccepterA(self, "peer_6",
+            auto_accept=True,
+            provider=accepter,
+            tags={
+                "Side": "Accepter"
+            },
+            vpc_peering_connection_id=Token.as_string(aws_vpc_peering_connection_peer.id)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_vpc_peering_connection_accepter_peer.override_logical_id("peer")
+        VpcPeeringConnectionOptions(self, "accepter",
+            accepter=VpcPeeringConnectionOptionsAccepter(
+                allow_remote_vpc_dns_resolution=True
+            ),
+            provider=accepter,
+            vpc_peering_connection_id=Token.as_string(aws_vpc_peering_connection_accepter_peer.id)
+        )
+        VpcPeeringConnectionOptions(self, "requester",
+            provider=requester,
+            requester=VpcPeeringConnectionOptionsRequester(
+                allow_remote_vpc_dns_resolution=True
+            ),
+            vpc_peering_connection_id=Token.as_string(aws_vpc_peering_connection_accepter_peer.id)
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `vpc_peering_connection_id` - (Required) The ID of the requester VPC peering connection.
+* `accepter` (Optional) - An optional configuration block that allows for [VPC Peering Connection](https://docs.aws.amazon.com/vpc/latest/peering/what-is-vpc-peering.html) options to be set for the VPC that acceptsthe peering connection (a maximum of one).
+* `requester` (Optional) - A optional configuration block that allows for [VPC Peering Connection](https://docs.aws.amazon.com/vpc/latest/peering/what-is-vpc-peering.html) options to be set for the VPC that requeststhe peering connection (a maximum of one).
+
+#### Accepter and Requester Arguments
+
+-> **Note:** When enabled, the DNS resolution feature requires that VPCs participating in the peering must have support for the DNS hostnames enabled. This can be done using the [`enable_dns_hostnames`](vpc.html#enable_dns_hostnames) attribute in the [`aws_vpc`](vpc.html) resource. See [Using DNS with Your VPC](http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/vpc-dns.html) user guide for more information.
+
+* `allow_remote_vpc_dns_resolution` - (Optional) Allow a local VPC to resolve public DNS hostnames to private IP addresses when queried from instances in the peer VPC.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the VPC Peering Connection Options.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import VPC Peering Connection Options using the VPC peering `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import VPC Peering Connection Options using the VPC peering `id`. For example:
+
+```console
+% terraform import aws_vpc_peering_connection_options.foo pcx-111aaa111
+```
+
+<!-- cache-key: cdktf-0.18.0 input-0062ec18a4f742aa15c04ce7c0dc2438cb0c8699001025a2f42368b3d237e0ac -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/vpc_security_group_egress_rule.html.markdown b/website/docs/cdktf/python/r/vpc_security_group_egress_rule.html.markdown
new file mode 100644
index 00000000000..97b8117f60e
--- /dev/null
+++ b/website/docs/cdktf/python/r/vpc_security_group_egress_rule.html.markdown
@@ -0,0 +1,89 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_vpc_security_group_egress_rule"
+description: |-
+  Provides a VPC security group egress rule resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_vpc_security_group_egress_rule
+
+Manages an outbound (egress) rule for a security group.
+
+When specifying an outbound rule for your security group in a VPC, the configuration must include a destination for the traffic.
+
+~> **NOTE on Security Groups and Security Group Rules:** Terraform currently provides a [Security Group resource](security_group.html) with `ingress` and `egress` rules defined in-line and a [Security Group Rule resource](security_group_rule.html) which manages one or more `ingress` or
+`egress` rules. Both of these resource were added before AWS assigned a [security group rule unique ID](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/security-group-rules.html), and they do not work well in all scenarios using the`description` and `tags` attributes, which rely on the unique ID.
+The `aws_vpc_security_group_egress_rule` resource has been added to address these limitations and should be used for all new security group rules.
+You should not use the `aws_vpc_security_group_egress_rule` resource in conjunction with an `aws_security_group` resource with in-line rules or with `aws_security_group_rule` resources defined for the same Security Group, as rule conflicts may occur and rules will be overwritten.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.vpc_security_group_egress_rule import VpcSecurityGroupEgressRule
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        VpcSecurityGroupEgressRule(self, "example",
+            cidr_ipv4="10.0.0.0/8",
+            from_port=80,
+            ip_protocol="tcp",
+            security_group_id=Token.as_string(aws_security_group_example.id),
+            to_port=80
+        )
+```
+
+## Argument Reference
+
+~> **Note** Although `cidr_ipv4`, `cidr_ipv6`, `prefix_list_id`, and `referenced_security_group_id` are all marked as optional, you *must* provide one of them in order to configure the destination of the traffic. The `from_port` and `to_port` arguments are required unless `ip_protocol` is set to `-1` or `icmpv6`.
+
+This argument supports the following arguments:
+
+* `cidr_ipv4` - (Optional) The destination IPv4 CIDR range.
+* `cidr_ipv6` - (Optional) The destination IPv6 CIDR range.
+* `description` - (Optional) The security group rule description.
+* `from_port` - (Optional) The start of port range for the TCP and UDP protocols, or an ICMP/ICMPv6 type.
+* `ip_protocol` - (Optional) The IP protocol name or number. Use `-1` to specify all protocols. Note that if `ip_protocol` is set to `-1`, it translates to all protocols, all port ranges, and `from_port` and `to_port` values should not be defined.
+* `prefix_list_id` - (Optional) The ID of the destination prefix list.
+* `referenced_security_group_id` - (Optional) The destination security group that is referenced in the rule.
+* `security_group_id` - (Required) The ID of the security group.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `to_port` - (Optional) The end of port range for the TCP and UDP protocols, or an ICMP/ICMPv6 code.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the security group rule.
+* `security_group_rule_id` - The ID of the security group rule.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import security group egress rules using the `security_group_rule_id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import security group egress rules using the `security_group_rule_id`. For example:
+
+```console
+% terraform import aws_vpc_security_group_egress_rule.example sgr-02108b27edd666983
+```
+
+<!-- cache-key: cdktf-0.18.0 input-3621cd75bed627759b23d79804e271902694303345d1faee64fd0fa94f65fd5d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/vpc_security_group_ingress_rule.html.markdown b/website/docs/cdktf/python/r/vpc_security_group_ingress_rule.html.markdown
new file mode 100644
index 00000000000..ce0e40fda16
--- /dev/null
+++ b/website/docs/cdktf/python/r/vpc_security_group_ingress_rule.html.markdown
@@ -0,0 +1,89 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_vpc_security_group_ingress_rule"
+description: |-
+  Provides a VPC security group ingress rule resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_vpc_security_group_ingress_rule
+
+Manages an inbound (ingress) rule for a security group.
+
+When specifying an inbound rule for your security group in a VPC, the configuration must include a source for the traffic.
+
+~> **NOTE on Security Groups and Security Group Rules:** Terraform currently provides a [Security Group resource](security_group.html) with `ingress` and `egress` rules defined in-line and a [Security Group Rule resource](security_group_rule.html) which manages one or more `ingress` or
+`egress` rules. Both of these resource were added before AWS assigned a [security group rule unique ID](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/security-group-rules.html), and they do not work well in all scenarios using the`description` and `tags` attributes, which rely on the unique ID.
+The `aws_vpc_security_group_ingress_rule` resource has been added to address these limitations and should be used for all new security group rules.
+You should not use the `aws_vpc_security_group_ingress_rule` resource in conjunction with an `aws_security_group` resource with in-line rules or with `aws_security_group_rule` resources defined for the same Security Group, as rule conflicts may occur and rules will be overwritten.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.vpc_security_group_ingress_rule import VpcSecurityGroupIngressRule
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        VpcSecurityGroupIngressRule(self, "example",
+            cidr_ipv4="10.0.0.0/8",
+            from_port=80,
+            ip_protocol="tcp",
+            security_group_id=Token.as_string(aws_security_group_example.id),
+            to_port=80
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+~> **Note** Although `cidr_ipv4`, `cidr_ipv6`, `prefix_list_id`, and `referenced_security_group_id` are all marked as optional, you *must* provide one of them in order to configure the destination of the traffic. The `from_port` and `to_port` arguments are required unless `ip_protocol` is set to `-1` or `icmpv6`.
+
+* `cidr_ipv4` - (Optional) The source IPv4 CIDR range.
+* `cidr_ipv6` - (Optional) The source IPv6 CIDR range.
+* `description` - (Optional) The security group rule description.
+* `from_port` - (Optional) The start of port range for the TCP and UDP protocols, or an ICMP/ICMPv6 type.
+* `ip_protocol` - (Required) The IP protocol name or number. Use `-1` to specify all protocols. Note that if `ip_protocol` is set to `-1`, it translates to all protocols, all port ranges, and `from_port` and `to_port` values should not be defined.
+* `prefix_list_id` - (Optional) The ID of the source prefix list.
+* `referenced_security_group_id` - (Optional) The source security group that is referenced in the rule.
+* `security_group_id` - (Required) The ID of the security group.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `to_port` - (Optional) The end of port range for the TCP and UDP protocols, or an ICMP/ICMPv6 code.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the security group rule.
+* `security_group_rule_id` - The ID of the security group rule.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import security group ingress rules using the `security_group_rule_id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import security group ingress rules using the `security_group_rule_id`. For example:
+
+```console
+% terraform import aws_vpc_security_group_ingress_rule.example sgr-02108b27edd666983
+```
+
+<!-- cache-key: cdktf-0.18.0 input-342da4e18ab78aa5e23ae36caa8f6f8db7a836ccfe08cb53a9e1fe0b87ef8b39 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/vpclattice_access_log_subscription.html.markdown b/website/docs/cdktf/python/r/vpclattice_access_log_subscription.html.markdown
new file mode 100644
index 00000000000..3eeaa39526b
--- /dev/null
+++ b/website/docs/cdktf/python/r/vpclattice_access_log_subscription.html.markdown
@@ -0,0 +1,71 @@
+---
+subcategory: "VPC Lattice"
+layout: "aws"
+page_title: "AWS: aws_vpclattice_access_log_subscription"
+description: |-
+  Terraform resource for managing an AWS VPC Lattice Service Network or Services Access log subscription.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_vpclattice_access_log_subscription
+
+Terraform resource for managing an AWS VPC Lattice Service Network or Service Access log subscription.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.vpclattice_access_log_subscription import VpclatticeAccessLogSubscription
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        VpclatticeAccessLogSubscription(self, "example",
+            destination_arn=Token.as_string(bucket.arn),
+            resource_identifier=Token.as_string(aws_vpclattice_service_network_example.id)
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `destination_arn` - (Required) Amazon Resource Name (ARN) of the log destination.
+* `resource_identifier` - (Required) The ID or Amazon Resource Identifier (ARN) of the service network or service. You must use the ARN if the resources specified in the operation are in different accounts.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the access log subscription.
+* `arn` - Amazon Resource Name (ARN) of the access log subscription.
+* `resource_arn` - Amazon Resource Name (ARN) of the service network or service.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import VPC Lattice Access Log Subscription using the access log subscription ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import VPC Lattice Access Log Subscription using the access log subscription ID. For example:
+
+```console
+% terraform import aws_vpclattice_access_log_subscription.example rft-8012925589
+```
+
+<!-- cache-key: cdktf-0.18.0 input-071e5e00ee8c7257836217b64dd4601a37eae349f38d2cca190da1ad40bc2a7d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/vpclattice_auth_policy.html.markdown b/website/docs/cdktf/python/r/vpclattice_auth_policy.html.markdown
new file mode 100644
index 00000000000..c6a4e3b8c43
--- /dev/null
+++ b/website/docs/cdktf/python/r/vpclattice_auth_policy.html.markdown
@@ -0,0 +1,101 @@
+---
+subcategory: "VPC Lattice"
+layout: "aws"
+page_title: "AWS: aws_vpclattice_auth_policy"
+description: |-
+  Terraform resource for managing an AWS VPC Lattice Auth Policy.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_vpclattice_auth_policy
+
+Terraform resource for managing an AWS VPC Lattice Auth Policy.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.vpclattice_auth_policy import VpclatticeAuthPolicy
+from imports.aws.vpclattice_service import VpclatticeService
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = VpclatticeService(self, "example",
+            auth_type="AWS_IAM",
+            custom_domain_name="example.com",
+            name="example-vpclattice-service"
+        )
+        aws_vpclattice_auth_policy_example = VpclatticeAuthPolicy(self, "example_1",
+            policy=Token.as_string(
+                Fn.jsonencode({
+                    "Statement": [{
+                        "Action": "*",
+                        "Condition": {
+                            "StringNotEqualsIgnoreCase": {
+                                "aws:_principal_type": "anonymous"
+                            }
+                        },
+                        "Effect": "Allow",
+                        "Principal": "*",
+                        "Resource": "*"
+                    }
+                    ],
+                    "Version": "2012-10-17"
+                })),
+            resource_identifier=example.arn
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_vpclattice_auth_policy_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `resource_identifier` - (Required) The ID or Amazon Resource Name (ARN) of the service network or service for which the policy is created.
+* `policy` - (Required) The auth policy. The policy string in JSON must not contain newlines or blank lines.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `policy` - The auth policy. The policy string in JSON must not contain newlines or blank lines.
+* `state` - The state of the auth policy. The auth policy is only active when the auth type is set to AWS_IAM. If you provide a policy, then authentication and authorization decisions are made based on this policy and the client's IAM policy. If the Auth type is NONE, then, any auth policy you provide will remain inactive.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `60m`)
+* `update` - (Default `180m`)
+* `delete` - (Default `90m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import VPC Lattice Auth Policy using the `example_id_arg`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import VPC Lattice Auth Policy using the `example_id_arg`. For example:
+
+```console
+% terraform import aws_vpclattice_auth_policy.example rft-8012925589
+```
+
+<!-- cache-key: cdktf-0.18.0 input-b4a5732fa3a54f088c4124bbf3f60126a39eedadb80630bef753b4e9195b528d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/vpclattice_listener.html.markdown b/website/docs/cdktf/python/r/vpclattice_listener.html.markdown
new file mode 100644
index 00000000000..62a7e7d64b5
--- /dev/null
+++ b/website/docs/cdktf/python/r/vpclattice_listener.html.markdown
@@ -0,0 +1,209 @@
+---
+subcategory: "VPC Lattice"
+layout: "aws"
+page_title: "AWS: aws_vpclattice_listener"
+description: |-
+  Terraform resource for managing an AWS VPC Lattice Listener.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_vpclattice_listener
+
+Terraform resource for managing an AWS VPC Lattice Listener.
+
+## Example Usage
+
+### Fixed response action
+
+```
+resource "aws_vpclattice_service" "test" {
+  name = %[1]q
+}
+
+resource "aws_vpclattice_listener" "test" {
+  name               = %[1]q
+  protocol           = "HTTPS"
+  service_identifier = aws_vpclattice_service.test.id
+  default_action {
+    fixed_response {
+      status_code = 404
+    }
+  }
+}
+```
+
+### Forward action
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.vpclattice_listener import VpclatticeListener
+from imports.aws.vpclattice_service import VpclatticeService
+from imports.aws.vpclattice_target_group import VpclatticeTargetGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        VpclatticeService(self, "test",
+            name="example"
+        )
+        example = VpclatticeTargetGroup(self, "example",
+            config=VpclatticeTargetGroupConfigA(
+                port=80,
+                protocol="HTTP",
+                vpc_identifier=Token.as_string(aws_vpc_test.id)
+            ),
+            name="example-target-group-1",
+            type="INSTANCE"
+        )
+        aws_vpclattice_listener_example = VpclatticeListener(self, "example_2",
+            default_action=VpclatticeListenerDefaultAction(
+                forward=[VpclatticeListenerDefaultActionForward(
+                    target_groups=[VpclatticeListenerDefaultActionForwardTargetGroups(
+                        target_group_identifier=example.id
+                    )
+                    ]
+                )
+                ]
+            ),
+            name="example",
+            protocol="HTTP",
+            service_identifier=Token.as_string(aws_vpclattice_service_example.id)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_vpclattice_listener_example.override_logical_id("example")
+```
+
+### Forward action with weighted target groups
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.vpclattice_listener import VpclatticeListener
+from imports.aws.vpclattice_service import VpclatticeService
+from imports.aws.vpclattice_target_group import VpclatticeTargetGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        VpclatticeService(self, "test",
+            name="example"
+        )
+        example1 = VpclatticeTargetGroup(self, "example1",
+            config=VpclatticeTargetGroupConfigA(
+                port=80,
+                protocol="HTTP",
+                vpc_identifier=Token.as_string(aws_vpc_test.id)
+            ),
+            name="example-target-group-1",
+            type="INSTANCE"
+        )
+        example2 = VpclatticeTargetGroup(self, "example2",
+            config=VpclatticeTargetGroupConfigA(
+                port=8080,
+                protocol="HTTP",
+                vpc_identifier=Token.as_string(aws_vpc_test.id)
+            ),
+            name="example-target-group-2",
+            type="INSTANCE"
+        )
+        VpclatticeListener(self, "example",
+            default_action=VpclatticeListenerDefaultAction(
+                forward=[VpclatticeListenerDefaultActionForward(
+                    target_groups=[VpclatticeListenerDefaultActionForwardTargetGroups(
+                        target_group_identifier=example1.id,
+                        weight=80
+                    ), VpclatticeListenerDefaultActionForwardTargetGroups(
+                        target_group_identifier=example2.id,
+                        weight=20
+                    )
+                    ]
+                )
+                ]
+            ),
+            name="example",
+            protocol="HTTP",
+            service_identifier=Token.as_string(aws_vpclattice_service_example.id)
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `default_action` - (Required) Default action block for the default listener rule. Default action blocks are defined below.
+* `name` - (Required, Forces new resource) Name of the listener. A listener name must be unique within a service. Valid characters are a-z, 0-9, and hyphens (-). You can't use a hyphen as the first or last character, or immediately after another hyphen.
+* `port` - (Optional, Forces new resource) Listener port. You can specify a value from 1 to 65535. If `port` is not specified and `protocol` is HTTP, the value will default to 80. If `port` is not specified and `protocol` is HTTPS, the value will default to 443.
+* `protocol` - (Required, Forces new resource) Protocol for the listener. Supported values are `HTTP` or `HTTPS`
+* `service_arn` - (Optional) Amazon Resource Name (ARN) of the VPC Lattice service. You must include either the `service_arn` or `service_identifier` arguments.
+* `service_identifier` - (Optional) ID of the VPC Lattice service. You must include either the `service_arn` or `service_identifier` arguments.
+-> **NOTE:** You must specify one of the following arguments: `service_arn` or `service_identifier`.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Default Action
+
+Default action blocks (for `default_action`) must include at least one of the following argument blocks:
+
+* `fixed-response` - (Optional) Configuration block for returning a fixed response. See Fixed Response blocks below.
+* `forward` - (Optional) Route requests to one or more target groups. See Forward blocks below.
+
+-> **NOTE:** You must specify exactly one of the following argument blocks: `fixed_response` or `forward`.
+
+### Fixed Response
+
+Fixed response blocks (for `fixed-response`) must include the following argument:
+
+* `status_code` - (Required) Custom HTTP status code to return, e.g. a 404 response code. See [Listeners](https://docs.aws.amazon.com/vpc-lattice/latest/ug/listeners.html) in the AWS documentation for a list of supported codes.
+
+### Forward
+
+Forward blocks (for `forward`) must include the following arguments:
+
+* `target_groups` - (Required) One or more target group blocks.
+
+### Target Groups
+
+Target group blocks (for `target_group`) must include the following arguments:
+
+* `target_group_identifier` - (Required) ID or Amazon Resource Name (ARN) of the target group.
+* `weight` - (Optional) Determines how requests are distributed to the target group. Only required if you specify multiple target groups for a forward action. For example, if you specify two target groups, one with a
+weight of 10 and the other with a weight of 20, the target group with a weight of 20 receives twice as many requests as the other target group. See [Listener rules](https://docs.aws.amazon.com/vpc-lattice/latest/ug/listeners.html#listener-rules) in the AWS documentation for additional examples. Default: `100`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the listener.
+* `created_at` - Date and time that the listener was created, specified in ISO-8601 format.
+* `listener_id` - Standalone ID of the listener, e.g. `listener-0a1b2c3d4e5f6g`.
+* `updated_at` - Date and time that the listener was last updated, specified in ISO-8601 format.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import VPC Lattice Listener using the `listener_id` of the listener and the `id` of the VPC Lattice service combined with a `/` character. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import VPC Lattice Listener using the `listener_id` of the listener and the `id` of the VPC Lattice service combined with a `/` character. For example:
+
+```console
+% terraform import aws_vpclattice_listener.example svc-1a2b3c4d/listener-987654321
+```
+
+<!-- cache-key: cdktf-0.18.0 input-e2bae928892603c6e366f96e2b306e1d9cc0375cc0bc9fe47de944099b3dfbab -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/vpclattice_listener_rule.html.markdown b/website/docs/cdktf/python/r/vpclattice_listener_rule.html.markdown
new file mode 100644
index 00000000000..0de19f26a90
--- /dev/null
+++ b/website/docs/cdktf/python/r/vpclattice_listener_rule.html.markdown
@@ -0,0 +1,201 @@
+---
+subcategory: "VPC Lattice"
+layout: "aws"
+page_title: "AWS: aws_vpclattice_listener_rule"
+description: |-
+  Terraform resource for managing an AWS VPC Lattice Listener Rule.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_vpclattice_listener_rule
+
+Terraform resource for managing an AWS VPC Lattice Listener Rule.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.vpclattice_listener_rule import VpclatticeListenerRule
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        VpclatticeListenerRule(self, "test",
+            action=VpclatticeListenerRuleAction(
+                forward=VpclatticeListenerRuleActionForward(
+                    target_groups=[VpclatticeListenerRuleActionForwardTargetGroups(
+                        target_group_identifier=example.id,
+                        weight=1
+                    ), VpclatticeListenerRuleActionForwardTargetGroups(
+                        target_group_identifier=example2.id,
+                        weight=2
+                    )
+                    ]
+                )
+            ),
+            listener_identifier=Token.as_string(aws_vpclattice_listener_example.listener_id),
+            match=VpclatticeListenerRuleMatch(
+                http_match=VpclatticeListenerRuleMatchHttpMatch(
+                    header_matches=[VpclatticeListenerRuleMatchHttpMatchHeaderMatches(
+                        case_sensitive=False,
+                        match=VpclatticeListenerRuleMatchHttpMatchHeaderMatchesMatch(
+                            exact="example-contains"
+                        ),
+                        name="example-header"
+                    )
+                    ],
+                    path_match=VpclatticeListenerRuleMatchHttpMatchPathMatch(
+                        case_sensitive=True,
+                        match=VpclatticeListenerRuleMatchHttpMatchPathMatchMatch(
+                            prefix="/example-path"
+                        )
+                    )
+                )
+            ),
+            name="example",
+            priority=20,
+            service_identifier=Token.as_string(aws_vpclattice_service_example.id)
+        )
+```
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.vpclattice_listener_rule import VpclatticeListenerRule
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        VpclatticeListenerRule(self, "test",
+            action=VpclatticeListenerRuleAction(
+                fixed_response=VpclatticeListenerRuleActionFixedResponse(
+                    status_code=404
+                )
+            ),
+            listener_identifier=example.listener_id,
+            match=VpclatticeListenerRuleMatch(
+                http_match=VpclatticeListenerRuleMatchHttpMatch(
+                    path_match=VpclatticeListenerRuleMatchHttpMatchPathMatch(
+                        case_sensitive=False,
+                        match=VpclatticeListenerRuleMatchHttpMatchPathMatchMatch(
+                            exact="/example-path"
+                        )
+                    )
+                )
+            ),
+            name="example",
+            priority=10,
+            service_identifier=Token.as_string(aws_vpclattice_service_example.id)
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `service_identifier` - (Required) The ID or Amazon Resource Identifier (ARN) of the service.
+* `listener_identifier` - (Required) The ID or Amazon Resource Name (ARN) of the listener.
+* `action` - (Required) The action for the listener rule.
+* `match` - (Required) The rule match.
+* `name` - (Required) The name of the rule. The name must be unique within the listener. The valid characters are a-z, 0-9, and hyphens (-). You can't use a hyphen as the first or last character, or immediately after another hyphen.
+* `priority` - (Required) The priority assigned to the rule. Each rule for a specific listener must have a unique priority. The lower the priority number the higher the priority.
+
+The following arguments are optional:
+
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+action (`action`) supports the following:
+
+* `fixed_response` - (Optional) Describes the rule action that returns a custom HTTP response.
+* `forward` - (Optional) The forward action. Traffic that matches the rule is forwarded to the specified target groups.
+
+fixed response (`fixed_response`) supports the following:
+
+* `status_code` - (Optional) The HTTP response code.
+
+forward (`forward`) supports the following:
+
+* `target_groups` - (Optional) The target groups. Traffic matching the rule is forwarded to the specified target groups. With forward actions, you can assign a weight that controls the prioritization and selection of each target group. This means that requests are distributed to individual target groups based on their weights. For example, if two target groups have the same weight, each target group receives half of the traffic.
+
+The default value is 1 with maximum number of 2. If only one target group is provided, there is no need to set the weight; 100% of traffic will go to that target group.
+
+action (`match`) supports the following:
+
+* `http_match` - (Optional) The HTTP criteria that a rule must match.
+
+http match (`http_match`) supports the following:
+
+* `header_matches` - (Optional) The header matches. Matches incoming requests with rule based on request header value before applying rule action.
+* `method` - (Optional) The HTTP method type.
+* `path_match` - (Optional) The path match.
+
+header matches (`header_matches`) supports the following:
+
+* `case_sensitive` - (Optional) Indicates whether the match is case sensitive. Defaults to false.
+* `match` - (Optional) The header match type.
+* `name` - (Optional) The name of the header.
+
+header matches match (`match`) supports the following:
+
+* `contains` - (Optional) Specifies a contains type match.
+* `exact` - (Optional) Specifies an exact type match.
+* `prefix` - (Optional) Specifies a prefix type match. Matches the value with the prefix.
+
+path match (`path_match`) supports the following:
+
+* `case_sensitive` - (Optional) Indicates whether the match is case sensitive. Defaults to false.
+* `match` - (Optional) The header match type.
+
+path match match (`match`) supports the following:
+
+* `exact` - (Optional) Specifies an exact type match.
+* `prefix` - (Optional) Specifies a prefix type match. Matches the value with the prefix.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN for the listener rule.
+* `rule_id` - Unique identifier for the listener rule.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `60m`)
+* `update` - (Default `180m`)
+* `delete` - (Default `90m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import VPC Lattice Listener Rule using the `example_id_arg`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import VPC Lattice Listener Rule using the `example_id_arg`. For example:
+
+```console
+% terraform import aws_vpclattice_listener_rule.example rft-8012925589
+```
+
+<!-- cache-key: cdktf-0.18.0 input-18c4d701108689bcdef68a561bb727fff88960c4bf3c3a870cba068fc4e67f93 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/vpclattice_resource_policy.html.markdown b/website/docs/cdktf/python/r/vpclattice_resource_policy.html.markdown
new file mode 100644
index 00000000000..a8adefe4795
--- /dev/null
+++ b/website/docs/cdktf/python/r/vpclattice_resource_policy.html.markdown
@@ -0,0 +1,93 @@
+---
+subcategory: "VPC Lattice"
+layout: "aws"
+page_title: "AWS: aws_vpclattice_resource_policy"
+description: |-
+  Terraform resource for managing an AWS VPC Lattice Resource Policy.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_vpclattice_resource_policy
+
+Terraform resource for managing an AWS VPC Lattice Resource Policy.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_caller_identity import DataAwsCallerIdentity
+from imports.aws.data_aws_partition import DataAwsPartition
+from imports.aws.vpclattice_resource_policy import VpclatticeResourcePolicy
+from imports.aws.vpclattice_service_network import VpclatticeServiceNetwork
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = VpclatticeServiceNetwork(self, "example",
+            name="example-vpclattice-service-network"
+        )
+        current = DataAwsCallerIdentity(self, "current")
+        data_aws_partition_current = DataAwsPartition(self, "current_2")
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_partition_current.override_logical_id("current")
+        aws_vpclattice_resource_policy_example = VpclatticeResourcePolicy(self, "example_3",
+            policy=Token.as_string(
+                Fn.jsonencode({
+                    "Statement": [{
+                        "Action": ["vpc-lattice:CreateServiceNetworkVpcAssociation", "vpc-lattice:CreateServiceNetworkServiceAssociation", "vpc-lattice:GetServiceNetwork"
+                        ],
+                        "Effect": "Allow",
+                        "Principal": {
+                            "AWS": "arn:${" + data_aws_partition_current.partition + "}:iam::${" + current.account_id + "}:root"
+                        },
+                        "Resource": example.arn,
+                        "Sid": "test-pol-principals-6"
+                    }
+                    ],
+                    "Version": "2012-10-17"
+                })),
+            resource_arn=example.arn
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_vpclattice_resource_policy_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `resource_arn` - (Required) The ID or Amazon Resource Name (ARN) of the service network or service for which the policy is created.
+* `policy` - (Required) An IAM policy. The policy string in JSON must not contain newlines or blank lines.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import VPC Lattice Resource Policy using the `resource_arn`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import VPC Lattice Resource Policy using the `resource_arn`. For example:
+
+```console
+% terraform import aws_vpclattice_resource_policy.example rft-8012925589
+```
+
+<!-- cache-key: cdktf-0.18.0 input-c969eed7a7377f14bd03d1b92b78d4bf654be694271ee442b4563386ee2c88bd -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/vpclattice_service.html.markdown b/website/docs/cdktf/python/r/vpclattice_service.html.markdown
new file mode 100644
index 00000000000..2180c26a7c0
--- /dev/null
+++ b/website/docs/cdktf/python/r/vpclattice_service.html.markdown
@@ -0,0 +1,87 @@
+---
+subcategory: "VPC Lattice"
+layout: "aws"
+page_title: "AWS: aws_vpclattice_service"
+description: |-
+  Terraform resource for managing an AWS VPC Lattice Service.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_vpclattice_service
+
+Terraform resource for managing an AWS VPC Lattice Service.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.vpclattice_service import VpclatticeService
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        VpclatticeService(self, "example",
+            auth_type="AWS_IAM",
+            custom_domain_name="example.com",
+            name="example"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) Name of the service. The name must be unique within the account. The valid characters are a-z, 0-9, and hyphens (-). You can't use a hyphen as the first or last character, or immediately after another hyphen.Must be between 3 and 40 characters in length.
+
+The following arguments are optional:
+
+* `auth_type` - (Optional) Type of IAM policy. Either `NONE` or `AWS_IAM`.
+* `certificate_arn` - (Optional) Amazon Resource Name (ARN) of the certificate.
+* `custom_domain_name` - (Optional) Custom domain name of the service.
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the service. Do not begin the description with "An", "The", "Defines", "Indicates", or "Specifies," as these are verbose. In other words, "Indicates the amount of storage," can be rewritten as "Amount of storage," without losing any information.
+* `dns_entry` - Concise description. Do not begin the description with "An", "The", "Defines", "Indicates", or "Specifies," as these are verbose. In other words, "Indicates the amount of storage," can be rewritten as "Amount of storage," without losing any information.
+* `id` - Unique identifier for the service.
+* `status` - Status of the service.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `5m`)
+* `delete` - (Default `5m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import VPC Lattice Service using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import VPC Lattice Service using the `id`. For example:
+
+```console
+% terraform import aws_vpclattice_service.example svc-06728e2357ea55f8a
+```
+
+<!-- cache-key: cdktf-0.18.0 input-9538031e1f3e91a6025513a51240647cd5ea1ebb1f5f4cc3598ae3498c4720e0 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/vpclattice_service_network.html.markdown b/website/docs/cdktf/python/r/vpclattice_service_network.html.markdown
new file mode 100644
index 00000000000..26ce7c9575f
--- /dev/null
+++ b/website/docs/cdktf/python/r/vpclattice_service_network.html.markdown
@@ -0,0 +1,74 @@
+---
+subcategory: "VPC Lattice"
+layout: "aws"
+page_title: "AWS: aws_vpclattice_service_network"
+description: |-
+  Terraform resource for managing an AWS VPC Lattice Service Network.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_vpclattice_service_network
+
+Terraform resource for managing an AWS VPC Lattice Service Network.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.vpclattice_service_network import VpclatticeServiceNetwork
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        VpclatticeServiceNetwork(self, "example",
+            auth_type="AWS_IAM",
+            name="example"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) Name of the service network
+
+The following arguments are optional:
+
+* `auth_type` - (Optional) Type of IAM policy. Either `NONE` or `AWS_IAM`.
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Service Network.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import VPC Lattice Service Network using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import VPC Lattice Service Network using the `id`. For example:
+
+```console
+% terraform import aws_vpclattice_service_network.example sn-0158f91c1e3358dba
+```
+
+<!-- cache-key: cdktf-0.18.0 input-bd399060a3ff40174d174d00151279d434802a5189dee061f444da739500f832 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/vpclattice_service_network_service_association.html.markdown b/website/docs/cdktf/python/r/vpclattice_service_network_service_association.html.markdown
new file mode 100644
index 00000000000..eac0c5e3cee
--- /dev/null
+++ b/website/docs/cdktf/python/r/vpclattice_service_network_service_association.html.markdown
@@ -0,0 +1,87 @@
+---
+subcategory: "VPC Lattice"
+layout: "aws"
+page_title: "AWS: aws_vpclattice_service_network_service_association"
+description: |-
+  Terraform resource for managing an AWS VPC Lattice Service Network Service Association.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_vpclattice_service_network_service_association
+
+Terraform resource for managing an AWS VPC Lattice Service Network Service Association.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.vpclattice_service_network_service_association import VpclatticeServiceNetworkServiceAssociation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        VpclatticeServiceNetworkServiceAssociation(self, "example",
+            service_identifier=Token.as_string(aws_vpclattice_service_example.id),
+            service_network_identifier=Token.as_string(aws_vpclattice_service_network_example.id)
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `service_identifier` - (Required) The ID or Amazon Resource Identifier (ARN) of the service.
+* `service_network_identifier` - (Required) The ID or Amazon Resource Identifier (ARN) of the service network. You must use the ARN if the resources specified in the operation are in different accounts.
+The following arguments are optional:
+
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the Association.
+* `created_by` - The account that created the association.
+* `custom_domain_name` - The custom domain name of the service.
+* `dns_entry` - The DNS name of the service.
+    * `domain_name` - The domain name of the service.
+    * `hosted_zone_id` - The ID of the hosted zone.
+* `id` - The ID of the association.
+* `status` - The operations status. Valid Values are CREATE_IN_PROGRESS | ACTIVE | DELETE_IN_PROGRESS | CREATE_FAILED | DELETE_FAILED
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `5m`)
+* `delete` - (Default `5m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import VPC Lattice Service Network Service Association using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import VPC Lattice Service Network Service Association using the `id`. For example:
+
+```console
+% terraform import aws_vpclattice_service_network_service_association.example snsa-05e2474658a88f6ba
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ed0fbd858c03d6277e22292ff2f9c7e7102bc8ebdee62a4f130453206c0b83a7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/vpclattice_service_network_vpc_association.html.markdown b/website/docs/cdktf/python/r/vpclattice_service_network_vpc_association.html.markdown
new file mode 100644
index 00000000000..847c6b3ce8d
--- /dev/null
+++ b/website/docs/cdktf/python/r/vpclattice_service_network_vpc_association.html.markdown
@@ -0,0 +1,85 @@
+---
+subcategory: "VPC Lattice"
+layout: "aws"
+page_title: "AWS: aws_vpclattice_service_network_vpc_association"
+description: |-
+  Terraform resource for managing an AWS VPC Lattice Service Network VPC Association.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_vpclattice_service_network_vpc_association
+
+Terraform resource for managing an AWS VPC Lattice Service Network VPC Association.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.vpclattice_service_network_vpc_association import VpclatticeServiceNetworkVpcAssociation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        VpclatticeServiceNetworkVpcAssociation(self, "example",
+            security_group_ids=[Token.as_string(aws_security_group_example.id)],
+            service_network_identifier=Token.as_string(aws_vpclattice_service_network_example.id),
+            vpc_identifier=Token.as_string(aws_vpc_example.id)
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `vpc_identifier` - (Required) The ID of the VPC.
+* `service_network_identifier` - (Required) The ID or Amazon Resource Identifier (ARN) of the service network. You must use the ARN if the resources specified in the operation are in different accounts.
+The following arguments are optional:
+
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `security_group_ids` - (Optional) The IDs of the security groups.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the Association.
+* `created_by` - The account that created the association.
+* `id` - The ID of the association.
+* `status` - The operations status. Valid Values are CREATE_IN_PROGRESS | ACTIVE | DELETE_IN_PROGRESS | CREATE_FAILED | DELETE_FAILED
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `5m`)
+* `delete` - (Default `5m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import VPC Lattice Service Network VPC Association using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import VPC Lattice Service Network VPC Association using the `id`. For example:
+
+```console
+% terraform import aws_vpclattice_service_network_vpc_association.example snsa-05e2474658a88f6ba
+```
+
+<!-- cache-key: cdktf-0.18.0 input-7c8b2edfc9c8f937c0cca70fd647384595bc839a9f7ba74d190e7819a13b08d8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/vpclattice_target_group.html.markdown b/website/docs/cdktf/python/r/vpclattice_target_group.html.markdown
new file mode 100644
index 00000000000..001745a6b2c
--- /dev/null
+++ b/website/docs/cdktf/python/r/vpclattice_target_group.html.markdown
@@ -0,0 +1,204 @@
+---
+subcategory: "VPC Lattice"
+layout: "aws"
+page_title: "AWS: aws_vpclattice_target_group"
+description: |-
+  Terraform resource for managing an AWS VPC Lattice Target Group.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_vpclattice_target_group
+
+Terraform resource for managing an AWS VPC Lattice Target Group.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.vpclattice_target_group import VpclatticeTargetGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        VpclatticeTargetGroup(self, "example",
+            config=VpclatticeTargetGroupConfigA(
+                port=443,
+                protocol="HTTPS",
+                vpc_identifier=Token.as_string(aws_vpc_example.id)
+            ),
+            name="example",
+            type="INSTANCE"
+        )
+```
+
+### Basic usage with Health check
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.vpclattice_target_group import VpclatticeTargetGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        VpclatticeTargetGroup(self, "example",
+            config=VpclatticeTargetGroupConfigA(
+                health_check=VpclatticeTargetGroupConfigHealthCheck(
+                    enabled=True,
+                    health_check_interval_seconds=20,
+                    health_check_timeout_seconds=10,
+                    healthy_threshold_count=7,
+                    matcher=VpclatticeTargetGroupConfigHealthCheckMatcher(
+                        value="200-299"
+                    ),
+                    path="/instance",
+                    port=80,
+                    protocol="HTTP",
+                    protocol_version="HTTP1",
+                    unhealthy_threshold_count=3
+                ),
+                ip_address_type="IPV4",
+                port=443,
+                protocol="HTTPS",
+                protocol_version="HTTP1",
+                vpc_identifier=Token.as_string(aws_vpc_example.id)
+            ),
+            name="example",
+            type="IP"
+        )
+```
+
+### ALB
+
+If the type is ALB, `health_check` block is not supported.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.vpclattice_target_group import VpclatticeTargetGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        VpclatticeTargetGroup(self, "example",
+            config=VpclatticeTargetGroupConfigA(
+                port=443,
+                protocol="HTTPS",
+                protocol_version="HTTP1",
+                vpc_identifier=Token.as_string(aws_vpc_example.id)
+            ),
+            name="example",
+            type="ALB"
+        )
+```
+
+### Lambda
+
+If the type is Lambda, `config` block is not supported.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.vpclattice_target_group import VpclatticeTargetGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        VpclatticeTargetGroup(self, "example",
+            name="example",
+            type="LAMBDA"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) The name of the target group. The name must be unique within the account. The valid characters are a-z, 0-9, and hyphens (-). You can't use a hyphen as the first or last character, or immediately after another hyphen.
+* `type` - (Required) The type of target group. Valid Values are `IP` | `LAMBDA` | `INSTANCE` | `ALB`
+
+The following arguments are optional:
+
+* `config` - (Optional) The target group configuration.
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+Config (`config`) supports the following:
+
+* `health_check` - (Optional) The health check configuration.
+* `ip_address_type` - (Optional) The type of IP address used for the target group. Valid values: `IPV4` | `IPV6`.
+* `lambda_event_structure_version` - (Optional) The version of the event structure that the Lambda function receives. Supported only if `type` is `LAMBDA`. Valid Values are `V1` | `V2`.
+* `port` - (Optional) The port on which the targets are listening.
+* `protocol` - (Optional) The protocol to use for routing traffic to the targets. Valid Values are `HTTP` | `HTTPS`.
+* `protocol_version` - (Optional) The protocol version. Valid Values are `HTTP1` | `HTTP2` | `GRPC`. Default value is `HTTP1`.
+* `vpc_identifier` - (Optional) The ID of the VPC.
+
+Health Check (`health_check`) supports the following:
+
+* `enabled` - (Optional) Indicates whether health checking is enabled. Defaults to `true`.
+* `health_check_interval_seconds` - (Optional) The approximate amount of time, in seconds, between health checks of an individual target. The range is 5–300 seconds. The default is 30 seconds.
+* `health_check_timeout_seconds` - (Optional) The amount of time, in seconds, to wait before reporting a target as unhealthy. The range is 1–120 seconds. The default is 5 seconds.
+* `healthy_threshold_count ` - (Optional) The number of consecutive successful health checks required before considering an unhealthy target healthy. The range is 2–10. The default is 5.
+* `matcher` - (Optional) The codes to use when checking for a successful response from a target. These are called _Success codes_ in the console.
+    * `value` - (Optional) The HTTP codes to use when checking for a successful response from a target.
+* `path` - (Optional) The destination for health checks on the targets. If the protocol version is HTTP/1.1 or HTTP/2, specify a valid URI (for example, /path?query). The default path is `/`. Health checks are not supported if the protocol version is gRPC, however, you can choose HTTP/1.1 or HTTP/2 and specify a valid URI.
+* `port` - (Optional) The port used when performing health checks on targets. The default setting is the port that a target receives traffic on.
+* `protocol` - (Optional) The protocol used when performing health checks on targets. The possible protocols are `HTTP` and `HTTPS`.
+* `protocol_version` - (Optional) The protocol version used when performing health checks on targets. The possible protocol versions are `HTTP1` and `HTTP2`. The default is `HTTP1`.
+* `unhealthy_threshold_count` - (Optional) The number of consecutive failed health checks required before considering a target unhealthy. The range is 2–10. The default is 2.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the target group.
+* `id` - Unique identifier for the target group.
+* `status` - Status of the target group.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `5m`)
+* `delete` - (Default `5m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import VPC Lattice Target Group using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import VPC Lattice Target Group using the `id`. For example:
+
+```console
+% terraform import aws_vpclattice_target_group.example tg-0c11d4dc16ed96bdb
+```
+
+<!-- cache-key: cdktf-0.18.0 input-8b0f63dce846bb387e0c2e47e763aeda9a0b71702c33c2b21f0f39c8cf773e37 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/vpclattice_target_group_attachment.html.markdown b/website/docs/cdktf/python/r/vpclattice_target_group_attachment.html.markdown
new file mode 100644
index 00000000000..0ade38be154
--- /dev/null
+++ b/website/docs/cdktf/python/r/vpclattice_target_group_attachment.html.markdown
@@ -0,0 +1,56 @@
+---
+subcategory: "VPC Lattice"
+layout: "aws"
+page_title: "AWS: aws_vpclattice_target_group_attachment"
+description: |-
+  Provides the ability to register a target with an AWS VPC Lattice Target Group.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_vpclattice_target_group_attachment
+
+Provides the ability to register a target with an AWS VPC Lattice Target Group.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.vpclattice_target_group_attachment import VpclatticeTargetGroupAttachment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        VpclatticeTargetGroupAttachment(self, "example",
+            target=VpclatticeTargetGroupAttachmentTarget(
+                id=Token.as_string(aws_lb_example.arn),
+                port=80
+            ),
+            target_group_identifier=Token.as_string(aws_vpclattice_target_group_example.id)
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+- `target_group_identifier` - (Required) The ID or Amazon Resource Name (ARN) of the target group.
+- `target` - (Required) The target.
+
+`target` supports the following:
+
+- `id` - (Required) The ID of the target. If the target type of the target group is INSTANCE, this is an instance ID. If the target type is IP , this is an IP address. If the target type is LAMBDA, this is the ARN of the Lambda function. If the target type is ALB, this is the ARN of the Application Load Balancer.
+- `port` - (Optional) This port is used for routing traffic to the target, and defaults to the target group port. However, you can override the default and specify a custom port.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+<!-- cache-key: cdktf-0.18.0 input-07d016dd19914a4941aa50badc7be37f87be2205c9b19ece183e96d29c4e875b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/vpn_connection.html.markdown b/website/docs/cdktf/python/r/vpn_connection.html.markdown
new file mode 100644
index 00000000000..f96cbfbdeae
--- /dev/null
+++ b/website/docs/cdktf/python/r/vpn_connection.html.markdown
@@ -0,0 +1,298 @@
+---
+subcategory: "VPN (Site-to-Site)"
+layout: "aws"
+page_title: "AWS: aws_vpn_connection"
+description: |-
+  Manages a Site-to-Site VPN connection. A Site-to-Site VPN connection is an Internet Protocol security (IPsec) VPN connection between a VPC and an on-premises network.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_vpn_connection
+
+Manages a Site-to-Site VPN connection. A Site-to-Site VPN connection is an Internet Protocol security (IPsec) VPN connection between a VPC and an on-premises network.
+Any new Site-to-Site VPN connection that you create is an [AWS VPN connection](https://docs.aws.amazon.com/vpn/latest/s2svpn/vpn-categories.html).
+
+~> **Note:** All arguments including `tunnel1_preshared_key` and `tunnel2_preshared_key` will be stored in the raw state as plain-text.
+[Read more about sensitive data in state](https://www.terraform.io/docs/state/sensitive-data.html).
+
+~> **Note:** The CIDR blocks in the arguments `tunnel1_inside_cidr` and `tunnel2_inside_cidr` must have a prefix of /30 and be a part of a specific range.
+[Read more about this in the AWS documentation](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_VpnTunnelOptionsSpecification.html).
+
+## Example Usage
+
+### EC2 Transit Gateway
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.customer_gateway import CustomerGateway
+from imports.aws.ec2_transit_gateway import Ec2TransitGateway
+from imports.aws.vpn_connection import VpnConnection
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = CustomerGateway(self, "example",
+            bgp_asn=Token.as_string(65000),
+            ip_address="172.0.0.1",
+            type="ipsec.1"
+        )
+        aws_ec2_transit_gateway_example = Ec2TransitGateway(self, "example_1")
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_ec2_transit_gateway_example.override_logical_id("example")
+        aws_vpn_connection_example = VpnConnection(self, "example_2",
+            customer_gateway_id=example.id,
+            transit_gateway_id=Token.as_string(aws_ec2_transit_gateway_example.id),
+            type=example.type
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_vpn_connection_example.override_logical_id("example")
+```
+
+### Virtual Private Gateway
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.customer_gateway import CustomerGateway
+from imports.aws.vpc import Vpc
+from imports.aws.vpn_connection import VpnConnection
+from imports.aws.vpn_gateway import VpnGateway
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        customer_gateway = CustomerGateway(self, "customer_gateway",
+            bgp_asn=Token.as_string(65000),
+            ip_address="172.0.0.1",
+            type="ipsec.1"
+        )
+        vpc = Vpc(self, "vpc",
+            cidr_block="10.0.0.0/16"
+        )
+        vpn_gateway = VpnGateway(self, "vpn_gateway",
+            vpc_id=vpc.id
+        )
+        VpnConnection(self, "main",
+            customer_gateway_id=customer_gateway.id,
+            static_routes_only=True,
+            type="ipsec.1",
+            vpn_gateway_id=vpn_gateway.id
+        )
+```
+
+### AWS Site to Site Private VPN
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.customer_gateway import CustomerGateway
+from imports.aws.data_aws_ec2_transit_gateway_dx_gateway_attachment import DataAwsEc2TransitGatewayDxGatewayAttachment
+from imports.aws.dx_gateway import DxGateway
+from imports.aws.dx_gateway_association import DxGatewayAssociation
+from imports.aws.ec2_transit_gateway import Ec2TransitGateway
+from imports.aws.vpn_connection import VpnConnection
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = CustomerGateway(self, "example",
+            bgp_asn=Token.as_string(64514),
+            ip_address="10.0.0.1",
+            tags={
+                "Name": "terraform_ipsec_vpn_example"
+            },
+            type="ipsec.1"
+        )
+        aws_dx_gateway_example = DxGateway(self, "example_1",
+            amazon_side_asn="64512",
+            name="terraform_ipsec_vpn_example"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_dx_gateway_example.override_logical_id("example")
+        aws_ec2_transit_gateway_example = Ec2TransitGateway(self, "example_2",
+            amazon_side_asn=Token.as_number("64513"),
+            description="terraform_ipsec_vpn_example",
+            transit_gateway_cidr_blocks=["10.0.0.0/24"]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_ec2_transit_gateway_example.override_logical_id("example")
+        aws_dx_gateway_association_example = DxGatewayAssociation(self, "example_3",
+            allowed_prefixes=["10.0.0.0/8"],
+            associated_gateway_id=Token.as_string(aws_ec2_transit_gateway_example.id),
+            dx_gateway_id=Token.as_string(aws_dx_gateway_example.id)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_dx_gateway_association_example.override_logical_id("example")
+        data_aws_ec2_transit_gateway_dx_gateway_attachment_example =
+        DataAwsEc2TransitGatewayDxGatewayAttachment(self, "example_4",
+            depends_on=[aws_dx_gateway_association_example],
+            dx_gateway_id=Token.as_string(aws_dx_gateway_example.id),
+            transit_gateway_id=Token.as_string(aws_ec2_transit_gateway_example.id)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_ec2_transit_gateway_dx_gateway_attachment_example.override_logical_id("example")
+        aws_vpn_connection_example = VpnConnection(self, "example_5",
+            customer_gateway_id=example.id,
+            outside_ip_address_type="PrivateIpv4",
+            tags={
+                "Name": "terraform_ipsec_vpn_example"
+            },
+            transit_gateway_id=Token.as_string(aws_ec2_transit_gateway_example.id),
+            transport_transit_gateway_attachment_id=Token.as_string(data_aws_ec2_transit_gateway_dx_gateway_attachment_example.id),
+            type="ipsec.1"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_vpn_connection_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `customer_gateway_id` - (Required) The ID of the customer gateway.
+* `type` - (Required) The type of VPN connection. The only type AWS supports at this time is "ipsec.1".
+* `transit_gateway_id` - (Optional) The ID of the EC2 Transit Gateway.
+* `vpn_gateway_id` - (Optional) The ID of the Virtual Private Gateway.
+* `static_routes_only` - (Optional, Default `false`) Whether the VPN connection uses static routes exclusively. Static routes must be used for devices that don't support BGP.
+* `enable_acceleration` - (Optional, Default `false`) Indicate whether to enable acceleration for the VPN connection. Supports only EC2 Transit Gateway.
+* `tags` - (Optional) Tags to apply to the connection. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `local_ipv4_network_cidr` - (Optional, Default `0.0.0.0/0`) The IPv4 CIDR on the customer gateway (on-premises) side of the VPN connection.
+* `local_ipv6_network_cidr` - (Optional, Default `::/0`) The IPv6 CIDR on the customer gateway (on-premises) side of the VPN connection.
+* `outside_ip_address_type` - (Optional, Default `PublicIpv4`) Indicates if a Public S2S VPN or Private S2S VPN over AWS Direct Connect. Valid values are `PublicIpv4 | PrivateIpv4`
+* `remote_ipv4_network_cidr` - (Optional, Default `0.0.0.0/0`) The IPv4 CIDR on the AWS side of the VPN connection.
+* `remote_ipv6_network_cidr` - (Optional, Default `::/0`) The IPv6 CIDR on the customer gateway (on-premises) side of the VPN connection.
+* `transport_transit_gateway_attachment_id` - (Required when outside_ip_address_type is set to `PrivateIpv4`). The attachment ID of the Transit Gateway attachment to Direct Connect Gateway. The ID is obtained through a data source only.
+* `tunnel_inside_ip_version` - (Optional, Default `ipv4`) Indicate whether the VPN tunnels process IPv4 or IPv6 traffic. Valid values are `ipv4 | ipv6`. `ipv6` Supports only EC2 Transit Gateway.
+* `tunnel1_inside_cidr` - (Optional) The CIDR block of the inside IP addresses for the first VPN tunnel. Valid value is a size /30 CIDR block from the 169.254.0.0/16 range.
+* `tunnel2_inside_cidr` - (Optional) The CIDR block of the inside IP addresses for the second VPN tunnel. Valid value is a size /30 CIDR block from the 169.254.0.0/16 range.
+* `tunnel1_inside_ipv6_cidr` - (Optional) The range of inside IPv6 addresses for the first VPN tunnel. Supports only EC2 Transit Gateway. Valid value is a size /126 CIDR block from the local fd00::/8 range.
+* `tunnel2_inside_ipv6_cidr` - (Optional) The range of inside IPv6 addresses for the second VPN tunnel. Supports only EC2 Transit Gateway. Valid value is a size /126 CIDR block from the local fd00::/8 range.
+* `tunnel1_preshared_key` - (Optional) The preshared key of the first VPN tunnel. The preshared key must be between 8 and 64 characters in length and cannot start with zero(0). Allowed characters are alphanumeric characters, periods(.) and underscores(_).
+* `tunnel2_preshared_key` - (Optional) The preshared key of the second VPN tunnel. The preshared key must be between 8 and 64 characters in length and cannot start with zero(0). Allowed characters are alphanumeric characters, periods(.) and underscores(_).
+* `tunnel1_dpd_timeout_action` - (Optional, Default `clear`) The action to take after DPD timeout occurs for the first VPN tunnel. Specify restart to restart the IKE initiation. Specify clear to end the IKE session. Valid values are `clear | none | restart`.
+* `tunnel2_dpd_timeout_action` - (Optional, Default `clear`) The action to take after DPD timeout occurs for the second VPN tunnel. Specify restart to restart the IKE initiation. Specify clear to end the IKE session. Valid values are `clear | none | restart`.
+* `tunnel1_dpd_timeout_seconds` - (Optional, Default `30`) The number of seconds after which a DPD timeout occurs for the first VPN tunnel. Valid value is equal or higher than `30`.
+* `tunnel2_dpd_timeout_seconds` - (Optional, Default `30`) The number of seconds after which a DPD timeout occurs for the second VPN tunnel. Valid value is equal or higher than `30`.
+* `tunnel1_enable_tunnel_lifecycle_control` - (Optional, Default `false`) Turn on or off tunnel endpoint lifecycle control feature for the first VPN tunnel. Valid values are `true | false`.
+* `tunnel2_enable_tunnel_lifecycle_control` - (Optional, Default `false`) Turn on or off tunnel endpoint lifecycle control feature for the second VPN tunnel. Valid values are `true | false`.
+* `tunnel1_ike_versions` - (Optional) The IKE versions that are permitted for the first VPN tunnel. Valid values are `ikev1 | ikev2`.
+* `tunnel2_ike_versions` - (Optional) The IKE versions that are permitted for the second VPN tunnel. Valid values are `ikev1 | ikev2`.
+* `tunnel1_log_options` - (Optional) Options for logging VPN tunnel activity. See [Log Options](#log-options) below for more details.
+* `tunnel2_log_options` - (Optional) Options for logging VPN tunnel activity. See [Log Options](#log-options) below for more details.
+* `tunnel1_phase1_dh_group_numbers` - (Optional) List of one or more Diffie-Hellman group numbers that are permitted for the first VPN tunnel for phase 1 IKE negotiations. Valid values are ` 2 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24`.
+* `tunnel2_phase1_dh_group_numbers` - (Optional) List of one or more Diffie-Hellman group numbers that are permitted for the second VPN tunnel for phase 1 IKE negotiations. Valid values are ` 2 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24`.
+* `tunnel1_phase1_encryption_algorithms` - (Optional) List of one or more encryption algorithms that are permitted for the first VPN tunnel for phase 1 IKE negotiations. Valid values are `AES128 | AES256 | AES128-GCM-16 | AES256-GCM-16`.
+* `tunnel2_phase1_encryption_algorithms` - (Optional) List of one or more encryption algorithms that are permitted for the second VPN tunnel for phase 1 IKE negotiations. Valid values are `AES128 | AES256 | AES128-GCM-16 | AES256-GCM-16`.
+* `tunnel1_phase1_integrity_algorithms` - (Optional) One or more integrity algorithms that are permitted for the first VPN tunnel for phase 1 IKE negotiations. Valid values are `SHA1 | SHA2-256 | SHA2-384 | SHA2-512`.
+* `tunnel2_phase1_integrity_algorithms` - (Optional) One or more integrity algorithms that are permitted for the second VPN tunnel for phase 1 IKE negotiations. Valid values are `SHA1 | SHA2-256 | SHA2-384 | SHA2-512`.
+* `tunnel1_phase1_lifetime_seconds` - (Optional, Default `28800`) The lifetime for phase 1 of the IKE negotiation for the first VPN tunnel, in seconds. Valid value is between `900` and `28800`.
+* `tunnel2_phase1_lifetime_seconds` - (Optional, Default `28800`) The lifetime for phase 1 of the IKE negotiation for the second VPN tunnel, in seconds. Valid value is between `900` and `28800`.
+* `tunnel1_phase2_dh_group_numbers` - (Optional) List of one or more Diffie-Hellman group numbers that are permitted for the first VPN tunnel for phase 2 IKE negotiations. Valid values are `2 | 5 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24`.
+* `tunnel2_phase2_dh_group_numbers` - (Optional) List of one or more Diffie-Hellman group numbers that are permitted for the second VPN tunnel for phase 2 IKE negotiations. Valid values are `2 | 5 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24`.
+* `tunnel1_phase2_encryption_algorithms` - (Optional) List of one or more encryption algorithms that are permitted for the first VPN tunnel for phase 2 IKE negotiations. Valid values are `AES128 | AES256 | AES128-GCM-16 | AES256-GCM-16`.
+* `tunnel2_phase2_encryption_algorithms` - (Optional) List of one or more encryption algorithms that are permitted for the second VPN tunnel for phase 2 IKE negotiations. Valid values are `AES128 | AES256 | AES128-GCM-16 | AES256-GCM-16`.
+* `tunnel1_phase2_integrity_algorithms` - (Optional) List of one or more integrity algorithms that are permitted for the first VPN tunnel for phase 2 IKE negotiations. Valid values are `SHA1 | SHA2-256 | SHA2-384 | SHA2-512`.
+* `tunnel2_phase2_integrity_algorithms` - (Optional) List of one or more integrity algorithms that are permitted for the second VPN tunnel for phase 2 IKE negotiations. Valid values are `SHA1 | SHA2-256 | SHA2-384 | SHA2-512`.
+* `tunnel1_phase2_lifetime_seconds` - (Optional, Default `3600`) The lifetime for phase 2 of the IKE negotiation for the first VPN tunnel, in seconds. Valid value is between `900` and `3600`.
+* `tunnel2_phase2_lifetime_seconds` - (Optional, Default `3600`) The lifetime for phase 2 of the IKE negotiation for the second VPN tunnel, in seconds. Valid value is between `900` and `3600`.
+* `tunnel1_rekey_fuzz_percentage` - (Optional, Default `100`) The percentage of the rekey window for the first VPN tunnel (determined by `tunnel1_rekey_margin_time_seconds`) during which the rekey time is randomly selected. Valid value is between `0` and `100`.
+* `tunnel2_rekey_fuzz_percentage` - (Optional, Default `100`) The percentage of the rekey window for the second VPN tunnel (determined by `tunnel2_rekey_margin_time_seconds`) during which the rekey time is randomly selected. Valid value is between `0` and `100`.
+* `tunnel1_rekey_margin_time_seconds` - (Optional, Default `540`) The margin time, in seconds, before the phase 2 lifetime expires, during which the AWS side of the first VPN connection performs an IKE rekey. The exact time of the rekey is randomly selected based on the value for `tunnel1_rekey_fuzz_percentage`. Valid value is between `60` and half of `tunnel1_phase2_lifetime_seconds`.
+* `tunnel2_rekey_margin_time_seconds` - (Optional, Default `540`) The margin time, in seconds, before the phase 2 lifetime expires, during which the AWS side of the second VPN connection performs an IKE rekey. The exact time of the rekey is randomly selected based on the value for `tunnel2_rekey_fuzz_percentage`. Valid value is between `60` and half of `tunnel2_phase2_lifetime_seconds`.
+* `tunnel1_replay_window_size` - (Optional, Default `1024`) The number of packets in an IKE replay window for the first VPN tunnel. Valid value is between `64` and `2048`.
+* `tunnel2_replay_window_size` - (Optional, Default `1024`) The number of packets in an IKE replay window for the second VPN tunnel. Valid value is between `64` and `2048`.
+* `tunnel1_startup_action` - (Optional, Default `add`) The action to take when the establishing the tunnel for the first VPN connection. By default, your customer gateway device must initiate the IKE negotiation and bring up the tunnel. Specify start for AWS to initiate the IKE negotiation. Valid values are `add | start`.
+* `tunnel2_startup_action` - (Optional, Default `add`) The action to take when the establishing the tunnel for the second VPN connection. By default, your customer gateway device must initiate the IKE negotiation and bring up the tunnel. Specify start for AWS to initiate the IKE negotiation. Valid values are `add | start`.
+
+### Log Options
+
+The `tunnel1_log_options` and `tunnel2_log_options` block supports the following arguments:
+
+* `cloudwatch_log_options` - (Optional) Options for sending VPN tunnel logs to CloudWatch. See [CloudWatch Log Options](#cloudwatch-log-options) below for more details.
+
+### CloudWatch Log Options
+
+The `cloudwatch_log_options` blocks supports the following arguments:
+
+* `log_enabled` - (Optional) Enable or disable VPN tunnel logging feature. The default is `false`.
+* `log_group_arn` - (Optional) The Amazon Resource Name (ARN) of the CloudWatch log group to send logs to.
+* `log_output_format` - (Optional) Set log format. Default format is json. Possible values are: `json` and `text`. The default is `json`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the VPN Connection.
+* `id` - The amazon-assigned ID of the VPN connection.
+* `core_network_arn` - The ARN of the core network.
+* `core_network_attachment_arn` - The ARN of the core network attachment.
+* `customer_gateway_configuration` - The configuration information for the VPN connection's customer gateway (in the native XML format).
+* `customer_gateway_id` - The ID of the customer gateway to which the connection is attached.
+* `routes` - The static routes associated with the VPN connection. Detailed below.
+* `static_routes_only` - Whether the VPN connection uses static routes exclusively.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `transit_gateway_attachment_id` - When associated with an EC2 Transit Gateway (`transit_gateway_id` argument), the attachment ID. See also the [`aws_ec2_tag` resource](/docs/providers/aws/r/ec2_tag.html) for tagging the EC2 Transit Gateway VPN Attachment.
+* `tunnel1_address` - The public IP address of the first VPN tunnel.
+* `tunnel1_cgw_inside_address` - The RFC 6890 link-local address of the first VPN tunnel (Customer Gateway Side).
+* `tunnel1_vgw_inside_address` - The RFC 6890 link-local address of the first VPN tunnel (VPN Gateway Side).
+* `tunnel1_preshared_key` - The preshared key of the first VPN tunnel.
+* `tunnel1_bgp_asn` - The bgp asn number of the first VPN tunnel.
+* `tunnel1_bgp_holdtime` - The bgp holdtime of the first VPN tunnel.
+* `tunnel2_address` - The public IP address of the second VPN tunnel.
+* `tunnel2_cgw_inside_address` - The RFC 6890 link-local address of the second VPN tunnel (Customer Gateway Side).
+* `tunnel2_vgw_inside_address` - The RFC 6890 link-local address of the second VPN tunnel (VPN Gateway Side).
+* `tunnel2_preshared_key` - The preshared key of the second VPN tunnel.
+* `tunnel2_bgp_asn` - The bgp asn number of the second VPN tunnel.
+* `tunnel2_bgp_holdtime` - The bgp holdtime of the second VPN tunnel.
+* `vgw_telemetry` - Telemetry for the VPN tunnels. Detailed below.
+* `vpn_gateway_id` - The ID of the virtual private gateway to which the connection is attached.
+
+### routes
+
+* `destination_cidr_block` - The CIDR block associated with the local subnet of the customer data center.
+* `source` - Indicates how the routes were provided.
+* `state` - The current state of the static route.
+
+### vgw_telemetry
+
+* `accepted_route_count` - The number of accepted routes.
+* `certificate_arn` - The Amazon Resource Name (ARN) of the VPN tunnel endpoint certificate.
+* `last_status_change` - The date and time of the last change in status.
+* `outside_ip_address` - The Internet-routable IP address of the virtual private gateway's outside interface.
+* `status` - The status of the VPN tunnel.
+* `status_message` - If an error occurs, a description of the error.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import VPN Connections using the VPN connection `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import VPN Connections using the VPN connection `id`. For example:
+
+```console
+% terraform import aws_vpn_connection.testvpnconnection vpn-40f41529
+```
+
+<!-- cache-key: cdktf-0.18.0 input-3d90dfa10b9036a076f1ef132a7b8d5011c2699fea5ecbd9ed76a20dc1755eae -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/vpn_connection_route.html.markdown b/website/docs/cdktf/python/r/vpn_connection_route.html.markdown
new file mode 100644
index 00000000000..b49ff31dcf1
--- /dev/null
+++ b/website/docs/cdktf/python/r/vpn_connection_route.html.markdown
@@ -0,0 +1,70 @@
+---
+subcategory: "VPN (Site-to-Site)"
+layout: "aws"
+page_title: "AWS: aws_vpn_connection_route"
+description: |-
+  Provides a static route between a VPN connection and a customer gateway.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_vpn_connection_route
+
+Provides a static route between a VPN connection and a customer gateway.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.customer_gateway import CustomerGateway
+from imports.aws.vpc import Vpc
+from imports.aws.vpn_connection import VpnConnection
+from imports.aws.vpn_connection_route import VpnConnectionRoute
+from imports.aws.vpn_gateway import VpnGateway
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        customer_gateway = CustomerGateway(self, "customer_gateway",
+            bgp_asn=Token.as_string(65000),
+            ip_address="172.0.0.1",
+            type="ipsec.1"
+        )
+        vpc = Vpc(self, "vpc",
+            cidr_block="10.0.0.0/16"
+        )
+        vpn_gateway = VpnGateway(self, "vpn_gateway",
+            vpc_id=vpc.id
+        )
+        main = VpnConnection(self, "main",
+            customer_gateway_id=customer_gateway.id,
+            static_routes_only=True,
+            type="ipsec.1",
+            vpn_gateway_id=vpn_gateway.id
+        )
+        VpnConnectionRoute(self, "office",
+            destination_cidr_block="192.168.10.0/24",
+            vpn_connection_id=main.id
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `destination_cidr_block` - (Required) The CIDR block associated with the local subnet of the customer network.
+* `vpn_connection_id` - (Required) The ID of the VPN connection.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `destination_cidr_block` - The CIDR block associated with the local subnet of the customer network.
+* `vpn_connection_id` - The ID of the VPN connection.
+
+<!-- cache-key: cdktf-0.18.0 input-64b067c6df57ea0b47856274e104f5456078a8dcbea6eef290dbd19011659e4a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/vpn_gateway.html.markdown b/website/docs/cdktf/python/r/vpn_gateway.html.markdown
new file mode 100644
index 00000000000..f4fce3ab8c0
--- /dev/null
+++ b/website/docs/cdktf/python/r/vpn_gateway.html.markdown
@@ -0,0 +1,73 @@
+---
+subcategory: "VPN (Site-to-Site)"
+layout: "aws"
+page_title: "AWS: aws_vpn_gateway"
+description: |-
+  Provides a resource to create a VPC VPN Gateway.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_vpn_gateway
+
+Provides a resource to create a VPC VPN Gateway.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.vpn_gateway import VpnGateway
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        VpnGateway(self, "vpn_gw",
+            tags={
+                "Name": "main"
+            },
+            vpc_id=main.id
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `vpc_id` - (Optional) The VPC ID to create in.
+* `availability_zone` - (Optional) The Availability Zone for the virtual private gateway.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `amazon_side_asn` - (Optional) The Autonomous System Number (ASN) for the Amazon side of the gateway. If you don't specify an ASN, the virtual private gateway is created with the default ASN.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the VPN Gateway.
+* `id` - The ID of the VPN Gateway.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import VPN Gateways using the VPN gateway `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import VPN Gateways using the VPN gateway `id`. For example:
+
+```console
+% terraform import aws_vpn_gateway.testvpngateway vgw-9a4cacf3
+```
+
+<!-- cache-key: cdktf-0.18.0 input-23251df1f50c37a9ee6f1698ee1bc52e7ae914120d59db5552c6f4fc31ca25f4 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/vpn_gateway_attachment.html.markdown b/website/docs/cdktf/python/r/vpn_gateway_attachment.html.markdown
new file mode 100644
index 00000000000..c1907336f9a
--- /dev/null
+++ b/website/docs/cdktf/python/r/vpn_gateway_attachment.html.markdown
@@ -0,0 +1,72 @@
+---
+subcategory: "VPN (Site-to-Site)"
+layout: "aws"
+page_title: "AWS: aws_vpn_gateway_attachment"
+description: |-
+  Provides a Virtual Private Gateway attachment resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_vpn_gateway_attachment
+
+Provides a Virtual Private Gateway attachment resource, allowing for an existing
+hardware VPN gateway to be attached and/or detached from a VPC.
+
+-> **Note:** The [`aws_vpn_gateway`](vpn_gateway.html)
+resource can also automatically attach the Virtual Private Gateway it creates
+to an existing VPC by setting the [`vpc_id`](vpn_gateway.html#vpc_id) attribute accordingly.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.vpc import Vpc
+from imports.aws.vpn_gateway import VpnGateway
+from imports.aws.vpn_gateway_attachment import VpnGatewayAttachment
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        network = Vpc(self, "network",
+            cidr_block="10.0.0.0/16"
+        )
+        vpn = VpnGateway(self, "vpn",
+            tags={
+                "Name": "example-vpn-gateway"
+            }
+        )
+        VpnGatewayAttachment(self, "vpn_attachment",
+            vpc_id=network.id,
+            vpn_gateway_id=vpn.id
+        )
+```
+
+See [Virtual Private Cloud](http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Introduction.html)
+and [Virtual Private Gateway](http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_VPN.html) user
+guides for more information.
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `vpc_id` - (Required) The ID of the VPC.
+* `vpn_gateway_id` - (Required) The ID of the Virtual Private Gateway.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `vpc_id` - The ID of the VPC that Virtual Private Gateway is attached to.
+* `vpn_gateway_id` - The ID of the Virtual Private Gateway.
+
+## Import
+
+You cannot import this resource.
+
+<!-- cache-key: cdktf-0.18.0 input-2348f137f23e9e2ad9c5fe33e3628594f5ea4a23246976fd2266c1cbe04f05d2 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/vpn_gateway_route_propagation.html.markdown b/website/docs/cdktf/python/r/vpn_gateway_route_propagation.html.markdown
new file mode 100644
index 00000000000..5bbfd3e7170
--- /dev/null
+++ b/website/docs/cdktf/python/r/vpn_gateway_route_propagation.html.markdown
@@ -0,0 +1,57 @@
+---
+subcategory: "VPN (Site-to-Site)"
+layout: "aws"
+page_title: "AWS: aws_vpn_gateway_route_propagation"
+description: |-
+  Requests automatic route propagation between a VPN gateway and a route table.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_vpn_gateway_route_propagation
+
+Requests automatic route propagation between a VPN gateway and a route table.
+
+~> **Note:** This resource should not be used with a route table that has
+the `propagating_vgws` argument set. If that argument is set, any route
+propagation not explicitly listed in its value will be removed.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.vpn_gateway_route_propagation import VpnGatewayRoutePropagation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        VpnGatewayRoutePropagation(self, "example",
+            route_table_id=Token.as_string(aws_route_table_example.id),
+            vpn_gateway_id=Token.as_string(aws_vpn_gateway_example.id)
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `vpn_gateway_id` - The id of the `aws_vpn_gateway` to propagate routes from.
+* `route_table_id` - The id of the `aws_route_table` to propagate routes into.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `2m`)
+- `delete` - (Default `2m`)
+
+<!-- cache-key: cdktf-0.18.0 input-1c3c2e8d2f812de0afe226b6fe030874cca2a61ce5a4b402872d573b9b0adc66 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/waf_byte_match_set.html.markdown b/website/docs/cdktf/python/r/waf_byte_match_set.html.markdown
new file mode 100644
index 00000000000..f3733bd85f8
--- /dev/null
+++ b/website/docs/cdktf/python/r/waf_byte_match_set.html.markdown
@@ -0,0 +1,112 @@
+---
+subcategory: "WAF Classic"
+layout: "aws"
+page_title: "AWS: aws_waf_byte_match_set"
+description: |-
+  Provides a AWS WAF Byte Match Set resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_waf_byte_match_set
+
+Provides a WAF Byte Match Set Resource
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.waf_byte_match_set import WafByteMatchSet
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        WafByteMatchSet(self, "byte_set",
+            byte_match_tuples=[WafByteMatchSetByteMatchTuples(
+                field_to_match=WafByteMatchSetByteMatchTuplesFieldToMatch(
+                    data="referer",
+                    type="HEADER"
+                ),
+                positional_constraint="CONTAINS",
+                target_string="badrefer1",
+                text_transformation="NONE"
+            )
+            ],
+            name="tf_waf_byte_match_set"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name or description of the Byte Match Set.
+* `byte_match_tuples` - Specifies the bytes (typically a string that corresponds
+  with ASCII characters) that you want to search for in web requests,
+  the location in requests that you want to search, and other settings.
+
+## Nested blocks
+
+### `byte_match_tuples`
+
+#### Arguments
+
+* `field_to_match` - (Required) The part of a web request that you want to search, such as a specified header or a query string.
+* `positional_constraint` - (Required) Within the portion of a web request that you want to search
+  (for example, in the query string, if any), specify where you want to search.
+  e.g., `CONTAINS`, `CONTAINS_WORD` or `EXACTLY`.
+  See [docs](http://docs.aws.amazon.com/waf/latest/APIReference/API_ByteMatchTuple.html#WAF-Type-ByteMatchTuple-PositionalConstraint)
+  for all supported values.
+* `target_string` - (Optional) The value that you want to search for within the field specified by `field_to_match`, e.g., `badrefer1`.
+  See [docs](https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_ByteMatchTuple.html)
+  for all supported values.
+* `text_transformation` - (Required) Text transformations used to eliminate unusual formatting that attackers use in web requests in an effort to bypass AWS WAF.
+  If you specify a transformation, AWS WAF performs the transformation on `target_string` before inspecting a request for a match.
+  e.g., `CMD_LINE`, `HTML_ENTITY_DECODE` or `NONE`.
+  See [docs](http://docs.aws.amazon.com/waf/latest/APIReference/API_ByteMatchTuple.html#WAF-Type-ByteMatchTuple-TextTransformation)
+  for all supported values.
+
+### `field_to_match`
+
+#### Arguments
+
+* `data` - (Optional) When `type` is `HEADER`, enter the name of the header that you want to search, e.g., `User-Agent` or `Referer`.
+  If `type` is any other value, omit this field.
+* `type` - (Required) The part of the web request that you want AWS WAF to search for a specified string.
+  e.g., `HEADER`, `METHOD` or `BODY`.
+  See [docs](http://docs.aws.amazon.com/waf/latest/APIReference/API_FieldToMatch.html)
+  for all supported values.
+
+## Remarks
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the WAF Byte Match Set.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WAF Byte Match Set using the id. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import WAF Byte Match Set using the id. For example:
+
+```console
+% terraform import aws_waf_byte_match_set.byte_set a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
+```
+
+<!-- cache-key: cdktf-0.18.0 input-a06ceb0ddbbc765dc1c16cfd7dbd1d081a410429cadf571ebee08f28fa270e27 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/waf_geo_match_set.html.markdown b/website/docs/cdktf/python/r/waf_geo_match_set.html.markdown
new file mode 100644
index 00000000000..4ac25e1ee53
--- /dev/null
+++ b/website/docs/cdktf/python/r/waf_geo_match_set.html.markdown
@@ -0,0 +1,88 @@
+---
+subcategory: "WAF Classic"
+layout: "aws"
+page_title: "AWS: aws_waf_geo_match_set"
+description: |-
+  Provides a AWS WAF GeoMatchSet resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_waf_geo_match_set
+
+Provides a WAF Geo Match Set Resource
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.waf_geo_match_set import WafGeoMatchSet
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        WafGeoMatchSet(self, "geo_match_set",
+            geo_match_constraint=[WafGeoMatchSetGeoMatchConstraint(
+                type="Country",
+                value="US"
+            ), WafGeoMatchSetGeoMatchConstraint(
+                type="Country",
+                value="CA"
+            )
+            ],
+            name="geo_match_set"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name or description of the GeoMatchSet.
+* `geo_match_constraint` - (Optional) The GeoMatchConstraint objects which contain the country that you want AWS WAF to search for.
+
+## Nested Blocks
+
+### `geo_match_constraint`
+
+#### Arguments
+
+* `type` - (Required) The type of geographical area you want AWS WAF to search for. Currently Country is the only valid value.
+* `value` - (Required) The country that you want AWS WAF to search for.
+  This is the two-letter country code, e.g., `US`, `CA`, `RU`, `CN`, etc.
+  See [docs](https://docs.aws.amazon.com/waf/latest/APIReference/API_GeoMatchConstraint.html) for all supported values.
+
+## Remarks
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the WAF GeoMatchSet.
+* `arn` - Amazon Resource Name (ARN)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WAF Geo Match Set using their ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import WAF Geo Match Set using their ID. For example:
+
+```console
+% terraform import aws_waf_geo_match_set.example a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
+```
+
+<!-- cache-key: cdktf-0.18.0 input-c1ffab5d5b03d4b8b05b08bb866e76580c89d0afb01bede81ffc61a97685962b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/waf_ipset.html.markdown b/website/docs/cdktf/python/r/waf_ipset.html.markdown
new file mode 100644
index 00000000000..708faeacfdb
--- /dev/null
+++ b/website/docs/cdktf/python/r/waf_ipset.html.markdown
@@ -0,0 +1,84 @@
+---
+subcategory: "WAF Classic"
+layout: "aws"
+page_title: "AWS: aws_waf_ipset"
+description: |-
+  Provides a AWS WAF IPSet resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_waf_ipset
+
+Provides a WAF IPSet Resource
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.waf_ipset import WafIpset
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        WafIpset(self, "ipset",
+            ip_set_descriptors=[WafIpsetIpSetDescriptors(
+                type="IPV4",
+                value="192.0.7.0/24"
+            ), WafIpsetIpSetDescriptors(
+                type="IPV4",
+                value="10.16.16.0/16"
+            )
+            ],
+            name="tfIPSet"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name or description of the IPSet.
+* `ip_set_descriptors` - (Optional) One or more pairs specifying the IP address type (IPV4 or IPV6) and the IP address range (in CIDR format) from which web requests originate.
+
+## Nested Blocks
+
+### `ip_set_descriptors`
+
+#### Arguments
+
+* `type` - (Required) Type of the IP address - `IPV4` or `IPV6`.
+* `value` - (Required) An IPv4 or IPv6 address specified via CIDR notationE.g., `192.0.2.44/32` or `1111:0000:0000:0000:0000:0000:0000:0000/64`
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the WAF IPSet.
+* `arn` - The ARN of the WAF IPSet.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WAF IPSets using their ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import WAF IPSets using their ID. For example:
+
+```console
+% terraform import aws_waf_ipset.example a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
+```
+
+<!-- cache-key: cdktf-0.18.0 input-199b162a3b94acefad74ab099acfcf5a728844c2fbdd1d414b2e9f701182033c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/waf_rate_based_rule.html.markdown b/website/docs/cdktf/python/r/waf_rate_based_rule.html.markdown
new file mode 100644
index 00000000000..9ce6364756f
--- /dev/null
+++ b/website/docs/cdktf/python/r/waf_rate_based_rule.html.markdown
@@ -0,0 +1,108 @@
+---
+subcategory: "WAF Classic"
+layout: "aws"
+page_title: "AWS: aws_waf_rate_based_rule"
+description: |-
+  Provides a AWS WAF rule resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_waf_rate_based_rule
+
+Provides a WAF Rate Based Rule Resource
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.waf_ipset import WafIpset
+from imports.aws.waf_rate_based_rule import WafRateBasedRule
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ipset = WafIpset(self, "ipset",
+            ip_set_descriptors=[WafIpsetIpSetDescriptors(
+                type="IPV4",
+                value="192.0.7.0/24"
+            )
+            ],
+            name="tfIPSet"
+        )
+        WafRateBasedRule(self, "wafrule",
+            depends_on=[ipset],
+            metric_name="tfWAFRule",
+            name="tfWAFRule",
+            predicates=[WafRateBasedRulePredicates(
+                data_id=ipset.id,
+                negated=False,
+                type="IPMatch"
+            )
+            ],
+            rate_key="IP",
+            rate_limit=100
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `metric_name` - (Required) The name or description for the Amazon CloudWatch metric of this rule.
+* `name` - (Required) The name or description of the rule.
+* `rate_key` - (Required) Valid value is IP.
+* `rate_limit` - (Required) The maximum number of requests, which have an identical value in the field specified by the RateKey, allowed in a five-minute period. Minimum value is 100.
+* `predicates` - (Optional) The objects to include in a rule (documented below).
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Nested Blocks
+
+### `predicates`
+
+See the [WAF Documentation](https://docs.aws.amazon.com/waf/latest/APIReference/API_Predicate.html) for more information.
+
+#### Arguments
+
+* `negated` - (Required) Set this to `false` if you want to allow, block, or count requests
+  based on the settings in the specified `ByteMatchSet`, `IPSet`, `SqlInjectionMatchSet`, `XssMatchSet`, or `SizeConstraintSet`.
+  For example, if an IPSet includes the IP address `192.0.2.44`, AWS WAF will allow or block requests based on that IP address.
+  If set to `true`, AWS WAF will allow, block, or count requests based on all IP addresses _except_ `192.0.2.44`.
+* `data_id` - (Required) A unique identifier for a predicate in the rule, such as Byte Match Set ID or IPSet ID.
+* `type` - (Required) The type of predicate in a rule. Valid values: `ByteMatch`, `GeoMatch`, `IPMatch`, `RegexMatch`, `SizeConstraint`, `SqlInjectionMatch`, or `XssMatch`.
+
+## Remarks
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the WAF rule.
+* `arn` - Amazon Resource Name (ARN)
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WAF Rated Based Rule using the id. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import WAF Rated Based Rule using the id. For example:
+
+```console
+% terraform import aws_waf_rate_based_rule.wafrule a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
+```
+
+<!-- cache-key: cdktf-0.18.0 input-530aa2bf29dc90170951e958f2fab3eca6770263da54a51c9aba805d25697e07 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/waf_regex_match_set.html.markdown b/website/docs/cdktf/python/r/waf_regex_match_set.html.markdown
new file mode 100644
index 00000000000..698a7621107
--- /dev/null
+++ b/website/docs/cdktf/python/r/waf_regex_match_set.html.markdown
@@ -0,0 +1,103 @@
+---
+subcategory: "WAF Classic"
+layout: "aws"
+page_title: "AWS: aws_waf_regex_match_set"
+description: |-
+  Provides a AWS WAF Regex Match Set resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_waf_regex_match_set
+
+Provides a WAF Regex Match Set Resource
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.waf_regex_match_set import WafRegexMatchSet
+from imports.aws.waf_regex_pattern_set import WafRegexPatternSet
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = WafRegexPatternSet(self, "example",
+            name="example",
+            regex_pattern_strings=["one", "two"]
+        )
+        aws_waf_regex_match_set_example = WafRegexMatchSet(self, "example_1",
+            name="example",
+            regex_match_tuple=[WafRegexMatchSetRegexMatchTuple(
+                field_to_match=WafRegexMatchSetRegexMatchTupleFieldToMatch(
+                    data="User-Agent",
+                    type="HEADER"
+                ),
+                regex_pattern_set_id=example.id,
+                text_transformation="NONE"
+            )
+            ]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_waf_regex_match_set_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name or description of the Regex Match Set.
+* `regex_match_tuple` - (Required) The regular expression pattern that you want AWS WAF to search for in web requests, the location in requests that you want AWS WAF to search, and other settings. See below.
+
+### Nested Arguments
+
+#### `regex_match_tuple`
+
+* `field_to_match` - (Required) The part of a web request that you want to search, such as a specified header or a query string.
+* `regex_pattern_set_id` - (Required) The ID of a [Regex Pattern Set](/docs/providers/aws/r/waf_regex_pattern_set.html).
+* `text_transformation` - (Required) Text transformations used to eliminate unusual formatting that attackers use in web requests in an effort to bypass AWS WAF.
+  e.g., `CMD_LINE`, `HTML_ENTITY_DECODE` or `NONE`.
+  See [docs](http://docs.aws.amazon.com/waf/latest/APIReference/API_ByteMatchTuple.html#WAF-Type-ByteMatchTuple-TextTransformation)
+  for all supported values.
+
+#### `field_to_match`
+
+* `data` - (Optional) When `type` is `HEADER`, enter the name of the header that you want to search, e.g., `User-Agent` or `Referer`.
+  If `type` is any other value, omit this field.
+* `type` - (Required) The part of the web request that you want AWS WAF to search for a specified string.
+  e.g., `HEADER`, `METHOD` or `BODY`.
+  See [docs](http://docs.aws.amazon.com/waf/latest/APIReference/API_FieldToMatch.html)
+  for all supported values.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the WAF Regex Match Set.
+* `arn` - Amazon Resource Name (ARN)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WAF Regex Match Set using their ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import WAF Regex Match Set using their ID. For example:
+
+```console
+% terraform import aws_waf_regex_match_set.example a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ce0a33802205206c3df8153ccf35320eadb17a76e385e935a563c75b8193cf45 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/waf_regex_pattern_set.html.markdown b/website/docs/cdktf/python/r/waf_regex_pattern_set.html.markdown
new file mode 100644
index 00000000000..1a992b4a09d
--- /dev/null
+++ b/website/docs/cdktf/python/r/waf_regex_pattern_set.html.markdown
@@ -0,0 +1,68 @@
+---
+subcategory: "WAF Classic"
+layout: "aws"
+page_title: "AWS: aws_waf_regex_pattern_set"
+description: |-
+  Provides a AWS WAF Regex Pattern Set resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_waf_regex_pattern_set
+
+Provides a WAF Regex Pattern Set Resource
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.waf_regex_pattern_set import WafRegexPatternSet
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        WafRegexPatternSet(self, "example",
+            name="tf_waf_regex_pattern_set",
+            regex_pattern_strings=["one", "two"]
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name or description of the Regex Pattern Set.
+* `regex_pattern_strings` - (Optional) A list of regular expression (regex) patterns that you want AWS WAF to search for, such as `B[a@]dB[o0]t`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the WAF Regex Pattern Set.
+* `arn` - Amazon Resource Name (ARN)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AWS WAF Regex Pattern Set using their ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import AWS WAF Regex Pattern Set using their ID. For example:
+
+```console
+% terraform import aws_waf_regex_pattern_set.example a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
+```
+
+<!-- cache-key: cdktf-0.18.0 input-c7a01b91a902b53fb081fc1a31da6a9bab5a071453ba698e3fa3b714308491e7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/waf_rule.html.markdown b/website/docs/cdktf/python/r/waf_rule.html.markdown
new file mode 100644
index 00000000000..aec5c7638bb
--- /dev/null
+++ b/website/docs/cdktf/python/r/waf_rule.html.markdown
@@ -0,0 +1,102 @@
+---
+subcategory: "WAF Classic"
+layout: "aws"
+page_title: "AWS: aws_waf_rule"
+description: |-
+  Provides a AWS WAF rule resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_waf_rule
+
+Provides a WAF Rule Resource
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.waf_ipset import WafIpset
+from imports.aws.waf_rule import WafRule
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ipset = WafIpset(self, "ipset",
+            ip_set_descriptors=[WafIpsetIpSetDescriptors(
+                type="IPV4",
+                value="192.0.7.0/24"
+            )
+            ],
+            name="tfIPSet"
+        )
+        WafRule(self, "wafrule",
+            depends_on=[ipset],
+            metric_name="tfWAFRule",
+            name="tfWAFRule",
+            predicates=[WafRulePredicates(
+                data_id=ipset.id,
+                negated=False,
+                type="IPMatch"
+            )
+            ]
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `metric_name` - (Required) The name or description for the Amazon CloudWatch metric of this rule. The name can contain only alphanumeric characters (A-Z, a-z, 0-9); the name can't contain whitespace.
+* `name` - (Required) The name or description of the rule.
+* `predicates` - (Optional) The objects to include in a rule (documented below).
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Nested Blocks
+
+### `predicates`
+
+See the [WAF Documentation](https://docs.aws.amazon.com/waf/latest/APIReference/API_Predicate.html) for more information.
+
+#### Arguments
+
+* `negated` - (Required) Set this to `false` if you want to allow, block, or count requests
+  based on the settings in the specified [waf_byte_match_set](/docs/providers/aws/r/waf_byte_match_set.html), [waf_ipset](/docs/providers/aws/r/waf_ipset.html), [aws_waf_size_constraint_set](/docs/providers/aws/r/waf_size_constraint_set.html), [aws_waf_sql_injection_match_set](/docs/providers/aws/r/waf_sql_injection_match_set.html) or [aws_waf_xss_match_set](/docs/providers/aws/r/waf_xss_match_set.html).
+  For example, if an IPSet includes the IP address `192.0.2.44`, AWS WAF will allow or block requests based on that IP address.
+  If set to `true`, AWS WAF will allow, block, or count requests based on all IP addresses except `192.0.2.44`.
+* `data_id` - (Required) A unique identifier for a predicate in the rule, such as Byte Match Set ID or IPSet ID.
+* `type` - (Required) The type of predicate in a rule. Valid values: `ByteMatch`, `GeoMatch`, `IPMatch`, `RegexMatch`, `SizeConstraint`, `SqlInjectionMatch`, or `XssMatch`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the WAF rule.
+* `arn` - The ARN of the WAF rule.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WAF rules using the id. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import WAF rules using the id. For example:
+
+```console
+% terraform import aws_waf_rule.example a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
+```
+
+<!-- cache-key: cdktf-0.18.0 input-2c43340a2d06e3942756017a4add4fafed5cbb5d7c4a714075fea348a36c1c0b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/waf_rule_group.html.markdown b/website/docs/cdktf/python/r/waf_rule_group.html.markdown
new file mode 100644
index 00000000000..32b40805336
--- /dev/null
+++ b/website/docs/cdktf/python/r/waf_rule_group.html.markdown
@@ -0,0 +1,99 @@
+---
+subcategory: "WAF Classic"
+layout: "aws"
+page_title: "AWS: aws_waf_rule_group"
+description: |-
+  Provides a AWS WAF rule group resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_waf_rule_group
+
+Provides a WAF Rule Group Resource
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.waf_rule import WafRule
+from imports.aws.waf_rule_group import WafRuleGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = WafRule(self, "example",
+            metric_name="example",
+            name="example"
+        )
+        aws_waf_rule_group_example = WafRuleGroup(self, "example_1",
+            activated_rule=[WafRuleGroupActivatedRule(
+                action=WafRuleGroupActivatedRuleAction(
+                    type="COUNT"
+                ),
+                priority=50,
+                rule_id=example.id
+            )
+            ],
+            metric_name="example",
+            name="example"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_waf_rule_group_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Optional) Name of the rule group. If omitted, Terraform will assign a random, unique name. Conflicts with `name_prefix`.
+* `name_prefix` - (Optional) Creates a unique name beginning with the specified prefix. Conflicts with `name`.
+* `metric_name` - (Required) A friendly name for the metrics from the rule group
+* `activated_rule` - (Optional) A list of activated rules, see below
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Nested Blocks
+
+### `activated_rule`
+
+#### Arguments
+
+* `action` - (Required) Specifies the action that CloudFront or AWS WAF takes when a web request matches the conditions in the rule.
+    * `type` - (Required) e.g., `BLOCK`, `ALLOW`, or `COUNT`
+* `priority` - (Required) Specifies the order in which the rules are evaluated. Rules with a lower value are evaluated before rules with a higher value.
+* `rule_id` - (Required) The ID of a [rule](/docs/providers/aws/r/waf_rule.html)
+* `type` - (Optional) The rule type, either [`REGULAR`](/docs/providers/aws/r/waf_rule.html), [`RATE_BASED`](/docs/providers/aws/r/waf_rate_based_rule.html), or `GROUP`. Defaults to `REGULAR`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the WAF rule group.
+* `arn` - The ARN of the WAF rule group.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WAF Rule Group using the id. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import WAF Rule Group using the id. For example:
+
+```console
+% terraform import aws_waf_rule_group.example a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
+```
+
+<!-- cache-key: cdktf-0.18.0 input-55ab96b827dc2a0f93ec875d666102ecc7d13a2de2d65c381747b9a8c9c72a79 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/waf_size_constraint_set.html.markdown b/website/docs/cdktf/python/r/waf_size_constraint_set.html.markdown
new file mode 100644
index 00000000000..d94b153bf8b
--- /dev/null
+++ b/website/docs/cdktf/python/r/waf_size_constraint_set.html.markdown
@@ -0,0 +1,106 @@
+---
+subcategory: "WAF Classic"
+layout: "aws"
+page_title: "AWS: aws_waf_size_constraint_set"
+description: |-
+  Provides a AWS WAF Size Constraint Set resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_waf_size_constraint_set
+
+Provides a WAF Size Constraint Set Resource
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.waf_size_constraint_set import WafSizeConstraintSet
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        WafSizeConstraintSet(self, "size_constraint_set",
+            name="tfsize_constraints",
+            size_constraints=[WafSizeConstraintSetSizeConstraints(
+                comparison_operator="EQ",
+                field_to_match=WafSizeConstraintSetSizeConstraintsFieldToMatch(
+                    type="BODY"
+                ),
+                size=Token.as_number("4096"),
+                text_transformation="NONE"
+            )
+            ]
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name or description of the Size Constraint Set.
+* `size_constraints` - (Optional) Specifies the parts of web requests that you want to inspect the size of.
+
+## Nested Blocks
+
+### `size_constraints`
+
+#### Arguments
+
+* `field_to_match` - (Required) Specifies where in a web request to look for the size constraint.
+* `comparison_operator` - (Required) The type of comparison you want to perform.
+  e.g., `EQ`, `NE`, `LT`, `GT`.
+  See [docs](https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_SizeConstraint.html) for all supported values.
+* `size` - (Required) The size in bytes that you want to compare against the size of the specified `field_to_match`.
+  Valid values are between 0 - 21474836480 bytes (0 - 20 GB).
+* `text_transformation` - (Required) Text transformations used to eliminate unusual formatting that attackers use in web requests in an effort to bypass AWS WAF.
+  If you specify a transformation, AWS WAF performs the transformation on `field_to_match` before inspecting a request for a match.
+  e.g., `CMD_LINE`, `HTML_ENTITY_DECODE` or `NONE`.
+  See [docs](http://docs.aws.amazon.com/waf/latest/APIReference/API_SizeConstraint.html#WAF-Type-SizeConstraint-TextTransformation)
+  for all supported values.
+  **Note:** if you choose `BODY` as `type`, you must choose `NONE` because CloudFront forwards only the first 8192 bytes for inspection.
+
+### `field_to_match`
+
+#### Arguments
+
+* `data` - (Optional) When `type` is `HEADER`, enter the name of the header that you want to search, e.g., `User-Agent` or `Referer`.
+  If `type` is any other value, omit this field.
+* `type` - (Required) The part of the web request that you want AWS WAF to search for a specified string.
+  e.g., `HEADER`, `METHOD` or `BODY`.
+  See [docs](http://docs.aws.amazon.com/waf/latest/APIReference/API_FieldToMatch.html)
+  for all supported values.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the WAF Size Constraint Set.
+* `arn` - Amazon Resource Name (ARN)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AWS WAF Size Constraint Set using their ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import AWS WAF Size Constraint Set using their ID. For example:
+
+```console
+% terraform import aws_waf_size_constraint_set.example a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
+```
+
+<!-- cache-key: cdktf-0.18.0 input-8aed729c72fd1d4b82992bc8b3dac7aa0adf754f46bba56e2c3fc9d20546c234 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/waf_sql_injection_match_set.html.markdown b/website/docs/cdktf/python/r/waf_sql_injection_match_set.html.markdown
new file mode 100644
index 00000000000..8628e7c78fd
--- /dev/null
+++ b/website/docs/cdktf/python/r/waf_sql_injection_match_set.html.markdown
@@ -0,0 +1,97 @@
+---
+subcategory: "WAF Classic"
+layout: "aws"
+page_title: "AWS: aws_waf_sql_injection_match_set"
+description: |-
+  Provides a AWS WAF SQL Injection Match Set resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_waf_sql_injection_match_set
+
+Provides a WAF SQL Injection Match Set Resource
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.waf_sql_injection_match_set import WafSqlInjectionMatchSet
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        WafSqlInjectionMatchSet(self, "sql_injection_match_set",
+            name="tf-sql_injection_match_set",
+            sql_injection_match_tuples=[WafSqlInjectionMatchSetSqlInjectionMatchTuples(
+                field_to_match=WafSqlInjectionMatchSetSqlInjectionMatchTuplesFieldToMatch(
+                    type="QUERY_STRING"
+                ),
+                text_transformation="URL_DECODE"
+            )
+            ]
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name or description of the SQL Injection Match Set.
+* `sql_injection_match_tuples` - (Optional) The parts of web requests that you want AWS WAF to inspect for malicious SQL code and, if you want AWS WAF to inspect a header, the name of the header.
+
+## Nested Blocks
+
+### `sql_injection_match_tuples`
+
+* `field_to_match` - (Required) Specifies where in a web request to look for snippets of malicious SQL code.
+* `text_transformation` - (Required) Text transformations used to eliminate unusual formatting that attackers use in web requests in an effort to bypass AWS WAF.
+  If you specify a transformation, AWS WAF performs the transformation on `field_to_match` before inspecting a request for a match.
+  e.g., `CMD_LINE`, `HTML_ENTITY_DECODE` or `NONE`.
+  See [docs](http://docs.aws.amazon.com/waf/latest/APIReference/API_SqlInjectionMatchTuple.html#WAF-Type-SqlInjectionMatchTuple-TextTransformation)
+  for all supported values.
+
+### `field_to_match`
+
+#### Arguments
+
+* `data` - (Optional) When `type` is `HEADER`, enter the name of the header that you want to search, e.g., `User-Agent` or `Referer`.
+  If `type` is any other value, omit this field.
+* `type` - (Required) The part of the web request that you want AWS WAF to search for a specified string.
+  e.g., `HEADER`, `METHOD` or `BODY`.
+  See [docs](http://docs.aws.amazon.com/waf/latest/APIReference/API_FieldToMatch.html)
+  for all supported values.
+
+## Remarks
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the WAF SQL Injection Match Set.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AWS WAF SQL Injection Match Set using their ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import AWS WAF SQL Injection Match Set using their ID. For example:
+
+```console
+% terraform import aws_waf_sql_injection_match_set.example a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
+```
+
+<!-- cache-key: cdktf-0.18.0 input-a47ebe8da0dc48ddfdde164b586f5f77d04e0387919e7dfd6d04e602fd7caae2 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/waf_web_acl.html.markdown b/website/docs/cdktf/python/r/waf_web_acl.html.markdown
new file mode 100644
index 00000000000..b3eda86d38c
--- /dev/null
+++ b/website/docs/cdktf/python/r/waf_web_acl.html.markdown
@@ -0,0 +1,178 @@
+---
+subcategory: "WAF Classic"
+layout: "aws"
+page_title: "AWS: aws_waf_web_acl"
+description: |-
+  Provides a AWS WAF web access control group (ACL) resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_waf_web_acl
+
+Provides a WAF Web ACL Resource
+
+## Example Usage
+
+This example blocks requests coming from `192.0.7.0/24` and allows everything else.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.waf_ipset import WafIpset
+from imports.aws.waf_rule import WafRule
+from imports.aws.waf_web_acl import WafWebAcl
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ipset = WafIpset(self, "ipset",
+            ip_set_descriptors=[WafIpsetIpSetDescriptors(
+                type="IPV4",
+                value="192.0.7.0/24"
+            )
+            ],
+            name="tfIPSet"
+        )
+        wafrule = WafRule(self, "wafrule",
+            depends_on=[ipset],
+            metric_name="tfWAFRule",
+            name="tfWAFRule",
+            predicates=[WafRulePredicates(
+                data_id=ipset.id,
+                negated=False,
+                type="IPMatch"
+            )
+            ]
+        )
+        WafWebAcl(self, "waf_acl",
+            default_action=WafWebAclDefaultAction(
+                type="ALLOW"
+            ),
+            depends_on=[ipset, wafrule],
+            metric_name="tfWebACL",
+            name="tfWebACL",
+            rules=[WafWebAclRules(
+                action=WafWebAclRulesAction(
+                    type="BLOCK"
+                ),
+                priority=1,
+                rule_id=wafrule.id,
+                type="REGULAR"
+            )
+            ]
+        )
+```
+
+### Logging
+
+~> *NOTE:* The Kinesis Firehose Delivery Stream name must begin with `aws-waf-logs-` and be located in `us-east-1` region. See the [AWS WAF Developer Guide](https://docs.aws.amazon.com/waf/latest/developerguide/logging.html) for more information about enabling WAF logging.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.waf_web_acl import WafWebAcl
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, defaultAction, metricName, name):
+        super().__init__(scope, name)
+        WafWebAcl(self, "example",
+            logging_configuration=WafWebAclLoggingConfiguration(
+                log_destination=Token.as_string(aws_kinesis_firehose_delivery_stream_example.arn),
+                redacted_fields=WafWebAclLoggingConfigurationRedactedFields(
+                    field_to_match=[WafWebAclLoggingConfigurationRedactedFieldsFieldToMatch(
+                        type="URI"
+                    ), WafWebAclLoggingConfigurationRedactedFieldsFieldToMatch(
+                        data="referer",
+                        type="HEADER"
+                    )
+                    ]
+                )
+            ),
+            default_action=default_action,
+            metric_name=metric_name,
+            name=name
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `default_action` - (Required) Configuration block with action that you want AWS WAF to take when a request doesn't match the criteria in any of the rules that are associated with the web ACL. Detailed below.
+* `metric_name` - (Required) The name or description for the Amazon CloudWatch metric of this web ACL.
+* `name` - (Required) The name or description of the web ACL.
+* `rules` - (Optional) Configuration blocks containing rules to associate with the web ACL and the settings for each rule. Detailed below.
+* `logging_configuration` - (Optional) Configuration block to enable WAF logging. Detailed below.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### `default_action` Configuration Block
+
+* `type` - (Required) Specifies how you want AWS WAF to respond to requests that don't match the criteria in any of the `rules`.
+  e.g., `ALLOW` or `BLOCK`
+
+### `logging_configuration` Configuration Block
+
+* `log_destination` - (Required) Amazon Resource Name (ARN) of Kinesis Firehose Delivery Stream
+* `redacted_fields` - (Optional) Configuration block containing parts of the request that you want redacted from the logs. Detailed below.
+
+#### `redacted_fields` Configuration Block
+
+* `field_to_match` - (Required) Set of configuration blocks for fields to redact. Detailed below.
+
+##### `field_to_match` Configuration Block
+
+-> Additional information about this configuration can be found in the [AWS WAF Regional API Reference](https://docs.aws.amazon.com/waf/latest/APIReference/API_regional_FieldToMatch.html).
+
+* `data` - (Optional) When the value of `type` is `HEADER`, enter the name of the header that you want the WAF to search, for example, `User-Agent` or `Referer`. If the value of `type` is any other value, omit `data`.
+* `type` - (Required) The part of the web request that you want AWS WAF to search for a specified stringE.g., `HEADER` or `METHOD`
+
+### `rules` Configuration Block
+
+See [docs](http://docs.aws.amazon.com/waf/latest/APIReference/API_ActivatedRule.html) for all details and supported values.
+
+* `action` - (Optional) The action that CloudFront or AWS WAF takes when a web request matches the conditions in the rule. Not used if `type` is `GROUP`.
+    * `type` - (Required) valid values are: `BLOCK`, `ALLOW`, or `COUNT`
+* `override_action` - (Optional) Override the action that a group requests CloudFront or AWS WAF takes when a web request matches the conditions in the rule. Only used if `type` is `GROUP`.
+    * `type` - (Required) valid values are: `NONE` or `COUNT`
+* `priority` - (Required) Specifies the order in which the rules in a WebACL are evaluated.
+  Rules with a lower value are evaluated before rules with a higher value.
+* `rule_id` - (Required) ID of the associated WAF (Global) rule (e.g., [`aws_waf_rule`](/docs/providers/aws/r/waf_rule.html)). WAF (Regional) rules cannot be used.
+* `type` - (Optional) The rule type, either `REGULAR`, as defined by [Rule](http://docs.aws.amazon.com/waf/latest/APIReference/API_Rule.html), `RATE_BASED`, as defined by [RateBasedRule](http://docs.aws.amazon.com/waf/latest/APIReference/API_RateBasedRule.html), or `GROUP`, as defined by [RuleGroup](https://docs.aws.amazon.com/waf/latest/APIReference/API_RuleGroup.html). The default is REGULAR. If you add a RATE_BASED rule, you need to set `type` as `RATE_BASED`. If you add a GROUP rule, you need to set `type` as `GROUP`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the WAF WebACL.
+* `arn` - The ARN of the WAF WebACL.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WAF Web ACL using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import WAF Web ACL using the `id`. For example:
+
+```console
+% terraform import aws_waf_web_acl.main 0c8e583e-18f3-4c13-9e2a-67c4805d2f94
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ef78a6170a502ab8d3c2771bf4b7f7c113cf688e0a9d2aa577e013e90b14709a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/waf_xss_match_set.html.markdown b/website/docs/cdktf/python/r/waf_xss_match_set.html.markdown
new file mode 100644
index 00000000000..d8cbab4d01e
--- /dev/null
+++ b/website/docs/cdktf/python/r/waf_xss_match_set.html.markdown
@@ -0,0 +1,103 @@
+---
+subcategory: "WAF Classic"
+layout: "aws"
+page_title: "AWS: aws_waf_xss_match_set"
+description: |-
+  Provides a AWS WAF XssMatchSet resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_waf_xss_match_set
+
+Provides a WAF XSS Match Set Resource
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.waf_xss_match_set import WafXssMatchSet
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        WafXssMatchSet(self, "xss_match_set",
+            name="xss_match_set",
+            xss_match_tuples=[WafXssMatchSetXssMatchTuples(
+                field_to_match=WafXssMatchSetXssMatchTuplesFieldToMatch(
+                    type="URI"
+                ),
+                text_transformation="NONE"
+            ), WafXssMatchSetXssMatchTuples(
+                field_to_match=WafXssMatchSetXssMatchTuplesFieldToMatch(
+                    type="QUERY_STRING"
+                ),
+                text_transformation="NONE"
+            )
+            ]
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name or description of the SizeConstraintSet.
+* `xss_match_tuples` - (Optional) The parts of web requests that you want to inspect for cross-site scripting attacks.
+
+## Nested Blocks
+
+### `xss_match_tuples`
+
+* `field_to_match` - (Required) Specifies where in a web request to look for cross-site scripting attacks.
+* `text_transformation` - (Required) Text transformations used to eliminate unusual formatting that attackers use in web requests in an effort to bypass AWS WAF.
+  If you specify a transformation, AWS WAF performs the transformation on `target_string` before inspecting a request for a match.
+  e.g., `CMD_LINE`, `HTML_ENTITY_DECODE` or `NONE`.
+  See [docs](http://docs.aws.amazon.com/waf/latest/APIReference/API_XssMatchTuple.html#WAF-Type-XssMatchTuple-TextTransformation)
+  for all supported values.
+
+### `field_to_match`
+
+#### Arguments
+
+* `data` - (Optional) When `type` is `HEADER`, enter the name of the header that you want to search, e.g., `User-Agent` or `Referer`.
+  If `type` is any other value, omit this field.
+* `type` - (Required) The part of the web request that you want AWS WAF to search for a specified string.
+  e.g., `HEADER`, `METHOD` or `BODY`.
+  See [docs](http://docs.aws.amazon.com/waf/latest/APIReference/API_FieldToMatch.html)
+  for all supported values.
+
+## Remarks
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the WAF XssMatchSet.
+* `arn` - Amazon Resource Name (ARN)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WAF XSS Match Set using their ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import WAF XSS Match Set using their ID. For example:
+
+```console
+% terraform import aws_waf_xss_match_set.example a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
+```
+
+<!-- cache-key: cdktf-0.18.0 input-b20024f44c940ead290498f06ec9b2d740a6fb68cd9745d06916f73db65eaaa6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/wafregional_byte_match_set.html.markdown b/website/docs/cdktf/python/r/wafregional_byte_match_set.html.markdown
new file mode 100644
index 00000000000..a42513bb537
--- /dev/null
+++ b/website/docs/cdktf/python/r/wafregional_byte_match_set.html.markdown
@@ -0,0 +1,90 @@
+---
+subcategory: "WAF Classic Regional"
+layout: "aws"
+page_title: "AWS: aws_wafregional_byte_match_set"
+description: |-
+  Provides a AWS WAF Regional ByteMatchSet resource for use with ALB.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_wafregional_byte_match_set
+
+Provides a WAF Regional Byte Match Set Resource for use with Application Load Balancer.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.wafregional_byte_match_set import WafregionalByteMatchSet
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        WafregionalByteMatchSet(self, "byte_set",
+            byte_match_tuples=[WafregionalByteMatchSetByteMatchTuples(
+                field_to_match=WafregionalByteMatchSetByteMatchTuplesFieldToMatch(
+                    data="referer",
+                    type="HEADER"
+                ),
+                positional_constraint="CONTAINS",
+                target_string="badrefer1",
+                text_transformation="NONE"
+            )
+            ],
+            name="tf_waf_byte_match_set"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name or description of the ByteMatchSet.
+* `byte_match_tuples` - (Optional)Settings for the ByteMatchSet, such as the bytes (typically a string that corresponds with ASCII characters) that you want AWS WAF to search for in web requests. ByteMatchTuple documented below.
+
+ByteMatchTuples(byte_match_tuples) support the following:
+
+* `field_to_match` - (Required) Settings for the ByteMatchTuple. FieldToMatch documented below.
+* `positional_constraint` - (Required) Within the portion of a web request that you want to search.
+* `target_string` - (Required) The value that you want AWS WAF to search for. The maximum length of the value is 50 bytes.
+* `text_transformation` - (Required) The formatting way for web request.
+
+FieldToMatch(field_to_match) support following:
+
+* `data` - (Optional) When the value of Type is HEADER, enter the name of the header that you want AWS WAF to search, for example, User-Agent or Referer. If the value of Type is any other value, omit Data.
+* `type` - (Required) The part of the web request that you want AWS WAF to search for a specified string.
+
+## Remarks
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the WAF ByteMatchSet.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WAF Regional Byte Match Set using the id. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import WAF Regional Byte Match Set using the id. For example:
+
+```console
+% terraform import aws_wafregional_byte_match_set.byte_set a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
+```
+
+<!-- cache-key: cdktf-0.18.0 input-d354d98336a367dcda2900aef5df37bc2a4674f135a53bf8117fd2307be17d3e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/wafregional_geo_match_set.html.markdown b/website/docs/cdktf/python/r/wafregional_geo_match_set.html.markdown
new file mode 100644
index 00000000000..dc405c526c0
--- /dev/null
+++ b/website/docs/cdktf/python/r/wafregional_geo_match_set.html.markdown
@@ -0,0 +1,85 @@
+---
+subcategory: "WAF Classic Regional"
+layout: "aws"
+page_title: "AWS: aws_wafregional_geo_match_set"
+description: |-
+  Provides a AWS WAF Regional Geo Match Set resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_wafregional_geo_match_set
+
+Provides a WAF Regional Geo Match Set Resource
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.wafregional_geo_match_set import WafregionalGeoMatchSet
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        WafregionalGeoMatchSet(self, "geo_match_set",
+            geo_match_constraint=[WafregionalGeoMatchSetGeoMatchConstraint(
+                type="Country",
+                value="US"
+            ), WafregionalGeoMatchSetGeoMatchConstraint(
+                type="Country",
+                value="CA"
+            )
+            ],
+            name="geo_match_set"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name or description of the Geo Match Set.
+* `geo_match_constraint` - (Optional) The Geo Match Constraint objects which contain the country that you want AWS WAF to search for.
+
+## Nested Blocks
+
+### `geo_match_constraint`
+
+#### Arguments
+
+* `type` - (Required) The type of geographical area you want AWS WAF to search for. Currently Country is the only valid value.
+* `value` - (Required) The country that you want AWS WAF to search for.
+  This is the two-letter country code, e.g., `US`, `CA`, `RU`, `CN`, etc.
+  See [docs](https://docs.aws.amazon.com/waf/latest/APIReference/API_GeoMatchConstraint.html) for all supported values.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the WAF Regional Geo Match Set.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WAF Regional Geo Match Set using the id. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import WAF Regional Geo Match Set using the id. For example:
+
+```console
+% terraform import aws_wafregional_geo_match_set.geo_match_set a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
+```
+
+<!-- cache-key: cdktf-0.18.0 input-076708092d61d2d1e6c278cff3a1595b6f32efbba2e3ac89150e24303f965c61 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/wafregional_ipset.html.markdown b/website/docs/cdktf/python/r/wafregional_ipset.html.markdown
new file mode 100644
index 00000000000..359314ace9d
--- /dev/null
+++ b/website/docs/cdktf/python/r/wafregional_ipset.html.markdown
@@ -0,0 +1,86 @@
+---
+subcategory: "WAF Classic Regional"
+layout: "aws"
+page_title: "AWS: aws_wafregional_ipset"
+description: |-
+  Provides a AWS WAF Regional IPSet resource for use with ALB.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_wafregional_ipset
+
+Provides a WAF Regional IPSet Resource for use with Application Load Balancer.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.wafregional_ipset import WafregionalIpset
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        WafregionalIpset(self, "ipset",
+            ip_set_descriptor=[WafregionalIpsetIpSetDescriptor(
+                type="IPV4",
+                value="192.0.7.0/24"
+            ), WafregionalIpsetIpSetDescriptor(
+                type="IPV4",
+                value="10.16.16.0/16"
+            )
+            ],
+            name="tfIPSet"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name or description of the IPSet.
+* `ip_set_descriptor` - (Optional) One or more pairs specifying the IP address type (IPV4 or IPV6) and the IP address range (in CIDR notation) from which web requests originate.
+
+## Nested Blocks
+
+### `ip_set_descriptor`
+
+#### Arguments
+
+* `type` - (Required) The string like IPV4 or IPV6.
+* `value` - (Required) The CIDR notation.
+
+## Remarks
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the WAF IPSet.
+* `arn` - The ARN of the WAF IPSet.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WAF Regional IPSets using their ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import WAF Regional IPSets using their ID. For example:
+
+```console
+% terraform import aws_wafregional_ipset.example a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
+```
+
+<!-- cache-key: cdktf-0.18.0 input-bd423cc7eae4bc7869d7e7f89697634be360c63540ee5c25595e89016d52dd6a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/wafregional_rate_based_rule.html.markdown b/website/docs/cdktf/python/r/wafregional_rate_based_rule.html.markdown
new file mode 100644
index 00000000000..70f1b9422ae
--- /dev/null
+++ b/website/docs/cdktf/python/r/wafregional_rate_based_rule.html.markdown
@@ -0,0 +1,106 @@
+---
+subcategory: "WAF Classic Regional"
+layout: "aws"
+page_title: "AWS: aws_wafregional_rate_based_rule"
+description: |-
+  Provides a AWS WAF Regional rate based rule resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_wafregional_rate_based_rule
+
+Provides a WAF Rate Based Rule Resource
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.wafregional_ipset import WafregionalIpset
+from imports.aws.wafregional_rate_based_rule import WafregionalRateBasedRule
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ipset = WafregionalIpset(self, "ipset",
+            ip_set_descriptor=[WafregionalIpsetIpSetDescriptor(
+                type="IPV4",
+                value="192.0.7.0/24"
+            )
+            ],
+            name="tfIPSet"
+        )
+        WafregionalRateBasedRule(self, "wafrule",
+            depends_on=[ipset],
+            metric_name="tfWAFRule",
+            name="tfWAFRule",
+            predicate=[WafregionalRateBasedRulePredicate(
+                data_id=ipset.id,
+                negated=False,
+                type="IPMatch"
+            )
+            ],
+            rate_key="IP",
+            rate_limit=100
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `metric_name` - (Required) The name or description for the Amazon CloudWatch metric of this rule.
+* `name` - (Required) The name or description of the rule.
+* `rate_key` - (Required) Valid value is IP.
+* `rate_limit` - (Required) The maximum number of requests, which have an identical value in the field specified by the RateKey, allowed in a five-minute period. Minimum value is 100.
+* `predicate` - (Optional) The objects to include in a rule (documented below).
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Nested Blocks
+
+### `predicate`
+
+See the [WAF Documentation](https://docs.aws.amazon.com/waf/latest/APIReference/API_Predicate.html) for more information.
+
+#### Arguments
+
+* `negated` - (Required) Set this to `false` if you want to allow, block, or count requests
+  based on the settings in the specified `ByteMatchSet`, `IPSet`, `SqlInjectionMatchSet`, `XssMatchSet`, or `SizeConstraintSet`.
+  For example, if an IPSet includes the IP address `192.0.2.44`, AWS WAF will allow or block requests based on that IP address.
+  If set to `true`, AWS WAF will allow, block, or count requests based on all IP addresses _except_ `192.0.2.44`.
+* `data_id` - (Required) A unique identifier for a predicate in the rule, such as Byte Match Set ID or IPSet ID.
+* `type` - (Required) The type of predicate in a rule. Valid values: `ByteMatch`, `GeoMatch`, `IPMatch`, `RegexMatch`, `SizeConstraint`, `SqlInjectionMatch`, or `XssMatch`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the WAF Regional Rate Based Rule.
+* `arn` - The ARN of the WAF Regional Rate Based Rule.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WAF Regional Rate Based Rule using the id. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import WAF Regional Rate Based Rule using the id. For example:
+
+```console
+% terraform import aws_wafregional_rate_based_rule.wafrule a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
+```
+
+<!-- cache-key: cdktf-0.18.0 input-c9528cd637559b06111f0a86770cfd3352bea18039b8f306e153eeb9fb06d57f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/wafregional_regex_match_set.html.markdown b/website/docs/cdktf/python/r/wafregional_regex_match_set.html.markdown
new file mode 100644
index 00000000000..10bf344f817
--- /dev/null
+++ b/website/docs/cdktf/python/r/wafregional_regex_match_set.html.markdown
@@ -0,0 +1,102 @@
+---
+subcategory: "WAF Classic Regional"
+layout: "aws"
+page_title: "AWS: aws_wafregional_regex_match_set"
+description: |-
+  Provides a AWS WAF Regional Regex Match Set resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_wafregional_regex_match_set
+
+Provides a WAF Regional Regex Match Set Resource
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.wafregional_regex_match_set import WafregionalRegexMatchSet
+from imports.aws.wafregional_regex_pattern_set import WafregionalRegexPatternSet
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = WafregionalRegexPatternSet(self, "example",
+            name="example",
+            regex_pattern_strings=["one", "two"]
+        )
+        aws_wafregional_regex_match_set_example = WafregionalRegexMatchSet(self, "example_1",
+            name="example",
+            regex_match_tuple=[WafregionalRegexMatchSetRegexMatchTuple(
+                field_to_match=WafregionalRegexMatchSetRegexMatchTupleFieldToMatch(
+                    data="User-Agent",
+                    type="HEADER"
+                ),
+                regex_pattern_set_id=example.id,
+                text_transformation="NONE"
+            )
+            ]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_wafregional_regex_match_set_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name or description of the Regex Match Set.
+* `regex_match_tuple` - (Required) The regular expression pattern that you want AWS WAF to search for in web requests, the location in requests that you want AWS WAF to search, and other settings. See below.
+
+### Nested Arguments
+
+#### `regex_match_tuple`
+
+* `field_to_match` - (Required) The part of a web request that you want to search, such as a specified header or a query string.
+* `regex_pattern_set_id` - (Required) The ID of a [Regex Pattern Set](/docs/providers/aws/r/waf_regex_pattern_set.html).
+* `text_transformation` - (Required) Text transformations used to eliminate unusual formatting that attackers use in web requests in an effort to bypass AWS WAF.
+  e.g., `CMD_LINE`, `HTML_ENTITY_DECODE` or `NONE`.
+  See [docs](http://docs.aws.amazon.com/waf/latest/APIReference/API_ByteMatchTuple.html#WAF-Type-ByteMatchTuple-TextTransformation)
+  for all supported values.
+
+#### `field_to_match`
+
+* `data` - (Optional) When `type` is `HEADER`, enter the name of the header that you want to search, e.g., `User-Agent` or `Referer`.
+  If `type` is any other value, omit this field.
+* `type` - (Required) The part of the web request that you want AWS WAF to search for a specified string.
+  e.g., `HEADER`, `METHOD` or `BODY`.
+  See [docs](http://docs.aws.amazon.com/waf/latest/APIReference/API_FieldToMatch.html)
+  for all supported values.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the WAF Regional Regex Match Set.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WAF Regional Regex Match Set using the id. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import WAF Regional Regex Match Set using the id. For example:
+
+```console
+% terraform import aws_wafregional_regex_match_set.example a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
+```
+
+<!-- cache-key: cdktf-0.18.0 input-280a1a139f7548e59dbaac6d77fc6dec1f0577b42b89b3bfe2b5a8ac5c257759 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/wafregional_regex_pattern_set.html.markdown b/website/docs/cdktf/python/r/wafregional_regex_pattern_set.html.markdown
new file mode 100644
index 00000000000..edfc6286ea1
--- /dev/null
+++ b/website/docs/cdktf/python/r/wafregional_regex_pattern_set.html.markdown
@@ -0,0 +1,67 @@
+---
+subcategory: "WAF Classic Regional"
+layout: "aws"
+page_title: "AWS: aws_wafregional_regex_pattern_set"
+description: |-
+  Provides a AWS WAF Regional Regex Pattern Set resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_wafregional_regex_pattern_set
+
+Provides a WAF Regional Regex Pattern Set Resource
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.wafregional_regex_pattern_set import WafregionalRegexPatternSet
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        WafregionalRegexPatternSet(self, "example",
+            name="example",
+            regex_pattern_strings=["one", "two"]
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name or description of the Regex Pattern Set.
+* `regex_pattern_strings` - (Optional) A list of regular expression (regex) patterns that you want AWS WAF to search for, such as `B[a@]dB[o0]t`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the WAF Regional Regex Pattern Set.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WAF Regional Regex Pattern Set using the id. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import WAF Regional Regex Pattern Set using the id. For example:
+
+```console
+% terraform import aws_wafregional_regex_pattern_set.example a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
+```
+
+<!-- cache-key: cdktf-0.18.0 input-cff1466a5daff624aa9ded6cc255388e5ab53f5a98b6e49b1cd55ad6eb538fca -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/wafregional_rule.html.markdown b/website/docs/cdktf/python/r/wafregional_rule.html.markdown
new file mode 100644
index 00000000000..fc1a07bf4ee
--- /dev/null
+++ b/website/docs/cdktf/python/r/wafregional_rule.html.markdown
@@ -0,0 +1,100 @@
+---
+subcategory: "WAF Classic Regional"
+layout: "aws"
+page_title: "AWS: aws_wafregional_rule"
+description: |-
+  Provides an AWS WAF Regional rule resource for use with ALB.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_wafregional_rule
+
+Provides an WAF Regional Rule Resource for use with Application Load Balancer.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.wafregional_ipset import WafregionalIpset
+from imports.aws.wafregional_rule import WafregionalRule
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ipset = WafregionalIpset(self, "ipset",
+            ip_set_descriptor=[WafregionalIpsetIpSetDescriptor(
+                type="IPV4",
+                value="192.0.7.0/24"
+            )
+            ],
+            name="tfIPSet"
+        )
+        WafregionalRule(self, "wafrule",
+            metric_name="tfWAFRule",
+            name="tfWAFRule",
+            predicate=[WafregionalRulePredicate(
+                data_id=ipset.id,
+                negated=False,
+                type="IPMatch"
+            )
+            ]
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name or description of the rule.
+* `metric_name` - (Required) The name or description for the Amazon CloudWatch metric of this rule.
+* `predicate` - (Optional) The objects to include in a rule (documented below).
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Nested Fields
+
+### `predicate`
+
+See the [WAF Documentation](https://docs.aws.amazon.com/waf/latest/APIReference/API_Predicate.html) for more information.
+
+#### Arguments
+
+* `type` - (Required) The type of predicate in a rule. Valid values: `ByteMatch`, `GeoMatch`, `IPMatch`, `RegexMatch`, `SizeConstraint`, `SqlInjectionMatch`, or `XssMatch`
+* `data_id` - (Required) The unique identifier of a predicate, such as the ID of a `ByteMatchSet` or `IPSet`.
+* `negated` - (Required) Whether to use the settings or the negated settings that you specified in the objects.
+
+## Remarks
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the WAF Regional Rule.
+* `arn` - The ARN of the WAF Regional Rule.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WAF Regional Rule using the id. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import WAF Regional Rule using the id. For example:
+
+```console
+% terraform import aws_wafregional_rule.wafrule a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
+```
+
+<!-- cache-key: cdktf-0.18.0 input-a40cdd272300595e743e666f37c7f58fb8e82cbebd3677921ecf317be3ff42df -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/wafregional_rule_group.html.markdown b/website/docs/cdktf/python/r/wafregional_rule_group.html.markdown
new file mode 100644
index 00000000000..4b59fed490f
--- /dev/null
+++ b/website/docs/cdktf/python/r/wafregional_rule_group.html.markdown
@@ -0,0 +1,98 @@
+---
+subcategory: "WAF Classic Regional"
+layout: "aws"
+page_title: "AWS: aws_wafregional_rule_group"
+description: |-
+  Provides a AWS WAF Regional Rule Group resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_wafregional_rule_group
+
+Provides a WAF Regional Rule Group Resource
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.wafregional_rule import WafregionalRule
+from imports.aws.wafregional_rule_group import WafregionalRuleGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = WafregionalRule(self, "example",
+            metric_name="example",
+            name="example"
+        )
+        aws_wafregional_rule_group_example = WafregionalRuleGroup(self, "example_1",
+            activated_rule=[WafregionalRuleGroupActivatedRule(
+                action=WafregionalRuleGroupActivatedRuleAction(
+                    type="COUNT"
+                ),
+                priority=50,
+                rule_id=example.id
+            )
+            ],
+            metric_name="example",
+            name="example"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_wafregional_rule_group_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) A friendly name of the rule group
+* `metric_name` - (Required) A friendly name for the metrics from the rule group
+* `activated_rule` - (Optional) A list of activated rules, see below
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Nested Blocks
+
+### `activated_rule`
+
+#### Arguments
+
+* `action` - (Required) Specifies the action that CloudFront or AWS WAF takes when a web request matches the conditions in the rule.
+    * `type` - (Required) e.g., `BLOCK`, `ALLOW`, or `COUNT`
+* `priority` - (Required) Specifies the order in which the rules are evaluated. Rules with a lower value are evaluated before rules with a higher value.
+* `rule_id` - (Required) The ID of a [rule](/docs/providers/aws/r/wafregional_rule.html)
+* `type` - (Optional) The rule type, either [`REGULAR`](/docs/providers/aws/r/wafregional_rule.html), [`RATE_BASED`](/docs/providers/aws/r/wafregional_rate_based_rule.html), or `GROUP`. Defaults to `REGULAR`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the WAF Regional Rule Group.
+* `arn` - The ARN of the WAF Regional Rule Group.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WAF Regional Rule Group using the id. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import WAF Regional Rule Group using the id. For example:
+
+```console
+% terraform import aws_wafregional_rule_group.example a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
+```
+
+<!-- cache-key: cdktf-0.18.0 input-2935ebb79c393d1d70c3018dc3927bc8f00af67f128cb5a4088d52b0c5dc4769 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/wafregional_size_constraint_set.html.markdown b/website/docs/cdktf/python/r/wafregional_size_constraint_set.html.markdown
new file mode 100644
index 00000000000..919648476ba
--- /dev/null
+++ b/website/docs/cdktf/python/r/wafregional_size_constraint_set.html.markdown
@@ -0,0 +1,105 @@
+---
+subcategory: "WAF Classic Regional"
+layout: "aws"
+page_title: "AWS: aws_wafregional_size_constraint_set"
+description: |-
+  Provides an AWS WAF Regional Size Constraint Set resource for use with ALB.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_wafregional_size_constraint_set
+
+Provides a WAF Regional Size Constraint Set Resource for use with Application Load Balancer.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.wafregional_size_constraint_set import WafregionalSizeConstraintSet
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        WafregionalSizeConstraintSet(self, "size_constraint_set",
+            name="tfsize_constraints",
+            size_constraints=[WafregionalSizeConstraintSetSizeConstraints(
+                comparison_operator="EQ",
+                field_to_match=WafregionalSizeConstraintSetSizeConstraintsFieldToMatch(
+                    type="BODY"
+                ),
+                size=Token.as_number("4096"),
+                text_transformation="NONE"
+            )
+            ]
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name or description of the Size Constraint Set.
+* `size_constraints` - (Optional) Specifies the parts of web requests that you want to inspect the size of.
+
+## Nested Blocks
+
+### `size_constraints`
+
+#### Arguments
+
+* `field_to_match` - (Required) Specifies where in a web request to look for the size constraint.
+* `comparison_operator` - (Required) The type of comparison you want to perform.
+  e.g., `EQ`, `NE`, `LT`, `GT`.
+  See [docs](https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_SizeConstraint.html) for all supported values.
+* `size` - (Required) The size in bytes that you want to compare against the size of the specified `field_to_match`.
+  Valid values are between 0 - 21474836480 bytes (0 - 20 GB).
+* `text_transformation` - (Required) Text transformations used to eliminate unusual formatting that attackers use in web requests in an effort to bypass AWS WAF.
+  If you specify a transformation, AWS WAF performs the transformation on `field_to_match` before inspecting a request for a match.
+  e.g., `CMD_LINE`, `HTML_ENTITY_DECODE` or `NONE`.
+  See [docs](http://docs.aws.amazon.com/waf/latest/APIReference/API_SizeConstraint.html#WAF-Type-SizeConstraint-TextTransformation)
+  for all supported values.
+  **Note:** if you choose `BODY` as `type`, you must choose `NONE` because CloudFront forwards only the first 8192 bytes for inspection.
+
+### `field_to_match`
+
+#### Arguments
+
+* `data` - (Optional) When `type` is `HEADER`, enter the name of the header that you want to search, e.g., `User-Agent` or `Referer`.
+  If `type` is any other value, omit this field.
+* `type` - (Required) The part of the web request that you want AWS WAF to search for a specified string.
+  e.g., `HEADER`, `METHOD` or `BODY`.
+  See [docs](http://docs.aws.amazon.com/waf/latest/APIReference/API_FieldToMatch.html)
+  for all supported values.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the WAF Size Constraint Set.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WAF Size Constraint Set using the id. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import WAF Size Constraint Set using the id. For example:
+
+```console
+% terraform import aws_wafregional_size_constraint_set.size_constraint_set a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
+```
+
+<!-- cache-key: cdktf-0.18.0 input-64d9f0d82b2b891198f8ccc4cee325bd0e4f4efb84239342a4238efc9f6b5a0e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/wafregional_sql_injection_match_set.html.markdown b/website/docs/cdktf/python/r/wafregional_sql_injection_match_set.html.markdown
new file mode 100644
index 00000000000..3ac69c7522a
--- /dev/null
+++ b/website/docs/cdktf/python/r/wafregional_sql_injection_match_set.html.markdown
@@ -0,0 +1,93 @@
+---
+subcategory: "WAF Classic Regional"
+layout: "aws"
+page_title: "AWS: aws_wafregional_sql_injection_match_set"
+description: |-
+  Provides a AWS WAF Regional SqlInjectionMatchSet resource for use with ALB.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_wafregional_sql_injection_match_set
+
+Provides a WAF Regional SQL Injection Match Set Resource for use with Application Load Balancer.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.wafregional_sql_injection_match_set import WafregionalSqlInjectionMatchSet
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        WafregionalSqlInjectionMatchSet(self, "sql_injection_match_set",
+            name="tf-sql_injection_match_set",
+            sql_injection_match_tuple=[WafregionalSqlInjectionMatchSetSqlInjectionMatchTuple(
+                field_to_match=WafregionalSqlInjectionMatchSetSqlInjectionMatchTupleFieldToMatch(
+                    type="QUERY_STRING"
+                ),
+                text_transformation="URL_DECODE"
+            )
+            ]
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name or description of the SizeConstraintSet.
+* `sql_injection_match_tuple` - (Optional) The parts of web requests that you want AWS WAF to inspect for malicious SQL code and, if you want AWS WAF to inspect a header, the name of the header.
+
+### Nested fields
+
+### `sql_injection_match_tuple`
+
+* `field_to_match` - (Required) Specifies where in a web request to look for snippets of malicious SQL code.
+* `text_transformation` - (Required) Text transformations used to eliminate unusual formatting that attackers use in web requests in an effort to bypass AWS WAF.
+  If you specify a transformation, AWS WAF performs the transformation on `field_to_match` before inspecting a request for a match.
+  e.g., `CMD_LINE`, `HTML_ENTITY_DECODE` or `NONE`.
+  See [docs](https://docs.aws.amazon.com/waf/latest/APIReference/API_regional_SqlInjectionMatchTuple.html#WAF-Type-regional_SqlInjectionMatchTuple-TextTransformation)
+  for all supported values.
+
+### `field_to_match`
+
+* `data` - (Optional) When `type` is `HEADER`, enter the name of the header that you want to search, e.g., `User-Agent` or `Referer`.
+  If `type` is any other value, omit this field.
+* `type` - (Required) The part of the web request that you want AWS WAF to search for a specified string.
+  e.g., `HEADER`, `METHOD` or `BODY`.
+  See [docs](https://docs.aws.amazon.com/waf/latest/APIReference/API_regional_FieldToMatch.html)
+  for all supported values.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the WAF SqlInjectionMatchSet.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WAF Regional Sql Injection Match Set using the id. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import WAF Regional Sql Injection Match Set using the id. For example:
+
+```console
+% terraform import aws_wafregional_sql_injection_match_set.sql_injection_match_set a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
+```
+
+<!-- cache-key: cdktf-0.18.0 input-adfcd685dca95982844290477cadf9fa51737f4a170db60101e185299508456a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/wafregional_web_acl.html.markdown b/website/docs/cdktf/python/r/wafregional_web_acl.html.markdown
new file mode 100644
index 00000000000..1dedfd1acd1
--- /dev/null
+++ b/website/docs/cdktf/python/r/wafregional_web_acl.html.markdown
@@ -0,0 +1,209 @@
+---
+subcategory: "WAF Classic Regional"
+layout: "aws"
+page_title: "AWS: aws_wafregional_web_acl"
+description: |-
+  Provides a AWS WAF Regional web access control group (ACL) resource for use with ALB.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_wafregional_web_acl
+
+Provides a WAF Regional Web ACL Resource for use with Application Load Balancer.
+
+## Example Usage
+
+### Regular Rule
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.wafregional_ipset import WafregionalIpset
+from imports.aws.wafregional_rule import WafregionalRule
+from imports.aws.wafregional_web_acl import WafregionalWebAcl
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        ipset = WafregionalIpset(self, "ipset",
+            ip_set_descriptor=[WafregionalIpsetIpSetDescriptor(
+                type="IPV4",
+                value="192.0.7.0/24"
+            )
+            ],
+            name="tfIPSet"
+        )
+        wafrule = WafregionalRule(self, "wafrule",
+            metric_name="tfWAFRule",
+            name="tfWAFRule",
+            predicate=[WafregionalRulePredicate(
+                data_id=ipset.id,
+                negated=False,
+                type="IPMatch"
+            )
+            ]
+        )
+        WafregionalWebAcl(self, "wafacl",
+            default_action=WafregionalWebAclDefaultAction(
+                type="ALLOW"
+            ),
+            metric_name="tfWebACL",
+            name="tfWebACL",
+            rule=[WafregionalWebAclRule(
+                action=WafregionalWebAclRuleAction(
+                    type="BLOCK"
+                ),
+                priority=1,
+                rule_id=wafrule.id,
+                type="REGULAR"
+            )
+            ]
+        )
+```
+
+### Group Rule
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.wafregional_web_acl import WafregionalWebAcl
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        WafregionalWebAcl(self, "example",
+            default_action=WafregionalWebAclDefaultAction(
+                type="ALLOW"
+            ),
+            metric_name="example",
+            name="example",
+            rule=[WafregionalWebAclRule(
+                override_action=WafregionalWebAclRuleOverrideAction(
+                    type="NONE"
+                ),
+                priority=1,
+                rule_id=Token.as_string(aws_wafregional_rule_group_example.id),
+                type="GROUP"
+            )
+            ]
+        )
+```
+
+### Logging
+
+~> *NOTE:* The Kinesis Firehose Delivery Stream name must begin with `aws-waf-logs-`. See the [AWS WAF Developer Guide](https://docs.aws.amazon.com/waf/latest/developerguide/logging.html) for more information about enabling WAF logging.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.wafregional_web_acl import WafregionalWebAcl
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name, *, defaultAction, metricName, name):
+        super().__init__(scope, name)
+        WafregionalWebAcl(self, "example",
+            logging_configuration=WafregionalWebAclLoggingConfiguration(
+                log_destination=Token.as_string(aws_kinesis_firehose_delivery_stream_example.arn),
+                redacted_fields=WafregionalWebAclLoggingConfigurationRedactedFields(
+                    field_to_match=[WafregionalWebAclLoggingConfigurationRedactedFieldsFieldToMatch(
+                        type="URI"
+                    ), WafregionalWebAclLoggingConfigurationRedactedFieldsFieldToMatch(
+                        data="referer",
+                        type="HEADER"
+                    )
+                    ]
+                )
+            ),
+            default_action=default_action,
+            metric_name=metric_name,
+            name=name
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `default_action` - (Required) The action that you want AWS WAF Regional to take when a request doesn't match the criteria in any of the rules that are associated with the web ACL.
+* `metric_name` - (Required) The name or description for the Amazon CloudWatch metric of this web ACL.
+* `name` - (Required) The name or description of the web ACL.
+* `logging_configuration` - (Optional) Configuration block to enable WAF logging. Detailed below.
+* `rule` - (Optional) Set of configuration blocks containing rules for the web ACL. Detailed below.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### `default_action` Configuration Block
+
+* `type` - (Required) Specifies how you want AWS WAF Regional to respond to requests that match the settings in a ruleE.g., `ALLOW`, `BLOCK` or `COUNT`
+
+### `logging_configuration` Configuration Block
+
+* `log_destination` - (Required) Amazon Resource Name (ARN) of Kinesis Firehose Delivery Stream
+* `redacted_fields` - (Optional) Configuration block containing parts of the request that you want redacted from the logs. Detailed below.
+
+#### `redacted_fields` Configuration Block
+
+* `field_to_match` - (Required) Set of configuration blocks for fields to redact. Detailed below.
+
+##### `field_to_match` Configuration Block
+
+-> Additional information about this configuration can be found in the [AWS WAF Regional API Reference](https://docs.aws.amazon.com/waf/latest/APIReference/API_regional_FieldToMatch.html).
+
+* `data` - (Optional) When the value of `type` is `HEADER`, enter the name of the header that you want the WAF to search, for example, `User-Agent` or `Referer`. If the value of `type` is any other value, omit `data`.
+* `type` - (Required) The part of the web request that you want AWS WAF to search for a specified stringE.g., `HEADER` or `METHOD`
+
+### `rule` Configuration Block
+
+-> Additional information about this configuration can be found in the [AWS WAF Regional API Reference](https://docs.aws.amazon.com/waf/latest/APIReference/API_regional_ActivatedRule.html).
+
+* `priority` - (Required) Specifies the order in which the rules in a WebACL are evaluated.
+  Rules with a lower value are evaluated before rules with a higher value.
+* `rule_id` - (Required) ID of the associated WAF (Regional) rule (e.g., [`aws_wafregional_rule`](/docs/providers/aws/r/wafregional_rule.html)). WAF (Global) rules cannot be used.
+* `action` - (Optional) Configuration block of the action that CloudFront or AWS WAF takes when a web request matches the conditions in the rule.  Not used if `type` is `GROUP`. Detailed below.
+* `override_action` - (Optional) Configuration block of the override the action that a group requests CloudFront or AWS WAF takes when a web request matches the conditions in the rule.  Only used if `type` is `GROUP`. Detailed below.
+* `type` - (Optional) The rule type, either `REGULAR`, as defined by [Rule](http://docs.aws.amazon.com/waf/latest/APIReference/API_Rule.html), `RATE_BASED`, as defined by [RateBasedRule](http://docs.aws.amazon.com/waf/latest/APIReference/API_RateBasedRule.html), or `GROUP`, as defined by [RuleGroup](https://docs.aws.amazon.com/waf/latest/APIReference/API_RuleGroup.html). The default is REGULAR. If you add a RATE_BASED rule, you need to set `type` as `RATE_BASED`. If you add a GROUP rule, you need to set `type` as `GROUP`.
+
+#### `action` / `override_action` Configuration Block
+
+* `type` - (Required) Specifies how you want AWS WAF Regional to respond to requests that match the settings in a rule. Valid values for `action` are `ALLOW`, `BLOCK` or `COUNT`. Valid values for `override_action` are `COUNT` and `NONE`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the WAF Regional WebACL.
+* `id` - The ID of the WAF Regional WebACL.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WAF Regional Web ACL using the id. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import WAF Regional Web ACL using the id. For example:
+
+```console
+% terraform import aws_wafregional_web_acl.wafacl a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
+```
+
+<!-- cache-key: cdktf-0.18.0 input-becb283a0bf3a66968d3b5835eb6a5ff193e490c6ee5cb1289a6144e0f32490f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/wafregional_web_acl_association.html.markdown b/website/docs/cdktf/python/r/wafregional_web_acl_association.html.markdown
new file mode 100644
index 00000000000..a844532cf6b
--- /dev/null
+++ b/website/docs/cdktf/python/r/wafregional_web_acl_association.html.markdown
@@ -0,0 +1,228 @@
+---
+subcategory: "WAF Classic Regional"
+layout: "aws"
+page_title: "AWS: aws_wafregional_web_acl_association"
+description: |-
+  Manages an association with WAF Regional Web ACL
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_wafregional_web_acl_association
+
+Manages an association with WAF Regional Web ACL.
+
+-> **Note:** An Application Load Balancer can only be associated with one WAF Regional WebACL.
+
+## Example Usage
+
+### Application Load Balancer Association
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, Fn, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.alb import Alb
+from imports.aws.data_aws_availability_zones import DataAwsAvailabilityZones
+from imports.aws.subnet import Subnet
+from imports.aws.vpc import Vpc
+from imports.aws.wafregional_ipset import WafregionalIpset
+from imports.aws.wafregional_rule import WafregionalRule
+from imports.aws.wafregional_web_acl import WafregionalWebAcl
+from imports.aws.wafregional_web_acl_association import WafregionalWebAclAssociation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        foo = Vpc(self, "foo",
+            cidr_block="10.1.0.0/16"
+        )
+        ipset = WafregionalIpset(self, "ipset",
+            ip_set_descriptor=[WafregionalIpsetIpSetDescriptor(
+                type="IPV4",
+                value="192.0.7.0/24"
+            )
+            ],
+            name="tfIPSet"
+        )
+        aws_wafregional_rule_foo = WafregionalRule(self, "foo_2",
+            metric_name="tfWAFRule",
+            name="tfWAFRule",
+            predicate=[WafregionalRulePredicate(
+                data_id=ipset.id,
+                negated=False,
+                type="IPMatch"
+            )
+            ]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_wafregional_rule_foo.override_logical_id("foo")
+        aws_wafregional_web_acl_foo = WafregionalWebAcl(self, "foo_3",
+            default_action=WafregionalWebAclDefaultAction(
+                type="ALLOW"
+            ),
+            metric_name="foo",
+            name="foo",
+            rule=[WafregionalWebAclRule(
+                action=WafregionalWebAclRuleAction(
+                    type="BLOCK"
+                ),
+                priority=1,
+                rule_id=Token.as_string(aws_wafregional_rule_foo.id)
+            )
+            ]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_wafregional_web_acl_foo.override_logical_id("foo")
+        available = DataAwsAvailabilityZones(self, "available")
+        bar = Subnet(self, "bar",
+            availability_zone=Token.as_string(Fn.lookup_nested(available.names, ["1"])),
+            cidr_block="10.1.2.0/24",
+            vpc_id=foo.id
+        )
+        aws_subnet_foo = Subnet(self, "foo_6",
+            availability_zone=Token.as_string(Fn.lookup_nested(available.names, ["0"])),
+            cidr_block="10.1.1.0/24",
+            vpc_id=foo.id
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_subnet_foo.override_logical_id("foo")
+        aws_alb_foo = Alb(self, "foo_7",
+            internal=True,
+            subnets=[Token.as_string(aws_subnet_foo.id), bar.id]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_alb_foo.override_logical_id("foo")
+        aws_wafregional_web_acl_association_foo = WafregionalWebAclAssociation(self, "foo_8",
+            resource_arn=Token.as_string(aws_alb_foo.arn),
+            web_acl_id=Token.as_string(aws_wafregional_web_acl_foo.id)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_wafregional_web_acl_association_foo.override_logical_id("foo")
+```
+
+### API Gateway Association
+
+```terraform
+resource "aws_wafregional_ipset" "ipset" {
+  name = "tfIPSet"
+
+  ip_set_descriptor {
+    type  = "IPV4"
+    value = "192.0.7.0/24"
+  }
+}
+
+resource "aws_wafregional_rule" "foo" {
+  name        = "tfWAFRule"
+  metric_name = "tfWAFRule"
+
+  predicate {
+    data_id = aws_wafregional_ipset.ipset.id
+    negated = false
+    type    = "IPMatch"
+  }
+}
+
+resource "aws_wafregional_web_acl" "foo" {
+  name        = "foo"
+  metric_name = "foo"
+
+  default_action {
+    type = "ALLOW"
+  }
+
+  rule {
+    action {
+      type = "BLOCK"
+    }
+
+    priority = 1
+    rule_id  = aws_wafregional_rule.foo.id
+  }
+}
+
+resource "aws_api_gateway_rest_api" "example" {
+  body = jsonencode({
+    openapi = "3.0.1"
+    info = {
+      title   = "example"
+      version = "1.0"
+    }
+    paths = {
+      "/path1" = {
+        get = {
+          x-amazon-apigateway-integration = {
+            httpMethod           = "GET"
+            payloadFormatVersion = "1.0"
+            type                 = "HTTP_PROXY"
+            uri                  = "https://ip-ranges.amazonaws.com/ip-ranges.json"
+          }
+        }
+      }
+    }
+  })
+
+  name = "example"
+}
+
+resource "aws_api_gateway_deployment" "example" {
+  rest_api_id = aws_api_gateway_rest_api.example.id
+
+  triggers = {
+    redeployment = sha1(jsonencode(aws_api_gateway_rest_api.example.body))
+  }
+
+  lifecycle {
+    create_before_destroy = true
+  }
+}
+
+resource "aws_api_gateway_stage" "example" {
+  deployment_id = aws_api_gateway_deployment.example.id
+  rest_api_id   = aws_api_gateway_rest_api.example.id
+  stage_name    = "example"
+}
+
+resource "aws_wafregional_web_acl_association" "association" {
+  resource_arn = aws_api_gateway_stage.example.arn
+  web_acl_id   = aws_wafregional_web_acl.foo.id
+}
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `web_acl_id` - (Required) The ID of the WAF Regional WebACL to create an association.
+* `resource_arn` - (Required) ARN of the resource to associate with. For example, an Application Load Balancer or API Gateway Stage.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the association
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WAF Regional Web ACL Association using their `web_acl_id:resource_arn`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import WAF Regional Web ACL Association using their `web_acl_id:resource_arn`. For example:
+
+```console
+% terraform import aws_wafregional_web_acl_association.foo web_acl_id:resource_arn
+```
+
+<!-- cache-key: cdktf-0.18.0 input-92667f5c1ba12f0dd670b9a0c354eaa6a7710825c86ec694fd9b66942f7d2390 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/wafregional_xss_match_set.html.markdown b/website/docs/cdktf/python/r/wafregional_xss_match_set.html.markdown
new file mode 100644
index 00000000000..da79fb6e283
--- /dev/null
+++ b/website/docs/cdktf/python/r/wafregional_xss_match_set.html.markdown
@@ -0,0 +1,90 @@
+---
+subcategory: "WAF Classic Regional"
+layout: "aws"
+page_title: "AWS: aws_wafregional_xss_match_set"
+description: |-
+  Provides an AWS WAF Regional XSS Match Set resource for use with ALB.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_wafregional_xss_match_set
+
+Provides a WAF Regional XSS Match Set Resource for use with Application Load Balancer.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.wafregional_xss_match_set import WafregionalXssMatchSet
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        WafregionalXssMatchSet(self, "xss_match_set",
+            name="xss_match_set",
+            xss_match_tuple=[WafregionalXssMatchSetXssMatchTuple(
+                field_to_match=WafregionalXssMatchSetXssMatchTupleFieldToMatch(
+                    type="URI"
+                ),
+                text_transformation="NONE"
+            ), WafregionalXssMatchSetXssMatchTuple(
+                field_to_match=WafregionalXssMatchSetXssMatchTupleFieldToMatch(
+                    type="QUERY_STRING"
+                ),
+                text_transformation="NONE"
+            )
+            ]
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the set
+* `xss_match_tuple` - (Optional) The parts of web requests that you want to inspect for cross-site scripting attacks.
+
+### Nested fields
+
+#### `xss_match_tuple`
+
+* `field_to_match` - (Required) Specifies where in a web request to look for cross-site scripting attacks.
+* `text_transformation` - (Required) Which text transformation, if any, to perform on the web request before inspecting the request for cross-site scripting attacks.
+
+#### `field_to_match`
+
+* `data` - (Optional) When the value of `type` is `HEADER`, enter the name of the header that you want the WAF to search, for example, `User-Agent` or `Referer`. If the value of `type` is any other value, omit `data`.
+* `type` - (Required) The part of the web request that you want AWS WAF to search for a specified stringE.g., `HEADER` or `METHOD`
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the Regional WAF XSS Match Set.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AWS WAF Regional XSS Match using the `id`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import AWS WAF Regional XSS Match using the `id`. For example:
+
+```console
+% terraform import aws_wafregional_xss_match_set.example 12345abcde
+```
+
+<!-- cache-key: cdktf-0.18.0 input-4f4d2ad8398170e5434a031da6cefde1dcdd17702dcd9c227325415752575f4a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/wafv2_ip_set.html.markdown b/website/docs/cdktf/python/r/wafv2_ip_set.html.markdown
new file mode 100644
index 00000000000..61ad1b5f3da
--- /dev/null
+++ b/website/docs/cdktf/python/r/wafv2_ip_set.html.markdown
@@ -0,0 +1,80 @@
+---
+subcategory: "WAF"
+layout: "aws"
+page_title: "AWS: aws_wafv2_ip_set"
+description: |-
+  Provides an AWS WAFv2 IP Set resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_wafv2_ip_set
+
+Provides a WAFv2 IP Set Resource
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.wafv2_ip_set import Wafv2IpSet
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Wafv2IpSet(self, "example",
+            addresses=["1.2.3.4/32", "5.6.7.8/32"],
+            description="Example IP set",
+            ip_address_version="IPV4",
+            name="example",
+            scope="REGIONAL",
+            tags={
+                "Tag1": "Value1",
+                "Tag2": "Value2"
+            }
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) A friendly name of the IP set.
+* `description` - (Optional) A friendly description of the IP set.
+* `scope` - (Required) Specifies whether this is for an AWS CloudFront distribution or for a regional application. Valid values are `CLOUDFRONT` or `REGIONAL`. To work with CloudFront, you must also specify the Region US East (N. Virginia).
+* `ip_address_version` - (Required) Specify IPV4 or IPV6. Valid values are `IPV4` or `IPV6`.
+* `addresses` - (Required) Contains an array of strings that specifies zero or more IP addresses or blocks of IP addresses. All addresses must be specified using Classless Inter-Domain Routing (CIDR) notation. WAF supports all IPv4 and IPv6 CIDR ranges except for `/0`.
+* `tags` - (Optional) An array of key:value pairs to associate with the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - A unique identifier for the IP set.
+* `arn` - The Amazon Resource Name (ARN) of the IP set.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WAFv2 IP Sets using `ID/name/scope`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import WAFv2 IP Sets using `ID/name/scope`. For example:
+
+```console
+% terraform import aws_wafv2_ip_set.example a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc/example/REGIONAL
+```
+
+<!-- cache-key: cdktf-0.18.0 input-b479c9f718a616c5596b789c7ff158e99147f52c44de441fab9ea4c4e4b4ab65 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/wafv2_regex_pattern_set.html.markdown b/website/docs/cdktf/python/r/wafv2_regex_pattern_set.html.markdown
new file mode 100644
index 00000000000..d8d00f1b1bc
--- /dev/null
+++ b/website/docs/cdktf/python/r/wafv2_regex_pattern_set.html.markdown
@@ -0,0 +1,87 @@
+---
+subcategory: "WAF"
+layout: "aws"
+page_title: "AWS: aws_wafv2_regex_pattern_set"
+description: |-
+  Provides an AWS WAFv2 Regex Pattern Set resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_wafv2_regex_pattern_set
+
+Provides an AWS WAFv2 Regex Pattern Set Resource
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.wafv2_regex_pattern_set import Wafv2RegexPatternSet
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Wafv2RegexPatternSet(self, "example",
+            description="Example regex pattern set",
+            name="example",
+            regular_expression=[Wafv2RegexPatternSetRegularExpression(
+                regex_string="one"
+            ), Wafv2RegexPatternSetRegularExpression(
+                regex_string="two"
+            )
+            ],
+            scope="REGIONAL",
+            tags={
+                "Tag1": "Value1",
+                "Tag2": "Value2"
+            }
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) A friendly name of the regular expression pattern set.
+* `description` - (Optional) A friendly description of the regular expression pattern set.
+* `scope` - (Required) Specifies whether this is for an AWS CloudFront distribution or for a regional application. Valid values are `CLOUDFRONT` or `REGIONAL`. To work with CloudFront, you must also specify the region `us-east-1` (N. Virginia) on the AWS provider.
+* `regular_expression` - (Optional) One or more blocks of regular expression patterns that you want AWS WAF to search for, such as `B[a@]dB[o0]t`. See [Regular Expression](#regular-expression) below for details. A maximum of 10 `regular_expression` blocks may be specified.
+* `tags` - (Optional) An array of key:value pairs to associate with the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Regular Expression
+
+* `regex_string` - (Required) The string representing the regular expression, see the AWS WAF [documentation](https://docs.aws.amazon.com/waf/latest/developerguide/waf-regex-pattern-set-creating.html) for more information.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - A unique identifier for the set.
+* `arn` - The Amazon Resource Name (ARN) that identifies the cluster.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WAFv2 Regex Pattern Sets using `ID/name/scope`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import WAFv2 Regex Pattern Sets using `ID/name/scope`. For example:
+
+```console
+% terraform import aws_wafv2_regex_pattern_set.example a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc/example/REGIONAL
+```
+
+<!-- cache-key: cdktf-0.18.0 input-eed21a5d34f7cebe366e9c7f2f0e99fea6caa3cbfe03c93ecf2ee8118271fa64 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/wafv2_rule_group.html.markdown b/website/docs/cdktf/python/r/wafv2_rule_group.html.markdown
new file mode 100644
index 00000000000..03170c058ae
--- /dev/null
+++ b/website/docs/cdktf/python/r/wafv2_rule_group.html.markdown
@@ -0,0 +1,774 @@
+---
+subcategory: "WAF"
+layout: "aws"
+page_title: "AWS: aws_wafv2_rule_group"
+description: |-
+  Creates a WAFv2 rule group resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_wafv2_rule_group
+
+Creates a WAFv2 Rule Group resource.
+
+## Example Usage
+
+### Simple
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.wafv2_rule_group import Wafv2RuleGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Wafv2RuleGroup(self, "example",
+            capacity=2,
+            name="example-rule",
+            rule=[Wafv2RuleGroupRule(
+                action=Wafv2RuleGroupRuleAction(
+                    allow=Wafv2RuleGroupRuleActionAllow()
+                ),
+                name="rule-1",
+                priority=1,
+                statement=Wafv2RuleGroupRuleStatement(
+                    geo_match_statement=Wafv2RuleGroupRuleStatementGeoMatchStatement(
+                        country_codes=["US", "NL"]
+                    )
+                ),
+                visibility_config=Wafv2RuleGroupRuleVisibilityConfig(
+                    cloudwatch_metrics_enabled=False,
+                    metric_name="friendly-rule-metric-name",
+                    sampled_requests_enabled=False
+                )
+            )
+            ],
+            scope="REGIONAL",
+            visibility_config=Wafv2RuleGroupVisibilityConfig(
+                cloudwatch_metrics_enabled=False,
+                metric_name="friendly-metric-name",
+                sampled_requests_enabled=False
+            )
+        )
+```
+
+### Complex
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.wafv2_ip_set import Wafv2IpSet
+from imports.aws.wafv2_regex_pattern_set import Wafv2RegexPatternSet
+from imports.aws.wafv2_rule_group import Wafv2RuleGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        test = Wafv2IpSet(self, "test",
+            addresses=["1.1.1.1/32", "2.2.2.2/32"],
+            ip_address_version="IPV4",
+            name="test",
+            scope="REGIONAL"
+        )
+        aws_wafv2_regex_pattern_set_test = Wafv2RegexPatternSet(self, "test_1",
+            name="test",
+            regular_expression=[Wafv2RegexPatternSetRegularExpression(
+                regex_string="one"
+            )
+            ],
+            scope="REGIONAL"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_wafv2_regex_pattern_set_test.override_logical_id("test")
+        Wafv2RuleGroup(self, "example",
+            capacity=500,
+            captcha_config=[{
+                "immunity_time_property": [{
+                    "immunity_time": 120
+                }
+                ]
+            }
+            ],
+            description="An rule group containing all statements",
+            name="complex-example",
+            rule=[Wafv2RuleGroupRule(
+                action=Wafv2RuleGroupRuleAction(
+                    block=Wafv2RuleGroupRuleActionBlock()
+                ),
+                name="rule-1",
+                priority=1,
+                statement=Wafv2RuleGroupRuleStatement(
+                    not_statement=Wafv2RuleGroupRuleStatementNotStatement(
+                        statement=[Wafv2RuleGroupRuleStatementNotStatementStatement(
+                            and_statement=Wafv2RuleGroupRuleStatementNotStatementStatementAndStatement(
+                                statement=[Wafv2RuleGroupRuleStatementNotStatementStatement(
+                                    geo_match_statement=Wafv2RuleGroupRuleStatementNotStatementStatementGeoMatchStatement(
+                                        country_codes=["US"]
+                                    )
+                                ), Wafv2RuleGroupRuleStatementNotStatementStatement(
+                                    byte_match_statement=Wafv2RuleGroupRuleStatementNotStatementStatementByteMatchStatement(
+                                        field_to_match=Wafv2RuleGroupRuleStatementNotStatementStatementByteMatchStatementFieldToMatch(
+                                            all_query_arguments=Wafv2RuleGroupRuleStatementNotStatementStatementByteMatchStatementFieldToMatchAllQueryArguments()
+                                        ),
+                                        positional_constraint="CONTAINS",
+                                        search_string="word",
+                                        text_transformation=[Wafv2RuleGroupRuleStatementNotStatementStatementByteMatchStatementTextTransformation(
+                                            priority=5,
+                                            type="CMD_LINE"
+                                        ), Wafv2RuleGroupRuleStatementNotStatementStatementByteMatchStatementTextTransformation(
+                                            priority=2,
+                                            type="LOWERCASE"
+                                        )
+                                        ]
+                                    )
+                                )
+                                ]
+                            )
+                        )
+                        ]
+                    )
+                ),
+                visibility_config=Wafv2RuleGroupRuleVisibilityConfig(
+                    cloudwatch_metrics_enabled=False,
+                    metric_name="rule-1",
+                    sampled_requests_enabled=False
+                )
+            ), Wafv2RuleGroupRule(
+                action=Wafv2RuleGroupRuleAction(
+                    count=Wafv2RuleGroupRuleActionCount()
+                ),
+                captcha_config=Wafv2RuleGroupRuleCaptchaConfig(
+                    immunity_time_property=Wafv2RuleGroupRuleCaptchaConfigImmunityTimeProperty(
+                        immunity_time=240
+                    )
+                ),
+                name="rule-2",
+                priority=2,
+                statement=Wafv2RuleGroupRuleStatement(
+                    or_statement=Wafv2RuleGroupRuleStatementOrStatement(
+                        statement=[Wafv2RuleGroupRuleStatementOrStatementStatement(
+                            regex_match_statement=Wafv2RuleGroupRuleStatementOrStatementStatementRegexMatchStatement(
+                                field_to_match=Wafv2RuleGroupRuleStatementOrStatementStatementRegexMatchStatementFieldToMatch(
+                                    single_header=Wafv2RuleGroupRuleStatementOrStatementStatementRegexMatchStatementFieldToMatchSingleHeader(
+                                        name="user-agent"
+                                    )
+                                ),
+                                regex_string="[a-z]([a-z0-9_-]*[a-z0-9])?",
+                                text_transformation=[Wafv2RuleGroupRuleStatementOrStatementStatementRegexMatchStatementTextTransformation(
+                                    priority=6,
+                                    type="NONE"
+                                )
+                                ]
+                            )
+                        ), Wafv2RuleGroupRuleStatementOrStatementStatement(
+                            sqli_match_statement=Wafv2RuleGroupRuleStatementOrStatementStatementSqliMatchStatement(
+                                field_to_match=Wafv2RuleGroupRuleStatementOrStatementStatementSqliMatchStatementFieldToMatch(
+                                    body=Wafv2RuleGroupRuleStatementOrStatementStatementSqliMatchStatementFieldToMatchBody()
+                                ),
+                                text_transformation=[Wafv2RuleGroupRuleStatementOrStatementStatementSqliMatchStatementTextTransformation(
+                                    priority=5,
+                                    type="URL_DECODE"
+                                ), Wafv2RuleGroupRuleStatementOrStatementStatementSqliMatchStatementTextTransformation(
+                                    priority=4,
+                                    type="HTML_ENTITY_DECODE"
+                                ), Wafv2RuleGroupRuleStatementOrStatementStatementSqliMatchStatementTextTransformation(
+                                    priority=3,
+                                    type="COMPRESS_WHITE_SPACE"
+                                )
+                                ]
+                            )
+                        ), Wafv2RuleGroupRuleStatementOrStatementStatement(
+                            xss_match_statement=Wafv2RuleGroupRuleStatementOrStatementStatementXssMatchStatement(
+                                field_to_match=Wafv2RuleGroupRuleStatementOrStatementStatementXssMatchStatementFieldToMatch(
+                                    method=Wafv2RuleGroupRuleStatementOrStatementStatementXssMatchStatementFieldToMatchMethod()
+                                ),
+                                text_transformation=[Wafv2RuleGroupRuleStatementOrStatementStatementXssMatchStatementTextTransformation(
+                                    priority=2,
+                                    type="NONE"
+                                )
+                                ]
+                            )
+                        )
+                        ]
+                    )
+                ),
+                visibility_config=Wafv2RuleGroupRuleVisibilityConfig(
+                    cloudwatch_metrics_enabled=False,
+                    metric_name="rule-2",
+                    sampled_requests_enabled=False
+                )
+            ), Wafv2RuleGroupRule(
+                action=Wafv2RuleGroupRuleAction(
+                    block=Wafv2RuleGroupRuleActionBlock()
+                ),
+                name="rule-3",
+                priority=3,
+                statement=Wafv2RuleGroupRuleStatement(
+                    size_constraint_statement=Wafv2RuleGroupRuleStatementSizeConstraintStatement(
+                        comparison_operator="GT",
+                        field_to_match=Wafv2RuleGroupRuleStatementSizeConstraintStatementFieldToMatch(
+                            single_query_argument=Wafv2RuleGroupRuleStatementSizeConstraintStatementFieldToMatchSingleQueryArgument(
+                                name="username"
+                            )
+                        ),
+                        size=100,
+                        text_transformation=[Wafv2RuleGroupRuleStatementSizeConstraintStatementTextTransformation(
+                            priority=5,
+                            type="NONE"
+                        )
+                        ]
+                    )
+                ),
+                visibility_config=Wafv2RuleGroupRuleVisibilityConfig(
+                    cloudwatch_metrics_enabled=False,
+                    metric_name="rule-3",
+                    sampled_requests_enabled=False
+                )
+            ), Wafv2RuleGroupRule(
+                action=Wafv2RuleGroupRuleAction(
+                    block=Wafv2RuleGroupRuleActionBlock()
+                ),
+                name="rule-4",
+                priority=4,
+                statement=Wafv2RuleGroupRuleStatement(
+                    or_statement=Wafv2RuleGroupRuleStatementOrStatement(
+                        statement=[Wafv2RuleGroupRuleStatementOrStatementStatement(
+                            ip_set_reference_statement=Wafv2RuleGroupRuleStatementOrStatementStatementIpSetReferenceStatement(
+                                arn=test.arn
+                            )
+                        ), Wafv2RuleGroupRuleStatementOrStatementStatement(
+                            regex_pattern_set_reference_statement=Wafv2RuleGroupRuleStatementOrStatementStatementRegexPatternSetReferenceStatement(
+                                arn=Token.as_string(aws_wafv2_regex_pattern_set_test.arn),
+                                field_to_match=Wafv2RuleGroupRuleStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatch(
+                                    single_header=Wafv2RuleGroupRuleStatementOrStatementStatementRegexPatternSetReferenceStatementFieldToMatchSingleHeader(
+                                        name="referer"
+                                    )
+                                ),
+                                text_transformation=[Wafv2RuleGroupRuleStatementOrStatementStatementRegexPatternSetReferenceStatementTextTransformation(
+                                    priority=2,
+                                    type="NONE"
+                                )
+                                ]
+                            )
+                        )
+                        ]
+                    )
+                ),
+                visibility_config=Wafv2RuleGroupRuleVisibilityConfig(
+                    cloudwatch_metrics_enabled=False,
+                    metric_name="rule-4",
+                    sampled_requests_enabled=False
+                )
+            )
+            ],
+            scope="REGIONAL",
+            tags={
+                "Code": "123456",
+                "Name": "example-and-statement"
+            },
+            visibility_config=Wafv2RuleGroupVisibilityConfig(
+                cloudwatch_metrics_enabled=False,
+                metric_name="friendly-metric-name",
+                sampled_requests_enabled=False
+            )
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `capacity` - (Required, Forces new resource) The web ACL capacity units (WCUs) required for this rule group. See [here](https://docs.aws.amazon.com/waf/latest/APIReference/API_CreateRuleGroup.html#API_CreateRuleGroup_RequestSyntax) for general information and [here](https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-statements-list.html) for capacity specific information.
+* `custom_response_body` - (Optional) Defines custom response bodies that can be referenced by `custom_response` actions. See [Custom Response Body](#custom-response-body) below for details.
+* `description` - (Optional) A friendly description of the rule group.
+* `name` - (Required, Forces new resource) A friendly name of the rule group.
+* `rule` - (Optional) The rule blocks used to identify the web requests that you want to `allow`, `block`, or `count`. See [Rules](#rules) below for details.
+* `scope` - (Required, Forces new resource) Specifies whether this is for an AWS CloudFront distribution or for a regional application. Valid values are `CLOUDFRONT` or `REGIONAL`. To work with CloudFront, you must also specify the region `us-east-1` (N. Virginia) on the AWS provider.
+* `tags` - (Optional) An array of key:value pairs to associate with the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `visibility_config` - (Required) Defines and enables Amazon CloudWatch metrics and web request sample collection. See [Visibility Configuration](#visibility-configuration) below for details.
+
+### Custom Response Body
+
+Each `custom_response_body` block supports the following arguments:
+
+* `key` - (Required) A unique key identifying the custom response body. This is referenced by the `custom_response_body_key` argument in the [Custom Response](#custom-response) block.
+* `content` - (Required) The payload of the custom response.
+* `content_type` - (Required) The type of content in the payload that you are defining in the `content` argument. Valid values are `TEXT_PLAIN`, `TEXT_HTML`, or `APPLICATION_JSON`.
+
+### Rules
+
+Each `rule` supports the following arguments:
+
+* `action` - (Required) The action that AWS WAF should take on a web request when it matches the rule's statement. Settings at the `aws_wafv2_web_acl` level can override the rule action setting. See [Action](#action) below for details.
+* `captcha_config` - (Optional) Specifies how AWS WAF should handle CAPTCHA evaluations. See [Captcha Configuration](#captcha-configuration) below for details.
+* `name` - (Required, Forces new resource) A friendly name of the rule.
+* `priority` - (Required) If you define more than one Rule in a WebACL, AWS WAF evaluates each request against the `rules` in order based on the value of `priority`. AWS WAF processes rules with lower priority first.
+* `rule_label` - (Optional) Labels to apply to web requests that match the rule match statement. See [Rule Label](#rule-label) below for details.
+* `statement` - (Required) The AWS WAF processing statement for the rule, for example `byte_match_statement` or `geo_match_statement`. See [Statement](#statement) below for details.
+* `visibility_config` - (Required) Defines and enables Amazon CloudWatch metrics and web request sample collection. See [Visibility Configuration](#visibility-configuration) below for details.
+
+### Action
+
+The `action` block supports the following arguments:
+
+~> **NOTE:** One of `allow`, `block`, or `count`, is required when specifying an `action`.
+
+* `allow` - (Optional) Instructs AWS WAF to allow the web request. See [Allow](#action) below for details.
+* `block` - (Optional) Instructs AWS WAF to block the web request. See [Block](#block) below for details.
+* `captcha` - (Optional) Instructs AWS WAF to run a `CAPTCHA` check against the web request. See [Captcha](#captcha) below for details.
+* `challenge` - (Optional) Instructs AWS WAF to run a check against the request to verify that the request is coming from a legitimate client session. See [Challenge](#challenge) below for details.
+* `count` - (Optional) Instructs AWS WAF to count the web request and allow it. See [Count](#count) below for details.
+
+### Allow
+
+The `allow` block supports the following arguments:
+
+* `custom_request_handling` - (Optional) Defines custom handling for the web request. See [Custom Request Handling](#custom-request-handling) below for details.
+
+### Block
+
+The `block` block supports the following arguments:
+
+* `custom_response` - (Optional) Defines a custom response for the web request. See [Custom Response](#custom-response) below for details.
+
+### Captcha
+
+The `captcha` block supports the following arguments:
+
+* `custom_request_handling` - (Optional) Defines custom handling for the web request. See [Custom Request Handling](#custom-request-handling) below for details.
+
+#### Challenge
+
+The `challenge` block supports the following arguments:
+
+* `custom_request_handling` - (Optional) Defines custom handling for the web request. See [Custom Request Handling](#custom-request-handling) below for details.
+
+### Count
+
+The `count` block supports the following arguments:
+
+* `custom_request_handling` - (Optional) Defines custom handling for the web request. See [Custom Request Handling](#custom-request-handling) below for details.
+
+### Custom Request Handling
+
+The `custom_request_handling` block supports the following arguments:
+
+* `insert_header` - (Required) The `insert_header` blocks used to define HTTP headers added to the request. See [Custom HTTP Header](#custom-http-header) below for details.
+
+### Custom Response
+
+The `custom_response` block supports the following arguments:
+
+* `custom_response_body_key` - (Optional) References the response body that you want AWS WAF to return to the web request client. This must reference a `key` defined in a `custom_response_body` block of this resource.
+* `response_code` - (Required) The HTTP status code to return to the client.
+* `response_header` - (Optional) The `response_header` blocks used to define the HTTP response headers added to the response. See [Custom HTTP Header](#custom-http-header) below for details.
+
+### Custom HTTP Header
+
+Each block supports the following arguments. Duplicate header names are not allowed:
+
+* `name` - The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+* `value` - The value of the custom header.
+
+### Rule Label
+
+Each block supports the following arguments:
+
+* `name` - The label string.
+
+### Statement
+
+The processing guidance for a Rule, used by AWS WAF to determine whether a web request matches the rule. See the [documentation](https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-statements-list.html) for more information.
+
+-> **NOTE:** Although the `statement` block is recursive, currently only 3 levels are supported.
+
+The `statement` block supports the following arguments:
+
+* `and_statement` - (Optional) A logical rule statement used to combine other rule statements with AND logic. See [AND Statement](#and-statement) below for details.
+* `byte_match_statement` - (Optional) A rule statement that defines a string match search for AWS WAF to apply to web requests. See [Byte Match Statement](#byte-match-statement) below for details.
+* `geo_match_statement` - (Optional) A rule statement used to identify web requests based on country of origin. See [GEO Match Statement](#geo-match-statement) below for details.
+* `label_match_statement` - (Optional) A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See [Label Match Statement](#label-match-statement) below for details.
+* `ip_set_reference_statement` - (Optional) A rule statement used to detect web requests coming from particular IP addresses or address ranges. See [IP Set Reference Statement](#ip-set-reference-statement) below for details.
+* `not_statement` - (Optional) A logical rule statement used to negate the results of another rule statement. See [NOT Statement](#not-statement) below for details.
+* `or_statement` - (Optional) A logical rule statement used to combine other rule statements with OR logic. See [OR Statement](#or-statement) below for details.
+* `rate_based_statement` - (Optional) A rate-based rule tracks the rate of requests for each originating `IP address`, and triggers the rule action when the rate exceeds a limit that you specify on the number of requests in any `5-minute` time span. This statement can not be nested. See [Rate Based Statement](#rate-based-statement) below for details.
+* `regex_match_statement` - (Optional) A rule statement used to search web request components for a match against a single regular expression. See [Regex Match Statement](#regex-match-statement) below for details.
+* `regex_pattern_set_reference_statement` - (Optional) A rule statement used to search web request components for matches with regular expressions. See [Regex Pattern Set Reference Statement](#regex-pattern-set-reference-statement) below for details.
+* `size_constraint_statement` - (Optional) A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See [Size Constraint Statement](#size-constraint-statement) below for more details.
+* `sqli_match_statement` - (Optional) An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See [SQL Injection Match Statement](#sql-injection-match-statement) below for details.
+* `xss_match_statement` - (Optional) A rule statement that defines a cross-site scripting (XSS) match search for AWS WAF to apply to web requests. See [XSS Match Statement](#xss-match-statement) below for details.
+
+### AND Statement
+
+A logical rule statement used to combine other rule statements with `AND` logic. You provide more than one `statement` within the `and_statement`.
+
+The `and_statement` block supports the following arguments:
+
+* `statement` - (Required) The statements to combine with `AND` logic. You can use any statements that can be nested. See [Statement](#statement) above for details.
+
+### Byte Match Statement
+
+The byte match statement provides the bytes to search for, the location in requests that you want AWS WAF to search, and other settings. The bytes to search for are typically a string that corresponds with ASCII characters.
+
+The `byte_match_statement` block supports the following arguments:
+
+* `field_to_match` - (Required) The part of a web request that you want AWS WAF to inspect. See [Field to Match](#field-to-match) below for details.
+* `positional_constraint` - (Required) The area within the portion of a web request that you want AWS WAF to search for `search_string`. Valid values include the following: `EXACTLY`, `STARTS_WITH`, `ENDS_WITH`, `CONTAINS`, `CONTAINS_WORD`. See the AWS [documentation](https://docs.aws.amazon.com/waf/latest/APIReference/API_ByteMatchStatement.html) for more information.
+* `search_string` - (Required) A string value that you want AWS WAF to search for. AWS WAF searches only in the part of web requests that you designate for inspection in `field_to_match`. The maximum length of the value is 50 bytes.
+* `text_transformation` - (Required) Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection.
+  At least one required.
+  See [Text Transformation](#text-transformation) below for details.
+
+### GEO Match Statement
+
+The `geo_match_statement` block supports the following arguments:
+
+* `country_codes` - (Required) An array of two-character country codes, for example, [ "US", "CN" ], from the alpha-2 country ISO codes of the `ISO 3166` international standard. See the [documentation](https://docs.aws.amazon.com/waf/latest/APIReference/API_GeoMatchStatement.html) for valid values.
+* `forwarded_ip_config` - (Optional) The configuration for inspecting IP addresses in an HTTP header that you specify, instead of using the IP address that's reported by the web request origin. See [Forwarded IP Config](#forwarded-ip-config) below for details.
+
+### Label Match Statement
+
+The `label_match_statement` block supports the following arguments:
+
+* `scope` - (Required) Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+* `key` - (Required) The string to match against.
+
+### IP Set Reference Statement
+
+A rule statement used to detect web requests coming from particular IP addresses or address ranges. To use this, create an `aws_wafv2_ip_set` that specifies the addresses you want to detect, then use the `ARN` of that set in this statement.
+
+The `ip_set_reference_statement` block supports the following arguments:
+
+* `arn` - (Required) The Amazon Resource Name (ARN) of the IP Set that this statement references.
+* `ip_set_forwarded_ip_config` - (Optional) The configuration for inspecting IP addresses in an HTTP header that you specify, instead of using the IP address that's reported by the web request origin. See [IPSet Forwarded IP Config](#ipset-forwarded-ip-config) below for more details.
+
+### NOT Statement
+
+A logical rule statement used to negate the results of another rule statement. You provide one `statement` within the `not_statement`.
+
+The `not_statement` block supports the following arguments:
+
+* `statement` - (Required) The statement to negate. You can use any statement that can be nested. See [Statement](#statement) above for details.
+
+### OR Statement
+
+A logical rule statement used to combine other rule statements with `OR` logic. You provide more than one `statement` within the `or_statement`.
+
+The `or_statement` block supports the following arguments:
+
+* `statement` - (Required) The statements to combine with `OR` logic. You can use any statements that can be nested. See [Statement](#statement) above for details.
+
+### Rate Based Statement
+
+A rate-based rule tracks the rate of requests for each originating IP address, and triggers the rule action when the rate exceeds a limit that you specify on the number of requests in any 5-minute time span. You can use this to put a temporary block on requests from an IP address that is sending excessive requests. See the [documentation](https://docs.aws.amazon.com/waf/latest/APIReference/API_RateBasedStatement.html) for more information.
+
+You can't nest a `rate_based_statement`, for example for use inside a `not_statement` or `or_statement`. It can only be referenced as a `top-level` statement within a `rule`.
+
+The `rate_based_statement` block supports the following arguments:
+
+* `aggregate_key_type` - (Optional) Setting that indicates how to aggregate the request counts. Valid values include: `CONSTANT`, `CUSTOM_KEYS`, `FORWARDED_IP` or `IP`. Default: `IP`.
+* `custom_key` - (Optional) Aggregate the request counts using one or more web request components as the aggregate keys. See [`custom_key`](#custom_key-block) below for details.
+* `forwarded_ip_config` - (Optional) The configuration for inspecting IP addresses in an HTTP header that you specify, instead of using the IP address that's reported by the web request origin. If `aggregate_key_type` is set to `FORWARDED_IP`, this block is required. See [Forwarded IP Config](#forwarded-ip-config) below for details.
+* `limit` - (Required) The limit on requests per 5-minute period for a single originating IP address.
+* `scope_down_statement` - (Optional) An optional nested statement that narrows the scope of the rate-based statement to matching web requests. This can be any nestable statement, and you can nest statements at any level below this scope-down statement. See [Statement](#statement) above for details. If `aggregate_key_type` is set to `CONSTANT`, this block is required.
+
+### Regex Match Statement
+
+A rule statement used to search web request components for a match against a single regular expression.
+
+The `regex_match_statement` block supports the following arguments:
+
+* `regex_string` - (Required) The string representing the regular expression. Minimum of `1` and maximum of `512` characters.
+* `field_to_match` - (Required) The part of a web request that you want AWS WAF to inspect. See [Field to Match](#field-to-match) below for details.
+* `text_transformation` - (Required) Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection.
+  At least one required.
+  See [Text Transformation](#text-transformation) below for details.
+
+### Regex Pattern Set Reference Statement
+
+A rule statement used to search web request components for matches with regular expressions. To use this, create a `aws_wafv2_regex_pattern_set` that specifies the expressions that you want to detect, then use the `ARN` of that set in this statement. A web request matches the pattern set rule statement if the request component matches any of the patterns in the set.
+
+The `regex_pattern_set_reference_statement` block supports the following arguments:
+
+* `arn` - (Required) The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
+* `field_to_match` - (Required) The part of a web request that you want AWS WAF to inspect. See [Field to Match](#field-to-match) below for details.
+* `text_transformation` - (Required) Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection.
+  At least one required.
+  See [Text Transformation](#text-transformation) below for details.
+
+### Size Constraint Statement
+
+A rule statement that uses a comparison operator to compare a number of bytes against the size of a request component. AWS WAFv2 inspects up to the first 8192 bytes (8 KB) of a request body, and when inspecting the request URI Path, the slash `/` in
+the URI counts as one character.
+
+The `size_constraint_statement` block supports the following arguments:
+
+* `comparison_operator` - (Required) The operator to use to compare the request part to the size setting. Valid values include: `EQ`, `NE`, `LE`, `LT`, `GE`, or `GT`.
+* `field_to_match` - (Optional) The part of a web request that you want AWS WAF to inspect. See [Field to Match](#field-to-match) below for details.
+* `size` - (Required) The size, in bytes, to compare to the request part, after any transformations. Valid values are integers between 0 and 21474836480, inclusive.
+* `text_transformation` - (Required) Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection.
+  At least one required.
+  See [Text Transformation](#text-transformation) below for details.
+
+### SQL Injection Match Statement
+
+An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. Later in the process, when you create a web ACL, you specify whether to allow or block requests that appear to contain malicious SQL code.
+
+The `sqli_match_statement` block supports the following arguments:
+
+* `field_to_match` - (Required) The part of a web request that you want AWS WAF to inspect. See [Field to Match](#field-to-match) below for details.
+* `text_transformation` - (Required) Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection.
+  At least one required.
+  See [Text Transformation](#text-transformation) below for details.
+
+### XSS Match Statement
+
+The XSS match statement provides the location in requests that you want AWS WAF to search and text transformations to use on the search area before AWS WAF searches for character sequences that are likely to be malicious strings.
+
+The `xss_match_statement` block supports the following arguments:
+
+* `field_to_match` - (Required) The part of a web request that you want AWS WAF to inspect. See [Field to Match](#field-to-match) below for details.
+* `text_transformation` - (Required) Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection.
+  At least one required.
+  See [Text Transformation](#text-transformation) below for details.
+
+### Field to Match
+
+The part of a web request that you want AWS WAF to inspect. Include the single `field_to_match` type that you want to inspect, with additional specifications as needed, according to the type. You specify a single request component in `field_to_match` for each rule statement that requires it. To inspect more than one component of a web request, create a separate rule statement for each component. See the [documentation](https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-statement-fields.html#waf-rule-statement-request-component) for more details.
+
+The `field_to_match` block supports the following arguments:
+
+~> **NOTE:** Only one of `all_query_arguments`, `body`, `cookies`, `headers`, `json_body`, `method`, `query_string`, `single_header`, `single_query_argument`, or `uri_path` can be specified.
+An empty configuration block `{}` should be used when specifying `all_query_arguments`, `body`, `method`, or `query_string` attributes.
+
+* `all_query_arguments` - (Optional) Inspect all query arguments.
+* `body` - (Optional) Inspect the request body, which immediately follows the request headers.
+* `cookies` - (Optional) Inspect the cookies in the web request. See [Cookies](#cookies) below for details.
+* `headers` - (Optional) Inspect the request headers. See [Headers](#headers) below for details.
+* `json_body` - (Optional) Inspect the request body as JSON. See [JSON Body](#json-body) for details.
+* `method` - (Optional) Inspect the HTTP method. The method indicates the type of operation that the request is asking the origin to perform.
+* `query_string` - (Optional) Inspect the query string. This is the part of a URL that appears after a `?` character, if any.
+* `single_header` - (Optional) Inspect a single header. See [Single Header](#single-header) below for details.
+* `single_query_argument` - (Optional) Inspect a single query argument. See [Single Query Argument](#single-query-argument) below for details.
+* `uri_path` - (Optional) Inspect the request URI path. This is the part of a web request that identifies a resource, for example, `/images/daily-ad.jpg`.
+
+### Forwarded IP Config
+
+The configuration for inspecting IP addresses in an HTTP header that you specify, instead of using the IP address that's reported by the web request origin. Commonly, this is the X-Forwarded-For (XFF) header, but you can specify
+any header name. If the specified header isn't present in the request, AWS WAFv2 doesn't apply the rule to the web request at all.
+AWS WAFv2 only evaluates the first IP address found in the specified HTTP header.
+
+The `forwarded_ip_config` block supports the following arguments:
+
+* `fallback_behavior` - (Required) - The match status to assign to the web request if the request doesn't have a valid IP address in the specified position. Valid values include: `MATCH` or `NO_MATCH`.
+* `header_name` - (Required) - The name of the HTTP header to use for the IP address.
+
+### IPSet Forwarded IP Config
+
+The configuration for inspecting IP addresses in an HTTP header that you specify, instead of using the IP address that's reported by the web request origin. Commonly, this is the X-Forwarded-For (XFF) header, but you can specify any header name.
+
+The `ip_set_forwarded_ip_config` block supports the following arguments:
+
+* `fallback_behavior` - (Required) - The match status to assign to the web request if the request doesn't have a valid IP address in the specified position. Valid values include: `MATCH` or `NO_MATCH`.
+* `header_name` - (Required) - The name of the HTTP header to use for the IP address.
+* `position` - (Required) - The position in the header to search for the IP address. Valid values include: `FIRST`, `LAST`, or `ANY`. If `ANY` is specified and the header contains more than 10 IP addresses, AWS WAFv2 inspects the last 10.
+
+### Headers
+
+Inspect the request headers.
+
+The `headers` block supports the following arguments:
+
+* `match_pattern` - (Required) The filter to use to identify the subset of headers to inspect in a web request. The `match_pattern` block supports only one of the following arguments:
+    * `all` - An empty configuration block that is used for inspecting all headers.
+    * `included_headers` - An array of strings that will be used for inspecting headers that have a key that matches one of the provided values.
+    * `excluded_headers` - An array of strings that will be used for inspecting headers that do not have a key that matches one of the provided values.
+* `match_scope` - (Required) The parts of the headers to inspect with the rule inspection criteria. If you specify `All`, AWS WAF inspects both keys and values. Valid values include the following: `ALL`, `Key`, `Value`.
+* `oversize_handling` - (Required) Oversize handling tells AWS WAF what to do with a web request when the request component that the rule inspects is over the limits. Valid values include the following: `CONTINUE`, `MATCH`, `NO_MATCH`. See the AWS [documentation](https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-statement-oversize-handling.html) for more information.
+
+### JSON Body
+
+The `json_body` block supports the following arguments:
+
+* `invalid_fallback_behavior` - (Optional) What to do when JSON parsing fails. Defaults to evaluating up to the first parsing failure. Valid values are `EVALUATE_AS_STRING`, `MATCH` and `NO_MATCH`.
+* `match_pattern` - (Required) The patterns to look for in the JSON body. You must specify exactly one setting: either `all` or `included_paths`. See [JsonMatchPattern](https://docs.aws.amazon.com/waf/latest/APIReference/API_JsonMatchPattern.html) for details.
+* `match_scope` - (Required) The parts of the JSON to match against using the `match_pattern`. Valid values are `ALL`, `KEY` and `VALUE`.
+* `oversize_handling` - (Optional) What to do if the body is larger than can be inspected. Valid values are `CONTINUE` (default), `MATCH` and `NO_MATCH`.
+
+### Single Header
+
+Inspect a single header. Provide the name of the header to inspect, for example, `User-Agent` or `Referer` (provided as lowercase strings).
+
+The `single_header` block supports the following arguments:
+
+* `name` - (Optional) The name of the query header to inspect. This setting must be provided as lower case characters.
+
+### Single Query Argument
+
+Inspect a single query argument. Provide the name of the query argument to inspect, such as `UserName` or `SalesRegion` (provided as lowercase strings).
+
+The `single_query_argument` block supports the following arguments:
+
+* `name` - (Optional) The name of the query header to inspect. This setting must be provided as lower case characters.
+
+### Cookies
+
+Inspect the cookies in the web request. You can specify the parts of the cookies to inspect and you can narrow the set of cookies to inspect by including or excluding specific keys.
+This is used to indicate the web request component to inspect, in the [FieldToMatch](https://docs.aws.amazon.com/waf/latest/APIReference/API_FieldToMatch.html) specification.
+
+The `cookies` block supports the following arguments:
+
+* `match_pattern` - (Required) The filter to use to identify the subset of cookies to inspect in a web request. You must specify exactly one setting: either `all`, `included_cookies` or `excluded_cookies`. More details: [CookieMatchPattern](https://docs.aws.amazon.com/waf/latest/APIReference/API_CookieMatchPattern.html)
+* `match_scope` - (Required) The parts of the cookies to inspect with the rule inspection criteria. If you specify All, AWS WAF inspects both keys and values. Valid values: `ALL`, `KEY`, `VALUE`
+* `oversize_handling` - (Required) What AWS WAF should do if the cookies of the request are larger than AWS WAF can inspect. AWS WAF does not support inspecting the entire contents of request cookies when they exceed 8 KB (8192 bytes) or 200 total cookies. The underlying host service forwards a maximum of 200 cookies and at most 8 KB of cookie contents to AWS WAF. Valid values: `CONTINUE`, `MATCH`, `NO_MATCH`
+
+### Text Transformation
+
+The `text_transformation` block supports the following arguments:
+
+* `priority` - (Required) The relative processing order for multiple transformations that are defined for a rule statement. AWS WAF processes all transformations, from lowest priority to highest, before inspecting the transformed content.
+* `type` - (Required) The transformation to apply, please refer to the Text Transformation [documentation](https://docs.aws.amazon.com/waf/latest/APIReference/API_TextTransformation.html) for more details.
+
+### Visibility Configuration
+
+The `visibility_config` block supports the following arguments:
+
+* `cloudwatch_metrics_enabled` - (Required) A boolean indicating whether the associated resource sends metrics to CloudWatch. For the list of available metrics, see [AWS WAF Metrics](https://docs.aws.amazon.com/waf/latest/developerguide/monitoring-cloudwatch.html#waf-metrics).
+* `metric_name` - (Required, Forces new resource) A friendly name of the CloudWatch metric. The name can contain only alphanumeric characters (A-Z, a-z, 0-9) hyphen(-) and underscore (_), with length from one to 128 characters. It can't contain whitespace or metric names reserved for AWS WAF, for example `All` and `Default_Action`.
+* `sampled_requests_enabled` - (Required) A boolean indicating whether AWS WAF should store a sampling of the web requests that match the rules. You can view the sampled requests through the AWS WAF console.
+
+### Captcha Configuration
+
+The `captcha_config` block supports the following arguments:
+
+* `immunity_time_property` - (Optional) Defines custom immunity time. See [Immunity Time Property](#immunity-time-property) below for details.
+
+### Immunity Time Property
+
+The `immunity_time_property` block supports the following arguments:
+
+* `immunity_time` - (Optional) The amount of time, in seconds, that a CAPTCHA or challenge timestamp is considered valid by AWS WAF. The default setting is 300.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the WAF rule group.
+* `arn` - The ARN of the WAF rule group.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+### `custom_key` Block
+
+Aggregate the request counts using one or more web request components as the aggregate keys. With this option, you must specify the aggregate keys in the `custom_keys` block. To aggregate on only the IP address or only the forwarded IP address, don't use custom keys. Instead, set the `aggregate_key_type` to `IP` or `FORWARDED_IP`.
+
+The `custom_key` block supports the following arguments:
+
+* `cookie` - (Optional) Use the value of a cookie in the request as an aggregate key. See [RateLimit `cookie`](#ratelimit-cookie-block) below for details.
+* `forwarded_ip` - (Optional) Use the first IP address in an HTTP header as an aggregate key. See [`forwarded_ip`](#ratelimit-forwarded_ip-block) below for details.
+* `http_method` - (Optional) Use the request's HTTP method as an aggregate key. See [RateLimit `http_method`](#ratelimit-http_method-block) below for details.
+* `header` - (Optional) Use the value of a header in the request as an aggregate key. See [RateLimit `header`](#ratelimit-header-block) below for details.
+* `ip` - (Optional) Use the request's originating IP address as an aggregate key. See [`RateLimit ip`](#ratelimit-ip-block) below for details.
+* `label_namespace` - (Optional) Use the specified label namespace as an aggregate key. See [RateLimit `label_namespace`](#ratelimit-label_namespace-block) below for details.
+* `query_argument` - (Optional) Use the specified query argument as an aggregate key. See [RateLimit `query_argument`](#ratelimit-query_argument-block) below for details.
+* `query_string` - (Optional) Use the request's query string as an aggregate key. See [RateLimit `query_string`](#ratelimit-query_string-block) below for details.
+* `uri_path` - (Optional) Use the request's URI path as an aggregate key. See [RateLimit `uri_path`](#ratelimit-uri_path-block) below for details.
+
+### RateLimit `cookie` Block
+
+Use the value of a cookie in the request as an aggregate key. Each distinct value in the cookie contributes to the aggregation instance. If you use a single cookie as your custom key, then each value fully defines an aggregation instance.
+
+The `cookie` block supports the following arguments:
+
+* `name`: The name of the cookie to use.
+* `text_transformation`: Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection. They are used in rate-based rule statements, to transform request components before using them as custom aggregation keys. Atleast one transformation is required.  See [Text Transformation](#text-transformation) above for details.
+
+### RateLimit `forwarded_ip` Block
+
+Use the first IP address in an HTTP header as an aggregate key. Each distinct forwarded IP address contributes to the aggregation instance. When you specify an IP or forwarded IP in the custom key settings, you must also specify at least one other key to use. You can aggregate on only the forwarded IP address by specifying `FORWARDED_IP` in your rate-based statement's `aggregate_key_type`. With this option, you must specify the header to use in the rate-based rule's [Forwarded IP Config](#forwarded-ip-config) block.
+
+The `forwarded_ip` block is configured as an empty block `{}`.
+
+### RateLimit `http_method` Block
+
+Use the request's HTTP method as an aggregate key. Each distinct HTTP method contributes to the aggregation instance. If you use just the HTTP method as your custom key, then each method fully defines an aggregation instance.
+
+The `http_method` block is configured as an empty block `{}`.
+
+### RateLimit `header` Block
+
+Use the value of a header in the request as an aggregate key. Each distinct value in the header contributes to the aggregation instance. If you use a single header as your custom key, then each value fully defines an aggregation instance.
+
+The `header` block supports the following arguments:
+
+* `name`: The name of the header to use.
+* `text_transformation`: Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection. They are used in rate-based rule statements, to transform request components before using them as custom aggregation keys. Atleast one transformation is required.  See [Text Transformation](#text-transformation) above for details.
+
+### RateLimit `ip` Block
+
+Use the request's originating IP address as an aggregate key. Each distinct IP address contributes to the aggregation instance. When you specify an IP or forwarded IP in the custom key settings, you must also specify at least one other key to use. You can aggregate on only the IP address by specifying `IP` in your rate-based statement's `aggregate_key_type`.
+
+The `ip` block is configured as an empty block `{}`.
+
+### RateLimit `label_namespace` Block
+
+Use the specified label namespace as an aggregate key. Each distinct fully qualified label name that has the specified label namespace contributes to the aggregation instance. If you use just one label namespace as your custom key, then each label name fully defines an aggregation instance. This uses only labels that have been added to the request by rules that are evaluated before this rate-based rule in the web ACL. For information about label namespaces and names, see Label syntax and naming requirements (https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-label-requirements.html) in the WAF Developer Guide.
+
+The `label_namespace` block supports the following arguments:
+
+* `namespace`: The namespace to use for aggregation
+
+### RateLimit `query_argument` Block
+
+Use the specified query argument as an aggregate key. Each distinct value for the named query argument contributes to the aggregation instance. If you use a single query argument as your custom key, then each value fully defines an aggregation instance.
+
+The `query_argument` block supports the following arguments:
+
+* `name`: The name of the query argument to use.
+* `text_transformation`: Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection. They are used in rate-based rule statements, to transform request components before using them as custom aggregation keys. Atleast one transformation is required. See [Text Transformation](#text-transformation) above for details.
+
+### RateLimit `query_string` Block
+
+Use the request's query string as an aggregate key. Each distinct string contributes to the aggregation instance. If you use just the query string as your custom key, then each string fully defines an aggregation instance.
+
+The `query_string` block supports the following arguments:
+
+* `text_transformation`: Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection. They are used in rate-based rule statements, to transform request components before using them as custom aggregation keys. Atleast one transformation is required. See [Text Transformation](#text-transformation) above for details.
+
+### RateLimit `uri_path` Block
+
+Use the request's URI path as an aggregate key. Each distinct URI path contributes to the aggregation instance. If you use just the URI path as your custom key, then each URI path fully defines an aggregation instance.
+
+The `uri_path` block supports the following arguments:
+
+* `text_transformation`: Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection. They are used in rate-based rule statements, to transform request components before using them as custom aggregation keys. Atleast one transformation is required. See [Text Transformation](#text-transformation) above for details.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WAFv2 Rule Group using `ID/name/scope`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import WAFv2 Rule Group using `ID/name/scope`. For example:
+
+```console
+% terraform import aws_wafv2_rule_group.example a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc/example/REGIONAL
+```
+
+<!-- cache-key: cdktf-0.18.0 input-d2bb4de24461011d76bbc3333d69c2766c8e9c558c45b18a7db45691e9d58825 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/wafv2_web_acl.html.markdown b/website/docs/cdktf/python/r/wafv2_web_acl.html.markdown
new file mode 100644
index 00000000000..d29508c92fb
--- /dev/null
+++ b/website/docs/cdktf/python/r/wafv2_web_acl.html.markdown
@@ -0,0 +1,1057 @@
+---
+subcategory: "WAF"
+layout: "aws"
+page_title: "AWS: aws_wafv2_web_acl"
+description: |-
+  Creates a WAFv2 Web ACL resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_wafv2_web_acl
+
+Creates a WAFv2 Web ACL resource.
+
+~> **Note** In `field_to_match` blocks, _e.g._, in `byte_match_statement`, the `body` block includes an optional argument `oversize_handling`. AWS indicates this argument will be required starting February 2023. To avoid configurations breaking when that change happens, treat the `oversize_handling` argument as **required** as soon as possible.
+
+## Example Usage
+
+This resource is based on `aws_wafv2_rule_group`, check the documentation of the `aws_wafv2_rule_group` resource to see examples of the various available statements.
+
+### Managed Rule
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.wafv2_web_acl import Wafv2WebAcl
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Wafv2WebAcl(self, "example",
+            default_action=Wafv2WebAclDefaultAction(
+                allow=Wafv2WebAclDefaultActionAllow()
+            ),
+            description="Example of a managed rule.",
+            name="managed-rule-example",
+            rule=[Wafv2WebAclRule(
+                name="rule-1",
+                override_action=Wafv2WebAclRuleOverrideAction(
+                    count=Wafv2WebAclRuleOverrideActionCount()
+                ),
+                priority=1,
+                statement=Wafv2WebAclRuleStatement(
+                    managed_rule_group_statement=Wafv2WebAclRuleStatementManagedRuleGroupStatement(
+                        name="AWSManagedRulesCommonRuleSet",
+                        rule_action_override=[Wafv2WebAclRuleStatementManagedRuleGroupStatementRuleActionOverride(
+                            action_to_use=Wafv2WebAclRuleStatementManagedRuleGroupStatementRuleActionOverrideActionToUse(
+                                count=Wafv2WebAclRuleStatementManagedRuleGroupStatementRuleActionOverrideActionToUseCount()
+                            ),
+                            name="SizeRestrictions_QUERYSTRING"
+                        ), Wafv2WebAclRuleStatementManagedRuleGroupStatementRuleActionOverride(
+                            action_to_use=Wafv2WebAclRuleStatementManagedRuleGroupStatementRuleActionOverrideActionToUse(
+                                count=Wafv2WebAclRuleStatementManagedRuleGroupStatementRuleActionOverrideActionToUseCount()
+                            ),
+                            name="NoUserAgent_HEADER"
+                        )
+                        ],
+                        scope_down_statement=Wafv2WebAclRuleStatementManagedRuleGroupStatementScopeDownStatement(
+                            geo_match_statement=Wafv2WebAclRuleStatementManagedRuleGroupStatementScopeDownStatementGeoMatchStatement(
+                                country_codes=["US", "NL"]
+                            )
+                        ),
+                        vendor_name="AWS"
+                    )
+                ),
+                token_domains=["mywebsite.com", "myotherwebsite.com"],
+                visibility_config=Wafv2WebAclRuleVisibilityConfig(
+                    cloudwatch_metrics_enabled=False,
+                    metric_name="friendly-rule-metric-name",
+                    sampled_requests_enabled=False
+                )
+            )
+            ],
+            scope="REGIONAL",
+            tags={
+                "Tag1": "Value1",
+                "Tag2": "Value2"
+            },
+            visibility_config=Wafv2WebAclVisibilityConfig(
+                cloudwatch_metrics_enabled=False,
+                metric_name="friendly-metric-name",
+                sampled_requests_enabled=False
+            )
+        )
+```
+
+### Account Creation Fraud Prevention
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.wafv2_web_acl import Wafv2WebAcl
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Wafv2WebAcl(self, "acfp-example",
+            default_action=Wafv2WebAclDefaultAction(
+                allow=Wafv2WebAclDefaultActionAllow()
+            ),
+            description="Example of a managed ACFP rule.",
+            name="managed-acfp-example",
+            rule=[Wafv2WebAclRule(
+                name="acfp-rule-1",
+                override_action=Wafv2WebAclRuleOverrideAction(
+                    count=Wafv2WebAclRuleOverrideActionCount()
+                ),
+                priority=1,
+                statement=Wafv2WebAclRuleStatement(
+                    managed_rule_group_statement=Wafv2WebAclRuleStatementManagedRuleGroupStatement(
+                        managed_rule_group_configs=[Wafv2WebAclRuleStatementManagedRuleGroupStatementManagedRuleGroupConfigs(
+                            aws_managed_rules_acfp_rule_set=Wafv2WebAclRuleStatementManagedRuleGroupStatementManagedRuleGroupConfigsAwsManagedRulesAcfpRuleSet(
+                                creation_path="/signin",
+                                registration_page_path="/register",
+                                request_inspection=Wafv2WebAclRuleStatementManagedRuleGroupStatementManagedRuleGroupConfigsAwsManagedRulesAcfpRuleSetRequestInspection(
+                                    email_field=Wafv2WebAclRuleStatementManagedRuleGroupStatementManagedRuleGroupConfigsAwsManagedRulesAcfpRuleSetRequestInspectionEmailField(
+                                        identifier="/email"
+                                    ),
+                                    password_field=Wafv2WebAclRuleStatementManagedRuleGroupStatementManagedRuleGroupConfigsAwsManagedRulesAcfpRuleSetRequestInspectionPasswordField(
+                                        identifier="/password"
+                                    ),
+                                    payload_type="JSON",
+                                    username_field=Wafv2WebAclRuleStatementManagedRuleGroupStatementManagedRuleGroupConfigsAwsManagedRulesAcfpRuleSetRequestInspectionUsernameField(
+                                        identifier="/username"
+                                    )
+                                ),
+                                response_inspection=Wafv2WebAclRuleStatementManagedRuleGroupStatementManagedRuleGroupConfigsAwsManagedRulesAcfpRuleSetResponseInspection(
+                                    status_code=Wafv2WebAclRuleStatementManagedRuleGroupStatementManagedRuleGroupConfigsAwsManagedRulesAcfpRuleSetResponseInspectionStatusCode(
+                                        failure_codes=[Token.as_number("403")],
+                                        success_codes=[Token.as_number("200")]
+                                    )
+                                )
+                            )
+                        )
+                        ],
+                        name="AWSManagedRulesACFPRuleSet",
+                        vendor_name="AWS"
+                    )
+                ),
+                visibility_config=Wafv2WebAclRuleVisibilityConfig(
+                    cloudwatch_metrics_enabled=False,
+                    metric_name="friendly-rule-metric-name",
+                    sampled_requests_enabled=False
+                )
+            )
+            ],
+            scope="CLOUDFRONT",
+            visibility_config=Wafv2WebAclVisibilityConfig(
+                cloudwatch_metrics_enabled=False,
+                metric_name="friendly-metric-name",
+                sampled_requests_enabled=False
+            )
+        )
+```
+
+### Account Takeover Protection
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.wafv2_web_acl import Wafv2WebAcl
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Wafv2WebAcl(self, "atp-example",
+            default_action=Wafv2WebAclDefaultAction(
+                allow=Wafv2WebAclDefaultActionAllow()
+            ),
+            description="Example of a managed ATP rule.",
+            name="managed-atp-example",
+            rule=[Wafv2WebAclRule(
+                name="atp-rule-1",
+                override_action=Wafv2WebAclRuleOverrideAction(
+                    count=Wafv2WebAclRuleOverrideActionCount()
+                ),
+                priority=1,
+                statement=Wafv2WebAclRuleStatement(
+                    managed_rule_group_statement=Wafv2WebAclRuleStatementManagedRuleGroupStatement(
+                        managed_rule_group_configs=[Wafv2WebAclRuleStatementManagedRuleGroupStatementManagedRuleGroupConfigs(
+                            aws_managed_rules_atp_rule_set=Wafv2WebAclRuleStatementManagedRuleGroupStatementManagedRuleGroupConfigsAwsManagedRulesAtpRuleSet(
+                                login_path="/api/1/signin",
+                                request_inspection=Wafv2WebAclRuleStatementManagedRuleGroupStatementManagedRuleGroupConfigsAwsManagedRulesAtpRuleSetRequestInspection(
+                                    password_field=Wafv2WebAclRuleStatementManagedRuleGroupStatementManagedRuleGroupConfigsAwsManagedRulesAtpRuleSetRequestInspectionPasswordField(
+                                        identifier="/password"
+                                    ),
+                                    payload_type="JSON",
+                                    username_field=Wafv2WebAclRuleStatementManagedRuleGroupStatementManagedRuleGroupConfigsAwsManagedRulesAtpRuleSetRequestInspectionUsernameField(
+                                        identifier="/email"
+                                    )
+                                ),
+                                response_inspection=Wafv2WebAclRuleStatementManagedRuleGroupStatementManagedRuleGroupConfigsAwsManagedRulesAtpRuleSetResponseInspection(
+                                    status_code=Wafv2WebAclRuleStatementManagedRuleGroupStatementManagedRuleGroupConfigsAwsManagedRulesAtpRuleSetResponseInspectionStatusCode(
+                                        failure_codes=[Token.as_number("403")],
+                                        success_codes=[Token.as_number("200")]
+                                    )
+                                )
+                            )
+                        )
+                        ],
+                        name="AWSManagedRulesATPRuleSet",
+                        vendor_name="AWS"
+                    )
+                ),
+                visibility_config=Wafv2WebAclRuleVisibilityConfig(
+                    cloudwatch_metrics_enabled=False,
+                    metric_name="friendly-rule-metric-name",
+                    sampled_requests_enabled=False
+                )
+            )
+            ],
+            scope="CLOUDFRONT",
+            visibility_config=Wafv2WebAclVisibilityConfig(
+                cloudwatch_metrics_enabled=False,
+                metric_name="friendly-metric-name",
+                sampled_requests_enabled=False
+            )
+        )
+```
+
+### Rate Based
+
+Rate-limit US and NL-based clients to 10,000 requests for every 5 minutes.
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.wafv2_web_acl import Wafv2WebAcl
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Wafv2WebAcl(self, "example",
+            default_action=Wafv2WebAclDefaultAction(
+                allow=Wafv2WebAclDefaultActionAllow()
+            ),
+            description="Example of a Cloudfront rate based statement.",
+            name="rate-based-example",
+            rule=[Wafv2WebAclRule(
+                action=Wafv2WebAclRuleAction(
+                    block=Wafv2WebAclRuleActionBlock()
+                ),
+                name="rule-1",
+                priority=1,
+                statement=Wafv2WebAclRuleStatement(
+                    rate_based_statement=Wafv2WebAclRuleStatementRateBasedStatement(
+                        aggregate_key_type="IP",
+                        limit=10000,
+                        scope_down_statement=Wafv2WebAclRuleStatementRateBasedStatementScopeDownStatement(
+                            geo_match_statement=Wafv2WebAclRuleStatementRateBasedStatementScopeDownStatementGeoMatchStatement(
+                                country_codes=["US", "NL"]
+                            )
+                        )
+                    )
+                ),
+                visibility_config=Wafv2WebAclRuleVisibilityConfig(
+                    cloudwatch_metrics_enabled=False,
+                    metric_name="friendly-rule-metric-name",
+                    sampled_requests_enabled=False
+                )
+            )
+            ],
+            scope="CLOUDFRONT",
+            tags={
+                "Tag1": "Value1",
+                "Tag2": "Value2"
+            },
+            visibility_config=Wafv2WebAclVisibilityConfig(
+                cloudwatch_metrics_enabled=False,
+                metric_name="friendly-metric-name",
+                sampled_requests_enabled=False
+            )
+        )
+```
+
+### Rule Group Reference
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.wafv2_rule_group import Wafv2RuleGroup
+from imports.aws.wafv2_web_acl import Wafv2WebAcl
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = Wafv2RuleGroup(self, "example",
+            capacity=10,
+            name="example-rule-group",
+            rule=[Wafv2RuleGroupRule(
+                action=Wafv2RuleGroupRuleAction(
+                    count=Wafv2RuleGroupRuleActionCount()
+                ),
+                name="rule-1",
+                priority=1,
+                statement=Wafv2RuleGroupRuleStatement(
+                    geo_match_statement=Wafv2RuleGroupRuleStatementGeoMatchStatement(
+                        country_codes=["NL"]
+                    )
+                ),
+                visibility_config=Wafv2RuleGroupRuleVisibilityConfig(
+                    cloudwatch_metrics_enabled=False,
+                    metric_name="friendly-rule-metric-name",
+                    sampled_requests_enabled=False
+                )
+            ), Wafv2RuleGroupRule(
+                action=Wafv2RuleGroupRuleAction(
+                    allow=Wafv2RuleGroupRuleActionAllow()
+                ),
+                name="rule-to-exclude-a",
+                priority=10,
+                statement=Wafv2RuleGroupRuleStatement(
+                    geo_match_statement=Wafv2RuleGroupRuleStatementGeoMatchStatement(
+                        country_codes=["US"]
+                    )
+                ),
+                visibility_config=Wafv2RuleGroupRuleVisibilityConfig(
+                    cloudwatch_metrics_enabled=False,
+                    metric_name="friendly-rule-metric-name",
+                    sampled_requests_enabled=False
+                )
+            ), Wafv2RuleGroupRule(
+                action=Wafv2RuleGroupRuleAction(
+                    allow=Wafv2RuleGroupRuleActionAllow()
+                ),
+                name="rule-to-exclude-b",
+                priority=15,
+                statement=Wafv2RuleGroupRuleStatement(
+                    geo_match_statement=Wafv2RuleGroupRuleStatementGeoMatchStatement(
+                        country_codes=["GB"]
+                    )
+                ),
+                visibility_config=Wafv2RuleGroupRuleVisibilityConfig(
+                    cloudwatch_metrics_enabled=False,
+                    metric_name="friendly-rule-metric-name",
+                    sampled_requests_enabled=False
+                )
+            )
+            ],
+            scope="REGIONAL",
+            visibility_config=Wafv2RuleGroupVisibilityConfig(
+                cloudwatch_metrics_enabled=False,
+                metric_name="friendly-metric-name",
+                sampled_requests_enabled=False
+            )
+        )
+        Wafv2WebAcl(self, "test",
+            default_action=Wafv2WebAclDefaultAction(
+                block=Wafv2WebAclDefaultActionBlock()
+            ),
+            name="rule-group-example",
+            rule=[Wafv2WebAclRule(
+                name="rule-1",
+                override_action=Wafv2WebAclRuleOverrideAction(
+                    count=Wafv2WebAclRuleOverrideActionCount()
+                ),
+                priority=1,
+                statement=Wafv2WebAclRuleStatement(
+                    rule_group_reference_statement=Wafv2WebAclRuleStatementRuleGroupReferenceStatement(
+                        arn=example.arn,
+                        rule_action_override=[Wafv2WebAclRuleStatementRuleGroupReferenceStatementRuleActionOverride(
+                            action_to_use=Wafv2WebAclRuleStatementRuleGroupReferenceStatementRuleActionOverrideActionToUse(
+                                count=Wafv2WebAclRuleStatementRuleGroupReferenceStatementRuleActionOverrideActionToUseCount()
+                            ),
+                            name="rule-to-exclude-b"
+                        ), Wafv2WebAclRuleStatementRuleGroupReferenceStatementRuleActionOverride(
+                            action_to_use=Wafv2WebAclRuleStatementRuleGroupReferenceStatementRuleActionOverrideActionToUse(
+                                count=Wafv2WebAclRuleStatementRuleGroupReferenceStatementRuleActionOverrideActionToUseCount()
+                            ),
+                            name="rule-to-exclude-a"
+                        )
+                        ]
+                    )
+                ),
+                visibility_config=Wafv2WebAclRuleVisibilityConfig(
+                    cloudwatch_metrics_enabled=False,
+                    metric_name="friendly-rule-metric-name",
+                    sampled_requests_enabled=False
+                )
+            )
+            ],
+            scope="REGIONAL",
+            tags={
+                "Tag1": "Value1",
+                "Tag2": "Value2"
+            },
+            visibility_config=Wafv2WebAclVisibilityConfig(
+                cloudwatch_metrics_enabled=False,
+                metric_name="friendly-metric-name",
+                sampled_requests_enabled=False
+            )
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `association_config` - (Optional) Specifies custom configurations for the associations between the web ACL and protected resources. See [`association_config`](#association_config-block) below for details.
+* `custom_response_body` - (Optional) Defines custom response bodies that can be referenced by `custom_response` actions. See [`custom_response_body`](#custom_response_body-block) below for details.
+* `default_action` - (Required) Action to perform if none of the `rules` contained in the WebACL match. See [`default_action`](#default_action-block) below for details.
+* `description` - (Optional) Friendly description of the WebACL.
+* `name` - (Required) Friendly name of the WebACL.
+* `rule` - (Optional) Rule blocks used to identify the web requests that you want to `allow`, `block`, or `count`. See [`rule`](#rule-block) below for details.
+* `scope` - (Required) Specifies whether this is for an AWS CloudFront distribution or for a regional application. Valid values are `CLOUDFRONT` or `REGIONAL`. To work with CloudFront, you must also specify the region `us-east-1` (N. Virginia) on the AWS provider.
+* `tags` - (Optional) Map of key-value pairs to associate with the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `token_domains` - (Optional) Specifies the domains that AWS WAF should accept in a web request token. This enables the use of tokens across multiple protected websites. When AWS WAF provides a token, it uses the domain of the AWS resource that the web ACL is protecting. If you don't specify a list of token domains, AWS WAF accepts tokens only for the domain of the protected resource. With a token domain list, AWS WAF accepts the resource's host domain plus all domains in the token domain list, including their prefixed subdomains.
+* `visibility_config` - (Required) Defines and enables Amazon CloudWatch metrics and web request sample collection. See [`visibility_config`](#visibility_config-block) below for details.
+
+### `association_config` Block
+
+The `association_config` block supports the following arguments:
+
+* `request_body` - (Optional) Customizes the request body that your protected resource forward to AWS WAF for inspection. See [`request_body`](#request_body-block) below for details.
+
+### `custom_response_body` Block
+
+Each `custom_response_body` block supports the following arguments:
+
+* `key` - (Required) Unique key identifying the custom response body. This is referenced by the `custom_response_body_key` argument in the [`custom_response`](#custom_response-block) block.
+* `content` - (Required) Payload of the custom response.
+* `content_type` - (Required) Type of content in the payload that you are defining in the `content` argument. Valid values are `TEXT_PLAIN`, `TEXT_HTML`, or `APPLICATION_JSON`.
+
+### `default_action` Block
+
+The `default_action` block supports the following arguments:
+
+~> **Note** One of `allow` or `block`, expressed as an empty configuration block `{}`, is required when specifying a `default_action`
+
+* `allow` - (Optional) Specifies that AWS WAF should allow requests by default. See [`allow`](#allow-block) below for details.
+* `block` - (Optional) Specifies that AWS WAF should block requests by default. See [`block`](#block-block) below for details.
+
+### `rule` Block
+
+~> **Note** One of `action` or `override_action` is required when specifying a rule
+
+Each `rule` supports the following arguments:
+
+* `action` - (Optional) Action that AWS WAF should take on a web request when it matches the rule's statement. This is used only for rules whose **statements do not reference a rule group**. See [`action`](#action-block) for details.
+* `captcha_config` - (Optional) Specifies how AWS WAF should handle CAPTCHA evaluations. See [`captcha_config`](#captcha_config-block) below for details.
+* `name` - (Required) Friendly name of the rule. Note that the provider assumes that rules with names matching this pattern, `^ShieldMitigationRuleGroup_<account-id>_<web-acl-guid>_.*`, are AWS-added for [automatic application layer DDoS mitigation activities](https://docs.aws.amazon.com/waf/latest/developerguide/ddos-automatic-app-layer-response-rg.html). Such rules will be ignored by the provider unless you explicitly include them in your configuration (for example, by using the AWS CLI to discover their properties and creating matching configuration). However, since these rules are owned and managed by AWS, you may get permission errors.
+* `override_action` - (Optional) Override action to apply to the rules in a rule group. Used only for rule **statements that reference a rule group**, like `rule_group_reference_statement` and `managed_rule_group_statement`. See [`override_action`](#override_action-block) below for details.
+* `priority` - (Required) If you define more than one Rule in a WebACL, AWS WAF evaluates each request against the `rules` in order based on the value of `priority`. AWS WAF processes rules with lower priority first.
+* `rule_label` - (Optional) Labels to apply to web requests that match the rule match statement. See [`rule_label`](#rule_label-block) below for details.
+* `statement` - (Required) The AWS WAF processing statement for the rule, for example `byte_match_statement` or `geo_match_statement`. See [`statement`](#statement-block) below for details.
+* `visibility_config` - (Required) Defines and enables Amazon CloudWatch metrics and web request sample collection. See [`visibility_config`](#visibility_config-block) below for details.
+
+### `action` Block
+
+The `action` block supports the following arguments:
+
+~> **Note** One of `allow`, `block`, or `count`, is required when specifying an `action`.
+
+* `allow` - (Optional) Instructs AWS WAF to allow the web request. See [`allow`](#allow-block) below for details.
+* `block` - (Optional) Instructs AWS WAF to block the web request. See [`block`](#block-block) below for details.
+* `captcha` - (Optional) Instructs AWS WAF to run a Captcha check against the web request. See [`captcha`](#captcha-block) below for details.
+* `challenge` - (Optional) Instructs AWS WAF to run a check against the request to verify that the request is coming from a legitimate client session. See [`challenge`](#challenge-block) below for details.
+* `count` - (Optional) Instructs AWS WAF to count the web request and allow it. See [`count`](#count-block) below for details.
+
+### `override_action` Block
+
+The `override_action` block supports the following arguments:
+
+~> **Note** One of `count` or `none`, expressed as an empty configuration block `{}`, is required when specifying an `override_action`
+
+* `count` - (Optional) Override the rule action setting to count (i.e., only count matches). Configured as an empty block `{}`.
+* `none` - (Optional) Don't override the rule action setting. Configured as an empty block `{}`.
+
+### `allow` Block
+
+The `allow` block supports the following arguments:
+
+* `custom_request_handling` - (Optional) Defines custom handling for the web request. See [`custom_request_handling`](#custom_request_handling-block) below for details.
+
+### `block` Block
+
+The `block` block supports the following arguments:
+
+* `custom_response` - (Optional) Defines a custom response for the web request. See [`custom_response`](#custom_response-block) below for details.
+
+### `captcha` Block
+
+The `captcha` block supports the following arguments:
+
+* `custom_request_handling` - (Optional) Defines custom handling for the web request. See [`custom_request_handling`](#custom_request_handling-block) below for details.
+
+### `challenge` Block
+
+The `challenge` block supports the following arguments:
+
+* `custom_request_handling` - (Optional) Defines custom handling for the web request. See [`custom_request_handling`](#custom_request_handling-block) below for details.
+
+### `count` Block
+
+The `count` block supports the following arguments:
+
+* `custom_request_handling` - (Optional) Defines custom handling for the web request. See [`custom_request_handling`](#custom_request_handling-block) below for details.
+
+### `custom_request_handling` Block
+
+The `custom_request_handling` block supports the following arguments:
+
+* `insert_header` - (Required) The `insert_header` blocks used to define HTTP headers added to the request. See [`insert_header`](#insert_header-block) below for details.
+
+### `insert_header` Block
+
+Each `insert_header` block supports the following arguments. Duplicate header names are not allowed:
+
+* `name` - Name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+* `value` - Value of the custom header.
+
+### `custom_response` Block
+
+The `custom_response` block supports the following arguments:
+
+* `custom_response_body_key` - (Optional) References the response body that you want AWS WAF to return to the web request client. This must reference a `key` defined in a `custom_response_body` block of this resource.
+* `response_code` - (Required) The HTTP status code to return to the client.
+* `response_header` - (Optional) The `response_header` blocks used to define the HTTP response headers added to the response. See [`response_header`](#response_header-block) below for details.
+
+### `response_header` Block
+
+Each `response_header` block supports the following arguments. Duplicate header names are not allowed:
+
+* `name` - Name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
+* `value` - Value of the custom header.
+
+### `rule_label` Block
+
+Each block supports the following arguments:
+
+* `name` - Label string.
+
+### `statement` Block
+
+The processing guidance for a Rule, used by AWS WAF to determine whether a web request matches the rule. See the [documentation](https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-statements-list.html) for more information.
+
+-> **Note** Although the `statement` block is recursive, currently only 3 levels are supported.
+
+The `statement` block supports the following arguments:
+
+* `and_statement` - (Optional) Logical rule statement used to combine other rule statements with AND logic. See [`and_statement`](#and_statement-block) below for details.
+* `byte_match_statement` - (Optional) Rule statement that defines a string match search for AWS WAF to apply to web requests. See [`byte_match_statement`](#byte_match_statement-block) below for details.
+* `geo_match_statement` - (Optional) Rule statement used to identify web requests based on country of origin. See [`geo_match_statement`](#geo_match_statement-block) below for details.
+* `ip_set_reference_statement` - (Optional) Rule statement used to detect web requests coming from particular IP addresses or address ranges. See [`ip_set_reference_statement`](#ip_set_reference_statement-block) below for details.
+* `label_match_statement` - (Optional) Rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See [`label_match_statement`](#label_match_statement-block) below for details.
+* `managed_rule_group_statement` - (Optional) Rule statement used to run the rules that are defined in a managed rule group.  This statement can not be nested. See [`managed_rule_group_statement`](#managed_rule_group_statement-block) below for details.
+* `not_statement` - (Optional) Logical rule statement used to negate the results of another rule statement. See [`not_statement`](#not_statement-block) below for details.
+* `or_statement` - (Optional) Logical rule statement used to combine other rule statements with OR logic. See [`or_statement`](#or_statement-block) below for details.
+* `rate_based_statement` - (Optional) Rate-based rule tracks the rate of requests for each originating `IP address`, and triggers the rule action when the rate exceeds a limit that you specify on the number of requests in any `5-minute` time span. This statement can not be nested. See [`rate_based_statement`](#rate_based_statement-block) below for details.
+* `regex_match_statement` - (Optional) Rule statement used to search web request components for a match against a single regular expression. See [`regex_match_statement`](#regex_match_statement-block) below for details.
+* `regex_pattern_set_reference_statement` - (Optional) Rule statement used to search web request components for matches with regular expressions. See [`regex_pattern_set_reference_statement`](#regex_pattern_set_reference_statement-block) below for details.
+* `rule_group_reference_statement` - (Optional) Rule statement used to run the rules that are defined in an WAFv2 Rule Group. See [`rule_group_reference_statement`](#rule_group_reference_statement-block) below for details.
+* `size_constraint_statement` - (Optional) Rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See [`size_constraint_statement`](#size_constraint_statement-block) below for more details.
+* `sqli_match_statement` - (Optional) An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See [`sqli_match_statement`](#sqli_match_statement-block) below for details.
+* `xss_match_statement` - (Optional) Rule statement that defines a cross-site scripting (XSS) match search for AWS WAF to apply to web requests. See [`xss_match_statement`](#xss_match_statement-block) below for details.
+
+### `and_statement` Block
+
+A logical rule statement used to combine other rule statements with `AND` logic. You provide more than one `statement` within the `and_statement`.
+
+The `and_statement` block supports the following arguments:
+
+* `statement` - (Required) Statements to combine with `AND` logic. You can use any statements that can be nested. See [`statement`](#statement-block) above for details.
+
+### `byte_match_statement` Block
+
+The byte match statement provides the bytes to search for, the location in requests that you want AWS WAF to search, and other settings. The bytes to search for are typically a string that corresponds with ASCII characters.
+
+The `byte_match_statement` block supports the following arguments:
+
+* `field_to_match` - (Optional) Part of a web request that you want AWS WAF to inspect. See [`field_to_match`](#field_to_match-block) below for details.
+* `positional_constraint` - (Required) Area within the portion of a web request that you want AWS WAF to search for `search_string`. Valid values include the following: `EXACTLY`, `STARTS_WITH`, `ENDS_WITH`, `CONTAINS`, `CONTAINS_WORD`. See the AWS [documentation](https://docs.aws.amazon.com/waf/latest/APIReference/API_ByteMatchStatement.html) for more information.
+* `search_string` - (Required) String value that you want AWS WAF to search for. AWS WAF searches only in the part of web requests that you designate for inspection in `field_to_match`. The maximum length of the value is 50 bytes.
+* `text_transformation` - (Required) Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection. At least one transformation is required. See [`text_transformation`](#text_transformation-block) below for details.
+
+### `geo_match_statement` Block
+
+The `geo_match_statement` block supports the following arguments:
+
+* `country_codes` - (Required) Array of two-character country codes, for example, [ "US", "CN" ], from the alpha-2 country ISO codes of the `ISO 3166` international standard. See the [documentation](https://docs.aws.amazon.com/waf/latest/APIReference/API_GeoMatchStatement.html) for valid values.
+* `forwarded_ip_config` - (Optional) Configuration for inspecting IP addresses in an HTTP header that you specify, instead of using the IP address that's reported by the web request origin. See [`forwarded_ip_config`](#forwarded_ip_config-block) below for details.
+
+### `ip_set_reference_statement` Block
+
+A rule statement used to detect web requests coming from particular IP addresses or address ranges. To use this, create an `aws_wafv2_ip_set` that specifies the addresses you want to detect, then use the `ARN` of that set in this statement.
+
+The `ip_set_reference_statement` block supports the following arguments:
+
+* `arn` - (Required) The Amazon Resource Name (ARN) of the IP Set that this statement references.
+* `ip_set_forwarded_ip_config` - (Optional) Configuration for inspecting IP addresses in an HTTP header that you specify, instead of using the IP address that's reported by the web request origin. See [`ip_set_forwarded_ip_config`](#ip_set_forwarded_ip_config-block) below for more details.
+
+### `label_match_statement` Block
+
+The `label_match_statement` block supports the following arguments:
+
+* `scope` - (Required) Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
+* `key` - (Required) String to match against.
+
+### `managed_rule_group_statement` Block
+
+A rule statement used to run the rules that are defined in a managed rule group.
+
+You can't nest a `managed_rule_group_statement`, for example for use inside a `not_statement` or `or_statement`. It can only be referenced as a `top-level` statement within a `rule`.
+
+The `managed_rule_group_statement` block supports the following arguments:
+
+* `name` - (Required) Name of the managed rule group.
+* `rule_action_override` - (Optional) Action settings to use in the place of the rule actions that are configured inside the rule group. You specify one override for each rule whose action you want to change. See [`rule_action_override`](#rule_action_override-block) below for details.
+* `managed_rule_group_configs`- (Optional) Additional information that's used by a managed rule group. Only one rule attribute is allowed in each config. See [`managed_rule_group_configs`](#managed_rule_group_configs-block) for more details
+* `scope_down_statement` - Narrows the scope of the statement to matching web requests. This can be any nestable statement, and you can nest statements at any level below this scope-down statement. See [`statement`](#statement-block) above for details.
+* `vendor_name` - (Required) Name of the managed rule group vendor.
+* `version` - (Optional) Version of the managed rule group. You can set `Version_1.0` or `Version_1.1` etc. If you want to use the default version, do not set anything.
+
+### `not_statement` Block
+
+A logical rule statement used to negate the results of another rule statement. You provide one `statement` within the `not_statement`.
+
+The `not_statement` block supports the following arguments:
+
+* `statement` - (Required) Statement to negate. You can use any statement that can be nested. See [`statement`](#statement-block) above for details.
+
+### `or_statement` Block
+
+A logical rule statement used to combine other rule statements with `OR` logic. You provide more than one `statement` within the `or_statement`.
+
+The `or_statement` block supports the following arguments:
+
+* `statement` - (Required) Statements to combine with `OR` logic. You can use any statements that can be nested. See [`statement`](#statement-block) above for details.
+
+### `rate_based_statement` Block
+
+A rate-based rule tracks the rate of requests for each originating IP address, and triggers the rule action when the rate exceeds a limit that you specify on the number of requests in any 5-minute time span. You can use this to put a temporary block on requests from an IP address that is sending excessive requests. See the [documentation](https://docs.aws.amazon.com/waf/latest/APIReference/API_RateBasedStatement.html) for more information.
+
+You can't nest a `rate_based_statement`, for example for use inside a `not_statement` or `or_statement`. It can only be referenced as a `top-level` statement within a `rule`.
+
+The `rate_based_statement` block supports the following arguments:
+
+* `aggregate_key_type` - (Optional) Setting that indicates how to aggregate the request counts. Valid values include: `CONSTANT`, `CUSTOM_KEYS`, `FORWARDED_IP`, or `IP`. Default: `IP`.
+* `custom_key` - (Optional) Aggregate the request counts using one or more web request components as the aggregate keys. See [`custom_key`](#custom_key-block) below for details.
+* `forwarded_ip_config` - (Optional) Configuration for inspecting IP addresses in an HTTP header that you specify, instead of using the IP address that's reported by the web request origin. If `aggregate_key_type` is set to `FORWARDED_IP`, this block is required. See [`forwarded_ip_config`](#forwarded_ip_config-block) below for details.
+* `limit` - (Required) Limit on requests per 5-minute period for a single originating IP address.
+* `scope_down_statement` - (Optional) Optional nested statement that narrows the scope of the rate-based statement to matching web requests. This can be any nestable statement, and you can nest statements at any level below this scope-down statement. See [`statement`](#statement-block) above for details. If `aggregate_key_type` is set to `CONSTANT`, this block is required.
+
+### `regex_match_statement` Block
+
+A rule statement used to search web request components for a match against a single regular expression.
+
+The `regex_match_statement` block supports the following arguments:
+
+* `regex_string` - (Required) String representing the regular expression. Minimum of `1` and maximum of `512` characters.
+* `field_to_match` - (Required) The part of a web request that you want AWS WAF to inspect. See [`field_to_match`](#field_to_match-block) below for details.
+* `text_transformation` - (Required) Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection. At least one transformation is required. See [`text_transformation`](#text_transformation-block) below for details.
+
+### `regex_pattern_set_reference_statement` Block
+
+A rule statement used to search web request components for matches with regular expressions. To use this, create a `aws_wafv2_regex_pattern_set` that specifies the expressions that you want to detect, then use the `ARN` of that set in this statement. A web request matches the pattern set rule statement if the request component matches any of the patterns in the set.
+
+The `regex_pattern_set_reference_statement` block supports the following arguments:
+
+* `arn` - (Required) The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
+* `field_to_match` - (Optional) Part of a web request that you want AWS WAF to inspect. See [`field_to_match`](#field_to_match-block) below for details.
+* `text_transformation` - (Required) Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection. At least one transformation is required. See [`text_transformation`](#text_transformation-block) below for details.
+
+### `rule_group_reference_statement` Block
+
+A rule statement used to run the rules that are defined in an WAFv2 Rule Group or `aws_wafv2_rule_group` resource.
+
+You can't nest a `rule_group_reference_statement`, for example for use inside a `not_statement` or `or_statement`. It can only be referenced as a `top-level` statement within a `rule`.
+
+The `rule_group_reference_statement` block supports the following arguments:
+
+* `arn` - (Required) The Amazon Resource Name (ARN) of the `aws_wafv2_rule_group` resource.
+* `rule_action_override` - (Optional) Action settings to use in the place of the rule actions that are configured inside the rule group. You specify one override for each rule whose action you want to change. See [`rule_action_override`](#rule_action_override-block) below for details.
+
+### `size_constraint_statement` Block
+
+A rule statement that uses a comparison operator to compare a number of bytes against the size of a request component. AWS WAFv2 inspects up to the first 8192 bytes (8 KB) of a request body, and when inspecting the request URI Path, the slash `/` in
+the URI counts as one character.
+
+The `size_constraint_statement` block supports the following arguments:
+
+* `comparison_operator` - (Required) Operator to use to compare the request part to the size setting. Valid values include: `EQ`, `NE`, `LE`, `LT`, `GE`, or `GT`.
+* `field_to_match` - (Optional) Part of a web request that you want AWS WAF to inspect. See [`field_to_match`](#field_to_match-block) below for details.
+* `size` - (Required) Size, in bytes, to compare to the request part, after any transformations. Valid values are integers between 0 and 21474836480, inclusive.
+* `text_transformation` - (Required) Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection. At least one transformation is required. See [`text_transformation`](#text_transformation-block) below for details.
+
+### `sqli_match_statement` Block
+
+An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. Later in the process, when you create a web ACL, you specify whether to allow or block requests that appear to contain malicious SQL code.
+
+The `sqli_match_statement` block supports the following arguments:
+
+* `field_to_match` - (Optional) Part of a web request that you want AWS WAF to inspect. See [`field_to_match`](#field_to_match-block) below for details.
+* `text_transformation` - (Required) Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection. At least one transformation is required. See [`text_transformation`](#text_transformation-block) below for details.
+
+### `xss_match_statement` Block
+
+The XSS match statement provides the location in requests that you want AWS WAF to search and text transformations to use on the search area before AWS WAF searches for character sequences that are likely to be malicious strings.
+
+The `xss_match_statement` block supports the following arguments:
+
+* `field_to_match` - (Optional) Part of a web request that you want AWS WAF to inspect. See [`field_to_match`](#field_to_match-block) below for details.
+* `text_transformation` - (Required) Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection. At least one transformation is required. See [`text_transformation`](#text_transformation-block) below for details.
+
+### `rule_action_override` Block
+
+The `rule_action_override` block supports the following arguments:
+
+* `action_to_use` - (Required) Override action to use, in place of the configured action of the rule in the rule group. See [`action`](#action-block) for details.
+* `name` - (Required) Name of the rule to override. See the [documentation](https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-list.html) for a list of names in the appropriate rule group in use.
+
+### `managed_rule_group_configs` Block
+
+The `managed_rule_group_configs` block support the following arguments:
+
+* `aws_managed_rules_bot_control_rule_set` - (Optional) Additional configuration for using the Bot Control managed rule group. Use this to specify the inspection level that you want to use. See [`aws_managed_rules_bot_control_rule_set`](#aws_managed_rules_bot_control_rule_set-block) for more details
+* `aws_managed_rules_acfp_rule_set` - (Optional) Additional configuration for using the Account Creation Fraud Prevention managed rule group. Use this to specify information such as the registration page of your application and the type of content to accept or reject from the client.
+* `aws_managed_rules_atp_rule_set` - (Optional) Additional configuration for using the Account Takeover Protection managed rule group. Use this to specify information such as the sign-in page of your application and the type of content to accept or reject from the client.
+* `login_path` - (Optional, **Deprecated**) The path of the login endpoint for your application.
+* `password_field` - (Optional, **Deprecated**) Details about your login page password field. See [`password_field`](#password_field-block) for more details.
+* `payload_type`- (Optional, **Deprecated**) The payload type for your login endpoint, either JSON or form encoded.
+* `username_field` - (Optional, **Deprecated**) Details about your login page username field. See [`username_field`](#username_field-block) for more details.
+
+### `aws_managed_rules_bot_control_rule_set` Block
+
+* `inspection_level` - (Optional) The inspection level to use for the Bot Control rule group.
+
+### `aws_managed_rules_acfp_rule_set` Block
+
+* `creation_path` - (Required) The path of the account creation endpoint for your application. This is the page on your website that accepts the completed registration form for a new user. This page must accept POST requests.
+* `enable_regex_in_path` - (Optional) Whether or not to allow the use of regular expressions in the login page path.
+* `registration_page_path` - (Required) The path of the account registration endpoint for your application. This is the page on your website that presents the registration form to new users. This page must accept GET text/html requests.
+* `request_inspection` - (Optional) The criteria for inspecting login requests, used by the ATP rule group to validate credentials usage. See [`request_inspection`](#request_inspection-block) for more details.
+* `response_inspection` - (Optional) The criteria for inspecting responses to login requests, used by the ATP rule group to track login failure rates. Note that Response Inspection is available only on web ACLs that protect CloudFront distributions. See [`response_inspection`](#response_inspection-block) for more details.
+
+### `aws_managed_rules_atp_rule_set` Block
+
+* `enable_regex_in_path` - (Optional) Whether or not to allow the use of regular expressions in the login page path.
+* `login_path` - (Required) The path of the login endpoint for your application.
+* `request_inspection` - (Optional) The criteria for inspecting login requests, used by the ATP rule group to validate credentials usage. See [`request_inspection`](#request_inspection-block) for more details.
+* `response_inspection` - (Optional) The criteria for inspecting responses to login requests, used by the ATP rule group to track login failure rates. Note that Response Inspection is available only on web ACLs that protect CloudFront distributions. See [`response_inspection`](#response_inspection-block) for more details.
+
+### `request_inspection` Block
+
+* `payload_type` (Required) The payload type for your login endpoint, either JSON or form encoded.
+* `username_field` (Required) Details about your login page username field. See [`username_field`](#username_field-block) for more details.
+* `password_field` (Required) Details about your login page password field. See [`password_field`](#password_field-block) for more details.
+
+### `password_field` Block
+
+* `identifier` - (Optional) The name of the password field.
+
+### `username_field` Block
+
+* `identifier` - (Optional) The name of the username field.
+
+### `response_inspection` Block
+
+* `body_contains` (Optional) Configures inspection of the response body. See [`body_contains`](#body_contains-block) for more details.
+* `header` (Optional) Configures inspection of the response header.See [`header`](#header-block) for more details.
+* `json` (Optional) Configures inspection of the response JSON. See [`json`](#json-block) for more details.
+* `status_code` (Optional) Configures inspection of the response status code.See [`status_code`](#status_code-block) for more details.
+
+### `body_contains` Block
+
+* `success_strings` (Required) Strings in the body of the response that indicate a successful login attempt.
+* `failure_strings` (Required) Strings in the body of the response that indicate a failed login attempt.
+
+### `header` Block
+
+* `name` (Required) The name of the header to match against. The name must be an exact match, including case.
+* `success_values` (Required) Values in the response header with the specified name that indicate a successful login attempt.
+* `failure_values` (Required) Values in the response header with the specified name that indicate a failed login attempt.
+
+### `json` Block
+
+* `identifier` (Required) The identifier for the value to match against in the JSON.
+* `success_strings` (Required) Strings in the body of the response that indicate a successful login attempt.
+* `failure_strings` (Required) Strings in the body of the response that indicate a failed login attempt.
+
+### `status_code` Block
+
+* `success_codes` (Required) Status codes in the response that indicate a successful login attempt.
+* `failure_codes` (Required) Status codes in the response that indicate a failed login attempt.
+
+### `field_to_match` Block
+
+The part of a web request that you want AWS WAF to inspect. Include the single `field_to_match` type that you want to inspect, with additional specifications as needed, according to the type. You specify a single request component in `field_to_match` for each rule statement that requires it. To inspect more than one component of a web request, create a separate rule statement for each component. See the [documentation](https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-statement-fields.html#waf-rule-statement-request-component) for more details.
+
+The `field_to_match` block supports the following arguments:
+
+~> **Note** Only one of `all_query_arguments`, `body`, `cookies`, `headers`, `ja3_fingerprint`, `json_body`, `method`, `query_string`, `single_header`, `single_query_argument`, or `uri_path` can be specified. An empty configuration block `{}` should be used when specifying `all_query_arguments`, `method`, or `query_string` attributes.
+
+* `all_query_arguments` - (Optional) Inspect all query arguments.
+* `body` - (Optional) Inspect the request body, which immediately follows the request headers. See [`body`](#body-block) below for details.
+* `cookies` - (Optional) Inspect the cookies in the web request. See [`cookies`](#cookies-block) below for details.
+* `headers` - (Optional) Inspect the request headers. See [`headers`](#headers-block) below for details.
+* `ja3_fingerprint` - (Optional) Inspect the JA3 fingerprint. See [`ja3_fingerprint`](#ja3_fingerprint-block) below for details.
+* `json_body` - (Optional) Inspect the request body as JSON. See [`json_body`](#json_body-block) for details.
+* `method` - (Optional) Inspect the HTTP method. The method indicates the type of operation that the request is asking the origin to perform.
+* `query_string` - (Optional) Inspect the query string. This is the part of a URL that appears after a `?` character, if any.
+* `single_header` - (Optional) Inspect a single header. See [`single_header`](#single_header-block) below for details.
+* `single_query_argument` - (Optional) Inspect a single query argument. See [`single_query_argument`](#single_query_argument-block) below for details.
+* `uri_path` - (Optional) Inspect the request URI path. This is the part of a web request that identifies a resource, for example, `/images/daily-ad.jpg`.
+
+### `forwarded_ip_config` Block
+
+The configuration for inspecting IP addresses in an HTTP header that you specify, instead of using the IP address that's reported by the web request origin. Commonly, this is the X-Forwarded-For (XFF) header, but you can specify any header name. If the specified header isn't present in the request, AWS WAFv2 doesn't apply the rule to the web request at all. AWS WAFv2 only evaluates the first IP address found in the specified HTTP header.
+
+The `forwarded_ip_config` block supports the following arguments:
+
+* `fallback_behavior` - (Required) - Match status to assign to the web request if the request doesn't have a valid IP address in the specified position. Valid values include: `MATCH` or `NO_MATCH`.
+* `header_name` - (Required) - Name of the HTTP header to use for the IP address.
+
+### `ip_set_forwarded_ip_config` Block
+
+The configuration for inspecting IP addresses in an HTTP header that you specify, instead of using the IP address that's reported by the web request origin. Commonly, this is the X-Forwarded-For (XFF) header, but you can specify any header name.
+
+The `ip_set_forwarded_ip_config` block supports the following arguments:
+
+* `fallback_behavior` - (Required) - Match status to assign to the web request if the request doesn't have a valid IP address in the specified position. Valid values include: `MATCH` or `NO_MATCH`.
+* `header_name` - (Required) - Name of the HTTP header to use for the IP address.
+* `position` - (Required) - Position in the header to search for the IP address. Valid values include: `FIRST`, `LAST`, or `ANY`. If `ANY` is specified and the header contains more than 10 IP addresses, AWS WAFv2 inspects the last 10.
+
+### `headers` Block
+
+Inspect the request headers.
+
+The `headers` block supports the following arguments:
+
+* `match_pattern` - (Required) The filter to use to identify the subset of headers to inspect in a web request. The `match_pattern` block supports only one of the following arguments:
+    * `all` - An empty configuration block that is used for inspecting all headers.
+    * `included_headers` - An array of strings that will be used for inspecting headers that have a key that matches one of the provided values.
+    * `excluded_headers` - An array of strings that will be used for inspecting headers that do not have a key that matches one of the provided values.
+* `match_scope` - (Required) The parts of the headers to inspect with the rule inspection criteria. If you specify `All`, AWS WAF inspects both keys and values. Valid values include the following: `ALL`, `Key`, `Value`.
+* `oversize_handling` - (Required) Oversize handling tells AWS WAF what to do with a web request when the request component that the rule inspects is over the limits. Valid values include the following: `CONTINUE`, `MATCH`, `NO_MATCH`. See the AWS [documentation](https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-statement-oversize-handling.html) for more information.
+
+### `ja3_fingerprint` Block
+
+The `ja3_fingerprint` block supports the following arguments:
+
+* `fallback_behavior` - (Required) The match status to assign to the web request if the request doesn't have a JA3 fingerprint. Valid values include: `MATCH` or `NO_MATCH`.
+
+### `json_body` Block
+
+The `json_body` block supports the following arguments:
+
+* `invalid_fallback_behavior` - (Optional) What to do when JSON parsing fails. Defaults to evaluating up to the first parsing failure. Valid values are `EVALUATE_AS_STRING`, `MATCH` and `NO_MATCH`.
+* `match_pattern` - (Required) The patterns to look for in the JSON body. You must specify exactly one setting: either `all` or `included_paths`. See [JsonMatchPattern](https://docs.aws.amazon.com/waf/latest/APIReference/API_JsonMatchPattern.html) for details.
+* `match_scope` - (Required) The parts of the JSON to match against using the `match_pattern`. Valid values are `ALL`, `KEY` and `VALUE`.
+* `oversize_handling` - (Optional) What to do if the body is larger than can be inspected. Valid values are `CONTINUE` (default), `MATCH` and `NO_MATCH`.
+
+### `single_header` Block
+
+Inspect a single header. Provide the name of the header to inspect, for example, `User-Agent` or `Referer` (provided as lowercase strings).
+
+The `single_header` block supports the following arguments:
+
+* `name` - (Optional) Name of the query header to inspect. This setting must be provided as lower case characters.
+
+### `single_query_argument` Block
+
+Inspect a single query argument. Provide the name of the query argument to inspect, such as `UserName` or `SalesRegion` (provided as lowercase strings).
+
+The `single_query_argument` block supports the following arguments:
+
+* `name` - (Optional) Name of the query header to inspect. This setting must be provided as lower case characters.
+
+### `body` Block
+
+The `body` block supports the following arguments:
+
+* `oversize_handling` - (Optional) What WAF should do if the body is larger than WAF can inspect. WAF does not support inspecting the entire contents of the body of a web request when the body exceeds 8 KB (8192 bytes). Only the first 8 KB of the request body are forwarded to WAF by the underlying host service. Valid values: `CONTINUE`, `MATCH`, `NO_MATCH`.
+
+### `cookies` Block
+
+Inspect the cookies in the web request. You can specify the parts of the cookies to inspect and you can narrow the set of cookies to inspect by including or excluding specific keys. This is used to indicate the web request component to inspect, in the [FieldToMatch](https://docs.aws.amazon.com/waf/latest/APIReference/API_FieldToMatch.html) specification.
+
+The `cookies` block supports the following arguments:
+
+* `match_pattern` - (Required) The filter to use to identify the subset of cookies to inspect in a web request. You must specify exactly one setting: either `all`, `included_cookies` or `excluded_cookies`. More details: [CookieMatchPattern](https://docs.aws.amazon.com/waf/latest/APIReference/API_CookieMatchPattern.html)
+* `match_scope` - (Required) The parts of the cookies to inspect with the rule inspection criteria. If you specify All, AWS WAF inspects both keys and values. Valid values: `ALL`, `KEY`, `VALUE`
+* `oversize_handling` - (Required) What AWS WAF should do if the cookies of the request are larger than AWS WAF can inspect. AWS WAF does not support inspecting the entire contents of request cookies when they exceed 8 KB (8192 bytes) or 200 total cookies. The underlying host service forwards a maximum of 200 cookies and at most 8 KB of cookie contents to AWS WAF. Valid values: `CONTINUE`, `MATCH`, `NO_MATCH`.
+
+### `text_transformation` Block
+
+The `text_transformation` block supports the following arguments:
+
+* `priority` - (Required) Relative processing order for multiple transformations that are defined for a rule statement. AWS WAF processes all transformations, from lowest priority to highest, before inspecting the transformed content.
+* `type` - (Required) Transformation to apply, please refer to the Text Transformation [documentation](https://docs.aws.amazon.com/waf/latest/APIReference/API_TextTransformation.html) for more details.
+
+### `visibility_config` Block
+
+The `visibility_config` block supports the following arguments:
+
+* `cloudwatch_metrics_enabled` - (Required) Whether the associated resource sends metrics to CloudWatch. For the list of available metrics, see [AWS WAF Metrics](https://docs.aws.amazon.com/waf/latest/developerguide/monitoring-cloudwatch.html#waf-metrics).
+* `metric_name` - (Required) A friendly name of the CloudWatch metric. The name can contain only alphanumeric characters (A-Z, a-z, 0-9) hyphen(-) and underscore (\_), with length from one to 128 characters. It can't contain whitespace or metric names reserved for AWS WAF, for example `All` and `Default_Action`.
+* `sampled_requests_enabled` - (Required) Whether AWS WAF should store a sampling of the web requests that match the rules. You can view the sampled requests through the AWS WAF console.
+
+### `captcha_config` Block
+
+The `captcha_config` block supports the following arguments:
+
+* `immunity_time_property` - (Optional) Defines custom immunity time. See [`immunity_time_property`](#immunity_time_property-block) below for details.
+
+### `immunity_time_property` Block
+
+The `immunity_time_property` block supports the following arguments:
+
+* `immunity_time` - (Optional) The amount of time, in seconds, that a CAPTCHA or challenge timestamp is considered valid by AWS WAF. The default setting is 300.
+
+### `request_body` Block
+
+The `request_body` block supports the following arguments:
+
+* `cloudfront` - (Optional) Customizes the request body that your protected CloudFront distributions forward to AWS WAF for inspection. See [`cloudfront`](#cloudfront-block) below for details.
+
+### `cloudfront` Block
+
+The `cloudfront` block supports the following arguments:
+
+* `default_size_inspection_limit` - (Required) Specifies the maximum size of the web request body component that an associated CloudFront distribution should send to AWS WAF for inspection. This applies to statements in the web ACL that inspect the body or JSON body. Valid values are `KB_16`, `KB_32`, `KB_48` and `KB_64`.
+
+### `custom_key` Block
+
+Aggregate the request counts using one or more web request components as the aggregate keys. With this option, you must specify the aggregate keys in the `custom_keys` block. To aggregate on only the IP address or only the forwarded IP address, don't use custom keys. Instead, set the `aggregate_key_type` to `IP` or `FORWARDED_IP`.
+
+The `custom_key` block supports the following arguments:
+
+* `cookie` - (Optional) Use the value of a cookie in the request as an aggregate key. See [RateLimit `cookie`](#ratelimit-cookie-block) below for details.
+* `forwarded_ip` - (Optional) Use the first IP address in an HTTP header as an aggregate key. See [`forwarded_ip`](#ratelimit-forwarded_ip-block) below for details.
+* `http_method` - (Optional) Use the request's HTTP method as an aggregate key. See [RateLimit `http_method`](#ratelimit-http_method-block) below for details.
+* `header` - (Optional) Use the value of a header in the request as an aggregate key. See [RateLimit `header`](#ratelimit-header-block) below for details.
+* `ip` - (Optional) Use the request's originating IP address as an aggregate key. See [`RateLimit ip`](#ratelimit-ip-block) below for details.
+* `label_namespace` - (Optional) Use the specified label namespace as an aggregate key. See [RateLimit `label_namespace`](#ratelimit-label_namespace-block) below for details.
+* `query_argument` - (Optional) Use the specified query argument as an aggregate key. See [RateLimit `query_argument`](#ratelimit-query_argument-block) below for details.
+* `query_string` - (Optional) Use the request's query string as an aggregate key. See [RateLimit `query_string`](#ratelimit-query_string-block) below for details.
+* `uri_path` - (Optional) Use the request's URI path as an aggregate key. See [RateLimit `uri_path`](#ratelimit-uri_path-block) below for details.
+
+### RateLimit `cookie` Block
+
+Use the value of a cookie in the request as an aggregate key. Each distinct value in the cookie contributes to the aggregation instance. If you use a single cookie as your custom key, then each value fully defines an aggregation instance.
+
+The `cookie` block supports the following arguments:
+
+* `name`: The name of the cookie to use.
+* `text_transformation`: Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection. They are used in rate-based rule statements, to transform request components before using them as custom aggregation keys. Atleast one transformation is required. See [`text_transformation`](#text_transformation-block) above for details.
+
+### RateLimit `forwarded_ip` Block
+
+Use the first IP address in an HTTP header as an aggregate key. Each distinct forwarded IP address contributes to the aggregation instance. When you specify an IP or forwarded IP in the custom key settings, you must also specify at least one other key to use. You can aggregate on only the forwarded IP address by specifying `FORWARDED_IP` in your rate-based statement's `aggregate_key_type`. With this option, you must specify the header to use in the rate-based rule's [`forwarded_ip_config`](#forwarded_ip_config-block) block.
+
+The `forwarded_ip` block is configured as an empty block `{}`.
+
+### RateLimit `http_method` Block
+
+Use the request's HTTP method as an aggregate key. Each distinct HTTP method contributes to the aggregation instance. If you use just the HTTP method as your custom key, then each method fully defines an aggregation instance.
+
+The `http_method` block is configured as an empty block `{}`.
+
+### RateLimit `header` Block
+
+Use the value of a header in the request as an aggregate key. Each distinct value in the header contributes to the aggregation instance. If you use a single header as your custom key, then each value fully defines an aggregation instance.
+
+The `header` block supports the following arguments:
+
+* `name`: The name of the header to use.
+* `text_transformation`: Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection. They are used in rate-based rule statements, to transform request components before using them as custom aggregation keys. Atleast one transformation is required. See [`text_transformation`](#text_transformation-block) above for details.
+
+### RateLimit `ip` Block
+
+Use the request's originating IP address as an aggregate key. Each distinct IP address contributes to the aggregation instance. When you specify an IP or forwarded IP in the custom key settings, you must also specify at least one other key to use. You can aggregate on only the IP address by specifying `IP` in your rate-based statement's `aggregate_key_type`.
+
+The `ip` block is configured as an empty block `{}`.
+
+### RateLimit `label_namespace` Block
+
+Use the specified label namespace as an aggregate key. Each distinct fully qualified label name that has the specified label namespace contributes to the aggregation instance. If you use just one label namespace as your custom key, then each label name fully defines an aggregation instance. This uses only labels that have been added to the request by rules that are evaluated before this rate-based rule in the web ACL. For information about label namespaces and names, see Label syntax and naming requirements (https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-label-requirements.html) in the WAF Developer Guide.
+
+The `label_namespace` block supports the following arguments:
+
+* `namespace`: The namespace to use for aggregation
+
+### RateLimit `query_argument` Block
+
+Use the specified query argument as an aggregate key. Each distinct value for the named query argument contributes to the aggregation instance. If you use a single query argument as your custom key, then each value fully defines an aggregation instance.
+
+The `query_argument` block supports the following arguments:
+
+* `name`: The name of the query argument to use.
+* `text_transformation`: Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection. They are used in rate-based rule statements, to transform request components before using them as custom aggregation keys. Atleast one transformation is required. See [`text_transformation`](#text_transformation-block) above for details.
+
+### RateLimit `query_string` Block
+
+Use the request's query string as an aggregate key. Each distinct string contributes to the aggregation instance. If you use just the query string as your custom key, then each string fully defines an aggregation instance.
+
+The `query_string` block supports the following arguments:
+
+* `text_transformation`: Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection. They are used in rate-based rule statements, to transform request components before using them as custom aggregation keys. Atleast one transformation is required. See [`text_transformation`](#text_transformation-block) above for details.
+
+### RateLimit `uri_path` Block
+
+Use the request's URI path as an aggregate key. Each distinct URI path contributes to the aggregation instance. If you use just the URI path as your custom key, then each URI path fully defines an aggregation instance.
+
+The `uri_path` block supports the following arguments:
+
+* `text_transformation`: Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection. They are used in rate-based rule statements, to transform request components before using them as custom aggregation keys. Atleast one transformation is required. See [`text_transformation`](#text_transformation-block) above for details.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the WAF WebACL.
+* `capacity` - Web ACL capacity units (WCUs) currently being used by this web ACL.
+* `id` - The ID of the WAF WebACL.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WAFv2 Web ACLs using `ID/Name/Scope`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import WAFv2 Web ACLs using `ID/Name/Scope`. For example:
+
+```console
+% terraform import aws_wafv2_web_acl.example a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc/example/REGIONAL
+```
+
+<!-- cache-key: cdktf-0.18.0 input-bb7e42f63763364f8c9c28922974f072b6dc15b1c389b5eb3fceec122747038c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/wafv2_web_acl_association.html.markdown b/website/docs/cdktf/python/r/wafv2_web_acl_association.html.markdown
new file mode 100644
index 00000000000..490c58190d8
--- /dev/null
+++ b/website/docs/cdktf/python/r/wafv2_web_acl_association.html.markdown
@@ -0,0 +1,122 @@
+---
+subcategory: "WAF"
+layout: "aws"
+page_title: "AWS: aws_wafv2_web_acl_association"
+description: |-
+  Creates a WAFv2 Web ACL Association.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_wafv2_web_acl_association
+
+Creates a WAFv2 Web ACL Association.
+
+~> **NOTE on associating a WAFv2 Web ACL with a Cloudfront distribution:** Do not use this resource to associate a WAFv2 Web ACL with a Cloudfront Distribution. The [AWS API call backing this resource][1] notes that you should use the [`web_acl_id`][2] property on the [`cloudfront_distribution`][2] instead.
+
+[1]: https://docs.aws.amazon.com/waf/latest/APIReference/API_AssociateWebACL.html
+[2]: /docs/providers/aws/r/cloudfront_distribution.html#web_acl_id
+
+## Example Usage
+
+```terraform
+resource "aws_api_gateway_rest_api" "example" {
+  body = jsonencode({
+    openapi = "3.0.1"
+    info = {
+      title   = "example"
+      version = "1.0"
+    }
+    paths = {
+      "/path1" = {
+        get = {
+          x-amazon-apigateway-integration = {
+            httpMethod           = "GET"
+            payloadFormatVersion = "1.0"
+            type                 = "HTTP_PROXY"
+            uri                  = "https://ip-ranges.amazonaws.com/ip-ranges.json"
+          }
+        }
+      }
+    }
+  })
+
+  name = "example"
+}
+
+resource "aws_api_gateway_deployment" "example" {
+  rest_api_id = aws_api_gateway_rest_api.example.id
+
+  triggers = {
+    redeployment = sha1(jsonencode(aws_api_gateway_rest_api.example.body))
+  }
+
+  lifecycle {
+    create_before_destroy = true
+  }
+}
+
+resource "aws_api_gateway_stage" "example" {
+  deployment_id = aws_api_gateway_deployment.example.id
+  rest_api_id   = aws_api_gateway_rest_api.example.id
+  stage_name    = "example"
+}
+
+resource "aws_wafv2_web_acl" "example" {
+  name  = "web-acl-association-example"
+  scope = "REGIONAL"
+
+  default_action {
+    allow {}
+  }
+
+  visibility_config {
+    cloudwatch_metrics_enabled = false
+    metric_name                = "friendly-metric-name"
+    sampled_requests_enabled   = false
+  }
+}
+
+resource "aws_wafv2_web_acl_association" "example" {
+  resource_arn = aws_api_gateway_stage.example.arn
+  web_acl_arn  = aws_wafv2_web_acl.example.arn
+}
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `resource_arn` - (Required) The Amazon Resource Name (ARN) of the resource to associate with the web ACL. This must be an ARN of an Application Load Balancer, an Amazon API Gateway stage, an Amazon Cognito User Pool, an Amazon AppSync GraphQL API, an Amazon App Runner service, or an Amazon Verified Access instance.
+* `web_acl_arn` - (Required) The Amazon Resource Name (ARN) of the Web ACL that you want to associate with the resource.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Timeouts
+
+[Configuration options](https://www.terraform.io/docs/configuration/blocks/resources/syntax.html#operation-timeouts):
+
+* `create` - (Default `5m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WAFv2 Web ACL Association using `WEB_ACL_ARN,RESOURCE_ARN`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import WAFv2 Web ACL Association using `WEB_ACL_ARN,RESOURCE_ARN`. For example:
+
+```console
+% terraform import aws_wafv2_web_acl_association.example arn:aws:wafv2:...7ce849ea,arn:aws:apigateway:...ages/name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1e2fe2da46ac8dc4f7bb916c998d2fa6d086f0a49db050025c26062f5eca9dc3 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/wafv2_web_acl_logging_configuration.html.markdown b/website/docs/cdktf/python/r/wafv2_web_acl_logging_configuration.html.markdown
new file mode 100644
index 00000000000..08aabd4d922
--- /dev/null
+++ b/website/docs/cdktf/python/r/wafv2_web_acl_logging_configuration.html.markdown
@@ -0,0 +1,254 @@
+---
+subcategory: "WAF"
+layout: "aws"
+page_title: "AWS: aws_wafv2_web_acl_logging_configuration"
+description: |-
+  Create a resource for WAFv2 Web ACL Logging Configuration.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_wafv2_web_acl_logging_configuration
+
+This resource creates a WAFv2 Web ACL Logging Configuration.
+
+!> **WARNING:** When logging from a WAFv2 Web ACL to a CloudWatch Log Group, the WAFv2 service tries to create or update a generic Log Resource Policy named `AWSWAF-LOGS`. However, if there are a large number of Web ACLs or if the account frequently creates and deletes Web ACLs, this policy may exceed the maximum policy size. As a result, this resource type will fail to be created. More details about this issue can be found in [this issue](https://github.com/hashicorp/terraform-provider-aws/issues/25296). To prevent this issue, you can manage a specific resource policy. Please refer to the [example](#with-cloudwatch-log-group-and-managed-cloudwatch-log-resource-policy) below for managing a CloudWatch Log Group with a managed CloudWatch Log Resource Policy.
+
+## Example Usage
+
+### With Redacted Fields
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.wafv2_web_acl_logging_configuration import Wafv2WebAclLoggingConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Wafv2WebAclLoggingConfiguration(self, "example",
+            log_destination_configs=[
+                Token.as_string(aws_kinesis_firehose_delivery_stream_example.arn)
+            ],
+            redacted_fields=[Wafv2WebAclLoggingConfigurationRedactedFields(
+                single_header=Wafv2WebAclLoggingConfigurationRedactedFieldsSingleHeader(
+                    name="user-agent"
+                )
+            )
+            ],
+            resource_arn=Token.as_string(aws_wafv2_web_acl_example.arn)
+        )
+```
+
+### With Logging Filter
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.wafv2_web_acl_logging_configuration import Wafv2WebAclLoggingConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        Wafv2WebAclLoggingConfiguration(self, "example",
+            log_destination_configs=[
+                Token.as_string(aws_kinesis_firehose_delivery_stream_example.arn)
+            ],
+            logging_filter=Wafv2WebAclLoggingConfigurationLoggingFilter(
+                default_behavior="KEEP",
+                filter=[Wafv2WebAclLoggingConfigurationLoggingFilterFilter(
+                    behavior="DROP",
+                    condition=[Wafv2WebAclLoggingConfigurationLoggingFilterFilterCondition(
+                        action_condition=Wafv2WebAclLoggingConfigurationLoggingFilterFilterConditionActionCondition(
+                            action="COUNT"
+                        )
+                    ), Wafv2WebAclLoggingConfigurationLoggingFilterFilterCondition(
+                        label_name_condition=Wafv2WebAclLoggingConfigurationLoggingFilterFilterConditionLabelNameCondition(
+                            label_name="awswaf:111122223333:rulegroup:testRules:LabelNameZ"
+                        )
+                    )
+                    ],
+                    requirement="MEETS_ALL"
+                ), Wafv2WebAclLoggingConfigurationLoggingFilterFilter(
+                    behavior="KEEP",
+                    condition=[Wafv2WebAclLoggingConfigurationLoggingFilterFilterCondition(
+                        action_condition=Wafv2WebAclLoggingConfigurationLoggingFilterFilterConditionActionCondition(
+                            action="ALLOW"
+                        )
+                    )
+                    ],
+                    requirement="MEETS_ANY"
+                )
+                ]
+            ),
+            resource_arn=Token.as_string(aws_wafv2_web_acl_example.arn)
+        )
+```
+
+### With CloudWatch Log Group and managed CloudWatch Log Resource Policy
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, Fn, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.cloudwatch_log_group import CloudwatchLogGroup
+from imports.aws.cloudwatch_log_resource_policy import CloudwatchLogResourcePolicy
+from imports.aws.data_aws_caller_identity import DataAwsCallerIdentity
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.data_aws_region import DataAwsRegion
+from imports.aws.wafv2_web_acl_logging_configuration import Wafv2WebAclLoggingConfiguration
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = CloudwatchLogGroup(self, "example",
+            name="aws-waf-logs-some-uniq-suffix"
+        )
+        aws_wafv2_web_acl_logging_configuration_example =
+        Wafv2WebAclLoggingConfiguration(self, "example_1",
+            log_destination_configs=[example.arn],
+            resource_arn=Token.as_string(aws_wafv2_web_acl_example.arn)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_wafv2_web_acl_logging_configuration_example.override_logical_id("example")
+        current = DataAwsCallerIdentity(self, "current")
+        data_aws_region_current = DataAwsRegion(self, "current_3")
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_region_current.override_logical_id("current")
+        data_aws_iam_policy_document_example = DataAwsIamPolicyDocument(self, "example_4",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["logs:CreateLogStream", "logs:PutLogEvents"],
+                condition=[DataAwsIamPolicyDocumentStatementCondition(
+                    test="ArnLike",
+                    values=["arn:aws:logs:${" + data_aws_region_current.name + "}:${" + current.account_id + "}:*"
+                    ],
+                    variable="aws:SourceArn"
+                ), DataAwsIamPolicyDocumentStatementCondition(
+                    test="StringEquals",
+                    values=[Token.as_string(Fn.tostring(current.account_id))],
+                    variable="aws:SourceAccount"
+                )
+                ],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["delivery.logs.amazonaws.com"],
+                    type="Service"
+                )
+                ],
+                resources=["${" + example.arn + "}:*"]
+            )
+            ],
+            version="2012-10-17"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        data_aws_iam_policy_document_example.override_logical_id("example")
+        aws_cloudwatch_log_resource_policy_example =
+        CloudwatchLogResourcePolicy(self, "example_5",
+            policy_document=Token.as_string(data_aws_iam_policy_document_example.json),
+            policy_name="webacl-policy-uniq-name"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_cloudwatch_log_resource_policy_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `log_destination_configs` - (Required) Configuration block that allows you to associate Amazon Kinesis Data Firehose, Cloudwatch Log log group, or S3 bucket Amazon Resource Names (ARNs) with the web ACL. **Note:** data firehose, log group, or bucket name **must** be prefixed with `aws-waf-logs-`, e.g. `aws-waf-logs-example-firehose`, `aws-waf-logs-example-log-group`, or `aws-waf-logs-example-bucket`.
+* `logging_filter` - (Optional) Configuration block that specifies which web requests are kept in the logs and which are dropped. It allows filtering based on the rule action and the web request labels applied by matching rules during web ACL evaluation. For more details, refer to the [Logging Filter](#logging-filter) section below.
+* `redacted_fields` - (Optional) Configuration for parts of the request that you want to keep out of the logs. Up to 100 `redacted_fields` blocks are supported. See [Redacted Fields](#redacted-fields) below for more details.
+* `resource_arn` - (Required) Amazon Resource Name (ARN) of the web ACL that you want to associate with `log_destination_configs`.
+
+### Logging Filter
+
+The `logging_filter` block supports the following arguments:
+
+* `default_behavior` - (Required) Default handling for logs that don't match any of the specified filtering conditions. Valid values for `default_behavior` are `KEEP` or `DROP`.
+* `filter` - (Required) Filter(s) that you want to apply to the logs. See [Filter](#filter) below for more details.
+
+### Filter
+
+The `filter` block supports the following arguments:
+
+* `behavior` - (Required) Parameter that determines how to handle logs that meet the conditions and requirements of the filter. The valid values for `behavior` are `KEEP` or `DROP`.
+* `condition` - (Required) Match condition(s) for the filter. See [Condition](#condition) below for more details.
+* `requirement` - (Required) Logic to apply to the filtering conditions. You can specify that a log must match all conditions or at least one condition in order to satisfy the filter. Valid values for `requirement` are `MEETS_ALL` or `MEETS_ANY`.
+
+### Condition
+
+The `condition` block supports the following arguments:
+
+~> **NOTE:** Either the `action_condition` or `label_name_condition` must be specified.
+
+* `action_condition` - (Optional) Configuration for a single action condition. See [Action Condition](#action-condition) below for more details.
+* `label_name_condition` - (Optional) Condition for a single label name. See [Label Name Condition](#label-name-condition) below for more details.
+
+### Action Condition
+
+The `action_condition` block supports the following argument:
+
+* `action` - (Required) Action setting that a log record must contain in order to meet the condition. Valid values for `action` are `ALLOW`, `BLOCK`, and `COUNT`.
+
+### Label Name Condition
+
+The `label_name_condition` block supports the following argument:
+
+* `label_name` - (Required) Name of the label that a log record must contain in order to meet the condition. It must be a fully qualified label name, which includes a prefix, optional namespaces, and the label name itself. The prefix identifies the rule group or web ACL context of the rule that added the label.
+
+### Redacted Fields
+
+The `redacted_fields` block supports the following arguments:
+
+~> **NOTE:** You can only specify one of the following: `method`, `query_string`, `single_header`, or `uri_path`.
+
+* `method` - (Optional) HTTP method to be redacted. It must be specified as an empty configuration block `{}`. The method indicates the type of operation that the request is asking the origin to perform.
+* `query_string` - (Optional) Whether to redact the query string. It must be specified as an empty configuration block `{}`. The query string is the part of a URL that appears after a `?` character, if any.
+* `single_header` - (Optional) "single_header" refers to the redaction of a single header. For more information, please see the details below under [Single Header](#single-header).
+* `uri_path` - (Optional) Configuration block that redacts the request URI path. It should be specified as an empty configuration block `{}`. The URI path is the part of a web request that identifies a resource, such as `/images/daily-ad.jpg`.
+
+### Single Header
+
+To redact a single header, provide the name of the header to be redacted. For example, use `User-Agent` or `Referer` (provided as lowercase strings).
+
+The `single_header` block supports the following arguments:
+
+* `name` - (Optional) Name of the query header to redact. This setting must be provided in lowercase characters.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Amazon Resource Name (ARN) of the WAFv2 Web ACL.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WAFv2 Web ACL Logging Configurations using the ARN of the WAFv2 Web ACL. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import WAFv2 Web ACL Logging Configurations using the ARN of the WAFv2 Web ACL. For example:
+
+```console
+% terraform import aws_wafv2_web_acl_logging_configuration.example arn:aws:wafv2:us-west-2:123456789012:regional/webacl/test-logs/a1b2c3d4-5678-90ab-cdef
+```
+
+<!-- cache-key: cdktf-0.18.0 input-25f3c0d8db1fe2e19c84f4ebb5edd1ab40bd0204a16eb4042e8db839d72d6f44 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/worklink_fleet.html.markdown b/website/docs/cdktf/python/r/worklink_fleet.html.markdown
new file mode 100644
index 00000000000..a81bc63483c
--- /dev/null
+++ b/website/docs/cdktf/python/r/worklink_fleet.html.markdown
@@ -0,0 +1,139 @@
+---
+subcategory: "WorkLink"
+layout: "aws"
+page_title: "AWS: aws_worklink_fleet"
+description: |-
+  Provides a AWS WorkLink Fleet resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_worklink_fleet
+
+## Example Usage
+
+Basic usage:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.worklink_fleet import WorklinkFleet
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        WorklinkFleet(self, "example",
+            name="terraform-example"
+        )
+```
+
+Network Configuration Usage:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.worklink_fleet import WorklinkFleet
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        WorklinkFleet(self, "example",
+            name="terraform-example",
+            network=WorklinkFleetNetwork(
+                security_group_ids=[test.id],
+                subnet_ids=[
+                    Token.as_string(Fn.lookup_nested(aws_subnet_test, ["*", "id"]))
+                ],
+                vpc_id=Token.as_string(aws_vpc_test.id)
+            )
+        )
+```
+
+Identity Provider Configuration Usage:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.worklink_fleet import WorklinkFleet
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        WorklinkFleet(self, "test",
+            identity_provider=WorklinkFleetIdentityProvider(
+                saml_metadata=Token.as_string(Fn.file("saml-metadata.xml")),
+                type="SAML"
+            ),
+            name="tf-worklink-fleet"
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) A region-unique name for the AMI.
+* `audit_stream_arn` - (Optional) The ARN of the Amazon Kinesis data stream that receives the audit events. Kinesis data stream name must begin with `"AmazonWorkLink-"`.
+* `device_ca_certificate` - (Optional) The certificate chain, including intermediate certificates and the root certificate authority certificate used to issue device certificates.
+* `identity_provider` - (Optional) Provide this to allow manage the identity provider configuration for the fleet. Fields documented below.
+* `display_name` - (Optional) The name of the fleet.
+* `network` - (Optional) Provide this to allow manage the company network configuration for the fleet. Fields documented below.
+* `optimize_for_end_user_location` - (Optional) The option to optimize for better performance by routing traffic through the closest AWS Region to users, which may be outside of your home Region. Defaults to `true`.
+
+**network** requires the following:
+
+~> **NOTE:** `network` cannot be removed without force recreating by `terraform taint`.
+
+* `vpc_id` - (Required) The VPC ID with connectivity to associated websites.
+* `subnet_ids` - (Required) A list of subnet IDs used for X-ENI connections from Amazon WorkLink rendering containers.
+* `security_group_ids` - (Required) A list of security group IDs associated with access to the provided subnets.
+
+**identity_provider** requires the following:
+
+~> **NOTE:** `identity_provider` cannot be removed without force recreating by `terraform taint`.
+
+* `type` - (Required) The type of identity provider.
+* `saml_metadata` - (Required) The SAML metadata document provided by the customer’s identity provider.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ARN of the created WorkLink Fleet.
+* `arn` - The ARN of the created WorkLink Fleet.
+* `company_code` - The identifier used by users to sign in to the Amazon WorkLink app.
+* `created_time` - The time that the fleet was created.
+* `last_updated_time` - The time that the fleet was last updated.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WorkLink using the ARN. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import WorkLink using the ARN. For example:
+
+```console
+% terraform import aws_worklink_fleet.test arn:aws:worklink::123456789012:fleet/example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-e7ee1bb443346fba441c55fe6024eae415cbde38eca738fd5b316c9affc96fc9 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/worklink_website_certificate_authority_association.html.markdown b/website/docs/cdktf/python/r/worklink_website_certificate_authority_association.html.markdown
new file mode 100644
index 00000000000..9643e8a37a7
--- /dev/null
+++ b/website/docs/cdktf/python/r/worklink_website_certificate_authority_association.html.markdown
@@ -0,0 +1,70 @@
+---
+subcategory: "WorkLink"
+layout: "aws"
+page_title: "AWS: aws_worklink_website_certificate_authority_association"
+description: |-
+  Provides a AWS WorkLink Website Certificate Authority Association resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_worklink_website_certificate_authority_association
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Fn, Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.worklink_fleet import WorklinkFleet
+from imports.aws.worklink_website_certificate_authority_association import WorklinkWebsiteCertificateAuthorityAssociation
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        WorklinkFleet(self, "example",
+            name="terraform-example"
+        )
+        WorklinkWebsiteCertificateAuthorityAssociation(self, "test",
+            certificate=Token.as_string(Fn.file("certificate.pem")),
+            fleet_arn=Token.as_string(aws_worklink_fleet_test.arn)
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `fleet_arn` - (Required, ForceNew) The ARN of the fleet.
+* `certificate` - (Required, ForceNew) The root certificate of the Certificate Authority.
+* `display_name` - (Optional, ForceNew) The certificate name to display.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `website_ca_id` - A unique identifier for the Certificate Authority.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WorkLink Website Certificate Authority using `FLEET-ARN,WEBSITE-CA-ID`. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import WorkLink Website Certificate Authority using `FLEET-ARN,WEBSITE-CA-ID`. For example:
+
+```console
+% terraform import aws_worklink_website_certificate_authority_association.example arn:aws:worklink::123456789012:fleet/example,abcdefghijk
+```
+
+<!-- cache-key: cdktf-0.18.0 input-2b2af5570bf7a64a89f55e81e480cfdcd1196d55b06f0523cabcef0e95e941f7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/workspaces_connection_alias.html.markdown b/website/docs/cdktf/python/r/workspaces_connection_alias.html.markdown
new file mode 100644
index 00000000000..5322bc124e1
--- /dev/null
+++ b/website/docs/cdktf/python/r/workspaces_connection_alias.html.markdown
@@ -0,0 +1,79 @@
+---
+subcategory: "WorkSpaces"
+layout: "aws"
+page_title: "AWS: aws_workspaces_connection_alias"
+description: |-
+  Terraform resource for managing an AWS WorkSpaces Connection Alias.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_workspaces_connection_alias
+
+Terraform resource for managing an AWS WorkSpaces Connection Alias.
+
+## Example Usage
+
+### Basic Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.workspaces_connection_alias import WorkspacesConnectionAlias
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        WorkspacesConnectionAlias(self, "example",
+            connection_string="testdomain.test"
+        )
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `connection_string` - (Required) The connection string specified for the connection alias. The connection string must be in the form of a fully qualified domain name (FQDN), such as www.example.com.
+* `tags` – (Optional) A map of tags assigned to the WorkSpaces Connection Alias. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The identifier of the connection alias.
+* `owner_account_id` - The identifier of the Amazon Web Services account that owns the connection alias.
+* `state` - The current state of the connection alias.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `60m`)
+* `update` - (Default `180m`)
+* `delete` - (Default `90m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WorkSpaces Connection Alias using the connection alias ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import WorkSpaces Connection Alias using the connection alias ID. For example:
+
+```console
+% terraform import aws_workspaces_connection_alias.example rft-8012925589
+```
+
+<!-- cache-key: cdktf-0.18.0 input-413fd75316cfeb359e07cefddd821d90ecf5ceabe738b42d92da1fd7d2704797 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/workspaces_directory.html.markdown b/website/docs/cdktf/python/r/workspaces_directory.html.markdown
new file mode 100644
index 00000000000..17d8f29a9a9
--- /dev/null
+++ b/website/docs/cdktf/python/r/workspaces_directory.html.markdown
@@ -0,0 +1,233 @@
+---
+subcategory: "WorkSpaces"
+layout: "aws"
+page_title: "AWS: aws_workspaces_directory"
+description: |-
+  Provides a WorkSpaces directory in AWS WorkSpaces Service.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_workspaces_directory
+
+Provides a WorkSpaces directory in AWS WorkSpaces Service.
+
+~> **NOTE:** AWS WorkSpaces service requires [`workspaces_DefaultRole`](https://docs.aws.amazon.com/workspaces/latest/adminguide/workspaces-access-control.html#create-default-role) IAM role to operate normally.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.directory_service_directory import DirectoryServiceDirectory
+from imports.aws.iam_role import IamRole
+from imports.aws.iam_role_policy_attachment import IamRolePolicyAttachment
+from imports.aws.subnet import Subnet
+from imports.aws.vpc import Vpc
+from imports.aws.workspaces_directory import WorkspacesDirectory
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = Vpc(self, "example",
+            cidr_block="10.0.0.0/16"
+        )
+        workspaces = DataAwsIamPolicyDocument(self, "workspaces",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["sts:AssumeRole"],
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["workspaces.amazonaws.com"],
+                    type="Service"
+                )
+                ]
+            )
+            ]
+        )
+        workspaces_default = IamRole(self, "workspaces_default",
+            assume_role_policy=Token.as_string(workspaces.json),
+            name="workspaces_DefaultRole"
+        )
+        workspaces_default_self_service_access = IamRolePolicyAttachment(self, "workspaces_default_self_service_access",
+            policy_arn="arn:aws:iam::aws:policy/AmazonWorkSpacesSelfServiceAccess",
+            role=workspaces_default.name
+        )
+        workspaces_default_service_access = IamRolePolicyAttachment(self, "workspaces_default_service_access",
+            policy_arn="arn:aws:iam::aws:policy/AmazonWorkSpacesServiceAccess",
+            role=workspaces_default.name
+        )
+        example_a = Subnet(self, "example_a",
+            availability_zone="us-east-1a",
+            cidr_block="10.0.0.0/24",
+            vpc_id=example.id
+        )
+        example_b = Subnet(self, "example_b",
+            availability_zone="us-east-1b",
+            cidr_block="10.0.1.0/24",
+            vpc_id=example.id
+        )
+        example_c = Subnet(self, "example_c",
+            availability_zone="us-east-1c",
+            cidr_block="10.0.2.0/24",
+            vpc_id=example.id
+        )
+        example_d = Subnet(self, "example_d",
+            availability_zone="us-east-1d",
+            cidr_block="10.0.3.0/24",
+            vpc_id=example.id
+        )
+        aws_directory_service_directory_example = DirectoryServiceDirectory(self, "example_9",
+            name="corp.example.com",
+            password="#S1ncerely",
+            size="Small",
+            vpc_settings=DirectoryServiceDirectoryVpcSettings(
+                subnet_ids=[example_a.id, example_b.id],
+                vpc_id=example.id
+            )
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_directory_service_directory_example.override_logical_id("example")
+        aws_workspaces_directory_example = WorkspacesDirectory(self, "example_10",
+            depends_on=[workspaces_default_service_access, workspaces_default_self_service_access
+            ],
+            directory_id=Token.as_string(aws_directory_service_directory_example.id),
+            self_service_permissions=WorkspacesDirectorySelfServicePermissions(
+                change_compute_type=True,
+                increase_volume_size=True,
+                rebuild_workspace=True,
+                restart_workspace=True,
+                switch_running_mode=True
+            ),
+            subnet_ids=[example_c.id, example_d.id],
+            tags={
+                "Example": Token.as_string(True)
+            },
+            workspace_access_properties=WorkspacesDirectoryWorkspaceAccessProperties(
+                device_type_android="ALLOW",
+                device_type_chromeos="ALLOW",
+                device_type_ios="ALLOW",
+                device_type_linux="DENY",
+                device_type_osx="ALLOW",
+                device_type_web="DENY",
+                device_type_windows="DENY",
+                device_type_zeroclient="DENY"
+            ),
+            workspace_creation_properties=WorkspacesDirectoryWorkspaceCreationProperties(
+                custom_security_group_id=Token.as_string(aws_security_group_example.id),
+                default_ou="OU=AWS,DC=Workgroup,DC=Example,DC=com",
+                enable_internet_access=True,
+                enable_maintenance_mode=True,
+                user_enabled_as_local_administrator=True
+            )
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_workspaces_directory_example.override_logical_id("example")
+```
+
+### IP Groups
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.workspaces_directory import WorkspacesDirectory
+from imports.aws.workspaces_ip_group import WorkspacesIpGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        example = WorkspacesIpGroup(self, "example",
+            name="example"
+        )
+        aws_workspaces_directory_example = WorkspacesDirectory(self, "example_1",
+            directory_id=Token.as_string(aws_directory_service_directory_example.id),
+            ip_group_ids=[example.id]
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_workspaces_directory_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `directory_id` - (Required) The directory identifier for registration in WorkSpaces service.
+* `subnet_ids` - (Optional) The identifiers of the subnets where the directory resides.
+* `ip_group_ids` - The identifiers of the IP access control groups associated with the directory.
+* `tags` – (Optional) A map of tags assigned to the WorkSpaces directory. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `self_service_permissions` – (Optional) Permissions to enable or disable self-service capabilities. Defined below.
+* `workspace_access_properties` – (Optional) Specifies which devices and operating systems users can use to access their WorkSpaces. Defined below.
+* `workspace_creation_properties` – (Optional) Default properties that are used for creating WorkSpaces. Defined below.
+
+### self_service_permissions
+
+* `change_compute_type` – (Optional) Whether WorkSpaces directory users can change the compute type (bundle) for their workspace. Default `false`.
+* `increase_volume_size` – (Optional) Whether WorkSpaces directory users can increase the volume size of the drives on their workspace. Default `false`.
+* `rebuild_workspace` – (Optional) Whether WorkSpaces directory users can rebuild the operating system of a workspace to its original state. Default `false`.
+* `restart_workspace` – (Optional) Whether WorkSpaces directory users can restart their workspace. Default `true`.
+* `switch_running_mode` – (Optional) Whether WorkSpaces directory users can switch the running mode of their workspace. Default `false`.
+
+### workspace_access_properties
+
+* `device_type_android` – (Optional) Indicates whether users can use Android devices to access their WorkSpaces.
+* `device_type_chromeos` – (Optional) Indicates whether users can use Chromebooks to access their WorkSpaces.
+* `device_type_ios` – (Optional) Indicates whether users can use iOS devices to access their WorkSpaces.
+* `device_type_linux` – (Optional) Indicates whether users can use Linux clients to access their WorkSpaces.
+* `device_type_osx` – (Optional) Indicates whether users can use macOS clients to access their WorkSpaces.
+* `device_type_web` – (Optional) Indicates whether users can access their WorkSpaces through a web browser.
+* `device_type_windows` – (Optional) Indicates whether users can use Windows clients to access their WorkSpaces.
+* `device_type_zeroclient` – (Optional) Indicates whether users can use zero client devices to access their WorkSpaces.
+
+### workspace_creation_properties
+
+-> **Note:** Once you specified `custom_security_group_id` or `default_ou`, there is no way to delete these attributes. If you cleanup them from the configuration, they still be present in state.
+
+* `custom_security_group_id` – (Optional) The identifier of your custom security group. Should relate to the same VPC, where workspaces reside in.
+* `default_ou` – (Optional) The default organizational unit (OU) for your WorkSpace directories. Should conform `"OU=<value>,DC=<value>,...,DC=<value>"` pattern.
+* `enable_internet_access` – (Optional) Indicates whether internet access is enabled for your WorkSpaces.
+* `enable_maintenance_mode` – (Optional) Indicates whether maintenance mode is enabled for your WorkSpaces. For more information, see [WorkSpace Maintenance](https://docs.aws.amazon.com/workspaces/latest/adminguide/workspace-maintenance.html)..
+* `user_enabled_as_local_administrator` – (Optional) Indicates whether users are local administrators of their WorkSpaces.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The WorkSpaces directory identifier.
+* `alias` - The directory alias.
+* `customer_user_name` - The user name for the service account.
+* `directory_name` - The name of the directory.
+* `directory_type` - The directory type.
+* `dns_ip_addresses` - The IP addresses of the DNS servers for the directory.
+* `iam_role_id` - The identifier of the IAM role. This is the role that allows Amazon WorkSpaces to make calls to other services, such as Amazon EC2, on your behalf.
+* `ip_group_ids` - The identifiers of the IP access control groups associated with the directory.
+* `registration_code` - The registration code for the directory. This is the code that users enter in their Amazon WorkSpaces client application to connect to the directory.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `workspace_security_group_id` - The identifier of the security group that is assigned to new WorkSpaces.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Workspaces directory using the directory ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Workspaces directory using the directory ID. For example:
+
+```console
+% terraform import aws_workspaces_directory.main d-4444444444
+```
+
+<!-- cache-key: cdktf-0.18.0 input-d3c63279ed03f48d66f7e43838d7dd34eb898e70056d69f86ad10924bad87a77 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/workspaces_ip_group.html.markdown b/website/docs/cdktf/python/r/workspaces_ip_group.html.markdown
new file mode 100644
index 00000000000..c7baee94529
--- /dev/null
+++ b/website/docs/cdktf/python/r/workspaces_ip_group.html.markdown
@@ -0,0 +1,90 @@
+---
+subcategory: "WorkSpaces"
+layout: "aws"
+page_title: "AWS: aws_workspaces_ip_group"
+description: |-
+  Provides an IP access control group in AWS WorkSpaces Service.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_workspaces_ip_group
+
+Provides an IP access control group in AWS WorkSpaces Service
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.workspaces_ip_group import WorkspacesIpGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        WorkspacesIpGroup(self, "contractors",
+            description="Contractors IP access control group",
+            name="Contractors",
+            rules=[WorkspacesIpGroupRules(
+                description="NY",
+                source="150.24.14.0/24"
+            ), WorkspacesIpGroupRules(
+                description="LA",
+                source="125.191.14.85/32"
+            ), WorkspacesIpGroupRules(
+                description="STL",
+                source="44.98.100.0/24"
+            )
+            ]
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the IP group.
+* `description` - (Optional) The description of the IP group.
+* `rules` - (Optional) One or more pairs specifying the IP group rule (in CIDR format) from which web requests originate.
+* `tags` – (Optional) A map of tags assigned to the WorkSpaces directory. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Nested Blocks
+
+### `rules`
+
+#### Arguments
+
+* `source` - (Required) The IP address range, in CIDR notation, e.g., `10.0.0.0/16`
+* `description` - (Optional) The description.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The IP group identifier.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WorkSpaces IP groups using their GroupID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import WorkSpaces IP groups using their GroupID. For example:
+
+```console
+% terraform import aws_workspaces_ip_group.example wsipg-488lrtl3k
+```
+
+<!-- cache-key: cdktf-0.18.0 input-4b601bcbe6ec03a647bced3e04fee24a2ec058d79738bc0ec9fc5dbfd30d43de -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/workspaces_workspace.html.markdown b/website/docs/cdktf/python/r/workspaces_workspace.html.markdown
new file mode 100644
index 00000000000..56bbebe11d6
--- /dev/null
+++ b/website/docs/cdktf/python/r/workspaces_workspace.html.markdown
@@ -0,0 +1,113 @@
+---
+subcategory: "WorkSpaces"
+layout: "aws"
+page_title: "AWS: aws_workspaces_workspace"
+description: |-
+  Provides a workspaces in AWS Workspaces Service.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_workspaces_workspace
+
+Provides a workspace in [AWS Workspaces](https://docs.aws.amazon.com/workspaces/latest/adminguide/amazon-workspaces.html) Service
+
+~> **NOTE:** AWS WorkSpaces service requires [`workspaces_DefaultRole`](https://docs.aws.amazon.com/workspaces/latest/adminguide/workspaces-access-control.html#create-default-role) IAM role to operate normally.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_workspaces_bundle import DataAwsWorkspacesBundle
+from imports.aws.workspaces_workspace import WorkspacesWorkspace
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        value_windows10 = DataAwsWorkspacesBundle(self, "value_windows_10",
+            bundle_id="wsb-bh8rsxt14"
+        )
+        WorkspacesWorkspace(self, "example",
+            bundle_id=Token.as_string(value_windows10.id),
+            directory_id=Token.as_string(aws_workspaces_directory_example.id),
+            root_volume_encryption_enabled=True,
+            tags={
+                "Department": "IT"
+            },
+            user_name="john.doe",
+            user_volume_encryption_enabled=True,
+            volume_encryption_key="alias/aws/workspaces",
+            workspace_properties=WorkspacesWorkspaceWorkspaceProperties(
+                compute_type_name="VALUE",
+                root_volume_size_gib=80,
+                running_mode="AUTO_STOP",
+                running_mode_auto_stop_timeout_in_minutes=60,
+                user_volume_size_gib=10
+            )
+        )
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `directory_id` - (Required) The ID of the directory for the WorkSpace.
+* `bundle_id` - (Required) The ID of the bundle for the WorkSpace.
+* `user_name` – (Required) The user name of the user for the WorkSpace. This user name must exist in the directory for the WorkSpace.
+* `root_volume_encryption_enabled` - (Optional) Indicates whether the data stored on the root volume is encrypted.
+* `user_volume_encryption_enabled` – (Optional) Indicates whether the data stored on the user volume is encrypted.
+* `volume_encryption_key` – (Optional) The symmetric AWS KMS customer master key (CMK) used to encrypt data stored on your WorkSpace. Amazon WorkSpaces does not support asymmetric CMKs.
+* `tags` - (Optional) The tags for the WorkSpace. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `workspace_properties` – (Optional) The WorkSpace properties.
+
+`workspace_properties` supports the following:
+
+* `compute_type_name` – (Optional) The compute type. For more information, see [Amazon WorkSpaces Bundles](http://aws.amazon.com/workspaces/details/#Amazon_WorkSpaces_Bundles). Valid values are `VALUE`, `STANDARD`, `PERFORMANCE`, `POWER`, `GRAPHICS`, `POWERPRO`, `GRAPHICSPRO`, `GRAPHICS_G4DN`, and `GRAPHICSPRO_G4DN`.
+* `root_volume_size_gib` – (Optional) The size of the root volume.
+* `running_mode` – (Optional) The running mode. For more information, see [Manage the WorkSpace Running Mode](https://docs.aws.amazon.com/workspaces/latest/adminguide/running-mode.html). Valid values are `AUTO_STOP` and `ALWAYS_ON`.
+* `running_mode_auto_stop_timeout_in_minutes` – (Optional) The time after a user logs off when WorkSpaces are automatically stopped. Configured in 60-minute intervals.
+* `user_volume_size_gib` – (Optional) The size of the user storage.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The workspaces ID.
+* `ip_address` - The IP address of the WorkSpace.
+* `computer_name` - The name of the WorkSpace, as seen by the operating system.
+* `state` - The operational state of the WorkSpace.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `30m`)
+- `update` - (Default `10m`)
+- `delete` - (Default `10m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Workspaces using their ID. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import Workspaces using their ID. For example:
+
+```console
+% terraform import aws_workspaces_workspace.example ws-9z9zmbkhv
+```
+
+<!-- cache-key: cdktf-0.18.0 input-574adeff5bd705e5554426bab9884c262aeb7fe0041d5694569aac9e50fca556 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/xray_encryption_config.html.markdown b/website/docs/cdktf/python/r/xray_encryption_config.html.markdown
new file mode 100644
index 00000000000..acb7b47da7c
--- /dev/null
+++ b/website/docs/cdktf/python/r/xray_encryption_config.html.markdown
@@ -0,0 +1,113 @@
+---
+subcategory: "X-Ray"
+layout: "aws"
+page_title: "AWS: aws_xray_encryption_config"
+description: |-
+    Creates and manages an AWS XRay Encryption Config.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_xray_encryption_config
+
+Creates and manages an AWS XRay Encryption Config.
+
+~> **NOTE:** Removing this resource from Terraform has no effect to the encryption configuration within X-Ray.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.xray_encryption_config import XrayEncryptionConfig
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        XrayEncryptionConfig(self, "example",
+            type="NONE"
+        )
+```
+
+## Example Usage with KMS Key
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import Token, TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.data_aws_caller_identity import DataAwsCallerIdentity
+from imports.aws.data_aws_iam_policy_document import DataAwsIamPolicyDocument
+from imports.aws.kms_key import KmsKey
+from imports.aws.xray_encryption_config import XrayEncryptionConfig
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        current = DataAwsCallerIdentity(self, "current")
+        example = DataAwsIamPolicyDocument(self, "example",
+            statement=[DataAwsIamPolicyDocumentStatement(
+                actions=["kms:*"],
+                effect="Allow",
+                principals=[DataAwsIamPolicyDocumentStatementPrincipals(
+                    identifiers=["arn:aws:iam::${" + current.account_id + "}:root"],
+                    type="AWS"
+                )
+                ],
+                resources=["*"],
+                sid="Enable IAM User Permissions"
+            )
+            ]
+        )
+        aws_kms_key_example = KmsKey(self, "example_2",
+            deletion_window_in_days=7,
+            description="Some Key",
+            policy=Token.as_string(example.json)
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_kms_key_example.override_logical_id("example")
+        aws_xray_encryption_config_example = XrayEncryptionConfig(self, "example_3",
+            key_id=Token.as_string(aws_kms_key_example.arn),
+            type="KMS"
+        )
+        # This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.
+        aws_xray_encryption_config_example.override_logical_id("example")
+```
+
+## Argument Reference
+
+* `type` - (Required) The type of encryption. Set to `KMS` to use your own key for encryption. Set to `NONE` for default encryption.
+* `key_id` - (Optional) An AWS KMS customer master key (CMK) ARN.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Region name.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import XRay Encryption Config using the region name. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import XRay Encryption Config using the region name. For example:
+
+```console
+% terraform import aws_xray_encryption_config.example us-west-2
+```
+
+<!-- cache-key: cdktf-0.18.0 input-55d226205a72425f4aa1a56a07d4e3a41a8d86c6c3b3f83bf024e6de8c19b0ed -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/xray_group.html.markdown b/website/docs/cdktf/python/r/xray_group.html.markdown
new file mode 100644
index 00000000000..f302c91d9ef
--- /dev/null
+++ b/website/docs/cdktf/python/r/xray_group.html.markdown
@@ -0,0 +1,80 @@
+---
+subcategory: "X-Ray"
+layout: "aws"
+page_title: "AWS: aws_xray_group"
+description: |-
+    Creates and manages an AWS XRay Group.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_xray_group
+
+Creates and manages an AWS XRay Group.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.xray_group import XrayGroup
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        XrayGroup(self, "example",
+            filter_expression="responsetime > 5",
+            group_name="example",
+            insights_configuration=XrayGroupInsightsConfiguration(
+                insights_enabled=True,
+                notifications_enabled=True
+            )
+        )
+```
+
+## Argument Reference
+
+* `group_name` - (Required) The name of the group.
+* `filter_expression` - (Required) The filter expression defining criteria by which to group traces. more info can be found in official [docs](https://docs.aws.amazon.com/xray/latest/devguide/xray-console-filters.html).
+* `insights_configuration` - (Optional) Configuration options for enabling insights.
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Nested fields
+
+#### `insights_configuration`
+
+* `insights_enabled` - (Required) Specifies whether insights are enabled.
+* `notifications_enabled` - (Optional) Specifies whether insight notifications are enabled.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ARN of the Group.
+* `arn` - The ARN of the Group.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import XRay Groups using the ARN. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import XRay Groups using the ARN. For example:
+
+```console
+% terraform import aws_xray_group.example arn:aws:xray:us-west-2:1234567890:group/example-group/TNGX7SW5U6QY36T4ZMOUA3HVLBYCZTWDIOOXY3CJAXTHSS3YCWUA
+```
+
+<!-- cache-key: cdktf-0.18.0 input-9e9af30b9adec288e781cee25a67533fbf3d979628ed12ff8336468434aab2be -->
\ No newline at end of file
diff --git a/website/docs/cdktf/python/r/xray_sampling_rule.html.markdown b/website/docs/cdktf/python/r/xray_sampling_rule.html.markdown
new file mode 100644
index 00000000000..8f85e9d066a
--- /dev/null
+++ b/website/docs/cdktf/python/r/xray_sampling_rule.html.markdown
@@ -0,0 +1,90 @@
+---
+subcategory: "X-Ray"
+layout: "aws"
+page_title: "AWS: aws_xray_sampling_rule"
+description: |-
+    Creates and manages an AWS XRay Sampling Rule.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_xray_sampling_rule
+
+Creates and manages an AWS XRay Sampling Rule.
+
+## Example Usage
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+#
+# Provider bindings are generated by running `cdktf get`.
+# See https://cdk.tf/provider-generation for more details.
+#
+from imports.aws.xray_sampling_rule import XraySamplingRule
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+        XraySamplingRule(self, "example",
+            attributes={
+                "Hello": "Tris"
+            },
+            fixed_rate=0.05,
+            host="*",
+            http_method="*",
+            priority=9999,
+            reservoir_size=1,
+            resource_arn="*",
+            rule_name="example",
+            service_name="*",
+            service_type="*",
+            url_path="*",
+            version=1
+        )
+```
+
+## Argument Reference
+
+* `rule_name` - (Required) The name of the sampling rule.
+* `resource_arn` - (Required) Matches the ARN of the AWS resource on which the service runs.
+* `priority` - (Required) The priority of the sampling rule.
+* `fixed_rate` - (Required) The percentage of matching requests to instrument, after the reservoir is exhausted.
+* `reservoir_size` - (Required) A fixed number of matching requests to instrument per second, prior to applying the fixed rate. The reservoir is not used directly by services, but applies to all services using the rule collectively.
+* `service_name` - (Required) Matches the `name` that the service uses to identify itself in segments.
+* `service_type` - (Required) Matches the `origin` that the service uses to identify its type in segments.
+* `host` - (Required) Matches the hostname from a request URL.
+* `http_method` - (Required) Matches the HTTP method of a request.
+* `url_path` - (Required) Matches the path from a request URL.
+* `version` - (Required) The version of the sampling rule format (`1` )
+* `attributes` - (Optional) Matches attributes derived from the request.
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name of the sampling rule.
+* `arn` - The ARN of the sampling rule.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import XRay Sampling Rules using the name. For example:
+
+```python
+# DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+from constructs import Construct
+from cdktf import TerraformStack
+class MyConvertedCode(TerraformStack):
+    def __init__(self, scope, name):
+        super().__init__(scope, name)
+```
+
+Using `terraform import`, import XRay Sampling Rules using the name. For example:
+
+```console
+% terraform import aws_xray_sampling_rule.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-3ca0f87f60b2af282993155f8f46c69e0703d25d278651c0017302f1714b4c23 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/acm_certificate.html.markdown b/website/docs/cdktf/typescript/d/acm_certificate.html.markdown
new file mode 100644
index 00000000000..75bae68f320
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/acm_certificate.html.markdown
@@ -0,0 +1,70 @@
+---
+subcategory: "ACM (Certificate Manager)"
+layout: "aws"
+page_title: "AWS: aws_acm_certificate"
+description: |-
+  Get information on a Amazon Certificate Manager (ACM) Certificate
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_acm_certificate
+
+Use this data source to get the ARN of a certificate in AWS Certificate
+Manager (ACM), you can reference
+it by domain without having to hard code the ARNs as input.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsAcmCertificate } from "./.gen/providers/aws/data-aws-acm-certificate";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsAcmCertificate(this, "amazon_issued", {
+      domain: "tf.example.com",
+      mostRecent: true,
+      types: ["AMAZON_ISSUED"],
+    });
+    new DataAwsAcmCertificate(this, "issued", {
+      domain: "tf.example.com",
+      statuses: ["ISSUED"],
+    });
+    new DataAwsAcmCertificate(this, "rsa_4096", {
+      domain: "tf.example.com",
+      keyTypes: ["RSA_4096"],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `domain` - (Required) Domain of the certificate to look up. If no certificate is found with this name, an error will be returned.
+* `keyTypes` - (Optional) List of key algorithms to filter certificates. By default, ACM does not return all certificate types when searching. See the [ACM API Reference](https://docs.aws.amazon.com/acm/latest/APIReference/API_CertificateDetail.html#ACM-Type-CertificateDetail-KeyAlgorithm) for supported key algorithms.
+* `statuses` - (Optional) List of statuses on which to filter the returned list. Valid values are `pendingValidation`, `issued`,
+   `inactive`, `expired`, `validationTimedOut`, `revoked` and `failed`. If no value is specified, only certificates in the `issued` state
+   are returned.
+* `types` - (Optional) List of types on which to filter the returned list. Valid values are `amazonIssued`, `private`, and `imported`.
+* `mostRecent` - (Optional) If set to true, it sorts the certificates matched by previous criteria by the NotBefore field, returning only the most recent one. If set to false, it returns an error if more than one certificate is found. Defaults to false.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the found certificate, suitable for referencing in other resources that support ACM certificates.
+* `id` - ARN of the found certificate, suitable for referencing in other resources that support ACM certificates.
+* `status` - Status of the found certificate.
+* `certificate` - ACM-issued certificate.
+* `certificateChain` - Certificates forming the requested ACM-issued certificate's chain of trust. The chain consists of the certificate of the issuing CA and the intermediate certificates of any other subordinate CAs.
+* `tags` - Mapping of tags for the resource.
+
+<!-- cache-key: cdktf-0.18.0 input-0827f19734f2b9d26e0cb7f069a9c6094d49e933890f68cd0c6364c65af42e86 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/acmpca_certificate.html.markdown b/website/docs/cdktf/typescript/d/acmpca_certificate.html.markdown
new file mode 100644
index 00000000000..1f44b1cf986
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/acmpca_certificate.html.markdown
@@ -0,0 +1,53 @@
+---
+subcategory: "ACM PCA (Certificate Manager Private Certificate Authority)"
+layout: "aws"
+page_title: "AWS: aws_acmpca_certificate"
+description: |-
+  Get information on a Certificate issued by a AWS Certificate Manager Private Certificate Authority
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_acmpca_certificate
+
+Get information on a Certificate issued by a AWS Certificate Manager Private Certificate Authority.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsAcmpcaCertificate } from "./.gen/providers/aws/data-aws-acmpca-certificate";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsAcmpcaCertificate(this, "example", {
+      arn: "arn:aws:acm-pca:us-east-1:123456789012:certificate-authority/12345678-1234-1234-1234-123456789012/certificate/1234b4a0d73e2056789bdbe77d5b1a23",
+      certificateAuthorityArn:
+        "arn:aws:acm-pca:us-east-1:123456789012:certificate-authority/12345678-1234-1234-1234-123456789012",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `arn` - (Required) ARN of the certificate issued by the private certificate authority.
+* `certificateAuthorityArn` - (Required) ARN of the certificate authority.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `certificate` - PEM-encoded certificate value.
+* `certificateChain` - PEM-encoded certificate chain that includes any intermediate certificates and chains up to root CA.
+
+<!-- cache-key: cdktf-0.18.0 input-f7804d061124fc6489bcc7d11d155c5a561ad1fe6aac3da7e0bdce8a5bdbf606 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/acmpca_certificate_authority.html.markdown b/website/docs/cdktf/typescript/d/acmpca_certificate_authority.html.markdown
new file mode 100644
index 00000000000..009f42005f0
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/acmpca_certificate_authority.html.markdown
@@ -0,0 +1,68 @@
+---
+subcategory: "ACM PCA (Certificate Manager Private Certificate Authority)"
+layout: "aws"
+page_title: "AWS: aws_acmpca_certificate_authority"
+description: |-
+  Get information on a AWS Certificate Manager Private Certificate Authority
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_acmpca_certificate_authority
+
+Get information on a AWS Certificate Manager Private Certificate Authority (ACM PCA Certificate Authority).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsAcmpcaCertificateAuthority } from "./.gen/providers/aws/data-aws-acmpca-certificate-authority";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsAcmpcaCertificateAuthority(this, "example", {
+      arn: "arn:aws:acm-pca:us-east-1:123456789012:certificate-authority/12345678-1234-1234-1234-123456789012",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `arn` - (Required) ARN of the certificate authority.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - ARN of the certificate authority.
+* `certificate` - Base64-encoded certificate authority (CA) certificate. Only available after the certificate authority certificate has been imported.
+* `certificateChain` - Base64-encoded certificate chain that includes any intermediate certificates and chains up to root on-premises certificate that you used to sign your private CA certificate. The chain does not include your private CA certificate. Only available after the certificate authority certificate has been imported.
+* `certificateSigningRequest` - The base64 PEM-encoded certificate signing request (CSR) for your private CA certificate.
+* `usageMode` - Specifies whether the CA issues general-purpose certificates that typically require a revocation mechanism, or short-lived certificates that may optionally omit revocation because they expire quickly.
+* `notAfter` - Date and time after which the certificate authority is not valid. Only available after the certificate authority certificate has been imported.
+* `notBefore` - Date and time before which the certificate authority is not valid. Only available after the certificate authority certificate has been imported.
+* `revocationConfiguration` - Nested attribute containing revocation configuration.
+    * `revocationConfiguration0CrlConfiguration` - Nested attribute containing configuration of the certificate revocation list (CRL), if any, maintained by the certificate authority.
+        * `revocationConfiguration0CrlConfiguration0CustomCname` - Name inserted into the certificate CRL Distribution Points extension that enables the use of an alias for the CRL distribution point.
+        * `revocationConfiguration0CrlConfiguration0Enabled` - Boolean value that specifies whether certificate revocation lists (CRLs) are enabled.
+        * `revocationConfiguration0CrlConfiguration0ExpirationInDays` - Number of days until a certificate expires.
+        * `revocationConfiguration0CrlConfiguration0S3BucketName` - Name of the S3 bucket that contains the CRL.
+        * `revocationConfiguration0CrlConfiguration0S3ObjectAcl` - Whether the CRL is publicly readable or privately held in the CRL Amazon S3 bucket.
+        * `revocationConfiguration0OcspConfiguration0Enabled` - Boolean value that specifies whether a custom OCSP responder is enabled.
+        * `revocationConfiguration0OcspConfiguration0OcspCustomCname` - A CNAME specifying a customized OCSP domain.
+* `serial` - Serial number of the certificate authority. Only available after the certificate authority certificate has been imported.
+* `status` - Status of the certificate authority.
+* `tags` - Key-value map of user-defined tags that are attached to the certificate authority.
+* `type` - Type of the certificate authority.
+
+<!-- cache-key: cdktf-0.18.0 input-bc455641e95958e404dd0619abf86e9d1dc1b0604b9b489c29ed39db56a62037 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/ami.html.markdown b/website/docs/cdktf/typescript/d/ami.html.markdown
new file mode 100644
index 00000000000..0b49be7ec84
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/ami.html.markdown
@@ -0,0 +1,142 @@
+---
+subcategory: "EC2 (Elastic Compute Cloud)"
+layout: "aws"
+page_title: "AWS: aws_ami"
+description: |-
+  Get information on an Amazon Machine Image (AMI).
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_ami
+
+Use this data source to get the ID of a registered AMI for use in other
+resources.
+
+## Example Usage
+
+```terraform
+data "aws_ami" "example" {
+  executable_users = ["self"]
+  most_recent      = true
+  name_regex       = "^myami-\\d{3}"
+  owners           = ["self"]
+
+  filter {
+    name   = "name"
+    values = ["myami-*"]
+  }
+
+  filter {
+    name   = "root-device-type"
+    values = ["ebs"]
+  }
+
+  filter {
+    name   = "virtualization-type"
+    values = ["hvm"]
+  }
+}
+```
+
+## Argument Reference
+
+* `owners` - (Optional) List of AMI owners to limit search. Valid values: an AWS account ID, `self` (the current account), or an AWS owner alias (e.g., `amazon`, `awsMarketplace`, `microsoft`).
+
+* `mostRecent` - (Optional) If more than one result is returned, use the most
+recent AMI.
+
+* `executableUsers` - (Optional) Limit search to users with *explicit* launch permission on
+ the image. Valid items are the numeric account ID or `self`.
+
+* `includeDeprecated` - (Optional) If true, all deprecated AMIs are included in the response. If false, no deprecated AMIs are included in the response. If no value is specified, the default value is false.
+
+* `filter` - (Optional) One or more name/value pairs to filter off of. There are
+several valid keys, for a full reference, check out
+[describe-images in the AWS CLI reference][1].
+
+* `nameRegex` - (Optional) Regex string to apply to the AMI list returned
+by AWS. This allows more advanced filtering not supported from the AWS API. This
+filtering is done locally on what AWS returns, and could have a performance
+impact if the result is large. Combine this with other
+options to narrow down the list AWS returns.
+
+~> **NOTE:** If more or less than a single match is returned by the search,
+Terraform will fail. Ensure that your search is specific enough to return
+a single AMI ID only, or use `mostRecent` to choose the most recent one. If
+you want to match multiple AMIs, use the `awsAmiIds` data source instead.
+
+## Attribute Reference
+
+`id` is set to the ID of the found AMI. In addition, the following attributes
+are exported:
+
+~> **NOTE:** Some values are not always set and may not be available for
+interpolation.
+
+* `arn` - ARN of the AMI.
+* `architecture` - OS architecture of the AMI (ie: `i386` or `x8664`).
+* `bootMode` - Boot mode of the image.
+* `blockDeviceMappings` - Set of objects with block device mappings of the AMI.
+    * `deviceName` - Physical name of the device.
+    * `ebs` - Map containing EBS information, if the device is EBS based. Unlike most object attributes, these are accessed directly (e.g., `ebsVolumeSize` or `ebs["volumeSize"]`) rather than accessed through the first element of a list (e.g., `ebs[0]VolumeSize`).
+        * `deleteOnTermination` - `true` if the EBS volume will be deleted on termination.
+        * `encrypted` - `true` if the EBS volume is encrypted.
+        * `iops` - `0` if the EBS volume is not a provisioned IOPS image, otherwise the supported IOPS count.
+        * `snapshotId` - The ID of the snapshot.
+        * `volumeSize` - The size of the volume, in GiB.
+        * `throughput` - The throughput that the EBS volume supports, in MiB/s.
+        * `volumeType` - The volume type.
+    * `noDevice` - Suppresses the specified device included in the block device mapping of the AMI.
+    * `virtualName` - Virtual device name (for instance stores).
+* `creationDate` - Date and time the image was created.
+* `deprecationTime` - Date and time when the image will be deprecated.
+* `description` - Description of the AMI that was provided during image
+  creation.
+* `hypervisor` - Hypervisor type of the image.
+* `imageId` - ID of the AMI. Should be the same as the resource `id`.
+* `imageLocation` - Location of the AMI.
+* `imageOwnerAlias` - AWS account alias (for example, `amazon`, `self`) or
+  the AWS account ID of the AMI owner.
+* `imageType` - Type of image.
+* `imdsSupport` - Instance Metadata Service (IMDS) support mode for the image. Set to `v20` if instances ran from this image enforce IMDSv2.
+* `kernelId` - Kernel associated with the image, if any. Only applicable
+  for machine images.
+* `name` - Name of the AMI that was provided during image creation.
+* `ownerId` - AWS account ID of the image owner.
+* `platform` - Value is Windows for `windows` AMIs; otherwise blank.
+* `productCodes` - Any product codes associated with the AMI.
+    * `productCodes.#ProductCodeId` - The product code.
+    * `productCodes.#ProductCodeType` - The type of product code.
+* `public` - `true` if the image has public launch permissions.
+* `ramdiskId` - RAM disk associated with the image, if any. Only applicable
+  for machine images.
+* `rootDeviceName` - Device name of the root device.
+* `rootDeviceType` - Type of root device (ie: `ebs` or `instanceStore`).
+* `rootSnapshotId` - Snapshot id associated with the root device, if any
+  (only applies to `ebs` root devices).
+* `sriovNetSupport` - Whether enhanced networking is enabled.
+* `state` - Current state of the AMI. If the state is `available`, the image
+  is successfully registered and can be used to launch an instance.
+* `stateReason` - Describes a state change. Fields are `unset` if not available.
+    * `stateReasonCode` - The reason code for the state change.
+    * `stateReasonMessage` - The message for the state change.
+* `tags` - Any tags assigned to the image.
+    * `tags.#Key` - Key name of the tag.
+    * `tags.#Value` - Value of the tag.
+* `tpmSupport` - If the image is configured for NitroTPM support, the value is `v20`.
+* `virtualizationType` - Type of virtualization of the AMI (ie: `hvm` or
+  `paravirtual`).
+* `usageOperation` - Operation of the Amazon EC2 instance and the billing code that is associated with the AMI.
+* `platformDetails` - Platform details associated with the billing code of the AMI.
+* `enaSupport` - Whether enhanced networking with ENA is enabled.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `20M`)
+
+[1]: http://docs.aws.amazon.com/cli/latest/reference/ec2/describe-images.html
+
+<!-- cache-key: cdktf-0.18.0 input-b27379b47e46b092af0eb0d0592f4690caa729d66535c1d3f2706e8aa24bff38 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/ami_ids.html.markdown b/website/docs/cdktf/typescript/d/ami_ids.html.markdown
new file mode 100644
index 00000000000..f11d84f1ef9
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/ami_ids.html.markdown
@@ -0,0 +1,78 @@
+---
+subcategory: "EC2 (Elastic Compute Cloud)"
+layout: "aws"
+page_title: "AWS: aws_ami_ids"
+description: |-
+  Provides a list of AMI IDs.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_ami_ids
+
+Use this data source to get a list of AMI IDs matching the specified criteria.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsAmiIds } from "./.gen/providers/aws/data-aws-ami-ids";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsAmiIds(this, "ubuntu", {
+      filter: [
+        {
+          name: "name",
+          values: ["ubuntu/images/ubuntu-*-*-amd64-server-*"],
+        },
+      ],
+      owners: ["099720109477"],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `owners` - (Required) List of AMI owners to limit search. At least 1 value must be specified. Valid values: an AWS account ID, `self` (the current account), or an AWS owner alias (e.g., `amazon`, `awsMarketplace`, `microsoft`).
+
+* `executableUsers` - (Optional) Limit search to users with *explicit* launch
+permission on  the image. Valid items are the numeric account ID or `self`.
+
+* `filter` - (Optional) One or more name/value pairs to filter off of. There
+are several valid keys, for a full reference, check out
+[describe-images in the AWS CLI reference][1].
+
+* `nameRegex` - (Optional) Regex string to apply to the AMI list returned
+by AWS. This allows more advanced filtering not supported from the AWS API.
+This filtering is done locally on what AWS returns, and could have a performance
+impact if the result is large. Combine this with other
+options to narrow down the list AWS returns.
+
+* `sortAscending` - (Optional) Used to sort AMIs by creation time.
+If no value is specified, the default value is `false`.
+
+* `includeDeprecated` - (Optional) If true, all deprecated AMIs are included in the response.
+If false, no deprecated AMIs are included in the response. If no value is specified, the default value is `false`.
+
+## Attribute Reference
+
+`ids` is set to the list of AMI IDs, sorted by creation time according to `sortAscending`.
+
+[1]: http://docs.aws.amazon.com/cli/latest/reference/ec2/describe-images.html
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `20M`)
+
+<!-- cache-key: cdktf-0.18.0 input-df8435503c645904f83640627b35c5031003b38da5f178afcb6e456e7076b481 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/api_gateway_api_key.html.markdown b/website/docs/cdktf/typescript/d/api_gateway_api_key.html.markdown
new file mode 100644
index 00000000000..08607d980e7
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/api_gateway_api_key.html.markdown
@@ -0,0 +1,56 @@
+---
+subcategory: "API Gateway"
+layout: "aws"
+page_title: "AWS: aws_api_gateway_api_key"
+description: |-
+  Get information on an API Gateway REST API Key
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_api_gateway_api_key
+
+Use this data source to get the name and value of a pre-existing API Key, for
+example to supply credentials for a dependency microservice.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsApiGatewayApiKey } from "./.gen/providers/aws/data-aws-api-gateway-api-key";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsApiGatewayApiKey(this, "my_api_key", {
+      id: "ru3mpjgse6",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `id` - (Required) ID of the API Key to look up.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - Set to the ID of the API Key.
+* `name` - Set to the name of the API Key.
+* `value` - Set to the value of the API Key.
+* `createdDate` - Date and time when the API Key was created.
+* `lastUpdatedDate` - Date and time when the API Key was last updated.
+* `customerId` - Amazon Web Services Marketplace customer identifier, when integrating with the Amazon Web Services SaaS Marketplace.
+* `description` - Description of the API Key.
+* `enabled` - Whether the API Key is enabled.
+* `tags` - Map of tags for the resource.
+
+<!-- cache-key: cdktf-0.18.0 input-a00d9aabc0922f53098450b1d3c7279484b52526cb4756e4cbbf4ebf71cc4ed2 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/api_gateway_authorizer.html.markdown b/website/docs/cdktf/typescript/d/api_gateway_authorizer.html.markdown
new file mode 100644
index 00000000000..171b72c34cb
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/api_gateway_authorizer.html.markdown
@@ -0,0 +1,61 @@
+---
+subcategory: "API Gateway"
+layout: "aws"
+page_title: "AWS: aws_api_gateway_authorizer"
+description: |-
+  Provides details about a specific API Gateway Authorizer.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_api_gateway_authorizer
+
+Provides details about a specific API Gateway Authorizer.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsApiGatewayAuthorizer } from "./.gen/providers/aws/data-aws-api-gateway-authorizer";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsApiGatewayAuthorizer(this, "example", {
+      authorizerId: Token.asString(
+        Fn.lookupNested(dataAwsApiGatewayAuthorizersExample.ids, ["0"])
+      ),
+      restApiId: Token.asString(awsApiGatewayRestApiExample.id),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `authorizerId` - (Required) Authorizer identifier.
+* `restApiId` - (Required) ID of the associated REST API.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the API Gateway Authorizer.
+* `authorizerCredentials` - Credentials required for the authorizer.
+* `authorizerResultTtlInSeconds` - TTL of cached authorizer results in seconds.
+* `authorizerUri` - Authorizer's Uniform Resource Identifier (URI).
+* `identitySource` - Source of the identity in an incoming request.
+* `identityValidationExpression` - Validation expression for the incoming identity.
+* `name` - Name of the authorizer.
+* `providerArns` - List of the Amazon Cognito user pool ARNs.
+* `type` - Type of the authorizer.
+
+<!-- cache-key: cdktf-0.18.0 input-7c505056a62ecddc8f4337cf059da361268167b1838c9f6ea4a6d78a7e84dfe3 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/api_gateway_authorizers.html.markdown b/website/docs/cdktf/typescript/d/api_gateway_authorizers.html.markdown
new file mode 100644
index 00000000000..1bd67a8c6b1
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/api_gateway_authorizers.html.markdown
@@ -0,0 +1,49 @@
+---
+subcategory: "API Gateway"
+layout: "aws"
+page_title: "AWS: aws_api_gateway_authorizers"
+description: |-
+  Provides details about multiple API Gateway Authorizers.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_api_gateway_authorizers
+
+Provides details about multiple API Gateway Authorizers.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsApiGatewayAuthorizers } from "./.gen/providers/aws/data-aws-api-gateway-authorizers";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsApiGatewayAuthorizers(this, "example", {
+      restApiId: Token.asString(awsApiGatewayRestApiExample.id),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `restApiId` - (Required) ID of the associated REST API.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `ids` - List of Authorizer identifiers.
+
+<!-- cache-key: cdktf-0.18.0 input-c3a17d70af9b0ac8d5e391a543335f1243e9dec902c7497cf1df2083482e833c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/api_gateway_domain_name.html.markdown b/website/docs/cdktf/typescript/d/api_gateway_domain_name.html.markdown
new file mode 100644
index 00000000000..c61b965382e
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/api_gateway_domain_name.html.markdown
@@ -0,0 +1,60 @@
+---
+subcategory: "API Gateway"
+layout: "aws"
+page_title: "AWS: aws_api_gateway_domain_name"
+description: |-
+ Get information on a custom domain name for use with AWS API Gateway.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_api_gateway_domain_name
+
+Use this data source to get the custom domain name for use with AWS API Gateway.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsApiGatewayDomainName } from "./.gen/providers/aws/data-aws-api-gateway-domain-name";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsApiGatewayDomainName(this, "example", {
+      domainName: "api.example.com",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `domainName` - (Required) Fully-qualified domain name to look up. If no domain name is found, an error will be returned.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the found custom domain name.
+* `certificateArn` - ARN for an AWS-managed certificate that is used by edge-optimized endpoint for this domain name.
+* `certificateName` - Name of the certificate that is used by edge-optimized endpoint for this domain name.
+* `certificateUploadDate` - Upload date associated with the domain certificate.
+* `cloudfrontDomainName` - Hostname created by Cloudfront to represent the distribution that implements this domain name mapping.
+* `cloudfrontZoneId` - For convenience, the hosted zone ID (`z2Fdtndataqyw2`) that can be used to create a Route53 alias record for the distribution.
+* `endpointConfiguration` - List of objects with the endpoint configuration of this domain name.
+    * `types` - List of endpoint types.
+* `regionalCertificateArn` - ARN for an AWS-managed certificate that is used for validating the regional domain name.
+* `regionalCertificateName` - User-friendly name of the certificate that is used by regional endpoint for this domain name.
+* `regionalDomainName` - Hostname for the custom domain's regional endpoint.
+* `regionalZoneId` - Hosted zone ID that can be used to create a Route53 alias record for the regional endpoint.
+* `securityPolicy` - Security policy for the domain name.
+* `tags` - Key-value map of tags for the resource.
+
+<!-- cache-key: cdktf-0.18.0 input-ec3ad0e8dda61e42fd75917952379778e983a6bf94a2c3f251ea482b57cbc3ed -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/api_gateway_export.html.markdown b/website/docs/cdktf/typescript/d/api_gateway_export.html.markdown
new file mode 100644
index 00000000000..cd68878b5dc
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/api_gateway_export.html.markdown
@@ -0,0 +1,54 @@
+---
+subcategory: "API Gateway"
+layout: "aws"
+page_title: "AWS: aws_api_gateway_export"
+description: |-
+  Get information on an API Gateway REST API Key
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_api_gateway_export
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsApiGatewayExport } from "./.gen/providers/aws/data-aws-api-gateway-export";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsApiGatewayExport(this, "example", {
+      exportType: "oas30",
+      restApiId: Token.asString(awsApiGatewayStageExample.restApiId),
+      stageName: Token.asString(awsApiGatewayStageExample.stageName),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `exportType` - (Required) Type of export. Acceptable values are `oas30` for OpenAPI 3.0.x and `swagger` for Swagger/OpenAPI 2.0.
+* `restApiId` - (Required) Identifier of the associated REST API.
+* `stageName` - (Required) Name of the Stage that will be exported.
+* `accepts` - (Optional) Content-type of the export. Valid values are `application/json` and `application/yaml` are supported for `exportType` `ofoas30` and `swagger`.
+* `parameters` - (Optional) Key-value map of query string parameters that specify properties of the export. the following parameters are supported: `extensions='integrations'` or `extensions='apigateway'` will export the API with x-amazon-apigateway-integration extensions. `extensions='authorizers'` will export the API with x-amazon-apigateway-authorizer extensions.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - The `restApiId:stageName`
+* `body` - API Spec.
+* `contentType` - Content-type header value in the HTTP response.
+* `contentDisposition` - Content-disposition header value in the HTTP response.
+
+<!-- cache-key: cdktf-0.18.0 input-c510075eea42189371d3ef965a6842b44146a7635515b8e6bc3e2af00098b481 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/api_gateway_resource.html.markdown b/website/docs/cdktf/typescript/d/api_gateway_resource.html.markdown
new file mode 100644
index 00000000000..76fadc1ef5d
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/api_gateway_resource.html.markdown
@@ -0,0 +1,56 @@
+---
+subcategory: "API Gateway"
+layout: "aws"
+page_title: "AWS: aws_api_gateway_resource"
+description: |-
+  Get information on a API Gateway Resource
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_api_gateway_resource
+
+Use this data source to get the id of a Resource in API Gateway.
+To fetch the Resource, you must provide the REST API id as well as the full path.  
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsApiGatewayResource } from "./.gen/providers/aws/data-aws-api-gateway-resource";
+import { DataAwsApiGatewayRestApi } from "./.gen/providers/aws/data-aws-api-gateway-rest-api";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const myRestApi = new DataAwsApiGatewayRestApi(this, "my_rest_api", {
+      name: "my-rest-api",
+    });
+    new DataAwsApiGatewayResource(this, "my_resource", {
+      path: "/endpoint/path",
+      restApiId: Token.asString(myRestApi.id),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `restApiId` - (Required) REST API id that owns the resource. If no REST API is found, an error will be returned.
+* `path` - (Required) Full path of the resource.  If no path is found, an error will be returned.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - Set to the ID of the found Resource.
+* `parentId` - Set to the ID of the parent Resource.
+* `pathPart` - Set to the path relative to the parent Resource.
+
+<!-- cache-key: cdktf-0.18.0 input-de42d4fd9ee5838ea57bf49335869fd7bec10ba3cea3b7e525af92359ab7bd14 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/api_gateway_rest_api.html.markdown b/website/docs/cdktf/typescript/d/api_gateway_rest_api.html.markdown
new file mode 100644
index 00000000000..d0482359dcb
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/api_gateway_rest_api.html.markdown
@@ -0,0 +1,60 @@
+---
+subcategory: "API Gateway"
+layout: "aws"
+page_title: "AWS: aws_api_gateway_rest_api"
+description: |-
+  Get information on a API Gateway REST API
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_api_gateway_rest_api
+
+Use this data source to get the id and root_resource_id of a REST API in
+API Gateway. To fetch the REST API you must provide a name to match against.
+As there is no unique name constraint on REST APIs this data source will
+error if there is more than one match.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsApiGatewayRestApi } from "./.gen/providers/aws/data-aws-api-gateway-rest-api";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsApiGatewayRestApi(this, "my_rest_api", {
+      name: "my-rest-api",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `name` - (Required) Name of the REST API to look up. If no REST API is found with this name, an error will be returned. If multiple REST APIs are found with this name, an error will be returned.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `apiKeySource` - Source of the API key for requests.
+* `arn` - ARN of the REST API.
+* `binaryMediaTypes` - List of binary media types supported by the REST API.
+* `description` - Description of the REST API.
+* `endpointConfiguration` - The endpoint configuration of this RestApi showing the endpoint types of the API.
+* `executionArn` - Execution ARN part to be used in [`lambdaPermission`](/docs/providers/aws/r/lambda_permission.html)'s `sourceArn` when allowing API Gateway to invoke a Lambda function, e.g., `arn:aws:executeApi:euWest2:123456789012:z4675Bid1J`, which can be concatenated with allowed stage, method and resource path.
+* `id` - Set to the ID of the found REST API.
+* `minimumCompressionSize` - Minimum response size to compress for the REST API.
+* `policy` - JSON formatted policy document that controls access to the API Gateway.
+* `rootResourceId` - Set to the ID of the API Gateway Resource on the found REST API where the route matches '/'.
+* `tags` - Key-value map of resource tags.
+
+<!-- cache-key: cdktf-0.18.0 input-f58dd0e8318def3e704471e581c407920560534f1c0b60ba367ee144e50a3888 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/api_gateway_sdk.html.markdown b/website/docs/cdktf/typescript/d/api_gateway_sdk.html.markdown
new file mode 100644
index 00000000000..9a2a0bbcbaf
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/api_gateway_sdk.html.markdown
@@ -0,0 +1,59 @@
+---
+subcategory: "API Gateway"
+layout: "aws"
+page_title: "AWS: aws_api_gateway_sdk"
+description: |-
+  Gets an API Gateway client SDK
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_api_gateway_sdk
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsApiGatewaySdk } from "./.gen/providers/aws/data-aws-api-gateway-sdk";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsApiGatewaySdk(this, "example", {
+      parameters: {
+        artifactId: "example",
+        artifactVersion: "example",
+        groupId: "example",
+        invokerPackage: "example",
+      },
+      restApiId: Token.asString(awsApiGatewayStageExample.restApiId),
+      sdkType: "android",
+      stageName: Token.asString(awsApiGatewayStageExample.stageName),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `restApiId` - (Required) Identifier of the associated REST API.
+* `stageName` - (Required) Name of the Stage that will be exported.
+* `sdkType` - (Required) Language for the generated SDK. Currently `java`, `javascript`, `android`, `objectivec` (for iOS), `swift` (for iOS), and `ruby` are supported.
+* `parameters` - (Optional) Key-value map of query string parameters `sdkType` properties of the SDK. For SDK Type of `objectivec` or `swift`, a parameter named `classPrefix` is required. For SDK Type of `android`, parameters named `groupId`, `artifactId`, `artifactVersion`, and `invokerPackage` are required. For SDK Type of `java`, parameters named `serviceName` and `javaPackageName` are required.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - The `restApiId:stageName`
+* `body` - SDK as a string.
+* `contentType` - Content-type header value in the HTTP response.
+* `contentDisposition` - Content-disposition header value in the HTTP response.
+
+<!-- cache-key: cdktf-0.18.0 input-ed1f26956d947879c351283b69f137259d03aa3d3365cfd1ed2dbc55a4d3774e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/api_gateway_vpc_link.html.markdown b/website/docs/cdktf/typescript/d/api_gateway_vpc_link.html.markdown
new file mode 100644
index 00000000000..ed3b6509962
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/api_gateway_vpc_link.html.markdown
@@ -0,0 +1,56 @@
+---
+subcategory: "API Gateway"
+layout: "aws"
+page_title: "AWS: aws_api_gateway_vpc_link"
+description: |-
+  Get information on a API Gateway VPC Link
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_api_gateway_vpc_link
+
+Use this data source to get the id of a VPC Link in
+API Gateway. To fetch the VPC Link you must provide a name to match against.
+As there is no unique name constraint on API Gateway VPC Links this data source will
+error if there is more than one match.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsApiGatewayVpcLink } from "./.gen/providers/aws/data-aws-api-gateway-vpc-link";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsApiGatewayVpcLink(this, "my_api_gateway_vpc_link", {
+      name: "my-vpc-link",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `name` - (Required) Name of the API Gateway VPC Link to look up. If no API Gateway VPC Link is found with this name, an error will be returned.
+ If multiple API Gateway VPC Links are found with this name, an error will be returned.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - Set to the ID of the found API Gateway VPC Link.
+* `description` - Description of the VPC link.
+* `status` - Status of the VPC link.
+* `statusMessage` - Status message of the VPC link.
+* `targetArns` - List of network load balancer arns in the VPC targeted by the VPC link. Currently AWS only supports 1 target.
+* `tags` - Key-value map of resource tags
+
+<!-- cache-key: cdktf-0.18.0 input-b5278dc46deda6987341a0eea118c91f7f9e8d4ab7dbcf2deaf2fce3bb8b0ca2 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/apigatewayv2_api.html.markdown b/website/docs/cdktf/typescript/d/apigatewayv2_api.html.markdown
new file mode 100644
index 00000000000..74d7fe2dce2
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/apigatewayv2_api.html.markdown
@@ -0,0 +1,76 @@
+---
+subcategory: "API Gateway V2"
+layout: "aws"
+page_title: "AWS: aws_apigatewayv2_api"
+description: |-
+  Provides details about a specific Amazon API Gateway Version 2 API.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_apigatewayv2_api
+
+Provides details about a specific Amazon API Gateway Version 2 API.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsApigatewayv2Api } from "./.gen/providers/aws/data-aws-apigatewayv2-api";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsApigatewayv2Api(this, "example", {
+      apiId: "aabbccddee",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The arguments of this data source act as filters for querying the available APIs in the current region.
+The given filters must match exactly one API whose data will be exported as attributes.
+
+This argument supports the following arguments:
+
+* `apiId` - (Required) API identifier.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `apiEndpoint` - URI of the API, of the form `https://{apiId}ExecuteApi.{region}AmazonawsCom` for HTTP APIs and `wss://{apiId}ExecuteApi.{region}AmazonawsCom` for WebSocket APIs.
+* `apiKeySelectionExpression` - An [API key selection expression](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-websocket-api-selection-expressions.html#apigateway-websocket-api-apikey-selection-expressions).
+Applicable for WebSocket APIs.
+* `arn` - ARN of the API.
+* `corsConfiguration` - Cross-origin resource sharing (CORS) [configuration](https://docs.aws.amazon.com/apigateway/latest/developerguide/http-api-cors.html).
+Applicable for HTTP APIs.
+* `description` - Description of the API.
+* `disableExecuteApiEndpoint` - Whether clients can invoke the API by using the default `executeApi` endpoint.
+* `executionArn` - ARN prefix to be used in an [`awsLambdaPermission`](/docs/providers/aws/r/lambda_permission.html)'s `sourceArn` attribute
+or in an [`awsIamPolicy`](/docs/providers/aws/r/iam_policy.html) to authorize access to the [`@connections` API](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-how-to-call-websocket-api-connections.html).
+See the [Amazon API Gateway Developer Guide](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-websocket-control-access-iam.html) for details.
+* `name` - Name of the API.
+* `protocolType` - API protocol.
+* `routeSelectionExpression` - The [route selection expression](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-websocket-api-selection-expressions.html#apigateway-websocket-api-route-selection-expressions) for the API.
+* `tags` - Map of resource tags.
+* `version` - Version identifier for the API.
+
+The `corsConfiguration` object supports the following:
+
+* `allowCredentials` - Whether credentials are included in the CORS request.
+* `allowHeaders` - Set of allowed HTTP headers.
+* `allowMethods` - Set of allowed HTTP methods.
+* `allowOrigins` - Set of allowed origins.
+* `exposeHeaders` - Set of exposed HTTP headers.
+* `maxAge` - Number of seconds that the browser should cache preflight request results.
+
+<!-- cache-key: cdktf-0.18.0 input-476586bb733fc0bcc5e9d7e9c2f79656a99a92d47ca1c6953fdfd3eeeab546d6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/apigatewayv2_apis.html.markdown b/website/docs/cdktf/typescript/d/apigatewayv2_apis.html.markdown
new file mode 100644
index 00000000000..c8d2e4f19ad
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/apigatewayv2_apis.html.markdown
@@ -0,0 +1,52 @@
+---
+subcategory: "API Gateway V2"
+layout: "aws"
+page_title: "AWS: aws_apigatewayv2_apis"
+description: |-
+  Provides details about multiple Amazon API Gateway Version 2 APIs.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_apigatewayv2_apis
+
+Provides details about multiple Amazon API Gateway Version 2 APIs.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsApigatewayv2Apis } from "./.gen/providers/aws/data-aws-apigatewayv2-apis";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsApigatewayv2Apis(this, "example", {
+      protocolType: "HTTP",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Optional) API name.
+* `protocolType` - (Optional) API protocol.
+* `tags` - (Optional) Map of tags, each pair of which must exactly match
+  a pair on the desired APIs.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `ids` - Set of API identifiers.
+
+<!-- cache-key: cdktf-0.18.0 input-a7653185a80a5e9399fb3e9d08f770ad4a08a7d1b822a172fdc6e2674fc1dd03 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/apigatewayv2_export.html.markdown b/website/docs/cdktf/typescript/d/apigatewayv2_export.html.markdown
new file mode 100644
index 00000000000..14af3e1055f
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/apigatewayv2_export.html.markdown
@@ -0,0 +1,57 @@
+---
+subcategory: "API Gateway V2"
+layout: "aws"
+page_title: "AWS: aws_apigatewayv2_export"
+description: |-
+  Exports a definition of an API in a particular output format and specification.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_apigatewayv2_export
+
+Exports a definition of an API in a particular output format and specification.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsApigatewayv2Export } from "./.gen/providers/aws/data-aws-apigatewayv2-export";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsApigatewayv2Export(this, "test", {
+      apiId: Token.asString(awsApigatewayv2RouteTest.apiId),
+      outputType: "JSON",
+      specification: "OAS30",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `apiId` - (Required) API identifier.
+* `specification` - (Required) Version of the API specification to use. `oas30`, for OpenAPI 3.0, is the only supported value.
+* `outputType` - (Required) Output type of the exported definition file. Valid values are `json` and `yaml`.
+* `exportVersion` - (Optional) Version of the API Gateway export algorithm. API Gateway uses the latest version by default. Currently, the only supported version is `10`.
+* `includeExtensions` - (Optional) Whether to include API Gateway extensions in the exported API definition. API Gateway extensions are included by default.
+* `stageName` - (Optional) Name of the API stage to export. If you don't specify this property, a representation of the latest API configuration is exported.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - API identifier.
+* `body` - ID of the API.
+
+<!-- cache-key: cdktf-0.18.0 input-6480a64e749693f83cf73592ca35d58ca5a49b6e975099c338b5341415898a74 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/appconfig_configuration_profile.html.markdown b/website/docs/cdktf/typescript/d/appconfig_configuration_profile.html.markdown
new file mode 100644
index 00000000000..a0ef43e36f7
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/appconfig_configuration_profile.html.markdown
@@ -0,0 +1,62 @@
+---
+subcategory: "AppConfig"
+layout: "aws"
+page_title: "AWS: aws_appconfig_configuration_profile"
+description: |-
+  Terraform data source for managing an AWS AppConfig Configuration Profile.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_appconfig_configuration_profile
+
+Provides access to an AppConfig Configuration Profile.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsAppconfigConfigurationProfile } from "./.gen/providers/aws/data-aws-appconfig-configuration-profile";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsAppconfigConfigurationProfile(this, "example", {
+      applicationId: "b5d5gpj",
+      configurationProfileId: "qrbb1c1",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `applicationId` - (Required) ID of the AppConfig application to which this configuration profile belongs.
+* `configurationProfileId` - (Required) ID of the Configuration Profile.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Configuration Profile.
+* `description` - Description of the Configuration Profile.
+* `id` - AppConfig Configuration Profile ID and Application ID separated by a colon `(:)`.
+* `locationUri` - Location URI of the Configuration Profile.
+* `name` - Name of the Configuration Profile.
+* `retrievalRoleArn` - ARN of an IAM role with permission to access the configuration at the specified location_uri.
+* `tags` - Map of tags for the resource.
+* `validator` - Nested list of methods for validating the configuration.
+    * `content` - Either the JSON Schema content or the ARN of an AWS Lambda function.
+    * `type` - Type of validator. Valid values: JSON_SCHEMA and LAMBDA.
+
+<!-- cache-key: cdktf-0.18.0 input-812d16f674999964ab6b67e20ad1395ac161f98caaa88682a62205246057f321 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/appconfig_configuration_profiles.html.markdown b/website/docs/cdktf/typescript/d/appconfig_configuration_profiles.html.markdown
new file mode 100644
index 00000000000..47d553a05e2
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/appconfig_configuration_profiles.html.markdown
@@ -0,0 +1,68 @@
+---
+subcategory: "AppConfig"
+layout: "aws"
+page_title: "AWS: aws_appconfig_configuration_profiles"
+description: |-
+    Terraform data source for managing an AWS AppConfig Configuration Profiles.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_appconfig_configuration_profiles
+
+Provides access to all Configuration Properties for an AppConfig Application. This will allow you to pass Configuration
+Profile IDs to another resource.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformIterator, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsAppconfigConfigurationProfile } from "./.gen/providers/aws/data-aws-appconfig-configuration-profile";
+import { DataAwsAppconfigConfigurationProfiles } from "./.gen/providers/aws/data-aws-appconfig-configuration-profiles";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new DataAwsAppconfigConfigurationProfiles(this, "example", {
+      applicationId: "a1d3rpe",
+    });
+    /*In most cases loops should be handled in the programming language context and 
+    not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+    you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+    you need to keep this like it is.*/
+    const exampleForEachIterator = TerraformIterator.fromList(
+      Token.asAny(example.configurationProfileIds)
+    );
+    const dataAwsAppconfigConfigurationProfileExample =
+      new DataAwsAppconfigConfigurationProfile(this, "example_1", {
+        applicationId: Token.asString(awsAppconfigApplicationExample.id),
+        configurationProfileId: Token.asString(exampleForEachIterator.value),
+        forEach: exampleForEachIterator,
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsAppconfigConfigurationProfileExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `applicationId` - (Required) ID of the AppConfig Application.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `configurationProfileIds` - Set of Configuration Profile IDs associated with the AppConfig Application.
+
+<!-- cache-key: cdktf-0.18.0 input-b4fc2e385f4cf8f2b77339adbebe9e03369792e3c761bb5599667ff5bad6268d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/appconfig_environment.html.markdown b/website/docs/cdktf/typescript/d/appconfig_environment.html.markdown
new file mode 100644
index 00000000000..7e37a5f1991
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/appconfig_environment.html.markdown
@@ -0,0 +1,61 @@
+---
+subcategory: "AppConfig"
+layout: "aws"
+page_title: "AWS: aws_appconfig_environment"
+description: |-
+  Terraform data source for managing an AWS AppConfig Environment.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_appconfig_environment
+
+Provides access to an AppConfig Environment.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsAppconfigEnvironment } from "./.gen/providers/aws/data-aws-appconfig-environment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsAppconfigEnvironment(this, "example", {
+      applicationId: "b5d5gpj",
+      environmentId: "qrbb1c1",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `applicationId` - (Required) ID of the AppConfig Application to which this Environment belongs.
+* `environmentId` - (Required) ID of the AppConfig Environment.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the environment.
+* `name` - Name of the environment.
+* `description` - Name of the environment.
+* `monitor` - Set of Amazon CloudWatch alarms to monitor during the deployment process.
+    * `alarmArn` - ARN of the Amazon CloudWatch alarm.
+    * `alarmRoleArn` - ARN of an IAM role for AWS AppConfig to monitor.
+* `state` - State of the environment. Possible values are `readyForDeployment`, `deploying`, `rollingBack`
+  or `rolledBack`.
+* `tags` - Map of tags for the resource.
+
+<!-- cache-key: cdktf-0.18.0 input-2536eae28938ccf1a8bf0a1e33718611d0fbfe4294f71a133d77dbe21bc83180 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/appconfig_environments.html.markdown b/website/docs/cdktf/typescript/d/appconfig_environments.html.markdown
new file mode 100644
index 00000000000..c35d27aefcf
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/appconfig_environments.html.markdown
@@ -0,0 +1,52 @@
+---
+subcategory: "AppConfig"
+layout: "aws"
+page_title: "AWS: aws_appconfig_environments"
+description: |-
+    Terraform data source for managing an AWS AppConfig Environments.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_appconfig_environments
+
+Provides access to all Environments for an AppConfig Application. This will allow you to pass Environment IDs to another
+resource.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsAppconfigEnvironments } from "./.gen/providers/aws/data-aws-appconfig-environments";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsAppconfigEnvironments(this, "example", {
+      applicationId: "a1d3rpe",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `applicationId` - (Required) ID of the AppConfig Application.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `environmentIds` - Set of Environment IDs associated with this AppConfig Application.
+
+<!-- cache-key: cdktf-0.18.0 input-b2458ae100264c5acfd0fedda3d10f3ece761d168943b6b933cee8edcda8140a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/appintegrations_event_integration.html.markdown b/website/docs/cdktf/typescript/d/appintegrations_event_integration.html.markdown
new file mode 100644
index 00000000000..1390f613400
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/appintegrations_event_integration.html.markdown
@@ -0,0 +1,60 @@
+---
+subcategory: "AppIntegrations"
+layout: "aws"
+page_title: "AWS: aws_appintegrations_event_integration"
+description: |-
+  Provides details about an Amazon AppIntegrations Event Integration
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_appintegrations_event_integration
+
+Use this data source to get information on an existing AppIntegrations Event Integration.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsAppintegrationsEventIntegration } from "./.gen/providers/aws/data-aws-appintegrations-event-integration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsAppintegrationsEventIntegration(this, "example", {
+      name: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) The AppIntegrations Event Integration name.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the AppIntegrations Event Integration.
+* `description` - The description of the Event Integration.
+* `eventbridgeBus` - The EventBridge bus.
+* `eventFilter` - A block that defines the configuration information for the event filter. The Event Filter block is documented below.
+* `id` - The identifier of the Event Integration which is the name of the Event Integration.
+* `tags` - Metadata that you can assign to help organize the report plans you create.
+
+### Event Filter Attributes
+
+`eventFilter` has the following attributes:
+
+* `source` - The source of the events.
+
+<!-- cache-key: cdktf-0.18.0 input-a2b07db4d9622e0a173d852d4b149d44bf0fa8466934be1d6bb261c76d08e4c8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/appmesh_gateway_route.html.markdown b/website/docs/cdktf/typescript/d/appmesh_gateway_route.html.markdown
new file mode 100644
index 00000000000..b2df8387546
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/appmesh_gateway_route.html.markdown
@@ -0,0 +1,59 @@
+---
+subcategory: "App Mesh"
+layout: "aws"
+page_title: "AWS: aws_appmesh_gateway_route"
+description: |-
+    Terraform data source for managing an AWS App Mesh Gateway Route.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_appmesh_gateway_route
+
+The App Mesh Gateway Route data source allows details of an App Mesh Gateway Route to be retrieved by its name, mesh_name, virtual_gateway_name, and optionally the mesh_owner.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsAppmeshGatewayRoute } from "./.gen/providers/aws/data-aws-appmesh-gateway-route";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsAppmeshGatewayRoute(this, "test", {
+      meshName: "test-mesh",
+      name: "test-route",
+      virtualGatewayName: "test-gateway",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name of the gateway route.
+* `meshName` - (Required) Name of the service mesh in which the virtual gateway exists.
+* `virtualGatewayName` - (Required) Name of the virtual gateway in which the route exists.
+* `meshOwner` - (Optional) AWS account ID of the service mesh's owner.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the gateway route.
+* `createdDate` - Creation date of the gateway route.
+* `lastUpdatedDate` - Last update date of the gateway route.
+* `resourceOwner` - Resource owner's AWS account ID.
+* `spec` - Gateway route specification. See the [`awsAppmeshGatewayRoute`](/docs/providers/aws/r/appmesh_gateway_route.html#spec) resource for details.
+* `tags` - Map of tags.
+
+<!-- cache-key: cdktf-0.18.0 input-a279c1138eda25f1a8fb5b8ea47e76c0ee2a8f2f9f4074a26d68a453bf070c31 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/appmesh_mesh.html.markdown b/website/docs/cdktf/typescript/d/appmesh_mesh.html.markdown
new file mode 100644
index 00000000000..f2454fe0bcf
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/appmesh_mesh.html.markdown
@@ -0,0 +1,78 @@
+---
+subcategory: "App Mesh"
+layout: "aws"
+page_title: "AWS: aws_appmesh_mesh"
+description: |-
+    Terraform data source for managing an AWS App Mesh Mesh.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_appmesh_mesh
+
+The App Mesh Mesh data source allows details of an App Mesh Mesh to be retrieved by its name and optionally the mesh_owner.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsAppmeshMesh } from "./.gen/providers/aws/data-aws-appmesh-mesh";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsAppmeshMesh(this, "simple", {
+      name: "simpleapp",
+    });
+  }
+}
+
+```
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsAppmeshMesh } from "./.gen/providers/aws/data-aws-appmesh-mesh";
+import { DataAwsCallerIdentity } from "./.gen/providers/aws/data-aws-caller-identity";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const current = new DataAwsCallerIdentity(this, "current", {});
+    new DataAwsAppmeshMesh(this, "simple", {
+      meshOwner: Token.asString(current.accountId),
+      name: "simpleapp",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name of the service mesh.
+* `meshOwner` - (Optional) AWS account ID of the service mesh's owner.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the service mesh.
+* `createdDate` - Creation date of the service mesh.
+* `lastUpdatedDate` - Last update date of the service mesh.
+* `resourceOwner` - Resource owner's AWS account ID.
+* `spec` - Service mesh specification. See the [`awsAppmeshMesh`](/docs/providers/aws/r/appmesh_mesh.html#spec) resource for details.
+* `tags` - Map of tags.
+
+<!-- cache-key: cdktf-0.18.0 input-d7824d065f1b548e8cd5d250543a8080d2008466f819e3d452bc45287fb64d1d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/appmesh_route.html.markdown b/website/docs/cdktf/typescript/d/appmesh_route.html.markdown
new file mode 100644
index 00000000000..68da44ad933
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/appmesh_route.html.markdown
@@ -0,0 +1,59 @@
+---
+subcategory: "App Mesh"
+layout: "aws"
+page_title: "AWS: aws_appmesh_route"
+description: |-
+    Terraform data source for managing an AWS App Mesh Route.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_appmesh_route
+
+The App Mesh Route data source allows details of an App Mesh Route to be retrieved by its name, mesh_name, virtual_router_name, and optionally the mesh_owner.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsAppmeshVirtualService } from "./.gen/providers/aws/data-aws-appmesh-virtual-service";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsAppmeshVirtualService(this, "test", {
+      meshName: "test-mesh",
+      name: "test-route",
+      virtual_router_name: "test-router",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name of the route.
+* `meshName` - (Required) Name of the service mesh in which the virtual router exists.
+* `virtualRouterName` - (Required) Name of the virtual router in which the route exists.
+* `meshOwner` - (Optional) AWS account ID of the service mesh's owner.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the route.
+* `createdDate` - Creation date of the route.
+* `lastUpdatedDate` - Last update date of the route.
+* `resourceOwner` - Resource owner's AWS account ID.
+* `spec` - Route specification. See the [`awsAppmeshRoute`](/docs/providers/aws/r/appmesh_route.html#spec) resource for details.
+* `tags` - Map of tags.
+
+<!-- cache-key: cdktf-0.18.0 input-61db8b34997ce89b5e11e05c9df80c6e3a3a0f5ad3176a86fce3a94bba27ce62 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/appmesh_virtual_gateway.html.markdown b/website/docs/cdktf/typescript/d/appmesh_virtual_gateway.html.markdown
new file mode 100644
index 00000000000..8140386a41d
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/appmesh_virtual_gateway.html.markdown
@@ -0,0 +1,83 @@
+---
+subcategory: "App Mesh"
+layout: "aws"
+page_title: "AWS: aws_appmesh_virtual_gateway"
+description: |-
+  Terraform data source for managing an AWS App Mesh Virtual Gateway.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_appmesh_virtual_gateway
+
+Terraform data source for managing an AWS App Mesh Virtual Gateway.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsAppmeshVirtualGateway } from "./.gen/providers/aws/data-aws-appmesh-virtual-gateway";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsAppmeshVirtualGateway(this, "example", {
+      meshName: "mesh-gateway",
+      name: "example-mesh",
+    });
+  }
+}
+
+```
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsAppmeshVirtualGateway } from "./.gen/providers/aws/data-aws-appmesh-virtual-gateway";
+import { DataAwsCallerIdentity } from "./.gen/providers/aws/data-aws-caller-identity";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const current = new DataAwsCallerIdentity(this, "current", {});
+    new DataAwsAppmeshVirtualGateway(this, "test", {
+      meshName: "example-mesh",
+      meshOwner: Token.asString(current.accountId),
+      name: "example.mesh.local",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) Name of the virtual gateway.
+* `meshName` - (Required) Name of the service mesh in which the virtual gateway exists.
+* `meshOwner` - (Optional) AWS account ID of the service mesh's owner.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the virtual gateway.
+* `createdDate` - Creation date of the virtual gateway.
+* `lastUpdatedDate` - Last update date of the virtual gateway.
+* `resourceOwner` - Resource owner's AWS account ID.
+* `spec` - Virtual gateway specification. See the [`awsAppmeshVirtualGateway`](/docs/providers/aws/r/appmesh_virtual_gateway.html#spec) resource for details.
+* `tags` - Map of tags.
+
+<!-- cache-key: cdktf-0.18.0 input-a538bcbf642443121e211852f127911c6109e4baf18bd72f5915c80b62936a13 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/appmesh_virtual_node.html.markdown b/website/docs/cdktf/typescript/d/appmesh_virtual_node.html.markdown
new file mode 100644
index 00000000000..206ae806ac9
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/appmesh_virtual_node.html.markdown
@@ -0,0 +1,57 @@
+---
+subcategory: "App Mesh"
+layout: "aws"
+page_title: "AWS: aws_appmesh_virtual_node"
+description: |-
+    Terraform data source for managing an AWS App Mesh Virtual Node.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_appmesh_virtual_node
+
+Terraform data source for managing an AWS App Mesh Virtual Node.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsAppmeshVirtualNode } from "./.gen/providers/aws/data-aws-appmesh-virtual-node";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsAppmeshVirtualNode(this, "test", {
+      meshName: "example-mesh",
+      name: "serviceBv1",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name of the virtual node.
+* `meshName` - (Required) Name of the service mesh in which the virtual node exists.
+* `meshOwner` - (Optional) AWS account ID of the service mesh's owner.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the virtual node.
+* `createdDate` - Creation date of the virtual node.
+* `lastUpdatedDate` - Last update date of the virtual node.
+* `resourceOwner` - Resource owner's AWS account ID.
+* `spec` - Virtual node specification. See the [`awsAppmeshVirtualNode`](/docs/providers/aws/r/appmesh_virtual_node.html#spec) resource for details.
+* `tags` - Map of tags.
+
+<!-- cache-key: cdktf-0.18.0 input-0af250ec57ad7c06ff9123a832f3205783a39694eff720e32b0655ce7952fa68 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/appmesh_virtual_router.html.markdown b/website/docs/cdktf/typescript/d/appmesh_virtual_router.html.markdown
new file mode 100644
index 00000000000..4c1665dcbd8
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/appmesh_virtual_router.html.markdown
@@ -0,0 +1,56 @@
+---
+subcategory: "App Mesh"
+layout: "aws"
+page_title: "AWS: aws_appmesh_virtual_router"
+description: |-
+    Terraform data source for managing an AWS App Mesh Virtual Router.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_appmesh_virtual_router
+
+The App Mesh Virtual Router data source allows details of an App Mesh Virtual Service to be retrieved by its name and mesh_name.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsAppmeshVirtualRouter } from "./.gen/providers/aws/data-aws-appmesh-virtual-router";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsAppmeshVirtualRouter(this, "test", {
+      meshName: "example-mesh-name",
+      name: "example-router-name",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name of the virtual router.
+* `meshName` - (Required) Name of the mesh in which the virtual router exists
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the virtual router.
+* `createdDate` - Creation date of the virtual router.
+* `lastUpdatedDate` - Last update date of the virtual router.
+* `resourceOwner` - Resource owner's AWS account ID.
+* `spec` - Virtual routers specification. See the [`awsAppmeshVirtualRouter`](/docs/providers/aws/r/appmesh_virtual_router.html#spec) resource for details.
+* `tags` - Map of tags.
+
+<!-- cache-key: cdktf-0.18.0 input-09267d7d4084baeb433ba4250023e9410012cd2645c2c7f14eb2ee7f754980ad -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/appmesh_virtual_service.html.markdown b/website/docs/cdktf/typescript/d/appmesh_virtual_service.html.markdown
new file mode 100644
index 00000000000..aae842de6fd
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/appmesh_virtual_service.html.markdown
@@ -0,0 +1,81 @@
+---
+subcategory: "App Mesh"
+layout: "aws"
+page_title: "AWS: aws_appmesh_virtual_service"
+description: |-
+    Terraform data source for managing an AWS App Mesh Virtual Service.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_appmesh_virtual_service
+
+The App Mesh Virtual Service data source allows details of an App Mesh Virtual Service to be retrieved by its name, mesh_name, and optionally the mesh_owner.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsAppmeshVirtualService } from "./.gen/providers/aws/data-aws-appmesh-virtual-service";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsAppmeshVirtualService(this, "test", {
+      meshName: "example-mesh",
+      name: "example.mesh.local",
+    });
+  }
+}
+
+```
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsAppmeshVirtualService } from "./.gen/providers/aws/data-aws-appmesh-virtual-service";
+import { DataAwsCallerIdentity } from "./.gen/providers/aws/data-aws-caller-identity";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const current = new DataAwsCallerIdentity(this, "current", {});
+    new DataAwsAppmeshVirtualService(this, "test", {
+      meshName: "example-mesh",
+      meshOwner: Token.asString(current.accountId),
+      name: "example.mesh.local",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name of the virtual service.
+* `meshName` - (Required) Name of the service mesh in which the virtual service exists.
+* `meshOwner` - (Optional) AWS account ID of the service mesh's owner.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the virtual service.
+* `createdDate` - Creation date of the virtual service.
+* `lastUpdatedDate` - Last update date of the virtual service.
+* `resourceOwner` - Resource owner's AWS account ID.
+* `spec` - Virtual service specification. See the [`awsAppmeshVirtualService`](/docs/providers/aws/r/appmesh_virtual_service.html#spec) resource for details.
+* `tags` - Map of tags.
+
+<!-- cache-key: cdktf-0.18.0 input-a9e88eca01bcb0655a9491489c66102bdf389f472af4c3044e98fbafbd11d67d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/arn.html.markdown b/website/docs/cdktf/typescript/d/arn.html.markdown
new file mode 100644
index 00000000000..1ba1d8c4a5b
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/arn.html.markdown
@@ -0,0 +1,59 @@
+---
+subcategory: "Meta Data Sources"
+layout: "aws"
+page_title: "AWS: aws_arn"
+description: |-
+    Parses an ARN into its constituent parts.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_arn
+
+Parses an ARN into its constituent parts.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsArn } from "./.gen/providers/aws/data-aws-arn";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsArn(this, "db_instance", {
+      arn: "arn:aws:rds:eu-west-1:123456789012:db:mysql-db",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `arn` - (Required) ARN to parse.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `partition` - Partition that the resource is in.
+
+* `service` - The [service namespace](https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html#genref-aws-service-namespaces) that identifies the AWS product.
+
+* `region` - Region the resource resides in.
+Note that the ARNs for some resources do not require a region, so this component might be omitted.
+
+* `account` - The [ID](https://docs.aws.amazon.com/general/latest/gr/acct-identifiers.html) of the AWS account that owns the resource, without the hyphens.
+
+* `resource` - Content of this part of the ARN varies by service.
+It often includes an indicator of the type of resource—for example, an IAM user or Amazon RDS database —followed by a slash (/) or a colon (:), followed by the resource name itself.
+
+<!-- cache-key: cdktf-0.18.0 input-440ccf3a9b006a55df02867b675efa529ed16c151a5b0875e321f0dd97d87344 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/auditmanager_control.html.markdown b/website/docs/cdktf/typescript/d/auditmanager_control.html.markdown
new file mode 100644
index 00000000000..6e342f8c949
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/auditmanager_control.html.markdown
@@ -0,0 +1,106 @@
+---
+subcategory: "Audit Manager"
+layout: "aws"
+page_title: "AWS: aws_auditmanager_control"
+description: |-
+  Terraform data source for managing an AWS Audit Manager Control.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_auditmanager_control
+
+Terraform data source for managing an AWS Audit Manager Control.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsAuditmanagerControl } from "./.gen/providers/aws/data-aws-auditmanager-control";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsAuditmanagerControl(this, "example", {
+      name: "1. Risk Management",
+      type: "Standard",
+    });
+  }
+}
+
+```
+
+### With Framework Resource
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AuditmanagerFramework } from "./.gen/providers/aws/auditmanager-framework";
+import { DataAwsAuditmanagerControl } from "./.gen/providers/aws/data-aws-auditmanager-control";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new DataAwsAuditmanagerControl(this, "example", {
+      name: "1. Risk Management",
+      type: "Standard",
+    });
+    const example2 = new DataAwsAuditmanagerControl(this, "example2", {
+      name: "2. Personnel",
+      type: "Standard",
+    });
+    const awsAuditmanagerFrameworkExample = new AuditmanagerFramework(
+      this,
+      "example_2",
+      {
+        controlSets: [
+          {
+            controls: [
+              {
+                id: Token.asString(example.id),
+              },
+            ],
+            name: "example",
+          },
+          {
+            controls: [
+              {
+                id: Token.asString(example2.id),
+              },
+            ],
+            name: "example2",
+          },
+        ],
+        name: "example",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsAuditmanagerFrameworkExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) Name of the control.
+* `type` - (Required) Type of control. Valid values are `custom` and `standard`.
+
+## Attribute Reference
+
+See the [`awsAuditmanagerControl` resource](/docs/providers/aws/r/auditmanager_control.html) for details on the returned attributes - they are identical.
+
+<!-- cache-key: cdktf-0.18.0 input-3db48c85023c8e29684006da94ab0858a40f92b8fb222869b34399953eba3333 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/auditmanager_framework.html.markdown b/website/docs/cdktf/typescript/d/auditmanager_framework.html.markdown
new file mode 100644
index 00000000000..b1462143fa0
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/auditmanager_framework.html.markdown
@@ -0,0 +1,51 @@
+---
+subcategory: "Audit Manager"
+layout: "aws"
+page_title: "AWS: aws_auditmanager_framework"
+description: |-
+  Terraform data source for managing an AWS Audit Manager Framework.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_auditmanager_framework
+
+Terraform data source for managing an AWS Audit Manager Framework.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsAuditmanagerFramework } from "./.gen/providers/aws/data-aws-auditmanager-framework";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsAuditmanagerFramework(this, "example", {
+      frameworkType: "Standard",
+      name: "Essential Eight",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) Name of the framework.
+* `type` - (Required) Type of framework. Valid values are `custom` and `standard`.
+
+## Attribute Reference
+
+See the [`awsAuditmanagerFramework` resource](/docs/providers/aws/r/auditmanager_framework.html) for details on the returned attributes - they are identical.
+
+<!-- cache-key: cdktf-0.18.0 input-e12a3dc3cc7a030af0ee05ef605e7ae0ed5532ec722427fc48f953a615499bf2 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/autoscaling_group.html.markdown b/website/docs/cdktf/typescript/d/autoscaling_group.html.markdown
new file mode 100644
index 00000000000..8b78fda14e5
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/autoscaling_group.html.markdown
@@ -0,0 +1,147 @@
+---
+subcategory: "Auto Scaling"
+layout: "aws"
+page_title: "AWS: aws_autoscaling_group"
+description: |-
+  Get information on an Amazon EC2 Autoscaling Group.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_autoscaling_group
+
+Use this data source to get information on an existing autoscaling group.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsAutoscalingGroup } from "./.gen/providers/aws/data-aws-autoscaling-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsAutoscalingGroup(this, "foo", {
+      name: "foo",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `name` - Specify the exact name of the desired autoscaling group.
+
+## Attribute Reference
+
+~> **NOTE:** Some values are not always set and may not be available for
+interpolation.
+
+* `arn` - ARN of the Auto Scaling group.
+* `availabilityZones` - One or more Availability Zones for the group.
+* `defaultCoolDown` - Amount of time, in seconds, after a scaling activity completes before another scaling activity can start.
+* `desiredCapacity` - Desired size of the group.
+* `desiredCapacityType` - The unit of measurement for the value returned for `desiredCapacity`.
+* `enabledMetrics` - List of metrics enabled for collection.
+* `healthCheckGracePeriod` - The amount of time, in seconds, that Amazon EC2 Auto Scaling waits before checking the health status of an EC2 instance that has come into service.
+* `healthCheckType` - Service to use for the health checks. The valid values are EC2 and ELB.
+* `id` - Name of the Auto Scaling Group.
+* `launchConfiguration` - The name of the associated launch configuration.
+* `launchTemplate` - List of launch templates for the group.
+    * `id` - ID of the launch template.
+    * `name` - Name of the launch template.
+    * `version` - Template version.
+* `loadBalancers` - One or more load balancers associated with the group.
+* `maxInstanceLifetime` - Maximum amount of time, in seconds, that an instance can be in service.
+* `maxSize` - Maximum size of the group.
+* `minSize` - Minimum size of the group.
+* `mixedInstancesPolicy` - List of mixed instances policy objects for the group.
+    * `instancesDistribution` - List of instances distribution objects.
+        * `onDemandAllocationStrategy` - Strategy used when launching on-demand instances.
+        * `onDemandBaseCapacity` -  Absolute minimum amount of desired capacity that must be fulfilled by on-demand instances.
+        * `spotAllocationStrategy` - Strategy used when launching Spot instances.
+        * `spotInstancePools` - Number of Spot pools per availability zone to allocate capacity.
+        * `spotMaxPrice` - Maximum price per unit hour that the user is willing to pay for the Spot instances.
+    * `launchTemplate` - List of launch templates along with the overrides.
+        * `launchTemplateSpecification` - List of launch template specification objects.
+            * `launchTemplateId` - ID of the launch template.
+            * `launchTemplateName` - Name of the launch template.
+            * `version` - Template version.
+        * `override` - List of properties overriding the same properties in the launch template.
+            * `instanceRequirements` - List of instance requirements objects.
+                * `accelerator_count - List of objects describing the minimum and maximum number of accelerators for an instance type.
+                    * `min` - Minimum.
+                    * `max` - Maximum.
+                * `acceleratorManufacturers` - List of accelerator manufacturer names.
+                * `acceleratorNames` - List of accelerator names.
+                * `acceleratorTotalMemoryMib` - List of objects describing the minimum and maximum total memory of the accelerators.
+                * `acceleratorTypes` - List of accelerator types.
+                * `allowedInstanceTypes` - List of instance types to apply the specified attributes against.
+                * `bareMetal` - Indicates whether bare metal instances are included, excluded, or required.
+                * `baselineEbsBandwidthMbps` - List of objects describing the minimum and maximum baseline EBS bandwidth (Mbps).
+                    * `min` - Minimum.
+                    * `max` - Maximum.
+                * `burstablePerformance` - Indicates whether burstable performance instance types are included, excluded, or required.
+                * `cpuManufacturers` - List of CPU manufacturer names.
+                * `excludedInstanceTypes` - List of excluded instance types.
+                * `instanceGenerations` - List of instance generation names.
+                * `localStorage` - Indicates whether instance types with instance store volumes are included, excluded, or required.
+                * `localStorageTypes` - List of local storage type names.
+                * `memoryGibPerVcpu` - List of objects describing the minimum and maximum amount of memory (GiB) per vCPU.
+                    * `min` - Minimum.
+                    * `max` - Maximum.
+                * `memoryMib` - List of objects describing the minimum and maximum amount of memory (MiB).
+                    * `min` - Minimum.
+                    * `max` - Maximum.
+                * `networkBandwidthGbps` - List of objects describing the minimum and maximum amount of network bandwidth (Gbps).
+                    * `min` - Minimum.
+                    * `max`- Maximum.
+                * `networkInterfaceCount` - List of objects describing the minimum and maximum amount of network interfaces.
+                    * `min` - Minimum.
+                    * `max` - Maximum.
+                * `onDemandMaxPricePercentageOverLowestPrice` - Price protection threshold for On-Demand Instances.
+                * `requireHibernateSupport` - Indicates whether instance types must support On-Demand Instance Hibernation.
+                * `spotMaxPricePercentageOverLowestPrice` - Price protection threshold for Spot Instances.
+                * `totalLocalStorageGb` - List of objects describing the minimum and maximum total storage (GB).
+                    * `min` - Minimum.
+                    * `max` - Maximum.
+                * `vcpuCount` - List of objects describing the minimum and maximum number of vCPUs.
+                    * `min` - Minimum.
+                    * `max` - Maximum.
+            * `instanceType` - Overriding instance type.
+            * `launchTemplateSpecification` - List of overriding launch template specification objects.
+                * `launchTemplateId` - ID of the launch template.
+                * `launchTemplateName` - Name of the launch template.
+                * `version` - Template version.
+            * `weightedCapacity` - Number of capacity units, which gives the instance type a proportional weight to other instance types.
+* `name` - Name of the Auto Scaling Group.
+* `placementGroup` - Name of the placement group into which to launch your instances, if any. For more information, see Placement Groups (http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/placement-groups.html) in the Amazon Elastic Compute Cloud User Guide.
+* `predictedCapacity` - Predicted capacity of the group.
+* `serviceLinkedRoleArn` - ARN of the service-linked role that the Auto Scaling group uses to call other AWS services on your behalf.
+* `status` - Current state of the group when DeleteAutoScalingGroup is in progress.
+* `suspendedProcesses` - List of processes suspended processes for the Auto Scaling Group.
+* `tag` - List of tags for the group.
+    * `key` - Key.
+    * `value` - Value.
+    * `propagateAtLaunch` - Whether the tag is propagated to Amazon EC2 instances launched via this ASG.
+* `targetGroupArns` - ARNs of the target groups for your load balancer.
+* `terminationPolicies` - The termination policies for the group.
+* `trafficSource` -Traffic sources.
+    * `identifier` - Identifies the traffic source. For Application Load Balancers, Gateway Load Balancers, Network Load Balancers, and VPC Lattice, this will be the Amazon Resource Name (ARN) for a target group in this account and Region. For Classic Load Balancers, this will be the name of the Classic Load Balancer in this account and Region.
+    * `type` - Traffic source type.
+* `vpcZoneIdentifier` - VPC ID for the group.
+* `warmPool` - List of warm pool configuration objects.
+    * `instanceReusePolicy` - List of instance reuse policy objects.
+        * `reuseOnScaleIn` - Indicates whether instances in the Auto Scaling group can be returned to the warm pool on scale in.
+    * `maxGroupPreparedPolicy` - Total maximum number of instances that are allowed to be in the warm pool or in any state except Terminated for the Auto Scaling group.
+    * `minSize` - Minimum number of instances to maintain in the warm pool.
+    * `poolState` - Instance state to transition to after the lifecycle actions are complete.
+* `warmPoolSize` - Current size of the warm pool.
+
+<!-- cache-key: cdktf-0.18.0 input-99dec3ec98ed7de1189a2c55151981d1b50b501480be637bbbe4a2b5d7102172 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/autoscaling_groups.html.markdown b/website/docs/cdktf/typescript/d/autoscaling_groups.html.markdown
new file mode 100644
index 00000000000..34602640f51
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/autoscaling_groups.html.markdown
@@ -0,0 +1,73 @@
+---
+subcategory: "Auto Scaling"
+layout: "aws"
+page_title: "AWS: aws_autoscaling_groups"
+description: |-
+    Provides a list of Autoscaling Groups within a specific region.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_autoscaling_groups
+
+The Autoscaling Groups data source allows access to the list of AWS
+ASGs within a specific region. This will allow you to pass a list of AutoScaling Groups to other resources.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AutoscalingNotification } from "./.gen/providers/aws/autoscaling-notification";
+import { DataAwsAutoscalingGroups } from "./.gen/providers/aws/data-aws-autoscaling-groups";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const groups = new DataAwsAutoscalingGroups(this, "groups", {
+      filter: [
+        {
+          name: "tag:Team",
+          values: ["Pets"],
+        },
+        {
+          name: "tag-key",
+          values: ["Environment"],
+        },
+      ],
+    });
+    new AutoscalingNotification(this, "slack_notifications", {
+      groupNames: Token.asList(groups.names),
+      notifications: [
+        "autoscaling:EC2_INSTANCE_LAUNCH",
+        "autoscaling:EC2_INSTANCE_TERMINATE",
+        "autoscaling:EC2_INSTANCE_LAUNCH_ERROR",
+        "autoscaling:EC2_INSTANCE_TERMINATE_ERROR",
+      ],
+      topicArn: "TOPIC ARN",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `names` - (Optional) List of autoscaling group names
+* `filter` - (Optional) Filter used to scope the list e.g., by tags. See [related docs](http://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_Filter.html).
+    * `name` - (Required) Name of the DescribeAutoScalingGroup filter. The recommended values are: `tagKey`, `tagValue`, and `tag:<tag name>`
+    * `values` - (Required) Value of the filter.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arns` - List of the Autoscaling Groups Arns in the current region.
+* `id` - AWS Region.
+* `names` - List of the Autoscaling Groups in the current region.
+
+<!-- cache-key: cdktf-0.18.0 input-20b7e19884e3bc895f27ed095f08d88d8a126a02daa27f2150766b85f3e730ed -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/availability_zone.html.markdown b/website/docs/cdktf/typescript/d/availability_zone.html.markdown
new file mode 100644
index 00000000000..843719fcea9
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/availability_zone.html.markdown
@@ -0,0 +1,140 @@
+---
+subcategory: "EC2 (Elastic Compute Cloud)"
+layout: "aws"
+page_title: "AWS: aws_availability_zone"
+description: |-
+    Provides details about a specific availability zone
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_availability_zone
+
+`awsAvailabilityZone` provides details about a specific availability zone (AZ)
+in the current region.
+
+This can be used both to validate an availability zone given in a variable
+and to split the AZ name into its component parts of an AWS region and an
+AZ identifier letter. The latter may be useful e.g., for implementing a
+consistent subnet numbering scheme across several regions by mapping both
+the region and the subnet letter to network numbers.
+
+This is different from the `awsAvailabilityZones` (plural) data source,
+which provides a list of the available zones.
+
+## Example Usage
+
+The following example shows how this data source might be used to derive
+VPC and subnet CIDR prefixes systematically for an availability zone.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformVariable, Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsAvailabilityZone } from "./.gen/providers/aws/data-aws-availability-zone";
+import { Subnet } from "./.gen/providers/aws/subnet";
+import { Vpc } from "./.gen/providers/aws/vpc";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    /*Terraform Variables are not always the best fit for getting inputs in the context of Terraform CDK.
+    You can read more about this at https://cdk.tf/variables*/
+    const azNumber = new TerraformVariable(this, "az_number", {
+      default: [
+        {
+          a: 1,
+          b: 2,
+          c: 3,
+          d: 4,
+          e: 5,
+          f: 6,
+        },
+      ],
+    });
+    const regionNumber = new TerraformVariable(this, "region_number", {
+      default: [
+        {
+          "ap-northeast-1": 5,
+          "eu-central-1": 4,
+          "us-east-1": 1,
+          "us-west-1": 2,
+          "us-west-2": 3,
+        },
+      ],
+    });
+    const example = new DataAwsAvailabilityZone(this, "example", {
+      name: "eu-central-1a",
+    });
+    const awsVpcExample = new Vpc(this, "example_3", {
+      cidrBlock: Token.asString(
+        Fn.cidrsubnet(
+          "10.0.0.0/8",
+          4,
+          Token.asNumber(Fn.lookupNested(regionNumber.value, [example.region]))
+        )
+      ),
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsVpcExample.overrideLogicalId("example");
+    const awsSubnetExample = new Subnet(this, "example_4", {
+      cidrBlock: Token.asString(
+        Fn.cidrsubnet(
+          Token.asString(awsVpcExample.cidrBlock),
+          4,
+          Token.asNumber(Fn.lookupNested(azNumber.value, [example.nameSuffix]))
+        )
+      ),
+      vpcId: Token.asString(awsVpcExample.id),
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSubnetExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+The arguments of this data source act as filters for querying the available
+availability zones. The given filters must match exactly one availability
+zone whose data will be exported as attributes.
+
+* `allAvailabilityZones` - (Optional) Set to `true` to include all Availability Zones and Local Zones regardless of your opt in status.
+* `filter` - (Optional) Configuration block(s) for filtering. Detailed below.
+* `name` - (Optional) Full name of the availability zone to select.
+* `state` - (Optional) Specific availability zone state to require. May be any of `"available"`, `"information"` or `"impaired"`.
+* `zoneId` - (Optional) Zone ID of the availability zone to select.
+
+### filter Configuration Block
+
+The `filter` configuration block supports the following arguments:
+
+* `name` - (Required) Name of the filter field. Valid values can be found in the [EC2 DescribeAvailabilityZones API Reference](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeAvailabilityZones.html).
+* `values` - (Required) Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `groupName` - For Availability Zones, this is the same value as the Region name. For Local Zones, the name of the associated group, for example `usWest2Lax1`.
+* `nameSuffix` - Part of the AZ name that appears after the region name, uniquely identifying the AZ within its region.
+For Availability Zones this is usually a single letter, for example `a` for the `usWest2A` zone.
+For Local and Wavelength Zones this is a longer string, for example `wl1SfoWlz1` for the `usWest2Wl1SfoWlz1` zone.
+* `networkBorderGroup` - The name of the location from which the address is advertised.
+* `optInStatus` - For Availability Zones, this always has the value of `optInNotRequired`. For Local Zones, this is the opt in status. The possible values are `optedIn` and `notOptedIn`.
+* `parentZoneId` - ID of the zone that handles some of the Local Zone or Wavelength Zone control plane operations, such as API calls.
+* `parentZoneName` - Name of the zone that handles some of the Local Zone or Wavelength Zone control plane operations, such as API calls.
+* `region` - Region where the selected availability zone resides. This is always the region selected on the provider, since this data source searches only within that region.
+* `zoneType` - Type of zone. Values are `availabilityZone`, `localZone`, and `wavelengthZone`.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `20M`)
+
+<!-- cache-key: cdktf-0.18.0 input-862d7a30e7b7fec1243f9a3afe7925988e240b4d36970fb4f9743ee1e9a647b3 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/availability_zones.html.markdown b/website/docs/cdktf/typescript/d/availability_zones.html.markdown
new file mode 100644
index 00000000000..28162aba35d
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/availability_zones.html.markdown
@@ -0,0 +1,153 @@
+---
+subcategory: "EC2 (Elastic Compute Cloud)"
+layout: "aws"
+page_title: "AWS: aws_availability_zones"
+description: |-
+    Provides a list of Availability Zones which can be used by an AWS account.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_availability_zones
+
+The Availability Zones data source allows access to the list of AWS
+Availability Zones which can be accessed by an AWS account within the region
+configured in the provider.
+
+This is different from the `awsAvailabilityZone` (singular) data source,
+which provides some details about a specific availability zone.
+
+-> When [Local Zones](https://aws.amazon.com/about-aws/global-infrastructure/localzones/) are enabled in a region, by default the API and this data source include both Local Zones and Availability Zones. To return only Availability Zones, see the example section below.
+
+## Example Usage
+
+### By State
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsAvailabilityZones } from "./.gen/providers/aws/data-aws-availability-zones";
+import { Subnet } from "./.gen/providers/aws/subnet";
+interface MyConfig {
+  vpcId: any;
+  vpcId1: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    const available = new DataAwsAvailabilityZones(this, "available", {
+      state: "available",
+    });
+    new Subnet(this, "primary", {
+      availabilityZone: Token.asString(Fn.lookupNested(available.names, ["0"])),
+      vpcId: config.vpcId,
+    });
+    new Subnet(this, "secondary", {
+      availabilityZone: Token.asString(Fn.lookupNested(available.names, ["1"])),
+      vpcId: config.vpcId1,
+    });
+  }
+}
+
+```
+
+### By Filter
+
+All Local Zones (regardless of opt-in status):
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsAvailabilityZones } from "./.gen/providers/aws/data-aws-availability-zones";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsAvailabilityZones(this, "example", {
+      allAvailabilityZones: true,
+      filter: [
+        {
+          name: "opt-in-status",
+          values: ["not-opted-in", "opted-in"],
+        },
+      ],
+    });
+  }
+}
+
+```
+
+Only Availability Zones (no Local Zones):
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsAvailabilityZones } from "./.gen/providers/aws/data-aws-availability-zones";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsAvailabilityZones(this, "example", {
+      filter: [
+        {
+          name: "opt-in-status",
+          values: ["opt-in-not-required"],
+        },
+      ],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `allAvailabilityZones` - (Optional) Set to `true` to include all Availability Zones and Local Zones regardless of your opt in status.
+* `filter` - (Optional) Configuration block(s) for filtering. Detailed below.
+* `excludeNames` - (Optional) List of Availability Zone names to exclude.
+* `excludeZoneIds` - (Optional) List of Availability Zone IDs to exclude.
+* `state` - (Optional) Allows to filter list of Availability Zones based on their
+current state. Can be either `"available"`, `"information"`, `"impaired"` or
+`"unavailable"`. By default the list includes a complete set of Availability Zones
+to which the underlying AWS account has access, regardless of their state.
+
+### filter Configuration Block
+
+The `filter` configuration block supports the following arguments:
+
+* `name` - (Required) Name of the filter field. Valid values can be found in the [EC2 DescribeAvailabilityZones API Reference](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeAvailabilityZones.html).
+* `values` - (Required) Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `groupNames` A set of the Availability Zone Group names. For Availability Zones, this is the same value as the Region name. For Local Zones, the name of the associated group, for example `usWest2Lax1`.
+* `id` - Region of the Availability Zones.
+* `names` - List of the Availability Zone names available to the account.
+* `zoneIds` - List of the Availability Zone IDs available to the account.
+
+Note that the indexes of Availability Zone names and IDs correspond.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `20M`)
+
+<!-- cache-key: cdktf-0.18.0 input-4fb56543535b24bb1a7db337e55d8060de419403eb0a490892cf3a3900602758 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/backup_framework.html.markdown b/website/docs/cdktf/typescript/d/backup_framework.html.markdown
new file mode 100644
index 00000000000..aaaa39629fd
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/backup_framework.html.markdown
@@ -0,0 +1,79 @@
+---
+subcategory: "Backup"
+layout: "aws"
+page_title: "AWS: aws_backup_framework"
+description: |-
+  Provides details about an AWS Backup Framework.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_backup_framework
+
+Use this data source to get information on an existing backup framework.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsBackupFramework } from "./.gen/providers/aws/data-aws-backup-framework";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsBackupFramework(this, "example", {
+      name: "tf_example_backup_framework_name",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Backup framework name.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the backup framework.
+* `control` - One or more control blocks that make up the framework. Each control in the list has a name, input parameters, and scope. Detailed below.
+* `creationTime` - Date and time that a framework is created, in Unix format and Coordinated Universal Time (UTC).
+* `deploymentStatus` - Deployment status of a framework. The statuses are: `createInProgress` | `updateInProgress` | `deleteInProgress` | `completed`| `failed`.
+* `description` - Description of the framework.
+* `id` - ID of the framework.
+* `status` - Framework consists of one or more controls. Each control governs a resource, such as backup plans, backup selections, backup vaults, or recovery points. You can also turn AWS Config recording on or off for each resource. The statuses are: `active`, `partiallyActive`, `inactive`, `unavailable`. For more information refer to the [AWS documentation for Framework Status](https://docs.aws.amazon.com/aws-backup/latest/devguide/API_DescribeFramework.html#Backup-DescribeFramework-response-FrameworkStatus)
+* `tags` - Metadata that helps organize the frameworks you create.
+
+### Control Attributes
+
+`control` has the following attributes:
+
+* `inputParameter` - One or more input parameter blocks. An example of a control with two parameters is: "backup plan frequency is at least daily and the retention period is at least 1 year". The first parameter is daily. The second parameter is 1 year. Detailed below.
+* `name` - Name of a control.
+* `scope` - Scope of a control. The control scope defines what the control will evaluate. Three examples of control scopes are: a specific backup plan, all backup plans with a specific tag, or all backup plans. Detailed below.
+
+### Input Parameter Attributes
+
+`inputParameter` has the following attributes:
+
+* `name` - Name of a parameter, for example, BackupPlanFrequency.
+* `value` - Value of parameter, for example, hourly.
+
+### Scope Attributes
+
+`scope` has the following attributes:
+
+* `complianceResourceIds` - The ID of the only AWS resource that you want your control scope to contain.
+* `complianceResourceTypes` - Describes whether the control scope includes one or more types of resources, such as EFS or RDS.
+* `tags` - Tag key-value pair applied to those AWS resources that you want to trigger an evaluation for a rule. A maximum of one key-value pair can be provided.
+
+<!-- cache-key: cdktf-0.18.0 input-070382f6ead1d1cc0b69de2f856a82f41ed348235bed7c03c3b9216ebaf43096 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/backup_plan.html.markdown b/website/docs/cdktf/typescript/d/backup_plan.html.markdown
new file mode 100644
index 00000000000..1d400812ea0
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/backup_plan.html.markdown
@@ -0,0 +1,52 @@
+---
+subcategory: "Backup"
+layout: "aws"
+page_title: "AWS: aws_backup_plan"
+description: |-
+  Provides details about an AWS Backup plan.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_backup_plan
+
+Use this data source to get information on an existing backup plan.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsBackupPlan } from "./.gen/providers/aws/data-aws-backup-plan";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsBackupPlan(this, "example", {
+      planId: "tf_example_backup_plan_id",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `planId` - (Required) Backup plan ID.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the backup plan.
+* `name` - Display name of a backup plan.
+* `tags` - Metadata that you can assign to help organize the plans you create.
+* `version` - Unique, randomly generated, Unicode, UTF-8 encoded string that serves as the version ID of the backup plan.
+
+<!-- cache-key: cdktf-0.18.0 input-57458a8d2ad23e0db1998b3c24bffe8d7a9e84c173a10afd8dcf9f9009620a99 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/backup_report_plan.html.markdown b/website/docs/cdktf/typescript/d/backup_report_plan.html.markdown
new file mode 100644
index 00000000000..8b3373bea1c
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/backup_report_plan.html.markdown
@@ -0,0 +1,75 @@
+---
+subcategory: "Backup"
+layout: "aws"
+page_title: "AWS: aws_backup_report_plan"
+description: |-
+  Provides details about an AWS Backup Report Plan.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_backup_report_plan
+
+Use this data source to get information on an existing backup report plan.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsBackupReportPlan } from "./.gen/providers/aws/data-aws-backup-report-plan";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsBackupReportPlan(this, "example", {
+      name: "tf_example_backup_report_plan_name",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Backup report plan name.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the backup report plan.
+* `creationTime` - Date and time that a report plan is created, in Unix format and Coordinated Universal Time (UTC).
+* `deploymentStatus` - Deployment status of a report plan. The statuses are: `createInProgress` | `updateInProgress` | `deleteInProgress` | `completed`.
+* `description` - Description of the report plan.
+* `id` - ID of the report plan.
+* `reportDeliveryChannel` - An object that contains information about where and how to deliver your reports, specifically your Amazon S3 bucket name, S3 key prefix, and the formats of your reports. Detailed below.
+* `reportSetting` - An object that identifies the report template for the report. Reports are built using a report template. Detailed below.
+* `tags` - Metadata that you can assign to help organize the report plans you create.
+
+### Report Delivery Channel Attributes
+
+`reportDeliveryChannel` has the following attributes:
+
+* `formats` - List of the format of your reports: CSV, JSON, or both.
+* `s3BucketName` - Unique name of the S3 bucket that receives your reports.
+* `s3KeyPrefix` - Prefix for where Backup Audit Manager delivers your reports to Amazon S3. The prefix is this part of the following path: s3://your-bucket-name/prefix/Backup/us-west-2/year/month/day/report-name.
+
+### Report Setting Attributes
+
+`reportSetting` has the following attributes:
+
+* `accounts` - (Optional) Specifies the list of accounts a report covers.
+* `frameworkArns` - ARNs of the frameworks a report covers.
+* `numberOfFrameworks` - Specifies the number of frameworks a report covers.
+* `organizationUnits` - (Optional) Specifies the list of Organizational Units a report covers.
+* `regions` - (Optional) Specifies the list of regions a report covers.
+* `reportTemplate` - Identifies the report template for the report. Reports are built using a report template.
+
+<!-- cache-key: cdktf-0.18.0 input-bb9ee564d7e610ad5a515bf5d6d41add676ed63ed91647947ed5d6fcd34dde46 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/backup_selection.html.markdown b/website/docs/cdktf/typescript/d/backup_selection.html.markdown
new file mode 100644
index 00000000000..49eebf48ab0
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/backup_selection.html.markdown
@@ -0,0 +1,53 @@
+---
+subcategory: "Backup"
+layout: "aws"
+page_title: "AWS: aws_backup_selection"
+description: |-
+  Provides details about an AWS Backup selection.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_backup_selection
+
+Use this data source to get information on an existing backup selection.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsBackupSelection } from "./.gen/providers/aws/data-aws-backup-selection";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsBackupSelection(this, "example", {
+      planId: Token.asString(dataAwsBackupPlanExample.id),
+      selectionId: "selection-id-example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `planId` - (Required) Backup plan ID associated with the selection of resources.
+* `selectionId` - (Required) Backup selection ID.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `name` - Display name of a resource selection document.
+* `iamRoleArn` - ARN of the IAM role that AWS Backup uses to authenticate when restoring and backing up the target resource. See the [AWS Backup Developer Guide](https://docs.aws.amazon.com/aws-backup/latest/devguide/access-control.html#managed-policies) for additional information about using AWS managed policies or creating custom policies attached to the IAM role.
+* `resources` - An array of strings that either contain Amazon Resource Names (ARNs) or match patterns of resources to assign to a backup plan..
+
+<!-- cache-key: cdktf-0.18.0 input-534dba699166fbe14df06754eebf249c7a81db83aae51d2b3269662e6cd9a9bd -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/backup_vault.html.markdown b/website/docs/cdktf/typescript/d/backup_vault.html.markdown
new file mode 100644
index 00000000000..f1694c2a83d
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/backup_vault.html.markdown
@@ -0,0 +1,52 @@
+---
+subcategory: "Backup"
+layout: "aws"
+page_title: "AWS: aws_backup_vault"
+description: |-
+  Provides details about an AWS Backup vault.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_backup_vault
+
+Use this data source to get information on an existing backup vault.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsBackupVault } from "./.gen/providers/aws/data-aws-backup-vault";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsBackupVault(this, "example", {
+      name: "example_backup_vault",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name of the backup vault.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the vault.
+* `kmsKeyArn` - Server-side encryption key that is used to protect your backups.
+* `recoveryPoints` - Number of recovery points that are stored in a backup vault.
+* `tags` - Metadata that you can assign to help organize the resources that you create.
+
+<!-- cache-key: cdktf-0.18.0 input-75bcf13abdcd543599d4af41c0a3cd4883e1f1ea69bf45b112f8908ac5682ba7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/batch_compute_environment.html.markdown b/website/docs/cdktf/typescript/d/batch_compute_environment.html.markdown
new file mode 100644
index 00000000000..d158d08f95b
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/batch_compute_environment.html.markdown
@@ -0,0 +1,57 @@
+---
+subcategory: "Batch"
+layout: "aws"
+page_title: "AWS: aws_batch_compute_environment"
+description: |-
+    Provides details about a batch compute environment
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_batch_compute_environment
+
+The Batch Compute Environment data source allows access to details of a specific
+compute environment within AWS Batch.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsBatchComputeEnvironment } from "./.gen/providers/aws/data-aws-batch-compute-environment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsBatchComputeEnvironment(this, "batch-mongo", {
+      computeEnvironmentName: "batch-mongo-production",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `computeEnvironmentName` - (Required) Name of the Batch Compute Environment
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the compute environment.
+* `ecsClusterArn` - ARN of the underlying Amazon ECS cluster used by the compute environment.
+* `serviceRole` - ARN of the IAM role that allows AWS Batch to make calls to other AWS services on your behalf.
+* `type` - Type of the compute environment (for example, `managed` or `unmanaged`).
+* `status` - Current status of the compute environment (for example, `creating` or `valid`).
+* `statusReason` - Short, human-readable string to provide additional details about the current status of the compute environment.
+* `state` - State of the compute environment (for example, `enabled` or `disabled`). If the state is `enabled`, then the compute environment accepts jobs from a queue and can scale out automatically based on queues.
+* `tags` - Key-value map of resource tags
+
+<!-- cache-key: cdktf-0.18.0 input-40ea513f9e96b190b76debe79cd7a41eb8991b1bc0efea47e7c5e257dd7f3f34 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/batch_job_queue.html.markdown b/website/docs/cdktf/typescript/d/batch_job_queue.html.markdown
new file mode 100644
index 00000000000..fa395b15981
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/batch_job_queue.html.markdown
@@ -0,0 +1,62 @@
+---
+subcategory: "Batch"
+layout: "aws"
+page_title: "AWS: aws_batch_job_queue"
+description: |-
+    Provides details about a batch job queue
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_batch_job_queue
+
+The Batch Job Queue data source allows access to details of a specific
+job queue within AWS Batch.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsBatchJobQueue } from "./.gen/providers/aws/data-aws-batch-job-queue";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsBatchJobQueue(this, "test-queue", {
+      name: "tf-test-batch-job-queue",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name of the job queue.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the job queue.
+* `schedulingPolicyArn` - The ARN of the fair share scheduling policy. If this attribute has a value, the job queue uses a fair share scheduling policy. If this attribute does not have a value, the job queue uses a first in, first out (FIFO) scheduling policy.
+* `status` - Current status of the job queue (for example, `creating` or `valid`).
+* `statusReason` - Short, human-readable string to provide additional details about the current status
+    of the job queue.
+* `state` - Describes the ability of the queue to accept new jobs (for example, `enabled` or `disabled`).
+* `tags` - Key-value map of resource tags
+* `priority` - Priority of the job queue. Job queues with a higher priority are evaluated first when
+    associated with the same compute environment.
+* `computeEnvironmentOrder` - The compute environments that are attached to the job queue and the order in
+    which job placement is preferred. Compute environments are selected for job placement in ascending order.
+    * `computeEnvironmentOrder.#Order` - The order of the compute environment.
+    * `computeEnvironmentOrder.#ComputeEnvironment` - The ARN of the compute environment.
+
+<!-- cache-key: cdktf-0.18.0 input-458fa4c54b7533c202af979978ce3bfb9fac6c2e69a836bcfd612403c16fe74e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/batch_scheduling_policy.html.markdown b/website/docs/cdktf/typescript/d/batch_scheduling_policy.html.markdown
new file mode 100644
index 00000000000..99c142db9bd
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/batch_scheduling_policy.html.markdown
@@ -0,0 +1,62 @@
+---
+subcategory: "Batch"
+layout: "aws"
+page_title: "AWS: aws_batch_scheduling_policy"
+description: |-
+    Provides details about a Batch Scheduling Policy
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_batch_scheduling_policy
+
+The Batch Scheduling Policy data source allows access to details of a specific Scheduling Policy within AWS Batch.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsBatchSchedulingPolicy } from "./.gen/providers/aws/data-aws-batch-scheduling-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsBatchSchedulingPolicy(this, "test", {
+      arn: "arn:aws:batch:us-east-1:012345678910:scheduling-policy/example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `arn` - (Required) ARN of the scheduling policy.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `fairsharePolicy` - Fairshare policy block specifies the `computeReservation`, `shareDelaySeconds`, and `shareDistribution` of the scheduling policy. The `fairsharePolicy` block is documented below.
+* `name` - Name of the scheduling policy.
+* `tags` - Key-value map of resource tags
+
+A `fairsharePolicy` block supports the following arguments:
+
+* `computeReservation` - Value used to reserve some of the available maximum vCPU for fair share identifiers that have not yet been used. For more information, see [FairsharePolicy](https://docs.aws.amazon.com/batch/latest/APIReference/API_FairsharePolicy.html).
+* `shareDelaySeconds` - Time period to use to calculate a fair share percentage for each fair share identifier in use, in seconds. For more information, see [FairsharePolicy](https://docs.aws.amazon.com/batch/latest/APIReference/API_FairsharePolicy.html).
+* `shareDistribution` - One or more share distribution blocks which define the weights for the fair share identifiers for the fair share policy. For more information, see [FairsharePolicy](https://docs.aws.amazon.com/batch/latest/APIReference/API_FairsharePolicy.html). The `shareDistribution` block is documented below.
+
+A `shareDistribution` block supports the following arguments:
+
+* `shareIdentifier` - Fair share identifier or fair share identifier prefix. For more information, see [ShareAttributes](https://docs.aws.amazon.com/batch/latest/APIReference/API_ShareAttributes.html).
+* `weightFactor` - Weight factor for the fair share identifier. For more information, see [ShareAttributes](https://docs.aws.amazon.com/batch/latest/APIReference/API_ShareAttributes.html).
+
+<!-- cache-key: cdktf-0.18.0 input-a3c940bd9dab02eb61feff7643ca700cbd6562b5e25eb6379d0c7a0bc4618bc4 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/billing_service_account.html.markdown b/website/docs/cdktf/typescript/d/billing_service_account.html.markdown
new file mode 100644
index 00000000000..15981ab8513
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/billing_service_account.html.markdown
@@ -0,0 +1,95 @@
+---
+subcategory: "Meta Data Sources"
+layout: "aws"
+page_title: "AWS: aws_billing_service_account"
+description: |-
+  Get AWS Billing Service Account
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_billing_service_account
+
+Use this data source to get the Account ID of the [AWS Billing and Cost Management Service Account](http://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-getting-started.html#step-2) for the purpose of permitting in S3 bucket policy.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsBillingServiceAccount } from "./.gen/providers/aws/data-aws-billing-service-account";
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketAcl } from "./.gen/providers/aws/s3-bucket-acl";
+import { S3BucketPolicy } from "./.gen/providers/aws/s3-bucket-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const billingLogs = new S3Bucket(this, "billing_logs", {
+      bucket: "my-billing-tf-test-bucket",
+    });
+    new S3BucketAcl(this, "billing_logs_acl", {
+      acl: "private",
+      bucket: billingLogs.id,
+    });
+    const main = new DataAwsBillingServiceAccount(this, "main", {});
+    const allowBillingLogging = new DataAwsIamPolicyDocument(
+      this,
+      "allow_billing_logging",
+      {
+        statement: [
+          {
+            actions: ["s3:GetBucketAcl", "s3:GetBucketPolicy"],
+            effect: "Allow",
+            principals: [
+              {
+                identifiers: [Token.asString(main.arn)],
+                type: "AWS",
+              },
+            ],
+            resources: [billingLogs.arn],
+          },
+          {
+            actions: ["s3:PutObject"],
+            effect: "Allow",
+            principals: [
+              {
+                identifiers: [Token.asString(main.arn)],
+                type: "AWS",
+              },
+            ],
+            resources: ["${" + billingLogs.arn + "}/*"],
+          },
+        ],
+      }
+    );
+    const awsS3BucketPolicyAllowBillingLogging = new S3BucketPolicy(
+      this,
+      "allow_billing_logging_4",
+      {
+        bucket: billingLogs.id,
+        policy: Token.asString(allowBillingLogging.json),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketPolicyAllowBillingLogging.overrideLogicalId(
+      "allow_billing_logging"
+    );
+  }
+}
+
+```
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the AWS billing service account.
+* `arn` - ARN of the AWS billing service account.
+
+<!-- cache-key: cdktf-0.18.0 input-8925e83aaf4808ed4c7dc3e71d2003c1129f36ec86722b8b5095c47d2188bd28 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/budgets_budget.html.markdown b/website/docs/cdktf/typescript/d/budgets_budget.html.markdown
new file mode 100644
index 00000000000..73b85c1376b
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/budgets_budget.html.markdown
@@ -0,0 +1,152 @@
+---
+subcategory: "Web Services Budgets"
+layout: "aws"
+page_title: "AWS: aws_budgets_budget"
+description: |-
+  Terraform data source for managing an AWS Web Services Budgets Budget.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_budgets_budget
+
+Terraform data source for managing an AWS Web Services Budgets Budget.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsBudgetsBudget } from "./.gen/providers/aws/data-aws-budgets-budget";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsBudgetsBudget(this, "test", {
+      name: Token.asString(awsBudgetsBudgetTest.name),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - The name of a budget. Unique within accounts.
+
+The following arguments are optional:
+
+* `accountId` - The ID of the target account for budget. Will use current user's account_id by default if omitted.
+* `namePrefix` - The prefix of the name of a budget. Unique within accounts.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `autoAdjustData` - Object containing [AutoAdjustData] which determines the budget amount for an auto-adjusting budget.
+* `budgetExceeded` - Boolean indicating whether this budget has been exceeded.
+* `budgetLimit` - The total amount of cost, usage, RI utilization, RI coverage, Savings Plans utilization, or Savings Plans coverage that you want to track with your budget. Contains object [Spend](#spend).
+* `budgetType` - Whether this budget tracks monetary cost or usage.
+* `calculatedSpend` - The spend objects that are associated with this budget. The [actualSpend](#actual-spend) tracks how much you've used, cost, usage, RI units, or Savings Plans units and the [forecastedSpend](#forecasted-spend) tracks how much that you're predicted to spend based on your historical usage profile.
+* `costFilter` - A list of [CostFilter](#cost-filter) name/values pair to apply to budget.
+* `costTypes` - Object containing [CostTypes](#cost-types) The types of cost included in a budget, such as tax and subscriptions.
+* `notification` - Object containing [Budget Notifications](#budget-notification). Can be used multiple times to define more than one budget notification.
+* `plannedLimit` - Object containing [Planned Budget Limits](#planned-budget-limits). Can be used multiple times to plan more than one budget limit. See [PlannedBudgetLimits](https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_budgets_Budget.html#awscostmanagement-Type-budgets_Budget-PlannedBudgetLimits) documentation.
+* `timePeriodEnd` - The end of the time period covered by the budget. There are no restrictions on the end date. Format: `2017010112:00`.
+* `timePeriodStart` - The start of the time period covered by the budget. If you don't specify a start date, AWS defaults to the start of your chosen time period. The start date must come before the end date. Format: `2017010112:00`.
+* `timeUnit` - The length of time until a budget resets the actual and forecasted spend. Valid values: `monthly`, `quarterly`, `annually`, and `daily`.
+
+### Actual Spend
+
+The amount of cost, usage, RI units, or Savings Plans units that you used. Type is [Spend](#spend)
+
+### Auto Adjust Data
+
+The parameters that determine the budget amount for an auto-adjusting budget.
+
+* `autoAdjustType` (Required) - The string that defines whether your budget auto-adjusts based on historical or forecasted data. Valid values: `forecast`,`historical`.
+* `historicalOptions` (Optional) - Configuration block of [Historical Options](#historical-options). Required for `autoAdjustType` of `historical` Configuration block that defines the historical data that your auto-adjusting budget is based on.
+* `lastAutoAdjustTime` (Optional) - The last time that your budget was auto-adjusted.
+
+### Budget Notification
+
+Valid keys for `notification` parameter.
+
+* `comparisonOperator` - (Required) Comparison operator to use to evaluate the condition. Can be `lessThan`, `equalTo` or `greaterThan`.
+* `threshold` - (Required) Threshold when the notification should be sent.
+* `thresholdType` - (Required) What kind of threshold is defined. Can be `percentage` OR `absoluteValue`.
+* `notificationType` - (Required) What kind of budget value to notify on. Can be `actual` or `forecasted`.
+* `subscriberEmailAddresses` - (Optional) E-Mail addresses to notify. Either this or `subscriberSnsTopicArns` is required.
+* `subscriberSnsTopicArns` - (Optional) SNS topics to notify. Either this or `subscriberEmailAddresses` is required.
+
+### Cost Filter
+
+Based on your choice of budget type, you can choose one or more of the available budget filters.
+
+* `purchaseType`
+* `usageTypeGroup`
+* `service`
+* `operation`
+* `usageType`
+* `billingEntity`
+* `costCategory`
+* `linkedAccount`
+* `tagKeyValue`
+* `legalEntityName`
+* `invoicingEntity`
+* `az`
+* `region`
+* `instanceType`
+
+Refer to [AWS CostFilter documentation](https://docs.aws.amazon.com/cost-management/latest/userguide/budgets-create-filters.html) for further detail.
+
+### Cost Types
+
+Valid keys for `costTypes` parameter.
+
+* `includeCredit` - A boolean value whether to include credits in the cost budget. Defaults to `true`.
+* `includeDiscount` - Whether a budget includes discounts. Defaults to `true`.
+* `includeOtherSubscription` - A boolean value whether to include other subscription costs in the cost budget. Defaults to `true`.
+* `includeRecurring` - A boolean value whether to include recurring costs in the cost budget. Defaults to `true`.
+* `includeRefund` - A boolean value whether to include refunds in the cost budget. Defaults to `true`.
+* `includeSubscription` - A boolean value whether to include subscriptions in the cost budget. Defaults to `true`.
+* `includeSupport` - A boolean value whether to include support costs in the cost budget. Defaults to `true`.
+* `includeTax` - A boolean value whether to include tax in the cost budget. Defaults to `true`.
+* `includeUpfront` - A boolean value whether to include upfront costs in the cost budget. Defaults to `true`.
+* `useAmortized` - Whether a budget uses the amortized rate. Defaults to `false`.
+* `useBlended` - A boolean value whether to use blended costs in the cost budget. Defaults to `false`.
+
+Refer to [AWS CostTypes documentation](https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_budgets_CostTypes.html) for further detail.
+
+### Forecasted Spend
+
+The amount of cost, usage, RI units, or Savings Plans units that you're forecasted to use.
+Type is [Spend](#spend)
+
+### Historical Options
+
+* `budgetAdjustmentPeriod` (Required) - The number of budget periods included in the moving-average calculation that determines your auto-adjusted budget amount.
+* `lookbackAvailablePeriods` (Optional) - The integer that describes how many budget periods in your BudgetAdjustmentPeriod are included in the calculation of your current budget limit. If the first budget period in your BudgetAdjustmentPeriod has no cost data, then that budget period isn’t included in the average that determines your budget limit. You can’t set your own LookBackAvailablePeriods. The value is automatically calculated from the `budgetAdjustmentPeriod` and your historical cost data.
+
+### Planned Budget Limits
+
+Valid keys for `plannedLimit` parameter.
+
+* `amount` - (Required) The amount of cost or usage being measured for a budget.
+* `startTime` - (Required) The start time of the budget limit. Format: `2017010112:00`. See [PlannedBudgetLimits](https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_budgets_Budget.html#awscostmanagement-Type-budgets_Budget-PlannedBudgetLimits) documentation.
+* `unit` - (Required) The unit of measurement used for the budget forecast, actual spend, or budget threshold, such as dollars or GB. See [Spend](http://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/data-type-spend.html) documentation.
+
+### Spend
+
+* `amount` - The cost or usage amount that's associated with a budget forecast, actual spend, or budget threshold. Length Constraints: Minimum length of `1`. Maximum length of `2147483647`.
+* `unit` - The unit of measurement that's used for the budget forecast, actual spend, or budget threshold, such as USD or GBP. Length Constraints: Minimum length of `1`. Maximum length of `2147483647`.
+
+<!-- cache-key: cdktf-0.18.0 input-b7c31c3ad39479e59da06d0c3fe09f56627948373042fa6519f4be932fdc9787 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/caller_identity.html.markdown b/website/docs/cdktf/typescript/d/caller_identity.html.markdown
new file mode 100644
index 00000000000..9e18b0dbca8
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/caller_identity.html.markdown
@@ -0,0 +1,59 @@
+---
+subcategory: "STS (Security Token)"
+layout: "aws"
+page_title: "AWS: aws_caller_identity"
+description: |-
+  Get information about the identity of the caller for the provider
+  connection to AWS.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_caller_identity
+
+Use this data source to get the access to the effective Account ID, User ID, and ARN in
+which Terraform is authorized.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformOutput, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCallerIdentity } from "./.gen/providers/aws/data-aws-caller-identity";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const current = new DataAwsCallerIdentity(this, "current", {});
+    new TerraformOutput(this, "account_id", {
+      value: current.accountId,
+    });
+    new TerraformOutput(this, "caller_arn", {
+      value: current.arn,
+    });
+    new TerraformOutput(this, "caller_user", {
+      value: current.userId,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+There are no arguments available for this data source.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `accountId` - AWS Account ID number of the account that owns or contains the calling entity.
+* `arn` - ARN associated with the calling entity.
+* `id` - Account ID number of the account that owns or contains the calling entity.
+* `userId` - Unique identifier of the calling entity.
+
+<!-- cache-key: cdktf-0.18.0 input-00a75824635dd096c73d792ee6588548d7424d85ce15eeacc898c5211b3f1527 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/canonical_user_id.html.markdown b/website/docs/cdktf/typescript/d/canonical_user_id.html.markdown
new file mode 100644
index 00000000000..099b8213e92
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/canonical_user_id.html.markdown
@@ -0,0 +1,54 @@
+---
+subcategory: "S3 (Simple Storage)"
+layout: "aws"
+page_title: "AWS: aws_canonical_user_id"
+description: |-
+  Provides the canonical user ID for the AWS account associated with the provider
+  connection to AWS.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_canonical_user_id
+
+The Canonical User ID data source allows access to the [canonical user ID](http://docs.aws.amazon.com/general/latest/gr/acct-identifiers.html)
+for the effective account in which Terraform is working.  
+
+~> **NOTE:** To use this data source, you must have the `s3:listAllMyBuckets` permission.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformOutput, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCanonicalUserId } from "./.gen/providers/aws/data-aws-canonical-user-id";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const current = new DataAwsCanonicalUserId(this, "current", {});
+    new TerraformOutput(this, "canonical_user_id", {
+      value: current.id,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+There are no arguments available for this data source.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - Canonical user ID associated with the AWS account.
+
+* `displayName` - Human-friendly name linked to the canonical user ID. The bucket owner's display name. **NOTE:** [This value](https://docs.aws.amazon.com/AmazonS3/latest/API/RESTServiceGET.html) is only included in the response in the US East (N. Virginia), US West (N. California), US West (Oregon), Asia Pacific (Singapore), Asia Pacific (Sydney), Asia Pacific (Tokyo), EU (Ireland), and South America (São Paulo) regions.
+
+<!-- cache-key: cdktf-0.18.0 input-db8220f51071b9966f2634f970bb7fc28053743696bb94d88dcc12f05f864080 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/ce_cost_category.html.markdown b/website/docs/cdktf/typescript/d/ce_cost_category.html.markdown
new file mode 100644
index 00000000000..453d70be2c9
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/ce_cost_category.html.markdown
@@ -0,0 +1,108 @@
+---
+subcategory: "CE (Cost Explorer)"
+layout: "aws"
+page_title: "AWS: aws_ce_cost_category"
+description: |-
+  Provides details about a specific CostExplorer Cost Category Definition
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ce_cost_category
+
+Provides details about a specific CostExplorer Cost Category.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCeCostCategory } from "./.gen/providers/aws/data-aws-ce-cost-category";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsCeCostCategory(this, "example", {
+      costCategoryArn: "costCategoryARN",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `costCategoryArn` - (Required) Unique name for the Cost Category.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the cost category.
+* `defaultValue` - Default value for the cost category.
+* `effectiveEnd` - Effective end data of your Cost Category.
+* `effectiveStart` - Effective state data of your Cost Category.
+* `id` - Unique ID of the cost category.
+* `rule` - Configuration block for the Cost Category rules used to categorize costs. See below.
+* `ruleVersion` - Rule schema version in this particular Cost Category.
+* `splitChargeRule` - Configuration block for the split charge rules used to allocate your charges between your Cost Category values. See below.
+* `tags` - Resource tags.
+
+### `rule`
+
+* `inheritedValue` - Configuration block for the value the line item is categorized as if the line item contains the matched dimension. See below.
+* `rule` - Configuration block for the `expression` object used to categorize costs. See below.
+* `type` - You can define the CostCategoryRule rule type as either `regular` or `inheritedValue`.
+* `value` - Default value for the cost category.
+
+### `inheritedValue`
+
+* `dimensionKey` - Key to extract cost category values.
+* `dimensionName` - Name of the dimension that's used to group costs. If you specify `linkedAccountName`, the cost category value is based on account name. If you specify `tag`, the cost category value will be based on the value of the specified tag key. Valid values are `linkedAccountName`, `tag`
+
+### `rule`
+
+* `and` - Return results that match both `dimension` objects.
+* `costCategory` - Configuration block for the filter that's based on `costCategory` values. See below.
+* `dimension` - Configuration block for the specific `dimension` to use for `expression`. See below.
+* `not` - Return results that do not match the `dimension` object.
+* `or` - Return results that match either `dimension` object.
+* `tags` - Configuration block for the specific `tag` to use for `expression`. See below.
+
+### `costCategory`
+
+* `key` - Unique name of the Cost Category.
+* `matchOptions` - Match options that you can use to filter your results. MatchOptions is only applicable for actions related to cost category. The default values for MatchOptions is `equals` and `caseSensitive`. Valid values are: `equals`,  `absent`, `startsWith`, `endsWith`, `contains`, `caseSensitive`, `caseInsensitive`.
+* `values` - Specific value of the Cost Category.
+
+### `dimension`
+
+* `key` - Unique name of the Cost Category.
+* `matchOptions` - Match options that you can use to filter your results. MatchOptions is only applicable for actions related to cost category. The default values for MatchOptions is `equals` and `caseSensitive`. Valid values are: `equals`,  `absent`, `startsWith`, `endsWith`, `contains`, `caseSensitive`, `caseInsensitive`.
+* `values` - Specific value of the Cost Category.
+
+### `tags`
+
+* `key` - Key for the tag.
+* `matchOptions` - Match options that you can use to filter your results. MatchOptions is only applicable for actions related to cost category. The default values for MatchOptions is `equals` and `caseSensitive`. Valid values are: `equals`,  `absent`, `startsWith`, `endsWith`, `contains`, `caseSensitive`, `caseInsensitive`.
+* `values` - Specific value of the Cost Category.
+
+### `splitChargeRule`
+
+* `method` - Method that's used to define how to split your source costs across your targets. Valid values are `fixed`, `proportional`, `even`
+* `parameter` - Configuration block for the parameters for a split charge method. This is only required for the `fixed` method. See below.
+* `source` - Cost Category value that you want to split.
+* `targets` - Cost Category values that you want to split costs across. These values can't be used as a source in other split charge rules.
+
+### `parameter`
+
+* `type` - Parameter type.
+* `values` - Parameter values.
+
+<!-- cache-key: cdktf-0.18.0 input-4cb2fbc95adf79676205ba698e97a322301998e777b3e00de5567e2938e38ac6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/ce_tags.html.markdown b/website/docs/cdktf/typescript/d/ce_tags.html.markdown
new file mode 100644
index 00000000000..bef98217503
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/ce_tags.html.markdown
@@ -0,0 +1,97 @@
+---
+subcategory: "CE (Cost Explorer)"
+layout: "aws"
+page_title: "AWS: aws_ce_tags"
+description: |-
+  Provides details about a specific CE Tags
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ce_tags
+
+Provides details about a specific CE Tags.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCeTags } from "./.gen/providers/aws/data-aws-ce-tags";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsCeTags(this, "test", {
+      timePeriod: {
+        end: "2022-12-01",
+        start: "2021-01-01",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `timePeriod` - (Required) Configuration block for the start and end dates for retrieving the dimension values.
+
+The following arguments are optional:
+
+* `filter` - (Optional) Configuration block for the `expression` object used to categorize costs. See below.
+* `searchString` - (Optional) Value that you want to search for.
+* `sortBy` - (Optional) Configuration block for the value by which you want to sort the data. See below.
+* `tagKey` - (Optional) Key of the tag that you want to return values for.
+
+### `timePeriod`
+
+* `start` - (Required) End of the time period.
+* `end` - (Required) Beginning of the time period.
+
+### `filter`
+
+* `and` - (Optional) Return results that match both `dimension` objects.
+* `costCategory` - (Optional) Configuration block for the filter that's based on `costCategory` values. See below.
+* `dimension` - (Optional) Configuration block for the specific `dimension` to use for `expression`. See below.
+* `not` - (Optional) Return results that match both `dimension` object.
+* `or` - (Optional) Return results that match both `dimension` object.
+* `tag` - (Optional) Configuration block for the specific `tag` to use for `expression`. See below.
+
+### `costCategory`
+
+* `key` - (Optional) Unique name of the Cost Category.
+* `matchOptions` - (Optional) Match options that you can use to filter your results. MatchOptions is only applicable for actions related to cost category. The default values for MatchOptions is `equals` and `caseSensitive`. Valid values are: `equals`,  `absent`, `startsWith`, `endsWith`, `contains`, `caseSensitive`, `caseInsensitive`.
+* `values` - (Optional) Specific value of the Cost Category.
+
+### `dimension`
+
+* `key` - (Optional) Unique name of the Cost Category.
+* `matchOptions` - (Optional) Match options that you can use to filter your results. MatchOptions is only applicable for actions related to cost category. The default values for MatchOptions is `equals` and `caseSensitive`. Valid values are: `equals`,  `absent`, `startsWith`, `endsWith`, `contains`, `caseSensitive`, `caseInsensitive`.
+* `values` - (Optional) Specific value of the Cost Category.
+
+### `tag`
+
+* `key` - (Optional) Key for the tag.
+* `matchOptions` - (Optional) Match options that you can use to filter your results. MatchOptions is only applicable for actions related to cost category. The default values for MatchOptions is `equals` and `caseSensitive`. Valid values are: `equals`,  `absent`, `startsWith`, `endsWith`, `contains`, `caseSensitive`, `caseInsensitive`.
+* `values` - (Optional) Specific value of the Cost Category.
+
+### `sortBy`
+
+* `key` - (Required) key that's used to sort the data. Valid values are: `blendedCost`,  `unblendedCost`, `amortizedCost`, `netAmortizedCost`, `netUnblendedCost`, `usageQuantity`, `normalizedUsageAmount`.
+* `sortOrder` - (Optional) order that's used to sort the data. Valid values are: `ascending`,  `descending`.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - Unique ID of the tag.
+* `tags` - Tags that match your request.
+
+<!-- cache-key: cdktf-0.18.0 input-9527a8a7806958858a1fefa9886293028fd6d96e84f71de91cdd7a28d03de47b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/cloudcontrolapi_resource.html.markdown b/website/docs/cdktf/typescript/d/cloudcontrolapi_resource.html.markdown
new file mode 100644
index 00000000000..8b991cb3ce8
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/cloudcontrolapi_resource.html.markdown
@@ -0,0 +1,56 @@
+---
+subcategory: "Cloud Control API"
+layout: "aws"
+page_title: "AWS: aws_cloudcontrolapi_resource"
+description: |-
+    Provides details for a Cloud Control API Resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_cloudcontrolapi_resource
+
+Provides details for a Cloud Control API Resource. The reading of these resources is proxied through Cloud Control API handlers to the backend service.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCloudcontrolapiResource } from "./.gen/providers/aws/data-aws-cloudcontrolapi-resource";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsCloudcontrolapiResource(this, "example", {
+      identifier: "example",
+      typeName: "AWS::ECS::Cluster",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `identifier` - (Required) Identifier of the CloudFormation resource type. For example, `vpc12345678`.
+* `typeName` - (Required) CloudFormation resource type name. For example, `aws::ec2::vpc`.
+
+The following arguments are optional:
+
+* `roleArn` - (Optional) ARN of the IAM Role to assume for operations.
+* `typeVersionId` - (Optional) Identifier of the CloudFormation resource type version.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `properties` - JSON string matching the CloudFormation resource type schema with current configuration. Underlying attributes can be referenced via the [`jsondecode()` function](https://www.terraform.io/docs/language/functions/jsondecode.html), for example, `jsondecode(dataAwsCloudcontrolapiResourceExampleProperties)["example"]`.
+
+<!-- cache-key: cdktf-0.18.0 input-619243038d5099b2d587f9f52a10ce00ce779e82bd95bb840d0d03a6570a1a61 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/cloudformation_export.html.markdown b/website/docs/cdktf/typescript/d/cloudformation_export.html.markdown
new file mode 100644
index 00000000000..61d455f1e2d
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/cloudformation_export.html.markdown
@@ -0,0 +1,57 @@
+---
+subcategory: "CloudFormation"
+layout: "aws"
+page_title: "AWS: aws_cloudformation_export"
+description: |-
+    Provides metadata of a CloudFormation Export (e.g., Cross Stack References)
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_cloudformation_export
+
+The CloudFormation Export data source allows access to stack
+exports specified in the [Output](http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/outputs-section-structure.html) section of the Cloudformation Template using the optional Export Property.
+
+ -> Note: If you are trying to use a value from a Cloudformation Stack in the same Terraform run please use normal interpolation or Cloudformation Outputs.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCloudformationExport } from "./.gen/providers/aws/data-aws-cloudformation-export";
+import { Instance } from "./.gen/providers/aws/instance";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const subnetId = new DataAwsCloudformationExport(this, "subnet_id", {
+      name: "mySubnetIdExportName",
+    });
+    new Instance(this, "web", {
+      ami: "ami-abb07bcb",
+      instanceType: "t2.micro",
+      subnetId: Token.asString(subnetId.value),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `name` - (Required) Name of the export as it appears in the console or from [list-exports](http://docs.aws.amazon.com/cli/latest/reference/cloudformation/list-exports.html)
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `value` - Value from Cloudformation export identified by the export name found from [list-exports](http://docs.aws.amazon.com/cli/latest/reference/cloudformation/list-exports.html)
+* `exportingStackId` - ARN of stack that contains the exported output name and value.
+
+<!-- cache-key: cdktf-0.18.0 input-ea221c8f2e1fb315847f21fd305282c9ac5244739898e9391797602940e42bd3 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/cloudformation_stack.html.markdown b/website/docs/cdktf/typescript/d/cloudformation_stack.html.markdown
new file mode 100644
index 00000000000..0eb28208214
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/cloudformation_stack.html.markdown
@@ -0,0 +1,70 @@
+---
+subcategory: "CloudFormation"
+layout: "aws"
+page_title: "AWS: aws_cloudformation_stack"
+description: |-
+    Provides metadata of a CloudFormation stack (e.g., outputs)
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_cloudformation_stack
+
+The CloudFormation Stack data source allows access to stack
+outputs and other useful data including the template body.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCloudformationStack } from "./.gen/providers/aws/data-aws-cloudformation-stack";
+import { Instance } from "./.gen/providers/aws/instance";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const network = new DataAwsCloudformationStack(this, "network", {
+      name: "my-network-stack",
+    });
+    new Instance(this, "web", {
+      ami: "ami-abb07bcb",
+      instanceType: "t2.micro",
+      subnetId: Token.asString(
+        Fn.lookupNested(network.outputs, ['"SubnetId"'])
+      ),
+      tags: {
+        Name: "HelloWorld",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name of the stack
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `capabilities` - List of capabilities
+* `description` - Description of the stack
+* `disableRollback` - Whether the rollback of the stack is disabled when stack creation fails
+* `notificationArns` - List of SNS topic ARNs to publish stack related events
+* `outputs` - Map of outputs from the stack.
+* `parameters` - Map of parameters that specify input parameters for the stack.
+* `tags` - Map of tags associated with this stack.
+* `templateBody` - Structure containing the template body.
+* `iamRoleArn` - ARN of the IAM role used to create the stack.
+* `timeoutInMinutes` - Amount of time that can pass before the stack status becomes `createFailed`
+
+<!-- cache-key: cdktf-0.18.0 input-a9acea3392c4b01ef5f2a16da219c4a26f63291cbb995f3f40b2de0113d12c7d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/cloudformation_type.html.markdown b/website/docs/cdktf/typescript/d/cloudformation_type.html.markdown
new file mode 100644
index 00000000000..baaa521c23c
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/cloudformation_type.html.markdown
@@ -0,0 +1,65 @@
+---
+subcategory: "CloudFormation"
+layout: "aws"
+page_title: "AWS: aws_cloudformation_type"
+description: |-
+    Provides details about a CloudFormation Type.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_cloudformation_type
+
+Provides details about a CloudFormation Type.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCloudformationType } from "./.gen/providers/aws/data-aws-cloudformation-type";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsCloudformationType(this, "example", {
+      type: "RESOURCE",
+      typeName: "AWS::Athena::WorkGroup",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `arn` - (Optional) ARN of the CloudFormation Type. For example, `arn:aws:cloudformation:usWest2::type/resource/awsEc2Vpc`.
+* `type` - (Optional) CloudFormation Registry Type. For example, `resource`.
+* `typeName` - (Optional) CloudFormation Type name. For example, `aws::ec2::vpc`.
+* `versionId` - (Optional) Identifier of the CloudFormation Type version.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `defaultVersionId` - Identifier of the CloudFormation Type default version.
+* `deprecatedStatus` - Deprecation status of the CloudFormation Type.
+* `description` - Description of the CloudFormation Type.
+* `documentationUrl` - URL of the documentation for the CloudFormation Type.
+* `executionRoleArn` - ARN of the IAM Role used to register the CloudFormation Type.
+* `isDefaultVersion` - Whether the CloudFormation Type version is the default version.
+* `loggingConfig` - List of objects containing logging configuration.
+    * `logGroupName` - Name of the CloudWatch Log Group where CloudFormation sends error logging information when invoking the type's handlers.
+    * `logRoleArn` - ARN of the IAM Role CloudFormation assumes when sending error logging information to CloudWatch Logs.
+* `provisioningType` - Provisioning behavior of the CloudFormation Type.
+* `schema` - JSON document of the CloudFormation Type schema.
+* `sourceUrl` - URL of the source code for the CloudFormation Type.
+* `visibility` - Scope of the CloudFormation Type.
+
+<!-- cache-key: cdktf-0.18.0 input-dbfea51aa26b3fcf5acdfa155004e8f1f27058ce9b62acf8eba0a37e7a8775f5 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/cloudfront_cache_policy.html.markdown b/website/docs/cdktf/typescript/d/cloudfront_cache_policy.html.markdown
new file mode 100644
index 00000000000..05a4c40ef48
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/cloudfront_cache_policy.html.markdown
@@ -0,0 +1,108 @@
+---
+subcategory: "CloudFront"
+layout: "aws"
+page_title: "AWS: aws_cloudfront_cache_policy"
+description: |-
+  Use this data source to retrieve information about a CloudFront cache policy.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_cloudfront_cache_policy
+
+Use this data source to retrieve information about a CloudFront cache policy.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCloudfrontCachePolicy } from "./.gen/providers/aws/data-aws-cloudfront-cache-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsCloudfrontCachePolicy(this, "example", {
+      name: "example-policy",
+    });
+  }
+}
+
+```
+
+### AWS-Managed Policies
+
+AWS managed cache policy names are prefixed with `managed`:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCloudfrontCachePolicy } from "./.gen/providers/aws/data-aws-cloudfront-cache-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsCloudfrontCachePolicy(this, "example", {
+      name: "Managed-CachingOptimized",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Optional) Unique name to identify the cache policy.
+* `id` - (Optional) Identifier for the cache policy.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `etag` - Current version of the cache policy.
+* `minTtl` - Minimum amount of time, in seconds, that you want objects to stay in the CloudFront cache before CloudFront sends another request to the origin to see if the object has been updated.
+* `maxTtl` - Maximum amount of time, in seconds, that objects stay in the CloudFront cache before CloudFront sends another request to the origin to see if the object has been updated.
+* `defaultTtl` - Default amount of time, in seconds, that you want objects to stay in the CloudFront cache before CloudFront sends another request to the origin to see if the object has been updated.
+* `comment` - Comment to describe the cache policy.
+* `parametersInCacheKeyAndForwardedToOrigin` - The HTTP headers, cookies, and URL query strings to include in the cache key. See [Parameters In Cache Key And Forwarded To Origin](#parameters-in-cache-key-and-forwarded-to-origin) for more information.
+
+### Parameters In Cache Key And Forwarded To Origin
+
+* `cookiesConfig` - Object that determines whether any cookies in viewer requests (and if so, which cookies) are included in the cache key and automatically included in requests that CloudFront sends to the origin. See [Cookies Config](#cookies-config) for more information.
+* `headersConfig` - Object that determines whether any HTTP headers (and if so, which headers) are included in the cache key and automatically included in requests that CloudFront sends to the origin. See [Headers Config](#headers-config) for more information.
+* `queryStringsConfig` - Object that determines whether any URL query strings in viewer requests (and if so, which query strings) are included in the cache key and automatically included in requests that CloudFront sends to the origin. See [Query String Config](#query-string-config) for more information.
+* `enableAcceptEncodingBrotli` - A flag that can affect whether the Accept-Encoding HTTP header is included in the cache key and included in requests that CloudFront sends to the origin.
+* `enableAcceptEncodingGzip` - A flag that can affect whether the Accept-Encoding HTTP header is included in the cache key and included in requests that CloudFront sends to the origin.
+
+### Cookies Config
+
+* `cookieBehavior` - Determines whether any cookies in viewer requests are included in the cache key and automatically included in requests that CloudFront sends to the origin. Valid values are `none`, `whitelist`, `allExcept`, `all`.
+* `cookies` - Object that contains a list of cookie names. See [Items](#items) for more information.
+
+### Headers Config
+
+* `headerBehavior` - Determines whether any HTTP headers are included in the cache key and automatically included in requests that CloudFront sends to the origin. Valid values are `none`, `whitelist`.
+* `headers` - Object that contains a list of header names. See [Items](#items) for more information.
+
+### Query String Config
+
+* `queryStringBehavior` - Determines whether any URL query strings in viewer requests are included in the cache key and automatically included in requests that CloudFront sends to the origin. Valid values are `none`, `whitelist`, `allExcept`, `all`.
+* `queryStrings` - Object that contains a list of query string names. See [Items](#items) for more information.
+
+### Items
+
+* `items` - List of item names (`cookies`, `headers`, or `queryStrings`).
+
+<!-- cache-key: cdktf-0.18.0 input-d2206ba916ee923999c55171522950c705c9bfd904c6382e709e850f3e24144f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/cloudfront_distribution.html.markdown b/website/docs/cdktf/typescript/d/cloudfront_distribution.html.markdown
new file mode 100644
index 00000000000..e794e072e9e
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/cloudfront_distribution.html.markdown
@@ -0,0 +1,71 @@
+---
+subcategory: "CloudFront"
+layout: "aws"
+page_title: "AWS: aws_cloudfront_distribution"
+description: |-
+  Provides a CloudFront web distribution data source.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_cloudfront_distribution
+
+Use this data source to retrieve information about a CloudFront distribution.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCloudfrontDistribution } from "./.gen/providers/aws/data-aws-cloudfront-distribution";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsCloudfrontDistribution(this, "test", {
+      id: "EDFDVBD632BHDS5",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `id` - Identifier for the distribution. For example: `edfdvbd632Bhds5`.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - Identifier for the distribution. For example: `edfdvbd632Bhds5`.
+
+* `aliases` - List that contains information about CNAMEs (alternate domain names), if any, for this distribution.
+
+* `arn` - ARN (Amazon Resource Name) for the distribution. For example: arn:aws:cloudfront::123456789012:distribution/EDFDVBD632BHDS5, where 123456789012 is your AWS account ID.
+
+* `status` - Current status of the distribution. `deployed` if the
+    distribution's information is fully propagated throughout the Amazon
+    CloudFront system.
+
+* `domainName` - Domain name corresponding to the distribution. For
+    example: `d604721Fxaaqy9CloudfrontNet`.
+
+* `lastModifiedTime` - Date and time the distribution was last modified.
+
+* `inProgressValidationBatches` - The number of invalidation batches
+    currently in progress.
+
+* `etag` - Current version of the distribution's information. For example:
+    `e2Qwruhapomqzl`.
+
+* `hostedZoneId` - CloudFront Route 53 zone ID that can be used to
+     route an [Alias Resource Record Set][7] to. This attribute is simply an
+     alias for the zone ID `z2Fdtndataqyw2`.
+* `webAclId` AWS WAF web ACL associated with this distribution.
+
+<!-- cache-key: cdktf-0.18.0 input-76fd4092d64caf3eb602d2f1b7554e0601ea2cb2c116df5092f91bc933e23c48 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/cloudfront_function.html.markdown b/website/docs/cdktf/typescript/d/cloudfront_function.html.markdown
new file mode 100644
index 00000000000..9b1b4cf0989
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/cloudfront_function.html.markdown
@@ -0,0 +1,65 @@
+---
+subcategory: "CloudFront"
+layout: "aws"
+page_title: "AWS: aws_cloudfront_function"
+description: |-
+  Provides a CloudFront Function data source.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# aws_cloudfront_function
+
+Provides information about a CloudFront Function.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { VariableType, TerraformVariable, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCloudfrontFunction } from "./.gen/providers/aws/data-aws-cloudfront-function";
+interface MyConfig {
+  stage: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    /*Terraform Variables are not always the best fit for getting inputs in the context of Terraform CDK.
+    You can read more about this at https://cdk.tf/variables*/
+    const functionName = new TerraformVariable(this, "function_name", {
+      type: VariableType.STRING,
+    });
+    new DataAwsCloudfrontFunction(this, "existing", {
+      name: functionName.stringValue,
+      stage: config.stage,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name of the CloudFront function.
+* `stage` - (Required) Function’s stage, either `development` or `live`.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN identifying your CloudFront Function.
+* `code` - Source code of the function
+* `comment` - Comment.
+* `etag` - ETag hash of the function
+* `lastModifiedTime` - When this resource was last modified.
+* `runtime` - Identifier of the function's runtime.
+* `status` - Status of the function. Can be `unpublished`, `unassociated` or `associated`.
+
+<!-- cache-key: cdktf-0.18.0 input-91b978e70ce3fa4778a1e7fadb7052748a3a704504ddaff849ccb10b0b522561 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/cloudfront_log_delivery_canonical_user_id.html.markdown b/website/docs/cdktf/typescript/d/cloudfront_log_delivery_canonical_user_id.html.markdown
new file mode 100644
index 00000000000..5040c5b2719
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/cloudfront_log_delivery_canonical_user_id.html.markdown
@@ -0,0 +1,80 @@
+---
+subcategory: "CloudFront"
+layout: "aws"
+page_title: "AWS: aws_cloudfront_log_delivery_canonical_user_id"
+description: |-
+  Provides the canonical user ID of the AWS `awslogsdelivery` account for CloudFront bucket logging.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_cloudfront_log_delivery_canonical_user_id
+
+The CloudFront Log Delivery Canonical User ID data source allows access to the [canonical user ID](http://docs.aws.amazon.com/general/latest/gr/acct-identifiers.html) of the AWS `awslogsdelivery` account for CloudFront bucket logging.
+See the [Amazon CloudFront Developer Guide](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/AccessLogs.html) for more information.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCloudfrontLogDeliveryCanonicalUserId } from "./.gen/providers/aws/data-aws-cloudfront-log-delivery-canonical-user-id";
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketAcl } from "./.gen/providers/aws/s3-bucket-acl";
+interface MyConfig {
+  owner: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    const example = new S3Bucket(this, "example", {
+      bucket: "example",
+    });
+    const dataAwsCloudfrontLogDeliveryCanonicalUserIdExample =
+      new DataAwsCloudfrontLogDeliveryCanonicalUserId(this, "example_1", {});
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsCloudfrontLogDeliveryCanonicalUserIdExample.overrideLogicalId(
+      "example"
+    );
+    const awsS3BucketAclExample = new S3BucketAcl(this, "example_2", {
+      accessControlPolicy: {
+        grant: [
+          {
+            grantee: {
+              id: Token.asString(
+                dataAwsCloudfrontLogDeliveryCanonicalUserIdExample.id
+              ),
+              type: "CanonicalUser",
+            },
+            permission: "FULL_CONTROL",
+          },
+        ],
+        owner: config.owner,
+      },
+      bucket: example.id,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketAclExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `region` - (Optional) Region you'd like the zone for. By default, fetches the current region.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - Canonical user ID for the AWS `awslogsdelivery` account in the region.
+
+<!-- cache-key: cdktf-0.18.0 input-2559298f99f82c97aa9ed9f52ecdd43d146cf2ecbc440cc80cecd164b8e630dc -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/cloudfront_origin_access_identities.html.markdown b/website/docs/cdktf/typescript/d/cloudfront_origin_access_identities.html.markdown
new file mode 100644
index 00000000000..76e334a40a5
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/cloudfront_origin_access_identities.html.markdown
@@ -0,0 +1,73 @@
+---
+subcategory: "CloudFront"
+layout: "aws"
+page_title: "AWS: aws_cloudfront_origin_access_identities"
+description: |-
+  Use this data source to retrieve information about a set of Amazon CloudFront origin access identities.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_cloudfront_origin_access_identities
+
+Use this data source to get ARNs, ids and S3 canonical user IDs of Amazon CloudFront origin access identities.
+
+## Example Usage
+
+### All origin access identities in the account
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCloudfrontOriginAccessIdentities } from "./.gen/providers/aws/data-aws-cloudfront-origin-access-identities";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsCloudfrontOriginAccessIdentities(this, "example", {});
+  }
+}
+
+```
+
+### Origin access identities filtered by comment/name
+
+Origin access identities whose comments are `exampleComment1`, `exampleComment2`
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCloudfrontOriginAccessIdentities } from "./.gen/providers/aws/data-aws-cloudfront-origin-access-identities";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsCloudfrontOriginAccessIdentities(this, "example", {
+      comments: ["example-comment1", "example-comment2"],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `comments` (Optional) - Filter origin access identities by comment.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `iamArns` - Set of ARNs of the matched origin access identities.
+* `ids` - Set of ids of the matched origin access identities.
+* `s3CanonicalUserIds` - Set of S3 canonical user IDs of the matched origin access identities.
+
+<!-- cache-key: cdktf-0.18.0 input-34f1ec8ef8003291bf6fbe0ad774299d58060f6ff187f903aecfd73ee7ad4efc -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/cloudfront_origin_access_identity.html.markdown b/website/docs/cdktf/typescript/d/cloudfront_origin_access_identity.html.markdown
new file mode 100644
index 00000000000..de14ebcedce
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/cloudfront_origin_access_identity.html.markdown
@@ -0,0 +1,61 @@
+---
+subcategory: "CloudFront"
+layout: "aws"
+page_title: "AWS: aws_cloudfront_origin_access_identity"
+description: |-
+  Use this data source to retrieve information for an Amazon CloudFront origin access identity.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_cloudfront_origin_access_identity
+
+Use this data source to retrieve information for an Amazon CloudFront origin access identity.
+
+## Example Usage
+
+The following example below creates a CloudFront origin access identity.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCloudfrontOriginAccessIdentity } from "./.gen/providers/aws/data-aws-cloudfront-origin-access-identity";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsCloudfrontOriginAccessIdentity(this, "example", {
+      id: "EDFDVBD632BHDS5",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `id` (Required) -  The identifier for the distribution. For example: `edfdvbd632Bhds5`.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `callerReference` - Internal value used by CloudFront to allow future
+   updates to the origin access identity.
+* `cloudfrontAccessIdentityPath` - A shortcut to the full path for the
+   origin access identity to use in CloudFront, see below.
+* `comment` - An optional comment for the origin access identity.
+* `etag` - Current version of the origin access identity's information.
+   For example: `e2Qwruhapomqzl`.
+* `iamArn` - Pre-generated ARN for use in S3 bucket policies (see below).
+   Example: `arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity
+ E2QWRUHAPOMQZL`.
+* `s3CanonicalUserId` - The Amazon S3 canonical user ID for the origin
+   access identity, which you use when giving the origin access identity read
+   permission to an object in Amazon S3.
+
+<!-- cache-key: cdktf-0.18.0 input-6ee07d67e88c83135a682bc01ecae9a6413d07992377fed93295e34cd1b0ceec -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/cloudfront_origin_request_policy.html.markdown b/website/docs/cdktf/typescript/d/cloudfront_origin_request_policy.html.markdown
new file mode 100644
index 00000000000..b8e11c708d9
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/cloudfront_origin_request_policy.html.markdown
@@ -0,0 +1,97 @@
+---
+subcategory: "CloudFront"
+layout: "aws"
+page_title: "AWS: aws_cloudfront_origin_request_policy"
+description: |-
+  Determines the values that CloudFront includes in requests that it sends to the origin.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_cloudfront_origin_request_policy
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCloudfrontOriginRequestPolicy } from "./.gen/providers/aws/data-aws-cloudfront-origin-request-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsCloudfrontOriginRequestPolicy(this, "example", {
+      name: "example-policy",
+    });
+  }
+}
+
+```
+
+### AWS-Managed Policies
+
+AWS managed origin request policy names are prefixed with `managed`:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCloudfrontOriginRequestPolicy } from "./.gen/providers/aws/data-aws-cloudfront-origin-request-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsCloudfrontOriginRequestPolicy(this, "ua_referer", {
+      name: "Managed-UserAgentRefererHeaders",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - Unique name to identify the origin request policy.
+* `id` - Identifier for the origin request policy.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `comment` - Comment to describe the origin request policy.
+* `cookiesConfig` - Object that determines whether any cookies in viewer requests (and if so, which cookies) are included in the origin request key and automatically included in requests that CloudFront sends to the origin. See [Cookies Config](#cookies-config) for more information.
+* `etag` - Current version of the origin request policy.
+* `headersConfig` - Object that determines whether any HTTP headers (and if so, which headers) are included in the origin request key and automatically included in requests that CloudFront sends to the origin. See [Headers Config](#headers-config) for more information.
+* `queryStringsConfig` - Object that determines whether any URL query strings in viewer requests (and if so, which query strings) are included in the origin request key and automatically included in requests that CloudFront sends to the origin. See [Query String Config](#query-string-config) for more information.
+
+### Cookies Config
+
+`cookieBehavior` - Determines whether any cookies in viewer requests are included in the origin request key and automatically included in requests that CloudFront sends to the origin. Valid values are `none`, `whitelist` `all`.
+`cookies` - Object that contains a list of cookie names. See [Items](#items) for more information.
+
+### Headers Config
+
+`headerBehavior` - Determines whether any HTTP headers are included in the origin request key and automatically included in requests that CloudFront sends to the origin. Valid values are `none`, `whitelist`, `allViewer`, `allViewerAndWhitelistCloudFront`.
+`headers` - Object that contains a list of header names. See [Items](#items) for more information.
+
+### Query String Config
+
+`queryStringBehavior` - Determines whether any URL query strings in viewer requests are included in the origin request key and automatically included in requests that CloudFront sends to the origin. Valid values are `none`, `whitelist`, `all`.
+`queryStrings` - Object that contains a list of query string names. See [Items](#items) for more information.
+
+### Items
+
+`items` - List of item names (cookies, headers, or query strings).
+
+<!-- cache-key: cdktf-0.18.0 input-302109f4c0fde1e60aeb00b2aa87f0426e0944c3dc7969f58b1b182e3ccb56a1 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/cloudfront_realtime_log_config.html.markdown b/website/docs/cdktf/typescript/d/cloudfront_realtime_log_config.html.markdown
new file mode 100644
index 00000000000..77f9cd94b53
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/cloudfront_realtime_log_config.html.markdown
@@ -0,0 +1,63 @@
+---
+subcategory: "CloudFront"
+layout: "aws"
+page_title: "AWS: aws_cloudfront_realtime_log_config"
+description: |-
+  Provides a CloudFront real-time log configuration resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_cloudfront_realtime_log_config
+
+Provides a CloudFront real-time log configuration resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCloudfrontRealtimeLogConfig } from "./.gen/providers/aws/data-aws-cloudfront-realtime-log-config";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsCloudfrontRealtimeLogConfig(this, "example", {
+      name: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Unique name to identify this real-time log configuration.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN (Amazon Resource Name) of the CloudFront real-time log configuration.
+* `endpoint` - (Required) Amazon Kinesis data streams where real-time log data is sent.
+* `fields` - (Required) Fields that are included in each real-time log record. See the [AWS documentation](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/real-time-logs.html#understand-real-time-log-config-fields) for supported values.
+* `samplingRate` - (Required) Sampling rate for this real-time log configuration. The sampling rate determines the percentage of viewer requests that are represented in the real-time log data. An integer between `1` and `100`, inclusive.
+
+The `endpoint` object supports the following:
+
+* `kinesisStreamConfig` - (Required) Amazon Kinesis data stream configuration.
+* `streamType` - (Required) Type of data stream where real-time log data is sent. The only valid value is `kinesis`.
+
+The `kinesisStreamConfig` object supports the following:
+
+* `roleArn` - (Required) ARN of an [IAM role](iam_role.html) that CloudFront can use to send real-time log data to the Kinesis data stream.
+See the [AWS documentation](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/real-time-logs.html#understand-real-time-log-config-iam-role) for more information.
+* `streamArn` - (Required) ARN of the [Kinesis data stream](kinesis_stream.html).
+
+<!-- cache-key: cdktf-0.18.0 input-6e46dcbfc5e16d8ff6f2789ee3bd99879502463156b4531588dacfee314c12ca -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/cloudfront_response_headers_policy.html.markdown b/website/docs/cdktf/typescript/d/cloudfront_response_headers_policy.html.markdown
new file mode 100644
index 00000000000..5f33fa1b72e
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/cloudfront_response_headers_policy.html.markdown
@@ -0,0 +1,148 @@
+---
+subcategory: "CloudFront"
+layout: "aws"
+page_title: "AWS: aws_cloudfront_response_headers_policy"
+description: |-
+  Use this data source to retrieve information about a CloudFront response headers policy.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_cloudfront_response_headers_policy
+
+Use this data source to retrieve information about a CloudFront cache policy.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCloudfrontResponseHeadersPolicy } from "./.gen/providers/aws/data-aws-cloudfront-response-headers-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsCloudfrontResponseHeadersPolicy(this, "example", {
+      name: "example-policy",
+    });
+  }
+}
+
+```
+
+### AWS-Managed Policies
+
+AWS managed response header policy names are prefixed with `managed`:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCloudfrontResponseHeadersPolicy } from "./.gen/providers/aws/data-aws-cloudfront-response-headers-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsCloudfrontResponseHeadersPolicy(this, "example", {
+      name: "Managed-SimpleCORS",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Optional) Unique name to identify the response headers policy.
+* `id` - (Optional) Identifier for the response headers policy.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `comment` - Comment to describe the response headers policy. The comment cannot be longer than 128 characters.
+* `etag` - Current version of the response headers policy.
+* `corsConfig` - Configuration for a set of HTTP response headers that are used for Cross-Origin Resource Sharing (CORS). See [Cors Config](#cors-config) for more information.
+* `customHeadersConfig` - Object that contains an attribute `items` that contains a list of Custom Headers. See [Custom Header](#custom-header) for more information.
+* `removeHeadersConfig` - Object that contains an attribute `items` that contains a list of Remove Headers. See [Remove Header](#remove-header) for more information.
+* `securityHeadersConfig` - A configuration for a set of security-related HTTP response headers. See [Security Headers Config](#security-headers-config) for more information.
+* `serverTimingHeadersConfig` - (Optional) Configuration for enabling the Server-Timing header in HTTP responses sent from CloudFront. See [Server Timing Headers Config](#server-timing-headers-config) for more information.
+
+### Cors Config
+
+* `accessControlAllowCredentials` - A Boolean value that CloudFront uses as the value for the Access-Control-Allow-Credentials HTTP response header.
+* `accessControlAllowHeaders` - Object that contains an attribute `items` that contains a list of HTTP header names that CloudFront includes as values for the Access-Control-Allow-Headers HTTP response header.
+* `accessControlAllowMethods` - Object that contains an attribute `items` that contains a list of HTTP methods that CloudFront includes as values for the Access-Control-Allow-Methods HTTP response header. Valid values: `get` | `post` | `options` | `put` | `delete` | `head` | `all`
+* `accessControlAllowOrigins` - Object that contains an attribute `items` that contains a list of origins that CloudFront can use as the value for the Access-Control-Allow-Origin HTTP response header.
+* `accessControlExposeHeaders` - Object that contains an attribute `items` that contains a list of HTTP headers that CloudFront includes as values for the Access-Control-Expose-Headers HTTP response header.
+* `accessControlMaxAgeSec` - A number that CloudFront uses as the value for the Access-Control-Max-Age HTTP response header.
+
+### Custom Header
+
+* `header` - HTTP response header name.
+* `override` - Whether CloudFront overrides a response header with the same name received from the origin with the header specifies here.
+* `value` - Value for the HTTP response header.
+
+### Remove Header
+
+* `header` - The HTTP header name.
+
+### Security Headers Config
+
+* `contentSecurityPolicy` - The policy directives and their values that CloudFront includes as values for the Content-Security-Policy HTTP response header. See [Content Security Policy](#content-security-policy) for more information.
+* `contentTypeOptions` - A setting that determines whether CloudFront includes the X-Content-Type-Options HTTP response header with its value set to nosniff. See [Content Type Options](#content-type-options) for more information.
+* `frameOptions` - Setting that determines whether CloudFront includes the X-Frame-Options HTTP response header and the header’s value. See [Frame Options](#frame-options) for more information.
+* `referrerPolicy` - Setting that determines whether CloudFront includes the Referrer-Policy HTTP response header and the header’s value. See [Referrer Policy](#referrer-policy) for more information.
+* `strictTransportSecurity` - Settings that determine whether CloudFront includes the Strict-Transport-Security HTTP response header and the header’s value. See [Strict Transport Security](#strict-transport-security) for more information.
+* `xssProtection` - Settings that determine whether CloudFront includes the X-XSS-Protection HTTP response header and the header’s value. See [XSS Protection](#xss-protection) for more information.
+
+### Content Security Policy
+
+* `contentSecurityPolicy` - The policy directives and their values that CloudFront includes as values for the Content-Security-Policy HTTP response header.
+* `override` - Whether CloudFront overrides the Content-Security-Policy HTTP response header received from the origin with the one specified in this response headers policy.
+
+### Content Type Options
+
+* `override` - Whether CloudFront overrides the X-Content-Type-Options HTTP response header received from the origin with the one specified in this response headers policy.
+
+### Frame Options
+
+* `frameOption` - Value of the X-Frame-Options HTTP response header. Valid values: `deny` | `sameorigin`
+* `override` - Whether CloudFront overrides the X-Frame-Options HTTP response header received from the origin with the one specified in this response headers policy.
+
+### Referrer Policy
+
+* `referrerPolicy` - Value of the Referrer-Policy HTTP response header. Valid Values: `noReferrer` | `noReferrerWhenDowngrade` | `origin` | `originWhenCrossOrigin` | `sameOrigin` | `strictOrigin` | `strictOriginWhenCrossOrigin` | `unsafeUrl`
+* `override` - Whether CloudFront overrides the Referrer-Policy HTTP response header received from the origin with the one specified in this response headers policy.
+
+### Strict Transport Security
+
+* `accessControlMaxAgeSec` - A number that CloudFront uses as the value for the max-age directive in the Strict-Transport-Security HTTP response header.
+* `includeSubdomains` - Whether CloudFront includes the includeSubDomains directive in the Strict-Transport-Security HTTP response header.
+* `override` - Whether CloudFront overrides the Strict-Transport-Security HTTP response header received from the origin with the one specified in this response headers policy.
+* `preload` - Whether CloudFront includes the preload directive in the Strict-Transport-Security HTTP response header.
+
+### XSS Protection
+
+* `modeBlock` - Whether CloudFront includes the mode=block directive in the X-XSS-Protection header.
+* `override` - Whether CloudFront overrides the X-XSS-Protection HTTP response header received from the origin with the one specified in this response headers policy.
+* `protection` - Boolean value that determines the value of the X-XSS-Protection HTTP response header. When this setting is true, the value of the X-XSS-Protection header is 1. When this setting is false, the value of the X-XSS-Protection header is 0.
+* `reportUri` - Whether CloudFront sets a reporting URI in the X-XSS-Protection header.
+
+### Server Timing Headers Config
+
+* `enabled` - Whether CloudFront adds the `serverTiming` header to HTTP responses that it sends in response to requests that match a cache behavior that's associated with this response headers policy.
+* `samplingRate` - Number 0–100 (inclusive) that specifies the percentage of responses that you want CloudFront to add the Server-Timing header to.
+
+<!-- cache-key: cdktf-0.18.0 input-72a56289982ff99c5a8915f5f70bc400c310b4c8325a6846d6c8b892d3eab9cb -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/cloudhsm_v2_cluster.html.markdown b/website/docs/cdktf/typescript/d/cloudhsm_v2_cluster.html.markdown
new file mode 100644
index 00000000000..3b7bcc79628
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/cloudhsm_v2_cluster.html.markdown
@@ -0,0 +1,59 @@
+---
+subcategory: "CloudHSM"
+layout: "aws"
+page_title: "AWS: aws_cloudhsm_v2_cluster"
+description: |-
+  Get information on a CloudHSM v2 cluster.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_cloudhsm_v2_cluster
+
+Use this data source to get information about a CloudHSM v2 cluster
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCloudhsmV2Cluster } from "./.gen/providers/aws/data-aws-cloudhsm-v2-cluster";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsCloudhsmV2Cluster(this, "cluster", {
+      clusterId: "cluster-testclusterid",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `clusterId` - (Required) ID of Cloud HSM v2 cluster.
+* `clusterState` - (Optional) State of the cluster to be found.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `vpcId` - ID of the VPC that the CloudHSM cluster resides in.
+* `securityGroupId` - ID of the security group associated with the CloudHSM cluster.
+* `subnetIds` - IDs of subnets in which cluster operates.
+* `clusterCertificates` - The list of cluster certificates.
+    * `clusterCertificates0ClusterCertificate` - The cluster certificate issued (signed) by the issuing certificate authority (CA) of the cluster's owner.
+    * `clusterCertificates0ClusterCsr` - The certificate signing request (CSR). Available only in UNINITIALIZED state.
+    * `clusterCertificates0AwsHardwareCertificate` - The HSM hardware certificate issued (signed) by AWS CloudHSM.
+    * `clusterCertificates0HsmCertificate` - The HSM certificate issued (signed) by the HSM hardware.
+    * `clusterCertificates0ManufacturerHardwareCertificate` - The HSM hardware certificate issued (signed) by the hardware manufacturer.
+The number of available cluster certificates may vary depending on state of the cluster.
+
+<!-- cache-key: cdktf-0.18.0 input-cafc753026d5e76ff2fae8fcd6781f60ca5e79de76e720cef8a6975659131495 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/cloudtrail_service_account.html.markdown b/website/docs/cdktf/typescript/d/cloudtrail_service_account.html.markdown
new file mode 100644
index 00000000000..e8491b2aacb
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/cloudtrail_service_account.html.markdown
@@ -0,0 +1,99 @@
+---
+subcategory: "CloudTrail"
+layout: "aws"
+page_title: "AWS: aws_cloudtrail_service_account"
+description: |-
+  Get AWS CloudTrail Service Account ID for storing trail data in S3.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_cloudtrail_service_account
+
+Use this data source to get the Account ID of the [AWS CloudTrail Service Account](http://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-supported-regions.html)
+in a given region for the purpose of allowing CloudTrail to store trail data in S3.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCloudtrailServiceAccount } from "./.gen/providers/aws/data-aws-cloudtrail-service-account";
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketPolicy } from "./.gen/providers/aws/s3-bucket-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const bucket = new S3Bucket(this, "bucket", {
+      bucket: "tf-cloudtrail-logging-test-bucket",
+      forceDestroy: true,
+    });
+    const main = new DataAwsCloudtrailServiceAccount(this, "main", {});
+    const allowCloudtrailLogging = new DataAwsIamPolicyDocument(
+      this,
+      "allow_cloudtrail_logging",
+      {
+        statement: [
+          {
+            actions: ["s3:PutObject"],
+            effect: "Allow",
+            principals: [
+              {
+                identifiers: [Token.asString(main.arn)],
+                type: "AWS",
+              },
+            ],
+            resources: ["${" + bucket.arn + "}/*"],
+            sid: "Put bucket policy needed for trails",
+          },
+          {
+            actions: ["s3:GetBucketAcl"],
+            effect: "Allow",
+            principals: [
+              {
+                identifiers: [Token.asString(main.arn)],
+                type: "AWS",
+              },
+            ],
+            resources: [bucket.arn],
+            sid: "Get bucket policy needed for trails",
+          },
+        ],
+      }
+    );
+    const awsS3BucketPolicyAllowCloudtrailLogging = new S3BucketPolicy(
+      this,
+      "allow_cloudtrail_logging_3",
+      {
+        bucket: bucket.id,
+        policy: Token.asString(allowCloudtrailLogging.json),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketPolicyAllowCloudtrailLogging.overrideLogicalId(
+      "allow_cloudtrail_logging"
+    );
+  }
+}
+
+```
+
+## Argument Reference
+
+* `region` - (Optional) Name of the region whose AWS CloudTrail account ID is desired.
+Defaults to the region from the AWS provider configuration.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the AWS CloudTrail service account in the selected region.
+* `arn` - ARN of the AWS CloudTrail service account in the selected region.
+
+<!-- cache-key: cdktf-0.18.0 input-c5f519c52875128e9a18f748579bb40b5819ba4da9ebe83e2a9cb71b3becf3ad -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/cloudwatch_event_bus.html.markdown b/website/docs/cdktf/typescript/d/cloudwatch_event_bus.html.markdown
new file mode 100644
index 00000000000..26a84883923
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/cloudwatch_event_bus.html.markdown
@@ -0,0 +1,49 @@
+---
+subcategory: "EventBridge"
+layout: "aws"
+page_title: "AWS: aws_cloudwatch_event_bus"
+description: |-
+  Get information on an EventBridge (Cloudwatch) Event Bus.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_cloudwatch_event_bus
+
+This data source can be used to fetch information about a specific
+EventBridge event bus. Use this data source to compute the ARN of
+an event bus, given the name of the bus.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCloudwatchEventBus } from "./.gen/providers/aws/data-aws-cloudwatch-event-bus";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsCloudwatchEventBus(this, "example", {
+      name: "example-bus-name",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `name` - (Required) Friendly EventBridge event bus name.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN.
+
+<!-- cache-key: cdktf-0.18.0 input-6d48ebb9d36b6f8a656ed8f66550b6d3efee3a308c32d635751c6d385e62d112 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/cloudwatch_event_connection.html.markdown b/website/docs/cdktf/typescript/d/cloudwatch_event_connection.html.markdown
new file mode 100644
index 00000000000..c48e70a6a59
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/cloudwatch_event_connection.html.markdown
@@ -0,0 +1,55 @@
+---
+subcategory: "EventBridge"
+layout: "aws"
+page_title: "AWS: aws_cloudwatch_event_connection"
+description: |-
+  Provides an EventBridge connection data source.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_cloudwatch_event_connection
+
+Use this data source to retrieve information about an EventBridge connection.
+
+~> **Note:** EventBridge was formerly known as CloudWatch Events. The functionality is identical.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCloudwatchEventConnection } from "./.gen/providers/aws/data-aws-cloudwatch-event-connection";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsCloudwatchEventConnection(this, "test", {
+      name: "test",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `name` - Name of the connection.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `name` - Name of the connection.
+
+* `arn` - ARN (Amazon Resource Name) for the connection.
+
+* `secretArn` - ARN (Amazon Resource Name) for the secret created from the authorization parameters specified for the connection.
+
+* `authorizationType` - Type of authorization to use to connect. One of `apiKey`,`basic`,`oauthClientCredentials`.
+
+<!-- cache-key: cdktf-0.18.0 input-c28a6e87c62c9016e5553ac80ba81f240b8c76ab8a07aa2ea802508e58427f58 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/cloudwatch_event_source.html.markdown b/website/docs/cdktf/typescript/d/cloudwatch_event_source.html.markdown
new file mode 100644
index 00000000000..ea2fb8ee025
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/cloudwatch_event_source.html.markdown
@@ -0,0 +1,54 @@
+---
+subcategory: "EventBridge"
+layout: "aws"
+page_title: "AWS: aws_cloudwatch_event_source"
+description: |-
+  Get information on an EventBridge (Cloudwatch) Event Source.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_cloudwatch_event_source
+
+Use this data source to get information about an EventBridge Partner Event Source. This data source will only return one partner event source. An error will be returned if multiple sources match the same name prefix.
+
+~> **Note:** EventBridge was formerly known as CloudWatch Events. The functionality is identical.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCloudwatchEventSource } from "./.gen/providers/aws/data-aws-cloudwatch-event-source";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsCloudwatchEventSource(this, "examplepartner", {
+      namePrefix: "aws.partner/examplepartner.com",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `namePrefix` - (Optional) Specifying this limits the results to only those partner event sources with names that start with the specified prefix
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the partner event source
+* `createdBy` - Name of the SaaS partner that created the event source
+* `name` - Name of the event source
+* `state` - State of the event source (`active` or `pending`)
+
+<!-- cache-key: cdktf-0.18.0 input-7fea3094a9236a42f149275c2bbaa33e18c22a2111ac12ba23865c087753c6e6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/cloudwatch_log_data_protection_policy_document.html.markdown b/website/docs/cdktf/typescript/d/cloudwatch_log_data_protection_policy_document.html.markdown
new file mode 100644
index 00000000000..d361accc214
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/cloudwatch_log_data_protection_policy_document.html.markdown
@@ -0,0 +1,148 @@
+---
+subcategory: "CloudWatch Logs"
+layout: "aws"
+page_title: "AWS: aws_cloudwatch_log_data_protection_policy_document"
+description: |-
+  Generates a CloudWatch Log Group Data Protection Policy document in JSON format
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_cloudwatch_log_data_protection_policy_document
+
+Generates a CloudWatch Log Group Data Protection Policy document in JSON format for use with the `awsCloudwatchLogDataProtectionPolicy` resource.
+
+-> For more information about data protection policies, see the [Help protect sensitive log data with masking](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/mask-sensitive-log-data.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudwatchLogDataProtectionPolicy } from "./.gen/providers/aws/cloudwatch-log-data-protection-policy";
+import { DataAwsCloudwatchLogDataProtectionPolicyDocument } from "./.gen/providers/aws/data-aws-cloudwatch-log-data-protection-policy-document";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new DataAwsCloudwatchLogDataProtectionPolicyDocument(
+      this,
+      "example",
+      {
+        name: "Example",
+        statement: [
+          {
+            dataIdentifiers: [
+              "arn:aws:dataprotection::aws:data-identifier/EmailAddress",
+              "arn:aws:dataprotection::aws:data-identifier/DriversLicense-US",
+            ],
+            operation: {
+              audit: {
+                findingsDestination: {
+                  cloudwatchLogs: {
+                    logGroup: audit.name,
+                  },
+                  firehose: {
+                    deliveryStream: Token.asString(
+                      awsKinesisFirehoseDeliveryStreamAudit.name
+                    ),
+                  },
+                  s3: {
+                    bucket: Token.asString(awsS3BucketAudit.bucket),
+                  },
+                },
+              },
+            },
+            sid: "Audit",
+          },
+          {
+            dataIdentifiers: [
+              "arn:aws:dataprotection::aws:data-identifier/EmailAddress",
+              "arn:aws:dataprotection::aws:data-identifier/DriversLicense-US",
+            ],
+            operation: {
+              deidentify: {
+                maskConfig: {},
+              },
+            },
+            sid: "Deidentify",
+          },
+        ],
+      }
+    );
+    const awsCloudwatchLogDataProtectionPolicyExample =
+      new CloudwatchLogDataProtectionPolicy(this, "example_1", {
+        logGroupName: Token.asString(awsCloudwatchLogGroupExample.name),
+        policyDocument: Token.asString(example.json),
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsCloudwatchLogDataProtectionPolicyExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) The name of the data protection policy document.
+* `statement` - (Required) Configures the data protection policy.
+
+-> There must be exactly two statements: the first with an `audit` operation, and the second with a `deidentify` operation.
+
+The following arguments are optional:
+
+* `description` - (Optional)
+* `version` - (Optional)
+
+### statement Configuration Block
+
+* `dataIdentifiers` - (Required) Set of at least 1 sensitive data identifiers that you want to mask. Read more in [Types of data that you can protect](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/protect-sensitive-log-data-types.html).
+* `operation` - (Required) Configures the data protection operation applied by this statement.
+* `sid` - (Optional) Name of this statement.
+
+#### operation Configuration Block
+
+* `audit` - (Optional) Configures the detection of sensitive data.
+* `deidentify` - (Optional) Configures the masking of sensitive data.
+
+-> Every policy statement must specify exactly one operation.
+
+##### audit Configuration Block
+
+* `findingsDestination` - (Required) Configures destinations to send audit findings to.
+
+##### findings_destination Configuration Block
+
+* `cloudwatchLogs` - (Optional) Configures CloudWatch Logs as a findings destination.
+* `firehose` - (Optional) Configures Kinesis Firehose as a findings destination.
+* `s3` - (Optional) Configures S3 as a findings destination.
+
+###### cloudwatch_logs Configuration Block
+
+* `logGroup` - (Required) Name of the CloudWatch Log Group to send findings to.
+
+###### firehose Configuration Block
+
+* `deliveryStream` - (Required) Name of the Kinesis Firehose Delivery Stream to send findings to.
+
+###### s3 Configuration Block
+
+* `bucket` - (Required) Name of the S3 Bucket to send findings to.
+
+##### deidentify Configuration Block
+
+* `maskConfig` - (Required) An empty object that configures masking.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `json` - Standard JSON policy document rendered based on the arguments above.
+
+<!-- cache-key: cdktf-0.18.0 input-f0c94e0aa8a0da473585431ea622f8f0cfd32bb09136ae337369c54288ff6f27 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/cloudwatch_log_group.html.markdown b/website/docs/cdktf/typescript/d/cloudwatch_log_group.html.markdown
new file mode 100644
index 00000000000..eea8639d451
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/cloudwatch_log_group.html.markdown
@@ -0,0 +1,53 @@
+---
+subcategory: "CloudWatch Logs"
+layout: "aws"
+page_title: "AWS: aws_cloudwatch_log_group"
+description: |-
+  Get information on a Cloudwatch Log Group.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_cloudwatch_log_group
+
+Use this data source to get information about an AWS Cloudwatch Log Group
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCloudwatchLogGroup } from "./.gen/providers/aws/data-aws-cloudwatch-log-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsCloudwatchLogGroup(this, "example", {
+      name: "MyImportantLogs",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name of the Cloudwatch log group
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Cloudwatch log group. Any `:*` suffix added by the API, denoting all CloudWatch Log Streams under the CloudWatch Log Group, is removed for greater compatibility with other AWS services that do not accept the suffix.
+* `creationTime` - Creation time of the log group, expressed as the number of milliseconds after Jan 1, 1970 00:00:00 UTC.
+* `retentionInDays` - Number of days log events retained in the specified log group.
+* `kmsKeyId` - ARN of the KMS Key to use when encrypting log data.
+* `tags` - Map of tags to assign to the resource.
+
+<!-- cache-key: cdktf-0.18.0 input-98c67f629213b5447fa03395fb5fb657973411cf76bb2bdbeae232bee8c64098 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/cloudwatch_log_groups.html.markdown b/website/docs/cdktf/typescript/d/cloudwatch_log_groups.html.markdown
new file mode 100644
index 00000000000..1c0cd776115
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/cloudwatch_log_groups.html.markdown
@@ -0,0 +1,50 @@
+---
+subcategory: "CloudWatch Logs"
+layout: "aws"
+page_title: "AWS: aws_cloudwatch_log_groups"
+description: |-
+  Get list of Cloudwatch Log Groups.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_cloudwatch_log_groups
+
+Use this data source to get a list of AWS Cloudwatch Log Groups
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCloudwatchLogGroups } from "./.gen/providers/aws/data-aws-cloudwatch-log-groups";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsCloudwatchLogGroups(this, "example", {
+      logGroupNamePrefix: "/MyImportantLogs",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `logGroupNamePrefix` - (Optional) Group prefix of the Cloudwatch log groups to list
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arns` - Set of ARNs of the Cloudwatch log groups
+* `logGroupNames` - Set of names of the Cloudwatch log groups
+
+<!-- cache-key: cdktf-0.18.0 input-de8e9f02351b1211d18fc68d49088b86a691dbdbd63e91089bb0ce365508019e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/codeartifact_authorization_token.html.markdown b/website/docs/cdktf/typescript/d/codeartifact_authorization_token.html.markdown
new file mode 100644
index 00000000000..744633146d2
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/codeartifact_authorization_token.html.markdown
@@ -0,0 +1,52 @@
+---
+subcategory: "CodeArtifact"
+layout: "aws"
+page_title: "AWS: aws_codeartifact_authorization_token"
+description: |-
+    Provides details about a CodeArtifact Authorization Token
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_codeartifact_authorization_token
+
+The CodeArtifact Authorization Token data source generates a temporary authentication token for accessing repositories in a CodeArtifact domain.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCodeartifactAuthorizationToken } from "./.gen/providers/aws/data-aws-codeartifact-authorization-token";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsCodeartifactAuthorizationToken(this, "test", {
+      domain: Token.asString(awsCodeartifactDomainTest.domain),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `domain` - (Required) Name of the domain that is in scope for the generated authorization token.
+* `domainOwner` - (Optional) Account number of the AWS account that owns the domain.
+* `durationSeconds` - (Optional) Time, in seconds, that the generated authorization token is valid. Valid values are `0` and between `900` and `43200`.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `authorizationToken` - Temporary authorization token.
+* `expiration` - Time in UTC RFC3339 format when the authorization token expires.
+
+<!-- cache-key: cdktf-0.18.0 input-35ae5dc1307055f4be42f0268b760c21da97017124c46086e4dc01079119728a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/codeartifact_repository_endpoint.html.markdown b/website/docs/cdktf/typescript/d/codeartifact_repository_endpoint.html.markdown
new file mode 100644
index 00000000000..55f37d88d02
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/codeartifact_repository_endpoint.html.markdown
@@ -0,0 +1,54 @@
+---
+subcategory: "CodeArtifact"
+layout: "aws"
+page_title: "AWS: aws_codeartifact_repository_endpoint"
+description: |-
+    Provides details about a CodeArtifact Repository Endpoint
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_codeartifact_repository_endpoint
+
+The CodeArtifact Repository Endpoint data source returns the endpoint of a repository for a specific package format.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCodeartifactRepositoryEndpoint } from "./.gen/providers/aws/data-aws-codeartifact-repository-endpoint";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsCodeartifactRepositoryEndpoint(this, "test", {
+      domain: Token.asString(awsCodeartifactDomainTest.domain),
+      format: "npm",
+      repository: Token.asString(awsCodeartifactRepositoryTest.repository),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `domain` - (Required) Name of the domain that contains the repository.
+* `repository` - (Required) Name of the repository.
+* `format` - (Required) Which endpoint of a repository to return. A repository has one endpoint for each package format: `npm`, `pypi`, `maven`, and `nuget`.
+* `domainOwner` - (Optional) Account number of the AWS account that owns the domain.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `repositoryEndpoint` - URL of the returned endpoint.
+
+<!-- cache-key: cdktf-0.18.0 input-845ec7d27ada856d0ad7aca19277d5091cd5696d048ed754b76ab9909399306c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/codecatalyst_dev_environment.html.markdown b/website/docs/cdktf/typescript/d/codecatalyst_dev_environment.html.markdown
new file mode 100644
index 00000000000..2da2a5bf79f
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/codecatalyst_dev_environment.html.markdown
@@ -0,0 +1,63 @@
+---
+subcategory: "CodeCatalyst"
+layout: "aws"
+page_title: "AWS: aws_codecatalyst_dev_environment"
+description: |-
+  Terraform data source for managing an AWS CodeCatalyst Dev Environment.
+---
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_codecatalyst_dev_environment
+
+Terraform data source for managing an AWS CodeCatalyst Dev Environment.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCodecatalystDevEnvironment } from "./.gen/providers/aws/data-aws-codecatalyst-dev-environment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsCodecatalystDevEnvironment(this, "example", {
+      envId: Token.asString(awsCodecatalystDevEnvironmentExample.id),
+      projectName: "myproject",
+      spaceName: "myspace",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `envId` - - (Required) The system-generated unique ID of the Dev Environment for which you want to view information. To retrieve a list of Dev Environment IDs, use [ListDevEnvironments](https://docs.aws.amazon.com/codecatalyst/latest/APIReference/API_ListDevEnvironments.html).
+* `projectName` - (Required) The name of the project in the space.
+* `spaceName` - (Required) The name of the space.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `alias` - The user-specified alias for the Dev Environment.
+* `creatorId` - The system-generated unique ID of the user who created the Dev Environment.
+* `ides` - Information about the integrated development environment (IDE) configured for a Dev Environment.
+* `inactivityTimeoutMinutes` - The amount of time the Dev Environment will run without any activity detected before stopping, in minutes. Only whole integers are allowed. Dev Environments consume compute minutes when running.
+* `instanceType` - The Amazon EC2 instace type to use for the Dev Environment.
+* `lastUpdatedTime` - The time when the Dev Environment was last updated, in coordinated universal time (UTC) timestamp format as specified in [RFC 3339](https://www.rfc-editor.org/rfc/rfc3339#section-5.6).
+* `persistentStorage` - Information about the amount of storage allocated to the Dev Environment.
+* `repositories` - The source repository that contains the branch to clone into the Dev Environment.
+* `status` - The current status of the Dev Environment. From: PENDING | RUNNING | STARTING | STOPPING | STOPPED | FAILED | DELETING | DELETED.
+* `statusReason` - The reason for the status.
+
+<!-- cache-key: cdktf-0.18.0 input-c61bba638996c2149ec91b8cd25afae8ff1fa5829987e15f55f2b47440b45e86 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/codecommit_approval_rule_template.html.markdown b/website/docs/cdktf/typescript/d/codecommit_approval_rule_template.html.markdown
new file mode 100644
index 00000000000..3055c7bae91
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/codecommit_approval_rule_template.html.markdown
@@ -0,0 +1,55 @@
+---
+subcategory: "CodeCommit"
+layout: "aws"
+page_title: "AWS: aws_codecommit_approval_rule_template"
+description: |-
+  Provides details about a specific CodeCommit Approval Rule Template.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_codecommit_approval_rule_template
+
+Provides details about a specific CodeCommit Approval Rule Template.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCodecommitApprovalRuleTemplate } from "./.gen/providers/aws/data-aws-codecommit-approval-rule-template";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsCodecommitApprovalRuleTemplate(this, "example", {
+      name: "MyExampleApprovalRuleTemplate",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name for the approval rule template. This needs to be less than 100 characters.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `approvalRuleTemplateId` - The ID of the approval rule template.
+* `content` - Content of the approval rule template.
+* `creationDate` - Date the approval rule template was created, in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8).
+* `description` - Description of the approval rule template.
+* `lastModifiedDate` - Date the approval rule template was most recently changed, in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8).
+* `lastModifiedUser` - ARN of the user who made the most recent changes to the approval rule template.
+* `ruleContentSha256` - SHA-256 hash signature for the content of the approval rule template.
+
+<!-- cache-key: cdktf-0.18.0 input-98231bebffea86eca15b51adc087fc2f29b27084e6d362ae00eb79cfb0b83130 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/codecommit_repository.html.markdown b/website/docs/cdktf/typescript/d/codecommit_repository.html.markdown
new file mode 100644
index 00000000000..5d5dc1925ca
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/codecommit_repository.html.markdown
@@ -0,0 +1,52 @@
+---
+subcategory: "CodeCommit"
+layout: "aws"
+page_title: "AWS: aws_codecommit_repository"
+description: |-
+  Provides details about CodeCommit Repository.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_codecommit_repository
+
+The CodeCommit Repository data source allows the ARN, Repository ID, Repository URL for HTTP and Repository URL for SSH to be retrieved for an CodeCommit repository.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCodecommitRepository } from "./.gen/providers/aws/data-aws-codecommit-repository";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsCodecommitRepository(this, "test", {
+      repositoryName: "MyTestRepository",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `repositoryName` - (Required) Name for the repository. This needs to be less than 100 characters.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `repositoryId` - ID of the repository
+* `arn` - ARN of the repository
+* `cloneUrlHttp` - URL to use for cloning the repository over HTTPS.
+* `cloneUrlSsh` - URL to use for cloning the repository over SSH.
+
+<!-- cache-key: cdktf-0.18.0 input-5f322aa9e58ade376d26a7bc7fcca823f5fc4c32d9a5916f862aea8c60b99b90 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/codestarconnections_connection.html.markdown b/website/docs/cdktf/typescript/d/codestarconnections_connection.html.markdown
new file mode 100644
index 00000000000..9c5e5b34b99
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/codestarconnections_connection.html.markdown
@@ -0,0 +1,81 @@
+---
+subcategory: "CodeStar Connections"
+layout: "aws"
+page_title: "AWS: aws_codestarconnections_connection"
+description: |-
+  Provides details about CodeStar Connection
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_codestarconnections_connection
+
+Provides details about CodeStar Connection.
+
+## Example Usage
+
+### By ARN
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCodestarconnectionsConnection } from "./.gen/providers/aws/data-aws-codestarconnections-connection";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsCodestarconnectionsConnection(this, "example", {
+      arn: Token.asString(awsCodestarconnectionsConnectionExample.arn),
+    });
+  }
+}
+
+```
+
+### By Name
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCodestarconnectionsConnection } from "./.gen/providers/aws/data-aws-codestarconnections-connection";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsCodestarconnectionsConnection(this, "example", {
+      name: Token.asString(awsCodestarconnectionsConnectionExample.name),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `arn` - (Optional) CodeStar Connection ARN.
+* `name` - (Optional) CodeStar Connection name.
+
+~> **NOTE:** When both `arn` and `name` are specified, `arn` takes precedence.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `connectionStatus` - CodeStar Connection status. Possible values are `pending`, `available` and `error`.
+* `id` - CodeStar Connection ARN.
+* `hostArn` - ARN of the host associated with the connection.
+* `name` - Name of the CodeStar Connection. The name is unique in the calling AWS account.
+* `providerType` - Name of the external provider where your third-party code repository is configured. Possible values are `bitbucket` and `gitHub`. For connections to a GitHub Enterprise Server instance, you must create an [aws_codestarconnections_host](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/codestarconnections_host) resource and use `hostArn` instead.
+* `tags` - Map of key-value resource tags to associate with the resource.
+
+<!-- cache-key: cdktf-0.18.0 input-ab1b1d204990cc42834998f3ea8aaf072f9c3accf6d33f73782ae59f7304b4b6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/cognito_identity_pool.html.markdown b/website/docs/cdktf/typescript/d/cognito_identity_pool.html.markdown
new file mode 100644
index 00000000000..4f5ad4c490a
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/cognito_identity_pool.html.markdown
@@ -0,0 +1,60 @@
+---
+subcategory: "Cognito Identity"
+layout: "aws"
+page_title: "AWS: aws_cognito_identity_pool"
+description: |-
+  Terraform data source for managing an AWS Cognito Identity Pool.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_cognito_identity_pool
+
+Terraform data source for managing an AWS Cognito Identity Pool.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCognitoIdentityPool } from "./.gen/providers/aws/data-aws-cognito-identity-pool";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsCognitoIdentityPool(this, "example", {
+      identityPoolName: "test pool",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `identityPoolName` - (Required)  The Cognito Identity Pool name.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - An identity pool ID, e.g. `usWest2:1A2345678901234B5CdeF6789G01H2I3`.
+* `arn` - ARN of the Pool.
+* `allowUnauthenticatedIdentities` - Whether the identity pool supports unauthenticated logins or not.
+* `allowClassicFlow` - Whether the classic / basic authentication flow is enabled.
+* `developerProviderName` - The "domain" by which Cognito will refer to your users.
+* `cognitoIdentityProviders` - An array of Amazon Cognito Identity user pools and their client IDs.
+* `openidConnectProviderArns` - Set of OpendID Connect provider ARNs.
+* `samlProviderArns` - An array of Amazon Resource Names (ARNs) of the SAML provider for your identity.
+* `supportedLoginProviders` - Key-Value pairs mapping provider names to provider app IDs.
+* `tags` - A map of tags to assigned to the Identity Pool.
+
+<!-- cache-key: cdktf-0.18.0 input-6bbe3d8309c3b6b61d82ed31432b903fb83ab96fbd1ea591aba2ca68e658f68f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/cognito_user_pool_client.html.markdown b/website/docs/cdktf/typescript/d/cognito_user_pool_client.html.markdown
new file mode 100644
index 00000000000..7e1e61b7047
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/cognito_user_pool_client.html.markdown
@@ -0,0 +1,87 @@
+---
+subcategory: "Cognito IDP (Identity Provider)"
+layout: "aws"
+page_title: "AWS: aws_cognito_user_pool_client"
+description: |-
+  Provides a Cognito User Pool Client
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_cognito_user_pool_client
+
+Provides a Cognito User Pool Client resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCognitoUserPoolClient } from "./.gen/providers/aws/data-aws-cognito-user-pool-client";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsCognitoUserPoolClient(this, "client", {
+      clientId: "38fjsnc484p94kpqsnet7mpld0",
+      userPoolId: "us-west-2_aaaaaaaaa",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `clientId` - (Required) Client Id of the user pool.
+* `userPoolId` - (Required) User pool the client belongs to.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `accessTokenValidity` - (Optional) Time limit, between 5 minutes and 1 day, after which the access token is no longer valid and cannot be used. This value will be overridden if you have entered a value in `tokenValidityUnits`.
+* `allowedOauthFlowsUserPoolClient` - (Optional) Whether the client is allowed to follow the OAuth protocol when interacting with Cognito user pools.
+* `allowedOauthFlows` - (Optional) List of allowed OAuth flows (code, implicit, client_credentials).
+* `allowedOauthScopes` - (Optional) List of allowed OAuth scopes (phone, email, openid, profile, and aws.cognito.signin.user.admin).
+* `analyticsConfiguration` - (Optional) Configuration block for Amazon Pinpoint analytics for collecting metrics for this user pool. [Detailed below](#analytics_configuration).
+* `callbackUrls` - (Optional) List of allowed callback URLs for the identity providers.
+* `clientSecret` - Client secret of the user pool client.
+* `defaultRedirectUri` - (Optional) Default redirect URI. Must be in the list of callback URLs.
+* `enableTokenRevocation` - (Optional) Enables or disables token revocation.
+* `explicitAuthFlows` - (Optional) List of authentication flows (ADMIN_NO_SRP_AUTH, CUSTOM_AUTH_FLOW_ONLY, USER_PASSWORD_AUTH, ALLOW_ADMIN_USER_PASSWORD_AUTH, ALLOW_CUSTOM_AUTH, ALLOW_USER_PASSWORD_AUTH, ALLOW_USER_SRP_AUTH, ALLOW_REFRESH_TOKEN_AUTH).
+* `generateSecret` - (Optional) Should an application secret be generated.
+* `idTokenValidity` - (Optional) Time limit, between 5 minutes and 1 day, after which the ID token is no longer valid and cannot be used. This value will be overridden if you have entered a value in `tokenValidityUnits`.
+* `logoutUrls` - (Optional) List of allowed logout URLs for the identity providers.
+* `preventUserExistenceErrors` - (Optional) Choose which errors and responses are returned by Cognito APIs during authentication, account confirmation, and password recovery when the user does not exist in the user pool. When set to `enabled` and the user does not exist, authentication returns an error indicating either the username or password was incorrect, and account confirmation and password recovery return a response indicating a code was sent to a simulated destination. When set to `legacy`, those APIs will return a `userNotFoundException` exception if the user does not exist in the user pool.
+* `readAttributes` - (Optional) List of user pool attributes the application client can read from.
+* `refreshTokenValidity` - (Optional) Time limit in days refresh tokens are valid for.
+* `supportedIdentityProviders` - (Optional) List of provider names for the identity providers that are supported on this client. Uses the `providerName` attribute of `awsCognitoIdentityProvider` resource(s), or the equivalent string(s).
+* `tokenValidityUnits` - (Optional) Configuration block for units in which the validity times are represented in. [Detailed below](#token_validity_units).
+* `writeAttributes` - (Optional) List of user pool attributes the application client can write to.
+
+### analytics_configuration
+
+Either `applicationArn` or `applicationId` is required.
+
+* `applicationArn` - (Optional) Application ARN for an Amazon Pinpoint application. Conflicts with `externalId` and `roleArn`.
+* `applicationId` - (Optional) Application ID for an Amazon Pinpoint application.
+* `externalId` - (Optional) ID for the Analytics Configuration. Conflicts with `applicationArn`.
+* `roleArn` - (Optional) ARN of an IAM role that authorizes Amazon Cognito to publish events to Amazon Pinpoint analytics. Conflicts with `applicationArn`.
+* `userDataShared` (Optional) If set to `true`, Amazon Cognito will include user data in the events it publishes to Amazon Pinpoint analytics.
+
+### token_validity_units
+
+Valid values for the following arguments are: `seconds`, `minutes`, `hours` or `days`.
+
+* `accessToken` - (Optional) Time unit in for the value in `accessTokenValidity`, defaults to `hours`.
+* `idToken` - (Optional) Time unit in for the value in `idTokenValidity`, defaults to `hours`.
+* `refreshToken` - (Optional) Time unit in for the value in `refreshTokenValidity`, defaults to `days`.
+
+<!-- cache-key: cdktf-0.18.0 input-804400abfbd53cd25621680ec5f1657976bea849d7c8272f9f3b774f5cc1e05b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/cognito_user_pool_client.markdown b/website/docs/cdktf/typescript/d/cognito_user_pool_client.markdown
new file mode 100644
index 00000000000..7e1e61b7047
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/cognito_user_pool_client.markdown
@@ -0,0 +1,87 @@
+---
+subcategory: "Cognito IDP (Identity Provider)"
+layout: "aws"
+page_title: "AWS: aws_cognito_user_pool_client"
+description: |-
+  Provides a Cognito User Pool Client
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_cognito_user_pool_client
+
+Provides a Cognito User Pool Client resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCognitoUserPoolClient } from "./.gen/providers/aws/data-aws-cognito-user-pool-client";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsCognitoUserPoolClient(this, "client", {
+      clientId: "38fjsnc484p94kpqsnet7mpld0",
+      userPoolId: "us-west-2_aaaaaaaaa",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `clientId` - (Required) Client Id of the user pool.
+* `userPoolId` - (Required) User pool the client belongs to.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `accessTokenValidity` - (Optional) Time limit, between 5 minutes and 1 day, after which the access token is no longer valid and cannot be used. This value will be overridden if you have entered a value in `tokenValidityUnits`.
+* `allowedOauthFlowsUserPoolClient` - (Optional) Whether the client is allowed to follow the OAuth protocol when interacting with Cognito user pools.
+* `allowedOauthFlows` - (Optional) List of allowed OAuth flows (code, implicit, client_credentials).
+* `allowedOauthScopes` - (Optional) List of allowed OAuth scopes (phone, email, openid, profile, and aws.cognito.signin.user.admin).
+* `analyticsConfiguration` - (Optional) Configuration block for Amazon Pinpoint analytics for collecting metrics for this user pool. [Detailed below](#analytics_configuration).
+* `callbackUrls` - (Optional) List of allowed callback URLs for the identity providers.
+* `clientSecret` - Client secret of the user pool client.
+* `defaultRedirectUri` - (Optional) Default redirect URI. Must be in the list of callback URLs.
+* `enableTokenRevocation` - (Optional) Enables or disables token revocation.
+* `explicitAuthFlows` - (Optional) List of authentication flows (ADMIN_NO_SRP_AUTH, CUSTOM_AUTH_FLOW_ONLY, USER_PASSWORD_AUTH, ALLOW_ADMIN_USER_PASSWORD_AUTH, ALLOW_CUSTOM_AUTH, ALLOW_USER_PASSWORD_AUTH, ALLOW_USER_SRP_AUTH, ALLOW_REFRESH_TOKEN_AUTH).
+* `generateSecret` - (Optional) Should an application secret be generated.
+* `idTokenValidity` - (Optional) Time limit, between 5 minutes and 1 day, after which the ID token is no longer valid and cannot be used. This value will be overridden if you have entered a value in `tokenValidityUnits`.
+* `logoutUrls` - (Optional) List of allowed logout URLs for the identity providers.
+* `preventUserExistenceErrors` - (Optional) Choose which errors and responses are returned by Cognito APIs during authentication, account confirmation, and password recovery when the user does not exist in the user pool. When set to `enabled` and the user does not exist, authentication returns an error indicating either the username or password was incorrect, and account confirmation and password recovery return a response indicating a code was sent to a simulated destination. When set to `legacy`, those APIs will return a `userNotFoundException` exception if the user does not exist in the user pool.
+* `readAttributes` - (Optional) List of user pool attributes the application client can read from.
+* `refreshTokenValidity` - (Optional) Time limit in days refresh tokens are valid for.
+* `supportedIdentityProviders` - (Optional) List of provider names for the identity providers that are supported on this client. Uses the `providerName` attribute of `awsCognitoIdentityProvider` resource(s), or the equivalent string(s).
+* `tokenValidityUnits` - (Optional) Configuration block for units in which the validity times are represented in. [Detailed below](#token_validity_units).
+* `writeAttributes` - (Optional) List of user pool attributes the application client can write to.
+
+### analytics_configuration
+
+Either `applicationArn` or `applicationId` is required.
+
+* `applicationArn` - (Optional) Application ARN for an Amazon Pinpoint application. Conflicts with `externalId` and `roleArn`.
+* `applicationId` - (Optional) Application ID for an Amazon Pinpoint application.
+* `externalId` - (Optional) ID for the Analytics Configuration. Conflicts with `applicationArn`.
+* `roleArn` - (Optional) ARN of an IAM role that authorizes Amazon Cognito to publish events to Amazon Pinpoint analytics. Conflicts with `applicationArn`.
+* `userDataShared` (Optional) If set to `true`, Amazon Cognito will include user data in the events it publishes to Amazon Pinpoint analytics.
+
+### token_validity_units
+
+Valid values for the following arguments are: `seconds`, `minutes`, `hours` or `days`.
+
+* `accessToken` - (Optional) Time unit in for the value in `accessTokenValidity`, defaults to `hours`.
+* `idToken` - (Optional) Time unit in for the value in `idTokenValidity`, defaults to `hours`.
+* `refreshToken` - (Optional) Time unit in for the value in `refreshTokenValidity`, defaults to `days`.
+
+<!-- cache-key: cdktf-0.18.0 input-804400abfbd53cd25621680ec5f1657976bea849d7c8272f9f3b774f5cc1e05b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/cognito_user_pool_clients.html.markdown b/website/docs/cdktf/typescript/d/cognito_user_pool_clients.html.markdown
new file mode 100644
index 00000000000..4a4996a7a4f
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/cognito_user_pool_clients.html.markdown
@@ -0,0 +1,48 @@
+---
+subcategory: "Cognito IDP (Identity Provider)"
+layout: "aws"
+page_title: "AWS: aws_cognito_user_pool_clients"
+description: |-
+  Get list of cognito user pool clients connected to user pool.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_cognito_user_pool_clients
+
+Use this data source to get a list of Cognito user pools clients for a Cognito IdP user pool.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCognitoUserPoolClients } from "./.gen/providers/aws/data-aws-cognito-user-pool-clients";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsCognitoUserPoolClients(this, "main", {
+      userPoolId: Token.asString(awsCognitoUserPoolMain.id),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `userPoolId` - (Required) Cognito user pool ID.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `clientIds` - List of Cognito user pool client IDs.
+* `clientNames` - List of Cognito user pool client names.
+
+<!-- cache-key: cdktf-0.18.0 input-0fe61149f327af030714ff2a7ce38b01d25e4ce678ca724c3e6bcaa54b7f9201 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/cognito_user_pool_clients.markdown b/website/docs/cdktf/typescript/d/cognito_user_pool_clients.markdown
new file mode 100644
index 00000000000..4a4996a7a4f
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/cognito_user_pool_clients.markdown
@@ -0,0 +1,48 @@
+---
+subcategory: "Cognito IDP (Identity Provider)"
+layout: "aws"
+page_title: "AWS: aws_cognito_user_pool_clients"
+description: |-
+  Get list of cognito user pool clients connected to user pool.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_cognito_user_pool_clients
+
+Use this data source to get a list of Cognito user pools clients for a Cognito IdP user pool.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCognitoUserPoolClients } from "./.gen/providers/aws/data-aws-cognito-user-pool-clients";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsCognitoUserPoolClients(this, "main", {
+      userPoolId: Token.asString(awsCognitoUserPoolMain.id),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `userPoolId` - (Required) Cognito user pool ID.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `clientIds` - List of Cognito user pool client IDs.
+* `clientNames` - List of Cognito user pool client names.
+
+<!-- cache-key: cdktf-0.18.0 input-0fe61149f327af030714ff2a7ce38b01d25e4ce678ca724c3e6bcaa54b7f9201 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/cognito_user_pool_signing_certificate.html.markdown b/website/docs/cdktf/typescript/d/cognito_user_pool_signing_certificate.html.markdown
new file mode 100644
index 00000000000..bd10bde4fa5
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/cognito_user_pool_signing_certificate.html.markdown
@@ -0,0 +1,47 @@
+---
+subcategory: "Cognito IDP (Identity Provider)"
+layout: "aws"
+page_title: "AWS: aws_cognito_user_pool_signing_certificate"
+description: |-
+  Get signing certificate of user pool
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_cognito_user_pool_signing_certificate
+
+Use this data source to get the signing certificate for a Cognito IdP user pool.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCognitoUserPoolSigningCertificate } from "./.gen/providers/aws/data-aws-cognito-user-pool-signing-certificate";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsCognitoUserPoolSigningCertificate(this, "sc", {
+      userPoolId: myPool.id,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `userPoolId` - (Required) Cognito user pool ID.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `certificate` - Certificate string
+
+<!-- cache-key: cdktf-0.18.0 input-841008061a82572c40fa11d3c10bc7dfd40e9bb58c679fe5f8e62188a7dcffb2 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/cognito_user_pool_signing_certificate.markdown b/website/docs/cdktf/typescript/d/cognito_user_pool_signing_certificate.markdown
new file mode 100644
index 00000000000..bd10bde4fa5
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/cognito_user_pool_signing_certificate.markdown
@@ -0,0 +1,47 @@
+---
+subcategory: "Cognito IDP (Identity Provider)"
+layout: "aws"
+page_title: "AWS: aws_cognito_user_pool_signing_certificate"
+description: |-
+  Get signing certificate of user pool
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_cognito_user_pool_signing_certificate
+
+Use this data source to get the signing certificate for a Cognito IdP user pool.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCognitoUserPoolSigningCertificate } from "./.gen/providers/aws/data-aws-cognito-user-pool-signing-certificate";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsCognitoUserPoolSigningCertificate(this, "sc", {
+      userPoolId: myPool.id,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `userPoolId` - (Required) Cognito user pool ID.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `certificate` - Certificate string
+
+<!-- cache-key: cdktf-0.18.0 input-841008061a82572c40fa11d3c10bc7dfd40e9bb58c679fe5f8e62188a7dcffb2 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/cognito_user_pools.html.markdown b/website/docs/cdktf/typescript/d/cognito_user_pools.html.markdown
new file mode 100644
index 00000000000..cd0a2b7a3f7
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/cognito_user_pools.html.markdown
@@ -0,0 +1,65 @@
+---
+subcategory: "Cognito IDP (Identity Provider)"
+layout: "aws"
+page_title: "AWS: aws_cognito_user_pools"
+description: |-
+  Get list of cognito user pools.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_cognito_user_pools
+
+Use this data source to get a list of cognito user pools.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ApiGatewayAuthorizer } from "./.gen/providers/aws/api-gateway-authorizer";
+import { DataAwsApiGatewayRestApi } from "./.gen/providers/aws/data-aws-api-gateway-rest-api";
+import { DataAwsCognitoUserPools } from "./.gen/providers/aws/data-aws-cognito-user-pools";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const selected = new DataAwsApiGatewayRestApi(this, "selected", {
+      name: apiGatewayName.stringValue,
+    });
+    const dataAwsCognitoUserPoolsSelected = new DataAwsCognitoUserPools(
+      this,
+      "selected_1",
+      {
+        name: cognitoUserPoolName.stringValue,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsCognitoUserPoolsSelected.overrideLogicalId("selected");
+    new ApiGatewayAuthorizer(this, "cognito", {
+      name: "cognito",
+      providerArns: Token.asList(dataAwsCognitoUserPoolsSelected.arns),
+      restApiId: Token.asString(selected.id),
+      type: "COGNITO_USER_POOLS",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `name` - (Required) Name of the cognito user pools. Name is not a unique attribute for cognito user pool, so multiple pools might be returned with given name. If the pool name is expected to be unique, you can reference the pool id via `tolist(dataAwsCognitoUserPoolsSelectedIds)[0]`
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `ids` - Set of cognito user pool ids.
+* `arns` - Set of cognito user pool Amazon Resource Names (ARNs).
+
+<!-- cache-key: cdktf-0.18.0 input-75e710379276dd4b4879fdf870f90225a6aad57dec06cd592a215bcaab891f06 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/cognito_user_pools.markdown b/website/docs/cdktf/typescript/d/cognito_user_pools.markdown
new file mode 100644
index 00000000000..cd0a2b7a3f7
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/cognito_user_pools.markdown
@@ -0,0 +1,65 @@
+---
+subcategory: "Cognito IDP (Identity Provider)"
+layout: "aws"
+page_title: "AWS: aws_cognito_user_pools"
+description: |-
+  Get list of cognito user pools.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_cognito_user_pools
+
+Use this data source to get a list of cognito user pools.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ApiGatewayAuthorizer } from "./.gen/providers/aws/api-gateway-authorizer";
+import { DataAwsApiGatewayRestApi } from "./.gen/providers/aws/data-aws-api-gateway-rest-api";
+import { DataAwsCognitoUserPools } from "./.gen/providers/aws/data-aws-cognito-user-pools";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const selected = new DataAwsApiGatewayRestApi(this, "selected", {
+      name: apiGatewayName.stringValue,
+    });
+    const dataAwsCognitoUserPoolsSelected = new DataAwsCognitoUserPools(
+      this,
+      "selected_1",
+      {
+        name: cognitoUserPoolName.stringValue,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsCognitoUserPoolsSelected.overrideLogicalId("selected");
+    new ApiGatewayAuthorizer(this, "cognito", {
+      name: "cognito",
+      providerArns: Token.asList(dataAwsCognitoUserPoolsSelected.arns),
+      restApiId: Token.asString(selected.id),
+      type: "COGNITO_USER_POOLS",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `name` - (Required) Name of the cognito user pools. Name is not a unique attribute for cognito user pool, so multiple pools might be returned with given name. If the pool name is expected to be unique, you can reference the pool id via `tolist(dataAwsCognitoUserPoolsSelectedIds)[0]`
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `ids` - Set of cognito user pool ids.
+* `arns` - Set of cognito user pool Amazon Resource Names (ARNs).
+
+<!-- cache-key: cdktf-0.18.0 input-75e710379276dd4b4879fdf870f90225a6aad57dec06cd592a215bcaab891f06 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/connect_bot_association.html.markdown b/website/docs/cdktf/typescript/d/connect_bot_association.html.markdown
new file mode 100644
index 00000000000..7feb765dc1a
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/connect_bot_association.html.markdown
@@ -0,0 +1,56 @@
+---
+subcategory: "Connect"
+layout: "aws"
+page_title: "AWS: aws_connect_bot_association"
+description: |-
+  Provides details about a specific Lex (V1) Bot associated with an Amazon Connect instance
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_connect_bot_association
+
+Provides details about a specific Lex (V1) Bot associated with an Amazon Connect instance.
+
+## Example Usage
+
+### By name
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsConnectBotAssociation } from "./.gen/providers/aws/data-aws-connect-bot-association";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsConnectBotAssociation(this, "example", {
+      instanceId: "aaaaaaaa-bbbb-cccc-dddd-111111111111",
+      lexBot: {
+        name: "Test",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `instanceId` - (Required) Identifier of the Amazon Connect instance. You can find the instanceId in the ARN of the instance.
+* `lexBot` - (Required) Configuration information of an Amazon Lex (V1) bot. Detailed below.
+
+### lex_bot
+
+The `lexBot` configuration block supports the following:
+
+* `name` - (Required) Name of the Amazon Lex (V1) bot.
+* `lexRegion` - (Optional) Region that the Amazon Lex (V1) bot was created in.
+
+<!-- cache-key: cdktf-0.18.0 input-404504bb11b568903bd8a32e96212172ac650fcf502c3c69fa40dbe6b2b93e17 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/connect_bot_association.markdown b/website/docs/cdktf/typescript/d/connect_bot_association.markdown
new file mode 100644
index 00000000000..7feb765dc1a
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/connect_bot_association.markdown
@@ -0,0 +1,56 @@
+---
+subcategory: "Connect"
+layout: "aws"
+page_title: "AWS: aws_connect_bot_association"
+description: |-
+  Provides details about a specific Lex (V1) Bot associated with an Amazon Connect instance
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_connect_bot_association
+
+Provides details about a specific Lex (V1) Bot associated with an Amazon Connect instance.
+
+## Example Usage
+
+### By name
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsConnectBotAssociation } from "./.gen/providers/aws/data-aws-connect-bot-association";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsConnectBotAssociation(this, "example", {
+      instanceId: "aaaaaaaa-bbbb-cccc-dddd-111111111111",
+      lexBot: {
+        name: "Test",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `instanceId` - (Required) Identifier of the Amazon Connect instance. You can find the instanceId in the ARN of the instance.
+* `lexBot` - (Required) Configuration information of an Amazon Lex (V1) bot. Detailed below.
+
+### lex_bot
+
+The `lexBot` configuration block supports the following:
+
+* `name` - (Required) Name of the Amazon Lex (V1) bot.
+* `lexRegion` - (Optional) Region that the Amazon Lex (V1) bot was created in.
+
+<!-- cache-key: cdktf-0.18.0 input-404504bb11b568903bd8a32e96212172ac650fcf502c3c69fa40dbe6b2b93e17 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/connect_contact_flow.html.markdown b/website/docs/cdktf/typescript/d/connect_contact_flow.html.markdown
new file mode 100644
index 00000000000..11cb65f2716
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/connect_contact_flow.html.markdown
@@ -0,0 +1,83 @@
+---
+subcategory: "Connect"
+layout: "aws"
+page_title: "AWS: aws_connect_contact_flow"
+description: |-
+  Provides details about a specific Amazon Connect Contact Flow.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_connect_contact_flow
+
+Provides details about a specific Amazon Connect Contact Flow.
+
+## Example Usage
+
+By name
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsConnectContactFlow } from "./.gen/providers/aws/data-aws-connect-contact-flow";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsConnectContactFlow(this, "test", {
+      instanceId: "aaaaaaaa-bbbb-cccc-dddd-111111111111",
+      name: "Test",
+    });
+  }
+}
+
+```
+
+By contact_flow_id
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsConnectContactFlow } from "./.gen/providers/aws/data-aws-connect-contact-flow";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsConnectContactFlow(this, "test", {
+      contactFlowId: "cccccccc-bbbb-cccc-dddd-111111111111",
+      instanceId: "aaaaaaaa-bbbb-cccc-dddd-111111111111",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+~> **NOTE:** `instanceId` and one of either `name` or `contactFlowId` is required.
+
+This argument supports the following arguments:
+
+* `contactFlowId` - (Optional) Returns information on a specific Contact Flow by contact flow id
+* `instanceId` - (Required) Reference to the hosting Amazon Connect Instance
+* `name` - (Optional) Returns information on a specific Contact Flow by name
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Contact Flow.
+* `content` - Logic of the Contact Flow.
+* `description` - Description of the Contact Flow.
+* `tags` - Tags to assign to the Contact Flow.
+* `type` - Type of Contact Flow.
+
+<!-- cache-key: cdktf-0.18.0 input-4e365316c40b7e767d366a9457c4aad07059bd09524a478619ae11bc584d56dc -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/connect_contact_flow_module.html.markdown b/website/docs/cdktf/typescript/d/connect_contact_flow_module.html.markdown
new file mode 100644
index 00000000000..741ee15bf90
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/connect_contact_flow_module.html.markdown
@@ -0,0 +1,84 @@
+---
+subcategory: "Connect"
+layout: "aws"
+page_title: "AWS: aws_connect_contact_flow_module"
+description: |-
+  Provides details about a specific Amazon Connect Contact Flow Module.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_connect_contact_flow_module
+
+Provides details about a specific Amazon Connect Contact Flow Module.
+
+## Example Usage
+
+By `name`
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsConnectContactFlowModule } from "./.gen/providers/aws/data-aws-connect-contact-flow-module";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsConnectContactFlowModule(this, "example", {
+      instanceId: "aaaaaaaa-bbbb-cccc-dddd-111111111111",
+      name: "example",
+    });
+  }
+}
+
+```
+
+By `contactFlowModuleId`
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsConnectContactFlowModule } from "./.gen/providers/aws/data-aws-connect-contact-flow-module";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsConnectContactFlowModule(this, "example", {
+      contactFlowModuleId: "cccccccc-bbbb-cccc-dddd-111111111111",
+      instanceId: "aaaaaaaa-bbbb-cccc-dddd-111111111111",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+~> **NOTE:** `instanceId` and one of either `name` or `contactFlowModuleId` is required.
+
+This argument supports the following arguments:
+
+* `contactFlowModuleId` - (Optional) Returns information on a specific Contact Flow Module by contact flow module id
+* `instanceId` - (Required) Reference to the hosting Amazon Connect Instance
+* `name` - (Optional) Returns information on a specific Contact Flow Module by name
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Contact Flow Module.
+* `content` - Logic of the Contact Flow Module.
+* `description` - Description of the Contact Flow Module.
+* `tags` - Map of tags to assign to the Contact Flow Module.
+* `state` - Type of Contact Flow Module Module. Values are either `active` or `archived`.
+* `status` - Status of the Contact Flow Module Module. Values are either `published` or `saved`.
+
+<!-- cache-key: cdktf-0.18.0 input-42ad4b40afc50837380755e739270bff09e741210205ca792850ed7cbdd2d210 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/connect_hours_of_operation.html.markdown b/website/docs/cdktf/typescript/d/connect_hours_of_operation.html.markdown
new file mode 100644
index 00000000000..6c199c23c98
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/connect_hours_of_operation.html.markdown
@@ -0,0 +1,102 @@
+---
+subcategory: "Connect"
+layout: "aws"
+page_title: "AWS: aws_connect_hours_of_operation"
+description: |-
+  Provides details about a specific Amazon Connect Hours of Operation.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_connect_hours_of_operation
+
+Provides details about a specific Amazon Connect Hours of Operation.
+
+## Example Usage
+
+By `name`
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsConnectHoursOfOperation } from "./.gen/providers/aws/data-aws-connect-hours-of-operation";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsConnectHoursOfOperation(this, "test", {
+      instanceId: "aaaaaaaa-bbbb-cccc-dddd-111111111111",
+      name: "Test",
+    });
+  }
+}
+
+```
+
+By `hoursOfOperationId`
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsConnectHoursOfOperation } from "./.gen/providers/aws/data-aws-connect-hours-of-operation";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsConnectHoursOfOperation(this, "test", {
+      hoursOfOperationId: "cccccccc-bbbb-cccc-dddd-111111111111",
+      instanceId: "aaaaaaaa-bbbb-cccc-dddd-111111111111",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+~> **NOTE:** `instanceId` and one of either `name` or `hoursOfOperationId` is required.
+
+This argument supports the following arguments:
+
+* `hoursOfOperationId` - (Optional) Returns information on a specific Hours of Operation by hours of operation id
+* `instanceId` - (Required) Reference to the hosting Amazon Connect Instance
+* `name` - (Optional) Returns information on a specific Hours of Operation by name
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Hours of Operation.
+* `config` - Configuration information for the hours of operation: day, start time, and end time . Config blocks are documented below. Config blocks are documented below.
+* `description` - Description of the Hours of Operation.
+* `hoursOfOperationId` - The identifier for the hours of operation.
+* `instanceId` - Identifier of the hosting Amazon Connect Instance.
+* `name` - Name of the Hours of Operation.
+* `tags` - Map of tags to assign to the Hours of Operation.
+* `timeZone` - Time zone of the Hours of Operation.
+
+A `config` block supports the following arguments:
+
+* `day` - Day that the hours of operation applies to.
+* `endTime` - End time block specifies the time that your contact center closes. The `endTime` is documented below.
+* `startTime` - Start time block specifies the time that your contact center opens. The `startTime` is documented below.
+
+A `endTime` block supports the following arguments:
+
+* `hours` - Hour of closing.
+* `minutes` - Minute of closing.
+
+A `startTime` block supports the following arguments:
+
+* `hours` - Hour of opening.
+* `minutes` - Minute of opening.
+
+<!-- cache-key: cdktf-0.18.0 input-69f2eddaf1ae71ae8b2382f108eed67e1baf19a25a016f4a6cd6db210fa55e83 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/connect_instance.html.markdown b/website/docs/cdktf/typescript/d/connect_instance.html.markdown
new file mode 100644
index 00000000000..c8e35825b46
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/connect_instance.html.markdown
@@ -0,0 +1,89 @@
+---
+subcategory: "Connect"
+layout: "aws"
+page_title: "AWS: aws_connect_instance"
+description: |-
+  Provides details about a specific Connect Instance.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_connect_instance
+
+Provides details about a specific Amazon Connect Instance.
+
+## Example Usage
+
+By instance_alias
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsConnectInstance } from "./.gen/providers/aws/data-aws-connect-instance";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsConnectInstance(this, "foo", {
+      instanceAlias: "foo",
+    });
+  }
+}
+
+```
+
+By instance_id
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsConnectInstance } from "./.gen/providers/aws/data-aws-connect-instance";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsConnectInstance(this, "foo", {
+      instanceId: "97afc98d-101a-ba98-ab97-ae114fc115ec",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+~> **NOTE:** One of either `instanceId` or `instanceAlias` is required.
+
+This argument supports the following arguments:
+
+* `instanceId` - (Optional) Returns information on a specific connect instance by id
+
+* `instanceAlias` - (Optional) Returns information on a specific connect instance by alias
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `createdTime` - When the instance was created.
+* `arn` - ARN of the instance.
+* `identityManagementType` - Specifies The identity management type attached to the instance.
+* `inboundCallsEnabled` - Whether inbound calls are enabled.
+* `outboundCallsEnabled` - Whether outbound calls are enabled.
+* `earlyMediaEnabled` - Whether early media for outbound calls is enabled .
+* `contactFlowLogsEnabled` - Whether contact flow logs are enabled.
+* `contactLensEnabled` - Whether contact lens is enabled.
+* `autoResolveBestVoices` - Whether auto resolve best voices is enabled.
+* `multiPartyConferenceEnabled` - Whether multi-party calls/conference is enabled.
+* `useCustomTtsVoices` - Whether use custom tts voices is enabled.
+* `status` - State of the instance.
+* `serviceRole` - Service role of the instance.
+
+<!-- cache-key: cdktf-0.18.0 input-f348847518408d57a1b3c05acaebc2f7c353201d2c00301debc08e5c4c84bccc -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/connect_instance_storage_config.html.markdown b/website/docs/cdktf/typescript/d/connect_instance_storage_config.html.markdown
new file mode 100644
index 00000000000..8cca3280da2
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/connect_instance_storage_config.html.markdown
@@ -0,0 +1,100 @@
+---
+subcategory: "Connect"
+layout: "aws"
+page_title: "AWS: aws_connect_instance_storage_config"
+description: |-
+  Provides details about a specific Amazon Connect Instance Storage Config.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_connect_instance_storage_config
+
+Provides details about a specific Amazon Connect Instance Storage Config.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsConnectInstanceStorageConfig } from "./.gen/providers/aws/data-aws-connect-instance-storage-config";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsConnectInstanceStorageConfig(this, "example", {
+      associationId:
+        "1234567890123456789012345678901234567890123456789012345678901234",
+      instanceId: "aaaaaaaa-bbbb-cccc-dddd-111111111111",
+      resourceType: "CONTACT_TRACE_RECORDS",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `associationId` - (Required) The existing association identifier that uniquely identifies the resource type and storage config for the given instance ID.
+* `instanceId` - (Required) Reference to the hosting Amazon Connect Instance
+* `resourceType` - (Required) A valid resource type. Valid Values: `agentEvents` | `attachments` | `callRecordings` | `chatTranscripts` | `contactEvaluations` | `contactTraceRecords` | `mediaStreams` | `realTimeContactAnalysisSegments` | `scheduledReports` |  `screenRecordings`.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - The identifier of the hosting Amazon Connect Instance, `associationId`, and `resourceType` separated by a colon (`:`).
+* `storageConfig` - Specifies the storage configuration options for the Connect Instance. [Documented below](#storage_config).
+
+### `storageConfig`
+
+The `storageConfig` configuration block supports the following arguments:
+
+* `kinesisFirehoseConfig` - A block that specifies the configuration of the Kinesis Firehose delivery stream. [Documented below](#kinesis_firehose_config).
+* `kinesisStreamConfig` - A block that specifies the configuration of the Kinesis data stream. [Documented below](#kinesis_stream_config).
+* `kinesisVideoStreamConfig` - A block that specifies the configuration of the Kinesis video stream. [Documented below](#kinesis_video_stream_config).
+* `s3Config` - A block that specifies the configuration of S3 Bucket. [Documented below](#s3_config).
+* `storageType` - A valid storage type. Valid Values: `s3` | `kinesisVideoStream` | `kinesisStream` | `kinesisFirehose`.
+
+#### `kinesisFirehoseConfig`
+
+The `kinesisFirehoseConfig` configuration block supports the following arguments:
+
+* `firehoseArn` - The Amazon Resource Name (ARN) of the delivery stream.
+
+#### `kinesisStreamConfig`
+
+The `kinesisStreamConfig` configuration block supports the following arguments:
+
+* `streamArn` - The Amazon Resource Name (ARN) of the data stream.
+
+#### `kinesisVideoStreamConfig`
+
+The `kinesisVideoStreamConfig` configuration block supports the following arguments:
+
+* `encryptionConfig` - The encryption configuration. [Documented below](#encryption_config).
+* `prefix` - The prefix of the video stream. Minimum length of `1`. Maximum length of `128`. When read from the state, the value returned is `<prefix>Connect-<connectInstanceAlias>Contact` since the API appends additional details to the `prefix`.
+* `retentionPeriodHours` - The number of hours to retain the data in a data store associated with the stream. Minimum value of `0`. Maximum value of `87600`. A value of `0` indicates that the stream does not persist data.
+
+#### `s3Config`
+
+The `s3Config` configuration block supports the following arguments:
+
+* `bucketName` - The S3 bucket name.
+* `bucketPrefix` - The S3 bucket prefix.
+* `encryptionConfig` - The encryption configuration. [Documented below](#encryption_config).
+
+#### `encryptionConfig`
+
+The `encryptionConfig` configuration block supports the following arguments:
+
+* `encryptionType` - The type of encryption. Valid Values: `kms`.
+* `keyId` - The full ARN of the encryption key. Be sure to provide the full ARN of the encryption key, not just the ID.
+
+<!-- cache-key: cdktf-0.18.0 input-0a371661b1d38e2710e935ff6991b75943c6ddc01dc786ffa90e9554a47badeb -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/connect_lambda_function_association.html.markdown b/website/docs/cdktf/typescript/d/connect_lambda_function_association.html.markdown
new file mode 100644
index 00000000000..3747cab259b
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/connect_lambda_function_association.html.markdown
@@ -0,0 +1,51 @@
+---
+subcategory: "Connect"
+layout: "aws"
+page_title: "AWS: aws_connect_lambda_function_association"
+description: |-
+  Provides details about a specific Connect Lambda Function Association.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_connect_lambda_function_association
+
+Provides details about a specific Connect Lambda Function Association.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsConnectLambdaFunctionAssociation } from "./.gen/providers/aws/data-aws-connect-lambda-function-association";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsConnectLambdaFunctionAssociation(this, "example", {
+      functionArn: "arn:aws:lambda:us-west-2:123456789123:function:abcdefg",
+      instanceId: "aaaaaaaa-bbbb-cccc-dddd-111111111111",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `functionArn` - (Required) ARN of the Lambda Function, omitting any version or alias qualifier.
+* `instanceId` - (Required) Identifier of the Amazon Connect instance. You can find the instanceId in the ARN of the instance.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - AWS Region.
+
+<!-- cache-key: cdktf-0.18.0 input-c1d2d9bab41d5c50f6cd1ef56d9cd79787374ce4ee8749c6691de4b6f052c798 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/connect_lambda_function_association.markdown b/website/docs/cdktf/typescript/d/connect_lambda_function_association.markdown
new file mode 100644
index 00000000000..3747cab259b
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/connect_lambda_function_association.markdown
@@ -0,0 +1,51 @@
+---
+subcategory: "Connect"
+layout: "aws"
+page_title: "AWS: aws_connect_lambda_function_association"
+description: |-
+  Provides details about a specific Connect Lambda Function Association.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_connect_lambda_function_association
+
+Provides details about a specific Connect Lambda Function Association.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsConnectLambdaFunctionAssociation } from "./.gen/providers/aws/data-aws-connect-lambda-function-association";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsConnectLambdaFunctionAssociation(this, "example", {
+      functionArn: "arn:aws:lambda:us-west-2:123456789123:function:abcdefg",
+      instanceId: "aaaaaaaa-bbbb-cccc-dddd-111111111111",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `functionArn` - (Required) ARN of the Lambda Function, omitting any version or alias qualifier.
+* `instanceId` - (Required) Identifier of the Amazon Connect instance. You can find the instanceId in the ARN of the instance.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - AWS Region.
+
+<!-- cache-key: cdktf-0.18.0 input-c1d2d9bab41d5c50f6cd1ef56d9cd79787374ce4ee8749c6691de4b6f052c798 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/connect_prompt.html.markdown b/website/docs/cdktf/typescript/d/connect_prompt.html.markdown
new file mode 100644
index 00000000000..d31e32a21fe
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/connect_prompt.html.markdown
@@ -0,0 +1,54 @@
+---
+subcategory: "Connect"
+layout: "aws"
+page_title: "AWS: aws_connect_prompt"
+description: |-
+  Provides details about a specific Amazon Connect Prompt.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_connect_prompt
+
+Provides details about a specific Amazon Connect Prompt.
+
+## Example Usage
+
+By `name`
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsConnectPrompt } from "./.gen/providers/aws/data-aws-connect-prompt";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsConnectPrompt(this, "example", {
+      instanceId: "aaaaaaaa-bbbb-cccc-dddd-111111111111",
+      name: "Beep.wav",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `instanceId` - (Required) Reference to the hosting Amazon Connect Instance
+* `name` - (Required) Returns information on a specific Prompt by name
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Prompt.
+* `promptId` - Identifier for the prompt.
+
+<!-- cache-key: cdktf-0.18.0 input-58177347a81170a254def5388f5a6e011293a60f34e502cfd48782224da8174b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/connect_queue.html.markdown b/website/docs/cdktf/typescript/d/connect_queue.html.markdown
new file mode 100644
index 00000000000..56e8f16bbae
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/connect_queue.html.markdown
@@ -0,0 +1,93 @@
+---
+subcategory: "Connect"
+layout: "aws"
+page_title: "AWS: aws_connect_queue"
+description: |-
+  Provides details about a specific Amazon Connect Queue.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_connect_queue
+
+Provides details about a specific Amazon Connect Queue.
+
+## Example Usage
+
+By `name`
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsConnectQueue } from "./.gen/providers/aws/data-aws-connect-queue";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsConnectQueue(this, "example", {
+      instanceId: "aaaaaaaa-bbbb-cccc-dddd-111111111111",
+      name: "Example",
+    });
+  }
+}
+
+```
+
+By `queueId`
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsConnectQueue } from "./.gen/providers/aws/data-aws-connect-queue";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsConnectQueue(this, "example", {
+      instanceId: "aaaaaaaa-bbbb-cccc-dddd-111111111111",
+      queueId: "cccccccc-bbbb-cccc-dddd-111111111111",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+~> **NOTE:** `instanceId` and one of either `name` or `queueId` is required.
+
+This argument supports the following arguments:
+
+* `queueId` - (Optional) Returns information on a specific Queue by Queue id
+* `instanceId` - (Required) Reference to the hosting Amazon Connect Instance
+* `name` - (Optional) Returns information on a specific Queue by name
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Queue.
+* `description` - Description of the Queue.
+* `hoursOfOperationId` - Specifies the identifier of the Hours of Operation.
+* `id` - Identifier of the hosting Amazon Connect Instance and identifier of the Queue separated by a colon (`:`).
+* `maxContacts` - Maximum number of contacts that can be in the queue before it is considered full. Minimum value of 0.
+* `outboundCallerConfig` - A block that defines the outbound caller ID name, number, and outbound whisper flow. The Outbound Caller Config block is documented below.
+* `queueId` - Identifier for the Queue.
+* `status` - Description of the Queue. Values are `enabled` or `disabled`.
+* `tags` - Map of tags assigned to the Queue.
+
+A `outboundCallerConfig` block supports the following arguments:
+
+* `outboundCallerIdName` - Specifies the caller ID name.
+* `outboundCallerIdNumberId` - Specifies the caller ID number.
+* `outboundFlowId` - Outbound whisper flow to be used during an outbound call.
+
+<!-- cache-key: cdktf-0.18.0 input-d0262a3c29b46b8dbb30b2ae9f8094c5a65be92283024cb87ab840ae200c1772 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/connect_queue.markdown b/website/docs/cdktf/typescript/d/connect_queue.markdown
new file mode 100644
index 00000000000..56e8f16bbae
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/connect_queue.markdown
@@ -0,0 +1,93 @@
+---
+subcategory: "Connect"
+layout: "aws"
+page_title: "AWS: aws_connect_queue"
+description: |-
+  Provides details about a specific Amazon Connect Queue.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_connect_queue
+
+Provides details about a specific Amazon Connect Queue.
+
+## Example Usage
+
+By `name`
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsConnectQueue } from "./.gen/providers/aws/data-aws-connect-queue";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsConnectQueue(this, "example", {
+      instanceId: "aaaaaaaa-bbbb-cccc-dddd-111111111111",
+      name: "Example",
+    });
+  }
+}
+
+```
+
+By `queueId`
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsConnectQueue } from "./.gen/providers/aws/data-aws-connect-queue";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsConnectQueue(this, "example", {
+      instanceId: "aaaaaaaa-bbbb-cccc-dddd-111111111111",
+      queueId: "cccccccc-bbbb-cccc-dddd-111111111111",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+~> **NOTE:** `instanceId` and one of either `name` or `queueId` is required.
+
+This argument supports the following arguments:
+
+* `queueId` - (Optional) Returns information on a specific Queue by Queue id
+* `instanceId` - (Required) Reference to the hosting Amazon Connect Instance
+* `name` - (Optional) Returns information on a specific Queue by name
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Queue.
+* `description` - Description of the Queue.
+* `hoursOfOperationId` - Specifies the identifier of the Hours of Operation.
+* `id` - Identifier of the hosting Amazon Connect Instance and identifier of the Queue separated by a colon (`:`).
+* `maxContacts` - Maximum number of contacts that can be in the queue before it is considered full. Minimum value of 0.
+* `outboundCallerConfig` - A block that defines the outbound caller ID name, number, and outbound whisper flow. The Outbound Caller Config block is documented below.
+* `queueId` - Identifier for the Queue.
+* `status` - Description of the Queue. Values are `enabled` or `disabled`.
+* `tags` - Map of tags assigned to the Queue.
+
+A `outboundCallerConfig` block supports the following arguments:
+
+* `outboundCallerIdName` - Specifies the caller ID name.
+* `outboundCallerIdNumberId` - Specifies the caller ID number.
+* `outboundFlowId` - Outbound whisper flow to be used during an outbound call.
+
+<!-- cache-key: cdktf-0.18.0 input-d0262a3c29b46b8dbb30b2ae9f8094c5a65be92283024cb87ab840ae200c1772 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/connect_quick_connect.html.markdown b/website/docs/cdktf/typescript/d/connect_quick_connect.html.markdown
new file mode 100644
index 00000000000..e56e34f0390
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/connect_quick_connect.html.markdown
@@ -0,0 +1,105 @@
+---
+subcategory: "Connect"
+layout: "aws"
+page_title: "AWS: aws_connect_quick_connect"
+description: |-
+  Provides details about a specific Amazon Connect Quick Connect.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_connect_quick_connect
+
+Provides details about a specific Amazon Connect Quick Connect.
+
+## Example Usage
+
+By `name`
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsConnectQuickConnect } from "./.gen/providers/aws/data-aws-connect-quick-connect";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsConnectQuickConnect(this, "example", {
+      instanceId: "aaaaaaaa-bbbb-cccc-dddd-111111111111",
+      name: "Example",
+    });
+  }
+}
+
+```
+
+By `quickConnectId`
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsConnectQuickConnect } from "./.gen/providers/aws/data-aws-connect-quick-connect";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsConnectQuickConnect(this, "example", {
+      instanceId: "aaaaaaaa-bbbb-cccc-dddd-111111111111",
+      quickConnectId: "cccccccc-bbbb-cccc-dddd-111111111111",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+~> **NOTE:** `instanceId` and one of either `name` or `quickConnectId` is required.
+
+This argument supports the following arguments:
+
+* `quickConnectId` - (Optional) Returns information on a specific Quick Connect by Quick Connect id
+* `instanceId` - (Required) Reference to the hosting Amazon Connect Instance
+* `name` - (Optional) Returns information on a specific Quick Connect by name
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Quick Connect.
+* `description` - Description of the Quick Connect.
+* `id` - Identifier of the hosting Amazon Connect Instance and identifier of the Quick Connect separated by a colon (`:`).
+* `quickConnectConfig` - A block that defines the configuration information for the Quick Connect: `quickConnectType` and one of `phoneConfig`, `queueConfig`, `userConfig` . The Quick Connect Config block is documented below.
+* `quickConnectId` - Identifier for the Quick Connect.
+* `tags` - Map of tags to assign to the Quick Connect.
+
+A `quickConnectConfig` block contains the following arguments:
+
+* `quickConnectType` - Configuration type of the Quick Connect. Valid values are `phoneNumber`, `queue`, `user`.
+* `phoneConfig` - Phone configuration of the Quick Connect. This is returned only if `quickConnectType` is `phoneNumber`. The `phoneConfig` block is documented below.
+* `queueConfig` - Queue configuration of the Quick Connect. This is returned only if `quickConnectType` is `queue`. The `queueConfig` block is documented below.
+* `userConfig` - User configuration of the Quick Connect. This is returned only if `quickConnectType` is `user`. The `userConfig` block is documented below.
+
+A `phoneConfig` block contains the following arguments:
+
+* `phoneNumber` - Phone number in in E.164 format.
+
+A `queueConfig` block contains the following arguments:
+
+* `contactFlowId` - Identifier of the contact flow.
+* `queueId` - Identifier for the queue.
+
+A `userConfig` block contains the following arguments:
+
+* `contactFlowId` - Identifier of the contact flow.
+* `userId` - Identifier for the user.
+
+<!-- cache-key: cdktf-0.18.0 input-47e113eb2f3ca472b6251d59440456f77334d6f7906ea4bbe83c661c839f9048 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/connect_quick_connect.markdown b/website/docs/cdktf/typescript/d/connect_quick_connect.markdown
new file mode 100644
index 00000000000..e56e34f0390
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/connect_quick_connect.markdown
@@ -0,0 +1,105 @@
+---
+subcategory: "Connect"
+layout: "aws"
+page_title: "AWS: aws_connect_quick_connect"
+description: |-
+  Provides details about a specific Amazon Connect Quick Connect.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_connect_quick_connect
+
+Provides details about a specific Amazon Connect Quick Connect.
+
+## Example Usage
+
+By `name`
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsConnectQuickConnect } from "./.gen/providers/aws/data-aws-connect-quick-connect";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsConnectQuickConnect(this, "example", {
+      instanceId: "aaaaaaaa-bbbb-cccc-dddd-111111111111",
+      name: "Example",
+    });
+  }
+}
+
+```
+
+By `quickConnectId`
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsConnectQuickConnect } from "./.gen/providers/aws/data-aws-connect-quick-connect";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsConnectQuickConnect(this, "example", {
+      instanceId: "aaaaaaaa-bbbb-cccc-dddd-111111111111",
+      quickConnectId: "cccccccc-bbbb-cccc-dddd-111111111111",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+~> **NOTE:** `instanceId` and one of either `name` or `quickConnectId` is required.
+
+This argument supports the following arguments:
+
+* `quickConnectId` - (Optional) Returns information on a specific Quick Connect by Quick Connect id
+* `instanceId` - (Required) Reference to the hosting Amazon Connect Instance
+* `name` - (Optional) Returns information on a specific Quick Connect by name
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Quick Connect.
+* `description` - Description of the Quick Connect.
+* `id` - Identifier of the hosting Amazon Connect Instance and identifier of the Quick Connect separated by a colon (`:`).
+* `quickConnectConfig` - A block that defines the configuration information for the Quick Connect: `quickConnectType` and one of `phoneConfig`, `queueConfig`, `userConfig` . The Quick Connect Config block is documented below.
+* `quickConnectId` - Identifier for the Quick Connect.
+* `tags` - Map of tags to assign to the Quick Connect.
+
+A `quickConnectConfig` block contains the following arguments:
+
+* `quickConnectType` - Configuration type of the Quick Connect. Valid values are `phoneNumber`, `queue`, `user`.
+* `phoneConfig` - Phone configuration of the Quick Connect. This is returned only if `quickConnectType` is `phoneNumber`. The `phoneConfig` block is documented below.
+* `queueConfig` - Queue configuration of the Quick Connect. This is returned only if `quickConnectType` is `queue`. The `queueConfig` block is documented below.
+* `userConfig` - User configuration of the Quick Connect. This is returned only if `quickConnectType` is `user`. The `userConfig` block is documented below.
+
+A `phoneConfig` block contains the following arguments:
+
+* `phoneNumber` - Phone number in in E.164 format.
+
+A `queueConfig` block contains the following arguments:
+
+* `contactFlowId` - Identifier of the contact flow.
+* `queueId` - Identifier for the queue.
+
+A `userConfig` block contains the following arguments:
+
+* `contactFlowId` - Identifier of the contact flow.
+* `userId` - Identifier for the user.
+
+<!-- cache-key: cdktf-0.18.0 input-47e113eb2f3ca472b6251d59440456f77334d6f7906ea4bbe83c661c839f9048 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/connect_routing_profile.html.markdown b/website/docs/cdktf/typescript/d/connect_routing_profile.html.markdown
new file mode 100644
index 00000000000..0af2f9688ee
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/connect_routing_profile.html.markdown
@@ -0,0 +1,99 @@
+---
+subcategory: "Connect"
+layout: "aws"
+page_title: "AWS: aws_connect_routing_profile"
+description: |-
+  Provides details about a specific Amazon Connect Routing Profile.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_connect_routing_profile
+
+Provides details about a specific Amazon Connect Routing Profile.
+
+## Example Usage
+
+By `name`
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsConnectRoutingProfile } from "./.gen/providers/aws/data-aws-connect-routing-profile";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsConnectRoutingProfile(this, "example", {
+      instanceId: "aaaaaaaa-bbbb-cccc-dddd-111111111111",
+      name: "Example",
+    });
+  }
+}
+
+```
+
+By `routingProfileId`
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsConnectRoutingProfile } from "./.gen/providers/aws/data-aws-connect-routing-profile";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsConnectRoutingProfile(this, "example", {
+      instanceId: "aaaaaaaa-bbbb-cccc-dddd-111111111111",
+      routingProfileId: "cccccccc-bbbb-cccc-dddd-111111111111",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+~> **NOTE:** `instanceId` and one of either `name` or `routingProfileId` is required.
+
+This argument supports the following arguments:
+
+* `instanceId` - Reference to the hosting Amazon Connect Instance
+* `name` - (Optional) Returns information on a specific Routing Profile by name
+* `routingProfileId` - (Optional) Returns information on a specific Routing Profile by Routing Profile id
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Routing Profile.
+* `defaultOutboundQueueId` - Specifies the default outbound queue for the Routing Profile.
+* `description` - Description of the Routing Profile.
+* `id` - Identifier of the hosting Amazon Connect Instance and identifier of the Routing Profile separated by a colon (`:`).
+* `mediaConcurrencies` - One or more `mediaConcurrencies` blocks that specify the channels that agents can handle in the Contact Control Panel (CCP) for this Routing Profile. The `mediaConcurrencies` block is documented below.
+* `queueConfigs` - One or more `queueConfigs` blocks that specify the inbound queues associated with the routing profile. If no queue is added, the agent only can make outbound calls. The `queueConfigs` block is documented below.
+* `tags` - Map of tags to assign to the Routing Profile.
+
+A `mediaConcurrencies` block supports the following attributes:
+
+* `channel` - Channels that agents can handle in the Contact Control Panel (CCP). Valid values are `voice`, `chat`, `task`.
+* `concurrency` - Number of contacts an agent can have on a channel simultaneously. Valid Range for `voice`: Minimum value of 1. Maximum value of 1. Valid Range for `chat`: Minimum value of 1. Maximum value of 10. Valid Range for `task`: Minimum value of 1. Maximum value of 10.
+
+A `queueConfigs` block supports the following attributes:
+
+* `channel` - Channels agents can handle in the Contact Control Panel (CCP) for this routing profile. Valid values are `voice`, `chat`, `task`.
+* `delay` - Delay, in seconds, that a contact should be in the queue before they are routed to an available agent
+* `priority` - Order in which contacts are to be handled for the queue.
+* `queueArn` - ARN for the queue.
+* `queueId` - Identifier for the queue.
+* `queueName` - Name for the queue.
+
+<!-- cache-key: cdktf-0.18.0 input-7ae68b75fdca27a8760c4c164d2158714999272950916b7bd000a215ec569cf2 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/connect_security_profile.html.markdown b/website/docs/cdktf/typescript/d/connect_security_profile.html.markdown
new file mode 100644
index 00000000000..87840008f52
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/connect_security_profile.html.markdown
@@ -0,0 +1,84 @@
+---
+subcategory: "Connect"
+layout: "aws"
+page_title: "AWS: aws_connect_security_profile"
+description: |-
+  Provides details about a specific Amazon Connect Security Profile.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_connect_security_profile
+
+Provides details about a specific Amazon Connect Security Profile.
+
+## Example Usage
+
+By `name`
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsConnectSecurityProfile } from "./.gen/providers/aws/data-aws-connect-security-profile";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsConnectSecurityProfile(this, "example", {
+      instanceId: "aaaaaaaa-bbbb-cccc-dddd-111111111111",
+      name: "Example",
+    });
+  }
+}
+
+```
+
+By `securityProfileId`
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsConnectSecurityProfile } from "./.gen/providers/aws/data-aws-connect-security-profile";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsConnectSecurityProfile(this, "example", {
+      instanceId: "aaaaaaaa-bbbb-cccc-dddd-111111111111",
+      securityProfileId: "cccccccc-bbbb-cccc-dddd-111111111111",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+~> **NOTE:** `instanceId` and one of either `name` or `securityProfileId` is required.
+
+This argument supports the following arguments:
+
+* `securityProfileId` - (Optional) Returns information on a specific Security Profile by Security Profile id
+* `instanceId` - (Required) Reference to the hosting Amazon Connect Instance
+* `name` - (Optional) Returns information on a specific Security Profile by name
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Security Profile.
+* `description` - Description of the Security Profile.
+* `id` - Identifier of the hosting Amazon Connect Instance and identifier of the Security Profile separated by a colon (`:`).
+* `organizationResourceId` - The organization resource identifier for the security profile.
+* `permissions` - List of permissions assigned to the security profile.
+* `tags` - Map of tags to assign to the Security Profile.
+
+<!-- cache-key: cdktf-0.18.0 input-ca6061431d187a32ef698b08c7464880ab9e5cbcb8ba86414cce0d19a1515ff1 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/connect_user.html.markdown b/website/docs/cdktf/typescript/d/connect_user.html.markdown
new file mode 100644
index 00000000000..fc92ca467e8
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/connect_user.html.markdown
@@ -0,0 +1,105 @@
+---
+subcategory: "Connect"
+layout: "aws"
+page_title: "AWS: aws_connect_user"
+description: |-
+  Provides details about a specific Amazon Connect User.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_connect_user
+
+Provides details about a specific Amazon Connect User.
+
+## Example Usage
+
+By `name`
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsConnectUser } from "./.gen/providers/aws/data-aws-connect-user";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsConnectUser(this, "example", {
+      instanceId: "aaaaaaaa-bbbb-cccc-dddd-111111111111",
+      name: "Example",
+    });
+  }
+}
+
+```
+
+By `userId`
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsConnectUser } from "./.gen/providers/aws/data-aws-connect-user";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsConnectUser(this, "example", {
+      instanceId: "aaaaaaaa-bbbb-cccc-dddd-111111111111",
+      userId: "cccccccc-bbbb-cccc-dddd-111111111111",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+~> **NOTE:** `instanceId` and one of either `name` or `userId` is required.
+
+This argument supports the following arguments:
+
+* `instanceId` - (Required) Reference to the hosting Amazon Connect Instance
+* `name` - (Optional) Returns information on a specific User by name
+* `userId` - (Optional) Returns information on a specific User by User id
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the User.
+* `directoryUserId` - The identifier of the user account in the directory used for identity management.
+* `hierarchyGroupId` - The identifier of the hierarchy group for the user.
+* `id` - The identifier of the hosting Amazon Connect Instance and identifier of the User separated by a colon (`:`).
+* `identityInfo` - A block that contains information about the identity of the user. [Documented below](#identity_info).
+* `instanceId` - Specifies the identifier of the hosting Amazon Connect Instance.
+* `phoneConfig` - A block that contains information about the phone settings for the user. [Documented below](#phone_config).
+* `routingProfileId` - The identifier of the routing profile for the user.
+* `securityProfileIds` - A list of identifiers for the security profiles for the user.
+* `tags` - A map of tags to assign to the User.
+
+### `identityInfo`
+
+An `identityInfo` block supports the following attributes:
+
+* `email` - The email address.
+* `firstName` - The first name.
+* `lastName` - The last name.
+
+### `phoneConfig`
+
+A `phoneConfig` block supports the following attributes:
+
+* `afterContactWorkTimeLimit` - The After Call Work (ACW) timeout setting, in seconds.
+* `autoAccept` - When Auto-Accept Call is enabled for an available agent, the agent connects to contacts automatically.
+* `deskPhoneNumber` - The phone number for the user's desk phone.
+* `phoneType` - The phone type. Valid values are `deskPhone` and `softPhone`.
+
+<!-- cache-key: cdktf-0.18.0 input-6533a2d44318a8db1711f9e310a73d30328d1503d85cb50973ba8962241bc227 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/connect_user_hierarchy_group.html.markdown b/website/docs/cdktf/typescript/d/connect_user_hierarchy_group.html.markdown
new file mode 100644
index 00000000000..91b602aba6d
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/connect_user_hierarchy_group.html.markdown
@@ -0,0 +1,97 @@
+---
+subcategory: "Connect"
+layout: "aws"
+page_title: "AWS: aws_connect_user_hierarchy_group"
+description: |-
+  Provides details about a specific Amazon Connect User Hierarchy Group.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_connect_user_hierarchy_group
+
+Provides details about a specific Amazon Connect User Hierarchy Group.
+
+## Example Usage
+
+By `name`
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsConnectUserHierarchyGroup } from "./.gen/providers/aws/data-aws-connect-user-hierarchy-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsConnectUserHierarchyGroup(this, "example", {
+      instanceId: "aaaaaaaa-bbbb-cccc-dddd-111111111111",
+      name: "Example",
+    });
+  }
+}
+
+```
+
+By `hierarchyGroupId`
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsConnectUserHierarchyGroup } from "./.gen/providers/aws/data-aws-connect-user-hierarchy-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsConnectUserHierarchyGroup(this, "example", {
+      hierarchyGroupId: "cccccccc-bbbb-cccc-dddd-111111111111",
+      instanceId: "aaaaaaaa-bbbb-cccc-dddd-111111111111",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+~> **NOTE:** `instanceId` and one of either `name` or `hierarchyGroupId` is required.
+
+This argument supports the following arguments:
+
+* `hierarchyGroupId` - (Optional) Returns information on a specific hierarchy group by hierarchy group id
+* `instanceId` - (Required) Reference to the hosting Amazon Connect Instance
+* `name` - (Optional) Returns information on a specific hierarchy group by name
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the hierarchy group.
+* `hierarchyPath` - Block that contains information about the levels in the hierarchy group. The `hierarchyPath` block is documented below.
+* `levelId` - Identifier of the level in the hierarchy group.
+* `id` - Identifier of the hosting Amazon Connect Instance and identifier of the hierarchy group separated by a colon (`:`).
+* `tags` - Map of tags to assign to the hierarchy group.
+
+A `hierarchyPath` block supports the following attributes:
+
+* `levelOne` - Details of level one. See below.
+* `levelTwo` - Details of level two. See below.
+* `levelThree` - Details of level three. See below.
+* `levelFour` - Details of level four. See below.
+* `levelFive` - Details of level five. See below.
+
+A level block supports the following attributes:
+
+* `arn` -  ARN of the hierarchy group.
+* `id` -  The identifier of the hierarchy group.
+* `name` - Name of the hierarchy group.
+
+<!-- cache-key: cdktf-0.18.0 input-4a65e86f5180790b93c832a3ed14333f7e6e9c245f4c8eef60843f34eedef36c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/connect_user_hierarchy_structure.html.markdown b/website/docs/cdktf/typescript/d/connect_user_hierarchy_structure.html.markdown
new file mode 100644
index 00000000000..8af32c11326
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/connect_user_hierarchy_structure.html.markdown
@@ -0,0 +1,63 @@
+---
+subcategory: "Connect"
+layout: "aws"
+page_title: "AWS: aws_connect_user_hierarchy_structure"
+description: |-
+  Provides details about a specific Amazon Connect User Hierarchy Structure
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_connect_user_hierarchy_structure
+
+Provides details about a specific Amazon Connect User Hierarchy Structure
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsConnectUserHierarchyStructure } from "./.gen/providers/aws/data-aws-connect-user-hierarchy-structure";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsConnectUserHierarchyStructure(this, "test", {
+      instanceId: Token.asString(awsConnectInstanceTest.id),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `instanceId` - (Required) Reference to the hosting Amazon Connect Instance
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `hierarchyStructure` - Block that defines the hierarchy structure's levels. The `hierarchyStructure` block is documented below.
+
+A `hierarchyStructure` block supports the following attributes:
+
+* `levelOne` - Details of level one. See below.
+* `levelTwo` - Details of level two. See below.
+* `levelThree` - Details of level three. See below.
+* `levelFour` - Details of level four. See below.
+* `levelFive` - Details of level five. See below.
+
+Each level block supports the following attributes:
+
+* `arn` -  ARN of the hierarchy level.
+* `id` -  The identifier of the hierarchy level.
+* `name` - Name of the user hierarchy level. Must not be more than 50 characters.
+
+<!-- cache-key: cdktf-0.18.0 input-67c7477b2b97d10d20fdb501a7e53bda8c43d8444a8ca3ea500fed342e44089c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/connect_vocabulary.html.markdown b/website/docs/cdktf/typescript/d/connect_vocabulary.html.markdown
new file mode 100644
index 00000000000..6e6a874dd5d
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/connect_vocabulary.html.markdown
@@ -0,0 +1,88 @@
+---
+subcategory: "Connect"
+layout: "aws"
+page_title: "AWS: aws_connect_vocabulary"
+description: |-
+  Provides details about a specific Amazon Connect Vocabulary.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_connect_vocabulary
+
+Provides details about a specific Amazon Connect Vocabulary.
+
+## Example Usage
+
+By `name`
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsConnectVocabulary } from "./.gen/providers/aws/data-aws-connect-vocabulary";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsConnectVocabulary(this, "example", {
+      instanceId: "aaaaaaaa-bbbb-cccc-dddd-111111111111",
+      name: "Example",
+    });
+  }
+}
+
+```
+
+By `vocabularyId`
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsConnectVocabulary } from "./.gen/providers/aws/data-aws-connect-vocabulary";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsConnectVocabulary(this, "example", {
+      instanceId: "aaaaaaaa-bbbb-cccc-dddd-111111111111",
+      vocabularyId: "cccccccc-bbbb-cccc-dddd-111111111111",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+~> **NOTE:** `instanceId` and one of either `name` or `vocabularyId` is required.
+
+This argument supports the following arguments:
+
+* `instanceId` - (Required) Reference to the hosting Amazon Connect Instance
+* `name` - (Optional) Returns information on a specific Vocabulary by name
+* `vocabularyId` - (Optional) Returns information on a specific Vocabulary by Vocabulary id
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the Vocabulary.
+* `content` - The content of the custom vocabulary in plain-text format with a table of values. Each row in the table represents a word or a phrase, described with Phrase, IPA, SoundsLike, and DisplayAs fields. Separate the fields with TAB characters. For more information, see [Create a custom vocabulary using a table](https://docs.aws.amazon.com/transcribe/latest/dg/custom-vocabulary.html#create-vocabulary-table).
+* `failureReason` - The reason why the custom vocabulary was not created.
+* `id` - The identifier of the hosting Amazon Connect Instance and identifier of the vocabulary
+separated by a colon (`:`).
+* `languageCode` - The language code of the vocabulary entries. For a list of languages and their corresponding language codes, see [What is Amazon Transcribe?](https://docs.aws.amazon.com/transcribe/latest/dg/transcribe-whatis.html). Valid Values are `arAe`, `deCh`, `deDe`, `enAb`, `enAu`, `enGb`, `enIe`, `enIn`, `enUs`, `enWl`, `esEs`, `esUs`, `frCa`, `frFr`, `hiIn`, `itIt`, `jaJp`, `koKr`, `ptBr`, `ptPt`, `zhCn`.
+* `lastModifiedTime` - The timestamp when the custom vocabulary was last modified.
+* `state` - The current state of the custom vocabulary. Valid values are `creationInProgress`, `active`, `creationFailed`, `deleteInProgress`.
+* `tags` - A map of tags to assign to the Vocabulary.
+* `vocabularyId` - The identifier of the custom vocabulary.
+
+<!-- cache-key: cdktf-0.18.0 input-28dff9533e7ed6f8274af7c06c44ac3737d4ee8b41560fc884b0ffe019a6221f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/controltower_controls.html.markdown b/website/docs/cdktf/typescript/d/controltower_controls.html.markdown
new file mode 100644
index 00000000000..612952f27eb
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/controltower_controls.html.markdown
@@ -0,0 +1,71 @@
+---
+subcategory: "Control Tower"
+layout: "aws"
+page_title: "AWS: aws_controltower_controls"
+description: |-
+  List of Control Tower controls applied to an OU.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_controltower_controls
+
+List of Control Tower controls applied to an OU.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsControltowerControls } from "./.gen/providers/aws/data-aws-controltower-controls";
+import { DataAwsOrganizationsOrganization } from "./.gen/providers/aws/data-aws-organizations-organization";
+import { DataAwsOrganizationsOrganizationalUnits } from "./.gen/providers/aws/data-aws-organizations-organizational-units";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const thisVar = new DataAwsOrganizationsOrganization(this, "this", {});
+    const dataAwsOrganizationsOrganizationalUnitsThis =
+      new DataAwsOrganizationsOrganizationalUnits(this, "this_1", {
+        parentId: Token.asString(Fn.lookupNested(thisVar.roots, ["0", "id"])),
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsOrganizationsOrganizationalUnitsThis.overrideLogicalId("this");
+    const dataAwsControltowerControlsThis = new DataAwsControltowerControls(
+      this,
+      "this_2",
+      {
+        targetIdentifier: Token.asString(
+          Fn.lookupNested(
+            "${[ for x in ${" +
+              dataAwsOrganizationsOrganizationalUnitsThis.children +
+              '} : x.arn if x.name == "Security"]}',
+            ["0"]
+          )
+        ),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsControltowerControlsThis.overrideLogicalId("this");
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `targetIdentifier` - (Required) The ARN of the organizational unit.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `enabledControls` - List of all the ARNs for the controls applied to the `targetIdentifier`.
+
+<!-- cache-key: cdktf-0.18.0 input-5d64cbccc4ebc5f5b040cdf645dfc1895e2df0f54863b642aeb0024d4372f827 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/cur_report_definition.html.markdown b/website/docs/cdktf/typescript/d/cur_report_definition.html.markdown
new file mode 100644
index 00000000000..159e04180c6
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/cur_report_definition.html.markdown
@@ -0,0 +1,62 @@
+---
+subcategory: "Cost and Usage Report"
+layout: "aws"
+page_title: "AWS: aws_cur_report_definition"
+description: |-
+  Get information on an AWS Cost and Usage Report Definition.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_cur_report_definition
+
+Use this data source to get information on an AWS Cost and Usage Report Definition.
+
+~> *NOTE:* The AWS Cost and Usage Report service is only available in `usEast1` currently.
+
+~> *NOTE:* If AWS Organizations is enabled, only the master account can use this resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCurReportDefinition } from "./.gen/providers/aws/data-aws-cur-report-definition";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsCurReportDefinition(this, "report_definition", {
+      reportName: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `reportName` - (Required) Name of the report definition to match.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `timeUnit` - Frequency on which report data are measured and displayed.
+* `format` - Preferred compression format for report.
+* `compression` - Preferred format for report.
+* `additionalSchemaElements` - A list of schema elements.
+* `s3Bucket` - Name of customer S3 bucket.
+* `s3Prefix` - Preferred report path prefix.
+* `s3Region` - Region of customer S3 bucket.
+* `additionalArtifacts` - A list of additional artifacts.
+* `refreshClosedReports` - If true reports are updated after they have been finalized.
+* `reportVersioning` - Overwrite the previous version of each report or to deliver the report in addition to the previous versions.
+
+<!-- cache-key: cdktf-0.18.0 input-7c41a2bcbec1b1838d1888c217040322a9f0e0110b3b20e4772db0809292f796 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/customer_gateway.html.markdown b/website/docs/cdktf/typescript/d/customer_gateway.html.markdown
new file mode 100644
index 00000000000..5346ccf8eb7
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/customer_gateway.html.markdown
@@ -0,0 +1,81 @@
+---
+subcategory: "VPN (Site-to-Site)"
+layout: "aws"
+page_title: "AWS: aws_customer_gateway"
+description: |-
+  Get an existing AWS Customer Gateway.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_customer_gateway
+
+Get an existing AWS Customer Gateway.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCustomerGateway } from "./.gen/providers/aws/data-aws-customer-gateway";
+import { VpnConnection } from "./.gen/providers/aws/vpn-connection";
+import { VpnGateway } from "./.gen/providers/aws/vpn-gateway";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const main = new VpnGateway(this, "main", {
+      amazonSideAsn: Token.asString(7224),
+      vpcId: Token.asString(awsVpcMain.id),
+    });
+    const foo = new DataAwsCustomerGateway(this, "foo", {
+      filter: [
+        {
+          name: "tag:Name",
+          values: ["foo-prod"],
+        },
+      ],
+    });
+    new VpnConnection(this, "transit", {
+      customerGatewayId: Token.asString(foo.id),
+      staticRoutesOnly: false,
+      type: Token.asString(foo.type),
+      vpnGatewayId: main.id,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `id` - (Optional) ID of the gateway.
+* `filter` - (Optional) One or more [name-value pairs][dcg-filters] to filter by.
+
+[dcg-filters]: https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeCustomerGateways.html
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the customer gateway.
+* `bgpAsn` - Gateway's Border Gateway Protocol (BGP) Autonomous System Number (ASN).
+* `certificateArn` - ARN for the customer gateway certificate.
+* `deviceName` - Name for the customer gateway device.
+* `ipAddress` - IP address of the gateway's Internet-routable external interface.
+* `tags` - Map of key-value pairs assigned to the gateway.
+* `type` - Type of customer gateway. The only type AWS supports at this time is "ipsec.1".
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `20M`)
+
+<!-- cache-key: cdktf-0.18.0 input-e72280e509c2817731cdebdb6406a3889d39f235f042905746f02db00e556305 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/datapipeline_pipeline.html.markdown b/website/docs/cdktf/typescript/d/datapipeline_pipeline.html.markdown
new file mode 100644
index 00000000000..18c2ca4cd3d
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/datapipeline_pipeline.html.markdown
@@ -0,0 +1,51 @@
+---
+subcategory: "Data Pipeline"
+layout: "aws"
+page_title: "AWS: aws_datapipeline_pipeline"
+description: |-
+  Provides details about a specific DataPipeline.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Source: aws_datapipeline_pipeline
+
+Provides details about a specific DataPipeline Pipeline.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsDatapipelinePipeline } from "./.gen/providers/aws/data-aws-datapipeline-pipeline";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsDatapipelinePipeline(this, "example", {
+      pipelineId: "pipelineID",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `pipelineId` - (Required) ID of the pipeline.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `name` - Name of Pipeline.
+* `description` - Description of Pipeline.
+* `tags` - Map of tags assigned to the resource.
+
+<!-- cache-key: cdktf-0.18.0 input-0154aec5cfe5e0d42b7c7722943a7cf0f57208c6d4b146fcddb0cb3fda0c9cc9 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/datapipeline_pipeline_definition.html.markdown b/website/docs/cdktf/typescript/d/datapipeline_pipeline_definition.html.markdown
new file mode 100644
index 00000000000..ef21c2904fa
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/datapipeline_pipeline_definition.html.markdown
@@ -0,0 +1,78 @@
+---
+subcategory: "Data Pipeline"
+layout: "aws"
+page_title: "AWS: aws_datapipeline_pipeline_definition"
+description: |-
+  Provides details about a specific DataPipeline Definition.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Source: aws_datapipeline_pipeline_definition
+
+Provides details about a specific DataPipeline Pipeline Definition.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsDatapipelinePipelineDefinition } from "./.gen/providers/aws/data-aws-datapipeline-pipeline-definition";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsDatapipelinePipelineDefinition(this, "example", {
+      pipelineId: "pipelineID",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `pipelineId` - (Required) ID of the pipeline.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `parameterObject` - Parameter objects used in the pipeline definition. See below
+* `parameterValue` - Parameter values used in the pipeline definition. See below
+* `pipelineObject` - Objects defined in the pipeline. See below
+
+### `parameterObject`
+
+* `attributes` - Attributes of the parameter object. See below
+* `id` - ID of the parameter object.
+
+### `attributes`
+
+* `key` - Field identifier.
+* `stringValue` - Field value, expressed as a String.
+
+### `parameterValue`
+
+* `id` - ID of the parameter value.
+* `stringValue` - Field value, expressed as a String.
+
+### `pipelineObject`
+
+* `field` - Key-value pairs that define the properties of the object. See below
+* `id` - ID of the object.
+* `name` - ARN of the storage connector.
+
+### `field`
+
+* `key` - Field identifier.
+* `refValue` - Field value, expressed as the identifier of another object
+* `stringValue` - Field value, expressed as a String.
+
+<!-- cache-key: cdktf-0.18.0 input-75cbddaa4bd420bfb5a031b922347a505b58350e72121e00d8808da4c3ad03ca -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/db_cluster_snapshot.html.markdown b/website/docs/cdktf/typescript/d/db_cluster_snapshot.html.markdown
new file mode 100644
index 00000000000..43a2b6a02ad
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/db_cluster_snapshot.html.markdown
@@ -0,0 +1,111 @@
+---
+subcategory: "RDS (Relational Database)"
+layout: "aws"
+page_title: "AWS: aws_db_cluster_snapshot"
+description: |-
+  Get information on a DB Cluster Snapshot.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_db_cluster_snapshot
+
+Use this data source to get information about a DB Cluster Snapshot for use when provisioning DB clusters.
+
+~> **NOTE:** This data source does not apply to snapshots created on DB Instances.
+See the [`awsDbSnapshot` data source](/docs/providers/aws/d/db_snapshot.html) for DB Instance snapshots.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsDbClusterSnapshot } from "./.gen/providers/aws/data-aws-db-cluster-snapshot";
+import { RdsCluster } from "./.gen/providers/aws/rds-cluster";
+import { RdsClusterInstance } from "./.gen/providers/aws/rds-cluster-instance";
+interface MyConfig {
+  engine: any;
+  engine1: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    const developmentFinalSnapshot = new DataAwsDbClusterSnapshot(
+      this,
+      "development_final_snapshot",
+      {
+        dbClusterIdentifier: "development_cluster",
+        mostRecent: true,
+      }
+    );
+    const aurora = new RdsCluster(this, "aurora", {
+      clusterIdentifier: "development_cluster",
+      dbSubnetGroupName: "my_db_subnet_group",
+      lifecycle: {
+        ignoreChanges: [snapshotIdentifier],
+      },
+      snapshotIdentifier: Token.asString(developmentFinalSnapshot.id),
+      engine: config.engine,
+    });
+    const awsRdsClusterInstanceAurora = new RdsClusterInstance(
+      this,
+      "aurora_2",
+      {
+        clusterIdentifier: aurora.id,
+        dbSubnetGroupName: "my_db_subnet_group",
+        instanceClass: "db.t2.small",
+        engine: config.engine1,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsRdsClusterInstanceAurora.overrideLogicalId("aurora");
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `mostRecent` - (Optional) If more than one result is returned, use the most recent Snapshot.
+* `dbClusterIdentifier` - (Optional) Returns the list of snapshots created by the specific db_cluster
+* `dbClusterSnapshotIdentifier` - (Optional) Returns information on a specific snapshot_id.
+* `snapshotType` - (Optional) Type of snapshots to be returned. If you don't specify a SnapshotType
+value, then both automated and manual DB cluster snapshots are returned. Shared and public DB Cluster Snapshots are not
+included in the returned results by default. Possible values are, `automated`, `manual`, `shared`, `public` and `awsbackup`.
+* `includeShared` - (Optional) Set this value to true to include shared manual DB Cluster Snapshots from other
+AWS accounts that this AWS account has been given permission to copy or restore, otherwise set this value to false.
+The default is `false`.
+* `includePublic` - (Optional) Set this value to true to include manual DB Cluster Snapshots that are public and can be
+copied or restored by any AWS account, otherwise set this value to false. The default is `false`.
+* `tags` - (Optional) Mapping of tags, each pair of which must exactly match
+  a pair on the desired DB cluster snapshot.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `allocatedStorage` - Allocated storage size in gigabytes (GB).
+* `availabilityZones` - List of EC2 Availability Zones that instances in the DB cluster snapshot can be restored in.
+* `dbClusterIdentifier` - Specifies the DB cluster identifier of the DB cluster that this DB cluster snapshot was created from.
+* `dbClusterSnapshotArn` - The ARN for the DB Cluster Snapshot.
+* `engineVersion` - Version of the database engine for this DB cluster snapshot.
+* `engine` - Name of the database engine.
+* `id` - Snapshot ID.
+* `kmsKeyId` - If storage_encrypted is true, the AWS KMS key identifier for the encrypted DB cluster snapshot.
+* `licenseModel` - License model information for the restored DB cluster.
+* `port` - Port that the DB cluster was listening on at the time of the snapshot.
+* `snapshotCreateTime` - Time when the snapshot was taken, in Universal Coordinated Time (UTC).
+* `sourceDbClusterSnapshotIdentifier` - DB Cluster Snapshot ARN that the DB Cluster Snapshot was copied from. It only has value in case of cross customer or cross region copy.
+* `status` - Status of this DB Cluster Snapshot.
+* `storageEncrypted` - Whether the DB cluster snapshot is encrypted.
+* `vpcId` - VPC ID associated with the DB cluster snapshot.
+* `tags` - Map of tags for the resource.
+
+<!-- cache-key: cdktf-0.18.0 input-a5847b6b7894b8bc81d561012d77e63802b11d4802ee1f24e4c51067e98ce60e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/db_event_categories.html.markdown b/website/docs/cdktf/typescript/d/db_event_categories.html.markdown
new file mode 100644
index 00000000000..9710760bd26
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/db_event_categories.html.markdown
@@ -0,0 +1,80 @@
+---
+subcategory: "RDS (Relational Database)"
+layout: "aws"
+page_title: "AWS: aws_db_event_categories"
+description: |-
+    Provides a list of DB Event Categories which can be used to pass values into DB Event Subscription.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_db_event_categories
+
+## Example Usage
+
+List the event categories of all the RDS resources.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformOutput, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsDbEventCategories } from "./.gen/providers/aws/data-aws-db-event-categories";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new DataAwsDbEventCategories(this, "example", {});
+    const cdktfTerraformOutputExample = new TerraformOutput(this, "example_1", {
+      value: example.eventCategories,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    cdktfTerraformOutputExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+List the event categories specific to the RDS resource `dbSnapshot`.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformOutput, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsDbEventCategories } from "./.gen/providers/aws/data-aws-db-event-categories";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new DataAwsDbEventCategories(this, "example", {
+      sourceType: "db-snapshot",
+    });
+    const cdktfTerraformOutputExample = new TerraformOutput(this, "example_1", {
+      value: example.eventCategories,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    cdktfTerraformOutputExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `sourceType` - (Optional) Type of source that will be generating the events. Valid options are db-instance, db-security-group, db-parameter-group, db-snapshot, db-cluster or db-cluster-snapshot.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `eventCategories` - List of the event categories.
+* `id` - Region of the event categories.
+
+<!-- cache-key: cdktf-0.18.0 input-d1d5b27d77d80317092ac76176fc6ee08cb96d448e528e2d6bdc53e0d6fff300 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/db_instance.html.markdown b/website/docs/cdktf/typescript/d/db_instance.html.markdown
new file mode 100644
index 00000000000..acf8f50d2c2
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/db_instance.html.markdown
@@ -0,0 +1,99 @@
+---
+subcategory: "RDS (Relational Database)"
+layout: "aws"
+page_title: "AWS: aws_db_instance"
+description: |-
+  Get information on an RDS Database Instance.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_db_instance
+
+Use this data source to get information about an RDS instance
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsDbInstance } from "./.gen/providers/aws/data-aws-db-instance";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsDbInstance(this, "database", {
+      dbInstanceIdentifier: "my-test-database",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `dbInstanceIdentifier` - (Optional) Name of the RDS instance.
+* `tags` - (Optional) Map of tags, each pair of which must exactly match a pair on the desired instance.
+
+## Attribute Reference
+
+~> **NOTE:** The `port` field may be empty while an Aurora cluster is still in the process of being created. This can occur if the cluster was initiated with the [AWS CLI `createDbCluster`](https://docs.aws.amazon.com/cli/latest/reference/rds/create-db-cluster.html) command, but no DB instance has yet been added to it.
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `address` - Hostname of the RDS instance. See also `endpoint` and `port`.
+* `allocatedStorage` - Allocated storage size specified in gigabytes.
+* `autoMinorVersionUpgrade` - Indicates that minor version patches are applied automatically.
+* `availabilityZone` - Name of the Availability Zone the DB instance is located in.
+* `backupRetentionPeriod` - Specifies the number of days for which automatic DB snapshots are retained.
+* `dbClusterIdentifier` - If the DB instance is a member of a DB cluster, contains the name of the DB cluster that the DB instance is a member of.
+* `dbInstanceArn` - ARN for the DB instance.
+* `dbInstanceClass` - Contains the name of the compute and memory capacity class of the DB instance.
+* `dbName` - Contains the name of the initial database of this instance that was provided at create time, if one was specified when the DB instance was created. This same name is returned for the life of the DB instance.
+* `dbParameterGroups` - Provides the list of DB parameter groups applied to this DB instance.
+* `dbSubnetGroup` - Name of the subnet group associated with the DB instance.
+* `dbInstancePort` - Port that the DB instance listens on.
+* `enabledCloudwatchLogsExports` - List of log types to export to cloudwatch.
+* `endpoint` - Connection endpoint in `address:port` format.
+* `engine` - Provides the name of the database engine to be used for this DB instance.
+* `engineVersion` - Database engine version.
+* `hostedZoneId` - Canonical hosted zone ID of the DB instance (to be used in a Route 53 Alias record).
+* `iops` - Provisioned IOPS (I/O operations per second) value.
+* `kmsKeyId` - If StorageEncrypted is true, the KMS key identifier for the encrypted DB instance.
+* `licenseModel` - License model information for this DB instance.
+* `masterUsername` - Contains the master username for the DB instance.
+* `masterUserSecret` - Provides the master user secret. Only available when `manageMasterUserPassword` is set to true. [Documented below](#master_user_secret).
+* `maxAllocatedStorage` - The upper limit to which Amazon RDS can automatically scale the storage of the DB instance.
+* `monitoringInterval` - Interval, in seconds, between points when Enhanced Monitoring metrics are collected for the DB instance.
+* `monitoringRoleArn` - ARN for the IAM role that permits RDS to send Enhanced Monitoring metrics to CloudWatch Logs.
+* `multiAz` - If the DB instance is a Multi-AZ deployment.
+* `networkType` - Network type of the DB instance.
+* `optionGroupMemberships` - Provides the list of option group memberships for this DB instance.
+* `port` - Database endpoint port, primarily used by an Aurora DB cluster. For a conventional RDS DB instance, the `dbInstancePort` is typically the preferred choice.
+* `preferredBackupWindow` - Specifies the daily time range during which automated backups are created.
+* `preferredMaintenanceWindow` -  Specifies the weekly time range during which system maintenance can occur in UTC.
+* `publiclyAccessible` - Accessibility options for the DB instance.
+* `resourceId` - RDS Resource ID of this instance.
+* `storageEncrypted` - Whether the DB instance is encrypted.
+* `storageThroughput` - Storage throughput value for the DB instance.
+* `storageType` - Storage type associated with DB instance.
+* `timezone` - Time zone of the DB instance.
+* `vpcSecurityGroups` - Provides a list of VPC security group elements that the DB instance belongs to.
+* `replicateSourceDb` - Identifier of the source DB that this is a replica of.
+* `caCertIdentifier` - Identifier of the CA certificate for the DB instance.
+
+### master_user_secret
+
+The `masterUserSecret` configuration block supports the following attributes:
+
+* `kmsKeyId` - The Amazon Web Services KMS key identifier that is used to encrypt the secret.
+* `secretArn` - The Amazon Resource Name (ARN) of the secret.
+* `secretStatus` - The status of the secret. Valid Values: `creating` | `active` | `rotating` | `impaired`.
+
+<!-- cache-key: cdktf-0.18.0 input-156ff5865fbb8f8d95843d45c98755bb49f6b9ca52d29fab4979c7c7d124577a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/db_instances.html.markdown b/website/docs/cdktf/typescript/d/db_instances.html.markdown
new file mode 100644
index 00000000000..2f6b2c89aae
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/db_instances.html.markdown
@@ -0,0 +1,89 @@
+---
+subcategory: "RDS (Relational Database)"
+layout: "aws"
+page_title: "AWS: aws_db_instances"
+description: |-
+  Terraform data source for listing RDS Database Instances.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_db_instances
+
+Terraform data source for listing RDS Database Instances.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsDbInstances } from "./.gen/providers/aws/data-aws-db-instances";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsDbInstances(this, "example", {
+      filter: [
+        {
+          name: "db-instance-id",
+          values: ["my-database-id"],
+        },
+      ],
+    });
+  }
+}
+
+```
+
+### Using tags
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsDbInstances } from "./.gen/providers/aws/data-aws-db-instances";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsDbInstances(this, "example", {
+      tags: {
+        Env: "test",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are optional:
+
+* `filter` - (Optional) Configuration block(s) used to filter instances with AWS supported attributes, such as `engine`, `dbClusterId` or `dbInstanceId` for example. Detailed below.
+* `tags` - (Optional) Map of tags, each pair of which must exactly match a pair on the desired instances.
+
+### filter Configuration block
+
+The `filter` configuration block supports the following arguments:
+
+* `name` - (Required) Name of the filter field. Valid values can be found in the [RDS DescribeDBClusters API Reference](https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeDBClusters.html) or [RDS DescribeDBInstances API Reference](https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeDBInstances.html).
+* `values` - (Required) Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `instanceArns` - ARNs of the matched RDS instances.
+* `instanceIdentifiers` - Identifiers of the matched RDS instances.
+
+<!-- cache-key: cdktf-0.18.0 input-759327832e7c9698cbc6e9a3c77063f37e9ca19af1429332b64a60ca9d471f64 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/db_proxy.html.markdown b/website/docs/cdktf/typescript/d/db_proxy.html.markdown
new file mode 100644
index 00000000000..a7a976081b7
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/db_proxy.html.markdown
@@ -0,0 +1,59 @@
+---
+subcategory: "RDS (Relational Database)"
+layout: "aws"
+page_title: "AWS: aws_db_proxy"
+description: |-
+  Get information on a DB Proxy.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_db_proxy
+
+Use this data source to get information about a DB Proxy.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsDbProxy } from "./.gen/providers/aws/data-aws-db-proxy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsDbProxy(this, "proxy", {
+      name: "my-test-db-proxy",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name of the DB proxy.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the DB Proxy.
+* `auth` - Configuration(s) with authorization mechanisms to connect to the associated instance or cluster.
+* `debugLogging` - Whether the proxy includes detailed information about SQL statements in its logs.
+* `endpoint` - Endpoint that you can use to connect to the DB proxy.
+* `engineFamily` - Kinds of databases that the proxy can connect to.
+* `idleClientTimeout` - Number of seconds a connection to the proxy can have no activity before the proxy drops the client connection.
+* `requireTls` - Whether Transport Layer Security (TLS) encryption is required for connections to the proxy.
+* `roleArn` - ARN for the IAM role that the proxy uses to access Amazon Secrets Manager.
+* `vpcId` - Provides the VPC ID of the DB proxy.
+* `vpcSecurityGroupIds` - Provides a list of VPC security groups that the proxy belongs to.
+* `vpcSubnetIds` - EC2 subnet IDs for the proxy.
+
+<!-- cache-key: cdktf-0.18.0 input-40613dad61f863b46258986380665de6148f37458b6c3dc04b218f3d733ebd72 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/db_snapshot.html.markdown b/website/docs/cdktf/typescript/d/db_snapshot.html.markdown
new file mode 100644
index 00000000000..6a430148efa
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/db_snapshot.html.markdown
@@ -0,0 +1,108 @@
+---
+subcategory: "RDS (Relational Database)"
+layout: "aws"
+page_title: "AWS: aws_db_snapshot"
+description: |-
+  Get information on a DB Snapshot.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_db_snapshot
+
+Use this data source to get information about a DB Snapshot for use when provisioning DB instances
+
+~> **NOTE:** This data source does not apply to snapshots created on Aurora DB clusters.
+See the [`awsDbClusterSnapshot` data source](/docs/providers/aws/d/db_cluster_snapshot.html) for DB Cluster snapshots.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsDbSnapshot } from "./.gen/providers/aws/data-aws-db-snapshot";
+import { DbInstance } from "./.gen/providers/aws/db-instance";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const prod = new DbInstance(this, "prod", {
+      allocatedStorage: 10,
+      dbName: "mydb",
+      dbSubnetGroupName: "my_database_subnet_group",
+      engine: "mysql",
+      engineVersion: "5.6.17",
+      instanceClass: "db.t2.micro",
+      parameterGroupName: "default.mysql5.6",
+      password: "bar",
+      username: "foo",
+    });
+    const latestProdSnapshot = new DataAwsDbSnapshot(
+      this,
+      "latest_prod_snapshot",
+      {
+        dbInstanceIdentifier: prod.identifier,
+        mostRecent: true,
+      }
+    );
+    new DbInstance(this, "dev", {
+      dbName: "mydbdev",
+      instanceClass: "db.t2.micro",
+      lifecycle: {
+        ignoreChanges: [snapshotIdentifier],
+      },
+      snapshotIdentifier: Token.asString(latestProdSnapshot.id),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+~> **NOTE:** One of either `dbInstanceIdentifier` or `dbSnapshotIdentifier` is required.
+
+This argument supports the following arguments:
+
+* `mostRecent` - (Optional) If more than one result is returned, use the most
+recent Snapshot.
+* `dbInstanceIdentifier` - (Optional) Returns the list of snapshots created by the specific db_instance
+* `dbSnapshotIdentifier` - (Optional) Returns information on a specific snapshot_id.
+* `snapshotType` - (Optional) Type of snapshots to be returned. If you don't specify a SnapshotType
+value, then both automated and manual snapshots are returned. Shared and public DB snapshots are not
+included in the returned results by default. Possible values are, `automated`, `manual`, `shared`, `public` and `awsbackup`.
+* `includeShared` - (Optional) Set this value to true to include shared manual DB snapshots from other
+AWS accounts that this AWS account has been given permission to copy or restore, otherwise set this value to false.
+The default is `false`.
+* `includePublic` - (Optional) Set this value to true to include manual DB snapshots that are public and can be
+copied or restored by any AWS account, otherwise set this value to false. The default is `false`.
+`tags` - (Optional) Mapping of tags, each pair of which must exactly match
+  a pair on the desired DB snapshot.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - Snapshot ID.
+* `allocatedStorage` - Allocated storage size in gigabytes (GB).
+* `availabilityZone` - Name of the Availability Zone the DB instance was located in at the time of the DB snapshot.
+* `dbSnapshotArn` - ARN for the DB snapshot.
+* `encrypted` - Whether the DB snapshot is encrypted.
+* `engine` - Name of the database engine.
+* `engineVersion` - Version of the database engine.
+* `iops` - Provisioned IOPS (I/O operations per second) value of the DB instance at the time of the snapshot.
+* `kmsKeyId` - ARN for the KMS encryption key.
+* `licenseModel` - License model information for the restored DB instance.
+* `optionGroupName` - Provides the option group name for the DB snapshot.
+* `sourceDbSnapshotIdentifier` - DB snapshot ARN that the DB snapshot was copied from. It only has value in case of cross customer or cross region copy.
+* `sourceRegion` - Region that the DB snapshot was created in or copied from.
+* `status` - Status of this DB snapshot.
+* `storageType` - Storage type associated with DB snapshot.
+* `vpcId` - ID of the VPC associated with the DB snapshot.
+* `snapshotCreateTime` - Provides the time when the snapshot was taken, in Universal Coordinated Time (UTC).
+
+<!-- cache-key: cdktf-0.18.0 input-453c07311432431ff619a675fedc77cdb7b11651f38957e4c10480c9e5d7bb31 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/db_subnet_group.html.markdown b/website/docs/cdktf/typescript/d/db_subnet_group.html.markdown
new file mode 100644
index 00000000000..6bbdcf9be6c
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/db_subnet_group.html.markdown
@@ -0,0 +1,54 @@
+---
+subcategory: "RDS (Relational Database)"
+layout: "aws"
+page_title: "AWS: aws_db_subnet_group"
+description: |-
+  Get information on an RDS Database Subnet Group.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_db_subnet_group
+
+Use this data source to get information about an RDS subnet group.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsDbSubnetGroup } from "./.gen/providers/aws/data-aws-db-subnet-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsDbSubnetGroup(this, "database", {
+      name: "my-test-database-subnet-group",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name of the RDS database subnet group.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN for the DB subnet group.
+* `description` - Provides the description of the DB subnet group.
+* `status` - Provides the status of the DB subnet group.
+* `subnetIds` - Contains a list of subnet identifiers.
+* `supportedNetworkTypes` - The network type of the DB subnet group.
+* `vpcId` - Provides the VPC ID of the DB subnet group.
+
+<!-- cache-key: cdktf-0.18.0 input-c8c709e17391d65123c921a8b10fb4fd4c29d0c36a2dcc845c526ef3b4b3fda7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/default_tags.html.markdown b/website/docs/cdktf/typescript/d/default_tags.html.markdown
new file mode 100644
index 00000000000..ae37233624d
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/default_tags.html.markdown
@@ -0,0 +1,108 @@
+---
+subcategory: "Meta Data Sources"
+layout: "aws"
+page_title: "AWS: aws_default_tags"
+description: |-
+  Access the default tags configured on the provider.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_default_tags
+
+Use this data source to get the default tags configured on the provider.
+
+With this data source, you can apply default tags to resources not _directly_ managed by a Terraform resource, such as the instances underneath an Auto Scaling group or the volumes created for an EC2 instance.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsDefaultTags } from "./.gen/providers/aws/data-aws-default-tags";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsDefaultTags(this, "example", {});
+  }
+}
+
+```
+
+### Dynamically Apply Default Tags to Auto Scaling Group
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformIterator, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AutoscalingGroup } from "./.gen/providers/aws/autoscaling-group";
+import { DataAwsDefaultTags } from "./.gen/providers/aws/data-aws-default-tags";
+import { AwsProvider } from "./.gen/providers/aws/provider";
+interface MyConfig {
+  maxSize: any;
+  minSize: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new AwsProvider(this, "aws", {
+      defaultTags: [
+        {
+          tags: {
+            Environment: "Test",
+            Name: "Provider Tag",
+          },
+        },
+      ],
+    });
+    const example = new DataAwsDefaultTags(this, "example", {});
+    /*In most cases loops should be handled in the programming language context and 
+    not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+    you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+    you need to keep this like it is.*/
+    const exampleDynamicIterator0 = TerraformIterator.fromList(
+      Token.asAny(example.tags)
+    );
+    const awsAutoscalingGroupExample = new AutoscalingGroup(this, "example_2", {
+      tag: exampleDynamicIterator0.dynamic({
+        key: exampleDynamicIterator0.key,
+        propagate_at_launch: true,
+        value: exampleDynamicIterator0.value,
+      }),
+      maxSize: config.maxSize,
+      minSize: config.minSize,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsAutoscalingGroupExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source has no arguments.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `tags` - Blocks of default tags set on the provider. See details below.
+
+### tags
+
+* `key` - Key name of the tag (i.e., `tags.#Key`).
+* `value` - Value of the tag (i.e., `tags.#Value`).
+
+<!-- cache-key: cdktf-0.18.0 input-4241b507ba8cc2f145c5ca347d447ee201ff9625e2d883dc7fc4ea765952c336 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/default_tags.markdown b/website/docs/cdktf/typescript/d/default_tags.markdown
new file mode 100644
index 00000000000..ae37233624d
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/default_tags.markdown
@@ -0,0 +1,108 @@
+---
+subcategory: "Meta Data Sources"
+layout: "aws"
+page_title: "AWS: aws_default_tags"
+description: |-
+  Access the default tags configured on the provider.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_default_tags
+
+Use this data source to get the default tags configured on the provider.
+
+With this data source, you can apply default tags to resources not _directly_ managed by a Terraform resource, such as the instances underneath an Auto Scaling group or the volumes created for an EC2 instance.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsDefaultTags } from "./.gen/providers/aws/data-aws-default-tags";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsDefaultTags(this, "example", {});
+  }
+}
+
+```
+
+### Dynamically Apply Default Tags to Auto Scaling Group
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformIterator, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AutoscalingGroup } from "./.gen/providers/aws/autoscaling-group";
+import { DataAwsDefaultTags } from "./.gen/providers/aws/data-aws-default-tags";
+import { AwsProvider } from "./.gen/providers/aws/provider";
+interface MyConfig {
+  maxSize: any;
+  minSize: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new AwsProvider(this, "aws", {
+      defaultTags: [
+        {
+          tags: {
+            Environment: "Test",
+            Name: "Provider Tag",
+          },
+        },
+      ],
+    });
+    const example = new DataAwsDefaultTags(this, "example", {});
+    /*In most cases loops should be handled in the programming language context and 
+    not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+    you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+    you need to keep this like it is.*/
+    const exampleDynamicIterator0 = TerraformIterator.fromList(
+      Token.asAny(example.tags)
+    );
+    const awsAutoscalingGroupExample = new AutoscalingGroup(this, "example_2", {
+      tag: exampleDynamicIterator0.dynamic({
+        key: exampleDynamicIterator0.key,
+        propagate_at_launch: true,
+        value: exampleDynamicIterator0.value,
+      }),
+      maxSize: config.maxSize,
+      minSize: config.minSize,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsAutoscalingGroupExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source has no arguments.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `tags` - Blocks of default tags set on the provider. See details below.
+
+### tags
+
+* `key` - Key name of the tag (i.e., `tags.#Key`).
+* `value` - Value of the tag (i.e., `tags.#Value`).
+
+<!-- cache-key: cdktf-0.18.0 input-4241b507ba8cc2f145c5ca347d447ee201ff9625e2d883dc7fc4ea765952c336 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/directory_service_directory.html.markdown b/website/docs/cdktf/typescript/d/directory_service_directory.html.markdown
new file mode 100644
index 00000000000..6f8416ceea0
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/directory_service_directory.html.markdown
@@ -0,0 +1,82 @@
+---
+subcategory: "Directory Service"
+layout: "aws"
+page_title: "AWS: aws_directory_service_directory"
+description: |-
+  AWS Directory Service Directory
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_directory_service_directory
+
+Get attributes of AWS Directory Service directory (SimpleAD, Managed AD, AD Connector). It's especially useful to refer AWS Managed AD or on-premise AD in AD Connector configuration.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsDirectoryServiceDirectory } from "./.gen/providers/aws/data-aws-directory-service-directory";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsDirectoryServiceDirectory(this, "example", {
+      directoryId: main.id,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `directoryId` - (Required) ID of the directory.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `type` - Directory type (`simpleAd`, `adConnector` or `microsoftAd`).
+* `edition` - (for `microsoftAd`) Microsoft AD edition (`standard` or `enterprise`).
+* `name` - Fully qualified name for the directory/connector.
+* `password` - Password for the directory administrator or connector user.
+* `size` - (for `simpleAd` and `adConnector`) Size of the directory/connector (`small` or `large`).
+* `alias` - Alias for the directory/connector, such as `d991708B282AwsappsCom`.
+* `description` - Textual description for the directory/connector.
+* `shortName` - Short name of the directory/connector, such as `corp`.
+* `enableSso` - Directory/connector single-sign on status.
+* `accessUrl` - Access URL for the directory/connector, such as http://alias.awsapps.com.
+* `dnsIpAddresses` - List of IP addresses of the DNS servers for the directory/connector.
+* `securityGroupId` - ID of the security group created by the directory/connector.
+* `tags` – A map of tags assigned to the directory/connector.
+
+ `vpcSettings` (for `simpleAd` and `microsoftAd`) is also exported with the following attributes:
+
+* `subnetIds` - Identifiers of the subnets for the directory servers (2 subnets in 2 different AZs).
+* `vpcId` - ID of the VPC that the directory is in.
+
+`connectSettings` (for `adConnector`) is also exported with the following attributes:
+
+* `connectIps` - IP addresses of the AD Connector servers.
+* `customerUsername` - Username corresponding to the password provided.
+* `customerDnsIps` - DNS IP addresses of the domain to connect to.
+* `subnetIds` - Identifiers of the subnets for the connector servers (2 subnets in 2 different AZs).
+* `vpcId` - ID of the VPC that the connector is in.
+
+`radiusSettings` is also exported with the following attributes:
+
+* `authenticationProtocol` - The protocol specified for your RADIUS endpoints.
+* `displayLabel` - Display label.
+* `radiusPort` - Port that your RADIUS server is using for communications.
+* `radiusRetries` - Maximum number of times that communication with the RADIUS server is attempted.
+* `radiusServers` - Set of strings that contains the fully qualified domain name (FQDN) or IP addresses of the RADIUS server endpoints, or the FQDN or IP addresses of your RADIUS server load balancer.
+* `radiusTimeout` - Amount of time, in seconds, to wait for the RADIUS server to respond.
+* `useSameUsername` - Not currently used.
+
+<!-- cache-key: cdktf-0.18.0 input-a0542c4af1900563814b75f11b6b9079e80d58db377a8603ef5e97154a0bd43f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/dms_certificate.html.markdown b/website/docs/cdktf/typescript/d/dms_certificate.html.markdown
new file mode 100644
index 00000000000..1b945e66c83
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/dms_certificate.html.markdown
@@ -0,0 +1,59 @@
+---
+subcategory: "DMS (Database Migration)"
+layout: "aws"
+page_title: "AWS: aws_dms_certificate"
+description: |-
+  Terraform data source for managing an AWS DMS (Database Migration) Certificate.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_dms_certificate
+
+Terraform data source for managing an AWS DMS (Database Migration) Certificate.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsDmsCertificate } from "./.gen/providers/aws/data-aws-dms-certificate";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsDmsCertificate(this, "example", {
+      certificateId: test.certificateId,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `certificateId` - (Required) A customer-assigned name for the certificate. Identifiers must begin with a letter and must contain only ASCII letters, digits, and hyphens. They can't end with a hyphen or contain two consecutive hyphens.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `certificateCreationDate` - The date that the certificate was created.
+* `certificatePem` - The contents of a .pem file, which contains an X.509 certificate.
+* `certificateOwner` - The owner of the certificate.
+* `certificateArn` - The Amazon Resource Name (ARN) for the certificate.
+* `certificateWallet` - The owner of the certificate.
+* `keyLength` - The key length of the cryptographic algorithm being used.
+* `signingAlgorithm` - The algorithm for the certificate.
+* `validFromDate` - The beginning date that the certificate is valid.
+* `validToDate` - The final date that the certificate is valid.
+
+<!-- cache-key: cdktf-0.18.0 input-8c90e07fbf9734b9fd8c20ee7cebf074bf4b7702ec8ddca26d7eea974d6a74a0 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/dms_endpoint.html.markdown b/website/docs/cdktf/typescript/d/dms_endpoint.html.markdown
new file mode 100644
index 00000000000..8d275d440eb
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/dms_endpoint.html.markdown
@@ -0,0 +1,49 @@
+---
+subcategory: "DMS (Database Migration)"
+layout: "aws"
+page_title: "AWS: aws_dms_endpoint"
+description: |-
+  Terraform data source for managing an AWS DMS (Database Migration) Endpoint.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_dms_endpoint
+
+Terraform data source for managing an AWS DMS (Database Migration) Endpoint.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsDmsEndpoint } from "./.gen/providers/aws/data-aws-dms-endpoint";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsDmsEndpoint(this, "test", {
+      endpointId: "test_id",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `endpointId` - (Required) Database endpoint identifier. Identifiers must contain from 1 to 255 alphanumeric characters or hyphens, begin with a letter, contain only ASCII letters, digits, and hyphens, not end with a hyphen, and not contain two consecutive hyphens.
+
+## Attribute Reference
+
+See the [`awsDmsEndpoint` resource](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/dms_endpoint) for details on the returned attributes - they are identical.
+
+<!-- cache-key: cdktf-0.18.0 input-998a5893daed445684f6f9e1f26e5c03b27e3ac275e8cdebccf3ef05a470a1a7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/dms_replication_instance.html.markdown b/website/docs/cdktf/typescript/d/dms_replication_instance.html.markdown
new file mode 100644
index 00000000000..2641018457e
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/dms_replication_instance.html.markdown
@@ -0,0 +1,65 @@
+---
+subcategory: "DMS (Database Migration)"
+layout: "aws"
+page_title: "AWS: aws_dms_replication_instance"
+description: |-
+  Terraform data source for managing an AWS DMS (Database Migration) Replication Instance.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_dms_replication_instance
+
+Terraform data source for managing an AWS DMS (Database Migration) Replication Instance.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsDmsReplicationInstance } from "./.gen/providers/aws/data-aws-dms-replication-instance";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsDmsReplicationInstance(this, "test", {
+      replicationInstanceId: Token.asString(
+        awsDmsReplicationInstanceTest.replicationInstanceId
+      ),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `replicationInstanceId` - (Required) The replication instance identifier.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `allocatedStorage` - The amount of storage (in gigabytes) to be initially allocated for the replication instance.
+* `autoMinorVersionUpgrade` - Indicates that minor engine upgrades will be applied automatically to the replication instance during the maintenance window.
+* `availabilityZone` - The EC2 Availability Zone that the replication instance will be created in.
+* `engineVersion` - The engine version number of the replication instance.
+* `kmsKeyArn` - The Amazon Resource Name (ARN) for the KMS key used to encrypt the connection parameters.
+* `multiAz` - Specifies if the replication instance is a multi-az deployment.
+* `networkType` - The type of IP address protocol used by the replication instance.
+* `preferredMaintenanceWindow` - The weekly time range during which system maintenance can occur, in Universal Coordinated Time (UTC).
+* `publiclyAccessible` - Specifies the accessibility options for the replication instance. A value of true represents an instance with a public IP address. A value of false represents an instance with a private IP address.
+* `replicationInstanceArn` - The Amazon Resource Name (ARN) of the replication instance.
+* `replicationInstanceClass` - The compute and memory capacity of the replication instance as specified by the replication instance class. See [AWS DMS User Guide](https://docs.aws.amazon.com/dms/latest/userguide/CHAP_ReplicationInstance.Types.html) for information on instance classes.
+* `replicationInstancePrivateIps` - A list of the private IP addresses of the replication instance.
+* `replicationInstancePublicIps` - A list of the public IP addresses of the replication instance.
+* `replicationSubnetGroupId` - A subnet group to associate with the replication instance.
+* `vpcSecurityGroupIds` - A set of VPC security group IDs that are used with the replication instance.
+
+<!-- cache-key: cdktf-0.18.0 input-5aba05f196697c06b58151a68778040ed73677e99368add1ba52d699e7516fbc -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/dms_replication_subnet_group.html.markdown b/website/docs/cdktf/typescript/d/dms_replication_subnet_group.html.markdown
new file mode 100644
index 00000000000..05075a9126f
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/dms_replication_subnet_group.html.markdown
@@ -0,0 +1,55 @@
+---
+subcategory: "DMS (Database Migration)"
+layout: "aws"
+page_title: "AWS: aws_dms_replication_subnet_group"
+description: |-
+  Terraform data source for managing an AWS DMS (Database Migration) Replication Subnet Group.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_dms_replication_subnet_group
+
+Terraform data source for managing an AWS DMS (Database Migration) Replication Subnet Group.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsDmsReplicationSubnetGroup } from "./.gen/providers/aws/data-aws-dms-replication-subnet-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsDmsReplicationSubnetGroup(this, "test", {
+      replicationSubnetGroupId: Token.asString(
+        awsDmsReplicationSubnetGroupTest.replicationSubnetGroupId
+      ),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `replicationSubnetGroupId` - (Required) Name for the replication subnet group. This value is stored as a lowercase string. It must contain no more than 255 alphanumeric characters, periods, spaces, underscores, or hyphens and cannot be `default`.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `replicationSubnetGroupDescription` - Description for the subnet group.
+* `subnetIds` - List of at least 2 EC2 subnet IDs for the subnet group. The subnets must cover at least 2 availability zones.
+* `vpcId` - The ID of the VPC the subnet group is in.
+
+<!-- cache-key: cdktf-0.18.0 input-5a351e6983e13ca8ab53ae0b1934dd0149e708010440ee07aeef9d923642a6da -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/dms_replication_task.html.markdown b/website/docs/cdktf/typescript/d/dms_replication_task.html.markdown
new file mode 100644
index 00000000000..504cce23c50
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/dms_replication_task.html.markdown
@@ -0,0 +1,68 @@
+---
+subcategory: "DMS (Database Migration)"
+layout: "aws"
+page_title: "AWS: aws_dms_replication_task"
+description: |-
+  Terraform data source for managing an AWS DMS (Database Migration) Replication Task.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_dms_replication_task
+
+Terraform data source for managing an AWS DMS (Database Migration) Replication Task.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsDmsReplicationTask } from "./.gen/providers/aws/data-aws-dms-replication-task";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsDmsReplicationTask(this, "test", {
+      replicationTaskId: Token.asString(
+        awsDmsReplicationTaskTest.replicationTaskId
+      ),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `replicationTaskId` - (Required) The replication task identifier.
+
+    - Must contain from 1 to 255 alphanumeric characters or hyphens.
+    - First character must be a letter.
+    - Cannot end with a hyphen.
+    - Cannot contain two consecutive hyphens.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `cdcStartPosition` - (Conflicts with `cdcStartTime`) Indicates when you want a change data capture (CDC) operation to start. The value can be in date, checkpoint, or LSN/SCN format depending on the source engine. For more information, see [Determining a CDC native start point](https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Task.CDC.html#CHAP_Task.CDC.StartPoint.Native).
+* `cdcStartTime` - (Conflicts with `cdcStartPosition`) The Unix timestamp integer for the start of the Change Data Capture (CDC) operation.
+* `migrationType` - The migration type. Can be one of `full-load | cdc | full-load-and-cdc`.
+* `replicationInstanceArn` - The Amazon Resource Name (ARN) of the replication instance.
+* `replicationTaskSettings` - An escaped JSON string that contains the task settings. For a complete list of task settings, see [Task Settings for AWS Database Migration Service Tasks](http://docs.aws.amazon.com/dms/latest/userguide/CHAP_Tasks.CustomizingTasks.TaskSettings.html).
+* `sourceEndpointArn` - The Amazon Resource Name (ARN) string that uniquely identifies the source endpoint.
+* `startReplicationTask` -  Whether to run or stop the replication task.
+* `status` - Replication Task status.
+* `tableMappings` - An escaped JSON string that contains the table mappings. For information on table mapping see [Using Table Mapping with an AWS Database Migration Service Task to Select and Filter Data](http://docs.aws.amazon.com/dms/latest/userguide/CHAP_Tasks.CustomizingTasks.TableMapping.html)
+* `targetEndpointArn` - The Amazon Resource Name (ARN) string that uniquely identifies the target endpoint.
+* `replicationTaskArn` - The Amazon Resource Name (ARN) for the replication task.
+
+<!-- cache-key: cdktf-0.18.0 input-fa1a1915aa39f86d68f0c890bf2884e184e4111a8bb8bbe6b38fd7c6c992b063 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/docdb_engine_version.html.markdown b/website/docs/cdktf/typescript/d/docdb_engine_version.html.markdown
new file mode 100644
index 00000000000..1bf23b69d05
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/docdb_engine_version.html.markdown
@@ -0,0 +1,56 @@
+---
+subcategory: "DocumentDB"
+layout: "aws"
+page_title: "AWS: aws_docdb_engine_version"
+description: |-
+  Information about a DocumentDB engine version.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_docdb_engine_version
+
+Information about a DocumentDB engine version.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsDocdbEngineVersion } from "./.gen/providers/aws/data-aws-docdb-engine-version";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsDocdbEngineVersion(this, "test", {
+      version: "3.6.0",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `engine` - (Optional) DB engine. (Default: `docdb`)
+* `parameterGroupFamily` - (Optional) Name of a specific DB parameter group family. An example parameter group family is `docdb36`.
+* `preferredVersions` - (Optional) Ordered list of preferred engine versions. The first match in this list will be returned. If no preferred matches are found and the original search returned more than one result, an error is returned. If both the `version` and `preferredVersions` arguments are not configured, the data source will return the default version for the engine.
+* `version` - (Optional) Version of the DB engine. For example, `360`. If `version` and `preferredVersions` are not set, the data source will provide information for the AWS-defined default version. If both the `version` and `preferredVersions` arguments are not configured, the data source will return the default version for the engine.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `engineDescription` - Description of the database engine.
+* `exportableLogTypes` - Set of log types that the database engine has available for export to CloudWatch Logs.
+* `supportsLogExportsToCloudwatch` - Indicates whether the engine version supports exporting the log types specified by `exportableLogTypes` to CloudWatch Logs.
+* `validUpgradeTargets` - A set of engine versions that this database engine version can be upgraded to.
+* `versionDescription` - Description of the database engine version.
+
+<!-- cache-key: cdktf-0.18.0 input-551f8c39da9e4704102d050a7505855d613f3511c6df64ebd9c88d0d5533b8f5 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/docdb_engine_version.markdown b/website/docs/cdktf/typescript/d/docdb_engine_version.markdown
new file mode 100644
index 00000000000..1bf23b69d05
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/docdb_engine_version.markdown
@@ -0,0 +1,56 @@
+---
+subcategory: "DocumentDB"
+layout: "aws"
+page_title: "AWS: aws_docdb_engine_version"
+description: |-
+  Information about a DocumentDB engine version.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_docdb_engine_version
+
+Information about a DocumentDB engine version.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsDocdbEngineVersion } from "./.gen/providers/aws/data-aws-docdb-engine-version";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsDocdbEngineVersion(this, "test", {
+      version: "3.6.0",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `engine` - (Optional) DB engine. (Default: `docdb`)
+* `parameterGroupFamily` - (Optional) Name of a specific DB parameter group family. An example parameter group family is `docdb36`.
+* `preferredVersions` - (Optional) Ordered list of preferred engine versions. The first match in this list will be returned. If no preferred matches are found and the original search returned more than one result, an error is returned. If both the `version` and `preferredVersions` arguments are not configured, the data source will return the default version for the engine.
+* `version` - (Optional) Version of the DB engine. For example, `360`. If `version` and `preferredVersions` are not set, the data source will provide information for the AWS-defined default version. If both the `version` and `preferredVersions` arguments are not configured, the data source will return the default version for the engine.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `engineDescription` - Description of the database engine.
+* `exportableLogTypes` - Set of log types that the database engine has available for export to CloudWatch Logs.
+* `supportsLogExportsToCloudwatch` - Indicates whether the engine version supports exporting the log types specified by `exportableLogTypes` to CloudWatch Logs.
+* `validUpgradeTargets` - A set of engine versions that this database engine version can be upgraded to.
+* `versionDescription` - Description of the database engine version.
+
+<!-- cache-key: cdktf-0.18.0 input-551f8c39da9e4704102d050a7505855d613f3511c6df64ebd9c88d0d5533b8f5 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/docdb_orderable_db_instance.html.markdown b/website/docs/cdktf/typescript/d/docdb_orderable_db_instance.html.markdown
new file mode 100644
index 00000000000..18b50fda322
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/docdb_orderable_db_instance.html.markdown
@@ -0,0 +1,57 @@
+---
+subcategory: "DocumentDB"
+layout: "aws"
+page_title: "AWS: aws_docdb_orderable_db_instance"
+description: |-
+  Information about DocumentDB orderable DB instances.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_docdb_orderable_db_instance
+
+Information about DocumentDB orderable DB instances.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsDocdbOrderableDbInstance } from "./.gen/providers/aws/data-aws-docdb-orderable-db-instance";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsDocdbOrderableDbInstance(this, "test", {
+      engine: "docdb",
+      engineVersion: "3.6.0",
+      licenseModel: "na",
+      preferredInstanceClasses: ["db.r5.large", "db.r4.large", "db.t3.medium"],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `engine` - (Optional) DB engine. Default: `docdb`
+* `engineVersion` - (Optional) Version of the DB engine.
+* `instanceClass` - (Optional) DB instance class. Examples of classes are `dbR512Xlarge`, `dbR524Xlarge`, `dbR52Xlarge`, `dbR54Xlarge`, `dbR5Large`, `dbR5Xlarge`, and `dbT3Medium`. (Conflicts with `preferredInstanceClasses`.)
+* `licenseModel` - (Optional) License model. Default: `na`
+* `preferredInstanceClasses` - (Optional) Ordered list of preferred DocumentDB DB instance classes. The first match in this list will be returned. If no preferred matches are found and the original search returned more than one result, an error is returned. (Conflicts with `instanceClass`.)
+* `vpc` - (Optional) Enable to show only VPC.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `availabilityZones` - Availability zones where the instance is available.
+
+<!-- cache-key: cdktf-0.18.0 input-e0d401d073f27bb9d79b27ff7639257efd1b7f3f54817d94de7fdf271020db6f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/docdb_orderable_db_instance.markdown b/website/docs/cdktf/typescript/d/docdb_orderable_db_instance.markdown
new file mode 100644
index 00000000000..18b50fda322
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/docdb_orderable_db_instance.markdown
@@ -0,0 +1,57 @@
+---
+subcategory: "DocumentDB"
+layout: "aws"
+page_title: "AWS: aws_docdb_orderable_db_instance"
+description: |-
+  Information about DocumentDB orderable DB instances.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_docdb_orderable_db_instance
+
+Information about DocumentDB orderable DB instances.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsDocdbOrderableDbInstance } from "./.gen/providers/aws/data-aws-docdb-orderable-db-instance";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsDocdbOrderableDbInstance(this, "test", {
+      engine: "docdb",
+      engineVersion: "3.6.0",
+      licenseModel: "na",
+      preferredInstanceClasses: ["db.r5.large", "db.r4.large", "db.t3.medium"],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `engine` - (Optional) DB engine. Default: `docdb`
+* `engineVersion` - (Optional) Version of the DB engine.
+* `instanceClass` - (Optional) DB instance class. Examples of classes are `dbR512Xlarge`, `dbR524Xlarge`, `dbR52Xlarge`, `dbR54Xlarge`, `dbR5Large`, `dbR5Xlarge`, and `dbT3Medium`. (Conflicts with `preferredInstanceClasses`.)
+* `licenseModel` - (Optional) License model. Default: `na`
+* `preferredInstanceClasses` - (Optional) Ordered list of preferred DocumentDB DB instance classes. The first match in this list will be returned. If no preferred matches are found and the original search returned more than one result, an error is returned. (Conflicts with `instanceClass`.)
+* `vpc` - (Optional) Enable to show only VPC.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `availabilityZones` - Availability zones where the instance is available.
+
+<!-- cache-key: cdktf-0.18.0 input-e0d401d073f27bb9d79b27ff7639257efd1b7f3f54817d94de7fdf271020db6f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/dx_connection.html.markdown b/website/docs/cdktf/typescript/d/dx_connection.html.markdown
new file mode 100644
index 00000000000..50716426965
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/dx_connection.html.markdown
@@ -0,0 +1,56 @@
+---
+subcategory: "Direct Connect"
+layout: "aws"
+page_title: "AWS: aws_dx_connection"
+description: |-
+  Retrieve information about a Direct Connect Connection.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_dx_connection
+
+Retrieve information about a Direct Connect Connection.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsDxConnection } from "./.gen/providers/aws/data-aws-dx-connection";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsDxConnection(this, "example", {
+      name: "tf-dx-connection",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `name` - (Required) Name of the connection to retrieve.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the connection.
+* `awsDevice` - Direct Connect endpoint on which the physical connection terminates.
+* `bandwidth` - Bandwidth of the connection.
+* `id` - ID of the connection.
+* `location` - AWS Direct Connect location where the connection is located.
+* `ownerAccountId` - ID of the AWS account that owns the connection.
+* `partnerName` - The name of the AWS Direct Connect service provider associated with the connection.
+* `providerName` - Name of the service provider associated with the connection.
+* `tags` - Map of tags for the resource.
+* `vlanId` - The VLAN ID.
+
+<!-- cache-key: cdktf-0.18.0 input-192e94cc169312d4fa902eb3bcc5d1de027e5be4fe92fdaf9fdbeefc124a32a8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/dx_gateway.html.markdown b/website/docs/cdktf/typescript/d/dx_gateway.html.markdown
new file mode 100644
index 00000000000..e91b1a35107
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/dx_gateway.html.markdown
@@ -0,0 +1,49 @@
+---
+subcategory: "Direct Connect"
+layout: "aws"
+page_title: "AWS: aws_dx_gateway"
+description: |-
+  Retrieve information about a Direct Connect Gateway
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_dx_gateway
+
+Retrieve information about a Direct Connect Gateway.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsDxGateway } from "./.gen/providers/aws/data-aws-dx-gateway";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsDxGateway(this, "example", {
+      name: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `name` - (Required) Name of the gateway to retrieve.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `amazonSideAsn` - ASN on the Amazon side of the connection.
+* `id` - ID of the gateway.
+* `ownerAccountId` - AWS Account ID of the gateway.
+
+<!-- cache-key: cdktf-0.18.0 input-3127f300941d7e2a8378ebe59e0ac105a1d12fbec8c4b114a8a16614047676a0 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/dx_location.html.markdown b/website/docs/cdktf/typescript/d/dx_location.html.markdown
new file mode 100644
index 00000000000..1c041473d52
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/dx_location.html.markdown
@@ -0,0 +1,53 @@
+---
+subcategory: "Direct Connect"
+layout: "aws"
+page_title: "AWS: aws_dx_location"
+description: |-
+  Retrieve information about a specific AWS Direct Connect location in the current AWS Region.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_dx_location
+
+Retrieve information about a specific AWS Direct Connect location in the current AWS Region.
+These are the locations that can be specified when configuring [`awsDxConnection`](/docs/providers/aws/r/dx_connection.html) or [`awsDxLag`](/docs/providers/aws/r/dx_lag.html) resources.
+
+~> **Note:** This data source is different from the [`awsDxLocations`](/docs/providers/aws/d/dx_locations.html) data source which retrieves information about all the AWS Direct Connect locations in the current AWS Region.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsDxLocation } from "./.gen/providers/aws/data-aws-dx-location";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsDxLocation(this, "example", {
+      locationCode: "CS32A-24FL",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `locationCode` - (Required) Code for the location to retrieve.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `availableMacsecPortSpeeds` - The available MAC Security (MACsec) port speeds for the location.
+* `availablePortSpeeds` - The available port speeds for the location.
+* `availableProviders` - Names of the service providers for the location.
+* `locationName` - Name of the location. This includes the name of the colocation partner and the physical site of the building.
+
+<!-- cache-key: cdktf-0.18.0 input-d889468623dfe6cc7e6edbb487338f8e41ba42d426b71ce13bb577672f6b08e4 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/dx_locations.html.markdown b/website/docs/cdktf/typescript/d/dx_locations.html.markdown
new file mode 100644
index 00000000000..e99ca14cda0
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/dx_locations.html.markdown
@@ -0,0 +1,48 @@
+---
+subcategory: "Direct Connect"
+layout: "aws"
+page_title: "AWS: aws_dx_locations"
+description: |-
+  Retrieve information about the AWS Direct Connect locations in the current AWS Region.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_dx_locations
+
+Retrieve information about the AWS Direct Connect locations in the current AWS Region.
+These are the locations that can be specified when configuring [`awsDxConnection`](/docs/providers/aws/r/dx_connection.html) or [`awsDxLag`](/docs/providers/aws/r/dx_lag.html) resources.
+
+~> **Note:** This data source is different from the [`awsDxLocation`](/docs/providers/aws/d/dx_location.html) data source which retrieves information about a specific AWS Direct Connect location in the current AWS Region.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsDxLocations } from "./.gen/providers/aws/data-aws-dx-locations";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsDxLocations(this, "available", {});
+  }
+}
+
+```
+
+## Argument Reference
+
+There are no arguments available for this data source.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `locationCodes` - Code for the locations.
+
+<!-- cache-key: cdktf-0.18.0 input-edf9691bbd1000b72a448faca5fe847d9e9f887f6e0151e1dd14c6adec8f3ca6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/dx_router_configuration.html.markdown b/website/docs/cdktf/typescript/d/dx_router_configuration.html.markdown
new file mode 100644
index 00000000000..babf2f77f07
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/dx_router_configuration.html.markdown
@@ -0,0 +1,80 @@
+---
+subcategory: "Direct Connect"
+layout: "aws"
+page_title: "AWS: aws_dx_router_configuration"
+description: |-
+  Terraform data source for managing an AWS Direct Connect Router Configuration.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_dx_router_configuration
+
+Terraform data source for retrieving Router Configuration instructions for a given AWS Direct Connect Virtual Interface and Router Type.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsDxRouterConfiguration } from "./.gen/providers/aws/data-aws-dx-router-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsDxRouterConfiguration(this, "example", {
+      routerTypeIdentifier: "CiscoSystemsInc-2900SeriesRouters-IOS124",
+      virtualInterfaceId: "dxvif-abcde123",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `virtualInterfaceId` - (Required) ID of the Direct Connect Virtual Interface
+* `routerTypeIdentifier` - (Required) ID of the Router Type. For example: `ciscoSystemsInc2900SeriesRoutersIos124`
+
+There is currently no AWS API to retrieve the full list of `routerTypeIdentifier` values. Here is a list of known `routerType` objects that can be used:
+
+```json
+{
+  "routerTypes": [
+    {"platform":"2900 Series Routers","routerTypeIdentifier":"CiscoSystemsInc-2900SeriesRouters-IOS124","software":"IOS 12.4+","vendor":"Cisco Systems, Inc.","xsltTemplateName":"customer-router-cisco-generic.xslt","xsltTemplateNameForMacSec":""},
+    {"platform":"3700 Series Routers","routerTypeIdentifier":"CiscoSystemsInc-3700SeriesRouters-IOS124","software":"IOS 12.4+","vendor":"Cisco Systems, Inc.","xsltTemplateName":"customer-router-cisco-generic.xslt","xsltTemplateNameForMacSec":""},
+    {"platform":"7200 Series Routers","routerTypeIdentifier":"CiscoSystemsInc-7200SeriesRouters-IOS124","software":"IOS 12.4+","vendor":"Cisco Systems, Inc.","xsltTemplateName":"customer-router-cisco-generic.xslt","xsltTemplateNameForMacSec":""},
+    {"platform":"Nexus 7000 Series Switches","routerTypeIdentifier":"CiscoSystemsInc-Nexus7000SeriesSwitches-NXOS51","software":"NX-OS 5.1+","vendor":"Cisco Systems, Inc.","xsltTemplateName":"customer-switch-cisco-nexus-generic.xslt","xsltTemplateNameForMacSec":""},
+    {"platform":"Nexus 9K+ Series Switches","routerTypeIdentifier":"CiscoSystemsInc-Nexus9KSeriesSwitches-NXOS93","software":"NX-OS 9.3+","vendor":"Cisco Systems, Inc.","xsltTemplateName":"customer-switch-cisco-nexus-generic.xslt","xsltTemplateNameForMacSec":"customer-switch-cisco-nexus-generic-macsec.xslt"},
+    {"platform":"M/MX Series Routers","routerTypeIdentifier":"JuniperNetworksInc-MMXSeriesRouters-JunOS95","software":"JunOS 9.5+","vendor":"Juniper Networks, Inc.","xsltTemplateName":"customer-router-juniper-generic.xslt","xsltTemplateNameForMacSec":"customer-router-juniper-generic-macsec.xslt"},
+    {"platform":"SRX Series Routers","routerTypeIdentifier":"JuniperNetworksInc-SRXSeriesRouters-JunOS95","software":"JunOS 9.5+","vendor":"Juniper Networks, Inc.","xsltTemplateName":"customer-router-juniper-generic.xslt","xsltTemplateNameForMacSec":""},
+    {"platform":"T Series Routers","routerTypeIdentifier":"JuniperNetworksInc-TSeriesRouters-JunOS95","software":"JunOS 9.5+","vendor":"Juniper Networks, Inc.","xsltTemplateName":"customer-router-juniper-generic.xslt","xsltTemplateNameForMacSec":""},
+    {"platform":"PA-3000+ and 5000+ series","routerTypeIdentifier":"PaloAltoNetworks-PA3000and5000series-PANOS803","software":"PAN-OS 8.0.3+","vendor":"Palo Alto Networks","xsltTemplateName":"customer-router-palo-alto-generic.xslt","xsltTemplateNameForMacSec":""}]
+}
+```
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `customerRouterConfig` - Instructions for configuring your router
+* `router` - Block of the router type details
+
+A `router` block supports the following attributes:
+
+* `platform` - Router platform
+* `routerTypeIdentifier` - Router type identifier
+* `software` - Router operating system
+* `vendor` - Router vendor
+* `xsltTemplateName` - Router XSLT Template Name
+* `xsltTemplateNameForMac` - Router XSLT Template Name for MacSec
+
+<!-- cache-key: cdktf-0.18.0 input-9678217d6fec10b383267202e6ceb5509d81e5095d37ada2c2523269c07135c5 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/dynamodb_table.html.markdown b/website/docs/cdktf/typescript/d/dynamodb_table.html.markdown
new file mode 100644
index 00000000000..8eb26d6727a
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/dynamodb_table.html.markdown
@@ -0,0 +1,48 @@
+---
+subcategory: "DynamoDB"
+layout: "aws"
+page_title: "AWS: aws_dynamodb_table"
+description: |-
+  Provides a DynamoDB table data source.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_dynamodb_table
+
+Provides information about a DynamoDB table.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsDynamodbTable } from "./.gen/providers/aws/data-aws-dynamodb-table";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsDynamodbTable(this, "tableName", {
+      name: "tableName",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name of the DynamoDB table.
+
+## Attribute Reference
+
+See the [DynamoDB Table Resource](/docs/providers/aws/r/dynamodb_table.html) for details on the
+returned attributes - they are identical.
+
+<!-- cache-key: cdktf-0.18.0 input-1f59fb72cfbdb2e6f0ab733246fe01d5f9b99e7b551e1073e5c40c8c404bd9ef -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/dynamodb_table_item.html.markdown b/website/docs/cdktf/typescript/d/dynamodb_table_item.html.markdown
new file mode 100644
index 00000000000..ae4c7890354
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/dynamodb_table_item.html.markdown
@@ -0,0 +1,65 @@
+---
+subcategory: "DynamoDB"
+layout: "aws"
+page_title: "AWS: aws_dynamodb_table_item"
+description: |-
+  Terraform data source for retrieving a value from an AWS DynamoDB table.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_dynamodb_table_item
+
+Terraform data source for retrieving a value from an AWS DynamoDB table.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsDynamodbTableItem } from "./.gen/providers/aws/data-aws-dynamodb-table-item";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsDynamodbTableItem(this, "test", {
+      dependsOn: [example],
+      expressionAttributeNames: {
+        "#P": "Percentile",
+      },
+      key: '{\n\t"hashKey": {"S": "example"}\n}\n\n',
+      projectionExpression: "#P",
+      tableName: Token.asString(awsDynamodbTableExample.name),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `tableName` - (Required) The name of the table containing the requested item.
+* `key` - (Required) A map of attribute names to AttributeValue objects, representing the primary key of the item to retrieve.
+  For the primary key, you must provide all of the attributes. For example, with a simple primary key, you only need to provide a value for the partition key. For a composite primary key, you must provide values for both the partition key and the sort key.
+
+The following arguments are optional:
+
+* `expressionAttributeName` - (Optional) - One or more substitution tokens for attribute names in an expression. Use the `#` character in an expression to dereference an attribute name.
+* `projectionExpression` - (Optional) A string that identifies one or more attributes to retrieve from the table. These attributes can include scalars, sets, or elements of a JSON document. The attributes in the expression must be separated by commas.
+If no attribute names are specified, then all attributes are returned. If any of the requested attributes are not found, they do not appear in the result.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `item` - JSON representation of a map of attribute names to [AttributeValue](https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_AttributeValue.html) objects, as specified by ProjectionExpression.
+
+<!-- cache-key: cdktf-0.18.0 input-15763bbf01ce37024fe77596ac5996501c9715c0941ce02a4eab1115436c2219 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/ebs_default_kms_key.html.markdown b/website/docs/cdktf/typescript/d/ebs_default_kms_key.html.markdown
new file mode 100644
index 00000000000..6b65d6d2ddf
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/ebs_default_kms_key.html.markdown
@@ -0,0 +1,54 @@
+---
+subcategory: "EBS (EC2)"
+layout: "aws"
+page_title: "AWS: aws_ebs_default_kms_key"
+description: |-
+  Provides metadata about the KMS key set for EBS default encryption
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_ebs_default_kms_key
+
+Use this data source to get the default EBS encryption KMS key in the current region.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsEbsDefaultKmsKey } from "./.gen/providers/aws/data-aws-ebs-default-kms-key";
+import { EbsVolume } from "./.gen/providers/aws/ebs-volume";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const current = new DataAwsEbsDefaultKmsKey(this, "current", {});
+    new EbsVolume(this, "example", {
+      availabilityZone: "us-west-2a",
+      encrypted: true,
+      kmsKeyId: Token.asString(current.keyArn),
+    });
+  }
+}
+
+```
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `keyArn` - ARN of the default KMS key uses to encrypt an EBS volume in this region when no key is specified in an API call that creates the volume and encryption by default is enabled.
+* `id` - Region of the default KMS Key.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `20M`)
+
+<!-- cache-key: cdktf-0.18.0 input-2ea61958e162ad0b2b3b242ab8cd3395fe46d2bce086890134212bd6f12284d6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/ebs_encryption_by_default.html.markdown b/website/docs/cdktf/typescript/d/ebs_encryption_by_default.html.markdown
new file mode 100644
index 00000000000..1178f04ce36
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/ebs_encryption_by_default.html.markdown
@@ -0,0 +1,48 @@
+---
+subcategory: "EBS (EC2)"
+layout: "aws"
+page_title: "AWS: aws_ebs_encryption_by_default"
+description: |-
+  Checks whether default EBS encryption is enabled for your AWS account in the current AWS region.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_ebs_encryption_by_default
+
+Provides a way to check whether default EBS encryption is enabled for your AWS account in the current AWS region.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsEbsEncryptionByDefault } from "./.gen/providers/aws/data-aws-ebs-encryption-by-default";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsEbsEncryptionByDefault(this, "current", {});
+  }
+}
+
+```
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `enabled` - Whether or not default EBS encryption is enabled. Returns as `true` or `false`.
+* `id` - Region of default EBS encryption.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `20M`)
+
+<!-- cache-key: cdktf-0.18.0 input-2606f9f1f57c452981b17146b7983251b10e31c6aeb74dfd9e1ac4d8fab6d7ad -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/ebs_snapshot.html.markdown b/website/docs/cdktf/typescript/d/ebs_snapshot.html.markdown
new file mode 100644
index 00000000000..64c2441598f
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/ebs_snapshot.html.markdown
@@ -0,0 +1,92 @@
+---
+subcategory: "EBS (EC2)"
+layout: "aws"
+page_title: "AWS: aws_ebs_snapshot"
+description: |-
+  Get information on an EBS Snapshot.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_ebs_snapshot
+
+Use this data source to get information about an EBS Snapshot for use when provisioning EBS Volumes
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsEbsSnapshot } from "./.gen/providers/aws/data-aws-ebs-snapshot";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsEbsSnapshot(this, "ebs_volume", {
+      filter: [
+        {
+          name: "volume-size",
+          values: ["40"],
+        },
+        {
+          name: "tag:Name",
+          values: ["Example"],
+        },
+      ],
+      mostRecent: true,
+      owners: ["self"],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `mostRecent` - (Optional) If more than one result is returned, use the most recent snapshot.
+
+* `owners` - (Optional) Returns the snapshots owned by the specified owner id. Multiple owners can be specified.
+
+* `snapshotIds` - (Optional) Returns information on a specific snapshot_id.
+
+* `restorableByUserIds` - (Optional) One or more AWS accounts IDs that can create volumes from the snapshot.
+
+* `filter` - (Optional) One or more name/value pairs to filter off of. There are
+several valid keys, for a full reference, check out
+[describe-snapshots in the AWS CLI reference][1].
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the EBS Snapshot.
+* `id` - Snapshot ID (e.g., snap-59fcb34e).
+* `snapshotId` - Snapshot ID (e.g., snap-59fcb34e).
+* `description` - Description for the snapshot
+* `ownerId` - AWS account ID of the EBS snapshot owner.
+* `ownerAlias` - Value from an Amazon-maintained list (`amazon`, `awsMarketplace`, `microsoft`) of snapshot owners.
+* `volumeId` - Volume ID (e.g., vol-59fcb34e).
+* `encrypted` - Whether the snapshot is encrypted.
+* `volumeSize` - Size of the drive in GiBs.
+* `kmsKeyId` - ARN for the KMS encryption key.
+* `dataEncryptionKeyId` - The data encryption key identifier for the snapshot.
+* `state` - Snapshot state.
+* `storageTier` - Storage tier in which the snapshot is stored.
+* `outpostArn` - ARN of the Outpost on which the snapshot is stored.
+* `tags` - Map of tags for the resource.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `20M`)
+
+[1]: http://docs.aws.amazon.com/cli/latest/reference/ec2/describe-snapshots.html
+
+<!-- cache-key: cdktf-0.18.0 input-c8ad520ee1902fdd4beb1d909dcc090edcec79bd99fe9a2e9d973ce88eeefa44 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/ebs_snapshot_ids.html.markdown b/website/docs/cdktf/typescript/d/ebs_snapshot_ids.html.markdown
new file mode 100644
index 00000000000..d620b619388
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/ebs_snapshot_ids.html.markdown
@@ -0,0 +1,75 @@
+---
+subcategory: "EBS (EC2)"
+layout: "aws"
+page_title: "AWS: aws_ebs_snapshot_ids"
+description: |-
+  Provides a list of EBS snapshot IDs.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_ebs_snapshot_ids
+
+Use this data source to get a list of EBS Snapshot IDs matching the specified
+criteria.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsEbsSnapshotIds } from "./.gen/providers/aws/data-aws-ebs-snapshot-ids";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsEbsSnapshotIds(this, "ebs_volumes", {
+      filter: [
+        {
+          name: "volume-size",
+          values: ["40"],
+        },
+        {
+          name: "tag:Name",
+          values: ["Example"],
+        },
+      ],
+      owners: ["self"],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `owners` - (Optional) Returns the snapshots owned by the specified owner id. Multiple owners can be specified.
+
+* `restorableByUserIds` - (Optional) One or more AWS accounts IDs that can create volumes from the snapshot.
+
+* `filter` - (Optional) One or more name/value pairs to filter off of. There are
+several valid keys, for a full reference, check out
+[describe-volumes in the AWS CLI reference][1].
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - AWS Region.
+* `ids` - Set of EBS snapshot IDs, sorted by creation time in descending order.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `20M`)
+
+[1]: http://docs.aws.amazon.com/cli/latest/reference/ec2/describe-snapshots.html
+
+<!-- cache-key: cdktf-0.18.0 input-39c8fd3ed01de7a4c5bbc663b2dbb6a16897ac65078b21e1f01a11f41abab5e1 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/ebs_volume.html.markdown b/website/docs/cdktf/typescript/d/ebs_volume.html.markdown
new file mode 100644
index 00000000000..47474bf25d3
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/ebs_volume.html.markdown
@@ -0,0 +1,85 @@
+---
+subcategory: "EBS (EC2)"
+layout: "aws"
+page_title: "AWS: aws_ebs_volume"
+description: |-
+  Get information on an EBS volume.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_ebs_volume
+
+Use this data source to get information about an EBS volume for use in other
+resources.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsEbsVolume } from "./.gen/providers/aws/data-aws-ebs-volume";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsEbsVolume(this, "ebs_volume", {
+      filter: [
+        {
+          name: "volume-type",
+          values: ["gp2"],
+        },
+        {
+          name: "tag:Name",
+          values: ["Example"],
+        },
+      ],
+      mostRecent: true,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `mostRecent` - (Optional) If more than one result is returned, use the most
+recent Volume.
+* `filter` - (Optional) One or more name/value pairs to filter off of. There are
+several valid keys, for a full reference, check out
+[describe-volumes in the AWS CLI reference][1].
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - Volume ID (e.g., vol-59fcb34e).
+* `volumeId` - Volume ID (e.g., vol-59fcb34e).
+* `arn` - Volume ARN (e.g., arn:aws:ec2:us-east-1:0123456789012:volume/vol-59fcb34e).
+* `availabilityZone` - AZ where the EBS volume exists.
+* `encrypted` - Whether the disk is encrypted.
+* `iops` - Amount of IOPS for the disk.
+* `multiAttachEnabled` - (Optional) Specifies whether Amazon EBS Multi-Attach is enabled.
+* `size` - Size of the drive in GiBs.
+* `snapshotId` - Snapshot_id the EBS volume is based off.
+* `outpostArn` - ARN of the Outpost.
+* `volumeType` - Type of EBS volume.
+* `kmsKeyId` - ARN for the KMS encryption key.
+* `tags` - Map of tags for the resource.
+* `throughput` - Throughput that the volume supports, in MiB/s.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `20M`)
+
+[1]: http://docs.aws.amazon.com/cli/latest/reference/ec2/describe-volumes.html
+
+<!-- cache-key: cdktf-0.18.0 input-00c94bacdc21ca1f9f8c3f77dac8c937947e9644a5d93fbb88f378a86ec1420e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/ebs_volumes.html.markdown b/website/docs/cdktf/typescript/d/ebs_volumes.html.markdown
new file mode 100644
index 00000000000..371a97fba46
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/ebs_volumes.html.markdown
@@ -0,0 +1,129 @@
+---
+subcategory: "EBS (EC2)"
+layout: "aws"
+page_title: "AWS: aws_ebs_volumes"
+description: |-
+    Provides identifying information for EBS volumes matching given criteria
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_ebs_volumes
+
+`awsEbsVolumes` provides identifying information for EBS volumes matching given criteria.
+
+This data source can be useful for getting a list of volume IDs with (for example) matching tags.
+
+## Example Usage
+
+The following demonstrates obtaining a map of availability zone to EBS volume ID for volumes with a given tag value.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import {
+  Token,
+  TerraformIterator,
+  TerraformOutput,
+  TerraformStack,
+} from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsEbsVolume } from "./.gen/providers/aws/data-aws-ebs-volume";
+import { DataAwsEbsVolumes } from "./.gen/providers/aws/data-aws-ebs-volumes";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new DataAwsEbsVolumes(this, "example", {
+      tags: {
+        VolumeSet: "TestVolumeSet",
+      },
+    });
+    /*In most cases loops should be handled in the programming language context and 
+    not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+    you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+    you need to keep this like it is.*/
+    const exampleForEachIterator = TerraformIterator.fromList(
+      Token.asAny(example.ids)
+    );
+    const dataAwsEbsVolumeExample = new DataAwsEbsVolume(this, "example_1", {
+      filter: [
+        {
+          name: "volume-id",
+          values: [Token.asString(exampleForEachIterator.value)],
+        },
+      ],
+      forEach: exampleForEachIterator,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsEbsVolumeExample.overrideLogicalId("example");
+    new TerraformOutput(this, "availability_zone_to_volume_id", {
+      value:
+        "${{ for s in ${" +
+        dataAwsEbsVolumeExample.fqn +
+        "} : s.id => s.availability_zone}}",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `filter` - (Optional) Custom filter block as described below.
+
+* `tags` - (Optional) Map of tags, each pair of which must exactly match
+  a pair on the desired volumes.
+
+More complex filters can be expressed using one or more `filter` sub-blocks,
+which take the following arguments:
+
+* `name` - (Required) Name of the field to filter by, as defined by
+  [the underlying AWS API](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeVolumes.html).
+  For example, if matching against the `size` filter, use:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsEbsVolumes } from "./.gen/providers/aws/data-aws-ebs-volumes";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsEbsVolumes(this, "ten_or_twenty_gb_volumes", {
+      filter: [
+        {
+          name: "size",
+          values: ["10", "20"],
+        },
+      ],
+    });
+  }
+}
+
+```
+
+* `values` - (Required) Set of values that are accepted for the given field.
+  EBS Volume IDs will be selected if any one of the given values match.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - AWS Region.
+* `ids` - Set of all the EBS Volume IDs found. This data source will fail if
+  no volumes match the provided criteria.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `20M`)
+
+<!-- cache-key: cdktf-0.18.0 input-2fdb43d70c3e01df69142bb8e512eb860b7308eecd84dfa0aec0a61b89c10a96 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/ec2_client_vpn_endpoint.html.markdown b/website/docs/cdktf/typescript/d/ec2_client_vpn_endpoint.html.markdown
index 95855761c0a..03eb08a3a7b 100644
--- a/website/docs/cdktf/typescript/d/ec2_client_vpn_endpoint.html.markdown
+++ b/website/docs/cdktf/typescript/d/ec2_client_vpn_endpoint.html.markdown
@@ -6,6 +6,8 @@ description: |-
   Get information on an EC2 Client VPN endpoint
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Data Source: aws_ec2_client_vpn_endpoint
 
 Get information on an EC2 Client VPN endpoint.
@@ -15,26 +17,25 @@ Get information on an EC2 Client VPN endpoint.
 ### By Filter
 
 ```typescript
-import * as constructs from "constructs";
-import * as cdktf from "cdktf";
-/*Provider bindings are generated by running cdktf get.
-See https://cdk.tf/provider-generation for more details.*/
-import * as aws from "./.gen/providers/aws";
-class MyConvertedCode extends cdktf.TerraformStack {
-  constructor(scope: constructs.Construct, name: string) {
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsEc2ClientVpnEndpoint } from "./.gen/providers/aws/data-aws-ec2-client-vpn-endpoint";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
     super(scope, name);
-    new aws.dataAwsEc2ClientVpnEndpoint.DataAwsEc2ClientVpnEndpoint(
-      this,
-      "example",
-      {
-        filter: [
-          {
-            name: "tag:Name",
-            values: ["ExampleVpn"],
-          },
-        ],
-      }
-    );
+    new DataAwsEc2ClientVpnEndpoint(this, "example", {
+      filter: [
+        {
+          name: "tag:Name",
+          values: ["ExampleVpn"],
+        },
+      ],
+    });
   }
 }
 
@@ -43,21 +44,20 @@ class MyConvertedCode extends cdktf.TerraformStack {
 ### By Identifier
 
 ```typescript
-import * as constructs from "constructs";
-import * as cdktf from "cdktf";
-/*Provider bindings are generated by running cdktf get.
-See https://cdk.tf/provider-generation for more details.*/
-import * as aws from "./.gen/providers/aws";
-class MyConvertedCode extends cdktf.TerraformStack {
-  constructor(scope: constructs.Construct, name: string) {
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsEc2ClientVpnEndpoint } from "./.gen/providers/aws/data-aws-ec2-client-vpn-endpoint";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
     super(scope, name);
-    new aws.dataAwsEc2ClientVpnEndpoint.DataAwsEc2ClientVpnEndpoint(
-      this,
-      "example",
-      {
-        clientVpnEndpointId: "cvpn-endpoint-083cf50d6eb314f21",
-      }
-    );
+    new DataAwsEc2ClientVpnEndpoint(this, "example", {
+      clientVpnEndpointId: "cvpn-endpoint-083cf50d6eb314f21",
+    });
   }
 }
 
@@ -65,7 +65,7 @@ class MyConvertedCode extends cdktf.TerraformStack {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `clientVpnEndpointId` - (Optional) ID of the Client VPN endpoint.
 * `filter` - (Optional) One or more configuration blocks containing name-values filters. Detailed below.
@@ -82,7 +82,7 @@ The following arguments are required:
 
 ## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` -  The ARN of the Client VPN endpoint.
 * `authenticationOptions` - Information about the authentication method used by the Client VPN endpoint.
@@ -95,6 +95,7 @@ In addition to all arguments above, the following attributes are exported:
 * `dnsServers` - Information about the DNS servers to be used for DNS resolution.
 * `securityGroupIds` - IDs of the security groups for the target network associated with the Client VPN endpoint.
 * `selfServicePortal` - Whether the self-service portal for the Client VPN endpoint is enabled.
+* `selfServicePortalUrl` - The URL of the self-service portal.
 * `serverCertificateArn` - The ARN of the server certificate.
 * `sessionTimeoutHours` - The maximum VPN session duration time in hours.
 * `splitTunnel` - Whether split-tunnel is enabled in the AWS Client VPN endpoint.
@@ -108,4 +109,4 @@ In addition to all arguments above, the following attributes are exported:
 
 - `read` - (Default `20M`)
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-86166d26a95ae3c88a4d4e7f8804306d48860395f262b9f351921ba97ba82ccc -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-bc05f6bb24f9086ff19f5d3ed7d1f4948088a83b4e318db8a86fe506a18104cf -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/ec2_coip_pool.html.markdown b/website/docs/cdktf/typescript/d/ec2_coip_pool.html.markdown
index aedff5df3de..0d8bc8d55c6 100644
--- a/website/docs/cdktf/typescript/d/ec2_coip_pool.html.markdown
+++ b/website/docs/cdktf/typescript/d/ec2_coip_pool.html.markdown
@@ -6,6 +6,8 @@ description: |-
     Provides details about a specific EC2 Customer-Owned IP Pool
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Data Source: aws_ec2_coip_pool
 
 Provides details about a specific EC2 Customer-Owned IP Pool.
@@ -18,12 +20,27 @@ COIP Pool.
 
 The following example returns a specific coip pool ID
 
-```terraform
-variable "coip_pool_id" {}
-
-data "aws_ec2_coip_pool" "selected" {
-  id = var.coip_pool_id
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformVariable, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsEc2CoipPool } from "./.gen/providers/aws/data-aws-ec2-coip-pool";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    /*Terraform Variables are not always the best fit for getting inputs in the context of Terraform CDK.
+    You can read more about this at https://cdk.tf/variables*/
+    const coipPoolId = new TerraformVariable(this, "coip_pool_id", {});
+    new DataAwsEc2CoipPool(this, "selected", {
+      id: coipPoolId.stringValue,
+    });
+  }
 }
+
 ```
 
 ## Argument Reference
@@ -48,14 +65,14 @@ which take the following arguments:
 * `values` - (Required) Set of values that are accepted for the given field.
   A COIP Pool will be selected if any one of the given values matches.
 
-## Attributes Reference
+## Attribute Reference
 
 All of the argument attributes except `filter` blocks are also exported as
 result attributes. This data source will complete the data by populating
 any fields that are not included in the configuration with the data for
 the selected COIP Pool.
 
-In addition, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the COIP pool
 * `poolCidrs` - Set of CIDR blocks in pool
@@ -66,4 +83,4 @@ In addition, the following attributes are exported:
 
 - `read` - (Default `20M`)
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-4018a02fb3e3ba399170a12145e567c04dd4dcf3d3de820650bd0da4b7852ab7 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-9daefdcf6a9406d85608497b3074a6f9c1cdbfdb9d671dde53dad6ac78ca710e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/ec2_coip_pools.html.markdown b/website/docs/cdktf/typescript/d/ec2_coip_pools.html.markdown
index 548b6a0d6dd..f0c943ca6eb 100644
--- a/website/docs/cdktf/typescript/d/ec2_coip_pools.html.markdown
+++ b/website/docs/cdktf/typescript/d/ec2_coip_pools.html.markdown
@@ -6,6 +6,8 @@ description: |-
     Provides information for multiple EC2 Customer-Owned IP Pools
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Data Source: aws_ec2_coip_pools
 
 Provides information for multiple EC2 Customer-Owned IP Pools, such as their identifiers.
@@ -14,12 +16,27 @@ Provides information for multiple EC2 Customer-Owned IP Pools, such as their ide
 
 The following shows outputting all COIP Pool Ids.
 
-```terraform
-data "aws_ec2_coip_pools" "foo" {}
-
-output "foo" {
-  value = data.aws_ec2_coip_pools.foo.ids
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformOutput, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsEc2CoipPools } from "./.gen/providers/aws/data-aws-ec2-coip-pools";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const foo = new DataAwsEc2CoipPools(this, "foo", {});
+    const cdktfTerraformOutputFoo = new TerraformOutput(this, "foo_1", {
+      value: foo.ids,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    cdktfTerraformOutputFoo.overrideLogicalId("foo");
+  }
 }
+
 ```
 
 ## Argument Reference
@@ -38,7 +55,9 @@ which take the following arguments:
 * `values` - (Required) Set of values that are accepted for the given field.
   A COIP Pool will be selected if any one of the given values matches.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - AWS Region.
 * `poolIds` - Set of COIP Pool Identifiers
@@ -49,4 +68,4 @@ which take the following arguments:
 
 - `read` - (Default `20M`)
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-c1c9a426e16105b7a02e1c1b1adc831132ac241239b921ea8b6a60157547ed64 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-b91d2cae592ac5bf459745fca131316d289583f055df2569fd13d50a3ac7f511 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/ec2_host.html.markdown b/website/docs/cdktf/typescript/d/ec2_host.html.markdown
index ebfe3f56944..3ddc18b2b04 100644
--- a/website/docs/cdktf/typescript/d/ec2_host.html.markdown
+++ b/website/docs/cdktf/typescript/d/ec2_host.html.markdown
@@ -6,6 +6,8 @@ description: |-
   Get information on an EC2 Host.
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Data Source: aws_ec2_host
 
 Use this data source to get information about an EC2 Dedicated Host.
@@ -13,25 +15,25 @@ Use this data source to get information about an EC2 Dedicated Host.
 ## Example Usage
 
 ```typescript
-import * as constructs from "constructs";
-import * as cdktf from "cdktf";
-/*Provider bindings are generated by running cdktf get.
-See https://cdk.tf/provider-generation for more details.*/
-import * as aws from "./.gen/providers/aws";
-class MyConvertedCode extends cdktf.TerraformStack {
-  constructor(scope: constructs.Construct, name: string) {
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsEc2Host } from "./.gen/providers/aws/data-aws-ec2-host";
+import { Ec2Host } from "./.gen/providers/aws/ec2-host";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
     super(scope, name);
-    const awsEc2HostTest = new aws.ec2Host.Ec2Host(this, "test", {
+    const test = new Ec2Host(this, "test", {
       availabilityZone: "us-west-2a",
       instanceType: "c5.18xlarge",
     });
-    const dataAwsEc2HostTest = new aws.dataAwsEc2Host.DataAwsEc2Host(
-      this,
-      "test_1",
-      {
-        hostId: cdktf.Token.asString(awsEc2HostTest.id),
-      }
-    );
+    const dataAwsEc2HostTest = new DataAwsEc2Host(this, "test_1", {
+      hostId: test.id,
+    });
     /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
     dataAwsEc2HostTest.overrideLogicalId("test");
   }
@@ -42,15 +44,18 @@ class MyConvertedCode extends cdktf.TerraformStack {
 ### Filter Example
 
 ```typescript
-import * as constructs from "constructs";
-import * as cdktf from "cdktf";
-/*Provider bindings are generated by running cdktf get.
-See https://cdk.tf/provider-generation for more details.*/
-import * as aws from "./.gen/providers/aws";
-class MyConvertedCode extends cdktf.TerraformStack {
-  constructor(scope: constructs.Construct, name: string) {
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsEc2Host } from "./.gen/providers/aws/data-aws-ec2-host";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
     super(scope, name);
-    new aws.dataAwsEc2Host.DataAwsEc2Host(this, "test", {
+    new DataAwsEc2Host(this, "test", {
       filter: [
         {
           name: "instance-type",
@@ -80,12 +85,13 @@ The following arguments are required:
 * `name` - (Required) Name of the field to filter by, as defined by [the underlying AWS API](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeHosts.html).
 * `values` - (Required) Set of values that are accepted for the given field. A host will be selected if any one of the given values matches.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to the attributes above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - ID of the Dedicated Host.
 * `arn` - ARN of the Dedicated Host.
+* `assetId` - The ID of the Outpost hardware asset on which the Dedicated Host is allocated.
 * `autoPlacement` - Whether auto-placement is on or off.
 * `availabilityZone` - Availability Zone of the Dedicated Host.
 * `cores` - Number of cores on the Dedicated Host.
@@ -103,4 +109,4 @@ In addition to the attributes above, the following attributes are exported:
 
 - `read` - (Default `20M`)
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-9b4c91c8afc4637faf1832c061bf67a14ccd6dddf8ee04ebb2ecd4958b912e50 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-2c0dd059868ed5217fac4aec77aa468bafc9f69b8de0b12d682d6625c1850767 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/ec2_instance_type.html.markdown b/website/docs/cdktf/typescript/d/ec2_instance_type.html.markdown
index 9628bf7d587..ebe4c9b2a30 100644
--- a/website/docs/cdktf/typescript/d/ec2_instance_type.html.markdown
+++ b/website/docs/cdktf/typescript/d/ec2_instance_type.html.markdown
@@ -7,6 +7,8 @@ description: |-
 ---
 
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Data Source: aws_ec2_instance_type
 
 Get characteristics for a single EC2 Instance Type.
@@ -14,15 +16,18 @@ Get characteristics for a single EC2 Instance Type.
 ## Example Usage
 
 ```typescript
-import * as constructs from "constructs";
-import * as cdktf from "cdktf";
-/*Provider bindings are generated by running cdktf get.
-See https://cdk.tf/provider-generation for more details.*/
-import * as aws from "./.gen/providers/aws";
-class MyConvertedCode extends cdktf.TerraformStack {
-  constructor(scope: constructs.Construct, name: string) {
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsEc2InstanceType } from "./.gen/providers/aws/data-aws-ec2-instance-type";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
     super(scope, name);
-    new aws.dataAwsEc2InstanceType.DataAwsEc2InstanceType(this, "example", {
+    new DataAwsEc2InstanceType(this, "example", {
       instanceType: "t2.micro",
     });
   }
@@ -32,13 +37,13 @@ class MyConvertedCode extends cdktf.TerraformStack {
 
 ## Argument Reference
 
-The following argument is supported:
+This data source supports the following arguments:
 
 * `instanceType` - (Required) Instance
 
 ## Attribute Reference
 
-In addition to the argument above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 ~> **NOTE:** Not all attributes are set for every instance type.
 
@@ -108,4 +113,4 @@ In addition to the argument above, the following attributes are exported:
 
 - `read` - (Default `20M`)
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-2b636f57a79c9545305113d01a6f8b0a344a9f774db0d6a467fd46c35a6802c0 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-b7277db3a541ce0f8fed6f01d3571ab61e9905732dcb0c8ed05bebf2a1116184 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/ec2_instance_type_offering.html.markdown b/website/docs/cdktf/typescript/d/ec2_instance_type_offering.html.markdown
index c6603fda8d4..327e47560ca 100644
--- a/website/docs/cdktf/typescript/d/ec2_instance_type_offering.html.markdown
+++ b/website/docs/cdktf/typescript/d/ec2_instance_type_offering.html.markdown
@@ -6,6 +6,8 @@ description: |-
   Information about single EC2 Instance Type Offering.
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Data Source: aws_ec2_instance_type_offering
 
 Information about single EC2 Instance Type Offering.
@@ -13,27 +15,26 @@ Information about single EC2 Instance Type Offering.
 ## Example Usage
 
 ```typescript
-import * as constructs from "constructs";
-import * as cdktf from "cdktf";
-/*Provider bindings are generated by running cdktf get.
-See https://cdk.tf/provider-generation for more details.*/
-import * as aws from "./.gen/providers/aws";
-class MyConvertedCode extends cdktf.TerraformStack {
-  constructor(scope: constructs.Construct, name: string) {
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsEc2InstanceTypeOffering } from "./.gen/providers/aws/data-aws-ec2-instance-type-offering";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
     super(scope, name);
-    new aws.dataAwsEc2InstanceTypeOffering.DataAwsEc2InstanceTypeOffering(
-      this,
-      "example",
-      {
-        filter: [
-          {
-            name: "instance-type",
-            values: ["t2.micro", "t3.micro"],
-          },
-        ],
-        preferredInstanceTypes: ["t3.micro", "t2.micro"],
-      }
-    );
+    new DataAwsEc2InstanceTypeOffering(this, "example", {
+      filter: [
+        {
+          name: "instance-type",
+          values: ["t2.micro", "t3.micro"],
+        },
+      ],
+      preferredInstanceTypes: ["t3.micro", "t2.micro"],
+    });
   }
 }
 
@@ -41,7 +42,7 @@ class MyConvertedCode extends cdktf.TerraformStack {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `filter` - (Optional) One or more configuration blocks containing name-values filters. See the [EC2 API Reference](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeInstanceTypeOfferings.html) for supported filters. Detailed below.
 * `locationType` - (Optional) Location type. Defaults to `region`. Valid values: `availabilityZone`, `availabilityZoneId`, and `region`.
@@ -54,7 +55,7 @@ The following arguments are supported:
 
 ## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - EC2 Instance Type.
 * `instanceType` - EC2 Instance Type.
@@ -65,4 +66,4 @@ In addition to all arguments above, the following attributes are exported:
 
 - `read` - (Default `20M`)
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-b9a0baa6d38287dcfdc6f70833e23287a617a652af798b75206cc22860a785e7 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-ee92204428b1ac2c8a41c289f70dd6ba1bc0d940110fee2c372c0684d819b847 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/ec2_instance_type_offerings.html.markdown b/website/docs/cdktf/typescript/d/ec2_instance_type_offerings.html.markdown
index 63d24b7e9d1..24740e5449c 100644
--- a/website/docs/cdktf/typescript/d/ec2_instance_type_offerings.html.markdown
+++ b/website/docs/cdktf/typescript/d/ec2_instance_type_offerings.html.markdown
@@ -6,6 +6,8 @@ description: |-
   Information about EC2 Instance Type Offerings.
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Data Source: aws_ec2_instance_type_offerings
 
 Information about EC2 Instance Type Offerings.
@@ -13,31 +15,30 @@ Information about EC2 Instance Type Offerings.
 ## Example Usage
 
 ```typescript
-import * as constructs from "constructs";
-import * as cdktf from "cdktf";
-/*Provider bindings are generated by running cdktf get.
-See https://cdk.tf/provider-generation for more details.*/
-import * as aws from "./.gen/providers/aws";
-class MyConvertedCode extends cdktf.TerraformStack {
-  constructor(scope: constructs.Construct, name: string) {
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsEc2InstanceTypeOfferings } from "./.gen/providers/aws/data-aws-ec2-instance-type-offerings";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
     super(scope, name);
-    new aws.dataAwsEc2InstanceTypeOfferings.DataAwsEc2InstanceTypeOfferings(
-      this,
-      "example",
-      {
-        filter: [
-          {
-            name: "instance-type",
-            values: ["t2.micro", "t3.micro"],
-          },
-          {
-            name: "location",
-            values: ["usw2-az4"],
-          },
-        ],
-        locationType: "availability-zone-id",
-      }
-    );
+    new DataAwsEc2InstanceTypeOfferings(this, "example", {
+      filter: [
+        {
+          name: "instance-type",
+          values: ["t2.micro", "t3.micro"],
+        },
+        {
+          name: "location",
+          values: ["usw2-az4"],
+        },
+      ],
+      locationType: "availability-zone-id",
+    });
   }
 }
 
@@ -45,7 +46,7 @@ class MyConvertedCode extends cdktf.TerraformStack {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `filter` - (Optional) One or more configuration blocks containing name-values filters. See the [EC2 API Reference](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeInstanceTypeOfferings.html) for supported filters. Detailed below.
 * `locationType` - (Optional) Location type. Defaults to `region`. Valid values: `availabilityZone`, `availabilityZoneId`, and `region`.
@@ -57,7 +58,7 @@ The following arguments are supported:
 
 ## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - AWS Region.
 * `instanceTypes` - List of EC2 Instance Types.
@@ -72,4 +73,4 @@ Note that the indexes of Instance Type Offering instance types, locations and lo
 
 - `read` - (Default `20M`)
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-1ee018a194cbf08b7beed7fc665daba2fd81f7b8d3a928d9e68977514ac22388 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-b0fad9c4702cf5f0efa96a6a41ce0782d77f7dd1b5e2e01addf5aacedb2df2ba -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/ec2_instance_types.html.markdown b/website/docs/cdktf/typescript/d/ec2_instance_types.html.markdown
index bb586ca30ac..2741acf9ab5 100644
--- a/website/docs/cdktf/typescript/d/ec2_instance_types.html.markdown
+++ b/website/docs/cdktf/typescript/d/ec2_instance_types.html.markdown
@@ -6,6 +6,8 @@ description: |-
   Information about EC2 Instance Types.
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Data Source: aws_ec2_instance_types
 
 Information about EC2 Instance Types.
@@ -13,15 +15,18 @@ Information about EC2 Instance Types.
 ## Example Usage
 
 ```typescript
-import * as constructs from "constructs";
-import * as cdktf from "cdktf";
-/*Provider bindings are generated by running cdktf get.
-See https://cdk.tf/provider-generation for more details.*/
-import * as aws from "./.gen/providers/aws";
-class MyConvertedCode extends cdktf.TerraformStack {
-  constructor(scope: constructs.Construct, name: string) {
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsEc2InstanceTypes } from "./.gen/providers/aws/data-aws-ec2-instance-types";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
     super(scope, name);
-    new aws.dataAwsEc2InstanceTypes.DataAwsEc2InstanceTypes(this, "test", {
+    new DataAwsEc2InstanceTypes(this, "test", {
       filter: [
         {
           name: "auto-recovery-supported",
@@ -48,7 +53,7 @@ class MyConvertedCode extends cdktf.TerraformStack {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `filter` - (Optional) One or more configuration blocks containing name-values filters. See the [EC2 API Reference](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeInstanceTypes.html) for supported filters. Detailed below.
 
@@ -59,7 +64,7 @@ The following arguments are supported:
 
 ## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - AWS Region.
 * `instanceTypes` - List of EC2 Instance Types.
@@ -70,4 +75,4 @@ In addition to all arguments above, the following attributes are exported:
 
 - `read` - (Default `20M`)
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-5948af49a7b80d2c68167a564344d97e7d0a4780fb7397e6ec5945e26f7c7f9a -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-03e38077d0e2af0e80115aa30d25c82dfe7e6f8b184cc0e1b4e0116655ad11fb -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/ec2_local_gateway.html.markdown b/website/docs/cdktf/typescript/d/ec2_local_gateway.html.markdown
index e88cf56e10e..30caa6a4891 100644
--- a/website/docs/cdktf/typescript/d/ec2_local_gateway.html.markdown
+++ b/website/docs/cdktf/typescript/d/ec2_local_gateway.html.markdown
@@ -6,6 +6,8 @@ description: |-
     Provides details about an EC2 Local Gateway
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Data Source: aws_ec2_local_gateway
 
 Provides details about an EC2 Local Gateway.
@@ -15,22 +17,21 @@ Provides details about an EC2 Local Gateway.
 The following example shows how one might accept a local gateway id as a variable.
 
 ```typescript
-import * as constructs from "constructs";
-import * as cdktf from "cdktf";
-/*Provider bindings are generated by running cdktf get.
-See https://cdk.tf/provider-generation for more details.*/
-import * as aws from "./.gen/providers/aws";
-class MyConvertedCode extends cdktf.TerraformStack {
-  constructor(scope: constructs.Construct, name: string) {
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformVariable, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsEc2LocalGateway } from "./.gen/providers/aws/data-aws-ec2-local-gateway";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
     super(scope, name);
     /*Terraform Variables are not always the best fit for getting inputs in the context of Terraform CDK.
     You can read more about this at https://cdk.tf/variables*/
-    const localGatewayId = new cdktf.TerraformVariable(
-      this,
-      "local_gateway_id",
-      {}
-    );
-    new aws.dataAwsEc2LocalGateway.DataAwsEc2LocalGateway(this, "selected", {
+    const localGatewayId = new TerraformVariable(this, "local_gateway_id", {});
+    new DataAwsEc2LocalGateway(this, "selected", {
       id: localGatewayId.stringValue,
     });
   }
@@ -63,7 +64,7 @@ which take the following arguments:
 * `values` - (Required) Set of values that are accepted for the given field.
   A Local Gateway will be selected if any one of the given values matches.
 
-## Attributes Reference
+## Attribute Reference
 
 All of the argument attributes except `filter` blocks are also exported as
 result attributes. This data source will complete the data by populating
@@ -82,4 +83,4 @@ The following attributes are additionally exported:
 
 - `read` - (Default `20M`)
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-56eb53c0592b4dcc9d2d5a1f358fef5265a9b459052c09b2a04aaa3623ccf1be -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-e9224792e92736687e2ac8179a6512547c5aaa4078c6bb91db11fd714268b0ee -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/ec2_local_gateway_route_table.html.markdown b/website/docs/cdktf/typescript/d/ec2_local_gateway_route_table.html.markdown
index 0d7ff06c103..39fd5c25ef2 100644
--- a/website/docs/cdktf/typescript/d/ec2_local_gateway_route_table.html.markdown
+++ b/website/docs/cdktf/typescript/d/ec2_local_gateway_route_table.html.markdown
@@ -6,6 +6,8 @@ description: |-
     Provides details about an EC2 Local Gateway Route Table
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Data Source: aws_ec2_local_gateway_route_table
 
 Provides details about an EC2 Local Gateway Route Table.
@@ -18,28 +20,27 @@ an input variable and needs to, for example, find the associated Outpost or Loca
 The following example returns a specific local gateway route table ID
 
 ```typescript
-import * as constructs from "constructs";
-import * as cdktf from "cdktf";
-/*Provider bindings are generated by running cdktf get.
-See https://cdk.tf/provider-generation for more details.*/
-import * as aws from "./.gen/providers/aws";
-class MyConvertedCode extends cdktf.TerraformStack {
-  constructor(scope: constructs.Construct, name: string) {
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformVariable, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsEc2LocalGatewayRouteTable } from "./.gen/providers/aws/data-aws-ec2-local-gateway-route-table";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
     super(scope, name);
     /*Terraform Variables are not always the best fit for getting inputs in the context of Terraform CDK.
     You can read more about this at https://cdk.tf/variables*/
-    const awsEc2LocalGatewayRouteTable = new cdktf.TerraformVariable(
+    const awsEc2LocalGatewayRouteTable = new TerraformVariable(
       this,
       "aws_ec2_local_gateway_route_table",
       {}
     );
-    new aws.dataAwsEc2LocalGatewayRouteTable.DataAwsEc2LocalGatewayRouteTable(
-      this,
-      "selected",
-      {
-        localGatewayRouteTableId: awsEc2LocalGatewayRouteTable.stringValue,
-      }
-    );
+    new DataAwsEc2LocalGatewayRouteTable(this, "selected", {
+      localGatewayRouteTableId: awsEc2LocalGatewayRouteTable.stringValue,
+    });
   }
 }
 
@@ -77,4 +78,4 @@ which take the following arguments:
 
 - `read` - (Default `20M`)
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-659f40a3728960d4574b77039ecbc60a549c25ba6a774b2467023fef557a755a -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-659f40a3728960d4574b77039ecbc60a549c25ba6a774b2467023fef557a755a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/ec2_local_gateway_route_tables.html.markdown b/website/docs/cdktf/typescript/d/ec2_local_gateway_route_tables.html.markdown
index ebf9a5249d7..de0a2100fe6 100644
--- a/website/docs/cdktf/typescript/d/ec2_local_gateway_route_tables.html.markdown
+++ b/website/docs/cdktf/typescript/d/ec2_local_gateway_route_tables.html.markdown
@@ -6,6 +6,8 @@ description: |-
     Provides information for multiple EC2 Local Gateway Route Tables
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Data Source: aws_ec2_local_gateway_route_tables
 
 Provides information for multiple EC2 Local Gateway Route Tables, such as their identifiers.
@@ -15,22 +17,20 @@ Provides information for multiple EC2 Local Gateway Route Tables, such as their
 The following shows outputting all Local Gateway Route Table Ids.
 
 ```typescript
-import * as constructs from "constructs";
-import * as cdktf from "cdktf";
-/*Provider bindings are generated by running cdktf get.
-See https://cdk.tf/provider-generation for more details.*/
-import * as aws from "./.gen/providers/aws";
-class MyConvertedCode extends cdktf.TerraformStack {
-  constructor(scope: constructs.Construct, name: string) {
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformOutput, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsEc2LocalGatewayRouteTables } from "./.gen/providers/aws/data-aws-ec2-local-gateway-route-tables";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
     super(scope, name);
-    const dataAwsEc2LocalGatewayRouteTablesFoo =
-      new aws.dataAwsEc2LocalGatewayRouteTables.DataAwsEc2LocalGatewayRouteTables(
-        this,
-        "foo",
-        {}
-      );
-    const cdktfTerraformOutputFoo = new cdktf.TerraformOutput(this, "foo_1", {
-      value: dataAwsEc2LocalGatewayRouteTablesFoo.ids,
+    const foo = new DataAwsEc2LocalGatewayRouteTables(this, "foo", {});
+    const cdktfTerraformOutputFoo = new TerraformOutput(this, "foo_1", {
+      value: foo.ids,
     });
     /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
     cdktfTerraformOutputFoo.overrideLogicalId("foo");
@@ -55,7 +55,9 @@ which take the following arguments:
 * `values` - (Required) Set of values that are accepted for the given field.
   A Local Gateway Route Table will be selected if any one of the given values matches.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - AWS Region.
 * `ids` - Set of Local Gateway Route Table identifiers
@@ -66,4 +68,4 @@ which take the following arguments:
 
 - `read` - (Default `20M`)
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-6cee9559daa21ba439753064a3a6eb96fd5b6326abef88de2b9f66f02ac0770e -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-a7fa07e5df9221f1a1960ea3ec891c58f8a438a9471e6be0d1a428fa3ee9bed1 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/ec2_local_gateway_virtual_interface.html.markdown b/website/docs/cdktf/typescript/d/ec2_local_gateway_virtual_interface.html.markdown
index e03e15d73b0..6e4d27cfed5 100644
--- a/website/docs/cdktf/typescript/d/ec2_local_gateway_virtual_interface.html.markdown
+++ b/website/docs/cdktf/typescript/d/ec2_local_gateway_virtual_interface.html.markdown
@@ -6,18 +6,42 @@ description: |-
     Provides details about an EC2 Local Gateway Virtual Interface
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Data Source: aws_ec2_local_gateway_virtual_interface
 
 Provides details about an EC2 Local Gateway Virtual Interface. More information can be found in the [Outposts User Guide](https://docs.aws.amazon.com/outposts/latest/userguide/outposts-networking-components.html#routing).
 
 ## Example Usage
 
-```terraform
-data "aws_ec2_local_gateway_virtual_interface" "example" {
-  for_each = data.aws_ec2_local_gateway_virtual_interface_group.example.local_gateway_virtual_interface_ids
-
-  id = each.value
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformIterator, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsEc2LocalGatewayVirtualInterface } from "./.gen/providers/aws/data-aws-ec2-local-gateway-virtual-interface";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    /*In most cases loops should be handled in the programming language context and 
+    not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+    you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+    you need to keep this like it is.*/
+    const exampleForEachIterator = TerraformIterator.fromList(
+      Token.asAny(
+        dataAwsEc2LocalGatewayVirtualInterfaceGroupExample.localGatewayVirtualInterfaceIds
+      )
+    );
+    new DataAwsEc2LocalGatewayVirtualInterface(this, "example", {
+      id: Token.asString(exampleForEachIterator.value),
+      forEach: exampleForEachIterator,
+    });
+  }
 }
+
 ```
 
 ## Argument Reference
@@ -37,7 +61,7 @@ The `filter` configuration block supports the following arguments:
 
 ## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `localAddress` - Local address.
 * `localBgpAsn` - Border Gateway Protocol (BGP) Autonomous System Number (ASN) of the EC2 Local Gateway.
@@ -52,4 +76,4 @@ In addition to all arguments above, the following attributes are exported:
 
 - `read` - (Default `20M`)
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-8e096e1216ac507f824ce02a9ba18794bf5791c0f496d83b673af9b7c193c051 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-84b19b85b29b524237f0dba8dd0b0098f8acc444d8a902be6fcf51bfed3a262a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/ec2_local_gateway_virtual_interface_group.html.markdown b/website/docs/cdktf/typescript/d/ec2_local_gateway_virtual_interface_group.html.markdown
index b8eaa49f856..25d3da5d5da 100644
--- a/website/docs/cdktf/typescript/d/ec2_local_gateway_virtual_interface_group.html.markdown
+++ b/website/docs/cdktf/typescript/d/ec2_local_gateway_virtual_interface_group.html.markdown
@@ -6,16 +6,32 @@ description: |-
     Provides details about an EC2 Local Gateway Virtual Interface Group
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Data Source: aws_ec2_local_gateway_virtual_interface_group
 
 Provides details about an EC2 Local Gateway Virtual Interface Group. More information can be found in the [Outposts User Guide](https://docs.aws.amazon.com/outposts/latest/userguide/outposts-networking-components.html#routing).
 
 ## Example Usage
 
-```terraform
-data "aws_ec2_local_gateway_virtual_interface_group" "example" {
-  local_gateway_id = data.aws_ec2_local_gateway.example.id
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsEc2LocalGatewayVirtualInterfaceGroup } from "./.gen/providers/aws/data-aws-ec2-local-gateway-virtual-interface-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsEc2LocalGatewayVirtualInterfaceGroup(this, "example", {
+      localGatewayId: Token.asString(dataAwsEc2LocalGatewayExample.id),
+    });
+  }
 }
+
 ```
 
 ## Argument Reference
@@ -36,7 +52,7 @@ The `filter` configuration block supports the following arguments:
 
 ## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `localGatewayVirtualInterfaceIds` - Set of EC2 Local Gateway Virtual Interface identifiers.
 
@@ -46,4 +62,4 @@ In addition to all arguments above, the following attributes are exported:
 
 - `read` - (Default `20M`)
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-540e4780997710333dc225582410f2a266ebddd6e5fe16521de29c067a33a32d -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-5e2411b5d41b817a4357d5f458ca79618899e731412cbe0aaf57de8040137661 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/ec2_local_gateway_virtual_interface_groups.html.markdown b/website/docs/cdktf/typescript/d/ec2_local_gateway_virtual_interface_groups.html.markdown
index 72a97d90ebf..02944eccf13 100644
--- a/website/docs/cdktf/typescript/d/ec2_local_gateway_virtual_interface_groups.html.markdown
+++ b/website/docs/cdktf/typescript/d/ec2_local_gateway_virtual_interface_groups.html.markdown
@@ -6,6 +6,8 @@ description: |-
     Provides details about multiple EC2 Local Gateway Virtual Interface Groups
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Data Source: aws_ec2_local_gateway_virtual_interface_groups
 
 Provides details about multiple EC2 Local Gateway Virtual Interface Groups, such as identifiers. More information can be found in the [Outposts User Guide](https://docs.aws.amazon.com/outposts/latest/userguide/outposts-networking-components.html#routing).
@@ -13,19 +15,18 @@ Provides details about multiple EC2 Local Gateway Virtual Interface Groups, such
 ## Example Usage
 
 ```typescript
-import * as constructs from "constructs";
-import * as cdktf from "cdktf";
-/*Provider bindings are generated by running cdktf get.
-See https://cdk.tf/provider-generation for more details.*/
-import * as aws from "./.gen/providers/aws";
-class MyConvertedCode extends cdktf.TerraformStack {
-  constructor(scope: constructs.Construct, name: string) {
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsEc2LocalGatewayVirtualInterfaceGroups } from "./.gen/providers/aws/data-aws-ec2-local-gateway-virtual-interface-groups";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
     super(scope, name);
-    new aws.dataAwsEc2LocalGatewayVirtualInterfaceGroups.DataAwsEc2LocalGatewayVirtualInterfaceGroups(
-      this,
-      "all",
-      {}
-    );
+    new DataAwsEc2LocalGatewayVirtualInterfaceGroups(this, "all", {});
   }
 }
 
@@ -47,7 +48,7 @@ The `filter` configuration block supports the following arguments:
 
 ## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - AWS Region.
 * `ids` - Set of EC2 Local Gateway Virtual Interface Group identifiers.
@@ -59,4 +60,4 @@ In addition to all arguments above, the following attributes are exported:
 
 - `read` - (Default `20M`)
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-c7ad9cd4b80f965d2bf2e4d0d094399cc47edf44b5a28085f45c0ac3949e454a -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-cd5323f4e3c93b1fcf956785701876e0cd9b44a0db7f8464b46be04b9eacf2f4 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/ec2_local_gateways.html.markdown b/website/docs/cdktf/typescript/d/ec2_local_gateways.html.markdown
index 58e8d79ce11..b19259354ff 100644
--- a/website/docs/cdktf/typescript/d/ec2_local_gateways.html.markdown
+++ b/website/docs/cdktf/typescript/d/ec2_local_gateways.html.markdown
@@ -6,6 +6,8 @@ description: |-
     Provides information for multiple EC2 Local Gateways
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Data Source: aws_ec2_local_gateways
 
 Provides information for multiple EC2 Local Gateways, such as their identifiers.
@@ -15,22 +17,24 @@ Provides information for multiple EC2 Local Gateways, such as their identifiers.
 The following example retrieves Local Gateways with a resource tag of `service` set to `production`.
 
 ```typescript
-import * as constructs from "constructs";
-import * as cdktf from "cdktf";
-/*Provider bindings are generated by running cdktf get.
-See https://cdk.tf/provider-generation for more details.*/
-import * as aws from "./.gen/providers/aws";
-class MyConvertedCode extends cdktf.TerraformStack {
-  constructor(scope: constructs.Construct, name: string) {
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformOutput, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsEc2LocalGateways } from "./.gen/providers/aws/data-aws-ec2-local-gateways";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
     super(scope, name);
-    const dataAwsEc2LocalGatewaysFoo =
-      new aws.dataAwsEc2LocalGateways.DataAwsEc2LocalGateways(this, "foo", {
-        tags: {
-          service: "production",
-        },
-      });
-    const cdktfTerraformOutputFoo = new cdktf.TerraformOutput(this, "foo_1", {
-      value: dataAwsEc2LocalGatewaysFoo.ids,
+    const foo = new DataAwsEc2LocalGateways(this, "foo", {
+      tags: {
+        service: "production",
+      },
+    });
+    const cdktfTerraformOutputFoo = new TerraformOutput(this, "foo_1", {
+      value: foo.ids,
     });
     /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
     cdktfTerraformOutputFoo.overrideLogicalId("foo");
@@ -55,7 +59,9 @@ which take the following arguments:
 * `values` - (Required) Set of values that are accepted for the given field.
   A Local Gateway will be selected if any one of the given values matches.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - AWS Region.
 * `ids` - Set of all the Local Gateway identifiers
@@ -66,4 +72,4 @@ which take the following arguments:
 
 - `read` - (Default `20M`)
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-9165a57396230ff8a87e9418dc7e8806ac85629eb83283b59445620f46a229c8 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-194cd66e7dae043fd6ed1ab7524f3a069880d0040e7bff6c2c060f60274071f5 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/ec2_managed_prefix_list.html.markdown b/website/docs/cdktf/typescript/d/ec2_managed_prefix_list.html.markdown
index c33c136869d..85e7114229c 100644
--- a/website/docs/cdktf/typescript/d/ec2_managed_prefix_list.html.markdown
+++ b/website/docs/cdktf/typescript/d/ec2_managed_prefix_list.html.markdown
@@ -6,6 +6,8 @@ description: |-
     Provides details about a specific managed prefix list
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Data Source: aws_ec2_managed_prefix_list
 
 `awsEc2ManagedPrefixList` provides details about a specific AWS prefix list or
@@ -16,26 +18,22 @@ customer-managed prefix list in the current region.
 ### Find the regional DynamoDB prefix list
 
 ```typescript
-import * as constructs from "constructs";
-import * as cdktf from "cdktf";
-/*Provider bindings are generated by running cdktf get.
-See https://cdk.tf/provider-generation for more details.*/
-import * as aws from "./.gen/providers/aws";
-class MyConvertedCode extends cdktf.TerraformStack {
-  constructor(scope: constructs.Construct, name: string) {
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsEc2ManagedPrefixList } from "./.gen/providers/aws/data-aws-ec2-managed-prefix-list";
+import { DataAwsRegion } from "./.gen/providers/aws/data-aws-region";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
     super(scope, name);
-    const dataAwsRegionCurrent = new aws.dataAwsRegion.DataAwsRegion(
-      this,
-      "current",
-      {}
-    );
-    new aws.dataAwsEc2ManagedPrefixList.DataAwsEc2ManagedPrefixList(
-      this,
-      "example",
-      {
-        name: "com.amazonaws.${" + dataAwsRegionCurrent.name + "}.dynamodb",
-      }
-    );
+    const current = new DataAwsRegion(this, "current", {});
+    new DataAwsEc2ManagedPrefixList(this, "example", {
+      name: "com.amazonaws.${" + current.name + "}.dynamodb",
+    });
   }
 }
 
@@ -44,26 +42,25 @@ class MyConvertedCode extends cdktf.TerraformStack {
 ### Find a managed prefix list using filters
 
 ```typescript
-import * as constructs from "constructs";
-import * as cdktf from "cdktf";
-/*Provider bindings are generated by running cdktf get.
-See https://cdk.tf/provider-generation for more details.*/
-import * as aws from "./.gen/providers/aws";
-class MyConvertedCode extends cdktf.TerraformStack {
-  constructor(scope: constructs.Construct, name: string) {
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsEc2ManagedPrefixList } from "./.gen/providers/aws/data-aws-ec2-managed-prefix-list";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
     super(scope, name);
-    new aws.dataAwsEc2ManagedPrefixList.DataAwsEc2ManagedPrefixList(
-      this,
-      "example",
-      {
-        filter: [
-          {
-            name: "prefix-list-name",
-            values: ["my-prefix-list"],
-          },
-        ],
-      }
-    );
+    new DataAwsEc2ManagedPrefixList(this, "example", {
+      filter: [
+        {
+          name: "prefix-list-name",
+          values: ["my-prefix-list"],
+        },
+      ],
+    });
   }
 }
 
@@ -81,14 +78,14 @@ whose data will be exported as attributes.
 
 ### filter Configuration Block
 
-The following arguments are supported by the `filter` configuration block:
+The `filter` configuration block supports the following arguments:
 
 * `name` - (Required) Name of the filter field. Valid values can be found in the EC2 [DescribeManagedPrefixLists](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeManagedPrefixLists.html) API Reference.
 * `values` - (Required) Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - ID of the selected prefix list.
 * `arn` - ARN of the selected prefix list.
@@ -105,4 +102,4 @@ In addition to all arguments above, the following attributes are exported:
 
 - `read` - (Default `20M`)
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-3e3c72b875acdabeff222d7efc6381624218bdc684c16b8ec1c38859e1e80f26 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-cdbf4a9d93a044622eb9a1f8a3e9a7b0a043366fdd2b0bae53faf5879d45c641 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/ec2_managed_prefix_lists.html.markdown b/website/docs/cdktf/typescript/d/ec2_managed_prefix_lists.html.markdown
index e6269fd1ed3..c4381bd2380 100644
--- a/website/docs/cdktf/typescript/d/ec2_managed_prefix_lists.html.markdown
+++ b/website/docs/cdktf/typescript/d/ec2_managed_prefix_lists.html.markdown
@@ -6,6 +6,8 @@ description: |-
     Get information on managed prefix lists
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Data Source: aws_ec2_managed_prefix_lists
 
 This resource can be useful for getting back a list of managed prefix list ids to be referenced elsewhere.
@@ -15,45 +17,40 @@ This resource can be useful for getting back a list of managed prefix list ids t
 The following returns all managed prefix lists filtered by tags
 
 ```typescript
-import * as constructs from "constructs";
-import * as cdktf from "cdktf";
-/*Provider bindings are generated by running cdktf get.
-See https://cdk.tf/provider-generation for more details.*/
-import * as aws from "./.gen/providers/aws";
-class MyConvertedCode extends cdktf.TerraformStack {
-  constructor(scope: constructs.Construct, name: string) {
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformCount, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsEc2ManagedPrefixList } from "./.gen/providers/aws/data-aws-ec2-managed-prefix-list";
+import { DataAwsEc2ManagedPrefixLists } from "./.gen/providers/aws/data-aws-ec2-managed-prefix-lists";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
     super(scope, name);
-    const dataAwsEc2ManagedPrefixListsTestEnv =
-      new aws.dataAwsEc2ManagedPrefixLists.DataAwsEc2ManagedPrefixLists(
-        this,
-        "test_env",
-        {
-          tags: {
-            Env: "test",
-          },
-        }
-      );
+    const testEnv = new DataAwsEc2ManagedPrefixLists(this, "test_env", {
+      tags: {
+        Env: "test",
+      },
+    });
     /*In most cases loops should be handled in the programming language context and 
     not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
     you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
     you need to keep this like it is.*/
-    const dataAwsEc2ManagedPrefixListTestEnvCount = cdktf.TerraformCount.of(
-      cdktf.Fn.lengthOf(dataAwsEc2ManagedPrefixListsTestEnv.ids)
+    const testEnvCount = TerraformCount.of(
+      Token.asNumber(Fn.lengthOf(testEnv.ids))
+    );
+    const dataAwsEc2ManagedPrefixListTestEnv = new DataAwsEc2ManagedPrefixList(
+      this,
+      "test_env_1",
+      {
+        id: Token.asString(
+          Fn.lookupNested(Fn.tolist(testEnv.ids), [testEnvCount.index])
+        ),
+        count: testEnvCount,
+      }
     );
-    const dataAwsEc2ManagedPrefixListTestEnv =
-      new aws.dataAwsEc2ManagedPrefixList.DataAwsEc2ManagedPrefixList(
-        this,
-        "test_env_1",
-        {
-          id: cdktf.Token.asString(
-            cdktf.propertyAccess(
-              cdktf.Fn.tolist(dataAwsEc2ManagedPrefixListsTestEnv.ids),
-              [dataAwsEc2ManagedPrefixListTestEnvCount.index]
-            )
-          ),
-          count: dataAwsEc2ManagedPrefixListTestEnvCount,
-        }
-      );
     /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
     dataAwsEc2ManagedPrefixListTestEnv.overrideLogicalId("test_env");
   }
@@ -75,7 +72,9 @@ which take the following arguments:
 * `values` - (Required) Set of values that are accepted for the given field.
   A managed prefix list will be selected if any one of the given values matches.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - AWS Region.
 * `ids` - List of all the managed prefix list ids found.
@@ -86,4 +85,4 @@ which take the following arguments:
 
 - `read` - (Default `20M`)
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-34b67ee42a5e4e01675b0661ae691e66cc897092214d5887d7cc8ea40ac77b4a -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-145158f6b1f653afe1f39eba16c020b3a0c007043249f21a1109df310923bf6a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/ec2_network_insights_analysis.html.markdown b/website/docs/cdktf/typescript/d/ec2_network_insights_analysis.html.markdown
index 5427a4642e4..d79d33ccdb7 100644
--- a/website/docs/cdktf/typescript/d/ec2_network_insights_analysis.html.markdown
+++ b/website/docs/cdktf/typescript/d/ec2_network_insights_analysis.html.markdown
@@ -6,16 +6,34 @@ description: |-
     Provides details about a specific Network Insights Analysis.
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Data Source: aws_ec2_network_insights_analysis
 
 `awsEc2NetworkInsightsAnalysis` provides details about a specific Network Insights Analysis.
 
 ## Example Usage
 
-```terraform
-data "aws_ec2_network_insights_analysis" "example" {
-  network_insights_analysis_id = aws_ec2_network_insights_analysis.example.id
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsEc2NetworkInsightsAnalysis } from "./.gen/providers/aws/data-aws-ec2-network-insights-analysis";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsEc2NetworkInsightsAnalysis(this, "example", {
+      networkInsightsAnalysisId: Token.asString(
+        awsEc2NetworkInsightsAnalysisExample.id
+      ),
+    });
+  }
 }
+
 ```
 
 ## Argument Reference
@@ -29,14 +47,14 @@ whose data will be exported as attributes.
 
 ### filter Configuration Block
 
-The following arguments are supported by the `filter` configuration block:
+The `filter` configuration block supports the following arguments:
 
 * `name` - (Required) Name of the filter field. Valid values can be found in the EC2 [`describeNetworkInsightsAnalyses`](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeNetworkInsightsAnalyses.html) API Reference.
 * `values` - (Required) Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `alternatePathHints` - Potential intermediate components of a feasible path.
 * `arn` - ARN of the selected Network Insights Analysis.
@@ -51,4 +69,4 @@ In addition to all arguments above, the following attributes are exported:
 * `statusMessage` - Message to provide more context when the `status` is `failed`.
 * `warningMessage` - Warning message.
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-56159c91965c21fbdc8ca0c6f12ca5f32b05dec8d3bf96c00e582befed10c93b -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-d7f40f52a0f576e9ad55308a3c0b7c20a1611a5a4641eb6f08ff3a89153793e8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/ec2_network_insights_path.html.markdown b/website/docs/cdktf/typescript/d/ec2_network_insights_path.html.markdown
index 31db2845dcc..38f59c8fb13 100644
--- a/website/docs/cdktf/typescript/d/ec2_network_insights_path.html.markdown
+++ b/website/docs/cdktf/typescript/d/ec2_network_insights_path.html.markdown
@@ -6,16 +6,34 @@ description: |-
     Provides details about a specific Network Insights Path.
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Data Source: aws_ec2_network_insights_path
 
 `awsEc2NetworkInsightsPath` provides details about a specific Network Insights Path.
 
 ## Example Usage
 
-```terraform
-data "aws_ec2_network_insights_path" "example" {
-  network_insights_path_id = aws_ec2_network_insights_path.example.id
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsEc2NetworkInsightsPath } from "./.gen/providers/aws/data-aws-ec2-network-insights-path";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsEc2NetworkInsightsPath(this, "example", {
+      networkInsightsPathId: Token.asString(
+        awsEc2NetworkInsightsPathExample.id
+      ),
+    });
+  }
 }
+
 ```
 
 ## Argument Reference
@@ -29,22 +47,24 @@ whose data will be exported as attributes.
 
 ### filter Configuration Block
 
-The following arguments are supported by the `filter` configuration block:
+The `filter` configuration block supports the following arguments:
 
 * `name` - (Required) Name of the filter field. Valid values can be found in the EC2 [`describeNetworkInsightsPaths`](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeNetworkInsightsPaths.html) API Reference.
 * `values` - (Required) Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the selected Network Insights Path.
 * `destination` - AWS resource that is the destination of the path.
+* `destinationArn` - ARN of the destination.
 * `destinationIp` - IP address of the AWS resource that is the destination of the path.
 * `destinationPort` - Destination port.
 * `protocol` - Protocol.
 * `source` - AWS resource that is the source of the path.
+* `sourceArn` - ARN of the source.
 * `sourceIp` - IP address of the AWS resource that is the source of the path.
 * `tags` - Map of tags assigned to the resource.
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-017e47b8511c6e75a1a988c666c67e3fd15177c1f172912ddd91034adf7a15dc -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-445b5efe4c93146386518473af01d6da2f1f20f20f9a688cc7349f4a0720df0a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/ec2_public_ipv4_pool.html.markdown b/website/docs/cdktf/typescript/d/ec2_public_ipv4_pool.html.markdown
index c78106e05c8..0167481166a 100644
--- a/website/docs/cdktf/typescript/d/ec2_public_ipv4_pool.html.markdown
+++ b/website/docs/cdktf/typescript/d/ec2_public_ipv4_pool.html.markdown
@@ -6,6 +6,8 @@ description: |-
   Provides details about a specific AWS EC2 Public IPv4 Pool.
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Data Source: aws_ec2_public_ipv4_pool
 
 Provides details about a specific AWS EC2 Public IPv4 Pool.
@@ -15,15 +17,18 @@ Provides details about a specific AWS EC2 Public IPv4 Pool.
 ### Basic Usage
 
 ```typescript
-import * as constructs from "constructs";
-import * as cdktf from "cdktf";
-/*Provider bindings are generated by running cdktf get.
-See https://cdk.tf/provider-generation for more details.*/
-import * as aws from "./.gen/providers/aws";
-class MyConvertedCode extends cdktf.TerraformStack {
-  constructor(scope: constructs.Construct, name: string) {
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsEc2PublicIpv4Pool } from "./.gen/providers/aws/data-aws-ec2-public-ipv4-pool";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
     super(scope, name);
-    new aws.dataAwsEc2PublicIpv4Pool.DataAwsEc2PublicIpv4Pool(this, "example", {
+    new DataAwsEc2PublicIpv4Pool(this, "example", {
       poolId: "ipv4pool-ec2-000df99cff0c1ec10",
     });
   }
@@ -37,9 +42,9 @@ The following arguments are required:
 
 * `poolId` - (Required) AWS resource IDs of a public IPv4 pool (as a string) for which this data source will fetch detailed information.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `description` - Description of the pool, if any.
 * `networkBorderGroup` - Name of the location from which the address pool is advertised.
@@ -52,4 +57,4 @@ In addition to all arguments above, the following attributes are exported:
 * `totalAddressCount` - Total number of addresses in the pool.
 * `totalAvailableAddressCount` - Total number of available addresses in the pool.
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-6aa34590ccc7e3d0622ca88ec8ec1e0690413e3549fd336def6464c101e07acf -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-48bacd43b83d45d6042e5adf0821e82fae16e4191784bc09d4af47b05ff7cf8b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/ec2_public_ipv4_pools.html.markdown b/website/docs/cdktf/typescript/d/ec2_public_ipv4_pools.html.markdown
index c8b8ea41dd3..ad1a7d0c41d 100644
--- a/website/docs/cdktf/typescript/d/ec2_public_ipv4_pools.html.markdown
+++ b/website/docs/cdktf/typescript/d/ec2_public_ipv4_pools.html.markdown
@@ -6,6 +6,8 @@ description: |-
   Terraform data source for getting information about AWS EC2 Public IPv4 Pools.
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Data Source: aws_ec2_public_ipv4_pools
 
 Terraform data source for getting information about AWS EC2 Public IPv4 Pools.
@@ -15,19 +17,18 @@ Terraform data source for getting information about AWS EC2 Public IPv4 Pools.
 ### Basic Usage
 
 ```typescript
-import * as constructs from "constructs";
-import * as cdktf from "cdktf";
-/*Provider bindings are generated by running cdktf get.
-See https://cdk.tf/provider-generation for more details.*/
-import * as aws from "./.gen/providers/aws";
-class MyConvertedCode extends cdktf.TerraformStack {
-  constructor(scope: constructs.Construct, name: string) {
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsEc2PublicIpv4Pools } from "./.gen/providers/aws/data-aws-ec2-public-ipv4-pools";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
     super(scope, name);
-    new aws.dataAwsEc2PublicIpv4Pools.DataAwsEc2PublicIpv4Pools(
-      this,
-      "example",
-      {}
-    );
+    new DataAwsEc2PublicIpv4Pools(this, "example", {});
   }
 }
 
@@ -36,26 +37,25 @@ class MyConvertedCode extends cdktf.TerraformStack {
 ### Usage with Filter
 
 ```typescript
-import * as constructs from "constructs";
-import * as cdktf from "cdktf";
-/*Provider bindings are generated by running cdktf get.
-See https://cdk.tf/provider-generation for more details.*/
-import * as aws from "./.gen/providers/aws";
-class MyConvertedCode extends cdktf.TerraformStack {
-  constructor(scope: constructs.Construct, name: string) {
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsEc2PublicIpv4Pools } from "./.gen/providers/aws/data-aws-ec2-public-ipv4-pools";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
     super(scope, name);
-    new aws.dataAwsEc2PublicIpv4Pools.DataAwsEc2PublicIpv4Pools(
-      this,
-      "example",
-      {
-        filter: [
-          {
-            name: "tag-key",
-            values: ["ExampleTagKey"],
-          },
-        ],
-      }
-    );
+    new DataAwsEc2PublicIpv4Pools(this, "example", {
+      filter: [
+        {
+          name: "tag-key",
+          values: ["ExampleTagKey"],
+        },
+      ],
+    });
   }
 }
 
@@ -74,8 +74,10 @@ which take the following arguments:
 * `name` - (Required) Name of the field to filter by, as defined by [the underlying AWS API](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribePublicIpv4Pools.html).
 * `values` - (Required) Set of values that are accepted for the given field. Pool IDs will be selected if any one of the given values match.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `poolIds` - List of all the pool IDs found.
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-497fd23718e9c3019ac0aba9d1ed2938cf04039c3919e0576a2f4fa8b45cc047 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-422bc757fd116f1b140b124c51e19d025c4072d60b8ea9e265213b729b246ca5 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/ec2_serial_console_access.html.markdown b/website/docs/cdktf/typescript/d/ec2_serial_console_access.html.markdown
index 7e1b7114154..d960fb4b039 100644
--- a/website/docs/cdktf/typescript/d/ec2_serial_console_access.html.markdown
+++ b/website/docs/cdktf/typescript/d/ec2_serial_console_access.html.markdown
@@ -6,6 +6,8 @@ description: |-
   Checks whether serial console access is enabled for your AWS account in the current AWS region.
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Data Source: aws_ec2_serial_console_access
 
 Provides a way to check whether serial console access is enabled for your AWS account in the current AWS region.
@@ -13,27 +15,26 @@ Provides a way to check whether serial console access is enabled for your AWS ac
 ## Example Usage
 
 ```typescript
-import * as constructs from "constructs";
-import * as cdktf from "cdktf";
-/*Provider bindings are generated by running cdktf get.
-See https://cdk.tf/provider-generation for more details.*/
-import * as aws from "./.gen/providers/aws";
-class MyConvertedCode extends cdktf.TerraformStack {
-  constructor(scope: constructs.Construct, name: string) {
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsEc2SerialConsoleAccess } from "./.gen/providers/aws/data-aws-ec2-serial-console-access";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
     super(scope, name);
-    new aws.dataAwsEc2SerialConsoleAccess.DataAwsEc2SerialConsoleAccess(
-      this,
-      "current",
-      {}
-    );
+    new DataAwsEc2SerialConsoleAccess(this, "current", {});
   }
 }
 
 ```
 
-## Attributes Reference
+## Attribute Reference
 
-The following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `enabled` - Whether or not serial console access is enabled. Returns as `true` or `false`.
 * `id` - Region of serial console access.
@@ -44,4 +45,4 @@ The following attributes are exported:
 
 - `read` - (Default `20M`)
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-fd8b4f696d0f003aee2404884112394191a210b2ad4bf6aac54e22a791bee4ed -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-7d21124aaffd09332def089cd0e6c69fdfa0c5c94678ee766395bb6fc343430d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/ec2_spot_price.html.markdown b/website/docs/cdktf/typescript/d/ec2_spot_price.html.markdown
index 88c18ff7117..9600de7850f 100644
--- a/website/docs/cdktf/typescript/d/ec2_spot_price.html.markdown
+++ b/website/docs/cdktf/typescript/d/ec2_spot_price.html.markdown
@@ -6,6 +6,8 @@ description: |-
   Information about most recent Spot Price for a given EC2 instance.
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Data Source: aws_ec2_spot_price
 
 Information about most recent Spot Price for a given EC2 instance.
@@ -13,15 +15,18 @@ Information about most recent Spot Price for a given EC2 instance.
 ## Example Usage
 
 ```typescript
-import * as constructs from "constructs";
-import * as cdktf from "cdktf";
-/*Provider bindings are generated by running cdktf get.
-See https://cdk.tf/provider-generation for more details.*/
-import * as aws from "./.gen/providers/aws";
-class MyConvertedCode extends cdktf.TerraformStack {
-  constructor(scope: constructs.Construct, name: string) {
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsEc2SpotPrice } from "./.gen/providers/aws/data-aws-ec2-spot-price";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
     super(scope, name);
-    new aws.dataAwsEc2SpotPrice.DataAwsEc2SpotPrice(this, "example", {
+    new DataAwsEc2SpotPrice(this, "example", {
       availabilityZone: "us-west-2a",
       filter: [
         {
@@ -38,7 +43,7 @@ class MyConvertedCode extends cdktf.TerraformStack {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `instanceType` - (Optional) Type of instance for which to query Spot Price information.
 * `availabilityZone` - (Optional) Availability zone in which to query Spot price information.
@@ -51,7 +56,7 @@ The following arguments are supported:
 
 ## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - AWS Region.
 * `spotPrice` - Most recent Spot Price value for the given instance type and AZ.
@@ -63,4 +68,4 @@ In addition to all arguments above, the following attributes are exported:
 
 - `read` - (Default `20M`)
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-5f57429f9fe1e4ba33e515d8d643d119473ff58bb60dd4d219c499ffaa02b9c9 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-84288ca39edef310f32dba7504a9418ce015393e96eb2b8cc8a803eca06e4db4 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/ec2_transit_gateway.html.markdown b/website/docs/cdktf/typescript/d/ec2_transit_gateway.html.markdown
index b4dfa0c4ff7..c5b6689053d 100644
--- a/website/docs/cdktf/typescript/d/ec2_transit_gateway.html.markdown
+++ b/website/docs/cdktf/typescript/d/ec2_transit_gateway.html.markdown
@@ -6,6 +6,8 @@ description: |-
   Get information on an EC2 Transit Gateway
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Data Source: aws_ec2_transit_gateway
 
 Get information on an EC2 Transit Gateway.
@@ -15,15 +17,18 @@ Get information on an EC2 Transit Gateway.
 ### By Filter
 
 ```typescript
-import * as constructs from "constructs";
-import * as cdktf from "cdktf";
-/*Provider bindings are generated by running cdktf get.
-See https://cdk.tf/provider-generation for more details.*/
-import * as aws from "./.gen/providers/aws";
-class MyConvertedCode extends cdktf.TerraformStack {
-  constructor(scope: constructs.Construct, name: string) {
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsEc2TransitGateway } from "./.gen/providers/aws/data-aws-ec2-transit-gateway";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
     super(scope, name);
-    new aws.dataAwsEc2TransitGateway.DataAwsEc2TransitGateway(this, "example", {
+    new DataAwsEc2TransitGateway(this, "example", {
       filter: [
         {
           name: "options.amazon-side-asn",
@@ -39,15 +44,18 @@ class MyConvertedCode extends cdktf.TerraformStack {
 ### By Identifier
 
 ```typescript
-import * as constructs from "constructs";
-import * as cdktf from "cdktf";
-/*Provider bindings are generated by running cdktf get.
-See https://cdk.tf/provider-generation for more details.*/
-import * as aws from "./.gen/providers/aws";
-class MyConvertedCode extends cdktf.TerraformStack {
-  constructor(scope: constructs.Construct, name: string) {
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsEc2TransitGateway } from "./.gen/providers/aws/data-aws-ec2-transit-gateway";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
     super(scope, name);
-    new aws.dataAwsEc2TransitGateway.DataAwsEc2TransitGateway(this, "example", {
+    new DataAwsEc2TransitGateway(this, "example", {
       id: "tgw-12345678",
     });
   }
@@ -57,7 +65,7 @@ class MyConvertedCode extends cdktf.TerraformStack {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `filter` - (Optional) One or more configuration blocks containing name-values filters. Detailed below.
 * `id` - (Optional) Identifier of the EC2 Transit Gateway.
@@ -69,7 +77,7 @@ The following arguments are supported:
 
 ## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `amazonSideAsn` - Private Autonomous System Number (ASN) for the Amazon side of a BGP session
 * `arn` - EC2 Transit Gateway ARN
@@ -93,4 +101,4 @@ In addition to all arguments above, the following attributes are exported:
 
 - `read` - (Default `20M`)
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-e24eaaf1aa0b28a091689ddfaeaf01ceb3851faa3d8dd0eefba334e1fd10a072 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-ffa9ee3ddd9d388f5e2e15cbd5dbf081b080b3ce321303e9a320db13aad75c6f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/ec2_transit_gateway_attachment.html.markdown b/website/docs/cdktf/typescript/d/ec2_transit_gateway_attachment.html.markdown
index c6a362490e8..f40e158bc51 100644
--- a/website/docs/cdktf/typescript/d/ec2_transit_gateway_attachment.html.markdown
+++ b/website/docs/cdktf/typescript/d/ec2_transit_gateway_attachment.html.markdown
@@ -6,29 +6,46 @@ description: |-
   Get information on an EC2 Transit Gateway's attachment to a resource
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Data Source: aws_ec2_transit_gateway_attachment
 
 Get information on an EC2 Transit Gateway's attachment to a resource.
 
 ## Example Usage
 
-```terraform
-data "aws_ec2_transit_gateway_attachment" "example" {
-  filter {
-    name   = "transit-gateway-id"
-    values = [aws_ec2_transit_gateway.example.id]
-  }
-
-  filter {
-    name   = "resource-type"
-    values = ["peering"]
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsEc2TransitGatewayAttachment } from "./.gen/providers/aws/data-aws-ec2-transit-gateway-attachment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsEc2TransitGatewayAttachment(this, "example", {
+      filter: [
+        {
+          name: "transit-gateway-id",
+          values: [Token.asString(awsEc2TransitGatewayExample.id)],
+        },
+        {
+          name: "resource-type",
+          values: ["peering"],
+        },
+      ],
+    });
   }
 }
+
 ```
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `filter` - (Optional) One or more configuration blocks containing name-values filters. Detailed below.
 * `transitGatewayAttachmentId` - (Optional) ID of the attachment.
@@ -40,7 +57,7 @@ The following arguments are supported:
 
 ## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the attachment.
 * `associationState` - The state of the association (see [the underlying AWS API](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_TransitGatewayAttachmentAssociation.html) for valid values).
@@ -53,4 +70,4 @@ In addition to all arguments above, the following attributes are exported:
 * `transitGatewayId` - ID of the transit gateway.
 * `transitGatewayOwnerId` - The ID of the AWS account that owns the transit gateway.
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-1d6871537e0fdef0517b26c6418ac11cc1adeef6a7e98b29bb413da70c0a8517 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-855174ba9f5d7c6a547c955bd66cf3e3934a1b368d1480c66e0d166837fd5797 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/ec2_transit_gateway_attachments.html.markdown b/website/docs/cdktf/typescript/d/ec2_transit_gateway_attachments.html.markdown
index c48843e19d7..947b8328542 100644
--- a/website/docs/cdktf/typescript/d/ec2_transit_gateway_attachments.html.markdown
+++ b/website/docs/cdktf/typescript/d/ec2_transit_gateway_attachments.html.markdown
@@ -6,6 +6,8 @@ description: |-
   Get information on EC2 Transit Gateway Attachments
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Data Source: aws_ec2_transit_gateway_attachments
 
 Get information on EC2 Transit Gateway Attachments.
@@ -14,28 +16,50 @@ Get information on EC2 Transit Gateway Attachments.
 
 ### By Filter
 
-```hcl
-data "aws_ec2_transit_gateway_attachments" "filtered" {
-  filter {
-    name   = "state"
-    values = ["pendingAcceptance"]
-  }
-
-  filter {
-    name   = "resource-type"
-    values = ["vpc"]
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformCount, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsEc2TransitGatewayAttachment } from "./.gen/providers/aws/data-aws-ec2-transit-gateway-attachment";
+import { DataAwsEc2TransitGatewayAttachments } from "./.gen/providers/aws/data-aws-ec2-transit-gateway-attachments";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const filtered = new DataAwsEc2TransitGatewayAttachments(this, "filtered", {
+      filter: [
+        {
+          name: "state",
+          values: ["pendingAcceptance"],
+        },
+        {
+          name: "resource-type",
+          values: ["vpc"],
+        },
+      ],
+    });
+    /*In most cases loops should be handled in the programming language context and 
+    not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+    you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+    you need to keep this like it is.*/
+    const unitCount = TerraformCount.of(
+      Token.asNumber(Fn.lengthOf(filtered.ids))
+    );
+    new DataAwsEc2TransitGatewayAttachment(this, "unit", {
+      id: Token.asString(Fn.lookupNested(filtered.ids, [unitCount.index])),
+      count: unitCount,
+    });
   }
 }
 
-data "aws_ec2_transit_gateway_attachment" "unit" {
-  count = length(data.aws_ec2_transit_gateway_attachments.filtered.ids)
-  id    = data.aws_ec2_transit_gateway_attachments.filtered.ids[count.index]
-}
 ```
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `filter` - (Optional) One or more configuration blocks containing name-values filters. Detailed below.
 
@@ -46,7 +70,7 @@ The following arguments are supported:
 
 ## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `ids` A list of all attachments ids matching the filter. You can retrieve more information about the attachment using the [aws_ec2_transit_gateway_attachment][2] data source, searching by identifier.
 
@@ -59,4 +83,4 @@ In addition to all arguments above, the following attributes are exported:
 
 - `read` - (Default `20M`)
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-5aab4b9996d301d85a81444ffb46bbaa0a94e492c4d5d3b1c1df96c4c03b5905 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-d711b87a1b40869313a118f25c07038992c92b0b5b1accc3b33147f75288e032 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/ec2_transit_gateway_connect.html.markdown b/website/docs/cdktf/typescript/d/ec2_transit_gateway_connect.html.markdown
index cadcb3d6633..7ceb9350751 100644
--- a/website/docs/cdktf/typescript/d/ec2_transit_gateway_connect.html.markdown
+++ b/website/docs/cdktf/typescript/d/ec2_transit_gateway_connect.html.markdown
@@ -6,6 +6,8 @@ description: |-
   Get information on an EC2 Transit Gateway Connect
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Data Source: aws_ec2_transit_gateway_connect
 
 Get information on an EC2 Transit Gateway Connect.
@@ -15,26 +17,25 @@ Get information on an EC2 Transit Gateway Connect.
 ### By Filter
 
 ```typescript
-import * as constructs from "constructs";
-import * as cdktf from "cdktf";
-/*Provider bindings are generated by running cdktf get.
-See https://cdk.tf/provider-generation for more details.*/
-import * as aws from "./.gen/providers/aws";
-class MyConvertedCode extends cdktf.TerraformStack {
-  constructor(scope: constructs.Construct, name: string) {
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsEc2TransitGatewayConnect } from "./.gen/providers/aws/data-aws-ec2-transit-gateway-connect";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
     super(scope, name);
-    new aws.dataAwsEc2TransitGatewayConnect.DataAwsEc2TransitGatewayConnect(
-      this,
-      "example",
-      {
-        filter: [
-          {
-            name: "transport-transit-gateway-attachment-id",
-            values: ["tgw-attach-12345678"],
-          },
-        ],
-      }
-    );
+    new DataAwsEc2TransitGatewayConnect(this, "example", {
+      filter: [
+        {
+          name: "transport-transit-gateway-attachment-id",
+          values: ["tgw-attach-12345678"],
+        },
+      ],
+    });
   }
 }
 
@@ -43,21 +44,20 @@ class MyConvertedCode extends cdktf.TerraformStack {
 ### By Identifier
 
 ```typescript
-import * as constructs from "constructs";
-import * as cdktf from "cdktf";
-/*Provider bindings are generated by running cdktf get.
-See https://cdk.tf/provider-generation for more details.*/
-import * as aws from "./.gen/providers/aws";
-class MyConvertedCode extends cdktf.TerraformStack {
-  constructor(scope: constructs.Construct, name: string) {
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsEc2TransitGatewayConnect } from "./.gen/providers/aws/data-aws-ec2-transit-gateway-connect";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
     super(scope, name);
-    new aws.dataAwsEc2TransitGatewayConnect.DataAwsEc2TransitGatewayConnect(
-      this,
-      "example",
-      {
-        transitGatewayConnectId: "tgw-attach-12345678",
-      }
-    );
+    new DataAwsEc2TransitGatewayConnect(this, "example", {
+      transitGatewayConnectId: "tgw-attach-12345678",
+    });
   }
 }
 
@@ -65,7 +65,7 @@ class MyConvertedCode extends cdktf.TerraformStack {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `filter` - (Optional) One or more configuration blocks containing name-values filters. Detailed below.
 * `transitGatewayConnectId` - (Optional) Identifier of the EC2 Transit Gateway Connect.
@@ -77,7 +77,7 @@ The following arguments are supported:
 
 ## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `protocol` - Tunnel protocol
 * `tags` - Key-value tags for the EC2 Transit Gateway Connect
@@ -90,4 +90,4 @@ In addition to all arguments above, the following attributes are exported:
 
 - `read` - (Default `20M`)
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-e8f48ffb39a79e25f21e27492ff83b8d5204dffc24108324f1f587842ad3aa9e -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-9d1721683744b25e4682599f551444c6d51b4984d022443ff5e7b4565ef4e5bd -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/ec2_transit_gateway_connect_peer.html.markdown b/website/docs/cdktf/typescript/d/ec2_transit_gateway_connect_peer.html.markdown
index 8ea68196119..009114a5db2 100644
--- a/website/docs/cdktf/typescript/d/ec2_transit_gateway_connect_peer.html.markdown
+++ b/website/docs/cdktf/typescript/d/ec2_transit_gateway_connect_peer.html.markdown
@@ -6,6 +6,8 @@ description: |-
   Get information on an EC2 Transit Gateway Connect Peer
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Data Source: aws_ec2_transit_gateway_connect_peer
 
 Get information on an EC2 Transit Gateway Connect Peer.
@@ -15,26 +17,25 @@ Get information on an EC2 Transit Gateway Connect Peer.
 ### By Filter
 
 ```typescript
-import * as constructs from "constructs";
-import * as cdktf from "cdktf";
-/*Provider bindings are generated by running cdktf get.
-See https://cdk.tf/provider-generation for more details.*/
-import * as aws from "./.gen/providers/aws";
-class MyConvertedCode extends cdktf.TerraformStack {
-  constructor(scope: constructs.Construct, name: string) {
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsEc2TransitGatewayConnectPeer } from "./.gen/providers/aws/data-aws-ec2-transit-gateway-connect-peer";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
     super(scope, name);
-    new aws.dataAwsEc2TransitGatewayConnectPeer.DataAwsEc2TransitGatewayConnectPeer(
-      this,
-      "example",
-      {
-        filter: [
-          {
-            name: "transit-gateway-attachment-id",
-            values: ["tgw-attach-12345678"],
-          },
-        ],
-      }
-    );
+    new DataAwsEc2TransitGatewayConnectPeer(this, "example", {
+      filter: [
+        {
+          name: "transit-gateway-attachment-id",
+          values: ["tgw-attach-12345678"],
+        },
+      ],
+    });
   }
 }
 
@@ -43,21 +44,20 @@ class MyConvertedCode extends cdktf.TerraformStack {
 ### By Identifier
 
 ```typescript
-import * as constructs from "constructs";
-import * as cdktf from "cdktf";
-/*Provider bindings are generated by running cdktf get.
-See https://cdk.tf/provider-generation for more details.*/
-import * as aws from "./.gen/providers/aws";
-class MyConvertedCode extends cdktf.TerraformStack {
-  constructor(scope: constructs.Construct, name: string) {
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsEc2TransitGatewayConnectPeer } from "./.gen/providers/aws/data-aws-ec2-transit-gateway-connect-peer";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
     super(scope, name);
-    new aws.dataAwsEc2TransitGatewayConnectPeer.DataAwsEc2TransitGatewayConnectPeer(
-      this,
-      "example",
-      {
-        transitGatewayConnectPeerId: "tgw-connect-peer-12345678",
-      }
-    );
+    new DataAwsEc2TransitGatewayConnectPeer(this, "example", {
+      transitGatewayConnectPeerId: "tgw-connect-peer-12345678",
+    });
   }
 }
 
@@ -65,7 +65,7 @@ class MyConvertedCode extends cdktf.TerraformStack {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `filter` - (Optional) One or more configuration blocks containing name-values filters. Detailed below.
 * `transitGatewayConnectPeerId` - (Optional) Identifier of the EC2 Transit Gateway Connect Peer.
@@ -77,10 +77,12 @@ The following arguments are supported:
 
 ## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - EC2 Transit Gateway Connect Peer ARN
 * `bgpAsn` - BGP ASN number assigned customer device
+* `bgpPeerAddress` - The IP address assigned to customer device, which is used as BGP IP address.
+* `bgpTransitGatewayAddresses` - The IP addresses assigned to Transit Gateway, which are used as BGP IP addresses.
 * `insideCidrBlocks` - CIDR blocks that will be used for addressing within the tunnel.
 * `peerAddress` - IP addressed assigned to customer device, which is used as tunnel endpoint
 * `tags` - Key-value tags for the EC2 Transit Gateway Connect Peer
@@ -93,4 +95,4 @@ In addition to all arguments above, the following attributes are exported:
 
 - `read` - (Default `20M`)
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-8222b615e033f6fd67548f593586fe3af7c94748dd48b5242ba15bf81d464fe3 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-3bd4c9e7e6f26191e1ea71278ee4046a31a2441aa9d86a38639bf000e83931d8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/ec2_transit_gateway_dx_gateway_attachment.html.markdown b/website/docs/cdktf/typescript/d/ec2_transit_gateway_dx_gateway_attachment.html.markdown
index 10802b4f9c4..86740cae841 100644
--- a/website/docs/cdktf/typescript/d/ec2_transit_gateway_dx_gateway_attachment.html.markdown
+++ b/website/docs/cdktf/typescript/d/ec2_transit_gateway_dx_gateway_attachment.html.markdown
@@ -6,6 +6,8 @@ description: |-
   Get information on an EC2 Transit Gateway's attachment to a Direct Connect Gateway
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Data Source: aws_ec2_transit_gateway_dx_gateway_attachment
 
 Get information on an EC2 Transit Gateway's attachment to a Direct Connect Gateway.
@@ -14,16 +16,30 @@ Get information on an EC2 Transit Gateway's attachment to a Direct Connect Gatew
 
 ### By Transit Gateway and Direct Connect Gateway Identifiers
 
-```terraform
-data "aws_ec2_transit_gateway_dx_gateway_attachment" "example" {
-  transit_gateway_id = aws_ec2_transit_gateway.example.id
-  dx_gateway_id      = aws_dx_gateway.example.id
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsEc2TransitGatewayDxGatewayAttachment } from "./.gen/providers/aws/data-aws-ec2-transit-gateway-dx-gateway-attachment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsEc2TransitGatewayDxGatewayAttachment(this, "example", {
+      dxGatewayId: Token.asString(awsDxGatewayExample.id),
+      transitGatewayId: Token.asString(awsEc2TransitGatewayExample.id),
+    });
+  }
 }
+
 ```
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `transitGatewayId` - (Optional) Identifier of the EC2 Transit Gateway.
 * `dxGatewayId` - (Optional) Identifier of the Direct Connect Gateway.
@@ -32,14 +48,14 @@ The following arguments are supported:
 
 ### filter Configuration Block
 
-The following arguments are supported by the `filter` configuration block:
+The `filter` configuration block supports the following arguments:
 
 * `name` - (Required) Name of the filter field. Valid values can be found in the [EC2 DescribeTransitGatewayAttachments API Reference](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeTransitGatewayAttachments.html).
 * `values` - (Required) Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
 
 ## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - EC2 Transit Gateway Attachment identifier
 * `tags` - Key-value tags for the EC2 Transit Gateway Attachment
@@ -50,4 +66,4 @@ In addition to all arguments above, the following attributes are exported:
 
 - `read` - (Default `20M`)
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-24342787a3ce635e686cc7f106a91787a880dd41a77e294e579c6c74e8174823 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-b7236cdedf33b2a2beaa76c047f8a0d2b5a1cc86432e1675ff18f61961098d3d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/ec2_transit_gateway_multicast_domain.html.markdown b/website/docs/cdktf/typescript/d/ec2_transit_gateway_multicast_domain.html.markdown
index 5300c9ae90c..295600dee00 100644
--- a/website/docs/cdktf/typescript/d/ec2_transit_gateway_multicast_domain.html.markdown
+++ b/website/docs/cdktf/typescript/d/ec2_transit_gateway_multicast_domain.html.markdown
@@ -6,6 +6,8 @@ description: |-
   Get information on an EC2 Transit Gateway Multicast Domain
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Data Source: aws_ec2_transit_gateway_multicast_domain
 
 Get information on an EC2 Transit Gateway Multicast Domain.
@@ -15,26 +17,25 @@ Get information on an EC2 Transit Gateway Multicast Domain.
 ### By Filter
 
 ```typescript
-import * as constructs from "constructs";
-import * as cdktf from "cdktf";
-/*Provider bindings are generated by running cdktf get.
-See https://cdk.tf/provider-generation for more details.*/
-import * as aws from "./.gen/providers/aws";
-class MyConvertedCode extends cdktf.TerraformStack {
-  constructor(scope: constructs.Construct, name: string) {
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsEc2TransitGatewayMulticastDomain } from "./.gen/providers/aws/data-aws-ec2-transit-gateway-multicast-domain";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
     super(scope, name);
-    new aws.dataAwsEc2TransitGatewayMulticastDomain.DataAwsEc2TransitGatewayMulticastDomain(
-      this,
-      "example",
-      {
-        filter: [
-          {
-            name: "transit-gateway-multicast-domain-id",
-            values: ["tgw-mcast-domain-12345678"],
-          },
-        ],
-      }
-    );
+    new DataAwsEc2TransitGatewayMulticastDomain(this, "example", {
+      filter: [
+        {
+          name: "transit-gateway-multicast-domain-id",
+          values: ["tgw-mcast-domain-12345678"],
+        },
+      ],
+    });
   }
 }
 
@@ -43,21 +44,20 @@ class MyConvertedCode extends cdktf.TerraformStack {
 ### By Identifier
 
 ```typescript
-import * as constructs from "constructs";
-import * as cdktf from "cdktf";
-/*Provider bindings are generated by running cdktf get.
-See https://cdk.tf/provider-generation for more details.*/
-import * as aws from "./.gen/providers/aws";
-class MyConvertedCode extends cdktf.TerraformStack {
-  constructor(scope: constructs.Construct, name: string) {
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsEc2TransitGatewayMulticastDomain } from "./.gen/providers/aws/data-aws-ec2-transit-gateway-multicast-domain";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
     super(scope, name);
-    new aws.dataAwsEc2TransitGatewayMulticastDomain.DataAwsEc2TransitGatewayMulticastDomain(
-      this,
-      "example",
-      {
-        transitGatewayMulticastDomainId: "tgw-mcast-domain-12345678",
-      }
-    );
+    new DataAwsEc2TransitGatewayMulticastDomain(this, "example", {
+      transitGatewayMulticastDomainId: "tgw-mcast-domain-12345678",
+    });
   }
 }
 
@@ -65,7 +65,7 @@ class MyConvertedCode extends cdktf.TerraformStack {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `filter` - (Optional) One or more configuration blocks containing name-values filters. Detailed below.
 * `transitGatewayMulticastDomainId` - (Optional) Identifier of the EC2 Transit Gateway Multicast Domain.
@@ -81,7 +81,7 @@ The following arguments are required:
 
 ## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - EC2 Transit Gateway Multicast Domain identifier.
 * `arn` - EC2 Transit Gateway Multicast Domain ARN.
@@ -107,4 +107,4 @@ In addition to all arguments above, the following attributes are exported:
 
 - `read` - (Default `20M`)
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-7fcf121a6afa9b103a4a9aa8daf6635896a64eb12f56c34cc8bd881e1042d110 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-854de9a7e77b920dc2a59508efed1e997a904be759a67e383d582356d4c4d937 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/ec2_transit_gateway_peering_attachment.html.markdown b/website/docs/cdktf/typescript/d/ec2_transit_gateway_peering_attachment.html.markdown
index 48906585d84..e3ae028e642 100644
--- a/website/docs/cdktf/typescript/d/ec2_transit_gateway_peering_attachment.html.markdown
+++ b/website/docs/cdktf/typescript/d/ec2_transit_gateway_peering_attachment.html.markdown
@@ -6,6 +6,8 @@ description: |-
   Get information on an EC2 Transit Gateway Peering Attachment
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Data Source: aws_ec2_transit_gateway_peering_attachment
 
 Get information on an EC2 Transit Gateway Peering Attachment.
@@ -15,26 +17,25 @@ Get information on an EC2 Transit Gateway Peering Attachment.
 ### By Filter
 
 ```typescript
-import * as constructs from "constructs";
-import * as cdktf from "cdktf";
-/*Provider bindings are generated by running cdktf get.
-See https://cdk.tf/provider-generation for more details.*/
-import * as aws from "./.gen/providers/aws";
-class MyConvertedCode extends cdktf.TerraformStack {
-  constructor(scope: constructs.Construct, name: string) {
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsEc2TransitGatewayPeeringAttachment } from "./.gen/providers/aws/data-aws-ec2-transit-gateway-peering-attachment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
     super(scope, name);
-    new aws.dataAwsEc2TransitGatewayPeeringAttachment.DataAwsEc2TransitGatewayPeeringAttachment(
-      this,
-      "example",
-      {
-        filter: [
-          {
-            name: "transit-gateway-attachment-id",
-            values: ["tgw-attach-12345678"],
-          },
-        ],
-      }
-    );
+    new DataAwsEc2TransitGatewayPeeringAttachment(this, "example", {
+      filter: [
+        {
+          name: "transit-gateway-attachment-id",
+          values: ["tgw-attach-12345678"],
+        },
+      ],
+    });
   }
 }
 
@@ -43,21 +44,20 @@ class MyConvertedCode extends cdktf.TerraformStack {
 ### By Identifier
 
 ```typescript
-import * as constructs from "constructs";
-import * as cdktf from "cdktf";
-/*Provider bindings are generated by running cdktf get.
-See https://cdk.tf/provider-generation for more details.*/
-import * as aws from "./.gen/providers/aws";
-class MyConvertedCode extends cdktf.TerraformStack {
-  constructor(scope: constructs.Construct, name: string) {
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsEc2TransitGatewayPeeringAttachment } from "./.gen/providers/aws/data-aws-ec2-transit-gateway-peering-attachment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
     super(scope, name);
-    new aws.dataAwsEc2TransitGatewayPeeringAttachment.DataAwsEc2TransitGatewayPeeringAttachment(
-      this,
-      "attachment",
-      {
-        id: "tgw-attach-12345678",
-      }
-    );
+    new DataAwsEc2TransitGatewayPeeringAttachment(this, "attachment", {
+      id: "tgw-attach-12345678",
+    });
   }
 }
 
@@ -65,7 +65,7 @@ class MyConvertedCode extends cdktf.TerraformStack {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `filter` - (Optional) One or more configuration blocks containing name-values filters. Detailed below.
 * `id` - (Optional) Identifier of the EC2 Transit Gateway Peering Attachment.
@@ -82,7 +82,7 @@ which take the following arguments:
 
 ## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `peerAccountId` - Identifier of the peer AWS account
 * `peerRegion` - Identifier of the peer AWS region
@@ -95,4 +95,4 @@ In addition to all arguments above, the following attributes are exported:
 
 - `read` - (Default `20M`)
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-070f687dc6ea215734d45f7c1eda427968f4bc99d8b79e65dcd8d643efb5d83c -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-64a386696c78ec2309a46c70c800259471a55f51d87aca95430609381da1032a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/ec2_transit_gateway_route_table.html.markdown b/website/docs/cdktf/typescript/d/ec2_transit_gateway_route_table.html.markdown
index 08b3f7255b2..f54edacb405 100644
--- a/website/docs/cdktf/typescript/d/ec2_transit_gateway_route_table.html.markdown
+++ b/website/docs/cdktf/typescript/d/ec2_transit_gateway_route_table.html.markdown
@@ -6,6 +6,8 @@ description: |-
   Get information on an EC2 Transit Gateway Route Table
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Data Source: aws_ec2_transit_gateway_route_table
 
 Get information on an EC2 Transit Gateway Route Table.
@@ -15,30 +17,29 @@ Get information on an EC2 Transit Gateway Route Table.
 ### By Filter
 
 ```typescript
-import * as constructs from "constructs";
-import * as cdktf from "cdktf";
-/*Provider bindings are generated by running cdktf get.
-See https://cdk.tf/provider-generation for more details.*/
-import * as aws from "./.gen/providers/aws";
-class MyConvertedCode extends cdktf.TerraformStack {
-  constructor(scope: constructs.Construct, name: string) {
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsEc2TransitGatewayRouteTable } from "./.gen/providers/aws/data-aws-ec2-transit-gateway-route-table";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
     super(scope, name);
-    new aws.dataAwsEc2TransitGatewayRouteTable.DataAwsEc2TransitGatewayRouteTable(
-      this,
-      "example",
-      {
-        filter: [
-          {
-            name: "default-association-route-table",
-            values: ["true"],
-          },
-          {
-            name: "transit-gateway-id",
-            values: ["tgw-12345678"],
-          },
-        ],
-      }
-    );
+    new DataAwsEc2TransitGatewayRouteTable(this, "example", {
+      filter: [
+        {
+          name: "default-association-route-table",
+          values: ["true"],
+        },
+        {
+          name: "transit-gateway-id",
+          values: ["tgw-12345678"],
+        },
+      ],
+    });
   }
 }
 
@@ -47,21 +48,20 @@ class MyConvertedCode extends cdktf.TerraformStack {
 ### By Identifier
 
 ```typescript
-import * as constructs from "constructs";
-import * as cdktf from "cdktf";
-/*Provider bindings are generated by running cdktf get.
-See https://cdk.tf/provider-generation for more details.*/
-import * as aws from "./.gen/providers/aws";
-class MyConvertedCode extends cdktf.TerraformStack {
-  constructor(scope: constructs.Construct, name: string) {
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsEc2TransitGatewayRouteTable } from "./.gen/providers/aws/data-aws-ec2-transit-gateway-route-table";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
     super(scope, name);
-    new aws.dataAwsEc2TransitGatewayRouteTable.DataAwsEc2TransitGatewayRouteTable(
-      this,
-      "example",
-      {
-        id: "tgw-rtb-12345678",
-      }
-    );
+    new DataAwsEc2TransitGatewayRouteTable(this, "example", {
+      id: "tgw-rtb-12345678",
+    });
   }
 }
 
@@ -69,7 +69,7 @@ class MyConvertedCode extends cdktf.TerraformStack {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `filter` - (Optional) One or more configuration blocks containing name-values filters. Detailed below.
 * `id` - (Optional) Identifier of the EC2 Transit Gateway Route Table.
@@ -81,7 +81,7 @@ The following arguments are supported:
 
 ## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - EC2 Transit Gateway Route Table ARN.
 * `defaultAssociationRouteTable` - Boolean whether this is the default association route table for the EC2 Transit Gateway
@@ -96,4 +96,4 @@ In addition to all arguments above, the following attributes are exported:
 
 - `read` - (Default `20M`)
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-1208f03f1c84c0e2ce61d9b6b1a78aed169974d74a04009ae9e848da55024189 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-64c18727eda903f3fe0bc6e70c5f6f2c068e6f4cc7b9427d36d59676ca309a0a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/ec2_transit_gateway_route_table_associations.html.markdown b/website/docs/cdktf/typescript/d/ec2_transit_gateway_route_table_associations.html.markdown
index 962adeaeb85..dea7f9fdfd6 100644
--- a/website/docs/cdktf/typescript/d/ec2_transit_gateway_route_table_associations.html.markdown
+++ b/website/docs/cdktf/typescript/d/ec2_transit_gateway_route_table_associations.html.markdown
@@ -6,6 +6,8 @@ description: |-
    Provides information for multiple EC2 Transit Gateway Route Table Associations
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Data Source: aws_ec2_transit_gateway_route_table_associations
 
 Provides information for multiple EC2 Transit Gateway Route Table Associations, such as their identifiers.
@@ -14,10 +16,26 @@ Provides information for multiple EC2 Transit Gateway Route Table Associations,
 
 ### By Transit Gateway Identifier
 
-```terraform
-data "aws_ec2_transit_gateway_route_table_associations" "example" {
-  transit_gateway_route_table_id = aws_ec2_transit_gateway_route_table.example.id
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsEc2TransitGatewayRouteTableAssociations } from "./.gen/providers/aws/data-aws-ec2-transit-gateway-route-table-associations";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsEc2TransitGatewayRouteTableAssociations(this, "example", {
+      transitGatewayRouteTableId: Token.asString(
+        awsEc2TransitGatewayRouteTableExample.id
+      ),
+    });
+  }
 }
+
 ```
 
 ## Argument Reference
@@ -39,11 +57,11 @@ which take the following arguments:
 * `values` - (Required) Set of values that are accepted for the given field.
   A Transit Gateway Route Table will be selected if any one of the given values matches.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - AWS Region.
 * `ids` - Set of Transit Gateway Route Table Association identifiers.
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-f5431c712bc460939eff4f13ee315f6c314d3bbb3a79a668ec2278449b7548b6 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-bfa58264f45212830b07dd741569d6e94ca91a2bd3663b4e9cf46da0d1431ddd -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/ec2_transit_gateway_route_table_propagations.html.markdown b/website/docs/cdktf/typescript/d/ec2_transit_gateway_route_table_propagations.html.markdown
index 1cf37dfd563..b80039eaed3 100644
--- a/website/docs/cdktf/typescript/d/ec2_transit_gateway_route_table_propagations.html.markdown
+++ b/website/docs/cdktf/typescript/d/ec2_transit_gateway_route_table_propagations.html.markdown
@@ -6,6 +6,8 @@ description: |-
    Provides information for multiple EC2 Transit Gateway Route Table Propagations
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Data Source: aws_ec2_transitgateway_route_table_propagations
 
 Provides information for multiple EC2 Transit Gateway Route Table Propagations, such as their identifiers.
@@ -14,10 +16,26 @@ Provides information for multiple EC2 Transit Gateway Route Table Propagations,
 
 ### By Transit Gateway Identifier
 
-```terraform
-data "aws_ec2_transit_gateway_route_table_propagations" "example" {
-  transit_gateway_route_table_id = aws_ec2_transit_gateway_route_table.example.id
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsEc2TransitGatewayRouteTablePropagations } from "./.gen/providers/aws/data-aws-ec2-transit-gateway-route-table-propagations";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsEc2TransitGatewayRouteTablePropagations(this, "example", {
+      transitGatewayRouteTableId: Token.asString(
+        awsEc2TransitGatewayRouteTableExample.id
+      ),
+    });
+  }
 }
+
 ```
 
 ## Argument Reference
@@ -39,11 +57,11 @@ which take the following arguments:
 * `values` - (Required) Set of values that are accepted for the given field.
   A Transit Gateway Route Table will be selected if any one of the given values matches.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - AWS Region.
 * `ids` - Set of Transit Gateway Route Table Association identifiers.
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-a62abe28e531fd8e1af6114d984180c2997a6bff69c0a5c03d6e3a0644a3e17c -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-7e2c8e286fe68a0b28268b36f5ee1907ae2dd7e9634ec2582746d0b7fe00b544 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/ec2_transit_gateway_route_table_routes.html.markdown b/website/docs/cdktf/typescript/d/ec2_transit_gateway_route_table_routes.html.markdown
new file mode 100644
index 00000000000..8c2ac807a0a
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/ec2_transit_gateway_route_table_routes.html.markdown
@@ -0,0 +1,384 @@
+---
+subcategory: "Transit Gateway"
+layout: "aws"
+page_title: "AWS: aws_ec2_transit_gateway_route_table_routes"
+description: |-
+   Provides informations for routes of a specific transit gateway
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_ec2_transit_gateway_route_table_routes
+
+Provides informations for routes of a specific transit gateway, such as state, type, cidr
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsEc2TransitGatewayRouteTableRoutes } from "./.gen/providers/aws/data-aws-ec2-transit-gateway-route-table-routes";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsEc2TransitGatewayRouteTableRoutes(this, "test", {
+      filter: [
+        {
+          name: "type",
+          values: ["propagated"],
+        },
+      ],
+      transitGatewayRouteTableId: example.id,
+    });
+  }
+}
+
+```
+
+### Complexe use case with transit gateway peering
+
+This example allow to create a mesh of transit gateway for différent regions routing all traffic to on-prem VPN
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, Fn, TerraformIterator, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsEc2TransitGatewayRouteTableRoutes } from "./.gen/providers/aws/data-aws-ec2-transit-gateway-route-table-routes";
+import { DataAwsEc2TransitGatewayVpcAttachment } from "./.gen/providers/aws/data-aws-ec2-transit-gateway-vpc-attachment";
+import { DataAwsEc2TransitGatewayVpcAttachments } from "./.gen/providers/aws/data-aws-ec2-transit-gateway-vpc-attachments";
+import { Ec2TransitGateway } from "./.gen/providers/aws/ec2-transit-gateway";
+import { Ec2TransitGatewayPeeringAttachment } from "./.gen/providers/aws/ec2-transit-gateway-peering-attachment";
+import { Ec2TransitGatewayPeeringAttachmentAccepter } from "./.gen/providers/aws/ec2-transit-gateway-peering-attachment-accepter";
+import { Ec2TransitGatewayRoute } from "./.gen/providers/aws/ec2-transit-gateway-route";
+import { Ec2TransitGatewayRouteTable } from "./.gen/providers/aws/ec2-transit-gateway-route-table";
+import { Ec2TransitGatewayRouteTableAssociation } from "./.gen/providers/aws/ec2-transit-gateway-route-table-association";
+import { Ec2TransitGatewayRouteTablePropagation } from "./.gen/providers/aws/ec2-transit-gateway-route-table-propagation";
+import { Ec2TransitGatewayVpcAttachment } from "./.gen/providers/aws/ec2-transit-gateway-vpc-attachment";
+import { Ec2TransitGatewayVpcAttachmentAccepter } from "./.gen/providers/aws/ec2-transit-gateway-vpc-attachment-accepter";
+import { AwsProvider } from "./.gen/providers/aws/provider";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const euCentral1 = new AwsProvider(this, "aws", {
+      alias: "eu-central-1",
+      region: "eu-central-1",
+    });
+    const awsEc2TransitGatewayEuCentral1 = new Ec2TransitGateway(
+      this,
+      "eu-central-1",
+      {
+        defaultRouteTableAssociation: "disable",
+        defaultRouteTablePropagation: "disable",
+        provider: euCentral1,
+      }
+    );
+    const thisVar = new Ec2TransitGateway(this, "this", {
+      defaultRouteTableAssociation: "disable",
+      defaultRouteTablePropagation: "disable",
+    });
+    const awsEc2TransitGatewayPeeringAttachmentEuCentral1 =
+      new Ec2TransitGatewayPeeringAttachment(this, "eu-central-1_3", {
+        peerRegion: "eu-central-1",
+        peerTransitGatewayId: Token.asString(awsEc2TransitGatewayEuCentral1.id),
+        tags: {
+          Name: "TGW mesh from eu-central-1",
+        },
+        transitGatewayId: Token.asString(Fn.lookupNested(thisVar, ["0", "id"])),
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsEc2TransitGatewayPeeringAttachmentEuCentral1.overrideLogicalId(
+      "eu-central-1"
+    );
+    const awsEc2TransitGatewayPeeringAttachmentAccepterEuCentral1 =
+      new Ec2TransitGatewayPeeringAttachmentAccepter(this, "eu-central-1_4", {
+        provider: euCentral1,
+        tags: {
+          Name: "Accepter TGW peering eu-central-1",
+        },
+        transitGatewayAttachmentId: Token.asString(
+          awsEc2TransitGatewayPeeringAttachmentEuCentral1.id
+        ),
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsEc2TransitGatewayPeeringAttachmentAccepterEuCentral1.overrideLogicalId(
+      "eu-central-1"
+    );
+    const awsEc2TransitGatewayRouteTableEuCentral1 =
+      new Ec2TransitGatewayRouteTable(this, "eu-central-1_5", {
+        provider: euCentral1,
+        tags: Token.asStringMap(
+          Fn.merge([
+            {
+              Name: "wl-transit-gateway-routetable-eu-central-1",
+            },
+            globalTags,
+          ])
+        ),
+        transitGatewayId: Token.asString(awsEc2TransitGatewayEuCentral1.id),
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsEc2TransitGatewayRouteTableEuCentral1.overrideLogicalId("eu-central-1");
+    const awsEc2TransitGatewayRouteTableThis = new Ec2TransitGatewayRouteTable(
+      this,
+      "this_6",
+      {
+        transitGatewayId: myTransitGatewayId,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsEc2TransitGatewayRouteTableThis.overrideLogicalId("this");
+    new Ec2TransitGatewayRouteTableAssociation(this, "vpn", {
+      transitGatewayAttachmentId: Token.asString(
+        Fn.lookupNested(awsVpnConnectionThis, [
+          "0",
+          "transit_gateway_attachment_id",
+        ])
+      ),
+      transitGatewayRouteTableId: myTransitGatewayIdRouteTable,
+    });
+    const awsEc2TransitGatewayRouteTablePropagationVpn =
+      new Ec2TransitGatewayRouteTablePropagation(this, "vpn_8", {
+        transitGatewayAttachmentId: Token.asString(
+          Fn.lookupNested(awsVpnConnectionThis, [
+            "0",
+            "transit_gateway_attachment_id",
+          ])
+        ),
+        transitGatewayRouteTableId: Token.asString(
+          awsEc2TransitGatewayRouteTableThis.id
+        ),
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsEc2TransitGatewayRouteTablePropagationVpn.overrideLogicalId("vpn");
+    const awsEc2TransitGatewayVpcAttachmentThis =
+      new Ec2TransitGatewayVpcAttachment(this, "this_9", {
+        dependsOn: [private, public],
+        subnetIds: Token.asList("${[ for s in ${" + private.fqn + "} : s.id]}"),
+        transitGatewayDefaultRouteTableAssociation: false,
+        transitGatewayDefaultRouteTablePropagation: false,
+        transitGatewayId: Token.asString(Fn.lookupNested(thisVar, ["0", "id"])),
+        vpcId: Token.asString(awsVpcThis.id),
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsEc2TransitGatewayVpcAttachmentThis.overrideLogicalId("this");
+    const filteredEuCentral1 = new DataAwsEc2TransitGatewayVpcAttachments(
+      this,
+      "filtered-eu-central-1",
+      {
+        filter: [
+          {
+            name: "state",
+            values: ["pendingAcceptance", "available"],
+          },
+        ],
+        provider: euCentral1,
+      }
+    );
+    new Ec2TransitGatewayRouteTableAssociation(this, "vpc", {
+      transitGatewayAttachmentId: Token.asString(
+        awsEc2TransitGatewayVpcAttachmentThis.id
+      ),
+      transitGatewayRouteTableId: myTransitGatewayIdRouteTable,
+    });
+    const awsEc2TransitGatewayRouteTablePropagationVpc =
+      new Ec2TransitGatewayRouteTablePropagation(this, "vpc_12", {
+        transitGatewayAttachmentId: Token.asString(
+          awsEc2TransitGatewayVpcAttachmentThis.id
+        ),
+        transitGatewayRouteTableId: Token.asString(
+          awsEc2TransitGatewayRouteTableThis.id
+        ),
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsEc2TransitGatewayRouteTablePropagationVpc.overrideLogicalId("vpc");
+    /*In most cases loops should be handled in the programming language context and 
+    not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+    you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+    you need to keep this like it is.*/
+    const unitEuCentral1ForEachIterator = TerraformIterator.fromList(
+      Token.asAny(Fn.toset(filteredEuCentral1.ids))
+    );
+    const unitEuCentral1 = new DataAwsEc2TransitGatewayVpcAttachment(
+      this,
+      "unit-eu-central-1",
+      {
+        id: Token.asString(unitEuCentral1ForEachIterator.value),
+        provider: euCentral1,
+        forEach: unitEuCentral1ForEachIterator,
+      }
+    );
+    const trustedVpcAttachmentsListEuCentral1 = Fn.compact(
+      Token.asList(
+        "${[ for k, tva in ${" +
+          unitEuCentral1.fqn +
+          '} : contains(local.trusted_aws_accounts_ids, lookup(tva, "vpc_owner_id", "")) ? tva.id : ""]}'
+      )
+    );
+    const trustedVpcAttachementsEuCentral1 = Fn.toset(
+      Fn.sort(Token.asList(trustedVpcAttachmentsListEuCentral1))
+    );
+    /*In most cases loops should be handled in the programming language context and 
+    not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+    you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+    you need to keep this like it is.*/
+    const trustedAccountsEuCentral1TgwForEachIterator =
+      TerraformIterator.fromList(Token.asAny(trustedVpcAttachementsEuCentral1));
+    const trustedAccountsEuCentral1Tgw =
+      new Ec2TransitGatewayVpcAttachmentAccepter(
+        this,
+        "trusted_accounts_eu-central-1_tgw",
+        {
+          lifecycle: {
+            ignoreChanges: [
+              subnetIds,
+              id,
+              dnsSupport,
+              ipv6Support,
+              transitGatewayId,
+              vpcId,
+              vpcOwnerId,
+            ],
+            preventDestroy: false,
+          },
+          provider: euCentral1,
+          tags: Token.asStringMap(globalTags),
+          transitGatewayAttachmentId: Token.asString(
+            trustedAccountsEuCentral1TgwForEachIterator.value
+          ),
+          transitGatewayDefaultRouteTableAssociation: false,
+          transitGatewayDefaultRouteTablePropagation: false,
+          forEach: trustedAccountsEuCentral1TgwForEachIterator,
+        }
+      );
+    /*In most cases loops should be handled in the programming language context and 
+    not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+    you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+    you need to keep this like it is.*/
+    const trustedAccountsEuCentral1ForEachIterator = TerraformIterator.fromList(
+      Token.asAny(trustedAccountsEuCentral1Tgw)
+    );
+    new Ec2TransitGatewayRouteTableAssociation(
+      this,
+      "trusted_accounts_eu-central-1",
+      {
+        provider: euCentral1,
+        transitGatewayAttachmentId: Token.asString(
+          Fn.lookupNested(trustedAccountsEuCentral1ForEachIterator.value, [
+            "transit_gateway_attachment_id",
+          ])
+        ),
+        transitGatewayRouteTableId: Token.asString(
+          awsEc2TransitGatewayRouteTableEuCentral1.id
+        ),
+        forEach: trustedAccountsEuCentral1ForEachIterator,
+      }
+    );
+    /*In most cases loops should be handled in the programming language context and 
+    not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+    you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+    you need to keep this like it is.*/
+    const awsEc2TransitGatewayRouteTablePropagationTrustedAccountsEuCentral1ForEachIterator =
+      TerraformIterator.fromList(Token.asAny(trustedAccountsEuCentral1Tgw));
+    const awsEc2TransitGatewayRouteTablePropagationTrustedAccountsEuCentral1 =
+      new Ec2TransitGatewayRouteTablePropagation(
+        this,
+        "trusted_accounts_eu-central-1_16",
+        {
+          provider: euCentral1,
+          transitGatewayAttachmentId: Token.asString(
+            Fn.lookupNested(
+              awsEc2TransitGatewayRouteTablePropagationTrustedAccountsEuCentral1ForEachIterator.value,
+              ["transit_gateway_attachment_id"]
+            )
+          ),
+          transitGatewayRouteTableId: Token.asString(
+            awsEc2TransitGatewayRouteTableEuCentral1.id
+          ),
+          forEach:
+            awsEc2TransitGatewayRouteTablePropagationTrustedAccountsEuCentral1ForEachIterator,
+        }
+      );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsEc2TransitGatewayRouteTablePropagationTrustedAccountsEuCentral1.overrideLogicalId(
+      "trusted_accounts_eu-central-1"
+    );
+    const test = new DataAwsEc2TransitGatewayRouteTableRoutes(this, "test", {
+      dependsOn: [
+        awsEc2TransitGatewayRouteTablePropagationTrustedAccountsEuCentral1,
+      ],
+      filter: [
+        {
+          name: "type",
+          values: ["propagated"],
+        },
+      ],
+      provider: euCentral1,
+      transitGatewayRouteTableId: Token.asString(
+        awsEc2TransitGatewayRouteTableEuCentral1.id
+      ),
+    });
+    /*In most cases loops should be handled in the programming language context and 
+    not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+    you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+    you need to keep this like it is.*/
+    const defaultRegionToEuCentral1ForEachIterator = TerraformIterator.fromList(
+      Token.asAny(
+        "${{ for r in ${" + test.routes + "} : r.destination_cidr_block => r}}"
+      )
+    );
+    new Ec2TransitGatewayRoute(this, "default-region-to-eu-central-1", {
+      destinationCidrBlock: Token.asString(
+        defaultRegionToEuCentral1ForEachIterator.key
+      ),
+      transitGatewayAttachmentId: Token.asString(
+        awsEc2TransitGatewayPeeringAttachmentEuCentral1.id
+      ),
+      transitGatewayRouteTableId: Token.asString(
+        awsEc2TransitGatewayRouteTableThis.id
+      ),
+      forEach: defaultRegionToEuCentral1ForEachIterator,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `filter` - (Required) Custom filter block as described below.
+* `transitGatewayRouteTableId` - (Required) Identifier of EC2 Transit Gateway Route Table.
+
+More complex filters can be expressed using one or more `filter` sub-blocks,
+which take the following arguments:
+
+* `name` - (Required) Name of the field to filter by, as defined by
+  [the underlying AWS API](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_SearchTransitGatewayRoutes.html).
+* `values` - (Required) Set of values that are accepted for the given field.
+
+## Attributes Reference
+
+In addition to all arguments above, the following attributes are exported:
+
+* `id` - The transit gateway route table id suffixed by `routes`
+* `routes` - List of Transit Gateway Routes.
+
+#### Routes list Attributes Reference
+
+* `destinationCidrBlock` - The CIDR used for route destination matches.
+* `prefixListId` - The ID of the prefix list used for destination matches.
+* `state` - The current state of the route, can be `active`, `deleted`, `pending`, `blackhole`, `deleting`.
+* `transitGatewayRouteTableAnnouncementId` - The id of the transit gateway route table announcement, most of the time it is an empty string.
+* `type` - The type of the route, can be `propagated` or `static`.
+
+<!-- cache-key: cdktf-0.18.0 input-5fba265cc145ada0235efec26c10c79f01ec5384ee918cc84a3f6d087ffa07e0 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/ec2_transit_gateway_route_tables.html.markdown b/website/docs/cdktf/typescript/d/ec2_transit_gateway_route_tables.html.markdown
index 77961c10613..f569527932a 100644
--- a/website/docs/cdktf/typescript/d/ec2_transit_gateway_route_tables.html.markdown
+++ b/website/docs/cdktf/typescript/d/ec2_transit_gateway_route_tables.html.markdown
@@ -6,6 +6,8 @@ description: |-
    Provides information for multiple EC2 Transit Gateway Route Tables
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Data Source: aws_ec2_transit_gateway_route_tables
 
 Provides information for multiple EC2 Transit Gateway Route Tables, such as their identifiers.
@@ -14,17 +16,36 @@ Provides information for multiple EC2 Transit Gateway Route Tables, such as thei
 
 The following shows outputting all Transit Gateway Route Table Ids.
 
-```terraform
-data "aws_ec2_transit_gateway_route_tables" "example" {}
-
-output "example" {
-  value = data.aws_ec2_transit_gateway_route_table.example.ids
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformOutput, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsEc2TransitGatewayRouteTables } from "./.gen/providers/aws/data-aws-ec2-transit-gateway-route-tables";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new DataAwsEc2TransitGatewayRouteTables(
+      this,
+      "example",
+      {}
+    );
+    const cdktfTerraformOutputExample = new TerraformOutput(this, "example_1", {
+      value: example.ids,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    cdktfTerraformOutputExample.overrideLogicalId("example");
+  }
 }
+
 ```
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `filter` - (Optional) Custom filter block as described below.
 
@@ -40,9 +61,9 @@ which take the following arguments:
 * `values` - (Required) Set of values that are accepted for the given field.
   A Transit Gateway Route Table will be selected if any one of the given values matches.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - AWS Region.
 * `ids` - Set of Transit Gateway Route Table identifiers.
@@ -53,4 +74,4 @@ In addition to all arguments above, the following attributes are exported:
 
 - `read` - (Default `20M`)
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-21b354be5ff1a820230b37a47d13e1da6f5225ba42571d63d85a355c468318aa -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-dd6ce3b8d03c97c0be1c62a1eb6f7e48e7f33a7530f057628e07baf248805ae7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/ec2_transit_gateway_vpc_attachment.html.markdown b/website/docs/cdktf/typescript/d/ec2_transit_gateway_vpc_attachment.html.markdown
index 22e76d5a21a..063f891d9de 100644
--- a/website/docs/cdktf/typescript/d/ec2_transit_gateway_vpc_attachment.html.markdown
+++ b/website/docs/cdktf/typescript/d/ec2_transit_gateway_vpc_attachment.html.markdown
@@ -6,6 +6,8 @@ description: |-
   Get information on an EC2 Transit Gateway VPC Attachment
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Data Source: aws_ec2_transit_gateway_vpc_attachment
 
 Get information on an EC2 Transit Gateway VPC Attachment.
@@ -15,26 +17,25 @@ Get information on an EC2 Transit Gateway VPC Attachment.
 ### By Filter
 
 ```typescript
-import * as constructs from "constructs";
-import * as cdktf from "cdktf";
-/*Provider bindings are generated by running cdktf get.
-See https://cdk.tf/provider-generation for more details.*/
-import * as aws from "./.gen/providers/aws";
-class MyConvertedCode extends cdktf.TerraformStack {
-  constructor(scope: constructs.Construct, name: string) {
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsEc2TransitGatewayVpcAttachment } from "./.gen/providers/aws/data-aws-ec2-transit-gateway-vpc-attachment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
     super(scope, name);
-    new aws.dataAwsEc2TransitGatewayVpcAttachment.DataAwsEc2TransitGatewayVpcAttachment(
-      this,
-      "example",
-      {
-        filter: [
-          {
-            name: "vpc-id",
-            values: ["vpc-12345678"],
-          },
-        ],
-      }
-    );
+    new DataAwsEc2TransitGatewayVpcAttachment(this, "example", {
+      filter: [
+        {
+          name: "vpc-id",
+          values: ["vpc-12345678"],
+        },
+      ],
+    });
   }
 }
 
@@ -43,21 +44,20 @@ class MyConvertedCode extends cdktf.TerraformStack {
 ### By Identifier
 
 ```typescript
-import * as constructs from "constructs";
-import * as cdktf from "cdktf";
-/*Provider bindings are generated by running cdktf get.
-See https://cdk.tf/provider-generation for more details.*/
-import * as aws from "./.gen/providers/aws";
-class MyConvertedCode extends cdktf.TerraformStack {
-  constructor(scope: constructs.Construct, name: string) {
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsEc2TransitGatewayVpcAttachment } from "./.gen/providers/aws/data-aws-ec2-transit-gateway-vpc-attachment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
     super(scope, name);
-    new aws.dataAwsEc2TransitGatewayVpcAttachment.DataAwsEc2TransitGatewayVpcAttachment(
-      this,
-      "example",
-      {
-        id: "tgw-attach-12345678",
-      }
-    );
+    new DataAwsEc2TransitGatewayVpcAttachment(this, "example", {
+      id: "tgw-attach-12345678",
+    });
   }
 }
 
@@ -65,7 +65,7 @@ class MyConvertedCode extends cdktf.TerraformStack {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `filter` - (Optional) One or more configuration blocks containing name-values filters. Detailed below.
 * `id` - (Optional) Identifier of the EC2 Transit Gateway VPC Attachment.
@@ -77,7 +77,7 @@ The following arguments are supported:
 
 ## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `applianceModeSupport` - Whether Appliance Mode support is enabled.
 * `dnsSupport` - Whether DNS support is enabled.
@@ -95,4 +95,4 @@ In addition to all arguments above, the following attributes are exported:
 
 - `read` - (Default `20M`)
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-d9a7b3de207778ae6262226683d82d8cf55a2755353a69faa2211b11f09ae695 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-1163f41ecbd71e0e8d7980fd48db7828f6a894bd96414a472ab369bf6fdfcc81 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/ec2_transit_gateway_vpc_attachments.html.markdown b/website/docs/cdktf/typescript/d/ec2_transit_gateway_vpc_attachments.html.markdown
index 1d2b67dd3a2..f24ca024456 100644
--- a/website/docs/cdktf/typescript/d/ec2_transit_gateway_vpc_attachments.html.markdown
+++ b/website/docs/cdktf/typescript/d/ec2_transit_gateway_vpc_attachments.html.markdown
@@ -6,6 +6,8 @@ description: |-
   Get information on EC2 Transit Gateway VPC Attachments
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Data Source: aws_ec2_transit_gateway_vpc_attachments
 
 Get information on EC2 Transit Gateway VPC Attachments.
@@ -15,48 +17,41 @@ Get information on EC2 Transit Gateway VPC Attachments.
 ### By Filter
 
 ```typescript
-import * as constructs from "constructs";
-import * as cdktf from "cdktf";
-/*Provider bindings are generated by running cdktf get.
-See https://cdk.tf/provider-generation for more details.*/
-import * as aws from "./.gen/providers/aws";
-class MyConvertedCode extends cdktf.TerraformStack {
-  constructor(scope: constructs.Construct, name: string) {
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformCount, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsEc2TransitGatewayVpcAttachment } from "./.gen/providers/aws/data-aws-ec2-transit-gateway-vpc-attachment";
+import { DataAwsEc2TransitGatewayVpcAttachments } from "./.gen/providers/aws/data-aws-ec2-transit-gateway-vpc-attachments";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
     super(scope, name);
-    const dataAwsEc2TransitGatewayVpcAttachmentsFiltered =
-      new aws.dataAwsEc2TransitGatewayVpcAttachments.DataAwsEc2TransitGatewayVpcAttachments(
-        this,
-        "filtered",
-        {
-          filter: [
-            {
-              name: "state",
-              values: ["pendingAcceptance"],
-            },
-          ],
-        }
-      );
+    const filtered = new DataAwsEc2TransitGatewayVpcAttachments(
+      this,
+      "filtered",
+      {
+        filter: [
+          {
+            name: "state",
+            values: ["pendingAcceptance"],
+          },
+        ],
+      }
+    );
     /*In most cases loops should be handled in the programming language context and 
     not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
     you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
     you need to keep this like it is.*/
-    const dataAwsEc2TransitGatewayVpcAttachmentUnitCount =
-      cdktf.TerraformCount.of(
-        cdktf.Fn.lengthOf(dataAwsEc2TransitGatewayVpcAttachmentsFiltered.ids)
-      );
-    new aws.dataAwsEc2TransitGatewayVpcAttachment.DataAwsEc2TransitGatewayVpcAttachment(
-      this,
-      "unit",
-      {
-        id: cdktf.Token.asString(
-          cdktf.propertyAccess(
-            dataAwsEc2TransitGatewayVpcAttachmentsFiltered.ids,
-            [dataAwsEc2TransitGatewayVpcAttachmentUnitCount.index]
-          )
-        ),
-        count: dataAwsEc2TransitGatewayVpcAttachmentUnitCount,
-      }
+    const unitCount = TerraformCount.of(
+      Token.asNumber(Fn.lengthOf(filtered.ids))
     );
+    new DataAwsEc2TransitGatewayVpcAttachment(this, "unit", {
+      id: Token.asString(Fn.lookupNested(filtered.ids, [unitCount.index])),
+      count: unitCount,
+    });
   }
 }
 
@@ -64,7 +59,7 @@ class MyConvertedCode extends cdktf.TerraformStack {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `filter` - (Optional) One or more configuration blocks containing name-values filters. Detailed below.
 
@@ -75,7 +70,7 @@ The following arguments are supported:
 
 ## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `ids` A list of all attachments ids matching the filter. You can retrieve more information about the attachment using the [aws_ec2_transit_gateway_vpc_attachment][2] data source, searching by identifier.
 
@@ -88,4 +83,4 @@ In addition to all arguments above, the following attributes are exported:
 
 - `read` - (Default `20M`)
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-94a4a5c01262f3d0b0040f40dfcbae5974b17c833a028dce6e27bdcd796da76f -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-2d39ff132acd3771e1ec4fad107a8e23d40412d978b10bdbac6f691914bd45b7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/ec2_transit_gateway_vpn_attachment.html.markdown b/website/docs/cdktf/typescript/d/ec2_transit_gateway_vpn_attachment.html.markdown
index 34ac73fbd3b..ba1d341e587 100644
--- a/website/docs/cdktf/typescript/d/ec2_transit_gateway_vpn_attachment.html.markdown
+++ b/website/docs/cdktf/typescript/d/ec2_transit_gateway_vpn_attachment.html.markdown
@@ -6,6 +6,8 @@ description: |-
   Get information on an EC2 Transit Gateway VPN Attachment
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Data Source: aws_ec2_transit_gateway_vpn_attachment
 
 Get information on an EC2 Transit Gateway VPN Attachment.
@@ -16,36 +18,49 @@ Get information on an EC2 Transit Gateway VPN Attachment.
 
 ### By Transit Gateway and VPN Connection Identifiers
 
-```terraform
-data "aws_ec2_transit_gateway_vpn_attachment" "example" {
-  transit_gateway_id = aws_ec2_transit_gateway.example.id
-  vpn_connection_id  = aws_vpn_connection.example.id
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsEc2TransitGatewayVpnAttachment } from "./.gen/providers/aws/data-aws-ec2-transit-gateway-vpn-attachment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsEc2TransitGatewayVpnAttachment(this, "example", {
+      transitGatewayId: Token.asString(awsEc2TransitGatewayExample.id),
+      vpnConnectionId: Token.asString(awsVpnConnectionExample.id),
+    });
+  }
 }
+
 ```
 
 ### Filter
 
 ```typescript
-import * as constructs from "constructs";
-import * as cdktf from "cdktf";
-/*Provider bindings are generated by running cdktf get.
-See https://cdk.tf/provider-generation for more details.*/
-import * as aws from "./.gen/providers/aws";
-class MyConvertedCode extends cdktf.TerraformStack {
-  constructor(scope: constructs.Construct, name: string) {
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsEc2TransitGatewayVpnAttachment } from "./.gen/providers/aws/data-aws-ec2-transit-gateway-vpn-attachment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
     super(scope, name);
-    new aws.dataAwsEc2TransitGatewayVpnAttachment.DataAwsEc2TransitGatewayVpnAttachment(
-      this,
-      "test",
-      {
-        filter: [
-          {
-            name: "resource-id",
-            values: ["some-resource"],
-          },
-        ],
-      }
-    );
+    new DataAwsEc2TransitGatewayVpnAttachment(this, "test", {
+      filter: [
+        {
+          name: "resource-id",
+          values: ["some-resource"],
+        },
+      ],
+    });
   }
 }
 
@@ -53,7 +68,7 @@ class MyConvertedCode extends cdktf.TerraformStack {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `transitGatewayId` - (Optional) Identifier of the EC2 Transit Gateway.
 * `vpnConnectionId` - (Optional) Identifier of the EC2 VPN Connection.
@@ -62,14 +77,14 @@ The following arguments are supported:
 
 ### filter Configuration Block
 
-The following arguments are supported by the `filter` configuration block:
+The `filter` configuration block supports the following arguments:
 
 * `name` - (Required) Name of the filter field. Valid values can be found in the [EC2 DescribeTransitGatewayAttachments API Reference](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeTransitGatewayAttachments.html).
 * `values` - (Required) Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
 
 ## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - EC2 Transit Gateway VPN Attachment identifier
 * `tags` - Key-value tags for the EC2 Transit Gateway VPN Attachment
@@ -80,4 +95,4 @@ In addition to all arguments above, the following attributes are exported:
 
 - `read` - (Default `20M`)
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-2149138dd4a425dc46526663f1027084972afb2d6643d8f1be249b8702bebeb1 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-88b75ea1f3920ded56d1eddbe0d74b036502601096fcc354c6675666bea832df -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/ecr_authorization_token.html.markdown b/website/docs/cdktf/typescript/d/ecr_authorization_token.html.markdown
new file mode 100644
index 00000000000..2d38839294b
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/ecr_authorization_token.html.markdown
@@ -0,0 +1,52 @@
+---
+subcategory: "ECR (Elastic Container Registry)"
+layout: "aws"
+page_title: "AWS: aws_ecr_authorization_token"
+description: |-
+    Provides details about an ECR Authorization Token
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_ecr_authorization_token
+
+The ECR Authorization Token data source allows the authorization token, proxy endpoint, token expiration date, user name and password to be retrieved for an ECR repository.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsEcrAuthorizationToken } from "./.gen/providers/aws/data-aws-ecr-authorization-token";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsEcrAuthorizationToken(this, "token", {});
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `registryId` - (Optional) AWS account ID of the ECR Repository. If not specified the default account is assumed.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `authorizationToken` - Temporary IAM authentication credentials to access the ECR repository encoded in base64 in the form of `userName:password`.
+* `expiresAt` - Time in UTC RFC3339 format when the authorization token expires.
+* `id` - Region of the authorization token.
+* `password` - Password decoded from the authorization token.
+* `proxyEndpoint` - Registry URL to use in the docker login command.
+* `userName` - User name decoded from the authorization token.
+
+<!-- cache-key: cdktf-0.18.0 input-d34a382e4ced5a92cb958e15e5c5a33471a37b0250050f1b1a0f69eb8326fece -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/ecr_image.html.markdown b/website/docs/cdktf/typescript/d/ecr_image.html.markdown
new file mode 100644
index 00000000000..a44533815d7
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/ecr_image.html.markdown
@@ -0,0 +1,57 @@
+---
+subcategory: "ECR (Elastic Container Registry)"
+layout: "aws"
+page_title: "AWS: aws_ecr_image"
+description: |-
+    Provides details about an ECR Image
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_ecr_image
+
+The ECR Image data source allows the details of an image with a particular tag or digest to be retrieved.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsEcrImage } from "./.gen/providers/aws/data-aws-ecr-image";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsEcrImage(this, "service_image", {
+      imageTag: "latest",
+      repositoryName: "my/service",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `registryId` - (Optional) ID of the Registry where the repository resides.
+* `repositoryName` - (Required) Name of the ECR Repository.
+* `imageDigest` - (Optional) Sha256 digest of the image manifest. At least one of `imageDigest`, `imageTag`, or `mostRecent` must be specified.
+* `imageTag` - (Optional) Tag associated with this image. At least one of `imageDigest`, `imageTag`, or `mostRecent` must be specified.
+* `mostRecent` - (Optional) Return the most recently pushed image. At least one of `imageDigest`, `imageTag`, or `mostRecent` must be specified.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - SHA256 digest of the image manifest.
+* `imagePushedAt` - Date and time, expressed as a unix timestamp, at which the current image was pushed to the repository.
+* `imageSizeInBytes` - Size, in bytes, of the image in the repository.
+* `imageTags` - List of tags associated with this image.
+
+<!-- cache-key: cdktf-0.18.0 input-eb75c0a7672b4cf7c02f9b64096974ed3f209abe2c9c03438c3aa07107bc2b28 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/ecr_pull_through_cache_rule.html.markdown b/website/docs/cdktf/typescript/d/ecr_pull_through_cache_rule.html.markdown
new file mode 100644
index 00000000000..c782fcff678
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/ecr_pull_through_cache_rule.html.markdown
@@ -0,0 +1,51 @@
+---
+subcategory: "ECR (Elastic Container Registry)"
+layout: "aws"
+page_title: "AWS: aws_ecr_pull_through_cache_rule"
+description: |-
+  Provides details about an ECR Pull Through Cache Rule
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_ecr_pull_through_cache_rule
+
+The ECR Pull Through Cache Rule data source allows the upstream registry URL and registry ID to be retrieved for a Pull Through Cache Rule.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsEcrPullThroughCacheRule } from "./.gen/providers/aws/data-aws-ecr-pull-through-cache-rule";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsEcrPullThroughCacheRule(this, "ecr_public", {
+      ecrRepositoryPrefix: "ecr-public",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+- `ecrRepositoryPrefix` - (Required) The repository name prefix to use when caching images from the source registry.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+- `id` - The repository name prefix.
+- `upstreamRegistryUrl` - The registry URL of the upstream public registry to use as the source.
+- `registryId` - The registry ID where the repository was created.
+
+<!-- cache-key: cdktf-0.18.0 input-3ee2ad3b6b1782465fd57fc7a664c3cb24f3d2959a61a327dc70b472c5eb08e8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/ecr_repository.html.markdown b/website/docs/cdktf/typescript/d/ecr_repository.html.markdown
new file mode 100644
index 00000000000..92ae11ee559
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/ecr_repository.html.markdown
@@ -0,0 +1,65 @@
+---
+subcategory: "ECR (Elastic Container Registry)"
+layout: "aws"
+page_title: "AWS: aws_ecr_repository"
+description: |-
+    Provides details about an ECR Repository
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_ecr_repository
+
+The ECR Repository data source allows the ARN, Repository URI and Registry ID to be retrieved for an ECR repository.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsEcrRepository } from "./.gen/providers/aws/data-aws-ecr-repository";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsEcrRepository(this, "service", {
+      name: "ecr-repository",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name of the ECR Repository.
+* `registryId` - (Optional) Registry ID where the repository was created.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - Full ARN of the repository.
+* `encryptionConfiguration` - Encryption configuration for the repository. See [Encryption Configuration](#encryption-configuration) below.
+* `imageScanningConfiguration` - Configuration block that defines image scanning configuration for the repository. See [Image Scanning Configuration](#image-scanning-configuration) below.
+* `imageTagMutability` - The tag mutability setting for the repository.
+* `mostRecentImageTags` - List of image tags associated with the most recently pushed image in the repository.
+* `repositoryUrl` - URL of the repository (in the form `awsAccountIdDkrEcrRegionAmazonawsCom/repositoryName`).
+* `tags` - Map of tags assigned to the resource.
+
+### Encryption Configuration
+
+* `encryptionType` - Encryption type to use for the repository, either `aes256` or `kms`.
+* `kmsKey` - If `encryptionType` is `kms`, the ARN of the KMS key used.
+
+### Image Scanning Configuration
+
+* `scanOnPush` - Whether images are scanned after being pushed to the repository.
+
+<!-- cache-key: cdktf-0.18.0 input-dca647d04d11f3277efe49d65bb6183e2b5b2ad799294faa6fdd90156a3bfee3 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/ecrpublic_authorization_token.html.markdown b/website/docs/cdktf/typescript/d/ecrpublic_authorization_token.html.markdown
new file mode 100644
index 00000000000..e753ffe6131
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/ecrpublic_authorization_token.html.markdown
@@ -0,0 +1,47 @@
+---
+subcategory: "ECR Public"
+layout: "aws"
+page_title: "AWS: aws_ecrpublic_authorization_token"
+description: |-
+    Provides details about a Public ECR Authorization Token
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_ecrpublic_authorization_token
+
+The Public ECR Authorization Token data source allows the authorization token, token expiration date, user name, and password to be retrieved for a Public ECR repository.
+
+~> **NOTE:** This data source can only be used in the `usEast1` region.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsEcrpublicAuthorizationToken } from "./.gen/providers/aws/data-aws-ecrpublic-authorization-token";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsEcrpublicAuthorizationToken(this, "token", {});
+  }
+}
+
+```
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `authorizationToken` - Temporary IAM authentication credentials to access the ECR repository encoded in base64 in the form of `userName:password`.
+* `expiresAt` - Time in UTC RFC3339 format when the authorization token expires.
+* `id` - Region of the authorization token.
+* `password` - Password decoded from the authorization token.
+* `userName` - User name decoded from the authorization token.
+
+<!-- cache-key: cdktf-0.18.0 input-fc553185b1ad0893b42035538b008c8015883bff0b2f28b28094a5ed72a8fc63 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/ecs_cluster.html.markdown b/website/docs/cdktf/typescript/d/ecs_cluster.html.markdown
new file mode 100644
index 00000000000..9451970778f
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/ecs_cluster.html.markdown
@@ -0,0 +1,57 @@
+---
+subcategory: "ECS (Elastic Container)"
+layout: "aws"
+page_title: "AWS: aws_ecs_cluster"
+description: |-
+    Provides details about an ecs cluster
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_ecs_cluster
+
+The ECS Cluster data source allows access to details of a specific
+cluster within an AWS ECS service.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsEcsCluster } from "./.gen/providers/aws/data-aws-ecs-cluster";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsEcsCluster(this, "ecs-mongo", {
+      clusterName: "ecs-mongo-production",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `clusterName` - (Required) Name of the ECS Cluster
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the ECS Cluster
+* `status` - Status of the ECS Cluster
+* `pendingTasksCount` - Number of pending tasks for the ECS Cluster
+* `runningTasksCount` - Number of running tasks for the ECS Cluster
+* `registeredContainerInstancesCount` - The number of registered container instances for the ECS Cluster
+* `serviceConnectDefaults` - The default Service Connect namespace
+* `setting` - Settings associated with the ECS Cluster
+* `tags` - Key-value map of resource tags
+
+<!-- cache-key: cdktf-0.18.0 input-34810e42d3b55e16f7f6d3afebb0129a5abba1001be099dab6e734c0ce5c7341 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/ecs_container_definition.html.markdown b/website/docs/cdktf/typescript/d/ecs_container_definition.html.markdown
new file mode 100644
index 00000000000..e36539152d1
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/ecs_container_definition.html.markdown
@@ -0,0 +1,59 @@
+---
+subcategory: "ECS (Elastic Container)"
+layout: "aws"
+page_title: "AWS: aws_ecs_container_definition"
+description: |-
+    Provides details about a single container within an ecs task definition
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_ecs_container_definition
+
+The ECS container definition data source allows access to details of
+a specific container within an AWS ECS service.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsEcsContainerDefinition } from "./.gen/providers/aws/data-aws-ecs-container-definition";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsEcsContainerDefinition(this, "ecs-mongo", {
+      containerName: "mongodb",
+      taskDefinition: mongo.id,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `taskDefinition` - (Required) ARN of the task definition which contains the container
+* `containerName` - (Required) Name of the container definition
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `image` - Docker image in use, including the digest
+* `imageDigest` - Digest of the docker image in use
+* `cpu` - CPU limit for this container definition
+* `memory` - Memory limit for this container definition
+* `memoryReservation` - Soft limit (in MiB) of memory to reserve for the container. When system memory is under contention, Docker attempts to keep the container memory to this soft limit
+* `environment` - Environment in use
+* `disableNetworking` - Indicator if networking is disabled
+* `dockerLabels` - Set docker labels
+
+<!-- cache-key: cdktf-0.18.0 input-6aeb7bcd3d9ef0fd16650027ff7ee1fa1b9bdd2ab011e720f74e5b141ebf8c21 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/ecs_service.html.markdown b/website/docs/cdktf/typescript/d/ecs_service.html.markdown
new file mode 100644
index 00000000000..937046da3db
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/ecs_service.html.markdown
@@ -0,0 +1,57 @@
+---
+subcategory: "ECS (Elastic Container)"
+layout: "aws"
+page_title: "AWS: aws_ecs_service"
+description: |-
+    Provides details about an ecs service
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_ecs_service
+
+The ECS Service data source allows access to details of a specific
+Service within a AWS ECS Cluster.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsEcsService } from "./.gen/providers/aws/data-aws-ecs-service";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsEcsService(this, "example", {
+      clusterArn: Token.asString(dataAwsEcsClusterExample.arn),
+      serviceName: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `serviceName` - (Required) Name of the ECS Service
+* `clusterArn` - (Required) ARN of the ECS Cluster
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the ECS Service
+* `desiredCount` - Number of tasks for the ECS Service
+* `launchType` - Launch type for the ECS Service
+* `schedulingStrategy` - Scheduling strategy for the ECS Service
+* `taskDefinition` - Family for the latest ACTIVE revision or full ARN of the task definition.
+* `tags` - Resource tags.
+
+<!-- cache-key: cdktf-0.18.0 input-342c81cf26422fd2c4195d60a2096623c39f08ed2e906f31b634d44bbdc3ee9c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/ecs_task_definition.html.markdown b/website/docs/cdktf/typescript/d/ecs_task_definition.html.markdown
new file mode 100644
index 00000000000..e212c525ce1
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/ecs_task_definition.html.markdown
@@ -0,0 +1,83 @@
+---
+subcategory: "ECS (Elastic Container)"
+layout: "aws"
+page_title: "AWS: aws_ecs_task_definition"
+description: |-
+    Provides details about an ecs task definition
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_ecs_task_definition
+
+The ECS task definition data source allows access to details of
+a specific AWS ECS task definition.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsEcsTaskDefinition } from "./.gen/providers/aws/data-aws-ecs-task-definition";
+import { EcsCluster } from "./.gen/providers/aws/ecs-cluster";
+import { EcsService } from "./.gen/providers/aws/ecs-service";
+import { EcsTaskDefinition } from "./.gen/providers/aws/ecs-task-definition";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const foo = new EcsCluster(this, "foo", {
+      name: "foo",
+    });
+    const mongo = new EcsTaskDefinition(this, "mongo", {
+      containerDefinitions:
+        '[\n  {\n    "cpu": 128,\n    "environment": [{\n      "name": "SECRET",\n      "value": "KEY"\n    }],\n    "essential": true,\n    "image": "mongo:latest",\n    "memory": 128,\n    "memoryReservation": 64,\n    "name": "mongodb"\n  }\n]\n\n',
+      family: "mongodb",
+    });
+    const dataAwsEcsTaskDefinitionMongo = new DataAwsEcsTaskDefinition(
+      this,
+      "mongo_2",
+      {
+        taskDefinition: mongo.family,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsEcsTaskDefinitionMongo.overrideLogicalId("mongo");
+    const awsEcsServiceMongo = new EcsService(this, "mongo_3", {
+      cluster: foo.id,
+      desiredCount: 2,
+      name: "mongo",
+      taskDefinition: Token.asString(dataAwsEcsTaskDefinitionMongo.arn),
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsEcsServiceMongo.overrideLogicalId("mongo");
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `taskDefinition` - (Required) Family for the latest ACTIVE revision, family and revision (family:revision) for a specific revision in the family, the ARN of the task definition to access to.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - ARN of the task definition.
+* `arn` - ARN of the task definition.
+* `arnWithoutRevision` - ARN of the Task Definition with the trailing `revision` removed. This may be useful for situations where the latest task definition is always desired. If a revision isn't specified, the latest ACTIVE revision is used. See the [AWS documentation](https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_StartTask.html#ECS-StartTask-request-taskDefinition) for details.
+* `executionRoleArn` - ARN of the task execution role that the Amazon ECS container agent and the Docker.
+* `family` - Family of this task definition.
+* `networkMode` - Docker networking mode to use for the containers in this task.
+* `revision` - Revision of this task definition.
+* `status` - Status of this task definition.
+* `taskRoleArn` - ARN of the IAM role that containers in this task can assume.
+
+<!-- cache-key: cdktf-0.18.0 input-4a4502052fe5e4b3b606605c68760b5b4032e8f1ed7a3c177b5d6a07c7731b9c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/ecs_task_execution.html.markdown b/website/docs/cdktf/typescript/d/ecs_task_execution.html.markdown
new file mode 100644
index 00000000000..46bc92a78a4
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/ecs_task_execution.html.markdown
@@ -0,0 +1,141 @@
+---
+subcategory: "ECS (Elastic Container)"
+layout: "aws"
+page_title: "AWS: aws_ecs_task_execution"
+description: |-
+  Terraform data source for managing an AWS ECS (Elastic Container) Task Execution.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_ecs_task_execution
+
+Terraform data source for managing an AWS ECS (Elastic Container) Task Execution. This data source calls the [RunTask](https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_RunTask.html) API, allowing execution of one-time tasks that don't fit a standard resource lifecycle. See the [feature request issue](https://github.com/hashicorp/terraform-provider-aws/issues/1703) for additional context.
+
+~> **NOTE on plan operations:** This data source calls the `runTask` API on every read operation, which means new task(s) may be created from a `terraform plan` command if all attributes are known. Placing this functionality behind a data source is an intentional trade off to enable use cases requiring a one-time task execution without relying on [provisioners](https://developer.hashicorp.com/terraform/language/resources/provisioners/syntax). Caution should be taken to ensure the data source is only executed once, or that the resulting tasks can safely run in parallel.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, Fn, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsEcsTaskExecution } from "./.gen/providers/aws/data-aws-ecs-task-execution";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsEcsTaskExecution(this, "example", {
+      cluster: Token.asString(awsEcsClusterExample.id),
+      desiredCount: 1,
+      launchType: "FARGATE",
+      networkConfiguration: {
+        assignPublicIp: false,
+        securityGroups: [Token.asString(awsSecurityGroupExample.id)],
+        subnets: Token.asList(Fn.lookupNested(awsSubnetExample, ["*", "id"])),
+      },
+      taskDefinition: Token.asString(awsEcsTaskDefinitionExample.arn),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `cluster` - (Required) Short name or full Amazon Resource Name (ARN) of the cluster to run the task on.
+* `taskDefinition` - (Required) The `family` and `revision` (`family:revision`) or full ARN of the task definition to run. If a revision isn't specified, the latest `active` revision is used.
+
+The following arguments are optional:
+
+* `capacityProviderStrategy` - (Optional) Set of capacity provider strategies to use for the cluster. See below.
+* `desiredCount` - (Optional) Number of instantiations of the specified task to place on your cluster. You can specify up to 10 tasks for each call.
+* `enableEcsManagedTags` - (Optional) Specifies whether to enable Amazon ECS managed tags for the tasks within the service.
+* `enableExecuteCommand` - (Optional) Specifies whether to enable Amazon ECS Exec for the tasks within the service.
+* `group` - (Optional) Name of the task group to associate with the task. The default value is the family name of the task definition.
+* `launchType` - (Optional) Launch type on which to run your service. Valid values are `ec2`, `fargate`, and `external`.
+* `networkConfiguration` - (Optional) Network configuration for the service. This parameter is required for task definitions that use the `awsvpc` network mode to receive their own Elastic Network Interface, and it is not supported for other network modes. See below.
+* `overrides` - (Optional) A list of container overrides that specify the name of a container in the specified task definition and the overrides it should receive.
+* `placementConstraints` - (Optional) An array of placement constraint objects to use for the task. You can specify up to 10 constraints for each task. See below.
+* `placementStrategy` - (Optional) The placement strategy objects to use for the task. You can specify a maximum of 5 strategy rules for each task. See below.
+* `platformVersion` - (Optional) The platform version the task uses. A platform version is only specified for tasks hosted on Fargate. If one isn't specified, the `latest` platform version is used.
+* `propagateTags` - (Optional) Specifies whether to propagate the tags from the task definition to the task. If no value is specified, the tags aren't propagated. An error will be received if you specify the `service` option when running a task. Valid values are `taskDefinition` or `none`.
+* `referenceId` - (Optional) The reference ID to use for the task.
+* `startedBy` - (Optional) An optional tag specified when a task is started.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### capacity_provider_strategy
+
+* `capacityProvider` - (Required) Name of the capacity provider.
+* `base` - (Optional) The number of tasks, at a minimum, to run on the specified capacity provider. Only one capacity provider in a capacity provider strategy can have a base defined. Defaults to `0`.
+* `weight` - (Optional) The relative percentage of the total number of launched tasks that should use the specified capacity provider. The `weight` value is taken into consideration after the `base` count of tasks has been satisfied. Defaults to `0`.
+
+### network_configuration
+
+* `subnets` - (Required) Subnets associated with the task or service.
+* `securityGroups` - (Optional) Security groups associated with the task or service. If you do not specify a security group, the default security group for the VPC is used.
+* `assignPublicIp` - (Optional) Assign a public IP address to the ENI (Fargate launch type only). Valid values are `true` or `false`. Default `false`.
+
+For more information, see the [Task Networking](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-networking.html) documentation.
+
+### overrides
+
+* `containerOverrides` - (Optional) One or more container overrides that are sent to a task. See below.
+* `cpu` - (Optional) The CPU override for the task.
+* `executionRoleArn` - (Optional) Amazon Resource Name (ARN) of the task execution role override for the task.
+* `inferenceAcceleratorOverrides` - (Optional) Elastic Inference accelerator override for the task. See below.
+* `memory` - (Optional) The memory override for the task.
+* `taskRoleArn` - (Optional) Amazon Resource Name (ARN) of the role that containers in this task can assume.
+
+### container_overrides
+
+* `command` - (Optional) The command to send to the container that overrides the default command from the Docker image or the task definition.
+* `cpu` - (Optional) The number of cpu units reserved for the container, instead of the default value from the task definition.
+* `environment` - (Optional) The environment variables to send to the container. You can add new environment variables, which are added to the container at launch, or you can override the existing environment variables from the Docker image or the task definition. See below.
+* `memory` - (Optional) The hard limit (in MiB) of memory to present to the container, instead of the default value from the task definition. If your container attempts to exceed the memory specified here, the container is killed.
+* `memoryReservation` - (Optional) The soft limit (in MiB) of memory to reserve for the container, instead of the default value from the task definition.
+* `name` - (Optional) The name of the container that receives the override. This parameter is required if any override is specified.
+* `resourceRequirements` - (Optional) The type and amount of a resource to assign to a container, instead of the default value from the task definition. The only supported resource is a GPU. See below.
+
+### environment
+
+* `key` - (Required) The name of the key-value pair. For environment variables, this is the name of the environment variable.
+* `value` - (Required) The value of the key-value pair. For environment variables, this is the value of the environment variable.
+
+### resource_requirements
+
+* `type` - (Required) The type of resource to assign to a container. Valid values are `gpu` or `inferenceAccelerator`.
+* `value` - (Required) The value for the specified resource type. If the `gpu` type is used, the value is the number of physical GPUs the Amazon ECS container agent reserves for the container. The number of GPUs that's reserved for all containers in a task can't exceed the number of available GPUs on the container instance that the task is launched on. If the `inferenceAccelerator` type is used, the value matches the `deviceName` for an InferenceAccelerator specified in a task definition.
+
+### inference_accelerator_overrides
+
+* `deviceName` - (Optional) The Elastic Inference accelerator device name to override for the task. This parameter must match a deviceName specified in the task definition.
+* `deviceType` - (Optional) The Elastic Inference accelerator type to use.
+
+### placement_constraints
+
+* `expression` - (Optional) A cluster query language expression to apply to the constraint. The expression can have a maximum length of 2000 characters. You can't specify an expression if the constraint type is `distinctInstance`.
+* `type` - (Optional) The type of constraint. Valid values are `distinctInstance` or `memberOf`. Use `distinctInstance` to ensure that each task in a particular group is running on a different container instance. Use `memberOf` to restrict the selection to a group of valid candidates.
+
+### placement_strategy
+
+* `field` - (Optional) The field to apply the placement strategy against.
+* `type` - (Optional) The type of placement strategy. Valid values are `random`, `spread`, and `binpack`.
+
+For more information, see the [Placement Strategy](https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_PlacementStrategy.html) documentation.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `taskArns` - A list of the provisioned task ARNs.
+* `id` - The unique identifier, which is a comma-delimited string joining the `cluster` and `taskDefinition` attributes.
+
+<!-- cache-key: cdktf-0.18.0 input-43e278c1402adce6a7fc73f884efc857a1ca139e84ad68f7ea78a5f8b607b74c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/efs_access_point.html.markdown b/website/docs/cdktf/typescript/d/efs_access_point.html.markdown
new file mode 100644
index 00000000000..4c4e99c4d24
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/efs_access_point.html.markdown
@@ -0,0 +1,63 @@
+---
+subcategory: "EFS (Elastic File System)"
+layout: "aws"
+page_title: "AWS: aws_efs_access_point"
+description: |-
+  Provides an Elastic File System (EFS) Access Point data source.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_efs_access_point
+
+Provides information about an Elastic File System (EFS) Access Point.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsEfsAccessPoint } from "./.gen/providers/aws/data-aws-efs-access-point";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsEfsAccessPoint(this, "test", {
+      accessPointId: "fsap-12345678",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `accessPointId` - (Required) ID that identifies the file system.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the access point.
+* `arn` - Amazon Resource Name of the file system.
+* `fileSystemArn` - Amazon Resource Name of the file system.
+* `fileSystemId` - ID of the file system for which the access point is intended.
+* `posixUser` - Single element list containing operating system user and group applied to all file system requests made using the access point.
+    * `gid` - Group ID
+    * `secondaryGids` - Secondary group IDs
+    * `uid` - User Id
+* `rootDirectory`- Single element list containing information on the directory on the Amazon EFS file system that the access point provides access to.
+    * `creationInfo` - Single element list containing information on the creation permissions of the directory
+        * `ownerGid` - POSIX owner group ID
+        * `ownerUid` - POSIX owner user ID
+        * `permissions` - POSIX permissions mode
+    * `path` - Path exposed as the root directory
+* `tags` - Key-value mapping of resource tags.
+
+<!-- cache-key: cdktf-0.18.0 input-0a6eb33b78fe37cb122bdb76da99c518922b10eb75fae54fd07c18509d2e4a50 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/efs_access_points.html.markdown b/website/docs/cdktf/typescript/d/efs_access_points.html.markdown
new file mode 100644
index 00000000000..5ab149f28c4
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/efs_access_points.html.markdown
@@ -0,0 +1,51 @@
+---
+subcategory: "EFS (Elastic File System)"
+layout: "aws"
+page_title: "AWS: aws_efs_access_points"
+description: |-
+  Provides information about multiple Elastic File System (EFS) Access Points.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_efs_access_points
+
+Provides information about multiple Elastic File System (EFS) Access Points.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsEfsAccessPoints } from "./.gen/providers/aws/data-aws-efs-access-points";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsEfsAccessPoints(this, "test", {
+      fileSystemId: "fs-12345678",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `fileSystemId` - (Required) EFS File System identifier.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arns` - Set of Amazon Resource Names (ARNs).
+* `id` - EFS File System identifier.
+* `ids` - Set of identifiers.
+
+<!-- cache-key: cdktf-0.18.0 input-6411c7528e305530b4e30c020a220acea9846dec4899a48198364c9069f2fbcd -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/efs_file_system.html.markdown b/website/docs/cdktf/typescript/d/efs_file_system.html.markdown
new file mode 100644
index 00000000000..0f9d07fc632
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/efs_file_system.html.markdown
@@ -0,0 +1,74 @@
+---
+subcategory: "EFS (Elastic File System)"
+layout: "aws"
+page_title: "AWS: aws_efs_file_system"
+description: |-
+  Provides an Elastic File System (EFS) File System data source.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_efs_file_system
+
+Provides information about an Elastic File System (EFS) File System.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { VariableType, TerraformVariable, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsEfsFileSystem } from "./.gen/providers/aws/data-aws-efs-file-system";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    /*Terraform Variables are not always the best fit for getting inputs in the context of Terraform CDK.
+    You can read more about this at https://cdk.tf/variables*/
+    const fileSystemId = new TerraformVariable(this, "file_system_id", {
+      default: "",
+      type: VariableType.STRING,
+    });
+    new DataAwsEfsFileSystem(this, "by_id", {
+      fileSystemId: fileSystemId.stringValue,
+    });
+    new DataAwsEfsFileSystem(this, "by_tag", {
+      tags: {
+        Environment: "dev",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `fileSystemId` - (Optional) ID that identifies the file system (e.g., fs-ccfc0d65).
+* `creationToken` - (Optional) Restricts the list to the file system with this creation token.
+* `tags` - (Optional) Restricts the list to the file system with these tags.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name of the file system.
+* `availabilityZoneName` - The Availability Zone name in which the file system's One Zone storage classes exist.
+* `availabilityZoneId` - The identifier of the Availability Zone in which the file system's One Zone storage classes exist.
+* `dnsName` - DNS name for the filesystem per [documented convention](http://docs.aws.amazon.com/efs/latest/ug/mounting-fs-mount-cmd-dns-name.html).
+* `encrypted` - Whether EFS is encrypted.
+* `kmsKeyId` - ARN for the KMS encryption key.
+* `lifecyclePolicy` - File system [lifecycle policy](https://docs.aws.amazon.com/efs/latest/ug/API_LifecyclePolicy.html) object.
+* `name` - The value of the file system's `name` tag.
+* `performanceMode` - File system performance mode.
+* `provisionedThroughputInMibps` - The throughput, measured in MiB/s, that you want to provision for the file system.
+* `tags` -A map of tags to assign to the file system.
+* `throughputMode` - Throughput mode for the file system.
+* `sizeInBytes` - Current byte count used by the file system.
+
+<!-- cache-key: cdktf-0.18.0 input-91848697481eb0959ef949486e3ade78e73077540a9a38720f250c99edbeced7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/efs_mount_target.html.markdown b/website/docs/cdktf/typescript/d/efs_mount_target.html.markdown
new file mode 100644
index 00000000000..090e8293e50
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/efs_mount_target.html.markdown
@@ -0,0 +1,66 @@
+---
+subcategory: "EFS (Elastic File System)"
+layout: "aws"
+page_title: "AWS: aws_efs_mount_target"
+description: |-
+  Provides an Elastic File System Mount Target (EFS) data source.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_efs_mount_target
+
+Provides information about an Elastic File System Mount Target (EFS).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { VariableType, TerraformVariable, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsEfsMountTarget } from "./.gen/providers/aws/data-aws-efs-mount-target";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    /*Terraform Variables are not always the best fit for getting inputs in the context of Terraform CDK.
+    You can read more about this at https://cdk.tf/variables*/
+    const mountTargetId = new TerraformVariable(this, "mount_target_id", {
+      default: "",
+      type: VariableType.STRING,
+    });
+    new DataAwsEfsMountTarget(this, "by_id", {
+      mountTargetId: mountTargetId.stringValue,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `accessPointId` - (Optional) ID or ARN of the access point whose mount target that you want to find. It must be included if a `fileSystemId` and `mountTargetId` are not included.
+* `fileSystemId` - (Optional) ID or ARN of the file system whose mount target that you want to find. It must be included if an `accessPointId` and `mountTargetId` are not included.
+* `mountTargetId` - (Optional) ID or ARN of the mount target that you want to find. It must be included in your request if an `accessPointId` and `fileSystemId` are not included.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `fileSystemArn` - Amazon Resource Name of the file system for which the mount target is intended.
+* `subnetId` - ID of the mount target's subnet.
+* `ipAddress` - Address at which the file system may be mounted via the mount target.
+* `securityGroups` - List of VPC security group IDs attached to the mount target.
+* `dnsName` - DNS name for the EFS file system.
+* `mountTargetDnsName` - The DNS name for the given subnet/AZ per [documented convention](http://docs.aws.amazon.com/efs/latest/ug/mounting-fs-mount-cmd-dns-name.html).
+* `networkInterfaceId` - The ID of the network interface that Amazon EFS created when it created the mount target.
+* `availabilityZoneName` - The name of the Availability Zone (AZ) that the mount target resides in.
+* `availabilityZoneId` - The unique and consistent identifier of the Availability Zone (AZ) that the mount target resides in.
+* `ownerId` - AWS account ID that owns the resource.
+
+<!-- cache-key: cdktf-0.18.0 input-241585ed69289317f2541ca35ef78442a4e59e0d0ccb4b15a56966c7604251c8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/eip.html.markdown b/website/docs/cdktf/typescript/d/eip.html.markdown
new file mode 100644
index 00000000000..56e48559d3a
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/eip.html.markdown
@@ -0,0 +1,151 @@
+---
+subcategory: "EC2 (Elastic Compute Cloud)"
+layout: "aws"
+page_title: "AWS: aws_eip"
+description: |-
+    Provides details about a specific Elastic IP
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_eip
+
+`awsEip` provides details about a specific Elastic IP.
+
+## Example Usage
+
+### Search By Allocation ID (VPC only)
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsEip } from "./.gen/providers/aws/data-aws-eip";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsEip(this, "by_allocation_id", {
+      id: "eipalloc-12345678",
+    });
+  }
+}
+
+```
+
+### Search By Filters (EC2-Classic or VPC)
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsEip } from "./.gen/providers/aws/data-aws-eip";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsEip(this, "by_filter", {
+      filter: [
+        {
+          name: "tag:Name",
+          values: ["exampleNameTagValue"],
+        },
+      ],
+    });
+  }
+}
+
+```
+
+### Search By Public IP (EC2-Classic or VPC)
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsEip } from "./.gen/providers/aws/data-aws-eip";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsEip(this, "by_public_ip", {
+      publicIp: "1.2.3.4",
+    });
+  }
+}
+
+```
+
+### Search By Tags (EC2-Classic or VPC)
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsEip } from "./.gen/providers/aws/data-aws-eip";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsEip(this, "by_tags", {
+      tags: {
+        Name: "exampleNameTagValue",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The arguments of this data source act as filters for querying the available
+Elastic IPs in the current region. The given filters must match exactly one
+Elastic IP whose data will be exported as attributes.
+
+* `filter` - (Optional) One or more name/value pairs to use as filters. There are several valid keys, for a full reference, check out the [EC2 API Reference](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeAddresses.html).
+* `id` - (Optional) Allocation ID of the specific VPC EIP to retrieve. If a classic EIP is required, do NOT set `id`, only set `publicIp`
+* `publicIp` - (Optional) Public IP of the specific EIP to retrieve.
+* `tags` - (Optional) Map of tags, each pair of which must exactly match a pair on the desired Elastic IP
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `associationId` - ID representing the association of the address with an instance in a VPC.
+* `domain` - Whether the address is for use in EC2-Classic (standard) or in a VPC (vpc).
+* `id` - If VPC Elastic IP, the allocation identifier. If EC2-Classic Elastic IP, the public IP address.
+* `instanceId` - ID of the instance that the address is associated with (if any).
+* `networkInterfaceId` - The ID of the network interface.
+* `networkInterfaceOwnerId` - The ID of the AWS account that owns the network interface.
+* `privateIp` - Private IP address associated with the Elastic IP address.
+* `privateDns` - Private DNS associated with the Elastic IP address.
+* `publicIp` - Public IP address of Elastic IP.
+* `publicDns` - Public DNS associated with the Elastic IP address.
+* `publicIpv4Pool` - ID of an address pool.
+* `carrierIp` - Carrier IP address.
+* `customerOwnedIpv4Pool` - The ID of a Customer Owned IP Pool. For more on customer owned IP addressed check out [Customer-owned IP addresses guide](https://docs.aws.amazon.com/outposts/latest/userguide/outposts-networking-components.html#ip-addressing)
+* `customerOwnedIp` - Customer Owned IP.
+* `tags` - Key-value map of tags associated with Elastic IP.
+
+~> **Note:** The data source computes the `publicDns` and `privateDns` attributes according to the [VPC DNS Guide](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-dns.html#vpc-dns-hostnames) as they are not available with the EC2 API.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `20M`)
+
+<!-- cache-key: cdktf-0.18.0 input-7688d5e50a2996c50fe0c8917540205326f787fcf7c961bd9d79ba635401f620 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/eips.html.markdown b/website/docs/cdktf/typescript/d/eips.html.markdown
new file mode 100644
index 00000000000..fd4424b02a2
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/eips.html.markdown
@@ -0,0 +1,72 @@
+---
+subcategory: "EC2 (Elastic Compute Cloud)"
+layout: "aws"
+page_title: "AWS: aws_eips"
+description: |-
+    Provides a list of Elastic IPs in a region
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_eips
+
+Provides a list of Elastic IPs in a region.
+
+## Example Usage
+
+The following shows outputting all Elastic IPs with the a specific tag value.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformOutput, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsEips } from "./.gen/providers/aws/data-aws-eips";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new DataAwsEips(this, "example", {
+      tags: {
+        Env: "dev",
+      },
+    });
+    new TerraformOutput(this, "allocation_ids", {
+      value: example.allocationIds,
+    });
+    new TerraformOutput(this, "public_ips", {
+      value: example.publicIps,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `filter` - (Optional) Custom filter block as described below.
+* `tags` - (Optional) Map of tags, each pair of which must exactly match a pair on the desired Elastic IPs.
+
+More complex filters can be expressed using one or more `filter` sub-blocks, which take the following arguments:
+
+* `name` - (Required) Name of the field to filter by, as defined by
+  [the underlying AWS API](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeAddresses.html).
+* `values` - (Required) Set of values that are accepted for the given field. An Elastic IP will be selected if any one of the given values matches.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - AWS Region.
+* `allocationIds` - List of all the allocation IDs for address for use with EC2-VPC.
+* `publicIps` - List of all the Elastic IP addresses.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `20M`)
+
+<!-- cache-key: cdktf-0.18.0 input-ed0c009504a829c5af380a752739119e64fcc7c1f90f4ad49fc2af34458d3af3 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/eks_addon.html.markdown b/website/docs/cdktf/typescript/d/eks_addon.html.markdown
new file mode 100644
index 00000000000..0e484e30136
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/eks_addon.html.markdown
@@ -0,0 +1,60 @@
+---
+subcategory: "EKS (Elastic Kubernetes)"
+layout: "aws"
+page_title: "AWS: aws_eks_addon"
+description: |-
+  Retrieve information about an EKS add-on
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_eks_addon
+
+Retrieve information about an EKS add-on.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformOutput, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsEksAddon } from "./.gen/providers/aws/data-aws-eks-addon";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new TerraformOutput(this, "eks_addon_outputs", {
+      value: example,
+    });
+    new DataAwsEksAddon(this, "example", {
+      addonName: "vpc-cni",
+      clusterName: Token.asString(awsEksClusterExample.name),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `addonName` – (Required) Name of the EKS add-on. The name must match one of
+  the names returned by [list-addon](https://docs.aws.amazon.com/cli/latest/reference/eks/list-addons.html).
+* `clusterName` – (Required) Name of the EKS Cluster. Must be between 1-100 characters in length. Must begin with an alphanumeric character, and must only contain alphanumeric characters, dashes and underscores (`^[0-9A-Za-z][A-Za-z0-9\-_]+$`).
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the EKS add-on.
+* `addonVersion` - Version of EKS add-on.
+* `configurationValues` - Configuration values for the addon with a single JSON string.
+* `serviceAccountRoleArn` - ARN of IAM role used for EKS add-on. If value is empty -
+  then add-on uses the IAM role assigned to the EKS Cluster node.
+* `id` - EKS Cluster name and EKS add-on name separated by a colon (`:`).
+* `createdAt` - Date and time in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8) that the EKS add-on was created.
+* `modifiedAt` - Date and time in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8) that the EKS add-on was updated.
+
+<!-- cache-key: cdktf-0.18.0 input-553bc4808c728491b5414f2d688994a4b0a80d9290f35e4271bd6e2834213ffb -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/eks_addon_version.html.markdown b/website/docs/cdktf/typescript/d/eks_addon_version.html.markdown
new file mode 100644
index 00000000000..577b8972908
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/eks_addon_version.html.markdown
@@ -0,0 +1,73 @@
+---
+subcategory: "EKS (Elastic Kubernetes)"
+layout: "aws"
+page_title: "AWS: aws_eks_addon_version"
+description: |-
+  Retrieve information about versions of an EKS add-on
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_eks_addon_version
+
+Retrieve information about a specific EKS add-on version compatible with an EKS cluster version.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformOutput, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsEksAddonVersion } from "./.gen/providers/aws/data-aws-eks-addon-version";
+import { EksAddon } from "./.gen/providers/aws/eks-addon";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const defaultVar = new DataAwsEksAddonVersion(this, "default", {
+      addonName: "vpc-cni",
+      kubernetesVersion: example.version,
+    });
+    const latest = new DataAwsEksAddonVersion(this, "latest", {
+      addonName: "vpc-cni",
+      kubernetesVersion: example.version,
+      mostRecent: true,
+    });
+    const cdktfTerraformOutputDefault = new TerraformOutput(this, "default_2", {
+      value: defaultVar.version,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    cdktfTerraformOutputDefault.overrideLogicalId("default");
+    const cdktfTerraformOutputLatest = new TerraformOutput(this, "latest_3", {
+      value: latest.version,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    cdktfTerraformOutputLatest.overrideLogicalId("latest");
+    new EksAddon(this, "vpc_cni", {
+      addonName: "vpc-cni",
+      addonVersion: Token.asString(latest.version),
+      clusterName: example.name,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `addonName` – (Required) Name of the EKS add-on. The name must match one of
+  the names returned by [list-addon](https://docs.aws.amazon.com/cli/latest/reference/eks/list-addons.html).
+* `kubernetesVersion` – (Required) Version of the EKS Cluster. Must be between 1-100 characters in length. Must begin with an alphanumeric character, and must only contain alphanumeric characters, dashes and underscores (`^[0-9A-Za-z][A-Za-z0-9\-_]+$`).
+* `mostRecent` - (Optional) Determines if the most recent or default version of the addon should be returned.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - Name of the add-on
+* `version` - Version of the EKS add-on.
+
+<!-- cache-key: cdktf-0.18.0 input-6bea559fed867c091f7f8ce8ca24a017cb6af1e256023fe4160201c7d3a8800c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/eks_cluster.html.markdown b/website/docs/cdktf/typescript/d/eks_cluster.html.markdown
new file mode 100644
index 00000000000..f1f64fb051a
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/eks_cluster.html.markdown
@@ -0,0 +1,88 @@
+---
+subcategory: "EKS (Elastic Kubernetes)"
+layout: "aws"
+page_title: "AWS: aws_eks_cluster"
+description: |-
+  Retrieve information about an EKS Cluster
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_eks_cluster
+
+Retrieve information about an EKS Cluster.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformOutput, Fn, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsEksCluster } from "./.gen/providers/aws/data-aws-eks-cluster";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new DataAwsEksCluster(this, "example", {
+      name: "example",
+    });
+    new TerraformOutput(this, "endpoint", {
+      value: example.endpoint,
+    });
+    new TerraformOutput(this, "identity-oidc-issuer", {
+      value: Fn.lookupNested(example.identity, ["0", "oidc", "0", "issuer"]),
+    });
+    new TerraformOutput(this, "kubeconfig-certificate-authority-data", {
+      value: Fn.lookupNested(example.certificateAuthority, ["0", "data"]),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `name` - (Required) Name of the cluster. Must be between 1-100 characters in length. Must begin with an alphanumeric character, and must only contain alphanumeric characters, dashes and underscores (`^[0-9A-Za-z][A-Za-z0-9\-_]+$`).
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - Name of the cluster
+* `arn` - ARN of the cluster.
+* `certificateAuthority` - Nested attribute containing `certificateAuthorityData` for your cluster.
+    * `data` - The base64 encoded certificate data required to communicate with your cluster. Add this to the `certificateAuthorityData` section of the `kubeconfig` file for your cluster.
+* `clusterId` - The ID of your local Amazon EKS cluster on the AWS Outpost. This attribute isn't available for an AWS EKS cluster on AWS cloud.
+* `createdAt` - Unix epoch time stamp in seconds for when the cluster was created.
+* `enabledClusterLogTypes` - The enabled control plane logs.
+* `endpoint` - Endpoint for your Kubernetes API server.
+* `identity` - Nested attribute containing identity provider information for your cluster. Only available on Kubernetes version 1.13 and 1.14 clusters created or upgraded on or after September 3, 2019. For an example using this information to enable IAM Roles for Service Accounts, see the [`awsEksCluster` resource documentation](/docs/providers/aws/r/eks_cluster.html).
+    * `oidc` - Nested attribute containing [OpenID Connect](https://openid.net/connect/) identity provider information for the cluster.
+        * `issuer` - Issuer URL for the OpenID Connect identity provider.
+* `kubernetesNetworkConfig` - Nested list containing Kubernetes Network Configuration.
+    * `ipFamily` - `ipv4` or `ipv6`.
+    * `serviceIpv4Cidr` - The CIDR block to assign Kubernetes pod and service IP addresses from if `ipv4` was specified when the cluster was created.
+    * `serviceIpv6Cidr` - The CIDR block to assign Kubernetes pod and service IP addresses from if `ipv6` was specified when the cluster was created. Kubernetes assigns service addresses from the unique local address range (fc00::/7) because you can't specify a custom IPv6 CIDR block when you create the cluster.
+* `outpostConfig` - Contains Outpost Configuration.
+    * `controlPlaneInstanceType` - The Amazon EC2 instance type for all Kubernetes control plane instances.
+    * `controlPlanePlacement` - An object representing the placement configuration for all the control plane instances of your local Amazon EKS cluster on AWS Outpost.
+        * `groupName` - The name of the placement group for the Kubernetes control plane instances.
+    * `outpostArns` - List of ARNs of the Outposts hosting the EKS cluster. Only a single ARN is supported currently.
+* `platformVersion` - Platform version for the cluster.
+* `roleArn` - ARN of the IAM role that provides permissions for the Kubernetes control plane to make calls to AWS API operations on your behalf.
+* `status` - Status of the EKS cluster. One of `creating`, `active`, `deleting`, `failed`.
+* `tags` - Key-value map of resource tags.
+* `version` - Kubernetes server version for the cluster.
+* `vpcConfig` - Nested list containing VPC configuration for the cluster.
+    * `clusterSecurityGroupId` - The cluster security group that was created by Amazon EKS for the cluster.
+    * `endpointPrivateAccess` - Indicates whether or not the Amazon EKS private API server endpoint is enabled.
+    * `endpointPublicAccess` - Indicates whether or not the Amazon EKS public API server endpoint is enabled.
+    * `publicAccessCidrs` - List of CIDR blocks. Indicates which CIDR blocks can access the Amazon EKS public API server endpoint.
+    * `securityGroupIds` – List of security group IDs
+    * `subnetIds` – List of subnet IDs
+    * `vpcId` – The VPC associated with your cluster.
+
+<!-- cache-key: cdktf-0.18.0 input-c6c973609d8849dfdbe288511dbb8b53a13192e5d23e4a6f41498b65a5c39508 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/eks_cluster_auth.html.markdown b/website/docs/cdktf/typescript/d/eks_cluster_auth.html.markdown
new file mode 100644
index 00000000000..4d44dc3a767
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/eks_cluster_auth.html.markdown
@@ -0,0 +1,77 @@
+---
+subcategory: "EKS (Elastic Kubernetes)"
+layout: "aws"
+page_title: "AWS: aws_eks_cluster_auth"
+description: |-
+  Get an authentication token to communicate with an EKS Cluster
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_eks_cluster_auth
+
+Get an authentication token to communicate with an EKS cluster.
+
+Uses IAM credentials from the AWS provider to generate a temporary token that is compatible with
+[AWS IAM Authenticator](https://github.com/kubernetes-sigs/aws-iam-authenticator) authentication.
+This can be used to authenticate to an EKS cluster or to a cluster that has the AWS IAM Authenticator
+server configured.
+
+~> **NOTE:** Dynamically configuring a Terraform Provider via data sources currently has implications on [resource import support](https://github.com/hashicorp/terraform/issues/13018) on Terraform `<130`.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsEksCluster } from "./.gen/providers/aws/data-aws-eks-cluster";
+import { DataAwsEksClusterAuth } from "./.gen/providers/aws/data-aws-eks-cluster-auth";
+import { KubernetesProvider } from "./.gen/providers/kubernetes/provider";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    /*The following providers are missing schema information and might need manual adjustments to synthesize correctly: kubernetes.
+    For a more precise conversion please use the --provider flag in convert.*/
+    const example = new DataAwsEksCluster(this, "example", {
+      name: "example",
+    });
+    const dataAwsEksClusterAuthExample = new DataAwsEksClusterAuth(
+      this,
+      "example_1",
+      {
+        name: "example",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsEksClusterAuthExample.overrideLogicalId("example");
+    new KubernetesProvider(this, "kubernetes", {
+      cluster_ca_certificate: Fn.base64decode(
+        Token.asString(
+          Fn.lookupNested(example.certificateAuthority, ["0", "data"])
+        )
+      ),
+      host: example.endpoint,
+      token: dataAwsEksClusterAuthExample.token,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `name` - (Required) Name of the cluster
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - Name of the cluster.
+* `token` - Token to use to authenticate with the cluster.
+
+<!-- cache-key: cdktf-0.18.0 input-45d83dddba9412e716f03bde08f7185de087e8a46407d442260f7b0e6e29f02a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/eks_clusters.html.markdown b/website/docs/cdktf/typescript/d/eks_clusters.html.markdown
new file mode 100644
index 00000000000..337719e827d
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/eks_clusters.html.markdown
@@ -0,0 +1,56 @@
+---
+subcategory: "EKS (Elastic Kubernetes)"
+layout: "aws"
+page_title: "AWS: aws_eks_clusters"
+description: |-
+  Retrieve EKS Clusters list
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_eks_clusters
+
+Retrieve EKS Clusters list
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformIterator, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsEksCluster } from "./.gen/providers/aws/data-aws-eks-cluster";
+import { DataAwsEksClusters } from "./.gen/providers/aws/data-aws-eks-clusters";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new DataAwsEksClusters(this, "example", {});
+    /*In most cases loops should be handled in the programming language context and 
+    not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+    you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+    you need to keep this like it is.*/
+    const exampleForEachIterator = TerraformIterator.fromList(
+      Token.asAny(Fn.toset(example.names))
+    );
+    const dataAwsEksClusterExample = new DataAwsEksCluster(this, "example_1", {
+      name: Token.asString(exampleForEachIterator.value),
+      forEach: exampleForEachIterator,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsEksClusterExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - AWS Region.
+* `names` - Set of EKS clusters names
+
+<!-- cache-key: cdktf-0.18.0 input-dcfc76e9158933045e252a7c855e58231f5ae7d708f1bbdd9026d8d93182a8f3 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/eks_node_group.html.markdown b/website/docs/cdktf/typescript/d/eks_node_group.html.markdown
new file mode 100644
index 00000000000..6a118b73dc0
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/eks_node_group.html.markdown
@@ -0,0 +1,80 @@
+---
+subcategory: "EKS (Elastic Kubernetes)"
+layout: "aws"
+page_title: "AWS: aws_eks_node_group"
+description: |-
+  Retrieve information about an EKS Node Group
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_eks_node_group
+
+Retrieve information about an EKS Node Group.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsEksNodeGroup } from "./.gen/providers/aws/data-aws-eks-node-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsEksNodeGroup(this, "example", {
+      clusterName: "example",
+      nodeGroupName: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `clusterName` - (Required) Name of the cluster.
+* `nodeGroupName` - (Required) Name of the node group.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - EKS Cluster name and EKS Node Group name separated by a colon (`:`).
+* `amiType` - Type of Amazon Machine Image (AMI) associated with the EKS Node Group.
+* `arn` - ARN of the EKS Node Group.
+* `capacityType` - Type of capacity associated with the EKS Node Group. Valid values: `onDemand`, `spot`.
+* `diskSize` - Disk size in GiB for worker nodes.
+* `instanceTypes` - Set of instance types associated with the EKS Node Group.
+* `labels` - Key-value map of Kubernetes labels. Only labels that are applied with the EKS API are managed by this argument. Other Kubernetes labels applied to the EKS Node Group will not be managed.
+* `launchTemplate` - Nested attribute containing information about the launch template used to create the EKS Node Group.
+    * `id` - The ID of the launch template.
+    * `name` - The name of the launch template.
+    * `version` - The version number of the launch template.
+* `nodeRoleArn` – ARN of the IAM Role that provides permissions for the EKS Node Group.
+* `releaseVersion` – AMI version of the EKS Node Group.
+* `remoteAccess` - Configuration block with remote access settings.
+    * `ec2SshKey` - EC2 Key Pair name that provides access for SSH communication with the worker nodes in the EKS Node Group.
+    * `sourceSecurityGroupIds` - Set of EC2 Security Group IDs to allow SSH access (port 22) from on the worker nodes.
+* `resources` - List of objects containing information about underlying resources.
+    * `autoscalingGroups` - List of objects containing information about AutoScaling Groups.
+        * `name` - Name of the AutoScaling Group.
+    * `remoteAccessSecurityGroupId` - Identifier of the remote access EC2 Security Group.
+* `scalingConfig` - Configuration block with scaling settings.
+    * `desiredSize` - Desired number of worker nodes.
+    * `maxSize` - Maximum number of worker nodes.
+    * `minSize` - Minimum number of worker nodes.
+* `status` - Status of the EKS Node Group.
+* `subnetIds` – Identifiers of EC2 Subnets to associate with the EKS Node Group.
+* `taints` - List of objects containing information about taints applied to the nodes in the EKS Node Group.
+    * `key` - The key of the taint.
+    * `value` - The value of the taint.
+    * `effect` - The effect of the taint.
+* `tags` - Key-value map of resource tags.
+* `version` – Kubernetes version.
+
+<!-- cache-key: cdktf-0.18.0 input-455f97b7456c88e1697131f0d9d93c38151b37400a9cfe93bcaa3f2bceee01a2 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/eks_node_groups.html.markdown b/website/docs/cdktf/typescript/d/eks_node_groups.html.markdown
new file mode 100644
index 00000000000..3631dbacaa8
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/eks_node_groups.html.markdown
@@ -0,0 +1,67 @@
+---
+subcategory: "EKS (Elastic Kubernetes)"
+layout: "aws"
+page_title: "AWS: aws_eks_node_groups"
+description: |-
+  Provides a set of node groups for an EKS Cluster
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_eks_node_groups
+
+Retrieve the EKS Node Groups associated with a named EKS cluster. This will allow you to pass a list of Node Group names to other resources.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformIterator, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsEksNodeGroup } from "./.gen/providers/aws/data-aws-eks-node-group";
+import { DataAwsEksNodeGroups } from "./.gen/providers/aws/data-aws-eks-node-groups";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new DataAwsEksNodeGroups(this, "example", {
+      clusterName: "example",
+    });
+    /*In most cases loops should be handled in the programming language context and 
+    not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+    you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+    you need to keep this like it is.*/
+    const exampleForEachIterator = TerraformIterator.fromList(
+      Token.asAny(example.names)
+    );
+    const dataAwsEksNodeGroupExample = new DataAwsEksNodeGroup(
+      this,
+      "example_1",
+      {
+        clusterName: "example",
+        nodeGroupName: Token.asString(exampleForEachIterator.value),
+        forEach: exampleForEachIterator,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsEksNodeGroupExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+* `clusterName` - (Required) Name of the cluster.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - Cluster name.
+* `names` - Set of all node group names in an EKS Cluster.
+
+<!-- cache-key: cdktf-0.18.0 input-247b947784562fdc28bdbed2be700b3594988bb4a6202ca8641a02a2b58e0633 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/elastic_beanstalk_application.html.markdown b/website/docs/cdktf/typescript/d/elastic_beanstalk_application.html.markdown
new file mode 100644
index 00000000000..0cfda2a8561
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/elastic_beanstalk_application.html.markdown
@@ -0,0 +1,62 @@
+---
+subcategory: "Elastic Beanstalk"
+layout: "aws"
+page_title: "AWS: aws_elastic_beanstalk_application"
+description: |-
+  Retrieve information about an Elastic Beanstalk Application
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_elastic_beanstalk_application
+
+Retrieve information about an Elastic Beanstalk Application.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformOutput, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsElasticBeanstalkApplication } from "./.gen/providers/aws/data-aws-elastic-beanstalk-application";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new DataAwsElasticBeanstalkApplication(this, "example", {
+      name: "example",
+    });
+    new TerraformOutput(this, "arn", {
+      value: example.arn,
+    });
+    new TerraformOutput(this, "description", {
+      value: example.description,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `name` - (Required) Name of the application
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - Name of the application
+* `arn` - ARN of the application.
+* `description` - Short description of the application
+
+Application version lifecycle (`appversionLifecycle`) supports the nested attribute containing.
+
+* `serviceRole` - ARN of an IAM service role under which the application version is deleted.  Elastic Beanstalk must have permission to assume this role.
+* `maxCount` - Maximum number of application versions to retain.
+* `maxAgeInDays` - Number of days to retain an application version.
+* `deleteSourceFromS3` - Specifies whether delete a version's source bundle from S3 when the application version is deleted.
+
+<!-- cache-key: cdktf-0.18.0 input-91e8e35e02809b1291798f560a469b0ee44ac2ca2072d3eb5b99110f092216bf -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/elastic_beanstalk_hosted_zone.html.markdown b/website/docs/cdktf/typescript/d/elastic_beanstalk_hosted_zone.html.markdown
new file mode 100644
index 00000000000..7bd1f4d64c8
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/elastic_beanstalk_hosted_zone.html.markdown
@@ -0,0 +1,47 @@
+---
+subcategory: "Elastic Beanstalk"
+layout: "aws"
+page_title: "AWS: aws_elastic_beanstalk_hosted_zone"
+description: |-
+  Get an elastic beanstalk hosted zone.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_elastic_beanstalk_hosted_zone
+
+Use this data source to get the ID of an [elastic beanstalk hosted zone](http://docs.aws.amazon.com/general/latest/gr/rande.html#elasticbeanstalk_region).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsElasticBeanstalkHostedZone } from "./.gen/providers/aws/data-aws-elastic-beanstalk-hosted-zone";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsElasticBeanstalkHostedZone(this, "current", {});
+  }
+}
+
+```
+
+## Argument Reference
+
+* `region` - (Optional) Region you'd like the zone for. By default, fetches the current region.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the hosted zone.
+
+* `region` - Region of the hosted zone.
+
+<!-- cache-key: cdktf-0.18.0 input-289a7d0916600ca4fb2e9823e5d274b3fded6da1f72c678b3ea3c8ecc0af826c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/elastic_beanstalk_solution_stack.html.markdown b/website/docs/cdktf/typescript/d/elastic_beanstalk_solution_stack.html.markdown
new file mode 100644
index 00000000000..79ddcbf9115
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/elastic_beanstalk_solution_stack.html.markdown
@@ -0,0 +1,59 @@
+---
+subcategory: "Elastic Beanstalk"
+layout: "aws"
+page_title: "AWS: aws_elastic_beanstalk_solution_stack"
+description: |-
+  Get an elastic beanstalk solution stack.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_elastic_beanstalk_solution_stack
+
+Use this data source to get the name of a elastic beanstalk solution stack.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsElasticBeanstalkSolutionStack } from "./.gen/providers/aws/data-aws-elastic-beanstalk-solution-stack";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsElasticBeanstalkSolutionStack(this, "multi_docker", {
+      mostRecent: true,
+      nameRegex: "^64bit Amazon Linux (.*) Multi-container Docker (.*)$",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `mostRecent` - (Optional) If more than one result is returned, use the most
+recent solution stack.
+
+* `nameRegex` - Regex string to apply to the solution stack list returned
+by AWS. See [Elastic Beanstalk Supported Platforms][beanstalk-platforms] from
+AWS documentation for reference solution stack names.
+
+~> **NOTE:** If more or less than a single match is returned by the search,
+Terraform will fail. Ensure that your search is specific enough to return
+a single solution stack, or use `mostRecent` to choose the most recent one.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `name` - Name of the solution stack.
+
+[beanstalk-platforms]: http://docs.aws.amazon.com/elasticbeanstalk/latest/dg/concepts.platforms.html "AWS Elastic Beanstalk Supported Platforms documentation"
+
+<!-- cache-key: cdktf-0.18.0 input-bc5855ffbad2c3da05d523f3dafaef60d18324e30f798e90fe32639ded015eeb -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/elasticache_cluster.html.markdown b/website/docs/cdktf/typescript/d/elasticache_cluster.html.markdown
new file mode 100644
index 00000000000..8907b07395f
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/elasticache_cluster.html.markdown
@@ -0,0 +1,76 @@
+---
+subcategory: "ElastiCache"
+layout: "aws"
+page_title: "AWS: aws_elasticache_cluster"
+description: |-
+  Get information on an ElastiCache Cluster resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_elasticache_cluster
+
+Use this data source to get information about an ElastiCache Cluster
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsElasticacheCluster } from "./.gen/providers/aws/data-aws-elasticache-cluster";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsElasticacheCluster(this, "my_cluster", {
+      clusterId: "my-cluster-id",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `clusterId` – (Required) Group identifier.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `nodeType` – The cluster node type.
+* `numCacheNodes` – The number of cache nodes that the cache cluster has.
+* `engine` – Name of the cache engine.
+* `engineVersion` – Version number of the cache engine.
+* `ipDiscovery` - The IP version advertised in the discovery protocol.
+* `networkType` - The IP versions for cache cluster connections.
+* `subnetGroupName` – Name of the subnet group associated to the cache cluster.
+* `securityGroupIds` – List VPC security groups associated with the cache cluster.
+* `parameterGroupName` – Name of the parameter group associated with this cache cluster.
+* `replicationGroupId` - The replication group to which this cache cluster belongs.
+* `logDeliveryConfiguration` - Redis [SLOWLOG](https://redis.io/commands/slowlog) or Redis [Engine Log](https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/Log_Delivery.html#Log_contents-engine-log) delivery settings.
+* `maintenanceWindow` – Specifies the weekly time range for when maintenance
+on the cache cluster is performed.
+* `snapshotWindow` - Daily time range (in UTC) during which ElastiCache will
+begin taking a daily snapshot of the cache cluster.
+* `snapshotRetentionLimit` - The number of days for which ElastiCache will
+retain automatic cache cluster snapshots before deleting them.
+* `availabilityZone` - Availability Zone for the cache cluster.
+* `notificationTopicArn` – An ARN of an
+SNS topic that ElastiCache notifications get sent to.
+* `port` – The port number on which each of the cache nodes will
+accept connections.
+* `configurationEndpoint` - (Memcached only) Configuration endpoint to allow host discovery.
+* `clusterAddress` - (Memcached only) DNS name of the cache cluster without the port appended.
+* `preferredOutpostArn` - The outpost ARN in which the cache cluster was created if created in outpost.
+* `cacheNodes` - List of node objects including `id`, `address`, `port`, `availabilityZone` and `outpostArn`.
+   Referenceable e.g., as `${dataAwsElasticacheClusterBarCacheNodes0Address}`
+* `tags` - Tags assigned to the resource
+
+<!-- cache-key: cdktf-0.18.0 input-1e3ac11eb5023a5844f4de255a62edd6fa79961694900996bd0798736ae27445 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/elasticache_replication_group.html.markdown b/website/docs/cdktf/typescript/d/elasticache_replication_group.html.markdown
new file mode 100644
index 00000000000..9363c3b7d81
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/elasticache_replication_group.html.markdown
@@ -0,0 +1,65 @@
+---
+subcategory: "ElastiCache"
+layout: "aws"
+page_title: "AWS: aws_elasticache_replication_group"
+description: |-
+  Get information on an ElastiCache Replication Group resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_elasticache_replication_group
+
+Use this data source to get information about an ElastiCache Replication Group.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsElasticacheReplicationGroup } from "./.gen/providers/aws/data-aws-elasticache-replication-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsElasticacheReplicationGroup(this, "bar", {
+      replicationGroupId: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `replicationGroupId` – (Required) Identifier for the replication group.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `description` - Description of the replication group.
+* `arn` - ARN of the created ElastiCache Replication Group.
+* `authTokenEnabled` - Whether an AuthToken (password) is enabled.
+* `automaticFailoverEnabled` - A flag whether a read-only replica will be automatically promoted to read/write primary if the existing primary fails.
+* `nodeType` – The cluster node type.
+* `numCacheClusters` – The number of cache clusters that the replication group has.
+* `numNodeGroups` - Number of node groups (shards) for the replication group.
+* `memberClusters` - Identifiers of all the nodes that are part of this replication group.
+* `multiAzEnabled` - Whether Multi-AZ Support is enabled for the replication group.
+* `replicasPerNodeGroup` - Number of replica nodes in each node group.
+* `logDeliveryConfiguration` - Redis [SLOWLOG](https://redis.io/commands/slowlog) or Redis [Engine Log](https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/Log_Delivery.html#Log_contents-engine-log) delivery settings.
+* `snapshotWindow` - Daily time range (in UTC) during which ElastiCache begins taking a daily snapshot of your node group (shard).
+* `snapshotRetentionLimit` - The number of days for which ElastiCache retains automatic cache cluster snapshots before deleting them.
+* `port` – The port number on which the configuration endpoint will accept connections.
+* `configurationEndpointAddress` - The configuration endpoint address to allow host discovery.
+* `primaryEndpointAddress` - The endpoint of the primary node in this node group (shard).
+* `readerEndpointAddress` - The endpoint of the reader node in this node group (shard).
+
+<!-- cache-key: cdktf-0.18.0 input-88b0ad58e7a5f900fe3b48cf41ab1eb422b27cf6f91b31132f855aea899008d0 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/elasticache_subnet_group.html.markdown b/website/docs/cdktf/typescript/d/elasticache_subnet_group.html.markdown
new file mode 100644
index 00000000000..7b308bb6107
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/elasticache_subnet_group.html.markdown
@@ -0,0 +1,53 @@
+---
+subcategory: "ElastiCache"
+layout: "aws"
+page_title: "AWS: aws_elasticache_subnet_group"
+description: |-
+  Provides information about a ElastiCache Subnet Group.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_elasticache_subnet_group
+
+Provides information about a ElastiCache Subnet Group.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsElasticacheSubnetGroup } from "./.gen/providers/aws/data-aws-elasticache-subnet-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsElasticacheSubnetGroup(this, "example", {
+      name: "my-subnet-group",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) Name of the subnet group.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - Name of the subnet group.
+* `arn` - ARN of the subnet group.
+* `description` - Description of the subnet group.
+* `subnetIds` - Set of VPC Subnet ID-s of the subnet group.
+* `tags` - Map of tags assigned to the subnet group.
+
+<!-- cache-key: cdktf-0.18.0 input-a10cc3d3cb3b8626a11dcf295b29f911836bff7d00ed1bca0e896ee84c058643 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/elasticache_user.html.markdown b/website/docs/cdktf/typescript/d/elasticache_user.html.markdown
new file mode 100644
index 00000000000..3e276ba8f95
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/elasticache_user.html.markdown
@@ -0,0 +1,51 @@
+---
+subcategory: "ElastiCache"
+layout: "aws"
+page_title: "AWS: aws_elasticache_user"
+description: |-
+  Get information on an ElastiCache User resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_elasticache_user
+
+Use this data source to get information about an ElastiCache User.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsElasticacheUser } from "./.gen/providers/aws/data-aws-elasticache-user";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsElasticacheUser(this, "bar", {
+      userId: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `userId` – (Required) Identifier for the user.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `userId` - Identifier for the user.
+* `userName` - User name of the user.
+* `accessString` - String for what access a user possesses within the associated ElastiCache replication groups or clusters.
+
+<!-- cache-key: cdktf-0.18.0 input-64eebcc31de3d79926a950f1207062bdd9ae37c2badee3ea0ae9ce16d2cd8d16 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/elasticsearch_domain.html.markdown b/website/docs/cdktf/typescript/d/elasticsearch_domain.html.markdown
new file mode 100644
index 00000000000..3f5cfa3310c
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/elasticsearch_domain.html.markdown
@@ -0,0 +1,112 @@
+---
+subcategory: "Elasticsearch"
+layout: "aws"
+page_title: "AWS: aws_elasticsearch_domain"
+description: |-
+  Get information on an Elasticsearch Domain resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_elasticsearch_domain
+
+Use this data source to get information about an Elasticsearch Domain
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsElasticsearchDomain } from "./.gen/providers/aws/data-aws-elasticsearch-domain";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsElasticsearchDomain(this, "my_domain", {
+      domainName: "my-domain-name",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `domainName` – (Required) Name of the domain.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `accessPolicies` – The policy document attached to the domain.
+* `advancedOptions` - Key-value string pairs to specify advanced configuration options.
+* `advancedSecurityOptions` - Status of the Elasticsearch domain's advanced security options. The block consists of the following attributes:
+    * `enabled` - Whether advanced security is enabled.
+    * `internalUserDatabaseEnabled` - Whether the internal user database is enabled.
+* `arn` – The ARN of the domain.
+* `autoTuneOptions` - Configuration of the Auto-Tune options of the domain.
+    * `desiredState` - The Auto-Tune desired state for the domain.
+    * `maintenanceSchedule` - A list of the nested configurations for the Auto-Tune maintenance windows of the domain.
+        * `startAt` - Date and time at which the Auto-Tune maintenance schedule starts in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8).
+        * `duration` - Configuration block for the duration of the Auto-Tune maintenance window.
+            * `value` - Duration of an Auto-Tune maintenance window.
+            * `unit` - Unit of time.
+        * `cronExpressionForRecurrence` - Cron expression for an Auto-Tune maintenance schedule.
+    * `rollbackOnDisable` - Whether the domain is set to roll back to default Auto-Tune settings when disabling Auto-Tune.
+* `clusterConfig` - Cluster configuration of the domain.
+    * `coldStorageOptions` - Configuration block containing cold storage configuration.
+        * `enabled` - Indicates  cold storage is enabled.
+    * `instanceType` - Instance type of data nodes in the cluster.
+    * `instanceCount` - Number of instances in the cluster.
+    * `dedicatedMasterEnabled` - Indicates whether dedicated master nodes are enabled for the cluster.
+    * `dedicatedMasterType` - Instance type of the dedicated master nodes in the cluster.
+    * `dedicatedMasterCount` - Number of dedicated master nodes in the cluster.
+    * `zoneAwarenessEnabled` - Indicates whether zone awareness is enabled.
+    * `zoneAwarenessConfig` - Configuration block containing zone awareness settings.
+        * `availabilityZoneCount` - Number of availability zones used.
+    * `warmEnabled` - Warm storage is enabled.
+    * `warmCount` - The number of warm nodes in the cluster.
+    * `warmType` - The instance type for the Elasticsearch cluster's warm nodes.
+* `cognitoOptions` - Domain Amazon Cognito Authentication options for Kibana.
+    * `enabled` - Whether Amazon Cognito Authentication is enabled.
+    * `userPoolId` - The Cognito User pool used by the domain.
+    * `identityPoolId` - The Cognito Identity pool used by the domain.
+    * `roleArn` - The IAM Role with the AmazonESCognitoAccess policy attached.
+* `created` – Status of the creation of the domain.
+* `deleted` – Status of the deletion of the domain.
+* `domainId` – Unique identifier for the domain.
+* `ebsOptions` - EBS Options for the instances in the domain.
+    * `ebsEnabled` - Whether EBS volumes are attached to data nodes in the domain.
+    * `throughput` - The throughput (in MiB/s) of the EBS volumes attached to data nodes.
+    * `volumeType` - The type of EBS volumes attached to data nodes.
+    * `volumeSize` - The size of EBS volumes attached to data nodes (in GB).
+    * `iops` - The baseline input/output (I/O) performance of EBS volumes attached to data nodes.
+* `elasticsearchVersion` – Elasticsearch version for the domain.
+* `encryptionAtRest` - Domain encryption at rest related options.
+    * `enabled` - Whether encryption at rest is enabled in the domain.
+    * `kmsKeyId` - The KMS key id used to encrypt data at rest.
+* `endpoint` – Domain-specific endpoint used to submit index, search, and data upload requests.
+* `kibanaEndpoint` - Domain-specific endpoint used to access the Kibana application.
+* `logPublishingOptions` - Domain log publishing related options.
+    * `logType` - The type of Elasticsearch log being published.
+    * `cloudwatchLogGroupArn` - The CloudWatch Log Group where the logs are published.
+    * `enabled` - Whether log publishing is enabled.
+* `nodeToNodeEncryption` - Domain in transit encryption related options.
+    * `enabled` - Whether node to node encryption is enabled.
+* `processing` – Status of a configuration change in the domain.
+* `snapshotOptions` – Domain snapshot related options.
+    * `automatedSnapshotStartHour` - Hour during which the service takes an automated daily snapshot of the indices in the domain.
+* `tags` - Tags assigned to the domain.
+* `vpcOptions` - VPC Options for private Elasticsearch domains.
+    * `availabilityZones` - The availability zones used by the domain.
+    * `securityGroupIds` - The security groups used by the domain.
+    * `subnetIds` - The subnets used by the domain.
+    * `vpcId` - The VPC used by the domain.
+
+<!-- cache-key: cdktf-0.18.0 input-7feb15d47a2d190cb607bbd9038a049ea8b0ea44a4960e578dae2f2fe8f04a38 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/elb.html.markdown b/website/docs/cdktf/typescript/d/elb.html.markdown
new file mode 100644
index 00000000000..7fee75f3d95
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/elb.html.markdown
@@ -0,0 +1,60 @@
+---
+subcategory: "ELB Classic"
+layout: "aws"
+page_title: "AWS: aws_elb"
+description: |-
+  Provides a classic Elastic Load Balancer data source.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# aws_elb
+
+Provides information about a "classic" Elastic Load Balancer (ELB).
+See [LB Data Source](/docs/providers/aws/d/lb.html) if you are looking for "v2"
+Application Load Balancer (ALB) or Network Load Balancer (NLB).
+
+This data source can prove useful when a module accepts an LB as an input
+variable and needs to, for example, determine the security groups associated
+with it, etc.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { VariableType, TerraformVariable, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsElb } from "./.gen/providers/aws/data-aws-elb";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    /*Terraform Variables are not always the best fit for getting inputs in the context of Terraform CDK.
+    You can read more about this at https://cdk.tf/variables*/
+    const lbName = new TerraformVariable(this, "lb_name", {
+      default: "",
+      type: VariableType.STRING,
+    });
+    new DataAwsElb(this, "test", {
+      name: lbName.stringValue,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Unique name of the load balancer.
+
+## Attribute Reference
+
+See the [ELB Resource](/docs/providers/aws/r/elb.html) for details on the
+returned attributes - they are identical.
+
+<!-- cache-key: cdktf-0.18.0 input-82d29b709dd7359897c580a20647f7da354bd7d44a7d5f92c310d80cad1259b8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/elb_hosted_zone_id.html.markdown b/website/docs/cdktf/typescript/d/elb_hosted_zone_id.html.markdown
new file mode 100644
index 00000000000..5e29731be5d
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/elb_hosted_zone_id.html.markdown
@@ -0,0 +1,58 @@
+---
+subcategory: "ELB Classic"
+layout: "aws"
+page_title: "AWS: aws_elb_hosted_zone_id"
+description: |-
+  Get AWS Elastic Load Balancing Hosted Zone Id
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_elb_hosted_zone_id
+
+Use this data source to get the HostedZoneId of the AWS Elastic Load Balancing HostedZoneId
+in a given region for the purpose of using in an AWS Route53 Alias.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsElbHostedZoneId } from "./.gen/providers/aws/data-aws-elb-hosted-zone-id";
+import { Route53Record } from "./.gen/providers/aws/route53-record";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const main = new DataAwsElbHostedZoneId(this, "main", {});
+    new Route53Record(this, "www", {
+      alias: {
+        evaluateTargetHealth: true,
+        name: Token.asString(awsElbMain.dnsName),
+        zoneId: Token.asString(main.id),
+      },
+      name: "example.com",
+      type: "A",
+      zoneId: primary.zoneId,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `region` - (Optional) Name of the region whose AWS ELB HostedZoneId is desired.
+  Defaults to the region from the AWS provider configuration.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the AWS ELB HostedZoneId in the selected region.
+
+<!-- cache-key: cdktf-0.18.0 input-c2a71897abaf8ebad957ebc450a6e6db3c22c6c5e61e688eccadc3e3e3d48143 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/elb_service_account.html.markdown b/website/docs/cdktf/typescript/d/elb_service_account.html.markdown
new file mode 100644
index 00000000000..50ff5e2cdae
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/elb_service_account.html.markdown
@@ -0,0 +1,107 @@
+---
+subcategory: "ELB Classic"
+layout: "aws"
+page_title: "AWS: aws_elb_service_account"
+description: |-
+  Get AWS Elastic Load Balancing Service Account
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_elb_service_account
+
+Use this data source to get the Account ID of the [AWS Elastic Load Balancing Service Account](http://docs.aws.amazon.com/elasticloadbalancing/latest/classic/enable-access-logs.html#attach-bucket-policy)
+in a given region for the purpose of permitting in S3 bucket policy.
+
+~> **Note:** For AWS Regions opened since Jakarta (`apSoutheast3`) in December 2021, AWS [documents that](https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/enable-access-logs.html#attach-bucket-policy) a [service principal name](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html#principal-services) should be used instead of an AWS account ID in any relevant IAM policy.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsElbServiceAccount } from "./.gen/providers/aws/data-aws-elb-service-account";
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { Elb } from "./.gen/providers/aws/elb";
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketAcl } from "./.gen/providers/aws/s3-bucket-acl";
+import { S3BucketPolicy } from "./.gen/providers/aws/s3-bucket-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const elbLogs = new S3Bucket(this, "elb_logs", {
+      bucket: "my-elb-tf-test-bucket",
+    });
+    new S3BucketAcl(this, "elb_logs_acl", {
+      acl: "private",
+      bucket: elbLogs.id,
+    });
+    const main = new DataAwsElbServiceAccount(this, "main", {});
+    const allowElbLogging = new DataAwsIamPolicyDocument(
+      this,
+      "allow_elb_logging",
+      {
+        statement: [
+          {
+            actions: ["s3:PutObject"],
+            effect: "Allow",
+            principals: [
+              {
+                identifiers: [Token.asString(main.arn)],
+                type: "AWS",
+              },
+            ],
+            resources: ["${" + elbLogs.arn + "}/AWSLogs/*"],
+          },
+        ],
+      }
+    );
+    new Elb(this, "bar", {
+      accessLogs: {
+        bucket: elbLogs.id,
+        interval: 5,
+      },
+      availabilityZones: ["us-west-2a"],
+      listener: [
+        {
+          instancePort: 8000,
+          instanceProtocol: "http",
+          lbPort: 80,
+          lbProtocol: "http",
+        },
+      ],
+      name: "my-foobar-terraform-elb",
+    });
+    const awsS3BucketPolicyAllowElbLogging = new S3BucketPolicy(
+      this,
+      "allow_elb_logging_5",
+      {
+        bucket: elbLogs.id,
+        policy: Token.asString(allowElbLogging.json),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketPolicyAllowElbLogging.overrideLogicalId("allow_elb_logging");
+  }
+}
+
+```
+
+## Argument Reference
+
+* `region` - (Optional) Name of the region whose AWS ELB account ID is desired.
+  Defaults to the region from the AWS provider configuration.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the AWS ELB service account in the selected region.
+* `arn` - ARN of the AWS ELB service account in the selected region.
+
+<!-- cache-key: cdktf-0.18.0 input-5c1a0a2f00d960e1eac9847050597712fa9715a5b915ce4e9af9ffb2813ec3ab -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/emr_release_labels.html.markdown b/website/docs/cdktf/typescript/d/emr_release_labels.html.markdown
new file mode 100644
index 00000000000..02d04609bfe
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/emr_release_labels.html.markdown
@@ -0,0 +1,55 @@
+---
+subcategory: "EMR"
+layout: "aws"
+page_title: "AWS: aws_emr_release_labels"
+description: |-
+  Retrieve information about EMR Release Labels
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_emr_release_labels
+
+Retrieve information about EMR Release Labels.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsEmrReleaseLabels } from "./.gen/providers/aws/data-aws-emr-release-labels";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsEmrReleaseLabels(this, "example", {
+      filters: {
+        application: "spark@2.1.0",
+        prefix: "emr-5",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `filters` – (Optional) Filters the results of the request. Prefix specifies the prefix of release labels to return. Application specifies the application (with/without version) of release labels to return. See [Filters](#filters).
+
+### Filters
+
+* `application` - (Optional) Optional release label application filter. For example, `spark@210` or `spark`.
+* `prefix` - (Optional) Optional release label version prefix filter. For example, `emr5`.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `releaseLabels` - Returned release labels.
+
+<!-- cache-key: cdktf-0.18.0 input-caff30a437585dca8d53271b57c03d47d50046916f1661780cb3a6963d53b86c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/emr_release_labels.markdown b/website/docs/cdktf/typescript/d/emr_release_labels.markdown
new file mode 100644
index 00000000000..02d04609bfe
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/emr_release_labels.markdown
@@ -0,0 +1,55 @@
+---
+subcategory: "EMR"
+layout: "aws"
+page_title: "AWS: aws_emr_release_labels"
+description: |-
+  Retrieve information about EMR Release Labels
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_emr_release_labels
+
+Retrieve information about EMR Release Labels.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsEmrReleaseLabels } from "./.gen/providers/aws/data-aws-emr-release-labels";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsEmrReleaseLabels(this, "example", {
+      filters: {
+        application: "spark@2.1.0",
+        prefix: "emr-5",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `filters` – (Optional) Filters the results of the request. Prefix specifies the prefix of release labels to return. Application specifies the application (with/without version) of release labels to return. See [Filters](#filters).
+
+### Filters
+
+* `application` - (Optional) Optional release label application filter. For example, `spark@210` or `spark`.
+* `prefix` - (Optional) Optional release label version prefix filter. For example, `emr5`.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `releaseLabels` - Returned release labels.
+
+<!-- cache-key: cdktf-0.18.0 input-caff30a437585dca8d53271b57c03d47d50046916f1661780cb3a6963d53b86c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/emrcontainers_virtual_cluster.html.markdown b/website/docs/cdktf/typescript/d/emrcontainers_virtual_cluster.html.markdown
new file mode 100644
index 00000000000..62832bd8a37
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/emrcontainers_virtual_cluster.html.markdown
@@ -0,0 +1,64 @@
+---
+subcategory: "EMR Containers"
+layout: "aws"
+page_title: "AWS: aws_emrcontainers_virtual_cluster"
+description: |-
+  Retrieve information about an EMR Containers (EMR on EKS) Virtual Cluster
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_emrcontainers_virtual_cluster
+
+Retrieve information about an EMR Containers (EMR on EKS) Virtual Cluster.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformOutput, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsEmrcontainersVirtualCluster } from "./.gen/providers/aws/data-aws-emrcontainers-virtual-cluster";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new DataAwsEmrcontainersVirtualCluster(this, "example", {
+      virtualClusterId: "example id",
+    });
+    new TerraformOutput(this, "arn", {
+      value: example.arn,
+    });
+    new TerraformOutput(this, "name", {
+      value: example.name,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `virtualClusterId` - (Required) ID of the cluster.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the cluster.
+* `name` - Name of the cluster.
+* `arn` - ARN of the cluster.
+* `containerProvider` - Nested attribute containing information about the underlying container provider (EKS cluster) for your EMR Containers cluster.
+    * `id` - The name of the container provider that is running your EMR Containers cluster
+    * `info` - Nested list containing information about the configuration of the container provider
+        * `eksInfo` - Nested list containing EKS-specific information about the cluster where the EMR Containers cluster is running
+            * `namespace` - The namespace where the EMR Containers cluster is running
+    * `type` - The type of the container provider
+* `createdAt` - Unix epoch time stamp in seconds for when the cluster was created.
+* `state` - Status of the EKS cluster. One of `running`, `terminating`, `terminated`, `arrested`.
+* `tags` - Key-value mapping of resource tags.
+
+<!-- cache-key: cdktf-0.18.0 input-b68b876212554fb1c28230029578a838320e08a00b6bc270b81195566fe1902f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/emrcontainers_virtual_cluster.markdown b/website/docs/cdktf/typescript/d/emrcontainers_virtual_cluster.markdown
new file mode 100644
index 00000000000..62832bd8a37
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/emrcontainers_virtual_cluster.markdown
@@ -0,0 +1,64 @@
+---
+subcategory: "EMR Containers"
+layout: "aws"
+page_title: "AWS: aws_emrcontainers_virtual_cluster"
+description: |-
+  Retrieve information about an EMR Containers (EMR on EKS) Virtual Cluster
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_emrcontainers_virtual_cluster
+
+Retrieve information about an EMR Containers (EMR on EKS) Virtual Cluster.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformOutput, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsEmrcontainersVirtualCluster } from "./.gen/providers/aws/data-aws-emrcontainers-virtual-cluster";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new DataAwsEmrcontainersVirtualCluster(this, "example", {
+      virtualClusterId: "example id",
+    });
+    new TerraformOutput(this, "arn", {
+      value: example.arn,
+    });
+    new TerraformOutput(this, "name", {
+      value: example.name,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `virtualClusterId` - (Required) ID of the cluster.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the cluster.
+* `name` - Name of the cluster.
+* `arn` - ARN of the cluster.
+* `containerProvider` - Nested attribute containing information about the underlying container provider (EKS cluster) for your EMR Containers cluster.
+    * `id` - The name of the container provider that is running your EMR Containers cluster
+    * `info` - Nested list containing information about the configuration of the container provider
+        * `eksInfo` - Nested list containing EKS-specific information about the cluster where the EMR Containers cluster is running
+            * `namespace` - The namespace where the EMR Containers cluster is running
+    * `type` - The type of the container provider
+* `createdAt` - Unix epoch time stamp in seconds for when the cluster was created.
+* `state` - Status of the EKS cluster. One of `running`, `terminating`, `terminated`, `arrested`.
+* `tags` - Key-value mapping of resource tags.
+
+<!-- cache-key: cdktf-0.18.0 input-b68b876212554fb1c28230029578a838320e08a00b6bc270b81195566fe1902f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/fsx_ontap_file_system.html.markdown b/website/docs/cdktf/typescript/d/fsx_ontap_file_system.html.markdown
new file mode 100644
index 00000000000..48fc8c492ef
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/fsx_ontap_file_system.html.markdown
@@ -0,0 +1,86 @@
+---
+subcategory: "FSx"
+layout: "aws"
+page_title: "AWS: aws_fsx_ontap_file_system"
+description: |-
+  Retrieve information on FSx ONTAP File System.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_fsx_ontap_file_system
+
+Retrieve information on FSx ONTAP File System.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsFsxOntapFileSystem } from "./.gen/providers/aws/data-aws-fsx-ontap-file-system";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsFsxOntapFileSystem(this, "example", {
+      id: "fs-12345678",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `id` - (Required) Identifier of the file system (e.g. `fs12345678`).
+
+## Attributes Reference
+
+In addition to all arguments above, the following attributes are exported:
+
+* `arn` - Amazon Resource Name of the file system.
+* `automaticBackupRetentionDays` - The number of days to retain automatic backups.
+* `dailyAutomaticBackupStartTime` - The preferred time (in `hh:mm` format) to take daily automatic backups, in the UTC time zone.
+* `deploymentType` - The file system deployment type.
+* `diskIopsConfiguration` - The SSD IOPS configuration for the Amazon FSx for NetApp ONTAP file system, specifying the number of provisioned IOPS and the provision mode. See [Disk IOPS](#disk-iops) Below.
+* `dnsName` - DNS name for the file system (e.g. `fs12345678CorpExampleCom`).
+* `endpointIpAddressRange` - (Multi-AZ only) Specifies the IP address range in which the endpoints to access your file system exist.
+* `endpoints` - The Management and Intercluster FileSystemEndpoints that are used to access data or to manage the file system using the NetApp ONTAP CLI, REST API, or NetApp SnapMirror. See [FileSystemEndpoints](#file-system-endpoints) below.
+* `id` - Identifier of the file system (e.g. `fs12345678`).
+* `kmsKeyId` - ARN for the KMS Key to encrypt the file system at rest.
+* `networkInterfaceIds` - The IDs of the elastic network interfaces from which a specific file system is accessible.
+* `ownerId` - AWS account identifier that created the file system.
+* `preferredSubnetId` - Specifies the subnet in which you want the preferred file server to be located.
+* `routeTableIds` - (Multi-AZ only) The VPC route tables in which your file system's endpoints exist.
+* `storageCapacity` - The storage capacity of the file system in gibibytes (GiB).
+* `storageType` - The type of storage the file system is using. If set to `ssd`, the file system uses solid state drive storage. If set to `hdd`, the file system uses hard disk drive storage.
+* `subnetIds` - Specifies the IDs of the subnets that the file system is accessible from. For the MULTI_AZ_1 file system deployment type, there are two subnet IDs, one for the preferred file server and one for the standby file server. The preferred file server subnet identified in the `preferredSubnetId` property.
+* `tags` - The tags associated with the file system.
+* `throughputCapacity` - The sustained throughput of an Amazon FSx file system in Megabytes per second (MBps).
+* `vpcId` - The ID of the primary virtual private cloud (VPC) for the file system.
+* `weeklyMaintenanceStartTime` - The preferred start time (in `d:hh:mm` format) to perform weekly maintenance, in the UTC time zone.
+
+### Disk IOPS
+
+* `iops` - The total number of SSD IOPS provisioned for the file system.
+* `mode` - Specifies whether the file system is using the `automatic` setting of SSD IOPS of 3 IOPS per GB of storage capacity, or if it using a `userProvisioned` value.
+
+### File System Endpoints
+
+* `intercluster` - A FileSystemEndpoint for managing your file system by setting up NetApp SnapMirror with other ONTAP systems. See [FileSystemEndpoint](#file-system-endpoint) below.
+* `management` - A FileSystemEndpoint for managing your file system using the NetApp ONTAP CLI and NetApp ONTAP API. See [FileSystemEndpoint](#file-system-endpoint) below.
+
+### File System Endpoint
+
+* `dnsName` - The file system's DNS name. You can mount your file system using its DNS name.
+* `ipAddresses` - IP addresses of the file system endpoint.
+
+<!-- cache-key: cdktf-0.18.0 input-459fa001b98c16cffb882c5412b5d97d3d6335c21e394631f65f1e2eade0cc2d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/fsx_ontap_storage_virtual_machine.html.markdown b/website/docs/cdktf/typescript/d/fsx_ontap_storage_virtual_machine.html.markdown
new file mode 100644
index 00000000000..8fe806f5d6b
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/fsx_ontap_storage_virtual_machine.html.markdown
@@ -0,0 +1,131 @@
+---
+subcategory: "FSx"
+layout: "aws"
+page_title: "AWS: aws_fsx_ontap_storage_virtual_machine"
+description: |-
+  Retrieve information on FSx ONTAP Storage Virtual Machine (SVM).
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_fsx_ontap_storage_virtual_machine
+
+Retrieve information on FSx ONTAP Storage Virtual Machine (SVM).
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsFsxOntapStorageVirtualMachine } from "./.gen/providers/aws/data-aws-fsx-ontap-storage-virtual-machine";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsFsxOntapStorageVirtualMachine(this, "example", {
+      id: "svm-12345678",
+    });
+  }
+}
+
+```
+
+### Filter Example
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsFsxOntapStorageVirtualMachine } from "./.gen/providers/aws/data-aws-fsx-ontap-storage-virtual-machine";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsFsxOntapStorageVirtualMachine(this, "example", {
+      filter: [
+        {
+          name: "file-system-id",
+          values: ["fs-12345678"],
+        },
+      ],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The arguments of this data source act as filters for querying the available ONTAP Storage Virtual Machines in the current region. The given filters must match exactly one Storage Virtual Machine whose data will be exported as attributes.
+
+The following arguments are optional:
+
+* `filter` - (Optional) Configuration block. Detailed below.
+* `id` - (Optional) Identifier of the storage virtual machine (e.g. `svm12345678`).
+
+### filter
+
+This block allows for complex filters.
+
+The following arguments are required:
+
+* `name` - (Required) Name of the field to filter by, as defined by [the underlying AWS API](https://docs.aws.amazon.com/fsx/latest/APIReference/API_StorageVirtualMachineFilter.html).
+* `values` - (Required) Set of values that are accepted for the given field. An SVM will be selected if any one of the given values matches.
+
+## Attributes Reference
+
+In addition to all arguments above, the following attributes are exported:
+
+* `arn` - Amazon Resource Name of the SVM.
+* `activeDirectoryConfiguration` - The Microsoft Active Directory configuration to which the SVM is joined, if applicable. See [Active Directory Configuration](#active-directory-configuration) below.
+* `creationTime` - The time that the SVM was created.
+* `endpoints` - The endpoints that are used to access data or to manage the SVM using the NetApp ONTAP CLI, REST API, or NetApp CloudManager. They are the Iscsi, Management, Nfs, and Smb endpoints. See [SVM Endpoints](#svm-endpoints) below.
+* `fileSystemId` - Identifier of the file system (e.g. `fs12345678`).
+* `id` - The SVM's system generated unique ID.
+* `lifecycleStatus` - The SVM's lifecycle status.
+* `lifecycleTransitionReason` - Describes why the SVM lifecycle state changed. See [Lifecycle Transition Reason](#lifecycle-transition-reason) below.
+* `name` - The name of the SVM, if provisioned.
+* `subtype` - The SVM's subtype.
+* `uuid` - The SVM's UUID.
+
+### Active Directory Configuration
+
+The following arguments are supported for `activeDirectoryConfiguration` configuration block:
+
+* `netbiosName` - The NetBIOS name of the AD computer object to which the SVM is joined.
+* `selfManagedActiveDirectory` - The configuration of the self-managed Microsoft Active Directory (AD) directory to which the Windows File Server or ONTAP storage virtual machine (SVM) instance is joined. See [Self Managed Active Directory](#self-managed-active-directory) below.
+
+### Self Managed Active Directory
+
+* `dnsIps` - A list of up to three IP addresses of DNS servers or domain controllers in the self-managed AD directory.
+* `domainName` - The fully qualified domain name of the self-managed AD directory.
+* `fileSystemAdministratorsGroup` - The name of the domain group whose members have administrative privileges for the FSx file system.
+* `organizationalUnitDistinguishedName` - The fully qualified distinguished name of the organizational unit within the self-managed AD directory to which the Windows File Server or ONTAP storage virtual machine (SVM) instance is joined.
+* `username` - The user name for the service account on your self-managed AD domain that FSx uses to join to your AD domain.
+
+### Lifecycle Transition Reason
+
+* `message` - A detailed message.
+
+### SVM Endpoints
+
+* `iscsi` - An endpoint for connecting using the Internet Small Computer Systems Interface (iSCSI) protocol. See [SVM Endpoint](#svm-endpoint) below.
+* `management` - An endpoint for managing SVMs using the NetApp ONTAP CLI, NetApp ONTAP API, or NetApp CloudManager. See [SVM Endpoint](#svm-endpoint) below.
+* `nfs` - An endpoint for connecting using the Network File System (NFS) protocol. See [SVM Endpoint](#svm-endpoint) below.
+* `smb` - An endpoint for connecting using the Server Message Block (SMB) protocol. See [SVM Endpoint](#svm-endpoint) below.
+
+### SVM Endpoint
+
+* `dnsName` - The file system's DNS name. You can mount your file system using its DNS name.
+* `ipAddresses` - The SVM endpoint's IP addresses.
+
+<!-- cache-key: cdktf-0.18.0 input-f6cea127fecc9fef03f1751e79c3dcabeee15d54d55425580842b9e868758d48 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/fsx_ontap_storage_virtual_machines.html.markdown b/website/docs/cdktf/typescript/d/fsx_ontap_storage_virtual_machines.html.markdown
new file mode 100644
index 00000000000..d613cfbd121
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/fsx_ontap_storage_virtual_machines.html.markdown
@@ -0,0 +1,61 @@
+---
+subcategory: "FSx"
+layout: "aws"
+page_title: "AWS: aws_fsx_ontap_storage_virtual_machines"
+description: |-
+  This resource can be useful for getting back a set of FSx ONTAP Storage Virtual Machine (SVM) IDs.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_fsx_ontap_storage_virtual_machines
+
+This resource can be useful for getting back a set of FSx ONTAP Storage Virtual Machine (SVM) IDs.
+
+## Example Usage
+
+The following shows outputting all SVM IDs for a given FSx ONTAP File System.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsFsxOntapStorageVirtualMachines } from "./.gen/providers/aws/data-aws-fsx-ontap-storage-virtual-machines";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsFsxOntapStorageVirtualMachines(this, "example", {
+      filter: [
+        {
+          name: "file-system-id",
+          values: ["fs-12345678"],
+        },
+      ],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `filter` - (Optional) Configuration block. Detailed below.
+
+### filter
+
+This block allows for complex filters.
+
+The following arguments are required:
+
+* `name` - (Required) Name of the field to filter by, as defined by [the underlying AWS API](https://docs.aws.amazon.com/fsx/latest/APIReference/API_StorageVirtualMachineFilter.html).
+* `values` - (Required) Set of values that are accepted for the given field. An SVM will be selected if any one of the given values matches.
+
+## Attributes Reference
+
+* `ids` - List of all SVM IDs found.
+
+<!-- cache-key: cdktf-0.18.0 input-fe65afdf53d4c09b7ace920dfb5af1c86aa9ada3e1dee3a6a467d53273829e75 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/fsx_openzfs_snapshot.html.markdown b/website/docs/cdktf/typescript/d/fsx_openzfs_snapshot.html.markdown
new file mode 100644
index 00000000000..f521ccc1d78
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/fsx_openzfs_snapshot.html.markdown
@@ -0,0 +1,68 @@
+---
+subcategory: "FSx"
+layout: "aws"
+page_title: "AWS: aws_fsx_openzfs_snapshot"
+description: |-
+  Get information on an Amazon FSx for OpenZFS snapshot.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_fsx_openzfs_snapshot
+
+Use this data source to get information about an Amazon FSx for OpenZFS Snapshot for use when provisioning new Volumes.
+
+## Example Usage
+
+### Root volume Example
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsFsxOpenzfsSnapshot } from "./.gen/providers/aws/data-aws-fsx-openzfs-snapshot";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsFsxOpenzfsSnapshot(this, "example", {
+      filter: [
+        {
+          name: "volume-id",
+          values: ["fsvol-073a32b6098a73feb"],
+        },
+      ],
+      mostRecent: true,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `mostRecent` - (Optional) If more than one result is returned, use the most recent snapshot.
+
+* `snapshotIds` - (Optional) Returns information on a specific snapshot_id.
+
+* `filter` - (Optional) One or more name/value pairs to filter off of. The
+supported names are file-system-id or volume-id.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name of the snapshot.
+* `creationTime` - Time that the resource was created.
+* `id` - Identifier of the snapshot, e.g., `fsvolsnap12345678`
+* `name` - Name of the snapshot.
+* `snapshotId` - ID of the snapshot.
+* `tags` - List of Tag values, with a maximum of 50 elements.
+* `volumeId` - ID of the volume that the snapshot is of.
+
+<!-- cache-key: cdktf-0.18.0 input-8de9bd583ae91dc99a2426809f4ba7a76d20e95064b4a418a3d285d9bb3c459b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/fsx_windows_file_system.html.markdown b/website/docs/cdktf/typescript/d/fsx_windows_file_system.html.markdown
new file mode 100644
index 00000000000..abb0af65f1c
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/fsx_windows_file_system.html.markdown
@@ -0,0 +1,72 @@
+---
+subcategory: "FSx"
+layout: "aws"
+page_title: "AWS: aws_fsx_windows_file_system"
+description: |-
+  Retrieve information on FSx Windows File System.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_fsx_windows_file_system
+
+Retrieve information on FSx Windows File System.
+
+## Example Usage
+
+### Root volume Example
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsFsxWindowsFileSystem } from "./.gen/providers/aws/data-aws-fsx-windows-file-system";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsFsxWindowsFileSystem(this, "example", {
+      id: "fs-12345678",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `id` - (Required) Identifier of the file system (e.g. `fs12345678`).
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `activeDirectoryId` - The ID for Microsoft Active Directory instance that the file system is join to.
+* `aliases` - An array DNS alias names associated with the Amazon FSx file system.
+* `arn` - Amazon Resource Name of the file system.
+* `auditLogConfiguration` - The configuration that Amazon FSx for Windows File Server uses to audit and log user accesses of files, folders, and file shares on the Amazon FSx for Windows File Server file system.
+* `automaticBackupRetentionDays` - The number of days to retain automatic backups.
+* `copyTagsToBackups` - A boolean flag indicating whether tags on the file system should be copied to backups.
+* `dailyAutomaticBackupStartTime` - The preferred time (in `hh:mm` format) to take daily automatic backups, in the UTC time zone.
+* `deploymentType` - The file system deployment type.
+* `diskIopsConfiguration` - The SSD IOPS configuration for the file system.
+* `dnsName` - DNS name for the file system (e.g. `fs12345678CorpExampleCom`).
+* `id` - Identifier of the file system (e.g. `fs12345678`).
+* `kmsKeyId` - ARN for the KMS Key to encrypt the file system at rest.
+* `ownerId` - AWS account identifier that created the file system.
+* `preferredSubnetId` - Specifies the subnet in which you want the preferred file server to be located.
+* `preferredFileServerIp` - The IP address of the primary, or preferred, file server.
+* `storageCapacity` - The storage capacity of the file system in gibibytes (GiB).
+* `storageType` - The type of storage the file system is using. If set to `ssd`, the file system uses solid state drive storage. If set to `hdd`, the file system uses hard disk drive storage.
+* `subnetIds` - Specifies the IDs of the subnets that the file system is accessible from.
+* `tags` - The tags to associate with the file system.
+* `throughputCapacity` - Throughput (megabytes per second) of the file system in power of 2 increments. Minimum of `8` and maximum of `2048`.
+* `vpcId` - The ID of the primary virtual private cloud (VPC) for the file system.
+* `weeklyMaintenanceStartTime` - The preferred start time (in `d:hh:mm` format) to perform weekly maintenance, in the UTC time zone.
+
+<!-- cache-key: cdktf-0.18.0 input-7198016fdc5b76faa665d2e4a51c953549b6306de9af8ea688a7e3e2494a16d6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/globalaccelerator_accelerator.html.markdown b/website/docs/cdktf/typescript/d/globalaccelerator_accelerator.html.markdown
new file mode 100644
index 00000000000..b4f60c0fad2
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/globalaccelerator_accelerator.html.markdown
@@ -0,0 +1,62 @@
+---
+subcategory: "Global Accelerator"
+layout: "aws"
+page_title: "AWS: aws_globalaccelerator_accelerator"
+description: |-
+  Provides a Global Accelerator accelerator data source.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_globalaccelerator_accelerator
+
+Provides information about a Global Accelerator accelerator.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { VariableType, TerraformVariable, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsGlobalacceleratorAccelerator } from "./.gen/providers/aws/data-aws-globalaccelerator-accelerator";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    /*Terraform Variables are not always the best fit for getting inputs in the context of Terraform CDK.
+    You can read more about this at https://cdk.tf/variables*/
+    const acceleratorArn = new TerraformVariable(this, "accelerator_arn", {
+      default: "",
+      type: VariableType.STRING,
+    });
+    const acceleratorName = new TerraformVariable(this, "accelerator_name", {
+      default: "",
+      type: VariableType.STRING,
+    });
+    new DataAwsGlobalacceleratorAccelerator(this, "example", {
+      arn: acceleratorArn.stringValue,
+      name: acceleratorName.stringValue,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `arn` - (Optional) Full ARN of the Global Accelerator.
+* `name` - (Optional) Unique name of the Global Accelerator.
+
+~> **NOTE:** When both `arn` and `name` are specified, `arn` takes precedence.
+
+## Attribute Reference
+
+See the [`awsGlobalacceleratorAccelerator` resource](/docs/providers/aws/r/globalaccelerator_accelerator.html) for details on the
+returned attributes - they are identical.
+
+<!-- cache-key: cdktf-0.18.0 input-cb1337cef607f58a3c97dc590b01ec464124ea11b4eae120be4bb79fd188c55c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/globalaccelerator_custom_routing_accelerator.html.markdown b/website/docs/cdktf/typescript/d/globalaccelerator_custom_routing_accelerator.html.markdown
new file mode 100644
index 00000000000..bfc82a97c14
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/globalaccelerator_custom_routing_accelerator.html.markdown
@@ -0,0 +1,62 @@
+---
+subcategory: "Global Accelerator"
+layout: "aws"
+page_title: "AWS: aws_globalaccelerator_custom_routing_accelerator"
+description: |-
+  Provides a Global Accelerator custom routing accelerator data source.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_globalaccelerator_custom_routing_accelerator
+
+Provides information about a Global Accelerator custom routing accelerator.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { VariableType, TerraformVariable, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsGlobalacceleratorCustomRoutingAccelerator } from "./.gen/providers/aws/data-aws-globalaccelerator-custom-routing-accelerator";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    /*Terraform Variables are not always the best fit for getting inputs in the context of Terraform CDK.
+    You can read more about this at https://cdk.tf/variables*/
+    const acceleratorArn = new TerraformVariable(this, "accelerator_arn", {
+      default: "",
+      type: VariableType.STRING,
+    });
+    const acceleratorName = new TerraformVariable(this, "accelerator_name", {
+      default: "",
+      type: VariableType.STRING,
+    });
+    new DataAwsGlobalacceleratorCustomRoutingAccelerator(this, "example", {
+      arn: acceleratorArn.stringValue,
+      name: acceleratorName.stringValue,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `arn` - (Optional) Full ARN of the custom routing accelerator.
+* `name` - (Optional) Unique name of the custom routing accelerator.
+
+~> **NOTE:** When both `arn` and `name` are specified, `arn` takes precedence.
+
+## Attribute Reference
+
+See the [`awsGlobalacceleratorCustomRoutingAccelerator` resource](/docs/providers/aws/r/globalaccelerator_custom_routing_accelerator.html) for details on the
+returned attributes - they are identical.
+
+<!-- cache-key: cdktf-0.18.0 input-fb49b3a4aad72882bbe051a5e4ad191bf14607b4e514940f142786757b6b692c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/glue_catalog_table.html.markdown b/website/docs/cdktf/typescript/d/glue_catalog_table.html.markdown
new file mode 100644
index 00000000000..9a401b8a126
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/glue_catalog_table.html.markdown
@@ -0,0 +1,135 @@
+---
+subcategory: "Glue"
+layout: "aws"
+page_title: "AWS: aws_glue_catalog_table"
+description: |-
+  Get information on AWS Glue Data Catalog Table
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_glue_catalog_table
+
+This data source can be used to fetch information about an AWS Glue Data Catalog Table.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsGlueCatalogTable } from "./.gen/providers/aws/data-aws-glue-catalog-table";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsGlueCatalogTable(this, "example", {
+      databaseName: "MyCatalogDatabase",
+      name: "MyCatalogTable",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name of the table.
+* `databaseName` - (Required) Name of the metadata database where the table metadata resides.
+* `catalogId` - (Optional) ID of the Glue Catalog and database where the table metadata resides. If omitted, this defaults to the current AWS Account ID.
+* `queryAsOfTime`- (Optional) The time as of when to read the table contents. If not set, the most recent transaction commit time will be used. Cannot be specified along with `transactionId`. Specified in RFC 3339 format, e.g. `20060102T15:04:05Z07:00`.
+* `transactionId` - (Optional) The transaction ID at which to read the table contents.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - Catalog ID, Database name and of the name table.
+* `arn` - The ARN of the Glue Table.
+* `description` - Description of the table.
+* `owner` - Owner of the table.
+* `parameters` - Properties associated with this table, as a list of key-value pairs.
+* `partitionIndex` - Configuration block for a maximum of 3 partition indexes. See [`partitionIndex`](#partition_index) below.
+* `partitionKeys` - Configuration block of columns by which the table is partitioned. Only primitive types are supported as partition keys. See [`partitionKeys`](#partition_keys) below.
+* `retention` - Retention time for this table.
+* `storageDescriptor` - Configuration block for information about the physical storage of this table. For more information, refer to the [Glue Developer Guide](https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-tables.html#aws-glue-api-catalog-tables-StorageDescriptor). See [`storageDescriptor`](#storage_descriptor) below.
+* `tableType` - Type of this table (EXTERNAL_TABLE, VIRTUAL_VIEW, etc.). While optional, some Athena DDL queries such as `ALTER TABLE` and `SHOW CREATE TABLE` will fail if this argument is empty.
+* `targetTable` - Configuration block of a target table for resource linking. See [`targetTable`](#target_table) below.
+* `viewExpandedText` - If the table is a view, the expanded text of the view; otherwise null.
+* `viewOriginalText` - If the table is a view, the original text of the view; otherwise null.
+
+### partition_index
+
+* `indexName` - Name of the partition index.
+* `keys` - Keys for the partition index.
+
+### partition_keys
+
+* `comment` - Free-form text comment.
+* `name` - Name of the Partition Key.
+* `type` - Datatype of data in the Partition Key.
+
+### storage_descriptor
+
+* `bucketColumns` - List of reducer grouping columns, clustering columns, and bucketing columns in the table.
+* `columns` - Configuration block for columns in the table. See [`columns`](#columns) below.
+* `compressed` - Whether the data in the table is compressed.
+* `inputFormat` - Input format: SequenceFileInputFormat (binary), or TextInputFormat, or a custom format.
+* `location` - Physical location of the table. By default, this takes the form of the warehouse location, followed by the database location in the warehouse, followed by the table name.
+* `numberOfBuckets` - Is if the table contains any dimension columns.
+* `outputFormat` - Output format: SequenceFileOutputFormat (binary), or IgnoreKeyTextOutputFormat, or a custom format.
+* `parameters` - User-supplied properties in key-value form.
+* `schemaReference` - Object that references a schema stored in the AWS Glue Schema Registry. See [`schemaReference`](#schema_reference) below.
+* `serDeInfo` - Configuration block for serialization and deserialization ("SerDe") information. See [`serDeInfo`](#ser_de_info) below.
+* `skewedInfo` - Configuration block with information about values that appear very frequently in a column (skewed values). See [`skewedInfo`](#skewed_info) below.
+* `sortColumns` - Configuration block for the sort order of each bucket in the table. See [`sortColumns`](#sort_columns) below.
+* `storedAsSubDirectories` - Whether the table data is stored in subdirectories.
+
+#### columns
+
+* `comment` - Free-form text comment.
+* `name` - Name of the Column.
+* `parameters` - Key-value pairs defining properties associated with the column.
+* `type` - Datatype of data in the Column.
+
+#### schema_reference
+
+* `schemaId` - Configuration block that contains schema identity fields. See [`schemaId`](#schema_id) below.
+* `schemaVersionId` - Unique ID assigned to a version of the schema.
+* `schemaVersionNumber` - Version number of the schema.
+
+##### schema_id
+
+* `registryName` - Name of the schema registry that contains the schema.
+* `schemaArn` - ARN of the schema.
+* `schemaName` - Name of the schema.
+
+#### ser_de_info
+
+* `name` - Name of the SerDe.
+* `parameters` - Map of initialization parameters for the SerDe, in key-value form.
+* `serializationLibrary` - Usually the class that implements the SerDe. An example is `orgApacheHadoopHiveSerde2ColumnarColumnarSerDe`.
+
+#### sort_columns
+
+* `column` - Name of the column.
+* `sortOrder` - Whether the column is sorted in ascending (`1`) or descending order (`0`).
+
+#### skewed_info
+
+* `skewedColumnNames` - List of names of columns that contain skewed values.
+* `skewedColumnValueLocationMaps` - List of values that appear so frequently as to be considered skewed.
+* `skewedColumnValues` - Map of skewed values to the columns that contain them.
+
+### target_table
+
+* `catalogId` - ID of the Data Catalog in which the table resides.
+* `databaseName` - Name of the catalog database that contains the target table.
+* `name` - Name of the target table.
+
+<!-- cache-key: cdktf-0.18.0 input-e15edcd6d033b5edb19b2c2cba94f792949b55bd9f5265620f634af7b6c959a4 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/glue_connection.html.markdown b/website/docs/cdktf/typescript/d/glue_connection.html.markdown
new file mode 100644
index 00000000000..9f5c03208cf
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/glue_connection.html.markdown
@@ -0,0 +1,55 @@
+---
+subcategory: "Glue"
+layout: "aws"
+page_title: "AWS: aws_glue_connection"
+description: |-
+  Get information on an AWS Glue Connection
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_glue_connection
+
+This data source can be used to fetch information about a specific Glue Connection.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsGlueConnection } from "./.gen/providers/aws/data-aws-glue-connection";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsGlueConnection(this, "example", {
+      id: "123456789123:connection",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `id` - (Required) Concatenation of the catalog ID and connection name. For example, if your account ID is
+`123456789123` and the connection name is `conn` then the ID is `123456789123:conn`.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Glue Connection.
+* `catalogId` - Catalog ID of the Glue Connection.
+* `connectionType` - Type of Glue Connection.
+* `description` – Description of the connection.
+* `matchCriteria` – A list of criteria that can be used in selecting this connection.
+* `name` - Name of the Glue Connection.
+* `physicalConnectionRequirements` - A map of physical connection requirements, such as VPC and SecurityGroup.
+* `tags` - Tags assigned to the resource
+
+<!-- cache-key: cdktf-0.18.0 input-c3a54c13f6d1584c4b355be148ce4f3063077b22c8de52485229079b8245ad9c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/glue_data_catalog_encryption_settings.html.markdown b/website/docs/cdktf/typescript/d/glue_data_catalog_encryption_settings.html.markdown
new file mode 100644
index 00000000000..e236f8dc39d
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/glue_data_catalog_encryption_settings.html.markdown
@@ -0,0 +1,67 @@
+---
+subcategory: "Glue"
+layout: "aws"
+page_title: "AWS: aws_glue_data_catalog_encryption_settings"
+description: |-
+  Get information on AWS Glue Data Catalog Encryption Settings
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_glue_data_catalog_encryption_settings
+
+This data source can be used to fetch information about AWS Glue Data Catalog Encryption Settings.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsGlueDataCatalogEncryptionSettings } from "./.gen/providers/aws/data-aws-glue-data-catalog-encryption-settings";
+interface MyConfig {
+  catalogId: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new DataAwsGlueDataCatalogEncryptionSettings(this, "example", {
+      id: "123456789123",
+      catalogId: config.catalogId,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `catalogId` - (Required) ID of the Data Catalog. This is typically the AWS account ID.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `dataCatalogEncryptionSettings` – The security configuration to set. see [Data Catalog Encryption Settings](#data_catalog_encryption_settings).
+* `id` – The ID of the Data Catalog to set the security configuration for.
+
+### data_catalog_encryption_settings
+
+* `connectionPasswordEncryption` - When connection password protection is enabled, the Data Catalog uses a customer-provided key to encrypt the password as part of CreateConnection or UpdateConnection and store it in the ENCRYPTED_PASSWORD field in the connection properties. You can enable catalog encryption or only password encryption. see [Connection Password Encryption](#connection_password_encryption).
+* `encryptionAtRest` - Encryption-at-rest configuration for the Data Catalog. see [Encryption At Rest](#encryption_at_rest).
+
+### connection_password_encryption
+
+* `returnConnectionPasswordEncrypted` - When set to `true`, passwords remain encrypted in the responses of GetConnection and GetConnections. This encryption takes effect independently of the catalog encryption.
+* `awsKmsKeyId` - KMS key ARN that is used to encrypt the connection password.
+
+### encryption_at_rest
+
+* `catalogEncryptionMode` - The encryption-at-rest mode for encrypting Data Catalog data.
+* `sseAwsKmsKeyId` - ARN of the AWS KMS key to use for encryption at rest.
+
+<!-- cache-key: cdktf-0.18.0 input-e959f72d2bff30ad397e7c3f8e5c026335f7731049187b56bb28d0f687ba62fd -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/glue_script.html.markdown b/website/docs/cdktf/typescript/d/glue_script.html.markdown
new file mode 100644
index 00000000000..74177bfbb45
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/glue_script.html.markdown
@@ -0,0 +1,254 @@
+---
+subcategory: "Glue"
+layout: "aws"
+page_title: "AWS: aws_glue_script"
+description: |-
+  Generate Glue script from Directed Acyclic Graph
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_glue_script
+
+Use this data source to generate a Glue script from a Directed Acyclic Graph (DAG).
+
+## Example Usage
+
+### Generate Python Script
+
+```terraform
+data "aws_glue_script" "example" {
+  language = "PYTHON"
+
+  dag_edge {
+    source = "datasource0"
+    target = "applymapping1"
+  }
+
+  dag_edge {
+    source = "applymapping1"
+    target = "selectfields2"
+  }
+
+  dag_edge {
+    source = "selectfields2"
+    target = "resolvechoice3"
+  }
+
+  dag_edge {
+    source = "resolvechoice3"
+    target = "datasink4"
+  }
+
+  dag_node {
+    id        = "datasource0"
+    node_type = "DataSource"
+
+    args {
+      name  = "database"
+      value = "\"${aws_glue_catalog_database.source.name}\""
+    }
+
+    args {
+      name  = "table_name"
+      value = "\"${aws_glue_catalog_table.source.name}\""
+    }
+  }
+
+  dag_node {
+    id        = "applymapping1"
+    node_type = "ApplyMapping"
+
+    args {
+      name  = "mapping"
+      value = "[(\"column1\", \"string\", \"column1\", \"string\")]"
+    }
+  }
+
+  dag_node {
+    id        = "selectfields2"
+    node_type = "SelectFields"
+
+    args {
+      name  = "paths"
+      value = "[\"column1\"]"
+    }
+  }
+
+  dag_node {
+    id        = "resolvechoice3"
+    node_type = "ResolveChoice"
+
+    args {
+      name  = "choice"
+      value = "\"MATCH_CATALOG\""
+    }
+
+    args {
+      name  = "database"
+      value = "\"${aws_glue_catalog_database.destination.name}\""
+    }
+
+    args {
+      name  = "table_name"
+      value = "\"${aws_glue_catalog_table.destination.name}\""
+    }
+  }
+
+  dag_node {
+    id        = "datasink4"
+    node_type = "DataSink"
+
+    args {
+      name  = "database"
+      value = "\"${aws_glue_catalog_database.destination.name}\""
+    }
+
+    args {
+      name  = "table_name"
+      value = "\"${aws_glue_catalog_table.destination.name}\""
+    }
+  }
+}
+
+output "python_script" {
+  value = data.aws_glue_script.example.python_script
+}
+```
+
+### Generate Scala Code
+
+```terraform
+data "aws_glue_script" "example" {
+  language = "SCALA"
+
+  dag_edge {
+    source = "datasource0"
+    target = "applymapping1"
+  }
+
+  dag_edge {
+    source = "applymapping1"
+    target = "selectfields2"
+  }
+
+  dag_edge {
+    source = "selectfields2"
+    target = "resolvechoice3"
+  }
+
+  dag_edge {
+    source = "resolvechoice3"
+    target = "datasink4"
+  }
+
+  dag_node {
+    id        = "datasource0"
+    node_type = "DataSource"
+
+    args {
+      name  = "database"
+      value = "\"${aws_glue_catalog_database.source.name}\""
+    }
+
+    args {
+      name  = "table_name"
+      value = "\"${aws_glue_catalog_table.source.name}\""
+    }
+  }
+
+  dag_node {
+    id        = "applymapping1"
+    node_type = "ApplyMapping"
+
+    args {
+      name  = "mappings"
+      value = "[(\"column1\", \"string\", \"column1\", \"string\")]"
+    }
+  }
+
+  dag_node {
+    id        = "selectfields2"
+    node_type = "SelectFields"
+
+    args {
+      name  = "paths"
+      value = "[\"column1\"]"
+    }
+  }
+
+  dag_node {
+    id        = "resolvechoice3"
+    node_type = "ResolveChoice"
+
+    args {
+      name  = "choice"
+      value = "\"MATCH_CATALOG\""
+    }
+
+    args {
+      name  = "database"
+      value = "\"${aws_glue_catalog_database.destination.name}\""
+    }
+
+    args {
+      name  = "table_name"
+      value = "\"${aws_glue_catalog_table.destination.name}\""
+    }
+  }
+
+  dag_node {
+    id        = "datasink4"
+    node_type = "DataSink"
+
+    args {
+      name  = "database"
+      value = "\"${aws_glue_catalog_database.destination.name}\""
+    }
+
+    args {
+      name  = "table_name"
+      value = "\"${aws_glue_catalog_table.destination.name}\""
+    }
+  }
+}
+
+output "scala_code" {
+  value = data.aws_glue_script.example.scala_code
+}
+```
+
+## Argument Reference
+
+* `dagEdge` - (Required) List of the edges in the DAG. Defined below.
+* `dagNode` - (Required) List of the nodes in the DAG. Defined below.
+* `language` - (Optional) Programming language of the resulting code from the DAG. Defaults to `python`. Valid values are `python` and `scala`.
+
+### dag_edge Argument Reference
+
+* `source` - (Required) ID of the node at which the edge starts.
+* `target` - (Required) ID of the node at which the edge ends.
+* `targetParameter` - (Optional) Target of the edge.
+
+### dag_node Argument Reference
+
+* `args` - (Required) Nested configuration an argument or property of a node. Defined below.
+* `id` - (Required) Node identifier that is unique within the node's graph.
+* `nodeType` - (Required) Type of node this is.
+* `lineNumber` - (Optional) Line number of the node.
+
+#### args Argument Reference
+
+* `name` - (Required) Name of the argument or property.
+* `value` - (Required) Value of the argument or property.
+* `param` - (Optional) Boolean if the value is used as a parameter. Defaults to `false`.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - AWS Region.
+* `pythonScript` - Python script generated from the DAG when the `language` argument is set to `python`.
+* `scalaCode` - Scala code generated from the DAG when the `language` argument is set to `scala`.
+
+<!-- cache-key: cdktf-0.18.0 input-be24758996e8a89722ff26b1265bf9700176ddfdb291cd62471cea079785dce2 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/grafana_workspace.html.markdown b/website/docs/cdktf/typescript/d/grafana_workspace.html.markdown
new file mode 100644
index 00000000000..a81e8e040a1
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/grafana_workspace.html.markdown
@@ -0,0 +1,68 @@
+---
+subcategory: "Managed Grafana"
+layout: "aws"
+page_title: "AWS: aws_grafana_workspace"
+description: |-
+  Gets information on an Amazon Managed Grafana workspace.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_grafana_workspace
+
+Provides an Amazon Managed Grafana workspace data source.
+
+## Example Usage
+
+### Basic configuration
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsGrafanaWorkspace } from "./.gen/providers/aws/data-aws-grafana-workspace";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsGrafanaWorkspace(this, "example", {
+      workspaceId: "g-2054c75a02",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `workspaceId` - (Required) Grafana workspace ID.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `accountAccessType` - (Required) Type of account access for the workspace. Valid values are `currentAccount` and `organization`. If `organization` is specified, then `organizationalUnits` must also be present.
+* `authenticationProviders` - (Required) Authentication providers for the workspace. Valid values are `awsSso`, `saml`, or both.
+* `arn` - ARN of the Grafana workspace.
+* `createdDate` - Creation date of the Grafana workspace.
+* `dataSources` - Data sources for the workspace.
+* `description` - Workspace description.
+* `endpoint` - Endpoint of the Grafana workspace.
+* `grafanaVersion` - Version of Grafana running on the workspace.
+* `lastUpdatedDate` - Last updated date of the Grafana workspace.
+* `name` - Grafana workspace name.
+* `notificationDestinations` - The notification destinations.
+* `organizationRoleName` - The role name that the workspace uses to access resources through Amazon Organizations.
+* `organizationalUnits` - The Amazon Organizations organizational units that the workspace is authorized to use data sources from.
+* `permissionType` - Permission type of the workspace.
+* `roleArn` - IAM role ARN that the workspace assumes.
+* `stackSetName` - AWS CloudFormation stack set name that provisions IAM roles to be used by the workspace.
+* `status` - Status of the Grafana workspace.
+* `tags` - Tags assigned to the resource
+
+<!-- cache-key: cdktf-0.18.0 input-22d8f7cb4cb1f894ad0c40dec87b3b5711ec96e9e1e76be61286f5e1e2493124 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/guardduty_detector.html.markdown b/website/docs/cdktf/typescript/d/guardduty_detector.html.markdown
new file mode 100644
index 00000000000..622c5b9eb56
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/guardduty_detector.html.markdown
@@ -0,0 +1,53 @@
+---
+subcategory: "GuardDuty"
+layout: "aws"
+page_title: "AWS: aws_guardduty_detector"
+description: |-
+  Retrieve information about a GuardDuty detector.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_guardduty_detector
+
+Retrieve information about a GuardDuty detector.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsGuarddutyDetector } from "./.gen/providers/aws/data-aws-guardduty-detector";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsGuarddutyDetector(this, "example", {});
+  }
+}
+
+```
+
+## Argument Reference
+
+* `id` - (Optional) ID of the detector.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `features` - Current configuration of the detector features.
+    * `additionalConfiguration` - Additional feature configuration.
+        * `name` - The name of the additional configuration.
+        * `status` - The status of the additional configuration.
+    * `name` - The name of the detector feature.
+    * `status` - The status of the detector feature.
+* `findingPublishingFrequency` - The frequency of notifications sent about subsequent finding occurrences.
+* `serviceRoleArn` - Service-linked role that grants GuardDuty access to the resources in the AWS account.
+* `status` - Current status of the detector.
+
+<!-- cache-key: cdktf-0.18.0 input-07755259e17c1389ef594d13cf31fa96fecc80102f8edf0b3ec9e035aef6985e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/guardduty_finding_ids.html.markdown b/website/docs/cdktf/typescript/d/guardduty_finding_ids.html.markdown
new file mode 100644
index 00000000000..daebb0b47b5
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/guardduty_finding_ids.html.markdown
@@ -0,0 +1,52 @@
+---
+subcategory: "GuardDuty"
+layout: "aws"
+page_title: "AWS: aws_guardduty_finding_ids"
+description: |-
+  Terraform data source for managing an AWS GuardDuty Finding Ids.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_guardduty_finding_ids
+
+Terraform data source for managing an AWS GuardDuty Finding Ids.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsGuarddutyFindingIds } from "./.gen/providers/aws/data-aws-guardduty-finding-ids";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsGuarddutyFindingIds(this, "example", {
+      detectorId: Token.asString(awsGuarddutyDetectorExample.id),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `detectorId` - (Required) ID of the GuardDuty detector.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `hasFindings` - Indicates whether findings are present for the specified detector.
+* `findingIds` - A list of finding IDs for the specified detector.
+
+<!-- cache-key: cdktf-0.18.0 input-639e9057ccf47998ef50f3f122bf6e2e0a603648cc0ea1e6bdfe980be55cceb6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/iam_access_keys.html.markdown b/website/docs/cdktf/typescript/d/iam_access_keys.html.markdown
new file mode 100644
index 00000000000..7a3bcae57e9
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/iam_access_keys.html.markdown
@@ -0,0 +1,56 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_access_keys"
+description: |-
+  Get information on IAM access keys associated with the specified IAM user.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_iam_access_keys
+
+This data source can be used to fetch information about IAM access keys of a
+specific IAM user.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamAccessKeys } from "./.gen/providers/aws/data-aws-iam-access-keys";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsIamAccessKeys(this, "example", {
+      user: "an_example_user_name",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `user` - (Required) Name of the IAM user associated with the access keys.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `accessKeys` - List of the IAM access keys associated with the specified user. See below.
+
+The elements of the `accessKeys` are exported with the following attributes:
+
+* `accessKeyId` - Access key ID.
+* `createDate` - Date and time in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8) that the access key was created.
+* `status` - Access key status. Possible values are `active` and `inactive`.
+
+<!-- cache-key: cdktf-0.18.0 input-e240b2f1389af80ddb006ba0dd0c7ec511aa61dd50acb41a405183fb70ef28d8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/iam_account_alias.html.markdown b/website/docs/cdktf/typescript/d/iam_account_alias.html.markdown
new file mode 100644
index 00000000000..366acbb8dc7
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/iam_account_alias.html.markdown
@@ -0,0 +1,51 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_account_alias"
+description: |-
+  Provides the account alias for the AWS account associated with the provider
+  connection to AWS.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_iam_account_alias
+
+The IAM Account Alias data source allows access to the account alias
+for the effective account in which Terraform is working.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformOutput, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamAccountAlias } from "./.gen/providers/aws/data-aws-iam-account-alias";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const current = new DataAwsIamAccountAlias(this, "current", {});
+    new TerraformOutput(this, "account_id", {
+      value: current.accountAlias,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+There are no arguments available for this data source.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `accountAlias` - Alias associated with the AWS account.
+* `id` - Alias associated with the AWS account.
+
+<!-- cache-key: cdktf-0.18.0 input-efa6f2304fc0569176238ebf28fc4c9ec839c206f798e565d2b074c39fb9dfb0 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/iam_group.html.markdown b/website/docs/cdktf/typescript/d/iam_group.html.markdown
new file mode 100644
index 00000000000..46559915ac6
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/iam_group.html.markdown
@@ -0,0 +1,59 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_group"
+description: |-
+  Get information on a Amazon IAM group
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_iam_group
+
+This data source can be used to fetch information about a specific
+IAM group. By using this data source, you can reference IAM group
+properties without having to hard code ARNs as input.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamGroup } from "./.gen/providers/aws/data-aws-iam-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsIamGroup(this, "example", {
+      groupName: "an_example_group_name",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `groupName` - (Required) Friendly IAM group name to match.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - Group ARN.
+* `groupId` - Stable and unique string identifying the group.
+* `path` - Path to the group.
+* `users` - List of objects containing group member information. See below.
+
+### `users`
+
+* `arn` - User ARN.
+* `path` - Path to the IAM user.
+* `userId` - Stable and unique string identifying the IAM user.
+* `userName` - Name of the IAM user.
+
+<!-- cache-key: cdktf-0.18.0 input-b5b8d72dc7fc469d3b2d85b15798edaab2e9d2691ebb4b01603e4de702a19c97 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/iam_instance_profile.html.markdown b/website/docs/cdktf/typescript/d/iam_instance_profile.html.markdown
new file mode 100644
index 00000000000..4b8ac714d6c
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/iam_instance_profile.html.markdown
@@ -0,0 +1,54 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_instance_profile"
+description: |-
+  Get information on a Amazon IAM Instance Profile
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_iam_instance_profile
+
+This data source can be used to fetch information about a specific
+IAM instance profile. By using this data source, you can reference IAM
+instance profile properties without having to hard code ARNs as input.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamInstanceProfile } from "./.gen/providers/aws/data-aws-iam-instance-profile";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsIamInstanceProfile(this, "example", {
+      name: "an_example_instance_profile_name",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `name` - (Required) Friendly IAM instance profile name to match.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN.
+* `createDate` - String representation of the date the instance profile was created.
+* `path` - Path to the instance profile.
+* `roleArn` - Role ARN associated with this instance profile.
+* `roleId` - Role ID associated with this instance profile.
+* `roleName` - Role name associated with this instance profile.
+
+<!-- cache-key: cdktf-0.18.0 input-5e845773261432b358ba5aad381e509f7458709c0eda7705643bdfff5097226a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/iam_instance_profiles.html.markdown b/website/docs/cdktf/typescript/d/iam_instance_profiles.html.markdown
new file mode 100644
index 00000000000..9f8d9f3c000
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/iam_instance_profiles.html.markdown
@@ -0,0 +1,51 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_instance_profiles"
+description: |-
+  Get information on a Amazon IAM Instance Profiles from IAM role
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_iam_instance_profiles
+
+This data source can be used to fetch information about all
+IAM instance profiles under a role. By using this data source, you can reference IAM
+instance profile properties without having to hard code ARNs as input.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamInstanceProfiles } from "./.gen/providers/aws/data-aws-iam-instance-profiles";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsIamInstanceProfiles(this, "example", {
+      roleName: "an_example_iam_role_name",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `roleName` - (Required) IAM role name.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arns` - Set of ARNs of instance profiles.
+* `names` - Set of IAM instance profile names.
+* `paths` - Set of IAM instance profile paths.
+
+<!-- cache-key: cdktf-0.18.0 input-fdf4537f5bc24d70dba8df68e238853fd99393192e43f6e525a475fe964ee287 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/iam_openid_connect_provider.html.markdown b/website/docs/cdktf/typescript/d/iam_openid_connect_provider.html.markdown
new file mode 100644
index 00000000000..d6b3b973041
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/iam_openid_connect_provider.html.markdown
@@ -0,0 +1,72 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_openid_connect_provider"
+description: |-
+  Get information on a Amazon IAM OpenID Connect provider.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_iam_openid_connect_provider
+
+This data source can be used to fetch information about a specific
+IAM OpenID Connect provider. By using this data source, you can retrieve the
+the resource information by either its `arn` or `url`.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamOpenidConnectProvider } from "./.gen/providers/aws/data-aws-iam-openid-connect-provider";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsIamOpenidConnectProvider(this, "example", {
+      arn: "arn:aws:iam::123456789012:oidc-provider/accounts.google.com",
+    });
+  }
+}
+
+```
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamOpenidConnectProvider } from "./.gen/providers/aws/data-aws-iam-openid-connect-provider";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsIamOpenidConnectProvider(this, "example", {
+      url: "https://accounts.google.com",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `arn` - (Optional) ARN of the OpenID Connect provider.
+* `url` - (Optional) URL of the OpenID Connect provider.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `clientIdList` - List of client IDs (also known as audiences). When a mobile or web app registers with an OpenID Connect provider, they establish a value that identifies the application. (This is the value that's sent as the client_id parameter on OAuth requests.)
+* `thumbprintList` - List of server certificate thumbprints for the OpenID Connect (OIDC) identity provider's server certificate(s).
+* `tags` - Map of resource tags for the IAM OIDC provider.
+
+<!-- cache-key: cdktf-0.18.0 input-642346d1cceb7b38df3f8226fec2a77e31214afb1bcf46792639e9604b9060a4 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/iam_policy.html.markdown b/website/docs/cdktf/typescript/d/iam_policy.html.markdown
new file mode 100644
index 00000000000..ae1d51f9a38
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/iam_policy.html.markdown
@@ -0,0 +1,83 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_policy"
+description: |-
+  Get information on a Amazon IAM policy
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_iam_policy
+
+This data source can be used to fetch information about a specific
+IAM policy.
+
+## Example Usage
+
+### By ARN
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamPolicy } from "./.gen/providers/aws/data-aws-iam-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsIamPolicy(this, "example", {
+      arn: "arn:aws:iam::123456789012:policy/UsersManageOwnCredentials",
+    });
+  }
+}
+
+```
+
+### By Name
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamPolicy } from "./.gen/providers/aws/data-aws-iam-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsIamPolicy(this, "example", {
+      name: "test_policy",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `arn` - (Optional) ARN of the IAM policy.
+  Conflicts with `name` and `pathPrefix`.
+* `name` - (Optional) Name of the IAM policy.
+  Conflicts with `arn`.
+* `pathPrefix` - (Optional) Prefix of the path to the IAM policy.
+  Defaults to a slash (`/`).
+  Conflicts with `arn`.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the policy.
+* `path` - Path to the policy.
+* `description` - Description of the policy.
+* `policy` - Policy document of the policy.
+* `policyId` - Policy's ID.
+* `tags` - Key-value mapping of tags for the IAM Policy.
+
+<!-- cache-key: cdktf-0.18.0 input-0cf487c395058c7c9cab5e17ab81c86989934f0f0479c2c2af73d9be73409f10 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/iam_policy_document.html.markdown b/website/docs/cdktf/typescript/d/iam_policy_document.html.markdown
new file mode 100644
index 00000000000..47473e6ca76
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/iam_policy_document.html.markdown
@@ -0,0 +1,641 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_policy_document"
+description: |-
+  Generates an IAM policy document in JSON format
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_iam_policy_document
+
+Generates an IAM policy document in JSON format for use with resources that expect policy documents such as [`awsIamPolicy`](/docs/providers/aws/r/iam_policy.html).
+
+Using this data source to generate policy documents is *optional*. It is also valid to use literal JSON strings in your configuration or to use the `file` interpolation function to read a raw JSON policy document from a file.
+
+~> **NOTE:** AWS's IAM policy document syntax allows for replacement of [policy variables](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_variables.html) within a statement using `${...}`-style notation, which conflicts with Terraform's interpolation syntax. In order to use AWS policy variables with this data source, use `&{...}` notation for interpolations that should be processed by AWS rather than by Terraform.
+
+-> For more information about building AWS IAM policy documents with Terraform, see the [AWS IAM Policy Document Guide](https://learn.hashicorp.com/terraform/aws/iam-policy).
+
+## Example Usage
+
+### Basic Example
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { IamPolicy } from "./.gen/providers/aws/iam-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new DataAwsIamPolicyDocument(this, "example", {
+      statement: [
+        {
+          actions: ["s3:ListAllMyBuckets", "s3:GetBucketLocation"],
+          resources: ["arn:aws:s3:::*"],
+          sid: "1",
+        },
+        {
+          actions: ["s3:ListBucket"],
+          condition: [
+            {
+              test: "StringLike",
+              values: ["", "home/", "home/&{aws:username}/"],
+              variable: "s3:prefix",
+            },
+          ],
+          resources: ["arn:aws:s3:::${" + s3BucketName.value + "}"],
+        },
+        {
+          actions: ["s3:*"],
+          resources: [
+            "arn:aws:s3:::${" + s3BucketName.value + "}/home/&{aws:username}",
+            "arn:aws:s3:::${" + s3BucketName.value + "}/home/&{aws:username}/*",
+          ],
+        },
+      ],
+    });
+    const awsIamPolicyExample = new IamPolicy(this, "example_1", {
+      name: "example_policy",
+      path: "/",
+      policy: Token.asString(example.json),
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamPolicyExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### Example Multiple Condition Keys and Values
+
+You can specify a [condition with multiple keys and values](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_multi-value-conditions.html) by supplying multiple `condition` blocks with the same `test` value, but differing `variable` and `values` values.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsIamPolicyDocument(
+      this,
+      "example_multiple_condition_keys_and_values",
+      {
+        statement: [
+          {
+            actions: ["kms:Decrypt", "kms:GenerateDataKey"],
+            condition: [
+              {
+                test: "ForAnyValue:StringEquals",
+                values: ["pi"],
+                variable: "kms:EncryptionContext:service",
+              },
+              {
+                test: "ForAnyValue:StringEquals",
+                values: ["rds"],
+                variable: "kms:EncryptionContext:aws:pi:service",
+              },
+              {
+                test: "ForAnyValue:StringEquals",
+                values: [
+                  "db-AAAAABBBBBCCCCCDDDDDEEEEE",
+                  "db-EEEEEDDDDDCCCCCBBBBBAAAAA",
+                ],
+                variable: "kms:EncryptionContext:aws:rds:db-id",
+              },
+            ],
+            resources: ["*"],
+          },
+        ],
+      }
+    );
+  }
+}
+
+```
+
+`dataAwsIamPolicyDocumentExampleMultipleConditionKeysAndValuesJson` will evaluate to:
+
+```json
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Sid": "",
+      "Effect": "Allow",
+      "Action": [
+        "kms:GenerateDataKey",
+        "kms:Decrypt"
+      ],
+      "Resource": "*",
+      "Condition": {
+        "ForAnyValue:StringEquals": {
+          "kms:EncryptionContext:aws:pi:service": "rds",
+          "kms:EncryptionContext:aws:rds:db-id": [
+            "db-AAAAABBBBBCCCCCDDDDDEEEEE",
+            "db-EEEEEDDDDDCCCCCBBBBBAAAAA"
+          ],
+          "kms:EncryptionContext:service": "pi"
+        }
+      }
+    }
+  ]
+}
+```
+
+### Example Assume-Role Policy with Multiple Principals
+
+You can specify multiple principal blocks with different types. You can also use this data source to generate an assume-role policy.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsIamPolicyDocument(
+      this,
+      "event_stream_bucket_role_assume_role_policy",
+      {
+        statement: [
+          {
+            actions: ["sts:AssumeRole"],
+            principals: [
+              {
+                identifiers: ["firehose.amazonaws.com"],
+                type: "Service",
+              },
+              {
+                identifiers: [trustedRoleArn.stringValue],
+                type: "AWS",
+              },
+              {
+                identifiers: [
+                  "arn:aws:iam::${" +
+                    accountId.value +
+                    "}:saml-provider/${" +
+                    providerName.value +
+                    "}",
+                  "cognito-identity.amazonaws.com",
+                ],
+                type: "Federated",
+              },
+            ],
+          },
+        ],
+      }
+    );
+  }
+}
+
+```
+
+### Example Using A Source Document
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const source = new DataAwsIamPolicyDocument(this, "source", {
+      statement: [
+        {
+          actions: ["ec2:*"],
+          resources: ["*"],
+        },
+        {
+          actions: ["s3:*"],
+          resources: ["*"],
+          sid: "SidToOverride",
+        },
+      ],
+    });
+    new DataAwsIamPolicyDocument(this, "source_document_example", {
+      sourcePolicyDocuments: [Token.asString(source.json)],
+      statement: [
+        {
+          actions: ["s3:*"],
+          resources: ["arn:aws:s3:::somebucket", "arn:aws:s3:::somebucket/*"],
+          sid: "SidToOverride",
+        },
+      ],
+    });
+  }
+}
+
+```
+
+`dataAwsIamPolicyDocumentSourceDocumentExampleJson` will evaluate to:
+
+```json
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Sid": "",
+      "Effect": "Allow",
+      "Action": "ec2:*",
+      "Resource": "*"
+    },
+    {
+      "Sid": "SidToOverride",
+      "Effect": "Allow",
+      "Action": "s3:*",
+      "Resource": [
+        "arn:aws:s3:::somebucket/*",
+        "arn:aws:s3:::somebucket"
+      ]
+    }
+  ]
+}
+```
+
+### Example Using An Override Document
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const override = new DataAwsIamPolicyDocument(this, "override", {
+      statement: [
+        {
+          actions: ["s3:*"],
+          resources: ["*"],
+          sid: "SidToOverride",
+        },
+      ],
+    });
+    new DataAwsIamPolicyDocument(this, "override_policy_document_example", {
+      overridePolicyDocuments: [Token.asString(override.json)],
+      statement: [
+        {
+          actions: ["ec2:*"],
+          resources: ["*"],
+        },
+        {
+          actions: ["s3:*"],
+          resources: ["arn:aws:s3:::somebucket", "arn:aws:s3:::somebucket/*"],
+          sid: "SidToOverride",
+        },
+      ],
+    });
+  }
+}
+
+```
+
+`dataAwsIamPolicyDocumentOverridePolicyDocumentExampleJson` will evaluate to:
+
+```json
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Sid": "",
+      "Effect": "Allow",
+      "Action": "ec2:*",
+      "Resource": "*"
+    },
+    {
+      "Sid": "SidToOverride",
+      "Effect": "Allow",
+      "Action": "s3:*",
+      "Resource": "*"
+    }
+  ]
+}
+```
+
+### Example with Both Source and Override Documents
+
+You can also combine `sourcePolicyDocuments` and `overridePolicyDocuments` in the same document.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const override = new DataAwsIamPolicyDocument(this, "override", {
+      statement: [
+        {
+          actions: ["s3:GetObject"],
+          resources: ["*"],
+          sid: "OverridePlaceholder",
+        },
+      ],
+    });
+    const source = new DataAwsIamPolicyDocument(this, "source", {
+      statement: [
+        {
+          actions: ["ec2:DescribeAccountAttributes"],
+          resources: ["*"],
+          sid: "OverridePlaceholder",
+        },
+      ],
+    });
+    new DataAwsIamPolicyDocument(this, "politik", {
+      overridePolicyDocuments: [Token.asString(override.json)],
+      sourcePolicyDocuments: [Token.asString(source.json)],
+    });
+  }
+}
+
+```
+
+`dataAwsIamPolicyDocumentPolitikJson` will evaluate to:
+
+```json
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Sid": "OverridePlaceholder",
+      "Effect": "Allow",
+      "Action": "s3:GetObject",
+      "Resource": "*"
+    }
+  ]
+}
+```
+
+### Example of Merging Source Documents
+
+Multiple documents can be combined using the `sourcePolicyDocuments` or `overridePolicyDocuments` attributes. `sourcePolicyDocuments` requires that all documents have unique Sids, while `overridePolicyDocuments` will iteratively override matching Sids.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const sourceOne = new DataAwsIamPolicyDocument(this, "source_one", {
+      statement: [
+        {
+          actions: ["ec2:*"],
+          resources: ["*"],
+        },
+        {
+          actions: ["s3:*"],
+          resources: ["*"],
+          sid: "UniqueSidOne",
+        },
+      ],
+    });
+    const sourceTwo = new DataAwsIamPolicyDocument(this, "source_two", {
+      statement: [
+        {
+          actions: ["iam:*"],
+          resources: ["*"],
+          sid: "UniqueSidTwo",
+        },
+        {
+          actions: ["lambda:*"],
+          resources: ["*"],
+        },
+      ],
+    });
+    new DataAwsIamPolicyDocument(this, "combined", {
+      sourcePolicyDocuments: [
+        Token.asString(sourceOne.json),
+        Token.asString(sourceTwo.json),
+      ],
+    });
+  }
+}
+
+```
+
+`dataAwsIamPolicyDocumentCombinedJson` will evaluate to:
+
+```json
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Sid": "",
+      "Effect": "Allow",
+      "Action": "ec2:*",
+      "Resource": "*"
+    },
+    {
+      "Sid": "UniqueSidOne",
+      "Effect": "Allow",
+      "Action": "s3:*",
+      "Resource": "*"
+    },
+    {
+      "Sid": "UniqueSidTwo",
+      "Effect": "Allow",
+      "Action": "iam:*",
+      "Resource": "*"
+    },
+    {
+      "Sid": "",
+      "Effect": "Allow",
+      "Action": "lambda:*",
+      "Resource": "*"
+    }
+  ]
+}
+```
+
+### Example of Merging Override Documents
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const policyOne = new DataAwsIamPolicyDocument(this, "policy_one", {
+      statement: [
+        {
+          actions: ["s3:*"],
+          effect: "Allow",
+          resources: ["*"],
+          sid: "OverridePlaceHolderOne",
+        },
+      ],
+    });
+    const policyThree = new DataAwsIamPolicyDocument(this, "policy_three", {
+      statement: [
+        {
+          actions: ["logs:*"],
+          effect: "Deny",
+          resources: ["*"],
+          sid: "OverridePlaceHolderOne",
+        },
+      ],
+    });
+    const policyTwo = new DataAwsIamPolicyDocument(this, "policy_two", {
+      statement: [
+        {
+          actions: ["ec2:*"],
+          effect: "Allow",
+          resources: ["*"],
+        },
+        {
+          actions: ["iam:*"],
+          effect: "Allow",
+          resources: ["*"],
+          sid: "OverridePlaceHolderTwo",
+        },
+      ],
+    });
+    new DataAwsIamPolicyDocument(this, "combined", {
+      overridePolicyDocuments: [
+        Token.asString(policyOne.json),
+        Token.asString(policyTwo.json),
+        Token.asString(policyThree.json),
+      ],
+      statement: [
+        {
+          actions: ["*"],
+          effect: "Deny",
+          resources: ["*"],
+          sid: "OverridePlaceHolderTwo",
+        },
+      ],
+    });
+  }
+}
+
+```
+
+`dataAwsIamPolicyDocumentCombinedJson` will evaluate to:
+
+```json
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Sid": "OverridePlaceholderTwo",
+      "Effect": "Allow",
+      "Action": "iam:*",
+      "Resource": "*"
+    },
+    {
+      "Sid": "OverridePlaceholderOne",
+      "Effect": "Deny",
+      "Action": "logs:*",
+      "Resource": "*"
+    },
+    {
+      "Sid": "",
+      "Effect": "Allow",
+      "Action": "ec2:*",
+      "Resource": "*"
+    },
+  ]
+}
+```
+
+## Argument Reference
+
+The following arguments are optional:
+
+~> **NOTE:** Statements without a `sid` cannot be overridden. In other words, a statement without a `sid` from `sourcePolicyDocuments` cannot be overridden by statements from `overridePolicyDocuments`.
+
+* `overridePolicyDocuments` (Optional) - List of IAM policy documents that are merged together into the exported document. In merging, statements with non-blank `sid`s will override statements with the same `sid` from earlier documents in the list. Statements with non-blank `sid`s will also override statements with the same `sid` from `sourcePolicyDocuments`.  Non-overriding statements will be added to the exported document.
+* `policyId` (Optional) - ID for the policy document.
+* `sourcePolicyDocuments` (Optional) - List of IAM policy documents that are merged together into the exported document. Statements defined in `sourcePolicyDocuments` must have unique `sid`s. Statements with the same `sid` from `overridePolicyDocuments` will override source statements.
+* `statement` (Optional) - Configuration block for a policy statement. Detailed below.
+* `version` (Optional) - IAM policy document version. Valid values are `20081017` and `20121017`. Defaults to `20121017`. For more information, see the [AWS IAM User Guide](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_version.html).
+
+### `statement`
+
+The following arguments are optional:
+
+* `actions` (Optional) - List of actions that this statement either allows or denies. For example, `["ec2:RunInstances", "s3:*"]`.
+* `condition` (Optional) - Configuration block for a condition. Detailed below.
+* `effect` (Optional) - Whether this statement allows or denies the given actions. Valid values are `allow` and `deny`. Defaults to `allow`.
+* `notActions` (Optional) - List of actions that this statement does *not* apply to. Use to apply a policy statement to all actions *except* those listed.
+* `notPrincipals` (Optional) - Like `principals` except these are principals that the statement does *not* apply to.
+* `notResources` (Optional) - List of resource ARNs that this statement does *not* apply to. Use to apply a policy statement to all resources *except* those listed. Conflicts with `resources`.
+* `principals` (Optional) - Configuration block for principals. Detailed below.
+* `resources` (Optional) - List of resource ARNs that this statement applies to. This is required by AWS if used for an IAM policy. Conflicts with `notResources`.
+* `sid` (Optional) - Sid (statement ID) is an identifier for a policy statement.
+
+### `condition`
+
+A `condition` constrains whether a statement applies in a particular situation. Conditions can be specific to an AWS service. When using multiple `condition` blocks, they must *all* evaluate to true for the policy statement to apply. In other words, AWS evaluates the conditions as though with an "AND" boolean operation.
+
+The following arguments are required:
+
+* `test` (Required) Name of the [IAM condition operator](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html) to evaluate.
+* `values` (Required) Values to evaluate the condition against. If multiple values are provided, the condition matches if at least one of them applies. That is, AWS evaluates multiple values as though using an "OR" boolean operation.
+* `variable` (Required) Name of a [Context Variable](http://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements.html#AvailableKeys) to apply the condition to. Context variables may either be standard AWS variables starting with `aws:` or service-specific variables prefixed with the service name.
+
+### `principals` and `notPrincipals`
+
+The `principals` and `notPrincipals` arguments define to whom a statement applies or does not apply, respectively.
+
+~> **NOTE:** Even though the [IAM Documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html) states that `"Principal": "*"` and `"Principal": {"AWS": "*"}` are equivalent, those principal elements have different behavior in some situations, e.g., IAM Role Trust Policy. To have Terraform render JSON containing `"Principal": "*"`, use `type = "*"` and `identifiers = ["*"]`. To have Terraform render JSON containing `"Principal": {"AWS": "*"}`, use `type = "AWS"` and `identifiers = ["*"]`.
+
+-> For more information about AWS principals, refer to the [AWS Identity and Access Management User Guide: AWS JSON policy elements: Principal](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html).
+
+The following arguments are required:
+
+* `identifiers` (Required) List of identifiers for principals. When `type` is `aws`, these are IAM principal ARNs, e.g., `arn:aws:iam::12345678901:role/yakRole`.  When `type` is `service`, these are AWS Service roles, e.g., `lambdaAmazonawsCom`. When `type` is `federated`, these are web identity users or SAML provider ARNs, e.g., `accountsGoogleCom` or `arn:aws:iam::12345678901:samlProvider/yakSamlProvider`. When `type` is `canonicalUser`, these are [canonical user IDs](https://docs.aws.amazon.com/general/latest/gr/acct-identifiers.html#FindingCanonicalId), e.g., `79A59Df900B949E55D96A1E698Fbacedfd6E09D98Eacf8F8D5218E7Cd47Ef2Be`.
+* `type` (Required) Type of principal. Valid values include `aws`, `service`, `federated`, `canonicalUser` and `*`.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `json` - Standard JSON policy document rendered based on the arguments above.
+
+<!-- cache-key: cdktf-0.18.0 input-c602f06a4415d21639bfb95fc6d2eb21bd336984864688c93e5e0c70aab27794 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/iam_principal_policy_simulation.html.markdown b/website/docs/cdktf/typescript/d/iam_principal_policy_simulation.html.markdown
new file mode 100644
index 00000000000..4a4b813515c
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/iam_principal_policy_simulation.html.markdown
@@ -0,0 +1,268 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_principal_policy_simulation"
+description: |-
+  Runs a simulation of the IAM policies of a particular principal against a given hypothetical request.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_iam_principal_policy_simulation
+
+Runs a simulation of the IAM policies of a particular principal against a given hypothetical request.
+
+You can use this data source in conjunction with
+[Preconditions and Postconditions](https://www.terraform.io/language/expressions/custom-conditions#preconditions-and-postconditions) so that your configuration can test either whether it should have sufficient access to do its own work, or whether policies your configuration declares itself are sufficient for their intended use elsewhere.
+
+-> **Note:** Correctly using this data source requires familiarity with various details of AWS Identity and Access Management, and how various AWS services integrate with it. For general information on the AWS IAM policy simulator, see [Testing IAM policies with the IAM policy simulator](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_testing-policies.html). This data source wraps the `iam:simulatePrincipalPolicy` API action described on that page.
+
+## Example Usage
+
+### Self Access-checking Example
+
+The following example raises an error if the credentials passed to the AWS provider do not have access to perform the three actions `s3:getObject`, `s3:putObject`, and `s3:deleteObject` on the S3 bucket with the given ARN. It combines `awsIamPrincipalPolicySimulation` with the core Terraform postconditions feature.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformSelf, Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCallerIdentity } from "./.gen/providers/aws/data-aws-caller-identity";
+import { DataAwsIamPrincipalPolicySimulation } from "./.gen/providers/aws/data-aws-iam-principal-policy-simulation";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const current = new DataAwsCallerIdentity(this, "current", {});
+    new DataAwsIamPrincipalPolicySimulation(this, "s3_object_access", {
+      actionNames: ["s3:GetObject", "s3:PutObject", "s3:DeleteObject"],
+      lifecycle: {
+        postcondition: [
+          {
+            condition: TerraformSelf.getAny("all_allowed"),
+            errorMessage:
+              "        Given AWS credentials do not have sufficient access to manage " +
+              Token.asString(
+                Fn.join(
+                  ", ",
+                  Token.asList(TerraformSelf.getAny("resource_arns"))
+                )
+              ) +
+              ".\n\n",
+          },
+        ],
+      },
+      policySourceArn: Token.asString(current.arn),
+      resourceArns: ["arn:aws:s3:::my-test-bucket"],
+    });
+  }
+}
+
+```
+
+If you intend to use this data source to quickly raise an error when the given credentials are insufficient then you must use [`dependsOn`](https://www.terraform.io/language/meta-arguments/depends_on) inside any resource which would require those credentials, to ensure that the policy check will run first:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3BucketObject } from "./.gen/providers/aws/s3-bucket-object";
+interface MyConfig {
+  key: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new S3BucketObject(this, "example", {
+      bucket: "my-test-bucket",
+      dependsOn: [s3ObjectAccess],
+      key: config.key,
+    });
+  }
+}
+
+```
+
+### Testing the Effect of a Declared Policy
+
+The following example declares an S3 bucket and a user that should have access to the bucket, and then uses `awsIamPrincipalPolicySimulation` to verify that the user does indeed have access to perform needed operations against the bucket.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformSelf, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCallerIdentity } from "./.gen/providers/aws/data-aws-caller-identity";
+import { DataAwsIamPrincipalPolicySimulation } from "./.gen/providers/aws/data-aws-iam-principal-policy-simulation";
+import { IamUser } from "./.gen/providers/aws/iam-user";
+import { IamUserPolicy } from "./.gen/providers/aws/iam-user-policy";
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketPolicy } from "./.gen/providers/aws/s3-bucket-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new IamUser(this, "example", {
+      name: "example",
+    });
+    const awsS3BucketExample = new S3Bucket(this, "example_1", {
+      bucket: "my-test-bucket",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketExample.overrideLogicalId("example");
+    const current = new DataAwsCallerIdentity(this, "current", {});
+    const s3Access = new IamUserPolicy(this, "s3_access", {
+      name: "example_s3_access",
+      policy: Token.asString(
+        Fn.jsonencode({
+          Statement: [
+            {
+              Action: "s3:GetObject",
+              Effect: "Allow",
+              Resource: awsS3BucketExample.arn,
+            },
+          ],
+          Version: "2012-10-17",
+        })
+      ),
+      user: example.name,
+    });
+    const accountAccess = new S3BucketPolicy(this, "account_access", {
+      bucket: Token.asString(awsS3BucketExample.bucket),
+      policy: Token.asString(
+        Fn.jsonencode({
+          Statement: [
+            {
+              Action: "s3:*",
+              Effect: "Allow",
+              Principal: {
+                AWS: current.accountId,
+              },
+              Resource: [
+                awsS3BucketExample.arn,
+                "${" + awsS3BucketExample.arn + "}/*",
+              ],
+            },
+          ],
+          Version: "2012-10-17",
+        })
+      ),
+    });
+    new DataAwsIamPrincipalPolicySimulation(this, "s3_object_access", {
+      actionNames: ["s3:GetObject"],
+      dependsOn: [s3Access],
+      lifecycle: {
+        postcondition: [
+          {
+            condition: TerraformSelf.getAny("all_allowed"),
+            errorMessage:
+              "        " +
+              Token.asString(TerraformSelf.getAny("policy_source_arn")) +
+              " does not have the expected access to " +
+              Token.asString(
+                Fn.join(
+                  ", ",
+                  Token.asList(TerraformSelf.getAny("resource_arns"))
+                )
+              ) +
+              ".\n\n",
+          },
+        ],
+      },
+      policySourceArn: example.arn,
+      resourceArns: [Token.asString(awsS3BucketExample.arn)],
+      resourcePolicyJson: accountAccess.policy,
+    });
+  }
+}
+
+```
+
+When using `awsIamPrincipalPolicySimulation` to test the effect of a policy declared elsewhere in the same configuration, it's important to use [`dependsOn`](https://www.terraform.io/language/meta-arguments/depends_on) to make sure that the needed policy has been fully created or updated before running the simulation.
+
+## Argument Reference
+
+The following arguments are required for any principal policy simulation:
+
+* `actionNames` (Required) - A set of IAM action names to run simulations for. Each entry in this set adds an additional hypothetical request to the simulation.
+
+    Action names consist of a service prefix and an action verb separated by a colon, such as `s3:getObject`. Refer to [Actions, resources, and condition keys for AWS services](https://docs.aws.amazon.com/service-authorization/latest/reference/reference_policies_actions-resources-contextkeys.html) to see the full set of possible IAM action names across all AWS services.
+
+* `policySourceArn` (Required) - The [ARN](https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html) of the IAM user, group, or role whose policies will be included in the simulation.
+
+You must closely match the form of the real service request you are simulating in order to achieve a realistic result. You can use the following additional arguments to specify other characteristics of the simulated requests:
+
+* `callerArn` (Optional) - The ARN of an user that will appear as the "caller" of the simulated requests. If you do not specify `callerArn` then the simulation will use the `policySourceArn` instead, if it contains a user ARN.
+
+* `context` (Optional) - Each [`context` block](#context-block-arguments) defines an entry in the table of additional context keys in the simulated request.
+
+    IAM uses context keys for both custom conditions and for interpolating dynamic request-specific values into policy values. If you use policies that include those features then you will need to provide suitable example values for those keys to achieve a realistic simulation.
+
+* `additionalPoliciesJson` (Optional) - A set of additional principal policy documents to include in the simulation. The simulator will behave as if each of these policies were associated with the object specified in `policySourceArn`, allowing you to test the effect of hypothetical policies not yet created.
+
+* `permissionsBoundaryPoliciesJson` (Optional) - A set of [permissions boundary policy documents](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html) to include in the simulation.
+
+* `resourceArns` (Optional) - A set of ARNs of resources to include in the simulation.
+
+    This argument is important for actions that have either required or optional resource types listed in [Actions, resources, and condition keys for AWS services](https://docs.aws.amazon.com/service-authorization/latest/reference/reference_policies_actions-resources-contextkeys.html), and you must provide ARNs that identify AWS objects of the appropriate types for the chosen actions.
+
+    The policy simulator only automatically loads policies associated with the `policySourceArn`, so if your given resources have their own resource-level policy then you'll also need to provide that explicitly using the `resourcePolicyJson` argument to achieve a realistic simulation.
+
+* `resourceHandlingOption` (Optional) - Specifies a special simulation type to run. Some EC2 actions require special simulation behaviors and a particular set of resource ARNs to achieve a realistic result.
+
+    For more details, see the `resourceHandlingOption` request parameter for [the underlying `iam:simulatePrincipalPolicy` action](https://docs.aws.amazon.com/IAM/latest/APIReference/API_SimulatePrincipalPolicy.html).
+
+* `resourceOwnerAccountId` (Optional) - An AWS account ID to use for any resource ARN in `resourceArns` that doesn't include its own AWS account ID. If unspecified, the simulator will use the account ID from the `callerArn` argument as a placeholder.
+
+* `resourcePolicyJson` (Optional) - An IAM policy document representing the resource-level policy of all of the resources specified in `resourceArns`.
+
+    The policy simulator cannot automatically load policies that are associated with individual resources, as described in the documentation for `resourceArns` above.
+
+### `context` block arguments
+
+The following arguments are all required in each `context` block:
+
+* `key` (Required) - The context _condition key_ to set.
+
+    If you have policies containing `condition` elements or using dynamic interpolations then you will need to provide suitable values for each condition key your policies use. See [Actions, resources, and condition keys for AWS services](https://docs.aws.amazon.com/service-authorization/latest/reference/reference_policies_actions-resources-contextkeys.html) to find the various condition keys that are normally provided for real requests to each action of each AWS service.
+
+* `type` (Required) - An IAM value type that determines how the policy simulator will interpret the strings given in `values`.
+
+    For more information, see the `contextKeyType` field of [`iamContextEntry`](https://docs.aws.amazon.com/IAM/latest/APIReference/API_ContextEntry.html) in the underlying API.
+
+* `values` (Required) - A set of one or more values for this context entry.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `allAllowed` - `true` if all of the simulation results have decision "allowed", or `false` otherwise.
+
+    This is a convenient shorthand for the common case of requiring that all of the simulated requests passed in a postcondition associated with the data source. If you need to describe a more granular condition, use the `results` attribute instead.
+
+* `results` - A set of result objects, one for each of the simulated requests, with the following nested attributes:
+
+    * `actionName` - The name of the single IAM action used for this particular request.
+
+    * `decision` - The raw decision determined from all of the policies in scope; either "allowed", "explicitDeny", or "implicitDeny".
+
+    * `allowed` - `true` if `decision` is "allowed", and `false` otherwise.
+
+    * `decisionDetails` - A map of arbitrary metadata entries returned by the policy simulator for this request.
+
+    * `resourceArn` - ARN of the resource that was used for this particular request. When you specify multiple actions and multiple resource ARNs, that causes a separate policy request for each combination of unique action and resource.
+
+    * `matchedStatements` - A nested set of objects describing which policies contained statements that were relevant to this simulation request. Each object has attributes `sourcePolicyId` and `sourcePolicyType` to identify one of the policies.
+
+    * `missingContextKeys` - A set of context keys (or condition keys) that were needed by some of the policies contributing to this result but not specified using a `context` block in the configuration. Missing or incorrect context keys will typically cause a simulated request to be disallowed.
+
+<!-- cache-key: cdktf-0.18.0 input-6271bf4e5593c485a454ee1fc263b036e5a42e08cc910da3ee1ceb0f0495dce4 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/iam_role.html.markdown b/website/docs/cdktf/typescript/d/iam_role.html.markdown
new file mode 100644
index 00000000000..e1965ca8e89
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/iam_role.html.markdown
@@ -0,0 +1,64 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_role"
+description: |-
+  Get information on a Amazon IAM role
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_iam_role
+
+This data source can be used to fetch information about a specific
+IAM role. By using this data source, you can reference IAM role
+properties without having to hard code ARNs as input.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamRole } from "./.gen/providers/aws/data-aws-iam-role";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsIamRole(this, "example", {
+      name: "an_example_role_name",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `name` - (Required) Friendly IAM role name to match.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - Friendly IAM role name to match.
+* `arn` - ARN of the role.
+* `assumeRolePolicy` - Policy document associated with the role.
+* `createDate` - Creation date of the role in RFC 3339 format.
+* `description` - Description for the role.
+* `maxSessionDuration` - Maximum session duration.
+* `path` - Path to the role.
+* `permissionsBoundary` - The ARN of the policy that is used to set the permissions boundary for the role.
+* `roleLastUsed` - Contains information about the last time that an IAM role was used. See [`roleLastUsed`](#role_last_used) for details.
+* `uniqueId` - Stable and unique string identifying the role.
+* `tags` - Tags attached to the role.
+
+### role_last_used
+
+* `region` - The name of the AWS Region in which the role was last used.
+* `lastUsedDate` - The date and time, in RFC 3339 format, that the role was last used.
+
+<!-- cache-key: cdktf-0.18.0 input-f419dd0c81b1d5dcbc960f11de5335c9a815a56c17e6d9214e419f0ce6cd1165 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/iam_roles.html.markdown b/website/docs/cdktf/typescript/d/iam_roles.html.markdown
new file mode 100644
index 00000000000..0ffc48059c5
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/iam_roles.html.markdown
@@ -0,0 +1,176 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_roles"
+description: |-
+  Get information about a set of IAM Roles.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_iam_roles
+
+Use this data source to get the ARNs and Names of IAM Roles.
+
+## Example Usage
+
+### All roles in an account
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamRoles } from "./.gen/providers/aws/data-aws-iam-roles";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsIamRoles(this, "roles", {});
+  }
+}
+
+```
+
+### Roles filtered by name regex
+
+Roles whose role-name contains `project`
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamRoles } from "./.gen/providers/aws/data-aws-iam-roles";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsIamRoles(this, "roles", {
+      nameRegex: ".*project.*",
+    });
+  }
+}
+
+```
+
+### Roles filtered by path prefix
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamRoles } from "./.gen/providers/aws/data-aws-iam-roles";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsIamRoles(this, "roles", {
+      pathPrefix: "/custom-path",
+    });
+  }
+}
+
+```
+
+### Roles provisioned by AWS SSO
+
+Roles in the account filtered by path prefix
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamRoles } from "./.gen/providers/aws/data-aws-iam-roles";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsIamRoles(this, "roles", {
+      pathPrefix: "/aws-reserved/sso.amazonaws.com/",
+    });
+  }
+}
+
+```
+
+Specific role in the account filtered by name regex and path prefix
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamRoles } from "./.gen/providers/aws/data-aws-iam-roles";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsIamRoles(this, "roles", {
+      nameRegex: "AWSReservedSSO_permission_set_name_.*",
+      pathPrefix: "/aws-reserved/sso.amazonaws.com/",
+    });
+  }
+}
+
+```
+
+### Role ARNs with paths removed
+
+For services like Amazon EKS that do not permit a path in the role ARN when used in a cluster's configuration map
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformOutput, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamRoles } from "./.gen/providers/aws/data-aws-iam-roles";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const roles = new DataAwsIamRoles(this, "roles", {
+      pathPrefix: "/aws-reserved/sso.amazonaws.com/",
+    });
+    new TerraformOutput(this, "arns", {
+      value:
+        "${[ for parts in ${" +
+        ("${[ for arn in ${" + roles.arns + '} : split("/", arn)]}') +
+        '} : format("%s/%s", parts[0], element(parts, length(parts) - 1))]}',
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `nameRegex` - (Optional) Regex string to apply to the IAM roles list returned by AWS. This allows more advanced filtering not supported from the AWS API. This filtering is done locally on what AWS returns, and could have a performance impact if the result is large. Combine this with other options to narrow down the list AWS returns.
+* `pathPrefix` - (Optional) Path prefix for filtering the results. For example, the prefix `/application_abc/component_xyz/` gets all roles whose path starts with `/application_abc/component_xyz/`. If it is not included, it defaults to a slash (`/`), listing all roles. For more details, check out [list-roles in the AWS CLI reference][1].
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arns` - Set of ARNs of the matched IAM roles.
+* `names` - Set of Names of the matched IAM roles.
+
+[1]: https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/list-roles.html
+
+<!-- cache-key: cdktf-0.18.0 input-2f1510756a6120b958db2271379136537f759d5e9afbe12b5fb117e5c9014d63 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/iam_saml_provider.html.markdown b/website/docs/cdktf/typescript/d/iam_saml_provider.html.markdown
new file mode 100644
index 00000000000..10c1ebcab38
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/iam_saml_provider.html.markdown
@@ -0,0 +1,53 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_saml_provider"
+description: |-
+  Get information on an IAM SAML provider.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_saml_provider
+
+This data source can be used to fetch information about a specific
+IAM SAML provider. This will allow you to easily retrieve the metadata
+document of an existing SAML provider.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamSamlProvider } from "./.gen/providers/aws/data-aws-iam-saml-provider";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsIamSamlProvider(this, "example", {
+      arn: "arn:aws:iam::123456789:saml-provider/myprovider",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `arn` - (Required) ARN assigned by AWS for the provider.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `createDate` - Creation date of the SAML provider in RFC1123 format, e.g. `Mon, 02 Jan 2006 15:04:05 MST`.
+* `name` - Name of the provider.
+* `samlMetadataDocument` - The XML document generated by an identity provider that supports SAML 2.0.
+* `tags` - Tags attached to the SAML provider.
+* `validUntil` - Expiration date and time for the SAML provider in RFC1123 format, e.g. `Mon, 02 Jan 2007 15:04:05 MST`.
+
+<!-- cache-key: cdktf-0.18.0 input-3075ed53262e7e26eb19f6b6608bbaed885c6c93fe9dcf1a0139a8fe7f5d0d23 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/iam_server_certificate.html.markdown b/website/docs/cdktf/typescript/d/iam_server_certificate.html.markdown
new file mode 100644
index 00000000000..444b68f4552
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/iam_server_certificate.html.markdown
@@ -0,0 +1,94 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_server_certificate"
+description: |-
+  Get information about a server certificate
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_iam_server_certificate
+
+Use this data source to lookup information about IAM Server Certificates.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamServerCertificate } from "./.gen/providers/aws/data-aws-iam-server-certificate";
+import { Elb } from "./.gen/providers/aws/elb";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const myDomain = new DataAwsIamServerCertificate(this, "my-domain", {
+      latest: true,
+      namePrefix: "my-domain.org",
+    });
+    new Elb(this, "elb", {
+      listener: [
+        {
+          instancePort: 8000,
+          instanceProtocol: "https",
+          lbPort: 443,
+          lbProtocol: "https",
+          sslCertificateId: Token.asString(myDomain.arn),
+        },
+      ],
+      name: "my-domain-elb",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `namePrefix` - prefix of cert to filter by
+* `pathPrefix` - prefix of path to filter by
+* `name` - exact name of the cert to lookup
+* `latest` - sort results by expiration date. returns the certificate with expiration date in furthest in the future.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` is set to the unique id of the IAM Server Certificate
+* `arn` is set to the ARN of the IAM Server Certificate
+* `path` is set to the path of the IAM Server Certificate
+* `expirationDate` is set to the expiration date of the IAM Server Certificate
+* `uploadDate` is the date when the server certificate was uploaded
+* `certificateBody` is the public key certificate (PEM-encoded). This is useful when [configuring back-end instance authentication](http://docs.aws.amazon.com/elasticloadbalancing/latest/classic/elb-create-https-ssl-load-balancer.html) policy for load balancer
+* `certificateChain` is the public key certificate chain (PEM-encoded) if exists, empty otherwise
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import an IAM server certificate using `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import an IAM server certificate using `name`. For example:
+
+```console
+% terraform import aws_iam_server_certificate.example example
+```
+
+Import will read in the certificate body, certificate chain (if it exists), ID, name, path, and ARN. It will not retrieve the private key which is not available through the AWS API.
+
+<!-- cache-key: cdktf-0.18.0 input-15f20b097eebaf3145f26a098ba793c65fab18858f84e06d6eb664e0785a5cdd -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/iam_session_context.html.markdown b/website/docs/cdktf/typescript/d/iam_session_context.html.markdown
new file mode 100644
index 00000000000..a47c096b767
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/iam_session_context.html.markdown
@@ -0,0 +1,82 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_session_context"
+description: |-
+  Get information on the IAM source role of an STS assumed role
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_iam_session_context
+
+This data source provides information on the IAM source role of an STS assumed role. For non-role ARNs, this data source simply passes the ARN through in `issuerArn`.
+
+For some AWS resources, multiple types of principals are allowed in the same argument (e.g., IAM users and IAM roles). However, these arguments often do not allow assumed-role (i.e., STS, temporary credential) principals. Given an STS ARN, this data source provides the ARN for the source IAM role.
+
+## Example Usage
+
+### Basic Example
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamSessionContext } from "./.gen/providers/aws/data-aws-iam-session-context";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsIamSessionContext(this, "example", {
+      arn: "arn:aws:sts::123456789012:assumed-role/Audien-Heaven/MatyNoyes",
+    });
+  }
+}
+
+```
+
+### Find the Terraform Runner's Source Role
+
+Combined with `awsCallerIdentity`, you can get the current user's source IAM role ARN (`issuerArn`) if you're using an assumed role. If you're not using an assumed role, the caller's (e.g., an IAM user's) ARN will simply be passed through. In environments where both IAM users and individuals using assumed roles need to apply the same configurations, this data source enables seamless use.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCallerIdentity } from "./.gen/providers/aws/data-aws-caller-identity";
+import { DataAwsIamSessionContext } from "./.gen/providers/aws/data-aws-iam-session-context";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const current = new DataAwsCallerIdentity(this, "current", {});
+    new DataAwsIamSessionContext(this, "example", {
+      arn: Token.asString(current.arn),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `arn` - (Required) ARN for an assumed role.
+
+~> If `arn` is a non-role ARN, Terraform gives no error and `issuerArn` will be equal to the `arn` value. For STS assumed-role ARNs, Terraform gives an error if the identified IAM role does not exist.
+
+## Attribute Reference
+
+~> With the exception of `issuerArn`, the attributes will not be populated unless the `arn` corresponds to an STS assumed role.
+
+* `issuerArn` - IAM source role ARN if `arn` corresponds to an STS assumed role. Otherwise, `issuerArn` is equal to `arn`.
+* `issuerId` - Unique identifier of the IAM role that issues the STS assumed role.
+* `issuerName` - Name of the source role. Only available if `arn` corresponds to an STS assumed role.
+* `sessionName` - Name of the STS session. Only available if `arn` corresponds to an STS assumed role.
+
+<!-- cache-key: cdktf-0.18.0 input-2e84cd322ad745896d1da57edd8c38897f3e2a4e912db65dea1fc036c7a5e65a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/iam_session_context.markdown b/website/docs/cdktf/typescript/d/iam_session_context.markdown
new file mode 100644
index 00000000000..a47c096b767
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/iam_session_context.markdown
@@ -0,0 +1,82 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_session_context"
+description: |-
+  Get information on the IAM source role of an STS assumed role
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_iam_session_context
+
+This data source provides information on the IAM source role of an STS assumed role. For non-role ARNs, this data source simply passes the ARN through in `issuerArn`.
+
+For some AWS resources, multiple types of principals are allowed in the same argument (e.g., IAM users and IAM roles). However, these arguments often do not allow assumed-role (i.e., STS, temporary credential) principals. Given an STS ARN, this data source provides the ARN for the source IAM role.
+
+## Example Usage
+
+### Basic Example
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamSessionContext } from "./.gen/providers/aws/data-aws-iam-session-context";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsIamSessionContext(this, "example", {
+      arn: "arn:aws:sts::123456789012:assumed-role/Audien-Heaven/MatyNoyes",
+    });
+  }
+}
+
+```
+
+### Find the Terraform Runner's Source Role
+
+Combined with `awsCallerIdentity`, you can get the current user's source IAM role ARN (`issuerArn`) if you're using an assumed role. If you're not using an assumed role, the caller's (e.g., an IAM user's) ARN will simply be passed through. In environments where both IAM users and individuals using assumed roles need to apply the same configurations, this data source enables seamless use.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCallerIdentity } from "./.gen/providers/aws/data-aws-caller-identity";
+import { DataAwsIamSessionContext } from "./.gen/providers/aws/data-aws-iam-session-context";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const current = new DataAwsCallerIdentity(this, "current", {});
+    new DataAwsIamSessionContext(this, "example", {
+      arn: Token.asString(current.arn),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `arn` - (Required) ARN for an assumed role.
+
+~> If `arn` is a non-role ARN, Terraform gives no error and `issuerArn` will be equal to the `arn` value. For STS assumed-role ARNs, Terraform gives an error if the identified IAM role does not exist.
+
+## Attribute Reference
+
+~> With the exception of `issuerArn`, the attributes will not be populated unless the `arn` corresponds to an STS assumed role.
+
+* `issuerArn` - IAM source role ARN if `arn` corresponds to an STS assumed role. Otherwise, `issuerArn` is equal to `arn`.
+* `issuerId` - Unique identifier of the IAM role that issues the STS assumed role.
+* `issuerName` - Name of the source role. Only available if `arn` corresponds to an STS assumed role.
+* `sessionName` - Name of the STS session. Only available if `arn` corresponds to an STS assumed role.
+
+<!-- cache-key: cdktf-0.18.0 input-2e84cd322ad745896d1da57edd8c38897f3e2a4e912db65dea1fc036c7a5e65a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/iam_user.html.markdown b/website/docs/cdktf/typescript/d/iam_user.html.markdown
new file mode 100644
index 00000000000..05125709961
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/iam_user.html.markdown
@@ -0,0 +1,54 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_user"
+description: |-
+  Get information on a Amazon IAM user
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_iam_user
+
+This data source can be used to fetch information about a specific
+IAM user. By using this data source, you can reference IAM user
+properties without having to hard code ARNs or unique IDs as input.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamUser } from "./.gen/providers/aws/data-aws-iam-user";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsIamUser(this, "example", {
+      userName: "an_example_user_name",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `userName` - (Required) Friendly IAM user name to match.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN assigned by AWS for this user.
+* `path` - Path in which this user was created.
+* `permissionsBoundary` - The ARN of the policy that is used to set the permissions boundary for the user.
+* `userId` - Unique ID assigned by AWS for this user.
+* `userName` - Name associated to this User
+* `tags` - Map of key-value pairs associated with the user.
+
+<!-- cache-key: cdktf-0.18.0 input-311b2756445d8c90d21040b26efe2adc4c762ad5827739191b5f65d550f8435c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/iam_user_ssh_key.html.markdown b/website/docs/cdktf/typescript/d/iam_user_ssh_key.html.markdown
new file mode 100644
index 00000000000..62616e31d64
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/iam_user_ssh_key.html.markdown
@@ -0,0 +1,53 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_user_ssh_key"
+description: |-
+  Get information on a SSH public key associated with the specified IAM user.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_iam_user_ssh_key
+
+Use this data source to get information about a SSH public key associated with the specified IAM user.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamUserSshKey } from "./.gen/providers/aws/data-aws-iam-user-ssh-key";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsIamUserSshKey(this, "example", {
+      encoding: "SSH",
+      sshPublicKeyId: "APKARUZ32GUTKIGARLXE",
+      username: "test-user",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `encoding` - (Required) Specifies the public key encoding format to use in the response. To retrieve the public key in ssh-rsa format, use `ssh`. To retrieve the public key in PEM format, use `pem`.
+* `sshPublicKeyId` - (Required) Unique identifier for the SSH public key.
+* `username` - (Required) Name of the IAM user associated with the SSH public key.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `fingerprint` - MD5 message digest of the SSH public key.
+* `publicKey` - SSH public key.
+* `status` - Status of the SSH public key. Active means that the key can be used for authentication with an CodeCommit repository. Inactive means that the key cannot be used.
+
+<!-- cache-key: cdktf-0.18.0 input-4ee22ff1f5e0f080cab2c8697a1be23a25df9c75fdd5dc34b8ea78d65f92f801 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/iam_users.html.markdown b/website/docs/cdktf/typescript/d/iam_users.html.markdown
new file mode 100644
index 00000000000..7585e611078
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/iam_users.html.markdown
@@ -0,0 +1,99 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_users"
+description: |-
+  Get information about a set of IAM Users.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_iam_users
+
+Use this data source to get the ARNs and Names of IAM Users.
+
+## Example Usage
+
+### All users in an account
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamUsers } from "./.gen/providers/aws/data-aws-iam-users";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsIamUsers(this, "users", {});
+  }
+}
+
+```
+
+### Users filtered by name regex
+
+Users whose username contains `abc`
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamUsers } from "./.gen/providers/aws/data-aws-iam-users";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsIamUsers(this, "users", {
+      nameRegex: ".*abc.*",
+    });
+  }
+}
+
+```
+
+### Users filtered by path prefix
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamUsers } from "./.gen/providers/aws/data-aws-iam-users";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsIamUsers(this, "users", {
+      pathPrefix: "/custom-path",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `nameRegex` - (Optional) Regex string to apply to the IAM users list returned by AWS. This allows more advanced filtering not supported from the AWS API. This filtering is done locally on what AWS returns, and could have a performance impact if the result is large. Combine this with other options to narrow down the list AWS returns.
+* `pathPrefix` - (Optional) Path prefix for filtering the results. For example, the prefix `/division_abc/subdivision_xyz/` gets all users whose path starts with `/division_abc/subdivision_xyz/`. If it is not included, it defaults to a slash (`/`), listing all users. For more details, check out [list-users in the AWS CLI reference][1].
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arns` - Set of ARNs of the matched IAM users.
+* `names` - Set of Names of the matched IAM users.
+
+[1]: https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/list-users.html
+
+<!-- cache-key: cdktf-0.18.0 input-5428d23c52ab8bd43ff4dfbb46d01c355df0ab280bbe08b24005df157e030403 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/identitystore_group.html.markdown b/website/docs/cdktf/typescript/d/identitystore_group.html.markdown
new file mode 100644
index 00000000000..40dab9ecac8
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/identitystore_group.html.markdown
@@ -0,0 +1,113 @@
+---
+subcategory: "SSO Identity Store"
+layout: "aws"
+page_title: "AWS: aws_identitystore_group"
+description: |-
+  Get information on an Identity Store Group
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_identitystore_group
+
+Use this data source to get an Identity Store Group.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformOutput, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIdentitystoreGroup } from "./.gen/providers/aws/data-aws-identitystore-group";
+import { DataAwsSsoadminInstances } from "./.gen/providers/aws/data-aws-ssoadmin-instances";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new DataAwsSsoadminInstances(this, "example", {});
+    const dataAwsIdentitystoreGroupExample = new DataAwsIdentitystoreGroup(
+      this,
+      "example_1",
+      {
+        alternateIdentifier: {
+          uniqueAttribute: {
+            attributePath: "DisplayName",
+            attributeValue: "ExampleGroup",
+          },
+        },
+        identityStoreId: Token.asString(
+          Fn.lookupNested(Fn.tolist(example.identityStoreIds), ["0"])
+        ),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsIdentitystoreGroupExample.overrideLogicalId("example");
+    new TerraformOutput(this, "group_id", {
+      value: dataAwsIdentitystoreGroupExample.groupId,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `identityStoreId` - (Required) Identity Store ID associated with the Single Sign-On Instance.
+
+The following arguments are optional:
+
+* `alternateIdentifier` (Optional) A unique identifier for the group that is not the primary identifier. Conflicts with `groupId` and `filter`. Detailed below.
+* `filter` - (Optional, **Deprecated** use the `alternateIdentifier` attribute instead) Configuration block for filtering by a unique attribute of the group. Detailed below.
+* `groupId` - (Optional) The identifier for a group in the Identity Store.
+
+-> Exactly one of the above arguments must be provided. Passing both `filter` and `groupId` is allowed for backwards compatibility.
+
+### `alternateIdentifier` Configuration Block
+
+The `alternateIdentifier` configuration block supports the following arguments:
+
+* `externalId` - (Optional) Configuration block for filtering by the identifier issued by an external identity provider. Detailed below.
+* `uniqueAttribute` - (Optional) An entity attribute that's unique to a specific entity. Detailed below.
+
+-> Exactly one of the above arguments must be provided.
+
+### `externalId` Configuration Block
+
+The `externalId` configuration block supports the following arguments:
+
+* `id` - (Required) The identifier issued to this resource by an external identity provider.
+* `issuer` - (Required) The issuer for an external identifier.
+
+### `filter` Configuration Block
+
+~> The `filter` configuration block has been deprecated. Use `alternateIdentifier` instead.
+
+The following arguments are supported by the `filter` configuration block:
+
+* `attributePath` - (Required) Attribute path that is used to specify which attribute name to search. Currently, `displayName` is the only valid attribute path.
+* `attributeValue` - (Required) Value for an attribute.
+
+### `uniqueAttribute` Configuration Block
+
+The `uniqueAttribute` configuration block supports the following arguments:
+
+* `attributePath` - (Required) Attribute path that is used to specify which attribute name to search. For example: `displayName`. Refer to the [Group data type](https://docs.aws.amazon.com/singlesignon/latest/IdentityStoreAPIReference/API_Group.html).
+* `attributeValue` - (Required) Value for an attribute.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - Identifier of the group in the Identity Store.
+* `description` - Description of the specified group.
+* `displayName` - Group's display name value.
+* `externalIds` - List of identifiers issued to this resource by an external identity provider.
+    * `id` - The identifier issued to this resource by an external identity provider.
+    * `issuer` - The issuer for an external identifier.
+
+<!-- cache-key: cdktf-0.18.0 input-e2ee8a1f184076e4923473e811d8cdcd0bbfa4b31daf2855f308b2e41de9934b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/identitystore_user.html.markdown b/website/docs/cdktf/typescript/d/identitystore_user.html.markdown
new file mode 100644
index 00000000000..1d7a27b808b
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/identitystore_user.html.markdown
@@ -0,0 +1,144 @@
+---
+subcategory: "SSO Identity Store"
+layout: "aws"
+page_title: "AWS: aws_identitystore_user"
+description: |-
+  Get information on an Identity Store User
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_identitystore_user
+
+Use this data source to get an Identity Store User.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformOutput, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIdentitystoreUser } from "./.gen/providers/aws/data-aws-identitystore-user";
+import { DataAwsSsoadminInstances } from "./.gen/providers/aws/data-aws-ssoadmin-instances";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new DataAwsSsoadminInstances(this, "example", {});
+    const dataAwsIdentitystoreUserExample = new DataAwsIdentitystoreUser(
+      this,
+      "example_1",
+      {
+        alternateIdentifier: {
+          uniqueAttribute: {
+            attributePath: "UserName",
+            attributeValue: "ExampleUser",
+          },
+        },
+        identityStoreId: Token.asString(
+          Fn.lookupNested(Fn.tolist(example.identityStoreIds), ["0"])
+        ),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsIdentitystoreUserExample.overrideLogicalId("example");
+    new TerraformOutput(this, "user_id", {
+      value: dataAwsIdentitystoreUserExample.userId,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `identityStoreId` - (Required) Identity Store ID associated with the Single Sign-On Instance.
+
+The following arguments are optional:
+
+* `alternateIdentifier` (Optional) A unique identifier for a user or group that is not the primary identifier. Conflicts with `userId` and `filter`. Detailed below.
+* `filter` - (Optional, **Deprecated** use the `alternateIdentifier` attribute instead) Configuration block for filtering by a unique attribute of the user. Detailed below.
+* `userId` - (Optional) The identifier for a user in the Identity Store.
+
+-> Exactly one of the above arguments must be provided. Passing both `filter` and `userId` is allowed for backwards compatibility.
+
+### `alternateIdentifier` Configuration Block
+
+The `alternateIdentifier` configuration block supports the following arguments:
+
+* `externalId` - (Optional) Configuration block for filtering by the identifier issued by an external identity provider. Detailed below.
+* `uniqueAttribute` - (Optional) An entity attribute that's unique to a specific entity. Detailed below.
+
+-> Exactly one of the above arguments must be provided.
+
+### `externalId` Configuration Block
+
+The `externalId` configuration block supports the following arguments:
+
+* `id` - (Required) The identifier issued to this resource by an external identity provider.
+* `issuer` - (Required) The issuer for an external identifier.
+
+### `filter` Configuration Block
+
+~> The `filter` configuration block has been deprecated. Use `alternateIdentifier` instead.
+
+The following arguments are supported by the `filter` configuration block:
+
+* `attributePath` - (Required) Attribute path that is used to specify which attribute name to search. Currently, `userName` is the only valid attribute path.
+* `attributeValue` - (Required) Value for an attribute.
+
+### `uniqueAttribute` Configuration Block
+
+The `uniqueAttribute` configuration block supports the following arguments:
+
+* `attributePath` - (Required) Attribute path that is used to specify which attribute name to search. For example: `userName`. Refer to the [User data type](https://docs.aws.amazon.com/singlesignon/latest/IdentityStoreAPIReference/API_User.html).
+* `attributeValue` - (Required) Value for an attribute.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - Identifier of the user in the Identity Store.
+* `addresses` - List of details about the user's address.
+    * `country` - The country that this address is in.
+    * `formatted` - The name that is typically displayed when the address is shown for display.
+    * `locality` - The address locality.
+    * `postalCode` - The postal code of the address.
+    * `primary` - When `true`, this is the primary address associated with the user.
+    * `region` - The region of the address.
+    * `streetAddress` - The street of the address.
+    * `type` - The type of address.
+* `displayName` - The name that is typically displayed when the user is referenced.
+* `emails` - List of details about the user's email.
+    * `primary` - When `true`, this is the primary email associated with the user.
+    * `type` - The type of email.
+    * `value` - The email address. This value must be unique across the identity store.
+* `externalIds` - List of identifiers issued to this resource by an external identity provider.
+    * `id` - The identifier issued to this resource by an external identity provider.
+    * `issuer` - The issuer for an external identifier.
+* `locale` - The user's geographical region or location.
+* `name` - Details about the user's full name.
+    * `familyName` - The family name of the user.
+    * `formatted` - The name that is typically displayed when the name is shown for display.
+    * `givenName` - The given name of the user.
+    * `honorificPrefix` - The honorific prefix of the user.
+    * `honorificSuffix` - The honorific suffix of the user.
+    * `middleName` - The middle name of the user.
+* `nickname` - An alternate name for the user.
+* `phoneNumbers` - List of details about the user's phone number.
+    * `primary` - When `true`, this is the primary phone number associated with the user.
+    * `type` - The type of phone number.
+    * `value` - The user's phone number.
+* `preferredLanguage` - The preferred language of the user.
+* `profileUrl` - An URL that may be associated with the user.
+* `timezone` - The user's time zone.
+* `title` - The user's title.
+* `userName` - User's user name value.
+* `userType` - The user type.
+
+<!-- cache-key: cdktf-0.18.0 input-8c28f2f52361f5a36e7b173700680cb27d3254e1fd37a8faf2c90f48b32a9d09 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/imagebuilder_component.html.markdown b/website/docs/cdktf/typescript/d/imagebuilder_component.html.markdown
new file mode 100644
index 00000000000..5d7db18e940
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/imagebuilder_component.html.markdown
@@ -0,0 +1,59 @@
+---
+subcategory: "EC2 Image Builder"
+layout: "aws"
+page_title: "AWS: aws_imagebuilder_component"
+description: |-
+    Provides details about an Image Builder Component
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_imagebuilder_component
+
+Provides details about an Image Builder Component.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsImagebuilderComponent } from "./.gen/providers/aws/data-aws-imagebuilder-component";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsImagebuilderComponent(this, "example", {
+      arn: "arn:aws:imagebuilder:us-west-2:aws:component/amazon-cloudwatch-agent-linux/1.0.0",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `arn` - (Required) ARN of the component.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `changeDescription` - Change description of the component.
+* `data` - Data of the component.
+* `dateCreated` - Date the component was created.
+* `description` - Description of the component.
+* `encrypted` - Encryption status of the component.
+* `kmsKeyId` - ARN of the Key Management Service (KMS) Key used to encrypt the component.
+* `name` - Name of the component.
+* `owner` - Owner of the component.
+* `platform` - Platform of the component.
+* `supportedOsVersions` - Operating Systems (OSes) supported by the component.
+* `tags` - Key-value map of resource tags for the component.
+* `type` - Type of the component.
+* `version` - Version of the component.
+
+<!-- cache-key: cdktf-0.18.0 input-a1dc867971bb73f35e057b5eef73912cb2d3c40d9fe01c02820500754033afa8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/imagebuilder_components.html.markdown b/website/docs/cdktf/typescript/d/imagebuilder_components.html.markdown
new file mode 100644
index 00000000000..9a14468da55
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/imagebuilder_components.html.markdown
@@ -0,0 +1,62 @@
+---
+subcategory: "EC2 Image Builder"
+layout: "aws"
+page_title: "AWS: aws_imagebuilder_components"
+description: |-
+    Get information on Image Builder Components.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_imagebuilder_components
+
+Use this data source to get the ARNs and names of Image Builder Components matching the specified criteria.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsImagebuilderComponents } from "./.gen/providers/aws/data-aws-imagebuilder-components";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsImagebuilderComponents(this, "example", {
+      filter: [
+        {
+          name: "platform",
+          values: ["Linux"],
+        },
+      ],
+      owner: "Self",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `owner` - (Optional) Owner of the image recipes. Valid values are `self`, `shared` and `amazon`. Defaults to `self`.
+* `filter` - (Optional) Configuration block(s) for filtering. Detailed below.
+
+### filter Configuration Block
+
+The `filter` configuration block supports the following arguments:
+
+* `name` - (Required) Name of the filter field. Valid values can be found in the [Image Builder ListComponents API Reference](https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_ListComponents.html).
+* `values` - (Required) Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arns` - Set of ARNs of the matched Image Builder Components.
+* `names` - Set of names of the matched Image Builder Components.
+
+<!-- cache-key: cdktf-0.18.0 input-a8148cb67f010a061547e1729a4d73bbc09bfc19d0e0e931cf5f0ffd14e2da9f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/imagebuilder_container_recipe.html.markdown b/website/docs/cdktf/typescript/d/imagebuilder_container_recipe.html.markdown
new file mode 100644
index 00000000000..824d437382a
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/imagebuilder_container_recipe.html.markdown
@@ -0,0 +1,84 @@
+---
+subcategory: "EC2 Image Builder"
+layout: "aws"
+page_title: "AWS: aws_imagebuilder_container_recipe"
+description: |-
+    Provides details about an Image Builder Container Recipe
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_imagebuilder_container_recipe
+
+Provides details about an Image builder Container Recipe.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsImagebuilderContainerRecipe } from "./.gen/providers/aws/data-aws-imagebuilder-container-recipe";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsImagebuilderContainerRecipe(this, "example", {
+      arn: "arn:aws:imagebuilder:us-east-1:aws:container-recipe/example/1.0.0",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `arn` - (Required) ARN of the container recipe.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `component` - List of objects with components for the container recipe.
+    * `componentArn` - ARN of the Image Builder Component.
+    * `parameter` - Set of parameters that are used to configure the component.
+        * `name` - Name of the component parameter.
+        * `value` - Value of the component parameter.
+* `containerType` - Type of the container.
+* `dateCreated` - Date the container recipe was created.
+* `description` - Description of the container recipe.
+* `dockerfileTemplateData` - Dockerfile template used to build the image.
+* `encrypted` - Flag that indicates if the target container is encrypted.
+* `instanceConfiguration` - List of objects with instance configurations for building and testing container images.
+    * `blockDeviceMapping` - Set of objects with block device mappings for the instance configuration.
+        * `deviceName` - Name of the device. For example, `/dev/sda` or `/dev/xvdb`.
+        * `ebs` - Single list of object with Elastic Block Storage (EBS) block device mapping settings.
+            * `deleteOnTermination` - Whether to delete the volume on termination. Defaults to unset, which is the value inherited from the parent image.
+            * `encrypted` - Whether to encrypt the volume. Defaults to unset, which is the value inherited from the parent image.
+            * `iops` - Number of Input/Output (I/O) operations per second to provision for an `io1` or `io2` volume.
+            * `kmsKeyId` - ARN of the Key Management Service (KMS) Key for encryption.
+            * `snapshotId` - Identifier of the EC2 Volume Snapshot.
+            * `throughput` - For GP3 volumes only. The throughput in MiB/s that the volume supports.
+            * `volumeSize` - Size of the volume, in GiB.
+            * `volumeType` - Type of the volume. For example, `gp2` or `io2`.
+        * `noDevice` - Whether to remove a mapping from the parent image.
+        * `virtualName` - Virtual device name. For example, `ephemeral0`. Instance store volumes are numbered starting from 0.
+    * `image` - AMI ID of the base image for container build and test instance.
+* `kmsKeyId` - KMS key used to encrypt the container image.
+* `name` - Name of the container recipe.
+* `owner` - Owner of the container recipe.
+* `parentImage` - Base image for the container recipe.
+* `platform` - Platform of the container recipe.
+* `tags` - Key-value map of resource tags for the container recipe.
+* `targetRepository` - Destination repository for the container image.
+    * `repositoryName` - Name of the container repository where the output container image is stored. The name is prefixed by the repository location.
+    * `service` - Service in which this image is registered.
+* `version` - Version of the container recipe.
+* `workingDirectory` - Working directory used during build and test workflows.
+
+<!-- cache-key: cdktf-0.18.0 input-4e22e11f15936a7e4695ac2bfd8c64e0718ffb1c7fab1ad5ef07d652ffab46f0 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/imagebuilder_container_recipes.html.markdown b/website/docs/cdktf/typescript/d/imagebuilder_container_recipes.html.markdown
new file mode 100644
index 00000000000..3dd8c0bcd0b
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/imagebuilder_container_recipes.html.markdown
@@ -0,0 +1,62 @@
+---
+subcategory: "EC2 Image Builder"
+layout: "aws"
+page_title: "AWS: aws_imagebuilder_container_recipes"
+description: |-
+    Get information on Image Builder Container Recipes.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_imagebuilder_container_recipes
+
+Use this data source to get the ARNs and names of Image Builder Container Recipes matching the specified criteria.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsImagebuilderContainerRecipes } from "./.gen/providers/aws/data-aws-imagebuilder-container-recipes";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsImagebuilderContainerRecipes(this, "example", {
+      filter: [
+        {
+          name: "platform",
+          values: ["Linux"],
+        },
+      ],
+      owner: "Self",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `owner` - (Optional) Owner of the container recipes. Valid values are `self`, `shared` and `amazon`. Defaults to `self`.
+* `filter` - (Optional) Configuration block(s) for filtering. Detailed below.
+
+### filter Configuration Block
+
+The `filter` configuration block supports the following arguments:
+
+* `name` - (Required) Name of the filter field. Valid values can be found in the [Image Builder ListContainerRecipes API Reference](https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_ListContainerRecipes.html).
+* `values` - (Required) Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arns` - Set of ARNs of the matched Image Builder Container Recipes.
+* `names` - Set of names of the matched Image Builder Container Recipes.
+
+<!-- cache-key: cdktf-0.18.0 input-d055befea2d338072390ae3d9a57f66a449f452a3151ae51419f72bb83057800 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/imagebuilder_distribution_configuration.html.markdown b/website/docs/cdktf/typescript/d/imagebuilder_distribution_configuration.html.markdown
new file mode 100644
index 00000000000..f3c6a8bbdc7
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/imagebuilder_distribution_configuration.html.markdown
@@ -0,0 +1,84 @@
+---
+subcategory: "EC2 Image Builder"
+layout: "aws"
+page_title: "AWS: aws_imagebuilder_distribution_configuration"
+description: |-
+    Provides details about an Image Builder Distribution Configuration
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_imagebuilder_distribution_configuration
+
+Provides details about an Image Builder Distribution Configuration.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsImagebuilderDistributionConfiguration } from "./.gen/providers/aws/data-aws-imagebuilder-distribution-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsImagebuilderDistributionConfiguration(this, "example", {
+      arn: "arn:aws:imagebuilder:us-west-2:aws:distribution-configuration/example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `arn` - (Required) ARN of the distribution configuration.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `dateCreated` - Date the distribution configuration was created.
+* `dateUpdated` - Date the distribution configuration was updated.
+* `description` - Description of the distribution configuration.
+* `distribution` - Set of distributions.
+    * `amiDistributionConfiguration` - Nested list of AMI distribution configuration.
+        * `amiTags` - Key-value map of tags to apply to distributed AMI.
+        * `description` - Description to apply to distributed AMI.
+        * `kmsKeyId` - ARN of Key Management Service (KMS) Key to encrypt AMI.
+        * `launchPermission` - Nested list of EC2 launch permissions.
+            * `organizationArns` - Set of AWS Organization ARNs.
+            * `organizationalUnitArns` - Set of AWS Organizational Unit ARNs.
+            * `userGroups` - Set of EC2 launch permission user groups.
+            * `userIds` - Set of AWS Account identifiers.
+        * `targetAccountIds` - Set of target AWS Account identifiers.
+    * `containerDistributionConfiguration` - Nested list of container distribution configurations.
+        * `containerTags` - Set of tags that are attached to the container distribution configuration.
+        * `description` - Description of the container distribution configuration.
+        * `targetRepository` - Set of destination repositories for the container distribution configuration.
+            * `repositoryName` - Name of the container repository where the output container image is stored.
+            * `service` - Service in which the image is registered.
+    * `fastLaunchConfiguration` - Nested list of Windows faster-launching configurations to use for AMI distribution.
+        * `accountId` - The owner account ID for the fast-launch enabled Windows AMI.
+        * `enabled` - A Boolean that represents the current state of faster launching for the Windows AMI.
+        * `launchTemplate` - Nested list of launch templates that the fast-launch enabled Windows AMI uses when it launches Windows instances to create pre-provisioned snapshots.
+            * `launchTemplateId` - The ID of the launch template to use for faster launching for a Windows AMI.
+            * `launchTemplateName` - The name of the launch template to use for faster launching for a Windows AMI.
+            * `launchTemplateVersion` - The version of the launch template to use for faster launching for a Windows AMI.
+        * `maxParallelLaunches` - The maximum number of parallel instances that are launched for creating resources.
+        * `snapshotConfiguration` - Nested list of configurations for managing the number of snapshots that are created from pre-provisioned instances for the Windows AMI when faster launching is enabled.
+            * `targetResourceCount` - The number of pre-provisioned snapshots to keep on hand for a fast-launch enabled Windows AMI.
+    * `launchTemplateConfiguration` - Nested list of launch template configurations.
+        * `default` - Whether the specified Amazon EC2 launch template is set as the default launch template.
+        * `launchTemplateId` - ID of the Amazon EC2 launch template.
+        * `accountId` - The account ID that this configuration applies to.
+    * `licenseConfigurationArns` - Set of Amazon Resource Names (ARNs) of License Manager License Configurations.
+    * `region` - AWS Region of distribution.
+* `name` - Name of the distribution configuration.
+* `tags` - Key-value map of resource tags for the distribution configuration.
+
+<!-- cache-key: cdktf-0.18.0 input-7b28680ba5fe3c06481414befe6f2cb9eb821dae2ff9137702f5a2483f24bb91 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/imagebuilder_distribution_configurations.html.markdown b/website/docs/cdktf/typescript/d/imagebuilder_distribution_configurations.html.markdown
new file mode 100644
index 00000000000..03adb0d5ad2
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/imagebuilder_distribution_configurations.html.markdown
@@ -0,0 +1,60 @@
+---
+subcategory: "EC2 Image Builder"
+layout: "aws"
+page_title: "AWS: aws_imagebuilder_distribution_configurations"
+description: |-
+    Get information on Image Builder Distribution Configurations.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_imagebuilder_distribution_configurations
+
+Use this data source to get the ARNs and names of Image Builder Distribution Configurations matching the specified criteria.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsImagebuilderDistributionConfigurations } from "./.gen/providers/aws/data-aws-imagebuilder-distribution-configurations";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsImagebuilderDistributionConfigurations(this, "example", {
+      filter: [
+        {
+          name: "name",
+          values: ["example"],
+        },
+      ],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `filter` - (Optional) Configuration block(s) for filtering. Detailed below.
+
+## filter Configuration Block
+
+The `filter` configuration block supports the following arguments:
+
+* `name` - (Required) Name of the filter field. Valid values can be found in the [Image Builder ListDistributionConfigurations API Reference](https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_ListDistributionConfigurations.html).
+* `values` - (Required) Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arns` - Set of ARNs of the matched Image Builder Distribution Configurations.
+* `names` - Set of names of the matched Image Builder Distribution Configurations.
+
+<!-- cache-key: cdktf-0.18.0 input-fe0fb4ac2236aa97b321cc03ad0312343b5b0954825802e0f33e19eb3eabf16e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/imagebuilder_image.html.markdown b/website/docs/cdktf/typescript/d/imagebuilder_image.html.markdown
new file mode 100644
index 00000000000..ec71bc93f8a
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/imagebuilder_image.html.markdown
@@ -0,0 +1,78 @@
+---
+subcategory: "EC2 Image Builder"
+layout: "aws"
+page_title: "AWS: aws_imagebuilder_image"
+description: |-
+    Provides details about an Image Builder Image
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_imagebuilder_image
+
+Provides details about an Image Builder Image.
+
+## Example Usage
+
+### Latest
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsImagebuilderImage } from "./.gen/providers/aws/data-aws-imagebuilder-image";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsImagebuilderImage(this, "example", {
+      arn: "arn:aws:imagebuilder:us-west-2:aws:image/amazon-linux-2-x86/x.x.x",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `arn` - (Required) ARN of the image. The suffix can either be specified with wildcards (`xXX`) to fetch the latest build version or a full build version (e.g., `20201126/1`) to fetch an exact version.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `buildVersionArn` - Build version ARN of the image. This will always have the `#.#.#/#` suffix.
+* `containerRecipeArn` - ARN of the container recipe.
+* `dateCreated` - Date the image was created.
+* `distributionConfigurationArn` - ARN of the Image Builder Distribution Configuration.
+* `enhancedImageMetadataEnabled` - Whether additional information about the image being created is collected.
+* `imageRecipeArn` - ARN of the image recipe.
+* `imageScanningConfiguration` - List of an object with image scanning configuration fields.
+    * `imageScanningEnabled` - Indicates whether Image Builder keeps a snapshot of the vulnerability scans that Amazon Inspector runs against the build instance when you create a new image.
+    * `ecrConfiguration` - Configuration block with ECR configuration.
+        * `repositoryName` - The name of the container repository that Amazon Inspector scans to identify findings for your container images.
+        * `containerTags` - Set of tags for Image Builder to apply to the output container image that that Amazon Inspector scans.
+* `imageTestsConfiguration` - List of an object with image tests configuration.
+    * `imageTestsEnabled` - Whether image tests are enabled.
+    * `timeoutMinutes` - Number of minutes before image tests time out.
+* `infrastructureConfigurationArn` - ARN of the Image Builder Infrastructure Configuration.
+* `name` - Name of the image.
+* `platform` - Platform of the image.
+* `osVersion` - Operating System version of the image.
+* `outputResources` - List of objects with resources created by the image.
+    * `amis` - Set of objects with each Amazon Machine Image (AMI) created.
+        * `accountId` - Account identifier of the AMI.
+        * `description` - Description of the AMI.
+        * `image` - Identifier of the AMI.
+        * `name` - Name of the AMI.
+        * `region` - Region of the AMI.
+    * `containers` - Set of objects with each container image created and stored in the output repository.
+        * `imageUris` - Set of URIs for created containers.
+        * `region` - Region of the container image.
+* `tags` - Key-value map of resource tags for the image.
+* `version` - Version of the image.
+
+<!-- cache-key: cdktf-0.18.0 input-c16581cc1f73d4143d3834e3f16be4e4ace35e8a4c70a0907ae9057adf65efee -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/imagebuilder_image_pipeline.html.markdown b/website/docs/cdktf/typescript/d/imagebuilder_image_pipeline.html.markdown
new file mode 100644
index 00000000000..b4925ca46ec
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/imagebuilder_image_pipeline.html.markdown
@@ -0,0 +1,71 @@
+---
+subcategory: "EC2 Image Builder"
+layout: "aws"
+page_title: "AWS: aws_imagebuilder_image_pipeline"
+description: |-
+    Provides details about an Image Builder Image Pipeline
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_imagebuilder_image_pipeline
+
+Provides details about an Image Builder Image Pipeline.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsImagebuilderImagePipeline } from "./.gen/providers/aws/data-aws-imagebuilder-image-pipeline";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsImagebuilderImagePipeline(this, "example", {
+      arn: "arn:aws:imagebuilder:us-west-2:aws:image-pipeline/example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `arn` - (Required) ARN of the image pipeline.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `containerRecipeArn` - ARN of the container recipe.
+* `dateCreated` - Date the image pipeline was created.
+* `dateLastRun` - Date the image pipeline was last run.
+* `dateNextRun` - Date the image pipeline will run next.
+* `dateUpdated` - Date the image pipeline was updated.
+* `description` - Description of the image pipeline.
+* `distributionConfigurationArn` - ARN of the Image Builder Distribution Configuration.
+* `enhancedImageMetadataEnabled` - Whether additional information about the image being created is collected.
+* `imageRecipeArn` - ARN of the image recipe.
+* `imageTestsConfiguration` - List of an object with image scanning configuration.
+    * `imageScanningEnabled`  - Whether image scanning is enabled.
+    * `ecrConfiguration`  - List if an object with ecr configuration for image scanning
+        * `containerTags`  - Tags that are added to the output containers that are scanned
+        * `repositoryName`  - The name of the container repository that Amazon Inspector scans
+* `imageTestsConfiguration` - List of an object with image tests configuration.
+    * `imageTestsEnabled` - Whether image tests are enabled.
+    * `timeoutMinutes` - Number of minutes before image tests time out.
+* `infrastructureConfigurationArn` - ARN of the Image Builder Infrastructure Configuration.
+* `name` - Name of the image pipeline.
+* `platform` - Platform of the image pipeline.
+* `schedule` - List of an object with schedule settings.
+    * `pipelineExecutionStartCondition` - Condition when the pipeline should trigger a new image build.
+    * `scheduleExpression` - Cron expression of how often the pipeline start condition is evaluated.
+* `status` - Status of the image pipeline.
+* `tags` - Key-value map of resource tags for the image pipeline.
+
+<!-- cache-key: cdktf-0.18.0 input-86d00bfacbf8211ac391b618aacd3783f3887b1dc59f3fa49b15ed84f7aa629d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/imagebuilder_image_pipelines.html.markdown b/website/docs/cdktf/typescript/d/imagebuilder_image_pipelines.html.markdown
new file mode 100644
index 00000000000..37e0d1aa460
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/imagebuilder_image_pipelines.html.markdown
@@ -0,0 +1,60 @@
+---
+subcategory: "EC2 Image Builder"
+layout: "aws"
+page_title: "AWS: aws_imagebuilder_image_pipelines"
+description: |-
+    Get information on Image Builder Image Pipelines.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_imagebuilder_image_pipelines
+
+Use this data source to get the ARNs and names of Image Builder Image Pipelines matching the specified criteria.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsImagebuilderImagePipelines } from "./.gen/providers/aws/data-aws-imagebuilder-image-pipelines";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsImagebuilderImagePipelines(this, "example", {
+      filter: [
+        {
+          name: "name",
+          values: ["example"],
+        },
+      ],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `filter` - (Optional) Configuration block(s) for filtering. Detailed below.
+
+### filter Configuration Block
+
+The `filter` configuration block supports the following arguments:
+
+* `name` - (Required) Name of the filter field. Valid values can be found in the [Image Builder ListImagePipelines API Reference](https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_ListImagePipelines.html).
+* `values` - (Required) Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arns` - Set of ARNs of the matched Image Builder Image Pipelines.
+* `names` - Set of names of the matched Image Builder Image Pipelines.
+
+<!-- cache-key: cdktf-0.18.0 input-9aa1a817b341dd2fe9ffacd11d32c26b3c20e350b371b04907e37c56aa311d03 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/imagebuilder_image_recipe.html.markdown b/website/docs/cdktf/typescript/d/imagebuilder_image_recipe.html.markdown
new file mode 100644
index 00000000000..fe67be88c13
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/imagebuilder_image_recipe.html.markdown
@@ -0,0 +1,76 @@
+---
+subcategory: "EC2 Image Builder"
+layout: "aws"
+page_title: "AWS: aws_imagebuilder_image_recipe"
+description: |-
+    Provides details about an Image Builder Image Recipe
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_imagebuilder_image_recipe
+
+Provides details about an Image Builder Image Recipe.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsImagebuilderImageRecipe } from "./.gen/providers/aws/data-aws-imagebuilder-image-recipe";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsImagebuilderImageRecipe(this, "example", {
+      arn: "arn:aws:imagebuilder:us-east-1:aws:image-recipe/example/1.0.0",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `arn` - (Required) ARN of the image recipe.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `blockDeviceMapping` - Set of objects with block device mappings for the image recipe.
+    * `deviceName` - Name of the device. For example, `/dev/sda` or `/dev/xvdb`.
+    * `ebs` - Single list of object with Elastic Block Storage (EBS) block device mapping settings.
+        * `deleteOnTermination` - Whether to delete the volume on termination. Defaults to unset, which is the value inherited from the parent image.
+        * `encrypted` - Whether to encrypt the volume. Defaults to unset, which is the value inherited from the parent image.
+        * `iops` - Number of Input/Output (I/O) operations per second to provision for an `io1` or `io2` volume.
+        * `kmsKeyId` - ARN of the Key Management Service (KMS) Key for encryption.
+        * `snapshotId` - Identifier of the EC2 Volume Snapshot.
+        * `throughput` - For GP3 volumes only. The throughput in MiB/s that the volume supports.
+        * `volumeSize` - Size of the volume, in GiB.
+        * `volumeType` - Type of the volume. For example, `gp2` or `io2`.
+    * `noDevice` - Whether to remove a mapping from the parent image.
+    * `virtualName` - Virtual device name. For example, `ephemeral0`. Instance store volumes are numbered starting from 0.
+* `component` - List of objects with components for the image recipe.
+    * `componentArn` - ARN of the Image Builder Component.
+    * `parameter` - Set of parameters that are used to configure the component.
+        * `name` - Name of the component parameter.
+        * `value` - Value of the component parameter.
+* `dateCreated` - Date the image recipe was created.
+* `description` - Description of the image recipe.
+* `name` - Name of the image recipe.
+* `owner` - Owner of the image recipe.
+* `parentImage` - Base image of the image recipe.
+* `platform` - Platform of the image recipe.
+* `tags` - Key-value map of resource tags for the image recipe.
+* `userDataBase64` - Base64 encoded contents of user data. Commands or a command script to run when build instance is launched.
+* `version` - Version of the image recipe.
+* `workingDirectory` - Working directory used during build and test workflows.
+
+<!-- cache-key: cdktf-0.18.0 input-03811fbdc954ff54a22086b82658d8b2b187a94c5c0090a064a40b03c615a004 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/imagebuilder_image_recipes.html.markdown b/website/docs/cdktf/typescript/d/imagebuilder_image_recipes.html.markdown
new file mode 100644
index 00000000000..d13c5fe921c
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/imagebuilder_image_recipes.html.markdown
@@ -0,0 +1,62 @@
+---
+subcategory: "EC2 Image Builder"
+layout: "aws"
+page_title: "AWS: aws_imagebuilder_image_recipes"
+description: |-
+    Get information on Image Builder Image Recipes.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_imagebuilder_image_recipes
+
+Use this data source to get the ARNs and names of Image Builder Image Recipes matching the specified criteria.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsImagebuilderImageRecipes } from "./.gen/providers/aws/data-aws-imagebuilder-image-recipes";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsImagebuilderImageRecipes(this, "example", {
+      filter: [
+        {
+          name: "platform",
+          values: ["Linux"],
+        },
+      ],
+      owner: "Self",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `owner` - (Optional) Owner of the image recipes. Valid values are `self`, `shared` and `amazon`. Defaults to `self`.
+* `filter` - (Optional) Configuration block(s) for filtering. Detailed below.
+
+### filter Configuration Block
+
+The `filter` configuration block supports the following arguments:
+
+* `name` - (Required) Name of the filter field. Valid values can be found in the [Image Builder ListImageRecipes API Reference](https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_ListImageRecipes.html).
+* `values` - (Required) Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arns` - Set of ARNs of the matched Image Builder Image Recipes.
+* `names` - Set of names of the matched Image Builder Image Recipes.
+
+<!-- cache-key: cdktf-0.18.0 input-04bcd0a54deab227cba64be4a5e7a163ec84c3bcb003ab2dd8917c78ca18178b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/imagebuilder_infrastructure_configuration.html.markdown b/website/docs/cdktf/typescript/d/imagebuilder_infrastructure_configuration.html.markdown
new file mode 100644
index 00000000000..477ee96053d
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/imagebuilder_infrastructure_configuration.html.markdown
@@ -0,0 +1,68 @@
+---
+subcategory: "EC2 Image Builder"
+layout: "aws"
+page_title: "AWS: aws_imagebuilder_infrastructure_configuration"
+description: |-
+    Provides details about an Image Builder Infrastructure Configuration
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_imagebuilder_infrastructure_configuration
+
+Provides details about an Image Builder Infrastructure Configuration.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsImagebuilderInfrastructureConfiguration } from "./.gen/providers/aws/data-aws-imagebuilder-infrastructure-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsImagebuilderInfrastructureConfiguration(this, "example", {
+      arn: "arn:aws:imagebuilder:us-west-2:aws:infrastructure-configuration/example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `arn` - (Required) ARN of the infrastructure configuration.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `dateCreated` - Date the infrastructure configuration was created.
+* `dateCreated` - Date the infrastructure configuration was updated.
+* `description` - Description of the infrastructure configuration.
+* `instanceMetadataOptions` - Nested list of instance metadata options for the HTTP requests that pipeline builds use to launch EC2 build and test instances.
+    * `httpPutResponseHopLimit` - Number of hops that an instance can traverse to reach its destonation.
+    * `httpTokens` - Whether a signed token is required for instance metadata retrieval requests.
+* `instanceProfileName` - Name of the IAM Instance Profile associated with the configuration.
+* `instanceTypes` - Set of EC2 Instance Types associated with the configuration.
+* `keyPair` - Name of the EC2 Key Pair associated with the configuration.
+* `logging` - Nested list of logging settings.
+    * `s3Logs` - Nested list of S3 logs settings.
+        * `s3BucketName` - Name of the S3 Bucket for logging.
+        * `s3KeyPrefix` - Key prefix for S3 Bucket logging.
+* `name` - Name of the infrastructure configuration.
+* `resourceTags` - Key-value map of resource tags for the infrastructure created by the infrastructure configuration.
+* `securityGroupIds` - Set of EC2 Security Group identifiers associated with the configuration.
+* `snsTopicArn` - ARN of the SNS Topic associated with the configuration.
+* `subnetId` - Identifier of the EC2 Subnet associated with the configuration.
+* `tags` - Key-value map of resource tags for the infrastructure configuration.
+* `terminateInstanceOnFailure` - Whether instances are terminated on failure.
+
+<!-- cache-key: cdktf-0.18.0 input-7380cb5d85c6d7849e3a07a0e4591a1b51c24389729b623e1b3ca40a6eea581e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/imagebuilder_infrastructure_configurations.html.markdown b/website/docs/cdktf/typescript/d/imagebuilder_infrastructure_configurations.html.markdown
new file mode 100644
index 00000000000..8a2e98d07e9
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/imagebuilder_infrastructure_configurations.html.markdown
@@ -0,0 +1,60 @@
+---
+subcategory: "EC2 Image Builder"
+layout: "aws"
+page_title: "AWS: aws_imagebuilder_infrastructure_configurations"
+description: |-
+    Get information on Image Builder Infrastructure Configurations.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_imagebuilder_infrastructure_configurations
+
+Use this data source to get the ARNs and names of Image Builder Infrastructure Configurations matching the specified criteria.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsImagebuilderInfrastructureConfigurations } from "./.gen/providers/aws/data-aws-imagebuilder-infrastructure-configurations";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsImagebuilderInfrastructureConfigurations(this, "example", {
+      filter: [
+        {
+          name: "name",
+          values: ["example"],
+        },
+      ],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `filter` - (Optional) Configuration block(s) for filtering. Detailed below.
+
+## filter Configuration Block
+
+The `filter` configuration block supports the following arguments:
+
+* `name` - (Required) Name of the filter field. Valid values can be found in the [Image Builder ListInfrastructureConfigurations API Reference](https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_ListInfrastructureConfigurations.html).
+* `values` - (Required) Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arns` - Set of ARNs of the matched Image Builder Infrastructure Configurations.
+* `names` - Set of names of the matched Image Builder Infrastructure Configurations.
+
+<!-- cache-key: cdktf-0.18.0 input-83d3086f6077a26f6422506516e6b719a5fbe82fb8b50beb21985166498185d9 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/inspector_rules_packages.html.markdown b/website/docs/cdktf/typescript/d/inspector_rules_packages.html.markdown
new file mode 100644
index 00000000000..0d620c5cf22
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/inspector_rules_packages.html.markdown
@@ -0,0 +1,65 @@
+---
+subcategory: "Inspector Classic"
+layout: "aws"
+page_title: "AWS: aws_inspector_rules_packages"
+description: |-
+    Provides a list of Amazon Inspector Classic Rules packages which can be used by Amazon Inspector Classic.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_inspector_rules_packages
+
+The Amazon Inspector Classic Rules Packages data source allows access to the list of AWS
+Inspector Rules Packages which can be used by Amazon Inspector Classic within the region
+configured in the provider.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsInspectorRulesPackages } from "./.gen/providers/aws/data-aws-inspector-rules-packages";
+import { InspectorAssessmentTarget } from "./.gen/providers/aws/inspector-assessment-target";
+import { InspectorAssessmentTemplate } from "./.gen/providers/aws/inspector-assessment-template";
+import { InspectorResourceGroup } from "./.gen/providers/aws/inspector-resource-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const group = new InspectorResourceGroup(this, "group", {
+      tags: {
+        test: "test",
+      },
+    });
+    const rules = new DataAwsInspectorRulesPackages(this, "rules", {});
+    const assessment = new InspectorAssessmentTarget(this, "assessment", {
+      name: "test",
+      resourceGroupArn: group.arn,
+    });
+    const awsInspectorAssessmentTemplateAssessment =
+      new InspectorAssessmentTemplate(this, "assessment_3", {
+        duration: Token.asNumber("60"),
+        name: "Test",
+        rulesPackageArns: Token.asList(rules.arns),
+        targetArn: assessment.arn,
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsInspectorAssessmentTemplateAssessment.overrideLogicalId("assessment");
+  }
+}
+
+```
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - AWS Region.
+* `arns` - List of the Amazon Inspector Classic Rules Packages arns available in the AWS region.
+
+<!-- cache-key: cdktf-0.18.0 input-b55f49ddc9bd6ffd45988906833e0338e052589bc49023e7487f89772927ed30 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/instance.html.markdown b/website/docs/cdktf/typescript/d/instance.html.markdown
new file mode 100644
index 00000000000..3b587370b12
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/instance.html.markdown
@@ -0,0 +1,156 @@
+---
+subcategory: "EC2 (Elastic Compute Cloud)"
+layout: "aws"
+page_title: "AWS: aws_instance"
+description: |-
+  Get information on an Amazon EC2 Instance.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_instance
+
+Use this data source to get the ID of an Amazon EC2 Instance for use in other resources.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsInstance } from "./.gen/providers/aws/data-aws-instance";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsInstance(this, "foo", {
+      filter: [
+        {
+          name: "image-id",
+          values: ["ami-xxxxxxxx"],
+        },
+        {
+          name: "tag:Name",
+          values: ["instance-name-tag"],
+        },
+      ],
+      instanceId: "i-instanceid",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `instanceId` - (Optional) Specify the exact Instance ID with which to populate the data source.
+
+* `instanceTags` - (Optional) Map of tags, each pair of which must
+exactly match a pair on the desired Instance.
+
+* `filter` - (Optional) One or more name/value pairs to use as filters. There are
+several valid keys, for a full reference, check out
+[describe-instances in the AWS CLI reference][1].
+
+* `getPasswordData` - (Optional) If true, wait for password data to become available and retrieve it. Useful for getting the administrator password for instances running Microsoft Windows. The password data is exported to the `passwordData` attribute. See [GetPasswordData](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_GetPasswordData.html) for more information.
+
+* `getUserData` - (Optional) Retrieve Base64 encoded User Data contents into the `userDataBase64` attribute. A SHA-1 hash of the User Data contents will always be present in the `userData` attribute. Defaults to `false`.
+
+~> **NOTE:** At least one of `filter`, `instanceTags`, or `instanceId` must be specified.
+
+~> **NOTE:** If anything other than a single match is returned by the search,
+Terraform will fail. Ensure that your search is specific enough to return
+a single Instance ID only.
+
+## Attribute Reference
+
+`id` is set to the ID of the found Instance. In addition, the following attributes
+are exported:
+
+~> **NOTE:** Some values are not always set and may not be available for
+interpolation.
+
+* `ami` - ID of the AMI used to launch the instance.
+* `arn` - ARN of the instance.
+* `associatePublicIpAddress` - Whether or not the Instance is associated with a public IP address or not (Boolean).
+* `availabilityZone` - Availability zone of the Instance.
+* `creditSpecification` - Credit specification of the Instance.
+* `disableApiStop` - Whether or not EC2 Instance Stop Protection](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Stop_Start.html#Using_StopProtection) is enabled (Boolean).
+* `disableApiTermination` - Whether or not [EC2 Instance Termination Protection](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/terminating-instances.html#Using_ChangingDisableAPITermination) is enabled (Boolean).
+* `ebsBlockDevice` - EBS block device mappings of the Instance.
+    * `deleteOnTermination` - If the EBS volume will be deleted on termination.
+    * `deviceName` - Physical name of the device.
+    * `encrypted` - If the EBS volume is encrypted.
+    * `iops` - `0` If the EBS volume is not a provisioned IOPS image, otherwise the supported IOPS count.
+    * `kmsKeyArn` - ARN of KMS Key, if EBS volume is encrypted.
+    * `snapshotId` - ID of the snapshot.
+    * `throughput` - Throughput of the volume, in MiB/s.
+    * `volumeSize` - Size of the volume, in GiB.
+    * `volumeType` - Volume type.
+* `ebsOptimized` - Whether the Instance is EBS optimized or not (Boolean).
+* `enclaveOptions` - Enclave options of the instance.
+    * `enabled` - Whether Nitro Enclaves are enabled.
+* `ephemeralBlockDevice` - Ephemeral block device mappings of the Instance.
+    * `deviceName` - Physical name of the device.
+    * `noDevice` - Whether the specified device included in the device mapping was suppressed or not (Boolean).
+    * `virtualName` - Virtual device name.
+* `hostId` - ID of the dedicated host the instance will be assigned to.
+* `hostResourceGroupArn` - ARN of the host resource group the instance is associated with.
+* `iamInstanceProfile` - Name of the instance profile associated with the Instance.
+* `instanceState` - State of the instance. One of: `pending`, `running`, `shuttingDown`, `terminated`, `stopping`, `stopped`. See [Instance Lifecycle](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-lifecycle.html) for more information.
+* `instanceType` - Type of the Instance.
+* `ipv6Addresses` - IPv6 addresses associated to the Instance, if applicable. **NOTE**: Unlike the IPv4 address, this doesn't change if you attach an EIP to the instance.
+* `keyName` - Key name of the Instance.
+* `maintenanceOptions` - Maintenance and recovery options for the instance.
+    * `autoRecovery` - Automatic recovery behavior of the instance.
+* `metadataOptions` - Metadata options of the Instance.
+    * `httpEndpoint` - State of the metadata service: `enabled`, `disabled`.
+    * `httpProtocolIpv6` - Whether the IPv6 endpoint for the instance metadata service is `enabled` or `disabled`
+    * `httpTokens` - If session tokens are required: `optional`, `required`.
+    * `httpPutResponseHopLimit` - Desired HTTP PUT response hop limit for instance metadata requests.
+    * `instanceMetadataTags` - If access to instance tags is allowed from the metadata service: `enabled`, `disabled`.
+* `monitoring` - Whether detailed monitoring is enabled or disabled for the Instance (Boolean).
+* `networkInterfaceId` - ID of the network interface that was created with the Instance.
+* `outpostArn` - ARN of the Outpost.
+* `passwordData` - Base-64 encoded encrypted password data for the instance. Useful for getting the administrator password for instances running Microsoft Windows. This attribute is only exported if `getPasswordData` is true. See [GetPasswordData](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_GetPasswordData.html) for more information.
+* `placementGroup` - Placement group of the Instance.
+* `placementPartitionNumber` - Number of the partition the instance is in.
+* `privateDns` - Private DNS name assigned to the Instance. Can only be used inside the Amazon EC2, and only available if you've enabled DNS hostnames for your VPC.
+* `privateDnsNameOptions` - Options for the instance hostname.
+    * `enableResourceNameDnsAaaaRecord` - Indicates whether to respond to DNS queries for instance hostnames with DNS AAAA records.
+    * `enableResourceNameDnsARecord` - Indicates whether to respond to DNS queries for instance hostnames with DNS A records.
+    * `hostnameType` - Type of hostname for EC2 instances.
+* `privateIp` - Private IP address assigned to the Instance.
+* `publicDns` - Public DNS name assigned to the Instance. For EC2-VPC, this is only available if you've enabled DNS hostnames for your VPC.
+* `publicIp` - Public IP address assigned to the Instance, if applicable. **NOTE**: If you are using an [`awsEip`](/docs/providers/aws/r/eip.html) with your instance, you should refer to the EIP's address directly and not use `publicIp`, as this field will change after the EIP is attached.
+* `rootBlockDevice` - Root block device mappings of the Instance
+    * `deviceName` - Physical name of the device.
+    * `deleteOnTermination` - If the root block device will be deleted on termination.
+    * `encrypted` - If the EBS volume is encrypted.
+    * `iops` - `0` If the volume is not a provisioned IOPS image, otherwise the supported IOPS count.
+    * `kmsKeyArn` - ARN of KMS Key, if EBS volume is encrypted.
+    * `throughput` - Throughput of the volume, in MiB/s.
+    * `volumeSize` - Size of the volume, in GiB.
+    * `volumeType` - Type of the volume.
+* `secondaryPrivateIps` - Secondary private IPv4 addresses assigned to the instance's primary network interface (eth0) in a VPC.
+* `securityGroups` - Associated security groups.
+* `sourceDestCheck` - Whether the network interface performs source/destination checking (Boolean).
+* `subnetId` - VPC subnet ID.
+* `tags` - Map of tags assigned to the Instance.
+* `tenancy` - Tenancy of the instance: `dedicated`, `default`, `host`.
+* `userData` - SHA-1 hash of User Data supplied to the Instance.
+* `userDataBase64` - Base64 encoded contents of User Data supplied to the Instance. Valid UTF-8 contents can be decoded with the [`base64Decode` function](https://www.terraform.io/docs/configuration/functions/base64decode.html). This attribute is only exported if `getUserData` is true.
+* `vpcSecurityGroupIds` - Associated security groups in a non-default VPC.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `20M`)
+
+[1]: http://docs.aws.amazon.com/cli/latest/reference/ec2/describe-instances.html
+
+<!-- cache-key: cdktf-0.18.0 input-58a6dcf6b973aceef047b6a5f4da20044aa0391cf4a6935de6e8bdc7dc78ba4c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/instances.html.markdown b/website/docs/cdktf/typescript/d/instances.html.markdown
new file mode 100644
index 00000000000..d270b1ceb89
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/instances.html.markdown
@@ -0,0 +1,98 @@
+---
+subcategory: "EC2 (Elastic Compute Cloud)"
+layout: "aws"
+page_title: "AWS: aws_instances"
+description: |-
+  Get information on an Amazon EC2 instances.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_instances
+
+Use this data source to get IDs or IPs of Amazon EC2 instances to be referenced elsewhere,
+e.g., to allow easier migration from another management solution
+or to make it easier for an operator to connect through bastion host(s).
+
+-> **Note:** It's a best practice to expose instance details via [outputs](https://www.terraform.io/docs/configuration/outputs.html)
+and [remote state](https://www.terraform.io/docs/state/remote.html) and
+**use [`terraformRemoteState`](https://www.terraform.io/docs/providers/terraform/d/remote_state.html)
+data source instead** if you manage referenced instances via Terraform.
+
+~> **Note:** It's strongly discouraged to use this data source for querying ephemeral
+instances (e.g., managed via autoscaling group), as the output may change at any time
+and you'd need to re-run `apply` every time an instance comes up or dies.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformCount, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsInstances } from "./.gen/providers/aws/data-aws-instances";
+import { Eip } from "./.gen/providers/aws/eip";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const test = new DataAwsInstances(this, "test", {
+      filter: [
+        {
+          name: "instance.group-id",
+          values: ["sg-12345678"],
+        },
+      ],
+      instanceStateNames: ["running", "stopped"],
+      instanceTags: {
+        Role: "HardWorker",
+      },
+    });
+    /*In most cases loops should be handled in the programming language context and 
+    not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+    you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+    you need to keep this like it is.*/
+    const testCount = TerraformCount.of(Token.asNumber(Fn.lengthOf(test.ids)));
+    const awsEipTest = new Eip(this, "test_1", {
+      instance: Token.asString(Fn.lookupNested(test.ids, [testCount.index])),
+      count: testCount,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsEipTest.overrideLogicalId("test");
+  }
+}
+
+```
+
+## Argument Reference
+
+* `instanceTags` - (Optional) Map of tags, each pair of which must
+exactly match a pair on desired instances.
+
+* `instanceStateNames` - (Optional) List of instance states that should be applicable to the desired instances. The permitted values are: `pending, running, shutting-down, stopped, stopping, terminated`. The default value is `running`.
+
+* `filter` - (Optional) One or more name/value pairs to use as filters. There are
+several valid keys, for a full reference, check out
+[describe-instances in the AWS CLI reference][1].
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - AWS Region.
+* `ids` - IDs of instances found through the filter
+* `privateIps` - Private IP addresses of instances found through the filter
+* `publicIps` - Public IP addresses of instances found through the filter
+* `ipv6Addresses` - IPv6 addresses of instances found through the filter
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `20M`)
+
+[1]: http://docs.aws.amazon.com/cli/latest/reference/ec2/describe-instances.html
+
+<!-- cache-key: cdktf-0.18.0 input-b32a570916ee4ab91b69b22089fb9eae9d1e369af64f851ec6954b99768d43fd -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/internet_gateway.html.markdown b/website/docs/cdktf/typescript/d/internet_gateway.html.markdown
new file mode 100644
index 00000000000..e7082808631
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/internet_gateway.html.markdown
@@ -0,0 +1,91 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_internet_gateway"
+description: |-
+    Provides details about a specific Internet Gateway
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_internet_gateway
+
+`awsInternetGateway` provides details about a specific Internet Gateway.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformVariable, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsInternetGateway } from "./.gen/providers/aws/data-aws-internet-gateway";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    /*Terraform Variables are not always the best fit for getting inputs in the context of Terraform CDK.
+    You can read more about this at https://cdk.tf/variables*/
+    const vpcId = new TerraformVariable(this, "vpc_id", {});
+    new DataAwsInternetGateway(this, "default", {
+      filter: [
+        {
+          name: "attachment.vpc-id",
+          values: [vpcId.stringValue],
+        },
+      ],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The arguments of this data source act as filters for querying the available
+Internet Gateway in the current region. The given filters must match exactly one
+Internet Gateway whose data will be exported as attributes.
+
+* `internetGatewayId` - (Optional) ID of the specific Internet Gateway to retrieve.
+
+* `tags` - (Optional) Map of tags, each pair of which must exactly match
+  a pair on the desired Internet Gateway.
+
+* `filter` - (Optional) Custom filter block as described below.
+
+More complex filters can be expressed using one or more `filter` sub-blocks,
+which take the following arguments:
+
+* `name` - (Required) Name of the field to filter by, as defined by
+  [the underlying AWS API](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeInternetGateways.html).
+
+* `values` - (Required) Set of values that are accepted for the given field.
+  An Internet Gateway will be selected if any one of the given values matches.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Internet Gateway.
+
+All of the argument attributes except `filter` block are also exported as
+result attributes. This data source will complete the data by populating
+any fields that are not included in the configuration with the data for
+the selected Internet Gateway.
+
+`attachments` are also exported with the following attributes, when there are relevants:
+Each attachment supports the following:
+
+* `ownerId` - ID of the AWS account that owns the internet gateway.
+* `state` - Current state of the attachment between the gateway and the VPC. Present only if a VPC is attached
+* `vpcId` - ID of an attached VPC.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `20M`)
+
+<!-- cache-key: cdktf-0.18.0 input-96bb0aae58e9cc1f5627406db250b52752c3ca32ef3d0817dccae2e569d8a45c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/iot_endpoint.html.markdown b/website/docs/cdktf/typescript/d/iot_endpoint.html.markdown
new file mode 100644
index 00000000000..2b9db1720e2
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/iot_endpoint.html.markdown
@@ -0,0 +1,76 @@
+---
+subcategory: "IoT Core"
+layout: "aws"
+page_title: "AWS: aws_iot_endpoint"
+description: |-
+  Get the unique IoT endpoint
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_iot_endpoint
+
+Returns a unique endpoint specific to the AWS account making the call.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIotEndpoint } from "./.gen/providers/aws/data-aws-iot-endpoint";
+import { Pod } from "./.gen/providers/kubernetes/pod";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    /*The following providers are missing schema information and might need manual adjustments to synthesize correctly: kubernetes.
+    For a more precise conversion please use the --provider flag in convert.*/
+    const example = new DataAwsIotEndpoint(this, "example", {});
+    new Pod(this, "agent", {
+      metadata: [
+        {
+          name: "my-device",
+        },
+      ],
+      spec: [
+        {
+          container: [
+            {
+              env: [
+                {
+                  name: "IOT_ENDPOINT",
+                  value: example.endpointAddress,
+                },
+              ],
+              image: "gcr.io/my-project/image-name",
+              name: "image-name",
+            },
+          ],
+        },
+      ],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `endpointType` - (Optional) Endpoint type. Valid values: `iot:credentialProvider`, `iot:data`, `iot:dataAts`, `iot:jobs`.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `endpointAddress` - Endpoint based on `endpointType`:
+    * No `endpointType`: Either `iot:data` or `iot:dataAts` [depending on region](https://aws.amazon.com/blogs/iot/aws-iot-core-ats-endpoints/)
+    * `iot:credentialsProvider`: `identifierCredentialsIotRegionAmazonawsCom`
+    * `iot:data`: `identifierIotRegionAmazonawsCom`
+    * `iot:dataAts`: `identifierAtsIotRegionAmazonawsCom`
+    * `iot:jobs`: `identifierJobsIotRegionAmazonawsCom`
+
+<!-- cache-key: cdktf-0.18.0 input-56c8383801b044a75be3c89aa515472690d24408a38b21081a32c8735b9a3414 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/ip_ranges.html.markdown b/website/docs/cdktf/typescript/d/ip_ranges.html.markdown
new file mode 100644
index 00000000000..36be9031d0d
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/ip_ranges.html.markdown
@@ -0,0 +1,85 @@
+---
+subcategory: "Meta Data Sources"
+layout: "aws"
+page_title: "AWS: aws_ip_ranges"
+description: |-
+  Get information on AWS IP ranges.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_ip_ranges
+
+Use this data source to get the IP ranges of various AWS products and services. For more information about the contents of this data source and required JSON syntax if referencing a custom URL, see the [AWS IP Address Ranges documentation][1].
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIpRanges } from "./.gen/providers/aws/data-aws-ip-ranges";
+import { SecurityGroup } from "./.gen/providers/aws/security-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const europeanEc2 = new DataAwsIpRanges(this, "european_ec2", {
+      regions: ["eu-west-1", "eu-central-1"],
+      services: ["ec2"],
+    });
+    new SecurityGroup(this, "from_europe", {
+      ingress: [
+        {
+          cidrBlocks: Token.asList(europeanEc2.cidrBlocks),
+          fromPort: Token.asNumber("443"),
+          ipv6CidrBlocks: Token.asList(europeanEc2.ipv6CidrBlocks),
+          protocol: "tcp",
+          toPort: Token.asNumber("443"),
+        },
+      ],
+      name: "from_europe",
+      tags: {
+        CreateDate: Token.asString(europeanEc2.createDate),
+        SyncToken: Token.asString(europeanEc2.syncToken),
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `regions` - (Optional) Filter IP ranges by regions (or include all regions, if
+omitted). Valid items are `global` (for `cloudfront`) as well as all AWS regions
+(e.g., `euCentral1`)
+
+* `services` - (Required) Filter IP ranges by services. Valid items are `amazon`
+(for amazon.com), `amazonConnect`, `apiGateway`, `cloud9`, `cloudfront`,
+`codebuild`, `dynamodb`, `ec2`, `ec2InstanceConnect`, `globalaccelerator`,
+`route53`, `route53Healthchecks`, `s3` and `workspacesGateways`. See the
+[`service` attribute][2] documentation for other possible values.
+
+~> **NOTE:** If the specified combination of regions and services does not yield any
+CIDR blocks, Terraform will fail.
+
+* `url` - (Optional) Custom URL for source JSON file. Syntax must match [AWS IP Address Ranges documentation][1]. Defaults to `https://ipRangesAmazonawsCom/ipRangesJson`.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `cidrBlocks` - Lexically ordered list of CIDR blocks.
+* `ipv6CidrBlocks` - Lexically ordered list of IPv6 CIDR blocks.
+* `createDate` - Publication time of the IP ranges (e.g., `20160803234605`).
+* `syncToken` - Publication time of the IP ranges, in Unix epoch time format
+  (e.g., `1470267965`).
+
+[1]: https://docs.aws.amazon.com/general/latest/gr/aws-ip-ranges.html
+[2]: https://docs.aws.amazon.com/general/latest/gr/aws-ip-ranges.html#aws-ip-syntax
+
+<!-- cache-key: cdktf-0.18.0 input-73d6997abbb59dd921b8bcd692995e1403416e2fa26a744feb3a7bbef5d83b63 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/ivs_stream_key.html.markdown b/website/docs/cdktf/typescript/d/ivs_stream_key.html.markdown
new file mode 100644
index 00000000000..36be127cd1b
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/ivs_stream_key.html.markdown
@@ -0,0 +1,53 @@
+---
+subcategory: "IVS (Interactive Video)"
+layout: "aws"
+page_title: "AWS: aws_ivs_stream_key"
+description: |-
+  Terraform data source for managing an AWS IVS (Interactive Video) Stream Key.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_ivs_stream_key
+
+Terraform data source for managing an AWS IVS (Interactive Video) Stream Key.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIvsStreamKey } from "./.gen/providers/aws/data-aws-ivs-stream-key";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsIvsStreamKey(this, "example", {
+      channelArn: "arn:aws:ivs:us-west-2:326937407773:channel/0Y1lcs4U7jk5",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `channelArn` - (Required) ARN of the Channel.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Stream Key.
+* `tags` - Map of tags assigned to the resource.
+* `value` - Stream Key value.
+
+<!-- cache-key: cdktf-0.18.0 input-07ea21d8ae54ff1a061e2ce5f7053d91f4807ee4e6b32e670b8c70e8582e5c98 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/kendra_experience.html.markdown b/website/docs/cdktf/typescript/d/kendra_experience.html.markdown
new file mode 100644
index 00000000000..420ceb2ec3d
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/kendra_experience.html.markdown
@@ -0,0 +1,81 @@
+---
+subcategory: "Kendra"
+layout: "aws"
+page_title: "AWS: aws_kendra_experience"
+description: |-
+  Provides details about a specific Amazon Kendra Experience.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_kendra_experience
+
+Provides details about a specific Amazon Kendra Experience.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsKendraExperience } from "./.gen/providers/aws/data-aws-kendra-experience";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsKendraExperience(this, "example", {
+      experienceId: "87654321-1234-4321-4321-321987654321",
+      indexId: "12345678-1234-1234-1234-123456789123",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `experienceId` - (Required) Identifier of the Experience.
+* `indexId` - (Required) Identifier of the index that contains the Experience.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Experience.
+* `configuration` - Block that specifies the configuration information for your Amazon Kendra Experience. This includes `contentSourceConfiguration`, which specifies the data source IDs and/or FAQ IDs, and `userIdentityConfiguration`, which specifies the user or group information to grant access to your Amazon Kendra Experience. Documented below.
+* `createdAt` - Unix datetime that the Experience was created.
+* `description` - Description of the Experience.
+* `endpoints` - Shows the endpoint URLs for your Amazon Kendra Experiences. The URLs are unique and fully hosted by AWS. Documented below.
+* `errorMessage` - Reason your Amazon Kendra Experience could not properly process.
+* `id` - Unique identifiers of the Experience and index separated by a slash (`/`).
+* `name` - Name of the Experience.
+* `roleArn` - Shows the ARN of a role with permission to access `query` API, `querySuggestions` API, `submitFeedback` API, and AWS SSO that stores your user and group information.
+* `status` - Current processing status of your Amazon Kendra Experience. When the status is `active`, your Amazon Kendra Experience is ready to use. When the status is `failed`, the `errorMessage` field contains the reason that this failed.
+* `updatedAt` - Date and time that the Experience was last updated.
+
+The `configuration` block supports the following attributes:
+
+* `contentSourceConfiguration` - The identifiers of your data sources and FAQs. This is the content you want to use for your Amazon Kendra Experience. Documented below.
+* `userIdentityConfiguration` - The AWS SSO field name that contains the identifiers of your users, such as their emails. Documented below.
+
+The `contentSourceConfiguration` block supports the following attributes:
+
+* `dataSourceIds` - Identifiers of the data sources you want to use for your Amazon Kendra Experience.
+* `directPutContent` - Whether to use documents you indexed directly using the `BatchPutDocument API`.
+* `faqIds` - Identifier of the FAQs that you want to use for your Amazon Kendra Experience.
+
+The `userIdentityConfiguration` block supports the following attributes:
+
+* `identityAttributeName` - The AWS SSO field name that contains the identifiers of your users, such as their emails.
+
+The `endpoints` block supports the following attributes:
+
+* `endpoint` - Endpoint of your Amazon Kendra Experience.
+* `endpointType` - Type of endpoint for your Amazon Kendra Experience.
+
+<!-- cache-key: cdktf-0.18.0 input-f5305d893052c413022095c12ac4f6b75a23e499dbe8ec02edd79a5c7abd6c01 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/kendra_faq.html.markdown b/website/docs/cdktf/typescript/d/kendra_faq.html.markdown
new file mode 100644
index 00000000000..ea8bb412a3c
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/kendra_faq.html.markdown
@@ -0,0 +1,68 @@
+---
+subcategory: "Kendra"
+layout: "aws"
+page_title: "AWS: aws_kendra_faq"
+description: |-
+  Provides details about a specific Amazon Kendra Faq.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_kendra_faq
+
+Provides details about a specific Amazon Kendra Faq.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsKendraFaq } from "./.gen/providers/aws/data-aws-kendra-faq";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsKendraFaq(this, "test", {
+      faqId: "87654321-1234-4321-4321-321987654321",
+      indexId: "12345678-1234-1234-1234-123456789123",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `faqId` - (Required) Identifier of the FAQ.
+* `indexId` - (Required) Identifier of the index that contains the FAQ.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the FAQ.
+* `createdAt` - Unix datetime that the faq was created.
+* `description` - Description of the FAQ.
+* `errorMessage` - When the `status` field value is `failed`, this contains a message that explains why.
+* `fileFormat` - File format used by the input files for the FAQ. Valid Values are `csv`, `csvWithHeader`, `json`.
+* `id` - Unique identifiers of the FAQ and index separated by a slash (`/`).
+* `languageCode` - Code for a language. This shows a supported language for the FAQ document. For more information on supported languages, including their codes, see [Adding documents in languages other than English](https://docs.aws.amazon.com/kendra/latest/dg/in-adding-languages.html).
+* `name` - Name of the FAQ.
+* `roleArn` - ARN of a role with permission to access the S3 bucket that contains the FAQs. For more information, see [IAM Roles for Amazon Kendra](https://docs.aws.amazon.com/kendra/latest/dg/iam-roles.html).
+* `s3Path` - S3 location of the FAQ input data. Detailed below.
+* `status` - Status of the FAQ. It is ready to use when the status is ACTIVE.
+* `updatedAt` - Date and time that the FAQ was last updated.
+* `tags` - Metadata that helps organize the FAQs you create.
+
+The `s3Path` configuration block supports the following attributes:
+
+* `bucket` - Name of the S3 bucket that contains the file.
+* `key` - Name of the file.
+
+<!-- cache-key: cdktf-0.18.0 input-e521c2de099004f9800122d251b7adbf8d33a85b59c414cf1d1afcea0967b75a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/kendra_index.html.markdown b/website/docs/cdktf/typescript/d/kendra_index.html.markdown
new file mode 100644
index 00000000000..171897a7112
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/kendra_index.html.markdown
@@ -0,0 +1,135 @@
+---
+subcategory: "Kendra"
+layout: "aws"
+page_title: "AWS: aws_kendra_index"
+description: |-
+  Provides details about a specific Amazon Kendra Index.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_kendra_index
+
+Provides details about a specific Amazon Kendra Index.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsKendraIndex } from "./.gen/providers/aws/data-aws-kendra-index";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsKendraIndex(this, "example", {
+      id: "12345678-1234-1234-1234-123456789123",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `id` - (Required) Returns information on a specific Index by id.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Index.
+* `capacityUnits` - Block that sets the number of additional document storage and query capacity units that should be used by the index. Documented below.
+* `createdAt` - Unix datetime that the index was created.
+* `description` - Description of the Index.
+* `documentMetadataConfigurationUpdates` - One or more blocks that specify the configuration settings for any metadata applied to the documents in the index. Documented below.
+* `edition` - Amazon Kendra edition for the index.
+* `errorMessage` - When the Status field value is `failed`, this contains a message that explains why.
+* `id` - Identifier of the Index.
+* `indexStatistics` - Block that provides information about the number of FAQ questions and answers and the number of text documents indexed. Documented below.
+* `name` - Name of the Index.
+* `roleArn` - An AWS Identity and Access Management (IAM) role that gives Amazon Kendra permissions to access your Amazon CloudWatch logs and metrics. This is also the role you use when you call the `batchPutDocument` API to index documents from an Amazon S3 bucket.
+* `serverSideEncryptionConfiguration` - A block that specifies the identifier of the AWS KMS customer managed key (CMK) that's used to encrypt data indexed by Amazon Kendra. Amazon Kendra doesn't support asymmetric CMKs. Documented below.
+* `status` - Current status of the index. When the value is `active`, the index is ready for use. If the Status field value is `failed`, the `errorMessage` field contains a message that explains why.
+* `updatedAt` - Unix datetime that the index was last updated.
+* `userContextPolicy` - User context policy. Valid values are `attributeFilter` or `userToken`. For more information, refer to [UserContextPolicy](https://docs.aws.amazon.com/kendra/latest/APIReference/API_CreateIndex.html#kendra-CreateIndex-request-UserContextPolicy).
+* `userGroupResolutionConfiguration` - A block that enables fetching access levels of groups and users from an AWS Single Sign-On identity source. Documented below.
+* `userTokenConfigurations` - A block that specifies the user token configuration. Documented below.
+* `tags` - Metadata that helps organize the Indices you create.
+
+A `capacityUnits` block supports the following attributes:
+
+* `queryCapacityUnits` - The amount of extra query capacity for an index and GetQuerySuggestions capacity. For more information, refer to [QueryCapacityUnits](https://docs.aws.amazon.com/kendra/latest/APIReference/API_CapacityUnitsConfiguration.html#Kendra-Type-CapacityUnitsConfiguration-QueryCapacityUnits).
+* `storageCapacityUnits` - The amount of extra storage capacity for an index. A single capacity unit provides 30 GB of storage space or 100,000 documents, whichever is reached first. Minimum value of 0.
+
+A `documentMetadataConfigurationUpdates` block supports the following attributes:
+
+* `name` - Name of the index field. Minimum length of 1. Maximum length of 30.
+* `relevance` - Block that provides manual tuning parameters to determine how the field affects the search results. Documented below.
+* `search` - Block that provides information about how the field is used during a search. Documented below.
+* `type` - Data type of the index field. Valid values are `stringValue`, `stringListValue`, `longValue`, `dateValue`.
+
+A `relevance` block supports the following attributes:
+
+* `duration` - Time period that the boost applies to. For more information, refer to [Duration](https://docs.aws.amazon.com/kendra/latest/APIReference/API_Relevance.html#Kendra-Type-Relevance-Duration).
+* `freshness` - How "fresh" a document is. For more information, refer to [Freshness](https://docs.aws.amazon.com/kendra/latest/APIReference/API_Relevance.html#Kendra-Type-Relevance-Freshness).
+* `importance` - Relative importance of the field in the search. Larger numbers provide more of a boost than smaller numbers. Minimum value of 1. Maximum value of 10.
+* `rankOrder` - Determines how values should be interpreted. For more information, refer to [RankOrder](https://docs.aws.amazon.com/kendra/latest/APIReference/API_Relevance.html#Kendra-Type-Relevance-RankOrder).
+* `valuesImportanceMap` - A list of values that should be given a different boost when they appear in the result list. For more information, refer to [ValueImportanceMap](https://docs.aws.amazon.com/kendra/latest/APIReference/API_Relevance.html#Kendra-Type-Relevance-ValueImportanceMap).
+
+A `search` block supports the following attributes:
+
+* `displayable` - Determines whether the field is returned in the query response. The default is `true`.
+* `facetable` - Whether the field can be used to create search facets, a count of results for each value in the field. The default is `false`.
+* `searchable` - Determines whether the field is used in the search. If the Searchable field is true, you can use relevance tuning to manually tune how Amazon Kendra weights the field in the search. The default is `true` for `string` fields and `false` for `number` and `date` fields.
+* `sortable` - Determines whether the field can be used to sort the results of a query. If you specify sorting on a field that does not have Sortable set to true, Amazon Kendra returns an exception. The default is `false`.
+
+A `indexStatistics` block supports the following attributes:
+
+* `faqStatistics` - Block that specifies the number of question and answer topics in the index. Documented below.
+* `textDocumentStatistics` - A block that specifies the number of text documents indexed.
+
+A `faqStatistics` block supports the following attributes:
+
+* `indexedQuestionAnswersCount` - The total number of FAQ questions and answers contained in the index.
+
+A `textDocumentStatistics` block supports the following attributes:
+
+* `indexedTextBytes` - Total size, in bytes, of the indexed documents.
+* `indexedTextDocumentsCount` - The number of text documents indexed.
+
+A `serverSideEncryptionConfiguration` block supports the following attributes:
+
+* `kmsKeyId` - Identifier of the AWS KMScustomer master key (CMK). Amazon Kendra doesn't support asymmetric CMKs.
+
+A `userGroupResolutionConfiguration` block supports the following attributes:
+
+* `userGroupResolutionMode` - The identity store provider (mode) you want to use to fetch access levels of groups and users. AWS Single Sign-On is currently the only available mode. Your users and groups must exist in an AWS SSO identity source in order to use this mode. Valid Values are `awsSso` or `none`.
+
+A `userTokenConfigurations` block supports the following attributes:
+
+* `jsonTokenTypeConfiguration` - A block that specifies the information about the JSON token type configuration.
+* `jwtTokenTypeConfiguration` - A block that specifies the information about the JWT token type configuration.
+
+A `jsonTokenTypeConfiguration` block supports the following attributes:
+
+* `groupAttributeField` - The group attribute field.
+* `userNameAttributeField` - The user name attribute field.
+
+A `jwtTokenTypeConfiguration` block supports the following attributes:
+
+* `claimRegex` - Regular expression that identifies the claim.
+* `groupAttributeField` - The group attribute field.
+* `issuer` - Issuer of the token.
+* `keyLocation` - Location of the key. Valid values are `url` or `secretManager`
+* `secretsManagerArn` - ARN of the secret.
+* `url` - Signing key URL.
+* `userNameAttributeField` - The user name attribute field.
+
+<!-- cache-key: cdktf-0.18.0 input-e76a9b0bb218897eea66052e6f4809ec4cf76d678314db182219fa620bdbe4a4 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/kendra_query_suggestions_block_list.html.markdown b/website/docs/cdktf/typescript/d/kendra_query_suggestions_block_list.html.markdown
new file mode 100644
index 00000000000..c63d5e1fbc3
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/kendra_query_suggestions_block_list.html.markdown
@@ -0,0 +1,68 @@
+---
+subcategory: "Kendra"
+layout: "aws"
+page_title: "AWS: aws_kendra_query_suggestions_block_list"
+description: |-
+  Provides details about a specific Amazon Kendra block list used for query suggestions for an index.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_kendra_query_suggestions_block_list
+
+Provides details about a specific Amazon Kendra block list used for query suggestions for an index.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsKendraQuerySuggestionsBlockList } from "./.gen/providers/aws/data-aws-kendra-query-suggestions-block-list";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsKendraQuerySuggestionsBlockList(this, "example", {
+      indexId: "12345678-1234-1234-1234-123456789123",
+      querySuggestionsBlockListId: "87654321-1234-4321-4321-321987654321",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `indexId` - (Required) Identifier of the index that contains the block list.
+* `querySuggestionsBlockListId` - (Required) Identifier of the block list.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the block list.
+* `createdAt` - Date-time a block list was created.
+* `description` - Description for the block list.
+* `errorMessage` - Error message containing details if there are issues processing the block list.
+* `fileSizeBytes` - Current size of the block list text file in S3.
+* `id` - Unique identifiers of the block list and index separated by a slash (`/`).
+* `itemCount` - Current number of valid, non-empty words or phrases in the block list text file.
+* `name` - Name of the block list.
+* `roleArn` - ARN of a role with permission to access the S3 bucket that contains the block list. For more information, see [IAM Roles for Amazon Kendra](https://docs.aws.amazon.com/kendra/latest/dg/iam-roles.html).
+* `sourceS3Path` - S3 location of the block list input data. Detailed below.
+* `status` - Current status of the block list. When the value is `active`, the block list is ready for use.
+* `updatedAt` - Date and time that the block list was last updated.
+* `tags` - Metadata that helps organize the block list you create.
+
+The `sourceS3Path` configuration block supports the following attributes:
+
+* `bucket` - Name of the S3 bucket that contains the file.
+* `key` - Name of the file.
+
+<!-- cache-key: cdktf-0.18.0 input-58c35b9645175484541533f7e8f00ee84fdfe37d2326bf35c9f952899e44f7a6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/kendra_thesaurus.html.markdown b/website/docs/cdktf/typescript/d/kendra_thesaurus.html.markdown
new file mode 100644
index 00000000000..c9ed9b44ef6
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/kendra_thesaurus.html.markdown
@@ -0,0 +1,69 @@
+---
+subcategory: "Kendra"
+layout: "aws"
+page_title: "AWS: aws_kendra_thesaurus"
+description: |-
+  Provides details about a specific Amazon Kendra Thesaurus.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_kendra_thesaurus
+
+Provides details about a specific Amazon Kendra Thesaurus.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsKendraThesaurus } from "./.gen/providers/aws/data-aws-kendra-thesaurus";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsKendraThesaurus(this, "example", {
+      indexId: "12345678-1234-1234-1234-123456789123",
+      thesaurusId: "87654321-1234-4321-4321-321987654321",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `indexId` - (Required) Identifier of the index that contains the Thesaurus.
+* `thesaurusId` - (Required) Identifier of the Thesaurus.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Thesaurus.
+* `createdAt` - Unix datetime that the Thesaurus was created.
+* `description` - Description of the Thesaurus.
+* `errorMessage` - When the `status` field value is `failed`, this contains a message that explains why.
+* `fileSizeBytes` - Size of the Thesaurus file in bytes.
+* `id` - Unique identifiers of the Thesaurus and index separated by a slash (`/`).
+* `name` - Name of the Thesaurus.
+* `roleArn` - ARN of a role with permission to access the S3 bucket that contains the Thesaurus. For more information, see [IAM Roles for Amazon Kendra](https://docs.aws.amazon.com/kendra/latest/dg/iam-roles.html).
+* `sourceS3Path` - S3 location of the Thesaurus input data. Detailed below.
+* `status` - Status of the Thesaurus. It is ready to use when the status is `active`.
+* `synonymRuleCount` - Number of synonym rules in the Thesaurus file.
+* `termCount` - Number of unique terms in the Thesaurus file. For example, the synonyms `a,b,c` and `a=>d`, the term count would be 4.
+* `updatedAt` - Date and time that the Thesaurus was last updated.
+* `tags` - Metadata that helps organize the Thesaurus you create.
+
+The `sourceS3Path` configuration block supports the following attributes:
+
+* `bucket` - Name of the S3 bucket that contains the file.
+* `key` - Name of the file.
+
+<!-- cache-key: cdktf-0.18.0 input-29125b244608b6530d208362c4905e204c473f5f814e8bb91d9775dec645232b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/key_pair.html.markdown b/website/docs/cdktf/typescript/d/key_pair.html.markdown
new file mode 100644
index 00000000000..d38df9001ea
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/key_pair.html.markdown
@@ -0,0 +1,91 @@
+---
+subcategory: "EC2 (Elastic Compute Cloud)"
+layout: "aws"
+page_title: "AWS: aws_key_pair"
+description: |-
+    Provides details about a specific EC2 Key Pair.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_key_pair
+
+Use this data source to get information about a specific EC2 Key Pair.
+
+## Example Usage
+
+The following example shows how to get a EC2 Key Pair including the public key material from its name.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformOutput, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsKeyPair } from "./.gen/providers/aws/data-aws-key-pair";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new DataAwsKeyPair(this, "example", {
+      filter: [
+        {
+          name: "tag:Component",
+          values: ["web"],
+        },
+      ],
+      includePublicKey: true,
+      keyName: "test",
+    });
+    new TerraformOutput(this, "fingerprint", {
+      value: example.fingerprint,
+    });
+    new TerraformOutput(this, "id", {
+      value: example.id,
+    });
+    new TerraformOutput(this, "name", {
+      value: example.keyName,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The arguments of this data source act as filters for querying the available
+Key Pairs. The given filters must match exactly one Key Pair
+whose data will be exported as attributes.
+
+* `keyPairId` - (Optional) Key Pair ID.
+* `keyName` - (Optional) Key Pair name.
+* `includePublicKey` - (Optional) Whether to include the public key material in the response.
+* `filter` -  (Optional) Custom filter block as described below.
+
+### filter Configuration Block
+
+The `filter` configuration block supports the following arguments:
+
+* `name` - (Required) Name of the filter field. Valid values can be found in the [EC2 DescribeKeyPairs API Reference](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeKeyPairs.html).
+* `values` - (Required) Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the Key Pair.
+* `arn` - ARN of the Key Pair.
+* `createTime` - Timestamp for when the key pair was created in ISO 8601 format.
+* `fingerprint` - SHA-1 digest of the DER encoded private key.
+* `keyType` - Type of key pair.
+* `publicKey` - Public key material.
+* `tags` - Any tags assigned to the Key Pair.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `20M`)
+
+<!-- cache-key: cdktf-0.18.0 input-0d9f224b71bac4257ab9450b7b4225c2db875e803084b43d495dc85927c709ee -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/kinesis_firehose_delivery_stream.html.markdown b/website/docs/cdktf/typescript/d/kinesis_firehose_delivery_stream.html.markdown
new file mode 100644
index 00000000000..4966a3d5341
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/kinesis_firehose_delivery_stream.html.markdown
@@ -0,0 +1,52 @@
+---
+subcategory: "Kinesis Firehose"
+layout: "aws"
+page_title: "AWS: aws_kinesis_firehose_delivery_stream"
+description: |-
+  Provides an AWS Kinesis Firehose Delivery Stream data source.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_kinesis_firehose_delivery_stream
+
+Use this data source to get information about a Kinesis Firehose Delivery Stream for use in other resources.
+
+For more details, see the [Amazon Kinesis Firehose Documentation][1].
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsKinesisFirehoseDeliveryStream } from "./.gen/providers/aws/data-aws-kinesis-firehose-delivery-stream";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsKinesisFirehoseDeliveryStream(this, "stream", {
+      name: "stream-name",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `name` - (Required) Name of the Kinesis Stream.
+
+## Attribute Reference
+
+`id` is set to the ARN of the Kinesis Stream. In addition, the following attributes
+are exported:
+
+* `arn` - ARN of the Kinesis Stream (same as id).
+
+[1]: https://aws.amazon.com/documentation/firehose/
+
+<!-- cache-key: cdktf-0.18.0 input-1dd963295de26dc82ebe6970ff79c68f651a64142b5fe860bf5803000337b30e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/kinesis_stream.html.markdown b/website/docs/cdktf/typescript/d/kinesis_stream.html.markdown
new file mode 100644
index 00000000000..a8828c5f459
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/kinesis_stream.html.markdown
@@ -0,0 +1,69 @@
+---
+subcategory: "Kinesis"
+layout: "aws"
+page_title: "AWS: aws_kinesis_stream"
+description: |-
+  Provides a Kinesis Stream data source.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_kinesis_stream
+
+Use this data source to get information about a Kinesis Stream for use in other
+resources.
+
+For more details, see the [Amazon Kinesis Documentation][1].
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsKinesisStream } from "./.gen/providers/aws/data-aws-kinesis-stream";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsKinesisStream(this, "stream", {
+      name: "stream-name",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `name` - (Required) Name of the Kinesis Stream.
+
+## Attribute Reference
+
+`id` is set to the ARN of the Kinesis Stream. In addition, the following attributes
+are exported:
+
+* `arn` - ARN of the Kinesis Stream (same as id).
+* `name` - Name of the Kinesis Stream.
+* `creationTimestamp` - Approximate UNIX timestamp that the stream was created.
+* `status` - Current status of the stream. The stream status is one of CREATING, DELETING, ACTIVE, or UPDATING.
+* `retentionPeriod` - Length of time (in hours) data records are accessible after they are added to the stream.
+* `openShards` - List of shard ids in the OPEN state. See [Shard State][2] for more.
+* `closedShards` - List of shard ids in the CLOSED state. See [Shard State][2] for more.
+* `shardLevelMetrics` - List of shard-level CloudWatch metrics which are enabled for the stream. See [Monitoring with CloudWatch][3] for more.
+* `streamModeDetails` - [Capacity mode][4] of the data stream. Detailed below.
+* `tags` - Map of tags to assigned to the stream.
+
+### stream_mode_details Configuration Block
+
+* `streamMode` - Capacity mode of the stream. Either `onDemand` or `provisioned`.
+
+[1]: https://aws.amazon.com/documentation/kinesis/
+[2]: https://docs.aws.amazon.com/streams/latest/dev/kinesis-using-sdk-java-after-resharding.html#kinesis-using-sdk-java-resharding-data-routing
+[3]: https://docs.aws.amazon.com/streams/latest/dev/monitoring-with-cloudwatch.html
+[4]: https://docs.aws.amazon.com/streams/latest/dev/how-do-i-size-a-stream.html
+
+<!-- cache-key: cdktf-0.18.0 input-d035d44fea77906534614187920d80dfcb1210dd3b168e9a8322ca2eeaffb5f5 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/kinesis_stream_consumer.html.markdown b/website/docs/cdktf/typescript/d/kinesis_stream_consumer.html.markdown
new file mode 100644
index 00000000000..26aeb2621d3
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/kinesis_stream_consumer.html.markdown
@@ -0,0 +1,56 @@
+---
+subcategory: "Kinesis"
+layout: "aws"
+page_title: "AWS: aws_kinesis_stream_consumer"
+description: |-
+  Provides details about a Kinesis Stream Consumer.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_kinesis_stream_consumer
+
+Provides details about a Kinesis Stream Consumer.
+
+For more details, see the [Amazon Kinesis Stream Consumer Documentation][1].
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsKinesisStreamConsumer } from "./.gen/providers/aws/data-aws-kinesis-stream-consumer";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsKinesisStreamConsumer(this, "example", {
+      name: "example-consumer",
+      streamArn: Token.asString(awsKinesisStreamExample.arn),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `arn` - (Optional) ARN of the stream consumer.
+* `name` - (Optional) Name of the stream consumer.
+* `streamArn` - (Required) ARN of the data stream the consumer is registered with.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `creationTimestamp` - Approximate timestamp in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8) of when the stream consumer was created.
+* `id` - ARN of the stream consumer.
+* `status` - Current status of the stream consumer.
+
+[1]: https://docs.aws.amazon.com/streams/latest/dev/amazon-kinesis-consumers.html
+
+<!-- cache-key: cdktf-0.18.0 input-482a972e99b29826e09a6b01244884263ba57e5574eae706e0c8646f0c88959b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/kms_alias.html.markdown b/website/docs/cdktf/typescript/d/kms_alias.html.markdown
new file mode 100644
index 00000000000..da229bde11a
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/kms_alias.html.markdown
@@ -0,0 +1,52 @@
+---
+subcategory: "KMS (Key Management)"
+layout: "aws"
+page_title: "AWS: aws_kms_alias"
+description: |-
+  Get information on a AWS Key Management Service (KMS) Alias
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_kms_alias
+
+Use this data source to get the ARN of a KMS key alias.
+By using this data source, you can reference key alias
+without having to hard code the ARN as input.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsKmsAlias } from "./.gen/providers/aws/data-aws-kms-alias";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsKmsAlias(this, "s3", {
+      name: "alias/aws/s3",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `name` - (Required) Display name of the alias. The name must start with the word "alias" followed by a forward slash (alias/)
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name(ARN) of the key alias.
+* `id` - Amazon Resource Name(ARN) of the key alias.
+* `targetKeyId` - Key identifier pointed to by the alias.
+* `targetKeyArn` - ARN pointed to by the alias.
+
+<!-- cache-key: cdktf-0.18.0 input-a26328bd3bb7108ab75996766b208d1cd2fdaf417bd2555aa1588956c0544b01 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/kms_ciphertext.html.markdown b/website/docs/cdktf/typescript/d/kms_ciphertext.html.markdown
new file mode 100644
index 00000000000..cb0bdb9a6ba
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/kms_ciphertext.html.markdown
@@ -0,0 +1,65 @@
+---
+subcategory: "KMS (Key Management)"
+layout: "aws"
+page_title: "AWS: aws_kms_ciphertext"
+description: |-
+    Provides ciphertext encrypted using a KMS key
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_kms_ciphertext
+
+The KMS ciphertext data source allows you to encrypt plaintext into ciphertext
+by using an AWS KMS customer master key. The value returned by this data source
+changes every apply. For a stable ciphertext value, see the [`awsKmsCiphertext`
+resource](/docs/providers/aws/r/kms_ciphertext.html).
+
+~> **Note:** All arguments including the plaintext be stored in the raw state as plain-text.
+[Read more about sensitive data in state](https://www.terraform.io/docs/state/sensitive-data.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsKmsCiphertext } from "./.gen/providers/aws/data-aws-kms-ciphertext";
+import { KmsKey } from "./.gen/providers/aws/kms-key";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const oauthConfig = new KmsKey(this, "oauth_config", {
+      description: "oauth config",
+      isEnabled: true,
+    });
+    new DataAwsKmsCiphertext(this, "oauth", {
+      keyId: oauthConfig.keyId,
+      plaintext:
+        '{\n  "client_id": "e587dbae22222f55da22",\n  "client_secret": "8289575d00000ace55e1815ec13673955721b8a5"\n}\n\n',
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `plaintext` - (Required) Data to be encrypted. Note that this may show up in logs, and it will be stored in the state file.
+* `keyId` - (Required) Globally unique key ID for the customer master key.
+* `context` - (Optional) An optional mapping that makes up the encryption context.
+
+## Attribute Reference
+
+All of the argument attributes are also exported as result attributes.
+
+* `id` - Globally unique key ID for the customer master key.
+* `ciphertextBlob` - Base64 encoded ciphertext
+
+<!-- cache-key: cdktf-0.18.0 input-b95133cf0e6d636d0e7e0bba6f81265bceaccd42767260a7c1b7aa55fb5a81e8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/kms_custom_key_store.html.markdown b/website/docs/cdktf/typescript/d/kms_custom_key_store.html.markdown
new file mode 100644
index 00000000000..fcb420b8862
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/kms_custom_key_store.html.markdown
@@ -0,0 +1,54 @@
+---
+subcategory: "KMS (Key Management)"
+layout: "aws"
+page_title: "AWS: aws_kms_custom_key_store"
+description: |-
+  Get information on a AWS Key Management Service (KMS) Custom Key Store
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_kms_custom_key_store
+
+Use this data source to get the metadata KMS custom key store.
+By using this data source, you can reference KMS custom key store
+without having to hard code the ID as input.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsKmsCustomKeyStore } from "./.gen/providers/aws/data-aws-kms-custom-key-store";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsKmsCustomKeyStore(this, "keystore", {
+      customKeyStoreName: "my_cloudhsm",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `customKeyStoreId` - (Optional) The ID for the custom key store.
+* `customKeyStoreName` - (Optional) The user-specified friendly name for the custom key store.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - The ID for the custom key store.
+* `cloudhsmClusterId` - ID for the CloudHSM cluster that is associated with the custom key store.
+* `connectionState` - Indicates whether the custom key store is connected to its CloudHSM cluster.
+* `creationDate` - The date and time when the custom key store was created.
+* `trustAnchorCertificate` - The trust anchor certificate of the associated CloudHSM cluster.
+
+<!-- cache-key: cdktf-0.18.0 input-c99ed837841abb6fb88fc77efec11deea74fe80e9ca93d91eb217568414d6862 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/kms_key.html.markdown b/website/docs/cdktf/typescript/d/kms_key.html.markdown
new file mode 100644
index 00000000000..7f146d99be0
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/kms_key.html.markdown
@@ -0,0 +1,96 @@
+---
+subcategory: "KMS (Key Management)"
+layout: "aws"
+page_title: "AWS: aws_kms_key"
+description: |-
+  Get information on a AWS Key Management Service (KMS) Key
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# aws_kms_key
+
+Use this data source to get detailed information about
+the specified KMS Key with flexible key id input.
+This can be useful to reference key alias
+without having to hard code the ARN as input.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsKmsKey } from "./.gen/providers/aws/data-aws-kms-key";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsKmsKey(this, "by_alias", {
+      keyId: "alias/my-key",
+    });
+    new DataAwsKmsKey(this, "by_alias_arn", {
+      keyId: "arn:aws:kms:us-east-1:111122223333:alias/my-key",
+    });
+    new DataAwsKmsKey(this, "by_id", {
+      keyId: "1234abcd-12ab-34cd-56ef-1234567890ab",
+    });
+    new DataAwsKmsKey(this, "by_key_arn", {
+      keyId:
+        "arn:aws:kms:us-east-1:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `keyId` - (Required) Key identifier which can be one of the following format:
+    * Key ID. E.g: `1234Abcd12Ab34Cd56Ef1234567890Ab`
+    * Key ARN. E.g.: `arn:aws:kms:usEast1:111122223333:key/1234Abcd12Ab34Cd56Ef1234567890Ab`
+    * Alias name. E.g.: `alias/myKey`
+    * Alias ARN: E.g.: `arn:aws:kms:usEast1:111122223333:alias/myKey`
+* `grantTokens` - (Optional) List of grant tokens
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id`: The globally unique identifier for the key
+* `arn`: The ARN of the key
+* `awsAccountId`: The twelve-digit account ID of the AWS account that owns the key
+* `cloudHsmClusterId`: The cluster ID of the AWS CloudHSM cluster that contains the key material for the KMS key.
+* `creationDate`: The date and time when the key was created
+* `customKeyStoreId`: A unique identifier for the custom key store that contains the KMS key.
+* `customerMasterKeySpec`: Specifies whether the key contains a symmetric key or an asymmetric key pair and the encryption algorithms or signing algorithms that the key supports
+* `deletionDate`: The date and time after which AWS KMS deletes the key. This value is present only when `keyState` is `pendingDeletion`, otherwise this value is 0
+* `description`: The description of the key.
+* `enabled`: Specifies whether the key is enabled. When `keyState` is `enabled` this value is true, otherwise it is false
+* `expirationModel`: Specifies whether the Key's key material expires. This value is present only when `origin` is `external`, otherwise this value is empty
+* `keyManager`: The key's manager
+* `keySpec`: Describes the type of key material in the KMS key.
+* `keyState`: The state of the key
+* `keyUsage`: Specifies the intended use of the key
+* `multiRegion`: Indicates whether the KMS key is a multi-Region (`true`) or regional (`false`) key.
+* `multiRegionConfiguration`: Lists the primary and replica keys in same multi-Region key. Present only when the value of `multiRegion` is `true`.
+* `origin`: When this value is `awsKms`, AWS KMS created the key material. When this value is `external`, the key material was imported from your existing key management infrastructure or the CMK lacks key material
+* `pendingDeletionWindowInDays`: The waiting period before the primary key in a multi-Region key is deleted.
+* `validTo`: The time at which the imported key material expires. This value is present only when `origin` is `external` and whose `expirationModel` is `keyMaterialExpires`, otherwise this value is 0
+* `xksKeyConfiguration`: Information about the external key that is associated with a KMS key in an external key store.
+
+The `multiRegionConfiguration` object supports the following:
+
+* `multiRegionKeyType`: Indicates whether the KMS key is a `primary` or `replica` key.
+* `primaryKey`: The key ARN and Region of the primary key. This is the current KMS key if it is the primary key.
+* `replicaKeys`: The key ARNs and Regions of all replica keys. Includes the current KMS key if it is a replica key.
+
+The `primaryKey` and `replicaKeys` objects support the following:
+
+* `arn`: The key ARN of a primary or replica key of a multi-Region key.
+* `region`: The AWS Region of a primary or replica key in a multi-Region key.
+
+<!-- cache-key: cdktf-0.18.0 input-ea7621c22f20905a0de28c0a03b164a5da43b21e2d3bdf0913f29e827818698b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/kms_public_key.html.markdown b/website/docs/cdktf/typescript/d/kms_public_key.html.markdown
new file mode 100644
index 00000000000..4057411cc3d
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/kms_public_key.html.markdown
@@ -0,0 +1,71 @@
+---
+subcategory: "KMS (Key Management)"
+layout: "aws"
+page_title: "AWS: aws_kms_public_key"
+description: |-
+  Get information on a KMS public key
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# aws_kms_public_key
+
+Use this data source to get the public key about the specified KMS Key with flexible key id input. This can be useful to reference key alias without having to hard code the ARN as input.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsKmsPublicKey } from "./.gen/providers/aws/data-aws-kms-public-key";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsKmsPublicKey(this, "by_alias", {
+      keyId: "alias/my-key",
+    });
+    new DataAwsKmsPublicKey(this, "by_alias_arn", {
+      keyId: "arn:aws:kms:us-east-1:111122223333:alias/my-key",
+    });
+    new DataAwsKmsPublicKey(this, "by_id", {
+      keyId: "1234abcd-12ab-34cd-56ef-1234567890ab",
+    });
+    new DataAwsKmsPublicKey(this, "by_key_arn", {
+      keyId:
+        "arn:aws:kms:us-east-1:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `keyId` - (Required) Key identifier which can be one of the following format:
+    * Key ID. E.g - `1234Abcd12Ab34Cd56Ef1234567890Ab`
+    * Key ARN. E.g. - `arn:aws:kms:usEast1:111122223333:key/1234Abcd12Ab34Cd56Ef1234567890Ab`
+    * Alias name. E.g. - `alias/myKey`
+    * Alias ARN - E.g. - `arn:aws:kms:usEast1:111122223333:alias/myKey`
+* `grantTokens` - (Optional) List of grant tokens
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - Key ARN of the asymmetric CMK from which the public key was downloaded.
+* `customerMasterKeySpec` - Type of the public key that was downloaded.
+* `encryptionAlgorithms` - Encryption algorithms that AWS KMS supports for this key. Only set when the `keyUsage` of the public key is `encryptDecrypt`.
+* `id` - Key ARN of the asymmetric CMK from which the public key was downloaded.
+* `keyUsage` - Permitted use of the public key. Valid values are `encryptDecrypt` or `signVerify`
+* `publicKey` - Exported public key. The value is a DER-encoded X.509 public key, also known as SubjectPublicKeyInfo (SPKI), as defined in [RFC 5280](https://tools.ietf.org/html/rfc5280). The value is Base64-encoded.
+* `publicKeyPem` - Exported public key. The value is Privacy Enhanced Mail (PEM) encoded.
+* `signingAlgorithms` - Signing algorithms that AWS KMS supports for this key. Only set when the `keyUsage` of the public key is `signVerify`.
+
+<!-- cache-key: cdktf-0.18.0 input-12b3af34b0a1b4d66a4ded239c7cec5e42bb02e7dbdeb474700393154476f950 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/kms_secret.html.markdown b/website/docs/cdktf/typescript/d/kms_secret.html.markdown
new file mode 100644
index 00000000000..26c98a2354c
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/kms_secret.html.markdown
@@ -0,0 +1,15 @@
+---
+subcategory: "KMS (Key Management)"
+layout: "aws"
+page_title: "AWS: aws_kms_secret"
+description: |-
+    Provides secret data encrypted with the KMS service
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_kms_secret
+
+!> **WARNING:** This data source was removed in version 2.0.0 of the Terraform AWS Provider. You can migrate existing configurations to the [`awsKmsSecrets` data source](/docs/providers/aws/d/kms_secrets.html) following instructions available in the [Version 2 Upgrade Guide](../guides/version-2-upgrade.html#data-source-aws_kms_secret).
+
+<!-- cache-key: cdktf-0.18.0 input-fcfeaaa83a200a1ed43647d46ae1fe5be1d50d9ede7fb6ba139fb2957f734790 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/kms_secrets.html.markdown b/website/docs/cdktf/typescript/d/kms_secrets.html.markdown
new file mode 100644
index 00000000000..5d343a70944
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/kms_secrets.html.markdown
@@ -0,0 +1,109 @@
+---
+subcategory: "KMS (Key Management)"
+layout: "aws"
+page_title: "AWS: aws_kms_secrets"
+description: |-
+    Decrypt multiple secrets from data encrypted with the AWS KMS service
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_kms_secrets
+
+Decrypt multiple secrets from data encrypted with the AWS KMS service.
+
+~> **NOTE:** Using this data provider will allow you to conceal secret data within your resource definitions but does not take care of protecting that data in all Terraform logging and state output. Please take care to secure your secret data beyond just the Terraform configuration.
+
+## Example Usage
+
+If you do not already have a `ciphertextBlob` from encrypting a KMS secret, you can use the below commands to obtain one using the [AWS CLI kms encrypt](https://docs.aws.amazon.com/cli/latest/reference/kms/encrypt.html) command. This requires you to have your AWS CLI setup correctly and replace the `keyId` with your own. Alternatively you can use `--plaintext 'master-password'` (CLIv1) or `--plaintext fileb://<(echo -n 'master-password')` (CLIv2) instead of reading from a file.
+
+-> If you have a newline character at the end of your file, it will be decrypted with this newline character intact. For most use cases this is undesirable and leads to incorrect passwords or invalid values, as well as possible changes in the plan. Be sure to use `echo -n` if necessary.
+-> If you are using asymmetric keys ensure you are using the right encryption algorithm when you encrypt and decrypt else you will get IncorrectKeyException during the decrypt phase.
+
+```console
+% echo -n 'master-password' > plaintext-password
+% aws kms encrypt --key-id ab123456-c012-4567-890a-deadbeef123 --plaintext fileb://plaintext-password --encryption-context foo=bar --output text --query CiphertextBlob
+AQECAHgaPa0J8WadplGCqqVAr4HNvDaFSQ+NaiwIBhmm6qDSFwAAAGIwYAYJKoZIhvcNAQcGoFMwUQIBADBMBgkqhkiG9w0BBwEwHgYJYIZIAWUDBAEuMBEEDI+LoLdvYv8l41OhAAIBEIAfx49FFJCLeYrkfMfAw6XlnxP23MmDBdqP8dPp28OoAQ==
+% aws kms encrypt --key-id ab123456-c012-4567-890a-deadbeef123 --plaintext fileb://plaintext-password --encryption-algorithm RSAES_OAEP_SHA_256 --output text --query CiphertextBlob
+AQECAHgaPa0J8WadplGCqqVAr4HNvDaFSQ+NaiwIBhmm6qDSFwAAAGIwYAYJKoZIhvcNAQcGoFMwUQIBADBMBgkqhkiG9w0BBwEwHgYJYIZIAWUDBAEuMBEEDI+LoLdvYv8l41OhAAIBEIAfx49FFJCLeYrkfMfAw6XlnxP23MmDBdqP8dPp28OoAQ==
+```
+
+That encrypted output can now be inserted into Terraform configurations without exposing the plaintext secret directly.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsKmsSecrets } from "./.gen/providers/aws/data-aws-kms-secrets";
+import { RdsCluster } from "./.gen/providers/aws/rds-cluster";
+interface MyConfig {
+  engine: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    const example = new DataAwsKmsSecrets(this, "example", {
+      secret: [
+        {
+          context: {
+            foo: "bar",
+          },
+          name: "master_password",
+          payload:
+            "AQECAHgaPa0J8WadplGCqqVAr4HNvDaFSQ+NaiwIBhmm6qDSFwAAAGIwYAYJKoZIhvcNAQcGoFMwUQIBADBMBgkqhkiG9w0BBwEwHgYJYIZIAWUDBAEuMBEEDI+LoLdvYv8l41OhAAIBEIAfx49FFJCLeYrkfMfAw6XlnxP23MmDBdqP8dPp28OoAQ==",
+        },
+        {
+          name: "master_username",
+          payload:
+            "AQECAHgaPa0J8WadplGCqqVAr4HNvDaFSQ+NaiwIBhmm6qDSFwAAAGIwYAYJKoZIhvcNAQcGoFMwUQIBADBMBgkqhkiG9w0BBwEwHgYJYIZIAWUDBAEuMBEEDI+LoLdvYv8l41OhAAIBEIAfx49FFJCLeYrkfMfAw6XlnxP23MmDBdqP8dPp28OoAQ==",
+        },
+      ],
+    });
+    const awsRdsClusterExample = new RdsCluster(this, "example_1", {
+      masterPassword: Token.asString(
+        Fn.lookupNested(example.plaintext, ['"master_password"'])
+      ),
+      masterUsername: Token.asString(
+        Fn.lookupNested(example.plaintext, ['"master_username"'])
+      ),
+      engine: config.engine,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsRdsClusterExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `secret` - (Required) One or more encrypted payload definitions from the KMS service. See the Secret Definitions below.
+
+### Secret Definitions
+
+Each `secret` supports the following arguments:
+
+* `name` - (Required) Name to export this secret under in the attributes.
+* `payload` - (Required) Base64 encoded payload, as returned from a KMS encrypt operation.
+* `context` - (Optional) An optional mapping that makes up the Encryption Context for the secret.
+* `grantTokens` (Optional) An optional list of Grant Tokens for the secret.
+* `encryptionAlgorithm` - (Optional) The encryption algorithm that will be used to decrypt the ciphertext. This parameter is required only when the ciphertext was encrypted under an asymmetric KMS key. Valid Values: SYMMETRIC_DEFAULT | RSAES_OAEP_SHA_1 | RSAES_OAEP_SHA_256 | SM2PKE
+* `keyId` (Optional) Specifies the KMS key that AWS KMS uses to decrypt the ciphertext. This parameter is required only when the ciphertext was encrypted under an asymmetric KMS key.
+
+For more information on `context` and `grantTokens` see the [KMS
+Concepts](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html)
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `plaintext` - Map containing each `secret` `name` as the key with its decrypted plaintext value
+
+<!-- cache-key: cdktf-0.18.0 input-163ab67c377949aee00b00e3a19b28f529fc14cff02471ea6c0bd31a209a5b1d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/lakeformation_data_lake_settings.html.markdown b/website/docs/cdktf/typescript/d/lakeformation_data_lake_settings.html.markdown
new file mode 100644
index 00000000000..bf53e43ae66
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/lakeformation_data_lake_settings.html.markdown
@@ -0,0 +1,66 @@
+---
+subcategory: "Lake Formation"
+layout: "aws"
+page_title: "AWS: aws_lakeformation_data_lake_settings"
+description: |-
+    Get data lake administrators and default database and table permissions
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_lakeformation_data_lake_settings
+
+Get Lake Formation principals designated as data lake administrators and lists of principal permission entries for default create database and default create table permissions.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsLakeformationDataLakeSettings } from "./.gen/providers/aws/data-aws-lakeformation-data-lake-settings";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsLakeformationDataLakeSettings(this, "example", {
+      catalogId: "14916253649",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are optional:
+
+* `catalogId` – (Optional) Identifier for the Data Catalog. By default, the account ID.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `admins` – List of ARNs of AWS Lake Formation principals (IAM users or roles).
+* `readOnlyAdmins` – List of ARNs of AWS Lake Formation principals (IAM users or roles) with only view access to the resources.
+* `createDatabaseDefaultPermissions` - Up to three configuration blocks of principal permissions for default create database permissions. Detailed below.
+* `createTableDefaultPermissions` - Up to three configuration blocks of principal permissions for default create table permissions. Detailed below.
+* `trustedResourceOwners` – List of the resource-owning account IDs that the caller's account can use to share their user access details (user ARNs).
+* `allowExternalDataFiltering` - Whether to allow Amazon EMR clusters to access data managed by Lake Formation.
+* `externalDataFilteringAllowList` - A list of the account IDs of Amazon Web Services accounts with Amazon EMR clusters that are to perform data filtering.
+* `authorizedSessionTagValueList` - Lake Formation relies on a privileged process secured by Amazon EMR or the third party integrator to tag the user's role while assuming it.
+
+### create_database_default_permissions
+
+* `permissions` - List of permissions granted to the principal.
+* `principal` - Principal who is granted permissions.
+
+### create_table_default_permissions
+
+* `permissions` - List of permissions granted to the principal.
+* `principal` - Principal who is granted permissions.
+
+<!-- cache-key: cdktf-0.18.0 input-f9ed67609f11fe3dc75d11e8316427f119ef11af97f179f341207047f1fe3023 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/lakeformation_permissions.html.markdown b/website/docs/cdktf/typescript/d/lakeformation_permissions.html.markdown
new file mode 100644
index 00000000000..4a50858fc27
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/lakeformation_permissions.html.markdown
@@ -0,0 +1,204 @@
+---
+subcategory: "Lake Formation"
+layout: "aws"
+page_title: "AWS: aws_lakeformation_permissions"
+description: |-
+    Get permissions for a principal to access metadata in the Data Catalog and data organized in underlying data storage such as Amazon S3.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_lakeformation_permissions
+
+Get permissions for a principal to access metadata in the Data Catalog and data organized in underlying data storage such as Amazon S3. Permissions are granted to a principal, in a Data Catalog, relative to a Lake Formation resource, which includes the Data Catalog, databases, tables, LF-tags, and LF-tag policies. For more information, see [Security and Access Control to Metadata and Data in Lake Formation](https://docs.aws.amazon.com/lake-formation/latest/dg/security-data-access.html).
+
+~> **NOTE:** This data source deals with explicitly granted permissions. Lake Formation grants implicit permissions to data lake administrators, database creators, and table creators. For more information, see [Implicit Lake Formation Permissions](https://docs.aws.amazon.com/lake-formation/latest/dg/implicit-permissions.html).
+
+## Example Usage
+
+### Permissions For A Lake Formation S3 Resource
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsLakeformationPermissions } from "./.gen/providers/aws/data-aws-lakeformation-permissions";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsLakeformationPermissions(this, "test", {
+      dataLocation: {
+        arn: Token.asString(awsLakeformationResourceTest.arn),
+      },
+      principal: workflowRole.arn,
+    });
+  }
+}
+
+```
+
+### Permissions For A Glue Catalog Database
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsLakeformationPermissions } from "./.gen/providers/aws/data-aws-lakeformation-permissions";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsLakeformationPermissions(this, "test", {
+      database: {
+        catalogId: "110376042874",
+        name: Token.asString(awsGlueCatalogDatabaseTest.name),
+      },
+      principal: workflowRole.arn,
+    });
+  }
+}
+
+```
+
+### Permissions For Tag-Based Access Control
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsLakeformationPermissions } from "./.gen/providers/aws/data-aws-lakeformation-permissions";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsLakeformationPermissions(this, "test", {
+      lfTagPolicy: {
+        expression: [
+          {
+            key: "Team",
+            values: ["Sales"],
+          },
+          {
+            key: "Environment",
+            values: ["Dev", "Production"],
+          },
+        ],
+        resourceType: "DATABASE",
+      },
+      principal: workflowRole.arn,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `principal` – (Required) Principal to be granted the permissions on the resource. Supported principals are IAM users or IAM roles.
+
+One of the following is required:
+
+* `catalogResource` - Whether the permissions are to be granted for the Data Catalog. Defaults to `false`.
+* `dataLocation` - Configuration block for a data location resource. Detailed below.
+* `database` - Configuration block for a database resource. Detailed below.
+* `lfTag` - (Optional) Configuration block for an LF-tag resource. Detailed below.
+* `lfTagPolicy` - (Optional) Configuration block for an LF-tag policy resource. Detailed below.
+* `table` - Configuration block for a table resource. Detailed below.
+* `tableWithColumns` - Configuration block for a table with columns resource. Detailed below.
+
+The following arguments are optional:
+
+* `catalogId` – (Optional) Identifier for the Data Catalog. By default, the account ID. The Data Catalog is the persistent metadata store. It contains database definitions, table definitions, and other control information to manage your Lake Formation environment.
+
+### data_location
+
+The following argument is required:
+
+* `arn` – (Required) ARN that uniquely identifies the data location resource.
+
+The following argument is optional:
+
+* `catalogId` - (Optional) Identifier for the Data Catalog where the location is registered with Lake Formation. By default, it is the account ID of the caller.
+
+### database
+
+The following argument is required:
+
+* `name` – (Required) Name of the database resource. Unique to the Data Catalog.
+
+The following argument is optional:
+
+* `catalogId` - (Optional) Identifier for the Data Catalog. By default, it is the account ID of the caller.
+
+### lf_tag
+
+The following arguments are required:
+
+* `key` – (Required) Key-name for the tag.
+* `values` - (Required) List of possible values an attribute can take.
+
+The following argument is optional:
+
+* `catalogId` - (Optional) Identifier for the Data Catalog. By default, it is the account ID of the caller.
+
+### lf_tag_policy
+
+The following arguments are required:
+
+* `resourceType` – (Required) Resource type for which the tag policy applies. Valid values are `database` and `table`.
+* `expression` - (Required) List of tag conditions that apply to the resource's tag policy. Configuration block for tag conditions that apply to the policy. See [`expression`](#expression) below.
+
+The following argument is optional:
+
+* `catalogId` - (Optional) Identifier for the Data Catalog. By default, it is the account ID of the caller.
+
+#### expression
+
+* `key` – (Required) Key-name of an LF-Tag.
+* `values` - (Required) List of possible values of an LF-Tag.
+
+### table
+
+The following argument is required:
+
+* `databaseName` – (Required) Name of the database for the table. Unique to a Data Catalog.
+
+The following arguments are optional:
+
+* `catalogId` - (Optional) Identifier for the Data Catalog. By default, it is the account ID of the caller.
+* `name` - (Optional) Name of the table. At least one of `name` or `wildcard` is required.
+* `wildcard` - (Optional) Whether to use a wildcard representing every table under a database. At least one of `name` or `wildcard` is required. Defaults to `false`.
+
+### table_with_columns
+
+The following arguments are required:
+
+* `databaseName` – (Required) Name of the database for the table with columns resource. Unique to the Data Catalog.
+* `name` – (Required) Name of the table resource.
+
+The following arguments are optional:
+
+* `catalogId` - (Optional) Identifier for the Data Catalog. By default, it is the account ID of the caller.
+* `columnNames` - (Optional) Set of column names for the table. At least one of `columnNames` or `excludedColumnNames` is required.
+* `excludedColumnNames` - (Optional) Set of column names for the table to exclude. At least one of `columnNames` or `excludedColumnNames` is required.
+
+## Attribute Reference
+
+In addition to the above arguments, the following attribute is exported:
+
+* `permissions` – List of permissions granted to the principal. For details on permissions, see [Lake Formation Permissions Reference](https://docs.aws.amazon.com/lake-formation/latest/dg/lf-permissions-reference.html).
+* `permissionsWithGrantOption` - Subset of `permissions` which the principal can pass.
+
+<!-- cache-key: cdktf-0.18.0 input-f820afbcf35bc80d4121f086cb449534cf9844817817f907e94a928ec49659fd -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/lakeformation_resource.html.markdown b/website/docs/cdktf/typescript/d/lakeformation_resource.html.markdown
new file mode 100644
index 00000000000..893cf80cd3a
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/lakeformation_resource.html.markdown
@@ -0,0 +1,48 @@
+---
+subcategory: "Lake Formation"
+layout: "aws"
+page_title: "AWS: aws_lakeformation_resource"
+description: |-
+    Provides details about a Lake Formation resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_lakeformation_resource
+
+Provides details about a Lake Formation resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsLakeformationResource } from "./.gen/providers/aws/data-aws-lakeformation-resource";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsLakeformationResource(this, "example", {
+      arn: "arn:aws:s3:::tf-acc-test-9151654063908211878",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `arn` – (Required) ARN of the resource, an S3 path.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `lastModified` - Date and time the resource was last modified in [RFC 3339 format](https://tools.ietf.org/html/rfc3339#section-5.8).
+* `roleArn` – Role that the resource was registered with.
+
+<!-- cache-key: cdktf-0.18.0 input-0185c301ec1158bbafdd7e87d6616f71b92a457425fc4fc6e43f33335ee107a8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/lambda_alias.html.markdown b/website/docs/cdktf/typescript/d/lambda_alias.html.markdown
new file mode 100644
index 00000000000..f96d377bb4c
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/lambda_alias.html.markdown
@@ -0,0 +1,54 @@
+---
+subcategory: "Lambda"
+layout: "aws"
+page_title: "AWS: aws_lambda_alias"
+description: |-
+  Provides a Lambda Alias data source.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_lambda_alias
+
+Provides information about a Lambda Alias.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsLambdaAlias } from "./.gen/providers/aws/data-aws-lambda-alias";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsLambdaAlias(this, "production", {
+      functionName: "my-lambda-func",
+      name: "production",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `functionName` - (Required) Name of the aliased Lambda function.
+* `name` - (Required) Name of the Lambda alias.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN identifying the Lambda function alias.
+* `description` - Description of alias.
+* `functionVersion` - Lambda function version which the alias uses.
+* `invokeArn` - ARN to be used for invoking Lambda Function from API Gateway - to be used in aws_api_gateway_integration's `uri`.
+
+<!-- cache-key: cdktf-0.18.0 input-9a9ef3f242a9fa98f2fce5f412613b9059a876ab618fe7d6d35642bfb3e5874d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/lambda_code_signing_config.html.markdown b/website/docs/cdktf/typescript/d/lambda_code_signing_config.html.markdown
new file mode 100644
index 00000000000..ac3fb31d9a6
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/lambda_code_signing_config.html.markdown
@@ -0,0 +1,70 @@
+---
+subcategory: "Lambda"
+layout: "aws"
+page_title: "AWS: aws_lambda_code_signing_config"
+description: |-
+  Provides a Lambda Code Signing Config data source.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_lambda_code_signing_config
+
+Provides information about a Lambda Code Signing Config. A code signing configuration defines a list of allowed signing profiles and defines the code-signing validation policy (action to be taken if deployment validation checks fail).
+
+For information about Lambda code signing configurations and how to use them, see [configuring code signing for Lambda functions][1]
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsLambdaCodeSigningConfig } from "./.gen/providers/aws/data-aws-lambda-code-signing-config";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsLambdaCodeSigningConfig(this, "existing_csc", {
+      arn:
+        "arn:aws:lambda:${" +
+        awsRegion.value +
+        "}:${" +
+        awsAccount.value +
+        "}:code-signing-config:csc-0f6c334abcdea4d8b",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `arn` - (Required) ARN of the code signing configuration.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `allowedPublishers` - List of allowed publishers as signing profiles for this code signing configuration.
+* `configId` - Unique identifier for the code signing configuration.
+* `description` - Code signing configuration description.
+* `lastModified` - Date and time that the code signing configuration was last modified.
+* `policies` - List of code signing policies that control the validation failure action for signature mismatch or expiry.
+
+`allowedPublishers` is exported with the following attribute:
+
+* `signingProfileVersionArns` - The ARN for each of the signing profiles. A signing profile defines a trusted user who can sign a code package.
+
+`policies` is exported with the following attribute:
+
+* `untrustedArtifactOnDeployment` - Code signing configuration policy for deployment validation failure.
+
+[1]: https://docs.aws.amazon.com/lambda/latest/dg/configuration-codesigning.html
+
+<!-- cache-key: cdktf-0.18.0 input-7579a58de49284320a865ba064d26b395888e4b37e0c54bd6bcef30caa65b6ed -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/lambda_function.html.markdown b/website/docs/cdktf/typescript/d/lambda_function.html.markdown
new file mode 100644
index 00000000000..ce6894bd599
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/lambda_function.html.markdown
@@ -0,0 +1,82 @@
+---
+subcategory: "Lambda"
+layout: "aws"
+page_title: "AWS: aws_lambda_function"
+description: |-
+  Provides a Lambda Function data source.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# aws_lambda_function
+
+Provides information about a Lambda Function.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { VariableType, TerraformVariable, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsLambdaFunction } from "./.gen/providers/aws/data-aws-lambda-function";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    /*Terraform Variables are not always the best fit for getting inputs in the context of Terraform CDK.
+    You can read more about this at https://cdk.tf/variables*/
+    const functionName = new TerraformVariable(this, "function_name", {
+      type: VariableType.STRING,
+    });
+    new DataAwsLambdaFunction(this, "existing", {
+      functionName: functionName.stringValue,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `functionName` - (Required) Name of the lambda function.
+* `qualifier` - (Optional) Alias name or version number of the lambda functionE.g., `$latest`, `myAlias`, or `1`. When not included: the data source resolves to the most recent published version; if no published version exists: it resolves to the most recent unpublished version.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `architectures` - Instruction set architecture for the Lambda function.
+* `arn` - Unqualified (no `:qualifier` or `:version` suffix) ARN identifying your Lambda Function. See also `qualifiedArn`.
+* `codeSigningConfigArn` - ARN for a Code Signing Configuration.
+* `deadLetterConfig` - Configure the function's *dead letter queue*.
+* `description` - Description of what your Lambda Function does.
+* `environment` - Lambda environment's configuration settings.
+* `ephemeralStorage` - Amount of Ephemeral storage(`/tmp`) allocated for the Lambda Function.
+* `fileSystemConfig` - Connection settings for an Amazon EFS file system.
+* `handler` - Function entrypoint in your code.
+* `imageUri` - URI of the container image.
+* `invokeArn` - ARN to be used for invoking Lambda Function from API Gateway. **NOTE:** Starting with `v4510` of the provider, this will *not* include the qualifier.
+* `kmsKeyArn` - ARN for the KMS encryption key.
+* `lastModified` - Date this resource was last modified.
+* `layers` - List of Lambda Layer ARNs attached to your Lambda Function.
+* `memorySize` - Amount of memory in MB your Lambda Function can use at runtime.
+* `qualifiedArn` - Qualified (`:qualifier` or `:version` suffix) ARN identifying your Lambda Function. See also `arn`.
+* `qualifiedInvokeArn` - Qualified (`:qualifier` or `:version` suffix) ARN to be used for invoking Lambda Function from API Gateway. See also `invokeArn`.
+* `reservedConcurrentExecutions` - The amount of reserved concurrent executions for this lambda function or `1` if unreserved.
+* `role` - IAM role attached to the Lambda Function.
+* `runtime` - Runtime environment for the Lambda function.
+* `signingJobArn` - ARN of a signing job.
+* `signingProfileVersionArn` - The ARN for a signing profile version.
+* `sourceCodeHash` - Base64-encoded representation of raw SHA-256 sum of the zip file.
+* `sourceCodeSize` - Size in bytes of the function .zip file.
+* `timeout` - Function execution time at which Lambda should terminate the function.
+* `tracingConfig` - Tracing settings of the function.
+* `version` - The version of the Lambda function returned. If `qualifier` is not set, this will resolve to the most recent published version. If no published version of the function exists, `version` will resolve to `$latest`.
+* `vpcConfig` - VPC configuration associated with your Lambda function.
+
+<!-- cache-key: cdktf-0.18.0 input-aa23743032adbbcb3971ecbe81f2b393d5995f92cb64512014ac1d8c97a94023 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/lambda_function_url.html.markdown b/website/docs/cdktf/typescript/d/lambda_function_url.html.markdown
new file mode 100644
index 00000000000..b5ed2faa2ab
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/lambda_function_url.html.markdown
@@ -0,0 +1,62 @@
+---
+subcategory: "Lambda"
+layout: "aws"
+page_title: "AWS: aws_lambda_function_url"
+description: |-
+  Provides a Lambda function URL data source.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# aws_lambda_function_url
+
+Provides information about a Lambda function URL.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { VariableType, TerraformVariable, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsLambdaFunctionUrl } from "./.gen/providers/aws/data-aws-lambda-function-url";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    /*Terraform Variables are not always the best fit for getting inputs in the context of Terraform CDK.
+    You can read more about this at https://cdk.tf/variables*/
+    const functionName = new TerraformVariable(this, "function_name", {
+      type: VariableType.STRING,
+    });
+    new DataAwsLambdaFunctionUrl(this, "existing", {
+      functionName: functionName.stringValue,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `functionName` - (Required) The name (or ARN) of the Lambda function.
+* `qualifier` - (Optional) Alias name or `"$latest"`.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `authorizationType` - Type of authentication that the function URL uses.
+* `cors` - The [cross-origin resource sharing (CORS)](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS) settings for the function URL. See the [`awsLambdaFunctionUrl` resource](/docs/providers/aws/r/lambda_function_url.html) documentation for more details.
+* `creationTime` - When the function URL was created, in [ISO-8601 format](https://www.w3.org/TR/NOTE-datetime).
+* `functionArn` - ARN of the function.
+* `functionUrl` - HTTP URL endpoint for the function in the format `https://<urlId>LambdaUrl.<region>OnAws`.
+* `invokeMode` - Whether the Lambda function responds in `buffered` or `responseStream` mode.
+* `lastModifiedTime` - When the function URL configuration was last updated, in [ISO-8601 format](https://www.w3.org/TR/NOTE-datetime).
+* `urlId` - Generated ID for the endpoint.
+
+<!-- cache-key: cdktf-0.18.0 input-0a5c606b8160ad05d35175dbe2ca99c3d1ab9ce2b9e1e2ff92b850ec19ea50b9 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/lambda_functions.html.markdown b/website/docs/cdktf/typescript/d/lambda_functions.html.markdown
new file mode 100644
index 00000000000..3309d8554e4
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/lambda_functions.html.markdown
@@ -0,0 +1,46 @@
+---
+subcategory: "Lambda"
+layout: "aws"
+page_title: "AWS: aws_lambda_functions"
+description: |-
+  Terraform data resource to get a list of Lambda Functions.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# aws_lambda_functions
+
+Terraform data resource to get a list of Lambda Functions.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsLambdaFunctions } from "./.gen/providers/aws/data-aws-lambda-functions";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsLambdaFunctions(this, "all", {});
+  }
+}
+
+```
+
+## Argument Reference
+
+The resource does not support any arguments.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `functionNames` - A list of Lambda Function names.
+* `functionArns` - A list of Lambda Function ARNs.
+
+<!-- cache-key: cdktf-0.18.0 input-9ccb856a004c433861654de03521b43801920ad0f1aab4468643725a2469eb74 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/lambda_invocation.html.markdown b/website/docs/cdktf/typescript/d/lambda_invocation.html.markdown
new file mode 100644
index 00000000000..5276abe7eb5
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/lambda_invocation.html.markdown
@@ -0,0 +1,60 @@
+---
+subcategory: "Lambda"
+layout: "aws"
+page_title: "AWS: aws_lambda_invocation"
+description: |-
+  Invoke AWS Lambda Function as data source
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_lambda_invocation
+
+Use this data source to invoke custom lambda functions as data source.
+The lambda function is invoked with [RequestResponse](https://docs.aws.amazon.com/lambda/latest/dg/API_Invoke.html#API_Invoke_RequestSyntax)
+invocation type.
+
+~> **NOTE:** If you get a `KMSAccessDeniedException: Lambda was unable to decrypt the environment variables because KMS access was denied` error when invoking an [`awsLambdaFunction`](/docs/providers/aws/r/lambda_function.html) with environment variables, the IAM role associated with the function may have been deleted and recreated _after_ the function was created. You can fix the problem two ways: 1) updating the function's role to another role and then updating it back again to the recreated role, or 2) by using Terraform to `taint` the function and `apply` your configuration again to recreate the function. (When you create a function, Lambda grants permissions on the KMS key to the function's IAM role. If the IAM role is recreated, the grant is no longer valid. Changing the function's role or recreating the function causes Lambda to update the grant.)
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformOutput, Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsLambdaInvocation } from "./.gen/providers/aws/data-aws-lambda-invocation";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new DataAwsLambdaInvocation(this, "example", {
+      functionName: lambdaFunctionTest.functionName,
+      input: '{\n  "key1": "value1",\n  "key2": "value2"\n}\n\n',
+    });
+    new TerraformOutput(this, "result_entry", {
+      value: Fn.lookupNested(Fn.jsondecode(Token.asString(example.result)), [
+        '"key1"',
+      ]),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `functionName` - (Required) Name of the lambda function.
+* `input` - (Required) String in JSON format that is passed as payload to the lambda function.
+* `qualifier` - (Optional) Qualifier (a.k.a version) of the lambda function. Defaults
+ to `$latest`.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `result` - String result of the lambda function invocation.
+
+<!-- cache-key: cdktf-0.18.0 input-858416cde9289de24a6c4454bdaf3179b1c69d4515be797eefce2b9c352ef2b3 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/lambda_layer_version.html.markdown b/website/docs/cdktf/typescript/d/lambda_layer_version.html.markdown
new file mode 100644
index 00000000000..3b5a3dd397a
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/lambda_layer_version.html.markdown
@@ -0,0 +1,71 @@
+---
+subcategory: "Lambda"
+layout: "aws"
+page_title: "AWS: aws_lambda_layer_version"
+description: |-
+  Provides a Lambda Layer Version data source.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# aws_lambda_layer_version
+
+Provides information about a Lambda Layer Version.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { VariableType, TerraformVariable, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsLambdaLayerVersion } from "./.gen/providers/aws/data-aws-lambda-layer-version";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    /*Terraform Variables are not always the best fit for getting inputs in the context of Terraform CDK.
+    You can read more about this at https://cdk.tf/variables*/
+    const layerName = new TerraformVariable(this, "layer_name", {
+      type: VariableType.STRING,
+    });
+    new DataAwsLambdaLayerVersion(this, "existing", {
+      layerName: layerName.stringValue,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `layerName` - (Required) Name of the lambda layer.
+* `version` - (Optional) Specific layer version. Conflicts with `compatibleRuntime` and `compatibleArchitecture`. If omitted, the latest available layer version will be used.
+* `compatibleRuntime` (Optional) Specific runtime the layer version must support. Conflicts with `version`. If specified, the latest available layer version supporting the provided runtime will be used.
+* `compatibleArchitecture` (Optional) Specific architecture the layer version could support. Conflicts with `version`. If specified, the latest available layer version supporting the provided architecture will be used.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `description` - Description of the specific Lambda Layer version.
+* `licenseInfo` - License info associated with the specific Lambda Layer version.
+* `compatibleRuntimes` - List of [Runtimes][1] the specific Lambda Layer version is compatible with.
+* `compatibleArchitectures` - A list of [Architectures][2] the specific Lambda Layer version is compatible with.
+* `arn` - ARN of the Lambda Layer with version.
+* `layerArn` - ARN of the Lambda Layer without version.
+* `createdDate` - Date this resource was created.
+* `signingJobArn` - ARN of a signing job.
+* `signingProfileVersionArn` - The ARN for a signing profile version.
+* `sourceCodeHash` - Base64-encoded representation of raw SHA-256 sum of the zip file.
+* `sourceCodeSize` - Size in bytes of the function .zip file.
+* `version` - This Lamba Layer version.
+
+[1]: https://docs.aws.amazon.com/lambda/latest/dg/API_GetLayerVersion.html#SSS-GetLayerVersion-response-CompatibleRuntimes
+[2]: https://docs.aws.amazon.com/lambda/latest/dg/API_GetLayerVersion.html#SSS-GetLayerVersion-response-CompatibleArchitectures
+
+<!-- cache-key: cdktf-0.18.0 input-69ef06c57b86008a1c6e25d93dabac271b612b904a1a89dbe3fd5507d10e6742 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/launch_configuration.html.markdown b/website/docs/cdktf/typescript/d/launch_configuration.html.markdown
new file mode 100644
index 00000000000..c673231e1fa
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/launch_configuration.html.markdown
@@ -0,0 +1,95 @@
+---
+subcategory: "Auto Scaling"
+layout: "aws"
+page_title: "AWS: aws_launch_configuration"
+description: |-
+  Provides a Launch Configuration data source.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_launch_configuration
+
+Provides information about a Launch Configuration.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsLaunchConfiguration } from "./.gen/providers/aws/data-aws-launch-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsLaunchConfiguration(this, "ubuntu", {
+      name: "test-launch-config",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name of the launch configuration.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the launch configuration.
+* `arn` - Amazon Resource Name of the launch configuration.
+* `name` - Name of the launch configuration.
+* `imageId` - EC2 Image ID of the instance.
+* `instanceType` - Instance Type of the instance to launch.
+* `iamInstanceProfile` - The IAM Instance Profile to associate with launched instances.
+* `keyName` - Key Name that should be used for the instance.
+* `metadataOptions` - Metadata options for the instance.
+    * `httpEndpoint` - State of the metadata service: `enabled`, `disabled`.
+    * `httpTokens` - If session tokens are required: `optional`, `required`.
+    * `httpPutResponseHopLimit` - The desired HTTP PUT response hop limit for instance metadata requests.
+* `securityGroups` - List of associated Security Group IDS.
+* `associatePublicIpAddress` - Whether a Public IP address is associated with the instance.
+* `userData` - User Data of the instance.
+* `enableMonitoring` - Whether Detailed Monitoring is Enabled.
+* `ebsOptimized` - Whether the launched EC2 instance will be EBS-optimized.
+* `rootBlockDevice` - Root Block Device of the instance.
+* `ebsBlockDevice` - EBS Block Devices attached to the instance.
+* `ephemeralBlockDevice` - The Ephemeral volumes on the instance.
+* `spotPrice` - Price to use for reserving Spot instances.
+* `placementTenancy` - Tenancy of the instance.
+
+`rootBlockDevice` is exported with the following attributes:
+
+* `deleteOnTermination` - Whether the EBS Volume will be deleted on instance termination.
+* `encrypted` - Whether the volume is Encrypted.
+* `iops` - Provisioned IOPs of the volume.
+* `throughput` - Throughput of the volume.
+* `volumeSize` - Size of the volume.
+* `volumeType` - Type of the volume.
+
+`ebsBlockDevice` is exported with the following attributes:
+
+* `deleteOnTermination` - Whether the EBS Volume will be deleted on instance termination.
+* `deviceName` - Name of the device.
+* `encrypted` - Whether the volume is Encrypted.
+* `iops` - Provisioned IOPs of the volume.
+* `noDevice` - Whether the device in the block device mapping of the AMI is suppressed.
+* `snapshotId` - Snapshot ID of the mount.
+* `throughput` - Throughput of the volume.
+* `volumeSize` - Size of the volume.
+* `volumeType` - Type of the volume.
+
+`ephemeralBlockDevice` is exported with the following attributes:
+
+* `deviceName` - Name of the device.
+* `virtualName` - Virtual Name of the device.
+
+<!-- cache-key: cdktf-0.18.0 input-e1cd93bfea359bae7e967acc82a26e1a08ef38531f91dbee6e143392ac081f6b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/launch_template.html.markdown b/website/docs/cdktf/typescript/d/launch_template.html.markdown
new file mode 100644
index 00000000000..61e3f5cf14d
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/launch_template.html.markdown
@@ -0,0 +1,94 @@
+---
+subcategory: "EC2 (Elastic Compute Cloud)"
+layout: "aws"
+page_title: "AWS: aws_launch_template"
+description: |-
+  Provides a Launch Template data source.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_launch_template
+
+Provides information about a Launch Template.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsLaunchTemplate } from "./.gen/providers/aws/data-aws-launch-template";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsLaunchTemplate(this, "default", {
+      name: "my-launch-template",
+    });
+  }
+}
+
+```
+
+### Filter
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsLaunchTemplate } from "./.gen/providers/aws/data-aws-launch-template";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsLaunchTemplate(this, "test", {
+      filter: [
+        {
+          name: "launch-template-name",
+          values: ["some-template"],
+        },
+      ],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `filter` - (Optional) Configuration block(s) for filtering. Detailed below.
+* `id` - (Optional) ID of the specific launch template to retrieve.
+* `name` - (Optional) Name of the launch template.
+* `tags` - (Optional) Map of tags, each pair of which must exactly match a pair on the desired Launch Template.
+
+### filter Configuration Block
+
+The `filter` configuration block supports the following arguments:
+
+* `name` - (Required) Name of the filter field. Valid values can be found in the [EC2 DescribeLaunchTemplates API Reference](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeLaunchTemplates.html).
+* `values` - (Required) Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the launch template.
+
+This resource also exports a full set of attributes corresponding to the arguments of the [`awsLaunchTemplate`](/docs/providers/aws/r/launch_template.html) resource.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `20M`)
+
+<!-- cache-key: cdktf-0.18.0 input-ac085ab2a2118f2f53ba9bc1952c11c28381c52f43860ff26cbf46d376ef67e8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/lb.html.markdown b/website/docs/cdktf/typescript/d/lb.html.markdown
new file mode 100644
index 00000000000..9a01cfcafd5
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/lb.html.markdown
@@ -0,0 +1,75 @@
+---
+subcategory: "ELB (Elastic Load Balancing)"
+layout: "aws"
+page_title: "AWS: aws_lb"
+description: |-
+  Provides a Load Balancer data source.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_lb
+
+~> **Note:** `awsAlb` is known as `awsLb`. The functionality is identical.
+
+Provides information about a Load Balancer.
+
+This data source can prove useful when a module accepts an LB as an input
+variable and needs to, for example, determine the security groups associated
+with it, etc.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { VariableType, TerraformVariable, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsLb } from "./.gen/providers/aws/data-aws-lb";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    /*Terraform Variables are not always the best fit for getting inputs in the context of Terraform CDK.
+    You can read more about this at https://cdk.tf/variables*/
+    const lbArn = new TerraformVariable(this, "lb_arn", {
+      default: "",
+      type: VariableType.STRING,
+    });
+    const lbName = new TerraformVariable(this, "lb_name", {
+      default: "",
+      type: VariableType.STRING,
+    });
+    new DataAwsLb(this, "test", {
+      arn: lbArn.stringValue,
+      name: lbName.stringValue,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `arn` - (Optional) Full ARN of the load balancer.
+* `name` - (Optional) Unique name of the load balancer.
+* `tags` - (Optional) Mapping of tags, each pair of which must exactly match a pair on the desired load balancer.
+
+~> **NOTE:** When both `arn` and `name` are specified, `arn` takes precedence. `tags` has lowest precedence.
+
+## Attribute Reference
+
+See the [LB Resource](/docs/providers/aws/r/lb.html) for details on the
+returned attributes - they are identical.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `20M`)
+
+<!-- cache-key: cdktf-0.18.0 input-d467ed08bca93285eac24021220c51e2af88e8f7994426dedafb4e67c7ce3e5a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/lb_hosted_zone_id.html.markdown b/website/docs/cdktf/typescript/d/lb_hosted_zone_id.html.markdown
new file mode 100644
index 00000000000..1ebc857afc8
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/lb_hosted_zone_id.html.markdown
@@ -0,0 +1,59 @@
+---
+subcategory: "ELB (Elastic Load Balancing)"
+layout: "aws"
+page_title: "AWS: aws_lb_hosted_zone_id"
+description: |-
+  Provides AWS Elastic Load Balancing Hosted Zone Id
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_lb_hosted_zone_id
+
+Use this data source to get the HostedZoneId of the AWS Elastic Load Balancing (ELB) in a given region for the purpose of using in an AWS Route53 Alias. Specify the ELB type (`network` or `application`) to return the relevant the associated HostedZoneId. Ref: [ELB service endpoints](https://docs.aws.amazon.com/general/latest/gr/elb.html#elb_region)
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsLbHostedZoneId } from "./.gen/providers/aws/data-aws-lb-hosted-zone-id";
+import { Route53Record } from "./.gen/providers/aws/route53-record";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const main = new DataAwsLbHostedZoneId(this, "main", {});
+    new Route53Record(this, "www", {
+      alias: {
+        evaluateTargetHealth: true,
+        name: Token.asString(awsLbMain.dnsName),
+        zoneId: Token.asString(main.id),
+      },
+      name: "example.com",
+      type: "A",
+      zoneId: primary.zoneId,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `region` - (Optional) Name of the region whose AWS ELB HostedZoneId is desired.
+  Defaults to the region from the AWS provider configuration.
+
+* `loadBalancerType` - (Optional) Type of load balancer to create. Possible values are `application` or `network`. The default value is `application`.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the AWS ELB HostedZoneId in the selected region.
+
+<!-- cache-key: cdktf-0.18.0 input-20d3ff7ccd02c50f477bfaf817b623cdbb551c7595c79a649d2e2c4d5256df5a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/lb_listener.html.markdown b/website/docs/cdktf/typescript/d/lb_listener.html.markdown
new file mode 100644
index 00000000000..7aad1759531
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/lb_listener.html.markdown
@@ -0,0 +1,72 @@
+---
+subcategory: "ELB (Elastic Load Balancing)"
+layout: "aws"
+page_title: "AWS: aws_lb_listener"
+description: |-
+  Provides a Load Balancer Listener data source.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_lb_listener
+
+~> **Note:** `awsAlbListener` is known as `awsLbListener`. The functionality is identical.
+
+Provides information about a Load Balancer Listener.
+
+This data source can prove useful when a module accepts an LB Listener as an input variable and needs to know the LB it is attached to, or other information specific to the listener in question.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { VariableType, TerraformVariable, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsLb } from "./.gen/providers/aws/data-aws-lb";
+import { DataAwsLbListener } from "./.gen/providers/aws/data-aws-lb-listener";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    /*Terraform Variables are not always the best fit for getting inputs in the context of Terraform CDK.
+    You can read more about this at https://cdk.tf/variables*/
+    const listenerArn = new TerraformVariable(this, "listener_arn", {
+      type: VariableType.STRING,
+    });
+    const selected = new DataAwsLb(this, "selected", {
+      name: "default-public",
+    });
+    new DataAwsLbListener(this, "listener", {
+      arn: listenerArn.stringValue,
+    });
+    new DataAwsLbListener(this, "selected443", {
+      loadBalancerArn: Token.asString(selected.arn),
+      port: 443,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `arn` - (Optional) ARN of the listener. Required if `loadBalancerArn` and `port` is not set.
+* `loadBalancerArn` - (Optional) ARN of the load balancer. Required if `arn` is not set.
+* `port` - (Optional) Port of the listener. Required if `arn` is not set.
+
+## Attribute Reference
+
+See the [LB Listener Resource](/docs/providers/aws/r/lb_listener.html) for details on the returned attributes - they are identical.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `20M`)
+
+<!-- cache-key: cdktf-0.18.0 input-211bbf8f48d3f19292f3ee8b224115fe3e52e8fa4345ea857f3fb1459aff8016 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/lb_target_group.html.markdown b/website/docs/cdktf/typescript/d/lb_target_group.html.markdown
new file mode 100644
index 00000000000..4a56ff5a2d2
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/lb_target_group.html.markdown
@@ -0,0 +1,75 @@
+---
+subcategory: "ELB (Elastic Load Balancing)"
+layout: "aws"
+page_title: "AWS: aws_lb_target_group"
+description: |-
+  Provides a Load Balancer Target Group data source.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_lb_target_group
+
+~> **Note:** `awsAlbTargetGroup` is known as `awsLbTargetGroup`. The functionality is identical.
+
+Provides information about a Load Balancer Target Group.
+
+This data source can prove useful when a module accepts an LB Target Group as an
+input variable and needs to know its attributes. It can also be used to get the ARN of
+an LB Target Group for use in other resources, given LB Target Group name.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { VariableType, TerraformVariable, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsLbTargetGroup } from "./.gen/providers/aws/data-aws-lb-target-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    /*Terraform Variables are not always the best fit for getting inputs in the context of Terraform CDK.
+    You can read more about this at https://cdk.tf/variables*/
+    const lbTgArn = new TerraformVariable(this, "lb_tg_arn", {
+      default: "",
+      type: VariableType.STRING,
+    });
+    const lbTgName = new TerraformVariable(this, "lb_tg_name", {
+      default: "",
+      type: VariableType.STRING,
+    });
+    new DataAwsLbTargetGroup(this, "test", {
+      arn: lbTgArn.stringValue,
+      name: lbTgName.stringValue,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `arn` - (Optional) Full ARN of the target group.
+* `name` - (Optional) Unique name of the target group.
+* `tags` - (Optional) Mapping of tags, each pair of which must exactly match a pair on the desired target group.
+
+~> **NOTE:** When both `arn` and `name` are specified, `arn` takes precedence. `tags` has the lowest precedence.
+
+## Attribute Reference
+
+See the [LB Target Group Resource](/docs/providers/aws/r/lb_target_group.html) for details
+on the returned attributes - they are identical.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `20M`)
+
+<!-- cache-key: cdktf-0.18.0 input-18d6438e76c4e840091b23075a92bb955f78f2636fef33c88e5dc205c842a9c5 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/lbs.html.markdown b/website/docs/cdktf/typescript/d/lbs.html.markdown
new file mode 100644
index 00000000000..d5d7531cb5b
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/lbs.html.markdown
@@ -0,0 +1,55 @@
+---
+subcategory: "ELB (Elastic Load Balancing)"
+layout: "aws"
+page_title: "AWS: aws_lbs"
+description: |-
+    Data source for managing an AWS ELB (Elastic Load Balancing) Load Balancers.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_lbs
+
+Use this data source to get a list of Load Balancer ARNs matching the specified criteria. Useful for passing to other
+resources.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsLbs } from "./.gen/providers/aws/data-aws-lbs";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsLbs(this, "example", {
+      tags: {
+        "elbv2.k8s.aws/cluster": "my-cluster",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are optional:
+
+* `tags` - (Optional) Map of tags, each pair of which must exactly match
+   a pair on the desired Load Balancers.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arns` - Set of Load Balancer ARNs.
+
+<!-- cache-key: cdktf-0.18.0 input-2b2d69eb4a83af0e4fd4598a4f15f892a66e64c59168aa5e187aabae838abca7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/lex_bot.html.markdown b/website/docs/cdktf/typescript/d/lex_bot.html.markdown
new file mode 100644
index 00000000000..2fc5ba88187
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/lex_bot.html.markdown
@@ -0,0 +1,66 @@
+---
+subcategory: "Lex Model Building"
+layout: "aws"
+page_title: "AWS: aws_lex_bot"
+description: |-
+  Provides details about a specific Lex Bot
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_lex_bot
+
+Provides details about a specific Amazon Lex Bot.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsLexBot } from "./.gen/providers/aws/data-aws-lex-bot";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsLexBot(this, "order_flowers_bot", {
+      name: "OrderFlowers",
+      version: "$LATEST",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name of the bot. The name is case sensitive.
+* `version` - (Optional) Version or alias of the bot.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the bot.
+* `checksum` - Checksum of the bot used to identify a specific revision of the bot's `$latest` version.
+* `childDirected` - If this Amazon Lex Bot is related to a website, program, or other application that is directed or targeted, in whole or in part, to children under age 13 and subject to COPPA.
+* `createdDate` - Date that the bot was created.
+* `description` - Description of the bot.
+* `detectSentiment` - When set to true user utterances are sent to Amazon Comprehend for sentiment analysis.
+* `enableModelImprovements` - Set to true if natural language understanding improvements are enabled.
+* `failureReason` - If the `status` is `failed`, the reason why the bot failed to build.
+* `idleSessionTtlInSeconds` - The maximum time in seconds that Amazon Lex retains the data gathered in a conversation.
+* `lastUpdatedDate` - Date that the bot was updated.
+* `locale` - Target locale for the bot. Any intent used in the bot must be compatible with the locale of the bot.
+* `name` - Name of the bot, case sensitive.
+* `nluIntentConfidenceThreshold` - The threshold where Amazon Lex will insert the AMAZON.FallbackIntent, AMAZON.KendraSearchIntent, or both when returning alternative intents in a PostContent or PostText response. AMAZON.FallbackIntent and AMAZON.KendraSearchIntent are only inserted if they are configured for the bot.
+* `status` - Status of the bot.
+* `version` - Version of the bot. For a new bot, the version is always `$latest`.
+* `voiceId` - Amazon Polly voice ID that the Amazon Lex Bot uses for voice interactions with the user.
+
+<!-- cache-key: cdktf-0.18.0 input-5ef089ea17f3e167b9e877fe3394478af9b492a4da2e1d52a05076e5bbbba4a7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/lex_bot_alias.html.markdown b/website/docs/cdktf/typescript/d/lex_bot_alias.html.markdown
new file mode 100644
index 00000000000..280b6104604
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/lex_bot_alias.html.markdown
@@ -0,0 +1,58 @@
+---
+subcategory: "Lex Model Building"
+layout: "aws"
+page_title: "AWS: aws_lex_bot_alias"
+description: |-
+  Provides details about a specific Lex Bot Alias
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_lex_bot_alias
+
+Provides details about a specific Amazon Lex Bot Alias.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsLexBotAlias } from "./.gen/providers/aws/data-aws-lex-bot-alias";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsLexBotAlias(this, "order_flowers_prod", {
+      botName: "OrderFlowers",
+      name: "OrderFlowersProd",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `botName` - (Required) Name of the bot.
+* `name` - (Required) Name of the bot alias. The name is case sensitive.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the bot alias.
+* `botName` - Name of the bot.
+* `botVersion` - Version of the bot that the alias points to.
+* `checksum` - Checksum of the bot alias.
+* `createdDate` - Date that the bot alias was created.
+* `description` - Description of the alias.
+* `lastUpdatedDate` - Date that the bot alias was updated. When you create a resource, the creation date and the last updated date are the same.
+* `name` - Name of the alias. The name is not case sensitive.
+
+<!-- cache-key: cdktf-0.18.0 input-d573a0e146ccf354bee54f1fcff29eb5da0fe86b28b2cac76717ab2331d57f06 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/lex_intent.html.markdown b/website/docs/cdktf/typescript/d/lex_intent.html.markdown
new file mode 100644
index 00000000000..770a3cdd6e4
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/lex_intent.html.markdown
@@ -0,0 +1,62 @@
+---
+subcategory: "Lex Model Building"
+layout: "aws"
+page_title: "AWS: aws_lex_intent"
+description: |-
+  Provides details about a specific Amazon Lex Intent
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_lex_intent
+
+Provides details about a specific Amazon Lex Intent.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsLexIntent } from "./.gen/providers/aws/data-aws-lex-intent";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsLexIntent(this, "order_flowers", {
+      name: "OrderFlowers",
+      version: "$LATEST",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name of the intent. The name is case sensitive.
+* `version` - (Optional) Version of the intent.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Lex intent.
+* `checksum` - Checksum identifying the version of the intent that was created. The checksum is not
+included as an argument because the resource will add it automatically when updating the intent.
+* `createdDate` - Date when the intent version was created.
+* `description` - Description of the intent.
+* `lastUpdatedDate` - Date when the $LATEST version of this intent was updated.
+* `name` - Name of the intent, not case sensitive.
+* `parentIntentSignature` - A unique identifier for the built-in intent to base this
+intent on. To find the signature for an intent, see
+[Standard Built-in Intents](https://developer.amazon.com/public/solutions/alexa/alexa-skills-kit/docs/built-in-intent-ref/standard-intents)
+in the Alexa Skills Kit.
+* `version` - Version of the bot.
+
+<!-- cache-key: cdktf-0.18.0 input-394febf4c4d3edc4f0f324ec428dd4c71cb4d4a42df62b636f04fd735f6f2cf7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/lex_slot_type.html.markdown b/website/docs/cdktf/typescript/d/lex_slot_type.html.markdown
new file mode 100644
index 00000000000..3b22a61bd37
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/lex_slot_type.html.markdown
@@ -0,0 +1,64 @@
+---
+subcategory: "Lex Model Building"
+layout: "aws"
+page_title: "AWS: aws_lex_slot_type"
+description: |-
+  Provides details about a specific Amazon Lex Slot Type
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_lex_slot_type
+
+Provides details about a specific Amazon Lex Slot Type.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsLexSlotType } from "./.gen/providers/aws/data-aws-lex-slot-type";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsLexSlotType(this, "flower_types", {
+      name: "FlowerTypes",
+      version: "1",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name of the slot type. The name is case sensitive.
+* `version` - (Optional) Version of the slot type.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `checksum` - Checksum identifying the version of the slot type that was created. The checksum is
+not included as an argument because the resource will add it automatically when updating the slot type.
+* `createdDate` - Date when the slot type version was created.
+* `description` - Description of the slot type.
+* `enumerationValue` - Set of EnumerationValue objects that defines the values that
+the slot type can take. Each value can have a set of synonyms, which are additional values that help
+train the machine learning model about the values that it resolves for a slot.
+* `lastUpdatedDate` - Date when the $LATEST version of this slot type was updated.
+* `name` - Name of the slot type. The name is not case sensitive.
+* `valueSelectionStrategy` - Determines the slot resolution strategy that Amazon Lex
+uses to return slot type values. `originalValue` returns the value entered by the user if the user
+value is similar to the slot value. `topResolution` returns the first value in the resolution list
+if there is a resolution list for the slot, otherwise null is returned.
+* `version` - Version of the slot type.
+
+<!-- cache-key: cdktf-0.18.0 input-49d6a5803a0366ff33a06d9d299d17bb3b22f57aa09b8faad79c4b2c1781df65 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/licensemanager_grants.html.markdown b/website/docs/cdktf/typescript/d/licensemanager_grants.html.markdown
new file mode 100644
index 00000000000..84fcc922037
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/licensemanager_grants.html.markdown
@@ -0,0 +1,90 @@
+---
+subcategory: "License Manager"
+layout: "aws"
+page_title: "AWS: aws_licensemanager_grants"
+description: |-
+    Get information about a set of license manager grant licenses
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_licensemanager_grants
+
+This resource can be used to get a set of license grant ARNs matching a filter.
+
+## Example Usage
+
+The following shows getting all license grant ARNs granted to your account.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCallerIdentity } from "./.gen/providers/aws/data-aws-caller-identity";
+import { DataAwsLicensemanagerGrants } from "./.gen/providers/aws/data-aws-licensemanager-grants";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const current = new DataAwsCallerIdentity(this, "current", {});
+    new DataAwsLicensemanagerGrants(this, "test", {
+      filter: [
+        {
+          name: "GranteePrincipalARN",
+          values: ["arn:aws:iam::${" + current.accountId + "}:root"],
+        },
+      ],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `filter` - (Optional) Custom filter block as described below.
+
+More complex filters can be expressed using one or more `filter` sub-blocks,
+which take the following arguments:
+
+* `name` - (Required) Name of the field to filter by, as defined by
+  [the underlying AWS API](https://docs.aws.amazon.com/license-manager/latest/APIReference/API_ListReceivedGrants.html#API_ListReceivedGrants_RequestSyntax).
+  For example, if filtering using `productSku`, use:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsLicensemanagerGrants } from "./.gen/providers/aws/data-aws-licensemanager-grants";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsLicensemanagerGrants(this, "selected", {
+      filter: [
+        {
+          name: "ProductSKU",
+          values: [""],
+        },
+      ],
+    });
+  }
+}
+
+```
+
+* `values` - (Required) Set of values that are accepted for the given field.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arns` - List of all the license grant ARNs found.
+
+<!-- cache-key: cdktf-0.18.0 input-9865dc418cc55462aa5e6fc80f9e8a92e3c35a931c3b06a21d23c361cfa3f823 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/licensemanager_received_license.html.markdown b/website/docs/cdktf/typescript/d/licensemanager_received_license.html.markdown
new file mode 100644
index 00000000000..e15c569df08
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/licensemanager_received_license.html.markdown
@@ -0,0 +1,125 @@
+---
+subcategory: "License Manager"
+layout: "aws"
+page_title: "AWS: aws_licensemanager_received_license"
+description: |-
+    Get information about a set of license manager received license
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_licensemanager_received_license
+
+This resource can be used to get data on a received license using an ARN. This can be helpful for pulling in data on a license from the AWS marketplace and sharing that license with another account.
+
+## Example Usage
+
+The following shows getting the received license data using and ARN.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsLicensemanagerReceivedLicense } from "./.gen/providers/aws/data-aws-licensemanager-received-license";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsLicensemanagerReceivedLicense(this, "test", {
+      licenseArn:
+        "arn:aws:license-manager::111111111111:license:l-ecbaa94eb71a4830b6d7e49268fecaa0",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `licenseArn` - (Required) The ARN of the received license you want data for.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - The received license ARN (Same as: `licenseArn`).
+* `beneficiary` - Granted license beneficiary. This is in the form of the ARN of the root user of the account.
+* `consumptionConfiguration` - Configuration for consumption of the license. [Detailed below](#consumption_configuration)
+* `createTime` - Creation time of the granted license in RFC 3339 format.
+* `entitlements` - License entitlements. [Detailed below](#entitlements)
+* `homeRegion` - Home Region of the granted license.
+* `issuer` - Granted license issuer. [Detailed below](#issuer)
+* `licenseArn` - Amazon Resource Name (ARN) of the license.
+* `licenseMetadata`- Granted license metadata. This is in the form of a set of all meta data. [Detailed below](#license_metadata)
+* `licenseName` - License name.
+* `productName` - Product name.
+* `product_sku ` - Product SKU.
+* `receivedMetadata` - Granted license received metadata. [Detailed below](#received_metadata)
+* `status` - Granted license status.
+* `validity` - Date and time range during which the granted license is valid, in ISO8601-UTC format. [Detailed below](#validity)
+* `version` - Version of the granted license.
+
+### consumption_configuration
+
+* `borrowConfiguration` - Details about a borrow configuration. [Detailed below](#borrow_configuration)
+* `provisionalConfiguration` - Details about a provisional configuration. [Detailed below](#provisional_configuration)
+* `renewalFrequency` - Renewal frequency.
+
+#### borrow_configuration
+
+A list with a single map.
+
+* `allowEarlyCheckIn` - Indicates whether early check-ins are allowed.
+* `maxTimeToLiveInMinutes` - Maximum time for the borrow configuration, in minutes.
+
+#### provisional_configuration
+
+A list with a single map.
+
+* `maxTimeToLiveInMinutes` - Maximum time for the provisional configuration, in minutes.
+
+### entitlements
+
+A list with a single map.
+
+* `allowCheckIn` - Indicates whether check-ins are allowed.
+* `maxCount` - Maximum entitlement count. Use if the unit is not None.
+* `name` - Entitlement name.
+* `overage` - Indicates whether overages are allowed.
+* `unit` - Entitlement unit.
+* `value` - Entitlement resource. Use only if the unit is None.
+
+### issuer
+
+A list with a single map.
+
+* `keyFingerprint` - Issuer key fingerprint.
+* `name` - Issuer name.
+* `signKey` - Asymmetric KMS key from AWS Key Management Service. The KMS key must have a key usage of sign and verify, and support the RSASSA-PSS SHA-256 signing algorithm.
+
+### license_metadata
+
+Each metadata item will have the following attributes.
+
+* `name` - The key name.
+* `value` - The value.
+
+### received_metadata
+
+A list with a single map.
+
+* `allowedOperations` - A list of allowed operations.
+* `receivedStatus` - Received status.
+* `receivedStatusReason` - Received status reason.
+
+### validity
+
+A list with a single map.
+
+* `begin` - Start of the validity time range.
+* `end` - End of the validity time range.
+
+<!-- cache-key: cdktf-0.18.0 input-8e7789e1a13e838a8446f36566c96cb32c65c9068530cd596b7f17f7e9d88382 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/licensemanager_received_licenses.html.markdown b/website/docs/cdktf/typescript/d/licensemanager_received_licenses.html.markdown
new file mode 100644
index 00000000000..194af5ea60b
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/licensemanager_received_licenses.html.markdown
@@ -0,0 +1,88 @@
+---
+subcategory: "License Manager"
+layout: "aws"
+page_title: "AWS: aws_licensemanager_received_licenses"
+description: |-
+    Get information about a set of license manager received licenses
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_licensemanager_received_licenses
+
+This resource can be used to get a set of license ARNs matching a filter.
+
+## Example Usage
+
+The following shows getting all license ARNs issued from the AWS marketplace. Providing no filter, would provide all license ARNs for the entire account.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsLicensemanagerReceivedLicenses } from "./.gen/providers/aws/data-aws-licensemanager-received-licenses";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsLicensemanagerReceivedLicenses(this, "test", {
+      filter: [
+        {
+          name: "IssuerName",
+          values: ["AWS/Marketplace"],
+        },
+      ],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `filter` - (Optional) Custom filter block as described below.
+
+More complex filters can be expressed using one or more `filter` sub-blocks,
+which take the following arguments:
+
+* `name` - (Required) Name of the field to filter by, as defined by
+  [the underlying AWS API](https://docs.aws.amazon.com/license-manager/latest/APIReference/API_ListReceivedLicenses.html#API_ListReceivedLicenses_RequestSyntax).
+  For example, if filtering using `productSku`, use:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsLicensemanagerReceivedLicenses } from "./.gen/providers/aws/data-aws-licensemanager-received-licenses";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsLicensemanagerReceivedLicenses(this, "selected", {
+      filter: [
+        {
+          name: "ProductSKU",
+          values: [""],
+        },
+      ],
+    });
+  }
+}
+
+```
+
+* `values` - (Required) Set of values that are accepted for the given field.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arns` - List of all the license ARNs found.
+
+<!-- cache-key: cdktf-0.18.0 input-9e7d7fb591954c8a5486067c8e8ee9eec8da84299f8bb0a76f259725c8df90f0 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/location_geofence_collection.html.markdown b/website/docs/cdktf/typescript/d/location_geofence_collection.html.markdown
new file mode 100644
index 00000000000..7fc453abd79
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/location_geofence_collection.html.markdown
@@ -0,0 +1,56 @@
+---
+subcategory: "Location"
+layout: "aws"
+page_title: "AWS: aws_location_geofence_collection"
+description: |-
+    Retrieve information about a Location Service Geofence Collection.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_location_geofence_collection
+
+Retrieve information about a Location Service Geofence Collection.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsLocationGeofenceCollection } from "./.gen/providers/aws/data-aws-location-geofence-collection";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsLocationGeofenceCollection(this, "example", {
+      collectionName: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `collectionName` - (Required) Name of the geofence collection.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `collectionArn` - ARN for the geofence collection resource. Used when you need to specify a resource across all AWS.
+* `createTime` - Timestamp for when the geofence collection resource was created in ISO 8601 format.
+* `description` - Optional description of the geofence collection resource.
+* `kmsKeyId` - Key identifier for an AWS KMS customer managed key assigned to the Amazon Location resource.
+* `tags` - Key-value map of resource tags for the geofence collection.
+* `updateTime` - Timestamp for when the geofence collection resource was last updated in ISO 8601 format.
+
+<!-- cache-key: cdktf-0.18.0 input-412ec3161f32c61f58d8cc16f05d87cad980bf218e02a4e45e733843b249c8a5 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/location_map.html.markdown b/website/docs/cdktf/typescript/d/location_map.html.markdown
new file mode 100644
index 00000000000..8bd6ce0abd0
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/location_map.html.markdown
@@ -0,0 +1,53 @@
+---
+subcategory: "Location"
+layout: "aws"
+page_title: "AWS: aws_location_map"
+description: |-
+    Retrieve information about a Location Service Map.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_location_map
+
+Retrieve information about a Location Service Map.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsLocationMap } from "./.gen/providers/aws/data-aws-location-map";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsLocationMap(this, "example", {
+      mapName: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `mapName` - (Required) Name of the map resource.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `configuration` - List of configurations that specify the map tile style selected from a partner data provider.
+    * `style` - The map style selected from an available data provider.
+* `createTime` - Timestamp for when the map resource was created in ISO 8601 format.
+* `description` - Optional description for the map resource.
+* `mapArn` - ARN for the map resource.
+* `tags` - Key-value map of resource tags for the map.
+* `updateTime` - Timestamp for when the map resource was last updated in ISO 8601 format.
+
+<!-- cache-key: cdktf-0.18.0 input-0b7e671677f6b40d5b7e281bcc7a2f6d4c9948b32cc48282e4c534b54ca5d4c4 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/location_place_index.html.markdown b/website/docs/cdktf/typescript/d/location_place_index.html.markdown
new file mode 100644
index 00000000000..aba60c2f07d
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/location_place_index.html.markdown
@@ -0,0 +1,53 @@
+---
+subcategory: "Location"
+layout: "aws"
+page_title: "AWS: aws_location_place_index"
+description: |-
+    Retrieve information about a Location Service Place Index.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_location_place_index
+
+Retrieve information about a Location Service Place Index.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsLocationPlaceIndex } from "./.gen/providers/aws/data-aws-location-place-index";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsLocationPlaceIndex(this, "example", {
+      indexName: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `indexName` - (Required) Name of the place index resource.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `createTime` - Timestamp for when the place index resource was created in ISO 8601 format.
+* `dataSource` - Data provider of geospatial data.
+* `dataSourceConfiguration` - List of configurations that specify data storage option for requesting Places.
+* `description` - Optional description for the place index resource.
+* `indexArn` - ARN for the place index resource.
+* `tags` - Key-value map of resource tags for the place index.
+* `updateTime` - Timestamp for when the place index resource was last updated in ISO 8601 format.
+
+<!-- cache-key: cdktf-0.18.0 input-6bb9def3cfd4a1197d25303ba5cc4f3cedb296a92274d37e9697b77dc7cadbf8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/location_route_calculator.html.markdown b/website/docs/cdktf/typescript/d/location_route_calculator.html.markdown
new file mode 100644
index 00000000000..52829e12281
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/location_route_calculator.html.markdown
@@ -0,0 +1,52 @@
+---
+subcategory: "Location"
+layout: "aws"
+page_title: "AWS: aws_location_route_calculator"
+description: |-
+    Retrieve information about a Location Service Route Calculator.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_location_route_calculator
+
+Retrieve information about a Location Service Route Calculator.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsLocationRouteCalculator } from "./.gen/providers/aws/data-aws-location-route-calculator";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsLocationRouteCalculator(this, "example", {
+      calculatorName: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `calculatorName` - (Required) Name of the route calculator resource.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `calculatorArn` - ARN for the Route calculator resource. Use the ARN when you specify a resource across AWS.
+* `createTime` - Timestamp for when the route calculator resource was created in ISO 8601 format.
+* `dataSource` - Data provider of traffic and road network data.
+* `description` - Optional description of the route calculator resource.
+* `tags` - Key-value map of resource tags for the route calculator.
+* `updateTime` - Timestamp for when the route calculator resource was last updated in ISO 8601 format.
+
+<!-- cache-key: cdktf-0.18.0 input-dbfd8c367adb84b100d0300c89a12d823bcce0e79dfac69eed691750faab5b7b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/location_tracker.html.markdown b/website/docs/cdktf/typescript/d/location_tracker.html.markdown
new file mode 100644
index 00000000000..c8886f4d9ea
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/location_tracker.html.markdown
@@ -0,0 +1,53 @@
+---
+subcategory: "Location"
+layout: "aws"
+page_title: "AWS: aws_location_tracker"
+description: |-
+    Retrieve information about a Location Service Tracker.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_location_tracker
+
+Retrieve information about a Location Service Tracker.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsLocationTracker } from "./.gen/providers/aws/data-aws-location-tracker";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsLocationTracker(this, "example", {
+      trackerName: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `trackerName` - (Required) Name of the tracker resource.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `createTime` - Timestamp for when the tracker resource was created in ISO 8601 format.
+* `description` - Optional description for the tracker resource.
+* `kmsKeyId` - Key identifier for an AWS KMS customer managed key assigned to the Amazon Location resource.
+* `positionFiltering` - Position filtering method of the tracker resource.
+* `tags` - Key-value map of resource tags for the tracker.
+* `trackerArn` - ARN for the tracker resource. Used when you need to specify a resource across all AWS.
+* `updateTime` - Timestamp for when the tracker resource was last updated in ISO 8601 format.
+
+<!-- cache-key: cdktf-0.18.0 input-2209c57d7bd3b53aad44711d9b9e303cfc1662ea048bfb66d4abc6ef0052fc42 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/location_tracker_association.html.markdown b/website/docs/cdktf/typescript/d/location_tracker_association.html.markdown
new file mode 100644
index 00000000000..59c798e37c9
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/location_tracker_association.html.markdown
@@ -0,0 +1,52 @@
+---
+subcategory: "Location"
+layout: "aws"
+page_title: "AWS: aws_location_tracker_association"
+description: |-
+    Retrieve information about a Location Service Tracker Association.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_location_tracker_association
+
+Retrieve information about a Location Service Tracker Association.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsLocationTrackerAssociation } from "./.gen/providers/aws/data-aws-location-tracker-association";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsLocationTrackerAssociation(this, "example", {
+      consumerArn:
+        "arn:aws:geo:region:account-id:geofence-collection/ExampleGeofenceCollectionConsumer",
+      trackerName: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `consumerArn` - (Required) ARN of the geofence collection associated to tracker resource.
+* `trackerName` - (Required) Name of the tracker resource associated with a geofence collection.
+
+## Attribute Reference
+
+This data source exports no additional attributes.
+
+<!-- cache-key: cdktf-0.18.0 input-6af42e44615a0ca8da0850e3473b78cfb0b5edd6184e26e8d3695a1276214a1c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/location_tracker_associations.html.markdown b/website/docs/cdktf/typescript/d/location_tracker_associations.html.markdown
new file mode 100644
index 00000000000..179581b5ff9
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/location_tracker_associations.html.markdown
@@ -0,0 +1,51 @@
+---
+subcategory: "Location"
+layout: "aws"
+page_title: "AWS: aws_location_tracker_associations"
+description: |-
+    Retrieve information about Location Service Tracker Associations.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_location_tracker_associations
+
+Retrieve information about Location Service Tracker Associations.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsLocationTrackerAssociations } from "./.gen/providers/aws/data-aws-location-tracker-associations";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsLocationTrackerAssociations(this, "example", {
+      trackerName: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `trackerName` - (Required) Name of the tracker resource associated with a geofence collection.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `consumerArns` - List of geofence collection ARNs associated to the tracker resource.
+
+<!-- cache-key: cdktf-0.18.0 input-985e01b9b103d7b11889f5262870dbe1204cdfd00040b816e3dccd74a599b9b9 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/media_convert_queue.html.markdown b/website/docs/cdktf/typescript/d/media_convert_queue.html.markdown
new file mode 100644
index 00000000000..5aa29b90518
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/media_convert_queue.html.markdown
@@ -0,0 +1,50 @@
+---
+subcategory: "Elemental MediaConvert"
+layout: "aws"
+page_title: "AWS: aws_media_convert_queue"
+description: |-
+  Retrieve information about a AWS Elemental MediaConvert Queue.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_media_convert_queue
+
+Retrieve information about a AWS Elemental MediaConvert Queue.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsMediaConvertQueue } from "./.gen/providers/aws/data-aws-media-convert-queue";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsMediaConvertQueue(this, "example", {
+      id: "tf-example-queue",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `id` - (Required) Unique identifier of the queue. The same as `name`.
+
+## Attributes Reference
+
+* `arn` - The Arn of the queue.
+* `name` - The same as `id`.
+* `status` - The status of the queue.
+* `tags` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+<!-- cache-key: cdktf-0.18.0 input-cea02305ec5fbfab04de63ece53105b1232b24f60ce5c0d4c7c6b87963855d23 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/memorydb_acl.html.markdown b/website/docs/cdktf/typescript/d/memorydb_acl.html.markdown
new file mode 100644
index 00000000000..4094ecb017a
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/memorydb_acl.html.markdown
@@ -0,0 +1,53 @@
+---
+subcategory: "MemoryDB for Redis"
+layout: "aws"
+page_title: "AWS: aws_memorydb_acl"
+description: |-
+  Provides information about a MemoryDB ACL.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_memorydb_acl
+
+Provides information about a MemoryDB ACL.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsMemorydbAcl } from "./.gen/providers/aws/data-aws-memorydb-acl";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsMemorydbAcl(this, "example", {
+      name: "my-acl",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) Name of the ACL.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - Name of the ACL.
+* `arn` - ARN of the ACL.
+* `minimumEngineVersion` - The minimum engine version supported by the ACL.
+* `tags` - Map of tags assigned to the ACL.
+* `userNames` - Set of MemoryDB user names included in this ACL.
+
+<!-- cache-key: cdktf-0.18.0 input-dae65be976707896a0ccf5394e359974398040d0921bfad084e1f4c241a2a529 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/memorydb_cluster.html.markdown b/website/docs/cdktf/typescript/d/memorydb_cluster.html.markdown
new file mode 100644
index 00000000000..94970d07c56
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/memorydb_cluster.html.markdown
@@ -0,0 +1,85 @@
+---
+subcategory: "MemoryDB for Redis"
+layout: "aws"
+page_title: "AWS: aws_memorydb_cluster"
+description: |-
+  Provides information about a MemoryDB Cluster.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_memorydb_cluster
+
+Provides information about a MemoryDB Cluster.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsMemorydbCluster } from "./.gen/providers/aws/data-aws-memorydb-cluster";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsMemorydbCluster(this, "example", {
+      name: "my-cluster",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) Name of the cluster.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - Same as `name`.
+* `arn` - ARN of the cluster.
+* `aclName` - Name of the Access Control List associated with the cluster.
+* `autoMinorVersionUpgrade` - True when the cluster allows automatic minor version upgrades.
+* `clusterEndpoint`
+    * `address` - DNS hostname of the cluster configuration endpoint.
+    * `port` - Port number that the cluster configuration endpoint is listening on.
+* `dataTiering` - True when data tiering is enabled.
+* `description` - Description for the cluster.
+* `enginePatchVersion` - Patch version number of the Redis engine used by the cluster.
+* `engineVersion` - Version number of the Redis engine used by the cluster.
+* `finalSnapshotName` - Name of the final cluster snapshot to be created when this resource is deleted. If omitted, no final snapshot will be made.
+* `kmsKeyArn` - ARN of the KMS key used to encrypt the cluster at rest.
+* `maintenanceWindow` - Weekly time range during which maintenance on the cluster is performed. Specify as a range in the format `ddd:hh24:miDdd:hh24:mi` (24H Clock UTC). Example: `sun:23:00Mon:01:30`.
+* `nodeType` - Compute and memory capacity of the nodes in the cluster.
+* `numReplicasPerShard` - The number of replicas to apply to each shard.
+* `numShards` - Number of shards in the cluster.
+* `parameterGroupName` - The name of the parameter group associated with the cluster.
+* `port` - Port number on which each of the nodes accepts connections.
+* `securityGroupIds` - Set of VPC Security Group ID-s associated with this cluster.
+* `shards` - Set of shards in this cluster.
+    * `name` - Name of this shard.
+    * `numNodes` - Number of individual nodes in this shard.
+    * `slots` - Keyspace for this shard. Example: `016383`.
+    * `nodes` - Set of nodes in this shard.
+        * `availabilityZone` - The Availability Zone in which the node resides.
+        * `createTime` - The date and time when the node was created. Example: `20220101T21:00:00Z`.
+        * `name` - Name of this node.
+        * `endpoint`
+            * `address` - DNS hostname of the node.
+            * `port` - Port number that this node is listening on.
+* `snapshotRetentionLimit` - The number of days for which MemoryDB retains automatic snapshots before deleting them. When set to `0`, automatic backups are disabled.
+* `snapshotWindow` - Daily time range (in UTC) during which MemoryDB begins taking a daily snapshot of your shard. Example: `05:0009:00`.
+* `snsTopicArn` - ARN of the SNS topic to which cluster notifications are sent.
+* `subnetGroupName` -The name of the subnet group used for the cluster.
+* `tlsEnabled` - When true, in-transit encryption is enabled for the cluster.
+* `tags` - Map of tags assigned to the cluster.
+
+<!-- cache-key: cdktf-0.18.0 input-60661a32615a44866629e2e9ffadb0c1a33a84edf7060e982e9bec51eec4491d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/memorydb_parameter_group.html.markdown b/website/docs/cdktf/typescript/d/memorydb_parameter_group.html.markdown
new file mode 100644
index 00000000000..58a91d30a9b
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/memorydb_parameter_group.html.markdown
@@ -0,0 +1,56 @@
+---
+subcategory: "MemoryDB for Redis"
+layout: "aws"
+page_title: "AWS: aws_memorydb_parameter_group"
+description: |-
+  Provides information about a MemoryDB Parameter Group.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_memorydb_parameter_group
+
+Provides information about a MemoryDB Parameter Group.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsMemorydbParameterGroup } from "./.gen/providers/aws/data-aws-memorydb-parameter-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsMemorydbParameterGroup(this, "example", {
+      name: "my-parameter-group",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) Name of the parameter group.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - Name of the parameter group.
+* `arn` - ARN of the parameter group.
+* `description` - Description of the parameter group.
+* `family` - Engine version that the parameter group can be used with.
+* `parameter` - Set of user-defined MemoryDB parameters applied by the parameter group.
+    * `name` - Name of the parameter.
+    * `value` - Value of the parameter.
+* `tags` - Map of tags assigned to the parameter group.
+
+<!-- cache-key: cdktf-0.18.0 input-6ec5269ca86a0a1f8a702b357b9c477514195db733966e31d166353ba6ee15e5 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/memorydb_snapshot.html.markdown b/website/docs/cdktf/typescript/d/memorydb_snapshot.html.markdown
new file mode 100644
index 00000000000..054fdb9623f
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/memorydb_snapshot.html.markdown
@@ -0,0 +1,68 @@
+---
+subcategory: "MemoryDB for Redis"
+layout: "aws"
+page_title: "AWS: aws_memorydb_snapshot"
+description: |-
+  Provides information about a MemoryDB Snapshot.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_memorydb_snapshot
+
+Provides information about a MemoryDB Snapshot.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsMemorydbSnapshot } from "./.gen/providers/aws/data-aws-memorydb-snapshot";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsMemorydbSnapshot(this, "example", {
+      name: "my-snapshot",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) Name of the snapshot.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - Name of the snapshot.
+* `arn` - ARN of the snapshot.
+* `clusterConfiguration` - The configuration of the cluster from which the snapshot was taken.
+    * `description` - Description for the cluster.
+    * `engineVersion` - Version number of the Redis engine used by the cluster.
+    * `maintenanceWindow` - The weekly time range during which maintenance on the cluster is performed.
+    * `name` - Name of the cluster.
+    * `nodeType` - Compute and memory capacity of the nodes in the cluster.
+    * `numShards` - Number of shards in the cluster.
+    * `parameterGroupName` - Name of the parameter group associated with the cluster.
+    * `port` - Port number on which the cluster accepts connections.
+    * `snapshotRetentionLimit` - Number of days for which MemoryDB retains automatic snapshots before deleting them.
+    * `snapshotWindow` - The daily time range (in UTC) during which MemoryDB begins taking a daily snapshot of the shard.
+    * `subnetGroupName` - Name of the subnet group used by the cluster.
+    * `topicArn` - ARN of the SNS topic to which cluster notifications are sent.
+    * `vpcId` - The VPC in which the cluster exists.
+* `clusterName` - Name of the MemoryDB cluster that this snapshot was taken from.
+* `kmsKeyArn` - ARN of the KMS key used to encrypt the snapshot at rest.
+* `source` - Whether the snapshot is from an automatic backup (`automated`) or was created manually (`manual`).
+* `tags` - Map of tags assigned to the snapshot.
+
+<!-- cache-key: cdktf-0.18.0 input-62f791c7099ad6e3e06f89ea492109f2285d5d4a23f2005bec9ce21b57cd5349 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/memorydb_subnet_group.html.markdown b/website/docs/cdktf/typescript/d/memorydb_subnet_group.html.markdown
new file mode 100644
index 00000000000..bdd65b9a5a8
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/memorydb_subnet_group.html.markdown
@@ -0,0 +1,54 @@
+---
+subcategory: "MemoryDB for Redis"
+layout: "aws"
+page_title: "AWS: aws_memorydb_subnet_group"
+description: |-
+  Provides information about a MemoryDB Subnet Group.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_memorydb_subnet_group
+
+Provides information about a MemoryDB Subnet Group.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsMemorydbSubnetGroup } from "./.gen/providers/aws/data-aws-memorydb-subnet-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsMemorydbSubnetGroup(this, "example", {
+      name: "my-subnet-group",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) Name of the subnet group.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - Name of the subnet group.
+* `arn` - ARN of the subnet group.
+* `description` - Description of the subnet group.
+* `subnetIds` - Set of VPC Subnet ID-s of the subnet group.
+* `vpcId` - VPC in which the subnet group exists.
+* `tags` - Map of tags assigned to the subnet group.
+
+<!-- cache-key: cdktf-0.18.0 input-a2199a4dfc692ac39b45aee765d1dc366111874bffd60dc24a73443b21e9d7d0 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/memorydb_user.html.markdown b/website/docs/cdktf/typescript/d/memorydb_user.html.markdown
new file mode 100644
index 00000000000..86cffcdffa0
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/memorydb_user.html.markdown
@@ -0,0 +1,56 @@
+---
+subcategory: "MemoryDB for Redis"
+layout: "aws"
+page_title: "AWS: aws_memorydb_user"
+description: |-
+  Provides information about a MemoryDB User.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_memorydb_user
+
+Provides information about a MemoryDB User.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsMemorydbUser } from "./.gen/providers/aws/data-aws-memorydb-user";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsMemorydbUser(this, "example", {
+      userName: "my-user",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `userName` - (Required) Name of the user.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - Name of the user.
+* `accessString` - Access permissions string used for this user.
+* `arn` - ARN of the user.
+* `authenticationMode` - Denotes the user's authentication properties.
+    * `passwordCount` - The number of passwords belonging to the user.
+    * `type` - Whether the user requires a password to authenticate.
+* `minimumEngineVersion` - The minimum engine version supported for the user.
+* `tags` - Map of tags assigned to the subnet group.
+
+<!-- cache-key: cdktf-0.18.0 input-c6f19bc84dfa577edf03fcc5ca3f615821c417f424a780c64de232dacc41af5a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/mq_broker.html.markdown b/website/docs/cdktf/typescript/d/mq_broker.html.markdown
new file mode 100644
index 00000000000..e3697e8a07a
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/mq_broker.html.markdown
@@ -0,0 +1,62 @@
+---
+subcategory: "MQ"
+layout: "aws"
+page_title: "AWS: aws_mq_broker"
+description: |-
+  Provides a MQ Broker data source.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_mq_broker
+
+Provides information about a MQ Broker.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { VariableType, TerraformVariable, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsMqBroker } from "./.gen/providers/aws/data-aws-mq-broker";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    /*Terraform Variables are not always the best fit for getting inputs in the context of Terraform CDK.
+    You can read more about this at https://cdk.tf/variables*/
+    const brokerId = new TerraformVariable(this, "broker_id", {
+      default: "",
+      type: VariableType.STRING,
+    });
+    const brokerName = new TerraformVariable(this, "broker_name", {
+      default: "",
+      type: VariableType.STRING,
+    });
+    new DataAwsMqBroker(this, "by_id", {
+      brokerId: brokerId.stringValue,
+    });
+    new DataAwsMqBroker(this, "by_name", {
+      brokerName: brokerName.stringValue,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `brokerId` - (Optional) Unique id of the mq broker.
+* `brokerName` - (Optional) Unique name of the mq broker.
+
+## Attribute Reference
+
+See the [`awsMqBroker` resource](/docs/providers/aws/r/mq_broker.html) for details on the returned attributes.
+They are identical except for user password, which is not returned when describing broker.
+
+<!-- cache-key: cdktf-0.18.0 input-0e3d67694c8c62cd91f39eb11d121ea946f8feb6536315ac989e72cb171c80c6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/mq_broker_instance_type_offerings.html.markdown b/website/docs/cdktf/typescript/d/mq_broker_instance_type_offerings.html.markdown
new file mode 100644
index 00000000000..aaea9b7b901
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/mq_broker_instance_type_offerings.html.markdown
@@ -0,0 +1,76 @@
+---
+subcategory: "MQ"
+layout: "aws"
+page_title: "AWS: aws_mq_broker_instance_type_offerings"
+description: |-
+  Provides a MQ Broker Instance Offerings data source.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_mq_broker_instance_type_offerings
+
+Provides information about a MQ Broker Instance Offerings.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsMqBrokerInstanceTypeOfferings } from "./.gen/providers/aws/data-aws-mq-broker-instance-type-offerings";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsMqBrokerInstanceTypeOfferings(this, "all", {
+      engineType: "ACTIVEMQ",
+      hostInstanceType: "mq.m5.large",
+      storageType: "EBS",
+    });
+    new DataAwsMqBrokerInstanceTypeOfferings(this, "empty", {});
+    new DataAwsMqBrokerInstanceTypeOfferings(this, "engine", {
+      engineType: "ACTIVEMQ",
+    });
+    new DataAwsMqBrokerInstanceTypeOfferings(this, "instance", {
+      hostInstanceType: "mq.m5.large",
+    });
+    new DataAwsMqBrokerInstanceTypeOfferings(this, "storage", {
+      storageType: "EBS",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `engineType` - (Optional) Filter response by engine type.
+* `hostInstanceType` - (Optional) Filter response by host instance type.
+* `storageType` - (Optional) Filter response by storage type.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `brokerInstanceOptions` -  Option for host instance type. See Broker Instance Options below.
+
+### Broker Instance Options
+
+* `availabilityZones` - List of available AZs. See Availability Zones. below
+* `engineType` - Broker's engine type.
+* `hostInstanceType` - Broker's instance type.
+* `storageType` - Broker's storage type.
+* `supportedDeploymentModes` - The list of supported deployment modes.
+* `supportedEngineVersions` - The list of supported engine versions.
+
+### Availability Zones
+
+* `name` - Name of the Availability Zone.
+
+<!-- cache-key: cdktf-0.18.0 input-af7521896e903be08788f223edcfd27a267b313cdf4f21d6ea836a2e3f3e7984 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/mq_broker_instance_type_offerings.markdown b/website/docs/cdktf/typescript/d/mq_broker_instance_type_offerings.markdown
new file mode 100644
index 00000000000..aaea9b7b901
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/mq_broker_instance_type_offerings.markdown
@@ -0,0 +1,76 @@
+---
+subcategory: "MQ"
+layout: "aws"
+page_title: "AWS: aws_mq_broker_instance_type_offerings"
+description: |-
+  Provides a MQ Broker Instance Offerings data source.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_mq_broker_instance_type_offerings
+
+Provides information about a MQ Broker Instance Offerings.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsMqBrokerInstanceTypeOfferings } from "./.gen/providers/aws/data-aws-mq-broker-instance-type-offerings";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsMqBrokerInstanceTypeOfferings(this, "all", {
+      engineType: "ACTIVEMQ",
+      hostInstanceType: "mq.m5.large",
+      storageType: "EBS",
+    });
+    new DataAwsMqBrokerInstanceTypeOfferings(this, "empty", {});
+    new DataAwsMqBrokerInstanceTypeOfferings(this, "engine", {
+      engineType: "ACTIVEMQ",
+    });
+    new DataAwsMqBrokerInstanceTypeOfferings(this, "instance", {
+      hostInstanceType: "mq.m5.large",
+    });
+    new DataAwsMqBrokerInstanceTypeOfferings(this, "storage", {
+      storageType: "EBS",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `engineType` - (Optional) Filter response by engine type.
+* `hostInstanceType` - (Optional) Filter response by host instance type.
+* `storageType` - (Optional) Filter response by storage type.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `brokerInstanceOptions` -  Option for host instance type. See Broker Instance Options below.
+
+### Broker Instance Options
+
+* `availabilityZones` - List of available AZs. See Availability Zones. below
+* `engineType` - Broker's engine type.
+* `hostInstanceType` - Broker's instance type.
+* `storageType` - Broker's storage type.
+* `supportedDeploymentModes` - The list of supported deployment modes.
+* `supportedEngineVersions` - The list of supported engine versions.
+
+### Availability Zones
+
+* `name` - Name of the Availability Zone.
+
+<!-- cache-key: cdktf-0.18.0 input-af7521896e903be08788f223edcfd27a267b313cdf4f21d6ea836a2e3f3e7984 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/msk_broker_nodes.html.markdown b/website/docs/cdktf/typescript/d/msk_broker_nodes.html.markdown
new file mode 100644
index 00000000000..c1b9f47ee51
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/msk_broker_nodes.html.markdown
@@ -0,0 +1,58 @@
+---
+subcategory: "Managed Streaming for Kafka"
+layout: "aws"
+page_title: "AWS: aws_msk_broker_nodes"
+description: |-
+  Get information on an Amazon MSK Broker Nodes
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_msk_broker_nodes
+
+Get information on an Amazon MSK Broker Nodes.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsMskBrokerNodes } from "./.gen/providers/aws/data-aws-msk-broker-nodes";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsMskBrokerNodes(this, "example", {
+      clusterArn: Token.asString(awsMskClusterExample.arn),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `clusterArn` - (Required) ARN of the cluster the nodes belong to.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* [`nodeInfoList`](#nodes) - List of MSK Broker Nodes, sorted by broker ID in ascending order.
+
+### Nodes
+
+* `attachedEniId` - Attached elastic network interface of the broker
+* `brokerId` - ID of the broker
+* `clientSubnet` - Client subnet to which this broker node belongs
+* `clientVpcIpAddress` - The client virtual private cloud (VPC) IP address
+* `endpoints` - Set of endpoints for accessing the broker. This does not include ports
+* `nodeArn` - ARN of the node
+
+<!-- cache-key: cdktf-0.18.0 input-bff2642a3e21e8b608fc7f2ec749ea4dc2c86d2f7735aae811865faa68478e8c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/msk_cluster.html.markdown b/website/docs/cdktf/typescript/d/msk_cluster.html.markdown
new file mode 100644
index 00000000000..dd1e0596c5f
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/msk_cluster.html.markdown
@@ -0,0 +1,64 @@
+---
+subcategory: "Managed Streaming for Kafka"
+layout: "aws"
+page_title: "AWS: aws_msk_cluster"
+description: |-
+  Get information on an Amazon MSK Cluster
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_msk_cluster
+
+Get information on an Amazon MSK Cluster.
+
+-> **Note:** This data sources returns information on _provisioned_ clusters.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsMskCluster } from "./.gen/providers/aws/data-aws-msk-cluster";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsMskCluster(this, "example", {
+      clusterName: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `clusterName` - (Required) Name of the cluster.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the MSK cluster.
+* `bootstrapBrokers` - Comma separated list of one or more hostname:port pairs of kafka brokers suitable to bootstrap connectivity to the kafka cluster. Contains a value if `encryptionInfo0EncryptionInTransit0ClientBroker` is set to `plaintext` or `tlsPlaintext`. The resource sorts values alphabetically. AWS may not always return all endpoints so this value is not guaranteed to be stable across applies.
+* `bootstrapBrokersPublicSaslIam` - One or more DNS names (or IP addresses) and SASL IAM port pairs. For example, `b1PublicExampleClusterNameAbcdeC2KafkaUsEast1AmazonawsCom:9198,b2PublicExampleClusterNameAbcdeC2KafkaUsEast1AmazonawsCom:9198,b3PublicExampleClusterNameAbcdeC2KafkaUsEast1AmazonawsCom:9198`. This attribute will have a value if `encryptionInfo0EncryptionInTransit0ClientBroker` is set to `tlsPlaintext` or `tls` and `clientAuthentication0Sasl0Iam` is set to `true` and `brokerNodeGroupInfo0ConnectivityInfo0PublicAccess0Type` is set to `serviceProvidedEips` and the cluster fulfill all other requirements for public access. The resource sorts the list alphabetically. AWS may not always return all endpoints so the values may not be stable across applies.
+* `bootstrapBrokersPublicSaslScram` - One or more DNS names (or IP addresses) and SASL SCRAM port pairs. For example, `b1PublicExampleClusterNameAbcdeC2KafkaUsEast1AmazonawsCom:9196,b2PublicExampleClusterNameAbcdeC2KafkaUsEast1AmazonawsCom:9196,b3PublicExampleClusterNameAbcdeC2KafkaUsEast1AmazonawsCom:9196`. This attribute will have a value if `encryptionInfo0EncryptionInTransit0ClientBroker` is set to `tlsPlaintext` or `tls` and `clientAuthentication0Sasl0Scram` is set to `true` and `brokerNodeGroupInfo0ConnectivityInfo0PublicAccess0Type` is set to `serviceProvidedEips` and the cluster fulfill all other requirements for public access. The resource sorts the list alphabetically. AWS may not always return all endpoints so the values may not be stable across applies.
+* `bootstrapBrokersPublicTls` - One or more DNS names (or IP addresses) and TLS port pairs. For example, `b1PublicExampleClusterNameAbcdeC2KafkaUsEast1AmazonawsCom:9194,b2PublicExampleClusterNameAbcdeC2KafkaUsEast1AmazonawsCom:9194,b3PublicExampleClusterNameAbcdeC2KafkaUsEast1AmazonawsCom:9194`. This attribute will have a value if `encryptionInfo0EncryptionInTransit0ClientBroker` is set to `tlsPlaintext` or `tls` and `brokerNodeGroupInfo0ConnectivityInfo0PublicAccess0Type` is set to `serviceProvidedEips` and the cluster fulfill all other requirements for public access. The resource sorts the list alphabetically. AWS may not always return all endpoints so the values may not be stable across applies.
+* `bootstrapBrokersSaslIam` - One or more DNS names (or IP addresses) and SASL IAM port pairs. For example, `b1ExampleClusterNameAbcdeC2KafkaUsEast1AmazonawsCom:9098,b2ExampleClusterNameAbcdeC2KafkaUsEast1AmazonawsCom:9098,b3ExampleClusterNameAbcdeC2KafkaUsEast1AmazonawsCom:9098`. This attribute will have a value if `encryptionInfo0EncryptionInTransit0ClientBroker` is set to `tlsPlaintext` or `tls` and `clientAuthentication0Sasl0Iam` is set to `true`. The resource sorts the list alphabetically. AWS may not always return all endpoints so the values may not be stable across applies.
+* `bootstrapBrokersSaslScram` - One or more DNS names (or IP addresses) and SASL SCRAM port pairs. For example, `b1ExampleClusterNameAbcdeC2KafkaUsEast1AmazonawsCom:9096,b2ExampleClusterNameAbcdeC2KafkaUsEast1AmazonawsCom:9096,b3ExampleClusterNameAbcdeC2KafkaUsEast1AmazonawsCom:9096`. This attribute will have a value if `encryptionInfo0EncryptionInTransit0ClientBroker` is set to `tlsPlaintext` or `tls` and `clientAuthentication0Sasl0Scram` is set to `true`. The resource sorts the list alphabetically. AWS may not always return all endpoints so the values may not be stable across applies.
+* `bootstrapBrokersTls` - One or more DNS names (or IP addresses) and TLS port pairs. For example, `b1ExampleClusterNameAbcdeC2KafkaUsEast1AmazonawsCom:9094,b2ExampleClusterNameAbcdeC2KafkaUsEast1AmazonawsCom:9094,b3ExampleClusterNameAbcdeC2KafkaUsEast1AmazonawsCom:9094`. This attribute will have a value if `encryptionInfo0EncryptionInTransit0ClientBroker` is set to `tlsPlaintext` or `tls`. The resource sorts the list alphabetically. AWS may not always return all endpoints so the values may not be stable across applies.
+* `clusterUuid` - UUID of the MSK cluster, for use in IAM policies.
+* `kafkaVersion` - Apache Kafka version.
+* `numberOfBrokerNodes` - Number of broker nodes in the cluster.
+* `tags` - Map of key-value pairs assigned to the cluster.
+* `zookeeperConnectString` - A comma separated list of one or more hostname:port pairs to use to connect to the Apache Zookeeper cluster. The returned values are sorted alphbetically. The AWS API may not return all endpoints, so this value is not guaranteed to be stable across applies.
+* `zookeeperConnectStringTls` - A comma separated list of one or more hostname:port pairs to use to connect to the Apache Zookeeper cluster via TLS. The returned values are sorted alphabetically. The AWS API may not return all endpoints, so this value is not guaranteed to be stable across applies.
+
+<!-- cache-key: cdktf-0.18.0 input-acca35726c6c16c1d6bfaa3e60dcf9807ddf74bb084f85ee17a4170824050504 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/msk_configuration.html.markdown b/website/docs/cdktf/typescript/d/msk_configuration.html.markdown
new file mode 100644
index 00000000000..e763fee1528
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/msk_configuration.html.markdown
@@ -0,0 +1,53 @@
+---
+subcategory: "Managed Streaming for Kafka"
+layout: "aws"
+page_title: "AWS: aws_msk_configuration"
+description: |-
+  Get information on an Amazon MSK Configuration
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_msk_configuration
+
+Get information on an Amazon MSK Configuration.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsMskConfiguration } from "./.gen/providers/aws/data-aws-msk-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsMskConfiguration(this, "example", {
+      name: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name of the configuration.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the configuration.
+* `latestRevision` - Latest revision of the configuration.
+* `description` - Description of the configuration.
+* `kafkaVersions` - List of Apache Kafka versions which can use this configuration.
+* `serverProperties` - Contents of the server.properties file.
+
+<!-- cache-key: cdktf-0.18.0 input-a4d86b249f9d4af6d96814d6f29e2a202f807b86ac9fffd8815b7aa4931e1636 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/msk_kafka_version.html.markdown b/website/docs/cdktf/typescript/d/msk_kafka_version.html.markdown
new file mode 100644
index 00000000000..193c707f20e
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/msk_kafka_version.html.markdown
@@ -0,0 +1,53 @@
+---
+subcategory: "Managed Streaming for Kafka"
+layout: "aws"
+page_title: "AWS: aws_msk_kafka_version"
+description: |-
+  Get information on a Amazon MSK Kafka Version
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_msk_cluster
+
+Get information on a Amazon MSK Kafka Version
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsMskKafkaVersion } from "./.gen/providers/aws/data-aws-msk-kafka-version";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsMskKafkaVersion(this, "example", {
+      version: "2.8.0",
+    });
+    new DataAwsMskKafkaVersion(this, "preferred", {
+      preferredVersions: ["2.4.1.1", "2.4.1", "2.2.1"],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `preferredVersions` - (Optional) Ordered list of preferred Kafka versions. The first match in this list will be returned. Either `preferredVersions` or `version` must be set.
+* `version` - (Optional) Version of MSK Kafka. For example 2.4.1.1 or "2.2.1" etc. Either `preferredVersions` or `version` must be set.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `status` - Status of the MSK Kafka version eg. `active` or `deprecated`.
+
+<!-- cache-key: cdktf-0.18.0 input-6852054bc10e6a7e97a90613e2c215b051bd57037bfb23fddf1aebb0c8d4f92d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/msk_vpc_connection.html.markdown b/website/docs/cdktf/typescript/d/msk_vpc_connection.html.markdown
new file mode 100644
index 00000000000..21da873f15f
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/msk_vpc_connection.html.markdown
@@ -0,0 +1,53 @@
+---
+subcategory: "Managed Streaming for Kafka"
+layout: "aws"
+page_title: "AWS: aws_msk_vpc_connection"
+description: |-
+  Get information on an Amazon MSK VPC Connection.
+---
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_msk_vpc_connection
+
+Get information on an Amazon MSK VPC Connection.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsMskVpcConnection } from "./.gen/providers/aws/data-aws-msk-vpc-connection";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsMskVpcConnection(this, "example", {
+      arn: Token.asString(awsMskVpcConnectionExample.arn),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `arn` - (Required) ARN of the VPC Connection.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `authentication` - The authentication type for the client VPC Connection.
+* `clientSubnets` - The list of subnets in the client VPC.
+* `securityGroups` - The security groups attached to the ENIs for the broker nodes.
+* `tags` - Map of key-value pairs assigned to the VPC Connection.
+* `targetClusterArn` - The Amazon Resource Name (ARN) of the cluster.
+* `vpcId` - The VPC ID of the remote client.
+
+<!-- cache-key: cdktf-0.18.0 input-01122677f9ba30620563040b95b6c51a240e709b7fc3bc03683cde0b35bb7e29 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/mskconnect_connector.html.markdown b/website/docs/cdktf/typescript/d/mskconnect_connector.html.markdown
new file mode 100644
index 00000000000..f104cacb290
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/mskconnect_connector.html.markdown
@@ -0,0 +1,51 @@
+---
+subcategory: "Managed Streaming for Kafka Connect"
+layout: "aws"
+page_title: "AWS: aws_mskconnect_connector"
+description: |-
+  Get information on an Amazon MSK Connect Connector.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_mskconnect_connector
+
+Get information on an Amazon MSK Connect Connector.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsMskconnectConnector } from "./.gen/providers/aws/data-aws-mskconnect-connector";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsMskconnectConnector(this, "example", {
+      name: "example-mskconnector",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name of the connector.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the connector.
+* `description` - Summary description of the connector.
+* `version` - Current version of the connector.
+
+<!-- cache-key: cdktf-0.18.0 input-95d0c19f97dab5d0efafc846bda415a3a1bd7527693cac6b19d936ae768634cf -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/mskconnect_custom_plugin.html.markdown b/website/docs/cdktf/typescript/d/mskconnect_custom_plugin.html.markdown
new file mode 100644
index 00000000000..c8c66d2d8b9
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/mskconnect_custom_plugin.html.markdown
@@ -0,0 +1,52 @@
+---
+subcategory: "Managed Streaming for Kafka Connect"
+layout: "aws"
+page_title: "AWS: aws_mskconnect_custom_plugin"
+description: |-
+  Get information on an Amazon MSK Connect custom plugin.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_mskconnect_custom_plugin
+
+Get information on an Amazon MSK Connect custom plugin.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsMskconnectCustomPlugin } from "./.gen/providers/aws/data-aws-mskconnect-custom-plugin";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsMskconnectCustomPlugin(this, "example", {
+      name: "example-debezium-1",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name of the custom plugin.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - the ARN of the custom plugin.
+* `description` - a summary description of the custom plugin.
+* `latestRevision` - an ID of the latest successfully created revision of the custom plugin.
+* `state` - the state of the custom plugin.
+
+<!-- cache-key: cdktf-0.18.0 input-69d528a4e92608d40820215e21637edad56d0cf8bd42eb304519e5181a028a94 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/mskconnect_worker_configuration.html.markdown b/website/docs/cdktf/typescript/d/mskconnect_worker_configuration.html.markdown
new file mode 100644
index 00000000000..5655f09cbea
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/mskconnect_worker_configuration.html.markdown
@@ -0,0 +1,52 @@
+---
+subcategory: "Managed Streaming for Kafka Connect"
+layout: "aws"
+page_title: "AWS: aws_mskconnect_worker_configuration"
+description: |-
+  Get information on an Amazon MSK Connect worker configuration.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_mskconnect_worker_configuration
+
+Get information on an Amazon MSK Connect Worker Configuration.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsMskconnectWorkerConfiguration } from "./.gen/providers/aws/data-aws-mskconnect-worker-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsMskconnectWorkerConfiguration(this, "example", {
+      name: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name of the worker configuration.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - the ARN of the worker configuration.
+* `description` - a summary description of the worker configuration.
+* `latestRevision` - an ID of the latest successfully created revision of the worker configuration.
+* `propertiesFileContent` - contents of connect-distributed.properties file.
+
+<!-- cache-key: cdktf-0.18.0 input-a4a19bc8bace9a17fd9c5067fbaf9f50bdef230bacb36537455d33cae493f587 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/nat_gateway.html.markdown b/website/docs/cdktf/typescript/d/nat_gateway.html.markdown
new file mode 100644
index 00000000000..d88676fb261
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/nat_gateway.html.markdown
@@ -0,0 +1,107 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_nat_gateway"
+description: |-
+    Provides details about a specific VPC NAT Gateway.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_nat_gateway
+
+Provides details about a specific VPC NAT Gateway.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsNatGateway } from "./.gen/providers/aws/data-aws-nat-gateway";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsNatGateway(this, "default", {
+      subnetId: public.id,
+    });
+  }
+}
+
+```
+
+### With tags
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsNatGateway } from "./.gen/providers/aws/data-aws-nat-gateway";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsNatGateway(this, "default", {
+      subnetId: public.id,
+      tags: {
+        Name: "gw NAT",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The arguments of this data source act as filters for querying the available
+NAT Gateways in the current Region. The given filters must match exactly one
+NAT Gateway whose data will be exported as attributes.
+
+* `id` - (Optional) ID of the specific NAT Gateway to retrieve.
+* `subnetId` - (Optional) ID of subnet that the NAT Gateway resides in.
+* `vpcId` - (Optional) ID of the VPC that the NAT Gateway resides in.
+* `state` - (Optional) State of the NAT Gateway (pending | failed | available | deleting | deleted ).
+* `tags` - (Optional) Map of tags, each pair of which must exactly match
+  a pair on the desired NAT Gateway.
+* `filter` - (Optional) Custom filter block as described below.
+
+More complex filters can be expressed using one or more `filter` sub-blocks,
+which take the following arguments:
+
+* `name` - (Required) Name of the field to filter by, as defined by
+  [the underlying AWS API](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeNatGateways.html).
+* `values` - (Required) Set of values that are accepted for the given field.
+  An Nat Gateway will be selected if any one of the given values matches.
+
+## Attribute Reference
+
+All of the argument attributes except `filter` block are also exported as
+result attributes. This data source will complete the data by populating
+any fields that are not included in the configuration with the data for
+the selected Nat Gateway.
+
+* `allocationId` - ID of the EIP allocated to the selected NAT Gateway.
+* `associationId` - The association ID of the Elastic IP address that's associated with the NAT Gateway. Only available when `connectivityType` is `public`.
+* `connectivityType` - Connectivity type of the NAT Gateway.
+* `networkInterfaceId` - The ID of the ENI allocated to the selected NAT Gateway.
+* `privateIp` - Private IP address of the selected NAT Gateway.
+* `publicIp` - Public IP (EIP) address of the selected NAT Gateway.
+* `secondaryAllocationIds` - Secondary allocation EIP IDs for the selected NAT Gateway.
+* `secondaryPrivateIpAddressCount` - The number of secondary private IPv4 addresses assigned to the selected NAT Gateway.
+* `secondaryPrivateIpAddresses` - Secondary private IPv4 addresses assigned to the selected NAT Gateway.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `20M`)
+
+<!-- cache-key: cdktf-0.18.0 input-4030116e2abe81b3824dc015b0bf174d688531f1ad8692b89eca913c4b816418 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/nat_gateways.html.markdown b/website/docs/cdktf/typescript/d/nat_gateways.html.markdown
new file mode 100644
index 00000000000..00a2b53d1e8
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/nat_gateways.html.markdown
@@ -0,0 +1,85 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_nat_gateways"
+description: |-
+    Get information on Amazon NAT Gateways.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_nat_gateways
+
+This resource can be useful for getting back a list of NAT gateway ids to be referenced elsewhere.
+
+## Example Usage
+
+The following returns all NAT gateways in a specified VPC that are marked as available
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformCount, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsNatGateway } from "./.gen/providers/aws/data-aws-nat-gateway";
+import { DataAwsNatGateways } from "./.gen/providers/aws/data-aws-nat-gateways";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const ngws = new DataAwsNatGateways(this, "ngws", {
+      filter: [
+        {
+          name: "state",
+          values: ["available"],
+        },
+      ],
+      vpcId: vpcId.stringValue,
+    });
+    /*In most cases loops should be handled in the programming language context and 
+    not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+    you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+    you need to keep this like it is.*/
+    const ngwCount = TerraformCount.of(Token.asNumber(Fn.lengthOf(ngws.ids)));
+    new DataAwsNatGateway(this, "ngw", {
+      id: Token.asString(
+        Fn.lookupNested(Fn.tolist(ngws.ids), [ngwCount.index])
+      ),
+      count: ngwCount,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `filter` - (Optional) Custom filter block as described below.
+* `vpcId` - (Optional) VPC ID that you want to filter from.
+* `tags` - (Optional) Map of tags, each pair of which must exactly match
+  a pair on the desired NAT Gateways.
+
+More complex filters can be expressed using one or more `filter` sub-blocks,
+which take the following arguments:
+
+* `name` - (Required) Name of the field to filter by, as defined by
+  [the underlying AWS API](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeNatGateways.html).
+* `values` - (Required) Set of values that are accepted for the given field.
+  A Nat Gateway will be selected if any one of the given values matches.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - AWS Region.
+* `ids` - List of all the NAT gateway ids found.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `20M`)
+
+<!-- cache-key: cdktf-0.18.0 input-3dfcb9644adaffbf7b3a6ffb1c20821b6b1308407d55040b08b25e3a1307ee56 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/neptune_engine_version.html.markdown b/website/docs/cdktf/typescript/d/neptune_engine_version.html.markdown
new file mode 100644
index 00000000000..23bf8c7cb8d
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/neptune_engine_version.html.markdown
@@ -0,0 +1,58 @@
+---
+subcategory: "Neptune"
+layout: "aws"
+page_title: "AWS: aws_neptune_engine_version"
+description: |-
+  Information about a Neptune engine version.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_neptune_engine_version
+
+Information about a Neptune engine version.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsNeptuneEngineVersion } from "./.gen/providers/aws/data-aws-neptune-engine-version";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsNeptuneEngineVersion(this, "test", {
+      preferredVersions: ["1.0.3.0", "1.0.2.2", "1.0.2.1"],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `engine` - (Optional) DB engine. (Default: `neptune`)
+* `parameterGroupFamily` - (Optional) Name of a specific DB parameter group family. An example parameter group family is `neptune1`.
+* `preferredVersions` - (Optional) Ordered list of preferred engine versions. The first match in this list will be returned. If no preferred matches are found and the original search returned more than one result, an error is returned. If both the `version` and `preferredVersions` arguments are not configured, the data source will return the default version for the engine.
+* `version` - (Optional) Version of the DB engine. For example, `1010`, `1022`, and `1030`. If both the `version` and `preferredVersions` arguments are not configured, the data source will return the default version for the engine.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `engineDescription` - Description of the database engine.
+* `exportableLogTypes` - Set of log types that the database engine has available for export to CloudWatch Logs.
+* `supportedTimezones` - Set of the time zones supported by this engine.
+* `supportsLogExportsToCloudwatch` - Indicates whether the engine version supports exporting the log types specified by `exportableLogTypes` to CloudWatch Logs.
+* `supportsReadReplica` - Indicates whether the database engine version supports read replicas.
+* `validUpgradeTargets` - Set of engine versions that this database engine version can be upgraded to.
+* `versionDescription` - Description of the database engine version.
+
+<!-- cache-key: cdktf-0.18.0 input-95a44d0ef7849262a188ffdb9a5ba6d99336bcbafcda87d6d4674964f3cbe7d9 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/neptune_engine_version.markdown b/website/docs/cdktf/typescript/d/neptune_engine_version.markdown
new file mode 100644
index 00000000000..23bf8c7cb8d
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/neptune_engine_version.markdown
@@ -0,0 +1,58 @@
+---
+subcategory: "Neptune"
+layout: "aws"
+page_title: "AWS: aws_neptune_engine_version"
+description: |-
+  Information about a Neptune engine version.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_neptune_engine_version
+
+Information about a Neptune engine version.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsNeptuneEngineVersion } from "./.gen/providers/aws/data-aws-neptune-engine-version";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsNeptuneEngineVersion(this, "test", {
+      preferredVersions: ["1.0.3.0", "1.0.2.2", "1.0.2.1"],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `engine` - (Optional) DB engine. (Default: `neptune`)
+* `parameterGroupFamily` - (Optional) Name of a specific DB parameter group family. An example parameter group family is `neptune1`.
+* `preferredVersions` - (Optional) Ordered list of preferred engine versions. The first match in this list will be returned. If no preferred matches are found and the original search returned more than one result, an error is returned. If both the `version` and `preferredVersions` arguments are not configured, the data source will return the default version for the engine.
+* `version` - (Optional) Version of the DB engine. For example, `1010`, `1022`, and `1030`. If both the `version` and `preferredVersions` arguments are not configured, the data source will return the default version for the engine.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `engineDescription` - Description of the database engine.
+* `exportableLogTypes` - Set of log types that the database engine has available for export to CloudWatch Logs.
+* `supportedTimezones` - Set of the time zones supported by this engine.
+* `supportsLogExportsToCloudwatch` - Indicates whether the engine version supports exporting the log types specified by `exportableLogTypes` to CloudWatch Logs.
+* `supportsReadReplica` - Indicates whether the database engine version supports read replicas.
+* `validUpgradeTargets` - Set of engine versions that this database engine version can be upgraded to.
+* `versionDescription` - Description of the database engine version.
+
+<!-- cache-key: cdktf-0.18.0 input-95a44d0ef7849262a188ffdb9a5ba6d99336bcbafcda87d6d4674964f3cbe7d9 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/neptune_orderable_db_instance.html.markdown b/website/docs/cdktf/typescript/d/neptune_orderable_db_instance.html.markdown
new file mode 100644
index 00000000000..546c3f290dd
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/neptune_orderable_db_instance.html.markdown
@@ -0,0 +1,69 @@
+---
+subcategory: "Neptune"
+layout: "aws"
+page_title: "AWS: aws_neptune_orderable_db_instance"
+description: |-
+  Information about Neptune orderable DB instances.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_neptune_orderable_db_instance
+
+Information about Neptune orderable DB instances.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsNeptuneOrderableDbInstance } from "./.gen/providers/aws/data-aws-neptune-orderable-db-instance";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsNeptuneOrderableDbInstance(this, "test", {
+      engineVersion: "1.0.3.0",
+      preferredInstanceClasses: ["db.r5.large", "db.r4.large", "db.t3.medium"],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `engine` - (Optional) DB engine. (Default: `neptune`)
+* `engineVersion` - (Optional) Version of the DB engine. For example, `1010`, `1012`, `1022`, and `1030`.
+* `instanceClass` - (Optional) DB instance class. Examples of classes are `dbR5Large`, `dbR5Xlarge`, `dbR4Large`, `dbR54Xlarge`, `dbR512Xlarge`, `dbR4Xlarge`, and `dbT3Medium`.
+* `licenseModel` - (Optional) License model. (Default: `amazonLicense`)
+* `preferredInstanceClasses` - (Optional) Ordered list of preferred Neptune DB instance classes. The first match in this list will be returned. If no preferred matches are found and the original search returned more than one result, an error is returned.
+* `vpc` - (Optional) Enable to show only VPC offerings.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `availabilityZones` - Availability zones where the instance is available.
+* `maxIopsPerDbInstance` - Maximum total provisioned IOPS for a DB instance.
+* `maxIopsPerGib` - Maximum provisioned IOPS per GiB for a DB instance.
+* `maxStorageSize` - Maximum storage size for a DB instance.
+* `minIopsPerDbInstance` - Minimum total provisioned IOPS for a DB instance.
+* `minIopsPerGib` - Minimum provisioned IOPS per GiB for a DB instance.
+* `minStorageSize` - Minimum storage size for a DB instance.
+* `multiAzCapable` - Whether a DB instance is Multi-AZ capable.
+* `readReplicaCapable` - Whether a DB instance can have a read replica.
+* `storageType` - Storage type for a DB instance.
+* `supportsEnhancedMonitoring` - Whether a DB instance supports Enhanced Monitoring at intervals from 1 to 60 seconds.
+* `supportsIamDatabaseAuthentication` - Whether a DB instance supports IAM database authentication.
+* `supportsIops` - Whether a DB instance supports provisioned IOPS.
+* `supportsPerformanceInsights` - Whether a DB instance supports Performance Insights.
+* `supportsStorageEncryption` - Whether a DB instance supports encrypted storage.
+
+<!-- cache-key: cdktf-0.18.0 input-96ed319d4f21711473bbe2040090bbe88fe63b3c2315bc78386e18d098f01431 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/neptune_orderable_db_instance.markdown b/website/docs/cdktf/typescript/d/neptune_orderable_db_instance.markdown
new file mode 100644
index 00000000000..546c3f290dd
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/neptune_orderable_db_instance.markdown
@@ -0,0 +1,69 @@
+---
+subcategory: "Neptune"
+layout: "aws"
+page_title: "AWS: aws_neptune_orderable_db_instance"
+description: |-
+  Information about Neptune orderable DB instances.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_neptune_orderable_db_instance
+
+Information about Neptune orderable DB instances.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsNeptuneOrderableDbInstance } from "./.gen/providers/aws/data-aws-neptune-orderable-db-instance";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsNeptuneOrderableDbInstance(this, "test", {
+      engineVersion: "1.0.3.0",
+      preferredInstanceClasses: ["db.r5.large", "db.r4.large", "db.t3.medium"],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `engine` - (Optional) DB engine. (Default: `neptune`)
+* `engineVersion` - (Optional) Version of the DB engine. For example, `1010`, `1012`, `1022`, and `1030`.
+* `instanceClass` - (Optional) DB instance class. Examples of classes are `dbR5Large`, `dbR5Xlarge`, `dbR4Large`, `dbR54Xlarge`, `dbR512Xlarge`, `dbR4Xlarge`, and `dbT3Medium`.
+* `licenseModel` - (Optional) License model. (Default: `amazonLicense`)
+* `preferredInstanceClasses` - (Optional) Ordered list of preferred Neptune DB instance classes. The first match in this list will be returned. If no preferred matches are found and the original search returned more than one result, an error is returned.
+* `vpc` - (Optional) Enable to show only VPC offerings.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `availabilityZones` - Availability zones where the instance is available.
+* `maxIopsPerDbInstance` - Maximum total provisioned IOPS for a DB instance.
+* `maxIopsPerGib` - Maximum provisioned IOPS per GiB for a DB instance.
+* `maxStorageSize` - Maximum storage size for a DB instance.
+* `minIopsPerDbInstance` - Minimum total provisioned IOPS for a DB instance.
+* `minIopsPerGib` - Minimum provisioned IOPS per GiB for a DB instance.
+* `minStorageSize` - Minimum storage size for a DB instance.
+* `multiAzCapable` - Whether a DB instance is Multi-AZ capable.
+* `readReplicaCapable` - Whether a DB instance can have a read replica.
+* `storageType` - Storage type for a DB instance.
+* `supportsEnhancedMonitoring` - Whether a DB instance supports Enhanced Monitoring at intervals from 1 to 60 seconds.
+* `supportsIamDatabaseAuthentication` - Whether a DB instance supports IAM database authentication.
+* `supportsIops` - Whether a DB instance supports provisioned IOPS.
+* `supportsPerformanceInsights` - Whether a DB instance supports Performance Insights.
+* `supportsStorageEncryption` - Whether a DB instance supports encrypted storage.
+
+<!-- cache-key: cdktf-0.18.0 input-96ed319d4f21711473bbe2040090bbe88fe63b3c2315bc78386e18d098f01431 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/network_acls.html.markdown b/website/docs/cdktf/typescript/d/network_acls.html.markdown
new file mode 100644
index 00000000000..d5393726a77
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/network_acls.html.markdown
@@ -0,0 +1,128 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_network_acls"
+description: |-
+    Provides a list of network ACL ids for a VPC
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_network_acls
+
+## Example Usage
+
+The following shows outputting all network ACL ids in a vpc.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformOutput, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsNetworkAcls } from "./.gen/providers/aws/data-aws-network-acls";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new DataAwsNetworkAcls(this, "example", {
+      vpcId: vpcId.stringValue,
+    });
+    const cdktfTerraformOutputExample = new TerraformOutput(this, "example_1", {
+      value: example.ids,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    cdktfTerraformOutputExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+The following example retrieves a list of all network ACL ids in a VPC with a custom
+tag of `tier` set to a value of "Private".
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsNetworkAcls } from "./.gen/providers/aws/data-aws-network-acls";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsNetworkAcls(this, "example", {
+      tags: {
+        Tier: "Private",
+      },
+      vpcId: vpcId.stringValue,
+    });
+  }
+}
+
+```
+
+The following example retrieves a network ACL id in a VPC which associated
+with specific subnet.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsNetworkAcls } from "./.gen/providers/aws/data-aws-network-acls";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsNetworkAcls(this, "example", {
+      filter: [
+        {
+          name: "association.subnet-id",
+          values: [test.id],
+        },
+      ],
+      vpcId: vpcId.stringValue,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `vpcId` - (Optional) VPC ID that you want to filter from.
+
+* `tags` - (Optional) Map of tags, each pair of which must exactly match
+  a pair on the desired network ACLs.
+
+* `filter` - (Optional) Custom filter block as described below.
+
+More complex filters can be expressed using one or more `filter` sub-blocks,
+which take the following arguments:
+
+* `name` - (Required) Name of the field to filter by, as defined by
+  [the underlying AWS API](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeNetworkAcls.html).
+
+* `values` - (Required) Set of values that are accepted for the given field.
+  A VPC will be selected if any one of the given values matches.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - AWS Region.
+* `ids` - List of all the network ACL ids found.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `20M`)
+
+<!-- cache-key: cdktf-0.18.0 input-9e00033620073e117ff35c3a96437d5e582bff32daaefd9214f39ae3299dcbdb -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/network_interface.html.markdown b/website/docs/cdktf/typescript/d/network_interface.html.markdown
new file mode 100644
index 00000000000..7d8435543e8
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/network_interface.html.markdown
@@ -0,0 +1,84 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_network_interface"
+description: |-
+  Get information on a Network Interface resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# aws_network_interface
+
+Use this data source to get information about a Network Interface.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsNetworkInterface } from "./.gen/providers/aws/data-aws-network-interface";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsNetworkInterface(this, "bar", {
+      id: "eni-01234567",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `id` – (Optional) Identifier for the network interface.
+* `filter` – (Optional) One or more name/value pairs to filter off of. There are several valid keys, for a full reference, check out [describe-network-interfaces](https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-network-interfaces.html) in the AWS CLI reference.
+
+## Attribute Reference
+
+See the [Network Interface](/docs/providers/aws/r/network_interface.html) for details on the returned attributes.
+
+Additionally, the following attributes are exported:
+
+* `arn` - ARN of the network interface.
+* `association` - Association information for an Elastic IP address (IPv4) associated with the network interface. See supported fields below.
+* `availabilityZone` - Availability Zone.
+* `description` - Description of the network interface.
+* `interfaceType` - Type of interface.
+* `ipv6Addresses` - List of IPv6 addresses to assign to the ENI.
+* `macAddress` - MAC address.
+* `ownerId` - AWS account ID of the owner of the network interface.
+* `privateDnsName` - Private DNS name.
+* `privateIp` - Private IPv4 address of the network interface within the subnet.
+* `privateIps` - Private IPv4 addresses associated with the network interface.
+* `requesterId` - ID of the entity that launched the instance on your behalf.
+* `securityGroups` - List of security groups for the network interface.
+* `subnetId` - ID of the subnet.
+* `outpostArn` - ARN of the Outpost.
+* `tags` - Any tags assigned to the network interface.
+* `vpcId` - ID of the VPC.
+
+### `association`
+
+* `allocationId` - Allocation ID.
+* `associationId` - Association ID.
+* `carrierIp` - Carrier IP address associated with the network interface. This attribute is only set when the network interface is in a subnet which is associated with a Wavelength Zone.
+* `customerOwnedIp` - Customer-owned IP address.
+* `ipOwnerId` - ID of the Elastic IP address owner.
+* `publicDnsName` - Public DNS name.
+* `publicIp` - Address of the Elastic IP address bound to the network interface.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `20M`)
+
+<!-- cache-key: cdktf-0.18.0 input-2076fd1e9228c52725c01e9ff2e4ab23d3afe4ebaba78ef4fa3e8e525341ba1e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/network_interfaces.html.markdown b/website/docs/cdktf/typescript/d/network_interfaces.html.markdown
new file mode 100644
index 00000000000..913c35dfb4d
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/network_interfaces.html.markdown
@@ -0,0 +1,128 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_network_interfaces"
+description: |-
+    Provides a list of network interface ids
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_network_interfaces
+
+## Example Usage
+
+The following shows outputting all network interface ids in a region.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformOutput, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsNetworkInterfaces } from "./.gen/providers/aws/data-aws-network-interfaces";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new DataAwsNetworkInterfaces(this, "example", {});
+    const cdktfTerraformOutputExample = new TerraformOutput(this, "example_1", {
+      value: example.ids,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    cdktfTerraformOutputExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+The following example retrieves a list of all network interface ids with a custom tag of `name` set to a value of `test`.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformOutput, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsNetworkInterfaces } from "./.gen/providers/aws/data-aws-network-interfaces";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new DataAwsNetworkInterfaces(this, "example", {
+      tags: {
+        Name: "test",
+      },
+    });
+    new TerraformOutput(this, "example1", {
+      value: example.ids,
+    });
+  }
+}
+
+```
+
+The following example retrieves a network interface ids which associated
+with specific subnet.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformOutput, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsNetworkInterfaces } from "./.gen/providers/aws/data-aws-network-interfaces";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new DataAwsNetworkInterfaces(this, "example", {
+      filter: [
+        {
+          name: "subnet-id",
+          values: [test.id],
+        },
+      ],
+    });
+    const cdktfTerraformOutputExample = new TerraformOutput(this, "example_1", {
+      value: example.ids,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    cdktfTerraformOutputExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+* `tags` - (Optional) Map of tags, each pair of which must exactly match
+  a pair on the desired network interfaces.
+
+* `filter` - (Optional) Custom filter block as described below.
+
+More complex filters can be expressed using one or more `filter` sub-blocks,
+which take the following arguments:
+
+* `name` - (Required) Name of the field to filter by, as defined by
+  [the underlying AWS API](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeNetworkInterfaces.html).
+
+* `values` - (Required) Set of values that are accepted for the given field.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - AWS Region.
+* `ids` - List of all the network interface ids found.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `20M`)
+
+<!-- cache-key: cdktf-0.18.0 input-646906c0bd9fc7099554a6f7a7360e6017e0671ce35dd9034461a10e627366dc -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/networkfirewall_firewall.html.markdown b/website/docs/cdktf/typescript/d/networkfirewall_firewall.html.markdown
new file mode 100644
index 00000000000..2e0a5808579
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/networkfirewall_firewall.html.markdown
@@ -0,0 +1,125 @@
+---
+subcategory: "Network Firewall"
+layout: "aws"
+page_title: "AWS: aws_networkfirewall_firewall"
+description: |-
+  Retrieve information about an AWS Network Firewall Firewall resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_networkfirewall_firewall
+
+Retrieve information about a firewall.
+
+## Example Usage
+
+### Find firewall policy by ARN
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsNetworkfirewallFirewall } from "./.gen/providers/aws/data-aws-networkfirewall-firewall";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsNetworkfirewallFirewall(this, "example", {
+      arn: arn,
+    });
+  }
+}
+
+```
+
+### Find firewall policy by Name
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsNetworkfirewallFirewall } from "./.gen/providers/aws/data-aws-networkfirewall-firewall";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsNetworkfirewallFirewall(this, "example", {
+      name: "Test",
+    });
+  }
+}
+
+```
+
+### Find firewall policy by ARN and Name
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsNetworkfirewallFirewall } from "./.gen/providers/aws/data-aws-networkfirewall-firewall";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsNetworkfirewallFirewall(this, "example", {
+      arn: arn,
+      name: "Test",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+One or more of the following arguments are required:
+
+* `arn` - ARN of the firewall.
+* `name` - Descriptive name of the firewall.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the firewall.
+* `deleteProtection` - Boolean flag indicating whether it is possible to delete the firewall.
+* `description` - Description of the firewall.
+* `encryptionConfiguration` - AWS Key Management Service (AWS KMS) encryption settings for the firewall.
+    * `keyId` - The ID of the AWS Key Management Service (AWS KMS) customer managed key.
+    * `type` - The type of the AWS Key Management Service (AWS KMS) key use by the firewall.
+* `firewallPolicyArn` - ARN of the VPC Firewall policy.
+* `firewallPolicyChangeProtection` - A boolean flag indicating whether it is possible to change the associated firewall policy.
+* `firewallStatus` - Nested list of information about the current status of the firewall.
+    * `syncStates` - Set of subnets configured for use by the firewall.
+        * `attachment` - Nested list describing the attachment status of the firewall's association with a single VPC subnet.
+            * `endpointId` - The identifier of the firewall endpoint that AWS Network Firewall has instantiated in the subnet. You use this to identify the firewall endpoint in the VPC route tables, when you redirect the VPC traffic through the endpoint.
+            * `subnetId` - The unique identifier of the subnet that you've specified to be used for a firewall endpoint.
+        * `availabilityZone` - The Availability Zone where the subnet is configured.
+    * `capacityUsageSummary` - Aggregated count of all resources used by reference sets in a firewall.
+        * `cidrs` - Capacity usage of CIDR blocks used by IP set references in a firewall.
+            * `availableCidrCount` - Available number of CIDR blocks available for use by the IP set references in a firewall.
+            * `ipSetReferences` - The list of IP set references used by a firewall.
+                * `resolvedCidrCount` - Total number of CIDR blocks used by the IP set references in a firewall.
+            * `utilizedCidrCount` - Number of CIDR blocks used by the IP set references in a firewall.
+    * `configurationSyncStateSummary` - Summary of sync states for all availability zones in which the firewall is configured.
+* `id` - ARN that identifies the firewall.
+* `name` - Descriptive name of the firewall.
+* `subnetChangeProtection` - A boolean flag indicating whether it is possible to change the associated subnet(s).
+* `subnetMapping` - Set of configuration blocks describing the public subnets. Each subnet must belong to a different Availability Zone in the VPC. AWS Network Firewall creates a firewall endpoint in each subnet.
+    * `subnetId` - The unique identifier for the subnet.
+* `tags` - Map of resource tags to associate with the resource. If configured with a provider [`defaultTags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `updateToken` - String token used when updating a firewall.
+* `vpcId` - Unique identifier of the VPC where AWS Network Firewall should create the firewall.
+
+<!-- cache-key: cdktf-0.18.0 input-24e5c2406618e6513cfbf45303a085d913cb2cabcf2e44e12fc1f263b2a91298 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/networkfirewall_firewall_policy.html.markdown b/website/docs/cdktf/typescript/d/networkfirewall_firewall_policy.html.markdown
new file mode 100644
index 00000000000..67cfb531df7
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/networkfirewall_firewall_policy.html.markdown
@@ -0,0 +1,107 @@
+---
+subcategory: "Network Firewall"
+layout: "aws"
+page_title: "AWS: aws_networkfirewall_firewall_policy"
+description: |-
+  Retrieve information about a firewall policy.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_networkfirewall_firewall_policy
+
+Retrieve information about a firewall policy.
+
+## Example Usage
+
+### Find firewall policy by name
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsNetworkfirewallFirewallPolicy } from "./.gen/providers/aws/data-aws-networkfirewall-firewall-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsNetworkfirewallFirewallPolicy(this, "example", {
+      name: firewallPolicyName.stringValue,
+    });
+  }
+}
+
+```
+
+### Find firewall policy by ARN
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsNetworkfirewallFirewallPolicy } from "./.gen/providers/aws/data-aws-networkfirewall-firewall-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsNetworkfirewallFirewallPolicy(this, "example", {
+      arn: firewallPolicyArn.stringValue,
+    });
+  }
+}
+
+```
+
+### Find firewall policy by name and ARN
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsNetworkfirewallFirewallPolicy } from "./.gen/providers/aws/data-aws-networkfirewall-firewall-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsNetworkfirewallFirewallPolicy(this, "example", {
+      arn: firewallPolicyArn.stringValue,
+      name: firewallPolicyName.stringValue,
+    });
+  }
+}
+
+```
+
+AWS Network Firewall does not allow multiple firewall policies with the same name to be created in an account. It is possible, however, to have multiple firewall policies available in a single account with identical `name` values but distinct `arn` values, e.g. firewall policies shared via a [Resource Access Manager (RAM) share][1]. In that case specifying `arn`, or `name` and `arn`, is recommended.
+
+~> **Note:** If there are multiple firewall policies in an account with the same `name`, and `arn` is not specified, the default behavior will return the firewall policy with `name` that was created in the account.
+
+## Argument Reference
+
+One or more of the following arguments are required:
+
+* `arn` - ARN of the firewall policy.
+* `name` - Descriptive name of the firewall policy.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `description` - Description of the firewall policy.
+* `firewallPolicy` - The [policy][2] for the specified firewall policy.
+* `tags` - Key-value tags for the firewall policy.
+* `updateToken` - Token used for optimistic locking.
+
+[1]: https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ram_resource_share
+[2]: https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/networkfirewall_firewall_policy
+
+<!-- cache-key: cdktf-0.18.0 input-4989affff53c19ef7e5645a5518e7b1231c05395a155119b6668ad481fded458 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/networkfirewall_resource_policy.html.markdown b/website/docs/cdktf/typescript/d/networkfirewall_resource_policy.html.markdown
new file mode 100644
index 00000000000..a40746e016e
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/networkfirewall_resource_policy.html.markdown
@@ -0,0 +1,50 @@
+---
+subcategory: "Network Firewall"
+layout: "aws"
+page_title: "AWS: aws_networkfirewall_resource_policy"
+description: |-
+  Retrieve information about a Network Firewall resource policy.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_networkfirewall_resource_policy
+
+Retrieve information about a Network Firewall resource policy.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsNetworkfirewallResourcePolicy } from "./.gen/providers/aws/data-aws-networkfirewall-resource-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsNetworkfirewallResourcePolicy(this, "example", {
+      resourceArn: resourcePolicyArn.stringValue,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `resourceArn` - (Required) The Amazon Resource Name (ARN) that identifies the resource policy.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - The Amazon Resource Name (ARN) that identifies the resource policy.
+* `policy` - The [policy][1] for the resource.
+
+[1]: https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/networkfirewall_resource_policy
+
+<!-- cache-key: cdktf-0.18.0 input-107f955d750a5b8827c396d72211b79ae4ad8c3cde0654c3353f405a454c633b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/networkmanager_connection.html.markdown b/website/docs/cdktf/typescript/d/networkmanager_connection.html.markdown
new file mode 100644
index 00000000000..ff78aba4ee5
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/networkmanager_connection.html.markdown
@@ -0,0 +1,55 @@
+---
+subcategory: "Network Manager"
+layout: "aws"
+page_title: "AWS: aws_networkmanager_connection"
+description: |-
+  Retrieve information about a connection.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source:  aws_networkmanager_connection
+
+Retrieve information about a connection.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsNetworkmanagerConnection } from "./.gen/providers/aws/data-aws-networkmanager-connection";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsNetworkmanagerConnection(this, "example", {
+      connectionId: connectionId.stringValue,
+      globalNetworkId: globalNetworkId.stringValue,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `globalNetworkId` - (Required) ID of the Global Network of the connection to retrieve.
+* `connectionId` - (Required) ID of the specific connection to retrieve.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the connection.
+* `connectedDeviceId` - ID of the second device in the connection.
+* `connectedLinkId` - ID of the link for the second device.
+* `description` - Description of the connection.
+* `deviceId` - ID of the first device in the connection.
+* `linkId` - ID of the link for the first device.
+* `tags` - Key-value tags for the connection.
+
+<!-- cache-key: cdktf-0.18.0 input-a0cbd17186f4f009da616a66e54bfb81cbdebd2f6465c7c104a1c2b92433b010 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/networkmanager_connections.html.markdown b/website/docs/cdktf/typescript/d/networkmanager_connections.html.markdown
new file mode 100644
index 00000000000..c7e436c159a
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/networkmanager_connections.html.markdown
@@ -0,0 +1,52 @@
+---
+subcategory: "Network Manager"
+layout: "aws"
+page_title: "AWS: aws_networkmanager_connections"
+description: |-
+  Retrieve information about connections.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_networkmanager_connections
+
+Retrieve information about connections.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsNetworkmanagerConnections } from "./.gen/providers/aws/data-aws-networkmanager-connections";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsNetworkmanagerConnections(this, "example", {
+      globalNetworkId: globalNetworkId.stringValue,
+      tags: {
+        Env: "test",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `deviceId` - (Optional) ID of the device of the connections to retrieve.
+* `globalNetworkId` - (Required) ID of the Global Network of the connections to retrieve.
+* `tags` - (Optional) Restricts the list to the connections with these tags.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `ids` - IDs of the connections.
+
+<!-- cache-key: cdktf-0.18.0 input-aa7aa02ec1ffacee6041a548fe2c103f68bb508973cfffa5c9959d6c28550226 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/networkmanager_core_network_policy_document.html.markdown b/website/docs/cdktf/typescript/d/networkmanager_core_network_policy_document.html.markdown
new file mode 100644
index 00000000000..efb26954be7
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/networkmanager_core_network_policy_document.html.markdown
@@ -0,0 +1,281 @@
+---
+subcategory: "Network Manager"
+layout: "aws"
+page_title: "AWS: aws_networkmanager_core_network_policy_document"
+description: |-
+  Generates an Core Network policy document in JSON format
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_networkmanager_core_network_policy_document
+
+Generates a Core Network policy document in JSON format for use with resources that expect core network policy documents such as `awsccNetworkmanagerCoreNetwork`. It follows the API definition from the [core-network-policy documentation](https://docs.aws.amazon.com/vpc/latest/cloudwan/cloudwan-policies-json.html).
+
+Using this data source to generate policy documents is *optional*. It is also valid to use literal JSON strings in your configuration or to use the `file` interpolation function to read a raw JSON policy document from a file.
+
+-> For more information about building AWS Core Network policy documents with Terraform, see the [Using AWS & AWSCC Provider Together Guide](/docs/providers/aws/guides/using-aws-with-awscc-provider.html)
+
+## Example Usage
+
+### Basic Example
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsNetworkmanagerCoreNetworkPolicyDocument } from "./.gen/providers/aws/data-aws-networkmanager-core-network-policy-document";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsNetworkmanagerCoreNetworkPolicyDocument(this, "test", {
+      attachmentPolicies: [
+        {
+          action: {
+            associationMethod: "constant",
+            segment: "shared",
+          },
+          conditionLogic: "or",
+          conditions: [
+            {
+              key: "segment",
+              operator: "equals",
+              type: "tag-value",
+              value: "shared",
+            },
+          ],
+          ruleNumber: 100,
+        },
+        {
+          action: {
+            associationMethod: "constant",
+            segment: "prod",
+          },
+          conditionLogic: "or",
+          conditions: [
+            {
+              key: "segment",
+              operator: "equals",
+              type: "tag-value",
+              value: "prod",
+            },
+          ],
+          ruleNumber: 200,
+        },
+      ],
+      coreNetworkConfiguration: [
+        {
+          asnRanges: ["64512-64555"],
+          edgeLocations: [
+            {
+              asn: Token.asString(64512),
+              location: "us-east-1",
+            },
+            {
+              asn: Token.asString(64513),
+              location: "eu-central-1",
+            },
+          ],
+          vpnEcmpSupport: false,
+        },
+      ],
+      segmentActions: [
+        {
+          action: "share",
+          mode: "attachment-route",
+          segment: "shared",
+          shareWith: ["*"],
+        },
+      ],
+      segments: [
+        {
+          description: "Segment for shared services",
+          name: "shared",
+          requireAttachmentAcceptance: true,
+        },
+        {
+          description: "Segment for prod services",
+          name: "prod",
+          requireAttachmentAcceptance: true,
+        },
+      ],
+    });
+  }
+}
+
+```
+
+`dataAwsNetworkmanagerCoreNetworkPolicyDocumentTestJson` will evaluate to:
+
+```json
+{
+  "version": "2021.12",
+  "core-network-configuration": {
+    "asn-ranges": [
+      "64512-64555"
+    ],
+    "vpn-ecmp-support": false,
+    "edge-locations": [
+      {
+        "location": "us-east-1",
+        "asn": 64512
+      },
+      {
+        "location": "eu-central-1",
+        "asn": 64513
+      }
+    ]
+  },
+  "segments": [
+    {
+      "name": "shared",
+      "description": "Segment for shared services",
+      "require-attachment-acceptance": true
+    },
+    {
+      "name": "prod",
+      "description": "Segment for prod services",
+      "require-attachment-acceptance": true
+    }
+  ],
+  "attachment-policies": [
+    {
+      "rule-number": 100,
+      "action": {
+        "association-method": "constant",
+        "segment": "shared"
+      },
+      "conditions": [
+        {
+          "type": "tag-value",
+          "operator": "equals",
+          "key": "segment",
+          "value": "shared"
+        }
+      ],
+      "condition-logic": "or"
+    },
+    {
+      "rule-number": 200,
+      "action": {
+        "association-method": "constant",
+        "segment": "prod"
+      },
+      "conditions": [
+        {
+          "type": "tag-value",
+          "operator": "equals",
+          "key": "segment",
+          "value": "prod"
+        }
+      ],
+      "condition-logic": "or"
+    }
+  ],
+  "segment-actions": [
+    {
+      "action": "share",
+      "mode": "attachment-route",
+      "segment": "shared",
+      "share-with": "*"
+    }
+  ]
+}
+```
+
+## Argument Reference
+
+The following arguments are available:
+
+* `attachmentPolicies` (Optional) - In a core network, all attachments use the block argument `attachmentPolicies` section to map an attachment to a segment. Instead of manually associating a segment to each attachment, attachments use tags, and then the tags are used to associate the attachment to the specified segment. Detailed below.
+* `coreNetworkConfiguration` (Required) - The core network configuration section defines the Regions where a core network should operate. For AWS Regions that are defined in the policy, the core network creates a Core Network Edge where you can connect attachments. After it's created, each Core Network Edge is peered with every other defined Region and is configured with consistent segment and routing across all Regions. Regions cannot be removed until the associated attachments are deleted. Detailed below.
+* `segments` (Required) - Block argument that defines the different segments in the network. Here you can provide descriptions, change defaults, and provide explicit Regional operational and route filters. The names defined for each segment are used in the `segmentActions` and `attachmentPolicies` section. Each segment is created, and operates, as a completely separated routing domain. By default, attachments can only communicate with other attachments in the same segment. Detailed below.
+* `segmentActions` (Optional) - A block argument, `segmentActions` define how routing works between segments. By default, attachments can only communicate with other attachments in the same segment. Detailed below.
+
+### `attachmentPolicies`
+
+The following arguments are available:
+
+* `action` (Required) - Action to take when a condition is true. Detailed Below.
+* `conditionLogic` (Optional) - Valid values include `and` or `or`. This is a mandatory parameter only if you have more than one condition. The `conditionLogic` apply to all of the conditions for a rule, which also means nested conditions of `and` or `or` are not supported. Use `or` if you want to associate the attachment with the segment by either the segment name or attachment tag value, or by the chosen conditions. Use `and` if you want to associate the attachment with the segment by either the segment name or attachment tag value and by the chosen conditions. Detailed Below.
+* `conditions` (Required) - A block argument. Detailed Below.
+* `description` (Optional) - A user-defined description that further helps identify the rule.
+* `ruleNumber` (Required) - An integer from `1` to `65535` indicating the rule's order number. Rules are processed in order from the lowest numbered rule to the highest. Rules stop processing when a rule is matched. It's important to make sure that you number your rules in the exact order that you want them processed.
+
+### `action`
+
+The following arguments are available:
+
+* `associationMethod` (Required) - Defines how a segment is mapped. Values can be `constant` or `tag`. `constant` statically defines the segment to associate the attachment to. `tag` uses the value of a tag to dynamically try to map to a segment.reference_policies_elements_condition_operators.html) to evaluate.
+* `segment` (Optional) - Name of the `segment` to share as defined in the `segments` section. This is used only when the `associationMethod` is `constant`.
+* `tagValueOfKey` (Optional) - Maps the attachment to the value of a known key. This is used with the `associationMethod` is `tag`. For example a `tag` of `stage = “test”`, will map to a segment named `test`. The value must exactly match the name of a segment. This allows you to have many segments, but use only a single rule without having to define multiple nearly identical conditions. This prevents creating many similar conditions that all use the same keys to map to segments.
+* `requireAcceptance` (Optional) - Determines if this mapping should override the segment value for `requireAttachmentAcceptance`. You can only set this to `true`, indicating that this setting applies only to segments that have `requireAttachmentAcceptance` set to `false`. If the segment already has the default `requireAttachmentAcceptance`, you can set this to inherit segment’s acceptance value.
+
+### `conditions`
+
+The conditions block has 4 arguments `type`, `operator`, `key`, `value`. Setting or omitting each argument requires a combination of logic based on the value set to `type`. For that reason, please refer to the [AWS documentation](https://docs.aws.amazon.com/vpc/latest/cloudwan/cloudwan-policies-json.html) for complete usage docs.
+
+The following arguments are available:
+
+* `type` (Required) - Valid values include: `accountId`, `any`, `tagValue`, `tagExists`, `resourceId`, `region`, `attachmentType`.
+* `operator` (Optional) - Valid values include: `equals`, `notEquals`, `contains`, `beginsWith`.
+* `key` (Optional) - string value
+* `value` (Optional) - string value
+
+### `coreNetworkConfiguration`
+
+The following arguments are available:
+
+* `asnRanges` (Required) - List of strings containing Autonomous System Numbers (ASNs) to assign to Core Network Edges. By default, the core network automatically assigns an ASN for each Core Network Edge but you can optionally define the ASN in the edge-locations for each Region. The ASN uses an array of integer ranges only from `64512` to `65534` and `4200000000` to `4294967294` expressed as a string like `"6451265534"`. No other ASN ranges can be used.
+* `insideCidrBlocks` (Optional) - The Classless Inter-Domain Routing (CIDR) block range used to create tunnels for AWS Transit Gateway Connect. The format is standard AWS CIDR range (for example, `10010/24`). You can optionally define the inside CIDR in the Core Network Edges section per Region. The minimum is a `/24` for IPv4 or `/64` for IPv6. You can provide multiple `/24` subnets or a larger CIDR range. If you define a larger CIDR range, new Core Network Edges will be automatically assigned `/24` and `/64` subnets from the larger CIDR. an Inside CIDR block is required for attaching Connect attachments to a Core Network Edge.
+* `vpnEcmpSupport` (Optional) - Indicates whether the core network forwards traffic over multiple equal-cost routes using VPN. The value can be either `true` or `false`. The default is `true`.
+* `edgeLocations` (Required) - A block value of AWS Region locations where you're creating Core Network Edges. Detailed below.
+
+### `edgeLocations`
+
+The following arguments are available:
+
+* `locations` (Required) - An AWS Region code, such as `usEast1`.
+* `asn` (Optional) - ASN of the Core Network Edge in an AWS Region. By default, the ASN will be a single integer automatically assigned from `asnRanges`
+* `insideCidrBlocks` (Optional) - The local CIDR blocks for this Core Network Edge for AWS Transit Gateway Connect attachments. By default, this CIDR block will be one or more optional IPv4 and IPv6 CIDR prefixes auto-assigned from `insideCidrBlocks`.
+
+### `segments`
+
+The following arguments are available:
+
+* `allowFilter` (Optional) -  List of strings of segment names that explicitly allows only routes from the segments that are listed in the array. Use the `allowFilter` setting if a segment has a well-defined group of other segments that connectivity should be restricted to. It is applied after routes have been shared in `segmentActions`. If a segment is listed in `allowFilter`, attachments between the two segments will have routes if they are also shared in the segment-actions area. For example, you might have a segment named "video-producer" that should only ever share routes with a "video-distributor" segment, no matter how many other share statements are created.
+* `denyFilter` (Optional) - An array of segments that disallows routes from the segments listed in the array. It is applied only after routes have been shared in `segmentActions`. If a segment is listed in the `denyFilter`, attachments between the two segments will never have routes shared across them. For example, you might have a "financial" payment segment that should never share routes with a "development" segment, regardless of how many other share statements are created. Adding the payments segment to the deny-filter parameter prevents any shared routes from being created with other segments.
+* `description` (Optional) - A user-defined string describing the segment.
+* `edgeLocations` (Optional) - A list of strings of AWS Region names. Allows you to define a more restrictive set of Regions for a segment. The edge location must be a subset of the locations that are defined for `edgeLocations` in the `coreNetworkConfiguration`.
+* `isolateAttachments` (Optional) - This Boolean setting determines whether attachments on the same segment can communicate with each other. If set to `true`, the only routes available will be either shared routes through the share actions, which are attachments in other segments, or static routes. The default value is `false`. For example, you might have a segment dedicated to "development" that should never allow VPCs to talk to each other, even if they’re on the same segment. In this example, you would keep the default parameter of `false`.
+* `name` (Required) - Unique name for a segment. The name is a string used in other parts of the policy document, as well as in the console for metrics and other reference points. Valid characters are a–z, and 0–9.
+* `requireAttachmentAcceptance` (Optional) - This Boolean setting determines whether attachment requests are automatically approved or require acceptance. The default is `true`, indicating that attachment requests require acceptance. For example, you might use this setting to allow a "sandbox" segment to allow any attachment request so that a core network or attachment administrator does not need to review and approve attachment requests. In this example, `requireAttachmentAcceptance` is set to `false`.
+
+### `segmentActions`
+
+`segmentActions` have differnet outcomes based on their `action` argument value. There are 2 valid values for `action`: `createRoute` & `share`. Behaviors of the below arguments changed depending on the `action` you specify. For more details on their use see the [AWS documentation](https://docs.aws.amazon.com/vpc/latest/cloudwan/cloudwan-policies-json.html#cloudwan-segment-actions-json).
+
+~> **NOTE:** `shareWith` and `shareWithExcept` break from the AWS API specification. The API has 1 argument `shareWith` and it can accept 3 input types as valid (`"*"`, `["<segmentName>"]`, or `{ except: ["<segment-name>"]}`). To emulate this behavior, `shareWith` is always a list that can accept the argument `["*"]` as valid for `"*"` and `shareWithExcept` is a that can accept `["<segmentName>"]` as valid for `{ except: ["<segment-name>"]}`. You may only specify one of: `shareWith` or `shareWithExcept`.
+
+The following arguments are available:
+
+* `action` (Required) - Action to take for the chosen segment. Valid values `createRoute` or `share`.
+* `description` (Optional) - A user-defined string describing the segment action.
+* `destinationCidrBlocks` (Optional) - List of strings containing CIDRs. You can define the IPv4 and IPv6 CIDR notation for each AWS Region. For example, `10100/16` or `2001:db8::/56`. This is an array of CIDR notation strings.
+* `destinations` (Optional) - A list of strings. Valid values include `["blackhole"]` or a list of attachment ids.
+* `mode` (Optional) - String. This mode places the attachment and return routes in each of the `shareWith` segments. Valid values include: `attachmentRoute`.
+* `segment` (Optional) - Name of the segment.
+* `shareWith` (Optional) - A list of strings to share with. Must be a substring is all segments. Valid values include: `["*"]` or `["<segmentNames>"]`.
+* `shareWithExcept` (Optional) - A set subtraction of segments to not share with.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `json` - Standard JSON policy document rendered based on the arguments above.
+
+<!-- cache-key: cdktf-0.18.0 input-2d3a246690051cddc4eb7a0126e5c94a805d1a1904d829fcafd01fc1ad9efb5b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/networkmanager_device.html.markdown b/website/docs/cdktf/typescript/d/networkmanager_device.html.markdown
new file mode 100644
index 00000000000..d47c48305ec
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/networkmanager_device.html.markdown
@@ -0,0 +1,73 @@
+---
+subcategory: "Network Manager"
+layout: "aws"
+page_title: "AWS: aws_networkmanager_device"
+description: |-
+  Retrieve information about a device.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_networkmanager_device
+
+Retrieve information about a device.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsNetworkmanagerDevice } from "./.gen/providers/aws/data-aws-networkmanager-device";
+interface MyConfig {
+  globalNetworkId: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new DataAwsNetworkmanagerDevice(this, "example", {
+      deviceId: deviceId.stringValue,
+      global_network_id_id: globalNetworkId.value,
+      globalNetworkId: config.globalNetworkId,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `deviceId` - (Required) ID of the device.
+* `globalNetworkId` - (Required) ID of the global network.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the device.
+* `awsLocation` - AWS location of the device. Documented below.
+* `description` - Description of the device.
+* `location` - Location of the device. Documented below.
+* `model` - Model of device.
+* `serialNumber` - Serial number of the device.
+* `siteId` - ID of the site.
+* `tags` - Key-value tags for the device.
+* `type` - Type of device.
+* `vendor` - Vendor of the device.
+
+The `awsLocation` object supports the following:
+
+* `subnetArn` - ARN of the subnet that the device is located in.
+* `zone` - Zone that the device is located in.
+
+The `location` object supports the following:
+
+* `address` - Physical address.
+* `latitude` - Latitude.
+* `longitude` - Longitude.
+
+<!-- cache-key: cdktf-0.18.0 input-76a048bd410df03a668e6600981e43b447b543ed4c21486482b217e2964dea85 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/networkmanager_devices.html.markdown b/website/docs/cdktf/typescript/d/networkmanager_devices.html.markdown
new file mode 100644
index 00000000000..fca30a59175
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/networkmanager_devices.html.markdown
@@ -0,0 +1,52 @@
+---
+subcategory: "Network Manager"
+layout: "aws"
+page_title: "AWS: aws_networkmanager_devices"
+description: |-
+  Retrieve information about devices.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_networkmanager_devices
+
+Retrieve information about devices.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsNetworkmanagerDevices } from "./.gen/providers/aws/data-aws-networkmanager-devices";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsNetworkmanagerDevices(this, "example", {
+      globalNetworkId: globalNetworkId.stringValue,
+      tags: {
+        Env: "test",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `globalNetworkId` - (Required) ID of the Global Network of the devices to retrieve.
+* `siteId` - (Optional) ID of the site of the devices to retrieve.
+* `tags` - (Optional) Restricts the list to the devices with these tags.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `ids` - IDs of the devices.
+
+<!-- cache-key: cdktf-0.18.0 input-9df9546ef10dcce363950ea6c2c54dab55158382413f15d47a541efaeb75a8bb -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/networkmanager_global_network.html.markdown b/website/docs/cdktf/typescript/d/networkmanager_global_network.html.markdown
new file mode 100644
index 00000000000..56a07f29934
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/networkmanager_global_network.html.markdown
@@ -0,0 +1,49 @@
+---
+subcategory: "Network Manager"
+layout: "aws"
+page_title: "AWS: aws_networkmanager_global_network"
+description: |-
+  Retrieve information about a global network.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_networkmanager_global_network
+
+Retrieve information about a global network.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsNetworkmanagerGlobalNetwork } from "./.gen/providers/aws/data-aws-networkmanager-global-network";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsNetworkmanagerGlobalNetwork(this, "example", {
+      globalNetworkId: globalNetworkId.stringValue,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `globalNetworkId` - (Required) ID of the specific global network to retrieve.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the global network.
+* `description` - Description of the global network.
+* `tags` - Map of resource tags.
+
+<!-- cache-key: cdktf-0.18.0 input-2beedb9058cb6af0278a82e6f6239295f59bb32ff22d4cf013144823c528e416 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/networkmanager_global_networks.html.markdown b/website/docs/cdktf/typescript/d/networkmanager_global_networks.html.markdown
new file mode 100644
index 00000000000..8406fe97df8
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/networkmanager_global_networks.html.markdown
@@ -0,0 +1,49 @@
+---
+subcategory: "Network Manager"
+layout: "aws"
+page_title: "AWS: aws_networkmanager_global_networks"
+description: |-
+  Retrieve information about global networks.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_networkmanager_global_networks
+
+Retrieve information about global networks.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsNetworkmanagerGlobalNetworks } from "./.gen/providers/aws/data-aws-networkmanager-global-networks";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsNetworkmanagerGlobalNetworks(this, "example", {
+      tags: {
+        Env: "test",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `tags` - (Optional) Restricts the list to the global networks with these tags.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `ids` - IDs of the global networks.
+
+<!-- cache-key: cdktf-0.18.0 input-caac60dd34c0be6b782428c6a470c9e4f07734555611246ab87a27c694b566de -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/networkmanager_link.html.markdown b/website/docs/cdktf/typescript/d/networkmanager_link.html.markdown
new file mode 100644
index 00000000000..1224773f353
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/networkmanager_link.html.markdown
@@ -0,0 +1,60 @@
+---
+subcategory: "Network Manager"
+layout: "aws"
+page_title: "AWS: aws_networkmanager_link"
+description: |-
+  Retrieve information about a link.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source:  aws_networkmanager_link
+
+Retrieve information about a link.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsNetworkmanagerLink } from "./.gen/providers/aws/data-aws-networkmanager-link";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsNetworkmanagerLink(this, "example", {
+      globalNetworkId: globalNetworkId.stringValue,
+      linkId: linkId.stringValue,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `globalNetworkId` - (Required) ID of the Global Network of the link to retrieve.
+* `linkId` - (Required) ID of the specific link to retrieve.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the link.
+* `bandwidth` - Upload speed and download speed of the link as documented below
+* `description` - Description of the link.
+* `providerName` - Provider of the link.
+* `siteId` - ID of the site.
+* `tags` - Key-value tags for the link.
+* `type` - Type of the link.
+
+The `bandwidth` object supports the following:
+
+* `downloadSpeed` - Download speed in Mbps.
+* `uploadSpeed` - Upload speed in Mbps.
+
+<!-- cache-key: cdktf-0.18.0 input-1bb44c97d9c2c1eb71096f7293f01a1e8423d9ada68f26d6602f08c19b25554d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/networkmanager_links.html.markdown b/website/docs/cdktf/typescript/d/networkmanager_links.html.markdown
new file mode 100644
index 00000000000..be7c71846c0
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/networkmanager_links.html.markdown
@@ -0,0 +1,54 @@
+---
+subcategory: "Network Manager"
+layout: "aws"
+page_title: "AWS: aws_networkmanager_links"
+description: |-
+  Retrieve information about links.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_networkmanager_links
+
+Retrieve information about link.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsNetworkmanagerLinks } from "./.gen/providers/aws/data-aws-networkmanager-links";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsNetworkmanagerLinks(this, "example", {
+      globalNetworkId: globalNetworkId.stringValue,
+      tags: {
+        Env: "test",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `globalNetworkId` - (Required) ID of the Global Network of the links to retrieve.
+* `providerName` - (Optional) Link provider to retrieve.
+* `siteId` - (Optional) ID of the site of the links to retrieve.
+* `tags` - (Optional) Restricts the list to the links with these tags.
+* `type` - (Optional) Link type to retrieve.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `ids` - IDs of the links.
+
+<!-- cache-key: cdktf-0.18.0 input-1487eb3f5d87d6cd23f55d505c7f05610224dba8734fb0a6bb26595cb48f7494 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/networkmanager_site.html.markdown b/website/docs/cdktf/typescript/d/networkmanager_site.html.markdown
new file mode 100644
index 00000000000..308f6edaf78
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/networkmanager_site.html.markdown
@@ -0,0 +1,58 @@
+---
+subcategory: "Network Manager"
+layout: "aws"
+page_title: "AWS: aws_networkmanager_site"
+description: |-
+  Retrieve information about a site.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source:  aws_networkmanager_site
+
+Retrieve information about a site.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsNetworkmanagerSite } from "./.gen/providers/aws/data-aws-networkmanager-site";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsNetworkmanagerSite(this, "example", {
+      globalNetworkId: globalNetworkId.stringValue,
+      siteId: siteId.stringValue,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `globalNetworkId` - (Required) ID of the Global Network of the site to retrieve.
+* `siteId` - (Required) ID of the specific site to retrieve.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the site.
+* `description` - Description of the site.
+* `location` - Site location as documented below.
+* `tags` - Key-value tags for the Site.
+
+The `location` object supports the following:
+
+* `address` - Address of the location.
+* `latitude` - Latitude of the location.
+* `longitude` - Longitude of the location.
+
+<!-- cache-key: cdktf-0.18.0 input-2cbfc4283cdeeff2ae18f90ca3f052f344762564bd54bf48bd929558cd8d2825 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/networkmanager_sites.html.markdown b/website/docs/cdktf/typescript/d/networkmanager_sites.html.markdown
new file mode 100644
index 00000000000..35380b8cbc6
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/networkmanager_sites.html.markdown
@@ -0,0 +1,51 @@
+---
+subcategory: "Network Manager"
+layout: "aws"
+page_title: "AWS: aws_networkmanager_sites"
+description: |-
+  Retrieve information about sites.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_networkmanager_sites
+
+Retrieve information about sites.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsNetworkmanagerSites } from "./.gen/providers/aws/data-aws-networkmanager-sites";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsNetworkmanagerSites(this, "example", {
+      globalNetworkId: globalNetworkId.stringValue,
+      tags: {
+        Env: "test",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `globalNetworkId` - (Required) ID of the Global Network of the sites to retrieve.
+* `tags` - (Optional) Restricts the list to the sites with these tags.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `ids` - IDs of the sites.
+
+<!-- cache-key: cdktf-0.18.0 input-08e4f00d2370cfd3791e0040e3d3ac4c38eb5a633f54bd737b6c7bfb36230318 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/oam_link.html.markdown b/website/docs/cdktf/typescript/d/oam_link.html.markdown
new file mode 100644
index 00000000000..e27ff74a420
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/oam_link.html.markdown
@@ -0,0 +1,57 @@
+---
+subcategory: "CloudWatch Observability Access Manager"
+layout: "aws"
+page_title: "AWS: aws_oam_link"
+description: |-
+  Terraform data source for managing an AWS CloudWatch Observability Access Manager Link.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_oam_link
+
+Terraform data source for managing an AWS CloudWatch Observability Access Manager Link.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsOamLink } from "./.gen/providers/aws/data-aws-oam-link";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsOamLink(this, "example", {
+      linkIdentifier:
+        "arn:aws:oam:us-west-1:111111111111:link/abcd1234-a123-456a-a12b-a123b456c789",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `linkIdentifier` - (Required) ARN of the link.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the link.
+* `label` - Label that is assigned to this link.
+* `labelTemplate` - Human-readable name used to identify this source account when you are viewing data from it in the monitoring account.
+* `linkId` - ID string that AWS generated as part of the link ARN.
+* `resourceTypes` - Types of data that the source account shares with the monitoring account.
+* `sinkArn` - ARN of the sink that is used for this link.
+
+<!-- cache-key: cdktf-0.18.0 input-26fcd6d6196bf524f0cfb96d5f07e971f686ef152091f112f43b672b61693a13 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/oam_links.html.markdown b/website/docs/cdktf/typescript/d/oam_links.html.markdown
new file mode 100644
index 00000000000..88f608211cd
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/oam_links.html.markdown
@@ -0,0 +1,43 @@
+---
+subcategory: "CloudWatch Observability Access Manager"
+layout: "aws"
+page_title: "AWS: aws_oam_links"
+description: |-
+  Terraform data source for managing an AWS CloudWatch Observability Access Manager Links.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_oam_links
+
+Terraform data source for managing an AWS CloudWatch Observability Access Manager Links.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsOamLinks } from "./.gen/providers/aws/data-aws-oam-links";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsOamLinks(this, "example", {});
+  }
+}
+
+```
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arns` - Set of ARN of the Links.
+
+<!-- cache-key: cdktf-0.18.0 input-a7fb5ca672e8b3f4688abaeffd562fa606b998eadee65b1f1a1a5566b670b2db -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/oam_sink.html.markdown b/website/docs/cdktf/typescript/d/oam_sink.html.markdown
new file mode 100644
index 00000000000..77d24695159
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/oam_sink.html.markdown
@@ -0,0 +1,55 @@
+---
+subcategory: "CloudWatch Observability Access Manager"
+layout: "aws"
+page_title: "AWS: aws_oam_sink"
+description: |-
+  Terraform data source for managing an AWS CloudWatch Observability Access Manager Sink.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_oam_sink
+
+Terraform data source for managing an AWS CloudWatch Observability Access Manager Sink.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsOamSink } from "./.gen/providers/aws/data-aws-oam-sink";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsOamSink(this, "example", {
+      sinkIdentifier:
+        "arn:aws:oam:us-west-1:111111111111:sink/abcd1234-a123-456a-a12b-a123b456c789",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `sinkIdentifier` - (Required) ARN of the sink.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the sink.
+* `name` - Name of the sink.
+* `sinkId` - Random ID string that AWS generated as part of the sink ARN.
+* `tags` - Tags assigned to the sink.
+
+<!-- cache-key: cdktf-0.18.0 input-a4f5dba9c965dac580e8ea80924e17cc8d99e843f54e4829277a40c5b1d4e297 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/oam_sinks.html.markdown b/website/docs/cdktf/typescript/d/oam_sinks.html.markdown
new file mode 100644
index 00000000000..e3b8d5369b2
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/oam_sinks.html.markdown
@@ -0,0 +1,43 @@
+---
+subcategory: "CloudWatch Observability Access Manager"
+layout: "aws"
+page_title: "AWS: aws_oam_sinks"
+description: |-
+  Terraform data source for managing an AWS CloudWatch Observability Access Manager Sinks.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_oam_sinks
+
+Terraform data source for managing an AWS CloudWatch Observability Access Manager Sinks.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsOamSinks } from "./.gen/providers/aws/data-aws-oam-sinks";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsOamSinks(this, "example", {});
+  }
+}
+
+```
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arns` - Set of ARN of the Sinks.
+
+<!-- cache-key: cdktf-0.18.0 input-b46f5566657905f2a09bc4770daf56461626b99543a0e965bfb54b6891ad7156 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/opensearch_domain.html.markdown b/website/docs/cdktf/typescript/d/opensearch_domain.html.markdown
new file mode 100644
index 00000000000..8a9bfd93d1d
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/opensearch_domain.html.markdown
@@ -0,0 +1,121 @@
+---
+subcategory: "OpenSearch"
+layout: "aws"
+page_title: "AWS: aws_opensearch_domain"
+description: |-
+  Get information on an OpenSearch Domain resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_opensearch_domain
+
+Use this data source to get information about an OpenSearch Domain
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsOpensearchDomain } from "./.gen/providers/aws/data-aws-opensearch-domain";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsOpensearchDomain(this, "my_domain", {
+      domainName: "my-domain-name",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `domainName` – (Required) Name of the domain.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `accessPolicies` – Policy document attached to the domain.
+* `advancedOptions` - Key-value string pairs to specify advanced configuration options.
+* `advancedSecurityOptions` - Status of the OpenSearch domain's advanced security options. The block consists of the following attributes:
+    * `enabled` - Whether advanced security is enabled.
+    * `internalUserDatabaseEnabled` - Whether the internal user database is enabled.
+* `arn` – ARN of the domain.
+* `autoTuneOptions` - Configuration of the Auto-Tune options of the domain.
+    * `desiredState` - Auto-Tune desired state for the domain.
+    * `maintenanceSchedule` - A list of the nested configurations for the Auto-Tune maintenance windows of the domain.
+        * `startAt` - Date and time at which the Auto-Tune maintenance schedule starts in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8).
+        * `duration` - Configuration block for the duration of the Auto-Tune maintenance window.
+            * `value` - Duration of an Auto-Tune maintenance window.
+            * `unit` - Unit of time.
+        * `cronExpressionForRecurrence` - Cron expression for an Auto-Tune maintenance schedule.
+    * `rollbackOnDisable` - Whether the domain is set to roll back to default Auto-Tune settings when disabling Auto-Tune.
+* `clusterConfig` - Cluster configuration of the domain.
+    * `coldStorageOptions` - Configuration block containing cold storage configuration.
+        * `enabled` - Indicates  cold storage is enabled.
+    * `instanceType` - Instance type of data nodes in the cluster.
+    * `instanceCount` - Number of instances in the cluster.
+    * `dedicatedMasterEnabled` - Indicates whether dedicated master nodes are enabled for the cluster.
+    * `dedicatedMasterType` - Instance type of the dedicated master nodes in the cluster.
+    * `dedicatedMasterCount` - Number of dedicated master nodes in the cluster.
+    * `zoneAwarenessEnabled` - Indicates whether zone awareness is enabled.
+    * `zoneAwarenessConfig` - Configuration block containing zone awareness settings.
+        * `availabilityZoneCount` - Number of availability zones used.
+    * `warmEnabled` - Warm storage is enabled.
+    * `warmCount` - Number of warm nodes in the cluster.
+    * `warmType` - Instance type for the OpenSearch cluster's warm nodes.
+* `cognitoOptions` - Domain Amazon Cognito Authentication options for Dashboard.
+    * `enabled` - Whether Amazon Cognito Authentication is enabled.
+    * `userPoolId` - Cognito User pool used by the domain.
+    * `identityPoolId` - Cognito Identity pool used by the domain.
+    * `roleArn` - IAM Role with the AmazonOpenSearchServiceCognitoAccess policy attached.
+* `created` – Status of the creation of the domain.
+* `deleted` – Status of the deletion of the domain.
+* `domainId` – Unique identifier for the domain.
+* `ebsOptions` - EBS Options for the instances in the domain.
+    * `ebsEnabled` - Whether EBS volumes are attached to data nodes in the domain.
+    * `throughput` - The throughput (in MiB/s) of the EBS volumes attached to data nodes.
+    * `volumeType` - Type of EBS volumes attached to data nodes.
+    * `volumeSize` - Size of EBS volumes attached to data nodes (in GB).
+    * `iops` - Baseline input/output (I/O) performance of EBS volumes attached to data nodes.
+* `engineVersion` – OpenSearch version for the domain.
+* `encryptionAtRest` - Domain encryption at rest related options.
+    * `enabled` - Whether encryption at rest is enabled in the domain.
+    * `kmsKeyId` - KMS key id used to encrypt data at rest.
+* `endpoint` – Domain-specific endpoint used to submit index, search, and data upload requests.
+* `dashboardEndpoint` - Domain-specific endpoint used to access the [Dashboard application](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/dashboards.html).
+* `kibanaEndpoint` - (**Deprecated**) Domain-specific endpoint for kibana without https scheme. Use the `dashboardEndpoint` attribute instead.
+* `logPublishingOptions` - Domain log publishing related options.
+    * `logType` - Type of OpenSearch log being published.
+    * `cloudwatchLogGroupArn` - CloudWatch Log Group where the logs are published.
+    * `enabled` - Whether log publishing is enabled.
+* `nodeToNodeEncryption` - Domain in transit encryption related options.
+    * `enabled` - Whether node to node encryption is enabled.
+* `offPeakWindowOptions` - Off Peak update options
+    * `enabled` - Enabled disabled toggle for off-peak update window
+    * `offPeakWindow`
+        * `windowStartTime` - 10h window for updates
+            * `hours` - Starting hour of the 10-hour window for updates
+            * `minutes` - Starting minute of the 10-hour window for updates
+* `processing` – Status of a configuration change in the domain.
+* `snapshotOptions` – Domain snapshot related options.
+    * `automatedSnapshotStartHour` - Hour during which the service takes an automated daily snapshot of the indices in the domain.
+* `softwareUpdateOptions` - Software update options for the domain
+    * `autoSoftwareUpdateEnabled` - Enabled or disabled.
+* `tags` - Tags assigned to the domain.
+* `vpcOptions` - VPC Options for private OpenSearch domains.
+    * `availabilityZones` - Availability zones used by the domain.
+    * `securityGroupIds` - Security groups used by the domain.
+    * `subnetIds` - Subnets used by the domain.
+    * `vpcId` - VPC used by the domain.
+
+<!-- cache-key: cdktf-0.18.0 input-4b1000ae383db531a922afd36d146f59e8c9e92158fd3664a1e082f23a890d8d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/opensearchserverless_access_policy.html.markdown b/website/docs/cdktf/typescript/d/opensearchserverless_access_policy.html.markdown
new file mode 100644
index 00000000000..5ea281b66e8
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/opensearchserverless_access_policy.html.markdown
@@ -0,0 +1,55 @@
+---
+subcategory: "OpenSearch Serverless"
+layout: "aws"
+page_title: "AWS: aws_opensearchserverless_access_policy"
+description: |-
+  Terraform data source for managing an AWS OpenSearch Serverless Access Policy.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_opensearchserverless_access_policy
+
+Terraform data source for managing an AWS OpenSearch Serverless Access Policy.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsOpensearchserverlessAccessPolicy } from "./.gen/providers/aws/data-aws-opensearchserverless-access-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsOpensearchserverlessAccessPolicy(this, "example", {
+      name: Token.asString(awsOpensearchserverlessAccessPolicyExample.name),
+      type: Token.asString(awsOpensearchserverlessAccessPolicyExample.type),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) Name of the policy.
+* `type` - (Required) Type of access policy. Must be `data`.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `description` - Description of the policy. Typically used to store information about the permissions defined in the policy.
+* `policy` - JSON policy document to use as the content for the new policy.
+* `policyVersion` - Version of the policy.
+
+<!-- cache-key: cdktf-0.18.0 input-ac35c9dc57ef1f9e36ad182e014949ca30f6f5bc2316c4bcf6e057aee396e895 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/opensearchserverless_collection.html.markdown b/website/docs/cdktf/typescript/d/opensearchserverless_collection.html.markdown
new file mode 100644
index 00000000000..6f1464cc883
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/opensearchserverless_collection.html.markdown
@@ -0,0 +1,60 @@
+---
+subcategory: "OpenSearch Serverless"
+layout: "aws"
+page_title: "AWS: aws_opensearchserverless_collection"
+description: |-
+  Terraform data source for managing an AWS OpenSearch Serverless Collection.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_opensearchserverless_collection
+
+Terraform data source for managing an AWS OpenSearch Serverless Collection.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsOpensearchserverlessCollection } from "./.gen/providers/aws/data-aws-opensearchserverless-collection";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsOpensearchserverlessCollection(this, "example", {
+      name: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `id` - (Required) ID of the collection. Either `id` or `name` must be provided.
+* `name` - (Required) Name of the collection. Either `name` or `id` must be provided.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the collection.
+* `collectionEndpoint` - Collection-specific endpoint used to submit index, search, and data upload requests to an OpenSearch Serverless collection.
+* `createdDate` - Date the Collection was created.
+* `dashboardEndpoint` - Collection-specific endpoint used to access OpenSearch Dashboards.
+* `description` - Description of the collection.
+* `kmsKeyArn` - The ARN of the Amazon Web Services KMS key used to encrypt the collection.
+* `lastModifiedDate` - Date the Collection was last modified.
+* `tags` - A map of tags to assign to the collection.
+* `type` - Type of collection.
+
+<!-- cache-key: cdktf-0.18.0 input-c332ac6004d40b1ef96d276212bcda57926844a7182625fd0fc4322010b56bb6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/opensearchserverless_security_config.html.markdown b/website/docs/cdktf/typescript/d/opensearchserverless_security_config.html.markdown
new file mode 100644
index 00000000000..1276b0b6b08
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/opensearchserverless_security_config.html.markdown
@@ -0,0 +1,65 @@
+---
+subcategory: "OpenSearch Serverless"
+layout: "aws"
+page_title: "AWS: aws_opensearchserverless_security_config"
+description: |-
+  Terraform data source for managing an AWS OpenSearch Serverless Security Config.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_opensearchserverless_security_config
+
+Terraform data source for managing an AWS OpenSearch Serverless Security Config.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsOpensearchserverlessSecurityConfig } from "./.gen/providers/aws/data-aws-opensearchserverless-security-config";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsOpensearchserverlessSecurityConfig(this, "example", {
+      id: "saml/12345678912/example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `id` - (Required) The unique identifier of the security configuration.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `configVersion` - The version of the security configuration.
+* `createdDate` - The date the configuration was created.
+* `description` - The description of the security configuration.
+* `lastModifiedDate` - The date the configuration was last modified.
+* `samlOptions` - SAML options for the security configuration.
+* `type` - The type of security configuration.
+
+### saml_options
+
+SAML options for the security configuration.
+
+* `groupAttribute` - Group attribute for this SAML integration.
+* `metadata` - The XML IdP metadata file generated from your identity provider.
+* `sessionTimeout` - Session timeout, in minutes. Minimum is 5 minutes and maximum is 720 minutes (12 hours). Default is 60 minutes.
+* `userAttribute` - User attribute for this SAML integration.
+
+<!-- cache-key: cdktf-0.18.0 input-8187974261e12b138d3a7e197de7ca26b20f843eafab8ec86b4f5a9e972ddaa6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/opensearchserverless_security_policy.html.markdown b/website/docs/cdktf/typescript/d/opensearchserverless_security_policy.html.markdown
new file mode 100644
index 00000000000..ae50c81c072
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/opensearchserverless_security_policy.html.markdown
@@ -0,0 +1,55 @@
+---
+subcategory: "OpenSearch Serverless"
+layout: "aws"
+page_title: "AWS: aws_opensearchserverless_security_policy"
+description: |-
+  Get information on an OpenSearch Serverless Security Policy.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_opensearchserverless_security_policy
+
+Use this data source to get information about an AWS OpenSearch Serverless Security Policy.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsOpensearchserverlessSecurityPolicy } from "./.gen/providers/aws/data-aws-opensearchserverless-security-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsOpensearchserverlessSecurityPolicy(this, "example", {
+      name: "example-security-policy",
+      type: "encryption",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name of the policy
+* `type` - (Required) Type of security policy. One of `encryption` or `network`.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `createdDate` - The date the security policy was created.
+* `description` - Description of the security policy.
+* `lastModifiedDate` - The date the security policy was last modified.
+* `policy` - The JSON policy document without any whitespaces.
+* `policyVersion` - Version of the policy.
+
+<!-- cache-key: cdktf-0.18.0 input-ad99e2a9f8c79ed6569c0fb0eb9b7ab2fea24fd51596cfcf3c67bf8b48f6cd78 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/opensearchserverless_vpc_endpoint.html.markdown b/website/docs/cdktf/typescript/d/opensearchserverless_vpc_endpoint.html.markdown
new file mode 100644
index 00000000000..80630bb8532
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/opensearchserverless_vpc_endpoint.html.markdown
@@ -0,0 +1,53 @@
+---
+subcategory: "OpenSearch Serverless"
+layout: "aws"
+page_title: "AWS: aws_opensearchserverless_vpc_endpoint"
+description: |-
+  Terraform data source for managing an AWS OpenSearch Serverless VPC Endpoint.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_opensearchserverless_vpc_endpoint
+
+Terraform data source for managing an AWS OpenSearch Serverless VPC Endpoint.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsOpensearchserverlessVpcEndpoint } from "./.gen/providers/aws/data-aws-opensearchserverless-vpc-endpoint";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsOpensearchserverlessVpcEndpoint(this, "example", {
+      vpcEndpointId: "vpce-829a4487959e2a839",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `vpcEndpointId` - (Required) The unique identifier of the endpoint.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `createdDate` - The date the endpoint was created.
+* `name` - The name of the endpoint.
+* `securityGroupIds` - The IDs of the security groups that define the ports, protocols, and sources for inbound traffic that you are authorizing into your endpoint.
+* `subnetIds` - The IDs of the subnets from which you access OpenSearch Serverless.
+* `vpcId` - The ID of the VPC from which you access OpenSearch Serverless.
+
+<!-- cache-key: cdktf-0.18.0 input-2c446629971d0d10ff448173c283856675b8628bf661beac57c916ae51592d6d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/organizations_delegated_administrators.html.markdown b/website/docs/cdktf/typescript/d/organizations_delegated_administrators.html.markdown
new file mode 100644
index 00000000000..d4a672b9ecf
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/organizations_delegated_administrators.html.markdown
@@ -0,0 +1,55 @@
+---
+subcategory: "Organizations"
+layout: "aws"
+page_title: "AWS: aws_organizations_delegated_administrators"
+description: |-
+  Get a list of AWS accounts that are designated as delegated administrators in this organization 
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_organizations_delegated_administrators
+
+Get a list of AWS accounts that are designated as delegated administrators in this organization
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsOrganizationsDelegatedAdministrators } from "./.gen/providers/aws/data-aws-organizations-delegated-administrators";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsOrganizationsDelegatedAdministrators(this, "example", {
+      servicePrincipal: "SERVICE PRINCIPAL",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `servicePrincipal` - (Optional) Specifies a service principal name. If specified, then the operation lists the delegated administrators only for the specified service. If you don't specify a service principal, the operation lists all delegated administrators for all services in your organization.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `delegatedAdministrators` - The list of delegated administrators in your organization, which have the following attributes:
+    * `arn` - The ARN of the delegated administrator's account.
+    * `delegationEnabledDate` - The date when the account was made a delegated administrator.
+    * `email` - The email address that is associated with the delegated administrator's AWS account.
+    * `id` - The unique identifier (ID) of the delegated administrator's account.
+    * `joinedMethod` - The method by which the delegated administrator's account joined the organization.
+    * `joinedTimestamp` - The date when the delegated administrator's account became a part of the organization.
+    * `name` - The friendly name of the delegated administrator's account.
+    * `status` - The status of the delegated administrator's account in the organization.
+
+<!-- cache-key: cdktf-0.18.0 input-109c5f762c0d10ecbb15ab59b2bb18f8653bf89c01823c41fe23ae6036327116 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/organizations_delegated_services.html.markdown b/website/docs/cdktf/typescript/d/organizations_delegated_services.html.markdown
new file mode 100644
index 00000000000..79b4c3d974a
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/organizations_delegated_services.html.markdown
@@ -0,0 +1,49 @@
+---
+subcategory: "Organizations"
+layout: "aws"
+page_title: "AWS: aws_organizations_delegated_services"
+description: |-
+  Get a list the AWS services for which the specified account is a delegated administrator 
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_organizations_delegated_services
+
+Get a list the AWS services for which the specified account is a delegated administrator
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsOrganizationsDelegatedServices } from "./.gen/providers/aws/data-aws-organizations-delegated-services";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsOrganizationsDelegatedServices(this, "example", {
+      accountId: "AWS ACCOUNT ID",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `accountId` - (Required) Account ID number of a delegated administrator account in the organization.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `delegatedServices` - Services for which the account is a delegated administrator, which have the following attributes:
+    * `delegationEnabledDate` - The date that the account became a delegated administrator for this service.
+    * `servicePrincipal` - The name of an AWS service that can request an operation for the specified service.
+
+<!-- cache-key: cdktf-0.18.0 input-75948a55ba6b06c24be13238e2f8b8e4a682a05352b790ab2e35e7f82c3c8577 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/organizations_organization.html.markdown b/website/docs/cdktf/typescript/d/organizations_organization.html.markdown
new file mode 100644
index 00000000000..329d0adba07
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/organizations_organization.html.markdown
@@ -0,0 +1,143 @@
+---
+subcategory: "Organizations"
+layout: "aws"
+page_title: "AWS: aws_organizations_organization"
+description: |-
+  Get information about the organization that the user's account belongs to
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_organizations_organization
+
+Get information about the organization that the user's account belongs to
+
+## Example Usage
+
+### List all account IDs for the organization
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformOutput, Fn, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsOrganizationsOrganization } from "./.gen/providers/aws/data-aws-organizations-organization";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new DataAwsOrganizationsOrganization(this, "example", {});
+    new TerraformOutput(this, "account_ids", {
+      value: Fn.lookupNested(example.accounts, ["*", "id"]),
+    });
+  }
+}
+
+```
+
+### SNS topic that can be interacted by the organization only
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { DataAwsOrganizationsOrganization } from "./.gen/providers/aws/data-aws-organizations-organization";
+import { SnsTopic } from "./.gen/providers/aws/sns-topic";
+import { SnsTopicPolicy } from "./.gen/providers/aws/sns-topic-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const snsTopic = new SnsTopic(this, "sns_topic", {
+      name: "my-sns-topic",
+    });
+    const example = new DataAwsOrganizationsOrganization(this, "example", {});
+    const snsTopicPolicy = new DataAwsIamPolicyDocument(
+      this,
+      "sns_topic_policy",
+      {
+        statement: [
+          {
+            actions: ["SNS:Subscribe", "SNS:Publish"],
+            condition: [
+              {
+                test: "StringEquals",
+                values: [Token.asString(example.id)],
+                variable: "aws:PrincipalOrgID",
+              },
+            ],
+            effect: "Allow",
+            principals: [
+              {
+                identifiers: ["*"],
+                type: "AWS",
+              },
+            ],
+            resources: [snsTopic.arn],
+          },
+        ],
+      }
+    );
+    const awsSnsTopicPolicySnsTopicPolicy = new SnsTopicPolicy(
+      this,
+      "sns_topic_policy_3",
+      {
+        arn: snsTopic.arn,
+        policy: Token.asString(snsTopicPolicy.json),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSnsTopicPolicySnsTopicPolicy.overrideLogicalId("sns_topic_policy");
+  }
+}
+
+```
+
+## Argument Reference
+
+There are no arguments available for this data source.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the organization.
+* `featureSet` - FeatureSet of the organization.
+* `id` - ID of the organization.
+* `masterAccountArn` - ARN of the account that is designated as the master account for the organization.
+* `masterAccountEmail` - The email address that is associated with the AWS account that is designated as the master account for the organization.
+* `masterAccountId` - Unique identifier (ID) of the master account of an organization.
+
+### Master Account or Delegated Administrator Attribute Reference
+
+If the account is the master account or a delegated administrator for the organization, the following attributes are also exported:
+
+* `accounts` - List of organization accounts including the master account. For a list excluding the master account, see the `nonMasterAccounts` attribute. All elements have these attributes:
+    * `arn` - ARN of the account
+    * `email` - Email of the account
+    * `id` - Identifier of the account
+    * `name` - Name of the account
+    * `status` - Status of the account
+* `awsServiceAccessPrincipals` - A list of AWS service principal names that have integration enabled with your organization. Organization must have `featureSet` set to `all`. For additional information, see the [AWS Organizations User Guide](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_integrate_services.html).
+* `enabledPolicyTypes` - A list of Organizations policy types that are enabled in the Organization Root. Organization must have `featureSet` set to `all`. For additional information about valid policy types (e.g., `serviceControlPolicy`), see the [AWS Organizations API Reference](https://docs.aws.amazon.com/organizations/latest/APIReference/API_EnablePolicyType.html).
+* `nonMasterAccounts` - List of organization accounts excluding the master account. For a list including the master account, see the `accounts` attribute. All elements have these attributes:
+    * `arn` - ARN of the account
+    * `email` - Email of the account
+    * `id` - Identifier of the account
+    * `name` - Name of the account
+    * `status` - Status of the account
+* `roots` - List of organization roots. All elements have these attributes:
+    * `arn` - ARN of the root
+    * `id` - Identifier of the root
+    * `name` - Name of the root
+    * `policyTypes` - List of policy types enabled for this root. All elements have these attributes:
+        * `name` - The name of the policy type
+        * `status` - The status of the policy type as it relates to the associated root
+
+<!-- cache-key: cdktf-0.18.0 input-4e6e30bcec5e05a330427cb7ef2a21c714b5908caa1af760eadc9537632c8f92 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/organizations_organizational_unit.html.markdown b/website/docs/cdktf/typescript/d/organizations_organizational_unit.html.markdown
new file mode 100644
index 00000000000..e9da8ddecd0
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/organizations_organizational_unit.html.markdown
@@ -0,0 +1,58 @@
+---
+subcategory: "Organizations"
+layout: "aws"
+page_title: "AWS: aws_organizations_organizational_unit"
+description: |-
+  Terraform data source for getting an AWS Organizations Organizational Unit.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_organizations_organizational_unit
+
+Terraform data source for getting an AWS Organizations Organizational Unit.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsOrganizationsOrganization } from "./.gen/providers/aws/data-aws-organizations-organization";
+import { DataAwsOrganizationsOrganizationalUnit } from "./.gen/providers/aws/data-aws-organizations-organizational-unit";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const org = new DataAwsOrganizationsOrganization(this, "org", {});
+    new DataAwsOrganizationsOrganizationalUnit(this, "ou", {
+      name: "dev",
+      parentId: Token.asString(Fn.lookupNested(org.roots, ["0", "id"])),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `parentId` - (Required) Parent ID of the organizational unit.
+
+* `name` - (Required) Name of the organizational unit
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the organizational unit
+
+* `id` - ID of the organizational unit
+
+<!-- cache-key: cdktf-0.18.0 input-e56dc041babcb69fcbea16355a3a2d9d89e93f6d8fb748bce77dcff633eefa4b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/organizations_organizational_unit_child_accounts.html.markdown b/website/docs/cdktf/typescript/d/organizations_organizational_unit_child_accounts.html.markdown
new file mode 100644
index 00000000000..4923dbf3248
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/organizations_organizational_unit_child_accounts.html.markdown
@@ -0,0 +1,55 @@
+---
+subcategory: "Organizations"
+layout: "aws"
+page_title: "AWS: aws_organizations_organizational_unit_child_accounts"
+description: |-
+  Get all direct child accounts under a parent organizational unit. This only provides immediate children, not all children.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_organizations_organizational_unit_child_accounts
+
+Get all direct child accounts under a parent organizational unit. This only provides immediate children, not all children.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsOrganizationsOrganization } from "./.gen/providers/aws/data-aws-organizations-organization";
+import { DataAwsOrganizationsOrganizationalUnitChildAccounts } from "./.gen/providers/aws/data-aws-organizations-organizational-unit-child-accounts";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const org = new DataAwsOrganizationsOrganization(this, "org", {});
+    new DataAwsOrganizationsOrganizationalUnitChildAccounts(this, "accounts", {
+      parentId: Token.asString(Fn.lookupNested(org.roots, ["0", "id"])),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `parentId` - (Required) The parent ID of the accounts.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `accounts` - List of child accounts, which have the following attributes:
+    * `arn` - The Amazon Resource Name (ARN) of the account.
+    * `email` - The email address associated with the AWS account.
+    * `id` - The unique identifier (ID) of the account.
+    * `name` - The friendly name of the account.
+    * `status` - The status of the account in the organization.
+* `id` - Parent identifier of the organizational units.
+
+<!-- cache-key: cdktf-0.18.0 input-76dc172a797ae2e6f20b12434b37314ffa18984dde0049de9f69d083f89caebb -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/organizations_organizational_unit_descendant_accounts.html.markdown b/website/docs/cdktf/typescript/d/organizations_organizational_unit_descendant_accounts.html.markdown
new file mode 100644
index 00000000000..47cbba4f1d6
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/organizations_organizational_unit_descendant_accounts.html.markdown
@@ -0,0 +1,59 @@
+---
+subcategory: "Organizations"
+layout: "aws"
+page_title: "AWS: aws_organizations_organizational_unit_descendant_accounts"
+description: |-
+  Get all child accounts under a parent organizational unit. This provides all children.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_organizations_organizational_unit_descendant_accounts
+
+Get all direct child accounts under a parent organizational unit. This provides all children.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsOrganizationsOrganization } from "./.gen/providers/aws/data-aws-organizations-organization";
+import { DataAwsOrganizationsOrganizationalUnitDescendantAccounts } from "./.gen/providers/aws/data-aws-organizations-organizational-unit-descendant-accounts";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const org = new DataAwsOrganizationsOrganization(this, "org", {});
+    new DataAwsOrganizationsOrganizationalUnitDescendantAccounts(
+      this,
+      "accounts",
+      {
+        parentId: Token.asString(Fn.lookupNested(org.roots, ["0", "id"])),
+      }
+    );
+  }
+}
+
+```
+
+## Argument Reference
+
+* `parentId` - (Required) The parent ID of the accounts.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `accounts` - List of child accounts, which have the following attributes:
+    * `arn` - The Amazon Resource Name (ARN) of the account.
+    * `email` - The email address associated with the AWS account.
+    * `id` - The unique identifier (ID) of the account.
+    * `name` - The friendly name of the account.
+    * `status` - The status of the account in the organization.
+* `id` - Parent identifier of the organizational units.
+
+<!-- cache-key: cdktf-0.18.0 input-83df36a9fecfe145252f01dc2fe86a6a203da74dd32b47b2a49d6433c732079d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/organizations_organizational_units.html.markdown b/website/docs/cdktf/typescript/d/organizations_organizational_units.html.markdown
new file mode 100644
index 00000000000..d2ecb0ba3e8
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/organizations_organizational_units.html.markdown
@@ -0,0 +1,53 @@
+---
+subcategory: "Organizations"
+layout: "aws"
+page_title: "AWS: aws_organizations_organizational_units"
+description: |-
+  Get all direct child organizational units under a parent organizational unit. This only provides immediate children, not all children
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_organizations_organizational_units
+
+Get all direct child organizational units under a parent organizational unit. This only provides immediate children, not all children.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsOrganizationsOrganization } from "./.gen/providers/aws/data-aws-organizations-organization";
+import { DataAwsOrganizationsOrganizationalUnits } from "./.gen/providers/aws/data-aws-organizations-organizational-units";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const org = new DataAwsOrganizationsOrganization(this, "org", {});
+    new DataAwsOrganizationsOrganizationalUnits(this, "ou", {
+      parentId: Token.asString(Fn.lookupNested(org.roots, ["0", "id"])),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `parentId` - (Required) Parent ID of the organizational unit.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `children` - List of child organizational units, which have the following attributes:
+    * `arn` - ARN of the organizational unit
+    * `name` - Name of the organizational unit
+    * `id` - ID of the organizational unit
+* `id` - Parent identifier of the organizational units.
+
+<!-- cache-key: cdktf-0.18.0 input-e8fba2e2a32deeaa9d34df7261c8bf4531104d7bb0b8f26e9a73581b276185d7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/organizations_policies.html.markdown b/website/docs/cdktf/typescript/d/organizations_policies.html.markdown
new file mode 100644
index 00000000000..1bc310b1ae0
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/organizations_policies.html.markdown
@@ -0,0 +1,69 @@
+---
+subcategory: "Organizations"
+layout: "aws"
+page_title: "AWS: aws_organizations_policies"
+description: |-
+  Terraform data source for managing an AWS Organizations Policies.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_organizations_policies
+
+Terraform data source for managing an AWS Organizations Policies.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformIterator, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsOrganizationsPolicies } from "./.gen/providers/aws/data-aws-organizations-policies";
+import { DataAwsOrganizationsPolicy } from "./.gen/providers/aws/data-aws-organizations-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new DataAwsOrganizationsPolicies(this, "example", {
+      filter: "SERVICE_CONTROL_POLICY",
+    });
+    /*In most cases loops should be handled in the programming language context and 
+    not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+    you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+    you need to keep this like it is.*/
+    const exampleForEachIterator = TerraformIterator.fromList(
+      Token.asAny(Fn.toset(example.ids))
+    );
+    const dataAwsOrganizationsPolicyExample = new DataAwsOrganizationsPolicy(
+      this,
+      "example_1",
+      {
+        policyId: Token.asString(exampleForEachIterator.value),
+        forEach: exampleForEachIterator,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsOrganizationsPolicyExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `filter` - (Required) The type of policies to be returned in the response. Valid values are `SERVICE_CONTROL_POLICY | TAG_POLICY | BACKUP_POLICY | AISERVICES_OPT_OUT_POLICY`
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `ids` - List of all the policy ids found.
+
+<!-- cache-key: cdktf-0.18.0 input-bbb6107986f3a23baa5c573e84c2c0fd4ada189187325e46cc5d67b60df963bd -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/organizations_policies_for_target.html.markdown b/website/docs/cdktf/typescript/d/organizations_policies_for_target.html.markdown
new file mode 100644
index 00000000000..19a08dc5f7c
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/organizations_policies_for_target.html.markdown
@@ -0,0 +1,76 @@
+---
+subcategory: "Organizations"
+layout: "aws"
+page_title: "AWS: aws_organizations_policies_for_target"
+description: |-
+  Terraform data source for managing an AWS Organizations Policies For Target.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_organizations_policies_for_target
+
+Terraform data source for managing an AWS Organizations Policies For Target.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformIterator, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsOrganizationsOrganization } from "./.gen/providers/aws/data-aws-organizations-organization";
+import { DataAwsOrganizationsPoliciesForTarget } from "./.gen/providers/aws/data-aws-organizations-policies-for-target";
+import { DataAwsOrganizationsPolicy } from "./.gen/providers/aws/data-aws-organizations-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new DataAwsOrganizationsOrganization(this, "example", {});
+    const dataAwsOrganizationsPoliciesForTargetExample =
+      new DataAwsOrganizationsPoliciesForTarget(this, "example_1", {
+        filter: "SERVICE_CONTROL_POLICY",
+        targetId: Token.asString(Fn.lookupNested(example.roots, ["0", "id"])),
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsOrganizationsPoliciesForTargetExample.overrideLogicalId("example");
+    /*In most cases loops should be handled in the programming language context and 
+    not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+    you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+    you need to keep this like it is.*/
+    const exampleForEachIterator = TerraformIterator.fromList(
+      Token.asAny(Fn.toset(dataAwsOrganizationsPoliciesForTargetExample.ids))
+    );
+    const dataAwsOrganizationsPolicyExample = new DataAwsOrganizationsPolicy(
+      this,
+      "example_2",
+      {
+        policyId: Token.asString(exampleForEachIterator.value),
+        forEach: exampleForEachIterator,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsOrganizationsPolicyExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `targetId` - (Required) The root (string that begins with "r-" followed by 4-32 lowercase letters or digits), account (12 digit string), or Organizational Unit (string starting with "ou-" followed by 4-32 lowercase letters or digits. This string is followed by a second "-" dash and from 8-32 additional lowercase letters or digits.)
+* `filter` - (Required) Must supply one of the 4 different policy filters for a target (SERVICE_CONTROL_POLICY | TAG_POLICY | BACKUP_POLICY | AISERVICES_OPT_OUT_POLICY)
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `ids` - List of all the policy ids found.
+
+<!-- cache-key: cdktf-0.18.0 input-7436628b3d5183c757aca388e0440d856a1c75b4b189df46ab759d8bf24e7ed5 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/organizations_policy.html.markdown b/website/docs/cdktf/typescript/d/organizations_policy.html.markdown
new file mode 100644
index 00000000000..d95d158248a
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/organizations_policy.html.markdown
@@ -0,0 +1,72 @@
+---
+subcategory: "Organizations"
+layout: "aws"
+page_title: "AWS: aws_organizations_policy"
+description: |-
+  Terraform data source for managing an AWS Organizations Policy.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_organizations_policy
+
+Terraform data source for managing an AWS Organizations Policy.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsOrganizationalPolicies } from "./.gen/providers/aws/";
+import { DataAwsOrganizationsOrganization } from "./.gen/providers/aws/data-aws-organizations-organization";
+import { DataAwsOrganizationsPoliciesForTarget } from "./.gen/providers/aws/data-aws-organizations-policies-for-target";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsOrganizationalPolicies(this, "test", {
+      policy_id: Fn.lookupNested(current.policies, ["0", "id"]),
+    });
+    const dataAwsOrganizationsOrganizationCurrent =
+      new DataAwsOrganizationsOrganization(this, "current", {});
+    const dataAwsOrganizationsPoliciesForTargetCurrent =
+      new DataAwsOrganizationsPoliciesForTarget(this, "current_2", {
+        filter: "SERVICE_CONTROL_POLICY",
+        targetId: Token.asString(
+          Fn.lookupNested(dataAwsOrganizationsOrganizationCurrent.roots, [
+            "0",
+            "id",
+          ])
+        ),
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsOrganizationsPoliciesForTargetCurrent.overrideLogicalId("current");
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `policyId` - (Required) The unique identifier (ID) of the policy that you want more details on. Policy id starts with a "p-" followed by 8-28 lowercase or uppercase letters, digits, and underscores.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name of the policy.
+* `awsManaged` - Indicates if a policy is an AWS managed policy.
+* `content` - The text content of the policy.
+* `description` - The description of the policy.
+* `name` - The friendly name of the policy.
+* `type` - The type of policy values can be `SERVICE_CONTROL_POLICY | TAG_POLICY | BACKUP_POLICY | AISERVICES_OPT_OUT_POLICY`
+
+<!-- cache-key: cdktf-0.18.0 input-64f486a6cfb19466cfa54daa60bbce856a5f3e8a11f79a4bf1dce126e773a631 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/organizations_resource_tags.html.markdown b/website/docs/cdktf/typescript/d/organizations_resource_tags.html.markdown
new file mode 100644
index 00000000000..c55f1cba3d5
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/organizations_resource_tags.html.markdown
@@ -0,0 +1,56 @@
+---
+subcategory: "Organizations"
+layout: "aws"
+page_title: "AWS: aws_organizations_resource_tags"
+description: |-
+  Get tags attached to the specified AWS Organizations resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_organizations_resource_tags
+
+Get tags attached to the specified AWS Organizations resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsOrganizationsResourceTags } from "./.gen/providers/aws/data-aws-organizations-resource-tags";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsOrganizationsResourceTags(this, "account", {
+      resourceId: "123456123846",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `resourceId` - (Required) ID of the resource with the tags to list. See details below.
+
+### resource_id
+
+You can specify any of the following taggable resources.
+
+* AWS account – specify the account ID number.
+* Organizational unit – specify the OU ID that begins with `ou` and looks similar to: `ou1A2B34Uvwxyz`
+* Root – specify the root ID that begins with `r` and looks similar to: `r1A2B`
+* Policy – specify the policy ID that begins with `p` and looks similar to: `p12Abcdefg3`
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `tags` - Map of key=value pairs for each tag set on the resource.
+
+<!-- cache-key: cdktf-0.18.0 input-9e1e646d2fbb671bf1b3448756c03ac6bb18b017208c1205580374b81a907e14 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/outposts_asset.html.markdown b/website/docs/cdktf/typescript/d/outposts_asset.html.markdown
new file mode 100644
index 00000000000..be9ba690aca
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/outposts_asset.html.markdown
@@ -0,0 +1,74 @@
+---
+subcategory: "Outposts"
+layout: "aws"
+page_title: "AWS: aws_outposts_asset"
+description: |-
+  Information about hardware assets in an Outpost.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_outposts_asset
+
+Information about a specific hardware asset in an Outpost.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, Fn, TerraformCount, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsOutpostsAsset } from "./.gen/providers/aws/data-aws-outposts-asset";
+import { DataAwsOutpostsAssets } from "./.gen/providers/aws/data-aws-outposts-assets";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new DataAwsOutpostsAssets(this, "example", {
+      arn: Token.asString(dataAwsOutpostsOutpostExample.arn),
+    });
+    /*In most cases loops should be handled in the programming language context and 
+    not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+    you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+    you need to keep this like it is.*/
+    const exampleCount = TerraformCount.of(
+      Token.asNumber(Fn.lengthOf(example.assetIds))
+    );
+    const dataAwsOutpostsAssetExample = new DataAwsOutpostsAsset(
+      this,
+      "example_1",
+      {
+        arn: Token.asString(dataAwsOutpostsOutpostExample.arn),
+        assetId: Token.asString(
+          Fn.element(thisVar.assetIds, Token.asNumber(exampleCount.index))
+        ),
+        count: exampleCount,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsOutpostsAssetExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `arn` - (Required) Outpost ARN.
+* `assetId` - (Required) ID of the asset.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `assetType` - Type of the asset.
+* `hostId` - Host ID of the Dedicated Hosts on the asset, if a Dedicated Host is provisioned.
+* `rackElevation` - Position of an asset in a rack measured in rack units.
+* `rackId` - Rack ID of the asset.
+
+<!-- cache-key: cdktf-0.18.0 input-8f6a07737f519ffaadeaca6364717f481098718bcbccdc2303dde41b73d75ac9 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/outposts_assets.html.markdown b/website/docs/cdktf/typescript/d/outposts_assets.html.markdown
new file mode 100644
index 00000000000..8ff552fe61d
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/outposts_assets.html.markdown
@@ -0,0 +1,99 @@
+---
+subcategory: "Outposts"
+layout: "aws"
+page_title: "AWS: aws_outposts_assets"
+description: |-
+  Information about hardware assets in an Outpost.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_outposts_assets
+
+Information about hardware assets in an Outpost.
+
+## Example Usage
+
+### Basic
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsOutpostsAssets } from "./.gen/providers/aws/data-aws-outposts-assets";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsOutpostsAssets(this, "example", {
+      arn: Token.asString(dataAwsOutpostsOutpostExample.arn),
+    });
+  }
+}
+
+```
+
+### With Host ID Filter
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsOutpostsAssets } from "./.gen/providers/aws/data-aws-outposts-assets";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsOutpostsAssets(this, "example", {
+      arn: Token.asString(dataAwsOutpostsOutpostExample.arn),
+      hostIdFilter: ["h-x38g5n0yd2a0ueb61"],
+    });
+  }
+}
+
+```
+
+### With Status ID Filter
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsOutpostsAssets } from "./.gen/providers/aws/data-aws-outposts-assets";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsOutpostsAssets(this, "example", {
+      arn: Token.asString(dataAwsOutpostsOutpostExample.arn),
+      statusIdFilter: ["ACTIVE"],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `arn` - (Required) Outpost ARN.
+* `hostIdFilter` - (Optional) Filters by list of Host IDs of a Dedicated Host.
+* `statusIdFilter` - (Optional) Filters by list of state status. Valid values: "ACTIVE", "RETIRING".
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `assetIds` - List of all the asset ids found. This data source will fail if none are found.
+
+<!-- cache-key: cdktf-0.18.0 input-99ccb47ab4f9ad99dcd20220176ab80d7d2a523ce444c488ada1146d9922821b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/outposts_outpost.html.markdown b/website/docs/cdktf/typescript/d/outposts_outpost.html.markdown
new file mode 100644
index 00000000000..594a498b250
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/outposts_outpost.html.markdown
@@ -0,0 +1,59 @@
+---
+subcategory: "Outposts"
+layout: "aws"
+page_title: "AWS: aws_outposts_outpost"
+description: |-
+  Provides details about an Outposts Outpost
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_outposts_outpost
+
+Provides details about an Outposts Outpost.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsOutpostsOutpost } from "./.gen/providers/aws/data-aws-outposts-outpost";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsOutpostsOutpost(this, "example", {
+      name: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `id` - (Optional) Identifier of the Outpost.
+* `name` - (Optional) Name of the Outpost.
+* `arn` - (Optional) ARN.
+* `ownerId` - (Optional) AWS Account identifier of the Outpost owner.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `availabilityZone` - Availability Zone name.
+* `availabilityZoneId` - Availability Zone identifier.
+* `description` - The description of the Outpost.
+* `lifecycleStatus` - The life cycle status.
+* `siteArn` - The Amazon Resource Name (ARN) of the site.
+* `siteId` - The ID of the site.
+* `supportedHardwareType` - The hardware type.
+* `tags` - The Outpost tags.
+
+<!-- cache-key: cdktf-0.18.0 input-35f3fde745d0b61be013964ef1d616fef90704512a6afea84fcf8f9bf3c2acd5 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/outposts_outpost_instance_type.html.markdown b/website/docs/cdktf/typescript/d/outposts_outpost_instance_type.html.markdown
new file mode 100644
index 00000000000..d86cb3cc3dd
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/outposts_outpost_instance_type.html.markdown
@@ -0,0 +1,61 @@
+---
+subcategory: "Outposts"
+layout: "aws"
+page_title: "AWS: aws_outposts_outpost_instance_type"
+description: |-
+  Information about single Outpost Instance Type.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_outposts_outpost_instance_type
+
+Information about single Outpost Instance Type.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Ec2Instance } from "./.gen/providers/aws/";
+import { DataAwsOutpostsOutpostInstanceType } from "./.gen/providers/aws/data-aws-outposts-outpost-instance-type";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new DataAwsOutpostsOutpostInstanceType(this, "example", {
+      arn: Token.asString(dataAwsOutpostsOutpostExample.arn),
+      preferredInstanceTypes: ["m5.large", "m5.4xlarge"],
+    });
+    const awsEc2InstanceExample = new Ec2Instance(this, "example_1", {
+      instance_type: example.instanceType,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsEc2InstanceExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `arn` - (Required) Outpost ARN.
+
+The following arguments are optional:
+
+* `instanceType` - (Optional) Desired instance type. Conflicts with `preferredInstanceTypes`.
+* `preferredInstanceTypes` - (Optional) Ordered list of preferred instance types. The first match in this list will be returned. If no preferred matches are found and the original search returned more than one result, an error is returned. Conflicts with `instanceType`.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - Outpost identifier.
+
+<!-- cache-key: cdktf-0.18.0 input-bdb4cb1efd03c682353c33d56fbb0c15999ee4c0eda85c05b04d636ffab6f3a8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/outposts_outpost_instance_types.html.markdown b/website/docs/cdktf/typescript/d/outposts_outpost_instance_types.html.markdown
new file mode 100644
index 00000000000..aff55a0db00
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/outposts_outpost_instance_types.html.markdown
@@ -0,0 +1,49 @@
+---
+subcategory: "Outposts"
+layout: "aws"
+page_title: "AWS: aws_outposts_outpost_instance_types"
+description: |-
+  Information about Outpost Instance Types.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_outposts_outpost_instance_types
+
+Information about Outposts Instance Types.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsOutpostsOutpostInstanceTypes } from "./.gen/providers/aws/data-aws-outposts-outpost-instance-types";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsOutpostsOutpostInstanceTypes(this, "example", {
+      arn: Token.asString(dataAwsOutpostsOutpostExample.arn),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `arn` - (Required) Outpost ARN.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `instanceTypes` - Set of instance types.
+
+<!-- cache-key: cdktf-0.18.0 input-3dcd4d42109b60dec29ef5ce3754b18b70307fc52baa1c511a6b236d274c3d89 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/outposts_outposts.html.markdown b/website/docs/cdktf/typescript/d/outposts_outposts.html.markdown
new file mode 100644
index 00000000000..cd8e671b906
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/outposts_outposts.html.markdown
@@ -0,0 +1,54 @@
+---
+subcategory: "Outposts"
+layout: "aws"
+page_title: "AWS: aws_outposts_outposts"
+description: |-
+  Provides details about multiple Outposts
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_outposts_outposts
+
+Provides details about multiple Outposts.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsOutpostsOutposts } from "./.gen/providers/aws/data-aws-outposts-outposts";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsOutpostsOutposts(this, "example", {
+      siteId: id,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `availabilityZone` - (Optional) Availability Zone name.
+* `availabilityZoneId` - (Optional) Availability Zone identifier.
+* `siteId` - (Optional) Site identifier.
+* `ownerId` - (Optional) AWS Account identifier of the Outpost owner.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arns` - Set of Amazon Resource Names (ARNs).
+* `id` - AWS Region.
+* `ids` - Set of identifiers.
+
+<!-- cache-key: cdktf-0.18.0 input-02cae365ee7d67e7341963b741e8f66fba4ba35af6c45fb037892e4ed7c91bbe -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/outposts_site.html.markdown b/website/docs/cdktf/typescript/d/outposts_site.html.markdown
new file mode 100644
index 00000000000..a9cb9b31e76
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/outposts_site.html.markdown
@@ -0,0 +1,51 @@
+---
+subcategory: "Outposts"
+layout: "aws"
+page_title: "AWS: aws_outposts_site"
+description: |-
+  Provides details about an Outposts Site
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_outposts_site
+
+Provides details about an Outposts Site.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsOutpostsSite } from "./.gen/providers/aws/data-aws-outposts-site";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsOutpostsSite(this, "example", {
+      name: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `id` - (Optional) Identifier of the Site.
+* `name` - (Optional) Name of the Site.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `accountId` - AWS Account identifier.
+* `description` - Description.
+
+<!-- cache-key: cdktf-0.18.0 input-35136b0820f723be3d4e35e80bb8abd4839b40210fd445ddc0cbd77d3cf4f75f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/outposts_sites.html.markdown b/website/docs/cdktf/typescript/d/outposts_sites.html.markdown
new file mode 100644
index 00000000000..6dfdf4a1d9f
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/outposts_sites.html.markdown
@@ -0,0 +1,46 @@
+---
+subcategory: "Outposts"
+layout: "aws"
+page_title: "AWS: aws_outposts_sites"
+description: |-
+  Provides details about multiple Outposts Sites.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_outposts_sites
+
+Provides details about multiple Outposts Sites.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsOutpostsSites } from "./.gen/providers/aws/data-aws-outposts-sites";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsOutpostsSites(this, "all", {});
+  }
+}
+
+```
+
+## Argument Reference
+
+There are no arguments available for this data source.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - AWS Region.
+* `ids` - Set of Outposts Site identifiers.
+
+<!-- cache-key: cdktf-0.18.0 input-33f8249a08c1a9e061aad127e234ad70eb79b16ee48652025b3daa5b7b81e2c1 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/partition.html.markdown b/website/docs/cdktf/typescript/d/partition.html.markdown
new file mode 100644
index 00000000000..a57f1b1fec8
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/partition.html.markdown
@@ -0,0 +1,59 @@
+---
+subcategory: "Meta Data Sources"
+layout: "aws"
+page_title: "AWS: aws_partition"
+description: |-
+  Get AWS partition identifier
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_partition
+
+Use this data source to lookup information about the current AWS partition in
+which Terraform is working.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { DataAwsPartition } from "./.gen/providers/aws/data-aws-partition";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const current = new DataAwsPartition(this, "current", {});
+    new DataAwsIamPolicyDocument(this, "s3_policy", {
+      statement: [
+        {
+          actions: ["s3:ListBucket"],
+          resources: ["arn:${" + current.partition + "}:s3:::my-bucket"],
+          sid: "1",
+        },
+      ],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+There are no arguments available for this data source.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `dnsSuffix` - Base DNS domain name for the current partition (e.g., `amazonawsCom` in AWS Commercial, `amazonawsComCn` in AWS China).
+* `id` - Identifier of the current partition (e.g., `aws` in AWS Commercial, `awsCn` in AWS China).
+* `partition` - Identifier of the current partition (e.g., `aws` in AWS Commercial, `awsCn` in AWS China).
+* `reverseDnsPrefix` - Prefix of service names (e.g., `comAmazonaws` in AWS Commercial, `cnComAmazonaws` in AWS China).
+
+<!-- cache-key: cdktf-0.18.0 input-c447a01a61c27aee6e9e0f866a2c423555ed2688482ef36f154476b5b7d14505 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/prefix_list.html.markdown b/website/docs/cdktf/typescript/d/prefix_list.html.markdown
new file mode 100644
index 00000000000..1362c8cc446
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/prefix_list.html.markdown
@@ -0,0 +1,137 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_prefix_list"
+description: |-
+    Provides details about a specific prefix list
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_prefix_list
+
+`awsPrefixList` provides details about a specific AWS prefix list (PL)
+in the current region.
+
+This can be used both to validate a prefix list given in a variable
+and to obtain the CIDR blocks (IP address ranges) for the associated
+AWS service. The latter may be useful e.g., for adding network ACL
+rules.
+
+The [aws_ec2_managed_prefix_list](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ec2_managed_prefix_list) data source is normally more appropriate to use given it can return customer-managed prefix list info, as well as additional attributes.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsPrefixList } from "./.gen/providers/aws/data-aws-prefix-list";
+import { NetworkAcl } from "./.gen/providers/aws/network-acl";
+import { NetworkAclRule } from "./.gen/providers/aws/network-acl-rule";
+import { VpcEndpoint } from "./.gen/providers/aws/vpc-endpoint";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const bar = new NetworkAcl(this, "bar", {
+      vpcId: foo.id,
+    });
+    const privateS3 = new VpcEndpoint(this, "private_s3", {
+      serviceName: "com.amazonaws.us-west-2.s3",
+      vpcId: foo.id,
+    });
+    const dataAwsPrefixListPrivateS3 = new DataAwsPrefixList(
+      this,
+      "private_s3_2",
+      {
+        prefixListId: privateS3.prefixListId,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsPrefixListPrivateS3.overrideLogicalId("private_s3");
+    const awsNetworkAclRulePrivateS3 = new NetworkAclRule(
+      this,
+      "private_s3_3",
+      {
+        cidrBlock: Token.asString(
+          Fn.lookupNested(dataAwsPrefixListPrivateS3.cidrBlocks, ["0"])
+        ),
+        egress: false,
+        fromPort: 443,
+        networkAclId: bar.id,
+        protocol: "tcp",
+        ruleAction: "allow",
+        ruleNumber: 200,
+        toPort: 443,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsNetworkAclRulePrivateS3.overrideLogicalId("private_s3");
+  }
+}
+
+```
+
+### Filter
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsPrefixList } from "./.gen/providers/aws/data-aws-prefix-list";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsPrefixList(this, "test", {
+      filter: [
+        {
+          name: "prefix-list-id",
+          values: ["pl-68a54001"],
+        },
+      ],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The arguments of this data source act as filters for querying the available
+prefix lists. The given filters must match exactly one prefix list
+whose data will be exported as attributes.
+
+* `prefixListId` - (Optional) ID of the prefix list to select.
+* `name` - (Optional) Name of the prefix list to select.
+* `filter` - (Optional) Configuration block(s) for filtering. Detailed below.
+
+### filter Configuration Block
+
+The `filter` configuration block supports the following arguments:
+
+* `name` - (Required) Name of the filter field. Valid values can be found in the [EC2 DescribePrefixLists API Reference](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribePrefixLists.html).
+* `values` - (Required) Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the selected prefix list.
+* `name` - Name of the selected prefix list.
+* `cidrBlocks` - List of CIDR blocks for the AWS service associated with the prefix list.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `20M`)
+
+<!-- cache-key: cdktf-0.18.0 input-38cb83359a964cd4db19c88b875057b8276925ffe06c011b53a477d4b113a5ad -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/pricing_product.html.markdown b/website/docs/cdktf/typescript/d/pricing_product.html.markdown
new file mode 100644
index 00000000000..c647a52ee46
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/pricing_product.html.markdown
@@ -0,0 +1,114 @@
+---
+subcategory: "Pricing Calculator"
+layout: "aws"
+page_title: "AWS: aws_pricing_product"
+description: |-
+  Get information regarding the pricing of an Amazon product
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_pricing_product
+
+Use this data source to get the pricing information of all products in AWS.
+This data source is only available in a us-east-1 or ap-south-1 provider.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsPricingProduct } from "./.gen/providers/aws/data-aws-pricing-product";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsPricingProduct(this, "example", {
+      filters: [
+        {
+          field: "instanceType",
+          value: "c5.xlarge",
+        },
+        {
+          field: "operatingSystem",
+          value: "Linux",
+        },
+        {
+          field: "location",
+          value: "US East (N. Virginia)",
+        },
+        {
+          field: "preInstalledSw",
+          value: "NA",
+        },
+        {
+          field: "licenseModel",
+          value: "No License required",
+        },
+        {
+          field: "tenancy",
+          value: "Shared",
+        },
+        {
+          field: "capacitystatus",
+          value: "Used",
+        },
+      ],
+      serviceCode: "AmazonEC2",
+    });
+  }
+}
+
+```
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsPricingProduct } from "./.gen/providers/aws/data-aws-pricing-product";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsPricingProduct(this, "example", {
+      filters: [
+        {
+          field: "instanceType",
+          value: "ds1.xlarge",
+        },
+        {
+          field: "location",
+          value: "US East (N. Virginia)",
+        },
+      ],
+      serviceCode: "AmazonRedshift",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `serviceCode` - (Required) Code of the service. Available service codes can be fetched using the DescribeServices pricing API call.
+* `filters` - (Required) List of filters. Passed directly to the API (see GetProducts API reference). These filters must describe a single product, this resource will fail if more than one product is returned by the API.
+
+### filters
+
+* `field` (Required) Product attribute name that you want to filter on.
+* `value` (Required) Product attribute value that you want to filter on.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `result` - Set to the product returned from the API.
+
+<!-- cache-key: cdktf-0.18.0 input-7877cd39e468d078f53a2d4c542f1bf6ce9960ac9589794b8c81ab30b32ff42b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/prometheus_workspace.html.markdown b/website/docs/cdktf/typescript/d/prometheus_workspace.html.markdown
new file mode 100644
index 00000000000..90bc9523cc8
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/prometheus_workspace.html.markdown
@@ -0,0 +1,56 @@
+---
+subcategory: "AMP (Managed Prometheus)"
+layout: "aws"
+page_title: "AWS: aws_prometheus_workspace"
+description: |-
+  Gets information on an Amazon Managed Prometheus workspace.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_prometheus_workspace
+
+Provides an Amazon Managed Prometheus workspace data source.
+
+## Example Usage
+
+### Basic configuration
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsPrometheusWorkspace } from "./.gen/providers/aws/data-aws-prometheus-workspace";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsPrometheusWorkspace(this, "example", {
+      workspaceId: "ws-41det8a1-2c67-6a1a-9381-9b83d3d78ef7",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `workspaceId` - (Required) Prometheus workspace ID.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Prometheus workspace.
+* `createdDate` - Creation date of the Prometheus workspace.
+* `prometheusEndpoint` - Endpoint of the Prometheus workspace.
+* `alias` - Prometheus workspace alias.
+* `status` - Status of the Prometheus workspace.
+* `tags` - Tags assigned to the resource.
+
+<!-- cache-key: cdktf-0.18.0 input-2dd7010a4197a27a819b72ee32cf460519cbeffe970609f02714d302a749d6c2 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/prometheus_workspaces.html.markdown b/website/docs/cdktf/typescript/d/prometheus_workspaces.html.markdown
new file mode 100644
index 00000000000..371e0613ca4
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/prometheus_workspaces.html.markdown
@@ -0,0 +1,74 @@
+---
+subcategory: "AMP (Managed Prometheus)"
+layout: "aws"
+page_title: "AWS: aws_prometheus_workspaces"
+description: |-
+  Gets the aliases, ARNs, and workspace IDs of Amazon Prometheus workspaces.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_prometheus_workspaces
+
+Provides the aliases, ARNs, and workspace IDs of Amazon Prometheus workspaces.
+
+## Example Usage
+
+The following example returns all of the workspaces in a region:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsPrometheusWorkspaces } from "./.gen/providers/aws/data-aws-prometheus-workspaces";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsPrometheusWorkspaces(this, "example", {});
+  }
+}
+
+```
+
+The following example filters the workspaces by alias. Only the workspaces with
+aliases that begin with the value of `aliasPrefix` will be returned:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsPrometheusWorkspaces } from "./.gen/providers/aws/data-aws-prometheus-workspaces";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsPrometheusWorkspaces(this, "example", {
+      aliasPrefix: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `aliasPrefix` - (Optional) Limits results to workspaces with aliases that begin with this value.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `aliases` - List of aliases of the matched Prometheus workspaces.
+* `arns` - List of ARNs of the matched Prometheus workspaces.
+* `workspaceIds` - List of workspace IDs of the matched Prometheus workspaces.
+
+<!-- cache-key: cdktf-0.18.0 input-80acf7908c27226d8c0361ef362e87dbc25d3955952bacb62b20968912d47d8e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/qldb_ledger.html.markdown b/website/docs/cdktf/typescript/d/qldb_ledger.html.markdown
new file mode 100644
index 00000000000..a4f9d4d87dd
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/qldb_ledger.html.markdown
@@ -0,0 +1,46 @@
+---
+subcategory: "QLDB (Quantum Ledger Database)"
+layout: "aws"
+page_title: "AWS: aws_qldb_ledger"
+description: |-
+  Get information on a Amazon Quantum Ledger Database (QLDB)
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_qldb_ledger
+
+Use this data source to fetch information about a Quantum Ledger Database.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsQldbLedger } from "./.gen/providers/aws/data-aws-qldb-ledger";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsQldbLedger(this, "example", {
+      name: "an_example_ledger",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `name` - (Required) Friendly name of the ledger to match.
+
+## Attribute Reference
+
+See the [QLDB Ledger Resource](/docs/providers/aws/r/qldb_ledger.html) for details on the
+returned attributes - they are identical.
+
+<!-- cache-key: cdktf-0.18.0 input-0a3bcd75f129ece3016f3577ca775df98dda0b448d78fa027251b4d8bf803822 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/quicksight_data_set.html.markdown b/website/docs/cdktf/typescript/d/quicksight_data_set.html.markdown
new file mode 100644
index 00000000000..64709ff0057
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/quicksight_data_set.html.markdown
@@ -0,0 +1,54 @@
+---
+subcategory: "QuickSight"
+layout: "aws"
+page_title: "AWS: aws_quicksight_data_set"
+description: |-
+  Use this data source to fetch information about a QuickSight Data Set.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_quicksight_data_set
+
+Data source for managing a QuickSight Data Set.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsQuicksightDataSet } from "./.gen/providers/aws/data-aws-quicksight-data-set";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsQuicksightDataSet(this, "example", {
+      dataSetId: "example-id",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `dataSetId` - (Required) Identifier for the data set.
+
+The following arguments are optional:
+
+* `awsAccountId` - (Optional) AWS account ID.
+
+## Attribute Reference
+
+See the [Data Set Resource](/docs/providers/aws/r/quicksight_data_set.html) for details on the
+returned attributes - they are identical.
+
+<!-- cache-key: cdktf-0.18.0 input-8492869a248e84e19ddd16f07980df52ef0e93e1c422dbbba08a0d3de40e4ec1 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/quicksight_group.html.markdown b/website/docs/cdktf/typescript/d/quicksight_group.html.markdown
new file mode 100644
index 00000000000..d757159b55c
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/quicksight_group.html.markdown
@@ -0,0 +1,60 @@
+---
+subcategory: "QuickSight"
+layout: "aws"
+page_title: "AWS: aws_quicksight_group"
+description: |-
+  Use this data source to fetch information about a QuickSight Group.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_quicksight_group
+
+This data source can be used to fetch information about a specific
+QuickSight group. By using this data source, you can reference QuickSight group
+properties without having to hard code ARNs or unique IDs as input.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsQuicksightGroup } from "./.gen/providers/aws/data-aws-quicksight-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsQuicksightGroup(this, "example", {
+      groupName: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `groupName` - (Required) The name of the group that you want to match.
+
+The following arguments are optional:
+
+* `awsAccountId` - (Optional) AWS account ID.
+* `namespace` - (Optional) QuickSight namespace. Defaults to `default`.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) for the group.
+* `description` - The group description.
+* `principalId` - The principal ID of the group.
+
+<!-- cache-key: cdktf-0.18.0 input-2c348640ef79405d8a0bd0ed47ae13ff12c796f3ad5a7922552ef44e21969deb -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/quicksight_theme.html.markdown b/website/docs/cdktf/typescript/d/quicksight_theme.html.markdown
new file mode 100644
index 00000000000..bcf88ce99a6
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/quicksight_theme.html.markdown
@@ -0,0 +1,137 @@
+---
+subcategory: "QuickSight"
+layout: "aws"
+page_title: "AWS: aws_quicksight_theme"
+description: |-
+  Use this data source to fetch information about a QuickSight Theme.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_quicksight_theme
+
+Terraform data source for managing an AWS QuickSight Theme.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsQuicksightTheme } from "./.gen/providers/aws/data-aws-quicksight-theme";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsQuicksightTheme(this, "example", {
+      themeId: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `themeId` - Identifier of the theme.
+
+The following arguments are optional:
+
+* `awsAccountId` - AWS account ID.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the theme.
+* `baseThemeId` - The ID of the theme that a custom theme will inherit from. All themes inherit from one of the starting themes defined by Amazon QuickSight.
+* `configuration` - The theme configuration, which contains the theme display properties. See [configuration](#configuration).
+* `createdTime` - The time that the theme was created.
+* `id` - A comma-delimited string joining AWS account ID and theme ID.
+* `lastUpdatedTime` - The time that the theme was last updated.
+* `name` - Display name of the theme.
+* `permissions` - A set of resource permissions on the theme. See [permissions](#permissions).
+* `status` - The theme creation status.
+* `tags` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block).
+* `versionDescription` - A description of the current theme version being created/updated.
+* `versionNumber` - The version number of the theme version.
+
+### permissions
+
+* `actions` - List of IAM actions to grant or revoke permissions on.
+* `principal` - ARN of the principal. See the [ResourcePermission documentation](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_ResourcePermission.html) for the applicable ARN values.
+
+### configuration
+
+* `dataColorPalette` - Color properties that apply to chart data colors. See [data_color_palette](#data_color_palette).
+* `sheet` - Display options related to sheets. See [sheet](#sheet).
+* `typography` - Determines the typography options. See [typography](#typography).
+* `uiColorPalette` - Color properties that apply to the UI and to charts, excluding the colors that apply to data. See [ui_color_palette](#ui_color_palette).
+
+### data_color_palette
+
+* `colors` - List of hexadecimal codes for the colors. Minimum of 8 items and maximum of 20 items.
+* `emptyFillColor` - The hexadecimal code of a color that applies to charts where a lack of data is highlighted.
+* `minMaxGradient` - The minimum and maximum hexadecimal codes that describe a color gradient. List of exactly 2 items.
+
+### sheet
+
+* `tile` - The display options for tiles. See [tile](#tile).
+* `tileLayout` - The layout options for tiles. See [tile_layout](#tile_layout).
+
+### tile
+
+* `border` - The border around a tile. See [border](#border).
+
+### border
+
+* `show` - The option to enable display of borders for visuals.
+
+### tile_layout
+
+* `gutter` - The gutter settings that apply between tiles. See [gutter](#gutter).
+* `margin` - The margin settings that apply around the outside edge of sheets. See [margin](#margin).
+
+### gutter
+
+* `show` - This Boolean value controls whether to display a gutter space between sheet tiles.
+
+### margin
+
+* `show` - This Boolean value controls whether to display sheet margins.
+
+### typography
+
+* `fontFamilies` - Determines the list of font families. Maximum number of 5 items. See [font_families](#font_families).
+
+### font_families
+
+* `fontFamily` - Font family name.
+
+### ui_color_palette
+
+* `accent` - Color (hexadecimal) that applies to selected states and buttons.
+* `accentForeground` - Color (hexadecimal) that applies to any text or other elements that appear over the accent color.
+* `danger` - Color (hexadecimal) that applies to error messages.
+* `dangerForeground` - Color (hexadecimal) that applies to any text or other elements that appear over the error color.
+* `dimension` - Color (hexadecimal) that applies to the names of fields that are identified as dimensions.
+* `dimensionForeground` - Color (hexadecimal) that applies to any text or other elements that appear over the dimension color.
+* `measure` - Color (hexadecimal) that applies to the names of fields that are identified as measures.
+* `measureForeground` - Color (hexadecimal) that applies to any text or other elements that appear over the measure color.
+* `primaryBackground` - Color (hexadecimal) that applies to visuals and other high emphasis UI.
+* `primaryForeground` - Color (hexadecimal) of text and other foreground elements that appear over the primary background regions, such as grid lines, borders, table banding, icons, and so on.
+* `secondaryBackground` - Color (hexadecimal) that applies to the sheet background and sheet controls.
+* `secondaryForeground` - Color (hexadecimal) that applies to any sheet title, sheet control text, or UI that appears over the secondary background.
+* `success` - Color (hexadecimal) that applies to success messages, for example the check mark for a successful download.
+* `successForeground` - Color (hexadecimal) that applies to any text or other elements that appear over the success color.
+* `warning` - Color (hexadecimal) that applies to warning and informational messages.
+* `warningForeground` - Color (hexadecimal) that applies to any text or other elements that appear over the warning color.
+
+<!-- cache-key: cdktf-0.18.0 input-2daca04fcd76a4ea2ca17ad1ba924c5d29610a6687a891e20570267c4f9bd850 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/quicksight_user.html.markdown b/website/docs/cdktf/typescript/d/quicksight_user.html.markdown
new file mode 100644
index 00000000000..1f1fbc10b51
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/quicksight_user.html.markdown
@@ -0,0 +1,66 @@
+---
+subcategory: "QuickSight"
+layout: "aws"
+page_title: "AWS: aws_quicksight_user"
+description: |-
+  Use this data source to fetch information about a QuickSight User.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_quicksight_user
+
+This data source can be used to fetch information about a specific
+QuickSight user. By using this data source, you can reference QuickSight user
+properties without having to hard code ARNs or unique IDs as input.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsQuicksightUser } from "./.gen/providers/aws/data-aws-quicksight-user";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsQuicksightUser(this, "example", {
+      userName: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `userName` - (Required) The name of the user that you want to match.
+
+The following arguments are optional:
+
+* `awsAccountId` - (Optional) AWS account ID.
+* `namespace` - (Optional) QuickSight namespace. Defaults to `default`.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `active` - The active status of user. When you create an Amazon QuickSight user that’s not an IAM user or an Active Directory user, that user is inactive until they sign in and provide a password.
+* `arn` - The Amazon Resource Name (ARN) for the user.
+* `email` - The user's email address.
+* `identityType` - The type of identity authentication used by the user.
+* `principalId` - The principal ID of the user.
+* `userRole` - The Amazon QuickSight role for the user. The user role can be one of the following:.
+    - `reader`: A user who has read-only access to dashboards.
+    - `author`: A user who can create data sources, datasets, analyses, and dashboards.
+    - `admin`: A user who is an author, who can also manage Amazon QuickSight settings.
+
+<!-- cache-key: cdktf-0.18.0 input-8a09e3c69e880b414f66924d3def015ce6ed48913a9a062d5f17590c11a6327c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/ram_resource_share.html.markdown b/website/docs/cdktf/typescript/d/ram_resource_share.html.markdown
new file mode 100644
index 00000000000..83186a39c86
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/ram_resource_share.html.markdown
@@ -0,0 +1,90 @@
+---
+subcategory: "RAM (Resource Access Manager)"
+layout: "aws"
+page_title: "AWS: aws_ram_resource_share"
+description: |-
+  Retrieve information about a RAM Resource Share
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_ram_resource_share
+
+`awsRamResourceShare` Retrieve information about a RAM Resource Share.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsRamResourceShare } from "./.gen/providers/aws/data-aws-ram-resource-share";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsRamResourceShare(this, "example", {
+      name: "example",
+      resourceOwner: "SELF",
+    });
+  }
+}
+
+```
+
+## Search by filters
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsRamResourceShare } from "./.gen/providers/aws/data-aws-ram-resource-share";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsRamResourceShare(this, "tag_filter", {
+      filter: [
+        {
+          name: "NameOfTag",
+          values: ["exampleNameTagValue"],
+        },
+      ],
+      name: "MyResourceName",
+      resourceOwner: "SELF",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name of the resource share to retrieve.
+* `resourceOwner` (Required) Owner of the resource share. Valid values are `self` or `otherAccounts`.
+
+* `resourceShareStatus` (Optional) Specifies that you want to retrieve details of only those resource shares that have this status. Valid values are `pending`, `active`, `failed`, `deleting`, and `deleted`.
+* `filter` - (Optional) Filter used to scope the list e.g., by tags. See [related docs] (https://docs.aws.amazon.com/ram/latest/APIReference/API_TagFilter.html).
+    * `name` - (Required) Name of the tag key to filter on.
+    * `values` - (Required) Value of the tag key.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the resource share.
+* `id` - ARN of the resource share.
+* `owningAccountId` - ID of the AWS account that owns the resource share.
+* `resourceArns` - A list of resource ARNs associated with the resource share.
+* `status` - Status of the resource share.
+* `tags` - Tags attached to the resource share.
+
+<!-- cache-key: cdktf-0.18.0 input-54b4387b44c971bb05b58963626019234ab54bc7c441c150cb6b20fbb4f024fc -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/rds_certificate.html.markdown b/website/docs/cdktf/typescript/d/rds_certificate.html.markdown
new file mode 100644
index 00000000000..a308150cb78
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/rds_certificate.html.markdown
@@ -0,0 +1,56 @@
+---
+subcategory: "RDS (Relational Database)"
+layout: "aws"
+page_title: "AWS: aws_rds_certificate"
+description: |-
+  Information about an RDS Certificate.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_rds_certificate
+
+Information about an RDS Certificate.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsRdsCertificate } from "./.gen/providers/aws/data-aws-rds-certificate";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsRdsCertificate(this, "example", {
+      latestValidTill: true,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `id` - (Optional) Certificate identifier. For example, `rdsCa2019`.
+* `latestValidTill` - (Optional) When enabled, returns the certificate with the latest `validTill`.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the certificate.
+* `certificateType` - Type of certificate. For example, `ca`.
+* `customerOverride` - Boolean whether there is an override for the default certificate identifier.
+* `customerOverrideValidTill` - If there is an override for the default certificate identifier, when the override expires.
+* `thumbprint` - Thumbprint of the certificate.
+* `validFrom` - [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8) of certificate starting validity date.
+* `validTill` - [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8) of certificate ending validity date.
+
+<!-- cache-key: cdktf-0.18.0 input-11fac79b0d201c3f0e3fe5f7ce9e1273fd98f100c84dc2f6a4a3f5286bb6b1dd -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/rds_cluster.html.markdown b/website/docs/cdktf/typescript/d/rds_cluster.html.markdown
new file mode 100644
index 00000000000..e902ce507de
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/rds_cluster.html.markdown
@@ -0,0 +1,50 @@
+---
+subcategory: "RDS (Relational Database)"
+layout: "aws"
+page_title: "AWS: aws_rds_cluster"
+description: |-
+  Provides an RDS cluster data source.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_rds_cluster
+
+Provides information about an RDS cluster.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsRdsCluster } from "./.gen/providers/aws/data-aws-rds-cluster";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsRdsCluster(this, "clusterName", {
+      clusterIdentifier: "clusterName",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `clusterIdentifier` - (Required) Cluster identifier of the RDS cluster.
+
+## Attribute Reference
+
+See the [RDS Cluster Resource](/docs/providers/aws/r/rds_cluster.html) for details on the
+returned attributes - they are identical for all attributes, except the `tagsAll`. If you need to get the tags for this resource, use the attribute `tags` as described below.
+
+* `tags` - A map of tags assigned to the resource.
+
+<!-- cache-key: cdktf-0.18.0 input-c73b6ed9b7618d5c8808fa4b51f8b555a3290543f06a5030843096caf98e0ba8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/rds_clusters.html.markdown b/website/docs/cdktf/typescript/d/rds_clusters.html.markdown
new file mode 100644
index 00000000000..30fe5ead95f
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/rds_clusters.html.markdown
@@ -0,0 +1,64 @@
+---
+subcategory: "RDS (Relational Database)"
+layout: "aws"
+page_title: "AWS: aws_rds_clusters"
+description: |-
+  Terraform data source for managing an AWS RDS (Relational Database) Clusters.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_rds_clusters
+
+Terraform data source for managing an AWS RDS (Relational Database) Clusters.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsRdsClusters } from "./.gen/providers/aws/data-aws-rds-clusters";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsRdsClusters(this, "example", {
+      filter: [
+        {
+          name: "engine",
+          values: ["aurora-postgresql"],
+        },
+      ],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are optional:
+
+* `filter` - (Optional) Configuration block(s) for filtering. Detailed below.
+
+### filter Configuration block
+
+The `filter` configuration block supports the following arguments:
+
+* `name` - (Required) Name of the filter field. Valid values can be found in the [RDS DescribeDBClusters API Reference](https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeDBClusters.html).
+* `values` - (Required) Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `clusterArns` - Set of cluster ARNs of the matched RDS clusters.
+* `clusterIdentifiers` - Set of ARNs of cluster identifiers of the matched RDS clusters.
+
+<!-- cache-key: cdktf-0.18.0 input-68d8e0fc72c3359db6eb2f1e2e9009c536890e2e4f69c85c40a8c65401ddc632 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/rds_engine_version.html.markdown b/website/docs/cdktf/typescript/d/rds_engine_version.html.markdown
new file mode 100644
index 00000000000..344ba358f19
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/rds_engine_version.html.markdown
@@ -0,0 +1,101 @@
+---
+subcategory: "RDS (Relational Database)"
+layout: "aws"
+page_title: "AWS: aws_rds_engine_version"
+description: |-
+  Information about an RDS engine version.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_rds_engine_version
+
+Information about an RDS engine version.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsRdsEngineVersion } from "./.gen/providers/aws/data-aws-rds-engine-version";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsRdsEngineVersion(this, "test", {
+      engine: "mysql",
+      preferredVersions: ["8.0.27", "8.0.26"],
+    });
+  }
+}
+
+```
+
+### With `filter`
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsRdsEngineVersion } from "./.gen/providers/aws/data-aws-rds-engine-version";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsRdsEngineVersion(this, "test", {
+      engine: "aurora-postgresql",
+      filter: [
+        {
+          name: "engine-mode",
+          values: ["serverless"],
+        },
+      ],
+      includeAll: true,
+      version: "10.14",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `engine` - (Required) DB engine. Engine values include `aurora`, `auroraMysql`, `auroraPostgresql`, `docdb`, `mariadb`, `mysql`, `neptune`, `oracleEe`, `oracleSe`, `oracleSe1`, `oracleSe2`, `postgres`, `sqlserverEe`, `sqlserverEx`, `sqlserverSe`, and `sqlserverWeb`.
+* `defaultOnly` - (Optional) When set to `true`, the default version for the specified `engine` or combination of `engine` and major `version` will be returned. Can be used to limit responses to a single version when they would otherwise fail for returning multiple versions.
+* `filter` - (Optional) One or more name/value pairs to filter off of. There are several valid keys; for a full reference, check out [describe-db-engine-versions in the AWS CLI reference](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/rds/describe-db-engine-versions.html).
+* `includeAll` - (Optional) When set to `true`, the specified `version` or member of `preferredVersions` will be returned even if it is `deprecated`. Otherwise, only `available` versions will be returned.
+* `parameterGroupFamily` - (Optional) Name of a specific DB parameter group family. Examples of parameter group families are `mysql80`, `mariadb104`, and `postgres12`.
+* `preferredVersions` - (Optional) Ordered list of preferred engine versions. The first match in this list will be returned. If no preferred matches are found and the original search returned more than one result, an error is returned. If both the `version` and `preferredVersions` arguments are not configured, the data source will return the default version for the engine.
+* `version` - (Optional) Version of the DB engine. For example, `5722`, `10134`, and `123`. If both the `version` and `preferredVersions` arguments are not configured, the data source will return the default version for the engine.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `defaultCharacterSet` - The default character set for new instances of this engine version.
+* `engineDescription` - Description of the database engine.
+* `exportableLogTypes` - Set of log types that the database engine has available for export to CloudWatch Logs.
+* `status` - Status of the DB engine version, either available or deprecated.
+* `supportedCharacterSets` - Set of the character sets supported by this engine.
+* `supportedFeatureNames` - Set of features supported by the DB engine.
+* `supportedModes` - Set of the supported DB engine modes.
+* `supportedTimezones` - Set of the time zones supported by this engine.
+* `supportsGlobalDatabases` - Indicates whether you can use Aurora global databases with a specific DB engine version.
+* `supportsLogExportsToCloudwatch` - Indicates whether the engine version supports exporting the log types specified by `exportableLogTypes` to CloudWatch Logs.
+* `supportsParallelQuery` - Indicates whether you can use Aurora parallel query with a specific DB engine version.
+* `supportsReadReplica` - Indicates whether the database engine version supports read replicas.
+* `validUpgradeTargets` - Set of engine versions that this database engine version can be upgraded to.
+* `versionDescription` - Description of the database engine version.
+
+<!-- cache-key: cdktf-0.18.0 input-fa55a0405ca9fc58a5c4381651f7bc42f18362fa5a2253efb0a727fa8fb51c93 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/rds_engine_version.markdown b/website/docs/cdktf/typescript/d/rds_engine_version.markdown
new file mode 100644
index 00000000000..344ba358f19
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/rds_engine_version.markdown
@@ -0,0 +1,101 @@
+---
+subcategory: "RDS (Relational Database)"
+layout: "aws"
+page_title: "AWS: aws_rds_engine_version"
+description: |-
+  Information about an RDS engine version.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_rds_engine_version
+
+Information about an RDS engine version.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsRdsEngineVersion } from "./.gen/providers/aws/data-aws-rds-engine-version";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsRdsEngineVersion(this, "test", {
+      engine: "mysql",
+      preferredVersions: ["8.0.27", "8.0.26"],
+    });
+  }
+}
+
+```
+
+### With `filter`
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsRdsEngineVersion } from "./.gen/providers/aws/data-aws-rds-engine-version";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsRdsEngineVersion(this, "test", {
+      engine: "aurora-postgresql",
+      filter: [
+        {
+          name: "engine-mode",
+          values: ["serverless"],
+        },
+      ],
+      includeAll: true,
+      version: "10.14",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `engine` - (Required) DB engine. Engine values include `aurora`, `auroraMysql`, `auroraPostgresql`, `docdb`, `mariadb`, `mysql`, `neptune`, `oracleEe`, `oracleSe`, `oracleSe1`, `oracleSe2`, `postgres`, `sqlserverEe`, `sqlserverEx`, `sqlserverSe`, and `sqlserverWeb`.
+* `defaultOnly` - (Optional) When set to `true`, the default version for the specified `engine` or combination of `engine` and major `version` will be returned. Can be used to limit responses to a single version when they would otherwise fail for returning multiple versions.
+* `filter` - (Optional) One or more name/value pairs to filter off of. There are several valid keys; for a full reference, check out [describe-db-engine-versions in the AWS CLI reference](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/rds/describe-db-engine-versions.html).
+* `includeAll` - (Optional) When set to `true`, the specified `version` or member of `preferredVersions` will be returned even if it is `deprecated`. Otherwise, only `available` versions will be returned.
+* `parameterGroupFamily` - (Optional) Name of a specific DB parameter group family. Examples of parameter group families are `mysql80`, `mariadb104`, and `postgres12`.
+* `preferredVersions` - (Optional) Ordered list of preferred engine versions. The first match in this list will be returned. If no preferred matches are found and the original search returned more than one result, an error is returned. If both the `version` and `preferredVersions` arguments are not configured, the data source will return the default version for the engine.
+* `version` - (Optional) Version of the DB engine. For example, `5722`, `10134`, and `123`. If both the `version` and `preferredVersions` arguments are not configured, the data source will return the default version for the engine.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `defaultCharacterSet` - The default character set for new instances of this engine version.
+* `engineDescription` - Description of the database engine.
+* `exportableLogTypes` - Set of log types that the database engine has available for export to CloudWatch Logs.
+* `status` - Status of the DB engine version, either available or deprecated.
+* `supportedCharacterSets` - Set of the character sets supported by this engine.
+* `supportedFeatureNames` - Set of features supported by the DB engine.
+* `supportedModes` - Set of the supported DB engine modes.
+* `supportedTimezones` - Set of the time zones supported by this engine.
+* `supportsGlobalDatabases` - Indicates whether you can use Aurora global databases with a specific DB engine version.
+* `supportsLogExportsToCloudwatch` - Indicates whether the engine version supports exporting the log types specified by `exportableLogTypes` to CloudWatch Logs.
+* `supportsParallelQuery` - Indicates whether you can use Aurora parallel query with a specific DB engine version.
+* `supportsReadReplica` - Indicates whether the database engine version supports read replicas.
+* `validUpgradeTargets` - Set of engine versions that this database engine version can be upgraded to.
+* `versionDescription` - Description of the database engine version.
+
+<!-- cache-key: cdktf-0.18.0 input-fa55a0405ca9fc58a5c4381651f7bc42f18362fa5a2253efb0a727fa8fb51c93 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/rds_orderable_db_instance.html.markdown b/website/docs/cdktf/typescript/d/rds_orderable_db_instance.html.markdown
new file mode 100644
index 00000000000..dbf312966a8
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/rds_orderable_db_instance.html.markdown
@@ -0,0 +1,105 @@
+---
+subcategory: "RDS (Relational Database)"
+layout: "aws"
+page_title: "AWS: aws_rds_orderable_db_instance"
+description: |-
+  Information about RDS orderable DB instances.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_rds_orderable_db_instance
+
+Information about RDS orderable DB instances and valid parameter combinations.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsRdsOrderableDbInstance } from "./.gen/providers/aws/data-aws-rds-orderable-db-instance";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsRdsOrderableDbInstance(this, "test", {
+      engine: "mysql",
+      engineVersion: "5.7.22",
+      licenseModel: "general-public-license",
+      preferredInstanceClasses: ["db.r6.xlarge", "db.m4.large", "db.t3.small"],
+      storageType: "standard",
+    });
+  }
+}
+
+```
+
+Valid parameter combinations can also be found with `preferredEngineVersions` and/or `preferredInstanceClasses`.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsRdsOrderableDbInstance } from "./.gen/providers/aws/data-aws-rds-orderable-db-instance";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsRdsOrderableDbInstance(this, "test", {
+      engine: "mysql",
+      licenseModel: "general-public-license",
+      preferredEngineVersions: ["5.6.35", "5.6.41", "5.6.44"],
+      preferredInstanceClasses: ["db.t2.small", "db.t3.medium", "db.t3.large"],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `availabilityZoneGroup` - (Optional) Availability zone group.
+* `engine` - (Required) DB engine. Engine values include `aurora`, `auroraMysql`, `auroraPostgresql`, `docdb`, `mariadb`, `mysql`, `neptune`, `oracleEe`, `oracleSe`, `oracleSe1`, `oracleSe2`, `postgres`, `sqlserverEe`, `sqlserverEx`, `sqlserverSe`, and `sqlserverWeb`.
+* `engineVersion` - (Optional) Version of the DB engine. If none is provided, the AWS-defined default version will be used.
+* `instanceClass` - (Optional) DB instance class. Examples of classes are `dbM32Xlarge`, `dbT2Small`, and `dbM3Medium`.
+* `licenseModel` - (Optional) License model. Examples of license models are `generalPublicLicense`, `bringYourOwnLicense`, and `amazonLicense`.
+* `preferredInstanceClasses` - (Optional) Ordered list of preferred RDS DB instance classes. The first match in this list will be returned. If no preferred matches are found and the original search returned more than one result, an error is returned.
+* `preferredEngineVersions` - (Optional) Ordered list of preferred RDS DB instance engine versions. The first match in this list will be returned. If no preferred matches are found and the original search returned more than one result, an error is returned.
+* `storageType` - (Optional) Storage types. Examples of storage types are `standard`, `io1`, `gp2`, and `aurora`.
+* `supportsEnhancedMonitoring` - (Optional) Enable this to ensure a DB instance supports Enhanced Monitoring at intervals from 1 to 60 seconds.
+* `supportsGlobalDatabases` - (Optional) Enable this to ensure a DB instance supports Aurora global databases with a specific combination of other DB engine attributes.
+* `supportsIamDatabaseAuthentication` - (Optional) Enable this to ensure a DB instance supports IAM database authentication.
+* `supportsIops` - (Optional) Enable this to ensure a DB instance supports provisioned IOPS.
+* `supportsKerberosAuthentication` - (Optional) Enable this to ensure a DB instance supports Kerberos Authentication.
+* `supportsPerformanceInsights` - (Optional) Enable this to ensure a DB instance supports Performance Insights.
+* `supportsStorageAutoscaling` - (Optional) Enable this to ensure Amazon RDS can automatically scale storage for DB instances that use the specified DB instance class.
+* `supportsStorageEncryption` - (Optional) Enable this to ensure a DB instance supports encrypted storage.
+* `vpc` - (Optional) Boolean that indicates whether to show only VPC or non-VPC offerings.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `availabilityZones` - Availability zones where the instance is available.
+* `maxIopsPerDbInstance` - Maximum total provisioned IOPS for a DB instance.
+* `maxIopsPerGib` - Maximum provisioned IOPS per GiB for a DB instance.
+* `maxStorageSize` - Maximum storage size for a DB instance.
+* `minIopsPerDbInstance` - Minimum total provisioned IOPS for a DB instance.
+* `minIopsPerGib` - Minimum provisioned IOPS per GiB for a DB instance.
+* `minStorageSize` - Minimum storage size for a DB instance.
+* `multiAzCapable` - Whether a DB instance is Multi-AZ capable.
+* `outpostCapable` - Whether a DB instance supports RDS on Outposts.
+* `readReplicaCapable` - Whether a DB instance can have a read replica.
+* `supportedEngineModes` - A list of the supported DB engine modes.
+* `supportedNetworkTypes` - The network types supported by the DB instance (`ipv4` or `dual`).
+
+<!-- cache-key: cdktf-0.18.0 input-d3074786a5def42976852645afdb8943af9aab3562de935df98229e60b04c7e9 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/rds_orderable_db_instance.markdown b/website/docs/cdktf/typescript/d/rds_orderable_db_instance.markdown
new file mode 100644
index 00000000000..dbf312966a8
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/rds_orderable_db_instance.markdown
@@ -0,0 +1,105 @@
+---
+subcategory: "RDS (Relational Database)"
+layout: "aws"
+page_title: "AWS: aws_rds_orderable_db_instance"
+description: |-
+  Information about RDS orderable DB instances.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_rds_orderable_db_instance
+
+Information about RDS orderable DB instances and valid parameter combinations.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsRdsOrderableDbInstance } from "./.gen/providers/aws/data-aws-rds-orderable-db-instance";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsRdsOrderableDbInstance(this, "test", {
+      engine: "mysql",
+      engineVersion: "5.7.22",
+      licenseModel: "general-public-license",
+      preferredInstanceClasses: ["db.r6.xlarge", "db.m4.large", "db.t3.small"],
+      storageType: "standard",
+    });
+  }
+}
+
+```
+
+Valid parameter combinations can also be found with `preferredEngineVersions` and/or `preferredInstanceClasses`.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsRdsOrderableDbInstance } from "./.gen/providers/aws/data-aws-rds-orderable-db-instance";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsRdsOrderableDbInstance(this, "test", {
+      engine: "mysql",
+      licenseModel: "general-public-license",
+      preferredEngineVersions: ["5.6.35", "5.6.41", "5.6.44"],
+      preferredInstanceClasses: ["db.t2.small", "db.t3.medium", "db.t3.large"],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `availabilityZoneGroup` - (Optional) Availability zone group.
+* `engine` - (Required) DB engine. Engine values include `aurora`, `auroraMysql`, `auroraPostgresql`, `docdb`, `mariadb`, `mysql`, `neptune`, `oracleEe`, `oracleSe`, `oracleSe1`, `oracleSe2`, `postgres`, `sqlserverEe`, `sqlserverEx`, `sqlserverSe`, and `sqlserverWeb`.
+* `engineVersion` - (Optional) Version of the DB engine. If none is provided, the AWS-defined default version will be used.
+* `instanceClass` - (Optional) DB instance class. Examples of classes are `dbM32Xlarge`, `dbT2Small`, and `dbM3Medium`.
+* `licenseModel` - (Optional) License model. Examples of license models are `generalPublicLicense`, `bringYourOwnLicense`, and `amazonLicense`.
+* `preferredInstanceClasses` - (Optional) Ordered list of preferred RDS DB instance classes. The first match in this list will be returned. If no preferred matches are found and the original search returned more than one result, an error is returned.
+* `preferredEngineVersions` - (Optional) Ordered list of preferred RDS DB instance engine versions. The first match in this list will be returned. If no preferred matches are found and the original search returned more than one result, an error is returned.
+* `storageType` - (Optional) Storage types. Examples of storage types are `standard`, `io1`, `gp2`, and `aurora`.
+* `supportsEnhancedMonitoring` - (Optional) Enable this to ensure a DB instance supports Enhanced Monitoring at intervals from 1 to 60 seconds.
+* `supportsGlobalDatabases` - (Optional) Enable this to ensure a DB instance supports Aurora global databases with a specific combination of other DB engine attributes.
+* `supportsIamDatabaseAuthentication` - (Optional) Enable this to ensure a DB instance supports IAM database authentication.
+* `supportsIops` - (Optional) Enable this to ensure a DB instance supports provisioned IOPS.
+* `supportsKerberosAuthentication` - (Optional) Enable this to ensure a DB instance supports Kerberos Authentication.
+* `supportsPerformanceInsights` - (Optional) Enable this to ensure a DB instance supports Performance Insights.
+* `supportsStorageAutoscaling` - (Optional) Enable this to ensure Amazon RDS can automatically scale storage for DB instances that use the specified DB instance class.
+* `supportsStorageEncryption` - (Optional) Enable this to ensure a DB instance supports encrypted storage.
+* `vpc` - (Optional) Boolean that indicates whether to show only VPC or non-VPC offerings.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `availabilityZones` - Availability zones where the instance is available.
+* `maxIopsPerDbInstance` - Maximum total provisioned IOPS for a DB instance.
+* `maxIopsPerGib` - Maximum provisioned IOPS per GiB for a DB instance.
+* `maxStorageSize` - Maximum storage size for a DB instance.
+* `minIopsPerDbInstance` - Minimum total provisioned IOPS for a DB instance.
+* `minIopsPerGib` - Minimum provisioned IOPS per GiB for a DB instance.
+* `minStorageSize` - Minimum storage size for a DB instance.
+* `multiAzCapable` - Whether a DB instance is Multi-AZ capable.
+* `outpostCapable` - Whether a DB instance supports RDS on Outposts.
+* `readReplicaCapable` - Whether a DB instance can have a read replica.
+* `supportedEngineModes` - A list of the supported DB engine modes.
+* `supportedNetworkTypes` - The network types supported by the DB instance (`ipv4` or `dual`).
+
+<!-- cache-key: cdktf-0.18.0 input-d3074786a5def42976852645afdb8943af9aab3562de935df98229e60b04c7e9 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/rds_reserved_instance_offering.html.markdown b/website/docs/cdktf/typescript/d/rds_reserved_instance_offering.html.markdown
new file mode 100644
index 00000000000..e46ad2e26c9
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/rds_reserved_instance_offering.html.markdown
@@ -0,0 +1,60 @@
+---
+subcategory: "RDS (Relational Database)"
+layout: "aws"
+page_title: "AWS: aws_rds_reserved_instance_offering"
+description: |-
+  Information about a single RDS Reserved Instance Offering.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_rds_reserved_instance_offering
+
+Information about a single RDS Reserved Instance Offering.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsRdsReservedInstanceOffering } from "./.gen/providers/aws/data-aws-rds-reserved-instance-offering";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsRdsReservedInstanceOffering(this, "test", {
+      dbInstanceClass: "db.t2.micro",
+      duration: 31536000,
+      multiAz: false,
+      offeringType: "All Upfront",
+      productDescription: "mysql",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `dbInstanceClass` - (Required) DB instance class for the reserved DB instance.
+* `duration` - (Required) Duration of the reservation in years or seconds. Valid values are `1`, `3`, `31536000`, `94608000`
+* `multiAz` - (Required) Whether the reservation applies to Multi-AZ deployments.
+* `offeringType` - (Required) Offering type of this reserved DB instance. Valid values are `No Upfront`, `Partial Upfront`, `All Upfront`.
+* `productDescription` - (Required) Description of the reserved DB instance.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - Unique identifier for the reservation. Same as `offeringId`.
+* `currencyCode` - Currency code for the reserved DB instance.
+* `fixedPrice` - Fixed price charged for this reserved DB instance.
+* `offeringId` - Unique identifier for the reservation.
+
+<!-- cache-key: cdktf-0.18.0 input-a71cd524be029d3d53583d22786d99a97f23ac7fc0880861778d7b20d3ece4a7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/redshift_cluster.html.markdown b/website/docs/cdktf/typescript/d/redshift_cluster.html.markdown
new file mode 100644
index 00000000000..4640e3012ef
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/redshift_cluster.html.markdown
@@ -0,0 +1,118 @@
+---
+subcategory: "Redshift"
+layout: "aws"
+page_title: "AWS: aws_redshift_cluster"
+description: |-
+    Provides details about a specific redshift cluster
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_redshift_cluster
+
+Provides details about a specific redshift cluster.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsRedshiftCluster } from "./.gen/providers/aws/data-aws-redshift-cluster";
+import { KinesisFirehoseDeliveryStream } from "./.gen/providers/aws/kinesis-firehose-delivery-stream";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new DataAwsRedshiftCluster(this, "example", {
+      clusterIdentifier: "example-cluster",
+    });
+    new KinesisFirehoseDeliveryStream(this, "example_stream", {
+      destination: "redshift",
+      name: "terraform-kinesis-firehose-example-stream",
+      redshiftConfiguration: {
+        clusterJdbcurl:
+          "jdbc:redshift://${" +
+          example.endpoint +
+          "}/${" +
+          example.databaseName +
+          "}",
+        copyOptions: "delimiter '|'",
+        dataTableColumns: "example-col",
+        dataTableName: "example-table",
+        password: "Exampl3Pass",
+        roleArn: firehoseRole.arn,
+        s3Configuration: {
+          bucketArn: bucket.arn,
+          buffer_interval: 400,
+          buffer_size: 10,
+          compressionFormat: "GZIP",
+          roleArn: firehoseRole.arn,
+        },
+        username: "exampleuser",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `clusterIdentifier` - (Required) Cluster identifier
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of cluster.
+* `allowVersionUpgrade` - Whether major version upgrades can be applied during maintenance period
+* `automatedSnapshotRetentionPeriod` - The backup retention period
+* `aquaConfigurationStatus` - The value represents how the cluster is configured to use AQUA.
+* `availabilityZone` - Availability zone of the cluster
+* `availabilityZoneRelocationEnabled` - Indicates whether the cluster is able to be relocated to another availability zone.
+* `bucketName` - Name of the S3 bucket where the log files are to be stored
+* `clusterIdentifier` - Cluster identifier
+* `clusterNodes` - Nodes in the cluster. Cluster node blocks are documented below
+* `clusterParameterGroupName` - The name of the parameter group to be associated with this cluster
+* `clusterPublicKey` - Public key for the cluster
+* `clusterRevisionNumber` - The cluster revision number
+* `clusterSubnetGroupName` - The name of a cluster subnet group to be associated with this cluster
+* `clusterType` - Cluster type
+* `clusterNamespaceArn` - The namespace Amazon Resource Name (ARN) of the cluster
+* `databaseName` - Name of the default database in the cluster
+* `defaultIamRoleArn` - The ARN for the IAM role that was set as default for the cluster when the cluster was created.
+* `elasticIp` - Elastic IP of the cluster
+* `enableLogging` - Whether cluster logging is enabled
+* `encrypted` - Whether the cluster data is encrypted
+* `endpoint` - Cluster endpoint
+* `enhancedVpcRouting` - Whether enhanced VPC routing is enabled
+* `iamRoles` - IAM roles associated to the cluster
+* `kmsKeyId` - KMS encryption key associated to the cluster
+* `masterUsername` - Username for the master DB user
+* `nodeType` - Cluster node type
+* `numberOfNodes` - Number of nodes in the cluster
+* `maintenanceTrackName` - The name of the maintenance track for the restored cluster.
+* `manualSnapshotRetentionPeriod` - (Optional)  The default number of days to retain a manual snapshot.
+* `port` - Port the cluster responds on
+* `preferredMaintenanceWindow` - The maintenance window
+* `publiclyAccessible` - Whether the cluster is publicly accessible
+* `s3KeyPrefix` - Folder inside the S3 bucket where the log files are stored
+* `logDestinationType` - The log destination type.
+* `logExports` - Collection of exported log types. Log types include the connection log, user log and user activity log.
+* `tags` - Tags associated to the cluster
+* `vpcId` - VPC Id associated with the cluster
+* `vpcSecurityGroupIds` - The VPC security group Ids associated with the cluster
+
+Cluster nodes (for `clusterNodes`) support the following attributes:
+
+* `nodeRole` - Whether the node is a leader node or a compute node
+* `privateIpAddress` - Private IP address of a node within a cluster
+* `publicIpAddress` - Public IP address of a node within a cluster
+
+<!-- cache-key: cdktf-0.18.0 input-b688cc951fcaa53d0c385e11d05c939768ec5145c1f1ba9b8e2ae85e93a68c87 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/redshift_cluster_credentials.html.markdown b/website/docs/cdktf/typescript/d/redshift_cluster_credentials.html.markdown
new file mode 100644
index 00000000000..dba6f04c341
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/redshift_cluster_credentials.html.markdown
@@ -0,0 +1,58 @@
+---
+subcategory: "Redshift"
+layout: "aws"
+page_title: "AWS: aws_redshift_cluster_credentials"
+description: |-
+  Provides redshift cluster credentials
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_redshift_cluster_credentials
+
+Provides redshift cluster temporary credentials.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsRedshiftClusterCredentials } from "./.gen/providers/aws/data-aws-redshift-cluster-credentials";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsRedshiftClusterCredentials(this, "example", {
+      clusterIdentifier: Token.asString(
+        awsRedshiftClusterExample.clusterIdentifier
+      ),
+      dbUser: Token.asString(awsRedshiftClusterExample.masterUsername),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `autoCreate` - (Optional)  Create a database user with the name specified for the user named in `dbUser` if one does not exist.
+* `clusterIdentifier` - (Required) Unique identifier of the cluster that contains the database for which your are requesting credentials.
+* `dbName` - (Optional) Name of a database that DbUser is authorized to log on to. If `dbName` is not specified, `dbUser` can log on to any existing database.
+* `dbUser` - (Required) Name of a database user. If a user name matching `dbUser` exists in the database, the temporary user credentials have the same permissions as the  existing user. If `dbUser` doesn't exist in the database and `autoCreate` is `true`, a new user is created using the value for `dbUser` with `public` permissions.  If a database user matching the value for `dbUser` doesn't exist and `not` is `false`, then the command succeeds but the connection attempt will fail because the user doesn't exist in the database.
+* `dbGroups` - (Optional) List of the names of existing database groups that the user named in `dbUser` will join for the current session, in addition to any group memberships for an existing user. If not specified, a new user is added only to `public`.
+* `durationSeconds` - (Optional) The number of seconds until the returned temporary password expires. Valid values are between `900` and `3600`. Default value is `900`.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `dbPassword` - Temporary password that authorizes the user name returned by `dbUser` to log on to the database `dbName`.
+* `expiration` - Date and time the password in `dbPassword` expires.
+
+<!-- cache-key: cdktf-0.18.0 input-213149af130486a765c70a3136e8b43c8007a43f9271c0b532f89e893f1f207c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/redshift_orderable_cluster.html.markdown b/website/docs/cdktf/typescript/d/redshift_orderable_cluster.html.markdown
new file mode 100644
index 00000000000..b8fe6cf074b
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/redshift_orderable_cluster.html.markdown
@@ -0,0 +1,53 @@
+---
+subcategory: "Redshift"
+layout: "aws"
+page_title: "AWS: aws_redshift_orderable_cluster"
+description: |-
+  Information about RDS orderable DB instances.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_redshift_orderable_cluster
+
+Information about Redshift Orderable Clusters and valid parameter combinations.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsRedshiftOrderableCluster } from "./.gen/providers/aws/data-aws-redshift-orderable-cluster";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsRedshiftOrderableCluster(this, "test", {
+      clusterType: "multi-node",
+      preferredNodeTypes: ["dc2.large", "ds2.xlarge"],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `clusterType` - (Optional) Reshift Cluster typeE.g., `multiNode` or `singleNode`
+* `clusterVersion` - (Optional) Redshift Cluster versionE.g., `10`
+* `nodeType` - (Optional) Redshift Cluster node typeE.g., `dc28Xlarge`
+* `preferredNodeTypes` - (Optional) Ordered list of preferred Redshift Cluster node types. The first match in this list will be returned. If no preferred matches are found and the original search returned more than one result, an error is returned.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `availabilityZones` - List of Availability Zone names where the Redshift Cluster is available.
+
+<!-- cache-key: cdktf-0.18.0 input-e0fdf3575794ac21787874dcbc817842b5e948d938752511869f169f7c1ca44e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/redshift_service_account.html.markdown b/website/docs/cdktf/typescript/d/redshift_service_account.html.markdown
new file mode 100644
index 00000000000..fbfe89e97fa
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/redshift_service_account.html.markdown
@@ -0,0 +1,100 @@
+---
+subcategory: "Redshift"
+layout: "aws"
+page_title: "AWS: aws_redshift_service_account"
+description: |-
+  Get AWS Redshift Service Account for storing audit data in S3.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_redshift_service_account
+
+Use this data source to get the Account ID of the [AWS Redshift Service Account](http://docs.aws.amazon.com/redshift/latest/mgmt/db-auditing.html#db-auditing-enable-logging)
+in a given region for the purpose of allowing Redshift to store audit data in S3.
+
+~> **Note:** AWS documentation [states that](https://docs.aws.amazon.com/redshift/latest/mgmt/db-auditing.html#db-auditing-bucket-permissions) a [service principal name](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html#principal-services) should be used instead of an AWS account ID in any relevant IAM policy.
+The `awsRedshiftServiceAccount` data source has been deprecated and will be removed in a future version.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { DataAwsRedshiftServiceAccount } from "./.gen/providers/aws/data-aws-redshift-service-account";
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketPolicy } from "./.gen/providers/aws/s3-bucket-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const bucket = new S3Bucket(this, "bucket", {
+      bucket: "tf-redshift-logging-test-bucket",
+      forceDestroy: true,
+    });
+    const main = new DataAwsRedshiftServiceAccount(this, "main", {});
+    const allowAuditLogging = new DataAwsIamPolicyDocument(
+      this,
+      "allow_audit_logging",
+      {
+        statement: [
+          {
+            actions: ["s3:PutObject"],
+            effect: "Allow",
+            principals: [
+              {
+                identifiers: [Token.asString(main.arn)],
+                type: "AWS",
+              },
+            ],
+            resources: ["${" + bucket.arn + "}/*"],
+            sid: "Put bucket policy needed for audit logging",
+          },
+          {
+            actions: ["s3:GetBucketAcl"],
+            effect: "Allow",
+            principals: [
+              {
+                identifiers: [Token.asString(main.arn)],
+                type: "AWS",
+              },
+            ],
+            resources: Token.asList(dataAwsS3BucketBucket.arn),
+            sid: "Get bucket policy needed for audit logging",
+          },
+        ],
+      }
+    );
+    const awsS3BucketPolicyAllowAuditLogging = new S3BucketPolicy(
+      this,
+      "allow_audit_logging_3",
+      {
+        bucket: bucket.id,
+        policy: Token.asString(allowAuditLogging.json),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketPolicyAllowAuditLogging.overrideLogicalId("allow_audit_logging");
+  }
+}
+
+```
+
+## Argument Reference
+
+* `region` - (Optional) Name of the region whose AWS Redshift account ID is desired.
+Defaults to the region from the AWS provider configuration.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the AWS Redshift service account in the selected region.
+* `arn` - ARN of the AWS Redshift service account in the selected region.
+
+<!-- cache-key: cdktf-0.18.0 input-e94000569ef4938913b2e5c8ffc6e76ff71e3d14063c879ff153df1bb864e656 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/redshift_subnet_group.html.markdown b/website/docs/cdktf/typescript/d/redshift_subnet_group.html.markdown
new file mode 100644
index 00000000000..2273a2cc9fc
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/redshift_subnet_group.html.markdown
@@ -0,0 +1,53 @@
+---
+subcategory: "Redshift"
+layout: "aws"
+page_title: "AWS: aws_redshift_subnet_group"
+description: |-
+  Provides details about a specific redshift subnet_group
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_redshift_subnet_group
+
+Provides details about a specific redshift subnet group.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsRedshiftSubnetGroup } from "./.gen/providers/aws/data-aws-redshift-subnet-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsRedshiftSubnetGroup(this, "example", {
+      name: Token.asString(awsRedshiftSubnetGroupExample.name),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name of the cluster subnet group for which information is requested.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Redshift Subnet Group name.
+* `description` - Description of the Redshift Subnet group.
+* `id` - Redshift Subnet group Name.
+* `subnetIds` - An array of VPC subnet IDs.
+* `tags` - Tags associated to the Subnet Group
+
+<!-- cache-key: cdktf-0.18.0 input-1814cef40fea2151683ed9925569f34cf19ac6b05b2de4b553e90c473dc2df91 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/redshiftserverless_credentials.html.markdown b/website/docs/cdktf/typescript/d/redshiftserverless_credentials.html.markdown
new file mode 100644
index 00000000000..8f72cc35393
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/redshiftserverless_credentials.html.markdown
@@ -0,0 +1,55 @@
+---
+subcategory: "Redshift Serverless"
+layout: "aws"
+page_title: "AWS: aws_redshiftserverless_credentials"
+description: |-
+  Provides redshift serverless credentials
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_redshiftserverless_credentials
+
+Provides redshift serverless temporary credentials for a workgroup.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsRedshiftserverlessCredentials } from "./.gen/providers/aws/data-aws-redshiftserverless-credentials";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsRedshiftserverlessCredentials(this, "example", {
+      workgroupName: Token.asString(
+        awsRedshiftserverlessWorkgroupExample.workgroupName
+      ),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `workgroupName` - (Required) The name of the workgroup associated with the database.
+* `dbName` - (Optional) The name of the database to get temporary authorization to log on to.
+* `durationSeconds` - (Optional) The number of seconds until the returned temporary password expires. The minimum is 900 seconds, and the maximum is 3600 seconds.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `dbPassword` - Temporary password that authorizes the user name returned by `dbUser` to log on to the database `dbName`.
+* `dbUser` - A database user name that is authorized to log on to the database `dbName` using the password `dbPassword` . If the specified `dbUser` exists in the database, the new user name has the same database privileges as the user named in `dbUser` . By default, the user is added to PUBLIC. the user doesn't exist in the database.
+* `expiration` - Date and time the password in `dbPassword` expires.
+
+<!-- cache-key: cdktf-0.18.0 input-34a2bbcfc773ba4d89d7b456bbb05f8a84bac33ed819e86e9a4b29600cb82b59 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/redshiftserverless_namespace.html.markdown b/website/docs/cdktf/typescript/d/redshiftserverless_namespace.html.markdown
new file mode 100644
index 00000000000..827a7db978d
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/redshiftserverless_namespace.html.markdown
@@ -0,0 +1,56 @@
+---
+subcategory: "Redshift Serverless"
+layout: "aws"
+page_title: "AWS: aws_redshiftserverless_namespace"
+description: |-
+  Terraform data source for managing an AWS Redshift Serverless Namespace.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_redshiftserverless_namespace
+
+Terraform data source for managing an AWS Redshift Serverless Namespace.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsRedshiftserverlessNamespace } from "./.gen/providers/aws/data-aws-redshiftserverless-namespace";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsRedshiftserverlessNamespace(this, "example", {
+      namespaceName: "example-namespace",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `namespaceName` - (Required) The name of the namespace.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `adminUsername` - The username of the administrator for the first database created in the namespace.
+* `arn` - Amazon Resource Name (ARN) of the Redshift Serverless Namespace.
+* `dbName` - The name of the first database created in the namespace.
+* `defaultIamRoleArn` - The Amazon Resource Name (ARN) of the IAM role to set as a default in the namespace. When specifying `defaultIamRoleArn`, it also must be part of `iamRoles`.
+* `iamRoles` - A list of IAM roles to associate with the namespace.
+* `kmsKeyId` - The ARN of the Amazon Web Services Key Management Service key used to encrypt your data.
+* `logExports` - The types of logs the namespace can export. Available export types are `userlog`, `connectionlog`, and `useractivitylog`.
+* `namespaceId` - The Redshift Namespace ID.
+
+<!-- cache-key: cdktf-0.18.0 input-353587d87083acd6cf58b7bf04d05a60c67f4c8fc0953c115222a623d6c4455b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/redshiftserverless_workgroup.html.markdown b/website/docs/cdktf/typescript/d/redshiftserverless_workgroup.html.markdown
new file mode 100644
index 00000000000..6e25e3a0396
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/redshiftserverless_workgroup.html.markdown
@@ -0,0 +1,79 @@
+---
+subcategory: "Redshift Serverless"
+layout: "aws"
+page_title: "AWS: aws_redshiftserverless_workgroup"
+description: |-
+  Terraform data source for managing an AWS Redshift Serverless Workgroup.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_redshiftserverless_workgroup
+
+Terraform data source for managing an AWS Redshift Serverless Workgroup.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsRedshiftserverlessWorkgroup } from "./.gen/providers/aws/data-aws-redshiftserverless-workgroup";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsRedshiftserverlessWorkgroup(this, "example", {
+      workgroupName: Token.asString(
+        awsRedshiftserverlessWorkgroupExample.workgroupName
+      ),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `workgroupName` - (Required) The name of the workgroup associated with the database.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the Redshift Serverless Workgroup.
+* `id` - The Redshift Workgroup Name.
+* `endpoint` - The endpoint that is created from the workgroup. See `endpoint` below.
+* `enhancedVpcRouting` - The value that specifies whether to turn on enhanced virtual private cloud (VPC) routing, which forces Amazon Redshift Serverless to route traffic through your VPC instead of over the internet.
+* `publiclyAccessible` - A value that specifies whether the workgroup can be accessed from a public network.
+* `securityGroupIds` - An array of security group IDs to associate with the workgroup.
+* `subnetIds` - An array of VPC subnet IDs to associate with the workgroup. When set, must contain at least three subnets spanning three Availability Zones. A minimum number of IP addresses is required and scales with the Base Capacity. For more information, see the following [AWS document](https://docs.aws.amazon.com/redshift/latest/mgmt/serverless-known-issues.html).
+* `workgroupId` - The Redshift Workgroup ID.
+
+### Endpoint
+
+* `address` - The DNS address of the VPC endpoint.
+* `port` - The port that Amazon Redshift Serverless listens on.
+* `vpcEndpoint` - The VPC endpoint or the Redshift Serverless workgroup. See `VPC Endpoint` below.
+
+#### VPC Endpoint
+
+* `vpcEndpointId` - The DNS address of the VPC endpoint.
+* `vpcId` - The port that Amazon Redshift Serverless listens on.
+* `networkInterface` - The network interfaces of the endpoint.. See `Network Interface` below.
+
+##### Network Interface
+
+* `availabilityZone` - The availability Zone.
+* `networkInterfaceId` - The unique identifier of the network interface.
+* `privateIpAddress` - The IPv4 address of the network interface within the subnet.
+* `subnetId` - The unique identifier of the subnet.
+
+<!-- cache-key: cdktf-0.18.0 input-374d27f8fbd13cb2f6821046b5a1fe85a8500dfa779b30e1ffd4cad3110ce132 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/region.html.markdown b/website/docs/cdktf/typescript/d/region.html.markdown
new file mode 100644
index 00000000000..a935c4f40e0
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/region.html.markdown
@@ -0,0 +1,63 @@
+---
+subcategory: "Meta Data Sources"
+layout: "aws"
+page_title: "AWS: aws_region"
+description: |-
+    Provides details about a specific service region
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_region
+
+`awsRegion` provides details about a specific AWS region.
+
+As well as validating a given region name this resource can be used to
+discover the name of the region configured within the provider. The latter
+can be useful in a child module which is inheriting an AWS provider
+configuration from its parent module.
+
+## Example Usage
+
+The following example shows how the resource might be used to obtain
+the name of the AWS region configured on the provider.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsRegion } from "./.gen/providers/aws/data-aws-region";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsRegion(this, "current", {});
+  }
+}
+
+```
+
+## Argument Reference
+
+The arguments of this data source act as filters for querying the available
+regions. The given filters must match exactly one region whose data will be
+exported as attributes.
+
+* `name` - (Optional) Full name of the region to select.
+
+* `endpoint` - (Optional) EC2 endpoint of the region to select.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `name` - Name of the selected region.
+
+* `endpoint` - EC2 endpoint for the selected region.
+
+* `description` - Region's description in this format: "Location (Region name)".
+
+<!-- cache-key: cdktf-0.18.0 input-aa7c9151f3a0b19e57d6cc253b49c17fa63fbcf513e80e2ad30986f51d764653 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/regions.html.markdown b/website/docs/cdktf/typescript/d/regions.html.markdown
new file mode 100644
index 00000000000..4ad0bc6334d
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/regions.html.markdown
@@ -0,0 +1,111 @@
+---
+subcategory: "Meta Data Sources"
+layout: "aws"
+page_title: "AWS: aws_regions"
+description: |-
+    Provides information about AWS Regions.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_regions
+
+Provides information about AWS Regions. Can be used to filter regions i.e., by Opt-In status or only regions enabled for current account. To get details like endpoint and description of each region the data source can be combined with the [`awsRegion` data source](/docs/providers/aws/d/region.html).
+
+## Example Usage
+
+Enabled AWS Regions:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsRegions } from "./.gen/providers/aws/data-aws-regions";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsRegions(this, "current", {});
+  }
+}
+
+```
+
+All the regions regardless of the availability
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsRegions } from "./.gen/providers/aws/data-aws-regions";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsRegions(this, "current", {
+      allRegions: true,
+    });
+  }
+}
+
+```
+
+To see regions that are filtered by `"notOptedIn"`, the `allRegions` argument needs to be set to `true` or no results will be returned.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsRegions } from "./.gen/providers/aws/data-aws-regions";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsRegions(this, "current", {
+      allRegions: true,
+      filter: [
+        {
+          name: "opt-in-status",
+          values: ["not-opted-in"],
+        },
+      ],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `allRegions` - (Optional) If true the source will query all regions regardless of availability.
+
+* `filter` - (Optional) Configuration block(s) to use as filters. Detailed below.
+
+### filter Configuration Block
+
+The `filter` configuration block supports the following arguments:
+
+* `name` - (Required) Name of the filter field. Valid values can be found in the [describe-regions AWS CLI Reference][1].
+* `values` - (Required) Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - Identifier of the current partition (e.g., `aws` in AWS Commercial, `awsCn` in AWS China).
+* `names` - Names of regions that meets the criteria.
+
+[1]: https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-regions.html
+
+<!-- cache-key: cdktf-0.18.0 input-729936980236c90d4bfd49d088a65b256dd691594554c0abd78aef71806ddd45 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/resourcegroupstaggingapi_resources.html.markdown b/website/docs/cdktf/typescript/d/resourcegroupstaggingapi_resources.html.markdown
new file mode 100644
index 00000000000..65b4113182e
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/resourcegroupstaggingapi_resources.html.markdown
@@ -0,0 +1,118 @@
+---
+subcategory: "Resource Groups Tagging"
+layout: "aws"
+page_title: "AWS: aws_resourcegroupstaggingapi_resources"
+description: |-
+  Provides details about resource tagging.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_resourcegroupstaggingapi_resources
+
+Provides details about resource tagging.
+
+## Example Usage
+
+### Get All Resource Tag Mappings
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsResourcegroupstaggingapiResources } from "./.gen/providers/aws/data-aws-resourcegroupstaggingapi-resources";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsResourcegroupstaggingapiResources(this, "test", {});
+  }
+}
+
+```
+
+### Filter By Tag Key and Value
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsResourcegroupstaggingapiResources } from "./.gen/providers/aws/data-aws-resourcegroupstaggingapi-resources";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsResourcegroupstaggingapiResources(this, "test", {
+      tagFilter: [
+        {
+          key: "tag-key",
+          values: ["tag-value-1", "tag-value-2"],
+        },
+      ],
+    });
+  }
+}
+
+```
+
+### Filter By Resource Type
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsResourcegroupstaggingapiResources } from "./.gen/providers/aws/data-aws-resourcegroupstaggingapi-resources";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsResourcegroupstaggingapiResources(this, "test", {
+      resourceTypeFilters: ["ec2:instance"],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `excludeCompliantResources` - (Optional) Specifies whether to exclude resources that are compliant with the tag policy. You can use this parameter only if the `includeComplianceDetails` argument is also set to `true`.
+* `includeComplianceDetails` - (Optional) Specifies whether to include details regarding the compliance with the effective tag policy.
+* `tagFilter` - (Optional) Specifies a list of Tag Filters (keys and values) to restrict the output to only those resources that have the specified tag and, if included, the specified value. See [Tag Filter](#tag-filter) below. Conflicts with `resourceArnList`.
+* `resourceTypeFilters` - (Optional) Constraints on the resources that you want returned. The format of each resource type is `service:resourceType`. For example, specifying a resource type of `ec2` returns all Amazon EC2 resources (which includes EC2 instances). Specifying a resource type of `ec2:instance` returns only EC2 instances.
+* `resourceArnList` - (Optional) Specifies a list of ARNs of resources for which you want to retrieve tag data. Conflicts with `filter`.
+
+### Tag Filter
+
+A `tagFilter` block supports the following arguments:
+
+If you do specify `tagFilter`, the response returns only those resources that are currently associated with the specified tag.
+If you don't specify a `tagFilter`, the response includes all resources that were ever associated with tags. Resources that currently don't have associated tags are shown with an empty tag set.
+
+* `key` - (Required) One part of a key-value pair that makes up a tag.
+* `values` - (Optional) Optional part of a key-value pair that make up a tag.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `resourceTagMappingList` - List of objects matching the search criteria.
+    * `complianceDetails` - List of objects with information that shows whether a resource is compliant with the effective tag policy, including details on any noncompliant tag keys.
+        * `complianceStatus` - Whether the resource is compliant.
+        * `keys_with_noncompliant_values ` - Set of tag keys with non-compliant tag values.
+        * `non_compliant_keys ` - Set of non-compliant tag keys.
+    * `resourceArn` - ARN of the resource.
+    * `tags` - Map of tags assigned to the resource.
+
+<!-- cache-key: cdktf-0.18.0 input-dfacd28e615a77cfbad3e63cc2c0fab691bf6f824574bd266ed9fe2b81be6bdc -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/route.html.markdown b/website/docs/cdktf/typescript/d/route.html.markdown
new file mode 100644
index 00000000000..8ec35fa399f
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/route.html.markdown
@@ -0,0 +1,87 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_route"
+description: |-
+    Provides details about a specific Route
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_route
+
+`awsRoute` provides details about a specific Route.
+
+This resource can prove useful when finding the resource associated with a CIDR. For example, finding the peering connection associated with a CIDR value.
+
+## Example Usage
+
+The following example shows how one might use a CIDR value to find a network interface id and use this to create a data source of that network interface.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformVariable, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsNetworkInterface } from "./.gen/providers/aws/data-aws-network-interface";
+import { DataAwsRoute } from "./.gen/providers/aws/data-aws-route";
+import { DataAwsRouteTable } from "./.gen/providers/aws/data-aws-route-table";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    /*Terraform Variables are not always the best fit for getting inputs in the context of Terraform CDK.
+    You can read more about this at https://cdk.tf/variables*/
+    const subnetId = new TerraformVariable(this, "subnet_id", {});
+    const route = new DataAwsRoute(this, "route", {
+      destinationCidrBlock: "10.0.1.0/24",
+      routeTableId: selected.id,
+    });
+    new DataAwsRouteTable(this, "selected", {
+      subnetId: subnetId.stringValue,
+    });
+    new DataAwsNetworkInterface(this, "interface", {
+      id: Token.asString(route.networkInterfaceId),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The arguments of this data source act as filters for querying the available Route in the current region. The given filters must match exactly oneRoute whose data will be exported as attributes.
+
+The following arguments are required:
+
+* `routeTableId` - (Required) ID of the specific Route Table containing the Route entry.
+
+The following arguments are optional:
+
+* `carrierGatewayId` - (Optional) EC2 Carrier Gateway ID of the Route belonging to the Route Table.
+* `coreNetworkArn` - (Optional) Core network ARN of the Route belonging to the Route Table.
+* `destinationCidrBlock` - (Optional) CIDR block of the Route belonging to the Route Table.
+* `destinationIpv6CidrBlock` - (Optional) IPv6 CIDR block of the Route belonging to the Route Table.
+* `destinationPrefixListId` - (Optional) ID of a [managed prefix list](ec2_managed_prefix_list.html) destination of the Route belonging to the Route Table.
+* `egressOnlyGatewayId` - (Optional) Egress Only Gateway ID of the Route belonging to the Route Table.
+* `gatewayId` - (Optional) Gateway ID of the Route belonging to the Route Table.
+* `instanceId` - (Optional) Instance ID of the Route belonging to the Route Table.
+* `localGatewayId` - (Optional) Local Gateway ID of the Route belonging to the Route Table.
+* `natGatewayId` - (Optional) NAT Gateway ID of the Route belonging to the Route Table.
+* `networkInterfaceId` - (Optional) Network Interface ID of the Route belonging to the Route Table.
+* `transitGatewayId` - (Optional) EC2 Transit Gateway ID of the Route belonging to the Route Table.
+* `vpcPeeringConnectionId` - (Optional) VPC Peering Connection ID of the Route belonging to the Route Table.
+
+## Attribute Reference
+
+All of the argument attributes are also exported as result attributes when there is data available. For example, the `vpcPeeringConnectionId` field will be empty when the route is attached to a Network Interface.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `20M`)
+
+<!-- cache-key: cdktf-0.18.0 input-33a69cd7bf58da7db6b0a1e84dd1601b625d3a9040a0150ad517559d95d9622f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/route53_delegation_set.html.markdown b/website/docs/cdktf/typescript/d/route53_delegation_set.html.markdown
new file mode 100644
index 00000000000..9af1dc4f581
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/route53_delegation_set.html.markdown
@@ -0,0 +1,51 @@
+---
+subcategory: "Route 53"
+layout: "aws"
+page_title: "AWS: aws_route53_delegation_set"
+description: |-
+    Provides details about a specific Route 53 Delegation Set
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_route53_delegation_set
+
+`awsRoute53DelegationSet` provides details about a specific Route 53 Delegation Set.
+
+This data source allows to find a list of name servers associated with a specific delegation set.
+
+## Example Usage
+
+The following example shows how to get a delegation set from its id.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsRoute53DelegationSet } from "./.gen/providers/aws/data-aws-route53-delegation-set";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsRoute53DelegationSet(this, "dset", {
+      id: "MQWGHCBFAKEID",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `id` - (Required) Delegation set ID.
+
+The following attribute is additionally exported:
+
+* `arn` - ARN of the Delegation Set.
+* `callerReference` - Caller Reference of the delegation set.
+* `nameServers` - List of DNS name servers for the delegation set.
+
+<!-- cache-key: cdktf-0.18.0 input-40fcc3d8081992110595bf5da825dc8f40806338d89694588a485216d94caf0d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/route53_resolver_endpoint.html.markdown b/website/docs/cdktf/typescript/d/route53_resolver_endpoint.html.markdown
new file mode 100644
index 00000000000..4f6fa578f69
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/route53_resolver_endpoint.html.markdown
@@ -0,0 +1,81 @@
+---
+subcategory: "Route 53 Resolver"
+layout: "aws"
+page_title: "AWS: aws_route53_resolver_endpoint"
+description: |-
+    Provides details about a specific Route 53 Resolver Endpoint
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_route53_resolver_endpoint
+
+`awsRoute53ResolverEndpoint` provides details about a specific Route53 Resolver Endpoint.
+
+This data source allows to find a list of IPaddresses associated with a specific Route53 Resolver Endpoint.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsRoute53ResolverEndpoint } from "./.gen/providers/aws/data-aws-route53-resolver-endpoint";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsRoute53ResolverEndpoint(this, "example", {
+      resolverEndpointId: "rslvr-in-1abc2345ef678g91h",
+    });
+  }
+}
+
+```
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsRoute53ResolverEndpoint } from "./.gen/providers/aws/data-aws-route53-resolver-endpoint";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsRoute53ResolverEndpoint(this, "example", {
+      filter: [
+        {
+          name: "NAME",
+          values: ["MyResolverExampleName"],
+        },
+      ],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `resolverEndpointId` - (Optional) ID of the Route53 Resolver Endpoint.
+* `filter` - (Optional) One or more name/value pairs to use as filters. There are
+several valid keys, for a full reference, check out
+[Route53resolver Filter value in the AWS API reference][1].
+
+In addition to all arguments above, the following attributes are exported:
+
+* `arn` - Computed ARN of the Route53 Resolver Endpoint.
+* `direction` - Direction of the queries to or from the Resolver Endpoint .
+* `ipAddresses` - List of IPaddresses that have been associated with the Resolver Endpoint.
+* `status` - Current status of the Resolver Endpoint.
+* `vpcId` - ID of the Host VPC that the Resolver Endpoint resides in.
+
+[1]: https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_Filter.html
+
+<!-- cache-key: cdktf-0.18.0 input-c09fe4f13b65e731e041218940aaae0128be2c19aef275c15d677ea4e550c621 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/route53_resolver_firewall_config.html.markdown b/website/docs/cdktf/typescript/d/route53_resolver_firewall_config.html.markdown
new file mode 100644
index 00000000000..17cbc604109
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/route53_resolver_firewall_config.html.markdown
@@ -0,0 +1,51 @@
+---
+subcategory: "Route 53 Resolver"
+layout: "aws"
+page_title: "AWS: aws_route53_resolver_firewall_config"
+description: |-
+    Provides details about a specific a Route 53 Resolver DNS Firewall config.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_route53_resolver_firewall_config
+
+`awsRoute53ResolverFirewallConfig` provides details about a specific a Route 53 Resolver DNS Firewall config.
+
+This data source allows to find a details about a specific a Route 53 Resolver DNS Firewall config.
+
+## Example Usage
+
+The following example shows how to get a firewall config using the VPC ID.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsRoute53ResolverFirewallConfig } from "./.gen/providers/aws/data-aws-route53-resolver-firewall-config";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsRoute53ResolverFirewallConfig(this, "example", {
+      resourceId: "vpc-exampleid",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `resourceId` - (Required) The ID of the VPC from Amazon VPC that the configuration is for.
+
+The following attribute is additionally exported:
+
+* `firewallFailOpen` - Determines how DNS Firewall operates during failures, for example when all traffic that is sent to DNS Firewall fails to receive a reply.
+* `id` - The ID of the firewall configuration.
+* `ownerId` - The Amazon Web Services account ID of the owner of the VPC that this firewall configuration applies to.
+
+<!-- cache-key: cdktf-0.18.0 input-b0f09d7efd8e098bbc579593a822c42d9bc95461129ab91f2ff09be220ad7bf4 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/route53_resolver_firewall_domain_list.html.markdown b/website/docs/cdktf/typescript/d/route53_resolver_firewall_domain_list.html.markdown
new file mode 100644
index 00000000000..751c6daec5a
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/route53_resolver_firewall_domain_list.html.markdown
@@ -0,0 +1,57 @@
+---
+subcategory: "Route 53 Resolver"
+layout: "aws"
+page_title: "AWS: aws_route53_resolver_firewall_domain_list"
+description: |-
+    Retrieves the specified firewall domain list.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_route53_resolver_firewall_domain_list
+
+`awsRoute53ResolverFirewallDomainList` Retrieves the specified firewall domain list.
+
+This data source allows to retrieve details about a specific a Route 53 Resolver DNS Firewall domain list.
+
+## Example Usage
+
+The following example shows how to get a firewall domain list from its ID.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsRoute53ResolverFirewallDomainList } from "./.gen/providers/aws/data-aws-route53-resolver-firewall-domain-list";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsRoute53ResolverFirewallDomainList(this, "example", {
+      firewallDomainListId: "rslvr-fdl-example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `firewallDomainListId` - (Required) The ID of the domain list.
+
+The following attribute is additionally exported:
+
+* `arn` - The Amazon Resource Name (ARN) of the firewall domain list.
+* `creationTime` - The date and time that the domain list was created, in Unix time format and Coordinated Universal Time (UTC).
+* `creatorRequestId` - A unique string defined by you to identify the request.
+* `domainCount` - The number of domain names that are specified in the domain list.
+* `name` - The name of the domain list.
+* `managedOwnerName` - The owner of the list, used only for lists that are not managed by you.
+* `modificationTime` - The date and time that the domain list was last modified, in Unix time format and Coordinated Universal Time (UTC).
+* `status` - The status of the domain list.
+* `statusMessage` - Additional information about the status of the list, if available.
+
+<!-- cache-key: cdktf-0.18.0 input-35c900f0c4e3cc253efbb2bda21a0b76720a28ec58c6061e8c2afed4134cbbea -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/route53_resolver_firewall_rule_group.html.markdown b/website/docs/cdktf/typescript/d/route53_resolver_firewall_rule_group.html.markdown
new file mode 100644
index 00000000000..cda23b1f08f
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/route53_resolver_firewall_rule_group.html.markdown
@@ -0,0 +1,58 @@
+---
+subcategory: "Route 53 Resolver"
+layout: "aws"
+page_title: "AWS: aws_route53_resolver_firewall_rule_group"
+description: |-
+    Retrieves the specified firewall rule group.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_route53_resolver_firewall_rule_group
+
+`awsRoute53ResolverFirewallRuleGroup` Retrieves the specified firewall rule group.
+
+This data source allows to retrieve details about a specific a Route 53 Resolver DNS Firewall rule group.
+
+## Example Usage
+
+The following example shows how to get a firewall rule group from its ID.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsRoute53ResolverFirewallRuleGroup } from "./.gen/providers/aws/data-aws-route53-resolver-firewall-rule-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsRoute53ResolverFirewallRuleGroup(this, "example", {
+      firewallRuleGroupId: "rslvr-frg-example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `firewallRuleGroupId` - (Required) The ID of the rule group.
+
+The following attribute is additionally exported:
+
+* `arn` - The ARN (Amazon Resource Name) of the rule group.
+* `creationTime` - The date and time that the rule group was created, in Unix time format and Coordinated Universal Time (UTC).
+* `creatorRequestId` - A unique string defined by you to identify the request.
+* `name` - The name of the rule group.
+* `modificationTime` - The date and time that the rule group was last modified, in Unix time format and Coordinated Universal Time (UTC).
+* `ownerId` - The Amazon Web Services account ID for the account that created the rule group. When a rule group is shared with your account, this is the account that has shared the rule group with you.
+* `ruleCount` - The number of rules in the rule group.
+* `shareStatus` - Whether the rule group is shared with other Amazon Web Services accounts, or was shared with the current account by another Amazon Web Services account.
+* `status` - The status of the rule group.
+* `statusMessage` - Additional information about the status of the rule group, if available.
+
+<!-- cache-key: cdktf-0.18.0 input-472d18e53a4acc66b8fb9f05bea99d5b96b2b4c83c2cdc01e472235760993460 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/route53_resolver_firewall_rule_group_association.html.markdown b/website/docs/cdktf/typescript/d/route53_resolver_firewall_rule_group_association.html.markdown
new file mode 100644
index 00000000000..865f3f8f44a
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/route53_resolver_firewall_rule_group_association.html.markdown
@@ -0,0 +1,60 @@
+---
+subcategory: "Route 53 Resolver"
+layout: "aws"
+page_title: "AWS: aws_route53_resolver_firewall_rule_group_association"
+description: |-
+    Retrieves the specified firewall rule group association.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_route53_resolver_firewall_rule_group_association
+
+`awsRoute53ResolverFirewallRuleGroupAssociation` Retrieves the specified firewall rule group association.
+
+This data source allows to retrieve details about a specific a Route 53 Resolver DNS Firewall rule group association.
+
+## Example Usage
+
+The following example shows how to get a firewall rule group association from its id.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsRoute53ResolverFirewallRuleGroupAssociation } from "./.gen/providers/aws/data-aws-route53-resolver-firewall-rule-group-association";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsRoute53ResolverFirewallRuleGroupAssociation(this, "example", {
+      firewallRuleGroupAssociationId: "rslvr-frgassoc-example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `firewallRuleGroupAssociationId` - (Required) The identifier for the association.
+
+The following attribute is additionally exported:
+
+* `arn` - The Amazon Resource Name (ARN) of the firewall rule group association.
+* `creationTime` - The date and time that the association was created, in Unix time format and Coordinated Universal Time (UTC).
+* `creatorRequestId` - A unique string defined by you to identify the request.
+* `firewallRuleGroupId` - The unique identifier of the firewall rule group.
+* `managedOwnerName` - The owner of the association, used only for associations that are not managed by you.
+* `modificationTime` - The date and time that the association was last modified, in Unix time format and Coordinated Universal Time (UTC).
+* `mutationProtection` - If enabled, this setting disallows modification or removal of the association, to help prevent against accidentally altering DNS firewall protections.
+* `name` - The name of the association.
+* `priority` - The setting that determines the processing order of the rule group among the rule groups that are associated with a single VPC.
+* `status` - The current status of the association.
+* `statusMessage` - Additional information about the status of the response, if available.
+* `vpcId` - The unique identifier of the VPC that is associated with the rule group.
+
+<!-- cache-key: cdktf-0.18.0 input-96baaccea7a8993bc2b43ff8bcd9ea43595994e4407fb3bc1d20edf090565dd8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/route53_resolver_firewall_rules.html.markdown b/website/docs/cdktf/typescript/d/route53_resolver_firewall_rules.html.markdown
new file mode 100644
index 00000000000..8cc19bea547
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/route53_resolver_firewall_rules.html.markdown
@@ -0,0 +1,68 @@
+---
+subcategory: "Route 53 Resolver"
+layout: "aws"
+page_title: "AWS: aws_route53_resolver_firewall_rules"
+description: |-
+    Provides details about rules in a specific Route53 Resolver Firewall rule group.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_route53_resolver_firewall_rules
+
+`awsRoute53ResolverFirewallRules` Provides details about rules in a specific Route53 Resolver Firewall rule group.
+
+## Example Usage
+
+The following example shows how to get Route53 Resolver Firewall rules based on its associated firewall group id.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsRoute53ResolverFirewallRules } from "./.gen/providers/aws/data-aws-route53-resolver-firewall-rules";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsRoute53ResolverFirewallRules(this, "example", {
+      firewallRuleGroupId: Token.asString(
+        awsRoute53ResolverFirewallRuleGroupExample.id
+      ),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The arguments of this data source act as filters for querying the available resolver rules in the current region.
+The given filters must match exactly one resolver rule whose data will be exported as attributes.
+
+* `firewallRuleGroupId` - (Required) The unique identifier of the firewall rule group that you want to retrieve the rules for.
+* `action` - (Optional) The action that DNS Firewall should take on a DNS query when it matches one of the domains in the rule's domain list.
+* `priority` - (Optional) The setting that determines the processing order of the rules in a rule group.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `firewallRules` - List with information about the firewall rules. See details below.
+
+### provisioning_artifact_details
+
+* `blockOverrideDnsType` - The DNS record's type.
+* `blockOverrideDomain` - The custom DNS record to send back in response to the query.
+* `blockOverrideTtl` - The recommended amount of time, in seconds, for the DNS resolver or web browser to cache the provided override record.
+* `blockResponse` - The way that you want DNS Firewall to block the request.
+* `creationTime` - The date and time that the rule was created, in Unix time format and Coordinated Universal Time (UTC).
+* `creatorRequestId` - A unique string defined by you to identify the request.
+* `firewallDomainListId` - The ID of the domain list that's used in the rule.
+* `modificationTime` - The date and time that the rule was last modified, in Unix time format and Coordinated Universal Time (UTC).
+* `name` - The name of the rule.
+
+<!-- cache-key: cdktf-0.18.0 input-7b8006826528bb5f3aaa7132422f98725c6be04f17245114660aea8409422dde -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/route53_resolver_query_log_config.html.markdown b/website/docs/cdktf/typescript/d/route53_resolver_query_log_config.html.markdown
new file mode 100644
index 00000000000..52742aab5f3
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/route53_resolver_query_log_config.html.markdown
@@ -0,0 +1,85 @@
+---
+subcategory: "Route 53 Resolver"
+layout: "aws"
+page_title: "AWS: aws_route53_resolver_query_log_config"
+description: |-
+  Provides details about a specific Route53 Resolver Query Logging Configuration.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_route53_resolver_query_log_config
+
+`awsRoute53ResolverQueryLogConfig` provides details about a specific Route53 Resolver Query Logging Configuration.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsRoute53ResolverQueryLogConfig } from "./.gen/providers/aws/data-aws-route53-resolver-query-log-config";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsRoute53ResolverQueryLogConfig(this, "example", {
+      resolverQueryLogConfigId: "rqlc-1abc2345ef678g91h",
+    });
+  }
+}
+
+```
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsRoute53ResolverQueryLogConfig } from "./.gen/providers/aws/data-aws-route53-resolver-query-log-config";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsRoute53ResolverQueryLogConfig(this, "example", {
+      filter: [
+        {
+          name: "Name",
+          values: ["shared-query-log-config"],
+        },
+        {
+          name: "ShareStatus",
+          values: ["SHARED_WITH_ME"],
+        },
+      ],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `resolverQueryLogConfigId` - (Optional) ID of the Route53 Resolver Query Logging Configuration.
+* `filter` - (Optional) One or more name/value pairs to use as filters. There are
+several valid keys, for a full reference, check out
+[Route53resolver Filter value in the AWS API reference][1].
+
+In addition to all arguments above, the following attributes are exported:
+
+* `id` - The ID for the query logging configuration.
+* `arn` - Computed ARN of the Route53 Resolver Query Logging Configuration.
+* `destinationArn` - The ARN of the resource that you want Resolver to send query logs: an Amazon S3 bucket, a CloudWatch Logs log group or a Kinesis Data Firehose delivery stream.
+* `name` - The name of the query logging configuration.
+* `ownerId` - The AWS account ID for the account that created the query logging configuration.
+* `shareStatus` - An indication of whether the query logging configuration is shared with other AWS accounts or was shared with the current account by another AWS account.
+* `tags` - Map of tags to assign to the service.
+
+[1]: https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_Filter.html
+
+<!-- cache-key: cdktf-0.18.0 input-03aae9da90100bb44ba9ea973741cb3491b6e7ffca09d59a483c436ca965901e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/route53_resolver_rule.html.markdown b/website/docs/cdktf/typescript/d/route53_resolver_rule.html.markdown
new file mode 100644
index 00000000000..922a7b12414
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/route53_resolver_rule.html.markdown
@@ -0,0 +1,62 @@
+---
+subcategory: "Route 53 Resolver"
+layout: "aws"
+page_title: "AWS: aws_route53_resolver_rule"
+description: |-
+    Provides details about a specific Route53 Resolver rule
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_route53_resolver_rule
+
+`awsRoute53ResolverRule` provides details about a specific Route53 Resolver rule.
+
+## Example Usage
+
+The following example shows how to get a Route53 Resolver rule based on its associated domain name and rule type.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsRoute53ResolverRule } from "./.gen/providers/aws/data-aws-route53-resolver-rule";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsRoute53ResolverRule(this, "example", {
+      domainName: "subdomain.example.com",
+      ruleType: "SYSTEM",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The arguments of this data source act as filters for querying the available resolver rules in the current region.
+The given filters must match exactly one resolver rule whose data will be exported as attributes.
+
+* `domainName` - (Optional) Domain name the desired resolver rule forwards DNS queries for. Conflicts with `resolverRuleId`.
+* `name` - (Optional) Friendly name of the desired resolver rule. Conflicts with `resolverRuleId`.
+* `resolverEndpointId` (Optional) ID of the outbound resolver endpoint of the desired resolver rule. Conflicts with `resolverRuleId`.
+* `resolverRuleId` (Optional) ID of the desired resolver rule. Conflicts with `domainName`, `name`, `resolverEndpointId` and `ruleType`.
+* `ruleType` - (Optional) Rule type of the desired resolver rule. Valid values are `forward`, `system` and `recursive`. Conflicts with `resolverRuleId`.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the resolver rule.
+* `arn` - ARN (Amazon Resource Name) for the resolver rule.
+* `ownerId` - When a rule is shared with another AWS account, the account ID of the account that the rule is shared with.
+* `shareStatus` - Whether the rules is shared and, if so, whether the current account is sharing the rule with another account, or another account is sharing the rule with the current account.
+Values are `notShared`, `sharedByMe` or `sharedWithMe`
+* `tags` - Map of tags assigned to the resolver rule.
+
+<!-- cache-key: cdktf-0.18.0 input-18fb35f097987b8d14e261d381f5a10359f2716b6cb0f20fc2d80f0c0da22650 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/route53_resolver_rules.html.markdown b/website/docs/cdktf/typescript/d/route53_resolver_rules.html.markdown
new file mode 100644
index 00000000000..2c7c1f34752
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/route53_resolver_rules.html.markdown
@@ -0,0 +1,107 @@
+---
+subcategory: "Route 53 Resolver"
+layout: "aws"
+page_title: "AWS: aws_route53_resolver_rules"
+description: |-
+    Provides details about a set of Route53 Resolver rules
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_route53_resolver_rules
+
+`awsRoute53ResolverRules` provides details about a set of Route53 Resolver rules.
+
+## Example Usage
+
+### Retrieving the default resolver rule
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsRoute53ResolverRules } from "./.gen/providers/aws/data-aws-route53-resolver-rules";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsRoute53ResolverRules(this, "example", {
+      ownerId: "Route 53 Resolver",
+      ruleType: "RECURSIVE",
+      shareStatus: "NOT_SHARED",
+    });
+  }
+}
+
+```
+
+### Retrieving forward rules shared with me
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsRoute53ResolverRules } from "./.gen/providers/aws/data-aws-route53-resolver-rules";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsRoute53ResolverRules(this, "example", {
+      ruleType: "FORWARD",
+      shareStatus: "SHARED_WITH_ME",
+    });
+  }
+}
+
+```
+
+### Retrieving rules by name regex
+
+Resolver rules whose name contains `abc`.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsRoute53ResolverRules } from "./.gen/providers/aws/data-aws-route53-resolver-rules";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsRoute53ResolverRules(this, "example", {
+      nameRegex: ".*abc.*",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The arguments of this data source act as filters for querying the available resolver rules in the current region.
+
+* `nameRegex` - (Optional) Regex string to filter resolver rule names.
+  The filtering is done locally, so could have a performance impact if the result is large.
+  This argument should be used along with other arguments to limit the number of results returned.
+* `ownerId` (Optional) When the desired resolver rules are shared with another AWS account, the account ID of the account that the rules are shared with.
+* `resolverEndpointId` (Optional) ID of the outbound resolver endpoint for the desired resolver rules.
+* `ruleType` (Optional) Rule type of the desired resolver rules. Valid values are `forward`, `system` and `recursive`.
+* `shareStatus` (Optional) Whether the desired resolver rules are shared and, if so, whether the current account is sharing the rules with another account, or another account is sharing the rules with the current account. Valid values are `notShared`, `sharedByMe` or `sharedWithMe`
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - AWS Region.
+* `resolverRuleIds` - IDs of the matched resolver rules.
+
+<!-- cache-key: cdktf-0.18.0 input-9b0c7f44fbc4c3e685d8f6ce94f95d724eb10dbce507d5f4308b0a1bf1da3367 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/route53_traffic_policy_document.html.markdown b/website/docs/cdktf/typescript/d/route53_traffic_policy_document.html.markdown
new file mode 100644
index 00000000000..3f7e5e94c28
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/route53_traffic_policy_document.html.markdown
@@ -0,0 +1,251 @@
+---
+subcategory: "Route 53"
+layout: "aws"
+page_title: "AWS: aws_route53_traffic_policy_document"
+description: |-
+    Generates an Route53 traffic policy document in JSON format
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_route53_traffic_policy_document
+
+Generates an Route53 traffic policy document in JSON format for use with resources that expect policy documents such as [`awsRoute53TrafficPolicy`](/docs/providers/aws/r/route53_traffic_policy.html).
+
+## Example Usage
+
+### Basic Example
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsRegion } from "./.gen/providers/aws/data-aws-region";
+import { DataAwsRoute53TrafficPolicyDocument } from "./.gen/providers/aws/data-aws-route53-traffic-policy-document";
+import { Route53TrafficPolicy } from "./.gen/providers/aws/route53-traffic-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const current = new DataAwsRegion(this, "current", {});
+    const example = new DataAwsRoute53TrafficPolicyDocument(this, "example", {
+      endpoint: [
+        {
+          id: "my_elb",
+          type: "elastic-load-balancer",
+          value: "elb-111111.${" + current.name + "}.elb.amazonaws.com",
+        },
+        {
+          id: "site_down_banner",
+          region: Token.asString(current.name),
+          type: "s3-website",
+          value: "www.example.com",
+        },
+      ],
+      recordType: "A",
+      rule: [
+        {
+          id: "site_switch",
+          primary: {
+            endpointReference: "my_elb",
+          },
+          secondary: {
+            endpointReference: "site_down_banner",
+          },
+          type: "failover",
+        },
+      ],
+      startRule: "site_switch",
+    });
+    const awsRoute53TrafficPolicyExample = new Route53TrafficPolicy(
+      this,
+      "example_2",
+      {
+        comment: "example comment",
+        document: Token.asString(example.json),
+        name: "example",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsRoute53TrafficPolicyExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### Complex Example
+
+The following example showcases the use of nested rules within the traffic policy document and introduces the `geoproximity` rule type.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsRoute53TrafficPolicyDocument } from "./.gen/providers/aws/data-aws-route53-traffic-policy-document";
+import { Route53TrafficPolicy } from "./.gen/providers/aws/route53-traffic-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new DataAwsRoute53TrafficPolicyDocument(this, "example", {
+      endpoint: [
+        {
+          id: "na_endpoint_a",
+          type: "elastic-load-balancer",
+          value: "elb-111111.us-west-1.elb.amazonaws.com",
+        },
+        {
+          id: "na_endpoint_b",
+          type: "elastic-load-balancer",
+          value: "elb-222222.us-west-1.elb.amazonaws.com",
+        },
+        {
+          id: "eu_endpoint",
+          type: "elastic-load-balancer",
+          value: "elb-333333.eu-west-1.elb.amazonaws.com",
+        },
+        {
+          id: "ap_endpoint",
+          type: "elastic-load-balancer",
+          value: "elb-444444.ap-northeast-2.elb.amazonaws.com",
+        },
+      ],
+      recordType: "A",
+      rule: [
+        {
+          id: "na_rule",
+          primary: {
+            endpointReference: "na_endpoint_a",
+          },
+          secondary: {
+            endpointReference: "na_endpoint_b",
+          },
+          type: "failover",
+        },
+        {
+          geoProximityLocation: [
+            {
+              bias: Token.asString(10),
+              evaluateTargetHealth: true,
+              region: "aws:route53:us-west-1",
+              ruleReference: "na_rule",
+            },
+            {
+              bias: Token.asString(10),
+              endpointReference: "eu_endpoint",
+              evaluateTargetHealth: true,
+              region: "aws:route53:eu-west-1",
+            },
+            {
+              bias: Token.asString(0),
+              endpointReference: "ap_endpoint",
+              evaluateTargetHealth: true,
+              region: "aws:route53:ap-northeast-2",
+            },
+          ],
+          id: "geoproximity_rule",
+          type: "geoproximity",
+        },
+      ],
+      startRule: "geoproximity_rule",
+    });
+    const awsRoute53TrafficPolicyExample = new Route53TrafficPolicy(
+      this,
+      "example_1",
+      {
+        comment: "example comment",
+        document: Token.asString(example.json),
+        name: "example",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsRoute53TrafficPolicyExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are optional:
+
+* `endpoint` (Optional) - Configuration block for the definitions of the endpoints that you want to use in this traffic policy. See below
+* `recordType` (Optional) - DNS type of all of the resource record sets that Amazon Route 53 will create based on this traffic policy.
+* `rule` (Optional) - Configuration block for definitions of the rules that you want to use in this traffic policy. See below
+* `startEndpoint` (Optional) - An endpoint to be as the starting point for the traffic policy.
+* `startRule` (Optional) - A rule to be as the starting point for the traffic policy.
+* `version` (Optional) - Version of the traffic policy format.
+
+### `endpoint`
+
+* `id` - (Required) ID of an endpoint you want to assign.
+* `type` - (Optional) Type of the endpoint. Valid values are `value` , `cloudfront` , `elasticLoadBalancer`, `s3Website`
+* `region` - (Optional) To route traffic to an Amazon S3 bucket that is configured as a website endpoint, specify the region in which you created the bucket for `region`.
+* `value` - (Optional) Value of the `type`.
+
+### `rule`
+
+* `id` - (Required) ID of a rule you want to assign.
+* `type` - (Optional) Type of the rule.
+* `primary` - (Optional) Configuration block for the settings for the rule or endpoint that you want to route traffic to whenever the corresponding resources are available. Only valid for `failover` type. See below
+* `secondary` - (Optional) Configuration block for the rule or endpoint that you want to route traffic to whenever the primary resources are not available. Only valid for `failover` type. See below
+* `location` - (Optional) Configuration block for when you add a geolocation rule, you configure your traffic policy to route your traffic based on the geographic location of your users.  Only valid for `geo` type. See below
+* `geoProximityLocation` - (Optional) Configuration block for when you add a geoproximity rule, you configure Amazon Route 53 to route traffic to your resources based on the geographic location of your resources. Only valid for `geoproximity` type. See below
+* `regions` - (Optional) Configuration block for when you add a latency rule, you configure your traffic policy to route your traffic based on the latency (the time delay) between your users and the AWS regions where you've created AWS resources such as ELB load balancers and Amazon S3 buckets. Only valid for `latency` type. See below
+* `items` - (Optional) Configuration block for when you add a multivalue answer rule, you configure your traffic policy to route traffic approximately randomly to your healthy resources.  Only valid for `multivalue` type. See below
+
+### `primary` and `secondary`
+
+* `endpointReference` - (Optional) References to an endpoint.
+* `evaluateTargetHealth` - (Optional) Indicates whether you want Amazon Route 53 to evaluate the health of the endpoint and route traffic only to healthy endpoints.
+* `healthCheck` - (Optional) If you want to associate a health check with the endpoint or rule.
+* `ruleReference` - (Optional) References to a rule.
+
+### `location`
+
+* `continent` - (Optional) Value of a continent.
+* `country` - (Optional) Value of a country.
+* `endpointReference` - (Optional) References to an endpoint.
+* `evaluateTargetHealth` - (Optional) Indicates whether you want Amazon Route 53 to evaluate the health of the endpoint and route traffic only to healthy endpoints.
+* `healthCheck` - (Optional) If you want to associate a health check with the endpoint or rule.
+* `isDefault` - (Optional) Indicates whether this set of values represents the default location.
+* `ruleReference` - (Optional) References to a rule.
+* `subdivision` - (Optional) Value of a subdivision.
+
+### `geoProximityLocation`
+
+* `bias` - (Optional) Specify a value for `bias` if you want to route more traffic to an endpoint from nearby endpoints (positive values) or route less traffic to an endpoint (negative values).
+* `endpointReference` - (Optional) References to an endpoint.
+* `evaluateTargetHealth` - (Optional) Indicates whether you want Amazon Route 53 to evaluate the health of the endpoint and route traffic only to healthy endpoints.
+* `healthCheck` - (Optional) If you want to associate a health check with the endpoint or rule.
+* `latitude` - (Optional) Represents the location south (negative) or north (positive) of the equator. Valid values are -90 degrees to 90 degrees.
+* `longitude` - (Optional) Represents the location west (negative) or east (positive) of the prime meridian. Valid values are -180 degrees to 180 degrees.
+* `region` - (Optional) If your endpoint is an AWS resource, specify the AWS Region that you created the resource in.
+* `ruleReference` - (Optional) References to a rule.
+
+### `region`
+
+* `endpointReference` - (Optional) References to an endpoint.
+* `evaluateTargetHealth` - (Optional) Indicates whether you want Amazon Route 53 to evaluate the health of the endpoint and route traffic only to healthy endpoints.
+* `healthCheck` - (Optional) If you want to associate a health check with the endpoint or rule.
+* `region` - (Optional) Region code for the AWS Region that you created the resource in.
+* `ruleReference` - (Optional) References to a rule.
+
+### `item`
+
+* `endpointReference` - (Optional) References to an endpoint.
+* `healthCheck` - (Optional) If you want to associate a health check with the endpoint or rule.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `json` - Standard JSON policy document rendered based on the arguments above.
+
+<!-- cache-key: cdktf-0.18.0 input-9fc530bb661507b956e360642cff24bbe3a5634eccad12a1acf054528f189fc9 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/route53_zone.html.markdown b/website/docs/cdktf/typescript/d/route53_zone.html.markdown
new file mode 100644
index 00000000000..01e712b3283
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/route53_zone.html.markdown
@@ -0,0 +1,81 @@
+---
+subcategory: "Route 53"
+layout: "aws"
+page_title: "AWS: aws_route53_zone"
+description: |-
+    Provides details about a specific Route 53 Hosted Zone
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_route53_zone
+
+`awsRoute53Zone` provides details about a specific Route 53 Hosted Zone.
+
+This data source allows to find a Hosted Zone ID given Hosted Zone name and certain search criteria.
+
+## Example Usage
+
+The following example shows how to get a Hosted Zone from its name and from this data how to create a Record Set.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsRoute53Zone } from "./.gen/providers/aws/data-aws-route53-zone";
+import { Route53Record } from "./.gen/providers/aws/route53-record";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const selected = new DataAwsRoute53Zone(this, "selected", {
+      name: "test.com.",
+      privateZone: true,
+    });
+    new Route53Record(this, "www", {
+      name: "www.${" + selected.name + "}",
+      records: ["10.0.0.1"],
+      ttl: Token.asNumber("300"),
+      type: "A",
+      zoneId: Token.asString(selected.zoneId),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The arguments of this data source act as filters for querying the available
+Hosted Zone. You have to use `zoneId` or `name`, not both of them. The given filter must match exactly one
+Hosted Zone. If you use `name` field for private Hosted Zone, you need to add `privateZone` field to `true`
+
+* `zoneId` - (Optional) Hosted Zone id of the desired Hosted Zone.
+
+* `name` - (Optional) Hosted Zone name of the desired Hosted Zone.
+* `privateZone` - (Optional) Used with `name` field to get a private Hosted Zone.
+* `vpcId` - (Optional) Used with `name` field to get a private Hosted Zone associated with the vpc_id (in this case, private_zone is not mandatory).
+* `tags` - (Optional) Used with `name` field. A map of tags, each pair of which must exactly match a pair on the desired Hosted Zone.
+
+## Attribute Reference
+
+All of the argument attributes are also exported as
+result attributes. This data source will complete the data by populating
+any fields that are not included in the configuration with the data for
+the selected Hosted Zone.
+
+The following attribute is additionally exported:
+
+* `arn` - ARN of the Hosted Zone.
+* `callerReference` - Caller Reference of the Hosted Zone.
+* `comment` - Comment field of the Hosted Zone.
+* `nameServers` - List of DNS name servers for the Hosted Zone.
+* `primaryNameServer` - The Route 53 name server that created the SOA record.
+* `resourceRecordSetCount` - The number of Record Set in the Hosted Zone.
+* `linkedServicePrincipal` - The service that created the Hosted Zone (e.g., `servicediscoveryAmazonawsCom`).
+* `linkedServiceDescription` - The description provided by the service that created the Hosted Zone (e.g., `arn:aws:servicediscovery:usEast1:1234567890:namespace/nsXxxxxxxxxxxxxxxx`).
+
+<!-- cache-key: cdktf-0.18.0 input-1a22cb50fe32eb087fe481e2a504db0755c6d63fe989e4c8e5bb2e37f803debb -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/route_table.html.markdown b/website/docs/cdktf/typescript/d/route_table.html.markdown
new file mode 100644
index 00000000000..8a543e2b7f2
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/route_table.html.markdown
@@ -0,0 +1,121 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_route_table"
+description: |-
+    Provides details about a specific Route Table
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_route_table
+
+`awsRouteTable` provides details about a specific Route Table.
+
+This resource can prove useful when a module accepts a Subnet ID as an input variable and needs to, for example, add a route in the Route Table.
+
+## Example Usage
+
+The following example shows how one might accept a Route Table ID as a variable and use this data source to obtain the data necessary to create a route.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformVariable, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsRouteTable } from "./.gen/providers/aws/data-aws-route-table";
+import { Route } from "./.gen/providers/aws/route";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    /*Terraform Variables are not always the best fit for getting inputs in the context of Terraform CDK.
+    You can read more about this at https://cdk.tf/variables*/
+    const subnetId = new TerraformVariable(this, "subnet_id", {});
+    const selected = new DataAwsRouteTable(this, "selected", {
+      subnetId: subnetId.stringValue,
+    });
+    new Route(this, "route", {
+      destinationCidrBlock: "10.0.1.0/22",
+      routeTableId: Token.asString(selected.id),
+      vpcPeeringConnectionId: "pcx-45ff3dc1",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The arguments of this data source act as filters for querying the available Route Table in the current region. The given filters must match exactly one Route Table whose data will be exported as attributes.
+
+The following arguments are optional:
+
+* `filter` - (Optional) Configuration block. Detailed below.
+* `gatewayId` - (Optional) ID of an Internet Gateway or Virtual Private Gateway which is connected to the Route Table (not exported if not passed as a parameter).
+* `routeTableId` - (Optional) ID of the specific Route Table to retrieve.
+* `subnetId` - (Optional) ID of a Subnet which is connected to the Route Table (not exported if not passed as a parameter).
+* `tags` - (Optional) Map of tags, each pair of which must exactly match a pair on the desired Route Table.
+* `vpcId` - (Optional) ID of the VPC that the desired Route Table belongs to.
+
+### filter
+
+Complex filters can be expressed using one or more `filter` blocks.
+
+The following arguments are required:
+
+* `name` - (Required) Name of the field to filter by, as defined by [the underlying AWS API](http://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeRouteTables.html).
+* `values` - (Required) Set of values that are accepted for the given field. A Route Table will be selected if any one of the given values matches.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the route table.
+* `associations` - List of associations with attributes detailed below.
+* `ownerId` - ID of the AWS account that owns the route table.
+* `routes` - List of routes with attributes detailed below.
+
+### routes
+
+When relevant, routes are also exported with the following attributes:
+
+For destinations:
+
+* `cidrBlock` - CIDR block of the route.
+* `destinationPrefixListId` - The ID of a [managed prefix list](ec2_managed_prefix_list.html) destination of the route.
+* `ipv6CidrBlock` - IPv6 CIDR block of the route.
+
+For targets:
+
+* `carrierGatewayId` - ID of the Carrier Gateway.
+* `coreNetworkArn` - ARN of the core network.
+* `egressOnlyGatewayId` - ID of the Egress Only Internet Gateway.
+* `gatewayId` - Internet Gateway ID.
+* `instanceId` - EC2 instance ID.
+* `localGatewayId` - Local Gateway ID.
+* `natGatewayId` - NAT Gateway ID.
+* `networkInterfaceId` - ID of the elastic network interface (eni) to use.
+* `transitGatewayId` - EC2 Transit Gateway ID.
+* `vpcEndpointId` - VPC Endpoint ID.
+* `vpcPeeringConnectionId` - VPC Peering ID.
+
+### associations
+
+Associations are also exported with the following attributes:
+
+* `gatewayId` - Gateway ID. Only set when associated with an Internet Gateway or Virtual Private Gateway.
+* `main` - Whether the association is due to the main route table.
+* `routeTableAssociationId` - Association ID.
+* `routeTableId` - Route Table ID.
+* `subnetId` - Subnet ID. Only set when associated with a subnet.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `20M`)
+
+<!-- cache-key: cdktf-0.18.0 input-e02f8a1af89557e3d4f7912192d3d91ac681003bf0f578fd465030e054563a1e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/route_tables.html.markdown b/website/docs/cdktf/typescript/d/route_tables.html.markdown
new file mode 100644
index 00000000000..0a03e095fe5
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/route_tables.html.markdown
@@ -0,0 +1,92 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_route_tables"
+description: |-
+    Get information on Amazon route tables.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_route_tables
+
+This resource can be useful for getting back a list of route table ids to be referenced elsewhere.
+
+## Example Usage
+
+The following adds a route for a particular cidr block to every (private
+kops) route table in a specified vpc to use a particular vpc peering
+connection.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformCount, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsRouteTables } from "./.gen/providers/aws/data-aws-route-tables";
+import { Route } from "./.gen/providers/aws/route";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const rts = new DataAwsRouteTables(this, "rts", {
+      filter: [
+        {
+          name: "tag:kubernetes.io/kops/role",
+          values: ["private*"],
+        },
+      ],
+      vpcId: vpcId.stringValue,
+    });
+    /*In most cases loops should be handled in the programming language context and 
+    not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+    you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+    you need to keep this like it is.*/
+    const rCount = TerraformCount.of(Token.asNumber(Fn.lengthOf(rts.ids)));
+    new Route(this, "r", {
+      destinationCidrBlock: "10.0.0.0/22",
+      routeTableId: Token.asString(
+        Fn.lookupNested(Fn.tolist(rts.ids), [rCount.index])
+      ),
+      vpcPeeringConnectionId: "pcx-0e9a7a9ecd137dc54",
+      count: rCount,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `filter` - (Optional) Custom filter block as described below.
+
+* `vpcId` - (Optional) VPC ID that you want to filter from.
+
+* `tags` - (Optional) Map of tags, each pair of which must exactly match
+  a pair on the desired route tables.
+
+More complex filters can be expressed using one or more `filter` sub-blocks,
+which take the following arguments:
+
+* `name` - (Required) Name of the field to filter by, as defined by
+  [the underlying AWS API](http://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeRouteTables.html).
+
+* `values` - (Required) Set of values that are accepted for the given field.
+  A Route Table will be selected if any one of the given values matches.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - AWS Region.
+* `ids` - List of all the route table ids found.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `20M`)
+
+<!-- cache-key: cdktf-0.18.0 input-07bd888bd13dbd8777e5631c5b36ff641fbc5fd5fb51f5784ae46abc60f9a930 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/s3_account_public_access_block.html.markdown b/website/docs/cdktf/typescript/d/s3_account_public_access_block.html.markdown
new file mode 100644
index 00000000000..8dc6192c17d
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/s3_account_public_access_block.html.markdown
@@ -0,0 +1,51 @@
+---
+subcategory: "S3 Control"
+layout: "aws"
+page_title: "AWS: aws_s3_account_public_access_block"
+description: |-
+  Provides S3 account-level Public Access Block Configuration
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_s3_account_public_access_block
+
+The S3 account public access block data source returns account-level public access block configuration.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsS3AccountPublicAccessBlock } from "./.gen/providers/aws/data-aws-s3-account-public-access-block";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsS3AccountPublicAccessBlock(this, "example", {});
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `accountId` - (Optional) AWS account ID to configure. Defaults to automatically determined account ID of the Terraform AWS provider.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - AWS account ID
+* `blockPublicAcls` - Whether or not Amazon S3 should block public ACLs for buckets in this account is enabled. Returns as `true` or `false`.
+* `blockPublicPolicy` - Whether or not Amazon S3 should block public bucket policies for buckets in this account is enabled. Returns as `true` or `false`.
+* `ignorePublicAcls` - Whether or not Amazon S3 should ignore public ACLs for buckets in this account is enabled. Returns as `true` or `false`.
+* `restrictPublicBuckets` - Whether or not Amazon S3 should restrict public bucket policies for buckets in this account is enabled. Returns as `true` or `false`.
+
+<!-- cache-key: cdktf-0.18.0 input-c2e3f715fb56a3d3a79dd560c1d0d3c1f47a5c75c1840b0edbba7bc953a6dbc3 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/s3_bucket.html.markdown b/website/docs/cdktf/typescript/d/s3_bucket.html.markdown
new file mode 100644
index 00000000000..71d23ddb6cd
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/s3_bucket.html.markdown
@@ -0,0 +1,120 @@
+---
+subcategory: "S3 (Simple Storage)"
+layout: "aws"
+page_title: "AWS: aws_s3_bucket"
+description: |-
+    Provides details about a specific S3 bucket
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_s3_bucket
+
+Provides details about a specific S3 bucket.
+
+This resource may prove useful when setting up a Route53 record, or an origin for a CloudFront
+Distribution.
+
+## Example Usage
+
+### Route53 Record
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsRoute53Zone } from "./.gen/providers/aws/data-aws-route53-zone";
+import { DataAwsS3Bucket } from "./.gen/providers/aws/data-aws-s3-bucket";
+import { Route53Record } from "./.gen/providers/aws/route53-record";
+interface MyConfig {
+  evaluateTargetHealth: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    const testZone = new DataAwsRoute53Zone(this, "test_zone", {
+      name: "test.com.",
+    });
+    const selected = new DataAwsS3Bucket(this, "selected", {
+      bucket: "bucket.test.com",
+    });
+    new Route53Record(this, "example", {
+      alias: {
+        name: Token.asString(selected.websiteDomain),
+        zoneId: Token.asString(selected.hostedZoneId),
+        evaluateTargetHealth: config.evaluateTargetHealth,
+      },
+      name: "bucket",
+      type: "A",
+      zoneId: Token.asString(testZone.id),
+    });
+  }
+}
+
+```
+
+### CloudFront Origin
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudfrontDistribution } from "./.gen/providers/aws/cloudfront-distribution";
+import { DataAwsS3Bucket } from "./.gen/providers/aws/data-aws-s3-bucket";
+interface MyConfig {
+  defaultCacheBehavior: any;
+  enabled: any;
+  restrictions: any;
+  viewerCertificate: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    const selected = new DataAwsS3Bucket(this, "selected", {
+      bucket: "a-test-bucket",
+    });
+    new CloudfrontDistribution(this, "test", {
+      origin: [
+        {
+          domainName: Token.asString(selected.bucketDomainName),
+          originId: "s3-selected-bucket",
+        },
+      ],
+      defaultCacheBehavior: config.defaultCacheBehavior,
+      enabled: config.enabled,
+      restrictions: config.restrictions,
+      viewerCertificate: config.viewerCertificate,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `bucket` - (Required) Name of the bucket
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - Name of the bucket.
+* `arn` - ARN of the bucket. Will be of format `arn:aws:s3:::bucketname`.
+* `bucketDomainName` - Bucket domain name. Will be of format `bucketnameS3AmazonawsCom`.
+* `bucketRegionalDomainName` - The bucket region-specific domain name. The bucket domain name including the region name. Please refer to the [S3 endpoints reference](https://docs.aws.amazon.com/general/latest/gr/s3.html#s3_region) for format. Note: AWS CloudFront allows specifying an S3 region-specific endpoint when creating an S3 origin. This will prevent redirect issues from CloudFront to the S3 Origin URL. For more information, see the [Virtual Hosted-Style Requests for Other Regions](https://docs.aws.amazon.com/AmazonS3/latest/userguide/VirtualHosting.html#deprecated-global-endpoint) section in the AWS S3 User Guide.
+* `hostedZoneId` - The [Route 53 Hosted Zone ID](https://docs.aws.amazon.com/general/latest/gr/rande.html#s3_website_region_endpoints) for this bucket's region.
+* `region` - AWS region this bucket resides in.
+* `websiteEndpoint` - Website endpoint, if the bucket is configured with a website. If not, this will be an empty string.
+* `websiteDomain` - Domain of the website endpoint, if the bucket is configured with a website. If not, this will be an empty string. This is used to create Route 53 alias records.
+
+<!-- cache-key: cdktf-0.18.0 input-1b3882cef2e383d7b94a441272b1a5c90afe56f7bd4eade88c86484fd024b52a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/s3_bucket_object.html.markdown b/website/docs/cdktf/typescript/d/s3_bucket_object.html.markdown
new file mode 100644
index 00000000000..3ef3abc9dc3
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/s3_bucket_object.html.markdown
@@ -0,0 +1,129 @@
+---
+subcategory: "S3 (Simple Storage)"
+layout: "aws"
+page_title: "AWS: aws_s3_bucket_object"
+description: |-
+    Provides metadata and optionally content of an S3 object
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_s3_bucket_object
+
+~> **NOTE:** The `awsS3BucketObject` data source is DEPRECATED and will be removed in a future version! Use `awsS3Object` instead, where new features and fixes will be added.
+
+The S3 object data source allows access to the metadata and
+_optionally_ (see below) content of an object stored inside S3 bucket.
+
+~> **Note:** The content of an object (`body` field) is available only for objects which have a human-readable `contentType` (`text/*` and `application/json`). This is to prevent printing unsafe characters and potentially downloading large amount of data which would be thrown away in favour of metadata.
+
+## Example Usage
+
+The following example retrieves a text object (which must have a `contentType`
+value starting with `text/`) and uses it as the `userData` for an EC2 instance:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsS3BucketObject } from "./.gen/providers/aws/data-aws-s3-bucket-object";
+import { Instance } from "./.gen/providers/aws/instance";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const bootstrapScript = new DataAwsS3BucketObject(
+      this,
+      "bootstrap_script",
+      {
+        bucket: "ourcorp-deploy-config",
+        key: "ec2-bootstrap-script.sh",
+      }
+    );
+    new Instance(this, "example", {
+      ami: "ami-2757f631",
+      instanceType: "t2.micro",
+      userData: Token.asString(bootstrapScript.body),
+    });
+  }
+}
+
+```
+
+The following, more-complex example retrieves only the metadata for a zip
+file stored in S3, which is then used to pass the most recent `versionId`
+to AWS Lambda for use as a function implementation. More information about
+Lambda functions is available in the documentation for
+[`awsLambdaFunction`](/docs/providers/aws/r/lambda_function.html).
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsS3BucketObject } from "./.gen/providers/aws/data-aws-s3-bucket-object";
+import { LambdaFunction } from "./.gen/providers/aws/lambda-function";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const lambda = new DataAwsS3BucketObject(this, "lambda", {
+      bucket: "ourcorp-lambda-functions",
+      key: "hello-world.zip",
+    });
+    new LambdaFunction(this, "test_lambda", {
+      functionName: "lambda_function_name",
+      handler: "exports.test",
+      role: iamForLambda.arn,
+      s3Bucket: Token.asString(lambda.id),
+      s3Key: Token.asString(lambda.key),
+      s3ObjectVersion: Token.asString(lambda.versionId),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `bucket` - (Required) Name of the bucket to read the object from. Alternatively, an [S3 access point](https://docs.aws.amazon.com/AmazonS3/latest/dev/using-access-points.html) ARN can be specified
+* `key` - (Required) Full path to the object inside the bucket
+* `versionId` - (Optional) Specific version ID of the object returned (defaults to latest version)
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `body` - Object data (see **limitations above** to understand cases in which this field is actually available)
+* `bucketKeyEnabled` - (Optional) Whether or not to use [Amazon S3 Bucket Keys](https://docs.aws.amazon.com/AmazonS3/latest/dev/bucket-key.html) for SSE-KMS.
+* `cacheControl` - Caching behavior along the request/reply chain.
+* `contentDisposition` - Presentational information for the object.
+* `contentEncoding` - What content encodings have been applied to the object and thus what decoding mechanisms must be applied to obtain the media-type referenced by the Content-Type header field.
+* `contentLanguage` - Language the content is in.
+* `contentLength` - Size of the body in bytes.
+* `contentType` - Standard MIME type describing the format of the object data.
+* `etag` - [ETag](https://en.wikipedia.org/wiki/HTTP_ETag) generated for the object (an MD5 sum of the object content in case it's not encrypted)
+* `expiration` - If the object expiration is configured (see [object lifecycle management](http://docs.aws.amazon.com/AmazonS3/latest/dev/object-lifecycle-mgmt.html)), the field includes this header. It includes the expiry-date and rule-id key value pairs providing object expiration information. The value of the rule-id is URL encoded.
+* `expires` - Date and time at which the object is no longer cacheable.
+* `lastModified` - Last modified date of the object in RFC1123 format (e.g., `Mon, 02 Jan 2006 15:04:05 MST`)
+* `metadata` - Map of metadata stored with the object in S3. [Keys](https://developer.hashicorp.com/terraform/language/expressions/types#maps-objects) are always returned in lowercase.
+* `objectLockLegalHoldStatus` - Indicates whether this object has an active [legal hold](https://docs.aws.amazon.com/AmazonS3/latest/dev/object-lock-overview.html#object-lock-legal-holds). This field is only returned if you have permission to view an object's legal hold status.
+* `objectLockMode` - Object lock [retention mode](https://docs.aws.amazon.com/AmazonS3/latest/dev/object-lock-overview.html#object-lock-retention-modes) currently in place for this object.
+* `objectLockRetainUntilDate` - The date and time when this object's object lock will expire.
+* `serverSideEncryption` - If the object is stored using server-side encryption (KMS or Amazon S3-managed encryption key), this field includes the chosen encryption and algorithm used.
+* `sseKmsKeyId` - If present, specifies the ID of the Key Management Service (KMS) master encryption key that was used for the object.
+* `storageClass` - [Storage class](http://docs.aws.amazon.com/AmazonS3/latest/dev/storage-class-intro.html) information of the object. Available for all objects except for `standard` storage class objects.
+* `versionId` - Latest version ID of the object returned.
+* `websiteRedirectLocation` - If the bucket is configured as a website, redirects requests for this object to another object in the same bucket or to an external URL. Amazon S3 stores the value of this header in the object metadata.
+* `tags`  - Map of tags assigned to the object.
+
+-> **Note:** Terraform ignores all leading `/`s in the object's `key` and treats multiple `/`s in the rest of the object's `key` as a single `/`, so values of `/indexHtml` and `indexHtml` correspond to the same S3 object as do `first//second///third//` and `first/second/third/`.
+
+<!-- cache-key: cdktf-0.18.0 input-eeace90dfa8946b66ba3858986cd60a6630259121cbd2b07283b6d57a5c252cb -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/s3_bucket_objects.html.markdown b/website/docs/cdktf/typescript/d/s3_bucket_objects.html.markdown
new file mode 100644
index 00000000000..047e55f87d7
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/s3_bucket_objects.html.markdown
@@ -0,0 +1,79 @@
+---
+subcategory: "S3 (Simple Storage)"
+layout: "aws"
+page_title: "AWS: aws_s3_bucket_objects"
+description: |-
+    Returns keys and metadata of S3 objects
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_s3_bucket_objects
+
+~> **NOTE:** The `awsS3BucketObjects` data source is DEPRECATED and will be removed in a future version! Use `awsS3Objects` instead, where new features and fixes will be added.
+
+~> **NOTE on `maxKeys`:** Retrieving very large numbers of keys can adversely affect Terraform's performance.
+
+The objects data source returns keys (i.e., file names) and other metadata about objects in an S3 bucket.
+
+## Example Usage
+
+The following example retrieves a list of all object keys in an S3 bucket and creates corresponding Terraform object data sources:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformCount, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsS3BucketObjects } from "./.gen/providers/aws/data-aws-s3-bucket-objects";
+import { DataAwsS3Object } from "./.gen/providers/aws/data-aws-s3-object";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const myObjects = new DataAwsS3BucketObjects(this, "my_objects", {
+      bucket: "ourcorp",
+    });
+    /*In most cases loops should be handled in the programming language context and 
+    not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+    you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+    you need to keep this like it is.*/
+    const objectInfoCount = TerraformCount.of(
+      Token.asNumber(Fn.lengthOf(myObjects.keys))
+    );
+    new DataAwsS3Object(this, "object_info", {
+      bucket: Token.asString(myObjects.id),
+      key: Token.asString(
+        Fn.element(myObjects.keys, Token.asNumber(objectInfoCount.index))
+      ),
+      count: objectInfoCount,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `bucket` - (Required) Lists object keys in this S3 bucket. Alternatively, an [S3 access point](https://docs.aws.amazon.com/AmazonS3/latest/dev/using-access-points.html) ARN can be specified
+* `prefix` - (Optional) Limits results to object keys with this prefix (Default: none)
+* `delimiter` - (Optional) Character used to group keys (Default: none)
+* `encodingType` - (Optional) Encodes keys using this method (Default: none; besides none, only "url" can be used)
+* `maxKeys` - (Optional) Maximum object keys to return (Default: 1000)
+* `startAfter` - (Optional) Returns key names lexicographically after a specific object key in your bucket (Default: none; S3 lists object keys in UTF-8 character encoding in lexicographical order)
+* `fetchOwner` - (Optional) Boolean specifying whether to populate the owner list (Default: false)
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `keys` - List of strings representing object keys
+* `commonPrefixes` - List of any keys between `prefix` and the next occurrence of `delimiter` (i.e., similar to subdirectories of the `prefix` "directory"); the list is only returned when you specify `delimiter`
+* `id` - S3 Bucket.
+* `owners` - List of strings representing object owner IDs (see `fetchOwner` above)
+
+<!-- cache-key: cdktf-0.18.0 input-a76b73c82fad499d443cf61f0e3f0ceae10818b46525e36001df4ca1d2096e1a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/s3_bucket_policy.html.markdown b/website/docs/cdktf/typescript/d/s3_bucket_policy.html.markdown
new file mode 100644
index 00000000000..43c0be8e1c9
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/s3_bucket_policy.html.markdown
@@ -0,0 +1,54 @@
+---
+subcategory: "S3 (Simple Storage)"
+layout: "aws"
+page_title: "AWS: aws_s3_bucket_policy"
+description: |-
+    Provides IAM policy of an S3 bucket
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_s3_bucket_policy
+
+The bucket policy data source returns IAM policy of an S3 bucket.
+
+## Example Usage
+
+The following example retrieves IAM policy of a specified S3 bucket.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformOutput, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsS3BucketPolicy } from "./.gen/providers/aws/data-aws-s3-bucket-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new DataAwsS3BucketPolicy(this, "example", {
+      bucket: "example-bucket-name",
+    });
+    new TerraformOutput(this, "foo", {
+      value: example.policy,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `bucket` - (Required) Bucket name.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `policy` - IAM bucket policy.
+
+<!-- cache-key: cdktf-0.18.0 input-954a8fd4189d48cbd6438ea0a4f4717a1e6f8116e28864fc0a7752ae9c79f598 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/s3_object.html.markdown b/website/docs/cdktf/typescript/d/s3_object.html.markdown
new file mode 100644
index 00000000000..63ad9e7b1ee
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/s3_object.html.markdown
@@ -0,0 +1,128 @@
+---
+subcategory: "S3 (Simple Storage)"
+layout: "aws"
+page_title: "AWS: aws_s3_object"
+description: |-
+    Provides metadata and optionally content of an S3 object
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_s3_object
+
+The S3 object data source allows access to the metadata and
+_optionally_ (see below) content of an object stored inside S3 bucket.
+
+~> **Note:** The content of an object (`body` field) is available only for objects which have a human-readable `contentType` (`text/*` and `application/json`). This is to prevent printing unsafe characters and potentially downloading large amount of data which would be thrown away in favour of metadata.
+
+## Example Usage
+
+The following example retrieves a text object (which must have a `contentType`
+value starting with `text/`) and uses it as the `userData` for an EC2 instance:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsS3Object } from "./.gen/providers/aws/data-aws-s3-object";
+import { Instance } from "./.gen/providers/aws/instance";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const bootstrapScript = new DataAwsS3Object(this, "bootstrap_script", {
+      bucket: "ourcorp-deploy-config",
+      key: "ec2-bootstrap-script.sh",
+    });
+    new Instance(this, "example", {
+      ami: "ami-2757f631",
+      instanceType: "t2.micro",
+      userData: Token.asString(bootstrapScript.body),
+    });
+  }
+}
+
+```
+
+The following, more-complex example retrieves only the metadata for a zip
+file stored in S3, which is then used to pass the most recent `versionId`
+to AWS Lambda for use as a function implementation. More information about
+Lambda functions is available in the documentation for
+[`awsLambdaFunction`](/docs/providers/aws/r/lambda_function.html).
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsS3Object } from "./.gen/providers/aws/data-aws-s3-object";
+import { LambdaFunction } from "./.gen/providers/aws/lambda-function";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const lambda = new DataAwsS3Object(this, "lambda", {
+      bucket: "ourcorp-lambda-functions",
+      key: "hello-world.zip",
+    });
+    new LambdaFunction(this, "test_lambda", {
+      functionName: "lambda_function_name",
+      handler: "exports.test",
+      role: iamForLambda.arn,
+      s3Bucket: Token.asString(lambda.bucket),
+      s3Key: Token.asString(lambda.key),
+      s3ObjectVersion: Token.asString(lambda.versionId),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `bucket` - (Required) Name of the bucket to read the object from. Alternatively, an [S3 access point](https://docs.aws.amazon.com/AmazonS3/latest/dev/using-access-points.html) ARN can be specified
+* `checksumMode` - (Optional) To retrieve the object's checksum, this argument must be `enabled`. If you enable `checksumMode` and the object is encrypted with KMS, you must have permission to use the `kms:decrypt` action. Valid values: `enabled`
+* `key` - (Required) Full path to the object inside the bucket
+* `versionId` - (Optional) Specific version ID of the object returned (defaults to latest version)
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `body` - Object data (see **limitations above** to understand cases in which this field is actually available)
+* `bucketKeyEnabled` - (Optional) Whether or not to use [Amazon S3 Bucket Keys](https://docs.aws.amazon.com/AmazonS3/latest/dev/bucket-key.html) for SSE-KMS.
+* `cacheControl` - Caching behavior along the request/reply chain.
+* `checksumCrc32` - The base64-encoded, 32-bit CRC32 checksum of the object.
+* `checksumCrc32C` - The base64-encoded, 32-bit CRC32C checksum of the object.
+* `checksumSha1` - The base64-encoded, 160-bit SHA-1 digest of the object.
+* `checksumSha256` - The base64-encoded, 256-bit SHA-256 digest of the object.
+* `contentDisposition` - Presentational information for the object.
+* `contentEncoding` - What content encodings have been applied to the object and thus what decoding mechanisms must be applied to obtain the media-type referenced by the Content-Type header field.
+* `contentLanguage` - Language the content is in.
+* `contentLength` - Size of the body in bytes.
+* `contentType` - Standard MIME type describing the format of the object data.
+* `etag` - [ETag](https://en.wikipedia.org/wiki/HTTP_ETag) generated for the object (an MD5 sum of the object content in case it's not encrypted)
+* `expiration` - If the object expiration is configured (see [object lifecycle management](http://docs.aws.amazon.com/AmazonS3/latest/dev/object-lifecycle-mgmt.html)), the field includes this header. It includes the expiry-date and rule-id key value pairs providing object expiration information. The value of the rule-id is URL encoded.
+* `expires` - Date and time at which the object is no longer cacheable.
+* `lastModified` - Last modified date of the object in RFC1123 format (e.g., `Mon, 02 Jan 2006 15:04:05 MST`)
+* `metadata` - Map of metadata stored with the object in S3. [Keys](https://developer.hashicorp.com/terraform/language/expressions/types#maps-objects) are always returned in lowercase.
+* `objectLockLegalHoldStatus` - Indicates whether this object has an active [legal hold](https://docs.aws.amazon.com/AmazonS3/latest/dev/object-lock-overview.html#object-lock-legal-holds). This field is only returned if you have permission to view an object's legal hold status.
+* `objectLockMode` - Object lock [retention mode](https://docs.aws.amazon.com/AmazonS3/latest/dev/object-lock-overview.html#object-lock-retention-modes) currently in place for this object.
+* `objectLockRetainUntilDate` - The date and time when this object's object lock will expire.
+* `serverSideEncryption` - If the object is stored using server-side encryption (KMS or Amazon S3-managed encryption key), this field includes the chosen encryption and algorithm used.
+* `sseKmsKeyId` - If present, specifies the ID of the Key Management Service (KMS) master encryption key that was used for the object.
+* `storageClass` - [Storage class](http://docs.aws.amazon.com/AmazonS3/latest/dev/storage-class-intro.html) information of the object. Available for all objects except for `standard` storage class objects.
+* `versionId` - Latest version ID of the object returned.
+* `websiteRedirectLocation` - If the bucket is configured as a website, redirects requests for this object to another object in the same bucket or to an external URL. Amazon S3 stores the value of this header in the object metadata.
+* `tags`  - Map of tags assigned to the object.
+
+-> **Note:** Terraform ignores all leading `/`s in the object's `key` and treats multiple `/`s in the rest of the object's `key` as a single `/`, so values of `/indexHtml` and `indexHtml` correspond to the same S3 object as do `first//second///third//` and `first/second/third/`.
+
+<!-- cache-key: cdktf-0.18.0 input-222e50e78a98cdd8982d72d096abde0605f9c9d699620754eb3607023a2f5858 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/s3_objects.html.markdown b/website/docs/cdktf/typescript/d/s3_objects.html.markdown
new file mode 100644
index 00000000000..ba08e2a1a83
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/s3_objects.html.markdown
@@ -0,0 +1,79 @@
+---
+subcategory: "S3 (Simple Storage)"
+layout: "aws"
+page_title: "AWS: aws_s3_objects"
+description: |-
+    Returns keys and metadata of S3 objects
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_s3_objects
+
+~> **NOTE on `maxKeys`:** Retrieving very large numbers of keys can adversely affect Terraform's performance.
+
+The objects data source returns keys (i.e., file names) and other metadata about objects in an S3 bucket.
+
+## Example Usage
+
+The following example retrieves a list of all object keys in an S3 bucket and creates corresponding Terraform object data sources:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformCount, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsS3Object } from "./.gen/providers/aws/data-aws-s3-object";
+import { DataAwsS3Objects } from "./.gen/providers/aws/data-aws-s3-objects";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const myObjects = new DataAwsS3Objects(this, "my_objects", {
+      bucket: "ourcorp",
+    });
+    /*In most cases loops should be handled in the programming language context and 
+    not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+    you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+    you need to keep this like it is.*/
+    const objectInfoCount = TerraformCount.of(
+      Token.asNumber(Fn.lengthOf(myObjects.keys))
+    );
+    new DataAwsS3Object(this, "object_info", {
+      bucket: Token.asString(myObjects.id),
+      key: Token.asString(
+        Fn.element(myObjects.keys, Token.asNumber(objectInfoCount.index))
+      ),
+      count: objectInfoCount,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `bucket` - (Required) Lists object keys in this S3 bucket. Alternatively, an [S3 access point](https://docs.aws.amazon.com/AmazonS3/latest/dev/using-access-points.html) ARN can be specified
+* `prefix` - (Optional) Limits results to object keys with this prefix (Default: none)
+* `delimiter` - (Optional) Character used to group keys (Default: none)
+* `encodingType` - (Optional) Encodes keys using this method (Default: none; besides none, only "url" can be used)
+* `maxKeys` - (Optional) Maximum object keys to return (Default: 1000)
+* `startAfter` - (Optional) Returns key names lexicographically after a specific object key in your bucket (Default: none; S3 lists object keys in UTF-8 character encoding in lexicographical order)
+* `fetchOwner` - (Optional) Boolean specifying whether to populate the owner list (Default: false)
+* `requestPayer` - (Optional) Confirms that the requester knows that they will be charged for the request. Bucket owners need not specify this parameter in their requests. If included, the only valid value is `requester`.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `keys` - List of strings representing object keys
+* `commonPrefixes` - List of any keys between `prefix` and the next occurrence of `delimiter` (i.e., similar to subdirectories of the `prefix` "directory"); the list is only returned when you specify `delimiter`
+* `id` - S3 Bucket.
+* `owners` - List of strings representing object owner IDs (see `fetchOwner` above)
+* `requestCharged` - If present, indicates that the requester was successfully charged for the request.
+
+<!-- cache-key: cdktf-0.18.0 input-75319062f102d49785cbd4721ffbb267fc16f39f945cacf91b31e00a17bc10b2 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/s3control_multi_region_access_point.html.markdown b/website/docs/cdktf/typescript/d/s3control_multi_region_access_point.html.markdown
new file mode 100644
index 00000000000..d1f4872959a
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/s3control_multi_region_access_point.html.markdown
@@ -0,0 +1,75 @@
+---
+subcategory: "S3 Control"
+layout: "aws"
+page_title: "AWS: aws_s3control_multi_region_access_point"
+description: |-
+  Provides details an S3 Multi-Region Access Point.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_s3control_multi_region_access_point
+
+Provides details on a specific S3 Multi-Region Access Point.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsS3ControlMultiRegionAccessPoint } from "./.gen/providers/aws/data-aws-s3-control-multi-region-access-point";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsS3ControlMultiRegionAccessPoint(this, "example", {
+      name: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `accountId` - (Optional) The AWS account ID of the S3 Multi-Region Access Point. Defaults to automatically determined account ID of the Terraform AWS provider.
+* `name` - (Required) The name of the Multi-Region Access Point.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `alias` - The alias for the Multi-Region Access Point.
+* `arn` - Amazon Resource Name (ARN) of the Multi-Region Access Point.
+* `createdAt` - Timestamp when the resource has been created.
+* `domainName` - The DNS domain name of the S3 Multi-Region Access Point in the format _`alias`_.accesspoint.s3-global.amazonaws.com. For more information, see the documentation on [Multi-Region Access Point Requests](https://docs.aws.amazon.com/AmazonS3/latest/userguide/MultiRegionAccessPointRequests.html).
+* `publicAccessBlock` - Public Access Block of the Multi-Region Access Point. Detailed below.
+* `regions` - A collection of the regions and buckets associated with the Multi-Region Access Point.
+* `status` - The current status of the Multi-Region Access Point.
+
+### public_access_block
+
+* `blockPublicAcls` - Specifies whether Amazon S3 should block public access control lists (ACLs). When set to `true` causes the following behavior:
+    * PUT Bucket acl and PUT Object acl calls fail if the specified ACL is public.
+    * PUT Object calls fail if the request includes a public ACL.
+    * PUT Bucket calls fail if the request includes a public ACL.
+* `blockPublicPolicy` - Specifies whether Amazon S3 should block public bucket policies for buckets in this account. When set to `true` causes Amazon S3 to:
+    * Reject calls to PUT Bucket policy if the specified bucket policy allows public access.
+* `ignorePublicAcls` - Specifies whether Amazon S3 should ignore public ACLs for buckets in this account. When set to `true` causes Amazon S3 to:
+    * Ignore all public ACLs on buckets in this account and any objects that they contain.
+* `restrictPublicBuckets` - Specifies whether Amazon S3 should restrict public bucket policies for buckets in this account. When set to `true`:
+    * Only the bucket owner and AWS Services can access buckets with public policies.
+
+### regions
+
+* `bucket` - The name of the bucket.
+* `bucketAccountId` - The AWS account ID that owns the bucket.
+* `region` - The name of the region.
+
+<!-- cache-key: cdktf-0.18.0 input-4b2d4507f55425b893c6a7909b5f48feef1f322a3ab4bf8683d78ca9a96619fb -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/sagemaker_prebuilt_ecr_image.html.markdown b/website/docs/cdktf/typescript/d/sagemaker_prebuilt_ecr_image.html.markdown
new file mode 100644
index 00000000000..d007dd80d07
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/sagemaker_prebuilt_ecr_image.html.markdown
@@ -0,0 +1,58 @@
+---
+subcategory: "SageMaker"
+layout: "aws"
+page_title: "AWS: aws_sagemaker_prebuilt_ecr_image"
+description: |-
+  Get information about prebuilt Amazon SageMaker Docker images.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_sagemaker_prebuilt_ecr_image
+
+Get information about prebuilt Amazon SageMaker Docker images.
+
+~> **NOTE:** The AWS provider creates a validly constructed `registryPath` but does not verify that the `registryPath` corresponds to an existing image. For example, using a `registryPath` containing an `imageTag` that does not correspond to a Docker image in the ECR repository, will result in an error.
+
+## Example Usage
+
+Basic usage:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsSagemakerPrebuiltEcrImage } from "./.gen/providers/aws/data-aws-sagemaker-prebuilt-ecr-image";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsSagemakerPrebuiltEcrImage(this, "test", {
+      imageTag: "2.2-1.0.11.0",
+      repositoryName: "sagemaker-scikit-learn",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `repositoryName` - (Required) Name of the repository, which is generally the algorithm or library. Values include `blazingtext`, `factorizationMachines`, `forecastingDeepar`, `imageClassification`, `ipinsights`, `kmeans`, `knn`, `lda`, `linearLearner`, `mxnetInferenceEia`, `mxnetInference`, `mxnetTraining`, `ntm`, `objectDetection`, `object2Vec`, `pca`, `pytorchInferenceEia`, `pytorchInference`, `pytorchTraining`, `randomcutforest`, `sagemakerScikitLearn`, `sagemakerSparkmlServing`, `sagemakerXgboost`, `semanticSegmentation`, `seq2Seq`, `tensorflowInferenceEia`, `tensorflowInference`, `tensorflowTraining`, `huggingfaceTensorflowTraining`, `huggingfaceTensorflowInference`, `huggingfacePytorchTraining`, and `huggingfacePytorchInference`.
+* `dnsSuffix` - (Optional) DNS suffix to use in the registry path. If not specified, the AWS provider sets it to the DNS suffix for the current region.
+* `imageTag` - (Optional) Image tag for the Docker image. If not specified, the AWS provider sets the value to `1`, which for many repositories indicates the latest version. Some repositories, such as XGBoost, do not support `1` or `latest` and specific version must be used.
+* `region` (Optional) - Region to use in the registry path. If not specified, the AWS provider sets it to the current region.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `registryId` - Account ID containing the image. For example, `469771592824`.
+* `registryPath` - Docker image URL. For example, `341280168497DkrEcrCaCentral1AmazonawsCom/sagemakerSparkmlServing:24`.
+
+<!-- cache-key: cdktf-0.18.0 input-9f7430a5070692161cbacbbecaaf444a21d44fae9e8ba95244364cce1a3659ec -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/secretsmanager_random_password.html.markdown b/website/docs/cdktf/typescript/d/secretsmanager_random_password.html.markdown
new file mode 100644
index 00000000000..f0f515512ec
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/secretsmanager_random_password.html.markdown
@@ -0,0 +1,55 @@
+---
+subcategory: "Secrets Manager"
+layout: "aws"
+page_title: "AWS: aws_secretsmanager_random_password"
+description: |-
+  Generate a random password
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_secretsmanager_random_password
+
+Generate a random password.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsSecretsmanagerRandomPassword } from "./.gen/providers/aws/data-aws-secretsmanager-random-password";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsSecretsmanagerRandomPassword(this, "test", {
+      excludeNumbers: true,
+      passwordLength: 50,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `excludeCharacters` - (Optional) String of the characters that you don't want in the password.
+* `excludeLowercase` - (Optional) Specifies whether to exclude lowercase letters from the password.
+* `excludeNumbers` - (Optional) Specifies whether to exclude numbers from the password.
+* `excludePunctuation` - (Optional) Specifies whether to exclude the following punctuation characters from the password: `! " # $ % & ' ( ) * + , - . / : ; < = > ? @ [ \ ] ^ _ ` { | } ~ .`
+* `excludeUppercase` - (Optional) Specifies whether to exclude uppercase letters from the password.
+* `includeSpace` - (Optional) Specifies whether to include the space character.
+* `passwordLength` - (Optional) Length of the password.
+* `requireEachIncludedType` - (Optional) Specifies whether to include at least one upper and lowercase letter, one number, and one punctuation.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `randomPassword` - Random password.
+
+<!-- cache-key: cdktf-0.18.0 input-253220cea464918e719cdeb6fc246c1972e3652b5d753f22810bdf68eb8eaeef -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/secretsmanager_secret.html.markdown b/website/docs/cdktf/typescript/d/secretsmanager_secret.html.markdown
new file mode 100644
index 00000000000..1e76227c6db
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/secretsmanager_secret.html.markdown
@@ -0,0 +1,77 @@
+---
+subcategory: "Secrets Manager"
+layout: "aws"
+page_title: "AWS: aws_secretsmanager_secret"
+description: |-
+  Retrieve metadata information about a Secrets Manager secret
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_secretsmanager_secret
+
+Retrieve metadata information about a Secrets Manager secret. To retrieve a secret value, see the [`awsSecretsmanagerSecretVersion` data source](/docs/providers/aws/d/secretsmanager_secret_version.html).
+
+## Example Usage
+
+### ARN
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsSecretsmanagerSecret } from "./.gen/providers/aws/data-aws-secretsmanager-secret";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsSecretsmanagerSecret(this, "by-arn", {
+      arn: "arn:aws:secretsmanager:us-east-1:123456789012:secret:example-123456",
+    });
+  }
+}
+
+```
+
+### Name
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsSecretsmanagerSecret } from "./.gen/providers/aws/data-aws-secretsmanager-secret";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsSecretsmanagerSecret(this, "by-name", {
+      name: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `arn` - (Optional) ARN of the secret to retrieve.
+* `name` - (Optional) Name of the secret to retrieve.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the secret.
+* `description` - Description of the secret.
+* `kmsKeyId` - Key Management Service (KMS) Customer Master Key (CMK) associated with the secret.
+* `id` - ARN of the secret.
+* `tags` - Tags of the secret.
+* `policy` - Resource-based policy document that's attached to the secret.
+
+<!-- cache-key: cdktf-0.18.0 input-0fca6cfb25caf0f32cdf4fba62b9433e266444e38aa59620febc991b1723f0c4 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/secretsmanager_secret_rotation.html.markdown b/website/docs/cdktf/typescript/d/secretsmanager_secret_rotation.html.markdown
new file mode 100644
index 00000000000..b943d4a98c1
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/secretsmanager_secret_rotation.html.markdown
@@ -0,0 +1,51 @@
+---
+subcategory: "Secrets Manager"
+layout: "aws"
+page_title: "AWS: aws_secretsmanager_secret_rotation"
+description: |-
+  Retrieve information about a Secrets Manager secret rotation configuration
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_secretsmanager_secret_rotation
+
+Retrieve information about a Secrets Manager secret rotation. To retrieve secret metadata, see the [`awsSecretsmanagerSecret` data source](/docs/providers/aws/d/secretsmanager_secret.html). To retrieve a secret value, see the [`awsSecretsmanagerSecretVersion` data source](/docs/providers/aws/d/secretsmanager_secret_version.html).
+
+## Example Usage
+
+### Retrieve Secret Rotation Configuration
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsSecretsmanagerSecretRotation } from "./.gen/providers/aws/data-aws-secretsmanager-secret-rotation";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsSecretsmanagerSecretRotation(this, "example", {
+      secretId: Token.asString(dataAwsSecretsmanagerSecretExample.id),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `secretId` - (Required) Specifies the secret containing the version that you want to retrieve. You can specify either the ARN or the friendly name of the secret.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `rotationEnabled` - ARN of the secret.
+* `rotationLambdaArn` - Decrypted part of the protected secret information that was originally provided as a string.
+* `rotationRules` - Decrypted part of the protected secret information that was originally provided as a binary. Base64 encoded.
+
+<!-- cache-key: cdktf-0.18.0 input-e027aa73fed49f05ed2c35a302ee5eef5a2de9f215c0ad6bb0470048e38bbb27 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/secretsmanager_secret_version.html.markdown b/website/docs/cdktf/typescript/d/secretsmanager_secret_version.html.markdown
new file mode 100644
index 00000000000..c6e458b1bca
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/secretsmanager_secret_version.html.markdown
@@ -0,0 +1,102 @@
+---
+subcategory: "Secrets Manager"
+layout: "aws"
+page_title: "AWS: aws_secretsmanager_secret_version"
+description: |-
+  Retrieve information about a Secrets Manager secret version including its secret value
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_secretsmanager_secret_version
+
+Retrieve information about a Secrets Manager secret version, including its secret value. To retrieve secret metadata, see the [`awsSecretsmanagerSecret` data source](/docs/providers/aws/d/secretsmanager_secret.html).
+
+## Example Usage
+
+### Retrieve Current Secret Version
+
+By default, this data sources retrieves information based on the `awscurrent` staging label.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsSecretsmanagerSecretVersion } from "./.gen/providers/aws/data-aws-secretsmanager-secret-version";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsSecretsmanagerSecretVersion(this, "secret-version", {
+      secretId: Token.asString(example.id),
+    });
+  }
+}
+
+```
+
+### Retrieve Specific Secret Version
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsSecretsmanagerSecretVersion } from "./.gen/providers/aws/data-aws-secretsmanager-secret-version";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsSecretsmanagerSecretVersion(this, "by-version-stage", {
+      secretId: Token.asString(example.id),
+      versionStage: "example",
+    });
+  }
+}
+
+```
+
+### Handling Key-Value Secret Strings in JSON
+
+Reading key-value pairs from JSON back into a native Terraform map can be accomplished in Terraform 0.12 and later with the [`jsondecode()` function](https://www.terraform.io/docs/configuration/functions/jsondecode.html):
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformOutput, Fn, Token, TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new TerraformOutput(this, "example", {
+      value: Fn.lookupNested(
+        Fn.jsondecode(Token.asString(example.secretString)),
+        ['"key1"']
+      ),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `secretId` - (Required) Specifies the secret containing the version that you want to retrieve. You can specify either the ARN or the friendly name of the secret.
+* `versionId` - (Optional) Specifies the unique identifier of the version of the secret that you want to retrieve. Overrides `versionStage`.
+* `versionStage` - (Optional) Specifies the secret version that you want to retrieve by the staging label attached to the version. Defaults to `awscurrent`.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the secret.
+* `id` - Unique identifier of this version of the secret.
+* `secretString` - Decrypted part of the protected secret information that was originally provided as a string.
+* `secretBinary` - Decrypted part of the protected secret information that was originally provided as a binary.
+* `versionId` - Unique identifier of this version of the secret.
+
+<!-- cache-key: cdktf-0.18.0 input-0b6eddd0447056d7c1accf69edad117a5cfffc0cc933681a436ac5274d6d9488 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/secretsmanager_secrets.html.markdown b/website/docs/cdktf/typescript/d/secretsmanager_secrets.html.markdown
new file mode 100644
index 00000000000..7b2a03b1534
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/secretsmanager_secrets.html.markdown
@@ -0,0 +1,60 @@
+---
+subcategory: "Secrets Manager"
+layout: "aws"
+page_title: "AWS: aws_secretsmanager_secrets"
+description: |-
+    Get information on Secrets Manager secrets.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_secretsmanager_secrets
+
+Use this data source to get the ARNs and names of Secrets Manager secrets matching the specified criteria.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsSecretsmanagerSecrets } from "./.gen/providers/aws/data-aws-secretsmanager-secrets";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsSecretsmanagerSecrets(this, "example", {
+      filter: [
+        {
+          name: "name",
+          values: ["example"],
+        },
+      ],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `filter` - (Optional) Configuration block(s) for filtering. Detailed below.
+
+## filter Configuration Block
+
+The `filter` configuration block supports the following arguments:
+
+* `name` - (Required) Name of the filter field. Valid values can be found in the [Secrets Manager ListSecrets API Reference](https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_ListSecrets.html).
+* `values` - (Required) Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arns` - Set of ARNs of the matched Secrets Manager secrets.
+* `names` - Set of names of the matched Secrets Manager secrets.
+
+<!-- cache-key: cdktf-0.18.0 input-150d44c91f421068bbfdaf75b6d510764b7e066887fe235c7afddf8fee2eaa61 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/security_group.html.markdown b/website/docs/cdktf/typescript/d/security_group.html.markdown
new file mode 100644
index 00000000000..1fcdf800e1c
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/security_group.html.markdown
@@ -0,0 +1,102 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_security_group"
+description: |-
+    Provides details about a specific Security Group
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_security_group
+
+`awsSecurityGroup` provides details about a specific Security Group.
+
+This resource can prove useful when a module accepts a Security Group id as
+an input variable and needs to, for example, determine the id of the
+VPC that the security group belongs to.
+
+## Example Usage
+
+The following example shows how one might accept a Security Group id as a variable
+and use this data source to obtain the data necessary to create a subnet.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformVariable, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsSecurityGroup } from "./.gen/providers/aws/data-aws-security-group";
+import { Subnet } from "./.gen/providers/aws/subnet";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    /*Terraform Variables are not always the best fit for getting inputs in the context of Terraform CDK.
+    You can read more about this at https://cdk.tf/variables*/
+    const securityGroupId = new TerraformVariable(
+      this,
+      "security_group_id",
+      {}
+    );
+    const selected = new DataAwsSecurityGroup(this, "selected", {
+      id: securityGroupId.stringValue,
+    });
+    new Subnet(this, "subnet", {
+      cidrBlock: "10.0.1.0/24",
+      vpcId: Token.asString(selected.vpcId),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The arguments of this data source act as filters for querying the available
+security group in the current region. The given filters must match exactly one
+security group whose data will be exported as attributes.
+
+* `filter` - (Optional) Custom filter block as described below.
+
+* `id` - (Optional) Id of the specific security group to retrieve.
+
+* `name` - (Optional) Name that the desired security group must have.
+
+* `tags` - (Optional) Map of tags, each pair of which must exactly match
+  a pair on the desired security group.
+
+* `vpcId` - (Optional) Id of the VPC that the desired security group belongs to.
+
+More complex filters can be expressed using one or more `filter` sub-blocks,
+which take the following arguments:
+
+* `name` - (Required) Name of the field to filter by, as defined by
+  [the underlying AWS API](http://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeSecurityGroups.html).
+
+* `values` - (Required) Set of values that are accepted for the given field.
+  A Security Group will be selected if any one of the given values matches.
+
+## Attribute Reference
+
+All of the argument attributes except `filter` blocks are also exported as
+result attributes. This data source will complete the data by populating
+any fields that are not included in the configuration with the data for
+the selected Security Group.
+
+The following fields are also exported:
+
+* `description` - Description of the security group.
+* `arn` - Computed ARN of the security group.
+
+~> **Note:** The [default security group for a VPC](http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_SecurityGroups.html#DefaultSecurityGroup) has the name `default`.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `20M`)
+
+<!-- cache-key: cdktf-0.18.0 input-faa48f214b0a68965ac66737fa03fbf44f9874b295dbca0d05f8656a6168d9c4 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/security_groups.html.markdown b/website/docs/cdktf/typescript/d/security_groups.html.markdown
new file mode 100644
index 00000000000..e00ec47be6e
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/security_groups.html.markdown
@@ -0,0 +1,91 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_security_groups"
+description: |-
+  Get information about a set of Security Groups.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_security_groups
+
+Use this data source to get IDs and VPC membership of Security Groups that are created outside of Terraform.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsSecurityGroups } from "./.gen/providers/aws/data-aws-security-groups";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsSecurityGroups(this, "test", {
+      tags: {
+        Application: "k8s",
+        Environment: "dev",
+      },
+    });
+  }
+}
+
+```
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsSecurityGroups } from "./.gen/providers/aws/data-aws-security-groups";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsSecurityGroups(this, "test", {
+      filter: [
+        {
+          name: "group-name",
+          values: ["*nodes*"],
+        },
+        {
+          name: "vpc-id",
+          values: [vpcId.stringValue],
+        },
+      ],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `tags` - (Optional) Map of tags, each pair of which must exactly match for desired security groups.
+* `filter` - (Optional) One or more name/value pairs to use as filters. There are several valid keys, for a full reference, check out [describe-security-groups in the AWS CLI reference][1].
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arns` - ARNs of the matched security groups.
+* `id` - AWS Region.
+* `ids` - IDs of the matches security groups.
+* `vpcIds` - VPC IDs of the matched security groups. The data source's tag or filter *will span VPCs* unless the `vpcId` filter is also used.
+
+[1]: https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-security-groups.html
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `20M`)
+
+<!-- cache-key: cdktf-0.18.0 input-61bce3b277f527514fffcce8fa9eb4692ab442cb83160f5b9461f3e9c31d928a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/serverlessapplicationrepository_application.html.markdown b/website/docs/cdktf/typescript/d/serverlessapplicationrepository_application.html.markdown
new file mode 100644
index 00000000000..aa2bd62ca53
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/serverlessapplicationrepository_application.html.markdown
@@ -0,0 +1,73 @@
+---
+subcategory: "Serverless Application Repository"
+layout: "aws"
+page_title: "AWS: aws_serverlessapplicationrepository_application"
+description: |-
+  Get information on a AWS Serverless Application Repository application
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_serverlessapplicationrepository_application
+
+Use this data source to get information about an AWS Serverless Application Repository application. For example, this can be used to determine the required `capabilities` for an application.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsServerlessapplicationrepositoryApplication } from "./.gen/providers/aws/data-aws-serverlessapplicationrepository-application";
+import { ServerlessapplicationrepositoryCloudformationStack } from "./.gen/providers/aws/serverlessapplicationrepository-cloudformation-stack";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new DataAwsServerlessapplicationrepositoryApplication(
+      this,
+      "example",
+      {
+        applicationId:
+          "arn:aws:serverlessrepo:us-east-1:123456789012:applications/ExampleApplication",
+      }
+    );
+    const awsServerlessapplicationrepositoryCloudformationStackExample =
+      new ServerlessapplicationrepositoryCloudformationStack(
+        this,
+        "example_1",
+        {
+          applicationId: Token.asString(example.applicationId),
+          capabilities: Token.asList(example.requiredCapabilities),
+          name: "Example",
+          semanticVersion: Token.asString(example.semanticVersion),
+        }
+      );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsServerlessapplicationrepositoryCloudformationStackExample.overrideLogicalId(
+      "example"
+    );
+  }
+}
+
+```
+
+## Argument Reference
+
+* `applicationId` - (Required) ARN of the application.
+* `semanticVersion` - (Optional) Requested version of the application. By default, retrieves the latest version.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `applicationId` - ARN of the application.
+* `name` - Name of the application.
+* `requiredCapabilities` - A list of capabilities describing the permissions needed to deploy the application.
+* `sourceCodeUrl` - URL pointing to the source code of the application version.
+* `templateUrl` - URL pointing to the Cloud Formation template for the application version.
+
+<!-- cache-key: cdktf-0.18.0 input-4067d08c02e21d01320463b039dbb33009c80dd466c694f17352beb6a7e00e63 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/service.html.markdown b/website/docs/cdktf/typescript/d/service.html.markdown
new file mode 100644
index 00000000000..df992561336
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/service.html.markdown
@@ -0,0 +1,103 @@
+---
+subcategory: "Meta Data Sources"
+layout: "aws"
+page_title: "AWS: aws_service"
+description: |-
+  Compose and decompose AWS service DNS names
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_service
+
+Use this data source to compose and decompose AWS service DNS names.
+
+## Example Usage
+
+### Get Service DNS Name
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsRegion } from "./.gen/providers/aws/data-aws-region";
+import { DataAwsService } from "./.gen/providers/aws/data-aws-service";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const current = new DataAwsRegion(this, "current", {});
+    new DataAwsService(this, "test", {
+      region: Token.asString(current.name),
+      serviceId: "ec2",
+    });
+  }
+}
+
+```
+
+### Use Service Reverse DNS Name to Get Components
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsService } from "./.gen/providers/aws/data-aws-service";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsService(this, "s3", {
+      reverseDnsName: "cn.com.amazonaws.cn-north-1.s3",
+    });
+  }
+}
+
+```
+
+### Determine Regional Support for a Service
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsService } from "./.gen/providers/aws/data-aws-service";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsService(this, "s3", {
+      reverseDnsName: "com.amazonaws.us-gov-west-1.waf",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are optional:
+
+* `dnsName` - (Optional) DNS name of the service (_e.g.,_ `rdsUsEast1AmazonawsCom`). One of `dnsName`, `reverseDnsName`, or `serviceId` is required.
+* `partition` - (Optional) Partition corresponding to the region.
+* `region` - (Optional) Region of the service (_e.g.,_ `usWest2`, `apNortheast1`).
+* `reverseDnsName` - (Optional) Reverse DNS name of the service (_e.g.,_ `comAmazonawsUsWest2S3`). One of `dnsName`, `reverseDnsName`, or `serviceId` is required.
+* `reverseDnsPrefix` - (Optional) Prefix of the service (_e.g.,_ `comAmazonaws` in AWS Commercial, `cnComAmazonaws` in AWS China).
+* `serviceId` - (Optional) Service (_e.g.,_ `s3`, `rds`, `ec2`). One of `dnsName`, `reverseDnsName`, or `serviceId` is required.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `supported` - Whether the service is supported in the region's partition. New services may not be listed immediately as supported.
+
+<!-- cache-key: cdktf-0.18.0 input-1f67bf4039f0b27910cf9da065ca27ea6cdfc91b4ae00696fbad70cc0c50d4db -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/service_discovery_dns_namespace.html.markdown b/website/docs/cdktf/typescript/d/service_discovery_dns_namespace.html.markdown
new file mode 100644
index 00000000000..95fb06dd573
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/service_discovery_dns_namespace.html.markdown
@@ -0,0 +1,53 @@
+---
+subcategory: "Cloud Map"
+layout: "aws"
+page_title: "AWS: aws_service_discovery_dns_namespace"
+description: |-
+  Retrieves information about a Service Discovery private or public DNS namespace.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_service_discovery_dns_namespace
+
+Retrieves information about a Service Discovery private or public DNS namespace.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsServiceDiscoveryDnsNamespace } from "./.gen/providers/aws/data-aws-service-discovery-dns-namespace";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsServiceDiscoveryDnsNamespace(this, "test", {
+      name: "example.terraform.local",
+      type: "DNS_PRIVATE",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `name` - (Required) Name of the namespace.
+* `type` - (Required) Type of the namespace. Allowed values are `dnsPublic` or `dnsPrivate`.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the namespace.
+* `description` - Description of the namespace.
+* `id` - Namespace ID.
+* `hostedZone` - ID for the hosted zone that Amazon Route 53 creates when you create a namespace.
+* `tags` - Map of tags for the resource.
+
+<!-- cache-key: cdktf-0.18.0 input-536486dabc04dbcda77c827f5666503eea5945a2c5257dff3f3c8c8d37db1b34 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/service_discovery_http_namespace.html.markdown b/website/docs/cdktf/typescript/d/service_discovery_http_namespace.html.markdown
new file mode 100644
index 00000000000..1fc147b89a6
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/service_discovery_http_namespace.html.markdown
@@ -0,0 +1,51 @@
+---
+subcategory: "Cloud Map"
+layout: "aws"
+page_title: "AWS: aws_service_discovery_http_namespace"
+description: |-
+  Retrieves information about a Service Discovery HTTP Namespace.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_service_discovery_http_namespace
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsServiceDiscoveryHttpNamespace } from "./.gen/providers/aws/data-aws-service-discovery-http-namespace";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsServiceDiscoveryHttpNamespace(this, "example", {
+      name: "development",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name of the http namespace.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - ID of a namespace.
+* `arn` - ARN that Amazon Route 53 assigns to the namespace when you create it.
+* `description` - Description that you specify for the namespace when you create it.
+* `httpName` - Name of an HTTP namespace.
+* `tags` - Map of tags for the resource.
+
+<!-- cache-key: cdktf-0.18.0 input-fd64564a9e9f20381d3b8498bc1ece55a0a91282b8fa11f6f5581b84a7b4085a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/service_discovery_service.html.markdown b/website/docs/cdktf/typescript/d/service_discovery_service.html.markdown
new file mode 100644
index 00000000000..b36b4dbcb92
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/service_discovery_service.html.markdown
@@ -0,0 +1,87 @@
+---
+subcategory: "Cloud Map"
+layout: "aws"
+page_title: "AWS: aws_service_discovery_service"
+description: |-
+  Retrieves information about a Service Discovery Service
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_service_discovery_service
+
+Retrieves information about a Service Discovery Service.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsServiceDiscoveryService } from "./.gen/providers/aws/data-aws-service-discovery-service";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsServiceDiscoveryService(this, "test", {
+      name: "example",
+      namespaceId: "NAMESPACE_ID_VALUE",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name of the service.
+* `namespaceId` - (Required) ID of the namespace that the service belongs to.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the service.
+* `arn` - ARN of the service.
+* `description` - Description of the service.
+* `dnsConfig` - Complex type that contains information about the resource record sets that you want Amazon Route 53 to create when you register an instance.
+* `healthCheckConfig` - Complex type that contains settings for an optional health check. Only for Public DNS namespaces.
+* `healthCheckCustomConfig` -  A complex type that contains settings for ECS managed health checks.
+* `tags` - Map of tags to assign to the service. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `tagsAll` - (**Deprecated**) Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+### dns_config
+
+This argument supports the following arguments:
+
+* `namespaceId` - ID of the namespace to use for DNS configuration.
+* `dnsRecords` - An array that contains one DnsRecord object for each resource record set.
+* `routingPolicy` - Routing policy that you want to apply to all records that Route 53 creates when you register an instance and specify the service. Valid Values: MULTIVALUE, WEIGHTED
+
+#### dns_records
+
+This argument supports the following arguments:
+
+* `ttl` - Amount of time, in seconds, that you want DNS resolvers to cache the settings for this resource record set.
+* `type` - Type of the resource, which indicates the value that Amazon Route 53 returns in response to DNS queries. Valid Values: A, AAAA, SRV, CNAME
+
+### health_check_config
+
+This argument supports the following arguments:
+
+* `failureThreshold` - Number of consecutive health checks. Maximum value of 10.
+* `resourcePath` - Path that you want Route 53 to request when performing health checks. Route 53 automatically adds the DNS name for the service. If you don't specify a value, the default value is /.
+* `type` -  The type of health check that you want to create, which indicates how Route 53 determines whether an endpoint is healthy. Valid Values: HTTP, HTTPS, TCP
+
+### health_check_custom_config
+
+This argument supports the following arguments:
+
+* `failureThreshold` -  The number of 30-second intervals that you want service discovery to wait before it changes the health status of a service instance.  Maximum value of 10.
+
+<!-- cache-key: cdktf-0.18.0 input-7f7cfd8f45e41436fd49818ccfcd8108e8b10153e1f88948ca383049b98272be -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/servicecatalog_constraint.html.markdown b/website/docs/cdktf/typescript/d/servicecatalog_constraint.html.markdown
new file mode 100644
index 00000000000..30e4ce50149
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/servicecatalog_constraint.html.markdown
@@ -0,0 +1,62 @@
+---
+subcategory: "Service Catalog"
+layout: "aws"
+page_title: "AWS: aws_servicecatalog_constraint"
+description: |-
+  Provides information on a Service Catalog Constraint
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_servicecatalog_constraint
+
+Provides information on a Service Catalog Constraint.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsServicecatalogConstraint } from "./.gen/providers/aws/data-aws-servicecatalog-constraint";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsServicecatalogConstraint(this, "example", {
+      acceptLanguage: "en",
+      id: "cons-hrvy0335",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `id` - Constraint identifier.
+
+The following arguments are optional:
+
+* `acceptLanguage` - (Optional) Language code. Valid values: `en` (English), `jp` (Japanese), `zh` (Chinese). Default value is `en`.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `description` - Description of the constraint.
+* `owner` - Owner of the constraint.
+* `parameters` - Constraint parameters in JSON format.
+* `portfolioId` - Portfolio identifier.
+* `productId` - Product identifier.
+* `status` - Constraint status.
+* `type` - Type of constraint. Valid values are `launch`, `notification`, `resourceUpdate`, `stackset`, and `template`.
+
+<!-- cache-key: cdktf-0.18.0 input-da418dc5c6998e476df08abac67c17c4dc70e9bf30247effbc012c2e90dbc9b3 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/servicecatalog_launch_paths.html.markdown b/website/docs/cdktf/typescript/d/servicecatalog_launch_paths.html.markdown
new file mode 100644
index 00000000000..ac73b571518
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/servicecatalog_launch_paths.html.markdown
@@ -0,0 +1,67 @@
+---
+subcategory: "Service Catalog"
+layout: "aws"
+page_title: "AWS: aws_servicecatalog_launch_paths"
+description: |-
+  Provides information on Service Catalog Launch Paths
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_servicecatalog_launch_paths
+
+Lists the paths to the specified product. A path is how the user has access to a specified product, and is necessary when provisioning a product. A path also determines the constraints put on the product.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsServicecatalogLaunchPaths } from "./.gen/providers/aws/data-aws-servicecatalog-launch-paths";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsServicecatalogLaunchPaths(this, "example", {
+      productId: "prod-yakog5pdriver",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `productId` - (Required) Product identifier.
+
+The following arguments are optional:
+
+* `acceptLanguage` - (Optional) Language code. Valid values: `en` (English), `jp` (Japanese), `zh` (Chinese). Default value is `en`.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `summaries` - Block with information about the launch path. See details below.
+
+### summaries
+
+* `constraintSummaries` - Block for constraints on the portfolio-product relationship. See details below.
+* `pathId` - Identifier of the product path.
+* `name` - Name of the portfolio to which the path was assigned.
+* `tags` - Tags associated with this product path.
+
+### constraint_summaries
+
+* `description` - Description of the constraint.
+* `type` - Type of constraint. Valid values are `launch`, `notification`, `stackset`, and `template`.
+
+<!-- cache-key: cdktf-0.18.0 input-395a3eb806ea47e44fedb57001a8b66f937569364601cfff911b33a8f74a212b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/servicecatalog_portfolio.html.markdown b/website/docs/cdktf/typescript/d/servicecatalog_portfolio.html.markdown
new file mode 100644
index 00000000000..1870b0c6861
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/servicecatalog_portfolio.html.markdown
@@ -0,0 +1,58 @@
+---
+subcategory: "Service Catalog"
+layout: "aws"
+page_title: "AWS: aws_servicecatalog_portfolio"
+description: |-
+  Provides information for a Service Catalog Portfolio.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_servicecatalog_portfolio
+
+Provides information for a Service Catalog Portfolio.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsServicecatalogPortfolio } from "./.gen/providers/aws/data-aws-servicecatalog-portfolio";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsServicecatalogPortfolio(this, "portfolio", {
+      id: "port-07052002",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `id` - (Required) Portfolio identifier.
+
+The following arguments are optional:
+
+* `acceptLanguage` - (Optional) Language code. Valid values: `en` (English), `jp` (Japanese), `zh` (Chinese). Default value is `en`.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - Portfolio ARN.
+* `createdTime` - Time the portfolio was created.
+* `description` - Description of the portfolio
+* `name` - Portfolio name.
+* `providerName` - Name of the person or organization who owns the portfolio.
+* `tags` - Tags applied to the portfolio.
+
+<!-- cache-key: cdktf-0.18.0 input-84da50c0619f8efedfa9915aaeed7934ec932b8663c9afe0bb857f54d0d60299 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/servicecatalog_portfolio_constraints.html.markdown b/website/docs/cdktf/typescript/d/servicecatalog_portfolio_constraints.html.markdown
new file mode 100644
index 00000000000..6ec31348f06
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/servicecatalog_portfolio_constraints.html.markdown
@@ -0,0 +1,64 @@
+---
+subcategory: "Service Catalog"
+layout: "aws"
+page_title: "AWS: aws_servicecatalog_portfolio_constraints"
+description: |-
+  Provides information on Service Catalog Portfolio Constraints
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_servicecatalog_portfolio_constraints
+
+Provides information on Service Catalog Portfolio Constraints.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsServicecatalogPortfolioConstraints } from "./.gen/providers/aws/data-aws-servicecatalog-portfolio-constraints";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsServicecatalogPortfolioConstraints(this, "example", {
+      portfolioId: "port-3lli3b3an",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `portfolioId` - (Required) Portfolio identifier.
+
+The following arguments are optional:
+
+* `acceptLanguage` - (Optional) Language code. Valid values: `en` (English), `jp` (Japanese), `zh` (Chinese). Default value is `en`.
+* `productId` - (Optional) Product identifier.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `details` - List of information about the constraints. See details below.
+
+### details
+
+* `constraintId` - Identifier of the constraint.
+* `description` - Description of the constraint.
+* `portfolioId` - Identifier of the portfolio the product resides in. The constraint applies only to the instance of the product that lives within this portfolio.
+* `productId` - Identifier of the product the constraint applies to. A constraint applies to a specific instance of a product within a certain portfolio.
+* `type` - Type of constraint. Valid values are `launch`, `notification`, `stackset`, and `template`.
+
+<!-- cache-key: cdktf-0.18.0 input-f95e8d8a013aacf7b3916f6b479047744fecc334d40aba4c8da473d8e4af976e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/servicecatalog_product.html.markdown b/website/docs/cdktf/typescript/d/servicecatalog_product.html.markdown
new file mode 100644
index 00000000000..341f5c8985d
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/servicecatalog_product.html.markdown
@@ -0,0 +1,69 @@
+---
+subcategory: "Service Catalog"
+layout: "aws"
+page_title: "AWS: aws_servicecatalog_product"
+description: |-
+  This data source provides information about a Service Catalog product.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_servicecatalog_product
+
+Use this data source to retrieve information about a Service Catalog product.
+
+~> **NOTE:** A "provisioning artifact" is also known as a "version," and a "distributor" is also known as a "vendor."
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsServicecatalogProduct } from "./.gen/providers/aws/data-aws-servicecatalog-product";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsServicecatalogProduct(this, "example", {
+      id: "prod-dnigbtea24ste",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `id` - (Required) ID of the product.
+
+The following arguments are optional:
+
+* `acceptLanguage` - (Optional) Language code. Valid values are `en` (English), `jp` (Japanese), `zh` (Chinese). The default value is `en`.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the product.
+* `createdTime` - Time when the product was created.
+* `description` - Description of the product.
+* `distributor` - Vendor of the product.
+* `hasDefaultPath` - Whether the product has a default path.
+* `name` - Name of the product.
+* `owner` - Owner of the product.
+* `status` - Status of the product.
+* `supportDescription` - Field that provides support information about the product.
+* `supportEmail` - Contact email for product support.
+* `supportUrl` - Contact URL for product support.
+* `tags` - Tags applied to the product.
+* `type` - Type of product.
+
+<!-- cache-key: cdktf-0.18.0 input-5458573534df92d96787bca1e91a863522fae24c5024caea86faec96b4253984 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/servicecatalog_provisioning_artifacts.html.markdown b/website/docs/cdktf/typescript/d/servicecatalog_provisioning_artifacts.html.markdown
new file mode 100644
index 00000000000..76a28a367cf
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/servicecatalog_provisioning_artifacts.html.markdown
@@ -0,0 +1,65 @@
+---
+subcategory: "Service Catalog"
+layout: "aws"
+page_title: "AWS: aws_servicecatalog_provisioning_artifacts"
+description: |-
+  Provides information on Service Catalog Provisioning Artifacts
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_servicecatalog_provisioning_artifacts
+
+Lists the provisioning artifacts for the specified product.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsServicecatalogProvisioningArtifacts } from "./.gen/providers/aws/data-aws-servicecatalog-provisioning-artifacts";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsServicecatalogProvisioningArtifacts(this, "example", {
+      productId: "prod-yakog5pdriver",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `productId` - (Required) Product identifier.
+
+The following arguments are optional:
+
+* `acceptLanguage` - (Optional) Language code. Valid values: `en` (English), `jp` (Japanese), `zh` (Chinese). Default value is `en`.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `provisioningArtifactDetails` - List with information about the provisioning artifacts. See details below.
+
+### provisioning_artifact_details
+
+* `active` - Indicates whether the product version is active.
+* `createdTime` - The UTC time stamp of the creation time.
+* `description` - The description of the provisioning artifact.
+* `guidance` - Information set by the administrator to provide guidance to end users about which provisioning artifacts to use.
+* `id` - The identifier of the provisioning artifact.
+* `name` - The name of the provisioning artifact.
+* `type` - The type of provisioning artifact.
+
+<!-- cache-key: cdktf-0.18.0 input-70d3d0ef3ce0371f0258d9d9db5e9876444b44930ec3530badd4b8fe021fee18 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/servicequotas_service.html.markdown b/website/docs/cdktf/typescript/d/servicequotas_service.html.markdown
new file mode 100644
index 00000000000..9671a2c1c86
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/servicequotas_service.html.markdown
@@ -0,0 +1,50 @@
+---
+subcategory: "Service Quotas"
+layout: "aws"
+page_title: "AWS: aws_servicequotas_service"
+description: |-
+  Retrieve information about a Service Quotas Service
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_servicequotas_service
+
+Retrieve information about a Service Quotas Service.
+
+~> **NOTE:** Global quotas apply to all AWS regions, but can only be accessed in `usEast1` in the Commercial partition or `usGovWest1` in the GovCloud partition. In other regions, the AWS API will return the error `The request failed because the specified service does not exist.`
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsServicequotasService } from "./.gen/providers/aws/data-aws-servicequotas-service";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsServicequotasService(this, "example", {
+      serviceName: "Amazon Virtual Private Cloud (Amazon VPC)",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `serviceName` - (Required) Service name to lookup within Service Quotas. Available values can be found with the [AWS CLI service-quotas list-services command](https://docs.aws.amazon.com/cli/latest/reference/service-quotas/list-services.html).
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - Code of the service.
+* `serviceCode` - Code of the service.
+
+<!-- cache-key: cdktf-0.18.0 input-4d133c6d1401c018a17d5ac93ddafa2d0e17605d51df1be8cf1b26789b0bd62e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/servicequotas_service_quota.html.markdown b/website/docs/cdktf/typescript/d/servicequotas_service_quota.html.markdown
new file mode 100644
index 00000000000..4c31610e519
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/servicequotas_service_quota.html.markdown
@@ -0,0 +1,73 @@
+---
+subcategory: "Service Quotas"
+layout: "aws"
+page_title: "AWS: aws_servicequotas_service_quota"
+description: |-
+  Retrieve information about a Service Quota
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_servicequotas_service_quota
+
+Retrieve information about a Service Quota.
+
+~> **NOTE:** Global quotas apply to all AWS regions, but can only be accessed in `usEast1` in the Commercial partition or `usGovWest1` in the GovCloud partition. In other regions, the AWS API will return the error `The request failed because the specified service does not exist.`
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsServicequotasServiceQuota } from "./.gen/providers/aws/data-aws-servicequotas-service-quota";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsServicequotasServiceQuota(this, "by_quota_code", {
+      quotaCode: "L-F678F1CE",
+      serviceCode: "vpc",
+    });
+    new DataAwsServicequotasServiceQuota(this, "by_quota_name", {
+      quotaName: "VPCs per Region",
+      serviceCode: "vpc",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+~> *NOTE:* Either `quotaCode` or `quotaName` must be configured.
+
+* `serviceCode` - (Required) Service code for the quota. Available values can be found with the [`awsServicequotasService` data source](/docs/providers/aws/d/servicequotas_service.html) or [AWS CLI service-quotas list-services command](https://docs.aws.amazon.com/cli/latest/reference/service-quotas/list-services.html).
+* `quotaCode` - (Optional) Quota code within the service. When configured, the data source directly looks up the service quota. Available values can be found with the [AWS CLI service-quotas list-service-quotas command](https://docs.aws.amazon.com/cli/latest/reference/service-quotas/list-service-quotas.html). One of `quotaCode` or `quotaName` must be specified.
+* `quotaName` - (Optional) Quota name within the service. When configured, the data source searches through all service quotas to find the matching quota name. Available values can be found with the [AWS CLI service-quotas list-service-quotas command](https://docs.aws.amazon.com/cli/latest/reference/service-quotas/list-service-quotas.html). One of `quotaName` or `quotaCode` must be specified.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `adjustable` - Whether the service quota is adjustable.
+* `arn` - ARN of the service quota.
+* `defaultValue` - Default value of the service quota.
+* `globalQuota` - Whether the service quota is global for the AWS account.
+* `id` - ARN of the service quota.
+* `serviceName` - Name of the service.
+* `usageMetric` - Information about the measurement.
+    * `metricDimensions` - The metric dimensions.
+        * `class`
+        * `resource`
+        * `service`
+        * `type`
+    * `metricName` - The name of the metric.
+    * `metricNamespace` - The namespace of the metric.
+    * `metricStatisticRecommendation` - The metric statistic that AWS recommend you use when determining quota usage.
+* `value` - Current value of the service quota.
+
+<!-- cache-key: cdktf-0.18.0 input-bc36008b8483826c556e6fd6e192b7a6b4c3b1b4a2f09174ab402172ccc82dd9 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/servicequotas_templates.html.markdown b/website/docs/cdktf/typescript/d/servicequotas_templates.html.markdown
new file mode 100644
index 00000000000..76e2972b6e4
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/servicequotas_templates.html.markdown
@@ -0,0 +1,62 @@
+---
+subcategory: "Service Quotas"
+layout: "aws"
+page_title: "AWS: aws_servicequotas_templates"
+description: |-
+  Terraform data source for managing an AWS Service Quotas Templates.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_servicequotas_templates
+
+Terraform data source for managing an AWS Service Quotas Templates.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsServicequotasTemplates } from "./.gen/providers/aws/data-aws-servicequotas-templates";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsServicequotasTemplates(this, "example", {
+      region: "us-east-1",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `region` - (Required) AWS Region to which the quota increases apply.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `templates` - A list of quota increase templates for specified region. See [`templates`](#templates).
+
+### `templates`
+
+* `globalQuota` - Indicates whether the quota is global.
+* `quotaName` - Quota name.
+* `quotaCode` - Quota identifier.
+* `region` - AWS Region to which the template applies.
+* `serviceCode` - (Required) Service identifier.
+* `serviceName` - Service name.
+* `unit` - Unit of measurement.
+* `value` - (Required) The new, increased value for the quota.
+
+<!-- cache-key: cdktf-0.18.0 input-45d70f2e4ea266e23b4ad36acd3c73ea199467bd5ebbe49c2aee22a627335cbb -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/ses_active_receipt_rule_set.html.markdown b/website/docs/cdktf/typescript/d/ses_active_receipt_rule_set.html.markdown
new file mode 100644
index 00000000000..c610d00e03a
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/ses_active_receipt_rule_set.html.markdown
@@ -0,0 +1,42 @@
+---
+subcategory: "SES (Simple Email)"
+layout: "aws"
+page_title: "AWS: aws_ses_active_receipt_rule_set"
+description: |-
+  Retrieve the active SES receipt rule set
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_ses_active_receipt_rule_set
+
+Retrieve the active SES receipt rule set
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsSesActiveReceiptRuleSet } from "./.gen/providers/aws/data-aws-ses-active-receipt-rule-set";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsSesActiveReceiptRuleSet(this, "main", {});
+  }
+}
+
+```
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - SES receipt rule set ARN.
+* `ruleSetName` - Name of the rule set
+
+<!-- cache-key: cdktf-0.18.0 input-7e5511881f5e55ae7c44bb058232594f1824f28cdd4358ee38cec88c0c71d14b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/ses_domain_identity.html.markdown b/website/docs/cdktf/typescript/d/ses_domain_identity.html.markdown
new file mode 100644
index 00000000000..889816f475b
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/ses_domain_identity.html.markdown
@@ -0,0 +1,45 @@
+---
+subcategory: "SES (Simple Email)"
+layout: "aws"
+page_title: "AWS: aws_ses_domain_identity"
+description: |-
+  Retrieve the SES domain identity
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_ses_domain_identity
+
+Retrieve the SES domain identity
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsSesDomainIdentity } from "./.gen/providers/aws/data-aws-ses-domain-identity";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsSesDomainIdentity(this, "example", {
+      domain: "example.com",
+    });
+  }
+}
+
+```
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the domain identity.
+* `domain` - Name of the domain
+* `verificationToken` - Code which when added to the domain as a TXT record will signal to SES that the owner of the domain has authorized SES to act on their behalf.
+
+<!-- cache-key: cdktf-0.18.0 input-c92b09c53a734f66fe357db2ededfa5c3680d8cf83576766510fba91783213fc -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/ses_domain_identity.markdown b/website/docs/cdktf/typescript/d/ses_domain_identity.markdown
new file mode 100644
index 00000000000..889816f475b
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/ses_domain_identity.markdown
@@ -0,0 +1,45 @@
+---
+subcategory: "SES (Simple Email)"
+layout: "aws"
+page_title: "AWS: aws_ses_domain_identity"
+description: |-
+  Retrieve the SES domain identity
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_ses_domain_identity
+
+Retrieve the SES domain identity
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsSesDomainIdentity } from "./.gen/providers/aws/data-aws-ses-domain-identity";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsSesDomainIdentity(this, "example", {
+      domain: "example.com",
+    });
+  }
+}
+
+```
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the domain identity.
+* `domain` - Name of the domain
+* `verificationToken` - Code which when added to the domain as a TXT record will signal to SES that the owner of the domain has authorized SES to act on their behalf.
+
+<!-- cache-key: cdktf-0.18.0 input-c92b09c53a734f66fe357db2ededfa5c3680d8cf83576766510fba91783213fc -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/ses_email_identity.html.markdown b/website/docs/cdktf/typescript/d/ses_email_identity.html.markdown
new file mode 100644
index 00000000000..6cefb7764c0
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/ses_email_identity.html.markdown
@@ -0,0 +1,44 @@
+---
+subcategory: "SES (Simple Email)"
+layout: "aws"
+page_title: "AWS: aws_ses_email_identity"
+description: |-
+  Retrieve the active SES email identity
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_ses_email_identity
+
+Retrieve the active SES email identity
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsSesEmailIdentity } from "./.gen/providers/aws/data-aws-ses-email-identity";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsSesEmailIdentity(this, "example", {
+      email: "awesome@example.com",
+    });
+  }
+}
+
+```
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` -  The ARN of the email identity.
+* `email` - Email identity.
+
+<!-- cache-key: cdktf-0.18.0 input-8b3c7c5e4c1d6197b2c76516866374779af6bd8d12e2ceda7f1a749b93b9a39e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/ses_email_identity.markdown b/website/docs/cdktf/typescript/d/ses_email_identity.markdown
new file mode 100644
index 00000000000..6cefb7764c0
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/ses_email_identity.markdown
@@ -0,0 +1,44 @@
+---
+subcategory: "SES (Simple Email)"
+layout: "aws"
+page_title: "AWS: aws_ses_email_identity"
+description: |-
+  Retrieve the active SES email identity
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_ses_email_identity
+
+Retrieve the active SES email identity
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsSesEmailIdentity } from "./.gen/providers/aws/data-aws-ses-email-identity";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsSesEmailIdentity(this, "example", {
+      email: "awesome@example.com",
+    });
+  }
+}
+
+```
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` -  The ARN of the email identity.
+* `email` - Email identity.
+
+<!-- cache-key: cdktf-0.18.0 input-8b3c7c5e4c1d6197b2c76516866374779af6bd8d12e2ceda7f1a749b93b9a39e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/sesv2_configuration_set.html.markdown b/website/docs/cdktf/typescript/d/sesv2_configuration_set.html.markdown
new file mode 100644
index 00000000000..58a8f23e188
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/sesv2_configuration_set.html.markdown
@@ -0,0 +1,68 @@
+---
+subcategory: "SESv2 (Simple Email V2)"
+layout: "aws"
+page_title: "AWS: aws_sesv2_configuration_set"
+description: |-
+  Terraform data source for managing an AWS SESv2 (Simple Email V2) Configuration Set.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_sesv2_configuration_set
+
+Terraform data source for managing an AWS SESv2 (Simple Email V2) Configuration Set.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsSesv2ConfigurationSet } from "./.gen/providers/aws/data-aws-sesv2-configuration-set";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsSesv2ConfigurationSet(this, "example", {
+      configurationSetName: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `configurationSetName` - (Required) The name of the configuration set.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `deliveryOptions` - An object that defines the dedicated IP pool that is used to send emails that you send using the configuration set.
+    * `sendingPoolName` - The name of the dedicated IP pool to associate with the configuration set.
+    * `tlsPolicy` - Specifies whether messages that use the configuration set are required to use Transport Layer Security (TLS).
+* `reputationOptions` - An object that defines whether or not Amazon SES collects reputation metrics for the emails that you send that use the configuration set.
+    * `lastFreshStart` - The date and time (in Unix time) when the reputation metrics were last given a fresh start.
+    * `reputationMetricsEnabled` - Specifies whether tracking of reputation metrics is enabled.
+* `sendingOptions` - An object that defines whether or not Amazon SES can send email that you send using the configuration set.
+    * `sendingEnabled` - Specifies whether email sending is enabled.
+* `suppressionOptions` - An object that contains information about the suppression list preferences for your account.
+    * `suppressedReasons` - A list that contains the reasons that email addresses are automatically added to the suppression list for your account.
+* `tags` - Key-value map of resource tags for the container recipe.
+* `trackingOptions` - An object that defines the open and click tracking options for emails that you send using the configuration set.
+    * `customRedirectDomain` - The domain to use for tracking open and click events.
+* `vdmOptions` - An object that contains information about the VDM preferences for your configuration set.
+    * `dashboardOptions` - Specifies additional settings for your VDM configuration as applicable to the Dashboard.
+        * `engagementMetrics` - Specifies the status of your VDM engagement metrics collection.
+    * `guardianOptions` - Specifies additional settings for your VDM configuration as applicable to the Guardian.
+        * `optimizedSharedDelivery` - Specifies the status of your VDM optimized shared delivery.
+
+<!-- cache-key: cdktf-0.18.0 input-766473cbe249f97d2e59a5938aa348513964c44ef9762f5fa275491b1409c22a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/sesv2_dedicated_ip_pool.html.markdown b/website/docs/cdktf/typescript/d/sesv2_dedicated_ip_pool.html.markdown
new file mode 100644
index 00000000000..e8385c5be48
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/sesv2_dedicated_ip_pool.html.markdown
@@ -0,0 +1,60 @@
+---
+subcategory: "SESv2 (Simple Email V2)"
+layout: "aws"
+page_title: "AWS: aws_sesv2_dedicated_ip_pool"
+description: |-
+  Terraform data source for managing an AWS SESv2 (Simple Email V2) Dedicated IP Pool.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_sesv2_dedicated_ip_pool
+
+Terraform data source for managing an AWS SESv2 (Simple Email V2) Dedicated IP Pool.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsSesv2DedicatedIpPool } from "./.gen/providers/aws/data-aws-sesv2-dedicated-ip-pool";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsSesv2DedicatedIpPool(this, "example", {
+      poolName: "my-pool",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `poolName` - (Required) Name of the dedicated IP pool.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Dedicated IP Pool.
+* `dedicatedIps` - A list of objects describing the pool's dedicated IP's. See [`dedicatedIps`](#dedicated_ips).
+* `scalingMode` - (Optional) IP pool scaling mode. Valid values: `standard`, `managed`.
+* `tags` - A map of tags attached to the pool.
+
+### dedicated_ips
+
+* `ip` - IPv4 address.
+* `warmupPercentage` - Indicates how complete the dedicated IP warm-up process is. When this value equals `1`, the address has completed the warm-up process and is ready for use.
+* `warmupStatus` - The warm-up status of a dedicated IP address. Valid values: `inProgress`, `done`.
+
+<!-- cache-key: cdktf-0.18.0 input-85f32989660a929d8bc2374a2bb39ccd95b65ab0f91d1df95fd4ec734bc35496 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/sesv2_email_identity.html.markdown b/website/docs/cdktf/typescript/d/sesv2_email_identity.html.markdown
new file mode 100644
index 00000000000..5fe3a9c55c3
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/sesv2_email_identity.html.markdown
@@ -0,0 +1,61 @@
+---
+subcategory: "SESv2 (Simple Email V2)"
+layout: "aws"
+page_title: "AWS: aws_sesv2_email_identity"
+description: |-
+  Terraform data source for managing an AWS SESv2 (Simple Email V2) Email Identity.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_sesv2_email_identity
+
+Terraform data source for managing an AWS SESv2 (Simple Email V2) Email Identity.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsSesv2EmailIdentity } from "./.gen/providers/aws/data-aws-sesv2-email-identity";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsSesv2EmailIdentity(this, "example", {
+      emailIdentity: "example.com",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `emailIdentity` - (Required) The name of the email identity.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Email Identity.
+* `dkimSigningAttributes` - A list of objects that contains at most one element with information about the private key and selector that you want to use to configure DKIM for the identity for Bring Your Own DKIM (BYODKIM) for the identity, or, configures the key length to be used for Easy DKIM.
+    * `currentSigningKeyLength` - [Easy DKIM] The key length of the DKIM key pair in use.
+    * `lastKeyGenerationTimestamp` - [Easy DKIM] The last time a key pair was generated for this identity.
+    * `nextSigningKeyLength` - [Easy DKIM] The key length of the future DKIM key pair to be generated. This can be changed at most once per day.
+    * `signingAttributesOrigin` - A string that indicates how DKIM was configured for the identity. `awsSes` indicates that DKIM was configured for the identity by using Easy DKIM. `external` indicates that DKIM was configured for the identity by using Bring Your Own DKIM (BYODKIM).
+    * `status` - Describes whether or not Amazon SES has successfully located the DKIM records in the DNS records for the domain. See the [AWS SES API v2 Reference](https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_DkimAttributes.html#SES-Type-DkimAttributes-Status) for supported statuses.
+    * `tokens` - If you used Easy DKIM to configure DKIM authentication for the domain, then this object contains a set of unique strings that you use to create a set of CNAME records that you add to the DNS configuration for your domain. When Amazon SES detects these records in the DNS configuration for your domain, the DKIM authentication process is complete. If you configured DKIM authentication for the domain by providing your own public-private key pair, then this object contains the selector for the public key.
+* `identityType` - The email identity type. Valid values: `emailAddress`, `domain`.
+* `tags` - Key-value mapping of resource tags.
+* `verifiedForSendingStatus` - Specifies whether or not the identity is verified.
+
+<!-- cache-key: cdktf-0.18.0 input-7c12091698113e4874168fd26ec7c1c02c1487b040cff1044c5b20751c66d041 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/sesv2_email_identity_mail_from_attributes.html.markdown b/website/docs/cdktf/typescript/d/sesv2_email_identity_mail_from_attributes.html.markdown
new file mode 100644
index 00000000000..f44b226ee38
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/sesv2_email_identity_mail_from_attributes.html.markdown
@@ -0,0 +1,61 @@
+---
+subcategory: "SESv2 (Simple Email V2)"
+layout: "aws"
+page_title: "AWS: aws_sesv2_email_identity_mail_from_attributes"
+description: |-
+  Terraform data source for managing an AWS SESv2 (Simple Email V2) Email Identity Mail From Attributes.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_sesv2_email_identity_mail_from_attributes
+
+Terraform data source for managing an AWS SESv2 (Simple Email V2) Email Identity Mail From Attributes.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsSesv2EmailIdentity } from "./.gen/providers/aws/data-aws-sesv2-email-identity";
+import { DataAwsSesv2EmailIdentityMailFromAttributes } from "./.gen/providers/aws/data-aws-sesv2-email-identity-mail-from-attributes";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new DataAwsSesv2EmailIdentity(this, "example", {
+      emailIdentity: "example.com",
+    });
+    const dataAwsSesv2EmailIdentityMailFromAttributesExample =
+      new DataAwsSesv2EmailIdentityMailFromAttributes(this, "example_1", {
+        emailIdentity: Token.asString(example.emailIdentity),
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsSesv2EmailIdentityMailFromAttributesExample.overrideLogicalId(
+      "example"
+    );
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `emailIdentity` - (Required) The name of the email identity.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `behaviorOnMxFailure` - The action to take if the required MX record isn't found when you send an email. Valid values: `useDefaultValue`, `rejectMessage`.
+* `mailFromDomain` - The custom MAIL FROM domain that you want the verified identity to use.
+
+<!-- cache-key: cdktf-0.18.0 input-f06a941b8e525f3b2704cada8b06a7094de35a609eb45fe1ddea9ebc9ad88ae8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/sfn_activity.html.markdown b/website/docs/cdktf/typescript/d/sfn_activity.html.markdown
new file mode 100644
index 00000000000..e1f08804151
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/sfn_activity.html.markdown
@@ -0,0 +1,51 @@
+---
+subcategory: "SFN (Step Functions)"
+layout: "aws"
+page_title: "AWS: aws_sfn_activity"
+description: |-
+  Use this data source to get information about a Step Functions Activity.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_sfn_activity
+
+Provides a Step Functions Activity data source
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsSfnActivity } from "./.gen/providers/aws/data-aws-sfn-activity";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsSfnActivity(this, "sfn_activity", {
+      name: "my-activity",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Optional) Name that identifies the activity.
+* `arn` - (Optional) ARN that identifies the activity.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - ARN that identifies the activity.
+* `creationDate` - Date the activity was created.
+
+<!-- cache-key: cdktf-0.18.0 input-e2493cc090cc44214dfdcc458776424943b9df2b9c75318cd7718d0ef209f5e1 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/sfn_alias.html.markdown b/website/docs/cdktf/typescript/d/sfn_alias.html.markdown
new file mode 100644
index 00000000000..ff744cf7e4f
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/sfn_alias.html.markdown
@@ -0,0 +1,56 @@
+---
+subcategory: "SFN (Step Functions)"
+layout: "aws"
+page_title: "AWS: aws_sfn_alias"
+description: |-
+  Terraform data source for managing an AWS SFN (Step Functions) State Machine Alias.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_sfn_alias
+
+Terraform data source for managing an AWS SFN (Step Functions) State Machine Alias.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsSfnAlias } from "./.gen/providers/aws/data-aws-sfn-alias";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsSfnAlias(this, "example", {
+      name: "my_sfn_alias",
+      statemachineArn: sfnTest.arn,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) Name of the State Machine alias.
+* `statemachineArn` - (Required) ARN of the State Machine.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN identifying the State Machine alias.
+* `creationDate` - Date the state machine Alias was created.
+* `description` - Description of state machine alias.
+* `routingConfiguration` - Routing Configuration of state machine alias
+
+<!-- cache-key: cdktf-0.18.0 input-74bb5c065bedebe96a1f1604459cc4b92ef1bc40588d2a1e6918a9e59b8ae39b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/sfn_state_machine.html.markdown b/website/docs/cdktf/typescript/d/sfn_state_machine.html.markdown
new file mode 100644
index 00000000000..f25fc1789e8
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/sfn_state_machine.html.markdown
@@ -0,0 +1,55 @@
+---
+subcategory: "SFN (Step Functions)"
+layout: "aws"
+page_title: "AWS: aws_sfn_state_machine"
+description: |-
+  Get information on an Amazon Step Function State Machine
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_sfn_state_machine
+
+Use this data source to get the ARN of a State Machine in AWS Step
+Function (SFN). By using this data source, you can reference a
+state machine without having to hard code the ARNs as input.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsSfnStateMachine } from "./.gen/providers/aws/data-aws-sfn-state-machine";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsSfnStateMachine(this, "example", {
+      name: "an_example_sfn_name",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `name` - (Required) Friendly name of the state machine to match.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - Set to the ARN of the found state machine, suitable for referencing in other resources that support State Machines.
+* `arn` - Set to the arn of the state function.
+* `roleArn` - Set to the role_arn used by the state function.
+* `definition` - Set to the state machine definition.
+* `creationDate` - Date the state machine was created.
+* `revisionId` - The revision identifier for the state machine.
+* `status` - Set to the current status of the state machine.
+
+<!-- cache-key: cdktf-0.18.0 input-0f22f10a18b56fd2ce60408fbc367e0d625ee8c7fc8072d7009918250afe27d7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/sfn_state_machine_versions.html.markdown b/website/docs/cdktf/typescript/d/sfn_state_machine_versions.html.markdown
new file mode 100644
index 00000000000..ef8d53fa99e
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/sfn_state_machine_versions.html.markdown
@@ -0,0 +1,51 @@
+---
+subcategory: "SFN (Step Functions)"
+layout: "aws"
+page_title: "AWS: aws_sfn_state_machine_versions"
+description: |-
+  Terraform data source for managing an AWS SFN (Step Functions) State Machine Versions.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_sfn_state_machine_versions
+
+Terraform data source for managing an AWS SFN (Step Functions) State Machine Versions.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsSfnStateMachineVersions } from "./.gen/providers/aws/data-aws-sfn-state-machine-versions";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsSfnStateMachineVersions(this, "test", {
+      statemachineArn: Token.asString(awsSfnStateMachineTest.arn),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `statemachineArn` - (Required) ARN of the State Machine.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `statemachineVersions` - ARN List identifying the statemachine versions.
+
+<!-- cache-key: cdktf-0.18.0 input-824fd2b5bdeae5b7a6a3535a32c61238432e8f9bb78e071234ecee4baa02e255 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/signer_signing_job.html.markdown b/website/docs/cdktf/typescript/d/signer_signing_job.html.markdown
new file mode 100644
index 00000000000..e9e415cc187
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/signer_signing_job.html.markdown
@@ -0,0 +1,63 @@
+---
+subcategory: "Signer"
+layout: "aws"
+page_title: "AWS: aws_signer_signing_job"
+description: |-
+  Provides a Signer Signing Job data source.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_signer_signing_job
+
+Provides information about a Signer Signing Job.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsSignerSigningJob } from "./.gen/providers/aws/data-aws-signer-signing-job";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsSignerSigningJob(this, "build_signing_job", {
+      jobId: "9ed7e5c3-b8d4-4da0-8459-44e0b068f7ee",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `jobId` - (Required) ID of the signing job on output.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `completedAt` - Date and time in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8) that the signing job was completed.
+* `createdAt` - Date and time in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8) that the signing job was created.
+* `jobInvoker` - IAM entity that initiated the signing job.
+* `jobOwner` - AWS account ID of the job owner.
+* `platformDisplayName` - A human-readable name for the signing platform associated with the signing job.
+* `platformId` - Platform to which your signed code image will be distributed.
+* `profileName` - Name of the profile that initiated the signing operation.
+* `profileVersion` - Version of the signing profile used to initiate the signing job.
+* `requestedBy` - IAM principal that requested the signing job.
+* `revocationRecord` - Revocation record if the signature generated by the signing job has been revoked. Contains a timestamp and the ID of the IAM entity that revoked the signature.
+* `signatureExpiresAt` - The time when the signature of a signing job expires.
+* `signedObject` - Name of the S3 bucket where the signed code image is saved by code signing.
+* `source` - Object that contains the name of your S3 bucket or your raw code.
+* `status` - Status of the signing job.
+* `statusReason` - String value that contains the status reason.
+
+<!-- cache-key: cdktf-0.18.0 input-da438917e91506b32ffdad63f1749fec4c7fba78b31e711db78cd6ea684d041b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/signer_signing_profile.html.markdown b/website/docs/cdktf/typescript/d/signer_signing_profile.html.markdown
new file mode 100644
index 00000000000..a7ec2cb5df8
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/signer_signing_profile.html.markdown
@@ -0,0 +1,57 @@
+---
+subcategory: "Signer"
+layout: "aws"
+page_title: "AWS: aws_signer_signing_profile"
+description: |-
+  Provides a Signer Signing Profile data source.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_signer_signing_profile
+
+Provides information about a Signer Signing Profile.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsSignerSigningProfile } from "./.gen/providers/aws/data-aws-signer-signing-profile";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsSignerSigningProfile(this, "production_signing_profile", {
+      name: "prod_profile_DdW3Mk1foYL88fajut4mTVFGpuwfd4ACO6ANL0D1uIj7lrn8adK",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name of the target signing profile.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN for the signing profile.
+* `platformDisplayName` - A human-readable name for the signing platform associated with the signing profile.
+* `platformId` - ID of the platform that is used by the target signing profile.
+* `revocationRecord` - Revocation information for a signing profile.
+* `signatureValidityPeriod` - The validity period for a signing job.
+* `status` - Status of the target signing profile.
+* `tags` - List of tags associated with the signing profile.
+* `version` - Current version of the signing profile.
+* `versionArn` - Signing profile ARN, including the profile version.
+
+<!-- cache-key: cdktf-0.18.0 input-aba77f8dc958b5e0757ea2581dd2d80a47faca88c585f688dbc1436b3712ace6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/sns_topic.html.markdown b/website/docs/cdktf/typescript/d/sns_topic.html.markdown
new file mode 100644
index 00000000000..39fd8a166d2
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/sns_topic.html.markdown
@@ -0,0 +1,50 @@
+---
+subcategory: "SNS (Simple Notification)"
+layout: "aws"
+page_title: "AWS: aws_sns_topic"
+description: |-
+  Get information on a Amazon Simple Notification Service (SNS) Topic
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_sns_topic
+
+Use this data source to get the ARN of a topic in AWS Simple Notification
+Service (SNS). By using this data source, you can reference SNS topics
+without having to hard code the ARNs as input.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsSnsTopic } from "./.gen/providers/aws/data-aws-sns-topic";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsSnsTopic(this, "example", {
+      name: "an_example_topic",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `name` - (Required) Friendly name of the topic to match.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the found topic, suitable for referencing in other resources that support SNS topics.
+* `id` - ARN of the found topic, suitable for referencing in other resources that support SNS topics.
+
+<!-- cache-key: cdktf-0.18.0 input-a8e2c249a5626888f1285a9f19fb2d9d401d550cc75845a638d912a441614449 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/sqs_queue.html.markdown b/website/docs/cdktf/typescript/d/sqs_queue.html.markdown
new file mode 100644
index 00000000000..f9660da9a8c
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/sqs_queue.html.markdown
@@ -0,0 +1,51 @@
+---
+subcategory: "SQS (Simple Queue)"
+layout: "aws"
+page_title: "AWS: aws_sqs_queue"
+description: |-
+  Get information on an Amazon Simple Queue Service (SQS) Queue
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_sqs_queue
+
+Use this data source to get the ARN and URL of queue in AWS Simple Queue Service (SQS).
+By using this data source, you can reference SQS queues without having to hardcode
+the ARNs as input.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsSqsQueue } from "./.gen/providers/aws/data-aws-sqs-queue";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsSqsQueue(this, "example", {
+      name: "queue",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `name` - (Required) Name of the queue to match.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the queue.
+* `url` - URL of the queue.
+* `tags` - Map of tags for the resource.
+
+<!-- cache-key: cdktf-0.18.0 input-bc2387998bbb916bdcaa1a3f2f812935f5cc67ab5bb81f0bdfe43f5e898107d4 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/sqs_queues.html.markdown b/website/docs/cdktf/typescript/d/sqs_queues.html.markdown
new file mode 100644
index 00000000000..87ddd77e910
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/sqs_queues.html.markdown
@@ -0,0 +1,51 @@
+---
+subcategory: "SQS (Simple Queue)"
+layout: "aws"
+page_title: "AWS: aws_sqs_queues"
+description: |-
+  Terraform data source for managing an AWS SQS (Simple Queue) Queues.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_sqs_queues
+
+Terraform data source for managing an AWS SQS (Simple Queue) Queues.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsSqsQueues } from "./.gen/providers/aws/data-aws-sqs-queues";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsSqsQueues(this, "example", {
+      queueNamePrefix: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are optional:
+
+* `queueNamePrefix` - (Optional) A string to use for filtering the list results. Only those queues whose name begins with the specified string are returned. Queue URLs and names are case-sensitive.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `queueUrls` - A list of queue URLs.
+
+<!-- cache-key: cdktf-0.18.0 input-1e5fe100d7582003d54198ed26f28cc150e201a30f6ce59c4e3b9c34624d3a76 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/ssm_document.html.markdown b/website/docs/cdktf/typescript/d/ssm_document.html.markdown
new file mode 100644
index 00000000000..792f72eff26
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/ssm_document.html.markdown
@@ -0,0 +1,82 @@
+---
+subcategory: "SSM (Systems Manager)"
+layout: "aws"
+page_title: "AWS: aws_ssm_document"
+description: |-
+  Provides a SSM Document data source
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_ssm_document
+
+Gets the contents of the specified Systems Manager document.
+
+## Example Usage
+
+To get the contents of the document owned by AWS.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformOutput, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsSsmDocument } from "./.gen/providers/aws/data-aws-ssm-document";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const foo = new DataAwsSsmDocument(this, "foo", {
+      documentFormat: "YAML",
+      name: "AWS-GatherSoftwareInventory",
+    });
+    new TerraformOutput(this, "content", {
+      value: foo.content,
+    });
+  }
+}
+
+```
+
+To get the contents of the custom document.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsSsmDocument } from "./.gen/providers/aws/data-aws-ssm-document";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsSsmDocument(this, "test", {
+      documentFormat: "JSON",
+      name: Token.asString(awsSsmDocumentTest.name),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name of the Systems Manager document.
+* `documentFormat` - (Optional) Returns the document in the specified format. The document format can be either `json`, `yaml` and `text`. JSON is the default format.
+* `documentVersion` - (Optional) Document version for which you want information.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the document. If the document is an AWS managed document, this value will be set to the name of the document instead.
+* `content` - Contents of the document.
+* `documentType` - Type of the document.
+
+<!-- cache-key: cdktf-0.18.0 input-9343adb58c9912030cbf5122132a6b4bd27fc637380c9a974b20e323246d88d8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/ssm_instances.html.markdown b/website/docs/cdktf/typescript/d/ssm_instances.html.markdown
new file mode 100644
index 00000000000..2110872651d
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/ssm_instances.html.markdown
@@ -0,0 +1,59 @@
+---
+subcategory: "SSM (Systems Manager)"
+layout: "aws"
+page_title: "AWS: aws_ssm_instances"
+description: |-
+  Get information on SSM managed instances.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_ssm_instances
+
+Use this data source to get the instance IDs of SSM managed instances.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsSsmInstances } from "./.gen/providers/aws/data-aws-ssm-instances";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsSsmInstances(this, "example", {
+      filter: [
+        {
+          name: "PlatformTypes",
+          values: ["Linux"],
+        },
+      ],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `filter` - (Optional) Configuration block(s) for filtering. Detailed below.
+
+### filter Configuration Block
+
+The `filter` configuration block supports the following arguments:
+
+* `name` - (Required) Name of the filter field. Valid values can be found in the [SSM InstanceInformationStringFilter API Reference](https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_InstanceInformationStringFilter.html).
+* `values` - (Required) Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `ids` - Set of instance IDs of the matched SSM managed instances.
+
+<!-- cache-key: cdktf-0.18.0 input-e0bf0a9c24b0fa03c969992656b33d964fe9479c4bd864151f5158999bb3211a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/ssm_maintenance_windows.html.markdown b/website/docs/cdktf/typescript/d/ssm_maintenance_windows.html.markdown
new file mode 100644
index 00000000000..a38a991d6e8
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/ssm_maintenance_windows.html.markdown
@@ -0,0 +1,59 @@
+---
+subcategory: "SSM (Systems Manager)"
+layout: "aws"
+page_title: "AWS: aws_ssm_maintenance_windows"
+description: |-
+  Get information on SSM maintenance windows.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: ssm_maintenance_windows
+
+Use this data source to get the window IDs of SSM maintenance windows.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsSsmMaintenanceWindows } from "./.gen/providers/aws/data-aws-ssm-maintenance-windows";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsSsmMaintenanceWindows(this, "example", {
+      filter: [
+        {
+          name: "Enabled",
+          values: ["true"],
+        },
+      ],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `filter` - (Optional) Configuration block(s) for filtering. Detailed below.
+
+### filter Configuration Block
+
+The `filter` configuration block supports the following arguments:
+
+* `name` - (Required) Name of the filter field. Valid values can be found in the [SSM DescribeMaintenanceWindows API Reference](https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DescribeMaintenanceWindows.html#API_DescribeMaintenanceWindows_RequestSyntax).
+* `values` - (Required) Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `ids` - List of window IDs of the matched SSM maintenance windows.
+
+<!-- cache-key: cdktf-0.18.0 input-c5aedc6143d69465ce8bb1a3ffb4fcbaed9f5bbe552310caa38814607706ddc7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/ssm_parameter.html.markdown b/website/docs/cdktf/typescript/d/ssm_parameter.html.markdown
new file mode 100644
index 00000000000..d0197287b7c
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/ssm_parameter.html.markdown
@@ -0,0 +1,58 @@
+---
+subcategory: "SSM (Systems Manager)"
+layout: "aws"
+page_title: "AWS: aws_ssm_parameter"
+description: |-
+  Provides a SSM Parameter Data Source
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_ssm_parameter
+
+Provides an SSM Parameter data source.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsSsmParameter } from "./.gen/providers/aws/data-aws-ssm-parameter";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsSsmParameter(this, "foo", {
+      name: "foo",
+    });
+  }
+}
+
+```
+
+~> **Note:** The unencrypted value of a SecureString will be stored in the raw state as plain-text.
+[Read more about sensitive data in state](https://www.terraform.io/docs/state/sensitive-data.html).
+
+~> **Note:** The data source is currently following the behavior of the [SSM API](https://docs.aws.amazon.com/sdk-for-go/api/service/ssm/#Parameter) to return a string value, regardless of parameter type. For type `stringList`, we can use the built-in [split()](https://www.terraform.io/docs/configuration/functions/split.html) function to get values in a list. Example: `split(",", data.aws_ssm_parameter.subnets.value)`
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name of the parameter.
+* `withDecryption` - (Optional) Whether to return decrypted `secureString` value. Defaults to `true`.
+
+In addition to all arguments above, the following attributes are exported:
+
+* `arn` - ARN of the parameter.
+* `name` - Name of the parameter.
+* `type` - Type of the parameter. Valid types are `string`, `stringList` and `secureString`.
+* `value` - Value of the parameter. This value is always marked as sensitive in the Terraform plan output, regardless of `type`. In Terraform CLI version 0.15 and later, this may require additional configuration handling for certain scenarios. For more information, see the [Terraform v0.15 Upgrade Guide](https://www.terraform.io/upgrade-guides/0-15.html#sensitive-output-values).
+* `insecureValue` - Value of the parameter. **Use caution:** This value is never marked as sensitive.
+* `version` - Version of the parameter.
+
+<!-- cache-key: cdktf-0.18.0 input-89a145f5b43a3c824da664ca5cd8985b70d4cc516d350f4aa2411cd727cc5e4b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/ssm_parameters_by_path.html.markdown b/website/docs/cdktf/typescript/d/ssm_parameters_by_path.html.markdown
new file mode 100644
index 00000000000..2f0f95bdb5b
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/ssm_parameters_by_path.html.markdown
@@ -0,0 +1,57 @@
+---
+subcategory: "SSM (Systems Manager)"
+layout: "aws"
+page_title: "AWS: aws_ssm_parameters_by_path"
+description: |-
+  Provides SSM Parameters by path
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_ssm_parameters_by_path
+
+Provides SSM Parameters by path.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsSsmParametersByPath } from "./.gen/providers/aws/data-aws-ssm-parameters-by-path";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsSsmParametersByPath(this, "foo", {
+      path: "/foo",
+    });
+  }
+}
+
+```
+
+~> **Note:** The unencrypted value of a SecureString will be stored in the raw state as plain-text.
+[Read more about sensitive data in state](/docs/state/sensitive-data.html).
+
+~> **Note:** The data source is currently following the behavior of the [SSM API](https://docs.aws.amazon.com/sdk-for-go/api/service/ssm/#Parameter) to return a string value, regardless of parameter type. For type `stringList`, we can use the built-in [split()](https://www.terraform.io/docs/configuration/functions/split.html) function to get values in a list. Example: `split(",", data.aws_ssm_parameter.subnets.value)`
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `path` - (Required) Prefix path of the parameter.
+* `withDecryption` - (Optional) Whether to return decrypted `secureString` value. Defaults to `true`.
+* `recursive` - (Optional) Whether to recursively return parameters under `path`. Defaults to `false`.
+
+In addition to all arguments above, the following attributes are exported:
+
+* `arns` - ARNs of the parameters.
+* `names` - Names of the parameters.
+* `types` - Types of the parameters.
+* `values` - Value of the parameters.
+
+<!-- cache-key: cdktf-0.18.0 input-7b348a27d41a11a492f12ba3c140b7e05046525d9219a6497f555c54a31584cc -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/ssm_patch_baseline.html.markdown b/website/docs/cdktf/typescript/d/ssm_patch_baseline.html.markdown
new file mode 100644
index 00000000000..ee1b825ed2d
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/ssm_patch_baseline.html.markdown
@@ -0,0 +1,103 @@
+---
+subcategory: "SSM (Systems Manager)"
+layout: "aws"
+page_title: "AWS: aws_ssm_patch_baseline"
+description: |-
+  Provides an SSM Patch Baseline data source
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_ssm_patch_baseline
+
+Provides an SSM Patch Baseline data source. Useful if you wish to reuse the default baselines provided.
+
+## Example Usage
+
+To retrieve a baseline provided by AWS:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsSsmPatchBaseline } from "./.gen/providers/aws/data-aws-ssm-patch-baseline";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsSsmPatchBaseline(this, "centos", {
+      namePrefix: "AWS-",
+      operatingSystem: "CENTOS",
+      owner: "AWS",
+    });
+  }
+}
+
+```
+
+To retrieve a baseline on your account:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsSsmPatchBaseline } from "./.gen/providers/aws/data-aws-ssm-patch-baseline";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsSsmPatchBaseline(this, "default_custom", {
+      defaultBaseline: true,
+      namePrefix: "MyCustomBaseline",
+      operatingSystem: "WINDOWS",
+      owner: "Self",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `owner` - (Required) Owner of the baseline. Valid values: `all`, `aws`, `self` (the current account).
+* `namePrefix` - (Optional) Filter results by the baseline name prefix.
+* `defaultBaseline` - (Optional) Filters the results against the baselines default_baseline field.
+* `operatingSystem` - (Optional) Specified OS for the baseline. Valid values: `amazonLinux`, `amazonLinux2`, `ubuntu`, `redhatEnterpriseLinux`, `suse`, `centos`, `oracleLinux`, `debian`, `macos`, `raspbian` and `rockyLinux`.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `approvedPatches` - List of explicitly approved patches for the baseline.
+* `approvedPatchesComplianceLevel` - The compliance level for approved patches.
+* `approvedPatchesEnableNonSecurity` - Indicates whether the list of approved patches includes non-security updates that should be applied to the instances.
+* `approvalRule` - List of rules used to include patches in the baseline.
+    * `approveAfterDays` - The number of days after the release date of each patch matched by the rule the patch is marked as approved in the patch baseline.
+    * `approveUntilDate` - The cutoff date for auto approval of released patches. Any patches released on or before this date are installed automatically. Date is formatted as `yyyyMmDd`. Conflicts with `approveAfterDays`
+    * `complianceLevel` - The compliance level for patches approved by this rule.
+    * `enableNonSecurity` - Boolean enabling the application of non-security updates.
+    * `patchFilter` - The patch filter group that defines the criteria for the rule.
+        * `key` - The key for the filter.
+        * `values` - The value for the filter.
+* `globalFilter` - Set of global filters used to exclude patches from the baseline.
+    * `key` - The key for the filter.
+    * `values` - The value for the filter.
+* `id` - ID of the baseline.
+* `name` - Name of the baseline.
+* `description` - Description of the baseline.
+* `rejectedPatches` - List of rejected patches.
+* `rejectedPatchesAction` - The action specified to take on patches included in the `rejectedPatches` list.
+* `source` - Information about the patches to use to update the managed nodes, including target operating systems and source repositories.
+    * `configuration` - The value of the yum repo configuration.
+    * `name` - The name specified to identify the patch source.
+    * `products` - The specific operating system versions a patch repository applies to.
+
+<!-- cache-key: cdktf-0.18.0 input-1c115d0fa5611577b6c8646f608f018267b9450033415bb6dcacd2efe1e7a958 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/ssmcontacts_contact.html.markdown b/website/docs/cdktf/typescript/d/ssmcontacts_contact.html.markdown
new file mode 100644
index 00000000000..63f78f67767
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/ssmcontacts_contact.html.markdown
@@ -0,0 +1,54 @@
+---
+subcategory: "SSM Contacts"
+layout: "aws"
+page_title: "AWS: aws_ssmcontacts_contact"
+description: |-
+  Terraform data source for managing an AWS SSM Contact.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_ssmcontacts_contact
+
+Terraform data source for managing an AWS SSM Contact.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsSsmcontactsContact } from "./.gen/providers/aws/data-aws-ssmcontacts-contact";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsSsmcontactsContact(this, "example", {
+      arn: "arn:aws:ssm-contacts:us-west-2:123456789012:contact/contactalias",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `arn` - (Required) The Amazon Resource Name (ARN) of the contact or escalation plan.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `alias` - A unique and identifiable alias of the contact or escalation plan.
+* `type` - The type of contact engaged. A single contact is type `personal` and an escalation plan is type `escalation`.
+* `displayName` - Full friendly name of the contact or escalation plan.
+* `tags` - Map of tags to assign to the resource.
+
+<!-- cache-key: cdktf-0.18.0 input-028dcbba9b9d4f6b9868cfdfa5621e49e88520c35fc79346bd35242d298b06bc -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/ssmcontacts_contact_channel.html.markdown b/website/docs/cdktf/typescript/d/ssmcontacts_contact_channel.html.markdown
new file mode 100644
index 00000000000..31f4ff1360d
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/ssmcontacts_contact_channel.html.markdown
@@ -0,0 +1,59 @@
+---
+subcategory: "SSM Contacts"
+layout: "aws"
+page_title: "AWS: aws_ssmcontacts_contact_channel"
+description: |-
+  Terraform data source for managing an AWS SSM Contacts Contact Channel.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_ssmcontacts_contact_channel
+
+Terraform data source for managing an AWS SSM Contacts Contact Channel.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsSsmcontactsContactChannel } from "./.gen/providers/aws/data-aws-ssmcontacts-contact-channel";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsSsmcontactsContactChannel(this, "example", {
+      arn: "arn:aws:ssm-contacts:us-west-2:123456789012:contact-channel/example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+- `arn` - Amazon Resource Name (ARN) of the contact channel.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+- `activationStatus` - Whether the contact channel is activated.
+
+- `contactId` - Amazon Resource Name (ARN) of the AWS SSM Contact that the contact channel belongs to.
+
+- `deliveryAddress` - Details used to engage the contact channel.
+
+- `name` - Name of the contact channel.
+
+- `type` - Type of the contact channel.
+
+<!-- cache-key: cdktf-0.18.0 input-9f531cedbf6139b19742dde2e104f65f9b8b5e9b437541c3b2cb7082c8b98b4f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/ssmcontacts_plan.html.markdown b/website/docs/cdktf/typescript/d/ssmcontacts_plan.html.markdown
new file mode 100644
index 00000000000..d98b7b05715
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/ssmcontacts_plan.html.markdown
@@ -0,0 +1,52 @@
+---
+subcategory: "SSM Contacts"
+layout: "aws"
+page_title: "AWS: aws_ssmcontacts_plan"
+description: |-
+  Terraform data source for managing an AWS SSM Contact Plan.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_ssmcontacts_plan
+
+Terraform data source for managing a Plan of an AWS SSM Contact.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsSsmcontactsPlan } from "./.gen/providers/aws/data-aws-ssmcontacts-plan";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsSsmcontactsPlan(this, "test", {
+      contactId:
+        "arn:aws:ssm-contacts:us-west-2:123456789012:contact/contactalias",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `contactId` - (Required) The Amazon Resource Name (ARN) of the contact or escalation plan.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `stage` - List of stages. A contact has an engagement plan with stages that contact specified contact channels. An escalation plan uses stages that contact specified contacts.
+
+<!-- cache-key: cdktf-0.18.0 input-92a72d4072ec7f614f162d990ca656e1ab1bfa4324ea98598545cebc4173cb62 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/ssmincidents_replication_set.html.markdown b/website/docs/cdktf/typescript/d/ssmincidents_replication_set.html.markdown
new file mode 100644
index 00000000000..2c978bc44f5
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/ssmincidents_replication_set.html.markdown
@@ -0,0 +1,64 @@
+---
+subcategory: "SSM Incident Manager Incidents"
+layout: "aws"
+page_title: "AWS: aws_ssmincidents_replication_set"
+description: |-
+  Terraform data source for managing an incident replication set in AWS Systems Manager Incident Manager.
+---
+
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_ssmincidents_replication_set
+
+~> **NOTE:** The AWS Region specified by a Terraform provider must always be one of the Regions specified for the replication set.
+
+Use this Terraform data source to manage a replication set in AWS Systems Manager Incident Manager.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsSsmincidentsReplicationSet } from "./.gen/providers/aws/data-aws-ssmincidents-replication-set";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsSsmincidentsReplicationSet(this, "example", {});
+  }
+}
+
+```
+
+## Argument Reference
+
+No arguments are required.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resouce Name (ARN) of the replication set.
+* `tags` - All tags applied to the replication set.
+* `createdBy` - The ARN of the user who created the replication set.
+* `deletionProtected` - If `true`, the last remaining Region in a replication set can’t be deleted.
+* `lastModifiedBy` - The ARN of the user who last modified the replication set.
+* `status` - The overall status of a replication set.
+    * Valid Values: `active` | `creating` | `updating` | `deleting` | `failed`
+
+The `region` configuration block exports the following attributes for each Region:
+
+* `name` - The name of the Region.
+* `kmsKeyArn` - The ARN of the AWS Key Management Service (AWS KMS) encryption key.
+* `status` - The current status of the Region.
+    * Valid Values: `active` | `creating` | `updating` | `deleting` | `failed`
+* `statusMessage` - More information about the status of a Region.
+
+<!-- cache-key: cdktf-0.18.0 input-39319f4ba29ed3dd3b2f5e50f169ffe1879a34918a97973bcb5a09f09dcd8369 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/ssmincidents_response_plan.html.markdown b/website/docs/cdktf/typescript/d/ssmincidents_response_plan.html.markdown
new file mode 100644
index 00000000000..e910da2c68a
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/ssmincidents_response_plan.html.markdown
@@ -0,0 +1,97 @@
+---
+subcategory: "SSM Incident Manager Incidents"
+layout: "aws"
+page_title: "AWS: aws_ssmincidents_response_plan"
+description: |-
+  Terraform data source for managing a response plan in AWS Systems Manager Incident Manager.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_ssmincidents_response_plan
+
+Use this Terraform data source to manage a response plan in AWS Systems Manager Incident Manager.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SsmincidentsResponsePlan } from "./.gen/providers/aws/ssmincidents-response-plan";
+interface MyConfig {
+  incidentTemplate: any;
+  name: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new SsmincidentsResponsePlan(this, "example", {
+      arn: "exampleARN",
+      incidentTemplate: config.incidentTemplate,
+      name: config.name,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `arn` - (Required) The Amazon Resource Name (ARN) of the response plan.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `name` - The name of the response plan.
+* `tags` - The tags applied to the response plan.
+* `displayName` - The long format of the response plan name. This field can contain spaces.
+* `chatChannel` - The Chatbot chat channel used for collaboration during an incident.
+* `engagements` - The Amazon Resource Name (ARN) for the contacts and escalation plans that the response plan engages during an incident.
+
+The `incidentTemplate` configuration block exports the following attributes:
+
+* `title` - The title of a generated incident.
+* `impact` - The impact value of a generated incident. The following values are supported:
+    * `1` - Severe Impact
+    * `2` - High Impact
+    * `3` - Medium Impact
+    * `4` - Low Impact
+    * `5` - No Impact
+* `dedupeString` - A string used to stop Incident Manager from creating multiple incident records for the same incident.
+* `incidentTags` - The tags assigned to an incident template. When an incident starts, Incident Manager assigns the tags specified in the template to the incident.
+* `summary` - The summary of an incident.
+* `notificationTarget` - The Amazon Simple Notification Service (Amazon SNS) targets that this incident notifies when it is updated. The `notificationTarget` configuration block supports the following argument:
+    * `snsTopicArn` - The ARN of the Amazon SNS topic.
+
+The `action` configuration block exports the following attributes:
+
+* `action` - (Optional) The actions that the response plan starts at the beginning of an incident.
+    * `ssmAutomation` - The Systems Manager automation document to start as the runbook at the beginning of the incident. The following values are supported:
+        * `documentName` - The automation document's name.
+        * `roleArn` - The Amazon Resource Name (ARN) of the role that the automation document assumes when it runs commands.
+        * `documentVersion` - The version of the automation document to use at runtime.
+        * `targetAccount` - The account that runs the automation document. This can be in either the management account or an application account.
+        * `parameter` - The key-value pair parameters used when the automation document runs. The following values are supported:
+            * `name` - The name of parameter.
+            * `values` - The values for the associated parameter name.
+        * `dynamicParameters` - The key-value pair used to resolve dynamic parameter values when processing a Systems Manager Automation runbook.
+
+The `integration` configuration block exports the following attributes:
+
+* `integration` - Information about third-party services integrated into the response plan. The following values are supported:
+    * `pagerduty` - Details about the PagerDuty configuration for a response plan. The following values are supported:
+        * `name` - The name of the PagerDuty configuration.
+        * `serviceId` - The ID of the PagerDuty service that the response plan associates with an incident when it launches.
+        * `secretId` - The ID of the AWS Secrets Manager secret that stores your PagerDuty key &mdash; either a General Access REST API Key or User Token REST API Key &mdash; and other user credentials.
+
+<!-- cache-key: cdktf-0.18.0 input-53143826544758b79c896d3903f1f26c1fb9c78df0ebb1d8a86f77ef47ffac71 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/ssoadmin_instances.html.markdown b/website/docs/cdktf/typescript/d/ssoadmin_instances.html.markdown
new file mode 100644
index 00000000000..5f4eb055ee1
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/ssoadmin_instances.html.markdown
@@ -0,0 +1,53 @@
+---
+subcategory: "SSO Admin"
+layout: "aws"
+page_title: "AWS: aws_ssoadmin_instances"
+description: |-
+  Get information on SSO Instances.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_ssoadmin_instances
+
+Use this data source to get ARNs and Identity Store IDs of Single Sign-On (SSO) Instances.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformOutput, Fn, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsSsoadminInstances } from "./.gen/providers/aws/data-aws-ssoadmin-instances";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new DataAwsSsoadminInstances(this, "example", {});
+    new TerraformOutput(this, "arn", {
+      value: Fn.lookupNested(Fn.tolist(example.arns), ["0"]),
+    });
+    new TerraformOutput(this, "identity_store_id", {
+      value: Fn.lookupNested(Fn.tolist(example.identityStoreIds), ["0"]),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+There are no arguments available for this data source.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arns` - Set of Amazon Resource Names (ARNs) of the SSO Instances.
+* `id` - AWS Region.
+* `identityStoreIds` - Set of identifiers of the identity stores connected to the SSO Instances.
+
+<!-- cache-key: cdktf-0.18.0 input-f56f54131de38dcbeec3f2e88e1cd501245218eff2e9ca53862dc82398c4d12b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/ssoadmin_permission_set.html.markdown b/website/docs/cdktf/typescript/d/ssoadmin_permission_set.html.markdown
new file mode 100644
index 00000000000..a6647b002c3
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/ssoadmin_permission_set.html.markdown
@@ -0,0 +1,68 @@
+---
+subcategory: "SSO Admin"
+layout: "aws"
+page_title: "AWS: aws_ssoadmin_permission_set"
+description: |-
+  Get information on a Single Sign-On (SSO) Permission Set.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_ssoadmin_permission_set
+
+Use this data source to get a Single Sign-On (SSO) Permission Set.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformOutput, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsSsoadminInstances } from "./.gen/providers/aws/data-aws-ssoadmin-instances";
+import { DataAwsSsoadminPermissionSet } from "./.gen/providers/aws/data-aws-ssoadmin-permission-set";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new DataAwsSsoadminInstances(this, "example", {});
+    const dataAwsSsoadminPermissionSetExample =
+      new DataAwsSsoadminPermissionSet(this, "example_1", {
+        instanceArn: Token.asString(
+          Fn.lookupNested(Fn.tolist(example.arns), ["0"])
+        ),
+        name: "Example",
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsSsoadminPermissionSetExample.overrideLogicalId("example");
+    new TerraformOutput(this, "arn", {
+      value: dataAwsSsoadminPermissionSetExample.arn,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+~> **NOTE:** Either `arn` or `name` must be configured.
+
+* `arn` - (Optional) ARN of the permission set.
+* `instanceArn` - (Required) ARN of the SSO Instance associated with the permission set.
+* `name` - (Optional) Name of the SSO Permission Set.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - ARN of the Permission Set.
+* `description` - Description of the Permission Set.
+* `relayState` - Relay state URL used to redirect users within the application during the federation authentication process.
+* `sessionDuration` - Length of time that the application user sessions are valid in the ISO-8601 standard.
+* `tags` - Key-value map of resource tags.
+
+<!-- cache-key: cdktf-0.18.0 input-72117fb8aa2c4b577764d0abcde2981eecfaa21858cd3f396c6b7b422f3c859d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/storagegateway_local_disk.html.markdown b/website/docs/cdktf/typescript/d/storagegateway_local_disk.html.markdown
new file mode 100644
index 00000000000..2842c6d658a
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/storagegateway_local_disk.html.markdown
@@ -0,0 +1,51 @@
+---
+subcategory: "Storage Gateway"
+layout: "aws"
+page_title: "AWS: aws_storagegateway_local_disk"
+description: |-
+  Retrieve information about a Storage Gateway local disk
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_storagegateway_local_disk
+
+Retrieve information about a Storage Gateway local disk. The disk identifier is useful for adding the disk as a cache or upload buffer to a gateway.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsStoragegatewayLocalDisk } from "./.gen/providers/aws/data-aws-storagegateway-local-disk";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsStoragegatewayLocalDisk(this, "test", {
+      diskPath: Token.asString(awsVolumeAttachmentTest.deviceName),
+      gatewayArn: Token.asString(awsStoragegatewayGatewayTest.arn),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `gatewayArn` - (Required) ARN of the gateway.
+* `diskNode` - (Optional) Device node of the local disk to retrieve. For example, `/dev/sdb`.
+* `diskPath` - (Optional) Device path of the local disk to retrieve. For example, `/dev/xvdb` or `/dev/nvme1N1`.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `diskId` - Disk identifierE.g., `pci0000:03:000Scsi0:0:0:0`
+* `id` - Disk identifierE.g., `pci0000:03:000Scsi0:0:0:0`
+
+<!-- cache-key: cdktf-0.18.0 input-64c44f7144dae6178c64ac35e8513dac768f1816678a338129b7de095d6a0d5c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/subnet.html.markdown b/website/docs/cdktf/typescript/d/subnet.html.markdown
new file mode 100644
index 00000000000..bd016c85a9f
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/subnet.html.markdown
@@ -0,0 +1,137 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_subnet"
+description: |-
+    Provides details about a specific VPC subnet
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_subnet
+
+`awsSubnet` provides details about a specific VPC subnet.
+
+This resource can prove useful when a module accepts a subnet ID as an input variable and needs to, for example, determine the ID of the VPC that the subnet belongs to.
+
+## Example Usage
+
+The following example shows how one might accept a subnet ID as a variable and use this data source to obtain the data necessary to create a security group that allows connections from hosts in that subnet.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformVariable, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsSubnet } from "./.gen/providers/aws/data-aws-subnet";
+import { SecurityGroup } from "./.gen/providers/aws/security-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    /*Terraform Variables are not always the best fit for getting inputs in the context of Terraform CDK.
+    You can read more about this at https://cdk.tf/variables*/
+    const subnetId = new TerraformVariable(this, "subnet_id", {});
+    const selected = new DataAwsSubnet(this, "selected", {
+      id: subnetId.stringValue,
+    });
+    new SecurityGroup(this, "subnet", {
+      ingress: [
+        {
+          cidrBlocks: [Token.asString(selected.cidrBlock)],
+          fromPort: 80,
+          protocol: "tcp",
+          toPort: 80,
+        },
+      ],
+      vpcId: Token.asString(selected.vpcId),
+    });
+  }
+}
+
+```
+
+### Filter Example
+
+If you want to match against tag `name`, use:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsSubnet } from "./.gen/providers/aws/data-aws-subnet";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsSubnet(this, "selected", {
+      filter: [
+        {
+          name: "tag:Name",
+          values: ["yakdriver"],
+        },
+      ],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The arguments of this data source act as filters for querying the available subnets in the current region. The given filters must match exactly one subnet whose data will be exported as attributes.
+
+The following arguments are optional:
+
+* `availabilityZone` - (Optional) Availability zone where the subnet must reside.
+* `availabilityZoneId` - (Optional) ID of the Availability Zone for the subnet. This argument is not supported in all regions or partitions. If necessary, use `availabilityZone` instead.
+* `cidrBlock` - (Optional) CIDR block of the desired subnet.
+* `defaultForAz` - (Optional) Whether the desired subnet must be the default subnet for its associated availability zone.
+* `filter` - (Optional) Configuration block. Detailed below.
+* `id` - (Optional) ID of the specific subnet to retrieve.
+* `ipv6CidrBlock` - (Optional) IPv6 CIDR block of the desired subnet.
+* `state` - (Optional) State that the desired subnet must have.
+* `tags` - (Optional) Map of tags, each pair of which must exactly match a pair on the desired subnet.
+* `vpcId` - (Optional) ID of the VPC that the desired subnet belongs to.
+
+### filter
+
+This block allows for complex filters. You can use one or more `filter` blocks.
+
+The following arguments are required:
+
+* `name` - (Required) Name of the field to filter by, as defined by [the underlying AWS API](http://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeSubnets.html).
+* `values` - (Required) Set of values that are accepted for the given field. A subnet will be selected if any one of the given values matches.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the subnet.
+* `assignIpv6AddressOnCreation` - Whether an IPv6 address is assigned on creation.
+* `availableIpAddressCount` - Available IP addresses of the subnet.
+* `customerOwnedIpv4Pool` - Identifier of customer owned IPv4 address pool.
+* `enableDns64` - Whether DNS queries made to the Amazon-provided DNS Resolver in this subnet return synthetic IPv6 addresses for IPv4-only destinations.
+* `enableLniAtDeviceIndex` - Indicates the device position for local network interfaces in this subnet. For example, 1 indicates local network interfaces in this subnet are the secondary network interface (eth1). A local network interface cannot be the primary network interface (eth0).
+* `enableResourceNameDnsAaaaRecordOnLaunch` - Indicates whether to respond to DNS queries for instance hostnames with DNS AAAA records.
+* `enableResourceNameDnsARecordOnLaunch` - Indicates whether to respond to DNS queries for instance hostnames with DNS A records.
+* `ipv6CidrBlockAssociationId` - Association ID of the IPv6 CIDR block.
+* `ipv6Native` - Whether this is an IPv6-only subnet.
+* `mapCustomerOwnedIpOnLaunch` - Whether customer owned IP addresses are assigned on network interface creation.
+* `mapPublicIpOnLaunch` - Whether public IP addresses are assigned on instance launch.
+* `outpostArn` - ARN of the Outpost.
+* `ownerId` - ID of the AWS account that owns the subnet.
+* `privateDnsHostnameTypeOnLaunch` - The type of hostnames assigned to instances in the subnet at launch.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `20M`)
+
+<!-- cache-key: cdktf-0.18.0 input-4038416b655586cab52609dedf5c41d129209560a5619712772e26a29f2bcdfb -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/subnets.html.markdown b/website/docs/cdktf/typescript/d/subnets.html.markdown
new file mode 100644
index 00000000000..60e211e20f8
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/subnets.html.markdown
@@ -0,0 +1,167 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_subnets"
+description: |-
+    Get information about a set of subnets.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_subnets
+
+This resource can be useful for getting back a set of subnet IDs.
+
+## Example Usage
+
+The following shows outputting all CIDR blocks for every subnet ID in a VPC.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import {
+  Fn,
+  Token,
+  TerraformIterator,
+  TerraformOutput,
+  TerraformStack,
+} from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsSubnet } from "./.gen/providers/aws/data-aws-subnet";
+import { DataAwsSubnets } from "./.gen/providers/aws/data-aws-subnets";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new DataAwsSubnets(this, "example", {
+      filter: [
+        {
+          name: "vpc-id",
+          values: [vpcId.stringValue],
+        },
+      ],
+    });
+    /*In most cases loops should be handled in the programming language context and 
+    not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+    you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+    you need to keep this like it is.*/
+    const exampleForEachIterator = TerraformIterator.fromList(
+      Token.asAny(Fn.toset(example.ids))
+    );
+    const dataAwsSubnetExample = new DataAwsSubnet(this, "example_1", {
+      id: Token.asString(exampleForEachIterator.value),
+      forEach: exampleForEachIterator,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsSubnetExample.overrideLogicalId("example");
+    new TerraformOutput(this, "subnet_cidr_blocks", {
+      value:
+        "${[ for s in ${" + dataAwsSubnetExample.fqn + "} : s.cidr_block]}",
+    });
+  }
+}
+
+```
+
+The following example retrieves a set of all subnets in a VPC with a custom
+tag of `tier` set to a value of "Private" so that the `awsInstance` resource
+can loop through the subnets, putting instances across availability zones.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformIterator, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsSubnets } from "./.gen/providers/aws/data-aws-subnets";
+import { Instance } from "./.gen/providers/aws/instance";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const private = new DataAwsSubnets(this, "private", {
+      filter: [
+        {
+          name: "vpc-id",
+          values: [vpcId.stringValue],
+        },
+      ],
+      tags: {
+        Tier: "Private",
+      },
+    });
+    /*In most cases loops should be handled in the programming language context and 
+    not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+    you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+    you need to keep this like it is.*/
+    const appForEachIterator = TerraformIterator.fromList(
+      Token.asAny(Fn.toset(private.ids))
+    );
+    new Instance(this, "app", {
+      ami: ami.stringValue,
+      instanceType: "t2.micro",
+      subnetId: Token.asString(appForEachIterator.value),
+      forEach: appForEachIterator,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `filter` - (Optional) Custom filter block as described below.
+* `tags` - (Optional) Map of tags, each pair of which must exactly match
+  a pair on the desired subnets.
+
+More complex filters can be expressed using one or more `filter` sub-blocks,
+which take the following arguments:
+
+* `name` - (Required) Name of the field to filter by, as defined by
+  [the underlying AWS API](http://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeSubnets.html).
+  For example, if matching against tag `name`, use:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsSubnets } from "./.gen/providers/aws/data-aws-subnets";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsSubnets(this, "selected", {
+      filter: [
+        {
+          name: "tag:Name",
+          values: [""],
+        },
+      ],
+    });
+  }
+}
+
+```
+
+* `values` - (Required) Set of values that are accepted for the given field.
+  Subnet IDs will be selected if any one of the given values match.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `ids` - List of all the subnet ids found.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `20M`)
+
+<!-- cache-key: cdktf-0.18.0 input-fe8a040cf37c7960c6358cab9956de0b13b8749d8ba19ed8500e227449c1329e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/transfer_server.html.markdown b/website/docs/cdktf/typescript/d/transfer_server.html.markdown
new file mode 100644
index 00000000000..3b7c6387be7
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/transfer_server.html.markdown
@@ -0,0 +1,59 @@
+---
+subcategory: "Transfer Family"
+layout: "aws"
+page_title: "AWS: aws_transfer_server"
+description: |-
+  Get information on an AWS Transfer Server resource
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_transfer_server
+
+Use this data source to get the ARN of an AWS Transfer Server for use in other
+resources.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsTransferServer } from "./.gen/providers/aws/data-aws-transfer-server";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsTransferServer(this, "example", {
+      serverId: "s-1234567",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `serverId` - (Required) ID for an SFTP server.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of Transfer Server.
+* `certificate` - ARN of any certificate.
+* `domain` -  The domain of the storage system that is used for file transfers.
+* `endpoint` - Endpoint of the Transfer Server (e.g., `s12345678ServerTransferRegionAmazonawsCom`).
+* `endpointType` - Type of endpoint that the server is connected to.
+* `identityProviderType` - The mode of authentication enabled for this service. The default value is `serviceManaged`, which allows you to store and access SFTP user credentials within the service. `apiGateway` indicates that user authentication requires a call to an API Gateway endpoint URL provided by you to integrate an identity provider of your choice.
+* `invocationRole` - ARN of the IAM role used to authenticate the user account with an `identityProviderType` of `apiGateway`.
+* `loggingRole` - ARN of an IAM role that allows the service to write your SFTP users’ activity to your Amazon CloudWatch logs for monitoring and auditing purposes.
+* `protocols` - File transfer protocol or protocols over which your file transfer protocol client can connect to your server's endpoint.
+* `securityPolicyName` - The name of the security policy that is attached to the server.
+* `structuredLogDestinations` - A set of ARNs of destinations that will receive structured logs from the transfer server such as CloudWatch Log Group ARNs.
+* `url` - URL of the service endpoint used to authenticate users with an `identityProviderType` of `apiGateway`.
+
+<!-- cache-key: cdktf-0.18.0 input-527a93818210197a7ed1dcc84d2ff4fa1fd16ef88ced9a8af3676cc1ab7b8447 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/vpc.html.markdown b/website/docs/cdktf/typescript/d/vpc.html.markdown
new file mode 100644
index 00000000000..b1f39fe3460
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/vpc.html.markdown
@@ -0,0 +1,120 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_vpc"
+description: |-
+    Provides details about a specific VPC
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_vpc
+
+`awsVpc` provides details about a specific VPC.
+
+This resource can prove useful when a module accepts a vpc id as
+an input variable and needs to, for example, determine the CIDR block of that
+VPC.
+
+## Example Usage
+
+The following example shows how one might accept a VPC id as a variable
+and use this data source to obtain the data necessary to create a subnet
+within it.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformVariable, Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsVpc } from "./.gen/providers/aws/data-aws-vpc";
+import { Subnet } from "./.gen/providers/aws/subnet";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    /*Terraform Variables are not always the best fit for getting inputs in the context of Terraform CDK.
+    You can read more about this at https://cdk.tf/variables*/
+    const vpcId = new TerraformVariable(this, "vpc_id", {});
+    const selected = new DataAwsVpc(this, "selected", {
+      id: vpcId.stringValue,
+    });
+    new Subnet(this, "example", {
+      availabilityZone: "us-west-2a",
+      cidrBlock: Token.asString(
+        Fn.cidrsubnet(Token.asString(selected.cidrBlock), 4, 1)
+      ),
+      vpcId: Token.asString(selected.id),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The arguments of this data source act as filters for querying the available
+VPCs in the current region. The given filters must match exactly one
+VPC whose data will be exported as attributes.
+
+* `cidrBlock` - (Optional) Cidr block of the desired VPC.
+
+* `dhcpOptionsId` - (Optional) DHCP options id of the desired VPC.
+
+* `default` - (Optional) Boolean constraint on whether the desired VPC is
+  the default VPC for the region.
+
+* `filter` - (Optional) Custom filter block as described below.
+
+* `id` - (Optional) ID of the specific VPC to retrieve.
+
+* `state` - (Optional) Current state of the desired VPC.
+  Can be either `"pending"` or `"available"`.
+
+* `tags` - (Optional) Map of tags, each pair of which must exactly match
+  a pair on the desired VPC.
+
+More complex filters can be expressed using one or more `filter` sub-blocks,
+which take the following arguments:
+
+* `name` - (Required) Name of the field to filter by, as defined by
+  [the underlying AWS API](http://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeVpcs.html).
+
+* `values` - (Required) Set of values that are accepted for the given field.
+  A VPC will be selected if any one of the given values matches.
+
+## Attribute Reference
+
+All of the argument attributes except `filter` blocks are also exported as
+result attributes. This data source will complete the data by populating
+any fields that are not included in the configuration with the data for
+the selected VPC.
+
+The following attribute is additionally exported:
+
+* `arn` - ARN of VPC
+* `enableDnsSupport` - Whether or not the VPC has DNS support
+* `enableNetworkAddressUsageMetrics` - Whether Network Address Usage metrics are enabled for your VPC
+* `enableDnsHostnames` - Whether or not the VPC has DNS hostname support
+* `instanceTenancy` - Allowed tenancy of instances launched into the
+  selected VPC. May be any of `"default"`, `"dedicated"`, or `"host"`.
+* `ipv6AssociationId` - Association ID for the IPv6 CIDR block.
+* `ipv6CidrBlock` - IPv6 CIDR block.
+* `mainRouteTableId` - ID of the main route table associated with this VPC.
+* `ownerId` - ID of the AWS account that owns the VPC.
+
+`cidrBlockAssociations` is also exported with the following attributes:
+
+* `associationId` - Association ID for the IPv4 CIDR block.
+* `cidrBlock` - CIDR block for the association.
+* `state` - State of the association.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `20M`)
+
+<!-- cache-key: cdktf-0.18.0 input-8f39db2d83eed4fb37599ca81ea8bafc32c666cbedeb2b7236ecabe2e981a42e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/vpc_dhcp_options.html.markdown b/website/docs/cdktf/typescript/d/vpc_dhcp_options.html.markdown
new file mode 100644
index 00000000000..3ec7bf080b6
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/vpc_dhcp_options.html.markdown
@@ -0,0 +1,103 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_vpc_dhcp_options"
+description: |-
+  Retrieve information about an EC2 DHCP Options configuration
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_vpc_dhcp_options
+
+Retrieve information about an EC2 DHCP Options configuration.
+
+## Example Usage
+
+### Lookup by DHCP Options ID
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsVpcDhcpOptions } from "./.gen/providers/aws/data-aws-vpc-dhcp-options";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsVpcDhcpOptions(this, "example", {
+      dhcpOptionsId: "dopts-12345678",
+    });
+  }
+}
+
+```
+
+### Lookup by Filter
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsVpcDhcpOptions } from "./.gen/providers/aws/data-aws-vpc-dhcp-options";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsVpcDhcpOptions(this, "example", {
+      filter: [
+        {
+          name: "key",
+          values: ["domain-name"],
+        },
+        {
+          name: "value",
+          values: ["example.com"],
+        },
+      ],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `dhcpOptionsId` - (Optional) EC2 DHCP Options ID.
+* `filter` - (Optional) List of custom filters as described below.
+
+### filter
+
+For more information about filtering, see the [EC2 API documentation](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeDhcpOptions.html).
+
+* `name` - (Required) Name of the field to filter.
+* `values` - (Required) Set of values for filtering.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the DHCP Options Set.
+* `dhcpOptionsId` - EC2 DHCP Options ID
+* `domainName` - Suffix domain name to used when resolving non Fully Qualified Domain NamesE.g., the `search` value in the `/etc/resolvConf` file.
+* `domainNameServers` - List of name servers.
+* `id` - EC2 DHCP Options ID
+* `netbiosNameServers` - List of NETBIOS name servers.
+* `netbiosNodeType` - NetBIOS node type (1, 2, 4, or 8). For more information about these node types, see [RFC 2132](http://www.ietf.org/rfc/rfc2132.txt).
+* `ntpServers` - List of NTP servers.
+* `tags` - Map of tags assigned to the resource.
+* `ownerId` - ID of the AWS account that owns the DHCP options set.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `20M`)
+
+<!-- cache-key: cdktf-0.18.0 input-791925442f0012e5d97b1162afa65bd01197d035ae1eee08f5a4eb0bdfc0c813 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/vpc_endpoint.html.markdown b/website/docs/cdktf/typescript/d/vpc_endpoint.html.markdown
new file mode 100644
index 00000000000..9f203f3c239
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/vpc_endpoint.html.markdown
@@ -0,0 +1,104 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_vpc_endpoint"
+description: |-
+    Provides details about a specific VPC endpoint.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_vpc_endpoint
+
+The VPC Endpoint data source provides details about
+a specific VPC endpoint.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsVpcEndpoint } from "./.gen/providers/aws/data-aws-vpc-endpoint";
+import { VpcEndpointRouteTableAssociation } from "./.gen/providers/aws/vpc-endpoint-route-table-association";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const s3 = new DataAwsVpcEndpoint(this, "s3", {
+      serviceName: "com.amazonaws.us-west-2.s3",
+      vpcId: foo.id,
+    });
+    new VpcEndpointRouteTableAssociation(this, "private_s3", {
+      routeTableId: private.id,
+      vpcEndpointId: Token.asString(s3.id),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The arguments of this data source act as filters for querying the available VPC endpoints.
+The given filters must match exactly one VPC endpoint whose data will be exported as attributes.
+
+* `filter` - (Optional) Custom filter block as described below.
+* `id` - (Optional) ID of the specific VPC Endpoint to retrieve.
+* `serviceName` - (Optional) Service name of the specific VPC Endpoint to retrieve. For AWS services the service name is usually in the form `comAmazonaws.<region>.<service>` (the SageMaker Notebook service is an exception to this rule, the service name is in the form `awsSagemaker.<region>Notebook`).
+* `state` - (Optional) State of the specific VPC Endpoint to retrieve.
+* `tags` - (Optional) Map of tags, each pair of which must exactly match
+  a pair on the specific VPC Endpoint to retrieve.
+* `vpcId` - (Optional) ID of the VPC in which the specific VPC Endpoint is used.
+
+More complex filters can be expressed using one or more `filter` sub-blocks,
+which take the following arguments:
+
+* `name` - (Required) Name of the field to filter by, as defined by
+  [the underlying AWS API](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeVpcEndpoints.html).
+* `values` - (Required) Set of values that are accepted for the given field.
+  A VPC Endpoint will be selected if any one of the given values matches.
+
+## Attribute Reference
+
+In addition to all arguments above except `filter`, the following attributes are exported:
+
+* `arn` - ARN of the VPC endpoint.
+* `cidrBlocks` - List of CIDR blocks for the exposed AWS service. Applicable for endpoints of type `gateway`.
+* `dnsEntry` - DNS entries for the VPC Endpoint. Applicable for endpoints of type `interface`. [DNS entry blocks are documented below](#dns_entry-block).
+* `dnsOptions` - DNS options for the VPC Endpoint. [DNS options blocks are documented below](#dns_options-block).
+* `networkInterfaceIds` - One or more network interfaces for the VPC Endpoint. Applicable for endpoints of type `interface`.
+* `ownerId` - ID of the AWS account that owns the VPC endpoint.
+* `policy` - Policy document associated with the VPC Endpoint. Applicable for endpoints of type `gateway`.
+* `prefixListId` - Prefix list ID of the exposed AWS service. Applicable for endpoints of type `gateway`.
+* `privateDnsEnabled` - Whether or not the VPC is associated with a private hosted zone - `true` or `false`. Applicable for endpoints of type `interface`.
+* `requesterManaged` -  Whether or not the VPC Endpoint is being managed by its service - `true` or `false`.
+* `routeTableIds` - One or more route tables associated with the VPC Endpoint. Applicable for endpoints of type `gateway`.
+* `securityGroupIds` - One or more security groups associated with the network interfaces. Applicable for endpoints of type `interface`.
+* `subnetIds` - One or more subnets in which the VPC Endpoint is located. Applicable for endpoints of type `interface`.
+* `vpcEndpointType` - VPC Endpoint type, `gateway` or `interface`.
+
+### `dnsEntry` Block
+
+DNS blocks (for `dnsEntry`) support the following attributes:
+
+* `dnsName` - DNS name.
+* `hostedZoneId` - ID of the private hosted zone.
+
+### `dnsOptions` Block
+
+DNS options (for `dnsOptions`) support the following attributes:
+
+* `dnsRecordIpType` - The DNS records created for the endpoint.
+* `privateDnsOnlyForInboundResolverEndpoint` - Indicates whether to enable private DNS only for inbound endpoints.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `20M`)
+
+<!-- cache-key: cdktf-0.18.0 input-cf41a1af88fdcd16967d2fea2f7220a7cac0581c1bfd6c1afb6c5a31ae85ffb1 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/vpc_endpoint_service.html.markdown b/website/docs/cdktf/typescript/d/vpc_endpoint_service.html.markdown
new file mode 100644
index 00000000000..f3cc011db2f
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/vpc_endpoint_service.html.markdown
@@ -0,0 +1,141 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_vpc_endpoint_service"
+description: |-
+    Provides details about a specific service that can be specified when creating a VPC endpoint.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_vpc_endpoint_service
+
+The VPC Endpoint Service data source details about a specific service that
+can be specified when creating a VPC endpoint within the region configured in the provider.
+
+## Example Usage
+
+### AWS Service
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsVpcEndpointService } from "./.gen/providers/aws/data-aws-vpc-endpoint-service";
+import { Vpc } from "./.gen/providers/aws/vpc";
+import { VpcEndpoint } from "./.gen/providers/aws/vpc-endpoint";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const foo = new Vpc(this, "foo", {
+      cidrBlock: "10.0.0.0/16",
+    });
+    const s3 = new DataAwsVpcEndpointService(this, "s3", {
+      service: "s3",
+      serviceType: "Gateway",
+    });
+    new VpcEndpoint(this, "ep", {
+      serviceName: Token.asString(s3.serviceName),
+      vpcId: foo.id,
+    });
+  }
+}
+
+```
+
+### Non-AWS Service
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsVpcEndpointService } from "./.gen/providers/aws/data-aws-vpc-endpoint-service";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsVpcEndpointService(this, "custome", {
+      serviceName: "com.amazonaws.vpce.us-west-2.vpce-svc-0e87519c997c63cd8",
+    });
+  }
+}
+
+```
+
+### Filter
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsVpcEndpointService } from "./.gen/providers/aws/data-aws-vpc-endpoint-service";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsVpcEndpointService(this, "test", {
+      filter: [
+        {
+          name: "service-name",
+          values: ["some-service"],
+        },
+      ],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The arguments of this data source act as filters for querying the available VPC endpoint services.
+The given filters must match exactly one VPC endpoint service whose data will be exported as attributes.
+
+* `filter` - (Optional) Configuration block(s) for filtering. Detailed below.
+* `service` - (Optional) Common name of an AWS service (e.g., `s3`).
+* `serviceName` - (Optional) Service name that is specified when creating a VPC endpoint. For AWS services the service name is usually in the form `comAmazonaws.<region>.<service>` (the SageMaker Notebook service is an exception to this rule, the service name is in the form `awsSagemaker.<region>Notebook`).
+* `serviceType` - (Optional) Service type, `gateway` or `interface`.
+* `tags` - (Optional) Map of tags, each pair of which must exactly match a pair on the desired VPC Endpoint Service.
+
+~> **NOTE:** Specifying `service` will not work for non-AWS services or AWS services that don't follow the standard `serviceName` pattern of `comAmazonaws.<region>.<service>`.
+
+### filter Configuration Block
+
+The `filter` configuration block supports the following arguments:
+
+* `name` - (Required) Name of the filter field. Valid values can be found in the [EC2 DescribeVpcEndpointServices API Reference](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeVpcEndpointServices.html).
+* `values` - (Required) Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `acceptanceRequired` - Whether or not VPC endpoint connection requests to the service must be accepted by the service owner - `true` or `false`.
+* `arn` - ARN of the VPC endpoint service.
+* `availabilityZones` - Availability Zones in which the service is available.
+* `baseEndpointDnsNames` - The DNS names for the service.
+* `managesVpcEndpoints` - Whether or not the service manages its VPC endpoints - `true` or `false`.
+* `owner` - AWS account ID of the service owner or `amazon`.
+* `privateDnsName` - Private DNS name for the service.
+* `serviceId` - ID of the endpoint service.
+* `supportedIpAddressTypes` - The supported IP address types.
+* `tags` - Map of tags assigned to the resource.
+* `vpcEndpointPolicySupported` - Whether or not the service supports endpoint policies - `true` or `false`.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `20M`)
+
+<!-- cache-key: cdktf-0.18.0 input-07124556ae240c2c16fc954fbeb348321b8ac1e928a8e3cc7a640d672a6dfb99 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/vpc_ipam_pool.html.markdown b/website/docs/cdktf/typescript/d/vpc_ipam_pool.html.markdown
new file mode 100644
index 00000000000..4832ed7c53c
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/vpc_ipam_pool.html.markdown
@@ -0,0 +1,106 @@
+---
+subcategory: "VPC IPAM (IP Address Manager)"
+layout: "aws"
+page_title: "AWS: aws_vpc_ipam_pool"
+description: |-
+    Returns details about the first IPAM pool that matches search parameters provided.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_vpc_ipam_pool
+
+`awsVpcIpamPool` provides details about an IPAM pool.
+
+This resource can prove useful when an ipam pool was created in another root
+module and you need the pool's id as an input variable. For example, pools
+can be shared via RAM and used to create vpcs with CIDRs from that pool.
+
+## Example Usage
+
+The following example shows an account that has only 1 pool, perhaps shared
+via RAM, and using that pool id to create a VPC with a CIDR derived from
+AWS IPAM.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsVpcIpamPool } from "./.gen/providers/aws/data-aws-vpc-ipam-pool";
+import { Vpc } from "./.gen/providers/aws/vpc";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const test = new DataAwsVpcIpamPool(this, "test", {
+      filter: [
+        {
+          name: "description",
+          values: ["*test*"],
+        },
+        {
+          name: "address-family",
+          values: ["ipv4"],
+        },
+      ],
+    });
+    const awsVpcTest = new Vpc(this, "test_1", {
+      ipv4IpamPoolId: Token.asString(test.id),
+      ipv4NetmaskLength: 28,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsVpcTest.overrideLogicalId("test");
+  }
+}
+
+```
+
+## Argument Reference
+
+The arguments of this data source act as filters for querying the available
+VPCs in the current region. The given filters must match exactly one
+VPC whose data will be exported as attributes.
+
+* `ipamPoolId` - (Optional) ID of the IPAM pool you would like information on.
+* `filter` - (Optional) Custom filter block as described below.
+
+### filter
+
+* `name` - (Required) The name of the filter. Filter names are case-sensitive.
+* `values` - (Required) The filter values. Filter values are case-sensitive.
+
+## Attribute Reference
+
+All of the argument attributes except `filter` blocks are also exported as
+result attributes. This data source will complete the data by populating
+any fields that are not included in the configuration with the data for
+the selected VPC.
+
+The following attribute is additionally exported:
+
+* `addressFamily` - IP protocol assigned to this pool.
+* `allocationDefaultNetmaskLength` - A default netmask length for allocations added to this pool. If, for example, the CIDR assigned to this pool is `10000/8` and you enter 16 here, new allocations will default to `10000/16`.
+* `allocationMaxNetmaskLength` - The maximum netmask length that will be required for CIDR allocations in this pool.
+* `allocationMinNetmaskLength` - The minimum netmask length that will be required for CIDR allocations in this pool.
+* `allocationResourceTags` - Tags that are required to create resources in using this pool.
+* `arn` - ARN of the pool
+* `autoImport` - If enabled, IPAM will continuously look for resources within the CIDR range of this pool and automatically import them as allocations into your IPAM.
+* `awsService` - Limits which service in AWS that the pool can be used in. `ec2` for example, allows users to use space for Elastic IP addresses and VPCs.
+* `description` - Description for the IPAM pool.
+* `id` - ID of the IPAM pool.
+* `ipamScopeId` - ID of the scope the pool belongs to.
+* `locale` - Locale is the Region where your pool is available for allocations. You can only create pools with locales that match the operating Regions of the IPAM. You can only create VPCs from a pool whose locale matches the VPC's Region.
+* `publiclyAdvertisable` - Defines whether or not IPv6 pool space is publicly advertisable over the internet.
+* `sourceIpamPoolId` - ID of the source IPAM pool.
+* `tags` - Map of tags to assigned to the resource.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `20M`)
+
+<!-- cache-key: cdktf-0.18.0 input-14e0ec5a45dd1fac68d4e842a7b8f6c07c038a22e839fecb94a749a7d96d7a4e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/vpc_ipam_pool_cidrs.html.markdown b/website/docs/cdktf/typescript/d/vpc_ipam_pool_cidrs.html.markdown
new file mode 100644
index 00000000000..5fbde79c738
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/vpc_ipam_pool_cidrs.html.markdown
@@ -0,0 +1,134 @@
+---
+subcategory: "VPC IPAM (IP Address Manager)"
+layout: "aws"
+page_title: "AWS: aws_vpc_ipam_pool_cidrs"
+description: |-
+    Returns cidrs provisioned into an IPAM pool.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_vpc_ipam_pool_cidrs
+
+`awsVpcIpamPoolCidrs` provides details about an IPAM pool.
+
+This resource can prove useful when an ipam pool was shared to your account and you want to know all (or a filtered list) of the CIDRs that are provisioned into the pool.
+
+## Example Usage
+
+Basic usage:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsVpcIpamPool } from "./.gen/providers/aws/data-aws-vpc-ipam-pool";
+import { DataAwsVpcIpamPoolCidrs } from "./.gen/providers/aws/data-aws-vpc-ipam-pool-cidrs";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const p = new DataAwsVpcIpamPool(this, "p", {
+      filter: [
+        {
+          name: "description",
+          values: ["*mypool*"],
+        },
+        {
+          name: "address-family",
+          values: ["ipv4"],
+        },
+      ],
+    });
+    new DataAwsVpcIpamPoolCidrs(this, "c", {
+      ipamPoolId: Token.asString(p.id),
+    });
+  }
+}
+
+```
+
+Filtering:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformIterator, Fn, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsVpcIpamPoolCidrs } from "./.gen/providers/aws/data-aws-vpc-ipam-pool-cidrs";
+import { Ec2ManagedPrefixList } from "./.gen/providers/aws/ec2-managed-prefix-list";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const c = new DataAwsVpcIpamPoolCidrs(this, "c", {
+      filter: [
+        {
+          name: "cidr",
+          values: ["10.*"],
+        },
+      ],
+      ipamPoolId: "ipam-pool-123",
+    });
+    const mycidrs =
+      "${[ for cidr in ${" +
+      c.ipamPoolCidrs +
+      '} : cidr.cidr if cidr.state == "provisioned"]}';
+    /*In most cases loops should be handled in the programming language context and 
+    not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+    you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+    you need to keep this like it is.*/
+    const plsDynamicIterator0 = TerraformIterator.fromList(
+      Token.asAny(mycidrs)
+    );
+    new Ec2ManagedPrefixList(this, "pls", {
+      addressFamily: "IPv4",
+      maxEntries: Token.asNumber(Fn.lengthOf(mycidrs)),
+      name: "IPAM Pool (${" + test.id + "}) Cidrs",
+      entry: plsDynamicIterator0.dynamic({
+        cidr: plsDynamicIterator0.value,
+        description: plsDynamicIterator0.value,
+      }),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The arguments of this data source act as filters for querying the available
+VPCs in the current region. The given filters must match exactly one
+VPC whose data will be exported as attributes.
+
+* `ipamPoolId` - ID of the IPAM pool you would like the list of provisioned CIDRs.
+* `filter` - Custom filter block as described below.
+
+## Attribute Reference
+
+All of the argument attributes except `filter` blocks are also exported as
+result attributes. This data source will complete the data by populating
+any fields that are not included in the configuration with the data for
+the selected IPAM Pool CIDRs.
+
+The following attribute is additionally exported:
+
+* `ipamPoolCidrs` - The CIDRs provisioned into the IPAM pool, described below.
+
+### ipam_pool_cidrs
+
+* `cidr` - A network CIDR.
+* `state` - The provisioning state of that CIDR.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `1M`)
+
+<!-- cache-key: cdktf-0.18.0 input-b9fe0569a3bb59535a5bd318b59bb8f37d4a198fb5bfa62af131cfaa8ffd8980 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/vpc_ipam_pools.html.markdown b/website/docs/cdktf/typescript/d/vpc_ipam_pools.html.markdown
new file mode 100644
index 00000000000..f3d4128e2bd
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/vpc_ipam_pools.html.markdown
@@ -0,0 +1,88 @@
+---
+subcategory: "VPC IPAM (IP Address Manager)"
+layout: "aws"
+page_title: "AWS: aws_vpc_ipam_pools"
+description: |-
+    Returns details about IPAM pools that match the search parameters provided.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_vpc_ipam_pools
+
+`awsVpcIpamPools` provides details about IPAM pools.
+
+This resource can prove useful when IPAM pools are created in another root
+module and you need the pool ids as input variables. For example, pools
+can be shared via RAM and used to create vpcs with CIDRs from that pool.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsVpcIpamPools } from "./.gen/providers/aws/data-aws-vpc-ipam-pools";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsVpcIpamPools(this, "test", {
+      filter: [
+        {
+          name: "description",
+          values: ["*test*"],
+        },
+        {
+          name: "address-family",
+          values: ["ipv4"],
+        },
+      ],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The arguments of this data source act as filters for querying the available
+IPAM Pools in the current region.
+
+* `filter` - (Required) Custom filter block as described below.
+
+### filter
+
+* `name` - (Required) The name of the filter. Filter names are case-sensitive.
+* `values` - (Required) The filter values. Filter values are case-sensitive.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `ipamPools` - List of IPAM pools and their attributes. See below for details
+
+### ipam_pools
+
+The following attributes are available on each pool entry found.
+
+* `addressFamily` - IP protocol assigned to this pool.
+* `allocationDefaultNetmaskLength` - A default netmask length for allocations added to this pool. If, for example, the CIDR assigned to this pool is `10000/8` and you enter 16 here, new allocations will default to `10000/16`.
+* `allocationMaxNetmaskLength` - The maximum netmask length that will be required for CIDR allocations in this pool.
+* `allocationMinNetmaskLength` - The minimum netmask length that will be required for CIDR allocations in this pool.
+* `allocationResourceTags` - Tags that are required to create resources in using this pool.
+* `arn` - ARN of the pool
+* `autoImport` - If enabled, IPAM will continuously look for resources within the CIDR range of this pool and automatically import them as allocations into your IPAM.
+* `awsService` - Limits which service in AWS that the pool can be used in. `ec2` for example, allows users to use space for Elastic IP addresses and VPCs.
+* `description` - Description for the IPAM pool.
+* `id` - ID of the IPAM pool.
+* `ipamScopeId` - ID of the scope the pool belongs to.
+* `locale` - Locale is the Region where your pool is available for allocations. You can only create pools with locales that match the operating Regions of the IPAM. You can only create VPCs from a pool whose locale matches the VPC's Region.
+* `publiclyAdvertisable` - Defines whether or not IPv6 pool space is publicly advertisable over the internet.
+* `sourceIpamPoolId` - ID of the source IPAM pool.
+* `tags` - Map of tags to assigned to the resource.
+
+<!-- cache-key: cdktf-0.18.0 input-0f25f29b8da73a8eab1f57b2d6fd05fbdbacc033fa3a351d8ef07553310a8208 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/vpc_ipam_preview_next_cidr.html.markdown b/website/docs/cdktf/typescript/d/vpc_ipam_preview_next_cidr.html.markdown
new file mode 100644
index 00000000000..4b42aaad8a9
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/vpc_ipam_preview_next_cidr.html.markdown
@@ -0,0 +1,78 @@
+---
+subcategory: "VPC IPAM (IP Address Manager)"
+layout: "aws"
+page_title: "AWS: aws_vpc_ipam_preview_next_cidr"
+description: |-
+  Previews a CIDR from an IPAM address pool.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_vpc_ipam_preview_next_cidr
+
+Previews a CIDR from an IPAM address pool. Only works for private IPv4.
+
+~> **NOTE:** This functionality is also encapsulated in a resource sharing the same name. The data source can be used when you need to use the cidr in a calculation of the same Root module, `count` for example. However, once a cidr range has been allocated that was previewed, the next refresh will find a **new** cidr and may force new resources downstream. Make sure to use Terraform's lifecycle `ignoreChanges` policy if this is undesirable.
+
+## Example Usage
+
+Basic usage:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsVpcIpamPreviewNextCidr } from "./.gen/providers/aws/data-aws-vpc-ipam-preview-next-cidr";
+import { VpcIpamPoolCidrAllocation } from "./.gen/providers/aws/vpc-ipam-pool-cidr-allocation";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const test = new DataAwsVpcIpamPreviewNextCidr(this, "test", {
+      dependsOn: [awsVpcIpamPoolCidrTest],
+      ipamPoolId: Token.asString(awsVpcIpamPoolTest.id),
+      netmaskLength: 28,
+    });
+    const awsVpcIpamPoolCidrAllocationTest = new VpcIpamPoolCidrAllocation(
+      this,
+      "test_1",
+      {
+        cidr: Token.asString(test.cidr),
+        ipamPoolId: Token.asString(awsVpcIpamPoolTest.id),
+        lifecycle: {
+          ignoreChanges: [cidr],
+        },
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsVpcIpamPoolCidrAllocationTest.overrideLogicalId("test");
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `disallowedCidrs` - (Optional) Exclude a particular CIDR range from being returned by the pool.
+* `ipamPoolId` - (Required) ID of the pool to which you want to assign a CIDR.
+* `netmaskLength` - (Optional) Netmask length of the CIDR you would like to preview from the IPAM pool.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `cidr` - Previewed CIDR from the pool.
+* `id` - ID of the preview.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `20M`)
+
+<!-- cache-key: cdktf-0.18.0 input-dd816317496f53d47089ea622a6d2495e074267b1372edce322e33a4007d026b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/vpc_peering_connection.html.markdown b/website/docs/cdktf/typescript/d/vpc_peering_connection.html.markdown
new file mode 100644
index 00000000000..c986533fcb4
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/vpc_peering_connection.html.markdown
@@ -0,0 +1,117 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_vpc_peering_connection"
+description: |-
+    Provides details about a specific VPC peering connection.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_vpc_peering_connection
+
+The VPC Peering Connection data source provides details about
+a specific VPC peering connection.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsVpcPeeringConnection } from "./.gen/providers/aws/data-aws-vpc-peering-connection";
+import { Route } from "./.gen/providers/aws/route";
+import { RouteTable } from "./.gen/providers/aws/route-table";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const rt = new RouteTable(this, "rt", {
+      vpcId: foo.id,
+    });
+    const pc = new DataAwsVpcPeeringConnection(this, "pc", {
+      peerCidrBlock: "10.0.1.0/22",
+      vpcId: foo.id,
+    });
+    new Route(this, "r", {
+      destinationCidrBlock: Token.asString(pc.peerCidrBlock),
+      routeTableId: rt.id,
+      vpcPeeringConnectionId: Token.asString(pc.id),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The arguments of this data source act as filters for querying the available VPC peering connection.
+The given filters must match exactly one VPC peering connection whose data will be exported as attributes.
+
+* `id` - (Optional) ID of the specific VPC Peering Connection to retrieve.
+
+* `status` - (Optional) Status of the specific VPC Peering Connection to retrieve.
+
+* `vpcId` - (Optional) ID of the requester VPC of the specific VPC Peering Connection to retrieve.
+
+* `ownerId` - (Optional) AWS account ID of the owner of the requester VPC of the specific VPC Peering Connection to retrieve.
+
+* `cidrBlock` - (Optional) Primary CIDR block of the requester VPC of the specific VPC Peering Connection to retrieve.
+
+* `region` - (Optional) Region of the requester VPC of the specific VPC Peering Connection to retrieve.
+
+* `peerVpcId` - (Optional) ID of the accepter VPC of the specific VPC Peering Connection to retrieve.
+
+* `peerOwnerId` - (Optional) AWS account ID of the owner of the accepter VPC of the specific VPC Peering Connection to retrieve.
+
+* `peerCidrBlock` - (Optional) Primary CIDR block of the accepter VPC of the specific VPC Peering Connection to retrieve.
+
+* `peerRegion` - (Optional) Region of the accepter VPC of the specific VPC Peering Connection to retrieve.
+
+* `filter` - (Optional) Custom filter block as described below.
+
+* `tags` - (Optional) Map of tags, each pair of which must exactly match
+  a pair on the desired VPC Peering Connection.
+
+More complex filters can be expressed using one or more `filter` sub-blocks,
+which take the following arguments:
+
+* `name` - (Required) Name of the field to filter by, as defined by
+  [the underlying AWS API](http://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeVpcPeeringConnections.html).
+
+* `values` - (Required) Set of values that are accepted for the given field.
+  A VPC Peering Connection will be selected if any one of the given values matches.
+
+## Attribute Reference
+
+All of the argument attributes except `filter` are also exported as result attributes.
+
+* `accepter` - Configuration block that describes [VPC Peering Connection]
+(https://docs.aws.amazon.com/vpc/latest/peering/what-is-vpc-peering.html) options set for the accepter VPC.
+
+* `cidrBlockSet` - List of objects with CIDR blocks of the requester VPC.
+
+* `peerCidrBlockSet` - List of objects with CIDR blocks of the accepter VPC.
+
+* `requester` - Configuration block that describes [VPC Peering Connection]
+(https://docs.aws.amazon.com/vpc/latest/peering/what-is-vpc-peering.html) options set for the requester VPC.
+
+#### Accepter and Requester Attribute Reference
+
+* `allowRemoteVpcDnsResolution` - Indicates whether a local VPC can resolve public DNS hostnames to
+private IP addresses when queried from instances in a peer VPC.
+
+#### CIDR block set Attribute Reference
+
+* `cidrBlock` - CIDR block associated to the VPC of the specific VPC Peering Connection.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `20M`)
+
+<!-- cache-key: cdktf-0.18.0 input-b38a9587aaca2300c795e51ead64f4c57e57a85ac3044ada5792edf97aa88b1a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/vpc_peering_connections.html.markdown b/website/docs/cdktf/typescript/d/vpc_peering_connections.html.markdown
new file mode 100644
index 00000000000..afc9b4b90db
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/vpc_peering_connections.html.markdown
@@ -0,0 +1,87 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_vpc_peering_connections"
+description: |-
+    Lists peering connections
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_vpc_peering_connections
+
+Use this data source to get IDs of Amazon VPC peering connections
+To get more details on each connection, use the data resource [aws_vpc_peering_connection](/docs/providers/aws/d/vpc_peering_connection.html)
+
+Note: To use this data source in a count, the resources should exist before trying to access
+the data source, as noted in [issue 4149](https://github.com/hashicorp/terraform/issues/4149)
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformCount, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsVpcPeeringConnection } from "./.gen/providers/aws/data-aws-vpc-peering-connection";
+import { DataAwsVpcPeeringConnections } from "./.gen/providers/aws/data-aws-vpc-peering-connections";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const pcs = new DataAwsVpcPeeringConnections(this, "pcs", {
+      filter: [
+        {
+          name: "requester-vpc-info.vpc-id",
+          values: [foo.id],
+        },
+      ],
+    });
+    /*In most cases loops should be handled in the programming language context and 
+    not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+    you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+    you need to keep this like it is.*/
+    const pcCount = TerraformCount.of(Token.asNumber(Fn.lengthOf(pcs.ids)));
+    new DataAwsVpcPeeringConnection(this, "pc", {
+      id: Token.asString(Fn.lookupNested(pcs.ids, [pcCount.index])),
+      count: pcCount,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The arguments of this data source act as filters for querying the available VPC peering connections.
+
+* `filter` - (Optional) Custom filter block as described below.
+
+* `tags` - (Optional) Mapping of tags, each pair of which must exactly match
+  a pair on the desired VPC Peering Connection.
+
+More complex filters can be expressed using one or more `filter` sub-blocks,
+which take the following arguments:
+
+* `name` - (Required) Name of the field to filter by, as defined by
+  [the underlying AWS API](http://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeVpcPeeringConnections.html).
+
+* `values` - (Required) Set of values that are accepted for the given field.
+  A VPC Peering Connection will be selected if any one of the given values matches.
+
+## Attribute Reference
+
+All of the argument attributes except `filter` are also exported as result attributes.
+
+* `id` - AWS Region.
+* `ids` - IDs of the VPC Peering Connections.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `20M`)
+
+<!-- cache-key: cdktf-0.18.0 input-a9c5018aed4e1e6786cc7bb5dd8607ab1c1d2ea0787591a3d91d06ccfee33928 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/vpc_security_group_rule.html.markdown b/website/docs/cdktf/typescript/d/vpc_security_group_rule.html.markdown
new file mode 100644
index 00000000000..d1333e37b20
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/vpc_security_group_rule.html.markdown
@@ -0,0 +1,70 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_vpc_security_group_rule"
+description: |-
+    Provides details about a specific security group rule
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_vpc_security_group_rule
+
+`awsVpcSecurityGroupRule` provides details about a specific security group rule.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsVpcSecurityGroupRule } from "./.gen/providers/aws/data-aws-vpc-security-group-rule";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsVpcSecurityGroupRule(this, "example", {
+      securityGroupRuleId: securityGroupRuleId.stringValue,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The arguments of this data source act as filters for querying the available
+security group rules. The given filters must match exactly one security group rule
+whose data will be exported as attributes.
+
+* `securityGroupRuleId` - (Optional) ID of the security group rule to select.
+* `filter` - (Optional) Configuration block(s) for filtering. Detailed below.
+
+### filter Configuration Block
+
+The `filter` configuration block supports the following arguments:
+
+* `name` - (Required) Name of the filter field. Valid values can be found in the EC2 [`describeSecurityGroupRules`](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeSecurityGroupRules.html) API Reference.
+* `values` - (Required) Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the security group rule.
+* `cidrIpv4` - The destination IPv4 CIDR range.
+* `cidrIpv6` - The destination IPv6 CIDR range.
+* `description` - The security group rule description.
+* `fromPort` - The start of port range for the TCP and UDP protocols, or an ICMP/ICMPv6 type.
+* `isEgress` - Indicates whether the security group rule is an outbound rule.
+* `ipProtocol` - The IP protocol name or number. Use `1` to specify all protocols.
+* `prefixListId` - The ID of the destination prefix list.
+* `referencedSecurityGroupId` - The destination security group that is referenced in the rule.
+* `securityGroupId` - The ID of the security group.
+* `tags` - A map of tags assigned to the resource.
+* `toPort` - (Optional) The end of port range for the TCP and UDP protocols, or an ICMP/ICMPv6 code.
+
+<!-- cache-key: cdktf-0.18.0 input-60bbadf919e19a6b86244afce1efa5865475dc66aa0bf2f6b2d6643a6824df84 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/vpc_security_group_rules.html.markdown b/website/docs/cdktf/typescript/d/vpc_security_group_rules.html.markdown
new file mode 100644
index 00000000000..ca87441d2e8
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/vpc_security_group_rules.html.markdown
@@ -0,0 +1,62 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_vpc_security_group_rules"
+description: |-
+    Get information about a set of security group rules.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_vpc_security_group_rules
+
+This resource can be useful for getting back a set of security group rule IDs.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsVpcSecurityGroupRules } from "./.gen/providers/aws/data-aws-vpc-security-group-rules";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsVpcSecurityGroupRules(this, "example", {
+      filter: [
+        {
+          name: "group-id",
+          values: [securityGroupId.stringValue],
+        },
+      ],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `filter` - (Optional) Custom filter block as described below.
+* `tags` - (Optional) Map of tags, each pair of which must exactly match
+  a pair on the desired security group rule.
+
+More complex filters can be expressed using one or more `filter` sub-blocks,
+which take the following arguments:
+
+* `name` - (Required) Name of the field to filter by, as defined by
+  [the underlying AWS API](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeSecurityGroupRules.html).
+* `values` - (Required) Set of values that are accepted for the given field.
+  Security group rule IDs will be selected if any one of the given values match.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `ids` - List of all the security group rule IDs found.
+
+<!-- cache-key: cdktf-0.18.0 input-87719c79ae2f1f4c5613b3ccab85a172f42cc7b1318d60caecef6a1733d22344 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/vpclattice_auth_policy.html.markdown b/website/docs/cdktf/typescript/d/vpclattice_auth_policy.html.markdown
new file mode 100644
index 00000000000..c3975900164
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/vpclattice_auth_policy.html.markdown
@@ -0,0 +1,54 @@
+---
+subcategory: "VPC Lattice"
+layout: "aws"
+page_title: "AWS: aws_vpclattice_auth_policy"
+description: |-
+  Terraform data source for managing an AWS VPC Lattice Auth Policy.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_vpclattice_auth_policy
+
+Terraform data source for managing an AWS VPC Lattice Auth Policy.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsVpclatticeAuthPolicy } from "./.gen/providers/aws/data-aws-vpclattice-auth-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsVpclatticeAuthPolicy(this, "test", {
+      resourceIdentifier: Token.asString(
+        awsVpclatticeAuthPolicyTest.resourceIdentifier
+      ),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `resourceIdentifier` - (Required) The ID or Amazon Resource Name (ARN) of the service network or service for which the policy is created.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `policy` - The auth policy. The policy string in JSON must not contain newlines or blank lines.
+* `state` - The state of the auth policy. The auth policy is only active when the auth type is set to AWS_IAM. If you provide a policy, then authentication and authorization decisions are made based on this policy and the client's IAM policy. If the Auth type is NONE, then, any auth policy you provide will remain inactive.
+
+<!-- cache-key: cdktf-0.18.0 input-1a9e7f339073e21595c69c5c150562d38d28dfc83382761a10ef529f50b9408a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/vpclattice_listener.html.markdown b/website/docs/cdktf/typescript/d/vpclattice_listener.html.markdown
new file mode 100644
index 00000000000..f91ef903a87
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/vpclattice_listener.html.markdown
@@ -0,0 +1,67 @@
+---
+subcategory: "VPC Lattice"
+layout: "aws"
+page_title: "AWS: aws_vpclattice_listener"
+description: |-
+  Terraform data source for managing an AWS VPC Lattice Listener.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_vpclattice_listener
+
+Terraform data source for managing an AWS VPC Lattice Listener.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsVpclatticeListener } from "./.gen/providers/aws/data-aws-vpclattice-listener";
+interface MyConfig {
+  listenerIdentifier: any;
+  serviceIdentifier: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new DataAwsVpclatticeListener(this, "example", {
+      listenerIdentifier: config.listenerIdentifier,
+      serviceIdentifier: config.serviceIdentifier,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `serviceIdentifier` - (Required) ID or Amazon Resource Name (ARN) of the service network
+* `listenerIdentifier` - (Required) ID or Amazon Resource Name (ARN) of the listener
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the listener.
+* `createdAt` - The date and time that the listener was created.
+* `defaultAction` - The actions for the default listener rule.
+* `lastUpdatedAt` - The date and time the listener was last updated.
+* `listenerId` - The ID of the listener.
+* `name` - The name of the listener.
+* `port` - The listener port.
+* `protocol` - The listener protocol. Either `https` or `http`.
+* `serviceArn` - The ARN of the service.
+* `serviceId` - The ID of the service.
+* `tags` - List of tags associated with the listener.
+
+<!-- cache-key: cdktf-0.18.0 input-4a687c57ad29c134d46fc404c1c41b48da0292cbf1e1dd8120398bdb458ec84c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/vpclattice_resource_policy.html.markdown b/website/docs/cdktf/typescript/d/vpclattice_resource_policy.html.markdown
new file mode 100644
index 00000000000..801ba4af71e
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/vpclattice_resource_policy.html.markdown
@@ -0,0 +1,51 @@
+---
+subcategory: "VPC Lattice"
+layout: "aws"
+page_title: "AWS: aws_vpclattice_resource_policy"
+description: |-
+  Terraform data source for managing an AWS VPC Lattice Resource Policy.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_vpclattice_resource_policy
+
+Terraform data source for managing an AWS VPC Lattice Resource Policy.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsVpclatticeResourcePolicy } from "./.gen/providers/aws/data-aws-vpclattice-resource-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsVpclatticeResourcePolicy(this, "example", {
+      resourceArn: Token.asString(awsVpclatticeServiceNetworkExample.arn),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `resourceArn` - (Required) Resource ARN of the resource for which a policy is retrieved.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `policy` - JSON-encoded string representation of the applied resource policy.
+
+<!-- cache-key: cdktf-0.18.0 input-8bbfef254a190e7f80aa5a7e593ea739d64afa50ba608c823c8b66809a5ca7a5 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/vpclattice_service.html.markdown b/website/docs/cdktf/typescript/d/vpclattice_service.html.markdown
new file mode 100644
index 00000000000..8eb5349116d
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/vpclattice_service.html.markdown
@@ -0,0 +1,60 @@
+---
+subcategory: "VPC Lattice"
+layout: "aws"
+page_title: "AWS: aws_vpclattice_service"
+description: |-
+  Terraform data source for managing an AWS VPC Lattice Service.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_vpclattice_service
+
+Terraform data source for managing an AWS VPC Lattice Service.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsVpclatticeService } from "./.gen/providers/aws/data-aws-vpclattice-service";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsVpclatticeService(this, "example", {
+      name: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The arguments of this data source act as filters for querying the available VPC lattice services.
+The given filters must match exactly one VPC lattice service whose data will be exported as attributes.
+
+* `name` - (Optional) Service name.
+* `serviceIdentifier` - (Optional) ID or Amazon Resource Name (ARN) of the service.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the service.
+* `authType` - Type of IAM policy. Either `none` or `awsIam`.
+* `certificateArn` - Amazon Resource Name (ARN) of the certificate.
+* `customDomainName` - Custom domain name of the service.
+* `dnsEntry` - DNS name of the service.
+* `id` - Unique identifier for the service.
+* `status` - Status of the service.
+* `tags` - List of tags associated with the service.
+
+<!-- cache-key: cdktf-0.18.0 input-7b6870621548d47b2268852ea64bf86123c019e6fafbc3bb70238634ddfbd625 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/vpclattice_service_network.html.markdown b/website/docs/cdktf/typescript/d/vpclattice_service_network.html.markdown
new file mode 100644
index 00000000000..3c3fc22f164
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/vpclattice_service_network.html.markdown
@@ -0,0 +1,58 @@
+---
+subcategory: "VPC Lattice"
+layout: "aws"
+page_title: "AWS: aws_vpclattice_service_network"
+description: |-
+  Terraform data source for managing an AWS VPC Lattice Service Network.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_vpclattice_service_network
+
+Terraform data source for managing an AWS VPC Lattice Service Network.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsVpclatticeServiceNetwork } from "./.gen/providers/aws/data-aws-vpclattice-service-network";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsVpclatticeServiceNetwork(this, "example", {
+      serviceNetworkIdentifier: "snsa-01112223334445556",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `serviceNetworkIdentifier` - (Required) Identifier of the service network.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Service Network.
+* `authType` - Authentication type for the service network. Either `none` or `awsIam`.
+* `createdAt` - Date and time the service network was created.
+* `id` - ID of the service network.
+* `lastUpdatedAt` - Date and time the service network was last updated.
+* `name` - Name of the service network.
+* `numberOfAssociatedServices` - Number of services associated with this service network.
+* `numberOfAssociatedVpcs` - Number of VPCs associated with this service network.
+
+<!-- cache-key: cdktf-0.18.0 input-f4109a8ce33f12e8a0ef307b66a1c9cc873bcdc0d442d07fb6e1314973b2d72a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/vpcs.html.markdown b/website/docs/cdktf/typescript/d/vpcs.html.markdown
new file mode 100644
index 00000000000..ba18f4a519c
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/vpcs.html.markdown
@@ -0,0 +1,137 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_vpcs"
+description: |-
+    Provides a list of VPC Ids in a region
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_vpcs
+
+This resource can be useful for getting back a list of VPC Ids for a region.
+
+The following example retrieves a list of VPC Ids with a custom tag of `service` set to a value of "production".
+
+## Example Usage
+
+The following shows outputting all VPC Ids.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformOutput, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsVpcs } from "./.gen/providers/aws/data-aws-vpcs";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const foo = new DataAwsVpcs(this, "foo", {
+      tags: {
+        service: "production",
+      },
+    });
+    const cdktfTerraformOutputFoo = new TerraformOutput(this, "foo_1", {
+      value: foo.ids,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    cdktfTerraformOutputFoo.overrideLogicalId("foo");
+  }
+}
+
+```
+
+An example use case would be interpolate the `awsVpcs` output into `count` of an aws_flow_log resource.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import {
+  TerraformOutput,
+  Fn,
+  Token,
+  TerraformCount,
+  TerraformStack,
+} from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsVpc } from "./.gen/providers/aws/data-aws-vpc";
+import { DataAwsVpcs } from "./.gen/providers/aws/data-aws-vpcs";
+import { FlowLog } from "./.gen/providers/aws/flow-log";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const foo = new DataAwsVpcs(this, "foo", {});
+    const cdktfTerraformOutputFoo = new TerraformOutput(this, "foo_1", {
+      value: foo.ids,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    cdktfTerraformOutputFoo.overrideLogicalId("foo");
+    /*In most cases loops should be handled in the programming language context and 
+    not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+    you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+    you need to keep this like it is.*/
+    const fooCount = TerraformCount.of(Token.asNumber(Fn.lengthOf(foo.ids)));
+    const dataAwsVpcFoo = new DataAwsVpc(this, "foo_2", {
+      id: Token.asString(Fn.lookupNested(Fn.tolist(foo.ids), [fooCount.index])),
+      count: fooCount,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsVpcFoo.overrideLogicalId("foo");
+    /*In most cases loops should be handled in the programming language context and 
+    not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+    you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+    you need to keep this like it is.*/
+    const testFlowLogCount = TerraformCount.of(
+      Token.asNumber(Fn.lengthOf(foo.ids))
+    );
+    new FlowLog(this, "test_flow_log", {
+      vpcId: Token.asString(
+        Fn.lookupNested(
+          Fn.lookupNested(dataAwsVpcFoo, [testFlowLogCount.index]),
+          ["id"]
+        )
+      ),
+      count: testFlowLogCount,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `tags` - (Optional) Map of tags, each pair of which must exactly match
+  a pair on the desired vpcs.
+
+* `filter` - (Optional) Custom filter block as described below.
+
+More complex filters can be expressed using one or more `filter` sub-blocks,
+which take the following arguments:
+
+* `name` - (Required) Name of the field to filter by, as defined by
+  [the underlying AWS API](http://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeVpcs.html).
+
+* `values` - (Required) Set of values that are accepted for the given field.
+  A VPC will be selected if any one of the given values matches.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - AWS Region.
+* `ids` - List of all the VPC Ids found.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `20M`)
+
+<!-- cache-key: cdktf-0.18.0 input-be6a21066a3ec54cb0732f1d95589ca403b257a294348dbb989f92e860fb3744 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/vpn_gateway.html.markdown b/website/docs/cdktf/typescript/d/vpn_gateway.html.markdown
new file mode 100644
index 00000000000..4d586050d73
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/vpn_gateway.html.markdown
@@ -0,0 +1,85 @@
+---
+subcategory: "VPN (Site-to-Site)"
+layout: "aws"
+page_title: "AWS: aws_vpn_gateway"
+description: |-
+    Provides details about a specific VPN gateway.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_vpn_gateway
+
+The VPN Gateway data source provides details about
+a specific VPN gateway.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformOutput, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsVpnGateway } from "./.gen/providers/aws/data-aws-vpn-gateway";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const selected = new DataAwsVpnGateway(this, "selected", {
+      filter: [
+        {
+          name: "tag:Name",
+          values: ["vpn-gw"],
+        },
+      ],
+    });
+    new TerraformOutput(this, "vpn_gateway_id", {
+      value: selected.id,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The arguments of this data source act as filters for querying the available VPN gateways.
+The given filters must match exactly one VPN gateway whose data will be exported as attributes.
+
+* `id` - (Optional) ID of the specific VPN Gateway to retrieve.
+
+* `state` - (Optional) State of the specific VPN Gateway to retrieve.
+
+* `availabilityZone` - (Optional) Availability Zone of the specific VPN Gateway to retrieve.
+
+* `attachedVpcId` - (Optional) ID of a VPC attached to the specific VPN Gateway to retrieve.
+
+* `filter` - (Optional) Custom filter block as described below.
+
+* `tags` - (Optional) Map of tags, each pair of which must exactly match
+  a pair on the desired VPN Gateway.
+
+* `amazonSideAsn` - (Optional) Autonomous System Number (ASN) for the Amazon side of the specific VPN Gateway to retrieve.
+
+More complex filters can be expressed using one or more `filter` sub-blocks,
+which take the following arguments:
+
+* `name` - (Required) Name of the field to filter by, as defined by
+  [the underlying AWS API](http://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeVpnGateways.html).
+
+* `values` - (Required) Set of values that are accepted for the given field.
+  A VPN Gateway will be selected if any one of the given values matches.
+
+## Attribute Reference
+
+All of the argument attributes are also exported as result attributes.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `20M`)
+
+<!-- cache-key: cdktf-0.18.0 input-201be9d39d8341a8d96efb3b53da93d78c8ce2b555effb2685f5ba9809677802 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/waf_ipset.html.markdown b/website/docs/cdktf/typescript/d/waf_ipset.html.markdown
new file mode 100644
index 00000000000..02f2d9cff70
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/waf_ipset.html.markdown
@@ -0,0 +1,49 @@
+---
+subcategory: "WAF Classic"
+layout: "aws"
+page_title: "AWS: aws_waf_ipset"
+description: |-
+  Retrieves an AWS WAF IP set id.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_waf_ipset
+
+`awsWafIpset` Retrieves a WAF IP Set Resource Id.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsWafIpset } from "./.gen/providers/aws/data-aws-waf-ipset";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsWafIpset(this, "example", {
+      name: "tfWAFIPSet",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name of the WAF IP set.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the WAF IP set.
+
+<!-- cache-key: cdktf-0.18.0 input-94305640b0471bb774be2d17cd0306bf77a551e4516c629668c09de87293f751 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/waf_rate_based_rule.html.markdown b/website/docs/cdktf/typescript/d/waf_rate_based_rule.html.markdown
new file mode 100644
index 00000000000..dbfa4cef072
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/waf_rate_based_rule.html.markdown
@@ -0,0 +1,49 @@
+---
+subcategory: "WAF Classic"
+layout: "aws"
+page_title: "AWS: aws_waf_rate_based_rule"
+description: |-
+  Retrieves an AWS WAF rate based rule id.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_waf_rate_based_rule
+
+`awsWafRateBasedRule` Retrieves a WAF Rate Based Rule Resource Id.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsWafRateBasedRule } from "./.gen/providers/aws/data-aws-waf-rate-based-rule";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsWafRateBasedRule(this, "example", {
+      name: "tfWAFRateBasedRule",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name of the WAF rate based rule.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the WAF rate based rule.
+
+<!-- cache-key: cdktf-0.18.0 input-1b97312af7abdeb1a6510cdfa99485977c9509827c5322840ee31acdc07433ed -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/waf_rule.html.markdown b/website/docs/cdktf/typescript/d/waf_rule.html.markdown
new file mode 100644
index 00000000000..37ac5eff132
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/waf_rule.html.markdown
@@ -0,0 +1,49 @@
+---
+subcategory: "WAF Classic"
+layout: "aws"
+page_title: "AWS: aws_waf_rule"
+description: |-
+  Retrieves an AWS WAF rule id.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_waf_rule
+
+`awsWafRule` Retrieves a WAF Rule Resource Id.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsWafRule } from "./.gen/providers/aws/data-aws-waf-rule";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsWafRule(this, "example", {
+      name: "tfWAFRule",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name of the WAF rule.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the WAF rule.
+
+<!-- cache-key: cdktf-0.18.0 input-622f6e79a1da04607bbd486ece4ccfcdc4d3399df37f97810cbcfe6990f9931d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/waf_subscribed_rule_group.html.markdown b/website/docs/cdktf/typescript/d/waf_subscribed_rule_group.html.markdown
new file mode 100644
index 00000000000..c0ea2db2d1f
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/waf_subscribed_rule_group.html.markdown
@@ -0,0 +1,80 @@
+---
+subcategory: "WAF Classic"
+layout: "aws"
+page_title: "AWS: aws_waf_subscribed_rule_group"
+description: |-
+  Retrieves information about a Managed WAF Rule Group from AWS Marketplace.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_waf_rule
+
+`awsWafSubscribedRuleGroup` retrieves information about a Managed WAF Rule Group from AWS Marketplace (needs to be subscribed to first).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsWafSubscribedRuleGroup } from "./.gen/providers/aws/data-aws-waf-subscribed-rule-group";
+import { WafWebAcl } from "./.gen/providers/aws/waf-web-acl";
+interface MyConfig {
+  defaultAction: any;
+  metricName: any;
+  name: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    const byMetricName = new DataAwsWafSubscribedRuleGroup(
+      this,
+      "by_metric_name",
+      {
+        metricName: "F5BotDetectionSignatures",
+      }
+    );
+    const byName = new DataAwsWafSubscribedRuleGroup(this, "by_name", {
+      name: "F5 Bot Detection Signatures For AWS WAF",
+    });
+    new WafWebAcl(this, "acl", {
+      rules: [
+        {
+          priority: 1,
+          ruleId: Token.asString(byName.id),
+          type: "GROUP",
+        },
+        {
+          priority: 2,
+          ruleId: Token.asString(byMetricName.id),
+          type: "GROUP",
+        },
+      ],
+      defaultAction: config.defaultAction,
+      metricName: config.metricName,
+      name: config.name,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments: (at least one needs to be specified)
+
+* `name` - (Optional) Name of the WAF rule group.
+* `metricName` - (Optional) Name of the WAF rule group.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the WAF rule group.
+
+<!-- cache-key: cdktf-0.18.0 input-00a62e9c864ee7ccf92e3ef224d8f2eba8db0a1386389825ac9c6ed11e482193 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/waf_web_acl.html.markdown b/website/docs/cdktf/typescript/d/waf_web_acl.html.markdown
new file mode 100644
index 00000000000..b464c328315
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/waf_web_acl.html.markdown
@@ -0,0 +1,49 @@
+---
+subcategory: "WAF Classic"
+layout: "aws"
+page_title: "AWS: aws_waf_web_acl"
+description: |-
+  Retrieves a WAF Web ACL id.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_waf_web_acl
+
+`awsWafWebAcl` Retrieves a WAF Web ACL Resource Id.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsWafWebAcl } from "./.gen/providers/aws/data-aws-waf-web-acl";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsWafWebAcl(this, "example", {
+      name: "tfWAFWebACL",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name of the WAF Web ACL.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the WAF Web ACL.
+
+<!-- cache-key: cdktf-0.18.0 input-d097cc64235699a72862520fb07194eebd805ec1ae4dcf4ceff43f0fb78e0e97 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/wafregional_ipset.html.markdown b/website/docs/cdktf/typescript/d/wafregional_ipset.html.markdown
new file mode 100644
index 00000000000..d6a8e32de86
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/wafregional_ipset.html.markdown
@@ -0,0 +1,49 @@
+---
+subcategory: "WAF Classic Regional"
+layout: "aws"
+page_title: "AWS: aws_wafregional_ipset"
+description: |-
+  Retrieves an AWS WAF Regional IP set id.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_wafregional_ipset
+
+`awsWafregionalIpset` Retrieves a WAF Regional IP Set Resource Id.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsWafregionalIpset } from "./.gen/providers/aws/data-aws-wafregional-ipset";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsWafregionalIpset(this, "example", {
+      name: "tfWAFRegionalIPSet",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name of the WAF Regional IP set.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the WAF Regional IP set.
+
+<!-- cache-key: cdktf-0.18.0 input-664f0bcba2f0944a9bce4e4470bb1ca32f51d08df3ea85f50476a45145d90105 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/wafregional_rate_based_rule.html.markdown b/website/docs/cdktf/typescript/d/wafregional_rate_based_rule.html.markdown
new file mode 100644
index 00000000000..533712bd068
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/wafregional_rate_based_rule.html.markdown
@@ -0,0 +1,49 @@
+---
+subcategory: "WAF Classic Regional"
+layout: "aws"
+page_title: "AWS: aws_wafregional_rate_based_rule"
+description: |-
+  Retrieves an AWS WAF Regional rate based rule id.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_wafregional_rate_based_rule
+
+`awsWafregionalRateBasedRule` Retrieves a WAF Regional Rate Based Rule Resource Id.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsWafregionalRateBasedRule } from "./.gen/providers/aws/data-aws-wafregional-rate-based-rule";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsWafregionalRateBasedRule(this, "example", {
+      name: "tfWAFRegionalRateBasedRule",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name of the WAF Regional rate based rule.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the WAF Regional rate based rule.
+
+<!-- cache-key: cdktf-0.18.0 input-4efc48cfee1f2c7a8f4f34e4fbb2f4523a05a710c88547ac3014e9d0ff52a993 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/wafregional_rule.html.markdown b/website/docs/cdktf/typescript/d/wafregional_rule.html.markdown
new file mode 100644
index 00000000000..2e8114f76d0
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/wafregional_rule.html.markdown
@@ -0,0 +1,49 @@
+---
+subcategory: "WAF Classic Regional"
+layout: "aws"
+page_title: "AWS: aws_wafregional_rule"
+description: |-
+  Retrieves an AWS WAF Regional rule id.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_wafregional_rule
+
+`awsWafregionalRule` Retrieves a WAF Regional Rule Resource Id.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsWafregionalRule } from "./.gen/providers/aws/data-aws-wafregional-rule";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsWafregionalRule(this, "example", {
+      name: "tfWAFRegionalRule",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name of the WAF Regional rule.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the WAF Regional rule.
+
+<!-- cache-key: cdktf-0.18.0 input-8d1cf5dbf5c7c6a32f1f53f110f8770eb6472cb6316958e0e40be72dbcb9dad8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/wafregional_subscribed_rule_group.html.markdown b/website/docs/cdktf/typescript/d/wafregional_subscribed_rule_group.html.markdown
new file mode 100644
index 00000000000..8ab40906a6a
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/wafregional_subscribed_rule_group.html.markdown
@@ -0,0 +1,80 @@
+---
+subcategory: "WAF Classic Regional"
+layout: "aws"
+page_title: "AWS: aws_wafregional_subscribed_rule_group"
+description: |-
+  retrieves information about a Managed WAF Rule Group from AWS Marketplace for use in WAF Regional.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_wafregional_rule
+
+`awsWafregionalSubscribedRuleGroup` retrieves information about a Managed WAF Rule Group from AWS Marketplace for use in WAF Regional (needs to be subscribed to first).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsWafregionalSubscribedRuleGroup } from "./.gen/providers/aws/data-aws-wafregional-subscribed-rule-group";
+import { WafregionalWebAcl } from "./.gen/providers/aws/wafregional-web-acl";
+interface MyConfig {
+  defaultAction: any;
+  metricName: any;
+  name: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    const byMetricName = new DataAwsWafregionalSubscribedRuleGroup(
+      this,
+      "by_metric_name",
+      {
+        metricName: "F5BotDetectionSignatures",
+      }
+    );
+    const byName = new DataAwsWafregionalSubscribedRuleGroup(this, "by_name", {
+      name: "F5 Bot Detection Signatures For AWS WAF",
+    });
+    new WafregionalWebAcl(this, "acl", {
+      rules: [
+        {
+          priority: 1,
+          rule_id: byName.id,
+          type: "GROUP",
+        },
+        {
+          priority: 2,
+          rule_id: byMetricName.id,
+          type: "GROUP",
+        },
+      ],
+      defaultAction: config.defaultAction,
+      metricName: config.metricName,
+      name: config.name,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments: (at least one needs to be specified)
+
+* `name` - (Optional) Name of the WAF rule group.
+* `metricName` - (Optional) Name of the WAF rule group.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the WAF rule group.
+
+<!-- cache-key: cdktf-0.18.0 input-bb4b16d18b71e8e90027f29acab3911274775d639a6a27d7a70acb9c6cfb5569 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/wafregional_web_acl.html.markdown b/website/docs/cdktf/typescript/d/wafregional_web_acl.html.markdown
new file mode 100644
index 00000000000..54d251da229
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/wafregional_web_acl.html.markdown
@@ -0,0 +1,49 @@
+---
+subcategory: "WAF Classic Regional"
+layout: "aws"
+page_title: "AWS: aws_wafregional_web_acl"
+description: |-
+  Retrieves a WAF Regional Web ACL id.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_wafregional_web_acl
+
+`awsWafregionalWebAcl` Retrieves a WAF Regional Web ACL Resource Id.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsWafregionalWebAcl } from "./.gen/providers/aws/data-aws-wafregional-web-acl";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsWafregionalWebAcl(this, "example", {
+      name: "tfWAFRegionalWebACL",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name of the WAF Regional Web ACL.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the WAF Regional Web ACL.
+
+<!-- cache-key: cdktf-0.18.0 input-fa2b1a2433b2bd1f14d1f64ae7fa9b7121ac9bea96e36f12426b78a220709ce6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/wafv2_ip_set.html.markdown b/website/docs/cdktf/typescript/d/wafv2_ip_set.html.markdown
new file mode 100644
index 00000000000..84eff276cbd
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/wafv2_ip_set.html.markdown
@@ -0,0 +1,55 @@
+---
+subcategory: "WAF"
+layout: "aws"
+page_title: "AWS: aws_wafv2_ip_set"
+description: |-
+  Retrieves the summary of a WAFv2 IP Set.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_wafv2_ip_set
+
+Retrieves the summary of a WAFv2 IP Set.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsWafv2IpSet } from "./.gen/providers/aws/data-aws-wafv2-ip-set";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsWafv2IpSet(this, "example", {
+      name: "some-ip-set",
+      scope: "REGIONAL",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name of the WAFv2 IP Set.
+* `scope` - (Required) Specifies whether this is for an AWS CloudFront distribution or for a regional application. Valid values are `cloudfront` or `regional`. To work with CloudFront, you must also specify the region `usEast1` (N. Virginia) on the AWS provider.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `addresses` - An array of strings that specifies zero or more IP addresses or blocks of IP addresses in Classless Inter-Domain Routing (CIDR) notation.
+* `arn` - ARN of the entity.
+* `description` - Description of the set that helps with identification.
+* `id` - Unique identifier for the set.
+* `ipAddressVersion` - IP address version of the set.
+
+<!-- cache-key: cdktf-0.18.0 input-d7ec9696daa356516487e670fd980b4d44f0e307cfc20630bd6d1fb8fc4322b0 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/wafv2_regex_pattern_set.html.markdown b/website/docs/cdktf/typescript/d/wafv2_regex_pattern_set.html.markdown
new file mode 100644
index 00000000000..358a586c246
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/wafv2_regex_pattern_set.html.markdown
@@ -0,0 +1,60 @@
+---
+subcategory: "WAF"
+layout: "aws"
+page_title: "AWS: aws_wafv2_regex_pattern_set"
+description: |-
+  Retrieves the summary of a WAFv2 Regex Pattern Set.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_wafv2_regex_pattern_set
+
+Retrieves the summary of a WAFv2 Regex Pattern Set.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsWafv2RegexPatternSet } from "./.gen/providers/aws/data-aws-wafv2-regex-pattern-set";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsWafv2RegexPatternSet(this, "example", {
+      name: "some-regex-pattern-set",
+      scope: "REGIONAL",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name of the WAFv2 Regex Pattern Set.
+* `scope` - (Required) Specifies whether this is for an AWS CloudFront distribution or for a regional application. Valid values are `cloudfront` or `regional`. To work with CloudFront, you must also specify the region `usEast1` (N. Virginia) on the AWS provider.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the entity.
+* `description` - Description of the set that helps with identification.
+* `id` - Unique identifier for the set.
+* `regularExpression` - One or more blocks of regular expression patterns that AWS WAF is searching for. See [Regular Expression](#regular-expression) below for details.
+
+### Regular Expression
+
+Each `regularExpression` supports the following argument:
+
+* `regexString` - (Required) String representing the regular expression, see the AWS WAF [documentation](https://docs.aws.amazon.com/waf/latest/developerguide/waf-regex-pattern-set-creating.html) for more information.
+
+<!-- cache-key: cdktf-0.18.0 input-a646ff63f23c77b2e1c1477a070043fec306e7b9d0c94cd6c0f0b67fafdb28da -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/wafv2_rule_group.html.markdown b/website/docs/cdktf/typescript/d/wafv2_rule_group.html.markdown
new file mode 100644
index 00000000000..b9b1f8acd05
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/wafv2_rule_group.html.markdown
@@ -0,0 +1,53 @@
+---
+subcategory: "WAF"
+layout: "aws"
+page_title: "AWS: aws_wafv2_rule_group"
+description: |-
+  Retrieves the summary of a WAFv2 Rule Group.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_wafv2_rule_group
+
+Retrieves the summary of a WAFv2 Rule Group.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsWafv2RuleGroup } from "./.gen/providers/aws/data-aws-wafv2-rule-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsWafv2RuleGroup(this, "example", {
+      name: "some-rule-group",
+      scope: "REGIONAL",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name of the WAFv2 Rule Group.
+* `scope` - (Required) Specifies whether this is for an AWS CloudFront distribution or for a regional application. Valid values are `cloudfront` or `regional`. To work with CloudFront, you must also specify the region `usEast1` (N. Virginia) on the AWS provider.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the entity.
+* `description` - Description of the rule group that helps with identification.
+* `id` - Unique identifier of the rule group.
+
+<!-- cache-key: cdktf-0.18.0 input-4de733ef434bbfbe5aa4d54ed8db1f5e78db59b5a79986eddb88c9cc5144e9ca -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/wafv2_web_acl.html.markdown b/website/docs/cdktf/typescript/d/wafv2_web_acl.html.markdown
new file mode 100644
index 00000000000..cc115533f9e
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/wafv2_web_acl.html.markdown
@@ -0,0 +1,53 @@
+---
+subcategory: "WAF"
+layout: "aws"
+page_title: "AWS: aws_wafv2_web_acl"
+description: |-
+  Retrieves the summary of a WAFv2 Web ACL.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_wafv2_web_acl
+
+Retrieves the summary of a WAFv2 Web ACL.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsWafv2WebAcl } from "./.gen/providers/aws/data-aws-wafv2-web-acl";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsWafv2WebAcl(this, "example", {
+      name: "some-web-acl",
+      scope: "REGIONAL",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name of the WAFv2 Web ACL.
+* `scope` - (Required) Specifies whether this is for an AWS CloudFront distribution or for a regional application. Valid values are `cloudfront` or `regional`. To work with CloudFront, you must also specify the region `usEast1` (N. Virginia) on the AWS provider.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the entity.
+* `description` - Description of the WebACL that helps with identification.
+* `id` - Unique identifier of the WebACL.
+
+<!-- cache-key: cdktf-0.18.0 input-af626ac3c0fee58373df42af4a4ea59647ddfb9c8a5feb783fe3c2a90de2da07 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/workspaces_bundle.html.markdown b/website/docs/cdktf/typescript/d/workspaces_bundle.html.markdown
new file mode 100644
index 00000000000..ab19e23a9a1
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/workspaces_bundle.html.markdown
@@ -0,0 +1,94 @@
+---
+subcategory: "WorkSpaces"
+layout: "aws"
+page_title: "AWS: aws_workspaces_bundle"
+description: |-
+  Retrieve information about an AWS WorkSpaces bundle.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_workspaces_bundle
+
+Retrieve information about an AWS WorkSpaces bundle.
+
+## Example Usage
+
+### By ID
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsWorkspacesBundle } from "./.gen/providers/aws/data-aws-workspaces-bundle";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsWorkspacesBundle(this, "example", {
+      bundleId: "wsb-b0s22j3d7",
+    });
+  }
+}
+
+```
+
+### By Owner & Name
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsWorkspacesBundle } from "./.gen/providers/aws/data-aws-workspaces-bundle";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsWorkspacesBundle(this, "example", {
+      name: "Value with Windows 10 and Office 2016",
+      owner: "AMAZON",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `bundleId` – (Optional) ID of the bundle.
+* `owner` – (Optional) Owner of the bundles. You have to leave it blank for own bundles. You cannot combine this parameter with `bundleId`.
+* `name` – (Optional) Name of the bundle. You cannot combine this parameter with `bundleId`.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `description` – The description of the bundle.
+* `bundleId` – The ID of the bundle.
+* `name` – The name of the bundle.
+* `owner` – The owner of the bundle.
+* `computeType` – The compute type. See supported fields below.
+* `rootStorage` – The root volume. See supported fields below.
+* `userStorage` – The user storage. See supported fields below.
+
+### `computeType`
+
+* `name` - Name of the compute type.
+
+### `rootStorage`
+
+* `capacity` - Size of the root volume.
+
+### `userStorage`
+
+* `capacity` - Size of the user storage.
+
+<!-- cache-key: cdktf-0.18.0 input-fa51236e05e24e0256f2207788b1148c2c3ccab79c92b51106d255e1b69a9e3d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/workspaces_directory.html.markdown b/website/docs/cdktf/typescript/d/workspaces_directory.html.markdown
new file mode 100644
index 00000000000..398f55cfd55
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/workspaces_directory.html.markdown
@@ -0,0 +1,88 @@
+---
+subcategory: "WorkSpaces"
+layout: "aws"
+page_title: "AWS: aws_workspaces_directory"
+description: |-
+  Retrieve information about an AWS WorkSpaces directory.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_workspaces_directory
+
+Retrieve information about an AWS WorkSpaces directory.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsWorkspacesDirectory } from "./.gen/providers/aws/data-aws-workspaces-directory";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsWorkspacesDirectory(this, "example", {
+      directoryId: "d-9067783251",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `directoryId` - (Required) Directory identifier for registration in WorkSpaces service.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - WorkSpaces directory identifier.
+* `alias` - Directory alias.
+* `customerUserName` - User name for the service account.
+* `directoryName` - Name of the directory.
+* `directoryType` - Directory type.
+* `dnsIpAddresses` - IP addresses of the DNS servers for the directory.
+* `iamRoleId` - Identifier of the IAM role. This is the role that allows Amazon WorkSpaces to make calls to other services, such as Amazon EC2, on your behalf.
+* `ipGroupIds` - Identifiers of the IP access control groups associated with the directory.
+* `registrationCode` - Registration code for the directory. This is the code that users enter in their Amazon WorkSpaces client application to connect to the directory.
+* `selfServicePermissions` – The permissions to enable or disable self-service capabilities.
+* `subnetIds` - Identifiers of the subnets where the directory resides.
+* `tags` – A map of tags assigned to the WorkSpaces directory.
+* `workspaceCreationProperties` – The default properties that are used for creating WorkSpaces. Defined below.
+* `workspaceAccessProperties` – (Optional) Specifies which devices and operating systems users can use to access their WorkSpaces. Defined below.
+* `workspaceSecurityGroupId` - The identifier of the security group that is assigned to new WorkSpaces. Defined below.
+
+### self_service_permissions
+
+* `changeComputeType` – Whether WorkSpaces directory users can change the compute type (bundle) for their workspace.
+* `increaseVolumeSize` – Whether WorkSpaces directory users can increase the volume size of the drives on their workspace.
+* `rebuildWorkspace` – Whether WorkSpaces directory users can rebuild the operating system of a workspace to its original state.
+* `restartWorkspace` – Whether WorkSpaces directory users can restart their workspace.
+* `switchRunningMode` – Whether WorkSpaces directory users can switch the running mode of their workspace.
+
+### workspace_access_properties
+
+* `deviceTypeAndroid` – (Optional) Indicates whether users can use Android devices to access their WorkSpaces.
+* `deviceTypeChromeos` – (Optional) Indicates whether users can use Chromebooks to access their WorkSpaces.
+* `deviceTypeIos` – (Optional) Indicates whether users can use iOS devices to access their WorkSpaces.
+* `deviceTypeLinux` – (Optional) Indicates whether users can use Linux clients to access their WorkSpaces.
+* `deviceTypeOsx` – (Optional) Indicates whether users can use macOS clients to access their WorkSpaces.
+* `deviceTypeWeb` – (Optional) Indicates whether users can access their WorkSpaces through a web browser.
+* `deviceTypeWindows` – (Optional) Indicates whether users can use Windows clients to access their WorkSpaces.
+* `deviceTypeZeroclient` – (Optional) Indicates whether users can use zero client devices to access their WorkSpaces.
+
+### workspace_creation_properties
+
+* `customSecurityGroupId` – The identifier of your custom security group. Should relate to the same VPC, where workspaces reside in.
+* `defaultOu` – The default organizational unit (OU) for your WorkSpace directories.
+* `enableInternetAccess` – Indicates whether internet access is enabled for your WorkSpaces.
+* `enableMaintenanceMode` – Indicates whether maintenance mode is enabled for your WorkSpaces. For more information, see [WorkSpace Maintenance](https://docs.aws.amazon.com/workspaces/latest/adminguide/workspace-maintenance.html).
+* `userEnabledAsLocalAdministrator` – Indicates whether users are local administrators of their WorkSpaces.
+
+<!-- cache-key: cdktf-0.18.0 input-b94343197f46538817cb6fbc22fc3a4b2fd2b6a8ee88d85032acad20463566b5 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/workspaces_image.html.markdown b/website/docs/cdktf/typescript/d/workspaces_image.html.markdown
new file mode 100644
index 00000000000..3b0f87cde97
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/workspaces_image.html.markdown
@@ -0,0 +1,53 @@
+---
+subcategory: "WorkSpaces"
+layout: "aws"
+page_title: "AWS: aws_workspaces_image"
+description: |-
+  Get information about Workspaces image.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Data Source: aws_workspaces_image
+
+Use this data source to get information about a Workspaces image.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsWorkspacesImage } from "./.gen/providers/aws/data-aws-workspaces-image";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsWorkspacesImage(this, "example", {
+      imageId: "wsi-ten5h0y19",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `imageId` – (Required) ID of the image.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `name` – The name of the image.
+* `description` – The description of the image.
+* `os` – The operating system that the image is running.
+* `requiredTenancy` – Specifies whether the image is running on dedicated hardware. When Bring Your Own License (BYOL) is enabled, this value is set to DEDICATED. For more information, see [Bring Your Own Windows Desktop Images](https://docs.aws.amazon.com/workspaces/latest/adminguide/byol-windows-images.html).
+* `state` – The status of the image.
+
+<!-- cache-key: cdktf-0.18.0 input-e175478c435ceea20dd9a0b224e5ca9b6f41172a6466e59421b4cd7412f5f83d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/d/workspaces_workspace.html.markdown b/website/docs/cdktf/typescript/d/workspaces_workspace.html.markdown
new file mode 100644
index 00000000000..74f0a29b94d
--- /dev/null
+++ b/website/docs/cdktf/typescript/d/workspaces_workspace.html.markdown
@@ -0,0 +1,93 @@
+---
+subcategory: "WorkSpaces"
+layout: "aws"
+page_title: "AWS: aws_workspaces_workspace"
+description: |-
+  Get information about a WorkSpace in AWS Workspaces Service.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_workspaces_workspace
+
+Use this data source to get information about a workspace in [AWS Workspaces](https://docs.aws.amazon.com/workspaces/latest/adminguide/amazon-workspaces.html) Service.
+
+## Example Usage
+
+### Filter By Workspace ID
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsWorkspacesWorkspace } from "./.gen/providers/aws/data-aws-workspaces-workspace";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsWorkspacesWorkspace(this, "example", {
+      workspaceId: "ws-cj5xcxsz5",
+    });
+  }
+}
+
+```
+
+### Filter By Directory ID & User Name
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsWorkspacesWorkspace } from "./.gen/providers/aws/data-aws-workspaces-workspace";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsWorkspacesWorkspace(this, "example", {
+      directoryId: "d-9967252f57",
+      userName: "Example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `bundleId` - (Optional) ID of the bundle for the WorkSpace.
+* `directoryId` - (Optional) ID of the directory for the WorkSpace. You have to specify `userName` along with `directoryId`. You cannot combine this parameter with `workspaceId`.
+* `rootVolumeEncryptionEnabled` - (Optional) Indicates whether the data stored on the root volume is encrypted.
+* `tags` - (Optional) Tags for the WorkSpace.
+* `userName` – (Optional) User name of the user for the WorkSpace. This user name must exist in the directory for the WorkSpace. You cannot combine this parameter with `workspaceId`.
+* `userVolumeEncryptionEnabled` – (Optional) Indicates whether the data stored on the user volume is encrypted.
+* `volumeEncryptionKey` – (Optional) Symmetric AWS KMS customer master key (CMK) used to encrypt data stored on your WorkSpace. Amazon WorkSpaces does not support asymmetric CMKs.
+* `workspaceId` - (Optional) ID of the WorkSpace. You cannot combine this parameter with `directoryId`.
+* `workspaceProperties` – (Optional) WorkSpace properties.
+
+`workspaceProperties` supports the following:
+
+* `computeTypeName` – (Optional) Compute type. For more information, see [Amazon WorkSpaces Bundles](http://aws.amazon.com/workspaces/details/#Amazon_WorkSpaces_Bundles). Valid values are `value`, `standard`, `performance`, `power`, `graphics`, `powerpro` and `graphicspro`.
+* `rootVolumeSizeGib` – (Optional) Size of the root volume.
+* `runningMode` – (Optional) Running mode. For more information, see [Manage the WorkSpace Running Mode](https://docs.aws.amazon.com/workspaces/latest/adminguide/running-mode.html). Valid values are `autoStop` and `alwaysOn`.
+* `runningModeAutoStopTimeoutInMinutes` – (Optional) Time after a user logs off when WorkSpaces are automatically stopped. Configured in 60-minute intervals.
+* `userVolumeSizeGib` – (Optional) Size of the user storage.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - Workspaces ID.
+* `ipAddress` - IP address of the WorkSpace.
+* `computerName` - Name of the WorkSpace, as seen by the operating system.
+* `state` - Operational state of the WorkSpace.
+
+<!-- cache-key: cdktf-0.18.0 input-e3b5b66bcfd6093ee222bffc5ccc77c7abda6688fc2aaac99be169c6d22b80cf -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/guides/continuous-validation-examples.html.markdown b/website/docs/cdktf/typescript/guides/continuous-validation-examples.html.markdown
new file mode 100644
index 00000000000..16e4493816d
--- /dev/null
+++ b/website/docs/cdktf/typescript/guides/continuous-validation-examples.html.markdown
@@ -0,0 +1,119 @@
+---
+subcategory: ""
+layout: "aws"
+page_title: "Using Terraform Cloud's Continuous Validation feature with the AWS Provider"
+description: |-
+  Using Terraform Cloud's Continuous Validation feature with the AWS Provider
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Using Terraform Cloud's Continuous Validation feature with the AWS Provider
+
+## Continuous Validation in Terraform Cloud
+
+The Continuous Validation feature in Terraform Cloud (TFC) allows users to make assertions about their infrastructure between applied runs. This helps users to identify issues at the time they first appear and avoid situations where a change is only identified once it causes a customer-facing problem.
+
+Users can add checks to their Terraform configuration using check blocks. Check blocks contain assertions that are defined with a custom condition expression and an error message. When the condition expression evaluates to true the check passes, but when the expression evaluates to false Terraform will show a warning message that includes the user-defined error message.
+
+Custom conditions can be created using data from Terraform providers’ resources and data sources. Data can also be combined from multiple sources; for example, you can use checks to monitor expirable resources by comparing a resource’s expiration date attribute to the current time returned by Terraform’s built-in time functions.
+
+Below, this guide shows examples of how data returned by the AWS provider can be used to define checks in your Terraform configuration.
+
+## Example - Ensure your AWS account is within budget (aws_budgets_budget)
+
+AWS Budgets allows you to track and take action on your AWS costs and usage. You can use AWS Budgets to monitor your aggregate utilization and coverage metrics for your Reserved Instances (RIs) or Savings Plans.
+
+- You can use AWS Budgets to enable simple-to-complex cost and usage tracking. Some examples include:
+
+- Setting a monthly cost budget with a fixed target amount to track all costs associated with your account.
+
+- Setting a monthly cost budget with a variable target amount, with each subsequent month growing the budget target by 5 percent.
+
+- Setting a monthly usage budget with a fixed usage amount and forecasted notifications to help ensure that you are staying within the service limits for a specific service.
+
+- Setting a daily utilization or coverage budget to track your RI or Savings Plans.
+
+The example below shows how a check block can be used to assert that you remain in compliance for the budgets that have been established.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+If the budget exceeds the set limit, the check block assertion will return a warning similar to the following:
+
+```
+│ Warning: Check block assertion failed
+│ 
+│   on main.tf line 43, in check "check_budget_exceeded":
+│   43:     condition = !data.aws_budgets_budget.example.budget_exceeded
+│     ├────────────────
+│     │ data.aws_budgets_budget.example.budget_exceeded is true
+│ 
+│ AWS budget has been exceeded! Calculated spend: '1550.0' and budget limit: '1200.0'
+```
+
+## Example - Check GuardDuty for Threats (aws_guardduty_finding_ids)
+
+Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior to protect your Amazon Web Services accounts, workloads, and data stored in Amazon S3. With the cloud, the collection and aggregation of account and network activities is simplified, but it can be time consuming for security teams to continuously analyze event log data for potential threats. With GuardDuty, you now have an intelligent and cost-effective option for continuous threat detection in Amazon Web Services Cloud.
+
+The following example outlines how a check block can be utilized to assert that no threats have been identified from AWS GuardDuty.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsGuarddutyDetector } from "./.gen/providers/aws/data-aws-guardduty-detector";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsGuarddutyDetector(this, "example", {});
+  }
+}
+
+```
+
+If findings are present, the check block assertion will return a warning similar to the following:
+
+```
+│ Warning: Check block assertion failed
+│
+│   on main.tf line 24, in check "check_guardduty_findings":
+│   24:     condition = !data.aws_guardduty_finding_ids.example.has_findings
+│     ├────────────────
+│     │ data.aws_guardduty_finding_ids.example.has_findings is true
+│
+│ AWS GuardDuty detector 'abcdef123456' has 9 open findings!
+```
+
+## Example - Check for unused IAM roles (aws_iam_role)
+
+AWS IAM tracks role usage, including the [last used date and region](https://docs.aws.amazon.com/IAM/latest/APIReference/API_RoleLastUsed.html). This information is returned  with the [`awsIamRole`](../d/iam_role.html.markdown) data source, and can be used in continuous validation to check for unused roles. AWS reports activity for the trailing 400 days. If a role is unused within that period, the `lastUsedDate` will be an empty string (`""`).
+
+In the example below, the [`timecmp`](https://developer.hashicorp.com/terraform/language/functions/timecmp) function checks for a `lastUsedDate` more recent than the `unusedLimit` local variable (30 days ago). The [`coalesce`](https://developer.hashicorp.com/terraform/language/functions/coalesce) function handles empty (`""`) `lastUsedDate` values safely, falling back to the `unusedLimit` local, and automatically triggering a failed condition.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+<!-- cache-key: cdktf-0.18.0 input-46cf0803d4873a7572320ffe73a6975a74714c2428be20d68b32324329284129 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/guides/custom-service-endpoints.html.markdown b/website/docs/cdktf/typescript/guides/custom-service-endpoints.html.markdown
new file mode 100644
index 00000000000..119e13c8eda
--- /dev/null
+++ b/website/docs/cdktf/typescript/guides/custom-service-endpoints.html.markdown
@@ -0,0 +1,417 @@
+---
+subcategory: ""
+layout: "aws"
+page_title: "Terraform AWS Provider Custom Service Endpoint Configuration"
+description: |-
+  Configuring the Terraform AWS Provider to connect to custom AWS service endpoints and AWS compatible solutions.
+---
+
+<!-- Generated by internal/generate/customends/main.go; DO NOT EDIT. -->
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Custom Service Endpoint Configuration
+
+The Terraform AWS Provider configuration can be customized to connect to non-default AWS service endpoints and AWS compatible solutions. This may be useful for environments with specific compliance requirements, such as using [AWS FIPS 140-2 endpoints](https://aws.amazon.com/compliance/fips/), connecting to AWS Snowball, SC2S, or C2S environments, or local testing.
+
+This guide outlines how to get started with customizing endpoints, the available endpoint configurations, and offers example configurations for working with certain local development and testing solutions.
+
+~> **NOTE:** Support for connecting the Terraform AWS Provider with custom endpoints and AWS compatible solutions is offered as best effort. Individual Terraform resources may require compatibility updates to work in certain environments. Integration testing by HashiCorp during provider changes is exclusively done against default AWS endpoints at this time.
+
+<!-- TOC depthFrom:2 -->
+
+- [Getting Started with Custom Endpoints](#getting-started-with-custom-endpoints)
+- [Available Endpoint Customizations](#available-endpoint-customizations)
+- [Connecting to Local AWS Compatible Solutions](#connecting-to-local-aws-compatible-solutions)
+    - [DynamoDB Local](#dynamodb-local)
+    - [LocalStack](#localstack)
+
+<!-- /TOC -->
+
+## Getting Started with Custom Endpoints
+
+To configure the Terraform AWS Provider to use customized endpoints, it can be done within `provider` declarations using the `endpoints` configuration block, e.g.,
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AwsProvider } from "./.gen/providers/aws/provider";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AwsProvider(this, "aws", {
+      endpoints: [
+        {
+          dynamodb: "http://localhost:4569",
+          s3: "http://localhost:4572",
+        },
+      ],
+    });
+  }
+}
+
+```
+
+If multiple, different Terraform AWS Provider configurations are required, see the [Terraform documentation on multiple provider instances](https://www.terraform.io/docs/configuration/providers.html#alias-multiple-provider-instances) for additional information about the `alias` provider configuration and its usage.
+
+## Available Endpoint Customizations
+
+The Terraform AWS Provider allows the following endpoints to be customized.
+
+**Note:** The Provider allows some service endpoints to be customized despite not supporting those services.
+
+**Note:** For backward compatibility, some endpoints can be assigned using multiple service "keys" (_e.g._, `dms`, `databasemigration`, or `databasemigrationservice`). If you use more than one equivalent service key in your configuration, the provider will use the _first_ endpoint value set. For example, in the configuration below we have set the DMS service endpoints using both `dms` and `databasemigration`. The provider will set the endpoint to whichever appears first. Subsequent values are ignored.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AwsProvider } from "./.gen/providers/aws/provider";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AwsProvider(this, "aws", {
+      endpoints: [
+        {
+          databasemigration: "http://this.value.will.be.ignored.com",
+          dms: "http://this.value.will.be.used.com",
+        },
+      ],
+    });
+  }
+}
+
+```
+
+<!-- markdownlint-disable no-inline-html -->
+<!--
+    The division splits this long list into multiple columns without manually
+    maintaining a table. The terraform.io Markdown parser previously allowed
+    for Markdown within HTML elements, however the Terraform Registry parser
+    is more accurate/strict, so we use raw HTML to maintain this list.
+-->
+<!-- Generated by internal/generate/customends/main.go; DO NOT EDIT. -->
+<div style="column-width: 14em;">
+<ul>
+  <li><code>accessanalyzer</code></li>
+  <li><code>account</code></li>
+  <li><code>acm</code></li>
+  <li><code>acmpca</code></li>
+  <li><code>amp</code> (or <code>prometheus</code> or <code>prometheusservice</code>)</li>
+  <li><code>amplify</code></li>
+  <li><code>apigateway</code></li>
+  <li><code>apigatewayv2</code></li>
+  <li><code>appautoscaling</code> (or <code>applicationautoscaling</code>)</li>
+  <li><code>appconfig</code></li>
+  <li><code>appflow</code></li>
+  <li><code>appintegrations</code> (or <code>appintegrationsservice</code>)</li>
+  <li><code>applicationinsights</code></li>
+  <li><code>appmesh</code></li>
+  <li><code>apprunner</code></li>
+  <li><code>appstream</code></li>
+  <li><code>appsync</code></li>
+  <li><code>athena</code></li>
+  <li><code>auditmanager</code></li>
+  <li><code>autoscaling</code></li>
+  <li><code>autoscalingplans</code></li>
+  <li><code>backup</code></li>
+  <li><code>batch</code></li>
+  <li><code>bedrock</code></li>
+  <li><code>budgets</code></li>
+  <li><code>ce</code> (or <code>costexplorer</code>)</li>
+  <li><code>chime</code></li>
+  <li><code>chimesdkmediapipelines</code></li>
+  <li><code>chimesdkvoice</code></li>
+  <li><code>cleanrooms</code></li>
+  <li><code>cloud9</code></li>
+  <li><code>cloudcontrol</code> (or <code>cloudcontrolapi</code>)</li>
+  <li><code>cloudformation</code></li>
+  <li><code>cloudfront</code></li>
+  <li><code>cloudhsmv2</code> (or <code>cloudhsm</code>)</li>
+  <li><code>cloudsearch</code></li>
+  <li><code>cloudtrail</code></li>
+  <li><code>cloudwatch</code></li>
+  <li><code>codeartifact</code></li>
+  <li><code>codebuild</code></li>
+  <li><code>codecatalyst</code></li>
+  <li><code>codecommit</code></li>
+  <li><code>codegurureviewer</code></li>
+  <li><code>codepipeline</code></li>
+  <li><code>codestarconnections</code></li>
+  <li><code>codestarnotifications</code></li>
+  <li><code>cognitoidentity</code></li>
+  <li><code>cognitoidp</code> (or <code>cognitoidentityprovider</code>)</li>
+  <li><code>comprehend</code></li>
+  <li><code>computeoptimizer</code></li>
+  <li><code>configservice</code> (or <code>config</code>)</li>
+  <li><code>connect</code></li>
+  <li><code>controltower</code></li>
+  <li><code>cur</code> (or <code>costandusagereportservice</code>)</li>
+  <li><code>dataexchange</code></li>
+  <li><code>datapipeline</code></li>
+  <li><code>datasync</code></li>
+  <li><code>dax</code></li>
+  <li><code>deploy</code> (or <code>codedeploy</code>)</li>
+  <li><code>detective</code></li>
+  <li><code>devicefarm</code></li>
+  <li><code>directconnect</code></li>
+  <li><code>dlm</code></li>
+  <li><code>dms</code> (or <code>databasemigration</code> or <code>databasemigrationservice</code>)</li>
+  <li><code>docdb</code></li>
+  <li><code>docdbelastic</code></li>
+  <li><code>ds</code> (or <code>directoryservice</code>)</li>
+  <li><code>dynamodb</code></li>
+  <li><code>ec2</code></li>
+  <li><code>ecr</code></li>
+  <li><code>ecrpublic</code></li>
+  <li><code>ecs</code></li>
+  <li><code>efs</code></li>
+  <li><code>eks</code></li>
+  <li><code>elasticache</code></li>
+  <li><code>elasticbeanstalk</code> (or <code>beanstalk</code>)</li>
+  <li><code>elasticsearch</code> (or <code>es</code> or <code>elasticsearchservice</code>)</li>
+  <li><code>elastictranscoder</code></li>
+  <li><code>elb</code> (or <code>elasticloadbalancing</code>)</li>
+  <li><code>elbv2</code> (or <code>elasticloadbalancingv2</code>)</li>
+  <li><code>emr</code></li>
+  <li><code>emrcontainers</code></li>
+  <li><code>emrserverless</code></li>
+  <li><code>events</code> (or <code>eventbridge</code> or <code>cloudwatchevents</code>)</li>
+  <li><code>evidently</code> (or <code>cloudwatchevidently</code>)</li>
+  <li><code>finspace</code></li>
+  <li><code>firehose</code></li>
+  <li><code>fis</code></li>
+  <li><code>fms</code></li>
+  <li><code>fsx</code></li>
+  <li><code>gamelift</code></li>
+  <li><code>glacier</code></li>
+  <li><code>globalaccelerator</code></li>
+  <li><code>glue</code></li>
+  <li><code>grafana</code> (or <code>managedgrafana</code> or <code>amg</code>)</li>
+  <li><code>greengrass</code></li>
+  <li><code>guardduty</code></li>
+  <li><code>healthlake</code></li>
+  <li><code>iam</code></li>
+  <li><code>identitystore</code></li>
+  <li><code>imagebuilder</code></li>
+  <li><code>inspector</code></li>
+  <li><code>inspector2</code> (or <code>inspectorv2</code>)</li>
+  <li><code>internetmonitor</code></li>
+  <li><code>iot</code></li>
+  <li><code>iotanalytics</code></li>
+  <li><code>iotevents</code></li>
+  <li><code>ivs</code></li>
+  <li><code>ivschat</code></li>
+  <li><code>kafka</code> (or <code>msk</code>)</li>
+  <li><code>kafkaconnect</code></li>
+  <li><code>kendra</code></li>
+  <li><code>keyspaces</code></li>
+  <li><code>kinesis</code></li>
+  <li><code>kinesisanalytics</code></li>
+  <li><code>kinesisanalyticsv2</code></li>
+  <li><code>kinesisvideo</code></li>
+  <li><code>kms</code></li>
+  <li><code>lakeformation</code></li>
+  <li><code>lambda</code></li>
+  <li><code>lexmodels</code> (or <code>lexmodelbuilding</code> or <code>lexmodelbuildingservice</code> or <code>lex</code>)</li>
+  <li><code>lexv2models</code> (or <code>lexmodelsv2</code>)</li>
+  <li><code>licensemanager</code></li>
+  <li><code>lightsail</code></li>
+  <li><code>location</code> (or <code>locationservice</code>)</li>
+  <li><code>logs</code> (or <code>cloudwatchlog</code> or <code>cloudwatchlogs</code>)</li>
+  <li><code>macie2</code></li>
+  <li><code>mediaconnect</code></li>
+  <li><code>mediaconvert</code></li>
+  <li><code>medialive</code></li>
+  <li><code>mediapackage</code></li>
+  <li><code>mediastore</code></li>
+  <li><code>memorydb</code></li>
+  <li><code>mq</code></li>
+  <li><code>mwaa</code></li>
+  <li><code>neptune</code></li>
+  <li><code>networkfirewall</code></li>
+  <li><code>networkmanager</code></li>
+  <li><code>oam</code> (or <code>cloudwatchobservabilityaccessmanager</code>)</li>
+  <li><code>opensearch</code> (or <code>opensearchservice</code>)</li>
+  <li><code>opensearchserverless</code></li>
+  <li><code>opsworks</code></li>
+  <li><code>organizations</code></li>
+  <li><code>outposts</code></li>
+  <li><code>pinpoint</code></li>
+  <li><code>pipes</code></li>
+  <li><code>pricing</code></li>
+  <li><code>qldb</code></li>
+  <li><code>quicksight</code></li>
+  <li><code>ram</code></li>
+  <li><code>rbin</code> (or <code>recyclebin</code>)</li>
+  <li><code>rds</code></li>
+  <li><code>redshift</code></li>
+  <li><code>redshiftdata</code> (or <code>redshiftdataapiservice</code>)</li>
+  <li><code>redshiftserverless</code></li>
+  <li><code>resourceexplorer2</code></li>
+  <li><code>resourcegroups</code></li>
+  <li><code>resourcegroupstaggingapi</code> (or <code>resourcegroupstagging</code>)</li>
+  <li><code>rolesanywhere</code></li>
+  <li><code>route53</code></li>
+  <li><code>route53domains</code></li>
+  <li><code>route53recoverycontrolconfig</code></li>
+  <li><code>route53recoveryreadiness</code></li>
+  <li><code>route53resolver</code></li>
+  <li><code>rum</code> (or <code>cloudwatchrum</code>)</li>
+  <li><code>s3</code> (or <code>s3api</code>)</li>
+  <li><code>s3control</code></li>
+  <li><code>s3outposts</code></li>
+  <li><code>sagemaker</code></li>
+  <li><code>scheduler</code></li>
+  <li><code>schemas</code></li>
+  <li><code>secretsmanager</code></li>
+  <li><code>securityhub</code></li>
+  <li><code>securitylake</code></li>
+  <li><code>serverlessrepo</code> (or <code>serverlessapprepo</code> or <code>serverlessapplicationrepository</code>)</li>
+  <li><code>servicecatalog</code></li>
+  <li><code>servicediscovery</code></li>
+  <li><code>servicequotas</code></li>
+  <li><code>ses</code></li>
+  <li><code>sesv2</code></li>
+  <li><code>sfn</code> (or <code>stepfunctions</code>)</li>
+  <li><code>shield</code></li>
+  <li><code>signer</code></li>
+  <li><code>simpledb</code> (or <code>sdb</code>)</li>
+  <li><code>sns</code></li>
+  <li><code>sqs</code></li>
+  <li><code>ssm</code></li>
+  <li><code>ssmcontacts</code></li>
+  <li><code>ssmincidents</code></li>
+  <li><code>ssoadmin</code></li>
+  <li><code>storagegateway</code></li>
+  <li><code>sts</code></li>
+  <li><code>swf</code></li>
+  <li><code>synthetics</code></li>
+  <li><code>timestreamwrite</code></li>
+  <li><code>transcribe</code> (or <code>transcribeservice</code>)</li>
+  <li><code>transfer</code></li>
+  <li><code>verifiedpermissions</code></li>
+  <li><code>vpclattice</code></li>
+  <li><code>waf</code></li>
+  <li><code>wafregional</code></li>
+  <li><code>wafv2</code></li>
+  <li><code>worklink</code></li>
+  <li><code>workspaces</code></li>
+  <li><code>xray</code></li>
+</ul>
+</div>
+<!-- markdownlint-enable no-inline-html -->
+
+As a convenience, for compatibility with the [Terraform S3 Backend](https://www.terraform.io/language/settings/backends/s3),
+the following service endpoints can be configured using environment variables:
+
+* DynamoDB: `tfAwsDynamodbEndpoint` (or **Deprecated** `awsDynamodbEndpoint`)
+* IAM: `tfAwsIamEndpoint` (or **Deprecated** `awsIamEndpoint`)
+* S3: `tfAwsS3Endpoint` (or **Deprecated** `awsS3Endpoint`)
+* STS: `tfAwsStsEndpoint` (or **Deprecated** `awsStsEndpoint`)
+
+## Connecting to Local AWS Compatible Solutions
+
+~> **NOTE:** This information is not intended to be exhaustive for all local AWS compatible solutions or necessarily authoritative configurations for those documented. Check the documentation for each of these solutions for the most up to date information.
+
+### DynamoDB Local
+
+The Amazon DynamoDB service offers a downloadable version for writing and testing applications without accessing the DynamoDB web service. For more information about this solution, see the [DynamoDB Local documentation in the Amazon DynamoDB Developer Guide](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/DynamoDBLocal.html).
+
+An example provider configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AwsProvider } from "./.gen/providers/aws/provider";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AwsProvider(this, "aws", {
+      accessKey: "mock_access_key",
+      endpoints: [
+        {
+          dynamodb: "http://localhost:8000",
+        },
+      ],
+      region: "us-east-1",
+      secretKey: "mock_secret_key",
+      skipCredentialsValidation: true,
+      skipMetadataApiCheck: Token.asString(true),
+      skipRequestingAccountId: true,
+    });
+  }
+}
+
+```
+
+### LocalStack
+
+[LocalStack](https://localstack.cloud/) provides an easy-to-use test/mocking framework for developing Cloud applications.
+
+An example provider configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AwsProvider } from "./.gen/providers/aws/provider";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AwsProvider(this, "aws", {
+      accessKey: "mock_access_key",
+      endpoints: [
+        {
+          apigateway: "http://localhost:4566",
+          cloudformation: "http://localhost:4566",
+          cloudwatch: "http://localhost:4566",
+          dynamodb: "http://localhost:4566",
+          es: "http://localhost:4566",
+          firehose: "http://localhost:4566",
+          iam: "http://localhost:4566",
+          kinesis: "http://localhost:4566",
+          lambda: "http://localhost:4566",
+          redshift: "http://localhost:4566",
+          route53: "http://localhost:4566",
+          s3: "http://localhost:4566",
+          secretsmanager: "http://localhost:4566",
+          ses: "http://localhost:4566",
+          sns: "http://localhost:4566",
+          sqs: "http://localhost:4566",
+          ssm: "http://localhost:4566",
+          stepfunctions: "http://localhost:4566",
+          sts: "http://localhost:4566",
+        },
+      ],
+      region: "us-east-1",
+      s3UsePathStyle: true,
+      secretKey: "mock_secret_key",
+      skipCredentialsValidation: true,
+      skipMetadataApiCheck: Token.asString(true),
+      skipRequestingAccountId: true,
+    });
+  }
+}
+
+```
+
+<!-- cache-key: cdktf-0.18.0 input-0e0dec25d22a19f39d4881dd603482a4765f842b794421afb1763a74aeea1795 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/guides/resource-tagging.html.markdown b/website/docs/cdktf/typescript/guides/resource-tagging.html.markdown
new file mode 100644
index 00000000000..d62169f3634
--- /dev/null
+++ b/website/docs/cdktf/typescript/guides/resource-tagging.html.markdown
@@ -0,0 +1,330 @@
+---
+subcategory: ""
+layout: "aws"
+page_title: "Terraform AWS Provider Resource Tagging"
+description: |-
+  Managing resource tags with the Terraform AWS Provider.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource Tagging
+
+Many AWS services implement [resource tags](https://docs.aws.amazon.com/general/latest/gr/aws_tagging.html) as an essential part of managing components. These arbitrary key-value pairs can be utilized for billing, ownership, automation, [access control](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_tags.html), and many other use cases. Given that these tags are an important aspect of successfully managing an AWS environment, the Terraform AWS Provider implements additional functionality beyond the typical one-to-one resource lifecycle management for easier and more customized implementations.
+
+-> Not all AWS resources support tagging, which can differ across AWS services and even across resources within the same service. Browse the individual Terraform AWS Provider resource documentation pages for the `tags` argument, to see which support resource tagging. If the AWS API implements tagging support for a resource and it is missing from the Terraform AWS Provider resource, a [feature request](https://github.com/hashicorp/terraform-provider-aws/issues/new?labels=enhancement&template=Feature_Request.md) can be submitted.
+
+<!-- TOC depthFrom:2 -->
+
+- [Getting Started with Resource Tags](#getting-started-with-resource-tags)
+- [Ignoring Changes to Specific Tags](#ignoring-changes-to-specific-tags)
+    - [Ignoring Changes in Individual Resources](#ignoring-changes-in-individual-resources)
+    - [Ignoring Changes in All Resources](#ignoring-changes-in-all-resources)
+- [Managing Individual Resource Tags](#managing-individual-resource-tags)
+- [Propagating Tags to All Resources](#propagating-tags-to-all-resources)
+
+<!-- /TOC -->
+
+## Getting Started with Resource Tags
+
+Terraform AWS Provider resources that support resource tags implement a consistent argument named `tags` which accepts a key-value map, e.g.,
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Vpc } from "./.gen/providers/aws/vpc";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Vpc(this, "example", {
+      tags: {
+        Name: "MyVPC",
+      },
+    });
+  }
+}
+
+```
+
+The tags for the resource are wholly managed by Terraform except tag keys beginning with `aws:` as these are managed by AWS services and cannot typically be edited or deleted. Any non-AWS tags added to the VPC outside of Terraform will be proposed for removal on the next Terraform execution. Missing tags or those with incorrect values from the Terraform configuration will be proposed for addition or update on the next Terraform execution. Advanced patterns that can adjust these behaviors for special use cases, such as Terraform AWS Provider configurations that affect all resources and the ability to manage resource tags for resources not managed by Terraform, can be found later in this guide.
+
+For most environments and use cases, this is the typical implementation pattern, whether it be in a standalone Terraform configuration or within a [Terraform Module](https://www.terraform.io/docs/modules/). The Terraform configuration language also enables less repetitive configurations via [variables](https://www.terraform.io/docs/configuration/variables.html), [locals](https://www.terraform.io/docs/configuration/locals.html), or potentially a combination of these, e.g.,
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import {
+  VariableType,
+  TerraformVariable,
+  Fn,
+  Token,
+  TerraformStack,
+} from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Vpc } from "./.gen/providers/aws/vpc";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    /*Terraform Variables are not always the best fit for getting inputs in the context of Terraform CDK.
+    You can read more about this at https://cdk.tf/variables*/
+    const additionalTags = new TerraformVariable(this, "additional_tags", {
+      default: [{}],
+      description: "Additional resource tags",
+      type: VariableType.map(VariableType.STRING),
+    });
+    new Vpc(this, "example", {
+      tags: Token.asStringMap(
+        Fn.merge([
+          additionalTags.value,
+          {
+            Name: "MyVPC",
+          },
+        ])
+      ),
+    });
+  }
+}
+
+```
+
+## Ignoring Changes to Specific Tags
+
+Systems outside of Terraform may automatically interact with the tagging associated with AWS resources. These external systems may be for administrative purposes, such as a Configuration Management Database, or the tagging may be required functionality for those systems, such as Kubernetes. This section shows methods to prevent Terraform from showing differences for specific tags.
+
+### Ignoring Changes in Individual Resources
+
+All Terraform resources support the [`lifecycle` configuration block `ignoreChanges` argument](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html#ignore_changes), which can be used to explicitly ignore all tags changes on a resource beyond an initial configuration or individual tag values.
+
+In this example, the `name` tag will be added to the VPC on resource creation, however any external changes to the `name` tag value or the addition/removal of any tag (including the `name` tag) will be ignored:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Vpc } from "./.gen/providers/aws/vpc";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Vpc(this, "example", {
+      lifecycle: {
+        ignoreChanges: [tags],
+      },
+      tags: {
+        Name: "MyVPC",
+      },
+    });
+  }
+}
+
+```
+
+In this example, the `name` and `owner` tags will be added to the VPC on resource creation, however any external changes to the value of the `name` tag will be ignored while any changes to other tags (including the `owner` tag and any additions) will still be proposed:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Vpc } from "./.gen/providers/aws/vpc";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Vpc(this, "example", {
+      lifecycle: {
+        ignoreChanges: [name],
+      },
+      tags: {
+        Name: "MyVPC",
+        Owner: "Operations",
+      },
+    });
+  }
+}
+
+```
+
+### Ignoring Changes in All Resources
+
+As of version 2.60.0 of the Terraform AWS Provider, there is support for ignoring tag changes across all resources under a provider. This simplifies situations where certain tags may be externally applied more globally and enhances functionality beyond `ignoreChanges` to support cases such as tag key prefixes.
+
+In this example, all resources will ignore any addition of the `lastScanned` tag:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AwsProvider } from "./.gen/providers/aws/provider";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AwsProvider(this, "aws", {
+      ignoreTags: [
+        {
+          keys: ["LastScanned"],
+        },
+      ],
+    });
+  }
+}
+
+```
+
+In this example, all resources will ignore any addition of tags with the `kubernetesIo/` prefix, such as `kubernetesIo/cluster/name` or `kubernetesIo/role/elb`:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AwsProvider } from "./.gen/providers/aws/provider";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AwsProvider(this, "aws", {
+      ignoreTags: [
+        {
+          keyPrefixes: ["kubernetes.io/"],
+        },
+      ],
+    });
+  }
+}
+
+```
+
+Any of the `ignoreTags` configurations can be combined as needed.
+
+The provider ignore tags configuration applies to all Terraform AWS Provider resources under that particular instance (the `default` provider instance in the above cases). If multiple, different Terraform AWS Provider configurations are being used (e.g., [multiple provider instances](https://www.terraform.io/docs/configuration/providers.html#alias-multiple-provider-instances)), the ignore tags configuration must be added to all applicable provider configurations.
+
+## Managing Individual Resource Tags
+
+Certain Terraform AWS Provider services support a special resource for managing an individual tag on a resource without managing the resource itself. One example is the [`awsEc2Tag` resource](/docs/providers/aws/r/ec2_tag.html). These resources enable tagging where resources are created outside Terraform such as EC2 Images (AMIs), shared across accounts via Resource Access Manager (RAM), or implicitly created by other means such as EC2 VPN Connections implicitly creating a taggable EC2 Transit Gateway VPN Attachment.
+
+~> **NOTE:** This is an advanced use case and can cause conflicting management issues when improperly implemented. These individual tag resources should not be combined with the Terraform resource for managing the parent resource. For example, using `awsVpc` and `awsEc2Tag` to manage tags of the same VPC will cause a perpetual difference where the `awsVpc` resource will try to remove the tag being added by the `awsEc2Tag` resource.
+
+-> Not all services supported by the Terraform AWS Provider implement these resources. Browse the Terraform AWS Provider resource documentation pages for a resource with a type ending in `tag`. If there is a use case where this type of resource is missing, a [feature request](https://github.com/hashicorp/terraform-provider-aws/issues/new?labels=enhancement&template=Feature_Request.md) can be submitted.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Ec2Tag } from "./.gen/providers/aws/ec2-tag";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Ec2Tag(this, "example", {
+      key: "Owner",
+      resourceId: Token.asString(
+        awsVpnConnectionExample.transitGatewayAttachmentId
+      ),
+      value: "Operations",
+    });
+  }
+}
+
+```
+
+To manage multiple tags for a resource in this scenario, [`forEach`](https://www.terraform.io/docs/configuration/meta-arguments/for_each.html) can be used:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformIterator, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Ec2Tag } from "./.gen/providers/aws/ec2-tag";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    /*In most cases loops should be handled in the programming language context and 
+    not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+    you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+    you need to keep this like it is.*/
+    const exampleForEachIterator = TerraformIterator.fromList(
+      Token.asAny("[object Object]")
+    );
+    new Ec2Tag(this, "example", {
+      key: exampleForEachIterator.key,
+      resourceId: Token.asString(
+        awsVpnConnectionExample.transitGatewayAttachmentId
+      ),
+      value: exampleForEachIterator.value,
+      forEach: exampleForEachIterator,
+    });
+  }
+}
+
+```
+
+The inline map provided to `forEach` in the example above is used for brevity, but other Terraform configuration language features similar to those noted at the beginning of this guide can be used to make the example more extensible.
+
+### Propagating Tags to All Resources
+
+As of version 3.38.0 of the Terraform AWS Provider, the Terraform Configuration language also enables provider-level tagging as an alternative to the methods described in the [Getting Started with Resource Tags](#getting-started-with-resource-tags) section above.
+This functionality is available for all Terraform AWS Provider resources that currently support `tags`, with the exception of the [`awsAutoscalingGroup`](/docs/providers/aws/r/autoscaling_group.html.markdown) resource. Refactoring the use of [variables](https://www.terraform.io/docs/configuration/variables.html) or [locals](https://www.terraform.io/docs/configuration/locals.html) may look like:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AwsProvider } from "./.gen/providers/aws/provider";
+import { Vpc } from "./.gen/providers/aws/vpc";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AwsProvider(this, "aws", {
+      defaultTags: [
+        {
+          tags: {
+            Environment: "Production",
+            Owner: "Ops",
+          },
+        },
+      ],
+    });
+    new Vpc(this, "example", {
+      tags: {
+        Name: "MyVPC",
+      },
+    });
+  }
+}
+
+```
+
+In this example, the `environment` and `owner` tags defined within the provider configuration block will be added to the VPC on resource creation, in addition to the `name` tag defined within the VPC resource configuration.
+To access all the tags applied to the VPC resource, use the read-only attribute `tagsAll`, e.g., `awsVpcExampleTagsAll`.
+
+<!-- cache-key: cdktf-0.18.0 input-d76ea6fe81ad5c47295d3452558feb86a504b39383ae3e8bd97aba4cffd8dba7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/guides/using-aws-with-awscc-provider.html.markdown b/website/docs/cdktf/typescript/guides/using-aws-with-awscc-provider.html.markdown
new file mode 100644
index 00000000000..b065afdf269
--- /dev/null
+++ b/website/docs/cdktf/typescript/guides/using-aws-with-awscc-provider.html.markdown
@@ -0,0 +1,194 @@
+---
+subcategory: ""
+layout: "aws"
+page_title: "Using the Terraform awscc provider with aws provider"
+description: |-
+  Managing resource tags with the Terraform AWS Provider.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Using AWS & AWSCC Provider Together
+
+~> **NOTE:** The `awscc` provider is currently in technical preview. This means some aspects of its design and implementation are not yet considered stable for production use. We are actively looking for community feedback in order to identify needed improvements.
+
+The [HashiCorp Terraform AWS Cloud Control Provider](https://registry.terraform.io/providers/hashicorp/awscc/latest) aims to bring Amazon Web Services (AWS) resources to Terraform users faster. The new provider is automatically generated, which means new features and services on AWS can be supported right away. The AWS Cloud Control provider supports hundreds of AWS resources, with more support being added as AWS service teams adopt the Cloud Control API standard.
+
+For Terraform users managing infrastructure on AWS, we expect the AWSCC provider will be used alongside the existing AWS provider. This guide is provided to show guidance and an example of using the providers together to deploy an AWS Cloud WAN Core Network.
+
+For more information about the AWSCC provider, please see the provider documentation in [Terraform Registry](https://registry.terraform.io/providers/hashicorp/awscc/latest)
+
+<!-- TOC depthFrom:2 -->
+
+- [AWS CloudWAN Overview](#aws-cloud-wan)
+- [Specifying Multiple Providers](#specifying-multiple-providers)
+    - [First Look at AWSCC Resources](#first-look-at-awscc-resources)
+    - [Using AWS and AWSCC Providers Together](#using-aws-and-awscc-providers-together)
+
+<!-- /TOC -->
+
+## AWS Cloud Wan
+
+In this guide we will deploy [AWS Cloud WAN](https://aws.amazon.com/cloud-wan/) to demonstrate how both AWS & AWSCC can work togther. Cloud WAN is a wide area networking (WAN) service that helps you build, manage, and monitor a unified global network that manages traffic running between resources in your cloud and on-premises environments.
+
+With Cloud WAN, you define network policies that are used to create a global network that spans multiple locations and networks—eliminating the need to configure and manage different networks individually using different technologies. Your network policies can be used to specify which of your Amazon Virtual Private Clouds (VPCs) and on-premises locations you wish to connect through AWS VPN or third-party software-defined WAN (SD-WAN) products, and the Cloud WAN central dashboard generates a complete view of the network to monitor network health, security, and performance. Cloud WAN automatically creates a global network across AWS Regions using Border Gateway Protocol (BGP), so you can easily exchange routes around the world.
+
+For more information on AWS Cloud WAN see [the documentation.](https://docs.aws.amazon.com/vpc/latest/cloudwan/what-is-cloudwan.html)
+
+## Specifying Multiple Providers
+
+Terraform can use many providers at once, as long as they are specified in your `terraform` configuration block:
+
+```terraform
+terraform {
+  required_version = ">= 1.0.7"
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 4.9.0"
+    }
+    awscc = {
+      source  = "hashicorp/awscc"
+      version = ">= 0.25.0"
+    }
+  }
+}
+```
+
+The code snippet above informs terraform to download 2 providers as plugins for the current root module, the AWS and AWSCC provider. You can tell which provider is being use by looking at the resource or data source name-prefix. Resources that start with `aws` use the AWS provider, resources that start with `awscc` are using the AWSCC provider.
+
+### First look at AWSCC resources
+
+Lets start by building our [global network](https://aws.amazon.com/about-aws/global-infrastructure/global_network/) which will house our core network.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { NetworkmanagerGlobalNetwork } from "./.gen/providers/awscc/networkmanager-global-network";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    /*The following providers are missing schema information and might need manual adjustments to synthesize correctly: awscc.
+    For a more precise conversion please use the --provider flag in convert.*/
+    const terraformTag = [
+      {
+        key: "terraform",
+        value: "true",
+      },
+    ];
+    new NetworkmanagerGlobalNetwork(this, "main", {
+      description: "My Global Network",
+      tags: Fn.concat([
+        terraformTag,
+        [
+          {
+            key: "Name",
+            value: "My Global Network",
+          },
+        ],
+      ]),
+    });
+  }
+}
+
+```
+
+Above, we define a `awsccNetworkmanagerGlobalNetwork` with 2 tags and a description. AWSCC resources use the [standard AWS tag format](https://docs.aws.amazon.com/general/latest/gr/aws_tagging.html) which is expressed in HCL as a list of maps with 2 keys. We want to reuse the `terraform = true` tag so we define it as a `local` then we use [concat](https://www.terraform.io/language/functions/concat) to join the list of tags together.
+
+### Using AWS and AWSCC providers together
+
+Next we will create a [core network](https://docs.aws.amazon.com/vpc/latest/cloudwan/cloudwan-core-network-policy.html) using an AWSCC resource `awsccNetworkmanagerCoreNetwork` and an AWS data source `dataAwsNetworkmanagerCoreNetworkPolicyDocument` which allows users to write HCL to generate the json policy used as the [core policy network](https://docs.aws.amazon.com/vpc/latest/cloudwan/cloudwan-policies-json.html).
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, Fn, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsNetworkmanagerCoreNetworkPolicyDocument } from "./.gen/providers/aws/data-aws-networkmanager-core-network-policy-document";
+import { NetworkmanagerCoreNetwork } from "./.gen/providers/awscc/networkmanager-core-network";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    /*The following providers are missing schema information and might need manual adjustments to synthesize correctly: awscc.
+    For a more precise conversion please use the --provider flag in convert.*/
+    const main = new DataAwsNetworkmanagerCoreNetworkPolicyDocument(
+      this,
+      "main",
+      {
+        attachmentPolicies: [
+          {
+            action: {
+              associationMethod: "constant",
+              segment: "shared",
+            },
+            conditionLogic: "or",
+            conditions: [
+              {
+                key: "segment",
+                operator: "equals",
+                type: "tag-value",
+                value: "shared",
+              },
+            ],
+            ruleNumber: 1,
+          },
+        ],
+        coreNetworkConfiguration: [
+          {
+            asnRanges: ["64512-64555"],
+            edgeLocations: [
+              {
+                asn: Token.asString(64512),
+                location: "us-east-1",
+              },
+            ],
+            vpnEcmpSupport: false,
+          },
+        ],
+        segmentActions: [
+          {
+            action: "share",
+            mode: "attachment-route",
+            segment: "shared",
+            shareWith: ["*"],
+          },
+        ],
+        segments: [
+          {
+            description: "SegmentForSharedServices",
+            name: "shared",
+            requireAttachmentAcceptance: true,
+          },
+        ],
+      }
+    );
+    const awsccNetworkmanagerCoreNetworkMain = new NetworkmanagerCoreNetwork(
+      this,
+      "main_1",
+      {
+        description: "My Core Network",
+        global_network_id: awsccNetworkmanagerGlobalNetworkMain.id,
+        policy_document: Fn.jsonencode(
+          Fn.jsondecode(Token.asString(main.json))
+        ),
+        tags: terraformTag,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsccNetworkmanagerCoreNetworkMain.overrideLogicalId("main");
+  }
+}
+
+```
+
+Thanks to Terraform's plugin design, the providers work together seemlessly!
+
+<!-- cache-key: cdktf-0.18.0 input-d0049083f5b79a00f6a6b9e71c9150830577760133eb5f349b9d3fe97a23ad13 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/guides/version-2-upgrade.html.markdown b/website/docs/cdktf/typescript/guides/version-2-upgrade.html.markdown
new file mode 100644
index 00000000000..a46c8b36045
--- /dev/null
+++ b/website/docs/cdktf/typescript/guides/version-2-upgrade.html.markdown
@@ -0,0 +1,1563 @@
+---
+subcategory: ""
+layout: "aws"
+page_title: "Terraform AWS Provider Version 2 Upgrade Guide"
+description: |-
+  Terraform AWS Provider Version 2 Upgrade Guide
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Terraform AWS Provider Version 2 Upgrade Guide
+
+Version 2.0.0 of the AWS provider for Terraform is a major release and includes some changes that you will need to consider when upgrading. This guide is intended to help with that process and focuses only on changes from version 1.60.0 to version 2.0.0.
+
+Most of the changes outlined in this guide have been previously marked as deprecated in the Terraform plan/apply output throughout previous provider releases. These changes, such as deprecation notices, can always be found in the [Terraform AWS Provider CHANGELOG](https://github.com/hashicorp/terraform-provider-aws/blob/main/CHANGELOG.md).
+
+Upgrade topics:
+
+<!-- TOC depthFrom:2 depthTo:2 -->
+
+- [Provider Version Configuration](#provider-version-configuration)
+- [Provider: Configuration](#provider-configuration)
+- [Data Source: aws_ami](#data-source-aws_ami)
+- [Data Source: aws_ami_ids](#data-source-aws_ami_ids)
+- [Data Source: aws_iam_role](#data-source-aws_iam_role)
+- [Data Source: aws_kms_secret](#data-source-aws_kms_secret)
+- [Data Source: aws_lambda_function](#data-source-aws_lambda_function)
+- [Data Source: aws_region](#data-source-aws_region)
+- [Resource: aws_api_gateway_api_key](#resource-aws_api_gateway_api_key)
+- [Resource: aws_api_gateway_integration](#resource-aws_api_gateway_integration)
+- [Resource: aws_api_gateway_integration_response](#resource-aws_api_gateway_integration_response)
+- [Resource: aws_api_gateway_method](#resource-aws_api_gateway_method)
+- [Resource: aws_api_gateway_method_response](#resource-aws_api_gateway_method_response)
+- [Resource: aws_appautoscaling_policy](#resource-aws_appautoscaling_policy)
+- [Resource: aws_autoscaling_policy](#resource-aws_autoscaling_policy)
+- [Resource: aws_batch_compute_environment](#resource-aws_batch_compute_environment)
+- [Resource: aws_cloudfront_distribution](#resource-aws_cloudfront_distribution)
+- [Resource: aws_cognito_user_pool](#resource-aws_cognito_user_pool)
+- [Resource: aws_dx_lag](#resource-aws_dx_lag)
+- [Resource: aws_ecs_service](#resource-aws_ecs_service)
+- [Resource: aws_efs_file_system](#resource-aws_efs_file_system)
+- [Resource: aws_elasticache_cluster](#resource-aws_elasticache_cluster)
+- [Resource: aws_iam_user_login_profile](#resource-aws_iam_user_login_profile)
+- [Resource: aws_instance](#resource-aws_instance)
+- [Resource: aws_lambda_function](#resource-aws_lambda_function)
+- [Resource: aws_lambda_layer_version](#resource-aws_lambda_layer_version)
+- [Resource: aws_network_acl](#resource-aws_network_acl)
+- [Resource: aws_redshift_cluster](#resource-aws_redshift_cluster)
+- [Resource: aws_route_table](#resource-aws_route_table)
+- [Resource: aws_route53_record](#resource-aws_route53_record)
+- [Resource: aws_route53_zone](#resource-aws_route53_zone)
+- [Resource: aws_wafregional_byte_match_set](#resource-aws_wafregional_byte_match_set)
+
+<!-- /TOC -->
+
+## Provider Version Configuration
+
+-> Before upgrading to version 2.0.0 or later, it is recommended to upgrade to the most recent 1.X version of the provider (version 1.60.0) and ensure that your environment successfully runs [`terraform plan`](https://www.terraform.io/docs/commands/plan.html) without unexpected changes or deprecation notices.
+
+We recommend using [version constraints when configuring Terraform providers](https://www.terraform.io/docs/configuration/providers.html#provider-versions). If you are following that recommendation, update the version constraints in your Terraform configuration and run [`terraform init`](https://www.terraform.io/docs/commands/init.html) to download the new version.
+
+Update to latest 1.X version:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AwsProvider } from "./.gen/providers/aws/provider";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AwsProvider(this, "aws", {});
+  }
+}
+
+```
+
+Update to latest 2.X version:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AwsProvider } from "./.gen/providers/aws/provider";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AwsProvider(this, "aws", {});
+  }
+}
+
+```
+
+## Provider: Configuration
+
+### skip_requesting_account_id Argument Now Required to Skip Account ID Lookup Errors
+
+If the provider is unable to determine the AWS account ID from a provider assume role configuration or the STS GetCallerIdentity call used to verify the credentials (if `skip_credentials_validation = false`), it will attempt to lookup the AWS account ID via EC2 metadata, IAM GetUser, IAM ListRoles, and STS GetCallerIdentity. Previously, the provider would silently allow the failure of all the above methods.
+
+The provider will now return an error to ensure operators understand the implications of the missing AWS account ID in the provider.
+
+If necessary, the AWS account ID lookup logic can be skipped via:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AwsProvider } from "./.gen/providers/aws/provider";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AwsProvider(this, "aws", {
+      skipRequestingAccountId: true,
+    });
+  }
+}
+
+```
+
+## Data Source: aws_ami
+
+### owners Argument Now Required
+
+The `owners` argument is now required. Specifying `ownerId` or `ownerAlias` under `filter` does not satisfy this requirement.
+
+## Data Source: aws_ami_ids
+
+### owners Argument Now Required
+
+The `owners` argument is now required. Specifying `ownerId` or `ownerAlias` under `filter` does not satisfy this requirement.
+
+## Data Source: aws_iam_role
+
+### assume_role_policy_document Attribute Removal
+
+Switch your attribute references to the `assumeRolePolicy` attribute instead.
+
+### role_id Attribute Removal
+
+Switch your attribute references to the `uniqueId` attribute instead.
+
+### role_name Argument Removal
+
+Switch your Terraform configuration to the `name` argument instead.
+
+## Data Source: aws_kms_secret
+
+### Data Source Removal and Migrating to aws_kms_secrets Data Source
+
+The implementation of the `awsKmsSecret` data source, prior to Terraform AWS provider version 2.0.0, used dynamic attribute behavior which is not supported with Terraform 0.12 and beyond (full details available in [this GitHub issue](https://github.com/hashicorp/terraform-provider-aws/issues/5144)).
+
+Terraform configuration migration steps:
+
+* Change the data source type from `awsKmsSecret` to `awsKmsSecrets`
+* Change any attribute reference (e.g., `"${dataAwsKmsSecretExampleAttribute}"`) from `attribute` to `plaintext["attribute"]`
+
+As an example, lets take the below sample configuration and migrate it.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsKmsSecret } from "./.gen/providers/aws/data-aws-kms-secret";
+import { RdsCluster } from "./.gen/providers/aws/rds-cluster";
+interface MyConfig {
+  engine: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    const example = new DataAwsKmsSecret(this, "example", {
+      secret: [
+        {
+          name: "master_password",
+          payload: "AQEC...",
+        },
+        {
+          name: "master_username",
+          payload: "AQEC...",
+        },
+      ],
+    });
+    const awsRdsClusterExample = new RdsCluster(this, "example_1", {
+      masterPassword: Token.asString(example.masterPassword),
+      masterUsername: Token.asString(example.masterUsername),
+      engine: config.engine,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsRdsClusterExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+Notice that the `awsKmsSecret` data source previously was taking the two `secret` configuration block `name` arguments and generating those as attribute names (`masterPassword` and `masterUsername` in this case). To remove the incompatible behavior, this updated version of the data source provides the decrypted value of each of those `secret` configuration block `name` arguments within a map attribute named `plaintext`.
+
+Updating the sample configuration from above:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsKmsSecrets } from "./.gen/providers/aws/data-aws-kms-secrets";
+import { RdsCluster } from "./.gen/providers/aws/rds-cluster";
+interface MyConfig {
+  engine: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    const example = new DataAwsKmsSecrets(this, "example", {
+      secret: [
+        {
+          name: "master_password",
+          payload: "AQEC...",
+        },
+        {
+          name: "master_username",
+          payload: "AQEC...",
+        },
+      ],
+    });
+    const awsRdsClusterExample = new RdsCluster(this, "example_1", {
+      masterPassword: Token.asString(
+        Fn.lookupNested(example.plaintext, ['"master_password"'])
+      ),
+      masterUsername: Token.asString(
+        Fn.lookupNested(example.plaintext, ['"master_username"'])
+      ),
+      engine: config.engine,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsRdsClusterExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Data Source: aws_lambda_function
+
+### arn and qualified_arn Attribute Behavior Changes
+
+The `arn` attribute now always returns the unqualified (no `:qualifier` or `:version` suffix) ARN value and the `qualifiedArn` attribute now always returns the qualified (includes `:qualifier` or `:version` suffix) ARN value. Previously by default, the `arn` attribute included `:$latest` suffix when not setting the optional `qualifier` argument, which was not compatible with many other resources. To restore the previous default behavior, set the `qualifier` argument to `$latest` and reference the `qualifiedArn` attribute.
+
+## Data Source: aws_region
+
+### current Argument Removal
+
+Simply remove `current = true` from your Terraform configuration. The data source defaults to the current provider region if no other filtering is enabled.
+
+## Resource: aws_api_gateway_api_key
+
+### stage_key Argument Removal
+
+Since the API Gateway usage plans feature was launched on August 11, 2016, usage plans are now required to associate an API key with an API stage. To migrate your Terraform configuration, the AWS provider implements support for usage plans with the following resources:
+
+* [`awsApiGatewayUsagePlan`](/docs/providers/aws/r/api_gateway_usage_plan.html)
+* [`awsApiGatewayUsagePlanKey`](/docs/providers/aws/r/api_gateway_usage_plan_key.html)
+
+For example, given this previous configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ApiGatewayApiKey } from "./.gen/providers/aws/api-gateway-api-key";
+import { ApiGatewayDeployment } from "./.gen/providers/aws/api-gateway-deployment";
+import { ApiGatewayRestApi } from "./.gen/providers/aws/api-gateway-rest-api";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new ApiGatewayRestApi(this, "example", {
+      name: "example",
+    });
+    const awsApiGatewayDeploymentExample = new ApiGatewayDeployment(
+      this,
+      "example_1",
+      {
+        restApiId: example.id,
+        stageName: "example",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsApiGatewayDeploymentExample.overrideLogicalId("example");
+    const awsApiGatewayApiKeyExample = new ApiGatewayApiKey(this, "example_2", {
+      name: "example",
+      stage_key: [
+        {
+          rest_api_id: example.id,
+          stage_name: awsApiGatewayDeploymentExample.stageName,
+        },
+      ],
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsApiGatewayApiKeyExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+An updated configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ApiGatewayApiKey } from "./.gen/providers/aws/api-gateway-api-key";
+import { ApiGatewayDeployment } from "./.gen/providers/aws/api-gateway-deployment";
+import { ApiGatewayRestApi } from "./.gen/providers/aws/api-gateway-rest-api";
+import { ApiGatewayUsagePlan } from "./.gen/providers/aws/api-gateway-usage-plan";
+import { ApiGatewayUsagePlanKey } from "./.gen/providers/aws/api-gateway-usage-plan-key";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new ApiGatewayApiKey(this, "example", {
+      name: "example",
+    });
+    const awsApiGatewayRestApiExample = new ApiGatewayRestApi(
+      this,
+      "example_1",
+      {
+        name: "example",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsApiGatewayRestApiExample.overrideLogicalId("example");
+    const awsApiGatewayDeploymentExample = new ApiGatewayDeployment(
+      this,
+      "example_2",
+      {
+        restApiId: Token.asString(awsApiGatewayRestApiExample.id),
+        stageName: "example",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsApiGatewayDeploymentExample.overrideLogicalId("example");
+    const awsApiGatewayUsagePlanExample = new ApiGatewayUsagePlan(
+      this,
+      "example_3",
+      {
+        apiStages: [
+          {
+            apiId: Token.asString(awsApiGatewayRestApiExample.id),
+            stage: Token.asString(awsApiGatewayDeploymentExample.stageName),
+          },
+        ],
+        name: "example",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsApiGatewayUsagePlanExample.overrideLogicalId("example");
+    const awsApiGatewayUsagePlanKeyExample = new ApiGatewayUsagePlanKey(
+      this,
+      "example_4",
+      {
+        keyId: example.id,
+        keyType: "API_KEY",
+        usagePlanId: Token.asString(awsApiGatewayUsagePlanExample.id),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsApiGatewayUsagePlanKeyExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Resource: aws_api_gateway_integration
+
+### request_parameters_in_json Argument Removal
+
+Switch your Terraform configuration to the `requestParameters` argument instead.
+
+For example, given this previous configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ApiGatewayIntegration } from "./.gen/providers/aws/api-gateway-integration";
+interface MyConfig {
+  httpMethod: any;
+  resourceId: any;
+  restApiId: any;
+  type: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new ApiGatewayIntegration(this, "example", {
+      request_parameters_in_json:
+        '{\n    "integration.request.header.X-Authorization": "\'static\'"\n}\n\n',
+      httpMethod: config.httpMethod,
+      resourceId: config.resourceId,
+      restApiId: config.restApiId,
+      type: config.type,
+    });
+  }
+}
+
+```
+
+An updated configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ApiGatewayIntegration } from "./.gen/providers/aws/api-gateway-integration";
+interface MyConfig {
+  httpMethod: any;
+  resourceId: any;
+  restApiId: any;
+  type: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new ApiGatewayIntegration(this, "example", {
+      requestParameters: {
+        "integration.request.header.X-Authorization": "'static'",
+      },
+      httpMethod: config.httpMethod,
+      resourceId: config.resourceId,
+      restApiId: config.restApiId,
+      type: config.type,
+    });
+  }
+}
+
+```
+
+## Resource: aws_api_gateway_integration_response
+
+### response_parameters_in_json Argument Removal
+
+Switch your Terraform configuration to the `responseParameters` argument instead.
+
+For example, given this previous configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ApiGatewayIntegrationResponse } from "./.gen/providers/aws/api-gateway-integration-response";
+interface MyConfig {
+  httpMethod: any;
+  resourceId: any;
+  restApiId: any;
+  statusCode: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new ApiGatewayIntegrationResponse(this, "example", {
+      response_parameters_in_json:
+        '{\n    "method.response.header.Content-Type": "integration.response.body.type"\n}\n\n',
+      httpMethod: config.httpMethod,
+      resourceId: config.resourceId,
+      restApiId: config.restApiId,
+      statusCode: config.statusCode,
+    });
+  }
+}
+
+```
+
+An updated configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ApiGatewayIntegrationResponse } from "./.gen/providers/aws/api-gateway-integration-response";
+interface MyConfig {
+  httpMethod: any;
+  resourceId: any;
+  restApiId: any;
+  statusCode: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new ApiGatewayIntegrationResponse(this, "example", {
+      responseParameters: {
+        "method.response.header.Content-Type": "integration.response.body.type",
+      },
+      httpMethod: config.httpMethod,
+      resourceId: config.resourceId,
+      restApiId: config.restApiId,
+      statusCode: config.statusCode,
+    });
+  }
+}
+
+```
+
+## Resource: aws_api_gateway_method
+
+### request_parameters_in_json Argument Removal
+
+Switch your Terraform configuration to the `requestParameters` argument instead.
+
+For example, given this previous configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ApiGatewayMethod } from "./.gen/providers/aws/api-gateway-method";
+interface MyConfig {
+  authorization: any;
+  httpMethod: any;
+  resourceId: any;
+  restApiId: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new ApiGatewayMethod(this, "example", {
+      request_parameters_in_json:
+        '{\n    "method.request.header.Content-Type": false,\n    "method.request.querystring.page": true\n}\n\n',
+      authorization: config.authorization,
+      httpMethod: config.httpMethod,
+      resourceId: config.resourceId,
+      restApiId: config.restApiId,
+    });
+  }
+}
+
+```
+
+An updated configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ApiGatewayMethod } from "./.gen/providers/aws/api-gateway-method";
+interface MyConfig {
+  authorization: any;
+  httpMethod: any;
+  resourceId: any;
+  restApiId: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new ApiGatewayMethod(this, "example", {
+      requestParameters: {
+        "method.request.header.Content-Type": false,
+        "method.request.querystring.page": true,
+      },
+      authorization: config.authorization,
+      httpMethod: config.httpMethod,
+      resourceId: config.resourceId,
+      restApiId: config.restApiId,
+    });
+  }
+}
+
+```
+
+## Resource: aws_api_gateway_method_response
+
+### response_parameters_in_json Argument Removal
+
+Switch your Terraform configuration to the `responseParameters` argument instead.
+
+For example, given this previous configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ApiGatewayMethodResponse } from "./.gen/providers/aws/api-gateway-method-response";
+interface MyConfig {
+  httpMethod: any;
+  resourceId: any;
+  restApiId: any;
+  statusCode: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new ApiGatewayMethodResponse(this, "example", {
+      response_parameters_in_json:
+        '{\n    "method.response.header.Content-Type": true\n}\n\n',
+      httpMethod: config.httpMethod,
+      resourceId: config.resourceId,
+      restApiId: config.restApiId,
+      statusCode: config.statusCode,
+    });
+  }
+}
+
+```
+
+An updated configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ApiGatewayMethodResponse } from "./.gen/providers/aws/api-gateway-method-response";
+interface MyConfig {
+  httpMethod: any;
+  resourceId: any;
+  restApiId: any;
+  statusCode: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new ApiGatewayMethodResponse(this, "example", {
+      responseParameters: {
+        "method.response.header.Content-Type": true,
+      },
+      httpMethod: config.httpMethod,
+      resourceId: config.resourceId,
+      restApiId: config.restApiId,
+      statusCode: config.statusCode,
+    });
+  }
+}
+
+```
+
+## Resource: aws_appautoscaling_policy
+
+### Argument Removals
+
+The following arguments have been moved into a nested argument named `stepScalingPolicyConfiguration`:
+
+* `adjustmentType`
+* `cooldown`
+* `metricAggregationType`
+* `minAdjustmentMagnitude`
+* `stepAdjustment`
+
+For example, given this previous configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Op, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AppautoscalingPolicy } from "./.gen/providers/aws/appautoscaling-policy";
+interface MyConfig {
+  name: any;
+  resourceId: any;
+  scalableDimension: any;
+  serviceNamespace: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new AppautoscalingPolicy(this, "example", {
+      adjustment_type: "ChangeInCapacity",
+      cooldown: 60,
+      metric_aggregation_type: "Maximum",
+      step_adjustment: [
+        {
+          metric_interval_upper_bound: 0,
+          scaling_adjustment: Op.negate(1),
+        },
+      ],
+      name: config.name,
+      resourceId: config.resourceId,
+      scalableDimension: config.scalableDimension,
+      serviceNamespace: config.serviceNamespace,
+    });
+  }
+}
+
+```
+
+An updated configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, Op, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AppautoscalingPolicy } from "./.gen/providers/aws/appautoscaling-policy";
+interface MyConfig {
+  name: any;
+  resourceId: any;
+  scalableDimension: any;
+  serviceNamespace: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new AppautoscalingPolicy(this, "example", {
+      stepScalingPolicyConfiguration: {
+        adjustmentType: "ChangeInCapacity",
+        cooldown: 60,
+        metricAggregationType: "Maximum",
+        stepAdjustment: [
+          {
+            metricIntervalUpperBound: Token.asString(0),
+            scalingAdjustment: Token.asNumber(Op.negate(1)),
+          },
+        ],
+      },
+      name: config.name,
+      resourceId: config.resourceId,
+      scalableDimension: config.scalableDimension,
+      serviceNamespace: config.serviceNamespace,
+    });
+  }
+}
+
+```
+
+## Resource: aws_autoscaling_policy
+
+### min_adjustment_step Argument Removal
+
+Switch your Terraform configuration to the `minAdjustmentMagnitude` argument instead.
+
+For example, given this previous configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AutoscalingPolicy } from "./.gen/providers/aws/autoscaling-policy";
+interface MyConfig {
+  autoscalingGroupName: any;
+  name: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new AutoscalingPolicy(this, "example", {
+      min_adjustment_step: 2,
+      autoscalingGroupName: config.autoscalingGroupName,
+      name: config.name,
+    });
+  }
+}
+
+```
+
+An updated configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AutoscalingPolicy } from "./.gen/providers/aws/autoscaling-policy";
+interface MyConfig {
+  autoscalingGroupName: any;
+  name: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new AutoscalingPolicy(this, "example", {
+      minAdjustmentMagnitude: 2,
+      autoscalingGroupName: config.autoscalingGroupName,
+      name: config.name,
+    });
+  }
+}
+
+```
+
+## Resource: aws_batch_compute_environment
+
+### ecc_cluster_arn Attribute Removal
+
+Switch your attribute references to the `ecsClusterArn` attribute instead.
+
+## Resource: aws_cloudfront_distribution
+
+### cache_behavior Argument Removal
+
+Switch your Terraform configuration to the `orderedCacheBehavior` argument instead. It behaves similar to the previous `cacheBehavior` argument, however the ordering of the configurations in Terraform is now reflected in the distribution where previously it was indeterminate.
+
+For example, given this previous configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudfrontDistribution } from "./.gen/providers/aws/cloudfront-distribution";
+interface MyConfig {
+  defaultCacheBehavior: any;
+  enabled: any;
+  origin: any;
+  restrictions: any;
+  viewerCertificate: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new CloudfrontDistribution(this, "example", {
+      cache_behavior: [{}, {}],
+      defaultCacheBehavior: config.defaultCacheBehavior,
+      enabled: config.enabled,
+      origin: config.origin,
+      restrictions: config.restrictions,
+      viewerCertificate: config.viewerCertificate,
+    });
+  }
+}
+
+```
+
+An updated configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudfrontDistribution } from "./.gen/providers/aws/cloudfront-distribution";
+interface MyConfig {
+  allowedMethods: any;
+  cachedMethods: any;
+  pathPattern: any;
+  targetOriginId: any;
+  viewerProtocolPolicy: any;
+  allowedMethods1: any;
+  cachedMethods1: any;
+  pathPattern1: any;
+  targetOriginId1: any;
+  viewerProtocolPolicy1: any;
+  defaultCacheBehavior: any;
+  enabled: any;
+  origin: any;
+  restrictions: any;
+  viewerCertificate: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new CloudfrontDistribution(this, "example", {
+      orderedCacheBehavior: [
+        {
+          allowedMethods: config.allowedMethods,
+          cachedMethods: config.cachedMethods,
+          pathPattern: config.pathPattern,
+          targetOriginId: config.targetOriginId,
+          viewerProtocolPolicy: config.viewerProtocolPolicy,
+        },
+        {
+          allowedMethods: config.allowedMethods1,
+          cachedMethods: config.cachedMethods1,
+          pathPattern: config.pathPattern1,
+          targetOriginId: config.targetOriginId1,
+          viewerProtocolPolicy: config.viewerProtocolPolicy1,
+        },
+      ],
+      defaultCacheBehavior: config.defaultCacheBehavior,
+      enabled: config.enabled,
+      origin: config.origin,
+      restrictions: config.restrictions,
+      viewerCertificate: config.viewerCertificate,
+    });
+  }
+}
+
+```
+
+## Resource: aws_cognito_user_pool
+
+### email_verification_subject Argument Now Conflicts With verification_message_template Configuration Block email_subject Argument
+
+Choose one argument or the other. These arguments update the same underlying information in Cognito and the selection is indeterminate if differing values are provided.
+
+### email_verification_message Argument Now Conflicts With verification_message_template Configuration Block email_message Argument
+
+Choose one argument or the other. These arguments update the same underlying information in Cognito and the selection is indeterminate if differing values are provided.
+
+### sms_verification_message Argument Now Conflicts With verification_message_template Configuration Block sms_message Argument
+
+Choose one argument or the other. These arguments update the same underlying information in Cognito and the selection is indeterminate if differing values are provided.
+
+## Resource: aws_dx_lag
+
+### number_of_connections Argument Removal
+
+Default connections have been removed as part of LAG creation. To migrate your Terraform configuration, the AWS provider implements the following resources:
+
+* [`awsDxConnection`](/docs/providers/aws/r/dx_connection.html)
+* [`awsDxConnectionAssociation`](/docs/providers/aws/r/dx_connection_association.html)
+
+For example, given this previous configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DxLag } from "./.gen/providers/aws/dx-lag";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DxLag(this, "example", {
+      connectionsBandwidth: "1Gbps",
+      location: "EqSe2-EQ",
+      name: "example",
+      number_of_connections: 1,
+    });
+  }
+}
+
+```
+
+An updated configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DxConnection } from "./.gen/providers/aws/dx-connection";
+import { DxConnectionAssociation } from "./.gen/providers/aws/dx-connection-association";
+import { DxLag } from "./.gen/providers/aws/dx-lag";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new DxConnection(this, "example", {
+      bandwidth: "1Gbps",
+      location: "EqSe2-EQ",
+      name: "example",
+    });
+    const awsDxLagExample = new DxLag(this, "example_1", {
+      connectionsBandwidth: "1Gbps",
+      location: "EqSe2-EQ",
+      name: "example",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsDxLagExample.overrideLogicalId("example");
+    const awsDxConnectionAssociationExample = new DxConnectionAssociation(
+      this,
+      "example_2",
+      {
+        connectionId: example.id,
+        lagId: Token.asString(awsDxLagExample.id),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsDxConnectionAssociationExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Resource: aws_ecs_service
+
+### placement_strategy Argument Removal
+
+Switch your Terraform configuration to the `orderedPlacementStrategy` argument instead. It behaves similar to the previous `placementStrategy` argument, however the ordering of the configurations in Terraform is now reflected in the distribution where previously it was indeterminate.
+
+For example, given this previous configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EcsService } from "./.gen/providers/aws/ecs-service";
+interface MyConfig {
+  name: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new EcsService(this, "example", {
+      placement_strategy: [{}, {}],
+      name: config.name,
+    });
+  }
+}
+
+```
+
+An updated configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EcsService } from "./.gen/providers/aws/ecs-service";
+interface MyConfig {
+  type: any;
+  type1: any;
+  name: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new EcsService(this, "example", {
+      orderedPlacementStrategy: [
+        {
+          type: config.type,
+        },
+        {
+          type: config.type1,
+        },
+      ],
+      name: config.name,
+    });
+  }
+}
+
+```
+
+## Resource: aws_efs_file_system
+
+### reference_name Argument Removal
+
+Switch your Terraform configuration to the `creationToken` argument instead.
+
+For example, given this previous configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EfsFileSystem } from "./.gen/providers/aws/efs-file-system";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new EfsFileSystem(this, "example", {
+      reference_name: "example",
+    });
+  }
+}
+
+```
+
+An updated configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EfsFileSystem } from "./.gen/providers/aws/efs-file-system";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new EfsFileSystem(this, "example", {
+      creationToken: "example",
+    });
+  }
+}
+
+```
+
+## Resource: aws_elasticache_cluster
+
+### availability_zones Argument Removal
+
+Switch your Terraform configuration to the `preferredAvailabilityZones` argument instead. The argument is still optional and the API will continue to automatically choose Availability Zones for nodes if not specified. The new argument will also continue to match the APIs required behavior that the length of the list must be the same as `numCacheNodes`.
+
+For example, given this previous configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ElasticacheCluster } from "./.gen/providers/aws/elasticache-cluster";
+interface MyConfig {
+  clusterId: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new ElasticacheCluster(this, "example", {
+      availability_zones: ["us-west-2a", "us-west-2b"],
+      clusterId: config.clusterId,
+    });
+  }
+}
+
+```
+
+An updated configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ElasticacheCluster } from "./.gen/providers/aws/elasticache-cluster";
+interface MyConfig {
+  clusterId: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new ElasticacheCluster(this, "example", {
+      preferredAvailabilityZones: ["us-west-2a", "us-west-2b"],
+      clusterId: config.clusterId,
+    });
+  }
+}
+
+```
+
+## Resource: aws_iam_user_login_profile
+
+### Import Now Required For Existing Infrastructure
+
+When attempting to bring existing IAM User Login Profiles under Terraform management, `terraform import` is now required. See the [`awsIamUserLoginProfile` resource documentation](https://www.terraform.io/docs/providers/aws/r/iam_user_login_profile.html) for more information.
+
+## Resource: aws_instance
+
+### network_interface_id Attribute Removal
+
+Switch your attribute references to the `primaryNetworkInterfaceId` attribute instead.
+
+## Resource: aws_lambda_function
+
+### reserved_concurrent_executions Argument Behavior Change
+
+Setting `reservedConcurrentExecutions` to `0` will now disable Lambda Function invocations, causing downtime for the Lambda Function.
+
+Previously `reservedConcurrentExecutions` accepted `0` and below for unreserved concurrency, which means it was not previously possible to disable invocations. The argument now differentiates between a new value for unreserved concurrency (`1`) and disabling Lambda invocations (`0`). If previously configuring this value to `0` for unreserved concurrency, update the configured value to `1` or the resource will disable Lambda Function invocations on update. If previously unconfigured, the argument does not require any changes.
+
+See the [Lambda User Guide](https://docs.aws.amazon.com/lambda/latest/dg/concurrent-executions.html) for more information about concurrency.
+
+## Resource: aws_lambda_layer_version
+
+### arn and layer_arn Attribute Value Swap
+
+Switch your `arn` attribute references to the `layerArn` attribute instead and vice-versa.
+
+## Resource: aws_network_acl
+
+### subnet_id Argument Removal
+
+Switch your Terraform configuration to the `subnetIds` argument instead.
+
+For example, given this previous configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { NetworkAcl } from "./.gen/providers/aws/network-acl";
+interface MyConfig {
+  vpcId: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new NetworkAcl(this, "example", {
+      subnet_id: "subnet-12345678",
+      vpcId: config.vpcId,
+    });
+  }
+}
+
+```
+
+An updated configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { NetworkAcl } from "./.gen/providers/aws/network-acl";
+interface MyConfig {
+  vpcId: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new NetworkAcl(this, "example", {
+      subnetIds: ["subnet-12345678"],
+      vpcId: config.vpcId,
+    });
+  }
+}
+
+```
+
+## Resource: aws_redshift_cluster
+
+### Argument Removals
+
+The following arguments have been moved into a nested argument named `logging`:
+
+* `bucketName`
+* `enableLogging` (also renamed to just `enable`)
+* `s3KeyPrefix`
+
+For example, given this previous configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { RedshiftCluster } from "./.gen/providers/aws/redshift-cluster";
+interface MyConfig {
+  clusterIdentifier: any;
+  nodeType: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new RedshiftCluster(this, "example", {
+      bucket_name: "example",
+      enable_logging: true,
+      s3_key_prefix: "example",
+      clusterIdentifier: config.clusterIdentifier,
+      nodeType: config.nodeType,
+    });
+  }
+}
+
+```
+
+An updated configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { RedshiftCluster } from "./.gen/providers/aws/redshift-cluster";
+interface MyConfig {
+  clusterIdentifier: any;
+  nodeType: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new RedshiftCluster(this, "example", {
+      logging: {
+        bucketName: "example",
+        enable: true,
+        s3KeyPrefix: "example",
+      },
+      clusterIdentifier: config.clusterIdentifier,
+      nodeType: config.nodeType,
+    });
+  }
+}
+
+```
+
+## Resource: aws_route_table
+
+### Import Change
+
+Previously, importing this resource resulted in an `awsRoute` resource for each route, in
+addition to the `awsRouteTable`, in the Terraform state. Support for importing `awsRoute` resources has been added and importing this resource only adds the `awsRouteTable`
+resource, with in-line routes, to the state.
+
+## Resource: aws_route53_record
+
+### allow_overwrite Default Value Change
+
+The resource now requires existing Route 53 Records to be imported into the Terraform state for management unless the `allowOverwrite` argument is enabled.
+
+For example, if the `wwwExampleCom` Route 53 Record in the `exampleCom` Route 53 Hosted Zone existed previously and this new Terraform configuration was introduced:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Route53Record } from "./.gen/providers/aws/route53-record";
+interface MyConfig {
+  type: any;
+  zoneId: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new Route53Record(this, "www", {
+      name: "www.example.com",
+      type: config.type,
+      zoneId: config.zoneId,
+    });
+  }
+}
+
+```
+
+During resource creation in version 1.X and prior, it would silently perform an `upsert` changeset to the existing Route 53 Record and not report back an error. In version 2.0.0 of the Terraform AWS Provider, the resource now performs a `create` changeset, which will error for existing Route 53 Records.
+
+The `allowOverwrite` argument provides a workaround to keep the old behavior, but most existing workflows should be updated to perform a `terraform import` command like the following instead:
+
+```console
+$ terraform import aws_route53_record.www ZONEID_www.example.com_TYPE
+```
+
+More information can be found in the [`awsRoute53Record` resource documentation](https://www.terraform.io/docs/providers/aws/r/route53_record.html#import).
+
+## Resource: aws_route53_zone
+
+### vpc_id and vpc_region Argument Removal
+
+Switch your Terraform configuration to `vpc` configuration block(s) instead.
+
+For example, given this previous configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Route53Zone } from "./.gen/providers/aws/route53-zone";
+interface MyConfig {
+  name: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new Route53Zone(this, "example", {
+      vpc_id: "...",
+      name: config.name,
+    });
+  }
+}
+
+```
+
+An updated configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Route53Zone } from "./.gen/providers/aws/route53-zone";
+interface MyConfig {
+  name: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new Route53Zone(this, "example", {
+      vpc: [
+        {
+          vpcId: "...",
+        },
+      ],
+      name: config.name,
+    });
+  }
+}
+
+```
+
+## Resource: aws_wafregional_byte_match_set
+
+### byte_match_tuple Argument Removal
+
+Switch your Terraform configuration to the `byteMatchTuples` argument instead.
+
+For example, given this previous configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { WafregionalByteMatchSet } from "./.gen/providers/aws/wafregional-byte-match-set";
+interface MyConfig {
+  name: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new WafregionalByteMatchSet(this, "example", {
+      byte_match_tuple: [{}, {}],
+      name: config.name,
+    });
+  }
+}
+
+```
+
+An updated configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { WafregionalByteMatchSet } from "./.gen/providers/aws/wafregional-byte-match-set";
+interface MyConfig {
+  fieldToMatch: any;
+  positionalConstraint: any;
+  textTransformation: any;
+  fieldToMatch1: any;
+  positionalConstraint1: any;
+  textTransformation1: any;
+  name: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new WafregionalByteMatchSet(this, "example", {
+      byteMatchTuples: [
+        {
+          fieldToMatch: config.fieldToMatch,
+          positionalConstraint: config.positionalConstraint,
+          textTransformation: config.textTransformation,
+        },
+        {
+          fieldToMatch: config.fieldToMatch1,
+          positionalConstraint: config.positionalConstraint1,
+          textTransformation: config.textTransformation1,
+        },
+      ],
+      name: config.name,
+    });
+  }
+}
+
+```
+
+<!-- cache-key: cdktf-0.18.0 input-603687597fabf51f83331995b133df850861a17c0d29ee4fbc2f2bfc3a7c98e8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/guides/version-3-upgrade.html.markdown b/website/docs/cdktf/typescript/guides/version-3-upgrade.html.markdown
new file mode 100644
index 00000000000..6a11a405afb
--- /dev/null
+++ b/website/docs/cdktf/typescript/guides/version-3-upgrade.html.markdown
@@ -0,0 +1,2545 @@
+---
+subcategory: ""
+layout: "aws"
+page_title: "Terraform AWS Provider Version 3 Upgrade Guide"
+description: |-
+  Terraform AWS Provider Version 3 Upgrade Guide
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Terraform AWS Provider Version 3 Upgrade Guide
+
+Version 3.0.0 of the AWS provider for Terraform is a major release and includes some changes that you will need to consider when upgrading. This guide is intended to help with that process and focuses only on changes from version 2.X to version 3.0.0. See the [Version 2 Upgrade Guide](/docs/providers/aws/guides/version-2-upgrade.html) for information about upgrading from 1.X to version 2.0.0.
+
+Most of the changes outlined in this guide have been previously marked as deprecated in the Terraform plan/apply output throughout previous provider releases. These changes, such as deprecation notices, can always be found in the [Terraform AWS Provider CHANGELOG](https://github.com/hashicorp/terraform-provider-aws/blob/main/CHANGELOG.md).
+
+~> **NOTE:** Version 3.0.0 and later of the AWS Provider can only be automatically installed on Terraform 0.12 and later.
+
+Upgrade topics:
+
+<!-- TOC depthFrom:2 depthTo:2 -->
+
+- [Provider Version Configuration](#provider-version-configuration)
+- [Provider Authentication Updates](#provider-authentication-updates)
+- [Provider Custom Service Endpoint Updates](#provider-custom-service-endpoint-updates)
+- [Data Source: aws_availability_zones](#data-source-aws_availability_zones)
+- [Data Source: aws_lambda_invocation](#data-source-aws_lambda_invocation)
+- [Data Source: aws_launch_template](#data-source-aws_launch_template)
+- [Data Source: aws_route53_resolver_rule](#data-source-aws_route53_resolver_rule)
+- [Data Source: aws_route53_zone](#data-source-aws_route53_zone)
+- [Resource: aws_acm_certificate](#resource-aws_acm_certificate)
+- [Resource: aws_api_gateway_method_settings](#resource-aws_api_gateway_method_settings)
+- [Resource: aws_autoscaling_group](#resource-aws_autoscaling_group)
+- [Resource: aws_cloudfront_distribution](#resource-aws_cloudfront_distribution)
+- [Resource: aws_cloudwatch_log_group](#resource-aws_cloudwatch_log_group)
+- [Resource: aws_codepipeline](#resource-aws_codepipeline)
+- [Resource: aws_cognito_user_pool](#resource-aws_cognito_user_pool)
+- [Resource: aws_dx_gateway](#resource-aws_dx_gateway)
+- [Resource: aws_dx_gateway_association](#resource-aws_dx_gateway_association)
+- [Resource: aws_dx_gateway_association_proposal](#resource-aws_dx_gateway_association_proposal)
+- [Resource: aws_ebs_volume](#resource-aws_ebs_volume)
+- [Resource: aws_elastic_transcoder_preset](#resource-aws_elastic_transcoder_preset)
+- [Resource: aws_emr_cluster](#resource-aws_emr_cluster)
+- [Resource: aws_glue_job](#resource-aws_glue_job)
+- [Resource: aws_iam_access_key](#resource-aws_iam_access_key)
+- [Resource: aws_iam_instance_profile](#resource-aws_iam_instance_profile)
+- [Resource: aws_iam_server_certificate](#resource-aws_iam_server_certificate)
+- [Resource: aws_instance](#resource-aws_instance)
+- [Resource: aws_lambda_alias](#resource-aws_lambda_alias)
+- [Resource: aws_launch_template](#resource-aws_launch_template)
+- [Resource: aws_lb_listener_rule](#resource-aws_lb_listener_rule)
+- [Resource: aws_msk_cluster](#resource-aws_msk_cluster)
+- [Resource: aws_rds_cluster](#resource-aws_rds_cluster)
+- [Resource: aws_route53_resolver_rule](#resource-aws_route53_resolver_rule)
+- [Resource: aws_route53_zone](#resource-aws_route53_zone)
+- [Resource: aws_s3_bucket](#resource-aws_s3_bucket)
+- [Resource: aws_s3_bucket_metric](#resource-aws_s3_bucket_metric)
+- [Resource: aws_security_group](#resource-aws_security_group)
+- [Resource: aws_sns_platform_application](#resource-aws_sns_platform_application)
+- [Resource: aws_spot_fleet_request](#resource-aws_spot_fleet_request)
+
+<!-- /TOC -->
+
+## Provider Version Configuration
+
+-> Before upgrading to version 3.0.0, it is recommended to upgrade to the most recent 2.X version of the provider and ensure that your environment successfully runs [`terraform plan`](https://www.terraform.io/docs/commands/plan.html) without unexpected changes or deprecation notices.
+
+We recommend using [version constraints when configuring Terraform providers](https://www.terraform.io/docs/configuration/providers.html#provider-versions). If you are following that recommendation, update the version constraints in your Terraform configuration and run [`terraform init`](https://www.terraform.io/docs/commands/init.html) to download the new version.
+
+For example, given this previous configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AwsProvider } from "./.gen/providers/aws/provider";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AwsProvider(this, "aws", {});
+  }
+}
+
+```
+
+Update to latest 3.X version:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AwsProvider } from "./.gen/providers/aws/provider";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AwsProvider(this, "aws", {});
+  }
+}
+
+```
+
+## Provider Authentication Updates
+
+### Authentication Ordering
+
+Previously, the provider preferred credentials in the following order:
+
+- Static credentials (those defined in the Terraform configuration)
+- Environment variables (e.g., `awsAccessKeyId` or `awsProfile`)
+- Shared credentials file (e.g., `~/Aws/credentials`)
+- EC2 Instance Metadata Service
+- Default AWS Go SDK handling (shared configuration, CodeBuild/ECS/EKS)
+
+The provider now prefers the following credential ordering:
+
+- Static credentials (those defined in the Terraform configuration)
+- Environment variables (e.g., `awsAccessKeyId` or `awsProfile`)
+- Shared credentials and/or configuration file (e.g., `~/Aws/credentials` and `~/Aws/config`)
+- Default AWS Go SDK handling (shared configuration, CodeBuild/ECS/EKS, EC2 Instance Metadata Service)
+
+This means workarounds of disabling the EC2 Instance Metadata Service handling to enable CodeBuild/ECS/EKS credentials or to enable other credential methods such as `credentialProcess` in the AWS shared configuration are no longer necessary.
+
+### Shared Configuration File Automatically Enabled
+
+The `awsSdkLoadConfig` environment variable is no longer necessary for the provider to automatically load the AWS shared configuration file (e.g., `~/Aws/config`).
+
+### Removal of AWS_METADATA_TIMEOUT Environment Variable Usage
+
+The provider now relies on the default AWS Go SDK timeouts for interacting with the EC2 Instance Metadata Service.
+
+## Provider Custom Service Endpoint Updates
+
+### Removal of kinesis_analytics and r53 Arguments
+
+The [custom service endpoints](custom-service-endpoints.html) for Kinesis Analytics and Route 53 now use the `kinesisanalytics` and `route53` argument names in the provider configuration.
+
+For example, given this previous configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AwsProvider } from "./.gen/providers/aws/provider";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AwsProvider(this, "aws", {
+      endpoints: [
+        {
+          kinesis_analytics: "https://example.com",
+          r53: "https://example.com",
+        },
+      ],
+    });
+  }
+}
+
+```
+
+An updated configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AwsProvider } from "./.gen/providers/aws/provider";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AwsProvider(this, "aws", {
+      endpoints: [
+        {
+          kinesisanalytics: "https://example.com",
+          route53: "https://example.com",
+        },
+      ],
+    });
+  }
+}
+
+```
+
+## Data Source: aws_availability_zones
+
+### blacklisted_names Attribute Removal
+
+Switch your Terraform configuration to the `excludeNames` attribute instead.
+
+For example, given this previous configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsAvailabilityZones } from "./.gen/providers/aws/data-aws-availability-zones";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsAvailabilityZones(this, "example", {
+      blacklisted_names: ["us-west-2d"],
+    });
+  }
+}
+
+```
+
+An updated configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsAvailabilityZones } from "./.gen/providers/aws/data-aws-availability-zones";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsAvailabilityZones(this, "example", {
+      excludeNames: ["us-west-2d"],
+    });
+  }
+}
+
+```
+
+### blacklisted_zone_ids Attribute Removal
+
+Switch your Terraform configuration to the `excludeZoneIds` attribute instead.
+
+For example, given this previous configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsAvailabilityZones } from "./.gen/providers/aws/data-aws-availability-zones";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsAvailabilityZones(this, "example", {
+      blacklisted_zone_ids: ["usw2-az4"],
+    });
+  }
+}
+
+```
+
+An updated configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsAvailabilityZones } from "./.gen/providers/aws/data-aws-availability-zones";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsAvailabilityZones(this, "example", {
+      excludeZoneIds: ["usw2-az4"],
+    });
+  }
+}
+
+```
+
+## Data Source: aws_lambda_invocation
+
+### result_map Attribute Removal
+
+Switch your Terraform configuration to the `result` attribute with the [`jsondecode()` function](https://www.terraform.io/docs/configuration/functions/jsondecode.html) instead.
+
+For example, given this previous configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformOutput, Fn, TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new TerraformOutput(this, "lambda_result", {
+      value: Fn.lookupNested(example.resultMap, ['"key1"']),
+    });
+  }
+}
+
+```
+
+An updated configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformOutput, Fn, Token, TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new TerraformOutput(this, "lambda_result", {
+      value: Fn.lookupNested(Fn.jsondecode(Token.asString(example.result)), [
+        '"key1"',
+      ]),
+    });
+  }
+}
+
+```
+
+## Data Source: aws_launch_template
+
+### Error raised if no matching launch template is found
+
+Previously, when a launch template matching the criteria was not found the data source would have been `null`.
+Now this could produce errors similar to the below:
+
+```
+data.aws_launch_template.current: Refreshing state...
+
+Error: error reading launch template: empty output
+```
+
+Configuration that depend on the previous behavior will need to be updated.
+
+## Data Source: aws_route53_resolver_rule
+
+### Removal of trailing period in domain_name argument
+
+Previously the data-source returned the Resolver Rule Domain Name directly from the API, which included a `.` suffix. This proves difficult when many other AWS services do not accept this trailing period (e.g., ACM Certificate). This period is now automatically removed. For example, when the attribute would previously return a Resolver Rule Domain Name such as `exampleCom`, the attribute now will be returned as `exampleCom`.
+While the returned value will omit the trailing period, use of configurations with trailing periods will not be interrupted.
+
+## Data Source: aws_route53_zone
+
+### Removal of trailing period in name argument
+
+Previously the data-source returned the Hosted Zone Domain Name directly from the API, which included a `.` suffix. This proves difficult when many other AWS services do not accept this trailing period (e.g., ACM Certificate). This period is now automatically removed. For example, when the attribute would previously return a Hosted Zone Domain Name such as `exampleCom`, the attribute now will be returned as `exampleCom`.
+While the returned value will omit the trailing period, use of configurations with trailing periods will not be interrupted.
+
+## Resource: aws_acm_certificate
+
+### domain_validation_options Changed from List to Set
+
+Previously, the `domainValidationOptions` attribute was a list type and completely unknown until after an initial `terraform apply`. This generally required complicated configuration workarounds to properly create DNS validation records since referencing this attribute directly could produce errors similar to the below:
+
+```
+Error: Invalid for_each argument
+
+  on main.tf line 16, in resource "aws_route53_record" "existing":
+  16:   for_each = aws_acm_certificate.existing.domain_validation_options
+
+The `for_each` value depends on resource attributes that cannot be determined
+until apply, so Terraform cannot predict how many instances will be created.
+To work around this, use the -target argument to first apply only the
+resources that the for_each depends on.
+```
+
+The `domainValidationOptions` attribute is now a set type and the resource will attempt to populate the information necessary during the planning phase to handle the above situation in most environments without workarounds. This change also prevents Terraform from showing unexpected differences if the API returns the results in varying order.
+
+Configuration references to this attribute will likely require updates since sets cannot be indexed (e.g., `domainValidationOptions[0]` or the older `domainValidationOptions0` syntax will return errors).
+If the `domainValidationOptions` list previously contained only a single element like the two examples just shown,
+it may be possible to wrap these references using the [`tolist()` function](https://www.terraform.io/docs/configuration/functions/tolist.html)
+<!-- markdownlint-disable-next-line no-reversed-links -->
+(e.g., `tolist(awsAcmCertificateExampleDomainValidationOptions)[0]`) as a quick configuration update.
+However given the complexity and workarounds required with the previous `domainValidationOptions` attribute implementation,
+different environments will require different configuration updates and migration steps.
+Below is a more advanced example.
+Further questions on potential update steps can be submitted to the [community forums](https://discuss.hashicorp.com/c/terraform-providers/tf-aws/33).
+
+For example, given this previous configuration using a `count` based resource approach that may have been used in certain environments:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Op, Token, TerraformCount, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AcmCertificate } from "./.gen/providers/aws/acm-certificate";
+import { AcmCertificateValidation } from "./.gen/providers/aws/acm-certificate-validation";
+import { DataAwsRoute53Zone } from "./.gen/providers/aws/data-aws-route53-zone";
+import { Route53Record } from "./.gen/providers/aws/route53-record";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const existing = new AcmCertificate(this, "existing", {
+      domainName: "existing.${" + publicRootDomain.value + "}",
+      subjectAlternativeNames: [
+        "existing1.${" + publicRootDomain.value + "}",
+        "existing2.${" + publicRootDomain.value + "}",
+        "existing3.${" + publicRootDomain.value + "}",
+      ],
+      validationMethod: "DNS",
+    });
+    const dataAwsRoute53ZonePublicRootDomain = new DataAwsRoute53Zone(
+      this,
+      "public_root_domain",
+      {
+        name: publicRootDomain.stringValue,
+      }
+    );
+    /*In most cases loops should be handled in the programming language context and 
+    not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+    you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+    you need to keep this like it is.*/
+    const existingCount = TerraformCount.of(
+      Token.asNumber(Op.add(Fn.lengthOf(existing.subjectAlternativeNames), 1))
+    );
+    const awsRoute53RecordExisting = new Route53Record(this, "existing_2", {
+      allowOverwrite: true,
+      name: Token.asString(
+        Fn.lookupNested(
+          Fn.lookupNested(existing.domainValidationOptions, [
+            existingCount.index,
+          ]),
+          ["resource_record_name"]
+        )
+      ),
+      records: [
+        Token.asString(
+          Fn.lookupNested(
+            Fn.lookupNested(existing.domainValidationOptions, [
+              existingCount.index,
+            ]),
+            ["resource_record_value"]
+          )
+        ),
+      ],
+      ttl: 60,
+      type: Token.asString(
+        Fn.lookupNested(
+          Fn.lookupNested(existing.domainValidationOptions, [
+            existingCount.index,
+          ]),
+          ["resource_record_type"]
+        )
+      ),
+      zoneId: Token.asString(dataAwsRoute53ZonePublicRootDomain.zoneId),
+      count: existingCount,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsRoute53RecordExisting.overrideLogicalId("existing");
+    const awsAcmCertificateValidationExisting = new AcmCertificateValidation(
+      this,
+      "existing_3",
+      {
+        certificateArn: existing.arn,
+        validationRecordFqdns: Token.asList(
+          Fn.lookupNested(awsRoute53RecordExisting, ["*", "fqdn"])
+        ),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsAcmCertificateValidationExisting.overrideLogicalId("existing");
+  }
+}
+
+```
+
+It will receive errors like the below after upgrading:
+
+```
+Error: Invalid index
+
+  on main.tf line 14, in resource "aws_route53_record" "existing":
+  14:   name    = aws_acm_certificate.existing.domain_validation_options[count.index].resource_record_name
+    |----------------
+    | aws_acm_certificate.existing.domain_validation_options is set of object with 4 elements
+    | count.index is 1
+
+This value does not have any indices.
+```
+
+Since the `domainValidationOptions` attribute changed from a list to a set and sets cannot be indexed in Terraform, the recommendation is to update the configuration to use the more stable [resource `forEach` support](https://www.terraform.io/docs/configuration/meta-arguments/for_each.html) instead of [`count`](https://www.terraform.io/docs/configuration/meta-arguments/count.html). Note the slight change in the `validationRecordFqdns` syntax as well.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformIterator, Fn, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AcmCertificateValidation } from "./.gen/providers/aws/acm-certificate-validation";
+import { Route53Record } from "./.gen/providers/aws/route53-record";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    /*In most cases loops should be handled in the programming language context and 
+    not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+    you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+    you need to keep this like it is.*/
+    const existingForEachIterator = TerraformIterator.fromList(
+      Token.asAny(
+        "${{ for dvo in ${" +
+          awsAcmCertificateExisting.domainValidationOptions +
+          "} : dvo.domain_name => {\n      name   = dvo.resource_record_name\n      record = dvo.resource_record_value\n      type   = dvo.resource_record_type\n    }}}"
+      )
+    );
+    const existing = new Route53Record(this, "existing", {
+      allowOverwrite: true,
+      name: Token.asString(
+        Fn.lookupNested(existingForEachIterator.value, ["name"])
+      ),
+      records: [
+        Token.asString(
+          Fn.lookupNested(existingForEachIterator.value, ["record"])
+        ),
+      ],
+      ttl: 60,
+      type: Token.asString(
+        Fn.lookupNested(existingForEachIterator.value, ["type"])
+      ),
+      zoneId: Token.asString(publicRootDomain.zoneId),
+      forEach: existingForEachIterator,
+    });
+    const awsAcmCertificateValidationExisting = new AcmCertificateValidation(
+      this,
+      "existing_1",
+      {
+        certificateArn: Token.asString(awsAcmCertificateExisting.arn),
+        validationRecordFqdns: Token.asList(
+          "${[ for record in ${" + existing.fqn + "} : record.fqdn]}"
+        ),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsAcmCertificateValidationExisting.overrideLogicalId("existing");
+  }
+}
+
+```
+
+After the configuration has been updated, a plan should no longer error and may look like the following:
+
+```
+------------------------------------------------------------------------
+
+An execution plan has been generated and is shown below.
+Resource actions are indicated with the following symbols:
+  + create
+  - destroy
+-/+ destroy and then create replacement
+
+Terraform will perform the following actions:
+
+  # aws_acm_certificate_validation.existing must be replaced
+-/+ resource "aws_acm_certificate_validation" "existing" {
+        certificate_arn         = "arn:aws:acm:us-east-2:123456789012:certificate/ccbc58e8-061d-4443-9035-d3af0512e863"
+      ~ id                      = "2020-07-16 00:01:19 +0000 UTC" -> (known after apply)
+      ~ validation_record_fqdns = [
+          - "_40b71647a8d88eb82d53fe988e8a3cc1.existing2.example.com",
+          - "_812ddf11b781af1eec1643ec58f102d2.existing.example.com",
+          - "_8dc56b6e35f699b8754afcdd79e9748d.existing3.example.com",
+          - "_d7112da809a40e848207c04399babcec.existing1.example.com",
+        ] -> (known after apply) # forces replacement
+    }
+
+  # aws_route53_record.existing will be destroyed
+  - resource "aws_route53_record" "existing" {
+      - fqdn    = "_812ddf11b781af1eec1643ec58f102d2.existing.example.com" -> null
+      - id      = "Z123456789012__812ddf11b781af1eec1643ec58f102d2.existing.example.com._CNAME" -> null
+      - name    = "_812ddf11b781af1eec1643ec58f102d2.existing.example.com" -> null
+      - records = [
+          - "_bdeba72164eec216c55a32374bcceafd.jfrzftwwjs.acm-validations.aws.",
+        ] -> null
+      - ttl     = 60 -> null
+      - type    = "CNAME" -> null
+      - zone_id = "Z123456789012" -> null
+    }
+
+  # aws_route53_record.existing[1] will be destroyed
+  - resource "aws_route53_record" "existing" {
+      - fqdn    = "_40b71647a8d88eb82d53fe988e8a3cc1.existing2.example.com" -> null
+      - id      = "Z123456789012__40b71647a8d88eb82d53fe988e8a3cc1.existing2.example.com._CNAME" -> null
+      - name    = "_40b71647a8d88eb82d53fe988e8a3cc1.existing2.example.com" -> null
+      - records = [
+          - "_638532db1fa6a1b71aaf063c8ea29d52.jfrzftwwjs.acm-validations.aws.",
+        ] -> null
+      - ttl     = 60 -> null
+      - type    = "CNAME" -> null
+      - zone_id = "Z123456789012" -> null
+    }
+
+  # aws_route53_record.existing[2] will be destroyed
+  - resource "aws_route53_record" "existing" {
+      - fqdn    = "_d7112da809a40e848207c04399babcec.existing1.example.com" -> null
+      - id      = "Z123456789012__d7112da809a40e848207c04399babcec.existing1.example.com._CNAME" -> null
+      - name    = "_d7112da809a40e848207c04399babcec.existing1.example.com" -> null
+      - records = [
+          - "_6e1da5574ab46a6c782ed73438274181.jfrzftwwjs.acm-validations.aws.",
+        ] -> null
+      - ttl     = 60 -> null
+      - type    = "CNAME" -> null
+      - zone_id = "Z123456789012" -> null
+    }
+
+  # aws_route53_record.existing[3] will be destroyed
+  - resource "aws_route53_record" "existing" {
+      - fqdn    = "_8dc56b6e35f699b8754afcdd79e9748d.existing3.example.com" -> null
+      - id      = "Z123456789012__8dc56b6e35f699b8754afcdd79e9748d.existing3.example.com._CNAME" -> null
+      - name    = "_8dc56b6e35f699b8754afcdd79e9748d.existing3.example.com" -> null
+      - records = [
+          - "_a419f8410d2e0720528a96c3506f3841.jfrzftwwjs.acm-validations.aws.",
+        ] -> null
+      - ttl     = 60 -> null
+      - type    = "CNAME" -> null
+      - zone_id = "Z123456789012" -> null
+    }
+
+  # aws_route53_record.existing["existing.example.com"] will be created
+  + resource "aws_route53_record" "existing" {
+      + allow_overwrite = true
+      + fqdn            = (known after apply)
+      + id              = (known after apply)
+      + name            = "_812ddf11b781af1eec1643ec58f102d2.existing.example.com"
+      + records         = [
+          + "_bdeba72164eec216c55a32374bcceafd.jfrzftwwjs.acm-validations.aws.",
+        ]
+      + ttl             = 60
+      + type            = "CNAME"
+      + zone_id         = "Z123456789012"
+    }
+
+  # aws_route53_record.existing["existing1.example.com"] will be created
+  + resource "aws_route53_record" "existing" {
+      + allow_overwrite = true
+      + fqdn            = (known after apply)
+      + id              = (known after apply)
+      + name            = "_d7112da809a40e848207c04399babcec.existing1.example.com"
+      + records         = [
+          + "_6e1da5574ab46a6c782ed73438274181.jfrzftwwjs.acm-validations.aws.",
+        ]
+      + ttl             = 60
+      + type            = "CNAME"
+      + zone_id         = "Z123456789012"
+    }
+
+  # aws_route53_record.existing["existing2.example.com"] will be created
+  + resource "aws_route53_record" "existing" {
+      + allow_overwrite = true
+      + fqdn            = (known after apply)
+      + id              = (known after apply)
+      + name            = "_40b71647a8d88eb82d53fe988e8a3cc1.existing2.example.com"
+      + records         = [
+          + "_638532db1fa6a1b71aaf063c8ea29d52.jfrzftwwjs.acm-validations.aws.",
+        ]
+      + ttl             = 60
+      + type            = "CNAME"
+      + zone_id         = "Z123456789012"
+    }
+
+  # aws_route53_record.existing["existing3.example.com"] will be created
+  + resource "aws_route53_record" "existing" {
+      + allow_overwrite = true
+      + fqdn            = (known after apply)
+      + id              = (known after apply)
+      + name            = "_8dc56b6e35f699b8754afcdd79e9748d.existing3.example.com"
+      + records         = [
+          + "_a419f8410d2e0720528a96c3506f3841.jfrzftwwjs.acm-validations.aws.",
+        ]
+      + ttl             = 60
+      + type            = "CNAME"
+      + zone_id         = "Z123456789012"
+    }
+
+Plan: 5 to add, 0 to change, 5 to destroy.
+```
+
+Due to the type of configuration change, Terraform does not know that the previous `awsRoute53Record` resources (indexed by number in the existing state) and the new resources (indexed by domain names in the updated configuration) are equivalent. Typically in this situation, the [`terraform state mv` command](https://www.terraform.io/docs/commands/state/mv.html) can be used to reduce the plan to show no changes. This is done by associating the count index (e.g., `[1]`) with the equivalent domain name index (e.g., `["existing2ExampleCom"]`), making one of the four commands to fix the above example: `terraform state mv 'aws_route53_record.existing[1]' 'aws_route53_record.existing["existing2.example.com"]'`. We recommend using this `terraform state mv` update process where possible to reduce chances of unexpected behaviors or changes in an environment.
+
+If using `terraform state mv` to reduce the plan to show no changes, no additional steps are required.
+
+In larger or more complex environments though, this process can be tedius to match the old resource address to the new resource address and run all the necessary `terraform state mv` commands. Instead, since the `awsRoute53Record` resource implements the `allow_overwrite = true` argument, it is possible to just remove the old `awsRoute53Record` resources from the Terraform state using the [`terraform state rm` command](https://www.terraform.io/docs/commands/state/rm.html). In this case, Terraform will leave the existing records in Route 53 and plan to just overwrite the existing validation records with the same exact (previous) values.
+
+-> This guide is showing the simpler `terraform state rm` option below as a potential shortcut in this specific situation, however in most other cases `terraform state mv` is required to change from `count` based resources to `forEach` based resources and properly match the existing Terraform state to the updated Terraform configuration.
+
+```console
+$ terraform state rm aws_route53_record.existing
+Removed aws_route53_record.existing[0]
+Removed aws_route53_record.existing[1]
+Removed aws_route53_record.existing[2]
+Removed aws_route53_record.existing[3]
+Successfully removed 4 resource instance(s).
+```
+
+Now the Terraform plan will show only the additions of new Route 53 records (which are exactly the same as before the upgrade) and the proposed recreation of the `awsAcmCertificateValidation` resource. The `awsAcmCertificateValidation` resource recreation will have no effect as the certificate is already validated and issued.
+
+```
+An execution plan has been generated and is shown below.
+Resource actions are indicated with the following symbols:
+  + create
+-/+ destroy and then create replacement
+
+Terraform will perform the following actions:
+
+  # aws_acm_certificate_validation.existing must be replaced
+-/+ resource "aws_acm_certificate_validation" "existing" {
+        certificate_arn         = "arn:aws:acm:us-east-2:123456789012:certificate/ccbc58e8-061d-4443-9035-d3af0512e863"
+      ~ id                      = "2020-07-16 00:01:19 +0000 UTC" -> (known after apply)
+      ~ validation_record_fqdns = [
+          - "_40b71647a8d88eb82d53fe988e8a3cc1.existing2.example.com",
+          - "_812ddf11b781af1eec1643ec58f102d2.existing.example.com",
+          - "_8dc56b6e35f699b8754afcdd79e9748d.existing3.example.com",
+          - "_d7112da809a40e848207c04399babcec.existing1.example.com",
+        ] -> (known after apply) # forces replacement
+    }
+
+  # aws_route53_record.existing["existing.example.com"] will be created
+  + resource "aws_route53_record" "existing" {
+      + allow_overwrite = true
+      + fqdn            = (known after apply)
+      + id              = (known after apply)
+      + name            = "_812ddf11b781af1eec1643ec58f102d2.existing.example.com"
+      + records         = [
+          + "_bdeba72164eec216c55a32374bcceafd.jfrzftwwjs.acm-validations.aws.",
+        ]
+      + ttl             = 60
+      + type            = "CNAME"
+      + zone_id         = "Z123456789012"
+    }
+
+  # aws_route53_record.existing["existing1.example.com"] will be created
+  + resource "aws_route53_record" "existing" {
+      + allow_overwrite = true
+      + fqdn            = (known after apply)
+      + id              = (known after apply)
+      + name            = "_d7112da809a40e848207c04399babcec.existing1.example.com"
+      + records         = [
+          + "_6e1da5574ab46a6c782ed73438274181.jfrzftwwjs.acm-validations.aws.",
+        ]
+      + ttl             = 60
+      + type            = "CNAME"
+      + zone_id         = "Z123456789012"
+    }
+
+  # aws_route53_record.existing["existing2.example.com"] will be created
+  + resource "aws_route53_record" "existing" {
+      + allow_overwrite = true
+      + fqdn            = (known after apply)
+      + id              = (known after apply)
+      + name            = "_40b71647a8d88eb82d53fe988e8a3cc1.existing2.example.com"
+      + records         = [
+          + "_638532db1fa6a1b71aaf063c8ea29d52.jfrzftwwjs.acm-validations.aws.",
+        ]
+      + ttl             = 60
+      + type            = "CNAME"
+      + zone_id         = "Z123456789012"
+    }
+
+  # aws_route53_record.existing["existing3.example.com"] will be created
+  + resource "aws_route53_record" "existing" {
+      + allow_overwrite = true
+      + fqdn            = (known after apply)
+      + id              = (known after apply)
+      + name            = "_8dc56b6e35f699b8754afcdd79e9748d.existing3.example.com"
+      + records         = [
+          + "_a419f8410d2e0720528a96c3506f3841.jfrzftwwjs.acm-validations.aws.",
+        ]
+      + ttl             = 60
+      + type            = "CNAME"
+      + zone_id         = "Z123456789012"
+    }
+
+Plan: 5 to add, 0 to change, 1 to destroy.
+```
+
+Once applied, no differences should be shown and no additional steps should be necessary.
+
+Alternatively, if you are referencing a subset of `domainValidationOptions`, there is another method of upgrading from v2 to v3 without having to move state. Given the scenario below...
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AcmCertificate } from "./.gen/providers/aws/acm-certificate";
+import { AcmCertificateValidation } from "./.gen/providers/aws/acm-certificate-validation";
+import { DataAwsRoute53Zone } from "./.gen/providers/aws/data-aws-route53-zone";
+import { Route53Record } from "./.gen/providers/aws/route53-record";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const existing = new AcmCertificate(this, "existing", {
+      domainName: "existing.${" + publicRootDomain.value + "}",
+      subjectAlternativeNames: [
+        "existing1.${" + publicRootDomain.value + "}",
+        "existing2.${" + publicRootDomain.value + "}",
+        "existing3.${" + publicRootDomain.value + "}",
+      ],
+      validationMethod: "DNS",
+    });
+    const dataAwsRoute53ZonePublicRootDomain = new DataAwsRoute53Zone(
+      this,
+      "public_root_domain",
+      {
+        name: publicRootDomain.stringValue,
+      }
+    );
+    const existing1 = new Route53Record(this, "existing_1", {
+      allowOverwrite: true,
+      name: Token.asString(
+        Fn.lookupNested(existing.domainValidationOptions, [
+          "0",
+          "resource_record_name",
+        ])
+      ),
+      records: [
+        Token.asString(
+          Fn.lookupNested(existing.domainValidationOptions, [
+            "0",
+            "resource_record_value",
+          ])
+        ),
+      ],
+      ttl: 60,
+      type: Token.asString(
+        Fn.lookupNested(existing.domainValidationOptions, [
+          "0",
+          "resource_record_type",
+        ])
+      ),
+      zoneId: Token.asString(dataAwsRoute53ZonePublicRootDomain.zoneId),
+    });
+    const existing3 = new Route53Record(this, "existing_3", {
+      allowOverwrite: true,
+      name: Token.asString(
+        Fn.lookupNested(existing.domainValidationOptions, [
+          "2",
+          "resource_record_name",
+        ])
+      ),
+      records: [
+        Token.asString(
+          Fn.lookupNested(existing.domainValidationOptions, [
+            "2",
+            "resource_record_value",
+          ])
+        ),
+      ],
+      ttl: 60,
+      type: Token.asString(
+        Fn.lookupNested(existing.domainValidationOptions, [
+          "2",
+          "resource_record_type",
+        ])
+      ),
+      zoneId: Token.asString(dataAwsRoute53ZonePublicRootDomain.zoneId),
+    });
+    const awsAcmCertificateValidationExisting1 = new AcmCertificateValidation(
+      this,
+      "existing_1_4",
+      {
+        certificateArn: existing.arn,
+        validationRecordFqdns: Token.asList(existing1.fqdn),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsAcmCertificateValidationExisting1.overrideLogicalId("existing_1");
+    const awsAcmCertificateValidationExisting3 = new AcmCertificateValidation(
+      this,
+      "existing_3_5",
+      {
+        certificateArn: existing.arn,
+        validationRecordFqdns: Token.asList(existing3.fqdn),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsAcmCertificateValidationExisting3.overrideLogicalId("existing_3");
+  }
+}
+
+```
+
+You can perform a conversion of the new `domainValidationOptions` object into a map, to allow you to perform a lookup by the domain name in place of an index number.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AcmCertificateValidation } from "./.gen/providers/aws/acm-certificate-validation";
+import { Route53Record } from "./.gen/providers/aws/route53-record";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const existingDomainValidationOptions =
+      "${{ for dvo in ${" +
+      cloudfrontCert.domainValidationOptions +
+      "} : dvo.domain_name => {\n      name   = dvo.resource_record_name\n      record = dvo.resource_record_value\n      type   = dvo.resource_record_type\n    }}}";
+    const existing1 = new Route53Record(this, "existing_1", {
+      allowOverwrite: true,
+      name: Token.asString(
+        Fn.lookupNested(
+          Fn.lookupNested(existingDomainValidationOptions, [
+            "existing1.${" + publicRootDomain.value + "}",
+          ]),
+          ["name"]
+        )
+      ),
+      records: [
+        Token.asString(
+          Fn.lookupNested(
+            Fn.lookupNested(existingDomainValidationOptions, [
+              "existing1.${" + publicRootDomain.value + "}",
+            ]),
+            ["record"]
+          )
+        ),
+      ],
+      ttl: 60,
+      type: Token.asString(
+        Fn.lookupNested(
+          Fn.lookupNested(existingDomainValidationOptions, [
+            "existing1.${" + publicRootDomain.value + "}",
+          ]),
+          ["type"]
+        )
+      ),
+      zoneId: Token.asString(dataAwsRoute53ZonePublicRootDomain.zoneId),
+    });
+    const existing3 = new Route53Record(this, "existing_3", {
+      allowOverwrite: true,
+      name: Token.asString(
+        Fn.lookupNested(
+          Fn.lookupNested(existingDomainValidationOptions, [
+            "existing3.${" + publicRootDomain.value + "}",
+          ]),
+          ["name"]
+        )
+      ),
+      records: [
+        Token.asString(
+          Fn.lookupNested(
+            Fn.lookupNested(existingDomainValidationOptions, [
+              "existing3.${" + publicRootDomain.value + "}",
+            ]),
+            ["record"]
+          )
+        ),
+      ],
+      ttl: 60,
+      type: Token.asString(
+        Fn.lookupNested(
+          Fn.lookupNested(existingDomainValidationOptions, [
+            "existing3.${" + publicRootDomain.value + "}",
+          ]),
+          ["type"]
+        )
+      ),
+      zoneId: Token.asString(dataAwsRoute53ZonePublicRootDomain.zoneId),
+    });
+    const awsAcmCertificateValidationExisting1 = new AcmCertificateValidation(
+      this,
+      "existing_1_2",
+      {
+        certificateArn: existing.arn,
+        validationRecordFqdns: Token.asList(existing1.fqdn),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsAcmCertificateValidationExisting1.overrideLogicalId("existing_1");
+    const awsAcmCertificateValidationExisting3 = new AcmCertificateValidation(
+      this,
+      "existing_3_3",
+      {
+        certificateArn: existing.arn,
+        validationRecordFqdns: Token.asList(existing3.fqdn),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsAcmCertificateValidationExisting3.overrideLogicalId("existing_3");
+  }
+}
+
+```
+
+Performing a plan against these resources will not cause any change in state, since underlying resources have not changed.
+
+### subject_alternative_names Changed from List to Set
+
+Previously the `subjectAlternativeNames` argument was stored in the Terraform state as an ordered list while the API returned information in an unordered manner. The attribute is now configured as a set instead of a list. Certain Terraform configuration language features distinguish between these two attribute types such as not being able to index a set (e.g., `awsAcmCertificateExampleSubjectAlternativeNames[0]` is no longer a valid reference). Depending on the implementation details of a particular configuration using `subjectAlternativeNames` as a reference, possible solutions include changing references to using `for`/`forEach` or using the `tolist()` function as a temporary workaround to keep the previous behavior until an appropriate configuration (properly using the unordered set) can be determined. Usage questions can be submitted to the [community forums](https://discuss.hashicorp.com/c/terraform-providers/tf-aws/33).
+
+### certificate_body, certificate_chain, and private_key Arguments No Longer Stored as Hash
+
+Previously when the `certificateBody`, `certificateChain`, and `privateKey` arguments were stored in state, they were stored as a hash of the actual value. This prevented Terraform from properly updating the resource when necessary and the hashing has been removed. The Terraform AWS Provider will show an update to these arguments on the first apply after upgrading to version 3.0.0, which is fixing the Terraform state to remove the hash. Since the `privateKey` attribute is marked as sensitive, the values in the update will not be visible in the Terraform output. If the non-hashed values have not changed, then no update is occurring other than the Terraform state update. If these arguments are the only updates and they all match the hash removal, the apply will occur without submitting API calls.
+
+## Resource: aws_api_gateway_method_settings
+
+### throttling_burst_limit and throttling_rate_limit Arguments Now Default to -1
+
+Previously when the `throttlingBurstLimit` or `throttlingRateLimit` argument was not configured, the resource would enable throttling and set the limit value to the AWS API Gateway default. In addition, as these arguments were marked as `computed`, Terraform ignored any subsequent changes made to these arguments in the resource. These behaviors have been removed and, by default, the `throttlingBurstLimit` and `throttlingRateLimit` arguments will be disabled in the resource with a value of `1`.
+
+## Resource: aws_autoscaling_group
+
+### availability_zones and vpc_zone_identifier Arguments Now Report Plan-Time Conflict
+
+Specifying both the `availabilityZones` and `vpcZoneIdentifier` arguments previously led to confusing behavior and errors. Now this issue is reported at plan-time. Use the `null` value instead of `[]` (empty list) in conditionals to ensure this validation does not unexpectedly trigger.
+
+### Drift detection enabled for `loadBalancers` and `targetGroupArns` arguments
+
+If you previously set one of these arguments to an empty list to enable drift detection (e.g., when migrating an ASG from ELB to ALB), this can be updated as follows.
+
+For example, given this previous configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AutoscalingGroup } from "./.gen/providers/aws/autoscaling-group";
+interface MyConfig {
+  maxSize: any;
+  minSize: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new AutoscalingGroup(this, "example", {
+      loadBalancers: [],
+      targetGroupArns: [Token.asString(awsLbTargetGroupExample.arn)],
+      maxSize: config.maxSize,
+      minSize: config.minSize,
+    });
+  }
+}
+
+```
+
+An updated configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AutoscalingGroup } from "./.gen/providers/aws/autoscaling-group";
+interface MyConfig {
+  maxSize: any;
+  minSize: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new AutoscalingGroup(this, "example", {
+      targetGroupArns: [Token.asString(awsLbTargetGroupExample.arn)],
+      maxSize: config.maxSize,
+      minSize: config.minSize,
+    });
+  }
+}
+
+```
+
+If `awsAutoscalingAttachment` resources reference your ASG configurations, you will need to add the [`lifecycle` configuration block](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html) with an `ignoreChanges` argument to prevent Terraform non-empty plans (i.e., forcing resource update) during the next state refresh.
+
+For example, given this previous configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AutoscalingAttachment } from "./.gen/providers/aws/autoscaling-attachment";
+import { AutoscalingGroup } from "./.gen/providers/aws/autoscaling-group";
+interface MyConfig {
+  maxSize: any;
+  minSize: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    const example = new AutoscalingGroup(this, "example", {
+      maxSize: config.maxSize,
+      minSize: config.minSize,
+    });
+    const awsAutoscalingAttachmentExample = new AutoscalingAttachment(
+      this,
+      "example_1",
+      {
+        autoscalingGroupName: example.id,
+        elb: Token.asString(awsElbExample.id),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsAutoscalingAttachmentExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+An updated configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AutoscalingAttachment } from "./.gen/providers/aws/autoscaling-attachment";
+import { AutoscalingGroup } from "./.gen/providers/aws/autoscaling-group";
+interface MyConfig {
+  maxSize: any;
+  minSize: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    const example = new AutoscalingGroup(this, "example", {
+      lifecycle: {
+        ignoreChanges: [loadBalancers, targetGroupArns],
+      },
+      maxSize: config.maxSize,
+      minSize: config.minSize,
+    });
+    const awsAutoscalingAttachmentExample = new AutoscalingAttachment(
+      this,
+      "example_1",
+      {
+        autoscalingGroupName: example.id,
+        elb: Token.asString(awsElbExample.id),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsAutoscalingAttachmentExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Resource: aws_cloudfront_distribution
+
+### active_trusted_signers Attribute Name and Type Change
+
+Previously, the `activeTrustedSigners` computed attribute was implemented with a Map that did not support accessing its computed `items` attribute in Terraform 0.12 correctly.
+To address this, the `activeTrustedSigners` attribute has been renamed to `trustedSigners` and is now implemented as a List with a computed `items` List attribute and computed `enabled` boolean attribute.
+The nested `items` attribute includes computed `awsAccountNumber` and `keyPairIds` sub-fields, with the latter implemented as a List.
+Thus, user configurations referencing the `activeTrustedSigners` attribute and its sub-fields will need to be changed as follows.
+
+Given these previous references:
+
+```
+aws_cloudfront_distribution.example.active_trusted_signers.enabled
+aws_cloudfront_distribution.example.active_trusted_signers.items
+```
+
+Updated references:
+
+```
+aws_cloudfront_distribution.example.trusted_signers[0].enabled
+aws_cloudfront_distribution.example.trusted_signers[0].items
+```
+
+## Resource: aws_cloudwatch_log_group
+
+### Removal of arn Wildcard Suffix
+
+Previously, the resource returned the ARN directly from the API, which included a `:*` suffix to denote all CloudWatch Log Streams under the CloudWatch Log Group. Most other AWS resources that return ARNs and many other AWS services do not use the `:*` suffix. The suffix is now automatically removed. For example, the resource previously returned an ARN such as `arn:aws:logs:usEast1:123456789012:logGroup:/example:*` but will now return `arn:aws:logs:usEast1:123456789012:logGroup:/example`.
+
+Workarounds, such as using `replace()` as shown below, should be removed:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudwatchLogGroup } from "./.gen/providers/aws/cloudwatch-log-group";
+import { DatasyncTask } from "./.gen/providers/aws/datasync-task";
+interface MyConfig {
+  destinationLocationArn: any;
+  sourceLocationArn: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    const example = new CloudwatchLogGroup(this, "example", {
+      name: "example",
+    });
+    const awsDatasyncTaskExample = new DatasyncTask(this, "example_1", {
+      cloudwatchLogGroupArn: Token.asString(Fn.replace(example.arn, ":*", "")),
+      destinationLocationArn: config.destinationLocationArn,
+      sourceLocationArn: config.sourceLocationArn,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsDatasyncTaskExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+Removing the `:*` suffix is a breaking change for some configurations. Fix these configurations using string interpolations as demonstrated below. For example, this configuration is now broken:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsIamPolicyDocument(this, "ad-log-policy", {
+      statement: [
+        {
+          actions: ["logs:CreateLogStream", "logs:PutLogEvents"],
+          effect: "Allow",
+          principals: [
+            {
+              identifiers: ["ds.amazonaws.com"],
+              type: "Service",
+            },
+          ],
+          resources: [example.arn],
+        },
+      ],
+    });
+  }
+}
+
+```
+
+An updated configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsIamPolicyDocument(this, "ad-log-policy", {
+      statement: [
+        {
+          actions: ["logs:CreateLogStream", "logs:PutLogEvents"],
+          effect: "Allow",
+          principals: [
+            {
+              identifiers: ["ds.amazonaws.com"],
+              type: "Service",
+            },
+          ],
+          resources: ["${" + example.arn + "}:*"],
+        },
+      ],
+    });
+  }
+}
+
+```
+
+## Resource: aws_codepipeline
+
+### GITHUB_TOKEN environment variable removal
+
+Switch your Terraform configuration to the `oAuthToken` element in the `action` `configuration` map instead.
+
+For example, given this previous configuration:
+
+```console
+$ GITHUB_TOKEN=<token> terraform apply
+```
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Codepipeline } from "./.gen/providers/aws/codepipeline";
+interface MyConfig {
+  artifactStore: any;
+  name: any;
+  roleArn: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new Codepipeline(this, "example", {
+      stage: [
+        {
+          action: [
+            {
+              category: "Source",
+              configuration: {
+                Branch: "main",
+                Owner: "lifesum-terraform",
+                Repo: "example",
+              },
+              name: "Source",
+              outputArtifacts: ["example"],
+              owner: "ThirdParty",
+              provider: "GitHub",
+              version: "1",
+            },
+          ],
+          name: "Source",
+        },
+      ],
+      artifactStore: config.artifactStore,
+      name: config.name,
+      roleArn: config.roleArn,
+    });
+  }
+}
+
+```
+
+The configuration could be updated as follows:
+
+```console
+$ TF_VAR_github_token=<token> terraform apply
+```
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformVariable, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Codepipeline } from "./.gen/providers/aws/codepipeline";
+interface MyConfig {
+  artifactStore: any;
+  name: any;
+  roleArn: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    /*Terraform Variables are not always the best fit for getting inputs in the context of Terraform CDK.
+    You can read more about this at https://cdk.tf/variables*/
+    const githubToken = new TerraformVariable(this, "github_token", {});
+    new Codepipeline(this, "example", {
+      stage: [
+        {
+          action: [
+            {
+              category: "Source",
+              configuration: {
+                Branch: "main",
+                OAuthToken: githubToken.stringValue,
+                Owner: "lifesum-terraform",
+                Repo: "example",
+              },
+              name: "Source",
+              outputArtifacts: ["example"],
+              owner: "ThirdParty",
+              provider: "GitHub",
+              version: "1",
+            },
+          ],
+          name: "Source",
+        },
+      ],
+      artifactStore: config.artifactStore,
+      name: config.name,
+      roleArn: config.roleArn,
+    });
+  }
+}
+
+```
+
+## Resource: aws_cognito_user_pool
+
+### Removal of admin_create_user_config.unused_account_validity_days Argument
+
+The Cognito API previously deprecated the `adminCreateUserConfig` configuration block `unusedAccountValidityDays` argument in preference of the `passwordPolicy` configuration block `temporaryPasswordValidityDays` argument. Configurations will need to be updated to use the API supported configuration.
+
+For example, given this previous configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CognitoUserPool } from "./.gen/providers/aws/cognito-user-pool";
+interface MyConfig {
+  name: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new CognitoUserPool(this, "example", {
+      adminCreateUserConfig: {
+        unused_account_validity_days: 7,
+      },
+      name: config.name,
+    });
+  }
+}
+
+```
+
+An updated configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CognitoUserPool } from "./.gen/providers/aws/cognito-user-pool";
+interface MyConfig {
+  name: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new CognitoUserPool(this, "example", {
+      passwordPolicy: {
+        temporaryPasswordValidityDays: 7,
+      },
+      name: config.name,
+    });
+  }
+}
+
+```
+
+## Resource: aws_dx_gateway
+
+### Removal of Automatic aws_dx_gateway_association Import
+
+Previously when importing the `awsDxGateway` resource with the [`terraform import` command](https://www.terraform.io/docs/commands/import.html), the Terraform AWS Provider would automatically attempt to import an associated `awsDxGatewayAssociation` resource(s) as well. This automatic resource import has been removed. Use the [`awsDxGatewayAssociation` resource import](/docs/providers/aws/r/dx_gateway_association.html#import) to import those resources separately.
+
+## Resource: aws_dx_gateway_association
+
+### vpn_gateway_id Argument Removal
+
+Switch your Terraform configuration to the `associatedGatewayId` argument instead.
+
+For example, given this previous configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DxGatewayAssociation } from "./.gen/providers/aws/dx-gateway-association";
+interface MyConfig {
+  dxGatewayId: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new DxGatewayAssociation(this, "example", {
+      vpnGatewayId: Token.asString(awsVpnGatewayExample.id),
+      dxGatewayId: config.dxGatewayId,
+    });
+  }
+}
+
+```
+
+An updated configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DxGatewayAssociation } from "./.gen/providers/aws/dx-gateway-association";
+interface MyConfig {
+  dxGatewayId: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new DxGatewayAssociation(this, "example", {
+      associatedGatewayId: Token.asString(awsVpnGatewayExample.id),
+      dxGatewayId: config.dxGatewayId,
+    });
+  }
+}
+
+```
+
+## Resource: aws_dx_gateway_association_proposal
+
+### vpn_gateway_id Argument Removal
+
+Switch your Terraform configuration to the `associatedGatewayId` argument instead.
+
+For example, given this previous configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DxGatewayAssociationProposal } from "./.gen/providers/aws/dx-gateway-association-proposal";
+interface MyConfig {
+  associatedGatewayId: any;
+  dxGatewayId: any;
+  dxGatewayOwnerAccountId: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new DxGatewayAssociationProposal(this, "example", {
+      vpn_gateway_id: awsVpnGatewayExample.id,
+      associatedGatewayId: config.associatedGatewayId,
+      dxGatewayId: config.dxGatewayId,
+      dxGatewayOwnerAccountId: config.dxGatewayOwnerAccountId,
+    });
+  }
+}
+
+```
+
+An updated configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DxGatewayAssociationProposal } from "./.gen/providers/aws/dx-gateway-association-proposal";
+interface MyConfig {
+  dxGatewayId: any;
+  dxGatewayOwnerAccountId: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new DxGatewayAssociationProposal(this, "example", {
+      associatedGatewayId: Token.asString(awsVpnGatewayExample.id),
+      dxGatewayId: config.dxGatewayId,
+      dxGatewayOwnerAccountId: config.dxGatewayOwnerAccountId,
+    });
+  }
+}
+
+```
+
+## Resource: aws_ebs_volume
+
+### iops Argument Apply-Time Validation
+
+Previously when the `iops` argument was configured with a `type` other than `io1` (either explicitly or omitted, indicating the default type `gp2`), the Terraform AWS Provider would automatically disregard the value provided to `iops` as it is only configurable for the `io1` volume type per the AWS EC2 API. This behavior has changed such that the Terraform AWS Provider will instead return an error at apply time indicating an `iops` value is invalid for types other than `io1`.
+Exceptions to this are in cases where `iops` is set to `null` or `0` such that the Terraform AWS Provider will continue to accept the value regardless of `type`.
+
+## Resource: aws_elastic_transcoder_preset
+
+### video Configuration Block max_frame_rate Argument No Longer Uses 30 Default
+
+Previously when the `maxFrameRate` argument was not configured, the resource would default to 30. This behavior has been removed and allows for auto frame rate presets to automatically set the appropriate value.
+
+## Resource: aws_emr_cluster
+
+### core_instance_count Argument Removal
+
+Switch your Terraform configuration to the `coreInstanceGroup` configuration block instead.
+
+For example, given this previous configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EmrCluster } from "./.gen/providers/aws/emr-cluster";
+interface MyConfig {
+  name: any;
+  releaseLabel: any;
+  serviceRole: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new EmrCluster(this, "example", {
+      core_instance_count: 2,
+      name: config.name,
+      releaseLabel: config.releaseLabel,
+      serviceRole: config.serviceRole,
+    });
+  }
+}
+
+```
+
+An updated configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EmrCluster } from "./.gen/providers/aws/emr-cluster";
+interface MyConfig {
+  instanceType: any;
+  name: any;
+  releaseLabel: any;
+  serviceRole: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new EmrCluster(this, "example", {
+      coreInstanceGroup: {
+        instanceCount: 2,
+        instanceType: config.instanceType,
+      },
+      name: config.name,
+      releaseLabel: config.releaseLabel,
+      serviceRole: config.serviceRole,
+    });
+  }
+}
+
+```
+
+### core_instance_type Argument Removal
+
+Switch your Terraform configuration to the `coreInstanceGroup` configuration block instead.
+
+For example, given this previous configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EmrCluster } from "./.gen/providers/aws/emr-cluster";
+interface MyConfig {
+  name: any;
+  releaseLabel: any;
+  serviceRole: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new EmrCluster(this, "example", {
+      core_instance_type: "m4.large",
+      name: config.name,
+      releaseLabel: config.releaseLabel,
+      serviceRole: config.serviceRole,
+    });
+  }
+}
+
+```
+
+An updated configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EmrCluster } from "./.gen/providers/aws/emr-cluster";
+interface MyConfig {
+  name: any;
+  releaseLabel: any;
+  serviceRole: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new EmrCluster(this, "example", {
+      coreInstanceGroup: {
+        instanceType: "m4.large",
+      },
+      name: config.name,
+      releaseLabel: config.releaseLabel,
+      serviceRole: config.serviceRole,
+    });
+  }
+}
+
+```
+
+### instance_group Configuration Block Removal
+
+Switch your Terraform configuration to the `masterInstanceGroup` and `coreInstanceGroup` configuration blocks instead. For any task instance groups, use the `awsEmrInstanceGroup` resource.
+
+For example, given this previous configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EmrCluster } from "./.gen/providers/aws/emr-cluster";
+interface MyConfig {
+  name: any;
+  releaseLabel: any;
+  serviceRole: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new EmrCluster(this, "example", {
+      instance_group: [
+        {
+          instance_role: "MASTER",
+          instance_type: "m4.large",
+        },
+        {
+          instance_count: 1,
+          instance_role: "CORE",
+          instance_type: "c4.large",
+        },
+        {
+          instance_count: 2,
+          instance_role: "TASK",
+          instance_type: "c4.xlarge",
+        },
+      ],
+      name: config.name,
+      releaseLabel: config.releaseLabel,
+      serviceRole: config.serviceRole,
+    });
+  }
+}
+
+```
+
+An updated configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EmrCluster } from "./.gen/providers/aws/emr-cluster";
+import { EmrInstanceGroup } from "./.gen/providers/aws/emr-instance-group";
+interface MyConfig {
+  name: any;
+  releaseLabel: any;
+  serviceRole: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    const example = new EmrCluster(this, "example", {
+      coreInstanceGroup: {
+        instanceCount: 1,
+        instanceType: "c4.large",
+      },
+      masterInstanceGroup: {
+        instanceType: "m4.large",
+      },
+      name: config.name,
+      releaseLabel: config.releaseLabel,
+      serviceRole: config.serviceRole,
+    });
+    const awsEmrInstanceGroupExample = new EmrInstanceGroup(this, "example_1", {
+      clusterId: example.id,
+      instanceCount: 2,
+      instanceType: "c4.xlarge",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsEmrInstanceGroupExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### master_instance_type Argument Removal
+
+Switch your Terraform configuration to the `masterInstanceGroup` configuration block instead.
+
+For example, given this previous configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EmrCluster } from "./.gen/providers/aws/emr-cluster";
+interface MyConfig {
+  name: any;
+  releaseLabel: any;
+  serviceRole: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new EmrCluster(this, "example", {
+      master_instance_type: "m4.large",
+      name: config.name,
+      releaseLabel: config.releaseLabel,
+      serviceRole: config.serviceRole,
+    });
+  }
+}
+
+```
+
+An updated configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EmrCluster } from "./.gen/providers/aws/emr-cluster";
+interface MyConfig {
+  name: any;
+  releaseLabel: any;
+  serviceRole: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new EmrCluster(this, "example", {
+      masterInstanceGroup: {
+        instanceType: "m4.large",
+      },
+      name: config.name,
+      releaseLabel: config.releaseLabel,
+      serviceRole: config.serviceRole,
+    });
+  }
+}
+
+```
+
+## Resource: aws_glue_job
+
+### allocated_capacity Argument Removal
+
+The Glue API has deprecated the `allocatedCapacity` argument. Switch your Terraform configuration to the `maxCapacity` argument instead.
+
+For example, given this previous configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { GlueJob } from "./.gen/providers/aws/glue-job";
+interface MyConfig {
+  command: any;
+  name: any;
+  roleArn: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new GlueJob(this, "example", {
+      allocated_capacity: 2,
+      command: config.command,
+      name: config.name,
+      roleArn: config.roleArn,
+    });
+  }
+}
+
+```
+
+An updated configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { GlueJob } from "./.gen/providers/aws/glue-job";
+interface MyConfig {
+  command: any;
+  name: any;
+  roleArn: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new GlueJob(this, "example", {
+      maxCapacity: 2,
+      command: config.command,
+      name: config.name,
+      roleArn: config.roleArn,
+    });
+  }
+}
+
+```
+
+## Resource: aws_iam_access_key
+
+### ses_smtp_password Attribute Removal
+
+In many regions today and in all regions after October 1, 2020, the [SES API will only accept version 4 signatures](https://docs.aws.amazon.com/ses/latest/DeveloperGuide/using-ses-api-authentication.html). If referencing the `sesSmtpPassword` attribute, switch your Terraform configuration to the `sesSmtpPasswordV4` attribute instead. Please note that this signature is based on the region of the Terraform AWS Provider. If you need the SES v4 password in multiple regions, it may require using [multiple provider instances](https://www.terraform.io/docs/configuration/providers.html#alias-multiple-provider-configurations).
+
+Depending on when the `awsIamAccessKey` resource was created, it may not have a `sesSmtpPasswordV4` attribute for you to use. If this is the case you will need to [taint](/docs/commands/taint.html) the resource so that it can be recreated with the new value.
+
+Alternatively, you can stage the change by creating a new `awsIamAccessKey` resource and change any downstream dependencies to use the new `sesSmtpPasswordV4` attribute. Once dependents have been updated with the new resource you can remove the old one.
+
+## Resource: aws_iam_instance_profile
+
+### roles Argument Removal
+
+Switch your Terraform configuration to the `role` argument instead.
+
+For example, given this previous configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { IamInstanceProfile } from "./.gen/providers/aws/iam-instance-profile";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new IamInstanceProfile(this, "example", {
+      roles: [awsIamRoleExample.id],
+    });
+  }
+}
+
+```
+
+An updated configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { IamInstanceProfile } from "./.gen/providers/aws/iam-instance-profile";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new IamInstanceProfile(this, "example", {
+      role: Token.asString(awsIamRoleExample.id),
+    });
+  }
+}
+
+```
+
+## Resource: aws_iam_server_certificate
+
+### certificate_body, certificate_chain, and private_key Arguments No Longer Stored as Hash
+
+Previously when the `certificateBody`, `certificateChain`, and `privateKey` arguments were stored in state, they were stored as a hash of the actual value. This hashing has been removed for new or recreated resources to prevent lifecycle issues.
+
+## Resource: aws_instance
+
+### ebs_block_device.iops and root_block_device.iops Argument Apply-Time Validations
+
+Previously when the `iops` argument was configured in either the `ebsBlockDevice` or `rootBlockDevice` configuration block, the Terraform AWS Provider would automatically disregard the value provided to `iops` if the `type` argument was also configured with a value other than `io1` (either explicitly or omitted, indicating the default type `gp2`) as `iops` are only configurable for the `io1` volume type per the AWS EC2 API. This behavior has changed such that the Terraform AWS Provider will instead return an error at apply time indicating an `iops` value is invalid for volume types other than `io1`.
+Exceptions to this are in cases where `iops` is set to `null` or `0` such that the Terraform AWS Provider will continue to accept the value regardless of `type`.
+
+## Resource: aws_lambda_alias
+
+### Import No Longer Converts Function Name to ARN
+
+Previously the resource import would always convert the `functionName` portion of the import identifier into the ARN format. Configurations using the Lambda Function name would show this as an unexpected difference after import. Now this will passthrough the given value on import whether its a Lambda Function name or ARN.
+
+## Resource: aws_launch_template
+
+### network_interfaces.delete_on_termination Argument type change
+
+The `networkInterfacesDeleteOnTermination` argument is now of type `string`, allowing an unspecified value for the argument since the previous `bool` type only allowed for `true/false` and defaulted to `false` when no value was set. Now to enforce `deleteOnTermination` to `false`, the string `"false"` or bare `false` value must be used.
+
+For example, given this previous configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LaunchTemplate } from "./.gen/providers/aws/launch-template";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new LaunchTemplate(this, "example", {
+      networkInterfaces: [
+        {
+          deleteOnTermination: [null],
+        },
+      ],
+    });
+  }
+}
+
+```
+
+An updated configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LaunchTemplate } from "./.gen/providers/aws/launch-template";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new LaunchTemplate(this, "example", {
+      networkInterfaces: [
+        {
+          deleteOnTermination: Token.asString(false),
+        },
+      ],
+    });
+  }
+}
+
+```
+
+## Resource: aws_lb_listener_rule
+
+### condition.field and condition.values Arguments Removal
+
+Switch your Terraform configuration to use the `hostHeader` or `pathPattern` configuration block instead.
+
+For example, given this previous configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LbListenerRule } from "./.gen/providers/aws/lb-listener-rule";
+interface MyConfig {
+  action: any;
+  listenerArn: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new LbListenerRule(this, "example", {
+      condition: [
+        {
+          field: "path-pattern",
+          values: ["/static/*"],
+        },
+      ],
+      action: config.action,
+      listenerArn: config.listenerArn,
+    });
+  }
+}
+
+```
+
+An updated configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LbListenerRule } from "./.gen/providers/aws/lb-listener-rule";
+interface MyConfig {
+  action: any;
+  listenerArn: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new LbListenerRule(this, "example", {
+      condition: [
+        {
+          pathPattern: {
+            values: ["/static/*"],
+          },
+        },
+      ],
+      action: config.action,
+      listenerArn: config.listenerArn,
+    });
+  }
+}
+
+```
+
+## Resource: aws_msk_cluster
+
+### encryption_info.encryption_in_transit.client_broker Default Updated to Match API
+
+A few weeks after general availability launch and initial release of the `awsMskCluster` resource, the MSK API default for client broker encryption switched from `tlsPlaintext` to `tls`. The attribute default has now been updated to match the more secure API default, however existing Terraform configurations may show a difference if this setting is not configured.
+
+To continue using the old default when it was previously not configured, add or modify this configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { MskCluster } from "./.gen/providers/aws/msk-cluster";
+interface MyConfig {
+  brokerNodeGroupInfo: any;
+  clusterName: any;
+  kafkaVersion: any;
+  numberOfBrokerNodes: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new MskCluster(this, "example", {
+      encryptionInfo: {
+        encryptionInTransit: {
+          clientBroker: "TLS_PLAINTEXT",
+        },
+      },
+      brokerNodeGroupInfo: config.brokerNodeGroupInfo,
+      clusterName: config.clusterName,
+      kafkaVersion: config.kafkaVersion,
+      numberOfBrokerNodes: config.numberOfBrokerNodes,
+    });
+  }
+}
+
+```
+
+## Resource: aws_rds_cluster
+
+### scaling_configuration.min_capacity Now Defaults to 1
+
+Previously when the `minCapacity` argument in a `scalingConfiguration` block was not configured, the resource would default to 2. This behavior has been updated to align with the AWS RDS Cluster API default of 1.
+
+## Resource: aws_route53_resolver_rule
+
+### Removal of trailing period in domain_name argument
+
+Previously the resource returned the Resolver Rule Domain Name directly from the API, which included a `.` suffix. This proves difficult when many other AWS services do not accept this trailing period (e.g., ACM Certificate). This period is now automatically removed. For example, when the attribute would previously return a Resolver Rule Domain Name such as `exampleCom`, the attribute now will be returned as `exampleCom`.
+While the returned value will omit the trailing period, use of configurations with trailing periods will not be interrupted.
+
+## Resource: aws_route53_zone
+
+### Removal of trailing period in name argument
+
+Previously the resource returned the Hosted Zone Domain Name directly from the API, which included a `.` suffix. This proves difficult when many other AWS services do not accept this trailing period (e.g., ACM Certificate). This period is now automatically removed. For example, when the attribute would previously return a Hosted Zone Domain Name such as `exampleCom`, the attribute now will be returned as `exampleCom`.
+While the returned value will omit the trailing period, use of configurations with trailing periods will not be interrupted.
+
+## Resource: aws_s3_bucket
+
+### Removal of Automatic aws_s3_bucket_policy Import
+
+Previously when importing the `awsS3Bucket` resource with the [`terraform import` command](https://www.terraform.io/docs/commands/import.html), the Terraform AWS Provider would automatically attempt to import an associated `awsS3BucketPolicy` resource as well. This automatic resource import has been removed. Use the [`awsS3BucketPolicy` resource import](/docs/providers/aws/r/s3_bucket_policy.html#import) to import that resource separately.
+
+### region Attribute Is Now Read-Only
+
+The `region` attribute is no longer configurable, but it remains as a read-only attribute. The region of the `awsS3Bucket` resource is determined by the region of the Terraform AWS Provider, similar to all other resources.
+
+For example, given this previous configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new S3Bucket(this, "example", {
+      region: "us-west-2",
+    });
+  }
+}
+
+```
+
+An updated configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new S3Bucket(this, "example", {});
+  }
+}
+
+```
+
+## Resource: aws_s3_bucket_metric
+
+### filter configuration block Plan-Time Validation Change
+
+The `filter` configuration block no longer supports the empty block `{}` and requires at least one of the `prefix` or `tags` attributes to be specified.
+
+For example, given this previous configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3BucketMetric } from "./.gen/providers/aws/s3-bucket-metric";
+interface MyConfig {
+  bucket: any;
+  name: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new S3BucketMetric(this, "example", {
+      filter: {},
+      bucket: config.bucket,
+      name: config.name,
+    });
+  }
+}
+
+```
+
+An updated configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3BucketMetric } from "./.gen/providers/aws/s3-bucket-metric";
+interface MyConfig {
+  bucket: any;
+  name: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new S3BucketMetric(this, "example", {
+      bucket: config.bucket,
+      name: config.name,
+    });
+  }
+}
+
+```
+
+## Resource: aws_security_group
+
+### Removal of Automatic aws_security_group_rule Import
+
+Previously when importing the `awsSecurityGroup` resource with the [`terraform import` command](https://www.terraform.io/docs/commands/import.html), the Terraform AWS Provider would automatically attempt to import an associated `awsSecurityGroupRule` resource(s) as well. This automatic resource import has been removed. Use the [`awsSecurityGroupRule` resource import](/docs/providers/aws/r/security_group_rule.html#import) to import those resources separately.
+
+## Resource: aws_sns_platform_application
+
+### platform_credential and platform_principal Arguments No Longer Stored as SHA256 Hash
+
+Previously when the `platformCredential` and `platformPrincipal` arguments were stored in state, they were stored as a SHA256 hash of the actual value. This prevented Terraform from properly updating the resource when necessary and the hashing has been removed. The Terraform AWS Provider will show an update to these arguments on the first apply after upgrading to version 3.0.0, which is fixing the Terraform state to remove the hash. Since the attributes are marked as sensitive, the values in the update will not be visible in the Terraform output. If the non-hashed values have not changed, then no update is occurring other than the Terraform state update. If these arguments are the only two updates and they both match the SHA256 removal, the apply will occur without submitting an actual `setPlatformApplicationAttributes` API call.
+
+## Resource: aws_spot_fleet_request
+
+### valid_until Argument No Longer Uses 24 Hour Default
+
+Previously when the `validUntil` argument was not configured, the resource would default to a 24 hour request. This behavior has been removed and allows for non-expiring requests. To recreate the old behavior, the [`timeOffset` resource](https://registry.terraform.io/providers/hashicorp/time/latest/docs/resources/offset) can potentially be used.
+
+## Resource: aws_ssm_maintenance_window_task
+
+### logging_info Configuration Block Removal
+
+Switch your Terraform configuration to the `taskInvocationParameters` configuration block `runCommandParameters` configuration block `outputS3Bucket` and `outputS3KeyPrefix` arguments instead.
+
+For example, given this previous configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SsmMaintenanceWindowTask } from "./.gen/providers/aws/ssm-maintenance-window-task";
+interface MyConfig {
+  taskArn: any;
+  taskType: any;
+  windowId: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new SsmMaintenanceWindowTask(this, "example", {
+      logging_info: [
+        {
+          s3_bucket_key_prefix: "example",
+          s3_bucket_name: awsS3BucketExample.id,
+        },
+      ],
+      taskArn: config.taskArn,
+      taskType: config.taskType,
+      windowId: config.windowId,
+    });
+  }
+}
+
+```
+
+An updated configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SsmMaintenanceWindowTask } from "./.gen/providers/aws/ssm-maintenance-window-task";
+interface MyConfig {
+  taskArn: any;
+  taskType: any;
+  windowId: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new SsmMaintenanceWindowTask(this, "example", {
+      taskInvocationParameters: {
+        runCommandParameters: {
+          outputS3Bucket: Token.asString(awsS3BucketExample.id),
+          outputS3KeyPrefix: "example",
+        },
+      },
+      taskArn: config.taskArn,
+      taskType: config.taskType,
+      windowId: config.windowId,
+    });
+  }
+}
+
+```
+
+### task_parameters Configuration Block Removal
+
+Switch your Terraform configuration to the `taskInvocationParameters` configuration block `runCommandParameters` configuration block `parameter` configuration blocks instead.
+
+For example, given this previous configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SsmMaintenanceWindowTask } from "./.gen/providers/aws/ssm-maintenance-window-task";
+interface MyConfig {
+  taskArn: any;
+  taskType: any;
+  windowId: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new SsmMaintenanceWindowTask(this, "example", {
+      task_parameters: [
+        {
+          name: "commands",
+          values: ["date"],
+        },
+      ],
+      taskArn: config.taskArn,
+      taskType: config.taskType,
+      windowId: config.windowId,
+    });
+  }
+}
+
+```
+
+An updated configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SsmMaintenanceWindowTask } from "./.gen/providers/aws/ssm-maintenance-window-task";
+interface MyConfig {
+  taskArn: any;
+  taskType: any;
+  windowId: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new SsmMaintenanceWindowTask(this, "example", {
+      taskInvocationParameters: {
+        runCommandParameters: {
+          parameter: [
+            {
+              name: "commands",
+              values: ["date"],
+            },
+          ],
+        },
+      },
+      taskArn: config.taskArn,
+      taskType: config.taskType,
+      windowId: config.windowId,
+    });
+  }
+}
+
+```
+
+<!-- cache-key: cdktf-0.18.0 input-fedd1760b9754507e4a21a87fc167b34be2073f23cf84a5f4c3f209428295c89 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/guides/version-4-upgrade.html.markdown b/website/docs/cdktf/typescript/guides/version-4-upgrade.html.markdown
new file mode 100644
index 00000000000..b5b51a3801f
--- /dev/null
+++ b/website/docs/cdktf/typescript/guides/version-4-upgrade.html.markdown
@@ -0,0 +1,5276 @@
+---
+subcategory: ""
+layout: "aws"
+page_title: "Terraform AWS Provider Version 4 Upgrade Guide"
+description: |-
+  Terraform AWS Provider Version 4 Upgrade Guide
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Terraform AWS Provider Version 4 Upgrade Guide
+
+Version 4.0.0 of the AWS provider for Terraform is a major release and includes some changes that you will need to consider when upgrading. We intend this guide to help with that process and focus only on changes from version 3.X to version 4.0.0. See the [Version 3 Upgrade Guide](/docs/providers/aws/guides/version-3-upgrade.html) for information about upgrading from 2.X to version 3.0.0.
+
+We previously marked most of the changes we outline in this guide as deprecated in the Terraform plan/apply output throughout previous provider releases. You can find these changes, including deprecation notices, in the [Terraform AWS Provider CHANGELOG](https://github.com/hashicorp/terraform-provider-aws/blob/main/CHANGELOG.md).
+
+~> **NOTE:** Versions 4.0.0 through v4.8.0 of the AWS Provider introduce significant breaking changes to the `awsS3Bucket` resource. See [S3 Bucket Refactor](#s3-bucket-refactor) for more details.
+We recommend upgrading to v4.9.0 or later of the AWS Provider instead, where only non-breaking changes and deprecation notices are introduced to the `awsS3Bucket`. See  [Changes to S3 Bucket Drift Detection](#changes-to-s3-bucket-drift-detection) for additional considerations when upgrading to v4.9.0 or later.
+
+~> **NOTE:** Version 4.0.0 of the AWS Provider introduces changes to the precedence of some authentication and configuration parameters.
+These changes bring the provider in line with the AWS CLI and SDKs.
+See [Changes to Authentication](#changes-to-authentication) for more details.
+
+~> **NOTE:** Version 4.0.0 of the AWS Provider will be the last major version to support [EC2-Classic resources](#ec2-classic-resource-and-data-source-support) as AWS plans to fully retire EC2-Classic Networking. See the [AWS News Blog](https://aws.amazon.com/blogs/aws/ec2-classic-is-retiring-heres-how-to-prepare/) for additional details.
+
+~> **NOTE:** Version 4.0.0 of the AWS Provider will be the last major version to support [Macie Classic resources](#macie-classic-resource-support) as AWS plans to fully retire Macie Classic. See the [Amazon Macie Classic FAQs](https://aws.amazon.com/macie/classic-faqs/) for additional details.
+
+Upgrade topics:
+
+<!-- TOC depthFrom:2 depthTo:2 -->
+
+- [Provider Version Configuration](#provider-version-configuration)
+- [Changes to Authentication](#changes-to-authentication)
+- [New Provider Arguments](#new-provider-arguments)
+- [Changes to S3 Bucket Drift Detection](#changes-to-s3-bucket-drift-detection) (**Applicable to v4.9.0 and later of the AWS Provider**)
+- [S3 Bucket Refactor](#s3-bucket-refactor) (**Only applicable to v4.0.0 through v4.8.0 of the AWS Provider**)
+    - [`accelerationStatus` Argument](#acceleration_status-argument)
+    - [`acl` Argument](#acl-argument)
+    - [`corsRule` Argument](#cors_rule-argument)
+    - [`grant` Argument](#grant-argument)
+    - [`lifecycleRule` Argument](#lifecycle_rule-argument)
+    - [`logging` Argument](#logging-argument)
+    - [`objectLockConfiguration` `rule` Argument](#object_lock_configuration-rule-argument)
+    - [`policy` Argument](#policy-argument)
+    - [`replicationConfiguration` Argument](#replication_configuration-argument)
+    - [`requestPayer` Argument](#request_payer-argument)
+    - [`serverSideEncryptionConfiguration` Argument](#server_side_encryption_configuration-argument)
+    - [`versioning` Argument](#versioning-argument)
+    - [`website`, `websiteDomain`, and `websiteEndpoint` Arguments](#website-website_domain-and-website_endpoint-arguments)
+- [Full Resource Lifecycle of Default Resources](#full-resource-lifecycle-of-default-resources)
+    - [Resource: aws_default_subnet](#resource-aws_default_subnet)
+    - [Resource: aws_default_vpc](#resource-aws_default_vpc)
+- [Plural Data Source Behavior](#plural-data-source-behavior)
+- [Empty Strings Not Valid For Certain Resources](#empty-strings-not-valid-for-certain-resources)
+    - [Resource: aws_cloudwatch_event_target (Empty String)](#resource-aws_cloudwatch_event_target-empty-string)
+    - [Resource: aws_customer_gateway](#resource-aws_customer_gateway)
+    - [Resource: aws_default_network_acl](#resource-aws_default_network_acl)
+    - [Resource: aws_default_route_table](#resource-aws_default_route_table)
+    - [Resource: aws_default_vpc (Empty String)](#resource-aws_default_vpc-empty-string)
+    - [Resource: aws_efs_mount_target](#resource-aws_efs_mount_target)
+    - [Resource: aws_elasticsearch_domain](#resource-aws_elasticsearch_domain)
+    - [Resource: aws_instance](#resource-aws_instance)
+    - [Resource: aws_network_acl](#resource-aws_network_acl)
+    - [Resource: aws_route](#resource-aws_route)
+    - [Resource: aws_route_table](#resource-aws_route_table)
+    - [Resource: aws_vpc](#resource-aws_vpc)
+    - [Resource: aws_vpc_ipv6_cidr_block_association](#resource-aws_vpc_ipv6_cidr_block_association)
+- [Data Source: aws_cloudwatch_log_group](#data-source-aws_cloudwatch_log_group)
+- [Data Source: aws_subnet_ids](#data-source-aws_subnet_ids)
+- [Data Source: aws_s3_bucket_object](#data-source-aws_s3_bucket_object)
+- [Data Source: aws_s3_bucket_objects](#data-source-aws_s3_bucket_objects)
+- [Resource: aws_batch_compute_environment](#resource-aws_batch_compute_environment)
+- [Resource: aws_cloudwatch_event_target](#resource-aws_cloudwatch_event_target)
+- [Resource: aws_elasticache_cluster](#resource-aws_elasticache_cluster)
+- [Resource: aws_elasticache_global_replication_group](#resource-aws_elasticache_global_replication_group)
+- [Resource: aws_fsx_ontap_storage_virtual_machine](#resource-aws_fsx_ontap_storage_virtual_machine)
+- [Resource: aws_lb_target_group](#resource-aws_lb_target_group)
+- [Resource: aws_s3_bucket_object](#resource-aws_s3_bucket_object)
+
+<!-- /TOC -->
+
+Additional Topics:
+
+<!-- TOC depthFrom:2 depthTo:2 -->
+
+- [EC2-Classic resource and data source support](#ec2-classic-resource-and-data-source-support)
+- [Macie Classic resource support](#macie-classic-resource-support)
+
+<!-- /TOC -->
+
+## Provider Version Configuration
+
+-> Before upgrading to version 4.0.0, upgrade to the most recent 3.X version of the provider and ensure that your environment successfully runs [`terraform plan`](https://www.terraform.io/docs/commands/plan.html). You should not see changes you don't expect or deprecation notices.
+
+Use [version constraints when configuring Terraform providers](https://www.terraform.io/docs/configuration/providers.html#provider-versions). If you are following that recommendation, update the version constraints in your Terraform configuration and run [`terraform init -upgrade`](https://www.terraform.io/docs/commands/init.html) to download the new version.
+
+For example, given this previous configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AwsProvider } from "./.gen/providers/aws/provider";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AwsProvider(this, "aws", {});
+  }
+}
+
+```
+
+Update to the latest 4.X version:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AwsProvider } from "./.gen/providers/aws/provider";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AwsProvider(this, "aws", {});
+  }
+}
+
+```
+
+## Changes to Authentication
+
+The authentication configuration for the AWS Provider has changed in this version to match the behavior of other AWS products, including the AWS SDK and AWS CLI. _This will cause authentication failures in AWS provider configurations where you set a non-empty `profile` in the `provider` configuration but the profile does not correspond to an AWS profile with valid credentials._
+
+Precedence for authentication settings is as follows:
+
+* `provider` configuration
+* Environment variables
+* Shared credentials and configuration files (_e.g._, `~/Aws/credentials` and `~/Aws/config`)
+
+In previous versions of the provider, you could explicitly set `profile` in the `provider`, and if the profile did not correspond to valid credentials, the provider would use credentials from environment variables. Starting in v4.0, the Terraform AWS provider enforces the precedence shown above, similarly to how the AWS SDK and AWS CLI behave.
+
+In other words, when you explicitly set `profile` in `provider`, the AWS provider will not use environment variables per the precedence shown above. Before v4.0, if `profile` was configured in the `provider` configuration but did not correspond to an AWS profile or valid credentials, the provider would attempt to use environment variables. **This is no longer the case.** An explicitly set profile that does not have valid credentials will cause an authentication error.
+
+For example, with the following, the environment variables will not be used:
+
+```console
+$ export AWS_ACCESS_KEY_ID="anaccesskey"
+$ export AWS_SECRET_ACCESS_KEY="asecretkey"
+```
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AwsProvider } from "./.gen/providers/aws/provider";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AwsProvider(this, "aws", {
+      profile: "customprofile",
+      region: "us-west-2",
+    });
+  }
+}
+
+```
+
+## New Provider Arguments
+
+Version 4.x adds these new `provider` arguments:
+
+* `assumeRoleDuration` - Assume role duration as a string, _e.g._, `"1H"` or `"1H30S"`. Terraform AWS Provider v4.0.0 deprecates `assumeRoleDurationSeconds` and a future version will remove it.
+* `customCaBundle` - File containing custom root and intermediate certificates. Can also be configured using the `awsCaBundle` environment variable. (Setting `caBundle` in the shared config file is not supported.)
+* `ec2MetadataServiceEndpoint` - Address of the EC2 metadata service (IMDS) endpoint to use. Can also be set with the `awsEc2MetadataServiceEndpoint` environment variable.
+* `ec2MetadataServiceEndpointMode` - Mode to use in communicating with the metadata service. Valid values are `iPv4` and `iPv6`. Can also be set with the `awsEc2MetadataServiceEndpointMode` environment variable.
+* `s3UsePathStyle` - Replaces `s3ForcePathStyle`, which has been deprecated in Terraform AWS Provider v4.0.0 and support will be removed in a future version.
+* `sharedConfigFiles` - List of paths to AWS shared config files. If not set, the default is `[~/Aws/config]`. A single value can also be set with the `awsConfigFile` environment variable.
+* `sharedCredentialsFiles` - List of paths to the shared credentials file. If not set, the default  is `[~/Aws/credentials]`. A single value can also be set with the `awsSharedCredentialsFile` environment variable. Replaces `sharedCredentialsFile`, which has been deprecated in Terraform AWS Provider v4.0.0 and support will be removed in a future version.
+* `stsRegion` - Region where AWS STS operations will take place. For example, `usEast1` and `usWest2`.
+* `useDualstackEndpoint` - Force the provider to resolve endpoints with DualStack capability. Can also be set with the `awsUseDualstackEndpoint` environment variable or in a shared config file (`useDualstackEndpoint`).
+* `useFipsEndpoint` - Force the provider to resolve endpoints with FIPS capability. Can also be set with the `awsUseFipsEndpoint` environment variable or in a shared config file (`useFipsEndpoint`).
+
+~> **NOTE:** Using the `awsMetadataUrl` environment variable has been deprecated in Terraform AWS Provider v4.0.0 and support will be removed in a future version. Change any scripts or environments using `awsMetadataUrl` to instead use `awsEc2MetadataServiceEndpoint`.
+
+For example, in previous versions, to use FIPS endpoints, you would need to provide all the FIPS endpoints that you wanted to use in the `endpoints` configuration block:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AwsProvider } from "./.gen/providers/aws/provider";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AwsProvider(this, "aws", {
+      endpoints: [
+        {
+          ec2: "https://ec2-fips.us-west-2.amazonaws.com",
+          s3: "https://s3-fips.us-west-2.amazonaws.com",
+          sts: "https://sts-fips.us-west-2.amazonaws.com",
+        },
+      ],
+    });
+  }
+}
+
+```
+
+In v4.0.0, you can still set endpoints in the same way. However, you can instead use the `useFipsEndpoint` argument to have the provider automatically resolve FIPS endpoints for all supported services:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AwsProvider } from "./.gen/providers/aws/provider";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AwsProvider(this, "aws", {
+      useFipsEndpoint: true,
+    });
+  }
+}
+
+```
+
+Note that the provider can only resolve FIPS endpoints where AWS provides FIPS support. Support depends on the service and may include `usEast1`, `usEast2`, `usWest1`, `usWest2`, `usGovEast1`, `usGovWest1`, and `caCentral1`. For more information, see [Federal Information Processing Standard (FIPS) 140-2](https://aws.amazon.com/compliance/fips/).
+
+## Changes to S3 Bucket Drift Detection
+
+~> **NOTE:** This only applies to v4.9.0 and later of the AWS Provider.
+
+~> **NOTE:** If you are migrating from v3.75.x of the AWS Provider and you have already adopted the standalone S3 bucket resources (e.g. `awsS3BucketLifecycleConfiguration`),
+a [`lifecycle` configuration block to ignore changes](https://www.terraform.io/language/meta-arguments/lifecycle#ignore_changes) to the internal parameters of the source `awsS3Bucket` resources will no longer be necessary and can be removed upon upgrade.
+
+~> **NOTE:** In the next major version, v5.0, the parameters listed below will be removed entirely from the `awsS3Bucket` resource.
+For this reason, a deprecation notice is printed in the Terraform CLI for each of the parameters when used in a configuration.
+
+To remediate the breaking changes introduced to the `awsS3Bucket` resource in v4.0.0 of the AWS Provider,
+v4.9.0 and later retain the same configuration parameters of the `awsS3Bucket` resource as in v3.x and functionality of the `awsS3Bucket` resource only differs from v3.x
+in that Terraform will only perform drift detection for each of the following parameters if a configuration value is provided:
+
+* `accelerationStatus`
+* `acl`
+* `corsRule`
+* `grant`
+* `lifecycleRule`
+* `logging`
+* `objectLockConfiguration`
+* `policy`
+* `replicationConfiguration`
+* `requestPayer`
+* `serverSideEncryptionConfiguration`
+* `versioning`
+* `website`
+
+Thus, if one of these parameters was once configured and then is entirely removed from an `awsS3Bucket` resource configuration,
+Terraform will not pick up on these changes on a subsequent `terraform plan` or `terraform apply`.
+
+For example, given the following configuration with a single `corsRule`:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new S3Bucket(this, "example", {
+      bucket: "yournamehere",
+      corsRule: [
+        {
+          allowedHeaders: ["*"],
+          allowedMethods: ["PUT", "POST"],
+          allowedOrigins: ["https://s3-website-test.hashicorp.com"],
+          exposeHeaders: ["ETag"],
+          maxAgeSeconds: 3000,
+        },
+      ],
+    });
+  }
+}
+
+```
+
+When updated to the following configuration without a `corsRule`:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new S3Bucket(this, "example", {
+      bucket: "yournamehere",
+    });
+  }
+}
+
+```
+
+Terraform CLI with v4.9.0 of the AWS Provider will report back:
+
+```console
+aws_s3_bucket.example: Refreshing state... [id=yournamehere]
+...
+No changes. Your infrastructure matches the configuration.
+```
+
+With that said, to manage changes to these parameters in the `awsS3Bucket` resource, practitioners should configure each parameter's respective standalone resource
+and perform updates directly on those new configurations. The parameters are mapped to the standalone resources as follows:
+
+| `awsS3Bucket` Parameter              | Standalone Resource                                  |
+|----------------------------------------|------------------------------------------------------|
+| `accelerationStatus`                  | `awsS3BucketAccelerateConfiguration`             |
+| `acl`                                  | `awsS3BucketAcl`                                  |
+| `corsRule`                            | `awsS3BucketCorsConfiguration`                   |
+| `grant`                                | `awsS3BucketAcl`                                  |
+| `lifecycleRule`                       | `awsS3BucketLifecycleConfiguration`              |
+| `logging`                              | `awsS3BucketLogging`                              |
+| `objectLockConfiguration`            | `awsS3BucketObjectLockConfiguration`            |
+| `policy`                               | `awsS3BucketPolicy`                               |
+| `replicationConfiguration`            | `awsS3BucketReplicationConfiguration`            |
+| `requestPayer`                        | `awsS3BucketRequestPaymentConfiguration`        |
+| `serverSideEncryptionConfiguration` | `awsS3BucketServerSideEncryptionConfiguration` |
+| `versioning`                           | `awsS3BucketVersioning`                           |
+| `website`                              | `awsS3BucketWebsiteConfiguration`                |
+
+Going back to the earlier example, given the following configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new S3Bucket(this, "example", {
+      bucket: "yournamehere",
+      corsRule: [
+        {
+          allowedHeaders: ["*"],
+          allowedMethods: ["PUT", "POST"],
+          allowedOrigins: ["https://s3-website-test.hashicorp.com"],
+          exposeHeaders: ["ETag"],
+          maxAgeSeconds: 3000,
+        },
+      ],
+    });
+  }
+}
+
+```
+
+Practitioners can upgrade to v4.9.0 and then introduce the standalone `awsS3BucketCorsConfiguration` resource, e.g.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketCorsConfiguration } from "./.gen/providers/aws/s3-bucket-cors-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new S3Bucket(this, "example", {
+      bucket: "yournamehere",
+    });
+    const awsS3BucketCorsConfigurationExample = new S3BucketCorsConfiguration(
+      this,
+      "example_1",
+      {
+        bucket: example.id,
+        corsRule: [
+          {
+            allowedHeaders: ["*"],
+            allowedMethods: ["PUT", "POST"],
+            allowedOrigins: ["https://s3-website-test.hashicorp.com"],
+            exposeHeaders: ["ETag"],
+            maxAgeSeconds: 3000,
+          },
+        ],
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketCorsConfigurationExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+Depending on the tools available to you, the above configuration can either be directly applied with Terraform or the standalone resource
+can be imported into Terraform state. Please refer to each standalone resource's _Import_ documentation for the proper syntax.
+
+Once the standalone resources are managed by Terraform, updates and removal can be performed as needed.
+
+The following sections depict standalone resource adoption per individual parameter. Standalone resource adoption is not required to upgrade but is recommended to ensure drift is detected by Terraform.
+The examples below are by no means exhaustive. The aim is to provide important concepts when migrating to a standalone resource whose parameters may not entirely align with the corresponding parameter in the `awsS3Bucket` resource.
+
+### Migrating to `awsS3BucketAccelerateConfiguration`
+
+Given this previous configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new S3Bucket(this, "example", {
+      accelerationStatus: "Enabled",
+      bucket: "yournamehere",
+    });
+  }
+}
+
+```
+
+Update the configuration to:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketAccelerateConfiguration } from "./.gen/providers/aws/s3-bucket-accelerate-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new S3Bucket(this, "example", {
+      bucket: "yournamehere",
+    });
+    const awsS3BucketAccelerateConfigurationExample =
+      new S3BucketAccelerateConfiguration(this, "example_1", {
+        bucket: example.id,
+        status: "Enabled",
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketAccelerateConfigurationExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### Migrating to `awsS3BucketAcl`
+
+#### With `acl`
+
+Given this previous configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new S3Bucket(this, "example", {
+      acl: "private",
+      bucket: "yournamehere",
+    });
+  }
+}
+
+```
+
+Update the configuration to:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketAcl } from "./.gen/providers/aws/s3-bucket-acl";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new S3Bucket(this, "example", {
+      bucket: "yournamehere",
+    });
+    const awsS3BucketAclExample = new S3BucketAcl(this, "example_1", {
+      acl: "private",
+      bucket: example.id,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketAclExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+#### With `grant`
+
+Given this previous configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new S3Bucket(this, "example", {
+      bucket: "yournamehere",
+      grant: [
+        {
+          id: Token.asString(currentUser.id),
+          permissions: ["FULL_CONTROL"],
+          type: "CanonicalUser",
+        },
+        {
+          permissions: ["READ_ACP", "WRITE"],
+          type: "Group",
+          uri: "http://acs.amazonaws.com/groups/s3/LogDelivery",
+        },
+      ],
+    });
+  }
+}
+
+```
+
+Update the configuration to:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketAcl } from "./.gen/providers/aws/s3-bucket-acl";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new S3Bucket(this, "example", {
+      bucket: "yournamehere",
+    });
+    const awsS3BucketAclExample = new S3BucketAcl(this, "example_1", {
+      accessControlPolicy: {
+        grant: [
+          {
+            grantee: {
+              id: Token.asString(currentUser.id),
+              type: "CanonicalUser",
+            },
+            permission: "FULL_CONTROL",
+          },
+          {
+            grantee: {
+              type: "Group",
+              uri: "http://acs.amazonaws.com/groups/s3/LogDelivery",
+            },
+            permission: "READ_ACP",
+          },
+          {
+            grantee: {
+              type: "Group",
+              uri: "http://acs.amazonaws.com/groups/s3/LogDelivery",
+            },
+            permission: "WRITE",
+          },
+        ],
+        owner: {
+          id: Token.asString(currentUser.id),
+        },
+      },
+      bucket: example.id,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketAclExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### Migrating to `awsS3BucketCorsConfiguration`
+
+Given this previous configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new S3Bucket(this, "example", {
+      bucket: "yournamehere",
+      corsRule: [
+        {
+          allowedHeaders: ["*"],
+          allowedMethods: ["PUT", "POST"],
+          allowedOrigins: ["https://s3-website-test.hashicorp.com"],
+          exposeHeaders: ["ETag"],
+          maxAgeSeconds: 3000,
+        },
+      ],
+    });
+  }
+}
+
+```
+
+Update the configuration to:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketCorsConfiguration } from "./.gen/providers/aws/s3-bucket-cors-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new S3Bucket(this, "example", {
+      bucket: "yournamehere",
+    });
+    const awsS3BucketCorsConfigurationExample = new S3BucketCorsConfiguration(
+      this,
+      "example_1",
+      {
+        bucket: example.id,
+        corsRule: [
+          {
+            allowedHeaders: ["*"],
+            allowedMethods: ["PUT", "POST"],
+            allowedOrigins: ["https://s3-website-test.hashicorp.com"],
+            exposeHeaders: ["ETag"],
+            maxAgeSeconds: 3000,
+          },
+        ],
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketCorsConfigurationExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### Migrating to `awsS3BucketLifecycleConfiguration`
+
+~> **Note:** In version `3X` of the provider, the `lifecycleRuleId` argument was optional, while in version `4X`, the `awsS3BucketLifecycleConfigurationRuleId` argument required. Use the AWS CLI s3api [get-bucket-lifecycle-configuration](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/s3api/get-bucket-lifecycle-configuration.html) to get the source bucket's lifecycle configuration to determine the ID.
+
+#### For Lifecycle Rules with no `prefix` previously configured
+
+~> **Note:** When configuring the `ruleFilter` configuration block in the new `awsS3BucketLifecycleConfiguration` resource, use the AWS CLI s3api [get-bucket-lifecycle-configuration](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/s3api/get-bucket-lifecycle-configuration.html)
+to get the source bucket's lifecycle configuration and determine if the `filter` is configured as `"Filter" : {}` or `"Filter" : { "Prefix": "" }`.
+If AWS returns the former, configure `ruleFilter` as `filter {}`. Otherwise, neither a `ruleFilter` nor `rulePrefix` parameter should be configured as shown here:
+
+Given this previous configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new S3Bucket(this, "example", {
+      bucket: "yournamehere",
+      lifecycleRule: [
+        {
+          enabled: true,
+          id: "Keep previous version 30 days, then in Glacier another 60",
+          noncurrentVersionExpiration: {
+            days: 90,
+          },
+          noncurrentVersionTransition: [
+            {
+              days: 30,
+              storageClass: "GLACIER",
+            },
+          ],
+        },
+        {
+          abortIncompleteMultipartUploadDays: 7,
+          enabled: true,
+          id: "Delete old incomplete multi-part uploads",
+        },
+      ],
+    });
+  }
+}
+
+```
+
+Update the configuration to:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketLifecycleConfiguration } from "./.gen/providers/aws/s3-bucket-lifecycle-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new S3Bucket(this, "example", {
+      bucket: "yournamehere",
+    });
+    const awsS3BucketLifecycleConfigurationExample =
+      new S3BucketLifecycleConfiguration(this, "example_1", {
+        bucket: example.id,
+        rule: [
+          {
+            id: "Keep previous version 30 days, then in Glacier another 60",
+            noncurrentVersionExpiration: {
+              noncurrentDays: 90,
+            },
+            noncurrentVersionTransition: [
+              {
+                noncurrentDays: 30,
+                storageClass: "GLACIER",
+              },
+            ],
+            status: "Enabled",
+          },
+          {
+            abortIncompleteMultipartUpload: {
+              daysAfterInitiation: 7,
+            },
+            id: "Delete old incomplete multi-part uploads",
+            status: "Enabled",
+          },
+        ],
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketLifecycleConfigurationExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+#### For Lifecycle Rules with `prefix` previously configured as an empty string
+
+Given this previous configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new S3Bucket(this, "example", {
+      bucket: "yournamehere",
+      lifecycleRule: [
+        {
+          enabled: true,
+          id: "log-expiration",
+          prefix: "",
+          transition: [
+            {
+              days: 30,
+              storageClass: "STANDARD_IA",
+            },
+            {
+              days: 180,
+              storageClass: "GLACIER",
+            },
+          ],
+        },
+      ],
+    });
+  }
+}
+
+```
+
+Update the configuration to:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketLifecycleConfiguration } from "./.gen/providers/aws/s3-bucket-lifecycle-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new S3Bucket(this, "example", {
+      bucket: "yournamehere",
+    });
+    const awsS3BucketLifecycleConfigurationExample =
+      new S3BucketLifecycleConfiguration(this, "example_1", {
+        bucket: example.id,
+        rule: [
+          {
+            id: "log-expiration",
+            status: "Enabled",
+            transition: [
+              {
+                days: 30,
+                storageClass: "STANDARD_IA",
+              },
+              {
+                days: 180,
+                storageClass: "GLACIER",
+              },
+            ],
+          },
+        ],
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketLifecycleConfigurationExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+#### For Lifecycle Rules with `prefix`
+
+Given this previous configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new S3Bucket(this, "example", {
+      bucket: "yournamehere",
+      lifecycleRule: [
+        {
+          enabled: true,
+          id: "log-expiration",
+          prefix: "foobar",
+          transition: [
+            {
+              days: 30,
+              storageClass: "STANDARD_IA",
+            },
+            {
+              days: 180,
+              storageClass: "GLACIER",
+            },
+          ],
+        },
+      ],
+    });
+  }
+}
+
+```
+
+Update the configuration to:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketLifecycleConfiguration } from "./.gen/providers/aws/s3-bucket-lifecycle-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new S3Bucket(this, "example", {
+      bucket: "yournamehere",
+    });
+    const awsS3BucketLifecycleConfigurationExample =
+      new S3BucketLifecycleConfiguration(this, "example_1", {
+        bucket: example.id,
+        rule: [
+          {
+            filter: {
+              prefix: "foobar",
+            },
+            id: "log-expiration",
+            status: "Enabled",
+            transition: [
+              {
+                days: 30,
+                storageClass: "STANDARD_IA",
+              },
+              {
+                days: 180,
+                storageClass: "GLACIER",
+              },
+            ],
+          },
+        ],
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketLifecycleConfigurationExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+#### For Lifecycle Rules with `prefix` and `tags`
+
+Given this previous configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new S3Bucket(this, "example", {
+      bucket: "yournamehere",
+      lifecycleRule: [
+        {
+          enabled: true,
+          expiration: {
+            days: 90,
+          },
+          id: "log",
+          prefix: "log/",
+          tags: {
+            autoclean: "true",
+            rule: "log",
+          },
+          transition: [
+            {
+              days: 30,
+              storageClass: "STANDARD_IA",
+            },
+            {
+              days: 60,
+              storageClass: "GLACIER",
+            },
+          ],
+        },
+        {
+          enabled: true,
+          expiration: {
+            date: "2022-12-31",
+          },
+          id: "tmp",
+          prefix: "tmp/",
+        },
+      ],
+    });
+  }
+}
+
+```
+
+Update the configuration to:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketLifecycleConfiguration } from "./.gen/providers/aws/s3-bucket-lifecycle-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new S3Bucket(this, "example", {
+      bucket: "yournamehere",
+    });
+    const awsS3BucketLifecycleConfigurationExample =
+      new S3BucketLifecycleConfiguration(this, "example_1", {
+        bucket: example.id,
+        rule: [
+          {
+            expiration: {
+              days: 90,
+            },
+            filter: {
+              and: {
+                prefix: "log/",
+                tags: {
+                  autoclean: "true",
+                  rule: "log",
+                },
+              },
+            },
+            id: "log",
+            status: "Enabled",
+            transition: [
+              {
+                days: 30,
+                storageClass: "STANDARD_IA",
+              },
+              {
+                days: 60,
+                storageClass: "GLACIER",
+              },
+            ],
+          },
+          {
+            expiration: {
+              date: "2022-12-31T00:00:00Z",
+            },
+            filter: {
+              prefix: "tmp/",
+            },
+            id: "tmp",
+            status: "Enabled",
+          },
+        ],
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketLifecycleConfigurationExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### Migrating to `awsS3BucketLogging`
+
+Given this previous configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const logBucket = new S3Bucket(this, "log_bucket", {
+      bucket: "example-log-bucket",
+    });
+    new S3Bucket(this, "example", {
+      bucket: "yournamehere",
+      logging: {
+        targetBucket: logBucket.id,
+        targetPrefix: "log/",
+      },
+    });
+  }
+}
+
+```
+
+Update the configuration to:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketLoggingA } from "./.gen/providers/aws/s3-bucket-logging";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new S3Bucket(this, "example", {
+      bucket: "yournamehere",
+    });
+    const logBucket = new S3Bucket(this, "log_bucket", {
+      bucket: "example-log-bucket",
+    });
+    const awsS3BucketLoggingExample = new S3BucketLoggingA(this, "example_2", {
+      bucket: example.id,
+      targetBucket: logBucket.id,
+      targetPrefix: "log/",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketLoggingExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### Migrating to `awsS3BucketObjectLockConfiguration`
+
+Given this previous configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new S3Bucket(this, "example", {
+      bucket: "yournamehere",
+      objectLockConfiguration: {
+        objectLockEnabled: "Enabled",
+        rule: {
+          defaultRetention: {
+            days: 3,
+            mode: "COMPLIANCE",
+          },
+        },
+      },
+    });
+  }
+}
+
+```
+
+Update the configuration to:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketObjectLockConfigurationA } from "./.gen/providers/aws/s3-bucket-object-lock-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new S3Bucket(this, "example", {
+      bucket: "yournamehere",
+      objectLockEnabled: true,
+    });
+    const awsS3BucketObjectLockConfigurationExample =
+      new S3BucketObjectLockConfigurationA(this, "example_1", {
+        bucket: example.id,
+        rule: {
+          defaultRetention: {
+            days: 3,
+            mode: "COMPLIANCE",
+          },
+        },
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketObjectLockConfigurationExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### Migrating to `awsS3BucketPolicy`
+
+Given this previous configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new S3Bucket(this, "example", {
+      bucket: "yournamehere",
+      policy:
+        '{\n  "Id": "Policy1446577137248",\n  "Statement": [\n    {\n      "Action": "s3:PutObject",\n      "Effect": "Allow",\n      "Principal": {\n        "AWS": "${' +
+        current.arn +
+        '}"\n      },\n      "Resource": "arn:${' +
+        dataAwsPartitionCurrent.partition +
+        '}:s3:::yournamehere/*",\n      "Sid": "Stmt1446575236270"\n    }\n  ],\n  "Version": "2012-10-17"\n}\n\n',
+    });
+  }
+}
+
+```
+
+Update the configuration to:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketPolicy } from "./.gen/providers/aws/s3-bucket-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new S3Bucket(this, "example", {
+      bucket: "yournamehere",
+    });
+    const awsS3BucketPolicyExample = new S3BucketPolicy(this, "example_1", {
+      bucket: example.id,
+      policy:
+        '{\n  "Id": "Policy1446577137248",\n  "Statement": [\n    {\n      "Action": "s3:PutObject",\n      "Effect": "Allow",\n      "Principal": {\n        "AWS": "${' +
+        current.arn +
+        '}"\n      },\n      "Resource": "${' +
+        example.arn +
+        '}/*",\n      "Sid": "Stmt1446575236270"\n    }\n  ],\n  "Version": "2012-10-17"\n}\n\n',
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketPolicyExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### Migrating to `awsS3BucketReplicationConfiguration`
+
+Given this previous configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new S3Bucket(this, "example", {
+      bucket: "yournamehere",
+      provider: central,
+      replicationConfiguration: {
+        role: replication.arn,
+        rules: [
+          {
+            destination: {
+              bucket: destination.arn,
+              metrics: {
+                minutes: 15,
+                status: "Enabled",
+              },
+              replicationTime: {
+                minutes: 15,
+                status: "Enabled",
+              },
+              storageClass: "STANDARD",
+            },
+            filter: {
+              tags: {},
+            },
+            id: "foobar",
+            status: "Enabled",
+          },
+        ],
+      },
+    });
+  }
+}
+
+```
+
+Update the configuration to:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketReplicationConfigurationA } from "./.gen/providers/aws/s3-bucket-replication-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new S3Bucket(this, "example", {
+      bucket: "yournamehere",
+      provider: central,
+    });
+    const awsS3BucketReplicationConfigurationExample =
+      new S3BucketReplicationConfigurationA(this, "example_1", {
+        bucket: source.id,
+        role: replication.arn,
+        rule: [
+          {
+            deleteMarkerReplication: {
+              status: "Enabled",
+            },
+            destination: {
+              bucket: destination.arn,
+              metrics: {
+                eventThreshold: {
+                  minutes: 15,
+                },
+                status: "Enabled",
+              },
+              replicationTime: {
+                status: "Enabled",
+                time: {
+                  minutes: 15,
+                },
+              },
+              storageClass: "STANDARD",
+            },
+            filter: {},
+            id: "foobar",
+            status: "Enabled",
+          },
+        ],
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketReplicationConfigurationExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### Migrating to `awsS3BucketRequestPaymentConfiguration`
+
+Given this previous configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new S3Bucket(this, "example", {
+      bucket: "yournamehere",
+      requestPayer: "Requester",
+    });
+  }
+}
+
+```
+
+Update the configuration to:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketRequestPaymentConfiguration } from "./.gen/providers/aws/s3-bucket-request-payment-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new S3Bucket(this, "example", {
+      bucket: "yournamehere",
+    });
+    const awsS3BucketRequestPaymentConfigurationExample =
+      new S3BucketRequestPaymentConfiguration(this, "example_1", {
+        bucket: example.id,
+        payer: "Requester",
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketRequestPaymentConfigurationExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### Migrating to `awsS3BucketServerSideEncryptionConfiguration`
+
+Given this previous configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new S3Bucket(this, "example", {
+      bucket: "yournamehere",
+      serverSideEncryptionConfiguration: {
+        rule: {
+          applyServerSideEncryptionByDefault: {
+            kmsMasterKeyId: mykey.arn,
+            sseAlgorithm: "aws:kms",
+          },
+        },
+      },
+    });
+  }
+}
+
+```
+
+Update the configuration to:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketServerSideEncryptionConfigurationA } from "./.gen/providers/aws/s3-bucket-server-side-encryption-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new S3Bucket(this, "example", {
+      bucket: "yournamehere",
+    });
+    const awsS3BucketServerSideEncryptionConfigurationExample =
+      new S3BucketServerSideEncryptionConfigurationA(this, "example_1", {
+        bucket: example.id,
+        rule: [
+          {
+            applyServerSideEncryptionByDefault: {
+              kmsMasterKeyId: mykey.arn,
+              sseAlgorithm: "aws:kms",
+            },
+          },
+        ],
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketServerSideEncryptionConfigurationExample.overrideLogicalId(
+      "example"
+    );
+  }
+}
+
+```
+
+### Migrating to `awsS3BucketVersioning`
+
+~> **NOTE:** As `awsS3BucketVersioning` is a separate resource, any S3 objects for which versioning is important (_e.g._, a truststore for mutual TLS authentication) must implicitly or explicitly depend on the `awsS3BucketVersioning` resource. Otherwise, the S3 objects may be created before versioning has been set. [See below](#ensure-objects-depend-on-versioning) for an example. Also note that AWS recommends waiting 15 minutes after enabling versioning on a bucket before putting or deleting objects in/from the bucket.
+
+#### Buckets With Versioning Enabled
+
+Given this previous configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new S3Bucket(this, "example", {
+      bucket: "yournamehere",
+      versioning: {
+        enabled: true,
+      },
+    });
+  }
+}
+
+```
+
+Update the configuration to:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketVersioningA } from "./.gen/providers/aws/s3-bucket-versioning";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new S3Bucket(this, "example", {
+      bucket: "yournamehere",
+    });
+    const awsS3BucketVersioningExample = new S3BucketVersioningA(
+      this,
+      "example_1",
+      {
+        bucket: example.id,
+        versioningConfiguration: {
+          status: "Enabled",
+        },
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketVersioningExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+#### Buckets With Versioning Disabled or Suspended
+
+Depending on the version of the Terraform AWS Provider you are migrating from, the interpretation of `versioning.enabled = false`
+in your `awsS3Bucket` resource will differ and thus the migration to the `awsS3BucketVersioning` resource will also differ as follows.
+
+If you are migrating from the Terraform AWS Provider `v3700` or later:
+
+* For new S3 buckets, `enabled = false` is synonymous to `disabled`.
+* For existing S3 buckets, `enabled = false` is synonymous to `suspended`.
+
+If you are migrating from an earlier version of the Terraform AWS Provider:
+
+* For both new and existing S3 buckets, `enabled = false` is synonymous to `suspended`.
+
+Given this previous configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new S3Bucket(this, "example", {
+      bucket: "yournamehere",
+      versioning: {
+        enabled: false,
+      },
+    });
+  }
+}
+
+```
+
+Update the configuration to one of the following:
+
+* If migrating from Terraform AWS Provider `v3700` or later and bucket versioning was never enabled:
+
+  ```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketVersioningA } from "./.gen/providers/aws/s3-bucket-versioning";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new S3Bucket(this, "example", {
+      bucket: "yournamehere",
+    });
+    const awsS3BucketVersioningExample = new S3BucketVersioningA(
+      this,
+      "example_1",
+      {
+        bucket: example.id,
+        versioningConfiguration: {
+          status: "Disabled",
+        },
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketVersioningExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+* If migrating from Terraform AWS Provider `v3700` or later and bucket versioning was enabled at one point:
+
+  ```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketVersioningA } from "./.gen/providers/aws/s3-bucket-versioning";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new S3Bucket(this, "example", {
+      bucket: "yournamehere",
+    });
+    const awsS3BucketVersioningExample = new S3BucketVersioningA(
+      this,
+      "example_1",
+      {
+        bucket: example.id,
+        versioningConfiguration: {
+          status: "Suspended",
+        },
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketVersioningExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+* If migrating from an earlier version of Terraform AWS Provider:
+
+  ```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketVersioningA } from "./.gen/providers/aws/s3-bucket-versioning";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new S3Bucket(this, "example", {
+      bucket: "yournamehere",
+    });
+    const awsS3BucketVersioningExample = new S3BucketVersioningA(
+      this,
+      "example_1",
+      {
+        bucket: example.id,
+        versioningConfiguration: {
+          status: "Suspended",
+        },
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketVersioningExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+#### Ensure Objects Depend on Versioning
+
+When you create an object whose `versionId` you need and an `awsS3BucketVersioning` resource in the same configuration, you are more likely to have success by ensuring the `s3Object` depends either implicitly (see below) or explicitly (i.e., using `depends_on = [aws_s3_bucket_versioning.example]`) on the `awsS3BucketVersioning` resource.
+
+~> **NOTE:** For critical and/or production S3 objects, do not create a bucket, enable versioning, and create an object in the bucket within the same configuration. Doing so will not allow the AWS-recommended 15 minutes between enabling versioning and writing to the bucket.
+
+This example shows the `awsS3ObjectExample` depending implicitly on the versioning resource through the reference to `awsS3BucketVersioningExampleId` to define `bucket`:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketVersioningA } from "./.gen/providers/aws/s3-bucket-versioning";
+import { S3Object } from "./.gen/providers/aws/s3-object";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new S3Bucket(this, "example", {
+      bucket: "yotto",
+    });
+    const awsS3BucketVersioningExample = new S3BucketVersioningA(
+      this,
+      "example_1",
+      {
+        bucket: example.id,
+        versioningConfiguration: {
+          status: "Enabled",
+        },
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketVersioningExample.overrideLogicalId("example");
+    const awsS3ObjectExample = new S3Object(this, "example_2", {
+      bucket: Token.asString(awsS3BucketVersioningExample.id),
+      key: "droeloe",
+      source: "example.txt",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3ObjectExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### Migrating to `awsS3BucketWebsiteConfiguration`
+
+Given this previous configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new S3Bucket(this, "example", {
+      bucket: "yournamehere",
+      website: {
+        errorDocument: "error.html",
+        indexDocument: "index.html",
+      },
+    });
+  }
+}
+
+```
+
+Update the configuration to:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketWebsiteConfiguration } from "./.gen/providers/aws/s3-bucket-website-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new S3Bucket(this, "example", {
+      bucket: "yournamehere",
+    });
+    const awsS3BucketWebsiteConfigurationExample =
+      new S3BucketWebsiteConfiguration(this, "example_1", {
+        bucket: example.id,
+        errorDocument: {
+          key: "error.html",
+        },
+        indexDocument: {
+          suffix: "index.html",
+        },
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketWebsiteConfigurationExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+Given this previous configuration that uses the `awsS3Bucket` parameter `websiteDomain` with `awsRoute53Record`:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Route53Record } from "./.gen/providers/aws/route53-record";
+import { Route53Zone } from "./.gen/providers/aws/route53-zone";
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const main = new Route53Zone(this, "main", {
+      name: "domain.test",
+    });
+    const website = new S3Bucket(this, "website", {
+      website: {
+        errorDocument: "error.html",
+        indexDocument: "index.html",
+      },
+    });
+    new Route53Record(this, "alias", {
+      alias: {
+        evaluateTargetHealth: true,
+        name: website.websiteDomain,
+        zoneId: website.hostedZoneId,
+      },
+      name: "www",
+      type: "A",
+      zoneId: main.zoneId,
+    });
+  }
+}
+
+```
+
+Update the configuration to use the `awsS3BucketWebsiteConfiguration` resource and its `websiteDomain` parameter:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Route53Record } from "./.gen/providers/aws/route53-record";
+import { Route53Zone } from "./.gen/providers/aws/route53-zone";
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketWebsiteConfiguration } from "./.gen/providers/aws/s3-bucket-website-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const main = new Route53Zone(this, "main", {
+      name: "domain.test",
+    });
+    const website = new S3Bucket(this, "website", {});
+    const example = new S3BucketWebsiteConfiguration(this, "example", {
+      bucket: website.id,
+      indexDocument: {
+        suffix: "index.html",
+      },
+    });
+    new Route53Record(this, "alias", {
+      alias: {
+        evaluateTargetHealth: true,
+        name: example.websiteDomain,
+        zoneId: website.hostedZoneId,
+      },
+      name: "www",
+      type: "A",
+      zoneId: main.zoneId,
+    });
+  }
+}
+
+```
+
+## S3 Bucket Refactor
+
+~> **NOTE:** This only applies to v4.0.0 through v4.8.0 of the AWS Provider, which introduce significant breaking
+changes to the `awsS3Bucket` resource. We recommend upgrading to v4.9.0 of the AWS Provider instead. See the section above, [Changes to S3 Bucket Drift Detection](#changes-to-s3-bucket-drift-detection), for additional upgrade considerations.
+
+To help distribute the management of S3 bucket settings via independent resources, various arguments and attributes in the `awsS3Bucket` resource have become **read-only**.
+
+Configurations dependent on these arguments should be updated to use the corresponding `awsS3Bucket_*` resource in order to prevent Terraform from reporting “unconfigurable attribute” errors for read-only arguments. Once updated, it is recommended to import new `awsS3Bucket_*` resources into Terraform state.
+
+In the event practitioners do not anticipate future modifications to the S3 bucket settings associated with these read-only arguments or drift detection is not needed, these read-only arguments should be removed from `awsS3Bucket` resource configurations in order to prevent Terraform from reporting “unconfigurable attribute” errors; the states of these arguments will be preserved but are subject to change with modifications made outside Terraform.
+
+~> **NOTE:** Each of the new `awsS3Bucket_*` resources relies on S3 API calls that utilize a `put` action in order to modify the target S3 bucket. These calls follow standard HTTP methods for REST APIs, and therefore **should** handle situations where the target configuration already exists. While it is not strictly necessary to import new `awsS3Bucket_*` resources where the updated configuration matches the configuration used in previous versions of the AWS provider, skipping this step will lead to a diff in the first plan after a configuration change indicating that any new `awsS3Bucket_*` resources will be created, making it more difficult to determine whether the appropriate actions will be taken.
+
+### `accelerationStatus` Argument
+
+Switch your Terraform configuration to the [`awsS3BucketAccelerateConfiguration` resource](/docs/providers/aws/r/s3_bucket_accelerate_configuration.html) instead.
+
+For example, given this previous configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new S3Bucket(this, "example", {
+      accelerationStatus: "Enabled",
+      bucket: "yournamehere",
+    });
+  }
+}
+
+```
+
+You will get the following error after upgrading:
+
+```
+│ Error: Value for unconfigurable attribute
+│
+│   with aws_s3_bucket.example,
+│   on main.tf line 1, in resource "aws_s3_bucket" "example":
+│    1: resource "aws_s3_bucket" "example" {
+│
+│ Can't configure a value for "acceleration_status": its value will be decided automatically based on the result of applying this configuration.
+```
+
+Since `accelerationStatus` is now read only, update your configuration to use the `awsS3BucketAccelerateConfiguration`
+resource and remove `accelerationStatus` in the `awsS3Bucket` resource:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketAccelerateConfiguration } from "./.gen/providers/aws/s3-bucket-accelerate-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new S3Bucket(this, "example", {
+      bucket: "yournamehere",
+    });
+    const awsS3BucketAccelerateConfigurationExample =
+      new S3BucketAccelerateConfiguration(this, "example_1", {
+        bucket: example.id,
+        status: "Enabled",
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketAccelerateConfigurationExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+Run `terraform import` on each new resource, _e.g._,
+
+```console
+$ terraform import aws_s3_bucket_accelerate_configuration.example yournamehere
+aws_s3_bucket_accelerate_configuration.example: Importing from ID "yournamehere"...
+aws_s3_bucket_accelerate_configuration.example: Import prepared!
+  Prepared aws_s3_bucket_accelerate_configuration for import
+aws_s3_bucket_accelerate_configuration.example: Refreshing state... [id=yournamehere]
+
+Import successful!
+
+The resources that were imported are shown above. These resources are now in
+your Terraform state and will henceforth be managed by Terraform.
+```
+
+### `acl` Argument
+
+Switch your Terraform configuration to the [`awsS3BucketAcl` resource](/docs/providers/aws/r/s3_bucket_acl.html) instead.
+
+For example, given this previous configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new S3Bucket(this, "example", {
+      acl: "private",
+      bucket: "yournamehere",
+    });
+  }
+}
+
+```
+
+You will get the following error after upgrading:
+
+```
+│ Error: Value for unconfigurable attribute
+│
+│   with aws_s3_bucket.example,
+│   on main.tf line 1, in resource "aws_s3_bucket" "example":
+│    1: resource "aws_s3_bucket" "example" {
+│
+│ Can't configure a value for "acl": its value will be decided automatically based on the result of applying this configuration.
+```
+
+Since `acl` is now read only, update your configuration to use the `awsS3BucketAcl`
+resource and remove the `acl` argument in the `awsS3Bucket` resource:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketAcl } from "./.gen/providers/aws/s3-bucket-acl";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new S3Bucket(this, "example", {
+      bucket: "yournamehere",
+    });
+    const awsS3BucketAclExample = new S3BucketAcl(this, "example_1", {
+      acl: "private",
+      bucket: example.id,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketAclExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+~> **NOTE:** When importing into `awsS3BucketAcl`, make sure you use the S3 bucket name (_e.g._, `yournamehere` in the example above) as part of the ID, and _not_ the Terraform bucket configuration name (_e.g._, `example` in the example above).
+
+Run `terraform import` on each new resource, _e.g._,
+
+```console
+$ terraform import aws_s3_bucket_acl.example yournamehere,private
+aws_s3_bucket_acl.example: Importing from ID "yournamehere,private"...
+aws_s3_bucket_acl.example: Import prepared!
+  Prepared aws_s3_bucket_acl for import
+aws_s3_bucket_acl.example: Refreshing state... [id=yournamehere,private]
+
+Import successful!
+
+The resources that were imported are shown above. These resources are now in
+your Terraform state and will henceforth be managed by Terraform.
+```
+
+### `corsRule` Argument
+
+Switch your Terraform configuration to the [`awsS3BucketCorsConfiguration` resource](/docs/providers/aws/r/s3_bucket_cors_configuration.html) instead.
+
+For example, given this previous configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new S3Bucket(this, "example", {
+      bucket: "yournamehere",
+      corsRule: [
+        {
+          allowedHeaders: ["*"],
+          allowedMethods: ["PUT", "POST"],
+          allowedOrigins: ["https://s3-website-test.hashicorp.com"],
+          exposeHeaders: ["ETag"],
+          maxAgeSeconds: 3000,
+        },
+      ],
+    });
+  }
+}
+
+```
+
+You will get the following error after upgrading:
+
+```
+│ Error: Value for unconfigurable attribute
+│
+│   with aws_s3_bucket.example,
+│   on main.tf line 1, in resource "aws_s3_bucket" "example":
+│    1: resource "aws_s3_bucket" "example" {
+│
+│ Can't configure a value for "cors_rule": its value will be decided automatically based on the result of applying this configuration.
+```
+
+Since `corsRule` is now read only, update your configuration to use the `awsS3BucketCorsConfiguration`
+resource and remove `corsRule` and its nested arguments in the `awsS3Bucket` resource:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketCorsConfiguration } from "./.gen/providers/aws/s3-bucket-cors-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new S3Bucket(this, "example", {
+      bucket: "yournamehere",
+    });
+    const awsS3BucketCorsConfigurationExample = new S3BucketCorsConfiguration(
+      this,
+      "example_1",
+      {
+        bucket: example.id,
+        corsRule: [
+          {
+            allowedHeaders: ["*"],
+            allowedMethods: ["PUT", "POST"],
+            allowedOrigins: ["https://s3-website-test.hashicorp.com"],
+            exposeHeaders: ["ETag"],
+            maxAgeSeconds: 3000,
+          },
+        ],
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketCorsConfigurationExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+Run `terraform import` on each new resource, _e.g._,
+
+```console
+$ terraform import aws_s3_bucket_cors_configuration.example yournamehere
+aws_s3_bucket_cors_configuration.example: Importing from ID "yournamehere"...
+aws_s3_bucket_cors_configuration.example: Import prepared!
+  Prepared aws_s3_bucket_cors_configuration for import
+aws_s3_bucket_cors_configuration.example: Refreshing state... [id=yournamehere]
+
+Import successful!
+
+The resources that were imported are shown above. These resources are now in
+your Terraform state and will henceforth be managed by Terraform.
+```
+
+### `grant` Argument
+
+Switch your Terraform configuration to the [`awsS3BucketAcl` resource](/docs/providers/aws/r/s3_bucket_acl.html) instead.
+
+For example, given this previous configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new S3Bucket(this, "example", {
+      bucket: "yournamehere",
+      grant: [
+        {
+          id: Token.asString(currentUser.id),
+          permissions: ["FULL_CONTROL"],
+          type: "CanonicalUser",
+        },
+        {
+          permissions: ["READ_ACP", "WRITE"],
+          type: "Group",
+          uri: "http://acs.amazonaws.com/groups/s3/LogDelivery",
+        },
+      ],
+    });
+  }
+}
+
+```
+
+You will get the following error after upgrading:
+
+```
+│ Error: Value for unconfigurable attribute
+│
+│   with aws_s3_bucket.example,
+│   on main.tf line 1, in resource "aws_s3_bucket" "example":
+│    1: resource "aws_s3_bucket" "example" {
+│
+│ Can't configure a value for "grant": its value will be decided automatically based on the result of applying this configuration.
+```
+
+Since `grant` is now read only, update your configuration to use the `awsS3BucketAcl`
+resource and remove `grant` in the `awsS3Bucket` resource:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketAcl } from "./.gen/providers/aws/s3-bucket-acl";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new S3Bucket(this, "example", {
+      bucket: "yournamehere",
+    });
+    const awsS3BucketAclExample = new S3BucketAcl(this, "example_1", {
+      accessControlPolicy: {
+        grant: [
+          {
+            grantee: {
+              id: Token.asString(currentUser.id),
+              type: "CanonicalUser",
+            },
+            permission: "FULL_CONTROL",
+          },
+          {
+            grantee: {
+              type: "Group",
+              uri: "http://acs.amazonaws.com/groups/s3/LogDelivery",
+            },
+            permission: "READ_ACP",
+          },
+          {
+            grantee: {
+              type: "Group",
+              uri: "http://acs.amazonaws.com/groups/s3/LogDelivery",
+            },
+            permission: "WRITE",
+          },
+        ],
+        owner: {
+          id: Token.asString(currentUser.id),
+        },
+      },
+      bucket: example.id,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketAclExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+Run `terraform import` on each new resource, _e.g._,
+
+```console
+$ terraform import aws_s3_bucket_acl.example yournamehere
+aws_s3_bucket_acl.example: Importing from ID "yournamehere"...
+aws_s3_bucket_acl.example: Import prepared!
+  Prepared aws_s3_bucket_acl for import
+aws_s3_bucket_acl.example: Refreshing state... [id=yournamehere]
+
+Import successful!
+
+The resources that were imported are shown above. These resources are now in
+your Terraform state and will henceforth be managed by Terraform.
+```
+
+### `lifecycleRule` Argument
+
+Switch your Terraform configuration to the [`awsS3BucketLifecycleConfiguration` resource](/docs/providers/aws/r/s3_bucket_lifecycle_configuration.html) instead.
+
+#### For Lifecycle Rules with no `prefix` previously configured
+
+For example, given this previous configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new S3Bucket(this, "example", {
+      bucket: "yournamehere",
+      lifecycleRule: [
+        {
+          enabled: true,
+          id: "Keep previous version 30 days, then in Glacier another 60",
+          noncurrentVersionExpiration: {
+            days: 90,
+          },
+          noncurrentVersionTransition: [
+            {
+              days: 30,
+              storageClass: "GLACIER",
+            },
+          ],
+        },
+        {
+          abortIncompleteMultipartUploadDays: 7,
+          enabled: true,
+          id: "Delete old incomplete multi-part uploads",
+        },
+      ],
+    });
+  }
+}
+
+```
+
+You will receive the following error after upgrading:
+
+```
+│ Error: Value for unconfigurable attribute
+│
+│   with aws_s3_bucket.example,
+│   on main.tf line 1, in resource "aws_s3_bucket" "example":
+│    1: resource "aws_s3_bucket" "example" {
+│
+│ Can't configure a value for "lifecycle_rule": its value will be decided automatically based on the result of applying this configuration.
+```
+
+Since the `lifecycleRule` argument changed to read-only, update the configuration to use the `awsS3BucketLifecycleConfiguration`
+resource and remove `lifecycleRule` and its nested arguments in the `awsS3Bucket` resource.
+
+~> **Note:** When configuring the `ruleFilter` configuration block in the new `awsS3BucketLifecycleConfiguration` resource, use the AWS CLI s3api [get-bucket-lifecycle-configuration](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/s3api/get-bucket-lifecycle-configuration.html)
+to get the source bucket's lifecycle configuration and determine if the `filter` is configured as `"Filter" : {}` or `"Filter" : { "Prefix": "" }`.
+If AWS returns the former, configure `ruleFilter` as `filter {}`. Otherwise, neither a `ruleFilter` nor `rulePrefix` parameter should be configured as shown here:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketLifecycleConfiguration } from "./.gen/providers/aws/s3-bucket-lifecycle-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new S3Bucket(this, "example", {
+      bucket: "yournamehere",
+    });
+    const awsS3BucketLifecycleConfigurationExample =
+      new S3BucketLifecycleConfiguration(this, "example_1", {
+        bucket: example.id,
+        rule: [
+          {
+            id: "Keep previous version 30 days, then in Glacier another 60",
+            noncurrentVersionExpiration: {
+              noncurrentDays: 90,
+            },
+            noncurrentVersionTransition: [
+              {
+                noncurrentDays: 30,
+                storageClass: "GLACIER",
+              },
+            ],
+            status: "Enabled",
+          },
+          {
+            abortIncompleteMultipartUpload: {
+              daysAfterInitiation: 7,
+            },
+            id: "Delete old incomplete multi-part uploads",
+            status: "Enabled",
+          },
+        ],
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketLifecycleConfigurationExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+Run `terraform import` on each new resource, _e.g._,
+
+```console
+$ terraform import aws_s3_bucket_lifecycle_configuration.example yournamehere
+aws_s3_bucket_lifecycle_configuration.example: Importing from ID "yournamehere"...
+aws_s3_bucket_lifecycle_configuration.example: Import prepared!
+  Prepared aws_s3_bucket_lifecycle_configuration for import
+aws_s3_bucket_lifecycle_configuration.example: Refreshing state... [id=yournamehere]
+
+Import successful!
+
+The resources that were imported are shown above. These resources are now in
+your Terraform state and will henceforth be managed by Terraform.
+```
+
+#### For Lifecycle Rules with `prefix` previously configured as an empty string
+
+For example, given this configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new S3Bucket(this, "example", {
+      bucket: "yournamehere",
+      lifecycleRule: [
+        {
+          enabled: true,
+          id: "log-expiration",
+          prefix: "",
+          transition: [
+            {
+              days: 30,
+              storageClass: "STANDARD_IA",
+            },
+            {
+              days: 180,
+              storageClass: "GLACIER",
+            },
+          ],
+        },
+      ],
+    });
+  }
+}
+
+```
+
+You will receive the following error after upgrading:
+
+```
+│ Error: Value for unconfigurable attribute
+│
+│   with aws_s3_bucket.example,
+│   on main.tf line 1, in resource "aws_s3_bucket" "example":
+│    1: resource "aws_s3_bucket" "example" {
+│
+│ Can't configure a value for "lifecycle_rule": its value will be decided automatically based on the result of applying this configuration.
+```
+
+Since the `lifecycleRule` argument changed to read-only, update the configuration to use the `awsS3BucketLifecycleConfiguration`
+resource and remove `lifecycleRule` and its nested arguments in the `awsS3Bucket` resource:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketLifecycleConfiguration } from "./.gen/providers/aws/s3-bucket-lifecycle-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new S3Bucket(this, "example", {
+      bucket: "yournamehere",
+    });
+    const awsS3BucketLifecycleConfigurationExample =
+      new S3BucketLifecycleConfiguration(this, "example_1", {
+        bucket: example.id,
+        rule: [
+          {
+            id: "log-expiration",
+            status: "Enabled",
+            transition: [
+              {
+                days: 30,
+                storageClass: "STANDARD_IA",
+              },
+              {
+                days: 180,
+                storageClass: "GLACIER",
+              },
+            ],
+          },
+        ],
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketLifecycleConfigurationExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+Run `terraform import` on each new resource, _e.g._,
+
+```console
+$ terraform import aws_s3_bucket_lifecycle_configuration.example yournamehere
+aws_s3_bucket_lifecycle_configuration.example: Importing from ID "yournamehere"...
+aws_s3_bucket_lifecycle_configuration.example: Import prepared!
+  Prepared aws_s3_bucket_lifecycle_configuration for import
+aws_s3_bucket_lifecycle_configuration.example: Refreshing state... [id=yournamehere]
+
+Import successful!
+
+The resources that were imported are shown above. These resources are now in
+your Terraform state and will henceforth be managed by Terraform.
+```
+
+#### For Lifecycle Rules with `prefix`
+
+For example, given this configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new S3Bucket(this, "example", {
+      bucket: "yournamehere",
+      lifecycleRule: [
+        {
+          enabled: true,
+          id: "log-expiration",
+          prefix: "foobar",
+          transition: [
+            {
+              days: 30,
+              storageClass: "STANDARD_IA",
+            },
+            {
+              days: 180,
+              storageClass: "GLACIER",
+            },
+          ],
+        },
+      ],
+    });
+  }
+}
+
+```
+
+You will receive the following error after upgrading:
+
+```
+│ Error: Value for unconfigurable attribute
+│
+│   with aws_s3_bucket.example,
+│   on main.tf line 1, in resource "aws_s3_bucket" "example":
+│    1: resource "aws_s3_bucket" "example" {
+│
+│ Can't configure a value for "lifecycle_rule": its value will be decided automatically based on the result of applying this configuration.
+```
+
+Since the `lifecycleRule` argument changed to read-only, update the configuration to use the `awsS3BucketLifecycleConfiguration`
+resource and remove `lifecycleRule` and its nested arguments in the `awsS3Bucket` resource:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketLifecycleConfiguration } from "./.gen/providers/aws/s3-bucket-lifecycle-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new S3Bucket(this, "example", {
+      bucket: "yournamehere",
+    });
+    const awsS3BucketLifecycleConfigurationExample =
+      new S3BucketLifecycleConfiguration(this, "example_1", {
+        bucket: example.id,
+        rule: [
+          {
+            filter: {
+              prefix: "foobar",
+            },
+            id: "log-expiration",
+            status: "Enabled",
+            transition: [
+              {
+                days: 30,
+                storageClass: "STANDARD_IA",
+              },
+              {
+                days: 180,
+                storageClass: "GLACIER",
+              },
+            ],
+          },
+        ],
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketLifecycleConfigurationExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+Run `terraform import` on each new resource, _e.g._,
+
+```console
+$ terraform import aws_s3_bucket_lifecycle_configuration.example yournamehere
+aws_s3_bucket_lifecycle_configuration.example: Importing from ID "yournamehere"...
+aws_s3_bucket_lifecycle_configuration.example: Import prepared!
+  Prepared aws_s3_bucket_lifecycle_configuration for import
+aws_s3_bucket_lifecycle_configuration.example: Refreshing state... [id=yournamehere]
+
+Import successful!
+
+The resources that were imported are shown above. These resources are now in
+your Terraform state and will henceforth be managed by Terraform.
+```
+
+#### For Lifecycle Rules with `prefix` and `tags`
+
+For example, given this previous configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new S3Bucket(this, "example", {
+      bucket: "yournamehere",
+      lifecycleRule: [
+        {
+          enabled: true,
+          expiration: {
+            days: 90,
+          },
+          id: "log",
+          prefix: "log/",
+          tags: {
+            autoclean: "true",
+            rule: "log",
+          },
+          transition: [
+            {
+              days: 30,
+              storageClass: "STANDARD_IA",
+            },
+            {
+              days: 60,
+              storageClass: "GLACIER",
+            },
+          ],
+        },
+        {
+          enabled: true,
+          expiration: {
+            date: "2022-12-31",
+          },
+          id: "tmp",
+          prefix: "tmp/",
+        },
+      ],
+    });
+  }
+}
+
+```
+
+You will get the following error after upgrading:
+
+```
+│ Error: Value for unconfigurable attribute
+│
+│   with aws_s3_bucket.example,
+│   on main.tf line 1, in resource "aws_s3_bucket" "example":
+│    1: resource "aws_s3_bucket" "example" {
+│
+│ Can't configure a value for "lifecycle_rule": its value will be decided automatically based on the result of applying this configuration.
+```
+
+Since `lifecycleRule` is now read only, update your configuration to use the `awsS3BucketLifecycleConfiguration`
+resource and remove `lifecycleRule` and its nested arguments in the `awsS3Bucket` resource:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketLifecycleConfiguration } from "./.gen/providers/aws/s3-bucket-lifecycle-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new S3Bucket(this, "example", {
+      bucket: "yournamehere",
+    });
+    const awsS3BucketLifecycleConfigurationExample =
+      new S3BucketLifecycleConfiguration(this, "example_1", {
+        bucket: example.id,
+        rule: [
+          {
+            expiration: {
+              days: 90,
+            },
+            filter: {
+              and: {
+                prefix: "log/",
+                tags: {
+                  autoclean: "true",
+                  rule: "log",
+                },
+              },
+            },
+            id: "log",
+            status: "Enabled",
+            transition: [
+              {
+                days: 30,
+                storageClass: "STANDARD_IA",
+              },
+              {
+                days: 60,
+                storageClass: "GLACIER",
+              },
+            ],
+          },
+          {
+            expiration: {
+              date: "2022-12-31T00:00:00Z",
+            },
+            filter: {
+              prefix: "tmp/",
+            },
+            id: "tmp",
+            status: "Enabled",
+          },
+        ],
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketLifecycleConfigurationExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+Run `terraform import` on each new resource, _e.g._,
+
+```console
+$ terraform import aws_s3_bucket_lifecycle_configuration.example yournamehere
+aws_s3_bucket_lifecycle_configuration.example: Importing from ID "yournamehere"...
+aws_s3_bucket_lifecycle_configuration.example: Import prepared!
+  Prepared aws_s3_bucket_lifecycle_configuration for import
+aws_s3_bucket_lifecycle_configuration.example: Refreshing state... [id=yournamehere]
+
+Import successful!
+
+The resources that were imported are shown above. These resources are now in
+your Terraform state and will henceforth be managed by Terraform.
+```
+
+### `logging` Argument
+
+Switch your Terraform configuration to the [`awsS3BucketLogging` resource](/docs/providers/aws/r/s3_bucket_logging.html) instead.
+
+For example, given this previous configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const logBucket = new S3Bucket(this, "log_bucket", {
+      bucket: "example-log-bucket",
+    });
+    new S3Bucket(this, "example", {
+      bucket: "yournamehere",
+      logging: {
+        targetBucket: logBucket.id,
+        targetPrefix: "log/",
+      },
+    });
+  }
+}
+
+```
+
+You will get the following error after upgrading:
+
+```
+│ Error: Value for unconfigurable attribute
+│
+│   with aws_s3_bucket.example,
+│   on main.tf line 1, in resource "aws_s3_bucket" "example":
+│    1: resource "aws_s3_bucket" "example" {
+│
+│ Can't configure a value for "logging": its value will be decided automatically based on the result of applying this configuration.
+```
+
+Since `logging` is now read only, update your configuration to use the `awsS3BucketLogging`
+resource and remove `logging` and its nested arguments in the `awsS3Bucket` resource:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketLoggingA } from "./.gen/providers/aws/s3-bucket-logging";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new S3Bucket(this, "example", {
+      bucket: "yournamehere",
+    });
+    const logBucket = new S3Bucket(this, "log_bucket", {
+      bucket: "example-log-bucket",
+    });
+    const awsS3BucketLoggingExample = new S3BucketLoggingA(this, "example_2", {
+      bucket: example.id,
+      targetBucket: logBucket.id,
+      targetPrefix: "log/",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketLoggingExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+Run `terraform import` on each new resource, _e.g._,
+
+```console
+$ terraform import aws_s3_bucket_logging.example yournamehere
+aws_s3_bucket_logging.example: Importing from ID "yournamehere"...
+aws_s3_bucket_logging.example: Import prepared!
+  Prepared aws_s3_bucket_logging for import
+aws_s3_bucket_logging.example: Refreshing state... [id=yournamehere]
+
+Import successful!
+
+The resources that were imported are shown above. These resources are now in
+your Terraform state and will henceforth be managed by Terraform.
+```
+
+### `objectLockConfiguration` `rule` Argument
+
+Switch your Terraform configuration to the [`awsS3BucketObjectLockConfiguration` resource](/docs/providers/aws/r/s3_bucket_object_lock_configuration.html) instead.
+
+For example, given this previous configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new S3Bucket(this, "example", {
+      bucket: "yournamehere",
+      objectLockConfiguration: {
+        objectLockEnabled: "Enabled",
+        rule: {
+          defaultRetention: {
+            days: 3,
+            mode: "COMPLIANCE",
+          },
+        },
+      },
+    });
+  }
+}
+
+```
+
+You will get the following error after upgrading:
+
+```
+│ Error: Value for unconfigurable attribute
+│
+│   with aws_s3_bucket.example,
+│   on main.tf line 1, in resource "aws_s3_bucket" "example":
+│    1: resource "aws_s3_bucket" "example" {
+│
+│ Can't configure a value for "object_lock_configuration.0.rule": its value will be decided automatically based on the result of applying this configuration.
+```
+
+Since the `rule` argument of the `objectLockConfiguration` configuration block changed to read-only, update your configuration to use the `awsS3BucketObjectLockConfiguration`
+resource and remove `rule` and its nested arguments in the `awsS3Bucket` resource:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketObjectLockConfigurationA } from "./.gen/providers/aws/s3-bucket-object-lock-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new S3Bucket(this, "example", {
+      bucket: "yournamehere",
+      objectLockEnabled: true,
+    });
+    const awsS3BucketObjectLockConfigurationExample =
+      new S3BucketObjectLockConfigurationA(this, "example_1", {
+        bucket: example.id,
+        rule: {
+          defaultRetention: {
+            days: 3,
+            mode: "COMPLIANCE",
+          },
+        },
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketObjectLockConfigurationExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+Run `terraform import` on each new resource, _e.g._,
+
+```console
+$ terraform import aws_s3_bucket_object_lock_configuration.example yournamehere
+aws_s3_bucket_object_lock_configuration.example: Importing from ID "yournamehere"...
+aws_s3_bucket_object_lock_configuration.example: Import prepared!
+  Prepared aws_s3_bucket_object_lock_configuration for import
+aws_s3_bucket_object_lock_configuration.example: Refreshing state... [id=yournamehere]
+
+Import successful!
+
+The resources that were imported are shown above. These resources are now in
+your Terraform state and will henceforth be managed by Terraform.
+```
+
+### `policy` Argument
+
+Switch your Terraform configuration to the [`awsS3BucketPolicy` resource](/docs/providers/aws/r/s3_bucket_policy.html) instead.
+
+For example, given this previous configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new S3Bucket(this, "example", {
+      bucket: "yournamehere",
+      policy:
+        '{\n  "Id": "Policy1446577137248",\n  "Statement": [\n    {\n      "Action": "s3:PutObject",\n      "Effect": "Allow",\n      "Principal": {\n        "AWS": "${' +
+        current.arn +
+        '}"\n      },\n      "Resource": "arn:${' +
+        dataAwsPartitionCurrent.partition +
+        '}:s3:::yournamehere/*",\n      "Sid": "Stmt1446575236270"\n    }\n  ],\n  "Version": "2012-10-17"\n}\n\n',
+    });
+  }
+}
+
+```
+
+You will get the following error after upgrading:
+
+```
+│ Error: Value for unconfigurable attribute
+│
+│   with aws_s3_bucket.example,
+│   on main.tf line 1, in resource "aws_s3_bucket" "example":
+│    1: resource "aws_s3_bucket" "example" {
+│
+│ Can't configure a value for "policy": its value will be decided automatically based on the result of applying this configuration.
+```
+
+Since `policy` is now read only, update your configuration to use the `awsS3BucketPolicy`
+resource and remove `policy` in the `awsS3Bucket` resource:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketPolicy } from "./.gen/providers/aws/s3-bucket-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new S3Bucket(this, "example", {
+      bucket: "yournamehere",
+    });
+    const awsS3BucketPolicyExample = new S3BucketPolicy(this, "example_1", {
+      bucket: example.id,
+      policy:
+        '{\n  "Id": "Policy1446577137248",\n  "Statement": [\n    {\n      "Action": "s3:PutObject",\n      "Effect": "Allow",\n      "Principal": {\n        "AWS": "${' +
+        current.arn +
+        '}"\n      },\n      "Resource": "${' +
+        example.arn +
+        '}/*",\n      "Sid": "Stmt1446575236270"\n    }\n  ],\n  "Version": "2012-10-17"\n}\n\n',
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketPolicyExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+Run `terraform import` on each new resource, _e.g._,
+
+```console
+$ terraform import aws_s3_bucket_policy.example yournamehere
+aws_s3_bucket_policy.example: Importing from ID "yournamehere"...
+aws_s3_bucket_policy.example: Import prepared!
+  Prepared aws_s3_bucket_policy for import
+aws_s3_bucket_policy.example: Refreshing state... [id=yournamehere]
+
+Import successful!
+
+The resources that were imported are shown above. These resources are now in
+your Terraform state and will henceforth be managed by Terraform.
+```
+
+### `replicationConfiguration` Argument
+
+Switch your Terraform configuration to the [`awsS3BucketReplicationConfiguration` resource](/docs/providers/aws/r/s3_bucket_replication_configuration.html) instead.
+
+For example, given this previous configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new S3Bucket(this, "example", {
+      bucket: "yournamehere",
+      provider: central,
+      replicationConfiguration: {
+        role: replication.arn,
+        rules: [
+          {
+            destination: {
+              bucket: destination.arn,
+              metrics: {
+                minutes: 15,
+                status: "Enabled",
+              },
+              replicationTime: {
+                minutes: 15,
+                status: "Enabled",
+              },
+              storageClass: "STANDARD",
+            },
+            filter: {
+              tags: {},
+            },
+            id: "foobar",
+            status: "Enabled",
+          },
+        ],
+      },
+    });
+  }
+}
+
+```
+
+You will get the following error after upgrading:
+
+```
+│ Error: Value for unconfigurable attribute
+│
+│   with aws_s3_bucket.example,
+│   on main.tf line 1, in resource "aws_s3_bucket" "example":
+│    1: resource "aws_s3_bucket" "example" {
+│
+│ Can't configure a value for "replication_configuration": its value will be decided automatically based on the result of applying this configuration.
+```
+
+Since `replicationConfiguration` is now read only, update your configuration to use the `awsS3BucketReplicationConfiguration`
+resource and remove `replicationConfiguration` and its nested arguments in the `awsS3Bucket` resource:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketReplicationConfigurationA } from "./.gen/providers/aws/s3-bucket-replication-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new S3Bucket(this, "example", {
+      bucket: "yournamehere",
+      provider: central,
+    });
+    const awsS3BucketReplicationConfigurationExample =
+      new S3BucketReplicationConfigurationA(this, "example_1", {
+        bucket: example.id,
+        role: replication.arn,
+        rule: [
+          {
+            deleteMarkerReplication: {
+              status: "Enabled",
+            },
+            destination: {
+              bucket: destination.arn,
+              metrics: {
+                eventThreshold: {
+                  minutes: 15,
+                },
+                status: "Enabled",
+              },
+              replicationTime: {
+                status: "Enabled",
+                time: {
+                  minutes: 15,
+                },
+              },
+              storageClass: "STANDARD",
+            },
+            filter: {},
+            id: "foobar",
+            status: "Enabled",
+          },
+        ],
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketReplicationConfigurationExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+Run `terraform import` on each new resource, _e.g._,
+
+```console
+$ terraform import aws_s3_bucket_replication_configuration.example yournamehere
+aws_s3_bucket_replication_configuration.example: Importing from ID "yournamehere"...
+aws_s3_bucket_replication_configuration.example: Import prepared!
+  Prepared aws_s3_bucket_replication_configuration for import
+aws_s3_bucket_replication_configuration.example: Refreshing state... [id=yournamehere]
+
+Import successful!
+
+The resources that were imported are shown above. These resources are now in
+your Terraform state and will henceforth be managed by Terraform.
+```
+
+### `requestPayer` Argument
+
+Switch your Terraform configuration to the [`awsS3BucketRequestPaymentConfiguration` resource](/docs/providers/aws/r/s3_bucket_request_payment_configuration.html) instead.
+
+For example, given this previous configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new S3Bucket(this, "example", {
+      bucket: "yournamehere",
+      requestPayer: "Requester",
+    });
+  }
+}
+
+```
+
+You will get the following error after upgrading:
+
+```
+│ Error: Value for unconfigurable attribute
+│
+│   with aws_s3_bucket.example,
+│   on main.tf line 1, in resource "aws_s3_bucket" "example":
+│    1: resource "aws_s3_bucket" "example" {
+│
+│ Can't configure a value for "request_payer": its value will be decided automatically based on the result of applying this configuration.
+```
+
+Since `requestPayer` is now read only, update your configuration to use the `awsS3BucketRequestPaymentConfiguration`
+resource and remove `requestPayer` in the `awsS3Bucket` resource:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketRequestPaymentConfiguration } from "./.gen/providers/aws/s3-bucket-request-payment-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new S3Bucket(this, "example", {
+      bucket: "yournamehere",
+    });
+    const awsS3BucketRequestPaymentConfigurationExample =
+      new S3BucketRequestPaymentConfiguration(this, "example_1", {
+        bucket: example.id,
+        payer: "Requester",
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketRequestPaymentConfigurationExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+Run `terraform import` on each new resource, _e.g._,
+
+```console
+$ terraform import aws_s3_bucket_request_payment_configuration.example yournamehere
+aws_s3_bucket_request_payment_configuration.example: Importing from ID "yournamehere"...
+aws_s3_bucket_request_payment_configuration.example: Import prepared!
+  Prepared aws_s3_bucket_request_payment_configuration for import
+aws_s3_bucket_request_payment_configuration.example: Refreshing state... [id=yournamehere]
+
+Import successful!
+
+The resources that were imported are shown above. These resources are now in
+your Terraform state and will henceforth be managed by Terraform.
+```
+
+### `serverSideEncryptionConfiguration` Argument
+
+Switch your Terraform configuration to the [`awsS3BucketServerSideEncryptionConfiguration` resource](/docs/providers/aws/r/s3_bucket_server_side_encryption_configuration.html) instead.
+
+For example, given this previous configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new S3Bucket(this, "example", {
+      bucket: "yournamehere",
+      serverSideEncryptionConfiguration: {
+        rule: {
+          applyServerSideEncryptionByDefault: {
+            kmsMasterKeyId: mykey.arn,
+            sseAlgorithm: "aws:kms",
+          },
+        },
+      },
+    });
+  }
+}
+
+```
+
+You will get the following error after upgrading:
+
+```
+│ Error: Value for unconfigurable attribute
+│
+│   with aws_s3_bucket.example,
+│   on main.tf line 1, in resource "aws_s3_bucket" "example":
+│    1: resource "aws_s3_bucket" "example" {
+│
+│ Can't configure a value for "server_side_encryption_configuration": its value will be decided automatically based on the result of applying this configuration.
+```
+
+Since `serverSideEncryptionConfiguration` is now read only, update your configuration to use the `awsS3BucketServerSideEncryptionConfiguration`
+resource and remove `serverSideEncryptionConfiguration` and its nested arguments in the `awsS3Bucket` resource:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketServerSideEncryptionConfigurationA } from "./.gen/providers/aws/s3-bucket-server-side-encryption-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new S3Bucket(this, "example", {
+      bucket: "yournamehere",
+    });
+    const awsS3BucketServerSideEncryptionConfigurationExample =
+      new S3BucketServerSideEncryptionConfigurationA(this, "example_1", {
+        bucket: example.id,
+        rule: [
+          {
+            applyServerSideEncryptionByDefault: {
+              kmsMasterKeyId: mykey.arn,
+              sseAlgorithm: "aws:kms",
+            },
+          },
+        ],
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketServerSideEncryptionConfigurationExample.overrideLogicalId(
+      "example"
+    );
+  }
+}
+
+```
+
+Run `terraform import` on each new resource, _e.g._,
+
+```console
+$ terraform import aws_s3_bucket_server_side_encryption_configuration.example yournamehere
+aws_s3_bucket_server_side_encryption_configuration.example: Importing from ID "yournamehere"...
+aws_s3_bucket_server_side_encryption_configuration.example: Import prepared!
+  Prepared aws_s3_bucket_server_side_encryption_configuration for import
+aws_s3_bucket_server_side_encryption_configuration.example: Refreshing state... [id=yournamehere]
+
+Import successful!
+
+The resources that were imported are shown above. These resources are now in
+your Terraform state and will henceforth be managed by Terraform.
+```
+
+### `versioning` Argument
+
+Switch your Terraform configuration to the [`awsS3BucketVersioning` resource](/docs/providers/aws/r/s3_bucket_versioning.html) instead.
+
+~> **NOTE:** As `awsS3BucketVersioning` is a separate resource, any S3 objects for which versioning is important (_e.g._, a truststore for mutual TLS authentication) must implicitly or explicitly depend on the `awsS3BucketVersioning` resource. Otherwise, the S3 objects may be created before versioning has been set. [See below](#ensure-objects-depend-on-versioning) for an example. Also note that AWS recommends waiting 15 minutes after enabling versioning on a bucket before putting or deleting objects in/from the bucket.
+
+#### Buckets With Versioning Enabled
+
+Given this previous configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new S3Bucket(this, "example", {
+      bucket: "yournamehere",
+      versioning: {
+        enabled: true,
+      },
+    });
+  }
+}
+
+```
+
+You will get the following error after upgrading:
+
+```
+│ Error: Value for unconfigurable attribute
+│
+│   with aws_s3_bucket.example,
+│   on main.tf line 1, in resource "aws_s3_bucket" "example":
+│    1: resource "aws_s3_bucket" "example" {
+│
+│ Can't configure a value for "versioning": its value will be decided automatically based on the result of applying this configuration.
+```
+
+Since `versioning` is now read only, update your configuration to use the `awsS3BucketVersioning`
+resource and remove `versioning` and its nested arguments in the `awsS3Bucket` resource:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketVersioningA } from "./.gen/providers/aws/s3-bucket-versioning";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new S3Bucket(this, "example", {
+      bucket: "yournamehere",
+    });
+    const awsS3BucketVersioningExample = new S3BucketVersioningA(
+      this,
+      "example_1",
+      {
+        bucket: example.id,
+        versioningConfiguration: {
+          status: "Enabled",
+        },
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketVersioningExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+Run `terraform import` on each new resource, _e.g._,
+
+```console
+$ terraform import aws_s3_bucket_versioning.example yournamehere
+aws_s3_bucket_versioning.example: Importing from ID "yournamehere"...
+aws_s3_bucket_versioning.example: Import prepared!
+  Prepared aws_s3_bucket_versioning for import
+aws_s3_bucket_versioning.example: Refreshing state... [id=yournamehere]
+
+Import successful!
+
+The resources that were imported are shown above. These resources are now in
+your Terraform state and will henceforth be managed by Terraform.
+```
+
+#### Buckets With Versioning Disabled or Suspended
+
+Depending on the version of the Terraform AWS Provider you are migrating from, the interpretation of `versioning.enabled = false`
+in your `awsS3Bucket` resource will differ and thus the migration to the `awsS3BucketVersioning` resource will also differ as follows.
+
+If you are migrating from the Terraform AWS Provider `v3700` or later:
+
+* For new S3 buckets, `enabled = false` is synonymous to `disabled`.
+* For existing S3 buckets, `enabled = false` is synonymous to `suspended`.
+
+If you are migrating from an earlier version of the Terraform AWS Provider:
+
+* For both new and existing S3 buckets, `enabled = false` is synonymous to `suspended`.
+
+Given this previous configuration :
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new S3Bucket(this, "example", {
+      bucket: "yournamehere",
+      versioning: {
+        enabled: false,
+      },
+    });
+  }
+}
+
+```
+
+You will get the following error after upgrading:
+
+```
+│ Error: Value for unconfigurable attribute
+│
+│   with aws_s3_bucket.example,
+│   on main.tf line 1, in resource "aws_s3_bucket" "example":
+│    1: resource "aws_s3_bucket" "example" {
+│
+│ Can't configure a value for "versioning": its value will be decided automatically based on the result of applying this configuration.
+```
+
+Since `versioning` is now read only, update your configuration to use the `awsS3BucketVersioning`
+resource and remove `versioning` and its nested arguments in the `awsS3Bucket` resource.
+
+* If migrating from Terraform AWS Provider `v3700` or later and bucket versioning was never enabled:
+
+  ```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketVersioningA } from "./.gen/providers/aws/s3-bucket-versioning";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new S3Bucket(this, "example", {
+      bucket: "yournamehere",
+    });
+    const awsS3BucketVersioningExample = new S3BucketVersioningA(
+      this,
+      "example_1",
+      {
+        bucket: example.id,
+        versioningConfiguration: {
+          status: "Disabled",
+        },
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketVersioningExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+* If migrating from Terraform AWS Provider `v3700` or later and bucket versioning was enabled at one point:
+
+  ```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketVersioningA } from "./.gen/providers/aws/s3-bucket-versioning";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new S3Bucket(this, "example", {
+      bucket: "yournamehere",
+    });
+    const awsS3BucketVersioningExample = new S3BucketVersioningA(
+      this,
+      "example_1",
+      {
+        bucket: example.id,
+        versioningConfiguration: {
+          status: "Suspended",
+        },
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketVersioningExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+* If migrating from an earlier version of Terraform AWS Provider:
+
+  ```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketVersioningA } from "./.gen/providers/aws/s3-bucket-versioning";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new S3Bucket(this, "example", {
+      bucket: "yournamehere",
+    });
+    const awsS3BucketVersioningExample = new S3BucketVersioningA(
+      this,
+      "example_1",
+      {
+        bucket: example.id,
+        versioningConfiguration: {
+          status: "Suspended",
+        },
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketVersioningExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+Run `terraform import` on each new resource, _e.g._,
+
+```console
+$ terraform import aws_s3_bucket_versioning.example yournamehere
+aws_s3_bucket_versioning.example: Importing from ID "yournamehere"...
+aws_s3_bucket_versioning.example: Import prepared!
+  Prepared aws_s3_bucket_versioning for import
+aws_s3_bucket_versioning.example: Refreshing state... [id=yournamehere]
+
+Import successful!
+
+The resources that were imported are shown above. These resources are now in
+your Terraform state and will henceforth be managed by Terraform.
+```
+
+#### Ensure Objects Depend on Versioning
+
+When you create an object whose `versionId` you need and an `awsS3BucketVersioning` resource in the same configuration, you are more likely to have success by ensuring the `s3Object` depends either implicitly (see below) or explicitly (i.e., using `depends_on = [aws_s3_bucket_versioning.example]`) on the `awsS3BucketVersioning` resource.
+
+~> **NOTE:** For critical and/or production S3 objects, do not create a bucket, enable versioning, and create an object in the bucket within the same configuration. Doing so will not allow the AWS-recommended 15 minutes between enabling versioning and writing to the bucket.
+
+This example shows the `awsS3ObjectExample` depending implicitly on the versioning resource through the reference to `awsS3BucketVersioningExampleBucket` to define `bucket`:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketVersioningA } from "./.gen/providers/aws/s3-bucket-versioning";
+import { S3Object } from "./.gen/providers/aws/s3-object";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new S3Bucket(this, "example", {
+      bucket: "yotto",
+    });
+    const awsS3BucketVersioningExample = new S3BucketVersioningA(
+      this,
+      "example_1",
+      {
+        bucket: example.id,
+        versioningConfiguration: {
+          status: "Enabled",
+        },
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketVersioningExample.overrideLogicalId("example");
+    const awsS3ObjectExample = new S3Object(this, "example_2", {
+      bucket: Token.asString(awsS3BucketVersioningExample.id),
+      key: "droeloe",
+      source: "example.txt",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3ObjectExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### `website`, `websiteDomain`, and `websiteEndpoint` Arguments
+
+Switch your Terraform configuration to the [`awsS3BucketWebsiteConfiguration` resource](/docs/providers/aws/r/s3_bucket_website_configuration.html) instead.
+
+For example, given this previous configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new S3Bucket(this, "example", {
+      bucket: "yournamehere",
+      website: {
+        errorDocument: "error.html",
+        indexDocument: "index.html",
+      },
+    });
+  }
+}
+
+```
+
+You will get the following error after upgrading:
+
+```
+│ Error: Value for unconfigurable attribute
+│
+│   with aws_s3_bucket.example,
+│   on main.tf line 1, in resource "aws_s3_bucket" "example":
+│    1: resource "aws_s3_bucket" "example" {
+│
+│ Can't configure a value for "website": its value will be decided automatically based on the result of applying this configuration.
+```
+
+Since `website` is now read only, update your configuration to use the `awsS3BucketWebsiteConfiguration`
+resource and remove `website` and its nested arguments in the `awsS3Bucket` resource:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketWebsiteConfiguration } from "./.gen/providers/aws/s3-bucket-website-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new S3Bucket(this, "example", {
+      bucket: "yournamehere",
+    });
+    const awsS3BucketWebsiteConfigurationExample =
+      new S3BucketWebsiteConfiguration(this, "example_1", {
+        bucket: example.id,
+        errorDocument: {
+          key: "error.html",
+        },
+        indexDocument: {
+          suffix: "index.html",
+        },
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketWebsiteConfigurationExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+Run `terraform import` on each new resource, _e.g._,
+
+```console
+$ terraform import aws_s3_bucket_website_configuration.example yournamehere
+aws_s3_bucket_website_configuration.example: Importing from ID "yournamehere"...
+aws_s3_bucket_website_configuration.example: Import prepared!
+  Prepared aws_s3_bucket_website_configuration for import
+aws_s3_bucket_website_configuration.example: Refreshing state... [id=yournamehere]
+
+Import successful!
+
+The resources that were imported are shown above. These resources are now in
+your Terraform state and will henceforth be managed by Terraform.
+```
+
+For example, if you use the `awsS3Bucket` attribute `websiteDomain` with `awsRoute53Record`, as shown below, you will need to update your configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Route53Record } from "./.gen/providers/aws/route53-record";
+import { Route53Zone } from "./.gen/providers/aws/route53-zone";
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const main = new Route53Zone(this, "main", {
+      name: "domain.test",
+    });
+    const website = new S3Bucket(this, "website", {
+      website: {
+        errorDocument: "error.html",
+        indexDocument: "index.html",
+      },
+    });
+    new Route53Record(this, "alias", {
+      alias: {
+        evaluateTargetHealth: true,
+        name: website.websiteDomain,
+        zoneId: website.hostedZoneId,
+      },
+      name: "www",
+      type: "A",
+      zoneId: main.zoneId,
+    });
+  }
+}
+
+```
+
+Instead, you will now use the `awsS3BucketWebsiteConfiguration` resource and its `websiteDomain` attribute:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Route53Record } from "./.gen/providers/aws/route53-record";
+import { Route53Zone } from "./.gen/providers/aws/route53-zone";
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketWebsiteConfiguration } from "./.gen/providers/aws/s3-bucket-website-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const main = new Route53Zone(this, "main", {
+      name: "domain.test",
+    });
+    const website = new S3Bucket(this, "website", {});
+    const example = new S3BucketWebsiteConfiguration(this, "example", {
+      bucket: website.id,
+      indexDocument: {
+        suffix: "index.html",
+      },
+    });
+    new Route53Record(this, "alias", {
+      alias: {
+        evaluateTargetHealth: true,
+        name: example.websiteDomain,
+        zoneId: website.hostedZoneId,
+      },
+      name: "www",
+      type: "A",
+      zoneId: main.zoneId,
+    });
+  }
+}
+
+```
+
+## Full Resource Lifecycle of Default Resources
+
+Default subnets and vpcs can now do full resource lifecycle operations such that resource
+creation and deletion are now supported.
+
+### Resource: aws_default_subnet
+
+The `awsDefaultSubnet` resource behaves differently from normal resources in that if a default subnet exists in the specified Availability Zone, Terraform does not _create_ this resource, but instead "adopts" it into management.
+If no default subnet exists, Terraform creates a new default subnet.
+By default, `terraform destroy` does not delete the default subnet but does remove the resource from Terraform state.
+Set the `forceDestroy` argument to `true` to delete the default subnet.
+
+For example, given this previous configuration with no existing default subnet:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DefaultSubnet } from "./.gen/providers/aws/default-subnet";
+import { AwsProvider } from "./.gen/providers/aws/provider";
+interface MyConfig {
+  availabilityZone: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new AwsProvider(this, "aws", {
+      region: "eu-west-2",
+    });
+    new DefaultSubnet(this, "default", {
+      availabilityZone: config.availabilityZone,
+    });
+  }
+}
+
+```
+
+The following error was thrown on `terraform apply`:
+
+```
+│ Error: Default subnet not found.
+│
+│   with aws_default_subnet.default,
+│   on main.tf line 5, in resource "aws_default_subnet" "default":
+│    5: resource "aws_default_subnet" "default" {}
+```
+
+Now after upgrading, the above configuration will apply successfully.
+
+To delete the default subnet, the above configuration should be updated as follows:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DefaultSubnet } from "./.gen/providers/aws/default-subnet";
+interface MyConfig {
+  availabilityZone: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new DefaultSubnet(this, "default", {
+      forceDestroy: true,
+      availabilityZone: config.availabilityZone,
+    });
+  }
+}
+
+```
+
+### Resource: aws_default_vpc
+
+The `awsDefaultVpc` resource behaves differently from normal resources in that if a default VPC exists, Terraform does not _create_ this resource, but instead "adopts" it into management.
+If no default VPC exists, Terraform creates a new default VPC, which leads to the implicit creation of [other resources](https://docs.aws.amazon.com/vpc/latest/userguide/default-vpc.html#default-vpc-components).
+By default, `terraform destroy` does not delete the default VPC but does remove the resource from Terraform state.
+Set the `forceDestroy` argument to `true` to delete the default VPC.
+
+For example, given this previous configuration with no existing default VPC:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DefaultVpc } from "./.gen/providers/aws/default-vpc";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DefaultVpc(this, "default", {});
+  }
+}
+
+```
+
+The following error was thrown on `terraform apply`:
+
+```
+│ Error: No default VPC found in this region.
+│
+│   with aws_default_vpc.default,
+│   on main.tf line 5, in resource "aws_default_vpc" "default":
+│    5: resource "aws_default_vpc" "default" {}
+```
+
+Now after upgrading, the above configuration will apply successfully.
+
+To delete the default VPC, the above configuration should be updated to:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DefaultVpc } from "./.gen/providers/aws/default-vpc";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DefaultVpc(this, "default", {
+      forceDestroy: true,
+    });
+  }
+}
+
+```
+
+## Plural Data Source Behavior
+
+The following plural data sources are now consistent with [Provider Design](https://hashicorp.github.io/terraform-provider-aws/provider-design/#plural-data-sources)
+such that they no longer return an error if zero results are found.
+
+* [aws_cognito_user_pools](/docs/providers/aws/d/cognito_user_pools.html)
+* [aws_db_event_categories](/docs/providers/aws/d/db_event_categories.html)
+* [aws_ebs_volumes](/docs/providers/aws/d/ebs_volumes.html)
+* [aws_ec2_coip_pools](/docs/providers/aws/d/ec2_coip_pools.html)
+* [aws_ec2_local_gateway_route_tables](/docs/providers/aws/d/ec2_local_gateway_route_tables.html)
+* [aws_ec2_local_gateway_virtual_interface_groups](/docs/providers/aws/d/ec2_local_gateway_virtual_interface_groups.html)
+* [aws_ec2_local_gateways](/docs/providers/aws/d/ec2_local_gateways.html)
+* [aws_ec2_transit_gateway_route_tables](/docs/providers/aws/d/ec2_transit_gateway_route_tables.html)
+* [aws_efs_access_points](/docs/providers/aws/d/efs_access_points.html)
+* [aws_emr_release_labels](/docs/providers/aws/d/emr_release_labels.html)
+* [aws_inspector_rules_packages](/docs/providers/aws/d/inspector_rules_packages.html)
+* [aws_ip_ranges](/docs/providers/aws/d/ip_ranges.html)
+* [aws_network_acls](/docs/providers/aws/d/network_acls.html)
+* [aws_route_tables](/docs/providers/aws/d/route_tables.html)
+* [aws_security_groups](/docs/providers/aws/d/security_groups.html)
+* [aws_ssoadmin_instances](/docs/providers/aws/d/ssoadmin_instances.html)
+* [aws_vpcs](/docs/providers/aws/d/vpcs.html)
+* [aws_vpc_peering_connections](/docs/providers/aws/d/vpc_peering_connections.html)
+
+## Empty Strings Not Valid For Certain Resources
+
+First, this is a breaking change but should affect very few configurations.
+
+Second, the motivation behind this change is that previously, you might set an argument to `""` to explicitly convey it is empty. However, with the introduction of `null` in Terraform 0.12 and to prepare for continuing enhancements that distinguish between unset arguments and those that have a value, including an empty string (`""`), we are moving away from this use of zero values. We ask practitioners to either use `null` instead or remove the arguments that are set to `""`.
+
+### Resource: aws_cloudwatch_event_target (Empty String)
+
+Previously, you could set `ecsTarget0LaunchType` to `""`. However, the value `""` is no longer valid. Now, set the argument to `null` (_e.g._, `launch_type = null`) or remove the empty-string configuration.
+
+For example, this type of configuration is now not valid:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudwatchEventTarget } from "./.gen/providers/aws/cloudwatch-event-target";
+interface MyConfig {
+  arn: any;
+  rule: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new CloudwatchEventTarget(this, "example", {
+      ecsTarget: {
+        launchType: "",
+        taskCount: 1,
+        taskDefinitionArn: task.arn,
+      },
+      arn: config.arn,
+      rule: config.rule,
+    });
+  }
+}
+
+```
+
+We fix this configuration by setting `launchType` to `null`:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudwatchEventTarget } from "./.gen/providers/aws/cloudwatch-event-target";
+interface MyConfig {
+  arn: any;
+  rule: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new CloudwatchEventTarget(this, "example", {
+      ecsTarget: {
+        launchType: [null],
+        taskCount: 1,
+        taskDefinitionArn: task.arn,
+      },
+      arn: config.arn,
+      rule: config.rule,
+    });
+  }
+}
+
+```
+
+### Resource: aws_customer_gateway
+
+Previously, you could set `ipAddress` to `""`, which would result in an AWS error. However, the provider now also gives an error.
+
+### Resource: aws_default_network_acl
+
+Previously, you could set `egress.*CidrBlock`, `egress.*Ipv6CidrBlock`, `ingress.*CidrBlock`, or `ingress.*Ipv6CidrBlock` to `""`. However, the value `""` is no longer valid. Now, set the argument to `null` (_e.g._, `ipv6_cidr_block = null`) or remove the empty-string configuration.
+
+For example, this type of configuration is now not valid:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DefaultNetworkAcl } from "./.gen/providers/aws/default-network-acl";
+interface MyConfig {
+  action: any;
+  fromPort: any;
+  protocol: any;
+  ruleNo: any;
+  toPort: any;
+  defaultNetworkAclId: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new DefaultNetworkAcl(this, "example", {
+      egress: [
+        {
+          cidrBlock: "0.0.0.0/0",
+          ipv6CidrBlock: "",
+          action: config.action,
+          fromPort: config.fromPort,
+          protocol: config.protocol,
+          ruleNo: config.ruleNo,
+          toPort: config.toPort,
+        },
+      ],
+      defaultNetworkAclId: config.defaultNetworkAclId,
+    });
+  }
+}
+
+```
+
+To fix this configuration, we remove the empty-string configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DefaultNetworkAcl } from "./.gen/providers/aws/default-network-acl";
+interface MyConfig {
+  action: any;
+  fromPort: any;
+  protocol: any;
+  ruleNo: any;
+  toPort: any;
+  defaultNetworkAclId: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new DefaultNetworkAcl(this, "example", {
+      egress: [
+        {
+          cidrBlock: "0.0.0.0/0",
+          action: config.action,
+          fromPort: config.fromPort,
+          protocol: config.protocol,
+          ruleNo: config.ruleNo,
+          toPort: config.toPort,
+        },
+      ],
+      defaultNetworkAclId: config.defaultNetworkAclId,
+    });
+  }
+}
+
+```
+
+### Resource: aws_default_route_table
+
+Previously, you could set `route.*CidrBlock` or `route.*Ipv6CidrBlock` to `""`. However, the value `""` is no longer valid. Now, set the argument to `null` (_e.g._, `ipv6_cidr_block = null`) or remove the empty-string configuration.
+
+For example, this type of configuration is now not valid:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { conditional, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DefaultRouteTable } from "./.gen/providers/aws/default-route-table";
+interface MyConfig {
+  defaultRouteTableId: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new DefaultRouteTable(this, "example", {
+      route: [
+        {
+          cidrBlock: Token.asString(conditional(ipv6, "", destination)),
+          ipv6CidrBlock: Token.asString(conditional(ipv6, destinationIpv6, "")),
+        },
+      ],
+      defaultRouteTableId: config.defaultRouteTableId,
+    });
+  }
+}
+
+```
+
+We fix this configuration by using `null` instead of an empty string (`""`):
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { conditional, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DefaultRouteTable } from "./.gen/providers/aws/default-route-table";
+interface MyConfig {
+  defaultRouteTableId: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new DefaultRouteTable(this, "example", {
+      route: [
+        {
+          cidrBlock: Token.asString(conditional(ipv6, "null", destination)),
+          ipv6CidrBlock: Token.asString(
+            conditional(ipv6, destinationIpv6, "null")
+          ),
+        },
+      ],
+      defaultRouteTableId: config.defaultRouteTableId,
+    });
+  }
+}
+
+```
+
+### Resource: aws_default_vpc (Empty String)
+
+Previously, you could set `ipv6CidrBlock` to `""`. However, the value `""` is no longer valid. Now, set the argument to `null` (_e.g._, `ipv6_cidr_block = null`) or remove the empty-string configuration.
+
+### Resource: aws_instance
+
+Previously, you could set `privateIp` to `""`. However, the value `""` is no longer valid. Now, set the argument to `null` (_e.g._, `private_ip = null`) or remove the empty-string configuration.
+
+For example, this type of configuration is now not valid:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Instance } from "./.gen/providers/aws/instance";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Instance(this, "example", {
+      instanceType: "t2.micro",
+      privateIp: "",
+    });
+  }
+}
+
+```
+
+We fix this configuration by removing the empty-string configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Instance } from "./.gen/providers/aws/instance";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Instance(this, "example", {
+      instanceType: "t2.micro",
+    });
+  }
+}
+
+```
+
+### Resource: aws_efs_mount_target
+
+Previously, you could set `ipAddress` to `""`. However, the value `""` is no longer valid. Now, set the argument to `null` (_e.g._, `ip_address = null`) or remove the empty-string configuration.
+
+For example, this type of configuration is now not valid: `ip_address = ""`.
+
+### Resource: aws_elasticsearch_domain
+
+Previously, you could set `ebsOptions0VolumeType` to `""`. However, the value `""` is no longer valid. Now, set the argument to `null` (_e.g._, `volume_type = null`) or remove the empty-string configuration.
+
+For example, this type of configuration is now not valid:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Op, conditional, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ElasticsearchDomain } from "./.gen/providers/aws/elasticsearch-domain";
+interface MyConfig {
+  domainName: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new ElasticsearchDomain(this, "example", {
+      ebsOptions: {
+        ebsEnabled: true,
+        volumeSize: volumeSize.numberValue,
+        volumeType: Token.asString(
+          conditional(Op.gt(volumeSize.value, 0), volumeType, "")
+        ),
+      },
+      domainName: config.domainName,
+    });
+  }
+}
+
+```
+
+We fix this configuration by using `null` instead of `""`:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Op, conditional, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ElasticsearchDomain } from "./.gen/providers/aws/elasticsearch-domain";
+interface MyConfig {
+  domainName: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new ElasticsearchDomain(this, "example", {
+      ebsOptions: {
+        ebsEnabled: true,
+        volumeSize: volumeSize.numberValue,
+        volumeType: Token.asString(
+          conditional(Op.gt(volumeSize.value, 0), volumeType, "null")
+        ),
+      },
+      domainName: config.domainName,
+    });
+  }
+}
+
+```
+
+### Resource: aws_network_acl
+
+Previously, `egress.*CidrBlock`, `egress.*Ipv6CidrBlock`, `ingress.*CidrBlock`, and `ingress.*Ipv6CidrBlock` could be set to `""`. However, the value `""` is no longer valid. Now, set the argument to `null` (_e.g._, `ipv6_cidr_block = null`) or remove the empty-string configuration.
+
+For example, this type of configuration is now not valid:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { NetworkAcl } from "./.gen/providers/aws/network-acl";
+interface MyConfig {
+  vpcId: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new NetworkAcl(this, "example", {
+      egress: [
+        {
+          cidrBlock: "0.0.0.0/0",
+          ipv6CidrBlock: "",
+        },
+      ],
+      vpcId: config.vpcId,
+    });
+  }
+}
+
+```
+
+We fix this configuration by removing the empty-string configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { NetworkAcl } from "./.gen/providers/aws/network-acl";
+interface MyConfig {
+  vpcId: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new NetworkAcl(this, "example", {
+      egress: [
+        {
+          cidrBlock: "0.0.0.0/0",
+        },
+      ],
+      vpcId: config.vpcId,
+    });
+  }
+}
+
+```
+
+### Resource: aws_route
+
+Previously, `destinationCidrBlock` and `destinationIpv6CidrBlock` could be set to `""`. However, the value `""` is no longer valid. Now, set the argument to `null` (_e.g._, `destination_ipv6_cidr_block = null`) or remove the empty-string configuration.
+
+In addition, now exactly one of `destinationCidrBlock`, `destinationIpv6CidrBlock`, and `destinationPrefixListId` can be set.
+
+For example, this type of configuration for `awsRoute` is now not valid:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { conditional, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Route } from "./.gen/providers/aws/route";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Route(this, "example", {
+      destinationCidrBlock: Token.asString(conditional(ipv6, "", destination)),
+      destinationIpv6CidrBlock: Token.asString(
+        conditional(ipv6, destinationIpv6, "")
+      ),
+      gatewayId: Token.asString(awsInternetGatewayExample.id),
+      routeTableId: Token.asString(awsRouteTableExample.id),
+    });
+  }
+}
+
+```
+
+We fix this configuration by using `null` instead of an empty-string (`""`):
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { conditional, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Route } from "./.gen/providers/aws/route";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Route(this, "example", {
+      destinationCidrBlock: Token.asString(
+        conditional(ipv6, "null", destination)
+      ),
+      destinationIpv6CidrBlock: Token.asString(
+        conditional(ipv6, destinationIpv6, "null")
+      ),
+      gatewayId: Token.asString(awsInternetGatewayExample.id),
+      routeTableId: Token.asString(awsRouteTableExample.id),
+    });
+  }
+}
+
+```
+
+### Resource: aws_route_table
+
+Previously, `route.*CidrBlock` and `route.*Ipv6CidrBlock` could be set to `""`. However, the value `""` is no longer valid. Now, set the argument to `null` (_e.g._, `ipv6_cidr_block = null`) or remove the empty-string configuration.
+
+For example, this type of configuration is now not valid:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { conditional, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { RouteTable } from "./.gen/providers/aws/route-table";
+interface MyConfig {
+  vpcId: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new RouteTable(this, "example", {
+      route: [
+        {
+          cidrBlock: Token.asString(conditional(ipv6, "", destination)),
+          ipv6CidrBlock: Token.asString(conditional(ipv6, destinationIpv6, "")),
+        },
+      ],
+      vpcId: config.vpcId,
+    });
+  }
+}
+
+```
+
+We fix this configuration by usingd `null` instead of an empty-string (`""`):
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { conditional, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { RouteTable } from "./.gen/providers/aws/route-table";
+interface MyConfig {
+  vpcId: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new RouteTable(this, "example", {
+      route: [
+        {
+          cidrBlock: Token.asString(conditional(ipv6, "null", destination)),
+          ipv6CidrBlock: Token.asString(
+            conditional(ipv6, destinationIpv6, "null")
+          ),
+        },
+      ],
+      vpcId: config.vpcId,
+    });
+  }
+}
+
+```
+
+### Resource: aws_vpc
+
+Previously, `ipv6CidrBlock` could be set to `""`. However, the value `""` is no longer valid. Now, set the argument to `null` (_e.g._, `ipv6_cidr_block = null`) or remove the empty-string configuration.
+
+For example, this type of configuration is now not valid:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Vpc } from "./.gen/providers/aws/vpc";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Vpc(this, "example", {
+      cidrBlock: "10.1.0.0/16",
+      ipv6CidrBlock: "",
+    });
+  }
+}
+
+```
+
+We fix this configuration by removing `ipv6CidrBlock`:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Vpc } from "./.gen/providers/aws/vpc";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Vpc(this, "example", {
+      cidrBlock: "10.1.0.0/16",
+    });
+  }
+}
+
+```
+
+### Resource: aws_vpc_ipv6_cidr_block_association
+
+Previously, `ipv6CidrBlock` could be set to `""`. However, the value `""` is no longer valid. Now, set the argument to `null` (_e.g._, `ipv6_cidr_block = null`) or remove the empty-string configuration.
+
+## Data Source: aws_cloudwatch_log_group
+
+### Removal of arn Wildcard Suffix
+
+Previously, the data source returned the ARN directly from the API, which included a `:*` suffix to denote all CloudWatch Log Streams under the CloudWatch Log Group. Most other AWS resources that return ARNs and many other AWS services do not use the `:*` suffix. The suffix is now automatically removed. For example, the data source previously returned an ARN such as `arn:aws:logs:usEast1:123456789012:logGroup:/example:*` but will now return `arn:aws:logs:usEast1:123456789012:logGroup:/example`.
+
+Workarounds, such as using `replace()` as shown below, should be removed:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCloudwatchLogGroup } from "./.gen/providers/aws/data-aws-cloudwatch-log-group";
+import { DatasyncTask } from "./.gen/providers/aws/datasync-task";
+interface MyConfig {
+  destinationLocationArn: any;
+  sourceLocationArn: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    const example = new DataAwsCloudwatchLogGroup(this, "example", {
+      name: "example",
+    });
+    const awsDatasyncTaskExample = new DatasyncTask(this, "example_1", {
+      cloudwatchLogGroupArn: Token.asString(
+        Fn.replace(Token.asString(example.arn), ":*", "")
+      ),
+      destinationLocationArn: config.destinationLocationArn,
+      sourceLocationArn: config.sourceLocationArn,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsDatasyncTaskExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+Removing the `:*` suffix is a breaking change for some configurations. Fix these configurations using string interpolations as demonstrated below. For example, this configuration is now broken:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsIamPolicyDocument(this, "ad-log-policy", {
+      statement: [
+        {
+          actions: ["logs:CreateLogStream", "logs:PutLogEvents"],
+          effect: "Allow",
+          principals: [
+            {
+              identifiers: ["ds.amazonaws.com"],
+              type: "Service",
+            },
+          ],
+          resources: [Token.asString(example.arn)],
+        },
+      ],
+    });
+  }
+}
+
+```
+
+An updated configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataAwsIamPolicyDocument(this, "ad-log-policy", {
+      statement: [
+        {
+          actions: ["logs:CreateLogStream", "logs:PutLogEvents"],
+          effect: "Allow",
+          principals: [
+            {
+              identifiers: ["ds.amazonaws.com"],
+              type: "Service",
+            },
+          ],
+          resources: ["${" + example.arn + "}:*"],
+        },
+      ],
+    });
+  }
+}
+
+```
+
+## Data Source: aws_subnet_ids
+
+The `awsSubnetIds` data source has been deprecated and will be removed in a future version. Use the `awsSubnets` data source instead.
+
+For example, change a configuration such as
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import {
+  Token,
+  TerraformIterator,
+  TerraformOutput,
+  TerraformStack,
+} from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsSubnetIds } from "./.gen/providers/aws/";
+import { DataAwsSubnet } from "./.gen/providers/aws/data-aws-subnet";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new DataAwsSubnetIds(this, "example", {
+      vpc_id: vpcId.value,
+    });
+    /*In most cases loops should be handled in the programming language context and 
+    not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+    you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+    you need to keep this like it is.*/
+    const exampleForEachIterator = TerraformIterator.fromList(
+      Token.asAny(example.ids)
+    );
+    const dataAwsSubnetExample = new DataAwsSubnet(this, "example_1", {
+      id: Token.asString(exampleForEachIterator.value),
+      forEach: exampleForEachIterator,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsSubnetExample.overrideLogicalId("example");
+    new TerraformOutput(this, "subnet_cidr_blocks", {
+      value:
+        "${[ for s in ${" + dataAwsSubnetExample.fqn + "} : s.cidr_block]}",
+    });
+  }
+}
+
+```
+
+to
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import {
+  Token,
+  TerraformIterator,
+  TerraformOutput,
+  TerraformStack,
+} from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsSubnet } from "./.gen/providers/aws/data-aws-subnet";
+import { DataAwsSubnets } from "./.gen/providers/aws/data-aws-subnets";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new DataAwsSubnets(this, "example", {
+      filter: [
+        {
+          name: "vpc-id",
+          values: [vpcId.stringValue],
+        },
+      ],
+    });
+    /*In most cases loops should be handled in the programming language context and 
+    not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+    you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+    you need to keep this like it is.*/
+    const exampleForEachIterator = TerraformIterator.fromList(
+      Token.asAny(example.ids)
+    );
+    const dataAwsSubnetExample = new DataAwsSubnet(this, "example_1", {
+      id: Token.asString(exampleForEachIterator.value),
+      forEach: exampleForEachIterator,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsSubnetExample.overrideLogicalId("example");
+    new TerraformOutput(this, "subnet_cidr_blocks", {
+      value:
+        "${[ for s in ${" + dataAwsSubnetExample.fqn + "} : s.cidr_block]}",
+    });
+  }
+}
+
+```
+
+## Data Source: aws_s3_bucket_object
+
+Version 4.x deprecates the `awsS3BucketObject` data source. Maintainers will remove it in a future version. Use `awsS3Object` instead, where new features and fixes will be added.
+
+## Data Source: aws_s3_bucket_objects
+
+Version 4.x deprecates the `awsS3BucketObjects` data source. Maintainers will remove it in a future version. Use `awsS3Objects` instead, where new features and fixes will be added.
+
+## Resource: aws_batch_compute_environment
+
+You can no longer specify `computeResources` when `type` is `unmanaged`.
+
+Previously, you could apply this configuration and the provider would ignore any compute resources:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { BatchComputeEnvironment } from "./.gen/providers/aws/batch-compute-environment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new BatchComputeEnvironment(this, "test", {
+      computeEnvironmentName: "test",
+      computeResources: {
+        instanceRole: ecsInstance.arn,
+        instanceType: ["c4.large"],
+        maxVcpus: 16,
+        minVcpus: 0,
+        securityGroupIds: [Token.asString(awsSecurityGroupTest.id)],
+        subnets: [Token.asString(awsSubnetTest.id)],
+        type: "EC2",
+      },
+      serviceRole: batchService.arn,
+      type: "UNMANAGED",
+    });
+  }
+}
+
+```
+
+Now, this configuration is invalid and will result in an error during plan.
+
+To resolve this error, simply remove or comment out the `computeResources` configuration block.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { BatchComputeEnvironment } from "./.gen/providers/aws/batch-compute-environment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new BatchComputeEnvironment(this, "test", {
+      computeEnvironmentName: "test",
+      serviceRole: batchService.arn,
+      type: "UNMANAGED",
+    });
+  }
+}
+
+```
+
+## Resource: aws_cloudwatch_event_target
+
+### Removal of `ecsTarget` `launchType` default value
+
+Previously, the provider assigned `ecsTarget` `launchType` the default value of `ec2` if you did not configure a value. However, the provider no longer assigns a default value.
+
+For example, previously you could workaround the default value by using an empty string (`""`), as shown:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudwatchEventTarget } from "./.gen/providers/aws/cloudwatch-event-target";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new CloudwatchEventTarget(this, "test", {
+      arn: Token.asString(awsEcsClusterTest.id),
+      ecsTarget: {
+        launchType: "",
+        networkConfiguration: {
+          subnets: [subnet.id],
+        },
+        taskCount: 1,
+        taskDefinitionArn: task.arn,
+      },
+      roleArn: Token.asString(awsIamRoleTest.arn),
+      rule: Token.asString(awsCloudwatchEventRuleTest.id),
+    });
+  }
+}
+
+```
+
+This is no longer necessary. We fix the configuration by removing the empty string assignment:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudwatchEventTarget } from "./.gen/providers/aws/cloudwatch-event-target";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new CloudwatchEventTarget(this, "test", {
+      arn: Token.asString(awsEcsClusterTest.id),
+      ecsTarget: {
+        networkConfiguration: {
+          subnets: [subnet.id],
+        },
+        taskCount: 1,
+        taskDefinitionArn: task.arn,
+      },
+      roleArn: Token.asString(awsIamRoleTest.arn),
+      rule: Token.asString(awsCloudwatchEventRuleTest.id),
+    });
+  }
+}
+
+```
+
+## Resource: aws_elasticache_cluster
+
+### Error raised if neither `engine` nor `replicationGroupId` is specified
+
+Previously, when you did not specify either `engine` or `replicationGroupId`, Terraform would not prevent you from applying the invalid configuration.
+Now, this will produce an error similar to the one below:
+
+```
+Error: Invalid combination of arguments
+
+          with aws_elasticache_cluster.example,
+          on terraform_plugin_test.tf line 2, in resource "aws_elasticache_cluster" "example":
+           2: resource "aws_elasticache_cluster" "example" {
+
+        "replication_group_id": one of `engine,replication_group_id` must be
+        specified
+
+        Error: Invalid combination of arguments
+
+          with aws_elasticache_cluster.example,
+          on terraform_plugin_test.tf line 2, in resource "aws_elasticache_cluster" "example":
+           2: resource "aws_elasticache_cluster" "example" {
+
+        "engine": one of `engine,replication_group_id` must be specified
+```
+
+Update your configuration to supply one of `engine` or `replicationGroupId`.
+
+## Resource: aws_elasticache_global_replication_group
+
+### actual_engine_version Attribute removal
+
+Switch your Terraform configuration from using `actualEngineVersion` to use the `engineVersionActual` attribute instead.
+
+For example, given this previous configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformOutput, TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new TerraformOutput(
+      this,
+      "elasticache_global_replication_group_version_result",
+      {
+        value: example.actualEngineVersion,
+      }
+    );
+  }
+}
+
+```
+
+An updated configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformOutput, TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new TerraformOutput(
+      this,
+      "elasticache_global_replication_group_version_result",
+      {
+        value: example.engineVersionActual,
+      }
+    );
+  }
+}
+
+```
+
+## Resource: aws_fsx_ontap_storage_virtual_machine
+
+We removed the misspelled argument `activeDirectoryConfiguration0SelfManagedActiveDirectoryConfiguration0OrganizationalUnitDistinguidshedName` that we previously deprecated. Use `activeDirectoryConfiguration0SelfManagedActiveDirectoryConfiguration0OrganizationalUnitDistinguishedName` now instead. Terraform will automatically migrate the state to `activeDirectoryConfiguration0SelfManagedActiveDirectoryConfiguration0OrganizationalUnitDistinguishedName` during planning.
+
+## Resource: aws_lb_target_group
+
+For `protocol = "TCP"`, you can no longer set `stickinessType` to `lbCookie` even when `enabled = false`. Instead, either change the `protocol` to `"http"` or `"https"`, or change `stickinessType` to `"sourceIp"`.
+
+For example, this configuration is no longer valid:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LbTargetGroup } from "./.gen/providers/aws/lb-target-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new LbTargetGroup(this, "test", {
+      port: 25,
+      protocol: "TCP",
+      stickiness: {
+        enabled: false,
+        type: "lb_cookie",
+      },
+      vpcId: Token.asString(awsVpcTest.id),
+    });
+  }
+}
+
+```
+
+To fix this, we change the `stickinessType` to `"sourceIp"`.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LbTargetGroup } from "./.gen/providers/aws/lb-target-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new LbTargetGroup(this, "test", {
+      port: 25,
+      protocol: "TCP",
+      stickiness: {
+        enabled: false,
+        type: "source_ip",
+      },
+      vpcId: Token.asString(awsVpcTest.id),
+    });
+  }
+}
+
+```
+
+## Resource: aws_s3_bucket_object
+
+Version 4.x deprecates the `awsS3BucketObject` and maintainers will remove it in a future version. Use `awsS3Object` instead, where new features and fixes will be added.
+
+When replacing `awsS3BucketObject` with `awsS3Object` in your configuration, on the next apply, Terraform will recreate the object. If you prefer to not have Terraform recreate the object, import the object using `awsS3Object`.
+
+For example, the following will import an S3 object into state, assuming the configuration exists, as `awsS3ObjectExample`:
+
+```console
+% terraform import aws_s3_object.example s3://some-bucket-name/some/key.txt
+```
+
+~> **CAUTION:** We do not recommend modifying the state file manually. If you do, you can make it unusable. However, if you accept that risk, some community members have upgraded to the new resource by searching and replacing `"type": "aws_s3_bucket_object",` with `"type": "aws_s3_object",` in the state file, and then running `terraform apply -refresh-only`.
+
+## EC2-Classic Resource and Data Source Support
+
+While an upgrade to this major version will not directly impact EC2-Classic resources configured with Terraform,
+it is important to keep in the mind the following AWS Provider resources will eventually no longer
+be compatible with EC2-Classic as AWS completes their EC2-Classic networking retirement (expected around August 15, 2022).
+
+* Running or stopped [EC2 instances](/docs/providers/aws/r/instance.html)
+* Running or stopped [RDS database instances](/docs/providers/aws/r/db_instance.html)
+* [Elastic IP addresses](/docs/providers/aws/r/eip.html)
+* [Classic Load Balancers](/docs/providers/aws/r/lb.html)
+* [Redshift clusters](/docs/providers/aws/r/redshift_cluster.html)
+* [Elastic Beanstalk environments](/docs/providers/aws/r/elastic_beanstalk_environment.html)
+* [EMR clusters](/docs/providers/aws/r/emr_cluster.html)
+* [AWS Data Pipelines pipelines](/docs/providers/aws/r/datapipeline_pipeline.html)
+* [ElastiCache clusters](/docs/providers/aws/r/elasticache_cluster.html)
+* [Spot Requests](/docs/providers/aws/r/spot_instance_request.html)
+* [Capacity Reservations](/docs/providers/aws/r/ec2_capacity_reservation.html)
+
+## Macie Classic Resource Support
+
+These resources should be considered deprecated and will be removed in version 5.0.0.
+
+* Macie Member Account Association
+* Macie S3 Bucket Association
+
+<!-- cache-key: cdktf-0.18.0 input-3ef88020b37e35d78babc46d26306cbef9b0d542745d0afa1cec66e81ef43304 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/guides/version-5-upgrade.html.markdown b/website/docs/cdktf/typescript/guides/version-5-upgrade.html.markdown
new file mode 100644
index 00000000000..1101b15c4a6
--- /dev/null
+++ b/website/docs/cdktf/typescript/guides/version-5-upgrade.html.markdown
@@ -0,0 +1,818 @@
+---
+subcategory: ""
+layout: "aws"
+page_title: "Terraform AWS Provider Version 5 Upgrade Guide"
+description: |-
+  Terraform AWS Provider Version 5 Upgrade Guide
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Terraform AWS Provider Version 5 Upgrade Guide
+
+Version 5.0.0 of the AWS provider for Terraform is a major release and includes changes that you need to consider when upgrading. This guide will help with that process and focuses only on changes from version 4.x to version 5.0.0. See the [Version 4 Upgrade Guide](/docs/providers/aws/guides/version-4-upgrade.html) for information on upgrading from 3.x to version 4.0.0.
+
+Upgrade topics:
+
+<!-- TOC depthFrom:2 depthTo:2 -->
+
+- [Provider Version Configuration](#provider-version-configuration)
+- [Provider Arguments](#provider-arguments)
+- [Default Tags](#default-tags)
+- [EC2-Classic Retirement](#ec2-classic-retirement)
+- [Macie Classic Retirement](#macie-classic-retirement)
+- [resource/aws_acmpca_certificate_authority](#resourceaws_acmpca_certificate_authority)
+- [resource/aws_api_gateway_rest_api](#resourceaws_api_gateway_rest_api)
+- [resource/aws_autoscaling_attachment](#resourceaws_autoscaling_attachment)
+- [resource/aws_autoscaling_group](#resourceaws_autoscaling_group)
+- [resource/aws_budgets_budget](#resourceaws_budgets_budget)
+- [resource/aws_ce_anomaly_subscription](#resourceaws_ce_anomaly_subscription)
+- [resource/aws_cloudwatch_event_target](#resourceaws_cloudwatch_event_target)
+- [resource/aws_codebuild_project](#resourceaws_codebuild_project)
+- [resource/aws_connect_hours_of_operation](#resourceaws_connect_hours_of_operation)
+- [resource/aws_connect_queue](#resourceaws_connect_queue)
+- [resource/aws_connect_routing_profile](#resourceaws_connect_routing_profile)
+- [resource/aws_db_event_subscription](#resourceaws_db_event_subscription)
+- [resource/aws_db_instance_role_association](#resourceaws_db_instance_role_association)
+- [resource/aws_db_instance](#resourceaws_db_instance)
+- [resource/aws_db_proxy_target](#resourceaws_db_proxy_target)
+- [resource/aws_db_security_group](#resourceaws_db_security_group)
+- [resource/aws_db_snapshot](#resourceaws_db_snapshot)
+- [resource/aws_default_vpc](#resourceaws_default_vpc)
+- [resource/aws_dms_endpoint](#resourceaws_dms_endpoint)
+- [resource/aws_docdb_cluster](#resourceaws_docdb_cluster)
+- [resource/aws_dx_gateway_association](#resourceaws_dx_gateway_association)
+- [resource/aws_ec2_client_vpn_endpoint](#resourceaws_ec2_client_vpn_endpoint)
+- [resource/aws_ec2_client_vpn_network_association](#resourceaws_ec2_client_vpn_network_association)
+- [resource/aws_ecs_cluster](#resourceaws_ecs_cluster)
+- [resource/aws_eip](#resourceaws_eip)
+- [resource/aws_eip_association](#resourceaws_eip_association)
+- [resource/aws_eks_addon](#resourceaws_eks_addon)
+- [resource/aws_elasticache_cluster](#resourceaws_elasticache_cluster)
+- [resource/aws_elasticache_replication_group](#resourceaws_elasticache_replication_group)
+- [resource/aws_elasticache_security_group](#resourceaws_elasticache_security_group)
+- [resource/aws_flow_log](#resourceaws_flow_log)
+- [resource/aws_guardduty_organization_configuration](#resourceaws_guardduty_organization_configuration)
+- [resource/aws_kinesis_firehose_delivery_stream](#resourceaws_kinesis_firehose_delivery_stream)
+- [resource/aws_launch_configuration](#resourceaws_launch_configuration)
+- [resource/aws_launch_template](#resourceaws_launch_template)
+- [resource/aws_lightsail_instance](#resourceaws_lightsail_instance)
+- [resource/aws_macie_member_account_association](#resourceaws_macie_member_account_association)
+- [resource/aws_macie_s3_bucket_association](#resourceaws_macie_s3_bucket_association)
+- [resource/aws_medialive_multiplex_program](#resourceaws_medialive_multiplex_program)
+- [resource/aws_msk_cluster](#resourceaws_msk_cluster)
+- [resource/aws_neptune_cluster](#resourceaws_neptune_cluster)
+- [resource/aws_networkmanager_core_network](#resourceaws_networkmanager_core_network)
+- [resource/aws_opensearch_domain](#resourceaws_opensearch_domain)
+- [resource/aws_rds_cluster](#resourceaws_rds_cluster)
+- [resource/aws_rds_cluster_instance](#resourceaws_rds_cluster_instance)
+- [resource/aws_redshift_cluster](#resourceaws_redshift_cluster)
+- [resource/aws_redshift_security_group](#resourceaws_redshift_security_group)
+- [resource/aws_route](#resourceaws_route)
+- [resource/aws_route_table](#resourceaws_route_table)
+- [resource/aws_s3_object](#resourceaws_s3_object)
+- [resource/aws_s3_object_copy](#resourceaws_s3_object_copy)
+- [resource/aws_secretsmanager_secret](#resourceaws_secretsmanager_secret)
+- [resource/aws_security_group](#resourceaws_security_group)
+- [resource/aws_security_group_rule](#resourceaws_security_group_rule)
+- [resource/aws_servicecatalog_product](#resourceaws_servicecatalog_product)
+- [resource/aws_ssm_association](#resourceaws_ssm_association)
+- [resource/aws_ssm_parameter](#resourceaws_ssm_parameter)
+- [resource/aws_vpc](#resourceaws_vpc)
+- [resource/aws_vpc_peering_connection](#resourceaws_vpc_peering_connection)
+- [resource/aws_vpc_peering_connection_accepter](#resourceaws_vpc_peering_connection_accepter)
+- [resource/aws_vpc_peering_connection_options](#resourceaws_vpc_peering_connection_options)
+- [resource/aws_wafv2_web_acl](#resourceaws_wafv2_web_acl)
+- [resource/aws_wafv2_web_acl_logging_configuration](#resourceaws_wafv2_web_acl_logging_configuration)
+- [data-source/aws_api_gateway_rest_api](#data-sourceaws_api_gateway_rest_api)
+- [data-source/aws_connect_hours_of_operation](#data-sourceaws_connect_hours_of_operation)
+- [data-source/aws_db_instance](#data-sourceaws_db_instance)
+- [data-source/aws_elasticache_cluster](#data-sourceaws_elasticache_cluster)
+- [data-source/aws_elasticache_replication_group](#data-sourceaws_elasticache_replication_group)
+- [data-source/aws_iam_policy_document](#data-sourceaws_iam_policy_document)
+- [data-source/aws_identitystore_group](#data-sourceaws_identitystore_group)
+- [data-source/aws_identitystore_user](#data-sourceaws_identitystore_user)
+- [data-source/aws_launch_configuration](#data-sourceaws_launch_configuration)
+- [data-source/aws_opensearch_domain](#data-sourceaws_opensearch_domain)
+- [data-source/aws_quicksight_data_set](#data-sourceaws_quicksight_data_set)
+- [data-source/aws_redshift_cluster](#data-sourceaws_redshift_cluster)
+- [data-source/aws_redshift_service_account](#data-sourceaws_redshift_service_account)
+- [data-source/aws_secretsmanager_secret](#data-sourceaws_secretsmanager_secret)
+- [data-source/aws_service_discovery_service](#data-sourceaws_service_discovery_service)
+- [data-source/aws_subnet_ids](#data-sourceaws_subnet_ids)
+- [data-source/aws_vpc_peering_connection](#data-sourceaws_vpc_peering_connection)
+
+<!-- /TOC -->
+
+## Provider Version Configuration
+
+-> Before upgrading to version 5.0.0, upgrade to the most recent 4.X version of the provider and ensure that your environment successfully runs [`terraform plan`](https://www.terraform.io/docs/commands/plan.html). You should not see changes you don't expect or deprecation notices.
+
+Use [version constraints when configuring Terraform providers](https://www.terraform.io/docs/configuration/providers.html#provider-versions). If you are following that recommendation, update the version constraints in your Terraform configuration and run [`terraform init -upgrade`](https://www.terraform.io/docs/commands/init.html) to download the new version.
+
+For example, given this previous configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AwsProvider } from "./.gen/providers/aws/provider";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AwsProvider(this, "aws", {});
+  }
+}
+
+```
+
+Update to the latest 5.X version:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AwsProvider } from "./.gen/providers/aws/provider";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AwsProvider(this, "aws", {});
+  }
+}
+
+```
+
+## Provider Arguments
+
+Version 5.0.0 removes these `provider` arguments:
+
+* `assumeRoleDurationSeconds` - Use `assumeRoleDuration` instead
+* `assumeRoleWithWebIdentityDurationSeconds` - Use `assumeRoleWithWebIdentityDuration` instead
+* `s3ForcePathStyle` - Use `s3UsePathStyle` instead
+* `sharedCredentialsFile` - Use `sharedCredentialsFiles` instead
+* `skipGetEc2Platforms` - Removed following the retirement of EC2-Classic
+
+## Default Tags
+
+The following enhancements are included:
+
+* Duplicate `defaultTags` can now be included and will be overwritten by resource `tags`.
+* Zero value tags, `""`, can now be included in both `defaultTags` and resource `tags`.
+* Tags can now be `computed`.
+
+## EC2-Classic Retirement
+
+Following the retirement of EC2-Classic, we removed a number of resources, arguments, and attributes. This list summarizes what we _removed_:
+
+* `awsDbSecurityGroup` resource
+* `awsElasticacheSecurityGroup` resource
+* `awsRedshiftSecurityGroup` resource
+* [`awsDbInstance`](/docs/providers/aws/r/db_instance.html) resource's `securityGroupNames` argument
+* [`awsElasticacheCluster`](/docs/providers/aws/r/elasticache_cluster.html) resource's `securityGroupNames` argument
+* [`awsRedshiftCluster`](/docs/providers/aws/r/redshift_cluster.html) resource's `clusterSecurityGroups` argument
+* [`awsLaunchConfiguration`](/docs/providers/aws/r/launch_configuration.html) resource's `vpcClassicLinkId` and `vpcClassicLinkSecurityGroups` arguments
+* [`awsVpc`](/docs/providers/aws/r/vpc.html) resource's `enableClassiclink` and `enableClassiclinkDnsSupport` arguments
+* [`awsDefaultVpc`](/docs/providers/aws/r/default_vpc.html) resource's `enableClassiclink` and `enableClassiclinkDnsSupport` arguments
+* [`awsVpcPeeringConnection`](/docs/providers/aws/r/vpc_peering_connection.html) resource's `allowClassicLinkToRemoteVpc` and `allowVpcToRemoteClassicLink` arguments
+* [`awsVpcPeeringConnectionAccepter`](/docs/providers/aws/r/vpc_peering_connection_accepter.html) resource's `allowClassicLinkToRemoteVpc` and `allowVpcToRemoteClassicLink` arguments
+* [`awsVpcPeeringConnectionOptions`](/docs/providers/aws/r/vpc_peering_connection_options.html) resource's `allowClassicLinkToRemoteVpc` and `allowVpcToRemoteClassicLink` arguments
+* [`awsDbInstance`](/docs/providers/aws/d/db_instance.html) data source's `dbSecurityGroups` attribute
+* [`awsElasticacheCluster`](/docs/providers/aws/d/elasticache_cluster.html) data source's `securityGroupNames` attribute
+* [`awsRedshiftCluster`](/docs/providers/aws/d/redshift_cluster.html) data source's `clusterSecurityGroups` attribute
+* [`awsLaunchConfiguration`](/docs/providers/aws/d/launch_configuration.html) data source's `vpcClassicLinkId` and `vpcClassicLinkSecurityGroups` attributes
+
+## Macie Classic Retirement
+
+Following the retirement of Amazon Macie Classic, we removed these resources:
+
+* `awsMacieMemberAccountAssociation`
+* `awsMacieS3BucketAssociation`
+
+## resource/aws_acmpca_certificate_authority
+
+Remove `status` from configurations as it no longer exists.
+
+## resource/aws_api_gateway_rest_api
+
+The `minimumCompressionSize` attribute is now a String type, allowing it to be computed when set via the `body` attribute. Valid values remain the same.
+
+## resource/aws_autoscaling_attachment
+
+Change `albTargetGroupArn`, which no longer exists, to `lbTargetGroupArn` in configurations.
+
+## resource/aws_autoscaling_group
+
+Remove `tags` from configurations as it no longer exists. Use the `tag` attribute instead. For use cases requiring dynamic tags, see the [Dynamic Tagging example](../r/autoscaling_group.html.markdown#dynamic-tagging).
+
+## resource/aws_budgets_budget
+
+Remove `costFilters` from configurations as it no longer exists.
+
+## resource/aws_ce_anomaly_subscription
+
+Remove `threshold` from configurations as it no longer exists.
+
+## resource/aws_cloudwatch_event_target
+
+The `ecsTargetPropagateTags` attribute now has no default value. If no value is specified, the tags are not propagated.
+
+## resource/aws_codebuild_project
+
+Remove `secondarySourcesAuth` and `sourceAuth` from configurations as they no longer exist.
+
+## resource/aws_connect_hours_of_operation
+
+Remove `hoursOfOperationArn` from configurations as it no longer exists.
+
+## resource/aws_connect_queue
+
+Remove `quickConnectIdsAssociated` from configurations as it no longer exists.
+
+## resource/aws_connect_routing_profile
+
+Remove `queueConfigsAssociated` from configurations as it no longer exists.
+
+## resource/aws_db_event_subscription
+
+Configurations that define `sourceIds` using the `id` attribute of `awsDbInstance` must be updated to use `identifier` instead. For example, `source_ids = [aws_db_instance.example.id]` must be updated to `source_ids = [aws_db_instance.example.identifier]`.
+
+## resource/aws_db_instance
+
+`awsDbInstance` has had a number of changes:
+
+1. [`id` is no longer the identifier](#aws_db_instanceid-is-no-longer-the-identifier)
+2. [Use `dbName` instead of `name`](#use-db_name-instead-of-name)
+3. [Remove `dbSecurityGroups`](#remove-db_security_groups)
+
+### aws_db_instance.id is no longer the identifier
+
+**What `id` _is_ has changed and can have far-reaching consequences.** Fortunately, fixing configurations is straightforward.
+
+`id` is _now_ the DBI Resource ID (_i.e._, `dbiResourceId`), an immutable "identifier" for an instance. `id` is now the same as the `resourceId`. (We recommend using `resourceId` rather than `id` when you need to refer to the DBI Resource ID.) _Previously_, `id` was the DB Identifier. Now when you need to refer to the _DB Identifier_, use `identifier`.
+
+Fixing configurations involves changing any `id` references to `identifier`, where the reference expects the DB Identifier. For example, if you're replicating an `awsDbInstance`, you can no longer use `id` to define the `replicateSourceDb`.
+
+This configuration will now result in an error since `replicateSourceDb` expects a _DB Identifier_:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DbInstance } from "./.gen/providers/aws/db-instance";
+interface MyConfig {
+  instanceClass: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new DbInstance(this, "test", {
+      replicateSourceDb: source.id,
+      instanceClass: config.instanceClass,
+    });
+  }
+}
+
+```
+
+You can fix the configuration like this:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DbInstance } from "./.gen/providers/aws/db-instance";
+interface MyConfig {
+  instanceClass: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new DbInstance(this, "test", {
+      replicateSourceDb: source.identifier,
+      instanceClass: config.instanceClass,
+    });
+  }
+}
+
+```
+
+### Use `dbName` instead of `name`
+
+Change `name` to `dbName` in configurations as `name` no longer exists.
+
+### Remove `dbSecurityGroups`
+
+Remove `dbSecurityGroups` from configurations as it no longer exists. We removed it as part of the EC2-Classic retirement.
+
+## resource/aws_db_instance_role_association
+
+Configurations that define `dbInstanceIdentifier` using the `id` attribute of `awsDbInstance` must be updated to use `identifier` instead. For example, `db_instance_identifier = aws_db_instance.example.id` must be updated to `db_instance_identifier = aws_db_instance.example.identifier`.
+
+## resource/aws_db_proxy_target
+
+Configurations that define `dbInstanceIdentifier` using the `id` attribute of `awsDbInstance` must be updated to use `identifier` instead. For example, `db_instance_identifier = aws_db_instance.example.id` must be updated to `db_instance_identifier = aws_db_instance.example.identifier`.
+
+## resource/aws_db_security_group
+
+We removed this resource as part of the EC2-Classic retirement.
+
+## resource/aws_db_snapshot
+
+Configurations that define `dbInstanceIdentifier` using the `id` attribute of `awsDbInstance` must be updated to use `identifier` instead. For example, `db_instance_identifier = aws_db_instance.example.id` must be updated to `db_instance_identifier = aws_db_instance.example.identifier`.
+
+## resource/aws_default_vpc
+
+Remove `enableClassiclink` and `enableClassiclinkDnsSupport` from configurations as they no longer exist. They were part of the EC2-Classic retirement.
+
+## resource/aws_dms_endpoint
+
+Remove `s3SettingsIgnoreHeadersRow` from configurations as it no longer exists. **Be careful to not confuse `ignoreHeadersRow`, which no longer exists, with `ignoreHeaderRows`, which still exists.**
+
+## resource/aws_docdb_cluster
+
+Changes to the `snapshotIdentifier` attribute will now correctly force re-creation of the resource. Previously, changing this attribute would result in a successful apply, but without the cluster being restored (only the resource state was changed). This change brings behavior of the cluster `snapshotIdentifier` attribute into alignment with other RDS resources, such as `awsDbInstance`.
+
+Automated snapshots **should not** be used for this attribute, unless from a different cluster. Automated snapshots are deleted as part of cluster destruction when the resource is replaced.
+
+## resource/aws_dx_gateway_association
+
+The `vpnGatewayId` attribute has been deprecated. All configurations using `vpnGatewayId` should be updated to use the `associatedGatewayId` attribute instead.
+
+## resource/aws_ec2_client_vpn_endpoint
+
+Remove `status` from configurations as it no longer exists.
+
+## resource/aws_ec2_client_vpn_network_association
+
+Remove `securityGroups` and `status` from configurations as they no longer exist.
+
+## resource/aws_ecs_cluster
+
+Remove `capacityProviders` and `defaultCapacityProviderStrategy` from configurations as they no longer exist.
+
+## resource/aws_eip
+
+* With the retirement of EC2-Classic, the `standard` domain is no longer supported.
+* The `vpc` argument has been deprecated. Use `domain` argument instead.
+
+## resource/aws_eip_association
+
+With the retirement of EC2-Classic, the `standard` domain is no longer supported.
+
+## resource/aws_eks_addon
+
+The `resolveConflicts` argument has been deprecated. Use the `resolveConflictsOnCreate` and/or `resolveConflictsOnUpdate` arguments instead.
+
+## resource/aws_elasticache_cluster
+
+Remove `securityGroupNames` from configurations as it no longer exists. We removed it as part of the EC2-Classic retirement.
+
+## resource/aws_elasticache_replication_group
+
+* Remove the `clusterMode` configuration block. Use top-level `numNodeGroups` and `replicasPerNodeGroup` instead.
+* Remove `availabilityZones`, `numberCacheClusters`, `replicationGroupDescription` arguments from configurations as they no longer exist.  Use `preferredCacheClusterAzs`, `numCacheClusters`, and `description`, respectively, instead.
+
+## resource/aws_elasticache_security_group
+
+We removed this resource as part of the EC2-Classic retirement.
+
+## resource/aws_flow_log
+
+The `logGroupName` attribute has been deprecated. All configurations using `logGroupName` should be updated to use the `logDestination` attribute instead.
+
+## resource/aws_guardduty_organization_configuration
+
+The `autoEnable` argument has been deprecated. Use the `autoEnableOrganizationMembers` argument instead.
+
+## resource/aws_kinesis_firehose_delivery_stream
+
+* Remove the `s3Configuration` attribute from the root of the resource. `s3Configuration` is now a part of the following blocks: `elasticsearchConfiguration`, `opensearchConfiguration`, `redshiftConfiguration`, `splunkConfiguration`, and `httpEndpointConfiguration`.
+* Remove `s3` as an option for `destination`. Use `extendedS3` instead
+* Rename `extendedS3Configuration0S3BackupConfiguration0BufferSize` and `extendedS3Configuration0S3BackupConfiguration0BufferInterval` to `extendedS3Configuration0S3BackupConfiguration0BufferingSize` and `extendedS3Configuration0S3BackupConfiguration0BufferingInterval`, respectively.
+* Rename `redshiftConfiguration0S3BackupConfiguration0BufferSize` and `redshiftConfiguration0S3BackupConfiguration0BufferInterval` to `redshiftConfiguration0S3BackupConfiguration0BufferingSize` and `redshiftConfiguration0S3BackupConfiguration0BufferingInterval`, respectively.
+* Rename `s3Configuration0BufferSize` and `s3Configuration0BufferInterval` to `s3Configuration0BufferingSize` and `s3Configuration0BufferingInterval`, respectively.
+
+## resource/aws_launch_configuration
+
+Remove `vpcClassicLinkId` and `vpcClassicLinkSecurityGroups` from configurations as they no longer exist. We removed them as part of the EC2-Classic retirement.
+
+## resource/aws_launch_template
+
+We removed defaults from `metatadataOptions`. Launch template metadata options will now default to unset values, which is the AWS default behavior.
+
+## resource/aws_lightsail_instance
+
+Remove `ipv6Address` from configurations as it no longer exists.
+
+## resource/aws_macie_member_account_association
+
+We removed this resource as part of the Macie Classic retirement.
+
+## resource/aws_macie_s3_bucket_association
+
+We removed this resource as part of the Macie Classic retirement.
+
+## resource/aws_medialive_multiplex_program
+
+Change `statemuxSettings`, which no longer exists, to `statmuxSettings` in configurations.
+
+## resource/aws_msk_cluster
+
+Remove `brokerNodeGroupInfoEbsVolumeSize` from configurations as it no longer exists.
+
+## resource/aws_neptune_cluster
+
+Changes to the `snapshotIdentifier` attribute will now correctly force re-creation of the resource. Previously, changing this attribute would result in a successful apply, but without the cluster being restored (only the resource state was changed). This change brings behavior of the cluster `snapshotIdentifier` attribute into alignment with other RDS resources, such as `awsDbInstance`.
+
+Automated snapshots **should not** be used for this attribute, unless from a different cluster. Automated snapshots are deleted as part of cluster destruction when the resource is replaced.
+
+## resource/aws_networkmanager_core_network
+
+Remove `policyDocument` from configurations as it no longer exists. Use the `awsNetworkmanagerCoreNetworkPolicyAttachment` resource instead.
+
+## resource/aws_opensearch_domain
+
+* The `kibanaEndpoint` attribute has been deprecated. All configurations using `kibanaEndpoint` should be updated to use the `dashboardEndpoint` attribute instead.
+* The `engineVersion` attribute no longer has a default value. Omitting this attribute will now create a domain with the latest OpenSearch version, consistent with the behavior of the AWS API.
+
+## resource/aws_rds_cluster
+
+* Update configurations to always include `engine` since it is now required and has no default. Previously, not including `engine` was equivalent to `engine = "aurora"` and created a MySQL-5.6-compatible cluster.
+* Changes to the `snapshotIdentifier` attribute will now correctly force re-creation of the resource. Previously, changing this attribute would result in a successful apply, but without the cluster being restored (only the resource state was changed). This change brings behavior of the cluster `snapshotIdentifier` attribute into alignment with other RDS resources, such as `awsDbInstance`. **NOTE:** Automated snapshots **should not** be used for this attribute, unless from a different cluster. Automated snapshots are deleted as part of cluster destruction when the resource is replaced.
+
+## resource/aws_rds_cluster_instance
+
+Update configurations to always include `engine` since it is now required and has no default. Previously, not including `engine` was equivalent to `engine = "aurora"` and created a MySQL-5.6-compatible cluster.
+
+## resource/aws_redshift_cluster
+
+Remove `clusterSecurityGroups` from configurations as it no longer exists. We removed it as part of the EC2-Classic retirement.
+
+## resource/aws_redshift_security_group
+
+We removed this resource as part of the EC2-Classic retirement.
+
+## resource/aws_route
+
+Update configurations to use `networkInterfaceId` rather than `instanceId`, which no longer exists.
+
+For example, this configuration is _no longer valid_:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Route } from "./.gen/providers/aws/route";
+interface MyConfig {
+  routeTableId: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new Route(this, "example", {
+      instanceId: Token.asString(awsInstanceExample.id),
+      routeTableId: config.routeTableId,
+    });
+  }
+}
+
+```
+
+One possible way to fix this configuration involves referring to the `primaryNetworkInterfaceId` of an instance:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Route } from "./.gen/providers/aws/route";
+interface MyConfig {
+  routeTableId: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new Route(this, "example", {
+      networkInterfaceId: Token.asString(
+        awsInstanceExample.primaryNetworkInterfaceId
+      ),
+      routeTableId: config.routeTableId,
+    });
+  }
+}
+
+```
+
+Another fix is to use an ENI:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Instance } from "./.gen/providers/aws/instance";
+import { NetworkInterface } from "./.gen/providers/aws/network-interface";
+import { Route } from "./.gen/providers/aws/route";
+interface MyConfig {
+  subnetId: any;
+  deviceIndex: any;
+  routeTableId: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    const example = new NetworkInterface(this, "example", {
+      subnetId: config.subnetId,
+    });
+    const awsInstanceExample = new Instance(this, "example_1", {
+      networkInterface: [
+        {
+          networkInterfaceId: example.id,
+          deviceIndex: config.deviceIndex,
+        },
+      ],
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsInstanceExample.overrideLogicalId("example");
+    const awsRouteExample = new Route(this, "example_2", {
+      dependsOn: [awsInstanceExample],
+      networkInterfaceId: example.id,
+      routeTableId: config.routeTableId,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsRouteExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## resource/aws_route_table
+
+Update configurations to use `route.*NetworkInterfaceId` rather than `route.*InstanceId`, which no longer exists.
+
+For example, this configuration is _no longer valid_:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { RouteTable } from "./.gen/providers/aws/route-table";
+interface MyConfig {
+  vpcId: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new RouteTable(this, "example", {
+      route: [
+        {
+          instance_id: awsInstanceExample.id,
+        },
+      ],
+      vpcId: config.vpcId,
+    });
+  }
+}
+
+```
+
+One possible way to fix this configuration involves referring to the `primaryNetworkInterfaceId` of an instance:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { RouteTable } from "./.gen/providers/aws/route-table";
+interface MyConfig {
+  vpcId: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new RouteTable(this, "example", {
+      route: [
+        {
+          networkInterfaceId: Token.asString(
+            awsInstanceExample.primaryNetworkInterfaceId
+          ),
+        },
+      ],
+      vpcId: config.vpcId,
+    });
+  }
+}
+
+```
+
+Another fix is to use an ENI:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Instance } from "./.gen/providers/aws/instance";
+import { NetworkInterface } from "./.gen/providers/aws/network-interface";
+import { RouteTable } from "./.gen/providers/aws/route-table";
+interface MyConfig {
+  subnetId: any;
+  deviceIndex: any;
+  vpcId: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    const example = new NetworkInterface(this, "example", {
+      subnetId: config.subnetId,
+    });
+    const awsInstanceExample = new Instance(this, "example_1", {
+      networkInterface: [
+        {
+          networkInterfaceId: example.id,
+          deviceIndex: config.deviceIndex,
+        },
+      ],
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsInstanceExample.overrideLogicalId("example");
+    const awsRouteTableExample = new RouteTable(this, "example_2", {
+      dependsOn: [awsInstanceExample],
+      route: [
+        {
+          networkInterfaceId: example.id,
+        },
+      ],
+      vpcId: config.vpcId,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsRouteTableExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## resource/aws_s3_object
+
+The `acl` attribute no longer has a default value. Previously this was set to `private` when omitted. Objects requiring a private ACL should now explicitly set this attribute.
+
+## resource/aws_s3_object_copy
+
+The `acl` attribute no longer has a default value. Previously this was set to `private` when omitted. Object copies requiring a private ACL should now explicitly set this attribute.
+
+## resource/aws_secretsmanager_secret
+
+Remove `rotationEnabled`, `rotationLambdaArn` and `rotationRules` from configurations as they no longer exist.
+
+## resource/aws_security_group
+
+With the retirement of EC2-Classic, non-VPC security groups are no longer supported.
+
+## resource/aws_security_group_rule
+
+With the retirement of EC2-Classic, non-VPC security groups are no longer supported.
+
+## resource/aws_servicecatalog_product
+
+Changes to any `provisioningArtifactParameters` arguments now properly trigger a replacement. This fixes incorrect behavior, but may technically be breaking for configurations expecting non-functional in-place updates.
+
+## resource/aws_ssm_association
+
+The `instanceId` attribute has been deprecated. All configurations using `instanceId` should be updated to use the `targets` attribute instead.
+
+## resource/aws_ssm_parameter
+
+The `overwrite` attribute has been deprecated. Existing parameters should be explicitly imported rather than relying on the "import on create" behavior previously enabled by setting `overwrite = true`. In a future major version the `overwrite` attribute will be removed and attempting to create a parameter that already exists will fail.
+
+## resource/aws_vpc
+
+Remove `enableClassiclink` and `enableClassiclinkDnsSupport` from configurations as they no longer exist. They were part of the EC2-Classic retirement.
+
+## resource/aws_vpc_peering_connection
+
+Remove `allowClassicLinkToRemoteVpc` and `allowVpcToRemoteClassicLink` from configurations as they no longer exist. They were part of the EC2-Classic retirement.
+
+## resource/aws_vpc_peering_connection_accepter
+
+Remove `allowClassicLinkToRemoteVpc` and `allowVpcToRemoteClassicLink` from configurations as they no longer exist. They were part of the EC2-Classic retirement.
+
+## resource/aws_vpc_peering_connection_options
+
+Remove `allowClassicLinkToRemoteVpc` and `allowVpcToRemoteClassicLink` from configurations as they no longer exist. They were part of the EC2-Classic retirement.
+
+## resource/aws_wafv2_web_acl
+
+* Remove `statementManagedRuleGroupStatementExcludedRule` and `statementRuleGroupReferenceStatementExcludedRule` from configurations as they no longer exist.
+* The `statementRuleGroupReferenceStatementRuleActionOverride` attribute has been added.
+
+## resource/aws_wafv2_web_acl_logging_configuration
+
+Remove `redactedFieldsAllQueryArguments`, `redactedFieldsBody` and `redactedFieldsSingleQueryArgument` from configurations as they no longer exist.
+
+## data-source/aws_api_gateway_rest_api
+
+The `minimumCompressionSize` attribute is now a String type, allowing it to be computed when set via the `body` attribute.
+
+## data-source/aws_connect_hours_of_operation
+
+Remove `hoursOfOperationArn` from configurations as it no longer exists.
+
+## data-source/aws_db_instance
+
+Remove `dbSecurityGroups` from configurations as it no longer exists. We removed it as part of the EC2-Classic retirement.
+
+## data-source/aws_elasticache_cluster
+
+Remove `securityGroupNames` from configurations as it no longer exists. We removed it as part of the EC2-Classic retirement.
+
+## data-source/aws_elasticache_replication_group
+
+Rename `numberCacheClusters` and `replicationGroupDescription`, which no longer exist, to `numCacheClusters`, and `description`, respectively.
+
+## data-source/aws_iam_policy_document
+
+* Remove `sourceJson` and `overrideJson` from configurations. Use `sourcePolicyDocuments` and `overridePolicyDocuments`, respectively, instead.
+* Don't add empty `statementSid` values to `json` attribute value.
+
+## data-source/aws_identitystore_group
+
+Remove `filter` from configurations as it no longer exists.
+
+## data-source/aws_identitystore_user
+
+Remove `filter` from configurations as it no longer exists.
+
+## data-source/aws_launch_configuration
+
+Remove `vpcClassicLinkId` and `vpcClassicLinkSecurityGroups` from configurations as they no longer exist. They were part of the EC2-Classic retirement.
+
+## data-source/aws_opensearch_domain
+
+The `kibanaEndpoint` attribute has been deprecated. All configurations using `kibanaEndpoint` should be updated to use the `dashboardEndpoint` attribute instead.
+
+## data-source/aws_quicksight_data_set
+
+The `tagsAll` attribute has been deprecated and will be removed in a future version.
+
+## data-source/aws_redshift_cluster
+
+Remove `clusterSecurityGroups` from configurations as it no longer exists. We removed it as part of the EC2-Classic retirement.
+
+## data-source/aws_redshift_service_account
+
+[AWS document](https://docs.aws.amazon.com/redshift/latest/mgmt/db-auditing.html#db-auditing-bucket-permissions) that [a service principal name](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html#principal-services) be used instead of AWS account ID in any relevant IAM policy.
+The [`awsRedshiftServiceAccount`](/docs/providers/aws/d/redshift_service_account.html) data source should now be considered deprecated and will be removed in a future version.
+
+## data-source/aws_service_discovery_service
+
+The `tagsAll` attribute has been deprecated and will be removed in a future version.
+
+## data-source/aws_secretsmanager_secret
+
+Remove `rotationEnabled`, `rotationLambdaArn` and `rotationRules` from configurations as they no longer exist.
+
+## data-source/aws_subnet_ids
+
+We removed the `awsSubnetIds` data source. Use the [`awsSubnets`](/docs/providers/aws/d/subnets.html) data source instead.
+
+## data-source/aws_vpc_peering_connection
+
+Remove `allowClassicLinkToRemoteVpc` and `allowVpcToRemoteClassicLink` from configurations as they no longer exist. They were part of the EC2-Classic retirement.
+
+<!-- cache-key: cdktf-0.18.0 input-aca6d1f7e7d666acb626774a0855d9b010ab540c0e171c9acb88a23401334cb9 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/index.html.markdown b/website/docs/cdktf/typescript/index.html.markdown
new file mode 100644
index 00000000000..128977537ae
--- /dev/null
+++ b/website/docs/cdktf/typescript/index.html.markdown
@@ -0,0 +1,832 @@
+---
+layout: "aws"
+page_title: "Provider: AWS"
+description: |-
+  Use the Amazon Web Services (AWS) provider to interact with the many resources supported by AWS. You must configure the provider with the proper credentials before you can use it.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# AWS Provider
+
+Use the Amazon Web Services (AWS) provider to interact with the
+many resources supported by AWS. You must configure the provider
+with the proper credentials before you can use it.
+
+Use the navigation to the left to read about the available resources. There are currently 1270 resources and 520 data sources available in the provider.
+
+To learn the basics of Terraform using this provider, follow the
+hands-on [get started tutorials](https://learn.hashicorp.com/tutorials/terraform/infrastructure-as-code?in=terraform/aws-get-started&utm_source=WEBSITE&utm_medium=WEB_IO&utm_offer=ARTICLE_PAGE&utm_content=DOCS). Interact with AWS services,
+including Lambda, RDS, and IAM by following the [AWS services
+tutorials](https://learn.hashicorp.com/collections/terraform/aws?utm_source=WEBSITE&utm_medium=WEB_IO&utm_offer=ARTICLE_PAGE&utm_content=DOCS).
+
+## Example Usage
+
+Terraform 0.13 and later:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AwsProvider } from "./.gen/providers/aws/provider";
+import { Vpc } from "./.gen/providers/aws/vpc";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AwsProvider(this, "aws", {
+      region: "us-east-1",
+    });
+    new Vpc(this, "example", {
+      cidrBlock: "10.0.0.0/16",
+    });
+  }
+}
+
+```
+
+Terraform 0.12 and earlier:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AwsProvider } from "./.gen/providers/aws/provider";
+import { Vpc } from "./.gen/providers/aws/vpc";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AwsProvider(this, "aws", {
+      region: "us-east-1",
+    });
+    new Vpc(this, "example", {
+      cidrBlock: "10.0.0.0/16",
+    });
+  }
+}
+
+```
+
+## Authentication and Configuration
+
+Configuration for the AWS Provider can be derived from several sources,
+which are applied in the following order:
+
+1. Parameters in the provider configuration
+1. Environment variables
+1. Shared credentials files
+1. Shared configuration files
+1. Container credentials
+1. Instance profile credentials and region
+
+This order matches the precedence used by the
+[AWS CLI](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-quickstart.html#cli-configure-quickstart-precedence)
+and the [AWS SDKs](https://aws.amazon.com/tools/).
+
+The AWS Provider supports assuming an IAM role, either in
+the provider configuration block parameter `assumeRole`
+or in [a named profile](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-role.html).
+
+The AWS Provider supports assuming an IAM role using [web identity federation and OpenID Connect (OIDC)](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-role.html#cli-configure-role-oidc).
+This can be configured either using environment variables or in a named profile.
+
+When using a named profile, the AWS Provider also supports [sourcing credentials from an external process](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sourcing-external.html).
+
+### Provider Configuration
+
+!> **Warning:** Hard-coded credentials are not recommended in any Terraform
+configuration and risks secret leakage should this file ever be committed to a
+public version control system.
+
+Credentials can be provided by adding an `accessKey`, `secretKey`, and optionally `token`, to the `aws` provider block.
+
+Usage:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AwsProvider } from "./.gen/providers/aws/provider";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AwsProvider(this, "aws", {
+      accessKey: "my-access-key",
+      region: "us-west-2",
+      secretKey: "my-secret-key",
+    });
+  }
+}
+
+```
+
+Other settings related to authorization can be configured, such as:
+
+* `profile`
+* `sharedConfigFiles`
+* `sharedCredentialsFiles`
+
+### Environment Variables
+
+Credentials can be provided by using the `awsAccessKeyId`, `awsSecretAccessKey`, and optionally `awsSessionToken` environment variables.
+The region can be set using the `awsRegion` or `awsDefaultRegion` environment variables.
+
+For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AwsProvider } from "./.gen/providers/aws/provider";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AwsProvider(this, "aws", {});
+  }
+}
+
+```
+
+```console
+% export AWS_ACCESS_KEY_ID="anaccesskey"
+% export AWS_SECRET_ACCESS_KEY="asecretkey"
+% export AWS_REGION="us-west-2"
+% terraform plan
+```
+
+Other environment variables related to authorization are:
+
+* `awsProfile`
+* `awsConfigFile`
+* `awsSharedCredentialsFile`
+
+### Shared Configuration and Credentials Files
+
+The AWS Provider can source credentials and other settings from the [shared configuration and credentials files](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-files.html).
+By default, these files are located at `$home/Aws/config` and `$home/Aws/credentials` on Linux and macOS,
+and `"%userprofile%\Aws\config"` and `"%userprofile%\Aws\credentials"` on Windows.
+
+If no named profile is specified, the `default` profile is used.
+Use the `profile` parameter or `awsProfile` environment variable to specify a named profile.
+
+The locations of the shared configuration and credentials files can be configured using either
+the parameters `sharedConfigFiles` and `sharedCredentialsFiles`
+or the environment variables `awsConfigFile` and `awsSharedCredentialsFile`.
+
+For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AwsProvider } from "./.gen/providers/aws/provider";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AwsProvider(this, "aws", {
+      profile: "customprofile",
+      sharedConfigFiles: ["/Users/tf_user/.aws/conf"],
+      sharedCredentialsFiles: ["/Users/tf_user/.aws/creds"],
+    });
+  }
+}
+
+```
+
+### Container Credentials
+
+If you're running Terraform on CodeBuild or ECS and have configured an [IAM Task Role](http://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-iam-roles.html), Terraform can use the container's Task Role. This support is based on the underlying `awsContainerCredentialsRelativeUri` and `awsContainerCredentialsFullUri` environment variables being automatically set by those services or manually for advanced usage.
+
+If you're running Terraform on EKS and have configured [IAM Roles for Service Accounts (IRSA)](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html), Terraform can use the pod's role. This support is based on the underlying `awsRoleArn` and `awsWebIdentityTokenFile` environment variables being automatically set by Kubernetes or manually for advanced usage.
+
+### Instance profile credentials and region
+
+When the AWS Provider is running on an EC2 instance with an IAM Instance Profile set,
+the provider can source credentials from the [EC2 Instance Metadata Service](http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html#instance-metadata-security-credentials).
+Both IMDS v1 and IMDS v2 are supported.
+
+A custom endpoint for the metadata service can be provided using the `ec2MetadataServiceEndpoint` parameter or the `awsEc2MetadataServiceEndpoint` environment variable.
+
+### Assuming an IAM Role
+
+If provided with a role ARN, the AWS Provider will attempt to assume this role
+using the supplied credentials.
+
+Usage:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AwsProvider } from "./.gen/providers/aws/provider";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AwsProvider(this, "aws", {
+      assumeRole: [
+        {
+          externalId: "EXTERNAL_ID",
+          roleArn: "arn:aws:iam::123456789012:role/ROLE_NAME",
+          sessionName: "SESSION_NAME",
+        },
+      ],
+    });
+  }
+}
+
+```
+
+> **Hands-on:** Try the [Use AssumeRole to Provision AWS Resources Across Accounts](https://learn.hashicorp.com/tutorials/terraform/aws-assumerole) tutorial.
+
+### Assuming an IAM Role Using A Web Identity
+
+If provided with a role ARN and a token from a web identity provider,
+the AWS Provider will attempt to assume this role using the supplied credentials.
+
+Usage:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AwsProvider } from "./.gen/providers/aws/provider";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AwsProvider(this, "aws", {
+      assumeRoleWithWebIdentity: [
+        {
+          roleArn: "arn:aws:iam::123456789012:role/ROLE_NAME",
+          sessionName: "SESSION_NAME",
+          webIdentityTokenFile: "/Users/tf_user/secrets/web-identity-token",
+        },
+      ],
+    });
+  }
+}
+
+```
+
+### Using an External Credentials Process
+
+To use an [external process to source credentials](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sourcing-external.html),
+the process must be configured in a named profile, including the `default` profile.
+The profile is configured in a shared configuration file.
+
+For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AwsProvider } from "./.gen/providers/aws/provider";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AwsProvider(this, "aws", {
+      profile: "customprofile",
+    });
+  }
+}
+
+```
+
+```ini
+[profile customprofile]
+credential_process = custom-process --username jdoe
+```
+
+## AWS Configuration Reference
+
+|Setting|Provider|[Environment Variable][envvars]|[Shared Config][config]|
+|-------|--------|-------------------------------|-----------------------|
+|Access Key ID|`accessKey`|`awsAccessKeyId`|`awsAccessKeyId`|
+|Secret Access Key|`secretKey`|`awsSecretAccessKey`|`awsSecretAccessKey`|
+|Session Token|`token`|`awsSessionToken`|`awsSessionToken`|
+|Region|`region`|`awsRegion` or `awsDefaultRegion`|`region`|
+|Custom CA Bundle |`customCaBundle`|`awsCaBundle`|`caBundle`|
+|EC2 IMDS Endpoint |`ec2MetadataServiceEndpoint`|`awsEc2MetadataServiceEndpoint`|N/A|
+|EC2 IMDS Endpoint Mode|`ec2MetadataServiceEndpointMode`|`awsEc2MetadataServiceEndpointMode`|N/A|
+|Disable EC2 IMDS|`skipMetadataApiCheck`|`awsEc2MetadataDisabled`|N/A|
+|HTTP Proxy|`httpProxy`|`httpProxy` or `httpsProxy`|N/A|
+|Max Retries|`maxRetries`|`awsMaxAttempts`|`maxAttempts`|
+|Profile|`profile`|`awsProfile` or `awsDefaultProfile`|N/A|
+|Retry Mode|`retryMode`|`awsRetryMode`|`retryMode`|
+|Shared Config Files|`sharedConfigFiles`|`awsConfigFile`|N/A|
+|Shared Credentials Files|`sharedCredentialsFiles`|`awsSharedCredentialsFile`|N/A|
+|S3 Use Regional Endpoint for `usEast1`|`s3UsEast1RegionalEndpoint`|`awsS3UsEast1RegionalEndpoint`|`s3UsEast1RegionalEndpoint`|
+|Use DualStack Endpoints|`useDualstackEndpoint`|`awsUseDualstackEndpoint`|`useDualstackEndpoint`|
+|Use FIPS Endpoints|`useFipsEndpoint`|`awsUseFipsEndpoint`|`useFipsEndpoint`|
+
+[envvars]: https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-envvars.html
+[config]: https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-files.html#cli-configure-files-settings
+
+### Assume Role Configuration Reference
+
+Configuation for assuming an IAM role can be done using provider configuration or a named profile in shared configuration files.
+In the provider, all parameters for assuming an IAM role are set in the `assumeRole` block.
+
+Note that environment variables are not supported for assuming IAM roles.
+
+See the [assume role documentation](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-role.html) for more information.
+
+|Setting|Provider|[Shared Config][config]|
+|-------|--------|-----------------------|
+|Role ARN|`roleArn`|`roleArn`|
+|Duration|`duration`|`durationSeconds`|
+|External ID|`externalId`|`externalId`|
+|Policy|`policy`|N/A|
+|Policy ARNs|`policyArns`|N/A|
+|Session Name|`sessionName`|`roleSessionName`|
+|Source Identity|`sourceIdentity`|N/A|
+|Tags|`tags`|N/A|
+|Transitive Tag Keys|`transitiveTagKeys`|N/A|
+
+### Assume Role with Web Identity Configuration Reference
+
+Configuration for assuming an IAM role using web identify federation can be done using provider configuration, environment variables, or a named profile in shared configuration files.
+In the provider, all parameters for assuming an IAM role are set in the `assumeRoleWithWebIdentity` block.
+
+See the assume role documentation [section on web identities](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-role.html#cli-configure-role-oidc) for more information.
+
+|Setting|Provider|[Environment Variable][envvars]|[Shared Config][config]|
+|-------|--------|--------|-----------------------|
+|Role ARN|`roleArn`|`awsRoleArn`|`roleArn`|
+|Web Identity Token|`webIdentityToken`|N/A|N/A|
+|Web Identity Token File|`webIdentityTokenFile`|`awsWebIdentityTokenFile`|`webIdentityTokenFile`|
+|Duration|`duration`|N/A|`durationSeconds`|
+|Policy|`policy`|N/A|`policy`|
+|Policy ARNs|`policyArns`|N/A|`policyArns`|
+|Session Name|`sessionName`|`awsRoleSessionName`|`roleSessionName`|
+
+## Custom User-Agent Information
+
+By default, the underlying AWS client used by the Terraform AWS Provider creates requests with User-Agent headers including information about Terraform and AWS SDK for Go versions. To provide additional information in the User-Agent headers, the `tfAppendUserAgent` environment variable can be set and its value will be directly added to HTTP requests. E.g.,
+
+```console
+% export TF_APPEND_USER_AGENT="JenkinsAgent/i-12345678 BuildID/1234 (Optional Extra Information)"
+```
+
+## Argument Reference
+
+In addition to [generic `provider` arguments](https://www.terraform.io/docs/configuration/providers.html)
+(e.g., `alias` and `version`), the following arguments are supported in the AWS
+ `provider` block:
+
+* `accessKey` - (Optional) AWS access key. Can also be set with the `awsAccessKeyId` environment variable, or via a shared credentials file if `profile` is specified. See also `secretKey`.
+* `allowedAccountIds` - (Optional) List of allowed AWS account IDs to prevent you from mistakenly using an incorrect one (and potentially end up destroying a live environment). Conflicts with `forbiddenAccountIds`.
+* `assumeRole` - (Optional) Configuration block for assuming an IAM role. See the [`assumeRole` Configuration Block](#assume_role-configuration-block) section below. Only one `assumeRole` block may be in the configuration.
+* `assumeRoleWithWebIdentity` - (Optional) Configuration block for assuming an IAM role using a web identity. See the [`assumeRoleWithWebIdentity` Configuration Block](#assume_role_with_web_identity-configuration-block) section below. Only one `assumeRoleWithWebIdentity` block may be in the configuration.
+* `customCaBundle` - (Optional) File containing custom root and intermediate certificates.
+  Can also be set using the `awsCaBundle` environment variable.
+  Setting `caBundle` in the shared config file is not supported.
+* `defaultTags` - (Optional) Configuration block with resource tag settings to apply across all resources handled by this provider (see the [Terraform multiple provider instances documentation](/docs/configuration/providers.html#alias-multiple-provider-instances) for more information about additional provider configurations). This is designed to replace redundant per-resource `tags` configurations. Provider tags can be overridden with new values, but not excluded from specific resources. To override provider tag values, use the `tags` argument within a resource to configure new tag values for matching keys. See the [`defaultTags`](#default_tags-configuration-block) Configuration Block section below for example usage and available arguments. This functionality is supported in all resources that implement `tags`, with the exception of the `awsAutoscalingGroup` resource.
+* `ec2MetadataServiceEndpoint` - (Optional) Address of the EC2 metadata service (IMDS) endpoint to use. Can also be set with the `awsEc2MetadataServiceEndpoint` environment variable.
+* `ec2MetadataServiceEndpointMode` - (Optional) Mode to use in communicating with the metadata service. Valid values are `iPv4` and `iPv6`. Can also be set with the `awsEc2MetadataServiceEndpointMode` environment variable.
+* `endpoints` - (Optional) Configuration block for customizing service endpoints. See the [Custom Service Endpoints Guide](/docs/providers/aws/guides/custom-service-endpoints.html) for more information about connecting to alternate AWS endpoints or AWS compatible solutions. See also `useFipsEndpoint`.
+* `forbiddenAccountIds` - (Optional) List of forbidden AWS account IDs to prevent you from mistakenly using the wrong one (and potentially end up destroying a live environment). Conflicts with `allowedAccountIds`.
+* `httpProxy` - (Optional) Address of an HTTP proxy to use when accessing the AWS API. Can also be set using the `httpProxy` or `httpsProxy` environment variables.
+* `ignoreTags` - (Optional) Configuration block with resource tag settings to ignore across all resources handled by this provider (except any individual service tag resources such as `awsEc2Tag`) for situations where external systems are managing certain resource tags. Arguments to the configuration block are described below in the `ignoreTags` Configuration Block section. See the [Terraform multiple provider instances documentation](https://www.terraform.io/docs/configuration/providers.html#alias-multiple-provider-configurations) for more information about additional provider configurations.
+* `insecure` - (Optional) Whether to explicitly allow the provider to perform "insecure" SSL requests. If omitted, the default value is `false`.
+* `maxRetries` - (Optional) Maximum number of times an API call is retried when AWS throttles requests or you experience transient failures.
+  The delay between the subsequent API calls increases exponentially.
+  If omitted, the default value is `25`.
+  Can also be set using the environment variable `awsMaxAttempts`
+  and the shared configuration parameter `maxAttempts`.
+* `profile` - (Optional) AWS profile name as set in the shared configuration and credentials files.
+  Can also be set using either the environment variables `awsProfile` or `awsDefaultProfile`.
+* `region` - (Optional) AWS region where the provider will operate. The region must be set.
+  Can also be set with either the `awsRegion` or `awsDefaultRegion` environment variables,
+  or via a shared config file parameter `region` if `profile` is used.
+  If credentials are retrieved from the EC2 Instance Metadata Service, the region can also be retrieved from the metadata.
+* `retryMode` - (Optional) Specifies how retries are attempted.
+  Valid values are `standard` and `adaptive`.
+  Can also be configured using the `awsRetryMode` environment variable or the shared config file parameter `retryMode`.
+* `s3UsePathStyle` - (Optional) Whether to enable the request to use path-style addressing, i.e., `https://s3AmazonawsCom/bucket/key`.
+  By default, the S3 client will use virtual hosted bucket addressing, `https://bucketS3AmazonawsCom/key`, when possible.
+  Specific to the Amazon S3 service.
+* `s3UsEast1RegionalEndpoint` - (Optional) Specifies whether S3 API calls in the `usEast1` region use the legacy global endpoint or a regional endpoint.
+  Valid values are `legacy` or `regional`.
+  Can also be configured using the `awsS3UsEast1RegionalEndpoint` environment variable or the `s3UsEast1RegionalEndpoint` shared config file parameter.
+  Specific to the Amazon S3 service.
+* `secretKey` - (Optional) AWS secret key. Can also be set with the `awsSecretAccessKey` environment variable, or via a shared configuration and credentials files if `profile` is used. See also `accessKey`.
+* `sharedConfigFiles` - (Optional) List of paths to AWS shared config files. If not set, the default is `[~/Aws/config]`. A single value can also be set with the `awsConfigFile` environment variable.
+* `sharedCredentialsFiles` - (Optional) List of paths to the shared credentials file. If not set and a profile is used, the default value is `[~/Aws/credentials]`. A single value can also be set with the `awsSharedCredentialsFile` environment variable.
+* `skipCredentialsValidation` - (Optional) Whether to skip credentials validation via the STS API. This can be useful for testing and for AWS API implementations that do not have STS available.
+* `skipMetadataApiCheck` - (Optional) Whether to skip the AWS Metadata API check.  Useful for AWS API implementations that do not have a metadata API endpoint.  Setting to `true` prevents Terraform from authenticating via the Metadata API. You may need to use other authentication methods like static credentials, configuration variables, or environment variables.
+* `skipRegionValidation` - (Optional) Whether to skip validating the region. Useful for AWS-like implementations that use their own region names or to bypass the validation for regions that aren't publicly available yet.
+* `skipRequestingAccountId` - (Optional) Whether to skip requesting the account ID.  Useful for AWS API implementations that do not have the IAM, STS API, or metadata API.  When set to `true` and not determined previously, returns an empty account ID when manually constructing ARN attributes with the following:
+    - [`awsApiGatewayDeployment` resource](/docs/providers/aws/r/api_gateway_deployment.html)
+    - [`awsApiGatewayRestApi` resource](/docs/providers/aws/r/api_gateway_rest_api.html)
+    - [`awsApiGatewayStage` resource](/docs/providers/aws/r/api_gateway_stage.html)
+    - [`awsApigatewayv2Api` data source](/docs/providers/aws/d/apigatewayv2_api.html)
+    - [`awsApigatewayv2Api` resource](/docs/providers/aws/r/apigatewayv2_api.html)
+    - [`awsApigatewayv2Stage` resource](/docs/providers/aws/r/apigatewayv2_stage.html)
+    - [`awsAppconfigApplication` resource](/docs/providers/aws/r/appconfig_application.html)
+    - [`awsAppconfigConfigurationProfile` resource](/docs/providers/aws/r/appconfig_configuration_profile.html)
+    - [`awsAppconfigDeployment` resource](/docs/providers/aws/r/appconfig_deployment.html)
+    - [`awsAppconfigDeploymentStrategy` resource](/docs/providers/aws/r/appconfig_deployment_strategy.html)
+    - [`awsAppconfigEnvironment` resource](/docs/providers/aws/r/appconfig_environment.html)
+    - [`awsAppconfigHostedConfigurationVersion` resource](/docs/providers/aws/r/appconfig_hosted_configuration_version.html)
+    - [`awsAthenaWorkgroup` resource](/docs/providers/aws/r/athena_workgroup.html)
+    - [`awsBudgetsBudget` resource](/docs/providers/aws/r/budgets_budget.html)
+    - [`awsCodedeployApp` resource](/docs/providers/aws/r/codedeploy_app.html)
+    - [`awsCodedeployDeploymentGroup` resource](/docs/providers/aws/r/codedeploy_deployment_group.html)
+    - [`awsCognitoIdentityPool` resource](/docs/providers/aws/r/cognito_identity_pool.html)
+    - [`awsCognitoUserPools` data source](/docs/providers/aws/d/cognito_user_pools.html)
+    - [`awsDefaultVpcDhcpOptions`](/docs/providers/aws/r/default_vpc_dhcp_options.html)
+    - [`awsDmsEventSubscription` resource](/docs/providers/aws/r/dms_event_subscription.html)
+    - [`awsDmsReplicationSubnetGroup` resource](/docs/providers/aws/r/dms_replication_subnet_group.html)
+    - [`awsDxConnection` resource](/docs/providers/aws/r/dx_connection.html)
+    - [`awsDxHostedPrivateVirtualInterfaceAccepter` resource](/docs/providers/aws/r/dx_hosted_private_virtual_interface_accepter.html)
+    - [`awsDxHostedPrivateVirtualInterface` resource](/docs/providers/aws/r/dx_hosted_private_virtual_interface.html)
+    - [`awsDxHostedPublicVirtualInterfaceAccepter` resource](/docs/providers/aws/r/dx_hosted_public_virtual_interface_accepter.html)
+    - [`awsDxHostedPublicVirtualInterface` resource](/docs/providers/aws/r/dx_hosted_public_virtual_interface.html)
+    - [`awsDxHostedTransitVirtualInterfaceAccepter` resource](/docs/providers/aws/r/dx_hosted_transit_virtual_interface_accepter.html)
+    - [`awsDxHostedTransitVirtualInterface` resource](/docs/providers/aws/r/dx_hosted_transit_virtual_interface.html)
+    - [`awsDxLag` resource](/docs/providers/aws/r/dx_lag.html)
+    - [`awsDxPrivateVirtualInterface` resource](/docs/providers/aws/r/dx_private_virtual_interface.html)
+    - [`awsDxPublicVirtualInterface` resource](/docs/providers/aws/r/dx_public_virtual_interface.html)
+    - [`awsDxTransitVirtualInterface` resource](/docs/providers/aws/r/dx_transit_virtual_interface.html)
+    - [`awsEbsVolume` data source](/docs/providers/aws/d/ebs_volume.html)
+    - [`awsEc2ClientVpnEndpoint` resource](/docs/providers/aws/r/ec2_client_vpn_endpoint.html)
+    - [`awsEc2TrafficMirrorFilter` resource](/docs/providers/aws/r/ec2_traffic_mirror_filter.html)
+    - [`awsEc2TrafficMirrorFilterRule` resource](/docs/providers/aws/r/ec2_traffic_mirror_filter_rule.html)
+    - [`awsEc2TrafficMirrorSession` resource](/docs/providers/aws/r/ec2_traffic_mirror_session.html)
+    - [`awsEc2TrafficMirrorTarget` resource](/docs/providers/aws/r/ec2_traffic_mirror_target.html)
+    - [`awsEc2TransitGatewayRouteTable` data source](/docs/providers/aws/d/ec2_transit_gateway_route_table.html)
+    - [`awsEc2TransitGatewayRouteTable` resource](/docs/providers/aws/r/ec2_transit_gateway_route_table.html)
+    - [`awsEcsCapacityProvider` resource (import)](/docs/providers/aws/r/ecs_capacity_provider.html)
+    - [`awsEcsCluster` resource (import)](/docs/providers/aws/r/ecs_cluster.html)
+    - [`awsEcsService` resource (import)](/docs/providers/aws/r/ecs_service.html)
+    - [`awsCustomerGateway` data source](/docs/providers/aws/d/customer_gateway.html)
+    - [`awsCustomerGateway` resource](/docs/providers/aws/r/customer_gateway.html)
+    - [`awsEfsAccessPoint` data source](/docs/providers/aws/d/efs_access_point.html)
+    - [`awsEfsAccessPoint` resource](/docs/providers/aws/r/efs_access_point.html)
+    - [`awsEfsFileSystem` data source](/docs/providers/aws/d/efs_file_system.html)
+    - [`awsEfsFileSystem` resource](/docs/providers/aws/r/efs_file_system.html)
+    - [`awsEfsMountTarget` data source](/docs/providers/aws/d/efs_mount_target.html)
+    - [`awsEfsMountTarget` resource](/docs/providers/aws/r/efs_mount_target.html)
+    - [`awsElasticacheCluster` data source](/docs/providers/aws/d/elasticache_cluster.html)
+    - [`awsElasticacheCluster` resource](/docs/providers/aws/r/elasticache_cluster.html)
+    - [`awsElb` data source](/docs/providers/aws/d/elb.html)
+    - [`awsElb` resource](/docs/providers/aws/r/elb.html)
+    - [`awsFlowLog` resource](/docs/providers/aws/r/flow_log.html)
+    - [`awsGlueCatalogDatabase` resource](/docs/providers/aws/r/glue_catalog_database.html)
+    - [`awsGlueCatalogTable` resource](/docs/providers/aws/r/glue_catalog_table.html)
+    - [`awsGlueConnection` resource](/docs/providers/aws/r/glue_connection.html)
+    - [`awsGlueCrawler` resource](/docs/providers/aws/r/glue_crawler.html)
+    - [`awsGlueJob` resource](/docs/providers/aws/r/glue_job.html)
+    - [`awsGlueMlTransform` resource](/docs/providers/aws/r/glue_ml_transform.html)
+    - [`awsGlueTrigger` resource](/docs/providers/aws/r/glue_trigger.html)
+    - [`awsGlueUserDefinedFunction` resource](/docs/providers/aws/r/glue_user_defined_function.html)
+    - [`awsGlueWorkflow` resource](/docs/providers/aws/r/glue_workflow.html)
+    - [`awsGuarddutyDetector` resource](/docs/providers/aws/r/guardduty_detector.html)
+    - [`awsGuarddutyIpset` resource](/docs/providers/aws/r/guardduty_ipset.html)
+    - [`awsGuarddutyThreatintelset` resource](/docs/providers/aws/r/guardduty_threatintelset.html)
+    - [`awsInstance` data source](/docs/providers/aws/d/instance.html)
+    - [`awsInstance` resource](/docs/providers/aws/r/instance.html)
+    - [`awsKeyPair` resource](/docs/providers/aws/r/key_pair.html)
+    - [`awsLaunchTemplate` data source](/docs/providers/aws/d/launch_template.html)
+    - [`awsLaunchTemplate` resource](/docs/providers/aws/r/launch_template.html)
+    - [`awsPlacementGroup` resource](/docs/providers/aws/r/placement_group.html)
+    - [`awsRedshiftCluster` resource](/docs/providers/aws/r/redshift_cluster.html)
+    - [`awsRedshiftEventSubscription` resource](/docs/providers/aws/r/redshift_event_subscription.html)
+    - [`awsRedshiftParameterGroup` resource](/docs/providers/aws/r/redshift_parameter_group.html)
+    - [`awsRedshiftSnapshotCopyGrant` resource](/docs/providers/aws/r/redshift_snapshot_copy_grant.html)
+    - [`awsRedshiftSnapshotSchedule` resource](/docs/providers/aws/r/redshift_snapshot_schedule.html)
+    - [`awsRedshiftSubnetGroup` resource](/docs/providers/aws/r/redshift_subnet_group.html)
+    - [`awsS3AccountPublicAccessBlock` resource](/docs/providers/aws/r/s3_account_public_access_block.html)
+    - [`awsSesActiveReceiptRuleSet` resource](/docs/providers/aws/r/ses_active_receipt_rule_set.html)
+    - [`awsSesConfigurationSet` resource](/docs/providers/aws/r/ses_configuration_set.html)
+    - [`awsSesDomainIdentityVerification` resource](/docs/providers/aws/r/ses_domain_identity_verification.html)
+    - [`awsSesDomainIdentity` resource](/docs/providers/aws/r/ses_domain_identity.html)
+    - [`awsSesEmailIdentity` resource](/docs/providers/aws/r/ses_email_identity.html)
+    - [`awsSesEventDestination` resource](/docs/providers/aws/r/ses_event_destination.html)
+    - [`awsSesReceiptFilter` resource](/docs/providers/aws/r/ses_receipt_filter.html)
+    - [`awsSesReceiptRule` resource](/docs/providers/aws/r/ses_receipt_rule.html)
+    - [`awsSesTemplate` resource](/docs/providers/aws/r/ses_template.html)
+    - [`awsSsmDocument` data source](/docs/providers/aws/d/ssm_document.html)
+    - [`awsSsmDocument` resource](/docs/providers/aws/r/ssm_document.html)
+    - [`awsSsmParameter` data source](/docs/providers/aws/d/ssm_parameter.html)
+    - [`awsSsmParameter` resource](/docs/providers/aws/r/ssm_parameter.html)
+    - [`awsSyntheticsCanary` resource](/docs/providers/aws/r/synthetics_canary.html)
+    - [`awsVpcEndpointService` data source](/docs/providers/aws/d/vpc_endpoint_service.html)
+    - [`awsVpcEndpointService` resource](/docs/providers/aws/r/vpc_endpoint_service.html)
+    - [`awsVpnConnection` resource](/docs/providers/aws/r/vpn_connection.html)
+    - [`awsVpnGateway` data source](/docs/providers/aws/d/vpn_gateway.html)
+    - [`awsVpnGateway` resource](/docs/providers/aws/r/vpn_gateway.html)
+    - [`awsWafGeoMatchSet` resource](/docs/providers/aws/r/waf_geo_match_set.html)
+    - [`awsWafIpset` resource](/docs/providers/aws/r/waf_ipset.html)
+    - [`awsWafRateBasedRule` resource](/docs/providers/aws/r/waf_rate_based_rule.html)
+    - [`awsWafRegexMatchSet` resource](/docs/providers/aws/r/waf_regex_match_set.html)
+    - [`awsWafRegexPatternSet` resource](/docs/providers/aws/r/waf_regex_pattern_set.html)
+    - [`awsWafregionalIpset` resource](/docs/providers/aws/r/wafregional_ipset.html)
+    - [`awsWafregionalRateBasedRule` resource](/docs/providers/aws/r/wafregional_rate_based_rule.html)
+    - [`awsWafregionalRule` resource](/docs/providers/aws/r/wafregional_rule.html)
+    - [`awsWafregionalRuleGroup` resource](/docs/providers/aws/r/wafregional_rule_group.html)
+    - [`awsWafregionalWebAcl` resource](/docs/providers/aws/r/wafregional_web_acl.html)
+    - [`awsWafRule` resource](/docs/providers/aws/r/waf_rule.html)
+    - [`awsWafRuleGroup` resource](/docs/providers/aws/r/waf_rule_group.html)
+    - [`awsWafSizeConstraintSet` resource](/docs/providers/aws/r/waf_size_constraint_set.html)
+    - [`awsWafWebAcl` resource](/docs/providers/aws/r/waf_web_acl.html)
+    - [`awsWafXssMatchSet` resource](/docs/providers/aws/r/waf_xss_match_set.html)
+* `stsRegion` - (Optional) AWS region for STS. If unset, AWS will use the same region for STS as other non-STS operations.
+* `token` - (Optional) Session token for validating temporary credentials. Typically provided after successful identity federation or Multi-Factor Authentication (MFA) login. With MFA login, this is the session token provided afterward, not the 6 digit MFA code used to get temporary credentials.  Can also be set with the `awsSessionToken` environment variable.
+* `useDualstackEndpoint` - (Optional) Force the provider to resolve endpoints with DualStack capability. Can also be set with the `awsUseDualstackEndpoint` environment variable or in a shared config file (`useDualstackEndpoint`).
+* `useFipsEndpoint` - (Optional) Force the provider to resolve endpoints with FIPS capability. Can also be set with the `awsUseFipsEndpoint` environment variable or in a shared config file (`useFipsEndpoint`).
+
+### assume_role Configuration Block
+
+The `assumeRole` configuration block supports the following arguments:
+
+* `duration` - (Optional) Duration of the assume role session. You can provide a value from 15 minutes up to the maximum session duration setting for the role. Represented by a string such as `1H`, `2H45M`, or `30M15S`.
+* `externalId` - (Optional) External identifier to use when assuming the role.
+* `policy` - (Optional) IAM Policy JSON describing further restricting permissions for the IAM Role being assumed.
+* `policyArns` - (Optional) Set of Amazon Resource Names (ARNs) of IAM Policies describing further restricting permissions for the IAM Role being assumed.
+* `roleArn` - (Required) ARN of the IAM Role to assume.
+* `sessionName` - (Optional) Session name to use when assuming the role.
+* `sourceIdentity` - (Optional) Source identity specified by the principal assuming the role.
+* `tags` - (Optional) Map of assume role session tags.
+* `transitiveTagKeys` - (Optional) Set of assume role session tag keys to pass to any subsequent sessions.
+
+### assume_role_with_web_identity Configuration Block
+
+The `assumeRoleWithWebIdentity` configuration block supports the following arguments:
+
+* `duration` - (Optional) Duration of the assume role session.
+  You can provide a value from 15 minutes up to the maximum session duration setting for the role.
+  Represented by a string such as `1H`, `2H45M`, or `30M15S`.
+* `policy` - (Optional) IAM Policy JSON describing further restricting permissions for the IAM Role being assumed.
+* `policyArns` - (Optional) Set of Amazon Resource Names (ARNs) of IAM Policies describing further restricting permissions for the IAM Role being assumed.
+* `roleArn` - (Required) ARN of the IAM Role to assume.
+  Can also be set with the `awsRoleArn` environment variable.
+* `sessionName` - (Optional) Session name to use when assuming the role.
+  Can also be set with the `awsRoleSessionName` environment variable.
+* `webIdentityToken` - (Optional) Value of a web identity token from an OpenID Connect (OIDC) or OAuth provider.
+  One of `webIdentityToken` or `webIdentityTokenFile` is required.
+* `webIdentityTokenFile` - (Optional) File containing a web identity token from an OpenID Connect (OIDC) or OAuth provider.
+  One of `webIdentityTokenFile` or `webIdentityToken` is required.
+  Can also be set with the `awsWebIdentityTokenFile` environment variable.
+
+### default_tags Configuration Block
+
+> **Hands-on:** Try the [Configure Default Tags for AWS Resources](https://learn.hashicorp.com/tutorials/terraform/aws-default-tags?in=terraform/aws) tutorial.
+
+Example: Resource with provider default tags
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformOutput, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AwsProvider } from "./.gen/providers/aws/provider";
+import { Vpc } from "./.gen/providers/aws/vpc";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AwsProvider(this, "aws", {
+      defaultTags: [
+        {
+          tags: {
+            Environment: "Test",
+            Name: "Provider Tag",
+          },
+        },
+      ],
+    });
+    const example = new Vpc(this, "example", {});
+    new TerraformOutput(this, "vpc_all_tags", {
+      value: example.tagsAll,
+    });
+    new TerraformOutput(this, "vpc_resource_level_tags", {
+      value: example.tags,
+    });
+  }
+}
+
+```
+
+Outputs:
+
+```console
+$ terraform apply
+...
+Outputs:
+
+vpc_all_tags = tomap({
+  "Environment" = "Test"
+  "Name" = "Provider Tag"
+})
+```
+
+Example: Resource with tags and provider default tags
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformOutput, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AwsProvider } from "./.gen/providers/aws/provider";
+import { Vpc } from "./.gen/providers/aws/vpc";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AwsProvider(this, "aws", {
+      defaultTags: [
+        {
+          tags: {
+            Environment: "Test",
+            Name: "Provider Tag",
+          },
+        },
+      ],
+    });
+    const example = new Vpc(this, "example", {
+      tags: {
+        Owner: "example",
+      },
+    });
+    new TerraformOutput(this, "vpc_all_tags", {
+      value: example.tagsAll,
+    });
+    new TerraformOutput(this, "vpc_resource_level_tags", {
+      value: example.tags,
+    });
+  }
+}
+
+```
+
+Outputs:
+
+```console
+$ terraform apply
+...
+Outputs:
+
+vpc_all_tags = tomap({
+  "Environment" = "Test"
+  "Name" = "Provider Tag"
+  "Owner" = "example"
+})
+vpc_resource_level_tags = tomap({
+  "Owner" = "example"
+})
+```
+
+Example: Resource overriding provider default tags
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformOutput, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AwsProvider } from "./.gen/providers/aws/provider";
+import { Vpc } from "./.gen/providers/aws/vpc";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AwsProvider(this, "aws", {
+      defaultTags: [
+        {
+          tags: {
+            Environment: "Test",
+            Name: "Provider Tag",
+          },
+        },
+      ],
+    });
+    const example = new Vpc(this, "example", {
+      tags: {
+        Environment: "Production",
+      },
+    });
+    new TerraformOutput(this, "vpc_all_tags", {
+      value: example.tagsAll,
+    });
+    new TerraformOutput(this, "vpc_resource_level_tags", {
+      value: example.tags,
+    });
+  }
+}
+
+```
+
+Outputs:
+
+```console
+$ terraform apply
+...
+Outputs:
+
+vpc_all_tags = tomap({
+  "Environment" = "Production"
+  "Name" = "Provider Tag"
+})
+vpc_resource_level_tags = tomap({
+  "Environment" = "Production"
+})
+```
+
+The `defaultTags` configuration block supports the following argument:
+
+* `tags` - (Optional) Key-value map of tags to apply to all resources.
+
+### ignore_tags Configuration Block
+
+Example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AwsProvider } from "./.gen/providers/aws/provider";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AwsProvider(this, "aws", {
+      ignoreTags: [
+        {
+          keys: ["TagKey1"],
+        },
+      ],
+    });
+  }
+}
+
+```
+
+The `ignoreTags` configuration block supports the following arguments:
+
+* `keys` - (Optional) List of exact resource tag keys to ignore across all resources handled by this provider. This configuration prevents Terraform from returning the tag in any `tags` attributes and displaying any configuration difference for the tag value. If any resource configuration still has this tag key configured in the `tags` argument, it will display a perpetual difference until the tag is removed from the argument or [`ignoreChanges`](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html#ignore_changes) is also used.
+* `keyPrefixes` - (Optional) List of resource tag key prefixes to ignore across all resources handled by this provider. This configuration prevents Terraform from returning any tag key matching the prefixes in any `tags` attributes and displaying any configuration difference for those tag values. If any resource configuration still has a tag matching one of the prefixes configured in the `tags` argument, it will display a perpetual difference until the tag is removed from the argument or [`ignoreChanges`](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html#ignore_changes) is also used.
+
+## Getting the Account ID
+
+If you use either `allowedAccountIds` or `forbiddenAccountIds`,
+Terraform uses several approaches to get the actual account ID
+in order to compare it with allowed or forbidden IDs.
+
+Approaches differ per authentication providers:
+
+* EC2 instance w/ IAM Instance Profile - [Metadata API](http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html)
+    is always used. Introduced in Terraform `0616`.
+* All other providers (environment variable, shared credentials file, ...)
+    will try three approaches in the following order
+    * `iam:getUser` - Typically useful for IAM Users. It also means
+      that each user needs to be privileged to call `iam:getUser` for themselves.
+    * `sts:getCallerIdentity` - _Should_ work for both IAM Users and federated IAM Roles,
+      introduced in Terraform `0616`.
+    * `iam:listRoles` - This is specifically useful for IdP-federated profiles
+      which cannot use `iam:getUser`. It also means that each federated user
+      need to be _assuming_ an IAM role which allows `iam:listRoles`.
+      Used in Terraform `0616+`.
+      There used to be no better way to get account ID out of the API
+      when using the federated account until `sts:getCallerIdentity` was introduced.
+
+<!-- cache-key: cdktf-0.18.0 input-acd8a09881ab29aeafe5c6b0411f4694cd3850219e5293c00f973ced87f5aab0 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/accessanalyzer_analyzer.html.markdown b/website/docs/cdktf/typescript/r/accessanalyzer_analyzer.html.markdown
new file mode 100644
index 00000000000..78040c89b7a
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/accessanalyzer_analyzer.html.markdown
@@ -0,0 +1,114 @@
+---
+subcategory: "IAM Access Analyzer"
+layout: "aws"
+page_title: "AWS: aws_accessanalyzer_analyzer"
+description: |-
+  Manages an Access Analyzer Analyzer
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_accessanalyzer_analyzer
+
+Manages an Access Analyzer Analyzer. More information can be found in the [Access Analyzer User Guide](https://docs.aws.amazon.com/IAM/latest/UserGuide/what-is-access-analyzer.html).
+
+## Example Usage
+
+### Account Analyzer
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AccessanalyzerAnalyzer } from "./.gen/providers/aws/accessanalyzer-analyzer";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AccessanalyzerAnalyzer(this, "example", {
+      analyzerName: "example",
+    });
+  }
+}
+
+```
+
+### Organization Analyzer
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AccessanalyzerAnalyzer } from "./.gen/providers/aws/accessanalyzer-analyzer";
+import { OrganizationsOrganization } from "./.gen/providers/aws/organizations-organization";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new OrganizationsOrganization(this, "example", {
+      awsServiceAccessPrincipals: ["access-analyzer.amazonaws.com"],
+    });
+    const awsAccessanalyzerAnalyzerExample = new AccessanalyzerAnalyzer(
+      this,
+      "example_1",
+      {
+        analyzerName: "example",
+        dependsOn: [example],
+        type: "ORGANIZATION",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsAccessanalyzerAnalyzerExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `analyzerName` - (Required) Name of the Analyzer.
+
+The following arguments are optional:
+
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `type` - (Optional) Type of Analyzer. Valid values are `account` or `organization`. Defaults to `account`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Analyzer.
+* `id` - Analyzer name.
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Access Analyzer Analyzers using the `analyzerName`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Access Analyzer Analyzers using the `analyzerName`. For example:
+
+```console
+% terraform import aws_accessanalyzer_analyzer.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-865517f541a3e2db841337fbd9f0628587cf4b4a56bf09cdcd6af204495a9819 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/accessanalyzer_archive_rule.html.markdown b/website/docs/cdktf/typescript/r/accessanalyzer_archive_rule.html.markdown
new file mode 100644
index 00000000000..cfebceb11c4
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/accessanalyzer_archive_rule.html.markdown
@@ -0,0 +1,100 @@
+---
+subcategory: "IAM Access Analyzer"
+layout: "aws"
+page_title: "AWS: aws_accessanalyzer_archive_rule"
+description: |-
+  Terraform resource for managing an AWS AccessAnalyzer Archive Rule.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_accessanalyzer_archive_rule
+
+Terraform resource for managing an AWS AccessAnalyzer Archive Rule.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AccessanalyzerArchiveRule } from "./.gen/providers/aws/accessanalyzer-archive-rule";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AccessanalyzerArchiveRule(this, "example", {
+      analyzerName: "example-analyzer",
+      filter: [
+        {
+          criteria: "condition.aws:UserId",
+          eq: ["userid"],
+        },
+        {
+          criteria: "error",
+          exists: Token.asString(true),
+        },
+        {
+          criteria: "isPublic",
+          eq: ["false"],
+        },
+      ],
+      ruleName: "example-rule",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `analyzerName` - (Required) Analyzer name.
+* `filter` - (Required) Filter criteria for the archive rule. See [Filter](#filter) for more details.
+* `ruleName` - (Required) Rule name.
+
+### Filter
+
+**Note** One comparator must be included with each filter.
+
+* `criteria` - (Required) Filter criteria.
+* `contains` - (Optional) Contains comparator.
+* `eq` - (Optional) Equals comparator.
+* `exists` - (Optional) Boolean comparator.
+* `neq` - (Optional) Not Equals comparator.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Resource ID in the format: `analyzerName/ruleName`.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AccessAnalyzer ArchiveRule using the `analyzerName/ruleName`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import AccessAnalyzer ArchiveRule using the `analyzerName/ruleName`. For example:
+
+```console
+% terraform import aws_accessanalyzer_archive_rule.example example-analyzer/example-rule
+```
+
+<!-- cache-key: cdktf-0.18.0 input-6c3a5ffb045f96a752c714c3e446067414c5c96251a4373be0b926978dc5643a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/account_alternate_contact.html.markdown b/website/docs/cdktf/typescript/r/account_alternate_contact.html.markdown
new file mode 100644
index 00000000000..bdf0fb1a257
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/account_alternate_contact.html.markdown
@@ -0,0 +1,110 @@
+---
+subcategory: "Account Management"
+layout: "aws"
+page_title: "AWS: aws_account_alternate_contact"
+description: |-
+  Manages the specified alternate contact attached to an AWS Account.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_account_alternate_contact
+
+Manages the specified alternate contact attached to an AWS Account.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AccountAlternateContact } from "./.gen/providers/aws/account-alternate-contact";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AccountAlternateContact(this, "operations", {
+      alternateContactType: "OPERATIONS",
+      emailAddress: "test@example.com",
+      name: "Example",
+      phoneNumber: "+1234567890",
+      title: "Example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `accountId` - (Optional) ID of the target account when managing member accounts. Will manage current user's account by default if omitted.
+* `alternateContactType` - (Required) Type of the alternate contact. Allowed values are: `billing`, `operations`, `security`.
+* `emailAddress` - (Required) An email address for the alternate contact.
+* `name` - (Required) Name of the alternate contact.
+* `phoneNumber` - (Required) Phone number for the alternate contact.
+* `title` - (Required) Title for the alternate contact.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `5M`)
+- `update` - (Default `5M`)
+- `delete` - (Default `5M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import the Alternate Contact for the current or another account using the `alternateContactType`. For example:
+
+Import the Alternate Contact for the current account:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Import the Alternate Contact for another account using the `accountId` and `alternateContactType` separated by a forward slash (`/`):
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+**Using `terraform import` to import** the Alternate Contact for the current or another account using the `alternateContactType`. For example:
+
+Import the Alternate Contact for the current account:
+
+```console
+% terraform import aws_account_alternate_contact.operations OPERATIONS
+```
+
+Import the Alternate Contact for another account using the `accountId` and `alternateContactType` separated by a forward slash (`/`):
+
+```console
+% terraform import aws_account_alternate_contact.operations 1234567890/OPERATIONS
+```
+
+<!-- cache-key: cdktf-0.18.0 input-03bffb9572a9af37cd374a887e8789217031dddd609768f253119fb07d95935d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/account_primary_contact.html.markdown b/website/docs/cdktf/typescript/r/account_primary_contact.html.markdown
new file mode 100644
index 00000000000..4734898609c
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/account_primary_contact.html.markdown
@@ -0,0 +1,90 @@
+---
+subcategory: "Account Management"
+layout: "aws"
+page_title: "AWS: aws_account_primary_contact"
+description: |-
+  Manages the specified primary contact information associated with an AWS Account.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_account_primary_contact
+
+Manages the specified primary contact information associated with an AWS Account.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AccountPrimaryContact } from "./.gen/providers/aws/account-primary-contact";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AccountPrimaryContact(this, "test", {
+      addressLine1: "123 Any Street",
+      city: "Seattle",
+      companyName: "Example Corp, Inc.",
+      countryCode: "US",
+      districtOrCounty: "King",
+      fullName: "My Name",
+      phoneNumber: "+64211111111",
+      postalCode: "98101",
+      stateOrRegion: "WA",
+      websiteUrl: "https://www.examplecorp.com",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `accountId` - (Optional) The ID of the target account when managing member accounts. Will manage current user's account by default if omitted.
+* `addressLine1` - (Required) The first line of the primary contact address.
+* `addressLine2` - (Optional) The second line of the primary contact address, if any.
+* `addressLine3` - (Optional) The third line of the primary contact address, if any.
+* `city` - (Required) The city of the primary contact address.
+* `companyName` - (Optional) The name of the company associated with the primary contact information, if any.
+* `countryCode` - (Required) The ISO-3166 two-letter country code for the primary contact address.
+* `districtOrCounty` - (Optional) The district or county of the primary contact address, if any.
+* `fullName` - (Required) The full name of the primary contact address.
+* `phoneNumber` - (Required) The phone number of the primary contact information. The number will be validated and, in some countries, checked for activation.
+* `postalCode` - (Required) The postal code of the primary contact address.
+* `stateOrRegion` - (Optional) The state or region of the primary contact address. This field is required in selected countries.
+* `websiteUrl` - (Optional) The URL of the website associated with the primary contact information, if any.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import the Primary Contact using the `accountId`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import the Primary Contact using the `accountId`. For example:
+
+```console
+% terraform import aws_account_primary_contact.test 1234567890
+```
+
+<!-- cache-key: cdktf-0.18.0 input-851429f776e6267c98084e58a5ee924b91d3bd11d2fa3463d9a57ae674b83986 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/acm_certificate.html.markdown b/website/docs/cdktf/typescript/r/acm_certificate.html.markdown
new file mode 100644
index 00000000000..b8727a7711b
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/acm_certificate.html.markdown
@@ -0,0 +1,304 @@
+---
+subcategory: "ACM (Certificate Manager)"
+layout: "aws"
+page_title: "AWS: aws_acm_certificate"
+description: |-
+  Requests and manages a certificate from Amazon Certificate Manager (ACM).
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_acm_certificate
+
+The ACM certificate resource allows requesting and management of certificates
+from the Amazon Certificate Manager.
+
+ACM certificates can be created in three ways:
+Amazon-issued, where AWS provides the certificate authority and automatically manages renewal;
+imported certificates, issued by another certificate authority;
+and private certificates, issued using an ACM Private Certificate Authority.
+
+## Amazon-Issued Certificates
+
+For Amazon-issued certificates, this resource deals with requesting certificates and managing their attributes and life-cycle.
+This resource does not deal with validation of a certificate but can provide inputs
+for other resources implementing the validation.
+It does not wait for a certificate to be issued.
+Use a [`awsAcmCertificateValidation`](acm_certificate_validation.html) resource for this.
+
+Most commonly, this resource is used together with [`awsRoute53Record`](route53_record.html) and
+[`awsAcmCertificateValidation`](acm_certificate_validation.html) to request a DNS validated certificate,
+deploy the required validation records and wait for validation to complete.
+
+Domain validation through email is also supported but should be avoided as it requires a manual step outside of Terraform.
+
+It's recommended to specify `create_before_destroy = true` in a [lifecycle][1] block to replace a certificate
+which is currently in use (eg, by [`awsLbListener`](lb_listener.html)).
+
+## Certificates Imported from Other Certificate Authority
+
+Imported certificates can be used to make certificates created with an external certificate authority available for AWS services.
+
+As they are not managed by AWS, imported certificates are not eligible for automatic renewal.
+New certificate materials can be supplied to an existing imported certificate to update it in place.
+
+## Private Certificates
+
+Private certificates are issued by an ACM Private Cerificate Authority, which can be created using the resource type [`awsAcmpcaCertificateAuthority`](acmpca_certificate_authority.html).
+
+Private certificates created using this resource are eligible for managed renewal if they have been exported or associated with another AWS service.
+See [managed renewal documentation](https://docs.aws.amazon.com/acm/latest/userguide/managed-renewal.html) for more information.
+By default, a certificate is valid for 395 days and the managed renewal process will start 60 days before expiration.
+To renew the certificate earlier than 60 days before expiration, configure `earlyRenewalDuration`.
+
+## Example Usage
+
+### Create Certificate
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AcmCertificate } from "./.gen/providers/aws/acm-certificate";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AcmCertificate(this, "cert", {
+      domainName: "example.com",
+      lifecycle: {
+        createBeforeDestroy: true,
+      },
+      tags: {
+        Environment: "test",
+      },
+      validationMethod: "DNS",
+    });
+  }
+}
+
+```
+
+### Custom Domain Validation Options
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AcmCertificate } from "./.gen/providers/aws/acm-certificate";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AcmCertificate(this, "cert", {
+      domainName: "testing.example.com",
+      validationMethod: "EMAIL",
+      validationOption: [
+        {
+          domainName: "testing.example.com",
+          validationDomain: "example.com",
+        },
+      ],
+    });
+  }
+}
+
+```
+
+### Existing Certificate Body Import
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AcmCertificate } from "./.gen/providers/aws/acm-certificate";
+import { PrivateKey } from "./.gen/providers/tls/private-key";
+import { SelfSignedCert } from "./.gen/providers/tls/self-signed-cert";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    /*The following providers are missing schema information and might need manual adjustments to synthesize correctly: tls.
+    For a more precise conversion please use the --provider flag in convert.*/
+    const example = new PrivateKey(this, "example", {
+      algorithm: "RSA",
+    });
+    const tlsSelfSignedCertExample = new SelfSignedCert(this, "example_1", {
+      allowed_uses: ["key_encipherment", "digital_signature", "server_auth"],
+      key_algorithm: "RSA",
+      private_key_pem: example.privateKeyPem,
+      subject: [
+        {
+          common_name: "example.com",
+          organization: "ACME Examples, Inc",
+        },
+      ],
+      validity_period_hours: 12,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    tlsSelfSignedCertExample.overrideLogicalId("example");
+    new AcmCertificate(this, "cert", {
+      certificateBody: Token.asString(tlsSelfSignedCertExample.certPem),
+      privateKey: Token.asString(example.privateKeyPem),
+    });
+  }
+}
+
+```
+
+### Referencing domain_validation_options With for_each Based Resources
+
+See the [`awsAcmCertificateValidation` resource](acm_certificate_validation.html) for a full example of performing DNS validation.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformIterator, Fn, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Route53Record } from "./.gen/providers/aws/route53-record";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    /*In most cases loops should be handled in the programming language context and 
+    not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+    you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+    you need to keep this like it is.*/
+    const exampleForEachIterator = TerraformIterator.fromList(
+      Token.asAny(
+        "${{ for dvo in ${" +
+          awsAcmCertificateExample.domainValidationOptions +
+          "} : dvo.domain_name => {\n      name   = dvo.resource_record_name\n      record = dvo.resource_record_value\n      type   = dvo.resource_record_type\n    }}}"
+      )
+    );
+    new Route53Record(this, "example", {
+      allowOverwrite: true,
+      name: Token.asString(
+        Fn.lookupNested(exampleForEachIterator.value, ["name"])
+      ),
+      records: [
+        Token.asString(
+          Fn.lookupNested(exampleForEachIterator.value, ["record"])
+        ),
+      ],
+      ttl: 60,
+      type: Token.asString(
+        Fn.lookupNested(exampleForEachIterator.value, ["type"])
+      ),
+      zoneId: Token.asString(awsRoute53ZoneExample.zoneId),
+      forEach: exampleForEachIterator,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* Creating an Amazon issued certificate
+    * `domainName` - (Required) Domain name for which the certificate should be issued
+    * `subjectAlternativeNames` - (Optional) Set of domains that should be SANs in the issued certificate. To remove all elements of a previously configured list, set this value equal to an empty list (`[]`) or use the [`terraform taint` command](https://www.terraform.io/docs/commands/taint.html) to trigger recreation.
+    * `validationMethod` - (Optional) Which method to use for validation. `dns` or `email` are valid. This parameter must not be set for certificates that were imported into ACM and then into Terraform.
+    * `keyAlgorithm` - (Optional) Specifies the algorithm of the public and private key pair that your Amazon issued certificate uses to encrypt data. See [ACM Certificate characteristics](https://docs.aws.amazon.com/acm/latest/userguide/acm-certificate.html#algorithms) for more details.
+    * `options` - (Optional) Configuration block used to set certificate options. Detailed below.
+    * `validationOption` - (Optional) Configuration block used to specify information about the initial validation of each domain name. Detailed below.
+* Importing an existing certificate
+    * `privateKey` - (Required) Certificate's PEM-formatted private key
+    * `certificateBody` - (Required) Certificate's PEM-formatted public key
+    * `certificateChain` - (Optional) Certificate's PEM-formatted chain
+* Creating a private CA issued certificate
+    * `certificateAuthorityArn` - (Required) ARN of an ACM PCA
+    * `domainName` - (Required) Domain name for which the certificate should be issued.
+    * `earlyRenewalDuration` - (Optional) Amount of time to start automatic renewal process before expiration.
+      Has no effect if less than 60 days.
+      Represented by either
+      a subset of [RFC 3339 duration](https://www.rfc-editor.org/rfc/rfc3339) supporting years, months, and days (e.g., `p90D`),
+      or a string such as `2160H`.
+* `subjectAlternativeNames` - (Optional) Set of domains that should be SANs in the issued certificate.
+  To remove all elements of a previously configured list, set this value equal to an empty list (`[]`)
+  or use the [`terraform taint` command](https://www.terraform.io/docs/commands/taint.html) to trigger recreation.
+* `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## options Configuration Block
+
+Supported nested arguments for the `options` configuration block:
+
+* `certificateTransparencyLoggingPreference` - (Optional) Whether certificate details should be added to a certificate transparency log. Valid values are `enabled` or `disabled`. See https://docs.aws.amazon.com/acm/latest/userguide/acm-concepts.html#concept-transparency for more details.
+
+## validation_option Configuration Block
+
+Supported nested arguments for the `validationOption` configuration block:
+
+* `domainName` - (Required) Fully qualified domain name (FQDN) in the certificate.
+* `validationDomain` - (Required) Domain name that you want ACM to use to send you validation emails. This domain name is the suffix of the email addresses that you want ACM to use. This must be the same as the `domainName` value or a superdomain of the `domainName` value. For example, if you request a certificate for `"testingExampleCom"`, you can specify `"exampleCom"` for this value.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - ARN of the certificate
+* `arn` - ARN of the certificate
+* `domainName` - Domain name for which the certificate is issued
+* `domainValidationOptions` - Set of domain validation objects which can be used to complete certificate validation.
+  Can have more than one element, e.g., if SANs are defined.
+  Only set if `dns`-validation was used.
+* `notAfter` - Expiration date and time of the certificate.
+* `notBefore` - Start of the validity period of the certificate.
+* `pendingRenewal` - `true` if a Private certificate eligible for managed renewal is within the `earlyRenewalDuration` period.
+* `renewalEligibility` - Whether the certificate is eligible for managed renewal.
+* `renewalSummary` - Contains information about the status of ACM's [managed renewal](https://docs.aws.amazon.com/acm/latest/userguide/acm-renewal.html) for the certificate.
+* `status` - Status of the certificate.
+* `type` - Source of the certificate.
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `validationEmails` - List of addresses that received a validation email. Only set if `email` validation was used.
+
+Domain validation objects export the following attributes:
+
+* `domainName` - Domain to be validated
+* `resourceRecordName` - The name of the DNS record to create to validate the certificate
+* `resourceRecordType` - The type of DNS record to create
+* `resourceRecordValue` - The value the DNS record needs to have
+
+Renewal summary objects export the following attributes:
+
+* `renewalStatus` - The status of ACM's managed renewal of the certificate
+* `renewalStatusReason` - The reason that a renewal request was unsuccessful or is pending
+
+[1]: https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import certificates using their ARN. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import certificates using their ARN. For example:
+
+```console
+% terraform import aws_acm_certificate.cert arn:aws:acm:eu-central-1:123456789012:certificate/7e7a28d2-163f-4b8f-b9cd-822f96c08d6a
+```
+
+<!-- cache-key: cdktf-0.18.0 input-e4c3a7735ec99f4007d8e7e7e89139f9d730f0e5d51221b59505955d1de5da60 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/acm_certificate_validation.html.markdown b/website/docs/cdktf/typescript/r/acm_certificate_validation.html.markdown
new file mode 100644
index 00000000000..2eb70ac9933
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/acm_certificate_validation.html.markdown
@@ -0,0 +1,267 @@
+---
+subcategory: "ACM (Certificate Manager)"
+layout: "aws"
+page_title: "AWS: aws_acm_certificate_validation"
+description: |-
+  Waits for and checks successful validation of an ACM certificate.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_acm_certificate_validation
+
+This resource represents a successful validation of an ACM certificate in concert
+with other resources.
+
+Most commonly, this resource is used together with [`awsRoute53Record`](route53_record.html) and
+[`awsAcmCertificate`](acm_certificate.html) to request a DNS validated certificate,
+deploy the required validation records and wait for validation to complete.
+
+~> **WARNING:** This resource implements a part of the validation workflow. It does not represent a real-world entity in AWS, therefore changing or deleting this resource on its own has no immediate effect.
+
+## Example Usage
+
+### DNS Validation with Route 53
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformIterator, Fn, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AcmCertificate } from "./.gen/providers/aws/acm-certificate";
+import { AcmCertificateValidation } from "./.gen/providers/aws/acm-certificate-validation";
+import { DataAwsRoute53Zone } from "./.gen/providers/aws/data-aws-route53-zone";
+import { LbListener } from "./.gen/providers/aws/lb-listener";
+import { Route53Record } from "./.gen/providers/aws/route53-record";
+interface MyConfig {
+  defaultAction: any;
+  loadBalancerArn: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    const example = new AcmCertificate(this, "example", {
+      domainName: "example.com",
+      validationMethod: "DNS",
+    });
+    const dataAwsRoute53ZoneExample = new DataAwsRoute53Zone(
+      this,
+      "example_1",
+      {
+        name: "example.com",
+        privateZone: false,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsRoute53ZoneExample.overrideLogicalId("example");
+    /*In most cases loops should be handled in the programming language context and 
+    not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+    you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+    you need to keep this like it is.*/
+    const exampleForEachIterator = TerraformIterator.fromList(
+      Token.asAny(
+        "${{ for dvo in ${" +
+          example.domainValidationOptions +
+          "} : dvo.domain_name => {\n      name   = dvo.resource_record_name\n      record = dvo.resource_record_value\n      type   = dvo.resource_record_type\n    }}}"
+      )
+    );
+    const awsRoute53RecordExample = new Route53Record(this, "example_2", {
+      allowOverwrite: true,
+      name: Token.asString(
+        Fn.lookupNested(exampleForEachIterator.value, ["name"])
+      ),
+      records: [
+        Token.asString(
+          Fn.lookupNested(exampleForEachIterator.value, ["record"])
+        ),
+      ],
+      ttl: 60,
+      type: Token.asString(
+        Fn.lookupNested(exampleForEachIterator.value, ["type"])
+      ),
+      zoneId: Token.asString(dataAwsRoute53ZoneExample.zoneId),
+      forEach: exampleForEachIterator,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsRoute53RecordExample.overrideLogicalId("example");
+    const awsAcmCertificateValidationExample = new AcmCertificateValidation(
+      this,
+      "example_3",
+      {
+        certificateArn: example.arn,
+        validationRecordFqdns: Token.asList(
+          "${[ for record in ${" +
+            awsRoute53RecordExample.fqn +
+            "} : record.fqdn]}"
+        ),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsAcmCertificateValidationExample.overrideLogicalId("example");
+    const awsLbListenerExample = new LbListener(this, "example_4", {
+      certificateArn: Token.asString(
+        awsAcmCertificateValidationExample.certificateArn
+      ),
+      defaultAction: config.defaultAction,
+      loadBalancerArn: config.loadBalancerArn,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsLbListenerExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### Alternative Domains DNS Validation with Route 53
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformIterator, Fn, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AcmCertificate } from "./.gen/providers/aws/acm-certificate";
+import { AcmCertificateValidation } from "./.gen/providers/aws/acm-certificate-validation";
+import { DataAwsRoute53Zone } from "./.gen/providers/aws/data-aws-route53-zone";
+import { LbListener } from "./.gen/providers/aws/lb-listener";
+import { Route53Record } from "./.gen/providers/aws/route53-record";
+interface MyConfig {
+  defaultAction: any;
+  loadBalancerArn: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    const example = new AcmCertificate(this, "example", {
+      domainName: "example.com",
+      subjectAlternativeNames: ["www.example.com", "example.org"],
+      validationMethod: "DNS",
+    });
+    /*In most cases loops should be handled in the programming language context and 
+    not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+    you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+    you need to keep this like it is.*/
+    const exampleForEachIterator = TerraformIterator.fromList(
+      Token.asAny(
+        "${{ for dvo in ${" +
+          example.domainValidationOptions +
+          '} : dvo.domain_name => {\n      name    = dvo.resource_record_name\n      record  = dvo.resource_record_value\n      type    = dvo.resource_record_type\n      zone_id = dvo.domain_name == "example.org" ? data.aws_route53_zone.example_org.zone_id : data.aws_route53_zone.example_com.zone_id\n    }}}'
+      )
+    );
+    const awsRoute53RecordExample = new Route53Record(this, "example_1", {
+      allowOverwrite: true,
+      name: Token.asString(
+        Fn.lookupNested(exampleForEachIterator.value, ["name"])
+      ),
+      records: [
+        Token.asString(
+          Fn.lookupNested(exampleForEachIterator.value, ["record"])
+        ),
+      ],
+      ttl: 60,
+      type: Token.asString(
+        Fn.lookupNested(exampleForEachIterator.value, ["type"])
+      ),
+      zoneId: Token.asString(
+        Fn.lookupNested(exampleForEachIterator.value, ["zone_id"])
+      ),
+      forEach: exampleForEachIterator,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsRoute53RecordExample.overrideLogicalId("example");
+    new DataAwsRoute53Zone(this, "example_com", {
+      name: "example.com",
+      privateZone: false,
+    });
+    new DataAwsRoute53Zone(this, "example_org", {
+      name: "example.org",
+      privateZone: false,
+    });
+    const awsAcmCertificateValidationExample = new AcmCertificateValidation(
+      this,
+      "example_4",
+      {
+        certificateArn: example.arn,
+        validationRecordFqdns: Token.asList(
+          "${[ for record in ${" +
+            awsRoute53RecordExample.fqn +
+            "} : record.fqdn]}"
+        ),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsAcmCertificateValidationExample.overrideLogicalId("example");
+    const awsLbListenerExample = new LbListener(this, "example_5", {
+      certificateArn: Token.asString(
+        awsAcmCertificateValidationExample.certificateArn
+      ),
+      defaultAction: config.defaultAction,
+      loadBalancerArn: config.loadBalancerArn,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsLbListenerExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### Email Validation
+
+In this situation, the resource is simply a waiter for manual email approval of ACM certificates.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AcmCertificate } from "./.gen/providers/aws/acm-certificate";
+import { AcmCertificateValidation } from "./.gen/providers/aws/acm-certificate-validation";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new AcmCertificate(this, "example", {
+      domainName: "example.com",
+      validationMethod: "EMAIL",
+    });
+    const awsAcmCertificateValidationExample = new AcmCertificateValidation(
+      this,
+      "example_1",
+      {
+        certificateArn: example.arn,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsAcmCertificateValidationExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `certificateArn` - (Required) ARN of the certificate that is being validated.
+* `validationRecordFqdns` - (Optional) List of FQDNs that implement the validation. Only valid for DNS validation method ACM certificates. If this is set, the resource can implement additional sanity checks and has an explicit dependency on the resource that is implementing the validation
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Time at which the certificate was issued
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `75M`)
+
+<!-- cache-key: cdktf-0.18.0 input-bd8c04ee824aa9ba9e41a615796c1554d255a22e9d0a9dd833af77b9c40bb301 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/acmpca_certificate.html.markdown b/website/docs/cdktf/typescript/r/acmpca_certificate.html.markdown
new file mode 100644
index 00000000000..92e238f700c
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/acmpca_certificate.html.markdown
@@ -0,0 +1,139 @@
+---
+subcategory: "ACM PCA (Certificate Manager Private Certificate Authority)"
+layout: "aws"
+page_title: "AWS: aws_acmpca_certificate"
+description: |-
+  Provides a resource to issue a certificate using AWS Certificate Manager Private Certificate Authority (ACM PCA)
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_acmpca_certificate
+
+Provides a resource to issue a certificate using AWS Certificate Manager Private Certificate Authority (ACM PCA).
+
+Certificates created using `awsAcmpcaCertificate` are not eligible for automatic renewal,
+and must be replaced instead.
+To issue a renewable certificate using an ACM PCA, create a [`awsAcmCertificate`](acm_certificate.html)
+with the parameter `certificateAuthorityArn`.
+
+## Example Usage
+
+### Basic
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AcmpcaCertificate } from "./.gen/providers/aws/acmpca-certificate";
+import { AcmpcaCertificateAuthority } from "./.gen/providers/aws/acmpca-certificate-authority";
+import { CertRequest } from "./.gen/providers/tls/cert-request";
+import { PrivateKey } from "./.gen/providers/tls/private-key";
+interface MyConfig {
+  certificateAuthorityConfiguration: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    /*The following providers are missing schema information and might need manual adjustments to synthesize correctly: tls.
+    For a more precise conversion please use the --provider flag in convert.*/
+    const example = new AcmpcaCertificateAuthority(this, "example", {
+      permanentDeletionTimeInDays: 7,
+      private_certificate_configuration: [
+        {
+          key_algorithm: "RSA_4096",
+          signing_algorithm: "SHA512WITHRSA",
+          subject: [
+            {
+              common_name: "example.com",
+            },
+          ],
+        },
+      ],
+      certificateAuthorityConfiguration:
+        config.certificateAuthorityConfiguration,
+    });
+    const key = new PrivateKey(this, "key", {
+      algorithm: "RSA",
+    });
+    const csr = new CertRequest(this, "csr", {
+      key_algorithm: "RSA",
+      private_key_pem: key.privateKeyPem,
+      subject: [
+        {
+          common_name: "example",
+        },
+      ],
+    });
+    const awsAcmpcaCertificateExample = new AcmpcaCertificate(
+      this,
+      "example_3",
+      {
+        certificateAuthorityArn: example.arn,
+        certificateSigningRequest: Token.asString(csr.certRequestPem),
+        signingAlgorithm: "SHA256WITHRSA",
+        validity: {
+          type: "YEARS",
+          value: Token.asString(1),
+        },
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsAcmpcaCertificateExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `certificateAuthorityArn` - (Required) ARN of the certificate authority.
+* `certificateSigningRequest` - (Required) Certificate Signing Request in PEM format.
+* `signingAlgorithm` - (Required) Algorithm to use to sign certificate requests. Valid values: `sha256Withrsa`, `sha256Withecdsa`, `sha384Withrsa`, `sha384Withecdsa`, `sha512Withrsa`, `sha512Withecdsa`.
+* `validity` - (Required) Configures end of the validity period for the certificate. See [validity block](#validity-block) below.
+* `templateArn` - (Optional) Template to use when issuing a certificate.
+  See [ACM PCA Documentation](https://docs.aws.amazon.com/privateca/latest/userguide/UsingTemplates.html) for more information.
+* `apiPassthrough` - (Optional) Specifies X.509 certificate information to be included in the issued certificate. To use with API Passthrough templates
+
+### validity block
+
+* `type` - (Required) Determines how `value` is interpreted. Valid values: `days`, `months`, `years`, `absolute`, `endDate`.
+* `value` - (Required) If `type` is `days`, `months`, or `years`, the relative time until the certificate expires. If `type` is `absolute`, the date in seconds since the Unix epoch. If `type` is `endDate`, the  date in RFC 3339 format.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the certificate.
+* `certificate` - PEM-encoded certificate value.
+* `certificateChain` - PEM-encoded certificate chain that includes any intermediate certificates and chains up to root CA.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import ACM PCA Certificates using their ARN. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import ACM PCA Certificates using their ARN. For example:
+
+```console
+% terraform import aws_acmpca_certificate.cert arn:aws:acm-pca:eu-west-1:675225743824:certificate-authority/08319ede-83g9-1400-8f21-c7d12b2b6edb/certificate/a4e9c2aa4bcfab625g1b9136464cd3a
+```
+
+<!-- cache-key: cdktf-0.18.0 input-3b19b04277da26192985928a772fc7a153a2937210c9952942adad77721165c9 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/acmpca_certificate_authority.html.markdown b/website/docs/cdktf/typescript/r/acmpca_certificate_authority.html.markdown
new file mode 100644
index 00000000000..33a7d00b5c1
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/acmpca_certificate_authority.html.markdown
@@ -0,0 +1,255 @@
+---
+subcategory: "ACM PCA (Certificate Manager Private Certificate Authority)"
+layout: "aws"
+page_title: "AWS: aws_acmpca_certificate_authority"
+description: |-
+  Provides a resource to manage AWS Certificate Manager Private Certificate Authorities
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_acmpca_certificate_authority
+
+Provides a resource to manage AWS Certificate Manager Private Certificate Authorities (ACM PCA Certificate Authorities).
+
+~> **NOTE:** Creating this resource will leave the certificate authority in a `pendingCertificate` status, which means it cannot yet issue certificates. To complete this setup, you must fully sign the certificate authority CSR available in the `certificateSigningRequest` attribute. The [`awsAcmpcaCertificateAuthorityCertificate`](/docs/providers/aws/r/acmpca_certificate_authority_certificate.html) resource can be used for this purpose.
+
+## Example Usage
+
+### Basic
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AcmpcaCertificateAuthority } from "./.gen/providers/aws/acmpca-certificate-authority";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AcmpcaCertificateAuthority(this, "example", {
+      certificateAuthorityConfiguration: {
+        keyAlgorithm: "RSA_4096",
+        signingAlgorithm: "SHA512WITHRSA",
+        subject: {
+          commonName: "example.com",
+        },
+      },
+      permanentDeletionTimeInDays: 7,
+    });
+  }
+}
+
+```
+
+### Short-lived certificate
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AcmpcaCertificateAuthority } from "./.gen/providers/aws/acmpca-certificate-authority";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AcmpcaCertificateAuthority(this, "example", {
+      certificateAuthorityConfiguration: {
+        keyAlgorithm: "RSA_4096",
+        signingAlgorithm: "SHA512WITHRSA",
+        subject: {
+          commonName: "example.com",
+        },
+      },
+      usageMode: "SHORT_LIVED_CERTIFICATE",
+    });
+  }
+}
+
+```
+
+### Enable Certificate Revocation List
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AcmpcaCertificateAuthority } from "./.gen/providers/aws/acmpca-certificate-authority";
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketPolicy } from "./.gen/providers/aws/s3-bucket-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new S3Bucket(this, "example", {
+      bucket: "example",
+      forceDestroy: true,
+    });
+    const acmpcaBucketAccess = new DataAwsIamPolicyDocument(
+      this,
+      "acmpca_bucket_access",
+      {
+        statement: [
+          {
+            actions: [
+              "s3:GetBucketAcl",
+              "s3:GetBucketLocation",
+              "s3:PutObject",
+              "s3:PutObjectAcl",
+            ],
+            principals: [
+              {
+                identifiers: ["acm-pca.amazonaws.com"],
+                type: "Service",
+              },
+            ],
+            resources: [example.arn, "${" + example.arn + "}/*"],
+          },
+        ],
+      }
+    );
+    const awsS3BucketPolicyExample = new S3BucketPolicy(this, "example_2", {
+      bucket: example.id,
+      policy: Token.asString(acmpcaBucketAccess.json),
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketPolicyExample.overrideLogicalId("example");
+    const awsAcmpcaCertificateAuthorityExample = new AcmpcaCertificateAuthority(
+      this,
+      "example_3",
+      {
+        certificateAuthorityConfiguration: {
+          keyAlgorithm: "RSA_4096",
+          signingAlgorithm: "SHA512WITHRSA",
+          subject: {
+            commonName: "example.com",
+          },
+        },
+        dependsOn: [awsS3BucketPolicyExample],
+        revocationConfiguration: {
+          crlConfiguration: {
+            customCname: "crl.example.com",
+            enabled: true,
+            expirationInDays: 7,
+            s3BucketName: example.id,
+            s3ObjectAcl: "BUCKET_OWNER_FULL_CONTROL",
+          },
+        },
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsAcmpcaCertificateAuthorityExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `certificateAuthorityConfiguration` - (Required) Nested argument containing algorithms and certificate subject information. Defined below.
+* `enabled` - (Optional) Whether the certificate authority is enabled or disabled. Defaults to `true`. Can only be disabled if the CA is in an `active` state.
+* `revocationConfiguration` - (Optional) Nested argument containing revocation configuration. Defined below.
+* `usageMode` - (Optional) Specifies whether the CA issues general-purpose certificates that typically require a revocation mechanism, or short-lived certificates that may optionally omit revocation because they expire quickly. Short-lived certificate validity is limited to seven days. Defaults to `generalPurpose`. Valid values: `generalPurpose` and `shortLivedCertificate`.
+* `tags` - (Optional) Key-value map of user-defined tags that are attached to the certificate authority. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `type` - (Optional) Type of the certificate authority. Defaults to `subordinate`. Valid values: `root` and `subordinate`.
+* `keyStorageSecurityStandard` - (Optional) Cryptographic key management compliance standard used for handling CA keys. Defaults to `fips1402Level3OrHigher`. Valid values: `fips1402Level3OrHigher` and `fips1402Level2OrHigher`. Supported standard for each region can be found in the [Storage and security compliance of AWS Private CA private keys Documentation](https://docs.aws.amazon.com/privateca/latest/userguide/data-protection.html#private-keys).
+* `permanentDeletionTimeInDays` - (Optional) Number of days to make a CA restorable after it has been deleted, must be between 7 to 30 days, with default to 30 days.
+
+### certificate_authority_configuration
+
+* `keyAlgorithm` - (Required) Type of the public key algorithm and size, in bits, of the key pair that your key pair creates when it issues a certificate. Valid values can be found in the [ACM PCA Documentation](https://docs.aws.amazon.com/privateca/latest/APIReference/API_CertificateAuthorityConfiguration.html).
+* `signingAlgorithm` - (Required) Name of the algorithm your private CA uses to sign certificate requests. Valid values can be found in the [ACM PCA Documentation](https://docs.aws.amazon.com/privateca/latest/APIReference/API_CertificateAuthorityConfiguration.html).
+* `subject` - (Required) Nested argument that contains X.500 distinguished name information. At least one nested attribute must be specified.
+
+#### subject
+
+Contains information about the certificate subject. Identifies the entity that owns or controls the public key in the certificate. The entity can be a user, computer, device, or service.
+
+* `commonName` - (Optional) Fully qualified domain name (FQDN) associated with the certificate subject. Must be less than or equal to 64 characters in length.
+* `country` - (Optional) Two digit code that specifies the country in which the certificate subject located. Must be less than or equal to 2 characters in length.
+* `distinguishedNameQualifier` - (Optional) Disambiguating information for the certificate subject. Must be less than or equal to 64 characters in length.
+* `generationQualifier` - (Optional) Typically a qualifier appended to the name of an individual. Examples include Jr. for junior, Sr. for senior, and III for third. Must be less than or equal to 3 characters in length.
+* `givenName` - (Optional) First name. Must be less than or equal to 16 characters in length.
+* `initials` - (Optional) Concatenation that typically contains the first letter of the `givenName`, the first letter of the middle name if one exists, and the first letter of the `surname`. Must be less than or equal to 5 characters in length.
+* `locality` - (Optional) Locality (such as a city or town) in which the certificate subject is located. Must be less than or equal to 128 characters in length.
+* `organization` - (Optional) Legal name of the organization with which the certificate subject is affiliated. Must be less than or equal to 64 characters in length.
+* `organizationalUnit` - (Optional) Subdivision or unit of the organization (such as sales or finance) with which the certificate subject is affiliated. Must be less than or equal to 64 characters in length.
+* `pseudonym` - (Optional) Typically a shortened version of a longer `givenName`. For example, Jonathan is often shortened to John. Elizabeth is often shortened to Beth, Liz, or Eliza. Must be less than or equal to 128 characters in length.
+* `state` - (Optional) State in which the subject of the certificate is located. Must be less than or equal to 128 characters in length.
+* `surname` - (Optional) Family name. In the US and the UK for example, the surname of an individual is ordered last. In Asian cultures the surname is typically ordered first. Must be less than or equal to 40 characters in length.
+* `title` - (Optional) Title such as Mr. or Ms. which is pre-pended to the name to refer formally to the certificate subject. Must be less than or equal to 64 characters in length.
+
+### revocation_configuration
+
+* `crlConfiguration` - (Optional) Nested argument containing configuration of the certificate revocation list (CRL), if any, maintained by the certificate authority. Defined below.
+* `ocspConfiguration` - (Optional) Nested argument containing configuration of
+the custom OCSP responder endpoint. Defined below.
+
+#### crl_configuration
+
+* `customCname` - (Optional) Name inserted into the certificate CRL Distribution Points extension that enables the use of an alias for the CRL distribution point. Use this value if you don't want the name of your S3 bucket to be public. Must be less than or equal to 253 characters in length.
+* `enabled` - (Optional) Boolean value that specifies whether certificate revocation lists (CRLs) are enabled. Defaults to `false`.
+* `expirationInDays` - (Optional, Required if `enabled` is `true`) Number of days until a certificate expires. Must be between 1 and 5000.
+* `s3BucketName` - (Optional, Required if `enabled` is `true`) Name of the S3 bucket that contains the CRL. If you do not provide a value for the `customCname` argument, the name of your S3 bucket is placed into the CRL Distribution Points extension of the issued certificate. You must specify a bucket policy that allows ACM PCA to write the CRL to your bucket. Must be between 3 and 255 characters in length.
+* `s3ObjectAcl` - (Optional) Determines whether the CRL will be publicly readable or privately held in the CRL Amazon S3 bucket. Defaults to `publicRead`.
+
+#### ocsp_configuration
+
+* `enabled` - (Required) Boolean value that specifies whether a custom OCSP responder is enabled.
+* `ocspCustomCname` - (Optional) CNAME specifying a customized OCSP domain. Note: The value of the CNAME must not include a protocol prefix such as "http://" or "https://".
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - ARN of the certificate authority.
+* `arn` - ARN of the certificate authority.
+* `certificate` - Base64-encoded certificate authority (CA) certificate. Only available after the certificate authority certificate has been imported.
+* `certificateChain` - Base64-encoded certificate chain that includes any intermediate certificates and chains up to root on-premises certificate that you used to sign your private CA certificate. The chain does not include your private CA certificate. Only available after the certificate authority certificate has been imported.
+* `certificateSigningRequest` - The base64 PEM-encoded certificate signing request (CSR) for your private CA certificate.
+* `notAfter` - Date and time after which the certificate authority is not valid. Only available after the certificate authority certificate has been imported.
+* `notBefore` - Date and time before which the certificate authority is not valid. Only available after the certificate authority certificate has been imported.
+* `serial` - Serial number of the certificate authority. Only available after the certificate authority certificate has been imported.
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `1M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsAcmpcaCertificateAuthority` using the certificate authority ARN. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsAcmpcaCertificateAuthority` using the certificate authority ARN. For example:
+
+```console
+% terraform import aws_acmpca_certificate_authority.example arn:aws:acm-pca:us-east-1:123456789012:certificate-authority/12345678-1234-1234-1234-123456789012
+```
+
+<!-- cache-key: cdktf-0.18.0 input-fb883601ee6544ef5b22499a07d5189a537b1a4c7dcbb9cd6e3997945ee21f4d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/acmpca_certificate_authority_certificate.html.markdown b/website/docs/cdktf/typescript/r/acmpca_certificate_authority_certificate.html.markdown
new file mode 100644
index 00000000000..8960d9d40ea
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/acmpca_certificate_authority_certificate.html.markdown
@@ -0,0 +1,195 @@
+---
+subcategory: "ACM PCA (Certificate Manager Private Certificate Authority)"
+layout: "aws"
+page_title: "AWS: aws_acmpca_certificate_authority_certificate"
+description: |-
+  Associates a certificate with an AWS Certificate Manager Private Certificate Authority
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_acmpca_certificate_authority_certificate
+
+Associates a certificate with an AWS Certificate Manager Private Certificate Authority (ACM PCA Certificate Authority). An ACM PCA Certificate Authority is unable to issue certificates until it has a certificate associated with it. A root level ACM PCA Certificate Authority is able to self-sign its own root certificate.
+
+## Example Usage
+
+### Self-Signed Root Certificate Authority Certificate
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AcmpcaCertificate } from "./.gen/providers/aws/acmpca-certificate";
+import { AcmpcaCertificateAuthority } from "./.gen/providers/aws/acmpca-certificate-authority";
+import { AcmpcaCertificateAuthorityCertificate } from "./.gen/providers/aws/acmpca-certificate-authority-certificate";
+import { DataAwsPartition } from "./.gen/providers/aws/data-aws-partition";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new AcmpcaCertificateAuthority(this, "example", {
+      certificateAuthorityConfiguration: {
+        keyAlgorithm: "RSA_4096",
+        signingAlgorithm: "SHA512WITHRSA",
+        subject: {
+          commonName: "example.com",
+        },
+      },
+      type: "ROOT",
+    });
+    const current = new DataAwsPartition(this, "current", {});
+    const awsAcmpcaCertificateExample = new AcmpcaCertificate(
+      this,
+      "example_2",
+      {
+        certificateAuthorityArn: example.arn,
+        certificateSigningRequest: example.certificateSigningRequest,
+        signingAlgorithm: "SHA512WITHRSA",
+        templateArn:
+          "arn:${" +
+          current.partition +
+          "}:acm-pca:::template/RootCACertificate/V1",
+        validity: {
+          type: "YEARS",
+          value: Token.asString(1),
+        },
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsAcmpcaCertificateExample.overrideLogicalId("example");
+    const awsAcmpcaCertificateAuthorityCertificateExample =
+      new AcmpcaCertificateAuthorityCertificate(this, "example_3", {
+        certificate: Token.asString(awsAcmpcaCertificateExample.certificate),
+        certificateAuthorityArn: example.arn,
+        certificateChain: Token.asString(
+          awsAcmpcaCertificateExample.certificateChain
+        ),
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsAcmpcaCertificateAuthorityCertificateExample.overrideLogicalId(
+      "example"
+    );
+  }
+}
+
+```
+
+### Certificate for Subordinate Certificate Authority
+
+Note that the certificate for the subordinate certificate authority must be issued by the root certificate authority using a signing request from the subordinate certificate authority.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AcmpcaCertificate } from "./.gen/providers/aws/acmpca-certificate";
+import { AcmpcaCertificateAuthority } from "./.gen/providers/aws/acmpca-certificate-authority";
+import { AcmpcaCertificateAuthorityCertificate } from "./.gen/providers/aws/acmpca-certificate-authority-certificate";
+import { DataAwsPartition } from "./.gen/providers/aws/data-aws-partition";
+interface MyConfig {
+  certificateAuthorityArn: any;
+  certificateSigningRequest: any;
+  signingAlgorithm: any;
+  validity: any;
+  certificateAuthorityConfiguration: any;
+  certificate: any;
+  certificateAuthorityArn1: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new AcmpcaCertificate(this, "root", {
+      certificateAuthorityArn: config.certificateAuthorityArn,
+      certificateSigningRequest: config.certificateSigningRequest,
+      signingAlgorithm: config.signingAlgorithm,
+      validity: config.validity,
+    });
+    const awsAcmpcaCertificateAuthorityRoot = new AcmpcaCertificateAuthority(
+      this,
+      "root_1",
+      {
+        certificateAuthorityConfiguration:
+          config.certificateAuthorityConfiguration,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsAcmpcaCertificateAuthorityRoot.overrideLogicalId("root");
+    const subordinate = new AcmpcaCertificateAuthority(this, "subordinate", {
+      certificateAuthorityConfiguration: {
+        keyAlgorithm: "RSA_2048",
+        signingAlgorithm: "SHA512WITHRSA",
+        subject: {
+          commonName: "sub.example.com",
+        },
+      },
+      type: "SUBORDINATE",
+    });
+    const awsAcmpcaCertificateAuthorityCertificateRoot =
+      new AcmpcaCertificateAuthorityCertificate(this, "root_3", {
+        certificate: config.certificate,
+        certificateAuthorityArn: config.certificateAuthorityArn1,
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsAcmpcaCertificateAuthorityCertificateRoot.overrideLogicalId("root");
+    const current = new DataAwsPartition(this, "current", {});
+    const awsAcmpcaCertificateSubordinate = new AcmpcaCertificate(
+      this,
+      "subordinate_5",
+      {
+        certificateAuthorityArn: Token.asString(
+          awsAcmpcaCertificateAuthorityRoot.arn
+        ),
+        certificateSigningRequest: subordinate.certificateSigningRequest,
+        signingAlgorithm: "SHA512WITHRSA",
+        templateArn:
+          "arn:${" +
+          current.partition +
+          "}:acm-pca:::template/SubordinateCACertificate_PathLen0/V1",
+        validity: {
+          type: "YEARS",
+          value: Token.asString(1),
+        },
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsAcmpcaCertificateSubordinate.overrideLogicalId("subordinate");
+    const awsAcmpcaCertificateAuthorityCertificateSubordinate =
+      new AcmpcaCertificateAuthorityCertificate(this, "subordinate_6", {
+        certificate: Token.asString(
+          awsAcmpcaCertificateSubordinate.certificate
+        ),
+        certificateAuthorityArn: subordinate.arn,
+        certificateChain: Token.asString(
+          awsAcmpcaCertificateSubordinate.certificateChain
+        ),
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsAcmpcaCertificateAuthorityCertificateSubordinate.overrideLogicalId(
+      "subordinate"
+    );
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `certificate` - (Required) PEM-encoded certificate for the Certificate Authority.
+* `certificateAuthorityArn` - (Required) ARN of the Certificate Authority.
+* `certificateChain` - (Optional) PEM-encoded certificate chain that includes any intermediate certificates and chains up to root CA. Required for subordinate Certificate Authorities. Not allowed for root Certificate Authorities.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+<!-- cache-key: cdktf-0.18.0 input-b19572b64df23c019471d3a64aa69d43a5eea5523748112a7c2283e9d3f7b724 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/acmpca_permission.html.markdown b/website/docs/cdktf/typescript/r/acmpca_permission.html.markdown
new file mode 100644
index 00000000000..6fd0338dfcc
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/acmpca_permission.html.markdown
@@ -0,0 +1,67 @@
+---
+subcategory: "ACM PCA (Certificate Manager Private Certificate Authority)"
+layout: "aws"
+page_title: "AWS: aws_acmpca_permission"
+description: |-
+  Provides a resource to manage an AWS Certificate Manager Private Certificate Authorities Permission
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_acmpca_permission
+
+Provides a resource to manage an AWS Certificate Manager Private Certificate Authorities Permission.
+Currently, this is only required in order to allow the ACM service to automatically renew certificates issued by a PCA.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AcmpcaCertificateAuthority } from "./.gen/providers/aws/acmpca-certificate-authority";
+import { AcmpcaPermission } from "./.gen/providers/aws/acmpca-permission";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new AcmpcaCertificateAuthority(this, "example", {
+      certificateAuthorityConfiguration: {
+        keyAlgorithm: "RSA_4096",
+        signingAlgorithm: "SHA512WITHRSA",
+        subject: {
+          commonName: "example.com",
+        },
+      },
+    });
+    const awsAcmpcaPermissionExample = new AcmpcaPermission(this, "example_1", {
+      actions: ["IssueCertificate", "GetCertificate", "ListPermissions"],
+      certificateAuthorityArn: example.arn,
+      principal: "acm.amazonaws.com",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsAcmpcaPermissionExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `certificateAuthorityArn` - (Required) ARN of the CA that grants the permissions.
+* `actions` - (Required) Actions that the specified AWS service principal can use. These include `issueCertificate`, `getCertificate`, and `listPermissions`. Note that in order for ACM to automatically rotate certificates issued by a PCA, it must be granted permission on all 3 actions, as per the example above.
+* `principal` - (Required) AWS service or identity that receives the permission. At this time, the only valid principal is `acmAmazonawsCom`.
+* `sourceAccount` - (Optional) ID of the calling account
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `policy` - IAM policy that is associated with the permission.
+
+<!-- cache-key: cdktf-0.18.0 input-494bcc5d28fd45281186122cb5e3ebdff619ec5306af716d4d8172805c2c661d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/acmpca_policy.html.markdown b/website/docs/cdktf/typescript/r/acmpca_policy.html.markdown
new file mode 100644
index 00000000000..ac3bce3213c
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/acmpca_policy.html.markdown
@@ -0,0 +1,117 @@
+---
+subcategory: "ACM PCA (Certificate Manager Private Certificate Authority)"
+layout: "aws"
+page_title: "AWS: aws_acmpca_policy"
+description: |-
+  Attaches a resource based policy to an AWS Certificate Manager Private Certificate Authority (ACM PCA)
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_acmpca_policy
+
+Attaches a resource based policy to a private CA.
+
+## Example Usage
+
+### Basic
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AcmpcaPolicy } from "./.gen/providers/aws/acmpca-policy";
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new DataAwsIamPolicyDocument(this, "example", {
+      statement: [
+        {
+          actions: [
+            "acm-pca:DescribeCertificateAuthority",
+            "acm-pca:GetCertificate",
+            "acm-pca:GetCertificateAuthorityCertificate",
+            "acm-pca:ListPermissions",
+            "acm-pca:ListTags",
+          ],
+          effect: "Allow",
+          principals: [
+            {
+              identifiers: [Token.asString(current.accountId)],
+              type: "AWS",
+            },
+          ],
+          resources: [Token.asString(awsAcmpcaCertificateAuthorityExample.arn)],
+          sid: "1",
+        },
+        {
+          actions: ["acm-pca:IssueCertificate"],
+          condition: [
+            {
+              test: "StringEquals",
+              values: ["arn:aws:acm-pca:::template/EndEntityCertificate/V1"],
+              variable: "acm-pca:TemplateArn",
+            },
+          ],
+          effect: allow,
+          principals: [
+            {
+              identifiers: [Token.asString(current.accountId)],
+              type: "AWS",
+            },
+          ],
+          resources: [Token.asString(awsAcmpcaCertificateAuthorityExample.arn)],
+          sid: "2",
+        },
+      ],
+    });
+    const awsAcmpcaPolicyExample = new AcmpcaPolicy(this, "example_1", {
+      policy: Token.asString(example.json),
+      resourceArn: Token.asString(awsAcmpcaCertificateAuthorityExample.arn),
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsAcmpcaPolicyExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `resourceArn` - (Required) ARN of the private CA to associate with the policy.
+* `policy` - (Required) JSON-formatted IAM policy to attach to the specified private CA resource.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsAcmpcaPolicy` using the `resourceArn` value. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsAcmpcaPolicy` using the `resourceArn` value. For example:
+
+```console
+% terraform import aws_acmpca_policy.example arn:aws:acm-pca:us-east-1:123456789012:certificate-authority/12345678-1234-1234-1234-123456789012
+```
+
+<!-- cache-key: cdktf-0.18.0 input-3897a945f24b08cf8623246e958727ed8480522a140850c9c8a5a835f4ee024d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ami.html.markdown b/website/docs/cdktf/typescript/r/ami.html.markdown
new file mode 100644
index 00000000000..a696d274a0e
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/ami.html.markdown
@@ -0,0 +1,163 @@
+---
+subcategory: "EC2 (Elastic Compute Cloud)"
+layout: "aws"
+page_title: "AWS: aws_ami"
+description: |-
+  Creates and manages a custom Amazon Machine Image (AMI).
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ami
+
+The AMI resource allows the creation and management of a completely-custom
+*Amazon Machine Image* (AMI).
+
+If you just want to duplicate an existing AMI, possibly copying it to another
+region, it's better to use `awsAmiCopy` instead.
+
+If you just want to share an existing AMI with another AWS account,
+it's better to use `awsAmiLaunchPermission` instead.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Ami } from "./.gen/providers/aws/ami";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Ami(this, "example", {
+      ebsBlockDevice: [
+        {
+          deviceName: "/dev/xvda",
+          snapshotId: "snap-xxxxxxxx",
+          volumeSize: 8,
+        },
+      ],
+      imdsSupport: "v2.0",
+      name: "terraform-example",
+      rootDeviceName: "/dev/xvda",
+      virtualizationType: "hvm",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) Region-unique name for the AMI.
+* `bootMode` - (Optional) Boot mode of the AMI. For more information, see [Boot modes](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ami-boot.html) in the Amazon Elastic Compute Cloud User Guide.
+* `deprecationTime` - (Optional) Date and time to deprecate the AMI. If you specified a value for seconds, Amazon EC2 rounds the seconds to the nearest minute. Valid values: [RFC3339 time string](https://tools.ietf.org/html/rfc3339#section-5.8) (`yyyyMmDdthh:mm:ssz`)
+* `description` - (Optional) Longer, human-readable description for the AMI.
+* `enaSupport` - (Optional) Whether enhanced networking with ENA is enabled. Defaults to `false`.
+* `rootDeviceName` - (Optional) Name of the root device (for example, `/dev/sda1`, or `/dev/xvda`).
+* `virtualizationType` - (Optional) Keyword to choose what virtualization mode created instances
+  will use. Can be either "paravirtual" (the default) or "hvm". The choice of virtualization type
+  changes the set of further arguments that are required, as described below.
+* `architecture` - (Optional) Machine architecture for created instances. Defaults to "x86_64".
+* `ebsBlockDevice` - (Optional) Nested block describing an EBS block device that should be
+  attached to created instances. The structure of this block is described below.
+* `ephemeralBlockDevice` - (Optional) Nested block describing an ephemeral block device that
+  should be attached to created instances. The structure of this block is described below.
+* `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `tpmSupport` - (Optional) If the image is configured for NitroTPM support, the value is `v20`. For more information, see [NitroTPM](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/nitrotpm.html) in the Amazon Elastic Compute Cloud User Guide.
+* `imdsSupport` - (Optional) If EC2 instances started from this image should require the use of the Instance Metadata Service V2 (IMDSv2), set this argument to `v20`. For more information, see [Configure instance metadata options for new instances](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-IMDS-new-instances.html#configure-IMDS-new-instances-ami-configuration).
+
+When `virtualizationType` is "paravirtual" the following additional arguments apply:
+
+* `imageLocation` - (Required) Path to an S3 object containing an image manifest, e.g., created
+  by the `ec2UploadBundle` command in the EC2 command line tools.
+* `kernelId` - (Required) ID of the kernel image (AKI) that will be used as the paravirtual
+  kernel in created instances.
+* `ramdiskId` - (Optional) ID of an initrd image (ARI) that will be used when booting the
+  created instances.
+
+When `virtualizationType` is "hvm" the following additional arguments apply:
+
+* `sriovNetSupport` - (Optional) When set to "simple" (the default), enables enhanced networking
+  for created instances. No other value is supported at this time.
+
+Nested `ebsBlockDevice` blocks have the following structure:
+
+* `deviceName` - (Required) Path at which the device is exposed to created instances.
+* `deleteOnTermination` - (Optional) Boolean controlling whether the EBS volumes created to
+  support each created instance will be deleted once that instance is terminated.
+* `encrypted` - (Optional) Boolean controlling whether the created EBS volumes will be encrypted. Can't be used with `snapshotId`.
+* `iops` - (Required only when `volumeType` is `io1` or `io2`) Number of I/O operations per second the
+  created volumes will support.
+* `snapshotId` - (Optional) ID of an EBS snapshot that will be used to initialize the created
+  EBS volumes. If set, the `volumeSize` attribute must be at least as large as the referenced
+  snapshot.
+* `throughput` - (Optional) Throughput that the EBS volume supports, in MiB/s. Only valid for `volumeType` of `gp3`.
+* `volumeSize` - (Required unless `snapshotId` is set) Size of created volumes in GiB.
+  If `snapshotId` is set and `volumeSize` is omitted then the volume will have the same size
+  as the selected snapshot.
+* `volumeType` - (Optional) Type of EBS volume to create. Can be `standard`, `gp2`, `gp3`, `io1`, `io2`, `sc1` or `st1` (Default: `standard`).
+* `outpostArn` - (Optional) ARN of the Outpost on which the snapshot is stored.
+
+~> **Note:** You can specify `encrypted` or `snapshotId` but not both.
+
+Nested `ephemeralBlockDevice` blocks have the following structure:
+
+* `deviceName` - (Required) Path at which the device is exposed to created instances.
+* `virtualName` - (Required) Name for the ephemeral device, of the form "ephemeralN" where
+  *N* is a volume number starting from zero.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the AMI.
+* `id` - ID of the created AMI.
+* `ownerId` - AWS account ID of the image owner.
+* `rootSnapshotId` - Snapshot ID for the root volume (for EBS-backed AMIs)
+* `usageOperation` - Operation of the Amazon EC2 instance and the billing code that is associated with the AMI.
+* `platformDetails` - Platform details associated with the billing code of the AMI.
+* `imageOwnerAlias` - AWS account alias (for example, amazon, self) or the AWS account ID of the AMI owner.
+* `imageType` - Type of image.
+* `hypervisor` - Hypervisor type of the image.
+* `platform` - This value is set to windows for Windows AMIs; otherwise, it is blank.
+* `public` - Whether the image has public launch permissions.
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `40M`)
+* `update` - (Default `40M`)
+* `delete` - (Default `90M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsAmi` using the ID of the AMI. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsAmi` using the ID of the AMI. For example:
+
+```console
+% terraform import aws_ami.example ami-12345678
+```
+
+<!-- cache-key: cdktf-0.18.0 input-07ad6907bcdf710f44e4490525952f2744e1fd913c106b86670941ed753bd143 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ami_copy.html.markdown b/website/docs/cdktf/typescript/r/ami_copy.html.markdown
new file mode 100644
index 00000000000..95ee3ef5c37
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/ami_copy.html.markdown
@@ -0,0 +1,89 @@
+---
+subcategory: "EC2 (Elastic Compute Cloud)"
+layout: "aws"
+page_title: "AWS: aws_ami_copy"
+description: |-
+  Duplicates an existing Amazon Machine Image (AMI)
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ami_copy
+
+The "AMI copy" resource allows duplication of an Amazon Machine Image (AMI),
+including cross-region copies.
+
+If the source AMI has associated EBS snapshots, those will also be duplicated
+along with the AMI.
+
+This is useful for taking a single AMI provisioned in one region and making
+it available in another for a multi-region deployment.
+
+Copying an AMI can take several minutes. The creation of this resource will
+block until the new AMI is available for use on new instances.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AmiCopy } from "./.gen/providers/aws/ami-copy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AmiCopy(this, "example", {
+      description: "A copy of ami-xxxxxxxx",
+      name: "terraform-example",
+      sourceAmiId: "ami-xxxxxxxx",
+      sourceAmiRegion: "us-west-1",
+      tags: {
+        Name: "HelloWorld",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) Region-unique name for the AMI.
+* `sourceAmiId` - (Required) Id of the AMI to copy. This id must be valid in the region
+  given by `sourceAmiRegion`.
+* `sourceAmiRegion` - (Required) Region from which the AMI will be copied. This may be the
+  same as the AWS provider region in order to create a copy within the same region.
+* `destinationOutpostArn` - (Optional) ARN of the Outpost to which to copy the AMI.
+  Only specify this parameter when copying an AMI from an AWS Region to an Outpost. The AMI must be in the Region of the destination Outpost.  
+* `encrypted` - (Optional) Whether the destination snapshots of the copied image should be encrypted. Defaults to `false`
+* `kmsKeyId` - (Optional) Full ARN of the KMS Key to use when encrypting the snapshots of an image during a copy operation. If not specified, then the default AWS KMS Key will be used
+* `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+This resource also exposes the full set of arguments from the [`awsAmi`](ami.html) resource.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the AMI.
+* `id` - ID of the created AMI.
+
+This resource also exports a full set of attributes corresponding to the arguments of the
+[`awsAmi`](/docs/providers/aws/r/ami.html) resource, allowing the properties of the created AMI to be used elsewhere in the
+configuration.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `40M`)
+* `update` - (Default `40M`)
+* `delete` - (Default `90M`)
+
+<!-- cache-key: cdktf-0.18.0 input-24f70ab5d03ce5421bd9ce27fd5b5602c0ac4eedfab0b82ddfc7fec0c10806cf -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ami_from_instance.html.markdown b/website/docs/cdktf/typescript/r/ami_from_instance.html.markdown
new file mode 100644
index 00000000000..f0570afacca
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/ami_from_instance.html.markdown
@@ -0,0 +1,85 @@
+---
+subcategory: "EC2 (Elastic Compute Cloud)"
+layout: "aws"
+page_title: "AWS: aws_ami_from_instance"
+description: |-
+  Creates an Amazon Machine Image (AMI) from an EBS-backed EC2 instance
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ami_from_instance
+
+The "AMI from instance" resource allows the creation of an Amazon Machine
+Image (AMI) modelled after an existing EBS-backed EC2 instance.
+
+The created AMI will refer to implicitly-created snapshots of the instance's
+EBS volumes and mimick its assigned block device configuration at the time
+the resource is created.
+
+This resource is best applied to an instance that is stopped when this instance
+is created, so that the contents of the created image are predictable. When
+applied to an instance that is running, *the instance will be stopped before taking
+the snapshots and then started back up again*, resulting in a period of
+downtime.
+
+Note that the source instance is inspected only at the initial creation of this
+resource. Ongoing updates to the referenced instance will not be propagated into
+the generated AMI. Users may taint or otherwise recreate the resource in order
+to produce a fresh snapshot.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AmiFromInstance } from "./.gen/providers/aws/ami-from-instance";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AmiFromInstance(this, "example", {
+      name: "terraform-example",
+      sourceInstanceId: "i-xxxxxxxx",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) Region-unique name for the AMI.
+* `sourceInstanceId` - (Required) ID of the instance to use as the basis of the AMI.
+* `snapshotWithoutReboot` - (Optional) Boolean that overrides the behavior of stopping
+  the instance before snapshotting. This is risky since it may cause a snapshot of an
+  inconsistent filesystem state, but can be used to avoid downtime if the user otherwise
+  guarantees that no filesystem writes will be underway at the time of snapshot.
+* `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `40M`)
+* `update` - (Default `40M`)
+* `delete` - (Default `90M`)
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the AMI.
+* `id` - ID of the created AMI.
+
+This resource also exports a full set of attributes corresponding to the arguments of the
+[`awsAmi`](/docs/providers/aws/r/ami.html) resource, allowing the properties of the created AMI to be used elsewhere in the
+configuration.
+
+<!-- cache-key: cdktf-0.18.0 input-d3b464f0179fdca5ee710daa9220402ec177617c9090c92a91af04fa0dca1ffa -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ami_launch_permission.html.markdown b/website/docs/cdktf/typescript/r/ami_launch_permission.html.markdown
new file mode 100644
index 00000000000..fe721ff7186
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/ami_launch_permission.html.markdown
@@ -0,0 +1,126 @@
+---
+subcategory: "EC2 (Elastic Compute Cloud)"
+layout: "aws"
+page_title: "AWS: aws_ami_launch_permission"
+description: |-
+  Adds a launch permission to an Amazon Machine Image (AMI).
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ami_launch_permission
+
+Adds a launch permission to an Amazon Machine Image (AMI).
+
+## Example Usage
+
+### AWS Account ID
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AmiLaunchPermission } from "./.gen/providers/aws/ami-launch-permission";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AmiLaunchPermission(this, "example", {
+      accountId: "123456789012",
+      imageId: "ami-12345678",
+    });
+  }
+}
+
+```
+
+### Public Access
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AmiLaunchPermission } from "./.gen/providers/aws/ami-launch-permission";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AmiLaunchPermission(this, "example", {
+      group: "all",
+      imageId: "ami-12345678",
+    });
+  }
+}
+
+```
+
+### Organization Access
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AmiLaunchPermission } from "./.gen/providers/aws/ami-launch-permission";
+import { DataAwsOrganizationsOrganization } from "./.gen/providers/aws/data-aws-organizations-organization";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const current = new DataAwsOrganizationsOrganization(this, "current", {});
+    new AmiLaunchPermission(this, "example", {
+      imageId: "ami-12345678",
+      organizationArn: Token.asString(current.arn),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `accountId` - (Optional) AWS account ID for the launch permission.
+* `group` - (Optional) Name of the group for the launch permission. Valid values: `"all"`.
+* `imageId` - (Required) ID of the AMI.
+* `organizationArn` - (Optional) ARN of an organization for the launch permission.
+* `organizationalUnitArn` - (Optional) ARN of an organizational unit for the launch permission.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Launch permission ID.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AMI Launch Permissions using `[accountId|groupName|organizationArn|organizationalUnitArn]/imageId`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import AMI Launch Permissions using `[accountId|groupName|organizationArn|organizationalUnitArn]/imageId`. For example:
+
+```console
+% terraform import aws_ami_launch_permission.example 123456789012/ami-12345678
+```
+
+<!-- cache-key: cdktf-0.18.0 input-a0902093918e0a418db9b2fc23c95e8777db95ce86c83b3b547f718d788c6648 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/amplify_app.html.markdown b/website/docs/cdktf/typescript/r/amplify_app.html.markdown
new file mode 100644
index 00000000000..a6d22b4d68b
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/amplify_app.html.markdown
@@ -0,0 +1,266 @@
+---
+subcategory: "Amplify"
+layout: "aws"
+page_title: "AWS: aws_amplify_app"
+description: |-
+  Provides an Amplify App resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_amplify_app
+
+Provides an Amplify App resource, a fullstack serverless app hosted on the [AWS Amplify Console](https://docs.aws.amazon.com/amplify/latest/userguide/welcome.html).
+
+~> **Note:** When you create/update an Amplify App from Terraform, you may end up with the error "BadRequestException: You should at least provide one valid token" because of authentication issues. See the section "Repository with Tokens" below.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AmplifyApp } from "./.gen/providers/aws/amplify-app";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AmplifyApp(this, "example", {
+      buildSpec:
+        "version: 0.1\nfrontend:\n  phases:\n    preBuild:\n      commands:\n        - yarn install\n    build:\n      commands:\n        - yarn run build\n  artifacts:\n    baseDirectory: build\n    files:\n      - '**/*'\n  cache:\n    paths:\n      - node_modules/**/*\n\n",
+      customRule: [
+        {
+          source: "/<*>",
+          status: "404",
+          target: "/index.html",
+        },
+      ],
+      environmentVariables: {
+        ENV: "test",
+      },
+      name: "example",
+      repository: "https://github.com/example/app",
+    });
+  }
+}
+
+```
+
+### Repository with Tokens
+
+If you create a new Amplify App with the `repository` argument, you also need to set `oauthToken` or `accessToken` for authentication. For GitHub, get a [personal access token](https://help.github.com/en/github/authenticating-to-github/creating-a-personal-access-token-for-the-command-line) and set `accessToken` as follows:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AmplifyApp } from "./.gen/providers/aws/amplify-app";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AmplifyApp(this, "example", {
+      accessToken: "...",
+      name: "example",
+      repository: "https://github.com/example/app",
+    });
+  }
+}
+
+```
+
+You can omit `accessToken` if you import an existing Amplify App created by the Amplify Console (using OAuth for authentication).
+
+### Auto Branch Creation
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AmplifyApp } from "./.gen/providers/aws/amplify-app";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AmplifyApp(this, "example", {
+      autoBranchCreationConfig: {
+        enableAutoBuild: true,
+      },
+      autoBranchCreationPatterns: ["*", "*/**"],
+      enableAutoBranchCreation: true,
+      name: "example",
+    });
+  }
+}
+
+```
+
+### Basic Authorization
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AmplifyApp } from "./.gen/providers/aws/amplify-app";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AmplifyApp(this, "example", {
+      basicAuthCredentials: Token.asString(
+        Fn.base64encode("username1:password1")
+      ),
+      enableBasicAuth: true,
+      name: "example",
+    });
+  }
+}
+
+```
+
+### Rewrites and Redirects
+
+```terraform
+resource "aws_amplify_app" "example" {
+  name = "example"
+
+  # Reverse Proxy Rewrite for API requests
+  # https://docs.aws.amazon.com/amplify/latest/userguide/redirects.html#reverse-proxy-rewrite
+  custom_rule {
+    source = "/api/<*>"
+    status = "200"
+    target = "https://api.example.com/api/<*>"
+  }
+
+  # Redirects for Single Page Web Apps (SPA)
+  # https://docs.aws.amazon.com/amplify/latest/userguide/redirects.html#redirects-for-single-page-web-apps-spa
+  custom_rule {
+    source = "</^[^.]+$|\\.(?!(css|gif|ico|jpg|js|png|txt|svg|woff|ttf|map|json)$)([^.]+$)/>"
+    status = "200"
+    target = "/index.html"
+  }
+}
+```
+
+### Custom Image
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AmplifyApp } from "./.gen/providers/aws/amplify-app";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AmplifyApp(this, "example", {
+      environmentVariables: {
+        _CUSTOM_IMAGE: "node:16",
+      },
+      name: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) Name for an Amplify app.
+* `accessToken` - (Optional) Personal access token for a third-party source control system for an Amplify app. The personal access token is used to create a webhook and a read-only deploy key. The token is not stored.
+* `autoBranchCreationConfig` - (Optional) Automated branch creation configuration for an Amplify app. An `autoBranchCreationConfig` block is documented below.
+* `autoBranchCreationPatterns` - (Optional) Automated branch creation glob patterns for an Amplify app.
+* `basicAuthCredentials` - (Optional) Credentials for basic authorization for an Amplify app.
+* `buildSpec` - (Optional) The [build specification](https://docs.aws.amazon.com/amplify/latest/userguide/build-settings.html) (build spec) for an Amplify app.
+* `customRule` - (Optional) Custom rewrite and redirect rules for an Amplify app. A `customRule` block is documented below.
+* `description` - (Optional) Description for an Amplify app.
+* `enableAutoBranchCreation` - (Optional) Enables automated branch creation for an Amplify app.
+* `enableBasicAuth` - (Optional) Enables basic authorization for an Amplify app. This will apply to all branches that are part of this app.
+* `enableBranchAutoBuild` - (Optional) Enables auto-building of branches for the Amplify App.
+* `enableBranchAutoDeletion` - (Optional) Automatically disconnects a branch in the Amplify Console when you delete a branch from your Git repository.
+* `environmentVariables` - (Optional) Environment variables map for an Amplify app.
+* `iamServiceRoleArn` - (Optional) AWS Identity and Access Management (IAM) service role for an Amplify app.
+* `oauthToken` - (Optional) OAuth token for a third-party source control system for an Amplify app. The OAuth token is used to create a webhook and a read-only deploy key. The OAuth token is not stored.
+* `platform` - (Optional) Platform or framework for an Amplify app. Valid values: `web`, `webCompute`. Default value: `web`.
+* `repository` - (Optional) Repository for an Amplify app.
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+An `autoBranchCreationConfig` block supports the following arguments:
+
+* `basicAuthCredentials` - (Optional) Basic authorization credentials for the autocreated branch.
+* `buildSpec` - (Optional) Build specification (build spec) for the autocreated branch.
+* `enableAutoBuild` - (Optional) Enables auto building for the autocreated branch.
+* `enableBasicAuth` - (Optional) Enables basic authorization for the autocreated branch.
+* `enablePerformanceMode` - (Optional) Enables performance mode for the branch.
+* `enablePullRequestPreview` - (Optional) Enables pull request previews for the autocreated branch.
+* `environmentVariables` - (Optional) Environment variables for the autocreated branch.
+* `framework` - (Optional) Framework for the autocreated branch.
+* `pullRequestEnvironmentName` - (Optional) Amplify environment name for the pull request.
+* `stage` - (Optional) Describes the current stage for the autocreated branch. Valid values: `production`, `beta`, `development`, `experimental`, `pullRequest`.
+
+A `customRule` block supports the following arguments:
+
+* `condition` - (Optional) Condition for a URL rewrite or redirect rule, such as a country code.
+* `source` - (Required) Source pattern for a URL rewrite or redirect rule.
+* `status` - (Optional) Status code for a URL rewrite or redirect rule. Valid values: `200`, `301`, `302`, `404`, `404200`.
+* `target` - (Required) Target pattern for a URL rewrite or redirect rule.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Amplify app.
+* `defaultDomain` - Default domain for the Amplify app.
+* `id` - Unique ID of the Amplify app.
+* `productionBranch` - Describes the information about a production branch for an Amplify app. A `productionBranch` block is documented below.
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+A `productionBranch` block supports the following attributes:
+
+* `branchName` - Branch name for the production branch.
+* `lastDeployTime` - Last deploy time of the production branch.
+* `status` - Status of the production branch.
+* `thumbnailUrl` - Thumbnail URL for the production branch.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Amplify App using Amplify App ID (appId). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Amplify App using Amplify App ID (appId). For example:
+
+```console
+% terraform import aws_amplify_app.example d2ypk4k47z8u6
+```
+
+App ID can be obtained from App ARN (e.g., `arn:aws:amplify:usEast1:12345678:apps/d2Ypk4K47Z8U6`).
+
+<!-- cache-key: cdktf-0.18.0 input-aa2222e19fec5cd81db6ed1903530b6a04721809fe7d885a605a693c961c09a6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/amplify_backend_environment.html.markdown b/website/docs/cdktf/typescript/r/amplify_backend_environment.html.markdown
new file mode 100644
index 00000000000..1e93c8e4568
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/amplify_backend_environment.html.markdown
@@ -0,0 +1,88 @@
+---
+subcategory: "Amplify"
+layout: "aws"
+page_title: "AWS: aws_amplify_backend_environment"
+description: |-
+  Provides an Amplify Backend Environment resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_amplify_backend_environment
+
+Provides an Amplify Backend Environment resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AmplifyApp } from "./.gen/providers/aws/amplify-app";
+import { AmplifyBackendEnvironment } from "./.gen/providers/aws/amplify-backend-environment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new AmplifyApp(this, "example", {
+      name: "example",
+    });
+    const awsAmplifyBackendEnvironmentExample = new AmplifyBackendEnvironment(
+      this,
+      "example_1",
+      {
+        appId: example.id,
+        deploymentArtifacts: "app-example-deployment",
+        environmentName: "example",
+        stackName: "amplify-app-example",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsAmplifyBackendEnvironmentExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `appId` - (Required) Unique ID for an Amplify app.
+* `environmentName` - (Required) Name for the backend environment.
+* `deploymentArtifacts` - (Optional) Name of deployment artifacts.
+* `stackName` - (Optional) AWS CloudFormation stack name of a backend environment.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN for a backend environment that is part of an Amplify app.
+* `id` - Unique ID of the Amplify backend environment.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Amplify backend environment using `appId` and `environmentName`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Amplify backend environment using `appId` and `environmentName`. For example:
+
+```console
+% terraform import aws_amplify_backend_environment.example d2ypk4k47z8u6/example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-c0149c5f68fd1dca66f72427d6f00bb2e21d8385c7bdf9671e71789ce006dd4d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/amplify_branch.html.markdown b/website/docs/cdktf/typescript/r/amplify_branch.html.markdown
new file mode 100644
index 00000000000..0085e772122
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/amplify_branch.html.markdown
@@ -0,0 +1,267 @@
+---
+subcategory: "Amplify"
+layout: "aws"
+page_title: "AWS: aws_amplify_branch"
+description: |-
+  Provides an Amplify Branch resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_amplify_branch
+
+Provides an Amplify Branch resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AmplifyApp } from "./.gen/providers/aws/amplify-app";
+import { AmplifyBranch } from "./.gen/providers/aws/amplify-branch";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new AmplifyApp(this, "example", {
+      name: "app",
+    });
+    new AmplifyBranch(this, "master", {
+      appId: example.id,
+      branchName: "master",
+      environmentVariables: {
+        REACT_APP_API_SERVER: "https://api.example.com",
+      },
+      framework: "React",
+      stage: "PRODUCTION",
+    });
+  }
+}
+
+```
+
+### Basic Authentication
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AmplifyApp } from "./.gen/providers/aws/amplify-app";
+import { AmplifyBranch } from "./.gen/providers/aws/amplify-branch";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new AmplifyApp(this, "example", {
+      name: "app",
+    });
+    new AmplifyBranch(this, "master", {
+      appId: example.id,
+      basicAuthCredentials: Token.asString(
+        Fn.base64encode("username:password")
+      ),
+      branchName: "master",
+      enableBasicAuth: true,
+    });
+  }
+}
+
+```
+
+### Notifications
+
+Amplify Console uses EventBridge (formerly known as CloudWatch Events) and SNS for email notifications.  To implement the same functionality, you need to set `enableNotification` in a `awsAmplifyBranch` resource, as well as creating an EventBridge Rule, an SNS topic, and SNS subscriptions.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AmplifyApp } from "./.gen/providers/aws/amplify-app";
+import { AmplifyBranch } from "./.gen/providers/aws/amplify-branch";
+import { CloudwatchEventRule } from "./.gen/providers/aws/cloudwatch-event-rule";
+import { CloudwatchEventTarget } from "./.gen/providers/aws/cloudwatch-event-target";
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { SnsTopic } from "./.gen/providers/aws/sns-topic";
+import { SnsTopicPolicy } from "./.gen/providers/aws/sns-topic-policy";
+import { SnsTopicSubscription } from "./.gen/providers/aws/sns-topic-subscription";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new AmplifyApp(this, "example", {
+      name: "app",
+    });
+    const master = new AmplifyBranch(this, "master", {
+      appId: example.id,
+      branchName: "master",
+      enableNotification: true,
+    });
+    const amplifyAppMaster = new CloudwatchEventRule(
+      this,
+      "amplify_app_master",
+      {
+        description:
+          "AWS Amplify build notifications for :  App: ${" +
+          app.id +
+          "} Branch: ${" +
+          master.branchName +
+          "}",
+        eventPattern: Token.asString(
+          Fn.jsonencode({
+            detail: {
+              appId: [example.id],
+              branchName: [master.branchName],
+              jobStatus: ["SUCCEED", "FAILED", "STARTED"],
+            },
+            "detail-type": ["Amplify Deployment Status Change"],
+            source: ["aws.amplify"],
+          })
+        ),
+        name:
+          "amplify-${" +
+          app.id +
+          "}-${" +
+          master.branchName +
+          "}-branch-notification",
+      }
+    );
+    const awsSnsTopicAmplifyAppMaster = new SnsTopic(
+      this,
+      "amplify_app_master_3",
+      {
+        name: "amplify-${" + app.id + "}_${" + master.branchName + "}",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSnsTopicAmplifyAppMaster.overrideLogicalId("amplify_app_master");
+    new SnsTopicSubscription(this, "this", {
+      endpoint: "user@acme.com",
+      protocol: "email",
+      topicArn: Token.asString(awsSnsTopicAmplifyAppMaster.arn),
+    });
+    const dataAwsIamPolicyDocumentAmplifyAppMaster =
+      new DataAwsIamPolicyDocument(this, "amplify_app_master_5", {
+        statement: [
+          {
+            actions: ["SNS:Publish"],
+            effect: "Allow",
+            principals: [
+              {
+                identifiers: ["events.amazonaws.com"],
+                type: "Service",
+              },
+            ],
+            resources: [Token.asString(awsSnsTopicAmplifyAppMaster.arn)],
+            sid: "Allow_Publish_Events ${" + master.arn + "}",
+          },
+        ],
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsIamPolicyDocumentAmplifyAppMaster.overrideLogicalId(
+      "amplify_app_master"
+    );
+    const awsCloudwatchEventTargetAmplifyAppMaster = new CloudwatchEventTarget(
+      this,
+      "amplify_app_master_6",
+      {
+        arn: Token.asString(awsSnsTopicAmplifyAppMaster.arn),
+        inputTransformer: {
+          inputPaths: {
+            appId: "$.detail.appId",
+            branch: "$.detail.branchName",
+            jobId: "$.detail.jobId",
+            region: "$.region",
+            status: "$.detail.jobStatus",
+          },
+          inputTemplate:
+            '\\"Build notification from the AWS Amplify Console for app: https://<branch>.<appId>.amplifyapp.com/. Your build status is <status>. Go to https://console.aws.amazon.com/amplify/home?region=<region>#<appId>/<branch>/<jobId> to view details on your build. \\"',
+        },
+        rule: amplifyAppMaster.name,
+        targetId: master.branchName,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsCloudwatchEventTargetAmplifyAppMaster.overrideLogicalId(
+      "amplify_app_master"
+    );
+    const awsSnsTopicPolicyAmplifyAppMaster = new SnsTopicPolicy(
+      this,
+      "amplify_app_master_7",
+      {
+        arn: Token.asString(awsSnsTopicAmplifyAppMaster.arn),
+        policy: Token.asString(dataAwsIamPolicyDocumentAmplifyAppMaster.json),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSnsTopicPolicyAmplifyAppMaster.overrideLogicalId("amplify_app_master");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `appId` - (Required) Unique ID for an Amplify app.
+* `branchName` - (Required) Name for the branch.
+* `backendEnvironmentArn` - (Optional) ARN for a backend environment that is part of an Amplify app.
+* `basicAuthCredentials` - (Optional) Basic authorization credentials for the branch.
+* `description` - (Optional) Description for the branch.
+* `displayName` - (Optional) Display name for a branch. This is used as the default domain prefix.
+* `enableAutoBuild` - (Optional) Enables auto building for the branch.
+* `enableBasicAuth` - (Optional) Enables basic authorization for the branch.
+* `enableNotification` - (Optional) Enables notifications for the branch.
+* `enablePerformanceMode` - (Optional) Enables performance mode for the branch.
+* `enablePullRequestPreview` - (Optional) Enables pull request previews for this branch.
+* `environmentVariables` - (Optional) Environment variables for the branch.
+* `framework` - (Optional) Framework for the branch.
+* `pullRequestEnvironmentName` - (Optional) Amplify environment name for the pull request.
+* `stage` - (Optional) Describes the current stage for the branch. Valid values: `production`, `beta`, `development`, `experimental`, `pullRequest`.
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `ttl` - (Optional) Content Time To Live (TTL) for the website in seconds.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN for the branch.
+* `associatedResources` - A list of custom resources that are linked to this branch.
+* `customDomains` - Custom domains for the branch.
+* `destinationBranch` - Destination branch if the branch is a pull request branch.
+* `sourceBranch` - Source branch if the branch is a pull request branch.
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Amplify branch using `appId` and `branchName`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Amplify branch using `appId` and `branchName`. For example:
+
+```console
+% terraform import aws_amplify_branch.master d2ypk4k47z8u6/master
+```
+
+<!-- cache-key: cdktf-0.18.0 input-18bb34f7ab2ddc6f2adc5f5bfbff608bb9af62203731b97b751ed9bb930f797a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/amplify_domain_association.html.markdown b/website/docs/cdktf/typescript/r/amplify_domain_association.html.markdown
new file mode 100644
index 00000000000..37a308060ff
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/amplify_domain_association.html.markdown
@@ -0,0 +1,119 @@
+---
+subcategory: "Amplify"
+layout: "aws"
+page_title: "AWS: aws_amplify_domain_association"
+description: |-
+  Provides an Amplify Domain Association resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_amplify_domain_association
+
+Provides an Amplify Domain Association resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AmplifyApp } from "./.gen/providers/aws/amplify-app";
+import { AmplifyBranch } from "./.gen/providers/aws/amplify-branch";
+import { AmplifyDomainAssociation } from "./.gen/providers/aws/amplify-domain-association";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new AmplifyApp(this, "example", {
+      customRule: [
+        {
+          source: "https://example.com",
+          status: "302",
+          target: "https://www.example.com",
+        },
+      ],
+      name: "app",
+    });
+    const master = new AmplifyBranch(this, "master", {
+      appId: example.id,
+      branchName: "master",
+    });
+    const awsAmplifyDomainAssociationExample = new AmplifyDomainAssociation(
+      this,
+      "example_2",
+      {
+        appId: example.id,
+        domainName: "example.com",
+        subDomain: [
+          {
+            branchName: master.branchName,
+            prefix: "",
+          },
+          {
+            branchName: master.branchName,
+            prefix: "www",
+          },
+        ],
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsAmplifyDomainAssociationExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `appId` - (Required) Unique ID for an Amplify app.
+* `domainName` - (Required) Domain name for the domain association.
+* `enableAutoSubDomain` - (Optional) Enables the automated creation of subdomains for branches.
+* `subDomain` - (Required) Setting for the subdomain. Documented below.
+* `waitForVerification` - (Optional) If enabled, the resource will wait for the domain association status to change to `pendingDeployment` or `available`. Setting this to `false` will skip the process. Default: `true`.
+
+The `subDomain` configuration block supports the following arguments:
+
+* `branchName` - (Required) Branch name setting for the subdomain.
+* `prefix` - (Required) Prefix setting for the subdomain.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN for the domain association.
+* `certificateVerificationDnsRecord` - The DNS record for certificate verification.
+
+The `subDomain` configuration block exports the following attributes:
+
+* `dnsRecord` - DNS record for the subdomain.
+* `verified` - Verified status of the subdomain.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Amplify domain association using `appId` and `domainName`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Amplify domain association using `appId` and `domainName`. For example:
+
+```console
+% terraform import aws_amplify_domain_association.app d2ypk4k47z8u6/example.com
+```
+
+<!-- cache-key: cdktf-0.18.0 input-10844d85ea1b0809e4b08cd8168c429bf0c742ec4760985072b9f61b55e19893 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/amplify_webhook.html.markdown b/website/docs/cdktf/typescript/r/amplify_webhook.html.markdown
new file mode 100644
index 00000000000..6051a66000e
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/amplify_webhook.html.markdown
@@ -0,0 +1,87 @@
+---
+subcategory: "Amplify"
+layout: "aws"
+page_title: "AWS: aws_amplify_webhook"
+description: |-
+  Provides an Amplify Webhook resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_amplify_webhook
+
+Provides an Amplify Webhook resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AmplifyApp } from "./.gen/providers/aws/amplify-app";
+import { AmplifyBranch } from "./.gen/providers/aws/amplify-branch";
+import { AmplifyWebhook } from "./.gen/providers/aws/amplify-webhook";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new AmplifyApp(this, "example", {
+      name: "app",
+    });
+    const master = new AmplifyBranch(this, "master", {
+      appId: example.id,
+      branchName: "master",
+    });
+    const awsAmplifyWebhookMaster = new AmplifyWebhook(this, "master_2", {
+      appId: example.id,
+      branchName: master.branchName,
+      description: "triggermaster",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsAmplifyWebhookMaster.overrideLogicalId("master");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `appId` - (Required) Unique ID for an Amplify app.
+* `branchName` - (Required) Name for a branch that is part of the Amplify app.
+* `description` - (Optional) Description for a webhook.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN for the webhook.
+* `url` - URL of the webhook.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Amplify webhook using a webhook ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Amplify webhook using a webhook ID. For example:
+
+```console
+% terraform import aws_amplify_webhook.master a26b22a0-748b-4b57-b9a0-ae7e601fe4b1
+```
+
+<!-- cache-key: cdktf-0.18.0 input-3bb11fa5debeb312ce5961222720872aa6f83d12dbd79b3d00fffa77e117baba -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/api_gateway_account.html.markdown b/website/docs/cdktf/typescript/r/api_gateway_account.html.markdown
new file mode 100644
index 00000000000..2874b095fbb
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/api_gateway_account.html.markdown
@@ -0,0 +1,127 @@
+---
+subcategory: "API Gateway"
+layout: "aws"
+page_title: "AWS: aws_api_gateway_account"
+description: |-
+  Provides a settings of an API Gateway Account.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_api_gateway_account
+
+Provides a settings of an API Gateway Account. Settings is applied region-wide per `provider` block.
+
+-> **Note:** As there is no API method for deleting account settings or resetting it to defaults, destroying this resource will keep your account settings intact
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ApiGatewayAccount } from "./.gen/providers/aws/api-gateway-account";
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+import { IamRolePolicy } from "./.gen/providers/aws/iam-role-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const assumeRole = new DataAwsIamPolicyDocument(this, "assume_role", {
+      statement: [
+        {
+          actions: ["sts:AssumeRole"],
+          effect: "Allow",
+          principals: [
+            {
+              identifiers: ["apigateway.amazonaws.com"],
+              type: "Service",
+            },
+          ],
+        },
+      ],
+    });
+    const cloudwatch = new DataAwsIamPolicyDocument(this, "cloudwatch", {
+      statement: [
+        {
+          actions: [
+            "logs:CreateLogGroup",
+            "logs:CreateLogStream",
+            "logs:DescribeLogGroups",
+            "logs:DescribeLogStreams",
+            "logs:PutLogEvents",
+            "logs:GetLogEvents",
+            "logs:FilterLogEvents",
+          ],
+          effect: "Allow",
+          resources: ["*"],
+        },
+      ],
+    });
+    const awsIamRoleCloudwatch = new IamRole(this, "cloudwatch_2", {
+      assumeRolePolicy: Token.asString(assumeRole.json),
+      name: "api_gateway_cloudwatch_global",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamRoleCloudwatch.overrideLogicalId("cloudwatch");
+    const awsIamRolePolicyCloudwatch = new IamRolePolicy(this, "cloudwatch_3", {
+      name: "default",
+      policy: Token.asString(cloudwatch.json),
+      role: Token.asString(awsIamRoleCloudwatch.id),
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamRolePolicyCloudwatch.overrideLogicalId("cloudwatch");
+    new ApiGatewayAccount(this, "demo", {
+      cloudwatchRoleArn: Token.asString(awsIamRoleCloudwatch.arn),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `cloudwatchRoleArn` - (Optional) ARN of an IAM role for CloudWatch (to allow logging & monitoring). See more [in AWS Docs](https://docs.aws.amazon.com/apigateway/latest/developerguide/how-to-stage-settings.html#how-to-stage-settings-console). Logging & monitoring can be enabled/disabled and otherwise tuned on the API Gateway Stage level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `apiKeyVersion` - The version of the API keys used for the account.
+* `throttleSettings` - Account-Level throttle settings. See exported fields below.
+* `features` - A list of features supported for the account.
+
+`throttleSettings` block exports the following:
+
+* `burstLimit` - Absolute maximum number of times API Gateway allows the API to be called per second (RPS).
+* `rateLimit` - Number of times API Gateway allows the API to be called per second on average (RPS).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import API Gateway Accounts using the word `apiGatewayAccount`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import API Gateway Accounts using the word `apiGatewayAccount`. For example:
+
+```console
+% terraform import aws_api_gateway_account.demo api-gateway-account
+```
+
+<!-- cache-key: cdktf-0.18.0 input-2c3031685ea1cacb5723c6c52399155d732bc5bb2d7fcfa71a3cc55a2bf24db5 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/api_gateway_api_key.html.markdown b/website/docs/cdktf/typescript/r/api_gateway_api_key.html.markdown
new file mode 100644
index 00000000000..0e3cbf6b9ca
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/api_gateway_api_key.html.markdown
@@ -0,0 +1,82 @@
+---
+subcategory: "API Gateway"
+layout: "aws"
+page_title: "AWS: aws_api_gateway_api_key"
+description: |-
+  Provides an API Gateway API Key.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_api_gateway_api_key
+
+Provides an API Gateway API Key.
+
+~> **NOTE:** Since the API Gateway usage plans feature was launched on August 11, 2016, usage plans are now **required** to associate an API key with an API stage.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ApiGatewayApiKey } from "./.gen/providers/aws/api-gateway-api-key";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ApiGatewayApiKey(this, "example", {
+      name: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) Name of the API key.
+* `customerId` - (Required) An Amazon Web Services Marketplace customer identifier, when integrating with the Amazon Web Services SaaS Marketplace.
+* `description` - (Optional) API key description. Defaults to "Managed by Terraform".
+* `enabled` - (Optional) Whether the API key can be used by callers. Defaults to `true`.
+* `value` - (Optional) Value of the API key. If specified, the value must be an alphanumeric string between 20 and 128 characters. If not specified, it will be automatically generated by AWS on creation.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the API key
+* `createdDate` - Creation date of the API key
+* `lastUpdatedDate` - Last update date of the API key
+* `arn` - ARN
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import API Gateway Keys using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import API Gateway Keys using the `id`. For example:
+
+```console
+% terraform import aws_api_gateway_api_key.example 8bklk8bl1k3sB38D9B3l0enyWT8c09B30lkq0blk
+```
+
+<!-- cache-key: cdktf-0.18.0 input-22b69fb8534ef570b5d1e520c78e2afd9a75df34ce74287081d34950badd6ce6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/api_gateway_authorizer.html.markdown b/website/docs/cdktf/typescript/r/api_gateway_authorizer.html.markdown
new file mode 100644
index 00000000000..0df2604e06e
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/api_gateway_authorizer.html.markdown
@@ -0,0 +1,176 @@
+---
+subcategory: "API Gateway"
+layout: "aws"
+page_title: "AWS: aws_api_gateway_authorizer"
+description: |-
+  Provides an API Gateway Authorizer.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_api_gateway_authorizer
+
+Provides an API Gateway Authorizer.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, Fn, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ApiGatewayAuthorizer } from "./.gen/providers/aws/api-gateway-authorizer";
+import { ApiGatewayRestApi } from "./.gen/providers/aws/api-gateway-rest-api";
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+import { IamRolePolicy } from "./.gen/providers/aws/iam-role-policy";
+import { LambdaFunction } from "./.gen/providers/aws/lambda-function";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const demo = new ApiGatewayRestApi(this, "demo", {
+      name: "auth-demo",
+    });
+    const invocationAssumeRole = new DataAwsIamPolicyDocument(
+      this,
+      "invocation_assume_role",
+      {
+        statement: [
+          {
+            actions: ["sts:AssumeRole"],
+            effect: "Allow",
+            principals: [
+              {
+                identifiers: ["apigateway.amazonaws.com"],
+                type: "Service",
+              },
+            ],
+          },
+        ],
+      }
+    );
+    const lambdaAssumeRole = new DataAwsIamPolicyDocument(
+      this,
+      "lambda_assume_role",
+      {
+        statement: [
+          {
+            actions: ["sts:AssumeRole"],
+            effect: "Allow",
+            principals: [
+              {
+                identifiers: ["lambda.amazonaws.com"],
+                type: "Service",
+              },
+            ],
+          },
+        ],
+      }
+    );
+    const invocationRole = new IamRole(this, "invocation_role", {
+      assumeRolePolicy: Token.asString(invocationAssumeRole.json),
+      name: "api_gateway_auth_invocation",
+      path: "/",
+    });
+    const lambda = new IamRole(this, "lambda", {
+      assumeRolePolicy: Token.asString(lambdaAssumeRole.json),
+      name: "demo-lambda",
+    });
+    const authorizer = new LambdaFunction(this, "authorizer", {
+      filename: "lambda-function.zip",
+      functionName: "api_gateway_authorizer",
+      handler: "exports.example",
+      role: lambda.arn,
+      sourceCodeHash: Token.asString(
+        Fn.filebase64sha256("lambda-function.zip")
+      ),
+    });
+    const invocationPolicy = new DataAwsIamPolicyDocument(
+      this,
+      "invocation_policy",
+      {
+        statement: [
+          {
+            actions: ["lambda:InvokeFunction"],
+            effect: "Allow",
+            resources: [authorizer.arn],
+          },
+        ],
+      }
+    );
+    const awsApiGatewayAuthorizerDemo = new ApiGatewayAuthorizer(
+      this,
+      "demo_7",
+      {
+        authorizerCredentials: invocationRole.arn,
+        authorizerUri: authorizer.invokeArn,
+        name: "demo",
+        restApiId: demo.id,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsApiGatewayAuthorizerDemo.overrideLogicalId("demo");
+    const awsIamRolePolicyInvocationPolicy = new IamRolePolicy(
+      this,
+      "invocation_policy_8",
+      {
+        name: "default",
+        policy: Token.asString(invocationPolicy.json),
+        role: invocationRole.id,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamRolePolicyInvocationPolicy.overrideLogicalId("invocation_policy");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `authorizerUri` - (Optional, required for type `token`/`request`) Authorizer's Uniform Resource Identifier (URI). This must be a well-formed Lambda function URI in the form of `arn:aws:apigateway:{region}:lambda:path/{serviceApi}`,
+ e.g., `arn:aws:apigateway:usWest2:lambda:path/20150331/functions/arn:aws:lambda:usWest2:012345678912:function:myFunction/invocations`
+* `name` - (Required) Name of the authorizer
+* `restApiId` - (Required) ID of the associated REST API
+* `identitySource` - (Optional) Source of the identity in an incoming request. Defaults to `methodRequestHeaderAuthorization`. For `request` type, this may be a comma-separated list of values, including headers, query string parameters and stage variables - e.g., `"methodRequestHeaderSomeHeaderName,methodRequestQuerystringSomeQueryStringName,stageVariablesSomeStageVariableName"`
+* `type` - (Optional) Type of the authorizer. Possible values are `token` for a Lambda function using a single authorization token submitted in a custom header, `request` for a Lambda function using incoming request parameters, or `cognitoUserPools` for using an Amazon Cognito user pool. Defaults to `token`.
+* `authorizerCredentials` - (Optional) Credentials required for the authorizer. To specify an IAM Role for API Gateway to assume, use the IAM Role ARN.
+* `authorizerResultTtlInSeconds` - (Optional) TTL of cached authorizer results in seconds. Defaults to `300`.
+* `identityValidationExpression` - (Optional) Validation expression for the incoming identity. For `token` type, this value should be a regular expression. The incoming token from the client is matched against this expression, and will proceed if the token matches. If the token doesn't match, the client receives a 401 Unauthorized response.
+* `providerArns` - (Optional, required for type `cognitoUserPools`) List of the Amazon Cognito user pool ARNs. Each element is of this format: `arn:aws:cognitoIdp:{region}:{accountId}:userpool/{userPoolId}`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the API Gateway Authorizer
+* `id` - Authorizer identifier.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AWS API Gateway Authorizer using the `restApiId/authorizerId`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import AWS API Gateway Authorizer using the `restApiId/authorizerId`. For example:
+
+```console
+% terraform import aws_api_gateway_authorizer.authorizer 12345abcde/example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-2079e78abb2de34b252c2d1829bd6d6c7b5e8eea6a54c81a845e12111109c59f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/api_gateway_base_path_mapping.html.markdown b/website/docs/cdktf/typescript/r/api_gateway_base_path_mapping.html.markdown
new file mode 100644
index 00000000000..7fc7d3a854f
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/api_gateway_base_path_mapping.html.markdown
@@ -0,0 +1,130 @@
+---
+subcategory: "API Gateway"
+layout: "aws"
+page_title: "AWS: aws_api_gateway_base_path_mapping"
+description: |-
+  Connects a custom domain with a deployed API
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_api_gateway_base_path_mapping
+
+Connects a custom domain name registered via `awsApiGatewayDomainName`
+with a deployed API so that its methods can be called via the
+custom domain name.
+
+## Example Usage
+
+An end-to-end example of a REST API configured with OpenAPI can be found in the [`/examples/apiGatewayRestApiOpenapi` directory within the GitHub repository](https://github.com/hashicorp/terraform-provider-aws/tree/main/examples/api-gateway-rest-api-openapi).
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ApiGatewayBasePathMapping } from "./.gen/providers/aws/api-gateway-base-path-mapping";
+import { ApiGatewayDomainName } from "./.gen/providers/aws/api-gateway-domain-name";
+import { ApiGatewayStage } from "./.gen/providers/aws/api-gateway-stage";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new ApiGatewayDomainName(this, "example", {
+      certificateBody: Token.asString(
+        Fn.file("${path.module}/example.com/example.crt")
+      ),
+      certificateChain: Token.asString(
+        Fn.file("${path.module}/example.com/ca.crt")
+      ),
+      certificateName: "example-api",
+      certificatePrivateKey: Token.asString(
+        Fn.file("${path.module}/example.com/example.key")
+      ),
+      domainName: "example.com",
+    });
+    const awsApiGatewayStageExample = new ApiGatewayStage(this, "example_1", {
+      deploymentId: Token.asString(awsApiGatewayDeploymentExample.id),
+      restApiId: Token.asString(awsApiGatewayRestApiExample.id),
+      stageName: "example",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsApiGatewayStageExample.overrideLogicalId("example");
+    const awsApiGatewayBasePathMappingExample = new ApiGatewayBasePathMapping(
+      this,
+      "example_2",
+      {
+        apiId: Token.asString(awsApiGatewayRestApiExample.id),
+        domainName: example.domainName,
+        stageName: Token.asString(awsApiGatewayStageExample.stageName),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsApiGatewayBasePathMappingExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `domainName` - (Required) Already-registered domain name to connect the API to.
+* `apiId` - (Required) ID of the API to connect.
+* `stageName` - (Optional) Name of a specific deployment stage to expose at the given path. If omitted, callers may select any stage by including its name as a path element after the base path.
+* `basePath` - (Optional) Path segment that must be prepended to the path when accessing the API via this mapping. If omitted, the API is exposed at the root of the given domain.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsApiGatewayBasePathMapping` using the domain name and base path. For example:
+
+For an empty `basePath` or, in other words, a root path (`/`):
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+For a non-root `basePath`:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsApiGatewayBasePathMapping` using the domain name and base path. For example:
+
+For an empty `basePath` or, in other words, a root path (`/`):
+
+```console
+% terraform import aws_api_gateway_base_path_mapping.example example.com/
+```
+
+For a non-root `basePath`:
+
+```console
+% terraform import aws_api_gateway_base_path_mapping.example example.com/base-path
+```
+
+<!-- cache-key: cdktf-0.18.0 input-7c630b1c026c451c91ce4be44cb571b40bd69a91e074917021e877a73f91c912 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/api_gateway_client_certificate.html.markdown b/website/docs/cdktf/typescript/r/api_gateway_client_certificate.html.markdown
new file mode 100644
index 00000000000..10b0e2fcc34
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/api_gateway_client_certificate.html.markdown
@@ -0,0 +1,77 @@
+---
+subcategory: "API Gateway"
+layout: "aws"
+page_title: "AWS: aws_api_gateway_client_certificate"
+description: |-
+  Provides an API Gateway Client Certificate.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_api_gateway_client_certificate
+
+Provides an API Gateway Client Certificate.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ApiGatewayClientCertificate } from "./.gen/providers/aws/api-gateway-client-certificate";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ApiGatewayClientCertificate(this, "demo", {
+      description: "My client certificate",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `description` - (Optional) Description of the client certificate.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Identifier of the client certificate.
+* `createdDate` - Date when the client certificate was created.
+* `expirationDate` - Date when the client certificate will expire.
+* `pemEncodedCertificate` - The PEM-encoded public key of the client certificate.
+* `arn` - ARN
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import API Gateway Client Certificates using the id. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import API Gateway Client Certificates using the id. For example:
+
+```console
+% terraform import aws_api_gateway_client_certificate.demo ab1cqe
+```
+
+<!-- cache-key: cdktf-0.18.0 input-f5e9958abec817b82b925c0b36a7398f6252c227f18c1f61028418cabf76045c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/api_gateway_deployment.html.markdown b/website/docs/cdktf/typescript/r/api_gateway_deployment.html.markdown
new file mode 100644
index 00000000000..63090093f01
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/api_gateway_deployment.html.markdown
@@ -0,0 +1,213 @@
+---
+subcategory: "API Gateway"
+layout: "aws"
+page_title: "AWS: aws_api_gateway_deployment"
+description: |-
+  Manages an API Gateway REST Deployment.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_api_gateway_deployment
+
+Manages an API Gateway REST Deployment. A deployment is a snapshot of the REST API configuration. The deployment can then be published to callable endpoints via the [`awsApiGatewayStage` resource](api_gateway_stage.html) and optionally managed further with the [`awsApiGatewayBasePathMapping` resource](api_gateway_base_path_mapping.html), [`awsApiGatewayDomainName` resource](api_gateway_domain_name.html), and [`awsApiMethodSettings` resource](api_gateway_method_settings.html). For more information, see the [API Gateway Developer Guide](https://docs.aws.amazon.com/apigateway/latest/developerguide/how-to-deploy-api.html).
+
+To properly capture all REST API configuration in a deployment, this resource must have dependencies on all prior Terraform resources that manage resources/paths, methods, integrations, etc.
+
+* For REST APIs that are configured via OpenAPI specification ([`awsApiGatewayRestApi` resource](api_gateway_rest_api.html) `body` argument), no special dependency setup is needed beyond referencing the  `id` attribute of that resource unless additional Terraform resources have further customized the REST API.
+* When the REST API configuration involves other Terraform resources ([`awsApiGatewayIntegration` resource](api_gateway_integration.html), etc.), the dependency setup can be done with implicit resource references in the `triggers` argument or explicit resource references using the [resource `dependsOn` meta-argument](https://www.terraform.io/docs/configuration/meta-arguments/depends_on.html). The `triggers` argument should be preferred over `dependsOn`, since `dependsOn` can only capture dependency ordering and will not cause the resource to recreate (redeploy the REST API) with upstream configuration changes.
+
+!> **WARNING:** We recommend using the [`awsApiGatewayStage` resource](api_gateway_stage.html) instead of managing an API Gateway Stage via the `stageName` argument of this resource. When this resource is recreated (REST API redeployment) with the `stageName` configured, the stage is deleted and recreated. This will cause a temporary service interruption, increase Terraform plan differences, and can require a second Terraform apply to recreate any downstream stage configuration such as associated `awsApiMethodSettings` resources.
+
+~> **NOTE:** Enable the [resource `lifecycle` configuration block `createBeforeDestroy` argument](https://www.terraform.io/language/meta-arguments/lifecycle#create_before_destroy) in this resource configuration to properly order redeployments in Terraform. Without enabling `createBeforeDestroy`, API Gateway can return errors such as `BadRequestException: Active stages pointing to this deployment must be moved or deleted` on recreation.
+
+## Example Usage
+
+### OpenAPI Specification
+
+An end-to-end example of a REST API configured with OpenAPI can be found in the [`/examples/apiGatewayRestApiOpenapi` directory within the GitHub repository](https://github.com/hashicorp/terraform-provider-aws/tree/main/examples/api-gateway-rest-api-openapi).
+
+```terraform
+resource "aws_api_gateway_rest_api" "example" {
+  body = jsonencode({
+    openapi = "3.0.1"
+    info = {
+      title   = "example"
+      version = "1.0"
+    }
+    paths = {
+      "/path1" = {
+        get = {
+          x-amazon-apigateway-integration = {
+            httpMethod           = "GET"
+            payloadFormatVersion = "1.0"
+            type                 = "HTTP_PROXY"
+            uri                  = "https://ip-ranges.amazonaws.com/ip-ranges.json"
+          }
+        }
+      }
+    }
+  })
+
+  name = "example"
+}
+
+resource "aws_api_gateway_deployment" "example" {
+  rest_api_id = aws_api_gateway_rest_api.example.id
+
+  triggers = {
+    redeployment = sha1(jsonencode(aws_api_gateway_rest_api.example.body))
+  }
+
+  lifecycle {
+    create_before_destroy = true
+  }
+}
+
+resource "aws_api_gateway_stage" "example" {
+  deployment_id = aws_api_gateway_deployment.example.id
+  rest_api_id   = aws_api_gateway_rest_api.example.id
+  stage_name    = "example"
+}
+```
+
+### Terraform Resources
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, Fn, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ApiGatewayDeployment } from "./.gen/providers/aws/api-gateway-deployment";
+import { ApiGatewayIntegration } from "./.gen/providers/aws/api-gateway-integration";
+import { ApiGatewayMethod } from "./.gen/providers/aws/api-gateway-method";
+import { ApiGatewayResource } from "./.gen/providers/aws/api-gateway-resource";
+import { ApiGatewayRestApi } from "./.gen/providers/aws/api-gateway-rest-api";
+import { ApiGatewayStage } from "./.gen/providers/aws/api-gateway-stage";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new ApiGatewayRestApi(this, "example", {
+      name: "example",
+    });
+    const awsApiGatewayResourceExample = new ApiGatewayResource(
+      this,
+      "example_1",
+      {
+        parentId: example.rootResourceId,
+        pathPart: "example",
+        restApiId: example.id,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsApiGatewayResourceExample.overrideLogicalId("example");
+    const awsApiGatewayMethodExample = new ApiGatewayMethod(this, "example_2", {
+      authorization: "NONE",
+      httpMethod: "GET",
+      resourceId: Token.asString(awsApiGatewayResourceExample.id),
+      restApiId: example.id,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsApiGatewayMethodExample.overrideLogicalId("example");
+    const awsApiGatewayIntegrationExample = new ApiGatewayIntegration(
+      this,
+      "example_3",
+      {
+        httpMethod: Token.asString(awsApiGatewayMethodExample.httpMethod),
+        resourceId: Token.asString(awsApiGatewayResourceExample.id),
+        restApiId: example.id,
+        type: "MOCK",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsApiGatewayIntegrationExample.overrideLogicalId("example");
+    const awsApiGatewayDeploymentExample = new ApiGatewayDeployment(
+      this,
+      "example_4",
+      {
+        lifecycle: {
+          createBeforeDestroy: true,
+        },
+        restApiId: example.id,
+        triggers: {
+          redeployment: Token.asString(
+            Fn.sha1(
+              Token.asString(
+                Fn.jsonencode([
+                  awsApiGatewayResourceExample.id,
+                  awsApiGatewayMethodExample.id,
+                  awsApiGatewayIntegrationExample.id,
+                ])
+              )
+            )
+          ),
+        },
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsApiGatewayDeploymentExample.overrideLogicalId("example");
+    const awsApiGatewayStageExample = new ApiGatewayStage(this, "example_5", {
+      deploymentId: Token.asString(awsApiGatewayDeploymentExample.id),
+      restApiId: example.id,
+      stageName: "example",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsApiGatewayStageExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `restApiId` - (Required) REST API identifier.
+* `description` - (Optional) Description of the deployment
+* `stageName` - (Optional) Name of the stage to create with this deployment. If the specified stage already exists, it will be updated to point to the new deployment. We recommend using the [`awsApiGatewayStage` resource](api_gateway_stage.html) instead to manage stages.
+* `stageDescription` - (Optional) Description to set on the stage managed by the `stageName` argument.
+* `triggers` - (Optional) Map of arbitrary keys and values that, when changed, will trigger a redeployment. To force a redeployment without changing these keys/values, use the [`replace` option](https://developer.hashicorp.com/terraform/cli/commands/plan#replace-address) with `terraform plan` or `terraform apply`.
+* `variables` - (Optional) Map to set on the stage managed by the `stageName` argument.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the deployment
+* `invokeUrl` - URL to invoke the API pointing to the stage,
+  e.g., `https://z4675Bid1JExecuteApiEuWest2AmazonawsCom/prod`
+* `executionArn` - Execution ARN to be used in [`lambdaPermission`](/docs/providers/aws/r/lambda_permission.html)'s `sourceArn`
+  when allowing API Gateway to invoke a Lambda function,
+  e.g., `arn:aws:executeApi:euWest2:123456789012:z4675Bid1J/prod`
+* `createdDate` - Creation date of the deployment
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsApiGatewayDeployment` using `restApiId/deploymentId`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsApiGatewayDeployment` using `restApiId/deploymentId`. For example:
+
+```console
+% terraform import aws_api_gateway_deployment.example aabbccddee/1122334
+```
+
+The `stageName`, `stageDescription`, and `variables` arguments cannot be imported. Use the [`awsApiGatewayStage` resource](api_gateway_stage.html) to import and manage stages.
+
+The `triggers` argument cannot be imported.
+
+<!-- cache-key: cdktf-0.18.0 input-a6bba7a5df573767f5e0da500df7a421964740e00b416a999a065c5b3ab27982 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/api_gateway_documentation_part.html.markdown b/website/docs/cdktf/typescript/r/api_gateway_documentation_part.html.markdown
new file mode 100644
index 00000000000..646272bfbf0
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/api_gateway_documentation_part.html.markdown
@@ -0,0 +1,98 @@
+---
+subcategory: "API Gateway"
+layout: "aws"
+page_title: "AWS: aws_api_gateway_documentation_part"
+description: |-
+  Provides a settings of an API Gateway Documentation Part.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_api_gateway_documentation_part
+
+Provides a settings of an API Gateway Documentation Part.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ApiGatewayDocumentationPart } from "./.gen/providers/aws/api-gateway-documentation-part";
+import { ApiGatewayRestApi } from "./.gen/providers/aws/api-gateway-rest-api";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new ApiGatewayRestApi(this, "example", {
+      name: "example_api",
+    });
+    const awsApiGatewayDocumentationPartExample =
+      new ApiGatewayDocumentationPart(this, "example_1", {
+        location: {
+          method: "GET",
+          path: "/example",
+          type: "METHOD",
+        },
+        properties: '{\\"description\\":\\"Example description\\"}',
+        restApiId: example.id,
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsApiGatewayDocumentationPartExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `location` - (Required) Location of the targeted API entity of the to-be-created documentation part. See below.
+* `properties` - (Required) Content map of API-specific key-value pairs describing the targeted API entity. The map must be encoded as a JSON string, e.g., "{ \"description\": \"The API does ...\" }". Only Swagger-compliant key-value pairs can be exported and, hence, published.
+* `restApiId` - (Required) ID of the associated Rest API
+
+### Nested fields
+
+#### `location`
+
+See supported entity types for each field in the [official docs](https://docs.aws.amazon.com/apigateway/api-reference/resource/documentation-part/).
+
+* `method` - (Optional) HTTP verb of a method. The default value is `*` for any method.
+* `name` - (Optional) Name of the targeted API entity.
+* `path` - (Optional) URL path of the target. The default value is `/` for the root resource.
+* `statusCode` - (Optional) HTTP status code of a response. The default value is `*` for any status code.
+* `type` - (Required) Type of API entity to which the documentation content appliesE.g., `api`, `method` or `requestBody`
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Unique ID of the Documentation Part
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import API Gateway documentation_parts using `restApiId/docPartId`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import API Gateway documentation_parts using `restApiId/docPartId`. For example:
+
+```console
+% terraform import aws_api_gateway_documentation_part.example 5i4e1ko720/3oyy3t
+```
+
+<!-- cache-key: cdktf-0.18.0 input-867334446462d153ff9de196dd9a6b79eb1a29610b4a35e0c546b546c92093da -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/api_gateway_documentation_version.html.markdown b/website/docs/cdktf/typescript/r/api_gateway_documentation_version.html.markdown
new file mode 100644
index 00000000000..12d237a67ba
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/api_gateway_documentation_version.html.markdown
@@ -0,0 +1,92 @@
+---
+subcategory: "API Gateway"
+layout: "aws"
+page_title: "AWS: aws_api_gateway_documentation_version"
+description: |-
+  Provides a resource to manage an API Gateway Documentation Version.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_api_gateway_documentation_version
+
+Provides a resource to manage an API Gateway Documentation Version.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ApiGatewayDocumentationPart } from "./.gen/providers/aws/api-gateway-documentation-part";
+import { ApiGatewayDocumentationVersion } from "./.gen/providers/aws/api-gateway-documentation-version";
+import { ApiGatewayRestApi } from "./.gen/providers/aws/api-gateway-rest-api";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new ApiGatewayRestApi(this, "example", {
+      name: "example_api",
+    });
+    const awsApiGatewayDocumentationPartExample =
+      new ApiGatewayDocumentationPart(this, "example_1", {
+        location: {
+          type: "API",
+        },
+        properties: '{\\"description\\":\\"Example\\"}',
+        restApiId: example.id,
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsApiGatewayDocumentationPartExample.overrideLogicalId("example");
+    const awsApiGatewayDocumentationVersionExample =
+      new ApiGatewayDocumentationVersion(this, "example_2", {
+        dependsOn: [awsApiGatewayDocumentationPartExample],
+        description: "Example description",
+        restApiId: example.id,
+        version: "example_version",
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsApiGatewayDocumentationVersionExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `version` - (Required) Version identifier of the API documentation snapshot.
+* `restApiId` - (Required) ID of the associated Rest API
+* `description` - (Optional) Description of the API documentation version.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import API Gateway documentation versions using `restApiId/version`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import API Gateway documentation versions using `restApiId/version`. For example:
+
+```console
+% terraform import aws_api_gateway_documentation_version.example 5i4e1ko720/example-version
+```
+
+<!-- cache-key: cdktf-0.18.0 input-a4c3d7281104b3d492a309138d97e039e5bb599759343aa17d6a213ef2be7c75 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/api_gateway_domain_name.html.markdown b/website/docs/cdktf/typescript/r/api_gateway_domain_name.html.markdown
new file mode 100644
index 00000000000..719127615fe
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/api_gateway_domain_name.html.markdown
@@ -0,0 +1,287 @@
+---
+subcategory: "API Gateway"
+layout: "aws"
+page_title: "AWS: aws_api_gateway_domain_name"
+description: |-
+  Registers a custom domain name for use with AWS API Gateway.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_api_gateway_domain_name
+
+Registers a custom domain name for use with AWS API Gateway. Additional information about this functionality
+can be found in the [API Gateway Developer Guide](https://docs.aws.amazon.com/apigateway/latest/developerguide/how-to-custom-domains.html).
+
+This resource just establishes ownership of and the TLS settings for
+a particular domain name. An API can be attached to a particular path
+under the registered domain name using
+[the `awsApiGatewayBasePathMapping` resource](api_gateway_base_path_mapping.html).
+
+API Gateway domains can be defined as either 'edge-optimized' or 'regional'.  In an edge-optimized configuration,
+API Gateway internally creates and manages a CloudFront distribution to route requests on the given hostname. In
+addition to this resource it's necessary to create a DNS record corresponding to the given domain name which is an alias
+(either Route53 alias or traditional CNAME) to the Cloudfront domain name exported in the `cloudfrontDomainName`
+attribute.
+
+In a regional configuration, API Gateway does not create a CloudFront distribution to route requests to the API, though
+a distribution can be created if needed. In either case, it is necessary to create a DNS record corresponding to the
+given domain name which is an alias (either Route53 alias or traditional CNAME) to the regional domain name exported in
+the `regionalDomainName` attribute.
+
+~> **Note:** API Gateway requires the use of AWS Certificate Manager (ACM) certificates instead of Identity and Access Management (IAM) certificates in regions that support ACM. Regions that support ACM can be found in the [Regions and Endpoints Documentation](https://docs.aws.amazon.com/general/latest/gr/rande.html#acm_region). To import an existing private key and certificate into ACM or request an ACM certificate, see the [`awsAcmCertificate` resource](/docs/providers/aws/r/acm_certificate.html).
+
+~> **Note:** The `awsApiGatewayDomainName` resource expects dependency on the `awsAcmCertificateValidation` as
+only verified certificates can be used. This can be made either explicitly by adding the
+`depends_on = [aws_acm_certificate_validation.cert]` attribute. Or implicitly by referring certificate ARN
+from the validation resource where it will be available after the resource creation:
+`regional_certificate_arn = aws_acm_certificate_validation.cert.certificate_arn`.
+
+~> **Note:** All arguments including the private key will be stored in the raw state as plain-text.
+[Read more about sensitive data in state](https://www.terraform.io/docs/state/sensitive-data.html).
+
+## Example Usage
+
+An end-to-end example of a REST API configured with OpenAPI can be found in the [`/examples/apiGatewayRestApiOpenapi` directory within the GitHub repository](https://github.com/hashicorp/terraform-provider-aws/tree/main/examples/api-gateway-rest-api-openapi).
+
+### Edge Optimized (ACM Certificate)
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ApiGatewayDomainName } from "./.gen/providers/aws/api-gateway-domain-name";
+import { Route53Record } from "./.gen/providers/aws/route53-record";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new ApiGatewayDomainName(this, "example", {
+      certificateArn: Token.asString(
+        awsAcmCertificateValidationExample.certificateArn
+      ),
+      domainName: "api.example.com",
+    });
+    const awsRoute53RecordExample = new Route53Record(this, "example_1", {
+      alias: {
+        evaluateTargetHealth: true,
+        name: example.cloudfrontDomainName,
+        zoneId: example.cloudfrontZoneId,
+      },
+      name: example.domainName,
+      type: "A",
+      zoneId: Token.asString(awsRoute53ZoneExample.id),
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsRoute53RecordExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### Edge Optimized (IAM Certificate)
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ApiGatewayDomainName } from "./.gen/providers/aws/api-gateway-domain-name";
+import { Route53Record } from "./.gen/providers/aws/route53-record";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new ApiGatewayDomainName(this, "example", {
+      certificateBody: Token.asString(
+        Fn.file("${path.module}/example.com/example.crt")
+      ),
+      certificateChain: Token.asString(
+        Fn.file("${path.module}/example.com/ca.crt")
+      ),
+      certificateName: "example-api",
+      certificatePrivateKey: Token.asString(
+        Fn.file("${path.module}/example.com/example.key")
+      ),
+      domainName: "api.example.com",
+    });
+    const awsRoute53RecordExample = new Route53Record(this, "example_1", {
+      alias: {
+        evaluateTargetHealth: true,
+        name: example.cloudfrontDomainName,
+        zoneId: example.cloudfrontZoneId,
+      },
+      name: example.domainName,
+      type: "A",
+      zoneId: Token.asString(awsRoute53ZoneExample.id),
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsRoute53RecordExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### Regional (ACM Certificate)
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ApiGatewayDomainName } from "./.gen/providers/aws/api-gateway-domain-name";
+import { Route53Record } from "./.gen/providers/aws/route53-record";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new ApiGatewayDomainName(this, "example", {
+      domainName: "api.example.com",
+      endpointConfiguration: {
+        types: ["REGIONAL"],
+      },
+      regionalCertificateArn: Token.asString(
+        awsAcmCertificateValidationExample.certificateArn
+      ),
+    });
+    const awsRoute53RecordExample = new Route53Record(this, "example_1", {
+      alias: {
+        evaluateTargetHealth: true,
+        name: example.regionalDomainName,
+        zoneId: example.regionalZoneId,
+      },
+      name: example.domainName,
+      type: "A",
+      zoneId: Token.asString(awsRoute53ZoneExample.id),
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsRoute53RecordExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### Regional (IAM Certificate)
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ApiGatewayDomainName } from "./.gen/providers/aws/api-gateway-domain-name";
+import { Route53Record } from "./.gen/providers/aws/route53-record";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new ApiGatewayDomainName(this, "example", {
+      certificateBody: Token.asString(
+        Fn.file("${path.module}/example.com/example.crt")
+      ),
+      certificateChain: Token.asString(
+        Fn.file("${path.module}/example.com/ca.crt")
+      ),
+      certificatePrivateKey: Token.asString(
+        Fn.file("${path.module}/example.com/example.key")
+      ),
+      domainName: "api.example.com",
+      endpointConfiguration: {
+        types: ["REGIONAL"],
+      },
+      regionalCertificateName: "example-api",
+    });
+    const awsRoute53RecordExample = new Route53Record(this, "example_1", {
+      alias: {
+        evaluateTargetHealth: true,
+        name: example.regionalDomainName,
+        zoneId: example.regionalZoneId,
+      },
+      name: example.domainName,
+      type: "A",
+      zoneId: Token.asString(awsRoute53ZoneExample.id),
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsRoute53RecordExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `domainName` - (Required) Fully-qualified domain name to register.
+* `endpointConfiguration` - (Optional) Configuration block defining API endpoint information including type. See below.
+* `mutualTlsAuthentication` - (Optional) Mutual TLS authentication configuration for the domain name. See below.
+* `ownershipVerificationCertificateArn` - (Optional) ARN of the AWS-issued certificate used to validate custom domain ownership (when `certificateArn` is issued via an ACM Private CA or `mutualTlsAuthentication` is configured with an ACM-imported certificate.)
+* `securityPolicy` - (Optional) Transport Layer Security (TLS) version + cipher suite for this DomainName. Valid values are `tls10` and `tls12`. Must be configured to perform drift detection.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+When referencing an AWS-managed certificate, the following arguments are supported:
+
+* `certificateArn` - (Optional) ARN for an AWS-managed certificate. AWS Certificate Manager is the only supported source. Used when an edge-optimized domain name is desired. Conflicts with `certificateName`, `certificateBody`, `certificateChain`, `certificatePrivateKey`, `regionalCertificateArn`, and `regionalCertificateName`.
+* `regionalCertificateArn` - (Optional) ARN for an AWS-managed certificate. AWS Certificate Manager is the only supported source. Used when a regional domain name is desired. Conflicts with `certificateArn`, `certificateName`, `certificateBody`, `certificateChain`, and `certificatePrivateKey`.
+
+When uploading a certificate, the following arguments are supported:
+
+* `certificateBody` - (Optional) Certificate issued for the domain name being registered, in PEM format. Only valid for `edge` endpoint configuration type. Conflicts with `certificateArn`, `regionalCertificateArn`, and `regionalCertificateName`.
+* `certificateChain` - (Optional) Certificate for the CA that issued the certificate, along with any intermediate CA certificates required to create an unbroken chain to a certificate trusted by the intended API clients. Only valid for `edge` endpoint configuration type. Conflicts with `certificateArn`, `regionalCertificateArn`, and `regionalCertificateName`.
+* `certificateName` - (Optional) Unique name to use when registering this certificate as an IAM server certificate. Conflicts with `certificateArn`, `regionalCertificateArn`, and `regionalCertificateName`. Required if `certificateArn` is not set.
+* `certificatePrivateKey` - (Optional) Private key associated with the domain certificate given in `certificateBody`. Only valid for `edge` endpoint configuration type. Conflicts with `certificateArn`, `regionalCertificateArn`, and `regionalCertificateName`.
+* `regionalCertificateName` - (Optional) User-friendly name of the certificate that will be used by regional endpoint for this domain name. Conflicts with `certificateArn`, `certificateName`, `certificateBody`, `certificateChain`, and `certificatePrivateKey`.
+
+### endpoint_configuration
+
+* `types` - (Required) List of endpoint types. This resource currently only supports managing a single value. Valid values: `edge` or `regional`. If unspecified, defaults to `edge`. Must be declared as `regional` in non-Commercial partitions. Refer to the [documentation](https://docs.aws.amazon.com/apigateway/latest/developerguide/create-regional-api.html) for more information on the difference between edge-optimized and regional APIs.
+
+### mutual_tls_authentication
+
+* `truststoreUri` - (Required) Amazon S3 URL that specifies the truststore for mutual TLS authentication, for example, `s3://bucketName/keyName`. The truststore can contain certificates from public or private certificate authorities. To update the truststore, upload a new version to S3, and then update your custom domain name to use the new version.
+* `truststoreVersion` - (Optional) Version of the S3 object that contains the truststore. To specify a version, you must have versioning enabled for the S3 bucket.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of domain name.
+* `certificateUploadDate` - Upload date associated with the domain certificate.
+* `cloudfrontDomainName` - Hostname created by Cloudfront to represent the distribution that implements this domain name mapping.
+* `cloudfrontZoneId` - For convenience, the hosted zone ID (`z2Fdtndataqyw2`) that can be used to create a Route53 alias record for the distribution.
+* `id` - Internal identifier assigned to this domain name by API Gateway.
+* `regionalDomainName` - Hostname for the custom domain's regional endpoint.
+* `regionalZoneId` - Hosted zone ID that can be used to create a Route53 alias record for the regional endpoint.
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import API Gateway domain names using their `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import API Gateway domain names using their `name`. For example:
+
+```console
+% terraform import aws_api_gateway_domain_name.example dev.example.com
+```
+
+<!-- cache-key: cdktf-0.18.0 input-94b48fa1d23d0d114bb8d9f31a16923c5bf9db107914287c83b704a97489f072 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/api_gateway_gateway_response.html.markdown b/website/docs/cdktf/typescript/r/api_gateway_gateway_response.html.markdown
new file mode 100644
index 00000000000..34b5cc2aef2
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/api_gateway_gateway_response.html.markdown
@@ -0,0 +1,85 @@
+---
+subcategory: "API Gateway"
+layout: "aws"
+page_title: "AWS: aws_api_gateway_gateway_response"
+description: |-
+  Provides an API Gateway Gateway Response for a REST API Gateway.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_api_gateway_gateway_response
+
+Provides an API Gateway Gateway Response for a REST API Gateway.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ApiGatewayGatewayResponse } from "./.gen/providers/aws/api-gateway-gateway-response";
+import { ApiGatewayRestApi } from "./.gen/providers/aws/api-gateway-rest-api";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const main = new ApiGatewayRestApi(this, "main", {
+      name: "MyDemoAPI",
+    });
+    new ApiGatewayGatewayResponse(this, "test", {
+      responseParameters: {
+        "gatewayresponse.header.Authorization": "'Basic'",
+      },
+      responseTemplates: {
+        "application/json": '{\\"message\\":$context.error.messageString}',
+      },
+      responseType: "UNAUTHORIZED",
+      restApiId: main.id,
+      statusCode: "401",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `restApiId` - (Required) String identifier of the associated REST API.
+* `responseType` - (Required) Response type of the associated GatewayResponse.
+* `statusCode` - (Optional) HTTP status code of the Gateway Response.
+* `responseTemplates` - (Optional) Map of templates used to transform the response body.
+* `responseParameters` - (Optional) Map of parameters (paths, query strings and headers) of the Gateway Response.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsApiGatewayGatewayResponse` using `restApiId/responseType`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsApiGatewayGatewayResponse` using `restApiId/responseType`. For example:
+
+```console
+% terraform import aws_api_gateway_gateway_response.example 12345abcde/UNAUTHORIZED
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1cf3d4efa3dea58b3eb33a7d86b84e6f760a3bfa3f2190d9e1f9e796eec417fc -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/api_gateway_gateway_response.markdown b/website/docs/cdktf/typescript/r/api_gateway_gateway_response.markdown
new file mode 100644
index 00000000000..34b5cc2aef2
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/api_gateway_gateway_response.markdown
@@ -0,0 +1,85 @@
+---
+subcategory: "API Gateway"
+layout: "aws"
+page_title: "AWS: aws_api_gateway_gateway_response"
+description: |-
+  Provides an API Gateway Gateway Response for a REST API Gateway.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_api_gateway_gateway_response
+
+Provides an API Gateway Gateway Response for a REST API Gateway.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ApiGatewayGatewayResponse } from "./.gen/providers/aws/api-gateway-gateway-response";
+import { ApiGatewayRestApi } from "./.gen/providers/aws/api-gateway-rest-api";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const main = new ApiGatewayRestApi(this, "main", {
+      name: "MyDemoAPI",
+    });
+    new ApiGatewayGatewayResponse(this, "test", {
+      responseParameters: {
+        "gatewayresponse.header.Authorization": "'Basic'",
+      },
+      responseTemplates: {
+        "application/json": '{\\"message\\":$context.error.messageString}',
+      },
+      responseType: "UNAUTHORIZED",
+      restApiId: main.id,
+      statusCode: "401",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `restApiId` - (Required) String identifier of the associated REST API.
+* `responseType` - (Required) Response type of the associated GatewayResponse.
+* `statusCode` - (Optional) HTTP status code of the Gateway Response.
+* `responseTemplates` - (Optional) Map of templates used to transform the response body.
+* `responseParameters` - (Optional) Map of parameters (paths, query strings and headers) of the Gateway Response.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsApiGatewayGatewayResponse` using `restApiId/responseType`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsApiGatewayGatewayResponse` using `restApiId/responseType`. For example:
+
+```console
+% terraform import aws_api_gateway_gateway_response.example 12345abcde/UNAUTHORIZED
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1cf3d4efa3dea58b3eb33a7d86b84e6f760a3bfa3f2190d9e1f9e796eec417fc -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/api_gateway_integration.html.markdown b/website/docs/cdktf/typescript/r/api_gateway_integration.html.markdown
new file mode 100644
index 00000000000..f78e484374a
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/api_gateway_integration.html.markdown
@@ -0,0 +1,314 @@
+---
+subcategory: "API Gateway"
+layout: "aws"
+page_title: "AWS: aws_api_gateway_integration"
+description: |-
+  Provides an HTTP Method Integration for an API Gateway Integration.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_api_gateway_integration
+
+Provides an HTTP Method Integration for an API Gateway Integration.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ApiGatewayIntegration } from "./.gen/providers/aws/api-gateway-integration";
+import { ApiGatewayMethod } from "./.gen/providers/aws/api-gateway-method";
+import { ApiGatewayResource } from "./.gen/providers/aws/api-gateway-resource";
+import { ApiGatewayRestApi } from "./.gen/providers/aws/api-gateway-rest-api";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const myDemoApi = new ApiGatewayRestApi(this, "MyDemoAPI", {
+      description: "This is my API for demonstration purposes",
+      name: "MyDemoAPI",
+    });
+    const myDemoResource = new ApiGatewayResource(this, "MyDemoResource", {
+      parentId: myDemoApi.rootResourceId,
+      pathPart: "mydemoresource",
+      restApiId: myDemoApi.id,
+    });
+    const myDemoMethod = new ApiGatewayMethod(this, "MyDemoMethod", {
+      authorization: "NONE",
+      httpMethod: "GET",
+      resourceId: myDemoResource.id,
+      restApiId: myDemoApi.id,
+    });
+    new ApiGatewayIntegration(this, "MyDemoIntegration", {
+      cacheKeyParameters: ["method.request.path.param"],
+      cacheNamespace: "foobar",
+      httpMethod: myDemoMethod.httpMethod,
+      requestParameters: {
+        "integration.request.header.X-Authorization": "'static'",
+      },
+      requestTemplates: {
+        "application/xml": "{\n   \"body\" : $input.json('$')\n}\n\n",
+      },
+      resourceId: myDemoResource.id,
+      restApiId: myDemoApi.id,
+      timeoutMilliseconds: 29000,
+      type: "MOCK",
+    });
+  }
+}
+
+```
+
+## Lambda integration
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformVariable, Token, Fn, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ApiGatewayIntegration } from "./.gen/providers/aws/api-gateway-integration";
+import { ApiGatewayMethod } from "./.gen/providers/aws/api-gateway-method";
+import { ApiGatewayResource } from "./.gen/providers/aws/api-gateway-resource";
+import { ApiGatewayRestApi } from "./.gen/providers/aws/api-gateway-rest-api";
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+import { LambdaFunction } from "./.gen/providers/aws/lambda-function";
+import { LambdaPermission } from "./.gen/providers/aws/lambda-permission";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    /*Terraform Variables are not always the best fit for getting inputs in the context of Terraform CDK.
+    You can read more about this at https://cdk.tf/variables*/
+    const accountId = new TerraformVariable(this, "accountId", {});
+    const myregion = new TerraformVariable(this, "myregion", {});
+    const api = new ApiGatewayRestApi(this, "api", {
+      name: "myapi",
+    });
+    const assumeRole = new DataAwsIamPolicyDocument(this, "assume_role", {
+      statement: [
+        {
+          actions: ["sts:AssumeRole"],
+          effect: "Allow",
+          principals: [
+            {
+              identifiers: ["lambda.amazonaws.com"],
+              type: "Service",
+            },
+          ],
+        },
+      ],
+    });
+    const resource = new ApiGatewayResource(this, "resource", {
+      parentId: api.rootResourceId,
+      pathPart: "resource",
+      restApiId: api.id,
+    });
+    const role = new IamRole(this, "role", {
+      assumeRolePolicy: Token.asString(assumeRole.json),
+      name: "myrole",
+    });
+    const lambda = new LambdaFunction(this, "lambda", {
+      filename: "lambda.zip",
+      functionName: "mylambda",
+      handler: "lambda.lambda_handler",
+      role: role.arn,
+      runtime: "python3.7",
+      sourceCodeHash: Token.asString(Fn.filebase64sha256("lambda.zip")),
+    });
+    const method = new ApiGatewayMethod(this, "method", {
+      authorization: "NONE",
+      httpMethod: "GET",
+      resourceId: resource.id,
+      restApiId: api.id,
+    });
+    new LambdaPermission(this, "apigw_lambda", {
+      action: "lambda:InvokeFunction",
+      functionName: lambda.functionName,
+      principal: "apigateway.amazonaws.com",
+      sourceArn:
+        "arn:aws:execute-api:${" +
+        myregion.value +
+        "}:${" +
+        accountId.value +
+        "}:${" +
+        api.id +
+        "}/*/${" +
+        method.httpMethod +
+        "${" +
+        resource.path +
+        "}",
+      statementId: "AllowExecutionFromAPIGateway",
+    });
+    new ApiGatewayIntegration(this, "integration", {
+      httpMethod: method.httpMethod,
+      integrationHttpMethod: "POST",
+      resourceId: resource.id,
+      restApiId: api.id,
+      type: "AWS_PROXY",
+      uri: lambda.invokeArn,
+    });
+  }
+}
+
+```
+
+## VPC Link
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformVariable, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ApiGatewayIntegration } from "./.gen/providers/aws/api-gateway-integration";
+import { ApiGatewayMethod } from "./.gen/providers/aws/api-gateway-method";
+import { ApiGatewayResource } from "./.gen/providers/aws/api-gateway-resource";
+import { ApiGatewayRestApi } from "./.gen/providers/aws/api-gateway-rest-api";
+import { ApiGatewayVpcLink } from "./.gen/providers/aws/api-gateway-vpc-link";
+import { Lb } from "./.gen/providers/aws/lb";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    /*Terraform Variables are not always the best fit for getting inputs in the context of Terraform CDK.
+    You can read more about this at https://cdk.tf/variables*/
+    const name = new TerraformVariable(this, "name", {});
+    const subnetId = new TerraformVariable(this, "subnet_id", {});
+    const test = new ApiGatewayRestApi(this, "test", {
+      name: name.stringValue,
+    });
+    const awsLbTest = new Lb(this, "test_3", {
+      internal: true,
+      loadBalancerType: "network",
+      name: name.stringValue,
+      subnets: [subnetId.stringValue],
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsLbTest.overrideLogicalId("test");
+    const awsApiGatewayResourceTest = new ApiGatewayResource(this, "test_4", {
+      parentId: test.rootResourceId,
+      pathPart: "test",
+      restApiId: test.id,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsApiGatewayResourceTest.overrideLogicalId("test");
+    const awsApiGatewayVpcLinkTest = new ApiGatewayVpcLink(this, "test_5", {
+      name: name.stringValue,
+      targetArns: [Token.asString(awsLbTest.arn)],
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsApiGatewayVpcLinkTest.overrideLogicalId("test");
+    const awsApiGatewayMethodTest = new ApiGatewayMethod(this, "test_6", {
+      authorization: "NONE",
+      httpMethod: "GET",
+      requestModels: {
+        "application/json": "Error",
+      },
+      resourceId: Token.asString(awsApiGatewayResourceTest.id),
+      restApiId: test.id,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsApiGatewayMethodTest.overrideLogicalId("test");
+    const awsApiGatewayIntegrationTest = new ApiGatewayIntegration(
+      this,
+      "test_7",
+      {
+        connectionId: Token.asString(awsApiGatewayVpcLinkTest.id),
+        connectionType: "VPC_LINK",
+        contentHandling: "CONVERT_TO_TEXT",
+        httpMethod: Token.asString(awsApiGatewayMethodTest.httpMethod),
+        integrationHttpMethod: "GET",
+        passthroughBehavior: "WHEN_NO_MATCH",
+        requestParameters: {
+          "integration.request.header.X-Authorization": "'static'",
+          "integration.request.header.X-Foo": "'Bar'",
+        },
+        requestTemplates: {
+          "application/json": "",
+          "application/xml": "#set($inputRoot = $input.path('$'))\n{ }\n",
+        },
+        resourceId: Token.asString(awsApiGatewayResourceTest.id),
+        restApiId: test.id,
+        type: "HTTP",
+        uri: "https://www.google.de",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsApiGatewayIntegrationTest.overrideLogicalId("test");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `restApiId` - (Required) ID of the associated REST API.
+* `resourceId` - (Required) API resource ID.
+* `httpMethod` - (Required) HTTP method (`get`, `post`, `put`, `delete`, `head`, `option`, `any`)
+  when calling the associated resource.
+* `integrationHttpMethod` - (Optional) Integration HTTP method
+  (`get`, `post`, `put`, `delete`, `head`, `optioNs`, `any`, `patch`) specifying how API Gateway will interact with the back end.
+  **Required** if `type` is `aws`, `awsProxy`, `http` or `httpProxy`.
+  Not all methods are compatible with all `aws` integrations.
+  e.g., Lambda function [can only be invoked](https://github.com/awslabs/aws-apigateway-importer/issues/9#issuecomment-129651005) via `post`.
+* `type` - (Required) Integration input's [type](https://docs.aws.amazon.com/apigateway/api-reference/resource/integration/). Valid values are `http` (for HTTP backends), `mock` (not calling any real backend), `aws` (for AWS services), `awsProxy` (for Lambda proxy integration) and `httpProxy` (for HTTP proxy integration). An `http` or `httpProxy` integration with a `connectionType` of `vpcLink` is referred to as a private integration and uses a VpcLink to connect API Gateway to a network load balancer of a VPC.
+* `connectionType` - (Optional) Integration input's [connectionType](https://docs.aws.amazon.com/apigateway/api-reference/resource/integration/#connectionType). Valid values are `internet` (default for connections through the public routable internet), and `vpcLink` (for private connections between API Gateway and a network load balancer in a VPC).
+* `connectionId` - (Optional) ID of the VpcLink used for the integration. **Required** if `connectionType` is `vpcLink`
+* `uri` - (Optional) Input's URI. **Required** if `type` is `aws`, `awsProxy`, `http` or `httpProxy`.
+  For HTTP integrations, the URI must be a fully formed, encoded HTTP(S) URL according to the RFC-3986 specification . For AWS integrations, the URI should be of the form `arn:aws:apigateway:{region}:{subdomainService|service}:{path|action}/{serviceApi}`. `region`, `subdomain` and `service` are used to determine the right endpoint.
+  e.g., `arn:aws:apigateway:euWest1:lambda:path/20150331/functions/arn:aws:lambda:euWest1:012345678901:function:myFunc/invocations`. For private integrations, the URI parameter is not used for routing requests to your endpoint, but is used for setting the Host header and for certificate validation.
+* `credentials` - (Optional) Credentials required for the integration. For `aws` integrations, 2 options are available. To specify an IAM Role for Amazon API Gateway to assume, use the role's ARN. To require that the caller's identity be passed through from the request, specify the string `arn:aws:iam::\*:user/\*`.
+* `requestTemplates` - (Optional) Map of the integration's request templates.
+* `requestParameters` - (Optional) Map of request query string parameters and headers that should be passed to the backend responder.
+  For example: `request_parameters = { "integration.request.header.X-Some-Other-Header" = "method.request.header.X-Some-Header" }`
+* `passthroughBehavior` - (Optional) Integration passthrough behavior (`whenNoMatch`, `whenNoTemplates`, `never`).  **Required** if `requestTemplates` is used.
+* `cacheKeyParameters` - (Optional) List of cache key parameters for the integration.
+* `cacheNamespace` - (Optional) Integration's cache namespace.
+* `contentHandling` - (Optional) How to handle request payload content type conversions. Supported values are `convertToBinary` and `convertToText`. If this property is not defined, the request payload will be passed through from the method request to integration request without modification, provided that the passthroughBehaviors is configured to support payload pass-through.
+* `timeoutMilliseconds` - (Optional) Custom timeout between 50 and 29,000 milliseconds. The default value is 29,000 milliseconds.
+* `tlsConfig` - (Optional) TLS configuration. See below.
+
+### tls_config Configuration Block
+
+The `tlsConfig` configuration block supports the following arguments:
+
+* `insecureSkipVerification` - (Optional) Whether or not API Gateway skips verification that the certificate for an integration endpoint is issued by a [supported certificate authority](https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-supported-certificate-authorities-for-http-endpoints.html). This isn’t recommended, but it enables you to use certificates that are signed by private certificate authorities, or certificates that are self-signed. If enabled, API Gateway still performs basic certificate validation, which includes checking the certificate's expiration date, hostname, and presence of a root certificate authority. Supported only for `http` and `httpProxy` integrations.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsApiGatewayIntegration` using `restApiId/resourceId/httpMethod`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsApiGatewayIntegration` using `restApiId/resourceId/httpMethod`. For example:
+
+```console
+% terraform import aws_api_gateway_integration.example 12345abcde/67890fghij/GET
+```
+
+<!-- cache-key: cdktf-0.18.0 input-6579a01c31e2b3a3e752d392012759bae929079686c0227bc0bc75da134a211f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/api_gateway_integration_response.html.markdown b/website/docs/cdktf/typescript/r/api_gateway_integration_response.html.markdown
new file mode 100644
index 00000000000..0af104e0dca
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/api_gateway_integration_response.html.markdown
@@ -0,0 +1,121 @@
+---
+subcategory: "API Gateway"
+layout: "aws"
+page_title: "AWS: aws_api_gateway_integration_response"
+description: |-
+  Provides an HTTP Method Integration Response for an API Gateway Resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_api_gateway_integration_response
+
+Provides an HTTP Method Integration Response for an API Gateway Resource.
+
+-> **Note:** Depends on having `awsApiGatewayIntegration` inside your rest api. To ensure this
+you might need to add an explicit `dependsOn` for clean runs.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ApiGatewayIntegration } from "./.gen/providers/aws/api-gateway-integration";
+import { ApiGatewayIntegrationResponse } from "./.gen/providers/aws/api-gateway-integration-response";
+import { ApiGatewayMethod } from "./.gen/providers/aws/api-gateway-method";
+import { ApiGatewayMethodResponse } from "./.gen/providers/aws/api-gateway-method-response";
+import { ApiGatewayResource } from "./.gen/providers/aws/api-gateway-resource";
+import { ApiGatewayRestApi } from "./.gen/providers/aws/api-gateway-rest-api";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const myDemoApi = new ApiGatewayRestApi(this, "MyDemoAPI", {
+      description: "This is my API for demonstration purposes",
+      name: "MyDemoAPI",
+    });
+    const myDemoResource = new ApiGatewayResource(this, "MyDemoResource", {
+      parentId: myDemoApi.rootResourceId,
+      pathPart: "mydemoresource",
+      restApiId: myDemoApi.id,
+    });
+    const myDemoMethod = new ApiGatewayMethod(this, "MyDemoMethod", {
+      authorization: "NONE",
+      httpMethod: "GET",
+      resourceId: myDemoResource.id,
+      restApiId: myDemoApi.id,
+    });
+    const response200 = new ApiGatewayMethodResponse(this, "response_200", {
+      httpMethod: myDemoMethod.httpMethod,
+      resourceId: myDemoResource.id,
+      restApiId: myDemoApi.id,
+      statusCode: "200",
+    });
+    new ApiGatewayIntegration(this, "MyDemoIntegration", {
+      httpMethod: myDemoMethod.httpMethod,
+      resourceId: myDemoResource.id,
+      restApiId: myDemoApi.id,
+      type: "MOCK",
+    });
+    new ApiGatewayIntegrationResponse(this, "MyDemoIntegrationResponse", {
+      httpMethod: myDemoMethod.httpMethod,
+      resourceId: myDemoResource.id,
+      responseTemplates: {
+        "application/xml":
+          '#set($inputRoot = $input.path(\'$\'))\n<?xml version="1.0" encoding="UTF-8"?>\n<message>\n    $inputRoot.body\n</message>\n\n',
+      },
+      restApiId: myDemoApi.id,
+      statusCode: response200.statusCode,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `httpMethod` - (Required) HTTP method (`get`, `post`, `put`, `delete`, `head`, `options`, `any`).
+* `resourceId` - (Required) API resource ID.
+* `restApiId` - (Required) ID of the associated REST API.
+* `statusCode` - (Required) HTTP status code.
+
+The following arguments are optional:
+
+* `contentHandling` - (Optional) How to handle request payload content type conversions. Supported values are `convertToBinary` and `convertToText`. If this property is not defined, the response payload will be passed through from the integration response to the method response without modification.
+* `responseParameters` - (Optional) Map of response parameters that can be read from the backend response. For example: `response_parameters = { "method.response.header.X-Some-Header" = "integration.response.header.X-Some-Other-Header" }`.
+* `responseTemplates` - (Optional) Map of templates used to transform the integration response body.
+* `selectionPattern` - (Optional) Regular expression pattern used to choose an integration response based on the response from the backend. Omit configuring this to make the integration the default one. If the backend is an `aws` Lambda function, the AWS Lambda function error header is matched. For all other `http` and `aws` backends, the HTTP status code is matched.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsApiGatewayIntegrationResponse` using `restApiId/resourceId/httpMethod/statusCode`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsApiGatewayIntegrationResponse` using `restApiId/resourceId/httpMethod/statusCode`. For example:
+
+```console
+% terraform import aws_api_gateway_integration_response.example 12345abcde/67890fghij/GET/200
+```
+
+<!-- cache-key: cdktf-0.18.0 input-97c39e121698d07126a2f35c245570b6347a512d3549856ca8d5c2fc0f8be7e7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/api_gateway_method.html.markdown b/website/docs/cdktf/typescript/r/api_gateway_method.html.markdown
new file mode 100644
index 00000000000..ae26316ec0a
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/api_gateway_method.html.markdown
@@ -0,0 +1,167 @@
+---
+subcategory: "API Gateway"
+layout: "aws"
+page_title: "AWS: aws_api_gateway_method"
+description: |-
+  Provides a HTTP Method for an API Gateway Resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_api_gateway_method
+
+Provides a HTTP Method for an API Gateway Resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ApiGatewayMethod } from "./.gen/providers/aws/api-gateway-method";
+import { ApiGatewayResource } from "./.gen/providers/aws/api-gateway-resource";
+import { ApiGatewayRestApi } from "./.gen/providers/aws/api-gateway-rest-api";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const myDemoApi = new ApiGatewayRestApi(this, "MyDemoAPI", {
+      description: "This is my API for demonstration purposes",
+      name: "MyDemoAPI",
+    });
+    const myDemoResource = new ApiGatewayResource(this, "MyDemoResource", {
+      parentId: myDemoApi.rootResourceId,
+      pathPart: "mydemoresource",
+      restApiId: myDemoApi.id,
+    });
+    new ApiGatewayMethod(this, "MyDemoMethod", {
+      authorization: "NONE",
+      httpMethod: "GET",
+      resourceId: myDemoResource.id,
+      restApiId: myDemoApi.id,
+    });
+  }
+}
+
+```
+
+## Usage with Cognito User Pool Authorizer
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformVariable, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ApiGatewayAuthorizer } from "./.gen/providers/aws/api-gateway-authorizer";
+import { ApiGatewayMethod } from "./.gen/providers/aws/api-gateway-method";
+import { ApiGatewayResource } from "./.gen/providers/aws/api-gateway-resource";
+import { ApiGatewayRestApi } from "./.gen/providers/aws/api-gateway-rest-api";
+import { DataAwsCognitoUserPools } from "./.gen/providers/aws/data-aws-cognito-user-pools";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    /*Terraform Variables are not always the best fit for getting inputs in the context of Terraform CDK.
+    You can read more about this at https://cdk.tf/variables*/
+    const cognitoUserPoolName = new TerraformVariable(
+      this,
+      "cognito_user_pool_name",
+      {}
+    );
+    const thisVar = new ApiGatewayRestApi(this, "this", {
+      name: "with-authorizer",
+    });
+    const dataAwsCognitoUserPoolsThis = new DataAwsCognitoUserPools(
+      this,
+      "this_2",
+      {
+        name: cognitoUserPoolName.stringValue,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsCognitoUserPoolsThis.overrideLogicalId("this");
+    const awsApiGatewayAuthorizerThis = new ApiGatewayAuthorizer(
+      this,
+      "this_3",
+      {
+        name: "CognitoUserPoolAuthorizer",
+        providerArns: Token.asList(dataAwsCognitoUserPoolsThis.arns),
+        restApiId: thisVar.id,
+        type: "COGNITO_USER_POOLS",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsApiGatewayAuthorizerThis.overrideLogicalId("this");
+    const awsApiGatewayResourceThis = new ApiGatewayResource(this, "this_4", {
+      parentId: thisVar.rootResourceId,
+      pathPart: "{proxy+}",
+      restApiId: thisVar.id,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsApiGatewayResourceThis.overrideLogicalId("this");
+    new ApiGatewayMethod(this, "any", {
+      authorization: "COGNITO_USER_POOLS",
+      authorizerId: Token.asString(awsApiGatewayAuthorizerThis.id),
+      httpMethod: "ANY",
+      requestParameters: {
+        "method.request.path.proxy": true,
+      },
+      resourceId: Token.asString(awsApiGatewayResourceThis.id),
+      restApiId: thisVar.id,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `restApiId` - (Required) ID of the associated REST API
+* `resourceId` - (Required) API resource ID
+* `httpMethod` - (Required) HTTP Method (`get`, `post`, `put`, `delete`, `head`, `options`, `any`)
+* `authorization` - (Required) Type of authorization used for the method (`none`, `custom`, `awsIam`, `cognitoUserPools`)
+* `authorizerId` - (Optional) Authorizer id to be used when the authorization is `custom` or `cognitoUserPools`
+* `authorizationScopes` - (Optional) Authorization scopes used when the authorization is `cognitoUserPools`
+* `apiKeyRequired` - (Optional) Specify if the method requires an API key
+* `operationName` - (Optional) Function name that will be given to the method when generating an SDK through API Gateway. If omitted, API Gateway will generate a function name based on the resource path and HTTP verb.
+* `requestModels` - (Optional) Map of the API models used for the request's content type
+  where key is the content type (e.g., `application/json`)
+  and value is either `error`, `empty` (built-in models) or `awsApiGatewayModel`'s `name`.
+* `requestValidatorId` - (Optional) ID of a `awsApiGatewayRequestValidator`
+* `requestParameters` - (Optional) Map of request parameters (from the path, query string and headers) that should be passed to the integration. The boolean value indicates whether the parameter is required (`true`) or optional (`false`).
+  For example: `request_parameters = {"method.request.header.X-Some-Header" = true "method.request.querystring.some-query-param" = true}` would define that the header `xSomeHeader` and the query string `someQueryParam` must be provided in the request.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsApiGatewayMethod` using `restApiId/resourceId/httpMethod`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsApiGatewayMethod` using `restApiId/resourceId/httpMethod`. For example:
+
+```console
+% terraform import aws_api_gateway_method.example 12345abcde/67890fghij/GET
+```
+
+<!-- cache-key: cdktf-0.18.0 input-d5fc57c36d3feff79723b5c6ed0551e4895d96864eaac47e1cfecf484fd84f98 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/api_gateway_method_response.html.markdown b/website/docs/cdktf/typescript/r/api_gateway_method_response.html.markdown
new file mode 100644
index 00000000000..e57bbfd900f
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/api_gateway_method_response.html.markdown
@@ -0,0 +1,104 @@
+---
+subcategory: "API Gateway"
+layout: "aws"
+page_title: "AWS: aws_api_gateway_method_response"
+description: |-
+  Provides an HTTP Method Response for an API Gateway Resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_api_gateway_method_response
+
+Provides an HTTP Method Response for an API Gateway Resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ApiGatewayIntegration } from "./.gen/providers/aws/api-gateway-integration";
+import { ApiGatewayMethod } from "./.gen/providers/aws/api-gateway-method";
+import { ApiGatewayMethodResponse } from "./.gen/providers/aws/api-gateway-method-response";
+import { ApiGatewayResource } from "./.gen/providers/aws/api-gateway-resource";
+import { ApiGatewayRestApi } from "./.gen/providers/aws/api-gateway-rest-api";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const myDemoApi = new ApiGatewayRestApi(this, "MyDemoAPI", {
+      description: "This is my API for demonstration purposes",
+      name: "MyDemoAPI",
+    });
+    const myDemoResource = new ApiGatewayResource(this, "MyDemoResource", {
+      parentId: myDemoApi.rootResourceId,
+      pathPart: "mydemoresource",
+      restApiId: myDemoApi.id,
+    });
+    const myDemoMethod = new ApiGatewayMethod(this, "MyDemoMethod", {
+      authorization: "NONE",
+      httpMethod: "GET",
+      resourceId: myDemoResource.id,
+      restApiId: myDemoApi.id,
+    });
+    new ApiGatewayMethodResponse(this, "response_200", {
+      httpMethod: myDemoMethod.httpMethod,
+      resourceId: myDemoResource.id,
+      restApiId: myDemoApi.id,
+      statusCode: "200",
+    });
+    new ApiGatewayIntegration(this, "MyDemoIntegration", {
+      httpMethod: myDemoMethod.httpMethod,
+      resourceId: myDemoResource.id,
+      restApiId: myDemoApi.id,
+      type: "MOCK",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `restApiId` - (Required) ID of the associated REST API
+* `resourceId` - (Required) API resource ID
+* `httpMethod` - (Required) HTTP Method (`get`, `post`, `put`, `delete`, `head`, `options`, `any`)
+* `statusCode` - (Required) HTTP status code
+* `responseModels` - (Optional) Map of the API models used for the response's content type
+* `responseParameters` - (Optional) Map of response parameters that can be sent to the caller.
+   For example: `response_parameters = { "method.response.header.X-Some-Header" = true }`
+   would define that the header `xSomeHeader` can be provided on the response.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsApiGatewayMethodResponse` using `restApiId/resourceId/httpMethod/statusCode`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsApiGatewayMethodResponse` using `restApiId/resourceId/httpMethod/statusCode`. For example:
+
+```console
+% terraform import aws_api_gateway_method_response.example 12345abcde/67890fghij/GET/200
+```
+
+<!-- cache-key: cdktf-0.18.0 input-747ca6d8aa85968a45fb4eebf14083b89f32bb4152faf84deb93ecea4d18c9cb -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/api_gateway_method_settings.html.markdown b/website/docs/cdktf/typescript/r/api_gateway_method_settings.html.markdown
new file mode 100644
index 00000000000..b95f5bd6c73
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/api_gateway_method_settings.html.markdown
@@ -0,0 +1,257 @@
+---
+subcategory: "API Gateway"
+layout: "aws"
+page_title: "AWS: aws_api_gateway_method_settings"
+description: |-
+  Manages API Gateway Stage Method Settings
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_api_gateway_method_settings
+
+Manages API Gateway Stage Method Settings. For example, CloudWatch logging and metrics.
+
+~> **NOTE:** We recommend using this resource in conjunction with the [`awsApiGatewayStage` resource](api_gateway_stage.html) instead of a stage managed by the [`awsApiGatewayDeployment` resource](api_gateway_deployment.html) optional `stageName` argument. Stages managed by the `awsApiGatewayDeployment` resource are recreated on redeployment and this resource will require a second apply to recreate the method settings.
+
+## Example Usage
+
+### End-to-end
+
+An end-to-end example of a REST API configured with OpenAPI can be found in the [`/examples/apiGatewayRestApiOpenapi` directory within the GitHub repository](https://github.com/hashicorp/terraform-provider-aws/tree/main/examples/api-gateway-rest-api-openapi).
+
+### Basic Usage
+
+```terraform
+resource "aws_api_gateway_rest_api" "example" {
+  body = jsonencode({
+    openapi = "3.0.1"
+    info = {
+      title   = "example"
+      version = "1.0"
+    }
+    paths = {
+      "/path1" = {
+        get = {
+          x-amazon-apigateway-integration = {
+            httpMethod           = "GET"
+            payloadFormatVersion = "1.0"
+            type                 = "HTTP_PROXY"
+            uri                  = "https://ip-ranges.amazonaws.com/ip-ranges.json"
+          }
+        }
+      }
+    }
+  })
+
+  name = "example"
+}
+
+resource "aws_api_gateway_deployment" "example" {
+  rest_api_id = aws_api_gateway_rest_api.example.id
+
+  triggers = {
+    redeployment = sha1(jsonencode(aws_api_gateway_rest_api.example.body))
+  }
+
+  lifecycle {
+    create_before_destroy = true
+  }
+}
+
+resource "aws_api_gateway_stage" "example" {
+  deployment_id = aws_api_gateway_deployment.example.id
+  rest_api_id   = aws_api_gateway_rest_api.example.id
+  stage_name    = "example"
+}
+
+resource "aws_api_gateway_method_settings" "all" {
+  rest_api_id = aws_api_gateway_rest_api.example.id
+  stage_name  = aws_api_gateway_stage.example.stage_name
+  method_path = "*/*"
+
+  settings {
+    metrics_enabled = true
+    logging_level   = "ERROR"
+  }
+}
+
+resource "aws_api_gateway_method_settings" "path_specific" {
+  rest_api_id = aws_api_gateway_rest_api.example.id
+  stage_name  = aws_api_gateway_stage.example.stage_name
+  method_path = "path1/GET"
+
+  settings {
+    metrics_enabled = true
+    logging_level   = "INFO"
+  }
+}
+```
+
+### CloudWatch Logging and Tracing
+
+The AWS Console API Gateway Editor displays multiple options for CloudWatch Logs that don't directly map to the options in the AWS API and Terraform. These examples show the `settings` blocks that are equivalent to the options the AWS Console gives for CloudWatch Logs.
+
+#### Off
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ApiGatewayMethodSettings } from "./.gen/providers/aws/api-gateway-method-settings";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ApiGatewayMethodSettings(this, "path_specific", {
+      methodPath: "path1/GET",
+      restApiId: example.id,
+      settings: {
+        loggingLevel: "OFF",
+      },
+      stageName: Token.asString(awsApiGatewayStageExample.stageName),
+    });
+  }
+}
+
+```
+
+#### Errors Only
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ApiGatewayMethodSettings } from "./.gen/providers/aws/api-gateway-method-settings";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ApiGatewayMethodSettings(this, "path_specific", {
+      methodPath: "path1/GET",
+      restApiId: example.id,
+      settings: {
+        dataTraceEnabled: false,
+        loggingLevel: "ERROR",
+        metricsEnabled: true,
+      },
+      stageName: Token.asString(awsApiGatewayStageExample.stageName),
+    });
+  }
+}
+
+```
+
+#### Errors and Info Logs
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ApiGatewayMethodSettings } from "./.gen/providers/aws/api-gateway-method-settings";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ApiGatewayMethodSettings(this, "path_specific", {
+      methodPath: "path1/GET",
+      restApiId: example.id,
+      settings: {
+        dataTraceEnabled: false,
+        loggingLevel: "INFO",
+        metricsEnabled: true,
+      },
+      stageName: Token.asString(awsApiGatewayStageExample.stageName),
+    });
+  }
+}
+
+```
+
+#### Full Request and Response Logs
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ApiGatewayMethodSettings } from "./.gen/providers/aws/api-gateway-method-settings";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ApiGatewayMethodSettings(this, "path_specific", {
+      methodPath: "path1/GET",
+      restApiId: example.id,
+      settings: {
+        dataTraceEnabled: true,
+        loggingLevel: "INFO",
+        metricsEnabled: true,
+      },
+      stageName: Token.asString(awsApiGatewayStageExample.stageName),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `restApiId` - (Required) ID of the REST API
+* `stageName` - (Required) Name of the stage
+* `methodPath` - (Required) Method path defined as `{resourcePath}/{httpMethod}` for an individual method override, or `*/*` for overriding all methods in the stage. Ensure to trim any leading forward slashes in the path (e.g., `trimprefix(aws_api_gateway_resource.example.path, "/")`).
+* `settings` - (Required) Settings block, see below.
+
+### `settings`
+
+* `metricsEnabled` - (Optional) Whether Amazon CloudWatch metrics are enabled for this method.
+* `loggingLevel` - (Optional) Logging level for this method, which effects the log entries pushed to Amazon CloudWatch Logs. The available levels are `off`, `error`, and `info`.
+* `dataTraceEnabled` - (Optional) Whether data trace logging is enabled for this method, which effects the log entries pushed to Amazon CloudWatch Logs.
+* `throttlingBurstLimit` - (Optional) Throttling burst limit. Default: `1` (throttling disabled).
+* `throttlingRateLimit` - (Optional) Throttling rate limit. Default: `1` (throttling disabled).
+* `cachingEnabled` - (Optional) Whether responses should be cached and returned for requests. A cache cluster must be enabled on the stage for responses to be cached.
+* `cacheTtlInSeconds` - (Optional) Time to live (TTL), in seconds, for cached responses. The higher the TTL, the longer the response will be cached.
+* `cacheDataEncrypted` - (Optional) Whether the cached responses are encrypted.
+* `requireAuthorizationForCacheControl` - (Optional) Whether authorization is required for a cache invalidation request.
+* `unauthorizedCacheControlHeaderStrategy` - (Optional) How to handle unauthorized requests for cache invalidation. The available values are `failWith403`, `succeedWithResponseHeader`, `succeedWithoutResponseHeader`.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsApiGatewayMethodSettings` using `restApiId/stageName/methodPath`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsApiGatewayMethodSettings` using `restApiId/stageName/methodPath`. For example:
+
+```console
+% terraform import aws_api_gateway_method_settings.example 12345abcde/example/test/GET
+```
+
+<!-- cache-key: cdktf-0.18.0 input-7743821eda51c37e62e60ebb2ef0df1ec418fbff45349d42c5ad9056c52929c9 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/api_gateway_model.html.markdown b/website/docs/cdktf/typescript/r/api_gateway_model.html.markdown
new file mode 100644
index 00000000000..675ccc60c50
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/api_gateway_model.html.markdown
@@ -0,0 +1,88 @@
+---
+subcategory: "API Gateway"
+layout: "aws"
+page_title: "AWS: aws_api_gateway_model"
+description: |-
+  Provides a Model for a REST API Gateway.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_api_gateway_model
+
+Provides a Model for a REST API Gateway.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ApiGatewayModel } from "./.gen/providers/aws/api-gateway-model";
+import { ApiGatewayRestApi } from "./.gen/providers/aws/api-gateway-rest-api";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const myDemoApi = new ApiGatewayRestApi(this, "MyDemoAPI", {
+      description: "This is my API for demonstration purposes",
+      name: "MyDemoAPI",
+    });
+    new ApiGatewayModel(this, "MyDemoModel", {
+      contentType: "application/json",
+      description: "a JSON schema",
+      name: "user",
+      restApiId: myDemoApi.id,
+      schema: Token.asString(
+        Fn.jsonencode({
+          type: "object",
+        })
+      ),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `restApiId` - (Required) ID of the associated REST API
+* `name` - (Required) Name of the model
+* `description` - (Optional) Description of the model
+* `contentType` - (Required) Content type of the model
+* `schema` - (Required) Schema of the model in a JSON form
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the model
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsApiGatewayModel` using `restApiId/name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsApiGatewayModel` using `restApiId/name`. For example:
+
+```console
+% terraform import aws_api_gateway_model.example 12345abcde/example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-3c89195f3305545d621230506fac11346c31eec2c1309a11239463f693b441d7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/api_gateway_request_validator.html.markdown b/website/docs/cdktf/typescript/r/api_gateway_request_validator.html.markdown
new file mode 100644
index 00000000000..a8e10dc58df
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/api_gateway_request_validator.html.markdown
@@ -0,0 +1,77 @@
+---
+subcategory: "API Gateway"
+layout: "aws"
+page_title: "AWS: aws_api_gateway_request_validator"
+description: |-
+  Manages an API Gateway Request Validator.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_api_gateway_request_validator
+
+Manages an API Gateway Request Validator.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ApiGatewayRequestValidator } from "./.gen/providers/aws/api-gateway-request-validator";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ApiGatewayRequestValidator(this, "example", {
+      name: "example",
+      restApiId: Token.asString(awsApiGatewayRestApiExample.id),
+      validateRequestBody: true,
+      validateRequestParameters: true,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) Name of the request validator
+* `restApiId` - (Required) ID of the associated Rest API
+* `validateRequestBody` - (Optional) Boolean whether to validate request body. Defaults to `false`.
+* `validateRequestParameters` - (Optional) Boolean whether to validate request parameters. Defaults to `false`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Unique ID of the request validator
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsApiGatewayRequestValidator` using `restApiId/requestValidatorId`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsApiGatewayRequestValidator` using `restApiId/requestValidatorId`. For example:
+
+```console
+% terraform import aws_api_gateway_request_validator.example 12345abcde/67890fghij
+```
+
+<!-- cache-key: cdktf-0.18.0 input-505defc9caba2113992cea9320dfb9b74802857b30dd2c0100aa471ccc27a60b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/api_gateway_resource.html.markdown b/website/docs/cdktf/typescript/r/api_gateway_resource.html.markdown
new file mode 100644
index 00000000000..53ff6e44bdb
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/api_gateway_resource.html.markdown
@@ -0,0 +1,81 @@
+---
+subcategory: "API Gateway"
+layout: "aws"
+page_title: "AWS: aws_api_gateway_resource"
+description: |-
+  Provides an API Gateway Resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_api_gateway_resource
+
+Provides an API Gateway Resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ApiGatewayResource } from "./.gen/providers/aws/api-gateway-resource";
+import { ApiGatewayRestApi } from "./.gen/providers/aws/api-gateway-rest-api";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const myDemoApi = new ApiGatewayRestApi(this, "MyDemoAPI", {
+      description: "This is my API for demonstration purposes",
+      name: "MyDemoAPI",
+    });
+    new ApiGatewayResource(this, "MyDemoResource", {
+      parentId: myDemoApi.rootResourceId,
+      pathPart: "mydemoresource",
+      restApiId: myDemoApi.id,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `restApiId` - (Required) ID of the associated REST API
+* `parentId` - (Required) ID of the parent API resource
+* `pathPart` - (Required) Last path segment of this API resource.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Resource's identifier.
+* `path` - Complete path for this API resource, including all parent paths.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsApiGatewayResource` using `restApiId/resourceId`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsApiGatewayResource` using `restApiId/resourceId`. For example:
+
+```console
+% terraform import aws_api_gateway_resource.example 12345abcde/67890fghij
+```
+
+<!-- cache-key: cdktf-0.18.0 input-721175b3ae904d683d63b51b6401729c22f6dffbfde1cdaa50d14675da16dc36 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/api_gateway_rest_api.html.markdown b/website/docs/cdktf/typescript/r/api_gateway_rest_api.html.markdown
new file mode 100644
index 00000000000..66d144a06a5
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/api_gateway_rest_api.html.markdown
@@ -0,0 +1,326 @@
+---
+subcategory: "API Gateway"
+layout: "aws"
+page_title: "AWS: aws_api_gateway_rest_api"
+description: |-
+  Manages an API Gateway REST API.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_api_gateway_rest_api
+
+Manages an API Gateway REST API. The REST API can be configured via [importing an OpenAPI specification](https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-import-api.html) in the `body` argument (with other arguments serving as overrides) or via other Terraform resources to manage the resources ([`awsApiGatewayResource` resource](api_gateway_resource.html)), methods ([`awsApiGatewayMethod` resource](api_gateway_method.html)), integrations ([`awsApiGatewayIntegration` resource](api_gateway_integration.html)), etc. of the REST API. Once the REST API is configured, the [`awsApiGatewayDeployment` resource](api_gateway_deployment.html) can be used along with the [`awsApiGatewayStage` resource](api_gateway_stage.html) to publish the REST API.
+
+-> **Note:** Amazon API Gateway Version 1 resources are used for creating and deploying REST APIs. To create and deploy WebSocket and HTTP APIs, use Amazon API Gateway Version 2 [resources](/docs/providers/aws/r/apigatewayv2_api.html).
+
+!> **WARN:** When importing Open API Specifications with the `body` argument, by default the API Gateway REST API will be replaced with the Open API Specification thus removing any existing methods, resources, integrations, or endpoints. Endpoint mutations are asynchronous operations, and race conditions with DNS are possible. To overcome this limitation, use the `putRestApiMode` attribute and set it to `merge`.
+
+## Example Usage
+
+### OpenAPI Specification
+
+An end-to-end example of a REST API configured with OpenAPI can be found in the [`/examples/apiGatewayRestApiOpenapi` directory within the GitHub repository](https://github.com/hashicorp/terraform-provider-aws/tree/main/examples/api-gateway-rest-api-openapi).
+
+```terraform
+resource "aws_api_gateway_rest_api" "example" {
+  body = jsonencode({
+    openapi = "3.0.1"
+    info = {
+      title   = "example"
+      version = "1.0"
+    }
+    paths = {
+      "/path1" = {
+        get = {
+          x-amazon-apigateway-integration = {
+            httpMethod           = "GET"
+            payloadFormatVersion = "1.0"
+            type                 = "HTTP_PROXY"
+            uri                  = "https://ip-ranges.amazonaws.com/ip-ranges.json"
+          }
+        }
+      }
+    }
+  })
+
+  name = "example"
+
+  endpoint_configuration {
+    types = ["REGIONAL"]
+  }
+}
+
+resource "aws_api_gateway_deployment" "example" {
+  rest_api_id = aws_api_gateway_rest_api.example.id
+
+  triggers = {
+    redeployment = sha1(jsonencode(aws_api_gateway_rest_api.example.body))
+  }
+
+  lifecycle {
+    create_before_destroy = true
+  }
+}
+
+resource "aws_api_gateway_stage" "example" {
+  deployment_id = aws_api_gateway_deployment.example.id
+  rest_api_id   = aws_api_gateway_rest_api.example.id
+  stage_name    = "example"
+}
+```
+
+### OpenAPI Specification with Private Endpoints
+
+Using `putRestApiMode` = `merge` when importing the OpenAPI Specification, the AWS control plane will not delete all existing literal properties that are not explicitly set in the OpenAPI definition. Impacted API Gateway properties: ApiKeySourceType, BinaryMediaTypes, Description, EndpointConfiguration, MinimumCompressionSize, Name, Policy).
+
+```terraform
+data "aws_availability_zones" "available" {
+  state = "available"
+
+  filter {
+    name   = "opt-in-status"
+    values = ["opt-in-not-required"]
+  }
+}
+
+data "aws_region" "current" {}
+
+resource "aws_vpc" "example" {
+  cidr_block           = "10.0.0.0/16"
+  enable_dns_support   = true
+  enable_dns_hostnames = true
+}
+
+resource "aws_default_security_group" "example" {
+  vpc_id = aws_vpc.example.id
+}
+
+resource "aws_subnet" "example" {
+  availability_zone = data.aws_availability_zones.available.names[0]
+  cidr_block        = cidrsubnet(aws_vpc.example.cidr_block, 8, 0)
+  vpc_id            = aws_vpc.example.id
+}
+
+resource "aws_vpc_endpoint" "example" {
+  count = 3
+
+  private_dns_enabled = false
+  security_group_ids  = [aws_default_security_group.example.id]
+  service_name        = "com.amazonaws.${data.aws_region.current.name}.execute-api"
+  subnet_ids          = [aws_subnet.example.id]
+  vpc_endpoint_type   = "Interface"
+  vpc_id              = aws_vpc.example.id
+}
+
+resource "aws_api_gateway_rest_api" "example" {
+  body = jsonencode({
+    openapi = "3.0.1"
+    info = {
+      title   = "example"
+      version = "1.0"
+    }
+    paths = {
+      "/path1" = {
+        get = {
+          x-amazon-apigateway-integration = {
+            httpMethod           = "GET"
+            payloadFormatVersion = "1.0"
+            type                 = "HTTP_PROXY"
+            uri                  = "https://ip-ranges.amazonaws.com/ip-ranges.json"
+          }
+        }
+      }
+    }
+  })
+
+  name              = "example"
+  put_rest_api_mode = "merge"
+
+  endpoint_configuration {
+    types            = ["PRIVATE"]
+    vpc_endpoint_ids = [aws_vpc_endpoint.example[0].id, aws_vpc_endpoint.example[1].id, aws_vpc_endpoint.example[2].id]
+  }
+}
+
+resource "aws_api_gateway_deployment" "example" {
+  rest_api_id = aws_api_gateway_rest_api.example.id
+
+  triggers = {
+    redeployment = sha1(jsonencode(aws_api_gateway_rest_api.example.body))
+  }
+
+  lifecycle {
+    create_before_destroy = true
+  }
+}
+
+resource "aws_api_gateway_stage" "example" {
+  deployment_id = aws_api_gateway_deployment.example.id
+  rest_api_id   = aws_api_gateway_rest_api.example.id
+  stage_name    = "example"
+}
+```
+
+### Terraform Resources
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, Fn, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ApiGatewayDeployment } from "./.gen/providers/aws/api-gateway-deployment";
+import { ApiGatewayIntegration } from "./.gen/providers/aws/api-gateway-integration";
+import { ApiGatewayMethod } from "./.gen/providers/aws/api-gateway-method";
+import { ApiGatewayResource } from "./.gen/providers/aws/api-gateway-resource";
+import { ApiGatewayRestApi } from "./.gen/providers/aws/api-gateway-rest-api";
+import { ApiGatewayStage } from "./.gen/providers/aws/api-gateway-stage";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new ApiGatewayRestApi(this, "example", {
+      name: "example",
+    });
+    const awsApiGatewayResourceExample = new ApiGatewayResource(
+      this,
+      "example_1",
+      {
+        parentId: example.rootResourceId,
+        pathPart: "example",
+        restApiId: example.id,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsApiGatewayResourceExample.overrideLogicalId("example");
+    const awsApiGatewayMethodExample = new ApiGatewayMethod(this, "example_2", {
+      authorization: "NONE",
+      httpMethod: "GET",
+      resourceId: Token.asString(awsApiGatewayResourceExample.id),
+      restApiId: example.id,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsApiGatewayMethodExample.overrideLogicalId("example");
+    const awsApiGatewayIntegrationExample = new ApiGatewayIntegration(
+      this,
+      "example_3",
+      {
+        httpMethod: Token.asString(awsApiGatewayMethodExample.httpMethod),
+        resourceId: Token.asString(awsApiGatewayResourceExample.id),
+        restApiId: example.id,
+        type: "MOCK",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsApiGatewayIntegrationExample.overrideLogicalId("example");
+    const awsApiGatewayDeploymentExample = new ApiGatewayDeployment(
+      this,
+      "example_4",
+      {
+        lifecycle: {
+          createBeforeDestroy: true,
+        },
+        restApiId: example.id,
+        triggers: {
+          redeployment: Token.asString(
+            Fn.sha1(
+              Token.asString(
+                Fn.jsonencode([
+                  awsApiGatewayResourceExample.id,
+                  awsApiGatewayMethodExample.id,
+                  awsApiGatewayIntegrationExample.id,
+                ])
+              )
+            )
+          ),
+        },
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsApiGatewayDeploymentExample.overrideLogicalId("example");
+    const awsApiGatewayStageExample = new ApiGatewayStage(this, "example_5", {
+      deploymentId: Token.asString(awsApiGatewayDeploymentExample.id),
+      restApiId: example.id,
+      stageName: "example",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsApiGatewayStageExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `apiKeySource` - (Optional) Source of the API key for requests. Valid values are `header` (default) and `authorizer`. If importing an OpenAPI specification via the `body` argument, this corresponds to the [`xAmazonApigatewayApiKeySource` extension](https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-swagger-extensions-api-key-source.html). If the argument value is provided and is different than the OpenAPI value, the argument value will override the OpenAPI value.
+* `binaryMediaTypes` - (Optional) List of binary media types supported by the REST API. By default, the REST API supports only UTF-8-encoded text payloads. If importing an OpenAPI specification via the `body` argument, this corresponds to the [`xAmazonApigatewayBinaryMediaTypes` extension](https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-swagger-extensions-binary-media-types.html). If the argument value is provided and is different than the OpenAPI value, the argument value will override the OpenAPI value.
+* `body` - (Optional) OpenAPI specification that defines the set of routes and integrations to create as part of the REST API. This configuration, and any updates to it, will replace all REST API configuration except values overridden in this resource configuration and other resource updates applied after this resource but before any `awsApiGatewayDeployment` creation. More information about REST API OpenAPI support can be found in the [API Gateway Developer Guide](https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-import-api.html).
+* `description` - (Optional) Description of the REST API. If importing an OpenAPI specification via the `body` argument, this corresponds to the `infoDescription` field. If the argument value is provided and is different than the OpenAPI value, the argument value will override the OpenAPI value.
+* `disableExecuteApiEndpoint` - (Optional) Whether clients can invoke your API by using the default execute-api endpoint. By default, clients can invoke your API with the default https://{api_id}.execute-api.{region}.amazonaws.com endpoint. To require that clients use a custom domain name to invoke your API, disable the default endpoint. Defaults to `false`. If importing an OpenAPI specification via the `body` argument, this corresponds to the [`xAmazonApigatewayEndpointConfiguration` extension `disableExecuteApiEndpoint` property](https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-swagger-extensions-endpoint-configuration.html). If the argument value is `true` and is different than the OpenAPI value, the argument value will override the OpenAPI value.
+* `endpointConfiguration` - (Optional) Configuration block defining API endpoint configuration including endpoint type. Defined below.
+* `minimumCompressionSize` - (Optional) Minimum response size to compress for the REST API. String containing an integer value between `1` and `10485760` (10MB). `1` will disable an existing compression configuration, and all other values will enable compression with the configured size. New resources can simply omit this argument to disable compression, rather than setting the value to `1`. If importing an OpenAPI specification via the `body` argument, this corresponds to the [`xAmazonApigatewayMinimumCompressionSize` extension](https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-openapi-minimum-compression-size.html). If the argument value is provided and is different than the OpenAPI value, the argument value will override the OpenAPI value.
+* `name` - (Required) Name of the REST API. If importing an OpenAPI specification via the `body` argument, this corresponds to the `infoTitle` field. If the argument value is different than the OpenAPI value, the argument value will override the OpenAPI value.
+* `failOnWarnings` - (Optional) Whether warnings while API Gateway is creating or updating the resource should return an error or not. Defaults to `false`
+* `parameters` - (Optional) Map of customizations for importing the specification in the `body` argument. For example, to exclude DocumentationParts from an imported API, set `ignore` equal to `documentation`. Additional documentation, including other parameters such as `basepath`, can be found in the [API Gateway Developer Guide](https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-import-api.html).
+* `policy` - (Optional) JSON formatted policy document that controls access to the API Gateway. For more information about building AWS IAM policy documents with Terraform, see the [AWS IAM Policy Document Guide](https://learn.hashicorp.com/terraform/aws/iam-policy). Terraform will only perform drift detection of its value when present in a configuration. We recommend using the [`awsApiGatewayRestApiPolicy` resource](/docs/providers/aws/r/api_gateway_rest_api_policy.html) instead. If importing an OpenAPI specification via the `body` argument, this corresponds to the [`xAmazonApigatewayPolicy` extension](https://docs.aws.amazon.com/apigateway/latest/developerguide/openapi-extensions-policy.html). If the argument value is provided and is different than the OpenAPI value, the argument value will override the OpenAPI value.
+* `putRestApiMode` - (Optional) Mode of the PutRestApi operation when importing an OpenAPI specification via the `body` argument (create or update operation). Valid values are `merge` and `overwrite`. If unspecificed, defaults to `overwrite` (for backwards compatibility). This corresponds to the [`xAmazonApigatewayPutIntegrationMethod` extension](https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-swagger-extensions-put-integration-method.html). If the argument value is provided and is different than the OpenAPI value, the argument value will override the OpenAPI value.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+**Note**: If the `body` argument is provided, the OpenAPI specification will be used to configure the resources, methods and integrations for the Rest API. If this argument is provided, the following resources should not be managed as separate ones, as updates may cause manual resource updates to be overwritten:
+
+* `awsApiGatewayResource`
+* `awsApiGatewayMethod`
+* `awsApiGatewayMethodResponse`
+* `awsApiGatewayMethodSettings`
+* `awsApiGatewayIntegration`
+* `awsApiGatewayIntegrationResponse`
+* `awsApiGatewayGatewayResponse`
+* `awsApiGatewayModel`
+
+### endpoint_configuration
+
+* `types` - (Required) List of endpoint types. This resource currently only supports managing a single value. Valid values: `edge`, `regional` or `private`. If unspecified, defaults to `edge`. If set to `private` recommend to set `putRestApiMode` = `merge` to not cause the endpoints and associated Route53 records to be deleted. Refer to the [documentation](https://docs.aws.amazon.com/apigateway/latest/developerguide/create-regional-api.html) for more information on the difference between edge-optimized and regional APIs.
+* `vpcEndpointIds` - (Optional) Set of VPC Endpoint identifiers. It is only supported for `private` endpoint type. If importing an OpenAPI specification via the `body` argument, this corresponds to the [`xAmazonApigatewayEndpointConfiguration` extension `vpcEndpointIds` property](https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-swagger-extensions-endpoint-configuration.html). If the argument value is provided and is different than the OpenAPI value, **the argument value will override the OpenAPI value**.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN
+* `createdDate` - Creation date of the REST API
+* `executionArn` - Execution ARN part to be used in [`lambdaPermission`](/docs/providers/aws/r/lambda_permission.html)'s `sourceArn`
+  when allowing API Gateway to invoke a Lambda function,
+  e.g., `arn:aws:executeApi:euWest2:123456789012:z4675Bid1J`, which can be concatenated with allowed stage, method and resource path.
+* `id` - ID of the REST API
+* `rootResourceId` - Resource ID of the REST API's root
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsApiGatewayRestApi` using the REST API ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsApiGatewayRestApi` using the REST API ID. For example:
+
+```console
+% terraform import aws_api_gateway_rest_api.example 12345abcde
+```
+
+~> **NOTE:** Resource import does not currently support the `body` attribute.
+
+<!-- cache-key: cdktf-0.18.0 input-e489f1763b2359237f3dddc078f272955078eab93aabf7213398c9c17e24c7ea -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/api_gateway_rest_api_policy.html.markdown b/website/docs/cdktf/typescript/r/api_gateway_rest_api_policy.html.markdown
new file mode 100644
index 00000000000..b1d34ba08da
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/api_gateway_rest_api_policy.html.markdown
@@ -0,0 +1,116 @@
+---
+subcategory: "API Gateway"
+layout: "aws"
+page_title: "AWS: aws_api_gateway_rest_api_policy"
+description: |-
+  Provides an API Gateway REST API Policy.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_api_gateway_rest_api_policy
+
+Provides an API Gateway REST API Policy.
+
+-> **Note:** Amazon API Gateway Version 1 resources are used for creating and deploying REST APIs. To create and deploy WebSocket and HTTP APIs, use Amazon API Gateway Version 2 [resources](/docs/providers/aws/r/apigatewayv2_api.html).
+
+## Example Usage
+
+### Basic
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ApiGatewayRestApi } from "./.gen/providers/aws/api-gateway-rest-api";
+import { ApiGatewayRestApiPolicy } from "./.gen/providers/aws/api-gateway-rest-api-policy";
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const test = new ApiGatewayRestApi(this, "test", {
+      name: "example-rest-api",
+    });
+    const dataAwsIamPolicyDocumentTest = new DataAwsIamPolicyDocument(
+      this,
+      "test_1",
+      {
+        statement: [
+          {
+            actions: ["execute-api:Invoke"],
+            condition: [
+              {
+                test: "IpAddress",
+                values: ["123.123.123.123/32"],
+                variable: "aws:SourceIp",
+              },
+            ],
+            effect: "Allow",
+            principals: [
+              {
+                identifiers: ["*"],
+                type: "AWS",
+              },
+            ],
+            resources: [test.executionArn],
+          },
+        ],
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsIamPolicyDocumentTest.overrideLogicalId("test");
+    const awsApiGatewayRestApiPolicyTest = new ApiGatewayRestApiPolicy(
+      this,
+      "test_2",
+      {
+        policy: Token.asString(dataAwsIamPolicyDocumentTest.json),
+        restApiId: test.id,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsApiGatewayRestApiPolicyTest.overrideLogicalId("test");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `restApiId` - (Required) ID of the REST API.
+* `policy` - (Required) JSON formatted policy document that controls access to the API Gateway. For more information about building AWS IAM policy documents with Terraform, see the [AWS IAM Policy Document Guide](https://learn.hashicorp.com/terraform/aws/iam-policy)
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the REST API
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsApiGatewayRestApiPolicy` using the REST API ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsApiGatewayRestApiPolicy` using the REST API ID. For example:
+
+```console
+% terraform import aws_api_gateway_rest_api_policy.example 12345abcde
+```
+
+<!-- cache-key: cdktf-0.18.0 input-a578ab2cbd9dbd4f544af9402983cad6a4047d176dace00d2077faadb4d78cfa -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/api_gateway_stage.html.markdown b/website/docs/cdktf/typescript/r/api_gateway_stage.html.markdown
new file mode 100644
index 00000000000..d7ce1cf43e9
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/api_gateway_stage.html.markdown
@@ -0,0 +1,202 @@
+---
+subcategory: "API Gateway"
+layout: "aws"
+page_title: "AWS: aws_api_gateway_stage"
+description: |-
+  Manages an API Gateway Stage.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_api_gateway_stage
+
+Manages an API Gateway Stage. A stage is a named reference to a deployment, which can be done via the [`awsApiGatewayDeployment` resource](api_gateway_deployment.html). Stages can be optionally managed further with the [`awsApiGatewayBasePathMapping` resource](api_gateway_base_path_mapping.html), [`awsApiGatewayDomainName` resource](api_gateway_domain_name.html), and [`awsApiMethodSettings` resource](api_gateway_method_settings.html). For more information, see the [API Gateway Developer Guide](https://docs.aws.amazon.com/apigateway/latest/developerguide/set-up-stages.html).
+
+## Example Usage
+
+An end-to-end example of a REST API configured with OpenAPI can be found in the [`/examples/apiGatewayRestApiOpenapi` directory within the GitHub repository](https://github.com/hashicorp/terraform-provider-aws/tree/main/examples/api-gateway-rest-api-openapi).
+
+```terraform
+resource "aws_api_gateway_rest_api" "example" {
+  body = jsonencode({
+    openapi = "3.0.1"
+    info = {
+      title   = "example"
+      version = "1.0"
+    }
+    paths = {
+      "/path1" = {
+        get = {
+          x-amazon-apigateway-integration = {
+            httpMethod           = "GET"
+            payloadFormatVersion = "1.0"
+            type                 = "HTTP_PROXY"
+            uri                  = "https://ip-ranges.amazonaws.com/ip-ranges.json"
+          }
+        }
+      }
+    }
+  })
+
+  name = "example"
+}
+
+resource "aws_api_gateway_deployment" "example" {
+  rest_api_id = aws_api_gateway_rest_api.example.id
+
+  triggers = {
+    redeployment = sha1(jsonencode(aws_api_gateway_rest_api.example.body))
+  }
+
+  lifecycle {
+    create_before_destroy = true
+  }
+}
+
+resource "aws_api_gateway_stage" "example" {
+  deployment_id = aws_api_gateway_deployment.example.id
+  rest_api_id   = aws_api_gateway_rest_api.example.id
+  stage_name    = "example"
+}
+
+resource "aws_api_gateway_method_settings" "example" {
+  rest_api_id = aws_api_gateway_rest_api.example.id
+  stage_name  = aws_api_gateway_stage.example.stage_name
+  method_path = "*/*"
+
+  settings {
+    metrics_enabled = true
+    logging_level   = "INFO"
+  }
+}
+```
+
+### Managing the API Logging CloudWatch Log Group
+
+API Gateway provides the ability to [enable CloudWatch API logging](https://docs.aws.amazon.com/apigateway/latest/developerguide/set-up-logging.html). To manage the CloudWatch Log Group when this feature is enabled, the [`awsCloudwatchLogGroup` resource](/docs/providers/aws/r/cloudwatch_log_group.html) can be used where the name matches the API Gateway naming convention. If the CloudWatch Log Group previously exists, import the [`awsCloudwatchLogGroup` resource into Terraform](/docs/providers/aws/r/cloudwatch_log_group.html#import) as a one time operation. You can recreate the environment without import.
+
+-> The below configuration uses [`dependsOn`](https://www.terraform.io/language/meta-arguments/depends_on) to prevent ordering issues with API Gateway automatically creating the log group first and a variable for naming consistency. Other ordering and naming methodologies may be more appropriate for your environment.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { VariableType, TerraformVariable, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ApiGatewayRestApi } from "./.gen/providers/aws/api-gateway-rest-api";
+import { ApiGatewayStage } from "./.gen/providers/aws/api-gateway-stage";
+import { CloudwatchLogGroup } from "./.gen/providers/aws/cloudwatch-log-group";
+interface MyConfig {
+  name: any;
+  deploymentId: any;
+  restApiId: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    /*Terraform Variables are not always the best fit for getting inputs in the context of Terraform CDK.
+    You can read more about this at https://cdk.tf/variables*/
+    const stageName = new TerraformVariable(this, "stage_name", {
+      default: "example",
+      type: VariableType.STRING,
+    });
+    const example = new ApiGatewayRestApi(this, "example", {
+      name: config.name,
+    });
+    const awsCloudwatchLogGroupExample = new CloudwatchLogGroup(
+      this,
+      "example_2",
+      {
+        name:
+          "API-Gateway-Execution-Logs_${" +
+          example.id +
+          "}/${" +
+          stageName.value +
+          "}",
+        retentionInDays: 7,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsCloudwatchLogGroupExample.overrideLogicalId("example");
+    const awsApiGatewayStageExample = new ApiGatewayStage(this, "example_3", {
+      dependsOn: [awsCloudwatchLogGroupExample],
+      stageName: stageName.stringValue,
+      deploymentId: config.deploymentId,
+      restApiId: config.restApiId,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsApiGatewayStageExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `restApiId` - (Required) ID of the associated REST API
+* `stageName` - (Required) Name of the stage
+* `deploymentId` - (Required) ID of the deployment that the stage points to
+* `accessLogSettings` - (Optional) Enables access logs for the API stage. See [Access Log Settings](#access-log-settings) below.
+* `cacheClusterEnabled` - (Optional) Whether a cache cluster is enabled for the stage
+* `cacheClusterSize` - (Optional) Size of the cache cluster for the stage, if enabled. Allowed values include `05`, `16`, `61`, `135`, `284`, `582`, `118` and `237`.
+* `canarySettings` - (Optional) Configuration settings of a canary deployment. See [Canary Settings](#canary-settings) below.
+* `clientCertificateId` - (Optional) Identifier of a client certificate for the stage.
+* `description` - (Optional) Description of the stage.
+* `documentationVersion` - (Optional) Version of the associated API documentation
+* `variables` - (Optional) Map that defines the stage variables
+* `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `xrayTracingEnabled` - (Optional) Whether active tracing with X-ray is enabled. Defaults to `false`.
+
+### Access Log Settings
+
+* `destinationArn` - (Required) ARN of the CloudWatch Logs log group or Kinesis Data Firehose delivery stream to receive access logs. If you specify a Kinesis Data Firehose delivery stream, the stream name must begin with `amazonApigateway`. Automatically removes trailing `:*` if present.
+* `format` - (Required) Formatting and values recorded in the logs.
+For more information on configuring the log format rules visit the AWS [documentation](https://docs.aws.amazon.com/apigateway/latest/developerguide/set-up-logging.html)
+
+### Canary Settings
+
+* `percentTraffic` - (Optional) Percent `00` - `1000` of traffic to divert to the canary deployment.
+* `stageVariableOverrides` - (Optional) Map of overridden stage `variables` (including new variables) for the canary deployment.
+* `useStageCache` - (Optional) Whether the canary deployment uses the stage cache. Defaults to false.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN
+* `id` - ID of the stage
+* `invokeUrl` - URL to invoke the API pointing to the stage,
+  e.g., `https://z4675Bid1JExecuteApiEuWest2AmazonawsCom/prod`
+* `executionArn` - Execution ARN to be used in [`lambdaPermission`](/docs/providers/aws/r/lambda_permission.html)'s `sourceArn`
+  when allowing API Gateway to invoke a Lambda function,
+  e.g., `arn:aws:executeApi:euWest2:123456789012:z4675Bid1J/prod`
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `webAclArn` - ARN of the WebAcl associated with the Stage.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsApiGatewayStage` using `restApiId/stageName`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsApiGatewayStage` using `restApiId/stageName`. For example:
+
+```console
+% terraform import aws_api_gateway_stage.example 12345abcde/example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-a0512b7365529cfc2af4fc000b34cd44473168df1e317e144f5b466e44cbe9fe -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/api_gateway_usage_plan.html.markdown b/website/docs/cdktf/typescript/r/api_gateway_usage_plan.html.markdown
new file mode 100644
index 00000000000..16176ec3295
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/api_gateway_usage_plan.html.markdown
@@ -0,0 +1,167 @@
+---
+subcategory: "API Gateway"
+layout: "aws"
+page_title: "AWS: aws_api_gateway_usage_plan"
+description: |-
+  Provides an API Gateway Usage Plan.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_api_gateway_usage_plan
+
+Provides an API Gateway Usage Plan.
+
+## Example Usage
+
+```terraform
+resource "aws_api_gateway_rest_api" "example" {
+  body = jsonencode({
+    openapi = "3.0.1"
+    info = {
+      title   = "example"
+      version = "1.0"
+    }
+    paths = {
+      "/path1" = {
+        get = {
+          x-amazon-apigateway-integration = {
+            httpMethod           = "GET"
+            payloadFormatVersion = "1.0"
+            type                 = "HTTP_PROXY"
+            uri                  = "https://ip-ranges.amazonaws.com/ip-ranges.json"
+          }
+        }
+      }
+    }
+  })
+
+  name = "example"
+}
+
+resource "aws_api_gateway_deployment" "example" {
+  rest_api_id = aws_api_gateway_rest_api.example.id
+
+  triggers = {
+    redeployment = sha1(jsonencode(aws_api_gateway_rest_api.example.body))
+  }
+
+  lifecycle {
+    create_before_destroy = true
+  }
+}
+
+resource "aws_api_gateway_stage" "development" {
+  deployment_id = aws_api_gateway_deployment.example.id
+  rest_api_id   = aws_api_gateway_rest_api.example.id
+  stage_name    = "development"
+}
+
+resource "aws_api_gateway_stage" "production" {
+  deployment_id = aws_api_gateway_deployment.example.id
+  rest_api_id   = aws_api_gateway_rest_api.example.id
+  stage_name    = "production"
+}
+
+resource "aws_api_gateway_usage_plan" "example" {
+  name         = "my-usage-plan"
+  description  = "my description"
+  product_code = "MYCODE"
+
+  api_stages {
+    api_id = aws_api_gateway_rest_api.example.id
+    stage  = aws_api_gateway_stage.development.stage_name
+  }
+
+  api_stages {
+    api_id = aws_api_gateway_rest_api.example.id
+    stage  = aws_api_gateway_stage.production.stage_name
+  }
+
+  quota_settings {
+    limit  = 20
+    offset = 2
+    period = "WEEK"
+  }
+
+  throttle_settings {
+    burst_limit = 5
+    rate_limit  = 10
+  }
+}
+```
+
+## Argument Reference
+
+The API Gateway Usage Plan argument layout is a structure composed of several sub-resources - these resources are laid out below.
+
+### Top-Level Arguments
+
+* `name` - (Required) Name of the usage plan.
+* `description` - (Optional) Description of a usage plan.
+* `apiStages` - (Optional) Associated [API stages](#api-stages-arguments) of the usage plan.
+* `quotaSettings` - (Optional) The [quota settings](#quota-settings-arguments) of the usage plan.
+* `throttleSettings` - (Optional) The [throttling limits](#throttling-settings-arguments) of the usage plan.
+* `productCode` - (Optional) AWS Marketplace product identifier to associate with the usage plan as a SaaS product on AWS Marketplace.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+#### Api Stages arguments
+
+* `apiId` (Required) - API Id of the associated API stage in a usage plan.
+* `stage` (Required) - API stage name of the associated API stage in a usage plan.
+* `throttle` - (Optional) The [throttling limits](#throttle) of the usage plan.
+
+##### Throttle
+
+* `path` (Required) - Method to apply the throttle settings for. Specfiy the path and method, for example `/test/get`.
+* `burstLimit` (Optional) - The API request burst limit, the maximum rate limit over a time ranging from one to a few seconds, depending upon whether the underlying token bucket is at its full capacity.
+* `rateLimit` (Optional) - The API request steady-state rate limit.
+
+#### Quota Settings Arguments
+
+* `limit` (Optional) - Maximum number of requests that can be made in a given time period.
+* `offset` (Optional) - Number of requests subtracted from the given limit in the initial time period.
+* `period` (Optional) - Time period in which the limit applies. Valid values are "DAY", "WEEK" or "MONTH".
+
+#### Throttling Settings Arguments
+
+* `burstLimit` (Optional) - The API request burst limit, the maximum rate limit over a time ranging from one to a few seconds, depending upon whether the underlying token bucket is at its full capacity.
+* `rateLimit` (Optional) - The API request steady-state rate limit.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the API resource
+* `name` - Name of the usage plan.
+* `description` - Description of a usage plan.
+* `apiStages` - Associated API stages of the usage plan.
+* `quotaSettings` - Quota of the usage plan.
+* `throttleSettings` - Throttling limits of the usage plan.
+* `productCode` - AWS Marketplace product identifier to associate with the usage plan as a SaaS product on AWS Marketplace.
+* `arn` - ARN
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AWS API Gateway Usage Plan using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import AWS API Gateway Usage Plan using the `id`. For example:
+
+```console
+% terraform import aws_api_gateway_usage_plan.myusageplan <usage_plan_id>
+```
+
+<!-- cache-key: cdktf-0.18.0 input-24116054635474bb919fe95d52d6e98ba1ea28094c03b0bd8fe0eab47156f843 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/api_gateway_usage_plan_key.html.markdown b/website/docs/cdktf/typescript/r/api_gateway_usage_plan_key.html.markdown
new file mode 100644
index 00000000000..80cac3b0bcf
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/api_gateway_usage_plan_key.html.markdown
@@ -0,0 +1,98 @@
+---
+subcategory: "API Gateway"
+layout: "aws"
+page_title: "AWS: aws_api_gateway_usage_plan_key"
+description: |-
+  Provides an API Gateway Usage Plan Key.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_api_gateway_usage_plan_key
+
+Provides an API Gateway Usage Plan Key.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ApiGatewayApiKey } from "./.gen/providers/aws/api-gateway-api-key";
+import { ApiGatewayRestApi } from "./.gen/providers/aws/api-gateway-rest-api";
+import { ApiGatewayUsagePlan } from "./.gen/providers/aws/api-gateway-usage-plan";
+import { ApiGatewayUsagePlanKey } from "./.gen/providers/aws/api-gateway-usage-plan-key";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const mykey = new ApiGatewayApiKey(this, "mykey", {
+      name: "my_key",
+    });
+    const test = new ApiGatewayRestApi(this, "test", {
+      name: "MyDemoAPI",
+    });
+    const myusageplan = new ApiGatewayUsagePlan(this, "myusageplan", {
+      apiStages: [
+        {
+          apiId: test.id,
+          stage: foo.stageName,
+        },
+      ],
+      name: "my_usage_plan",
+    });
+    new ApiGatewayUsagePlanKey(this, "main", {
+      keyId: mykey.id,
+      keyType: "API_KEY",
+      usagePlanId: myusageplan.id,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `keyId` - (Required) Identifier of the API key resource.
+* `keyType` - (Required) Type of the API key resource. Currently, the valid key type is API_KEY.
+* `usagePlanId` - (Required) Id of the usage plan resource representing to associate the key to.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - ID of a usage plan key.
+* `keyId` - Identifier of the API gateway key resource.
+* `keyType` - Type of a usage plan key. Currently, the valid key type is API_KEY.
+* `usagePlanId` - ID of the API resource
+* `name` - Name of a usage plan key.
+* `value` - Value of a usage plan key.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AWS API Gateway Usage Plan Key using the `usagePlanId/usagePlanKeyId`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import AWS API Gateway Usage Plan Key using the `usagePlanId/usagePlanKeyId`. For example:
+
+```console
+% terraform import aws_api_gateway_usage_plan_key.key 12345abcde/zzz
+```
+
+<!-- cache-key: cdktf-0.18.0 input-64d31ac82ac47958b893fdad358b9552bfb53b3872642df3b580cd7ea2309914 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/api_gateway_vpc_link.html.markdown b/website/docs/cdktf/typescript/r/api_gateway_vpc_link.html.markdown
new file mode 100644
index 00000000000..abae6e87663
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/api_gateway_vpc_link.html.markdown
@@ -0,0 +1,97 @@
+---
+subcategory: "API Gateway"
+layout: "aws"
+page_title: "AWS: aws_api_gateway_vpc_link"
+description: |-
+  Provides an API Gateway VPC Link.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_api_gateway_vpc_link
+
+Provides an API Gateway VPC Link.
+
+-> **Note:** Amazon API Gateway Version 1 VPC Links enable private integrations that connect REST APIs to private resources in a VPC.
+To enable private integration for HTTP APIs, use the Amazon API Gateway Version 2 VPC Link [resource](/docs/providers/aws/r/apigatewayv2_vpc_link.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ApiGatewayVpcLink } from "./.gen/providers/aws/api-gateway-vpc-link";
+import { Lb } from "./.gen/providers/aws/lb";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new Lb(this, "example", {
+      internal: true,
+      loadBalancerType: "network",
+      name: "example",
+      subnetMapping: [
+        {
+          subnetId: "12345",
+        },
+      ],
+    });
+    const awsApiGatewayVpcLinkExample = new ApiGatewayVpcLink(
+      this,
+      "example_1",
+      {
+        description: "example description",
+        name: "example",
+        targetArns: [example.arn],
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsApiGatewayVpcLinkExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) Name used to label and identify the VPC link.
+* `description` - (Optional) Description of the VPC link.
+* `targetArns` - (Required, ForceNew) List of network load balancer arns in the VPC targeted by the VPC link. Currently AWS only supports 1 target.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Identifier of the VpcLink.
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import API Gateway VPC Link using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import API Gateway VPC Link using the `id`. For example:
+
+```console
+% terraform import aws_api_gateway_vpc_link.example 12345abcde
+```
+
+<!-- cache-key: cdktf-0.18.0 input-67ae655f1b594d4a56352e7b95e9f98e0a7e757e376024aa97ec46526256091e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/apigatewayv2_api.html.markdown b/website/docs/cdktf/typescript/r/apigatewayv2_api.html.markdown
new file mode 100644
index 00000000000..f8f1335f6ce
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/apigatewayv2_api.html.markdown
@@ -0,0 +1,142 @@
+---
+subcategory: "API Gateway V2"
+layout: "aws"
+page_title: "AWS: aws_apigatewayv2_api"
+description: |-
+  Manages an Amazon API Gateway Version 2 API.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_apigatewayv2_api
+
+Manages an Amazon API Gateway Version 2 API.
+
+-> **Note:** Amazon API Gateway Version 2 resources are used for creating and deploying WebSocket and HTTP APIs. To create and deploy REST APIs, use Amazon API Gateway Version 1 [resources](/docs/providers/aws/r/api_gateway_rest_api.html).
+
+## Example Usage
+
+### Basic WebSocket API
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Apigatewayv2Api } from "./.gen/providers/aws/apigatewayv2-api";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Apigatewayv2Api(this, "example", {
+      name: "example-websocket-api",
+      protocolType: "WEBSOCKET",
+      routeSelectionExpression: "$request.body.action",
+    });
+  }
+}
+
+```
+
+### Basic HTTP API
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Apigatewayv2Api } from "./.gen/providers/aws/apigatewayv2-api";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Apigatewayv2Api(this, "example", {
+      name: "example-http-api",
+      protocolType: "HTTP",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) Name of the API. Must be less than or equal to 128 characters in length.
+* `protocolType` - (Required) API protocol. Valid values: `http`, `websocket`.
+* `apiKeySelectionExpression` - (Optional) An [API key selection expression](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-websocket-api-selection-expressions.html#apigateway-websocket-api-apikey-selection-expressions).
+Valid values: `$contextAuthorizerUsageIdentifierKey`, `$requestHeaderXApiKey`. Defaults to `$requestHeaderXApiKey`.
+Applicable for WebSocket APIs.
+* `corsConfiguration` - (Optional) Cross-origin resource sharing (CORS) [configuration](https://docs.aws.amazon.com/apigateway/latest/developerguide/http-api-cors.html). Applicable for HTTP APIs.
+* `credentialsArn` - (Optional) Part of _quick create_. Specifies any credentials required for the integration. Applicable for HTTP APIs.
+* `description` - (Optional) Description of the API. Must be less than or equal to 1024 characters in length.
+* `disableExecuteApiEndpoint` - (Optional) Whether clients can invoke the API by using the default `executeApi` endpoint.
+By default, clients can invoke the API with the default `{api_id}.execute-api.{region}.amazonaws.com endpoint`.
+To require that clients use a custom domain name to invoke the API, disable the default endpoint.
+* `routeKey` - (Optional) Part of _quick create_. Specifies any [route key](https://docs.aws.amazon.com/apigateway/latest/developerguide/http-api-develop-routes.html). Applicable for HTTP APIs.
+* `routeSelectionExpression` - (Optional) The [route selection expression](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-websocket-api-selection-expressions.html#apigateway-websocket-api-route-selection-expressions) for the API.
+Defaults to `$request.method $request.path`.
+* `tags` - (Optional) Map of tags to assign to the API. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `target` - (Optional) Part of _quick create_. Quick create produces an API with an integration, a default catch-all route, and a default stage which is configured to automatically deploy changes.
+For HTTP integrations, specify a fully qualified URL. For Lambda integrations, specify a function ARN.
+The type of the integration will be `httpProxy` or `awsProxy`, respectively. Applicable for HTTP APIs.
+* `body` - (Optional) An OpenAPI specification that defines the set of routes and integrations to create as part of the HTTP APIs. Supported only for HTTP APIs.
+* `version` - (Optional) Version identifier for the API. Must be between 1 and 64 characters in length.
+* `failOnWarnings` - (Optional) Whether warnings should return an error while API Gateway is creating or updating the resource using an OpenAPI specification. Defaults to `false`. Applicable for HTTP APIs.
+
+__Note__: If the `body` argument is provided, the OpenAPI specification will be used to configure the integrations and route for the HTTP API. If this argument is provided, the following resources should not be managed as separate ones, as updates may cause manual resource updates to be overwritten:
+
+* `awsApigatewayv2Integration`
+* `awsApigatewayv2Route`
+
+Further more, the `name`, `description`, `corsConfiguration`, `tags` and `version` fields should be specified in the Terraform configuration and the values will override any values specified in the OpenAPI document.
+
+The `corsConfiguration` object supports the following:
+
+* `allowCredentials` - (Optional) Whether credentials are included in the CORS request.
+* `allowHeaders` - (Optional) Set of allowed HTTP headers.
+* `allowMethods` - (Optional) Set of allowed HTTP methods.
+* `allowOrigins` - (Optional) Set of allowed origins.
+* `exposeHeaders` - (Optional) Set of exposed HTTP headers.
+* `maxAge` - (Optional) Number of seconds that the browser should cache preflight request results.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - API identifier.
+* `apiEndpoint` - URI of the API, of the form `https://{apiId}ExecuteApi.{region}AmazonawsCom` for HTTP APIs and `wss://{apiId}ExecuteApi.{region}AmazonawsCom` for WebSocket APIs.
+* `arn` - ARN of the API.
+* `executionArn` - ARN prefix to be used in an [`awsLambdaPermission`](/docs/providers/aws/r/lambda_permission.html)'s `sourceArn` attribute
+or in an [`awsIamPolicy`](/docs/providers/aws/r/iam_policy.html) to authorize access to the [`@connections` API](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-how-to-call-websocket-api-connections.html).
+See the [Amazon API Gateway Developer Guide](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-websocket-control-access-iam.html) for details.
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsApigatewayv2Api` using the API identifier. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsApigatewayv2Api` using the API identifier. For example:
+
+```console
+% terraform import aws_apigatewayv2_api.example aabbccddee
+```
+
+<!-- cache-key: cdktf-0.18.0 input-aa8c33d1b4534c72e0765acdfd063cd72de93dec3553988cad57b268051e01d2 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/apigatewayv2_api_mapping.html.markdown b/website/docs/cdktf/typescript/r/apigatewayv2_api_mapping.html.markdown
new file mode 100644
index 00000000000..22ba7076ce0
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/apigatewayv2_api_mapping.html.markdown
@@ -0,0 +1,79 @@
+---
+subcategory: "API Gateway V2"
+layout: "aws"
+page_title: "AWS: aws_apigatewayv2_api_mapping"
+description: |-
+  Manages an Amazon API Gateway Version 2 API mapping.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_apigatewayv2_api_mapping
+
+Manages an Amazon API Gateway Version 2 API mapping.
+More information can be found in the [Amazon API Gateway Developer Guide](https://docs.aws.amazon.com/apigateway/latest/developerguide/how-to-custom-domains.html).
+
+## Example Usage
+
+### Basic
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Apigatewayv2ApiMapping } from "./.gen/providers/aws/apigatewayv2-api-mapping";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Apigatewayv2ApiMapping(this, "example", {
+      apiId: Token.asString(awsApigatewayv2ApiExample.id),
+      domainName: Token.asString(awsApigatewayv2DomainNameExample.id),
+      stage: Token.asString(awsApigatewayv2StageExample.id),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `apiId` - (Required) API identifier.
+* `domainName` - (Required) Domain name. Use the [`awsApigatewayv2DomainName`](/docs/providers/aws/r/apigatewayv2_domain_name.html) resource to configure a domain name.
+* `stage` - (Required) API stage. Use the [`awsApigatewayv2Stage`](/docs/providers/aws/r/apigatewayv2_stage.html) resource to configure an API stage.
+* `apiMappingKey` - (Optional) The API mapping key. Refer to [REST API](https://docs.aws.amazon.com/apigateway/latest/developerguide/rest-api-mappings.html), [HTTP API](https://docs.aws.amazon.com/apigateway/latest/developerguide/http-api-mappings.html) or [WebSocket API](https://docs.aws.amazon.com/apigateway/latest/developerguide/websocket-api-mappings.html).
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - API mapping identifier.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsApigatewayv2ApiMapping` using the API mapping identifier and domain name. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsApigatewayv2ApiMapping` using the API mapping identifier and domain name. For example:
+
+```console
+% terraform import aws_apigatewayv2_api_mapping.example 1122334/ws-api.example.com
+```
+
+<!-- cache-key: cdktf-0.18.0 input-580fc04639f7b69e714911cbb27a6fa6354fc412415a99400266b16e65672884 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/apigatewayv2_authorizer.html.markdown b/website/docs/cdktf/typescript/r/apigatewayv2_authorizer.html.markdown
new file mode 100644
index 00000000000..943d53cbf47
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/apigatewayv2_authorizer.html.markdown
@@ -0,0 +1,131 @@
+---
+subcategory: "API Gateway V2"
+layout: "aws"
+page_title: "AWS: aws_apigatewayv2_authorizer"
+description: |-
+  Manages an Amazon API Gateway Version 2 authorizer.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_apigatewayv2_authorizer
+
+Manages an Amazon API Gateway Version 2 authorizer.
+More information can be found in the [Amazon API Gateway Developer Guide](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-websocket-api.html).
+
+## Example Usage
+
+### Basic WebSocket API
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Apigatewayv2Authorizer } from "./.gen/providers/aws/apigatewayv2-authorizer";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Apigatewayv2Authorizer(this, "example", {
+      apiId: Token.asString(awsApigatewayv2ApiExample.id),
+      authorizerType: "REQUEST",
+      authorizerUri: Token.asString(awsLambdaFunctionExample.invokeArn),
+      identitySources: ["route.request.header.Auth"],
+      name: "example-authorizer",
+    });
+  }
+}
+
+```
+
+### Basic HTTP API
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Apigatewayv2Authorizer } from "./.gen/providers/aws/apigatewayv2-authorizer";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Apigatewayv2Authorizer(this, "example", {
+      apiId: Token.asString(awsApigatewayv2ApiExample.id),
+      authorizerPayloadFormatVersion: "2.0",
+      authorizerType: "REQUEST",
+      authorizerUri: Token.asString(awsLambdaFunctionExample.invokeArn),
+      identitySources: ["$request.header.Authorization"],
+      name: "example-authorizer",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `apiId` - (Required) API identifier.
+* `authorizerType` - (Required) Authorizer type. Valid values: `jwt`, `request`.
+Specify `request` for a Lambda function using incoming request parameters.
+For HTTP APIs, specify `jwt` to use JSON Web Tokens.
+* `name` - (Required) Name of the authorizer. Must be between 1 and 128 characters in length.
+* `authorizerCredentialsArn` - (Optional) Required credentials as an IAM role for API Gateway to invoke the authorizer.
+Supported only for `request` authorizers.
+* `authorizerPayloadFormatVersion` - (Optional) Format of the payload sent to an HTTP API Lambda authorizer. Required for HTTP API Lambda authorizers.
+Valid values: `10`, `20`.
+* `authorizerResultTtlInSeconds` - (Optional) Time to live (TTL) for cached authorizer results, in seconds. If it equals 0, authorization caching is disabled.
+If it is greater than 0, API Gateway caches authorizer responses. The maximum value is 3600, or 1 hour. Defaults to `300`.
+Supported only for HTTP API Lambda authorizers.
+* `authorizerUri` - (Optional) Authorizer's Uniform Resource Identifier (URI).
+For `request` authorizers this must be a well-formed Lambda function URI, such as the `invokeArn` attribute of the [`awsLambdaFunction`](/docs/providers/aws/r/lambda_function.html) resource.
+Supported only for `request` authorizers. Must be between 1 and 2048 characters in length.
+* `enableSimpleResponses` - (Optional) Whether a Lambda authorizer returns a response in a simple format. If enabled, the Lambda authorizer can return a boolean value instead of an IAM policy.
+Supported only for HTTP APIs.
+* `identitySources` - (Optional) Identity sources for which authorization is requested.
+For `request` authorizers the value is a list of one or more mapping expressions of the specified request parameters.
+For `jwt` authorizers the single entry specifies where to extract the JSON Web Token (JWT) from inbound requests.
+* `jwtConfiguration` - (Optional) Configuration of a JWT authorizer. Required for the `jwt` authorizer type.
+Supported only for HTTP APIs.
+
+The `jwtConfiguration` object supports the following:
+
+* `audience` - (Optional) List of the intended recipients of the JWT. A valid JWT must provide an aud that matches at least one entry in this list.
+* `issuer` - (Optional) Base domain of the identity provider that issues JSON Web Tokens, such as the `endpoint` attribute of the [`awsCognitoUserPool`](/docs/providers/aws/r/cognito_user_pool.html) resource.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Authorizer identifier.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsApigatewayv2Authorizer` using the API identifier and authorizer identifier. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsApigatewayv2Authorizer` using the API identifier and authorizer identifier. For example:
+
+```console
+% terraform import aws_apigatewayv2_authorizer.example aabbccddee/1122334
+```
+
+<!-- cache-key: cdktf-0.18.0 input-322d065b428456a7d1cc59a5a9728d8c2146130eb3756317834d9f82f13b132e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/apigatewayv2_deployment.html.markdown b/website/docs/cdktf/typescript/r/apigatewayv2_deployment.html.markdown
new file mode 100644
index 00000000000..906f0011bdb
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/apigatewayv2_deployment.html.markdown
@@ -0,0 +1,132 @@
+---
+subcategory: "API Gateway V2"
+layout: "aws"
+page_title: "AWS: aws_apigatewayv2_deployment"
+description: |-
+  Manages an Amazon API Gateway Version 2 deployment.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_apigatewayv2_deployment
+
+Manages an Amazon API Gateway Version 2 deployment.
+More information can be found in the [Amazon API Gateway Developer Guide](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-websocket-api.html).
+
+-> **Note:** Creating a deployment for an API requires at least one `awsApigatewayv2Route` resource associated with that API. To avoid race conditions when all resources are being created together, you need to add implicit resource references via the `triggers` argument or explicit resource references using the [resource `dependsOn` meta-argument](https://www.terraform.io/docs/configuration/meta-arguments/depends_on.html).
+
+-> Enable the [resource `lifecycle` configuration block `createBeforeDestroy` argument](https://www.terraform.io/language/meta-arguments/lifecycle#create_before_destroy) in this resource configuration to properly order redeployments in Terraform.
+
+## Example Usage
+
+### Basic
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Apigatewayv2Deployment } from "./.gen/providers/aws/apigatewayv2-deployment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Apigatewayv2Deployment(this, "example", {
+      apiId: Token.asString(awsApigatewayv2ApiExample.id),
+      description: "Example deployment",
+      lifecycle: {
+        createBeforeDestroy: true,
+      },
+    });
+  }
+}
+
+```
+
+### Redeployment Triggers
+
+-> **NOTE:** This is an optional and Terraform 0.12 (or later) advanced configuration that shows calculating a hash of the API's Terraform resources to determine changes that should trigger a new deployment. This value will change after the first Terraform apply of new resources, triggering an immediate redeployment, however it will stabilize afterwards except for resource changes. The `triggers` map can also be configured in other, more complex ways to fit the environment, avoiding the immediate redeployment issue.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, Fn, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Apigatewayv2Deployment } from "./.gen/providers/aws/apigatewayv2-deployment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Apigatewayv2Deployment(this, "example", {
+      apiId: Token.asString(awsApigatewayv2ApiExample.id),
+      description: "Example deployment",
+      lifecycle: {
+        createBeforeDestroy: true,
+      },
+      triggers: {
+        redeployment: Token.asString(
+          Fn.sha1(
+            Token.asString(
+              Fn.join(
+                ",",
+                Token.asList(
+                  Fn.tolist([
+                    Fn.jsonencode(awsApigatewayv2IntegrationExample),
+                    Fn.jsonencode(awsApigatewayv2RouteExample),
+                  ])
+                )
+              )
+            )
+          )
+        ),
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `apiId` - (Required) API identifier.
+* `description` - (Optional) Description for the deployment resource. Must be less than or equal to 1024 characters in length.
+* `triggers` - (Optional) Map of arbitrary keys and values that, when changed, will trigger a redeployment. To force a redeployment without changing these keys/values, use the [`terraform taint` command](https://www.terraform.io/docs/commands/taint.html).
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Deployment identifier.
+* `autoDeployed` - Whether the deployment was automatically released.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsApigatewayv2Deployment` using the API identifier and deployment identifier. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsApigatewayv2Deployment` using the API identifier and deployment identifier. For example:
+
+```console
+% terraform import aws_apigatewayv2_deployment.example aabbccddee/1122334
+```
+
+The `triggers` argument cannot be imported.
+
+<!-- cache-key: cdktf-0.18.0 input-6f168dfabc70a225ecc775cc6a4b2adaf3369f7cedadbfe8329709220731be58 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/apigatewayv2_domain_name.html.markdown b/website/docs/cdktf/typescript/r/apigatewayv2_domain_name.html.markdown
new file mode 100644
index 00000000000..87f2b124ca7
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/apigatewayv2_domain_name.html.markdown
@@ -0,0 +1,159 @@
+---
+subcategory: "API Gateway V2"
+layout: "aws"
+page_title: "AWS: aws_apigatewayv2_domain_name"
+description: |-
+  Manages an Amazon API Gateway Version 2 domain name.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_apigatewayv2_domain_name
+
+Manages an Amazon API Gateway Version 2 domain name.
+More information can be found in the [Amazon API Gateway Developer Guide](https://docs.aws.amazon.com/apigateway/latest/developerguide/how-to-custom-domains.html).
+
+-> **Note:** This resource establishes ownership of and the TLS settings for
+a particular domain name. An API stage can be associated with the domain name using the `awsApigatewayv2ApiMapping` resource.
+
+## Example Usage
+
+### Basic
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Apigatewayv2DomainName } from "./.gen/providers/aws/apigatewayv2-domain-name";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Apigatewayv2DomainName(this, "example", {
+      domainName: "ws-api.example.com",
+      domainNameConfiguration: {
+        certificateArn: Token.asString(awsAcmCertificateExample.arn),
+        endpointType: "REGIONAL",
+        securityPolicy: "TLS_1_2",
+      },
+    });
+  }
+}
+
+```
+
+### Associated Route 53 Resource Record
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, Fn, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Apigatewayv2DomainName } from "./.gen/providers/aws/apigatewayv2-domain-name";
+import { Route53Record } from "./.gen/providers/aws/route53-record";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new Apigatewayv2DomainName(this, "example", {
+      domainName: "http-api.example.com",
+      domainNameConfiguration: {
+        certificateArn: Token.asString(awsAcmCertificateExample.arn),
+        endpointType: "REGIONAL",
+        securityPolicy: "TLS_1_2",
+      },
+    });
+    const awsRoute53RecordExample = new Route53Record(this, "example_1", {
+      alias: {
+        evaluateTargetHealth: false,
+        name: Token.asString(
+          Fn.lookupNested(example.domainNameConfiguration, [
+            "0",
+            "target_domain_name",
+          ])
+        ),
+        zoneId: Token.asString(
+          Fn.lookupNested(example.domainNameConfiguration, [
+            "0",
+            "hosted_zone_id",
+          ])
+        ),
+      },
+      name: example.domainName,
+      type: "A",
+      zoneId: Token.asString(awsRoute53ZoneExample.zoneId),
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsRoute53RecordExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `domainName` - (Required) Domain name. Must be between 1 and 512 characters in length.
+* `domainNameConfiguration` - (Required) Domain name configuration. See below.
+* `mutualTlsAuthentication` - (Optional) Mutual TLS authentication configuration for the domain name.
+* `tags` - (Optional) Map of tags to assign to the domain name. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### `domainNameConfiguration`
+
+* `certificateArn` - (Required) ARN of an AWS-managed certificate that will be used by the endpoint for the domain name. AWS Certificate Manager is the only supported source. Use the [`awsAcmCertificate`](/docs/providers/aws/r/acm_certificate.html) resource to configure an ACM certificate.
+* `endpointType` - (Required) Endpoint type. Valid values: `regional`.
+* `hostedZoneId` - (Computed) Amazon Route 53 Hosted Zone ID of the endpoint.
+* `ownershipVerificationCertificateArn` - (Optional) ARN of the AWS-issued certificate used to validate custom domain ownership (when `certificateArn` is issued via an ACM Private CA or `mutualTlsAuthentication` is configured with an ACM-imported certificate.)
+* `securityPolicy` - (Required) Transport Layer Security (TLS) version of the [security policy](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-custom-domain-tls-version.html) for the domain name. Valid values: `tls12`.
+* `targetDomainName` - (Computed) Target domain name.
+
+### `mutualTlsAuthentication`
+
+* `truststoreUri` - (Required) Amazon S3 URL that specifies the truststore for mutual TLS authentication, for example, `s3://bucketName/keyName`. The truststore can contain certificates from public or private certificate authorities. To update the truststore, upload a new version to S3, and then update your custom domain name to use the new version.
+* `truststoreVersion` - (Optional) Version of the S3 object that contains the truststore. To specify a version, you must have versioning enabled for the S3 bucket.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `apiMappingSelectionExpression` - [API mapping selection expression](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-websocket-api-selection-expressions.html#apigateway-websocket-api-mapping-selection-expressions) for the domain name.
+* `arn` - ARN of the domain name.
+* `id` - Domain name identifier.
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `10M`)
+- `update` - (Default `60M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsApigatewayv2DomainName` using the domain name. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsApigatewayv2DomainName` using the domain name. For example:
+
+```console
+% terraform import aws_apigatewayv2_domain_name.example ws-api.example.com
+```
+
+<!-- cache-key: cdktf-0.18.0 input-590fddf6e18ec896623edea239e232e92d9d62cdcbd1d648d652e4699c95dd9a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/apigatewayv2_integration.html.markdown b/website/docs/cdktf/typescript/r/apigatewayv2_integration.html.markdown
new file mode 100644
index 00000000000..2fd4ef1ca72
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/apigatewayv2_integration.html.markdown
@@ -0,0 +1,237 @@
+---
+subcategory: "API Gateway V2"
+layout: "aws"
+page_title: "AWS: aws_apigatewayv2_integration"
+description: |-
+  Manages an Amazon API Gateway Version 2 integration.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_apigatewayv2_integration
+
+Manages an Amazon API Gateway Version 2 integration.
+More information can be found in the [Amazon API Gateway Developer Guide](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-websocket-api.html).
+
+## Example Usage
+
+### Basic
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Apigatewayv2Integration } from "./.gen/providers/aws/apigatewayv2-integration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Apigatewayv2Integration(this, "example", {
+      apiId: Token.asString(awsApigatewayv2ApiExample.id),
+      integrationType: "MOCK",
+    });
+  }
+}
+
+```
+
+### Lambda Integration
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Apigatewayv2Integration } from "./.gen/providers/aws/apigatewayv2-integration";
+import { LambdaFunction } from "./.gen/providers/aws/lambda-function";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new LambdaFunction(this, "example", {
+      filename: "example.zip",
+      functionName: "Example",
+      handler: "index.handler",
+      role: Token.asString(awsIamRoleExample.arn),
+      runtime: "nodejs16.x",
+    });
+    const awsApigatewayv2IntegrationExample = new Apigatewayv2Integration(
+      this,
+      "example_1",
+      {
+        apiId: Token.asString(awsApigatewayv2ApiExample.id),
+        connectionType: "INTERNET",
+        contentHandlingStrategy: "CONVERT_TO_TEXT",
+        description: "Lambda example",
+        integrationMethod: "POST",
+        integrationType: "AWS_PROXY",
+        integrationUri: example.invokeArn,
+        passthroughBehavior: "WHEN_NO_MATCH",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsApigatewayv2IntegrationExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### AWS Service Integration
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Apigatewayv2Integration } from "./.gen/providers/aws/apigatewayv2-integration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Apigatewayv2Integration(this, "example", {
+      apiId: Token.asString(awsApigatewayv2ApiExample.id),
+      credentialsArn: Token.asString(awsIamRoleExample.arn),
+      description: "SQS example",
+      integrationSubtype: "SQS-SendMessage",
+      integrationType: "AWS_PROXY",
+      requestParameters: {
+        MessageBody: "$request.body.message",
+        QueueUrl: "$request.header.queueUrl",
+      },
+    });
+  }
+}
+
+```
+
+### Private Integration
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Apigatewayv2Integration } from "./.gen/providers/aws/apigatewayv2-integration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Apigatewayv2Integration(this, "example", {
+      apiId: Token.asString(awsApigatewayv2ApiExample.id),
+      connectionId: Token.asString(awsApigatewayv2VpcLinkExample.id),
+      connectionType: "VPC_LINK",
+      credentialsArn: Token.asString(awsIamRoleExample.arn),
+      description: "Example with a load balancer",
+      integrationMethod: "ANY",
+      integrationType: "HTTP_PROXY",
+      integrationUri: Token.asString(awsLbListenerExample.arn),
+      requestParameters: {
+        "append:header.authforintegration":
+          "$context.authorizer.authorizerResponse",
+        "overwrite:path": "staticValueForIntegration",
+      },
+      responseParameters: [
+        {
+          mappings: {
+            "append:header.auth": "$context.authorizer.authorizerResponse",
+          },
+          statusCode: Token.asString(403),
+        },
+        {
+          mappings: {
+            "overwrite:statuscode": "204",
+          },
+          statusCode: Token.asString(200),
+        },
+      ],
+      tlsConfig: {
+        serverNameToVerify: "example.com",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `apiId` - (Required) API identifier.
+* `integrationType` - (Required) Integration type of an integration.
+Valid values: `aws` (supported only for WebSocket APIs), `awsProxy`, `http` (supported only for WebSocket APIs), `httpProxy`, `mock` (supported only for WebSocket APIs). For an HTTP API private integration, use `httpProxy`.
+* `connectionId` - (Optional) ID of the [VPC link](apigatewayv2_vpc_link.html) for a private integration. Supported only for HTTP APIs. Must be between 1 and 1024 characters in length.
+* `connectionType` - (Optional) Type of the network connection to the integration endpoint. Valid values: `internet`, `vpcLink`. Default is `internet`.
+* `contentHandlingStrategy` - (Optional) How to handle response payload content type conversions. Valid values: `convertToBinary`, `convertToText`. Supported only for WebSocket APIs.
+* `credentialsArn` - (Optional) Credentials required for the integration, if any.
+* `description` - (Optional) Description of the integration.
+* `integrationMethod` - (Optional) Integration's HTTP method. Must be specified if `integrationType` is not `mock`.
+* `integrationSubtype` - (Optional) AWS service action to invoke. Supported only for HTTP APIs when `integrationType` is `awsProxy`. See the [AWS service integration reference](https://docs.aws.amazon.com/apigateway/latest/developerguide/http-api-develop-integrations-aws-services-reference.html) documentation for supported values. Must be between 1 and 128 characters in length.
+* `integrationUri` - (Optional) URI of the Lambda function for a Lambda proxy integration, when `integrationType` is `awsProxy`.
+For an `http` integration, specify a fully-qualified URL. For an HTTP API private integration, specify the ARN of an Application Load Balancer listener, Network Load Balancer listener, or AWS Cloud Map service.
+* `passthroughBehavior` - (Optional) Pass-through behavior for incoming requests based on the Content-Type header in the request, and the available mapping templates specified as the `requestTemplates` attribute.
+Valid values: `whenNoMatch`, `whenNoTemplates`, `never`. Default is `whenNoMatch`. Supported only for WebSocket APIs.
+* `payloadFormatVersion` - (Optional) The [format of the payload](https://docs.aws.amazon.com/apigateway/latest/developerguide/http-api-develop-integrations-lambda.html#http-api-develop-integrations-lambda.proxy-format) sent to an integration. Valid values: `10`, `20`. Default is `10`.
+* `requestParameters` - (Optional) For WebSocket APIs, a key-value map specifying request parameters that are passed from the method request to the backend.
+For HTTP APIs with a specified `integrationSubtype`, a key-value map specifying parameters that are passed to `awsProxy` integrations.
+For HTTP APIs without a specified `integrationSubtype`, a key-value map specifying how to transform HTTP requests before sending them to the backend.
+See the [Amazon API Gateway Developer Guide](https://docs.aws.amazon.com/apigateway/latest/developerguide/http-api-parameter-mapping.html) for details.
+* `requestTemplates` - (Optional) Map of [Velocity](https://velocity.apache.org/) templates that are applied on the request payload based on the value of the Content-Type header sent by the client. Supported only for WebSocket APIs.
+* `responseParameters` - (Optional) Mappings to transform the HTTP response from a backend integration before returning the response to clients. Supported only for HTTP APIs.
+* `templateSelectionExpression` - (Optional) The [template selection expression](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-websocket-api-selection-expressions.html#apigateway-websocket-api-template-selection-expressions) for the integration.
+* `timeoutMilliseconds` - (Optional) Custom timeout between 50 and 29,000 milliseconds for WebSocket APIs and between 50 and 30,000 milliseconds for HTTP APIs.
+The default timeout is 29 seconds for WebSocket APIs and 30 seconds for HTTP APIs.
+Terraform will only perform drift detection of its value when present in a configuration.
+* `tlsConfig` - (Optional) TLS configuration for a private integration. Supported only for HTTP APIs.
+
+The `responseParameters` object supports the following:
+
+* `statusCode` - (Required) HTTP status code in the range 200-599.
+* `mappings` - (Required) Key-value map. The key of this map identifies the location of the request parameter to change, and how to change it. The corresponding value specifies the new data for the parameter.
+See the [Amazon API Gateway Developer Guide](https://docs.aws.amazon.com/apigateway/latest/developerguide/http-api-parameter-mapping.html) for details.
+
+The `tlsConfig` object supports the following:
+
+* `serverNameToVerify` - (Optional) If you specify a server name, API Gateway uses it to verify the hostname on the integration's certificate. The server name is also included in the TLS handshake to support Server Name Indication (SNI) or virtual hosting.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Integration identifier.
+* `integrationResponseSelectionExpression` - The [integration response selection expression](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-websocket-api-selection-expressions.html#apigateway-websocket-api-integration-response-selection-expressions) for the integration.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsApigatewayv2Integration` using the API identifier and integration identifier. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsApigatewayv2Integration` using the API identifier and integration identifier. For example:
+
+```console
+% terraform import aws_apigatewayv2_integration.example aabbccddee/1122334
+```
+
+-> **Note:** The API Gateway managed integration created as part of [_quick_create_](https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-basic-concept.html#apigateway-definition-quick-create) cannot be imported.
+
+<!-- cache-key: cdktf-0.18.0 input-bd3868bb1d19101e5d7a5a40cefadf4031666c5772ea0394fa37f1396d869e4c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/apigatewayv2_integration_response.html.markdown b/website/docs/cdktf/typescript/r/apigatewayv2_integration_response.html.markdown
new file mode 100644
index 00000000000..1e4b478db80
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/apigatewayv2_integration_response.html.markdown
@@ -0,0 +1,81 @@
+---
+subcategory: "API Gateway V2"
+layout: "aws"
+page_title: "AWS: aws_apigatewayv2_integration_response"
+description: |-
+  Manages an Amazon API Gateway Version 2 integration response.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_apigatewayv2_integration_response
+
+Manages an Amazon API Gateway Version 2 integration response.
+More information can be found in the [Amazon API Gateway Developer Guide](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-websocket-api.html).
+
+## Example Usage
+
+### Basic
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Apigatewayv2IntegrationResponse } from "./.gen/providers/aws/apigatewayv2-integration-response";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Apigatewayv2IntegrationResponse(this, "example", {
+      apiId: Token.asString(awsApigatewayv2ApiExample.id),
+      integrationId: Token.asString(awsApigatewayv2IntegrationExample.id),
+      integrationResponseKey: "/200/",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `apiId` - (Required) API identifier.
+* `integrationId` - (Required) Identifier of the [`awsApigatewayv2Integration`](/docs/providers/aws/r/apigatewayv2_integration.html).
+* `integrationResponseKey` - (Required) Integration response key.
+* `contentHandlingStrategy` - (Optional) How to handle response payload content type conversions. Valid values: `convertToBinary`, `convertToText`.
+* `responseTemplates` - (Optional) Map of Velocity templates that are applied on the request payload based on the value of the Content-Type header sent by the client.
+* `templateSelectionExpression` - (Optional) The [template selection expression](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-websocket-api-selection-expressions.html#apigateway-websocket-api-template-selection-expressions) for the integration response.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Integration response identifier.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsApigatewayv2IntegrationResponse` using the API identifier, integration identifier and integration response identifier. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsApigatewayv2IntegrationResponse` using the API identifier, integration identifier and integration response identifier. For example:
+
+```console
+% terraform import aws_apigatewayv2_integration_response.example aabbccddee/1122334/998877
+```
+
+<!-- cache-key: cdktf-0.18.0 input-c751414ee371648e7a14d8bdd24be3cec193584e33fff3962b58af0f01c841ec -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/apigatewayv2_model.html.markdown b/website/docs/cdktf/typescript/r/apigatewayv2_model.html.markdown
new file mode 100644
index 00000000000..77b3a530d06
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/apigatewayv2_model.html.markdown
@@ -0,0 +1,91 @@
+---
+subcategory: "API Gateway V2"
+layout: "aws"
+page_title: "AWS: aws_apigatewayv2_model"
+description: |-
+  Manages an Amazon API Gateway Version 2 model.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_apigatewayv2_model
+
+Manages an Amazon API Gateway Version 2 [model](https://docs.aws.amazon.com/apigateway/latest/developerguide/models-mappings.html#models-mappings-models).
+
+## Example Usage
+
+### Basic
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, Fn, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Apigatewayv2Model } from "./.gen/providers/aws/apigatewayv2-model";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Apigatewayv2Model(this, "example", {
+      apiId: Token.asString(awsApigatewayv2ApiExample.id),
+      contentType: "application/json",
+      name: "example",
+      schema: Token.asString(
+        Fn.jsonencode({
+          $schema: "http://json-schema.org/draft-04/schema#",
+          properties: {
+            id: {
+              type: "string",
+            },
+          },
+          title: "ExampleModel",
+          type: "object",
+        })
+      ),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `apiId` - (Required) API identifier.
+* `contentType` - (Required)  The content-type for the model, for example, `application/json`. Must be between 1 and 256 characters in length.
+* `name` - (Required) Name of the model. Must be alphanumeric. Must be between 1 and 128 characters in length.
+* `schema` - (Required) Schema for the model. This should be a [JSON schema draft 4](https://tools.ietf.org/html/draft-zyp-json-schema-04) model. Must be less than or equal to 32768 characters in length.
+* `description` - (Optional) Description of the model. Must be between 1 and 128 characters in length.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Model identifier.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsApigatewayv2Model` using the API identifier and model identifier. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsApigatewayv2Model` using the API identifier and model identifier. For example:
+
+```console
+% terraform import aws_apigatewayv2_model.example aabbccddee/1122334
+```
+
+<!-- cache-key: cdktf-0.18.0 input-063f47681aa238116147c2530543550c6286bab9afb427347d6c9ef713ac5596 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/apigatewayv2_route.html.markdown b/website/docs/cdktf/typescript/r/apigatewayv2_route.html.markdown
new file mode 100644
index 00000000000..e18c044eb46
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/apigatewayv2_route.html.markdown
@@ -0,0 +1,156 @@
+---
+subcategory: "API Gateway V2"
+layout: "aws"
+page_title: "AWS: aws_apigatewayv2_route"
+description: |-
+  Manages an Amazon API Gateway Version 2 route.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_apigatewayv2_route
+
+Manages an Amazon API Gateway Version 2 route.
+More information can be found in the [Amazon API Gateway Developer Guide](https://docs.aws.amazon.com/apigateway/latest/developerguide/welcome.html) for [WebSocket](https://docs.aws.amazon.com/apigateway/latest/developerguide/websocket-api-develop-routes.html) and [HTTP](https://docs.aws.amazon.com/apigateway/latest/developerguide/http-api-develop-routes.html) APIs.
+
+## Example Usage
+
+### Basic
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Apigatewayv2Api } from "./.gen/providers/aws/apigatewayv2-api";
+import { Apigatewayv2Route } from "./.gen/providers/aws/apigatewayv2-route";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new Apigatewayv2Api(this, "example", {
+      name: "example-websocket-api",
+      protocolType: "WEBSOCKET",
+      routeSelectionExpression: "$request.body.action",
+    });
+    const awsApigatewayv2RouteExample = new Apigatewayv2Route(
+      this,
+      "example_1",
+      {
+        apiId: example.id,
+        routeKey: "$default",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsApigatewayv2RouteExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### HTTP Proxy Integration
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Apigatewayv2Api } from "./.gen/providers/aws/apigatewayv2-api";
+import { Apigatewayv2Integration } from "./.gen/providers/aws/apigatewayv2-integration";
+import { Apigatewayv2Route } from "./.gen/providers/aws/apigatewayv2-route";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new Apigatewayv2Api(this, "example", {
+      name: "example-http-api",
+      protocolType: "HTTP",
+    });
+    const awsApigatewayv2IntegrationExample = new Apigatewayv2Integration(
+      this,
+      "example_1",
+      {
+        apiId: example.id,
+        integrationMethod: "ANY",
+        integrationType: "HTTP_PROXY",
+        integrationUri: "https://example.com/{proxy}",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsApigatewayv2IntegrationExample.overrideLogicalId("example");
+    const awsApigatewayv2RouteExample = new Apigatewayv2Route(
+      this,
+      "example_2",
+      {
+        apiId: example.id,
+        routeKey: "ANY /example/{proxy+}",
+        target: "integrations/${" + awsApigatewayv2IntegrationExample.id + "}",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsApigatewayv2RouteExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `apiId` - (Required) API identifier.
+* `routeKey` - (Required) Route key for the route. For HTTP APIs, the route key can be either `$default`, or a combination of an HTTP method and resource path, for example, `GET /pets`.
+* `apiKeyRequired` - (Optional) Boolean whether an API key is required for the route. Defaults to `false`. Supported only for WebSocket APIs.
+* `authorizationScopes` - (Optional) Authorization scopes supported by this route. The scopes are used with a JWT authorizer to authorize the method invocation.
+* `authorizationType` - (Optional) Authorization type for the route.
+For WebSocket APIs, valid values are `none` for open access, `awsIam` for using AWS IAM permissions, and `custom` for using a Lambda authorizer.
+For HTTP APIs, valid values are `none` for open access, `jwt` for using JSON Web Tokens, `awsIam` for using AWS IAM permissions, and `custom` for using a Lambda authorizer.
+Defaults to `none`.
+* `authorizerId` - (Optional) Identifier of the [`awsApigatewayv2Authorizer`](apigatewayv2_authorizer.html) resource to be associated with this route.
+* `modelSelectionExpression` - (Optional) The [model selection expression](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-websocket-api-selection-expressions.html#apigateway-websocket-api-model-selection-expressions) for the route. Supported only for WebSocket APIs.
+* `operationName` - (Optional) Operation name for the route. Must be between 1 and 64 characters in length.
+* `requestModels` - (Optional) Request models for the route. Supported only for WebSocket APIs.
+* `requestParameter` - (Optional) Request parameters for the route. Supported only for WebSocket APIs.
+* `routeResponseSelectionExpression` - (Optional) The [route response selection expression](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-websocket-api-selection-expressions.html#apigateway-websocket-api-route-response-selection-expressions) for the route. Supported only for WebSocket APIs.
+* `target` - (Optional) Target for the route, of the form `integrations/`*`integrationId`*, where *`integrationId`* is the identifier of an [`awsApigatewayv2Integration`](apigatewayv2_integration.html) resource.
+
+The `requestParameter` object supports the following:
+
+* `requestParameterKey` - (Required) Request parameter key. This is a [request data mapping parameter](https://docs.aws.amazon.com/apigateway/latest/developerguide/websocket-api-data-mapping.html#websocket-mapping-request-parameters).
+* `required` - (Required) Boolean whether or not the parameter is required.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Route identifier.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsApigatewayv2Route` using the API identifier and route identifier. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsApigatewayv2Route` using the API identifier and route identifier. For example:
+
+```console
+% terraform import aws_apigatewayv2_route.example aabbccddee/1122334
+```
+
+-> **Note:** The API Gateway managed route created as part of [_quick_create_](https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-basic-concept.html#apigateway-definition-quick-create) cannot be imported.
+
+<!-- cache-key: cdktf-0.18.0 input-b9d6c42d850f8d41e68e09883583bfd0059174ab6d5527af47ec51f177c33a41 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/apigatewayv2_route_response.html.markdown b/website/docs/cdktf/typescript/r/apigatewayv2_route_response.html.markdown
new file mode 100644
index 00000000000..a046dd4c5ab
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/apigatewayv2_route_response.html.markdown
@@ -0,0 +1,80 @@
+---
+subcategory: "API Gateway V2"
+layout: "aws"
+page_title: "AWS: aws_apigatewayv2_route_response"
+description: |-
+  Manages an Amazon API Gateway Version 2 route response.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_apigatewayv2_route_response
+
+Manages an Amazon API Gateway Version 2 route response.
+More information can be found in the [Amazon API Gateway Developer Guide](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-websocket-api.html).
+
+## Example Usage
+
+### Basic
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Apigatewayv2RouteResponse } from "./.gen/providers/aws/apigatewayv2-route-response";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Apigatewayv2RouteResponse(this, "example", {
+      apiId: Token.asString(awsApigatewayv2ApiExample.id),
+      routeId: Token.asString(awsApigatewayv2RouteExample.id),
+      routeResponseKey: "$default",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `apiId` - (Required) API identifier.
+* `routeId` - (Required) Identifier of the [`awsApigatewayv2Route`](/docs/providers/aws/r/apigatewayv2_route.html).
+* `routeResponseKey` - (Required) Route response key.
+* `modelSelectionExpression` - (Optional) The [model selection expression](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-websocket-api-selection-expressions.html#apigateway-websocket-api-model-selection-expressions) for the route response.
+* `responseModels` - (Optional) Response models for the route response.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Route response identifier.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsApigatewayv2RouteResponse` using the API identifier, route identifier and route response identifier. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsApigatewayv2RouteResponse` using the API identifier, route identifier and route response identifier. For example:
+
+```console
+% terraform import aws_apigatewayv2_route_response.example aabbccddee/1122334/998877
+```
+
+<!-- cache-key: cdktf-0.18.0 input-09d67e36afad395b0392b180f09d72c54381ca9fc1c80ad3269815c5d740e985 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/apigatewayv2_stage.html.markdown b/website/docs/cdktf/typescript/r/apigatewayv2_stage.html.markdown
new file mode 100644
index 00000000000..ed55e1d77a9
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/apigatewayv2_stage.html.markdown
@@ -0,0 +1,125 @@
+---
+subcategory: "API Gateway V2"
+layout: "aws"
+page_title: "AWS: aws_apigatewayv2_stage"
+description: |-
+  Manages an Amazon API Gateway Version 2 stage.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_apigatewayv2_stage
+
+Manages an Amazon API Gateway Version 2 stage.
+More information can be found in the [Amazon API Gateway Developer Guide](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-websocket-api.html).
+
+## Example Usage
+
+### Basic
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Apigatewayv2Stage } from "./.gen/providers/aws/apigatewayv2-stage";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Apigatewayv2Stage(this, "example", {
+      apiId: Token.asString(awsApigatewayv2ApiExample.id),
+      name: "example-stage",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `apiId` - (Required) API identifier.
+* `name` - (Required) Name of the stage. Must be between 1 and 128 characters in length.
+
+The following arguments are optional:
+
+* `accessLogSettings` - (Optional) Settings for logging access in this stage.
+Use the [`awsApiGatewayAccount`](/docs/providers/aws/r/api_gateway_account.html) resource to configure [permissions for CloudWatch Logging](https://docs.aws.amazon.com/apigateway/latest/developerguide/set-up-logging.html#set-up-access-logging-permissions).
+* `autoDeploy` - (Optional) Whether updates to an API automatically trigger a new deployment. Defaults to `false`. Applicable for HTTP APIs.
+* `clientCertificateId` - (Optional) Identifier of a client certificate for the stage. Use the [`awsApiGatewayClientCertificate`](/docs/providers/aws/r/api_gateway_client_certificate.html) resource to configure a client certificate.
+Supported only for WebSocket APIs.
+* `defaultRouteSettings` - (Optional) Default route settings for the stage.
+* `deploymentId` - (Optional) Deployment identifier of the stage. Use the [`awsApigatewayv2Deployment`](/docs/providers/aws/r/apigatewayv2_deployment.html) resource to configure a deployment.
+* `description` - (Optional) Description for the stage. Must be less than or equal to 1024 characters in length.
+* `routeSettings` - (Optional) Route settings for the stage.
+* `stageVariables` - (Optional) Map that defines the stage variables for the stage.
+* `tags` - (Optional) Map of tags to assign to the stage. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### access_log_settings
+
+* `destinationArn` - (Required) ARN of the CloudWatch Logs log group to receive access logs. Any trailing `:*` is trimmed from the ARN.
+* `format` - (Required) Single line [format](https://docs.aws.amazon.com/apigateway/latest/developerguide/set-up-logging.html#apigateway-cloudwatch-log-formats) of the access logs of data. Refer to log settings for [HTTP](https://docs.aws.amazon.com/apigateway/latest/developerguide/http-api-logging-variables.html) or [Websocket](https://docs.aws.amazon.com/apigateway/latest/developerguide/websocket-api-logging.html).
+
+### default_route_settings
+
+* `dataTraceEnabled` - (Optional) Whether data trace logging is enabled for the default route. Affects the log entries pushed to Amazon CloudWatch Logs.
+Defaults to `false`. Supported only for WebSocket APIs.
+* `detailedMetricsEnabled` - (Optional) Whether detailed metrics are enabled for the default route. Defaults to `false`.
+* `loggingLevel` - (Optional) Logging level for the default route. Affects the log entries pushed to Amazon CloudWatch Logs.
+Valid values: `error`, `info`, `off`. Defaults to `off`. Supported only for WebSocket APIs. Terraform will only perform drift detection of its value when present in a configuration.
+* `throttlingBurstLimit` - (Optional) Throttling burst limit for the default route.
+* `throttlingRateLimit` - (Optional) Throttling rate limit for the default route.
+
+### route_settings
+
+* `routeKey` - (Required) Route key.
+* `dataTraceEnabled` - (Optional) Whether data trace logging is enabled for the route. Affects the log entries pushed to Amazon CloudWatch Logs.
+Defaults to `false`. Supported only for WebSocket APIs.
+* `detailedMetricsEnabled` - (Optional) Whether detailed metrics are enabled for the route. Defaults to `false`.
+* `loggingLevel` - (Optional) Logging level for the route. Affects the log entries pushed to Amazon CloudWatch Logs.
+Valid values: `error`, `info`, `off`. Defaults to `off`. Supported only for WebSocket APIs. Terraform will only perform drift detection of its value when present in a configuration.
+* `throttlingBurstLimit` - (Optional) Throttling burst limit for the route.
+* `throttlingRateLimit` - (Optional) Throttling rate limit for the route.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Stage identifier.
+* `arn` - ARN of the stage.
+* `executionArn` - ARN prefix to be used in an [`awsLambdaPermission`](/docs/providers/aws/r/lambda_permission.html)'s `sourceArn` attribute.
+For WebSocket APIs this attribute can additionally be used in an [`awsIamPolicy`](/docs/providers/aws/r/iam_policy.html) to authorize access to the [`@connections` API](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-how-to-call-websocket-api-connections.html).
+See the [Amazon API Gateway Developer Guide](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-websocket-control-access-iam.html) for details.
+* `invokeUrl` - URL to invoke the API pointing to the stage,
+  e.g., `wss://z4675Bid1JExecuteApiEuWest2AmazonawsCom/exampleStage`, or `https://z4675Bid1JExecuteApiEuWest2AmazonawsCom/`
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsApigatewayv2Stage` using the API identifier and stage name. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsApigatewayv2Stage` using the API identifier and stage name. For example:
+
+```console
+% terraform import aws_apigatewayv2_stage.example aabbccddee/example-stage
+```
+
+-> **Note:** The API Gateway managed stage created as part of [_quick_create_](https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-basic-concept.html#apigateway-definition-quick-create) cannot be imported.
+
+<!-- cache-key: cdktf-0.18.0 input-c7cc2d4235ed06a055a36c6327f99044a8a10f0f104b25ba18451743f15b5497 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/apigatewayv2_vpc_link.html.markdown b/website/docs/cdktf/typescript/r/apigatewayv2_vpc_link.html.markdown
new file mode 100644
index 00000000000..6e8a56470f5
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/apigatewayv2_vpc_link.html.markdown
@@ -0,0 +1,84 @@
+---
+subcategory: "API Gateway V2"
+layout: "aws"
+page_title: "AWS: aws_apigatewayv2_vpc_link"
+description: |-
+  Manages an Amazon API Gateway Version 2 VPC Link.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_apigatewayv2_vpc_link
+
+Manages an Amazon API Gateway Version 2 VPC Link.
+
+-> **Note:** Amazon API Gateway Version 2 VPC Links enable private integrations that connect HTTP APIs to private resources in a VPC.
+To enable private integration for REST APIs, use the Amazon API Gateway Version 1 VPC Link [resource](/docs/providers/aws/r/api_gateway_vpc_link.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Apigatewayv2VpcLink } from "./.gen/providers/aws/apigatewayv2-vpc-link";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Apigatewayv2VpcLink(this, "example", {
+      name: "example",
+      securityGroupIds: [Token.asString(dataAwsSecurityGroupExample.id)],
+      subnetIds: Token.asList(dataAwsSubnetsExample.ids),
+      tags: {
+        Usage: "example",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) Name of the VPC Link. Must be between 1 and 128 characters in length.
+* `securityGroupIds` - (Required) Security group IDs for the VPC Link.
+* `subnetIds` - (Required) Subnet IDs for the VPC Link.
+* `tags` - (Optional) Map of tags to assign to the VPC Link. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - VPC Link identifier.
+* `arn` - VPC Link ARN.
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsApigatewayv2VpcLink` using the VPC Link identifier. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsApigatewayv2VpcLink` using the VPC Link identifier. For example:
+
+```console
+% terraform import aws_apigatewayv2_vpc_link.example aabbccddee
+```
+
+<!-- cache-key: cdktf-0.18.0 input-7f7266061a30dbdd15dacececebef105a6b52be6446a7f4871237c0ef1b7c4b6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/app_cookie_stickiness_policy.html.markdown b/website/docs/cdktf/typescript/r/app_cookie_stickiness_policy.html.markdown
new file mode 100644
index 00000000000..0e4ab2b6c6e
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/app_cookie_stickiness_policy.html.markdown
@@ -0,0 +1,97 @@
+---
+subcategory: "ELB Classic"
+layout: "aws"
+page_title: "AWS: aws_app_cookie_stickiness_policy"
+description: |-
+  Provides an application cookie stickiness policy, which allows an ELB to wed its stickiness cookie to a cookie generated by your application.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_app_cookie_stickiness_policy
+
+Provides an application cookie stickiness policy, which allows an ELB to wed its sticky cookie's expiration to a cookie generated by your application.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AppCookieStickinessPolicy } from "./.gen/providers/aws/app-cookie-stickiness-policy";
+import { Elb } from "./.gen/providers/aws/elb";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const lb = new Elb(this, "lb", {
+      availabilityZones: ["us-east-1a"],
+      listener: [
+        {
+          instancePort: 8000,
+          instanceProtocol: "http",
+          lbPort: 80,
+          lbProtocol: "http",
+        },
+      ],
+      name: "test-lb",
+    });
+    new AppCookieStickinessPolicy(this, "foo", {
+      cookieName: "MyAppCookie",
+      lbPort: 80,
+      loadBalancer: lb.name,
+      name: "foo_policy",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) Name of the stickiness policy.
+* `loadBalancer` - (Required) Name of load balancer to which the policy
+  should be attached.
+* `lbPort` - (Required) Load balancer port to which the policy
+  should be applied. This must be an active listener on the load
+balancer.
+* `cookieName` - (Required) Application cookie whose lifetime the ELB's cookie should follow.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the policy.
+* `name` - Name of the stickiness policy.
+* `loadBalancer` - Name of load balancer to which the policy is attached.
+* `lbPort` - Load balancer port to which the policy is applied.
+* `cookieName` - Application cookie whose lifetime the ELB's cookie should follow.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import application cookie stickiness policies using the ELB name, port, and policy name separated by colons (`:`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import application cookie stickiness policies using the ELB name, port, and policy name separated by colons (`:`). For example:
+
+```console
+% terraform import aws_app_cookie_stickiness_policy.example my-elb:80:my-policy
+```
+
+<!-- cache-key: cdktf-0.18.0 input-88293d9f7b9b0c56a30ec158ef04e7ebaf1d4abe22c80ea32220c4d2176785a6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/appautoscaling_policy.html.markdown b/website/docs/cdktf/typescript/r/appautoscaling_policy.html.markdown
new file mode 100644
index 00000000000..1b0f5af8964
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/appautoscaling_policy.html.markdown
@@ -0,0 +1,490 @@
+---
+subcategory: "Application Auto Scaling"
+layout: "aws"
+page_title: "AWS: aws_appautoscaling_policy"
+description: |-
+  Provides an Application AutoScaling Policy resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_appautoscaling_policy
+
+Provides an Application AutoScaling Policy resource.
+
+## Example Usage
+
+### DynamoDB Table Autoscaling
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AppautoscalingPolicy } from "./.gen/providers/aws/appautoscaling-policy";
+import { AppautoscalingTarget } from "./.gen/providers/aws/appautoscaling-target";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const dynamodbTableReadTarget = new AppautoscalingTarget(
+      this,
+      "dynamodb_table_read_target",
+      {
+        maxCapacity: 100,
+        minCapacity: 5,
+        resourceId: "table/tableName",
+        scalableDimension: "dynamodb:table:ReadCapacityUnits",
+        serviceNamespace: "dynamodb",
+      }
+    );
+    new AppautoscalingPolicy(this, "dynamodb_table_read_policy", {
+      name:
+        "DynamoDBReadCapacityUtilization:${" +
+        dynamodbTableReadTarget.resourceId +
+        "}",
+      policyType: "TargetTrackingScaling",
+      resourceId: dynamodbTableReadTarget.resourceId,
+      scalableDimension: dynamodbTableReadTarget.scalableDimension,
+      serviceNamespace: dynamodbTableReadTarget.serviceNamespace,
+      targetTrackingScalingPolicyConfiguration: {
+        predefinedMetricSpecification: {
+          predefinedMetricType: "DynamoDBReadCapacityUtilization",
+        },
+        targetValue: 70,
+      },
+    });
+  }
+}
+
+```
+
+### ECS Service Autoscaling
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, Op, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AppautoscalingPolicy } from "./.gen/providers/aws/appautoscaling-policy";
+import { AppautoscalingTarget } from "./.gen/providers/aws/appautoscaling-target";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const ecsTarget = new AppautoscalingTarget(this, "ecs_target", {
+      maxCapacity: 4,
+      minCapacity: 1,
+      resourceId: "service/clusterName/serviceName",
+      scalableDimension: "ecs:service:DesiredCount",
+      serviceNamespace: "ecs",
+    });
+    new AppautoscalingPolicy(this, "ecs_policy", {
+      name: "scale-down",
+      policyType: "StepScaling",
+      resourceId: ecsTarget.resourceId,
+      scalableDimension: ecsTarget.scalableDimension,
+      serviceNamespace: ecsTarget.serviceNamespace,
+      stepScalingPolicyConfiguration: {
+        adjustmentType: "ChangeInCapacity",
+        cooldown: 60,
+        metricAggregationType: "Maximum",
+        stepAdjustment: [
+          {
+            metricIntervalUpperBound: Token.asString(0),
+            scalingAdjustment: Token.asNumber(Op.negate(1)),
+          },
+        ],
+      },
+    });
+  }
+}
+
+```
+
+### Preserve desired count when updating an autoscaled ECS Service
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EcsService } from "./.gen/providers/aws/ecs-service";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new EcsService(this, "ecs_service", {
+      cluster: "clusterName",
+      desiredCount: 2,
+      lifecycle: {
+        ignoreChanges: [desiredCount],
+      },
+      name: "serviceName",
+      taskDefinition: "taskDefinitionFamily:1",
+    });
+  }
+}
+
+```
+
+### Aurora Read Replica Autoscaling
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AppautoscalingPolicy } from "./.gen/providers/aws/appautoscaling-policy";
+import { AppautoscalingTarget } from "./.gen/providers/aws/appautoscaling-target";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const replicas = new AppautoscalingTarget(this, "replicas", {
+      maxCapacity: 15,
+      minCapacity: 1,
+      resourceId: "cluster:${" + example.id + "}",
+      scalableDimension: "rds:cluster:ReadReplicaCount",
+      serviceNamespace: "rds",
+    });
+    const awsAppautoscalingPolicyReplicas = new AppautoscalingPolicy(
+      this,
+      "replicas_1",
+      {
+        name: "cpu-auto-scaling",
+        policyType: "TargetTrackingScaling",
+        resourceId: replicas.resourceId,
+        scalableDimension: replicas.scalableDimension,
+        serviceNamespace: replicas.serviceNamespace,
+        targetTrackingScalingPolicyConfiguration: {
+          predefinedMetricSpecification: {
+            predefinedMetricType: "RDSReaderAverageCPUUtilization",
+          },
+          scaleInCooldown: 300,
+          scaleOutCooldown: 300,
+          targetValue: 75,
+        },
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsAppautoscalingPolicyReplicas.overrideLogicalId("replicas");
+  }
+}
+
+```
+
+### Create target tracking scaling policy using metric math
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AppautoscalingPolicy } from "./.gen/providers/aws/appautoscaling-policy";
+import { AppautoscalingTarget } from "./.gen/providers/aws/appautoscaling-target";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const ecsTarget = new AppautoscalingTarget(this, "ecs_target", {
+      maxCapacity: 4,
+      minCapacity: 1,
+      resourceId: "service/clusterName/serviceName",
+      scalableDimension: "ecs:service:DesiredCount",
+      serviceNamespace: "ecs",
+    });
+    new AppautoscalingPolicy(this, "example", {
+      name: "foo",
+      policyType: "TargetTrackingScaling",
+      resourceId: ecsTarget.resourceId,
+      scalableDimension: ecsTarget.scalableDimension,
+      serviceNamespace: ecsTarget.serviceNamespace,
+      targetTrackingScalingPolicyConfiguration: {
+        customizedMetricSpecification: {
+          metrics: [
+            {
+              id: "m1",
+              label:
+                "Get the queue size (the number of messages waiting to be processed)",
+              metricStat: {
+                metric: {
+                  dimensions: [
+                    {
+                      name: "QueueName",
+                      value: "my-queue",
+                    },
+                  ],
+                  metricName: "ApproximateNumberOfMessagesVisible",
+                  namespace: "AWS/SQS",
+                },
+                stat: "Sum",
+              },
+              returnData: false,
+            },
+            {
+              id: "m2",
+              label:
+                "Get the ECS running task count (the number of currently running tasks)",
+              metricStat: {
+                metric: {
+                  dimensions: [
+                    {
+                      name: "ClusterName",
+                      value: "default",
+                    },
+                    {
+                      name: "ServiceName",
+                      value: "web-app",
+                    },
+                  ],
+                  metricName: "RunningTaskCount",
+                  namespace: "ECS/ContainerInsights",
+                },
+                stat: "Average",
+              },
+              returnData: false,
+            },
+            {
+              expression: "m1 / m2",
+              id: "e1",
+              label: "Calculate the backlog per instance",
+              returnData: true,
+            },
+          ],
+        },
+        targetValue: 100,
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) Name of the policy. Must be between 1 and 255 characters in length.
+* `policyType` - (Optional) Policy type. Valid values are `stepScaling` and `targetTrackingScaling`. Defaults to `stepScaling`. Certain services only support only one policy type. For more information see the [Target Tracking Scaling Policies](https://docs.aws.amazon.com/autoscaling/application/userguide/application-auto-scaling-target-tracking.html) and [Step Scaling Policies](https://docs.aws.amazon.com/autoscaling/application/userguide/application-auto-scaling-step-scaling-policies.html) documentation.
+* `resourceId` - (Required) Resource type and unique identifier string for the resource associated with the scaling policy. Documentation can be found in the `resourceId` parameter at: [AWS Application Auto Scaling API Reference](https://docs.aws.amazon.com/autoscaling/application/APIReference/API_RegisterScalableTarget.html)
+* `scalableDimension` - (Required) Scalable dimension of the scalable target. Documentation can be found in the `scalableDimension` parameter at: [AWS Application Auto Scaling API Reference](https://docs.aws.amazon.com/autoscaling/application/APIReference/API_RegisterScalableTarget.html)
+* `serviceNamespace` - (Required) AWS service namespace of the scalable target. Documentation can be found in the `serviceNamespace` parameter at: [AWS Application Auto Scaling API Reference](https://docs.aws.amazon.com/autoscaling/application/APIReference/API_RegisterScalableTarget.html)
+* `stepScalingPolicyConfiguration` - (Optional) Step scaling policy configuration, requires `policy_type = "StepScaling"` (default). See supported fields below.
+* `targetTrackingScalingPolicyConfiguration` - (Optional) Target tracking policy, requires `policy_type = "TargetTrackingScaling"`. See supported fields below.
+
+### step_scaling_policy_configuration
+
+The `stepScalingPolicyConfiguration` configuration block supports the following arguments:
+
+* `adjustmentType` - (Required) Whether the adjustment is an absolute number or a percentage of the current capacity. Valid values are `changeInCapacity`, `exactCapacity`, and `percentChangeInCapacity`.
+* `cooldown` - (Required) Amount of time, in seconds, after a scaling activity completes and before the next scaling activity can start.
+* `metricAggregationType` - (Optional) Aggregation type for the policy's metrics. Valid values are "Minimum", "Maximum", and "Average". Without a value, AWS will treat the aggregation type as "Average".
+* `minAdjustmentMagnitude` - (Optional) Minimum number to adjust your scalable dimension as a result of a scaling activity. If the adjustment type is PercentChangeInCapacity, the scaling policy changes the scalable dimension of the scalable target by this amount.
+* `stepAdjustment` - (Optional) Set of adjustments that manage scaling. These have the following structure:
+
+ ```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, Op, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AppautoscalingPolicy } from "./.gen/providers/aws/appautoscaling-policy";
+interface MyConfig {
+  name: any;
+  resourceId: any;
+  scalableDimension: any;
+  serviceNamespace: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new AppautoscalingPolicy(this, "ecs_policy", {
+      stepScalingPolicyConfiguration: {
+        stepAdjustment: [
+          {
+            metricIntervalLowerBound: Token.asString(1),
+            metricIntervalUpperBound: Token.asString(2),
+            scalingAdjustment: Token.asNumber(Op.negate(1)),
+          },
+          {
+            metricIntervalLowerBound: Token.asString(2),
+            metricIntervalUpperBound: Token.asString(3),
+            scalingAdjustment: 1,
+          },
+        ],
+      },
+      name: config.name,
+      resourceId: config.resourceId,
+      scalableDimension: config.scalableDimension,
+      serviceNamespace: config.serviceNamespace,
+    });
+  }
+}
+
+```
+
+* `metricIntervalLowerBound` - (Optional) Lower bound for the difference between the alarm threshold and the CloudWatch metric. Without a value, AWS will treat this bound as negative infinity.
+* `metricIntervalUpperBound` - (Optional) Upper bound for the difference between the alarm threshold and the CloudWatch metric. Without a value, AWS will treat this bound as infinity. The upper bound must be greater than the lower bound.
+* `scalingAdjustment` - (Required) Number of members by which to scale, when the adjustment bounds are breached. A positive value scales up. A negative value scales down.
+
+### target_tracking_scaling_policy_configuration
+
+The `targetTrackingScalingPolicyConfiguration` configuration block supports the following arguments:
+
+* `targetValue` - (Required) Target value for the metric.
+* `disableScaleIn` - (Optional) Whether scale in by the target tracking policy is disabled. If the value is true, scale in is disabled and the target tracking policy won't remove capacity from the scalable resource. Otherwise, scale in is enabled and the target tracking policy can remove capacity from the scalable resource. The default value is `false`.
+* `scaleInCooldown` - (Optional) Amount of time, in seconds, after a scale in activity completes before another scale in activity can start.
+* `scaleOutCooldown` - (Optional) Amount of time, in seconds, after a scale out activity completes before another scale out activity can start.
+* `customizedMetricSpecification` - (Optional) Custom CloudWatch metric. Documentation can be found  at: [AWS Customized Metric Specification](https://docs.aws.amazon.com/autoscaling/ec2/APIReference/API_CustomizedMetricSpecification.html). See supported fields below.
+* `predefinedMetricSpecification` - (Optional) Predefined metric. See supported fields below.
+
+### target_tracking_scaling_policy_configuration customized_metric_specification
+
+Example usage:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AppautoscalingPolicy } from "./.gen/providers/aws/appautoscaling-policy";
+interface MyConfig {
+  name: any;
+  resourceId: any;
+  scalableDimension: any;
+  serviceNamespace: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new AppautoscalingPolicy(this, "example", {
+      policyType: "TargetTrackingScaling",
+      targetTrackingScalingPolicyConfiguration: {
+        customizedMetricSpecification: {
+          dimensions: [
+            {
+              name: "MyOptionalMetricDimensionName",
+              value: "MyOptionalMetricDimensionValue",
+            },
+          ],
+          metricName: "MyUtilizationMetric",
+          namespace: "MyNamespace",
+          statistic: "Average",
+          unit: "Percent",
+        },
+        targetValue: 40,
+      },
+      name: config.name,
+      resourceId: config.resourceId,
+      scalableDimension: config.scalableDimension,
+      serviceNamespace: config.serviceNamespace,
+    });
+  }
+}
+
+```
+
+The `targetTrackingScalingPolicyConfiguration` `customizedMetricSpecification` configuration block supports the following arguments:
+
+* `dimensions` - (Optional) Configuration block(s) with the dimensions of the metric if the metric was published with dimensions. Detailed below.
+* `metricName` - (Optional) Name of the metric.
+* `namespace` - (Optional) Namespace of the metric.
+* `statistic` - (Optional) Statistic of the metric. Valid values: `average`, `minimum`, `maximum`, `sampleCount`, and `sum`.
+* `unit` - (Optional) Unit of the metric.
+* `metrics` - (Optional) Metrics to include, as a metric data query.
+
+### target_tracking_scaling_policy_configuration customized_metric_specification dimensions
+
+The `targetTrackingScalingPolicyConfiguration` `customizedMetricSpecification` `dimensions` configuration block supports the following arguments:
+
+* `name` - (Required) Name of the dimension.
+* `value` - (Required) Value of the dimension.
+
+### target_tracking_scaling_policy_configuration customized_metric_specification metrics
+
+The `targetTrackingScalingPolicyConfiguration` `customizedMetricSpecification` `metrics` configuration block supports the following arguments:
+
+* `expression` - (Optional) Math expression used on the returned metric. You must specify either `expression` or `metricStat`, but not both.
+* `id` - (Required) Short name for the metric used in target tracking scaling policy.
+* `label` - (Optional) Human-readable label for this metric or expression.
+* `metricStat` - (Optional) Structure that defines CloudWatch metric to be used in target tracking scaling policy. You must specify either `expression` or `metricStat`, but not both.
+* `returnData` - (Optional) Boolean that indicates whether to return the timestamps and raw data values of this metric, the default is true
+
+### target_tracking_scaling_policy_configuration customized_metric_specification metrics metric_stat
+
+The `targetTrackingScalingPolicyConfiguration` `customizedMetricSpecification` `metrics` `metricStat` configuration block supports the following arguments:
+
+* `metric` - (Required) Structure that defines the CloudWatch metric to return, including the metric name, namespace, and dimensions.
+* `stat` - (Required) Statistic of the metrics to return.
+* `unit` - (Optional) Unit of the metrics to return.
+
+### target_tracking_scaling_policy_configuration customized_metric_specification metrics metric
+
+The `targetTrackingScalingPolicyConfiguration` `customizedMetricSpecification` `metrics` `metric` configuration block supports the following arguments:
+
+* `dimensions` - (Optional) Dimensions of the metric.
+* `metricName` - (Required) Name of the metric.
+* `namespace` - (Required) Namespace of the metric.
+
+### target_tracking_scaling_policy_configuration customized_metric_specification metrics dimensions
+
+The `targetTrackingScalingPolicyConfiguration` `customizedMetricSpecification` `metrics` `dimensions` configuration block supports the following arguments:
+
+* `name` - (Required) Name of the dimension.
+* `value` - (Required) Value of the dimension.
+
+### target_tracking_scaling_policy_configuration predefined_metric_specification
+
+The `targetTrackingScalingPolicyConfiguration` `predefinedMetricSpecification` configuration block supports the following arguments:
+
+* `predefinedMetricType` - (Required) Metric type.
+* `resourceLabel` - (Optional) Reserved for future use if the `predefinedMetricType` is not `albRequestCountPerTarget`. If the `predefinedMetricType` is `albRequestCountPerTarget`, you must specify this argument. Documentation can be found at: [AWS Predefined Scaling Metric Specification](https://docs.aws.amazon.com/autoscaling/plans/APIReference/API_PredefinedScalingMetricSpecification.html). Must be less than or equal to 1023 characters in length.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `alarmArns` - List of CloudWatch alarm ARNs associated with the scaling policy.
+* `arn` - ARN assigned by AWS to the scaling policy.
+* `name` - Scaling policy's name.
+* `policyType` - Scaling policy's type.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Application AutoScaling Policy using the `serviceNamespace` , `resourceId`, `scalableDimension` and `policyName` separated by `/`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Application AutoScaling Policy using the `serviceNamespace` , `resourceId`, `scalableDimension` and `policyName` separated by `/`. For example:
+
+```console
+% terraform import aws_appautoscaling_policy.test-policy service-namespace/resource-id/scalable-dimension/policy-name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-fbf0b558db12d5a4ee505edd94d9a657fd67e6fe4b86ba032dbf944c9b850975 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/appautoscaling_scheduled_action.html.markdown b/website/docs/cdktf/typescript/r/appautoscaling_scheduled_action.html.markdown
new file mode 100644
index 00000000000..7a4dcbe5cfa
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/appautoscaling_scheduled_action.html.markdown
@@ -0,0 +1,124 @@
+---
+subcategory: "Application Auto Scaling"
+layout: "aws"
+page_title: "AWS: aws_appautoscaling_scheduled_action"
+description: |-
+  Provides an Application AutoScaling ScheduledAction resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_appautoscaling_scheduled_action
+
+Provides an Application AutoScaling ScheduledAction resource.
+
+## Example Usage
+
+### DynamoDB Table Autoscaling
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AppautoscalingScheduledAction } from "./.gen/providers/aws/appautoscaling-scheduled-action";
+import { AppautoscalingTarget } from "./.gen/providers/aws/appautoscaling-target";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const dynamodb = new AppautoscalingTarget(this, "dynamodb", {
+      maxCapacity: 100,
+      minCapacity: 5,
+      resourceId: "table/tableName",
+      scalableDimension: "dynamodb:table:ReadCapacityUnits",
+      serviceNamespace: "dynamodb",
+    });
+    const awsAppautoscalingScheduledActionDynamodb =
+      new AppautoscalingScheduledAction(this, "dynamodb_1", {
+        name: "dynamodb",
+        resourceId: dynamodb.resourceId,
+        scalableDimension: dynamodb.scalableDimension,
+        scalableTargetAction: {
+          maxCapacity: Token.asString(200),
+          minCapacity: Token.asString(1),
+        },
+        schedule: "at(2006-01-02T15:04:05)",
+        serviceNamespace: dynamodb.serviceNamespace,
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsAppautoscalingScheduledActionDynamodb.overrideLogicalId("dynamodb");
+  }
+}
+
+```
+
+### ECS Service Autoscaling
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AppautoscalingScheduledAction } from "./.gen/providers/aws/appautoscaling-scheduled-action";
+import { AppautoscalingTarget } from "./.gen/providers/aws/appautoscaling-target";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const ecs = new AppautoscalingTarget(this, "ecs", {
+      maxCapacity: 4,
+      minCapacity: 1,
+      resourceId: "service/clusterName/serviceName",
+      scalableDimension: "ecs:service:DesiredCount",
+      serviceNamespace: "ecs",
+    });
+    const awsAppautoscalingScheduledActionEcs =
+      new AppautoscalingScheduledAction(this, "ecs_1", {
+        name: "ecs",
+        resourceId: ecs.resourceId,
+        scalableDimension: ecs.scalableDimension,
+        scalableTargetAction: {
+          maxCapacity: Token.asString(10),
+          minCapacity: Token.asString(1),
+        },
+        schedule: "at(2006-01-02T15:04:05)",
+        serviceNamespace: ecs.serviceNamespace,
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsAppautoscalingScheduledActionEcs.overrideLogicalId("ecs");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) Name of the scheduled action.
+* `serviceNamespace` - (Required) Namespace of the AWS service. Documentation can be found in the `serviceNamespace` parameter at: [AWS Application Auto Scaling API Reference](https://docs.aws.amazon.com/autoscaling/application/APIReference/API_PutScheduledAction.html) Example: ecs
+* `resourceId` - (Required) Identifier of the resource associated with the scheduled action. Documentation can be found in the `resourceId` parameter at: [AWS Application Auto Scaling API Reference](https://docs.aws.amazon.com/autoscaling/application/APIReference/API_PutScheduledAction.html)
+* `scalableDimension` - (Required) Scalable dimension. Documentation can be found in the `scalableDimension` parameter at: [AWS Application Auto Scaling API Reference](https://docs.aws.amazon.com/autoscaling/application/APIReference/API_PutScheduledAction.html) Example: ecs:service:DesiredCount
+* `scalableTargetAction` - (Required) New minimum and maximum capacity. You can set both values or just one. See [below](#scalable-target-action-arguments)
+* `schedule` - (Required) Schedule for this action. The following formats are supported: At expressions - at(yyyy-mm-ddThh:mm:ss), Rate expressions - rate(valueunit), Cron expressions - cron(fields). Times for at expressions and cron expressions are evaluated using the time zone configured in `timezone`. Documentation can be found in the `timezone` parameter at: [AWS Application Auto Scaling API Reference](https://docs.aws.amazon.com/autoscaling/application/APIReference/API_PutScheduledAction.html)
+* `startTime` - (Optional) Date and time for the scheduled action to start in RFC 3339 format. The timezone is not affected by the setting of `timezone`.
+* `endTime` - (Optional) Date and time for the scheduled action to end in RFC 3339 format. The timezone is not affected by the setting of `timezone`.
+* `timezone` - (Optional) Time zone used when setting a scheduled action by using an at or cron expression. Does not affect timezone for `startTime` and `endTime`. Valid values are the [canonical names of the IANA time zones supported by Joda-Time](https://www.joda.org/joda-time/timezones.html), such as `etc/gmt+9` or `pacific/tahiti`. Default is `utc`.
+
+### Scalable Target Action Arguments
+
+* `maxCapacity` - (Optional) Maximum capacity. At least one of `maxCapacity` or `minCapacity` must be set.
+* `minCapacity` - (Optional) Minimum capacity. At least one of `minCapacity` or `maxCapacity` must be set.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the scheduled action.
+
+<!-- cache-key: cdktf-0.18.0 input-2340bae330ec995b135b58fdb2388300b4f924ab8525d2c122eed0efb9dccbdd -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/appautoscaling_target.html.markdown b/website/docs/cdktf/typescript/r/appautoscaling_target.html.markdown
new file mode 100644
index 00000000000..957f21bcc53
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/appautoscaling_target.html.markdown
@@ -0,0 +1,198 @@
+---
+subcategory: "Application Auto Scaling"
+layout: "aws"
+page_title: "AWS: aws_appautoscaling_target"
+description: |-
+  Provides an Application AutoScaling ScalableTarget resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_appautoscaling_target
+
+Provides an Application AutoScaling ScalableTarget resource. To manage policies which get attached to the target, see the [`awsAppautoscalingPolicy` resource](/docs/providers/aws/r/appautoscaling_policy.html).
+
+~> **NOTE:** Scalable targets created before 2023-03-20 may not have an assigned `arn`. These resource cannot use `tags` or participate in `defaultTags`. To prevent `terraform plan` showing differences that can never be reconciled, use the [`lifecycleIgnoreChanges`](https://developer.hashicorp.com/terraform/language/meta-arguments/lifecycle#ignore_changes) meta-argument. See the example below.
+
+~> **NOTE:** The [Application Auto Scaling service automatically attempts to manage IAM Service-Linked Roles](https://docs.aws.amazon.com/autoscaling/application/userguide/security_iam_service-with-iam.html#security_iam_service-with-iam-roles) when registering certain service namespaces for the first time. To manually manage this role, see the [`awsIamServiceLinkedRole` resource](/docs/providers/aws/r/iam_service_linked_role.html).
+
+## Example Usage
+
+### DynamoDB Table Autoscaling
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AppautoscalingTarget } from "./.gen/providers/aws/appautoscaling-target";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AppautoscalingTarget(this, "dynamodb_table_read_target", {
+      maxCapacity: 100,
+      minCapacity: 5,
+      resourceId: "table/${" + example.name + "}",
+      scalableDimension: "dynamodb:table:ReadCapacityUnits",
+      serviceNamespace: "dynamodb",
+    });
+  }
+}
+
+```
+
+### DynamoDB Index Autoscaling
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AppautoscalingTarget } from "./.gen/providers/aws/appautoscaling-target";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AppautoscalingTarget(this, "dynamodb_index_read_target", {
+      maxCapacity: 100,
+      minCapacity: 5,
+      resourceId:
+        "table/${" + example.name + "}/index/${" + indexName.value + "}",
+      scalableDimension: "dynamodb:index:ReadCapacityUnits",
+      serviceNamespace: "dynamodb",
+    });
+  }
+}
+
+```
+
+### ECS Service Autoscaling
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AppautoscalingTarget } from "./.gen/providers/aws/appautoscaling-target";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AppautoscalingTarget(this, "ecs_target", {
+      maxCapacity: 4,
+      minCapacity: 1,
+      resourceId:
+        "service/${" + example.name + "}/${" + awsEcsServiceExample.name + "}",
+      scalableDimension: "ecs:service:DesiredCount",
+      serviceNamespace: "ecs",
+    });
+  }
+}
+
+```
+
+### Aurora Read Replica Autoscaling
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AppautoscalingTarget } from "./.gen/providers/aws/appautoscaling-target";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AppautoscalingTarget(this, "replicas", {
+      maxCapacity: 15,
+      minCapacity: 1,
+      resourceId: "cluster:${" + example.id + "}",
+      scalableDimension: "rds:cluster:ReadReplicaCount",
+      serviceNamespace: "rds",
+    });
+  }
+}
+
+```
+
+### Suppressing `tagsAll` Differences For Older Resources
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AppautoscalingTarget } from "./.gen/providers/aws/appautoscaling-target";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AppautoscalingTarget(this, "ecs_target", {
+      lifecycle: {
+        ignoreChanges: [tagsAll],
+      },
+      maxCapacity: 4,
+      minCapacity: 1,
+      resourceId:
+        "service/${" + example.name + "}/${" + awsEcsServiceExample.name + "}",
+      scalableDimension: "ecs:service:DesiredCount",
+      serviceNamespace: "ecs",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `maxCapacity` - (Required) Max capacity of the scalable target.
+* `minCapacity` - (Required) Min capacity of the scalable target.
+* `resourceId` - (Required) Resource type and unique identifier string for the resource associated with the scaling policy. Documentation can be found in the `resourceId` parameter at: [AWS Application Auto Scaling API Reference](https://docs.aws.amazon.com/autoscaling/application/APIReference/API_RegisterScalableTarget.html#API_RegisterScalableTarget_RequestParameters)
+* `roleArn` - (Optional) ARN of the IAM role that allows Application AutoScaling to modify your scalable target on your behalf. This defaults to an IAM Service-Linked Role for most services and custom IAM Roles are ignored by the API for those namespaces. See the [AWS Application Auto Scaling documentation](https://docs.aws.amazon.com/autoscaling/application/userguide/security_iam_service-with-iam.html#security_iam_service-with-iam-roles) for more information about how this service interacts with IAM.
+* `scalableDimension` - (Required) Scalable dimension of the scalable target. Documentation can be found in the `scalableDimension` parameter at: [AWS Application Auto Scaling API Reference](https://docs.aws.amazon.com/autoscaling/application/APIReference/API_RegisterScalableTarget.html#API_RegisterScalableTarget_RequestParameters)
+* `serviceNamespace` - (Required) AWS service namespace of the scalable target. Documentation can be found in the `serviceNamespace` parameter at: [AWS Application Auto Scaling API Reference](https://docs.aws.amazon.com/autoscaling/application/APIReference/API_RegisterScalableTarget.html#API_RegisterScalableTarget_RequestParameters)
+* `tags` - (Optional) Map of tags to assign to the scalable target. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the scalable target.
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Application AutoScaling Target using the `serviceNamespace` , `resourceId` and `scalableDimension` separated by `/`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Application AutoScaling Target using the `serviceNamespace` , `resourceId` and `scalableDimension` separated by `/`. For example:
+
+```console
+% terraform import aws_appautoscaling_target.test-target service-namespace/resource-id/scalable-dimension
+```
+
+<!-- cache-key: cdktf-0.18.0 input-cff841bc1572dc29970ebd87553eae1d8c7762f0125b027829e17184e7104fdf -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/appconfig_application.html.markdown b/website/docs/cdktf/typescript/r/appconfig_application.html.markdown
new file mode 100644
index 00000000000..d3e02fc7f74
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/appconfig_application.html.markdown
@@ -0,0 +1,79 @@
+---
+subcategory: "AppConfig"
+layout: "aws"
+page_title: "AWS: aws_appconfig_application"
+description: |-
+  Provides an AppConfig Application resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_appconfig_application
+
+Provides an AppConfig Application resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AppconfigApplication } from "./.gen/providers/aws/appconfig-application";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AppconfigApplication(this, "example", {
+      description: "Example AppConfig Application",
+      name: "example-application-tf",
+      tags: {
+        Type: "AppConfig Application",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) Name for the application. Must be between 1 and 64 characters in length.
+* `description` - (Optional) Description of the application. Can be at most 1024 characters.
+* `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the AppConfig Application.
+* `id` - AppConfig application ID.
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AppConfig Applications using their application ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import AppConfig Applications using their application ID. For example:
+
+```console
+% terraform import aws_appconfig_application.example 71rxuzt
+```
+
+<!-- cache-key: cdktf-0.18.0 input-640d61d75f2bc0890c5f7e85bddbe3b0d0c1003903cdf41e4dfe4c6e445c5966 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/appconfig_configuration_profile.html.markdown b/website/docs/cdktf/typescript/r/appconfig_configuration_profile.html.markdown
new file mode 100644
index 00000000000..5a6ae1ebb98
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/appconfig_configuration_profile.html.markdown
@@ -0,0 +1,100 @@
+---
+subcategory: "AppConfig"
+layout: "aws"
+page_title: "AWS: aws_appconfig_configuration_profile"
+description: |-
+  Provides an AppConfig Configuration Profile resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_appconfig_configuration_profile
+
+Provides an AppConfig Configuration Profile resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AppconfigConfigurationProfile } from "./.gen/providers/aws/appconfig-configuration-profile";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AppconfigConfigurationProfile(this, "example", {
+      applicationId: Token.asString(awsAppconfigApplicationExample.id),
+      description: "Example Configuration Profile",
+      locationUri: "hosted",
+      name: "example-configuration-profile-tf",
+      tags: {
+        Type: "AppConfig Configuration Profile",
+      },
+      validator: [
+        {
+          content: Token.asString(awsLambdaFunctionExample.arn),
+          type: "LAMBDA",
+        },
+      ],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `applicationId` - (Required, Forces new resource) Application ID. Must be between 4 and 7 characters in length.
+* `locationUri` - (Required, Forces new resource) URI to locate the configuration. You can specify the AWS AppConfig hosted configuration store, Systems Manager (SSM) document, an SSM Parameter Store parameter, or an Amazon S3 object. For the hosted configuration store, specify `hosted`. For an SSM document, specify either the document name in the format `ssmDocument://<documentName>` or the ARN. For a parameter, specify either the parameter name in the format `ssmParameter://<parameterName>` or the ARN. For an Amazon S3 object, specify the URI in the following format: `s3://<bucket>/<objectKey>`.
+* `name` - (Required) Name for the configuration profile. Must be between 1 and 64 characters in length.
+* `description` - (Optional) Description of the configuration profile. Can be at most 1024 characters.
+* `retrievalRoleArn` - (Optional) ARN of an IAM role with permission to access the configuration at the specified `locationUri`. A retrieval role ARN is not required for configurations stored in the AWS AppConfig `hosted` configuration store. It is required for all other sources that store your configuration.
+* `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `type` - (Optional) Type of configurations contained in the profile. Valid values: `awsAppConfigFeatureFlags` and `awsFreeform`.  Default: `awsFreeform`.
+* `validator` - (Optional) Set of methods for validating the configuration. Maximum of 2. See [Validator](#validator) below for more details.
+
+### Validator
+
+The `validator` block supports the following:
+
+* `content` - (Optional, Required when `type` is `lambda`) Either the JSON Schema content or the ARN of an AWS Lambda function.
+* `type` - (Optional) Type of validator. Valid values: `jsonSchema` and `lambda`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the AppConfig Configuration Profile.
+* `configurationProfileId` - The configuration profile ID.
+* `id` - AppConfig configuration profile ID and application ID separated by a colon (`:`).
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AppConfig Configuration Profiles using the configuration profile ID and application ID separated by a colon (`:`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import AppConfig Configuration Profiles using the configuration profile ID and application ID separated by a colon (`:`). For example:
+
+```console
+% terraform import aws_appconfig_configuration_profile.example 71abcde:11xxxxx
+```
+
+<!-- cache-key: cdktf-0.18.0 input-8bd3175c690640ae4abfd602726abaa14c66e5eea23a0a90f02171c3cfe14ffe -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/appconfig_deployment.html.markdown b/website/docs/cdktf/typescript/r/appconfig_deployment.html.markdown
new file mode 100644
index 00000000000..59963768cc0
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/appconfig_deployment.html.markdown
@@ -0,0 +1,97 @@
+---
+subcategory: "AppConfig"
+layout: "aws"
+page_title: "AWS: aws_appconfig_deployment"
+description: |-
+  Provides an AppConfig Deployment resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_appconfig_deployment
+
+Provides an AppConfig Deployment resource for an [`awsAppconfigApplication` resource](appconfig_application.html.markdown).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AppconfigDeployment } from "./.gen/providers/aws/appconfig-deployment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AppconfigDeployment(this, "example", {
+      applicationId: Token.asString(awsAppconfigApplicationExample.id),
+      configurationProfileId: Token.asString(
+        awsAppconfigConfigurationProfileExample.configurationProfileId
+      ),
+      configurationVersion: Token.asString(
+        awsAppconfigHostedConfigurationVersionExample.versionNumber
+      ),
+      deploymentStrategyId: Token.asString(
+        awsAppconfigDeploymentStrategyExample.id
+      ),
+      description: "My example deployment",
+      environmentId: Token.asString(
+        awsAppconfigEnvironmentExample.environmentId
+      ),
+      tags: {
+        Type: "AppConfig Deployment",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `applicationId` - (Required, Forces new resource) Application ID. Must be between 4 and 7 characters in length.
+* `configurationProfileId` - (Required, Forces new resource) Configuration profile ID. Must be between 4 and 7 characters in length.
+* `configurationVersion` - (Required, Forces new resource) Configuration version to deploy. Can be at most 1024 characters.
+* `deploymentStrategyId` - (Required, Forces new resource) Deployment strategy ID or name of a predefined deployment strategy. See [Predefined Deployment Strategies](https://docs.aws.amazon.com/appconfig/latest/userguide/appconfig-creating-deployment-strategy.html#appconfig-creating-deployment-strategy-predefined) for more details.
+* `description` - (Optional, Forces new resource) Description of the deployment. Can be at most 1024 characters.
+* `environmentId` - (Required, Forces new resource) Environment ID. Must be between 4 and 7 characters in length.
+* `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - AppConfig application ID, environment ID, and deployment number separated by a slash (`/`).
+* `arn` - ARN of the AppConfig Deployment.
+* `deploymentNumber` - Deployment number.
+* `state` - State of the deployment.
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AppConfig Deployments using the application ID, environment ID, and deployment number separated by a slash (`/`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import AppConfig Deployments using the application ID, environment ID, and deployment number separated by a slash (`/`). For example:
+
+```console
+% terraform import aws_appconfig_deployment.example 71abcde/11xxxxx/1
+```
+
+<!-- cache-key: cdktf-0.18.0 input-39d098aa9ae0c1f1d4eeeee8bc2060587e9cc2e856acbf07eef391aa67bc2054 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/appconfig_deployment_strategy.html.markdown b/website/docs/cdktf/typescript/r/appconfig_deployment_strategy.html.markdown
new file mode 100644
index 00000000000..f9f9109ecd6
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/appconfig_deployment_strategy.html.markdown
@@ -0,0 +1,89 @@
+---
+subcategory: "AppConfig"
+layout: "aws"
+page_title: "AWS: aws_appconfig_deployment_strategy"
+description: |-
+  Provides an AppConfig Deployment Strategy resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_appconfig_deployment_strategy
+
+Provides an AppConfig Deployment Strategy resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AppconfigDeploymentStrategy } from "./.gen/providers/aws/appconfig-deployment-strategy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AppconfigDeploymentStrategy(this, "example", {
+      deploymentDurationInMinutes: 3,
+      description: "Example Deployment Strategy",
+      finalBakeTimeInMinutes: 4,
+      growthFactor: 10,
+      growthType: "LINEAR",
+      name: "example-deployment-strategy-tf",
+      replicateTo: "NONE",
+      tags: {
+        Type: "AppConfig Deployment Strategy",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `deploymentDurationInMinutes` - (Required) Total amount of time for a deployment to last. Minimum value of 0, maximum value of 1440.
+* `growthFactor` - (Required) Percentage of targets to receive a deployed configuration during each interval. Minimum value of 1.0, maximum value of 100.0.
+* `name` - (Required, Forces new resource) Name for the deployment strategy. Must be between 1 and 64 characters in length.
+* `replicateTo` - (Required, Forces new resource) Where to save the deployment strategy. Valid values: `none` and `ssmDocument`.
+* `description` - (Optional) Description of the deployment strategy. Can be at most 1024 characters.
+* `finalBakeTimeInMinutes` - (Optional) Amount of time AWS AppConfig monitors for alarms before considering the deployment to be complete and no longer eligible for automatic roll back. Minimum value of 0, maximum value of 1440.
+* `growthType` - (Optional) Algorithm used to define how percentage grows over time. Valid value: `linear` and `exponential`. Defaults to `linear`.
+* `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - AppConfig deployment strategy ID.
+* `arn` - ARN of the AppConfig Deployment Strategy.
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AppConfig Deployment Strategies using their deployment strategy ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import AppConfig Deployment Strategies using their deployment strategy ID. For example:
+
+```console
+% terraform import aws_appconfig_deployment_strategy.example 11xxxxx
+```
+
+<!-- cache-key: cdktf-0.18.0 input-5523efc97b4058c67f8184189e652c62466a4aef6fbcf077f1b0196ea0ec5624 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/appconfig_environment.html.markdown b/website/docs/cdktf/typescript/r/appconfig_environment.html.markdown
new file mode 100644
index 00000000000..62edfe78214
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/appconfig_environment.html.markdown
@@ -0,0 +1,112 @@
+---
+subcategory: "AppConfig"
+layout: "aws"
+page_title: "AWS: aws_appconfig_environment"
+description: |-
+  Provides an AppConfig Environment resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_appconfig_environment
+
+Provides an AppConfig Environment resource for an [`awsAppconfigApplication` resource](appconfig_application.html.markdown). One or more environments can be defined for an application.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AppconfigApplication } from "./.gen/providers/aws/appconfig-application";
+import { AppconfigEnvironment } from "./.gen/providers/aws/appconfig-environment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new AppconfigApplication(this, "example", {
+      description: "Example AppConfig Application",
+      name: "example-application-tf",
+      tags: {
+        Type: "AppConfig Application",
+      },
+    });
+    const awsAppconfigEnvironmentExample = new AppconfigEnvironment(
+      this,
+      "example_1",
+      {
+        applicationId: example.id,
+        description: "Example AppConfig Environment",
+        monitor: [
+          {
+            alarmArn: Token.asString(awsCloudwatchMetricAlarmExample.arn),
+            alarmRoleArn: Token.asString(awsIamRoleExample.arn),
+          },
+        ],
+        name: "example-environment-tf",
+        tags: {
+          Type: "AppConfig Environment",
+        },
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsAppconfigEnvironmentExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `applicationId` - (Required, Forces new resource) AppConfig application ID. Must be between 4 and 7 characters in length.
+* `name` - (Required) Name for the environment. Must be between 1 and 64 characters in length.
+* `description` - (Optional) Description of the environment. Can be at most 1024 characters.
+* `monitor` - (Optional) Set of Amazon CloudWatch alarms to monitor during the deployment process. Maximum of 5. See [Monitor](#monitor) below for more details.
+* `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Monitor
+
+The `monitor` block supports the following:
+
+* `alarmArn` - (Required) ARN of the Amazon CloudWatch alarm.
+* `alarmRoleArn` - (Optional) ARN of an IAM role for AWS AppConfig to monitor `alarmArn`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the AppConfig Environment.
+* `id` - (**Deprecated**) AppConfig environment ID and application ID separated by a colon (`:`).
+* `environmentId` - AppConfig environment ID.
+* `state` - State of the environment. Possible values are `readyForDeployment`, `deploying`, `rollingBack`
+  or `rolledBack`.
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AppConfig Environments using the environment ID and application ID separated by a colon (`:`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import AppConfig Environments using the environment ID and application ID separated by a colon (`:`). For example:
+
+```console
+% terraform import aws_appconfig_environment.example 71abcde:11xxxxx
+```
+
+<!-- cache-key: cdktf-0.18.0 input-fbf604e2e551d298f98ef374aae241f630d53aa562269a500dee31fdf26530c5 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/appconfig_extension.html.markdown b/website/docs/cdktf/typescript/r/appconfig_extension.html.markdown
new file mode 100644
index 00000000000..e2deb16ed82
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/appconfig_extension.html.markdown
@@ -0,0 +1,150 @@
+---
+subcategory: "AppConfig"
+layout: "aws"
+page_title: "AWS: aws_appconfig_extension"
+description: |-
+  Provides an AppConfig Extension resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_appconfig_extension
+
+Provides an AppConfig Extension resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AppconfigExtension } from "./.gen/providers/aws/appconfig-extension";
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+import { SnsTopic } from "./.gen/providers/aws/sns-topic";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const test = new SnsTopic(this, "test", {
+      name: "test",
+    });
+    const dataAwsIamPolicyDocumentTest = new DataAwsIamPolicyDocument(
+      this,
+      "test_1",
+      {
+        statement: [
+          {
+            actions: ["sts:AssumeRole"],
+            principals: [
+              {
+                identifiers: ["appconfig.amazonaws.com"],
+                type: "Service",
+              },
+            ],
+          },
+        ],
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsIamPolicyDocumentTest.overrideLogicalId("test");
+    const awsIamRoleTest = new IamRole(this, "test_2", {
+      assumeRolePolicy: Token.asString(dataAwsIamPolicyDocumentTest.json),
+      name: "test",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamRoleTest.overrideLogicalId("test");
+    const awsAppconfigExtensionTest = new AppconfigExtension(this, "test_3", {
+      actionPoint: [
+        {
+          action: [
+            {
+              name: "test",
+              roleArn: Token.asString(awsIamRoleTest.arn),
+              uri: test.arn,
+            },
+          ],
+          point: "ON_DEPLOYMENT_COMPLETE",
+        },
+      ],
+      description: "test description",
+      name: "test",
+      tags: {
+        Type: "AppConfig Extension",
+      },
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsAppconfigExtensionTest.overrideLogicalId("test");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) A name for the extension. Each extension name in your account must be unique. Extension versions use the same name.
+* `description` - (Optional) Information about the extension.
+* `actionPoint` - (Required) The action points defined in the extension. [Detailed below](#action_point).
+* `parameter` - (Optional) The parameters accepted by the extension. You specify parameter values when you associate the extension to an AppConfig resource by using the CreateExtensionAssociation API action. For Lambda extension actions, these parameters are included in the Lambda request object. [Detailed below](#parameter).
+* `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### `actionPoint`
+
+Defines the actions the extension performs during the AppConfig workflow and at which point those actions are performed. The `actionPoint` configuration block supports the following arguments:
+
+* `point` - (Required) The point at which to perform the defined actions. Valid points are `preCreateHostedConfigurationVersion`, `preStartDeployment`, `onDeploymentStart`, `onDeploymentStep`, `onDeploymentBaking`, `onDeploymentComplete`, `onDeploymentRolledBack`.
+* `action` - (Required) An action defines the tasks the extension performs during the AppConfig workflow. [Detailed below](#action).
+
+#### `action`
+
+The `action` configuration block supports configuring any number of the following arguments:
+
+* `name` - (Required) The action name.
+* `roleArn` - (Required) An Amazon Resource Name (ARN) for an Identity and Access Management assume role.
+* `uri` - (Required) The extension URI associated to the action point in the extension definition. The URI can be an Amazon Resource Name (ARN) for one of the following: an Lambda function, an Amazon Simple Queue Service queue, an Amazon Simple Notification Service topic, or the Amazon EventBridge default event bus.
+* `description` - (Optional) Information about the action.
+
+#### `parameter`
+
+The `parameter` configuration block supports configuring any number of the following arguments:
+
+* `name` - (Required) The parameter name.
+* `required` - (Required) Determines if a parameter value must be specified in the extension association.
+* `description` - (Optional) Information about the parameter.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the AppConfig Extension.
+* `id` - AppConfig Extension ID.
+* `version` - The version number for the extension.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AppConfig Extensions using their extension ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import AppConfig Extensions using their extension ID. For example:
+
+```console
+% terraform import aws_appconfig_extension.example 71rxuzt
+```
+
+<!-- cache-key: cdktf-0.18.0 input-a57e9661c333d971fc98cbdd2a1d95de7a9014d90bd4fdbf0d526c04df1b2f9d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/appconfig_extension_association.html.markdown b/website/docs/cdktf/typescript/r/appconfig_extension_association.html.markdown
new file mode 100644
index 00000000000..0a247b3bede
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/appconfig_extension_association.html.markdown
@@ -0,0 +1,138 @@
+---
+subcategory: "AppConfig"
+layout: "aws"
+page_title: "AWS: aws_appconfig_extension_association"
+description: |-
+  Associates an AppConfig Extension with a Resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_appconfig_extension_association
+
+Associates an AppConfig Extension with a Resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AppconfigApplication } from "./.gen/providers/aws/appconfig-application";
+import { AppconfigExtension } from "./.gen/providers/aws/appconfig-extension";
+import { AppconfigExtensionAssociation } from "./.gen/providers/aws/appconfig-extension-association";
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+import { SnsTopic } from "./.gen/providers/aws/sns-topic";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const test = new AppconfigApplication(this, "test", {
+      name: "test",
+    });
+    const awsSnsTopicTest = new SnsTopic(this, "test_1", {
+      name: "test",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSnsTopicTest.overrideLogicalId("test");
+    const dataAwsIamPolicyDocumentTest = new DataAwsIamPolicyDocument(
+      this,
+      "test_2",
+      {
+        statement: [
+          {
+            actions: ["sts:AssumeRole"],
+            principals: [
+              {
+                identifiers: ["appconfig.amazonaws.com"],
+                type: "Service",
+              },
+            ],
+          },
+        ],
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsIamPolicyDocumentTest.overrideLogicalId("test");
+    const awsIamRoleTest = new IamRole(this, "test_3", {
+      assumeRolePolicy: Token.asString(dataAwsIamPolicyDocumentTest.json),
+      name: "test",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamRoleTest.overrideLogicalId("test");
+    const awsAppconfigExtensionTest = new AppconfigExtension(this, "test_4", {
+      actionPoint: [
+        {
+          action: [
+            {
+              name: "test",
+              roleArn: Token.asString(awsIamRoleTest.arn),
+              uri: Token.asString(awsSnsTopicTest.arn),
+            },
+          ],
+          point: "ON_DEPLOYMENT_COMPLETE",
+        },
+      ],
+      description: "test description",
+      name: "test",
+      tags: {
+        Type: "AppConfig Extension",
+      },
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsAppconfigExtensionTest.overrideLogicalId("test");
+    const awsAppconfigExtensionAssociationTest =
+      new AppconfigExtensionAssociation(this, "test_5", {
+        extensionArn: Token.asString(awsAppconfigExtensionTest.arn),
+        resourceArn: test.arn,
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsAppconfigExtensionAssociationTest.overrideLogicalId("test");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `extensionArn` - (Required) The ARN of the extension defined in the association.
+* `resourceArn` - (Optional) The ARN of the application, configuration profile, or environment to associate with the extension.
+* `parameters` - (Optional) The parameter names and values defined for the association.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the AppConfig Extension Association.
+* `id` - AppConfig Extension Association ID.
+* `extensionVersion` - The version number for the extension defined in the association.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AppConfig Extension Associations using their extension association ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import AppConfig Extension Associations using their extension association ID. For example:
+
+```console
+% terraform import aws_appconfig_extension_association.example 71rxuzt
+```
+
+<!-- cache-key: cdktf-0.18.0 input-17365f1464d46d38d1dcf2819aa51132f201f9fd4618e6d0e60185e1fad561f2 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/appconfig_hosted_configuration_version.html.markdown b/website/docs/cdktf/typescript/r/appconfig_hosted_configuration_version.html.markdown
new file mode 100644
index 00000000000..29bbe93c7aa
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/appconfig_hosted_configuration_version.html.markdown
@@ -0,0 +1,158 @@
+---
+subcategory: "AppConfig"
+layout: "aws"
+page_title: "AWS: aws_appconfig_hosted_configuration_version"
+description: |-
+  Provides an AppConfig Hosted Configuration Version resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_appconfig_hosted_configuration_version
+
+Provides an AppConfig Hosted Configuration Version resource.
+
+## Example Usage
+
+### Freeform
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, Fn, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AppconfigHostedConfigurationVersion } from "./.gen/providers/aws/appconfig-hosted-configuration-version";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AppconfigHostedConfigurationVersion(this, "example", {
+      applicationId: Token.asString(awsAppconfigApplicationExample.id),
+      configurationProfileId: Token.asString(
+        awsAppconfigConfigurationProfileExample.configurationProfileId
+      ),
+      content: Token.asString(
+        Fn.jsonencode({
+          foo: "bar",
+          fruit: ["apple", "pear", "orange"],
+          isThingEnabled: true,
+        })
+      ),
+      contentType: "application/json",
+      description: "Example Freeform Hosted Configuration Version",
+    });
+  }
+}
+
+```
+
+### Feature Flags
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, Fn, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AppconfigHostedConfigurationVersion } from "./.gen/providers/aws/appconfig-hosted-configuration-version";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AppconfigHostedConfigurationVersion(this, "example", {
+      applicationId: Token.asString(awsAppconfigApplicationExample.id),
+      configurationProfileId: Token.asString(
+        awsAppconfigConfigurationProfileExample.configurationProfileId
+      ),
+      content: Token.asString(
+        Fn.jsonencode({
+          flags: {
+            bar: {
+              attributes: {
+                someAttribute: {
+                  constraints: {
+                    required: true,
+                    type: "string",
+                  },
+                },
+                someOtherAttribute: {
+                  constraints: {
+                    required: true,
+                    type: "number",
+                  },
+                },
+              },
+              name: "bar",
+            },
+            foo: {
+              _deprecation: {
+                status: "planned",
+              },
+              name: "foo",
+            },
+          },
+          values: {
+            bar: {
+              enabled: "true",
+              someAttribute: "Hello World",
+              someOtherAttribute: 123,
+            },
+            foo: {
+              enabled: "true",
+            },
+          },
+          version: "1",
+        })
+      ),
+      contentType: "application/json",
+      description: "Example Feature Flag Configuration Version",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `applicationId` - (Required, Forces new resource) Application ID.
+* `configurationProfileId` - (Required, Forces new resource) Configuration profile ID.
+* `content` - (Required, Forces new resource) Content of the configuration or the configuration data.
+* `contentType` - (Required, Forces new resource) Standard MIME type describing the format of the configuration content. For more information, see [Content-Type](https://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.17).
+* `description` - (Optional, Forces new resource) Description of the configuration.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the AppConfig  hosted configuration version.
+* `id` - AppConfig application ID, configuration profile ID, and version number separated by a slash (`/`).
+* `versionNumber` - Version number of the hosted configuration.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AppConfig Hosted Configuration Versions using the application ID, configuration profile ID, and version number separated by a slash (`/`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import AppConfig Hosted Configuration Versions using the application ID, configuration profile ID, and version number separated by a slash (`/`). For example:
+
+```console
+% terraform import aws_appconfig_hosted_configuration_version.example 71abcde/11xxxxx/2
+```
+
+<!-- cache-key: cdktf-0.18.0 input-a6ff65d582f450abdbc1195a62bdb811f1120a5973cdab88491b53812cadd935 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/appflow_connector_profile.html.markdown b/website/docs/cdktf/typescript/r/appflow_connector_profile.html.markdown
new file mode 100644
index 00000000000..1844f024b6e
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/appflow_connector_profile.html.markdown
@@ -0,0 +1,380 @@
+---
+subcategory: "AppFlow"
+layout: "aws"
+page_title: "AWS: aws_appflow_connector_profile"
+description: |-
+  Provides an AppFlow Connector Profile resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_appflow_connector_profile
+
+Provides an AppFlow connector profile resource.
+
+For information about AppFlow flows, see the [Amazon AppFlow API Reference][1].
+For specific information about creating an AppFlow connector profile, see the
+[CreateConnectorProfile][2] page in the Amazon AppFlow API Reference.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AppflowConnectorProfile } from "./.gen/providers/aws/appflow-connector-profile";
+import { DataAwsIamPolicy } from "./.gen/providers/aws/data-aws-iam-policy";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+import { RedshiftCluster } from "./.gen/providers/aws/redshift-cluster";
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new IamRole(this, "example", {
+      assumeRolePolicy: Token.asString(
+        Fn.jsonencode({
+          Statement: [
+            {
+              Action: "sts:AssumeRole",
+              Effect: "Allow",
+              Principal: {
+                Service: "ec2.amazonaws.com",
+              },
+              Sid: "",
+            },
+          ],
+          Version: "2012-10-17",
+        })
+      ),
+      managedPolicyArns: [Token.asString(test.arn)],
+      name: "example_role",
+    });
+    const awsRedshiftClusterExample = new RedshiftCluster(this, "example_1", {
+      clusterIdentifier: "example_cluster",
+      clusterType: "single-node",
+      databaseName: "example_db",
+      masterPassword: "examplePassword123!",
+      masterUsername: "exampleuser",
+      nodeType: "dc1.large",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsRedshiftClusterExample.overrideLogicalId("example");
+    const awsS3BucketExample = new S3Bucket(this, "example_2", {
+      bucket: "example_bucket",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketExample.overrideLogicalId("example");
+    const dataAwsIamPolicyExample = new DataAwsIamPolicy(this, "example_3", {
+      name: "AmazonRedshiftAllCommandsFullAccess",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsIamPolicyExample.overrideLogicalId("example");
+    const awsAppflowConnectorProfileExample = new AppflowConnectorProfile(
+      this,
+      "example_4",
+      {
+        connectionMode: "Public",
+        connectorProfileConfig: {
+          connectorProfileCredentials: {
+            redshift: {
+              password: Token.asString(
+                awsRedshiftClusterExample.masterPassword
+              ),
+              username: Token.asString(
+                awsRedshiftClusterExample.masterUsername
+              ),
+            },
+          },
+          connectorProfileProperties: {
+            redshift: {
+              bucketName: Token.asString(awsS3BucketExample.name),
+              databaseUrl:
+                "jdbc:redshift://${" +
+                awsRedshiftClusterExample.endpoint +
+                "}/${" +
+                awsRedshiftClusterExample.databaseName +
+                "}",
+              roleArn: example.arn,
+            },
+          },
+        },
+        connectorType: "Redshift",
+        name: "example_profile",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsAppflowConnectorProfileExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+The AppFlow connector profile argument layout is a complex structure. The following top-level arguments are supports:
+
+* `name ` (Required) - Name of the connector profile. The name is unique for each `connectorProfile` in your AWS account.
+* `connectionMode` (Required) - Indicates the connection mode and specifies whether it is public or private. Private flows use AWS PrivateLink to route data over AWS infrastructure without exposing it to the public internet. One of: `public`, `private`.
+* `connectorLabel` (Optional) - The label of the connector. The label is unique for each ConnectorRegistration in your AWS account. Only needed if calling for `customConnector` connector type.
+* `connectorProfileConfig` (Required) - Defines the connector-specific configuration and credentials. See [Connector Profile Config](#connector-profile-config) for more details.
+* `connectorType` (Required) - The type of connector. One of: `amplitude`, `customConnector`, `customerProfiles`, `datadog`, `dynatrace`, `eventBridge`, `googleanalytics`, `honeycode`, `infornexus`, `lookoutMetrics`, `marketo`, `redshift`, `s3`, `salesforce`, `sapoData`, `servicenow`, `singular`, `slack`, `snowflake`, `trendmicro`, `upsolver`, `veeva`, `zendesk`.
+* `kmsArn` (Optional) - ARN (Amazon Resource Name) of the Key Management Service (KMS) key you provide for encryption. This is required if you do not want to use the Amazon AppFlow-managed KMS key. If you don't provide anything here, Amazon AppFlow uses the Amazon AppFlow-managed KMS key.
+
+### Connector Profile Config
+
+* `connectorProfileCredentials` (Required) - The connector-specific credentials required by each connector. See [Connector Profile Credentials](#connector-profile-credentials) for more details.
+* `connectorProfileProperties` (Required) - The connector-specific properties of the profile configuration. See [Connector Profile Properties](#connector-profile-properties) for more details.
+
+### Connector Profile Credentials
+
+* `amplitude` (Optional) - The connector-specific credentials required when using Amplitude. See [Amplitude Connector Profile Credentials](#amplitude-connector-profile-credentials) for more details.
+* `customConnector` (Optional) - The connector-specific profile credentials required when using the custom connector. See [Custom Connector Profile Credentials](#custom-connector-profile-credentials) for more details.
+* `datadog` (Optional) - Connector-specific credentials required when using Datadog. See [Datadog Connector Profile Credentials](#datadog-connector-profile-credentials) for more details.
+* `dynatrace` (Optional) - The connector-specific credentials required when using Dynatrace. See [Dynatrace Connector Profile Credentials](#dynatrace-connector-profile-credentials) for more details.
+* `googleAnalytics` (Optional) - The connector-specific credentials required when using Google Analytics. See [Google Analytics Connector Profile Credentials](#google-analytics-connector-profile-credentials) for more details.
+* `honeycode` (Optional) - The connector-specific credentials required when using Amazon Honeycode. See [Honeycode Connector Profile Credentials](#honeycode-connector-profile-credentials) for more details.
+* `inforNexus` (Optional) - The connector-specific credentials required when using Infor Nexus. See [Infor Nexus Connector Profile Credentials](#infor-nexus-connector-profile-credentials) for more details.
+* `marketo` (Optional) - Connector-specific credentials required when using Marketo. See [Marketo Connector Profile Credentials](#marketo-connector-profile-credentials) for more details.
+* `redshift` (Optional) - Connector-specific credentials required when using Amazon Redshift. See [Redshift Connector Profile Credentials](#redshift-connector-profile-credentials) for more details.
+* `salesforce` (Optional) - The connector-specific credentials required when using Salesforce. See [Salesforce Connector Profile Credentials](#salesforce-connector-profile-credentials) for more details.
+* `sapoData` (Optional) - The connector-specific credentials required when using SAPOData. See [SAPOData Connector Profile Credentials](#sapodata-connector-profile-credentials) for more details.
+* `serviceNow` (Optional) - The connector-specific credentials required when using ServiceNow. See [ServiceNow Connector Profile Credentials](#servicenow-connector-profile-credentials) for more details.
+* `singular` (Optional) - Connector-specific credentials required when using Singular. See [Singular Connector Profile Credentials](#singular-connector-profile-credentials) for more details.
+* `slack` (Optional) - Connector-specific credentials required when using Slack. See [Slack Connector Profile Credentials](#amplitude-connector-profile-credentials) for more details.
+* `snowflake` (Optional) - The connector-specific credentials required when using Snowflake. See [Snowflake Connector Profile Credentials](#snowflake-connector-profile-credentials) for more details.
+* `trendmicro` (Optional) - The connector-specific credentials required when using Trend Micro. See [Trend Micro Connector Profile Credentials](#trendmicro-connector-profile-credentials) for more details.
+* `veeva` (Optional) - Connector-specific credentials required when using Veeva. See [Veeva Connector Profile Credentials](#veeva-connector-profile-credentials) for more details.
+* `zendesk` (Optional) - Connector-specific credentials required when using Zendesk. See [Zendesk Connector Profile Credentials](#zendesk-connector-profile-credentials) for more details.
+
+#### Amplitude Connector Profile Credentials
+
+* `apiKey` (Required) - Unique alphanumeric identifier used to authenticate a user, developer, or calling program to your API.
+* `secretKey` (Required) - The Secret Access Key portion of the credentials.
+
+#### Custom Connector Profile Credentials
+
+* `apiKey` (Optional) - API keys required for the authentication of the user.
+    * `apiKey` (Required) - The API key required for API key authentication.
+    * `apiSecretKey` (Optional) - The API secret key required for API key authentication.
+* `authenticationType` (Required) - The authentication type that the custom connector uses for authenticating while creating a connector profile. One of: `apikey`, `basic`, `custom`, `oauth2`.
+* `basic` (Optional) - Basic credentials that are required for the authentication of the user.
+    * `password` (Required) - The password to use to connect to a resource.
+    * `username` (Required) - The username to use to connect to a resource.
+* `custom` (Optional) - If the connector uses the custom authentication mechanism, this holds the required credentials.
+    * `credentialsMap` (Optional) - A map that holds custom authentication credentials.
+    * `customAuthenticationType` (Required) - The custom authentication type that the connector uses.
+* `oauth2` (Optional) - OAuth 2.0 credentials required for the authentication of the user.
+    * `accessToken` (Optional) - The access token used to access the connector on your behalf.
+    * `clientId` (Optional) - The identifier for the desired client.
+    * `clientSecret` (Optional) - The client secret used by the OAuth client to authenticate to the authorization server.
+    * `oauthRequest` (Optional) - Used by select connectors for which the OAuth workflow is supported. See [OAuth Request](#oauth-request) for more details.
+    * `refreshToken` (Optional) - The refresh token used to refresh an expired access token.
+
+#### Datadog Connector Profile Credentials
+
+* `apiKey` (Required) - Unique alphanumeric identifier used to authenticate a user, developer, or calling program to your API.
+* `applicationKey` (Required) - Application keys, in conjunction with your API key, give you full access to Datadog’s programmatic API. Application keys are associated with the user account that created them. The application key is used to log all requests made to the API.
+
+#### Dynatrace Connector Profile Credentials
+
+* `apiToken` (Required) - The API tokens used by Dynatrace API to authenticate various API calls.
+
+#### Google Analytics Connector Profile Credentials
+
+* `accessToken` (Optional) - The credentials used to access protected Google Analytics resources.
+* `clientId` (Required) - The identifier for the desired client.
+* `clientSecret` (Required) - The client secret used by the OAuth client to authenticate to the authorization server.
+* `oauthRequest` (Optional) - The OAuth requirement needed to request security tokens from the connector endpoint. See [OAuth Request](#oauth-request) for more details.
+* `refreshToken` (Optional) - The credentials used to acquire new access tokens. This is required only for OAuth2 access tokens, and is not required for OAuth1 access tokens.
+
+#### Honeycode Connector Profile Credentials
+
+* `accessToken` (Optional) - The credentials used to access protected Amazon Honeycode resources.
+* `oauthRequest` (Optional) - Used by select connectors for which the OAuth workflow is supported, such as Salesforce, Google Analytics, Marketo, Zendesk, and Slack. See [OAuth Request](#oauth-request) for more details.
+* `refreshToken` (Optional) - The credentials used to acquire new access tokens.
+
+#### Infor Nexus Connector Profile Credentials
+
+* `accessKeyId` (Required) - The Access Key portion of the credentials.
+* `datakey` (Required) - Encryption keys used to encrypt data.
+* `secretAccessKey` (Required) - The secret key used to sign requests.
+* `userId` (Required) - Identifier for the user.
+
+#### Marketo Connector Profile Credentials
+
+* `accessToken` (Optional) - The credentials used to access protected Marketo resources.
+* `clientId` (Required) - The identifier for the desired client.
+* `clientSecret` (Required) - The client secret used by the OAuth client to authenticate to the authorization server.
+* `oauthRequest` (Optional) - The OAuth requirement needed to request security tokens from the connector endpoint. See [OAuth Request](#oauth-request) for more details.
+
+#### Redshift Connector Profile Credentials
+
+* `password` (Required) - Password that corresponds to the user name.
+* `username` (Required) - Name of the user.
+
+#### Salesforce Connector Profile Credentials
+
+* `accessToken` (Optional) - The credentials used to access protected Salesforce resources.
+* `clientCredentialsArn` (Optional) - The secret manager ARN, which contains the client ID and client secret of the connected app.
+* `oauthRequest` (Optional) - The OAuth requirement needed to request security tokens from the connector endpoint. See [OAuth Request](#oauth-request) for more details.
+* `refreshToken` (Optional) - The credentials used to acquire new access tokens.
+
+#### SAPOData Connector Profile Credentials
+
+* `basicAuthCredentials` (Optional) - The SAPOData basic authentication credentials.
+    * `password` (Required) - The password to use to connect to a resource.
+    * `username` (Required) - The username to use to connect to a resource.
+* `oauthCredentials` (Optional) - The SAPOData OAuth type authentication credentials.
+    * `accessToken` (Optional) - The access token used to access protected SAPOData resources.
+    * `clientId` (Required) - The identifier for the desired client.
+    * `clientSecret` (Required) -  The client secret used by the OAuth client to authenticate to the authorization server.
+    * `oauthRequest` (Optional) - The OAuth requirement needed to request security tokens from the connector endpoint. See [OAuth Request](#oauth-request) for more details.
+    * `refreshToken` (Optional) - The refresh token used to refresh expired access token.
+
+#### ServiceNow Connector Profile Credentials
+
+* `password` (Required) - Password that corresponds to the user name.
+* `username` (Required) - Name of the user.
+
+#### Singular Connector Profile Credentials
+
+* `apiKey` (Required) - Unique alphanumeric identifier used to authenticate a user, developer, or calling program to your API.
+
+#### Slack Connector Profile Credentials
+
+* `accessToken` (Optional) - The credentials used to access protected Slack resources.
+* `clientId` (Required) - The identifier for the client.
+* `clientSecret` (Required) - The client secret used by the OAuth client to authenticate to the authorization server.
+* `oauthRequest` (Optional) - The OAuth requirement needed to request security tokens from the connector endpoint. See [OAuth Request](#oauth-request) for more details.
+
+#### Snowflake Connector Profile Credentials
+
+* `password` (Required) - Password that corresponds to the user name.
+* `username` (Required) - Name of the user.
+
+#### Trendmicro Connector Profile Credentials
+
+* `apiSecretKey` (Required) - The Secret Access Key portion of the credentials.
+
+#### Veeva Connector Profile Credentials
+
+* `password` (Required) - Password that corresponds to the user name.
+* `username` (Required) - Name of the user.
+
+#### Zendesk Connector Profile Credentials
+
+* `accessToken` (Optional) - The credentials used to access protected Zendesk resources.
+* `clientId` (Required) - The identifier for the desired client.
+* `clientSecret` (Required) - The client secret used by the OAuth client to authenticate to the authorization server.
+* `oauthRequest` (Optional) - The OAuth requirement needed to request security tokens from the connector endpoint. See [OAuth Request](#oauth-request) for more details.
+
+##### OAuth Request
+
+* `authCode` (Optional) - The code provided by the connector when it has been authenticated via the connected app.
+* `redirectUri` (Optional) - The URL to which the authentication server redirects the browser after authorization has been granted.
+
+### Connector Profile Properties
+
+* `customConnector` (Optional) - The connector-specific profile properties required when using the custom connector. See [Custom Connector Profile Properties](#custom-connector-profile-properties) for more details.
+* `datadog` (Optional) - Connector-specific properties required when using Datadog. See [Generic Connector Profile Properties](#generic-connector-profile-properties) for more details.
+* `dynatrace` (Optional) - The connector-specific properties required when using Dynatrace. See [Generic Connector Profile Properties](#generic-connector-profile-properties) for more details.
+* `inforNexus` (Optional) - The connector-specific properties required when using Infor Nexus. See [Generic Connector Profile Properties](#generic-connector-profile-properties) for more details.
+* `marketo` (Optional) - Connector-specific properties required when using Marketo. See [Generic Connector Profile Properties](#generic-connector-profile-properties) for more details.
+* `redshift` (Optional) - Connector-specific properties required when using Amazon Redshift. See [Redshift Connector Profile Properties](#redshift-connector-profile-properties) for more details.
+* `salesforce` (Optional) - The connector-specific properties required when using Salesforce. See [Salesforce Connector Profile Properties](#salesforce-connector-profile-properties) for more details.
+* `sapoData` (Optional) - The connector-specific properties required when using SAPOData. See [SAPOData Connector Profile Properties](#sapodata-connector-profile-properties) for more details.
+* `serviceNow` (Optional) - The connector-specific properties required when using ServiceNow. See [Generic Connector Profile Properties](#generic-connector-profile-properties) for more details.
+* `slack` (Optional) - Connector-specific properties required when using Slack. See [Generic Connector Profile Properties](#generic-connector-profile-properties) for more details.
+* `snowflake` (Optional) - The connector-specific properties required when using Snowflake. See [Snowflake Connector Profile Properties](#snowflake-connector-profile-properties) for more details.
+* `veeva` (Optional) - Connector-specific properties required when using Veeva. See [Generic Connector Profile Properties](#generic-connector-profile-properties) for more details.
+* `zendesk` (Optional) - Connector-specific properties required when using Zendesk. See [Generic Connector Profile Properties](#generic-connector-profile-properties) for more details.
+
+#### Custom Connector Profile Properties
+
+* `oauth2Properties` (Optional) - The OAuth 2.0 properties required for OAuth 2.0 authentication.
+    * `oauth2GrantType` (Required) - The OAuth 2.0 grant type used by connector for OAuth 2.0 authentication. One of: `authorizationCode`, `clientCredentials`.
+    * `tokenUrl` (Required) - The token URL required for OAuth 2.0 authentication.
+    * `tokenUrlCustomProperties` (Optional) - Associates your token URL with a map of properties that you define. Use this parameter to provide any additional details that the connector requires to authenticate your request.
+* `profileProperties` (Optional) - A map of properties that are required to create a profile for the custom connector.
+
+#### Generic Connector Profile Properties
+
+Datadog, Dynatrace, Infor Nexus, Marketo, ServiceNow, Slack, Veeva, and Zendesk all support the following attributes:
+
+* `instanceUrl` (Required) - The location of the Datadog resource.
+
+#### Redshift Connector Profile Properties
+
+* `bucketName` (Required) - A name for the associated Amazon S3 bucket.
+* `bucketPrefix` (Optional) - The object key for the destination bucket in which Amazon AppFlow places the files.
+* `clusterIdentifier` (Optional) - The unique ID that's assigned to an Amazon Redshift cluster.
+* `databaseName` (Optional) - The name of an Amazon Redshift database.
+* `databaseUrl` (Required) - The JDBC URL of the Amazon Redshift cluster.
+* `dataApiRoleArn` (Optional) - ARN of the IAM role that permits AppFlow to access the database through Data API.
+* `roleArn` (Required) - ARN of the IAM role.
+
+#### Salesforce Connector Profile Properties
+
+* `instanceUrl` (Optional) - The location of the Salesforce resource.
+* `isSandboxEnvironment` (Optional) - Indicates whether the connector profile applies to a sandbox or production environment.
+
+#### SAPOData Connector Profile Properties
+
+* `applicationHostUrl` (Required) - The location of the SAPOData resource.
+* `applicationServicePath` (Required) - The application path to catalog service.
+* `clientNumber` (Required) - The client number for the client creating the connection.
+* `logonLanguage` (Optional) - The logon language of SAPOData instance.
+* `oauthProperties` (Optional) - The SAPOData OAuth properties required for OAuth type authentication.
+    * `authCodeUrl` (Required) - The authorization code url required to redirect to SAP Login Page to fetch authorization code for OAuth type authentication.
+    * `oauthScopes` (Required) - The OAuth scopes required for OAuth type authentication.
+    * `tokenUrl` (Required) - The token url required to fetch access/refresh tokens using authorization code and also to refresh expired access token using refresh token.
+* `portNumber` (Required) - The port number of the SAPOData instance.
+* `privateLinkServiceName` (Optional) - The SAPOData Private Link service name to be used for private data transfers.
+
+#### Snowflake Connector Profile Properties
+
+* `accountName` (Optional) - The name of the account.
+* `bucketName` (Required) - The name of the Amazon S3 bucket associated with Snowflake.
+* `bucketPrefix` (Optional) - The bucket path that refers to the Amazon S3 bucket associated with Snowflake.
+* `privateLinkServiceName` (Optional) - The Snowflake Private Link service name to be used for private data transfers.
+* `region` (Optional) - AWS Region of the Snowflake account.
+* `stage` (Required) - Name of the Amazon S3 stage that was created while setting up an Amazon S3 stage in the Snowflake account. This is written in the following format: `<Database>.<Schema>.<Stage Name>`.
+* `warehouse` (Required) - The name of the Snowflake warehouse.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the connector profile.
+* `credentialsArn` - ARN of the connector profile credentials.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AppFlow Connector Profile using the connector profile `arn`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import AppFlow Connector Profile using the connector profile `arn`. For example:
+
+```console
+% terraform import aws_appflow_connector_profile.profile arn:aws:appflow:us-west-2:123456789012:connectorprofile/example-profile
+```
+
+[1]: https://docs.aws.amazon.com/appflow/1.0/APIReference/Welcome.html
+[2]: https://docs.aws.amazon.com/appflow/1.0/APIReference/API_CreateConnectorProfile.html
+
+<!-- cache-key: cdktf-0.18.0 input-12a8438ef29150aa2860f41042c61347e6053f7bc63636fa7e0e39ab0a9c445b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/appflow_flow.html.markdown b/website/docs/cdktf/typescript/r/appflow_flow.html.markdown
new file mode 100644
index 00000000000..e498964bbe9
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/appflow_flow.html.markdown
@@ -0,0 +1,489 @@
+---
+subcategory: "AppFlow"
+layout: "aws"
+page_title: "AWS: aws_appflow_flow"
+description: |-
+  Provides an AppFlow Flow resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_appflow_flow
+
+Provides an AppFlow flow resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AppflowFlow } from "./.gen/providers/aws/appflow-flow";
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketPolicy } from "./.gen/providers/aws/s3-bucket-policy";
+import { S3Object } from "./.gen/providers/aws/s3-object";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const exampleDestination = new S3Bucket(this, "example_destination", {
+      bucket: "example-destination",
+    });
+    const exampleSource = new S3Bucket(this, "example_source", {
+      bucket: "example-source",
+    });
+    new S3Object(this, "example", {
+      bucket: exampleSource.id,
+      key: "example_source.csv",
+      source: "example_source.csv",
+    });
+    const dataAwsIamPolicyDocumentExampleDestination =
+      new DataAwsIamPolicyDocument(this, "example_destination_3", {
+        statement: [
+          {
+            actions: [
+              "s3:PutObject",
+              "s3:AbortMultipartUpload",
+              "s3:ListMultipartUploadParts",
+              "s3:ListBucketMultipartUploads",
+              "s3:GetBucketAcl",
+              "s3:PutObjectAcl",
+            ],
+            effect: "Allow",
+            principals: [
+              {
+                identifiers: ["appflow.amazonaws.com"],
+                type: "Service",
+              },
+            ],
+            resources: [
+              "arn:aws:s3:::example_destination",
+              "arn:aws:s3:::example_destination/*",
+            ],
+            sid: "AllowAppFlowDestinationActions",
+          },
+        ],
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsIamPolicyDocumentExampleDestination.overrideLogicalId(
+      "example_destination"
+    );
+    const dataAwsIamPolicyDocumentExampleSource = new DataAwsIamPolicyDocument(
+      this,
+      "example_source_4",
+      {
+        statement: [
+          {
+            actions: ["s3:ListBucket", "s3:GetObject"],
+            effect: "Allow",
+            principals: [
+              {
+                identifiers: ["appflow.amazonaws.com"],
+                type: "Service",
+              },
+            ],
+            resources: [
+              "arn:aws:s3:::example_source",
+              "arn:aws:s3:::example_source/*",
+            ],
+            sid: "AllowAppFlowSourceActions",
+          },
+        ],
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsIamPolicyDocumentExampleSource.overrideLogicalId("example_source");
+    const awsS3BucketPolicyExampleDestination = new S3BucketPolicy(
+      this,
+      "example_destination_5",
+      {
+        bucket: exampleDestination.id,
+        policy: Token.asString(dataAwsIamPolicyDocumentExampleDestination.json),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketPolicyExampleDestination.overrideLogicalId(
+      "example_destination"
+    );
+    const awsS3BucketPolicyExampleSource = new S3BucketPolicy(
+      this,
+      "example_source_6",
+      {
+        bucket: exampleSource.id,
+        policy: Token.asString(dataAwsIamPolicyDocumentExampleSource.json),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketPolicyExampleSource.overrideLogicalId("example_source");
+    const awsAppflowFlowExample = new AppflowFlow(this, "example_7", {
+      destinationFlowConfig: [
+        {
+          connectorType: "S3",
+          destinationConnectorProperties: {
+            s3: {
+              bucketName: Token.asString(
+                awsS3BucketPolicyExampleDestination.bucket
+              ),
+              s3OutputFormatConfig: {
+                prefixConfig: {
+                  prefixType: "PATH",
+                },
+              },
+            },
+          },
+        },
+      ],
+      name: "example",
+      sourceFlowConfig: {
+        connectorType: "S3",
+        sourceConnectorProperties: {
+          s3: {
+            bucketName: Token.asString(awsS3BucketPolicyExampleSource.bucket),
+            bucketPrefix: "example",
+          },
+        },
+      },
+      task: [
+        {
+          connectorOperator: [
+            {
+              s3: "NO_OP",
+            },
+          ],
+          destinationField: "exampleField",
+          sourceFields: ["exampleField"],
+          taskType: "Map",
+        },
+      ],
+      triggerConfig: {
+        triggerType: "OnDemand",
+      },
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsAppflowFlowExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) Name of the flow.
+* `destinationFlowConfig` - (Required) A [Destination Flow Config](#destination-flow-config) that controls how Amazon AppFlow places data in the destination connector.
+* `sourceFlowConfig` - (Required) The [Source Flow Config](#source-flow-config) that controls how Amazon AppFlow retrieves data from the source connector.
+* `task` - (Required) A [Task](#task) that Amazon AppFlow performs while transferring the data in the flow run.
+* `triggerConfig` - (Required) A [Trigger](#trigger-config) that determine how and when the flow runs.
+* `description` - (Optional) Description of the flow you want to create.
+* `kmsArn` - (Optional) ARN (Amazon Resource Name) of the Key Management Service (KMS) key you provide for encryption. This is required if you do not want to use the Amazon AppFlow-managed KMS key. If you don't provide anything here, Amazon AppFlow uses the Amazon AppFlow-managed KMS key.
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+### Destination Flow Config
+
+* `connectorType` - (Required) Type of connector, such as Salesforce, Amplitude, and so on. Valid values are `salesforce`, `singular`, `slack`, `redshift`, `s3`, `marketo`, `googleanalytics`, `zendesk`, `servicenow`, `datadog`, `trendmicro`, `snowflake`, `dynatrace`, `infornexus`, `amplitude`, `veeva`, `eventBridge`, `lookoutMetrics`, `upsolver`, `honeycode`, `customerProfiles`, `sapoData`, and `customConnector`.
+* `destinationConnectorProperties` - (Required) This stores the information that is required to query a particular connector. See [Destination Connector Properties](#destination-connector-properties) for more information.
+* `apiVersion` - (Optional) API version that the destination connector uses.
+* `connectorProfileName` - (Optional) Name of the connector profile. This name must be unique for each connector profile in the AWS account.
+
+#### Destination Connector Properties
+
+* `customConnector` - (Optional) Properties that are required to query the custom Connector. See [Custom Connector Destination Properties](#custom-connector-destination-properties) for more details.
+* `customerProfiles` - (Optional) Properties that are required to query Amazon Connect Customer Profiles. See [Customer Profiles Destination Properties](#customer-profiles-destination-properties) for more details.
+* `eventBridge` - (Optional) Properties that are required to query Amazon EventBridge. See [Generic Destination Properties](#generic-destination-properties) for more details.
+* `honeycode` - (Optional) Properties that are required to query Amazon Honeycode. See [Generic Destination Properties](#generic-destination-properties) for more details.
+* `marketo` - (Optional) Properties that are required to query Marketo. See [Generic Destination Properties](#generic-destination-properties) for more details.
+* `redshift` - (Optional) Properties that are required to query Amazon Redshift. See [Redshift Destination Properties](#redshift-destination-properties) for more details.
+* `s3` - (Optional) Properties that are required to query Amazon S3. See [S3 Destination Properties](#s3-destination-properties) for more details.
+* `salesforce` - (Optional) Properties that are required to query Salesforce. See [Salesforce Destination Properties](#salesforce-destination-properties) for more details.
+* `sapoData` - (Optional) Properties that are required to query SAPOData. See [SAPOData Destination Properties](#sapodata-destination-properties) for more details.
+* `snowflake` - (Optional) Properties that are required to query Snowflake. See [Snowflake Destination Properties](#snowflake-destination-properties) for more details.
+* `upsolver` - (Optional) Properties that are required to query Upsolver. See [Upsolver Destination Properties](#upsolver-destination-properties) for more details.
+* `zendesk` - (Optional) Properties that are required to query Zendesk. See [Zendesk Destination Properties](#zendesk-destination-properties) for more details.
+
+##### Generic Destination Properties
+
+EventBridge, Honeycode, and Marketo destination properties all support the following attributes:
+
+* `object` - (Required) Object specified in the flow destination.
+* `errorHandlingConfig` - (Optional) Settings that determine how Amazon AppFlow handles an error when placing data in the destination. See [Error Handling Config](#error-handling-config) for more details.
+
+##### Custom Connector Destination Properties
+
+* `entityName` - (Required) Entity specified in the custom connector as a destination in the flow.
+* `customProperties` - (Optional) Custom properties that are specific to the connector when it's used as a destination in the flow. Maximum of 50 items.
+* `errorHandlingConfig` - (Optional) Settings that determine how Amazon AppFlow handles an error when placing data in the custom connector as destination. See [Error Handling Config](#error-handling-config) for more details.
+* `idFieldNames` - (Optional) Name of the field that Amazon AppFlow uses as an ID when performing a write operation such as update, delete, or upsert.
+* `writeOperationType` - (Optional) Type of write operation to be performed in the custom connector when it's used as destination. Valid values are `insert`, `upsert`, `update`, and `delete`.
+
+##### Customer Profiles Destination Properties
+
+* `domainName` - (Required) Unique name of the Amazon Connect Customer Profiles domain.
+* `objectTypeName` - (Optional) Object specified in the Amazon Connect Customer Profiles flow destination.
+
+##### Redshift Destination Properties
+
+* `intermediateBucketName` - (Required) Intermediate bucket that Amazon AppFlow uses when moving data into Amazon Redshift.
+* `object` - (Required) Object specified in the Amazon Redshift flow destination.
+* `bucketPrefix` - (Optional) Object key for the bucket in which Amazon AppFlow places the destination files.
+* `errorHandlingConfig` - (Optional) Settings that determine how Amazon AppFlow handles an error when placing data in the destination. See [Error Handling Config](#error-handling-config) for more details.
+
+##### S3 Destination Properties
+
+* `bucketName` - (Required) Amazon S3 bucket name in which Amazon AppFlow places the transferred data.
+* `bucketPrefix` - (Optional) Object key for the bucket in which Amazon AppFlow places the destination files.
+* `s3OutputFormatConfig` - (Optional) Configuration that determines how Amazon AppFlow should format the flow output data when Amazon S3 is used as the destination. See [S3 Output Format Config](#s3-output-format-config) for more details.
+
+###### S3 Output Format Config
+
+* `aggregationConfig` - (Optional) Aggregation settings that you can use to customize the output format of your flow data. See [Aggregation Config](#aggregation-config) for more details.
+* `fileType` - (Optional) File type that Amazon AppFlow places in the Amazon S3 bucket. Valid values are `csv`, `json`, and `parquet`.
+* `prefixConfig` - (Optional) Determines the prefix that Amazon AppFlow applies to the folder name in the Amazon S3 bucket. You can name folders according to the flow frequency and date. See [Prefix Config](#prefix-config) for more details.
+* `preserveSourceDataTyping` - (Optional, Boolean) Whether the data types from the source system need to be preserved (Only valid for `parquet` file type)
+
+##### Salesforce Destination Properties
+
+* `object` - (Required) Object specified in the flow destination.
+* `errorHandlingConfig` - (Optional) Settings that determine how Amazon AppFlow handles an error when placing data in the destination. See [Error Handling Config](#error-handling-config) for more details.
+* `idFieldNames` - (Optional) Name of the field that Amazon AppFlow uses as an ID when performing a write operation such as update or delete.
+* `writeOperationType` - (Optional) This specifies the type of write operation to be performed in Salesforce. When the value is `upsert`, then `idFieldNames` is required. Valid values are `insert`, `upsert`, `update`, and `delete`.
+
+##### SAPOData Destination Properties
+
+* `objectPath` - (Required) Object path specified in the SAPOData flow destination.
+* `errorHandlingConfig` - (Optional) Settings that determine how Amazon AppFlow handles an error when placing data in the destination. See [Error Handling Config](#error-handling-config) for more details.
+* `idFieldNames` - (Optional) Name of the field that Amazon AppFlow uses as an ID when performing a write operation such as update or delete.
+* `successResponseHandlingConfig` - (Optional) Determines how Amazon AppFlow handles the success response that it gets from the connector after placing data. See [Success Response Handling Config](#success-response-handling-config) for more details.
+* `writeOperation` - (Optional) Possible write operations in the destination connector. When this value is not provided, this defaults to the `insert` operation. Valid values are `insert`, `upsert`, `update`, and `delete`.
+
+###### Success Response Handling Config
+
+* `bucketName` - (Optional) Name of the Amazon S3 bucket.
+* `bucketPrefix` - (Optional) Amazon S3 bucket prefix.
+
+##### Snowflake Destination Properties
+
+* `intermediateBucketName` - (Required) Intermediate bucket that Amazon AppFlow uses when moving data into Amazon Snowflake.
+* `object` - (Required) Object specified in the Amazon Snowflake flow destination.
+* `bucketPrefix` - (Optional) Object key for the bucket in which Amazon AppFlow places the destination files.
+* `errorHandlingConfig` - (Optional) Settings that determine how Amazon AppFlow handles an error when placing data in the destination. See [Error Handling Config](#error-handling-config) for more details.
+
+##### Upsolver Destination Properties
+
+* `bucketName` - (Required) Upsolver Amazon S3 bucket name in which Amazon AppFlow places the transferred data. This must begin with `upsolverAppflow`.
+* `bucketPrefix` - (Optional) Object key for the Upsolver Amazon S3 Bucket in which Amazon AppFlow places the destination files.
+* `s3OutputFormatConfig` - (Optional) Configuration that determines how Amazon AppFlow should format the flow output data when Upsolver is used as the destination. See [Upsolver S3 Output Format Config](#upsolver-s3-output-format-config) for more details.
+
+###### Upsolver S3 Output Format Config
+
+* `aggregationConfig` - (Optional) Aggregation settings that you can use to customize the output format of your flow data. See [Aggregation Config](#aggregation-config) for more details.
+* `fileType` - (Optional) File type that Amazon AppFlow places in the Upsolver Amazon S3 bucket. Valid values are `csv`, `json`, and `parquet`.
+* `prefixConfig` - (Optional) Determines the prefix that Amazon AppFlow applies to the folder name in the Amazon S3 bucket. You can name folders according to the flow frequency and date. See [Prefix Config](#prefix-config) for more details.
+
+###### Aggregation Config
+
+* `aggregationType` - (Optional) Whether Amazon AppFlow aggregates the flow records into a single file, or leave them unaggregated. Valid values are `none` and `singleFile`.
+
+###### Prefix Config
+
+* `prefixFormat` - (Optional) Determines the level of granularity that's included in the prefix. Valid values are `year`, `month`, `day`, `hour`, and `minute`.
+* `prefixType` - (Optional) Determines the format of the prefix, and whether it applies to the file name, file path, or both. Valid values are `filename`, `path`, and `pathAndFilename`.
+
+##### Zendesk Destination Properties
+
+* `object` - (Required) Object specified in the flow destination.
+* `errorHandlingConfig` - (Optional) Settings that determine how Amazon AppFlow handles an error when placing data in the destination. See [Error Handling Config](#error-handling-config) for more details.
+* `idFieldNames` - (Optional) Name of the field that Amazon AppFlow uses as an ID when performing a write operation such as update or delete.
+* `writeOperationType` - (Optional) This specifies the type of write operation to be performed in Zendesk. When the value is `upsert`, then `idFieldNames` is required. Valid values are `insert`, `upsert`, `update`, and `delete`.
+
+###### Error Handling Config
+
+* `bucketName` - (Optional) Name of the Amazon S3 bucket.
+* `bucketPrefix` - (Optional) Amazon S3 bucket prefix.
+* `failOnFirstDestinationError` - (Optional, boolean) If the flow should fail after the first instance of a failure when attempting to place data in the destination.
+
+### Source Flow Config
+
+* `connectorType` - (Required) Type of connector, such as Salesforce, Amplitude, and so on. Valid values are `salesforce`, `singular`, `slack`, `redshift`, `s3`, `marketo`, `googleanalytics`, `zendesk`, `servicenow`, `datadog`, `trendmicro`, `snowflake`, `dynatrace`, `infornexus`, `amplitude`, `veeva`, `eventBridge`, `lookoutMetrics`, `upsolver`, `honeycode`, `customerProfiles`, `sapoData`, and `customConnector`.
+* `sourceConnectorProperties` - (Required) Information that is required to query a particular source connector. See [Source Connector Properties](#source-connector-properties) for details.
+* `apiVersion` - (Optional) API version that the destination connector uses.
+* `connectorProfileName` - (Optional) Name of the connector profile. This name must be unique for each connector profile in the AWS account.
+* `incrementalPullConfig` - (Optional) Defines the configuration for a scheduled incremental data pull. If a valid configuration is provided, the fields specified in the configuration are used when querying for the incremental data pull. See [Incremental Pull Config](#incremental-pull-config) for more details.
+
+#### Source Connector Properties
+
+* `amplitude` - (Optional) Information that is required for querying Amplitude. See [Generic Source Properties](#generic-source-properties) for more details.
+* `customConnector` - (Optional) Properties that are applied when the custom connector is being used as a source. See [Custom Connector Source Properties](#custom-connector-source-properties).
+* `datadog` - (Optional) Information that is required for querying Datadog. See [Generic Source Properties](#generic-source-properties) for more details.
+* `dynratrace` - (Optional) Information that is required for querying Dynatrace. See [Generic Source Properties](#generic-source-properties) for more details.
+* `inforNexus` - (Optional) Information that is required for querying Infor Nexus. See [Generic Source Properties](#generic-source-properties) for more details.
+* `marketo` - (Optional) Information that is required for querying Marketo. See [Generic Source Properties](#generic-source-properties) for more details.
+* `s3` - (Optional) Information that is required for querying Amazon S3. See [S3 Source Properties](#s3-source-properties) for more details.
+* `salesforce` - (Optional) Information that is required for querying Salesforce. See [Salesforce Source Properties](#s3-source-properties) for more details.
+* `sapoData` - (Optional) Information that is required for querying SAPOData as a flow source. See [SAPO Source Properties](#sapodata-source-properties) for more details.
+* `serviceNow` - (Optional) Information that is required for querying ServiceNow. See [Generic Source Properties](#generic-source-properties) for more details.
+* `singular` - (Optional) Information that is required for querying Singular. See [Generic Source Properties](#generic-source-properties) for more details.
+* `slack` - (Optional) Information that is required for querying Slack. See [Generic Source Properties](#generic-source-properties) for more details.
+* `trendMicro` - (Optional) Information that is required for querying Trend Micro. See [Generic Source Properties](#generic-source-properties) for more details.
+* `veeva` - (Optional) Information that is required for querying Veeva. See [Veeva Source Properties](#veeva-source-properties) for more details.
+* `zendesk` - (Optional) Information that is required for querying Zendesk. See [Generic Source Properties](#generic-source-properties) for more details.
+
+##### Generic Source Properties
+
+Amplitude, Datadog, Dynatrace, Google Analytics, Infor Nexus, Marketo, ServiceNow, Singular, Slack, Trend Micro, and Zendesk source properties all support the following attributes:
+
+* `object` - (Required) Object specified in the flow source.
+
+##### Custom Connector Source Properties
+
+* `entityName` - (Required) Entity specified in the custom connector as a source in the flow.
+* `customProperties` - (Optional) Custom properties that are specific to the connector when it's used as a source in the flow. Maximum of 50 items.
+
+##### S3 Source Properties
+
+* `bucketName` - (Required) Amazon S3 bucket name where the source files are stored.
+* `bucketPrefix` - (Optional) Object key for the Amazon S3 bucket in which the source files are stored.
+* `s3InputFormatConfig` - (Optional) When you use Amazon S3 as the source, the configuration format that you provide the flow input data. See [S3 Input Format Config](#s3-input-format-config) for details.
+
+###### S3 Input Format Config
+
+* `s3InputFileType` - (Optional) File type that Amazon AppFlow gets from your Amazon S3 bucket. Valid values are `csv` and `json`.
+
+##### Salesforce Source Properties
+
+* `object` - (Required) Object specified in the Salesforce flow source.
+* `enableDynamicFieldUpdate` - (Optional, boolean) Flag that enables dynamic fetching of new (recently added) fields in the Salesforce objects while running a flow.
+* `includeDeletedRecords` - (Optional, boolean) Whether Amazon AppFlow includes deleted files in the flow run.
+
+##### SAPOData Source Properties
+
+* `objectPath` - (Required) Object path specified in the SAPOData flow source.
+
+##### Veeva Source Properties
+
+* `object` - (Required) Object specified in the Veeva flow source.
+* `documentType` - (Optional) Document type specified in the Veeva document extract flow.
+* `includeAllVersions` - (Optional, boolean) Boolean value to include All Versions of files in Veeva document extract flow.
+* `includeRenditions` - (Optional, boolean) Boolean value to include file renditions in Veeva document extract flow.
+* `includeSourceFiles` - (Optional, boolean) Boolean value to include source files in Veeva document extract flow.
+
+#### Incremental Pull Config
+
+* `datetimeTypeFieldName` - (Optional) Field that specifies the date time or timestamp field as the criteria to use when importing incremental records from the source.
+
+### Task
+
+* `sourceFields` - (Required) Source fields to which a particular task is applied.
+* `taskType` - (Required) Particular task implementation that Amazon AppFlow performs. Valid values are `arithmetic`, `filter`, `map`, `mapAll`, `mask`, `merge`, `passthrough`, `truncate`, and `validate`.
+* `connectorOperator` - (Optional) Operation to be performed on the provided source fields. See [Connector Operator](#connector-operator) for details.
+* `destinationField` - (Optional) Field in a destination connector, or a field value against which Amazon AppFlow validates a source field.
+* `taskProperties` - (Optional) Map used to store task-related information. The execution service looks for particular information based on the `taskType`. Valid keys are `value`, `values`, `dataType`, `upperBound`, `lowerBound`, `sourceDataType`, `destinationDataType`, `validationAction`, `maskValue`, `maskLength`, `truncateLength`, `mathOperationFieldsOrder`, `concatFormat`, `subfieldCategoryMap`, and `excludeSourceFieldsList`.
+
+#### Connector Operator
+
+* `amplitude` - (Optional) Operation to be performed on the provided Amplitude source fields. The only valid value is `between`.
+* `customConnector` - (Optional) Operators supported by the custom connector. Valid values are `projection`, `lessThan`, `greaterThan`, `contains`, `between`, `lessThanOrEqualTo`, `greaterThanOrEqualTo`, `equalTo`, `notEqualTo`, `addition`, `multiplication`, `division`, `subtraction`, `maskAll`, `maskFirstN`, `maskLastN`, `validateNonNull`, `validateNonZero`, `validateNonNegative`, `validateNumeric`, and `noOp`.
+* `datadog` - (Optional) Operation to be performed on the provided Datadog source fields. Valid values are `projection`, `between`, `equalTo`, `addition`, `multiplication`, `division`, `subtraction`, `maskAll`, `maskFirstN`, `maskLastN`, `validateNonNull`, `validateNonZero`, `validateNonNegative`, `validateNumeric`, and `noOp`.
+* `dynatrace` - (Optional) Operation to be performed on the provided Dynatrace source fields. Valid values are `projection`, `between`, `equalTo`, `addition`, `multiplication`, `division`, `subtraction`, `maskAll`, `maskFirstN`, `maskLastN`, `validateNonNull`, `validateNonZero`, `validateNonNegative`, `validateNumeric`, and `noOp`.
+* `googleAnalytics` - (Optional) Operation to be performed on the provided Google Analytics source fields. Valid values are `projection` and `between`.
+* `inforNexus` - (Optional) Operation to be performed on the provided Infor Nexus source fields. Valid values are `projection`, `between`, `equalTo`, `addition`, `multiplication`, `division`, `subtraction`, `maskAll`, `maskFirstN`, `maskLastN`, `validateNonNull`, `validateNonZero`, `validateNonNegative`, `validateNumeric`, and `noOp`.
+* `marketo` - (Optional) Operation to be performed on the provided Marketo source fields. Valid values are `projection`, `between`, `equalTo`, `addition`, `multiplication`, `division`, `subtraction`, `maskAll`, `maskFirstN`, `maskLastN`, `validateNonNull`, `validateNonZero`, `validateNonNegative`, `validateNumeric`, and `noOp`.
+* `s3` - (Optional) Operation to be performed on the provided Amazon S3 source fields. Valid values are `projection`, `lessThan`, `greaterThan`, `between`, `lessThanOrEqualTo`, `greaterThanOrEqualTo`, `equalTo`, `notEqualTo`, `addition`, `multiplication`, `division`, `subtraction`, `maskAll`, `maskFirstN`, `maskLastN`, `validateNonNull`, `validateNonZero`, `validateNonNegative`, `validateNumeric`, and `noOp`.
+* `salesforce` - (Optional) Operation to be performed on the provided Salesforce source fields. Valid values are `projection`, `lessThan`, `greaterThan`, `contains`, `between`, `lessThanOrEqualTo`, `greaterThanOrEqualTo`, `equalTo`, `notEqualTo`, `addition`, `multiplication`, `division`, `subtraction`, `maskAll`, `maskFirstN`, `maskLastN`, `validateNonNull`, `validateNonZero`, `validateNonNegative`, `validateNumeric`, and `noOp`.
+* `sapoData` - (Optional) Operation to be performed on the provided SAPOData source fields. Valid values are `projection`, `lessThan`, `greaterThan`, `contains`, `between`, `lessThanOrEqualTo`, `greaterThanOrEqualTo`, `equalTo`, `notEqualTo`, `addition`, `multiplication`, `division`, `subtraction`, `maskAll`, `maskFirstN`, `maskLastN`, `validateNonNull`, `validateNonZero`, `validateNonNegative`, `validateNumeric`, and `noOp`.
+* `serviceNow` - (Optional) Operation to be performed on the provided ServiceNow source fields. Valid values are `projection`, `lessThan`, `greaterThan`, `contains`, `between`, `lessThanOrEqualTo`, `greaterThanOrEqualTo`, `equalTo`, `notEqualTo`, `addition`, `multiplication`, `division`, `subtraction`, `maskAll`, `maskFirstN`, `maskLastN`, `validateNonNull`, `validateNonZero`, `validateNonNegative`, `validateNumeric`, and `noOp`.
+* `singular` - (Optional) Operation to be performed on the provided Singular source fields. Valid values are `projection`, `equalTo`, `addition`, `multiplication`, `division`, `subtraction`, `maskAll`, `maskFirstN`, `maskLastN`, `validateNonNull`, `validateNonZero`, `validateNonNegative`, `validateNumeric`, and `noOp`.
+* `slack` - (Optional) Operation to be performed on the provided Slack source fields. Valid values are `projection`, `lessThan`, `greaterThan`, `between`, `lessThanOrEqualTo`, `greaterThanOrEqualTo`, `equalTo`, `addition`, `multiplication`, `division`, `subtraction`, `maskAll`, `maskFirstN`, `maskLastN`, `validateNonNull`, `validateNonZero`, `validateNonNegative`, `validateNumeric`, and `noOp`.
+* `trendmicro` - (Optional) Operation to be performed on the provided Trend Micro source fields. Valid values are `projection`, `equalTo`, `addition`, `multiplication`, `division`, `subtraction`, `maskAll`, `maskFirstN`, `maskLastN`, `validateNonNull`, `validateNonZero`, `validateNonNegative`, `validateNumeric`, and `noOp`.
+* `veeva` - (Optional) Operation to be performed on the provided Veeva source fields. Valid values are `projection`, `lessThan`, `greaterThan`, `contains`, `between`, `lessThanOrEqualTo`, `greaterThanOrEqualTo`, `equalTo`, `notEqualTo`, `addition`, `multiplication`, `division`, `subtraction`, `maskAll`, `maskFirstN`, `maskLastN`, `validateNonNull`, `validateNonZero`, `validateNonNegative`, `validateNumeric`, and `noOp`.
+* `zendesk` - (Optional) Operation to be performed on the provided Zendesk source fields. Valid values are `projection`, `greaterThan`, `addition`, `multiplication`, `division`, `subtraction`, `maskAll`, `maskFirstN`, `maskLastN`, `validateNonNull`, `validateNonZero`, `validateNonNegative`, `validateNumeric`, and `noOp`.
+
+### Trigger Config
+
+* `triggerType` - (Required) Type of flow trigger. Valid values are `scheduled`, `event`, and `onDemand`.
+* `triggerProperties` - (Optional) Configuration details of a schedule-triggered flow as defined by the user. Currently, these settings only apply to the `scheduled` trigger type. See [Scheduled Trigger Properties](#scheduled-trigger-properties) for details.
+
+#### Scheduled Trigger Properties
+
+The `triggerProperties` block only supports one attribute: `scheduled`, a block which in turn supports the following:
+
+* `scheduleExpression` - (Required) Scheduling expression that determines the rate at which the schedule will run, for example `rate(5Minutes)`.
+* `dataPullMode` - (Optional) Whether a scheduled flow has an incremental data transfer or a complete data transfer for each flow run. Valid values are `incremental` and `complete`.
+* `firstExecutionFrom` - (Optional) Date range for the records to import from the connector in the first flow run. Must be a valid RFC3339 timestamp.
+* `scheduleEndTime` - (Optional) Scheduled end time for a schedule-triggered flow. Must be a valid RFC3339 timestamp.
+* `scheduleOffset` - (Optional) Optional offset that is added to the time interval for a schedule-triggered flow. Maximum value of 36000.
+* `scheduleStartTime` - (Optional) Scheduled start time for a schedule-triggered flow. Must be a valid RFC3339 timestamp.
+* `timezone` - (Optional) Time zone used when referring to the date and time of a scheduled-triggered flow, such as `america/newYork`.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AppflowFlow } from "./.gen/providers/aws/appflow-flow";
+interface MyConfig {
+  triggerType: any;
+  destinationFlowConfig: any;
+  name: any;
+  sourceFlowConfig: any;
+  task: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new AppflowFlow(this, "example", {
+      triggerConfig: {
+        scheduled: [
+          {
+            schedule_expression: "rate(1minutes)",
+          },
+        ],
+        triggerType: config.triggerType,
+      },
+      destinationFlowConfig: config.destinationFlowConfig,
+      name: config.name,
+      sourceFlowConfig: config.sourceFlowConfig,
+      task: config.task,
+    });
+  }
+}
+
+```
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Flow's ARN.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AppFlow flows using the `arn`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import AppFlow flows using the `arn`. For example:
+
+```console
+% terraform import aws_appflow_flow.example arn:aws:appflow:us-west-2:123456789012:flow/example-flow
+```
+
+<!-- cache-key: cdktf-0.18.0 input-17e1cfe9c9c0df000acad27d00f90bbaa486384b6d2aa3d057f258c6051b900d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/appintegrations_data_integration.html.markdown b/website/docs/cdktf/typescript/r/appintegrations_data_integration.html.markdown
new file mode 100644
index 00000000000..39cb4a8bebe
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/appintegrations_data_integration.html.markdown
@@ -0,0 +1,95 @@
+---
+subcategory: "AppIntegrations"
+layout: "aws"
+page_title: "AWS: aws_appintegrations_data_integration"
+description: |-
+  Provides details about a specific Amazon AppIntegrations Data Integration
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_appintegrations_data_integration
+
+Provides an Amazon AppIntegrations Data Integration resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AppintegrationsDataIntegration } from "./.gen/providers/aws/appintegrations-data-integration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AppintegrationsDataIntegration(this, "example", {
+      description: "example",
+      kmsKey: test.arn,
+      name: "example",
+      scheduleConfig: {
+        firstExecutionFrom: "1439788442681",
+        object: "Account",
+        scheduleExpression: "rate(1 hour)",
+      },
+      sourceUri: "Salesforce://AppFlow/example",
+      tags: {
+        Key1: "Value1",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `description` - (Optional) Specifies the description of the Data Integration.
+* `kmsKey` - (Required) Specifies the KMS key Amazon Resource Name (ARN) for the Data Integration.
+* `name` - (Required) Specifies the name of the Data Integration.
+* `scheduleConfig` - (Required) A block that defines the name of the data and how often it should be pulled from the source. The Schedule Config block is documented below.
+* `sourceUri` - (Required) Specifies the URI of the data source. Create an [AppFlow Connector Profile](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/appflow_connector_profile) and reference the name of the profile in the URL. An example of this value for Salesforce is `salesforce://appFlow/example` where `example` is the name of the AppFlow Connector Profile.
+* `tags` - (Optional) Tags to apply to the Data Integration. If configured with a provider [`defaultTags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+A `scheduleConfig` block supports the following arguments:
+
+* `firstExecutionFrom` - (Required) The start date for objects to import in the first flow run as an Unix/epoch timestamp in milliseconds or in ISO-8601 format. This needs to be a time in the past, meaning that the data created or updated before this given date will not be downloaded.
+* `object` - (Required) The name of the object to pull from the data source. Examples of objects in Salesforce include `case`, `account`, or `lead`.
+* `scheduleExpression` - (Required) How often the data should be pulled from data source. Examples include `rate(1 hour)`, `rate(3 hours)`, `rate(1 day)`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the Data Integration.
+* `id` - The identifier of the Data Integration.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Amazon AppIntegrations Data Integrations using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Amazon AppIntegrations Data Integrations using the `id`. For example:
+
+```console
+% terraform import aws_appintegrations_data_integration.example 12345678-1234-1234-1234-123456789123
+```
+
+<!-- cache-key: cdktf-0.18.0 input-c453729b63eb0dcd3c4b7bbf7e0c63bfc3f55c4cc0725680004f1efcf202b819 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/appintegrations_event_integration.html.markdown b/website/docs/cdktf/typescript/r/appintegrations_event_integration.html.markdown
new file mode 100644
index 00000000000..19a36c243fc
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/appintegrations_event_integration.html.markdown
@@ -0,0 +1,89 @@
+---
+subcategory: "AppIntegrations"
+layout: "aws"
+page_title: "AWS: aws_appintegrations_event_integration"
+description: |-
+  Provides details about a specific Amazon AppIntegrations Event Integration
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_appintegrations_event_integration
+
+Provides an Amazon AppIntegrations Event Integration resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AppintegrationsEventIntegration } from "./.gen/providers/aws/appintegrations-event-integration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AppintegrationsEventIntegration(this, "example", {
+      description: "Example Description",
+      eventFilter: {
+        source: "aws.partner/examplepartner.com",
+      },
+      eventbridgeBus: "default",
+      name: "example-name",
+      tags: {
+        Name: "Example Event Integration",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `description` - (Optional) Description of the Event Integration.
+* `eventbridgeBus` - (Required) EventBridge bus.
+* `eventFilter` - (Required) Block that defines the configuration information for the event filter. The Event Filter block is documented below.
+* `name` - (Required) Name of the Event Integration.
+* `tags` - (Optional) Tags to apply to the Event Integration. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+A `eventFilter` block supports the following arguments:
+
+* `source` - (Required) Source of the events.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Event Integration.
+* `id` - Identifier of the Event Integration which is the name of the Event Integration.
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Amazon AppIntegrations Event Integrations using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Amazon AppIntegrations Event Integrations using the `name`. For example:
+
+```console
+% terraform import aws_appintegrations_event_integration.example example-name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-8b79c762f6b5fb4efdf9be46519afb95e300098781375353c9e9d4ad128687a6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/applicationinsights_application.html.markdown b/website/docs/cdktf/typescript/r/applicationinsights_application.html.markdown
new file mode 100644
index 00000000000..49333ad4b60
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/applicationinsights_application.html.markdown
@@ -0,0 +1,103 @@
+---
+subcategory: "CloudWatch Application Insights"
+layout: "aws"
+page_title: "AWS: aws_applicationinsights_application"
+description: |-
+  Provides a CloudWatch Application Insights Application resource
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_applicationinsights_application
+
+Provides a ApplicationInsights Application resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ApplicationinsightsApplication } from "./.gen/providers/aws/applicationinsights-application";
+import { ResourcegroupsGroup } from "./.gen/providers/aws/resourcegroups-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new ResourcegroupsGroup(this, "example", {
+      name: "example",
+      resourceQuery: {
+        query: Token.asString(
+          Fn.jsonencode({
+            ResourceTypeFilters: ["AWS::EC2::Instance"],
+            TagFilters: [
+              {
+                Key: "Stage",
+                Values: ["Test"],
+              },
+            ],
+          })
+        ),
+      },
+    });
+    const awsApplicationinsightsApplicationExample =
+      new ApplicationinsightsApplication(this, "example_1", {
+        resourceGroupName: example.name,
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsApplicationinsightsApplicationExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `resourceGroupName` - (Required) Name of the resource group.
+
+The following arguments are optional:
+
+* `autoConfigEnabled` - (Optional)  Indicates whether Application Insights automatically configures unmonitored resources in the resource group.
+* `autoCreate` - (Optional) Configures all of the resources in the resource group by applying the recommended configurations.
+* `cweMonitorEnabled` - (Optional)  Indicates whether Application Insights can listen to CloudWatch events for the application resources, such as instance terminated, failed deployment, and others.
+* `groupingType` - (Optional) Application Insights can create applications based on a resource group or on an account. To create an account-based application using all of the resources in the account, set this parameter to `accountBased`.
+* `opsCenterEnabled` - (Optional) When set to `true`, creates opsItems for any problems detected on an application.
+* `opsItemSnsTopicArn` - (Optional) SNS topic provided to Application Insights that is associated to the created opsItem. Allows you to receive notifications for updates to the opsItem.
+* `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Application.
+* `id` - Name of the resource group.
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import ApplicationInsights Applications using the `resourceGroupName`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import ApplicationInsights Applications using the `resourceGroupName`. For example:
+
+```console
+% terraform import aws_applicationinsights_application.some some-application
+```
+
+<!-- cache-key: cdktf-0.18.0 input-30b40f9adb8f133c3e275766d86e95f547219ce5038fa7751ad75a6d3c0db957 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/appmesh_gateway_route.html.markdown b/website/docs/cdktf/typescript/r/appmesh_gateway_route.html.markdown
new file mode 100644
index 00000000000..97acd1bf421
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/appmesh_gateway_route.html.markdown
@@ -0,0 +1,205 @@
+---
+subcategory: "App Mesh"
+layout: "aws"
+page_title: "AWS: aws_appmesh_gateway_route"
+description: |-
+  Provides an AWS App Mesh gateway route resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_appmesh_gateway_route
+
+Provides an AWS App Mesh gateway route resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AppmeshGatewayRoute } from "./.gen/providers/aws/appmesh-gateway-route";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AppmeshGatewayRoute(this, "example", {
+      meshName: "example-service-mesh",
+      name: "example-gateway-route",
+      spec: {
+        httpRoute: {
+          action: {
+            target: {
+              virtualService: {
+                virtualServiceName: Token.asString(
+                  awsAppmeshVirtualServiceExample.name
+                ),
+              },
+            },
+          },
+          match: {
+            prefix: "/",
+          },
+        },
+      },
+      tags: {
+        Environment: "test",
+      },
+      virtualGatewayName: Token.asString(awsAppmeshVirtualGatewayExample.name),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) Name to use for the gateway route. Must be between 1 and 255 characters in length.
+* `meshName` - (Required) Name of the service mesh in which to create the gateway route. Must be between 1 and 255 characters in length.
+* `virtualGatewayName` - (Required) Name of the [virtual gateway](/docs/providers/aws/r/appmesh_virtual_gateway.html) to associate the gateway route with. Must be between 1 and 255 characters in length.
+* `meshOwner` - (Optional) AWS account ID of the service mesh's owner. Defaults to the account ID the [AWS provider][1] is currently connected to.
+* `spec` - (Required) Gateway route specification to apply.
+* `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+The `spec` object supports the following:
+
+* `grpcRoute` - (Optional) Specification of a gRPC gateway route.
+* `httpRoute` - (Optional) Specification of an HTTP gateway route.
+* `http2Route` - (Optional) Specification of an HTTP/2 gateway route.
+* `priority` - (Optional) Priority for the gateway route, between `0` and `1000`.
+
+The `grpcRoute`, `httpRoute` and `http2Route` objects supports the following:
+
+* `action` - (Required) Action to take if a match is determined.
+* `match` - (Required) Criteria for determining a request match.
+
+The `grpcRoute`, `httpRoute` and `http2Route`'s `action` object supports the following:
+
+* `target` - (Required) Target that traffic is routed to when a request matches the gateway route.
+
+The `target` object supports the following:
+
+* `port` - (Optional) The port number that corresponds to the target for Virtual Service provider port. This is required when the provider (router or node) of the Virtual Service has multiple listeners.
+* `virtualService` - (Required) Virtual service gateway route target.
+
+The `virtualService` object supports the following:
+
+* `virtualServiceName` - (Required) Name of the virtual service that traffic is routed to. Must be between 1 and 255 characters in length.
+
+The `httpRoute` and `http2Route`'s `action` object additionally supports the following:
+
+* `rewrite` - (Optional) Gateway route action to rewrite.
+
+The `rewrite` object supports the following:
+
+* `hostname` - (Optional) Host name to rewrite.
+* `path` - (Optional) Exact path to rewrite.
+* `prefix` - (Optional) Specified beginning characters to rewrite.
+
+The `hostname` object supports the following:
+
+* `defaultTargetHostname` - (Required) Default target host name to write to. Valid values: `enabled`, `disabled`.
+
+The `path` object supports the following:
+
+* `exact` - (Required) Value used to replace matched path.
+
+The `prefix` object supports the following:
+
+* `defaultPrefix` - (Optional) Default prefix used to replace the incoming route prefix when rewritten. Valid values: `enabled`, `disabled`.
+* `value` - (Optional) Value used to replace the incoming route prefix when rewritten.
+
+The `grpcRoute`'s `match` object supports the following:
+
+* `serviceName` - (Required) Fully qualified domain name for the service to match from the request.
+* `port` - (Optional) The port number to match from the request.
+
+The `httpRoute` and `http2Route`'s `match` object supports the following:
+
+* `header` - (Optional) Client request headers to match on.
+* `hostname` - (Optional) Host name to match on.
+* `path` - (Optional) Client request path to match on.
+* `port` - (Optional) The port number to match from the request.
+* `prefix` - (Optional) Path to match requests with. This parameter must always start with `/`, which by itself matches all requests to the virtual service name.
+* `queryParameter` - (Optional) Client request query parameters to match on.
+
+The `header` object supports the following:
+
+* `name` - (Required) Name for the HTTP header in the client request that will be matched on.
+* `invert` - (Optional) If `true`, the match is on the opposite of the `match` method and value. Default is `false`.
+* `match` - (Optional) Method and value to match the header value sent with a request. Specify one match method.
+
+The `header`'s `match` object supports the following:
+
+* `exact` - (Optional) Header value sent by the client must match the specified value exactly.
+* `prefix` - (Optional) Header value sent by the client must begin with the specified characters.
+* `port`- (Optional) The port number to match from the request.
+* `range`- (Optional) Object that specifies the range of numbers that the header value sent by the client must be included in.
+* `regex` - (Optional) Header value sent by the client must include the specified characters.
+* `suffix` - (Optional) Header value sent by the client must end with the specified characters.
+
+The `range` object supports the following:
+
+* `end` - (Required) End of the range.
+* `start` - (Requited) Start of the range.
+
+The `hostname` object supports the following:
+
+* `exact` - (Optional) Exact host name to match on.
+* `suffix` - (Optional) Specified ending characters of the host name to match on.
+
+The `path` object supports the following:
+
+* `exact` - (Optional) The exact path to match on.
+* `regex` - (Optional) The regex used to match the path.
+
+The `queryParameter` object supports the following:
+
+* `name` - (Required) Name for the query parameter that will be matched on.
+* `match` - (Optional) The query parameter to match on.
+
+The `queryParameter`'s `match` object supports the following:
+
+* `exact` - (Optional) The exact query parameter to match on.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the gateway route.
+* `arn` - ARN of the gateway route.
+* `createdDate` - Creation date of the gateway route.
+* `lastUpdatedDate` - Last update date of the gateway route.
+* `resourceOwner` - Resource owner's AWS account ID.
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import App Mesh gateway routes using `meshName` and `virtualGatewayName` together with the gateway route's `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import App Mesh gateway routes using `meshName` and `virtualGatewayName` together with the gateway route's `name`. For example:
+
+```console
+% terraform import aws_appmesh_gateway_route.example mesh/gw1/example-gateway-route
+```
+
+[1]: /docs/providers/aws/index.html
+
+<!-- cache-key: cdktf-0.18.0 input-c4b969b72d8a7fa97ad9813ee47129d1f3ecfc1dcc5979566a12522b5042594d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/appmesh_mesh.html.markdown b/website/docs/cdktf/typescript/r/appmesh_mesh.html.markdown
new file mode 100644
index 00000000000..6067e295d8d
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/appmesh_mesh.html.markdown
@@ -0,0 +1,117 @@
+---
+subcategory: "App Mesh"
+layout: "aws"
+page_title: "AWS: aws_appmesh_mesh"
+description: |-
+  Provides an AWS App Mesh service mesh resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_appmesh_mesh
+
+Provides an AWS App Mesh service mesh resource.
+
+## Example Usage
+
+### Basic
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AppmeshMesh } from "./.gen/providers/aws/appmesh-mesh";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AppmeshMesh(this, "simple", {
+      name: "simpleapp",
+    });
+  }
+}
+
+```
+
+### Egress Filter
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AppmeshMesh } from "./.gen/providers/aws/appmesh-mesh";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AppmeshMesh(this, "simple", {
+      name: "simpleapp",
+      spec: {
+        egressFilter: {
+          type: "ALLOW_ALL",
+        },
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) Name to use for the service mesh. Must be between 1 and 255 characters in length.
+* `spec` - (Optional) Service mesh specification to apply.
+* `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+The `spec` object supports the following:
+
+* `egressFilter`- (Optional) Egress filter rules for the service mesh.
+
+The `egressFilter` object supports the following:
+
+* `type` - (Optional) Egress filter type. By default, the type is `dropAll`.
+Valid values are `allowAll` and `dropAll`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the service mesh.
+* `arn` - ARN of the service mesh.
+* `createdDate` - Creation date of the service mesh.
+* `lastUpdatedDate` - Last update date of the service mesh.
+* `meshOwner` - AWS account ID of the service mesh's owner.
+* `resourceOwner` - Resource owner's AWS account ID.
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import App Mesh service meshes using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import App Mesh service meshes using the `name`. For example:
+
+```console
+% terraform import aws_appmesh_mesh.simple simpleapp
+```
+
+<!-- cache-key: cdktf-0.18.0 input-3173e5025bf46613bb3d81fd897c112506cd0123d7fe3d3c9ffea66ee2187a85 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/appmesh_route.html.markdown b/website/docs/cdktf/typescript/r/appmesh_route.html.markdown
new file mode 100644
index 00000000000..3baf4f516ff
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/appmesh_route.html.markdown
@@ -0,0 +1,398 @@
+---
+subcategory: "App Mesh"
+layout: "aws"
+page_title: "AWS: aws_appmesh_route"
+description: |-
+  Provides an AWS App Mesh route resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_appmesh_route
+
+Provides an AWS App Mesh route resource.
+
+## Example Usage
+
+### HTTP Routing
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AppmeshRoute } from "./.gen/providers/aws/appmesh-route";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AppmeshRoute(this, "serviceb", {
+      meshName: simple.id,
+      name: "serviceB-route",
+      spec: {
+        httpRoute: {
+          action: {
+            weightedTarget: [
+              {
+                virtualNode: serviceb1.name,
+                weight: 90,
+              },
+              {
+                virtualNode: serviceb2.name,
+                weight: 10,
+              },
+            ],
+          },
+          match: {
+            prefix: "/",
+          },
+        },
+      },
+      virtualRouterName: Token.asString(awsAppmeshVirtualRouterServiceb.name),
+    });
+  }
+}
+
+```
+
+### HTTP Header Routing
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AppmeshRoute } from "./.gen/providers/aws/appmesh-route";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AppmeshRoute(this, "serviceb", {
+      meshName: simple.id,
+      name: "serviceB-route",
+      spec: {
+        httpRoute: {
+          action: {
+            weightedTarget: [
+              {
+                virtualNode: Token.asString(awsAppmeshVirtualNodeServiceb.name),
+                weight: 100,
+              },
+            ],
+          },
+          match: {
+            header: [
+              {
+                match: {
+                  prefix: "123",
+                },
+                name: "clientRequestId",
+              },
+            ],
+            method: "POST",
+            prefix: "/",
+            scheme: "https",
+          },
+        },
+      },
+      virtualRouterName: Token.asString(awsAppmeshVirtualRouterServiceb.name),
+    });
+  }
+}
+
+```
+
+### Retry Policy
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AppmeshRoute } from "./.gen/providers/aws/appmesh-route";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AppmeshRoute(this, "serviceb", {
+      meshName: simple.id,
+      name: "serviceB-route",
+      spec: {
+        httpRoute: {
+          action: {
+            weightedTarget: [
+              {
+                virtualNode: Token.asString(awsAppmeshVirtualNodeServiceb.name),
+                weight: 100,
+              },
+            ],
+          },
+          match: {
+            prefix: "/",
+          },
+          retryPolicy: {
+            httpRetryEvents: ["server-error"],
+            maxRetries: 1,
+            perRetryTimeout: {
+              unit: "s",
+              value: 15,
+            },
+          },
+        },
+      },
+      virtualRouterName: Token.asString(awsAppmeshVirtualRouterServiceb.name),
+    });
+  }
+}
+
+```
+
+### TCP Routing
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AppmeshRoute } from "./.gen/providers/aws/appmesh-route";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AppmeshRoute(this, "serviceb", {
+      meshName: simple.id,
+      name: "serviceB-route",
+      spec: {
+        tcpRoute: {
+          action: {
+            weightedTarget: [
+              {
+                virtualNode: serviceb1.name,
+                weight: 100,
+              },
+            ],
+          },
+        },
+      },
+      virtualRouterName: Token.asString(awsAppmeshVirtualRouterServiceb.name),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) Name to use for the route. Must be between 1 and 255 characters in length.
+* `meshName` - (Required) Name of the service mesh in which to create the route. Must be between 1 and 255 characters in length.
+* `meshOwner` - (Optional) AWS account ID of the service mesh's owner. Defaults to the account ID the [AWS provider][1] is currently connected to.
+* `virtualRouterName` - (Required) Name of the virtual router in which to create the route. Must be between 1 and 255 characters in length.
+* `spec` - (Required) Route specification to apply.
+* `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+The `spec` object supports the following:
+
+* `grpcRoute` - (Optional) GRPC routing information for the route.
+* `http2Route` - (Optional) HTTP/2 routing information for the route.
+* `httpRoute` - (Optional) HTTP routing information for the route.
+* `priority` - (Optional) Priority for the route, between `0` and `1000`.
+Routes are matched based on the specified value, where `0` is the highest priority.
+* `tcpRoute` - (Optional) TCP routing information for the route.
+
+The `grpcRoute` object supports the following:
+
+* `action` - (Required) Action to take if a match is determined.
+* `match` - (Required) Criteria for determining an gRPC request match.
+* `retryPolicy` - (Optional) Retry policy.
+* `timeout` - (Optional) Types of timeouts.
+
+The `http2Route` and `httpRoute` objects supports the following:
+
+* `action` - (Required) Action to take if a match is determined.
+* `match` - (Required) Criteria for determining an HTTP request match.
+* `retryPolicy` - (Optional) Retry policy.
+* `timeout` - (Optional) Types of timeouts.
+
+The `tcpRoute` object supports the following:
+
+* `action` - (Required) Action to take if a match is determined.
+* `timeout` - (Optional) Types of timeouts.
+
+The `action` object supports the following:
+
+* `weightedTarget` - (Required) Targets that traffic is routed to when a request matches the route.
+You can specify one or more targets and their relative weights with which to distribute traffic.
+
+The `timeout` object supports the following:
+
+* `idle` - (Optional) Idle timeout. An idle timeout bounds the amount of time that a connection may be idle.
+
+The `idle` object supports the following:
+
+* `unit` - (Required) Unit of time. Valid values: `ms`, `s`.
+* `value` - (Required) Number of time units. Minimum value of `0`.
+
+The `grpcRoute`'s `match` object supports the following:
+
+* `metadata` - (Optional) Data to match from the gRPC request.
+* `methodName` - (Optional) Method name to match from the request. If you specify a name, you must also specify a `serviceName`.
+* `serviceName` - (Optional) Fully qualified domain name for the service to match from the request.
+* `port`- (Optional) The port number to match from the request.
+
+The `metadata` object supports the following:
+
+* `name` - (Required) Name of the route. Must be between 1 and 50 characters in length.
+* `invert` - (Optional) If `true`, the match is on the opposite of the `match` criteria. Default is `false`.
+* `match` - (Optional) Data to match from the request.
+
+The `metadata`'s `match` object supports the following:
+
+* `exact` - (Optional) Value sent by the client must match the specified value exactly. Must be between 1 and 255 characters in length.
+* `prefix` - (Optional) Value sent by the client must begin with the specified characters. Must be between 1 and 255 characters in length.
+* `port`- (Optional) The port number to match from the request.
+* `range`- (Optional) Object that specifies the range of numbers that the value sent by the client must be included in.
+* `regex` - (Optional) Value sent by the client must include the specified characters. Must be between 1 and 255 characters in length.
+* `suffix` - (Optional) Value sent by the client must end with the specified characters. Must be between 1 and 255 characters in length.
+
+The `grpcRoute`'s `retryPolicy` object supports the following:
+
+* `grpcRetryEvents` - (Optional) List of gRPC retry events.
+Valid values: `cancelled`, `deadlineExceeded`, `internal`, `resourceExhausted`, `unavailable`.
+* `httpRetryEvents` - (Optional) List of HTTP retry events.
+Valid values: `clientError` (HTTP status code 409), `gatewayError` (HTTP status codes 502, 503, and 504), `serverError` (HTTP status codes 500, 501, 502, 503, 504, 505, 506, 507, 508, 510, and 511), `streamError` (retry on refused stream).
+* `maxRetries` - (Required) Maximum number of retries.
+* `perRetryTimeout` - (Required) Per-retry timeout.
+* `tcpRetryEvents` - (Optional) List of TCP retry events. The only valid value is `connectionError`.
+
+The `grpcRoute`'s `timeout` object supports the following:
+
+* `idle` - (Optional) Idle timeout. An idle timeout bounds the amount of time that a connection may be idle.
+* `perRequest` - (Optional) Per request timeout.
+
+The `idle` and `perRequest` objects support the following:
+
+* `unit` - (Required) Unit of time. Valid values: `ms`, `s`.
+* `value` - (Required) Number of time units. Minimum value of `0`.
+
+The `http2Route` and `httpRoute`'s `match` object supports the following:
+
+* `prefix` - (Optional) Path with which to match requests.
+This parameter must always start with /, which by itself matches all requests to the virtual router service name.
+* `port`- (Optional) The port number to match from the request.
+* `header` - (Optional) Client request headers to match on.
+* `method` - (Optional) Client request header method to match on. Valid values: `get`, `head`, `post`, `put`, `delete`, `connect`, `options`, `trace`, `patch`.
+* `path` - (Optional) Client request path to match on.
+* `queryParameter` - (Optional) Client request query parameters to match on.
+* `scheme` - (Optional) Client request header scheme to match on. Valid values: `http`, `https`.
+
+The `match`'s `path` object supports the following:
+
+* `exact` - (Optional) The exact path to match on.
+* `regex` - (Optional) The regex used to match the path.
+
+The `match`'s `queryParameter` object supports the following:
+
+* `name` - (Required) Name for the query parameter that will be matched on.
+* `match` - (Optional) The query parameter to match on.
+
+The `queryParameter`'s `match` object supports the following:
+
+* `exact` - (Optional) The exact query parameter to match on.
+
+The `http2Route` and `httpRoute`'s `retryPolicy` object supports the following:
+
+* `httpRetryEvents` - (Optional) List of HTTP retry events.
+Valid values: `clientError` (HTTP status code 409), `gatewayError` (HTTP status codes 502, 503, and 504), `serverError` (HTTP status codes 500, 501, 502, 503, 504, 505, 506, 507, 508, 510, and 511), `streamError` (retry on refused stream).
+* `maxRetries` - (Required) Maximum number of retries.
+* `perRetryTimeout` - (Required) Per-retry timeout.
+* `tcpRetryEvents` - (Optional) List of TCP retry events. The only valid value is `connectionError`.
+
+You must specify at least one value for `httpRetryEvents`, or at least one value for `tcpRetryEvents`.
+
+The `http2Route` and `httpRoute`'s `timeout` object supports the following:
+
+* `idle` - (Optional) Idle timeout. An idle timeout bounds the amount of time that a connection may be idle.
+* `perRequest` - (Optional) Per request timeout.
+
+The `idle` and `perRequest` objects support the following:
+
+* `unit` - (Required) Unit of time. Valid values: `ms`, `s`.
+* `value` - (Required) Number of time units. Minimum value of `0`.
+
+The `perRetryTimeout` object supports the following:
+
+* `unit` - (Required) Retry unit. Valid values: `ms`, `s`.
+* `value` - (Required) Retry value.
+
+The `weightedTarget` object supports the following:
+
+* `virtualNode` - (Required) Virtual node to associate with the weighted target. Must be between 1 and 255 characters in length.
+* `weight` - (Required) Relative weight of the weighted target. An integer between 0 and 100.
+* `port` - (Optional) The targeted port of the weighted object.
+
+The `header` object supports the following:
+
+* `name` - (Required) Name for the HTTP header in the client request that will be matched on.
+* `invert` - (Optional) If `true`, the match is on the opposite of the `match` method and value. Default is `false`.
+* `match` - (Optional) Method and value to match the header value sent with a request. Specify one match method.
+
+The `header`'s `match` object supports the following:
+
+* `exact` - (Optional) Header value sent by the client must match the specified value exactly.
+* `prefix` - (Optional) Header value sent by the client must begin with the specified characters.
+* `port`- (Optional) The port number to match from the request.
+* `range`- (Optional) Object that specifies the range of numbers that the header value sent by the client must be included in.
+* `regex` - (Optional) Header value sent by the client must include the specified characters.
+* `suffix` - (Optional) Header value sent by the client must end with the specified characters.
+
+The `range` object supports the following:
+
+* `end` - (Required) End of the range.
+* `start` - (Requited) Start of the range.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the route.
+* `arn` - ARN of the route.
+* `createdDate` - Creation date of the route.
+* `lastUpdatedDate` - Last update date of the route.
+* `resourceOwner` - Resource owner's AWS account ID.
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import App Mesh virtual routes using `meshName` and `virtualRouterName` together with the route's `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import App Mesh virtual routes using `meshName` and `virtualRouterName` together with the route's `name`. For example:
+
+```console
+% terraform import aws_appmesh_route.serviceb simpleapp/serviceB/serviceB-route
+```
+
+[1]: /docs/providers/aws/index.html
+
+<!-- cache-key: cdktf-0.18.0 input-80e17b52a5e66a8d0e459a22b8228d6395a8847cf0270d3e66fc0d8a47b1bb28 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/appmesh_virtual_gateway.html.markdown b/website/docs/cdktf/typescript/r/appmesh_virtual_gateway.html.markdown
new file mode 100644
index 00000000000..2f0f12737f8
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/appmesh_virtual_gateway.html.markdown
@@ -0,0 +1,327 @@
+---
+subcategory: "App Mesh"
+layout: "aws"
+page_title: "AWS: aws_appmesh_virtual_gateway"
+description: |-
+  Provides an AWS App Mesh virtual gateway resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_appmesh_virtual_gateway
+
+Provides an AWS App Mesh virtual gateway resource.
+
+## Example Usage
+
+### Basic
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AppmeshVirtualGateway } from "./.gen/providers/aws/appmesh-virtual-gateway";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AppmeshVirtualGateway(this, "example", {
+      meshName: "example-service-mesh",
+      name: "example-virtual-gateway",
+      spec: {
+        listener: [
+          {
+            portMapping: {
+              port: 8080,
+              protocol: "http",
+            },
+          },
+        ],
+      },
+      tags: {
+        Environment: "test",
+      },
+    });
+  }
+}
+
+```
+
+### Access Logs and TLS
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AppmeshVirtualGateway } from "./.gen/providers/aws/appmesh-virtual-gateway";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AppmeshVirtualGateway(this, "example", {
+      meshName: "example-service-mesh",
+      name: "example-virtual-gateway",
+      spec: {
+        listener: [
+          {
+            portMapping: {
+              port: 8080,
+              protocol: "http",
+            },
+            tls: {
+              certificate: {
+                acm: {
+                  certificateArn: Token.asString(awsAcmCertificateExample.arn),
+                },
+              },
+              mode: "STRICT",
+            },
+          },
+        ],
+        logging: {
+          accessLog: {
+            file: {
+              path: "/var/log/access.log",
+            },
+          },
+        },
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) Name to use for the virtual gateway. Must be between 1 and 255 characters in length.
+* `meshName` - (Required) Name of the service mesh in which to create the virtual gateway. Must be between 1 and 255 characters in length.
+* `meshOwner` - (Optional) AWS account ID of the service mesh's owner. Defaults to the account ID the [AWS provider][1] is currently connected to.
+* `spec` - (Required) Virtual gateway specification to apply.
+* `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+The `spec` object supports the following:
+
+* `listener` - (Required) Listeners that the mesh endpoint is expected to receive inbound traffic from. You can specify one listener.
+* `backendDefaults` - (Optional) Defaults for backends.
+* `logging` - (Optional) Inbound and outbound access logging information for the virtual gateway.
+
+The `backendDefaults` object supports the following:
+
+* `clientPolicy` - (Optional) Default client policy for virtual gateway backends.
+
+The `clientPolicy` object supports the following:
+
+* `tls` - (Optional) Transport Layer Security (TLS) client policy.
+
+The `tls` object supports the following:
+
+* `certificate` (Optional) Virtual gateway's client's Transport Layer Security (TLS) certificate.
+* `enforce` - (Optional) Whether the policy is enforced. Default is `true`.
+* `ports` - (Optional) One or more ports that the policy is enforced for.
+* `validation` - (Required) TLS validation context.
+
+The `certificate` object supports the following:
+
+* `file` - (Optional) Local file certificate.
+* `sds` - (Optional) A [Secret Discovery Service](https://www.envoyproxy.io/docs/envoy/latest/configuration/security/secret#secret-discovery-service-sds) certificate.
+
+The `file` object supports the following:
+
+* `certificateChain` - (Required) Certificate chain for the certificate.
+* `privateKey` - (Required) Private key for a certificate stored on the file system of the mesh endpoint that the proxy is running on.
+
+The `sds` object supports the following:
+
+* `secretName` - (Required) Name of the secret secret requested from the Secret Discovery Service provider representing Transport Layer Security (TLS) materials like a certificate or certificate chain.
+
+The `validation` object supports the following:
+
+* `subjectAlternativeNames` - (Optional) SANs for a virtual gateway's listener's Transport Layer Security (TLS) validation context.
+* `trust` - (Required) TLS validation context trust.
+
+The `subjectAlternativeNames` object supports the following:
+
+* `match` - (Required) Criteria for determining a SAN's match.
+
+The `match` object supports the following:
+
+* `exact` - (Required) Values sent must match the specified values exactly.
+
+The `trust` object supports the following:
+
+* `acm` - (Optional) TLS validation context trust for an AWS Certificate Manager (ACM) certificate.
+* `file` - (Optional) TLS validation context trust for a local file certificate.
+* `sds` - (Optional) TLS validation context trust for a [Secret Discovery Service](https://www.envoyproxy.io/docs/envoy/latest/configuration/security/secret#secret-discovery-service-sds) certificate.
+
+The `acm` object supports the following:
+
+* `certificateAuthorityArns` - (Required) One or more ACM ARNs.
+
+The `file` object supports the following:
+
+* `certificateChain` - (Required) Certificate trust chain for a certificate stored on the file system of the mesh endpoint that the proxy is running on. Must be between 1 and 255 characters in length.
+
+The `sds` object supports the following:
+
+* `secretName` - (Required) Name of the secret for a virtual gateway's Transport Layer Security (TLS) Secret Discovery Service validation context trust.
+
+The `listener` object supports the following:
+
+* `portMapping` - (Required) Port mapping information for the listener.
+* `connectionPool` - (Optional) Connection pool information for the listener.
+* `healthCheck` - (Optional) Health check information for the listener.
+* `tls` - (Optional) Transport Layer Security (TLS) properties for the listener
+
+The `logging` object supports the following:
+
+* `accessLog` - (Optional) Access log configuration for a virtual gateway.
+
+The `accessLog` object supports the following:
+
+* `file` - (Optional) File object to send virtual gateway access logs to.
+
+The `file` object supports the following:
+
+* `format` - (Optional) The specified format for the logs.
+* `path` - (Required) File path to write access logs to. You can use `/dev/stdout` to send access logs to standard out. Must be between 1 and 255 characters in length.
+
+The `format` object supports the following:
+
+* `json` - (Optional) The logging format for JSON.
+* `text` - (Optional) The logging format for text. Must be between 1 and 1000 characters in length.
+
+The `json` object supports the following:
+
+* `key` - (Required) The specified key for the JSON. Must be between 1 and 100 characters in length.
+* `value` - (Required) The specified value for the JSON. Must be between 1 and 100 characters in length.
+
+The `portMapping` object supports the following:
+
+* `port` - (Required) Port used for the port mapping.
+* `protocol` - (Required) Protocol used for the port mapping. Valid values are `http`, `http2`, `tcp` and `grpc`.
+
+The `connectionPool` object supports the following:
+
+* `grpc` - (Optional) Connection pool information for gRPC listeners.
+* `http` - (Optional) Connection pool information for HTTP listeners.
+* `http2` - (Optional) Connection pool information for HTTP2 listeners.
+
+The `grpc` connection pool object supports the following:
+
+* `maxRequests` - (Required) Maximum number of inflight requests Envoy can concurrently support across hosts in upstream cluster. Minimum value of `1`.
+
+The `http` connection pool object supports the following:
+
+* `maxConnections` - (Required) Maximum number of outbound TCP connections Envoy can establish concurrently with all hosts in upstream cluster. Minimum value of `1`.
+* `maxPendingRequests` - (Optional) Number of overflowing requests after `maxConnections` Envoy will queue to upstream cluster. Minimum value of `1`.
+
+The `http2` connection pool object supports the following:
+
+* `maxRequests` - (Required) Maximum number of inflight requests Envoy can concurrently support across hosts in upstream cluster. Minimum value of `1`.
+
+The `healthCheck` object supports the following:
+
+* `healthyThreshold` - (Required) Number of consecutive successful health checks that must occur before declaring listener healthy.
+* `intervalMillis`- (Required) Time period in milliseconds between each health check execution.
+* `protocol` - (Required) Protocol for the health check request. Valid values are `http`, `http2`, and `grpc`.
+* `timeoutMillis` - (Required) Amount of time to wait when receiving a response from the health check, in milliseconds.
+* `unhealthyThreshold` - (Required) Number of consecutive failed health checks that must occur before declaring a virtual gateway unhealthy.
+* `path` - (Optional) Destination path for the health check request. This is only required if the specified protocol is `http` or `http2`.
+* `port` - (Optional) Destination port for the health check request. This port must match the port defined in the `portMapping` for the listener.
+
+The `tls` object supports the following:
+
+* `certificate` - (Required) Listener's TLS certificate.
+* `mode`- (Required) Listener's TLS mode. Valid values: `disabled`, `permissive`, `strict`.
+* `validation`- (Optional) Listener's Transport Layer Security (TLS) validation context.
+
+The `certificate` object supports the following:
+
+* `acm` - (Optional) An AWS Certificate Manager (ACM) certificate.
+* `file` - (Optional) Local file certificate.
+* `sds` - (Optional) A [Secret Discovery Service](https://www.envoyproxy.io/docs/envoy/latest/configuration/security/secret#secret-discovery-service-sds) certificate.
+
+The `acm` object supports the following:
+
+* `certificateArn` - (Required) ARN for the certificate.
+
+The `file` object supports the following:
+
+* `certificateChain` - (Required) Certificate chain for the certificate. Must be between 1 and 255 characters in length.
+* `privateKey` - (Required) Private key for a certificate stored on the file system of the mesh endpoint that the proxy is running on. Must be between 1 and 255 characters in length.
+
+The `sds` object supports the following:
+
+* `secretName` - (Required) Name of the secret secret requested from the Secret Discovery Service provider representing Transport Layer Security (TLS) materials like a certificate or certificate chain.
+
+The `validation` object supports the following:
+
+* `subjectAlternativeNames` - (Optional) SANs for a virtual gateway's listener's Transport Layer Security (TLS) validation context.
+* `trust` - (Required) TLS validation context trust.
+
+The `subjectAlternativeNames` object supports the following:
+
+* `match` - (Required) Criteria for determining a SAN's match.
+
+The `match` object supports the following:
+
+* `exact` - (Required) Values sent must match the specified values exactly.
+
+The `trust` object supports the following:
+
+* `file` - (Optional) TLS validation context trust for a local file certificate.
+* `sds` - (Optional) TLS validation context trust for a [Secret Discovery Service](https://www.envoyproxy.io/docs/envoy/latest/configuration/security/secret#secret-discovery-service-sds) certificate.
+
+The `file` object supports the following:
+
+* `certificateChain` - (Required) Certificate trust chain for a certificate stored on the file system of the mesh endpoint that the proxy is running on. Must be between 1 and 255 characters in length.
+
+The `sds` object supports the following:
+
+* `secretName` - (Required) Name of the secret for a virtual gateway's Transport Layer Security (TLS) Secret Discovery Service validation context trust.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the virtual gateway.
+* `arn` - ARN of the virtual gateway.
+* `createdDate` - Creation date of the virtual gateway.
+* `lastUpdatedDate` - Last update date of the virtual gateway.
+* `resourceOwner` - Resource owner's AWS account ID.
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import App Mesh virtual gateway using `meshName` together with the virtual gateway's `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import App Mesh virtual gateway using `meshName` together with the virtual gateway's `name`. For example:
+
+```console
+% terraform import aws_appmesh_virtual_gateway.example mesh/gw1
+```
+
+[1]: /docs/providers/aws/index.html
+
+<!-- cache-key: cdktf-0.18.0 input-0f019884935cffb4e15faa186fec437bbd1c1ed08bbdf658cac478d98a5253e8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/appmesh_virtual_node.html.markdown b/website/docs/cdktf/typescript/r/appmesh_virtual_node.html.markdown
new file mode 100644
index 00000000000..21331d7d67c
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/appmesh_virtual_node.html.markdown
@@ -0,0 +1,542 @@
+---
+subcategory: "App Mesh"
+layout: "aws"
+page_title: "AWS: aws_appmesh_virtual_node"
+description: |-
+  Provides an AWS App Mesh virtual node resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_appmesh_virtual_node
+
+Provides an AWS App Mesh virtual node resource.
+
+## Breaking Changes
+
+Because of backward incompatible API changes (read [here](https://github.com/awslabs/aws-app-mesh-examples/issues/92)), `awsAppmeshVirtualNode` resource definitions created with provider versions earlier than v2.3.0 will need to be modified:
+
+* Rename the `serviceName` attribute of the `dns` object to `hostname`.
+
+* Replace the `backends` attribute of the `spec` object with one or more `backend` configuration blocks,
+setting `virtualServiceName` to the name of the service.
+
+The Terraform state associated with existing resources will automatically be migrated.
+
+## Example Usage
+
+### Basic
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AppmeshVirtualNode } from "./.gen/providers/aws/appmesh-virtual-node";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AppmeshVirtualNode(this, "serviceb1", {
+      meshName: simple.id,
+      name: "serviceBv1",
+      spec: {
+        backend: [
+          {
+            virtualService: {
+              virtualServiceName: "servicea.simpleapp.local",
+            },
+          },
+        ],
+        listener: [
+          {
+            portMapping: {
+              port: 8080,
+              protocol: "http",
+            },
+          },
+        ],
+        serviceDiscovery: {
+          dns: {
+            hostname: "serviceb.simpleapp.local",
+          },
+        },
+      },
+    });
+  }
+}
+
+```
+
+### AWS Cloud Map Service Discovery
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AppmeshVirtualNode } from "./.gen/providers/aws/appmesh-virtual-node";
+import { ServiceDiscoveryHttpNamespace } from "./.gen/providers/aws/service-discovery-http-namespace";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new ServiceDiscoveryHttpNamespace(this, "example", {
+      name: "example-ns",
+    });
+    new AppmeshVirtualNode(this, "serviceb1", {
+      meshName: simple.id,
+      name: "serviceBv1",
+      spec: {
+        backend: [
+          {
+            virtualService: {
+              virtualServiceName: "servicea.simpleapp.local",
+            },
+          },
+        ],
+        listener: [
+          {
+            portMapping: {
+              port: 8080,
+              protocol: "http",
+            },
+          },
+        ],
+        serviceDiscovery: {
+          awsCloudMap: {
+            attributes: {
+              stack: "blue",
+            },
+            namespaceName: example.name,
+            serviceName: "serviceb1",
+          },
+        },
+      },
+    });
+  }
+}
+
+```
+
+### Listener Health Check
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AppmeshVirtualNode } from "./.gen/providers/aws/appmesh-virtual-node";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AppmeshVirtualNode(this, "serviceb1", {
+      meshName: simple.id,
+      name: "serviceBv1",
+      spec: {
+        backend: [
+          {
+            virtualService: {
+              virtualServiceName: "servicea.simpleapp.local",
+            },
+          },
+        ],
+        listener: [
+          {
+            healthCheck: {
+              healthyThreshold: 2,
+              intervalMillis: 5000,
+              path: "/ping",
+              protocol: "http",
+              timeoutMillis: 2000,
+              unhealthyThreshold: 2,
+            },
+            portMapping: {
+              port: 8080,
+              protocol: "http",
+            },
+          },
+        ],
+        serviceDiscovery: {
+          dns: {
+            hostname: "serviceb.simpleapp.local",
+          },
+        },
+      },
+    });
+  }
+}
+
+```
+
+### Logging
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AppmeshVirtualNode } from "./.gen/providers/aws/appmesh-virtual-node";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AppmeshVirtualNode(this, "serviceb1", {
+      meshName: simple.id,
+      name: "serviceBv1",
+      spec: {
+        backend: [
+          {
+            virtualService: {
+              virtualServiceName: "servicea.simpleapp.local",
+            },
+          },
+        ],
+        listener: [
+          {
+            portMapping: {
+              port: 8080,
+              protocol: "http",
+            },
+          },
+        ],
+        logging: {
+          accessLog: {
+            file: {
+              path: "/dev/stdout",
+            },
+          },
+        },
+        serviceDiscovery: {
+          dns: {
+            hostname: "serviceb.simpleapp.local",
+          },
+        },
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) Name to use for the virtual node. Must be between 1 and 255 characters in length.
+* `meshName` - (Required) Name of the service mesh in which to create the virtual node. Must be between 1 and 255 characters in length.
+* `meshOwner` - (Optional) AWS account ID of the service mesh's owner. Defaults to the account ID the [AWS provider][1] is currently connected to.
+* `spec` - (Required) Virtual node specification to apply.
+* `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+The `spec` object supports the following:
+
+* `backend` - (Optional) Backends to which the virtual node is expected to send outbound traffic.
+* `backendDefaults` - (Optional) Defaults for backends.
+* `listener` - (Optional) Listeners from which the virtual node is expected to receive inbound traffic.
+* `logging` - (Optional) Inbound and outbound access logging information for the virtual node.
+* `serviceDiscovery` - (Optional) Service discovery information for the virtual node.
+
+The `backend` object supports the following:
+
+* `virtualService` - (Required) Virtual service to use as a backend for a virtual node.
+
+The `virtualService` object supports the following:
+
+* `clientPolicy` - (Optional) Client policy for the backend.
+* `virtualServiceName` - (Required) Name of the virtual service that is acting as a virtual node backend. Must be between 1 and 255 characters in length.
+
+The `clientPolicy` object supports the following:
+
+* `tls` - (Optional) Transport Layer Security (TLS) client policy.
+
+The `tls` object supports the following:
+
+* `certificate` (Optional) Virtual node's client's Transport Layer Security (TLS) certificate.
+* `enforce` - (Optional) Whether the policy is enforced. Default is `true`.
+* `ports` - (Optional) One or more ports that the policy is enforced for.
+* `validation` - (Required) TLS validation context.
+
+The `certificate` object supports the following:
+
+* `file` - (Optional) Local file certificate.
+* `sds` - (Optional) A [Secret Discovery Service](https://www.envoyproxy.io/docs/envoy/latest/configuration/security/secret#secret-discovery-service-sds) certificate.
+
+The `file` object supports the following:
+
+* `certificateChain` - (Required) Certificate chain for the certificate.
+* `privateKey` - (Required) Private key for a certificate stored on the file system of the mesh endpoint that the proxy is running on.
+
+The `sds` object supports the following:
+
+* `secretName` - (Required) Name of the secret secret requested from the Secret Discovery Service provider representing Transport Layer Security (TLS) materials like a certificate or certificate chain.
+
+The `validation` object supports the following:
+
+* `subjectAlternativeNames` - (Optional) SANs for a TLS validation context.
+* `trust` - (Required) TLS validation context trust.
+
+The `subjectAlternativeNames` object supports the following:
+
+* `match` - (Required) Criteria for determining a SAN's match.
+
+The `match` object supports the following:
+
+* `exact` - (Required) Values sent must match the specified values exactly.
+
+The `trust` object supports the following:
+
+* `acm` - (Optional) TLS validation context trust for an AWS Certificate Manager (ACM) certificate.
+* `file` - (Optional) TLS validation context trust for a local file certificate.
+* `sds` - (Optional) TLS validation context trust for a [Secret Discovery Service](https://www.envoyproxy.io/docs/envoy/latest/configuration/security/secret#secret-discovery-service-sds) certificate.
+
+The `acm` object supports the following:
+
+* `certificateAuthorityArns` - (Required) One or more ACM ARNs.
+
+The `file` object supports the following:
+
+* `certificateChain` - (Required) Certificate trust chain for a certificate stored on the file system of the virtual node that the proxy is running on. Must be between 1 and 255 characters in length.
+
+The `sds` object supports the following:
+
+* `secretName` - (Required) Name of the secret secret requested from the Secret Discovery Service provider representing Transport Layer Security (TLS) materials like a certificate or certificate chain.
+
+The `backendDefaults` object supports the following:
+
+* `clientPolicy` - (Optional) Default client policy for virtual service backends. See above for details.
+
+The `listener` object supports the following:
+
+* `portMapping` - (Required) Port mapping information for the listener.
+* `connectionPool` - (Optional) Connection pool information for the listener.
+* `healthCheck` - (Optional) Health check information for the listener.
+* `outlierDetection` - (Optional) Outlier detection information for the listener.
+* `timeout` - (Optional) Timeouts for different protocols.
+* `tls` - (Optional) Transport Layer Security (TLS) properties for the listener
+
+The `logging` object supports the following:
+
+* `accessLog` - (Optional) Access log configuration for a virtual node.
+
+The `accessLog` object supports the following:
+
+* `file` - (Optional) File object to send virtual node access logs to.
+
+The `file` object supports the following:
+
+* `format` - (Optional) The specified format for the logs.
+* `path` - (Required) File path to write access logs to. You can use `/dev/stdout` to send access logs to standard out. Must be between 1 and 255 characters in length.
+
+The `format` object supports the following:
+
+* `json` - (Optional) The logging format for JSON.
+* `text` - (Optional) The logging format for text. Must be between 1 and 1000 characters in length.
+
+The `json` object supports the following:
+
+* `key` - (Required) The specified key for the JSON. Must be between 1 and 100 characters in length.
+* `value` - (Required) The specified value for the JSON. Must be between 1 and 100 characters in length.
+
+The `serviceDiscovery` object supports the following:
+
+* `awsCloudMap` - (Optional) Any AWS Cloud Map information for the virtual node.
+* `dns` - (Optional) DNS service name for the virtual node.
+
+The `awsCloudMap` object supports the following:
+
+* `attributes` - (Optional) String map that contains attributes with values that you can use to filter instances by any custom attribute that you specified when you registered the instance. Only instances that match all of the specified key/value pairs will be returned.
+* `namespaceName` - (Required) Name of the AWS Cloud Map namespace to use.
+Use the [`awsServiceDiscoveryHttpNamespace`](/docs/providers/aws/r/service_discovery_http_namespace.html) resource to configure a Cloud Map namespace. Must be between 1 and 1024 characters in length.
+* `serviceName` - (Required) Name of the AWS Cloud Map service to use. Use the [`awsServiceDiscoveryService`](/docs/providers/aws/r/service_discovery_service.html) resource to configure a Cloud Map service. Must be between 1 and 1024 characters in length.
+
+The `dns` object supports the following:
+
+* `hostname` - (Required) DNS host name for your virtual node.
+* `ipPreference` - (Optional) The preferred IP version that this virtual node uses. Valid values: `iPv6Preferred`, `iPv4Preferred`, `iPv4Only`, `iPv6Only`.
+* `responseType` - (Optional) The DNS response type for the virtual node. Valid values: `loadbalancer`, `endpoints`.
+
+The `portMapping` object supports the following:
+
+* `port` - (Required) Port used for the port mapping.
+* `protocol` - (Required) Protocol used for the port mapping. Valid values are `http`, `http2`, `tcp` and `grpc`.
+
+The `connectionPool` object supports the following:
+
+* `grpc` - (Optional) Connection pool information for gRPC listeners.
+* `http` - (Optional) Connection pool information for HTTP listeners.
+* `http2` - (Optional) Connection pool information for HTTP2 listeners.
+* `tcp` - (Optional) Connection pool information for TCP listeners.
+
+The `grpc` connection pool object supports the following:
+
+* `maxRequests` - (Required) Maximum number of inflight requests Envoy can concurrently support across hosts in upstream cluster. Minimum value of `1`.
+
+The `http` connection pool object supports the following:
+
+* `maxConnections` - (Required) Maximum number of outbound TCP connections Envoy can establish concurrently with all hosts in upstream cluster. Minimum value of `1`.
+* `maxPendingRequests` - (Optional) Number of overflowing requests after `maxConnections` Envoy will queue to upstream cluster. Minimum value of `1`.
+
+The `http2` connection pool object supports the following:
+
+* `maxRequests` - (Required) Maximum number of inflight requests Envoy can concurrently support across hosts in upstream cluster. Minimum value of `1`.
+
+The `tcp` connection pool object supports the following:
+
+* `maxConnections` - (Required) Maximum number of outbound TCP connections Envoy can establish concurrently with all hosts in upstream cluster. Minimum value of `1`.
+
+The `healthCheck` object supports the following:
+
+* `healthyThreshold` - (Required) Number of consecutive successful health checks that must occur before declaring listener healthy.
+* `intervalMillis`- (Required) Time period in milliseconds between each health check execution.
+* `protocol` - (Required) Protocol for the health check request. Valid values are `http`, `http2`, `tcp` and `grpc`.
+* `timeoutMillis` - (Required) Amount of time to wait when receiving a response from the health check, in milliseconds.
+* `unhealthyThreshold` - (Required) Number of consecutive failed health checks that must occur before declaring a virtual node unhealthy.
+* `path` - (Optional) Destination path for the health check request. This is only required if the specified protocol is `http` or `http2`.
+* `port` - (Optional) Destination port for the health check request. This port must match the port defined in the `portMapping` for the listener.
+
+The `outlierDetection` object supports the following:
+
+* `baseEjectionDuration` - (Required) Base amount of time for which a host is ejected.
+* `interval` - (Required) Time interval between ejection sweep analysis.
+* `maxEjectionPercent` - (Required) Maximum percentage of hosts in load balancing pool for upstream service that can be ejected. Will eject at least one host regardless of the value.
+Minimum value of `0`. Maximum value of `100`.
+* `maxServerErrors` - (Required) Number of consecutive `5Xx` errors required for ejection. Minimum value of `1`.
+
+The `baseEjectionDuration` and `interval` objects support the following:
+
+* `unit` - (Required) Unit of time. Valid values: `ms`, `s`.
+* `value` - (Required) Number of time units. Minimum value of `0`.
+
+The `timeout` object supports the following:
+
+* `grpc` - (Optional) Timeouts for gRPC listeners.
+* `http` - (Optional) Timeouts for HTTP listeners.
+* `http2` - (Optional) Timeouts for HTTP2 listeners.
+* `tcp` - (Optional) Timeouts for TCP listeners.
+
+The `grpc` timeout object supports the following:
+
+* `idle` - (Optional) Idle timeout. An idle timeout bounds the amount of time that a connection may be idle.
+* `perRequest` - (Optional) Per request timeout.
+
+The `idle` and `perRequest` objects support the following:
+
+* `unit` - (Required) Unit of time. Valid values: `ms`, `s`.
+* `value` - (Required) Number of time units. Minimum value of `0`.
+
+The `http` and `http2` timeout objects support the following:
+
+* `idle` - (Optional) Idle timeout. An idle timeout bounds the amount of time that a connection may be idle.
+* `perRequest` - (Optional) Per request timeout.
+
+The `idle` and `perRequest` objects support the following:
+
+* `unit` - (Required) Unit of time. Valid values: `ms`, `s`.
+* `value` - (Required) Number of time units. Minimum value of `0`.
+
+The `tcp` timeout object supports the following:
+
+* `idle` - (Optional) Idle timeout. An idle timeout bounds the amount of time that a connection may be idle.
+
+The `idle` object supports the following:
+
+* `unit` - (Required) Unit of time. Valid values: `ms`, `s`.
+* `value` - (Required) Number of time units. Minimum value of `0`.
+
+The `tls` object supports the following:
+
+* `certificate` - (Required) Listener's TLS certificate.
+* `mode`- (Required) Listener's TLS mode. Valid values: `disabled`, `permissive`, `strict`.
+* `validation`- (Optional) Listener's Transport Layer Security (TLS) validation context.
+
+The `certificate` object supports the following:
+
+* `acm` - (Optional) An AWS Certificate Manager (ACM) certificate.
+* `file` - (Optional) Local file certificate.
+* `sds` - (Optional) A [Secret Discovery Service](https://www.envoyproxy.io/docs/envoy/latest/configuration/security/secret#secret-discovery-service-sds) certificate.
+
+The `acm` object supports the following:
+
+* `certificateArn` - (Required) ARN for the certificate.
+
+The `file` object supports the following:
+
+* `certificateChain` - (Required) Certificate chain for the certificate. Must be between 1 and 255 characters in length.
+* `privateKey` - (Required) Private key for a certificate stored on the file system of the virtual node that the proxy is running on. Must be between 1 and 255 characters in length.
+
+The `sds` object supports the following:
+
+* `secretName` - (Required) Name of the secret secret requested from the Secret Discovery Service provider representing Transport Layer Security (TLS) materials like a certificate or certificate chain.
+
+The `validation` object supports the following:
+
+* `subjectAlternativeNames` - (Optional) SANs for a TLS validation context.
+* `trust` - (Required) TLS validation context trust.
+
+The `subjectAlternativeNames` object supports the following:
+
+* `match` - (Required) Criteria for determining a SAN's match.
+
+The `match` object supports the following:
+
+* `exact` - (Required) Values sent must match the specified values exactly.
+
+The `trust` object supports the following:
+
+* `file` - (Optional) TLS validation context trust for a local file certificate.
+* `sds` - (Optional) TLS validation context trust for a [Secret Discovery Service](https://www.envoyproxy.io/docs/envoy/latest/configuration/security/secret#secret-discovery-service-sds) certificate.
+
+The `file` object supports the following:
+
+* `certificateChain` - (Required) Certificate trust chain for a certificate stored on the file system of the mesh endpoint that the proxy is running on. Must be between 1 and 255 characters in length.
+
+The `sds` object supports the following:
+
+* `secretName` - (Required) Name of the secret for a virtual node's Transport Layer Security (TLS) Secret Discovery Service validation context trust.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the virtual node.
+* `arn` - ARN of the virtual node.
+* `createdDate` - Creation date of the virtual node.
+* `lastUpdatedDate` - Last update date of the virtual node.
+* `resourceOwner` - Resource owner's AWS account ID.
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import App Mesh virtual nodes using `meshName` together with the virtual node's `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import App Mesh virtual nodes using `meshName` together with the virtual node's `name`. For example:
+
+```console
+% terraform import aws_appmesh_virtual_node.serviceb1 simpleapp/serviceBv1
+```
+
+[1]: /docs/providers/aws/index.html
+
+<!-- cache-key: cdktf-0.18.0 input-024d5a96598211a97a1626c3090f4db9af8ed04ddfa8eea2600dc09cba20d3c6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/appmesh_virtual_router.html.markdown b/website/docs/cdktf/typescript/r/appmesh_virtual_router.html.markdown
new file mode 100644
index 00000000000..e84c6180393
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/appmesh_virtual_router.html.markdown
@@ -0,0 +1,117 @@
+---
+subcategory: "App Mesh"
+layout: "aws"
+page_title: "AWS: aws_appmesh_virtual_router"
+description: |-
+  Provides an AWS App Mesh virtual router resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_appmesh_virtual_router
+
+Provides an AWS App Mesh virtual router resource.
+
+## Breaking Changes
+
+Because of backward incompatible API changes (read [here](https://github.com/awslabs/aws-app-mesh-examples/issues/92) and [here](https://github.com/awslabs/aws-app-mesh-examples/issues/94)), `awsAppmeshVirtualRouter` resource definitions created with provider versions earlier than v2.3.0 will need to be modified:
+
+* Remove service `serviceNames` from the `spec` argument. AWS has created a `awsAppmeshVirtualService` resource for each service name. Import these resource using `terraform import`.
+
+* Add a `listener` configuration block to the `spec` argument.
+
+The Terraform state associated with existing resources will automatically be migrated.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AppmeshVirtualRouter } from "./.gen/providers/aws/appmesh-virtual-router";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AppmeshVirtualRouter(this, "serviceb", {
+      meshName: simple.id,
+      name: "serviceB",
+      spec: {
+        listener: [
+          {
+            portMapping: {
+              port: 8080,
+              protocol: "http",
+            },
+          },
+        ],
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) Name to use for the virtual router. Must be between 1 and 255 characters in length.
+* `meshName` - (Required) Name of the service mesh in which to create the virtual router. Must be between 1 and 255 characters in length.
+* `meshOwner` - (Optional) AWS account ID of the service mesh's owner. Defaults to the account ID the [AWS provider][1] is currently connected to.
+* `spec` - (Required) Virtual router specification to apply.
+* `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+The `spec` object supports the following:
+
+* `listener` - (Optional) Listeners that the virtual router is expected to receive inbound traffic from.
+Currently only one listener is supported per virtual router.
+
+The `listener` object supports the following:
+
+* `portMapping` - (Required) Port mapping information for the listener.
+
+The `portMapping` object supports the following:
+
+* `port` - (Required) Port used for the port mapping.
+* `protocol` - (Required) Protocol used for the port mapping. Valid values are `http`,`http2`, `tcp` and `grpc`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the virtual router.
+* `arn` - ARN of the virtual router.
+* `createdDate` - Creation date of the virtual router.
+* `lastUpdatedDate` - Last update date of the virtual router.
+* `resourceOwner` - Resource owner's AWS account ID.
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import App Mesh virtual routers using `meshName` together with the virtual router's `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import App Mesh virtual routers using `meshName` together with the virtual router's `name`. For example:
+
+```console
+% terraform import aws_appmesh_virtual_router.serviceb simpleapp/serviceB
+```
+
+[1]: /docs/providers/aws/index.html
+
+<!-- cache-key: cdktf-0.18.0 input-b6f73966761dbca6e2aaf44ef6787d712dc92b753deee4152c13d29b3071617c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/appmesh_virtual_service.html.markdown b/website/docs/cdktf/typescript/r/appmesh_virtual_service.html.markdown
new file mode 100644
index 00000000000..686398c00fc
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/appmesh_virtual_service.html.markdown
@@ -0,0 +1,139 @@
+---
+subcategory: "App Mesh"
+layout: "aws"
+page_title: "AWS: aws_appmesh_virtual_service"
+description: |-
+  Provides an AWS App Mesh virtual service resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_appmesh_virtual_service
+
+Provides an AWS App Mesh virtual service resource.
+
+## Example Usage
+
+### Virtual Node Provider
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AppmeshVirtualService } from "./.gen/providers/aws/appmesh-virtual-service";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AppmeshVirtualService(this, "servicea", {
+      meshName: simple.id,
+      name: "servicea.simpleapp.local",
+      spec: {
+        provider: {
+          virtualNode: {
+            virtualNodeName: serviceb1.name,
+          },
+        },
+      },
+    });
+  }
+}
+
+```
+
+### Virtual Router Provider
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AppmeshVirtualService } from "./.gen/providers/aws/appmesh-virtual-service";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AppmeshVirtualService(this, "servicea", {
+      meshName: simple.id,
+      name: "servicea.simpleapp.local",
+      spec: {
+        provider: {
+          virtualRouter: {
+            virtualRouterName: serviceb.name,
+          },
+        },
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) Name to use for the virtual service. Must be between 1 and 255 characters in length.
+* `meshName` - (Required) Name of the service mesh in which to create the virtual service. Must be between 1 and 255 characters in length.
+* `meshOwner` - (Optional) AWS account ID of the service mesh's owner. Defaults to the account ID the [AWS provider][1] is currently connected to.
+* `spec` - (Required) Virtual service specification to apply.
+* `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+The `spec` object supports the following:
+
+* `provider`- (Optional) App Mesh object that is acting as the provider for a virtual service. You can specify a single virtual node or virtual router.
+
+The `provider` object supports the following:
+
+* `virtualNode` - (Optional) Virtual node associated with a virtual service.
+* `virtualRouter` - (Optional) Virtual router associated with a virtual service.
+
+The `virtualNode` object supports the following:
+
+* `virtualNodeName` - (Required) Name of the virtual node that is acting as a service provider. Must be between 1 and 255 characters in length.
+
+The `virtualRouter` object supports the following:
+
+* `virtualRouterName` - (Required) Name of the virtual router that is acting as a service provider. Must be between 1 and 255 characters in length.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the virtual service.
+* `arn` - ARN of the virtual service.
+* `createdDate` - Creation date of the virtual service.
+* `lastUpdatedDate` - Last update date of the virtual service.
+* `resourceOwner` - Resource owner's AWS account ID.
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import App Mesh virtual services using `meshName` together with the virtual service's `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import App Mesh virtual services using `meshName` together with the virtual service's `name`. For example:
+
+```console
+% terraform import aws_appmesh_virtual_service.servicea simpleapp/servicea.simpleapp.local
+```
+
+[1]: /docs/providers/aws/index.html
+
+<!-- cache-key: cdktf-0.18.0 input-5fae0e103caf94ef3f122b26a776a50dc44ebd36febaccc175efd0e97ba5bdaf -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/apprunner_auto_scaling_configuration_version.html.markdown b/website/docs/cdktf/typescript/r/apprunner_auto_scaling_configuration_version.html.markdown
new file mode 100644
index 00000000000..474e5769072
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/apprunner_auto_scaling_configuration_version.html.markdown
@@ -0,0 +1,85 @@
+---
+subcategory: "App Runner"
+layout: "aws"
+page_title: "AWS: aws_apprunner_auto_scaling_configuration_version"
+description: |-
+  Manages an App Runner AutoScaling Configuration Version.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_apprunner_auto_scaling_configuration_version
+
+Manages an App Runner AutoScaling Configuration Version.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ApprunnerAutoScalingConfigurationVersion } from "./.gen/providers/aws/apprunner-auto-scaling-configuration-version";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ApprunnerAutoScalingConfigurationVersion(this, "example", {
+      autoScalingConfigurationName: "example",
+      maxConcurrency: 50,
+      maxSize: 10,
+      minSize: 2,
+      tags: {
+        Name: "example-apprunner-autoscaling",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments supported:
+
+* `autoScalingConfigurationName` - (Required, Forces new resource) Name of the auto scaling configuration.
+* `maxConcurrency` - (Optional, Forces new resource) Maximal number of concurrent requests that you want an instance to process. When the number of concurrent requests goes over this limit, App Runner scales up your service.
+* `maxSize` - (Optional, Forces new resource) Maximal number of instances that App Runner provisions for your service.
+* `minSize` - (Optional, Forces new resource) Minimal number of instances that App Runner provisions for your service.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of this auto scaling configuration version.
+* `autoScalingConfigurationRevision` - The revision of this auto scaling configuration.
+* `latest` - Whether the auto scaling configuration has the highest `autoScalingConfigurationRevision` among all configurations that share the same `autoScalingConfigurationName`.
+* `status` - Current state of the auto scaling configuration. An INACTIVE configuration revision has been deleted and can't be used. It is permanently removed some time after deletion.
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import App Runner AutoScaling Configuration Versions using the `arn`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import App Runner AutoScaling Configuration Versions using the `arn`. For example:
+
+```console
+% terraform import aws_apprunner_auto_scaling_configuration_version.example "arn:aws:apprunner:us-east-1:1234567890:autoscalingconfiguration/example/1/69bdfe0115224b0db49398b7beb68e0f
+```
+
+<!-- cache-key: cdktf-0.18.0 input-7aac7f85f31408240e0b57ce4afb75ca1e0d9a5e1f5c9aa2ba1d6961146bc1ac -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/apprunner_connection.html.markdown b/website/docs/cdktf/typescript/r/apprunner_connection.html.markdown
new file mode 100644
index 00000000000..e470a04f386
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/apprunner_connection.html.markdown
@@ -0,0 +1,81 @@
+---
+subcategory: "App Runner"
+layout: "aws"
+page_title: "AWS: aws_apprunner_connection"
+description: |-
+  Manages an App Runner Connection.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_apprunner_connection
+
+Manages an App Runner Connection.
+
+~> **NOTE:** After creation, you must complete the authentication handshake using the App Runner console.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ApprunnerConnection } from "./.gen/providers/aws/apprunner-connection";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ApprunnerConnection(this, "example", {
+      connectionName: "example",
+      providerType: "GITHUB",
+      tags: {
+        Name: "example-apprunner-connection",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments supported:
+
+* `connectionName` - (Required) Name of the connection.
+* `providerType` - (Required) Source repository provider. Valid values: `github`.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the connection.
+* `status` - Current state of the App Runner connection. When the state is `available`, you can use the connection to create an [`awsApprunnerService` resource](apprunner_service.html).
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import App Runner Connections using the `connectionName`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import App Runner Connections using the `connectionName`. For example:
+
+```console
+% terraform import aws_apprunner_connection.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-3223a9c42fae1a70b59eb72d4fd08310c6f33713ae95b548fcc20326e370a660 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/apprunner_custom_domain_association.html.markdown b/website/docs/cdktf/typescript/r/apprunner_custom_domain_association.html.markdown
new file mode 100644
index 00000000000..ee75b0b08b4
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/apprunner_custom_domain_association.html.markdown
@@ -0,0 +1,87 @@
+---
+subcategory: "App Runner"
+layout: "aws"
+page_title: "AWS: aws_apprunner_custom_domain_association"
+description: |-
+  Manages an App Runner Custom Domain association.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_apprunner_custom_domain_association
+
+Manages an App Runner Custom Domain association.
+
+~> **NOTE:** After creation, you must use the information in the `certificationValidationRecords` attribute to add CNAME records to your Domain Name System (DNS). For each mapped domain name, add a mapping to the target App Runner subdomain (found in the `dnsTarget` attribute) and one or more certificate validation records. App Runner then performs DNS validation to verify that you own or control the domain name you associated. App Runner tracks domain validity in a certificate stored in AWS Certificate Manager (ACM).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ApprunnerCustomDomainAssociation } from "./.gen/providers/aws/apprunner-custom-domain-association";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ApprunnerCustomDomainAssociation(this, "example", {
+      domainName: "example.com",
+      serviceArn: Token.asString(awsApprunnerServiceExample.arn),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments supported:
+
+* `domainName` - (Required) Custom domain endpoint to association. Specify a base domain e.g., `exampleCom` or a subdomain e.g., `subdomainExampleCom`.
+* `enableWwwSubdomain` (Optional) Whether to associate the subdomain with the App Runner service in addition to the base domain. Defaults to `true`.
+* `serviceArn` - (Required) ARN of the App Runner service.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The `domainName` and `serviceArn` separated by a comma (`,`).
+* `certificateValidationRecords` - A set of certificate CNAME records used for this domain name. See [Certificate Validation Records](#certificate-validation-records) below for more details.
+* `dnsTarget` - App Runner subdomain of the App Runner service. The custom domain name is mapped to this target name. Attribute only available if resource created (not imported) with Terraform.
+
+### Certificate Validation Records
+
+The configuration block consists of the following arguments:
+
+* `name` - Certificate CNAME record name.
+* `status` - Current state of the certificate CNAME record validation. It should change to `success` after App Runner completes validation with your DNS.
+* `type` - Record type, always `cname`.
+* `value` - Certificate CNAME record value.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import App Runner Custom Domain Associations using the `domainName` and `serviceArn` separated by a comma (`,`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import App Runner Custom Domain Associations using the `domainName` and `serviceArn` separated by a comma (`,`). For example:
+
+```console
+% terraform import aws_apprunner_custom_domain_association.example example.com,arn:aws:apprunner:us-east-1:123456789012:service/example-app/8fe1e10304f84fd2b0df550fe98a71fa
+```
+
+<!-- cache-key: cdktf-0.18.0 input-7cc3a375febd6cf6963cf65a24caeee55d47321c71cc824d65ac258b80d66ca7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/apprunner_observability_configuration.html.markdown b/website/docs/cdktf/typescript/r/apprunner_observability_configuration.html.markdown
new file mode 100644
index 00000000000..4bad7bacac5
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/apprunner_observability_configuration.html.markdown
@@ -0,0 +1,89 @@
+---
+subcategory: "App Runner"
+layout: "aws"
+page_title: "AWS: aws_apprunner_observability_configuration"
+description: |-
+  Manages an App Runner Observability Configuration.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_apprunner_observability_configuration
+
+Manages an App Runner Observability Configuration.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ApprunnerObservabilityConfiguration } from "./.gen/providers/aws/apprunner-observability-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ApprunnerObservabilityConfiguration(this, "example", {
+      observabilityConfigurationName: "example",
+      tags: {
+        Name: "example-apprunner-observability-configuration",
+      },
+      traceConfiguration: {
+        vendor: "AWSXRAY",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments supported:
+
+* `observabilityConfigurationName` - (Required, Forces new resource) Name of the observability configuration.
+* `traceConfiguration` - (Optional) Configuration of the tracing feature within this observability configuration. If you don't specify it, App Runner doesn't enable tracing. See [Trace Configuration](#trace-configuration) below for more details.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Trace Configuration
+
+The `traceConfiguration` block supports the following argument:
+
+* `vendor` - (Required) Implementation provider chosen for tracing App Runner services. Valid values: `awsxray`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of this observability configuration.
+* `observabilityConfigurationRevision` - The revision of this observability configuration.
+* `latest` - Whether the observability configuration has the highest `observabilityConfigurationRevision` among all configurations that share the same `observabilityConfigurationName`.
+* `status` - Current state of the observability configuration. An INACTIVE configuration revision has been deleted and can't be used. It is permanently removed some time after deletion.
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import App Runner Observability Configuration using the `arn`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import App Runner Observability Configuration using the `arn`. For example:
+
+```console
+% terraform import aws_apprunner_observability_configuration.example arn:aws:apprunner:us-east-1:1234567890:observabilityconfiguration/example/1/d75bc7ea55b71e724fe5c23452fe22a1
+```
+
+<!-- cache-key: cdktf-0.18.0 input-8e5cebb86212015c055222a001ff7c401e6fd39752f296bb53ad2acf1c736b46 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/apprunner_service.html.markdown b/website/docs/cdktf/typescript/r/apprunner_service.html.markdown
new file mode 100644
index 00000000000..77b50ff76b6
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/apprunner_service.html.markdown
@@ -0,0 +1,330 @@
+---
+subcategory: "App Runner"
+layout: "aws"
+page_title: "AWS: aws_apprunner_service"
+description: |-
+  Manages an App Runner Service.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_apprunner_service
+
+Manages an App Runner Service.
+
+## Example Usage
+
+### Service with a Code Repository Source
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ApprunnerService } from "./.gen/providers/aws/apprunner-service";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ApprunnerService(this, "example", {
+      networkConfiguration: {
+        egressConfiguration: {
+          egressType: "VPC",
+          vpcConnectorArn: connector.arn,
+        },
+      },
+      serviceName: "example",
+      sourceConfiguration: {
+        authenticationConfiguration: {
+          connectionArn: Token.asString(awsApprunnerConnectionExample.arn),
+        },
+        codeRepository: {
+          codeConfiguration: {
+            codeConfigurationValues: {
+              buildCommand: "python setup.py develop",
+              port: "8000",
+              runtime: "PYTHON_3",
+              startCommand: "python runapp.py",
+            },
+            configurationSource: "API",
+          },
+          repositoryUrl: "https://github.com/example/my-example-python-app",
+          sourceCodeVersion: {
+            type: "BRANCH",
+            value: "main",
+          },
+        },
+      },
+      tags: {
+        Name: "example-apprunner-service",
+      },
+    });
+  }
+}
+
+```
+
+### Service with an Image Repository Source
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ApprunnerService } from "./.gen/providers/aws/apprunner-service";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ApprunnerService(this, "example", {
+      serviceName: "example",
+      sourceConfiguration: {
+        autoDeploymentsEnabled: false,
+        imageRepository: {
+          imageConfiguration: {
+            port: "8000",
+          },
+          imageIdentifier:
+            "public.ecr.aws/aws-containers/hello-app-runner:latest",
+          imageRepositoryType: "ECR_PUBLIC",
+        },
+      },
+      tags: {
+        Name: "example-apprunner-service",
+      },
+    });
+  }
+}
+
+```
+
+### Service with Observability Configuration
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ApprunnerObservabilityConfiguration } from "./.gen/providers/aws/apprunner-observability-configuration";
+import { ApprunnerService } from "./.gen/providers/aws/apprunner-service";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new ApprunnerObservabilityConfiguration(this, "example", {
+      observabilityConfigurationName: "example",
+      traceConfiguration: {
+        vendor: "AWSXRAY",
+      },
+    });
+    const awsApprunnerServiceExample = new ApprunnerService(this, "example_1", {
+      observabilityConfiguration: {
+        observabilityConfigurationArn: example.arn,
+        observabilityEnabled: true,
+      },
+      serviceName: "example",
+      sourceConfiguration: {
+        autoDeploymentsEnabled: false,
+        imageRepository: {
+          imageConfiguration: {
+            port: "8000",
+          },
+          imageIdentifier:
+            "public.ecr.aws/aws-containers/hello-app-runner:latest",
+          imageRepositoryType: "ECR_PUBLIC",
+        },
+      },
+      tags: {
+        Name: "example-apprunner-service",
+      },
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsApprunnerServiceExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `serviceName` - (Forces new resource) Name of the service.
+* `sourceConfiguration` - The source to deploy to the App Runner service. Can be a code or an image repository. See [Source Configuration](#source-configuration) below for more details.
+
+The following arguments are optional:
+
+* `autoScalingConfigurationArn` - ARN of an App Runner automatic scaling configuration resource that you want to associate with your service. If not provided, App Runner associates the latest revision of a default auto scaling configuration.
+* `encryptionConfiguration` - (Forces new resource) An optional custom encryption key that App Runner uses to encrypt the copy of your source repository that it maintains and your service logs. By default, App Runner uses an AWS managed CMK. See [Encryption Configuration](#encryption-configuration) below for more details.
+* `healthCheckConfiguration` - (Forces new resource) Settings of the health check that AWS App Runner performs to monitor the health of your service. See [Health Check Configuration](#health-check-configuration) below for more details.
+* `instanceConfiguration` - The runtime configuration of instances (scaling units) of the App Runner service. See [Instance Configuration](#instance-configuration) below for more details.
+* `networkConfiguration` - Configuration settings related to network traffic of the web application that the App Runner service runs. See [Network Configuration](#network-configuration) below for more details.
+* `observabilityConfiguration` - The observability configuration of your service. See [Observability Configuration](#observability-configuration) below for more details.
+* `tags` - Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Encryption Configuration
+
+The `encryptionConfiguration` block supports the following argument:
+
+* `kmsKey` - (Required) ARN of the KMS key used for encryption.
+
+### Health Check Configuration
+
+The `healthCheckConfiguration` block supports the following arguments:
+
+* `healthyThreshold` - (Optional) Number of consecutive checks that must succeed before App Runner decides that the service is healthy. Defaults to 1. Minimum value of 1. Maximum value of 20.
+* `interval` - (Optional) Time interval, in seconds, between health checks. Defaults to 5. Minimum value of 1. Maximum value of 20.
+* `path` - (Optional) URL to send requests to for health checks. Defaults to `/`. Minimum length of 0. Maximum length of 51200.
+* `protocol` - (Optional) IP protocol that App Runner uses to perform health checks for your service. Valid values: `tcp`, `http`. Defaults to `tcp`. If you set protocol to `http`, App Runner sends health check requests to the HTTP path specified by `path`.
+* `timeout` - (Optional) Time, in seconds, to wait for a health check response before deciding it failed. Defaults to 2. Minimum value of  1. Maximum value of 20.
+* `unhealthyThreshold` - (Optional) Number of consecutive checks that must fail before App Runner decides that the service is unhealthy. Defaults to 5. Minimum value of  1. Maximum value of 20.
+
+### Instance Configuration
+
+The `instanceConfiguration` block supports the following arguments:
+
+* `cpu` - (Optional) Number of CPU units reserved for each instance of your App Runner service represented as a String. Defaults to `1024`. Valid values: `256|512|1024|2048|4096|(0.25|0.5|1|2|4) vCPU`.
+* `instanceRoleArn` - (Optional) ARN of an IAM role that provides permissions to your App Runner service. These are permissions that your code needs when it calls any AWS APIs.
+* `memory` - (Optional) Amount of memory, in MB or GB, reserved for each instance of your App Runner service. Defaults to `2048`. Valid values: `512|1024|2048|3072|4096|6144|8192|10240|12288|(0.5|1|2|3|4|6|8|10|12) GB`.
+
+### Source Configuration
+
+The `sourceConfiguration` block supports the following arguments:
+
+~>**Note:** Either `codeRepository` or `imageRepository` must be specified (but not both).
+
+* `authenticationConfiguration` - (Optional) Describes resources needed to authenticate access to some source repositories. See [Authentication Configuration](#authentication-configuration) below for more details.
+* `autoDeploymentsEnabled` - (Optional) Whether continuous integration from the source repository is enabled for the App Runner service. If set to `true`, each repository change (source code commit or new image version) starts a deployment. Defaults to `true`.
+* `codeRepository` - (Optional) Description of a source code repository. See [Code Repository](#code-repository) below for more details.
+* `imageRepository` - (Optional) Description of a source image repository. See [Image Repository](#image-repository) below for more details.
+
+### Authentication Configuration
+
+The `authenticationConfiguration` block supports the following arguments:
+
+* `accessRoleArn` - (Optional) ARN of the IAM role that grants the App Runner service access to a source repository. Required for ECR image repositories (but not for ECR Public)
+* `connectionArn` - (Optional) ARN of the App Runner connection that enables the App Runner service to connect to a source repository. Required for GitHub code repositories.
+
+### Network Configuration
+
+The `networkConfiguration` block supports the following arguments:
+
+* `ingressConfiguration` - (Optional) Network configuration settings for inbound network traffic. See [Ingress Configuration](#ingress-configuration) below for more details.
+* `egressConfiguration` - (Optional) Network configuration settings for outbound message traffic. See [Egress Configuration](#egress-configuration) below for more details.
+* `egressType` - (Optional) Type of egress configuration.Set to DEFAULT for access to resources hosted on public networks.Set to VPC to associate your service to a custom VPC specified by VpcConnectorArn.
+* `vpcConnectorArn` - ARN of the App Runner VPC connector that you want to associate with your App Runner service. Only valid when EgressType = VPC.
+
+### Ingress Configuration
+
+The `ingressConfiguration` block supports the following argument:
+
+* `isPubliclyAccessible` - (Required) Specifies whether your App Runner service is publicly accessible. To make the service publicly accessible set it to True. To make the service privately accessible, from only within an Amazon VPC set it to False.
+
+### Egress Configuration
+
+The `egressConfiguration` block supports the following argument:
+
+* `egressType` - The type of egress configuration. Valid values are: `default` and `vpc`.
+* `vpcConnectorArn` - The Amazon Resource Name (ARN) of the App Runner VPC connector that you want to associate with your App Runner service. Only valid when `EgressType = VPC`.
+
+### Observability Configuration
+
+The `observabilityConfiguration` block supports the following arguments:
+
+* `observabilityEnabled` - (Required) When `true`, an observability configuration resource is associated with the service.
+* `observabilityConfigurationArn` - (Optional) ARN of the observability configuration that is associated with the service. Specified only when `observabilityEnabled` is `true`.
+
+### Code Repository
+
+The `codeRepository` block supports the following arguments:
+
+* `codeConfiguration` - (Optional) Configuration for building and running the service from a source code repository. See [Code Configuration](#code-configuration) below for more details.
+* `repositoryUrl` - (Required) Location of the repository that contains the source code.
+* `sourceCodeVersion` - (Required) Version that should be used within the source code repository. See [Source Code Version](#source-code-version) below for more details.
+
+### Image Repository
+
+The `imageRepository` block supports the following arguments:
+
+* `imageConfiguration` - (Optional) Configuration for running the identified image. See [Image Configuration](#image-configuration) below for more details.
+* `imageIdentifier` - (Required) Identifier of an image. For an image in Amazon Elastic Container Registry (Amazon ECR), this is an image name. For the
+  image name format, see Pulling an image in the Amazon ECR User Guide.
+* `imageRepositoryType` - (Required) Type of the image repository. This reflects the repository provider and whether the repository is private or public. Valid values: `ecr` , `ecrPublic`.
+
+### Code Configuration
+
+The `codeConfiguration` block supports the following arguments:
+
+* `codeConfigurationValues` - (Optional) Basic configuration for building and running the App Runner service. Use this parameter to quickly launch an App Runner service without providing an apprunner.yaml file in the source code repository (or ignoring the file if it exists). See [Code Configuration Values](#code-configuration-values) below for more details.
+* `configurationSource` - (Required) Source of the App Runner configuration. Valid values: `repository`, `api`. Values are interpreted as follows:
+    * `repository` - App Runner reads configuration values from the apprunner.yaml file in the
+    source code repository and ignores the CodeConfigurationValues parameter.
+    * `api` - App Runner uses configuration values provided in the CodeConfigurationValues
+    parameter and ignores the apprunner.yaml file in the source code repository.
+
+### Code Configuration Values
+
+The `codeConfigurationValues` blocks supports the following arguments:
+
+* `buildCommand` - (Optional) Command App Runner runs to build your application.
+* `port` - (Optional) Port that your application listens to in the container. Defaults to `"8080"`.
+* `runtime` - (Required) Runtime environment type for building and running an App Runner service. Represents a programming language runtime. Valid values: `python3`, `nodejs12`, `nodejs14`, `nodejs16`, `corretto8`, `corretto11`, `go1`, `dotnet6`, `php81`, `ruby31`.
+* `runtimeEnvironmentSecrets` - (Optional) Secrets and parameters available to your service as environment variables. A map of key/value pairs, where the key is the desired name of the Secret in the environment (i.e. it does not have to match the name of the secret in Secrets Manager or SSM Parameter Store), and the value is the ARN of the secret from AWS Secrets Manager or the ARN of the parameter in AWS SSM Parameter Store.
+* `runtimeEnvironmentVariables` - (Optional) Environment variables available to your running App Runner service. A map of key/value pairs. Keys with a prefix of `awsapprunner` are reserved for system use and aren't valid.
+* `startCommand` - (Optional) Command App Runner runs to start your application.
+
+### Image Configuration
+
+The `imageConfiguration` block supports the following arguments:
+
+* `port` - (Optional) Port that your application listens to in the container. Defaults to `"8080"`.
+* `runtimeEnvironmentSecrets` - (Optional) Secrets and parameters available to your service as environment variables. A map of key/value pairs, where the key is the desired name of the Secret in the environment (i.e. it does not have to match the name of the secret in Secrets Manager or SSM Parameter Store), and the value is the ARN of the secret from AWS Secrets Manager or the ARN of the parameter in AWS SSM Parameter Store.
+* `runtimeEnvironmentVariables` - (Optional) Environment variables available to your running App Runner service. A map of key/value pairs. Keys with a prefix of `awsapprunner` are reserved for system use and aren't valid.
+* `startCommand` - (Optional) Command App Runner runs to start the application in the source image. If specified, this command overrides the Docker image’s default start command.
+
+### Source Code Version
+
+The `sourceCodeVersion` block supports the following arguments:
+
+* `type` - (Required) Type of version identifier. For a git-based repository, branches represent versions. Valid values: `branch`.
+* `value`- (Required) Source code version. For a git-based repository, a branch name maps to a specific version. App Runner uses the most recent commit to the branch.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the App Runner service.
+* `serviceId` - An alphanumeric ID that App Runner generated for this service. Unique within the AWS Region.
+* `serviceUrl` - Subdomain URL that App Runner generated for this service. You can use this URL to access your service web application.
+* `status` - Current state of the App Runner service.
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import App Runner Services using the `arn`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import App Runner Services using the `arn`. For example:
+
+```console
+% terraform import aws_apprunner_service.example arn:aws:apprunner:us-east-1:1234567890:service/example/0a03292a89764e5882c41d8f991c82fe
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ab52185ade0d482c41dce2950b5061670985bf2589f6ce689511bce1971583a6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/apprunner_vpc_connector.html.markdown b/website/docs/cdktf/typescript/r/apprunner_vpc_connector.html.markdown
new file mode 100644
index 00000000000..f530c7322c5
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/apprunner_vpc_connector.html.markdown
@@ -0,0 +1,79 @@
+---
+subcategory: "App Runner"
+layout: "aws"
+page_title: "AWS: aws_apprunner_vpc_connector"
+description: |-
+  Manages an App Runner VPC Connector.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_apprunner_vpc_connector
+
+Manages an App Runner VPC Connector.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ApprunnerVpcConnector } from "./.gen/providers/aws/apprunner-vpc-connector";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ApprunnerVpcConnector(this, "connector", {
+      securityGroups: ["sg1", "sg2"],
+      subnets: ["subnet1", "subnet2"],
+      vpcConnectorName: "name",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments supported:
+
+* `vpcConnectorName` - (Required) Name for the VPC connector.
+* `subnets` (Required) List of IDs of subnets that App Runner should use when it associates your service with a custom Amazon VPC. Specify IDs of subnets of a single Amazon VPC. App Runner determines the Amazon VPC from the subnets you specify.
+* `securityGroups` - List of IDs of security groups that App Runner should use for access to AWS resources under the specified subnets. If not specified, App Runner uses the default security group of the Amazon VPC. The default security group allows all outbound traffic.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of VPC connector.
+* `status` - Current state of the VPC connector. If the status of a connector revision is INACTIVE, it was deleted and can't be used. Inactive connector revisions are permanently removed some time after they are deleted.
+* `vpcConnectorRevision` - The revision of VPC connector. It's unique among all the active connectors ("Status": "ACTIVE") that share the same Name.
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import App Runner vpc connector using the `arn`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import App Runner vpc connector using the `arn`. For example:
+
+```console
+% terraform import aws_apprunner_vpc_connector.example arn:aws:apprunner:us-east-1:1234567890:vpcconnector/example/1/0a03292a89764e5882c41d8f991c82fe
+```
+
+<!-- cache-key: cdktf-0.18.0 input-a25bb324f61ef65387154b76f7156f8f2fb7eb7f11a4d07c072913a4bb2014c1 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/apprunner_vpc_ingress_connection.html.markdown b/website/docs/cdktf/typescript/r/apprunner_vpc_ingress_connection.html.markdown
new file mode 100644
index 00000000000..0fea3048ec5
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/apprunner_vpc_ingress_connection.html.markdown
@@ -0,0 +1,92 @@
+---
+subcategory: "App Runner"
+layout: "aws"
+page_title: "AWS: aws_apprunner_vpc_ingress_connection"
+description: |-
+  Manages an App Runner VPC Ingress Connection.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_apprunner_vpc_ingress_connection
+
+Manages an App Runner VPC Ingress Connection.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ApprunnerVpcIngressConnection } from "./.gen/providers/aws/apprunner-vpc-ingress-connection";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ApprunnerVpcIngressConnection(this, "example", {
+      ingressVpcConfiguration: {
+        vpcEndpointId: apprunner.id,
+        vpcId: defaultVar.id,
+      },
+      name: "example",
+      serviceArn: Token.asString(awsApprunnerServiceExample.arn),
+      tags: {
+        foo: "bar",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments supported:
+
+* `name` - (Required) A name for the VPC Ingress Connection resource. It must be unique across all the active VPC Ingress Connections in your AWS account in the AWS Region.
+* `serviceArn` - (Required) The Amazon Resource Name (ARN) for this App Runner service that is used to create the VPC Ingress Connection resource.
+* `ingressVpcConfiguration` - (Required) Specifications for the customer’s Amazon VPC and the related AWS PrivateLink VPC endpoint that are used to create the VPC Ingress Connection resource. See [Ingress VPC Configuration](#ingress-vpc-configuration) below for more details.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Ingress VPC Configuration
+
+The `ingressVpcConfiguration` block supports the following argument:
+
+* `vpcId` - (Required) The ID of the VPC that is used for the VPC endpoint.
+* `vpcEndpointId` - (Required) The ID of the VPC endpoint that your App Runner service connects to.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the VPC Ingress Connection.
+* `domainName` - The domain name associated with the VPC Ingress Connection resource.
+* `status` - The current status of the VPC Ingress Connection.
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import App Runner VPC Ingress Connection using the `arn`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import App Runner VPC Ingress Connection using the `arn`. For example:
+
+```console
+% terraform import aws_apprunner_vpc_ingress_connection.example "arn:aws:apprunner:us-west-2:837424938642:vpcingressconnection/example/b379f86381d74825832c2e82080342fa"
+```
+
+<!-- cache-key: cdktf-0.18.0 input-5ca4eb20c816b4fc2b57f0cfd6bbd31dc7537e74b1368f2c8074afd614895b23 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/appstream_directory_config.html.markdown b/website/docs/cdktf/typescript/r/appstream_directory_config.html.markdown
new file mode 100644
index 00000000000..67369e75bc9
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/appstream_directory_config.html.markdown
@@ -0,0 +1,84 @@
+---
+subcategory: "AppStream 2.0"
+layout: "aws"
+page_title: "AWS: aws_appstream_directory_config"
+description: |-
+  Provides an AppStream Directory Config
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_appstream_directory_config
+
+Provides an AppStream Directory Config.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AppstreamDirectoryConfig } from "./.gen/providers/aws/appstream-directory-config";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AppstreamDirectoryConfig(this, "example", {
+      directoryName: "NAME OF DIRECTORY",
+      organizationalUnitDistinguishedNames: ["DISTINGUISHED NAME"],
+      serviceAccountCredentials: {
+        accountName: "NAME OF ACCOUNT",
+        accountPassword: "PASSWORD OF ACCOUNT",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `directoryName` - (Required) Fully qualified name of the directory.
+* `organizationalUnitDistinguishedNames` - (Required) Distinguished names of the organizational units for computer accounts.
+* `serviceAccountCredentials` - (Required) Configuration block for the name of the directory and organizational unit (OU) to use to join the directory config to a Microsoft Active Directory domain. See [`serviceAccountCredentials`](#service_account_credentials) below.
+
+### `serviceAccountCredentials`
+
+* `accountName` - (Required) User name of the account. This account must have the following privileges: create computer objects, join computers to the domain, and change/reset the password on descendant computer objects for the organizational units specified.
+* `accountPassword` - (Required) Password for the account.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Unique identifier (ID) of the appstream directory config.
+* `createdTime` -  Date and time, in UTC and extended RFC 3339 format, when the directory config was created.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsAppstreamDirectoryConfig` using the id. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsAppstreamDirectoryConfig` using the id. For example:
+
+```console
+% terraform import aws_appstream_directory_config.example directoryNameExample
+```
+
+<!-- cache-key: cdktf-0.18.0 input-cc4dcd0e21d4459a6f134b5283f0f40cf04088ba29d91cc8b5c68f07a92ceeb9 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/appstream_fleet.html.markdown b/website/docs/cdktf/typescript/r/appstream_fleet.html.markdown
new file mode 100644
index 00000000000..a90f8c10849
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/appstream_fleet.html.markdown
@@ -0,0 +1,131 @@
+---
+subcategory: "AppStream 2.0"
+layout: "aws"
+page_title: "AWS: aws_appstream_fleet"
+description: |-
+  Provides an AppStream fleet
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_appstream_fleet
+
+Provides an AppStream fleet.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AppstreamFleet } from "./.gen/providers/aws/appstream-fleet";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AppstreamFleet(this, "test_fleet", {
+      computeCapacity: {
+        desiredInstances: 1,
+      },
+      description: "test fleet",
+      displayName: "test-fleet",
+      enableDefaultInternetAccess: false,
+      fleetType: "ON_DEMAND",
+      idleDisconnectTimeoutInSeconds: 60,
+      imageName: "Amazon-AppStream2-Sample-Image-03-11-2023",
+      instanceType: "stream.standard.large",
+      maxUserDurationInSeconds: 600,
+      name: "test-fleet",
+      tags: {
+        TagName: "tag-value",
+      },
+      vpcConfig: {
+        subnetIds: ["subnet-06e9b13400c225127"],
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `computeCapacity` - (Required) Configuration block for the desired capacity of the fleet. See below.
+* `instanceType` - (Required) Instance type to use when launching fleet instances.
+* `name` - (Required) Unique name for the fleet.
+
+The following arguments are optional:
+
+* `description` - (Optional) Description to display.
+* `disconnectTimeoutInSeconds` - (Optional) Amount of time that a streaming session remains active after users disconnect.
+* `displayName` - (Optional) Human-readable friendly name for the AppStream fleet.
+* `domainJoinInfo` - (Optional) Configuration block for the name of the directory and organizational unit (OU) to use to join the fleet to a Microsoft Active Directory domain. See below.
+* `enableDefaultInternetAccess` - (Optional) Enables or disables default internet access for the fleet.
+* `fleetType` - (Optional) Fleet type. Valid values are: `onDemand`, `alwaysOn`
+* `iamRoleArn` - (Optional) ARN of the IAM role to apply to the fleet.
+* `idleDisconnectTimeoutInSeconds` - (Optional) Amount of time that users can be idle (inactive) before they are disconnected from their streaming session and the `disconnectTimeoutInSeconds` time interval begins.
+* `imageName` - (Optional) Name of the image used to create the fleet.
+* `imageArn` - (Optional) ARN of the public, private, or shared image to use.
+* `streamView` - (Optional) AppStream 2.0 view that is displayed to your users when they stream from the fleet. When `app` is specified, only the windows of applications opened by users display. When `desktop` is specified, the standard desktop that is provided by the operating system displays. If not specified, defaults to `app`.
+* `maxUserDurationInSeconds` - (Optional) Maximum amount of time that a streaming session can remain active, in seconds.
+* `vpcConfig` - (Optional) Configuration block for the VPC configuration for the image builder. See below.
+* `tags` - (Optional) Map of tags to attach to AppStream instances.
+
+### `computeCapacity`
+
+* `desiredInstances` - (Required) Desired number of streaming instances.
+
+### `domainJoinInfo`
+
+* `directoryName` - (Optional) Fully qualified name of the directory (for example, corp.example.com).
+* `organizationalUnitDistinguishedName` - (Optional) Distinguished name of the organizational unit for computer accounts.
+
+### `vpcConfig`
+
+* `securityGroupIds` - Identifiers of the security groups for the fleet or image builder.
+* `subnetIds` - Identifiers of the subnets to which a network interface is attached from the fleet instance or image builder instance.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Unique identifier (ID) of the appstream fleet.
+* `arn` - ARN of the appstream fleet.
+* `state` - State of the fleet. Can be `starting`, `running`, `stopping` or `stopped`
+* `createdTime` -  Date and time, in UTC and extended RFC 3339 format, when the fleet was created.
+* `computeCapacity` - Describes the capacity status for a fleet.
+
+### `computeCapacity`
+
+* `available` - Number of currently available instances that can be used to stream sessions.
+* `inUse` - Number of instances in use for streaming.
+* `running` - Total number of simultaneous streaming instances that are running.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsAppstreamFleet` using the id. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsAppstreamFleet` using the id. For example:
+
+```console
+% terraform import aws_appstream_fleet.example fleetNameExample
+```
+
+<!-- cache-key: cdktf-0.18.0 input-73fdf63ad01b397b97d73714aee955eca2295534a2f89adc78fa6fd555eab144 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/appstream_fleet_stack_association.html.markdown b/website/docs/cdktf/typescript/r/appstream_fleet_stack_association.html.markdown
new file mode 100644
index 00000000000..668bd67bce2
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/appstream_fleet_stack_association.html.markdown
@@ -0,0 +1,91 @@
+---
+subcategory: "AppStream 2.0"
+layout: "aws"
+page_title: "AWS: aws_appstream_fleet_stack_association"
+description: |-
+  Manages an AppStream Fleet Stack association.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_appstream_fleet_stack_association
+
+Manages an AppStream Fleet Stack association.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AppstreamFleet } from "./.gen/providers/aws/appstream-fleet";
+import { AppstreamFleetStackAssociation } from "./.gen/providers/aws/appstream-fleet-stack-association";
+import { AppstreamStack } from "./.gen/providers/aws/appstream-stack";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new AppstreamFleet(this, "example", {
+      computeCapacity: {
+        desiredInstances: 1,
+      },
+      imageName: "Amazon-AppStream2-Sample-Image-03-11-2023",
+      instanceType: "stream.standard.small",
+      name: "NAME",
+    });
+    const awsAppstreamStackExample = new AppstreamStack(this, "example_1", {
+      name: "STACK NAME",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsAppstreamStackExample.overrideLogicalId("example");
+    const awsAppstreamFleetStackAssociationExample =
+      new AppstreamFleetStackAssociation(this, "example_2", {
+        fleetName: example.name,
+        stackName: Token.asString(awsAppstreamStackExample.name),
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsAppstreamFleetStackAssociationExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `fleetName` - (Required) Name of the fleet.
+* `stackName` (Required) Name of the stack.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Unique ID of the appstream stack fleet association, composed of the `fleetName` and `stackName` separated by a slash (`/`).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AppStream Stack Fleet Association using the `fleetName` and `stackName` separated by a slash (`/`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import AppStream Stack Fleet Association using the `fleetName` and `stackName` separated by a slash (`/`). For example:
+
+```console
+% terraform import aws_appstream_fleet_stack_association.example fleetName/stackName
+```
+
+<!-- cache-key: cdktf-0.18.0 input-d02e772e58ab8d188d62ad200741c9e10f12ac34ac4daa8c08f2dbd2bfc87b0a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/appstream_image_builder.html.markdown b/website/docs/cdktf/typescript/r/appstream_image_builder.html.markdown
new file mode 100644
index 00000000000..f35a169ee88
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/appstream_image_builder.html.markdown
@@ -0,0 +1,122 @@
+---
+subcategory: "AppStream 2.0"
+layout: "aws"
+page_title: "AWS: aws_appstream_image_builder"
+description: |-
+  Provides an AppStream image builder
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_appstream_image_builder
+
+Provides an AppStream image builder.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AppstreamImageBuilder } from "./.gen/providers/aws/appstream-image-builder";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AppstreamImageBuilder(this, "test_fleet", {
+      description: "Description of a ImageBuilder",
+      displayName: "Display name of a ImageBuilder",
+      enableDefaultInternetAccess: false,
+      imageName: "AppStream-WinServer2019-10-05-2022",
+      instanceType: "stream.standard.large",
+      name: "Name",
+      tags: {
+        Name: "Example Image Builder",
+      },
+      vpcConfig: {
+        subnetIds: [example.id],
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `instanceType` - (Required) Instance type to use when launching the image builder.
+* `name` - (Required) Unique name for the image builder.
+
+The following arguments are optional:
+
+* `accessEndpoint` - (Optional) Set of interface VPC endpoint (interface endpoint) objects. Maximum of 4. See below.
+* `appstreamAgentVersion` - (Optional) Version of the AppStream 2.0 agent to use for this image builder.
+* `description` - (Optional) Description to display.
+* `displayName` - (Optional) Human-readable friendly name for the AppStream image builder.
+* `domainJoinInfo` - (Optional) Configuration block for the name of the directory and organizational unit (OU) to use to join the image builder to a Microsoft Active Directory domain. See below.
+* `enableDefaultInternetAccess` - (Optional) Enables or disables default internet access for the image builder.
+* `iamRoleArn` - (Optional) ARN of the IAM role to apply to the image builder.
+* `imageArn` - (Optional, Required if `imageName` not provided) ARN of the public, private, or shared image to use.
+* `imageName` - (Optional, Required if `imageArn` not provided) Name of the image used to create the image builder.
+* `vpcConfig` - (Optional) Configuration block for the VPC configuration for the image builder. See below.
+* `tags` - (Optional) Map of tags to assign to the instance. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### `accessEndpoint`
+
+The `accessEndpoint` block supports the following arguments:
+
+* `endpointType` - (Required) Type of interface endpoint.
+* `vpceId` - (Optional) Identifier (ID) of the VPC in which the interface endpoint is used.
+
+### `domainJoinInfo`
+
+The `domainJoinInfo` block supports the following arguments:
+
+* `directoryName` - (Optional) Fully qualified name of the directory (for example, corp.example.com).
+* `organizationalUnitDistinguishedName` - (Optional) Distinguished name of the organizational unit for computer accounts.
+
+### `vpcConfig`
+
+The `vpcConfig` block supports the following arguments:
+
+* `securityGroupIds` - (Optional) Identifiers of the security groups for the image builder or image builder.
+* `subnetIds` - (Optional) Identifiers of the subnets to which a network interface is attached from the image builder instance or image builder instance.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the appstream image builder.
+* `createdTime` -  Date and time, in UTC and extended RFC 3339 format, when the image builder was created.
+* `id` - Name of the image builder.
+* `state` - State of the image builder. Can be: `pending`, `updatingAgent`, `running`, `stopping`, `stopped`, `rebooting`, `snapshotting`, `deleting`, `failed`, `updating`, `pendingQualification`
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsAppstreamImageBuilder` using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsAppstreamImageBuilder` using the `name`. For example:
+
+```console
+% terraform import aws_appstream_image_builder.example imageBuilderExample
+```
+
+<!-- cache-key: cdktf-0.18.0 input-4adcf125fe94b0f705d78c11c3a6d984d8e9dbc720fe7e15affd7d0a48348dcb -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/appstream_stack.html.markdown b/website/docs/cdktf/typescript/r/appstream_stack.html.markdown
new file mode 100644
index 00000000000..4c4c77aefdf
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/appstream_stack.html.markdown
@@ -0,0 +1,170 @@
+---
+subcategory: "AppStream 2.0"
+layout: "aws"
+page_title: "AWS: aws_appstream_stack"
+description: |-
+  Provides an AppStream stack
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_appstream_stack
+
+Provides an AppStream stack.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AppstreamStack } from "./.gen/providers/aws/appstream-stack";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AppstreamStack(this, "example", {
+      applicationSettings: {
+        enabled: true,
+        settingsGroup: "SettingsGroup",
+      },
+      description: "stack description",
+      displayName: "stack display name",
+      feedbackUrl: "http://your-domain/feedback",
+      name: "stack name",
+      redirectUrl: "http://your-domain/redirect",
+      storageConnectors: [
+        {
+          connectorType: "HOMEFOLDERS",
+        },
+      ],
+      tags: {
+        TagName: "TagValue",
+      },
+      userSettings: [
+        {
+          action: "CLIPBOARD_COPY_FROM_LOCAL_DEVICE",
+          permission: "ENABLED",
+        },
+        {
+          action: "CLIPBOARD_COPY_TO_LOCAL_DEVICE",
+          permission: "ENABLED",
+        },
+        {
+          action: "DOMAIN_PASSWORD_SIGNIN",
+          permission: "ENABLED",
+        },
+        {
+          action: "DOMAIN_SMART_CARD_SIGNIN",
+          permission: "DISABLED",
+        },
+        {
+          action: "FILE_DOWNLOAD",
+          permission: "ENABLED",
+        },
+        {
+          action: "FILE_UPLOAD",
+          permission: "ENABLED",
+        },
+        {
+          action: "PRINTING_TO_LOCAL_DEVICE",
+          permission: "ENABLED",
+        },
+      ],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) Unique name for the AppStream stack.
+
+The following arguments are optional:
+
+* `accessEndpoints` - (Optional) Set of configuration blocks defining the interface VPC endpoints. Users of the stack can connect to AppStream 2.0 only through the specified endpoints.
+  See [`accessEndpoints`](#access_endpoints) below.
+* `applicationSettings` - (Optional) Settings for application settings persistence.
+  See [`applicationSettings`](#application_settings) below.
+* `description` - (Optional) Description for the AppStream stack.
+* `displayName` - (Optional) Stack name to display.
+* `embedHostDomains` - (Optional) Domains where AppStream 2.0 streaming sessions can be embedded in an iframe. You must approve the domains that you want to host embedded AppStream 2.0 streaming sessions.
+* `feedbackUrl` - (Optional) URL that users are redirected to after they click the Send Feedback link. If no URL is specified, no Send Feedback link is displayed. .
+* `redirectUrl` - (Optional) URL that users are redirected to after their streaming session ends.
+* `storageConnectors` - (Optional) Configuration block for the storage connectors to enable.
+  See [`storageConnectors`](#storage_connectors) below.
+* `userSettings` - (Optional) Configuration block for the actions that are enabled or disabled for users during their streaming sessions. If not provided, these settings are configured automatically by AWS. If provided, the terraform configuration should include a block for each configurable action.
+  See [`userSettings`](#user_settings) below.
+* `streamingExperienceSettings` - (Optional) The streaming protocol you want your stack to prefer. This can be UDP or TCP. Currently, UDP is only supported in the Windows native client.
+  See [`streamingExperienceSettings`](#streaming_experience_settings) below.
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### `accessEndpoints`
+
+* `endpointType` - (Required) Type of the interface endpoint.
+  See the [`accessEndpoint` AWS API documentation](https://docs.aws.amazon.com/appstream2/latest/APIReference/API_AccessEndpoint.html) for valid values.
+* `vpceId` - (Optional) ID of the VPC in which the interface endpoint is used.
+
+### `applicationSettings`
+
+* `enabled` - (Required) Whether application settings should be persisted.
+* `settingsGroup` - (Optional) Name of the settings group.
+  Required when `enabled` is `true`.
+  Can be up to 100 characters.
+
+### `storageConnectors`
+
+* `connectorType` - (Required) Type of storage connector.
+  Valid values are `homefolders`, `googleDrive`, or `oneDrive`.
+* `domains` - (Optional) Names of the domains for the account.
+* `resourceIdentifier` - (Optional) ARN of the storage connector.
+
+### `userSettings`
+
+* `action` - (Required) Action that is enabled or disabled.
+  Valid values are `clipboardCopyFromLocalDevice`,  `clipboardCopyToLocalDevice`, `fileUpload`, `fileDownload`, `printingToLocalDevice`, `domainPasswordSignin`, or `domainSmartCardSignin`.
+* `permission` - (Required) Whether the action is enabled or disabled.
+  Valid values are `enabled` or `disabled`.
+
+### `streamingExperienceSettings`
+
+* `preferredProtocol` - (Optional) The preferred protocol that you want to use while streaming your application.
+  Valid values are `tcp` and `udp`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the appstream stack.
+* `createdTime` - Date and time, in UTC and extended RFC 3339 format, when the stack was created.
+* `id` - Unique ID of the appstream stack.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsAppstreamStack` using the id. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsAppstreamStack` using the id. For example:
+
+```console
+% terraform import aws_appstream_stack.example stackID
+```
+
+<!-- cache-key: cdktf-0.18.0 input-47da4616e548607a748b0c74b6e276c2936292671693468cbdab004d2cb5d071 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/appstream_user.html.markdown b/website/docs/cdktf/typescript/r/appstream_user.html.markdown
new file mode 100644
index 00000000000..c76156fc307
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/appstream_user.html.markdown
@@ -0,0 +1,85 @@
+---
+subcategory: "AppStream 2.0"
+layout: "aws"
+page_title: "AWS: aws_appstream_user"
+description: |-
+  Provides an AppStream user
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_appstream_user
+
+Provides an AppStream user.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AppstreamUser } from "./.gen/providers/aws/appstream-user";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AppstreamUser(this, "example", {
+      authenticationType: "USERPOOL",
+      firstName: "FIRST NAME",
+      lastName: "LAST NAME",
+      userName: "EMAIL",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `authenticationType` - (Required) Authentication type for the user. You must specify USERPOOL. Valid values: `api`, `saml`, `userpool`
+* `userName` - (Required) Email address of the user.
+
+The following arguments are optional:
+
+* `enabled` - (Optional) Whether the user in the user pool is enabled.
+* `firstName` - (Optional) First name, or given name, of the user.
+* `lastName` - (Optional) Last name, or surname, of the user.
+* `sendEmailNotification` - (Optional) Send an email notification.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the appstream user.
+* `createdTime` - Date and time, in UTC and extended RFC 3339 format, when the user was created.
+* `id` - Unique ID of the appstream user.
+* `status` - Status of the user in the user pool.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsAppstreamUser` using the `userName` and `authenticationType` separated by a slash (`/`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsAppstreamUser` using the `userName` and `authenticationType` separated by a slash (`/`). For example:
+
+```console
+% terraform import aws_appstream_user.example UserName/AuthenticationType
+```
+
+<!-- cache-key: cdktf-0.18.0 input-0ae35608b7c30b00bd83bdb13090e3e240414ae668bedb32d7e62c4aff37c502 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/appstream_user_stack_association.html.markdown b/website/docs/cdktf/typescript/r/appstream_user_stack_association.html.markdown
new file mode 100644
index 00000000000..80b20aa953f
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/appstream_user_stack_association.html.markdown
@@ -0,0 +1,95 @@
+---
+subcategory: "AppStream 2.0"
+layout: "aws"
+page_title: "AWS: aws_appstream_user_stack_association"
+description: |-
+  Manages an AppStream User Stack association.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_appstream_user_stack_association
+
+Manages an AppStream User Stack association.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AppstreamStack } from "./.gen/providers/aws/appstream-stack";
+import { AppstreamUser } from "./.gen/providers/aws/appstream-user";
+import { AppstreamUserStackAssociation } from "./.gen/providers/aws/appstream-user-stack-association";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const test = new AppstreamStack(this, "test", {
+      name: "STACK NAME",
+    });
+    const awsAppstreamUserTest = new AppstreamUser(this, "test_1", {
+      authenticationType: "USERPOOL",
+      userName: "EMAIL",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsAppstreamUserTest.overrideLogicalId("test");
+    const awsAppstreamUserStackAssociationTest =
+      new AppstreamUserStackAssociation(this, "test_2", {
+        authenticationType: Token.asString(
+          awsAppstreamUserTest.authenticationType
+        ),
+        stackName: test.name,
+        userName: Token.asString(awsAppstreamUserTest.userName),
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsAppstreamUserStackAssociationTest.overrideLogicalId("test");
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `authenticationType` - (Required) Authentication type for the user.
+* `stackName` (Required) Name of the stack that is associated with the user.
+* `userName` (Required) Email address of the user who is associated with the stack.
+
+The following arguments are optional:
+
+* `sendEmailNotification` - (Optional) Whether a welcome email is sent to a user after the user is created in the user pool.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Unique ID of the appstream User Stack association.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AppStream User Stack Association using the `userName`, `authenticationType`, and `stackName`, separated by a slash (`/`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import AppStream User Stack Association using the `userName`, `authenticationType`, and `stackName`, separated by a slash (`/`). For example:
+
+```console
+% terraform import aws_appstream_user_stack_association.example userName/auhtenticationType/stackName
+```
+
+<!-- cache-key: cdktf-0.18.0 input-6159c43dc4b863c969b8ab2f6ce472794478e51eb12d2094df23655fbcbc10e5 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/appsync_api_cache.html.markdown b/website/docs/cdktf/typescript/r/appsync_api_cache.html.markdown
new file mode 100644
index 00000000000..32d9d9f18a0
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/appsync_api_cache.html.markdown
@@ -0,0 +1,86 @@
+---
+subcategory: "AppSync"
+layout: "aws"
+page_title: "AWS: aws_appsync_api_cache"
+description: |-
+  Provides an AppSync API Cache.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_appsync_api_cache
+
+Provides an AppSync API Cache.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AppsyncApiCache } from "./.gen/providers/aws/appsync-api-cache";
+import { AppsyncGraphqlApi } from "./.gen/providers/aws/appsync-graphql-api";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new AppsyncGraphqlApi(this, "example", {
+      authenticationType: "API_KEY",
+      name: "example",
+    });
+    const awsAppsyncApiCacheExample = new AppsyncApiCache(this, "example_1", {
+      apiCachingBehavior: "FULL_REQUEST_CACHING",
+      apiId: example.id,
+      ttl: 900,
+      type: "LARGE",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsAppsyncApiCacheExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `apiId` - (Required) GraphQL API ID.
+* `apiCachingBehavior` - (Required) Caching behavior. Valid values are `fullRequestCaching` and `perResolverCaching`.
+* `type` - (Required) Cache instance type. Valid values are `small`, `medium`, `large`, `xlarge`, `large2X`, `large4X`, `large8X`, `large12X`, `t2Small`, `t2Medium`, `r4Large`, `r4Xlarge`, `r42Xlarge`, `r44Xlarge`, `r48Xlarge`.
+* `ttl` - (Required) TTL in seconds for cache entries.
+* `atRestEncryptionEnabled` - (Optional) At-rest encryption flag for cache. You cannot update this setting after creation.
+* `transitEncryptionEnabled` - (Optional) Transit encryption flag when connecting to cache. You cannot update this setting after creation.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - AppSync API ID.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsAppsyncApiCache` using the AppSync API ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsAppsyncApiCache` using the AppSync API ID. For example:
+
+```console
+% terraform import aws_appsync_api_cache.example xxxxx
+```
+
+<!-- cache-key: cdktf-0.18.0 input-7b300ac441f82586ce425ea9b3f1fabbacd0aa2e6e9a8cba068619ac2633970e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/appsync_api_key.html.markdown b/website/docs/cdktf/typescript/r/appsync_api_key.html.markdown
new file mode 100644
index 00000000000..818dc377e56
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/appsync_api_key.html.markdown
@@ -0,0 +1,82 @@
+---
+subcategory: "AppSync"
+layout: "aws"
+page_title: "AWS: aws_appsync_api_key"
+description: |-
+  Provides an AppSync API Key.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_appsync_api_key
+
+Provides an AppSync API Key.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AppsyncApiKey } from "./.gen/providers/aws/appsync-api-key";
+import { AppsyncGraphqlApi } from "./.gen/providers/aws/appsync-graphql-api";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new AppsyncGraphqlApi(this, "example", {
+      authenticationType: "API_KEY",
+      name: "example",
+    });
+    const awsAppsyncApiKeyExample = new AppsyncApiKey(this, "example_1", {
+      apiId: example.id,
+      expires: "2018-05-03T04:00:00Z",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsAppsyncApiKeyExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `apiId` - (Required) ID of the associated AppSync API
+* `description` - (Optional) API key description. Defaults to "Managed by Terraform".
+* `expires` - (Optional) RFC3339 string representation of the expiry date. Rounded down to nearest hour. By default, it is 7 days from the date of creation.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - API Key ID (Formatted as ApiId:Key)
+* `key` - API key
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsAppsyncApiKey` using the AppSync API ID and key separated by `:`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsAppsyncApiKey` using the AppSync API ID and key separated by `:`. For example:
+
+```console
+% terraform import aws_appsync_api_key.example xxxxx:yyyyy
+```
+
+<!-- cache-key: cdktf-0.18.0 input-9537eb2363c3276a35011eec4122475228554d13bf2934197192259c7ebc0bcd -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/appsync_datasource.html.markdown b/website/docs/cdktf/typescript/r/appsync_datasource.html.markdown
new file mode 100644
index 00000000000..657b39f737f
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/appsync_datasource.html.markdown
@@ -0,0 +1,239 @@
+---
+subcategory: "AppSync"
+layout: "aws"
+page_title: "AWS: aws_appsync_datasource"
+description: |-
+  Provides an AppSync Data Source.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_appsync_datasource
+
+Provides an AppSync Data Source.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AppsyncDatasource } from "./.gen/providers/aws/appsync-datasource";
+import { AppsyncGraphqlApi } from "./.gen/providers/aws/appsync-graphql-api";
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { DynamodbTable } from "./.gen/providers/aws/dynamodb-table";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+import { IamRolePolicy } from "./.gen/providers/aws/iam-role-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new AppsyncGraphqlApi(this, "example", {
+      authenticationType: "API_KEY",
+      name: "tf_appsync_example",
+    });
+    const awsDynamodbTableExample = new DynamodbTable(this, "example_1", {
+      attribute: [
+        {
+          name: "UserId",
+          type: "S",
+        },
+      ],
+      hashKey: "UserId",
+      name: "example",
+      readCapacity: 1,
+      writeCapacity: 1,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsDynamodbTableExample.overrideLogicalId("example");
+    const assumeRole = new DataAwsIamPolicyDocument(this, "assume_role", {
+      statement: [
+        {
+          actions: ["sts:AssumeRole"],
+          effect: "Allow",
+          principals: [
+            {
+              identifiers: ["appsync.amazonaws.com"],
+              type: "Service",
+            },
+          ],
+        },
+      ],
+    });
+    const dataAwsIamPolicyDocumentExample = new DataAwsIamPolicyDocument(
+      this,
+      "example_3",
+      {
+        statement: [
+          {
+            actions: ["dynamodb:*"],
+            effect: "Allow",
+            resources: [Token.asString(awsDynamodbTableExample.arn)],
+          },
+        ],
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsIamPolicyDocumentExample.overrideLogicalId("example");
+    const awsIamRoleExample = new IamRole(this, "example_4", {
+      assumeRolePolicy: Token.asString(assumeRole.json),
+      name: "example",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamRoleExample.overrideLogicalId("example");
+    const awsIamRolePolicyExample = new IamRolePolicy(this, "example_5", {
+      name: "example",
+      policy: Token.asString(dataAwsIamPolicyDocumentExample.json),
+      role: Token.asString(awsIamRoleExample.id),
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamRolePolicyExample.overrideLogicalId("example");
+    const awsAppsyncDatasourceExample = new AppsyncDatasource(
+      this,
+      "example_6",
+      {
+        apiId: example.id,
+        dynamodbConfig: {
+          tableName: Token.asString(awsDynamodbTableExample.name),
+        },
+        name: "tf_appsync_example",
+        serviceRoleArn: Token.asString(awsIamRoleExample.arn),
+        type: "AMAZON_DYNAMODB",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsAppsyncDatasourceExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `apiId` - (Required) API ID for the GraphQL API for the data source.
+* `name` - (Required) User-supplied name for the data source.
+* `type` - (Required) Type of the Data Source. Valid values: `awsLambda`, `amazonDynamodb`, `amazonElasticsearch`, `http`, `none`, `relationalDatabase`, `amazonEventbridge`, `amazonOpensearchService`.
+* `description` - (Optional) Description of the data source.
+* `dynamodbConfig` - (Optional) DynamoDB settings. See [DynamoDB Config](#dynamodb-config)
+* `elasticsearchConfig` - (Optional) Amazon Elasticsearch settings. See [ElasticSearch Config](#elasticsearch-config)
+* `eventBridgeConfig` - (Optional) AWS EventBridge settings. See [Event Bridge Config](#event-bridge-config)
+* `httpConfig` - (Optional) HTTP settings. See [HTTP Config](#http-config)
+* `lambdaConfig` - (Optional) AWS Lambda settings. See [Lambda Config](#lambda-config)
+* `opensearchserviceConfig` - (Optional) Amazon OpenSearch Service settings. See [OpenSearch Service Config](#opensearch-service-config)
+* `relationalDatabaseConfig` (Optional) AWS RDS settings. See [Relational Database Config](#relational-database-config)
+* `serviceRoleArn` - (Optional) IAM service role ARN for the data source.
+
+### DynamoDB Config
+
+This argument supports the following arguments:
+
+* `tableName` - (Required) Name of the DynamoDB table.
+* `region` - (Optional) AWS region of the DynamoDB table. Defaults to current region.
+* `useCallerCredentials` - (Optional) Set to `true` to use Amazon Cognito credentials with this data source.
+* `deltaSyncConfig` - (Optional) The DeltaSyncConfig for a versioned data source. See [Delta Sync Config](#delta-sync-config)
+* `versioned` - (Optional) Detects Conflict Detection and Resolution with this data source.
+
+### Delta Sync Config
+
+* `baseTableTtl` - (Optional) The number of minutes that an Item is stored in the data source.
+* `deltaSyncTableName` - (Required) The table name.
+* `deltaSyncTableTtl` - (Optional) The number of minutes that a Delta Sync log entry is stored in the Delta Sync table.
+
+### ElasticSearch Config
+
+This argument supports the following arguments:
+
+* `endpoint` - (Required) HTTP endpoint of the Elasticsearch domain.
+* `region` - (Optional) AWS region of Elasticsearch domain. Defaults to current region.
+
+### Event Bridge Config
+
+This argument supports the following arguments:
+
+* `eventBusArn` - (Required) ARN for the EventBridge bus.
+
+### HTTP Config
+
+This argument supports the following arguments:
+
+* `endpoint` - (Required) HTTP URL.
+* `authorizationConfig` - (Optional) Authorization configuration in case the HTTP endpoint requires authorization. See [Authorization Config](#authorization-config).
+
+#### Authorization Config
+
+This argument supports the following arguments:
+
+* `authorizationType` - (Optional) Authorization type that the HTTP endpoint requires. Default values is `awsIam`.
+* `awsIamConfig` - (Optional) Identity and Access Management (IAM) settings. See [AWS IAM Config](#aws-iam-config).
+
+##### AWS IAM Config
+
+This argument supports the following arguments:
+
+* `signingRegion` - (Optional) Signing Amazon Web Services Region for IAM authorization.
+* `signingServiceName`- (Optional) Signing service name for IAM authorization.
+
+### Lambda Config
+
+This argument supports the following arguments:
+
+* `functionArn` - (Required) ARN for the Lambda function.
+
+### OpenSearch Service Config
+
+This argument supports the following arguments:
+
+* `endpoint` - (Required) HTTP endpoint of the OpenSearch domain.
+* `region` - (Optional) AWS region of the OpenSearch domain. Defaults to current region.
+
+### Relational Database Config
+
+This argument supports the following arguments:
+
+* `httpEndpointConfig` - (Required) Amazon RDS HTTP endpoint configuration. See [HTTP Endpoint Config](#http-endpoint-config).
+* `sourceType` - (Optional) Source type for the relational database. Valid values: `rdsHttpEndpoint`.
+
+#### HTTP Endpoint Config
+
+This argument supports the following arguments:
+
+* `dbClusterIdentifier` - (Required) Amazon RDS cluster identifier.
+* `awsSecretStoreArn` - (Required) AWS secret store ARN for database credentials.
+* `databaseName` - (Optional) Logical database name.
+* `region` - (Optional) AWS Region for RDS HTTP endpoint. Defaults to current region.
+* `schema` - (Optional) Logical schema name.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsAppsyncDatasource` using the `apiId`, a hyphen, and `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsAppsyncDatasource` using the `apiId`, a hyphen, and `name`. For example:
+
+```console
+% terraform import aws_appsync_datasource.example abcdef123456-example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-65f545420c1890e5f6affd2d36656c47c2a7c4b889f24fd05541970389549ddb -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/appsync_domain_name.html.markdown b/website/docs/cdktf/typescript/r/appsync_domain_name.html.markdown
new file mode 100644
index 00000000000..f1d6bc1eb44
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/appsync_domain_name.html.markdown
@@ -0,0 +1,76 @@
+---
+subcategory: "AppSync"
+layout: "aws"
+page_title: "AWS: aws_appsync_domain_name"
+description: |-
+  Provides an AppSync Domain Name.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_appsync_domain_name
+
+Provides an AppSync Domain Name.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AppsyncDomainName } from "./.gen/providers/aws/appsync-domain-name";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AppsyncDomainName(this, "example", {
+      certificateArn: Token.asString(awsAcmCertificateExample.arn),
+      domainName: "api.example.com",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `certificateArn` - (Required) ARN of the certificate. This can be an Certificate Manager (ACM) certificate or an Identity and Access Management (IAM) server certificate. The certifiacte must reside in us-east-1.
+* `description` - (Optional)  A description of the Domain Name.
+* `domainName` - (Required) Domain name.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Appsync Domain Name.
+* `appsyncDomainName` - Domain name that AppSync provides.
+* `hostedZoneId` - ID of your Amazon Route 53 hosted zone.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsAppsyncDomainName` using the AppSync domain name. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsAppsyncDomainName` using the AppSync domain name. For example:
+
+```console
+% terraform import aws_appsync_domain_name.example example.com
+```
+
+<!-- cache-key: cdktf-0.18.0 input-c850eb2b8026013d6a49e351a9f3cc357c29b074be725be34e7d5f3683fad68c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/appsync_domain_name_api_association.html.markdown b/website/docs/cdktf/typescript/r/appsync_domain_name_api_association.html.markdown
new file mode 100644
index 00000000000..9d9ff24f2d4
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/appsync_domain_name_api_association.html.markdown
@@ -0,0 +1,73 @@
+---
+subcategory: "AppSync"
+layout: "aws"
+page_title: "AWS: aws_appsync_domain_name_api_association"
+description: |-
+  Provides an AppSync API Association.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_appsync_domain_name_api_association
+
+Provides an AppSync API Association.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AppsyncDomainNameApiAssociation } from "./.gen/providers/aws/appsync-domain-name-api-association";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AppsyncDomainNameApiAssociation(this, "example", {
+      apiId: Token.asString(awsAppsyncGraphqlApiExample.id),
+      domainName: Token.asString(awsAppsyncDomainNameExample.domainName),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `apiId` - (Required) API ID.
+* `domainName` - (Required) Appsync domain name.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Appsync domain name.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsAppsyncDomainNameApiAssociation` using the AppSync domain name. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsAppsyncDomainNameApiAssociation` using the AppSync domain name. For example:
+
+```console
+% terraform import aws_appsync_domain_name_api_association.example example.com
+```
+
+<!-- cache-key: cdktf-0.18.0 input-20f8e537078df27312c2183f4ab0c0158ba5ec522ac3da6fb70fd599dad00b8f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/appsync_function.html.markdown b/website/docs/cdktf/typescript/r/appsync_function.html.markdown
new file mode 100644
index 00000000000..dc8d5916270
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/appsync_function.html.markdown
@@ -0,0 +1,163 @@
+---
+subcategory: "AppSync"
+layout: "aws"
+page_title: "AWS: aws_appsync_function"
+description: |-
+  Provides an AppSync Function.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_appsync_function
+
+Provides an AppSync Function.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AppsyncDatasource } from "./.gen/providers/aws/appsync-datasource";
+import { AppsyncFunction } from "./.gen/providers/aws/appsync-function";
+import { AppsyncGraphqlApi } from "./.gen/providers/aws/appsync-graphql-api";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new AppsyncGraphqlApi(this, "example", {
+      authenticationType: "API_KEY",
+      name: "example",
+      schema:
+        "type Mutation {\n  putPost(id: ID!, title: String!): Post\n}\n\ntype Post {\n  id: ID!\n  title: String!\n}\n\ntype Query {\n  singlePost(id: ID!): Post\n}\n\nschema {\n  query: Query\n  mutation: Mutation\n}\n\n",
+    });
+    const awsAppsyncDatasourceExample = new AppsyncDatasource(
+      this,
+      "example_1",
+      {
+        apiId: example.id,
+        httpConfig: {
+          endpoint: "http://example.com",
+        },
+        name: "example",
+        type: "HTTP",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsAppsyncDatasourceExample.overrideLogicalId("example");
+    const awsAppsyncFunctionExample = new AppsyncFunction(this, "example_2", {
+      apiId: example.id,
+      dataSource: Token.asString(awsAppsyncDatasourceExample.name),
+      name: "example",
+      requestMappingTemplate:
+        '{\n    "version": "2018-05-29",\n    "method": "GET",\n    "resourcePath": "/",\n    "params":{\n        "headers": $utils.http.copyheaders($ctx.request.headers)\n    }\n}\n\n',
+      responseMappingTemplate:
+        "#if($ctx.result.statusCode == 200)\n    $ctx.result.body\n#else\n    $utils.appendError($ctx.result.body, $ctx.result.statusCode)\n#end\n\n",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsAppsyncFunctionExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Example Usage With Code
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, Fn, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AppsyncFunction } from "./.gen/providers/aws/appsync-function";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AppsyncFunction(this, "example", {
+      apiId: Token.asString(awsAppsyncGraphqlApiExample.id),
+      code: Token.asString(Fn.file("some-code-dir")),
+      dataSource: Token.asString(awsAppsyncDatasourceExample.name),
+      name: "example",
+      runtime: {
+        name: "APPSYNC_JS",
+        runtimeVersion: "1.0.0",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `apiId` - (Required) ID of the associated AppSync API.
+* `code` - (Optional) The function code that contains the request and response functions. When code is used, the runtime is required. The runtime value must be APPSYNC_JS.
+* `dataSource` - (Required) Function data source name.
+* `maxBatchSize` - (Optional) Maximum batching size for a resolver. Valid values are between `0` and `2000`.
+* `name` - (Required) Function name. The function name does not have to be unique.
+* `requestMappingTemplate` - (Optional) Function request mapping template. Functions support only the 2018-05-29 version of the request mapping template.
+* `responseMappingTemplate` - (Optional) Function response mapping template.
+* `description` - (Optional) Function description.
+* `runtime` - (Optional) Describes a runtime used by an AWS AppSync pipeline resolver or AWS AppSync function. Specifies the name and version of the runtime to use. Note that if a runtime is specified, code must also be specified. See [Runtime](#runtime).
+* `syncConfig` - (Optional) Describes a Sync configuration for a resolver. See [Sync Config](#sync-config).
+* `functionVersion` - (Optional) Version of the request mapping template. Currently the supported value is `20180529`. Does not apply when specifying `code`.
+
+### Runtime
+
+This argument supports the following arguments:
+
+* `name` - (Optional) The name of the runtime to use. Currently, the only allowed value is `appsyncJs`.
+* `runtimeVersion` - (Optional) The version of the runtime to use. Currently, the only allowed version is `100`.
+
+### Sync Config
+
+This argument supports the following arguments:
+
+* `conflictDetection` - (Optional) Conflict Detection strategy to use. Valid values are `none` and `version`.
+* `conflictHandler` - (Optional) Conflict Resolution strategy to perform in the event of a conflict. Valid values are `none`, `optimisticConcurrency`, `automerge`, and `lambda`.
+* `lambdaConflictHandlerConfig` - (Optional) Lambda Conflict Handler Config when configuring `lambda` as the Conflict Handler. See [Lambda Conflict Handler Config](#lambda-conflict-handler-config).
+
+#### Lambda Conflict Handler Config
+
+This argument supports the following arguments:
+
+* `lambdaConflictHandlerArn` - (Optional) ARN for the Lambda function to use as the Conflict Handler.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - API Function ID (Formatted as ApiId-FunctionId)
+* `arn` - ARN of the Function object.
+* `functionId` - Unique ID representing the Function object.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsAppsyncFunction` using the AppSync API ID and Function ID separated by `-`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsAppsyncFunction` using the AppSync API ID and Function ID separated by `-`. For example:
+
+```console
+% terraform import aws_appsync_function.example xxxxx-yyyyy
+```
+
+<!-- cache-key: cdktf-0.18.0 input-fd5bccadc3a9b3adcc9e953b3f3b963bdbabce78f3f8569cb3998c93b4620955 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/appsync_graphql_api.html.markdown b/website/docs/cdktf/typescript/r/appsync_graphql_api.html.markdown
new file mode 100644
index 00000000000..8cd7a44b70d
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/appsync_graphql_api.html.markdown
@@ -0,0 +1,432 @@
+---
+subcategory: "AppSync"
+layout: "aws"
+page_title: "AWS: aws_appsync_graphql_api"
+description: |-
+  Provides an AppSync GraphQL API.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_appsync_graphql_api
+
+Provides an AppSync GraphQL API.
+
+## Example Usage
+
+### API Key Authentication
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AppsyncGraphqlApi } from "./.gen/providers/aws/appsync-graphql-api";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AppsyncGraphqlApi(this, "example", {
+      authenticationType: "API_KEY",
+      name: "example",
+    });
+  }
+}
+
+```
+
+### AWS IAM Authentication
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AppsyncGraphqlApi } from "./.gen/providers/aws/appsync-graphql-api";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AppsyncGraphqlApi(this, "example", {
+      authenticationType: "AWS_IAM",
+      name: "example",
+    });
+  }
+}
+
+```
+
+### AWS Cognito User Pool Authentication
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AppsyncGraphqlApi } from "./.gen/providers/aws/appsync-graphql-api";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AppsyncGraphqlApi(this, "example", {
+      authenticationType: "AMAZON_COGNITO_USER_POOLS",
+      name: "example",
+      userPoolConfig: {
+        awsRegion: Token.asString(current.name),
+        defaultAction: "DENY",
+        userPoolId: Token.asString(awsCognitoUserPoolExample.id),
+      },
+    });
+  }
+}
+
+```
+
+### OpenID Connect Authentication
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AppsyncGraphqlApi } from "./.gen/providers/aws/appsync-graphql-api";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AppsyncGraphqlApi(this, "example", {
+      authenticationType: "OPENID_CONNECT",
+      name: "example",
+      openidConnectConfig: {
+        issuer: "https://example.com",
+      },
+    });
+  }
+}
+
+```
+
+### AWS Lambda Authorizer Authentication
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AppsyncGraphqlApi } from "./.gen/providers/aws/appsync-graphql-api";
+import { LambdaPermission } from "./.gen/providers/aws/lambda-permission";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new AppsyncGraphqlApi(this, "example", {
+      authenticationType: "AWS_LAMBDA",
+      lambdaAuthorizerConfig: {
+        authorizerUri:
+          "arn:aws:lambda:us-east-1:123456789012:function:custom_lambda_authorizer",
+      },
+      name: "example",
+    });
+    new LambdaPermission(this, "appsync_lambda_authorizer", {
+      action: "lambda:InvokeFunction",
+      functionName: "custom_lambda_authorizer",
+      principal: "appsync.amazonaws.com",
+      sourceArn: example.arn,
+      statementId: "appsync_lambda_authorizer",
+    });
+  }
+}
+
+```
+
+### With Multiple Authentication Providers
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AppsyncGraphqlApi } from "./.gen/providers/aws/appsync-graphql-api";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AppsyncGraphqlApi(this, "example", {
+      additionalAuthenticationProvider: [
+        {
+          authenticationType: "AWS_IAM",
+        },
+      ],
+      authenticationType: "API_KEY",
+      name: "example",
+    });
+  }
+}
+
+```
+
+### With Schema
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AppsyncGraphqlApi } from "./.gen/providers/aws/appsync-graphql-api";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AppsyncGraphqlApi(this, "example", {
+      authenticationType: "AWS_IAM",
+      name: "example",
+      schema: "schema {\n\tquery: Query\n}\ntype Query {\n  test: Int\n}\n\n",
+    });
+  }
+}
+
+```
+
+### Enabling Logging
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AppsyncGraphqlApi } from "./.gen/providers/aws/appsync-graphql-api";
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+import { IamRolePolicyAttachment } from "./.gen/providers/aws/iam-role-policy-attachment";
+interface MyConfig {
+  authenticationType: any;
+  name: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    const assumeRole = new DataAwsIamPolicyDocument(this, "assume_role", {
+      statement: [
+        {
+          actions: ["sts:AssumeRole"],
+          effect: "Allow",
+          principals: [
+            {
+              identifiers: ["appsync.amazonaws.com"],
+              type: "Service",
+            },
+          ],
+        },
+      ],
+    });
+    const example = new IamRole(this, "example", {
+      assumeRolePolicy: Token.asString(assumeRole.json),
+      name: "example",
+    });
+    const awsIamRolePolicyAttachmentExample = new IamRolePolicyAttachment(
+      this,
+      "example_2",
+      {
+        policyArn:
+          "arn:aws:iam::aws:policy/service-role/AWSAppSyncPushToCloudWatchLogs",
+        role: example.name,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamRolePolicyAttachmentExample.overrideLogicalId("example");
+    const awsAppsyncGraphqlApiExample = new AppsyncGraphqlApi(
+      this,
+      "example_3",
+      {
+        logConfig: {
+          cloudwatchLogsRoleArn: example.arn,
+          fieldLogLevel: "ERROR",
+        },
+        authenticationType: config.authenticationType,
+        name: config.name,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsAppsyncGraphqlApiExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### Associate Web ACL (v2)
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AppsyncGraphqlApi } from "./.gen/providers/aws/appsync-graphql-api";
+import { Wafv2WebAcl } from "./.gen/providers/aws/wafv2-web-acl";
+import { Wafv2WebAclAssociation } from "./.gen/providers/aws/wafv2-web-acl-association";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new AppsyncGraphqlApi(this, "example", {
+      authenticationType: "API_KEY",
+      name: "example",
+    });
+    const awsWafv2WebAclExample = new Wafv2WebAcl(this, "example_1", {
+      defaultAction: {
+        allow: {},
+      },
+      description: "Example of a managed rule.",
+      name: "managed-rule-example",
+      rule: [
+        {
+          name: "rule-1",
+          overrideAction: {
+            block: [{}],
+          },
+          priority: 1,
+          statement: {
+            managedRuleGroupStatement: {
+              name: "AWSManagedRulesCommonRuleSet",
+              vendorName: "AWS",
+            },
+          },
+          visibilityConfig: {
+            cloudwatchMetricsEnabled: false,
+            metricName: "friendly-rule-metric-name",
+            sampledRequestsEnabled: false,
+          },
+        },
+      ],
+      scope: "REGIONAL",
+      visibilityConfig: {
+        cloudwatchMetricsEnabled: false,
+        metricName: "friendly-metric-name",
+        sampledRequestsEnabled: false,
+      },
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsWafv2WebAclExample.overrideLogicalId("example");
+    const awsWafv2WebAclAssociationExample = new Wafv2WebAclAssociation(
+      this,
+      "example_2",
+      {
+        resourceArn: example.arn,
+        webAclArn: Token.asString(awsWafv2WebAclExample.arn),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsWafv2WebAclAssociationExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `authenticationType` - (Required) Authentication type. Valid values: `apiKey`, `awsIam`, `amazonCognitoUserPools`, `openidConnect`, `awsLambda`
+* `name` - (Required) User-supplied name for the GraphqlApi.
+* `logConfig` - (Optional) Nested argument containing logging configuration. Defined below.
+* `openidConnectConfig` - (Optional) Nested argument containing OpenID Connect configuration. Defined below.
+* `userPoolConfig` - (Optional) Amazon Cognito User Pool configuration. Defined below.
+* `lambdaAuthorizerConfig` - (Optional) Nested argument containing Lambda authorizer configuration. Defined below.
+* `schema` - (Optional) Schema definition, in GraphQL schema language format. Terraform cannot perform drift detection of this configuration.
+* `additionalAuthenticationProvider` - (Optional) One or more additional authentication providers for the GraphqlApi. Defined below.
+* `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `xrayEnabled` - (Optional) Whether tracing with X-ray is enabled. Defaults to false.
+* `visibility` - (Optional) Sets the value of the GraphQL API to public (`global`) or private (`private`). If no value is provided, the visibility will be set to `global` by default. This value cannot be changed once the API has been created.
+
+### log_config
+
+This argument supports the following arguments:
+
+* `cloudwatchLogsRoleArn` - (Required) Amazon Resource Name of the service role that AWS AppSync will assume to publish to Amazon CloudWatch logs in your account.
+* `fieldLogLevel` - (Required) Field logging level. Valid values: `all`, `error`, `none`.
+* `excludeVerboseContent` - (Optional) Set to TRUE to exclude sections that contain information such as headers, context, and evaluated mapping templates, regardless of logging  level. Valid values: `true`, `false`. Default value: `false`
+
+### additional_authentication_provider
+
+This argument supports the following arguments:
+
+* `authenticationType` - (Required) Authentication type. Valid values: `apiKey`, `awsIam`, `amazonCognitoUserPools`, `openidConnect`, `awsLambda`
+* `openidConnectConfig` - (Optional) Nested argument containing OpenID Connect configuration. Defined below.
+* `userPoolConfig` - (Optional) Amazon Cognito User Pool configuration. Defined below.
+
+### openid_connect_config
+
+This argument supports the following arguments:
+
+* `issuer` - (Required) Issuer for the OpenID Connect configuration. The issuer returned by discovery MUST exactly match the value of iss in the ID Token.
+* `authTtl` - (Optional) Number of milliseconds a token is valid after being authenticated.
+* `clientId` - (Optional) Client identifier of the Relying party at the OpenID identity provider. This identifier is typically obtained when the Relying party is registered with the OpenID identity provider. You can specify a regular expression so the AWS AppSync can validate against multiple client identifiers at a time.
+* `iatTtl` - (Optional) Number of milliseconds a token is valid after being issued to a user.
+
+### user_pool_config
+
+This argument supports the following arguments:
+
+* `defaultAction` - (Required only if Cognito is used as the default auth provider) Action that you want your GraphQL API to take when a request that uses Amazon Cognito User Pool authentication doesn't match the Amazon Cognito User Pool configuration. Valid: `allow` and `deny`
+* `userPoolId` - (Required) User pool ID.
+* `appIdClientRegex` - (Optional) Regular expression for validating the incoming Amazon Cognito User Pool app client ID.
+* `awsRegion` - (Optional) AWS region in which the user pool was created.
+
+### lambda_authorizer_config
+
+This argument supports the following arguments:
+
+* `authorizerUri` - (Required) ARN of the Lambda function to be called for authorization. Note: This Lambda function must have a resource-based policy assigned to it, to allow `lambda:invokeFunction` from service principal `appsyncAmazonawsCom`.
+* `authorizerResultTtlInSeconds` - (Optional) Number of seconds a response should be cached for. The default is 5 minutes (300 seconds). The Lambda function can override this by returning a `ttlOverride` key in its response. A value of 0 disables caching of responses. Minimum value of 0. Maximum value of 3600.
+* `identityValidationExpression` - (Optional) Regular expression for validation of tokens before the Lambda function is called.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - API ID
+* `arn` - ARN
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `uris` - Map of URIs associated with the APIE.g., `uris["GRAPHQL"] = https://ID.appsync-api.REGION.amazonaws.com/graphql`
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AppSync GraphQL API using the GraphQL API ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import AppSync GraphQL API using the GraphQL API ID. For example:
+
+```console
+% terraform import aws_appsync_graphql_api.example 0123456789
+```
+
+<!-- cache-key: cdktf-0.18.0 input-604f59c6c350d24f978a0ba94f2c30cf28473a80d9b5a2275a86a5740a4b0ee4 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/appsync_resolver.html.markdown b/website/docs/cdktf/typescript/r/appsync_resolver.html.markdown
new file mode 100644
index 00000000000..f33e533ae4e
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/appsync_resolver.html.markdown
@@ -0,0 +1,182 @@
+---
+subcategory: "AppSync"
+layout: "aws"
+page_title: "AWS: aws_appsync_resolver"
+description: |-
+  Provides an AppSync Resolver.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_appsync_resolver
+
+Provides an AppSync Resolver.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AppsyncDatasource } from "./.gen/providers/aws/appsync-datasource";
+import { AppsyncGraphqlApi } from "./.gen/providers/aws/appsync-graphql-api";
+import { AppsyncResolver } from "./.gen/providers/aws/appsync-resolver";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const test = new AppsyncGraphqlApi(this, "test", {
+      authenticationType: "API_KEY",
+      name: "tf-example",
+      schema:
+        "type Mutation {\n\tputPost(id: ID!, title: String!): Post\n}\n\ntype Post {\n\tid: ID!\n\ttitle: String!\n}\n\ntype Query {\n\tsinglePost(id: ID!): Post\n}\n\nschema {\n\tquery: Query\n\tmutation: Mutation\n}\n\n",
+    });
+    new AppsyncResolver(this, "Mutation_pipelineTest", {
+      apiId: test.id,
+      field: "pipelineTest",
+      kind: "PIPELINE",
+      pipelineConfig: {
+        functions: [test1.functionId, test2.functionId, test3.functionId],
+      },
+      requestTemplate: "{}",
+      responseTemplate: "$util.toJson($ctx.result)",
+      type: "Mutation",
+    });
+    const awsAppsyncDatasourceTest = new AppsyncDatasource(this, "test_2", {
+      apiId: test.id,
+      httpConfig: {
+        endpoint: "http://example.com",
+      },
+      name: "tf_example",
+      type: "HTTP",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsAppsyncDatasourceTest.overrideLogicalId("test");
+    const awsAppsyncResolverTest = new AppsyncResolver(this, "test_3", {
+      apiId: test.id,
+      cachingConfig: {
+        cachingKeys: ["$context.identity.sub", "$context.arguments.id"],
+        ttl: 60,
+      },
+      dataSource: Token.asString(awsAppsyncDatasourceTest.name),
+      field: "singlePost",
+      requestTemplate:
+        '{\n    "version": "2018-05-29",\n    "method": "GET",\n    "resourcePath": "/",\n    "params":{\n        "headers": $utils.http.copyheaders($ctx.request.headers)\n    }\n}\n\n',
+      responseTemplate:
+        "#if($ctx.result.statusCode == 200)\n    $ctx.result.body\n#else\n    $utils.appendError($ctx.result.body, $ctx.result.statusCode)\n#end\n\n",
+      type: "Query",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsAppsyncResolverTest.overrideLogicalId("test");
+  }
+}
+
+```
+
+## Example Usage JS
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AppsyncResolver } from "./.gen/providers/aws/appsync-resolver";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AppsyncResolver(this, "example", {
+      apiId: test.id,
+      code: Token.asString(Fn.file("some-code-dir")),
+      field: "pipelineTest",
+      kind: "PIPELINE",
+      pipelineConfig: {
+        functions: [Token.asString(awsAppsyncFunctionTest.functionId)],
+      },
+      runtime: {
+        name: "APPSYNC_JS",
+        runtimeVersion: "1.0.0",
+      },
+      type: "Query",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `apiId` - (Required) API ID for the GraphQL API.
+* `code` - (Optional) The function code that contains the request and response functions. When code is used, the runtime is required. The runtime value must be APPSYNC_JS.
+* `type` - (Required) Type name from the schema defined in the GraphQL API.
+* `field` - (Required) Field name from the schema defined in the GraphQL API.
+* `requestTemplate` - (Optional) Request mapping template for UNIT resolver or 'before mapping template' for PIPELINE resolver. Required for non-Lambda resolvers.
+* `responseTemplate` - (Optional) Response mapping template for UNIT resolver or 'after mapping template' for PIPELINE resolver. Required for non-Lambda resolvers.
+* `dataSource` - (Optional) Data source name.
+* `maxBatchSize` - (Optional) Maximum batching size for a resolver. Valid values are between `0` and `2000`.
+* `kind`  - (Optional) Resolver type. Valid values are `unit` and `pipeline`.
+* `syncConfig` - (Optional) Describes a Sync configuration for a resolver. See [Sync Config](#sync-config).
+* `pipelineConfig` - (Optional) The caching configuration for the resolver. See [Pipeline Config](#pipeline-config).
+* `cachingConfig` - (Optional) The Caching Config. See [Caching Config](#caching-config).
+* `runtime` - (Optional) Describes a runtime used by an AWS AppSync pipeline resolver or AWS AppSync function. Specifies the name and version of the runtime to use. Note that if a runtime is specified, code must also be specified. See [Runtime](#runtime).
+
+### Caching Config
+
+* `cachingKeys` - (Optional) The caching keys for a resolver that has caching activated. Valid values are entries from the $context.arguments, $context.source, and $context.identity maps.
+* `ttl` - (Optional) The TTL in seconds for a resolver that has caching activated. Valid values are between `1` and `3600` seconds.
+
+### Pipeline Config
+
+* `functions` - (Optional) A list of Function objects.
+
+### Sync Config
+
+* `conflictDetection` - (Optional) Conflict Detection strategy to use. Valid values are `none` and `version`.
+* `conflictHandler` - (Optional) Conflict Resolution strategy to perform in the event of a conflict. Valid values are `none`, `optimisticConcurrency`, `automerge`, and `lambda`.
+* `lambdaConflictHandlerConfig` - (Optional) Lambda Conflict Handler Config when configuring `lambda` as the Conflict Handler. See [Lambda Conflict Handler Config](#lambda-conflict-handler-config).
+
+#### Lambda Conflict Handler Config
+
+* `lambdaConflictHandlerArn` - (Optional) ARN for the Lambda function to use as the Conflict Handler.
+
+### Runtime
+
+* `name` - (Optional) The name of the runtime to use. Currently, the only allowed value is `appsyncJs`.
+* `runtimeVersion` - (Optional) The version of the runtime to use. Currently, the only allowed version is `100`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsAppsyncResolver` using the `apiId`, a hyphen, `type`, a hypen and `field`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsAppsyncResolver` using the `apiId`, a hyphen, `type`, a hypen and `field`. For example:
+
+```console
+% terraform import aws_appsync_resolver.example abcdef123456-exampleType-exampleField
+```
+
+<!-- cache-key: cdktf-0.18.0 input-c52e7e65e799b6104f6c311a148eb1f52433b7035e764e94e6ade1153f6ef6e4 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/appsync_type.html.markdown b/website/docs/cdktf/typescript/r/appsync_type.html.markdown
new file mode 100644
index 00000000000..ea75e74f6fa
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/appsync_type.html.markdown
@@ -0,0 +1,86 @@
+---
+subcategory: "AppSync"
+layout: "aws"
+page_title: "AWS: aws_appsync_type"
+description: |-
+  Provides an AppSync Type.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_appsync_type
+
+Provides an AppSync Type.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AppsyncGraphqlApi } from "./.gen/providers/aws/appsync-graphql-api";
+import { AppsyncType } from "./.gen/providers/aws/appsync-type";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new AppsyncGraphqlApi(this, "example", {
+      authenticationType: "API_KEY",
+      name: "example",
+    });
+    const awsAppsyncTypeExample = new AppsyncType(this, "example_1", {
+      apiId: example.id,
+      definition:
+        "type Mutation\n\n{\nputPost(id: ID!,title: String! ): Post\n\n}\n\n",
+      format: "SDL",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsAppsyncTypeExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `apiId` - (Required) GraphQL API ID.
+* `format` - (Required) The type format: `sdl` or `json`.
+* `definition` - (Required) The type definition.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the type.
+* `description` - The type description.
+* `id` - The ID is constructed from `apiId:format:name`.
+* `name` - The type name.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Appsync Types using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Appsync Types using the `id`. For example:
+
+```console
+% terraform import aws_appsync_type.example api-id:format:name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-583d1e739ac827e753ccd0e8ee386fa69ac34d8c7a9c5385c707c9de6772d943 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/athena_data_catalog.html.markdown b/website/docs/cdktf/typescript/r/athena_data_catalog.html.markdown
new file mode 100644
index 00000000000..260620042a7
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/athena_data_catalog.html.markdown
@@ -0,0 +1,175 @@
+---
+subcategory: "Athena"
+layout: "aws"
+page_title: "AWS: aws_athena_data_catalog"
+description: |-
+  Provides an Athena data catalog.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_athena_data_catalog
+
+Provides an Athena data catalog.
+
+More information about Athena and Athena data catalogs can be found in the [Athena User Guide](https://docs.aws.amazon.com/athena/latest/ug/what-is.html).
+
+-> **Tip:** for a more detailed explanation on the usage of `parameters`, see the [DataCatalog API documentation](https://docs.aws.amazon.com/athena/latest/APIReference/API_DataCatalog.html)
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AthenaDataCatalog } from "./.gen/providers/aws/athena-data-catalog";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AthenaDataCatalog(this, "example", {
+      description: "Example Athena data catalog",
+      name: "athena-data-catalog",
+      parameters: {
+        function:
+          "arn:aws:lambda:eu-central-1:123456789012:function:not-important-lambda-function",
+      },
+      tags: {
+        Name: "example-athena-data-catalog",
+      },
+      type: "LAMBDA",
+    });
+  }
+}
+
+```
+
+### Hive based Data Catalog
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AthenaDataCatalog } from "./.gen/providers/aws/athena-data-catalog";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AthenaDataCatalog(this, "example", {
+      description: "Hive based Data Catalog",
+      name: "hive-data-catalog",
+      parameters: {
+        "metadata-function":
+          "arn:aws:lambda:eu-central-1:123456789012:function:not-important-lambda-function",
+      },
+      type: "HIVE",
+    });
+  }
+}
+
+```
+
+### Glue based Data Catalog
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AthenaDataCatalog } from "./.gen/providers/aws/athena-data-catalog";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AthenaDataCatalog(this, "example", {
+      description: "Glue based Data Catalog",
+      name: "glue-data-catalog",
+      parameters: {
+        "catalog-id": "123456789012",
+      },
+      type: "GLUE",
+    });
+  }
+}
+
+```
+
+### Lambda based Data Catalog
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AthenaDataCatalog } from "./.gen/providers/aws/athena-data-catalog";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AthenaDataCatalog(this, "example", {
+      description: "Lambda based Data Catalog",
+      name: "lambda-data-catalog",
+      parameters: {
+        "metadata-function":
+          "arn:aws:lambda:eu-central-1:123456789012:function:not-important-lambda-function-1",
+        "record-function":
+          "arn:aws:lambda:eu-central-1:123456789012:function:not-important-lambda-function-2",
+      },
+      type: "LAMBDA",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+- `name` - (Required) Name of the data catalog. The catalog name must be unique for the AWS account and can use a maximum of 128 alphanumeric, underscore, at sign, or hyphen characters.
+- `type` - (Required) Type of data catalog: `lambda` for a federated catalog, `glue` for AWS Glue Catalog, or `hive` for an external hive metastore.
+- `parameters` - (Required) Key value pairs that specifies the Lambda function or functions to use for the data catalog. The mapping used depends on the catalog type.
+- `description` - (Required) Description of the data catalog.
+- `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+- `id` - Name of the data catalog.
+- `arn` - ARN of the data catalog.
+- `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import data catalogs using their `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import data catalogs using their `name`. For example:
+
+```console
+% terraform import aws_athena_data_catalog.example example-data-catalog
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ca384d0d131eb64581ab0b3c036a49902737674d63de3f2960c9f3aa9b8f446f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/athena_database.html.markdown b/website/docs/cdktf/typescript/r/athena_database.html.markdown
new file mode 100644
index 00000000000..296f9b9593e
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/athena_database.html.markdown
@@ -0,0 +1,122 @@
+---
+subcategory: "Athena"
+layout: "aws"
+page_title: "AWS: aws_athena_database"
+description: |-
+  Provides an Athena database.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_athena_database
+
+Provides an Athena database.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AthenaDatabase } from "./.gen/providers/aws/athena-database";
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new S3Bucket(this, "example", {
+      bucket: "example",
+    });
+    const awsAthenaDatabaseExample = new AthenaDatabase(this, "example_1", {
+      bucket: example.id,
+      name: "database_name",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsAthenaDatabaseExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `bucket` - (Required) Name of S3 bucket to save the results of the query execution.
+* `name` - (Required) Name of the database to create.
+* `aclConfiguration` - (Optional) That an Amazon S3 canned ACL should be set to control ownership of stored query results. See [ACL Configuration](#acl-configuration) below.
+* `comment` - (Optional) Description of the database.
+* `encryptionConfiguration` - (Optional) Encryption key block AWS Athena uses to decrypt the data in S3, such as an AWS Key Management Service (AWS KMS) key. See [Encryption Configuration](#encryption-configuration) below.
+* `expectedBucketOwner` - (Optional) AWS account ID that you expect to be the owner of the Amazon S3 bucket.
+* `forceDestroy` - (Optional, Default: false) Boolean that indicates all tables should be deleted from the database so that the database can be destroyed without error. The tables are *not* recoverable.
+* `properties` - (Optional) Key-value map of custom metadata properties for the database definition.
+
+### ACL Configuration
+
+* `s3AclOption` - (Required) Amazon S3 canned ACL that Athena should specify when storing query results. Valid value is `bucketOwnerFullControl`.
+
+~> **NOTE:** When Athena queries are executed, result files may be created in the specified bucket. Consider using `forceDestroy` on the bucket too in order to avoid any problems when destroying the bucket.  
+
+### Encryption Configuration
+
+* `encryptionOption` - (Required) Type of key; one of `sseS3`, `sseKms`, `cseKms`
+* `kmsKey` - (Optional) KMS key ARN or ID; required for key types `sseKms` and `cseKms`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Database name
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Athena Databases using their name. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Athena Databases using their name. For example:
+
+```console
+% terraform import aws_athena_database.example example
+```
+
+Certain resource arguments, like `encryptionConfiguration` and `bucket`, do not have an API method for reading the information after creation. If the argument is set in the Terraform configuration on an imported resource, Terraform will always show a difference. To workaround this behavior, either omit the argument from the Terraform configuration or use [`ignoreChanges`](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html#ignore_changes) to hide the difference. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AthenaDatabase } from "./.gen/providers/aws/athena-database";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AthenaDatabase(this, "example", {
+      bucket: Token.asString(awsS3BucketExample.id),
+      lifecycle: {
+        ignoreChanges: [bucket],
+      },
+      name: "database_name",
+    });
+  }
+}
+
+```
+
+<!-- cache-key: cdktf-0.18.0 input-189ae35c915899617823f1aa58e52b808e9d89a93ad41348d3b67590fd2c7244 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/athena_named_query.html.markdown b/website/docs/cdktf/typescript/r/athena_named_query.html.markdown
new file mode 100644
index 00000000000..7642fbfa028
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/athena_named_query.html.markdown
@@ -0,0 +1,108 @@
+---
+subcategory: "Athena"
+layout: "aws"
+page_title: "AWS: aws_athena_named_query"
+description: |-
+  Provides an Athena Named Query resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_athena_named_query
+
+Provides an Athena Named Query resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AthenaDatabase } from "./.gen/providers/aws/athena-database";
+import { AthenaNamedQuery } from "./.gen/providers/aws/athena-named-query";
+import { AthenaWorkgroup } from "./.gen/providers/aws/athena-workgroup";
+import { KmsKey } from "./.gen/providers/aws/kms-key";
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const test = new KmsKey(this, "test", {
+      deletionWindowInDays: 7,
+      description: "Athena KMS Key",
+    });
+    const hoge = new S3Bucket(this, "hoge", {
+      bucket: "tf-test",
+    });
+    const awsAthenaDatabaseHoge = new AthenaDatabase(this, "hoge_2", {
+      bucket: hoge.id,
+      name: "users",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsAthenaDatabaseHoge.overrideLogicalId("hoge");
+    const awsAthenaWorkgroupTest = new AthenaWorkgroup(this, "test_3", {
+      configuration: {
+        resultConfiguration: {
+          encryptionConfiguration: {
+            encryptionOption: "SSE_KMS",
+            kmsKeyArn: test.arn,
+          },
+        },
+      },
+      name: "example",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsAthenaWorkgroupTest.overrideLogicalId("test");
+    new AthenaNamedQuery(this, "foo", {
+      database: Token.asString(awsAthenaDatabaseHoge.name),
+      name: "bar",
+      query: "SELECT * FROM ${" + awsAthenaDatabaseHoge.name + "} limit 10;",
+      workgroup: Token.asString(awsAthenaWorkgroupTest.id),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) Plain language name for the query. Maximum length of 128.
+* `workgroup` - (Optional) Workgroup to which the query belongs. Defaults to `primary`
+* `database` - (Required) Database to which the query belongs.
+* `query` - (Required) Text of the query itself. In other words, all query statements. Maximum length of 262144.
+* `description` - (Optional) Brief explanation of the query. Maximum length of 1024.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Unique ID of the query.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Athena Named Query using the query ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Athena Named Query using the query ID. For example:
+
+```console
+% terraform import aws_athena_named_query.example 0123456789
+```
+
+<!-- cache-key: cdktf-0.18.0 input-47b0d06df589479137354b1a06a5e12352b544e95a27f4e5bc2dec9fa0224790 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/athena_workgroup.html.markdown b/website/docs/cdktf/typescript/r/athena_workgroup.html.markdown
new file mode 100644
index 00000000000..422325186bb
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/athena_workgroup.html.markdown
@@ -0,0 +1,122 @@
+---
+subcategory: "Athena"
+layout: "aws"
+page_title: "AWS: aws_athena_workgroup"
+description: |-
+  Manages an Athena Workgroup.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_athena_workgroup
+
+Provides an Athena Workgroup.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AthenaWorkgroup } from "./.gen/providers/aws/athena-workgroup";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AthenaWorkgroup(this, "example", {
+      configuration: {
+        enforceWorkgroupConfiguration: true,
+        publishCloudwatchMetricsEnabled: true,
+        resultConfiguration: {
+          encryptionConfiguration: {
+            encryptionOption: "SSE_KMS",
+            kmsKeyArn: Token.asString(awsKmsKeyExample.arn),
+          },
+          outputLocation: "s3://${" + awsS3BucketExample.bucket + "}/output/",
+        },
+      },
+      name: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) Name of the workgroup.
+* `configuration` - (Optional) Configuration block with various settings for the workgroup. Documented below.
+* `description` - (Optional) Description of the workgroup.
+* `state` - (Optional) State of the workgroup. Valid values are `disabled` or `enabled`. Defaults to `enabled`.
+* `tags` - (Optional) Key-value map of resource tags for the workgroup. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `forceDestroy` - (Optional) Option to delete the workgroup and its contents even if the workgroup contains any named queries.
+
+### Configuration
+
+* `bytesScannedCutoffPerQuery` - (Optional) Integer for the upper data usage limit (cutoff) for the amount of bytes a single query in a workgroup is allowed to scan. Must be at least `10485760`.
+* `enforceWorkgroupConfiguration` - (Optional) Boolean whether the settings for the workgroup override client-side settings. For more information, see [Workgroup Settings Override Client-Side Settings](https://docs.aws.amazon.com/athena/latest/ug/workgroups-settings-override.html). Defaults to `true`.
+* `engineVersion` - (Optional) Configuration block for the Athena Engine Versioning. For more information, see [Athena Engine Versioning](https://docs.aws.amazon.com/athena/latest/ug/engine-versions.html). See [Engine Version](#engine-version) below.
+* `executionRole` - (Optional) Role used in a notebook session for accessing the user's resources.
+* `publishCloudwatchMetricsEnabled` - (Optional) Boolean whether Amazon CloudWatch metrics are enabled for the workgroup. Defaults to `true`.
+* `resultConfiguration` - (Optional) Configuration block with result settings. See [Result Configuration](#result-configuration) below.
+* `requesterPaysEnabled` - (Optional) If set to true , allows members assigned to a workgroup to reference Amazon S3 Requester Pays buckets in queries. If set to false , workgroup members cannot query data from Requester Pays buckets, and queries that retrieve data from Requester Pays buckets cause an error. The default is false . For more information about Requester Pays buckets, see [Requester Pays Buckets](https://docs.aws.amazon.com/AmazonS3/latest/dev/RequesterPaysBuckets.html) in the Amazon Simple Storage Service Developer Guide.
+
+#### Engine Version
+
+* `selectedEngineVersion` - (Optional) Requested engine version. Defaults to `auto`.
+
+#### Result Configuration
+
+* `encryptionConfiguration` - (Optional) Configuration block with encryption settings. See [Encryption Configuration](#encryption-configuration) below.
+* `aclConfiguration` - (Optional) That an Amazon S3 canned ACL should be set to control ownership of stored query results. See [ACL Configuration](#acl-configuration) below.
+* `expectedBucketOwner` - (Optional) AWS account ID that you expect to be the owner of the Amazon S3 bucket.
+* `outputLocation` - (Optional) Location in Amazon S3 where your query results are stored, such as `s3://path/to/query/bucket/`. For more information, see [Queries and Query Result Files](https://docs.aws.amazon.com/athena/latest/ug/querying.html).
+
+##### ACL Configuration
+
+* `s3AclOption` - (Required) Amazon S3 canned ACL that Athena should specify when storing query results. Valid value is `bucketOwnerFullControl`.
+
+##### Encryption Configuration
+
+* `encryptionOption` - (Required) Whether Amazon S3 server-side encryption with Amazon S3-managed keys (`sseS3`), server-side encryption with KMS-managed keys (`sseKms`), or client-side encryption with KMS-managed keys (`cseKms`) is used. If a query runs in a workgroup and the workgroup overrides client-side settings, then the workgroup's setting for encryption is used. It specifies whether query results must be encrypted, for all queries that run in this workgroup.
+* `kmsKeyArn` - (Optional) For `sseKms` and `cseKms`, this is the KMS key ARN.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the workgroup
+* `configuration` - Configuration block with various settings for the workgroup
+    * `engineVersion` - Configuration block for the Athena Engine Versioning
+        * `effectiveEngineVersion` -  The engine version on which the query runs. If `selectedEngineVersion` is set to `auto`, the effective engine version is chosen by Athena.
+* `id` - Workgroup name
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Athena Workgroups using their name. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Athena Workgroups using their name. For example:
+
+```console
+% terraform import aws_athena_workgroup.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-c130731e53530304eb8b07566132f6c077365dfdbf8f6396690cec4300991bd4 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/auditmanager_account_registration.html.markdown b/website/docs/cdktf/typescript/r/auditmanager_account_registration.html.markdown
new file mode 100644
index 00000000000..e0e057fc879
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/auditmanager_account_registration.html.markdown
@@ -0,0 +1,96 @@
+---
+subcategory: "Audit Manager"
+layout: "aws"
+page_title: "AWS: aws_auditmanager_account_registration"
+description: |-
+  Terraform resource for managing AWS Audit Manager Account Registration.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_auditmanager_account_registration
+
+Terraform resource for managing AWS Audit Manager Account Registration.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AuditmanagerAccountRegistration } from "./.gen/providers/aws/auditmanager-account-registration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AuditmanagerAccountRegistration(this, "example", {});
+  }
+}
+
+```
+
+### Deregister On Destroy
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AuditmanagerAccountRegistration } from "./.gen/providers/aws/auditmanager-account-registration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AuditmanagerAccountRegistration(this, "example", {
+      deregisterOnDestroy: true,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are optional:
+
+* `delegatedAdminAccount` - (Optional) Identifier for the delegated administrator account.
+* `deregisterOnDestroy` - (Optional) Flag to deregister AuditManager in the account upon destruction. Defaults to `false` (ie. AuditManager will remain active in the account, even if this resource is removed).
+* `kmsKey` - (Optional) KMS key identifier.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Unique identifier for the account registration. Since registration is applied per AWS region, this will be the active region name (ex. `usEast1`).
+* `status` - Status of the account registration request.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Audit Manager Account Registration resources using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Audit Manager Account Registration resources using the `id`. For example:
+
+```console
+% terraform import aws_auditmanager_account_registration.example us-east-1
+```
+
+<!-- cache-key: cdktf-0.18.0 input-b8a8e96a39604df1b10232cf4a3d5b9b1cb58ec03eaacfe07b1799eb42bf2279 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/auditmanager_assessment.html.markdown b/website/docs/cdktf/typescript/r/auditmanager_assessment.html.markdown
new file mode 100644
index 00000000000..8b3dda612c7
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/auditmanager_assessment.html.markdown
@@ -0,0 +1,135 @@
+---
+subcategory: "Audit Manager"
+layout: "aws"
+page_title: "AWS: aws_auditmanager_assessment"
+description: |-
+  Terraform resource for managing an AWS Audit Manager Assessment.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_auditmanager_assessment
+
+Terraform resource for managing an AWS Audit Manager Assessment.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AuditmanagerAssessment } from "./.gen/providers/aws/auditmanager-assessment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AuditmanagerAssessment(this, "test", {
+      assessmentReportsDestination: [
+        {
+          destination: "s3://${" + awsS3BucketTest.id + "}",
+          destinationType: "S3",
+        },
+      ],
+      frameworkId: Token.asString(awsAuditmanagerFrameworkTest.id),
+      name: "example",
+      roles: [
+        {
+          roleArn: Token.asString(awsIamRoleTest.arn),
+          roleType: "PROCESS_OWNER",
+        },
+      ],
+      scope: [
+        {
+          awsAccounts: [
+            {
+              id: Token.asString(current.accountId),
+            },
+          ],
+          awsServices: [
+            {
+              serviceName: "S3",
+            },
+          ],
+        },
+      ],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) Name of the assessment.
+* `assessmentReportsDestination` - (Required) Assessment report storage destination configuration. See [`assessmentReportsDestination`](#assessment_reports_destination) below.
+* `frameworkId` - (Required) Unique identifier of the framework the assessment will be created from.
+* `roles` - (Required) List of roles for the assessment. See [`roles`](#roles) below.
+* `scope` - (Required) Amazon Web Services accounts and services that are in scope for the assessment. See [`scope`](#scope) below.
+
+The following arguments are optional:
+
+* `description` - (Optional) Description of the assessment.
+* `tags` - (Optional) A map of tags to assign to the assessment. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### assessment_reports_destination
+
+* `destination` - (Required) Destination of the assessment report. This value be in the form `s3://{bucketName}`.
+* `destinationType` - (Required) Destination type. Currently, `s3` is the only valid value.
+
+### roles
+
+* `roleArn` - (Required) Amazon Resource Name (ARN) of the IAM role.
+* `roleType` - (Required) Type of customer persona. For assessment creation, type must always be `processOwner`.
+
+### scope
+
+* `awsAccounts` - Amazon Web Services accounts that are in scope for the assessment. See [`awsAccounts`](#aws_accounts) below.
+* `awsServices` - Amazon Web Services services that are included in the scope of the assessment. See [`awsServices`](#aws_services) below.
+
+### aws_accounts
+
+* `id` - (Required) Identifier for the Amazon Web Services account.
+
+### aws_services
+
+* `serviceName` - (Required) Name of the Amazon Web Service.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the assessment.
+* `id` - Unique identifier for the assessment.
+* `rolesAll` - Complete list of all roles with access to the assessment. This includes both roles explicitly configured via the `roles` block, and any roles which have access to all Audit Manager assessments by default.
+* `status` - Status of the assessment. Valid values are `active` and `inactive`.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Audit Manager Assessments using the assessment `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Audit Manager Assessments using the assessment `id`. For example:
+
+```console
+% terraform import aws_auditmanager_assessment.example abc123-de45
+```
+
+<!-- cache-key: cdktf-0.18.0 input-aa1e0891f6ec8901473fa207078140ea42269fbcc18c7cea3c07e91aa207dcb8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/auditmanager_assessment_delegation.html.markdown b/website/docs/cdktf/typescript/r/auditmanager_assessment_delegation.html.markdown
new file mode 100644
index 00000000000..a8631bad841
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/auditmanager_assessment_delegation.html.markdown
@@ -0,0 +1,85 @@
+---
+subcategory: "Audit Manager"
+layout: "aws"
+page_title: "AWS: aws_auditmanager_assessment_delegation"
+description: |-
+  Terraform resource for managing an AWS Audit Manager Assessment Delegation.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_auditmanager_assessment_delegation
+
+Terraform resource for managing an AWS Audit Manager Assessment Delegation.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AuditmanagerAssessmentDelegation } from "./.gen/providers/aws/auditmanager-assessment-delegation";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AuditmanagerAssessmentDelegation(this, "example", {
+      assessmentId: Token.asString(awsAuditmanagerAssessmentExample.id),
+      controlSetId: "example",
+      roleArn: Token.asString(awsIamRoleExample.arn),
+      roleType: "RESOURCE_OWNER",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `assessmentId` - (Required) Identifier for the assessment.
+* `controlSetId` - (Required) Assessment control set name. This value is the control set name used during assessment creation (not the AWS-generated ID). The `id` suffix on this attribute has been preserved to be consistent with the underlying AWS API.
+* `roleArn` - (Required) Amazon Resource Name (ARN) of the IAM role.
+* `roleType` - (Required) Type of customer persona. For assessment delegation, type must always be `resourceOwner`.
+
+The following arguments are optional:
+
+* `comment` - (Optional) Comment describing the delegation request.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `delegationId` - Unique identifier for the delegation.
+* `id` - Unique identifier for the resource. This is a comma-separated string containing `assessmentId`, `roleArn`, and `controlSetId`.
+* `status` - Status of the delegation.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Audit Manager Assessment Delegation using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Audit Manager Assessment Delegation using the `id`. For example:
+
+```console
+% terraform import aws_auditmanager_assessment_delegation.example abcdef-123456,arn:aws:iam::012345678901:role/example,example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-a28cb94ff95d8ebfec7195b030654929667d5f4188784ab4f4a6c94229437e4d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/auditmanager_assessment_report.html.markdown b/website/docs/cdktf/typescript/r/auditmanager_assessment_report.html.markdown
new file mode 100644
index 00000000000..97d2923094f
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/auditmanager_assessment_report.html.markdown
@@ -0,0 +1,81 @@
+---
+subcategory: "Audit Manager"
+layout: "aws"
+page_title: "AWS: aws_auditmanager_assessment_report"
+description: |-
+  Terraform resource for managing an AWS Audit Manager Assessment Report.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_auditmanager_assessment_report
+
+Terraform resource for managing an AWS Audit Manager Assessment Report.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AuditmanagerAssessmentReport } from "./.gen/providers/aws/auditmanager-assessment-report";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AuditmanagerAssessmentReport(this, "test", {
+      assessmentId: Token.asString(awsAuditmanagerAssessmentTest.id),
+      name: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) Name of the assessment report.
+* `assessmentId` - (Required) Unique identifier of the assessment to create the report from.
+
+The following arguments are optional:
+
+* `description` - (Optional) Description of the assessment report.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `author` - Name of the user who created the assessment report.
+* `id` - Unique identifier for the assessment report.
+* `status` - Current status of the specified assessment report. Valid values are `complete`, `inProgress`, and `failed`.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Audit Manager Assessment Reports using the assessment report `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Audit Manager Assessment Reports using the assessment report `id`. For example:
+
+```console
+% terraform import aws_auditmanager_assessment_report.example abc123-de45
+```
+
+<!-- cache-key: cdktf-0.18.0 input-6b338b1bd64119b10018fd9c9f0d34c39bf215e8e6866aa5aefd18459615b30e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/auditmanager_control.html.markdown b/website/docs/cdktf/typescript/r/auditmanager_control.html.markdown
new file mode 100644
index 00000000000..0a4858db90c
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/auditmanager_control.html.markdown
@@ -0,0 +1,114 @@
+---
+subcategory: "Audit Manager"
+layout: "aws"
+page_title: "AWS: aws_auditmanager_control"
+description: |-
+  Terraform resource for managing an AWS Audit Manager Control.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_auditmanager_control
+
+Terraform resource for managing an AWS Audit Manager Control.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AuditmanagerControl } from "./.gen/providers/aws/auditmanager-control";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AuditmanagerControl(this, "example", {
+      controlMappingSources: [
+        {
+          sourceName: "example",
+          sourceSetUpOption: "Procedural_Controls_Mapping",
+          sourceType: "MANUAL",
+        },
+      ],
+      name: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) Name of the control.
+* `controlMappingSources` - (Required) Data mapping sources. See [`controlMappingSources`](#control_mapping_sources) below.
+
+The following arguments are optional:
+
+* `actionPlanInstructions` - (Optional) Recommended actions to carry out if the control isn't fulfilled.
+* `actionPlanTitle` - (Optional) Title of the action plan for remediating the control.
+* `description` - (Optional) Description of the control.
+* `tags` - (Optional) A map of tags to assign to the control. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `testingInformation` - (Optional) Steps to follow to determine if the control is satisfied.
+
+### control_mapping_sources
+
+The following arguments are required:
+
+* `sourceName` - (Required) Name of the source.
+* `sourceSetUpOption` - (Required) The setup option for the data source. This option reflects if the evidence collection is automated or manual. Valid values are `systemControlsMapping` (automated) and `proceduralControlsMapping` (manual).
+* `sourceType` - (Required) Type of data source for evidence collection. If `sourceSetUpOption` is manual, the only valid value is `manual`. If `sourceSetUpOption` is automated, valid values are `awsCloudtrail`, `awsConfig`, `awsSecurityHub`, or `awsApiCall`.
+
+The following arguments are optional:
+
+* `sourceDescription` - (Optional) Description of the source.
+* `sourceFrequency` - (Optional) Frequency of evidence collection. Valid values are `daily`, `weekly`, or `monthly`.
+* `sourceKeyword` - (Optional) The keyword to search for in CloudTrail logs, Config rules, Security Hub checks, and Amazon Web Services API names. See [`sourceKeyword`](#source_keyword) below.
+* `troubleshootingText` - (Optional) Instructions for troubleshooting the control.
+
+### source_keyword
+
+The following arguments are required:
+
+* `keywordInputType` - (Required) Input method for the keyword. Valid values are `selectFromList`.
+* `keywordValue` - (Required) The value of the keyword that's used when mapping a control data source. For example, this can be a CloudTrail event name, a rule name for Config, a Security Hub control, or the name of an Amazon Web Services API call. See the [Audit Manager supported control data sources documentation](https://docs.aws.amazon.com/audit-manager/latest/userguide/control-data-sources.html) for more information.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the control.
+* `controlMappingSources.*SourceId` - Unique identifier for the source.
+* `id` - Unique identifier for the control.
+* `type` - Type of control, such as a custom control or a standard control.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import an Audit Manager Control using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import an Audit Manager Control using the `id`. For example:
+
+```console
+% terraform import aws_auditmanager_control.example abc123-de45
+```
+
+<!-- cache-key: cdktf-0.18.0 input-b868688bbd20f6d5af9ab3798d86ae2370658daf4faa22e5cee0ffe9436e3cc0 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/auditmanager_framework.html.markdown b/website/docs/cdktf/typescript/r/auditmanager_framework.html.markdown
new file mode 100644
index 00000000000..8e735aac6f6
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/auditmanager_framework.html.markdown
@@ -0,0 +1,102 @@
+---
+subcategory: "Audit Manager"
+layout: "aws"
+page_title: "AWS: aws_auditmanager_framework"
+description: |-
+  Terraform resource for managing an AWS Audit Manager Framework.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_auditmanager_framework
+
+Terraform resource for managing an AWS Audit Manager Framework.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AuditmanagerFramework } from "./.gen/providers/aws/auditmanager-framework";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AuditmanagerFramework(this, "test", {
+      controlSets: [
+        {
+          controls: [
+            {
+              id: Token.asString(awsAuditmanagerControlTest.id),
+            },
+          ],
+          name: "example",
+        },
+      ],
+      name: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) Name of the framework.
+* `controlSets` - (Required) Control sets that are associated with the framework. See [`controlSets`](#control_sets) below.
+
+The following arguments are optional:
+
+* `complianceType` - (Optional) Compliance type that the new custom framework supports, such as `cis` or `hipaa`.
+* `description` - (Optional) Description of the framework.
+* `tags` - (Optional) A map of tags to assign to the framework. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### control_sets
+
+* `name` - (Required) Name of the control set.
+* `controls` - (Required) List of controls within the control set. See [`controls`](#controls) below.
+
+### controls
+
+* `id` - (Required) Unique identifier of the control.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the framework.
+* `controlSets[*]Id` - Unique identifier for the framework control set.
+* `id` - Unique identifier for the framework.
+* `frameworkType` - Framework type, such as a custom framework or a standard framework.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Audit Manager Framework using the framework `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Audit Manager Framework using the framework `id`. For example:
+
+```console
+% terraform import aws_auditmanager_framework.example abc123-de45
+```
+
+<!-- cache-key: cdktf-0.18.0 input-821a948286ad3665c063ce96f7b07cc9d38f2a8d5044bfae6a4c6b6094687367 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/auditmanager_framework_share.html.markdown b/website/docs/cdktf/typescript/r/auditmanager_framework_share.html.markdown
new file mode 100644
index 00000000000..1a98baf9045
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/auditmanager_framework_share.html.markdown
@@ -0,0 +1,82 @@
+---
+subcategory: "Audit Manager"
+layout: "aws"
+page_title: "AWS: aws_auditmanager_framework_share"
+description: |-
+  Terraform resource for managing an AWS Audit Manager Framework Share.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_auditmanager_framework_share
+
+Terraform resource for managing an AWS Audit Manager Framework Share.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AuditmanagerFrameworkShare } from "./.gen/providers/aws/auditmanager-framework-share";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AuditmanagerFrameworkShare(this, "example", {
+      destinationAccount: "012345678901",
+      destinationRegion: "us-east-1",
+      frameworkId: Token.asString(awsAuditmanagerFrameworkExample.id),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `destinationAccount` - (Required) Amazon Web Services account of the recipient.
+* `destinationRegion` - (Required) Amazon Web Services region of the recipient.
+* `frameworkId` - (Required) Unique identifier for the shared custom framework.
+
+The following arguments are optional:
+
+* `comment` - (Optional) Comment from the sender about the share request.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Unique identifier for the share request.
+* `status` -  Status of the share request.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Audit Manager Framework Share using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Audit Manager Framework Share using the `id`. For example:
+
+```console
+% terraform import aws_auditmanager_framework_share.example abcdef-123456
+```
+
+<!-- cache-key: cdktf-0.18.0 input-14d7a2ed97dee3206ec0e19704aeaa2d131932ec24b406ef4fff013eeb7c1aba -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/auditmanager_organization_admin_account_registration.html.markdown b/website/docs/cdktf/typescript/r/auditmanager_organization_admin_account_registration.html.markdown
new file mode 100644
index 00000000000..2bc9e2a2f2f
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/auditmanager_organization_admin_account_registration.html.markdown
@@ -0,0 +1,74 @@
+---
+subcategory: "Audit Manager"
+layout: "aws"
+page_title: "AWS: aws_auditmanager_organization_admin_account_registration"
+description: |-
+  Terraform resource for managing AWS Audit Manager Organization Admin Account Registration.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_auditmanager_organization_admin_account_registration
+
+Terraform resource for managing AWS Audit Manager Organization Admin Account Registration.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AuditmanagerOrganizationAdminAccountRegistration } from "./.gen/providers/aws/auditmanager-organization-admin-account-registration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AuditmanagerOrganizationAdminAccountRegistration(this, "example", {
+      adminAccountId: "012345678901",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `adminAccountId` - (Required) Identifier for the organization administrator account.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Identifier for the organization administrator account.
+* `organizationId` - Identifier for the organization.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Audit Manager Organization Admin Account Registration using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Audit Manager Organization Admin Account Registration using the `id`. For example:
+
+```console
+% terraform import aws_auditmanager_organization_admin_account_registration.example 012345678901 
+```
+
+<!-- cache-key: cdktf-0.18.0 input-73a8d01ece65d6322ccb932f7e3936fdefadced313d0732bd4dd6da49b4ca658 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/autoscaling_attachment.html.markdown b/website/docs/cdktf/typescript/r/autoscaling_attachment.html.markdown
new file mode 100644
index 00000000000..9405d28259f
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/autoscaling_attachment.html.markdown
@@ -0,0 +1,73 @@
+---
+subcategory: "Auto Scaling"
+layout: "aws"
+page_title: "AWS: aws_autoscaling_attachment"
+description: |-
+  Terraform resource for managing an AWS Auto Scaling Attachment.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_autoscaling_attachment
+
+Attaches a load balancer to an Auto Scaling group.
+
+~> **NOTE on Auto Scaling Groups, Attachments and Traffic Source Attachments:** Terraform provides standalone Attachment (for attaching Classic Load Balancers and Application Load Balancer, Gateway Load Balancer, or Network Load Balancer target groups) and [Traffic Source Attachment](autoscaling_traffic_source_attachment.html) (for attaching Load Balancers and VPC Lattice target groups) resources and an [Auto Scaling Group](autoscaling_group.html) resource with `loadBalancers`, `targetGroupArns` and `trafficSource` attributes. Do not use the same traffic source in more than one of these resources. Doing so will cause a conflict of attachments. A [`lifecycle` configuration block](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html) can be used to suppress differences if necessary.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AutoscalingAttachment } from "./.gen/providers/aws/autoscaling-attachment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AutoscalingAttachment(this, "example", {
+      autoscalingGroupName: Token.asString(awsAutoscalingGroupExample.id),
+      elb: Token.asString(awsElbExample.id),
+    });
+  }
+}
+
+```
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AutoscalingAttachment } from "./.gen/providers/aws/autoscaling-attachment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AutoscalingAttachment(this, "example", {
+      autoscalingGroupName: Token.asString(awsAutoscalingGroupExample.id),
+      lbTargetGroupArn: Token.asString(awsLbTargetGroupExample.arn),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `autoscalingGroupName` - (Required) Name of ASG to associate with the ELB.
+* `elb` - (Optional) Name of the ELB.
+* `lbTargetGroupArn` - (Optional) ARN of a load balancer target group.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+<!-- cache-key: cdktf-0.18.0 input-3767bb40f260f9b690b5ce54548d1dacba1a025bee3fd0c8617e2820d6db1a21 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/autoscaling_group.html.markdown b/website/docs/cdktf/typescript/r/autoscaling_group.html.markdown
new file mode 100644
index 00000000000..601c689394d
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/autoscaling_group.html.markdown
@@ -0,0 +1,972 @@
+---
+subcategory: "Auto Scaling"
+layout: "aws"
+page_title: "AWS: aws_autoscaling_group"
+description: |-
+  Provides an Auto Scaling Group resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_autoscaling_group
+
+Provides an Auto Scaling Group resource.
+
+-> **Note:** You must specify either `launchConfiguration`, `launchTemplate`, or `mixedInstancesPolicy`.
+
+~> **NOTE on Auto Scaling Groups, Attachments and Traffic Source Attachments:** Terraform provides standalone [Attachment](autoscaling_attachment.html) (for attaching Classic Load Balancers and Application Load Balancer, Gateway Load Balancer, or Network Load Balancer target groups) and [Traffic Source Attachment](autoscaling_traffic_source_attachment.html) (for attaching Load Balancers and VPC Lattice target groups) resources and an Auto Scaling Group resource with `loadBalancers`, `targetGroupArns` and `trafficSource` attributes. Do not use the same traffic source in more than one of these resources. Doing so will cause a conflict of attachments. A [`lifecycle` configuration block](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html) can be used to suppress differences if necessary.
+
+> **Hands-on:** Try the [Manage AWS Auto Scaling Groups](https://learn.hashicorp.com/tutorials/terraform/aws-asg?utm_source=WEBSITE&utm_medium=WEB_IO&utm_offer=ARTICLE_PAGE&utm_content=DOCS) tutorial on HashiCorp Learn.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AutoscalingGroup } from "./.gen/providers/aws/autoscaling-group";
+import { PlacementGroup } from "./.gen/providers/aws/placement-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const test = new PlacementGroup(this, "test", {
+      name: "test",
+      strategy: "cluster",
+    });
+    new AutoscalingGroup(this, "bar", {
+      desiredCapacity: 4,
+      forceDelete: true,
+      healthCheckGracePeriod: 300,
+      healthCheckType: "ELB",
+      initialLifecycleHook: [
+        {
+          defaultResult: "CONTINUE",
+          heartbeatTimeout: 2000,
+          lifecycleTransition: "autoscaling:EC2_INSTANCE_LAUNCHING",
+          name: "foobar",
+          notificationMetadata: Token.asString(
+            Fn.jsonencode({
+              foo: "bar",
+            })
+          ),
+          notificationTargetArn: "arn:aws:sqs:us-east-1:444455556666:queue1*",
+          roleArn: "arn:aws:iam::123456789012:role/S3Access",
+        },
+      ],
+      launchConfiguration: foobar.name,
+      maxSize: 5,
+      minSize: 2,
+      name: "foobar3-terraform-test",
+      placementGroup: test.id,
+      tag: [
+        {
+          key: "foo",
+          propagateAtLaunch: true,
+          value: "bar",
+        },
+        {
+          key: "lorem",
+          propagateAtLaunch: false,
+          value: "ipsum",
+        },
+      ],
+      timeouts: [
+        {
+          delete: "15m",
+        },
+      ],
+      vpcZoneIdentifier: [example1.id, example2.id],
+    });
+  }
+}
+
+```
+
+### With Latest Version Of Launch Template
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AutoscalingGroup } from "./.gen/providers/aws/autoscaling-group";
+import { LaunchTemplate } from "./.gen/providers/aws/launch-template";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const foobar = new LaunchTemplate(this, "foobar", {
+      imageId: "ami-1a2b3c",
+      instanceType: "t2.micro",
+      namePrefix: "foobar",
+    });
+    new AutoscalingGroup(this, "bar", {
+      availabilityZones: ["us-east-1a"],
+      desiredCapacity: 1,
+      launchTemplate: {
+        id: foobar.id,
+        version: "$Latest",
+      },
+      maxSize: 1,
+      minSize: 1,
+    });
+  }
+}
+
+```
+
+### Mixed Instances Policy
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AutoscalingGroup } from "./.gen/providers/aws/autoscaling-group";
+import { LaunchTemplate } from "./.gen/providers/aws/launch-template";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new LaunchTemplate(this, "example", {
+      imageId: Token.asString(dataAwsAmiExample.id),
+      instanceType: "c5.large",
+      namePrefix: "example",
+    });
+    const awsAutoscalingGroupExample = new AutoscalingGroup(this, "example_1", {
+      availabilityZones: ["us-east-1a"],
+      desiredCapacity: 1,
+      maxSize: 1,
+      minSize: 1,
+      mixedInstancesPolicy: {
+        launchTemplate: {
+          launchTemplateSpecification: {
+            launchTemplateId: example.id,
+          },
+          override: [
+            {
+              instanceType: "c4.large",
+              weightedCapacity: "3",
+            },
+            {
+              instanceType: "c3.large",
+              weightedCapacity: "2",
+            },
+          ],
+        },
+      },
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsAutoscalingGroupExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### Mixed Instances Policy with Spot Instances and Capacity Rebalance
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AutoscalingGroup } from "./.gen/providers/aws/autoscaling-group";
+import { LaunchTemplate } from "./.gen/providers/aws/launch-template";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new LaunchTemplate(this, "example", {
+      imageId: Token.asString(dataAwsAmiExample.id),
+      instanceType: "c5.large",
+      namePrefix: "example",
+    });
+    const awsAutoscalingGroupExample = new AutoscalingGroup(this, "example_1", {
+      capacityRebalance: true,
+      desiredCapacity: 12,
+      maxSize: 15,
+      minSize: 12,
+      mixedInstancesPolicy: {
+        instancesDistribution: {
+          onDemandBaseCapacity: 0,
+          onDemandPercentageAboveBaseCapacity: 25,
+          spotAllocationStrategy: "capacity-optimized",
+        },
+        launchTemplate: {
+          launchTemplateSpecification: {
+            launchTemplateId: example.id,
+          },
+          override: [
+            {
+              instanceType: "c4.large",
+              weightedCapacity: "3",
+            },
+            {
+              instanceType: "c3.large",
+              weightedCapacity: "2",
+            },
+          ],
+        },
+      },
+      vpcZoneIdentifier: [example1.id, example2.id],
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsAutoscalingGroupExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### Mixed Instances Policy with Instance level LaunchTemplateSpecification Overrides
+
+When using a diverse instance set, some instance types might require a launch template with configuration values unique to that instance type such as a different AMI (Graviton2), architecture specific user data script, different EBS configuration, or different networking configuration.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AutoscalingGroup } from "./.gen/providers/aws/autoscaling-group";
+import { LaunchTemplate } from "./.gen/providers/aws/launch-template";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new LaunchTemplate(this, "example", {
+      imageId: Token.asString(dataAwsAmiExample.id),
+      instanceType: "c5.large",
+      namePrefix: "example",
+    });
+    const example2 = new LaunchTemplate(this, "example2", {
+      imageId: Token.asString(dataAwsAmiExample2.id),
+      namePrefix: "example2",
+    });
+    const awsAutoscalingGroupExample = new AutoscalingGroup(this, "example_2", {
+      availabilityZones: ["us-east-1a"],
+      desiredCapacity: 1,
+      maxSize: 1,
+      minSize: 1,
+      mixedInstancesPolicy: {
+        launchTemplate: {
+          launchTemplateSpecification: {
+            launchTemplateId: example.id,
+          },
+          override: [
+            {
+              instanceType: "c4.large",
+              weightedCapacity: "3",
+            },
+            {
+              instanceType: "c6g.large",
+              launchTemplateSpecification: {
+                launchTemplateId: example2.id,
+              },
+              weightedCapacity: "2",
+            },
+          ],
+        },
+      },
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsAutoscalingGroupExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### Mixed Instances Policy with Attribute-based Instance Type Selection
+
+As an alternative to manually choosing instance types when creating a mixed instances group, you can specify a set of instance attributes that describe your compute requirements.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AutoscalingGroup } from "./.gen/providers/aws/autoscaling-group";
+import { LaunchTemplate } from "./.gen/providers/aws/launch-template";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new LaunchTemplate(this, "example", {
+      imageId: Token.asString(dataAwsAmiExample.id),
+      instanceType: "c5.large",
+      namePrefix: "example",
+    });
+    const awsAutoscalingGroupExample = new AutoscalingGroup(this, "example_1", {
+      availabilityZones: ["us-east-1a"],
+      desiredCapacity: 1,
+      maxSize: 1,
+      minSize: 1,
+      mixedInstancesPolicy: {
+        launchTemplate: {
+          launchTemplateSpecification: {
+            launchTemplateId: example.id,
+          },
+          override: [
+            {
+              instanceRequirements: {
+                memoryMib: {
+                  min: 1000,
+                },
+                vcpuCount: {
+                  min: 4,
+                },
+              },
+            },
+          ],
+        },
+      },
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsAutoscalingGroupExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### Dynamic tagging
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import {
+  TerraformVariable,
+  Token,
+  TerraformIterator,
+  Fn,
+  TerraformStack,
+} from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AutoscalingGroup } from "./.gen/providers/aws/autoscaling-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    /*Terraform Variables are not always the best fit for getting inputs in the context of Terraform CDK.
+    You can read more about this at https://cdk.tf/variables*/
+    const extraTags = new TerraformVariable(this, "extra_tags", {
+      default: [
+        {
+          key: "Foo",
+          propagate_at_launch: true,
+          value: "Bar",
+        },
+        {
+          key: "Baz",
+          propagate_at_launch: true,
+          value: "Bam",
+        },
+      ],
+    });
+    /*In most cases loops should be handled in the programming language context and 
+    not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+    you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+    you need to keep this like it is.*/
+    const testDynamicIterator0 = TerraformIterator.fromList(
+      Token.asAny(extraTags.value)
+    );
+    new AutoscalingGroup(this, "test", {
+      launchConfiguration: foobar.name,
+      maxSize: 5,
+      minSize: 2,
+      name: "foobar3-terraform-test",
+      tag: testDynamicIterator0.dynamic({
+        key: Fn.lookupNested(testDynamicIterator0.value, ["key"]),
+        propagate_at_launch: Fn.lookupNested(testDynamicIterator0.value, [
+          "propagate_at_launch",
+        ]),
+        value: Fn.lookupNested(testDynamicIterator0.value, ["value"]),
+      }),
+      vpcZoneIdentifier: [example1.id, example2.id],
+    });
+  }
+}
+
+```
+
+### Automatically refresh all instances after the group is updated
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AutoscalingGroup } from "./.gen/providers/aws/autoscaling-group";
+import { DataAwsAmi } from "./.gen/providers/aws/data-aws-ami";
+import { LaunchTemplate } from "./.gen/providers/aws/launch-template";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new DataAwsAmi(this, "example", {
+      filter: [
+        {
+          name: "name",
+          values: ["amzn-ami-hvm-*-x86_64-gp2"],
+        },
+      ],
+      mostRecent: true,
+      owners: ["amazon"],
+    });
+    const awsLaunchTemplateExample = new LaunchTemplate(this, "example_1", {
+      imageId: Token.asString(example.id),
+      instanceType: "t3.nano",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsLaunchTemplateExample.overrideLogicalId("example");
+    const awsAutoscalingGroupExample = new AutoscalingGroup(this, "example_2", {
+      availabilityZones: ["us-east-1a"],
+      desiredCapacity: 1,
+      instanceRefresh: {
+        preferences: {
+          minHealthyPercentage: 50,
+        },
+        strategy: "Rolling",
+        triggers: ["tag"],
+      },
+      launchTemplate: {
+        id: Token.asString(awsLaunchTemplateExample.id),
+        version: Token.asString(awsLaunchTemplateExample.latestVersion),
+      },
+      maxSize: 2,
+      minSize: 1,
+      tag: [
+        {
+          key: "Key",
+          propagateAtLaunch: true,
+          value: "Value",
+        },
+      ],
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsAutoscalingGroupExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### Auto Scaling group with Warm Pool
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AutoscalingGroup } from "./.gen/providers/aws/autoscaling-group";
+import { LaunchTemplate } from "./.gen/providers/aws/launch-template";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AutoscalingGroup(this, "example", {
+      availabilityZones: ["us-east-1a"],
+      desiredCapacity: 1,
+      maxSize: 5,
+      minSize: 1,
+      warmPool: {
+        instanceReusePolicy: {
+          reuseOnScaleIn: true,
+        },
+        maxGroupPreparedCapacity: 10,
+        minSize: 1,
+        poolState: "Hibernated",
+      },
+    });
+    const awsLaunchTemplateExample = new LaunchTemplate(this, "example_1", {
+      imageId: Token.asString(dataAwsAmiExample.id),
+      instanceType: "c5.large",
+      namePrefix: "example",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsLaunchTemplateExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### Auto Scaling group with Traffic Sources
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformIterator, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AutoscalingGroup } from "./.gen/providers/aws/autoscaling-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    /*In most cases loops should be handled in the programming language context and 
+    not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+    you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+    you need to keep this like it is.*/
+    const testDynamicIterator0 = TerraformIterator.fromList(
+      Token.asAny(Fn.lookupNested(awsVpclatticeTargetGroupTest, ["*"]))
+    );
+    new AutoscalingGroup(this, "test", {
+      forceDelete: true,
+      maxSize: 1,
+      minSize: 1,
+      vpcZoneIdentifier: Token.asList(awsSubnetTest.id),
+      trafficSource: testDynamicIterator0.dynamic({
+        identifier: Fn.lookupNested(testDynamicIterator0.value, ["arn"]),
+        type: "vpc-lattice",
+      }),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+- `name` - (Optional) Name of the Auto Scaling Group. By default generated by Terraform. Conflicts with `namePrefix`.
+- `namePrefix` - (Optional) Creates a unique name beginning with the specified
+  prefix. Conflicts with `name`.
+- `maxSize` - (Required) Maximum size of the Auto Scaling Group.
+- `minSize` - (Required) Minimum size of the Auto Scaling Group.
+  (See also [Waiting for Capacity](#waiting-for-capacity) below.)
+- `availabilityZones` - (Optional) A list of Availability Zones where instances in the Auto Scaling group can be created. Used for launching into the default VPC subnet in each Availability Zone when not using the `vpcZoneIdentifier` attribute, or for attaching a network interface when an existing network interface ID is specified in a launch template. Conflicts with `vpcZoneIdentifier`.
+- `capacityRebalance` - (Optional) Whether capacity rebalance is enabled. Otherwise, capacity rebalance is disabled.
+- `context` - (Optional) Reserved.
+- `defaultCooldown` - (Optional) Amount of time, in seconds, after a scaling activity completes before another scaling activity can start.
+- `defaultInstanceWarmup` - (Optional) Amount of time, in seconds, until a newly launched instance can contribute to the Amazon CloudWatch metrics. This delay lets an instance finish initializing before Amazon EC2 Auto Scaling aggregates instance metrics, resulting in more reliable usage data. Set this value equal to the amount of time that it takes for resource consumption to become stable after an instance reaches the InService state. (See [Set the default instance warmup for an Auto Scaling group](https://docs.aws.amazon.com/autoscaling/ec2/userguide/ec2-auto-scaling-default-instance-warmup.html))
+- `launchConfiguration` - (Optional) Name of the launch configuration to use.
+- `launchTemplate` - (Optional) Nested argument with Launch template specification to use to launch instances. See [Launch Template](#launch_template) below for more details.
+- `mixedInstancesPolicy` - (Optional) Configuration block containing settings to define launch targets for Auto Scaling groups. See [Mixed Instances Policy](#mixed_instances_policy) below for more details.
+- `ignoreFailedScalingActivities` - (Optional) Whether to ignore failed [Auto Scaling scaling activities](https://docs.aws.amazon.com/autoscaling/ec2/userguide/as-verify-scaling-activity.html) while [waiting for capacity](#waiting-for-capacity). The default is `false` -- failed scaling activities cause errors to be returned.
+- `initialLifecycleHook` - (Optional) One or more
+  [Lifecycle Hooks](http://docs.aws.amazon.com/autoscaling/latest/userguide/lifecycle-hooks.html)
+  to attach to the Auto Scaling Group **before** instances are launched. The
+  syntax is exactly the same as the separate
+  [`awsAutoscalingLifecycleHook`](/docs/providers/aws/r/autoscaling_lifecycle_hook.html)
+  resource, without the `autoscalingGroupName` attribute. Please note that this will only work when creating
+  a new Auto Scaling Group. For all other use-cases, please use `awsAutoscalingLifecycleHook` resource.
+- `healthCheckGracePeriod` - (Optional, Default: 300) Time (in seconds) after instance comes into service before checking health.
+- `healthCheckType` - (Optional) "EC2" or "ELB". Controls how health checking is done.
+- `desiredCapacity` - (Optional) Number of Amazon EC2 instances that
+  should be running in the group. (See also [Waiting for
+  Capacity](#waiting-for-capacity) below.)
+- `desiredCapacityType` - (Optional) The unit of measurement for the value specified for `desiredCapacity`. Supported for attribute-based instance type selection only. Valid values: `"units"`, `"vcpu"`, `"memoryMib"`.
+- `forceDelete` - (Optional) Allows deleting the Auto Scaling Group without waiting
+  for all instances in the pool to terminate. You can force an Auto Scaling Group to delete
+  even if it's in the process of scaling a resource. Normally, Terraform
+  drains all the instances before deleting the group. This bypasses that
+  behavior and potentially leaves resources dangling.
+- `loadBalancers` - (Optional) List of elastic load balancer names to add to the autoscaling
+  group names. Only valid for classic load balancers. For ALBs, use `targetGroupArns` instead. To remove all load balancer attachments an empty list should be specified.
+- `trafficSource` - (Optional) Attaches one or more traffic sources to the specified Auto Scaling group.
+- `vpcZoneIdentifier` - (Optional) List of subnet IDs to launch resources in. Subnets automatically determine which availability zones the group will reside. Conflicts with `availabilityZones`.
+- `targetGroupArns` - (Optional) Set of `awsAlbTargetGroup` ARNs, for use with Application or Network Load Balancing. To remove all target group attachments an empty list should be specified.
+- `terminationPolicies` - (Optional) List of policies to decide how the instances in the Auto Scaling Group should be terminated. The allowed values are `oldestInstance`, `newestInstance`, `oldestLaunchConfiguration`, `closestToNextInstanceHour`, `oldestLaunchTemplate`, `allocationStrategy`, `default`. Additionally, the ARN of a Lambda function can be specified for custom termination policies.
+- `suspendedProcesses` - (Optional) List of processes to suspend for the Auto Scaling Group. The allowed values are `launch`, `terminate`, `healthCheck`, `replaceUnhealthy`, `azRebalance`, `alarmNotification`, `scheduledActions`, `addToLoadBalancer`, `instanceRefresh`.
+  Note that if you suspend either the `launch` or `terminate` process types, it can prevent your Auto Scaling Group from functioning properly.
+- `tag` - (Optional) Configuration block(s) containing resource tags. See [Tag](#tag) below for more details.
+- `placementGroup` - (Optional) Name of the placement group into which you'll launch your instances, if any.
+- `metricsGranularity` - (Optional) Granularity to associate with the metrics to collect. The only valid value is `1Minute`. Default is `1Minute`.
+- `enabledMetrics` - (Optional) List of metrics to collect. The allowed values are defined by the [underlying AWS API](https://docs.aws.amazon.com/autoscaling/ec2/APIReference/API_EnableMetricsCollection.html).
+- `waitForCapacityTimeout` - (Optional, Default: "10m") Maximum
+  [duration](https://golang.org/pkg/time/#ParseDuration) that Terraform should
+  wait for ASG instances to be healthy before timing out. (See also [Waiting
+  for Capacity](#waiting-for-capacity) below.) Setting this to "0" causes
+  Terraform to skip all Capacity Waiting behavior.
+- `minElbCapacity` - (Optional) Setting this causes Terraform to wait for
+  this number of instances from this Auto Scaling Group to show up healthy in the
+  ELB only on creation. Updates will not wait on ELB instance number changes.
+  (See also [Waiting for Capacity](#waiting-for-capacity) below.)
+- `waitForElbCapacity` - (Optional) Setting this will cause Terraform to wait
+  for exactly this number of healthy instances from this Auto Scaling Group in
+  all attached load balancers on both create and update operations. (Takes
+  precedence over `minElbCapacity` behavior.)
+  (See also [Waiting for Capacity](#waiting-for-capacity) below.)
+- `protectFromScaleIn` - (Optional) Whether newly launched instances
+  are automatically protected from termination by Amazon EC2 Auto Scaling when
+  scaling in. For more information about preventing instances from terminating
+  on scale in, see [Using instance scale-in protection](https://docs.aws.amazon.com/autoscaling/ec2/userguide/ec2-auto-scaling-instance-protection.html)
+  in the Amazon EC2 Auto Scaling User Guide.
+- `serviceLinkedRoleArn` - (Optional) ARN of the service-linked role that the ASG will use to call other AWS services
+- `maxInstanceLifetime` - (Optional) Maximum amount of time, in seconds, that an instance can be in service, values must be either equal to 0 or between 86400 and 31536000 seconds.
+- `instanceRefresh` - (Optional) If this block is configured, start an
+  [Instance Refresh](https://docs.aws.amazon.com/autoscaling/ec2/userguide/asg-instance-refresh.html)
+  when this Auto Scaling Group is updated. Defined [below](#instance_refresh).
+- `warmPool` - (Optional) If this block is configured, add a [Warm Pool](https://docs.aws.amazon.com/autoscaling/ec2/userguide/ec2-auto-scaling-warm-pools.html)
+  to the specified Auto Scaling group. Defined [below](#warm_pool)
+
+### launch_template
+
+~> **NOTE:** Either `id` or `name` must be specified.
+
+The top-level `launchTemplate` block supports the following:
+
+- `id` - (Optional) ID of the launch template. Conflicts with `name`.
+- `name` - (Optional) Name of the launch template. Conflicts with `id`.
+- `version` - (Optional) Template version. Can be version number, `$latest`, or `$default`. (Default: `$default`).
+
+### mixed_instances_policy
+
+- `instancesDistribution` - (Optional) Nested argument containing settings on how to mix on-demand and Spot instances in the Auto Scaling group. Defined below.
+- `launchTemplate` - (Required) Nested argument containing launch template settings along with the overrides to specify multiple instance types and weights. Defined below.
+
+#### mixed_instances_policy instances_distribution
+
+This configuration block supports the following:
+
+- `onDemandAllocationStrategy` - (Optional) Strategy to use when launching on-demand instances. Valid values: `prioritized`, `lowestPrice`. Default: `prioritized`.
+- `onDemandBaseCapacity` - (Optional) Absolute minimum amount of desired capacity that must be fulfilled by on-demand instances. Default: `0`.
+- `onDemandPercentageAboveBaseCapacity` - (Optional) Percentage split between on-demand and Spot instances above the base on-demand capacity. Default: `100`.
+- `spotAllocationStrategy` - (Optional) How to allocate capacity across the Spot pools. Valid values: `lowestPrice`, `capacityOptimized`, `capacityOptimizedPrioritized`, and `priceCapacityOptimized`. Default: `lowestPrice`.
+- `spotInstancePools` - (Optional) Number of Spot pools per availability zone to allocate capacity. EC2 Auto Scaling selects the cheapest Spot pools and evenly allocates Spot capacity across the number of Spot pools that you specify. Only available with `spotAllocationStrategy` set to `lowestPrice`. Otherwise it must be set to `0`, if it has been defined before. Default: `2`.
+- `spotMaxPrice` - (Optional) Maximum price per unit hour that the user is willing to pay for the Spot instances. Default: an empty string which means the on-demand price.
+
+#### mixed_instances_policy launch_template
+
+This configuration block supports the following:
+
+- `launchTemplateSpecification` - (Required) Nested argument defines the Launch Template. Defined below.
+- `override` - (Optional) List of nested arguments provides the ability to specify multiple instance types. This will override the same parameter in the launch template. For on-demand instances, Auto Scaling considers the order of preference of instance types to launch based on the order specified in the overrides list. Defined below.
+
+##### mixed_instances_policy launch_template launch_template_specification
+
+~> **NOTE:** Either `launchTemplateId` or `launchTemplateName` must be specified.
+
+This configuration block supports the following:
+
+- `launchTemplateId` - (Optional) ID of the launch template. Conflicts with `launchTemplateName`.
+- `launchTemplateName` - (Optional) Name of the launch template. Conflicts with `launchTemplateId`.
+- `version` - (Optional) Template version. Can be version number, `$latest`, or `$default`. (Default: `$default`).
+
+##### mixed_instances_policy launch_template override
+
+This configuration block supports the following:
+
+- `instanceType` - (Optional) Override the instance type in the Launch Template.
+- `instanceRequirements` - (Optional) Override the instance type in the Launch Template with instance types that satisfy the requirements.
+- `launchTemplateSpecification` - (Optional) Override the instance launch template specification in the Launch Template.
+- `weightedCapacity` - (Optional) Number of capacity units, which gives the instance type a proportional weight to other instance types.
+
+###### mixed_instances_policy launch_template override instance_requirements
+
+This configuration block supports the following:
+
+~> **NOTE:** Both `memoryMibMin` and `vcpuCountMin` must be specified.
+
+- `acceleratorCount` - (Optional) Block describing the minimum and maximum number of accelerators (GPUs, FPGAs, or AWS Inferentia chips). Default is no minimum or maximum.
+    - `min` - (Optional) Minimum.
+    - `max` - (Optional) Maximum. Set to `0` to exclude instance types with accelerators.
+- `acceleratorManufacturers` - (Optional) List of accelerator manufacturer names. Default is any manufacturer.
+
+  ```
+  Valid names:
+    * amazon-web-services
+    * amd
+    * nvidia
+    * xilinx
+  ```
+
+- `acceleratorNames` - (Optional) List of accelerator names. Default is any acclerator.
+
+  ```
+  Valid names:
+    * a100            - NVIDIA A100 GPUs
+    * v100            - NVIDIA V100 GPUs
+    * k80             - NVIDIA K80 GPUs
+    * t4              - NVIDIA T4 GPUs
+    * m60             - NVIDIA M60 GPUs
+    * radeon-pro-v520 - AMD Radeon Pro V520 GPUs
+    * vu9p            - Xilinx VU9P FPGAs
+  ```
+
+- `acceleratorTotalMemoryMib` - (Optional) Block describing the minimum and maximum total memory of the accelerators. Default is no minimum or maximum.
+
+    - `min` - (Optional) Minimum.
+    - `max` - (Optional) Maximum.
+
+- `acceleratorTypes` - (Optional) List of accelerator types. Default is any accelerator type.
+
+  ```
+  Valid types:
+    * fpga
+    * gpu
+    * inference
+  ```
+
+- `allowedInstanceTypes` - (Optional) List of instance types to apply your specified attributes against. All other instance types are ignored, even if they match your specified attributes. You can use strings with one or more wild cards, represented by an asterisk (\*), to allow an instance type, size, or generation. The following are examples: `m58Xlarge`, `c5*.*`, `m5A.*`, `r*`, `*3*`. For example, if you specify `c5*`, you are allowing the entire C5 instance family, which includes all C5a and C5n instance types. If you specify `m5A.*`, you are allowing all the M5a instance types, but not the M5n instance types. Maximum of 400 entries in the list; each entry is limited to 30 characters. Default is all instance types.
+
+  ~> **NOTE:** If you specify `allowedInstanceTypes`, you can't specify `excludedInstanceTypes`.
+
+- `bareMetal` - (Optional) Indicate whether bare metal instace types should be `included`, `excluded`, or `required`. Default is `excluded`.
+- `baselineEbsBandwidthMbps` - (Optional) Block describing the minimum and maximum baseline EBS bandwidth, in Mbps. Default is no minimum or maximum.
+    - `min` - (Optional) Minimum.
+    - `max` - (Optional) Maximum.
+- `burstablePerformance` - (Optional) Indicate whether burstable performance instance types should be `included`, `excluded`, or `required`. Default is `excluded`.
+- `cpuManufacturers` (Optional) List of CPU manufacturer names. Default is any manufacturer.
+
+  ~> **NOTE:** Don't confuse the CPU hardware manufacturer with the CPU hardware architecture. Instances will be launched with a compatible CPU architecture based on the Amazon Machine Image (AMI) that you specify in your launch template.
+
+  ```
+  Valid names:
+    * amazon-web-services
+    * amd
+    * intel
+  ```
+
+- `excludedInstanceTypes` - (Optional) List of instance types to exclude. You can use strings with one or more wild cards, represented by an asterisk (\*), to exclude an instance type, size, or generation. The following are examples: `m58Xlarge`, `c5*.*`, `m5A.*`, `r*`, `*3*`. For example, if you specify `c5*`, you are excluding the entire C5 instance family, which includes all C5a and C5n instance types. If you specify `m5A.*`, you are excluding all the M5a instance types, but not the M5n instance types. Maximum of 400 entries in the list; each entry is limited to 30 characters. Default is no excluded instance types.
+
+  ~> **NOTE:** If you specify `excludedInstanceTypes`, you can't specify `allowedInstanceTypes`.
+
+- `instanceGenerations` - (Optional) List of instance generation names. Default is any generation.
+
+  ```
+  Valid names:
+    * current  - Recommended for best performance.
+    * previous - For existing applications optimized for older instance types.
+  ```
+
+- `localStorage` - (Optional) Indicate whether instance types with local storage volumes are `included`, `excluded`, or `required`. Default is `included`.
+- `localStorageTypes` - (Optional) List of local storage type names. Default any storage type.
+
+  ```
+  Value names:
+    * hdd - hard disk drive
+    * ssd - solid state drive
+  ```
+
+- `memoryGibPerVcpu` - (Optional) Block describing the minimum and maximum amount of memory (GiB) per vCPU. Default is no minimum or maximum.
+    - `min` - (Optional) Minimum. May be a decimal number, e.g. `05`.
+    - `max` - (Optional) Maximum. May be a decimal number, e.g. `05`.
+- `memoryMib` - (Required) Block describing the minimum and maximum amount of memory (MiB). Default is no maximum.
+    - `min` - (Required) Minimum.
+    - `max` - (Optional) Maximum.
+- `networkBandwidthGbps` - (Optional) Block describing the minimum and maximum amount of network bandwidth, in gigabits per second (Gbps). Default is no minimum or maximum.
+    - `min` - (Optional) Minimum.
+    - `max` - (Optional) Maximum.
+- `networkInterfaceCount` - (Optional) Block describing the minimum and maximum number of network interfaces. Default is no minimum or maximum.
+    - `min` - (Optional) Minimum.
+    - `max` - (Optional) Maximum.
+- `onDemandMaxPricePercentageOverLowestPrice` - (Optional) Price protection threshold for On-Demand Instances. This is the maximum you’ll pay for an On-Demand Instance, expressed as a percentage higher than the cheapest M, C, or R instance type with your specified attributes. When Amazon EC2 Auto Scaling selects instance types with your attributes, we will exclude instance types whose price is higher than your threshold. The parameter accepts an integer, which Amazon EC2 Auto Scaling interprets as a percentage. To turn off price protection, specify a high value, such as 999999. Default is 20.
+
+  If you set DesiredCapacityType to vcpu or memory-mib, the price protection threshold is applied based on the per vCPU or per memory price instead of the per instance price.
+
+- `requireHibernateSupport` - (Optional) Indicate whether instance types must support On-Demand Instance Hibernation, either `true` or `false`. Default is `false`.
+- `spotMaxPricePercentageOverLowestPrice` - (Optional) Price protection threshold for Spot Instances. This is the maximum you’ll pay for a Spot Instance, expressed as a percentage higher than the cheapest M, C, or R instance type with your specified attributes. When Amazon EC2 Auto Scaling selects instance types with your attributes, we will exclude instance types whose price is higher than your threshold. The parameter accepts an integer, which Amazon EC2 Auto Scaling interprets as a percentage. To turn off price protection, specify a high value, such as 999999. Default is 100.
+
+  If you set DesiredCapacityType to vcpu or memory-mib, the price protection threshold is applied based on the per vCPU or per memory price instead of the per instance price.
+
+- `totalLocalStorageGb` - (Optional) Block describing the minimum and maximum total local storage (GB). Default is no minimum or maximum.
+    - `min` - (Optional) Minimum. May be a decimal number, e.g. `05`.
+    - `max` - (Optional) Maximum. May be a decimal number, e.g. `05`.
+- `vcpuCount` - (Required) Block describing the minimum and maximum number of vCPUs. Default is no maximum.
+    - `min` - (Required) Minimum.
+    - `max` - (Optional) Maximum.
+
+### tag
+
+The `tag` attribute accepts exactly one tag declaration with the following fields:
+
+- `key` - (Required) Key
+- `value` - (Required) Value
+- `propagateAtLaunch` - (Required) Enables propagation of the tag to
+  Amazon EC2 instances launched via this ASG
+
+To declare multiple tags, additional `tag` blocks can be specified.
+
+~> **NOTE:** Other AWS APIs may automatically add special tags to their associated Auto Scaling Group for management purposes, such as ECS Capacity Providers adding the `amazonEcsManaged` tag. These generally should be included in the configuration so Terraform does not attempt to remove them and so if the `minSize` was greater than zero on creation, that these tag(s) are applied to any initial EC2 Instances in the Auto Scaling Group. If these tag(s) were missing in the Auto Scaling Group configuration on creation, affected EC2 Instances missing the tags may require manual intervention of adding the tags to ensure they work properly with the other AWS service.
+
+### instance_refresh
+
+This configuration block supports the following:
+
+- `strategy` - (Required) Strategy to use for instance refresh. The only allowed value is `rolling`. See [StartInstanceRefresh Action](https://docs.aws.amazon.com/autoscaling/ec2/APIReference/API_StartInstanceRefresh.html#API_StartInstanceRefresh_RequestParameters) for more information.
+- `preferences` - (Optional) Override default parameters for Instance Refresh.
+    - `checkpointDelay` - (Optional) Number of seconds to wait after a checkpoint. Defaults to `3600`.
+    - `checkpointPercentages` - (Optional) List of percentages for each checkpoint. Values must be unique and in ascending order. To replace all instances, the final number must be `100`.
+    - `instanceWarmup` - (Optional) Number of seconds until a newly launched instance is configured and ready to use. Default behavior is to use the Auto Scaling Group's health check grace period.
+    - `minHealthyPercentage` - (Optional) Amount of capacity in the Auto Scaling group that must remain healthy during an instance refresh to allow the operation to continue, as a percentage of the desired capacity of the Auto Scaling group. Defaults to `90`.
+    - `skipMatching` - (Optional) Replace instances that already have your desired configuration. Defaults to `false`.
+    - `autoRollback` - (Optional) Automatically rollback if instance refresh fails. Defaults to `false`. This option may only be set to `true` when specifying a `launchTemplate` or `mixedInstancesPolicy`.
+    - `scaleInProtectedInstances` - (Optional) Behavior when encountering instances protected from scale in are found. Available behaviors are `refresh`, `ignore`, and `wait`. Default is `ignore`.
+    - `standbyInstances` - (Optional) Behavior when encountering instances in the `standby` state in are found. Available behaviors are `terminate`, `ignore`, and `wait`. Default is `ignore`.
+- `triggers` - (Optional) Set of additional property names that will trigger an Instance Refresh. A refresh will always be triggered by a change in any of `launchConfiguration`, `launchTemplate`, or `mixedInstancesPolicy`.
+
+~> **NOTE:** A refresh is started when any of the following Auto Scaling Group properties change: `launchConfiguration`, `launchTemplate`, `mixedInstancesPolicy`. Additional properties can be specified in the `triggers` property of `instanceRefresh`.
+
+~> **NOTE:** A refresh will not start when `version = "$Latest"` is configured in the `launchTemplate` block. To trigger the instance refresh when a launch template is changed, configure `version` to use the `latestVersion` attribute of the `awsLaunchTemplate` resource.
+
+~> **NOTE:** Auto Scaling Groups support up to one active instance refresh at a time. When this resource is updated, any existing refresh is cancelled.
+
+~> **NOTE:** Depending on health check settings and group size, an instance refresh may take a long time or fail. This resource does not wait for the instance refresh to complete.
+
+### warm_pool
+
+This configuration block supports the following:
+
+- `instanceReusePolicy` - (Optional) Whether instances in the Auto Scaling group can be returned to the warm pool on scale in. The default is to terminate instances in the Auto Scaling group when the group scales in.
+- `maxGroupPreparedCapacity` - (Optional) Total maximum number of instances that are allowed to be in the warm pool or in any state except Terminated for the Auto Scaling group.
+- `minSize` - (Optional) Minimum number of instances to maintain in the warm pool. This helps you to ensure that there is always a certain number of warmed instances available to handle traffic spikes. Defaults to 0 if not specified.
+- `poolState` - (Optional) Sets the instance state to transition to after the lifecycle hooks finish. Valid values are: Stopped (default), Running or Hibernated.
+
+### traffic_source
+
+- `identifier` - Identifies the traffic source. For Application Load Balancers, Gateway Load Balancers, Network Load Balancers, and VPC Lattice, this will be the Amazon Resource Name (ARN) for a target group in this account and Region. For Classic Load Balancers, this will be the name of the Classic Load Balancer in this account and Region.
+- `type` - Provides additional context for the value of Identifier.
+  The following lists the valid values:
+  `elb` if `identifier` is the name of a Classic Load Balancer.
+  `elbv2` if `identifier` is the ARN of an Application Load Balancer, Gateway Load Balancer, or Network Load Balancer target group.
+  `vpcLattice` if `identifier` is the ARN of a VPC Lattice target group.
+
+##### instance_reuse_policy
+
+This configuration block supports the following:
+
+- `reuseOnScaleIn` - (Optional) Whether instances in the Auto Scaling group can be returned to the warm pool on scale in.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+- `id` - Auto Scaling Group id.
+- `arn` - ARN for this Auto Scaling Group
+- `availabilityZones` - Availability zones of the Auto Scaling Group.
+- `minSize` - Minimum size of the Auto Scaling Group
+- `maxSize` - Maximum size of the Auto Scaling Group
+- `defaultCooldown` - Time between a scaling activity and the succeeding scaling activity.
+- `defaultInstanceWarmup` - The duration of the default instance warmup, in seconds.
+- `name` - Name of the Auto Scaling Group
+- `healthCheckGracePeriod` - Time after instance comes into service before checking health.
+- `healthCheckType` - "EC2" or "ELB". Controls how health checking is done.
+- `desiredCapacity` -The number of Amazon EC2 instances that should be running in the group.
+- `launchConfiguration` - The launch configuration of the Auto Scaling Group
+- `predictedCapacity` - Predicted capacity of the group.
+- `vpcZoneIdentifier` (Optional) - The VPC zone identifier
+- `warmPoolSize` - Current size of the warm pool.
+
+~> **NOTE:** When using `elb` as the `healthCheckType`, `healthCheckGracePeriod` is required.
+
+~> **NOTE:** Terraform has two types of ways you can add lifecycle hooks - via
+the `initialLifecycleHook` attribute from this resource, or via the separate
+[`awsAutoscalingLifecycleHook`](/docs/providers/aws/r/autoscaling_lifecycle_hook.html)
+resource. `initialLifecycleHook` exists here because any lifecycle hooks
+added with `awsAutoscalingLifecycleHook` will not be added until the
+Auto Scaling Group has been created, and depending on your
+[capacity](#waiting-for-capacity) settings, after the initial instances have
+been launched, creating unintended behavior. If you need hooks to run on all
+instances, add them with `initialLifecycleHook` here, but take
+care to not duplicate these hooks in `awsAutoscalingLifecycleHook`.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `delete` - (Default `10M`)
+
+## Waiting for Capacity
+
+A newly-created ASG is initially empty and begins to scale to `minSize` (or
+`desiredCapacity`, if specified) by launching instances using the provided
+Launch Configuration. These instances take time to launch and boot.
+
+On ASG Update, changes to these values also take time to result in the target
+number of instances providing service.
+
+Terraform provides two mechanisms to help consistently manage ASG scale up
+time across dependent resources.
+
+#### Waiting for ASG Capacity
+
+The first is default behavior. Terraform waits after ASG creation for
+`minSize` (or `desiredCapacity`, if specified) healthy instances to show up
+in the ASG before continuing.
+
+If `minSize` or `desiredCapacity` are changed in a subsequent update,
+Terraform will also wait for the correct number of healthy instances before
+continuing.
+
+Terraform considers an instance "healthy" when the ASG reports `healthStatus:
+"healthy"` and `LifecycleState: "InService"`. See the [AWS AutoScaling
+Docs](https://docs.aws.amazon.com/AutoScaling/latest/DeveloperGuide/AutoScalingGroupLifecycle.html)
+for more information on an ASG's lifecycle.
+
+Terraform will wait for healthy instances for up to
+`waitForCapacityTimeout`. If ASG creation is taking more than a few minutes,
+it's worth investigating for scaling activity errors, which can be caused by
+problems with the selected Launch Configuration.
+
+Setting `waitForCapacityTimeout` to `"0"` disables ASG Capacity waiting.
+
+#### Waiting for ELB Capacity
+
+The second mechanism is optional, and affects ASGs with attached ELBs specified
+via the `loadBalancers` attribute or with ALBs specified with `targetGroupArns`.
+
+The `minElbCapacity` parameter causes Terraform to wait for at least the
+requested number of instances to show up `"inService"` in all attached ELBs
+during ASG creation. It has no effect on ASG updates.
+
+If `waitForElbCapacity` is set, Terraform will wait for exactly that number
+of Instances to be `"inService"` in all attached ELBs on both creation and
+updates.
+
+These parameters can be used to ensure that service is being provided before
+Terraform moves on. If new instances don't pass the ELB's health checks for any
+reason, the Terraform apply will time out, and the ASG will be marked as
+tainted (i.e., marked to be destroyed in a follow up run).
+
+As with ASG Capacity, Terraform will wait for up to `waitForCapacityTimeout`
+for the proper number of instances to be healthy.
+
+#### Troubleshooting Capacity Waiting Timeouts
+
+If ASG creation takes more than a few minutes, this could indicate one of a
+number of configuration problems. See the [AWS Docs on Load Balancer
+Troubleshooting](https://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/elb-troubleshooting.html)
+for more information.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Auto Scaling Groups using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Auto Scaling Groups using the `name`. For example:
+
+```console
+% terraform import aws_autoscaling_group.web web-asg
+```
+
+<!-- cache-key: cdktf-0.18.0 input-6123f1ad176783c4aeeb8809e50b4e73d7842b1025fac3b7c66ab4860931dd4c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/autoscaling_group_tag.html.markdown b/website/docs/cdktf/typescript/r/autoscaling_group_tag.html.markdown
new file mode 100644
index 00000000000..7c56a9d1d99
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/autoscaling_group_tag.html.markdown
@@ -0,0 +1,120 @@
+---
+subcategory: "Auto Scaling"
+layout: "aws"
+page_title: "AWS: aws_autoscaling_group_tag"
+description: |-
+  Manages an individual Autoscaling Group tag
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_autoscaling_group_tag
+
+Manages an individual Autoscaling Group (ASG) tag. This resource should only be used in cases where ASGs are created outside Terraform (e.g., ASGs implicitly created by EKS Node Groups).
+
+~> **NOTE:** This tagging resource should not be combined with the Terraform resource for managing the parent resource. For example, using `awsAutoscalingGroup` and `awsAutoscalingGroupTag` to manage tags of the same ASG will cause a perpetual difference where the `awsAutoscalingGroup` resource will try to remove the tag being added by the `awsAutoscalingGroupTag` resource.
+
+~> **NOTE:** This tagging resource does not use the [provider `ignoreTags` configuration](/docs/providers/aws/index.html#ignore_tags).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformIterator, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AutoscalingGroupTagA } from "./.gen/providers/aws/autoscaling-group-tag";
+import { EksNodeGroup } from "./.gen/providers/aws/eks-node-group";
+interface MyConfig {
+  nodeRoleArn: any;
+  scalingConfig: any;
+  subnetIds: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    /*In most cases loops should be handled in the programming language context and 
+    not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+    you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+    you need to keep this like it is.*/
+    const exampleForEachIterator = TerraformIterator.fromList(
+      Token.asAny(
+        Fn.toset(
+          "${[ for asg in ${" +
+            Fn.flatten(
+              "${[ for resources in ${" +
+                awsEksNodeGroupExample.resources +
+                "} : resources.autoscaling_groups]}"
+            ) +
+            "} : asg.name]}"
+        )
+      )
+    );
+    new AutoscalingGroupTagA(this, "example", {
+      autoscalingGroupName: Token.asString(exampleForEachIterator.value),
+      tag: {
+        key: "k8s.io/cluster-autoscaler/node-template/label/eks.amazonaws.com/capacityType",
+        propagateAtLaunch: false,
+        value: "SPOT",
+      },
+      forEach: exampleForEachIterator,
+    });
+    const awsEksNodeGroupExample = new EksNodeGroup(this, "example_1", {
+      clusterName: "example",
+      nodeGroupName: "example",
+      nodeRoleArn: config.nodeRoleArn,
+      scalingConfig: config.scalingConfig,
+      subnetIds: config.subnetIds,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsEksNodeGroupExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `autoscalingGroupName` - (Required) Name of the Autoscaling Group to apply the tag to.
+* `tag` - (Required) Tag to create. The `tag` block is documented below.
+
+The `tag` block supports the following arguments:
+
+* `key` - (Required) Tag name.
+* `value` - (Required) Tag value.
+* `propagateAtLaunch` - (Required) Whether to propagate the tags to instances launched by the ASG.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - ASG name and key, separated by a comma (`,`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsAutoscalingGroupTag` using the ASG name and key, separated by a comma (`,`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsAutoscalingGroupTag` using the ASG name and key, separated by a comma (`,`). For example:
+
+```console
+% terraform import aws_autoscaling_group_tag.example asg-example,k8s.io/cluster-autoscaler/node-template/label/eks.amazonaws.com/capacityType
+```
+
+<!-- cache-key: cdktf-0.18.0 input-6d03164dc8f7802d7fed35fe5527ff2cb206eef4734529984f76a9f8bdd4520e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/autoscaling_lifecycle_hook.html.markdown b/website/docs/cdktf/typescript/r/autoscaling_lifecycle_hook.html.markdown
new file mode 100644
index 00000000000..44057be4f55
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/autoscaling_lifecycle_hook.html.markdown
@@ -0,0 +1,125 @@
+---
+subcategory: "Auto Scaling"
+layout: "aws"
+page_title: "AWS: aws_autoscaling_lifecycle_hook"
+description: |-
+  Provides an AutoScaling Lifecycle Hook resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_autoscaling_lifecycle_hook
+
+Provides an AutoScaling Lifecycle Hook resource.
+
+~> **NOTE:** Terraform has two types of ways you can add lifecycle hooks - via
+the `initialLifecycleHook` attribute from the
+[`awsAutoscalingGroup`](/docs/providers/aws/r/autoscaling_group.html)
+resource, or via this one. Hooks added via this resource will not be added
+until the autoscaling group has been created, and depending on your
+[capacity](/docs/providers/aws/r/autoscaling_group.html#waiting-for-capacity)
+settings, after the initial instances have been launched, creating unintended
+behavior. If you need hooks to run on all instances, add them with
+`initialLifecycleHook` in
+[`awsAutoscalingGroup`](/docs/providers/aws/r/autoscaling_group.html),
+but take care to not duplicate those hooks with this resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AutoscalingGroup } from "./.gen/providers/aws/autoscaling-group";
+import { AutoscalingLifecycleHook } from "./.gen/providers/aws/autoscaling-lifecycle-hook";
+interface MyConfig {
+  maxSize: any;
+  minSize: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    const foobar = new AutoscalingGroup(this, "foobar", {
+      availabilityZones: ["us-west-2a"],
+      healthCheckType: "EC2",
+      name: "terraform-test-foobar5",
+      tag: [
+        {
+          key: "Foo",
+          propagateAtLaunch: true,
+          value: "foo-bar",
+        },
+      ],
+      terminationPolicies: ["OldestInstance"],
+      maxSize: config.maxSize,
+      minSize: config.minSize,
+    });
+    const awsAutoscalingLifecycleHookFoobar = new AutoscalingLifecycleHook(
+      this,
+      "foobar_1",
+      {
+        autoscalingGroupName: foobar.name,
+        defaultResult: "CONTINUE",
+        heartbeatTimeout: 2000,
+        lifecycleTransition: "autoscaling:EC2_INSTANCE_LAUNCHING",
+        name: "foobar",
+        notificationMetadata: Token.asString(
+          Fn.jsonencode({
+            foo: "bar",
+          })
+        ),
+        notificationTargetArn: "arn:aws:sqs:us-east-1:444455556666:queue1*",
+        roleArn: "arn:aws:iam::123456789012:role/S3Access",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsAutoscalingLifecycleHookFoobar.overrideLogicalId("foobar");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) Name of the lifecycle hook.
+* `autoscalingGroupName` - (Required) Name of the Auto Scaling group to which you want to assign the lifecycle hook
+* `defaultResult` - (Optional) Defines the action the Auto Scaling group should take when the lifecycle hook timeout elapses or if an unexpected failure occurs. The value for this parameter can be either CONTINUE or ABANDON. The default value for this parameter is ABANDON.
+* `heartbeatTimeout` - (Optional) Defines the amount of time, in seconds, that can elapse before the lifecycle hook times out. When the lifecycle hook times out, Auto Scaling performs the action defined in the DefaultResult parameter
+* `lifecycleTransition` - (Required) Instance state to which you want to attach the lifecycle hook. For a list of lifecycle hook types, see [describe-lifecycle-hook-types](https://docs.aws.amazon.com/cli/latest/reference/autoscaling/describe-lifecycle-hook-types.html#examples)
+* `notificationMetadata` - (Optional) Contains additional information that you want to include any time Auto Scaling sends a message to the notification target.
+* `notificationTargetArn` - (Optional) ARN of the notification target that Auto Scaling will use to notify you when an instance is in the transition state for the lifecycle hook. This ARN target can be either an SQS queue or an SNS topic.
+* `roleArn` - (Optional) ARN of the IAM role that allows the Auto Scaling group to publish to the specified notification target.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AutoScaling Lifecycle Hooks using the role autoscaling_group_name and name separated by `/`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import AutoScaling Lifecycle Hooks using the role autoscaling_group_name and name separated by `/`. For example:
+
+```console
+% terraform import aws_autoscaling_lifecycle_hook.test-lifecycle-hook asg-name/lifecycle-hook-name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-8ca53e0779c7b9f57e18da9406cc44b6560bf338b79f9897124efbb999b1bb41 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/autoscaling_notification.html.markdown b/website/docs/cdktf/typescript/r/autoscaling_notification.html.markdown
new file mode 100644
index 00000000000..4fffc0f727a
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/autoscaling_notification.html.markdown
@@ -0,0 +1,89 @@
+---
+subcategory: "Auto Scaling"
+layout: "aws"
+page_title: "AWS: aws_autoscaling_notification"
+description: |-
+  Provides an AutoScaling Group with Notification support
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_autoscaling_notification
+
+Provides an AutoScaling Group with Notification support, via SNS Topics. Each of
+the `notifications` map to a [Notification Configuration][2] inside Amazon Web
+Services, and are applied to each AutoScaling Group you supply.
+
+## Example Usage
+
+Basic usage:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AutoscalingGroup } from "./.gen/providers/aws/autoscaling-group";
+import { AutoscalingNotification } from "./.gen/providers/aws/autoscaling-notification";
+import { SnsTopic } from "./.gen/providers/aws/sns-topic";
+interface MyConfig {
+  maxSize: any;
+  minSize: any;
+  maxSize1: any;
+  minSize1: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    const bar = new AutoscalingGroup(this, "bar", {
+      name: "foobar1-terraform-test",
+      maxSize: config.maxSize,
+      minSize: config.minSize,
+    });
+    const foo = new AutoscalingGroup(this, "foo", {
+      name: "barfoo-terraform-test",
+      maxSize: config.maxSize1,
+      minSize: config.minSize1,
+    });
+    const example = new SnsTopic(this, "example", {
+      name: "example-topic",
+    });
+    new AutoscalingNotification(this, "example_notifications", {
+      groupNames: [bar.name, foo.name],
+      notifications: [
+        "autoscaling:EC2_INSTANCE_LAUNCH",
+        "autoscaling:EC2_INSTANCE_TERMINATE",
+        "autoscaling:EC2_INSTANCE_LAUNCH_ERROR",
+        "autoscaling:EC2_INSTANCE_TERMINATE_ERROR",
+      ],
+      topicArn: example.arn,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `groupNames` - (Required) List of AutoScaling Group Names
+* `notifications` - (Required) List of Notification Types that trigger
+notifications. Acceptable values are documented [in the AWS documentation here][1]
+* `topicArn` - (Required) Topic ARN for notifications to be sent through
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `groupNames`
+* `notifications`
+* `topicArn`
+
+[1]: https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_NotificationConfiguration.html
+[2]: https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_DescribeNotificationConfigurations.html
+
+<!-- cache-key: cdktf-0.18.0 input-3938cfbc30acbf16d80d3b3f6c56e132af303339229bf6a953b7b328c401cceb -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/autoscaling_policy.html.markdown b/website/docs/cdktf/typescript/r/autoscaling_policy.html.markdown
new file mode 100644
index 00000000000..dd2f9077182
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/autoscaling_policy.html.markdown
@@ -0,0 +1,557 @@
+---
+subcategory: "Auto Scaling"
+layout: "aws"
+page_title: "AWS: aws_autoscaling_policy"
+description: |-
+  Provides an AutoScaling Scaling Group resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_autoscaling_policy
+
+Provides an AutoScaling Scaling Policy resource.
+
+~> **NOTE:** You may want to omit `desiredCapacity` attribute from attached `awsAutoscalingGroup`
+when using autoscaling policies. It's good practice to pick either
+[manual](https://docs.aws.amazon.com/AutoScaling/latest/DeveloperGuide/as-manual-scaling.html)
+or [dynamic](https://docs.aws.amazon.com/AutoScaling/latest/DeveloperGuide/as-scale-based-on-demand.html)
+(policy-based) scaling.
+
+> **Hands-on:** Try the [Manage AWS Auto Scaling Groups](https://learn.hashicorp.com/tutorials/terraform/aws-asg?utm_source=WEBSITE&utm_medium=WEB_IO&utm_offer=ARTICLE_PAGE&utm_content=DOCS) tutorial on HashiCorp Learn.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AutoscalingGroup } from "./.gen/providers/aws/autoscaling-group";
+import { AutoscalingPolicy } from "./.gen/providers/aws/autoscaling-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const bar = new AutoscalingGroup(this, "bar", {
+      availabilityZones: ["us-east-1a"],
+      forceDelete: true,
+      healthCheckGracePeriod: 300,
+      healthCheckType: "ELB",
+      launchConfiguration: foo.name,
+      maxSize: 5,
+      minSize: 2,
+      name: "foobar3-terraform-test",
+    });
+    new AutoscalingPolicy(this, "bat", {
+      adjustmentType: "ChangeInCapacity",
+      autoscalingGroupName: bar.name,
+      cooldown: 300,
+      name: "foobar3-terraform-test",
+      scalingAdjustment: 4,
+    });
+  }
+}
+
+```
+
+### Create target tracking scaling policy using metric math
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AutoscalingPolicy } from "./.gen/providers/aws/autoscaling-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AutoscalingPolicy(this, "example", {
+      autoscalingGroupName: "my-test-asg",
+      name: "foo",
+      policyType: "TargetTrackingScaling",
+      targetTrackingConfiguration: {
+        customizedMetricSpecification: {
+          metrics: [
+            {
+              id: "m1",
+              label:
+                "Get the queue size (the number of messages waiting to be processed)",
+              metricStat: {
+                metric: {
+                  dimensions: [
+                    {
+                      name: "QueueName",
+                      value: "my-queue",
+                    },
+                  ],
+                  metricName: "ApproximateNumberOfMessagesVisible",
+                  namespace: "AWS/SQS",
+                },
+                stat: "Sum",
+              },
+              returnData: false,
+            },
+            {
+              id: "m2",
+              label: "Get the group size (the number of InService instances)",
+              metricStat: {
+                metric: {
+                  dimensions: [
+                    {
+                      name: "AutoScalingGroupName",
+                      value: "my-asg",
+                    },
+                  ],
+                  metricName: "GroupInServiceInstances",
+                  namespace: "AWS/AutoScaling",
+                },
+                stat: "Average",
+              },
+              returnData: false,
+            },
+            {
+              expression: "m1 / m2",
+              id: "e1",
+              label: "Calculate the backlog per instance",
+              returnData: true,
+            },
+          ],
+        },
+        targetValue: 100,
+      },
+    });
+  }
+}
+
+```
+
+### Create predictive scaling policy using customized metrics
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AutoscalingPolicy } from "./.gen/providers/aws/autoscaling-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AutoscalingPolicy(this, "example", {
+      autoscalingGroupName: "my-test-asg",
+      name: "foo",
+      policyType: "PredictiveScaling",
+      predictiveScalingConfiguration: {
+        metricSpecification: {
+          customizedCapacityMetricSpecification: {
+            metricDataQueries: [
+              {
+                expression:
+                  "SUM(SEARCH('{AWS/AutoScaling,AutoScalingGroupName} MetricName=\\\"GroupInServiceIntances\\\" my-test-asg', 'Average', 300))",
+                id: "capacity_sum",
+              },
+            ],
+          },
+          customizedLoadMetricSpecification: {
+            metricDataQueries: [
+              {
+                expression:
+                  "SUM(SEARCH('{AWS/EC2,AutoScalingGroupName} MetricName=\\\"CPUUtilization\\\" my-test-asg', 'Sum', 3600))",
+                id: "load_sum",
+              },
+            ],
+          },
+          customizedScalingMetricSpecification: {
+            metricDataQueries: [
+              {
+                expression:
+                  "SUM(SEARCH('{AWS/AutoScaling,AutoScalingGroupName} MetricName=\\\"GroupInServiceIntances\\\" my-test-asg', 'Average', 300))",
+                id: "capacity_sum",
+                returnData: false,
+              },
+              {
+                expression:
+                  "SUM(SEARCH('{AWS/EC2,AutoScalingGroupName} MetricName=\\\"CPUUtilization\\\" my-test-asg', 'Sum', 300))",
+                id: "load_sum",
+                returnData: false,
+              },
+              {
+                expression:
+                  "load_sum / (capacity_sum * PERIOD(capacity_sum) / 60)",
+                id: "weighted_average",
+              },
+            ],
+          },
+          targetValue: 10,
+        },
+      },
+    });
+  }
+}
+
+```
+
+### Create predictive scaling policy using customized scaling and predefined load metric
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AutoscalingPolicy } from "./.gen/providers/aws/autoscaling-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AutoscalingPolicy(this, "example", {
+      autoscalingGroupName: "my-test-asg",
+      name: "foo",
+      policyType: "PredictiveScaling",
+      predictiveScalingConfiguration: {
+        metricSpecification: {
+          customizedScalingMetricSpecification: {
+            metricDataQueries: [
+              {
+                id: "scaling",
+                metricStat: {
+                  metric: {
+                    dimensions: [
+                      {
+                        name: "AutoScalingGroupName",
+                        value: "my-test-asg",
+                      },
+                    ],
+                    metricName: "CPUUtilization",
+                    namespace: "AWS/EC2",
+                  },
+                  stat: "Average",
+                },
+              },
+            ],
+          },
+          predefinedLoadMetricSpecification: {
+            predefinedMetricType: "ASGTotalCPUUtilization",
+            resourceLabel: "testLabel",
+          },
+          targetValue: 10,
+        },
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `name` - (Required) Name of the policy.
+* `autoscalingGroupName` - (Required) Name of the autoscaling group.
+* `adjustmentType` - (Optional) Whether the adjustment is an absolute number or a percentage of the current capacity. Valid values are `changeInCapacity`, `exactCapacity`, and `percentChangeInCapacity`.
+* `policyType` - (Optional) Policy type, either "SimpleScaling", "StepScaling", "TargetTrackingScaling", or "PredictiveScaling". If this value isn't provided, AWS will default to "SimpleScaling."
+* `predictiveScalingConfiguration` - (Optional) Predictive scaling policy configuration to use with Amazon EC2 Auto Scaling.
+* `estimatedInstanceWarmup` - (Optional) Estimated time, in seconds, until a newly launched instance will contribute CloudWatch metrics. Without a value, AWS will default to the group's specified cooldown period.
+* `enabled` - (Optional) Whether the scaling policy is enabled or disabled. Default: `true`.
+
+The following argument is only available to "SimpleScaling" and "StepScaling" type policies:
+
+* `minAdjustmentMagnitude` - (Optional) Minimum value to scale by when `adjustmentType` is set to `percentChangeInCapacity`.
+
+The following arguments are only available to "SimpleScaling" type policies:
+
+* `cooldown` - (Optional) Amount of time, in seconds, after a scaling activity completes and before the next scaling activity can start.
+* `scalingAdjustment` - (Optional) Number of instances by which to scale. `adjustmentType` determines the interpretation of this number (e.g., as an absolute number or as a percentage of the existing Auto Scaling group size). A positive increment adds to the current capacity and a negative value removes from the current capacity.
+
+The following arguments are only available to "StepScaling" type policies:
+
+* `metricAggregationType` - (Optional) Aggregation type for the policy's metrics. Valid values are "Minimum", "Maximum", and "Average". Without a value, AWS will treat the aggregation type as "Average".
+* `stepAdjustment` - (Optional) Set of adjustments that manage
+group scaling. These have the following structure:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, Op, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AutoscalingPolicy } from "./.gen/providers/aws/autoscaling-policy";
+interface MyConfig {
+  autoscalingGroupName: any;
+  name: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new AutoscalingPolicy(this, "example", {
+      stepAdjustment: [
+        {
+          metricIntervalLowerBound: Token.asString(1),
+          metricIntervalUpperBound: Token.asString(2),
+          scalingAdjustment: Token.asNumber(Op.negate(1)),
+        },
+        {
+          metricIntervalLowerBound: Token.asString(2),
+          metricIntervalUpperBound: Token.asString(3),
+          scalingAdjustment: 1,
+        },
+      ],
+      autoscalingGroupName: config.autoscalingGroupName,
+      name: config.name,
+    });
+  }
+}
+
+```
+
+The following fields are available in step adjustments:
+
+* `scalingAdjustment` - (Required) Number of members by which to
+scale, when the adjustment bounds are breached. A positive value scales
+up. A negative value scales down.
+* `metricIntervalLowerBound` - (Optional) Lower bound for the
+difference between the alarm threshold and the CloudWatch metric.
+Without a value, AWS will treat this bound as negative infinity.
+* `metricIntervalUpperBound` - (Optional) Upper bound for the
+difference between the alarm threshold and the CloudWatch metric.
+Without a value, AWS will treat this bound as positive infinity. The upper bound
+must be greater than the lower bound.
+
+Notice the bounds are **relative** to the alarm threshold, meaning that the starting point is not 0%, but the alarm threshold. Check the official [docs](https://docs.aws.amazon.com/autoscaling/ec2/userguide/as-scaling-simple-step.html#as-scaling-steps) for a detailed example.
+
+The following arguments are only available to "TargetTrackingScaling" type policies:
+
+* `targetTrackingConfiguration` - (Optional) Target tracking policy. These have the following structure:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AutoscalingPolicy } from "./.gen/providers/aws/autoscaling-policy";
+interface MyConfig {
+  autoscalingGroupName: any;
+  name: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new AutoscalingPolicy(this, "example", {
+      targetTrackingConfiguration: {
+        predefinedMetricSpecification: {
+          predefinedMetricType: "ASGAverageCPUUtilization",
+        },
+        targetValue: 40,
+      },
+      autoscalingGroupName: config.autoscalingGroupName,
+      name: config.name,
+    });
+  }
+}
+
+```
+
+The following fields are available in target tracking configuration:
+
+* `predefinedMetricSpecification` - (Optional) Predefined metric. Conflicts with `customizedMetricSpecification`.
+* `customizedMetricSpecification` - (Optional) Customized metric. Conflicts with `predefinedMetricSpecification`.
+* `targetValue` - (Required) Target value for the metric.
+* `disableScaleIn` - (Optional, Default: false) Whether scale in by the target tracking policy is disabled.
+
+### predefined_metric_specification
+
+This argument supports the following arguments:
+
+* `predefinedMetricType` - (Required) Metric type.
+* `resourceLabel` - (Optional) Identifies the resource associated with the metric type.
+
+### customized_metric_specification
+
+This argument supports the following arguments:
+
+* `metricDimension` - (Optional) Dimensions of the metric.
+* `metricName` - (Optional) Name of the metric.
+* `namespace` - (Optional) Namespace of the metric.
+* `statistic` - (Optional) Statistic of the metric.
+* `unit` - (Optional) Unit of the metric.
+* `metrics` - (Optional) Metrics to include, as a metric data query.
+
+#### metric_dimension
+
+This argument supports the following arguments:
+
+* `name` - (Required) Name of the dimension.
+* `value` - (Required) Value of the dimension.
+
+#### metrics
+
+This argument supports the following arguments:
+
+* `expression` - (Optional) Math expression used on the returned metric. You must specify either `expression` or `metricStat`, but not both.
+* `id` - (Required) Short name for the metric used in target tracking scaling policy.
+* `label` - (Optional) Human-readable label for this metric or expression.
+* `metricStat` - (Optional) Structure that defines CloudWatch metric to be used in target tracking scaling policy. You must specify either `expression` or `metricStat`, but not both.
+* `returnData` - (Optional) Boolean that indicates whether to return the timestamps and raw data values of this metric, the default is true
+
+##### metric_stat
+
+This argument supports the following arguments:
+
+* `metric` - (Required) Structure that defines the CloudWatch metric to return, including the metric name, namespace, and dimensions.
+* `stat` - (Required) Statistic of the metrics to return.
+* `unit` - (Optional) Unit of the metrics to return.
+
+##### metric
+
+This argument supports the following arguments:
+
+* `dimensions` - (Optional) Dimensions of the metric.
+* `metricName` - (Required) Name of the metric.
+* `namespace` - (Required) Namespace of the metric.
+
+###### dimensions
+
+This argument supports the following arguments:
+
+* `name` - (Required) Name of the dimension.
+* `value` - (Required) Value of the dimension.
+
+### predictive_scaling_configuration
+
+This argument supports the following arguments:
+
+* `maxCapacityBreachBehavior` - (Optional) Defines the behavior that should be applied if the forecast capacity approaches or exceeds the maximum capacity of the Auto Scaling group. Valid values are `honorMaxCapacity` or `increaseMaxCapacity`. Default is `honorMaxCapacity`.
+* `maxCapacityBuffer` - (Optional) Size of the capacity buffer to use when the forecast capacity is close to or exceeds the maximum capacity. Valid range is `0` to `100`. If set to `0`, Amazon EC2 Auto Scaling may scale capacity higher than the maximum capacity to equal but not exceed forecast capacity.
+* `metricSpecification` - (Required) This structure includes the metrics and target utilization to use for predictive scaling.
+* `mode` - (Optional) Predictive scaling mode. Valid values are `forecastAndScale` and `forecastOnly`. Default is `forecastOnly`.
+* `schedulingBufferTime` - (Optional) Amount of time, in seconds, by which the instance launch time can be advanced. Minimum is `0`.
+
+#### metric_specification
+
+This argument supports the following arguments:
+
+* `customizedCapacityMetricSpecification` - (Optional) Customized capacity metric specification. The field is only valid when you use `customizedLoadMetricSpecification`
+* `customizedLoadMetricSpecification` - (Optional) Customized load metric specification.
+* `customizedScalingMetricSpecification` - (Optional) Customized scaling metric specification.
+* `predefinedLoadMetricSpecification` - (Optional) Predefined load metric specification.
+* `predefinedMetricPairSpecification` - (Optional) Metric pair specification from which Amazon EC2 Auto Scaling determines the appropriate scaling metric and load metric to use.
+* `predefinedScalingMetricSpecification` - (Optional) Predefined scaling metric specification.
+
+##### predefined_load_metric_specification
+
+This argument supports the following arguments:
+
+* `predefinedMetricType` - (Required) Metric type. Valid values are `asgTotalCpuUtilization`, `asgTotalNetworkIn`, `asgTotalNetworkOut`, or `albTargetGroupRequestCount`.
+* `resourceLabel` - (Required) Label that uniquely identifies a specific Application Load Balancer target group from which to determine the request count served by your Auto Scaling group.
+
+##### predefined_metric_pair_specification
+
+This argument supports the following arguments:
+
+* `predefinedMetricType` - (Required) Which metrics to use. There are two different types of metrics for each metric type: one is a load metric and one is a scaling metric. For example, if the metric type is `asgcpuUtilization`, the Auto Scaling group's total CPU metric is used as the load metric, and the average CPU metric is used for the scaling metric. Valid values are `asgcpuUtilization`, `asgNetworkIn`, `asgNetworkOut`, or `albRequestCount`.
+* `resourceLabel` - (Required) Label that uniquely identifies a specific Application Load Balancer target group from which to determine the request count served by your Auto Scaling group.
+
+##### predefined_scaling_metric_specification
+
+This argument supports the following arguments:
+
+* `predefinedMetricType` - (Required) Describes a scaling metric for a predictive scaling policy. Valid values are `asgAverageCpuUtilization`, `asgAverageNetworkIn`, `asgAverageNetworkOut`, or `albRequestCountPerTarget`.
+* `resourceLabel` - (Required) Label that uniquely identifies a specific Application Load Balancer target group from which to determine the request count served by your Auto Scaling group.
+
+##### customized_scaling_metric_specification
+
+This argument supports the following arguments:
+
+* `metricDataQueries` - (Required) List of up to 10 structures that defines custom scaling metric in predictive scaling policy
+
+##### customized_load_metric_specification
+
+This argument supports the following arguments:
+
+* `metricDataQueries` - (Required) List of up to 10 structures that defines custom load metric in predictive scaling policy
+
+##### customized_capacity_metric_specification
+
+This argument supports the following arguments:
+
+* `metricDataQueries` - (Required) List of up to 10 structures that defines custom capacity metric in predictive scaling policy
+
+##### metric_data_queries
+
+This argument supports the following arguments:
+
+* `expression` - (Optional) Math expression used on the returned metric. You must specify either `expression` or `metricStat`, but not both.
+* `id` - (Required) Short name for the metric used in predictive scaling policy.
+* `label` - (Optional) Human-readable label for this metric or expression.
+* `metricStat` - (Optional) Structure that defines CloudWatch metric to be used in predictive scaling policy. You must specify either `expression` or `metricStat`, but not both.
+* `returnData` - (Optional) Boolean that indicates whether to return the timestamps and raw data values of this metric, the default is true
+
+##### metric_stat
+
+This argument supports the following arguments:
+
+* `metric` - (Required) Structure that defines the CloudWatch metric to return, including the metric name, namespace, and dimensions.
+* `stat` - (Required) Statistic of the metrics to return.
+* `unit` - (Optional) Unit of the metrics to return.
+
+##### metric
+
+This argument supports the following arguments:
+
+* `dimensions` - (Optional) Dimensions of the metric.
+* `metricName` - (Required) Name of the metric.
+* `namespace` - (Required) Namespace of the metric.
+
+##### dimensions
+
+This argument supports the following arguments:
+
+* `name` - (Required) Name of the dimension.
+* `value` - (Required) Value of the dimension.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN assigned by AWS to the scaling policy.
+* `name` - Scaling policy's name.
+* `autoscalingGroupName` - The scaling policy's assigned autoscaling group.
+* `adjustmentType` - Scaling policy's adjustment type.
+* `policyType` - Scaling policy's type.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AutoScaling scaling policy using the role autoscaling_group_name and name separated by `/`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import AutoScaling scaling policy using the role autoscaling_group_name and name separated by `/`. For example:
+
+```console
+% terraform import aws_autoscaling_policy.test-policy asg-name/policy-name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-6ef16432ba01c530072bf934dd255361c14e5ea52efe71ab800335601445b659 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/autoscaling_schedule.html.markdown b/website/docs/cdktf/typescript/r/autoscaling_schedule.html.markdown
new file mode 100644
index 00000000000..e333773c315
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/autoscaling_schedule.html.markdown
@@ -0,0 +1,107 @@
+---
+subcategory: "Auto Scaling"
+layout: "aws"
+page_title: "AWS: aws_autoscaling_schedule"
+description: |-
+  Provides an AutoScaling Schedule resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_autoscaling_schedule
+
+Provides an AutoScaling Schedule resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AutoscalingGroup } from "./.gen/providers/aws/autoscaling-group";
+import { AutoscalingSchedule } from "./.gen/providers/aws/autoscaling-schedule";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const foobar = new AutoscalingGroup(this, "foobar", {
+      availabilityZones: ["us-west-2a"],
+      forceDelete: true,
+      healthCheckGracePeriod: 300,
+      healthCheckType: "ELB",
+      maxSize: 1,
+      minSize: 1,
+      name: "terraform-test-foobar5",
+      terminationPolicies: ["OldestInstance"],
+    });
+    const awsAutoscalingScheduleFoobar = new AutoscalingSchedule(
+      this,
+      "foobar_1",
+      {
+        autoscalingGroupName: foobar.name,
+        desiredCapacity: 0,
+        endTime: "2016-12-12T06:00:00Z",
+        maxSize: 1,
+        minSize: 0,
+        scheduledActionName: "foobar",
+        startTime: "2016-12-11T18:00:00Z",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsAutoscalingScheduleFoobar.overrideLogicalId("foobar");
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `autoscalingGroupName` - (Required) The name of the Auto Scaling group.
+* `scheduledActionName` - (Required) The name of this scaling action.
+
+The following arguments are optional:
+
+* `desiredCapacity` - (Optional) The initial capacity of the Auto Scaling group after the scheduled action runs and the capacity it attempts to maintain. Set to `1` if you don't want to change the desired capacity at the scheduled time. Defaults to `0`.
+* `endTime` - (Optional) The date and time for the recurring schedule to end, in UTC with the format `"yyyyMmDdThh:mm:ssZ"` (e.g. `"20210601T00:00:00Z"`).
+* `maxSize` - (Optional) The maximum size of the Auto Scaling group. Set to `1` if you don't want to change the maximum size at the scheduled time. Defaults to `0`.
+* `minSize` - (Optional) The minimum size of the Auto Scaling group. Set to `1` if you don't want to change the minimum size at the scheduled time. Defaults to `0`.
+* `recurrence` - (Optional) The recurring schedule for this action specified using the Unix cron syntax format.
+* `startTime` - (Optional) The date and time for the recurring schedule to start, in UTC with the format `"yyyyMmDdThh:mm:ssZ"` (e.g. `"20210601T00:00:00Z"`).
+* `timeZone` - (Optional)  Specifies the time zone for a cron expression. Valid values are the canonical names of the IANA time zones (such as `etc/gmt+9` or `pacific/tahiti`).
+
+~> **NOTE:** When `startTime` and `endTime` are specified with `recurrence` , they form the boundaries of when the recurring action will start and stop.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN assigned by AWS to the autoscaling schedule.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AutoScaling ScheduledAction using the `autoScalingGroupName` and `scheduledActionName`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import AutoScaling ScheduledAction using the `autoScalingGroupName` and `scheduledActionName`. For example:
+
+```console
+% terraform import aws_autoscaling_schedule.resource-name auto-scaling-group-name/scheduled-action-name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-5be402701834f8814cc05c38173674caf079493d6dfbaad45363725e999d42d0 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/autoscaling_traffic_source_attachment.html.markdown b/website/docs/cdktf/typescript/r/autoscaling_traffic_source_attachment.html.markdown
new file mode 100644
index 00000000000..2d70793ac90
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/autoscaling_traffic_source_attachment.html.markdown
@@ -0,0 +1,65 @@
+---
+subcategory: "Auto Scaling"
+layout: "aws"
+page_title: "AWS: aws_autoscaling_traffic_source_attachment"
+description: |-
+  Terraform resource for managing an AWS Auto Scaling Traffic Source Attachment.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_autoscaling_traffic_source_attachment
+
+Attaches a traffic source to an Auto Scaling group.
+
+~> **NOTE on Auto Scaling Groups, Attachments and Traffic Source Attachments:** Terraform provides standalone [Attachment](autoscaling_attachment.html) (for attaching Classic Load Balancers and Application Load Balancer, Gateway Load Balancer, or Network Load Balancer target groups) and Traffic Source Attachment (for attaching Load Balancers and VPC Lattice target groups) resources and an [Auto Scaling Group](autoscaling_group.html) resource with `loadBalancers`, `targetGroupArns` and `trafficSource` attributes. Do not use the same traffic source in more than one of these resources. Doing so will cause a conflict of attachments. A [`lifecycle` configuration block](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html) can be used to suppress differences if necessary.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AutoscalingTrafficSourceAttachment } from "./.gen/providers/aws/autoscaling-traffic-source-attachment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AutoscalingTrafficSourceAttachment(this, "example", {
+      autoscalingGroupName: Token.asString(awsAutoscalingGroupExample.id),
+      trafficSource: {
+        identifier: Token.asString(awsLbTargetGroupExample.arn),
+        type: "elbv2",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+- `autoscalingGroupName` - (Required) The name of the Auto Scaling group.
+- `trafficSource` - (Required) The unique identifiers of a traffic sources.
+
+`trafficSource` supports the following:
+
+- `identifier` - (Required) Identifies the traffic source. For Application Load Balancers, Gateway Load Balancers, Network Load Balancers, and VPC Lattice, this will be the Amazon Resource Name (ARN) for a target group in this account and Region. For Classic Load Balancers, this will be the name of the Classic Load Balancer in this account and Region.
+- `type` - (Required) Provides additional context for the value of `identifier`.
+  The following lists the valid values:
+  `elb` if `identifier` is the name of a Classic Load Balancer.
+  `elbv2` if `identifier` is the ARN of an Application Load Balancer, Gateway Load Balancer, or Network Load Balancer target group.
+  `vpcLattice` if `identifier` is the ARN of a VPC Lattice target group.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+<!-- cache-key: cdktf-0.18.0 input-72bb6c9704283849d9c75ff3dafc57a9e90be5f5708ae5130ec931e2c4f0ef04 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/autoscalingplans_scaling_plan.html.markdown b/website/docs/cdktf/typescript/r/autoscalingplans_scaling_plan.html.markdown
new file mode 100644
index 00000000000..c9c90c935ad
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/autoscalingplans_scaling_plan.html.markdown
@@ -0,0 +1,280 @@
+---
+subcategory: "Auto Scaling Plans"
+layout: "aws"
+page_title: "AWS: aws_autoscalingplans_scaling_plan"
+description: |-
+  Manages an AWS Auto Scaling scaling plan.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_autoscalingplans_scaling_plan
+
+Manages an AWS Auto Scaling scaling plan.
+More information can be found in the [AWS Auto Scaling User Guide](https://docs.aws.amazon.com/autoscaling/plans/userguide/what-is-aws-auto-scaling.html).
+
+~> **NOTE:** The AWS Auto Scaling service uses an AWS IAM service-linked role to manage predictive scaling of Amazon EC2 Auto Scaling groups. The service attempts to automatically create this role the first time a scaling plan with predictive scaling enabled is created.
+An [`awsIamServiceLinkedRole`](/docs/providers/aws/r/iam_service_linked_role.html) resource can be used to manually manage this role.
+See the [AWS documentation](https://docs.aws.amazon.com/autoscaling/plans/userguide/aws-auto-scaling-service-linked-roles.html#create-service-linked-role-manual) for more details.
+
+## Example Usage
+
+### Basic Dynamic Scaling
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AutoscalingGroup } from "./.gen/providers/aws/autoscaling-group";
+import { AutoscalingplansScalingPlan } from "./.gen/providers/aws/autoscalingplans-scaling-plan";
+import { DataAwsAvailabilityZones } from "./.gen/providers/aws/data-aws-availability-zones";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const available = new DataAwsAvailabilityZones(this, "available", {});
+    const example = new AutoscalingGroup(this, "example", {
+      availabilityZones: [
+        Token.asString(Fn.lookupNested(available.names, ["0"])),
+      ],
+      launchConfiguration: Token.asString(awsLaunchConfigurationExample.name),
+      maxSize: 3,
+      minSize: 0,
+      namePrefix: "example",
+      tags: [
+        {
+          key: "application",
+          propagate_at_launch: true,
+          value: "example",
+        },
+      ],
+    });
+    const awsAutoscalingplansScalingPlanExample =
+      new AutoscalingplansScalingPlan(this, "example_2", {
+        applicationSource: {
+          tagFilter: [
+            {
+              key: "application",
+              values: ["example"],
+            },
+          ],
+        },
+        name: "example-dynamic-cost-optimization",
+        scalingInstruction: [
+          {
+            maxCapacity: 3,
+            minCapacity: 0,
+            resourceId: Token.asString(
+              Fn.format("autoScalingGroup/%s", [example.name])
+            ),
+            scalableDimension: "autoscaling:autoScalingGroup:DesiredCapacity",
+            serviceNamespace: "autoscaling",
+            targetTrackingConfiguration: [
+              {
+                predefinedScalingMetricSpecification: {
+                  predefinedScalingMetricType: "ASGAverageCPUUtilization",
+                },
+                targetValue: 70,
+              },
+            ],
+          },
+        ],
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsAutoscalingplansScalingPlanExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### Basic Predictive Scaling
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AutoscalingGroup } from "./.gen/providers/aws/autoscaling-group";
+import { AutoscalingplansScalingPlan } from "./.gen/providers/aws/autoscalingplans-scaling-plan";
+import { DataAwsAvailabilityZones } from "./.gen/providers/aws/data-aws-availability-zones";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const available = new DataAwsAvailabilityZones(this, "available", {});
+    const example = new AutoscalingGroup(this, "example", {
+      availabilityZones: [
+        Token.asString(Fn.lookupNested(available.names, ["0"])),
+      ],
+      launchConfiguration: Token.asString(awsLaunchConfigurationExample.name),
+      maxSize: 3,
+      minSize: 0,
+      namePrefix: "example",
+      tags: [
+        {
+          key: "application",
+          propagate_at_launch: true,
+          value: "example",
+        },
+      ],
+    });
+    const awsAutoscalingplansScalingPlanExample =
+      new AutoscalingplansScalingPlan(this, "example_2", {
+        applicationSource: {
+          tagFilter: [
+            {
+              key: "application",
+              values: ["example"],
+            },
+          ],
+        },
+        name: "example-predictive-cost-optimization",
+        scalingInstruction: [
+          {
+            disableDynamicScaling: true,
+            maxCapacity: 3,
+            minCapacity: 0,
+            predefinedLoadMetricSpecification: {
+              predefinedLoadMetricType: "ASGTotalCPUUtilization",
+            },
+            predictiveScalingMaxCapacityBehavior:
+              "SetForecastCapacityToMaxCapacity",
+            predictiveScalingMode: "ForecastAndScale",
+            resourceId: Token.asString(
+              Fn.format("autoScalingGroup/%s", [example.name])
+            ),
+            scalableDimension: "autoscaling:autoScalingGroup:DesiredCapacity",
+            serviceNamespace: "autoscaling",
+            targetTrackingConfiguration: [
+              {
+                predefinedScalingMetricSpecification: {
+                  predefinedScalingMetricType: "ASGAverageCPUUtilization",
+                },
+                targetValue: 70,
+              },
+            ],
+          },
+        ],
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsAutoscalingplansScalingPlanExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) Name of the scaling plan. Names cannot contain vertical bars, colons, or forward slashes.
+* `applicationSource` - (Required) CloudFormation stack or set of tags. You can create one scaling plan per application source.
+* `scalingInstruction` - (Required) Scaling instructions. More details can be found in the [AWS Auto Scaling API Reference](https://docs.aws.amazon.com/autoscaling/plans/APIReference/API_ScalingInstruction.html).
+
+The `applicationSource` object supports the following:
+
+* `cloudformationStackArn` - (Optional) ARN of a AWS CloudFormation stack.
+* `tagFilter` - (Optional) Set of tags.
+
+The `tagFilter` object supports the following:
+
+* `key` - (Required) Tag key.
+* `values` - (Optional) Tag values.
+
+The `scalingInstruction` object supports the following:
+
+* `maxCapacity` - (Required) Maximum capacity of the resource. The exception to this upper limit is if you specify a non-default setting for `predictiveScalingMaxCapacityBehavior`.
+* `minCapacity` - (Required) Minimum capacity of the resource.
+* `resourceId` - (Required) ID of the resource. This string consists of the resource type and unique identifier.
+* `scalableDimension` - (Required) Scalable dimension associated with the resource. Valid values: `autoscaling:autoScalingGroup:desiredCapacity`, `dynamodb:index:readCapacityUnits`, `dynamodb:index:writeCapacityUnits`, `dynamodb:table:readCapacityUnits`, `dynamodb:table:writeCapacityUnits`, `ecs:service:desiredCount`, `ec2:spotFleetRequest:targetCapacity`, `rds:cluster:readReplicaCount`.
+* `serviceNamespace` - (Required) Namespace of the AWS service. Valid values: `autoscaling`, `dynamodb`, `ecs`, `ec2`, `rds`.
+* `targetTrackingConfiguration` - (Required) Structure that defines new target tracking configurations. Each of these structures includes a specific scaling metric and a target value for the metric, along with various parameters to use with dynamic scaling.
+More details can be found in the [AWS Auto Scaling API Reference](https://docs.aws.amazon.com/autoscaling/plans/APIReference/API_TargetTrackingConfiguration.html).
+* `customizedLoadMetricSpecification` - (Optional) Customized load metric to use for predictive scaling. You must specify either `customizedLoadMetricSpecification` or `predefinedLoadMetricSpecification` when configuring predictive scaling.
+More details can be found in the [AWS Auto Scaling API Reference](https://docs.aws.amazon.com/autoscaling/plans/APIReference/API_CustomizedLoadMetricSpecification.html).
+* `disableDynamicScaling` - (Optional) Boolean controlling whether dynamic scaling by AWS Auto Scaling is disabled. Defaults to `false`.
+* `predefinedLoadMetricSpecification` - (Optional) Predefined load metric to use for predictive scaling. You must specify either `predefinedLoadMetricSpecification` or `customizedLoadMetricSpecification` when configuring predictive scaling.
+More details can be found in the [AWS Auto Scaling API Reference](https://docs.aws.amazon.com/autoscaling/plans/APIReference/API_PredefinedLoadMetricSpecification.html).
+* `predictiveScalingMaxCapacityBehavior`- (Optional) Defines the behavior that should be applied if the forecast capacity approaches or exceeds the maximum capacity specified for the resource.
+Valid values: `setForecastCapacityToMaxCapacity`, `setMaxCapacityAboveForecastCapacity`, `setMaxCapacityToForecastCapacity`.
+* `predictiveScalingMaxCapacityBuffer` - (Optional) Size of the capacity buffer to use when the forecast capacity is close to or exceeds the maximum capacity.
+* `predictiveScalingMode` - (Optional) Predictive scaling mode. Valid values: `forecastAndScale`, `forecastOnly`.
+* `scalingPolicyUpdateBehavior` - (Optional) Controls whether a resource's externally created scaling policies are kept or replaced. Valid values: `keepExternalPolicies`, `replaceExternalPolicies`. Defaults to `keepExternalPolicies`.
+* `scheduledActionBufferTime` - (Optional) Amount of time, in seconds, to buffer the run time of scheduled scaling actions when scaling out.
+
+The `customizedLoadMetricSpecification` object supports the following:
+
+* `metricName` - (Required) Name of the metric.
+* `namespace` - (Required) Namespace of the metric.
+* `statistic` - (Required) Statistic of the metric. Currently, the value must always be `sum`.
+* `dimensions` - (Optional) Dimensions of the metric.
+* `unit` - (Optional) Unit of the metric.
+
+The `predefinedLoadMetricSpecification` object supports the following:
+
+* `predefinedLoadMetricType` - (Required) Metric type. Valid values: `albTargetGroupRequestCount`, `asgTotalCpuUtilization`, `asgTotalNetworkIn`, `asgTotalNetworkOut`.
+* `resourceLabel` - (Optional) Identifies the resource associated with the metric type.
+
+The `targetTrackingConfiguration` object supports the following:
+
+* `targetValue` - (Required) Target value for the metric.
+* `customizedScalingMetricSpecification` - (Optional) Customized metric. You can specify either `customizedScalingMetricSpecification` or `predefinedScalingMetricSpecification`.
+More details can be found in the [AWS Auto Scaling API Reference](https://docs.aws.amazon.com/autoscaling/plans/APIReference/API_CustomizedScalingMetricSpecification.html).
+* `disableScaleIn` - (Optional) Boolean indicating whether scale in by the target tracking scaling policy is disabled. Defaults to `false`.
+* `predefinedScalingMetricSpecification` - (Optional) Predefined metric. You can specify either `predefinedScalingMetricSpecification` or `customizedScalingMetricSpecification`.
+More details can be found in the [AWS Auto Scaling API Reference](https://docs.aws.amazon.com/autoscaling/plans/APIReference/API_PredefinedScalingMetricSpecification.html).
+* `estimatedInstanceWarmup` - (Optional) Estimated time, in seconds, until a newly launched instance can contribute to the CloudWatch metrics.
+This value is used only if the resource is an Auto Scaling group.
+* `scaleInCooldown` - (Optional) Amount of time, in seconds, after a scale in activity completes before another scale in activity can start.
+This value is not used if the scalable resource is an Auto Scaling group.
+* `scaleOutCooldown` - (Optional) Amount of time, in seconds, after a scale-out activity completes before another scale-out activity can start.
+This value is not used if the scalable resource is an Auto Scaling group.
+
+The `customizedScalingMetricSpecification` object supports the following:
+
+* `metricName` - (Required) Name of the metric.
+* `namespace` - (Required) Namespace of the metric.
+* `statistic` - (Required) Statistic of the metric. Valid values: `average`, `maximum`, `minimum`, `sampleCount`, `sum`.
+* `dimensions` - (Optional) Dimensions of the metric.
+* `unit` - (Optional) Unit of the metric.
+
+The `predefinedScalingMetricSpecification` object supports the following:
+
+* `predefinedScalingMetricType` - (Required) Metric type. Valid values: `albRequestCountPerTarget`, `asgAverageCpuUtilization`, `asgAverageNetworkIn`, `asgAverageNetworkOut`, `dynamoDbReadCapacityUtilization`, `dynamoDbWriteCapacityUtilization`, `ecsServiceAverageCpuUtilization`, `ecsServiceAverageMemoryUtilization`, `ec2SpotFleetRequestAverageCpuUtilization`, `ec2SpotFleetRequestAverageNetworkIn`, `ec2SpotFleetRequestAverageNetworkOut`, `rdsReaderAverageCpuUtilization`, `rdsReaderAverageDatabaseConnections`.
+* `resourceLabel` - (Optional) Identifies the resource associated with the metric type.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Scaling plan identifier.
+* `scalingPlanVersion` - The version number of the scaling plan. This value is always 1.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Auto Scaling scaling plans using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Auto Scaling scaling plans using the `name`. For example:
+
+```console
+% terraform import aws_autoscalingplans_scaling_plan.example MyScale1
+```
+
+<!-- cache-key: cdktf-0.18.0 input-f67f35037f518287955e616d7a36d30ef67c9f228d87872a4d2e00fce74eaaef -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/backup_framework.html.markdown b/website/docs/cdktf/typescript/r/backup_framework.html.markdown
new file mode 100644
index 00000000000..67631ab7ad8
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/backup_framework.html.markdown
@@ -0,0 +1,188 @@
+---
+subcategory: "Backup"
+layout: "aws"
+page_title: "AWS: aws_backup_framework"
+description: |-
+  Provides an AWS Backup Framework resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_backup_framework
+
+Provides an AWS Backup Framework resource.
+
+~> **Note:** For the Deployment Status of the Framework to be successful, please turn on resource tracking to enable AWS Config recording to track configuration changes of your backup resources. This can be done from the AWS Console.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { BackupFramework } from "./.gen/providers/aws/backup-framework";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new BackupFramework(this, "Example", {
+      control: [
+        {
+          inputParameter: [
+            {
+              name: "requiredRetentionDays",
+              value: "35",
+            },
+          ],
+          name: "BACKUP_RECOVERY_POINT_MINIMUM_RETENTION_CHECK",
+        },
+        {
+          inputParameter: [
+            {
+              name: "requiredFrequencyUnit",
+              value: "hours",
+            },
+            {
+              name: "requiredRetentionDays",
+              value: "35",
+            },
+            {
+              name: "requiredFrequencyValue",
+              value: "1",
+            },
+          ],
+          name: "BACKUP_PLAN_MIN_FREQUENCY_AND_MIN_RETENTION_CHECK",
+        },
+        {
+          name: "BACKUP_RECOVERY_POINT_ENCRYPTED",
+        },
+        {
+          name: "BACKUP_RESOURCES_PROTECTED_BY_BACKUP_PLAN",
+          scope: {
+            complianceResourceTypes: ["EBS"],
+          },
+        },
+        {
+          name: "BACKUP_RECOVERY_POINT_MANUAL_DELETION_DISABLED",
+        },
+        {
+          inputParameter: [
+            {
+              name: "maxRetentionDays",
+              value: "100",
+            },
+            {
+              name: "minRetentionDays",
+              value: "1",
+            },
+          ],
+          name: "BACKUP_RESOURCES_PROTECTED_BY_BACKUP_VAULT_LOCK",
+          scope: {
+            complianceResourceTypes: ["EBS"],
+          },
+        },
+        {
+          inputParameter: [
+            {
+              name: "recoveryPointAgeUnit",
+              value: "days",
+            },
+            {
+              name: "recoveryPointAgeValue",
+              value: "1",
+            },
+          ],
+          name: "BACKUP_LAST_RECOVERY_POINT_CREATED",
+          scope: {
+            complianceResourceTypes: ["EBS"],
+          },
+        },
+      ],
+      description: "this is an example framework",
+      name: "exampleFramework",
+      tags: {
+        Name: "Example Framework",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `control` - (Required) One or more control blocks that make up the framework. Each control in the list has a name, input parameters, and scope. Detailed below.
+* `description` - (Optional) The description of the framework with a maximum of 1,024 characters
+* `name` - (Required) The unique name of the framework. The name must be between 1 and 256 characters, starting with a letter, and consisting of letters, numbers, and underscores.
+* `tags` - (Optional) Metadata that you can assign to help organize the frameworks you create. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Control Arguments
+
+`control` has the following attributes:
+
+* `inputParameter` - (Optional) One or more input parameter blocks. An example of a control with two parameters is: "backup plan frequency is at least daily and the retention period is at least 1 year". The first parameter is daily. The second parameter is 1 year. Detailed below.
+* `name` - (Required) The name of a control. This name is between 1 and 256 characters.
+* `scope` - (Optional) The scope of a control. The control scope defines what the control will evaluate. Three examples of control scopes are: a specific backup plan, all backup plans with a specific tag, or all backup plans. Detailed below.
+
+### Input Parameter Arguments
+
+`inputParameter` has the following attributes:
+
+* `name` - (Optional) The name of a parameter, for example, BackupPlanFrequency.
+* `value` - (Optional) The value of parameter, for example, hourly.
+
+### Scope Arguments
+
+`scope` has the following attributes:
+
+* `complianceResourceIds` - (Optional) The ID of the only AWS resource that you want your control scope to contain. Minimum number of 1 item. Maximum number of 100 items.
+* `complianceResourceTypes` - (Optional) Describes whether the control scope includes one or more types of resources, such as EFS or RDS.
+* `tags` - (Optional) The tag key-value pair applied to those AWS resources that you want to trigger an evaluation for a rule. A maximum of one key-value pair can be provided.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the backup framework.
+* `creationTime` - The date and time that a framework is created, in Unix format and Coordinated Universal Time (UTC).
+* `deploymentStatus` - The deployment status of a framework. The statuses are: `createInProgress` | `updateInProgress` | `deleteInProgress` | `completed` | `failed`.
+* `id` - The id of the backup framework.
+* `status` - A framework consists of one or more controls. Each control governs a resource, such as backup plans, backup selections, backup vaults, or recovery points. You can also turn AWS Config recording on or off for each resource. For more information refer to the [AWS documentation for Framework Status](https://docs.aws.amazon.com/aws-backup/latest/devguide/API_DescribeFramework.html#Backup-DescribeFramework-response-FrameworkStatus)
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `2M`)
+* `update` - (Default `2M`)
+* `delete` - (Default `2M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Backup Framework using the `id` which corresponds to the name of the Backup Framework. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Backup Framework using the `id` which corresponds to the name of the Backup Framework. For example:
+
+```console
+% terraform import aws_backup_framework.test <id>
+```
+
+<!-- cache-key: cdktf-0.18.0 input-4cb34459561740182d4b24333fe8df9142bdd3e691f64f140504aa521fe31ef8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/backup_global_settings.html.markdown b/website/docs/cdktf/typescript/r/backup_global_settings.html.markdown
new file mode 100644
index 00000000000..ed28ed8f103
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/backup_global_settings.html.markdown
@@ -0,0 +1,73 @@
+---
+subcategory: "Backup"
+layout: "aws"
+page_title: "AWS: aws_backup_global_settings"
+description: |-
+  Provides an AWS Backup Global Settings resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_backup_global_settings
+
+Provides an AWS Backup Global Settings resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { BackupGlobalSettings } from "./.gen/providers/aws/backup-global-settings";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new BackupGlobalSettings(this, "test", {
+      globalSettings: {
+        isCrossAccountBackupEnabled: "true",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `globalSettings` - (Required) A list of resources along with the opt-in preferences for the account.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The AWS Account ID.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Backup Global Settings using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Backup Global Settings using the `id`. For example:
+
+```console
+% terraform import aws_backup_global_settings.example 123456789012
+```
+
+<!-- cache-key: cdktf-0.18.0 input-61e4ea90b0bc8bb7e796f1019721fafa7192f84c3c85dd25a159206e861e05c7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/backup_plan.html.markdown b/website/docs/cdktf/typescript/r/backup_plan.html.markdown
new file mode 100644
index 00000000000..15ae5b95b05
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/backup_plan.html.markdown
@@ -0,0 +1,130 @@
+---
+subcategory: "Backup"
+layout: "aws"
+page_title: "AWS: aws_backup_plan"
+description: |-
+  Provides an AWS Backup plan resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_backup_plan
+
+Provides an AWS Backup plan resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { BackupPlan } from "./.gen/providers/aws/backup-plan";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new BackupPlan(this, "example", {
+      advancedBackupSetting: [
+        {
+          backupOptions: {
+            WindowsVSS: "enabled",
+          },
+          resourceType: "EC2",
+        },
+      ],
+      name: "tf_example_backup_plan",
+      rule: [
+        {
+          lifecycle: {
+            deleteAfter: 14,
+          },
+          ruleName: "tf_example_backup_rule",
+          schedule: "cron(0 12 * * ? *)",
+          targetVaultName: test.name,
+        },
+      ],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The display name of a backup plan.
+* `rule` - (Required) A rule object that specifies a scheduled task that is used to back up a selection of resources.
+* `advancedBackupSetting` - (Optional) An object that specifies backup options for each resource type.
+* `tags` - (Optional) Metadata that you can assign to help organize the plans you create. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Rule Arguments
+
+`rule` supports the following attributes:
+
+* `ruleName` - (Required) An display name for a backup rule.
+* `targetVaultName` - (Required) The name of a logical container where backups are stored.
+* `schedule` - (Optional) A CRON expression specifying when AWS Backup initiates a backup job.
+* `enableContinuousBackup` - (Optional) Enable continuous backups for supported resources.
+* `startWindow` - (Optional) The amount of time in minutes before beginning a backup.
+* `completionWindow` - (Optional) The amount of time in minutes AWS Backup attempts a backup before canceling the job and returning an error.
+* `lifecycle` - (Optional) The lifecycle defines when a protected resource is transitioned to cold storage and when it expires.  Fields documented below.
+* `recoveryPointTags` - (Optional) Metadata that you can assign to help organize the resources that you create.
+* `copyAction` - (Optional) Configuration block(s) with copy operation settings. Detailed below.
+
+### Lifecycle Arguments
+
+`lifecycle` supports the following attributes:
+
+* `coldStorageAfter` - (Optional) Specifies the number of days after creation that a recovery point is moved to cold storage.
+* `deleteAfter` - (Optional) Specifies the number of days after creation that a recovery point is deleted. Must be 90 days greater than `coldStorageAfter`.
+
+### Copy Action Arguments
+
+`copyAction` supports the following attributes:
+
+* `lifecycle` - (Optional) The lifecycle defines when a protected resource is copied over to a backup vault and when it expires.  Fields documented above.
+* `destinationVaultArn` - (Required) An Amazon Resource Name (ARN) that uniquely identifies the destination backup vault for the copied backup.
+
+### Advanced Backup Setting Arguments
+
+`advancedBackupSetting` supports the following arguments:
+
+* `backupOptions` - (Required) Specifies the backup option for a selected resource. This option is only available for Windows VSS backup jobs. Set to `{ WindowsVSS = "enabled" }` to enable Windows VSS backup option and create a VSS Windows backup.
+* `resourceType` - (Required) The type of AWS resource to be backed up. For VSS Windows backups, the only supported resource type is Amazon EC2. Valid values: `ec2`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The id of the backup plan.
+* `arn` - The ARN of the backup plan.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `version` - Unique, randomly generated, Unicode, UTF-8 encoded string that serves as the version ID of the backup plan.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Backup Plan using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Backup Plan using the `id`. For example:
+
+```console
+% terraform import aws_backup_plan.test <id>
+```
+
+<!-- cache-key: cdktf-0.18.0 input-e41e73e041e50613fcaa9cb0889a0177d0b33c0a30b6e8469e4e706a67a8b35d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/backup_region_settings.html.markdown b/website/docs/cdktf/typescript/r/backup_region_settings.html.markdown
new file mode 100644
index 00000000000..515cced76ca
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/backup_region_settings.html.markdown
@@ -0,0 +1,88 @@
+---
+subcategory: "Backup"
+layout: "aws"
+page_title: "AWS: aws_backup_region_settings"
+description: |-
+  Provides an AWS Backup Region Settings resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_backup_region_settings
+
+Provides an AWS Backup Region Settings resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { BackupRegionSettings } from "./.gen/providers/aws/backup-region-settings";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new BackupRegionSettings(this, "test", {
+      resourceTypeManagementPreference: {
+        DynamoDB: true,
+        EFS: true,
+      },
+      resourceTypeOptInPreference: {
+        Aurora: true,
+        DocumentDB: true,
+        DynamoDB: true,
+        EBS: true,
+        EC2: true,
+        EFS: true,
+        FSx: true,
+        Neptune: true,
+        RDS: true,
+        "Storage Gateway": true,
+        VirtualMachine: true,
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `resourceTypeOptInPreference` - (Required) A map of services along with the opt-in preferences for the Region.
+* `resourceTypeManagementPreference` - (Optional) A map of services along with the management preferences for the Region. For more information, see the [AWS Documentation](https://docs.aws.amazon.com/aws-backup/latest/devguide/API_UpdateRegionSettings.html#API_UpdateRegionSettings_RequestSyntax).
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The AWS region.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Backup Region Settings using the `region`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Backup Region Settings using the `region`. For example:
+
+```console
+% terraform import aws_backup_region_settings.test us-west-2
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1c87f4723a3ea47fdb8b9fe296035ddc01080e9391eac471698160d93a976e00 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/backup_report_plan.html.markdown b/website/docs/cdktf/typescript/r/backup_report_plan.html.markdown
new file mode 100644
index 00000000000..8d4b5297247
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/backup_report_plan.html.markdown
@@ -0,0 +1,109 @@
+---
+subcategory: "Backup"
+layout: "aws"
+page_title: "AWS: aws_backup_report_plan"
+description: |-
+  Provides an AWS Backup Report Plan resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_backup_report_plan
+
+Provides an AWS Backup Report Plan resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { BackupReportPlan } from "./.gen/providers/aws/backup-report-plan";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new BackupReportPlan(this, "example", {
+      description: "example description",
+      name: "example_name",
+      reportDeliveryChannel: {
+        formats: ["CSV", "JSON"],
+        s3BucketName: "example-bucket-name",
+      },
+      reportSetting: {
+        reportTemplate: "RESTORE_JOB_REPORT",
+      },
+      tags: {
+        Name: "Example Report Plan",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `description` - (Optional) The description of the report plan with a maximum of 1,024 characters
+* `name` - (Required) The unique name of the report plan. The name must be between 1 and 256 characters, starting with a letter, and consisting of letters, numbers, and underscores.
+* `reportDeliveryChannel` - (Required) An object that contains information about where and how to deliver your reports, specifically your Amazon S3 bucket name, S3 key prefix, and the formats of your reports. Detailed below.
+* `reportSetting` - (Required) An object that identifies the report template for the report. Reports are built using a report template. Detailed below.
+* `tags` - (Optional) Metadata that you can assign to help organize the report plans you create. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Report Delivery Channel Arguments
+
+`reportDeliveryChannel` supports the following arguments:
+
+* `formats` - (Optional) A list of the format of your reports: CSV, JSON, or both. If not specified, the default format is CSV.
+* `s3BucketName` - (Required) The unique name of the S3 bucket that receives your reports.
+* `s3KeyPrefix` - (Optional) The prefix for where Backup Audit Manager delivers your reports to Amazon S3. The prefix is this part of the following path: s3://your-bucket-name/prefix/Backup/us-west-2/year/month/day/report-name. If not specified, there is no prefix.
+
+### Report Setting Arguments
+
+`reportSetting` supports the following arguments:
+
+* `accounts` - (Optional) Specifies the list of accounts a report covers.
+* `frameworkArns` - (Optional) Specifies the Amazon Resource Names (ARNs) of the frameworks a report covers.
+* `numberOfFrameworks` - (Optional) Specifies the number of frameworks a report covers.
+* `organizationUnits` - (Optional) Specifies the list of Organizational Units a report covers.
+* `regions` - (Optional) Specifies the list of regions a report covers.
+* `reportTemplate` - (Required) Identifies the report template for the report. Reports are built using a report template. The report templates are: `resourceComplianceReport` | `controlComplianceReport` | `backupJobReport` | `copyJobReport` | `restoreJobReport`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the backup report plan.
+* `creationTime` - The date and time that a report plan is created, in Unix format and Coordinated Universal Time (UTC).
+* `deploymentStatus` - The deployment status of a report plan. The statuses are: `createInProgress` | `updateInProgress` | `deleteInProgress` | `completed`.
+* `id` - The id of the backup report plan.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Backup Report Plan using the `id` which corresponds to the name of the Backup Report Plan. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Backup Report Plan using the `id` which corresponds to the name of the Backup Report Plan. For example:
+
+```console
+% terraform import aws_backup_report_plan.test <id>
+```
+
+<!-- cache-key: cdktf-0.18.0 input-bd959edfce1b301196f86382fc18f07f59bfcba90604113c6790f12cd75715da -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/backup_selection.html.markdown b/website/docs/cdktf/typescript/r/backup_selection.html.markdown
new file mode 100644
index 00000000000..d23330cdb6f
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/backup_selection.html.markdown
@@ -0,0 +1,271 @@
+---
+subcategory: "Backup"
+layout: "aws"
+page_title: "AWS: aws_backup_selection"
+description: |-
+  Manages selection conditions for AWS Backup plan resources.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_backup_selection
+
+Manages selection conditions for AWS Backup plan resources.
+
+## Example Usage
+
+### IAM Role
+
+-> For more information about creating and managing IAM Roles for backups and restores, see the [AWS Backup Developer Guide](https://docs.aws.amazon.com/aws-backup/latest/devguide/iam-service-roles.html).
+
+The below example creates an IAM role with the default managed IAM Policy for allowing AWS Backup to create backups.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { BackupSelection } from "./.gen/providers/aws/backup-selection";
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+import { IamRolePolicyAttachment } from "./.gen/providers/aws/iam-role-policy-attachment";
+interface MyConfig {
+  name: any;
+  planId: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    const assumeRole = new DataAwsIamPolicyDocument(this, "assume_role", {
+      statement: [
+        {
+          actions: ["sts:AssumeRole"],
+          effect: "Allow",
+          principals: [
+            {
+              identifiers: ["backup.amazonaws.com"],
+              type: "Service",
+            },
+          ],
+        },
+      ],
+    });
+    const example = new IamRole(this, "example", {
+      assumeRolePolicy: Token.asString(assumeRole.json),
+      name: "example",
+    });
+    const awsIamRolePolicyAttachmentExample = new IamRolePolicyAttachment(
+      this,
+      "example_2",
+      {
+        policyArn:
+          "arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForBackup",
+        role: example.name,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamRolePolicyAttachmentExample.overrideLogicalId("example");
+    const awsBackupSelectionExample = new BackupSelection(this, "example_3", {
+      iamRoleArn: example.arn,
+      name: config.name,
+      planId: config.planId,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsBackupSelectionExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### Selecting Backups By Tag
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { BackupSelection } from "./.gen/providers/aws/backup-selection";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new BackupSelection(this, "example", {
+      iamRoleArn: Token.asString(awsIamRoleExample.arn),
+      name: "tf_example_backup_selection",
+      planId: Token.asString(awsBackupPlanExample.id),
+      selectionTag: [
+        {
+          key: "foo",
+          type: "STRINGEQUALS",
+          value: "bar",
+        },
+      ],
+    });
+  }
+}
+
+```
+
+### Selecting Backups By Conditions
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { BackupSelection } from "./.gen/providers/aws/backup-selection";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new BackupSelection(this, "example", {
+      condition: [
+        {
+          stringEquals: [
+            {
+              key: "aws:ResourceTag/Component",
+              value: "rds",
+            },
+          ],
+          stringLike: [
+            {
+              key: "aws:ResourceTag/Application",
+              value: "app*",
+            },
+          ],
+          stringNotEquals: [
+            {
+              key: "aws:ResourceTag/Backup",
+              value: "false",
+            },
+          ],
+          stringNotLike: [
+            {
+              key: "aws:ResourceTag/Environment",
+              value: "test*",
+            },
+          ],
+        },
+      ],
+      iamRoleArn: Token.asString(awsIamRoleExample.arn),
+      name: "tf_example_backup_selection",
+      planId: Token.asString(awsBackupPlanExample.id),
+      resources: ["*"],
+    });
+  }
+}
+
+```
+
+### Selecting Backups By Resource
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { BackupSelection } from "./.gen/providers/aws/backup-selection";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new BackupSelection(this, "example", {
+      iamRoleArn: Token.asString(awsIamRoleExample.arn),
+      name: "tf_example_backup_selection",
+      planId: Token.asString(awsBackupPlanExample.id),
+      resources: [
+        Token.asString(awsDbInstanceExample.arn),
+        Token.asString(awsEbsVolumeExample.arn),
+        Token.asString(awsEfsFileSystemExample.arn),
+      ],
+    });
+  }
+}
+
+```
+
+### Selecting Backups By Not Resource
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { BackupSelection } from "./.gen/providers/aws/backup-selection";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new BackupSelection(this, "example", {
+      iamRoleArn: Token.asString(awsIamRoleExample.arn),
+      name: "tf_example_backup_selection",
+      notResources: [
+        Token.asString(awsDbInstanceExample.arn),
+        Token.asString(awsEbsVolumeExample.arn),
+        Token.asString(awsEfsFileSystemExample.arn),
+      ],
+      planId: Token.asString(awsBackupPlanExample.id),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The display name of a resource selection document.
+* `planId` - (Required) The backup plan ID to be associated with the selection of resources.
+* `iamRoleArn` - (Required) The ARN of the IAM role that AWS Backup uses to authenticate when restoring and backing up the target resource. See the [AWS Backup Developer Guide](https://docs.aws.amazon.com/aws-backup/latest/devguide/access-control.html#managed-policies) for additional information about using AWS managed policies or creating custom policies attached to the IAM role.
+* `selectionTag` - (Optional) Tag-based conditions used to specify a set of resources to assign to a backup plan.
+* `condition` - (Optional) A list of conditions that you define to assign resources to your backup plans using tags.
+* `resources` - (Optional) An array of strings that either contain Amazon Resource Names (ARNs) or match patterns of resources to assign to a backup plan.
+* `notResources` - (Optional) An array of strings that either contain Amazon Resource Names (ARNs) or match patterns of resources to exclude from a backup plan.
+
+Tag conditions (`selectionTag`) support the following:
+
+* `type` - (Required) An operation, such as `stringEquals`, that is applied to a key-value pair used to filter resources in a selection.
+* `key` - (Required) The key in a key-value pair.
+* `value` - (Required) The value in a key-value pair.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Backup Selection identifier
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Backup selection using the role plan_id and id separated by `|`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Backup selection using the role plan_id and id separated by `|`. For example:
+
+```console
+% terraform import aws_backup_selection.example plan-id|selection-id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-611a33d70e2d7ee876d82838e90e00edfd3ded77693e25a475537a3e728818a3 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/backup_vault.html.markdown b/website/docs/cdktf/typescript/r/backup_vault.html.markdown
new file mode 100644
index 00000000000..97f37fbd7ae
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/backup_vault.html.markdown
@@ -0,0 +1,84 @@
+---
+subcategory: "Backup"
+layout: "aws"
+page_title: "AWS: aws_backup_vault"
+description: |-
+  Provides an AWS Backup vault resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_backup_vault
+
+Provides an AWS Backup vault resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { BackupVault } from "./.gen/providers/aws/backup-vault";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new BackupVault(this, "example", {
+      kmsKeyArn: Token.asString(awsKmsKeyExample.arn),
+      name: "example_backup_vault",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `forceDestroy` - (Optional, Default: `false`) A boolean that indicates that all recovery points stored in the vault are deleted so that the vault can be destroyed without error.
+* `kmsKeyArn` - (Optional) The server-side encryption key that is used to protect your backups.
+* `name` - (Required) Name of the backup vault to create.
+* `tags` - (Optional) Metadata that you can assign to help organize the resources that you create. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name of the vault.
+* `arn` - The ARN of the vault.
+* `recoveryPoints` - The number of recovery points that are stored in a backup vault.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `delete` - (Default `10M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Backup vault using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Backup vault using the `name`. For example:
+
+```console
+% terraform import aws_backup_vault.test-vault TestVault
+```
+
+<!-- cache-key: cdktf-0.18.0 input-eca95e815c6165631f5519aecaf60793b9c12d8e7d3bc319cb6177906c2d98c0 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/backup_vault_lock_configuration.html.markdown b/website/docs/cdktf/typescript/r/backup_vault_lock_configuration.html.markdown
new file mode 100644
index 00000000000..03d4358368d
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/backup_vault_lock_configuration.html.markdown
@@ -0,0 +1,78 @@
+---
+subcategory: "Backup"
+layout: "aws"
+page_title: "AWS: aws_backup_vault_lock_configuration"
+description: |-
+  Provides an AWS Backup vault lock configuration resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_backup_vault_lock_configuration
+
+Provides an AWS Backup vault lock configuration resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { BackupVaultLockConfiguration } from "./.gen/providers/aws/backup-vault-lock-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new BackupVaultLockConfiguration(this, "test", {
+      backupVaultName: "example_backup_vault",
+      changeableForDays: 3,
+      maxRetentionDays: 1200,
+      minRetentionDays: 7,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `backupVaultName` - (Required) Name of the backup vault to add a lock configuration for.
+* `changeableForDays` - (Optional) The number of days before the lock date. If omitted creates a vault lock in `governance` mode, otherwise it will create a vault lock in `compliance` mode.
+* `maxRetentionDays` - (Optional) The maximum retention period that the vault retains its recovery points.
+* `minRetentionDays` - (Optional) The minimum retention period that the vault retains its recovery points.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `backupVaultName` - The name of the vault.
+* `backupVaultArn` - The ARN of the vault.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Backup vault lock configuration using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Backup vault lock configuration using the `name`. For example:
+
+```console
+% terraform import aws_backup_vault_lock_configuration.test TestVault
+```
+
+<!-- cache-key: cdktf-0.18.0 input-7a6a16a744584530b702e520addc8fa4bab5b7a770b8ab9d13d1bbcb2f7c3f12 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/backup_vault_notifications.html.markdown b/website/docs/cdktf/typescript/r/backup_vault_notifications.html.markdown
new file mode 100644
index 00000000000..d40006119e2
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/backup_vault_notifications.html.markdown
@@ -0,0 +1,117 @@
+---
+subcategory: "Backup"
+layout: "aws"
+page_title: "AWS: aws_backup_vault_notifications"
+description: |-
+  Provides an AWS Backup vault notifications resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_backup_vault_notifications
+
+Provides an AWS Backup vault notifications resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { BackupVaultNotifications } from "./.gen/providers/aws/backup-vault-notifications";
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { SnsTopic } from "./.gen/providers/aws/sns-topic";
+import { SnsTopicPolicy } from "./.gen/providers/aws/sns-topic-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const test = new SnsTopic(this, "test", {
+      name: "backup-vault-events",
+    });
+    const dataAwsIamPolicyDocumentTest = new DataAwsIamPolicyDocument(
+      this,
+      "test_1",
+      {
+        policyId: "__default_policy_ID",
+        statement: [
+          {
+            actions: ["SNS:Publish"],
+            effect: "Allow",
+            principals: [
+              {
+                identifiers: ["backup.amazonaws.com"],
+                type: "Service",
+              },
+            ],
+            resources: [test.arn],
+            sid: "__default_statement_ID",
+          },
+        ],
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsIamPolicyDocumentTest.overrideLogicalId("test");
+    const awsBackupVaultNotificationsTest = new BackupVaultNotifications(
+      this,
+      "test_2",
+      {
+        backupVaultEvents: ["BACKUP_JOB_STARTED", "RESTORE_JOB_COMPLETED"],
+        backupVaultName: "example_backup_vault",
+        snsTopicArn: test.arn,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsBackupVaultNotificationsTest.overrideLogicalId("test");
+    const awsSnsTopicPolicyTest = new SnsTopicPolicy(this, "test_3", {
+      arn: test.arn,
+      policy: Token.asString(dataAwsIamPolicyDocumentTest.json),
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSnsTopicPolicyTest.overrideLogicalId("test");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `backupVaultName` - (Required) Name of the backup vault to add notifications for.
+* `snsTopicArn` - (Required) The Amazon Resource Name (ARN) that specifies the topic for a backup vault’s events
+* `backupVaultEvents` - (Required) An array of events that indicate the status of jobs to back up resources to the backup vault.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name of the vault.
+* `backupVaultArn` - The ARN of the vault.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Backup vault notifications using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Backup vault notifications using the `name`. For example:
+
+```console
+% terraform import aws_backup_vault_notifications.test TestVault
+```
+
+<!-- cache-key: cdktf-0.18.0 input-08e7368ad3cd60e158138ba083276c5a2949bfb1492a95cc0bc4ae1150912893 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/backup_vault_policy.html.markdown b/website/docs/cdktf/typescript/r/backup_vault_policy.html.markdown
new file mode 100644
index 00000000000..62bab2429ee
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/backup_vault_policy.html.markdown
@@ -0,0 +1,115 @@
+---
+subcategory: "Backup"
+layout: "aws"
+page_title: "AWS: aws_backup_vault_policy"
+description: |-
+  Provides an AWS Backup vault policy resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_backup_vault_policy
+
+Provides an AWS Backup vault policy resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { BackupVault } from "./.gen/providers/aws/backup-vault";
+import { BackupVaultPolicy } from "./.gen/providers/aws/backup-vault-policy";
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new BackupVault(this, "example", {
+      name: "example",
+    });
+    const dataAwsIamPolicyDocumentExample = new DataAwsIamPolicyDocument(
+      this,
+      "example_1",
+      {
+        statement: [
+          {
+            actions: [
+              "backup:DescribeBackupVault",
+              "backup:DeleteBackupVault",
+              "backup:PutBackupVaultAccessPolicy",
+              "backup:DeleteBackupVaultAccessPolicy",
+              "backup:GetBackupVaultAccessPolicy",
+              "backup:StartBackupJob",
+              "backup:GetBackupVaultNotifications",
+              "backup:PutBackupVaultNotifications",
+            ],
+            effect: "Allow",
+            principals: [
+              {
+                identifiers: ["*"],
+                type: "AWS",
+              },
+            ],
+            resources: [example.arn],
+          },
+        ],
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsIamPolicyDocumentExample.overrideLogicalId("example");
+    const awsBackupVaultPolicyExample = new BackupVaultPolicy(
+      this,
+      "example_2",
+      {
+        backupVaultName: example.name,
+        policy: Token.asString(dataAwsIamPolicyDocumentExample.json),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsBackupVaultPolicyExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `backupVaultName` - (Required) Name of the backup vault to add policy for.
+* `policy` - (Required) The backup vault access policy document in JSON format.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name of the vault.
+* `backupVaultArn` - The ARN of the vault.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Backup vault policy using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Backup vault policy using the `name`. For example:
+
+```console
+% terraform import aws_backup_vault_policy.test TestVault
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ab98f99514f38866a517aac446be1f3acb9e1bf25ba0c4567594ea6cc2e401d8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/batch_compute_environment.html.markdown b/website/docs/cdktf/typescript/r/batch_compute_environment.html.markdown
new file mode 100644
index 00000000000..61aa2525c23
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/batch_compute_environment.html.markdown
@@ -0,0 +1,295 @@
+---
+subcategory: "Batch"
+layout: "aws"
+page_title: "AWS: aws_batch_compute_environment"
+description: |-
+  Creates a AWS Batch compute environment.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_batch_compute_environment
+
+Creates a AWS Batch compute environment. Compute environments contain the Amazon ECS container instances that are used to run containerized batch jobs.
+
+For information about AWS Batch, see [What is AWS Batch?][1] .
+For information about compute environment, see [Compute Environments][2] .
+
+~> **Note:** To prevent a race condition during environment deletion, make sure to set `dependsOn` to the related `awsIamRolePolicyAttachment`;
+otherwise, the policy may be destroyed too soon and the compute environment will then get stuck in the `deleting` state, see [Troubleshooting AWS Batch][3] .
+
+## Example Usage
+
+### EC2 Type
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { BatchComputeEnvironment } from "./.gen/providers/aws/batch-compute-environment";
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { IamInstanceProfile } from "./.gen/providers/aws/iam-instance-profile";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+import { IamRolePolicyAttachment } from "./.gen/providers/aws/iam-role-policy-attachment";
+import { PlacementGroup } from "./.gen/providers/aws/placement-group";
+import { SecurityGroup } from "./.gen/providers/aws/security-group";
+import { Subnet } from "./.gen/providers/aws/subnet";
+import { Vpc } from "./.gen/providers/aws/vpc";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const sample = new PlacementGroup(this, "sample", {
+      name: "sample",
+      strategy: "cluster",
+    });
+    const awsSecurityGroupSample = new SecurityGroup(this, "sample_1", {
+      egress: [
+        {
+          cidrBlocks: ["0.0.0.0/0"],
+          fromPort: 0,
+          protocol: "-1",
+          toPort: 0,
+        },
+      ],
+      name: "aws_batch_compute_environment_security_group",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSecurityGroupSample.overrideLogicalId("sample");
+    const awsVpcSample = new Vpc(this, "sample_2", {
+      cidrBlock: "10.1.0.0/16",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsVpcSample.overrideLogicalId("sample");
+    const batchAssumeRole = new DataAwsIamPolicyDocument(
+      this,
+      "batch_assume_role",
+      {
+        statement: [
+          {
+            actions: ["sts:AssumeRole"],
+            effect: "Allow",
+            principals: [
+              {
+                identifiers: ["batch.amazonaws.com"],
+                type: "Service",
+              },
+            ],
+          },
+        ],
+      }
+    );
+    const ec2AssumeRole = new DataAwsIamPolicyDocument(
+      this,
+      "ec2_assume_role",
+      {
+        statement: [
+          {
+            actions: ["sts:AssumeRole"],
+            effect: "Allow",
+            principals: [
+              {
+                identifiers: ["ec2.amazonaws.com"],
+                type: "Service",
+              },
+            ],
+          },
+        ],
+      }
+    );
+    const awsBatchServiceRole = new IamRole(this, "aws_batch_service_role", {
+      assumeRolePolicy: Token.asString(batchAssumeRole.json),
+      name: "aws_batch_service_role",
+    });
+    const ecsInstanceRole = new IamRole(this, "ecs_instance_role", {
+      assumeRolePolicy: Token.asString(ec2AssumeRole.json),
+      name: "ecs_instance_role",
+    });
+    const awsIamRolePolicyAttachmentAwsBatchServiceRole =
+      new IamRolePolicyAttachment(this, "aws_batch_service_role_7", {
+        policyArn: "arn:aws:iam::aws:policy/service-role/AWSBatchServiceRole",
+        role: awsBatchServiceRole.name,
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamRolePolicyAttachmentAwsBatchServiceRole.overrideLogicalId(
+      "aws_batch_service_role"
+    );
+    const awsIamRolePolicyAttachmentEcsInstanceRole =
+      new IamRolePolicyAttachment(this, "ecs_instance_role_8", {
+        policyArn:
+          "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role",
+        role: ecsInstanceRole.name,
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamRolePolicyAttachmentEcsInstanceRole.overrideLogicalId(
+      "ecs_instance_role"
+    );
+    const awsSubnetSample = new Subnet(this, "sample_9", {
+      cidrBlock: "10.1.1.0/24",
+      vpcId: Token.asString(awsVpcSample.id),
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSubnetSample.overrideLogicalId("sample");
+    const awsIamInstanceProfileEcsInstanceRole = new IamInstanceProfile(
+      this,
+      "ecs_instance_role_10",
+      {
+        name: "ecs_instance_role",
+        role: ecsInstanceRole.name,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamInstanceProfileEcsInstanceRole.overrideLogicalId("ecs_instance_role");
+    const awsBatchComputeEnvironmentSample = new BatchComputeEnvironment(
+      this,
+      "sample_11",
+      {
+        computeEnvironmentName: "sample",
+        computeResources: {
+          instanceRole: Token.asString(
+            awsIamInstanceProfileEcsInstanceRole.arn
+          ),
+          instanceType: ["c4.large"],
+          maxVcpus: 16,
+          minVcpus: 0,
+          placementGroup: sample.name,
+          securityGroupIds: [Token.asString(awsSecurityGroupSample.id)],
+          subnets: [Token.asString(awsSubnetSample.id)],
+          type: "EC2",
+        },
+        dependsOn: [awsIamRolePolicyAttachmentAwsBatchServiceRole],
+        serviceRole: awsBatchServiceRole.arn,
+        type: "MANAGED",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsBatchComputeEnvironmentSample.overrideLogicalId("sample");
+  }
+}
+
+```
+
+### Fargate Type
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { BatchComputeEnvironment } from "./.gen/providers/aws/batch-compute-environment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new BatchComputeEnvironment(this, "sample", {
+      computeEnvironmentName: "sample",
+      computeResources: {
+        maxVcpus: 16,
+        securityGroupIds: [Token.asString(awsSecurityGroupSample.id)],
+        subnets: [Token.asString(awsSubnetSample.id)],
+        type: "FARGATE",
+      },
+      dependsOn: [awsBatchServiceRole],
+      serviceRole: Token.asString(awsIamRoleAwsBatchServiceRole.arn),
+      type: "MANAGED",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `computeEnvironmentName` - (Optional, Forces new resource) The name for your compute environment. Up to 128 letters (uppercase and lowercase), numbers, and underscores are allowed. If omitted, Terraform will assign a random, unique name.
+* `computeEnvironmentNamePrefix` - (Optional, Forces new resource) Creates a unique compute environment name beginning with the specified prefix. Conflicts with `computeEnvironmentName`.
+* `computeResources` - (Optional) Details of the compute resources managed by the compute environment. This parameter is required for managed compute environments. See details below.
+* `eksConfiguration` - (Optional) Details for the Amazon EKS cluster that supports the compute environment. See details below.
+* `serviceRole` - (Required) The full Amazon Resource Name (ARN) of the IAM role that allows AWS Batch to make calls to other AWS services on your behalf.
+* `state` - (Optional) The state of the compute environment. If the state is `enabled`, then the compute environment accepts jobs from a queue and can scale out automatically based on queues. Valid items are `enabled` or `disabled`. Defaults to `enabled`.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `type` - (Required) The type of the compute environment. Valid items are `managed` or `unmanaged`.
+
+### compute_resources
+
+* `allocationStrategy` - (Optional) The allocation strategy to use for the compute resource in case not enough instances of the best fitting instance type can be allocated. Valid items are `bestFitProgressive`, `spotCapacityOptimized` or `bestFit`. Defaults to `bestFit`. See [AWS docs](https://docs.aws.amazon.com/batch/latest/userguide/allocation-strategies.html) for details. This parameter isn't applicable to jobs running on Fargate resources, and shouldn't be specified.
+* `bidPercentage` - (Optional) Integer of maximum percentage that a Spot Instance price can be when compared with the On-Demand price for that instance type before instances are launched. For example, if your bid percentage is 20% (`20`), then the Spot price must be below 20% of the current On-Demand price for that EC2 instance. If you leave this field empty, the default value is 100% of the On-Demand price. This parameter isn't applicable to jobs running on Fargate resources, and shouldn't be specified.
+* `desiredVcpus` - (Optional) The desired number of EC2 vCPUS in the compute environment. This parameter isn't applicable to jobs running on Fargate resources, and shouldn't be specified.
+* `ec2Configuration` - (Optional) Provides information used to select Amazon Machine Images (AMIs) for EC2 instances in the compute environment. If Ec2Configuration isn't specified, the default is ECS_AL2. This parameter isn't applicable to jobs that are running on Fargate resources, and shouldn't be specified.
+* `ec2KeyPair` - (Optional) The EC2 key pair that is used for instances launched in the compute environment. This parameter isn't applicable to jobs running on Fargate resources, and shouldn't be specified.
+* `imageId` - (Optional) The Amazon Machine Image (AMI) ID used for instances launched in the compute environment. This parameter isn't applicable to jobs running on Fargate resources, and shouldn't be specified. (Deprecated, use [`ec2Configuration`](#ec2_configuration) `imageIdOverride` instead)
+* `instanceRole` - (Optional) The Amazon ECS instance role applied to Amazon EC2 instances in a compute environment. This parameter isn't applicable to jobs running on Fargate resources, and shouldn't be specified.
+* `instanceType` - (Optional) A list of instance types that may be launched. This parameter isn't applicable to jobs running on Fargate resources, and shouldn't be specified.
+* `launchTemplate` - (Optional) The launch template to use for your compute resources. See details below. This parameter isn't applicable to jobs running on Fargate resources, and shouldn't be specified.
+* `maxVcpus` - (Required) The maximum number of EC2 vCPUs that an environment can reach.
+* `minVcpus` - (Optional) The minimum number of EC2 vCPUs that an environment should maintain. For `ec2` or `spot` compute environments, if the parameter is not explicitly defined, a `0` default value will be set. This parameter isn't applicable to jobs running on Fargate resources, and shouldn't be specified.
+* `placementGroup` - (Optional) The Amazon EC2 placement group to associate with your compute resources.
+* `securityGroupIds` - (Optional) A list of EC2 security group that are associated with instances launched in the compute environment. This parameter is required for Fargate compute environments.
+* `spotIamFleetRole` - (Optional) The Amazon Resource Name (ARN) of the Amazon EC2 Spot Fleet IAM role applied to a SPOT compute environment. This parameter is required for SPOT compute environments. This parameter isn't applicable to jobs running on Fargate resources, and shouldn't be specified.
+* `subnets` - (Required) A list of VPC subnets into which the compute resources are launched.
+* `tags` - (Optional) Key-value pair tags to be applied to resources that are launched in the compute environment. This parameter isn't applicable to jobs running on Fargate resources, and shouldn't be specified.
+* `type` - (Required) The type of compute environment. Valid items are `ec2`, `spot`, `fargate` or `fargateSpot`.
+
+### ec2_configuration
+
+`ec2Configuration` supports the following:
+
+* `imageIdOverride` - (Optional) The AMI ID used for instances launched in the compute environment that match the image type. This setting overrides the `imageId` argument in the [`computeResources`](#compute_resources) block.
+* `imageType` - (Optional) The image type to match with the instance type to select an AMI. If the `imageIdOverride` parameter isn't specified, then a recent [Amazon ECS-optimized Amazon Linux 2 AMI](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/ecs-optimized_AMI.html#al2ami) (`ecsAl2`) is used.
+
+### launch_template
+
+`launchTemplate` supports the following:
+
+* `launchTemplateId` - (Optional) ID of the launch template. You must specify either the launch template ID or launch template name in the request, but not both.
+* `launchTemplateName` - (Optional) Name of the launch template.
+* `version` - (Optional) The version number of the launch template. Default: The default version of the launch template.
+
+### eks_configuration
+
+`eksConfiguration` supports the following:
+
+* `eksClusterArn` - (Required) The Amazon Resource Name (ARN) of the Amazon EKS cluster.
+* `kubernetesNamespace` - (Required) The namespace of the Amazon EKS cluster. AWS Batch manages pods in this namespace.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the compute environment.
+* `ecsClusterArn` - The Amazon Resource Name (ARN) of the underlying Amazon ECS cluster used by the compute environment.
+* `status` - The current status of the compute environment (for example, CREATING or VALID).
+* `statusReason` - A short, human-readable string to provide additional details about the current status of the compute environment.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AWS Batch compute using the `computeEnvironmentName`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import AWS Batch compute using the `computeEnvironmentName`. For example:
+
+```console
+% terraform import aws_batch_compute_environment.sample sample
+```
+
+[1]: http://docs.aws.amazon.com/batch/latest/userguide/what-is-batch.html
+[2]: http://docs.aws.amazon.com/batch/latest/userguide/compute_environments.html
+[3]: http://docs.aws.amazon.com/batch/latest/userguide/troubleshooting.html
+
+<!-- cache-key: cdktf-0.18.0 input-31fc6d6f638d73792d12848676f9c99338d2b0f1615c84b67aea80c0d2df44fc -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/batch_job_definition.html.markdown b/website/docs/cdktf/typescript/r/batch_job_definition.html.markdown
new file mode 100644
index 00000000000..0cc11902ba9
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/batch_job_definition.html.markdown
@@ -0,0 +1,221 @@
+---
+subcategory: "Batch"
+layout: "aws"
+page_title: "AWS: aws_batch_job_definition"
+description: |-
+  Provides a Batch Job Definition resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_batch_job_definition
+
+Provides a Batch Job Definition resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { BatchJobDefinition } from "./.gen/providers/aws/batch-job-definition";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new BatchJobDefinition(this, "test", {
+      containerProperties: Token.asString(
+        Fn.jsonencode({
+          command: ["ls", "-la"],
+          environment: [
+            {
+              name: "VARNAME",
+              value: "VARVAL",
+            },
+          ],
+          image: "busybox",
+          mountPoints: [
+            {
+              containerPath: "/tmp",
+              readOnly: false,
+              sourceVolume: "tmp",
+            },
+          ],
+          resourceRequirements: [
+            {
+              type: "VCPU",
+              value: "0.25",
+            },
+            {
+              type: "MEMORY",
+              value: "512",
+            },
+          ],
+          ulimits: [
+            {
+              hardLimit: 1024,
+              name: "nofile",
+              softLimit: 1024,
+            },
+          ],
+          volumes: [
+            {
+              host: {
+                sourcePath: "/tmp",
+              },
+              name: "tmp",
+            },
+          ],
+        })
+      ),
+      name: "tf_test_batch_job_definition",
+      type: "container",
+    });
+  }
+}
+
+```
+
+### Fargate Platform Capability
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, Fn, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { BatchJobDefinition } from "./.gen/providers/aws/batch-job-definition";
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+import { IamRolePolicyAttachment } from "./.gen/providers/aws/iam-role-policy-attachment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const assumeRolePolicy = new DataAwsIamPolicyDocument(
+      this,
+      "assume_role_policy",
+      {
+        statement: [
+          {
+            actions: ["sts:AssumeRole"],
+            principals: [
+              {
+                identifiers: ["ecs-tasks.amazonaws.com"],
+                type: "Service",
+              },
+            ],
+          },
+        ],
+      }
+    );
+    const ecsTaskExecutionRole = new IamRole(this, "ecs_task_execution_role", {
+      assumeRolePolicy: Token.asString(assumeRolePolicy.json),
+      name: "tf_test_batch_exec_role",
+    });
+    new IamRolePolicyAttachment(this, "ecs_task_execution_role_policy", {
+      policyArn:
+        "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy",
+      role: ecsTaskExecutionRole.name,
+    });
+    new BatchJobDefinition(this, "test", {
+      containerProperties: Token.asString(
+        Fn.jsonencode({
+          command: ["echo", "test"],
+          executionRoleArn: ecsTaskExecutionRole.arn,
+          fargatePlatformConfiguration: {
+            platformVersion: "LATEST",
+          },
+          image: "busybox",
+          jobRoleArn: "arn:aws:iam::123456789012:role/AWSBatchS3ReadOnly",
+          resourceRequirements: [
+            {
+              type: "VCPU",
+              value: "0.25",
+            },
+            {
+              type: "MEMORY",
+              value: "512",
+            },
+          ],
+        })
+      ),
+      name: "tf_test_batch_job_definition",
+      platformCapabilities: ["FARGATE"],
+      type: "container",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) Specifies the name of the job definition.
+* `type` - (Required) The type of job definition. Must be `container`.
+
+The following arguments are optional:
+
+* `containerProperties` - (Optional) A valid [container properties](http://docs.aws.amazon.com/batch/latest/APIReference/API_RegisterJobDefinition.html)
+    provided as a single valid JSON document. This parameter is required if the `type` parameter is `container`.
+* `parameters` - (Optional) Specifies the parameter substitution placeholders to set in the job definition.
+* `platformCapabilities` - (Optional) The platform capabilities required by the job definition. If no value is specified, it defaults to `ec2`. To run the job on Fargate resources, specify `fargate`.
+* `propagateTags` - (Optional) Specifies whether to propagate the tags from the job definition to the corresponding Amazon ECS task. Default is `false`.
+* `retryStrategy` - (Optional) Specifies the retry strategy to use for failed jobs that are submitted with this job definition.
+    Maximum number of `retryStrategy` is `1`.  Defined below.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `timeout` - (Optional) Specifies the timeout for jobs so that if a job runs longer, AWS Batch terminates the job. Maximum number of `timeout` is `1`. Defined below.
+
+### retry_strategy
+
+* `attempts` - (Optional) The number of times to move a job to the `runnable` status. You may specify between `1` and `10` attempts.
+* `evaluateOnExit` - (Optional) The [evaluate on exit](#evaluate_on_exit) conditions under which the job should be retried or failed. If this parameter is specified, then the `attempts` parameter must also be specified. You may specify up to 5 configuration blocks.
+
+#### evaluate_on_exit
+
+* `action` - (Required) Specifies the action to take if all of the specified conditions are met. The values are not case sensitive. Valid values: `retry`, `exit`.
+* `onExitCode` - (Optional) A glob pattern to match against the decimal representation of the exit code returned for a job.
+* `onReason` - (Optional) A glob pattern to match against the reason returned for a job.
+* `onStatusReason` - (Optional) A glob pattern to match against the status reason returned for a job.
+  
+### timeout
+
+* `attemptDurationSeconds` - (Optional) The time duration in seconds after which AWS Batch terminates your jobs if they have not finished. The minimum value for the timeout is `60` seconds.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name of the job definition.
+* `revision` - The revision of the job definition.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Batch Job Definition using the `arn`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Batch Job Definition using the `arn`. For example:
+
+```console
+% terraform import aws_batch_job_definition.test arn:aws:batch:us-east-1:123456789012:job-definition/sample
+```
+
+<!-- cache-key: cdktf-0.18.0 input-6ae285cb9efa6efba899233ae6cf160def3681423ed8aca3247f22377d9d046c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/batch_job_queue.html.markdown b/website/docs/cdktf/typescript/r/batch_job_queue.html.markdown
new file mode 100644
index 00000000000..7dbd2503660
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/batch_job_queue.html.markdown
@@ -0,0 +1,134 @@
+---
+subcategory: "Batch"
+layout: "aws"
+page_title: "AWS: aws_batch_job_queue"
+description: |-
+  Provides a Batch Job Queue resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_batch_job_queue
+
+Provides a Batch Job Queue resource.
+
+## Example Usage
+
+### Basic Job Queue
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { BatchJobQueue } from "./.gen/providers/aws/batch-job-queue";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new BatchJobQueue(this, "test_queue", {
+      computeEnvironments: [testEnvironment1.arn, testEnvironment2.arn],
+      name: "tf-test-batch-job-queue",
+      priority: 1,
+      state: "ENABLED",
+    });
+  }
+}
+
+```
+
+### Job Queue with a fair share scheduling policy
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { BatchJobQueue } from "./.gen/providers/aws/batch-job-queue";
+import { BatchSchedulingPolicy } from "./.gen/providers/aws/batch-scheduling-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new BatchSchedulingPolicy(this, "example", {
+      fairSharePolicy: {
+        computeReservation: 1,
+        shareDecaySeconds: 3600,
+        shareDistribution: [
+          {
+            shareIdentifier: "A1*",
+            weightFactor: 0.1,
+          },
+        ],
+      },
+      name: "example",
+    });
+    const awsBatchJobQueueExample = new BatchJobQueue(this, "example_1", {
+      computeEnvironments: [testEnvironment1.arn, testEnvironment2.arn],
+      name: "tf-test-batch-job-queue",
+      priority: 1,
+      schedulingPolicyArn: example.arn,
+      state: "ENABLED",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsBatchJobQueueExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) Specifies the name of the job queue.
+* `computeEnvironments` - (Required) List of compute environment ARNs mapped to a job queue.
+  The position of the compute environments in the list will dictate the order.
+* `priority` - (Required) The priority of the job queue. Job queues with a higher priority
+    are evaluated first when associated with the same compute environment.
+* `schedulingPolicyArn` - (Optional) The ARN of the fair share scheduling policy. If this parameter is specified, the job queue uses a fair share scheduling policy. If this parameter isn't specified, the job queue uses a first in, first out (FIFO) scheduling policy. After a job queue is created, you can replace but can't remove the fair share scheduling policy.
+* `state` - (Required) The state of the job queue. Must be one of: `enabled` or `disabled`
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name of the job queue.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `10M`)
+- `update` - (Default `10M`)
+- `delete` - (Default `10M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Batch Job Queue using the `arn`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Batch Job Queue using the `arn`. For example:
+
+```console
+% terraform import aws_batch_job_queue.test_queue arn:aws:batch:us-east-1:123456789012:job-queue/sample
+```
+
+<!-- cache-key: cdktf-0.18.0 input-11a6c4c8622e2192aee9e7e7cc4d490a2dcbd3674d74501dcd201fc0b34547ee -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/batch_scheduling_policy.html.markdown b/website/docs/cdktf/typescript/r/batch_scheduling_policy.html.markdown
new file mode 100644
index 00000000000..311e336919e
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/batch_scheduling_policy.html.markdown
@@ -0,0 +1,102 @@
+---
+subcategory: "Batch"
+layout: "aws"
+page_title: "AWS: aws_batch_scheduling_policy"
+description: |-
+  Provides a Batch Scheduling Policy resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_batch_scheduling_policy
+
+Provides a Batch Scheduling Policy resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { BatchSchedulingPolicy } from "./.gen/providers/aws/batch-scheduling-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new BatchSchedulingPolicy(this, "example", {
+      fairSharePolicy: {
+        computeReservation: 1,
+        shareDecaySeconds: 3600,
+        shareDistribution: [
+          {
+            shareIdentifier: "A1*",
+            weightFactor: 0.1,
+          },
+          {
+            shareIdentifier: "A2",
+            weightFactor: 0.2,
+          },
+        ],
+      },
+      name: "example",
+      tags: {
+        Name: "Example Batch Scheduling Policy",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `fairsharePolicy` - (Optional) A fairshare policy block specifies the `computeReservation`, `shareDelaySeconds`, and `shareDistribution` of the scheduling policy. The `fairsharePolicy` block is documented below.
+* `name` - (Required) Specifies the name of the scheduling policy.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+A `fairsharePolicy` block supports the following arguments:
+
+* `computeReservation` - (Optional) A value used to reserve some of the available maximum vCPU for fair share identifiers that have not yet been used. For more information, see [FairsharePolicy](https://docs.aws.amazon.com/batch/latest/APIReference/API_FairsharePolicy.html).
+* `shareDelaySeconds` - (Optional) The time period to use to calculate a fair share percentage for each fair share identifier in use, in seconds. For more information, see [FairsharePolicy](https://docs.aws.amazon.com/batch/latest/APIReference/API_FairsharePolicy.html).
+* `shareDistribution` - (Optional) One or more share distribution blocks which define the weights for the fair share identifiers for the fair share policy. For more information, see [FairsharePolicy](https://docs.aws.amazon.com/batch/latest/APIReference/API_FairsharePolicy.html). The `shareDistribution` block is documented below.
+
+A `shareDistribution` block supports the following arguments:
+
+* `shareIdentifier` - (Required) A fair share identifier or fair share identifier prefix. For more information, see [ShareAttributes](https://docs.aws.amazon.com/batch/latest/APIReference/API_ShareAttributes.html).
+* `weightFactor` - (Optional) The weight factor for the fair share identifier. For more information, see [ShareAttributes](https://docs.aws.amazon.com/batch/latest/APIReference/API_ShareAttributes.html).
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name of the scheduling policy.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Batch Scheduling Policy using the `arn`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Batch Scheduling Policy using the `arn`. For example:
+
+```console
+% terraform import aws_batch_scheduling_policy.test_policy arn:aws:batch:us-east-1:123456789012:scheduling-policy/sample
+```
+
+<!-- cache-key: cdktf-0.18.0 input-c7708019f2dc1954cf5d6a36c441a8ca9c516d4c4eb0c1825e47bb64113b9003 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/budgets_budget.html.markdown b/website/docs/cdktf/typescript/r/budgets_budget.html.markdown
new file mode 100644
index 00000000000..1b34d4ab2e2
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/budgets_budget.html.markdown
@@ -0,0 +1,427 @@
+---
+subcategory: "Web Services Budgets"
+layout: "aws"
+page_title: "AWS: aws_budgets_budget"
+description: |-
+  Provides a budgets budget resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_budgets_budget
+
+Provides a budgets budget resource. Budgets use the cost visualisation provided by Cost Explorer to show you the status of your budgets, to provide forecasts of your estimated costs, and to track your AWS usage, including your free tier usage.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { BudgetsBudget } from "./.gen/providers/aws/budgets-budget";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new BudgetsBudget(this, "ec2", {
+      budgetType: "COST",
+      costFilter: [
+        {
+          name: "Service",
+          values: ["Amazon Elastic Compute Cloud - Compute"],
+        },
+      ],
+      limitAmount: "1200",
+      limitUnit: "USD",
+      name: "budget-ec2-monthly",
+      notification: [
+        {
+          comparisonOperator: "GREATER_THAN",
+          notificationType: "FORECASTED",
+          subscriberEmailAddresses: ["test@example.com"],
+          threshold: 100,
+          thresholdType: "PERCENTAGE",
+        },
+      ],
+      timePeriodEnd: "2087-06-15_00:00",
+      timePeriodStart: "2017-07-01_00:00",
+      timeUnit: "MONTHLY",
+    });
+  }
+}
+
+```
+
+Create a budget for *$100*.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { BudgetsBudget } from "./.gen/providers/aws/budgets-budget";
+interface MyConfig {
+  timeUnit: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new BudgetsBudget(this, "cost", {
+      budgetType: "COST",
+      limitAmount: "100",
+      limitUnit: "USD",
+      timeUnit: config.timeUnit,
+    });
+  }
+}
+
+```
+
+Create a budget with planned budget limits.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { BudgetsBudget } from "./.gen/providers/aws/budgets-budget";
+interface MyConfig {
+  budgetType: any;
+  timeUnit: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new BudgetsBudget(this, "cost", {
+      plannedLimit: [
+        {
+          amount: "100",
+          startTime: "2017-07-01_00:00",
+          unit: "USD",
+        },
+        {
+          amount: "200",
+          startTime: "2017-08-01_00:00",
+          unit: "USD",
+        },
+      ],
+      budgetType: config.budgetType,
+      timeUnit: config.timeUnit,
+    });
+  }
+}
+
+```
+
+Create a budget for s3 with a limit of *3 GB* of storage.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { BudgetsBudget } from "./.gen/providers/aws/budgets-budget";
+interface MyConfig {
+  timeUnit: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new BudgetsBudget(this, "s3", {
+      budgetType: "USAGE",
+      limitAmount: "3",
+      limitUnit: "GB",
+      timeUnit: config.timeUnit,
+    });
+  }
+}
+
+```
+
+Create a Savings Plan Utilization Budget
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { BudgetsBudget } from "./.gen/providers/aws/budgets-budget";
+interface MyConfig {
+  timeUnit: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new BudgetsBudget(this, "savings_plan_utilization", {
+      budgetType: "SAVINGS_PLANS_UTILIZATION",
+      costTypes: {
+        includeCredit: false,
+        includeDiscount: false,
+        includeOtherSubscription: false,
+        includeRecurring: false,
+        includeRefund: false,
+        includeSubscription: true,
+        includeSupport: false,
+        includeTax: false,
+        includeUpfront: false,
+        useBlended: false,
+      },
+      limitAmount: "100.0",
+      limitUnit: "PERCENTAGE",
+      timeUnit: config.timeUnit,
+    });
+  }
+}
+
+```
+
+Create a RI Utilization Budget
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { BudgetsBudget } from "./.gen/providers/aws/budgets-budget";
+interface MyConfig {
+  timeUnit: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new BudgetsBudget(this, "ri_utilization", {
+      budgetType: "RI_UTILIZATION",
+      costFilter: [
+        {
+          name: "Service",
+          values: ["Amazon Relational Database Service"],
+        },
+      ],
+      costTypes: {
+        includeCredit: false,
+        includeDiscount: false,
+        includeOtherSubscription: false,
+        includeRecurring: false,
+        includeRefund: false,
+        includeSubscription: true,
+        includeSupport: false,
+        includeTax: false,
+        includeUpfront: false,
+        useBlended: false,
+      },
+      limitAmount: "100.0",
+      limitUnit: "PERCENTAGE",
+      timeUnit: config.timeUnit,
+    });
+  }
+}
+
+```
+
+Create a Cost Filter using Resource Tags
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { BudgetsBudget } from "./.gen/providers/aws/budgets-budget";
+interface MyConfig {
+  budgetType: any;
+  timeUnit: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new BudgetsBudget(this, "cost", {
+      costFilter: [
+        {
+          name: "TagKeyValue",
+          values: ["TagKey$TagValue"],
+        },
+      ],
+      budgetType: config.budgetType,
+      timeUnit: config.timeUnit,
+    });
+  }
+}
+
+```
+
+Create a cost_filter using resource tags, obtaining the tag value from a terraform variable
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { BudgetsBudget } from "./.gen/providers/aws/budgets-budget";
+interface MyConfig {
+  budgetType: any;
+  timeUnit: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new BudgetsBudget(this, "cost", {
+      costFilter: [
+        {
+          name: "TagKeyValue",
+          values: ["TagKey$${var.TagValue}"],
+        },
+      ],
+      budgetType: config.budgetType,
+      timeUnit: config.timeUnit,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+For more detailed documentation about each argument, refer to the [AWS official
+documentation](http://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/data-type-budget.html).
+
+This argument supports the following arguments:
+
+* `accountId` - (Optional) The ID of the target account for budget. Will use current user's account_id by default if omitted.
+* `autoAdjustData` - (Optional) Object containing [AutoAdjustData] which determines the budget amount for an auto-adjusting budget.
+* `name` - (Optional) The name of a budget. Unique within accounts.
+* `namePrefix` - (Optional) The prefix of the name of a budget. Unique within accounts.
+* `budgetType` - (Required) Whether this budget tracks monetary cost or usage.
+* `costFilter` - (Optional) A list of [CostFilter](#cost-filter) name/values pair to apply to budget.
+* `costTypes` - (Optional) Object containing [CostTypes](#cost-types) The types of cost included in a budget, such as tax and subscriptions.
+* `limitAmount` - (Required) The amount of cost or usage being measured for a budget.
+* `limitUnit` - (Required) The unit of measurement used for the budget forecast, actual spend, or budget threshold, such as dollars or GB. See [Spend](http://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/data-type-spend.html) documentation.
+* `timePeriodEnd` - (Optional) The end of the time period covered by the budget. There are no restrictions on the end date. Format: `2017010112:00`.
+* `timePeriodStart` - (Optional) The start of the time period covered by the budget. If you don't specify a start date, AWS defaults to the start of your chosen time period. The start date must come before the end date. Format: `2017010112:00`.
+* `timeUnit` - (Required) The length of time until a budget resets the actual and forecasted spend. Valid values: `monthly`, `quarterly`, `annually`, and `daily`.
+* `notification` - (Optional) Object containing [Budget Notifications](#budget-notification). Can be used multiple times to define more than one budget notification.
+* `plannedLimit` - (Optional) Object containing [Planned Budget Limits](#planned-budget-limits). Can be used multiple times to plan more than one budget limit. See [PlannedBudgetLimits](https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_budgets_Budget.html#awscostmanagement-Type-budgets_Budget-PlannedBudgetLimits) documentation.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - id of resource.
+* `arn` - The ARN of the budget.
+
+### Auto Adjust Data
+
+The parameters that determine the budget amount for an auto-adjusting budget.
+
+`autoAdjustType` (Required) - The string that defines whether your budget auto-adjusts based on historical or forecasted data. Valid values: `forecast`,`historical`
+`historicalOptions` (Optional) - Configuration block of [Historical Options](#historical-options). Required for `autoAdjustType` of `historical` Configuration block that defines the historical data that your auto-adjusting budget is based on.
+`lastAutoAdjustTime` (Optional) - The last time that your budget was auto-adjusted.
+
+### Historical Options
+
+`budgetAdjustmentPeriod` (Required) - The number of budget periods included in the moving-average calculation that determines your auto-adjusted budget amount.
+`lookbackAvailablePeriods` (Optional) - The integer that describes how many budget periods in your BudgetAdjustmentPeriod are included in the calculation of your current budget limit. If the first budget period in your BudgetAdjustmentPeriod has no cost data, then that budget period isn’t included in the average that determines your budget limit. You can’t set your own LookBackAvailablePeriods. The value is automatically calculated from the `budgetAdjustmentPeriod` and your historical cost data.
+
+### Cost Types
+
+Valid keys for `costTypes` parameter.
+
+* `includeCredit` - A boolean value whether to include credits in the cost budget. Defaults to `true`
+* `includeDiscount` - Whether a budget includes discounts. Defaults to `true`
+* `includeOtherSubscription` - A boolean value whether to include other subscription costs in the cost budget. Defaults to `true`
+* `includeRecurring` - A boolean value whether to include recurring costs in the cost budget. Defaults to `true`
+* `includeRefund` - A boolean value whether to include refunds in the cost budget. Defaults to `true`
+* `includeSubscription` - A boolean value whether to include subscriptions in the cost budget. Defaults to `true`
+* `includeSupport` - A boolean value whether to include support costs in the cost budget. Defaults to `true`
+* `includeTax` - A boolean value whether to include tax in the cost budget. Defaults to `true`
+* `includeUpfront` - A boolean value whether to include upfront costs in the cost budget. Defaults to `true`
+* `useAmortized` - Whether a budget uses the amortized rate. Defaults to `false`
+* `useBlended` - A boolean value whether to use blended costs in the cost budget. Defaults to `false`
+
+Refer to [AWS CostTypes documentation](https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_budgets_CostTypes.html) for further detail.
+
+### Cost Filter
+
+Based on your choice of budget type, you can choose one or more of the available budget filters.
+
+* `purchaseType`
+* `usageTypeGroup`
+* `service`
+* `operation`
+* `usageType`
+* `billingEntity`
+* `costCategory`
+* `linkedAccount`
+* `tagKeyValue`
+* `legalEntityName`
+* `invoicingEntity`
+* `az`
+* `region`
+* `instanceType`
+
+Refer to [AWS CostFilter documentation](https://docs.aws.amazon.com/cost-management/latest/userguide/budgets-create-filters.html) for further detail.
+
+### Budget Notification
+
+Valid keys for `notification` parameter.
+
+* `comparisonOperator` - (Required) Comparison operator to use to evaluate the condition. Can be `lessThan`, `equalTo` or `greaterThan`.
+* `threshold` - (Required) Threshold when the notification should be sent.
+* `thresholdType` - (Required) What kind of threshold is defined. Can be `percentage` OR `absoluteValue`.
+* `notificationType` - (Required) What kind of budget value to notify on. Can be `actual` or `forecasted`
+* `subscriberEmailAddresses` - (Optional) E-Mail addresses to notify. Either this or `subscriberSnsTopicArns` is required.
+* `subscriberSnsTopicArns` - (Optional) SNS topics to notify. Either this or `subscriberEmailAddresses` is required.
+
+### Planned Budget Limits
+
+Valid keys for `plannedLimit` parameter.
+
+* `startTime` - (Required) The start time of the budget limit. Format: `2017010112:00`. See [PlannedBudgetLimits](https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_budgets_Budget.html#awscostmanagement-Type-budgets_Budget-PlannedBudgetLimits) documentation.
+* `amount` - (Required) The amount of cost or usage being measured for a budget.
+* `unit` - (Required) The unit of measurement used for the budget forecast, actual spend, or budget threshold, such as dollars or GB. See [Spend](http://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/data-type-spend.html) documentation.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import budgets using `accountId:actionId:budgetName`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import budgets using `accountId:actionId:budgetName`. For example:
+
+```console
+% terraform import aws_budgets_budget.myBudget 123456789012:myBudget
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1e489919affafec652fb181d887cfb745c4899bec31c5aef82fa0e7dc17bde94 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/budgets_budget_action.html.markdown b/website/docs/cdktf/typescript/r/budgets_budget_action.html.markdown
new file mode 100644
index 00000000000..12bbd1a64af
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/budgets_budget_action.html.markdown
@@ -0,0 +1,205 @@
+---
+subcategory: "Web Services Budgets"
+layout: "aws"
+page_title: "AWS: aws_budgets_budget_action"
+description: |-
+  Provides a budget action resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_budgets_budget_action
+
+Provides a budget action resource. Budget actions are cost savings controls that run either automatically on your behalf or by using a workflow approval process.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { BudgetsBudget } from "./.gen/providers/aws/budgets-budget";
+import { BudgetsBudgetAction } from "./.gen/providers/aws/budgets-budget-action";
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { DataAwsPartition } from "./.gen/providers/aws/data-aws-partition";
+import { IamPolicy } from "./.gen/providers/aws/iam-policy";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new BudgetsBudget(this, "example", {
+      budgetType: "USAGE",
+      limitAmount: "10.0",
+      limitUnit: "dollars",
+      name: "example",
+      timePeriodStart: "2006-01-02_15:04",
+      timeUnit: "MONTHLY",
+    });
+    const dataAwsIamPolicyDocumentExample = new DataAwsIamPolicyDocument(
+      this,
+      "example_1",
+      {
+        statement: [
+          {
+            actions: ["ec2:Describe*"],
+            effect: "Allow",
+            resources: ["*"],
+          },
+        ],
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsIamPolicyDocumentExample.overrideLogicalId("example");
+    const current = new DataAwsPartition(this, "current", {});
+    const awsIamPolicyExample = new IamPolicy(this, "example_3", {
+      description: "My example policy",
+      name: "example",
+      policy: Token.asString(dataAwsIamPolicyDocumentExample.json),
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamPolicyExample.overrideLogicalId("example");
+    const assumeRole = new DataAwsIamPolicyDocument(this, "assume_role", {
+      statement: [
+        {
+          actions: ["sts:AssumeRole"],
+          effect: "Allow",
+          principals: [
+            {
+              identifiers: ["budgets.${" + current.dnsSuffix + "}"],
+              type: "Service",
+            },
+          ],
+        },
+      ],
+    });
+    const awsIamRoleExample = new IamRole(this, "example_5", {
+      assumeRolePolicy: Token.asString(assumeRole.json),
+      name: "example",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamRoleExample.overrideLogicalId("example");
+    const awsBudgetsBudgetActionExample = new BudgetsBudgetAction(
+      this,
+      "example_6",
+      {
+        actionThreshold: {
+          actionThresholdType: "ABSOLUTE_VALUE",
+          actionThresholdValue: 100,
+        },
+        actionType: "APPLY_IAM_POLICY",
+        approvalModel: "AUTOMATIC",
+        budgetName: example.name,
+        definition: {
+          iamActionDefinition: {
+            policyArn: Token.asString(awsIamPolicyExample.arn),
+            roles: [Token.asString(awsIamRoleExample.name)],
+          },
+        },
+        executionRoleArn: Token.asString(awsIamRoleExample.arn),
+        notificationType: "ACTUAL",
+        subscriber: [
+          {
+            address: "example@example.example",
+            subscriptionType: "EMAIL",
+          },
+        ],
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsBudgetsBudgetActionExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `accountId` - (Optional) The ID of the target account for budget. Will use current user's account_id by default if omitted.
+* `budgetName` - (Required) The name of a budget.
+* `actionThreshold` - (Required) The trigger threshold of the action. See [Action Threshold](#action-threshold).
+* `actionType` - (Required) The type of action. This defines the type of tasks that can be carried out by this action. This field also determines the format for definition. Valid values are `applyIamPolicy`, `applyScpPolicy`, and `runSsmDocuments`.
+* `approvalModel` - (Required) This specifies if the action needs manual or automatic approval. Valid values are `automatic` and `manual`.
+* `definition` - (Required) Specifies all of the type-specific parameters. See [Definition](#definition).
+* `executionRoleArn` - (Required) The role passed for action execution and reversion. Roles and actions must be in the same account.
+* `notificationType` - (Required) The type of a notification. Valid values are `actual` or `forecasted`.
+* `subscriber` - (Required) A list of subscribers. See [Subscriber](#subscriber).
+
+### Action Threshold
+
+* `actionThresholdType` - (Required) The type of threshold for a notification. Valid values are `percentage` or `absoluteValue`.
+* `actionThresholdValue` - (Required) The threshold of a notification.
+
+### Subscriber
+
+* `address` - (Required) The address that AWS sends budget notifications to, either an SNS topic or an email.
+* `subscriptionType` - (Required) The type of notification that AWS sends to a subscriber. Valid values are `sns` or `email`.
+
+### Definition
+
+* `iamActionDefinition` - (Optional) The AWS Identity and Access Management (IAM) action definition details. See [IAM Action Definition](#iam-action-definition).
+* `ssmActionDefinition` - (Optional) The AWS Systems Manager (SSM) action definition details. See [SSM Action Definition](#ssm-action-definition).
+* `scpActionDefinition` - (Optional) The service control policies (SCPs) action definition details. See [SCP Action Definition](#scp-action-definition).
+
+#### IAM Action Definition
+
+* `policyArn` - (Required) The Amazon Resource Name (ARN) of the policy to be attached.
+* `groups` - (Optional) A list of groups to be attached. There must be at least one group.
+* `roles` - (Optional) A list of roles to be attached. There must be at least one role.
+* `users` - (Optional) A list of users to be attached. There must be at least one user.
+
+#### SCP Action Definition
+
+* `policyId` - (Required) The policy ID attached.
+* `targetIds` - (Optional) A list of target IDs.
+
+#### SSM Action Definition
+
+* `actionSubType` - (Required) The action subType. Valid values are `stopEc2Instances` or `stopRdsInstances`.
+* `instanceIds` - (Required) The EC2 and RDS instance IDs.
+* `region` - (Required) The Region to run the SSM document.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `actionId` - The id of the budget action.
+* `id` - ID of resource.
+* `arn` - The ARN of the budget action.
+* `status` - The status of the budget action.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `5M`)
+* `update` - (Default `5M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import budget actions using `accountId:actionId:budgetName`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import budget actions using `accountId:actionId:budgetName`. For example:
+
+```console
+% terraform import aws_budgets_budget_action.myBudget 123456789012:some-id:myBudget
+```
+
+<!-- cache-key: cdktf-0.18.0 input-a8daba74b839303b60ec0ca7332cc6e8fa6dbb5c1bd3883e6e008d98d91f359b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ce_anomaly_monitor.html.markdown b/website/docs/cdktf/typescript/r/ce_anomaly_monitor.html.markdown
new file mode 100644
index 00000000000..3fdb5b1bacf
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/ce_anomaly_monitor.html.markdown
@@ -0,0 +1,120 @@
+---
+subcategory: "CE (Cost Explorer)"
+layout: "aws"
+page_title: "AWS: aws_ce_anomaly_monitor"
+description: |-
+  Provides a CE Cost Anomaly Monitor
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ce_anomaly_monitor
+
+Provides a CE Anomaly Monitor.
+
+## Example Usage
+
+There are two main types of a Cost Anomaly Monitor: `dimensional` and `custom`.
+
+### Dimensional Example
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CeAnomalyMonitor } from "./.gen/providers/aws/ce-anomaly-monitor";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new CeAnomalyMonitor(this, "service_monitor", {
+      monitorDimension: "SERVICE",
+      monitorType: "DIMENSIONAL",
+      name: "AWSServiceMonitor",
+    });
+  }
+}
+
+```
+
+### Custom Example
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CeAnomalyMonitor } from "./.gen/providers/aws/ce-anomaly-monitor";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new CeAnomalyMonitor(this, "test", {
+      monitorSpecification: Token.asString(
+        Fn.jsonencode({
+          And: "null",
+          CostCategories: "null",
+          Dimensions: "null",
+          Not: "null",
+          Or: "null",
+          Tags: {
+            Key: "CostCenter",
+            MatchOptions: "null",
+            Values: ["10000"],
+          },
+        })
+      ),
+      monitorType: "CUSTOM",
+      name: "AWSCustomAnomalyMonitor",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) The name of the monitor.
+* `monitorType` - (Required) The possible type values. Valid values: `dimensional` | `custom`.
+* `monitorDimension` - (Required, if `monitorType` is `dimensional`) The dimensions to evaluate. Valid values: `service`.
+* `monitorSpecification` - (Required, if `monitorType` is `custom`) A valid JSON representation for the [Expression](https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_Expression.html) object.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the anomaly monitor.
+* `id` - Unique ID of the anomaly monitor. Same as `arn`.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsCeAnomalyMonitor` using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsCeAnomalyMonitor` using the `id`. For example:
+
+```console
+% terraform import aws_ce_anomaly_monitor.example costAnomalyMonitorARN
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1578f36961ed88a11a17f0c1c8745d16387472eae9e80de6c376da2f0ebcc68e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ce_anomaly_subscription.html.markdown b/website/docs/cdktf/typescript/r/ce_anomaly_subscription.html.markdown
new file mode 100644
index 00000000000..19857b101cc
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/ce_anomaly_subscription.html.markdown
@@ -0,0 +1,317 @@
+---
+subcategory: "CE (Cost Explorer)"
+layout: "aws"
+page_title: "AWS: aws_ce_anomaly_subscription"
+description: |-
+  Provides a CE Cost Anomaly Subscription
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ce_anomaly_subscription
+
+Provides a CE Anomaly Subscription.
+
+## Example Usage
+
+### Basic Example
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CeAnomalyMonitor } from "./.gen/providers/aws/ce-anomaly-monitor";
+import { CeAnomalySubscription } from "./.gen/providers/aws/ce-anomaly-subscription";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const test = new CeAnomalyMonitor(this, "test", {
+      monitorDimension: "SERVICE",
+      monitorType: "DIMENSIONAL",
+      name: "AWSServiceMonitor",
+    });
+    const awsCeAnomalySubscriptionTest = new CeAnomalySubscription(
+      this,
+      "test_1",
+      {
+        frequency: "DAILY",
+        monitorArnList: [test.arn],
+        name: "DAILYSUBSCRIPTION",
+        subscriber: [
+          {
+            address: "abc@example.com",
+            type: "EMAIL",
+          },
+        ],
+        threshold: 100,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsCeAnomalySubscriptionTest.overrideLogicalId("test");
+  }
+}
+
+```
+
+### Threshold Expression Example
+
+#### For a Specific Dimension
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CeAnomalySubscription } from "./.gen/providers/aws/ce-anomaly-subscription";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new CeAnomalySubscription(this, "test", {
+      frequency: "DAILY",
+      monitorArnList: [Token.asString(awsCeAnomalyMonitorTest.arn)],
+      name: "AWSServiceMonitor",
+      subscriber: [
+        {
+          address: "abc@example.com",
+          type: "EMAIL",
+        },
+      ],
+      thresholdExpression: {
+        dimension: {
+          key: "ANOMALY_TOTAL_IMPACT_ABSOLUTE",
+          matchOptions: ["GREATER_THAN_OR_EQUAL"],
+          values: ["100.0"],
+        },
+      },
+    });
+  }
+}
+
+```
+
+#### Using an `and` Expression
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CeAnomalySubscription } from "./.gen/providers/aws/ce-anomaly-subscription";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new CeAnomalySubscription(this, "test", {
+      frequency: "DAILY",
+      monitorArnList: [Token.asString(awsCeAnomalyMonitorTest.arn)],
+      name: "AWSServiceMonitor",
+      subscriber: [
+        {
+          address: "abc@example.com",
+          type: "EMAIL",
+        },
+      ],
+      thresholdExpression: {
+        and: [
+          {
+            dimension: {
+              key: "ANOMALY_TOTAL_IMPACT_ABSOLUTE",
+              matchOptions: ["GREATER_THAN_OR_EQUAL"],
+              values: ["100"],
+            },
+          },
+          {
+            dimension: {
+              key: "ANOMALY_TOTAL_IMPACT_PERCENTAGE",
+              matchOptions: ["GREATER_THAN_OR_EQUAL"],
+              values: ["50"],
+            },
+          },
+        ],
+      },
+    });
+  }
+}
+
+```
+
+### SNS Example
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CeAnomalyMonitor } from "./.gen/providers/aws/ce-anomaly-monitor";
+import { CeAnomalySubscription } from "./.gen/providers/aws/ce-anomaly-subscription";
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { SnsTopic } from "./.gen/providers/aws/sns-topic";
+import { SnsTopicPolicy } from "./.gen/providers/aws/sns-topic-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const anomalyMonitor = new CeAnomalyMonitor(this, "anomaly_monitor", {
+      monitorDimension: "SERVICE",
+      monitorType: "DIMENSIONAL",
+      name: "AWSServiceMonitor",
+    });
+    const costAnomalyUpdates = new SnsTopic(this, "cost_anomaly_updates", {
+      name: "CostAnomalyUpdates",
+    });
+    const snsTopicPolicy = new DataAwsIamPolicyDocument(
+      this,
+      "sns_topic_policy",
+      {
+        policyId: "__default_policy_ID",
+        statement: [
+          {
+            actions: ["SNS:Publish"],
+            effect: "Allow",
+            principals: [
+              {
+                identifiers: ["costalerts.amazonaws.com"],
+                type: "Service",
+              },
+            ],
+            resources: [costAnomalyUpdates.arn],
+            sid: "AWSAnomalyDetectionSNSPublishingPermissions",
+          },
+          {
+            actions: [
+              "SNS:Subscribe",
+              "SNS:SetTopicAttributes",
+              "SNS:RemovePermission",
+              "SNS:Receive",
+              "SNS:Publish",
+              "SNS:ListSubscriptionsByTopic",
+              "SNS:GetTopicAttributes",
+              "SNS:DeleteTopic",
+              "SNS:AddPermission",
+            ],
+            condition: [
+              {
+                test: "StringEquals",
+                values: [accountId.stringValue],
+                variable: "AWS:SourceOwner",
+              },
+            ],
+            effect: "Allow",
+            principals: [
+              {
+                identifiers: ["*"],
+                type: "AWS",
+              },
+            ],
+            resources: [costAnomalyUpdates.arn],
+            sid: "__default_statement_ID",
+          },
+        ],
+      }
+    );
+    const defaultVar = new SnsTopicPolicy(this, "default", {
+      arn: costAnomalyUpdates.arn,
+      policy: Token.asString(snsTopicPolicy.json),
+    });
+    new CeAnomalySubscription(this, "realtime_subscription", {
+      dependsOn: [defaultVar],
+      frequency: "IMMEDIATE",
+      monitorArnList: [anomalyMonitor.arn],
+      name: "RealtimeAnomalySubscription",
+      subscriber: [
+        {
+          address: costAnomalyUpdates.arn,
+          type: "SNS",
+        },
+      ],
+      threshold: 0,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `accountId` - (Optional) The unique identifier for the AWS account in which the anomaly subscription ought to be created.
+* `frequency` - (Required) The frequency that anomaly reports are sent. Valid Values: `daily` | `immediate` | `weekly`.
+* `monitorArnList` - (Required) A list of cost anomaly monitors.
+* `name` - (Required) The name for the subscription.
+* `subscriber` - (Required) A subscriber configuration. Multiple subscribers can be defined.
+    * `type` - (Required) The type of subscription. Valid Values: `sns` | `email`.
+    * `address` - (Required) The address of the subscriber. If type is `sns`, this will be the arn of the sns topic. If type is `email`, this will be the destination email address.
+* `threshold` - (Optional) The dollar value that triggers a notification if the threshold is exceeded. Depracated, use `thresholdExpression` instead.
+* `thresholdExpression` - (Optional) An Expression object used to specify the anomalies that you want to generate alerts for. See [Threshold Expression](#threshold-expression).
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Threshold Expression
+
+* `and` - (Optional) Return results that match both [Dimension](#dimension) objects.
+* `costCategory` - (Optional) Configuration block for the filter that's based on  values. See [Cost Category](#cost-category) below.
+* `dimension` - (Optional) Configuration block for the specific [Dimension](#dimension) to use for.
+* `not` - (Optional) Return results that match both [Dimension](#dimension) object.
+* `or` - (Optional) Return results that match both [Dimension](#dimension) object.
+* `tags` - (Optional) Configuration block for the specific Tag to use for. See [Tags](#tags) below.
+
+### Cost Category
+
+* `key` - (Optional) Unique name of the Cost Category.
+* `matchOptions` - (Optional) Match options that you can use to filter your results. MatchOptions is only applicable for actions related to cost category. The default values for MatchOptions is `equals` and `caseSensitive`. Valid values are: `equals`,  `absent`, `startsWith`, `endsWith`, `contains`, `caseSensitive`, `caseInsensitive`.
+* `values` - (Optional) Specific value of the Cost Category.
+
+### Dimension
+
+* `key` - (Optional) Unique name of the Cost Category.
+* `matchOptions` - (Optional) Match options that you can use to filter your results. MatchOptions is only applicable for actions related to cost category. The default values for MatchOptions is `equals` and `caseSensitive`. Valid values are: `equals`,  `absent`, `startsWith`, `endsWith`, `contains`, `caseSensitive`, `caseInsensitive`.
+* `values` - (Optional) Specific value of the Cost Category.
+
+### Tags
+
+* `key` - (Optional) Key for the tag.
+* `matchOptions` - (Optional) Match options that you can use to filter your results. MatchOptions is only applicable for actions related to cost category. The default values for MatchOptions is `equals` and `caseSensitive`. Valid values are: `equals`,  `absent`, `startsWith`, `endsWith`, `contains`, `caseSensitive`, `caseInsensitive`.
+* `values` - (Optional) Specific value of the Cost Category.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the anomaly subscription.
+* `id` - Unique ID of the anomaly subscription. Same as `arn`.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsCeAnomalySubscription` using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsCeAnomalySubscription` using the `id`. For example:
+
+```console
+% terraform import aws_ce_anomaly_subscription.example AnomalySubscriptionARN
+```
+
+<!-- cache-key: cdktf-0.18.0 input-8e7a0801298f69044c659554617a5baf1372b080e7b8c8feed89f9dfbbaac302 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ce_cost_allocation_tag.html.markdown b/website/docs/cdktf/typescript/r/ce_cost_allocation_tag.html.markdown
new file mode 100644
index 00000000000..ff48b387f7c
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/ce_cost_allocation_tag.html.markdown
@@ -0,0 +1,74 @@
+---
+subcategory: "CE (Cost Explorer)"
+layout: "aws"
+page_title: "AWS: aws_ce_cost_allocation_tag"
+description: |-
+  Provides a CE Cost Allocation Tag
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ce_cost_allocation_tag
+
+Provides a CE Cost Allocation Tag.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CeCostAllocationTag } from "./.gen/providers/aws/ce-cost-allocation-tag";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new CeCostAllocationTag(this, "example", {
+      status: "Active",
+      tagKey: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `tagKey` - (Required) The key for the cost allocation tag.
+* `status` - (Required) The status of a cost allocation tag. Valid values are `active` and `inactive`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The key for the cost allocation tag.
+* `type` - The type of cost allocation tag.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsCeCostAllocationTag` using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsCeCostAllocationTag` using the `id`. For example:
+
+```console
+% terraform import aws_ce_cost_allocation_tag.example key
+```
+
+<!-- cache-key: cdktf-0.18.0 input-544cfa0670b83ddbc9c2d5d5bbdf2b0ec54ea059c22ab29b2f86b8890060e8a5 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ce_cost_category.html.markdown b/website/docs/cdktf/typescript/r/ce_cost_category.html.markdown
new file mode 100644
index 00000000000..660dfd3230c
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/ce_cost_category.html.markdown
@@ -0,0 +1,167 @@
+---
+subcategory: "CE (Cost Explorer)"
+layout: "aws"
+page_title: "AWS: aws_ce_cost_category"
+description: |-
+  Provides a CE Cost Category Definition
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ce_cost_category
+
+Provides a CE Cost Category.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CeCostCategory } from "./.gen/providers/aws/ce-cost-category";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new CeCostCategory(this, "test", {
+      name: "NAME",
+      rule: [
+        {
+          rule: {
+            dimension: {
+              key: "LINKED_ACCOUNT_NAME",
+              matchOptions: ["ENDS_WITH"],
+              values: ["-prod"],
+            },
+          },
+          value: "production",
+        },
+        {
+          rule: {
+            dimension: {
+              key: "LINKED_ACCOUNT_NAME",
+              matchOptions: ["ENDS_WITH"],
+              values: ["-stg"],
+            },
+          },
+          value: "staging",
+        },
+        {
+          rule: {
+            dimension: {
+              key: "LINKED_ACCOUNT_NAME",
+              matchOptions: ["ENDS_WITH"],
+              values: ["-dev"],
+            },
+          },
+          value: "testing",
+        },
+      ],
+      ruleVersion: "CostCategoryExpression.v1",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) Unique name for the Cost Category.
+* `rule` - (Required) Configuration block for the Cost Category rules used to categorize costs. See below.
+* `ruleVersion` - (Required) Rule schema version in this particular Cost Category.
+* `effectiveStart`- (Optional)  The Cost Category's effective start date. It can only be a billing start date (first day of the month). If the date isn't provided, it's the first day of the current month. Dates can't be before the previous twelve months, or in the future. For example `20221101T00:00:00Z`.
+
+The following arguments are optional:
+
+* `defaultValue` - (Optional) Default value for the cost category.
+* `splitChargeRule` - (Optional) Configuration block for the split charge rules used to allocate your charges between your Cost Category values. See below.
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### `rule`
+
+* `inheritedValue` - (Optional) Configuration block for the value the line item is categorized as if the line item contains the matched dimension. See below.
+* `rule` - (Optional) Configuration block for the `expression` object used to categorize costs. See below.
+* `type` - (Optional) You can define the CostCategoryRule rule type as either `regular` or `inheritedValue`.
+* `value` - (Optional) Default value for the cost category.
+
+### `inheritedValue`
+
+* `dimensionKey` - (Optional) Key to extract cost category values.
+* `dimensionName` - (Optional) Name of the dimension that's used to group costs. If you specify `linkedAccountName`, the cost category value is based on account name. If you specify `tag`, the cost category value will be based on the value of the specified tag key. Valid values are `linkedAccountName`, `tag`
+
+### `rule`
+
+* `and` - (Optional) Return results that match both `dimension` objects.
+* `costCategory` - (Optional) Configuration block for the filter that's based on `costCategory` values. See below.
+* `dimension` - (Optional) Configuration block for the specific `dimension` to use for `expression`. See below.
+* `not` - (Optional) Return results that match both `dimension` object.
+* `or` - (Optional) Return results that match both `dimension` object.
+* `tags` - (Optional) Configuration block for the specific `tag` to use for `expression`. See below.
+
+### `costCategory`
+
+* `key` - (Optional) Unique name of the Cost Category.
+* `matchOptions` - (Optional) Match options that you can use to filter your results. MatchOptions is only applicable for actions related to cost category. The default values for MatchOptions is `equals` and `caseSensitive`. Valid values are: `equals`,  `absent`, `startsWith`, `endsWith`, `contains`, `caseSensitive`, `caseInsensitive`.
+* `values` - (Optional) Specific value of the Cost Category.
+
+### `dimension`
+
+* `key` - (Optional) Unique name of the Cost Category.
+* `matchOptions` - (Optional) Match options that you can use to filter your results. MatchOptions is only applicable for actions related to cost category. The default values for MatchOptions is `equals` and `caseSensitive`. Valid values are: `equals`,  `absent`, `startsWith`, `endsWith`, `contains`, `caseSensitive`, `caseInsensitive`.
+* `values` - (Optional) Specific value of the Cost Category.
+
+### `tags`
+
+* `key` - (Optional) Key for the tag.
+* `matchOptions` - (Optional) Match options that you can use to filter your results. MatchOptions is only applicable for actions related to cost category. The default values for MatchOptions is `equals` and `caseSensitive`. Valid values are: `equals`,  `absent`, `startsWith`, `endsWith`, `contains`, `caseSensitive`, `caseInsensitive`.
+* `values` - (Optional) Specific value of the Cost Category.
+
+### `splitChargeRule`
+
+* `method` - (Required) Method that's used to define how to split your source costs across your targets. Valid values are `fixed`, `proportional`, `even`
+* `parameter` - (Optional) Configuration block for the parameters for a split charge method. This is only required for the `fixed` method. See below.
+* `source` - (Required) Cost Category value that you want to split.
+* `targets` - (Required) Cost Category values that you want to split costs across. These values can't be used as a source in other split charge rules.
+
+### `parameter`
+
+* `type` - (Optional) Parameter type.
+* `values` - (Optional) Parameter values.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the cost category.
+* `effectiveEnd` - Effective end data of your Cost Category.
+* `id` - Unique ID of the cost category.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsCeCostCategory` using the id. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsCeCostCategory` using the id. For example:
+
+```console
+% terraform import aws_ce_cost_category.example costCategoryARN
+```
+
+<!-- cache-key: cdktf-0.18.0 input-6d32509d874b0d724dcb62ee9ca6ed83a7cb80815f66336ea0a19f4b9bd60e60 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/chime_voice_connector.html.markdown b/website/docs/cdktf/typescript/r/chime_voice_connector.html.markdown
new file mode 100644
index 00000000000..a5677edd3e6
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/chime_voice_connector.html.markdown
@@ -0,0 +1,81 @@
+---
+subcategory: "Chime"
+layout: "aws"
+page_title: "AWS: aws_chime_voice_connector"
+description: |-
+  Enables you to connect your phone system to the telephone network at a substantial cost savings by using SIP trunking.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_chime_voice_connector
+
+Enables you to connect your phone system to the telephone network at a substantial cost savings by using SIP trunking.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ChimeVoiceConnector } from "./.gen/providers/aws/chime-voice-connector";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ChimeVoiceConnector(this, "test", {
+      awsRegion: "us-east-1",
+      name: "connector-test-1",
+      requireEncryption: true,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) The name of the Amazon Chime Voice Connector.
+* `requireEncryption` - (Required) When enabled, requires encryption for the Amazon Chime Voice Connector.
+
+The following arguments are optional:
+
+* `awsRegion` - (Optional) The AWS Region in which the Amazon Chime Voice Connector is created. Default value: `usEast1`
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`defaultTags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN (Amazon Resource Name) of the Amazon Chime Voice Connector.
+* `outboundHostName` - The outbound host name for the Amazon Chime Voice Connector.
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Configuration Recorder using the name. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Configuration Recorder using the name. For example:
+
+```console
+% terraform import aws_chime_voice_connector.test example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-57d9ed8368462a0a6c75d0f398c65a29c78ba9f2b52b59eeb50b3be795890ccd -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/chime_voice_connector_group.html.markdown b/website/docs/cdktf/typescript/r/chime_voice_connector_group.html.markdown
new file mode 100644
index 00000000000..bc95941c6ce
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/chime_voice_connector_group.html.markdown
@@ -0,0 +1,102 @@
+---
+subcategory: "Chime"
+layout: "aws"
+page_title: "AWS: aws_chime_voice_connector_group"
+description: |-
+  Creates an Amazon Chime Voice Connector group under the administrator's AWS account.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_chime_voice_connector_group
+
+Creates an Amazon Chime Voice Connector group under the administrator's AWS account. You can associate Amazon Chime Voice Connectors with the Amazon Chime Voice Connector group by including VoiceConnectorItems in the request.
+
+You can include Amazon Chime Voice Connectors from different AWS Regions in your group. This creates a fault tolerant mechanism for fallback in case of availability events.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ChimeVoiceConnector } from "./.gen/providers/aws/chime-voice-connector";
+import { ChimeVoiceConnectorGroup } from "./.gen/providers/aws/chime-voice-connector-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const vc1 = new ChimeVoiceConnector(this, "vc1", {
+      awsRegion: "us-east-1",
+      name: "connector-test-1",
+      requireEncryption: true,
+    });
+    const vc2 = new ChimeVoiceConnector(this, "vc2", {
+      awsRegion: "us-west-2",
+      name: "connector-test-2",
+      requireEncryption: true,
+    });
+    new ChimeVoiceConnectorGroup(this, "group", {
+      connector: [
+        {
+          priority: 1,
+          voiceConnectorId: vc1.id,
+        },
+        {
+          priority: 3,
+          voiceConnectorId: vc2.id,
+        },
+      ],
+      name: "test-group",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the Amazon Chime Voice Connector group.
+* `connector` - (Optional) The Amazon Chime Voice Connectors to route inbound calls to.
+
+### `connector`
+
+For Amazon Chime Voice Connector groups, the Amazon Chime Voice Connectors to which to route inbound calls. Includes priority configuration settings. Limit: 3 VoiceConnectorItems per Amazon Chime Voice Connector group.
+
+* `voiceConnectorId` - (Required) The Amazon Chime Voice Connector ID.
+* `priority` - (Required) The priority associated with the Amazon Chime Voice Connector, with 1 being the highest priority. Higher priority Amazon Chime Voice Connectors are attempted first.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Amazon Chime Voice Connector group ID.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Configuration Recorder using the name. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Configuration Recorder using the name. For example:
+
+```console
+% terraform import aws_chime_voice_connector_group.default example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-2647c34ddcecc5abad23c5553fbf101209a26f858db52f9c3b06b4b66669a7c9 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/chime_voice_connector_logging.html.markdown b/website/docs/cdktf/typescript/r/chime_voice_connector_logging.html.markdown
new file mode 100644
index 00000000000..0b70bc4d887
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/chime_voice_connector_logging.html.markdown
@@ -0,0 +1,86 @@
+---
+subcategory: "Chime"
+layout: "aws"
+page_title: "AWS: aws_chime_voice_connector_logging"
+description: |-
+    Adds a logging configuration for the specified Amazon Chime Voice Connector. The logging configuration specifies whether SIP message logs are enabled for sending to Amazon CloudWatch Logs.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_chime_voice_connector_logging
+
+Adds a logging configuration for the specified Amazon Chime Voice Connector. The logging configuration specifies whether SIP message logs are enabled for sending to Amazon CloudWatch Logs.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ChimeVoiceConnector } from "./.gen/providers/aws/chime-voice-connector";
+import { ChimeVoiceConnectorLogging } from "./.gen/providers/aws/chime-voice-connector-logging";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const defaultVar = new ChimeVoiceConnector(this, "default", {
+      name: "vc-name-test",
+      requireEncryption: true,
+    });
+    const awsChimeVoiceConnectorLoggingDefault = new ChimeVoiceConnectorLogging(
+      this,
+      "default_1",
+      {
+        enableMediaMetricLogs: true,
+        enableSipLogs: true,
+        voiceConnectorId: defaultVar.id,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsChimeVoiceConnectorLoggingDefault.overrideLogicalId("default");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `voiceConnectorId` - (Required) The Amazon Chime Voice Connector ID.
+* `enableSipLogs` - (Optional) When true, enables SIP message logs for sending to Amazon CloudWatch Logs.
+* `enableMediaMetricLogs` - (Optional) When true, enables logging of detailed media metrics for Voice Connectors to Amazon CloudWatch logs.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Amazon Chime Voice Connector ID.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Chime Voice Connector Logging using the `voiceConnectorId`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Chime Voice Connector Logging using the `voiceConnectorId`. For example:
+
+```console
+% terraform import aws_chime_voice_connector_logging.default abcdef1ghij2klmno3pqr4
+```
+
+<!-- cache-key: cdktf-0.18.0 input-361c57bb71aad3cb46b58306335292d5a69d6d2855bbf5152806871405e9e3ff -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/chime_voice_connector_origination.html.markdown b/website/docs/cdktf/typescript/r/chime_voice_connector_origination.html.markdown
new file mode 100644
index 00000000000..65de8b21d18
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/chime_voice_connector_origination.html.markdown
@@ -0,0 +1,108 @@
+---
+subcategory: "Chime"
+layout: "aws"
+page_title: "AWS: aws_chime_voice_connector_origination"
+description: |-
+    Enable origination settings to control inbound calling to your SIP infrastructure.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_chime_voice_connector_origination
+
+Enable origination settings to control inbound calling to your SIP infrastructure.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ChimeVoiceConnector } from "./.gen/providers/aws/chime-voice-connector";
+import { ChimeVoiceConnectorOrigination } from "./.gen/providers/aws/chime-voice-connector-origination";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const defaultVar = new ChimeVoiceConnector(this, "default", {
+      name: "test",
+      requireEncryption: true,
+    });
+    const awsChimeVoiceConnectorOriginationDefault =
+      new ChimeVoiceConnectorOrigination(this, "default_1", {
+        disabled: false,
+        route: [
+          {
+            host: "127.0.0.1",
+            port: 8081,
+            priority: 1,
+            protocol: "TCP",
+            weight: 1,
+          },
+          {
+            host: "127.0.0.2",
+            port: 8082,
+            priority: 2,
+            protocol: "TCP",
+            weight: 10,
+          },
+        ],
+        voiceConnectorId: defaultVar.id,
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsChimeVoiceConnectorOriginationDefault.overrideLogicalId("default");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `voiceConnectorId` - (Required) The Amazon Chime Voice Connector ID.
+* `route` - (Required) Set of call distribution properties defined for your SIP hosts. See [route](#route) below for more details. Minimum of 1. Maximum of 20.
+* `disabled` - (Optional) When origination settings are disabled, inbound calls are not enabled for your Amazon Chime Voice Connector.
+
+### `route`
+
+Origination routes define call distribution properties for your SIP hosts to receive inbound calls using your Amazon Chime Voice Connector. Limit: Ten origination routes for each Amazon Chime Voice Connector.
+
+* `host` - (Required) The FQDN or IP address to contact for origination traffic.
+* `port` - (Required) The designated origination route port. Defaults to `5060`.
+* `priority` - (Required) The priority associated with the host, with 1 being the highest priority. Higher priority hosts are attempted first.
+* `protocol` - (Required) The protocol to use for the origination route. Encryption-enabled Amazon Chime Voice Connectors use TCP protocol by default.
+* `weight` - (Required) The weight associated with the host. If hosts are equal in priority, calls are redistributed among them based on their relative weight.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Amazon Chime Voice Connector ID.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Chime Voice Connector Origination using the `voiceConnectorId`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Chime Voice Connector Origination using the `voiceConnectorId`. For example:
+
+```console
+% terraform import aws_chime_voice_connector_origination.default abcdef1ghij2klmno3pqr4
+```
+
+<!-- cache-key: cdktf-0.18.0 input-2f8024ec4e12ef059381d8723231847b43f7b2e0c051e5ee2e2f2bc6e04e4558 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/chime_voice_connector_streaming.html.markdown b/website/docs/cdktf/typescript/r/chime_voice_connector_streaming.html.markdown
new file mode 100644
index 00000000000..24015140d12
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/chime_voice_connector_streaming.html.markdown
@@ -0,0 +1,186 @@
+---
+subcategory: "Chime"
+layout: "aws"
+page_title: "AWS: aws_chime_voice_connector_streaming"
+description: |-
+    The streaming configuration associated with an Amazon Chime Voice Connector. Specifies whether media streaming is enabled for sending to Amazon Kinesis, and shows the retention period for the Amazon Kinesis data, in hours.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_chime_voice_connector_streaming
+
+Adds a streaming configuration for the specified Amazon Chime Voice Connector. The streaming configuration specifies whether media streaming is enabled for sending to Amazon Kinesis.
+It also sets the retention period, in hours, for the Amazon Kinesis data.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ChimeVoiceConnector } from "./.gen/providers/aws/chime-voice-connector";
+import { ChimeVoiceConnectorStreaming } from "./.gen/providers/aws/chime-voice-connector-streaming";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const defaultVar = new ChimeVoiceConnector(this, "default", {
+      name: "vc-name-test",
+      requireEncryption: true,
+    });
+    const awsChimeVoiceConnectorStreamingDefault =
+      new ChimeVoiceConnectorStreaming(this, "default_1", {
+        dataRetention: 7,
+        disabled: false,
+        streamingNotificationTargets: ["SQS"],
+        voiceConnectorId: defaultVar.id,
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsChimeVoiceConnectorStreamingDefault.overrideLogicalId("default");
+  }
+}
+
+```
+
+### Example Usage With Media Insights
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ChimeVoiceConnector } from "./.gen/providers/aws/chime-voice-connector";
+import { ChimeVoiceConnectorStreaming } from "./.gen/providers/aws/chime-voice-connector-streaming";
+import { ChimesdkmediapipelinesMediaInsightsPipelineConfiguration } from "./.gen/providers/aws/chimesdkmediapipelines-media-insights-pipeline-configuration";
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+import { KinesisStream } from "./.gen/providers/aws/kinesis-stream";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const defaultVar = new ChimeVoiceConnector(this, "default", {
+      name: "vc-name-test",
+      requireEncryption: true,
+    });
+    const example = new KinesisStream(this, "example", {
+      name: "ExampleStream",
+      shardCount: 2,
+    });
+    const assumeRole = new DataAwsIamPolicyDocument(this, "assume_role", {
+      statement: [
+        {
+          actions: ["sts:AssumeRole"],
+          effect: "Allow",
+          principals: [
+            {
+              identifiers: ["mediapipelines.chime.amazonaws.com"],
+              type: "Service",
+            },
+          ],
+        },
+      ],
+    });
+    const awsIamRoleExample = new IamRole(this, "example_3", {
+      assumeRolePolicy: Token.asString(assumeRole.json),
+      name: "ExampleResourceAccessRole",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamRoleExample.overrideLogicalId("example");
+    const awsChimesdkmediapipelinesMediaInsightsPipelineConfigurationExample =
+      new ChimesdkmediapipelinesMediaInsightsPipelineConfiguration(
+        this,
+        "example_4",
+        {
+          elements: [
+            {
+              amazonTranscribeCallAnalyticsProcessorConfiguration: {
+                languageCode: "en-US",
+              },
+              type: "AmazonTranscribeCallAnalyticsProcessor",
+            },
+            {
+              kinesisDataStreamSinkConfiguration: {
+                insightsTarget: example.arn,
+              },
+              type: "KinesisDataStreamSink",
+            },
+          ],
+          name: "ExampleConfig",
+          resourceAccessRoleArn: Token.asString(awsIamRoleExample.arn),
+        }
+      );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsChimesdkmediapipelinesMediaInsightsPipelineConfigurationExample.overrideLogicalId(
+      "example"
+    );
+    const awsChimeVoiceConnectorStreamingDefault =
+      new ChimeVoiceConnectorStreaming(this, "default_5", {
+        dataRetention: 7,
+        disabled: false,
+        mediaInsightsConfiguration: {
+          configurationArn: Token.asString(
+            awsChimesdkmediapipelinesMediaInsightsPipelineConfigurationExample.arn
+          ),
+          disabled: false,
+        },
+        streamingNotificationTargets: ["SQS"],
+        voiceConnectorId: defaultVar.id,
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsChimeVoiceConnectorStreamingDefault.overrideLogicalId("default");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `voiceConnectorId` - (Required) The Amazon Chime Voice Connector ID.
+* `dataRetention`  - (Required) The retention period, in hours, for the Amazon Kinesis data.
+* `disabled` - (Optional) When true, media streaming to Amazon Kinesis is turned off. Default: `false`
+* `streamingNotificationTargets` - (Optional) The streaming notification targets. Valid Values: `EventBridge | SNS | SQS`
+* `mediaInsightsConfiguration` - (Optional) The media insights configuration. See [`mediaInsightsConfiguration`](#media_insights_configuration).
+
+### media_insights_configuration
+
+* `disabled` - (Optional) When `true`, the media insights configuration is not enabled. Defaults to `false`.
+* `configurationArn` - (Optional) The media insights configuration that will be invoked by the Voice Connector.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Amazon Chime Voice Connector ID.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Chime Voice Connector Streaming using the `voiceConnectorId`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Chime Voice Connector Streaming using the `voiceConnectorId`. For example:
+
+```console
+% terraform import aws_chime_voice_connector_streaming.default abcdef1ghij2klmno3pqr4
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1d6eaf10d1870a1e8fdf049fb6ca121f258d5ffdbe4eae79fe564f39d16ce4f8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/chime_voice_connector_termination.html.markdown b/website/docs/cdktf/typescript/r/chime_voice_connector_termination.html.markdown
new file mode 100644
index 00000000000..a05ea1c1212
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/chime_voice_connector_termination.html.markdown
@@ -0,0 +1,88 @@
+---
+subcategory: "Chime"
+layout: "aws"
+page_title: "AWS: aws_chime_voice_connector_termination"
+description: |-
+    Enable Termination settings to control outbound calling from your SIP infrastructure.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_chime_voice_connector_termination
+
+Enable Termination settings to control outbound calling from your SIP infrastructure.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ChimeVoiceConnector } from "./.gen/providers/aws/chime-voice-connector";
+import { ChimeVoiceConnectorTermination } from "./.gen/providers/aws/chime-voice-connector-termination";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const defaultVar = new ChimeVoiceConnector(this, "default", {
+      name: "vc-name-test",
+      requireEncryption: true,
+    });
+    const awsChimeVoiceConnectorTerminationDefault =
+      new ChimeVoiceConnectorTermination(this, "default_1", {
+        callingRegions: ["US", "CA"],
+        cidrAllowList: ["50.35.78.96/31"],
+        cpsLimit: 1,
+        disabled: false,
+        voiceConnectorId: defaultVar.id,
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsChimeVoiceConnectorTerminationDefault.overrideLogicalId("default");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `voiceConnectorId` - (Required) The Amazon Chime Voice Connector ID.
+* `cidrAllowList` - (Required) The IP addresses allowed to make calls, in CIDR format.
+* `callingRegions` - (Required) The countries to which calls are allowed, in ISO 3166-1 alpha-2 format.
+* `disabled` - (Optional) When termination settings are disabled, outbound calls can not be made.
+* `defaultPhoneNumber` - (Optional) The default caller ID phone number.
+* `cpsLimit` - (Optional) The limit on calls per second. Max value based on account service quota. Default value of `1`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Amazon Chime Voice Connector ID.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Chime Voice Connector Termination using the `voiceConnectorId`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Chime Voice Connector Termination using the `voiceConnectorId`. For example:
+
+```console
+% terraform import aws_chime_voice_connector_termination.default abcdef1ghij2klmno3pqr4
+```
+
+<!-- cache-key: cdktf-0.18.0 input-9b91d0804f73c2e363dbd51b5e4d5f6a556c88d12ee33e47aece98cc8ef64a64 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/chime_voice_connector_termination_credentials.html.markdown b/website/docs/cdktf/typescript/r/chime_voice_connector_termination_credentials.html.markdown
new file mode 100644
index 00000000000..177f71dbbbf
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/chime_voice_connector_termination_credentials.html.markdown
@@ -0,0 +1,109 @@
+---
+subcategory: "Chime"
+layout: "aws"
+page_title: "AWS: aws_chime_voice_connector_termination_credentials"
+description: |-
+    Adds termination SIP credentials for the specified Amazon Chime Voice Connector.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_chime_voice_connector_termination_credentials
+
+Adds termination SIP credentials for the specified Amazon Chime Voice Connector.
+
+~> **Note:** Voice Connector Termination Credentials requires a [Voice Connector Termination](/docs/providers/aws/r/chime_voice_connector_termination.html) to be present. Use of `dependsOn` (as shown below) is recommended to avoid race conditions.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ChimeVoiceConnector } from "./.gen/providers/aws/chime-voice-connector";
+import { ChimeVoiceConnectorTermination } from "./.gen/providers/aws/chime-voice-connector-termination";
+import { ChimeVoiceConnectorTerminationCredentials } from "./.gen/providers/aws/chime-voice-connector-termination-credentials";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const defaultVar = new ChimeVoiceConnector(this, "default", {
+      name: "test",
+      requireEncryption: true,
+    });
+    const awsChimeVoiceConnectorTerminationDefault =
+      new ChimeVoiceConnectorTermination(this, "default_1", {
+        callingRegions: ["US", "CA"],
+        cidrAllowList: ["50.35.78.96/31"],
+        cpsLimit: 1,
+        disabled: true,
+        voiceConnectorId: defaultVar.id,
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsChimeVoiceConnectorTerminationDefault.overrideLogicalId("default");
+    const awsChimeVoiceConnectorTerminationCredentialsDefault =
+      new ChimeVoiceConnectorTerminationCredentials(this, "default_2", {
+        credentials: [
+          {
+            password: "test!",
+            username: "test",
+          },
+        ],
+        dependsOn: [awsChimeVoiceConnectorTerminationDefault],
+        voiceConnectorId: defaultVar.id,
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsChimeVoiceConnectorTerminationCredentialsDefault.overrideLogicalId(
+      "default"
+    );
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `voiceConnectorId` - (Required) Amazon Chime Voice Connector ID.
+* `credentials` - (Required) List of termination SIP credentials.
+
+### `credentials`
+
+The SIP credentials used to authenticate requests to your Amazon Chime Voice Connector.
+
+* `username` - (Required) RFC2617 compliant username associated with the SIP credentials.
+* `password` - (Required) RFC2617 compliant password associated with the SIP credentials.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Amazon Chime Voice Connector ID.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Chime Voice Connector Termination Credentials using the `voiceConnectorId`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Chime Voice Connector Termination Credentials using the `voiceConnectorId`. For example:
+
+```console
+% terraform import aws_chime_voice_connector_termination_credentials.default abcdef1ghij2klmno3pqr4
+```
+
+<!-- cache-key: cdktf-0.18.0 input-02b1a944fea362b1a923331d302d7f87fdfe8ec990e3008661b3af45d9ffd0c0 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/chimesdkmediapipelines_media_insights_pipeline_configuration.html.markdown b/website/docs/cdktf/typescript/r/chimesdkmediapipelines_media_insights_pipeline_configuration.html.markdown
new file mode 100644
index 00000000000..77d68248023
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/chimesdkmediapipelines_media_insights_pipeline_configuration.html.markdown
@@ -0,0 +1,501 @@
+---
+subcategory: "Chime SDK Media Pipelines"
+layout: "aws"
+page_title: "AWS: aws_chimesdkmediapipelines_media_insights_pipeline_configuration"
+description: |-
+  Terraform resource for managing an AWS Chime SDK Media Pipelines Media Insights Pipeline Configuration.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_chimesdkmediapipelines_media_insights_pipeline_configuration
+
+Terraform resource for managing an AWS Chime SDK Media Pipelines Media Insights Pipeline Configuration.
+Consult the [Call analytics developer guide](https://docs.aws.amazon.com/chime-sdk/latest/dg/call-analytics.html) for more detailed information about usage.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ChimesdkmediapipelinesMediaInsightsPipelineConfiguration } from "./.gen/providers/aws/chimesdkmediapipelines-media-insights-pipeline-configuration";
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+import { KinesisStream } from "./.gen/providers/aws/kinesis-stream";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new KinesisStream(this, "example", {
+      name: "example",
+      shardCount: 2,
+    });
+    const mediaPipelinesAssumeRole = new DataAwsIamPolicyDocument(
+      this,
+      "media_pipelines_assume_role",
+      {
+        statement: [
+          {
+            actions: ["sts:AssumeRole"],
+            effect: "Allow",
+            principals: [
+              {
+                identifiers: ["mediapipelines.chime.amazonaws.com"],
+                type: "Service",
+              },
+            ],
+          },
+        ],
+      }
+    );
+    const callAnalyticsRole = new IamRole(this, "call_analytics_role", {
+      assumeRolePolicy: Token.asString(mediaPipelinesAssumeRole.json),
+      name: "CallAnalyticsRole",
+    });
+    new ChimesdkmediapipelinesMediaInsightsPipelineConfiguration(
+      this,
+      "my_configuration",
+      {
+        elements: [
+          {
+            amazonTranscribeCallAnalyticsProcessorConfiguration: {
+              languageCode: "en-US",
+            },
+            type: "AmazonTranscribeCallAnalyticsProcessor",
+          },
+          {
+            kinesisDataStreamSinkConfiguration: {
+              insightsTarget: example.arn,
+            },
+            type: "KinesisDataStreamSink",
+          },
+        ],
+        name: "MyBasicConfiguration",
+        resourceAccessRoleArn: callAnalyticsRole.arn,
+        tags: {
+          Key1: "Value1",
+          Key2: "Value2",
+        },
+      }
+    );
+  }
+}
+
+```
+
+- The required policies on `callAnalyticsRole` will vary based on the selected processors. See [Call analytics resource access role](https://docs.aws.amazon.com/chime-sdk/latest/dg/ca-resource-access-role.html) for directions on choosing appropriate policies.
+
+### Transcribe Call Analytics processor usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ChimesdkmediapipelinesMediaInsightsPipelineConfiguration } from "./.gen/providers/aws/chimesdkmediapipelines-media-insights-pipeline-configuration";
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const transcribeAssumeRole = new DataAwsIamPolicyDocument(
+      this,
+      "transcribe_assume_role",
+      {
+        statement: [
+          {
+            actions: ["sts:AssumeRole"],
+            effect: "Allow",
+            principals: [
+              {
+                identifiers: ["transcribe.amazonaws.com"],
+                type: "Service",
+              },
+            ],
+          },
+        ],
+      }
+    );
+    const postCallRole = new IamRole(this, "post_call_role", {
+      assumeRolePolicy: Token.asString(transcribeAssumeRole.json),
+      name: "PostCallAccessRole",
+    });
+    new ChimesdkmediapipelinesMediaInsightsPipelineConfiguration(
+      this,
+      "my_configuration",
+      {
+        elements: [
+          {
+            amazonTranscribeCallAnalyticsProcessorConfiguration: {
+              callAnalyticsStreamCategories: ["category_1", "category_2"],
+              contentRedactionType: "PII",
+              enablePartialResultsStabilization: true,
+              filterPartialResults: true,
+              languageCode: "en-US",
+              languageModelName: "MyLanguageModel",
+              partialResultsStability: "high",
+              piiEntityTypes: "ADDRESS,BANK_ACCOUNT_NUMBER",
+              postCallAnalyticsSettings: {
+                contentRedactionOutput: "redacted",
+                dataAccessRoleArn: postCallRole.arn,
+                outputEncryptionKmsKeyId: "MyKmsKeyId",
+                outputLocation: "s3://MyBucket",
+              },
+              vocabularyFilterMethod: "mask",
+              vocabularyFilterName: "MyVocabularyFilter",
+              vocabularyName: "MyVocabulary",
+            },
+            type: "AmazonTranscribeCallAnalyticsProcessor",
+          },
+          {
+            kinesisDataStreamSinkConfiguration: {
+              insightsTarget: example.arn,
+            },
+            type: "KinesisDataStreamSink",
+          },
+        ],
+        name: "MyCallAnalyticsConfiguration",
+        resourceAccessRoleArn: Token.asString(awsIamRoleExample.arn),
+      }
+    );
+  }
+}
+
+```
+
+### Real time alerts usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ChimesdkmediapipelinesMediaInsightsPipelineConfiguration } from "./.gen/providers/aws/chimesdkmediapipelines-media-insights-pipeline-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ChimesdkmediapipelinesMediaInsightsPipelineConfiguration(
+      this,
+      "my_configuration",
+      {
+        elements: [
+          {
+            amazonTranscribeCallAnalyticsProcessorConfiguration: {
+              languageCode: "en-US",
+            },
+            type: "AmazonTranscribeCallAnalyticsProcessor",
+          },
+          {
+            kinesisDataStreamSinkConfiguration: {
+              insightsTarget: example.arn,
+            },
+            type: "KinesisDataStreamSink",
+          },
+        ],
+        name: "MyRealTimeAlertConfiguration",
+        realTimeAlertConfiguration: {
+          disabled: false,
+          rules: [
+            {
+              issueDetectionConfiguration: {
+                ruleName: "MyIssueDetectionRule",
+              },
+              type: "IssueDetection",
+            },
+            {
+              keywordMatchConfiguration: {
+                keywords: ["keyword1", "keyword2"],
+                negate: false,
+                ruleName: "MyKeywordMatchRule",
+              },
+              type: "KeywordMatch",
+            },
+            {
+              sentimentConfiguration: {
+                ruleName: "MySentimentRule",
+                sentimentType: "NEGATIVE",
+                timePeriod: 60,
+              },
+              type: "Sentiment",
+            },
+          ],
+        },
+        resourceAccessRoleArn: callAnalyticsRole.arn,
+      }
+    );
+  }
+}
+
+```
+
+### Transcribe processor usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ChimesdkmediapipelinesMediaInsightsPipelineConfiguration } from "./.gen/providers/aws/chimesdkmediapipelines-media-insights-pipeline-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ChimesdkmediapipelinesMediaInsightsPipelineConfiguration(
+      this,
+      "my_configuration",
+      {
+        elements: [
+          {
+            amazonTranscribeProcessorConfiguration: {
+              contentIdentificationType: "PII",
+              enablePartialResultsStabilization: true,
+              filterPartialResults: true,
+              languageCode: "en-US",
+              languageModelName: "MyLanguageModel",
+              partialResultsStability: "high",
+              piiEntityTypes: "ADDRESS,BANK_ACCOUNT_NUMBER",
+              showSpeakerLabel: true,
+              vocabularyFilterMethod: "mask",
+              vocabularyFilterName: "MyVocabularyFilter",
+              vocabularyName: "MyVocabulary",
+            },
+            type: "AmazonTranscribeProcessor",
+          },
+          {
+            kinesisDataStreamSinkConfiguration: {
+              insightsTarget: example.arn,
+            },
+            type: "KinesisDataStreamSink",
+          },
+        ],
+        name: "MyTranscribeConfiguration",
+        resourceAccessRoleArn: Token.asString(awsIamRoleExample.arn),
+      }
+    );
+  }
+}
+
+```
+
+### Voice analytics processor usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ChimesdkmediapipelinesMediaInsightsPipelineConfiguration } from "./.gen/providers/aws/chimesdkmediapipelines-media-insights-pipeline-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ChimesdkmediapipelinesMediaInsightsPipelineConfiguration(
+      this,
+      "my_configuration",
+      {
+        elements: [
+          {
+            type: "VoiceAnalyticsProcessor",
+            voiceAnalyticsProcessorConfiguration: {
+              speakerSearchStatus: "Enabled",
+              voiceToneAnalysisStatus: "Enabled",
+            },
+          },
+          {
+            lambdaFunctionSinkConfiguration: {
+              insightsTarget:
+                "arn:aws:lambda:us-west-2:1111111111:function:MyFunction",
+            },
+            type: "LambdaFunctionSink",
+          },
+          {
+            snsTopicSinkConfiguration: {
+              insightsTarget: "arn:aws:sns:us-west-2:1111111111:topic/MyTopic",
+            },
+            type: "SnsTopicSink",
+          },
+          {
+            sqsQueueSinkConfiguration: {
+              insightsTarget: "arn:aws:sqs:us-west-2:1111111111:queue/MyQueue",
+            },
+            type: "SqsQueueSink",
+          },
+          {
+            kinesisDataStreamSinkConfiguration: {
+              insightsTarget: test.arn,
+            },
+            type: "KinesisDataStreamSink",
+          },
+        ],
+        name: "MyVoiceAnalyticsConfiguration",
+        resourceAccessRoleArn: example.arn,
+      }
+    );
+  }
+}
+
+```
+
+### S3 Recording sink usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ChimesdkmediapipelinesMediaInsightsPipelineConfiguration } from "./.gen/providers/aws/chimesdkmediapipelines-media-insights-pipeline-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ChimesdkmediapipelinesMediaInsightsPipelineConfiguration(
+      this,
+      "my_configuration",
+      {
+        elements: [
+          {
+            s3RecordingSinkConfiguration: {
+              destination: "arn:aws:s3:::MyBucket",
+            },
+            type: "S3RecordingSink",
+          },
+        ],
+        name: "MyS3RecordingConfiguration",
+        resourceAccessRoleArn: example.arn,
+      }
+    );
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) Configuration name.
+* `resourceAccessRoleArn` - (Required) ARN of IAM Role used by service to invoke processors and sinks specified by configuration elements.
+* `elements` - (Required) Collection of processors and sinks to transform media and deliver data.
+* `realTimeAlertConfiguration` - (Optional) Configuration for real-time alert rules to send EventBridge notifications when certain conditions are met.
+* `tags` - (Optional) Key-value map of tags for the resource.
+
+### Elements
+
+* `type` - (Required) Element type.
+* `amazonTranscribeCallAnalyticsProcessorConfiguration` - (Optional) Configuration for Amazon Transcribe Call Analytics processor.
+    * `callAnalyticsStreamCategories` - (Optional) Filter for category events to be delivered to insights target.
+    * `contentIdentificationType` - (Optional) Labels all personally identifiable information (PII) identified in Utterance events.
+    * `contentRedactionType` - (Optional) Redacts all personally identifiable information (PII) identified in Utterance events.
+    * `enablePartialResultsStabilization` - (Optional) Enables partial result stabilization in Utterance events.
+    * `filterPartialResults` - (Optional) Filters partial Utterance events from delivery to the insights target.
+    * `languageCode` - (Required) Language code for the transcription model.
+    * `languageModelName` - (Optional) Name of custom language model for transcription.
+    * `partialResultsStability` - (Optional) Level of stability to use when partial results stabilization is enabled.
+    * `piiEntityTypes` - (Optional) Types of personally identifiable information (PII) to redact from an Utterance event.
+    * `postCallAnalyticsSettings` - (Optional) Settings for post call analytics.
+        * `contentRedactionOutput` - (Optional) Should output be redacted.
+        * `dataAccessRoleArn` - (Required) ARN of the role used by AWS Transcribe to upload your post call analysis.
+        * `outputEncryptionKmsKeyId` - (Optional) ID of the KMS key used to encrypt the output.
+        * `outputLocation` - (Required) The Amazon S3 location where you want your Call Analytics post-call transcription output stored.
+    * `vocabularyFilterMethod` - (Optional) Method for applying a vocabulary filter to Utterance events.
+    * `vocabularyFilterName` - (Optional) Name of the custom vocabulary filter to use when processing Utterance events.
+    * `vocabularyName` - (Optional) Name of the custom vocabulary to use when processing Utterance events.
+* `amazonTranscribeProcessorConfiguration` - (Optional) Configuration for Amazon Transcribe processor.
+    * `contentIdentificationType` - (Optional) Labels all personally identifiable information (PII) identified in Transcript events.
+    * `contentRedactionType` - (Optional) Redacts all personally identifiable information (PII) identified in Transcript events.
+    * `enablePartialResultsStabilization` - (Optional) Enables partial result stabilization in Transcript events.
+    * `filterPartialResults` - (Optional) Filters partial Utterance events from delivery to the insights target.
+    * `languageCode` - (Required) Language code for the transcription model.
+    * `languageModelName` - (Optional) Name of custom language model for transcription.
+    * `partialResultsStability` - (Optional) Level of stability to use when partial results stabilization is enabled.
+    * `piiEntityTypes` - (Optional) Types of personally identifiable information (PII) to redact from a Transcript event.
+    * `showSpeakerLabel` - (Optional) Enables speaker partitioning (diarization) in your Transcript events.
+    * `vocabularyFilterMethod` - (Optional) Method for applying a vocabulary filter to Transcript events.
+    * `vocabularyFilterName` - (Optional) Name of the custom vocabulary filter to use when processing Transcript events.
+    * `vocabularyName` - (Optional) Name of the custom vocabulary to use when processing Transcript events.
+* `kinesisDataStreamSinkConfiguration` - (Optional) Configuration for Kinesis Data Stream sink.
+    * `insightsTarget` - (Required) Kinesis Data Stream to deliver results.
+* `lambdaFunctionSinkConfiguration` - (Optional) Configuration for Lambda Function sink.
+    * `insightsTarget` - (Required) Lambda Function to deliver results.
+* `snsTopicSinkConfiguration` - (Optional) Configuration for SNS Topic sink.
+    * `insightsTarget` - (Required) SNS topic to deliver results.
+* `sqsQueueSinkConfiguration` - (Optional) Configuration for SQS Queue sink.
+    * `insightsTarget` - (Required) SQS queue to deliver results.
+* `s3RecordingSinkConfiguration` - (Optional) Configuration for S3 recording sink.
+    * `destination` - (Required) S3 URI to deliver recordings.
+* `voiceAnalyticsProcessorConfiguration` - (Optional) Configuration for Voice analytics processor.
+    * `speakerSearchStatus` - (Required) Enable speaker search.
+    * `voiceToneAnalysisStatus` - (Required) Enable voice tone analysis.
+
+### Real time alert configuration
+
+* `rules` - (Required) Collection of real time alert rules
+    * `type` - (Required) Rule type.
+    * `issueDetectionConfiguration` - (Optional) Configuration for an issue detection rule.
+        * `ruleName` - (Required) Rule name.
+    * `keywordMatchConfiguration` - (Optional) Configuration for a keyword match rule.
+        * `ruleName` - (Required) Rule name.
+        * `keywords` - (Required) Collection of keywords to match.
+        * `negate` - (Optional) Negate the rule.
+    * `sentimentConfiguration` - (Optional) Configuration for a sentiment rule.
+        * `ruleName` - (Required) Rule name.
+        * `sentimentType` - (Required) Sentiment type to match.
+        * `timePeriod` - (Optional) Analysis interval.
+* `disabled` - (Optional) Disables real time alert rules.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Media Insights Pipeline Configuration.
+* `id` - Unique ID of the Media Insights Pipeline Configuration.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `3M`)
+* `update` - (Default `3M`)
+* `delete` - (Default `30S`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Chime SDK Media Pipelines Media Insights Pipeline Configuration using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Chime SDK Media Pipelines Media Insights Pipeline Configuration using the `id`. For example:
+
+```console
+% terraform import aws_chimesdkmediapipelines_media_insights_pipeline_configuration.example abcdef123456
+```
+
+<!-- cache-key: cdktf-0.18.0 input-e27c8cae132bb59224264ffd318670201dbde0c3fb71b0400db863d44cf5ecde -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/chimesdkvoice_global_settings.html.markdown b/website/docs/cdktf/typescript/r/chimesdkvoice_global_settings.html.markdown
new file mode 100644
index 00000000000..60dc1cd3c6f
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/chimesdkvoice_global_settings.html.markdown
@@ -0,0 +1,81 @@
+---
+subcategory: "Chime SDK Voice"
+layout: "aws"
+page_title: "AWS: aws_chimesdkvoice_global_settings"
+description: |-
+  Terraform resource for managing Amazon Chime SDK Voice Global Settings.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_chimesdkvoice_global_settings
+
+Terraform resource for managing Amazon Chime SDK Voice Global Settings.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ChimesdkvoiceGlobalSettings } from "./.gen/providers/aws/chimesdkvoice-global-settings";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ChimesdkvoiceGlobalSettings(this, "example", {
+      voiceConnector: {
+        cdrBucket: "example-bucket-name",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `voiceConnector` - (Required) The Voice Connector settings. See [voice_connector](#voice_connector).
+
+### `voiceConnector`
+
+The Amazon Chime SDK Voice Connector settings. Includes any Amazon S3 buckets designated for storing call detail records.
+
+* `cdrBucket` - (Optional) The S3 bucket that stores the Voice Connector's call detail records.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - AWS account ID for which the settings are applied.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AWS Chime SDK Voice Global Settings using the `id` (AWS account ID). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import AWS Chime SDK Voice Global Settings using the `id` (AWS account ID). For example:
+
+```console
+% terraform import aws_chimesdkvoice_global_settings.example 123456789012
+```
+
+<!-- cache-key: cdktf-0.18.0 input-dd8eeed093a67a95ba6171329281d91e91a270a2747bca2d4eb8cc09920ff746 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/chimesdkvoice_sip_media_application.html.markdown b/website/docs/cdktf/typescript/r/chimesdkvoice_sip_media_application.html.markdown
new file mode 100644
index 00000000000..b3ea3dbd3f2
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/chimesdkvoice_sip_media_application.html.markdown
@@ -0,0 +1,91 @@
+---
+subcategory: "Chime SDK Voice"
+layout: "aws"
+page_title: "AWS: aws_chimesdkvoice_sip_media_application"
+description: |-
+  A ChimeSDKVoice SIP Media Application is a managed object that passes values from a SIP rule to a target AWS Lambda function.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_chimesdkvoice_sip_media_application
+
+A ChimeSDKVoice SIP Media Application is a managed object that passes values from a SIP rule to a target AWS Lambda function.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ChimesdkvoiceSipMediaApplication } from "./.gen/providers/aws/chimesdkvoice-sip-media-application";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ChimesdkvoiceSipMediaApplication(this, "example", {
+      awsRegion: "us-east-1",
+      endpoints: {
+        lambdaArn: test.arn,
+      },
+      name: "example-sip-media-application",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `awsRegion` - (Required) The AWS Region in which the AWS Chime SDK Voice Sip Media Application is created.
+* `endpoints` - (Required)  List of endpoints (Lambda Amazon Resource Names) specified for the SIP media application. Currently, only one endpoint is supported. See [`endpoints`](#endpoints).
+* `name` - (Required) The name of the AWS Chime SDK Voice Sip Media Application.
+
+The following arguments are optional:
+
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`defaultTags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### `endpoints`
+
+The endpoint assigned to the SIP media application.
+
+* `lambdaArn` - (Required) Valid Amazon Resource Name (ARN) of the Lambda function, version, or alias. The function must be created in the same AWS Region as the SIP media application.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` -  ARN (Amazon Resource Name) of the AWS Chime SDK Voice Sip Media Application
+* `id` - The SIP media application ID.
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import a ChimeSDKVoice SIP Media Application using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import a ChimeSDKVoice SIP Media Application using the `id`. For example:
+
+```console
+% terraform import aws_chimesdkvoice_sip_media_application.example abcdef123456
+```
+
+<!-- cache-key: cdktf-0.18.0 input-e1b6072f4d998c9e513ec72230b13fe8b463d6b65adffbd9a34c66c4336e5e88 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/chimesdkvoice_sip_rule.html.markdown b/website/docs/cdktf/typescript/r/chimesdkvoice_sip_rule.html.markdown
new file mode 100644
index 00000000000..d7b46f151f8
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/chimesdkvoice_sip_rule.html.markdown
@@ -0,0 +1,96 @@
+---
+subcategory: "Chime SDK Voice"
+layout: "aws"
+page_title: "AWS: aws_chimesdkvoice_sip_rule"
+description: |-
+    A SIP rule associates your SIP media application with a phone number or a Request URI hostname. You can associate a SIP rule with more than one SIP media application. Each application then runs only that rule.
+---
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_chimesdkvoice_sip_rule
+
+A SIP rule associates your SIP media application with a phone number or a Request URI hostname. You can associate a SIP rule with more than one SIP media application. Each application then runs only that rule.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ChimesdkvoiceSipRule } from "./.gen/providers/aws/chimesdkvoice-sip-rule";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ChimesdkvoiceSipRule(this, "example", {
+      name: "example-sip-rule",
+      targetApplications: [
+        {
+          awsRegion: "us-east-1",
+          priority: 1,
+          sipMediaApplicationId: exampleSma.id,
+        },
+      ],
+      triggerType: "RequestUriHostname",
+      triggerValue: exampleVoiceConnector.outboundHostName,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) The name of the SIP rule.
+* `targetApplications` - (Required) List of SIP media applications with priority and AWS Region. Only one SIP application per AWS Region can be used. See [`targetApplications`](#target_applications).
+* `triggerType` - (Required) The type of trigger assigned to the SIP rule in `triggerValue`. Valid values are `requestUriHostname` or `toPhoneNumber`.
+* `triggerValue` - (Required) If `triggerType` is `requestUriHostname`, the value can be the outbound host name of an Amazon Chime Voice Connector. If `triggerType` is `toPhoneNumber`, the value can be a customer-owned phone number in the E164 format. The Sip Media Application specified in the Sip Rule is triggered if the request URI in an incoming SIP request matches the `requestUriHostname`, or if the "To" header in the incoming SIP request matches the `toPhoneNumber` value.
+
+The following arguments are optional:
+
+* `disabled` - (Optional) Enables or disables a rule. You must disable rules before you can delete them.
+
+### `targetApplications`
+
+List of SIP media applications with priority and AWS Region. Only one SIP application per AWS Region can be used.
+
+* `awsRegion` - (Required) The AWS Region of the target application.
+* `priority` - (Required) Priority of the SIP media application in the target list.
+* `sipMediaApplicationId` - (Required) The SIP media application ID.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The SIP rule ID.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import a ChimeSDKVoice SIP Rule using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import a ChimeSDKVoice SIP Rule using the `id`. For example:
+
+```console
+% terraform import aws_chimesdkvoice_sip_rule.example abcdef123456
+```
+
+<!-- cache-key: cdktf-0.18.0 input-3475b0a57a4be526a5e2626982a1ad5155fe2cd8afc53724a14c23471b5a6ff8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/chimesdkvoice_voice_profile_domain.html.markdown b/website/docs/cdktf/typescript/r/chimesdkvoice_voice_profile_domain.html.markdown
new file mode 100644
index 00000000000..57b6c4e8da4
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/chimesdkvoice_voice_profile_domain.html.markdown
@@ -0,0 +1,103 @@
+---
+subcategory: "Chime SDK Voice"
+layout: "aws"
+page_title: "AWS: aws_chimesdkvoice_voice_profile_domain"
+description: |-
+  Terraform resource for managing an AWS Chime SDK Voice Profile Domain.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_chimesdkvoice_voice_profile_domain
+
+Terraform resource for managing an AWS Chime SDK Voice Profile Domain.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ChimesdkvoiceVoiceProfileDomain } from "./.gen/providers/aws/chimesdkvoice-voice-profile-domain";
+import { KmsKey } from "./.gen/providers/aws/kms-key";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new KmsKey(this, "example", {
+      deletionWindowInDays: 7,
+      description: "KMS Key for Voice Profile Domain",
+    });
+    const awsChimesdkvoiceVoiceProfileDomainExample =
+      new ChimesdkvoiceVoiceProfileDomain(this, "example_1", {
+        description: "My Voice Profile Domain",
+        name: "ExampleVoiceProfileDomain",
+        serverSideEncryptionConfiguration: {
+          kmsKeyArn: example.arn,
+        },
+        tags: {
+          key1: "value1",
+        },
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsChimesdkvoiceVoiceProfileDomainExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) Name of Voice Profile Domain.
+* `serverSideEncryptionConfiguration` - (Required) Configuration for server side encryption.
+    * `kmsKeyArn` - (Required) ARN for KMS Key.
+
+The following arguments are optional:
+
+* `description` - (Optional) Description of Voice Profile Domain.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Voice Profile Domain.
+* `id` - ID of the Voice Profile Domain.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `30S`)
+* `update` - (Default `30S`)
+* `delete` - (Default `30S`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AWS Chime SDK Voice Profile Domain using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import AWS Chime SDK Voice Profile Domain using the `id`. For example:
+
+```console
+% terraform import aws_chimesdkvoice_voice_profile_domain.example abcdef123456
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1ed3340a6d443b0bc7304eeda785a30b45ce4604e81681eebd0a62911c653c94 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/cleanrooms_collaboration.html.markdown b/website/docs/cdktf/typescript/r/cleanrooms_collaboration.html.markdown
new file mode 100644
index 00000000000..b4d82864717
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/cleanrooms_collaboration.html.markdown
@@ -0,0 +1,128 @@
+---
+subcategory: "Clean Rooms"
+layout: "aws"
+page_title: "AWS: aws_cleanrooms_collaboration"
+description: |-
+  Provides a Clean Rooms Collaboration.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cleanrooms_collaboration
+
+Provides a AWS Clean Rooms collaboration.  All members included in the definition will be invited to
+join the collaboration and can create memberships.
+
+## Example Usage
+
+### Collaboration with tags
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CleanroomsCollaboration } from "./.gen/providers/aws/cleanrooms-collaboration";
+interface MyConfig {
+  memberAbilities: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new CleanroomsCollaboration(this, "test_collaboration", {
+      creatorDisplayName: "Creator ",
+      creatorMemberAbilities: ["CAN_QUERY", "CAN_RECEIVE_RESULTS"],
+      dataEncryptionMetadata: {
+        allowClearText: true,
+        allowDuplicates: true,
+        allowJoinsOnColumnsWithDifferentNames: true,
+        preserveNulls: false,
+      },
+      description: "I made this collaboration with terraform!",
+      member: [
+        {
+          accountId: Token.asString(123456789012),
+          displayName: "Other member",
+          memberAbilities: config.memberAbilities,
+        },
+      ],
+      name: "terraform-example-collaboration",
+      queryLogStatus: "DISABLED",
+      tags: {
+        Project: "Terraform",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) - The name of the collaboration.  Collaboration names do not need to be unique.
+* `description` - (Required) - A description for a collaboration.
+* `creatorMemberAbilities` - (Required - Forces new resource) - The list of member abilities for the creator of the collaboration.  Valid values [may be found here](https://docs.aws.amazon.com/clean-rooms/latest/apireference/API_CreateCollaboration.html#API-CreateCollaboration-request-creatorMemberAbilities).
+* `creatorDisplayName` - (Required - Forces new resource) - The name for the member record for the collaboration creator.
+* `queryLogStatus` - (Required - Forces new resource) - Determines if members of the collaboration can enable query logs within their own.
+emberships. Valid values [may be found here](https://docs.aws.amazon.com/clean-rooms/latest/apireference/API_CreateCollaboration.html#API-CreateCollaboration-request-queryLogStatus).
+* `dataEncryptionMetadata` - (Required - Forces new resource) - a collection of settings which determine how the [c3r client](https://docs.aws.amazon.com/clean-rooms/latest/userguide/crypto-computing.html) will encrypt data for use within this collaboration.
+* `dataEncryptionMetadataAllowClearText` - (Required - Forces new resource) - Indicates whether encrypted tables can contain cleartext data. This is a boolea
+ field.
+* `dataEncryptionMetadataAllowDuplicates` - (Required - Forces new resource ) - Indicates whether Fingerprint columns can contain duplicate entries. This is a
+boolean field.
+* `dataEncryptionMetadataAllowJoinsOnColumnsWithDifferentNames` - (Required - Forces new resource) - Indicates whether Fingerprint columns can be joined
+n any other Fingerprint column with a different name. This is a boolean field.
+* `dataEncryptionMetadataPreserveNulls` - (Required - Forces new resource) - Indicates whether NULL values are to be copied as NULL to encrypted tables (true)
+or cryptographically processed (false).
+* `member` - (Optional - Forces new resource) - Additional members of the collaboration which will be invited to join the collaboration.
+* `memberAccountId` - (Required - Forces new resource) - The account id for the invited member.
+* `memberDisplayName` - (Required - Forces new resource) - The display name for the invited member.
+* `memberMemberAbilities` - (Required - Forces new resource) - The list of abilities for the invited member. Valid values [may be found here](https://docs.aws.amazon.com/clean-rooms/latest/apireference/API_CreateCollaboration.html#API-CreateCollaboration-request-creatorMemberAbilities).
+* `tags` - (Optional) - Key value pairs which tag the collaboration.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The arn of the collaboration.
+* `id` - The id of the collaboration.
+* `createTime` - The date and time the collaboration was created.
+* `member status` - For each member included in the collaboration an additional computed attribute of status is added. These values [may be found here](https://docs.aws.amazon.com/clean-rooms/latest/apireference/API_MemberSummary.html#API-Type-MemberSummary-status).
+* `updatedTime` - The date and time the collaboration was last updated.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `1M`)
+- `update` - (Default `1M`)
+- `delete` - (Default `1M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsCleanroomsCollaboration` using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsCleanroomsCollaboration` using the `id`. For example:
+
+```console
+% terraform import aws_cleanrooms_collaboration.collaboration 1234abcd-12ab-34cd-56ef-1234567890ab
+```
+
+<!-- cache-key: cdktf-0.18.0 input-395ee6487e82b1be6f52fee6f12058bc05b7b0fad6b5632c7701a3893516718e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/cleanrooms_configured_table.html.markdown b/website/docs/cdktf/typescript/r/cleanrooms_configured_table.html.markdown
new file mode 100644
index 00000000000..56381b4bd47
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/cleanrooms_configured_table.html.markdown
@@ -0,0 +1,101 @@
+---
+subcategory: "Clean Rooms"
+layout: "aws"
+page_title: "AWS: aws_cleanrooms_configured_table"
+description: |-
+  Provides a Clean Rooms Configured Table.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cleanrooms_configured_table
+
+Provides a AWS Clean Rooms configured table. Configured tables are used to represent references to existing tables in the AWS Glue Data Catalog.
+
+## Example Usage
+
+### Configured table with tags
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CleanroomsConfiguredTable } from "./.gen/providers/aws/cleanrooms-configured-table";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new CleanroomsConfiguredTable(this, "test_configured_table", {
+      allowedColumns: ["column1", "column2", "column3"],
+      analysisMethod: "DIRECT_QUERY",
+      description: "I made this table with terraform!",
+      name: "terraform-example-table",
+      tableReference: {
+        databaseName: "example_database",
+        tableName: "example_table",
+      },
+      tags: {
+        Project: "Terraform",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) - The name of the configured table.
+* `description` - (Optional) - A description for the configured table.
+* `analysisMethod` - (Required) - The analysis method for the configured table. The only valid value is currently `directQuery`.
+* `allowedColumns` - (Required - Forces new resource) - The columns of the references table which will be included in the configured table.
+* `tableReference` - (Required - Forces new resource) - A reference to the AWS Glue table which will be used to create the configured table.
+* `tableReferenceDatabaseName` - (Required - Forces new resource) - The name of the AWS Glue database which contains the table.
+* `tableReferenceTableName` - (Required - Forces new resource) - The name of the AWS Glue table which will be used to create the configured table.
+* `tags` - (Optional) - Key value pairs which tag the configured table.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the configured table.
+* `id` - The ID of the configured table.
+* `createTime` - The date and time the configured table was created.
+* `updateTime` - The date and time the configured table was last updated.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `1M`)
+- `update` - (Default `1M`)
+- `delete` - (Default `1M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsCleanroomsConfiguredTable` using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsCleanroomsConfiguredTable` using the `id`. For example:
+
+```console
+% terraform import aws_cleanrooms_configured_table.table 1234abcd-12ab-34cd-56ef-1234567890ab
+```
+
+<!-- cache-key: cdktf-0.18.0 input-453a78d0a031324d090ad2bc765ccc4d2f1ec41c65c0d162ac12a0a01d1fb07d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/cloud9_environment_ec2.html.markdown b/website/docs/cdktf/typescript/r/cloud9_environment_ec2.html.markdown
new file mode 100644
index 00000000000..1ff2467f2f0
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/cloud9_environment_ec2.html.markdown
@@ -0,0 +1,158 @@
+---
+subcategory: "Cloud9"
+layout: "aws"
+page_title: "AWS: aws_cloud9_environment_ec2"
+description: |-
+  Provides a Cloud9 EC2 Development Environment.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloud9_environment_ec2
+
+Provides a Cloud9 EC2 Development Environment.
+
+## Example Usage
+
+Basic usage:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Cloud9EnvironmentEc2 } from "./.gen/providers/aws/cloud9-environment-ec2";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Cloud9EnvironmentEc2(this, "example", {
+      instanceType: "t2.micro",
+      name: "example-env",
+    });
+  }
+}
+
+```
+
+Get the URL of the Cloud9 environment after creation:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformOutput, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Cloud9EnvironmentEc2 } from "./.gen/providers/aws/cloud9-environment-ec2";
+import { DataAwsInstance } from "./.gen/providers/aws/data-aws-instance";
+interface MyConfig {
+  name: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    const example = new Cloud9EnvironmentEc2(this, "example", {
+      instanceType: "t2.micro",
+      name: config.name,
+    });
+    new DataAwsInstance(this, "cloud9_instance", {
+      filter: [
+        {
+          name: "tag:aws:cloud9:environment",
+          values: [example.id],
+        },
+      ],
+    });
+    new TerraformOutput(this, "cloud9_url", {
+      value:
+        "https://${" +
+        region.value +
+        "}.console.aws.amazon.com/cloud9/ide/${" +
+        example.id +
+        "}",
+    });
+  }
+}
+
+```
+
+Allocate a static IP to the Cloud9 environment:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformOutput, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Cloud9EnvironmentEc2 } from "./.gen/providers/aws/cloud9-environment-ec2";
+import { DataAwsInstance } from "./.gen/providers/aws/data-aws-instance";
+import { Eip } from "./.gen/providers/aws/eip";
+interface MyConfig {
+  name: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    const example = new Cloud9EnvironmentEc2(this, "example", {
+      instanceType: "t2.micro",
+      name: config.name,
+    });
+    const cloud9Instance = new DataAwsInstance(this, "cloud9_instance", {
+      filter: [
+        {
+          name: "tag:aws:cloud9:environment",
+          values: [example.id],
+        },
+      ],
+    });
+    const cloud9Eip = new Eip(this, "cloud9_eip", {
+      domain: "vpc",
+      instance: Token.asString(cloud9Instance.id),
+    });
+    new TerraformOutput(this, "cloud9_public_ip", {
+      value: cloud9Eip.publicIp,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the environment.
+* `instanceType` - (Required) The type of instance to connect to the environment, e.g., `t2Micro`.
+* `automaticStopTimeMinutes` - (Optional) The number of minutes until the running instance is shut down after the environment has last been used.
+* `connectionType` - (Optional) The connection type used for connecting to an Amazon EC2 environment. Valid values are `connectSsh` and `connectSsm`. For more information please refer [AWS documentation for Cloud9](https://docs.aws.amazon.com/cloud9/latest/user-guide/ec2-ssm.html).
+* `description` - (Optional) The description of the environment.
+* `imageId` - (Optional) The identifier for the Amazon Machine Image (AMI) that's used to create the EC2 instance. Valid values are
+    * `amazonlinux1X8664`
+    * `amazonlinux2X8664`
+    * `ubuntu1804X8664`
+    * `ubuntu2204X8664`
+    * `resolve:ssm:/aws/service/cloud9/amis/amazonlinux1X8664`
+    * `resolve:ssm:/aws/service/cloud9/amis/amazonlinux2X8664`
+    * `resolve:ssm:/aws/service/cloud9/amis/ubuntu1804X8664`
+    * `resolve:ssm:/aws/service/cloud9/amis/ubuntu2204X8664`
+
+* `ownerArn` - (Optional) The ARN of the environment owner. This can be ARN of any AWS IAM principal. Defaults to the environment's creator.
+* `subnetId` - (Optional) The ID of the subnet in Amazon VPC that AWS Cloud9 will use to communicate with the Amazon EC2 instance.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the environment.
+* `arn` - The ARN of the environment.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `type` - The type of the environment (e.g., `ssh` or `ec2`)
+
+<!-- cache-key: cdktf-0.18.0 input-0a7b7bb4db1f7b69891ee6f0c3a4d079fd3d0b45f3d6b81be48656fbea075db1 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/cloud9_environment_membership.html.markdown b/website/docs/cdktf/typescript/r/cloud9_environment_membership.html.markdown
new file mode 100644
index 00000000000..4c66f4902aa
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/cloud9_environment_membership.html.markdown
@@ -0,0 +1,93 @@
+---
+subcategory: "Cloud9"
+layout: "aws"
+page_title: "AWS: aws_cloud9_environment_membership"
+description: |-
+  Provides an environment member to an AWS Cloud9 development environment.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloud9_environment_membership
+
+Provides an environment member to an AWS Cloud9 development environment.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Cloud9EnvironmentEc2 } from "./.gen/providers/aws/cloud9-environment-ec2";
+import { Cloud9EnvironmentMembership } from "./.gen/providers/aws/cloud9-environment-membership";
+import { IamUser } from "./.gen/providers/aws/iam-user";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const test = new Cloud9EnvironmentEc2(this, "test", {
+      instanceType: "t2.micro",
+      name: "some-env",
+    });
+    const awsIamUserTest = new IamUser(this, "test_1", {
+      name: "some-user",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamUserTest.overrideLogicalId("test");
+    const awsCloud9EnvironmentMembershipTest = new Cloud9EnvironmentMembership(
+      this,
+      "test_2",
+      {
+        environmentId: test.id,
+        permissions: "read-only",
+        userArn: Token.asString(awsIamUserTest.arn),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsCloud9EnvironmentMembershipTest.overrideLogicalId("test");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `environmentId` - (Required) The ID of the environment that contains the environment member you want to add.
+* `permissions` - (Required) The type of environment member permissions you want to associate with this environment member. Allowed values are `readOnly` and `readWrite` .
+* `userArn` - (Required) The Amazon Resource Name (ARN) of the environment member you want to add.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the environment membership.
+* `userId` - he user ID in AWS Identity and Access Management (AWS IAM) of the environment member.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Cloud9 environment membership using the `environmentId#userArn`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Cloud9 environment membership using the `environmentId#userArn`. For example:
+
+```console
+% terraform import aws_cloud9_environment_membership.test environment-id#user-arn
+```
+
+<!-- cache-key: cdktf-0.18.0 input-10e00164fec66c387e4ef6582684bf8de89732c31df86387c3215daa6335723f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/cloud9_environment_membership.markdown b/website/docs/cdktf/typescript/r/cloud9_environment_membership.markdown
new file mode 100644
index 00000000000..4c66f4902aa
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/cloud9_environment_membership.markdown
@@ -0,0 +1,93 @@
+---
+subcategory: "Cloud9"
+layout: "aws"
+page_title: "AWS: aws_cloud9_environment_membership"
+description: |-
+  Provides an environment member to an AWS Cloud9 development environment.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloud9_environment_membership
+
+Provides an environment member to an AWS Cloud9 development environment.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Cloud9EnvironmentEc2 } from "./.gen/providers/aws/cloud9-environment-ec2";
+import { Cloud9EnvironmentMembership } from "./.gen/providers/aws/cloud9-environment-membership";
+import { IamUser } from "./.gen/providers/aws/iam-user";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const test = new Cloud9EnvironmentEc2(this, "test", {
+      instanceType: "t2.micro",
+      name: "some-env",
+    });
+    const awsIamUserTest = new IamUser(this, "test_1", {
+      name: "some-user",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamUserTest.overrideLogicalId("test");
+    const awsCloud9EnvironmentMembershipTest = new Cloud9EnvironmentMembership(
+      this,
+      "test_2",
+      {
+        environmentId: test.id,
+        permissions: "read-only",
+        userArn: Token.asString(awsIamUserTest.arn),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsCloud9EnvironmentMembershipTest.overrideLogicalId("test");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `environmentId` - (Required) The ID of the environment that contains the environment member you want to add.
+* `permissions` - (Required) The type of environment member permissions you want to associate with this environment member. Allowed values are `readOnly` and `readWrite` .
+* `userArn` - (Required) The Amazon Resource Name (ARN) of the environment member you want to add.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the environment membership.
+* `userId` - he user ID in AWS Identity and Access Management (AWS IAM) of the environment member.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Cloud9 environment membership using the `environmentId#userArn`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Cloud9 environment membership using the `environmentId#userArn`. For example:
+
+```console
+% terraform import aws_cloud9_environment_membership.test environment-id#user-arn
+```
+
+<!-- cache-key: cdktf-0.18.0 input-10e00164fec66c387e4ef6582684bf8de89732c31df86387c3215daa6335723f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/cloudcontrolapi_resource.html.markdown b/website/docs/cdktf/typescript/r/cloudcontrolapi_resource.html.markdown
new file mode 100644
index 00000000000..cc8e890f9a1
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/cloudcontrolapi_resource.html.markdown
@@ -0,0 +1,67 @@
+---
+subcategory: "Cloud Control API"
+layout: "aws"
+page_title: "AWS: aws_cloudcontrolapi_resource"
+description: |-
+    Manages a Cloud Control API Resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudcontrolapi_resource
+
+Manages a Cloud Control API Resource. The configuration and lifecycle handling of these resources is proxied through Cloud Control API handlers to the backend service.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudcontrolapiResource } from "./.gen/providers/aws/cloudcontrolapi-resource";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new CloudcontrolapiResource(this, "example", {
+      desiredState: Token.asString(
+        Fn.jsonencode({
+          ClusterName: "example",
+          Tags: [
+            {
+              Key: "CostCenter",
+              Value: "IT",
+            },
+          ],
+        })
+      ),
+      typeName: "AWS::ECS::Cluster",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `desiredState` - (Required) JSON string matching the CloudFormation resource type schema with desired configuration. Terraform configuration expressions can be converted into JSON using the [`jsonencode()` function](https://www.terraform.io/docs/language/functions/jsonencode.html).
+* `typeName` - (Required) CloudFormation resource type name. For example, `aws::ec2::vpc`.
+
+The following arguments are optional:
+
+* `roleArn` - (Optional) Amazon Resource Name (ARN) of the IAM Role to assume for operations.
+* `schema` - (Optional) JSON string of the CloudFormation resource type schema which is used for plan time validation where possible. Automatically fetched if not provided. In large scale environments with multiple resources using the same `typeName`, it is recommended to fetch the schema once via the [`awsCloudformationType` data source](/docs/providers/aws/d/cloudformation_type.html) and use this argument to reduce `describeType` API operation throttling. This value is marked sensitive only to prevent large plan differences from showing.
+* `typeVersionId` - (Optional) Identifier of the CloudFormation resource type version.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `properties` - JSON string matching the CloudFormation resource type schema with current configuration. Underlying attributes can be referenced via the [`jsondecode()` function](https://www.terraform.io/docs/language/functions/jsondecode.html), for example, `jsondecode(dataAwsCloudcontrolapiResourceExampleProperties)["example"]`.
+
+<!-- cache-key: cdktf-0.18.0 input-cf513e77c3363383fd47f2e480126cd6439d06b2a5ae773b5b9401ac9b353ec6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/cloudformation_stack.html.markdown b/website/docs/cdktf/typescript/r/cloudformation_stack.html.markdown
new file mode 100644
index 00000000000..52821820187
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/cloudformation_stack.html.markdown
@@ -0,0 +1,129 @@
+---
+subcategory: "CloudFormation"
+layout: "aws"
+page_title: "AWS: aws_cloudformation_stack"
+description: |-
+  Provides a CloudFormation Stack resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudformation_stack
+
+Provides a CloudFormation Stack resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudformationStack } from "./.gen/providers/aws/cloudformation-stack";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new CloudformationStack(this, "network", {
+      name: "networking-stack",
+      parameters: {
+        VPCCidr: "10.0.0.0/16",
+      },
+      templateBody: Token.asString(
+        Fn.jsonencode({
+          Parameters: {
+            VPCCidr: {
+              Default: "10.0.0.0/16",
+              Description:
+                "Enter the CIDR block for the VPC. Default is 10.0.0.0/16.",
+              Type: "String",
+            },
+          },
+          Resources: {
+            myVpc: {
+              Properties: {
+                CidrBlock: {
+                  Ref: "VPCCidr",
+                },
+                Tags: [
+                  {
+                    Key: "Name",
+                    Value: "Primary_CF_VPC",
+                  },
+                ],
+              },
+              Type: "AWS::EC2::VPC",
+            },
+          },
+        })
+      ),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) Stack name.
+* `templateBody` - (Optional) Structure containing the template body (max size: 51,200 bytes).
+* `templateUrl` - (Optional) Location of a file containing the template body (max size: 460,800 bytes).
+* `capabilities` - (Optional) A list of capabilities.
+  Valid values: `capabilityIam`, `capabilityNamedIam`, or `capabilityAutoExpand`
+* `disableRollback` - (Optional) Set to true to disable rollback of the stack if stack creation failed.
+  Conflicts with `onFailure`.
+* `notificationArns` - (Optional) A list of SNS topic ARNs to publish stack related events.
+* `onFailure` - (Optional) Action to be taken if stack creation fails. This must be
+  one of: `doNothing`, `rollback`, or `delete`. Conflicts with `disableRollback`.
+* `parameters` - (Optional) A map of Parameter structures that specify input parameters for the stack.
+* `policyBody` - (Optional) Structure containing the stack policy body.
+  Conflicts w/ `policyUrl`.
+* `policyUrl` - (Optional) Location of a file containing the stack policy.
+  Conflicts w/ `policyBody`.
+* `tags` - (Optional) Map of resource tags to associate with this stack. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `iamRoleArn` - (Optional) The ARN of an IAM role that AWS CloudFormation assumes to create the stack. If you don't specify a value, AWS CloudFormation uses the role that was previously associated with the stack. If no role is available, AWS CloudFormation uses a temporary session that is generated from your user credentials.
+* `timeoutInMinutes` - (Optional) The amount of time that can pass before the stack status becomes `createFailed`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - A unique identifier of the stack.
+* `outputs` - A map of outputs from the stack.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `30M`)
+- `update` - (Default `30M`)
+- `delete` - (Default `30M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Cloudformation Stacks using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Cloudformation Stacks using the `name`. For example:
+
+```console
+% terraform import aws_cloudformation_stack.stack networking-stack
+```
+
+<!-- cache-key: cdktf-0.18.0 input-c53bfbdca12c0eaf80e8a2eed58d9aa3dfa199b8365b1dbcd91c0ab7688d53d5 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/cloudformation_stack_set.html.markdown b/website/docs/cdktf/typescript/r/cloudformation_stack_set.html.markdown
new file mode 100644
index 00000000000..f38c0aeb290
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/cloudformation_stack_set.html.markdown
@@ -0,0 +1,227 @@
+---
+subcategory: "CloudFormation"
+layout: "aws"
+page_title: "AWS: aws_cloudformation_stack_set"
+description: |-
+  Manages a CloudFormation StackSet.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudformation_stack_set
+
+Manages a CloudFormation StackSet. StackSets allow CloudFormation templates to be easily deployed across multiple accounts and regions via StackSet Instances ([`awsCloudformationStackSetInstance` resource](/docs/providers/aws/r/cloudformation_stack_set_instance.html)). Additional information about StackSets can be found in the [AWS CloudFormation User Guide](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/what-is-cfnstacksets.html).
+
+~> **NOTE:** All template parameters, including those with a `default`, must be configured or ignored with the `lifecycle` configuration block `ignoreChanges` argument.
+
+~> **NOTE:** All `noEcho` template parameters must be ignored with the `lifecycle` configuration block `ignoreChanges` argument.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, Fn, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudformationStackSet } from "./.gen/providers/aws/cloudformation-stack-set";
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+import { IamRolePolicy } from "./.gen/providers/aws/iam-role-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const awsCloudFormationStackSetAdministrationRoleAssumeRolePolicy =
+      new DataAwsIamPolicyDocument(
+        this,
+        "AWSCloudFormationStackSetAdministrationRole_assume_role_policy",
+        {
+          statement: [
+            {
+              actions: ["sts:AssumeRole"],
+              effect: "Allow",
+              principals: [
+                {
+                  identifiers: ["cloudformation.amazonaws.com"],
+                  type: "Service",
+                },
+              ],
+            },
+          ],
+        }
+      );
+    const awsCloudFormationStackSetAdministrationRole = new IamRole(
+      this,
+      "AWSCloudFormationStackSetAdministrationRole",
+      {
+        assumeRolePolicy: Token.asString(
+          awsCloudFormationStackSetAdministrationRoleAssumeRolePolicy.json
+        ),
+        name: "AWSCloudFormationStackSetAdministrationRole",
+      }
+    );
+    const example = new CloudformationStackSet(this, "example", {
+      administrationRoleArn: awsCloudFormationStackSetAdministrationRole.arn,
+      name: "example",
+      parameters: {
+        VPCCidr: "10.0.0.0/16",
+      },
+      templateBody: Token.asString(
+        Fn.jsonencode({
+          Parameters: {
+            VPCCidr: {
+              Default: "10.0.0.0/16",
+              Description:
+                "Enter the CIDR block for the VPC. Default is 10.0.0.0/16.",
+              Type: "String",
+            },
+          },
+          Resources: {
+            myVpc: {
+              Properties: {
+                CidrBlock: {
+                  Ref: "VPCCidr",
+                },
+                Tags: [
+                  {
+                    Key: "Name",
+                    Value: "Primary_CF_VPC",
+                  },
+                ],
+              },
+              Type: "AWS::EC2::VPC",
+            },
+          },
+        })
+      ),
+    });
+    const awsCloudFormationStackSetAdministrationRoleExecutionPolicy =
+      new DataAwsIamPolicyDocument(
+        this,
+        "AWSCloudFormationStackSetAdministrationRole_ExecutionPolicy",
+        {
+          statement: [
+            {
+              actions: ["sts:AssumeRole"],
+              effect: "Allow",
+              resources: [
+                "arn:aws:iam::*:role/${" + example.executionRoleName + "}",
+              ],
+            },
+          ],
+        }
+      );
+    const awsIamRolePolicyAwsCloudFormationStackSetAdministrationRoleExecutionPolicy =
+      new IamRolePolicy(
+        this,
+        "AWSCloudFormationStackSetAdministrationRole_ExecutionPolicy_4",
+        {
+          name: "ExecutionPolicy",
+          policy: Token.asString(
+            awsCloudFormationStackSetAdministrationRoleExecutionPolicy.json
+          ),
+          role: awsCloudFormationStackSetAdministrationRole.name,
+        }
+      );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamRolePolicyAwsCloudFormationStackSetAdministrationRoleExecutionPolicy.overrideLogicalId(
+      "AWSCloudFormationStackSetAdministrationRole_ExecutionPolicy"
+    );
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `administrationRoleArn` - (Optional) Amazon Resource Number (ARN) of the IAM Role in the administrator account. This must be defined when using the `selfManaged` permission model.
+* `autoDeployment` - (Optional) Configuration block containing the auto-deployment model for your StackSet. This can only be defined when using the `serviceManaged` permission model.
+    * `enabled` - (Optional) Whether or not auto-deployment is enabled.
+    * `retainStacksOnAccountRemoval` - (Optional) Whether or not to retain stacks when the account is removed.
+* `name` - (Required) Name of the StackSet. The name must be unique in the region where you create your StackSet. The name can contain only alphanumeric characters (case-sensitive) and hyphens. It must start with an alphabetic character and cannot be longer than 128 characters.
+* `capabilities` - (Optional) A list of capabilities. Valid values: `capabilityIam`, `capabilityNamedIam`, `capabilityAutoExpand`.
+* `operationPreferences` - (Optional) Preferences for how AWS CloudFormation performs a stack set update.
+* `description` - (Optional) Description of the StackSet.
+* `executionRoleName` - (Optional) Name of the IAM Role in all target accounts for StackSet operations. Defaults to `awsCloudFormationStackSetExecutionRole` when using the `selfManaged` permission model. This should not be defined when using the `serviceManaged` permission model.
+* `managedExecution` - (Optional) Configuration block to allow StackSets to perform non-conflicting operations concurrently and queues conflicting operations.
+    * `active` - (Optional) When set to true, StackSets performs non-conflicting operations concurrently and queues conflicting operations. After conflicting operations finish, StackSets starts queued operations in request order. Default is false.
+* `parameters` - (Optional) Key-value map of input parameters for the StackSet template. All template parameters, including those with a `default`, must be configured or ignored with `lifecycle` configuration block `ignoreChanges` argument. All `noEcho` template parameters must be ignored with the `lifecycle` configuration block `ignoreChanges` argument.
+* `permissionModel` - (Optional) Describes how the IAM roles required for your StackSet are created. Valid values: `selfManaged` (default), `serviceManaged`.
+* `callAs` - (Optional) Specifies whether you are acting as an account administrator in the organization's management account or as a delegated administrator in a member account. Valid values: `self` (default), `delegatedAdmin`.
+* `tags` - (Optional) Key-value map of tags to associate with this StackSet and the Stacks created from it. AWS CloudFormation also propagates these tags to supported resources that are created in the Stacks. A maximum number of 50 tags can be specified. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `templateBody` - (Optional) String containing the CloudFormation template body. Maximum size: 51,200 bytes. Conflicts with `templateUrl`.
+* `templateUrl` - (Optional) String containing the location of a file containing the CloudFormation template body. The URL must point to a template that is located in an Amazon S3 bucket. Maximum location file size: 460,800 bytes. Conflicts with `templateBody`.
+
+### `operationPreferences` Argument Reference
+
+The `operationPreferences` configuration block supports the following arguments:
+
+* `failureToleranceCount` - (Optional) The number of accounts, per Region, for which this operation can fail before AWS CloudFormation stops the operation in that Region.
+* `failureTolerancePercentage` - (Optional) The percentage of accounts, per Region, for which this stack operation can fail before AWS CloudFormation stops the operation in that Region.
+* `maxConcurrentCount` - (Optional) The maximum number of accounts in which to perform this operation at one time.
+* `maxConcurrentPercentage` - (Optional) The maximum percentage of accounts in which to perform this operation at one time.
+* `regionConcurrencyType` - (Optional) The concurrency type of deploying StackSets operations in Regions, could be in parallel or one Region at a time.
+* `regionOrder` - (Optional) The order of the Regions in where you want to perform the stack operation.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the StackSet.
+* `id` - Name of the StackSet.
+* `stackSetId` - Unique identifier of the StackSet.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `update` - (Default `30M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudFormation StackSets using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Import CloudFormation StackSets when acting a delegated administrator in a member account using the `name` and `callAs` values separated by a comma (`,`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import CloudFormation StackSets using the `name`. For example:
+
+```console
+% terraform import aws_cloudformation_stack_set.example example
+```
+
+Using `terraform import`, import CloudFormation StackSets when acting a delegated administrator in a member account using the `name` and `callAs` values separated by a comma (`,`). For example:
+
+```console
+% terraform import aws_cloudformation_stack_set.example example,DELEGATED_ADMIN
+```
+
+<!-- cache-key: cdktf-0.18.0 input-419f928fb2ff9a66818eeeb6e7d41583d5b811405ac256cc0869c14a937c9a2d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/cloudformation_stack_set_instance.html.markdown b/website/docs/cdktf/typescript/r/cloudformation_stack_set_instance.html.markdown
new file mode 100644
index 00000000000..fe44af2d992
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/cloudformation_stack_set_instance.html.markdown
@@ -0,0 +1,275 @@
+---
+subcategory: "CloudFormation"
+layout: "aws"
+page_title: "AWS: aws_cloudformation_stack_set_instance"
+description: |-
+  Manages a CloudFormation StackSet Instance.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudformation_stack_set_instance
+
+Manages a CloudFormation StackSet Instance. Instances are managed in the account and region of the StackSet after the target account permissions have been configured. Additional information about StackSets can be found in the [AWS CloudFormation User Guide](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/what-is-cfnstacksets.html).
+
+~> **NOTE:** All target accounts must have an IAM Role created that matches the name of the execution role configured in the StackSet (the `executionRoleName` argument in the `awsCloudformationStackSet` resource) in a trust relationship with the administrative account or administration IAM Role. The execution role must have appropriate permissions to manage resources defined in the template along with those required for StackSets to operate. See the [AWS CloudFormation User Guide](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-prereqs.html) for more details.
+
+~> **NOTE:** To retain the Stack during Terraform resource destroy, ensure `retain_stack = true` has been successfully applied into the Terraform state first. This must be completed _before_ an apply that would destroy the resource.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudformationStackSetInstance } from "./.gen/providers/aws/cloudformation-stack-set-instance";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new CloudformationStackSetInstance(this, "example", {
+      accountId: "123456789012",
+      region: "us-east-1",
+      stackSetName: Token.asString(awsCloudformationStackSetExample.name),
+    });
+  }
+}
+
+```
+
+### Example IAM Setup in Target Account
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+import { IamRolePolicy } from "./.gen/providers/aws/iam-role-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const awsCloudFormationStackSetExecutionRoleMinimumExecutionPolicy =
+      new DataAwsIamPolicyDocument(
+        this,
+        "AWSCloudFormationStackSetExecutionRole_MinimumExecutionPolicy",
+        {
+          statement: [
+            {
+              actions: ["cloudformation:*", "s3:*", "sns:*"],
+              effect: "Allow",
+              resources: ["*"],
+            },
+          ],
+        }
+      );
+    const awsCloudFormationStackSetExecutionRoleAssumeRolePolicy =
+      new DataAwsIamPolicyDocument(
+        this,
+        "AWSCloudFormationStackSetExecutionRole_assume_role_policy",
+        {
+          statement: [
+            {
+              actions: ["sts:AssumeRole"],
+              effect: "Allow",
+              principals: [
+                {
+                  identifiers: [
+                    awsCloudFormationStackSetAdministrationRole.arn,
+                  ],
+                  type: "AWS",
+                },
+              ],
+            },
+          ],
+        }
+      );
+    const awsCloudFormationStackSetExecutionRole = new IamRole(
+      this,
+      "AWSCloudFormationStackSetExecutionRole",
+      {
+        assumeRolePolicy: Token.asString(
+          awsCloudFormationStackSetExecutionRoleAssumeRolePolicy.json
+        ),
+        name: "AWSCloudFormationStackSetExecutionRole",
+      }
+    );
+    const awsIamRolePolicyAwsCloudFormationStackSetExecutionRoleMinimumExecutionPolicy =
+      new IamRolePolicy(
+        this,
+        "AWSCloudFormationStackSetExecutionRole_MinimumExecutionPolicy_3",
+        {
+          name: "MinimumExecutionPolicy",
+          policy: Token.asString(
+            awsCloudFormationStackSetExecutionRoleMinimumExecutionPolicy.json
+          ),
+          role: awsCloudFormationStackSetExecutionRole.name,
+        }
+      );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamRolePolicyAwsCloudFormationStackSetExecutionRoleMinimumExecutionPolicy.overrideLogicalId(
+      "AWSCloudFormationStackSetExecutionRole_MinimumExecutionPolicy"
+    );
+  }
+}
+
+```
+
+### Example Deployment across Organizations account
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudformationStackSetInstance } from "./.gen/providers/aws/cloudformation-stack-set-instance";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new CloudformationStackSetInstance(this, "example", {
+      deploymentTargets: {
+        organizationalUnitIds: [
+          Token.asString(
+            Fn.lookupNested(awsOrganizationsOrganizationExample.roots, [
+              "0",
+              "id",
+            ])
+          ),
+        ],
+      },
+      region: "us-east-1",
+      stackSetName: Token.asString(awsCloudformationStackSetExample.name),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `stackSetName` - (Required) Name of the StackSet.
+* `accountId` - (Optional) Target AWS Account ID to create a Stack based on the StackSet. Defaults to current account.
+* `deploymentTargets` - (Optional) The AWS Organizations accounts to which StackSets deploys. StackSets doesn't deploy stack instances to the organization management account, even if the organization management account is in your organization or in an OU in your organization. Drift detection is not possible for this argument. See [deployment_targets](#deployment_targets-argument-reference) below.
+* `parameterOverrides` - (Optional) Key-value map of input parameters to override from the StackSet for this Instance.
+* `region` - (Optional) Target AWS Region to create a Stack based on the StackSet. Defaults to current region.
+* `retainStack` - (Optional) During Terraform resource destroy, remove Instance from StackSet while keeping the Stack and its associated resources. Must be enabled in Terraform state _before_ destroy operation to take effect. You cannot reassociate a retained Stack or add an existing, saved Stack to a new StackSet. Defaults to `false`.
+* `callAs` - (Optional) Specifies whether you are acting as an account administrator in the organization's management account or as a delegated administrator in a member account. Valid values: `self` (default), `delegatedAdmin`.
+* `operationPreferences` - (Optional) Preferences for how AWS CloudFormation performs a stack set operation.
+
+### `deploymentTargets` Argument Reference
+
+The `deploymentTargets` configuration block supports the following arguments:
+
+* `organizationalUnitIds` - (Optional) The organization root ID or organizational unit (OU) IDs to which StackSets deploys.
+
+### `operationPreferences` Argument Reference
+
+The `operationPreferences` configuration block supports the following arguments:
+
+* `failureToleranceCount` - (Optional) The number of accounts, per Region, for which this operation can fail before AWS CloudFormation stops the operation in that Region.
+* `failureTolerancePercentage` - (Optional) The percentage of accounts, per Region, for which this stack operation can fail before AWS CloudFormation stops the operation in that Region.
+* `maxConcurrentCount` - (Optional) The maximum number of accounts in which to perform this operation at one time.
+* `maxConcurrentPercentage` - (Optional) The maximum percentage of accounts in which to perform this operation at one time.
+* `regionConcurrencyType` - (Optional) The concurrency type of deploying StackSets operations in Regions, could be in parallel or one Region at a time. Valid values are `sequential` and `parallel`.
+* `regionOrder` - (Optional) The order of the Regions in where you want to perform the stack operation.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Unique identifier for the resource. If `deploymentTargets` is set, this is a comma-delimited string combining stack set name, organizational unit IDs (`/`-delimited), and region (ie. `mystack,ou123/ou456,usEast1`). Otherwise, this is a comma-delimited string combining stack set name, AWS account ID, and region (ie. `mystack,123456789012,usEast1`).
+* `organizationalUnitId` - The organization root ID or organizational unit (OU) ID in which the stack is deployed.
+* `stackId` - Stack identifier.
+* `stackInstanceSummaries` - List of stack instances created from an organizational unit deployment target. This will only be populated when `deploymentTargets` is set. See [`stackInstanceSummaries`](#stack_instance_summaries-attribute-reference).
+
+### `stackInstanceSummaries` Attribute Reference
+
+* `accountId` - AWS account ID in which the stack is deployed.
+* `organizationalUnitId` - Organizational unit ID in which the stack is deployed.
+* `stackId` - Stack identifier.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `30M`)
+* `update` - (Default `30M`)
+* `delete` - (Default `30M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudFormation StackSet Instances that target an AWS Account ID using the StackSet name, target AWS account ID, and target AWS Region separated by commas (`,`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Import CloudFormation StackSet Instances that target AWS Organizational Units using the StackSet name, a slash (`/`) separated list of organizational unit IDs, and target AWS Region separated by commas (`,`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Import CloudFormation StackSet Instances when acting a delegated administrator in a member account using the StackSet name, target AWS account ID or slash (`/`) separated list of organizational unit IDs, target AWS Region and `callAs` value separated by commas (`,`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import CloudFormation StackSet Instances that target an AWS Account ID using the StackSet name, target AWS account ID, and target AWS Region separated by commas (`,`). For example:
+
+```console
+% terraform import aws_cloudformation_stack_set_instance.example example,123456789012,us-east-1
+```
+
+Using `terraform import`, import CloudFormation StackSet Instances that target AWS Organizational Units using the StackSet name, a slash (`/`) separated list of organizational unit IDs, and target AWS Region separated by commas (`,`). For example:
+
+```console
+% terraform import aws_cloudformation_stack_set_instance.example example,ou-sdas-123123123/ou-sdas-789789789,us-east-1
+```
+
+Using `terraform import`, import CloudFormation StackSet Instances when acting a delegated administrator in a member account using the StackSet name, target AWS account ID or slash (`/`) separated list of organizational unit IDs, target AWS Region and `callAs` value separated by commas (`,`). For example:
+
+```console
+% terraform import aws_cloudformation_stack_set_instance.example example,ou-sdas-123123123/ou-sdas-789789789,us-east-1,DELEGATED_ADMIN
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1e1b74c9b69f000ae028bff21e6d418d876fa6006347b01a1cc908f1b3a20e44 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/cloudformation_type.html.markdown b/website/docs/cdktf/typescript/r/cloudformation_type.html.markdown
new file mode 100644
index 00000000000..6258623f13f
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/cloudformation_type.html.markdown
@@ -0,0 +1,109 @@
+---
+subcategory: "CloudFormation"
+layout: "aws"
+page_title: "AWS: aws_cloudformation_type"
+description: |-
+    Manages a version of a CloudFormation Type.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudformation_type
+
+Manages a version of a CloudFormation Type.
+
+~> **NOTE:** The destroy operation of this resource marks the version as deprecated. If this was the only `live` version, the type is marked as deprecated. Enable the [resource `lifecycle` configuration block `createBeforeDestroy` argument](https://www.terraform.io/language/meta-arguments/lifecycle#create_before_destroy) in this resource configuration to properly order redeployments in Terraform.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudformationType } from "./.gen/providers/aws/cloudformation-type";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new CloudformationType(this, "example", {
+      lifecycle: {
+        createBeforeDestroy: true,
+      },
+      loggingConfig: {
+        logGroupName: Token.asString(awsCloudwatchLogGroupExample.name),
+        logRoleArn: Token.asString(awsIamRoleExample.arn),
+      },
+      schemaHandlerPackage:
+        "s3://${" +
+        awsS3ObjectExample.bucket +
+        "}/${" +
+        awsS3ObjectExample.key +
+        "}",
+      type: "RESOURCE",
+      typeName: "ExampleCompany::ExampleService::ExampleResource",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `executionRoleArn` - (Optional) Amazon Resource Name (ARN) of the IAM Role for CloudFormation to assume when invoking the extension. If your extension calls AWS APIs in any of its handlers, you must create an IAM execution role that includes the necessary permissions to call those AWS APIs, and provision that execution role in your account. When CloudFormation needs to invoke the extension handler, CloudFormation assumes this execution role to create a temporary session token, which it then passes to the extension handler, thereby supplying your extension with the appropriate credentials.
+* `loggingConfig` - (Optional) Configuration block containing logging configuration.
+* `schemaHandlerPackage` - (Required) URL to the S3 bucket containing the extension project package that contains the necessary files for the extension you want to register. Must begin with `s3://` or `https://`. For example, `s3://exampleBucket/exampleObject`.
+* `type` - (Optional) CloudFormation Registry Type. For example, `resource` or `module`.
+* `typeName` - (Optional) CloudFormation Type name. For example, `exampleCompany::exampleService::exampleResource`.
+
+### logging_config
+
+The `loggingConfig` configuration block supports the following arguments:
+
+* `logGroupName` - (Required) Name of the CloudWatch Log Group where CloudFormation sends error logging information when invoking the type's handlers.
+* `logRoleArn` - (Required) Amazon Resource Name (ARN) of the IAM Role CloudFormation assumes when sending error logging information to CloudWatch Logs.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - (Optional) Amazon Resource Name (ARN) of the CloudFormation Type version. See also `typeArn`.
+* `defaultVersionId` - Identifier of the CloudFormation Type default version.
+* `deprecatedStatus` - Deprecation status of the version.
+* `description` - Description of the version.
+* `documentationUrl` - URL of the documentation for the CloudFormation Type.
+* `isDefaultVersion` - Whether the CloudFormation Type version is the default version.
+* `provisioningType` - Provisioning behavior of the CloudFormation Type.
+* `schema` - JSON document of the CloudFormation Type schema.
+* `sourceUrl` - URL of the source code for the CloudFormation Type.
+* `typeArn` - (Optional) Amazon Resource Name (ARN) of the CloudFormation Type. See also `arn`.
+* `versionId` - (Optional) Identifier of the CloudFormation Type version.
+* `visibility` - Scope of the CloudFormation Type.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsCloudformationType` using the type version Amazon Resource Name (ARN). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsCloudformationType` using the type version Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_cloudformation_type.example arn:aws:cloudformation:us-east-1:123456789012:type/resource/ExampleCompany-ExampleService-ExampleType/1
+```
+
+<!-- cache-key: cdktf-0.18.0 input-4738423c73768d212dce00b4674e015861f2836ad18ef9b55653e2e9fd2462e5 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/cloudfront_cache_policy.html.markdown b/website/docs/cdktf/typescript/r/cloudfront_cache_policy.html.markdown
new file mode 100644
index 00000000000..f79eab25023
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/cloudfront_cache_policy.html.markdown
@@ -0,0 +1,128 @@
+---
+subcategory: "CloudFront"
+layout: "aws"
+page_title: "AWS: aws_cloudfront_cache_policy"
+description: |-
+  Use the `awsCloudfrontCachePolicy` resource to manage cache policies for CloudFront distributions. This resource allows you to attach cache policies to cache behaviors, which determine the values included in the cache key, such as HTTP headers, cookies, and URL query strings. CloudFront uses the cache key to locate cached objects and return them to viewers. Additionally, the cache policy sets the default, minimum, and maximum time to live (TTL) values for objects in the CloudFront cache.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudfront_cache_policy
+
+## Example Usage
+
+Use the `awsCloudfrontCachePolicy` resource to create a cache policy for CloudFront.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudfrontCachePolicy } from "./.gen/providers/aws/cloudfront-cache-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new CloudfrontCachePolicy(this, "example", {
+      comment: "test comment",
+      defaultTtl: 50,
+      maxTtl: 100,
+      minTtl: 1,
+      name: "example-policy",
+      parametersInCacheKeyAndForwardedToOrigin: {
+        cookiesConfig: {
+          cookieBehavior: "whitelist",
+          cookies: {
+            items: ["example"],
+          },
+        },
+        headersConfig: {
+          headerBehavior: "whitelist",
+          headers: {
+            items: ["example"],
+          },
+        },
+        queryStringsConfig: {
+          queryStringBehavior: "whitelist",
+          queryStrings: {
+            items: ["example"],
+          },
+        },
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) Unique name used to identify the cache policy.
+* `minTtl` - (Required) Minimum amount of time, in seconds, that objects should remain in the CloudFront cache before a new request is sent to the origin to check for updates.
+* `maxTtl` - (Optional) Maximum amount of time, in seconds, that objects stay in the CloudFront cache before CloudFront sends another request to the origin to see if the object has been updated.
+* `defaultTtl` - (Optional) Amount of time, in seconds, that objects are allowed to remain in the CloudFront cache before CloudFront sends a new request to the origin server to check if the object has been updated.
+* `comment` - (Optional) Description for the cache policy.
+* `parametersInCacheKeyAndForwardedToOrigin` - (Required) Configuration for including HTTP headers, cookies, and URL query strings in the cache key. For more information, refer to the [Parameters In Cache Key And Forwarded To Origin](#parameters-in-cache-key-and-forwarded-to-origin) section.
+
+### Parameters In Cache Key And Forwarded To Origin
+
+* `cookiesConfig` - (Required) Whether any cookies in viewer requests are included in the cache key and automatically included in requests that CloudFront sends to the origin. See [Cookies Config](#cookies-config) for more information.
+* `headersConfig` - (Required) Whether any HTTP headers are included in the cache key and automatically included in requests that CloudFront sends to the origin. See [Headers Config](#headers-config) for more information.
+* `queryStringsConfig` - (Required) Whether any URL query strings in viewer requests are included in the cache key. It also automatically includes these query strings in requests that CloudFront sends to the origin. Please refer to the [Query String Config](#query-string-config) for more information.
+* `enableAcceptEncodingBrotli` - (Optional) Flag determines whether the Accept-Encoding HTTP header is included in the cache key and in requests that CloudFront sends to the origin.
+* `enableAcceptEncodingGzip` - (Optional) Whether the Accept-Encoding HTTP header is included in the cache key and in requests sent to the origin by CloudFront.
+
+### Cookies Config
+
+* `cookieBehavior` - (Required) Whether any cookies in viewer requests are included in the cache key and automatically included in requests that CloudFront sends to the origin. Valid values for `cookieBehavior` are `none`, `whitelist`, `allExcept`, and `all`.
+* `cookies` - (Optional) Object that contains a list of cookie names. See [Items](#items) for more information.
+
+### Headers Config
+
+* `headerBehavior` - (Required) Whether any HTTP headers are included in the cache key and automatically included in requests that CloudFront sends to the origin. Valid values for `headerBehavior` are `none` and `whitelist`.
+* `headers` - (Optional) Object contains a list of header names. See [Items](#items) for more information.
+
+### Query String Config
+
+* `queryStringBehavior` - (Required) Whether URL query strings in viewer requests are included in the cache key and automatically included in requests that CloudFront sends to the origin. Valid values for `queryStringBehavior` are `none`, `whitelist`, `allExcept`, and `all`.
+* `queryStrings` - (Optional) Configuration parameter that contains a list of query string names. See [Items](#items) for more information.
+
+### Items
+
+* `items` - (Required) List of item names, such as cookies, headers, or query strings.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `etag` - Current version of the cache policy.
+* `id` - Identifier for the cache policy.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudFront cache policies using the `id` of the cache policy. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import CloudFront cache policies using the `id` of the cache policy. For example:
+
+```console
+% terraform import aws_cloudfront_cache_policy.policy 658327ea-f89d-4fab-a63d-7e88639e58f6
+```
+
+<!-- cache-key: cdktf-0.18.0 input-8fda72f4e7c4165f1b2aa65dbf0738cc394e0490f46a68016d550c5ffee31214 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/cloudfront_continuous_deployment_policy.html.markdown b/website/docs/cdktf/typescript/r/cloudfront_continuous_deployment_policy.html.markdown
new file mode 100644
index 00000000000..41fb8047742
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/cloudfront_continuous_deployment_policy.html.markdown
@@ -0,0 +1,228 @@
+---
+subcategory: "CloudFront"
+layout: "aws"
+page_title: "AWS: aws_cloudfront_continuous_deployment_policy"
+description: |-
+  Terraform resource for managing an AWS CloudFront Continuous Deployment Policy.
+---
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudfront_continuous_deployment_policy
+
+Terraform resource for managing an AWS CloudFront Continuous Deployment Policy.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudfrontContinuousDeploymentPolicy } from "./.gen/providers/aws/cloudfront-continuous-deployment-policy";
+import { CloudfrontDistribution } from "./.gen/providers/aws/cloudfront-distribution";
+interface MyConfig {
+  defaultCacheBehavior: any;
+  origin: any;
+  restrictions: any;
+  viewerCertificate: any;
+  defaultCacheBehavior1: any;
+  origin1: any;
+  restrictions1: any;
+  viewerCertificate1: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    const staging = new CloudfrontDistribution(this, "staging", {
+      enabled: true,
+      staging: true,
+      defaultCacheBehavior: config.defaultCacheBehavior,
+      origin: config.origin,
+      restrictions: config.restrictions,
+      viewerCertificate: config.viewerCertificate,
+    });
+    const example = new CloudfrontContinuousDeploymentPolicy(this, "example", {
+      enabled: true,
+      stagingDistributionDnsNames: [
+        {
+          items: [staging.domainName],
+          quantity: 1,
+        },
+      ],
+      trafficConfig: [
+        {
+          singleWeightConfig: [
+            {
+              weight: Token.asNumber("0.01"),
+            },
+          ],
+          type: "SingleWeight",
+        },
+      ],
+    });
+    new CloudfrontDistribution(this, "production", {
+      continuousDeploymentPolicyId: example.id,
+      enabled: true,
+      defaultCacheBehavior: config.defaultCacheBehavior1,
+      origin: config.origin1,
+      restrictions: config.restrictions1,
+      viewerCertificate: config.viewerCertificate1,
+    });
+  }
+}
+
+```
+
+### Single Weight Config with Session Stickiness
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudfrontContinuousDeploymentPolicy } from "./.gen/providers/aws/cloudfront-continuous-deployment-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new CloudfrontContinuousDeploymentPolicy(this, "example", {
+      enabled: true,
+      stagingDistributionDnsNames: [
+        {
+          items: [staging.domainName],
+          quantity: 1,
+        },
+      ],
+      trafficConfig: [
+        {
+          singleWeightConfig: [
+            {
+              sessionStickinessConfig: [
+                {
+                  idleTtl: 300,
+                  maximumTtl: 600,
+                },
+              ],
+              weight: Token.asNumber("0.01"),
+            },
+          ],
+          type: "SingleWeight",
+        },
+      ],
+    });
+  }
+}
+
+```
+
+### Single Header Config
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudfrontContinuousDeploymentPolicy } from "./.gen/providers/aws/cloudfront-continuous-deployment-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new CloudfrontContinuousDeploymentPolicy(this, "example", {
+      enabled: true,
+      stagingDistributionDnsNames: [
+        {
+          items: [staging.domainName],
+          quantity: 1,
+        },
+      ],
+      trafficConfig: [
+        {
+          singleHeaderConfig: [
+            {
+              header: "aws-cf-cd-example",
+              value: "example",
+            },
+          ],
+          type: "SingleHeader",
+        },
+      ],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `enabled` - (Required) Whether this continuous deployment policy is enabled.
+* `stagingDistributionDnsNames` - (Required) CloudFront domain name of the staging distribution. See [`stagingDistributionDnsNames`](#staging_distribution_dns_names).
+* `trafficConfig` - (Required) Parameters for routing production traffic from primary to staging distributions. See [`trafficConfig`](#traffic_config).
+
+### `stagingDistributionDnsNames`
+
+* `items` - (Required) A list of CloudFront domain names for the staging distribution.
+* `quantity` - (Required) Number of CloudFront domain names in the staging distribution.
+
+### `trafficConfig`
+
+* `type` - (Required) Type of traffic configuration. Valid values are `singleWeight` and `singleHeader`.
+* `singleHeaderConfig` - (Optional) Determines which HTTP requests are sent to the staging distribution. See [`singleHeaderConfig`](#single_header_config).
+* `singleWeightConfig` - (Optional) Contains the percentage of traffic to send to the staging distribution. See [`singleWeightConfig`](#single_weight_config).
+
+### `singleHeaderConfig`
+
+* `header` - (Required) Request header name to send to the staging distribution. The header must contain the prefix `awsCfCd`.
+* `value` - (Required) Request header value.
+
+### `singleWeightConfig`
+
+* `weight` - (Required) The percentage of traffic to send to a staging distribution, expressed as a decimal number between `0` and `15`.
+* `sessionStickinessConfig` - (Optional) Session stickiness provides the ability to define multiple requests from a single viewer as a single session. This prevents the potentially inconsistent experience of sending some of a given user's requests to the staging distribution, while others are sent to the primary distribution. Define the session duration using TTL values. See [`sessionStickinessConfig`](#session_stickiness_config).
+
+### `sessionStickinessConfig`
+
+* `idleTtl` - (Required) The amount of time in seconds after which sessions will cease if no requests are received. Valid values are `300` – `3600` (5–60 minutes). The value must be less than or equal to `maximumTtl`.
+* `maximumTtl` - (Required) The maximum amount of time in seconds to consider requests from the viewer as being part of the same session. Valid values are `300` – `3600` (5–60 minutes). The value must be greater than or equal to `idleTtl`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `etag` - Current version of the continuous distribution policy.
+* `id` - Identifier of the continuous deployment policy.
+* `lastModifiedTime` - Date and time the continuous deployment policy was last modified.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudFront Continuous Deployment Policy using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import CloudFront Continuous Deployment Policy using the `id`. For example:
+
+```console
+% terraform import aws_cloudfront_continuous_deployment_policy.example abcd-1234 
+```
+
+<!-- cache-key: cdktf-0.18.0 input-10ca91c1c5f42a4e7c34b2e87eb874a6c1a113aec1a477105e5b977db0a0d32d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/cloudfront_distribution.html.markdown b/website/docs/cdktf/typescript/r/cloudfront_distribution.html.markdown
new file mode 100644
index 00000000000..dc28b3813bc
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/cloudfront_distribution.html.markdown
@@ -0,0 +1,604 @@
+---
+subcategory: "CloudFront"
+layout: "aws"
+page_title: "AWS: aws_cloudfront_distribution"
+description: |-
+  Provides a CloudFront web distribution resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudfront_distribution
+
+Creates an Amazon CloudFront web distribution.
+
+For information about CloudFront distributions, see the [Amazon CloudFront Developer Guide][1]. For specific information about creating CloudFront web distributions, see the [POST Distribution][2] page in the Amazon CloudFront API Reference.
+
+~> **NOTE:** CloudFront distributions take about 15 minutes to reach a deployed state after creation or modification. During this time, deletes to resources will be blocked. If you need to delete a distribution that is enabled and you do not want to wait, you need to use the `retainOnDelete` flag.
+
+## Example Usage
+
+### S3 Origin
+
+The example below creates a CloudFront distribution with an S3 origin.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudfrontDistribution } from "./.gen/providers/aws/cloudfront-distribution";
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketAcl } from "./.gen/providers/aws/s3-bucket-acl";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const s3OriginId = "myS3Origin";
+    const b = new S3Bucket(this, "b", {
+      bucket: "mybucket",
+      tags: {
+        Name: "My bucket",
+      },
+    });
+    new S3BucketAcl(this, "b_acl", {
+      acl: "private",
+      bucket: b.id,
+    });
+    new CloudfrontDistribution(this, "s3_distribution", {
+      aliases: ["mysite.example.com", "yoursite.example.com"],
+      comment: "Some comment",
+      defaultCacheBehavior: {
+        allowedMethods: [
+          "DELETE",
+          "GET",
+          "HEAD",
+          "OPTIONS",
+          "PATCH",
+          "POST",
+          "PUT",
+        ],
+        cachedMethods: ["GET", "HEAD"],
+        defaultTtl: 3600,
+        forwardedValues: {
+          cookies: {
+            forward: "none",
+          },
+          queryString: false,
+        },
+        maxTtl: 86400,
+        minTtl: 0,
+        targetOriginId: s3OriginId,
+        viewerProtocolPolicy: "allow-all",
+      },
+      defaultRootObject: "index.html",
+      enabled: true,
+      isIpv6Enabled: true,
+      loggingConfig: {
+        bucket: "mylogs.s3.amazonaws.com",
+        includeCookies: false,
+        prefix: "myprefix",
+      },
+      orderedCacheBehavior: [
+        {
+          allowedMethods: ["GET", "HEAD", "OPTIONS"],
+          cachedMethods: ["GET", "HEAD", "OPTIONS"],
+          compress: true,
+          defaultTtl: 86400,
+          forwardedValues: {
+            cookies: {
+              forward: "none",
+            },
+            headers: ["Origin"],
+            queryString: false,
+          },
+          maxTtl: 31536000,
+          minTtl: 0,
+          pathPattern: "/content/immutable/*",
+          targetOriginId: s3OriginId,
+          viewerProtocolPolicy: "redirect-to-https",
+        },
+        {
+          allowedMethods: ["GET", "HEAD", "OPTIONS"],
+          cachedMethods: ["GET", "HEAD"],
+          compress: true,
+          defaultTtl: 3600,
+          forwardedValues: {
+            cookies: {
+              forward: "none",
+            },
+            queryString: false,
+          },
+          maxTtl: 86400,
+          minTtl: 0,
+          pathPattern: "/content/*",
+          targetOriginId: s3OriginId,
+          viewerProtocolPolicy: "redirect-to-https",
+        },
+      ],
+      origin: [
+        {
+          domainName: b.bucketRegionalDomainName,
+          originAccessControlId: defaultVar.id,
+          originId: s3OriginId,
+        },
+      ],
+      priceClass: "PriceClass_200",
+      restrictions: {
+        geoRestriction: {
+          locations: ["US", "CA", "GB", "DE"],
+          restrictionType: "whitelist",
+        },
+      },
+      tags: {
+        Environment: "production",
+      },
+      viewerCertificate: {
+        cloudfrontDefaultCertificate: true,
+      },
+    });
+  }
+}
+
+```
+
+### With Failover Routing
+
+The example below creates a CloudFront distribution with an origin group for failover routing.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudfrontDistribution } from "./.gen/providers/aws/cloudfront-distribution";
+interface MyConfig {
+  allowedMethods: any;
+  cachedMethods: any;
+  viewerProtocolPolicy: any;
+  enabled: any;
+  restrictions: any;
+  viewerCertificate: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new CloudfrontDistribution(this, "s3_distribution", {
+      defaultCacheBehavior: {
+        targetOriginId: "groupS3",
+        allowedMethods: config.allowedMethods,
+        cachedMethods: config.cachedMethods,
+        viewerProtocolPolicy: config.viewerProtocolPolicy,
+      },
+      origin: [
+        {
+          domainName: primary.bucketRegionalDomainName,
+          originId: "primaryS3",
+          s3OriginConfig: {
+            originAccessIdentity: defaultVar.cloudfrontAccessIdentityPath,
+          },
+        },
+        {
+          domainName: failover.bucketRegionalDomainName,
+          originId: "failoverS3",
+          s3OriginConfig: {
+            originAccessIdentity: defaultVar.cloudfrontAccessIdentityPath,
+          },
+        },
+      ],
+      originGroup: [
+        {
+          failoverCriteria: {
+            statusCodes: [403, 404, 500, 502],
+          },
+          member: [
+            {
+              originId: "primaryS3",
+            },
+            {
+              originId: "failoverS3",
+            },
+          ],
+          originId: "groupS3",
+        },
+      ],
+      enabled: config.enabled,
+      restrictions: config.restrictions,
+      viewerCertificate: config.viewerCertificate,
+    });
+  }
+}
+
+```
+
+### With Managed Caching Policy
+
+The example below creates a CloudFront distribution with an [AWS managed caching policy](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-managed-cache-policies.html).
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudfrontDistribution } from "./.gen/providers/aws/cloudfront-distribution";
+interface MyConfig {
+  cachedMethods: any;
+  viewerProtocolPolicy: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    const s3OriginId = "myS3Origin";
+    new CloudfrontDistribution(this, "s3_distribution", {
+      comment: "Some comment",
+      defaultCacheBehavior: {
+        allowedMethods: ["GET", "HEAD", "OPTIONS"],
+        cachePolicyId: "4135ea2d-6df8-44a3-9df3-4b5a84be39ad",
+        targetOriginId: s3OriginId,
+        cachedMethods: config.cachedMethods,
+        viewerProtocolPolicy: config.viewerProtocolPolicy,
+      },
+      defaultRootObject: "index.html",
+      enabled: true,
+      isIpv6Enabled: true,
+      origin: [
+        {
+          domainName: primary.bucketRegionalDomainName,
+          originId: "myS3Origin",
+          s3OriginConfig: {
+            originAccessIdentity: defaultVar.cloudfrontAccessIdentityPath,
+          },
+        },
+      ],
+      restrictions: {
+        geoRestriction: {
+          locations: ["US", "CA", "GB", "DE"],
+          restrictionType: "whitelist",
+        },
+      },
+      viewerCertificate: {
+        cloudfrontDefaultCertificate: true,
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The CloudFront distribution argument layout is a complex structure composed of several sub-resources - these resources are laid out below.
+
+### Top-Level Arguments
+
+* `aliases` (Optional) - Extra CNAMEs (alternate domain names), if any, for this distribution.
+* `comment` (Optional) - Any comments you want to include about the distribution.
+* `continuousDeploymentPolicyId` (Optional) - Identifier of a continuous deployment policy. This argument should only be set on a production distribution. See the [`awsCloudfrontContinuousDeploymentPolicy` resource](./cloudfront_continuous_deployment_policy.html.markdown) for additional details.
+* `customErrorResponse` (Optional) - One or more [custom error response](#custom-error-response-arguments) elements (multiples allowed).
+* `defaultCacheBehavior` (Required) - [Default cache behavior](#default-cache-behavior-arguments) for this distribution (maximum one). Requires either `cachePolicyId` (preferred) or `forwardedValues` (deprecated) be set.
+* `defaultRootObject` (Optional) - Object that you want CloudFront to return (for example, index.html) when an end user requests the root URL.
+* `enabled` (Required) - Whether the distribution is enabled to accept end user requests for content.
+* `isIpv6Enabled` (Optional) - Whether the IPv6 is enabled for the distribution.
+* `httpVersion` (Optional) - Maximum HTTP version to support on the distribution. Allowed values are `http11`, `http2`, `http2And3` and `http3`. The default is `http2`.
+* `loggingConfig` (Optional) - The [logging configuration](#logging-config-arguments) that controls how logs are written to your distribution (maximum one).
+* `orderedCacheBehavior` (Optional) - Ordered list of [cache behaviors](#cache-behavior-arguments) resource for this distribution. List from top to bottom in order of precedence. The topmost cache behavior will have precedence 0.
+* `origin` (Required) - One or more [origins](#origin-arguments) for this distribution (multiples allowed).
+* `originGroup` (Optional) - One or more [origin_group](#origin-group-arguments) for this distribution (multiples allowed).
+* `priceClass` (Optional) - Price class for this distribution. One of `priceClassAll`, `priceClass200`, `priceClass100`.
+* `restrictions` (Required) - The [restriction configuration](#restrictions-arguments) for this distribution (maximum one).
+* `staging` (Optional) - A Boolean that indicates whether this is a staging distribution. Defaults to `false`.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `viewerCertificate` (Required) - The [SSL configuration](#viewer-certificate-arguments) for this distribution (maximum one).
+* `webAclId` (Optional) - Unique identifier that specifies the AWS WAF web ACL, if any, to associate with this distribution. To specify a web ACL created using the latest version of AWS WAF (WAFv2), use the ACL ARN, for example `awsWafv2WebAclExampleArn`. To specify a web ACL created using AWS WAF Classic, use the ACL ID, for example `awsWafWebAclExampleId`. The WAF Web ACL must exist in the WAF Global (CloudFront) region and the credentials configuring this argument must have `waf:getWebAcl` permissions assigned.
+* `retainOnDelete` (Optional) - Disables the distribution instead of deleting it when destroying the resource through Terraform. If this is set, the distribution needs to be deleted manually afterwards. Default: `false`.
+* `waitForDeployment` (Optional) - If enabled, the resource will wait for the distribution status to change from `inProgress` to `deployed`. Setting this to`false` will skip the process. Default: `true`.
+
+#### Cache Behavior Arguments
+
+~> **NOTE:** To achieve the setting of 'Use origin cache headers' without a linked cache policy, use the following TTL values: `minTtl` = 0, `maxTtl` = 31536000, `defaultTtl` = 86400. See [this issue](https://github.com/hashicorp/terraform-provider-aws/issues/19382) for additional context.
+
+* `allowedMethods` (Required) - Controls which HTTP methods CloudFront processes and forwards to your Amazon S3 bucket or your custom origin.
+* `cachedMethods` (Required) - Controls whether CloudFront caches the response to requests using the specified HTTP methods.
+* `cachePolicyId` (Optional) - Unique identifier of the cache policy that is attached to the cache behavior. If configuring the `defaultCacheBehavior` either `cachePolicyId` or `forwardedValues` must be set.
+* `compress` (Optional) - Whether you want CloudFront to automatically compress content for web requests that include `Accept-Encoding: gzip` in the request header (default: `false`).
+* `defaultTtl` (Optional) - Default amount of time (in seconds) that an object is in a CloudFront cache before CloudFront forwards another request in the absence of an `Cache-Control max-age` or `expires` header.
+* `fieldLevelEncryptionId` (Optional) - Field level encryption configuration ID.
+* `forwardedValues` (Optional, **Deprecated** use `cachePolicyId` or `origin_request_policy_id ` instead) - The [forwarded values configuration](#forwarded-values-arguments) that specifies how CloudFront handles query strings, cookies and headers (maximum one).
+* `lambdaFunctionAssociation` (Optional) - A [config block](#lambda-function-association) that triggers a lambda function with specific actions (maximum 4).
+* `functionAssociation` (Optional) - A [config block](#function-association) that triggers a cloudfront function with specific actions (maximum 2).
+* `maxTtl` (Optional) - Maximum amount of time (in seconds) that an object is in a CloudFront cache before CloudFront forwards another request to your origin to determine whether the object has been updated. Only effective in the presence of `Cache-Control max-age`, `Cache-Control s-maxage`, and `expires` headers.
+* `minTtl` (Optional) - Minimum amount of time that you want objects to stay in CloudFront caches before CloudFront queries your origin to see whether the object has been updated. Defaults to 0 seconds.
+* `originRequestPolicyId` (Optional) - Unique identifier of the origin request policy that is attached to the behavior.
+* `pathPattern` (Required) - Pattern (for example, `images/*Jpg`) that specifies which requests you want this cache behavior to apply to.
+* `realtimeLogConfigArn` (Optional) - ARN of the [real-time log configuration](cloudfront_realtime_log_config.html) that is attached to this cache behavior.
+* `responseHeadersPolicyId` (Optional) - Identifier for a response headers policy.
+* `smoothStreaming` (Optional) - Indicates whether you want to distribute media files in Microsoft Smooth Streaming format using the origin that is associated with this cache behavior.
+* `targetOriginId` (Required) - Value of ID for the origin that you want CloudFront to route requests to when a request matches the path pattern either for a cache behavior or for the default cache behavior.
+* `trustedKeyGroups` (Optional) - List of key group IDs that CloudFront can use to validate signed URLs or signed cookies. See the [CloudFront User Guide](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-trusted-signers.html) for more information about this feature.
+* `trustedSigners` (Optional) - List of AWS account IDs (or `self`) that you want to allow to create signed URLs for private content. See the [CloudFront User Guide](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-trusted-signers.html) for more information about this feature.
+* `viewerProtocolPolicy` (Required) - Use this element to specify the protocol that users can use to access the files in the origin specified by TargetOriginId when a request matches the path pattern in PathPattern. One of `allowAll`, `httpsOnly`, or `redirectToHttps`.
+
+##### Forwarded Values Arguments
+
+* `cookies` (Required) - The [forwarded values cookies](#cookies-arguments) that specifies how CloudFront handles cookies (maximum one).
+* `headers` (Optional) - Headers, if any, that you want CloudFront to vary upon for this cache behavior. Specify `*` to include all headers.
+* `queryString` (Required) - Indicates whether you want CloudFront to forward query strings to the origin that is associated with this cache behavior.
+* `queryStringCacheKeys` (Optional) - When specified, along with a value of `true` for `queryString`, all query strings are forwarded, however only the query string keys listed in this argument are cached. When omitted with a value of `true` for `queryString`, all query string keys are cached.
+
+##### Lambda Function Association
+
+Lambda@Edge allows you to associate an AWS Lambda Function with a predefined
+event. You can associate a single function per event type. See [What is
+Lambda@Edge](http://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/what-is-lambda-at-edge.html)
+for more information.
+
+Example configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudfrontDistribution } from "./.gen/providers/aws/cloudfront-distribution";
+interface MyConfig {
+  allowedMethods: any;
+  cachedMethods: any;
+  pathPattern: any;
+  targetOriginId: any;
+  viewerProtocolPolicy: any;
+  defaultCacheBehavior: any;
+  enabled: any;
+  origin: any;
+  restrictions: any;
+  viewerCertificate: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new CloudfrontDistribution(this, "example", {
+      orderedCacheBehavior: [
+        {
+          lambdaFunctionAssociation: [
+            {
+              eventType: "viewer-request",
+              includeBody: false,
+              lambdaArn: Token.asString(awsLambdaFunctionExample.qualifiedArn),
+            },
+          ],
+          allowedMethods: config.allowedMethods,
+          cachedMethods: config.cachedMethods,
+          pathPattern: config.pathPattern,
+          targetOriginId: config.targetOriginId,
+          viewerProtocolPolicy: config.viewerProtocolPolicy,
+        },
+      ],
+      defaultCacheBehavior: config.defaultCacheBehavior,
+      enabled: config.enabled,
+      origin: config.origin,
+      restrictions: config.restrictions,
+      viewerCertificate: config.viewerCertificate,
+    });
+  }
+}
+
+```
+
+* `eventType` (Required) - Specific event to trigger this function. Valid values: `viewerRequest`, `originRequest`, `viewerResponse`, `originResponse`.
+* `lambdaArn` (Required) - ARN of the Lambda function.
+* `includeBody` (Optional) - When set to true it exposes the request body to the lambda function. Defaults to false. Valid values: `true`, `false`.
+
+##### Function Association
+
+With CloudFront Functions in Amazon CloudFront, you can write lightweight functions in JavaScript for high-scale, latency-sensitive CDN customizations. You can associate a single function per event type. See [CloudFront Functions](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/cloudfront-functions.html)
+for more information.
+
+Example configuration:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudfrontDistribution } from "./.gen/providers/aws/cloudfront-distribution";
+interface MyConfig {
+  allowedMethods: any;
+  cachedMethods: any;
+  pathPattern: any;
+  targetOriginId: any;
+  viewerProtocolPolicy: any;
+  defaultCacheBehavior: any;
+  enabled: any;
+  origin: any;
+  restrictions: any;
+  viewerCertificate: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new CloudfrontDistribution(this, "example", {
+      orderedCacheBehavior: [
+        {
+          functionAssociation: [
+            {
+              eventType: "viewer-request",
+              functionArn: Token.asString(awsCloudfrontFunctionExample.arn),
+            },
+          ],
+          allowedMethods: config.allowedMethods,
+          cachedMethods: config.cachedMethods,
+          pathPattern: config.pathPattern,
+          targetOriginId: config.targetOriginId,
+          viewerProtocolPolicy: config.viewerProtocolPolicy,
+        },
+      ],
+      defaultCacheBehavior: config.defaultCacheBehavior,
+      enabled: config.enabled,
+      origin: config.origin,
+      restrictions: config.restrictions,
+      viewerCertificate: config.viewerCertificate,
+    });
+  }
+}
+
+```
+
+* `eventType` (Required) - Specific event to trigger this function. Valid values: `viewerRequest` or `viewerResponse`.
+* `functionArn` (Required) - ARN of the CloudFront function.
+
+##### Cookies Arguments
+
+* `forward` (Required) - Whether you want CloudFront to forward cookies to the origin that is associated with this cache behavior. You can specify `all`, `none` or `whitelist`. If `whitelist`, you must include the subsequent `whitelistedNames`.
+* `whitelistedNames` (Optional) - If you have specified `whitelist` to `forward`, the whitelisted cookies that you want CloudFront to forward to your origin.
+
+#### Custom Error Response Arguments
+
+* `errorCachingMinTtl` (Optional) - Minimum amount of time you want HTTP error codes to stay in CloudFront caches before CloudFront queries your origin to see whether the object has been updated.
+* `errorCode` (Required) - 4xx or 5xx HTTP status code that you want to customize.
+* `responseCode` (Optional) - HTTP status code that you want CloudFront to return with the custom error page to the viewer.
+* `responsePagePath` (Optional) - Path of the custom error page (for example, `/custom404Html`).
+
+#### Default Cache Behavior Arguments
+
+The arguments for `defaultCacheBehavior` are the same as for
+[`orderedCacheBehavior`](#cache-behavior-arguments), except for the `pathPattern`
+argument should not be specified.
+
+#### Logging Config Arguments
+
+* `bucket` (Required) - Amazon S3 bucket to store the access logs in, for example, `myawslogbucketS3AmazonawsCom`.
+* `includeCookies` (Optional) - Whether to include cookies in access logs (default: `false`).
+* `prefix` (Optional) - Prefix to the access log filenames for this distribution, for example, `myprefix/`.
+
+#### Origin Arguments
+
+* `connectionAttempts` (Optional) - Number of times that CloudFront attempts to connect to the origin. Must be between 1-3. Defaults to 3.
+* `connectionTimeout` (Optional) - Number of seconds that CloudFront waits when trying to establish a connection to the origin. Must be between 1-10. Defaults to 10.
+* `customOriginConfig` - The [CloudFront custom origin](#custom-origin-config-arguments) configuration information. If an S3 origin is required, use `originAccessControlId` or `s3OriginConfig` instead.
+* `domainName` (Required) - DNS domain name of either the S3 bucket, or web site of your custom origin.
+* `customHeader` (Optional) - One or more sub-resources with `name` and `value` parameters that specify header data that will be sent to the origin (multiples allowed).
+* `originAccessControlId` (Optional) - Unique identifier of a [CloudFront origin access control][8] for this origin.
+* `originId` (Required) - Unique identifier for the origin.
+* `originPath` (Optional) - Optional element that causes CloudFront to request your content from a directory in your Amazon S3 bucket or your custom origin.
+* `originShield` - (Optional) [CloudFront Origin Shield](#origin-shield-arguments) configuration information. Using Origin Shield can help reduce the load on your origin. For more information, see [Using Origin Shield](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/origin-shield.html) in the Amazon CloudFront Developer Guide.
+* `s3OriginConfig` - (Optional) [CloudFront S3 origin](#s3-origin-config-arguments) configuration information. If a custom origin is required, use `customOriginConfig` instead.
+
+##### Custom Origin Config Arguments
+
+* `httpPort` (Required) - HTTP port the custom origin listens on.
+* `httpsPort` (Required) - HTTPS port the custom origin listens on.
+* `originProtocolPolicy` (Required) - Origin protocol policy to apply to your origin. One of `httpOnly`, `httpsOnly`, or `matchViewer`.
+* `originSslProtocols` (Required) - SSL/TLS protocols that you want CloudFront to use when communicating with your origin over HTTPS. A list of one or more of `ssLv3`, `tlSv1`, `tlSv11`, and `tlSv12`.
+* `originKeepaliveTimeout` - (Optional) The Custom KeepAlive timeout, in seconds. By default, AWS enforces an upper limit of `60`. But you can request an [increase](http://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/RequestAndResponseBehaviorCustomOrigin.html#request-custom-request-timeout). Defaults to `5`.
+* `originReadTimeout` - (Optional) The Custom Read timeout, in seconds. By default, AWS enforces an upper limit of `60`. But you can request an [increase](http://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/RequestAndResponseBehaviorCustomOrigin.html#request-custom-request-timeout). Defaults to `30`.
+
+##### Origin Shield Arguments
+
+* `enabled` (Required) - Whether Origin Shield is enabled.
+* `originShieldRegion` (Optional) - AWS Region for Origin Shield. To specify a region, use the region code, not the region name. For example, specify the US East (Ohio) region as `usEast2`.
+
+##### S3 Origin Config Arguments
+
+* `originAccessIdentity` (Required) - The [CloudFront origin access identity][5] to associate with the origin.
+
+#### Origin Group Arguments
+
+* `originId` (Required) - Unique identifier for the origin group.
+* `failoverCriteria` (Required) - The [failover criteria](#failover-criteria-arguments) for when to failover to the secondary origin.
+* `member` (Required) - Ordered [member](#member-arguments) configuration blocks assigned to the origin group, where the first member is the primary origin. You must specify two members.
+
+##### Failover Criteria Arguments
+
+* `statusCodes` (Required) - List of HTTP status codes for the origin group.
+
+##### Member Arguments
+
+* `originId` (Required) - Unique identifier of the member origin.
+
+#### Restrictions Arguments
+
+The `restrictions` sub-resource takes another single sub-resource named `geoRestriction` (see the example for usage).
+
+The arguments of `geoRestriction` are:
+
+* `locations` (Required) - [ISO 3166-1-alpha-2 codes][4] for which you want CloudFront either to distribute your content (`whitelist`) or not distribute your content (`blacklist`). If the type is specified as `none` an empty array can be used.
+* `restrictionType` (Required) - Method that you want to use to restrict distribution of your content by country: `none`, `whitelist`, or `blacklist`.
+
+#### Viewer Certificate Arguments
+
+* `acmCertificateArn` - ARN of the [AWS Certificate Manager][6] certificate that you wish to use with this distribution. Specify this, `cloudfrontDefaultCertificate`, or `iamCertificateId`.  The ACM certificate must be in  US-EAST-1.
+* `cloudfrontDefaultCertificate` - `true` if you want viewers to use HTTPS to request your objects and you're using the CloudFront domain name for your distribution. Specify this, `acmCertificateArn`, or `iamCertificateId`.
+* `iamCertificateId` - IAM certificate identifier of the custom viewer certificate for this distribution if you are using a custom domain. Specify this, `acmCertificateArn`, or `cloudfrontDefaultCertificate`.
+* `minimumProtocolVersion` - Minimum version of the SSL protocol that you want CloudFront to use for HTTPS connections. Can only be set if `cloudfront_default_certificate = false`. See all possible values in [this](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/secure-connections-supported-viewer-protocols-ciphers.html) table under "Security policy." Some examples include: `tlSv122019` and `tlSv122021`. Default: `tlSv1`. **NOTE**: If you are using a custom certificate (specified with `acmCertificateArn` or `iamCertificateId`), and have specified `sniOnly` in `sslSupportMethod`, `tlSv1` or later must be specified. If you have specified `vip` in `sslSupportMethod`, only `ssLv3` or `tlSv1` can be specified. If you have specified `cloudfrontDefaultCertificate`, `tlSv1` must be specified.
+* `sslSupportMethod` - How you want CloudFront to serve HTTPS requests. One of `vip` or `sniOnly`. Required if you specify `acmCertificateArn` or `iamCertificateId`. **NOTE:** `vip` causes CloudFront to use a dedicated IP address and may incur extra charges.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Identifier for the distribution. For example: `edfdvbd632Bhds5`.
+* `arn` - ARN for the distribution. For example: `arn:aws:cloudfront::123456789012:distribution/edfdvbd632Bhds5`, where `123456789012` is your AWS account ID.
+* `callerReference` - Internal value used by CloudFront to allow future updates to the distribution configuration.
+* `status` - Current status of the distribution. `deployed` if the distribution's information is fully propagated throughout the Amazon CloudFront system.
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `trustedKeyGroups` - List of nested attributes for active trusted key groups, if the distribution is set up to serve private content with signed URLs.
+    * `enabled` - `true` if any of the key groups have public keys that CloudFront can use to verify the signatures of signed URLs and signed cookies.
+    * `items` - List of nested attributes for each key group.
+        * `keyGroupId` - ID of the key group that contains the public keys.
+        * `keyPairIds` - Set of CloudFront key pair IDs.
+* `trustedSigners` - List of nested attributes for active trusted signers, if the distribution is set up to serve private content with signed URLs.
+    * `enabled` - `true` if any of the AWS accounts listed as trusted signers have active CloudFront key pairs
+    * `items` - List of nested attributes for each trusted signer
+        * `awsAccountNumber` - AWS account ID or `self`
+        * `keyPairIds` - Set of active CloudFront key pairs associated with the signer account
+* `domainName` - Domain name corresponding to the distribution. For example: `d604721Fxaaqy9CloudfrontNet`.
+* `lastModifiedTime` - Date and time the distribution was last modified.
+* `inProgressValidationBatches` - Number of invalidation batches currently in progress.
+* `etag` - Current version of the distribution's information. For example: `e2Qwruhapomqzl`.
+* `hostedZoneId` - CloudFront Route 53 zone ID that can be used to route an [Alias Resource Record Set][7] to. This attribute is simply an alias for the zone ID `z2Fdtndataqyw2`.
+
+[1]: http://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Introduction.html
+[2]: https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_CreateDistribution.html
+[3]: http://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-s3.html
+[4]: http://www.iso.org/iso/country_codes/iso_3166_code_lists/country_names_and_code_elements.htm
+[5]: /docs/providers/aws/r/cloudfront_origin_access_identity.html
+[6]: https://aws.amazon.com/certificate-manager/
+[7]: http://docs.aws.amazon.com/Route53/latest/APIReference/CreateAliasRRSAPI.html
+[8]: /docs/providers/aws/r/cloudfront_origin_access_control.html
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudFront Distributions using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import CloudFront Distributions using the `id`. For example:
+
+```console
+% terraform import aws_cloudfront_distribution.distribution E74FTE3EXAMPLE
+```
+
+<!-- cache-key: cdktf-0.18.0 input-0b6496126422015df51ee5b7114c332b4222965bc778c7ff2aecedac14a3a375 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/cloudfront_field_level_encryption_config.html.markdown b/website/docs/cdktf/typescript/r/cloudfront_field_level_encryption_config.html.markdown
new file mode 100644
index 00000000000..0bbfccd445e
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/cloudfront_field_level_encryption_config.html.markdown
@@ -0,0 +1,120 @@
+---
+subcategory: "CloudFront"
+layout: "aws"
+page_title: "AWS: aws_cloudfront_field_level_encryption_config"
+description: |-
+  Provides a CloudFront Field-level Encryption Config resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudfront_field_level_encryption_config
+
+Provides a CloudFront Field-level Encryption Config resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudfrontFieldLevelEncryptionConfig } from "./.gen/providers/aws/cloudfront-field-level-encryption-config";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new CloudfrontFieldLevelEncryptionConfig(this, "test", {
+      comment: "test comment",
+      contentTypeProfileConfig: {
+        contentTypeProfiles: {
+          items: [
+            {
+              contentType: "application/x-www-form-urlencoded",
+              format: "URLEncoded",
+            },
+          ],
+        },
+        forwardWhenContentTypeIsUnknown: true,
+      },
+      queryArgProfileConfig: {
+        forwardWhenQueryArgProfileIsUnknown: true,
+        queryArgProfiles: {
+          items: [
+            {
+              profileId: Token.asString(
+                awsCloudfrontFieldLevelEncryptionProfileTest.id
+              ),
+              queryArg: "Arg1",
+            },
+          ],
+        },
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `comment` - (Optional) An optional comment about the Field Level Encryption Config.
+* `contentTypeProfileConfig` - (Required) [Content Type Profile Config](#content-type-profile-config) specifies when to forward content if a content type isn't recognized and profiles to use as by default in a request if a query argument doesn't specify a profile to use.
+* `queryArgProfileConfig` - (Required) [Query Arg Profile Config](#query-arg-profile-config) that specifies when to forward content if a profile isn't found and the profile that can be provided as a query argument in a request.
+
+### Content Type Profile Config
+
+* `forwardWhenContentTypeIsUnknown` - (Required) specifies what to do when an unknown content type is provided for the profile. If true, content is forwarded without being encrypted when the content type is unknown. If false (the default), an error is returned when the content type is unknown.
+* `contentTypeProfiles` - (Required) Object that contains an attribute `items` that contains the list of configurations for a field-level encryption content type-profile. See [Content Type Profile](#content-type-profile).
+
+### Content Type Profile
+
+* `contentType` - (Required) he content type for a field-level encryption content type-profile mapping. Valid value is `application/xWwwFormUrlencoded`.
+* `format` - (Required) The format for a field-level encryption content type-profile mapping. Valid value is `urlEncoded`.
+* `profileId` - (Optional) The profile ID for a field-level encryption content type-profile mapping.
+
+### Query Arg Profile Config
+
+* `forwardWhenQueryArgProfileIsUnknown` - (Required) Flag to set if you want a request to be forwarded to the origin even if the profile specified by the field-level encryption query argument, fle-profile, is unknown.
+* `queryArgProfiles` - (Optional) Object that contains an attribute `items` that contains the list ofrofiles specified for query argument-profile mapping for field-level encryption. see [Query Arg Profile](#query-arg-profile).
+
+### Query Arg Profile
+
+* `profileId` - (Required) ID of profile to use for field-level encryption query argument-profile mapping
+* `queryArg` - (Required) Query argument for field-level encryption query argument-profile mapping.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `callerReference` - Internal value used by CloudFront to allow future updates to the Field Level Encryption Config.
+* `etag` - The current version of the Field Level Encryption Config. For example: `e2Qwruhapomqzl`.
+* `id` - The identifier for the Field Level Encryption Config. For example: `k3D5Eweudccxon`.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Cloudfront Field Level Encryption Config using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Cloudfront Field Level Encryption Config using the `id`. For example:
+
+```console
+% terraform import aws_cloudfront_field_level_encryption_config.config E74FTE3AEXAMPLE
+```
+
+<!-- cache-key: cdktf-0.18.0 input-757359a9350d143cc637cf70befbb7ac23a36d48718be8d5941639a0def4ff71 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/cloudfront_field_level_encryption_profile.html.markdown b/website/docs/cdktf/typescript/r/cloudfront_field_level_encryption_profile.html.markdown
new file mode 100644
index 00000000000..3080624f1b5
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/cloudfront_field_level_encryption_profile.html.markdown
@@ -0,0 +1,99 @@
+---
+subcategory: "CloudFront"
+layout: "aws"
+page_title: "AWS: aws_cloudfront_field_level_encryption_profile"
+description: |-
+  Provides a CloudFront Field-level Encryption Profile resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudfront_field_level_encryption_profile
+
+Provides a CloudFront Field-level Encryption Profile resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudfrontFieldLevelEncryptionProfile } from "./.gen/providers/aws/cloudfront-field-level-encryption-profile";
+import { CloudfrontPublicKey } from "./.gen/providers/aws/cloudfront-public-key";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new CloudfrontPublicKey(this, "example", {
+      comment: "test public key",
+      encodedKey: Token.asString(Fn.file("public_key.pem")),
+      name: "test_key",
+    });
+    new CloudfrontFieldLevelEncryptionProfile(this, "test", {
+      comment: "test comment",
+      encryptionEntities: {
+        items: [
+          {
+            fieldPatterns: {
+              items: ["DateOfBirth"],
+            },
+            providerId: "test provider",
+            publicKeyId: example.id,
+          },
+        ],
+      },
+      name: "test profile",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the Field Level Encryption Profile.
+* `comment` - (Optional) An optional comment about the Field Level Encryption Profile.
+* `encryptionEntities` - (Required) The [encryption entities](#encryption-entities) config block for field-level encryption profiles that contains an attribute `items` which includes the encryption key and field pattern specifications.
+
+### Encryption Entities
+
+* `publicKeyId` - (Required) The public key associated with a set of field-level encryption patterns, to be used when encrypting the fields that match the patterns.
+* `providerId` - (Required) The provider associated with the public key being used for encryption.
+* `fieldPatterns` - (Required) Object that contains an attribute `items` that contains the list of field patterns in a field-level encryption content type profile specify the fields that you want to be encrypted.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `callerReference` - Internal value used by CloudFront to allow future updates to the Field Level Encryption Profile.
+* `etag` - The current version of the Field Level Encryption Profile. For example: `e2Qwruhapomqzl`.
+* `id` - The identifier for the Field Level Encryption Profile. For example: `k3D5Eweudccxon`.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Cloudfront Field Level Encryption Profile using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Cloudfront Field Level Encryption Profile using the `id`. For example:
+
+```console
+% terraform import aws_cloudfront_field_level_encryption_profile.profile K3D5EWEUDCCXON
+```
+
+<!-- cache-key: cdktf-0.18.0 input-70b6337b5220a74802bcb7be93e79696a90a0f0a1a7870e9703063485f2517fe -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/cloudfront_function.html.markdown b/website/docs/cdktf/typescript/r/cloudfront_function.html.markdown
new file mode 100644
index 00000000000..ade0dcb4c9f
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/cloudfront_function.html.markdown
@@ -0,0 +1,91 @@
+---
+subcategory: "CloudFront"
+layout: "aws"
+page_title: "AWS: aws_cloudfront_function"
+description: |-
+  Provides a CloudFront Function resource. With CloudFront Functions in Amazon CloudFront, you can write lightweight functions in JavaScript for high-scale, latency-sensitive CDN customizations.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudfront_function
+
+Provides a CloudFront Function resource. With CloudFront Functions in Amazon CloudFront, you can write lightweight functions in JavaScript for high-scale, latency-sensitive CDN customizations.
+
+See [CloudFront Functions](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/cloudfront-functions.html)
+
+~> **NOTE:** You cannot delete a function if it’s associated with a cache behavior. First, update your distributions to remove the function association from all cache behaviors, then delete the function.
+
+## Example Usage
+
+### Basic Example
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudfrontFunction } from "./.gen/providers/aws/cloudfront-function";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new CloudfrontFunction(this, "test", {
+      code: Token.asString(Fn.file("${path.module}/function.js")),
+      comment: "my function",
+      name: "test",
+      publish: true,
+      runtime: "cloudfront-js-1.0",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) Unique name for your CloudFront Function.
+* `code` - (Required) Source code of the function
+* `runtime` - (Required) Identifier of the function's runtime. Currently only `cloudfrontJs10` is valid.
+
+The following arguments are optional:
+
+* `comment` - (Optional) Comment.
+* `publish` - (Optional) Whether to publish creation/change as Live CloudFront Function Version. Defaults to `true`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) identifying your CloudFront Function.
+* `etag` - ETag hash of the function. This is the value for the `development` stage of the function.
+* `liveStageEtag` - ETag hash of any `live` stage of the function.
+* `status` - Status of the function. Can be `unpublished`, `unassociated` or `associated`.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudFront Functions using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import CloudFront Functions using the `name`. For example:
+
+```console
+% terraform import aws_cloudfront_function.test my_test_function
+```
+
+<!-- cache-key: cdktf-0.18.0 input-4dbd0fc63d6063c2f79ef92be1f7d40dedd1c366a0fddb227942d78a1ac1a21c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/cloudfront_key_group.html.markdown b/website/docs/cdktf/typescript/r/cloudfront_key_group.html.markdown
new file mode 100644
index 00000000000..de4afb59b5d
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/cloudfront_key_group.html.markdown
@@ -0,0 +1,88 @@
+---
+subcategory: "CloudFront"
+layout: "aws"
+page_title: "AWS: aws_cloudfront_key_group"
+description: |-
+  Provides a CloudFront key group.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudfront_key_group
+
+## Example Usage
+
+The following example below creates a CloudFront key group.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudfrontKeyGroup } from "./.gen/providers/aws/cloudfront-key-group";
+import { CloudfrontPublicKey } from "./.gen/providers/aws/cloudfront-public-key";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new CloudfrontPublicKey(this, "example", {
+      comment: "example public key",
+      encodedKey: Token.asString(Fn.file("public_key.pem")),
+      name: "example-key",
+    });
+    const awsCloudfrontKeyGroupExample = new CloudfrontKeyGroup(
+      this,
+      "example_1",
+      {
+        comment: "example key group",
+        items: [example.id],
+        name: "example-key-group",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsCloudfrontKeyGroupExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `comment` - (Optional) A comment to describe the key group..
+* `items` - (Required) A list of the identifiers of the public keys in the key group.
+* `name` - (Required) A name to identify the key group.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `etag` - The identifier for this version of the key group.
+* `id` - The identifier for the key group.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudFront Key Group using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import CloudFront Key Group using the `id`. For example:
+
+```console
+% terraform import aws_cloudfront_key_group.example 4b4f2r1c-315d-5c2e-f093-216t50jed10f
+```
+
+<!-- cache-key: cdktf-0.18.0 input-0db0e51d4954b3fa9a11b3c80e65d4eec2e3dd9da0abaf0109fbb3ae52ac9582 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/cloudfront_monitoring_subscription.html.markdown b/website/docs/cdktf/typescript/r/cloudfront_monitoring_subscription.html.markdown
new file mode 100644
index 00000000000..fa38c38cf24
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/cloudfront_monitoring_subscription.html.markdown
@@ -0,0 +1,85 @@
+---
+subcategory: "CloudFront"
+layout: "aws"
+page_title: "AWS: aws_cloudfront_monitoring_subscription"
+description: |-
+  Provides a CloudFront monitoring subscription resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudfront_monitoring_subscription
+
+Provides a CloudFront real-time log configuration resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudfrontMonitoringSubscription } from "./.gen/providers/aws/cloudfront-monitoring-subscription";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new CloudfrontMonitoringSubscription(this, "example", {
+      distributionId: Token.asString(awsCloudfrontDistributionExample.id),
+      monitoringSubscription: {
+        realtimeMetricsSubscriptionConfig: {
+          realtimeMetricsSubscriptionStatus: "Enabled",
+        },
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `distributionId` - (Required) The ID of the distribution that you are enabling metrics for.
+* `monitoringSubscription` - (Required) A monitoring subscription. This structure contains information about whether additional CloudWatch metrics are enabled for a given CloudFront distribution.
+
+### monitoring_subscription
+
+* `realtimeMetricsSubscriptionConfig` - (Required) A subscription configuration for additional CloudWatch metrics. See below.
+
+### realtime_metrics_subscription_config
+
+* `realtimeMetricsSubscriptionStatus` - (Required) A flag that indicates whether additional CloudWatch metrics are enabled for a given CloudFront distribution. Valid values are `enabled` and `disabled`. See below.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the CloudFront monitoring subscription, which corresponds to the `distributionId`.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudFront monitoring subscription using the id. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import CloudFront monitoring subscription using the id. For example:
+
+```console
+% terraform import aws_cloudfront_monitoring_subscription.example E3QYSUHO4VYRGB
+```
+
+<!-- cache-key: cdktf-0.18.0 input-b91e31f3e82dbecd167a0e42115b3ad5594b5f039d0b0b9f9acb77abb50ffaa6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/cloudfront_origin_access_control.html.markdown b/website/docs/cdktf/typescript/r/cloudfront_origin_access_control.html.markdown
new file mode 100644
index 00000000000..4497e944ba7
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/cloudfront_origin_access_control.html.markdown
@@ -0,0 +1,84 @@
+---
+subcategory: "CloudFront"
+layout: "aws"
+page_title: "AWS: aws_cloudfront_origin_access_control"
+description: |-
+  Terraform resource for managing an AWS CloudFront Origin Access Control.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudfront_origin_access_control
+
+Manages an AWS CloudFront Origin Access Control, which is used by CloudFront Distributions with an Amazon S3 bucket as the origin.
+
+Read more about Origin Access Control in the [CloudFront Developer Guide](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-s3.html).
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudfrontOriginAccessControl } from "./.gen/providers/aws/cloudfront-origin-access-control";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new CloudfrontOriginAccessControl(this, "example", {
+      description: "Example Policy",
+      name: "example",
+      originAccessControlOriginType: "s3",
+      signingBehavior: "always",
+      signingProtocol: "sigv4",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) A name that identifies the Origin Access Control.
+* `description` - (Optional) The description of the Origin Access Control. Defaults to "Managed by Terraform" if omitted.
+* `originAccessControlOriginType` - (Required) The type of origin that this Origin Access Control is for. Valid values are `s3`, and `mediastore`.
+* `signingBehavior` - (Required) Specifies which requests CloudFront signs. Specify `always` for the most common use case. Allowed values: `always`, `never`, and `noOverride`.
+* `signingProtocol` - (Required) Determines how CloudFront signs (authenticates) requests. The only valid value is `sigv4`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The unique identifier of this Origin Access Control.
+* `etag` - The current version of this Origin Access Control.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudFront Origin Access Control using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import CloudFront Origin Access Control using the `id`. For example:
+
+```console
+% terraform import aws_cloudfront_origin_access_control.example E327GJI25M56DG
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ebc51b864ba0cfb9ad22453d6e45a68aee5f617744805baea102f871af18ab56 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/cloudfront_origin_access_identity.html.markdown b/website/docs/cdktf/typescript/r/cloudfront_origin_access_identity.html.markdown
new file mode 100644
index 00000000000..1af3cdba401
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/cloudfront_origin_access_identity.html.markdown
@@ -0,0 +1,186 @@
+---
+subcategory: "CloudFront"
+layout: "aws"
+page_title: "AWS: aws_cloudfront_origin_access_identity"
+description: |-
+  Provides a CloudFront origin access identity.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudfront_origin_access_identity
+
+Creates an Amazon CloudFront origin access identity.
+
+For information about CloudFront distributions, see the
+[Amazon CloudFront Developer Guide][1]. For more information on generating
+origin access identities, see
+[Using an Origin Access Identity to Restrict Access to Your Amazon S3 Content][2].
+
+## Example Usage
+
+The following example below creates a CloudFront origin access identity.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudfrontOriginAccessIdentity } from "./.gen/providers/aws/cloudfront-origin-access-identity";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new CloudfrontOriginAccessIdentity(this, "example", {
+      comment: "Some comment",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `comment` (Optional) - An optional comment for the origin access identity.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The identifier for the distribution. For example: `edfdvbd632Bhds5`.
+* `callerReference` - Internal value used by CloudFront to allow future
+   updates to the origin access identity.
+* `cloudfrontAccessIdentityPath` - A shortcut to the full path for the
+   origin access identity to use in CloudFront, see below.
+* `etag` - The current version of the origin access identity's information.
+   For example: `e2Qwruhapomqzl`.
+* `iamArn` - A pre-generated ARN for use in S3 bucket policies (see below).
+   Example: `arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity
+ E2QWRUHAPOMQZL`.
+* `s3CanonicalUserId` - The Amazon S3 canonical user ID for the origin
+   access identity, which you use when giving the origin access identity read
+   permission to an object in Amazon S3.
+
+## Using With CloudFront
+
+Normally, when referencing an origin access identity in CloudFront, you need to
+prefix the ID with the `originAccessIdentity/cloudfront/` special path.
+The `cloudfrontAccessIdentityPath` allows this to be circumvented.
+The below snippet demonstrates use with the `s3OriginConfig` structure for the
+[`awsCloudfrontDistribution`][3] resource:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudfrontDistribution } from "./.gen/providers/aws/cloudfront-distribution";
+interface MyConfig {
+  domainName: any;
+  originId: any;
+  defaultCacheBehavior: any;
+  enabled: any;
+  restrictions: any;
+  viewerCertificate: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new CloudfrontDistribution(this, "example", {
+      origin: [
+        {
+          s3OriginConfig: {
+            originAccessIdentity: Token.asString(
+              awsCloudfrontOriginAccessIdentityExample.cloudfrontAccessIdentityPath
+            ),
+          },
+          domainName: config.domainName,
+          originId: config.originId,
+        },
+      ],
+      defaultCacheBehavior: config.defaultCacheBehavior,
+      enabled: config.enabled,
+      restrictions: config.restrictions,
+      viewerCertificate: config.viewerCertificate,
+    });
+  }
+}
+
+```
+
+### Updating your bucket policy
+
+Note that the AWS API may translate the `s3CanonicalUserId` `canonicalUser`
+principal into an `aws` IAM ARN principal when supplied in an
+[`awsS3Bucket`][4] bucket policy, causing spurious diffs in Terraform. If
+you see this behaviour, use the `iamArn` instead:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { S3BucketPolicy } from "./.gen/providers/aws/s3-bucket-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const s3Policy = new DataAwsIamPolicyDocument(this, "s3_policy", {
+      statement: [
+        {
+          actions: ["s3:GetObject"],
+          principals: [
+            {
+              identifiers: [example.iamArn],
+              type: "AWS",
+            },
+          ],
+          resources: ["${" + awsS3BucketExample.arn + "}/*"],
+        },
+      ],
+    });
+    new S3BucketPolicy(this, "example", {
+      bucket: Token.asString(awsS3BucketExample.id),
+      policy: Token.asString(s3Policy.json),
+    });
+  }
+}
+
+```
+
+[1]: http://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Introduction.html
+[2]: http://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-s3.html
+[3]: /docs/providers/aws/r/cloudfront_distribution.html
+[4]: /docs/providers/aws/r/s3_bucket.html
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Cloudfront Origin Access Identities using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Cloudfront Origin Access Identities using the `id`. For example:
+
+```console
+% terraform import aws_cloudfront_origin_access_identity.origin_access E74FTE3AEXAMPLE
+```
+
+<!-- cache-key: cdktf-0.18.0 input-233a1ba59fc5b72e6eab9f06e063242d771c0defae3bd21f603123c05ec4d160 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/cloudfront_origin_request_policy.html.markdown b/website/docs/cdktf/typescript/r/cloudfront_origin_request_policy.html.markdown
new file mode 100644
index 00000000000..6aa6be891e1
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/cloudfront_origin_request_policy.html.markdown
@@ -0,0 +1,114 @@
+---
+subcategory: "CloudFront"
+layout: "aws"
+page_title: "AWS: aws_cloudfront_origin_request_policy"
+description: |-
+  Determines the values that CloudFront includes in requests that it sends to the origin.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudfront_origin_request_policy
+
+## Example Usage
+
+The following example below creates a CloudFront origin request policy.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudfrontOriginRequestPolicy } from "./.gen/providers/aws/cloudfront-origin-request-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new CloudfrontOriginRequestPolicy(this, "example", {
+      comment: "example comment",
+      cookiesConfig: {
+        cookieBehavior: "whitelist",
+        cookies: {
+          items: ["example"],
+        },
+      },
+      headersConfig: {
+        headerBehavior: "whitelist",
+        headers: {
+          items: ["example"],
+        },
+      },
+      name: "example-policy",
+      queryStringsConfig: {
+        queryStringBehavior: "whitelist",
+        queryStrings: {
+          items: ["example"],
+        },
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) Unique name to identify the origin request policy.
+* `comment` - (Optional) Comment to describe the origin request policy.
+* `cookiesConfig` - (Required) Object that determines whether any cookies in viewer requests (and if so, which cookies) are included in the origin request key and automatically included in requests that CloudFront sends to the origin. See [Cookies Config](#cookies-config) for more information.
+* `headersConfig` - (Required) Object that determines whether any HTTP headers (and if so, which headers) are included in the origin request key and automatically included in requests that CloudFront sends to the origin. See [Headers Config](#headers-config) for more information.
+* `queryStringsConfig` - (Required) Object that determines whether any URL query strings in viewer requests (and if so, which query strings) are included in the origin request key and automatically included in requests that CloudFront sends to the origin. See [Query String Config](#query-string-config) for more information.
+
+### Cookies Config
+
+`cookieBehavior` - (Required) Determines whether any cookies in viewer requests are included in the origin request key and automatically included in requests that CloudFront sends to the origin. Valid values are `none`, `whitelist`, `all`, `allExcept`.
+`cookies` - (Optional) Object that contains a list of cookie names. See [Items](#items) for more information.
+
+### Headers Config
+
+`headerBehavior` - (Required) Determines whether any HTTP headers are included in the origin request key and automatically included in requests that CloudFront sends to the origin. Valid values are `none`, `whitelist`, `allViewer`, `allViewerAndWhitelistCloudFront`, `allExcept`.
+`headers` - (Optional) Object that contains a list of header names. See [Items](#items) for more information.
+
+### Query String Config
+
+`queryStringBehavior` - (Required) Determines whether any URL query strings in viewer requests are included in the origin request key and automatically included in requests that CloudFront sends to the origin. Valid values are `none`, `whitelist`, `all`, `allExcept`.
+`queryStrings` - (Optional) Object that contains a list of query string names. See [Items](#items) for more information.
+
+### Items
+
+`items` - (Required) List of item names (cookies, headers, or query strings).
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `etag` - The current version of the origin request policy.
+* `id` - The identifier for the origin request policy.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Cloudfront Origin Request Policies using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Cloudfront Origin Request Policies using the `id`. For example:
+
+```console
+% terraform import aws_cloudfront_origin_request_policy.policy ccca32ef-dce3-4df3-80df-1bd3000bc4d3
+```
+
+<!-- cache-key: cdktf-0.18.0 input-2bef7bc4558d3ce6ae66dcd3bb9da0419f06c50e2e3848dabc38af31c3b16d3b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/cloudfront_public_key.html.markdown b/website/docs/cdktf/typescript/r/cloudfront_public_key.html.markdown
new file mode 100644
index 00000000000..9a12338fed0
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/cloudfront_public_key.html.markdown
@@ -0,0 +1,80 @@
+---
+subcategory: "CloudFront"
+layout: "aws"
+page_title: "AWS: aws_cloudfront_public_key"
+description: |-
+  Provides a CloudFront Public Key which you add to CloudFront to use with features like field-level encryption.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudfront_public_key
+
+## Example Usage
+
+The following example below creates a CloudFront public key.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudfrontPublicKey } from "./.gen/providers/aws/cloudfront-public-key";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new CloudfrontPublicKey(this, "example", {
+      comment: "test public key",
+      encodedKey: Token.asString(Fn.file("public_key.pem")),
+      name: "test_key",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `comment` - (Optional) An optional comment about the public key.
+* `encodedKey` - (Required) The encoded public key that you want to add to CloudFront to use with features like field-level encryption.
+* `name` - (Optional) The name for the public key. By default generated by Terraform.
+* `namePrefix` - (Optional) The name for the public key. Conflicts with `name`.
+
+**NOTE:** When setting `encodedKey` value, there needs a newline at the end of string. Otherwise, multiple runs of terraform will want to recreate the `awsCloudfrontPublicKey` resource.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `callerReference` - Internal value used by CloudFront to allow future updates to the public key configuration.
+* `etag` - The current version of the public key. For example: `e2Qwruhapomqzl`.
+* `id` - The identifier for the public key. For example: `k3D5Eweudccxon`.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudFront Public Key using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import CloudFront Public Key using the `id`. For example:
+
+```console
+% terraform import aws_cloudfront_public_key.example K3D5EWEUDCCXON
+```
+
+<!-- cache-key: cdktf-0.18.0 input-94d904f4fccc2abfc5cddc1442837a48d3cf0fcd0480a05c448d4736bae1203a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/cloudfront_realtime_log_config.html.markdown b/website/docs/cdktf/typescript/r/cloudfront_realtime_log_config.html.markdown
new file mode 100644
index 00000000000..80bef81e4c3
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/cloudfront_realtime_log_config.html.markdown
@@ -0,0 +1,143 @@
+---
+subcategory: "CloudFront"
+layout: "aws"
+page_title: "AWS: aws_cloudfront_realtime_log_config"
+description: |-
+  Provides a CloudFront real-time log configuration resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudfront_realtime_log_config
+
+Provides a CloudFront real-time log configuration resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudfrontRealtimeLogConfig } from "./.gen/providers/aws/cloudfront-realtime-log-config";
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+import { IamRolePolicy } from "./.gen/providers/aws/iam-role-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const assumeRole = new DataAwsIamPolicyDocument(this, "assume_role", {
+      statement: [
+        {
+          actions: ["sts:AssumeRole"],
+          effect: "Allow",
+          principals: [
+            {
+              identifiers: ["cloudfront.amazonaws.com"],
+              type: "Service",
+            },
+          ],
+        },
+      ],
+    });
+    const example = new DataAwsIamPolicyDocument(this, "example", {
+      statement: [
+        {
+          actions: [
+            "kinesis:DescribeStreamSummary",
+            "kinesis:DescribeStream",
+            "kinesis:PutRecord",
+            "kinesis:PutRecords",
+          ],
+          effect: "Allow",
+          resources: [Token.asString(awsKinesisStreamExample.arn)],
+        },
+      ],
+    });
+    const awsIamRoleExample = new IamRole(this, "example_2", {
+      assumeRolePolicy: Token.asString(assumeRole.json),
+      name: "cloudfront-realtime-log-config-example",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamRoleExample.overrideLogicalId("example");
+    const awsIamRolePolicyExample = new IamRolePolicy(this, "example_3", {
+      name: "cloudfront-realtime-log-config-example",
+      policy: Token.asString(example.json),
+      role: Token.asString(awsIamRoleExample.id),
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamRolePolicyExample.overrideLogicalId("example");
+    const awsCloudfrontRealtimeLogConfigExample =
+      new CloudfrontRealtimeLogConfig(this, "example_4", {
+        dependsOn: [awsIamRolePolicyExample],
+        endpoint: {
+          kinesisStreamConfig: {
+            roleArn: Token.asString(awsIamRoleExample.arn),
+            streamArn: Token.asString(awsKinesisStreamExample.arn),
+          },
+          streamType: "Kinesis",
+        },
+        fields: ["timestamp", "c-ip"],
+        name: "example",
+        samplingRate: 75,
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsCloudfrontRealtimeLogConfigExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `endpoint` - (Required) The Amazon Kinesis data streams where real-time log data is sent.
+* `fields` - (Required) The fields that are included in each real-time log record. See the [AWS documentation](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/real-time-logs.html#understand-real-time-log-config-fields) for supported values.
+* `name` - (Required) The unique name to identify this real-time log configuration.
+* `samplingRate` - (Required) The sampling rate for this real-time log configuration. The sampling rate determines the percentage of viewer requests that are represented in the real-time log data. An integer between `1` and `100`, inclusive.
+
+The `endpoint` object supports the following:
+
+* `kinesisStreamConfig` - (Required) The Amazon Kinesis data stream configuration.
+* `streamType` - (Required) The type of data stream where real-time log data is sent. The only valid value is `kinesis`.
+
+The `kinesisStreamConfig` object supports the following:
+
+* `roleArn` - (Required) The ARN of an [IAM role](iam_role.html) that CloudFront can use to send real-time log data to the Kinesis data stream.
+See the [AWS documentation](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/real-time-logs.html#understand-real-time-log-config-iam-role) for more information.
+* `streamArn` - (Required) The ARN of the [Kinesis data stream](kinesis_stream.html).
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the CloudFront real-time log configuration.
+* `arn` - The ARN (Amazon Resource Name) of the CloudFront real-time log configuration.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudFront real-time log configurations using the ARN. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import CloudFront real-time log configurations using the ARN. For example:
+
+```console
+% terraform import aws_cloudfront_realtime_log_config.example arn:aws:cloudfront::111122223333:realtime-log-config/ExampleNameForRealtimeLogConfig
+```
+
+<!-- cache-key: cdktf-0.18.0 input-be02677fb3ad25ac1055ce131b85e8c78a124b0a2ec359c977c007200fc38e11 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/cloudfront_response_headers_policy.html.markdown b/website/docs/cdktf/typescript/r/cloudfront_response_headers_policy.html.markdown
new file mode 100644
index 00000000000..e8a878db859
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/cloudfront_response_headers_policy.html.markdown
@@ -0,0 +1,235 @@
+---
+subcategory: "CloudFront"
+layout: "aws"
+page_title: "AWS: aws_cloudfront_response_headers_policy"
+description: |-
+  Provides a CloudFront response headers policy resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudfront_response_headers_policy
+
+Provides a CloudFront response headers policy resource.
+A response headers policy contains information about a set of HTTP response headers and their values.
+After you create a response headers policy, you can use its ID to attach it to one or more cache behaviors in a CloudFront distribution.
+When it’s attached to a cache behavior, CloudFront adds the headers in the policy to every response that it sends for requests that match the cache behavior.
+
+## Example Usage
+
+The example below creates a CloudFront response headers policy.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudfrontResponseHeadersPolicy } from "./.gen/providers/aws/cloudfront-response-headers-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new CloudfrontResponseHeadersPolicy(this, "example", {
+      comment: "test comment",
+      corsConfig: {
+        accessControlAllowCredentials: true,
+        accessControlAllowHeaders: {
+          items: ["test"],
+        },
+        accessControlAllowMethods: {
+          items: ["GET"],
+        },
+        accessControlAllowOrigins: {
+          items: ["test.example.comtest"],
+        },
+        originOverride: true,
+      },
+      name: "example-policy",
+    });
+  }
+}
+
+```
+
+The example below creates a CloudFront response headers policy with a custom headers config.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudfrontResponseHeadersPolicy } from "./.gen/providers/aws/cloudfront-response-headers-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new CloudfrontResponseHeadersPolicy(this, "example", {
+      customHeadersConfig: {
+        items: [
+          {
+            header: "X-Permitted-Cross-Domain-Policies",
+            override: true,
+            value: "none",
+          },
+          {
+            header: "X-Test",
+            override: true,
+            value: "none",
+          },
+        ],
+      },
+      name: "example-headers-policy",
+    });
+  }
+}
+
+```
+
+The example below creates a CloudFront response headers policy with a custom headers config and server timing headers config.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudfrontResponseHeadersPolicy } from "./.gen/providers/aws/cloudfront-response-headers-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new CloudfrontResponseHeadersPolicy(this, "example", {
+      customHeadersConfig: {
+        items: [
+          {
+            header: "X-Permitted-Cross-Domain-Policies",
+            override: true,
+            value: "none",
+          },
+        ],
+      },
+      name: "example-headers-policy",
+      serverTimingHeadersConfig: {
+        enabled: true,
+        samplingRate: 50,
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) A unique name to identify the response headers policy.
+* `comment` - (Optional) A comment to describe the response headers policy. The comment cannot be longer than 128 characters.
+* `corsConfig` - (Optional) A configuration for a set of HTTP response headers that are used for Cross-Origin Resource Sharing (CORS). See [Cors Config](#cors-config) for more information.
+* `customHeadersConfig` - (Optional) Object that contains an attribute `items` that contains a list of custom headers. See [Custom Header](#custom-header) for more information.
+* `removeHeadersConfig` - (Optional) A configuration for a set of HTTP headers to remove from the HTTP response. Object that contains an attribute `items` that contains a list of headers. See [Remove Header](#remove-header) for more information.
+* `securityHeadersConfig` - (Optional) A configuration for a set of security-related HTTP response headers. See [Security Headers Config](#security-headers-config) for more information.
+* `serverTimingHeadersConfig` - (Optional) A configuration for enabling the Server-Timing header in HTTP responses sent from CloudFront. See [Server Timing Headers Config](#server-timing-headers-config) for more information.
+
+### Cors Config
+
+* `accessControlAllowCredentials` - (Required) A Boolean value that CloudFront uses as the value for the `accessControlAllowCredentials` HTTP response header.
+* `accessControlAllowHeaders` - (Required) Object that contains an attribute `items` that contains a list of HTTP header names that CloudFront includes as values for the `accessControlAllowHeaders` HTTP response header.
+* `accessControlAllowMethods` - (Required) Object that contains an attribute `items` that contains a list of HTTP methods that CloudFront includes as values for the `accessControlAllowMethods` HTTP response header. Valid values: `get` | `post` | `options` | `put` | `delete` | `head` | `all`
+* `accessControlAllowOrigins` - (Required) Object that contains an attribute `items` that contains a list of origins that CloudFront can use as the value for the `accessControlAllowOrigin` HTTP response header.
+* `accessControlExposeHeaders` - (Optional) Object that contains an attribute `items` that contains a list of HTTP headers that CloudFront includes as values for the `accessControlExposeHeaders` HTTP response header.
+* `accessControlMaxAgeSec` - (Optional) A number that CloudFront uses as the value for the `accessControlMaxAge` HTTP response header.
+* `originOverride` - (Required) A Boolean value that determines how CloudFront behaves for the HTTP response header.
+
+### Custom Header
+
+* `header` - (Required) The HTTP response header name.
+* `override` - (Required) Whether CloudFront overrides a response header with the same name received from the origin with the header specifies here.
+* `value` - (Required) The value for the HTTP response header.
+
+### Remove Header
+
+* `header` - (Required) The HTTP header name.
+
+### Security Headers Config
+
+* `contentSecurityPolicy` - (Optional) The policy directives and their values that CloudFront includes as values for the `contentSecurityPolicy` HTTP response header. See [Content Security Policy](#content-security-policy) for more information.
+* `contentTypeOptions` - (Optional) Determines whether CloudFront includes the `xContentTypeOptions` HTTP response header with its value set to `nosniff`. See [Content Type Options](#content-type-options) for more information.
+* `frameOptions` - (Optional) Determines whether CloudFront includes the `xFrameOptions` HTTP response header and the header’s value. See [Frame Options](#frame-options) for more information.
+* `referrerPolicy` - (Optional) Determines whether CloudFront includes the `referrerPolicy` HTTP response header and the header’s value. See [Referrer Policy](#referrer-policy) for more information.
+* `strictTransportSecurity` - (Optional) Determines whether CloudFront includes the `strictTransportSecurity` HTTP response header and the header’s value. See [Strict Transport Security](#strict-transport-security) for more information.
+* `xssProtection` - (Optional) Determine whether CloudFront includes the `xXssProtection` HTTP response header and the header’s value. See [XSS Protection](#xss-protection) for more information.
+
+### Content Security Policy
+
+* `contentSecurityPolicy` - (Required) The policy directives and their values that CloudFront includes as values for the `contentSecurityPolicy` HTTP response header.
+* `override` - (Required) Whether CloudFront overrides the `contentSecurityPolicy` HTTP response header received from the origin with the one specified in this response headers policy.
+
+### Content Type Options
+
+* `override` - (Required) Whether CloudFront overrides the `xContentTypeOptions` HTTP response header received from the origin with the one specified in this response headers policy.
+
+### Frame Options
+
+* `frameOption` - (Required) The value of the `xFrameOptions` HTTP response header. Valid values: `deny` | `sameorigin`
+* `override` - (Required) Whether CloudFront overrides the `xFrameOptions` HTTP response header received from the origin with the one specified in this response headers policy.
+
+### Referrer Policy
+
+* `referrerPolicy` - (Required) The value of the `referrerPolicy` HTTP response header. Valid Values: `noReferrer` | `noReferrerWhenDowngrade` | `origin` | `originWhenCrossOrigin` | `sameOrigin` | `strictOrigin` | `strictOriginWhenCrossOrigin` | `unsafeUrl`
+* `override` - (Required) Whether CloudFront overrides the `referrerPolicy` HTTP response header received from the origin with the one specified in this response headers policy.
+
+### Strict Transport Security
+
+* `accessControlMaxAgeSec` - (Required) A number that CloudFront uses as the value for the `maxAge` directive in the `strictTransportSecurity` HTTP response header.
+* `includeSubdomains` - (Optional) Whether CloudFront includes the `includeSubDomains` directive in the `strictTransportSecurity` HTTP response header.
+* `override` - (Required) Whether CloudFront overrides the `strictTransportSecurity` HTTP response header received from the origin with the one specified in this response headers policy.
+* `preload` - (Optional) Whether CloudFront includes the `preload` directive in the `strictTransportSecurity` HTTP response header.
+
+### XSS Protection
+
+* `modeBlock` - (Optional) Whether CloudFront includes the `mode=block` directive in the `xXssProtection` header.
+* `override` - (Required) Whether CloudFront overrides the `xXssProtection` HTTP response header received from the origin with the one specified in this response headers policy.
+* `protection` - (Required) A Boolean value that determines the value of the `xXssProtection` HTTP response header. When this setting is `true`, the value of the `xXssProtection` header is `1`. When this setting is `false`, the value of the `xXssProtection` header is `0`.
+* `reportUri` - (Optional) A reporting URI, which CloudFront uses as the value of the report directive in the `xXssProtection` header. You cannot specify a `reportUri` when `modeBlock` is `true`.
+
+### Server Timing Headers Config
+
+* `enabled` - (Required) A Whether CloudFront adds the `serverTiming` header to HTTP responses that it sends in response to requests that match a cache behavior that's associated with this response headers policy.
+* `samplingRate` - (Required) A number 0–100 (inclusive) that specifies the percentage of responses that you want CloudFront to add the Server-Timing header to. Valid range: Minimum value of 0.0. Maximum value of 100.0.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `etag` - The current version of the response headers policy.
+* `id` - The identifier for the response headers policy.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Cloudfront Response Headers Policies using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Cloudfront Response Headers Policies using the `id`. For example:
+
+```console
+% terraform import aws_cloudfront_response_headers_policy.policy 658327ea-f89d-4fab-a63d-7e88639e58f9
+```
+
+<!-- cache-key: cdktf-0.18.0 input-15a6be73fafecd64814710cc46b232493b1b75d7043901288106fe05e9584aec -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/cloudhsm_v2_cluster.html.markdown b/website/docs/cdktf/typescript/r/cloudhsm_v2_cluster.html.markdown
new file mode 100644
index 00000000000..670c07c6349
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/cloudhsm_v2_cluster.html.markdown
@@ -0,0 +1,138 @@
+---
+subcategory: "CloudHSM"
+layout: "aws"
+page_title: "AWS: aws_cloudhsm_v2_cluster"
+description: |-
+  Provides a CloudHSM v2 resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudhsm_v2_cluster
+
+Creates an Amazon CloudHSM v2 cluster.
+
+For information about CloudHSM v2, see the
+[AWS CloudHSM User Guide][1] and the [Amazon
+CloudHSM API Reference][2].
+
+~> **NOTE:** A CloudHSM Cluster can take several minutes to set up.
+Practically no single attribute can be updated, except for `tags`.
+If you need to delete a cluster, you have to remove its HSM modules first.
+To initialize cluster, you have to add an HSM instance to the cluster, then sign CSR and upload it.
+
+## Example Usage
+
+The following example below creates a CloudHSM cluster.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformCount, Fn, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudhsmV2Cluster } from "./.gen/providers/aws/cloudhsm-v2-cluster";
+import { DataAwsAvailabilityZones } from "./.gen/providers/aws/data-aws-availability-zones";
+import { AwsProvider } from "./.gen/providers/aws/provider";
+import { Subnet } from "./.gen/providers/aws/subnet";
+import { Vpc } from "./.gen/providers/aws/vpc";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AwsProvider(this, "aws", {
+      region: awsRegion.stringValue,
+    });
+    const cloudhsmV2Vpc = new Vpc(this, "cloudhsm_v2_vpc", {
+      cidrBlock: "10.0.0.0/16",
+      tags: {
+        Name: "example-aws_cloudhsm_v2_cluster",
+      },
+    });
+    const available = new DataAwsAvailabilityZones(this, "available", {});
+    /*In most cases loops should be handled in the programming language context and 
+    not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+    you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+    you need to keep this like it is.*/
+    const cloudhsmV2SubnetsCount = TerraformCount.of(Token.asNumber("2"));
+    const cloudhsmV2Subnets = new Subnet(this, "cloudhsm_v2_subnets", {
+      availabilityZone: Token.asString(
+        Fn.element(
+          available.names,
+          Token.asNumber(cloudhsmV2SubnetsCount.index)
+        )
+      ),
+      cidrBlock: Token.asString(
+        Fn.element(subnets.value, Token.asNumber(cloudhsmV2SubnetsCount.index))
+      ),
+      mapPublicIpOnLaunch: false,
+      tags: {
+        Name: "example-aws_cloudhsm_v2_cluster",
+      },
+      vpcId: cloudhsmV2Vpc.id,
+      count: cloudhsmV2SubnetsCount,
+    });
+    new CloudhsmV2Cluster(this, "cloudhsm_v2_cluster", {
+      hsmType: "hsm1.medium",
+      subnetIds: Token.asList(Fn.lookupNested(cloudhsmV2Subnets, ["*", "id"])),
+      tags: {
+        Name: "example-aws_cloudhsm_v2_cluster",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `sourceBackupIdentifier` - (Optional) ID of Cloud HSM v2 cluster backup to be restored.
+* `hsmType` - (Required) The type of HSM module in the cluster. Currently, only `hsm1Medium` is supported.
+* `subnetIds` - (Required) The IDs of subnets in which cluster will operate.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `clusterId` - The id of the CloudHSM cluster.
+* `clusterState` - The state of the CloudHSM cluster.
+* `vpcId` - The id of the VPC that the CloudHSM cluster resides in.
+* `securityGroupId` - The ID of the security group associated with the CloudHSM cluster.
+* `clusterCertificates` - The list of cluster certificates.
+    * `clusterCertificates0ClusterCertificate` - The cluster certificate issued (signed) by the issuing certificate authority (CA) of the cluster's owner.
+    * `clusterCertificates0ClusterCsr` - The certificate signing request (CSR). Available only in `uninitialized` state after an HSM instance is added to the cluster.
+    * `clusterCertificates0AwsHardwareCertificate` - The HSM hardware certificate issued (signed) by AWS CloudHSM.
+    * `clusterCertificates0HsmCertificate` - The HSM certificate issued (signed) by the HSM hardware.
+    * `clusterCertificates0ManufacturerHardwareCertificate` - The HSM hardware certificate issued (signed) by the hardware manufacturer.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+[1]: https://docs.aws.amazon.com/cloudhsm/latest/userguide/introduction.html
+[2]: https://docs.aws.amazon.com/cloudhsm/latest/APIReference/Welcome.html
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudHSM v2 Clusters using the cluster `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import CloudHSM v2 Clusters using the cluster `id`. For example:
+
+```console
+% terraform import aws_cloudhsm_v2_cluster.test_cluster cluster-aeb282a201
+```
+
+<!-- cache-key: cdktf-0.18.0 input-60608d99ff28e60f3d4ab022d7e83a5948556613036f369878a80719c7316ce2 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/cloudhsm_v2_hsm.html.markdown b/website/docs/cdktf/typescript/r/cloudhsm_v2_hsm.html.markdown
new file mode 100644
index 00000000000..810130d3337
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/cloudhsm_v2_hsm.html.markdown
@@ -0,0 +1,85 @@
+---
+subcategory: "CloudHSM"
+layout: "aws"
+page_title: "AWS: aws_cloudhsm_v2_hsm"
+description: |-
+  Provides a CloudHSM v2 HSM module resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudhsm_v2_hsm
+
+Creates an HSM module in Amazon CloudHSM v2 cluster.
+
+## Example Usage
+
+The following example below creates an HSM module in CloudHSM cluster.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, Fn, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudhsmV2Hsm } from "./.gen/providers/aws/cloudhsm-v2-hsm";
+import { DataAwsCloudhsmV2Cluster } from "./.gen/providers/aws/data-aws-cloudhsm-v2-cluster";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const cluster = new DataAwsCloudhsmV2Cluster(this, "cluster", {
+      clusterId: cloudhsmClusterId.stringValue,
+    });
+    new CloudhsmV2Hsm(this, "cloudhsm_v2_hsm", {
+      clusterId: Token.asString(cluster.clusterId),
+      subnetId: Token.asString(Fn.lookupNested(cluster.subnetIds, ["0"])),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+~> **NOTE:** Either `subnetId` or `availabilityZone` must be specified.
+
+* `clusterId` - (Required) The ID of Cloud HSM v2 cluster to which HSM will be added.
+* `subnetId` - (Optional) The ID of subnet in which HSM module will be located. Conflicts with `availabilityZone`.
+* `availabilityZone` - (Optional) The IDs of AZ in which HSM module will be located. Conflicts with `subnetId`.
+* `ipAddress` - (Optional) The IP address of HSM module. Must be within the CIDR of selected subnet.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `hsmId` - The id of the HSM module.
+* `hsmState` - The state of the HSM module.
+* `hsmEniId` - The id of the ENI interface allocated for HSM module.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import HSM modules using their HSM ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import HSM modules using their HSM ID. For example:
+
+```console
+% terraform import aws_cloudhsm_v2_hsm.bar hsm-quo8dahtaca
+```
+
+<!-- cache-key: cdktf-0.18.0 input-3969951d1910a8cfdfc7ba1e038e8b5797479bc0a89a46b5174ec4142d750a5c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/cloudsearch_domain.html.markdown b/website/docs/cdktf/typescript/r/cloudsearch_domain.html.markdown
new file mode 100644
index 00000000000..d4b9d626f4a
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/cloudsearch_domain.html.markdown
@@ -0,0 +1,141 @@
+---
+subcategory: "CloudSearch"
+layout: "aws"
+page_title: "AWS: aws_cloudsearch_domain"
+description: |-
+  Provides an CloudSearch domain resource. 
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudsearch_domain
+
+Provides an CloudSearch domain resource.
+
+Terraform waits for the domain to become `active` when applying a configuration.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudsearchDomain } from "./.gen/providers/aws/cloudsearch-domain";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new CloudsearchDomain(this, "example", {
+      indexField: [
+        {
+          analysisScheme: "_en_default_",
+          highlight: false,
+          name: "headline",
+          return: true,
+          search: true,
+          sort: true,
+          type: "text",
+        },
+        {
+          facet: true,
+          name: "price",
+          return: true,
+          search: true,
+          sort: true,
+          sourceFields: "headline",
+          type: "double",
+        },
+      ],
+      name: "example-domain",
+      scalingParameters: {
+        desiredInstanceType: "search.medium",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `endpointOptions` - (Optional) Domain endpoint options. Documented below.
+* `indexField` - (Optional) The index fields for documents added to the domain. Documented below.
+* `multiAz` - (Optional) Whether or not to maintain extra instances for the domain in a second Availability Zone to ensure high availability.
+* `name` - (Required) The name of the CloudSearch domain.
+* `scalingParameters` - (Optional) Domain scaling parameters. Documented below.
+
+### endpoint_options
+
+This configuration block supports the following attributes:
+
+* `enforceHttps` - (Optional) Enables or disables the requirement that all requests to the domain arrive over HTTPS.
+* `tlsSecurityPolicy` - (Optional) The minimum required TLS version. See the [AWS documentation](https://docs.aws.amazon.com/cloudsearch/latest/developerguide/API_DomainEndpointOptions.html) for valid values.
+
+### scaling_parameters
+
+This configuration block supports the following attributes:
+
+* `desiredInstanceType` - (Optional) The instance type that you want to preconfigure for your domain. See the [AWS documentation](https://docs.aws.amazon.com/cloudsearch/latest/developerguide/API_ScalingParameters.html) for valid values.
+* `desiredPartitionCount` - (Optional) The number of partitions you want to preconfigure for your domain. Only valid when you select `search2Xlarge` as the instance type.
+* `desiredReplicationCount` - (Optional) The number of replicas you want to preconfigure for each index partition.
+
+### index_field
+
+This configuration block supports the following attributes:
+
+* `name` - (Required) A unique name for the field. Field names must begin with a letter and be at least 3 and no more than 64 characters long. The allowed characters are: `a`-`z` (lower-case letters), `0`-`9`, and `_` (underscore). The name `score` is reserved and cannot be used as a field name.
+* `type` - (Required) The field type. Valid values: `date`, `dateArray`, `double`, `doubleArray`, `int`, `intArray`, `literal`, `literalArray`, `text`, `textArray`.
+* `analysisScheme` - (Optional) The analysis scheme you want to use for a `text` field. The analysis scheme specifies the language-specific text processing options that are used during indexing.
+* `defaultValue` - (Optional) The default value for the field. This value is used when no value is specified for the field in the document data.
+* `facet` - (Optional) You can get facet information by enabling this.
+* `highlight` - (Optional) You can highlight information.
+* `return` - (Optional) You can enable returning the value of all searchable fields.
+* `search` - (Optional) You can set whether this index should be searchable or not.
+* `sort` - (Optional) You can enable the property to be sortable.
+* `sourceFields` - (Optional) A comma-separated list of source fields to map to the field. Specifying a source field copies data from one field to another, enabling you to use the same source data in different ways by configuring different options for the fields.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The domain's ARN.
+* `documentServiceEndpoint` - The service endpoint for updating documents in a search domain.
+* `domainId` - An internally generated unique identifier for the domain.
+* `searchServiceEndpoint` - The service endpoint for requesting search results from a search domain.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `30M`)
+* `update` - (Default `30M`)
+* `delete` - (Default `20M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudSearch Domains using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import CloudSearch Domains using the `name`. For example:
+
+```console
+% terraform import aws_cloudsearch_domain.example example-domain
+```
+
+<!-- cache-key: cdktf-0.18.0 input-df7fa25a0a776188ea2cf1cb4023457fb311e8f2073fe09ae64b76245200a9e4 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/cloudsearch_domain_service_access_policy.html.markdown b/website/docs/cdktf/typescript/r/cloudsearch_domain_service_access_policy.html.markdown
new file mode 100644
index 00000000000..df80252c9a5
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/cloudsearch_domain_service_access_policy.html.markdown
@@ -0,0 +1,116 @@
+---
+subcategory: "CloudSearch"
+layout: "aws"
+page_title: "AWS: aws_cloudsearch_domain_service_access_policy"
+description: |-
+  Provides an CloudSearch domain service access policy resource. 
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudsearch_domain_service_access_policy
+
+Provides an CloudSearch domain service access policy resource.
+
+Terraform waits for the domain service access policy to become `active` when applying a configuration.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudsearchDomain } from "./.gen/providers/aws/cloudsearch-domain";
+import { CloudsearchDomainServiceAccessPolicy } from "./.gen/providers/aws/cloudsearch-domain-service-access-policy";
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new CloudsearchDomain(this, "example", {
+      name: "example-domain",
+    });
+    const dataAwsIamPolicyDocumentExample = new DataAwsIamPolicyDocument(
+      this,
+      "example_1",
+      {
+        statement: [
+          {
+            actions: ["cloudsearch:search", "cloudsearch:document"],
+            condition: [
+              {
+                test: "IpAddress",
+                values: ["192.0.2.0/32"],
+                variable: "aws:SourceIp",
+              },
+            ],
+            effect: "Allow",
+            principals: [
+              {
+                identifiers: ["*"],
+                type: "*",
+              },
+            ],
+            sid: "search_only",
+          },
+        ],
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsIamPolicyDocumentExample.overrideLogicalId("example");
+    const awsCloudsearchDomainServiceAccessPolicyExample =
+      new CloudsearchDomainServiceAccessPolicy(this, "example_2", {
+        accessPolicy: Token.asString(dataAwsIamPolicyDocumentExample.json),
+        domainName: example.id,
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsCloudsearchDomainServiceAccessPolicyExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `accessPolicy` - (Required) The access rules you want to configure. These rules replace any existing rules. See the [AWS documentation](https://docs.aws.amazon.com/cloudsearch/latest/developerguide/configuring-access.html) for details.
+* `domainName` - (Required) The CloudSearch domain name the policy applies to.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `update` - (Default `20M`)
+* `delete` - (Default `20M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudSearch domain service access policies using the domain name. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import CloudSearch domain service access policies using the domain name. For example:
+
+```console
+% terraform import aws_cloudsearch_domain_service_access_policy.example example-domain
+```
+
+<!-- cache-key: cdktf-0.18.0 input-c2ebea6afae4e24a2fd5837f7a4fbdb9c6667ec6f7293e498314a0c3b1c43e87 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/cloudtrail.html.markdown b/website/docs/cdktf/typescript/r/cloudtrail.html.markdown
new file mode 100644
index 00000000000..2618bde2307
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/cloudtrail.html.markdown
@@ -0,0 +1,562 @@
+---
+subcategory: "CloudTrail"
+layout: "aws"
+page_title: "AWS: aws_cloudtrail"
+description: |-
+  Provides a CloudTrail resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudtrail
+
+Provides a CloudTrail resource.
+
+-> **Tip:** For a multi-region trail, this resource must be in the home region of the trail.
+
+-> **Tip:** For an organization trail, this resource must be in the master account of the organization.
+
+## Example Usage
+
+### Basic
+
+Enable CloudTrail to capture all compatible management events in region.
+For capturing events from services like IAM, `includeGlobalServiceEvents` must be enabled.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Cloudtrail } from "./.gen/providers/aws/cloudtrail";
+import { DataAwsCallerIdentity } from "./.gen/providers/aws/data-aws-caller-identity";
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { DataAwsPartition } from "./.gen/providers/aws/data-aws-partition";
+import { DataAwsRegion } from "./.gen/providers/aws/data-aws-region";
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketPolicy } from "./.gen/providers/aws/s3-bucket-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new S3Bucket(this, "example", {
+      bucket: "tf-test-trail",
+      forceDestroy: true,
+    });
+    const current = new DataAwsCallerIdentity(this, "current", {});
+    const dataAwsPartitionCurrent = new DataAwsPartition(this, "current_2", {});
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsPartitionCurrent.overrideLogicalId("current");
+    const dataAwsRegionCurrent = new DataAwsRegion(this, "current_3", {});
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsRegionCurrent.overrideLogicalId("current");
+    const awsCloudtrailExample = new Cloudtrail(this, "example_4", {
+      includeGlobalServiceEvents: false,
+      name: "example",
+      s3BucketName: example.id,
+      s3KeyPrefix: "prefix",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsCloudtrailExample.overrideLogicalId("example");
+    const dataAwsIamPolicyDocumentExample = new DataAwsIamPolicyDocument(
+      this,
+      "example_5",
+      {
+        statement: [
+          {
+            actions: ["s3:GetBucketAcl"],
+            condition: [
+              {
+                test: "StringEquals",
+                values: [
+                  "arn:${" +
+                    dataAwsPartitionCurrent.partition +
+                    "}:cloudtrail:${" +
+                    dataAwsRegionCurrent.name +
+                    "}:${" +
+                    current.accountId +
+                    "}:trail/example",
+                ],
+                variable: "aws:SourceArn",
+              },
+            ],
+            effect: "Allow",
+            principals: [
+              {
+                identifiers: ["cloudtrail.amazonaws.com"],
+                type: "Service",
+              },
+            ],
+            resources: [example.arn],
+            sid: "AWSCloudTrailAclCheck",
+          },
+          {
+            actions: ["s3:PutObject"],
+            condition: [
+              {
+                test: "StringEquals",
+                values: ["bucket-owner-full-control"],
+                variable: "s3:x-amz-acl",
+              },
+              {
+                test: "StringEquals",
+                values: [
+                  "arn:${" +
+                    dataAwsPartitionCurrent.partition +
+                    "}:cloudtrail:${" +
+                    dataAwsRegionCurrent.name +
+                    "}:${" +
+                    current.accountId +
+                    "}:trail/example",
+                ],
+                variable: "aws:SourceArn",
+              },
+            ],
+            effect: "Allow",
+            principals: [
+              {
+                identifiers: ["cloudtrail.amazonaws.com"],
+                type: "Service",
+              },
+            ],
+            resources: [
+              "${" +
+                example.arn +
+                "}/prefix/AWSLogs/${" +
+                current.accountId +
+                "}/*",
+            ],
+            sid: "AWSCloudTrailWrite",
+          },
+        ],
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsIamPolicyDocumentExample.overrideLogicalId("example");
+    const awsS3BucketPolicyExample = new S3BucketPolicy(this, "example_6", {
+      bucket: example.id,
+      policy: Token.asString(dataAwsIamPolicyDocumentExample.json),
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketPolicyExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### Data Event Logging
+
+CloudTrail can log [Data Events](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.html) for certain services such as S3 objects and Lambda function invocations. Additional information about data event configuration can be found in the following links:
+
+* [CloudTrail API DataResource documentation](https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_DataResource.html) (for basic event selector).
+* [CloudTrail API AdvancedFieldSelector documentation](https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_AdvancedFieldSelector.html) (for advanced event selector).
+
+#### Logging All Lambda Function Invocations By Using Basic Event Selectors
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Cloudtrail } from "./.gen/providers/aws/cloudtrail";
+interface MyConfig {
+  name: any;
+  s3BucketName: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new Cloudtrail(this, "example", {
+      eventSelector: [
+        {
+          dataResource: [
+            {
+              type: "AWS::Lambda::Function",
+              values: ["arn:aws:lambda"],
+            },
+          ],
+          includeManagementEvents: true,
+          readWriteType: "All",
+        },
+      ],
+      name: config.name,
+      s3BucketName: config.s3BucketName,
+    });
+  }
+}
+
+```
+
+#### Logging All S3 Object Events By Using Basic Event Selectors
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Cloudtrail } from "./.gen/providers/aws/cloudtrail";
+interface MyConfig {
+  name: any;
+  s3BucketName: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new Cloudtrail(this, "example", {
+      eventSelector: [
+        {
+          dataResource: [
+            {
+              type: "AWS::S3::Object",
+              values: ["arn:aws:s3"],
+            },
+          ],
+          includeManagementEvents: true,
+          readWriteType: "All",
+        },
+      ],
+      name: config.name,
+      s3BucketName: config.s3BucketName,
+    });
+  }
+}
+
+```
+
+#### Logging Individual S3 Bucket Events By Using Basic Event Selectors
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Cloudtrail } from "./.gen/providers/aws/cloudtrail";
+import { DataAwsS3Bucket } from "./.gen/providers/aws/data-aws-s3-bucket";
+interface MyConfig {
+  name: any;
+  s3BucketName: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    const importantBucket = new DataAwsS3Bucket(this, "important-bucket", {
+      bucket: "important-bucket",
+    });
+    new Cloudtrail(this, "example", {
+      eventSelector: [
+        {
+          dataResource: [
+            {
+              type: "AWS::S3::Object",
+              values: ["${" + importantBucket.arn + "}/"],
+            },
+          ],
+          includeManagementEvents: true,
+          readWriteType: "All",
+        },
+      ],
+      name: config.name,
+      s3BucketName: config.s3BucketName,
+    });
+  }
+}
+
+```
+
+#### Logging All S3 Object Events Except For Two S3 Buckets By Using Advanced Event Selectors
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Cloudtrail } from "./.gen/providers/aws/cloudtrail";
+import { DataAwsS3Bucket } from "./.gen/providers/aws/data-aws-s3-bucket";
+interface MyConfig {
+  name: any;
+  s3BucketName: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    const notImportantBucket1 = new DataAwsS3Bucket(
+      this,
+      "not-important-bucket-1",
+      {
+        bucket: "not-important-bucket-1",
+      }
+    );
+    const notImportantBucket2 = new DataAwsS3Bucket(
+      this,
+      "not-important-bucket-2",
+      {
+        bucket: "not-important-bucket-2",
+      }
+    );
+    new Cloudtrail(this, "example", {
+      advancedEventSelector: [
+        {
+          fieldSelector: [
+            {
+              equalTo: ["Data"],
+              field: "eventCategory",
+            },
+            {
+              field: "resources.ARN",
+              notStartsWith: [
+                "${" + notImportantBucket1.arn + "}/",
+                "${" + notImportantBucket2.arn + "}/",
+              ],
+            },
+            {
+              equalTo: ["AWS::S3::Object"],
+              field: "resources.type",
+            },
+          ],
+          name: "Log all S3 objects events except for two S3 buckets",
+        },
+        {
+          fieldSelector: [
+            {
+              equalTo: ["Management"],
+              field: "eventCategory",
+            },
+          ],
+          name: "Log readOnly and writeOnly management events",
+        },
+      ],
+      name: config.name,
+      s3BucketName: config.s3BucketName,
+    });
+  }
+}
+
+```
+
+#### Logging Individual S3 Buckets And Specific Event Names By Using Advanced Event Selectors
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Cloudtrail } from "./.gen/providers/aws/cloudtrail";
+import { DataAwsS3Bucket } from "./.gen/providers/aws/data-aws-s3-bucket";
+interface MyConfig {
+  name: any;
+  s3BucketName: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    const importantBucket1 = new DataAwsS3Bucket(this, "important-bucket-1", {
+      bucket: "important-bucket-1",
+    });
+    const importantBucket2 = new DataAwsS3Bucket(this, "important-bucket-2", {
+      bucket: "important-bucket-2",
+    });
+    const importantBucket3 = new DataAwsS3Bucket(this, "important-bucket-3", {
+      bucket: "important-bucket-3",
+    });
+    new Cloudtrail(this, "example", {
+      advancedEventSelector: [
+        {
+          fieldSelector: [
+            {
+              equalTo: ["Data"],
+              field: "eventCategory",
+            },
+            {
+              equalTo: ["PutObject", "DeleteObject"],
+              field: "eventName",
+            },
+            {
+              field: "resources.ARN",
+              startsWith: [
+                "${" + importantBucket1.arn + "}/",
+                "${" + importantBucket2.arn + "}/",
+              ],
+            },
+            {
+              equalTo: ["false"],
+              field: "readOnly",
+            },
+            {
+              equalTo: ["AWS::S3::Object"],
+              field: "resources.type",
+            },
+          ],
+          name: "Log PutObject and DeleteObject events for two S3 buckets",
+        },
+        {
+          fieldSelector: [
+            {
+              equalTo: ["Data"],
+              field: "eventCategory",
+            },
+            {
+              field: "eventName",
+              startsWith: ["Delete"],
+            },
+            {
+              equalTo: ["${" + importantBucket3.arn + "}/important-prefix"],
+              field: "resources.ARN",
+            },
+            {
+              equalTo: ["false"],
+              field: "readOnly",
+            },
+            {
+              equalTo: ["AWS::S3::Object"],
+              field: "resources.type",
+            },
+          ],
+          name: "Log Delete* events for one S3 bucket",
+        },
+      ],
+      name: config.name,
+      s3BucketName: config.s3BucketName,
+    });
+  }
+}
+
+```
+
+#### Sending Events to CloudWatch Logs
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Cloudtrail } from "./.gen/providers/aws/cloudtrail";
+import { CloudwatchLogGroup } from "./.gen/providers/aws/cloudwatch-log-group";
+interface MyConfig {
+  name: any;
+  s3BucketName: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    const example = new CloudwatchLogGroup(this, "example", {
+      name: "Example",
+    });
+    const awsCloudtrailExample = new Cloudtrail(this, "example_1", {
+      cloudWatchLogsGroupArn: "${" + example.arn + "}:*",
+      name: config.name,
+      s3BucketName: config.s3BucketName,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsCloudtrailExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) Name of the trail.
+* `s3BucketName` - (Required) Name of the S3 bucket designated for publishing log files.
+
+The following arguments are optional:
+
+* `advancedEventSelector` - (Optional) Specifies an advanced event selector for enabling data event logging. Fields documented below. Conflicts with `eventSelector`.
+* `cloudWatchLogsGroupArn` - (Optional) Log group name using an ARN that represents the log group to which CloudTrail logs will be delivered. Note that CloudTrail requires the Log Stream wildcard.
+* `cloudWatchLogsRoleArn` - (Optional) Role for the CloudWatch Logs endpoint to assume to write to a user’s log group.
+* `enableLogFileValidation` - (Optional) Whether log file integrity validation is enabled. Defaults to `false`.
+* `enableLogging` - (Optional) Enables logging for the trail. Defaults to `true`. Setting this to `false` will pause logging.
+* `eventSelector` - (Optional) Specifies an event selector for enabling data event logging. Fields documented below. Please note the [CloudTrail limits](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/WhatIsCloudTrail-Limits.html) when configuring these. Conflicts with `advancedEventSelector`.
+* `includeGlobalServiceEvents` - (Optional) Whether the trail is publishing events from global services such as IAM to the log files. Defaults to `true`.
+* `insightSelector` - (Optional) Configuration block for identifying unusual operational activity. See details below.
+* `isMultiRegionTrail` - (Optional) Whether the trail is created in the current region or in all regions. Defaults to `false`.
+* `isOrganizationTrail` - (Optional) Whether the trail is an AWS Organizations trail. Organization trails log events for the master account and all member accounts. Can only be created in the organization master account. Defaults to `false`.
+* `kmsKeyId` - (Optional) KMS key ARN to use to encrypt the logs delivered by CloudTrail.
+* `s3KeyPrefix` - (Optional) S3 key prefix that follows the name of the bucket you have designated for log file delivery.
+* `snsTopicName` - (Optional) Name of the Amazon SNS topic defined for notification of log file delivery.
+* `tags` - (Optional) Map of tags to assign to the trail. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### event_selector
+
+* `dataResource` - (Optional) Configuration block for data events. See details below.
+* `excludeManagementEventSources` (Optional) -  A set of event sources to exclude. Valid values include: `kmsAmazonawsCom` and `rdsdataAmazonawsCom`. `includeManagementEvents` must be set to`true` to allow this.
+* `includeManagementEvents` - (Optional) Whether to include management events for your trail. Defaults to `true`.
+* `readWriteType` - (Optional) Type of events to log. Valid values are `readOnly`, `writeOnly`, `all`. Default value is `all`.
+
+#### data_resource
+
+* `type` - (Required) Resource type in which you want to log data events. You can specify only the following value: "AWS::S3::Object", "AWS::Lambda::Function" and "AWS::DynamoDB::Table".
+* `values` - (Required) List of ARN strings or partial ARN strings to specify selectors for data audit events over data resources. ARN list is specific to single-valued `type`. For example, `arn:aws:s3:::<bucket name>/` for all objects in a bucket, `arn:aws:s3:::<bucket name>/key` for specific objects, `arn:aws:lambda` for all lambda events within an account, `arn:aws:lambda:<region>:<account number>:function:<function name>` for a specific Lambda function, `arn:aws:dynamodb` for all DDB events for all tables within an account, or `arn:aws:dynamodb:<region>:<account number>:table/<table name>` for a specific DynamoDB table.
+
+### insight_selector
+
+* `insightType` - (Optional) Type of insights to log on a trail. Valid values are: `apiCallRateInsight` and `apiErrorRateInsight`.
+
+### Advanced Event Selector Arguments
+
+* `fieldSelector` (Required) - Specifies the selector statements in an advanced event selector. Fields documented below.
+* `name` (Optional) - Name of the advanced event selector.
+
+#### Field Selector Arguments
+
+* `field` (Required) - Field in an event record on which to filter events to be logged. You can specify only the following values: `readOnly`, `eventSource`, `eventName`, `eventCategory`, `resourcesType`, `resourcesArn`.
+* `endsWith` (Optional) - A list of values that includes events that match the last few characters of the event record field specified as the value of `field`.
+* `equals` (Optional) - A list of values that includes events that match the exact value of the event record field specified as the value of `field`. This is the only valid operator that you can use with the `readOnly`, `eventCategory`, and `resourcesType` fields.
+* `notEndsWith` (Optional) - A list of values that excludes events that match the last few characters of the event record field specified as the value of `field`.
+* `notEquals` (Optional) - A list of values that excludes events that match the exact value of the event record field specified as the value of `field`.
+* `notStartsWith` (Optional) - A list of values that excludes events that match the first few characters of the event record field specified as the value of `field`.
+* `startsWith` (Optional) - A list of values that includes events that match the first few characters of the event record field specified as the value of `field`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the trail.
+* `homeRegion` - Region in which the trail was created.
+* `id` - Name of the trail.
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Cloudtrails using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Cloudtrails using the `name`. For example:
+
+```console
+% terraform import aws_cloudtrail.sample my-sample-trail
+```
+
+<!-- cache-key: cdktf-0.18.0 input-98216d45a2a27863ff111f0d40da50548fbed7371974a66a6d0f1d447b675fea -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/cloudtrail_event_data_store.html.markdown b/website/docs/cdktf/typescript/r/cloudtrail_event_data_store.html.markdown
new file mode 100644
index 00000000000..de2d6d4a799
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/cloudtrail_event_data_store.html.markdown
@@ -0,0 +1,165 @@
+---
+subcategory: "CloudTrail"
+layout: "aws"
+page_title: "AWS: aws_cloudtrail_event_data_store"
+description: |-
+  Provides a CloudTrail Event Data Store resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudtrail_event_data_store
+
+Provides a CloudTrail Event Data Store.
+
+More information about event data stores can be found in the [Event Data Store User Guide](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/query-event-data-store.html).
+
+-> **Tip:** For an organization event data store you must create this resource in the management account.
+
+## Example Usage
+
+### Basic
+
+The most simple event data store configuration requires us to only set the `name` attribute. The event data store will automatically capture all management events. To capture management events from all the regions, `multiRegionEnabled` must be `true`.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudtrailEventDataStore } from "./.gen/providers/aws/cloudtrail-event-data-store";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new CloudtrailEventDataStore(this, "example", {
+      name: "example-event-data-store",
+    });
+  }
+}
+
+```
+
+### Data Event Logging
+
+CloudTrail can log [Data Events](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.html) for certain services such as S3 bucket objects and Lambda function invocations. Additional information about data event configuration can be found in the following links:
+
+- [CloudTrail API AdvancedFieldSelector documentation](https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_AdvancedFieldSelector.html)
+
+#### Log all DynamoDB PutEvent actions for a specific DynamoDB table
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudtrailEventDataStore } from "./.gen/providers/aws/cloudtrail-event-data-store";
+import { DataAwsDynamodbTable } from "./.gen/providers/aws/data-aws-dynamodb-table";
+interface MyConfig {
+  name: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    const table = new DataAwsDynamodbTable(this, "table", {
+      name: "not-important-dynamodb-table",
+    });
+    new CloudtrailEventDataStore(this, "example", {
+      advancedEventSelector: [
+        {
+          fieldSelector: [
+            {
+              equalTo: ["Data"],
+              field: "eventCategory",
+            },
+            {
+              equalTo: ["AWS::DynamoDB::Table"],
+              field: "resources.type",
+            },
+            {
+              equalTo: ["PutItem"],
+              field: "eventName",
+            },
+            {
+              equalTo: [Token.asString(table.arn)],
+              field: "resources.ARN",
+            },
+          ],
+          name: "Log all DynamoDB PutEvent actions for a specific DynamoDB table",
+        },
+      ],
+      name: config.name,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+- `name` - (Required) The name of the event data store.
+- `advancedEventSelector` - (Optional) The advanced event selectors to use to select the events for the data store. For more information about how to use advanced event selectors, see [Log events by using advanced event selectors](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.html#creating-data-event-selectors-advanced) in the CloudTrail User Guide.
+- `multiRegionEnabled` - (Optional) Specifies whether the event data store includes events from all regions, or only from the region in which the event data store is created. Default: `true`.
+- `organizationEnabled` - (Optional) Specifies whether an event data store collects events logged for an organization in AWS Organizations. Default: `false`.
+- `retentionPeriod` - (Optional) The retention period of the event data store, in days. You can set a retention period of up to 2555 days, the equivalent of seven years. Default: `2555`.
+- `kmsKeyId` - Specifies the AWS KMS key ID to use to encrypt the events delivered by CloudTrail. The value can be an alias name prefixed by alias/, a fully specified ARN to an alias, a fully specified ARN to a key, or a globally unique identifier.
+- `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+- `terminationProtectionEnabled` - (Optional) Specifies whether termination protection is enabled for the event data store. If termination protection is enabled, you cannot delete the event data store until termination protection is disabled. Default: `true`.
+
+### Advanced Event Selector Arguments
+
+`advancedEventSelector` supports the following arguments:
+
+- `name` (Optional) - Specifies the name of the advanced event selector.
+- `fieldSelector` (Required) - Specifies the selector statements in an advanced event selector. Fields documented below.
+
+#### Field Selector Arguments
+
+`fieldSelector` supports the following arguments:
+
+- `field` (Required) - Specifies a field in an event record on which to filter events to be logged. You can specify only the following values: `readOnly`, `eventSource`, `eventName`, `eventCategory`, `resourcesType`, `resourcesArn`.
+- `equals` (Optional) - A list of values that includes events that match the exact value of the event record field specified as the value of `field`. This is the only valid operator that you can use with the `readOnly`, `eventCategory`, and `resourcesType` fields.
+- `notEquals` (Optional) - A list of values that excludes events that match the exact value of the event record field specified as the value of `field`.
+- `startsWith` (Optional) - A list of values that includes events that match the first few characters of the event record field specified as the value of `field`.
+- `notStartsWith` (Optional) - A list of values that excludes events that match the first few characters of the event record field specified as the value of `field`.
+- `endsWith` (Optional) - A list of values that includes events that match the last few characters of the event record field specified as the value of `field`.
+- `notEndsWith` (Optional) - A list of values that excludes events that match the last few characters of the event record field specified as the value of `field`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+- `arn` - ARN of the event data store.
+- `id` - Name of the event data store.
+- `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import event data stores using their `arn`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import event data stores using their `arn`. For example:
+
+```console
+% terraform import aws_cloudtrail_event_data_store.example arn:aws:cloudtrail:us-east-1:123456789123:eventdatastore/22333815-4414-412c-b155-dd254033gfhf
+```
+
+<!-- cache-key: cdktf-0.18.0 input-606e5cb558b509aa1002c2f846e4174eed937e4e6b6708dfbb236e4bae1cfe9d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/cloudwatch_composite_alarm.html.markdown b/website/docs/cdktf/typescript/r/cloudwatch_composite_alarm.html.markdown
new file mode 100644
index 00000000000..39dfa7c46a3
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/cloudwatch_composite_alarm.html.markdown
@@ -0,0 +1,98 @@
+---
+subcategory: "CloudWatch"
+layout: "aws"
+page_title: "AWS: aws_cloudwatch_composite_alarm"
+description: |-
+  Provides a CloudWatch Composite Alarm resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudwatch_composite_alarm
+
+Provides a CloudWatch Composite Alarm resource.
+
+~> **NOTE:** An alarm (composite or metric) cannot be destroyed when there are other composite alarms depending on it. This can lead to a cyclical dependency on update, as Terraform will unsuccessfully attempt to destroy alarms before updating the rule. Consider using `dependsOn`, references to alarm names, and two-stage updates.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudwatchCompositeAlarm } from "./.gen/providers/aws/cloudwatch-composite-alarm";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new CloudwatchCompositeAlarm(this, "example", {
+      actionsSuppressor: {
+        alarm: "suppressor-alarm",
+        extensionPeriod: 10,
+        waitPeriod: 20,
+      },
+      alarmActions: Token.asList(awsSnsTopicExample.arn),
+      alarmDescription: "This is a composite alarm!",
+      alarmName: "example-composite-alarm",
+      alarmRule:
+        "ALARM(${" +
+        alpha.alarmName +
+        "}) OR\nALARM(${" +
+        bravo.alarmName +
+        "})\n\n",
+      okActions: Token.asList(awsSnsTopicExample.arn),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `actionsEnabled` - (Optional, Forces new resource) Indicates whether actions should be executed during any changes to the alarm state of the composite alarm. Defaults to `true`.
+* `actionsSuppressor` - (Optional) Actions will be suppressed if the suppressor alarm is in the ALARM state.
+    * `alarm` - (Required) Can be an AlarmName or an Amazon Resource Name (ARN) from an existing alarm.
+    * `extensionPeriod` - (Required) The maximum time in seconds that the composite alarm waits after suppressor alarm goes out of the `alarm` state. After this time, the composite alarm performs its actions.
+    * `waitPeriod` - (Required) The maximum time in seconds that the composite alarm waits for the suppressor alarm to go into the `alarm` state. After this time, the composite alarm performs its actions.
+* `alarmActions` - (Optional) The set of actions to execute when this alarm transitions to the `alarm` state from any other state. Each action is specified as an ARN. Up to 5 actions are allowed.
+* `alarmDescription` - (Optional) The description for the composite alarm.
+* `alarmName` - (Required) The name for the composite alarm. This name must be unique within the region.
+* `alarmRule` - (Required) An expression that specifies which other alarms are to be evaluated to determine this composite alarm's state. For syntax, see [Creating a Composite Alarm](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Create_Composite_Alarm.html). The maximum length is 10240 characters.
+* `insufficientDataActions` - (Optional) The set of actions to execute when this alarm transitions to the `insufficientData` state from any other state. Each action is specified as an ARN. Up to 5 actions are allowed.
+* `okActions` - (Optional) The set of actions to execute when this alarm transitions to an `ok` state from any other state. Each action is specified as an ARN. Up to 5 actions are allowed.
+* `tags` - (Optional) A map of tags to associate with the alarm. Up to 50 tags are allowed. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the composite alarm.
+* `id` - The ID of the composite alarm resource, which is equivalent to its `alarmName`.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import a CloudWatch Composite Alarm using the `alarmName`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import a CloudWatch Composite Alarm using the `alarmName`. For example:
+
+```console
+% terraform import aws_cloudwatch_composite_alarm.test my-alarm
+```
+
+<!-- cache-key: cdktf-0.18.0 input-bc5f81d668dc98cce89e801ef7bbb869b647ded82d35c20f03ae8298b2d50282 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/cloudwatch_dashboard.html.markdown b/website/docs/cdktf/typescript/r/cloudwatch_dashboard.html.markdown
new file mode 100644
index 00000000000..50a5846e97c
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/cloudwatch_dashboard.html.markdown
@@ -0,0 +1,104 @@
+---
+subcategory: "CloudWatch"
+layout: "aws"
+page_title: "AWS: aws_cloudwatch_dashboard"
+description: |-
+  Provides a CloudWatch Dashboard resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudwatch_dashboard
+
+Provides a CloudWatch Dashboard resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudwatchDashboard } from "./.gen/providers/aws/cloudwatch-dashboard";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new CloudwatchDashboard(this, "main", {
+      dashboardBody: Token.asString(
+        Fn.jsonencode({
+          widgets: [
+            {
+              height: 6,
+              properties: {
+                metrics: [
+                  ["AWS/EC2", "CPUUtilization", "InstanceId", "i-012345"],
+                ],
+                period: 300,
+                region: "us-east-1",
+                stat: "Average",
+                title: "EC2 Instance CPU",
+              },
+              type: "metric",
+              width: 12,
+              x: 0,
+              y: 0,
+            },
+            {
+              height: 3,
+              properties: {
+                markdown: "Hello world",
+              },
+              type: "text",
+              width: 3,
+              x: 0,
+              y: 7,
+            },
+          ],
+        })
+      ),
+      dashboardName: "my-dashboard",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `dashboardName` - (Required) The name of the dashboard.
+* `dashboardBody` - (Required) The detailed information about the dashboard, including what widgets are included and their location on the dashboard. You can read more about the body structure in the [documentation](https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/CloudWatch-Dashboard-Body-Structure.html).
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `dashboardArn` - The Amazon Resource Name (ARN) of the dashboard.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudWatch dashboards using the `dashboardName`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import CloudWatch dashboards using the `dashboardName`. For example:
+
+```console
+% terraform import aws_cloudwatch_dashboard.sample dashboard_name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-2364f68cbb18d2dbd2754d885496d994d344609a1d9297eee7cdf140181ca478 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/cloudwatch_event_api_destination.html.markdown b/website/docs/cdktf/typescript/r/cloudwatch_event_api_destination.html.markdown
new file mode 100644
index 00000000000..a06b08118d5
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/cloudwatch_event_api_destination.html.markdown
@@ -0,0 +1,83 @@
+---
+subcategory: "EventBridge"
+layout: "aws"
+page_title: "AWS: aws_cloudwatch_event_api_destination"
+description: |-
+  Provides an EventBridge event API Destination resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudwatch_event_api_destination
+
+Provides an EventBridge event API Destination resource.
+
+~> **Note:** EventBridge was formerly known as CloudWatch Events. The functionality is identical.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudwatchEventApiDestination } from "./.gen/providers/aws/cloudwatch-event-api-destination";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new CloudwatchEventApiDestination(this, "test", {
+      connectionArn: Token.asString(awsCloudwatchEventConnectionTest.arn),
+      description: "An API Destination",
+      httpMethod: "POST",
+      invocationEndpoint: "https://api.destination.com/endpoint",
+      invocationRateLimitPerSecond: 20,
+      name: "api-destination",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the new API Destination. The name must be unique for your account. Maximum of 64 characters consisting of numbers, lower/upper case letters, .,-,_.
+* `description` - (Optional) The description of the new API Destination. Maximum of 512 characters.
+* `invocationEndpoint` - (Required) URL endpoint to invoke as a target. This could be a valid endpoint generated by a partner service. You can include "*" as path parameters wildcards to be set from the Target HttpParameters.
+* `httpMethod` - (Required) Select the HTTP method used for the invocation endpoint, such as GET, POST, PUT, etc.
+* `invocationRateLimitPerSecond` - (Optional) Enter the maximum number of invocations per second to allow for this destination. Enter a value greater than 0 (default 300).
+* `connectionArn` - (Required) ARN of the EventBridge Connection to use for the API Destination.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the event API Destination.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EventBridge API Destinations using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import EventBridge API Destinations using the `name`. For example:
+
+```console
+% terraform import aws_cloudwatch_event_api_destination.test api-destination
+```
+
+<!-- cache-key: cdktf-0.18.0 input-f0527648b10617b833d1ba117b6b713b350a47ccacb5b91bbd9d88762283759c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/cloudwatch_event_archive.html.markdown b/website/docs/cdktf/typescript/r/cloudwatch_event_archive.html.markdown
new file mode 100644
index 00000000000..1a613faf454
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/cloudwatch_event_archive.html.markdown
@@ -0,0 +1,128 @@
+---
+subcategory: "EventBridge"
+layout: "aws"
+page_title: "AWS: aws_cloudwatch_event_archive"
+description: |-
+  Provides an EventBridge event archive resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudwatch_event_archive
+
+Provides an EventBridge event archive resource.
+
+~> **Note:** EventBridge was formerly known as CloudWatch Events. The functionality is identical.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudwatchEventArchive } from "./.gen/providers/aws/cloudwatch-event-archive";
+import { CloudwatchEventBus } from "./.gen/providers/aws/cloudwatch-event-bus";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const order = new CloudwatchEventBus(this, "order", {
+      name: "orders",
+    });
+    const awsCloudwatchEventArchiveOrder = new CloudwatchEventArchive(
+      this,
+      "order_1",
+      {
+        eventSourceArn: order.arn,
+        name: "order-archive",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsCloudwatchEventArchiveOrder.overrideLogicalId("order");
+  }
+}
+
+```
+
+## Example all optional arguments
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudwatchEventArchive } from "./.gen/providers/aws/cloudwatch-event-archive";
+import { CloudwatchEventBus } from "./.gen/providers/aws/cloudwatch-event-bus";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const order = new CloudwatchEventBus(this, "order", {
+      name: "orders",
+    });
+    const awsCloudwatchEventArchiveOrder = new CloudwatchEventArchive(
+      this,
+      "order_1",
+      {
+        description: "Archived events from order service",
+        eventPattern: Token.asString(
+          Fn.jsonencode({
+            source: ["company.team.order"],
+          })
+        ),
+        eventSourceArn: order.arn,
+        name: "order-archive",
+        retentionDays: 7,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsCloudwatchEventArchiveOrder.overrideLogicalId("order");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the new event archive. The archive name cannot exceed 48 characters.
+* `eventSourceArn` - (Required) Event bus source ARN from where these events should be archived.
+* `description` - (Optional) The description of the new event archive.
+* `eventPattern` - (Optional) Instructs the new event archive to only capture events matched by this pattern. By default, it attempts to archive every event received in the `eventSourceArn`.
+* `retentionDays` - (Optional) The maximum number of days to retain events in the new event archive. By default, it archives indefinitely.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the event archive.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import an EventBridge archive using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import an EventBridge archive using the `name`. For example:
+
+```console
+% terraform import aws_cloudwatch_event_archive.imported_event_archive order-archive
+```
+
+<!-- cache-key: cdktf-0.18.0 input-230aef7101e3a99451d3a96541a344389622f8e93208093246611e6e08ee12b5 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/cloudwatch_event_bus.html.markdown b/website/docs/cdktf/typescript/r/cloudwatch_event_bus.html.markdown
new file mode 100644
index 00000000000..a3d6ff592a5
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/cloudwatch_event_bus.html.markdown
@@ -0,0 +1,111 @@
+---
+subcategory: "EventBridge"
+layout: "aws"
+page_title: "AWS: aws_cloudwatch_event_bus"
+description: |-
+  Provides an EventBridge event bus resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudwatch_event_bus
+
+Provides an EventBridge event bus resource.
+
+~> **Note:** EventBridge was formerly known as CloudWatch Events. The functionality is identical.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudwatchEventBus } from "./.gen/providers/aws/cloudwatch-event-bus";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new CloudwatchEventBus(this, "messenger", {
+      name: "chat-messages",
+    });
+  }
+}
+
+```
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudwatchEventBus } from "./.gen/providers/aws/cloudwatch-event-bus";
+import { DataAwsCloudwatchEventSource } from "./.gen/providers/aws/data-aws-cloudwatch-event-source";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const examplepartner = new DataAwsCloudwatchEventSource(
+      this,
+      "examplepartner",
+      {
+        namePrefix: "aws.partner/examplepartner.com",
+      }
+    );
+    const awsCloudwatchEventBusExamplepartner = new CloudwatchEventBus(
+      this,
+      "examplepartner_1",
+      {
+        eventSourceName: Token.asString(examplepartner.name),
+        name: Token.asString(examplepartner.name),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsCloudwatchEventBusExamplepartner.overrideLogicalId("examplepartner");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the new event bus. The names of custom event buses can't contain the / character. To create a partner event bus, ensure the `name` matches the `eventSourceName`.
+* `eventSourceName` (Optional) The partner event source that the new event bus will be matched with. Must match `name`.
+* `tags` - (Optional)  A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the event bus.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EventBridge event buses using the `name` (which can also be a partner event source name). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import EventBridge event buses using the `name` (which can also be a partner event source name). For example:
+
+```console
+% terraform import aws_cloudwatch_event_bus.messenger chat-messages
+```
+
+<!-- cache-key: cdktf-0.18.0 input-740b7ef9a57fce58b33a2b98397aad29a82f722b6025aed22c549b727c9580eb -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/cloudwatch_event_bus_policy.html.markdown b/website/docs/cdktf/typescript/r/cloudwatch_event_bus_policy.html.markdown
new file mode 100644
index 00000000000..2384a38c556
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/cloudwatch_event_bus_policy.html.markdown
@@ -0,0 +1,241 @@
+---
+subcategory: "EventBridge"
+layout: "aws"
+page_title: "AWS: aws_cloudwatch_event_bus_policy"
+description: |-
+  Provides a resource to create an EventBridge policy to support cross-account events.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudwatch_event_bus_policy
+
+Provides a resource to create an EventBridge resource policy to support cross-account events.
+
+~> **Note:** EventBridge was formerly known as CloudWatch Events. The functionality is identical.
+
+~> **Note:** The EventBridge bus policy resource  (`awsCloudwatchEventBusPolicy`) is incompatible with the EventBridge permission resource (`awsCloudwatchEventPermission`) and will overwrite permissions.
+
+## Example Usage
+
+### Account Access
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudwatchEventBusPolicy } from "./.gen/providers/aws/cloudwatch-event-bus-policy";
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const test = new DataAwsIamPolicyDocument(this, "test", {
+      statement: [
+        {
+          actions: ["events:PutEvents"],
+          effect: "Allow",
+          principals: [
+            {
+              identifiers: ["123456789012"],
+              type: "AWS",
+            },
+          ],
+          resources: [
+            "arn:aws:events:eu-west-1:123456789012:event-bus/default",
+          ],
+          sid: "DevAccountAccess",
+        },
+      ],
+    });
+    const awsCloudwatchEventBusPolicyTest = new CloudwatchEventBusPolicy(
+      this,
+      "test_1",
+      {
+        eventBusName: Token.asString(awsCloudwatchEventBusTest.name),
+        policy: Token.asString(test.json),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsCloudwatchEventBusPolicyTest.overrideLogicalId("test");
+  }
+}
+
+```
+
+### Organization Access
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudwatchEventBusPolicy } from "./.gen/providers/aws/cloudwatch-event-bus-policy";
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const test = new DataAwsIamPolicyDocument(this, "test", {
+      statement: [
+        {
+          actions: [
+            "events:DescribeRule",
+            "events:ListRules",
+            "events:ListTargetsByRule",
+            "events:ListTagsForResource",
+          ],
+          condition: [
+            {
+              test: "StringEquals",
+              values: [example.id],
+              variable: "aws:PrincipalOrgID",
+            },
+          ],
+          effect: "Allow",
+          principals: [
+            {
+              identifiers: ["*"],
+              type: "AWS",
+            },
+          ],
+          resources: [
+            "arn:aws:events:eu-west-1:123456789012:rule/*",
+            "arn:aws:events:eu-west-1:123456789012:event-bus/default",
+          ],
+          sid: "OrganizationAccess",
+        },
+      ],
+    });
+    const awsCloudwatchEventBusPolicyTest = new CloudwatchEventBusPolicy(
+      this,
+      "test_1",
+      {
+        eventBusName: Token.asString(awsCloudwatchEventBusTest.name),
+        policy: Token.asString(test.json),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsCloudwatchEventBusPolicyTest.overrideLogicalId("test");
+  }
+}
+
+```
+
+### Multiple Statements
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudwatchEventBusPolicy } from "./.gen/providers/aws/cloudwatch-event-bus-policy";
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const test = new DataAwsIamPolicyDocument(this, "test", {
+      statement: [
+        {
+          actions: ["events:PutEvents"],
+          effect: "Allow",
+          principals: [
+            {
+              identifiers: ["123456789012"],
+              type: "AWS",
+            },
+          ],
+          resources: [
+            "arn:aws:events:eu-west-1:123456789012:event-bus/default",
+          ],
+          sid: "DevAccountAccess",
+        },
+        {
+          actions: [
+            "events:DescribeRule",
+            "events:ListRules",
+            "events:ListTargetsByRule",
+            "events:ListTagsForResource",
+          ],
+          condition: [
+            {
+              test: "StringEquals",
+              values: [example.id],
+              variable: "aws:PrincipalOrgID",
+            },
+          ],
+          effect: "Allow",
+          principals: [
+            {
+              identifiers: ["*"],
+              type: "AWS",
+            },
+          ],
+          resources: [
+            "arn:aws:events:eu-west-1:123456789012:rule/*",
+            "arn:aws:events:eu-west-1:123456789012:event-bus/default",
+          ],
+          sid: "OrganizationAccess",
+        },
+      ],
+    });
+    const awsCloudwatchEventBusPolicyTest = new CloudwatchEventBusPolicy(
+      this,
+      "test_1",
+      {
+        eventBusName: Token.asString(awsCloudwatchEventBusTest.name),
+        policy: Token.asString(test.json),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsCloudwatchEventBusPolicyTest.overrideLogicalId("test");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `policy` - (Required) The text of the policy. For more information about building AWS IAM policy documents with Terraform, see the [AWS IAM Policy Document Guide](https://learn.hashicorp.com/terraform/aws/iam-policy).
+* `eventBusName` - (Optional) The name of the event bus to set the permissions on.
+  If you omit this, the permissions are set on the `default` event bus.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name of the EventBridge event bus.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import an EventBridge policy using the `eventBusName`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import an EventBridge policy using the `eventBusName`. For example:
+
+```console
+% terraform import aws_cloudwatch_event_bus_policy.DevAccountAccess example-event-bus
+```
+
+<!-- cache-key: cdktf-0.18.0 input-169b2e45e0cb69c0e508149ef8eef91ea77e8a9d2a0a5c4ea7af58d28ac95866 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/cloudwatch_event_connection.html.markdown b/website/docs/cdktf/typescript/r/cloudwatch_event_connection.html.markdown
new file mode 100644
index 00000000000..27fcc29557a
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/cloudwatch_event_connection.html.markdown
@@ -0,0 +1,273 @@
+---
+subcategory: "EventBridge"
+layout: "aws"
+page_title: "AWS: aws_cloudwatch_event_connection"
+description: |-
+  Provides an EventBridge connection resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudwatch_event_connection
+
+Provides an EventBridge connection resource.
+
+~> **Note:** EventBridge was formerly known as CloudWatch Events. The functionality is identical.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudwatchEventConnection } from "./.gen/providers/aws/cloudwatch-event-connection";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new CloudwatchEventConnection(this, "test", {
+      authParameters: {
+        apiKey: {
+          key: "x-signature",
+          value: "1234",
+        },
+      },
+      authorizationType: "API_KEY",
+      description: "A connection description",
+      name: "ngrok-connection",
+    });
+  }
+}
+
+```
+
+## Example Usage Basic Authorization
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudwatchEventConnection } from "./.gen/providers/aws/cloudwatch-event-connection";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new CloudwatchEventConnection(this, "test", {
+      authParameters: {
+        basic: {
+          password: "Pass1234!",
+          username: "user",
+        },
+      },
+      authorizationType: "BASIC",
+      description: "A connection description",
+      name: "ngrok-connection",
+    });
+  }
+}
+
+```
+
+## Example Usage OAuth Authorization
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudwatchEventConnection } from "./.gen/providers/aws/cloudwatch-event-connection";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new CloudwatchEventConnection(this, "test", {
+      authParameters: {
+        oauth: {
+          authorizationEndpoint: "https://auth.url.com/endpoint",
+          clientParameters: {
+            clientId: "1234567890",
+            clientSecret: "Pass1234!",
+          },
+          httpMethod: "GET",
+          oauthHttpParameters: {
+            body: [
+              {
+                isValueSecret: false,
+                key: "body-parameter-key",
+                value: "body-parameter-value",
+              },
+            ],
+            header: [
+              {
+                isValueSecret: false,
+                key: "header-parameter-key",
+                value: "header-parameter-value",
+              },
+            ],
+            queryString: [
+              {
+                isValueSecret: false,
+                key: "query-string-parameter-key",
+                value: "query-string-parameter-value",
+              },
+            ],
+          },
+        },
+      },
+      authorizationType: "OAUTH_CLIENT_CREDENTIALS",
+      description: "A connection description",
+      name: "ngrok-connection",
+    });
+  }
+}
+
+```
+
+## Example Usage Invocation Http Parameters
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudwatchEventConnection } from "./.gen/providers/aws/cloudwatch-event-connection";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new CloudwatchEventConnection(this, "test", {
+      authParameters: {
+        basic: {
+          password: "Pass1234!",
+          username: "user",
+        },
+        invocationHttpParameters: {
+          body: [
+            {
+              isValueSecret: false,
+              key: "body-parameter-key",
+              value: "body-parameter-value",
+            },
+            {
+              isValueSecret: true,
+              key: "body-parameter-key2",
+              value: "body-parameter-value2",
+            },
+          ],
+          header: [
+            {
+              isValueSecret: false,
+              key: "header-parameter-key",
+              value: "header-parameter-value",
+            },
+          ],
+          queryString: [
+            {
+              isValueSecret: false,
+              key: "query-string-parameter-key",
+              value: "query-string-parameter-value",
+            },
+          ],
+        },
+      },
+      authorizationType: "BASIC",
+      description: "A connection description",
+      name: "ngrok-connection",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the new connection. Maximum of 64 characters consisting of numbers, lower/upper case letters, .,-,_.
+* `description` - (Optional) Enter a description for the connection. Maximum of 512 characters.
+* `authorizationType` - (Required) Choose the type of authorization to use for the connection. One of `apiKey`,`basic`,`oauthClientCredentials`.
+* `authParameters` - (Required) Parameters used for authorization. A maximum of 1 are allowed. Documented below.
+* `invocationHttpParameters` - (Optional) Invocation Http Parameters are additional credentials used to sign each Invocation of the ApiDestination created from this Connection. If the ApiDestination Rule Target has additional HttpParameters, the values will be merged together, with the Connection Invocation Http Parameters taking precedence. Secret values are stored and managed by AWS Secrets Manager. A maximum of 1 are allowed. Documented below.
+
+`authParameters` support the following:
+
+* `apiKey` - (Optional) Parameters used for API_KEY authorization. An API key to include in the header for each authentication request. A maximum of 1 are allowed. Conflicts with `basic` and `oauth`. Documented below.
+* `basic` - (Optional) Parameters used for BASIC authorization. A maximum of 1 are allowed. Conflicts with `apiKey` and `oauth`. Documented below.
+* `oauth` - (Optional) Parameters used for OAUTH_CLIENT_CREDENTIALS authorization. A maximum of 1 are allowed. Conflicts with `basic` and `apiKey`. Documented below.
+
+`apiKey` support the following:
+
+* `key` - (Required) Header Name.
+* `value` - (Required) Header Value. Created and stored in AWS Secrets Manager.
+
+`basic` support the following:
+
+* `username` - (Required) A username for the authorization.
+* `password` - (Required) A password for the authorization. Created and stored in AWS Secrets Manager.
+
+`oauth` support the following:
+
+* `authorizationEndpoint` - (Required) The URL to the authorization endpoint.
+* `httpMethod` - (Required) A password for the authorization. Created and stored in AWS Secrets Manager.
+* `clientParameters` - (Required) Contains the client parameters for OAuth authorization. Contains the following two parameters.
+    * `clientId` - (Required) The client ID for the credentials to use for authorization. Created and stored in AWS Secrets Manager.
+    * `clientSecret` - (Required) The client secret for the credentials to use for authorization. Created and stored in AWS Secrets Manager.
+* `oauthHttpParameters` - (Required) OAuth Http Parameters are additional credentials used to sign the request to the authorization endpoint to exchange the OAuth Client information for an access token. Secret values are stored and managed by AWS Secrets Manager. A maximum of 1 are allowed. Documented below.
+
+`invocationHttpParameters` and `oauthHttpParameters` support the following:
+
+* `body` - (Optional) Contains additional body string parameters for the connection. You can include up to 100 additional body string parameters per request. Each additional parameter counts towards the event payload size, which cannot exceed 64 KB. Each parameter can contain the following:
+    * `key` - (Required) The key for the parameter.
+    * `value` - (Required) The value associated with the key. Created and stored in AWS Secrets Manager if is secret.
+    * `isValueSecret` - (Optional) Specified whether the value is secret.
+
+* `header` - (Optional) Contains additional header parameters for the connection. You can include up to 100 additional body string parameters per request. Each additional parameter counts towards the event payload size, which cannot exceed 64 KB. Each parameter can contain the following:
+    * `key` - (Required) The key for the parameter.
+    * `value` - (Required) The value associated with the key. Created and stored in AWS Secrets Manager if is secret.
+    * `isValueSecret` - (Optional) Specified whether the value is secret.
+
+* `queryString` - (Optional) Contains additional query string parameters for the connection. You can include up to 100 additional body string parameters per request. Each additional parameter counts towards the event payload size, which cannot exceed 64 KB. Each parameter can contain the following:
+    * `key` - (Required) The key for the parameter.
+    * `value` - (Required) The value associated with the key. Created and stored in AWS Secrets Manager if is secret.
+    * `isValueSecret` - (Optional) Specified whether the value is secret.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the connection.
+* `secretArn` - The Amazon Resource Name (ARN) of the secret created from the authorization parameters specified for the connection.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EventBridge connection using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import EventBridge EventBridge connection using the `name`. For example:
+
+```console
+% terraform import aws_cloudwatch_event_connection.test ngrok-connection
+```
+
+<!-- cache-key: cdktf-0.18.0 input-4759efe6af4674649e56020fa0ba96724fe1874dd8ece605bca5846e4d11241e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/cloudwatch_event_endpoint.html.markdown b/website/docs/cdktf/typescript/r/cloudwatch_event_endpoint.html.markdown
new file mode 100644
index 00000000000..d05eaec8649
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/cloudwatch_event_endpoint.html.markdown
@@ -0,0 +1,126 @@
+---
+subcategory: "EventBridge"
+layout: "aws"
+page_title: "AWS: aws_cloudwatch_event_endpoint"
+description: |-
+  Provides a resource to create an EventBridge Global Endpoint.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudwatch_event_endpoint
+
+Provides a resource to create an EventBridge Global Endpoint.
+
+~> **Note:** EventBridge was formerly known as CloudWatch Events. The functionality is identical.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudwatchEventEndpoint } from "./.gen/providers/aws/cloudwatch-event-endpoint";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new CloudwatchEventEndpoint(this, "this", {
+      eventBus: [
+        {
+          eventBusArn: primary.arn,
+        },
+        {
+          eventBusArn: secondary.arn,
+        },
+      ],
+      name: "global-endpoint",
+      replicationConfig: {
+        state: "DISABLED",
+      },
+      roleArn: replication.arn,
+      routingConfig: {
+        failoverConfig: {
+          primary: {
+            healthCheck: Token.asString(awsRoute53HealthCheckPrimary.arn),
+          },
+          secondary: {
+            route: "us-east-2",
+          },
+        },
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `description` - (Optional) A description of the global endpoint.
+* `eventBus` - (Required) The event buses to use. The names of the event buses must be identical in each Region. Exactly two event buses are required. Documented below.
+* `name` - (Required) The name of the global endpoint.
+* `replicationConfig` - (Optional) Parameters used for replication. Documented below.
+* `roleArn` - (Optional) The ARN of the IAM role used for replication between event buses.
+* `routingConfig` - (Required) Parameters used for routing, including the health check and secondary Region. Documented below.
+
+`eventBus` supports the following:
+
+* `eventBusArn` - (Required) The ARN of the event bus the endpoint is associated with.
+
+`replicationConfig` supports the following:
+
+* `state` - (Optional) The state of event replication. Valid values: `enabled`, `disabled`. The default state is `enabled`, which means you must supply a `roleArn`. If you don't have a `roleArn` or you don't want event replication enabled, set `state` to `disabled`.
+
+`routingConfig` support the following:
+
+* `failoverConfig` - (Required) Parameters used for failover. This includes what triggers failover and what happens when it's triggered. Documented below.
+
+`failoverConfig` support the following:
+
+* `primary` - (Required) Parameters used for the primary Region. Documented below.
+* `secondary` - (Required) Parameters used for the secondary Region, the Region that events are routed to when failover is triggered or event replication is enabled. Documented below.
+
+`primary` support the following:
+
+* `healthCheck` - (Required) The ARN of the health check used by the endpoint to determine whether failover is triggered.
+
+`secondary` support the following:
+
+* `route` - (Required) The name of the secondary Region.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the endpoint that was created.
+* `endpointUrl` - The URL of the endpoint that was created.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EventBridge Global Endpoints using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import EventBridge Global Endpoints using the `name`. For example:
+
+```console
+% terraform import aws_cloudwatch_event_endpoint.imported_endpoint example-endpoint
+```
+
+<!-- cache-key: cdktf-0.18.0 input-dac45f03f23cfb9ec43d7243c7ab30a08379fa9704853c26c6d6b06354f671a4 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/cloudwatch_event_permission.html.markdown b/website/docs/cdktf/typescript/r/cloudwatch_event_permission.html.markdown
new file mode 100644
index 00000000000..9c3b4d73fd1
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/cloudwatch_event_permission.html.markdown
@@ -0,0 +1,117 @@
+---
+subcategory: "EventBridge"
+layout: "aws"
+page_title: "AWS: aws_cloudwatch_event_permission"
+description: |-
+  Provides a resource to create an EventBridge permission to support cross-account events in the current account default event bus.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudwatch_event_permission
+
+Provides a resource to create an EventBridge permission to support cross-account events in the current account default event bus.
+
+~> **Note:** EventBridge was formerly known as CloudWatch Events. The functionality is identical.
+
+~> **Note:** The EventBridge bus policy resource  (`awsCloudwatchEventBusPolicy`) is incompatible with the EventBridge permission resource (`awsCloudwatchEventPermission`) and will overwrite permissions.
+
+## Example Usage
+
+### Account Access
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudwatchEventPermission } from "./.gen/providers/aws/cloudwatch-event-permission";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new CloudwatchEventPermission(this, "DevAccountAccess", {
+      principal: "123456789012",
+      statementId: "DevAccountAccess",
+    });
+  }
+}
+
+```
+
+### Organization Access
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudwatchEventPermission } from "./.gen/providers/aws/cloudwatch-event-permission";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new CloudwatchEventPermission(this, "OrganizationAccess", {
+      condition: {
+        key: "aws:PrincipalOrgID",
+        type: "StringEquals",
+        value: example.id,
+      },
+      principal: "*",
+      statementId: "OrganizationAccess",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `principal` - (Required) The 12-digit AWS account ID that you are permitting to put events to your default event bus. Specify `*` to permit any account to put events to your default event bus, optionally limited by `condition`.
+* `statementId` - (Required) An identifier string for the external account that you are granting permissions to.
+* `action` - (Optional) The action that you are enabling the other account to perform. Defaults to `events:putEvents`.
+* `condition` - (Optional) Configuration block to limit the event bus permissions you are granting to only accounts that fulfill the condition. Specified below.
+* `eventBusName` - (Optional) The name of the event bus to set the permissions on.
+  If you omit this, the permissions are set on the `default` event bus.
+
+### condition
+
+* `key` - (Required) Key for the condition. Valid values: `aws:principalOrgId`.
+* `type` - (Required) Type of condition. Value values: `stringEquals`.
+* `value` - (Required) Value for the key.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The statement ID of the EventBridge permission.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EventBridge permissions using the `eventBusName/statementId` (if you omit `eventBusName`, the `default` event bus will be used). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import EventBridge permissions using the `eventBusName/statementId` (if you omit `eventBusName`, the `default` event bus will be used). For example:
+
+```console
+% terraform import aws_cloudwatch_event_permission.DevAccountAccess example-event-bus/DevAccountAccess
+```
+
+<!-- cache-key: cdktf-0.18.0 input-61e6e8cd01bf17093c7daf47be3dce1db556b13575a6c0f84dd9556644d63f94 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/cloudwatch_event_rule.html.markdown b/website/docs/cdktf/typescript/r/cloudwatch_event_rule.html.markdown
new file mode 100644
index 00000000000..a81bca16c0f
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/cloudwatch_event_rule.html.markdown
@@ -0,0 +1,106 @@
+---
+subcategory: "EventBridge"
+layout: "aws"
+page_title: "AWS: aws_cloudwatch_event_rule"
+description: |-
+  Provides an EventBridge Rule resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudwatch_event_rule
+
+Provides an EventBridge Rule resource.
+
+~> **Note:** EventBridge was formerly known as CloudWatch Events. The functionality is identical.
+
+## Example Usage
+
+```terraform
+resource "aws_cloudwatch_event_rule" "console" {
+  name        = "capture-aws-sign-in"
+  description = "Capture each AWS Console Sign In"
+
+  event_pattern = jsonencode({
+    detail-type = [
+      "AWS Console Sign In via CloudTrail"
+    ]
+  })
+}
+
+resource "aws_cloudwatch_event_target" "sns" {
+  rule      = aws_cloudwatch_event_rule.console.name
+  target_id = "SendToSNS"
+  arn       = aws_sns_topic.aws_logins.arn
+}
+
+resource "aws_sns_topic" "aws_logins" {
+  name = "aws-console-logins"
+}
+
+resource "aws_sns_topic_policy" "default" {
+  arn    = aws_sns_topic.aws_logins.arn
+  policy = data.aws_iam_policy_document.sns_topic_policy.json
+}
+
+data "aws_iam_policy_document" "sns_topic_policy" {
+  statement {
+    effect  = "Allow"
+    actions = ["SNS:Publish"]
+
+    principals {
+      type        = "Service"
+      identifiers = ["events.amazonaws.com"]
+    }
+
+    resources = [aws_sns_topic.aws_logins.arn]
+  }
+}
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Optional) The name of the rule. If omitted, Terraform will assign a random, unique name. Conflicts with `namePrefix`.
+* `namePrefix` - (Optional) Creates a unique name beginning with the specified prefix. Conflicts with `name`. **Note**: Due to the length of the generated suffix, must be 38 characters or less.
+* `scheduleExpression` - (Optional) The scheduling expression. For example, `cron(0 20 * * ? *)` or `rate(5 minutes)`. At least one of `scheduleExpression` or `eventPattern` is required. Can only be used on the default event bus. For more information, refer to the AWS documentation [Schedule Expressions for Rules](https://docs.aws.amazon.com/AmazonCloudWatch/latest/events/ScheduledEvents.html).
+* `eventBusName` - (Optional) The name or ARN of the event bus to associate with this rule.
+  If you omit this, the `default` event bus is used.
+* `eventPattern` - (Optional) The event pattern described a JSON object. At least one of `scheduleExpression` or `eventPattern` is required. See full documentation of [Events and Event Patterns in EventBridge](https://docs.aws.amazon.com/eventbridge/latest/userguide/eventbridge-and-event-patterns.html) for details.
+* `description` - (Optional) The description of the rule.
+* `roleArn` - (Optional) The Amazon Resource Name (ARN) associated with the role that is used for target invocation.
+* `isEnabled` - (Optional) Whether the rule should be enabled (defaults to `true`).
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name of the rule.
+* `arn` - The Amazon Resource Name (ARN) of the rule.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EventBridge Rules using the `eventBusName/ruleName` (if you omit `eventBusName`, the `default` event bus will be used). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import EventBridge Rules using the `eventBusName/ruleName` (if you omit `eventBusName`, the `default` event bus will be used). For example:
+
+```console
+% terraform import aws_cloudwatch_event_rule.console example-event-bus/capture-console-sign-in
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1682a88e595c1129ead5e465869167f15b794aa7b9b39b0aef0d03a1bb04985b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/cloudwatch_event_target.html.markdown b/website/docs/cdktf/typescript/r/cloudwatch_event_target.html.markdown
new file mode 100644
index 00000000000..6e90b39a105
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/cloudwatch_event_target.html.markdown
@@ -0,0 +1,834 @@
+---
+subcategory: "EventBridge"
+layout: "aws"
+page_title: "AWS: aws_cloudwatch_event_target"
+description: |-
+  Provides an EventBridge Target resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudwatch_event_target
+
+Provides an EventBridge Target resource.
+
+~> **Note:** EventBridge was formerly known as CloudWatch Events. The functionality is identical.
+
+## Example Usage
+
+### Kinesis Usage
+
+```terraform
+resource "aws_cloudwatch_event_target" "yada" {
+  target_id = "Yada"
+  rule      = aws_cloudwatch_event_rule.console.name
+  arn       = aws_kinesis_stream.test_stream.arn
+
+  run_command_targets {
+    key    = "tag:Name"
+    values = ["FooBar"]
+  }
+
+  run_command_targets {
+    key    = "InstanceIds"
+    values = ["i-162058cd308bffec2"]
+  }
+}
+
+resource "aws_cloudwatch_event_rule" "console" {
+  name        = "capture-ec2-scaling-events"
+  description = "Capture all EC2 scaling events"
+
+  event_pattern = jsonencode({
+    source = [
+      "aws.autoscaling"
+    ]
+
+    detail-type = [
+      "EC2 Instance Launch Successful",
+      "EC2 Instance Terminate Successful",
+      "EC2 Instance Launch Unsuccessful",
+      "EC2 Instance Terminate Unsuccessful"
+    ]
+  })
+}
+
+resource "aws_kinesis_stream" "test_stream" {
+  name        = "terraform-kinesis-test"
+  shard_count = 1
+}
+```
+
+### SSM Document Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudwatchEventRule } from "./.gen/providers/aws/cloudwatch-event-rule";
+import { CloudwatchEventTarget } from "./.gen/providers/aws/cloudwatch-event-target";
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { IamPolicy } from "./.gen/providers/aws/iam-policy";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+import { IamRolePolicyAttachment } from "./.gen/providers/aws/iam-role-policy-attachment";
+import { SsmDocument } from "./.gen/providers/aws/ssm-document";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const stopInstances = new CloudwatchEventRule(this, "stop_instances", {
+      description: "Stop instances nightly",
+      name: "StopInstance",
+      scheduleExpression: "cron(0 0 * * ? *)",
+    });
+    const stopInstance = new SsmDocument(this, "stop_instance", {
+      content: Token.asString(
+        Fn.jsonencode({
+          description: "Stop an instance",
+          parameters: {},
+          runtimeConfig: {
+            "aws:runShellScript": {
+              properties: [
+                {
+                  id: "0.aws:runShellScript",
+                  runCommand: ["halt"],
+                },
+              ],
+            },
+          },
+          schemaVersion: "1.2",
+        })
+      ),
+      documentType: "Command",
+      name: "stop_instance",
+    });
+    const ssmLifecycle = new DataAwsIamPolicyDocument(this, "ssm_lifecycle", {
+      statement: [
+        {
+          actions: ["ssm:SendCommand"],
+          condition: [
+            {
+              test: "StringEquals",
+              values: ["*"],
+              variable: "ec2:ResourceTag/Terminate",
+            },
+          ],
+          effect: "Allow",
+          resources: ["arn:aws:ec2:eu-west-1:1234567890:instance/*"],
+        },
+        {
+          actions: ["ssm:SendCommand"],
+          effect: "Allow",
+          resources: [stopInstance.arn],
+        },
+      ],
+    });
+    const ssmLifecycleTrust = new DataAwsIamPolicyDocument(
+      this,
+      "ssm_lifecycle_trust",
+      {
+        statement: [
+          {
+            actions: ["sts:AssumeRole"],
+            principals: [
+              {
+                identifiers: ["events.amazonaws.com"],
+                type: "Service",
+              },
+            ],
+          },
+        ],
+      }
+    );
+    const awsIamPolicySsmLifecycle = new IamPolicy(this, "ssm_lifecycle_4", {
+      name: "SSMLifecycle",
+      policy: Token.asString(ssmLifecycle.json),
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamPolicySsmLifecycle.overrideLogicalId("ssm_lifecycle");
+    const awsIamRoleSsmLifecycle = new IamRole(this, "ssm_lifecycle_5", {
+      assumeRolePolicy: Token.asString(ssmLifecycleTrust.json),
+      name: "SSMLifecycle",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamRoleSsmLifecycle.overrideLogicalId("ssm_lifecycle");
+    const awsIamRolePolicyAttachmentSsmLifecycle = new IamRolePolicyAttachment(
+      this,
+      "ssm_lifecycle_6",
+      {
+        policyArn: Token.asString(awsIamPolicySsmLifecycle.arn),
+        role: Token.asString(awsIamRoleSsmLifecycle.name),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamRolePolicyAttachmentSsmLifecycle.overrideLogicalId("ssm_lifecycle");
+    const awsCloudwatchEventTargetStopInstances = new CloudwatchEventTarget(
+      this,
+      "stop_instances_7",
+      {
+        arn: stopInstance.arn,
+        roleArn: Token.asString(awsIamRoleSsmLifecycle.arn),
+        rule: stopInstances.name,
+        runCommandTargets: [
+          {
+            key: "tag:Terminate",
+            values: ["midnight"],
+          },
+        ],
+        targetId: "StopInstance",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsCloudwatchEventTargetStopInstances.overrideLogicalId("stop_instances");
+  }
+}
+
+```
+
+### RunCommand Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudwatchEventRule } from "./.gen/providers/aws/cloudwatch-event-rule";
+import { CloudwatchEventTarget } from "./.gen/providers/aws/cloudwatch-event-target";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const stopInstances = new CloudwatchEventRule(this, "stop_instances", {
+      description: "Stop instances nightly",
+      name: "StopInstance",
+      scheduleExpression: "cron(0 0 * * ? *)",
+    });
+    const awsCloudwatchEventTargetStopInstances = new CloudwatchEventTarget(
+      this,
+      "stop_instances_1",
+      {
+        arn:
+          "arn:aws:ssm:${" + awsRegion.value + "}::document/AWS-RunShellScript",
+        input: '{\\"commands\\":[\\"halt\\"]}',
+        roleArn: ssmLifecycle.arn,
+        rule: stopInstances.name,
+        runCommandTargets: [
+          {
+            key: "tag:Terminate",
+            values: ["midnight"],
+          },
+        ],
+        targetId: "StopInstance",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsCloudwatchEventTargetStopInstances.overrideLogicalId("stop_instances");
+  }
+}
+
+```
+
+### ECS Run Task with Role and Task Override Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudwatchEventTarget } from "./.gen/providers/aws/cloudwatch-event-target";
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+import { IamRolePolicy } from "./.gen/providers/aws/iam-role-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const assumeRole = new DataAwsIamPolicyDocument(this, "assume_role", {
+      statement: [
+        {
+          actions: ["sts:AssumeRole"],
+          effect: "Allow",
+          principals: [
+            {
+              identifiers: ["events.amazonaws.com"],
+              type: "Service",
+            },
+          ],
+        },
+      ],
+    });
+    const ecsEventsRunTaskWithAnyRole = new DataAwsIamPolicyDocument(
+      this,
+      "ecs_events_run_task_with_any_role",
+      {
+        statement: [
+          {
+            actions: ["iam:PassRole"],
+            effect: "Allow",
+            resources: ["*"],
+          },
+          {
+            actions: ["ecs:RunTask"],
+            effect: "Allow",
+            resources: [
+              Token.asString(Fn.replace(taskName.arn, "/:\\\\d+$/", ":*")),
+            ],
+          },
+        ],
+      }
+    );
+    const ecsEvents = new IamRole(this, "ecs_events", {
+      assumeRolePolicy: Token.asString(assumeRole.json),
+      name: "ecs_events",
+    });
+    const awsIamRolePolicyEcsEventsRunTaskWithAnyRole = new IamRolePolicy(
+      this,
+      "ecs_events_run_task_with_any_role_3",
+      {
+        name: "ecs_events_run_task_with_any_role",
+        policy: Token.asString(ecsEventsRunTaskWithAnyRole.json),
+        role: ecsEvents.id,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamRolePolicyEcsEventsRunTaskWithAnyRole.overrideLogicalId(
+      "ecs_events_run_task_with_any_role"
+    );
+    new CloudwatchEventTarget(this, "ecs_scheduled_task", {
+      arn: clusterName.arn,
+      ecsTarget: {
+        taskCount: 1,
+        taskDefinitionArn: taskName.arn,
+      },
+      input: Token.asString(
+        Fn.jsonencode({
+          containerOverrides: [
+            {
+              command: ["bin/console", "scheduled-task"],
+              name: "name-of-container-to-override",
+            },
+          ],
+        })
+      ),
+      roleArn: ecsEvents.arn,
+      rule: everyHour.name,
+      targetId: "run-scheduled-task-every-hour",
+    });
+  }
+}
+
+```
+
+### API Gateway target
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ApiGatewayDeployment } from "./.gen/providers/aws/api-gateway-deployment";
+import { ApiGatewayStage } from "./.gen/providers/aws/api-gateway-stage";
+import { CloudwatchEventRule } from "./.gen/providers/aws/cloudwatch-event-rule";
+import { CloudwatchEventTarget } from "./.gen/providers/aws/cloudwatch-event-target";
+interface MyConfig {
+  stageName: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    const example = new ApiGatewayDeployment(this, "example", {
+      restApiId: Token.asString(awsApiGatewayRestApiExample.id),
+    });
+    const awsApiGatewayStageExample = new ApiGatewayStage(this, "example_1", {
+      deploymentId: example.id,
+      restApiId: Token.asString(awsApiGatewayRestApiExample.id),
+      stageName: config.stageName,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsApiGatewayStageExample.overrideLogicalId("example");
+    const awsCloudwatchEventRuleExample = new CloudwatchEventRule(
+      this,
+      "example_2",
+      {}
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsCloudwatchEventRuleExample.overrideLogicalId("example");
+    const awsCloudwatchEventTargetExample = new CloudwatchEventTarget(
+      this,
+      "example_3",
+      {
+        arn: "${" + awsApiGatewayStageExample.executionArn + "}/GET",
+        httpTarget: {
+          headerParameters: {
+            Env: "Test",
+          },
+          queryStringParameters: {
+            Body: "$.detail.body",
+          },
+        },
+        rule: Token.asString(awsCloudwatchEventRuleExample.id),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsCloudwatchEventTargetExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### Cross-Account Event Bus target
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudwatchEventRule } from "./.gen/providers/aws/cloudwatch-event-rule";
+import { CloudwatchEventTarget } from "./.gen/providers/aws/cloudwatch-event-target";
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { IamPolicy } from "./.gen/providers/aws/iam-policy";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+import { IamRolePolicyAttachment } from "./.gen/providers/aws/iam-role-policy-attachment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const stopInstances = new CloudwatchEventRule(this, "stop_instances", {
+      description: "Stop instances nightly",
+      name: "StopInstance",
+      scheduleExpression: "cron(0 0 * * ? *)",
+    });
+    const assumeRole = new DataAwsIamPolicyDocument(this, "assume_role", {
+      statement: [
+        {
+          actions: ["sts:AssumeRole"],
+          effect: "Allow",
+          principals: [
+            {
+              identifiers: ["events.amazonaws.com"],
+              type: "Service",
+            },
+          ],
+        },
+      ],
+    });
+    const eventBusInvokeRemoteEventBus = new DataAwsIamPolicyDocument(
+      this,
+      "event_bus_invoke_remote_event_bus",
+      {
+        statement: [
+          {
+            actions: ["events:PutEvents"],
+            effect: "Allow",
+            resources: [
+              "arn:aws:events:eu-west-1:1234567890:event-bus/My-Event-Bus",
+            ],
+          },
+        ],
+      }
+    );
+    const awsIamPolicyEventBusInvokeRemoteEventBus = new IamPolicy(
+      this,
+      "event_bus_invoke_remote_event_bus_3",
+      {
+        name: "event_bus_invoke_remote_event_bus",
+        policy: Token.asString(eventBusInvokeRemoteEventBus.json),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamPolicyEventBusInvokeRemoteEventBus.overrideLogicalId(
+      "event_bus_invoke_remote_event_bus"
+    );
+    const awsIamRoleEventBusInvokeRemoteEventBus = new IamRole(
+      this,
+      "event_bus_invoke_remote_event_bus_4",
+      {
+        assumeRolePolicy: Token.asString(assumeRole.json),
+        name: "event-bus-invoke-remote-event-bus",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamRoleEventBusInvokeRemoteEventBus.overrideLogicalId(
+      "event_bus_invoke_remote_event_bus"
+    );
+    const awsIamRolePolicyAttachmentEventBusInvokeRemoteEventBus =
+      new IamRolePolicyAttachment(this, "event_bus_invoke_remote_event_bus_5", {
+        policyArn: Token.asString(awsIamPolicyEventBusInvokeRemoteEventBus.arn),
+        role: Token.asString(awsIamRoleEventBusInvokeRemoteEventBus.name),
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamRolePolicyAttachmentEventBusInvokeRemoteEventBus.overrideLogicalId(
+      "event_bus_invoke_remote_event_bus"
+    );
+    const awsCloudwatchEventTargetStopInstances = new CloudwatchEventTarget(
+      this,
+      "stop_instances_6",
+      {
+        arn: "arn:aws:events:eu-west-1:1234567890:event-bus/My-Event-Bus",
+        roleArn: Token.asString(awsIamRoleEventBusInvokeRemoteEventBus.arn),
+        rule: stopInstances.name,
+        targetId: "StopInstance",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsCloudwatchEventTargetStopInstances.overrideLogicalId("stop_instances");
+  }
+}
+
+```
+
+### Input Transformer Usage - JSON Object
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudwatchEventRule } from "./.gen/providers/aws/cloudwatch-event-rule";
+import { CloudwatchEventTarget } from "./.gen/providers/aws/cloudwatch-event-target";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new CloudwatchEventRule(this, "example", {});
+    const awsCloudwatchEventTargetExample = new CloudwatchEventTarget(
+      this,
+      "example_1",
+      {
+        arn: Token.asString(awsLambdaFunctionExample.arn),
+        inputTransformer: {
+          inputPaths: {
+            instance: "$.detail.instance",
+            status: "$.detail.status",
+          },
+          inputTemplate:
+            '{\n  "instance_id": <instance>,\n  "instance_status": <status>\n}\n\n',
+        },
+        rule: example.id,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsCloudwatchEventTargetExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### Input Transformer Usage - Simple String
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudwatchEventRule } from "./.gen/providers/aws/cloudwatch-event-rule";
+import { CloudwatchEventTarget } from "./.gen/providers/aws/cloudwatch-event-target";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new CloudwatchEventRule(this, "example", {});
+    const awsCloudwatchEventTargetExample = new CloudwatchEventTarget(
+      this,
+      "example_1",
+      {
+        arn: Token.asString(awsLambdaFunctionExample.arn),
+        inputTransformer: {
+          inputPaths: {
+            instance: "$.detail.instance",
+            status: "$.detail.status",
+          },
+          inputTemplate: '\\"<instance> is in state <status>\\"',
+        },
+        rule: example.id,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsCloudwatchEventTargetExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### Cloudwatch Log Group Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudwatchEventRule } from "./.gen/providers/aws/cloudwatch-event-rule";
+import { CloudwatchEventTarget } from "./.gen/providers/aws/cloudwatch-event-target";
+import { CloudwatchLogGroup } from "./.gen/providers/aws/cloudwatch-log-group";
+import { CloudwatchLogResourcePolicy } from "./.gen/providers/aws/cloudwatch-log-resource-policy";
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new CloudwatchEventRule(this, "example", {
+      description: "GuardDuty Findings",
+      eventPattern: Token.asString(
+        Fn.jsonencode({
+          source: ["aws.guardduty"],
+        })
+      ),
+      name: "guard-duty_event_rule",
+      tags: {
+        Environment: "example",
+      },
+    });
+    const awsCloudwatchLogGroupExample = new CloudwatchLogGroup(
+      this,
+      "example_1",
+      {
+        name: "/aws/events/guardduty/logs",
+        retentionInDays: 1,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsCloudwatchLogGroupExample.overrideLogicalId("example");
+    const exampleLogPolicy = new DataAwsIamPolicyDocument(
+      this,
+      "example_log_policy",
+      {
+        statement: [
+          {
+            actions: ["logs:CreateLogStream"],
+            effect: "Allow",
+            principals: [
+              {
+                identifiers: [
+                  "events.amazonaws.com",
+                  "delivery.logs.amazonaws.com",
+                ],
+                type: "Service",
+              },
+            ],
+            resources: ["${" + awsCloudwatchLogGroupExample.arn + "}:*"],
+          },
+          {
+            actions: ["logs:PutLogEvents"],
+            condition: [
+              {
+                test: "ArnEquals",
+                values: [example.arn],
+                variable: "aws:SourceArn",
+              },
+            ],
+            effect: "Allow",
+            principals: [
+              {
+                identifiers: [
+                  "events.amazonaws.com",
+                  "delivery.logs.amazonaws.com",
+                ],
+                type: "Service",
+              },
+            ],
+            resources: ["${" + awsCloudwatchLogGroupExample.arn + "}:*:*"],
+          },
+        ],
+      }
+    );
+    const awsCloudwatchEventTargetExample = new CloudwatchEventTarget(
+      this,
+      "example_3",
+      {
+        arn: Token.asString(awsCloudwatchLogGroupExample.arn),
+        rule: example.name,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsCloudwatchEventTargetExample.overrideLogicalId("example");
+    const awsCloudwatchLogResourcePolicyExample =
+      new CloudwatchLogResourcePolicy(this, "example_4", {
+        policyDocument: Token.asString(exampleLogPolicy.json),
+        policyName: "guardduty-log-publishing-policy",
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsCloudwatchLogResourcePolicyExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+-> **Note:** In order to be able to have your AWS Lambda function or
+   SNS topic invoked by an EventBridge rule, you must set up the right permissions
+   using [`awsLambdaPermission`](/docs/providers/aws/r/lambda_permission.html)
+   or [`awsSnsTopicPolicy`](/docs/providers/aws/r/sns_topic_policy.html).
+   More info [here](https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-use-resource-based.html).
+
+The following arguments are required:
+
+* `arn` - (Required) The Amazon Resource Name (ARN) of the target.
+* `rule` - (Required) The name of the rule you want to add targets to.
+
+The following arguments are optional:
+
+* `batchTarget` - (Optional) Parameters used when you are using the rule to invoke an Amazon Batch Job. Documented below. A maximum of 1 are allowed.
+* `deadLetterConfig` - (Optional)  Parameters used when you are providing a dead letter config. Documented below. A maximum of 1 are allowed.
+* `ecsTarget` - (Optional) Parameters used when you are using the rule to invoke Amazon ECS Task. Documented below. A maximum of 1 are allowed.
+* `eventBusName` - (Optional) The name or ARN of the event bus to associate with the rule.
+  If you omit this, the `default` event bus is used.
+* `httpTarget` - (Optional) Parameters used when you are using the rule to invoke an API Gateway REST endpoint. Documented below. A maximum of 1 is allowed.
+* `input` - (Optional) Valid JSON text passed to the target. Conflicts with `inputPath` and `inputTransformer`.
+* `inputPath` - (Optional) The value of the [JSONPath](http://goessner.net/articles/JsonPath/) that is used for extracting part of the matched event when passing it to the target. Conflicts with `input` and `inputTransformer`.
+* `inputTransformer` - (Optional) Parameters used when you are providing a custom input to a target based on certain event data. Conflicts with `input` and `inputPath`.
+* `kinesisTarget` - (Optional) Parameters used when you are using the rule to invoke an Amazon Kinesis Stream. Documented below. A maximum of 1 are allowed.
+* `roleArn` - (Optional) The Amazon Resource Name (ARN) of the IAM role to be used for this target when the rule is triggered. Required if `ecsTarget` is used or target in `arn` is EC2 instance, Kinesis data stream, Step Functions state machine, or Event Bus in different account or region.
+* `runCommandTargets` - (Optional) Parameters used when you are using the rule to invoke Amazon EC2 Run Command. Documented below. A maximum of 5 are allowed.
+* `redshiftTarget` - (Optional) Parameters used when you are using the rule to invoke an Amazon Redshift Statement. Documented below. A maximum of 1 are allowed.
+* `retryPolicy` - (Optional)  Parameters used when you are providing retry policies. Documented below. A maximum of 1 are allowed.
+* `sagemakerPipelineTarget` - (Optional) Parameters used when you are using the rule to invoke an Amazon SageMaker Pipeline. Documented below. A maximum of 1 are allowed.
+* `sqsTarget` - (Optional) Parameters used when you are using the rule to invoke an Amazon SQS Queue. Documented below. A maximum of 1 are allowed.
+* `targetId` - (Optional) The unique target assignment ID. If missing, will generate a random, unique id.
+
+### batch_target
+
+* `jobDefinition` - (Required) The ARN or name of the job definition to use if the event target is an AWS Batch job. This job definition must already exist.
+* `jobName` - (Required) The name to use for this execution of the job, if the target is an AWS Batch job.
+* `arraySize` - (Optional) The size of the array, if this is an array batch job. Valid values are integers between 2 and 10,000.
+* `jobAttempts` - (Optional) The number of times to attempt to retry, if the job fails. Valid values are 1 to 10.
+
+### capacity_provider_strategy
+
+* `capacityProvider` - (Required) Short name of the capacity provider.
+* `weight` - (Required) The weight value designates the relative percentage of the total number of tasks launched that should use the specified capacity provider. The weight value is taken into consideration after the base value, if defined, is satisfied.
+* `base` - (Optional) The base value designates how many tasks, at a minimum, to run on the specified capacity provider. Only one capacity provider in a capacity provider strategy can have a base defined. Defaults to `0`.
+
+### dead_letter_config
+
+* `arn` - (Optional) - ARN of the SQS queue specified as the target for the dead-letter queue.
+
+### ecs_target
+
+* `taskDefinitionArn` - (Required) The ARN of the task definition to use if the event target is an Amazon ECS cluster.
+* `capacityProviderStrategy` - (Optional) The capacity provider strategy to use for the task. If a `capacityProviderStrategy` specified, the `launchType` parameter must be omitted. If no `capacityProviderStrategy` or `launchType` is specified, the default capacity provider strategy for the cluster is used. Can be one or more. See below.
+* `enableEcsManagedTags` - (Optional) Specifies whether to enable Amazon ECS managed tags for the task.
+* `enableExecuteCommand` - (Optional) Whether or not to enable the execute command functionality for the containers in this task. If true, this enables execute command functionality on all containers in the task.
+* `group` - (Optional) Specifies an ECS task group for the task. The maximum length is 255 characters.
+* `launchType` - (Optional) Specifies the launch type on which your task is running. The launch type that you specify here must match one of the launch type (compatibilities) of the target task. Valid values include: `ec2`, `external`, or `fargate`.
+* `networkConfiguration` - (Optional) Use this if the ECS task uses the awsvpc network mode. This specifies the VPC subnets and security groups associated with the task, and whether a public IP address is to be used. Required if `launchType` is `fargate` because the awsvpc mode is required for Fargate tasks.
+* `orderedPlacementStrategy` - (Optional) An array of placement strategy objects to use for the task. You can specify a maximum of five strategy rules per task.
+* `placementConstraint` - (Optional) An array of placement constraint objects to use for the task. You can specify up to 10 constraints per task (including constraints in the task definition and those specified at runtime). See Below.
+* `platformVersion` - (Optional) Specifies the platform version for the task. Specify only the numeric portion of the platform version, such as `110`. This is used only if LaunchType is FARGATE. For more information about valid platform versions, see [AWS Fargate Platform Versions](http://docs.aws.amazon.com/AmazonECS/latest/developerguide/platform_versions.html).
+* `propagateTags` - (Optional) Specifies whether to propagate the tags from the task definition to the task. If no value is specified, the tags are not propagated. Tags can only be propagated to the task during task creation. The only valid value is: `taskDefinition`.
+* `taskCount` - (Optional) The number of tasks to create based on the TaskDefinition. Defaults to `1`.
+* `tags` - (Optional) A map of tags to assign to ecs resources.
+
+### http_target
+
+* `headerParameters` - (Optional) Enables you to specify HTTP headers to add to the request.
+* `pathParameterValues` - (Optional) The list of values that correspond sequentially to any path variables in your endpoint ARN (for example `arn:aws:executeApi:usEast1:123456:myapi/*/post/pets/*`).
+* `queryStringParameters` - (Optional) Represents keys/values of query string parameters that are appended to the invoked endpoint.
+
+### input_transformer
+
+* `inputTemplate` - (Required) Template to customize data sent to the target. Must be valid JSON. To send a string value, the string value must include double quotes. Values must be escaped for both JSON and Terraform, e.g., `"\"Your string goes here.\\nA new line.\""`
+* `inputPaths` - (Optional) Key value pairs specified in the form of JSONPath (for example, time = $.time)
+    * You can have as many as 100 key-value pairs.
+    * You must use JSON dot notation, not bracket notation.
+    * The keys can't start with "AWS".
+
+### kinesis_target
+
+* `partitionKeyPath` - (Optional) The JSON path to be extracted from the event and used as the partition key.
+
+### network_configuration
+
+* `subnets` - (Required) The subnets associated with the task or service.
+* `securityGroups` - (Optional) The security groups associated with the task or service. If you do not specify a security group, the default security group for the VPC is used.
+* `assignPublicIp` - (Optional) Assign a public IP address to the ENI (Fargate launch type only). Valid values are `true` or `false`. Defaults to `false`.
+
+For more information, see [Task Networking](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-networking.html)
+
+### ordered_placement_strategy
+
+* `type` - (Required) Type of placement strategy. The only valid values at this time are `binpack`, `random` and `spread`.
+* `field` - (Optional) The field to apply the placement strategy against. For the `spread` placement strategy, valid values are `instanceId` (or `host`, which has the same effect), or any platform or custom attribute that is applied to a container instance, such as `attribute:ecsAvailabilityZone`. For the `binpack` placement strategy, valid values are `cpu` and `memory`. For the `random` placement strategy, this field is not used. For more information, see [Amazon ECS task placement strategies](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-placement-strategies.html).
+
+### placement_constraint
+
+* `type` - (Required) Type of constraint. The only valid values at this time are `memberOf` and `distinctInstance`.
+* `expression` -  (Optional) Cluster Query Language expression to apply to the constraint. Does not need to be specified for the `distinctInstance` type. For more information, see [Cluster Query Language in the Amazon EC2 Container Service Developer Guide](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/cluster-query-language.html).
+
+### redshift_target
+
+* `database` - (Required) The name of the database.
+* `dbUser` - (Optional) The database user name.
+* `secretsManagerArn` - (Optional) The name or ARN of the secret that enables access to the database.
+* `sql` - (Optional) The SQL statement text to run.
+* `statementName` - (Optional) The name of the SQL statement.
+* `withEvent` - (Optional) Indicates whether to send an event back to EventBridge after the SQL statement runs.
+
+### retry_policy
+
+* `maximumEventAgeInSeconds` - (Optional) The age in seconds to continue to make retry attempts.
+* `maximumRetryAttempts` - (Optional) maximum number of retry attempts to make before the request fails
+
+### run_command_targets
+
+* `key` - (Required) Can be either `tag:tagKey` or `instanceIds`.
+* `values` - (Required) If Key is `tag:tagKey`, Values is a list of tag values. If Key is `instanceIds`, Values is a list of Amazon EC2 instance IDs.
+
+### sqs_target
+
+* `messageGroupId` - (Optional) The FIFO message group ID to use as the target.
+
+### sagemaker_pipeline_target
+
+* `pipelineParameterList` - (Optional) List of Parameter names and values for SageMaker Model Building Pipeline execution.
+
+#### pipeline_parameter_list
+
+* `name` - (Required) Name of parameter to start execution of a SageMaker Model Building Pipeline.
+* `value` - (Required) Value of parameter to start execution of a SageMaker Model Building Pipeline.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EventBridge Targets using `eventBusName/ruleName/targetId` (if you omit `eventBusName`, the `default` event bus will be used). For example:
+
+ ```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import EventBridge Targets using `eventBusName/ruleName/targetId` (if you omit `eventBusName`, the `default` event bus will be used). For example:
+
+ ```console
+% terraform import aws_cloudwatch_event_target.test-event-target rule-name/target-id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-164c7e04d13a473ab9a0bbaa30d85030d052da19096a3497304d82fd1d72d513 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/cloudwatch_log_data_protection_policy.html.markdown b/website/docs/cdktf/typescript/r/cloudwatch_log_data_protection_policy.html.markdown
new file mode 100644
index 00000000000..77f51b6c327
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/cloudwatch_log_data_protection_policy.html.markdown
@@ -0,0 +1,119 @@
+---
+subcategory: "CloudWatch Logs"
+layout: "aws"
+page_title: "AWS: aws_cloudwatch_log_data_protection_policy"
+description: |-
+  Provides a CloudWatch Log Data Protection Policy resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudwatch_log_data_protection_policy
+
+Provides a CloudWatch Log Data Protection Policy resource.
+
+Read more about protecting sensitive user data in the [User Guide](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/mask-sensitive-log-data.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudwatchLogDataProtectionPolicy } from "./.gen/providers/aws/cloudwatch-log-data-protection-policy";
+import { CloudwatchLogGroup } from "./.gen/providers/aws/cloudwatch-log-group";
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new CloudwatchLogGroup(this, "example", {
+      name: "example",
+    });
+    const awsS3BucketExample = new S3Bucket(this, "example_1", {
+      bucket: "example",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketExample.overrideLogicalId("example");
+    const awsCloudwatchLogDataProtectionPolicyExample =
+      new CloudwatchLogDataProtectionPolicy(this, "example_2", {
+        logGroupName: example.name,
+        policyDocument: Token.asString(
+          Fn.jsonencode({
+            Name: "Example",
+            Statement: [
+              {
+                DataIdentifier: [
+                  "arn:aws:dataprotection::aws:data-identifier/EmailAddress",
+                ],
+                Operation: {
+                  Audit: {
+                    FindingsDestination: {
+                      S3: {
+                        Bucket: awsS3BucketExample.bucket,
+                      },
+                    },
+                  },
+                },
+                Sid: "Audit",
+              },
+              {
+                DataIdentifier: [
+                  "arn:aws:dataprotection::aws:data-identifier/EmailAddress",
+                ],
+                Operation: {
+                  Deidentify: {
+                    MaskConfig: {},
+                  },
+                },
+                Sid: "Redact",
+              },
+            ],
+            Version: "2021-06-01",
+          })
+        ),
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsCloudwatchLogDataProtectionPolicyExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `logGroupName` - (Required) The name of the log group under which the log stream is to be created.
+* `policyDocument` - (Required) Specifies the data protection policy in JSON. Read more at [Data protection policy syntax](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/mask-sensitive-log-data-start.html#mask-sensitive-log-data-policysyntax).
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import this resource using the `logGroupName`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import this resource using the `logGroupName`. For example:
+
+```console
+% terraform import aws_cloudwatch_log_data_protection_policy.example my-log-group
+```
+
+<!-- cache-key: cdktf-0.18.0 input-5d0eb45bdebf63544029d216f663f1fa8e735ed48c73f741006440431b616666 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/cloudwatch_log_destination.html.markdown b/website/docs/cdktf/typescript/r/cloudwatch_log_destination.html.markdown
new file mode 100644
index 00000000000..c53a03bc79b
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/cloudwatch_log_destination.html.markdown
@@ -0,0 +1,77 @@
+---
+subcategory: "CloudWatch Logs"
+layout: "aws"
+page_title: "AWS: aws_cloudwatch_log_destination"
+description: |-
+  Provides a CloudWatch Logs destination.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudwatch_log_destination
+
+Provides a CloudWatch Logs destination resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudwatchLogDestination } from "./.gen/providers/aws/cloudwatch-log-destination";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new CloudwatchLogDestination(this, "test_destination", {
+      name: "test_destination",
+      roleArn: iamForCloudwatch.arn,
+      targetArn: kinesisForCloudwatch.arn,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) A name for the log destination.
+* `roleArn` - (Required) The ARN of an IAM role that grants Amazon CloudWatch Logs permissions to put data into the target.
+* `targetArn` - (Required) The ARN of the target Amazon Kinesis stream resource for the destination.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) specifying the log destination.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudWatch Logs destinations using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import CloudWatch Logs destinations using the `name`. For example:
+
+```console
+% terraform import aws_cloudwatch_log_destination.test_destination test_destination
+```
+
+<!-- cache-key: cdktf-0.18.0 input-46d1c43716e504d59d633735be752913c3042813cb3fadb4b8427dbfc5e8d918 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/cloudwatch_log_destination_policy.html.markdown b/website/docs/cdktf/typescript/r/cloudwatch_log_destination_policy.html.markdown
new file mode 100644
index 00000000000..2da27fe4814
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/cloudwatch_log_destination_policy.html.markdown
@@ -0,0 +1,107 @@
+---
+subcategory: "CloudWatch Logs"
+layout: "aws"
+page_title: "AWS: aws_cloudwatch_log_destination_policy"
+description: |-
+  Provides a CloudWatch Logs destination policy.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudwatch_log_destination_policy
+
+Provides a CloudWatch Logs destination policy resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudwatchLogDestination } from "./.gen/providers/aws/cloudwatch-log-destination";
+import { CloudwatchLogDestinationPolicy } from "./.gen/providers/aws/cloudwatch-log-destination-policy";
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const testDestination = new CloudwatchLogDestination(
+      this,
+      "test_destination",
+      {
+        name: "test_destination",
+        roleArn: iamForCloudwatch.arn,
+        targetArn: kinesisForCloudwatch.arn,
+      }
+    );
+    const testDestinationPolicy = new DataAwsIamPolicyDocument(
+      this,
+      "test_destination_policy",
+      {
+        statement: [
+          {
+            actions: ["logs:PutSubscriptionFilter"],
+            effect: "Allow",
+            principals: [
+              {
+                identifiers: ["123456789012"],
+                type: "AWS",
+              },
+            ],
+            resources: [testDestination.arn],
+          },
+        ],
+      }
+    );
+    const awsCloudwatchLogDestinationPolicyTestDestinationPolicy =
+      new CloudwatchLogDestinationPolicy(this, "test_destination_policy_2", {
+        accessPolicy: Token.asString(testDestinationPolicy.json),
+        destinationName: testDestination.name,
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsCloudwatchLogDestinationPolicyTestDestinationPolicy.overrideLogicalId(
+      "test_destination_policy"
+    );
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `destinationName` - (Required) A name for the subscription filter
+* `accessPolicy` - (Required) The policy document. This is a JSON formatted string.
+* `forceUpdate` - (Optional) Specify true if you are updating an existing destination policy to grant permission to an organization ID instead of granting permission to individual AWS accounts.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudWatch Logs destination policies using the `destinationName`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import CloudWatch Logs destination policies using the `destinationName`. For example:
+
+```console
+% terraform import aws_cloudwatch_log_destination_policy.test_destination_policy test_destination
+```
+
+<!-- cache-key: cdktf-0.18.0 input-e9a8dea320a37c932bb21790e7e8761e42c974c856dc567a8154f492a8252914 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/cloudwatch_log_group.html.markdown b/website/docs/cdktf/typescript/r/cloudwatch_log_group.html.markdown
new file mode 100644
index 00000000000..bfb819651a4
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/cloudwatch_log_group.html.markdown
@@ -0,0 +1,85 @@
+---
+subcategory: "CloudWatch Logs"
+layout: "aws"
+page_title: "AWS: aws_cloudwatch_log_group"
+description: |-
+  Provides a CloudWatch Log Group resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudwatch_log_group
+
+Provides a CloudWatch Log Group resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudwatchLogGroup } from "./.gen/providers/aws/cloudwatch-log-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new CloudwatchLogGroup(this, "yada", {
+      name: "Yada",
+      tags: {
+        Application: "serviceA",
+        Environment: "production",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Optional, Forces new resource) The name of the log group. If omitted, Terraform will assign a random, unique name.
+* `namePrefix` - (Optional, Forces new resource) Creates a unique name beginning with the specified prefix. Conflicts with `name`.
+* `skipDestroy` - (Optional) Set to true if you do not wish the log group (and any logs it may contain) to be deleted at destroy time, and instead just remove the log group from the Terraform state.
+* `retentionInDays` - (Optional) Specifies the number of days
+  you want to retain log events in the specified log group.  Possible values are: 1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1096, 1827, 2192, 2557, 2922, 3288, 3653, and 0.
+  If you select 0, the events in the log group are always retained and never expire.
+* `kmsKeyId` - (Optional) The ARN of the KMS Key to use when encrypting log data. Please note, after the AWS KMS CMK is disassociated from the log group,
+AWS CloudWatch Logs stops encrypting newly ingested data for the log group. All previously ingested data remains encrypted, and AWS CloudWatch Logs requires
+permissions for the CMK whenever the encrypted data is requested.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) specifying the log group. Any `:*` suffix added by the API, denoting all CloudWatch Log Streams under the CloudWatch Log Group, is removed for greater compatibility with other AWS services that do not accept the suffix.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Cloudwatch Log Groups using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Cloudwatch Log Groups using the `name`. For example:
+
+```console
+% terraform import aws_cloudwatch_log_group.test_group yada
+```
+
+<!-- cache-key: cdktf-0.18.0 input-80dd704f7091eb9abb465ed20f8cdf999d0caa9424fa22d9998666170de0145a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/cloudwatch_log_metric_filter.html.markdown b/website/docs/cdktf/typescript/r/cloudwatch_log_metric_filter.html.markdown
new file mode 100644
index 00000000000..b6fc6ca7fdf
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/cloudwatch_log_metric_filter.html.markdown
@@ -0,0 +1,95 @@
+---
+subcategory: "CloudWatch Logs"
+layout: "aws"
+page_title: "AWS: aws_cloudwatch_log_metric_filter"
+description: |-
+  Provides a CloudWatch Log Metric Filter resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudwatch_log_metric_filter
+
+Provides a CloudWatch Log Metric Filter resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudwatchLogGroup } from "./.gen/providers/aws/cloudwatch-log-group";
+import { CloudwatchLogMetricFilter } from "./.gen/providers/aws/cloudwatch-log-metric-filter";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const dada = new CloudwatchLogGroup(this, "dada", {
+      name: "MyApp/access.log",
+    });
+    new CloudwatchLogMetricFilter(this, "yada", {
+      logGroupName: dada.name,
+      metricTransformation: {
+        name: "EventCount",
+        namespace: "YourNamespace",
+        value: "1",
+      },
+      name: "MyAppAccessCount",
+      pattern: "",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) A name for the metric filter.
+* `pattern` - (Required) A valid [CloudWatch Logs filter pattern](https://docs.aws.amazon.com/AmazonCloudWatch/latest/DeveloperGuide/FilterAndPatternSyntax.html)
+  for extracting metric data out of ingested log events.
+* `logGroupName` - (Required) The name of the log group to associate the metric filter with.
+* `metricTransformation` - (Required) A block defining collection of information needed to define how metric data gets emitted. See below.
+
+The `metricTransformation` block supports the following arguments:
+
+* `name` - (Required) The name of the CloudWatch metric to which the monitored log information should be published (e.g., `errorCount`)
+* `namespace` - (Required) The destination namespace of the CloudWatch metric.
+* `value` - (Required) What to publish to the metric. For example, if you're counting the occurrences of a particular term like "Error", the value will be "1" for each occurrence. If you're counting the bytes transferred the published value will be the value in the log event.
+* `defaultValue` - (Optional) The value to emit when a filter pattern does not match a log event. Conflicts with `dimensions`.
+* `dimensions` - (Optional) Map of fields to use as dimensions for the metric. Up to 3 dimensions are allowed. Conflicts with `defaultValue`.
+* `unit` - (Optional) The unit to assign to the metric. If you omit this, the unit is set as `none`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name of the metric filter.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudWatch Log Metric Filter using the `logGroupName:name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import CloudWatch Log Metric Filter using the `logGroupName:name`. For example:
+
+```console
+% terraform import aws_cloudwatch_log_metric_filter.test /aws/lambda/function:test
+```
+
+<!-- cache-key: cdktf-0.18.0 input-c3539b00aea6703f03f30c699d9e6682c77afa8c2025da9bd2bce0e294523841 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/cloudwatch_log_resource_policy.html.markdown b/website/docs/cdktf/typescript/r/cloudwatch_log_resource_policy.html.markdown
new file mode 100644
index 00000000000..733657039cc
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/cloudwatch_log_resource_policy.html.markdown
@@ -0,0 +1,154 @@
+---
+subcategory: "CloudWatch Logs"
+layout: "aws"
+page_title: "AWS: aws_cloudwatch_log_resource_policy"
+description: |-
+  Provides a resource to manage a CloudWatch log resource policy
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudwatch_log_resource_policy
+
+Provides a resource to manage a CloudWatch log resource policy.
+
+## Example Usage
+
+### Elasticsearch Log Publishing
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudwatchLogResourcePolicy } from "./.gen/providers/aws/cloudwatch-log-resource-policy";
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const elasticsearchLogPublishingPolicy = new DataAwsIamPolicyDocument(
+      this,
+      "elasticsearch-log-publishing-policy",
+      {
+        statement: [
+          {
+            actions: [
+              "logs:CreateLogStream",
+              "logs:PutLogEvents",
+              "logs:PutLogEventsBatch",
+            ],
+            principals: [
+              {
+                identifiers: ["es.amazonaws.com"],
+                type: "Service",
+              },
+            ],
+            resources: ["arn:aws:logs:*"],
+          },
+        ],
+      }
+    );
+    const awsCloudwatchLogResourcePolicyElasticsearchLogPublishingPolicy =
+      new CloudwatchLogResourcePolicy(
+        this,
+        "elasticsearch-log-publishing-policy_1",
+        {
+          policyDocument: Token.asString(elasticsearchLogPublishingPolicy.json),
+          policyName: "elasticsearch-log-publishing-policy",
+        }
+      );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsCloudwatchLogResourcePolicyElasticsearchLogPublishingPolicy.overrideLogicalId(
+      "elasticsearch-log-publishing-policy"
+    );
+  }
+}
+
+```
+
+### Route53 Query Logging
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudwatchLogResourcePolicy } from "./.gen/providers/aws/cloudwatch-log-resource-policy";
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const route53QueryLoggingPolicy = new DataAwsIamPolicyDocument(
+      this,
+      "route53-query-logging-policy",
+      {
+        statement: [
+          {
+            actions: ["logs:CreateLogStream", "logs:PutLogEvents"],
+            principals: [
+              {
+                identifiers: ["route53.amazonaws.com"],
+                type: "Service",
+              },
+            ],
+            resources: ["arn:aws:logs:*:*:log-group:/aws/route53/*"],
+          },
+        ],
+      }
+    );
+    const awsCloudwatchLogResourcePolicyRoute53QueryLoggingPolicy =
+      new CloudwatchLogResourcePolicy(this, "route53-query-logging-policy_1", {
+        policyDocument: Token.asString(route53QueryLoggingPolicy.json),
+        policyName: "route53-query-logging-policy",
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsCloudwatchLogResourcePolicyRoute53QueryLoggingPolicy.overrideLogicalId(
+      "route53-query-logging-policy"
+    );
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `policyDocument` - (Required) Details of the resource policy, including the identity of the principal that is enabled to put logs to this account. This is formatted as a JSON string. Maximum length of 5120 characters.
+* `policyName` - (Required) Name of the resource policy.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name of the CloudWatch log resource policy
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudWatch log resource policies using the policy name. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import CloudWatch log resource policies using the policy name. For example:
+
+```console
+% terraform import aws_cloudwatch_log_resource_policy.MyPolicy MyPolicy
+```
+
+<!-- cache-key: cdktf-0.18.0 input-e10ada71512fa142d53597fd2949e853332001f8f918abaf19a3f490a6fae621 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/cloudwatch_log_stream.html.markdown b/website/docs/cdktf/typescript/r/cloudwatch_log_stream.html.markdown
new file mode 100644
index 00000000000..98c9a66cb6c
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/cloudwatch_log_stream.html.markdown
@@ -0,0 +1,77 @@
+---
+subcategory: "CloudWatch Logs"
+layout: "aws"
+page_title: "AWS: aws_cloudwatch_log_stream"
+description: |-
+  Provides a CloudWatch Log Stream resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudwatch_log_stream
+
+Provides a CloudWatch Log Stream resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudwatchLogGroup } from "./.gen/providers/aws/cloudwatch-log-group";
+import { CloudwatchLogStream } from "./.gen/providers/aws/cloudwatch-log-stream";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const yada = new CloudwatchLogGroup(this, "yada", {
+      name: "Yada",
+    });
+    new CloudwatchLogStream(this, "foo", {
+      logGroupName: yada.name,
+      name: "SampleLogStream1234",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the log stream. Must not be longer than 512 characters and must not contain `:`
+* `logGroupName` - (Required) The name of the log group under which the log stream is to be created.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) specifying the log stream.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Cloudwatch Log Stream using the stream's `logGroupName` and `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Cloudwatch Log Stream using the stream's `logGroupName` and `name`. For example:
+
+```console
+% terraform import aws_cloudwatch_log_stream.foo Yada:SampleLogStream1234
+```
+
+<!-- cache-key: cdktf-0.18.0 input-4fed32ff75bb830aa4a809d588a8fcccf96c6368ab7e6ad418f7d940ac65117d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/cloudwatch_log_subscription_filter.html.markdown b/website/docs/cdktf/typescript/r/cloudwatch_log_subscription_filter.html.markdown
new file mode 100644
index 00000000000..15d87cbc070
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/cloudwatch_log_subscription_filter.html.markdown
@@ -0,0 +1,79 @@
+---
+subcategory: "CloudWatch Logs"
+layout: "aws"
+page_title: "AWS: aws_cloudwatch_log_subscription_filter"
+description: |-
+  Provides a CloudWatch Logs subscription filter.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudwatch_log_subscription_filter
+
+Provides a CloudWatch Logs subscription filter resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudwatchLogSubscriptionFilter } from "./.gen/providers/aws/cloudwatch-log-subscription-filter";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new CloudwatchLogSubscriptionFilter(this, "test_lambdafunction_logfilter", {
+      destinationArn: testLogstream.arn,
+      distribution: "Random",
+      filterPattern: "logtype test",
+      logGroupName: "/aws/lambda/example_lambda_name",
+      name: "test_lambdafunction_logfilter",
+      roleArn: iamForLambda.arn,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) A name for the subscription filter
+* `destinationArn` - (Required) The ARN of the destination to deliver matching log events to. Kinesis stream or Lambda function ARN.
+* `filterPattern` - (Required) A valid CloudWatch Logs filter pattern for subscribing to a filtered stream of log events. Use empty string `""` to match everything. For more information, see the [Amazon CloudWatch Logs User Guide](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/FilterAndPatternSyntax.html).
+* `logGroupName` - (Required) The name of the log group to associate the subscription filter with
+* `roleArn` - (Optional) The ARN of an IAM role that grants Amazon CloudWatch Logs permissions to deliver ingested log events to the destination. If you use Lambda as a destination, you should skip this argument and use `awsLambdaPermission` resource for granting access from CloudWatch logs to the destination Lambda function.
+* `distribution` - (Optional) The method used to distribute log data to the destination. By default log data is grouped by log stream, but the grouping can be set to random for a more even distribution. This property is only applicable when the destination is an Amazon Kinesis stream. Valid values are "Random" and "ByLogStream".
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudWatch Logs subscription filter using the log group name and subscription filter name separated by `|`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import CloudWatch Logs subscription filter using the log group name and subscription filter name separated by `|`. For example:
+
+```console
+% terraform import aws_cloudwatch_log_subscription_filter.test_lambdafunction_logfilter /aws/lambda/example_lambda_name|test_lambdafunction_logfilter
+```
+
+<!-- cache-key: cdktf-0.18.0 input-6fe4a3f3f90f50bfb6b67e46b6ceeb3cbceaaa24c09559152a030888d8e3104b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/cloudwatch_metric_alarm.html.markdown b/website/docs/cdktf/typescript/r/cloudwatch_metric_alarm.html.markdown
new file mode 100644
index 00000000000..e595b1f21ea
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/cloudwatch_metric_alarm.html.markdown
@@ -0,0 +1,341 @@
+---
+subcategory: "CloudWatch"
+layout: "aws"
+page_title: "AWS: aws_cloudwatch_metric_alarm"
+description: |-
+  Provides a CloudWatch Metric Alarm resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudwatch_metric_alarm
+
+Provides a CloudWatch Metric Alarm resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudwatchMetricAlarm } from "./.gen/providers/aws/cloudwatch-metric-alarm";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new CloudwatchMetricAlarm(this, "foobar", {
+      alarmDescription: "This metric monitors ec2 cpu utilization",
+      alarmName: "terraform-test-foobar5",
+      comparisonOperator: "GreaterThanOrEqualToThreshold",
+      evaluationPeriods: 2,
+      insufficientDataActions: [],
+      metricName: "CPUUtilization",
+      namespace: "AWS/EC2",
+      period: 120,
+      statistic: "Average",
+      threshold: 80,
+    });
+  }
+}
+
+```
+
+## Example in Conjunction with Scaling Policies
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AutoscalingPolicy } from "./.gen/providers/aws/autoscaling-policy";
+import { CloudwatchMetricAlarm } from "./.gen/providers/aws/cloudwatch-metric-alarm";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const bat = new AutoscalingPolicy(this, "bat", {
+      adjustmentType: "ChangeInCapacity",
+      autoscalingGroupName: bar.name,
+      cooldown: 300,
+      name: "foobar3-terraform-test",
+      scalingAdjustment: 4,
+    });
+    const awsCloudwatchMetricAlarmBat = new CloudwatchMetricAlarm(
+      this,
+      "bat_1",
+      {
+        alarmActions: [bat.arn],
+        alarmDescription: "This metric monitors ec2 cpu utilization",
+        alarmName: "terraform-test-foobar5",
+        comparisonOperator: "GreaterThanOrEqualToThreshold",
+        dimensions: {
+          AutoScalingGroupName: bar.name,
+        },
+        evaluationPeriods: 2,
+        metricName: "CPUUtilization",
+        namespace: "AWS/EC2",
+        period: 120,
+        statistic: "Average",
+        threshold: 80,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsCloudwatchMetricAlarmBat.overrideLogicalId("bat");
+  }
+}
+
+```
+
+## Example with an Expression
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudwatchMetricAlarm } from "./.gen/providers/aws/cloudwatch-metric-alarm";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new CloudwatchMetricAlarm(this, "foobar", {
+      alarmDescription: "Request error rate has exceeded 10%",
+      alarmName: "terraform-test-foobar",
+      comparisonOperator: "GreaterThanOrEqualToThreshold",
+      evaluationPeriods: 2,
+      insufficientDataActions: [],
+      metricQuery: [
+        {
+          expression: "m2/m1*100",
+          id: "e1",
+          label: "Error Rate",
+          returnData: Token.asBoolean("true"),
+        },
+        {
+          id: "m1",
+          metric: {
+            dimensions: {
+              LoadBalancer: "app/web",
+            },
+            metricName: "RequestCount",
+            namespace: "AWS/ApplicationELB",
+            period: 120,
+            stat: "Sum",
+            unit: "Count",
+          },
+        },
+        {
+          id: "m2",
+          metric: {
+            dimensions: {
+              LoadBalancer: "app/web",
+            },
+            metricName: "HTTPCode_ELB_5XX_Count",
+            namespace: "AWS/ApplicationELB",
+            period: 120,
+            stat: "Sum",
+            unit: "Count",
+          },
+        },
+      ],
+      threshold: 10,
+    });
+  }
+}
+
+```
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudwatchMetricAlarm } from "./.gen/providers/aws/cloudwatch-metric-alarm";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new CloudwatchMetricAlarm(this, "xx_anomaly_detection", {
+      alarmDescription: "This metric monitors ec2 cpu utilization",
+      alarmName: "terraform-test-foobar",
+      comparisonOperator: "GreaterThanUpperThreshold",
+      evaluationPeriods: 2,
+      insufficientDataActions: [],
+      metricQuery: [
+        {
+          expression: "ANOMALY_DETECTION_BAND(m1)",
+          id: "e1",
+          label: "CPUUtilization (Expected)",
+          returnData: Token.asBoolean("true"),
+        },
+        {
+          id: "m1",
+          metric: {
+            dimensions: {
+              InstanceId: "i-abc123",
+            },
+            metricName: "CPUUtilization",
+            namespace: "AWS/EC2",
+            period: 120,
+            stat: "Average",
+            unit: "Count",
+          },
+          returnData: Token.asBoolean("true"),
+        },
+      ],
+      thresholdMetricId: "e1",
+    });
+  }
+}
+
+```
+
+## Example of monitoring Healthy Hosts on NLB using Target Group and NLB
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudwatchMetricAlarm } from "./.gen/providers/aws/cloudwatch-metric-alarm";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new CloudwatchMetricAlarm(this, "nlb_healthyhosts", {
+      actionsEnabled: Token.asBoolean("true"),
+      alarmActions: [sns.arn],
+      alarmDescription: "Number of healthy nodes in Target Group",
+      alarmName: "alarmname",
+      comparisonOperator: "LessThanThreshold",
+      dimensions: {
+        LoadBalancer: lb.arnSuffix,
+        TargetGroup: lbTg.arnSuffix,
+      },
+      evaluationPeriods: 1,
+      metricName: "HealthyHostCount",
+      namespace: "AWS/NetworkELB",
+      okActions: [sns.arn],
+      period: 60,
+      statistic: "Average",
+      threshold: logstashServersCount.numberValue,
+    });
+  }
+}
+
+```
+
+~> **NOTE:**  You cannot create a metric alarm consisting of both `statistic` and `extendedStatistic` parameters.
+You must choose one or the other
+
+## Argument Reference
+
+See [related part of AWS Docs](https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_PutMetricAlarm.html)
+for details about valid values.
+
+This argument supports the following arguments:
+
+* `alarmName` - (Required) The descriptive name for the alarm. This name must be unique within the user's AWS account
+* `comparisonOperator` - (Required) The arithmetic operation to use when comparing the specified Statistic and Threshold. The specified Statistic value is used as the first operand. Either of the following is supported: `greaterThanOrEqualToThreshold`, `greaterThanThreshold`, `lessThanThreshold`, `lessThanOrEqualToThreshold`. Additionally, the values  `lessThanLowerOrGreaterThanUpperThreshold`, `lessThanLowerThreshold`, and `greaterThanUpperThreshold` are used only for alarms based on anomaly detection models.
+* `evaluationPeriods` - (Required) The number of periods over which data is compared to the specified threshold.
+* `metricName` - (Optional) The name for the alarm's associated metric.
+  See docs for [supported metrics](https://docs.aws.amazon.com/AmazonCloudWatch/latest/DeveloperGuide/CW_Support_For_AWS.html).
+* `namespace` - (Optional) The namespace for the alarm's associated metric. See docs for the [list of namespaces](https://docs.aws.amazon.com/AmazonCloudWatch/latest/DeveloperGuide/aws-namespaces.html).
+  See docs for [supported metrics](https://docs.aws.amazon.com/AmazonCloudWatch/latest/DeveloperGuide/CW_Support_For_AWS.html).
+* `period` - (Optional) The period in seconds over which the specified `statistic` is applied.
+  Valid values are `10`, `30`, or any multiple of `60`.
+* `statistic` - (Optional) The statistic to apply to the alarm's associated metric.
+   Either of the following is supported: `sampleCount`, `average`, `sum`, `minimum`, `maximum`
+* `threshold` - (Optional) The value against which the specified statistic is compared. This parameter is required for alarms based on static thresholds, but should not be used for alarms based on anomaly detection models.
+* `thresholdMetricId` - (Optional) If this is an alarm based on an anomaly detection model, make this value match the ID of the ANOMALY_DETECTION_BAND function.
+* `actionsEnabled` - (Optional) Indicates whether or not actions should be executed during any changes to the alarm's state. Defaults to `true`.
+* `alarmActions` - (Optional) The list of actions to execute when this alarm transitions into an ALARM state from any other state. Each action is specified as an Amazon Resource Name (ARN).
+* `alarmDescription` - (Optional) The description for the alarm.
+* `datapointsToAlarm` - (Optional) The number of datapoints that must be breaching to trigger the alarm.
+* `dimensions` - (Optional) The dimensions for the alarm's associated metric.  For the list of available dimensions see the AWS documentation [here](http://docs.aws.amazon.com/AmazonCloudWatch/latest/DeveloperGuide/CW_Support_For_AWS.html).
+* `insufficientDataActions` - (Optional) The list of actions to execute when this alarm transitions into an INSUFFICIENT_DATA state from any other state. Each action is specified as an Amazon Resource Name (ARN).
+* `okActions` - (Optional) The list of actions to execute when this alarm transitions into an OK state from any other state. Each action is specified as an Amazon Resource Name (ARN).
+* `unit` - (Optional) The unit for the alarm's associated metric.
+* `extendedStatistic` - (Optional) The percentile statistic for the metric associated with the alarm. Specify a value between p0.0 and p100.
+* `treatMissingData` - (Optional) Sets how this alarm is to handle missing data points. The following values are supported: `missing`, `ignore`, `breaching` and `notBreaching`. Defaults to `missing`.
+* `evaluateLowSampleCountPercentiles` - (Optional) Used only for alarms based on percentiles.
+  If you specify `ignore`, the alarm state will not change during periods with too few data points to be statistically significant.
+  If you specify `evaluate` or omit this parameter, the alarm will always be evaluated and possibly change state no matter how many data points are available.
+The following values are supported: `ignore`, and `evaluate`.
+* `metricQuery` (Optional) Enables you to create an alarm based on a metric math expression. You may specify at most 20.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+~> **NOTE:**  If you specify at least one `metricQuery`, you may not specify a `metricName`, `namespace`, `period` or `statistic`. If you do not specify a `metricQuery`, you must specify each of these (although you may use `extendedStatistic` instead of `statistic`).
+
+### Nested fields
+
+#### `metricQuery`
+
+* `id` - (Required) A short name used to tie this object to the results in the response. If you are performing math expressions on this set of data, this name represents that data and can serve as a variable in the mathematical expression. The valid characters are letters, numbers, and underscore. The first character must be a lowercase letter.
+* `accountId` - (Optional) The ID of the account where the metrics are located, if this is a cross-account alarm.
+* `expression` - (Optional) The math expression to be performed on the returned data, if this object is performing a math expression. This expression can use the id of the other metrics to refer to those metrics, and can also use the id of other expressions to use the result of those expressions. For more information about metric math expressions, see Metric Math Syntax and Functions in the [Amazon CloudWatch User Guide](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/using-metric-math.html#metric-math-syntax).
+* `label` - (Optional) A human-readable label for this metric or expression. This is especially useful if this is an expression, so that you know what the value represents.
+* `metric` - (Optional) The metric to be returned, along with statistics, period, and units. Use this parameter only if this object is retrieving a metric and not performing a math expression on returned data.
+* `period` - (Optional) Granularity in seconds of returned data points.
+  For metrics with regular resolution, valid values are any multiple of `60`.
+  For high-resolution metrics, valid values are `1`, `5`, `10`, `30`, or any multiple of `60`.
+* `returnData` - (Optional) Specify exactly one `metricQuery` to be `true` to use that `metricQuery` result as the alarm.
+
+~> **NOTE:**  You must specify either `metric` or `expression`. Not both.
+
+#### `metric`
+
+* `dimensions` - (Optional) The dimensions for this metric.  For the list of available dimensions see the AWS documentation [here](http://docs.aws.amazon.com/AmazonCloudWatch/latest/DeveloperGuide/CW_Support_For_AWS.html).
+* `metricName` - (Required) The name for this metric.
+  See docs for [supported metrics](https://docs.aws.amazon.com/AmazonCloudWatch/latest/DeveloperGuide/CW_Support_For_AWS.html).
+* `namespace` - (Required) The namespace for this metric. See docs for the [list of namespaces](https://docs.aws.amazon.com/AmazonCloudWatch/latest/DeveloperGuide/aws-namespaces.html).
+  See docs for [supported metrics](https://docs.aws.amazon.com/AmazonCloudWatch/latest/DeveloperGuide/CW_Support_For_AWS.html).
+* `period` - (Required) Granularity in seconds of returned data points.
+  For metrics with regular resolution, valid values are any multiple of `60`.
+  For high-resolution metrics, valid values are `1`, `5`, `10`, `30`, or any multiple of `60`.
+* `stat` - (Required) The statistic to apply to this metric.
+   See docs for [supported statistics](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Statistics-definitions.html).
+* `unit` - (Optional) The unit for this metric.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the CloudWatch Metric Alarm.
+* `id` - The ID of the health check.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudWatch Metric Alarm using the `alarmName`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import CloudWatch Metric Alarm using the `alarmName`. For example:
+
+```console
+% terraform import aws_cloudwatch_metric_alarm.test alarm-12345
+```
+
+<!-- cache-key: cdktf-0.18.0 input-35c84ffb25db36c6ca1bc5ffe04bb308aa8f69f6412b0c58319d41a28b5c21f7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/cloudwatch_metric_stream.html.markdown b/website/docs/cdktf/typescript/r/cloudwatch_metric_stream.html.markdown
new file mode 100644
index 00000000000..31e4b509283
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/cloudwatch_metric_stream.html.markdown
@@ -0,0 +1,295 @@
+---
+subcategory: "CloudWatch"
+layout: "aws"
+page_title: "AWS: aws_cloudwatch_metric_stream"
+description: |-
+  Provides a CloudWatch Metric Stream resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudwatch_metric_stream
+
+Provides a CloudWatch Metric Stream resource.
+
+## Example Usage
+
+### Filters
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudwatchMetricStream } from "./.gen/providers/aws/cloudwatch-metric-stream";
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+import { IamRolePolicy } from "./.gen/providers/aws/iam-role-policy";
+import { KinesisFirehoseDeliveryStream } from "./.gen/providers/aws/kinesis-firehose-delivery-stream";
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketAcl } from "./.gen/providers/aws/s3-bucket-acl";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const bucket = new S3Bucket(this, "bucket", {
+      bucket: "metric-stream-test-bucket",
+    });
+    new S3BucketAcl(this, "bucket_acl", {
+      acl: "private",
+      bucket: bucket.id,
+    });
+    const firehoseAssumeRole = new DataAwsIamPolicyDocument(
+      this,
+      "firehose_assume_role",
+      {
+        statement: [
+          {
+            actions: ["sts:AssumeRole"],
+            effect: "Allow",
+            principals: [
+              {
+                identifiers: ["firehose.amazonaws.com"],
+                type: "Service",
+              },
+            ],
+          },
+        ],
+      }
+    );
+    const firehoseToS3 = new DataAwsIamPolicyDocument(this, "firehose_to_s3", {
+      statement: [
+        {
+          actions: [
+            "s3:AbortMultipartUpload",
+            "s3:GetBucketLocation",
+            "s3:GetObject",
+            "s3:ListBucket",
+            "s3:ListBucketMultipartUploads",
+            "s3:PutObject",
+          ],
+          effect: "Allow",
+          resources: [bucket.arn, "${" + bucket.arn + "}/*"],
+        },
+      ],
+    });
+    const streamsAssumeRole = new DataAwsIamPolicyDocument(
+      this,
+      "streams_assume_role",
+      {
+        statement: [
+          {
+            actions: ["sts:AssumeRole"],
+            effect: "Allow",
+            principals: [
+              {
+                identifiers: ["streams.metrics.cloudwatch.amazonaws.com"],
+                type: "Service",
+              },
+            ],
+          },
+        ],
+      }
+    );
+    const awsIamRoleFirehoseToS3 = new IamRole(this, "firehose_to_s3_5", {
+      assumeRolePolicy: Token.asString(firehoseAssumeRole.json),
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamRoleFirehoseToS3.overrideLogicalId("firehose_to_s3");
+    const metricStreamToFirehose = new IamRole(
+      this,
+      "metric_stream_to_firehose",
+      {
+        assumeRolePolicy: Token.asString(streamsAssumeRole.json),
+        name: "metric_stream_to_firehose_role",
+      }
+    );
+    const awsIamRolePolicyFirehoseToS3 = new IamRolePolicy(
+      this,
+      "firehose_to_s3_7",
+      {
+        name: "default",
+        policy: Token.asString(firehoseToS3.json),
+        role: Token.asString(awsIamRoleFirehoseToS3.id),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamRolePolicyFirehoseToS3.overrideLogicalId("firehose_to_s3");
+    const s3Stream = new KinesisFirehoseDeliveryStream(this, "s3_stream", {
+      destination: "extended_s3",
+      extendedS3Configuration: {
+        bucketArn: bucket.arn,
+        roleArn: Token.asString(awsIamRoleFirehoseToS3.arn),
+      },
+      name: "metric-stream-test-stream",
+    });
+    const dataAwsIamPolicyDocumentMetricStreamToFirehose =
+      new DataAwsIamPolicyDocument(this, "metric_stream_to_firehose_9", {
+        statement: [
+          {
+            actions: ["firehose:PutRecord", "firehose:PutRecordBatch"],
+            effect: "Allow",
+            resources: [s3Stream.arn],
+          },
+        ],
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsIamPolicyDocumentMetricStreamToFirehose.overrideLogicalId(
+      "metric_stream_to_firehose"
+    );
+    new CloudwatchMetricStream(this, "main", {
+      firehoseArn: s3Stream.arn,
+      includeFilter: [
+        {
+          metricNames: ["CPUUtilization", "NetworkOut"],
+          namespace: "AWS/EC2",
+        },
+        {
+          metricNames: [],
+          namespace: "AWS/EBS",
+        },
+      ],
+      name: "my-metric-stream",
+      outputFormat: "json",
+      roleArn: metricStreamToFirehose.arn,
+    });
+    const awsIamRolePolicyMetricStreamToFirehose = new IamRolePolicy(
+      this,
+      "metric_stream_to_firehose_11",
+      {
+        name: "default",
+        policy: Token.asString(
+          dataAwsIamPolicyDocumentMetricStreamToFirehose.json
+        ),
+        role: metricStreamToFirehose.id,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamRolePolicyMetricStreamToFirehose.overrideLogicalId(
+      "metric_stream_to_firehose"
+    );
+  }
+}
+
+```
+
+### Additional Statistics
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudwatchMetricStream } from "./.gen/providers/aws/cloudwatch-metric-stream";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new CloudwatchMetricStream(this, "main", {
+      firehoseArn: s3Stream.arn,
+      name: "my-metric-stream",
+      outputFormat: "json",
+      roleArn: metricStreamToFirehose.arn,
+      statisticsConfiguration: [
+        {
+          additionalStatistics: ["p1", "tm99"],
+          includeMetric: [
+            {
+              metricName: "CPUUtilization",
+              namespace: "AWS/EC2",
+            },
+          ],
+        },
+        {
+          additionalStatistics: ["TS(50.5:)"],
+          includeMetric: [
+            {
+              metricName: "CPUUtilization",
+              namespace: "AWS/EC2",
+            },
+          ],
+        },
+      ],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `firehoseArn` - (Required) ARN of the Amazon Kinesis Firehose delivery stream to use for this metric stream.
+* `roleArn` - (Required) ARN of the IAM role that this metric stream will use to access Amazon Kinesis Firehose resources. For more information about role permissions, see [Trust between CloudWatch and Kinesis Data Firehose](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-metric-streams-trustpolicy.html).
+* `outputFormat` - (Required) Output format for the stream. Possible values are `json` and `opentelemetry07`. For more information about output formats, see [Metric streams output formats](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-metric-streams-formats.html).
+
+The following arguments are optional:
+
+* `excludeFilter` - (Optional) List of exclusive metric filters. If you specify this parameter, the stream sends metrics from all metric namespaces except for the namespaces and the conditional metric names that you specify here. If you don't specify metric names or provide empty metric names whole metric namespace is excluded. Conflicts with `includeFilter`.
+* `includeFilter` - (Optional) List of inclusive metric filters. If you specify this parameter, the stream sends only the conditional metric names from the metric namespaces that you specify here. If you don't specify metric names or provide empty metric names whole metric namespace is included. Conflicts with `excludeFilter`.
+* `name` - (Optional, Forces new resource) Friendly name of the metric stream. If omitted, Terraform will assign a random, unique name. Conflicts with `namePrefix`.
+* `namePrefix` - (Optional, Forces new resource) Creates a unique friendly name beginning with the specified prefix. Conflicts with `name`.
+* `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `statisticsConfiguration` - (Optional) For each entry in this array, you specify one or more metrics and the list of additional statistics to stream for those metrics. The additional statistics that you can stream depend on the stream's `outputFormat`. If the OutputFormat is `json`, you can stream any additional statistic that is supported by CloudWatch, listed in [CloudWatch statistics definitions](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Statistics-definitions.html.html). If the OutputFormat is `opentelemetry07`, you can stream percentile statistics (p99 etc.). See details below.
+* `includeLinkedAccountsMetrics` (Optional) If you are creating a metric stream in a monitoring account, specify true to include metrics from source accounts that are linked to this monitoring account, in the metric stream. The default is false. For more information about linking accounts, see [CloudWatch cross-account observability](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-Unified-Cross-Account.html).
+
+### Nested Fields
+
+#### `excludeFilter`
+
+* `namespace` - (Required) Name of the metric namespace in the filter.
+* `metricNames` - (Optional) An array that defines the metrics you want to exclude for this metric namespace
+
+#### `includeFilter`
+
+* `namespace` - (Required) Name of the metric namespace in the filter.
+* `metricNames` - (Optional) An array that defines the metrics you want to include for this metric namespace
+
+#### `statisticsConfigurations`
+
+* `additionalStatistics` - (Required) The additional statistics to stream for the metrics listed in `includeMetrics`.
+* `includeMetric` - (Required) An array that defines the metrics that are to have additional statistics streamed. See details below.
+
+#### `includeMetrics`
+
+* `metricName` - (Required) The name of the metric.
+* `namespace` - (Required) The namespace of the metric.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the metric stream.
+* `creationDate` - Date and time in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8) that the metric stream was created.
+* `lastUpdateDate` - Date and time in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8) that the metric stream was last updated.
+* `state` - State of the metric stream. Possible values are `running` and `stopped`.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudWatch metric streams using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import CloudWatch metric streams using the `name`. For example:
+
+```console
+% terraform import aws_cloudwatch_metric_stream.sample sample-stream-name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-c784099071593ee0e42cd9f39aed6e0e5231d53ebec38c6f6c7bc696081f0d87 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/cloudwatch_query_definition.html.markdown b/website/docs/cdktf/typescript/r/cloudwatch_query_definition.html.markdown
new file mode 100644
index 00000000000..d6b976f716b
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/cloudwatch_query_definition.html.markdown
@@ -0,0 +1,76 @@
+---
+subcategory: "CloudWatch Logs"
+layout: "aws"
+page_title: "AWS: aws_cloudwatch_query_definition"
+description: |-
+  Provides a CloudWatch Logs query definition resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cloudwatch_query_definition
+
+Provides a CloudWatch Logs query definition resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudwatchQueryDefinition } from "./.gen/providers/aws/cloudwatch-query-definition";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new CloudwatchQueryDefinition(this, "example", {
+      logGroupNames: ["/aws/logGroup1", "/aws/logGroup2"],
+      name: "custom_query",
+      queryString:
+        "fields @timestamp, @message\n| sort @timestamp desc\n| limit 25\n\n",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the query.
+* `queryString` - (Required) The query to save. You can read more about CloudWatch Logs Query Syntax in the [documentation](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_QuerySyntax.html).
+* `logGroupNames` - (Optional) Specific log groups to use with the query.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `queryDefinitionId` - The query definition ID.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudWatch query definitions using the query definition ARN. The ARN can be found on the "Edit Query" page for the query in the AWS Console. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import CloudWatch query definitions using the query definition ARN. The ARN can be found on the "Edit Query" page for the query in the AWS Console. For example:
+
+```console
+% terraform import aws_cloudwatch_query_definition.example arn:aws:logs:us-west-2:123456789012:query-definition:269951d7-6f75-496d-9d7b-6b7a5486bdbd
+```
+
+<!-- cache-key: cdktf-0.18.0 input-a122b619c0de2afa7a8b5aa10fde4e196df14477d2ae2e40ef733a9bc5105e18 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/codeartifact_domain.html.markdown b/website/docs/cdktf/typescript/r/codeartifact_domain.html.markdown
new file mode 100644
index 00000000000..5af77ee145b
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/codeartifact_domain.html.markdown
@@ -0,0 +1,79 @@
+---
+subcategory: "CodeArtifact"
+layout: "aws"
+page_title: "AWS: aws_codeartifact_domain"
+description: |-
+  Provides a CodeArtifact Domain resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_codeartifact_domain
+
+Provides a CodeArtifact Domain Resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CodeartifactDomain } from "./.gen/providers/aws/codeartifact-domain";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new CodeartifactDomain(this, "example", {
+      domain: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `domain` - (Required) The name of the domain to create. All domain names in an AWS Region that are in the same AWS account must be unique. The domain name is used as the prefix in DNS hostnames. Do not use sensitive information in a domain name because it is publicly discoverable.
+* `encryptionKey` - (Optional) The encryption key for the domain. This is used to encrypt content stored in a domain. The KMS Key Amazon Resource Name (ARN). The default aws/codeartifact AWS KMS master key is used if this element is absent.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ARN of the Domain.
+* `arn` - The ARN of the Domain.
+* `owner` - The AWS account ID that owns the domain.
+* `repositoryCount` - The number of repositories in the domain.
+* `createdTime` - A timestamp that represents the date and time the domain was created in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8).
+* `assetSizeBytes` - The total size of all assets in the domain.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CodeArtifact Domain using the CodeArtifact Domain arn. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import CodeArtifact Domain using the CodeArtifact Domain arn. For example:
+
+```console
+% terraform import aws_codeartifact_domain.example arn:aws:codeartifact:us-west-2:012345678912:domain/tf-acc-test-8593714120730241305
+```
+
+<!-- cache-key: cdktf-0.18.0 input-a89c6d8c19079509b918e67525ee7273ddf173853ad8232d1909b2d3be8ac22c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/codeartifact_domain_permissions_policy.html.markdown b/website/docs/cdktf/typescript/r/codeartifact_domain_permissions_policy.html.markdown
new file mode 100644
index 00000000000..9c349c9b29c
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/codeartifact_domain_permissions_policy.html.markdown
@@ -0,0 +1,110 @@
+---
+subcategory: "CodeArtifact"
+layout: "aws"
+page_title: "AWS: aws_codeartifact_domain_permissions_policy"
+description: |-
+  Provides a CodeArtifact Domain Permissions Policy resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_codeartifact_domain_permissions_policy
+
+Provides a CodeArtifact Domains Permissions Policy Resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CodeartifactDomain } from "./.gen/providers/aws/codeartifact-domain";
+import { CodeartifactDomainPermissionsPolicy } from "./.gen/providers/aws/codeartifact-domain-permissions-policy";
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { KmsKey } from "./.gen/providers/aws/kms-key";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new KmsKey(this, "example", {
+      description: "domain key",
+    });
+    const awsCodeartifactDomainExample = new CodeartifactDomain(
+      this,
+      "example_1",
+      {
+        domain: "example",
+        encryptionKey: example.arn,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsCodeartifactDomainExample.overrideLogicalId("example");
+    const test = new DataAwsIamPolicyDocument(this, "test", {
+      statement: [
+        {
+          actions: ["codeartifact:CreateRepository"],
+          effect: "Allow",
+          principals: [
+            {
+              identifiers: ["*"],
+              type: "*",
+            },
+          ],
+          resources: [Token.asString(awsCodeartifactDomainExample.arn)],
+        },
+      ],
+    });
+    const awsCodeartifactDomainPermissionsPolicyTest =
+      new CodeartifactDomainPermissionsPolicy(this, "test_3", {
+        domain: Token.asString(awsCodeartifactDomainExample.domain),
+        policyDocument: Token.asString(test.json),
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsCodeartifactDomainPermissionsPolicyTest.overrideLogicalId("test");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `domain` - (Required) The name of the domain on which to set the resource policy.
+* `policyDocument` - (Required) A JSON policy string to be set as the access control resource policy on the provided domain.
+* `domainOwner` - (Optional) The account number of the AWS account that owns the domain.
+* `policyRevision` - (Optional) The current revision of the resource policy to be set. This revision is used for optimistic locking, which prevents others from overwriting your changes to the domain's resource policy.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Name of Domain.
+* `resourceArn` - The ARN of the resource associated with the resource policy.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CodeArtifact Domain Permissions Policies using the CodeArtifact Domain ARN. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import CodeArtifact Domain Permissions Policies using the CodeArtifact Domain ARN. For example:
+
+```console
+% terraform import aws_codeartifact_domain_permissions_policy.example arn:aws:codeartifact:us-west-2:012345678912:domain/tf-acc-test-1928056699409417367
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ad7db656ffa6152a6f3b17e85bd919f6f92ab7d824fe3b18d3dfdd0e0c9f5daf -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/codeartifact_repository.html.markdown b/website/docs/cdktf/typescript/r/codeartifact_repository.html.markdown
new file mode 100644
index 00000000000..40bf9c8b90f
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/codeartifact_repository.html.markdown
@@ -0,0 +1,166 @@
+---
+subcategory: "CodeArtifact"
+layout: "aws"
+page_title: "AWS: aws_codeartifact_repository"
+description: |-
+  Provides a CodeArtifact Repository resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_codeartifact_repository
+
+Provides a CodeArtifact Repository Resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CodeartifactDomain } from "./.gen/providers/aws/codeartifact-domain";
+import { CodeartifactRepository } from "./.gen/providers/aws/codeartifact-repository";
+import { KmsKey } from "./.gen/providers/aws/kms-key";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new KmsKey(this, "example", {
+      description: "domain key",
+    });
+    const awsCodeartifactDomainExample = new CodeartifactDomain(
+      this,
+      "example_1",
+      {
+        domain: "example",
+        encryptionKey: example.arn,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsCodeartifactDomainExample.overrideLogicalId("example");
+    new CodeartifactRepository(this, "test", {
+      domain: Token.asString(awsCodeartifactDomainExample.domain),
+      repository: "example",
+    });
+  }
+}
+
+```
+
+## Example Usage with upstream repository
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CodeartifactRepository } from "./.gen/providers/aws/codeartifact-repository";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const upstream = new CodeartifactRepository(this, "upstream", {
+      domain: test.domain,
+      repository: "upstream",
+    });
+    new CodeartifactRepository(this, "test", {
+      domain: example.domain,
+      repository: "example",
+      upstream: [
+        {
+          repositoryName: upstream.repository,
+        },
+      ],
+    });
+  }
+}
+
+```
+
+## Example Usage with external connection
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CodeartifactRepository } from "./.gen/providers/aws/codeartifact-repository";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new CodeartifactRepository(this, "test", {
+      domain: example.domain,
+      externalConnections: {
+        externalConnectionName: "public:npmjs",
+      },
+      repository: "example",
+    });
+    new CodeartifactRepository(this, "upstream", {
+      domain: Token.asString(awsCodeartifactDomainTest.domain),
+      repository: "upstream",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `domain` - (Required) The domain that contains the created repository.
+* `repository` - (Required) The name of the repository to create.
+* `domainOwner` - (Optional) The account number of the AWS account that owns the domain.
+* `description` - (Optional) The description of the repository.
+* `upstream` - (Optional) A list of upstream repositories to associate with the repository. The order of the upstream repositories in the list determines their priority order when AWS CodeArtifact looks for a requested package version. see [Upstream](#upstream)
+* `externalConnections` - An array of external connections associated with the repository. Only one external connection can be set per repository. see [External Connections](#external-connections).
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Upstream
+
+* `repositoryName` - (Required) The name of an upstream repository.
+
+### External Connections
+
+* `externalConnectionName` - (Required) The name of the external connection associated with a repository.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ARN of the repository.
+* `arn` - The ARN of the repository.
+* `administratorAccount` - The account number of the AWS account that manages the repository.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CodeArtifact Repository using the CodeArtifact Repository ARN. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import CodeArtifact Repository using the CodeArtifact Repository ARN. For example:
+
+```console
+% terraform import aws_codeartifact_repository.example arn:aws:codeartifact:us-west-2:012345678912:repository/tf-acc-test-6968272603913957763/tf-acc-test-6968272603913957763
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ca58cfb42dd4c4e2a87c170764549f39f2f66f3383a2b20872f8e68bcce2c980 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/codeartifact_repository_permissions_policy.html.markdown b/website/docs/cdktf/typescript/r/codeartifact_repository_permissions_policy.html.markdown
new file mode 100644
index 00000000000..ed89c42a4d0
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/codeartifact_repository_permissions_policy.html.markdown
@@ -0,0 +1,131 @@
+---
+subcategory: "CodeArtifact"
+layout: "aws"
+page_title: "AWS: aws_codeartifact_repository_permissions_policy"
+description: |-
+  Provides a CodeArtifact Repository Permissions Policy resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_codeartifact_repository_permissions_policy
+
+Provides a CodeArtifact Repostory Permissions Policy Resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CodeartifactDomain } from "./.gen/providers/aws/codeartifact-domain";
+import { CodeartifactRepository } from "./.gen/providers/aws/codeartifact-repository";
+import { CodeartifactRepositoryPermissionsPolicy } from "./.gen/providers/aws/codeartifact-repository-permissions-policy";
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { KmsKey } from "./.gen/providers/aws/kms-key";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new KmsKey(this, "example", {
+      description: "domain key",
+    });
+    const awsCodeartifactDomainExample = new CodeartifactDomain(
+      this,
+      "example_1",
+      {
+        domain: "example",
+        encryptionKey: example.arn,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsCodeartifactDomainExample.overrideLogicalId("example");
+    const awsCodeartifactRepositoryExample = new CodeartifactRepository(
+      this,
+      "example_2",
+      {
+        domain: Token.asString(awsCodeartifactDomainExample.domain),
+        repository: "example",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsCodeartifactRepositoryExample.overrideLogicalId("example");
+    const dataAwsIamPolicyDocumentExample = new DataAwsIamPolicyDocument(
+      this,
+      "example_3",
+      {
+        statement: [
+          {
+            actions: ["codeartifact:ReadFromRepository"],
+            effect: "Allow",
+            principals: [
+              {
+                identifiers: ["*"],
+                type: "*",
+              },
+            ],
+            resources: [Token.asString(awsCodeartifactRepositoryExample.arn)],
+          },
+        ],
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsIamPolicyDocumentExample.overrideLogicalId("example");
+    const awsCodeartifactRepositoryPermissionsPolicyExample =
+      new CodeartifactRepositoryPermissionsPolicy(this, "example_4", {
+        domain: Token.asString(awsCodeartifactDomainExample.domain),
+        policyDocument: Token.asString(dataAwsIamPolicyDocumentExample.json),
+        repository: Token.asString(awsCodeartifactRepositoryExample.repository),
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsCodeartifactRepositoryPermissionsPolicyExample.overrideLogicalId(
+      "example"
+    );
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `repository` - (Required) The name of the repository to set the resource policy on.
+* `domain` - (Required) The name of the domain on which to set the resource policy.
+* `policyDocument` - (Required) A JSON policy string to be set as the access control resource policy on the provided domain.
+* `domainOwner` - (Optional) The account number of the AWS account that owns the domain.
+* `policyRevision` - (Optional) The current revision of the resource policy to be set. This revision is used for optimistic locking, which prevents others from overwriting your changes to the domain's resource policy.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ARN of the resource associated with the resource policy.
+* `resourceArn` - The ARN of the resource associated with the resource policy.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CodeArtifact Repository Permissions Policies using the CodeArtifact Repository ARN. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import CodeArtifact Repository Permissions Policies using the CodeArtifact Repository ARN. For example:
+
+```console
+% terraform import aws_codeartifact_repository_permissions_policy.example arn:aws:codeartifact:us-west-2:012345678912:repository/tf-acc-test-6968272603913957763/tf-acc-test-6968272603913957763
+```
+
+<!-- cache-key: cdktf-0.18.0 input-2609ffac94d64cc0a79333020641c78ce36e999d6d8358e8f31df4a0ce52ddb0 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/codebuild_project.html.markdown b/website/docs/cdktf/typescript/r/codebuild_project.html.markdown
new file mode 100644
index 00000000000..1d7dffd2ffa
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/codebuild_project.html.markdown
@@ -0,0 +1,441 @@
+---
+subcategory: "CodeBuild"
+layout: "aws"
+page_title: "AWS: aws_codebuild_project"
+description: |-
+  Provides a CodeBuild Project resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_codebuild_project
+
+Provides a CodeBuild Project resource. See also the [`awsCodebuildWebhook` resource](/docs/providers/aws/r/codebuild_webhook.html), which manages the webhook to the source (e.g., the "rebuild every time a code change is pushed" option in the CodeBuild web console).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CodebuildProject } from "./.gen/providers/aws/codebuild-project";
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+import { IamRolePolicy } from "./.gen/providers/aws/iam-role-policy";
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketAcl } from "./.gen/providers/aws/s3-bucket-acl";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new S3Bucket(this, "example", {
+      bucket: "example",
+    });
+    const awsS3BucketAclExample = new S3BucketAcl(this, "example_1", {
+      acl: "private",
+      bucket: example.id,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketAclExample.overrideLogicalId("example");
+    const assumeRole = new DataAwsIamPolicyDocument(this, "assume_role", {
+      statement: [
+        {
+          actions: ["sts:AssumeRole"],
+          effect: "Allow",
+          principals: [
+            {
+              identifiers: ["codebuild.amazonaws.com"],
+              type: "Service",
+            },
+          ],
+        },
+      ],
+    });
+    const dataAwsIamPolicyDocumentExample = new DataAwsIamPolicyDocument(
+      this,
+      "example_3",
+      {
+        statement: [
+          {
+            actions: [
+              "logs:CreateLogGroup",
+              "logs:CreateLogStream",
+              "logs:PutLogEvents",
+            ],
+            effect: "Allow",
+            resources: ["*"],
+          },
+          {
+            actions: [
+              "ec2:CreateNetworkInterface",
+              "ec2:DescribeDhcpOptions",
+              "ec2:DescribeNetworkInterfaces",
+              "ec2:DeleteNetworkInterface",
+              "ec2:DescribeSubnets",
+              "ec2:DescribeSecurityGroups",
+              "ec2:DescribeVpcs",
+            ],
+            effect: "Allow",
+            resources: ["*"],
+          },
+          {
+            actions: ["ec2:CreateNetworkInterfacePermission"],
+            condition: [
+              {
+                test: "StringEquals",
+                values: [example1.arn, example2.arn],
+                variable: "ec2:Subnet",
+              },
+              {
+                test: "StringEquals",
+                values: ["codebuild.amazonaws.com"],
+                variable: "ec2:AuthorizedService",
+              },
+            ],
+            effect: "Allow",
+            resources: [
+              "arn:aws:ec2:us-east-1:123456789012:network-interface/*",
+            ],
+          },
+          {
+            actions: ["s3:*"],
+            effect: "Allow",
+            resources: [example.arn, "${" + example.arn + "}/*"],
+          },
+        ],
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsIamPolicyDocumentExample.overrideLogicalId("example");
+    const awsIamRoleExample = new IamRole(this, "example_4", {
+      assumeRolePolicy: Token.asString(assumeRole.json),
+      name: "example",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamRoleExample.overrideLogicalId("example");
+    const awsIamRolePolicyExample = new IamRolePolicy(this, "example_5", {
+      policy: Token.asString(dataAwsIamPolicyDocumentExample.json),
+      role: Token.asString(awsIamRoleExample.name),
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamRolePolicyExample.overrideLogicalId("example");
+    const awsCodebuildProjectExample = new CodebuildProject(this, "example_6", {
+      artifacts: {
+        type: "NO_ARTIFACTS",
+      },
+      buildTimeout: 5,
+      cache: {
+        location: example.bucket,
+        type: "S3",
+      },
+      description: "test_codebuild_project",
+      environment: {
+        computeType: "BUILD_GENERAL1_SMALL",
+        environmentVariable: [
+          {
+            name: "SOME_KEY1",
+            value: "SOME_VALUE1",
+          },
+          {
+            name: "SOME_KEY2",
+            type: "PARAMETER_STORE",
+            value: "SOME_VALUE2",
+          },
+        ],
+        image: "aws/codebuild/amazonlinux2-x86_64-standard:4.0",
+        imagePullCredentialsType: "CODEBUILD",
+        type: "LINUX_CONTAINER",
+      },
+      logsConfig: {
+        cloudwatchLogs: {
+          groupName: "log-group",
+          streamName: "log-stream",
+        },
+        s3Logs: {
+          location: "${" + example.id + "}/build-log",
+          status: "ENABLED",
+        },
+      },
+      name: "test-project",
+      serviceRole: Token.asString(awsIamRoleExample.arn),
+      source: {
+        gitCloneDepth: 1,
+        gitSubmodulesConfig: {
+          fetchSubmodules: true,
+        },
+        location: "https://github.com/mitchellh/packer.git",
+        type: "GITHUB",
+      },
+      sourceVersion: "master",
+      tags: {
+        Environment: "Test",
+      },
+      vpcConfig: {
+        securityGroupIds: [
+          Token.asString(awsSecurityGroupExample1.id),
+          Token.asString(awsSecurityGroupExample2.id),
+        ],
+        subnets: [example1.id, example2.id],
+        vpcId: Token.asString(awsVpcExample.id),
+      },
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsCodebuildProjectExample.overrideLogicalId("example");
+    new CodebuildProject(this, "project-with-cache", {
+      artifacts: {
+        type: "NO_ARTIFACTS",
+      },
+      buildTimeout: 5,
+      cache: {
+        modes: ["LOCAL_DOCKER_LAYER_CACHE", "LOCAL_SOURCE_CACHE"],
+        type: "LOCAL",
+      },
+      description: "test_codebuild_project_cache",
+      environment: {
+        computeType: "BUILD_GENERAL1_SMALL",
+        environmentVariable: [
+          {
+            name: "SOME_KEY1",
+            value: "SOME_VALUE1",
+          },
+        ],
+        image: "aws/codebuild/amazonlinux2-x86_64-standard:4.0",
+        imagePullCredentialsType: "CODEBUILD",
+        type: "LINUX_CONTAINER",
+      },
+      name: "test-project-cache",
+      queuedTimeout: 5,
+      serviceRole: Token.asString(awsIamRoleExample.arn),
+      source: {
+        gitCloneDepth: 1,
+        location: "https://github.com/mitchellh/packer.git",
+        type: "GITHUB",
+      },
+      tags: {
+        Environment: "Test",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `artifacts` - (Required) Configuration block. Detailed below.
+* `environment` - (Required) Configuration block. Detailed below.
+* `name` - (Required) Project's name.
+* `serviceRole` - (Required) Amazon Resource Name (ARN) of the AWS Identity and Access Management (IAM) role that enables AWS CodeBuild to interact with dependent AWS services on behalf of the AWS account.
+* `source` - (Required) Configuration block. Detailed below.
+
+The following arguments are optional:
+
+* `badgeEnabled` - (Optional) Generates a publicly-accessible URL for the projects build badge. Available as `badgeUrl` attribute when enabled.
+* `buildBatchConfig` - (Optional) Defines the batch build options for the project.
+* `buildTimeout` - (Optional) Number of minutes, from 5 to 480 (8 hours), for AWS CodeBuild to wait until timing out any related build that does not get marked as completed. The default is 60 minutes.
+* `cache` - (Optional) Configuration block. Detailed below.
+* `concurrentBuildLimit` - (Optional) Specify a maximum number of concurrent builds for the project. The value specified must be greater than 0 and less than the account concurrent running builds limit.
+* `description` - (Optional) Short description of the project.
+* `fileSystemLocations` - (Optional) A set of file system locations to mount inside the build. File system locations are documented below.
+* `encryptionKey` - (Optional) AWS Key Management Service (AWS KMS) customer master key (CMK) to be used for encrypting the build project's build output artifacts.
+* `logsConfig` - (Optional) Configuration block. Detailed below.
+* `projectVisibility` - (Optional) Specifies the visibility of the project's builds. Possible values are: `publicRead` and `private`. Default value is `private`.
+* `resourceAccessRole` - The ARN of the IAM role that enables CodeBuild to access the CloudWatch Logs and Amazon S3 artifacts for the project's builds.
+* `queuedTimeout` - (Optional) Number of minutes, from 5 to 480 (8 hours), a build is allowed to be queued before it times out. The default is 8 hours.
+* `secondaryArtifacts` - (Optional) Configuration block. Detailed below.
+* `secondarySources` - (Optional) Configuration block. Detailed below.
+* `secondarySourceVersion` - (Optional) Configuration block. Detailed below.
+* `sourceVersion` - (Optional) Version of the build input to be built for this project. If not specified, the latest version is used.
+* `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `vpcConfig` - (Optional) Configuration block. Detailed below.
+
+### artifacts
+
+* `artifactIdentifier` - (Optional) Artifact identifier. Must be the same specified inside the AWS CodeBuild build specification.
+* `bucketOwnerAccess` - (Optional) Specifies the bucket owner's access for objects that another account uploads to their Amazon S3 bucket. By default, only the account that uploads the objects to the bucket has access to these objects. This property allows you to give the bucket owner access to these objects. Valid values are `none`, `readOnly`, and `full`. your CodeBuild service role must have the `s3:putBucketAcl` permission. This permission allows CodeBuild to modify the access control list for the bucket.
+* `encryptionDisabled` - (Optional) Whether to disable encrypting output artifacts. If `type` is set to `noArtifacts`, this value is ignored. Defaults to `false`.
+* `location` - (Optional) Information about the build output artifact location. If `type` is set to `codepipeline` or `noArtifacts`, this value is ignored. If `type` is set to `s3`, this is the name of the output bucket.
+* `name` - (Optional) Name of the project. If `type` is set to `s3`, this is the name of the output artifact object
+* `namespaceType` - (Optional) Namespace to use in storing build artifacts. If `type` is set to `s3`, then valid values are `buildId`, `none`.
+* `overrideArtifactName` (Optional) Whether a name specified in the build specification overrides the artifact name.
+* `packaging` - (Optional) Type of build output artifact to create. If `type` is set to `s3`, valid values are `none`, `zip`
+* `path` - (Optional) If `type` is set to `s3`, this is the path to the output artifact.
+* `type` - (Required) Build output artifact's type. Valid values: `codepipeline`, `noArtifacts`, `s3`.
+
+### build_batch_config
+
+* `combineArtifacts` - (Optional) Specifies if the build artifacts for the batch build should be combined into a single artifact location.
+* `restrictions` - (Optional) Configuration block specifying the restrictions for the batch build. Detailed below.
+* `serviceRole` - (Required) Specifies the service role ARN for the batch build project.
+* `timeoutInMins` - (Optional) Specifies the maximum amount of time, in minutes, that the batch build must be completed in.
+
+#### build_batch_config: restrictions
+
+* `computeTypesAllowed` - (Optional) An array of strings that specify the compute types that are allowed for the batch build. See [Build environment compute types](https://docs.aws.amazon.com/codebuild/latest/userguide/build-env-ref-compute-types.html) in the AWS CodeBuild User Guide for these values.
+* `maximumBuildsAllowed` - (Optional) Specifies the maximum number of builds allowed.
+
+### cache
+
+* `location` - (Required when cache type is `s3`) Location where the AWS CodeBuild project stores cached resources. For type `s3`, the value must be a valid S3 bucket name/prefix.
+* `modes` - (Required when cache type is `local`) Specifies settings that AWS CodeBuild uses to store and reuse build dependencies. Valid values:  `localSourceCache`, `localDockerLayerCache`, `localCustomCache`.
+* `type` - (Optional) Type of storage that will be used for the AWS CodeBuild project cache. Valid values: `noCache`, `local`, `s3`. Defaults to `noCache`.
+
+### environment
+
+* `certificate` - (Optional) ARN of the S3 bucket, path prefix and object key that contains the PEM-encoded certificate.
+* `computeType` - (Required) Information about the compute resources the build project will use. Valid values: `buildGeneral1Small`, `buildGeneral1Medium`, `buildGeneral1Large`, `buildGeneral12Xlarge`. `buildGeneral1Small` is only valid if `type` is set to `linuxContainer`. When `type` is set to `linuxGpuContainer`, `computeType` must be `buildGeneral1Large`.
+* `environmentVariable` - (Optional) Configuration block. Detailed below.
+* `imagePullCredentialsType` - (Optional) Type of credentials AWS CodeBuild uses to pull images in your build. Valid values: `codebuild`, `serviceRole`. When you use a cross-account or private registry image, you must use SERVICE_ROLE credentials. When you use an AWS CodeBuild curated image, you must use CodeBuild credentials. Defaults to `codebuild`.
+* `image` - (Required) Docker image to use for this build project. Valid values include [Docker images provided by CodeBuild](https://docs.aws.amazon.com/codebuild/latest/userguide/build-env-ref-available.html) (e.g `aws/codebuild/amazonlinux2X8664Standard:40`), [Docker Hub images](https://hub.docker.com/) (e.g., `hashicorp/terraform:latest`), and full Docker repository URIs such as those for ECR (e.g., `137112412989DkrEcrUsWest2AmazonawsCom/amazonlinux:latest`).
+* `privilegedMode` - (Optional) Whether to enable running the Docker daemon inside a Docker container. Defaults to `false`.
+* `registryCredential` - (Optional) Configuration block. Detailed below.
+* `type` - (Required) Type of build environment to use for related builds. Valid values: `linuxContainer`, `linuxGpuContainer`, `windowsContainer` (deprecated), `windowsServer2019Container`, `armContainer`. For additional information, see the [CodeBuild User Guide](https://docs.aws.amazon.com/codebuild/latest/userguide/build-env-ref-compute-types.html).
+
+#### environment: environment_variable
+
+* `name` - (Required) Environment variable's name or key.
+* `type` - (Optional) Type of environment variable. Valid values: `parameterStore`, `plaintext`, `secretsManager`.
+* `value` - (Required) Environment variable's value.
+
+#### environment: registry_credential
+
+Credentials for access to a private Docker registry.
+
+* `credential` - (Required) ARN or name of credentials created using AWS Secrets Manager.
+* `credentialProvider` - (Required) Service that created the credentials to access a private Docker registry. Valid value: `secretsManager` (AWS Secrets Manager).
+
+### file_system_locations
+
+See [ProjectFileSystemLocation](https://docs.aws.amazon.com/codebuild/latest/APIReference/API_ProjectFileSystemLocation.html) for more details of the fields.
+
+* `identifier` - (Optional) The name used to access a file system created by Amazon EFS. CodeBuild creates an environment variable by appending the identifier in all capital letters to CODEBUILD\_. For example, if you specify my-efs for identifier, a new environment variable is create named CODEBUILD_MY-EFS.
+* `location` - (Optional) A string that specifies the location of the file system created by Amazon EFS. Its format is `efsDnsName:/directoryPath`.
+* `mountOptions` - (Optional) The mount options for a file system created by AWS EFS.
+* `mountPoint` - (Optional) The location in the container where you mount the file system.
+* `type` - (Optional) The type of the file system. The one supported type is `efs`.
+
+### logs_config
+
+* `cloudwatchLogs` - (Optional) Configuration block. Detailed below.
+* `s3Logs` - (Optional) Configuration block. Detailed below.
+
+#### logs_config: cloudwatch_logs
+
+* `groupName` - (Optional) Group name of the logs in CloudWatch Logs.
+* `status` - (Optional) Current status of logs in CloudWatch Logs for a build project. Valid values: `enabled`, `disabled`. Defaults to `enabled`.
+* `streamName` - (Optional) Stream name of the logs in CloudWatch Logs.
+
+#### logs_config: s3_logs
+
+* `encryptionDisabled` - (Optional) Whether to disable encrypting S3 logs. Defaults to `false`.
+* `location` - (Optional) Name of the S3 bucket and the path prefix for S3 logs. Must be set if status is `enabled`, otherwise it must be empty.
+* `status` - (Optional) Current status of logs in S3 for a build project. Valid values: `enabled`, `disabled`. Defaults to `disabled`.
+* `bucketOwnerAccess` - (Optional) Specifies the bucket owner's access for objects that another account uploads to their Amazon S3 bucket. By default, only the account that uploads the objects to the bucket has access to these objects. This property allows you to give the bucket owner access to these objects. Valid values are `none`, `readOnly`, and `full`. your CodeBuild service role must have the `s3:putBucketAcl` permission. This permission allows CodeBuild to modify the access control list for the bucket.
+
+### secondary_artifacts
+
+* `artifactIdentifier` - (Required) Artifact identifier. Must be the same specified inside the AWS CodeBuild build specification.
+* `bucketOwnerAccess` - (Optional) Specifies the bucket owner's access for objects that another account uploads to their Amazon S3 bucket. By default, only the account that uploads the objects to the bucket has access to these objects. This property allows you to give the bucket owner access to these objects. Valid values are `none`, `readOnly`, and `full`. The CodeBuild service role must have the `s3:putBucketAcl` permission. This permission allows CodeBuild to modify the access control list for the bucket.
+* `encryptionDisabled` - (Optional) Whether to disable encrypting output artifacts. If `type` is set to `noArtifacts`, this value is ignored. Defaults to `false`.
+* `location` - (Optional) Information about the build output artifact location. If `type` is set to `codepipeline` or `noArtifacts`, this value is ignored if specified. If `type` is set to `s3`, this is the name of the output bucket. If `path` is not specified, `location` can specify the path of the output artifact in the output bucket.
+* `name` - (Optional) Name of the project. If `type` is set to `codepipeline` or `noArtifacts`, this value is ignored if specified. If `type` is set to `s3`, this is the name of the output artifact object.
+* `namespaceType` - (Optional) Namespace to use in storing build artifacts. If `type` is set to `codepipeline` or `noArtifacts`, this value is ignored if specified. If `type` is set to `s3`, valid values are `buildId` or `none`.
+* `overrideArtifactName` (Optional) Whether a name specified in the build specification overrides the artifact name.
+* `packaging` - (Optional) Type of build output artifact to create. If `type` is set to `codepipeline` or `noArtifacts`, this value is ignored if specified. If `type` is set to `s3`, valid values are `none` or `zip`.
+* `path` - (Optional) Along with `namespaceType` and `name`, the pattern that AWS CodeBuild uses to name and store the output artifact. If `type` is set to `codepipeline` or `noArtifacts`, this value is ignored if specified. If `type` is set to `s3`, this is the path to the output artifact.
+* `type` - (Required) Build output artifact's type. Valid values `codepipeline`, `noArtifacts`, and `s3`.
+
+### secondary_sources
+
+* `buildspec` - (Optional) The build spec declaration to use for this build project's related builds. This must be set when `type` is `noSource`. It can either be a path to a file residing in the repository to be built or a local file path leveraging the `file()` built-in.
+* `gitCloneDepth` - (Optional) Truncate git history to this many commits. Use `0` for a `full` checkout which you need to run commands like `git branch --show-current`. See [AWS CodePipeline User Guide: Tutorial: Use full clone with a GitHub pipeline source](https://docs.aws.amazon.com/codepipeline/latest/userguide/tutorials-github-gitclone.html) for details.
+* `gitSubmodulesConfig` - (Optional) Configuration block. Detailed below.
+* `insecureSsl` - (Optional) Ignore SSL warnings when connecting to source control.
+* `location` - (Optional) Location of the source code from git or s3.
+* `reportBuildStatus` - (Optional) Whether to report the status of a build's start and finish to your source provider. This option is only valid when your source provider is `github`, `bitbucket`, or `githubEnterprise`.
+* `buildStatusConfig` - (Optional) Configuration block that contains information that defines how the build project reports the build status to the source provider. This option is only used when the source provider is `github`, `githubEnterprise`, or `bitbucket`. `buildStatusConfig` blocks are documented below.
+* `sourceIdentifier` - (Required) An identifier for this project source. The identifier can only contain alphanumeric characters and underscores, and must be less than 128 characters in length.
+* `type` - (Required) Type of repository that contains the source code to be built. Valid values: `codecommit`, `codepipeline`, `github`, `githubEnterprise`, `bitbucket` or `s3`.
+
+#### secondary_sources: git_submodules_config
+
+This block is only valid when the `type` is `codecommit`, `github` or `githubEnterprise`.
+
+* `fetchSubmodules` - (Required) Whether to fetch Git submodules for the AWS CodeBuild build project.
+
+#### secondary_sources: build_status_config
+
+* `context` - (Optional) Specifies the context of the build status CodeBuild sends to the source provider. The usage of this parameter depends on the source provider.
+* `targetUrl` - (Optional) Specifies the target url of the build status CodeBuild sends to the source provider. The usage of this parameter depends on the source provider.
+
+### secondary_source_version
+
+* `sourceIdentifier` - (Required) An identifier for a source in the build project.
+* `sourceVersion` - (Required) The source version for the corresponding source identifier. See [AWS docs](https://docs.aws.amazon.com/codebuild/latest/APIReference/API_ProjectSourceVersion.html#CodeBuild-Type-ProjectSourceVersion-sourceVersion) for more details.
+
+### source
+
+* `buildspec` - (Optional) Build specification to use for this build project's related builds. This must be set when `type` is `noSource`.
+* `gitCloneDepth` - (Optional) Truncate git history to this many commits. Use `0` for a `full` checkout which you need to run commands like `git branch --show-current`. See [AWS CodePipeline User Guide: Tutorial: Use full clone with a GitHub pipeline source](https://docs.aws.amazon.com/codepipeline/latest/userguide/tutorials-github-gitclone.html) for details.
+* `gitSubmodulesConfig` - (Optional) Configuration block. Detailed below.
+* `insecureSsl` - (Optional) Ignore SSL warnings when connecting to source control.
+* `location` - (Optional) Location of the source code from git or s3.
+* `reportBuildStatus` - (Optional) Whether to report the status of a build's start and finish to your source provider. This option is only valid when the `type` is `bitbucket` or `github`.
+* `buildStatusConfig` - (Optional) Configuration block that contains information that defines how the build project reports the build status to the source provider. This option is only used when the source provider is `github`, `githubEnterprise`, or `bitbucket`. `buildStatusConfig` blocks are documented below.
+* `type` - (Required) Type of repository that contains the source code to be built. Valid values: `codecommit`, `codepipeline`, `github`, `githubEnterprise`, `bitbucket`, `s3`, `noSource`.
+
+#### source: git_submodules_config
+
+This block is only valid when the `type` is `codecommit`, `github` or `githubEnterprise`.
+
+* `fetchSubmodules` - (Required) Whether to fetch Git submodules for the AWS CodeBuild build project.
+
+#### source: build_status_config
+
+* `context` - (Optional) Specifies the context of the build status CodeBuild sends to the source provider. The usage of this parameter depends on the source provider.
+* `targetUrl` - (Optional) Specifies the target url of the build status CodeBuild sends to the source provider. The usage of this parameter depends on the source provider.
+
+### vpc_config
+
+* `securityGroupIds` - (Required) Security group IDs to assign to running builds.
+* `subnets` - (Required) Subnet IDs within which to run builds.
+* `vpcId` - (Required) ID of the VPC within which to run builds.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the CodeBuild project.
+* `badgeUrl` - URL of the build badge when `badgeEnabled` is enabled.
+* `id` - Name (if imported via `name`) or ARN (if created via Terraform or imported via ARN) of the CodeBuild project.
+* `publicProjectAlias` - The project identifier used with the public build APIs.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CodeBuild Project using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import CodeBuild Project using the `name`. For example:
+
+```console
+% terraform import aws_codebuild_project.name project-name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1231db4e8811d1c6f118d55d81d8dd0ad67e7fea5670ef0ab686100249f240fc -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/codebuild_report_group.html.markdown b/website/docs/cdktf/typescript/r/codebuild_report_group.html.markdown
new file mode 100644
index 00000000000..83eaf3ed715
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/codebuild_report_group.html.markdown
@@ -0,0 +1,146 @@
+---
+subcategory: "CodeBuild"
+layout: "aws"
+page_title: "AWS: aws_codebuild_report_group"
+description: |-
+  Provides a CodeBuild Report Group resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_codebuild_report_group
+
+Provides a CodeBuild Report Groups Resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CodebuildReportGroup } from "./.gen/providers/aws/codebuild-report-group";
+import { DataAwsCallerIdentity } from "./.gen/providers/aws/data-aws-caller-identity";
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { KmsKey } from "./.gen/providers/aws/kms-key";
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new S3Bucket(this, "example", {
+      bucket: "my-test",
+    });
+    const current = new DataAwsCallerIdentity(this, "current", {});
+    const dataAwsIamPolicyDocumentExample = new DataAwsIamPolicyDocument(
+      this,
+      "example_2",
+      {
+        statement: [
+          {
+            actions: ["kms:*"],
+            effect: "Allow",
+            principals: [
+              {
+                identifiers: ["arn:aws:iam::${" + current.accountId + "}:root"],
+                type: "AWS",
+              },
+            ],
+            resources: ["*"],
+            sid: "Enable IAM User Permissions",
+          },
+        ],
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsIamPolicyDocumentExample.overrideLogicalId("example");
+    const awsKmsKeyExample = new KmsKey(this, "example_3", {
+      deletionWindowInDays: 7,
+      description: "my test kms key",
+      policy: Token.asString(dataAwsIamPolicyDocumentExample.json),
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsKmsKeyExample.overrideLogicalId("example");
+    const awsCodebuildReportGroupExample = new CodebuildReportGroup(
+      this,
+      "example_4",
+      {
+        exportConfig: {
+          s3Destination: {
+            bucket: example.id,
+            encryptionDisabled: false,
+            encryptionKey: Token.asString(awsKmsKeyExample.arn),
+            packaging: "NONE",
+            path: "/some",
+          },
+          type: "S3",
+        },
+        name: "my test report group",
+        type: "TEST",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsCodebuildReportGroupExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of a Report Group.
+* `type` - (Required) The type of the Report Group. Valid value are `test` and `codeCoverage`.
+* `exportConfig` - (Required) Information about the destination where the raw data of this Report Group is exported. see [Export Config](#export-config) documented below.
+* `deleteReports` - (Optional) If `true`, deletes any reports that belong to a report group before deleting the report group. If `false`, you must delete any reports in the report group before deleting it. Default value is `false`.
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Export Config
+
+* `type` - (Required) The export configuration type. Valid values are `s3` and `noExport`.
+* `s3Destination` - (Required) contains information about the S3 bucket where the run of a report is exported. see [S3 Destination](#s3-destination) documented below.
+
+#### S3 Destination
+
+* `bucket`- (Required) The name of the S3 bucket where the raw data of a report are exported.
+* `encryptionKey` - (Required) The encryption key for the report's encrypted raw data. The KMS key ARN.
+* `encryptionDisabled`- (Optional) A boolean value that specifies if the results of a report are encrypted.
+ **Note: the API does not currently allow setting encryption as disabled**
+* `packaging` - (Optional) The type of build output artifact to create. Valid values are: `none` (default) and `zip`.
+* `path` - (Optional) The path to the exported report's raw data results.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ARN of Report Group.
+* `arn` - The ARN of Report Group.
+* `created` - The date and time this Report Group was created.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CodeBuild Report Group using the CodeBuild Report Group arn. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import CodeBuild Report Group using the CodeBuild Report Group arn. For example:
+
+```console
+% terraform import aws_codebuild_report_group.example arn:aws:codebuild:us-west-2:123456789:report-group/report-group-name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-8ad57ea33f51d8c292612a210a7b0152c2dbf1d07a6f6d7699514cc614c46f5d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/codebuild_resource_policy.html.markdown b/website/docs/cdktf/typescript/r/codebuild_resource_policy.html.markdown
new file mode 100644
index 00000000000..50998f53414
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/codebuild_resource_policy.html.markdown
@@ -0,0 +1,119 @@
+---
+subcategory: "CodeBuild"
+layout: "aws"
+page_title: "AWS: aws_codebuild_resource_policy"
+description: |-
+  Provides a CodeBuild Resource Policy resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_codebuild_resource_policy
+
+Provides a CodeBuild Resource Policy Resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CodebuildReportGroup } from "./.gen/providers/aws/codebuild-report-group";
+import { CodebuildResourcePolicy } from "./.gen/providers/aws/codebuild-resource-policy";
+import { DataAwsCallerIdentity } from "./.gen/providers/aws/data-aws-caller-identity";
+import { DataAwsPartition } from "./.gen/providers/aws/data-aws-partition";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new CodebuildReportGroup(this, "example", {
+      exportConfig: {
+        type: "NO_EXPORT",
+      },
+      name: "example",
+      type: "TEST",
+    });
+    const current = new DataAwsCallerIdentity(this, "current", {});
+    const dataAwsPartitionCurrent = new DataAwsPartition(this, "current_2", {});
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsPartitionCurrent.overrideLogicalId("current");
+    const awsCodebuildResourcePolicyExample = new CodebuildResourcePolicy(
+      this,
+      "example_3",
+      {
+        policy: Token.asString(
+          Fn.jsonencode({
+            Id: "default",
+            Statement: [
+              {
+                Action: [
+                  "codebuild:BatchGetReportGroups",
+                  "codebuild:BatchGetReports",
+                  "codebuild:ListReportsForReportGroup",
+                  "codebuild:DescribeTestCases",
+                ],
+                Effect: "Allow",
+                Principal: {
+                  AWS:
+                    "arn:${" +
+                    dataAwsPartitionCurrent.partition +
+                    "}:iam::${" +
+                    current.accountId +
+                    "}:root",
+                },
+                Resource: example.arn,
+                Sid: "default",
+              },
+            ],
+            Version: "2012-10-17",
+          })
+        ),
+        resourceArn: example.arn,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsCodebuildResourcePolicyExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `resourceArn` - (Required) The ARN of the Project or ReportGroup resource you want to associate with a resource policy.
+* `policy` - (Required) A JSON-formatted resource policy. For more information, see [Sharing a Projec](https://docs.aws.amazon.com/codebuild/latest/userguide/project-sharing.html#project-sharing-share) and [Sharing a Report Group](https://docs.aws.amazon.com/codebuild/latest/userguide/report-groups-sharing.html#report-groups-sharing-share).
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ARN of Resource.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CodeBuild Resource Policy using the CodeBuild Resource Policy arn. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import CodeBuild Resource Policy using the CodeBuild Resource Policy arn. For example:
+
+```console
+% terraform import aws_codebuild_resource_policy.example arn:aws:codebuild:us-west-2:123456789:report-group/report-group-name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-f23442c58293672c191dd97a4494665d2aef6eee691d16bd2960548ec6b274dd -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/codebuild_source_credential.html.markdown b/website/docs/cdktf/typescript/r/codebuild_source_credential.html.markdown
new file mode 100644
index 00000000000..08bd91c8bac
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/codebuild_source_credential.html.markdown
@@ -0,0 +1,105 @@
+---
+subcategory: "CodeBuild"
+layout: "aws"
+page_title: "AWS: aws_codebuild_source_credential"
+description: |-
+  Provides a CodeBuild Source Credential resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_codebuild_source_credential
+
+Provides a CodeBuild Source Credentials Resource.
+
+~> **NOTE:**
+[Codebuild only allows a single credential per given server type in a given region](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_codebuild.GitHubSourceCredentials.html). Therefore, when you define `awsCodebuildSourceCredential`, [`awsCodebuildProject` resource](/docs/providers/aws/r/codebuild_project.html) defined in the same module will use it.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CodebuildSourceCredential } from "./.gen/providers/aws/codebuild-source-credential";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new CodebuildSourceCredential(this, "example", {
+      authType: "PERSONAL_ACCESS_TOKEN",
+      serverType: "GITHUB",
+      token: "example",
+    });
+  }
+}
+
+```
+
+### Bitbucket Server Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CodebuildSourceCredential } from "./.gen/providers/aws/codebuild-source-credential";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new CodebuildSourceCredential(this, "example", {
+      authType: "BASIC_AUTH",
+      serverType: "BITBUCKET",
+      token: "example",
+      userName: "test-user",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `authType` - (Required) The type of authentication used to connect to a GitHub, GitHub Enterprise, or Bitbucket repository. An OAUTH connection is not supported by the API.
+* `serverType` - (Required) The source provider used for this project.
+* `token` - (Required) For `gitHub` or `GitHub Enterprise`, this is the personal access token. For `bitbucket`, this is the app password.
+* `userName` - (Optional) The Bitbucket username when the authType is `basicAuth`. This parameter is not valid for other types of source providers or connections.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ARN of Source Credential.
+* `arn` - The ARN of Source Credential.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CodeBuild Source Credential using the CodeBuild Source Credential arn. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import CodeBuild Source Credential using the CodeBuild Source Credential arn. For example:
+
+```console
+% terraform import aws_codebuild_source_credential.example arn:aws:codebuild:us-west-2:123456789:token:github
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1d3035420b7bbe8f89436bdbdcd040691cc3649bd4b17947a90be506a262d9cb -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/codebuild_webhook.html.markdown b/website/docs/cdktf/typescript/r/codebuild_webhook.html.markdown
new file mode 100644
index 00000000000..00044c138ee
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/codebuild_webhook.html.markdown
@@ -0,0 +1,161 @@
+---
+subcategory: "CodeBuild"
+layout: "aws"
+page_title: "AWS: aws_codebuild_webhook"
+description: |-
+  Provides a CodeBuild Webhook resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_codebuild_webhook
+
+Manages a CodeBuild webhook, which is an endpoint accepted by the CodeBuild service to trigger builds from source code repositories. Depending on the source type of the CodeBuild project, the CodeBuild service may also automatically create and delete the actual repository webhook as well.
+
+## Example Usage
+
+### Bitbucket and GitHub
+
+When working with [Bitbucket](https://bitbucket.org) and [GitHub](https://github.com) source CodeBuild webhooks, the CodeBuild service will automatically create (on `awsCodebuildWebhook` resource creation) and delete (on `awsCodebuildWebhook` resource deletion) the Bitbucket/GitHub repository webhook using its granted OAuth permissions. This behavior cannot be controlled by Terraform.
+
+~> **Note:** The AWS account that Terraform uses to create this resource *must* have authorized CodeBuild to access Bitbucket/GitHub's OAuth API in each applicable region. This is a manual step that must be done *before* creating webhooks with this resource. If OAuth is not configured, AWS will return an error similar to `ResourceNotFoundException: Could not find access token for server type github`. More information can be found in the CodeBuild User Guide for [Bitbucket](https://docs.aws.amazon.com/codebuild/latest/userguide/sample-bitbucket-pull-request.html) and [GitHub](https://docs.aws.amazon.com/codebuild/latest/userguide/sample-github-pull-request.html).
+
+~> **Note:** Further managing the automatically created Bitbucket/GitHub webhook with the `bitbucketHook`/`githubRepositoryWebhook` resource is only possible with importing that resource after creation of the `awsCodebuildWebhook` resource. The CodeBuild API does not ever provide the `secret` attribute for the `awsCodebuildWebhook` resource in this scenario.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CodebuildWebhook } from "./.gen/providers/aws/codebuild-webhook";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new CodebuildWebhook(this, "example", {
+      buildType: "BUILD",
+      filterGroup: [
+        {
+          filter: [
+            {
+              pattern: "PUSH",
+              type: "EVENT",
+            },
+            {
+              pattern: "master",
+              type: "BASE_REF",
+            },
+          ],
+        },
+      ],
+      projectName: Token.asString(awsCodebuildProjectExample.name),
+    });
+  }
+}
+
+```
+
+### GitHub Enterprise
+
+When working with [GitHub Enterprise](https://enterprise.github.com/) source CodeBuild webhooks, the GHE repository webhook must be separately managed (e.g., manually or with the `githubRepositoryWebhook` resource).
+
+More information creating webhooks with GitHub Enterprise can be found in the [CodeBuild User Guide](https://docs.aws.amazon.com/codebuild/latest/userguide/sample-github-enterprise.html).
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CodebuildWebhook } from "./.gen/providers/aws/codebuild-webhook";
+import { RepositoryWebhook } from "./.gen/providers/github/repository-webhook";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    /*The following providers are missing schema information and might need manual adjustments to synthesize correctly: github.
+    For a more precise conversion please use the --provider flag in convert.*/
+    const example = new CodebuildWebhook(this, "example", {
+      projectName: Token.asString(awsCodebuildProjectExample.name),
+    });
+    const githubRepositoryWebhookExample = new RepositoryWebhook(
+      this,
+      "example_1",
+      {
+        active: true,
+        configuration: [
+          {
+            content_type: "json",
+            insecure_ssl: false,
+            secret: example.secret,
+            url: example.payloadUrl,
+          },
+        ],
+        events: ["push"],
+        name: "example",
+        repository: githubRepositoryExample.name,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    githubRepositoryWebhookExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `projectName` - (Required) The name of the build project.
+* `buildType` - (Optional) The type of build this webhook will trigger. Valid values for this parameter are: `build`, `buildBatch`.
+* `branchFilter` - (Optional) A regular expression used to determine which branches get built. Default is all branches are built. We recommend using `filterGroup` over `branchFilter`.
+* `filterGroup` - (Optional) Information about the webhook's trigger. Filter group blocks are documented below.
+
+`filterGroup` supports the following:
+
+* `filter` - (Required) A webhook filter for the group. Filter blocks are documented below.
+
+`filter` supports the following:
+
+* `type` - (Required) The webhook filter group's type. Valid values for this parameter are: `event`, `baseRef`, `headRef`, `actorAccountId`, `filePath`, `commitMessage`. At least one filter group must specify `event` as its type.
+* `pattern` - (Required) For a filter that uses `event` type, a comma-separated string that specifies one event: `push`, `pullRequestCreated`, `pullRequestUpdated`, `pullRequestReopened`. `pullRequestMerged` works with GitHub & GitHub Enterprise only. For a filter that uses any of the other filter types, a regular expression.
+* `excludeMatchedPattern` - (Optional) If set to `true`, the specified filter does *not* trigger a build. Defaults to `false`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name of the build project.
+* `payloadUrl` - The CodeBuild endpoint where webhook events are sent.
+* `secret` - The secret token of the associated repository. Not returned by the CodeBuild API for all source types.
+* `url` - The URL to the webhook.
+
+~> **Note:** The `secret` attribute is only set on resource creation, so if the secret is manually rotated, terraform will not pick up the change on subsequent runs.  In that case, the webhook resource should be tainted and re-created to get the secret back in sync.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CodeBuild Webhooks using the CodeBuild Project name. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import CodeBuild Webhooks using the CodeBuild Project name. For example:
+
+```console
+% terraform import aws_codebuild_webhook.example MyProjectName
+```
+
+<!-- cache-key: cdktf-0.18.0 input-cf2c7457e01d223f33713530c0bde71a1f3d519e66df2997191b2c29539aab1a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/codecatalyst_dev_environment.html.markdown b/website/docs/cdktf/typescript/r/codecatalyst_dev_environment.html.markdown
new file mode 100644
index 00000000000..f4febc289d3
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/codecatalyst_dev_environment.html.markdown
@@ -0,0 +1,96 @@
+---
+subcategory: "CodeCatalyst"
+layout: "aws"
+page_title: "AWS: aws_codecatalyst_dev_environment"
+description: |-
+  Terraform resource for managing an AWS CodeCatalyst Devenvironment.
+---
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_codecatalyst_dev_environment
+
+Terraform resource for managing an AWS CodeCatalyst Dev Environment.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CodecatalystDevEnvironment } from "./.gen/providers/aws/codecatalyst-dev-environment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new CodecatalystDevEnvironment(this, "test", {
+      alias: "devenv",
+      ides: {
+        name: "PyCharm",
+        runtime: "public.ecr.aws/jetbrains/py",
+      },
+      inactivityTimeoutMinutes: 40,
+      instanceType: "dev.standard1.small",
+      persistentStorage: {
+        size: 16,
+      },
+      projectName: "myproject",
+      repositories: [
+        {
+          branchName: "main",
+          repositoryName: "terraform-provider-aws",
+        },
+      ],
+      spaceName: "myspace",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `spaceName` - (Required) The name of the space.
+* `projectName` - (Required) The name of the project in the space.
+* `persistentStorage` - (Required) Information about the amount of storage allocated to the Dev Environment.
+* `ides` - (Required) Information about the integrated development environment (IDE) configured for a Dev Environment.
+* `instanceType` - (Required) The Amazon EC2 instace type to use for the Dev Environment. Valid values include dev.standard1.small,dev.standard1.medium,dev.standard1.large,dev.standard1.xlarge
+
+The following arguments are optional:
+
+* `inactivityTimeoutMinutes` - (Optional) The amount of time the Dev Environment will run without any activity detected before stopping, in minutes. Only whole integers are allowed. Dev Environments consume compute minutes when running.
+* `repositories` - (Optional) The source repository that contains the branch to clone into the Dev Environment.
+
+ides (`ides`) supports the following:
+
+* `name` - (Required) The name of the IDE. Valid values include Cloud9, IntelliJ, PyCharm, GoLand, and VSCode.
+* `runtime` - (Required) A link to the IDE runtime image. This parameter is not required if the name is VSCode. Values of the runtime can be for example public.ecr.aws/jetbrains/py,public.ecr.aws/jetbrains/go
+
+repositories (`repositories`) supports the following:
+
+* `repositoryName` - (Required) The name of the source repository.
+* `branchName` - (Optional) The name of the branch in a source repository.
+
+persistent storage (` persistent_storage`) supports the following:
+
+* `size` - (Required) The size of the persistent storage in gigabytes (specifically GiB). Valid values for storage are based on memory sizes in 16GB increments. Valid values are 16, 32, and 64.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Unique identifier for the Dev Environment
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `30M`)
+- `update` - (Default `10M`)
+- `delete` - (Default `10M`)
+
+<!-- cache-key: cdktf-0.18.0 input-83072c31095d92a81b54f714ca680dc32ebce04ee3482f885395e5500cfeace5 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/codecatalyst_project.html.markdown b/website/docs/cdktf/typescript/r/codecatalyst_project.html.markdown
new file mode 100644
index 00000000000..a4725c563e0
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/codecatalyst_project.html.markdown
@@ -0,0 +1,88 @@
+---
+subcategory: "CodeCatalyst"
+layout: "aws"
+page_title: "AWS: aws_codecatalyst_project"
+description: |-
+  Terraform resource for managing an AWS CodeCatalyst Project.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_codecatalyst_project
+
+Terraform resource for managing an AWS CodeCatalyst Project.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CodecatalystProject } from "./.gen/providers/aws/codecatalyst-project";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new CodecatalystProject(this, "test", {
+      description: "My CodeCatalyst Project created using Terraform",
+      displayName: "MyProject",
+      spaceName: "myproject",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `spaceName` - (Required) The name of the space.
+* `displayName` - (Required) The friendly name of the project that will be displayed to users.
+
+The following arguments are optional:
+
+* `description` - (Optional) The description of the project. This description will be displayed to all users of the project. We recommend providing a brief description of the project and its intended purpose.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `name` - The name of the project in the space.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `60M`)
+* `update` - (Default `180M`)
+* `delete` - (Default `90M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CodeCatalyst Project using the `exampleIdArg`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import CodeCatalyst Project using the `exampleIdArg`. For example:
+
+```console
+% terraform import aws_codecatalyst_project.example project-id-12345678
+```
+
+<!-- cache-key: cdktf-0.18.0 input-458059ba4aa1ab978fd9d595f17ad727e6f517ced23cac7527a27f8c131037e1 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/codecatalyst_source_repository.html.markdown b/website/docs/cdktf/typescript/r/codecatalyst_source_repository.html.markdown
new file mode 100644
index 00000000000..5bc62632fce
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/codecatalyst_source_repository.html.markdown
@@ -0,0 +1,87 @@
+---
+subcategory: "CodeCatalyst"
+layout: "aws"
+page_title: "AWS: aws_codecatalyst_source_repository"
+description: |-
+  Terraform resource for managing an AWS CodeCatalyst Source Repository.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_codecatalyst_source_repository
+
+Terraform resource for managing an AWS CodeCatalyst Source Repository.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CodecatalystSourceRepository } from "./.gen/providers/aws/codecatalyst-source-repository";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new CodecatalystSourceRepository(this, "example", {
+      name: "example-repo",
+      projectName: "example-project",
+      spaceName: "example-space",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) The name of the source repository. For more information about name requirements, see [Quotas for source repositories](https://docs.aws.amazon.com/codecatalyst/latest/userguide/source-quotas.html).
+* `spaceName` - (Required) The name of the CodeCatalyst space.
+* `projectName` - (Required) The name of the project in the CodeCatalyst space.
+
+The following arguments are optional:
+
+* `description` - (Optional) The description of the project. This description will be displayed to all users of the project. We recommend providing a brief description of the project and its intended purpose.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `60M`)
+* `update` - (Default `180M`)
+* `delete` - (Default `90M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CodeCatalyst Source Repository using the `exampleIdArg`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import CodeCatalyst Source Repository using the `exampleIdArg`. For example:
+
+```console
+% terraform import aws_codecatalyst_source_repository.example source_repository-id-12345678
+```
+
+<!-- cache-key: cdktf-0.18.0 input-03b428f1b5cc0fdf28b4d5ea9381e651fe9e72981c5ada420c0f7134b76c3774 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/codecommit_approval_rule_template.html.markdown b/website/docs/cdktf/typescript/r/codecommit_approval_rule_template.html.markdown
new file mode 100644
index 00000000000..0e733d337da
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/codecommit_approval_rule_template.html.markdown
@@ -0,0 +1,93 @@
+---
+subcategory: "CodeCommit"
+layout: "aws"
+page_title: "AWS: aws_codecommit_approval_rule_template"
+description: |-
+  Provides a CodeCommit Approval Rule Template Resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_codecommit_approval_rule_template
+
+Provides a CodeCommit Approval Rule Template Resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CodecommitApprovalRuleTemplate } from "./.gen/providers/aws/codecommit-approval-rule-template";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new CodecommitApprovalRuleTemplate(this, "example", {
+      content: Token.asString(
+        Fn.jsonencode({
+          DestinationReferences: ["refs/heads/master"],
+          Statements: [
+            {
+              ApprovalPoolMembers: [
+                "arn:aws:sts::123456789012:assumed-role/CodeCommitReview/*",
+              ],
+              NumberOfApprovalsNeeded: 2,
+              Type: "Approvers",
+            },
+          ],
+          Version: "2018-11-08",
+        })
+      ),
+      description: "This is an example approval rule template",
+      name: "MyExampleApprovalRuleTemplate",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `content` - (Required) The content of the approval rule template. Maximum of 3000 characters.
+* `name` - (Required) The name for the approval rule template. Maximum of 100 characters.
+* `description` - (Optional) The description of the approval rule template. Maximum of 1000 characters.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `approvalRuleTemplateId` - The ID of the approval rule template
+* `creationDate` - The date the approval rule template was created, in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8).
+* `lastModifiedDate` - The date the approval rule template was most recently changed, in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8).
+* `lastModifiedUser` - The Amazon Resource Name (ARN) of the user who made the most recent changes to the approval rule template.
+* `ruleContentSha256` - The SHA-256 hash signature for the content of the approval rule template.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CodeCommit approval rule templates using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import CodeCommit approval rule templates using the `name`. For example:
+
+```console
+% terraform import aws_codecommit_approval_rule_template.imported ExistingApprovalRuleTemplateName
+```
+
+<!-- cache-key: cdktf-0.18.0 input-7214ebc6881ab8b5f086e92ff1f7e4c9d9a74e5ba4ce12face913b9951a3a79e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/codecommit_approval_rule_template_association.html.markdown b/website/docs/cdktf/typescript/r/codecommit_approval_rule_template_association.html.markdown
new file mode 100644
index 00000000000..c69f2296090
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/codecommit_approval_rule_template_association.html.markdown
@@ -0,0 +1,77 @@
+---
+subcategory: "CodeCommit"
+layout: "aws"
+page_title: "AWS: aws_codecommit_approval_rule_template_association"
+description: |-
+  Associates a CodeCommit Approval Rule Template with a Repository.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_codecommit_approval_rule_template_association
+
+Associates a CodeCommit Approval Rule Template with a Repository.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CodecommitApprovalRuleTemplateAssociation } from "./.gen/providers/aws/codecommit-approval-rule-template-association";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new CodecommitApprovalRuleTemplateAssociation(this, "example", {
+      approvalRuleTemplateName: Token.asString(
+        awsCodecommitApprovalRuleTemplateExample.name
+      ),
+      repositoryName: Token.asString(
+        awsCodecommitRepositoryExample.repositoryName
+      ),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `approvalRuleTemplateName` - (Required) The name for the approval rule template.
+* `repositoryName` - (Required) The name of the repository that you want to associate with the template.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name of the approval rule template and name of the repository, separated by a comma (`,`).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CodeCommit approval rule template associations using the `approvalRuleTemplateName` and `repositoryName` separated by a comma (`,`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import CodeCommit approval rule template associations using the `approvalRuleTemplateName` and `repositoryName` separated by a comma (`,`). For example:
+
+```console
+% terraform import aws_codecommit_approval_rule_template_association.example approver-rule-for-example,MyExampleRepo
+```
+
+<!-- cache-key: cdktf-0.18.0 input-800a49692194ca7d70016b5efe848036ee2107aa5291a82d90a63cd527264967 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/codecommit_repository.html.markdown b/website/docs/cdktf/typescript/r/codecommit_repository.html.markdown
new file mode 100644
index 00000000000..ef50d21c5d5
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/codecommit_repository.html.markdown
@@ -0,0 +1,79 @@
+---
+subcategory: "CodeCommit"
+layout: "aws"
+page_title: "AWS: aws_codecommit_repository"
+description: |-
+  Provides a CodeCommit Repository Resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_codecommit_repository
+
+Provides a CodeCommit Repository Resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CodecommitRepository } from "./.gen/providers/aws/codecommit-repository";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new CodecommitRepository(this, "test", {
+      description: "This is the Sample App Repository",
+      repositoryName: "MyTestRepository",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `repositoryName` - (Required) The name for the repository. This needs to be less than 100 characters.
+* `description` - (Optional) The description of the repository. This needs to be less than 1000 characters
+* `defaultBranch` - (Optional) The default branch of the repository. The branch specified here needs to exist.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `repositoryId` - The ID of the repository
+* `arn` - The ARN of the repository
+* `cloneUrlHttp` - The URL to use for cloning the repository over HTTPS.
+* `cloneUrlSsh` - The URL to use for cloning the repository over SSH.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CodeCommit repository using repository name. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import CodeCommit repository using repository name. For example:
+
+```console
+% terraform import aws_codecommit_repository.imported ExistingRepo
+```
+
+<!-- cache-key: cdktf-0.18.0 input-50d294f897d743c5c8bc69d3979c0e0ea1f7abc83eb38554128f2468842056ab -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/codecommit_trigger.html.markdown b/website/docs/cdktf/typescript/r/codecommit_trigger.html.markdown
new file mode 100644
index 00000000000..b06ca8c1727
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/codecommit_trigger.html.markdown
@@ -0,0 +1,69 @@
+---
+subcategory: "CodeCommit"
+layout: "aws"
+page_title: "AWS: aws_codecommit_trigger"
+description: |-
+  Provides a CodeCommit Trigger Resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_codecommit_trigger
+
+Provides a CodeCommit Trigger Resource.
+
+~> **NOTE:** Terraform currently can create only one trigger per repository, even if multiple aws_codecommit_trigger resources are defined. Moreover, creating triggers with Terraform will delete all other triggers in the repository (also manually-created triggers).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CodecommitRepository } from "./.gen/providers/aws/codecommit-repository";
+import { CodecommitTrigger } from "./.gen/providers/aws/codecommit-trigger";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const test = new CodecommitRepository(this, "test", {
+      repositoryName: "test",
+    });
+    const awsCodecommitTriggerTest = new CodecommitTrigger(this, "test_1", {
+      repositoryName: test.repositoryName,
+      trigger: [
+        {
+          destinationArn: Token.asString(awsSnsTopicTest.arn),
+          events: ["all"],
+          name: "all",
+        },
+      ],
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsCodecommitTriggerTest.overrideLogicalId("test");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `repositoryName` - (Required) The name for the repository. This needs to be less than 100 characters.
+* `name` - (Required) The name of the trigger.
+* `destinationArn` - (Required) The ARN of the resource that is the target for a trigger. For example, the ARN of a topic in Amazon Simple Notification Service (SNS).
+* `customData` - (Optional) Any custom data associated with the trigger that will be included in the information sent to the target of the trigger.
+* `branches` - (Optional) The branches that will be included in the trigger configuration. If no branches are specified, the trigger will apply to all branches.
+* `events` - (Required) The repository events that will cause the trigger to run actions in another service, such as sending a notification through Amazon Simple Notification Service (SNS). If no events are specified, the trigger will run for all repository events. Event types include: `all`, `updateReference`, `createReference`, `deleteReference`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `configurationId` - System-generated unique identifier.
+
+<!-- cache-key: cdktf-0.18.0 input-6fc445fde615a4a95723b535dcf09b6e0655d8096cedb2b5da2231587aee3f88 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/codedeploy_app.html.markdown b/website/docs/cdktf/typescript/r/codedeploy_app.html.markdown
new file mode 100644
index 00000000000..32ea33fc29a
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/codedeploy_app.html.markdown
@@ -0,0 +1,128 @@
+---
+subcategory: "CodeDeploy"
+layout: "aws"
+page_title: "AWS: aws_codedeploy_app"
+description: |-
+  Provides a CodeDeploy application.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_codedeploy_app
+
+Provides a CodeDeploy application to be used as a basis for deployments
+
+## Example Usage
+
+### ECS Application
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CodedeployApp } from "./.gen/providers/aws/codedeploy-app";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new CodedeployApp(this, "example", {
+      computePlatform: "ECS",
+      name: "example",
+    });
+  }
+}
+
+```
+
+### Lambda Application
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CodedeployApp } from "./.gen/providers/aws/codedeploy-app";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new CodedeployApp(this, "example", {
+      computePlatform: "Lambda",
+      name: "example",
+    });
+  }
+}
+
+```
+
+### Server Application
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CodedeployApp } from "./.gen/providers/aws/codedeploy-app";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new CodedeployApp(this, "example", {
+      computePlatform: "Server",
+      name: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the application.
+* `computePlatform` - (Optional) The compute platform can either be `ecs`, `lambda`, or `server`. Default is `server`.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the CodeDeploy application.
+* `applicationId` - The application ID.
+* `id` - Amazon's assigned ID for the application.
+* `name` - The application's name.
+* `githubAccountName` - The name for a connection to a GitHub account.
+* `linkedToGithub` - Whether the user has authenticated with GitHub for the specified application.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CodeDeploy Applications using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import CodeDeploy Applications using the `name`. For example:
+
+```console
+% terraform import aws_codedeploy_app.example my-application
+```
+
+<!-- cache-key: cdktf-0.18.0 input-00b9fbbd35972d7215984367937bb47e7c6439d5c41831dac0b563a419c59962 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/codedeploy_deployment_config.html.markdown b/website/docs/cdktf/typescript/r/codedeploy_deployment_config.html.markdown
new file mode 100644
index 00000000000..81f166a3162
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/codedeploy_deployment_config.html.markdown
@@ -0,0 +1,191 @@
+---
+subcategory: "CodeDeploy"
+layout: "aws"
+page_title: "AWS: aws_codedeploy_deployment_config"
+description: |-
+  Provides a CodeDeploy deployment config.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_codedeploy_deployment_config
+
+Provides a CodeDeploy deployment config for an application
+
+## Example Usage
+
+### Server Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CodedeployDeploymentConfig } from "./.gen/providers/aws/codedeploy-deployment-config";
+import { CodedeployDeploymentGroup } from "./.gen/providers/aws/codedeploy-deployment-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const foo = new CodedeployDeploymentConfig(this, "foo", {
+      deploymentConfigName: "test-deployment-config",
+      minimumHealthyHosts: {
+        type: "HOST_COUNT",
+        value: 2,
+      },
+    });
+    const awsCodedeployDeploymentGroupFoo = new CodedeployDeploymentGroup(
+      this,
+      "foo_1",
+      {
+        alarmConfiguration: {
+          alarms: ["my-alarm-name"],
+          enabled: true,
+        },
+        appName: fooApp.name,
+        autoRollbackConfiguration: {
+          enabled: true,
+          events: ["DEPLOYMENT_FAILURE"],
+        },
+        deploymentConfigName: foo.id,
+        deploymentGroupName: "bar",
+        ec2TagFilter: [
+          {
+            key: "filterkey",
+            type: "KEY_AND_VALUE",
+            value: "filtervalue",
+          },
+        ],
+        serviceRoleArn: fooRole.arn,
+        triggerConfiguration: [
+          {
+            triggerEvents: ["DeploymentFailure"],
+            triggerName: "foo-trigger",
+            triggerTargetArn: "foo-topic-arn",
+          },
+        ],
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsCodedeployDeploymentGroupFoo.overrideLogicalId("foo");
+  }
+}
+
+```
+
+### Lambda Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CodedeployDeploymentConfig } from "./.gen/providers/aws/codedeploy-deployment-config";
+import { CodedeployDeploymentGroup } from "./.gen/providers/aws/codedeploy-deployment-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const foo = new CodedeployDeploymentConfig(this, "foo", {
+      computePlatform: "Lambda",
+      deploymentConfigName: "test-deployment-config",
+      trafficRoutingConfig: {
+        timeBasedLinear: {
+          interval: 10,
+          percentage: 10,
+        },
+        type: "TimeBasedLinear",
+      },
+    });
+    const awsCodedeployDeploymentGroupFoo = new CodedeployDeploymentGroup(
+      this,
+      "foo_1",
+      {
+        alarmConfiguration: {
+          alarms: ["my-alarm-name"],
+          enabled: true,
+        },
+        appName: fooApp.name,
+        autoRollbackConfiguration: {
+          enabled: true,
+          events: ["DEPLOYMENT_STOP_ON_ALARM"],
+        },
+        deploymentConfigName: foo.id,
+        deploymentGroupName: "bar",
+        serviceRoleArn: fooRole.arn,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsCodedeployDeploymentGroupFoo.overrideLogicalId("foo");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `deploymentConfigName` - (Required) The name of the deployment config.
+* `computePlatform` - (Optional) The compute platform can be `server`, `lambda`, or `ecs`. Default is `server`.
+* `minimumHealthyHosts` - (Optional) A minimum_healthy_hosts block. Required for `server` compute platform. Minimum Healthy Hosts are documented below.
+* `trafficRoutingConfig` - (Optional) A traffic_routing_config block. Traffic Routing Config is documented below.
+
+The `minimumHealthyHosts` block supports the following:
+
+* `type` - (Required) The type can either be `fleetPercent` or `hostCount`.
+* `value` - (Required) The value when the type is `fleetPercent` represents the minimum number of healthy instances as
+a percentage of the total number of instances in the deployment. If you specify FLEET_PERCENT, at the start of the
+deployment, AWS CodeDeploy converts the percentage to the equivalent number of instance and rounds up fractional instances.
+When the type is `hostCount`, the value represents the minimum number of healthy instances as an absolute value.
+
+The `trafficRoutingConfig` block supports the following:
+
+* `type` - (Optional) Type of traffic routing config. One of `timeBasedCanary`, `timeBasedLinear`, `allAtOnce`.
+* `timeBasedCanary` - (Optional) The time based canary configuration information. If `type` is `timeBasedLinear`, use `timeBasedLinear` instead.
+* `timeBasedLinear` - (Optional) The time based linear configuration information. If `type` is `timeBasedCanary`, use `timeBasedCanary` instead.
+
+The `timeBasedCanary` block supports the following:
+
+* `interval` - (Optional) The number of minutes between the first and second traffic shifts of a `timeBasedCanary` deployment.
+* `percentage` - (Optional) The percentage of traffic to shift in the first increment of a `timeBasedCanary` deployment.
+
+The `timeBasedLinear` block supports the following:
+
+* `interval` - (Optional) The number of minutes between each incremental traffic shift of a `timeBasedLinear` deployment.
+* `percentage` - (Optional) The percentage of traffic that is shifted at the start of each increment of a `timeBasedLinear` deployment.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The deployment group's config name.
+* `deploymentConfigId` - The AWS Assigned deployment config id
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CodeDeploy Deployment Configurations using the `deploymentConfigName`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import CodeDeploy Deployment Configurations using the `deploymentConfigName`. For example:
+
+```console
+% terraform import aws_codedeploy_deployment_config.example my-deployment-config
+```
+
+<!-- cache-key: cdktf-0.18.0 input-2cc160bcb5a9c6c91fd5d75e63168fd2d320f48dbdb419ab8d514075206a12e7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/codedeploy_deployment_group.html.markdown b/website/docs/cdktf/typescript/r/codedeploy_deployment_group.html.markdown
new file mode 100644
index 00000000000..3ce016750ba
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/codedeploy_deployment_group.html.markdown
@@ -0,0 +1,444 @@
+---
+subcategory: "CodeDeploy"
+layout: "aws"
+page_title: "AWS: aws_codedeploy_deployment_group"
+description: |-
+  Provides a CodeDeploy deployment group.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_codedeploy_deployment_group
+
+Provides a CodeDeploy Deployment Group for a CodeDeploy Application
+
+~> **NOTE on blue/green deployments:** When using `greenFleetProvisioningOption` with the `copyAutoScalingGroup` action, CodeDeploy will create a new ASG with a different name. This ASG is _not_ managed by terraform and will conflict with existing configuration and state. You may want to use a different approach to managing deployments that involve multiple ASG, such as `discoverExisting` with separate blue and green ASG.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CodedeployApp } from "./.gen/providers/aws/codedeploy-app";
+import { CodedeployDeploymentGroup } from "./.gen/providers/aws/codedeploy-deployment-group";
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+import { IamRolePolicyAttachment } from "./.gen/providers/aws/iam-role-policy-attachment";
+import { SnsTopic } from "./.gen/providers/aws/sns-topic";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new CodedeployApp(this, "example", {
+      name: "example-app",
+    });
+    const awsSnsTopicExample = new SnsTopic(this, "example_1", {
+      name: "example-topic",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSnsTopicExample.overrideLogicalId("example");
+    const assumeRole = new DataAwsIamPolicyDocument(this, "assume_role", {
+      statement: [
+        {
+          actions: ["sts:AssumeRole"],
+          effect: "Allow",
+          principals: [
+            {
+              identifiers: ["codedeploy.amazonaws.com"],
+              type: "Service",
+            },
+          ],
+        },
+      ],
+    });
+    const awsIamRoleExample = new IamRole(this, "example_3", {
+      assumeRolePolicy: Token.asString(assumeRole.json),
+      name: "example-role",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamRoleExample.overrideLogicalId("example");
+    new IamRolePolicyAttachment(this, "AWSCodeDeployRole", {
+      policyArn: "arn:aws:iam::aws:policy/service-role/AWSCodeDeployRole",
+      role: Token.asString(awsIamRoleExample.name),
+    });
+    const awsCodedeployDeploymentGroupExample = new CodedeployDeploymentGroup(
+      this,
+      "example_5",
+      {
+        alarmConfiguration: {
+          alarms: ["my-alarm-name"],
+          enabled: true,
+        },
+        appName: example.name,
+        autoRollbackConfiguration: {
+          enabled: true,
+          events: ["DEPLOYMENT_FAILURE"],
+        },
+        deploymentGroupName: "example-group",
+        ec2TagSet: [
+          {
+            ec2TagFilter: [
+              {
+                key: "filterkey1",
+                type: "KEY_AND_VALUE",
+                value: "filtervalue",
+              },
+              {
+                key: "filterkey2",
+                type: "KEY_AND_VALUE",
+                value: "filtervalue",
+              },
+            ],
+          },
+        ],
+        outdatedInstancesStrategy: "UPDATE",
+        serviceRoleArn: Token.asString(awsIamRoleExample.arn),
+        triggerConfiguration: [
+          {
+            triggerEvents: ["DeploymentFailure"],
+            triggerName: "example-trigger",
+            triggerTargetArn: Token.asString(awsSnsTopicExample.arn),
+          },
+        ],
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsCodedeployDeploymentGroupExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### Blue Green Deployments with ECS
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CodedeployApp } from "./.gen/providers/aws/codedeploy-app";
+import { CodedeployDeploymentGroup } from "./.gen/providers/aws/codedeploy-deployment-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new CodedeployApp(this, "example", {
+      computePlatform: "ECS",
+      name: "example",
+    });
+    const awsCodedeployDeploymentGroupExample = new CodedeployDeploymentGroup(
+      this,
+      "example_1",
+      {
+        appName: example.name,
+        autoRollbackConfiguration: {
+          enabled: true,
+          events: ["DEPLOYMENT_FAILURE"],
+        },
+        blueGreenDeploymentConfig: {
+          deploymentReadyOption: {
+            actionOnTimeout: "CONTINUE_DEPLOYMENT",
+          },
+          terminateBlueInstancesOnDeploymentSuccess: {
+            action: "TERMINATE",
+            terminationWaitTimeInMinutes: 5,
+          },
+        },
+        deploymentConfigName: "CodeDeployDefault.ECSAllAtOnce",
+        deploymentGroupName: "example",
+        deploymentStyle: {
+          deploymentOption: "WITH_TRAFFIC_CONTROL",
+          deploymentType: "BLUE_GREEN",
+        },
+        ecsService: {
+          clusterName: Token.asString(awsEcsClusterExample.name),
+          serviceName: Token.asString(awsEcsServiceExample.name),
+        },
+        loadBalancerInfo: {
+          targetGroupPairInfo: {
+            prodTrafficRoute: {
+              listenerArns: [Token.asString(awsLbListenerExample.arn)],
+            },
+            targetGroup: [
+              {
+                name: blue.name,
+              },
+              {
+                name: green.name,
+              },
+            ],
+          },
+        },
+        serviceRoleArn: Token.asString(awsIamRoleExample.arn),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsCodedeployDeploymentGroupExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### Blue Green Deployments with Servers and Classic ELB
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CodedeployApp } from "./.gen/providers/aws/codedeploy-app";
+import { CodedeployDeploymentGroup } from "./.gen/providers/aws/codedeploy-deployment-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new CodedeployApp(this, "example", {
+      name: "example-app",
+    });
+    const awsCodedeployDeploymentGroupExample = new CodedeployDeploymentGroup(
+      this,
+      "example_1",
+      {
+        appName: example.name,
+        blueGreenDeploymentConfig: {
+          deploymentReadyOption: {
+            actionOnTimeout: "STOP_DEPLOYMENT",
+            waitTimeInMinutes: 60,
+          },
+          greenFleetProvisioningOption: {
+            action: "DISCOVER_EXISTING",
+          },
+          terminateBlueInstancesOnDeploymentSuccess: {
+            action: "KEEP_ALIVE",
+          },
+        },
+        deploymentGroupName: "example-group",
+        deploymentStyle: {
+          deploymentOption: "WITH_TRAFFIC_CONTROL",
+          deploymentType: "BLUE_GREEN",
+        },
+        loadBalancerInfo: {
+          elbInfo: [
+            {
+              name: Token.asString(awsElbExample.name),
+            },
+          ],
+        },
+        serviceRoleArn: Token.asString(awsIamRoleExample.arn),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsCodedeployDeploymentGroupExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `appName` - (Required) The name of the application.
+* `deploymentGroupName` - (Required) The name of the deployment group.
+* `serviceRoleArn` - (Required) The service role ARN that allows deployments.
+* `alarmConfiguration` - (Optional) Configuration block of alarms associated with the deployment group (documented below).
+* `autoRollbackConfiguration` - (Optional) Configuration block of the automatic rollback configuration associated with the deployment group (documented below).
+* `autoscalingGroups` - (Optional) Autoscaling groups associated with the deployment group.
+* `blueGreenDeploymentConfig` - (Optional) Configuration block of the blue/green deployment options for a deployment group (documented below).
+* `deploymentConfigName` - (Optional) The name of the group's deployment config. The default is "CodeDeployDefault.OneAtATime".
+* `deploymentStyle` - (Optional) Configuration block of the type of deployment, either in-place or blue/green, you want to run and whether to route deployment traffic behind a load balancer (documented below).
+* `ec2TagFilter` - (Optional) Tag filters associated with the deployment group. See the AWS docs for details.
+* `ec2TagSet` - (Optional) Configuration block(s) of Tag filters associated with the deployment group, which are also referred to as tag groups (documented below). See the AWS docs for details.
+* `ecsService` - (Optional) Configuration block(s) of the ECS services for a deployment group (documented below).
+* `loadBalancerInfo` - (Optional) Single configuration block of the load balancer to use in a blue/green deployment (documented below).
+* `onPremisesInstanceTagFilter` - (Optional) On premise tag filters associated with the group. See the AWS docs for details.
+* `triggerConfiguration` - (Optional) Configuration block(s) of the triggers for the deployment group (documented below).
+* `outdatedInstancesStrategy` - (Optional) Configuration block of Indicates what happens when new Amazon EC2 instances are launched mid-deployment and do not receive the deployed application revision. Valid values are `update` and `ignore`. Defaults to `update`.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### alarm_configuration Argument Reference
+
+You can configure a deployment to stop when a **CloudWatch** alarm detects that a metric has fallen below or exceeded a defined threshold. `alarmConfiguration` supports the following:
+
+* `alarms` - (Optional) A list of alarms configured for the deployment group. _A maximum of 10 alarms can be added to a deployment group_.
+* `enabled` - (Optional) Indicates whether the alarm configuration is enabled. This option is useful when you want to temporarily deactivate alarm monitoring for a deployment group without having to add the same alarms again later.
+* `ignorePollAlarmFailure` - (Optional) Indicates whether a deployment should continue if information about the current state of alarms cannot be retrieved from CloudWatch. The default value is `false`.
+    * `true`: The deployment will proceed even if alarm status information can't be retrieved.
+    * `false`: The deployment will stop if alarm status information can't be retrieved.
+
+_Only one `alarmConfiguration` is allowed_.
+
+### auto_rollback_configuration Argument Reference
+
+You can configure a deployment group to automatically rollback when a deployment fails or when a monitoring threshold you specify is met. In this case, the last known good version of an application revision is deployed. `autoRollbackConfiguration` supports the following:
+
+* `enabled` - (Optional) Indicates whether a defined automatic rollback configuration is currently enabled for this Deployment Group. If you enable automatic rollback, you must specify at least one event type.
+* `events` - (Optional) The event type or types that trigger a rollback. Supported types are `deploymentFailure`, `deploymentStopOnAlarm` and `deploymentStopOnRequest`.
+
+_Only one `autoRollbackConfiguration` is allowed_.
+
+### blue_green_deployment_config Argument Reference
+
+You can configure options for a blue/green deployment. `blueGreenDeploymentConfig` supports the following:
+
+* `deploymentReadyOption` - (Optional) Information about the action to take when newly provisioned instances are ready to receive traffic in a blue/green deployment (documented below).
+* `greenFleetProvisioningOption` - (Optional) Information about how instances are provisioned for a replacement environment in a blue/green deployment (documented below).
+* `terminateBlueInstancesOnDeploymentSuccess` - (Optional) Information about whether to terminate instances in the original fleet during a blue/green deployment (documented below).
+
+_Only one `blueGreenDeploymentConfig` is allowed_.
+
+You can configure how traffic is rerouted to instances in a replacement environment in a blue/green deployment. `deploymentReadyOption` supports the following:
+
+* `actionOnTimeout` - (Optional) When to reroute traffic from an original environment to a replacement environment in a blue/green deployment.
+    * `continueDeployment`: Register new instances with the load balancer immediately after the new application revision is installed on the instances in the replacement environment.
+    * `stopDeployment`: Do not register new instances with load balancer unless traffic is rerouted manually. If traffic is not rerouted manually before the end of the specified wait period, the deployment status is changed to Stopped.
+* `waitTimeInMinutes` - (Optional) The number of minutes to wait before the status of a blue/green deployment changed to Stopped if rerouting is not started manually. Applies only to the `stopDeployment` option for `actionOnTimeout`.
+
+You can configure how instances will be added to the replacement environment in a blue/green deployment. `greenFleetProvisioningOption` supports the following:
+
+* `action` - (Optional) The method used to add instances to a replacement environment.
+    * `discoverExisting`: Use instances that already exist or will be created manually.
+    * `copyAutoScalingGroup`: Use settings from a specified **Auto Scaling** group to define and create instances in a new Auto Scaling group. _Exactly one Auto Scaling group must be specified_ when selecting `copyAutoScalingGroup`. Use `autoscalingGroups` to specify the Auto Scaling group.
+
+You can configure how instances in the original environment are terminated when a blue/green deployment is successful. `terminateBlueInstancesOnDeploymentSuccess` supports the following:
+
+* `action` - (Optional) The action to take on instances in the original environment after a successful blue/green deployment.
+    * `terminate`: Instances are terminated after a specified wait time.
+    * `keepAlive`: Instances are left running after they are deregistered from the load balancer and removed from the deployment group.
+* `terminationWaitTimeInMinutes` - (Optional) The number of minutes to wait after a successful blue/green deployment before terminating instances from the original environment.
+
+### deployment_style Argument Reference
+
+You can configure the type of deployment, either in-place or blue/green, you want to run and whether to route deployment traffic behind a load balancer. `deploymentStyle` supports the following:
+
+* `deploymentOption` - (Optional) Indicates whether to route deployment traffic behind a load balancer. Valid Values are `withTrafficControl` or `withoutTrafficControl`. Default is `withoutTrafficControl`.
+* `deploymentType` - (Optional) Indicates whether to run an in-place deployment or a blue/green deployment. Valid Values are `inPlace` or `blueGreen`. Default is `inPlace`.
+
+_Only one `deploymentStyle` is allowed_.
+
+### ec2_tag_filter Argument Reference
+
+The `ec2TagFilter` configuration block supports the following:
+
+* `key` - (Optional) The key of the tag filter.
+* `type` - (Optional) The type of the tag filter, either `keyOnly`, `valueOnly`, or `keyAndValue`.
+* `value` - (Optional) The value of the tag filter.
+
+Multiple occurrences of `ec2TagFilter` are allowed, where any instance that matches to at least one of the tag filters is selected.
+
+### ec2_tag_set Argument Reference
+
+You can form a tag group by putting a set of tag filters into `ec2TagSet`. If multiple tag groups are specified, any instance that matches to at least one tag filter of every tag group is selected.
+
+### ecs_service Argument Reference
+
+Each `ecsService` configuration block supports the following:
+
+* `clusterName` - (Required) The name of the ECS cluster.
+* `serviceName` - (Required) The name of the ECS service.
+
+### load_balancer_info Argument Reference
+
+You can configure the **Load Balancer** to use in a deployment. `loadBalancerInfo` supports the following:
+
+* `elbInfo` - (Optional) The Classic Elastic Load Balancer to use in a deployment. Conflicts with `targetGroupInfo` and `targetGroupPairInfo`.
+* `targetGroupInfo` - (Optional) The (Application/Network Load Balancer) target group to use in a deployment. Conflicts with `elbInfo` and `targetGroupPairInfo`.
+* `targetGroupPairInfo` - (Optional) The (Application/Network Load Balancer) target group pair to use in a deployment. Conflicts with `elbInfo` and `targetGroupInfo`.
+
+#### load_balancer_info elb_info Argument Reference
+
+The `elbInfo` configuration block supports the following:
+
+* `name` - (Optional) The name of the load balancer that will be used to route traffic from original instances to replacement instances in a blue/green deployment. For in-place deployments, the name of the load balancer that instances are deregistered from so they are not serving traffic during a deployment, and then re-registered with after the deployment completes.
+
+#### load_balancer_info target_group_info Argument Reference
+
+The `targetGroupInfo` configuration block supports the following:
+
+* `name` - (Optional) The name of the target group that instances in the original environment are deregistered from, and instances in the replacement environment registered with. For in-place deployments, the name of the target group that instances are deregistered from, so they are not serving traffic during a deployment, and then re-registered with after the deployment completes.
+
+#### load_balancer_info target_group_pair_info Argument Reference
+
+The `targetGroupPairInfo` configuration block supports the following:
+
+* `prodTrafficRoute` - (Required) Configuration block for the production traffic route (documented below).
+* `targetGroup` - (Required) Configuration blocks for a target group within a target group pair (documented below).
+* `testTrafficRoute` - (Optional) Configuration block for the test traffic route (documented below).
+
+##### load_balancer_info target_group_pair_info prod_traffic_route Argument Reference
+
+The `prodTrafficRoute` configuration block supports the following:
+
+* `listenerArns` - (Required) List of Amazon Resource Names (ARNs) of the load balancer listeners. Must contain exactly one listener ARN.
+
+##### load_balancer_info target_group_pair_info target_group Argument Reference
+
+The `targetGroup` configuration block supports the following:
+
+* `name` - (Required) Name of the target group.
+
+##### load_balancer_info target_group_pair_info test_traffic_route Argument Reference
+
+The `testTrafficRoute` configuration block supports the following:
+
+* `listenerArns` - (Required) List of Amazon Resource Names (ARNs) of the load balancer listeners.
+
+### on_premises_instance_tag_filter Argument Reference
+
+The `onPremisesInstanceTagFilter` configuration block supports the following:
+
+* `key` - (Optional) The key of the tag filter.
+* `type` - (Optional) The type of the tag filter, either `keyOnly`, `valueOnly`, or `keyAndValue`.
+* `value` - (Optional) The value of the tag filter.
+
+### trigger_configuration Argument Reference
+
+Add triggers to a Deployment Group to receive notifications about events related to deployments or instances in the group. Notifications are sent to subscribers of the **SNS** topic associated with the trigger. _CodeDeploy must have permission to publish to the topic from this deployment group_. `triggerConfiguration` supports the following:
+
+* `triggerEvents` - (Required) The event type or types for which notifications are triggered. Some values that are supported: `deploymentStart`, `deploymentSuccess`, `deploymentFailure`, `deploymentStop`, `deploymentRollback`, `instanceStart`, `instanceSuccess`, `instanceFailure`.  See [the CodeDeploy documentation][1] for all possible values.
+* `triggerName` - (Required) The name of the notification trigger.
+* `triggerTargetArn` - (Required) The ARN of the SNS topic through which notifications are sent.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the CodeDeploy deployment group.
+* `id` - Application name and deployment group name.
+* `computePlatform` - The destination platform type for the deployment.
+* `deploymentGroupId` - The ID of the CodeDeploy deployment group.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CodeDeploy Deployment Groups using `appName`, a colon, and `deploymentGroupName`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import CodeDeploy Deployment Groups using `appName`, a colon, and `deploymentGroupName`. For example:
+
+```console
+% terraform import aws_codedeploy_deployment_group.example my-application:my-deployment-group
+```
+
+[1]: http://docs.aws.amazon.com/codedeploy/latest/userguide/monitoring-sns-event-notifications-create-trigger.html
+
+<!-- cache-key: cdktf-0.18.0 input-5e030adb78af16cbd2b9d795ba427fe21289613e6f4a6a7fcdd3fb270bcf4d76 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/codegurureviewer_repository_association.html.markdown b/website/docs/cdktf/typescript/r/codegurureviewer_repository_association.html.markdown
new file mode 100644
index 00000000000..30222657ebf
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/codegurureviewer_repository_association.html.markdown
@@ -0,0 +1,125 @@
+---
+subcategory: "CodeGuru Reviewer"
+layout: "aws"
+page_title: "AWS: aws_codegurureviewer_repository_association"
+description: |-
+  Terraform resource for managing an AWS CodeGuru Reviewer Repository Association.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_codegurureviewer_repository_association
+
+Terraform resource for managing an AWS CodeGuru Reviewer Repository Association.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CodecommitRepository } from "./.gen/providers/aws/codecommit-repository";
+import { CodegurureviewerRepositoryAssociation } from "./.gen/providers/aws/codegurureviewer-repository-association";
+import { KmsKey } from "./.gen/providers/aws/kms-key";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new CodecommitRepository(this, "example", {
+      lifecycle: {
+        ignoreChanges: ["codeguruReviewer"],
+      },
+      repositoryName: "example-repo",
+    });
+    const awsKmsKeyExample = new KmsKey(this, "example_1", {});
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsKmsKeyExample.overrideLogicalId("example");
+    const awsCodegurureviewerRepositoryAssociationExample =
+      new CodegurureviewerRepositoryAssociation(this, "example_2", {
+        kmsKeyDetails: {
+          encryptionOption: "CUSTOMER_MANAGED_CMK",
+          kmsKeyId: Token.asString(awsKmsKeyExample.keyId),
+        },
+        repository: {
+          codecommit: {
+            name: example.repositoryName,
+          },
+        },
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsCodegurureviewerRepositoryAssociationExample.overrideLogicalId(
+      "example"
+    );
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `repository` - (Required) An object describing the repository to associate. Valid values: `bitbucket`, `codecommit`, `githubEnterpriseServer`, or `s3Bucket`. Block is documented below. Note: for repositories that leverage CodeStar connections (ex. `bitbucket`, `githubEnterpriseServer`) the connection must be in `available` status prior to creating this resource.
+
+The following arguments are optional:
+
+* `kmsKeyDetails` - (Optional) An object describing the KMS key to asssociate. Block is documented below.
+
+## repository
+
+This configuration block supports the following:
+
+### bitbucket
+
+* `connectionArn` - (Required) The Amazon Resource Name (ARN) of an AWS CodeStar Connections connection.
+* `name` - (Required) The name of the third party source repository.
+* `owner` - (Required) The username for the account that owns the repository.
+
+### codecommit
+
+* `name` - (Required) The name of the AWS CodeCommit repository.
+
+### github_enterprise_server
+
+* `connectionArn` - (Required) The Amazon Resource Name (ARN) of an AWS CodeStar Connections connection.
+* `name` - (Required) The name of the third party source repository.
+* `owner` - (Required) The username for the account that owns the repository.
+
+### s3_bucket
+
+* `bucketName` - (Required) The name of the S3 bucket used for associating a new S3 repository. Note: The name must begin with `codeguruReviewer`.
+* `name` - (Required) The name of the repository in the S3 bucket.
+
+## kms_key_details
+
+This configuration block supports the following:
+
+* `encryptionOption` - (Optional) The encryption option for a repository association. It is either owned by AWS Key Management Service (KMS) (`awsOwnedCmk`) or customer managed (`customerManagedCmk`).
+* `kmsKeyId` - (Optional) The ID of the AWS KMS key that is associated with a repository association.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) identifying the repository association.
+* `associationId` - The ID of the repository association.
+* `connectionArn` - The Amazon Resource Name (ARN) of an AWS CodeStar Connections connection.
+* `id` - The Amazon Resource Name (ARN) identifying the repository association.
+* `name` - The name of the repository.
+* `owner` - The owner of the repository.
+* `providerType` - The provider type of the repository association.
+* `state` - The state of the repository association.
+* `stateReason` - A description of why the repository association is in the current state.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `60M`)
+* `update` - (Default `180M`)
+* `delete` - (Default `90M`)
+
+<!-- cache-key: cdktf-0.18.0 input-b8a4a1df23287da973904a4fa9f7f519b62aeebe1f60535df99ad7d1c408a770 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/codepipeline.html.markdown b/website/docs/cdktf/typescript/r/codepipeline.html.markdown
new file mode 100644
index 00000000000..c2762f27d97
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/codepipeline.html.markdown
@@ -0,0 +1,261 @@
+---
+subcategory: "CodePipeline"
+layout: "aws"
+page_title: "AWS: aws_codepipeline"
+description: |-
+  Provides a CodePipeline
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_codepipeline
+
+Provides a CodePipeline.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Codepipeline } from "./.gen/providers/aws/codepipeline";
+import { CodestarconnectionsConnection } from "./.gen/providers/aws/codestarconnections-connection";
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { DataAwsKmsAlias } from "./.gen/providers/aws/data-aws-kms-alias";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+import { IamRolePolicy } from "./.gen/providers/aws/iam-role-policy";
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketAcl } from "./.gen/providers/aws/s3-bucket-acl";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new CodestarconnectionsConnection(this, "example", {
+      name: "example-connection",
+      providerType: "GitHub",
+    });
+    const codepipelineBucket = new S3Bucket(this, "codepipeline_bucket", {
+      bucket: "test-bucket",
+    });
+    new S3BucketAcl(this, "codepipeline_bucket_acl", {
+      acl: "private",
+      bucket: codepipelineBucket.id,
+    });
+    const assumeRole = new DataAwsIamPolicyDocument(this, "assume_role", {
+      statement: [
+        {
+          actions: ["sts:AssumeRole"],
+          effect: "Allow",
+          principals: [
+            {
+              identifiers: ["codepipeline.amazonaws.com"],
+              type: "Service",
+            },
+          ],
+        },
+      ],
+    });
+    const codepipelinePolicy = new DataAwsIamPolicyDocument(
+      this,
+      "codepipeline_policy",
+      {
+        statement: [
+          {
+            actions: [
+              "s3:GetObject",
+              "s3:GetObjectVersion",
+              "s3:GetBucketVersioning",
+              "s3:PutObjectAcl",
+              "s3:PutObject",
+            ],
+            effect: "Allow",
+            resources: [
+              codepipelineBucket.arn,
+              "${" + codepipelineBucket.arn + "}/*",
+            ],
+          },
+          {
+            actions: ["codestar-connections:UseConnection"],
+            effect: "Allow",
+            resources: [example.arn],
+          },
+          {
+            actions: ["codebuild:BatchGetBuilds", "codebuild:StartBuild"],
+            effect: "Allow",
+            resources: ["*"],
+          },
+        ],
+      }
+    );
+    const s3Kmskey = new DataAwsKmsAlias(this, "s3kmskey", {
+      name: "alias/myKmsKey",
+    });
+    const codepipelineRole = new IamRole(this, "codepipeline_role", {
+      assumeRolePolicy: Token.asString(assumeRole.json),
+      name: "test-role",
+    });
+    const awsIamRolePolicyCodepipelinePolicy = new IamRolePolicy(
+      this,
+      "codepipeline_policy_7",
+      {
+        name: "codepipeline_policy",
+        policy: Token.asString(codepipelinePolicy.json),
+        role: codepipelineRole.id,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamRolePolicyCodepipelinePolicy.overrideLogicalId("codepipeline_policy");
+    new Codepipeline(this, "codepipeline", {
+      artifactStore: [
+        {
+          encryptionKey: {
+            id: Token.asString(s3Kmskey.arn),
+            type: "KMS",
+          },
+          location: codepipelineBucket.bucket,
+          type: "S3",
+        },
+      ],
+      name: "tf-test-pipeline",
+      roleArn: codepipelineRole.arn,
+      stage: [
+        {
+          action: [
+            {
+              category: "Source",
+              configuration: {
+                BranchName: "main",
+                ConnectionArn: example.arn,
+                FullRepositoryId: "my-organization/example",
+              },
+              name: "Source",
+              outputArtifacts: ["source_output"],
+              owner: "AWS",
+              provider: "CodeStarSourceConnection",
+              version: "1",
+            },
+          ],
+          name: "Source",
+        },
+        {
+          action: [
+            {
+              category: "Build",
+              configuration: {
+                ProjectName: "test",
+              },
+              inputArtifacts: ["source_output"],
+              name: "Build",
+              outputArtifacts: ["build_output"],
+              owner: "AWS",
+              provider: "CodeBuild",
+              version: "1",
+            },
+          ],
+          name: "Build",
+        },
+        {
+          action: [
+            {
+              category: "Deploy",
+              configuration: {
+                ActionMode: "REPLACE_ON_FAILURE",
+                Capabilities: "CAPABILITY_AUTO_EXPAND,CAPABILITY_IAM",
+                OutputFileName: "CreateStackOutput.json",
+                StackName: "MyStack",
+                TemplatePath: "build_output::sam-templated.yaml",
+              },
+              inputArtifacts: ["build_output"],
+              name: "Deploy",
+              owner: "AWS",
+              provider: "CloudFormation",
+              version: "1",
+            },
+          ],
+          name: "Deploy",
+        },
+      ],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the pipeline.
+* `roleArn` - (Required) A service role Amazon Resource Name (ARN) that grants AWS CodePipeline permission to make calls to AWS services on your behalf.
+* `artifactStore` (Required) One or more artifact_store blocks. Artifact stores are documented below.
+* `stage` (Minimum of at least two `stage` blocks is required) A stage block. Stages are documented below.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+An `artifactStore` block supports the following arguments:
+
+* `location` - (Required) The location where AWS CodePipeline stores artifacts for a pipeline; currently only `s3` is supported.
+* `type` - (Required) The type of the artifact store, such as Amazon S3
+* `encryptionKey` - (Optional) The encryption key block AWS CodePipeline uses to encrypt the data in the artifact store, such as an AWS Key Management Service (AWS KMS) key. If you don't specify a key, AWS CodePipeline uses the default key for Amazon Simple Storage Service (Amazon S3). An `encryptionKey` block is documented below.
+* `region` - (Optional) The region where the artifact store is located. Required for a cross-region CodePipeline, do not provide for a single-region CodePipeline.
+
+An `encryptionKey` block supports the following arguments:
+
+* `id` - (Required) The KMS key ARN or ID
+* `type` - (Required) The type of key; currently only `kms` is supported
+
+A `stage` block supports the following arguments:
+
+* `name` - (Required) The name of the stage.
+* `action` - (Required) The action(s) to include in the stage. Defined as an `action` block below
+
+An `action` block supports the following arguments:
+
+* `category` - (Required) A category defines what kind of action can be taken in the stage, and constrains the provider type for the action. Possible values are `approval`, `build`, `deploy`, `invoke`, `source` and `test`.
+* `owner` - (Required) The creator of the action being called. Possible values are `aws`, `custom` and `thirdParty`.
+* `name` - (Required) The action declaration's name.
+* `provider` - (Required) The provider of the service being called by the action. Valid providers are determined by the action category. Provider names are listed in the [Action Structure Reference](https://docs.aws.amazon.com/codepipeline/latest/userguide/action-reference.html) documentation.
+* `version` - (Required) A string that identifies the action type.
+* `configuration` - (Optional) A map of the action declaration's configuration. Configurations options for action types and providers can be found in the [Pipeline Structure Reference](http://docs.aws.amazon.com/codepipeline/latest/userguide/reference-pipeline-structure.html#action-requirements) and [Action Structure Reference](https://docs.aws.amazon.com/codepipeline/latest/userguide/action-reference.html) documentation.
+* `inputArtifacts` - (Optional) A list of artifact names to be worked on.
+* `outputArtifacts` - (Optional) A list of artifact names to output. Output artifact names must be unique within a pipeline.
+* `roleArn` - (Optional) The ARN of the IAM service role that will perform the declared action. This is assumed through the roleArn for the pipeline.
+* `runOrder` - (Optional) The order in which actions are run.
+* `region` - (Optional) The region in which to run the action.
+* `namespace` - (Optional) The namespace all output variables will be accessed from.
+
+~> **Note:** The input artifact of an action must exactly match the output artifact declared in a preceding action, but the input artifact does not have to be the next action in strict sequence from the action that provided the output artifact. Actions in parallel can declare different output artifacts, which are in turn consumed by different following actions.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The codepipeline ID.
+* `arn` - The codepipeline ARN.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CodePipelines using the name. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import CodePipelines using the name. For example:
+
+```console
+% terraform import aws_codepipeline.foo example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-7564a4a21906390b235c7f254087ae49e059d302514c3158ce3d6d1c0c29ca5e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/codepipeline.markdown b/website/docs/cdktf/typescript/r/codepipeline.markdown
new file mode 100644
index 00000000000..c2762f27d97
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/codepipeline.markdown
@@ -0,0 +1,261 @@
+---
+subcategory: "CodePipeline"
+layout: "aws"
+page_title: "AWS: aws_codepipeline"
+description: |-
+  Provides a CodePipeline
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_codepipeline
+
+Provides a CodePipeline.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Codepipeline } from "./.gen/providers/aws/codepipeline";
+import { CodestarconnectionsConnection } from "./.gen/providers/aws/codestarconnections-connection";
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { DataAwsKmsAlias } from "./.gen/providers/aws/data-aws-kms-alias";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+import { IamRolePolicy } from "./.gen/providers/aws/iam-role-policy";
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketAcl } from "./.gen/providers/aws/s3-bucket-acl";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new CodestarconnectionsConnection(this, "example", {
+      name: "example-connection",
+      providerType: "GitHub",
+    });
+    const codepipelineBucket = new S3Bucket(this, "codepipeline_bucket", {
+      bucket: "test-bucket",
+    });
+    new S3BucketAcl(this, "codepipeline_bucket_acl", {
+      acl: "private",
+      bucket: codepipelineBucket.id,
+    });
+    const assumeRole = new DataAwsIamPolicyDocument(this, "assume_role", {
+      statement: [
+        {
+          actions: ["sts:AssumeRole"],
+          effect: "Allow",
+          principals: [
+            {
+              identifiers: ["codepipeline.amazonaws.com"],
+              type: "Service",
+            },
+          ],
+        },
+      ],
+    });
+    const codepipelinePolicy = new DataAwsIamPolicyDocument(
+      this,
+      "codepipeline_policy",
+      {
+        statement: [
+          {
+            actions: [
+              "s3:GetObject",
+              "s3:GetObjectVersion",
+              "s3:GetBucketVersioning",
+              "s3:PutObjectAcl",
+              "s3:PutObject",
+            ],
+            effect: "Allow",
+            resources: [
+              codepipelineBucket.arn,
+              "${" + codepipelineBucket.arn + "}/*",
+            ],
+          },
+          {
+            actions: ["codestar-connections:UseConnection"],
+            effect: "Allow",
+            resources: [example.arn],
+          },
+          {
+            actions: ["codebuild:BatchGetBuilds", "codebuild:StartBuild"],
+            effect: "Allow",
+            resources: ["*"],
+          },
+        ],
+      }
+    );
+    const s3Kmskey = new DataAwsKmsAlias(this, "s3kmskey", {
+      name: "alias/myKmsKey",
+    });
+    const codepipelineRole = new IamRole(this, "codepipeline_role", {
+      assumeRolePolicy: Token.asString(assumeRole.json),
+      name: "test-role",
+    });
+    const awsIamRolePolicyCodepipelinePolicy = new IamRolePolicy(
+      this,
+      "codepipeline_policy_7",
+      {
+        name: "codepipeline_policy",
+        policy: Token.asString(codepipelinePolicy.json),
+        role: codepipelineRole.id,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamRolePolicyCodepipelinePolicy.overrideLogicalId("codepipeline_policy");
+    new Codepipeline(this, "codepipeline", {
+      artifactStore: [
+        {
+          encryptionKey: {
+            id: Token.asString(s3Kmskey.arn),
+            type: "KMS",
+          },
+          location: codepipelineBucket.bucket,
+          type: "S3",
+        },
+      ],
+      name: "tf-test-pipeline",
+      roleArn: codepipelineRole.arn,
+      stage: [
+        {
+          action: [
+            {
+              category: "Source",
+              configuration: {
+                BranchName: "main",
+                ConnectionArn: example.arn,
+                FullRepositoryId: "my-organization/example",
+              },
+              name: "Source",
+              outputArtifacts: ["source_output"],
+              owner: "AWS",
+              provider: "CodeStarSourceConnection",
+              version: "1",
+            },
+          ],
+          name: "Source",
+        },
+        {
+          action: [
+            {
+              category: "Build",
+              configuration: {
+                ProjectName: "test",
+              },
+              inputArtifacts: ["source_output"],
+              name: "Build",
+              outputArtifacts: ["build_output"],
+              owner: "AWS",
+              provider: "CodeBuild",
+              version: "1",
+            },
+          ],
+          name: "Build",
+        },
+        {
+          action: [
+            {
+              category: "Deploy",
+              configuration: {
+                ActionMode: "REPLACE_ON_FAILURE",
+                Capabilities: "CAPABILITY_AUTO_EXPAND,CAPABILITY_IAM",
+                OutputFileName: "CreateStackOutput.json",
+                StackName: "MyStack",
+                TemplatePath: "build_output::sam-templated.yaml",
+              },
+              inputArtifacts: ["build_output"],
+              name: "Deploy",
+              owner: "AWS",
+              provider: "CloudFormation",
+              version: "1",
+            },
+          ],
+          name: "Deploy",
+        },
+      ],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the pipeline.
+* `roleArn` - (Required) A service role Amazon Resource Name (ARN) that grants AWS CodePipeline permission to make calls to AWS services on your behalf.
+* `artifactStore` (Required) One or more artifact_store blocks. Artifact stores are documented below.
+* `stage` (Minimum of at least two `stage` blocks is required) A stage block. Stages are documented below.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+An `artifactStore` block supports the following arguments:
+
+* `location` - (Required) The location where AWS CodePipeline stores artifacts for a pipeline; currently only `s3` is supported.
+* `type` - (Required) The type of the artifact store, such as Amazon S3
+* `encryptionKey` - (Optional) The encryption key block AWS CodePipeline uses to encrypt the data in the artifact store, such as an AWS Key Management Service (AWS KMS) key. If you don't specify a key, AWS CodePipeline uses the default key for Amazon Simple Storage Service (Amazon S3). An `encryptionKey` block is documented below.
+* `region` - (Optional) The region where the artifact store is located. Required for a cross-region CodePipeline, do not provide for a single-region CodePipeline.
+
+An `encryptionKey` block supports the following arguments:
+
+* `id` - (Required) The KMS key ARN or ID
+* `type` - (Required) The type of key; currently only `kms` is supported
+
+A `stage` block supports the following arguments:
+
+* `name` - (Required) The name of the stage.
+* `action` - (Required) The action(s) to include in the stage. Defined as an `action` block below
+
+An `action` block supports the following arguments:
+
+* `category` - (Required) A category defines what kind of action can be taken in the stage, and constrains the provider type for the action. Possible values are `approval`, `build`, `deploy`, `invoke`, `source` and `test`.
+* `owner` - (Required) The creator of the action being called. Possible values are `aws`, `custom` and `thirdParty`.
+* `name` - (Required) The action declaration's name.
+* `provider` - (Required) The provider of the service being called by the action. Valid providers are determined by the action category. Provider names are listed in the [Action Structure Reference](https://docs.aws.amazon.com/codepipeline/latest/userguide/action-reference.html) documentation.
+* `version` - (Required) A string that identifies the action type.
+* `configuration` - (Optional) A map of the action declaration's configuration. Configurations options for action types and providers can be found in the [Pipeline Structure Reference](http://docs.aws.amazon.com/codepipeline/latest/userguide/reference-pipeline-structure.html#action-requirements) and [Action Structure Reference](https://docs.aws.amazon.com/codepipeline/latest/userguide/action-reference.html) documentation.
+* `inputArtifacts` - (Optional) A list of artifact names to be worked on.
+* `outputArtifacts` - (Optional) A list of artifact names to output. Output artifact names must be unique within a pipeline.
+* `roleArn` - (Optional) The ARN of the IAM service role that will perform the declared action. This is assumed through the roleArn for the pipeline.
+* `runOrder` - (Optional) The order in which actions are run.
+* `region` - (Optional) The region in which to run the action.
+* `namespace` - (Optional) The namespace all output variables will be accessed from.
+
+~> **Note:** The input artifact of an action must exactly match the output artifact declared in a preceding action, but the input artifact does not have to be the next action in strict sequence from the action that provided the output artifact. Actions in parallel can declare different output artifacts, which are in turn consumed by different following actions.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The codepipeline ID.
+* `arn` - The codepipeline ARN.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CodePipelines using the name. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import CodePipelines using the name. For example:
+
+```console
+% terraform import aws_codepipeline.foo example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-7564a4a21906390b235c7f254087ae49e059d302514c3158ce3d6d1c0c29ca5e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/codepipeline_custom_action_type.html.markdown b/website/docs/cdktf/typescript/r/codepipeline_custom_action_type.html.markdown
new file mode 100644
index 00000000000..0dcd6de4a78
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/codepipeline_custom_action_type.html.markdown
@@ -0,0 +1,122 @@
+---
+subcategory: "CodePipeline"
+layout: "aws"
+page_title: "AWS: aws_codepipeline_custom_action_type"
+description: |-
+  Provides a CodePipeline CustomActionType.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_codepipeline_custom_action_type
+
+Provides a CodeDeploy CustomActionType
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CodepipelineCustomActionType } from "./.gen/providers/aws/codepipeline-custom-action-type";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new CodepipelineCustomActionType(this, "example", {
+      category: "Build",
+      inputArtifactDetails: {
+        maximumCount: 1,
+        minimumCount: 0,
+      },
+      outputArtifactDetails: {
+        maximumCount: 1,
+        minimumCount: 0,
+      },
+      providerName: "example",
+      version: "1",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `category` - (Required) The category of the custom action. Valid values: `source`, `build`, `deploy`, `test`, `invoke`, `approval`
+* `configurationProperty` - (Optional) The configuration properties for the custom action. Max 10 items.
+
+The `configurationProperty` object supports the following:
+
+* `description` - (Optional) The description of the action configuration property.
+* `key` - (Required) Whether the configuration property is a key.
+* `name` - (Required) The name of the action configuration property.
+* `queryable` - (Optional) Indicates that the property will be used in conjunction with PollForJobs.
+* `required` - (Required) Whether the configuration property is a required value.
+* `secret`- (Required) Whether the configuration property is secret.
+* `type`- (Optional) The type of the configuration property. Valid values: `string`, `number`, `boolean`
+
+* `inputArtifactDetails` - (Required) The details of the input artifact for the action.
+
+The `inputArtifactDetails` object supports the following:
+
+* `maximumCount` - (Required) The maximum number of artifacts allowed for the action type. Min: 0, Max: 5
+* `minimumCount` - (Required) The minimum number of artifacts allowed for the action type. Min: 0, Max: 5
+
+* `outputArtifactDetails` - (Required) The details of the output artifact of the action.
+
+The `outputArtifactDetails` object supports the following:
+
+* `maximumCount` - (Required) The maximum number of artifacts allowed for the action type. Min: 0, Max: 5
+* `minimumCount` - (Required) The minimum number of artifacts allowed for the action type. Min: 0, Max: 5
+
+* `providerName` - (Required) The provider of the service used in the custom action
+* `settings` - (Optional) The settings for an action type.
+
+The `settings` object supports the following:
+
+* `entityUrlTemplate` - (Optional) The URL returned to the AWS CodePipeline console that provides a deep link to the resources of the external system.
+* `executionUrlTemplate` - (Optional) The URL returned to the AWS CodePipeline console that contains a link to the top-level landing page for the external system.
+* `revisionUrlTemplate` - (Optional) The URL returned to the AWS CodePipeline console that contains a link to the page where customers can update or change the configuration of the external action.
+* `thirdPartyConfigurationUrl` - (Optional) The URL of a sign-up page where users can sign up for an external service and perform initial configuration of the action provided by that service.
+
+* `tags` - (Optional) Map of tags to assign to this resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `version` - (Required) The version identifier of the custom action.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Composed of category, provider and version. For example, `build:terraform:1`
+* `arn` - The action ARN.
+* `owner` - The creator of the action being called.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CodeDeploy CustomActionType using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import CodeDeploy CustomActionType using the `id`. For example:
+
+```console
+% terraform import aws_codepipeline_custom_action_type.example Build:terraform:1
+```
+
+<!-- cache-key: cdktf-0.18.0 input-618f4e853ef9774ea870455f957f72ac7ccbe371d784f81ae5996c728184b956 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/codepipeline_webhook.html.markdown b/website/docs/cdktf/typescript/r/codepipeline_webhook.html.markdown
new file mode 100644
index 00000000000..5c5e63740ba
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/codepipeline_webhook.html.markdown
@@ -0,0 +1,174 @@
+---
+subcategory: "CodePipeline"
+layout: "aws"
+page_title: "AWS: aws_codepipeline_webhook"
+description: |-
+  Provides a CodePipeline Webhook
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_codepipeline_webhook
+
+Provides a CodePipeline Webhook.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Codepipeline } from "./.gen/providers/aws/codepipeline";
+import { CodepipelineWebhook } from "./.gen/providers/aws/codepipeline-webhook";
+import { RepositoryWebhook } from "./.gen/providers/github/repository-webhook";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    /*The following providers are missing schema information and might need manual adjustments to synthesize correctly: github.
+    For a more precise conversion please use the --provider flag in convert.*/
+    const webhookSecret = "super-secret";
+    const bar = new Codepipeline(this, "bar", {
+      artifactStore: [
+        {
+          encryptionKey: {
+            id: Token.asString(s3Kmskey.arn),
+            type: "KMS",
+          },
+          location: Token.asString(awsS3BucketBar.bucket),
+          type: "S3",
+        },
+      ],
+      name: "tf-test-pipeline",
+      roleArn: Token.asString(awsIamRoleBar.arn),
+      stage: [
+        {
+          action: [
+            {
+              category: "Source",
+              configuration: {
+                Branch: "master",
+                Owner: "my-organization",
+                Repo: "test",
+              },
+              name: "Source",
+              outputArtifacts: ["test"],
+              owner: "ThirdParty",
+              provider: "GitHub",
+              version: "1",
+            },
+          ],
+          name: "Source",
+        },
+        {
+          action: [
+            {
+              category: "Build",
+              configuration: {
+                ProjectName: "test",
+              },
+              inputArtifacts: ["test"],
+              name: "Build",
+              owner: "AWS",
+              provider: "CodeBuild",
+              version: "1",
+            },
+          ],
+          name: "Build",
+        },
+      ],
+    });
+    const awsCodepipelineWebhookBar = new CodepipelineWebhook(this, "bar_1", {
+      authentication: "GITHUB_HMAC",
+      authenticationConfiguration: {
+        secretToken: webhookSecret,
+      },
+      filter: [
+        {
+          jsonPath: "$.ref",
+          matchEquals: "refs/heads/{Branch}",
+        },
+      ],
+      name: "test-webhook-github-bar",
+      targetAction: "Source",
+      targetPipeline: bar.name,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsCodepipelineWebhookBar.overrideLogicalId("bar");
+    const githubRepositoryWebhookBar = new RepositoryWebhook(this, "bar_2", {
+      configuration: [
+        {
+          content_type: "json",
+          insecure_ssl: true,
+          secret: webhookSecret,
+          url: awsCodepipelineWebhookBar.url,
+        },
+      ],
+      events: ["push"],
+      name: "web",
+      repository: repo.name,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    githubRepositoryWebhookBar.overrideLogicalId("bar");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the webhook.
+* `authentication` - (Required) The type of authentication  to use. One of `ip`, `githubHmac`, or `unauthenticated`.
+* `authenticationConfiguration` - (Optional) An `auth` block. Required for `ip` and `githubHmac`. Auth blocks are documented below.
+* `filter` (Required) One or more `filter` blocks. Filter blocks are documented below.
+* `targetAction` - (Required) The name of the action in a pipeline you want to connect to the webhook. The action must be from the source (first) stage of the pipeline.
+* `targetPipeline` - (Required) The name of the pipeline.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+An `authenticationConfiguration` block supports the following arguments:
+
+* `secretToken` - (Optional) The shared secret for the GitHub repository webhook. Set this as `secret` in your `githubRepositoryWebhook`'s `configuration` block. Required for `githubHmac`.
+* `allowedIpRange` - (Optional) A valid CIDR block for `ip` filtering. Required for `ip`.
+
+A `filter` block supports the following arguments:
+
+* `jsonPath` - (Required) The [JSON path](https://github.com/json-path/JsonPath) to filter on.
+* `matchEquals` - (Required) The value to match on (e.g., `refs/heads/{branch}`). See [AWS docs](https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_WebhookFilterRule.html) for details.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The CodePipeline webhook's ARN.
+* `id` - The CodePipeline webhook's ARN.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `url` - The CodePipeline webhook's URL. POST events to this endpoint to trigger the target.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CodePipeline Webhooks using their ARN. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import CodePipeline Webhooks using their ARN. For example:
+
+```console
+% terraform import aws_codepipeline_webhook.example arn:aws:codepipeline:us-west-2:123456789012:webhook:example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-12eddb2b0e3d8862aa33cfaab94c4516ce51690b35cba10b34567326ccde28ed -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/codepipeline_webhook.markdown b/website/docs/cdktf/typescript/r/codepipeline_webhook.markdown
new file mode 100644
index 00000000000..5c5e63740ba
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/codepipeline_webhook.markdown
@@ -0,0 +1,174 @@
+---
+subcategory: "CodePipeline"
+layout: "aws"
+page_title: "AWS: aws_codepipeline_webhook"
+description: |-
+  Provides a CodePipeline Webhook
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_codepipeline_webhook
+
+Provides a CodePipeline Webhook.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Codepipeline } from "./.gen/providers/aws/codepipeline";
+import { CodepipelineWebhook } from "./.gen/providers/aws/codepipeline-webhook";
+import { RepositoryWebhook } from "./.gen/providers/github/repository-webhook";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    /*The following providers are missing schema information and might need manual adjustments to synthesize correctly: github.
+    For a more precise conversion please use the --provider flag in convert.*/
+    const webhookSecret = "super-secret";
+    const bar = new Codepipeline(this, "bar", {
+      artifactStore: [
+        {
+          encryptionKey: {
+            id: Token.asString(s3Kmskey.arn),
+            type: "KMS",
+          },
+          location: Token.asString(awsS3BucketBar.bucket),
+          type: "S3",
+        },
+      ],
+      name: "tf-test-pipeline",
+      roleArn: Token.asString(awsIamRoleBar.arn),
+      stage: [
+        {
+          action: [
+            {
+              category: "Source",
+              configuration: {
+                Branch: "master",
+                Owner: "my-organization",
+                Repo: "test",
+              },
+              name: "Source",
+              outputArtifacts: ["test"],
+              owner: "ThirdParty",
+              provider: "GitHub",
+              version: "1",
+            },
+          ],
+          name: "Source",
+        },
+        {
+          action: [
+            {
+              category: "Build",
+              configuration: {
+                ProjectName: "test",
+              },
+              inputArtifacts: ["test"],
+              name: "Build",
+              owner: "AWS",
+              provider: "CodeBuild",
+              version: "1",
+            },
+          ],
+          name: "Build",
+        },
+      ],
+    });
+    const awsCodepipelineWebhookBar = new CodepipelineWebhook(this, "bar_1", {
+      authentication: "GITHUB_HMAC",
+      authenticationConfiguration: {
+        secretToken: webhookSecret,
+      },
+      filter: [
+        {
+          jsonPath: "$.ref",
+          matchEquals: "refs/heads/{Branch}",
+        },
+      ],
+      name: "test-webhook-github-bar",
+      targetAction: "Source",
+      targetPipeline: bar.name,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsCodepipelineWebhookBar.overrideLogicalId("bar");
+    const githubRepositoryWebhookBar = new RepositoryWebhook(this, "bar_2", {
+      configuration: [
+        {
+          content_type: "json",
+          insecure_ssl: true,
+          secret: webhookSecret,
+          url: awsCodepipelineWebhookBar.url,
+        },
+      ],
+      events: ["push"],
+      name: "web",
+      repository: repo.name,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    githubRepositoryWebhookBar.overrideLogicalId("bar");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the webhook.
+* `authentication` - (Required) The type of authentication  to use. One of `ip`, `githubHmac`, or `unauthenticated`.
+* `authenticationConfiguration` - (Optional) An `auth` block. Required for `ip` and `githubHmac`. Auth blocks are documented below.
+* `filter` (Required) One or more `filter` blocks. Filter blocks are documented below.
+* `targetAction` - (Required) The name of the action in a pipeline you want to connect to the webhook. The action must be from the source (first) stage of the pipeline.
+* `targetPipeline` - (Required) The name of the pipeline.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+An `authenticationConfiguration` block supports the following arguments:
+
+* `secretToken` - (Optional) The shared secret for the GitHub repository webhook. Set this as `secret` in your `githubRepositoryWebhook`'s `configuration` block. Required for `githubHmac`.
+* `allowedIpRange` - (Optional) A valid CIDR block for `ip` filtering. Required for `ip`.
+
+A `filter` block supports the following arguments:
+
+* `jsonPath` - (Required) The [JSON path](https://github.com/json-path/JsonPath) to filter on.
+* `matchEquals` - (Required) The value to match on (e.g., `refs/heads/{branch}`). See [AWS docs](https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_WebhookFilterRule.html) for details.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The CodePipeline webhook's ARN.
+* `id` - The CodePipeline webhook's ARN.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `url` - The CodePipeline webhook's URL. POST events to this endpoint to trigger the target.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CodePipeline Webhooks using their ARN. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import CodePipeline Webhooks using their ARN. For example:
+
+```console
+% terraform import aws_codepipeline_webhook.example arn:aws:codepipeline:us-west-2:123456789012:webhook:example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-12eddb2b0e3d8862aa33cfaab94c4516ce51690b35cba10b34567326ccde28ed -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/codestarconnections_connection.html.markdown b/website/docs/cdktf/typescript/r/codestarconnections_connection.html.markdown
new file mode 100644
index 00000000000..784ce8941cc
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/codestarconnections_connection.html.markdown
@@ -0,0 +1,151 @@
+---
+subcategory: "CodeStar Connections"
+layout: "aws"
+page_title: "AWS: aws_codestarconnections_connection"
+description: |-
+  Provides a CodeStar Connection
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_codestarconnections_connection
+
+Provides a CodeStar Connection.
+
+~> **NOTE:** The `awsCodestarconnectionsConnection` resource is created in the state `pending`. Authentication with the connection provider must be completed in the AWS Console. See the [AWS documentation](https://docs.aws.amazon.com/dtconsole/latest/userguide/connections-update.html) for details.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Codepipeline } from "./.gen/providers/aws/codepipeline";
+import { CodestarconnectionsConnection } from "./.gen/providers/aws/codestarconnections-connection";
+interface MyConfig {
+  location: any;
+  type: any;
+  category: any;
+  name: any;
+  owner: any;
+  provider: any;
+  version: any;
+  category1: any;
+  name1: any;
+  owner1: any;
+  provider1: any;
+  version1: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    const example = new CodestarconnectionsConnection(this, "example", {
+      name: "example-connection",
+      providerType: "Bitbucket",
+    });
+    const awsCodepipelineExample = new Codepipeline(this, "example_1", {
+      artifactStore: [
+        {
+          location: config.location,
+          type: config.type,
+        },
+      ],
+      name: "tf-test-pipeline",
+      roleArn: codepipelineRole.arn,
+      stage: [
+        {
+          action: [
+            {
+              category: "Source",
+              configuration: {
+                BranchName: "main",
+                ConnectionArn: example.arn,
+                FullRepositoryId: "my-organization/test",
+              },
+              name: "Source",
+              outputArtifacts: ["source_output"],
+              owner: "AWS",
+              provider: "CodeStarSourceConnection",
+              version: "1",
+            },
+          ],
+          name: "Source",
+        },
+        {
+          action: [
+            {
+              category: config.category,
+              name: config.name,
+              owner: config.owner,
+              provider: config.provider,
+              version: config.version,
+            },
+          ],
+          name: "Build",
+        },
+        {
+          action: [
+            {
+              category: config.category1,
+              name: config.name1,
+              owner: config.owner1,
+              provider: config.provider1,
+              version: config.version1,
+            },
+          ],
+          name: "Deploy",
+        },
+      ],
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsCodepipelineExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the connection to be created. The name must be unique in the calling AWS account. Changing `name` will create a new resource.
+* `providerType` - (Optional) The name of the external provider where your third-party code repository is configured. Valid values are `bitbucket`, `gitHub` or `gitHubEnterpriseServer`. Changing `providerType` will create a new resource. Conflicts with `hostArn`
+* `hostArn` - (Optional) The Amazon Resource Name (ARN) of the host associated with the connection. Conflicts with `providerType`
+* `tags` - (Optional) Map of key-value resource tags to associate with the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The codestar connection ARN.
+* `arn` - The codestar connection ARN.
+* `connectionStatus` - The codestar connection status. Possible values are `pending`, `available` and `error`.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CodeStar connections using the ARN. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import CodeStar connections using the ARN. For example:
+
+```console
+% terraform import aws_codestarconnections_connection.test-connection arn:aws:codestar-connections:us-west-1:0123456789:connection/79d4d357-a2ee-41e4-b350-2fe39ae59448
+```
+
+<!-- cache-key: cdktf-0.18.0 input-cea28696e8a04ea0fb64e3b43f622ae20b1f905cc54be4b416fdf569f4bc9518 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/codestarconnections_connection.markdown b/website/docs/cdktf/typescript/r/codestarconnections_connection.markdown
new file mode 100644
index 00000000000..784ce8941cc
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/codestarconnections_connection.markdown
@@ -0,0 +1,151 @@
+---
+subcategory: "CodeStar Connections"
+layout: "aws"
+page_title: "AWS: aws_codestarconnections_connection"
+description: |-
+  Provides a CodeStar Connection
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_codestarconnections_connection
+
+Provides a CodeStar Connection.
+
+~> **NOTE:** The `awsCodestarconnectionsConnection` resource is created in the state `pending`. Authentication with the connection provider must be completed in the AWS Console. See the [AWS documentation](https://docs.aws.amazon.com/dtconsole/latest/userguide/connections-update.html) for details.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Codepipeline } from "./.gen/providers/aws/codepipeline";
+import { CodestarconnectionsConnection } from "./.gen/providers/aws/codestarconnections-connection";
+interface MyConfig {
+  location: any;
+  type: any;
+  category: any;
+  name: any;
+  owner: any;
+  provider: any;
+  version: any;
+  category1: any;
+  name1: any;
+  owner1: any;
+  provider1: any;
+  version1: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    const example = new CodestarconnectionsConnection(this, "example", {
+      name: "example-connection",
+      providerType: "Bitbucket",
+    });
+    const awsCodepipelineExample = new Codepipeline(this, "example_1", {
+      artifactStore: [
+        {
+          location: config.location,
+          type: config.type,
+        },
+      ],
+      name: "tf-test-pipeline",
+      roleArn: codepipelineRole.arn,
+      stage: [
+        {
+          action: [
+            {
+              category: "Source",
+              configuration: {
+                BranchName: "main",
+                ConnectionArn: example.arn,
+                FullRepositoryId: "my-organization/test",
+              },
+              name: "Source",
+              outputArtifacts: ["source_output"],
+              owner: "AWS",
+              provider: "CodeStarSourceConnection",
+              version: "1",
+            },
+          ],
+          name: "Source",
+        },
+        {
+          action: [
+            {
+              category: config.category,
+              name: config.name,
+              owner: config.owner,
+              provider: config.provider,
+              version: config.version,
+            },
+          ],
+          name: "Build",
+        },
+        {
+          action: [
+            {
+              category: config.category1,
+              name: config.name1,
+              owner: config.owner1,
+              provider: config.provider1,
+              version: config.version1,
+            },
+          ],
+          name: "Deploy",
+        },
+      ],
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsCodepipelineExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the connection to be created. The name must be unique in the calling AWS account. Changing `name` will create a new resource.
+* `providerType` - (Optional) The name of the external provider where your third-party code repository is configured. Valid values are `bitbucket`, `gitHub` or `gitHubEnterpriseServer`. Changing `providerType` will create a new resource. Conflicts with `hostArn`
+* `hostArn` - (Optional) The Amazon Resource Name (ARN) of the host associated with the connection. Conflicts with `providerType`
+* `tags` - (Optional) Map of key-value resource tags to associate with the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The codestar connection ARN.
+* `arn` - The codestar connection ARN.
+* `connectionStatus` - The codestar connection status. Possible values are `pending`, `available` and `error`.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CodeStar connections using the ARN. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import CodeStar connections using the ARN. For example:
+
+```console
+% terraform import aws_codestarconnections_connection.test-connection arn:aws:codestar-connections:us-west-1:0123456789:connection/79d4d357-a2ee-41e4-b350-2fe39ae59448
+```
+
+<!-- cache-key: cdktf-0.18.0 input-cea28696e8a04ea0fb64e3b43f622ae20b1f905cc54be4b416fdf569f4bc9518 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/codestarconnections_host.html.markdown b/website/docs/cdktf/typescript/r/codestarconnections_host.html.markdown
new file mode 100644
index 00000000000..fec951e0c45
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/codestarconnections_host.html.markdown
@@ -0,0 +1,87 @@
+---
+subcategory: "CodeStar Connections"
+layout: "aws"
+page_title: "AWS: aws_codestarconnections_host"
+description: |-
+  Provides a CodeStar Host
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_codestarconnections_host
+
+Provides a CodeStar Host.
+
+~> **NOTE:** The `awsCodestarconnectionsHost` resource is created in the state `pending`. Authentication with the host provider must be completed in the AWS Console. For more information visit [Set up a pending host](https://docs.aws.amazon.com/dtconsole/latest/userguide/connections-host-setup.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CodestarconnectionsHost } from "./.gen/providers/aws/codestarconnections-host";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new CodestarconnectionsHost(this, "example", {
+      name: "example-host",
+      providerEndpoint: "https://example.com",
+      providerType: "GitHubEnterpriseServer",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the host to be created. The name must be unique in the calling AWS account.
+* `providerEndpoint` - (Required) The endpoint of the infrastructure to be represented by the host after it is created.
+* `providerType` - (Required) The name of the external provider where your third-party code repository is configured.
+* `vpcConfiguration` - (Optional) The VPC configuration to be provisioned for the host. A VPC must be configured, and the infrastructure to be represented by the host must already be connected to the VPC.
+
+A `vpcConfiguration` block supports the following arguments:
+
+* `securityGroupIds` - (Required) ID of the security group or security groups associated with the Amazon VPC connected to the infrastructure where your provider type is installed.
+* `subnetIds` - (Required) The ID of the subnet or subnets associated with the Amazon VPC connected to the infrastructure where your provider type is installed.
+* `tlsCertificate` - (Optional) The value of the Transport Layer Security (TLS) certificate associated with the infrastructure where your provider type is installed.
+* `vpcId` - (Required) The ID of the Amazon VPC connected to the infrastructure where your provider type is installed.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The CodeStar Host ARN.
+* `arn` - The CodeStar Host ARN.
+* `status` - The CodeStar Host status. Possible values are `pending`, `available`, `vpcConfigDeleting`, `vpcConfigInitializing`, and `vpcConfigFailedInitialization`.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CodeStar Host using the ARN. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import CodeStar Host using the ARN. For example:
+
+```console
+% terraform import aws_codestarconnections_host.example-host arn:aws:codestar-connections:us-west-1:0123456789:host/79d4d357-a2ee-41e4-b350-2fe39ae59448
+```
+
+<!-- cache-key: cdktf-0.18.0 input-deb204f04b1d3b40e9230a8529e261bf3e35a0ba36cd5b092788c3a247d424f1 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/codestarconnections_host.markdown b/website/docs/cdktf/typescript/r/codestarconnections_host.markdown
new file mode 100644
index 00000000000..fec951e0c45
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/codestarconnections_host.markdown
@@ -0,0 +1,87 @@
+---
+subcategory: "CodeStar Connections"
+layout: "aws"
+page_title: "AWS: aws_codestarconnections_host"
+description: |-
+  Provides a CodeStar Host
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_codestarconnections_host
+
+Provides a CodeStar Host.
+
+~> **NOTE:** The `awsCodestarconnectionsHost` resource is created in the state `pending`. Authentication with the host provider must be completed in the AWS Console. For more information visit [Set up a pending host](https://docs.aws.amazon.com/dtconsole/latest/userguide/connections-host-setup.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CodestarconnectionsHost } from "./.gen/providers/aws/codestarconnections-host";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new CodestarconnectionsHost(this, "example", {
+      name: "example-host",
+      providerEndpoint: "https://example.com",
+      providerType: "GitHubEnterpriseServer",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the host to be created. The name must be unique in the calling AWS account.
+* `providerEndpoint` - (Required) The endpoint of the infrastructure to be represented by the host after it is created.
+* `providerType` - (Required) The name of the external provider where your third-party code repository is configured.
+* `vpcConfiguration` - (Optional) The VPC configuration to be provisioned for the host. A VPC must be configured, and the infrastructure to be represented by the host must already be connected to the VPC.
+
+A `vpcConfiguration` block supports the following arguments:
+
+* `securityGroupIds` - (Required) ID of the security group or security groups associated with the Amazon VPC connected to the infrastructure where your provider type is installed.
+* `subnetIds` - (Required) The ID of the subnet or subnets associated with the Amazon VPC connected to the infrastructure where your provider type is installed.
+* `tlsCertificate` - (Optional) The value of the Transport Layer Security (TLS) certificate associated with the infrastructure where your provider type is installed.
+* `vpcId` - (Required) The ID of the Amazon VPC connected to the infrastructure where your provider type is installed.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The CodeStar Host ARN.
+* `arn` - The CodeStar Host ARN.
+* `status` - The CodeStar Host status. Possible values are `pending`, `available`, `vpcConfigDeleting`, `vpcConfigInitializing`, and `vpcConfigFailedInitialization`.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CodeStar Host using the ARN. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import CodeStar Host using the ARN. For example:
+
+```console
+% terraform import aws_codestarconnections_host.example-host arn:aws:codestar-connections:us-west-1:0123456789:host/79d4d357-a2ee-41e4-b350-2fe39ae59448
+```
+
+<!-- cache-key: cdktf-0.18.0 input-deb204f04b1d3b40e9230a8529e261bf3e35a0ba36cd5b092788c3a247d424f1 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/codestarnotifications_notification_rule.html.markdown b/website/docs/cdktf/typescript/r/codestarnotifications_notification_rule.html.markdown
new file mode 100644
index 00000000000..845badeec75
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/codestarnotifications_notification_rule.html.markdown
@@ -0,0 +1,121 @@
+---
+subcategory: "CodeStar Notifications"
+layout: "aws"
+page_title: "AWS: aws_codestarnotifications_notification_rule"
+description: |-
+  Provides a CodeStar Notifications Rule
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_codestarnotifications_notification_rule
+
+Provides a CodeStar Notifications Rule.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CodecommitRepository } from "./.gen/providers/aws/codecommit-repository";
+import { CodestarnotificationsNotificationRule } from "./.gen/providers/aws/codestarnotifications-notification-rule";
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { SnsTopic } from "./.gen/providers/aws/sns-topic";
+import { SnsTopicPolicy } from "./.gen/providers/aws/sns-topic-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const code = new CodecommitRepository(this, "code", {
+      repositoryName: "example-code-repo",
+    });
+    const notif = new SnsTopic(this, "notif", {
+      name: "notification",
+    });
+    const notifAccess = new DataAwsIamPolicyDocument(this, "notif_access", {
+      statement: [
+        {
+          actions: ["sns:Publish"],
+          principals: [
+            {
+              identifiers: ["codestar-notifications.amazonaws.com"],
+              type: "Service",
+            },
+          ],
+          resources: [notif.arn],
+        },
+      ],
+    });
+    new CodestarnotificationsNotificationRule(this, "commits", {
+      detailType: "BASIC",
+      eventTypeIds: ["codecommit-repository-comments-on-commits"],
+      name: "example-code-repo-commits",
+      resource: code.arn,
+      target: [
+        {
+          address: notif.arn,
+        },
+      ],
+    });
+    new SnsTopicPolicy(this, "default", {
+      arn: notif.arn,
+      policy: Token.asString(notifAccess.json),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `detailType` - (Required) The level of detail to include in the notifications for this resource. Possible values are `basic` and `full`.
+* `eventTypeIds` - (Required) A list of event types associated with this notification rule.
+  For list of allowed events see [here](https://docs.aws.amazon.com/codestar-notifications/latest/userguide/concepts.html#concepts-api).
+* `name` - (Required) The name of notification rule.
+* `resource` - (Required) The ARN of the resource to associate with the notification rule.
+* `status` - (Optional) The status of the notification rule. Possible values are `enabled` and `disabled`, default is `enabled`.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `target` - (Optional) Configuration blocks containing notification target information. Can be specified multiple times. At least one target must be specified on creation.
+
+An `target` block supports the following arguments:
+
+* `address` - (Required) The ARN of notification rule target. For example, a SNS Topic ARN.
+* `type` - (Optional) The type of the notification target. Default value is `sns`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The codestar notification rule ARN.
+* `arn` - The codestar notification rule ARN.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CodeStar notification rule using the ARN. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import CodeStar notification rule using the ARN. For example:
+
+```console
+% terraform import aws_codestarnotifications_notification_rule.foo arn:aws:codestar-notifications:us-west-1:0123456789:notificationrule/2cdc68a3-8f7c-4893-b6a5-45b362bd4f2b
+```
+
+<!-- cache-key: cdktf-0.18.0 input-4e53883c7fac8ce18f0f284d8670fbec11d282232b37f3e8c5d77110845632ed -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/codestarnotifications_notification_rule.markdown b/website/docs/cdktf/typescript/r/codestarnotifications_notification_rule.markdown
new file mode 100644
index 00000000000..845badeec75
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/codestarnotifications_notification_rule.markdown
@@ -0,0 +1,121 @@
+---
+subcategory: "CodeStar Notifications"
+layout: "aws"
+page_title: "AWS: aws_codestarnotifications_notification_rule"
+description: |-
+  Provides a CodeStar Notifications Rule
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_codestarnotifications_notification_rule
+
+Provides a CodeStar Notifications Rule.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CodecommitRepository } from "./.gen/providers/aws/codecommit-repository";
+import { CodestarnotificationsNotificationRule } from "./.gen/providers/aws/codestarnotifications-notification-rule";
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { SnsTopic } from "./.gen/providers/aws/sns-topic";
+import { SnsTopicPolicy } from "./.gen/providers/aws/sns-topic-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const code = new CodecommitRepository(this, "code", {
+      repositoryName: "example-code-repo",
+    });
+    const notif = new SnsTopic(this, "notif", {
+      name: "notification",
+    });
+    const notifAccess = new DataAwsIamPolicyDocument(this, "notif_access", {
+      statement: [
+        {
+          actions: ["sns:Publish"],
+          principals: [
+            {
+              identifiers: ["codestar-notifications.amazonaws.com"],
+              type: "Service",
+            },
+          ],
+          resources: [notif.arn],
+        },
+      ],
+    });
+    new CodestarnotificationsNotificationRule(this, "commits", {
+      detailType: "BASIC",
+      eventTypeIds: ["codecommit-repository-comments-on-commits"],
+      name: "example-code-repo-commits",
+      resource: code.arn,
+      target: [
+        {
+          address: notif.arn,
+        },
+      ],
+    });
+    new SnsTopicPolicy(this, "default", {
+      arn: notif.arn,
+      policy: Token.asString(notifAccess.json),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `detailType` - (Required) The level of detail to include in the notifications for this resource. Possible values are `basic` and `full`.
+* `eventTypeIds` - (Required) A list of event types associated with this notification rule.
+  For list of allowed events see [here](https://docs.aws.amazon.com/codestar-notifications/latest/userguide/concepts.html#concepts-api).
+* `name` - (Required) The name of notification rule.
+* `resource` - (Required) The ARN of the resource to associate with the notification rule.
+* `status` - (Optional) The status of the notification rule. Possible values are `enabled` and `disabled`, default is `enabled`.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `target` - (Optional) Configuration blocks containing notification target information. Can be specified multiple times. At least one target must be specified on creation.
+
+An `target` block supports the following arguments:
+
+* `address` - (Required) The ARN of notification rule target. For example, a SNS Topic ARN.
+* `type` - (Optional) The type of the notification target. Default value is `sns`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The codestar notification rule ARN.
+* `arn` - The codestar notification rule ARN.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CodeStar notification rule using the ARN. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import CodeStar notification rule using the ARN. For example:
+
+```console
+% terraform import aws_codestarnotifications_notification_rule.foo arn:aws:codestar-notifications:us-west-1:0123456789:notificationrule/2cdc68a3-8f7c-4893-b6a5-45b362bd4f2b
+```
+
+<!-- cache-key: cdktf-0.18.0 input-4e53883c7fac8ce18f0f284d8670fbec11d282232b37f3e8c5d77110845632ed -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/cognito_identity_pool.html.markdown b/website/docs/cdktf/typescript/r/cognito_identity_pool.html.markdown
new file mode 100644
index 00000000000..02e60ced384
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/cognito_identity_pool.html.markdown
@@ -0,0 +1,117 @@
+---
+subcategory: "Cognito Identity"
+layout: "aws"
+page_title: "AWS: aws_cognito_identity_pool"
+description: |-
+  Provides an AWS Cognito Identity Pool.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cognito_identity_pool
+
+Provides an AWS Cognito Identity Pool.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CognitoIdentityPool } from "./.gen/providers/aws/cognito-identity-pool";
+import { IamSamlProvider } from "./.gen/providers/aws/iam-saml-provider";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const defaultVar = new IamSamlProvider(this, "default", {
+      name: "my-saml-provider",
+      samlMetadataDocument: Token.asString(Fn.file("saml-metadata.xml")),
+    });
+    new CognitoIdentityPool(this, "main", {
+      allowClassicFlow: false,
+      allowUnauthenticatedIdentities: false,
+      cognitoIdentityProviders: [
+        {
+          clientId: "6lhlkkfbfb4q5kpp90urffae",
+          providerName:
+            "cognito-idp.us-east-1.amazonaws.com/us-east-1_Tv0493apJ",
+          serverSideTokenCheck: false,
+        },
+        {
+          clientId: "7kodkvfqfb4qfkp39eurffae",
+          providerName:
+            "cognito-idp.us-east-1.amazonaws.com/eu-west-1_Zr231apJu",
+          serverSideTokenCheck: false,
+        },
+      ],
+      identityPoolName: "identity pool",
+      openidConnectProviderArns: [
+        "arn:aws:iam::123456789012:oidc-provider/id.example.com",
+      ],
+      samlProviderArns: [defaultVar.arn],
+      supportedLoginProviders: {
+        "accounts.google.com": "123456789012.apps.googleusercontent.com",
+        "graph.facebook.com": "7346241598935552",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The Cognito Identity Pool argument layout is a structure composed of several sub-resources - these resources are laid out below.
+
+* `identityPoolName` (Required) - The Cognito Identity Pool name.
+* `allowUnauthenticatedIdentities` (Required) - Whether the identity pool supports unauthenticated logins or not.
+* `allowClassicFlow` (Optional) - Enables or disables the classic / basic authentication flow. Default is `false`.
+* `developerProviderName` (Optional) - The "domain" by which Cognito will refer to your users. This name acts as a placeholder that allows your
+backend and the Cognito service to communicate about the developer provider.
+* `cognitoIdentityProviders` (Optional) - An array of [Amazon Cognito Identity user pools](#cognito-identity-providers) and their client IDs.
+* `openidConnectProviderArns` (Optional) - Set of OpendID Connect provider ARNs.
+* `samlProviderArns` (Optional) - An array of Amazon Resource Names (ARNs) of the SAML provider for your identity.
+* `supportedLoginProviders` (Optional) - Key-Value pairs mapping provider names to provider app IDs.
+* `tags` - (Optional) A map of tags to assign to the Identity Pool. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+#### Cognito Identity Providers
+
+* `clientId` (Optional) - The client ID for the Amazon Cognito Identity User Pool.
+* `providerName` (Optional) - The provider name for an Amazon Cognito Identity User Pool.
+* `serverSideTokenCheck` (Optional) - Whether server-side token validation is enabled for the identity provider’s token or not.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - An identity pool ID, e.g. `usWest2:1A2345678901234B5CdeF6789G01H2I3`.
+* `arn` - The ARN of the identity pool.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Cognito Identity Pool using its ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Cognito Identity Pool using its ID. For example:
+
+```console
+% terraform import aws_cognito_identity_pool.mypool us-west-2:1a234567-8901-234b-5cde-f6789g01h2i3
+```
+
+<!-- cache-key: cdktf-0.18.0 input-6cea6e360281bc475ea8b2d012b8c1df933a00c36975d5e9256c0c0610277b76 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/cognito_identity_pool.markdown b/website/docs/cdktf/typescript/r/cognito_identity_pool.markdown
new file mode 100644
index 00000000000..02e60ced384
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/cognito_identity_pool.markdown
@@ -0,0 +1,117 @@
+---
+subcategory: "Cognito Identity"
+layout: "aws"
+page_title: "AWS: aws_cognito_identity_pool"
+description: |-
+  Provides an AWS Cognito Identity Pool.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cognito_identity_pool
+
+Provides an AWS Cognito Identity Pool.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CognitoIdentityPool } from "./.gen/providers/aws/cognito-identity-pool";
+import { IamSamlProvider } from "./.gen/providers/aws/iam-saml-provider";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const defaultVar = new IamSamlProvider(this, "default", {
+      name: "my-saml-provider",
+      samlMetadataDocument: Token.asString(Fn.file("saml-metadata.xml")),
+    });
+    new CognitoIdentityPool(this, "main", {
+      allowClassicFlow: false,
+      allowUnauthenticatedIdentities: false,
+      cognitoIdentityProviders: [
+        {
+          clientId: "6lhlkkfbfb4q5kpp90urffae",
+          providerName:
+            "cognito-idp.us-east-1.amazonaws.com/us-east-1_Tv0493apJ",
+          serverSideTokenCheck: false,
+        },
+        {
+          clientId: "7kodkvfqfb4qfkp39eurffae",
+          providerName:
+            "cognito-idp.us-east-1.amazonaws.com/eu-west-1_Zr231apJu",
+          serverSideTokenCheck: false,
+        },
+      ],
+      identityPoolName: "identity pool",
+      openidConnectProviderArns: [
+        "arn:aws:iam::123456789012:oidc-provider/id.example.com",
+      ],
+      samlProviderArns: [defaultVar.arn],
+      supportedLoginProviders: {
+        "accounts.google.com": "123456789012.apps.googleusercontent.com",
+        "graph.facebook.com": "7346241598935552",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The Cognito Identity Pool argument layout is a structure composed of several sub-resources - these resources are laid out below.
+
+* `identityPoolName` (Required) - The Cognito Identity Pool name.
+* `allowUnauthenticatedIdentities` (Required) - Whether the identity pool supports unauthenticated logins or not.
+* `allowClassicFlow` (Optional) - Enables or disables the classic / basic authentication flow. Default is `false`.
+* `developerProviderName` (Optional) - The "domain" by which Cognito will refer to your users. This name acts as a placeholder that allows your
+backend and the Cognito service to communicate about the developer provider.
+* `cognitoIdentityProviders` (Optional) - An array of [Amazon Cognito Identity user pools](#cognito-identity-providers) and their client IDs.
+* `openidConnectProviderArns` (Optional) - Set of OpendID Connect provider ARNs.
+* `samlProviderArns` (Optional) - An array of Amazon Resource Names (ARNs) of the SAML provider for your identity.
+* `supportedLoginProviders` (Optional) - Key-Value pairs mapping provider names to provider app IDs.
+* `tags` - (Optional) A map of tags to assign to the Identity Pool. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+#### Cognito Identity Providers
+
+* `clientId` (Optional) - The client ID for the Amazon Cognito Identity User Pool.
+* `providerName` (Optional) - The provider name for an Amazon Cognito Identity User Pool.
+* `serverSideTokenCheck` (Optional) - Whether server-side token validation is enabled for the identity provider’s token or not.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - An identity pool ID, e.g. `usWest2:1A2345678901234B5CdeF6789G01H2I3`.
+* `arn` - The ARN of the identity pool.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Cognito Identity Pool using its ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Cognito Identity Pool using its ID. For example:
+
+```console
+% terraform import aws_cognito_identity_pool.mypool us-west-2:1a234567-8901-234b-5cde-f6789g01h2i3
+```
+
+<!-- cache-key: cdktf-0.18.0 input-6cea6e360281bc475ea8b2d012b8c1df933a00c36975d5e9256c0c0610277b76 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/cognito_identity_pool_provider_principal_tag.html.markdown b/website/docs/cdktf/typescript/r/cognito_identity_pool_provider_principal_tag.html.markdown
new file mode 100644
index 00000000000..f59c5e0cc8a
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/cognito_identity_pool_provider_principal_tag.html.markdown
@@ -0,0 +1,119 @@
+---
+subcategory: "Cognito Identity"
+layout: "aws"
+page_title: "AWS: aws_cognito_identity_pool_provider_principal_tag"
+description: |-
+  Provides an AWS Cognito Identity Principal Mapping.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cognito_identity_pool_provider_principal_tag
+
+Provides an AWS Cognito Identity Principal Mapping.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CognitoIdentityPool } from "./.gen/providers/aws/cognito-identity-pool";
+import { CognitoIdentityPoolProviderPrincipalTag } from "./.gen/providers/aws/cognito-identity-pool-provider-principal-tag";
+import { CognitoUserPool } from "./.gen/providers/aws/cognito-user-pool";
+import { CognitoUserPoolClient } from "./.gen/providers/aws/cognito-user-pool-client";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new CognitoUserPool(this, "example", {
+      autoVerifiedAttributes: ["email"],
+      name: "user pool",
+    });
+    const awsCognitoUserPoolClientExample = new CognitoUserPoolClient(
+      this,
+      "example_1",
+      {
+        name: "client",
+        supportedIdentityProviders: Token.asList(
+          Fn.compact(Token.asList(["COGNITO"]))
+        ),
+        userPoolId: example.id,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsCognitoUserPoolClientExample.overrideLogicalId("example");
+    const awsCognitoIdentityPoolExample = new CognitoIdentityPool(
+      this,
+      "example_2",
+      {
+        allowUnauthenticatedIdentities: false,
+        cognitoIdentityProviders: [
+          {
+            clientId: Token.asString(awsCognitoUserPoolClientExample.id),
+            providerName: example.endpoint,
+            serverSideTokenCheck: false,
+          },
+        ],
+        identityPoolName: "identity pool",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsCognitoIdentityPoolExample.overrideLogicalId("example");
+    const awsCognitoIdentityPoolProviderPrincipalTagExample =
+      new CognitoIdentityPoolProviderPrincipalTag(this, "example_3", {
+        identityPoolId: Token.asString(awsCognitoIdentityPoolExample.id),
+        identityProviderName: example.endpoint,
+        principalTags: {
+          test: "value",
+        },
+        useDefaults: false,
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsCognitoIdentityPoolProviderPrincipalTagExample.overrideLogicalId(
+      "example"
+    );
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `identityPoolId` (Required) - An identity pool ID.
+* `identityProviderName` (Required) - The name of the identity provider.
+* `principalTags`: (Optional: []) - String to string map of variables.
+* `useDefaults`: (Optional: true) use default (username and clientID) attribute mappings.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Cognito Identity Pool Roles Attachment using the Identity Pool ID and provider name. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Cognito Identity Pool Roles Attachment using the Identity Pool ID and provider name. For example:
+
+```console
+% terraform import aws_cognito_identity_pool_provider_principal_tag.example us-west-2_abc123:CorpAD
+```
+
+<!-- cache-key: cdktf-0.18.0 input-d4f777a31b91b31ab50e67859396a09149b958fe813bebf15e96c5dcc295d8be -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/cognito_identity_pool_provider_principal_tag.markdown b/website/docs/cdktf/typescript/r/cognito_identity_pool_provider_principal_tag.markdown
new file mode 100644
index 00000000000..f59c5e0cc8a
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/cognito_identity_pool_provider_principal_tag.markdown
@@ -0,0 +1,119 @@
+---
+subcategory: "Cognito Identity"
+layout: "aws"
+page_title: "AWS: aws_cognito_identity_pool_provider_principal_tag"
+description: |-
+  Provides an AWS Cognito Identity Principal Mapping.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cognito_identity_pool_provider_principal_tag
+
+Provides an AWS Cognito Identity Principal Mapping.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CognitoIdentityPool } from "./.gen/providers/aws/cognito-identity-pool";
+import { CognitoIdentityPoolProviderPrincipalTag } from "./.gen/providers/aws/cognito-identity-pool-provider-principal-tag";
+import { CognitoUserPool } from "./.gen/providers/aws/cognito-user-pool";
+import { CognitoUserPoolClient } from "./.gen/providers/aws/cognito-user-pool-client";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new CognitoUserPool(this, "example", {
+      autoVerifiedAttributes: ["email"],
+      name: "user pool",
+    });
+    const awsCognitoUserPoolClientExample = new CognitoUserPoolClient(
+      this,
+      "example_1",
+      {
+        name: "client",
+        supportedIdentityProviders: Token.asList(
+          Fn.compact(Token.asList(["COGNITO"]))
+        ),
+        userPoolId: example.id,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsCognitoUserPoolClientExample.overrideLogicalId("example");
+    const awsCognitoIdentityPoolExample = new CognitoIdentityPool(
+      this,
+      "example_2",
+      {
+        allowUnauthenticatedIdentities: false,
+        cognitoIdentityProviders: [
+          {
+            clientId: Token.asString(awsCognitoUserPoolClientExample.id),
+            providerName: example.endpoint,
+            serverSideTokenCheck: false,
+          },
+        ],
+        identityPoolName: "identity pool",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsCognitoIdentityPoolExample.overrideLogicalId("example");
+    const awsCognitoIdentityPoolProviderPrincipalTagExample =
+      new CognitoIdentityPoolProviderPrincipalTag(this, "example_3", {
+        identityPoolId: Token.asString(awsCognitoIdentityPoolExample.id),
+        identityProviderName: example.endpoint,
+        principalTags: {
+          test: "value",
+        },
+        useDefaults: false,
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsCognitoIdentityPoolProviderPrincipalTagExample.overrideLogicalId(
+      "example"
+    );
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `identityPoolId` (Required) - An identity pool ID.
+* `identityProviderName` (Required) - The name of the identity provider.
+* `principalTags`: (Optional: []) - String to string map of variables.
+* `useDefaults`: (Optional: true) use default (username and clientID) attribute mappings.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Cognito Identity Pool Roles Attachment using the Identity Pool ID and provider name. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Cognito Identity Pool Roles Attachment using the Identity Pool ID and provider name. For example:
+
+```console
+% terraform import aws_cognito_identity_pool_provider_principal_tag.example us-west-2_abc123:CorpAD
+```
+
+<!-- cache-key: cdktf-0.18.0 input-d4f777a31b91b31ab50e67859396a09149b958fe813bebf15e96c5dcc295d8be -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/cognito_identity_pool_roles_attachment.html.markdown b/website/docs/cdktf/typescript/r/cognito_identity_pool_roles_attachment.html.markdown
new file mode 100644
index 00000000000..f87816b6c4b
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/cognito_identity_pool_roles_attachment.html.markdown
@@ -0,0 +1,179 @@
+---
+subcategory: "Cognito Identity"
+layout: "aws"
+page_title: "AWS: aws_cognito_identity_pool_roles_attachment"
+description: |-
+  Provides an AWS Cognito Identity Pool Roles Attachment.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cognito_identity_pool_roles_attachment
+
+Provides an AWS Cognito Identity Pool Roles Attachment.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CognitoIdentityPool } from "./.gen/providers/aws/cognito-identity-pool";
+import { CognitoIdentityPoolRolesAttachment } from "./.gen/providers/aws/cognito-identity-pool-roles-attachment";
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+import { IamRolePolicy } from "./.gen/providers/aws/iam-role-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const main = new CognitoIdentityPool(this, "main", {
+      allowUnauthenticatedIdentities: false,
+      identityPoolName: "identity pool",
+      supportedLoginProviders: {
+        "graph.facebook.com": "7346241598935555",
+      },
+    });
+    const authenticated = new DataAwsIamPolicyDocument(this, "authenticated", {
+      statement: [
+        {
+          actions: ["sts:AssumeRoleWithWebIdentity"],
+          condition: [
+            {
+              test: "StringEquals",
+              values: [main.id],
+              variable: "cognito-identity.amazonaws.com:aud",
+            },
+            {
+              test: "ForAnyValue:StringLike",
+              values: ["authenticated"],
+              variable: "cognito-identity.amazonaws.com:amr",
+            },
+          ],
+          effect: "Allow",
+          principals: [
+            {
+              identifiers: ["cognito-identity.amazonaws.com"],
+              type: "Federated",
+            },
+          ],
+        },
+      ],
+    });
+    const authenticatedRolePolicy = new DataAwsIamPolicyDocument(
+      this,
+      "authenticated_role_policy",
+      {
+        statement: [
+          {
+            actions: [
+              "mobileanalytics:PutEvents",
+              "cognito-sync:*",
+              "cognito-identity:*",
+            ],
+            effect: "Allow",
+            resources: ["*"],
+          },
+        ],
+      }
+    );
+    const awsIamRoleAuthenticated = new IamRole(this, "authenticated_3", {
+      assumeRolePolicy: Token.asString(authenticated.json),
+      name: "cognito_authenticated",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamRoleAuthenticated.overrideLogicalId("authenticated");
+    const awsIamRolePolicyAuthenticated = new IamRolePolicy(
+      this,
+      "authenticated_4",
+      {
+        name: "authenticated_policy",
+        policy: Token.asString(authenticatedRolePolicy.json),
+        role: Token.asString(awsIamRoleAuthenticated.id),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamRolePolicyAuthenticated.overrideLogicalId("authenticated");
+    const awsCognitoIdentityPoolRolesAttachmentMain =
+      new CognitoIdentityPoolRolesAttachment(this, "main_5", {
+        identityPoolId: main.id,
+        roleMapping: [
+          {
+            ambiguousRoleResolution: "AuthenticatedRole",
+            identityProvider: "graph.facebook.com",
+            mappingRule: [
+              {
+                claim: "isAdmin",
+                matchType: "Equals",
+                roleArn: Token.asString(awsIamRoleAuthenticated.arn),
+                value: "paid",
+              },
+            ],
+            type: "Rules",
+          },
+        ],
+        roles: {
+          authenticated: Token.asString(awsIamRoleAuthenticated.arn),
+        },
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsCognitoIdentityPoolRolesAttachmentMain.overrideLogicalId("main");
+  }
+}
+
+```
+
+## Argument Reference
+
+The Cognito Identity Pool Roles Attachment argument layout is a structure composed of several sub-resources - these resources are laid out below.
+
+* `identityPoolId` (Required) - An identity pool ID in the format `regionGuid`.
+* `roleMapping` (Optional) - A List of [Role Mapping](#role-mappings).
+* `roles` (Required) - The map of roles associated with this pool. For a given role, the key will be either "authenticated" or "unauthenticated" and the value will be the Role ARN.
+
+#### Role Mappings
+
+* `identityProvider` (Required) - A string identifying the identity provider, for example, "graph.facebook.com" or "cognito-idp.us-east-1.amazonaws.com/us-east-1_abcdefghi:app_client_id". Depends on `cognitoIdentityProviders` set on `awsCognitoIdentityPool` resource or a `awsCognitoIdentityProvider` resource.
+* `ambiguousRoleResolution` (Optional) - Specifies the action to be taken if either no rules match the claim value for the Rules type, or there is no cognito:preferred_role claim and there are multiple cognito:roles matches for the Token type. `required` if you specify Token or Rules as the Type.
+* `mappingRule` (Optional) - The [Rules Configuration](#rules-configuration) to be used for mapping users to roles. You can specify up to 25 rules per identity provider. Rules are evaluated in order. The first one to match specifies the role.
+* `type` (Required) - The role mapping type.
+
+#### Rules Configuration
+
+* `claim` (Required) - The claim name that must be present in the token, for example, "isAdmin" or "paid".
+* `matchType` (Required) - The match condition that specifies how closely the claim value in the IdP token must match Value.
+* `roleArn` (Required) - The role ARN.
+* `value` (Required) - A brief string that the claim must match, for example, "paid" or "yes".
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The identity pool ID.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Cognito Identity Pool Roles Attachment using the Identity Pool ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Cognito Identity Pool Roles Attachment using the Identity Pool ID. For example:
+
+```console
+% terraform import aws_cognito_identity_pool_roles_attachment.example us-west-2:b64805ad-cb56-40ba-9ffc-f5d8207e6d42
+```
+
+<!-- cache-key: cdktf-0.18.0 input-74c6734db32e60310fb7b71d1ef7e57fff3eb57e2065822e5e2535d8f77e6646 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/cognito_identity_pool_roles_attachment.markdown b/website/docs/cdktf/typescript/r/cognito_identity_pool_roles_attachment.markdown
new file mode 100644
index 00000000000..f87816b6c4b
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/cognito_identity_pool_roles_attachment.markdown
@@ -0,0 +1,179 @@
+---
+subcategory: "Cognito Identity"
+layout: "aws"
+page_title: "AWS: aws_cognito_identity_pool_roles_attachment"
+description: |-
+  Provides an AWS Cognito Identity Pool Roles Attachment.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cognito_identity_pool_roles_attachment
+
+Provides an AWS Cognito Identity Pool Roles Attachment.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CognitoIdentityPool } from "./.gen/providers/aws/cognito-identity-pool";
+import { CognitoIdentityPoolRolesAttachment } from "./.gen/providers/aws/cognito-identity-pool-roles-attachment";
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+import { IamRolePolicy } from "./.gen/providers/aws/iam-role-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const main = new CognitoIdentityPool(this, "main", {
+      allowUnauthenticatedIdentities: false,
+      identityPoolName: "identity pool",
+      supportedLoginProviders: {
+        "graph.facebook.com": "7346241598935555",
+      },
+    });
+    const authenticated = new DataAwsIamPolicyDocument(this, "authenticated", {
+      statement: [
+        {
+          actions: ["sts:AssumeRoleWithWebIdentity"],
+          condition: [
+            {
+              test: "StringEquals",
+              values: [main.id],
+              variable: "cognito-identity.amazonaws.com:aud",
+            },
+            {
+              test: "ForAnyValue:StringLike",
+              values: ["authenticated"],
+              variable: "cognito-identity.amazonaws.com:amr",
+            },
+          ],
+          effect: "Allow",
+          principals: [
+            {
+              identifiers: ["cognito-identity.amazonaws.com"],
+              type: "Federated",
+            },
+          ],
+        },
+      ],
+    });
+    const authenticatedRolePolicy = new DataAwsIamPolicyDocument(
+      this,
+      "authenticated_role_policy",
+      {
+        statement: [
+          {
+            actions: [
+              "mobileanalytics:PutEvents",
+              "cognito-sync:*",
+              "cognito-identity:*",
+            ],
+            effect: "Allow",
+            resources: ["*"],
+          },
+        ],
+      }
+    );
+    const awsIamRoleAuthenticated = new IamRole(this, "authenticated_3", {
+      assumeRolePolicy: Token.asString(authenticated.json),
+      name: "cognito_authenticated",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamRoleAuthenticated.overrideLogicalId("authenticated");
+    const awsIamRolePolicyAuthenticated = new IamRolePolicy(
+      this,
+      "authenticated_4",
+      {
+        name: "authenticated_policy",
+        policy: Token.asString(authenticatedRolePolicy.json),
+        role: Token.asString(awsIamRoleAuthenticated.id),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamRolePolicyAuthenticated.overrideLogicalId("authenticated");
+    const awsCognitoIdentityPoolRolesAttachmentMain =
+      new CognitoIdentityPoolRolesAttachment(this, "main_5", {
+        identityPoolId: main.id,
+        roleMapping: [
+          {
+            ambiguousRoleResolution: "AuthenticatedRole",
+            identityProvider: "graph.facebook.com",
+            mappingRule: [
+              {
+                claim: "isAdmin",
+                matchType: "Equals",
+                roleArn: Token.asString(awsIamRoleAuthenticated.arn),
+                value: "paid",
+              },
+            ],
+            type: "Rules",
+          },
+        ],
+        roles: {
+          authenticated: Token.asString(awsIamRoleAuthenticated.arn),
+        },
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsCognitoIdentityPoolRolesAttachmentMain.overrideLogicalId("main");
+  }
+}
+
+```
+
+## Argument Reference
+
+The Cognito Identity Pool Roles Attachment argument layout is a structure composed of several sub-resources - these resources are laid out below.
+
+* `identityPoolId` (Required) - An identity pool ID in the format `regionGuid`.
+* `roleMapping` (Optional) - A List of [Role Mapping](#role-mappings).
+* `roles` (Required) - The map of roles associated with this pool. For a given role, the key will be either "authenticated" or "unauthenticated" and the value will be the Role ARN.
+
+#### Role Mappings
+
+* `identityProvider` (Required) - A string identifying the identity provider, for example, "graph.facebook.com" or "cognito-idp.us-east-1.amazonaws.com/us-east-1_abcdefghi:app_client_id". Depends on `cognitoIdentityProviders` set on `awsCognitoIdentityPool` resource or a `awsCognitoIdentityProvider` resource.
+* `ambiguousRoleResolution` (Optional) - Specifies the action to be taken if either no rules match the claim value for the Rules type, or there is no cognito:preferred_role claim and there are multiple cognito:roles matches for the Token type. `required` if you specify Token or Rules as the Type.
+* `mappingRule` (Optional) - The [Rules Configuration](#rules-configuration) to be used for mapping users to roles. You can specify up to 25 rules per identity provider. Rules are evaluated in order. The first one to match specifies the role.
+* `type` (Required) - The role mapping type.
+
+#### Rules Configuration
+
+* `claim` (Required) - The claim name that must be present in the token, for example, "isAdmin" or "paid".
+* `matchType` (Required) - The match condition that specifies how closely the claim value in the IdP token must match Value.
+* `roleArn` (Required) - The role ARN.
+* `value` (Required) - A brief string that the claim must match, for example, "paid" or "yes".
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The identity pool ID.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Cognito Identity Pool Roles Attachment using the Identity Pool ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Cognito Identity Pool Roles Attachment using the Identity Pool ID. For example:
+
+```console
+% terraform import aws_cognito_identity_pool_roles_attachment.example us-west-2:b64805ad-cb56-40ba-9ffc-f5d8207e6d42
+```
+
+<!-- cache-key: cdktf-0.18.0 input-74c6734db32e60310fb7b71d1ef7e57fff3eb57e2065822e5e2535d8f77e6646 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/cognito_identity_provider.html.markdown b/website/docs/cdktf/typescript/r/cognito_identity_provider.html.markdown
new file mode 100644
index 00000000000..10985dd7c8c
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/cognito_identity_provider.html.markdown
@@ -0,0 +1,91 @@
+---
+subcategory: "Cognito IDP (Identity Provider)"
+layout: "aws"
+page_title: "AWS: aws_cognito_identity_provider"
+side_bar_current: "docs-aws-resource-cognito-identity-provider"
+description: |-
+  Provides a Cognito User Identity Provider resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cognito_identity_provider
+
+Provides a Cognito User Identity Provider resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CognitoIdentityProvider } from "./.gen/providers/aws/cognito-identity-provider";
+import { CognitoUserPool } from "./.gen/providers/aws/cognito-user-pool";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new CognitoUserPool(this, "example", {
+      autoVerifiedAttributes: ["email"],
+      name: "example-pool",
+    });
+    new CognitoIdentityProvider(this, "example_provider", {
+      attributeMapping: {
+        email: "email",
+        username: "sub",
+      },
+      providerDetails: {
+        authorize_scopes: "email",
+        client_id: "your client_id",
+        client_secret: "your client_secret",
+      },
+      providerName: "Google",
+      providerType: "Google",
+      userPoolId: example.id,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `userPoolId` (Required) - The user pool id
+* `providerName` (Required) - The provider name
+* `providerType` (Required) - The provider type.  [See AWS API for valid values](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_CreateIdentityProvider.html#CognitoUserPools-CreateIdentityProvider-request-ProviderType)
+* `attributeMapping` (Optional) - The map of attribute mapping of user pool attributes. [AttributeMapping in AWS API documentation](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_CreateIdentityProvider.html#CognitoUserPools-CreateIdentityProvider-request-AttributeMapping)
+* `idpIdentifiers` (Optional) - The list of identity providers.
+* `providerDetails` (Optional) - The map of identity details, such as access token
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsCognitoIdentityProvider` resources using their User Pool ID and Provider Name. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsCognitoIdentityProvider` resources using their User Pool ID and Provider Name. For example:
+
+```console
+% terraform import aws_cognito_identity_provider.example us-west-2_abc123:CorpAD
+```
+
+<!-- cache-key: cdktf-0.18.0 input-6efb87c639b5fd6ebfce1d4da9543ffcb04eb147b8e55d66726d206815799eac -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/cognito_managed_user_pool_client.html.markdown b/website/docs/cdktf/typescript/r/cognito_managed_user_pool_client.html.markdown
new file mode 100644
index 00000000000..9c6574c8781
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/cognito_managed_user_pool_client.html.markdown
@@ -0,0 +1,206 @@
+---
+subcategory: "Cognito IDP (Identity Provider)"
+layout: "aws"
+page_title: "AWS: aws_cognito_managed_user_pool_client"
+description: |-
+  Use the `awsCognitoUserPoolClient` resource to manage a Cognito User Pool Client. This resource is created by another service.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cognito_managed_user_pool_client
+
+Use the `awsCognitoUserPoolClient` resource to manage a Cognito User Pool Client.
+
+**This resource is advanced** and has special caveats to consider before use. Please read this document completely before using the resource.
+
+Use the `awsCognitoManagedUserPoolClient` resource to manage a Cognito User Pool Client that is automatically created by an AWS service. For instance, when [configuring an OpenSearch Domain to use Cognito authentication](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/cognito-auth.html), the OpenSearch service creates the User Pool Client during setup and removes it when it is no longer required. As a result, the `awsCognitoManagedUserPoolClient` resource does not create or delete this resource, but instead assumes management of it.
+
+Use the [`awsCognitoUserPoolClient`](cognito_user_pool_client.html) resource to manage Cognito User Pool Clients for normal use cases.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CognitoIdentityPool } from "./.gen/providers/aws/cognito-identity-pool";
+import { CognitoManagedUserPoolClient } from "./.gen/providers/aws/cognito-managed-user-pool-client";
+import { CognitoUserPool } from "./.gen/providers/aws/cognito-user-pool";
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { DataAwsPartition } from "./.gen/providers/aws/data-aws-partition";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+import { IamRolePolicyAttachment } from "./.gen/providers/aws/iam-role-policy-attachment";
+import { OpensearchDomain } from "./.gen/providers/aws/opensearch-domain";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new CognitoIdentityPool(this, "example", {
+      identityPoolName: "example",
+      lifecycle: {
+        ignoreChanges: [cognitoIdentityProviders],
+      },
+    });
+    const awsCognitoUserPoolExample = new CognitoUserPool(this, "example_1", {
+      name: "example",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsCognitoUserPoolExample.overrideLogicalId("example");
+    const current = new DataAwsPartition(this, "current", {});
+    const dataAwsIamPolicyDocumentExample = new DataAwsIamPolicyDocument(
+      this,
+      "example_3",
+      {
+        statement: [
+          {
+            actions: ["sts:AssumeRole"],
+            effect: "Allow",
+            principals: [
+              {
+                identifiers: ["es.${" + current.dnsSuffix + "}"],
+                type: "Service",
+              },
+            ],
+            sid: "",
+          },
+        ],
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsIamPolicyDocumentExample.overrideLogicalId("example");
+    const awsIamRoleExample = new IamRole(this, "example_4", {
+      assumeRolePolicy: Token.asString(dataAwsIamPolicyDocumentExample.json),
+      name: "example-role",
+      path: "/service-role/",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamRoleExample.overrideLogicalId("example");
+    const awsIamRolePolicyAttachmentExample = new IamRolePolicyAttachment(
+      this,
+      "example_5",
+      {
+        policyArn:
+          "arn:${" +
+          current.partition +
+          "}:iam::aws:policy/AmazonESCognitoAccess",
+        role: Token.asString(awsIamRoleExample.name),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamRolePolicyAttachmentExample.overrideLogicalId("example");
+    const awsOpensearchDomainExample = new OpensearchDomain(this, "example_6", {
+      cognitoOptions: {
+        enabled: true,
+        identityPoolId: example.id,
+        roleArn: Token.asString(awsIamRoleExample.arn),
+        userPoolId: Token.asString(awsCognitoUserPoolExample.id),
+      },
+      dependsOn: [
+        awsCognitoUserPoolDomainExample,
+        awsIamRolePolicyAttachmentExample,
+      ],
+      domainName: "example",
+      ebsOptions: {
+        ebsEnabled: true,
+        volumeSize: 10,
+      },
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsOpensearchDomainExample.overrideLogicalId("example");
+    const awsCognitoManagedUserPoolClientExample =
+      new CognitoManagedUserPoolClient(this, "example_7", {
+        dependsOn: [awsOpensearchDomainExample],
+        namePrefix: "AmazonOpenSearchService-example",
+        userPoolId: Token.asString(awsCognitoUserPoolExample.id),
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsCognitoManagedUserPoolClientExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `userPoolId` - (Required) User pool that the client belongs to.
+* `namePattern` - (Required, one of `namePattern` or `namePrefix`) Regular expression that matches the name of the desired User Pool Client. It must only match one User Pool Client.
+* `namePrefix` - (Required, one of `namePrefix` or `namePattern`) String that matches the beginning of the name of the desired User Pool Client. It must match only one User Pool Client.
+
+The following arguments are optional:
+
+* `accessTokenValidity` - (Optional) Time limit, between 5 minutes and 1 day, after which the access token is no longer valid and cannot be used. By default, the unit is hours. The unit can be overridden by a value in `tokenValidityUnitsAccessToken`.
+* `allowedOauthFlowsUserPoolClient` - (Optional) Whether the client is allowed to use the OAuth protocol when interacting with Cognito user pools.
+* `allowedOauthFlows` - (Optional) List of allowed OAuth flows, including code, implicit, and client_credentials.
+* `allowedOauthScopes` - (Optional) List of allowed OAuth scopes, including phone, email, openid, profile, and aws.cognito.signin.user.admin.
+* `analyticsConfiguration` - (Optional) Configuration block for Amazon Pinpoint analytics that collects metrics for this user pool. See [details below](#analytics_configuration).
+* `authSessionValidity` - (Optional) Duration, in minutes, of the session token created by Amazon Cognito for each API request in an authentication flow. The session token must be responded to by the native user of the user pool before it expires. Valid values for `authSessionValidity` are between `3` and `15`, with a default value of `3`.
+* `callbackUrls` - (Optional) List of allowed callback URLs for the identity providers.
+* `defaultRedirectUri` - (Optional) Default redirect URI and must be included in the list of callback URLs.
+* `enableTokenRevocation` - (Optional) Enables or disables token revocation.
+* `enablePropagateAdditionalUserContextData` - (Optional) Enables the propagation of additional user context data.
+* `explicitAuthFlows` - (Optional) List of authentication flows. The available options include ADMIN_NO_SRP_AUTH, CUSTOM_AUTH_FLOW_ONLY, USER_PASSWORD_AUTH, ALLOW_ADMIN_USER_PASSWORD_AUTH, ALLOW_CUSTOM_AUTH, ALLOW_USER_PASSWORD_AUTH, ALLOW_USER_SRP_AUTH, and ALLOW_REFRESH_TOKEN_AUTH.
+* `generateSecret` - (Optional) Boolean flag indicating whether an application secret should be generated.
+* `idTokenValidity` - (Optional) Time limit, between 5 minutes and 1 day, after which the ID token is no longer valid and cannot be used. By default, the unit is hours. The unit can be overridden by a value in `tokenValidityUnitsIdToken`.
+* `logoutUrls` - (Optional) List of allowed logout URLs for the identity providers.
+* `preventUserExistenceErrors` - (Optional) Setting determines the errors and responses returned by Cognito APIs when a user does not exist in the user pool during authentication, account confirmation, and password recovery.
+* `readAttributes` - (Optional) List of user pool attributes that the application client can read from.
+* `refreshTokenValidity` - (Optional) Time limit, between 60 minutes and 10 years, after which the refresh token is no longer valid and cannot be used. By default, the unit is days. The unit can be overridden by a value in `tokenValidityUnitsRefreshToken`.
+* `supportedIdentityProviders` - (Optional) List of provider names for the identity providers that are supported on this client. It uses the `providerName` attribute of the `awsCognitoIdentityProvider` resource(s), or the equivalent string(s).
+* `tokenValidityUnits` - (Optional) Configuration block for representing the validity times in units. See details below. [Detailed below](#token_validity_units).
+* `writeAttributes` - (Optional) List of user pool attributes that the application client can write to.
+
+### analytics_configuration
+
+Either `applicationArn` or `applicationId` is required for this configuration block.
+
+* `applicationArn` - (Optional) Application ARN for an Amazon Pinpoint application. It conflicts with `externalId` and `roleArn`.
+* `applicationId` - (Optional) Unique identifier for an Amazon Pinpoint application.
+* `externalId` - (Optional) ID for the Analytics Configuration and conflicts with `applicationArn`.
+* `roleArn` - (Optional) ARN of an IAM role that authorizes Amazon Cognito to publish events to Amazon Pinpoint analytics. It conflicts with `applicationArn`.
+* `userDataShared` - (Optional) If `userDataShared` is set to `true`, Amazon Cognito will include user data in the events it publishes to Amazon Pinpoint analytics.
+
+### token_validity_units
+
+Valid values for the following arguments are: `seconds`, `minutes`, `hours`, or `days`.
+
+* `accessToken` - (Optional) Time unit for the value in `accessTokenValidity` and defaults to `hours`.
+* `idToken` - (Optional) Time unit for the value in `idTokenValidity`, and it defaults to `hours`.
+* `refreshToken` - (Optional) Time unit for the value in `refreshTokenValidity` and defaults to `days`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `clientSecret` - Client secret of the user pool client.
+* `id` - Unique identifier for the user pool client.
+* `name` - Name of the user pool client.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Cognito User Pool Clients using the `id` of the Cognito User Pool and the `id` of the Cognito User Pool Client. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Cognito User Pool Clients using the `id` of the Cognito User Pool and the `id` of the Cognito User Pool Client. For example:
+
+```console
+% terraform import aws_cognito_managed_user_pool_client.client us-west-2_abc123/3ho4ek12345678909nh3fmhpko
+```
+
+<!-- cache-key: cdktf-0.18.0 input-09a5545a9b1f170005d5b45885469f05e619194057d0005875513587b0db3def -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/cognito_resource_server.html.markdown b/website/docs/cdktf/typescript/r/cognito_resource_server.html.markdown
new file mode 100644
index 00000000000..5d2d6add28c
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/cognito_resource_server.html.markdown
@@ -0,0 +1,121 @@
+---
+subcategory: "Cognito IDP (Identity Provider)"
+layout: "aws"
+page_title: "AWS: aws_cognito_resource_server"
+side_bar_current: "docs-aws-resource-cognito-resource-server"
+description: |-
+  Provides a Cognito Resource Server.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cognito_resource_server
+
+Provides a Cognito Resource Server.
+
+## Example Usage
+
+### Create a basic resource server
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CognitoResourceServer } from "./.gen/providers/aws/cognito-resource-server";
+import { CognitoUserPool } from "./.gen/providers/aws/cognito-user-pool";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const pool = new CognitoUserPool(this, "pool", {
+      name: "pool",
+    });
+    new CognitoResourceServer(this, "resource", {
+      identifier: "https://example.com",
+      name: "example",
+      userPoolId: pool.id,
+    });
+  }
+}
+
+```
+
+### Create a resource server with sample-scope
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CognitoResourceServer } from "./.gen/providers/aws/cognito-resource-server";
+import { CognitoUserPool } from "./.gen/providers/aws/cognito-user-pool";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const pool = new CognitoUserPool(this, "pool", {
+      name: "pool",
+    });
+    new CognitoResourceServer(this, "resource", {
+      identifier: "https://example.com",
+      name: "example",
+      scope: [
+        {
+          scopeDescription: "a Sample Scope Description",
+          scopeName: "sample-scope",
+        },
+      ],
+      userPoolId: pool.id,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `identifier` - (Required) An identifier for the resource server.
+* `name` - (Required) A name for the resource server.
+* `scope` - (Optional) A list of [Authorization Scope](#authorization-scope).
+
+### Authorization Scope
+
+* `scopeName` - (Required) The scope name.
+* `scopeDescription` - (Required) The scope description.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `scopeIdentifiers` - A list of all scopes configured for this resource server in the format identifier/scope_name.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsCognitoResourceServer` using their User Pool ID and Identifier. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsCognitoResourceServer` using their User Pool ID and Identifier. For example:
+
+```console
+% terraform import aws_cognito_resource_server.example "us-west-2_abc123|https://example.com"
+```
+
+<!-- cache-key: cdktf-0.18.0 input-de46a7a41e5a457b2e40bf3acab26f989ff8b0291a8fbbdd80d28397469c06a7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/cognito_risk_configuration.html.markdown b/website/docs/cdktf/typescript/r/cognito_risk_configuration.html.markdown
new file mode 100644
index 00000000000..0e1cae6fd04
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/cognito_risk_configuration.html.markdown
@@ -0,0 +1,151 @@
+---
+subcategory: "Cognito IDP (Identity Provider)"
+layout: "aws"
+page_title: "AWS: aws_cognito_risk_configuration"
+description: |-
+  Provides a Cognito Risk Configuration resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cognito_risk_configuration
+
+Provides a Cognito Risk Configuration resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CognitoRiskConfiguration } from "./.gen/providers/aws/cognito-risk-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new CognitoRiskConfiguration(this, "example", {
+      riskExceptionConfiguration: {
+        blockedIpRangeList: ["10.10.10.10/32"],
+      },
+      userPoolId: Token.asString(awsCognitoUserPoolExample.id),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `userPoolId` - (Required) The user pool ID.
+* `clientId` - (Optional) The app client ID. When the client ID is not provided, the same risk configuration is applied to all the clients in the User Pool.
+* `accountTakeoverRiskConfiguration` - (Optional) The account takeover risk configuration. See details below.
+* `compromisedCredentialsRiskConfiguration` - (Optional) The compromised credentials risk configuration. See details below.
+* `riskExceptionConfiguration` - (Optional) The configuration to override the risk decision. See details below.
+
+### account_takeover_risk_configuration
+
+* `notifyConfiguration` - (Required) The notify configuration used to construct email notifications. See details below.
+* `actions` - (Required) Account takeover risk configuration actions. See details below.
+
+#### notify_configuration
+
+* `blockEmail` - (Optional) Email template used when a detected risk event is blocked. See notify email type below.
+* `mfaEmail` - (Optional) The multi-factor authentication (MFA) email template used when MFA is challenged as part of a detected risk. See notify email type below.
+* `noActionEmail` - (Optional) The email template used when a detected risk event is allowed. See notify email type below.
+* `from` - (Optional) The email address that is sending the email. The address must be either individually verified with Amazon Simple Email Service, or from a domain that has been verified with Amazon SES.
+* `replyTo` - (Optional) The destination to which the receiver of an email should reply to.
+* `sourceArn` - (Required) The Amazon Resource Name (ARN) of the identity that is associated with the sending authorization policy. This identity permits Amazon Cognito to send for the email address specified in the From parameter.
+
+##### notify email type
+
+* `htmlBody` - (Required) The email HTML body.
+* `subject` - (Required) The email subject.
+* `textBody` - (Required) The email text body.
+
+#### actions
+
+* `highAction` - (Optional) Action to take for a high risk. See action block below.
+* `lowAction` - (Optional) Action to take for a low risk. See action block below.
+* `mediumAction` - (Optional) Action to take for a medium risk. See action block below.
+
+##### action
+
+* `eventAction` - (Required) The action to take in response to the account takeover action. Valid values are `block`, `mfaIfConfigured`, `mfaRequired` and `noAction`.
+* `notify` - (Required) Whether to send a notification.
+
+### compromised_credentials_risk_configuration
+
+* `eventFilter` - (Optional) Perform the action for these events. The default is to perform all events if no event filter is specified. Valid values are `signIn`, `passwordChange`, and `signUp`.
+* `actions` - (Required) The compromised credentials risk configuration actions. See details below.
+
+#### actions
+
+* `eventAction` - (Optional) The event action. Valid values are `block` or `noAction`.
+
+### risk_exception_configuration
+
+* `blockedIpRangeList` - (Optional) Overrides the risk decision to always block the pre-authentication requests.
+  The IP range is in CIDR notation, a compact representation of an IP address and its routing prefix.
+  Can contain a maximum of 200 items.
+* `skippedIpRangeList` - (Optional) Risk detection isn't performed on the IP addresses in this range list.
+  The IP range is in CIDR notation.
+  Can contain a maximum of 200 items.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The user pool ID or the user pool ID and Client Id separated by a `:` if the configuration is client specific.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Cognito Risk Configurations using the user pool ID or the user pool ID and Client Id separated by a `:`. For example:
+
+Import using the user pool ID:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Import using the user pool ID and Client ID separated by a `:`:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+**Using `terraform import` to import** Cognito Risk Configurations using the user pool ID or the user pool ID and Client Id separated by a `:`. For example:
+
+Import using the user pool ID:
+
+```console
+% terraform import aws_cognito_risk_configuration.main example
+```
+
+Import using the user pool ID and Client ID separated by a `:`:
+
+```console
+% terraform import aws_cognito_risk_configuration.main example:example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-b75593cc575d1cd95ecde1a9b1a8a4e0bd77767201715d4f626c2fa0398eed4b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/cognito_user.html.markdown b/website/docs/cdktf/typescript/r/cognito_user.html.markdown
new file mode 100644
index 00000000000..2679e081a1e
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/cognito_user.html.markdown
@@ -0,0 +1,149 @@
+---
+subcategory: "Cognito IDP (Identity Provider)"
+layout: "aws"
+page_title: "AWS: aws_cognito_user"
+description: |-
+  Provides a Cognito User resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cognito_user
+
+Provides a Cognito User Resource.
+
+## Example Usage
+
+### Basic configuration
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CognitoUser } from "./.gen/providers/aws/cognito-user";
+import { CognitoUserPool } from "./.gen/providers/aws/cognito-user-pool";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new CognitoUserPool(this, "example", {
+      name: "MyExamplePool",
+    });
+    const awsCognitoUserExample = new CognitoUser(this, "example_1", {
+      userPoolId: example.id,
+      username: "example",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsCognitoUserExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### Setting user attributes
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CognitoUser } from "./.gen/providers/aws/cognito-user";
+import { CognitoUserPool } from "./.gen/providers/aws/cognito-user-pool";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new CognitoUserPool(this, "example", {
+      name: "mypool",
+      schema: [
+        {
+          attributeDataType: "Boolean",
+          developerOnlyAttribute: false,
+          mutable: false,
+          name: "terraform",
+          required: false,
+        },
+        {
+          attributeDataType: "String",
+          developerOnlyAttribute: false,
+          mutable: false,
+          name: "foo",
+          required: false,
+          stringAttributeConstraints: {},
+        },
+      ],
+    });
+    const awsCognitoUserExample = new CognitoUser(this, "example_1", {
+      attributes: {
+        email: "no-reply@hashicorp.com",
+        email_verified: Token.asString(true),
+        foo: "bar",
+        terraform: Token.asString(true),
+      },
+      userPoolId: example.id,
+      username: "example",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsCognitoUserExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `userPoolId` - (Required) The user pool ID for the user pool where the user will be created.
+* `username` - (Required) The username for the user. Must be unique within the user pool. Must be a UTF-8 string between 1 and 128 characters. After the user is created, the username cannot be changed.
+
+The following arguments are optional:
+
+* `attributes` - (Optional) A map that contains user attributes and attribute values to be set for the user.
+* `clientMetadata` - (Optional) A map of custom key-value pairs that you can provide as input for any custom workflows that user creation triggers. Amazon Cognito does not store the `clientMetadata` value. This data is available only to Lambda triggers that are assigned to a user pool to support custom workflows. If your user pool configuration does not include triggers, the ClientMetadata parameter serves no purpose. For more information, see [Customizing User Pool Workflows with Lambda Triggers](https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-identity-pools-working-with-aws-lambda-triggers.html).
+* `desiredDeliveryMediums` - (Optional) A list of mediums to the welcome message will be sent through. Allowed values are `email` and `sms`. If it's provided, make sure you have also specified `email` attribute for the `email` medium and `phoneNumber` for the `sms`. More than one value can be specified. Amazon Cognito does not store the `desiredDeliveryMediums` value. Defaults to `["sms"]`.
+* `enabled` - (Optional) Specifies whether the user should be enabled after creation. The welcome message will be sent regardless of the `enabled` value. The behavior can be changed with `messageAction` argument. Defaults to `true`.
+* `forceAliasCreation` - (Optional) If this parameter is set to True and the `phoneNumber` or `email` address specified in the `attributes` parameter already exists as an alias with a different user, Amazon Cognito will migrate the alias from the previous user to the newly created user. The previous user will no longer be able to log in using that alias. Amazon Cognito does not store the `forceAliasCreation` value. Defaults to `false`.
+* `messageAction` - (Optional) Set to `resend` to resend the invitation message to a user that already exists and reset the expiration limit on the user's account. Set to `suppress` to suppress sending the message. Only one value can be specified. Amazon Cognito does not store the `messageAction` value.
+* `password` - (Optional) The user's permanent password. This password must conform to the password policy specified by user pool the user belongs to. The welcome message always contains only `temporaryPassword` value. You can suppress sending the welcome message with the `messageAction` argument. Amazon Cognito does not store the `password` value. Conflicts with `temporaryPassword`.
+* `temporaryPassword` - (Optional) The user's temporary password. Conflicts with `password`.
+* `validationData` - (Optional) The user's validation data. This is an array of name-value pairs that contain user attributes and attribute values that you can use for custom validation, such as restricting the types of user accounts that can be registered. Amazon Cognito does not store the `validationData` value. For more information, see [Customizing User Pool Workflows with Lambda Triggers](https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-identity-pools-working-with-aws-lambda-triggers.html).
+
+~> **NOTE:** Clearing `password` or `temporaryPassword` does not reset user's password in Cognito.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `status` - current user status.
+* `sub` - unique user id that is never reassignable to another user.
+* `mfaPreference` - user's settings regarding MFA settings and preferences.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Cognito User using the `userPoolId`/`name` attributes concatenated. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Cognito User using the `userPoolId`/`name` attributes concatenated. For example:
+
+```console
+% terraform import aws_cognito_user.user us-east-1_vG78M4goG/user
+```
+
+<!-- cache-key: cdktf-0.18.0 input-b603092428c63c12332d47bff8ea434c3f148dcd1ba3a4fb846409da827bc678 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/cognito_user_group.html.markdown b/website/docs/cdktf/typescript/r/cognito_user_group.html.markdown
new file mode 100644
index 00000000000..4e48172f8f7
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/cognito_user_group.html.markdown
@@ -0,0 +1,117 @@
+---
+subcategory: "Cognito IDP (Identity Provider)"
+layout: "aws"
+page_title: "AWS: aws_cognito_user_group"
+description: |-
+  Provides a Cognito User Group resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cognito_user_group
+
+Provides a Cognito User Group resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CognitoUserGroup } from "./.gen/providers/aws/cognito-user-group";
+import { CognitoUserPool } from "./.gen/providers/aws/cognito-user-pool";
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const main = new CognitoUserPool(this, "main", {
+      name: "identity pool",
+    });
+    const groupRole = new DataAwsIamPolicyDocument(this, "group_role", {
+      statement: [
+        {
+          actions: ["sts:AssumeRoleWithWebIdentity"],
+          condition: [
+            {
+              test: "StringEquals",
+              values: ["us-east-1:12345678-dead-beef-cafe-123456790ab"],
+              variable: "cognito-identity.amazonaws.com:aud",
+            },
+            {
+              test: "ForAnyValue:StringLike",
+              values: ["authenticated"],
+              variable: "cognito-identity.amazonaws.com:amr",
+            },
+          ],
+          effect: "Allow",
+          principals: [
+            {
+              identifiers: ["cognito-identity.amazonaws.com"],
+              type: "Federated",
+            },
+          ],
+        },
+      ],
+    });
+    const awsIamRoleGroupRole = new IamRole(this, "group_role_2", {
+      assumeRolePolicy: Token.asString(groupRole.json),
+      name: "user-group-role",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamRoleGroupRole.overrideLogicalId("group_role");
+    const awsCognitoUserGroupMain = new CognitoUserGroup(this, "main_3", {
+      description: "Managed by Terraform",
+      name: "user-group",
+      precedence: 42,
+      roleArn: Token.asString(awsIamRoleGroupRole.arn),
+      userPoolId: main.id,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsCognitoUserGroupMain.overrideLogicalId("main");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the user group.
+* `userPoolId` - (Required) The user pool ID.
+* `description` - (Optional) The description of the user group.
+* `precedence` - (Optional) The precedence of the user group.
+* `roleArn` - (Optional) The ARN of the IAM role to be associated with the user group.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Cognito User Groups using the `userPoolId`/`name` attributes concatenated. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Cognito User Groups using the `userPoolId`/`name` attributes concatenated. For example:
+
+```console
+% terraform import aws_cognito_user_group.group us-east-1_vG78M4goG/user-group
+```
+
+<!-- cache-key: cdktf-0.18.0 input-cc1b14439a5de34e3245c86b3fde6854b55b9ec7ad46bd038fb95fabbe714a37 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/cognito_user_in_group.html.markdown b/website/docs/cdktf/typescript/r/cognito_user_in_group.html.markdown
new file mode 100644
index 00000000000..5b8aef1062b
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/cognito_user_in_group.html.markdown
@@ -0,0 +1,82 @@
+---
+subcategory: "Cognito IDP (Identity Provider)"
+layout: "aws"
+page_title: "AWS: aws_cognito_user_in_group"
+description: |-
+  Adds the specified user to the specified group.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cognito_user_in_group
+
+Adds the specified user to the specified group.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CognitoUser } from "./.gen/providers/aws/cognito-user";
+import { CognitoUserGroup } from "./.gen/providers/aws/cognito-user-group";
+import { CognitoUserInGroup } from "./.gen/providers/aws/cognito-user-in-group";
+import { CognitoUserPool } from "./.gen/providers/aws/cognito-user-pool";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new CognitoUserPool(this, "example", {
+      name: "example",
+      passwordPolicy: {
+        minimumLength: 6,
+        requireNumbers: false,
+        requireSymbols: false,
+        requireUppercase: false,
+        temporaryPasswordValidityDays: 7,
+      },
+    });
+    const awsCognitoUserExample = new CognitoUser(this, "example_1", {
+      userPoolId: example.id,
+      username: "example",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsCognitoUserExample.overrideLogicalId("example");
+    const awsCognitoUserGroupExample = new CognitoUserGroup(this, "example_2", {
+      name: "example",
+      userPoolId: example.id,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsCognitoUserGroupExample.overrideLogicalId("example");
+    const awsCognitoUserInGroupExample = new CognitoUserInGroup(
+      this,
+      "example_3",
+      {
+        groupName: Token.asString(awsCognitoUserGroupExample.name),
+        userPoolId: example.id,
+        username: Token.asString(awsCognitoUserExample.username),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsCognitoUserInGroupExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `userPoolId` - (Required) The user pool ID of the user and group.
+* `groupName` - (Required) The name of the group to which the user is to be added.
+* `username` - (Required) The username of the user to be added to the group.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+<!-- cache-key: cdktf-0.18.0 input-be59be793cc148b63f6cb2c1176522ea395a72e01fb79223c762c9ea801a348a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/cognito_user_pool.html.markdown b/website/docs/cdktf/typescript/r/cognito_user_pool.html.markdown
new file mode 100644
index 00000000000..b003aeb6482
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/cognito_user_pool.html.markdown
@@ -0,0 +1,336 @@
+---
+subcategory: "Cognito IDP (Identity Provider)"
+layout: "aws"
+page_title: "AWS: aws_cognito_user_pool"
+description: |-
+  Provides a Cognito User Pool resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cognito_user_pool
+
+Provides a Cognito User Pool resource.
+
+## Example Usage
+
+### Basic configuration
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CognitoUserPool } from "./.gen/providers/aws/cognito-user-pool";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new CognitoUserPool(this, "pool", {
+      name: "mypool",
+    });
+  }
+}
+
+```
+
+### Enabling SMS and Software Token Multi-Factor Authentication
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CognitoUserPool } from "./.gen/providers/aws/cognito-user-pool";
+interface MyConfig {
+  name: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new CognitoUserPool(this, "example", {
+      mfaConfiguration: "ON",
+      smsAuthenticationMessage: "Your code is {####}",
+      smsConfiguration: {
+        externalId: "example",
+        snsCallerArn: Token.asString(awsIamRoleExample.arn),
+        snsRegion: "us-east-1",
+      },
+      softwareTokenMfaConfiguration: {
+        enabled: true,
+      },
+      name: config.name,
+    });
+  }
+}
+
+```
+
+### Using Account Recovery Setting
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CognitoUserPool } from "./.gen/providers/aws/cognito-user-pool";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new CognitoUserPool(this, "test", {
+      accountRecoverySetting: {
+        recoveryMechanism: [
+          {
+            name: "verified_email",
+            priority: 1,
+          },
+          {
+            name: "verified_phone_number",
+            priority: 2,
+          },
+        ],
+      },
+      name: "mypool",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following argument is required:
+
+* `name` - (Required) Name of the user pool.
+
+The following arguments are optional:
+
+* `accountRecoverySetting` - (Optional) Configuration block to define which verified available method a user can use to recover their forgotten password. [Detailed below](#account_recovery_setting).
+* `adminCreateUserConfig` - (Optional) Configuration block for creating a new user profile. [Detailed below](#admin_create_user_config).
+* `aliasAttributes` - (Optional) Attributes supported as an alias for this user pool. Valid values: `phoneNumber`, `email`, or `preferredUsername`. Conflicts with `usernameAttributes`.
+* `autoVerifiedAttributes` - (Optional) Attributes to be auto-verified. Valid values: `email`, `phoneNumber`.
+* `deletionProtection` - (Optional) When active, DeletionProtection prevents accidental deletion of your user pool. Before you can delete a user pool that you have protected against deletion, you must deactivate this feature. Valid values are `active` and `inactive`, Default value is `inactive`.
+* `deviceConfiguration` - (Optional) Configuration block for the user pool's device tracking. [Detailed below](#device_configuration).
+* `emailConfiguration` - (Optional) Configuration block for configuring email. [Detailed below](#email_configuration).
+* `emailVerificationMessage` - (Optional) String representing the email verification message. Conflicts with `verificationMessageTemplate` configuration block `emailMessage` argument.
+* `emailVerificationSubject` - (Optional) String representing the email verification subject. Conflicts with `verificationMessageTemplate` configuration block `emailSubject` argument.
+* `lambdaConfig` - (Optional) Configuration block for the AWS Lambda triggers associated with the user pool. [Detailed below](#lambda_config).
+* `mfaConfiguration` - (Optional) Multi-Factor Authentication (MFA) configuration for the User Pool. Defaults of `off`. Valid values are `off` (MFA Tokens are not required), `on` (MFA is required for all users to sign in; requires at least one of `smsConfiguration` or `softwareTokenMfaConfiguration` to be configured), or `optional` (MFA Will be required only for individual users who have MFA Enabled; requires at least one of `smsConfiguration` or `softwareTokenMfaConfiguration` to be configured).
+* `passwordPolicy` - (Optional) Configuration block for information about the user pool password policy. [Detailed below](#password_policy).
+* `schema` - (Optional) Configuration block for the schema attributes of a user pool. [Detailed below](#schema). Schema attributes from the [standard attribute set](https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-settings-attributes.html#cognito-user-pools-standard-attributes) only need to be specified if they are different from the default configuration. Attributes can be added, but not modified or removed. Maximum of 50 attributes.
+* `smsAuthenticationMessage` - (Optional) String representing the SMS authentication message. The Message must contain the `{####}` placeholder, which will be replaced with the code.
+* `smsConfiguration` - (Optional) Configuration block for Short Message Service (SMS) settings. [Detailed below](#sms_configuration). These settings apply to SMS user verification and SMS Multi-Factor Authentication (MFA). Due to Cognito API restrictions, the SMS configuration cannot be removed without recreating the Cognito User Pool. For user data safety, this resource will ignore the removal of this configuration by disabling drift detection. To force resource recreation after this configuration has been applied, see the [`taint` command](https://www.terraform.io/docs/commands/taint.html).
+* `smsVerificationMessage` - (Optional) String representing the SMS verification message. Conflicts with `verificationMessageTemplate` configuration block `smsMessage` argument.
+* `softwareTokenMfaConfiguration` - (Optional) Configuration block for software token Mult-Factor Authentication (MFA) settings. [Detailed below](#software_token_mfa_configuration).
+* `tags` - (Optional) Map of tags to assign to the User Pool. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `userAttributeUpdateSettings` - (Optional) Configuration block for user attribute update settings. [Detailed below](#user_attribute_update_settings).
+* `userPoolAddOns` - (Optional) Configuration block for user pool add-ons to enable user pool advanced security mode features. [Detailed below](#user_pool_add_ons).
+* `usernameAttributes` - (Optional) Whether email addresses or phone numbers can be specified as usernames when a user signs up. Conflicts with `aliasAttributes`.
+* `usernameConfiguration` - (Optional) Configuration block for username configuration. [Detailed below](#username_configuration).
+* `verificationMessageTemplate` - (Optional) Configuration block for verification message templates. [Detailed below](#verification_message_template).
+
+### account_recovery_setting
+
+* `recoveryMechanism` - (Optional) List of Account Recovery Options of the following structure:
+    * `name` - (Required) Recovery method for a user. Can be of the following: `verifiedEmail`, `verifiedPhoneNumber`, and `adminOnly`.
+    * `priority` - (Required) Positive integer specifying priority of a method with 1 being the highest priority.
+
+### admin_create_user_config
+
+* `allowAdminCreateUserOnly` - (Optional) Set to True if only the administrator is allowed to create user profiles. Set to False if users can sign themselves up via an app.
+* `inviteMessageTemplate` - (Optional) Invite message template structure. [Detailed below](#invite_message_template).
+
+#### invite_message_template
+
+* `emailMessage` - (Optional) Message template for email messages. Must contain `{username}` and `{####}` placeholders, for username and temporary password, respectively.
+* `emailSubject` - (Optional) Subject line for email messages.
+* `smsMessage` - (Optional) Message template for SMS messages. Must contain `{username}` and `{####}` placeholders, for username and temporary password, respectively.
+
+### device_configuration
+
+* `challengeRequiredOnNewDevice` - (Optional) Whether a challenge is required on a new device. Only applicable to a new device.
+* `deviceOnlyRememberedOnUserPrompt` - (Optional) Whether a device is only remembered on user prompt. `false` equates to "Always" remember, `true` is "User Opt In," and not using a `deviceConfiguration` block is "No."
+
+### email_configuration
+
+* `configurationSet` - (Optional) Email configuration set name from SES.
+* `emailSendingAccount` - (Optional) Email delivery method to use. `cognitoDefault` for the default email functionality built into Cognito or `developer` to use your Amazon SES configuration. Required to be `developer` if `fromEmailAddress` is set.
+* `fromEmailAddress` - (Optional) Sender’s email address or sender’s display name with their email address (e.g., `john@exampleCom`, `John Smith <john@example.com>` or `\"John Smith Ph.D.\" <john@example.com>`). Escaped double quotes are required around display names that contain certain characters as specified in [RFC 5322](https://tools.ietf.org/html/rfc5322).
+* `replyToEmailAddress` - (Optional) REPLY-TO email address.
+* `sourceArn` - (Optional) ARN of the SES verified email identity to use. Required if `emailSendingAccount` is set to `developer`.
+
+### lambda_config
+
+* `createAuthChallenge` - (Optional) ARN of the lambda creating an authentication challenge.
+* `customMessage` - (Optional) Custom Message AWS Lambda trigger.
+* `defineAuthChallenge` - (Optional) Defines the authentication challenge.
+* `postAuthentication` - (Optional) Post-authentication AWS Lambda trigger.
+* `postConfirmation` - (Optional) Post-confirmation AWS Lambda trigger.
+* `preAuthentication` - (Optional) Pre-authentication AWS Lambda trigger.
+* `preSignUp` - (Optional) Pre-registration AWS Lambda trigger.
+* `preTokenGeneration` - (Optional) Allow to customize identity token claims before token generation.
+* `userMigration` - (Optional) User migration Lambda config type.
+* `verifyAuthChallengeResponse` - (Optional) Verifies the authentication challenge response.
+* `kmsKeyId` - (Optional) The Amazon Resource Name of Key Management Service Customer master keys. Amazon Cognito uses the key to encrypt codes and temporary passwords sent to CustomEmailSender and CustomSMSSender.
+* `customEmailSender` - (Optional) A custom email sender AWS Lambda trigger. See [custom_email_sender](#custom_email_sender) Below.
+* `customSmsSender` - (Optional) A custom SMS sender AWS Lambda trigger. See [custom_sms_sender](#custom_sms_sender) Below.
+
+#### custom_email_sender
+
+* `lambdaArn` - (Required) The Lambda Amazon Resource Name of the Lambda function that Amazon Cognito triggers to send email notifications to users.
+* `lambdaVersion` - (Required) The Lambda version represents the signature of the "request" attribute in the "event" information Amazon Cognito passes to your custom email Lambda function. The only supported value is `v10`.
+
+#### custom_sms_sender
+
+* `lambdaArn` - (Required) The Lambda Amazon Resource Name of the Lambda function that Amazon Cognito triggers to send SMS notifications to users.
+* `lambdaVersion` - (Required) The Lambda version represents the signature of the "request" attribute in the "event" information Amazon Cognito passes to your custom SMS Lambda function. The only supported value is `v10`.
+
+### password_policy
+
+* `minimumLength` - (Optional) Minimum length of the password policy that you have set.
+* `requireLowercase` - (Optional) Whether you have required users to use at least one lowercase letter in their password.
+* `requireNumbers` - (Optional) Whether you have required users to use at least one number in their password.
+* `requireSymbols` - (Optional) Whether you have required users to use at least one symbol in their password.
+* `requireUppercase` - (Optional) Whether you have required users to use at least one uppercase letter in their password.
+* `temporaryPasswordValidityDays` - (Optional) In the password policy you have set, refers to the number of days a temporary password is valid. If the user does not sign-in during this time, their password will need to be reset by an administrator.
+
+### schema
+
+~> **NOTE:** When defining an `attributeDataType` of `string` or `number`, the respective attribute constraints configuration block (e.g `stringAttributeConstraints` or `numberAttributeConstraints`) is **required** to prevent recreation of the Terraform resource. This requirement is true for both standard (e.g., name, email) and custom schema attributes.
+
+* `attributeDataType` - (Required) Attribute data type. Must be one of `boolean`, `number`, `string`, `dateTime`.
+* `developerOnlyAttribute` - (Optional) Whether the attribute type is developer only.
+* `mutable` - (Optional) Whether the attribute can be changed once it has been created.
+* `name` - (Required) Name of the attribute.
+* `numberAttributeConstraints` - (Required when `attributeDataType` is `number`) Configuration block for the constraints for an attribute of the number type. [Detailed below](#number_attribute_constraints).
+* `required` - (Optional) Whether a user pool attribute is required. If the attribute is required and the user does not provide a value, registration or sign-in will fail.
+* `stringAttributeConstraints` - (Required when `attributeDataType` is `string`) Constraints for an attribute of the string type. [Detailed below](#string_attribute_constraints).
+
+#### schema: Defaults for Standard Attributes
+
+The [standard attributes](https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-settings-attributes.html#cognito-user-pools-standard-attributes) have the following defaults. Note that attributes which match the default values are not stored in Terraform state when importing.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CognitoUserPool } from "./.gen/providers/aws/cognito-user-pool";
+interface MyConfig {
+  name: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new CognitoUserPool(this, "example", {
+      schema: [
+        {
+          attributeDataType: "<appropriate type>",
+          developerOnlyAttribute: false,
+          mutable: true,
+          name: "<name>",
+          required: false,
+          stringAttributeConstraints: {
+            maxLength: Token.asString(2048),
+            minLength: Token.asString(0),
+          },
+        },
+      ],
+      name: config.name,
+    });
+  }
+}
+
+```
+
+#### number_attribute_constraints
+
+* `maxValue` - (Optional) Maximum value of an attribute that is of the number data type.
+* `minValue` - (Optional) Minimum value of an attribute that is of the number data type.
+
+#### string_attribute_constraints
+
+* `maxLength` - (Optional) Maximum length of an attribute value of the string type.
+* `minLength` - (Optional) Minimum length of an attribute value of the string type.
+
+### sms_configuration
+
+* `externalId` - (Required) External ID used in IAM role trust relationships. For more information about using external IDs, see [How to Use an External ID When Granting Access to Your AWS Resources to a Third Party](http://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user_externalid.html).
+* `snsCallerArn` - (Required) ARN of the Amazon SNS caller. This is usually the IAM role that you've given Cognito permission to assume.
+* `snsRegion` - (Optional) The AWS Region to use with Amazon SNS integration. You can choose the same Region as your user pool, or a supported Legacy Amazon SNS alternate Region. Amazon Cognito resources in the Asia Pacific (Seoul) AWS Region must use your Amazon SNS configuration in the Asia Pacific (Tokyo) Region. For more information, see [SMS message settings for Amazon Cognito user pools](https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-sms-settings.html).
+
+### software_token_mfa_configuration
+
+The following arguments are required in the `softwareTokenMfaConfiguration` configuration block:
+
+* `enabled` - (Required) Boolean whether to enable software token Multi-Factor (MFA) tokens, such as Time-based One-Time Password (TOTP). To disable software token MFA When `smsConfiguration` is not present, the `mfaConfiguration` argument must be set to `off` and the `softwareTokenMfaConfiguration` configuration block must be fully removed.
+
+### user_attribute_update_settings
+
+* `attributesRequireVerificationBeforeUpdate` - (Required) A list of attributes requiring verification before update. If set, the provided value(s) must also be set in `autoVerifiedAttributes`. Valid values: `email`, `phoneNumber`.
+
+### user_pool_add_ons
+
+* `advancedSecurityMode` - (Required) Mode for advanced security, must be one of `off`, `audit` or `enforced`.
+
+### username_configuration
+
+* `caseSensitive` - (Required) Whether username case sensitivity will be applied for all users in the user pool through Cognito APIs.
+
+### verification_message_template
+
+* `defaultEmailOption` - (Optional) Default email option. Must be either `confirmWithCode` or `confirmWithLink`. Defaults to `confirmWithCode`.
+* `emailMessage` - (Optional) Email message template. Must contain the `{####}` placeholder. Conflicts with `emailVerificationMessage` argument.
+* `emailMessageByLink` - (Optional) Email message template for sending a confirmation link to the user, it must contain the `{##Click Here##}` placeholder.
+* `emailSubject` - (Optional) Subject line for the email message template. Conflicts with `emailVerificationSubject` argument.
+* `emailSubjectByLink` - (Optional) Subject line for the email message template for sending a confirmation link to the user.
+* `smsMessage` - (Optional) SMS message template. Must contain the `{####}` placeholder. Conflicts with `smsVerificationMessage` argument.
+  
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the user pool.
+* `creationDate` - Date the user pool was created.
+* `customDomain` - A custom domain name that you provide to Amazon Cognito. This parameter applies only if you use a custom domain to host the sign-up and sign-in pages for your application. For example: `authExampleCom`.
+* `domain` - Holds the domain prefix if the user pool has a domain associated with it.
+* `endpoint` - Endpoint name of the user pool. Example format: `cognitoIdpRegionAmazonawsCom/xxxxYyyyy`
+* `estimatedNumberOfUsers` - A number estimating the size of the user pool.
+* `id` - ID of the user pool.
+* `lastModifiedDate` - Date the user pool was last modified.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Cognito User Pools using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Cognito User Pools using the `id`. For example:
+
+```console
+% terraform import aws_cognito_user_pool.pool us-west-2_abc123
+```
+
+<!-- cache-key: cdktf-0.18.0 input-956f61f5814a7a2fe0cddeef5fa9d4a645f79dd8c9a568695d52c319ef5ea5d4 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/cognito_user_pool.markdown b/website/docs/cdktf/typescript/r/cognito_user_pool.markdown
new file mode 100644
index 00000000000..b003aeb6482
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/cognito_user_pool.markdown
@@ -0,0 +1,336 @@
+---
+subcategory: "Cognito IDP (Identity Provider)"
+layout: "aws"
+page_title: "AWS: aws_cognito_user_pool"
+description: |-
+  Provides a Cognito User Pool resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cognito_user_pool
+
+Provides a Cognito User Pool resource.
+
+## Example Usage
+
+### Basic configuration
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CognitoUserPool } from "./.gen/providers/aws/cognito-user-pool";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new CognitoUserPool(this, "pool", {
+      name: "mypool",
+    });
+  }
+}
+
+```
+
+### Enabling SMS and Software Token Multi-Factor Authentication
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CognitoUserPool } from "./.gen/providers/aws/cognito-user-pool";
+interface MyConfig {
+  name: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new CognitoUserPool(this, "example", {
+      mfaConfiguration: "ON",
+      smsAuthenticationMessage: "Your code is {####}",
+      smsConfiguration: {
+        externalId: "example",
+        snsCallerArn: Token.asString(awsIamRoleExample.arn),
+        snsRegion: "us-east-1",
+      },
+      softwareTokenMfaConfiguration: {
+        enabled: true,
+      },
+      name: config.name,
+    });
+  }
+}
+
+```
+
+### Using Account Recovery Setting
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CognitoUserPool } from "./.gen/providers/aws/cognito-user-pool";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new CognitoUserPool(this, "test", {
+      accountRecoverySetting: {
+        recoveryMechanism: [
+          {
+            name: "verified_email",
+            priority: 1,
+          },
+          {
+            name: "verified_phone_number",
+            priority: 2,
+          },
+        ],
+      },
+      name: "mypool",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following argument is required:
+
+* `name` - (Required) Name of the user pool.
+
+The following arguments are optional:
+
+* `accountRecoverySetting` - (Optional) Configuration block to define which verified available method a user can use to recover their forgotten password. [Detailed below](#account_recovery_setting).
+* `adminCreateUserConfig` - (Optional) Configuration block for creating a new user profile. [Detailed below](#admin_create_user_config).
+* `aliasAttributes` - (Optional) Attributes supported as an alias for this user pool. Valid values: `phoneNumber`, `email`, or `preferredUsername`. Conflicts with `usernameAttributes`.
+* `autoVerifiedAttributes` - (Optional) Attributes to be auto-verified. Valid values: `email`, `phoneNumber`.
+* `deletionProtection` - (Optional) When active, DeletionProtection prevents accidental deletion of your user pool. Before you can delete a user pool that you have protected against deletion, you must deactivate this feature. Valid values are `active` and `inactive`, Default value is `inactive`.
+* `deviceConfiguration` - (Optional) Configuration block for the user pool's device tracking. [Detailed below](#device_configuration).
+* `emailConfiguration` - (Optional) Configuration block for configuring email. [Detailed below](#email_configuration).
+* `emailVerificationMessage` - (Optional) String representing the email verification message. Conflicts with `verificationMessageTemplate` configuration block `emailMessage` argument.
+* `emailVerificationSubject` - (Optional) String representing the email verification subject. Conflicts with `verificationMessageTemplate` configuration block `emailSubject` argument.
+* `lambdaConfig` - (Optional) Configuration block for the AWS Lambda triggers associated with the user pool. [Detailed below](#lambda_config).
+* `mfaConfiguration` - (Optional) Multi-Factor Authentication (MFA) configuration for the User Pool. Defaults of `off`. Valid values are `off` (MFA Tokens are not required), `on` (MFA is required for all users to sign in; requires at least one of `smsConfiguration` or `softwareTokenMfaConfiguration` to be configured), or `optional` (MFA Will be required only for individual users who have MFA Enabled; requires at least one of `smsConfiguration` or `softwareTokenMfaConfiguration` to be configured).
+* `passwordPolicy` - (Optional) Configuration block for information about the user pool password policy. [Detailed below](#password_policy).
+* `schema` - (Optional) Configuration block for the schema attributes of a user pool. [Detailed below](#schema). Schema attributes from the [standard attribute set](https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-settings-attributes.html#cognito-user-pools-standard-attributes) only need to be specified if they are different from the default configuration. Attributes can be added, but not modified or removed. Maximum of 50 attributes.
+* `smsAuthenticationMessage` - (Optional) String representing the SMS authentication message. The Message must contain the `{####}` placeholder, which will be replaced with the code.
+* `smsConfiguration` - (Optional) Configuration block for Short Message Service (SMS) settings. [Detailed below](#sms_configuration). These settings apply to SMS user verification and SMS Multi-Factor Authentication (MFA). Due to Cognito API restrictions, the SMS configuration cannot be removed without recreating the Cognito User Pool. For user data safety, this resource will ignore the removal of this configuration by disabling drift detection. To force resource recreation after this configuration has been applied, see the [`taint` command](https://www.terraform.io/docs/commands/taint.html).
+* `smsVerificationMessage` - (Optional) String representing the SMS verification message. Conflicts with `verificationMessageTemplate` configuration block `smsMessage` argument.
+* `softwareTokenMfaConfiguration` - (Optional) Configuration block for software token Mult-Factor Authentication (MFA) settings. [Detailed below](#software_token_mfa_configuration).
+* `tags` - (Optional) Map of tags to assign to the User Pool. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `userAttributeUpdateSettings` - (Optional) Configuration block for user attribute update settings. [Detailed below](#user_attribute_update_settings).
+* `userPoolAddOns` - (Optional) Configuration block for user pool add-ons to enable user pool advanced security mode features. [Detailed below](#user_pool_add_ons).
+* `usernameAttributes` - (Optional) Whether email addresses or phone numbers can be specified as usernames when a user signs up. Conflicts with `aliasAttributes`.
+* `usernameConfiguration` - (Optional) Configuration block for username configuration. [Detailed below](#username_configuration).
+* `verificationMessageTemplate` - (Optional) Configuration block for verification message templates. [Detailed below](#verification_message_template).
+
+### account_recovery_setting
+
+* `recoveryMechanism` - (Optional) List of Account Recovery Options of the following structure:
+    * `name` - (Required) Recovery method for a user. Can be of the following: `verifiedEmail`, `verifiedPhoneNumber`, and `adminOnly`.
+    * `priority` - (Required) Positive integer specifying priority of a method with 1 being the highest priority.
+
+### admin_create_user_config
+
+* `allowAdminCreateUserOnly` - (Optional) Set to True if only the administrator is allowed to create user profiles. Set to False if users can sign themselves up via an app.
+* `inviteMessageTemplate` - (Optional) Invite message template structure. [Detailed below](#invite_message_template).
+
+#### invite_message_template
+
+* `emailMessage` - (Optional) Message template for email messages. Must contain `{username}` and `{####}` placeholders, for username and temporary password, respectively.
+* `emailSubject` - (Optional) Subject line for email messages.
+* `smsMessage` - (Optional) Message template for SMS messages. Must contain `{username}` and `{####}` placeholders, for username and temporary password, respectively.
+
+### device_configuration
+
+* `challengeRequiredOnNewDevice` - (Optional) Whether a challenge is required on a new device. Only applicable to a new device.
+* `deviceOnlyRememberedOnUserPrompt` - (Optional) Whether a device is only remembered on user prompt. `false` equates to "Always" remember, `true` is "User Opt In," and not using a `deviceConfiguration` block is "No."
+
+### email_configuration
+
+* `configurationSet` - (Optional) Email configuration set name from SES.
+* `emailSendingAccount` - (Optional) Email delivery method to use. `cognitoDefault` for the default email functionality built into Cognito or `developer` to use your Amazon SES configuration. Required to be `developer` if `fromEmailAddress` is set.
+* `fromEmailAddress` - (Optional) Sender’s email address or sender’s display name with their email address (e.g., `john@exampleCom`, `John Smith <john@example.com>` or `\"John Smith Ph.D.\" <john@example.com>`). Escaped double quotes are required around display names that contain certain characters as specified in [RFC 5322](https://tools.ietf.org/html/rfc5322).
+* `replyToEmailAddress` - (Optional) REPLY-TO email address.
+* `sourceArn` - (Optional) ARN of the SES verified email identity to use. Required if `emailSendingAccount` is set to `developer`.
+
+### lambda_config
+
+* `createAuthChallenge` - (Optional) ARN of the lambda creating an authentication challenge.
+* `customMessage` - (Optional) Custom Message AWS Lambda trigger.
+* `defineAuthChallenge` - (Optional) Defines the authentication challenge.
+* `postAuthentication` - (Optional) Post-authentication AWS Lambda trigger.
+* `postConfirmation` - (Optional) Post-confirmation AWS Lambda trigger.
+* `preAuthentication` - (Optional) Pre-authentication AWS Lambda trigger.
+* `preSignUp` - (Optional) Pre-registration AWS Lambda trigger.
+* `preTokenGeneration` - (Optional) Allow to customize identity token claims before token generation.
+* `userMigration` - (Optional) User migration Lambda config type.
+* `verifyAuthChallengeResponse` - (Optional) Verifies the authentication challenge response.
+* `kmsKeyId` - (Optional) The Amazon Resource Name of Key Management Service Customer master keys. Amazon Cognito uses the key to encrypt codes and temporary passwords sent to CustomEmailSender and CustomSMSSender.
+* `customEmailSender` - (Optional) A custom email sender AWS Lambda trigger. See [custom_email_sender](#custom_email_sender) Below.
+* `customSmsSender` - (Optional) A custom SMS sender AWS Lambda trigger. See [custom_sms_sender](#custom_sms_sender) Below.
+
+#### custom_email_sender
+
+* `lambdaArn` - (Required) The Lambda Amazon Resource Name of the Lambda function that Amazon Cognito triggers to send email notifications to users.
+* `lambdaVersion` - (Required) The Lambda version represents the signature of the "request" attribute in the "event" information Amazon Cognito passes to your custom email Lambda function. The only supported value is `v10`.
+
+#### custom_sms_sender
+
+* `lambdaArn` - (Required) The Lambda Amazon Resource Name of the Lambda function that Amazon Cognito triggers to send SMS notifications to users.
+* `lambdaVersion` - (Required) The Lambda version represents the signature of the "request" attribute in the "event" information Amazon Cognito passes to your custom SMS Lambda function. The only supported value is `v10`.
+
+### password_policy
+
+* `minimumLength` - (Optional) Minimum length of the password policy that you have set.
+* `requireLowercase` - (Optional) Whether you have required users to use at least one lowercase letter in their password.
+* `requireNumbers` - (Optional) Whether you have required users to use at least one number in their password.
+* `requireSymbols` - (Optional) Whether you have required users to use at least one symbol in their password.
+* `requireUppercase` - (Optional) Whether you have required users to use at least one uppercase letter in their password.
+* `temporaryPasswordValidityDays` - (Optional) In the password policy you have set, refers to the number of days a temporary password is valid. If the user does not sign-in during this time, their password will need to be reset by an administrator.
+
+### schema
+
+~> **NOTE:** When defining an `attributeDataType` of `string` or `number`, the respective attribute constraints configuration block (e.g `stringAttributeConstraints` or `numberAttributeConstraints`) is **required** to prevent recreation of the Terraform resource. This requirement is true for both standard (e.g., name, email) and custom schema attributes.
+
+* `attributeDataType` - (Required) Attribute data type. Must be one of `boolean`, `number`, `string`, `dateTime`.
+* `developerOnlyAttribute` - (Optional) Whether the attribute type is developer only.
+* `mutable` - (Optional) Whether the attribute can be changed once it has been created.
+* `name` - (Required) Name of the attribute.
+* `numberAttributeConstraints` - (Required when `attributeDataType` is `number`) Configuration block for the constraints for an attribute of the number type. [Detailed below](#number_attribute_constraints).
+* `required` - (Optional) Whether a user pool attribute is required. If the attribute is required and the user does not provide a value, registration or sign-in will fail.
+* `stringAttributeConstraints` - (Required when `attributeDataType` is `string`) Constraints for an attribute of the string type. [Detailed below](#string_attribute_constraints).
+
+#### schema: Defaults for Standard Attributes
+
+The [standard attributes](https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-settings-attributes.html#cognito-user-pools-standard-attributes) have the following defaults. Note that attributes which match the default values are not stored in Terraform state when importing.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CognitoUserPool } from "./.gen/providers/aws/cognito-user-pool";
+interface MyConfig {
+  name: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new CognitoUserPool(this, "example", {
+      schema: [
+        {
+          attributeDataType: "<appropriate type>",
+          developerOnlyAttribute: false,
+          mutable: true,
+          name: "<name>",
+          required: false,
+          stringAttributeConstraints: {
+            maxLength: Token.asString(2048),
+            minLength: Token.asString(0),
+          },
+        },
+      ],
+      name: config.name,
+    });
+  }
+}
+
+```
+
+#### number_attribute_constraints
+
+* `maxValue` - (Optional) Maximum value of an attribute that is of the number data type.
+* `minValue` - (Optional) Minimum value of an attribute that is of the number data type.
+
+#### string_attribute_constraints
+
+* `maxLength` - (Optional) Maximum length of an attribute value of the string type.
+* `minLength` - (Optional) Minimum length of an attribute value of the string type.
+
+### sms_configuration
+
+* `externalId` - (Required) External ID used in IAM role trust relationships. For more information about using external IDs, see [How to Use an External ID When Granting Access to Your AWS Resources to a Third Party](http://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user_externalid.html).
+* `snsCallerArn` - (Required) ARN of the Amazon SNS caller. This is usually the IAM role that you've given Cognito permission to assume.
+* `snsRegion` - (Optional) The AWS Region to use with Amazon SNS integration. You can choose the same Region as your user pool, or a supported Legacy Amazon SNS alternate Region. Amazon Cognito resources in the Asia Pacific (Seoul) AWS Region must use your Amazon SNS configuration in the Asia Pacific (Tokyo) Region. For more information, see [SMS message settings for Amazon Cognito user pools](https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-sms-settings.html).
+
+### software_token_mfa_configuration
+
+The following arguments are required in the `softwareTokenMfaConfiguration` configuration block:
+
+* `enabled` - (Required) Boolean whether to enable software token Multi-Factor (MFA) tokens, such as Time-based One-Time Password (TOTP). To disable software token MFA When `smsConfiguration` is not present, the `mfaConfiguration` argument must be set to `off` and the `softwareTokenMfaConfiguration` configuration block must be fully removed.
+
+### user_attribute_update_settings
+
+* `attributesRequireVerificationBeforeUpdate` - (Required) A list of attributes requiring verification before update. If set, the provided value(s) must also be set in `autoVerifiedAttributes`. Valid values: `email`, `phoneNumber`.
+
+### user_pool_add_ons
+
+* `advancedSecurityMode` - (Required) Mode for advanced security, must be one of `off`, `audit` or `enforced`.
+
+### username_configuration
+
+* `caseSensitive` - (Required) Whether username case sensitivity will be applied for all users in the user pool through Cognito APIs.
+
+### verification_message_template
+
+* `defaultEmailOption` - (Optional) Default email option. Must be either `confirmWithCode` or `confirmWithLink`. Defaults to `confirmWithCode`.
+* `emailMessage` - (Optional) Email message template. Must contain the `{####}` placeholder. Conflicts with `emailVerificationMessage` argument.
+* `emailMessageByLink` - (Optional) Email message template for sending a confirmation link to the user, it must contain the `{##Click Here##}` placeholder.
+* `emailSubject` - (Optional) Subject line for the email message template. Conflicts with `emailVerificationSubject` argument.
+* `emailSubjectByLink` - (Optional) Subject line for the email message template for sending a confirmation link to the user.
+* `smsMessage` - (Optional) SMS message template. Must contain the `{####}` placeholder. Conflicts with `smsVerificationMessage` argument.
+  
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the user pool.
+* `creationDate` - Date the user pool was created.
+* `customDomain` - A custom domain name that you provide to Amazon Cognito. This parameter applies only if you use a custom domain to host the sign-up and sign-in pages for your application. For example: `authExampleCom`.
+* `domain` - Holds the domain prefix if the user pool has a domain associated with it.
+* `endpoint` - Endpoint name of the user pool. Example format: `cognitoIdpRegionAmazonawsCom/xxxxYyyyy`
+* `estimatedNumberOfUsers` - A number estimating the size of the user pool.
+* `id` - ID of the user pool.
+* `lastModifiedDate` - Date the user pool was last modified.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Cognito User Pools using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Cognito User Pools using the `id`. For example:
+
+```console
+% terraform import aws_cognito_user_pool.pool us-west-2_abc123
+```
+
+<!-- cache-key: cdktf-0.18.0 input-956f61f5814a7a2fe0cddeef5fa9d4a645f79dd8c9a568695d52c319ef5ea5d4 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/cognito_user_pool_client.html.markdown b/website/docs/cdktf/typescript/r/cognito_user_pool_client.html.markdown
new file mode 100644
index 00000000000..9a46c72b0c0
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/cognito_user_pool_client.html.markdown
@@ -0,0 +1,294 @@
+---
+subcategory: "Cognito IDP (Identity Provider)"
+layout: "aws"
+page_title: "AWS: aws_cognito_user_pool_client"
+description: |-
+  Provides a Cognito User Pool Client resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cognito_user_pool_client
+
+Provides a Cognito User Pool Client resource.
+
+To manage a User Pool Client created by another service, such as when [configuring an OpenSearch Domain to use Cognito authentication](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/cognito-auth.html),
+use the [`awsCognitoManagedUserPoolClient` resource](cognito_managed_user_pool_client.html) instead.
+
+## Example Usage
+
+### Create a basic user pool client
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CognitoUserPool } from "./.gen/providers/aws/cognito-user-pool";
+import { CognitoUserPoolClient } from "./.gen/providers/aws/cognito-user-pool-client";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const pool = new CognitoUserPool(this, "pool", {
+      name: "pool",
+    });
+    new CognitoUserPoolClient(this, "client", {
+      name: "client",
+      userPoolId: pool.id,
+    });
+  }
+}
+
+```
+
+### Create a user pool client with no SRP authentication
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CognitoUserPool } from "./.gen/providers/aws/cognito-user-pool";
+import { CognitoUserPoolClient } from "./.gen/providers/aws/cognito-user-pool-client";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const pool = new CognitoUserPool(this, "pool", {
+      name: "pool",
+    });
+    new CognitoUserPoolClient(this, "client", {
+      explicitAuthFlows: ["ADMIN_NO_SRP_AUTH"],
+      generateSecret: true,
+      name: "client",
+      userPoolId: pool.id,
+    });
+  }
+}
+
+```
+
+### Create a user pool client with pinpoint analytics
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CognitoUserPool } from "./.gen/providers/aws/cognito-user-pool";
+import { CognitoUserPoolClient } from "./.gen/providers/aws/cognito-user-pool-client";
+import { DataAwsCallerIdentity } from "./.gen/providers/aws/data-aws-caller-identity";
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+import { IamRolePolicy } from "./.gen/providers/aws/iam-role-policy";
+import { PinpointApp } from "./.gen/providers/aws/pinpoint-app";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const test = new CognitoUserPool(this, "test", {
+      name: "pool",
+    });
+    const awsPinpointAppTest = new PinpointApp(this, "test_1", {
+      name: "pinpoint",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsPinpointAppTest.overrideLogicalId("test");
+    const current = new DataAwsCallerIdentity(this, "current", {});
+    const assumeRole = new DataAwsIamPolicyDocument(this, "assume_role", {
+      statement: [
+        {
+          actions: ["sts:AssumeRole"],
+          effect: "Allow",
+          principals: [
+            {
+              identifiers: ["cognito-idp.amazonaws.com"],
+              type: "Service",
+            },
+          ],
+        },
+      ],
+    });
+    const dataAwsIamPolicyDocumentTest = new DataAwsIamPolicyDocument(
+      this,
+      "test_4",
+      {
+        statement: [
+          {
+            actions: [
+              "mobiletargeting:UpdateEndpoint",
+              "mobiletargeting:PutEvents",
+            ],
+            effect: "Allow",
+            resources: [
+              "arn:aws:mobiletargeting:*:${" +
+                current.accountId +
+                "}:apps/${" +
+                awsPinpointAppTest.applicationId +
+                "}*",
+            ],
+          },
+        ],
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsIamPolicyDocumentTest.overrideLogicalId("test");
+    const awsIamRoleTest = new IamRole(this, "test_5", {
+      assumeRolePolicy: Token.asString(assumeRole.json),
+      name: "role",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamRoleTest.overrideLogicalId("test");
+    const awsIamRolePolicyTest = new IamRolePolicy(this, "test_6", {
+      name: "role_policy",
+      policy: Token.asString(dataAwsIamPolicyDocumentTest.json),
+      role: Token.asString(awsIamRoleTest.id),
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamRolePolicyTest.overrideLogicalId("test");
+    const awsCognitoUserPoolClientTest = new CognitoUserPoolClient(
+      this,
+      "test_7",
+      {
+        analyticsConfiguration: [
+          {
+            applicationId: Token.asString(awsPinpointAppTest.applicationId),
+            externalId: "some_id",
+            roleArn: Token.asString(awsIamRoleTest.arn),
+            userDataShared: true,
+          },
+        ],
+        name: "pool_client",
+        userPoolId: test.id,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsCognitoUserPoolClientTest.overrideLogicalId("test");
+  }
+}
+
+```
+
+### Create a user pool client with Cognito as the identity provider
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CognitoUserPool } from "./.gen/providers/aws/cognito-user-pool";
+import { CognitoUserPoolClient } from "./.gen/providers/aws/cognito-user-pool-client";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const pool = new CognitoUserPool(this, "pool", {
+      name: "pool",
+    });
+    new CognitoUserPoolClient(this, "userpool_client", {
+      allowedOauthFlows: ["code", "implicit"],
+      allowedOauthFlowsUserPoolClient: true,
+      allowedOauthScopes: ["email", "openid"],
+      callbackUrls: ["https://example.com"],
+      name: "client",
+      supportedIdentityProviders: ["COGNITO"],
+      userPoolId: pool.id,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) Name of the application client.
+* `userPoolId` - (Required) User pool the client belongs to.
+
+The following arguments are optional:
+
+* `accessTokenValidity` - (Optional) Time limit, between 5 minutes and 1 day, after which the access token is no longer valid and cannot be used.
+  By default, the unit is hours.
+  The unit can be overridden by a value in `tokenValidityUnitsAccessToken`.
+* `allowedOauthFlowsUserPoolClient` - (Optional) Whether the client is allowed to follow the OAuth protocol when interacting with Cognito user pools.
+* `allowedOauthFlows` - (Optional) List of allowed OAuth flows (code, implicit, client_credentials).
+* `allowedOauthScopes` - (Optional) List of allowed OAuth scopes (phone, email, openid, profile, and aws.cognito.signin.user.admin).
+* `analyticsConfiguration` - (Optional) Configuration block for Amazon Pinpoint analytics for collecting metrics for this user pool. [Detailed below](#analytics_configuration).
+* `authSessionValidity` - (Optional) Amazon Cognito creates a session token for each API request in an authentication flow. AuthSessionValidity is the duration, in minutes, of that session token. Your user pool native user must respond to each authentication challenge before the session expires. Valid values between `3` and `15`. Default value is `3`.
+* `callbackUrls` - (Optional) List of allowed callback URLs for the identity providers.
+* `defaultRedirectUri` - (Optional) Default redirect URI. Must be in the list of callback URLs.
+* `enableTokenRevocation` - (Optional) Enables or disables token revocation.
+* `enablePropagateAdditionalUserContextData` - (Optional) Activates the propagation of additional user context data.
+* `explicitAuthFlows` - (Optional) List of authentication flows (ADMIN_NO_SRP_AUTH, CUSTOM_AUTH_FLOW_ONLY, USER_PASSWORD_AUTH, ALLOW_ADMIN_USER_PASSWORD_AUTH, ALLOW_CUSTOM_AUTH, ALLOW_USER_PASSWORD_AUTH, ALLOW_USER_SRP_AUTH, ALLOW_REFRESH_TOKEN_AUTH).
+* `generateSecret` - (Optional) Should an application secret be generated.
+* `idTokenValidity` - (Optional) Time limit, between 5 minutes and 1 day, after which the ID token is no longer valid and cannot be used.
+  By default, the unit is hours.
+  The unit can be overridden by a value in `tokenValidityUnitsIdToken`.
+* `logoutUrls` - (Optional) List of allowed logout URLs for the identity providers.
+* `preventUserExistenceErrors` - (Optional) Choose which errors and responses are returned by Cognito APIs during authentication, account confirmation, and password recovery when the user does not exist in the user pool. When set to `enabled` and the user does not exist, authentication returns an error indicating either the username or password was incorrect, and account confirmation and password recovery return a response indicating a code was sent to a simulated destination. When set to `legacy`, those APIs will return a `userNotFoundException` exception if the user does not exist in the user pool.
+* `readAttributes` - (Optional) List of user pool attributes the application client can read from.
+* `refreshTokenValidity` - (Optional) Time limit, between 60 minutes and 10 years, after which the refresh token is no longer valid and cannot be used.
+  By default, the unit is days.
+  The unit can be overridden by a value in `tokenValidityUnitsRefreshToken`.
+* `supportedIdentityProviders` - (Optional) List of provider names for the identity providers that are supported on this client. Uses the `providerName` attribute of `awsCognitoIdentityProvider` resource(s), or the equivalent string(s).
+* `tokenValidityUnits` - (Optional) Configuration block for units in which the validity times are represented in. [Detailed below](#token_validity_units).
+* `writeAttributes` - (Optional) List of user pool attributes the application client can write to.
+
+### analytics_configuration
+
+Either `applicationArn` or `applicationId` is required.
+
+* `applicationArn` - (Optional) Application ARN for an Amazon Pinpoint application. Conflicts with `externalId` and `roleArn`.
+* `applicationId` - (Optional) Application ID for an Amazon Pinpoint application.
+* `externalId` - (Optional) ID for the Analytics Configuration. Conflicts with `applicationArn`.
+* `roleArn` - (Optional) ARN of an IAM role that authorizes Amazon Cognito to publish events to Amazon Pinpoint analytics. Conflicts with `applicationArn`.
+* `userDataShared` (Optional) If set to `true`, Amazon Cognito will include user data in the events it publishes to Amazon Pinpoint analytics.
+
+### token_validity_units
+
+Valid values for the following arguments are: `seconds`, `minutes`, `hours` or `days`.
+
+* `accessToken` - (Optional) Time unit in for the value in `accessTokenValidity`, defaults to `hours`.
+* `idToken` - (Optional) Time unit in for the value in `idTokenValidity`, defaults to `hours`.
+* `refreshToken` - (Optional) Time unit in for the value in `refreshTokenValidity`, defaults to `days`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `clientSecret` - Client secret of the user pool client.
+* `id` - ID of the user pool client.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Cognito User Pool Clients using the `id` of the Cognito User Pool, and the `id` of the Cognito User Pool Client. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Cognito User Pool Clients using the `id` of the Cognito User Pool, and the `id` of the Cognito User Pool Client. For example:
+
+```console
+% terraform import aws_cognito_user_pool_client.client us-west-2_abc123/3ho4ek12345678909nh3fmhpko
+```
+
+<!-- cache-key: cdktf-0.18.0 input-f15ecc5dad4d3b315fc63b6cc6f271d574fd906c13652ee8c6dbe7ed3789a449 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/cognito_user_pool_domain.html.markdown b/website/docs/cdktf/typescript/r/cognito_user_pool_domain.html.markdown
new file mode 100644
index 00000000000..1b664b9a348
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/cognito_user_pool_domain.html.markdown
@@ -0,0 +1,134 @@
+---
+subcategory: "Cognito IDP (Identity Provider)"
+layout: "aws"
+page_title: "AWS: aws_cognito_user_pool_domain"
+description: |-
+  Provides a Cognito User Pool Domain resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cognito_user_pool_domain
+
+Provides a Cognito User Pool Domain resource.
+
+## Example Usage
+
+### Amazon Cognito domain
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CognitoUserPool } from "./.gen/providers/aws/cognito-user-pool";
+import { CognitoUserPoolDomain } from "./.gen/providers/aws/cognito-user-pool-domain";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new CognitoUserPool(this, "example", {
+      name: "example-pool",
+    });
+    new CognitoUserPoolDomain(this, "main", {
+      domain: "example-domain",
+      userPoolId: example.id,
+    });
+  }
+}
+
+```
+
+### Custom Cognito domain
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CognitoUserPool } from "./.gen/providers/aws/cognito-user-pool";
+import { CognitoUserPoolDomain } from "./.gen/providers/aws/cognito-user-pool-domain";
+import { DataAwsRoute53Zone } from "./.gen/providers/aws/data-aws-route53-zone";
+import { Route53Record } from "./.gen/providers/aws/route53-record";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new CognitoUserPool(this, "example", {
+      name: "example-pool",
+    });
+    const main = new CognitoUserPoolDomain(this, "main", {
+      certificateArn: cert.arn,
+      domain: "example-domain",
+      userPoolId: example.id,
+    });
+    const dataAwsRoute53ZoneExample = new DataAwsRoute53Zone(
+      this,
+      "example_2",
+      {
+        name: "example.com",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsRoute53ZoneExample.overrideLogicalId("example");
+    new Route53Record(this, "auth-cognito-A", {
+      alias: {
+        evaluateTargetHealth: false,
+        name: main.cloudfrontDistribution,
+        zoneId: main.cloudfrontDistributionZoneId,
+      },
+      name: main.domain,
+      type: "A",
+      zoneId: Token.asString(dataAwsRoute53ZoneExample.zoneId),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `domain` - (Required) For custom domains, this is the fully-qualified domain name, such as auth.example.com. For Amazon Cognito prefix domains, this is the prefix alone, such as auth.
+* `userPoolId` - (Required) The user pool ID.
+* `certificateArn` - (Optional) The ARN of an ISSUED ACM certificate in us-east-1 for a custom domain.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `awsAccountId` - The AWS account ID for the user pool owner.
+* `cloudfrontDistribution` - The Amazon CloudFront endpoint (e.g. `dpp0Gtxikpq3YCloudfrontNet`) that you use as the target of the alias that you set up with your Domain Name Service (DNS) provider.
+* `cloudfrontDistributionArn` - The URL of the CloudFront distribution. This is required to generate the ALIAS `awsRoute53Record`
+* `cloudfrontDistributionZoneId` - The Route 53 hosted zone ID of the CloudFront distribution.
+* `s3Bucket` - The S3 bucket where the static files for this domain are stored.
+* `version` - The app version.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Cognito User Pool Domains using the `domain`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Cognito User Pool Domains using the `domain`. For example:
+
+```console
+% terraform import aws_cognito_user_pool_domain.main auth.example.org
+```
+
+<!-- cache-key: cdktf-0.18.0 input-733a59c8cc009e81485e84116993b875f945dcad026524678e85b20d84780cc3 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/cognito_user_pool_ui_customization.html.markdown b/website/docs/cdktf/typescript/r/cognito_user_pool_ui_customization.html.markdown
new file mode 100644
index 00000000000..280c8a35dfc
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/cognito_user_pool_ui_customization.html.markdown
@@ -0,0 +1,155 @@
+---
+subcategory: "Cognito IDP (Identity Provider)"
+layout: "aws"
+page_title: "AWS: aws_cognito_user_pool_ui_customization"
+description: |-
+  Provides a Cognito User Pool UI Customization resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cognito_user_pool_ui_customization
+
+Provides a Cognito User Pool UI Customization resource.
+
+~> **Note:** To use this resource, the user pool must have a domain associated with it. For more information, see the Amazon Cognito Developer Guide on [Customizing the Built-in Sign-In and Sign-up Webpages](https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-app-ui-customization.html).
+
+## Example Usage
+
+### UI customization settings for a single client
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, Fn, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CognitoUserPool } from "./.gen/providers/aws/cognito-user-pool";
+import { CognitoUserPoolClient } from "./.gen/providers/aws/cognito-user-pool-client";
+import { CognitoUserPoolDomain } from "./.gen/providers/aws/cognito-user-pool-domain";
+import { CognitoUserPoolUiCustomization } from "./.gen/providers/aws/cognito-user-pool-ui-customization";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new CognitoUserPool(this, "example", {
+      name: "example",
+    });
+    const awsCognitoUserPoolClientExample = new CognitoUserPoolClient(
+      this,
+      "example_1",
+      {
+        name: "example",
+        userPoolId: example.id,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsCognitoUserPoolClientExample.overrideLogicalId("example");
+    const awsCognitoUserPoolDomainExample = new CognitoUserPoolDomain(
+      this,
+      "example_2",
+      {
+        domain: "example",
+        userPoolId: example.id,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsCognitoUserPoolDomainExample.overrideLogicalId("example");
+    const awsCognitoUserPoolUiCustomizationExample =
+      new CognitoUserPoolUiCustomization(this, "example_3", {
+        clientId: Token.asString(awsCognitoUserPoolClientExample.id),
+        css: ".label-customizable {font-weight: 400;}",
+        imageFile: Token.asString(Fn.filebase64("logo.png")),
+        userPoolId: Token.asString(awsCognitoUserPoolDomainExample.userPoolId),
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsCognitoUserPoolUiCustomizationExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### UI customization settings for all clients
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CognitoUserPool } from "./.gen/providers/aws/cognito-user-pool";
+import { CognitoUserPoolDomain } from "./.gen/providers/aws/cognito-user-pool-domain";
+import { CognitoUserPoolUiCustomization } from "./.gen/providers/aws/cognito-user-pool-ui-customization";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new CognitoUserPool(this, "example", {
+      name: "example",
+    });
+    const awsCognitoUserPoolDomainExample = new CognitoUserPoolDomain(
+      this,
+      "example_1",
+      {
+        domain: "example",
+        userPoolId: example.id,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsCognitoUserPoolDomainExample.overrideLogicalId("example");
+    const awsCognitoUserPoolUiCustomizationExample =
+      new CognitoUserPoolUiCustomization(this, "example_2", {
+        css: ".label-customizable {font-weight: 400;}",
+        imageFile: Token.asString(Fn.filebase64("logo.png")),
+        userPoolId: Token.asString(awsCognitoUserPoolDomainExample.userPoolId),
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsCognitoUserPoolUiCustomizationExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `clientId` (Optional) The client ID for the client app. Defaults to `all`. If `all` is specified, the `css` and/or `imageFile` settings will be used for every client that has no UI customization set previously.
+* `css` (Optional) - The CSS values in the UI customization, provided as a String. At least one of `css` or `imageFile` is required.
+* `imageFile` (Optional) - The uploaded logo image for the UI customization, provided as a base64-encoded String. Drift detection is not possible for this argument. At least one of `css` or `imageFile` is required.
+* `userPoolId` (Required) - The user pool ID for the user pool.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `creationDate` - The creation date in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8) for the UI customization.
+* `cssVersion` - The CSS version number.
+* `imageUrl` - The logo image URL for the UI customization.
+* `lastModifiedDate` - The last-modified date in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8) for the UI customization.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Cognito User Pool UI Customizations using the `userPoolId` and `clientId` separated by `,`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Cognito User Pool UI Customizations using the `userPoolId` and `clientId` separated by `,`. For example:
+
+```console
+% terraform import aws_cognito_user_pool_ui_customization.example us-west-2_ZCTarbt5C,12bu4fuk3mlgqa2rtrujgp6egq
+```
+
+<!-- cache-key: cdktf-0.18.0 input-bf4b70b595c743ddb747623355c0d273cc993578aa1b9483b75e196d7e5ca18c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/comprehend_document_classifier.html.markdown b/website/docs/cdktf/typescript/r/comprehend_document_classifier.html.markdown
new file mode 100644
index 00000000000..1d37601921c
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/comprehend_document_classifier.html.markdown
@@ -0,0 +1,174 @@
+---
+subcategory: "Comprehend"
+layout: "aws"
+page_title: "AWS: aws_comprehend_document_classifier"
+description: |-
+  Terraform resource for managing an AWS Comprehend Document Classifier.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_comprehend_document_classifier
+
+Terraform resource for managing an AWS Comprehend Document Classifier.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ComprehendDocumentClassifier } from "./.gen/providers/aws/comprehend-document-classifier";
+import { S3Object } from "./.gen/providers/aws/s3-object";
+interface MyConfig {
+  bucket: any;
+  key: any;
+  bucket1: any;
+  key1: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    const documents = new S3Object(this, "documents", {
+      bucket: config.bucket,
+      key: config.key,
+    });
+    new S3Object(this, "entities", {
+      bucket: config.bucket1,
+      key: config.key1,
+    });
+    new ComprehendDocumentClassifier(this, "example", {
+      dataAccessRoleArn: Token.asString(awsIamRoleExample.arn),
+      dependsOn: [awsIamRolePolicyExample],
+      inputDataConfig: {
+        s3Uri: "s3://${" + test.bucket + "}/${" + documents.id + "}",
+      },
+      languageCode: "en",
+      name: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `dataAccessRoleArn` - (Required) The ARN for an IAM Role which allows Comprehend to read the training and testing data.
+* `inputDataConfig` - (Required) Configuration for the training and testing data.
+  See the [`inputDataConfig` Configuration Block](#input_data_config-configuration-block) section below.
+* `languageCode` - (Required) Two-letter language code for the language.
+  One of `en`, `es`, `fr`, `it`, `de`, or `pt`.
+* `name` - (Required) Name for the Document Classifier.
+  Has a maximum length of 63 characters.
+  Can contain upper- and lower-case letters, numbers, and hypen (`-`).
+
+The following arguments are optional:
+
+* `mode` - (Optional, Default: `multiClass`) The document classification mode.
+  One of `multiClass` or `multiLabel`.
+  `multiClass` is also known as "Single Label" in the AWS Console.
+* `modelKmsKeyId` - (Optional) KMS Key used to encrypt trained Document Classifiers.
+  Can be a KMS Key ID or a KMS Key ARN.
+* `outputDataConfig` - (Optional) Configuration for the output results of training.
+  See the [`outputDataConfig` Configuration Block](#output_data_config-configuration-block) section below.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` Configuration Block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `versionName` - (Optional) Name for the version of the Document Classifier.
+  Each version must have a unique name within the Document Classifier.
+  If omitted, Terraform will assign a random, unique version name.
+  If explicitly set to `""`, no version name will be set.
+  Has a maximum length of 63 characters.
+  Can contain upper- and lower-case letters, numbers, and hypen (`-`).
+  Conflicts with `versionNamePrefix`.
+* `versionNamePrefix` - (Optional) Creates a unique version name beginning with the specified prefix.
+  Has a maximum length of 37 characters.
+  Can contain upper- and lower-case letters, numbers, and hypen (`-`).
+  Conflicts with `versionName`.
+* `volumeKmsKeyId` - (Optional) KMS Key used to encrypt storage volumes during job processing.
+  Can be a KMS Key ID or a KMS Key ARN.
+* `vpcConfig` - (Optional) Configuration parameters for VPC to contain Document Classifier resources.
+  See the [`vpcConfig` Configuration Block](#vpc_config-configuration-block) section below.
+
+### `inputDataConfig` Configuration Block
+
+* `augmentedManifests` - (Optional) List of training datasets produced by Amazon SageMaker Ground Truth.
+  Used if `dataFormat` is `augmentedManifest`.
+  See the [`augmentedManifests` Configuration Block](#augmented_manifests-configuration-block) section below.
+* `dataFormat` - (Optional, Default: `comprehendCsv`) The format for the training data.
+  One of `comprehendCsv` or `augmentedManifest`.
+* `labelDelimiter` - (Optional) Delimiter between labels when training a multi-label classifier.
+  Valid values are `|`, `~`, `!`, `@`, `#`, `$`, `%`, `^`, `*`, `-`, `_`, `+`, `=`, `\`, `:`, `;`, `>`, `?`, `/`, `<space>`, and `<tab>`.
+  Default is `|`.
+* `s3Uri` - (Optional) Location of training documents.
+  Used if `dataFormat` is `comprehendCsv`.
+* `testS3Uri` - (Optional) Location of test documents.
+
+### `augmentedManifests` Configuration Block
+
+* `annotationDataS3Uri` - (Optional) Location of annotation files.
+* `attributeNames` - (Required) The JSON attribute that contains the annotations for the training documents.
+* `documentType` - (Optional, Default: `plainTextDocument`) Type of augmented manifest.
+  One of `plainTextDocument` or `semiStructuredDocument`.
+* `s3Uri` - (Required) Location of augmented manifest file.
+* `sourceDocumentsS3Uri` - (Optional) Location of source PDF files.
+* `split` - (Optional, Default: `train`) Purpose of data in augmented manifest.
+  One of `train` or `test`.
+
+### `outputDataConfig` Configuration Block
+
+* `kmsKeyId` - (Optional) KMS Key used to encrypt the output documents.
+  Can be a KMS Key ID, a KMS Key ARN, a KMS Alias name, or a KMS Alias ARN.
+* `outputS3Uri` - (Computed) Full path for the output documents.
+* `s3Uri` - (Required) Destination path for the output documents.
+  The full path to the output file will be returned in `outputS3Uri`.
+
+### `vpcConfig` Configuration Block
+
+* `securityGroupIds` - (Required) List of security group IDs.
+* `subnets` - (Required) List of VPC subnets.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Document Classifier version.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block).
+
+## Timeouts
+
+`awsComprehendDocumentClassifier` provides the following [Timeouts](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts) configuration options:
+
+* `create` - (Optional, Default: `60M`)
+* `update` - (Optional, Default: `60M`)
+* `delete` - (Optional, Default: `30M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Comprehend Document Classifier using the ARN. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Comprehend Document Classifier using the ARN. For example:
+
+```console
+% terraform import aws_comprehend_document_classifier.example arn:aws:comprehend:us-west-2:123456789012:document_classifier/example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-3bdf44a11e1e62cc863f8955dc4387827ea8dcfb6ef1cd3b96e5d632e2eea8cf -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/comprehend_entity_recognizer.html.markdown b/website/docs/cdktf/typescript/r/comprehend_entity_recognizer.html.markdown
new file mode 100644
index 00000000000..eae47157d1d
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/comprehend_entity_recognizer.html.markdown
@@ -0,0 +1,205 @@
+---
+subcategory: "Comprehend"
+layout: "aws"
+page_title: "AWS: aws_comprehend_entity_recognizer"
+description: |-
+  Terraform resource for managing an AWS Comprehend Entity Recognizer.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_comprehend_entity_recognizer
+
+Terraform resource for managing an AWS Comprehend Entity Recognizer.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ComprehendEntityRecognizer } from "./.gen/providers/aws/comprehend-entity-recognizer";
+import { S3Object } from "./.gen/providers/aws/s3-object";
+interface MyConfig {
+  bucket: any;
+  key: any;
+  bucket1: any;
+  key1: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    const documents = new S3Object(this, "documents", {
+      bucket: config.bucket,
+      key: config.key,
+    });
+    const entities = new S3Object(this, "entities", {
+      bucket: config.bucket1,
+      key: config.key1,
+    });
+    new ComprehendEntityRecognizer(this, "example", {
+      dataAccessRoleArn: Token.asString(awsIamRoleExample.arn),
+      dependsOn: [awsIamRolePolicyExample],
+      inputDataConfig: {
+        documents: {
+          s3Uri:
+            "s3://${" +
+            awsS3BucketDocuments.bucket +
+            "}/${" +
+            documents.id +
+            "}",
+        },
+        entityList: {
+          s3Uri:
+            "s3://${" + awsS3BucketEntities.bucket + "}/${" + entities.id + "}",
+        },
+        entityTypes: [
+          {
+            type: "ENTITY_1",
+          },
+          {
+            type: "ENTITY_2",
+          },
+        ],
+      },
+      languageCode: "en",
+      name: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `dataAccessRoleArn` - (Required) The ARN for an IAM Role which allows Comprehend to read the training and testing data.
+* `inputDataConfig` - (Required) Configuration for the training and testing data.
+  See the [`inputDataConfig` Configuration Block](#input_data_config-configuration-block) section below.
+* `languageCode` - (Required) Two-letter language code for the language.
+  One of `en`, `es`, `fr`, `it`, `de`, or `pt`.
+* `name` - (Required) Name for the Entity Recognizer.
+  Has a maximum length of 63 characters.
+  Can contain upper- and lower-case letters, numbers, and hypen (`-`).
+
+The following arguments are optional:
+
+* `modelKmsKeyId` - (Optional) The ID or ARN of a KMS Key used to encrypt trained Entity Recognizers.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` Configuration Block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `versionName` - (Optional) Name for the version of the Entity Recognizer.
+  Each version must have a unique name within the Entity Recognizer.
+  If omitted, Terraform will assign a random, unique version name.
+  If explicitly set to `""`, no version name will be set.
+  Has a maximum length of 63 characters.
+  Can contain upper- and lower-case letters, numbers, and hypen (`-`).
+  Conflicts with `versionNamePrefix`.
+* `versionNamePrefix` - (Optional) Creates a unique version name beginning with the specified prefix.
+  Has a maximum length of 37 characters.
+  Can contain upper- and lower-case letters, numbers, and hypen (`-`).
+  Conflicts with `versionName`.
+* `volumeKmsKeyId` - (Optional) ID or ARN of a KMS Key used to encrypt storage volumes during job processing.
+* `vpcConfig` - (Optional) Configuration parameters for VPC to contain Entity Recognizer resources.
+  See the [`vpcConfig` Configuration Block](#vpc_config-configuration-block) section below.
+
+### `inputDataConfig` Configuration Block
+
+* `annotations` - (Optional) Specifies location of the document annotation data.
+  See the [`annotations` Configuration Block](#annotations-configuration-block) section below.
+  One of `annotations` or `entityList` is required.
+* `augmentedManifests` - (Optional) List of training datasets produced by Amazon SageMaker Ground Truth.
+  Used if `dataFormat` is `augmentedManifest`.
+  See the [`augmentedManifests` Configuration Block](#augmented_manifests-configuration-block) section below.
+* `dataFormat` - (Optional, Default: `comprehendCsv`) The format for the training data.
+  One of `comprehendCsv` or `augmentedManifest`.
+* `documents` - (Optional) Specifies a collection of training documents.
+  Used if `dataFormat` is `comprehendCsv`.
+  See the [`documents` Configuration Block](#documents-configuration-block) section below.
+* `entityList` - (Optional) Specifies location of the entity list data.
+  See the [`entityList` Configuration Block](#entity_list-configuration-block) section below.
+  One of `entityList` or `annotations` is required.
+* `entityTypes` - (Required) Set of entity types to be recognized.
+  Has a maximum of 25 items.
+  See the [`entityTypes` Configuration Block](#entity_types-configuration-block) section below.
+
+### `annotations` Configuration Block
+
+* `s3Uri` - (Required) Location of training annotations.
+* `testS3Uri` - (Optional) Location of test annotations.
+
+### `augmentedManifests` Configuration Block
+
+* `annotationDataS3Uri` - (Optional) Location of annotation files.
+* `attributeNames` - (Required) The JSON attribute that contains the annotations for the training documents.
+* `documentType` - (Optional, Default: `plainTextDocument`) Type of augmented manifest.
+  One of `plainTextDocument` or `semiStructuredDocument`.
+* `s3Uri` - (Required) Location of augmented manifest file.
+* `sourceDocumentsS3Uri` - (Optional) Location of source PDF files.
+* `split` - (Optional, Default: `train`) Purpose of data in augmented manifest.
+  One of `train` or `test`.
+
+### `documents` Configuration Block
+
+* `inputFormat` - (Optional, Default: `oneDocPerLine`) Specifies how the input files should be processed.
+  One of `oneDocPerLine` or `oneDocPerFile`.
+* `s3Uri` - (Required) Location of training documents.
+* `testS3Uri` - (Optional) Location of test documents.
+
+### `entityList` Configuration Block
+
+* `s3Uri` - (Required) Location of entity list.
+
+### `entityTypes` Configuration Block
+
+* `type` - (Required) An entity type to be matched by the Entity Recognizer.
+  Cannot contain a newline (`\n`), carriage return (`\r`), or tab (`\t`).
+
+### `vpcConfig` Configuration Block
+
+* `securityGroupIds` - (Required) List of security group IDs.
+* `subnets` - (Required) List of VPC subnets.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Entity Recognizer version.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block).
+
+## Timeouts
+
+`awsComprehendEntityRecognizer` provides the following [Timeouts](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts) configuration options:
+
+* `create` - (Optional, Default: `60M`)
+* `update` - (Optional, Default: `60M`)
+* `delete` - (Optional, Default: `30M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Comprehend Entity Recognizer using the ARN. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Comprehend Entity Recognizer using the ARN. For example:
+
+```console
+% terraform import aws_comprehend_entity_recognizer.example arn:aws:comprehend:us-west-2:123456789012:entity-recognizer/example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-5a4f330d945c67ebd2c327cc9ed1a4d3cbd7331cc6eefe3c8b6a54590b34a394 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/config_aggregate_authorization.html.markdown b/website/docs/cdktf/typescript/r/config_aggregate_authorization.html.markdown
new file mode 100644
index 00000000000..7eb0f5ccf88
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/config_aggregate_authorization.html.markdown
@@ -0,0 +1,75 @@
+---
+subcategory: "Config"
+layout: "aws"
+page_title: "AWS: aws_config_aggregate_authorization"
+description: |-
+  Manages an AWS Config Aggregate Authorization.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_config_aggregate_authorization
+
+Manages an AWS Config Aggregate Authorization
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ConfigAggregateAuthorization } from "./.gen/providers/aws/config-aggregate-authorization";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ConfigAggregateAuthorization(this, "example", {
+      accountId: "123456789012",
+      region: "eu-west-2",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `accountId` - (Required) Account ID
+* `region` - (Required) Region
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the authorization
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Config aggregate authorizations using `accountId:region`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Config aggregate authorizations using `accountId:region`. For example:
+
+```console
+% terraform import aws_config_aggregate_authorization.example 123456789012:us-east-1
+```
+
+<!-- cache-key: cdktf-0.18.0 input-4204f5d9e939a49ac26b9c31dd13e4a4acdca6966654b750d69b34875f0ffb29 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/config_aggregate_authorization.markdown b/website/docs/cdktf/typescript/r/config_aggregate_authorization.markdown
new file mode 100644
index 00000000000..7eb0f5ccf88
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/config_aggregate_authorization.markdown
@@ -0,0 +1,75 @@
+---
+subcategory: "Config"
+layout: "aws"
+page_title: "AWS: aws_config_aggregate_authorization"
+description: |-
+  Manages an AWS Config Aggregate Authorization.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_config_aggregate_authorization
+
+Manages an AWS Config Aggregate Authorization
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ConfigAggregateAuthorization } from "./.gen/providers/aws/config-aggregate-authorization";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ConfigAggregateAuthorization(this, "example", {
+      accountId: "123456789012",
+      region: "eu-west-2",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `accountId` - (Required) Account ID
+* `region` - (Required) Region
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the authorization
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Config aggregate authorizations using `accountId:region`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Config aggregate authorizations using `accountId:region`. For example:
+
+```console
+% terraform import aws_config_aggregate_authorization.example 123456789012:us-east-1
+```
+
+<!-- cache-key: cdktf-0.18.0 input-4204f5d9e939a49ac26b9c31dd13e4a4acdca6966654b750d69b34875f0ffb29 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/config_config_rule.html.markdown b/website/docs/cdktf/typescript/r/config_config_rule.html.markdown
new file mode 100644
index 00000000000..77a7b9d522c
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/config_config_rule.html.markdown
@@ -0,0 +1,266 @@
+---
+subcategory: "Config"
+layout: "aws"
+page_title: "AWS: aws_config_config_rule"
+description: |-
+  Provides an AWS Config Rule.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_config_config_rule
+
+Provides an AWS Config Rule.
+
+~> **Note:** Config Rule requires an existing [Configuration Recorder](/docs/providers/aws/r/config_configuration_recorder.html) to be present. Use of `dependsOn` is recommended (as shown below) to avoid race conditions.
+
+## Example Usage
+
+### AWS Managed Rules
+
+AWS managed rules can be used by setting the source owner to `aws` and the source identifier to the name of the managed rule. More information about AWS managed rules can be found in the [AWS Config Developer Guide](https://docs.aws.amazon.com/config/latest/developerguide/evaluate-config_use-managed-rules.html).
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ConfigConfigRule } from "./.gen/providers/aws/config-config-rule";
+import { ConfigConfigurationRecorder } from "./.gen/providers/aws/config-configuration-recorder";
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+import { IamRolePolicy } from "./.gen/providers/aws/iam-role-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const assumeRole = new DataAwsIamPolicyDocument(this, "assume_role", {
+      statement: [
+        {
+          actions: ["sts:AssumeRole"],
+          effect: "Allow",
+          principals: [
+            {
+              identifiers: ["config.amazonaws.com"],
+              type: "Service",
+            },
+          ],
+        },
+      ],
+    });
+    const p = new DataAwsIamPolicyDocument(this, "p", {
+      statement: [
+        {
+          actions: ["config:Put*"],
+          effect: "Allow",
+          resources: ["*"],
+        },
+      ],
+    });
+    const r = new IamRole(this, "r", {
+      assumeRolePolicy: Token.asString(assumeRole.json),
+      name: "my-awsconfig-role",
+    });
+    const awsIamRolePolicyP = new IamRolePolicy(this, "p_3", {
+      name: "my-awsconfig-policy",
+      policy: Token.asString(p.json),
+      role: r.id,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamRolePolicyP.overrideLogicalId("p");
+    const foo = new ConfigConfigurationRecorder(this, "foo", {
+      name: "example",
+      roleArn: r.arn,
+    });
+    const awsConfigConfigRuleR = new ConfigConfigRule(this, "r_5", {
+      dependsOn: [foo],
+      name: "example",
+      source: {
+        owner: "AWS",
+        sourceIdentifier: "S3_BUCKET_VERSIONING_ENABLED",
+      },
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsConfigConfigRuleR.overrideLogicalId("r");
+  }
+}
+
+```
+
+### Custom Rules
+
+Custom rules can be used by setting the source owner to `customLambda` and the source identifier to the Amazon Resource Name (ARN) of the Lambda Function. The AWS Config service must have permissions to invoke the Lambda Function, e.g., via the [`awsLambdaPermission` resource](/docs/providers/aws/r/lambda_permission.html). More information about custom rules can be found in the [AWS Config Developer Guide](https://docs.aws.amazon.com/config/latest/developerguide/evaluate-config_develop-rules.html).
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ConfigConfigRule } from "./.gen/providers/aws/config-config-rule";
+import { ConfigConfigurationRecorder } from "./.gen/providers/aws/config-configuration-recorder";
+import { LambdaFunction } from "./.gen/providers/aws/lambda-function";
+import { LambdaPermission } from "./.gen/providers/aws/lambda-permission";
+interface MyConfig {
+  roleArn: any;
+  functionName: any;
+  role: any;
+  name: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    const example = new ConfigConfigurationRecorder(this, "example", {
+      roleArn: config.roleArn,
+    });
+    const awsLambdaFunctionExample = new LambdaFunction(this, "example_1", {
+      functionName: config.functionName,
+      role: config.role,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsLambdaFunctionExample.overrideLogicalId("example");
+    const awsLambdaPermissionExample = new LambdaPermission(this, "example_2", {
+      action: "lambda:InvokeFunction",
+      functionName: Token.asString(awsLambdaFunctionExample.arn),
+      principal: "config.amazonaws.com",
+      statementId: "AllowExecutionFromConfig",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsLambdaPermissionExample.overrideLogicalId("example");
+    const awsConfigConfigRuleExample = new ConfigConfigRule(this, "example_3", {
+      dependsOn: [example, awsLambdaPermissionExample],
+      source: {
+        owner: "CUSTOM_LAMBDA",
+        sourceIdentifier: Token.asString(awsLambdaFunctionExample.arn),
+      },
+      name: config.name,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsConfigConfigRuleExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### Custom Policies
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ConfigConfigRule } from "./.gen/providers/aws/config-config-rule";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ConfigConfigRule(this, "example", {
+      name: "example",
+      source: {
+        customPolicyDetails: {
+          policyRuntime: "guard-2.x.x",
+          policyText:
+            '\t  rule tableisactive when\n\t\t  resourceType == "AWS::DynamoDB::Table" {\n\t\t  configuration.tableStatus == [\'ACTIVE\']\n\t  }\n\t  \n\t  rule checkcompliance when\n\t\t  resourceType == "AWS::DynamoDB::Table"\n\t\t  tableisactive {\n\t\t\t  supplementaryConfiguration.ContinuousBackupsDescription.pointInTimeRecoveryDescription.pointInTimeRecoveryStatus == "ENABLED"\n\t  }\n\n',
+        },
+        owner: "CUSTOM_POLICY",
+        sourceDetail: [
+          {
+            messageType: "ConfigurationItemChangeNotification",
+          },
+        ],
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the rule
+* `description` - (Optional) Description of the rule
+* `evaluationMode` - (Optional) The modes the Config rule can be evaluated in. See [Evaluation Mode](#evaluation-mode) for more details.
+* `inputParameters` - (Optional) A string in JSON format that is passed to the AWS Config rule Lambda function.
+* `maximumExecutionFrequency` - (Optional) The maximum frequency with which AWS Config runs evaluations for a rule.
+* `scope` - (Optional) Scope defines which resources can trigger an evaluation for the rule. See [Source](#source) Below.
+* `source` - (Required) Source specifies the rule owner, the rule identifier, and the notifications that cause the function to evaluate your AWS resources. See [Scope](#scope) Below.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Evaluation Mode
+
+* `mode` - (Optional) The mode of an evaluation.
+
+### Scope
+
+Defines which resources can trigger an evaluation for the rule.
+If you do not specify a scope, evaluations are triggered when any resource in the recording group changes.
+
+* `complianceResourceId` - (Optional) The IDs of the only AWS resource that you want to trigger an evaluation for the rule. If you specify a resource ID, you must specify one resource type for `complianceResourceTypes`.
+* `complianceResourceTypes` - (Optional) A list of resource types of only those AWS resources that you want to trigger an evaluation for the ruleE.g., `aws::ec2::instance`. You can only specify one type if you also specify a resource ID for `complianceResourceId`. See [relevant part of AWS Docs](http://docs.aws.amazon.com/config/latest/APIReference/API_ResourceIdentifier.html#config-Type-ResourceIdentifier-resourceType) for available types.
+* `tagKey` - (Optional, Required if `tagValue` is specified) The tag key that is applied to only those AWS resources that you want you want to trigger an evaluation for the rule.
+* `tagValue` - (Optional) The tag value applied to only those AWS resources that you want to trigger an evaluation for the rule.
+
+### Source
+
+Provides the rule owner (AWS or customer), the rule identifier, and the notifications that cause the function to evaluate your AWS resources.
+
+* `owner` - (Required) Indicates whether AWS or the customer owns and manages the AWS Config rule. Valid values are `aws`, `customLambda` or `customPolicy`. For more information about managed rules, see the [AWS Config Managed Rules documentation](https://docs.aws.amazon.com/config/latest/developerguide/evaluate-config_use-managed-rules.html). For more information about custom rules, see the [AWS Config Custom Rules documentation](https://docs.aws.amazon.com/config/latest/developerguide/evaluate-config_develop-rules.html). Custom Lambda Functions require permissions to allow the AWS Config service to invoke them, e.g., via the [`awsLambdaPermission` resource](/docs/providers/aws/r/lambda_permission.html).
+* `sourceIdentifier` - (Optional) For AWS Config managed rules, a predefined identifier, e.g `iamPasswordPolicy`. For custom Lambda rules, the identifier is the ARN of the Lambda Function, such as `arn:aws:lambda:usEast1:123456789012:function:customRuleName` or the [`arn` attribute of the `awsLambdaFunction` resource](/docs/providers/aws/r/lambda_function.html#arn).
+* `sourceDetail` - (Optional) Provides the source and type of the event that causes AWS Config to evaluate your AWS resources. Only valid if `owner` is `customLambda` or `customPolicy`. See [Source Detail](#source-detail) Below.
+* `customPolicyDetails` - (Optional) Provides the runtime system, policy definition, and whether debug logging is enabled. Required when owner is set to `customPolicy`. See [Custom Policy Details](#custom-policy-details) Below.
+
+#### Source Detail
+
+* `eventSource` - (Optional) The source of the event, such as an AWS service, that triggers AWS Config to evaluate your AWSresources. This defaults to `awsConfig` and is the only valid value.
+* `maximumExecutionFrequency` - (Optional) The frequency that you want AWS Config to run evaluations for a rule that istriggered periodically. If specified, requires `messageType` to be `scheduledNotification`.
+* `messageType` - (Optional) The type of notification that triggers AWS Config to run an evaluation for a rule. You canspecify the following notification types:
+    * `configurationItemChangeNotification` - Triggers an evaluation when AWS Config delivers a configuration item as a result of a resource change.
+    * `oversizedConfigurationItemChangeNotification` - Triggers an evaluation when AWS Config delivers an oversized configuration item. AWS Config may generate this notification type when a resource changes and the notification exceeds the maximum size allowed by Amazon SNS.
+    * `scheduledNotification` - Triggers a periodic evaluation at the frequency specified for `maximumExecutionFrequency`.
+    * `configurationSnapshotDeliveryCompleted` - Triggers a periodic evaluation when AWS Config delivers a configuration snapshot.
+
+#### Custom Policy Details
+
+* `enableDebugLogDelivery` - (Optional) The boolean expression for enabling debug logging for your Config Custom Policy rule. The default value is `false`.
+* `policyRuntime` - (Required) The runtime system for your Config Custom Policy rule. Guard is a policy-as-code language that allows you to write policies that are enforced by Config Custom Policy rules. For more information about Guard, see the [Guard GitHub Repository](https://github.com/aws-cloudformation/cloudformation-guard).
+* `policyText` - (Required) The policy definition containing the logic for your Config Custom Policy rule.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the config rule
+* `ruleId` - The ID of the config rule
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Config Rule using the name. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Config Rule using the name. For example:
+
+```console
+% terraform import aws_config_config_rule.foo example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ddaef59fa5f30160f091633e8659aa1541092b84b1622013d4f61c51640fbed0 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/config_configuration_aggregator.html.markdown b/website/docs/cdktf/typescript/r/config_configuration_aggregator.html.markdown
new file mode 100644
index 00000000000..18fb60ea66b
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/config_configuration_aggregator.html.markdown
@@ -0,0 +1,165 @@
+---
+subcategory: "Config"
+layout: "aws"
+page_title: "AWS: aws_config_configuration_aggregator"
+description: |-
+  Manages an AWS Config Configuration Aggregator.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_config_configuration_aggregator
+
+Manages an AWS Config Configuration Aggregator
+
+## Example Usage
+
+### Account Based Aggregation
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ConfigConfigurationAggregator } from "./.gen/providers/aws/config-configuration-aggregator";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ConfigConfigurationAggregator(this, "account", {
+      accountAggregationSource: {
+        accountIds: ["123456789012"],
+        regions: ["us-west-2"],
+      },
+      name: "example",
+    });
+  }
+}
+
+```
+
+### Organization Based Aggregation
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ConfigConfigurationAggregator } from "./.gen/providers/aws/config-configuration-aggregator";
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+import { IamRolePolicyAttachment } from "./.gen/providers/aws/iam-role-policy-attachment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const assumeRole = new DataAwsIamPolicyDocument(this, "assume_role", {
+      statement: [
+        {
+          actions: ["sts:AssumeRole"],
+          effect: "Allow",
+          principals: [
+            {
+              identifiers: ["config.amazonaws.com"],
+              type: "Service",
+            },
+          ],
+        },
+      ],
+    });
+    const organization = new IamRole(this, "organization", {
+      assumeRolePolicy: Token.asString(assumeRole.json),
+      name: "example",
+    });
+    const awsIamRolePolicyAttachmentOrganization = new IamRolePolicyAttachment(
+      this,
+      "organization_2",
+      {
+        policyArn:
+          "arn:aws:iam::aws:policy/service-role/AWSConfigRoleForOrganizations",
+        role: organization.name,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamRolePolicyAttachmentOrganization.overrideLogicalId("organization");
+    const awsConfigConfigurationAggregatorOrganization =
+      new ConfigConfigurationAggregator(this, "organization_3", {
+        dependsOn: [awsIamRolePolicyAttachmentOrganization],
+        name: "example",
+        organizationAggregationSource: {
+          allRegions: true,
+          roleArn: organization.arn,
+        },
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsConfigConfigurationAggregatorOrganization.overrideLogicalId(
+      "organization"
+    );
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the configuration aggregator.
+* `accountAggregationSource` - (Optional) The account(s) to aggregate config data from as documented below.
+* `organizationAggregationSource` - (Optional) The organization to aggregate config data from as documented below.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+Either `accountAggregationSource` or `organizationAggregationSource` must be specified.
+
+### `accountAggregationSource`
+
+* `accountIds` - (Required) List of 12-digit account IDs of the account(s) being aggregated.
+* `allRegions` - (Optional) If true, aggregate existing AWS Config regions and future regions.
+* `regions` - (Optional) List of source regions being aggregated.
+
+Either `regions` or `allRegions` (as true) must be specified.
+
+### `organizationAggregationSource`
+
+~> **Note:** If your source type is an organization, you must be signed in to the master account and all features must be enabled in your organization. AWS Config calls EnableAwsServiceAccess API to enable integration between AWS Config and AWS Organizations.
+
+* `allRegions` - (Optional) If true, aggregate existing AWS Config regions and future regions.
+* `regions` - (Optional) List of source regions being aggregated.
+* `roleArn` - (Required) ARN of the IAM role used to retrieve AWS Organization details associated with the aggregator account.
+
+Either `regions` or `allRegions` (as true) must be specified.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the aggregator
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Configuration Aggregators using the name. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Configuration Aggregators using the name. For example:
+
+```console
+% terraform import aws_config_configuration_aggregator.example foo
+```
+
+<!-- cache-key: cdktf-0.18.0 input-bd7368dc645892d0916218e47f2c57cc5932d586ba0ba2eedc64e2d5eb4009f8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/config_configuration_recorder.html.markdown b/website/docs/cdktf/typescript/r/config_configuration_recorder.html.markdown
new file mode 100644
index 00000000000..1147a654df2
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/config_configuration_recorder.html.markdown
@@ -0,0 +1,150 @@
+---
+subcategory: "Config"
+layout: "aws"
+page_title: "AWS: aws_config_configuration_recorder"
+description: |-
+  Provides an AWS Config Configuration Recorder.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_config_configuration_recorder
+
+Provides an AWS Config Configuration Recorder. Please note that this resource **does not start** the created recorder automatically.
+
+~> **Note:** _Starting_ the Configuration Recorder requires a [delivery channel](/docs/providers/aws/r/config_delivery_channel.html) (while delivery channel creation requires Configuration Recorder). This is why [`awsConfigConfigurationRecorderStatus`](/docs/providers/aws/r/config_configuration_recorder_status.html) is a separate resource.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ConfigConfigurationRecorder } from "./.gen/providers/aws/config-configuration-recorder";
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const assumeRole = new DataAwsIamPolicyDocument(this, "assume_role", {
+      statement: [
+        {
+          actions: ["sts:AssumeRole"],
+          effect: "Allow",
+          principals: [
+            {
+              identifiers: ["config.amazonaws.com"],
+              type: "Service",
+            },
+          ],
+        },
+      ],
+    });
+    const r = new IamRole(this, "r", {
+      assumeRolePolicy: Token.asString(assumeRole.json),
+      name: "awsconfig-example",
+    });
+    new ConfigConfigurationRecorder(this, "foo", {
+      name: "example",
+      roleArn: r.arn,
+    });
+  }
+}
+
+```
+
+### Exclude Resources Types Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ConfigConfigurationRecorder } from "./.gen/providers/aws/config-configuration-recorder";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ConfigConfigurationRecorder(this, "foo", {
+      name: "example",
+      recordingGroup: {
+        allSupported: false,
+        exclusionByResourceTypes: [
+          {
+            resourceTypes: ["AWS::EC2::Instance"],
+          },
+        ],
+        recordingStrategy: [
+          {
+            useOnly: "EXCLUSION_BY_RESOURCE_TYPES",
+          },
+        ],
+      },
+      roleArn: r.arn,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Optional) The name of the recorder. Defaults to `default`. Changing it recreates the resource.
+* `roleArn` - (Required) Amazon Resource Name (ARN) of the IAM role. Used to make read or write requests to the delivery channel and to describe the AWS resources associated with the account. See [AWS Docs](http://docs.aws.amazon.com/config/latest/developerguide/iamrole-permissions.html) for more details.
+* `recordingGroup` - (Optional) Recording group - see below.
+
+### recording_group Configuration Block
+
+* `allSupported` - (Optional) Specifies whether AWS Config records configuration changes for every supported type of regional resource (which includes any new type that will become supported in the future). Conflicts with `resourceTypes`. Defaults to `true`.
+* `exclusionByResourceTypes` - (Optional) An object that specifies how AWS Config excludes resource types from being recorded by the configuration recorder.To use this option, you must set the useOnly field of RecordingStrategy to `exclusionByResourceTypes` Requires `all_supported = false`. Conflicts with `resourceTypes`.
+* `includeGlobalResourceTypes` - (Optional) Specifies whether AWS Config includes all supported types of _global resources_ with the resources that it records. Requires `all_supported = true`. Conflicts with `resourceTypes`.
+* `recordingStrategy` - (Optional) Recording Strategy. Detailed below.
+* `resourceTypes` - (Optional) A list that specifies the types of AWS resources for which AWS Config records configuration changes (for example, `aws::ec2::instance` or `aws::cloudTrail::trail`). See [relevant part of AWS Docs](http://docs.aws.amazon.com/config/latest/APIReference/API_ResourceIdentifier.html#config-Type-ResourceIdentifier-resourceType) for available types. In order to use this attribute, `allSupported` must be set to false.
+
+#### exclusion_by_resource_types Configuration Block
+
+* `resourceTypes` - (Optional) A list that specifies the types of AWS resources for which AWS Config excludes records configuration changes. See [relevant part of AWS Docs](http://docs.aws.amazon.com/config/latest/APIReference/API_ResourceIdentifier.html#config-Type-ResourceIdentifier-resourceType) for available types.
+
+#### recording_strategy Configuration Block
+
+* ` use_only` - (Optional) The recording strategy for the configuration recorder.See [relevant part of AWS Docs](https://docs.aws.amazon.com/config/latest/APIReference/API_RecordingStrategy.html)
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Name of the recorder
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Configuration Recorder using the name. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Configuration Recorder using the name. For example:
+
+```console
+% terraform import aws_config_configuration_recorder.foo example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-f7d9392378b34f2ee90f6663aee76cb66b2d7d72f4eb2ced771d862822d5a3df -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/config_configuration_recorder_status.html.markdown b/website/docs/cdktf/typescript/r/config_configuration_recorder_status.html.markdown
new file mode 100644
index 00000000000..2e06259e1fd
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/config_configuration_recorder_status.html.markdown
@@ -0,0 +1,139 @@
+---
+subcategory: "Config"
+layout: "aws"
+page_title: "AWS: aws_config_configuration_recorder_status"
+description: |-
+  Manages status of an AWS Config Configuration Recorder.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_config_configuration_recorder_status
+
+Manages status (recording / stopped) of an AWS Config Configuration Recorder.
+
+~> **Note:** Starting Configuration Recorder requires a [Delivery Channel](/docs/providers/aws/r/config_delivery_channel.html) to be present. Use of `dependsOn` (as shown below) is recommended to avoid race conditions.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ConfigConfigurationRecorder } from "./.gen/providers/aws/config-configuration-recorder";
+import { ConfigConfigurationRecorderStatus } from "./.gen/providers/aws/config-configuration-recorder-status";
+import { ConfigDeliveryChannel } from "./.gen/providers/aws/config-delivery-channel";
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+import { IamRolePolicy } from "./.gen/providers/aws/iam-role-policy";
+import { IamRolePolicyAttachment } from "./.gen/providers/aws/iam-role-policy-attachment";
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const b = new S3Bucket(this, "b", {
+      bucket: "awsconfig-example",
+    });
+    const assumeRole = new DataAwsIamPolicyDocument(this, "assume_role", {
+      statement: [
+        {
+          actions: ["sts:AssumeRole"],
+          effect: "Allow",
+          principals: [
+            {
+              identifiers: ["config.amazonaws.com"],
+              type: "Service",
+            },
+          ],
+        },
+      ],
+    });
+    const p = new DataAwsIamPolicyDocument(this, "p", {
+      statement: [
+        {
+          actions: ["s3:*"],
+          effect: "Allow",
+          resources: [b.arn, "${" + b.arn + "}/*"],
+        },
+      ],
+    });
+    const foo = new ConfigDeliveryChannel(this, "foo", {
+      name: "example",
+      s3BucketName: b.bucket,
+    });
+    const r = new IamRole(this, "r", {
+      assumeRolePolicy: Token.asString(assumeRole.json),
+      name: "example-awsconfig",
+    });
+    const awsIamRolePolicyP = new IamRolePolicy(this, "p_5", {
+      name: "awsconfig-example",
+      policy: Token.asString(p.json),
+      role: r.id,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamRolePolicyP.overrideLogicalId("p");
+    new IamRolePolicyAttachment(this, "a", {
+      policyArn: "arn:aws:iam::aws:policy/service-role/AWS_ConfigRole",
+      role: r.name,
+    });
+    const awsConfigConfigurationRecorderFoo = new ConfigConfigurationRecorder(
+      this,
+      "foo_7",
+      {
+        name: "example",
+        roleArn: r.arn,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsConfigConfigurationRecorderFoo.overrideLogicalId("foo");
+    const awsConfigConfigurationRecorderStatusFoo =
+      new ConfigConfigurationRecorderStatus(this, "foo_8", {
+        dependsOn: [foo],
+        isEnabled: true,
+        name: Token.asString(awsConfigConfigurationRecorderFoo.name),
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsConfigConfigurationRecorderStatusFoo.overrideLogicalId("foo");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the recorder
+* `isEnabled` - (Required) Whether the configuration recorder should be enabled or disabled.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Configuration Recorder Status using the name of the Configuration Recorder. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Configuration Recorder Status using the name of the Configuration Recorder. For example:
+
+```console
+% terraform import aws_config_configuration_recorder_status.foo example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-eff5be1ca06224bd56323b786df4a302b3a7bde4963a5efe48e7bee409360bcf -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/config_conformance_pack.html.markdown b/website/docs/cdktf/typescript/r/config_conformance_pack.html.markdown
new file mode 100644
index 00000000000..ad48019c5c4
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/config_conformance_pack.html.markdown
@@ -0,0 +1,147 @@
+---
+subcategory: "Config"
+layout: "aws"
+page_title: "AWS: aws_config_conformance_pack"
+description: |-
+  Manages a Config Conformance Pack
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_config_conformance_pack
+
+Manages a Config Conformance Pack. More information about this collection of Config rules and remediation actions can be found in the
+[Conformance Packs](https://docs.aws.amazon.com/config/latest/developerguide/conformance-packs.html) documentation.
+Sample Conformance Pack templates may be found in the
+[AWS Config Rules Repository](https://github.com/awslabs/aws-config-rules/tree/master/aws-config-conformance-packs).
+
+~> **NOTE:** The account must have a Configuration Recorder with proper IAM permissions before the Conformance Pack will
+successfully create or update. See also the
+[`awsConfigConfigurationRecorder` resource](/docs/providers/aws/r/config_configuration_recorder.html).
+
+## Example Usage
+
+### Template Body
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ConfigConformancePack } from "./.gen/providers/aws/config-conformance-pack";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ConfigConformancePack(this, "example", {
+      dependsOn: [awsConfigConfigurationRecorderExample],
+      inputParameter: [
+        {
+          parameterName: "AccessKeysRotatedParameterMaxAccessKeyAge",
+          parameterValue: "90",
+        },
+      ],
+      name: "example",
+      templateBody:
+        "Parameters:\n  AccessKeysRotatedParameterMaxAccessKeyAge:\n    Type: String\nResources:\n  IAMPasswordPolicy:\n    Properties:\n      ConfigRuleName: IAMPasswordPolicy\n      Source:\n        Owner: AWS\n        SourceIdentifier: IAM_PASSWORD_POLICY\n    Type: AWS::Config::ConfigRule\n\n",
+    });
+  }
+}
+
+```
+
+### Template S3 URI
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ConfigConformancePack } from "./.gen/providers/aws/config-conformance-pack";
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3Object } from "./.gen/providers/aws/s3-object";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new S3Bucket(this, "example", {
+      bucket: "example",
+    });
+    const awsS3ObjectExample = new S3Object(this, "example_1", {
+      bucket: example.id,
+      content:
+        "Resources:\n  IAMPasswordPolicy:\n    Properties:\n      ConfigRuleName: IAMPasswordPolicy\n      Source:\n        Owner: AWS\n        SourceIdentifier: IAM_PASSWORD_POLICY\n    Type: AWS::Config::ConfigRule\n\n",
+      key: "example-key",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3ObjectExample.overrideLogicalId("example");
+    const awsConfigConformancePackExample = new ConfigConformancePack(
+      this,
+      "example_2",
+      {
+        dependsOn: [awsConfigConfigurationRecorderExample],
+        name: "example",
+        templateS3Uri:
+          "s3://${" + example.bucket + "}/${" + awsS3ObjectExample.key + "}",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsConfigConformancePackExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+~> **Note:** If both `templateBody` and `templateS3Uri` are specified, AWS Config uses the `templateS3Uri` and ignores the `templateBody`.
+
+This argument supports the following arguments:
+
+* `name` - (Required, Forces new resource) The name of the conformance pack. Must begin with a letter and contain from 1 to 256 alphanumeric characters and hyphens.
+* `deliveryS3Bucket` - (Optional) Amazon S3 bucket where AWS Config stores conformance pack templates. Maximum length of 63.
+* `deliveryS3KeyPrefix` - (Optional) The prefix for the Amazon S3 bucket. Maximum length of 1024.
+* `inputParameter` - (Optional) Set of configuration blocks describing input parameters passed to the conformance pack template. Documented below. When configured, the parameters must also be included in the `templateBody` or in the template stored in Amazon S3 if using `templateS3Uri`.
+* `templateBody` - (Optional, required if `templateS3Uri` is not provided) A string containing full conformance pack template body. Maximum length of 51200. Drift detection is not possible with this argument.
+* `templateS3Uri` - (Optional, required if `templateBody` is not provided) Location of file, e.g., `s3://bucketname/prefix`, containing the template body. The uri must point to the conformance pack template that is located in an Amazon S3 bucket in the same region as the conformance pack. Maximum length of 1024. Drift detection is not possible with this argument.
+
+### input_parameter Argument Reference
+
+The `inputParameter` configuration block supports the following arguments:
+
+* `parameterName` - (Required) The input key.
+* `parameterValue` - (Required) The input value.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the conformance pack.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Config Conformance Packs using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Config Conformance Packs using the `name`. For example:
+
+```console
+% terraform import aws_config_conformance_pack.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-86a608716b92b915769aca6b0e5f24ca5b42bf4f52fb91a1566b43fe79868c79 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/config_delivery_channel.html.markdown b/website/docs/cdktf/typescript/r/config_delivery_channel.html.markdown
new file mode 100644
index 00000000000..6c997dffc7b
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/config_delivery_channel.html.markdown
@@ -0,0 +1,137 @@
+---
+subcategory: "Config"
+layout: "aws"
+page_title: "AWS: aws_config_delivery_channel"
+description: |-
+  Provides an AWS Config Delivery Channel.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_config_delivery_channel
+
+Provides an AWS Config Delivery Channel.
+
+~> **Note:** Delivery Channel requires a [Configuration Recorder](/docs/providers/aws/r/config_configuration_recorder.html) to be present. Use of `dependsOn` (as shown below) is recommended to avoid race conditions.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ConfigConfigurationRecorder } from "./.gen/providers/aws/config-configuration-recorder";
+import { ConfigDeliveryChannel } from "./.gen/providers/aws/config-delivery-channel";
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+import { IamRolePolicy } from "./.gen/providers/aws/iam-role-policy";
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const b = new S3Bucket(this, "b", {
+      bucket: "example-awsconfig",
+      forceDestroy: true,
+    });
+    const assumeRole = new DataAwsIamPolicyDocument(this, "assume_role", {
+      statement: [
+        {
+          actions: ["sts:AssumeRole"],
+          effect: "Allow",
+          principals: [
+            {
+              identifiers: ["config.amazonaws.com"],
+              type: "Service",
+            },
+          ],
+        },
+      ],
+    });
+    const p = new DataAwsIamPolicyDocument(this, "p", {
+      statement: [
+        {
+          actions: ["s3:*"],
+          effect: "Allow",
+          resources: [b.arn, "${" + b.arn + "}/*"],
+        },
+      ],
+    });
+    const r = new IamRole(this, "r", {
+      assumeRolePolicy: Token.asString(assumeRole.json),
+      name: "awsconfig-example",
+    });
+    const awsIamRolePolicyP = new IamRolePolicy(this, "p_4", {
+      name: "awsconfig-example",
+      policy: Token.asString(p.json),
+      role: r.id,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamRolePolicyP.overrideLogicalId("p");
+    const foo = new ConfigConfigurationRecorder(this, "foo", {
+      name: "example",
+      roleArn: r.arn,
+    });
+    const awsConfigDeliveryChannelFoo = new ConfigDeliveryChannel(
+      this,
+      "foo_6",
+      {
+        dependsOn: [foo],
+        name: "example",
+        s3BucketName: b.bucket,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsConfigDeliveryChannelFoo.overrideLogicalId("foo");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Optional) The name of the delivery channel. Defaults to `default`. Changing it recreates the resource.
+* `s3BucketName` - (Required) The name of the S3 bucket used to store the configuration history.
+* `s3KeyPrefix` - (Optional) The prefix for the specified S3 bucket.
+* `s3KmsKeyArn` - (Optional) The ARN of the AWS KMS key used to encrypt objects delivered by AWS Config. Must belong to the same Region as the destination S3 bucket.
+* `snsTopicArn` - (Optional) The ARN of the SNS topic that AWS Config delivers notifications to.
+* `snapshotDeliveryProperties` - (Optional) Options for how AWS Config delivers configuration snapshots. See below
+
+### `snapshotDeliveryProperties`
+
+* `deliveryFrequency` - (Optional) - The frequency with which AWS Config recurringly delivers configuration snapshotsE.g., `oneHour` or `threeHours`. Valid values are listed [here](https://docs.aws.amazon.com/config/latest/APIReference/API_ConfigSnapshotDeliveryProperties.html#API_ConfigSnapshotDeliveryProperties_Contents).
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name of the delivery channel.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Delivery Channel using the name. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Delivery Channel using the name. For example:
+
+```console
+% terraform import aws_config_delivery_channel.foo example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-54435b5e17865652d2b4e1be7bdaf36c37288ea5a996a242391550ce3763b0a2 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/config_organization_conformance_pack.html.markdown b/website/docs/cdktf/typescript/r/config_organization_conformance_pack.html.markdown
new file mode 100644
index 00000000000..b2e58a0277c
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/config_organization_conformance_pack.html.markdown
@@ -0,0 +1,166 @@
+---
+subcategory: "Config"
+layout: "aws"
+page_title: "AWS: aws_config_organization_conformance_pack"
+description: |-
+  Manages a Config Organization Conformance Pack
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_config_organization_conformance_pack
+
+Manages a Config Organization Conformance Pack. More information can be found in the [Managing Conformance Packs Across all Accounts in Your Organization](https://docs.aws.amazon.com/config/latest/developerguide/conformance-pack-organization-apis.html) and [AWS Config Managed Rules](https://docs.aws.amazon.com/config/latest/developerguide/evaluate-config_use-managed-rules.html) documentation. Example conformance pack templates may be found in the [AWS Config Rules Repository](https://github.com/awslabs/aws-config-rules/tree/master/aws-config-conformance-packs).
+
+~> **NOTE:** This resource must be created in the Organization master account or a delegated administrator account, and the Organization must have all features enabled. Every Organization account except those configured in the `excludedAccounts` argument must have a Configuration Recorder with proper IAM permissions before the Organization Conformance Pack will successfully create or update. See also the [`awsConfigConfigurationRecorder` resource](/docs/providers/aws/r/config_configuration_recorder.html).
+
+## Example Usage
+
+### Using Template Body
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ConfigOrganizationConformancePack } from "./.gen/providers/aws/config-organization-conformance-pack";
+import { OrganizationsOrganization } from "./.gen/providers/aws/organizations-organization";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new OrganizationsOrganization(this, "example", {
+      awsServiceAccessPrincipals: ["config-multiaccountsetup.amazonaws.com"],
+      featureSet: "ALL",
+    });
+    const awsConfigOrganizationConformancePackExample =
+      new ConfigOrganizationConformancePack(this, "example_1", {
+        dependsOn: [awsConfigConfigurationRecorderExample, example],
+        inputParameter: [
+          {
+            parameterName: "AccessKeysRotatedParameterMaxAccessKeyAge",
+            parameterValue: "90",
+          },
+        ],
+        name: "example",
+        templateBody:
+          "Parameters:\n  AccessKeysRotatedParameterMaxAccessKeyAge:\n    Type: String\nResources:\n  IAMPasswordPolicy:\n    Properties:\n      ConfigRuleName: IAMPasswordPolicy\n      Source:\n        Owner: AWS\n        SourceIdentifier: IAM_PASSWORD_POLICY\n    Type: AWS::Config::ConfigRule\n\n",
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsConfigOrganizationConformancePackExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### Using Template S3 URI
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ConfigOrganizationConformancePack } from "./.gen/providers/aws/config-organization-conformance-pack";
+import { OrganizationsOrganization } from "./.gen/providers/aws/organizations-organization";
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3Object } from "./.gen/providers/aws/s3-object";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new OrganizationsOrganization(this, "example", {
+      awsServiceAccessPrincipals: ["config-multiaccountsetup.amazonaws.com"],
+      featureSet: "ALL",
+    });
+    const awsS3BucketExample = new S3Bucket(this, "example_1", {
+      bucket: "example",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketExample.overrideLogicalId("example");
+    const awsS3ObjectExample = new S3Object(this, "example_2", {
+      bucket: Token.asString(awsS3BucketExample.id),
+      content:
+        "Resources:\n  IAMPasswordPolicy:\n    Properties:\n      ConfigRuleName: IAMPasswordPolicy\n      Source:\n        Owner: AWS\n        SourceIdentifier: IAM_PASSWORD_POLICY\n    Type: AWS::Config::ConfigRule\n\n",
+      key: "example-key",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3ObjectExample.overrideLogicalId("example");
+    const awsConfigOrganizationConformancePackExample =
+      new ConfigOrganizationConformancePack(this, "example_3", {
+        dependsOn: [awsConfigConfigurationRecorderExample, example],
+        name: "example",
+        templateS3Uri:
+          "s3://${" +
+          awsS3BucketExample.bucket +
+          "}/${" +
+          awsS3ObjectExample.key +
+          "}",
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsConfigOrganizationConformancePackExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required, Forces new resource) The name of the organization conformance pack. Must begin with a letter and contain from 1 to 128 alphanumeric characters and hyphens.
+* `deliveryS3Bucket` - (Optional) Amazon S3 bucket where AWS Config stores conformance pack templates. Delivery bucket must begin with `awsconfigconforms` prefix. Maximum length of 63.
+* `deliveryS3KeyPrefix` - (Optional) The prefix for the Amazon S3 bucket. Maximum length of 1024.
+* `excludedAccounts` - (Optional) Set of AWS accounts to be excluded from an organization conformance pack while deploying a conformance pack. Maximum of 1000 accounts.
+* `inputParameter` - (Optional) Set of configuration blocks describing input parameters passed to the conformance pack template. Documented below. When configured, the parameters must also be included in the `templateBody` or in the template stored in Amazon S3 if using `templateS3Uri`.
+* `templateBody` - (Optional, Conflicts with `templateS3Uri`) A string containing full conformance pack template body. Maximum length of 51200. Drift detection is not possible with this argument.
+* `templateS3Uri` - (Optional, Conflicts with `templateBody`) Location of file, e.g., `s3://bucketname/prefix`, containing the template body. The uri must point to the conformance pack template that is located in an Amazon S3 bucket in the same region as the conformance pack. Maximum length of 1024. Drift detection is not possible with this argument.
+
+### input_parameter Argument Reference
+
+The `inputParameter` configuration block supports the following arguments:
+
+* `parameterName` - (Required) The input key.
+* `parameterValue` - (Required) The input value.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the organization conformance pack.
+* `id` - The name of the organization conformance pack.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `10M`)
+- `update` - (Default `10M`)
+- `delete` - (Default `20M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Config Organization Conformance Packs using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Config Organization Conformance Packs using the `name`. For example:
+
+```console
+% terraform import aws_config_organization_conformance_pack.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-4f933a5e639d5b2cfd2450761a6e901c02e6e8a4875255817cf9b88f4cfacd1d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/config_organization_custom_policy_rule.html.markdown b/website/docs/cdktf/typescript/r/config_organization_custom_policy_rule.html.markdown
new file mode 100644
index 00000000000..bab021299fe
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/config_organization_custom_policy_rule.html.markdown
@@ -0,0 +1,106 @@
+---
+subcategory: "Config"
+layout: "aws"
+page_title: "AWS: aws_config_organization_custom_policy_rule"
+description: |-
+  Terraform resource for managing an AWS Config Organization Custom Policy.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_config_organization_custom_policy_rule
+
+Manages a Config Organization Custom Policy Rule. More information about these rules can be found in the [Enabling AWS Config Rules Across all Accounts in Your Organization](https://docs.aws.amazon.com/config/latest/developerguide/config-rule-multi-account-deployment.html) and [AWS Config Managed Rules](https://docs.aws.amazon.com/config/latest/developerguide/evaluate-config_use-managed-rules.html) documentation. For working with Organization Managed Rules (those invoking an AWS managed rule), see the [`awsConfigOrganizationManagedRule` resource](/docs/providers/aws/r/config_organization_managed_rule.html).
+
+~> **NOTE:** This resource must be created in the Organization master account and rules will include the master account unless its ID is added to the `excludedAccounts` argument.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ConfigOrganizationCustomPolicyRule } from "./.gen/providers/aws/config-organization-custom-policy-rule";
+interface MyConfig {
+  triggerTypes: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new ConfigOrganizationCustomPolicyRule(this, "example", {
+      name: "example_rule_name",
+      policyRuntime: "guard-2.x.x",
+      policyText:
+        'let status = [\'ACTIVE\']\n\nrule tableisactive when\n    resourceType == "AWS::DynamoDB::Table" {\n    configuration.tableStatus == %status\n}\n\nrule checkcompliance when\n    resourceType == "AWS::DynamoDB::Table"\n    tableisactive {\n        let pitr = supplementaryConfiguration.ContinuousBackupsDescription.pointInTimeRecoveryDescription.pointInTimeRecoveryStatus\n        %pitr == "ENABLED"\n    }\n\n',
+      resourceTypesScope: ["AWS::DynamoDB::Table"],
+      triggerTypes: config.triggerTypes,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) name of the rule
+* `policyText` - (Required) policy definition containing the logic for your organization AWS Config Custom Policy rule
+* `policyRuntime` - (Required)  runtime system for your organization AWS Config Custom Policy rules
+* `triggerTypes` - (Required) List of notification types that trigger AWS Config to run an evaluation for the rule. Valid values: `configurationItemChangeNotification`, `oversizedConfigurationItemChangeNotification`
+
+The following arguments are optional:
+
+* `description` - (Optional) Description of the rule
+* `debugLogDeliveryAccounts` - (Optional) List of AWS account identifiers to exclude from the rule
+* `excludedAccounts` - (Optional) List of AWS account identifiers to exclude from the rule
+* `inputParameters` - (Optional) A string in JSON format that is passed to the AWS Config Rule Lambda Function
+* `maximumExecutionFrequency` - (Optional) Maximum frequency with which AWS Config runs evaluations for a rule, if the rule is triggered at a periodic frequency. Defaults to `twentyFourHours` for periodic frequency triggered rules. Valid values: `oneHour`, `threeHours`, `sixHours`, `twelveHours`, or `twentyFourHours`.
+* `resourceIdScope` - (Optional) Identifier of the AWS resource to evaluate
+* `resourceTypesScope` - (Optional) List of types of AWS resources to evaluate
+* `tagKeyScope` - (Optional, Required if `tagValueScope` is configured) Tag key of AWS resources to evaluate
+* `tagValueScope` - (Optional) Tag value of AWS resources to evaluate
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the rule
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `20M`)
+* `update` - (Default `20M`)
+* `delete` - (Default `20M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import a Config Organization Custom Policy Rule using the `name` argument. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import a Config Organization Custom Policy Rule using the `name` argument. For example:
+
+```console
+% terraform import aws_config_organization_custom_policy_rule.example example_rule_name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-f90143a3072d513a2fe1459c4bfdb050b7dfd52b0b478cfb10ff823139422527 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/config_organization_custom_rule.html.markdown b/website/docs/cdktf/typescript/r/config_organization_custom_rule.html.markdown
new file mode 100644
index 00000000000..df088dbc8bb
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/config_organization_custom_rule.html.markdown
@@ -0,0 +1,117 @@
+---
+subcategory: "Config"
+layout: "aws"
+page_title: "AWS: aws_config_organization_custom_rule"
+description: |-
+  Manages a Config Organization Custom Rule
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_config_organization_custom_rule
+
+Manages a Config Organization Custom Rule. More information about these rules can be found in the [Enabling AWS Config Rules Across all Accounts in Your Organization](https://docs.aws.amazon.com/config/latest/developerguide/config-rule-multi-account-deployment.html) and [AWS Config Managed Rules](https://docs.aws.amazon.com/config/latest/developerguide/evaluate-config_use-managed-rules.html) documentation. For working with Organization Managed Rules (those invoking an AWS managed rule), see the [`awsConfigOrganizationManagedRule` resource](/docs/providers/aws/r/config_organization_managed_rule.html).
+
+~> **NOTE:** This resource must be created in the Organization master account and rules will include the master account unless its ID is added to the `excludedAccounts` argument.
+
+~> **NOTE:** The proper Lambda permission to allow the AWS Config service invoke the Lambda Function must be in place before the rule will successfully create or update. See also the [`awsLambdaPermission` resource](/docs/providers/aws/r/lambda_permission.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ConfigOrganizationCustomRule } from "./.gen/providers/aws/config-organization-custom-rule";
+import { LambdaPermission } from "./.gen/providers/aws/lambda-permission";
+import { OrganizationsOrganization } from "./.gen/providers/aws/organizations-organization";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new LambdaPermission(this, "example", {
+      action: "lambda:InvokeFunction",
+      functionName: Token.asString(awsLambdaFunctionExample.arn),
+      principal: "config.amazonaws.com",
+      statementId: "AllowExecutionFromConfig",
+    });
+    const awsOrganizationsOrganizationExample = new OrganizationsOrganization(
+      this,
+      "example_1",
+      {
+        awsServiceAccessPrincipals: ["config-multiaccountsetup.amazonaws.com"],
+        featureSet: "ALL",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsOrganizationsOrganizationExample.overrideLogicalId("example");
+    const awsConfigOrganizationCustomRuleExample =
+      new ConfigOrganizationCustomRule(this, "example_2", {
+        dependsOn: [example, awsOrganizationsOrganizationExample],
+        lambdaFunctionArn: Token.asString(awsLambdaFunctionExample.arn),
+        name: "example",
+        triggerTypes: ["ConfigurationItemChangeNotification"],
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsConfigOrganizationCustomRuleExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `lambdaFunctionArn` - (Required) Amazon Resource Name (ARN) of the rule Lambda Function
+* `name` - (Required) The name of the rule
+* `triggerTypes` - (Required) List of notification types that trigger AWS Config to run an evaluation for the rule. Valid values: `configurationItemChangeNotification`, `oversizedConfigurationItemChangeNotification`, and `scheduledNotification`
+* `description` - (Optional) Description of the rule
+* `excludedAccounts` - (Optional) List of AWS account identifiers to exclude from the rule
+* `inputParameters` - (Optional) A string in JSON format that is passed to the AWS Config Rule Lambda Function
+* `maximumExecutionFrequency` - (Optional) The maximum frequency with which AWS Config runs evaluations for a rule, if the rule is triggered at a periodic frequency. Defaults to `twentyFourHours` for periodic frequency triggered rules. Valid values: `oneHour`, `threeHours`, `sixHours`, `twelveHours`, or `twentyFourHours`.
+* `resourceIdScope` - (Optional) Identifier of the AWS resource to evaluate
+* `resourceTypesScope` - (Optional) List of types of AWS resources to evaluate
+* `tagKeyScope` - (Optional, Required if `tagValueScope` is configured) Tag key of AWS resources to evaluate
+* `tagValueScope` - (Optional) Tag value of AWS resources to evaluate
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the rule
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `5M`)
+* `delete` - (Default `5M`)
+* `update` - (Default `5M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Config Organization Custom Rules using the name. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Config Organization Custom Rules using the name. For example:
+
+```console
+% terraform import aws_config_organization_custom_rule.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-33094f531130f32ecdf884f7220da12125657cf545f1554a9e4e90b73a4d1db1 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/config_organization_managed_rule.html.markdown b/website/docs/cdktf/typescript/r/config_organization_managed_rule.html.markdown
new file mode 100644
index 00000000000..6663aa1c02f
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/config_organization_managed_rule.html.markdown
@@ -0,0 +1,102 @@
+---
+subcategory: "Config"
+layout: "aws"
+page_title: "AWS: aws_config_organization_managed_rule"
+description: |-
+  Manages a Config Organization Managed Rule
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_config_organization_managed_rule
+
+Manages a Config Organization Managed Rule. More information about these rules can be found in the [Enabling AWS Config Rules Across all Accounts in Your Organization](https://docs.aws.amazon.com/config/latest/developerguide/config-rule-multi-account-deployment.html) and [AWS Config Managed Rules](https://docs.aws.amazon.com/config/latest/developerguide/evaluate-config_use-managed-rules.html) documentation. For working with Organization Custom Rules (those invoking a custom Lambda Function), see the [`awsConfigOrganizationCustomRule` resource](/docs/providers/aws/r/config_organization_custom_rule.html).
+
+~> **NOTE:** This resource must be created in the Organization master account and rules will include the master account unless its ID is added to the `excludedAccounts` argument.
+
+~> **NOTE:** Every Organization account except those configured in the `excludedAccounts` argument must have a Configuration Recorder with proper IAM permissions before the rule will successfully create or update. See also the [`awsConfigConfigurationRecorder` resource](/docs/providers/aws/r/config_configuration_recorder.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ConfigOrganizationManagedRule } from "./.gen/providers/aws/config-organization-managed-rule";
+import { OrganizationsOrganization } from "./.gen/providers/aws/organizations-organization";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new OrganizationsOrganization(this, "example", {
+      awsServiceAccessPrincipals: ["config-multiaccountsetup.amazonaws.com"],
+      featureSet: "ALL",
+    });
+    const awsConfigOrganizationManagedRuleExample =
+      new ConfigOrganizationManagedRule(this, "example_1", {
+        dependsOn: [example],
+        name: "example",
+        ruleIdentifier: "IAM_PASSWORD_POLICY",
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsConfigOrganizationManagedRuleExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the rule
+* `ruleIdentifier` - (Required) Identifier of an available AWS Config Managed Rule to call. For available values, see the [List of AWS Config Managed Rules](https://docs.aws.amazon.com/config/latest/developerguide/managed-rules-by-aws-config.html) documentation
+* `description` - (Optional) Description of the rule
+* `excludedAccounts` - (Optional) List of AWS account identifiers to exclude from the rule
+* `inputParameters` - (Optional) A string in JSON format that is passed to the AWS Config Rule Lambda Function
+* `maximumExecutionFrequency` - (Optional) The maximum frequency with which AWS Config runs evaluations for a rule, if the rule is triggered at a periodic frequency. Defaults to `twentyFourHours` for periodic frequency triggered rules. Valid values: `oneHour`, `threeHours`, `sixHours`, `twelveHours`, or `twentyFourHours`.
+* `resourceIdScope` - (Optional) Identifier of the AWS resource to evaluate
+* `resourceTypesScope` - (Optional) List of types of AWS resources to evaluate
+* `tagKeyScope` - (Optional, Required if `tagValueScope` is configured) Tag key of AWS resources to evaluate
+* `tagValueScope` - (Optional) Tag value of AWS resources to evaluate
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the rule
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `5M`)
+* `delete` - (Default `5M`)
+* `update` - (Default `5M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Config Organization Managed Rules using the name. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Config Organization Managed Rules using the name. For example:
+
+```console
+% terraform import aws_config_organization_managed_rule.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-29a5f024d0a4952e4ef689b372b4e88a2023404e9e31631bc6e865b75a8f3733 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/config_remediation_configuration.html.markdown b/website/docs/cdktf/typescript/r/config_remediation_configuration.html.markdown
new file mode 100644
index 00000000000..be567bb8e83
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/config_remediation_configuration.html.markdown
@@ -0,0 +1,145 @@
+---
+subcategory: "Config"
+layout: "aws"
+page_title: "AWS: aws_config_remediation_configuration"
+description: |-
+  Provides an AWS Config Remediation Configuration.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_config_remediation_configuration
+
+Provides an AWS Config Remediation Configuration.
+
+~> **Note:** Config Remediation Configuration requires an existing [Config Rule](/docs/providers/aws/r/config_config_rule.html) to be present.
+
+## Example Usage
+
+AWS managed rules can be used by setting the source owner to `aws` and the source identifier to the name of the managed rule. More information about AWS managed rules can be found in the [AWS Config Developer Guide](https://docs.aws.amazon.com/config/latest/developerguide/evaluate-config_use-managed-rules.html).
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ConfigConfigRule } from "./.gen/providers/aws/config-config-rule";
+import { ConfigRemediationConfiguration } from "./.gen/providers/aws/config-remediation-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const thisVar = new ConfigConfigRule(this, "this", {
+      name: "example",
+      source: {
+        owner: "AWS",
+        sourceIdentifier: "S3_BUCKET_VERSIONING_ENABLED",
+      },
+    });
+    const awsConfigRemediationConfigurationThis =
+      new ConfigRemediationConfiguration(this, "this_1", {
+        automatic: true,
+        configRuleName: thisVar.name,
+        executionControls: {
+          ssmControls: {
+            concurrentExecutionRatePercentage: 25,
+            errorPercentage: 20,
+          },
+        },
+        maximumAutomaticAttempts: 10,
+        parameter: [
+          {
+            name: "AutomationAssumeRole",
+            staticValue: "arn:aws:iam::875924563244:role/security_config",
+          },
+          {
+            name: "BucketName",
+            resourceValue: "RESOURCE_ID",
+          },
+          {
+            name: "SSEAlgorithm",
+            staticValue: "AES256",
+          },
+        ],
+        resourceType: "AWS::S3::Bucket",
+        retryAttemptSeconds: 600,
+        targetId: "AWS-EnableS3BucketEncryption",
+        targetType: "SSM_DOCUMENT",
+        targetVersion: "1",
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsConfigRemediationConfigurationThis.overrideLogicalId("this");
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `configRuleName` - (Required) Name of the AWS Config rule.
+* `targetId` - (Required) Target ID is the name of the public document.
+* `targetType` - (Required) Type of the target. Target executes remediation. For example, SSM document.
+
+The following arguments are optional:
+
+* `automatic` - (Optional) Remediation is triggered automatically if `true`.
+* `executionControls` - (Optional) Configuration block for execution controls. See below.
+* `maximumAutomaticAttempts` - (Optional) Maximum number of failed attempts for auto-remediation. If you do not select a number, the default is 5.
+* `parameter` - (Optional) Can be specified multiple times for each parameter. Each parameter block supports arguments below.
+* `resourceType` - (Optional) Type of resource.
+* `retryAttemptSeconds` - (Optional) Maximum time in seconds that AWS Config runs auto-remediation. If you do not select a number, the default is 60 seconds.
+* `targetVersion` - (Optional) Version of the target. For example, version of the SSM document
+
+### `executionControls`
+
+* `ssmControls` - (Required) Configuration block for SSM controls. See below.
+
+#### `ssmControls`
+
+One or both of these values are required.
+
+* `concurrentExecutionRatePercentage` - (Optional) Maximum percentage of remediation actions allowed to run in parallel on the non-compliant resources for that specific rule. The default value is 10%.
+* `errorPercentage` - (Optional) Percentage of errors that are allowed before SSM stops running automations on non-compliant resources for that specific rule. The default is 50%.
+
+### `parameter`
+
+The value is either a dynamic (resource) value or a static value. You must select either a dynamic value or a static value.
+
+* `name` - (Required) Name of the attribute.
+* `resourceValue` - (Optional) Value is dynamic and changes at run-time.
+* `staticValue` - (Optional) Value is static and does not change at run-time.
+* `staticValues` - (Optional) List of static values.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Config Remediation Configuration.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Remediation Configurations using the name config_rule_name. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Remediation Configurations using the name config_rule_name. For example:
+
+```console
+% terraform import aws_config_remediation_configuration.this example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-e4422e32c7a9b0e1b751fde0505405c8311a46abe23651a75ba503285c3a58bd -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/connect_bot_association.html.markdown b/website/docs/cdktf/typescript/r/connect_bot_association.html.markdown
new file mode 100644
index 00000000000..b31a657af16
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/connect_bot_association.html.markdown
@@ -0,0 +1,162 @@
+---
+subcategory: "Connect"
+layout: "aws"
+page_title: "AWS: aws_connect_bot_association"
+description: |-
+  Associates an Amazon Connect instance to an Amazon Lex (V1) bot
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_connect_bot_association
+
+Allows the specified Amazon Connect instance to access the specified Amazon Lex (V1) bot. For more information see
+[Amazon Connect: Getting Started](https://docs.aws.amazon.com/connect/latest/adminguide/amazon-connect-get-started.html) and [Add an Amazon Lex bot](https://docs.aws.amazon.com/connect/latest/adminguide/amazon-lex.html).
+
+~> **NOTE:** This resource only currently supports Amazon Lex (V1) Associations.
+
+## Example Usage
+
+### Basic
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ConnectBotAssociation } from "./.gen/providers/aws/connect-bot-association";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ConnectBotAssociation(this, "example", {
+      instanceId: Token.asString(awsConnectInstanceExample.id),
+      lexBot: {
+        lexRegion: "us-west-2",
+        name: "Test",
+      },
+    });
+  }
+}
+
+```
+
+### Including a sample Lex bot
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ConnectBotAssociation } from "./.gen/providers/aws/connect-bot-association";
+import { DataAwsRegion } from "./.gen/providers/aws/data-aws-region";
+import { LexBot } from "./.gen/providers/aws/lex-bot";
+import { LexIntent } from "./.gen/providers/aws/lex-intent";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new LexIntent(this, "example", {
+      createVersion: true,
+      fulfillmentActivity: {
+        type: "ReturnIntent",
+      },
+      name: "connect_lex_intent",
+      sampleUtterances: ["I would like to pick up flowers."],
+    });
+    const current = new DataAwsRegion(this, "current", {});
+    const awsLexBotExample = new LexBot(this, "example_2", {
+      abortStatement: {
+        message: [
+          {
+            content: "Sorry, I am not able to assist at this time.",
+            contentType: "PlainText",
+          },
+        ],
+      },
+      childDirected: false,
+      clarificationPrompt: {
+        maxAttempts: 2,
+        message: [
+          {
+            content: "I didn't understand you, what would you like to do?",
+            contentType: "PlainText",
+          },
+        ],
+      },
+      intent: [
+        {
+          intentName: example.name,
+          intentVersion: "1",
+        },
+      ],
+      name: "connect_lex_bot",
+      processBehavior: "BUILD",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsLexBotExample.overrideLogicalId("example");
+    const awsConnectBotAssociationExample = new ConnectBotAssociation(
+      this,
+      "example_3",
+      {
+        instanceId: Token.asString(awsConnectInstanceExample.id),
+        lexBot: {
+          lexRegion: Token.asString(current.name),
+          name: Token.asString(awsLexBotExample.name),
+        },
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsConnectBotAssociationExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `instanceId` - (Required) The identifier of the Amazon Connect instance. You can find the instanceId in the ARN of the instance.
+* `lexBot` - (Required) Configuration information of an Amazon Lex (V1) bot. Detailed below.
+
+### lex_bot
+
+The `lexBot` configuration block supports the following:
+
+* `name` - (Required) The name of the Amazon Lex (V1) bot.
+* `lexRegion` - (Optional) The Region that the Amazon Lex (V1) bot was created in. Defaults to current region.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Amazon Connect instance ID, Lex (V1) bot name, and Lex (V1) bot region separated by colons (`:`).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsConnectBotAssociation` using the Amazon Connect instance ID, Lex (V1) bot name, and Lex (V1) bot region separated by colons (`:`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsConnectBotAssociation` using the Amazon Connect instance ID, Lex (V1) bot name, and Lex (V1) bot region separated by colons (`:`). For example:
+
+```console
+% terraform import aws_connect_bot_association.example aaaaaaaa-bbbb-cccc-dddd-111111111111:Example:us-west-2
+```
+
+<!-- cache-key: cdktf-0.18.0 input-a2f9c06dc453656a33c733da12968f311c1fb8ca4fa4a21171e1bb6249dad8c8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/connect_bot_association.markdown b/website/docs/cdktf/typescript/r/connect_bot_association.markdown
new file mode 100644
index 00000000000..b31a657af16
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/connect_bot_association.markdown
@@ -0,0 +1,162 @@
+---
+subcategory: "Connect"
+layout: "aws"
+page_title: "AWS: aws_connect_bot_association"
+description: |-
+  Associates an Amazon Connect instance to an Amazon Lex (V1) bot
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_connect_bot_association
+
+Allows the specified Amazon Connect instance to access the specified Amazon Lex (V1) bot. For more information see
+[Amazon Connect: Getting Started](https://docs.aws.amazon.com/connect/latest/adminguide/amazon-connect-get-started.html) and [Add an Amazon Lex bot](https://docs.aws.amazon.com/connect/latest/adminguide/amazon-lex.html).
+
+~> **NOTE:** This resource only currently supports Amazon Lex (V1) Associations.
+
+## Example Usage
+
+### Basic
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ConnectBotAssociation } from "./.gen/providers/aws/connect-bot-association";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ConnectBotAssociation(this, "example", {
+      instanceId: Token.asString(awsConnectInstanceExample.id),
+      lexBot: {
+        lexRegion: "us-west-2",
+        name: "Test",
+      },
+    });
+  }
+}
+
+```
+
+### Including a sample Lex bot
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ConnectBotAssociation } from "./.gen/providers/aws/connect-bot-association";
+import { DataAwsRegion } from "./.gen/providers/aws/data-aws-region";
+import { LexBot } from "./.gen/providers/aws/lex-bot";
+import { LexIntent } from "./.gen/providers/aws/lex-intent";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new LexIntent(this, "example", {
+      createVersion: true,
+      fulfillmentActivity: {
+        type: "ReturnIntent",
+      },
+      name: "connect_lex_intent",
+      sampleUtterances: ["I would like to pick up flowers."],
+    });
+    const current = new DataAwsRegion(this, "current", {});
+    const awsLexBotExample = new LexBot(this, "example_2", {
+      abortStatement: {
+        message: [
+          {
+            content: "Sorry, I am not able to assist at this time.",
+            contentType: "PlainText",
+          },
+        ],
+      },
+      childDirected: false,
+      clarificationPrompt: {
+        maxAttempts: 2,
+        message: [
+          {
+            content: "I didn't understand you, what would you like to do?",
+            contentType: "PlainText",
+          },
+        ],
+      },
+      intent: [
+        {
+          intentName: example.name,
+          intentVersion: "1",
+        },
+      ],
+      name: "connect_lex_bot",
+      processBehavior: "BUILD",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsLexBotExample.overrideLogicalId("example");
+    const awsConnectBotAssociationExample = new ConnectBotAssociation(
+      this,
+      "example_3",
+      {
+        instanceId: Token.asString(awsConnectInstanceExample.id),
+        lexBot: {
+          lexRegion: Token.asString(current.name),
+          name: Token.asString(awsLexBotExample.name),
+        },
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsConnectBotAssociationExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `instanceId` - (Required) The identifier of the Amazon Connect instance. You can find the instanceId in the ARN of the instance.
+* `lexBot` - (Required) Configuration information of an Amazon Lex (V1) bot. Detailed below.
+
+### lex_bot
+
+The `lexBot` configuration block supports the following:
+
+* `name` - (Required) The name of the Amazon Lex (V1) bot.
+* `lexRegion` - (Optional) The Region that the Amazon Lex (V1) bot was created in. Defaults to current region.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Amazon Connect instance ID, Lex (V1) bot name, and Lex (V1) bot region separated by colons (`:`).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsConnectBotAssociation` using the Amazon Connect instance ID, Lex (V1) bot name, and Lex (V1) bot region separated by colons (`:`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsConnectBotAssociation` using the Amazon Connect instance ID, Lex (V1) bot name, and Lex (V1) bot region separated by colons (`:`). For example:
+
+```console
+% terraform import aws_connect_bot_association.example aaaaaaaa-bbbb-cccc-dddd-111111111111:Example:us-west-2
+```
+
+<!-- cache-key: cdktf-0.18.0 input-a2f9c06dc453656a33c733da12968f311c1fb8ca4fa4a21171e1bb6249dad8c8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/connect_contact_flow.html.markdown b/website/docs/cdktf/typescript/r/connect_contact_flow.html.markdown
new file mode 100644
index 00000000000..3a549699ca8
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/connect_contact_flow.html.markdown
@@ -0,0 +1,164 @@
+---
+subcategory: "Connect"
+layout: "aws"
+page_title: "AWS: aws_connect_contact_flow"
+description: |-
+  Provides details about a specific Amazon Connect Contact Flow.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_connect_contact_flow
+
+Provides an Amazon Connect Contact Flow resource. For more information see
+[Amazon Connect: Getting Started](https://docs.aws.amazon.com/connect/latest/adminguide/amazon-connect-get-started.html)
+
+This resource embeds or references Contact Flows specified in Amazon Connect Contact Flow Language. For more information see
+[Amazon Connect Flow language](https://docs.aws.amazon.com/connect/latest/adminguide/flow-language.html)
+
+!> **WARN:** Contact Flows exported from the Console [Contact Flow import/export](https://docs.aws.amazon.com/connect/latest/adminguide/contact-flow-import-export.html) are not in the Amazon Connect Contact Flow Language and can not be used with this resource. Instead, the recommendation is to use the AWS CLI [`describeContactFlow`](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/connect/describe-contact-flow.html).
+See [example](#with-external-content) below which uses `jq` to extract the `content` attribute and saves it to a local file.
+
+## Example Usage
+
+### Basic
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ConnectContactFlow } from "./.gen/providers/aws/connect-contact-flow";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ConnectContactFlow(this, "test", {
+      content: Token.asString(
+        Fn.jsonencode({
+          Actions: [
+            {
+              Identifier: "12345678-1234-1234-1234-123456789012",
+              Parameters: {
+                Text: "Thanks for calling the sample flow!",
+              },
+              Transitions: {
+                Conditions: [],
+                Errors: [],
+                NextAction: "abcdef-abcd-abcd-abcd-abcdefghijkl",
+              },
+              Type: "MessageParticipant",
+            },
+            {
+              Identifier: "abcdef-abcd-abcd-abcd-abcdefghijkl",
+              Parameters: {},
+              Transitions: {},
+              Type: "DisconnectParticipant",
+            },
+          ],
+          StartAction: "12345678-1234-1234-1234-123456789012",
+          Version: "2019-10-30",
+        })
+      ),
+      description: "Test Contact Flow Description",
+      instanceId: "aaaaaaaa-bbbb-cccc-dddd-111111111111",
+      name: "Test",
+      tags: {
+        Application: "Terraform",
+        Method: "Create",
+        Name: "Test Contact Flow",
+      },
+      type: "CONTACT_FLOW",
+    });
+  }
+}
+
+```
+
+### With External Content
+
+Use the AWS CLI to extract Contact Flow Content:
+
+```console
+% aws connect describe-contact-flow --instance-id 1b3c5d8-1b3c-1b3c-1b3c-1b3c5d81b3c5 --contact-flow-id c1d4e5f6-1b3c-1b3c-1b3c-c1d4e5f6c1d4e5 --region us-west-2 | jq '.ContactFlow.Content | fromjson' > contact_flow.json
+```
+
+Use the generated file as input:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ConnectContactFlow } from "./.gen/providers/aws/connect-contact-flow";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ConnectContactFlow(this, "test", {
+      contentHash: Token.asString(Fn.filebase64sha256("contact_flow.json")),
+      description: "Test Contact Flow Description",
+      filename: "contact_flow.json",
+      instanceId: "aaaaaaaa-bbbb-cccc-dddd-111111111111",
+      name: "Test",
+      tags: {
+        Application: "Terraform",
+        Method: "Create",
+        Name: "Test Contact Flow",
+      },
+      type: "CONTACT_FLOW",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `content` - (Optional) Specifies the content of the Contact Flow, provided as a JSON string, written in Amazon Connect Contact Flow Language. If defined, the `filename` argument cannot be used.
+* `contentHash` - (Optional) Used to trigger updates. Must be set to a base64-encoded SHA256 hash of the Contact Flow source specified with `filename`. The usual way to set this is filebase64sha256("mycontact_flow.json") (Terraform 0.11.12 and later) or base64sha256(file("mycontact_flow.json")) (Terraform 0.11.11 and earlier), where "mycontact_flow.json" is the local filename of the Contact Flow source.
+* `description` - (Optional) Specifies the description of the Contact Flow.
+* `filename` - (Optional) The path to the Contact Flow source within the local filesystem. Conflicts with `content`.
+* `instanceId` - (Required) Specifies the identifier of the hosting Amazon Connect Instance.
+* `name` - (Required) Specifies the name of the Contact Flow.
+* `tags` - (Optional) Tags to apply to the Contact Flow. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `type` - (Optional, Forces new resource) Specifies the type of the Contact Flow. Defaults to `contactFlow`. Allowed Values are: `contactFlow`, `customerQueue`, `customerHold`, `customerWhisper`, `agentHold`, `agentWhisper`, `outboundWhisper`, `agentTransfer`, `queueTransfer`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the Contact Flow.
+* `id` - The identifier of the hosting Amazon Connect Instance and identifier of the Contact Flow separated by a colon (`:`).
+* `contactFlowId` - The identifier of the Contact Flow.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Amazon Connect Contact Flows using the `instanceId` and `contactFlowId` separated by a colon (`:`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Amazon Connect Contact Flows using the `instanceId` and `contactFlowId` separated by a colon (`:`). For example:
+
+```console
+% terraform import aws_connect_contact_flow.example f1288a1f-6193-445a-b47e-af739b2:c1d4e5f6-1b3c-1b3c-1b3c-c1d4e5f6c1d4e5
+```
+
+<!-- cache-key: cdktf-0.18.0 input-d0d71a52cab7abb64ba26756e847f3a0e817e9bd943be18f335c31c6bacc92bc -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/connect_contact_flow_module.html.markdown b/website/docs/cdktf/typescript/r/connect_contact_flow_module.html.markdown
new file mode 100644
index 00000000000..cb2f20b2317
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/connect_contact_flow_module.html.markdown
@@ -0,0 +1,179 @@
+---
+subcategory: "Connect"
+layout: "aws"
+page_title: "AWS: aws_connect_contact_flow_module"
+description: |-
+  Provides details about a specific Amazon Connect Contact Flow Module.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_connect_contact_flow_module
+
+Provides an Amazon Connect Contact Flow Module resource. For more information see
+[Amazon Connect: Getting Started](https://docs.aws.amazon.com/connect/latest/adminguide/amazon-connect-get-started.html)
+
+This resource embeds or references Contact Flows Modules specified in Amazon Connect Contact Flow Language. For more information see
+[Amazon Connect Flow language](https://docs.aws.amazon.com/connect/latest/adminguide/flow-language.html)
+
+!> **WARN:** Contact Flow Modules exported from the Console [See Contact Flow import/export which is the same for Contact Flow Modules](https://docs.aws.amazon.com/connect/latest/adminguide/contact-flow-import-export.html) are not in the Amazon Connect Contact Flow Language and can not be used with this resource. Instead, the recommendation is to use the AWS CLI [`describeContactFlowModule`](https://docs.aws.amazon.com/cli/latest/reference/connect/describe-contact-flow-module.html).
+See [example](#with-external-content) below which uses `jq` to extract the `content` attribute and saves it to a local file.
+
+## Example Usage
+
+### Basic
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ConnectContactFlowModule } from "./.gen/providers/aws/connect-contact-flow-module";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ConnectContactFlowModule(this, "example", {
+      content: Token.asString(
+        Fn.jsonencode({
+          Actions: [
+            {
+              Identifier: "12345678-1234-1234-1234-123456789012",
+              Parameters: {
+                Text: "Hello contact flow module",
+              },
+              Transitions: {
+                Conditions: [],
+                Errors: [],
+                NextAction: "abcdef-abcd-abcd-abcd-abcdefghijkl",
+              },
+              Type: "MessageParticipant",
+            },
+            {
+              Identifier: "abcdef-abcd-abcd-abcd-abcdefghijkl",
+              Parameters: {},
+              Transitions: {},
+              Type: "DisconnectParticipant",
+            },
+          ],
+          Settings: {
+            InputParameters: [],
+            OutputParameters: [],
+            Transitions: [
+              {
+                Description: "",
+                DisplayName: "Success",
+                ReferenceName: "Success",
+              },
+              {
+                Description: "",
+                DisplayName: "Error",
+                ReferenceName: "Error",
+              },
+            ],
+          },
+          StartAction: "12345678-1234-1234-1234-123456789012",
+          Version: "2019-10-30",
+        })
+      ),
+      description: "Example Contact Flow Module Description",
+      instanceId: "aaaaaaaa-bbbb-cccc-dddd-111111111111",
+      name: "Example",
+      tags: {
+        Application: "Terraform",
+        Method: "Create",
+        Name: "Example Contact Flow Module",
+      },
+    });
+  }
+}
+
+```
+
+### With External Content
+
+Use the AWS CLI to extract Contact Flow Content:
+
+```console
+% aws connect describe-contact-flow-module --instance-id 1b3c5d8-1b3c-1b3c-1b3c-1b3c5d81b3c5 --contact-flow-module-id c1d4e5f6-1b3c-1b3c-1b3c-c1d4e5f6c1d4e5 --region us-west-2 | jq '.ContactFlowModule.Content | fromjson' > contact_flow_module.json
+```
+
+Use the generated file as input:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ConnectContactFlowModule } from "./.gen/providers/aws/connect-contact-flow-module";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ConnectContactFlowModule(this, "example", {
+      contentHash: Token.asString(
+        Fn.filebase64sha256("contact_flow_module.json")
+      ),
+      description: "Example Contact Flow Module Description",
+      filename: "contact_flow_module.json",
+      instanceId: "aaaaaaaa-bbbb-cccc-dddd-111111111111",
+      name: "Example",
+      tags: {
+        Application: "Terraform",
+        Method: "Create",
+        Name: "Example Contact Flow Module",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `content` - (Optional) Specifies the content of the Contact Flow Module, provided as a JSON string, written in Amazon Connect Contact Flow Language. If defined, the `filename` argument cannot be used.
+* `contentHash` - (Optional) Used to trigger updates. Must be set to a base64-encoded SHA256 hash of the Contact Flow Module source specified with `filename`. The usual way to set this is filebase64sha256("contact_flow_module.json") (Terraform 0.11.12 and later) or base64sha256(file("contact_flow_module.json")) (Terraform 0.11.11 and earlier), where "contact_flow_module.json" is the local filename of the Contact Flow Module source.
+* `description` - (Optional) Specifies the description of the Contact Flow Module.
+* `filename` - (Optional) The path to the Contact Flow Module source within the local filesystem. Conflicts with `content`.
+* `instanceId` - (Required) Specifies the identifier of the hosting Amazon Connect Instance.
+* `name` - (Required) Specifies the name of the Contact Flow Module.
+* `tags` - (Optional) Tags to apply to the Contact Flow Module. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the Contact Flow Module.
+* `id` - The identifier of the hosting Amazon Connect Instance and identifier of the Contact Flow Module separated by a colon (`:`).
+* `contactFlowModuleId` - The identifier of the Contact Flow Module.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Amazon Connect Contact Flow Modules using the `instanceId` and `contactFlowModuleId` separated by a colon (`:`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Amazon Connect Contact Flow Modules using the `instanceId` and `contactFlowModuleId` separated by a colon (`:`). For example:
+
+```console
+% terraform import aws_connect_contact_flow_module.example f1288a1f-6193-445a-b47e-af739b2:c1d4e5f6-1b3c-1b3c-1b3c-c1d4e5f6c1d4e5
+```
+
+<!-- cache-key: cdktf-0.18.0 input-fad5a83f3f5a5cf193df0637530e1bc1f6d891f07b57ab8518ef971ee9d23841 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/connect_hours_of_operation.html.markdown b/website/docs/cdktf/typescript/r/connect_hours_of_operation.html.markdown
new file mode 100644
index 00000000000..307cd72df1d
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/connect_hours_of_operation.html.markdown
@@ -0,0 +1,126 @@
+---
+subcategory: "Connect"
+layout: "aws"
+page_title: "AWS: aws_connect_hours_of_operation"
+description: |-
+  Provides details about a specific Amazon Connect Hours of Operation.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_connect_hours_of_operation
+
+Provides an Amazon Connect Hours of Operation resource. For more information see
+[Amazon Connect: Getting Started](https://docs.aws.amazon.com/connect/latest/adminguide/amazon-connect-get-started.html)
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ConnectHoursOfOperation } from "./.gen/providers/aws/connect-hours-of-operation";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ConnectHoursOfOperation(this, "test", {
+      config: [
+        {
+          day: "MONDAY",
+          endTime: {
+            hours: 23,
+            minutes: 8,
+          },
+          startTime: {
+            hours: 8,
+            minutes: 0,
+          },
+        },
+        {
+          day: "TUESDAY",
+          endTime: {
+            hours: 21,
+            minutes: 0,
+          },
+          startTime: {
+            hours: 9,
+            minutes: 0,
+          },
+        },
+      ],
+      description: "Monday office hours",
+      instanceId: "aaaaaaaa-bbbb-cccc-dddd-111111111111",
+      name: "Office Hours",
+      tags: {
+        Name: "Example Hours of Operation",
+      },
+      timeZone: "EST",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `config` - (Required) One or more config blocks which define the configuration information for the hours of operation: day, start time, and end time . Config blocks are documented below.
+* `description` - (Optional) Specifies the description of the Hours of Operation.
+* `instanceId` - (Required) Specifies the identifier of the hosting Amazon Connect Instance.
+* `name` - (Required) Specifies the name of the Hours of Operation.
+* `tags` - (Optional) Tags to apply to the Hours of Operation. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `timeZone` - (Required) Specifies the time zone of the Hours of Operation.
+
+A `config` block supports the following arguments:
+
+* `day` - (Required) Specifies the day that the hours of operation applies to.
+* `endTime` - (Required) A end time block specifies the time that your contact center closes. The `endTime` is documented below.
+* `startTime` - (Required) A start time block specifies the time that your contact center opens. The `startTime` is documented below.
+
+A `endTime` block supports the following arguments:
+
+* `hours` - (Required) Specifies the hour of closing.
+* `minutes` - (Required) Specifies the minute of closing.
+
+A `startTime` block supports the following arguments:
+
+* `hours` - (Required) Specifies the hour of opening.
+* `minutes` - (Required) Specifies the minute of opening.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the Hours of Operation.
+* `hoursOfOperationId` - The identifier for the hours of operation.
+* `id` - The identifier of the hosting Amazon Connect Instance and identifier of the Hours of Operation separated by a colon (`:`).
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Amazon Connect Hours of Operations using the `instanceId` and `hoursOfOperationId` separated by a colon (`:`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Amazon Connect Hours of Operations using the `instanceId` and `hoursOfOperationId` separated by a colon (`:`). For example:
+
+```console
+% terraform import aws_connect_hours_of_operation.example f1288a1f-6193-445a-b47e-af739b2:c1d4e5f6-1b3c-1b3c-1b3c-c1d4e5f6c1d4e5
+```
+
+<!-- cache-key: cdktf-0.18.0 input-e685961316f9f34f8486d7fd79d05b0468f7a89263abaaf59ddd74e65a685a9c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/connect_instance.html.markdown b/website/docs/cdktf/typescript/r/connect_instance.html.markdown
new file mode 100644
index 00000000000..e684a753766
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/connect_instance.html.markdown
@@ -0,0 +1,149 @@
+---
+subcategory: "Connect"
+layout: "aws"
+page_title: "AWS: aws_connect_instance"
+description: |-
+  Provides details about a specific Connect Instance.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_connect_instance
+
+Provides an Amazon Connect instance resource. For more information see
+[Amazon Connect: Getting Started](https://docs.aws.amazon.com/connect/latest/adminguide/amazon-connect-get-started.html)
+
+!> **WARN:** Amazon Connect enforces a limit of [100 combined instance creation and deletions every 30 days](https://docs.aws.amazon.com/connect/latest/adminguide/amazon-connect-service-limits.html#feature-limits).  For example, if you create 80 instances and delete 20 of them, you must wait 30 days to create or delete another instance.  Use care when creating or deleting instances.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ConnectInstance } from "./.gen/providers/aws/connect-instance";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ConnectInstance(this, "test", {
+      identityManagementType: "CONNECT_MANAGED",
+      inboundCallsEnabled: true,
+      instanceAlias: "friendly-name-connect",
+      outboundCallsEnabled: true,
+    });
+  }
+}
+
+```
+
+## Example Usage with Existing Active Directory
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ConnectInstance } from "./.gen/providers/aws/connect-instance";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ConnectInstance(this, "test", {
+      directoryId: Token.asString(awsDirectoryServiceDirectoryTest.id),
+      identityManagementType: "EXISTING_DIRECTORY",
+      inboundCallsEnabled: true,
+      instanceAlias: "friendly-name-connect",
+      outboundCallsEnabled: true,
+    });
+  }
+}
+
+```
+
+## Example Usage with SAML
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ConnectInstance } from "./.gen/providers/aws/connect-instance";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ConnectInstance(this, "test", {
+      identityManagementType: "SAML",
+      inboundCallsEnabled: true,
+      instanceAlias: "friendly-name-connect",
+      outboundCallsEnabled: true,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `autoResolveBestVoicesEnabled` - (Optional) Specifies whether auto resolve best voices is enabled. Defaults to `true`.
+* `contactFlowLogsEnabled` - (Optional) Specifies whether contact flow logs are enabled. Defaults to `false`.
+* `contactLensEnabled` - (Optional) Specifies whether contact lens is enabled. Defaults to `true`.
+* `directoryId` - (Optional) The identifier for the directory if identity_management_type is `existingDirectory`.
+* `earlyMediaEnabled` - (Optional) Specifies whether early media for outbound calls is enabled . Defaults to `true` if outbound calls is enabled.
+* `identityManagementType` - (Required) Specifies the identity management type attached to the instance. Allowed Values are: `saml`, `connectManaged`, `existingDirectory`.
+* `inboundCallsEnabled` - (Required) Specifies whether inbound calls are enabled.
+* `instanceAlias` - (Optional) Specifies the name of the instance. Required if `directoryId` not specified.
+* `multiPartyConferenceEnabled` - (Optional) Specifies whether multi-party calls/conference is enabled. Defaults to `false`.
+* `outboundCallsEnabled` - (Required) Specifies whether outbound calls are enabled.
+<!-- * `use_custom_tts_voices` - (Optional) Whether use custom tts voices is enabled. Defaults to `false` -->
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The identifier of the instance.
+* `arn` - Amazon Resource Name (ARN) of the instance.
+* `createdTime` - When the instance was created.
+* `serviceRole` - The service role of the instance.
+* `status` - The state of the instance.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `5M`)
+* `delete` - (Default `5M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Connect instances using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Connect instances using the `id`. For example:
+
+```console
+% terraform import aws_connect_instance.example f1288a1f-6193-445a-b47e-af739b2
+```
+
+<!-- cache-key: cdktf-0.18.0 input-e8635103b3da162fead649adf119535c0b0db258c89a17c04da04da2013fbd83 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/connect_instance_storage_config.html.markdown b/website/docs/cdktf/typescript/r/connect_instance_storage_config.html.markdown
new file mode 100644
index 00000000000..e4bcd21a743
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/connect_instance_storage_config.html.markdown
@@ -0,0 +1,258 @@
+---
+subcategory: "Connect"
+layout: "aws"
+page_title: "AWS: aws_connect_instance_storage_config"
+description: |-
+  Provides details about a specific Amazon Connect Instance Storage Config.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_connect_instance_storage_config
+
+Provides an Amazon Connect Instance Storage Config resource. For more information see
+[Amazon Connect: Getting Started](https://docs.aws.amazon.com/connect/latest/adminguide/amazon-connect-get-started.html)
+
+## Example Usage
+
+### Storage Config Kinesis Firehose Config
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ConnectInstanceStorageConfig } from "./.gen/providers/aws/connect-instance-storage-config";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ConnectInstanceStorageConfig(this, "example", {
+      instanceId: Token.asString(awsConnectInstanceExample.id),
+      resourceType: "CONTACT_TRACE_RECORDS",
+      storageConfig: {
+        kinesisFirehoseConfig: {
+          firehoseArn: Token.asString(
+            awsKinesisFirehoseDeliveryStreamExample.arn
+          ),
+        },
+        storageType: "KINESIS_FIREHOSE",
+      },
+    });
+  }
+}
+
+```
+
+### Storage Config Kinesis Stream Config
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ConnectInstanceStorageConfig } from "./.gen/providers/aws/connect-instance-storage-config";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ConnectInstanceStorageConfig(this, "example", {
+      instanceId: Token.asString(awsConnectInstanceExample.id),
+      resourceType: "CONTACT_TRACE_RECORDS",
+      storageConfig: {
+        kinesisStreamConfig: {
+          streamArn: Token.asString(awsKinesisStreamExample.arn),
+        },
+        storageType: "KINESIS_STREAM",
+      },
+    });
+  }
+}
+
+```
+
+### Storage Config Kinesis Video Stream Config
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ConnectInstanceStorageConfig } from "./.gen/providers/aws/connect-instance-storage-config";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ConnectInstanceStorageConfig(this, "example", {
+      instanceId: Token.asString(awsConnectInstanceExample.id),
+      resourceType: "MEDIA_STREAMS",
+      storageConfig: {
+        kinesisVideoStreamConfig: {
+          encryptionConfig: {
+            encryptionType: "KMS",
+            keyId: Token.asString(awsKmsKeyExample.arn),
+          },
+          prefix: "example",
+          retentionPeriodHours: 3,
+        },
+        storageType: "KINESIS_VIDEO_STREAM",
+      },
+    });
+  }
+}
+
+```
+
+### Storage Config S3 Config
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ConnectInstanceStorageConfig } from "./.gen/providers/aws/connect-instance-storage-config";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ConnectInstanceStorageConfig(this, "example", {
+      instanceId: Token.asString(awsConnectInstanceExample.id),
+      resourceType: "CHAT_TRANSCRIPTS",
+      storageConfig: {
+        s3Config: {
+          bucketName: Token.asString(awsS3BucketExample.id),
+          bucketPrefix: "example",
+        },
+        storageType: "S3",
+      },
+    });
+  }
+}
+
+```
+
+### Storage Config S3 Config with Encryption Config
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ConnectInstanceStorageConfig } from "./.gen/providers/aws/connect-instance-storage-config";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ConnectInstanceStorageConfig(this, "example", {
+      instanceId: Token.asString(awsConnectInstanceExample.id),
+      resourceType: "CHAT_TRANSCRIPTS",
+      storageConfig: {
+        s3Config: {
+          bucketName: Token.asString(awsS3BucketExample.id),
+          bucketPrefix: "example",
+          encryptionConfig: {
+            encryptionType: "KMS",
+            keyId: Token.asString(awsKmsKeyExample.arn),
+          },
+        },
+        storageType: "S3",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `instanceId` - (Required) Specifies the identifier of the hosting Amazon Connect Instance.
+* `resourceType` - (Required) A valid resource type. Valid Values: `agentEvents` | `attachments` | `callRecordings` | `chatTranscripts` | `contactEvaluations` | `contactTraceRecords` | `mediaStreams` | `realTimeContactAnalysisSegments` | `scheduledReports` | `screenRecordings`.
+* `storageConfig` - (Required) Specifies the storage configuration options for the Connect Instance. [Documented below](#storage_config).
+
+### `storageConfig`
+
+The `storageConfig` configuration block supports the following arguments:
+
+* `kinesisFirehoseConfig` - (Required if `type` is set to `kinesisFirehose`) A block that specifies the configuration of the Kinesis Firehose delivery stream. [Documented below](#kinesis_firehose_config).
+* `kinesisStreamConfig` - (Required if `type` is set to `kinesisStream`) A block that specifies the configuration of the Kinesis data stream. [Documented below](#kinesis_stream_config).
+* `kinesisVideoStreamConfig` - (Required if `type` is set to `kinesisVideoStream`) A block that specifies the configuration of the Kinesis video stream. [Documented below](#kinesis_video_stream_config).
+* `s3Config` - (Required if `type` is set to `s3`) A block that specifies the configuration of S3 Bucket. [Documented below](#s3_config).
+* `storageType` - (Required) A valid storage type. Valid Values: `s3` | `kinesisVideoStream` | `kinesisStream` | `kinesisFirehose`.
+
+#### `kinesisFirehoseConfig`
+
+The `kinesisFirehoseConfig` configuration block supports the following arguments:
+
+* `firehoseArn` - (Required) The Amazon Resource Name (ARN) of the delivery stream.
+
+#### `kinesisStreamConfig`
+
+The `kinesisStreamConfig` configuration block supports the following arguments:
+
+* `streamArn` - (Required) The Amazon Resource Name (ARN) of the data stream.
+
+#### `kinesisVideoStreamConfig`
+
+The `kinesisVideoStreamConfig` configuration block supports the following arguments:
+
+* `encryptionConfig` - (Required) The encryption configuration. [Documented below](#encryption_config).
+* `prefix` - (Required) The prefix of the video stream. Minimum length of `1`. Maximum length of `128`. When read from the state, the value returned is `<prefix>Connect-<connectInstanceAlias>Contact` since the API appends additional details to the `prefix`.
+* `retentionPeriodHours` - (Required) The number of hours data is retained in the stream. Kinesis Video Streams retains the data in a data store that is associated with the stream. Minimum value of `0`. Maximum value of `87600`. A value of `0`, indicates that the stream does not persist data.
+
+#### `s3Config`
+
+The `s3Config` configuration block supports the following arguments:
+
+* `bucketName` - (Required) The S3 bucket name.
+* `bucketPrefix` - (Required) The S3 bucket prefix.
+* `encryptionConfig` - (Optional) The encryption configuration. [Documented below](#encryption_config).
+
+#### `encryptionConfig`
+
+The `encryptionConfig` configuration block supports the following arguments:
+
+* `encryptionType` - (Required) The type of encryption. Valid Values: `kms`.
+* `keyId` - (Required) The full ARN of the encryption key. Be sure to provide the full ARN of the encryption key, not just the ID.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `associationId` - The existing association identifier that uniquely identifies the resource type and storage config for the given instance ID.
+* `id` - The identifier of the hosting Amazon Connect Instance, `associationId`, and `resourceType` separated by a colon (`:`).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Amazon Connect Instance Storage Configs using the `instanceId`, `associationId`, and `resourceType` separated by a colon (`:`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Amazon Connect Instance Storage Configs using the `instanceId`, `associationId`, and `resourceType` separated by a colon (`:`). For example:
+
+```console
+% terraform import aws_connect_instance_storage_config.example f1288a1f-6193-445a-b47e-af739b2:c1d4e5f6-1b3c-1b3c-1b3c-c1d4e5f6c1d4e5:CHAT_TRANSCRIPTS
+```
+
+<!-- cache-key: cdktf-0.18.0 input-f61d343b420a3f570c17898dc773fd2fccd8d832985461fc87179d145f2b2518 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/connect_lambda_function_association.html.markdown b/website/docs/cdktf/typescript/r/connect_lambda_function_association.html.markdown
new file mode 100644
index 00000000000..f6b2eacd727
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/connect_lambda_function_association.html.markdown
@@ -0,0 +1,74 @@
+---
+subcategory: "Connect"
+layout: "aws"
+page_title: "AWS: aws_connect_lambda_function_association"
+description: |-
+  Provides details about a specific Connect Lambda Function Association.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_connect_lambda_function_association
+
+Provides an Amazon Connect Lambda Function Association. For more information see
+[Amazon Connect: Getting Started](https://docs.aws.amazon.com/connect/latest/adminguide/amazon-connect-get-started.html) and [Invoke AWS Lambda functions](https://docs.aws.amazon.com/connect/latest/adminguide/connect-lambda-functions.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ConnectLambdaFunctionAssociation } from "./.gen/providers/aws/connect-lambda-function-association";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ConnectLambdaFunctionAssociation(this, "example", {
+      functionArn: Token.asString(awsLambdaFunctionExample.arn),
+      instanceId: Token.asString(awsConnectInstanceExample.id),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `functionArn` - (Required) Amazon Resource Name (ARN) of the Lambda Function, omitting any version or alias qualifier.
+* `instanceId` - (Required) The identifier of the Amazon Connect instance. You can find the instanceId in the ARN of the instance.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Amazon Connect instance ID and Lambda Function ARN separated by a comma (`,`).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsConnectLambdaFunctionAssociation` using the `instanceId` and `functionArn` separated by a comma (`,`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsConnectLambdaFunctionAssociation` using the `instanceId` and `functionArn` separated by a comma (`,`). For example:
+
+```console
+% terraform import aws_connect_lambda_function_association.example aaaaaaaa-bbbb-cccc-dddd-111111111111,arn:aws:lambda:us-west-2:123456789123:function:example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-0dc6354187f80cf8f051974afaaff4271402269b69f61f468fc0147b5f4d0bfa -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/connect_lambda_function_association.markdown b/website/docs/cdktf/typescript/r/connect_lambda_function_association.markdown
new file mode 100644
index 00000000000..f6b2eacd727
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/connect_lambda_function_association.markdown
@@ -0,0 +1,74 @@
+---
+subcategory: "Connect"
+layout: "aws"
+page_title: "AWS: aws_connect_lambda_function_association"
+description: |-
+  Provides details about a specific Connect Lambda Function Association.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_connect_lambda_function_association
+
+Provides an Amazon Connect Lambda Function Association. For more information see
+[Amazon Connect: Getting Started](https://docs.aws.amazon.com/connect/latest/adminguide/amazon-connect-get-started.html) and [Invoke AWS Lambda functions](https://docs.aws.amazon.com/connect/latest/adminguide/connect-lambda-functions.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ConnectLambdaFunctionAssociation } from "./.gen/providers/aws/connect-lambda-function-association";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ConnectLambdaFunctionAssociation(this, "example", {
+      functionArn: Token.asString(awsLambdaFunctionExample.arn),
+      instanceId: Token.asString(awsConnectInstanceExample.id),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `functionArn` - (Required) Amazon Resource Name (ARN) of the Lambda Function, omitting any version or alias qualifier.
+* `instanceId` - (Required) The identifier of the Amazon Connect instance. You can find the instanceId in the ARN of the instance.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Amazon Connect instance ID and Lambda Function ARN separated by a comma (`,`).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsConnectLambdaFunctionAssociation` using the `instanceId` and `functionArn` separated by a comma (`,`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsConnectLambdaFunctionAssociation` using the `instanceId` and `functionArn` separated by a comma (`,`). For example:
+
+```console
+% terraform import aws_connect_lambda_function_association.example aaaaaaaa-bbbb-cccc-dddd-111111111111,arn:aws:lambda:us-west-2:123456789123:function:example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-0dc6354187f80cf8f051974afaaff4271402269b69f61f468fc0147b5f4d0bfa -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/connect_phone_number.html.markdown b/website/docs/cdktf/typescript/r/connect_phone_number.html.markdown
new file mode 100644
index 00000000000..a1731b9d39c
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/connect_phone_number.html.markdown
@@ -0,0 +1,153 @@
+---
+subcategory: "Connect"
+layout: "aws"
+page_title: "AWS: aws_connect_phone_number"
+description: |-
+  Provides details about a specific Amazon Connect Phone Number.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_connect_phone_number
+
+Provides an Amazon Connect Phone Number resource. For more information see
+[Amazon Connect: Getting Started](https://docs.aws.amazon.com/connect/latest/adminguide/amazon-connect-get-started.html)
+
+## Example Usage
+
+### Basic
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ConnectPhoneNumber } from "./.gen/providers/aws/connect-phone-number";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ConnectPhoneNumber(this, "example", {
+      countryCode: "US",
+      tags: {
+        hello: "world",
+      },
+      targetArn: Token.asString(awsConnectInstanceExample.arn),
+      type: "DID",
+    });
+  }
+}
+
+```
+
+### Description
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ConnectPhoneNumber } from "./.gen/providers/aws/connect-phone-number";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ConnectPhoneNumber(this, "example", {
+      countryCode: "US",
+      description: "example description",
+      targetArn: Token.asString(awsConnectInstanceExample.arn),
+      type: "DID",
+    });
+  }
+}
+
+```
+
+### Prefix to filter phone numbers
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ConnectPhoneNumber } from "./.gen/providers/aws/connect-phone-number";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ConnectPhoneNumber(this, "example", {
+      countryCode: "US",
+      prefix: "+18005",
+      targetArn: Token.asString(awsConnectInstanceExample.arn),
+      type: "DID",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `countryCode` - (Required, Forces new resource) The ISO country code. For a list of Valid values, refer to [PhoneNumberCountryCode](https://docs.aws.amazon.com/connect/latest/APIReference/API_SearchAvailablePhoneNumbers.html#connect-SearchAvailablePhoneNumbers-request-PhoneNumberCountryCode).
+* `description` - (Optional, Forces new resource) The description of the phone number.
+* `prefix` - (Optional, Forces new resource) The prefix of the phone number that is used to filter available phone numbers. If provided, it must contain `+` as part of the country code. Do not specify this argument when importing the resource.
+* `tags` - (Optional) Tags to apply to the Phone Number. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `targetArn` - (Required) The Amazon Resource Name (ARN) for Amazon Connect instances that phone numbers are claimed to.
+* `type` - (Required, Forces new resource) The type of phone number. Valid Values: `tollFree` | `did`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the phone number.
+* `phoneNumber` - The phone number. Phone numbers are formatted `[+] [country code] [subscriber number including area code]`.
+* `id` - The identifier of the phone number.
+* `status` - A block that specifies status of the phone number. [Documented below](#status).
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+### `status`
+
+The `status` configuration block supports the following attributes:
+
+* `message` - The status message.
+* `status` - The status of the phone number. Valid Values: `claimed` | `inProgress` | `failed`.
+
+## Timeouts
+
+[Configuration options](https://www.terraform.io/docs/configuration/blocks/resources/syntax.html#operation-timeouts):
+
+* `create` - (Default `2M`)
+* `update` - (Default `2M`)
+* `delete` - (Default `2M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Amazon Connect Phone Numbers using its `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Amazon Connect Phone Numbers using its `id`. For example:
+
+```console
+% terraform import aws_connect_phone_number.example 12345678-abcd-1234-efgh-9876543210ab
+```
+
+<!-- cache-key: cdktf-0.18.0 input-3709bbd75b47ca64869527df48be54e1acf135a3093efdda6d797cfbc24ebba1 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/connect_queue.html.markdown b/website/docs/cdktf/typescript/r/connect_queue.html.markdown
new file mode 100644
index 00000000000..cc43f596444
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/connect_queue.html.markdown
@@ -0,0 +1,159 @@
+---
+subcategory: "Connect"
+layout: "aws"
+page_title: "AWS: aws_connect_queue"
+description: |-
+  Provides details about a specific Amazon Connect Queue
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_connect_queue
+
+Provides an Amazon Connect Queue resource. For more information see
+[Amazon Connect: Getting Started](https://docs.aws.amazon.com/connect/latest/adminguide/amazon-connect-get-started.html)
+
+## Example Usage
+
+### Basic
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ConnectQueue } from "./.gen/providers/aws/connect-queue";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ConnectQueue(this, "test", {
+      description: "Example Description",
+      hoursOfOperationId: "12345678-1234-1234-1234-123456789012",
+      instanceId: "aaaaaaaa-bbbb-cccc-dddd-111111111111",
+      name: "Example Name",
+      tags: {
+        Name: "Example Queue",
+      },
+    });
+  }
+}
+
+```
+
+### With Quick Connect IDs
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ConnectQueue } from "./.gen/providers/aws/connect-queue";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ConnectQueue(this, "test", {
+      description: "Example Description",
+      hoursOfOperationId: "12345678-1234-1234-1234-123456789012",
+      instanceId: "aaaaaaaa-bbbb-cccc-dddd-111111111111",
+      name: "Example Name",
+      quickConnectIds: ["12345678-abcd-1234-abcd-123456789012"],
+      tags: {
+        Name: "Example Queue with Quick Connect IDs",
+      },
+    });
+  }
+}
+
+```
+
+### With Outbound Caller Config
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ConnectQueue } from "./.gen/providers/aws/connect-queue";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ConnectQueue(this, "test", {
+      description: "Example Description",
+      hoursOfOperationId: "12345678-1234-1234-1234-123456789012",
+      instanceId: "aaaaaaaa-bbbb-cccc-dddd-111111111111",
+      name: "Example Name",
+      outboundCallerConfig: {
+        outboundCallerIdName: "example",
+        outboundCallerIdNumberId: "12345678-abcd-1234-abcd-123456789012",
+        outboundFlowId: "87654321-defg-1234-defg-987654321234",
+      },
+      tags: {
+        Name: "Example Queue with Outbound Caller Config",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `description` - (Optional) Specifies the description of the Queue.
+* `hoursOfOperationId` - (Required) Specifies the identifier of the Hours of Operation.
+* `instanceId` - (Required) Specifies the identifier of the hosting Amazon Connect Instance.
+* `maxContacts` - (Optional) Specifies the maximum number of contacts that can be in the queue before it is considered full. Minimum value of 0.
+* `name` - (Required) Specifies the name of the Queue.
+* `outboundCallerConfig` - (Required) A block that defines the outbound caller ID name, number, and outbound whisper flow. The Outbound Caller Config block is documented below.
+* `quickConnectIds` - (Optional) Specifies a list of quick connects ids that determine the quick connects available to agents who are working the queue.
+* `status` - (Optional) Specifies the description of the Queue. Valid values are `enabled`, `disabled`.
+* `tags` - (Optional) Tags to apply to the Queue. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+A `outboundCallerConfig` block supports the following arguments:
+
+* `outboundCallerIdName` - (Optional) Specifies the caller ID name.
+* `outboundCallerIdNumberId` - (Optional) Specifies the caller ID number.
+* `outboundFlowId` - (Optional) Specifies outbound whisper flow to be used during an outbound call.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the Queue.
+* `queueId` - The identifier for the Queue.
+* `id` - The identifier of the hosting Amazon Connect Instance and identifier of the Queue separated by a colon (`:`).
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Amazon Connect Queues using the `instanceId` and `queueId` separated by a colon (`:`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Amazon Connect Queues using the `instanceId` and `queueId` separated by a colon (`:`). For example:
+
+```console
+% terraform import aws_connect_queue.example f1288a1f-6193-445a-b47e-af739b2:c1d4e5f6-1b3c-1b3c-1b3c-c1d4e5f6c1d4e5
+```
+
+<!-- cache-key: cdktf-0.18.0 input-2ad77533b286fa62f6bf36fa4951ae8f0bd431d1f8cd5d285ecbbda98060e486 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/connect_quick_connect.html.markdown b/website/docs/cdktf/typescript/r/connect_quick_connect.html.markdown
new file mode 100644
index 00000000000..d0cd473bde2
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/connect_quick_connect.html.markdown
@@ -0,0 +1,113 @@
+---
+subcategory: "Connect"
+layout: "aws"
+page_title: "AWS: aws_connect_quick_connect"
+description: |-
+  Provides details about a specific Amazon Quick Connect
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_connect_quick_connect
+
+Provides an Amazon Connect Quick Connect resource. For more information see
+[Amazon Connect: Getting Started](https://docs.aws.amazon.com/connect/latest/adminguide/amazon-connect-get-started.html)
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ConnectQuickConnect } from "./.gen/providers/aws/connect-quick-connect";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ConnectQuickConnect(this, "test", {
+      description: "quick connect phone number",
+      instanceId: "aaaaaaaa-bbbb-cccc-dddd-111111111111",
+      name: "Example Name",
+      quickConnectConfig: {
+        phoneConfig: [
+          {
+            phoneNumber: "+12345678912",
+          },
+        ],
+        quickConnectType: "PHONE_NUMBER",
+      },
+      tags: {
+        Name: "Example Quick Connect",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `description` - (Optional) Specifies the description of the Quick Connect.
+* `instanceId` - (Required) Specifies the identifier of the hosting Amazon Connect Instance.
+* `name` - (Required) Specifies the name of the Quick Connect.
+* `quickConnectConfig` - (Required) A block that defines the configuration information for the Quick Connect: `quickConnectType` and one of `phoneConfig`, `queueConfig`, `userConfig` . The Quick Connect Config block is documented below.
+* `tags` - (Optional) Tags to apply to the Quick Connect. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+A `quickConnectConfig` block supports the following arguments:
+
+* `quickConnectType` - (Required) Specifies the configuration type of the quick connect. valid values are `phoneNumber`, `queue`, `user`.
+* `phoneConfig` - (Optional) Specifies the phone configuration of the Quick Connect. This is required only if `quickConnectType` is `phoneNumber`. The `phoneConfig` block is documented below.
+* `queueConfig` - (Optional) Specifies the queue configuration of the Quick Connect. This is required only if `quickConnectType` is `queue`. The `queueConfig` block is documented below.
+* `userConfig` - (Optional) Specifies the user configuration of the Quick Connect. This is required only if `quickConnectType` is `user`. The `userConfig` block is documented below.
+
+A `phoneConfig` block supports the following arguments:
+
+* `phoneNumber` - (Required) Specifies the phone number in in E.164 format.
+
+A `queueConfig` block supports the following arguments:
+
+* `contactFlowId` - (Required) Specifies the identifier of the contact flow.
+* `queueId` - (Required) Specifies the identifier for the queue.
+
+A `userConfig` block supports the following arguments:
+
+* `contactFlowId` - (Required) Specifies the identifier of the contact flow.
+* `userId` - (Required) Specifies the identifier for the user.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the Quick Connect.
+* `quickConnectId` - The identifier for the Quick Connect.
+* `id` - The identifier of the hosting Amazon Connect Instance and identifier of the Quick Connect separated by a colon (`:`).
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Amazon Connect Quick Connects using the `instanceId` and `quickConnectId` separated by a colon (`:`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Amazon Connect Quick Connects using the `instanceId` and `quickConnectId` separated by a colon (`:`). For example:
+
+```console
+% terraform import aws_connect_quick_connect.example f1288a1f-6193-445a-b47e-af739b2:c1d4e5f6-1b3c-1b3c-1b3c-c1d4e5f6c1d4e5
+```
+
+<!-- cache-key: cdktf-0.18.0 input-01f9e092c1240fc60d8e6329e1e37cd1a809022b9cf4800e0a25c88837374218 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/connect_routing_profile.html.markdown b/website/docs/cdktf/typescript/r/connect_routing_profile.html.markdown
new file mode 100644
index 00000000000..eff708f51e8
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/connect_routing_profile.html.markdown
@@ -0,0 +1,120 @@
+---
+subcategory: "Connect"
+layout: "aws"
+page_title: "AWS: aws_connect_routing_profile"
+description: |-
+  Provides details about a specific Amazon Connect Routing Profile.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_connect_routing_profile
+
+Provides an Amazon Connect Routing Profile resource. For more information see
+[Amazon Connect: Getting Started](https://docs.aws.amazon.com/connect/latest/adminguide/amazon-connect-get-started.html)
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ConnectRoutingProfile } from "./.gen/providers/aws/connect-routing-profile";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ConnectRoutingProfile(this, "example", {
+      defaultOutboundQueueId: "12345678-1234-1234-1234-123456789012",
+      description: "example description",
+      instanceId: "aaaaaaaa-bbbb-cccc-dddd-111111111111",
+      mediaConcurrencies: [
+        {
+          channel: "VOICE",
+          concurrency: 1,
+        },
+      ],
+      name: "example",
+      queueConfigs: [
+        {
+          channel: "VOICE",
+          delay: 2,
+          priority: 1,
+          queueId: "12345678-1234-1234-1234-123456789012",
+        },
+      ],
+      tags: {
+        Name: "Example Routing Profile",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `defaultOutboundQueueId` - (Required) Specifies the default outbound queue for the Routing Profile.
+* `description` - (Required) Specifies the description of the Routing Profile.
+* `instanceId` - (Required) Specifies the identifier of the hosting Amazon Connect Instance.
+* `mediaConcurrencies` - (Required) One or more `mediaConcurrencies` blocks that specify the channels that agents can handle in the Contact Control Panel (CCP) for this Routing Profile. The `mediaConcurrencies` block is documented below.
+* `name` - (Required) Specifies the name of the Routing Profile.
+* `queueConfigs` - (Optional) One or more `queueConfigs` blocks that specify the inbound queues associated with the routing profile. If no queue is added, the agent only can make outbound calls. The `queueConfigs` block is documented below.
+* `tags` - (Optional) Tags to apply to the Routing Profile. If configured with a provider
+[`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+A `mediaConcurrencies` block supports the following arguments:
+
+* `channel` - (Required) Specifies the channels that agents can handle in the Contact Control Panel (CCP). Valid values are `voice`, `chat`, `task`.
+* `concurrency` - (Required) Specifies the number of contacts an agent can have on a channel simultaneously. Valid Range for `voice`: Minimum value of 1. Maximum value of 1. Valid Range for `chat`: Minimum value of 1. Maximum value of 10. Valid Range for `task`: Minimum value of 1. Maximum value of 10.
+
+A `queueConfigs` block supports the following arguments:
+
+* `channel` - (Required) Specifies the channels agents can handle in the Contact Control Panel (CCP) for this routing profile. Valid values are `voice`, `chat`, `task`.
+* `delay` - (Required) Specifies the delay, in seconds, that a contact should be in the queue before they are routed to an available agent
+* `priority` - (Required) Specifies the order in which contacts are to be handled for the queue.
+* `queueId` - (Required) Specifies the identifier for the queue.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the Routing Profile.
+* `id` - The identifier of the hosting Amazon Connect Instance and identifier of the Routing Profile separated by a colon (`:`).
+* `queueConfigs` - In addition to the arguments used in the `queueConfigs` argument block, there are additional attributes exported within the `queueConfigs` block. These additional attributes are documented below.
+* `routingProfileId` - The identifier for the Routing Profile.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+A `queueConfigs` block supports the following attributes in addition to the arguments defined earlier:
+
+* `queueArn` - ARN for the queue.
+* `queueName` - Name for the queue.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Amazon Connect Routing Profiles using the `instanceId` and `routingProfileId` separated by a colon (`:`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Amazon Connect Routing Profiles using the `instanceId` and `routingProfileId` separated by a colon (`:`). For example:
+
+```console
+% terraform import aws_connect_routing_profile.example f1288a1f-6193-445a-b47e-af739b2:c1d4e5f6-1b3c-1b3c-1b3c-c1d4e5f6c1d4e5
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1f2cd7ee9876fa36ee4179b3d2a05a02f4d68fe3bb0d9a30414b3a35c3873635 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/connect_security_profile.html.markdown b/website/docs/cdktf/typescript/r/connect_security_profile.html.markdown
new file mode 100644
index 00000000000..397e1d4ec1a
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/connect_security_profile.html.markdown
@@ -0,0 +1,87 @@
+---
+subcategory: "Connect"
+layout: "aws"
+page_title: "AWS: aws_connect_security_profile"
+description: |-
+  Provides details about a specific Amazon Connect Security Profile.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_connect_security_profile
+
+Provides an Amazon Connect Security Profile resource. For more information see
+[Amazon Connect: Getting Started](https://docs.aws.amazon.com/connect/latest/adminguide/amazon-connect-get-started.html)
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ConnectSecurityProfile } from "./.gen/providers/aws/connect-security-profile";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ConnectSecurityProfile(this, "example", {
+      description: "example description",
+      instanceId: "aaaaaaaa-bbbb-cccc-dddd-111111111111",
+      name: "example",
+      permissions: ["BasicAgentAccess", "OutboundCallAccess"],
+      tags: {
+        Name: "Example Security Profile",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `description` - (Optional) Specifies the description of the Security Profile.
+* `instanceId` - (Required) Specifies the identifier of the hosting Amazon Connect Instance.
+* `name` - (Required) Specifies the name of the Security Profile.
+* `permissions` - (Optional) Specifies a list of permissions assigned to the security profile.
+* `tags` - (Optional) Tags to apply to the Security Profile. If configured with a provider
+[`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the Security Profile.
+* `organizationResourceId` - The organization resource identifier for the security profile.
+* `securityProfileId` - The identifier for the Security Profile.
+* `id` - The identifier of the hosting Amazon Connect Instance and identifier of the Security Profile separated by a colon (`:`).
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Amazon Connect Security Profiles using the `instanceId` and `securityProfileId` separated by a colon (`:`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Amazon Connect Security Profiles using the `instanceId` and `securityProfileId` separated by a colon (`:`). For example:
+
+```console
+% terraform import aws_connect_security_profile.example f1288a1f-6193-445a-b47e-af739b2:c1d4e5f6-1b3c-1b3c-1b3c-c1d4e5f6c1d4e5
+```
+
+<!-- cache-key: cdktf-0.18.0 input-220f16e830e0261ed2fda1556d594951dc89e406092f917b2ad3ea75fafbac54 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/connect_user.html.markdown b/website/docs/cdktf/typescript/r/connect_user.html.markdown
new file mode 100644
index 00000000000..f7f5fd89f0b
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/connect_user.html.markdown
@@ -0,0 +1,268 @@
+---
+subcategory: "Connect"
+layout: "aws"
+page_title: "AWS: aws_connect_user"
+description: |-
+  Provides details about a specific Amazon Connect User
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_connect_user
+
+Provides an Amazon Connect User resource. For more information see
+[Amazon Connect: Getting Started](https://docs.aws.amazon.com/connect/latest/adminguide/amazon-connect-get-started.html)
+
+## Example Usage
+
+### Basic
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ConnectUser } from "./.gen/providers/aws/connect-user";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ConnectUser(this, "example", {
+      identityInfo: {
+        firstName: "example",
+        lastName: "example2",
+      },
+      instanceId: Token.asString(awsConnectInstanceExample.id),
+      name: "example",
+      password: "Password123",
+      phoneConfig: {
+        afterContactWorkTimeLimit: 0,
+        phoneType: "SOFT_PHONE",
+      },
+      routingProfileId: Token.asString(
+        awsConnectRoutingProfileExample.routingProfileId
+      ),
+      securityProfileIds: [
+        Token.asString(awsConnectSecurityProfileExample.securityProfileId),
+      ],
+    });
+  }
+}
+
+```
+
+### With hierarchy_group_id
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ConnectUser } from "./.gen/providers/aws/connect-user";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ConnectUser(this, "example", {
+      hierarchyGroupId: Token.asString(
+        awsConnectUserHierarchyGroupExample.hierarchyGroupId
+      ),
+      identityInfo: {
+        firstName: "example",
+        lastName: "example2",
+      },
+      instanceId: Token.asString(awsConnectInstanceExample.id),
+      name: "example",
+      password: "Password123",
+      phoneConfig: {
+        afterContactWorkTimeLimit: 0,
+        phoneType: "SOFT_PHONE",
+      },
+      routingProfileId: Token.asString(
+        awsConnectRoutingProfileExample.routingProfileId
+      ),
+      securityProfileIds: [
+        Token.asString(awsConnectSecurityProfileExample.securityProfileId),
+      ],
+    });
+  }
+}
+
+```
+
+### With identity_info filled
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ConnectUser } from "./.gen/providers/aws/connect-user";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ConnectUser(this, "example", {
+      identityInfo: {
+        email: "example@example.com",
+        firstName: "example",
+        lastName: "example2",
+      },
+      instanceId: Token.asString(awsConnectInstanceExample.id),
+      name: "example",
+      password: "Password123",
+      phoneConfig: {
+        afterContactWorkTimeLimit: 0,
+        phoneType: "SOFT_PHONE",
+      },
+      routingProfileId: Token.asString(
+        awsConnectRoutingProfileExample.routingProfileId
+      ),
+      securityProfileIds: [
+        Token.asString(awsConnectSecurityProfileExample.securityProfileId),
+      ],
+    });
+  }
+}
+
+```
+
+### With phone_config phone type as desk phone
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ConnectUser } from "./.gen/providers/aws/connect-user";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ConnectUser(this, "example", {
+      instanceId: Token.asString(awsConnectInstanceExample.id),
+      name: "example",
+      password: "Password123",
+      phoneConfig: {
+        afterContactWorkTimeLimit: 0,
+        phoneType: "SOFT_PHONE",
+      },
+      routingProfileId: Token.asString(
+        awsConnectRoutingProfileExample.routingProfileId
+      ),
+      securityProfileIds: [
+        Token.asString(awsConnectSecurityProfileExample.securityProfileId),
+      ],
+    });
+  }
+}
+
+```
+
+### With multiple Security profile ids specified in security_profile_ids
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ConnectUser } from "./.gen/providers/aws/connect-user";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ConnectUser(this, "example", {
+      instanceId: Token.asString(awsConnectInstanceExample.id),
+      name: "example",
+      password: "Password123",
+      phoneConfig: {
+        afterContactWorkTimeLimit: 0,
+        autoAccept: false,
+        deskPhoneNumber: "+112345678912",
+        phoneType: "DESK_PHONE",
+      },
+      routingProfileId: Token.asString(
+        awsConnectRoutingProfileExample.routingProfileId
+      ),
+      securityProfileIds: [
+        Token.asString(awsConnectSecurityProfileExample.securityProfileId),
+        example2.securityProfileId,
+      ],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `directoryUserId` - (Optional) The identifier of the user account in the directory used for identity management. If Amazon Connect cannot access the directory, you can specify this identifier to authenticate users. If you include the identifier, we assume that Amazon Connect cannot access the directory. Otherwise, the identity information is used to authenticate users from your directory. This parameter is required if you are using an existing directory for identity management in Amazon Connect when Amazon Connect cannot access your directory to authenticate users. If you are using SAML for identity management and include this parameter, an error is returned.
+* `hierarchyGroupId` - (Optional) The identifier of the hierarchy group for the user.
+* `identityInfo` - (Optional) A block that contains information about the identity of the user. Documented below.
+* `instanceId` - (Required) Specifies the identifier of the hosting Amazon Connect Instance.
+* `name` - (Required) The user name for the account. For instances not using SAML for identity management, the user name can include up to 20 characters. If you are using SAML for identity management, the user name can include up to 64 characters from `[aZAZ09_-.\@]+`.
+* `password` - (Optional) The password for the user account. A password is required if you are using Amazon Connect for identity management. Otherwise, it is an error to include a password.
+* `phoneConfig` - (Required) A block that contains information about the phone settings for the user. Documented below.
+* `routingProfileId` - (Required) The identifier of the routing profile for the user.
+* `securityProfileIds` - (Required) A list of identifiers for the security profiles for the user. Specify a minimum of 1 and maximum of 10 security profile ids. For more information, see [Best Practices for Security Profiles](https://docs.aws.amazon.com/connect/latest/adminguide/security-profile-best-practices.html) in the Amazon Connect Administrator Guide.
+* `tags` - (Optional) Tags to apply to the user. If configured with a provider
+[`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+A `identityInfo` block supports the following arguments:
+
+* `email` - (Optional) The email address. If you are using SAML for identity management and include this parameter, an error is returned. Note that updates to the `email` is supported. From the [UpdateUserIdentityInfo API documentation](https://docs.aws.amazon.com/connect/latest/APIReference/API_UpdateUserIdentityInfo.html) it is strongly recommended to limit who has the ability to invoke `updateUserIdentityInfo`. Someone with that ability can change the login credentials of other users by changing their email address. This poses a security risk to your organization. They can change the email address of a user to the attacker's email address, and then reset the password through email. For more information, see [Best Practices for Security Profiles](https://docs.aws.amazon.com/connect/latest/adminguide/security-profile-best-practices.html) in the Amazon Connect Administrator Guide.
+* `firstName` - (Optional) The first name. This is required if you are using Amazon Connect or SAML for identity management. Minimum length of 1. Maximum length of 100.
+* `lastName` - (Optional) The last name. This is required if you are using Amazon Connect or SAML for identity management. Minimum length of 1. Maximum length of 100.
+
+A `phoneConfig` block supports the following arguments:
+
+* `afterContactWorkTimeLimit` - (Optional) The After Call Work (ACW) timeout setting, in seconds. Minimum value of 0.
+* `autoAccept` - (Optional) When Auto-Accept Call is enabled for an available agent, the agent connects to contacts automatically.
+* `deskPhoneNumber` - (Optional) The phone number for the user's desk phone. Required if `phoneType` is set as `deskPhone`.
+* `phoneType` - (Required) The phone type. Valid values are `deskPhone` and `softPhone`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the user.
+* `id` - The identifier of the hosting Amazon Connect Instance and identifier of the user
+separated by a colon (`:`).
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `userId` - The identifier for the user.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Amazon Connect Users using the `instanceId` and `userId` separated by a colon (`:`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Amazon Connect Users using the `instanceId` and `userId` separated by a colon (`:`). For example:
+
+```console
+% terraform import aws_connect_user.example f1288a1f-6193-445a-b47e-af739b2:c1d4e5f6-1b3c-1b3c-1b3c-c1d4e5f6c1d4e5
+```
+
+<!-- cache-key: cdktf-0.18.0 input-637041caefd4e9ef7b93ae5320925ba1005510f5cbf4f83cc643caaa13039440 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/connect_user_hierarchy_group.html.markdown b/website/docs/cdktf/typescript/r/connect_user_hierarchy_group.html.markdown
new file mode 100644
index 00000000000..5c97ea29453
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/connect_user_hierarchy_group.html.markdown
@@ -0,0 +1,138 @@
+---
+subcategory: "Connect"
+layout: "aws"
+page_title: "AWS: aws_connect_user_hierarchy_group"
+description: |-
+  Provides details about a specific Amazon Connect User Hierarchy Group
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_connect_user_hierarchy_group
+
+Provides an Amazon Connect User Hierarchy Group resource. For more information see
+[Amazon Connect: Getting Started](https://docs.aws.amazon.com/connect/latest/adminguide/amazon-connect-get-started.html)
+
+~> **NOTE:** The User Hierarchy Structure must be created before creating a User Hierarchy Group.
+
+## Example Usage
+
+### Basic
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ConnectUserHierarchyGroup } from "./.gen/providers/aws/connect-user-hierarchy-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ConnectUserHierarchyGroup(this, "example", {
+      instanceId: "aaaaaaaa-bbbb-cccc-dddd-111111111111",
+      name: "example",
+      tags: {
+        Name: "Example User Hierarchy Group",
+      },
+    });
+  }
+}
+
+```
+
+### With a parent group
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ConnectUserHierarchyGroup } from "./.gen/providers/aws/connect-user-hierarchy-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const parent = new ConnectUserHierarchyGroup(this, "parent", {
+      instanceId: "aaaaaaaa-bbbb-cccc-dddd-111111111111",
+      name: "parent",
+      tags: {
+        Name: "Example User Hierarchy Group Parent",
+      },
+    });
+    new ConnectUserHierarchyGroup(this, "child", {
+      instanceId: "aaaaaaaa-bbbb-cccc-dddd-111111111111",
+      name: "child",
+      parentGroupId: parent.hierarchyGroupId,
+      tags: {
+        Name: "Example User Hierarchy Group Child",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `instanceId` - (Required) Specifies the identifier of the hosting Amazon Connect Instance.
+* `name` - (Required) The name of the user hierarchy group. Must not be more than 100 characters.
+* `parentGroupId` - (Optional) The identifier for the parent hierarchy group. The user hierarchy is created at level one if the parent group ID is null.
+* `tags` - (Optional) Tags to apply to the hierarchy group. If configured with a provider
+[`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the hierarchy group.
+* `hierarchyGroupId` - The identifier for the hierarchy group.
+* `hierarchyPath` - A block that contains information about the levels in the hierarchy group. The `hierarchyPath` block is documented below.
+* `id` - The identifier of the hosting Amazon Connect Instance and identifier of the hierarchy group
+separated by a colon (`:`).
+* `levelId` - The identifier of the level in the hierarchy group.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+A `hierarchyPath` block supports the following attributes:
+
+* `levelOne` - A block that defines the details of level one. The level block is documented below.
+* `levelTwo` - A block that defines the details of level two. The level block is documented below.
+* `levelThree` - A block that defines the details of level three. The level block is documented below.
+* `levelFour` - A block that defines the details of level four. The level block is documented below.
+* `levelFive` - A block that defines the details of level five. The level block is documented below.
+
+A level block supports the following attributes:
+
+* `arn` -  The Amazon Resource Name (ARN) of the hierarchy group.
+* `id` -  The identifier of the hierarchy group.
+* `name` - The name of the hierarchy group.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Amazon Connect User Hierarchy Groups using the `instanceId` and `hierarchyGroupId` separated by a colon (`:`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Amazon Connect User Hierarchy Groups using the `instanceId` and `hierarchyGroupId` separated by a colon (`:`). For example:
+
+```console
+% terraform import aws_connect_user_hierarchy_group.example f1288a1f-6193-445a-b47e-af739b2:c1d4e5f6-1b3c-1b3c-1b3c-c1d4e5f6c1d4e5
+```
+
+<!-- cache-key: cdktf-0.18.0 input-88263c0c4b64231cf0ae6b158e3728e1a26added6f1a3b85f4dc8db7b158609a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/connect_user_hierarchy_structure.html.markdown b/website/docs/cdktf/typescript/r/connect_user_hierarchy_structure.html.markdown
new file mode 100644
index 00000000000..5be52f2d68b
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/connect_user_hierarchy_structure.html.markdown
@@ -0,0 +1,137 @@
+---
+subcategory: "Connect"
+layout: "aws"
+page_title: "AWS: aws_connect_user_hierarchy_structure"
+description: |-
+  Provides details about a specific Amazon Connect User Hierarchy Structure
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_connect_user_hierarchy_structure
+
+Provides an Amazon Connect User Hierarchy Structure resource. For more information see
+[Amazon Connect: Getting Started](https://docs.aws.amazon.com/connect/latest/adminguide/amazon-connect-get-started.html)
+
+## Example Usage
+
+### Basic
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ConnectUserHierarchyStructure } from "./.gen/providers/aws/connect-user-hierarchy-structure";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ConnectUserHierarchyStructure(this, "example", {
+      hierarchyStructure: {
+        levelOne: {
+          name: "levelone",
+        },
+      },
+      instanceId: "aaaaaaaa-bbbb-cccc-dddd-111111111111",
+    });
+  }
+}
+
+```
+
+### With Five Levels
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ConnectUserHierarchyStructure } from "./.gen/providers/aws/connect-user-hierarchy-structure";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ConnectUserHierarchyStructure(this, "example", {
+      hierarchyStructure: {
+        levelFive: {
+          name: "levelfive",
+        },
+        levelFour: {
+          name: "levelfour",
+        },
+        levelOne: {
+          name: "levelone",
+        },
+        levelThree: {
+          name: "levelthree",
+        },
+        levelTwo: {
+          name: "leveltwo",
+        },
+      },
+      instanceId: "aaaaaaaa-bbbb-cccc-dddd-111111111111",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `hierarchyStructure` - (Required) A block that defines the hierarchy structure's levels. The `hierarchyStructure` block is documented below.
+* `instanceId` - (Required) Specifies the identifier of the hosting Amazon Connect Instance.
+
+A `hierarchyStructure` block supports the following arguments:
+
+* `levelOne` - (Optional) A block that defines the details of level one. The level block is documented below.
+* `levelTwo` - (Optional) A block that defines the details of level two. The level block is documented below.
+* `levelThree` - (Optional) A block that defines the details of level three. The level block is documented below.
+* `levelFour` - (Optional) A block that defines the details of level four. The level block is documented below.
+* `levelFive` - (Optional) A block that defines the details of level five. The level block is documented below.
+
+Each level block supports the following arguments:
+
+* `name` - (Required) The name of the user hierarchy level. Must not be more than 50 characters.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `hierarchyStructure` - In addition to the arguments defined initially, there are attributes added to the levels created. These additional attributes are documented below.
+* `id` - The identifier of the hosting Amazon Connect Instance.
+
+A level block supports the following additional attributes:
+
+* `arn` -  The Amazon Resource Name (ARN) of the hierarchy level.
+* `id` -  The identifier of the hierarchy level.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Amazon Connect User Hierarchy Structures using the `instanceId`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Amazon Connect User Hierarchy Structures using the `instanceId`. For example:
+
+```console
+% terraform import aws_connect_user_hierarchy_structure.example f1288a1f-6193-445a-b47e-af739b2
+```
+
+<!-- cache-key: cdktf-0.18.0 input-d4221332a1de6be2872d8c5ee9a0bd06fd2ef712cb35778939fcdd12ecf0c17c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/connect_vocabulary.html.markdown b/website/docs/cdktf/typescript/r/connect_vocabulary.html.markdown
new file mode 100644
index 00000000000..763b474ac25
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/connect_vocabulary.html.markdown
@@ -0,0 +1,98 @@
+---
+subcategory: "Connect"
+layout: "aws"
+page_title: "AWS: aws_connect_vocabulary"
+description: |-
+  Provides details about a specific Amazon Connect Vocabulary
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_connect_vocabulary
+
+Provides an Amazon Connect Vocabulary resource. For more information see
+[Amazon Connect: Getting Started](https://docs.aws.amazon.com/connect/latest/adminguide/amazon-connect-get-started.html)
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ConnectVocabulary } from "./.gen/providers/aws/connect-vocabulary";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ConnectVocabulary(this, "example", {
+      content:
+        "Phrase\tIPA\tSoundsLike\tDisplayAs\nLos-Angeles\t\t\tLos Angeles\nF.B.I.\t\u025B f b i a\u026A\t\tFBI\nEtienne\t\teh-tee-en\t\n",
+      instanceId: "aaaaaaaa-bbbb-cccc-dddd-111111111111",
+      languageCode: "en-US",
+      name: "example",
+      tags: {
+        Key1: "Value1",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `content` - (Required) The content of the custom vocabulary in plain-text format with a table of values. Each row in the table represents a word or a phrase, described with Phrase, IPA, SoundsLike, and DisplayAs fields. Separate the fields with TAB characters. For more information, see [Create a custom vocabulary using a table](https://docs.aws.amazon.com/transcribe/latest/dg/custom-vocabulary.html#create-vocabulary-table). Minimum length of `1`. Maximum length of `60000`.
+* `instanceId` - (Required) Specifies the identifier of the hosting Amazon Connect Instance.
+* `languageCode` - (Required) The language code of the vocabulary entries. For a list of languages and their corresponding language codes, see [What is Amazon Transcribe?](https://docs.aws.amazon.com/transcribe/latest/dg/transcribe-whatis.html). Valid Values are `arAe`, `deCh`, `deDe`, `enAb`, `enAu`, `enGb`, `enIe`, `enIn`, `enUs`, `enWl`, `esEs`, `esUs`, `frCa`, `frFr`, `hiIn`, `itIt`, `jaJp`, `koKr`, `ptBr`, `ptPt`, `zhCn`.
+* `name` - (Required) A unique name of the custom vocabulary. Must not be more than 140 characters.
+* `tags` - (Optional) Tags to apply to the vocabulary. If configured with a provider
+[`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `5M`)
+* `delete` - (Default `100M`)
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the vocabulary.
+* `failureReason` - The reason why the custom vocabulary was not created.
+* `id` - The identifier of the hosting Amazon Connect Instance and identifier of the vocabulary
+separated by a colon (`:`).
+* `lastModifiedTime` - The timestamp when the custom vocabulary was last modified.
+* `state` - The current state of the custom vocabulary. Valid values are `creationInProgress`, `active`, `creationFailed`, `deleteInProgress`.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `vocabularyId` - The identifier of the custom vocabulary.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Amazon Connect Vocabularies using the `instanceId` and `vocabularyId` separated by a colon (`:`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Amazon Connect Vocabularies using the `instanceId` and `vocabularyId` separated by a colon (`:`). For example:
+
+```console
+% terraform import aws_connect_vocabulary.example f1288a1f-6193-445a-b47e-af739b2:c1d4e5f6-1b3c-1b3c-1b3c-c1d4e5f6c1d4e5
+```
+
+<!-- cache-key: cdktf-0.18.0 input-3955fbdc4f62d37293c6c592a646970e8139f7fe6c62b5ff6553de1bddf5eb38 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/controltower_control.html.markdown b/website/docs/cdktf/typescript/r/controltower_control.html.markdown
new file mode 100644
index 00000000000..5c005e6936a
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/controltower_control.html.markdown
@@ -0,0 +1,101 @@
+---
+subcategory: "Control Tower"
+layout: "aws"
+page_title: "AWS: aws_controltower_control"
+description: |-
+  Allows the application of pre-defined controls to organizational units.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_controltower_control
+
+Allows the application of pre-defined controls to organizational units. For more information on usage, please see the
+[AWS Control Tower User Guide](https://docs.aws.amazon.com/controltower/latest/userguide/enable-guardrails.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ControltowerControl } from "./.gen/providers/aws/controltower-control";
+import { DataAwsOrganizationsOrganization } from "./.gen/providers/aws/data-aws-organizations-organization";
+import { DataAwsOrganizationsOrganizationalUnits } from "./.gen/providers/aws/data-aws-organizations-organizational-units";
+import { DataAwsRegion } from "./.gen/providers/aws/data-aws-region";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new DataAwsOrganizationsOrganization(this, "example", {});
+    const dataAwsOrganizationsOrganizationalUnitsExample =
+      new DataAwsOrganizationsOrganizationalUnits(this, "example_1", {
+        parentId: Token.asString(Fn.lookupNested(example.roots, ["0", "id"])),
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsOrganizationsOrganizationalUnitsExample.overrideLogicalId("example");
+    const current = new DataAwsRegion(this, "current", {});
+    const awsControltowerControlExample = new ControltowerControl(
+      this,
+      "example_3",
+      {
+        controlIdentifier:
+          "arn:aws:controltower:${" +
+          current.name +
+          "}::control/AWS-GR_EC2_VOLUME_INUSE_CHECK",
+        targetIdentifier: Token.asString(
+          Fn.lookupNested(
+            "${[ for x in ${" +
+              dataAwsOrganizationsOrganizationalUnitsExample.children +
+              '} : x.arn if x.name == "Infrastructure"]}',
+            ["0"]
+          )
+        ),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsControltowerControlExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `controlIdentifier` - (Required) The ARN of the control. Only Strongly recommended and Elective controls are permitted, with the exception of the Region deny guardrail.
+* `targetIdentifier` - (Required) The ARN of the organizational unit.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ARN of the organizational unit.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Control Tower Controls using their `organizationalUnitArn/controlIdentifier`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Control Tower Controls using their `organizationalUnitArn/controlIdentifier`. For example:
+
+```console
+% terraform import aws_controltower_control.example arn:aws:organizations::123456789101:ou/o-qqaejywet/ou-qg5o-ufbhdtv3,arn:aws:controltower:us-east-1::control/WTDSMKDKDNLE
+```
+
+<!-- cache-key: cdktf-0.18.0 input-9eb1fc57f4835f2b8e9d32dc66ec655897e6e1d78cffd7254048eef1370885df -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/cur_report_definition.html.markdown b/website/docs/cdktf/typescript/r/cur_report_definition.html.markdown
new file mode 100644
index 00000000000..5e2e6becc78
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/cur_report_definition.html.markdown
@@ -0,0 +1,90 @@
+---
+subcategory: "Cost and Usage Report"
+layout: "aws"
+page_title: "AWS: aws_cur_report_definition"
+description: |-
+  Provides a Cost and Usage Report Definition.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_cur_report_definition
+
+Manages Cost and Usage Report Definitions.
+
+~> *NOTE:* The AWS Cost and Usage Report service is only available in `usEast1` currently.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CurReportDefinition } from "./.gen/providers/aws/cur-report-definition";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new CurReportDefinition(this, "example_cur_report_definition", {
+      additionalArtifacts: ["REDSHIFT", "QUICKSIGHT"],
+      additionalSchemaElements: ["RESOURCES", "SPLIT_COST_ALLOCATION_DATA"],
+      compression: "GZIP",
+      format: "textORcsv",
+      reportName: "example-cur-report-definition",
+      s3Bucket: "example-bucket-name",
+      s3Region: "us-east-1",
+      timeUnit: "HOURLY",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `reportName` - (Required) Unique name for the report. Must start with a number/letter and is case sensitive. Limited to 256 characters.
+* `timeUnit` - (Required) The frequency on which report data are measured and displayed.  Valid values are: `daily`, `hourly`, `monthly`.
+* `format` - (Required) Format for report. Valid values are: `textORcsv`, `parquet`. If `parquet` is used, then Compression must also be `parquet`.
+* `compression` - (Required) Compression format for report. Valid values are: `gzip`, `zip`, `parquet`. If `parquet` is used, then format must also be `parquet`.
+* `additionalSchemaElements` - (Required) A list of schema elements. Valid values are: `resources`, `splitCostAllocationData`.
+* `s3Bucket` - (Required) Name of the existing S3 bucket to hold generated reports.
+* `s3Prefix` - (Optional) Report path prefix. Limited to 256 characters.
+* `s3Region` - (Required) Region of the existing S3 bucket to hold generated reports.
+* `additionalArtifacts` - (Required) A list of additional artifacts. Valid values are: `redshift`, `quicksight`, `athena`. When ATHENA exists within additional_artifacts, no other artifact type can be declared and report_versioning must be `overwriteReport`.
+* `refreshClosedReports` - (Optional) Set to true to update your reports after they have been finalized if AWS detects charges related to previous months.
+* `reportVersioning` - (Optional) Overwrite the previous version of each report or to deliver the report in addition to the previous versions. Valid values are: `createNewReport` and `overwriteReport`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) specifying the cur report.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Report Definitions using the `reportName`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Report Definitions using the `reportName`. For example:
+
+```console
+% terraform import aws_cur_report_definition.example_cur_report_definition example-cur-report-definition
+```
+
+<!-- cache-key: cdktf-0.18.0 input-067985956199063abed34d5456679d542c82c7fd1e66853cbcc4c311a08d07b2 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/customer_gateway.html.markdown b/website/docs/cdktf/typescript/r/customer_gateway.html.markdown
new file mode 100644
index 00000000000..37fb463ee32
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/customer_gateway.html.markdown
@@ -0,0 +1,86 @@
+---
+subcategory: "VPN (Site-to-Site)"
+layout: "aws"
+page_title: "AWS: aws_customer_gateway"
+description: |-
+  Provides a customer gateway inside a VPC. These objects can be
+  connected to VPN gateways via VPN connections, and allow you to
+  establish tunnels between your network and the VPC.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_customer_gateway
+
+Provides a customer gateway inside a VPC. These objects can be connected to VPN gateways via VPN connections, and allow you to establish tunnels between your network and the VPC.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CustomerGateway } from "./.gen/providers/aws/customer-gateway";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new CustomerGateway(this, "main", {
+      bgpAsn: Token.asString(65000),
+      ipAddress: "172.83.124.10",
+      tags: {
+        Name: "main-customer-gateway",
+      },
+      type: "ipsec.1",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `bgpAsn` - (Required) The gateway's Border Gateway Protocol (BGP) Autonomous System Number (ASN).
+* `certificateArn` - (Optional) The Amazon Resource Name (ARN) for the customer gateway certificate.
+* `deviceName` - (Optional) A name for the customer gateway device.
+* `ipAddress` - (Optional) The IPv4 address for the customer gateway device's outside interface.
+* `type` - (Required) The type of customer gateway. The only type AWS
+  supports at this time is "ipsec.1".
+* `tags` - (Optional) Tags to apply to the gateway. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The amazon-assigned ID of the gateway.
+* `arn` - The ARN of the customer gateway.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Customer Gateways using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Customer Gateways using the `id`. For example:
+
+```console
+% terraform import aws_customer_gateway.main cgw-b4dc3961
+```
+
+<!-- cache-key: cdktf-0.18.0 input-88fc55069a35af7318bebf35b35547af61fdd41a1afa9f74484f765b22315549 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/dataexchange_data_set.html.markdown b/website/docs/cdktf/typescript/r/dataexchange_data_set.html.markdown
new file mode 100644
index 00000000000..cff7db44bc6
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/dataexchange_data_set.html.markdown
@@ -0,0 +1,76 @@
+---
+subcategory: "Data Exchange"
+layout: "aws"
+page_title: "AWS: aws_dataexchange_data_set"
+description: |-
+  Provides a DataExchange DataSet
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_dataexchange_data_set
+
+Provides a resource to manage AWS Data Exchange DataSets.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataexchangeDataSet } from "./.gen/providers/aws/dataexchange-data-set";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataexchangeDataSet(this, "example", {
+      assetType: "S3_SNAPSHOT",
+      description: "example",
+      name: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `assetType` - (Required) The type of asset that is added to a data set. Valid values are: `s3Snapshot`, `redshiftDataShare`, and `apiGatewayApi`.
+* `description` - (Required) A description for the data set.
+* `name` - (Required) The name of the data set.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Id of the data set.
+* `arn` - The Amazon Resource Name of this data set.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DataExchange DataSets using their ARN. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import DataExchange DataSets using their ARN. For example:
+
+```console
+% terraform import aws_dataexchange_data_set.example arn:aws:dataexchange:us-west-2:123456789012:data-sets/4fa784c7-ccb4-4dbf-ba4f-02198320daa1
+```
+
+<!-- cache-key: cdktf-0.18.0 input-bcb32869378838571a8ae492463bc57c036b3f3e8528a58d44a0847e4f76852a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/dataexchange_revision.html.markdown b/website/docs/cdktf/typescript/r/dataexchange_revision.html.markdown
new file mode 100644
index 00000000000..94f8471ce88
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/dataexchange_revision.html.markdown
@@ -0,0 +1,74 @@
+---
+subcategory: "Data Exchange"
+layout: "aws"
+page_title: "AWS: aws_dataexchange_revision"
+description: |-
+  Provides a DataExchange Revision
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_dataexchange_revision
+
+Provides a resource to manage AWS Data Exchange Revisions.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataexchangeRevision } from "./.gen/providers/aws/dataexchange-revision";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DataexchangeRevision(this, "example", {
+      dataSetId: Token.asString(awsDataexchangeDataSetExample.id),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `dataSetId` - (Required) The dataset id.
+* `comment` - (Required) An optional comment about the revision.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Id of the data set.
+* `revisionId` - The Id of the revision.
+* `arn` - The Amazon Resource Name of this data set.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DataExchange Revisions using their `dataSetId:revisionId`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import DataExchange Revisions using their `dataSetId:revisionId`. For example:
+
+```console
+% terraform import aws_dataexchange_revision.example 4fa784c7-ccb4-4dbf-ba4f-02198320daa1:4fa784c7-ccb4-4dbf-ba4f-02198320daa1
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1dff294cf3af4fd0944cbd190d7f06ffbbea96e953f96933b6e5b54e4c8fdcd1 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/datapipeline_pipeline.html.markdown b/website/docs/cdktf/typescript/r/datapipeline_pipeline.html.markdown
new file mode 100644
index 00000000000..b09d82b40ce
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/datapipeline_pipeline.html.markdown
@@ -0,0 +1,74 @@
+---
+subcategory: "Data Pipeline"
+layout: "aws"
+page_title: "AWS: aws_datapipeline_pipeline"
+description: |-
+  Provides a AWS DataPipeline Pipeline.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_datapipeline_pipeline
+
+Provides a DataPipeline Pipeline resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DatapipelinePipeline } from "./.gen/providers/aws/datapipeline-pipeline";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DatapipelinePipeline(this, "default", {
+      name: "tf-pipeline-default",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of Pipeline.
+* `description` - (Optional) The description of Pipeline.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The identifier of the client certificate.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsDatapipelinePipeline` using the id (Pipeline ID). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsDatapipelinePipeline` using the id (Pipeline ID). For example:
+
+```console
+% terraform import aws_datapipeline_pipeline.default df-1234567890
+```
+
+<!-- cache-key: cdktf-0.18.0 input-900f2070a2090481270a42e79665c28c006980d650e7abfe29339b39fbd3a425 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/datapipeline_pipeline_definition.html.markdown b/website/docs/cdktf/typescript/r/datapipeline_pipeline_definition.html.markdown
new file mode 100644
index 00000000000..d65f3aede58
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/datapipeline_pipeline_definition.html.markdown
@@ -0,0 +1,164 @@
+---
+subcategory: "Data Pipeline"
+layout: "aws"
+page_title: "AWS: aws_datapipeline_pipeline_definition"
+description: |-
+  Provides a DataPipeline Definition.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_datapipeline_pipeline_definition
+
+Provides a DataPipeline Pipeline Definition resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DatapipelinePipeline } from "./.gen/providers/aws/datapipeline-pipeline";
+import { DatapipelinePipelineDefinition } from "./.gen/providers/aws/datapipeline-pipeline-definition";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const defaultVar = new DatapipelinePipeline(this, "default", {
+      name: "tf-pipeline-default",
+    });
+    new DatapipelinePipelineDefinition(this, "example", {
+      pipelineId: defaultVar.id,
+      pipelineObject: [
+        {
+          field: [
+            {
+              key: "workerGroup",
+              stringValue: "workerGroup",
+            },
+          ],
+          id: "Default",
+          name: "Default",
+        },
+        {
+          field: [
+            {
+              key: "startDateTime",
+              stringValue: "2012-12-12T00:00:00",
+            },
+            {
+              key: "type",
+              stringValue: "Schedule",
+            },
+            {
+              key: "period",
+              stringValue: "1 hour",
+            },
+            {
+              key: "endDateTime",
+              stringValue: "2012-12-21T18:00:00",
+            },
+          ],
+          id: "Schedule",
+          name: "Schedule",
+        },
+        {
+          field: [
+            {
+              key: "type",
+              stringValue: "ShellCommandActivity",
+            },
+            {
+              key: "command",
+              stringValue: "echo hello",
+            },
+            {
+              key: "parent",
+              stringValue: "Default",
+            },
+            {
+              key: "schedule",
+              stringValue: "Schedule",
+            },
+          ],
+          id: "SayHello",
+          name: "SayHello",
+        },
+      ],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `pipelineId` - (Required) ID of the pipeline.
+* `pipelineObject` - (Required) Configuration block for the objects that define the pipeline. See below
+
+The following arguments are optional:
+
+* `parameterObject` - (Optional) Configuration block for the parameter objects used in the pipeline definition. See below
+* `parameterValue` - (Optional) Configuration block for the parameter values used in the pipeline definition. See below
+
+### `pipelineObject`
+
+* `field` - (Required) Configuration block for Key-value pairs that define the properties of the object. See below
+* `id` - (Required) ID of the object.
+* `name` - (Required) ARN of the storage connector.
+
+### `field`
+
+* `key` - (Required) Field identifier.
+* `refValue` - (Optional) Field value, expressed as the identifier of another object
+* `stringValue` - (Optional) Field value, expressed as a String.
+
+### `parameterObject`
+
+* `attribute` - (Required) Configuration block for attributes of the parameter object. See below
+* `id` - (Required) ID of the parameter object.
+
+### `attribute`
+
+* `key` - (Required) Field identifier.
+* `stringValue` - (Required) Field value, expressed as a String.
+
+### `parameterValue`
+
+* `id` - (Required) ID of the parameter value.
+* `stringValue` - (Required) Field value, expressed as a String.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Unique ID of the datapipeline definition.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsDatapipelinePipelineDefinition` using the id. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsDatapipelinePipelineDefinition` using the id. For example:
+
+```console
+% terraform import aws_datapipeline_pipeline_definition.example df-1234567890
+```
+
+<!-- cache-key: cdktf-0.18.0 input-513fb767241e4c9deb0e2e131aa76eae7629b4160098b9555deea889ccb98bd7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/datasync_agent.html.markdown b/website/docs/cdktf/typescript/r/datasync_agent.html.markdown
new file mode 100644
index 00000000000..0880038732b
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/datasync_agent.html.markdown
@@ -0,0 +1,142 @@
+---
+subcategory: "DataSync"
+layout: "aws"
+page_title: "AWS: aws_datasync_agent"
+description: |-
+  Manages an AWS DataSync Agent in the provider region
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_datasync_agent
+
+Manages an AWS DataSync Agent deployed on premises.
+
+~> **NOTE:** One of `activationKey` or `ipAddress` must be provided for resource creation (agent activation). Neither is required for resource import. If using `ipAddress`, Terraform must be able to make an HTTP (port 80) GET request to the specified IP address from where it is running. The agent will turn off that HTTP server after activation.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DatasyncAgent } from "./.gen/providers/aws/datasync-agent";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DatasyncAgent(this, "example", {
+      ipAddress: "1.2.3.4",
+      name: "example",
+    });
+  }
+}
+
+```
+
+## Example Usage with VPC Endpoints
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, Fn, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsNetworkInterface } from "./.gen/providers/aws/data-aws-network-interface";
+import { DataAwsRegion } from "./.gen/providers/aws/data-aws-region";
+import { DatasyncAgent } from "./.gen/providers/aws/datasync-agent";
+import { VpcEndpoint } from "./.gen/providers/aws/vpc-endpoint";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const current = new DataAwsRegion(this, "current", {});
+    const example = new VpcEndpoint(this, "example", {
+      securityGroupIds: [Token.asString(awsSecurityGroupExample.id)],
+      serviceName: "com.amazonaws.${" + current.name + "}.datasync",
+      subnetIds: [Token.asString(awsSubnetExample.id)],
+      vpcEndpointType: "Interface",
+      vpcId: Token.asString(awsVpcExample.id),
+    });
+    const dataAwsNetworkInterfaceExample = new DataAwsNetworkInterface(
+      this,
+      "example_2",
+      {
+        id: Token.asString(
+          Fn.lookupNested(Fn.tolist(example.networkInterfaceIds), ["0"])
+        ),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsNetworkInterfaceExample.overrideLogicalId("example");
+    const awsDatasyncAgentExample = new DatasyncAgent(this, "example_3", {
+      ipAddress: "1.2.3.4",
+      name: "example",
+      privateLinkEndpoint: Token.asString(
+        dataAwsNetworkInterfaceExample.privateIp
+      ),
+      securityGroupArns: [Token.asString(awsSecurityGroupExample.arn)],
+      subnetArns: [Token.asString(awsSubnetExample.arn)],
+      vpcEndpointId: example.id,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsDatasyncAgentExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) Name of the DataSync Agent.
+* `activationKey` - (Optional) DataSync Agent activation key during resource creation. Conflicts with `ipAddress`. If an `ipAddress` is provided instead, Terraform will retrieve the `activationKey` as part of the resource creation.
+* `ipAddress` - (Optional) DataSync Agent IP address to retrieve activation key during resource creation. Conflicts with `activationKey`. DataSync Agent must be accessible on port 80 from where Terraform is running.
+* `privateLinkEndpoint` - (Optional) The IP address of the VPC endpoint the agent should connect to when retrieving an activation key during resource creation. Conflicts with `activationKey`.
+* `securityGroupArns` - (Optional) The ARNs of the security groups used to protect your data transfer task subnets.
+* `subnetArns` - (Optional) The Amazon Resource Names (ARNs) of the subnets in which DataSync will create elastic network interfaces for each data transfer task.
+* `tags` - (Optional) Key-value pairs of resource tags to assign to the DataSync Agent. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `vpcEndpointId` - (Optional) The ID of the VPC (virtual private cloud) endpoint that the agent has access to.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Amazon Resource Name (ARN) of the DataSync Agent.
+* `arn` - Amazon Resource Name (ARN) of the DataSync Agent.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `10M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsDatasyncAgent` using the DataSync Agent Amazon Resource Name (ARN). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsDatasyncAgent` using the DataSync Agent Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_datasync_agent.example arn:aws:datasync:us-east-1:123456789012:agent/agent-12345678901234567
+```
+
+<!-- cache-key: cdktf-0.18.0 input-0acba5dd129383087553f49e6f95af67ac05fa502cb2be0e9157f77f225a5cfa -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/datasync_location_azure_blob.html.markdown b/website/docs/cdktf/typescript/r/datasync_location_azure_blob.html.markdown
new file mode 100644
index 00000000000..441348263cc
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/datasync_location_azure_blob.html.markdown
@@ -0,0 +1,91 @@
+---
+subcategory: "DataSync"
+layout: "aws"
+page_title: "AWS: aws_datasync_location_azure_blob"
+description: |-
+  Manages an AWS DataSync Microsoft Azure Blob Storage Location
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_datasync_location_azure_blob
+
+Manages a Microsoft Azure Blob Storage Location within AWS DataSync.
+
+~> **NOTE:** The DataSync Agents must be available before creating this resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DatasyncLocationAzureBlob } from "./.gen/providers/aws/datasync-location-azure-blob";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DatasyncLocationAzureBlob(this, "example", {
+      agentArns: [Token.asString(awsDatasyncAgentExample.arn)],
+      authenticationType: "SAS",
+      containerUrl: "https://example.com/path",
+      sasConfiguration: {
+        token:
+          "sp=r&st=2023-12-20T14:54:52Z&se=2023-12-20T22:54:52Z&spr=https&sv=2021-06-08&sr=c&sig=aBBKDWQvyuVcTPH9EBp%2FXTI9E%2F%2Fmq171%2BZU178wcwqU%3D",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `accessTier` - (Optional) The access tier that you want your objects or files transferred into. Valid values: `hot`, `cool` and `archive`. Default: `hot`.
+* `agentArns` - (Required) A list of DataSync Agent ARNs with which this location will be associated.
+* `authenticationType` - (Required) The authentication method DataSync uses to access your Azure Blob Storage. Valid values: `sas`.
+* `blobType` - (Optional) The type of blob that you want your objects or files to be when transferring them into Azure Blob Storage. Valid values: `blob`. Default: `blob`.
+* `containerUrl` - (Required) The URL of the Azure Blob Storage container involved in your transfer.
+* `sasConfiguration` - (Optional) The SAS configuration that allows DataSync to access your Azure Blob Storage. See configuration below.
+* `subdirectory` - (Optional) Path segments if you want to limit your transfer to a virtual directory in the container.
+* `tags` - (Optional) Key-value pairs of resource tags to assign to the DataSync Location. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### sas_configuration Argument Reference
+
+* `token` - (Required) A SAS token that provides permissions to access your Azure Blob Storage.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the DataSync Location.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsDatasyncLocationAzureBlob` using the Amazon Resource Name (ARN). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsDatasyncLocationAzureBlob` using the Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_datasync_location_azure_blob.example arn:aws:datasync:us-east-1:123456789012:location/loc-12345678901234567
+```
+
+<!-- cache-key: cdktf-0.18.0 input-edba47394ea99b575175b683fe5ef747a098ab29d4224c1d53d79c12b0a9eadd -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/datasync_location_efs.html.markdown b/website/docs/cdktf/typescript/r/datasync_location_efs.html.markdown
new file mode 100644
index 00000000000..48fea2c440a
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/datasync_location_efs.html.markdown
@@ -0,0 +1,92 @@
+---
+subcategory: "DataSync"
+layout: "aws"
+page_title: "AWS: aws_datasync_location_efs"
+description: |-
+  Manages an EFS Location within AWS DataSync.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_datasync_location_efs
+
+Manages an AWS DataSync EFS Location.
+
+~> **NOTE:** The EFS File System must have a mounted EFS Mount Target before creating this resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DatasyncLocationEfs } from "./.gen/providers/aws/datasync-location-efs";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DatasyncLocationEfs(this, "example", {
+      ec2Config: {
+        securityGroupArns: [Token.asString(awsSecurityGroupExample.arn)],
+        subnetArn: Token.asString(awsSubnetExample.arn),
+      },
+      efsFileSystemArn: Token.asString(awsEfsMountTargetExample.fileSystemArn),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `accessPointArn` - (Optional) Specifies the Amazon Resource Name (ARN) of the access point that DataSync uses to access the Amazon EFS file system.
+* `ec2Config` - (Required) Configuration block containing EC2 configurations for connecting to the EFS File System.
+* `efsFileSystemArn` - (Required) Amazon Resource Name (ARN) of EFS File System.
+* `fileSystemAccessRoleArn` - (Optional)  Specifies an Identity and Access Management (IAM) role that DataSync assumes when mounting the Amazon EFS file system.
+* `inTransitEncryption` - (Optional) Specifies whether you want DataSync to use TLS encryption when transferring data to or from your Amazon EFS file system. Valid values are `none` and `tls12`.
+* `subdirectory` - (Optional) Subdirectory to perform actions as source or destination. Default `/`.
+* `tags` - (Optional) Key-value pairs of resource tags to assign to the DataSync Location. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### ec2_config Argument Reference
+
+The `ec2Config` configuration block supports the following arguments:
+
+* `securityGroupArns` - (Required) List of Amazon Resource Names (ARNs) of the EC2 Security Groups that are associated with the EFS Mount Target.
+* `subnetArn` - (Required) Amazon Resource Name (ARN) of the EC2 Subnet that is associated with the EFS Mount Target.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Amazon Resource Name (ARN) of the DataSync Location.
+* `arn` - Amazon Resource Name (ARN) of the DataSync Location.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsDatasyncLocationEfs` using the DataSync Task Amazon Resource Name (ARN). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsDatasyncLocationEfs` using the DataSync Task Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_datasync_location_efs.example arn:aws:datasync:us-east-1:123456789012:location/loc-12345678901234567
+```
+
+<!-- cache-key: cdktf-0.18.0 input-fd6bfd5001bb7a9ddd15cbeb18b63b36796ee1633c2d3e03d32a2391d872d1d1 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/datasync_location_fsx_lustre_file_system.html.markdown b/website/docs/cdktf/typescript/r/datasync_location_fsx_lustre_file_system.html.markdown
new file mode 100644
index 00000000000..4feac563ac3
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/datasync_location_fsx_lustre_file_system.html.markdown
@@ -0,0 +1,79 @@
+---
+subcategory: "DataSync"
+layout: "aws"
+page_title: "AWS: aws_datasync_location_fsx_lustre_file_system"
+description: |-
+  Manages an FSx Lustre Location within AWS DataSync.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_datasync_location_fsx_lustre_file_system
+
+Manages an AWS DataSync FSx Lustre Location.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DatasyncLocationFsxLustreFileSystem } from "./.gen/providers/aws/datasync-location-fsx-lustre-file-system";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DatasyncLocationFsxLustreFileSystem(this, "example", {
+      fsxFilesystemArn: Token.asString(awsFsxLustreFileSystemExample.arn),
+      securityGroupArns: [Token.asString(awsSecurityGroupExample.arn)],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `fsxFilesystemArn` - (Required) The Amazon Resource Name (ARN) for the FSx for Lustre file system.
+* `securityGroupArns` - (Optional) The Amazon Resource Names (ARNs) of the security groups that are to use to configure the FSx for Lustre file system.
+* `subdirectory` - (Optional) Subdirectory to perform actions as source or destination.
+* `tags` - (Optional) Key-value pairs of resource tags to assign to the DataSync Location. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Amazon Resource Name (ARN) of the DataSync Location.
+* `arn` - Amazon Resource Name (ARN) of the DataSync Location.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `uri` - The URL of the FSx for Lustre location that was described.
+* `creationTime` - The time that the FSx for Lustre location was created.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsDatasyncLocationFsxLustreFileSystem` using the `dataSyncArn#fSxLustreArn`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsDatasyncLocationFsxLustreFileSystem` using the `dataSyncArn#fSxLustreArn`. For example:
+
+```console
+% terraform import aws_datasync_location_fsx_lustre_file_system.example arn:aws:datasync:us-west-2:123456789012:location/loc-12345678901234567#arn:aws:fsx:us-west-2:476956259333:file-system/fs-08e04cd442c1bb94a
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ff1125dfd4d4a7819d78cada4fa2e6a9cacc0dbd81f2b217268a7544a6a5415d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/datasync_location_fsx_ontap_file_system.html.markdown b/website/docs/cdktf/typescript/r/datasync_location_fsx_ontap_file_system.html.markdown
new file mode 100644
index 00000000000..82a24b56e60
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/datasync_location_fsx_ontap_file_system.html.markdown
@@ -0,0 +1,119 @@
+---
+subcategory: "DataSync"
+layout: "aws"
+page_title: "AWS: aws_datasync_location_fsx_ontap_file_system"
+description: |-
+  Terraform resource for managing an AWS DataSync Location FSx Ontap File System.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_datasync_location_fsx_ontap_file_system
+
+Terraform resource for managing an AWS DataSync Location FSx Ontap File System.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DatasyncLocationFsxOntapFileSystem } from "./.gen/providers/aws/datasync-location-fsx-ontap-file-system";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DatasyncLocationFsxOntapFileSystem(this, "test", {
+      fsxFilesystemArn: Token.asString(awsFsxOntapFileSystemTest.arn),
+      protocol: {
+        nfs: {
+          mountOptions: {
+            version: "NFS3",
+          },
+        },
+      },
+      securityGroupArns: [Token.asString(awsSecurityGroupTest.arn)],
+      storageVirtualMachineArn: Token.asString(
+        awsFsxOntapStorageVirtualMachineTest.arn
+      ),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `protocol` - (Required) The data transfer protocol that DataSync uses to access your Amazon FSx file system. See [Protocol](#protocol) below.
+* `securityGroupArns` - (Required) The security groups that provide access to your file system's preferred subnet. The security groups must allow outbbound traffic on the following ports (depending on the protocol you use):
+    * Network File System (NFS): TCP ports 111, 635, and 2049
+    * Server Message Block (SMB): TCP port 445
+* `storageVirtualMachineArn` - (Required) The ARN of the SVM in your file system where you want to copy data to of from.
+
+The following arguments are optional:
+
+* `subdirectory` - (Optional) Path to the file share in the SVM where you'll copy your data. You can specify a junction path (also known as a mount point), qtree path (for NFS file shares), or share name (for SMB file shares) (e.g. `/vol1`, `/vol1/tree1`, `share1`).
+* `tags` - (Optional) Key-value pairs of resource tags to assign to the DataSync Location. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Protocol
+
+* `nfs` - Network File System (NFS) protocol that DataSync uses to access your FSx ONTAP file system. See [NFS](#nfs) below.
+* `smb` - Server Message Block (SMB) protocol that DataSync uses to access your FSx ONTAP file system. See [SMB] (#smb) below.
+
+### NFS
+
+* `mountOptions` - (Required) Mount options that are available for DataSync to access an NFS location. See [NFS Mount Options](#nfs-mount-options) below.
+
+### NFS Mount Options
+
+* `version` - (Optional) The specific NFS version that you want DataSync to use for mounting your NFS share. Valid values: `nfs3`. Default: `nfs3`
+
+### SMB
+
+* `domain` - Fully qualified domain name of the Microsoft Active Directory (AD) that your storage virtual machine belongs to.
+* `mountOptions` - Mount options that are available for DataSync to access an SMB location. See [SMB Mount Options](#smb-mount-options) below.
+* `password` - Password of a user who has permission to access your SVM.
+* `user` - Username that can mount the location and access the files, folders, and metadata that you need in the SVM.
+
+### SMB Mount Options
+
+* `version` - (Optional) SMB version that you want DataSync to use for mounting your SMB share. Valid values: `automatic`, `smb3`, `smb2` `smb20`. Default: `automatic`
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the DataSync Location for the FSx Ontap File System.
+* `fsxFilesystemArn` - ARN of the FSx Ontap File System.
+* `uri` - URI of the FSx ONTAP file system location
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsDatasyncLocationFsxOntapFileSystem` using the `dataSyncArn#fSxOntapSvmArn`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsDatasyncLocationFsxOntapFileSystem` using the `dataSyncArn#fSxOntapSvmArn`. For example:
+
+```console
+% terraform import aws_datasync_location_fsx_ontap_file_system.example arn:aws:datasync:us-west-2:123456789012:location/loc-12345678901234567#arn:aws:fsx:us-west-2:123456789012:storage-virtual-machine/svm-12345678abcdef123
+```
+
+<!-- cache-key: cdktf-0.18.0 input-fdb2898abac9131a1e6f0aedf0c516dba5a11e0930534026410c35d320db2ff2 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/datasync_location_fsx_openzfs_file_system.html.markdown b/website/docs/cdktf/typescript/r/datasync_location_fsx_openzfs_file_system.html.markdown
new file mode 100644
index 00000000000..bf493e1d8c0
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/datasync_location_fsx_openzfs_file_system.html.markdown
@@ -0,0 +1,99 @@
+---
+subcategory: "DataSync"
+layout: "aws"
+page_title: "AWS: aws_datasync_location_fsx_openzfs_file_system"
+description: |-
+  Manages an FSx OpenZfs Location within AWS DataSync.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_datasync_location_fsx_openzfs_file_system
+
+Manages an AWS DataSync FSx OpenZfs Location.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DatasyncLocationFsxOpenzfsFileSystem } from "./.gen/providers/aws/datasync-location-fsx-openzfs-file-system";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DatasyncLocationFsxOpenzfsFileSystem(this, "example", {
+      fsxFilesystemArn: Token.asString(awsFsxOpenzfsFileSystemExample.arn),
+      protocol: {
+        nfs: {
+          mountOptions: {
+            version: "AUTOMATIC",
+          },
+        },
+      },
+      securityGroupArns: [Token.asString(awsSecurityGroupExample.arn)],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `fsxFilesystemArn` - (Required) The Amazon Resource Name (ARN) for the FSx for OpenZfs file system.
+* `protocol` - (Required) The type of protocol that DataSync uses to access your file system. See below.
+* `securityGroupArns` - (Optional) The Amazon Resource Names (ARNs) of the security groups that are to use to configure the FSx for openzfs file system.
+* `subdirectory` - (Optional) Subdirectory to perform actions as source or destination. Must start with `/fsx`.
+* `tags` - (Optional) Key-value pairs of resource tags to assign to the DataSync Location. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### protocol
+
+* `nfs` - (Required) Represents the Network File System (NFS) protocol that DataSync uses to access your FSx for OpenZFS file system. See below.
+
+### nfs
+
+* `mountOptions` - (Required) Represents the mount options that are available for DataSync to access an NFS location. See below.
+
+### mount_options
+
+* `version` - (Optional) The specific NFS version that you want DataSync to use for mounting your NFS share. Valid values: `automatic`, `nfs3`, `nfs40` and `nfs41`. Default: `automatic`
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Amazon Resource Name (ARN) of the DataSync Location.
+* `arn` - Amazon Resource Name (ARN) of the DataSync Location.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `uri` - The URL of the FSx for openzfs location that was described.
+* `creationTime` - The time that the FSx for openzfs location was created.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsDatasyncLocationFsxOpenzfsFileSystem` using the `dataSyncArn#fSxOpenzfsArn`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsDatasyncLocationFsxOpenzfsFileSystem` using the `dataSyncArn#fSxOpenzfsArn`. For example:
+
+```console
+% terraform import aws_datasync_location_fsx_openzfs_file_system.example arn:aws:datasync:us-west-2:123456789012:location/loc-12345678901234567#arn:aws:fsx:us-west-2:123456789012:file-system/fs-08e04cd442c1bb94a
+```
+
+<!-- cache-key: cdktf-0.18.0 input-fd48fc85d580e2ffedd314108832541f3cf603267b4fbea2028c4f03fd9b3981 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/datasync_location_fsx_windows_file_system.html.markdown b/website/docs/cdktf/typescript/r/datasync_location_fsx_windows_file_system.html.markdown
new file mode 100644
index 00000000000..49513056e20
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/datasync_location_fsx_windows_file_system.html.markdown
@@ -0,0 +1,84 @@
+---
+subcategory: "DataSync"
+layout: "aws"
+page_title: "AWS: aws_datasync_location_fsx_windows_file_system"
+description: |-
+  Manages an FSx Windows Location within AWS DataSync.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_datasync_location_fsx_windows_file_system
+
+Manages an AWS DataSync FSx Windows Location.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DatasyncLocationFsxWindowsFileSystem } from "./.gen/providers/aws/datasync-location-fsx-windows-file-system";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DatasyncLocationFsxWindowsFileSystem(this, "example", {
+      fsxFilesystemArn: Token.asString(awsFsxWindowsFileSystemExample.arn),
+      password: "SuperSecretPassw0rd",
+      securityGroupArns: [Token.asString(awsSecurityGroupExample.arn)],
+      user: "SomeUser",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `fsxFilesystemArn` - (Required) The Amazon Resource Name (ARN) for the FSx for Windows file system.
+* `password` - (Required) The password of the user who has the permissions to access files and folders in the FSx for Windows file system.
+* `user` - (Required) The user who has the permissions to access files and folders in the FSx for Windows file system.
+* `domain` - (Optional) The name of the Windows domain that the FSx for Windows server belongs to.
+* `securityGroupArns` - (Optional) The Amazon Resource Names (ARNs) of the security groups that are to use to configure the FSx for Windows file system.
+* `subdirectory` - (Optional) Subdirectory to perform actions as source or destination.
+* `tags` - (Optional) Key-value pairs of resource tags to assign to the DataSync Location. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Amazon Resource Name (ARN) of the DataSync Location.
+* `arn` - Amazon Resource Name (ARN) of the DataSync Location.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `uri` - The URL of the FSx for Windows location that was described.
+* `creationTime` - The time that the FSx for Windows location was created.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsDatasyncLocationFsxWindowsFileSystem` using the `dataSyncArn#fSxWindowsArn`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsDatasyncLocationFsxWindowsFileSystem` using the `dataSyncArn#fSxWindowsArn`. For example:
+
+```console
+% terraform import aws_datasync_location_fsx_windows_file_system.example arn:aws:datasync:us-west-2:123456789012:location/loc-12345678901234567#arn:aws:fsx:us-west-2:476956259333:file-system/fs-08e04cd442c1bb94a
+```
+
+<!-- cache-key: cdktf-0.18.0 input-4eec17500a279969bf934f139b5e4af49e794bbe75e137b1fefca8b157890cbf -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/datasync_location_hdfs.html.markdown b/website/docs/cdktf/typescript/r/datasync_location_hdfs.html.markdown
new file mode 100644
index 00000000000..90810d78744
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/datasync_location_hdfs.html.markdown
@@ -0,0 +1,104 @@
+---
+subcategory: "DataSync"
+layout: "aws"
+page_title: "AWS: aws_datasync_location_hdfs"
+description: |-
+  Manages an AWS DataSync HDFS Location
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_datasync_location_hdfs
+
+Manages an HDFS Location within AWS DataSync.
+
+~> **NOTE:** The DataSync Agents must be available before creating this resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DatasyncLocationHdfs } from "./.gen/providers/aws/datasync-location-hdfs";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DatasyncLocationHdfs(this, "example", {
+      agentArns: [Token.asString(awsDatasyncAgentExample.arn)],
+      authenticationType: "SIMPLE",
+      nameNode: [
+        {
+          hostname: Token.asString(awsInstanceExample.privateDns),
+          port: 80,
+        },
+      ],
+      simpleUser: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `agentArns` - (Required) A list of DataSync Agent ARNs with which this location will be associated.
+* `authenticationType` - (Required) The type of authentication used to determine the identity of the user. Valid values are `simple` and `kerberos`.
+* `nameNode` - (Required)  The NameNode that manages the HDFS namespace. The NameNode performs operations such as opening, closing, and renaming files and directories. The NameNode contains the information to map blocks of data to the DataNodes. You can use only one NameNode. See configuration below.
+* `simpleUser` - (Optional) The user name used to identify the client on the host operating system. If `simple` is specified for `authenticationType`, this parameter is required.
+* `blockSize` - (Optional) The size of data blocks to write into the HDFS cluster. The block size must be a multiple of 512 bytes. The default block size is 128 mebibytes (MiB).
+* `replicationFactor` - (Optional) The number of DataNodes to replicate the data to when writing to the HDFS cluster. By default, data is replicated to three DataNodes.
+* `kerberosKeytab` - (Optional) The Kerberos key table (keytab) that contains mappings between the defined Kerberos principal and the encrypted keys. If `kerberos` is specified for `authenticationType`, this parameter is required.
+* `kerberosKrb5Conf` - (Optional) The krb5.conf file that contains the Kerberos configuration information. If `kerberos` is specified for `authenticationType`, this parameter is required.
+* `kerberosPrincipal` - (Optional) The Kerberos principal with access to the files and folders on the HDFS cluster. If `kerberos` is specified for `authenticationType`, this parameter is required.
+* `kmsKeyProviderUri` - (Optional) The URI of the HDFS cluster's Key Management Server (KMS).
+* `qopConfiguration` - (Optional) The Quality of Protection (QOP) configuration specifies the Remote Procedure Call (RPC) and data transfer protection settings configured on the Hadoop Distributed File System (HDFS) cluster. If `qopConfiguration` isn't specified, `rpcProtection` and `dataTransferProtection` default to `privacy`. If you set RpcProtection or DataTransferProtection, the other parameter assumes the same value.  See configuration below.
+* `subdirectory` - (Optional) A subdirectory in the HDFS cluster. This subdirectory is used to read data from or write data to the HDFS cluster. If the subdirectory isn't specified, it will default to /.
+* `tags` - (Optional) Key-value pairs of resource tags to assign to the DataSync Location. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### name_node Argument Reference
+
+* `hostname` - (Required) The hostname of the NameNode in the HDFS cluster. This value is the IP address or Domain Name Service (DNS) name of the NameNode. An agent that's installed on-premises uses this hostname to communicate with the NameNode in the network.
+* `port` - (Required) The port that the NameNode uses to listen to client requests.
+
+### qop_configuration Argument Reference
+
+* `dataTransferProtection` - (Optional) The data transfer protection setting configured on the HDFS cluster. This setting corresponds to your dfs.data.transfer.protection setting in the hdfs-site.xml file on your Hadoop cluster. Valid values are `disabled`, `authentication`, `integrity` and `privacy`.
+* `rpcProtection` - (Optional)The RPC protection setting configured on the HDFS cluster. This setting corresponds to your hadoop.rpc.protection setting in your core-site.xml file on your Hadoop cluster. Valid values are `disabled`, `authentication`, `integrity` and `privacy`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the DataSync Location.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsDatasyncLocationHdfs` using the Amazon Resource Name (ARN). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsDatasyncLocationHdfs` using the Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_datasync_location_hdfs.example arn:aws:datasync:us-east-1:123456789012:location/loc-12345678901234567
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1cc985ade5113195ca4aacb6777a856e91fc3b85034c6177aac61b5f398194ec -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/datasync_location_nfs.html.markdown b/website/docs/cdktf/typescript/r/datasync_location_nfs.html.markdown
new file mode 100644
index 00000000000..8e761b56996
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/datasync_location_nfs.html.markdown
@@ -0,0 +1,95 @@
+---
+subcategory: "DataSync"
+layout: "aws"
+page_title: "AWS: aws_datasync_location_nfs"
+description: |-
+  Manages an AWS DataSync NFS Location
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_datasync_location_nfs
+
+Manages an NFS Location within AWS DataSync.
+
+~> **NOTE:** The DataSync Agents must be available before creating this resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DatasyncLocationNfs } from "./.gen/providers/aws/datasync-location-nfs";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DatasyncLocationNfs(this, "example", {
+      onPremConfig: {
+        agentArns: [Token.asString(awsDatasyncAgentExample.arn)],
+      },
+      serverHostname: "nfs.example.com",
+      subdirectory: "/exported/path",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `mountOptions` - (Optional) Configuration block containing mount options used by DataSync to access the NFS Server.
+* `onPremConfig` - (Required) Configuration block containing information for connecting to the NFS File System.
+* `serverHostname` - (Required) Specifies the IP address or DNS name of the NFS server. The DataSync Agent(s) use this to mount the NFS server.
+* `subdirectory` - (Required) Subdirectory to perform actions as source or destination. Should be exported by the NFS server.
+* `tags` - (Optional) Key-value pairs of resource tags to assign to the DataSync Location. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### mount_options Argument Reference
+
+The `mountOptions` configuration block supports the following arguments:
+
+* `version` - (Optional) The specific NFS version that you want DataSync to use for mounting your NFS share. Valid values: `automatic`, `nfs3`, `nfs40` and `nfs41`. Default: `automatic`
+
+### on_prem_config Argument Reference
+
+The `onPremConfig` configuration block supports the following arguments:
+
+* `agentArns` - (Required) List of Amazon Resource Names (ARNs) of the DataSync Agents used to connect to the NFS server.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Amazon Resource Name (ARN) of the DataSync Location.
+* `arn` - Amazon Resource Name (ARN) of the DataSync Location.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsDatasyncLocationNfs` using the DataSync Task Amazon Resource Name (ARN). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsDatasyncLocationNfs` using the DataSync Task Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_datasync_location_nfs.example arn:aws:datasync:us-east-1:123456789012:location/loc-12345678901234567
+```
+
+<!-- cache-key: cdktf-0.18.0 input-cb00fc82fb27ed23545aa2a14e593899a6887ce57ca2c5b408cf2933841b79e3 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/datasync_location_object_storage.html.markdown b/website/docs/cdktf/typescript/r/datasync_location_object_storage.html.markdown
new file mode 100644
index 00000000000..234efcc465e
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/datasync_location_object_storage.html.markdown
@@ -0,0 +1,86 @@
+---
+subcategory: "DataSync"
+layout: "aws"
+page_title: "AWS: aws_datasync_location_object_storage"
+description: |-
+  Manages an AWS DataSync Object Storage Location
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_datasync_location_object_storage
+
+Manages a Object Storage Location within AWS DataSync.
+
+~> **NOTE:** The DataSync Agents must be available before creating this resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DatasyncLocationObjectStorage } from "./.gen/providers/aws/datasync-location-object-storage";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DatasyncLocationObjectStorage(this, "example", {
+      agentArns: [Token.asString(awsDatasyncAgentExample.arn)],
+      bucketName: "example",
+      serverHostname: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `agentArns` - (Required) A list of DataSync Agent ARNs with which this location will be associated.
+* `accessKey` - (Optional) The access key is used if credentials are required to access the self-managed object storage server. If your object storage requires a user name and password to authenticate, use `accessKey` and `secretKey` to provide the user name and password, respectively.
+* `bucketName` - (Required) The bucket on the self-managed object storage server that is used to read data from.
+* `secretKey` - (Optional) The secret key is used if credentials are required to access the self-managed object storage server. If your object storage requires a user name and password to authenticate, use `accessKey` and `secretKey` to provide the user name and password, respectively.
+* `serverCertificate` - (Optional) Specifies a certificate to authenticate with an object storage system that uses a private or self-signed certificate authority (CA). You must specify a Base64-encoded .pem string. The certificate can be up to 32768 bytes (before Base64 encoding).
+* `serverHostname` - (Required) The name of the self-managed object storage server. This value is the IP address or Domain Name Service (DNS) name of the object storage server. An agent uses this host name to mount the object storage server in a network.
+* `serverProtocol` - (Optional) The protocol that the object storage server uses to communicate. Valid values are `http` or `https`.
+* `serverPort` - (Optional) The port that your self-managed object storage server accepts inbound network traffic on. The server port is set by default to TCP 80 (`http`) or TCP 443 (`https`). You can specify a custom port if your self-managed object storage server requires one.
+* `subdirectory` - (Optional) A subdirectory in the HDFS cluster. This subdirectory is used to read data from or write data to the HDFS cluster. If the subdirectory isn't specified, it will default to /.
+* `tags` - (Optional) Key-value pairs of resource tags to assign to the DataSync Location. If configured with a provider [`defaultTags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the DataSync Location.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block).
+* `uri` - The URL of the Object Storage location that was described.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsDatasyncLocationObjectStorage` using the Amazon Resource Name (ARN). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsDatasyncLocationObjectStorage` using the Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_datasync_location_object_storage.example arn:aws:datasync:us-east-1:123456789012:location/loc-12345678901234567
+```
+
+<!-- cache-key: cdktf-0.18.0 input-aa5f076525dfa611768eccf07161cc0a0de01894b1d5fb99e88d9b4c0d6109a2 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/datasync_location_s3.html.markdown b/website/docs/cdktf/typescript/r/datasync_location_s3.html.markdown
new file mode 100644
index 00000000000..dc895932026
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/datasync_location_s3.html.markdown
@@ -0,0 +1,88 @@
+---
+subcategory: "DataSync"
+layout: "aws"
+page_title: "AWS: aws_datasync_location_s3"
+description: |-
+  Manages an AWS DataSync S3 Location
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_datasync_location_s3
+
+Manages an S3 Location within AWS DataSync.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DatasyncLocationS3 } from "./.gen/providers/aws/datasync-location-s3";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DatasyncLocationS3(this, "example", {
+      s3BucketArn: Token.asString(awsS3BucketExample.arn),
+      s3Config: {
+        bucketAccessRoleArn: Token.asString(awsIamRoleExample.arn),
+      },
+      subdirectory: "/example/prefix",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `agentArns` - (Optional) A list of DataSync Agent ARNs with which this location will be associated.
+* `s3BucketArn` - (Required) Amazon Resource Name (ARN) of the S3 Bucket.
+* `s3Config` - (Required) Configuration block containing information for connecting to S3.
+* `s3StorageClass` - (Optional) The Amazon S3 storage class that you want to store your files in when this location is used as a task destination. [Valid values](https://docs.aws.amazon.com/datasync/latest/userguide/create-s3-location.html#using-storage-classes)  
+* `subdirectory` - (Required) Prefix to perform actions as source or destination.
+* `tags` - (Optional) Key-value pairs of resource tags to assign to the DataSync Location. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### s3_config Argument Reference
+
+The `s3Config` configuration block supports the following arguments:
+
+* `bucketAccessRoleArn` - (Required) ARN of the IAM Role used to connect to the S3 Bucket.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Amazon Resource Name (ARN) of the DataSync Location.
+* `arn` - Amazon Resource Name (ARN) of the DataSync Location.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsDatasyncLocationS3` using the DataSync Task Amazon Resource Name (ARN). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsDatasyncLocationS3` using the DataSync Task Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_datasync_location_s3.example arn:aws:datasync:us-east-1:123456789012:location/loc-12345678901234567
+```
+
+<!-- cache-key: cdktf-0.18.0 input-667c050457c227762c7f8b9400f09ce49e704686c477993bb241f2426bbb2497 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/datasync_location_smb.html.markdown b/website/docs/cdktf/typescript/r/datasync_location_smb.html.markdown
new file mode 100644
index 00000000000..96a8a3a82f9
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/datasync_location_smb.html.markdown
@@ -0,0 +1,91 @@
+---
+subcategory: "DataSync"
+layout: "aws"
+page_title: "AWS: aws_datasync_location_smb"
+description: |-
+  Manages an AWS DataSync SMB Location
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_datasync_location_smb
+
+Manages a SMB Location within AWS DataSync.
+
+~> **NOTE:** The DataSync Agents must be available before creating this resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DatasyncLocationSmb } from "./.gen/providers/aws/datasync-location-smb";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DatasyncLocationSmb(this, "example", {
+      agentArns: [Token.asString(awsDatasyncAgentExample.arn)],
+      password: "ANotGreatPassword",
+      serverHostname: "smb.example.com",
+      subdirectory: "/exported/path",
+      user: "Guest",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `agentArns` - (Required) A list of DataSync Agent ARNs with which this location will be associated.
+* `domain` - (Optional) The name of the Windows domain the SMB server belongs to.
+* `mountOptions` - (Optional) Configuration block containing mount options used by DataSync to access the SMB Server. Can be `automatic`, `smb2`, or `smb3`.
+* `password` - (Required) The password of the user who can mount the share and has file permissions in the SMB.
+* `serverHostname` - (Required) Specifies the IP address or DNS name of the SMB server. The DataSync Agent(s) use this to mount the SMB share.
+* `subdirectory` - (Required) Subdirectory to perform actions as source or destination. Should be exported by the NFS server.
+* `tags` - (Optional) Key-value pairs of resource tags to assign to the DataSync Location. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `user` - (Required) The user who can mount the share and has file and folder permissions in the SMB share.
+
+### mount_options Argument Reference
+
+The `mountOptions` configuration block supports the following arguments:
+
+* `version` - (Optional) The specific SMB version that you want DataSync to use for mounting your SMB share. Valid values: `automatic`, `smb2`, and `smb3`. Default: `automatic`
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the DataSync Location.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsDatasyncLocationSmb` using the Amazon Resource Name (ARN). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsDatasyncLocationSmb` using the Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_datasync_location_smb.example arn:aws:datasync:us-east-1:123456789012:location/loc-12345678901234567
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ef64a786032b1bd4736b717fcbb2fa2b4849fff365db36c6537de225840acb5d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/datasync_task.html.markdown b/website/docs/cdktf/typescript/r/datasync_task.html.markdown
new file mode 100644
index 00000000000..de7b813b2ed
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/datasync_task.html.markdown
@@ -0,0 +1,187 @@
+---
+subcategory: "DataSync"
+layout: "aws"
+page_title: "AWS: aws_datasync_task"
+description: |-
+  Manages an AWS DataSync Task
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_datasync_task
+
+Manages an AWS DataSync Task, which represents a configuration for synchronization. Starting an execution of these DataSync Tasks (actually synchronizing files) is performed outside of this Terraform resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Op, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DatasyncTask } from "./.gen/providers/aws/datasync-task";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DatasyncTask(this, "example", {
+      destinationLocationArn: destination.arn,
+      name: "example",
+      options: {
+        bytesPerSecond: Token.asNumber(Op.negate(1)),
+      },
+      sourceLocationArn: source.arn,
+    });
+  }
+}
+
+```
+
+## Example Usage with Scheduling
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DatasyncTask } from "./.gen/providers/aws/datasync-task";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DatasyncTask(this, "example", {
+      destinationLocationArn: destination.arn,
+      name: "example",
+      schedule: {
+        scheduleExpression: "cron(0 12 ? * SUN,WED *)",
+      },
+      sourceLocationArn: source.arn,
+    });
+  }
+}
+
+```
+
+## Example Usage with Filtering
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DatasyncTask } from "./.gen/providers/aws/datasync-task";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DatasyncTask(this, "example", {
+      destinationLocationArn: destination.arn,
+      excludes: {
+        filterType: "SIMPLE_PATTERN",
+        value: "/folder1|/folder2",
+      },
+      includes: {
+        filterType: "SIMPLE_PATTERN",
+        value: "/folder1|/folder2",
+      },
+      name: "example",
+      sourceLocationArn: source.arn,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `destinationLocationArn` - (Required) Amazon Resource Name (ARN) of destination DataSync Location.
+* `sourceLocationArn` - (Required) Amazon Resource Name (ARN) of source DataSync Location.
+* `cloudwatchLogGroupArn` - (Optional) Amazon Resource Name (ARN) of the CloudWatch Log Group that is used to monitor and log events in the sync task.
+* `excludes` - (Optional) Filter rules that determines which files to exclude from a task.
+* `includes` - (Optional) Filter rules that determines which files to include in a task.
+* `name` - (Optional) Name of the DataSync Task.
+* `options` - (Optional) Configuration block containing option that controls the default behavior when you start an execution of this DataSync Task. For each individual task execution, you can override these options by specifying an overriding configuration in those executions.
+* `schedule` - (Optional) Specifies a schedule used to periodically transfer files from a source to a destination location.
+* `tags` - (Optional) Key-value pairs of resource tags to assign to the DataSync Task. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### options Argument Reference
+
+~> **NOTE:** If `atime` is set to `bestEffort`, `mtime` must be set to `preserve`. If `atime` is set to `none`, `mtime` must be set to `none`.
+
+The `options` configuration block supports the following arguments:
+
+* `atime` - (Optional) A file metadata that shows the last time a file was accessed (that is when the file was read or written to). If set to `bestEffort`, the DataSync Task attempts to preserve the original (that is, the version before sync `preparing` phase) `atime` attribute on all source files. Valid values: `bestEffort`, `none`. Default: `bestEffort`.
+* `bytesPerSecond` - (Optional) Limits the bandwidth utilized. For example, to set a maximum of 1 MB, set this value to `1048576`. Value values: `1` or greater. Default: `1` (unlimited).
+* `gid` - (Optional) Group identifier of the file's owners. Valid values: `both`, `intValue`, `name`, `none`. Default: `intValue` (preserve integer value of the ID).
+* `logLevel` - (Optional) Determines the type of logs that DataSync publishes to a log stream in the Amazon CloudWatch log group that you provide. Valid values: `off`, `basic`, `transfer`. Default: `off`.
+* `mtime` - (Optional) A file metadata that indicates the last time a file was modified (written to) before the sync `preparing` phase. Value values: `none`, `preserve`. Default: `preserve`.
+* `objectTags` - (Optional) Specifies whether object tags are maintained when transferring between object storage systems. If you want your DataSync task to ignore object tags, specify the NONE value. Valid values: `preserve`, `none`. Default value: `preserve`.
+* `overwriteMode` - (Optional) Determines whether files at the destination should be overwritten or preserved when copying files. Valid values: `always`, `never`. Default: `always`.
+* `posixPermissions` - (Optional) Determines which users or groups can access a file for a specific purpose such as reading, writing, or execution of the file. Valid values: `none`, `preserve`. Default: `preserve`.
+* `preserveDeletedFiles` - (Optional) Whether files deleted in the source should be removed or preserved in the destination file system. Valid values: `preserve`, `remove`. Default: `preserve`.
+* `preserveDevices` - (Optional) Whether the DataSync Task should preserve the metadata of block and character devices in the source files system, and recreate the files with that device name and metadata on the destination. The DataSync Task can’t sync the actual contents of such devices, because many of the devices are non-terminal and don’t return an end of file (EOF) marker. Valid values: `none`, `preserve`. Default: `none` (ignore special devices).
+* `securityDescriptorCopyFlags` - (Optional) Determines which components of the SMB security descriptor are copied from source to destination objects. This value is only used for transfers between SMB and Amazon FSx for Windows File Server locations, or between two Amazon FSx for Windows File Server locations. Valid values: `none`, `ownerDacl`, `ownerDaclSacl`. Default: `ownerDacl`.
+* `taskQueueing` - (Optional) Determines whether tasks should be queued before executing the tasks. Valid values: `enabled`, `disabled`. Default `enabled`.
+* `transferMode` - (Optional) Determines whether DataSync transfers only the data and metadata that differ between the source and the destination location, or whether DataSync transfers all the content from the source, without comparing to the destination location. Valid values: `changed`, `all`. Default: `changed`
+* `uid` - (Optional) User identifier of the file's owners. Valid values: `both`, `intValue`, `name`, `none`. Default: `intValue` (preserve integer value of the ID).
+* `verifyMode` - (Optional) Whether a data integrity verification should be performed at the end of a task execution after all data and metadata have been transferred. Valid values: `none`, `pointInTimeConsistent`, `onlyFilesTransferred`. Default: `pointInTimeConsistent`.
+
+### Schedule
+
+* `scheduleExpression` - (Required) Specifies the schedule you want your task to use for repeated executions. For more information, see [Schedule Expressions for Rules](https://docs.aws.amazon.com/AmazonCloudWatch/latest/events/ScheduledEvents.html).
+
+### excludes Argument Reference
+
+* `filterType` - (Optional) The type of filter rule to apply. Valid values: `simplePattern`.
+* `value` - (Optional) A single filter string that consists of the patterns to exclude. The patterns are delimited by "|" (that is, a pipe), for example: `/folder1|/folder2`
+
+### includes Argument Reference
+
+* `filterType` - (Optional) The type of filter rule to apply. Valid values: `simplePattern`.
+* `value` - (Optional) A single filter string that consists of the patterns to include. The patterns are delimited by "|" (that is, a pipe), for example: `/folder1|/folder2`
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Amazon Resource Name (ARN) of the DataSync Task.
+* `arn` - Amazon Resource Name (ARN) of the DataSync Task.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `5M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsDatasyncTask` using the DataSync Task Amazon Resource Name (ARN). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsDatasyncTask` using the DataSync Task Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_datasync_task.example arn:aws:datasync:us-east-1:123456789012:task/task-12345678901234567
+```
+
+<!-- cache-key: cdktf-0.18.0 input-cdd40a57bab5272f6d1ab360a92d6775feeadf4450ae0350087abd170b623ea3 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/dax_cluster.html.markdown b/website/docs/cdktf/typescript/r/dax_cluster.html.markdown
new file mode 100644
index 00000000000..8a4351f38f6
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/dax_cluster.html.markdown
@@ -0,0 +1,144 @@
+---
+subcategory: "DynamoDB Accelerator (DAX)"
+layout: "aws"
+page_title: "AWS: aws_dax_cluster"
+description: |-
+  Provides an DAX Cluster resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_dax_cluster
+
+Provides a DAX Cluster resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DaxCluster } from "./.gen/providers/aws/dax-cluster";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DaxCluster(this, "bar", {
+      clusterName: "cluster-example",
+      iamRoleArn: Token.asString(example.arn),
+      nodeType: "dax.r4.large",
+      replicationFactor: 1,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `clusterEndpointEncryptionType` – (Optional) The type of encryption the
+cluster's endpoint should support. Valid values are: `none` and `tls`.
+Default value is `none`.
+
+* `clusterName` – (Required) Group identifier. DAX converts this name to
+lowercase
+
+* `iamRoleArn` - (Required) A valid Amazon Resource Name (ARN) that identifies
+an IAM role. At runtime, DAX will assume this role and use the role's
+permissions to access DynamoDB on your behalf
+
+* `nodeType` – (Required) The compute and memory capacity of the nodes. See
+[Nodes][1] for supported node types
+
+* `replicationFactor` – (Required) The number of nodes in the DAX cluster. A
+replication factor of 1 will create a single-node cluster, without any read
+replicas
+
+* `availabilityZones` - (Optional) List of Availability Zones in which the
+nodes will be created
+
+* `description` – (Optional) Description for the cluster
+
+* `notificationTopicArn` – (Optional) An Amazon Resource Name (ARN) of an
+SNS topic to send DAX notifications to. Example:
+`arn:aws:sns:usEast1:012345678999:mySnsTopic`
+
+* `parameterGroupName` – (Optional) Name of the parameter group to associate
+with this DAX cluster
+
+* `maintenanceWindow` – (Optional) Specifies the weekly time range for when
+maintenance on the cluster is performed. The format is `ddd:hh24:miDdd:hh24:mi`
+(24H Clock UTC). The minimum maintenance window is a 60 minute period. Example:
+`sun:05:00Sun:09:00`
+
+* `securityGroupIds` – (Optional) One or more VPC security groups associated
+with the cluster
+
+* `serverSideEncryption` - (Optional) Encrypt at rest options
+
+* `subnetGroupName` – (Optional) Name of the subnet group to be used for the
+cluster
+
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+The `serverSideEncryption` object supports the following:
+
+* `enabled` - (Optional) Whether to enable encryption at rest. Defaults to `false`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the DAX cluster
+
+* `nodes` - List of node objects including `id`, `address`, `port` and
+`availabilityZone`. Referenceable e.g., as
+`${awsDaxClusterTestNodes0Address}`
+
+* `configurationEndpoint` - The configuration endpoint for this DAX cluster,
+consisting of a DNS name and a port number
+
+* `clusterAddress` - The DNS name of the DAX cluster without the port appended
+
+* `port` - The port used by the configuration endpoint
+
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `45M`)
+- `update` - (Default `45M`)
+- `delete` - (Default `90M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DAX Clusters using the `clusterName`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import DAX Clusters using the `clusterName`. For example:
+
+```console
+% terraform import aws_dax_cluster.my_cluster my_cluster
+```
+
+[1]: http://docs.aws.amazon.com/amazondynamodb/latest/developerguide/DAX.concepts.cluster.html#DAX.concepts.nodes
+
+<!-- cache-key: cdktf-0.18.0 input-4181166d95f7861d31bfe7d254c348dcceab5cb195724123d069730a8e82414d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/dax_parameter_group.html.markdown b/website/docs/cdktf/typescript/r/dax_parameter_group.html.markdown
new file mode 100644
index 00000000000..ace9107faaa
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/dax_parameter_group.html.markdown
@@ -0,0 +1,92 @@
+---
+subcategory: "DynamoDB Accelerator (DAX)"
+layout: "aws"
+page_title: "AWS: aws_dax_parameter_group"
+description: |-
+  Provides an DAX Parameter Group resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_dax_parameter_group
+
+Provides a DAX Parameter Group resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DaxParameterGroup } from "./.gen/providers/aws/dax-parameter-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DaxParameterGroup(this, "example", {
+      name: "example",
+      parameters: [
+        {
+          name: "query-ttl-millis",
+          value: "100000",
+        },
+        {
+          name: "record-ttl-millis",
+          value: "100000",
+        },
+      ],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` – (Required) The name of the parameter group.
+
+* `description` - (Optional, ForceNew) A description of the parameter group.
+
+* `parameters` – (Optional) The parameters of the parameter group.
+
+## parameters
+
+`parameters` supports the following:
+
+* `name` - (Required) The name of the parameter.
+* `value` - (Required) The value for the parameter.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name of the parameter group.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DAX Parameter Group using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import DAX Parameter Group using the `name`. For example:
+
+```console
+% terraform import aws_dax_parameter_group.example my_dax_pg
+```
+
+<!-- cache-key: cdktf-0.18.0 input-3baebb2b38580e9504f432df3ad10f9401086de59d9fede3a77fa269c4b381fa -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/dax_subnet_group.html.markdown b/website/docs/cdktf/typescript/r/dax_subnet_group.html.markdown
new file mode 100644
index 00000000000..32bb3b4d747
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/dax_subnet_group.html.markdown
@@ -0,0 +1,75 @@
+---
+subcategory: "DynamoDB Accelerator (DAX)"
+layout: "aws"
+page_title: "AWS: aws_dax_subnet_group"
+description: |-
+  Provides an DAX Subnet Group resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_dax_subnet_group
+
+Provides a DAX Subnet Group resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DaxSubnetGroup } from "./.gen/providers/aws/dax-subnet-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DaxSubnetGroup(this, "example", {
+      name: "example",
+      subnetIds: [example1.id, example2.id],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` – (Required) The name of the subnet group.
+* `description` - (Optional) A description of the subnet group.
+* `subnetIds` – (Required) A list of VPC subnet IDs for the subnet group.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name of the subnet group.
+* `vpcId` – VPC ID of the subnet group.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DAX Subnet Group using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import DAX Subnet Group using the `name`. For example:
+
+```console
+% terraform import aws_dax_subnet_group.example my_dax_sg
+```
+
+<!-- cache-key: cdktf-0.18.0 input-7e0b85bfae073f3145aed1d3f2658b614702a6a6a2bc2cf27086e92f41fc07d8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/db_cluster_snapshot.html.markdown b/website/docs/cdktf/typescript/r/db_cluster_snapshot.html.markdown
new file mode 100644
index 00000000000..8099ff2123f
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/db_cluster_snapshot.html.markdown
@@ -0,0 +1,92 @@
+---
+subcategory: "RDS (Relational Database)"
+layout: "aws"
+page_title: "AWS: aws_db_cluster_snapshot"
+description: |-
+  Manages an RDS database cluster snapshot.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_db_cluster_snapshot
+
+Manages an RDS database cluster snapshot for Aurora clusters. For managing RDS database instance snapshots, see the [`awsDbSnapshot` resource](/docs/providers/aws/r/db_snapshot.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DbClusterSnapshot } from "./.gen/providers/aws/db-cluster-snapshot";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DbClusterSnapshot(this, "example", {
+      dbClusterIdentifier: Token.asString(awsRdsClusterExample.id),
+      dbClusterSnapshotIdentifier: "resourcetestsnapshot1234",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `dbClusterIdentifier` - (Required) The DB Cluster Identifier from which to take the snapshot.
+* `dbClusterSnapshotIdentifier` - (Required) The Identifier for the snapshot.
+* `tags` - (Optional) A map of tags to assign to the DB cluster. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `allocatedStorage` - Allocated storage size in gigabytes (GB).
+* `availabilityZones` - List of EC2 Availability Zones that instances in the DB cluster snapshot can be restored in.
+* `dbClusterSnapshotArn` - The Amazon Resource Name (ARN) for the DB Cluster Snapshot.
+* `engine` - Name of the database engine.
+* `engineVersion` - Version of the database engine for this DB cluster snapshot.
+* `kmsKeyId` - If storage_encrypted is true, the AWS KMS key identifier for the encrypted DB cluster snapshot.
+* `licenseModel` - License model information for the restored DB cluster.
+* `port` - Port that the DB cluster was listening on at the time of the snapshot.
+* `sourceDbClusterSnapshotIdentifier` - DB Cluster Snapshot ARN that the DB Cluster Snapshot was copied from. It only has value in case of cross customer or cross region copy.
+* `storageEncrypted` - Whether the DB cluster snapshot is encrypted.
+* `status` - The status of this DB Cluster Snapshot.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `vpcId` - The VPC ID associated with the DB cluster snapshot.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `20M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsDbClusterSnapshot` using the cluster snapshot identifier. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsDbClusterSnapshot` using the cluster snapshot identifier. For example:
+
+```console
+% terraform import aws_db_cluster_snapshot.example my-cluster-snapshot
+```
+
+<!-- cache-key: cdktf-0.18.0 input-184cf1bfcccfca9c2ff7ce3ea29b9445d23880d46f0be562ac06c71e5ee10f89 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/db_event_subscription.html.markdown b/website/docs/cdktf/typescript/r/db_event_subscription.html.markdown
new file mode 100644
index 00000000000..34b4001bb73
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/db_event_subscription.html.markdown
@@ -0,0 +1,128 @@
+---
+subcategory: "RDS (Relational Database)"
+layout: "aws"
+page_title: "AWS: aws_db_event_subscription"
+description: |-
+  Provides a DB event subscription resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_db_event_subscription
+
+Provides a DB event subscription resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DbEventSubscription } from "./.gen/providers/aws/db-event-subscription";
+import { DbInstance } from "./.gen/providers/aws/db-instance";
+import { SnsTopic } from "./.gen/providers/aws/sns-topic";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const defaultVar = new DbInstance(this, "default", {
+      allocatedStorage: 10,
+      dbName: "mydb",
+      dbSubnetGroupName: "my_database_subnet_group",
+      engine: "mysql",
+      engineVersion: "5.6.17",
+      instanceClass: "db.t2.micro",
+      parameterGroupName: "default.mysql5.6",
+      password: "bar",
+      username: "foo",
+    });
+    const awsSnsTopicDefault = new SnsTopic(this, "default_1", {
+      name: "rds-events",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSnsTopicDefault.overrideLogicalId("default");
+    const awsDbEventSubscriptionDefault = new DbEventSubscription(
+      this,
+      "default_2",
+      {
+        eventCategories: [
+          "availability",
+          "deletion",
+          "failover",
+          "failure",
+          "low storage",
+          "maintenance",
+          "notification",
+          "read replica",
+          "recovery",
+          "restoration",
+        ],
+        name: "rds-event-sub",
+        snsTopic: Token.asString(awsSnsTopicDefault.arn),
+        sourceIds: [defaultVar.identifier],
+        sourceType: "db-instance",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsDbEventSubscriptionDefault.overrideLogicalId("default");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Optional) The name of the DB event subscription. By default generated by Terraform.
+* `namePrefix` - (Optional) The name of the DB event subscription. Conflicts with `name`.
+* `snsTopic` - (Required) The SNS topic to send events to.
+* `sourceIds` - (Optional) A list of identifiers of the event sources for which events will be returned. If not specified, then all sources are included in the response. If specified, a source_type must also be specified.
+* `sourceType` - (Optional) The type of source that will be generating the events. Valid options are `dbInstance`, `dbSecurityGroup`, `dbParameterGroup`, `dbSnapshot`, `dbCluster`, `dbClusterSnapshot`, or `dbProxy`. If not set, all sources will be subscribed to.
+* `eventCategories` - (Optional) A list of event categories for a SourceType that you want to subscribe to. See http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Events.html or run `aws rds describe-event-categories`.
+* `enabled` - (Optional) A boolean flag to enable/disable the subscription. Defaults to true.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name of the RDS event notification subscription
+* `arn` - The Amazon Resource Name of the RDS event notification subscription
+* `customerAwsId` - The AWS customer account associated with the RDS event notification subscription
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `40M`)
+- `delete` - (Default `40M`)
+- `update` - (Default `40M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DB Event Subscriptions using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import DB Event Subscriptions using the `name`. For example:
+
+```console
+% terraform import aws_db_event_subscription.default rds-event-sub
+```
+
+<!-- cache-key: cdktf-0.18.0 input-cb5fc34abd6de28afa1d0edc0e2b55d536c749f2cbd0845b420b9fb388541aff -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/db_instance.html.markdown b/website/docs/cdktf/typescript/r/db_instance.html.markdown
new file mode 100644
index 00000000000..302d7d9c26b
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/db_instance.html.markdown
@@ -0,0 +1,629 @@
+---
+subcategory: "RDS (Relational Database)"
+layout: "aws"
+page_title: "AWS: aws_db_instance"
+description: |-
+  Provides an RDS instance resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_db_instance
+
+Provides an RDS instance resource.  A DB instance is an isolated database
+environment in the cloud.  A DB instance can contain multiple user-created
+databases.
+
+Changes to a DB instance can occur when you manually change a parameter, such as
+`allocatedStorage`, and are reflected in the next maintenance window. Because
+of this, Terraform may report a difference in its planning phase because a
+modification has not yet taken place. You can use the `applyImmediately` flag
+to instruct the service to apply the change immediately (see documentation
+below).
+
+When upgrading the major version of an engine, `allowMajorVersionUpgrade` must be set to `true`.
+
+~> **Note:** using `applyImmediately` can result in a brief downtime as the server reboots.
+See the AWS Docs on [RDS Instance Maintenance][instance-maintenance] for more information.
+
+~> **Note:** All arguments including the username and password will be stored in the raw state as plain-text.
+[Read more about sensitive data instate](https://www.terraform.io/docs/state/sensitive-data.html).
+
+> **Hands-on:** Try the [Manage AWS RDS Instances](https://learn.hashicorp.com/tutorials/terraform/aws-rds) tutorial on HashiCorp Learn.
+
+## RDS Instance Class Types
+
+Amazon RDS supports three types of instance classes: Standard, Memory Optimized, and Burstable Performance.
+For more information please read the AWS RDS documentation about [DB Instance Class Types](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Concepts.DBInstanceClass.html)
+
+## Low-Downtime Updates
+
+By default, RDS applies updates to DB Instances in-place, which can lead to service interruptions.
+Low-downtime updates minimize service interruptions by performing the updates with an [RDS Blue/Green deployment][blue-green] and switching over the instances when complete.
+
+Low-downtime updates are only available for DB Instances using MySQL and MariaDB,
+as other engines are not supported by RDS Blue/Green deployments.
+
+Backups must be enabled to use low-downtime updates.
+
+Enable low-downtime updates by setting `blueGreenUpdateEnabled` to `true`.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DbInstance } from "./.gen/providers/aws/db-instance";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DbInstance(this, "default", {
+      allocatedStorage: 10,
+      dbName: "mydb",
+      engine: "mysql",
+      engineVersion: "5.7",
+      instanceClass: "db.t3.micro",
+      parameterGroupName: "default.mysql5.7",
+      password: "foobarbaz",
+      skipFinalSnapshot: true,
+      username: "foo",
+    });
+  }
+}
+
+```
+
+### RDS Custom for Oracle Usage with Replica
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsKmsKey } from "./.gen/providers/aws/data-aws-kms-key";
+import { DataAwsRdsOrderableDbInstance } from "./.gen/providers/aws/data-aws-rds-orderable-db-instance";
+import { DbInstance } from "./.gen/providers/aws/db-instance";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const byId = new DataAwsKmsKey(this, "by_id", {
+      keyId: "example-ef278353ceba4a5a97de6784565b9f78",
+    });
+    const customOracle = new DataAwsRdsOrderableDbInstance(
+      this,
+      "custom-oracle",
+      {
+        engine: "custom-oracle-ee",
+        engineVersion: "19.c.ee.002",
+        licenseModel: "bring-your-own-license",
+        preferredInstanceClasses: [
+          "db.r5.xlarge",
+          "db.r5.2xlarge",
+          "db.r5.4xlarge",
+        ],
+        storageType: "gp3",
+      }
+    );
+    const defaultVar = new DbInstance(this, "default", {
+      allocatedStorage: 50,
+      autoMinorVersionUpgrade: false,
+      backupRetentionPeriod: 7,
+      customIamInstanceProfile: "AWSRDSCustomInstanceProfile",
+      dbSubnetGroupName: dbSubnetGroupName,
+      engine: Token.asString(customOracle.engine),
+      engineVersion: Token.asString(customOracle.engineVersion),
+      identifier: "ee-instance-demo",
+      instanceClass: Token.asString(customOracle.instanceClass),
+      kmsKeyId: Token.asString(byId.arn),
+      licenseModel: Token.asString(customOracle.licenseModel),
+      multiAz: false,
+      password: "avoid-plaintext-passwords",
+      storageEncrypted: true,
+      timeouts: [
+        {
+          create: "3h",
+          delete: "3h",
+          update: "3h",
+        },
+      ],
+      username: "test",
+    });
+    new DbInstance(this, "test-replica", {
+      autoMinorVersionUpgrade: false,
+      backupRetentionPeriod: 7,
+      customIamInstanceProfile: "AWSRDSCustomInstanceProfile",
+      identifier: "ee-instance-replica",
+      instanceClass: Token.asString(customOracle.instanceClass),
+      kmsKeyId: Token.asString(byId.arn),
+      multiAz: false,
+      replicaMode: "mounted",
+      replicateSourceDb: defaultVar.identifier,
+      skipFinalSnapshot: true,
+      storageEncrypted: true,
+      timeouts: [
+        {
+          create: "3h",
+          delete: "3h",
+          update: "3h",
+        },
+      ],
+    });
+  }
+}
+
+```
+
+### RDS Custom for SQL Server
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsKmsKey } from "./.gen/providers/aws/data-aws-kms-key";
+import { DataAwsRdsOrderableDbInstance } from "./.gen/providers/aws/data-aws-rds-orderable-db-instance";
+import { DbInstance } from "./.gen/providers/aws/db-instance";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const byId = new DataAwsKmsKey(this, "by_id", {
+      keyId: "example-ef278353ceba4a5a97de6784565b9f78",
+    });
+    const customSqlserver = new DataAwsRdsOrderableDbInstance(
+      this,
+      "custom-sqlserver",
+      {
+        engine: "custom-sqlserver-se",
+        engineVersion: "15.00.4249.2.v1",
+        preferredInstanceClasses: [
+          "db.r5.xlarge",
+          "db.r5.2xlarge",
+          "db.r5.4xlarge",
+        ],
+        storageType: "gp3",
+      }
+    );
+    new DbInstance(this, "example", {
+      allocatedStorage: 500,
+      autoMinorVersionUpgrade: false,
+      backupRetentionPeriod: 7,
+      customIamInstanceProfile: "AWSRDSCustomSQLServerInstanceRole",
+      dbSubnetGroupName: dbSubnetGroupName,
+      engine: Token.asString(customSqlserver.engine),
+      engineVersion: Token.asString(customSqlserver.engineVersion),
+      identifier: "sql-instance-demo",
+      instanceClass: Token.asString(customSqlserver.instanceClass),
+      kmsKeyId: Token.asString(byId.arn),
+      multiAz: false,
+      password: "avoid-plaintext-passwords",
+      storageEncrypted: true,
+      timeouts: [
+        {
+          create: "3h",
+          delete: "3h",
+          update: "3h",
+        },
+      ],
+      username: "test",
+    });
+  }
+}
+
+```
+
+### Storage Autoscaling
+
+To enable Storage Autoscaling with instances that support the feature, define the `maxAllocatedStorage` argument higher than the `allocatedStorage` argument. Terraform will automatically hide differences with the `allocatedStorage` argument value if autoscaling occurs.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DbInstance } from "./.gen/providers/aws/db-instance";
+interface MyConfig {
+  instanceClass: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new DbInstance(this, "example", {
+      allocatedStorage: 50,
+      maxAllocatedStorage: 100,
+      instanceClass: config.instanceClass,
+    });
+  }
+}
+
+```
+
+### Managed Master Passwords via Secrets Manager, default KMS Key
+
+-> More information about RDS/Aurora Aurora integrates with Secrets Manager to manage master user passwords for your DB clusters can be found in the [RDS User Guide](https://aws.amazon.com/about-aws/whats-new/2022/12/amazon-rds-integration-aws-secrets-manager/) and [Aurora User Guide](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/rds-secrets-manager.html).
+
+You can specify the `manageMasterUserPassword` attribute to enable managing the master password with Secrets Manager. You can also update an existing cluster to use Secrets Manager by specify the `manageMasterUserPassword` attribute and removing the `password` attribute (removal is required).
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DbInstance } from "./.gen/providers/aws/db-instance";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DbInstance(this, "default", {
+      allocatedStorage: 10,
+      dbName: "mydb",
+      engine: "mysql",
+      engineVersion: "5.7",
+      instanceClass: "db.t3.micro",
+      manageMasterUserPassword: true,
+      parameterGroupName: "default.mysql5.7",
+      username: "foo",
+    });
+  }
+}
+
+```
+
+### Managed Master Passwords via Secrets Manager, specific KMS Key
+
+-> More information about RDS/Aurora Aurora integrates with Secrets Manager to manage master user passwords for your DB clusters can be found in the [RDS User Guide](https://aws.amazon.com/about-aws/whats-new/2022/12/amazon-rds-integration-aws-secrets-manager/) and [Aurora User Guide](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/rds-secrets-manager.html).
+
+You can specify the `masterUserSecretKmsKeyId` attribute to specify a specific KMS Key.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DbInstance } from "./.gen/providers/aws/db-instance";
+import { KmsKey } from "./.gen/providers/aws/kms-key";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new KmsKey(this, "example", {
+      description: "Example KMS Key",
+    });
+    new DbInstance(this, "default", {
+      allocatedStorage: 10,
+      dbName: "mydb",
+      engine: "mysql",
+      engineVersion: "5.7",
+      instanceClass: "db.t3.micro",
+      manageMasterUserPassword: true,
+      masterUserSecretKmsKeyId: example.keyId,
+      parameterGroupName: "default.mysql5.7",
+      username: "foo",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+For more detailed documentation about each argument, refer to the [AWS official
+documentation](http://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_CreateDBInstance.html).
+
+This argument supports the following arguments:
+
+* `allocatedStorage` - (Required unless a `snapshotIdentifier` or `replicateSourceDb` is provided) The allocated storage in gibibytes. If `maxAllocatedStorage` is configured, this argument represents the initial storage allocation and differences from the configuration will be ignored automatically when Storage Autoscaling occurs. If `replicateSourceDb` is set, the value is ignored during the creation of the instance.
+* `allowMajorVersionUpgrade` - (Optional) Indicates that major version
+upgrades are allowed. Changing this parameter does not result in an outage and
+the change is asynchronously applied as soon as possible.
+* `applyImmediately` - (Optional) Specifies whether any database modifications
+are applied immediately, or during the next maintenance window. Default is
+`false`. See [Amazon RDS Documentation for more
+information.](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.DBInstance.Modifying.html)
+* `autoMinorVersionUpgrade` - (Optional) Indicates that minor engine upgrades
+will be applied automatically to the DB instance during the maintenance window.
+Defaults to true.
+* `availabilityZone` - (Optional) The AZ for the RDS instance.
+* `backupRetentionPeriod` - (Optional) The days to retain backups for.
+  Must be between `0` and `35`.
+  Default is `0`.
+  Must be greater than `0` if the database is used as a source for a [Read Replica][instance-replication],
+  uses [low-downtime updates](#low-downtime-updates),
+  or will use [RDS Blue/Green deployments][blue-green].
+* `backupTarget` - (Optional, Forces new resource) Specifies where automated backups and manual snapshots are stored. Possible values are `region` (default) and `outposts`. See [Working with Amazon RDS on AWS Outposts](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/rds-on-outposts.html) for more information.
+* `backupWindow` - (Optional) The daily time range (in UTC) during which automated backups are created if they are enabled.
+  Example: "09:46-10:16". Must not overlap with `maintenanceWindow`.
+* `blueGreenUpdate` - (Optional) Enables low-downtime updates using [RDS Blue/Green deployments][blue-green].
+  See [`blueGreenUpdate`](#blue_green_update) below.
+* `caCertIdentifier` - (Optional) The identifier of the CA certificate for the DB instance.
+* `characterSetName` - (Optional) The character set name to use for DB
+encoding in Oracle and Microsoft SQL instances (collation). This can't be changed. See [Oracle Character Sets
+Supported in Amazon RDS](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Appendix.OracleCharacterSets.html)
+or [Server-Level Collation for Microsoft SQL Server](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Appendix.SQLServer.CommonDBATasks.Collation.html) for more information.
+* `copyTagsToSnapshot` – (Optional, boolean) Copy all Instance `tags` to snapshots. Default is `false`.
+* `customIamInstanceProfile` - (Optional) The instance profile associated with the underlying Amazon EC2 instance of an RDS Custom DB instance.
+* `dbName` - (Optional) The name of the database to create when the DB instance is created. If this parameter is not specified, no database is created in the DB instance. Note that this does not apply for Oracle or SQL Server engines. See the [AWS documentation](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/rds/create-db-instance.html) for more details on what applies for those engines. If you are providing an Oracle db name, it needs to be in all upper case. Cannot be specified for a replica.
+* `dbSubnetGroupName` - (Optional) Name of [DB subnet group](/docs/providers/aws/r/db_subnet_group.html). DB instance will
+be created in the VPC associated with the DB subnet group. If unspecified, will
+be created in the `default` VPC, or in EC2 Classic, if available. When working
+with read replicas, it should be specified only if the source database
+specifies an instance in another AWS Region. See [DBSubnetGroupName in API
+action CreateDBInstanceReadReplica](https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_CreateDBInstanceReadReplica.html)
+for additional read replica constraints.
+* `deleteAutomatedBackups` - (Optional) Specifies whether to remove automated backups immediately after the DB instance is deleted. Default is `true`.
+* `deletionProtection` - (Optional) If the DB instance should have deletion protection enabled. The database can't be deleted when this value is set to `true`. The default is `false`.
+* `domain` - (Optional) The ID of the Directory Service Active Directory domain to create the instance in.
+* `domainIamRoleName` - (Optional, but required if domain is provided) The name of the IAM role to be used when making API calls to the Directory Service.
+* `enabledCloudwatchLogsExports` - (Optional) Set of log types to enable for exporting to CloudWatch logs. If omitted, no logs will be exported. Valid values (depending on `engine`). MySQL and MariaDB: `audit`, `error`, `general`, `slowquery`. PostgreSQL: `postgresql`, `upgrade`. MSSQL: `agent` , `error`. Oracle: `alert`, `audit`, `listener`, `trace`.
+* `engine` - (Required unless a `snapshotIdentifier` or `replicateSourceDb` is provided) The database engine to use. For supported values, see the Engine parameter in [API action CreateDBInstance](https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_CreateDBInstance.html). Note that for Amazon Aurora instances the engine must match the [DB cluster](/docs/providers/aws/r/rds_cluster.html)'s engine'. For information on the difference between the available Aurora MySQL engines see [Comparison between Aurora MySQL 1 and Aurora MySQL 2](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/AuroraMySQL.Updates.20180206.html) in the Amazon RDS User Guide.
+* `engineVersion` - (Optional) The engine version to use. If `autoMinorVersionUpgrade` is enabled, you can provide a prefix of the version such as `57` (for `5710`). The actual engine version used is returned in the attribute `engineVersionActual`, see [Attribute Reference](#attribute-reference) below. For supported values, see the EngineVersion parameter in [API action CreateDBInstance](https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_CreateDBInstance.html). Note that for Amazon Aurora instances the engine version must match the [DB cluster](/docs/providers/aws/r/rds_cluster.html)'s engine version'.
+* `finalSnapshotIdentifier` - (Optional) The name of your final DB snapshot
+when this DB instance is deleted. Must be provided if `skipFinalSnapshot` is
+set to `false`. The value must begin with a letter, only contain alphanumeric characters and hyphens, and not end with a hyphen or contain two consecutive hyphens. Must not be provided when deleting a read replica.
+* `iamDatabaseAuthenticationEnabled` - (Optional) Specifies whether mappings of AWS Identity and Access Management (IAM) accounts to database
+accounts is enabled.
+* `identifier` - (Optional) The name of the RDS instance, if omitted, Terraform will assign a random, unique identifier. Required if `restoreToPointInTime` is specified.
+* `identifierPrefix` - (Optional) Creates a unique identifier beginning with the specified prefix. Conflicts with `identifier`.
+* `instanceClass` - (Required) The instance type of the RDS instance.
+* `iops` - (Optional) The amount of provisioned IOPS. Setting this implies a
+storage_type of "io1". Can only be set when `storageType` is `"io1"` or `"gp3"`.
+Cannot be specified for gp3 storage if the `allocatedStorage` value is below a per-`engine` threshold.
+See the [RDS User Guide](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_Storage.html#gp3-storage) for details.
+* `kmsKeyId` - (Optional) The ARN for the KMS encryption key. If creating an
+encrypted replica, set this to the destination KMS ARN.
+* `licenseModel` - (Optional, but required for some DB engines, i.e., Oracle SE1) License model information for this DB instance. Valid values for this field are as follows:
+    * RDS for MariaDB: `generalPublicLicense`
+    * RDS for Microsoft SQL Server: `licenseIncluded`
+    * RDS for MySQL: `generalPublicLicense`
+    * RDS for Oracle: `bring-your-own-license | license-included`
+    * RDS for PostgreSQL: `postgresqlLicense`
+* `maintenanceWindow` - (Optional) The window to perform maintenance in.
+Syntax: "ddd:hh24:mi-ddd:hh24:mi". Eg: "Mon:00:00-Mon:03:00". See [RDS
+Maintenance Window
+docs](http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_UpgradeDBInstance.Maintenance.html#AdjustingTheMaintenanceWindow)
+for more information.
+* `manageMasterUserPassword` - (Optional) Set to true to allow RDS to manage the master user password in Secrets Manager. Cannot be set if `password` is provided.
+* `masterUserSecretKmsKeyId` - (Optional) The Amazon Web Services KMS key identifier is the key ARN, key ID, alias ARN, or alias name for the KMS key. To use a KMS key in a different Amazon Web Services account, specify the key ARN or alias ARN. If not specified, the default KMS key for your Amazon Web Services account is used.
+* `maxAllocatedStorage` - (Optional) When configured, the upper limit to which Amazon RDS can automatically scale the storage of the DB instance. Configuring this will automatically ignore differences to `allocatedStorage`. Must be greater than or equal to `allocatedStorage` or `0` to disable Storage Autoscaling.
+* `monitoringInterval` - (Optional) The interval, in seconds, between points
+when Enhanced Monitoring metrics are collected for the DB instance. To disable
+collecting Enhanced Monitoring metrics, specify 0. The default is 0. Valid
+Values: 0, 1, 5, 10, 15, 30, 60.
+* `monitoringRoleArn` - (Optional) The ARN for the IAM role that permits RDS
+to send enhanced monitoring metrics to CloudWatch Logs. You can find more
+information on the [AWS
+Documentation](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Monitoring.html)
+what IAM permissions are needed to allow Enhanced Monitoring for RDS Instances.
+* `multiAz` - (Optional) Specifies if the RDS instance is multi-AZ
+* `ncharCharacterSetName` - (Optional, Forces new resource) The national character set is used in the NCHAR, NVARCHAR2, and NCLOB data types for Oracle instances. This can't be changed. See [Oracle Character Sets
+Supported in Amazon RDS](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Appendix.OracleCharacterSets.html).
+* `networkType` - (Optional) The network type of the DB instance. Valid values: `ipv4`, `dual`.
+* `optionGroupName` - (Optional) Name of the DB option group to associate.
+* `parameterGroupName` - (Optional) Name of the DB parameter group to
+associate.
+* `password` - (Required unless `manageMasterUserPassword` is set to true or unless a `snapshotIdentifier` or `replicateSourceDb`
+is provided or `manageMasterUserPassword` is set.) Password for the master DB user. Note that this may show up in
+logs, and it will be stored in the state file. Cannot be set if `manageMasterUserPassword` is set to `true`.
+* `performanceInsightsEnabled` - (Optional) Specifies whether Performance Insights are enabled. Defaults to false.
+* `performanceInsightsKmsKeyId` - (Optional) The ARN for the KMS key to encrypt Performance Insights data. When specifying `performanceInsightsKmsKeyId`, `performanceInsightsEnabled` needs to be set to true. Once KMS key is set, it can never be changed.
+* `performanceInsightsRetentionPeriod` - (Optional) Amount of time in days to retain Performance Insights data. Valid values are `7`, `731` (2 years) or a multiple of `31`. When specifying `performanceInsightsRetentionPeriod`, `performanceInsightsEnabled` needs to be set to true. Defaults to '7'.
+* `port` - (Optional) The port on which the DB accepts connections.
+* `publiclyAccessible` - (Optional) Bool to control if instance is publicly
+accessible. Default is `false`.
+* `replicaMode` - (Optional) Specifies whether the replica is in either `mounted` or `openReadOnly` mode. This attribute
+is only supported by Oracle instances. Oracle replicas operate in `openReadOnly` mode unless otherwise specified. See [Working with Oracle Read Replicas](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/oracle-read-replicas.html) for more information.
+* `replicateSourceDb` - (Optional) Specifies that this resource is a Replicate
+database, and to use this value as the source database. This correlates to the
+`identifier` of another Amazon RDS Database to replicate (if replicating within
+a single region) or ARN of the Amazon RDS Database to replicate (if replicating
+cross-region). Note that if you are
+creating a cross-region replica of an encrypted database you will also need to
+specify a `kmsKeyId`. See [DB Instance Replication][instance-replication] and [Working with
+PostgreSQL and MySQL Read Replicas](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_ReadRepl.html)
+for more information on using Replication.
+* `restoreToPointInTime` - (Optional, Forces new resource) A configuration block for restoring a DB instance to an arbitrary point in time. Requires the `identifier` argument to be set with the name of the new DB instance to be created. See [Restore To Point In Time](#restore-to-point-in-time) below for details.
+* `s3Import` - (Optional) Restore from a Percona Xtrabackup in S3.  See [Importing Data into an Amazon RDS MySQL DB Instance](http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/MySQL.Procedural.Importing.html)
+* `skipFinalSnapshot` - (Optional) Determines whether a final DB snapshot is
+created before the DB instance is deleted. If true is specified, no DBSnapshot
+is created. If false is specified, a DB snapshot is created before the DB
+instance is deleted, using the value from `finalSnapshotIdentifier`. Default
+is `false`.
+* `snapshotIdentifier` - (Optional) Specifies whether or not to create this
+database from a snapshot. This correlates to the snapshot ID you'd find in the
+RDS console, e.g: rds:production-2015-06-26-06-05.
+* `storageEncrypted` - (Optional) Specifies whether the DB instance is
+encrypted. Note that if you are creating a cross-region read replica this field
+is ignored and you should instead declare `kmsKeyId` with a valid ARN. The
+default is `false` if not specified.
+* `storageType` - (Optional) One of "standard" (magnetic), "gp2" (general
+purpose SSD), "gp3" (general purpose SSD that needs `iops` independently)
+or "io1" (provisioned IOPS SSD). The default is "io1" if `iops` is specified,
+"gp2" if not.
+* `storageThroughput` - (Optional) The storage throughput value for the DB instance. Can only be set when `storageType` is `"gp3"`. Cannot be specified if the `allocatedStorage` value is below a per-`engine` threshold. See the [RDS User Guide](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_Storage.html#gp3-storage) for details.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `timezone` - (Optional) Time zone of the DB instance. `timezone` is currently
+only supported by Microsoft SQL Server. The `timezone` can only be set on
+creation. See [MSSQL User
+Guide](http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_SQLServer.html#SQLServer.Concepts.General.TimeZone)
+for more information.
+* `username` - (Required unless a `snapshotIdentifier` or `replicateSourceDb`
+is provided) Username for the master DB user. Cannot be specified for a replica.
+* `vpcSecurityGroupIds` - (Optional) List of VPC security groups to
+associate.
+* `customerOwnedIpEnabled` - (Optional) Indicates whether to enable a customer-owned IP address (CoIP) for an RDS on Outposts DB instance. See [CoIP for RDS on Outposts](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/rds-on-outposts.html#rds-on-outposts.coip) for more information.
+
+~> **NOTE:** Removing the `replicateSourceDb` attribute from an existing RDS
+Replicate database managed by Terraform will promote the database to a fully
+standalone database.
+
+### Restore To Point In Time
+
+-> **Note:** You can restore to any point in time before the source DB instance's `latestRestorableTime` or a point up to the number of days specified in the source DB instance's `backupRetentionPeriod`.
+For more information, please refer to the [Developer Guide](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_PIT.html).
+This setting does not apply to `auroraMysql` or `auroraPostgresql` DB engines. For Aurora, refer to the [`awsRdsCluster` resource documentation](/docs/providers/aws/r/rds_cluster.html#restore_in_time).
+
+The `restoreToPointInTime` block supports the following arguments:
+
+* `restoreTime` - (Optional) The date and time to restore from. Value must be a time in Universal Coordinated Time (UTC) format and must be before the latest restorable time for the DB instance. Cannot be specified with `useLatestRestorableTime`.
+* `sourceDbInstanceIdentifier` - (Optional) The identifier of the source DB instance from which to restore. Must match the identifier of an existing DB instance. Required if `sourceDbInstanceAutomatedBackupsArn` or `sourceDbiResourceId` is not specified.
+* `sourceDbInstanceAutomatedBackupsArn` - (Optional) The ARN of the automated backup from which to restore. Required if `sourceDbInstanceIdentifier` or `sourceDbiResourceId` is not specified.
+* `sourceDbiResourceId` - (Optional) The resource ID of the source DB instance from which to restore. Required if `sourceDbInstanceIdentifier` or `sourceDbInstanceAutomatedBackupsArn` is not specified.
+* `useLatestRestorableTime` - (Optional) A boolean value that indicates whether the DB instance is restored from the latest backup time. Defaults to `false`. Cannot be specified with `restoreTime`.
+
+### S3 Import Options
+
+Full details on the core parameters and impacts are in the API Docs: [RestoreDBInstanceFromS3](http://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_RestoreDBInstanceFromS3.html).  Sample
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DbInstance } from "./.gen/providers/aws/db-instance";
+interface MyConfig {
+  instanceClass: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new DbInstance(this, "db", {
+      s3Import: {
+        bucketName: "mybucket",
+        bucketPrefix: "backups",
+        ingestionRole:
+          "arn:aws:iam::1234567890:role/role-xtrabackup-rds-restore",
+        sourceEngine: "mysql",
+        sourceEngineVersion: "5.6",
+      },
+      instanceClass: config.instanceClass,
+    });
+  }
+}
+
+```
+
+* `bucketName` - (Required) The bucket name where your backup is stored
+* `bucketPrefix` - (Optional) Can be blank, but is the path to your backup
+* `ingestionRole` - (Required) Role applied to load the data.
+* `sourceEngine` - (Required, as of Feb 2018 only 'mysql' supported) Source engine for the backup
+* `sourceEngineVersion` - (Required, as of Feb 2018 only '5.6' supported) Version of the source engine used to make the backup
+
+This will not recreate the resource if the S3 object changes in some way.  It's only used to initialize the database.
+
+### `blueGreenUpdate`
+
+* `enabled` - (Optional) Enables [low-downtime updates](#low-downtime-updates) when `true`.
+  Default is `false`.
+
+[instance-replication]:
+https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.Replication.html
+[instance-maintenance]:
+https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_UpgradeDBInstance.Maintenance.html
+[blue-green]:
+https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/blue-green-deployments.html
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `address` - The hostname of the RDS instance. See also `endpoint` and `port`.
+* `arn` - The ARN of the RDS instance.
+* `allocatedStorage` - The amount of allocated storage.
+* `availabilityZone` - The availability zone of the instance.
+* `backupRetentionPeriod` - The backup retention period.
+* `backupWindow` - The backup window.
+* `caCertIdentifier` - Identifier of the CA certificate for the
+DB instance.
+* `dbName` - The database name.
+* `domain` - The ID of the Directory Service Active Directory domain the instance is joined to
+* `domainIamRoleName` - The name of the IAM role to be used when making API calls to the Directory Service.
+* `endpoint` - The connection endpoint in `address:port` format.
+* `engine` - The database engine.
+* `engineVersionActual` - The running version of the database.
+* `hostedZoneId` - The canonical hosted zone ID of the DB instance (to be used
+in a Route 53 Alias record).
+* `id` - RDS DBI resource ID.
+* `instanceClass`- The RDS instance class.
+* `latestRestorableTime` - The latest time, in UTC [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8), to which a database can be restored with point-in-time restore.
+* `listenerEndpoint` - Specifies the listener connection endpoint for SQL Server Always On. See [endpoint](#endpoint) below.
+* `maintenanceWindow` - The instance maintenance window.
+* `masterUserSecret` - A block that specifies the master user secret. Only available when `manageMasterUserPassword` is set to true. [Documented below](#master_user_secret).
+* `multiAz` - If the RDS instance is multi AZ enabled.
+* `port` - The database port.
+* `resourceId` - The RDS Resource ID of this instance.
+* `status` - The RDS instance status.
+* `storageEncrypted` - Whether the DB instance is encrypted.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `username` - The master username for the database.
+
+On Oracle and Microsoft SQL instances the following is exported additionally:
+
+* `characterSetName` - The character set (collation) used on Oracle and Microsoft SQL instances.
+
+### Endpoint
+
+* `address` - Specifies the DNS address of the DB instance.
+* `hostedZoneId` - Specifies the ID that Amazon Route 53 assigns when you create a hosted zone.
+* `port` - Specifies the port that the database engine is listening on.
+
+### master_user_secret
+
+The `masterUserSecret` configuration block supports the following attributes:
+
+* `kmsKeyId` - The Amazon Web Services KMS key identifier that is used to encrypt the secret.
+* `secretArn` - The Amazon Resource Name (ARN) of the secret.
+* `secretStatus` - The status of the secret. Valid Values: `creating` | `active` | `rotating` | `impaired`.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `40M`)
+- `update` - (Default `80M`)
+- `delete` - (Default `60M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DB Instances using the `identifier`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import DB Instances using the `identifier`. For example:
+
+```console
+% terraform import aws_db_instance.default mydb-rds-instance
+```
+
+<!-- cache-key: cdktf-0.18.0 input-b21700814161e25f711326174480a6752fc0080770ea5836b639fbad92ed7c1e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/db_instance_automated_backups_replication.html.markdown b/website/docs/cdktf/typescript/r/db_instance_automated_backups_replication.html.markdown
new file mode 100644
index 00000000000..6c73598dafa
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/db_instance_automated_backups_replication.html.markdown
@@ -0,0 +1,168 @@
+---
+subcategory: "RDS (Relational Database)"
+layout: "aws"
+page_title: "AWS: aws_db_instance_automated_backups_replication"
+description: |-
+  Enables replication of automated backups to a different AWS Region.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_db_instance_automated_backups_replication
+
+Manage cross-region replication of automated backups to a different AWS Region. Documentation for cross-region automated backup replication can be found at:
+
+* [Replicating automated backups to another AWS Region](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_ReplicateBackups.html)
+
+-> **Note:** This resource has to be created in the destination region.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DbInstanceAutomatedBackupsReplication } from "./.gen/providers/aws/db-instance-automated-backups-replication";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DbInstanceAutomatedBackupsReplication(this, "default", {
+      retentionPeriod: 14,
+      sourceDbInstanceArn: "arn:aws:rds:us-west-2:123456789012:db:mydatabase",
+    });
+  }
+}
+
+```
+
+## Encrypting the automated backup with KMS
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DbInstanceAutomatedBackupsReplication } from "./.gen/providers/aws/db-instance-automated-backups-replication";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DbInstanceAutomatedBackupsReplication(this, "default", {
+      kmsKeyId:
+        "arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012",
+      sourceDbInstanceArn: "arn:aws:rds:us-west-2:123456789012:db:mydatabase",
+    });
+  }
+}
+
+```
+
+## Example including a RDS DB instance
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DbInstance } from "./.gen/providers/aws/db-instance";
+import { DbInstanceAutomatedBackupsReplication } from "./.gen/providers/aws/db-instance-automated-backups-replication";
+import { KmsKey } from "./.gen/providers/aws/kms-key";
+import { AwsProvider } from "./.gen/providers/aws/provider";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AwsProvider(this, "aws", {
+      region: "us-east-1",
+    });
+    const replica = new AwsProvider(this, "aws_1", {
+      alias: "replica",
+      region: "us-west-2",
+    });
+    const defaultVar = new DbInstance(this, "default", {
+      allocatedStorage: 10,
+      backupRetentionPeriod: 7,
+      dbName: "mydb",
+      engine: "postgres",
+      engineVersion: "13.4",
+      identifier: "mydb",
+      instanceClass: "db.t3.micro",
+      password: "mustbeeightcharacters",
+      skipFinalSnapshot: true,
+      storageEncrypted: true,
+      username: "masterusername",
+    });
+    const awsKmsKeyDefault = new KmsKey(this, "default_3", {
+      description: "Encryption key for automated backups",
+      provider: replica,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsKmsKeyDefault.overrideLogicalId("default");
+    const awsDbInstanceAutomatedBackupsReplicationDefault =
+      new DbInstanceAutomatedBackupsReplication(this, "default_4", {
+        kmsKeyId: Token.asString(awsKmsKeyDefault.arn),
+        provider: replica,
+        sourceDbInstanceArn: defaultVar.arn,
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsDbInstanceAutomatedBackupsReplicationDefault.overrideLogicalId(
+      "default"
+    );
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `kmsKeyId` - (Optional, Forces new resource) The AWS KMS key identifier for encryption of the replicated automated backups. The KMS key ID is the Amazon Resource Name (ARN) for the KMS encryption key in the destination AWS Region, for example, `arn:aws:kms:usEast1:123456789012:key/akiaiosfodnn7Example`.
+* `preSignedUrl` - (Optional, Forces new resource) A URL that contains a [Signature Version 4](https://docs.aws.amazon.com/general/latest/gr/signature-version-4.html) signed request for the [`startDbInstanceAutomatedBackupsReplication`](https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_StartDBInstanceAutomatedBackupsReplication.html) action to be called in the AWS Region of the source DB instance.
+* `retentionPeriod` - (Optional, Forces new resource) The retention period for the replicated automated backups, defaults to `7`.
+* `sourceDbInstanceArn` - (Required, Forces new resource) The Amazon Resource Name (ARN) of the source DB instance for the replicated automated backups, for example, `arn:aws:rds:usWest2:123456789012:db:mydatabase`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Amazon Resource Name (ARN) of the replicated automated backups.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `75M`)
+- `delete` - (Default `75M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import RDS instance automated backups replication using the `arn`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import RDS instance automated backups replication using the `arn`. For example:
+
+```console
+% terraform import aws_db_instance_automated_backups_replication.default arn:aws:rds:us-east-1:123456789012:auto-backup:ab-faaa2mgdj1vmp4xflr7yhsrmtbtob7ltrzzz2my
+```
+
+<!-- cache-key: cdktf-0.18.0 input-a1a4df51ceeb0b407d09f3cecea4189146c75a1f96880f39dc75e22abd29cc11 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/db_instance_automated_backups_replication.markdown b/website/docs/cdktf/typescript/r/db_instance_automated_backups_replication.markdown
new file mode 100644
index 00000000000..6c73598dafa
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/db_instance_automated_backups_replication.markdown
@@ -0,0 +1,168 @@
+---
+subcategory: "RDS (Relational Database)"
+layout: "aws"
+page_title: "AWS: aws_db_instance_automated_backups_replication"
+description: |-
+  Enables replication of automated backups to a different AWS Region.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_db_instance_automated_backups_replication
+
+Manage cross-region replication of automated backups to a different AWS Region. Documentation for cross-region automated backup replication can be found at:
+
+* [Replicating automated backups to another AWS Region](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_ReplicateBackups.html)
+
+-> **Note:** This resource has to be created in the destination region.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DbInstanceAutomatedBackupsReplication } from "./.gen/providers/aws/db-instance-automated-backups-replication";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DbInstanceAutomatedBackupsReplication(this, "default", {
+      retentionPeriod: 14,
+      sourceDbInstanceArn: "arn:aws:rds:us-west-2:123456789012:db:mydatabase",
+    });
+  }
+}
+
+```
+
+## Encrypting the automated backup with KMS
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DbInstanceAutomatedBackupsReplication } from "./.gen/providers/aws/db-instance-automated-backups-replication";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DbInstanceAutomatedBackupsReplication(this, "default", {
+      kmsKeyId:
+        "arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012",
+      sourceDbInstanceArn: "arn:aws:rds:us-west-2:123456789012:db:mydatabase",
+    });
+  }
+}
+
+```
+
+## Example including a RDS DB instance
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DbInstance } from "./.gen/providers/aws/db-instance";
+import { DbInstanceAutomatedBackupsReplication } from "./.gen/providers/aws/db-instance-automated-backups-replication";
+import { KmsKey } from "./.gen/providers/aws/kms-key";
+import { AwsProvider } from "./.gen/providers/aws/provider";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AwsProvider(this, "aws", {
+      region: "us-east-1",
+    });
+    const replica = new AwsProvider(this, "aws_1", {
+      alias: "replica",
+      region: "us-west-2",
+    });
+    const defaultVar = new DbInstance(this, "default", {
+      allocatedStorage: 10,
+      backupRetentionPeriod: 7,
+      dbName: "mydb",
+      engine: "postgres",
+      engineVersion: "13.4",
+      identifier: "mydb",
+      instanceClass: "db.t3.micro",
+      password: "mustbeeightcharacters",
+      skipFinalSnapshot: true,
+      storageEncrypted: true,
+      username: "masterusername",
+    });
+    const awsKmsKeyDefault = new KmsKey(this, "default_3", {
+      description: "Encryption key for automated backups",
+      provider: replica,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsKmsKeyDefault.overrideLogicalId("default");
+    const awsDbInstanceAutomatedBackupsReplicationDefault =
+      new DbInstanceAutomatedBackupsReplication(this, "default_4", {
+        kmsKeyId: Token.asString(awsKmsKeyDefault.arn),
+        provider: replica,
+        sourceDbInstanceArn: defaultVar.arn,
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsDbInstanceAutomatedBackupsReplicationDefault.overrideLogicalId(
+      "default"
+    );
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `kmsKeyId` - (Optional, Forces new resource) The AWS KMS key identifier for encryption of the replicated automated backups. The KMS key ID is the Amazon Resource Name (ARN) for the KMS encryption key in the destination AWS Region, for example, `arn:aws:kms:usEast1:123456789012:key/akiaiosfodnn7Example`.
+* `preSignedUrl` - (Optional, Forces new resource) A URL that contains a [Signature Version 4](https://docs.aws.amazon.com/general/latest/gr/signature-version-4.html) signed request for the [`startDbInstanceAutomatedBackupsReplication`](https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_StartDBInstanceAutomatedBackupsReplication.html) action to be called in the AWS Region of the source DB instance.
+* `retentionPeriod` - (Optional, Forces new resource) The retention period for the replicated automated backups, defaults to `7`.
+* `sourceDbInstanceArn` - (Required, Forces new resource) The Amazon Resource Name (ARN) of the source DB instance for the replicated automated backups, for example, `arn:aws:rds:usWest2:123456789012:db:mydatabase`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Amazon Resource Name (ARN) of the replicated automated backups.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `75M`)
+- `delete` - (Default `75M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import RDS instance automated backups replication using the `arn`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import RDS instance automated backups replication using the `arn`. For example:
+
+```console
+% terraform import aws_db_instance_automated_backups_replication.default arn:aws:rds:us-east-1:123456789012:auto-backup:ab-faaa2mgdj1vmp4xflr7yhsrmtbtob7ltrzzz2my
+```
+
+<!-- cache-key: cdktf-0.18.0 input-a1a4df51ceeb0b407d09f3cecea4189146c75a1f96880f39dc75e22abd29cc11 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/db_instance_role_association.html.markdown b/website/docs/cdktf/typescript/r/db_instance_role_association.html.markdown
new file mode 100644
index 00000000000..9ffa8b0fd04
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/db_instance_role_association.html.markdown
@@ -0,0 +1,80 @@
+---
+subcategory: "RDS (Relational Database)"
+layout: "aws"
+page_title: "AWS: aws_db_instance_role_association"
+description: |-
+  Manages an RDS DB Instance association with an IAM Role.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_db_instance_role_association
+
+Manages an RDS DB Instance association with an IAM Role. Example use cases:
+
+* [Amazon RDS Oracle integration with Amazon S3](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/oracle-s3-integration.html)
+* [Importing Amazon S3 Data into an RDS PostgreSQL DB Instance](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_PostgreSQL.S3Import.html)
+
+-> To manage the RDS DB Instance IAM Role for [Enhanced Monitoring](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Monitoring.OS.html), see the `awsDbInstance` resource `monitoringRoleArn` argument instead.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DbInstanceRoleAssociation } from "./.gen/providers/aws/db-instance-role-association";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DbInstanceRoleAssociation(this, "example", {
+      dbInstanceIdentifier: Token.asString(awsDbInstanceExample.identifier),
+      featureName: "S3_INTEGRATION",
+      roleArn: Token.asString(awsIamRoleExample.arn),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `dbInstanceIdentifier` - (Required) DB Instance Identifier to associate with the IAM Role.
+* `featureName` - (Required) Name of the feature for association. This can be found in the AWS documentation relevant to the integration or a full list is available in the `supportedFeatureNames` list returned by [AWS CLI rds describe-db-engine-versions](https://docs.aws.amazon.com/cli/latest/reference/rds/describe-db-engine-versions.html).
+* `roleArn` - (Required) Amazon Resource Name (ARN) of the IAM Role to associate with the DB Instance.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - DB Instance Identifier and IAM Role ARN separated by a comma (`,`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsDbInstanceRoleAssociation` using the DB Instance Identifier and IAM Role ARN separated by a comma (`,`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsDbInstanceRoleAssociation` using the DB Instance Identifier and IAM Role ARN separated by a comma (`,`). For example:
+
+```console
+% terraform import aws_db_instance_role_association.example my-db-instance,arn:aws:iam::123456789012:role/my-role
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ea9099caf40d7a4cade1ea4194ea1b75c0145f79cdeb15a2e5c098eb364ca5d9 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/db_option_group.html.markdown b/website/docs/cdktf/typescript/r/db_option_group.html.markdown
new file mode 100644
index 00000000000..bd69e9b810f
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/db_option_group.html.markdown
@@ -0,0 +1,140 @@
+---
+subcategory: "RDS (Relational Database)"
+layout: "aws"
+page_title: "AWS: aws_db_option_group"
+description: |-
+  Provides an RDS DB option group resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_db_option_group
+
+Provides an RDS DB option group resource. Documentation of the available options for various RDS engines can be found at:
+
+* [MariaDB Options](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Appendix.MariaDB.Options.html)
+* [Microsoft SQL Server Options](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Appendix.SQLServer.Options.html)
+* [MySQL Options](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Appendix.MySQL.Options.html)
+* [Oracle Options](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Appendix.Oracle.Options.html)
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DbOptionGroup } from "./.gen/providers/aws/db-option-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DbOptionGroup(this, "example", {
+      engineName: "sqlserver-ee",
+      majorEngineVersion: "11.00",
+      name: "option-group-test-terraform",
+      option: [
+        {
+          optionName: "Timezone",
+          optionSettings: [
+            {
+              name: "TIME_ZONE",
+              value: "UTC",
+            },
+          ],
+        },
+        {
+          optionName: "SQLSERVER_BACKUP_RESTORE",
+          optionSettings: [
+            {
+              name: "IAM_ROLE_ARN",
+              value: Token.asString(awsIamRoleExample.arn),
+            },
+          ],
+        },
+        {
+          optionName: "TDE",
+        },
+      ],
+      optionGroupDescription: "Terraform Option Group",
+    });
+  }
+}
+
+```
+
+~> **Note:** Any modifications to the `awsDbOptionGroup` are set to happen immediately as we default to applying immediately.
+
+~> **WARNING:** You can perform a destroy on a `awsDbOptionGroup`, as long as it is not associated with any Amazon RDS resource. An option group can be associated with a DB instance, a manual DB snapshot, or an automated DB snapshot.
+
+If you try to delete an option group that is associated with an Amazon RDS resource, an error similar to the following is returned:
+
+> An error occurred (InvalidOptionGroupStateFault) when calling the DeleteOptionGroup operation: The option group 'optionGroupName' cannot be deleted because it is in use.
+
+More information about this can be found [here](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_WorkingWithOptionGroups.html#USER_WorkingWithOptionGroups.Delete).
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Optional, Forces new resource) Name of the option group. If omitted, Terraform will assign a random, unique name. Must be lowercase, to match as it is stored in AWS.
+* `namePrefix` - (Optional, Forces new resource) Creates a unique name beginning with the specified prefix. Conflicts with `name`. Must be lowercase, to match as it is stored in AWS.
+* `optionGroupDescription` - (Optional) Description of the option group. Defaults to "Managed by Terraform".
+* `engineName` - (Required) Specifies the name of the engine that this option group should be associated with.
+* `majorEngineVersion` - (Required) Specifies the major version of the engine that this option group should be associated with.
+* `option` - (Optional) List of options to apply.
+* `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+`option` blocks support the following:
+
+* `optionName` - (Required) Name of the option (e.g., MEMCACHED).
+* `optionSettings` - (Optional) List of option settings to apply.
+* `port` - (Optional) Port number when connecting to the option (e.g., 11211). Leaving out or removing `port` from your configuration does not remove or clear a port from the option in AWS. AWS may assign a default port. Not including `port` in your configuration means that the AWS provider will ignore a previously set value, a value set by AWS, and any port changes.
+* `version` - (Optional) Version of the option (e.g., 13.1.0.0). Leaving out or removing `version` from your configuration does not remove or clear a version from the option in AWS. AWS may assign a default version. Not including `version` in your configuration means that the AWS provider will ignore a previously set value, a value set by AWS, and any version changes.
+* `dbSecurityGroupMemberships` - (Optional) List of DB Security Groups for which the option is enabled.
+* `vpcSecurityGroupMemberships` - (Optional) List of VPC Security Groups for which the option is enabled.
+
+`optionSettings` blocks support the following:
+
+* `name` - (Optional) Name of the setting.
+* `value` - (Optional) Value of the setting.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - DB option group name.
+* `arn` - ARN of the DB option group.
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `delete` - (Default `15M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DB option groups using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import DB option groups using the `name`. For example:
+
+```console
+% terraform import aws_db_option_group.example mysql-option-group
+```
+
+<!-- cache-key: cdktf-0.18.0 input-62a59e358d472f90cc96a8b627a9411731fa9d779529aff440ffd21e6234b0b2 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/db_parameter_group.html.markdown b/website/docs/cdktf/typescript/r/db_parameter_group.html.markdown
new file mode 100644
index 00000000000..b7e7aca6a77
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/db_parameter_group.html.markdown
@@ -0,0 +1,162 @@
+---
+subcategory: "RDS (Relational Database)"
+layout: "aws"
+page_title: "AWS: aws_db_parameter_group"
+description: |-
+  Provides an RDS DB parameter group resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_db_parameter_group
+
+Provides an RDS DB parameter group resource. Documentation of the available parameters for various RDS engines can be found at:
+
+* [Aurora MySQL Parameters](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/AuroraMySQL.Reference.html)
+* [Aurora PostgreSQL Parameters](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/AuroraPostgreSQL.Reference.html)
+* [MariaDB Parameters](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Appendix.MariaDB.Parameters.html)
+* [Oracle Parameters](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_ModifyInstance.Oracle.html#USER_ModifyInstance.Oracle.sqlnet)
+* [PostgreSQL Parameters](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Appendix.PostgreSQL.CommonDBATasks.html#Appendix.PostgreSQL.CommonDBATasks.Parameters)
+
+> **Hands-on:** For an example of the `awsDbParameterGroup` in use, follow the [Manage AWS RDS Instances](https://learn.hashicorp.com/tutorials/terraform/aws-rds?in=terraform/aws&utm_source=WEBSITE&utm_medium=WEB_IO&utm_offer=ARTICLE_PAGE&utm_content=DOCS) tutorial on HashiCorp Learn.
+
+~> **NOTE:** After applying your changes, you may encounter a perpetual diff in your Terraform plan
+output for a `parameter` whose `value` remains unchanged but whose `applyMethod` is changing
+(e.g., from `immediate` to `pendingReboot`, or `pendingReboot` to `immediate`). If only the
+apply method of a parameter is changing, the AWS API will not register this change. To change
+the `applyMethod` of a parameter, its value must also change.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DbParameterGroup } from "./.gen/providers/aws/db-parameter-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DbParameterGroup(this, "default", {
+      family: "mysql5.6",
+      name: "rds-pg",
+      parameter: [
+        {
+          name: "character_set_server",
+          value: "utf8",
+        },
+        {
+          name: "character_set_client",
+          value: "utf8",
+        },
+      ],
+    });
+  }
+}
+
+```
+
+### `createBeforeDestroy` Lifecycle Configuration
+
+The [`createBeforeDestroy`](https://developer.hashicorp.com/terraform/language/meta-arguments/lifecycle#create_before_destroy)
+lifecycle configuration is necessary for modifications that force re-creation of an existing,
+in-use parameter group. This includes common situations like changing the group `name` or
+bumping the `family` version during a major version upgrade. This configuration will prevent destruction
+of the deposed parameter group while still in use by the database during upgrade.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DbInstance } from "./.gen/providers/aws/db-instance";
+import { DbParameterGroup } from "./.gen/providers/aws/db-parameter-group";
+interface MyConfig {
+  instanceClass: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    const example = new DbParameterGroup(this, "example", {
+      family: "postgres13",
+      lifecycle: {
+        createBeforeDestroy: true,
+      },
+      name: "my-pg",
+      parameter: [
+        {
+          name: "log_connections",
+          value: "1",
+        },
+      ],
+    });
+    const awsDbInstanceExample = new DbInstance(this, "example_1", {
+      applyImmediately: true,
+      parameterGroupName: example.name,
+      instanceClass: config.instanceClass,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsDbInstanceExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Optional, Forces new resource) The name of the DB parameter group. If omitted, Terraform will assign a random, unique name.
+* `namePrefix` - (Optional, Forces new resource) Creates a unique name beginning with the specified prefix. Conflicts with `name`.
+* `family` - (Required, Forces new resource) The family of the DB parameter group.
+* `description` - (Optional, Forces new resource) The description of the DB parameter group. Defaults to "Managed by Terraform".
+* `parameter` - (Optional) A list of DB parameters to apply. Note that parameters may differ from a family to an other. Full list of all parameters can be discovered via [`aws rds describe-db-parameters`](https://docs.aws.amazon.com/cli/latest/reference/rds/describe-db-parameters.html) after initial creation of the group.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+Parameter blocks support the following:
+
+* `name` - (Required) The name of the DB parameter.
+* `value` - (Required) The value of the DB parameter.
+* `applyMethod` - (Optional) "immediate" (default), or "pending-reboot". Some
+    engines can't apply some parameters without a reboot, and you will need to
+    specify "pending-reboot" here.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The db parameter group name.
+* `arn` - The ARN of the db parameter group.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DB Parameter groups using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import DB Parameter groups using the `name`. For example:
+
+```console
+% terraform import aws_db_parameter_group.rds_pg rds-pg
+```
+
+<!-- cache-key: cdktf-0.18.0 input-58d3afb77ce85c7eccf039e1c08d533c541b3a0e93a559083e86605494ac1352 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/db_proxy.html.markdown b/website/docs/cdktf/typescript/r/db_proxy.html.markdown
new file mode 100644
index 00000000000..51d196f4b06
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/db_proxy.html.markdown
@@ -0,0 +1,119 @@
+---
+subcategory: "RDS (Relational Database)"
+layout: "aws"
+page_title: "AWS: aws_db_proxy"
+description: |-
+  Provides an RDS DB proxy resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_db_proxy
+
+Provides an RDS DB proxy resource. For additional information, see the [RDS User Guide](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/rds-proxy.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DbProxy } from "./.gen/providers/aws/db-proxy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DbProxy(this, "example", {
+      auth: [
+        {
+          authScheme: "SECRETS",
+          description: "example",
+          iamAuth: "DISABLED",
+          secretArn: Token.asString(awsSecretsmanagerSecretExample.arn),
+        },
+      ],
+      debugLogging: false,
+      engineFamily: "MYSQL",
+      idleClientTimeout: 1800,
+      name: "example",
+      requireTls: true,
+      roleArn: Token.asString(awsIamRoleExample.arn),
+      tags: {
+        Key: "value",
+        Name: "example",
+      },
+      vpcSecurityGroupIds: [Token.asString(awsSecurityGroupExample.id)],
+      vpcSubnetIds: [Token.asString(awsSubnetExample.id)],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The identifier for the proxy. This name must be unique for all proxies owned by your AWS account in the specified AWS Region. An identifier must begin with a letter and must contain only ASCII letters, digits, and hyphens; it can't end with a hyphen or contain two consecutive hyphens.
+* `auth` - (Required) Configuration block(s) with authorization mechanisms to connect to the associated instances or clusters. Described below.
+* `debugLogging` - (Optional) Whether the proxy includes detailed information about SQL statements in its logs. This information helps you to debug issues involving SQL behavior or the performance and scalability of the proxy connections. The debug information includes the text of SQL statements that you submit through the proxy. Thus, only enable this setting when needed for debugging, and only when you have security measures in place to safeguard any sensitive information that appears in the logs.
+* `engineFamily` - (Required, Forces new resource) The kinds of databases that the proxy can connect to. This value determines which database network protocol the proxy recognizes when it interprets network traffic to and from the database. For Aurora MySQL, RDS for MariaDB, and RDS for MySQL databases, specify `mysql`. For Aurora PostgreSQL and RDS for PostgreSQL databases, specify `postgresql`. For RDS for Microsoft SQL Server, specify `sqlserver`. Valid values are `mysql`, `postgresql`, and `sqlserver`.
+* `idleClientTimeout` - (Optional) The number of seconds that a connection to the proxy can be inactive before the proxy disconnects it. You can set this value higher or lower than the connection timeout limit for the associated database.
+* `requireTls` - (Optional) A Boolean parameter that specifies whether Transport Layer Security (TLS) encryption is required for connections to the proxy. By enabling this setting, you can enforce encrypted TLS connections to the proxy.
+* `roleArn` - (Required) The Amazon Resource Name (ARN) of the IAM role that the proxy uses to access secrets in AWS Secrets Manager.
+* `vpcSecurityGroupIds` - (Optional) One or more VPC security group IDs to associate with the new proxy.
+* `vpcSubnetIds` - (Required) One or more VPC subnet IDs to associate with the new proxy.
+* `tags` - (Optional) A mapping of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+`auth` blocks support the following:
+
+* `authScheme` - (Optional) The type of authentication that the proxy uses for connections from the proxy to the underlying database. One of `secrets`.
+* `clientPasswordAuthType` - (Optional) The type of authentication the proxy uses for connections from clients. Valid values are `mysqlNativePassword`, `postgresScramSha256`, `postgresMd5`, and `sqlServerAuthentication`.
+* `description` - (Optional) A user-specified description about the authentication used by a proxy to log in as a specific database user.
+* `iamAuth` - (Optional) Whether to require or disallow AWS Identity and Access Management (IAM) authentication for connections to the proxy. One of `disabled`, `required`.
+* `secretArn` - (Optional) The Amazon Resource Name (ARN) representing the secret that the proxy uses to authenticate to the RDS DB instance or Aurora DB cluster. These secrets are stored within Amazon Secrets Manager.
+* `username` - (Optional) The name of the database user to which the proxy connects.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Amazon Resource Name (ARN) for the proxy.
+* `arn` - The Amazon Resource Name (ARN) for the proxy.
+* `endpoint` - The endpoint that you can use to connect to the proxy. You include the endpoint value in the connection string for a database client application.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `30M`)
+- `update` - (Default `30M`)
+- `delete` - (Default `60M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DB proxies using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import DB proxies using the `name`. For example:
+
+```console
+% terraform import aws_db_proxy.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-8a3c238396074ac96e7b1e4adfae2e3755201827cad27408ac90aeb3b6b1ca32 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/db_proxy_default_target_group.html.markdown b/website/docs/cdktf/typescript/r/db_proxy_default_target_group.html.markdown
new file mode 100644
index 00000000000..0163016348e
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/db_proxy_default_target_group.html.markdown
@@ -0,0 +1,127 @@
+---
+subcategory: "RDS (Relational Database)"
+layout: "aws"
+page_title: "AWS: aws_db_proxy_default_target_group"
+description: |-
+  Manage an RDS DB proxy default target group resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_db_proxy_default_target_group
+
+Provides a resource to manage an RDS DB proxy default target group resource.
+
+The `awsDbProxyDefaultTargetGroup` behaves differently from normal resources, in that Terraform does not _create_ or _destroy_ this resource, since it implicitly exists as part of an RDS DB Proxy. On Terraform resource creation it is automatically imported and on resource destruction, Terraform performs no actions in RDS.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DbProxy } from "./.gen/providers/aws/db-proxy";
+import { DbProxyDefaultTargetGroup } from "./.gen/providers/aws/db-proxy-default-target-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new DbProxy(this, "example", {
+      auth: [
+        {
+          authScheme: "SECRETS",
+          description: "example",
+          iamAuth: "DISABLED",
+          secretArn: Token.asString(awsSecretsmanagerSecretExample.arn),
+        },
+      ],
+      debugLogging: false,
+      engineFamily: "MYSQL",
+      idleClientTimeout: 1800,
+      name: "example",
+      requireTls: true,
+      roleArn: Token.asString(awsIamRoleExample.arn),
+      tags: {
+        Key: "value",
+        Name: "example",
+      },
+      vpcSecurityGroupIds: [Token.asString(awsSecurityGroupExample.id)],
+      vpcSubnetIds: [Token.asString(awsSubnetExample.id)],
+    });
+    const awsDbProxyDefaultTargetGroupExample = new DbProxyDefaultTargetGroup(
+      this,
+      "example_1",
+      {
+        connectionPoolConfig: {
+          connectionBorrowTimeout: 120,
+          initQuery: "SET x=1, y=2",
+          maxConnectionsPercent: 100,
+          maxIdleConnectionsPercent: 50,
+          sessionPinningFilters: ["EXCLUDE_VARIABLE_SETS"],
+        },
+        dbProxyName: example.name,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsDbProxyDefaultTargetGroupExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `dbProxyName` - (Required) Name of the RDS DB Proxy.
+* `connectionPoolConfig` - (Optional) The settings that determine the size and behavior of the connection pool for the target group.
+
+`connectionPoolConfig` blocks support the following:
+
+* `connectionBorrowTimeout` - (Optional) The number of seconds for a proxy to wait for a connection to become available in the connection pool. Only applies when the proxy has opened its maximum number of connections and all connections are busy with client sessions.
+* `initQuery` - (Optional) One or more SQL statements for the proxy to run when opening each new database connection. Typically used with `set` statements to make sure that each connection has identical settings such as time zone and character set. This setting is empty by default. For multiple statements, use semicolons as the separator. You can also include multiple variables in a single `set` statement, such as `SET x=1, y=2`.
+* `maxConnectionsPercent` - (Optional) The maximum size of the connection pool for each target in a target group. For Aurora MySQL, it is expressed as a percentage of the max_connections setting for the RDS DB instance or Aurora DB cluster used by the target group.
+* `maxIdleConnectionsPercent` - (Optional) Controls how actively the proxy closes idle database connections in the connection pool. A high value enables the proxy to leave a high percentage of idle connections open. A low value causes the proxy to close idle client connections and return the underlying database connections to the connection pool. For Aurora MySQL, it is expressed as a percentage of the max_connections setting for the RDS DB instance or Aurora DB cluster used by the target group.
+* `sessionPinningFilters` - (Optional) Each item in the list represents a class of SQL operations that normally cause all later statements in a session using a proxy to be pinned to the same underlying database connection. Including an item in the list exempts that class of SQL operations from the pinning behavior. Currently, the only allowed value is `excludeVariableSets`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Name of the RDS DB Proxy.
+* `arn` - The Amazon Resource Name (ARN) representing the target group.
+* `name` - The name of the default target group.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `30M`)
+- `update` - (Default `30M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DB proxy default target groups using the `dbProxyName`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import DB proxy default target groups using the `dbProxyName`. For example:
+
+```console
+% terraform import aws_db_proxy_default_target_group.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-586609f3d8c714e67602a68a74614deb7a87a2757faa28cdcb1f6179fbffb6a9 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/db_proxy_endpoint.html.markdown b/website/docs/cdktf/typescript/r/db_proxy_endpoint.html.markdown
new file mode 100644
index 00000000000..ac632610d52
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/db_proxy_endpoint.html.markdown
@@ -0,0 +1,91 @@
+---
+subcategory: "RDS (Relational Database)"
+layout: "aws"
+page_title: "AWS: aws_db_proxy_endpoint"
+description: |-
+  Provides an RDS DB proxy endpoint resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_db_proxy_endpoint
+
+Provides an RDS DB proxy endpoint resource. For additional information, see the [RDS User Guide](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/rds-proxy-endpoints.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DbProxyEndpoint } from "./.gen/providers/aws/db-proxy-endpoint";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DbProxyEndpoint(this, "example", {
+      dbProxyEndpointName: "example",
+      dbProxyName: test.name,
+      targetRole: "READ_ONLY",
+      vpcSubnetIds: Token.asList(Fn.lookupNested(awsSubnetTest, ["*", "id"])),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `dbProxyEndpointName` - (Required) The identifier for the proxy endpoint. An identifier must begin with a letter and must contain only ASCII letters, digits, and hyphens; it can't end with a hyphen or contain two consecutive hyphens.
+* `dbProxyName` - (Required) The name of the DB proxy associated with the DB proxy endpoint that you create.
+* `vpcSubnetIds` - (Required) One or more VPC subnet IDs to associate with the new proxy.
+* `vpcSecurityGroupIds` - (Optional) One or more VPC security group IDs to associate with the new proxy.
+* `targetRole` - (Optional) Indicates whether the DB proxy endpoint can be used for read/write or read-only operations. The default is `readWrite`. Valid values are `readWrite` and `readOnly`.
+* `tags` - (Optional) A mapping of tags to assign to the resource.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name of the proxy and proxy endpoint separated by `/`, `dbProxyName/dbProxyEndpointName`.
+* `arn` - The Amazon Resource Name (ARN) for the proxy endpoint.
+* `endpoint` - The endpoint that you can use to connect to the proxy. You include the endpoint value in the connection string for a database client application.
+* `isDefault` - Indicates whether this endpoint is the default endpoint for the associated DB proxy.
+* `vpcId` - The VPC ID of the DB proxy endpoint.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `30M`)
+- `update` - (Default `30M`)
+- `delete` - (Default `60M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DB proxy endpoints using the `dbProxyName/dbProxyEndpointName`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import DB proxy endpoints using the `dbProxyName/dbProxyEndpointName`. For example:
+
+```console
+% terraform import aws_db_proxy_endpoint.example example/example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-350a8a6ad58a9a637252ca5d1e91e374fee3e01e2e35b79ea8ea63a3a00e8a4d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/db_proxy_target.html.markdown b/website/docs/cdktf/typescript/r/db_proxy_target.html.markdown
new file mode 100644
index 00000000000..67c8079179c
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/db_proxy_target.html.markdown
@@ -0,0 +1,150 @@
+---
+subcategory: "RDS (Relational Database)"
+layout: "aws"
+page_title: "AWS: aws_db_proxy_target"
+description: |-
+  Provides an RDS DB proxy target resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_db_proxy_target
+
+Provides an RDS DB proxy target resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DbProxy } from "./.gen/providers/aws/db-proxy";
+import { DbProxyDefaultTargetGroup } from "./.gen/providers/aws/db-proxy-default-target-group";
+import { DbProxyTarget } from "./.gen/providers/aws/db-proxy-target";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new DbProxy(this, "example", {
+      auth: [
+        {
+          authScheme: "SECRETS",
+          description: "example",
+          iamAuth: "DISABLED",
+          secretArn: Token.asString(awsSecretsmanagerSecretExample.arn),
+        },
+      ],
+      debugLogging: false,
+      engineFamily: "MYSQL",
+      idleClientTimeout: 1800,
+      name: "example",
+      requireTls: true,
+      roleArn: Token.asString(awsIamRoleExample.arn),
+      tags: {
+        Key: "value",
+        Name: "example",
+      },
+      vpcSecurityGroupIds: [Token.asString(awsSecurityGroupExample.id)],
+      vpcSubnetIds: [Token.asString(awsSubnetExample.id)],
+    });
+    const awsDbProxyDefaultTargetGroupExample = new DbProxyDefaultTargetGroup(
+      this,
+      "example_1",
+      {
+        connectionPoolConfig: {
+          connectionBorrowTimeout: 120,
+          initQuery: "SET x=1, y=2",
+          maxConnectionsPercent: 100,
+          maxIdleConnectionsPercent: 50,
+          sessionPinningFilters: ["EXCLUDE_VARIABLE_SETS"],
+        },
+        dbProxyName: example.name,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsDbProxyDefaultTargetGroupExample.overrideLogicalId("example");
+    const awsDbProxyTargetExample = new DbProxyTarget(this, "example_2", {
+      dbInstanceIdentifier: Token.asString(awsDbInstanceExample.identifier),
+      dbProxyName: example.name,
+      targetGroupName: Token.asString(awsDbProxyDefaultTargetGroupExample.name),
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsDbProxyTargetExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `dbProxyName` - (Required, Forces new resource) The name of the DB proxy.
+* `targetGroupName` - (Required, Forces new resource) The name of the target group.
+* `dbInstanceIdentifier` - (Optional, Forces new resource) DB instance identifier.
+* `dbClusterIdentifier` - (Optional, Forces new resource) DB cluster identifier.
+
+**NOTE:** Either `dbInstanceIdentifier` or `dbClusterIdentifier` should be specified and both should not be specified together
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `endpoint` - Hostname for the target RDS DB Instance. Only returned for `rdsInstance` type.
+* `id` - Identifier of  `dbProxyName`, `targetGroupName`, target type (e.g., `rdsInstance` or `trackedCluster`), and resource identifier separated by forward slashes (`/`).
+* `port` - Port for the target RDS DB Instance or Aurora DB Cluster.
+* `rdsResourceId` - Identifier representing the DB Instance or DB Cluster target.
+* `targetArn` - Amazon Resource Name (ARN) for the DB instance or DB cluster. Currently not returned by the RDS API.
+* `trackedClusterId` - DB Cluster identifier for the DB Instance target. Not returned unless manually importing an `rdsInstance` target that is part of a DB Cluster.
+* `type` - Type of targetE.g., `rdsInstance` or `trackedCluster`
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import RDS DB Proxy Targets using the `dbProxyName`, `targetGroupName`, target type (such as `rdsInstance` or `trackedCluster`), and resource identifier separated by forward slashes (`/`). For example:
+
+Instances:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Provisioned Clusters:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+**Using `terraform import` to import** RDS DB Proxy Targets using the `dbProxyName`, `targetGroupName`, target type (such as `rdsInstance` or `trackedCluster`), and resource identifier separated by forward slashes (`/`). For example:
+
+Instances:
+
+```console
+% terraform import aws_db_proxy_target.example example-proxy/default/RDS_INSTANCE/example-instance
+```
+
+Provisioned Clusters:
+
+```console
+% terraform import aws_db_proxy_target.example example-proxy/default/TRACKED_CLUSTER/example-cluster
+```
+
+<!-- cache-key: cdktf-0.18.0 input-7434cf3969d924cf4dd540c487f947d3059ac1146283da81333dc7dd742fe6ae -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/db_snapshot.html.markdown b/website/docs/cdktf/typescript/r/db_snapshot.html.markdown
new file mode 100644
index 00000000000..418cfe43704
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/db_snapshot.html.markdown
@@ -0,0 +1,109 @@
+---
+subcategory: "RDS (Relational Database)"
+layout: "aws"
+page_title: "AWS: aws_db_snapshot"
+description: |-
+  Manages an RDS database instance snapshot.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_db_snapshot
+
+Manages an RDS database instance snapshot. For managing RDS database cluster snapshots, see the [`awsDbClusterSnapshot` resource](/docs/providers/aws/r/db_cluster_snapshot.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DbInstance } from "./.gen/providers/aws/db-instance";
+import { DbSnapshot } from "./.gen/providers/aws/db-snapshot";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const bar = new DbInstance(this, "bar", {
+      allocatedStorage: 10,
+      backupRetentionPeriod: 0,
+      dbName: "baz",
+      engine: "mysql",
+      engineVersion: "5.6.21",
+      instanceClass: "db.t2.micro",
+      maintenanceWindow: "Fri:09:00-Fri:09:30",
+      parameterGroupName: "default.mysql5.6",
+      password: "barbarbarbar",
+      username: "foo",
+    });
+    new DbSnapshot(this, "test", {
+      dbInstanceIdentifier: bar.identifier,
+      dbSnapshotIdentifier: "testsnapshot1234",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `dbInstanceIdentifier` - (Required) The DB Instance Identifier from which to take the snapshot.
+* `dbSnapshotIdentifier` - (Required) The Identifier for the snapshot.
+* `sharedAccounts` - (Optional) List of AWS Account ids to share snapshot with, use `all` to make snaphot public.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `allocatedStorage` - Specifies the allocated storage size in gigabytes (GB).
+* `availabilityZone` - Specifies the name of the Availability Zone the DB instance was located in at the time of the DB snapshot.
+* `dbSnapshotArn` - The Amazon Resource Name (ARN) for the DB snapshot.
+* `encrypted` - Specifies whether the DB snapshot is encrypted.
+* `engine` - Specifies the name of the database engine.
+* `engineVersion` - Specifies the version of the database engine.
+* `iops` - Specifies the Provisioned IOPS (I/O operations per second) value of the DB instance at the time of the snapshot.
+* `kmsKeyId` - The ARN for the KMS encryption key.
+* `licenseModel` - License model information for the restored DB instance.
+* `optionGroupName` - Provides the option group name for the DB snapshot.
+* `sourceDbSnapshotIdentifier` - The DB snapshot Arn that the DB snapshot was copied from. It only has value in case of cross customer or cross region copy.
+* `sourceRegion` - The region that the DB snapshot was created in or copied from.
+* `status` - Specifies the status of this DB snapshot.
+* `storageType` - Specifies the storage type associated with DB snapshot.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `vpcId` - Provides the VPC ID associated with the DB snapshot.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `20M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsDbSnapshot` using the snapshot identifier. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsDbSnapshot` using the snapshot identifier. For example:
+
+```console
+% terraform import aws_db_snapshot.example my-snapshot
+```
+
+<!-- cache-key: cdktf-0.18.0 input-41ad054e1cd5f9035a73439b5851601fe3048ea049009ee39814356714bc4d11 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/db_snapshot_copy.html.markdown b/website/docs/cdktf/typescript/r/db_snapshot_copy.html.markdown
new file mode 100644
index 00000000000..82e08bb8c7c
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/db_snapshot_copy.html.markdown
@@ -0,0 +1,125 @@
+---
+subcategory: "RDS (Relational Database)"
+layout: "aws"
+page_title: "AWS: aws_db_snapshot_copy"
+description: |-
+  Manages an RDS database instance snapshot copy.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_db_snapshot_copy
+
+Manages an RDS database instance snapshot copy. For managing RDS database cluster snapshots, see the [`awsDbClusterSnapshot` resource](/docs/providers/aws/r/db_cluster_snapshot.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DbInstance } from "./.gen/providers/aws/db-instance";
+import { DbSnapshot } from "./.gen/providers/aws/db-snapshot";
+import { DbSnapshotCopy } from "./.gen/providers/aws/db-snapshot-copy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new DbInstance(this, "example", {
+      allocatedStorage: 10,
+      backupRetentionPeriod: 0,
+      dbName: "baz",
+      engine: "mysql",
+      engineVersion: "5.6.21",
+      instanceClass: "db.t2.micro",
+      maintenanceWindow: "Fri:09:00-Fri:09:30",
+      parameterGroupName: "default.mysql5.6",
+      password: "barbarbarbar",
+      username: "foo",
+    });
+    const awsDbSnapshotExample = new DbSnapshot(this, "example_1", {
+      dbInstanceIdentifier: example.identifier,
+      dbSnapshotIdentifier: "testsnapshot1234",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsDbSnapshotExample.overrideLogicalId("example");
+    const awsDbSnapshotCopyExample = new DbSnapshotCopy(this, "example_2", {
+      sourceDbSnapshotIdentifier: Token.asString(
+        awsDbSnapshotExample.dbSnapshotArn
+      ),
+      targetDbSnapshotIdentifier: "testsnapshot1234-copy",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsDbSnapshotCopyExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `copyTags` - (Optional) Whether to copy existing tags. Defaults to `false`.
+* `destinationRegion` - (Optional) The Destination region to place snapshot copy.
+* `kmsKeyId` - (Optional) KMS key ID.
+* `optionGroupName`- (Optional) The name of an option group to associate with the copy of the snapshot.
+* `presignedUrl` - (Optional) he URL that contains a Signature Version 4 signed request.
+* `sourceDbSnapshotIdentifier` - (Required) Snapshot identifier of the source snapshot.
+* `targetCustomAvailabilityZone` - (Optional) The external custom Availability Zone.
+* `targetDbSnapshotIdentifier` - (Required) The Identifier for the snapshot.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Snapshot Identifier.
+* `allocatedStorage` - Specifies the allocated storage size in gigabytes (GB).
+* `availabilityZone` - Specifies the name of the Availability Zone the DB instance was located in at the time of the DB snapshot.
+* `dbSnapshotArn` - The Amazon Resource Name (ARN) for the DB snapshot.
+* `encrypted` - Specifies whether the DB snapshot is encrypted.
+* `engine` - Specifies the name of the database engine.
+* `engineVersion` - Specifies the version of the database engine.
+* `iops` - Specifies the Provisioned IOPS (I/O operations per second) value of the DB instance at the time of the snapshot.
+* `kmsKeyId` - The ARN for the KMS encryption key.
+* `licenseModel` - License model information for the restored DB instance.
+* `optionGroupName` - Provides the option group name for the DB snapshot.
+* `sourceDbSnapshotIdentifier` - The DB snapshot Arn that the DB snapshot was copied from. It only has value in case of cross customer or cross region copy.
+* `sourceRegion` - The region that the DB snapshot was created in or copied from.
+* `storageType` - Specifies the storage type associated with DB snapshot.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `vpcId` - Provides the VPC ID associated with the DB snapshot.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `20M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsDbSnapshotCopy` using the snapshot identifier. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsDbSnapshotCopy` using the snapshot identifier. For example:
+
+```console
+% terraform import aws_db_snapshot_copy.example my-snapshot
+```
+
+<!-- cache-key: cdktf-0.18.0 input-082f155090a12691f858aa1fdb27e4c7fb93bb3dd71c2796c7c873690f9af714 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/db_subnet_group.html.markdown b/website/docs/cdktf/typescript/r/db_subnet_group.html.markdown
new file mode 100644
index 00000000000..a64cf7b1770
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/db_subnet_group.html.markdown
@@ -0,0 +1,85 @@
+---
+subcategory: "RDS (Relational Database)"
+layout: "aws"
+page_title: "AWS: aws_db_subnet_group"
+description: |-
+  Provides an RDS DB subnet group resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_db_subnet_group
+
+Provides an RDS DB subnet group resource.
+
+> **Hands-on:** For an example of the `awsDbSubnetGroup` in use, follow the [Manage AWS RDS Instances](https://learn.hashicorp.com/tutorials/terraform/aws-rds?in=terraform/aws&utm_source=WEBSITE&utm_medium=WEB_IO&utm_offer=ARTICLE_PAGE&utm_content=DOCS) tutorial on HashiCorp Learn.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DbSubnetGroup } from "./.gen/providers/aws/db-subnet-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DbSubnetGroup(this, "default", {
+      name: "main",
+      subnetIds: [frontend.id, backend.id],
+      tags: {
+        Name: "My DB subnet group",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Optional, Forces new resource) The name of the DB subnet group. If omitted, Terraform will assign a random, unique name.
+* `namePrefix` - (Optional, Forces new resource) Creates a unique name beginning with the specified prefix. Conflicts with `name`.
+* `description` - (Optional) The description of the DB subnet group. Defaults to "Managed by Terraform".
+* `subnetIds` - (Required) A list of VPC subnet IDs.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The db subnet group name.
+* `arn` - The ARN of the db subnet group.
+* `supportedNetworkTypes` - The network type of the db subnet group.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `vpcId` - Provides the VPC ID of the DB subnet group.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DB Subnet groups using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import DB Subnet groups using the `name`. For example:
+
+```console
+% terraform import aws_db_subnet_group.default production-subnet-group
+```
+
+<!-- cache-key: cdktf-0.18.0 input-179353c0fba303d203c766c21037c29f91420947dad2e027698bb64aec31054a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/default_network_acl.html.markdown b/website/docs/cdktf/typescript/r/default_network_acl.html.markdown
new file mode 100644
index 00000000000..0bb8efb52b3
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/default_network_acl.html.markdown
@@ -0,0 +1,247 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_default_network_acl"
+description: |-
+  Manage a default network ACL.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_default_network_acl
+
+Provides a resource to manage a VPC's default network ACL. This resource can manage the default network ACL of the default or a non-default VPC.
+
+~> **NOTE:** This is an advanced resource with special caveats. Please read this document in its entirety before using this resource. The `awsDefaultNetworkAcl` behaves differently from normal resources. Terraform does not _create_ this resource but instead attempts to "adopt" it into management.
+
+Every VPC has a default network ACL that can be managed but not destroyed. When Terraform first adopts the Default Network ACL, it **immediately removes all rules in the ACL**. It then proceeds to create any rules specified in the configuration. This step is required so that only the rules specified in the configuration are created.
+
+This resource treats its inline rules as absolute; only the rules defined inline are created, and any additions/removals external to this resource will result in diffs being shown. For these reasons, this resource is incompatible with the `awsNetworkAclRule` resource.
+
+For more information about Network ACLs, see the AWS Documentation on [Network ACLs][aws-network-acls].
+
+## Example Usage
+
+### Basic Example
+
+The following config gives the Default Network ACL the same rules that AWS includes but pulls the resource under management by Terraform. This means that any ACL rules added or changed will be detected as drift.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Op, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DefaultNetworkAcl } from "./.gen/providers/aws/default-network-acl";
+import { Vpc } from "./.gen/providers/aws/vpc";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const mainvpc = new Vpc(this, "mainvpc", {
+      cidrBlock: "10.1.0.0/16",
+    });
+    new DefaultNetworkAcl(this, "default", {
+      defaultNetworkAclId: mainvpc.defaultNetworkAclId,
+      egress: [
+        {
+          action: "allow",
+          cidrBlock: "0.0.0.0/0",
+          fromPort: 0,
+          protocol: Token.asString(Op.negate(1)),
+          ruleNo: 100,
+          toPort: 0,
+        },
+      ],
+      ingress: [
+        {
+          action: "allow",
+          cidrBlock: "0.0.0.0/0",
+          fromPort: 0,
+          protocol: Token.asString(Op.negate(1)),
+          ruleNo: 100,
+          toPort: 0,
+        },
+      ],
+    });
+  }
+}
+
+```
+
+### Example: Deny All Egress Traffic, Allow Ingress
+
+The following denies all Egress traffic by omitting any `egress` rules, while including the default `ingress` rule to allow all traffic.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Op, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DefaultNetworkAcl } from "./.gen/providers/aws/default-network-acl";
+import { Vpc } from "./.gen/providers/aws/vpc";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const mainvpc = new Vpc(this, "mainvpc", {
+      cidrBlock: "10.1.0.0/16",
+    });
+    new DefaultNetworkAcl(this, "default", {
+      defaultNetworkAclId: mainvpc.defaultNetworkAclId,
+      ingress: [
+        {
+          action: "allow",
+          cidrBlock: Token.asString(awsDefaultVpcMainvpc.cidrBlock),
+          fromPort: 0,
+          protocol: Token.asString(Op.negate(1)),
+          ruleNo: 100,
+          toPort: 0,
+        },
+      ],
+    });
+  }
+}
+
+```
+
+### Example: Deny All Traffic To Any Subnet In The Default Network ACL
+
+This config denies all traffic in the Default ACL. This can be useful if you want to lock down the VPC to force all resources to assign a non-default ACL.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DefaultNetworkAcl } from "./.gen/providers/aws/default-network-acl";
+import { Vpc } from "./.gen/providers/aws/vpc";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const mainvpc = new Vpc(this, "mainvpc", {
+      cidrBlock: "10.1.0.0/16",
+    });
+    new DefaultNetworkAcl(this, "default", {
+      defaultNetworkAclId: mainvpc.defaultNetworkAclId,
+    });
+  }
+}
+
+```
+
+### Managing Subnets In A Default Network ACL
+
+Within a VPC, all Subnets must be associated with a Network ACL. In order to "delete" the association between a Subnet and a non-default Network ACL, the association is destroyed by replacing it with an association between the Subnet and the Default ACL instead.
+
+When managing the Default Network ACL, you cannot "remove" Subnets. Instead, they must be reassigned to another Network ACL, or the Subnet itself must be destroyed. Because of these requirements, removing the `subnetIds` attribute from the configuration of a `awsDefaultNetworkAcl` resource may result in a reoccurring plan, until the Subnets are reassigned to another Network ACL or are destroyed.
+
+Because Subnets are by default associated with the Default Network ACL, any non-explicit association will show up as a plan to remove the Subnet. For example: if you have a custom `awsNetworkAcl` with two subnets attached, and you remove the `awsNetworkAcl` resource, after successfully destroying this resource future plans will show a diff on the managed `awsDefaultNetworkAcl`, as those two Subnets have been orphaned by the now destroyed network acl and thus adopted by the Default Network ACL. In order to avoid a reoccurring plan, they will need to be reassigned, destroyed, or added to the `subnetIds` attribute of the `awsDefaultNetworkAcl` entry.
+
+As an alternative to the above, you can also specify the following lifecycle configuration in your `awsDefaultNetworkAcl` resource:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DefaultNetworkAcl } from "./.gen/providers/aws/default-network-acl";
+interface MyConfig {
+  defaultNetworkAclId: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new DefaultNetworkAcl(this, "default", {
+      lifecycle: {
+        ignoreChanges: [subnetIds],
+      },
+      defaultNetworkAclId: config.defaultNetworkAclId,
+    });
+  }
+}
+
+```
+
+### Removing `awsDefaultNetworkAcl` From Your Configuration
+
+Each AWS VPC comes with a Default Network ACL that cannot be deleted. The `awsDefaultNetworkAcl` allows you to manage this Network ACL, but Terraform cannot destroy it. Removing this resource from your configuration will remove it from your statefile and management, **but will not destroy the Network ACL.** All Subnets associations and ingress or egress rules will be left as they are at the time of removal. You can resume managing them via the AWS Console.
+
+## Argument Reference
+
+The following arguments are required:
+
+* `defaultNetworkAclId` - (Required) Network ACL ID to manage. This attribute is exported from `awsVpc`, or manually found via the AWS Console.
+
+The following arguments are optional:
+
+* `egress` - (Optional) Configuration block for an egress rule. Detailed below.
+* `ingress` - (Optional) Configuration block for an ingress rule. Detailed below.
+* `subnetIds` - (Optional) List of Subnet IDs to apply the ACL to. See the notes above on Managing Subnets in the Default Network ACL
+* `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### egress and ingress
+
+Both the `egress` and `ingress` configuration blocks have the same arguments.
+
+The following arguments are required:
+
+* `action` - (Required) The action to take.
+* `fromPort` - (Required) The from port to match.
+* `protocol` - (Required) The protocol to match. If using the -1 'all' protocol, you must specify a from and to port of 0.
+* `ruleNo` - (Required) The rule number. Used for ordering.
+* `toPort` - (Required) The to port to match.
+
+The following arguments are optional:
+
+* `cidrBlock` - (Optional) The CIDR block to match. This must be a valid network mask.
+* `icmpCode` - (Optional) The ICMP type code to be used. Default 0.
+* `icmpType` - (Optional) The ICMP type to be used. Default 0.
+* `ipv6CidrBlock` - (Optional) The IPv6 CIDR block.
+
+-> For more information on ICMP types and codes, see [Internet Control Message Protocol (ICMP) Parameters](https://www.iana.org/assignments/icmp-parameters/icmp-parameters.xhtml).
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Default Network ACL
+* `id` - ID of the Default Network ACL
+* `ownerId` - ID of the AWS account that owns the Default Network ACL
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `vpcId` -  ID of the associated VPC
+
+[aws-network-acls]: http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_ACLs.html
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Default Network ACLs using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Default Network ACLs using the `id`. For example:
+
+```console
+% terraform import aws_default_network_acl.sample acl-7aaabd18
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1ee0cdf2a65fb9b81bf170ed16e018fb9c51a76e5efe0185e333f268f198ed71 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/default_route_table.html.markdown b/website/docs/cdktf/typescript/r/default_route_table.html.markdown
new file mode 100644
index 00000000000..cdf8b098061
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/default_route_table.html.markdown
@@ -0,0 +1,161 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_default_route_table"
+description: |-
+  Provides a resource to manage a default route table of a VPC.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_default_route_table
+
+Provides a resource to manage a default route table of a VPC. This resource can manage the default route table of the default or a non-default VPC.
+
+~> **NOTE:** This is an advanced resource with special caveats. Please read this document in its entirety before using this resource. The `awsDefaultRouteTable` resource behaves differently from normal resources. Terraform does not _create_ this resource but instead attempts to "adopt" it into management. **Do not** use both `awsDefaultRouteTable` to manage a default route table **and** `awsMainRouteTableAssociation` with the same VPC due to possible route conflicts. See [aws_main_route_table_association][tf-main-route-table-association] documentation for more details.
+
+Every VPC has a default route table that can be managed but not destroyed. When Terraform first adopts a default route table, it **immediately removes all defined routes**. It then proceeds to create any routes specified in the configuration. This step is required so that only the routes specified in the configuration exist in the default route table.
+
+For more information, see the Amazon VPC User Guide on [Route Tables](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Route_Tables.html). For information about managing normal route tables in Terraform, see [`awsRouteTable`](/docs/providers/aws/r/route_table.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DefaultRouteTable } from "./.gen/providers/aws/default-route-table";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DefaultRouteTable(this, "example", {
+      defaultRouteTableId: Token.asString(awsVpcExample.defaultRouteTableId),
+      route: [
+        {
+          cidrBlock: "10.0.1.0/24",
+          gatewayId: Token.asString(awsInternetGatewayExample.id),
+        },
+        {
+          egressOnlyGatewayId: Token.asString(
+            awsEgressOnlyInternetGatewayExample.id
+          ),
+          ipv6CidrBlock: "::/0",
+        },
+      ],
+      tags: {
+        Name: "example",
+      },
+    });
+  }
+}
+
+```
+
+To subsequently remove all managed routes:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DefaultRouteTable } from "./.gen/providers/aws/default-route-table";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DefaultRouteTable(this, "example", {
+      defaultRouteTableId: Token.asString(awsVpcExample.defaultRouteTableId),
+      route: [],
+      tags: {
+        Name: "example",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `defaultRouteTableId` - (Required) ID of the default route table.
+
+The following arguments are optional:
+
+* `propagatingVgws` - (Optional) List of virtual gateways for propagation.
+* `route` - (Optional) Configuration block of routes. Detailed below. This argument is processed in [attribute-as-blocks mode](https://www.terraform.io/docs/configuration/attr-as-blocks.html). This means that omitting this argument is interpreted as ignoring any existing routes. To remove all managed routes an empty list should be specified. See the example above.
+* `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### route
+
+This argument is processed in [attribute-as-blocks mode](https://www.terraform.io/docs/configuration/attr-as-blocks.html).
+
+One of the following destination arguments must be supplied:
+
+* `cidrBlock` - (Required) The CIDR block of the route.
+* `ipv6CidrBlock` - (Optional) The Ipv6 CIDR block of the route
+* `destinationPrefixListId` - (Optional) The ID of a [managed prefix list](ec2_managed_prefix_list.html) destination of the route.
+
+One of the following target arguments must be supplied:
+
+* `coreNetworkArn` - (Optional) The Amazon Resource Name (ARN) of a core network.
+* `egressOnlyGatewayId` - (Optional) Identifier of a VPC Egress Only Internet Gateway.
+* `gatewayId` - (Optional) Identifier of a VPC internet gateway or a virtual private gateway.
+* `instanceId` - (Optional) Identifier of an EC2 instance.
+* `natGatewayId` - (Optional) Identifier of a VPC NAT gateway.
+* `networkInterfaceId` - (Optional) Identifier of an EC2 network interface.
+* `transitGatewayId` - (Optional) Identifier of an EC2 Transit Gateway.
+* `vpcEndpointId` - (Optional) Identifier of a VPC Endpoint. This route must be removed prior to VPC Endpoint deletion.
+* `vpcPeeringConnectionId` - (Optional) Identifier of a VPC peering connection.
+
+Note that the default route, mapping the VPC's CIDR block to "local", is created implicitly and cannot be specified.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the route table.
+* `arn` - The ARN of the route table.
+* `ownerId` - ID of the AWS account that owns the route table.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `vpcId` - ID of the VPC.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `2M`)
+- `update` - (Default `2M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Default VPC route tables using the `vpcId`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Default VPC route tables using the `vpcId`. For example:
+
+```console
+% terraform import aws_default_route_table.example vpc-33cc44dd
+```
+
+[tf-main-route-table-association]: /docs/providers/aws/r/main_route_table_association.html
+
+<!-- cache-key: cdktf-0.18.0 input-52890b2ce73c129b096972d97be8827bd1630df722976c50bc3863ebadce1093 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/default_security_group.html.markdown b/website/docs/cdktf/typescript/r/default_security_group.html.markdown
new file mode 100644
index 00000000000..595d6ac35e0
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/default_security_group.html.markdown
@@ -0,0 +1,167 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_default_security_group"
+description: |-
+  Manage a default security group resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_default_security_group
+
+Provides a resource to manage a default security group. This resource can manage the default security group of the default or a non-default VPC.
+
+~> **NOTE:** This is an advanced resource with special caveats. Please read this document in its entirety before using this resource. The `awsDefaultSecurityGroup` resource behaves differently from normal resources. Terraform does not _create_ this resource but instead attempts to "adopt" it into management.
+
+When Terraform first begins managing the default security group, it **immediately removes all ingress and egress rules in the Security Group**. It then creates any rules specified in the configuration. This way only the rules specified in the configuration are created.
+
+This resource treats its inline rules as absolute; only the rules defined inline are created, and any additions/removals external to this resource will result in diff shown. For these reasons, this resource is incompatible with the `awsSecurityGroupRule` resource.
+
+For more information about default security groups, see the AWS documentation on [Default Security Groups][aws-default-security-groups]. To manage normal security groups, see the [`awsSecurityGroup`](/docs/providers/aws/r/security_group.html) resource.
+
+## Example Usage
+
+The following config gives the default security group the same rules that AWS provides by default but under management by Terraform. This means that any ingress or egress rules added or changed will be detected as drift.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Op, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DefaultSecurityGroup } from "./.gen/providers/aws/default-security-group";
+import { Vpc } from "./.gen/providers/aws/vpc";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const mainvpc = new Vpc(this, "mainvpc", {
+      cidrBlock: "10.1.0.0/16",
+    });
+    new DefaultSecurityGroup(this, "default", {
+      egress: [
+        {
+          cidrBlocks: ["0.0.0.0/0"],
+          fromPort: 0,
+          protocol: "-1",
+          toPort: 0,
+        },
+      ],
+      ingress: [
+        {
+          fromPort: 0,
+          protocol: Token.asString(Op.negate(1)),
+          selfAttribute: true,
+          toPort: 0,
+        },
+      ],
+      vpcId: mainvpc.id,
+    });
+  }
+}
+
+```
+
+### Example Config To Deny All Egress Traffic, Allowing Ingress
+
+The following denies all Egress traffic by omitting any `egress` rules, while including the default `ingress` rule to allow all traffic.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Op, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DefaultSecurityGroup } from "./.gen/providers/aws/default-security-group";
+import { Vpc } from "./.gen/providers/aws/vpc";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const mainvpc = new Vpc(this, "mainvpc", {
+      cidrBlock: "10.1.0.0/16",
+    });
+    new DefaultSecurityGroup(this, "default", {
+      ingress: [
+        {
+          fromPort: 0,
+          protocol: Token.asString(Op.negate(1)),
+          selfAttribute: true,
+          toPort: 0,
+        },
+      ],
+      vpcId: mainvpc.id,
+    });
+  }
+}
+
+```
+
+### Removing `awsDefaultSecurityGroup` From Your Configuration
+
+Removing this resource from your configuration will remove it from your statefile and management, but will not destroy the Security Group. All ingress or egress rules will be left as they are at the time of removal. You can resume managing them via the AWS Console.
+
+## Argument Reference
+
+The following arguments are optional:
+
+* `egress` - (Optional, VPC only) Configuration block. Detailed below.
+* `ingress` - (Optional) Configuration block. Detailed below.
+* `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `vpcId` - (Optional, Forces new resource) VPC ID. **Note that changing the `vpcId` will _not_ restore any default security group rules that were modified, added, or removed.** It will be left in its current state.
+
+### egress and ingress
+
+Both arguments are processed in [attribute-as-blocks mode](https://www.terraform.io/docs/configuration/attr-as-blocks.html).
+
+Both `egress` and `ingress` objects have the same arguments.
+
+* `cidrBlocks` - (Optional) List of CIDR blocks.
+* `description` - (Optional) Description of this rule.
+* `fromPort` - (Required) Start port (or ICMP type number if protocol is `icmp`)
+* `ipv6CidrBlocks` - (Optional) List of IPv6 CIDR blocks.
+* `prefixListIds` - (Optional) List of prefix list IDs (for allowing access to VPC endpoints)
+* `protocol` - (Required) Protocol. If you select a protocol of "-1" (semantically equivalent to `all`, which is not a valid value here), you must specify a `fromPort` and `toPort` equal to `0`. If not `icmp`, `tcp`, `udp`, or `1` use the [protocol number](https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml).
+* `securityGroups` - (Optional) List of security groups. A group name can be used relative to the default VPC. Otherwise, group ID.
+* `self` - (Optional) Whether the security group itself will be added as a source to this egress rule.
+* `toPort` - (Required) End range port (or ICMP code if protocol is `icmp`).
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the security group.
+* `description` - Description of the security group.
+* `id` - ID of the security group.
+* `name` - Name of the security group.
+* `ownerId` - Owner ID.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+[aws-default-security-groups]: http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-network-security.html#default-security-group
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Security Groups using the security group `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Security Groups using the security group `id`. For example:
+
+```console
+% terraform import aws_default_security_group.default_sg sg-903004f8
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1772c4a79e74a3aeb963e0bbd212a020fc07e8e9c6c1eef173ce3d3d6f84d54b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/default_subnet.html.markdown b/website/docs/cdktf/typescript/r/default_subnet.html.markdown
new file mode 100644
index 00000000000..55868dc1bfb
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/default_subnet.html.markdown
@@ -0,0 +1,89 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_default_subnet"
+description: |-
+  Manage a default subnet resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_default_subnet
+
+Provides a resource to manage a [default subnet](http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/default-vpc.html#default-vpc-basics) in the current region.
+
+**This is an advanced resource** and has special caveats to be aware of when using it. Please read this document in its entirety before using this resource.
+
+The `awsDefaultSubnet` resource behaves differently from normal resources in that if a default subnet exists in the specified Availability Zone, Terraform does not _create_ this resource, but instead "adopts" it into management.
+If no default subnet exists, Terraform creates a new default subnet.
+By default, `terraform destroy` does not delete the default subnet but does remove the resource from Terraform state.
+Set the `forceDestroy` argument to `true` to delete the default subnet.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DefaultSubnet } from "./.gen/providers/aws/default-subnet";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DefaultSubnet(this, "default_az1", {
+      availabilityZone: "us-west-2a",
+      tags: {
+        Name: "Default subnet for us-west-2a",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The arguments of an `awsDefaultSubnet` differ slightly from those of [`awsSubnet`](subnet.html):
+
+* `availabilityZone` is required
+* The `availabilityZoneId`, `cidrBlock` and `vpcId` arguments become computed attributes
+* The default value for `mapPublicIpOnLaunch` is `true`
+
+This resource supports the following additional arguments:
+
+* `forceDestroy` - (Optional) Whether destroying the resource deletes the default subnet. Default: `false`
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `availabilityZoneId` - The AZ ID of the subnet
+* `cidrBlock` - The IPv4 CIDR block assigned to the subnet
+* `vpcId` - The ID of the VPC the subnet is in
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import subnets using the subnet `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import subnets using the subnet `id`. For example:
+
+```console
+% terraform import aws_default_subnet.public_subnet subnet-9d4a7b6c
+```
+
+<!-- cache-key: cdktf-0.18.0 input-946ded19323b4288f4f2e72461cc5948a23ea35404090c8cf1614d4381c9ce49 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/default_vpc.html.markdown b/website/docs/cdktf/typescript/r/default_vpc.html.markdown
new file mode 100644
index 00000000000..7f1017de2d8
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/default_vpc.html.markdown
@@ -0,0 +1,91 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_default_vpc"
+description: |-
+  Manage a default VPC resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_default_vpc
+
+Provides a resource to manage the [default AWS VPC](http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/default-vpc.html)
+in the current AWS Region.
+
+If you created your AWS account after 2013-12-04 you have a default VPC in each AWS Region.
+
+**This is an advanced resource** and has special caveats to be aware of when using it. Please read this document in its entirety before using this resource.
+
+The `awsDefaultVpc` resource behaves differently from normal resources in that if a default VPC exists, Terraform does not _create_ this resource, but instead "adopts" it into management.
+If no default VPC exists, Terraform creates a new default VPC, which leads to the implicit creation of [other resources](https://docs.aws.amazon.com/vpc/latest/userguide/default-vpc.html#default-vpc-components).
+By default, `terraform destroy` does not delete the default VPC but does remove the resource from Terraform state.
+Set the `forceDestroy` argument to `true` to delete the default VPC.
+
+## Example Usage
+
+Basic usage with tags:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DefaultVpc } from "./.gen/providers/aws/default-vpc";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DefaultVpc(this, "default", {
+      tags: {
+        Name: "Default VPC",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The arguments of an `awsDefaultVpc` differ slightly from those of [`awsVpc`](vpc.html):
+
+* The `cidrBlock` and `instanceTenancy` arguments become computed attributes
+* The default value for `enableDnsHostnames` is `true`
+
+This resource supports the following additional arguments:
+
+* `forceDestroy` - (Optional) Whether destroying the resource deletes the default VPC. Default: `false`
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `cidrBlock` - The primary IPv4 CIDR block for the VPC
+* `instanceTenancy` - The allowed tenancy of instances launched into the VPC
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Default VPCs using the VPC `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Default VPCs using the VPC `id`. For example:
+
+```console
+% terraform import aws_default_vpc.default vpc-a01106c2
+```
+
+<!-- cache-key: cdktf-0.18.0 input-23d964c1dc88c45ec1734d4089d10399fa0b6a694656d6ed659894a9f0b6dd98 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/default_vpc_dhcp_options.html.markdown b/website/docs/cdktf/typescript/r/default_vpc_dhcp_options.html.markdown
new file mode 100644
index 00000000000..b065c3bd4db
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/default_vpc_dhcp_options.html.markdown
@@ -0,0 +1,97 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_default_vpc_dhcp_options"
+description: |-
+  Manage the default VPC DHCP Options resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_default_vpc_dhcp_options
+
+Provides a resource to manage the [default AWS DHCP Options Set](http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_DHCP_Options.html#AmazonDNS)
+in the current region.
+
+Each AWS region comes with a default set of DHCP options.
+**This is an advanced resource**, and has special caveats to be aware of when
+using it. Please read this document in its entirety before using this resource.
+
+The `awsDefaultVpcDhcpOptions` behaves differently from normal resources, in that
+Terraform does not _create_ this resource, but instead "adopts" it
+into management.
+
+## Example Usage
+
+Basic usage with tags:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DefaultVpcDhcpOptions } from "./.gen/providers/aws/default-vpc-dhcp-options";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DefaultVpcDhcpOptions(this, "default", {
+      tags: {
+        Name: "Default DHCP Option Set",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The arguments of an `awsDefaultVpcDhcpOptions` differ slightly from `awsVpcDhcpOptions`  resources.
+Namely, the `domainName`, `domainNameServers` and `ntpServers` arguments are computed.
+The following arguments are still supported:
+
+* `netbiosNameServers` - (Optional) List of NETBIOS name servers.
+* `netbiosNodeType` - (Optional) The NetBIOS node type (1, 2, 4, or 8). AWS recommends to specify 2 since broadcast and multicast are not supported in their network. For more information about these node types, see [RFC 2132](http://www.ietf.org/rfc/rfc2132.txt).
+* `ownerId` - The ID of the AWS account that owns the DHCP options set.
+* `tags` - (Optional) A map of tags to assign to the resource.
+
+### Removing `awsDefaultVpcDhcpOptions` from your configuration
+
+The `awsDefaultVpcDhcpOptions` resource allows you to manage a region's default DHCP Options Set,
+but Terraform cannot destroy it. Removing this resource from your configuration
+will remove it from your statefile and management, but will not destroy the DHCP Options Set.
+You can resume managing the DHCP Options Set via the AWS Console.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the DHCP Options Set.
+* `arn` - The ARN of the DHCP Options Set.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import VPC DHCP Options using the DHCP Options `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import VPC DHCP Options using the DHCP Options `id`. For example:
+
+```console
+% terraform import aws_default_vpc_dhcp_options.default_options dopt-d9070ebb
+```
+
+<!-- cache-key: cdktf-0.18.0 input-21aa3abe1b6cf1b9d60f1d171804683cdd303ce6ce4e6aea648ed7c2d5d6b7c2 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/detective_graph.html.markdown b/website/docs/cdktf/typescript/r/detective_graph.html.markdown
new file mode 100644
index 00000000000..213cfcda626
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/detective_graph.html.markdown
@@ -0,0 +1,75 @@
+---
+subcategory: "Detective"
+layout: "aws"
+page_title: "AWS: aws_detective_graph"
+description: |-
+  Provides a resource to manage an Amazon Detective graph.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_detective_graph
+
+Provides a resource to manage an [AWS Detective Graph](https://docs.aws.amazon.com/detective/latest/APIReference/API_CreateGraph.html). As an AWS account may own only one Detective graph per region, provisioning multiple Detective graphs requires a separate provider configuration for each graph.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DetectiveGraph } from "./.gen/providers/aws/detective-graph";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DetectiveGraph(this, "example", {
+      tags: {
+        Name: "example-detective-graph",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are optional:
+
+* `tags` -  (Optional) A map of tags to assign to the instance. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - ARN of the Detective Graph.
+* `graphArn` - ARN of the Detective Graph.
+* `createdTime` - Date and time, in UTC and extended RFC 3339 format, when the Amazon Detective Graph was created.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsDetectiveGraph` using the ARN. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsDetectiveGraph` using the ARN. For example:
+
+```console
+% terraform import aws_detective_graph.example arn:aws:detective:us-east-1:123456789101:graph:231684d34gh74g4bae1dbc7bd807d02d
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ee8961bdda24bd4636640d877e7c8cec4877ed2d26e63964d9fab2e0003f440c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/detective_invitation_accepter.html.markdown b/website/docs/cdktf/typescript/r/detective_invitation_accepter.html.markdown
new file mode 100644
index 00000000000..340dce5f3a6
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/detective_invitation_accepter.html.markdown
@@ -0,0 +1,84 @@
+---
+subcategory: "Detective"
+layout: "aws"
+page_title: "AWS: aws_detective_invitation_accepter"
+description: |-
+  Provides a resource to manage an Amazon Detective member invitation accepter.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_detective_invitation_accepter
+
+Provides a resource to manage an [Amazon Detective Invitation Accepter](https://docs.aws.amazon.com/detective/latest/APIReference/API_AcceptInvitation.html). Ensure that the accepter is configured to use the AWS account you wish to _accept_ the invitation from the primary graph owner account.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DetectiveGraph } from "./.gen/providers/aws/detective-graph";
+import { DetectiveInvitationAccepter } from "./.gen/providers/aws/detective-invitation-accepter";
+import { DetectiveMember } from "./.gen/providers/aws/detective-member";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const primary = new DetectiveGraph(this, "primary", {});
+    const awsDetectiveMemberPrimary = new DetectiveMember(this, "primary_1", {
+      accountId: "ACCOUNT ID",
+      emailAddress: "EMAIL",
+      graphArn: primary.id,
+      message: "Message of the invite",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsDetectiveMemberPrimary.overrideLogicalId("primary");
+    new DetectiveInvitationAccepter(this, "member", {
+      dependsOn: [awsDetectiveMemberPrimary],
+      graphArn: primary.graphArn,
+      provider: "awsalternate",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `graphArn` - (Required) ARN of the behavior graph that the member account is accepting the invitation for.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Unique identifier (ID) of the Detective invitation accepter.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsDetectiveInvitationAccepter` using the graph ARN. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsDetectiveInvitationAccepter` using the graph ARN. For example:
+
+```console
+% terraform import aws_detective_invitation_accepter.example arn:aws:detective:us-east-1:123456789101:graph:231684d34gh74g4bae1dbc7bd807d02d
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ca2bf5e5cb9affcfcf860965a82f07a76d1193a82b4cdb53e84a5d10e901c8a0 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/detective_member.html.markdown b/website/docs/cdktf/typescript/r/detective_member.html.markdown
new file mode 100644
index 00000000000..2aeb0f80c64
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/detective_member.html.markdown
@@ -0,0 +1,88 @@
+---
+subcategory: "Detective"
+layout: "aws"
+page_title: "AWS: aws_detective_member"
+description: |-
+  Provides a resource to manage an Amazon Detective member.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_detective_member
+
+Provides a resource to manage an [Amazon Detective Member](https://docs.aws.amazon.com/detective/latest/APIReference/API_CreateMembers.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DetectiveGraph } from "./.gen/providers/aws/detective-graph";
+import { DetectiveMember } from "./.gen/providers/aws/detective-member";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new DetectiveGraph(this, "example", {});
+    const awsDetectiveMemberExample = new DetectiveMember(this, "example_1", {
+      accountId: "AWS ACCOUNT ID",
+      disableEmailNotification: true,
+      emailAddress: "EMAIL",
+      graphArn: example.id,
+      message: "Message of the invitation",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsDetectiveMemberExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `accountId` - (Required) AWS account ID for the account.
+* `emailAddress` - (Required) Email address for the account.
+* `graphArn` - (Required) ARN of the behavior graph to invite the member accounts to contribute their data to.
+* `message` - (Optional) A custom message to include in the invitation. Amazon Detective adds this message to the standard content that it sends for an invitation.
+* `disableEmailNotification` - (Optional) If set to true, then the root user of the invited account will _not_ receive an email notification. This notification is in addition to an alert that the root user receives in AWS Personal Health Dashboard. By default, this is set to `false`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Unique identifier (ID) of the Detective.
+* `status` - Current membership status of the member account.
+* `administratorId` - AWS account ID for the administrator account.
+* `volumeUsageInBytes` - Data volume in bytes per day for the member account.
+* `invitedTime` - Date and time, in UTC and extended RFC 3339 format, when an Amazon Detective membership invitation was last sent to the account.
+* `updatedTime` - Date and time, in UTC and extended RFC 3339 format, of the most recent change to the member account's status.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsDetectiveMember` using the ARN of the graph followed by the account ID of the member account. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsDetectiveMember` using the ARN of the graph followed by the account ID of the member account. For example:
+
+```console
+% terraform import aws_detective_member.example arn:aws:detective:us-east-1:123456789101:graph:231684d34gh74g4bae1dbc7bd807d02d/123456789012
+```
+
+<!-- cache-key: cdktf-0.18.0 input-4108f05240e0c0f62d7dfe1e0039f5231d9901dad3b7104a04e9f1121a124644 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/devicefarm_device_pool.html.markdown b/website/docs/cdktf/typescript/r/devicefarm_device_pool.html.markdown
new file mode 100644
index 00000000000..6694dd90973
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/devicefarm_device_pool.html.markdown
@@ -0,0 +1,89 @@
+---
+subcategory: "Device Farm"
+layout: "aws"
+page_title: "AWS: aws_devicefarm_device_pool"
+description: |-
+  Provides a Devicefarm device_pool
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_devicefarm_device_pool
+
+Provides a resource to manage AWS Device Farm Device Pools.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DevicefarmDevicePool } from "./.gen/providers/aws/devicefarm-device-pool";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DevicefarmDevicePool(this, "example", {
+      name: "example",
+      projectArn: Token.asString(awsDevicefarmProjectExample.arn),
+      rule: [
+        {
+          attribute: "OS_VERSION",
+          operator: "EQUALS",
+          value: '\\"AVAILABLE\\"',
+        },
+      ],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `name` - (Required) The name of the Device Pool
+* `projectArn` - (Required) The ARN of the project for the device pool.
+* `rule` - (Required) The device pool's rules. See [Rule](#rule).
+* `description` - (Optional) The device pool's description.
+* `maxDevices` - (Optional) The number of devices that Device Farm can add to your device pool.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Rule
+
+* `attribute` - (Optional) The rule's stringified attribute. Valid values are: `appiumVersion`, `arn`, `availability`, `fleetType`, `formFactor`, `instanceArn`, `instanceLabels`, `manufacturer`, `model`, `osVersion`, `platform`, `remoteAccessEnabled`, `remoteDebugEnabled`.
+* `operator` - (Optional) Specifies how Device Farm compares the rule's attribute to the value. For the operators that are supported by each attribute. Valid values are: `equals`, `notIn`, `in`, `greaterThan`, `greaterThanOrEquals`, `lessThan`, `lessThanOrEquals`, `contains`.
+* `value` - (Optional) The rule's value.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name of this Device Pool
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DeviceFarm Device Pools using their ARN. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import DeviceFarm Device Pools using their ARN. For example:
+
+```console
+% terraform import aws_devicefarm_device_pool.example arn:aws:devicefarm:us-west-2:123456789012:devicepool:4fa784c7-ccb4-4dbf-ba4f-02198320daa1/4fa784c7-ccb4-4dbf-ba4f-02198320daa1
+```
+
+<!-- cache-key: cdktf-0.18.0 input-70dc4ff5fd779dddf25798da293a38ce0cbfa6d4a0332256582b1806152f2230 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/devicefarm_instance_profile.html.markdown b/website/docs/cdktf/typescript/r/devicefarm_instance_profile.html.markdown
new file mode 100644
index 00000000000..10ab1d3e305
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/devicefarm_instance_profile.html.markdown
@@ -0,0 +1,77 @@
+---
+subcategory: "Device Farm"
+layout: "aws"
+page_title: "AWS: aws_devicefarm_instance_profile"
+description: |-
+  Provides a Devicefarm instance profile
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_devicefarm_instance_profile
+
+Provides a resource to manage AWS Device Farm Instance Profiles.
+∂
+~> **NOTE:** AWS currently has limited regional support for Device Farm (e.g., `usWest2`). See [AWS Device Farm endpoints and quotas](https://docs.aws.amazon.com/general/latest/gr/devicefarm.html) for information on supported regions.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DevicefarmInstanceProfile } from "./.gen/providers/aws/devicefarm-instance-profile";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DevicefarmInstanceProfile(this, "example", {
+      name: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `description` - (Optional) The description of the instance profile.
+* `excludeAppPackagesFromCleanup` - (Optional) An array of strings that specifies the list of app packages that should not be cleaned up from the device after a test run.
+* `name` - (Required) The name for the instance profile.
+* `packageCleanup` - (Optional) When set to `true`, Device Farm removes app packages after a test run. The default value is `false` for private devices.
+* `rebootAfterUse` - (Optional) When set to `true`, Device Farm reboots the instance after a test run. The default value is `true`.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name of this instance profile.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DeviceFarm Instance Profiles using their ARN. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import DeviceFarm Instance Profiles using their ARN. For example:
+
+```console
+% terraform import aws_devicefarm_instance_profile.example arn:aws:devicefarm:us-west-2:123456789012:instanceprofile:4fa784c7-ccb4-4dbf-ba4f-02198320daa1
+```
+
+<!-- cache-key: cdktf-0.18.0 input-869291a59b04d3cacb00462dab45e1d4434b9d843a3070738a3d718940fb202b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/devicefarm_network_profile.html.markdown b/website/docs/cdktf/typescript/r/devicefarm_network_profile.html.markdown
new file mode 100644
index 00000000000..aecb993c497
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/devicefarm_network_profile.html.markdown
@@ -0,0 +1,95 @@
+---
+subcategory: "Device Farm"
+layout: "aws"
+page_title: "AWS: aws_devicefarm_network_profile"
+description: |-
+  Provides a Devicefarm network profile
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_devicefarm_network_profile
+
+Provides a resource to manage AWS Device Farm Network Profiles.
+∂
+~> **NOTE:** AWS currently has limited regional support for Device Farm (e.g., `usWest2`). See [AWS Device Farm endpoints and quotas](https://docs.aws.amazon.com/general/latest/gr/devicefarm.html) for information on supported regions.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DevicefarmNetworkProfile } from "./.gen/providers/aws/devicefarm-network-profile";
+import { DevicefarmProject } from "./.gen/providers/aws/devicefarm-project";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new DevicefarmProject(this, "example", {
+      name: "example",
+    });
+    const awsDevicefarmNetworkProfileExample = new DevicefarmNetworkProfile(
+      this,
+      "example_1",
+      {
+        name: "example",
+        projectArn: example.arn,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsDevicefarmNetworkProfileExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+* `description` - (Optional) The description of the network profile.
+* `downlinkBandwidthBits` - (Optional) The data throughput rate in bits per second, as an integer from `0` to `104857600`. Default value is `104857600`.
+* `downlinkDelayMs` - (Optional) Delay time for all packets to destination in milliseconds as an integer from `0` to `2000`.
+* `downlinkJitterMs` - (Optional) Time variation in the delay of received packets in milliseconds as an integer from `0` to `2000`.
+* `downlinkLossPercent` - (Optional) Proportion of received packets that fail to arrive from `0` to `100` percent.
+* `name` - (Required) The name for the network profile.
+* `uplinkBandwidthBits` - (Optional) The data throughput rate in bits per second, as an integer from `0` to `104857600`. Default value is `104857600`.
+* `uplinkDelayMs` - (Optional) Delay time for all packets to destination in milliseconds as an integer from `0` to `2000`.
+* `uplinkJitterMs` - (Optional) Time variation in the delay of received packets in milliseconds as an integer from `0` to `2000`.
+* `uplinkLossPercent` - (Optional) Proportion of received packets that fail to arrive from `0` to `100` percent.
+* `projectArn` - (Required) The ARN of the project for the network profile.
+* `type` - (Optional) The type of network profile to create. Valid values are listed are `private` and `curated`.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name of this network profile.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DeviceFarm Network Profiles using their ARN. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import DeviceFarm Network Profiles using their ARN. For example:
+
+```console
+% terraform import aws_devicefarm_network_profile.example arn:aws:devicefarm:us-west-2:123456789012:networkprofile:4fa784c7-ccb4-4dbf-ba4f-02198320daa1
+```
+
+<!-- cache-key: cdktf-0.18.0 input-82616cb48039f8368ead9b616e986d34cc6658f5bc299c003c202bc94e665131 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/devicefarm_project.html.markdown b/website/docs/cdktf/typescript/r/devicefarm_project.html.markdown
new file mode 100644
index 00000000000..09549df5e6b
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/devicefarm_project.html.markdown
@@ -0,0 +1,79 @@
+---
+subcategory: "Device Farm"
+layout: "aws"
+page_title: "AWS: aws_devicefarm_project"
+description: |-
+  Provides a Devicefarm project
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_devicefarm_project
+
+Provides a resource to manage AWS Device Farm Projects.
+
+For more information about Device Farm Projects, see the AWS Documentation on
+[Device Farm Projects][aws-get-project].
+
+~> **NOTE:** AWS currently has limited regional support for Device Farm (e.g., `usWest2`). See [AWS Device Farm endpoints and quotas](https://docs.aws.amazon.com/general/latest/gr/devicefarm.html) for information on supported regions.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DevicefarmProject } from "./.gen/providers/aws/devicefarm-project";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DevicefarmProject(this, "awesome_devices", {
+      name: "my-device-farm",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `name` - (Required) The name of the project
+* `defaultJobTimeoutMinutes` - (Optional) Sets the execution timeout value (in minutes) for a project. All test runs in this project use the specified execution timeout value unless overridden when scheduling a run.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name of this project
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+[aws-get-project]: http://docs.aws.amazon.com/devicefarm/latest/APIReference/API_GetProject.html
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DeviceFarm Projects using their ARN. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import DeviceFarm Projects using their ARN. For example:
+
+```console
+% terraform import aws_devicefarm_project.example arn:aws:devicefarm:us-west-2:123456789012:project:4fa784c7-ccb4-4dbf-ba4f-02198320daa1
+```
+
+<!-- cache-key: cdktf-0.18.0 input-fea501aea933ca5c661b1980e1f92d94c086b5241762d0510490c8478e31499d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/devicefarm_test_grid_project.html.markdown b/website/docs/cdktf/typescript/r/devicefarm_test_grid_project.html.markdown
new file mode 100644
index 00000000000..33db0c08744
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/devicefarm_test_grid_project.html.markdown
@@ -0,0 +1,88 @@
+---
+subcategory: "Device Farm"
+layout: "aws"
+page_title: "AWS: aws_devicefarm_test_grid_project"
+description: |-
+  Provides a Devicefarm test_grid_project
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_devicefarm_test_grid_project
+
+Provides a resource to manage AWS Device Farm Test Grid Projects.
+
+~> **NOTE:** AWS currently has limited regional support for Device Farm (e.g., `usWest2`). See [AWS Device Farm endpoints and quotas](https://docs.aws.amazon.com/general/latest/gr/devicefarm.html) for information on supported regions.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DevicefarmTestGridProject } from "./.gen/providers/aws/devicefarm-test-grid-project";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DevicefarmTestGridProject(this, "example", {
+      name: "example",
+      vpcConfig: {
+        securityGroupIds: Token.asList(
+          Fn.lookupNested(awsSecurityGroupExample, ["*", "id"])
+        ),
+        subnetIds: Token.asList(Fn.lookupNested(awsSubnetExample, ["*", "id"])),
+        vpcId: Token.asString(awsVpcExample.id),
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `name` - (Required) The name of the Selenium testing project.
+* `description` - (Optional) Human-readable description of the project.
+* `vpcConfig` - (Required) The VPC security groups and subnets that are attached to a project. See [VPC Config](#vpc-config) below.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### VPC Config
+
+* `securityGroupIds` - (Required) A list of VPC security group IDs in your Amazon VPC.
+* `subnetIds` - (Required) A list of VPC subnet IDs in your Amazon VPC.
+* `vpcId` - (Required) The ID of the Amazon VPC.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name of this Test Grid Project.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DeviceFarm Test Grid Projects using their ARN. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import DeviceFarm Test Grid Projects using their ARN. For example:
+
+```console
+% terraform import aws_devicefarm_test_grid_project.example arn:aws:devicefarm:us-west-2:123456789012:testgrid-project:4fa784c7-ccb4-4dbf-ba4f-02198320daa1
+```
+
+<!-- cache-key: cdktf-0.18.0 input-2f5eb3ada6471cdbf41632a80ae508f4c526e15908f83a9d3ac70cb7c05f37b2 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/devicefarm_upload.html.markdown b/website/docs/cdktf/typescript/r/devicefarm_upload.html.markdown
new file mode 100644
index 00000000000..5abe0f154de
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/devicefarm_upload.html.markdown
@@ -0,0 +1,85 @@
+---
+subcategory: "Device Farm"
+layout: "aws"
+page_title: "AWS: aws_devicefarm_upload"
+description: |-
+  Provides a Devicefarm upload
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_devicefarm_upload
+
+Provides a resource to manage AWS Device Farm Uploads.
+
+~> **NOTE:** AWS currently has limited regional support for Device Farm (e.g., `usWest2`). See [AWS Device Farm endpoints and quotas](https://docs.aws.amazon.com/general/latest/gr/devicefarm.html) for information on supported regions.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DevicefarmProject } from "./.gen/providers/aws/devicefarm-project";
+import { DevicefarmUpload } from "./.gen/providers/aws/devicefarm-upload";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new DevicefarmProject(this, "example", {
+      name: "example",
+    });
+    const awsDevicefarmUploadExample = new DevicefarmUpload(this, "example_1", {
+      name: "example",
+      projectArn: example.arn,
+      type: "APPIUM_JAVA_TESTNG_TEST_SPEC",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsDevicefarmUploadExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+* `contentType` - (Optional) The upload's content type (for example, application/octet-stream).
+* `name` - (Required) The upload's file name. The name should not contain any forward slashes (/). If you are uploading an iOS app, the file name must end with the .ipa extension. If you are uploading an Android app, the file name must end with the .apk extension. For all others, the file name must end with the .zip file extension.
+* `projectArn` - (Required) The ARN of the project for the upload.
+* `type` - (Required) The upload's upload type. See [AWS Docs](https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_CreateUpload.html#API_CreateUpload_RequestSyntax) for valid list of values.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name of this upload.
+* `url` - The presigned Amazon S3 URL that was used to store a file using a PUT request.
+* `category` - The upload's category.
+* `metadata` - The upload's metadata. For example, for Android, this contains information that is parsed from the manifest and is displayed in the AWS Device Farm console after the associated app is uploaded.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DeviceFarm Uploads using their ARN. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import DeviceFarm Uploads using their ARN. For example:
+
+```console
+% terraform import aws_devicefarm_upload.example arn:aws:devicefarm:us-west-2:123456789012:upload:4fa784c7-ccb4-4dbf-ba4f-02198320daa1
+```
+
+<!-- cache-key: cdktf-0.18.0 input-157c6a3834c0d5903b438d5bff03780c3535132f31f3df5b70aed301ac010dfd -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/directory_service_conditional_forwarder.html.markdown b/website/docs/cdktf/typescript/r/directory_service_conditional_forwarder.html.markdown
new file mode 100644
index 00000000000..dd5e8c034e6
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/directory_service_conditional_forwarder.html.markdown
@@ -0,0 +1,73 @@
+---
+subcategory: "Directory Service"
+layout: "aws"
+page_title: "AWS: aws_directory_service_conditional_forwarder"
+description: |-
+  Provides a conditional forwarder for managed Microsoft AD in AWS Directory Service.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_directory_service_conditional_forwarder
+
+Provides a conditional forwarder for managed Microsoft AD in AWS Directory Service.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DirectoryServiceConditionalForwarder } from "./.gen/providers/aws/directory-service-conditional-forwarder";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DirectoryServiceConditionalForwarder(this, "example", {
+      directoryId: ad.id,
+      dnsIps: ["8.8.8.8", "8.8.4.4"],
+      remoteDomainName: "example.com",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `directoryId` - (Required) ID of directory.
+* `dnsIps` - (Required) A list of forwarder IP addresses.
+* `remoteDomainName` - (Required) The fully qualified domain name of the remote domain for which forwarders will be used.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import conditional forwarders using the directory id and remote_domain_name. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import conditional forwarders using the directory id and remote_domain_name. For example:
+
+```console
+% terraform import aws_directory_service_conditional_forwarder.example d-1234567890:example.com
+```
+
+<!-- cache-key: cdktf-0.18.0 input-6c5202e2bda00c02157b7a412c0e460a4f86c81c2eec1650454ecd36ded52d0d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/directory_service_directory.html.markdown b/website/docs/cdktf/typescript/r/directory_service_directory.html.markdown
new file mode 100644
index 00000000000..a9ff7c0f280
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/directory_service_directory.html.markdown
@@ -0,0 +1,245 @@
+---
+subcategory: "Directory Service"
+layout: "aws"
+page_title: "AWS: aws_directory_service_directory"
+description: |-
+  Provides a directory in AWS Directory Service.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_directory_service_directory
+
+Provides a Simple or Managed Microsoft directory in AWS Directory Service.
+
+~> **Note:** All arguments including the password and customer username will be stored in the raw state as plain-text.
+[Read more about sensitive data in state](https://www.terraform.io/docs/state/sensitive-data.html).
+
+## Example Usage
+
+### SimpleAD
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DirectoryServiceDirectory } from "./.gen/providers/aws/directory-service-directory";
+import { Subnet } from "./.gen/providers/aws/subnet";
+import { Vpc } from "./.gen/providers/aws/vpc";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const main = new Vpc(this, "main", {
+      cidrBlock: "10.0.0.0/16",
+    });
+    const bar = new Subnet(this, "bar", {
+      availabilityZone: "us-west-2b",
+      cidrBlock: "10.0.2.0/24",
+      vpcId: main.id,
+    });
+    const foo = new Subnet(this, "foo", {
+      availabilityZone: "us-west-2a",
+      cidrBlock: "10.0.1.0/24",
+      vpcId: main.id,
+    });
+    const awsDirectoryServiceDirectoryBar = new DirectoryServiceDirectory(
+      this,
+      "bar_3",
+      {
+        name: "corp.notexample.com",
+        password: "SuperSecretPassw0rd",
+        size: "Small",
+        tags: {
+          Project: "foo",
+        },
+        vpcSettings: {
+          subnetIds: [foo.id, bar.id],
+          vpcId: main.id,
+        },
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsDirectoryServiceDirectoryBar.overrideLogicalId("bar");
+  }
+}
+
+```
+
+### Microsoft Active Directory (MicrosoftAD)
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DirectoryServiceDirectory } from "./.gen/providers/aws/directory-service-directory";
+import { Subnet } from "./.gen/providers/aws/subnet";
+import { Vpc } from "./.gen/providers/aws/vpc";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const main = new Vpc(this, "main", {
+      cidrBlock: "10.0.0.0/16",
+    });
+    const bar = new Subnet(this, "bar", {
+      availabilityZone: "us-west-2b",
+      cidrBlock: "10.0.2.0/24",
+      vpcId: main.id,
+    });
+    const foo = new Subnet(this, "foo", {
+      availabilityZone: "us-west-2a",
+      cidrBlock: "10.0.1.0/24",
+      vpcId: main.id,
+    });
+    const awsDirectoryServiceDirectoryBar = new DirectoryServiceDirectory(
+      this,
+      "bar_3",
+      {
+        edition: "Standard",
+        name: "corp.notexample.com",
+        password: "SuperSecretPassw0rd",
+        tags: {
+          Project: "foo",
+        },
+        type: "MicrosoftAD",
+        vpcSettings: {
+          subnetIds: [foo.id, bar.id],
+          vpcId: main.id,
+        },
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsDirectoryServiceDirectoryBar.overrideLogicalId("bar");
+  }
+}
+
+```
+
+### Microsoft Active Directory Connector (ADConnector)
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DirectoryServiceDirectory } from "./.gen/providers/aws/directory-service-directory";
+import { Subnet } from "./.gen/providers/aws/subnet";
+import { Vpc } from "./.gen/providers/aws/vpc";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const main = new Vpc(this, "main", {
+      cidrBlock: "10.0.0.0/16",
+    });
+    const bar = new Subnet(this, "bar", {
+      availabilityZone: "us-west-2b",
+      cidrBlock: "10.0.2.0/24",
+      vpcId: main.id,
+    });
+    const foo = new Subnet(this, "foo", {
+      availabilityZone: "us-west-2a",
+      cidrBlock: "10.0.1.0/24",
+      vpcId: main.id,
+    });
+    new DirectoryServiceDirectory(this, "connector", {
+      connectSettings: {
+        customerDnsIps: ["A.B.C.D"],
+        customerUsername: "Admin",
+        subnetIds: [foo.id, bar.id],
+        vpcId: main.id,
+      },
+      name: "corp.notexample.com",
+      password: "SuperSecretPassw0rd",
+      size: "Small",
+      type: "ADConnector",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The fully qualified name for the directory, such as `corpExampleCom`
+* `password` - (Required) The password for the directory administrator or connector user.
+* `size` - (Optional) (For `simpleAd` and `adConnector` types) The size of the directory (`small` or `large` are accepted values). `large` by default.
+* `vpcSettings` - (Required for `simpleAd` and `microsoftAd`) VPC related information about the directory. Fields documented below.
+* `connectSettings` - (Required for `adConnector`) Connector related information about the directory. Fields documented below.
+* `alias` - (Optional) The alias for the directory (must be unique amongst all aliases in AWS). Required for `enableSso`.
+* `description` - (Optional) A textual description for the directory.
+* `desiredNumberOfDomainControllers` - (Optional) The number of domain controllers desired in the directory. Minimum value of `2`. Scaling of domain controllers is only supported for `microsoftAd` directories.
+* `shortName` - (Optional) The short name of the directory, such as `corp`.
+* `enableSso` - (Optional) Whether to enable single-sign on for the directory. Requires `alias`. Defaults to `false`.
+* `type` (Optional) - The directory type (`simpleAd`, `adConnector` or `microsoftAd` are accepted values). Defaults to `simpleAd`.
+* `edition` - (Optional, for type `microsoftAd` only) The MicrosoftAD edition (`standard` or `enterprise`). Defaults to `enterprise`.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+**vpc_settings** supports the following:
+
+* `subnetIds` - (Required) The identifiers of the subnets for the directory servers (2 subnets in 2 different AZs).
+* `vpcId` - (Required) The identifier of the VPC that the directory is in.
+
+**connect_settings** supports the following:
+
+* `customerUsername` - (Required) The username corresponding to the password provided.
+* `customerDnsIps` - (Required) The DNS IP addresses of the domain to connect to.
+* `subnetIds` - (Required) The identifiers of the subnets for the directory servers (2 subnets in 2 different AZs).
+* `vpcId` - (Required) The identifier of the VPC that the directory is in.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The directory identifier.
+* `accessUrl` - The access URL for the directory, such as `http://aliasAwsappsCom`.
+* `dnsIpAddresses` - A list of IP addresses of the DNS servers for the directory or connector.
+* `securityGroupId` - The ID of the security group created by the directory.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+`connectSettings` (for `adConnector`) is also exported with the following attributes:
+
+* `connectIps` - The IP addresses of the AD Connector servers.
+
+## Timeouts
+
+`awsDirectoryServiceDirectory` provides the following [Timeouts](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts) configuration options:
+
+- `create` - (Default `60 minutes`) Used for directory creation
+- `update` - (Default `60 minutes`) Used for directory update
+- `delete` - (Default `60 minutes`) Used for directory deletion
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DirectoryService directories using the directory `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import DirectoryService directories using the directory `id`. For example:
+
+```console
+% terraform import aws_directory_service_directory.sample d-926724cf57
+```
+
+<!-- cache-key: cdktf-0.18.0 input-49c24dcd4cf67951f7f5fa46955d3c67849291a777e1963a25110967098be86d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/directory_service_log_subscription.html.markdown b/website/docs/cdktf/typescript/r/directory_service_log_subscription.html.markdown
new file mode 100644
index 00000000000..1192bab725b
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/directory_service_log_subscription.html.markdown
@@ -0,0 +1,108 @@
+---
+subcategory: "Directory Service"
+layout: "aws"
+page_title: "AWS: aws_directory_service_log_subscription"
+description: |-
+  Provides a Log subscription for AWS Directory Service that pushes logs to cloudwatch.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_directory_service_log_subscription
+
+Provides a Log subscription for AWS Directory Service that pushes logs to cloudwatch.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudwatchLogGroup } from "./.gen/providers/aws/cloudwatch-log-group";
+import { CloudwatchLogResourcePolicy } from "./.gen/providers/aws/cloudwatch-log-resource-policy";
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { DirectoryServiceLogSubscription } from "./.gen/providers/aws/directory-service-log-subscription";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new CloudwatchLogGroup(this, "example", {
+      name:
+        "/aws/directoryservice/${" +
+        awsDirectoryServiceDirectoryExample.id +
+        "}",
+      retentionInDays: 14,
+    });
+    const awsDirectoryServiceLogSubscriptionExample =
+      new DirectoryServiceLogSubscription(this, "example_1", {
+        directoryId: Token.asString(awsDirectoryServiceDirectoryExample.id),
+        logGroupName: example.name,
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsDirectoryServiceLogSubscriptionExample.overrideLogicalId("example");
+    const adLogPolicy = new DataAwsIamPolicyDocument(this, "ad-log-policy", {
+      statement: [
+        {
+          actions: ["logs:CreateLogStream", "logs:PutLogEvents"],
+          effect: "Allow",
+          principals: [
+            {
+              identifiers: ["ds.amazonaws.com"],
+              type: "Service",
+            },
+          ],
+          resources: ["${" + example.arn + "}:*"],
+        },
+      ],
+    });
+    const awsCloudwatchLogResourcePolicyAdLogPolicy =
+      new CloudwatchLogResourcePolicy(this, "ad-log-policy_3", {
+        policyDocument: Token.asString(adLogPolicy.json),
+        policyName: "ad-log-policy",
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsCloudwatchLogResourcePolicyAdLogPolicy.overrideLogicalId(
+      "ad-log-policy"
+    );
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `directoryId` - (Required) ID of directory.
+* `logGroupName` - (Required) Name of the cloudwatch log group to which the logs should be published. The log group should be already created and the directory service principal should be provided with required permission to create stream and publish logs. Changing this value would delete the current subscription and create a new one. A directory can only have one log subscription at a time.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Directory Service Log Subscriptions using the directory id. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Directory Service Log Subscriptions using the directory id. For example:
+
+```console
+% terraform import aws_directory_service_log_subscription.msad d-1234567890
+```
+
+<!-- cache-key: cdktf-0.18.0 input-4c454e09cdbbcc5b15311701235bc1776950d5a3aac1b39f531b202fbb8a7072 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/directory_service_radius_settings.html.markdown b/website/docs/cdktf/typescript/r/directory_service_radius_settings.html.markdown
new file mode 100644
index 00000000000..36bf2b469ad
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/directory_service_radius_settings.html.markdown
@@ -0,0 +1,93 @@
+---
+subcategory: "Directory Service"
+layout: "aws"
+page_title: "AWS: aws_directory_service_radius_settings"
+description: |-
+  Manages a directory's multi-factor authentication (MFA) using a Remote Authentication Dial In User Service (RADIUS) server.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_directory_service_radius_settings
+
+Manages a directory's multi-factor authentication (MFA) using a Remote Authentication Dial In User Service (RADIUS) server.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DirectoryServiceRadiusSettings } from "./.gen/providers/aws/directory-service-radius-settings";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DirectoryServiceRadiusSettings(this, "example", {
+      authenticationProtocol: "PAP",
+      directoryId: Token.asString(awsDirectoryServiceDirectoryExample.id),
+      displayLabel: "example",
+      radiusPort: 1812,
+      radiusRetries: 4,
+      radiusServers: ["10.0.1.5"],
+      radiusTimeout: 1,
+      sharedSecret: "12345678",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `authenticationProtocol` - (Optional) The protocol specified for your RADIUS endpoints. Valid values: `pap`, `chap`, `msChaPv1`, `msChaPv2`.
+* `directoryId` - (Required) The identifier of the directory for which you want to manager RADIUS settings.
+* `displayLabel` - (Required) Display label.
+* `radiusPort` - (Required) The port that your RADIUS server is using for communications. Your self-managed network must allow inbound traffic over this port from the AWS Directory Service servers.
+* `radiusRetries` - (Required) The maximum number of times that communication with the RADIUS server is attempted. Minimum value of `0`. Maximum value of `10`.
+* `radiusServers` - (Required) An array of strings that contains the fully qualified domain name (FQDN) or IP addresses of the RADIUS server endpoints, or the FQDN or IP addresses of your RADIUS server load balancer.
+* `radiusTimeout` - (Required) The amount of time, in seconds, to wait for the RADIUS server to respond. Minimum value of `1`. Maximum value of `50`.
+* `sharedSecret` - (Required) Required for enabling RADIUS on the directory.
+* `useSameUsername` - (Optional) Not currently used.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The directory identifier.
+
+## Timeouts
+
+`awsDirectoryServiceRadiusSettings` provides the following [Timeouts](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts) configuration options:
+
+- `create` - (Default `30 minutes`) Used for RADIUS settings creation
+- `update` - (Default `30 minutes`) Used for RADIUS settings update
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import RADIUS settings using the directory ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import RADIUS settings using the directory ID. For example:
+
+```console
+% terraform import aws_directory_service_radius_settings.example d-926724cf57
+```
+
+<!-- cache-key: cdktf-0.18.0 input-120cead939815417bd9577d93de9c412838e216cb9e55a21bc6d0f08acbd6ddc -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/directory_service_region.html.markdown b/website/docs/cdktf/typescript/r/directory_service_region.html.markdown
new file mode 100644
index 00000000000..f8973e20b02
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/directory_service_region.html.markdown
@@ -0,0 +1,221 @@
+---
+subcategory: "Directory Service"
+layout: "aws"
+page_title: "AWS: aws_directory_service_region"
+description: |-
+    Manages a replicated Region and directory for Multi-Region replication.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_directory_service_region
+
+Manages a replicated Region and directory for Multi-Region replication.
+Multi-Region replication is only supported for the Enterprise Edition of AWS Managed Microsoft AD.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformCount, Fn, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsAvailabilityZones } from "./.gen/providers/aws/data-aws-availability-zones";
+import { DataAwsRegion } from "./.gen/providers/aws/data-aws-region";
+import { DirectoryServiceDirectory } from "./.gen/providers/aws/directory-service-directory";
+import { DirectoryServiceRegion } from "./.gen/providers/aws/directory-service-region";
+import { AwsProvider } from "./.gen/providers/aws/provider";
+import { Subnet } from "./.gen/providers/aws/subnet";
+import { Vpc } from "./.gen/providers/aws/vpc";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AwsProvider(this, "aws", {
+      region: "us-west-2",
+    });
+    const secondary = new AwsProvider(this, "aws_1", {
+      alias: "secondary",
+      region: "us-east-2",
+    });
+    const example = new Vpc(this, "example", {
+      cidrBlock: "10.0.0.0/16",
+      tags: {
+        Name: "Primary",
+      },
+    });
+    const exampleSecondary = new Vpc(this, "example-secondary", {
+      cidrBlock: "10.1.0.0/16",
+      provider: secondary,
+      tags: {
+        Name: "Secondary",
+      },
+    });
+    const available = new DataAwsAvailabilityZones(this, "available", {
+      filter: [
+        {
+          name: "opt-in-status",
+          values: ["opt-in-not-required"],
+        },
+      ],
+      state: "available",
+    });
+    const availableSecondary = new DataAwsAvailabilityZones(
+      this,
+      "available-secondary",
+      {
+        filter: [
+          {
+            name: "opt-in-status",
+            values: ["opt-in-not-required"],
+          },
+        ],
+        provider: secondary,
+        state: "available",
+      }
+    );
+    const dataAwsRegionExample = new DataAwsRegion(this, "example_6", {
+      provider: secondary,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsRegionExample.overrideLogicalId("example");
+    /*In most cases loops should be handled in the programming language context and 
+    not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+    you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+    you need to keep this like it is.*/
+    const exampleCount = TerraformCount.of(Token.asNumber("2"));
+    const awsSubnetExample = new Subnet(this, "example_7", {
+      availabilityZone: Token.asString(
+        Fn.lookupNested(available.names, [exampleCount.index])
+      ),
+      cidrBlock: Token.asString(
+        Fn.cidrsubnet(example.cidrBlock, 8, Token.asNumber(exampleCount.index))
+      ),
+      tags: {
+        Name: "Primary",
+      },
+      vpcId: example.id,
+      count: exampleCount,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSubnetExample.overrideLogicalId("example");
+    /*In most cases loops should be handled in the programming language context and 
+    not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+    you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+    you need to keep this like it is.*/
+    const exampleSecondaryCount = TerraformCount.of(Token.asNumber("2"));
+    const awsSubnetExampleSecondary = new Subnet(this, "example-secondary_8", {
+      availabilityZone: Token.asString(
+        Fn.lookupNested(availableSecondary.names, [exampleSecondaryCount.index])
+      ),
+      cidrBlock: Token.asString(
+        Fn.cidrsubnet(
+          exampleSecondary.cidrBlock,
+          8,
+          Token.asNumber(exampleSecondaryCount.index)
+        )
+      ),
+      provider: secondary,
+      tags: {
+        Name: "Secondary",
+      },
+      vpcId: exampleSecondary.id,
+      count: exampleSecondaryCount,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSubnetExampleSecondary.overrideLogicalId("example-secondary");
+    const awsDirectoryServiceDirectoryExample = new DirectoryServiceDirectory(
+      this,
+      "example_9",
+      {
+        name: "example.com",
+        password: "SuperSecretPassw0rd",
+        type: "MicrosoftAD",
+        vpcSettings: {
+          subnetIds: Token.asList(
+            Fn.lookupNested(awsSubnetExample, ["*", "id"])
+          ),
+          vpcId: example.id,
+        },
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsDirectoryServiceDirectoryExample.overrideLogicalId("example");
+    const awsDirectoryServiceRegionExample = new DirectoryServiceRegion(
+      this,
+      "example_10",
+      {
+        directoryId: Token.asString(awsDirectoryServiceDirectoryExample.id),
+        regionName: Token.asString(dataAwsRegionExample.name),
+        tags: {
+          Name: "Secondary",
+        },
+        vpcSettings: {
+          subnetIds: Token.asList(
+            Fn.lookupNested(awsSubnetExampleSecondary, ["*", "id"])
+          ),
+          vpcId: exampleSecondary.id,
+        },
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsDirectoryServiceRegionExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `desiredNumberOfDomainControllers` - (Optional) The number of domain controllers desired in the replicated directory. Minimum value of `2`.
+* `directoryId` - (Required) The identifier of the directory to which you want to add Region replication.
+* `regionName` - (Required) The name of the Region where you want to add domain controllers for replication.
+* `tags` - (Optional) Map of tags to assign to this resource. If configured with a provider [`defaultTags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `vpcSettings` - (Required) VPC information in the replicated Region. Detailed below.
+
+### `vpcSettings`
+
+* `subnetIds` - (Required) The identifiers of the subnets for the directory servers.
+* `vpcId` - (Optional) The identifier of the VPC in which to create the directory.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block).
+
+## Timeouts
+
+`awsDirectoryServiceRegion` provides the following [Timeouts](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts) configuration options:
+
+- `create` - (Default `180 minutes`) Used for Region addition
+- `update` - (Default `90 minutes`) Used for replicated directory update
+- `delete` - (Default `90 minutes`) Used for Region removal
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Replicated Regions using directory ID,Region name. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Replicated Regions using directory ID,Region name. For example:
+
+```console
+% terraform import aws_directory_service_region.example d-9267651497,us-east-2
+```
+
+<!-- cache-key: cdktf-0.18.0 input-20d7af9911cb4ea2ab9c63d5899325921c11d1438c0a0bd4b54c4be7952b8fff -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/directory_service_shared_directory.html.markdown b/website/docs/cdktf/typescript/r/directory_service_shared_directory.html.markdown
new file mode 100644
index 00000000000..c702a398511
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/directory_service_shared_directory.html.markdown
@@ -0,0 +1,107 @@
+---
+subcategory: "Directory Service"
+layout: "aws"
+page_title: "AWS: aws_directory_service_shared_directory"
+description: |-
+    Manages a directory in your account (directory owner) shared with another account (directory consumer).
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_directory_service_shared_directory
+
+Manages a directory in your account (directory owner) shared with another account (directory consumer).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DirectoryServiceDirectory } from "./.gen/providers/aws/directory-service-directory";
+import { DirectoryServiceSharedDirectory } from "./.gen/providers/aws/directory-service-shared-directory";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new DirectoryServiceDirectory(this, "example", {
+      edition: "Standard",
+      name: "tf-example",
+      password: "SuperSecretPassw0rd",
+      type: "MicrosoftAD",
+      vpcSettings: {
+        subnetIds: Token.asList(Fn.lookupNested(awsSubnetExample, ["*", "id"])),
+        vpcId: Token.asString(awsVpcExample.id),
+      },
+    });
+    const awsDirectoryServiceSharedDirectoryExample =
+      new DirectoryServiceSharedDirectory(this, "example_1", {
+        directoryId: example.id,
+        notes: "You wanna have a catch?",
+        target: {
+          id: Token.asString(receiver.accountId),
+        },
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsDirectoryServiceSharedDirectoryExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `directoryId` - (Required) Identifier of the Managed Microsoft AD directory that you want to share with other accounts.
+* `target` - (Required) Identifier for the directory consumer account with whom the directory is to be shared. See below.
+
+The following arguments are optional:
+
+* `method` - (Optional) Method used when sharing a directory. Valid values are `organizations` and `handshake`. Default is `handshake`.
+* `notes` - (Optional, Sensitive) Message sent by the directory owner to the directory consumer to help the directory consumer administrator determine whether to approve or reject the share invitation.
+
+### `target`
+
+* `id` - (Required) Identifier of the directory consumer account.
+* `type` - (Optional) Type of identifier to be used in the `id` field. Valid value is `account`. Default is `account`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Identifier of the shared directory.
+* `sharedDirectoryId` - Identifier of the directory that is stored in the directory consumer account that corresponds to the shared directory in the owner account.
+
+## Timeouts
+
+`awsDirectoryServiceSharedDirectory` provides the following [Timeouts](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts) configuration options:
+
+- `delete` - (Default `60 minutes`) Used for shared directory deletion
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Directory Service Shared Directories using the owner directory ID/shared directory ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Directory Service Shared Directories using the owner directory ID/shared directory ID. For example:
+
+```console
+% terraform import aws_directory_service_shared_directory.example d-1234567890/d-9267633ece
+```
+
+<!-- cache-key: cdktf-0.18.0 input-703c00eb7c77b3d6d3290dced0c2f1e34dd8c3a57ded6619cfae213d85fabb65 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/directory_service_shared_directory_accepter.html.markdown b/website/docs/cdktf/typescript/r/directory_service_shared_directory_accepter.html.markdown
new file mode 100644
index 00000000000..3207a3f76dc
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/directory_service_shared_directory_accepter.html.markdown
@@ -0,0 +1,98 @@
+---
+subcategory: "Directory Service"
+layout: "aws"
+page_title: "AWS: aws_directory_service_shared_directory_accepter"
+description: |-
+    Accepts a shared directory in a consumer account.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_directory_service_shared_directory_accepter
+
+Accepts a shared directory in a consumer account.
+
+~> **NOTE:** Destroying this resource removes the shared directory from the consumer account only.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DirectoryServiceSharedDirectory } from "./.gen/providers/aws/directory-service-shared-directory";
+import { DirectoryServiceSharedDirectoryAccepter } from "./.gen/providers/aws/directory-service-shared-directory-accepter";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new DirectoryServiceSharedDirectory(this, "example", {
+      directoryId: Token.asString(awsDirectoryServiceDirectoryExample.id),
+      notes: "example",
+      target: {
+        id: Token.asString(receiver.accountId),
+      },
+    });
+    const awsDirectoryServiceSharedDirectoryAccepterExample =
+      new DirectoryServiceSharedDirectoryAccepter(this, "example_1", {
+        provider: "awsalternate",
+        sharedDirectoryId: example.sharedDirectoryId,
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsDirectoryServiceSharedDirectoryAccepterExample.overrideLogicalId(
+      "example"
+    );
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `sharedDirectoryId` - (Required) Identifier of the directory that is stored in the directory consumer account that corresponds to the shared directory in the owner account.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Identifier of the shared directory.
+* `method` - Method used when sharing a directory (i.e., `organizations` or `handshake`).
+* `notes` - Message sent by the directory owner to the directory consumer to help the directory consumer administrator determine whether to approve or reject the share invitation.
+* `ownerAccountId` - Account identifier of the directory owner.
+* `ownerDirectoryId` - Identifier of the Managed Microsoft AD directory from the perspective of the directory owner.
+
+## Timeouts
+
+`awsDirectoryServiceSharedDirectoryAccepter` provides the following [Timeouts](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts) configuration options:
+
+- `create` - (Default `60 minutes`) Used for directory creation
+- `delete` - (Default `60 minutes`) Used for directory deletion
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Directory Service Shared Directories using the shared directory ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Directory Service Shared Directories using the shared directory ID. For example:
+
+```console
+% terraform import aws_directory_service_shared_directory_accepter.example d-9267633ece
+```
+
+<!-- cache-key: cdktf-0.18.0 input-63416097ef145afd37784c7610985af402f18b723a7a423cc37dfe1e13007046 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/directory_service_trust.html.markdown b/website/docs/cdktf/typescript/r/directory_service_trust.html.markdown
new file mode 100644
index 00000000000..da8eb9dd87e
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/directory_service_trust.html.markdown
@@ -0,0 +1,199 @@
+---
+subcategory: "Directory Service"
+layout: "aws"
+page_title: "AWS: aws_directory_service_trust"
+description: |-
+  Manages a trust relationship between two Active Directory Directories.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_directory_service_trust
+
+Manages a trust relationship between two Active Directory Directories.
+
+The directories may either be both AWS Managed Microsoft AD domains or an AWS Managed Microsoft AD domain and a self-managed Active Directory Domain.
+
+The Trust relationship must be configured on both sides of the relationship.
+If a Trust has only been created on one side, it will be in the state `verifyFailed`.
+Once the second Trust is created, the first will update to the correct state.
+
+## Example Usage
+
+### Two-Way Trust
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DirectoryServiceDirectory } from "./.gen/providers/aws/directory-service-directory";
+import { DirectoryServiceTrust } from "./.gen/providers/aws/directory-service-trust";
+interface MyConfig {
+  password: any;
+  password1: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    const one = new DirectoryServiceDirectory(this, "one", {
+      name: "one.example.com",
+      type: "MicrosoftAD",
+      password: config.password,
+    });
+    const two = new DirectoryServiceDirectory(this, "two", {
+      name: "two.example.com",
+      type: "MicrosoftAD",
+      password: config.password1,
+    });
+    const awsDirectoryServiceTrustOne = new DirectoryServiceTrust(
+      this,
+      "one_2",
+      {
+        conditionalForwarderIpAddrs: two.dnsIpAddresses,
+        directoryId: one.id,
+        remoteDomainName: two.name,
+        trustDirection: "Two-Way",
+        trustPassword: "Some0therPassword",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsDirectoryServiceTrustOne.overrideLogicalId("one");
+    const awsDirectoryServiceTrustTwo = new DirectoryServiceTrust(
+      this,
+      "two_3",
+      {
+        conditionalForwarderIpAddrs: one.dnsIpAddresses,
+        directoryId: two.id,
+        remoteDomainName: one.name,
+        trustDirection: "Two-Way",
+        trustPassword: "Some0therPassword",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsDirectoryServiceTrustTwo.overrideLogicalId("two");
+  }
+}
+
+```
+
+### One-Way Trust
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DirectoryServiceDirectory } from "./.gen/providers/aws/directory-service-directory";
+import { DirectoryServiceTrust } from "./.gen/providers/aws/directory-service-trust";
+interface MyConfig {
+  password: any;
+  password1: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    const one = new DirectoryServiceDirectory(this, "one", {
+      name: "one.example.com",
+      type: "MicrosoftAD",
+      password: config.password,
+    });
+    const two = new DirectoryServiceDirectory(this, "two", {
+      name: "two.example.com",
+      type: "MicrosoftAD",
+      password: config.password1,
+    });
+    const awsDirectoryServiceTrustOne = new DirectoryServiceTrust(
+      this,
+      "one_2",
+      {
+        conditionalForwarderIpAddrs: two.dnsIpAddresses,
+        directoryId: one.id,
+        remoteDomainName: two.name,
+        trustDirection: "One-Way: Incoming",
+        trustPassword: "Some0therPassword",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsDirectoryServiceTrustOne.overrideLogicalId("one");
+    const awsDirectoryServiceTrustTwo = new DirectoryServiceTrust(
+      this,
+      "two_3",
+      {
+        conditionalForwarderIpAddrs: one.dnsIpAddresses,
+        directoryId: two.id,
+        remoteDomainName: one.name,
+        trustDirection: "One-Way: Outgoing",
+        trustPassword: "Some0therPassword",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsDirectoryServiceTrustTwo.overrideLogicalId("two");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `conditionalForwarderIpAddrs` - (Optional) Set of IPv4 addresses for the DNS server associated with the remote Directory.
+  Can contain between 1 and 4 values.
+* `deleteAssociatedConditionalForwarder` - (Optional) Whether to delete the conditional forwarder when deleting the Trust relationship.
+* `directoryId` - (Required) ID of the Directory.
+* `remoteDomainName` - (Required) Fully qualified domain name of the remote Directory.
+* `selectiveAuth` - (Optional) Whether to enable selective authentication.
+  Valid values are `enabled` and `disabled`.
+  Default value is `disabled`.
+* `trustDirection` - (Required) The direction of the Trust relationship.
+  Valid values are `One-Way: Outgoing`, `One-Way: Incoming`, and `twoWay`.
+* `trustPassword` - (Required) Password for the Trust.
+  Does not need to match the passwords for either Directory.
+  Can contain upper- and lower-case letters, numbers, and punctuation characters.
+  May be up to 128 characters long.
+* `trustType` - (Optional) Type of the Trust relationship.
+  Valid values are `forest` and `external`.
+  Default value is `forest`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `createdDateTime` - Date and time when the Trust was created.
+* `id` - The Trust identifier.
+* `lastUpdatedDateTime` - Date and time when the Trust was last updated.
+* `stateLastUpdatedDateTime` - Date and time when the Trust state in `trustState` was last updated.
+* `trustState` - State of the Trust relationship.
+  One of `created`, `verifyFailed`,`verified`, `updateFailed`,`updated`,`deleted`, or `failed`.
+* `trustStateReason` - Reason for the Trust state set in `trustState`.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import the Trust relationship using the directory ID and remote domain name, separated by a `/`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import the Trust relationship using the directory ID and remote domain name, separated by a `/`. For example:
+
+```console
+% terraform import aws_directory_service_trust.example d-926724cf57/directory.example.com
+```
+
+<!-- cache-key: cdktf-0.18.0 input-66aa03e6601035df60798595ea8787d00d4683201307e38bda224131aa72224e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/dlm_lifecycle_policy.html.markdown b/website/docs/cdktf/typescript/r/dlm_lifecycle_policy.html.markdown
new file mode 100644
index 00000000000..6f218f0e0ba
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/dlm_lifecycle_policy.html.markdown
@@ -0,0 +1,426 @@
+---
+subcategory: "DLM (Data Lifecycle Manager)"
+layout: "aws"
+page_title: "AWS: aws_dlm_lifecycle_policy"
+description: |-
+  Provides a Data Lifecycle Manager (DLM) lifecycle policy for managing snapshots.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_dlm_lifecycle_policy
+
+Provides a [Data Lifecycle Manager (DLM) lifecycle policy](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/snapshot-lifecycle.html) for managing snapshots.
+
+## Example Usage
+
+### Basic
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { DlmLifecyclePolicy } from "./.gen/providers/aws/dlm-lifecycle-policy";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+import { IamRolePolicy } from "./.gen/providers/aws/iam-role-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const assumeRole = new DataAwsIamPolicyDocument(this, "assume_role", {
+      statement: [
+        {
+          actions: ["sts:AssumeRole"],
+          effect: "Allow",
+          principals: [
+            {
+              identifiers: ["dlm.amazonaws.com"],
+              type: "Service",
+            },
+          ],
+        },
+      ],
+    });
+    const dlmLifecycle = new DataAwsIamPolicyDocument(this, "dlm_lifecycle", {
+      statement: [
+        {
+          actions: [
+            "ec2:CreateSnapshot",
+            "ec2:CreateSnapshots",
+            "ec2:DeleteSnapshot",
+            "ec2:DescribeInstances",
+            "ec2:DescribeVolumes",
+            "ec2:DescribeSnapshots",
+          ],
+          effect: "Allow",
+          resources: ["*"],
+        },
+        {
+          actions: ["ec2:CreateTags"],
+          effect: "Allow",
+          resources: ["arn:aws:ec2:*::snapshot/*"],
+        },
+      ],
+    });
+    const dlmLifecycleRole = new IamRole(this, "dlm_lifecycle_role", {
+      assumeRolePolicy: Token.asString(assumeRole.json),
+      name: "dlm-lifecycle-role",
+    });
+    const awsIamRolePolicyDlmLifecycle = new IamRolePolicy(
+      this,
+      "dlm_lifecycle_3",
+      {
+        name: "dlm-lifecycle-policy",
+        policy: Token.asString(dlmLifecycle.json),
+        role: dlmLifecycleRole.id,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamRolePolicyDlmLifecycle.overrideLogicalId("dlm_lifecycle");
+    new DlmLifecyclePolicy(this, "example", {
+      description: "example DLM lifecycle policy",
+      executionRoleArn: dlmLifecycleRole.arn,
+      policyDetails: {
+        resourceTypes: ["VOLUME"],
+        schedule: [
+          {
+            copyTags: false,
+            createRule: {
+              interval: 24,
+              intervalUnit: "HOURS",
+              times: ["23:45"],
+            },
+            name: "2 weeks of daily snapshots",
+            retainRule: {
+              count: 14,
+            },
+            tagsToAdd: {
+              snapshotCreator: "DLM",
+            },
+          },
+        ],
+        targetTags: {
+          snapshot: "true",
+        },
+      },
+      state: "ENABLED",
+    });
+  }
+}
+
+```
+
+### Example Cross-Region Snapshot Copy Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCallerIdentity } from "./.gen/providers/aws/data-aws-caller-identity";
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { DlmLifecyclePolicy } from "./.gen/providers/aws/dlm-lifecycle-policy";
+import { KmsKey } from "./.gen/providers/aws/kms-key";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const current = new DataAwsCallerIdentity(this, "current", {});
+    const key = new DataAwsIamPolicyDocument(this, "key", {
+      statement: [
+        {
+          actions: ["kms:*"],
+          effect: "Allow",
+          principals: [
+            {
+              identifiers: ["arn:aws:iam::${" + current.accountId + "}:root"],
+              type: "AWS",
+            },
+          ],
+          resources: ["*"],
+          sid: "Enable IAM User Permissions",
+        },
+      ],
+    });
+    const dlmCrossRegionCopyCmk = new KmsKey(
+      this,
+      "dlm_cross_region_copy_cmk",
+      {
+        description: "Example Alternate Region KMS Key",
+        policy: Token.asString(key.json),
+        provider: alternate,
+      }
+    );
+    new DlmLifecyclePolicy(this, "example", {
+      description: "example DLM lifecycle policy",
+      executionRoleArn: dlmLifecycleRole.arn,
+      policyDetails: {
+        resourceTypes: ["VOLUME"],
+        schedule: [
+          {
+            copyTags: false,
+            createRule: {
+              interval: 24,
+              intervalUnit: "HOURS",
+              times: ["23:45"],
+            },
+            crossRegionCopyRule: [
+              {
+                cmkArn: dlmCrossRegionCopyCmk.arn,
+                copyTags: true,
+                encrypted: true,
+                retainRule: {
+                  interval: 30,
+                  intervalUnit: "DAYS",
+                },
+                target: "us-west-2",
+              },
+            ],
+            name: "2 weeks of daily snapshots",
+            retainRule: {
+              count: 14,
+            },
+            tagsToAdd: {
+              snapshotCreator: "DLM",
+            },
+          },
+        ],
+        targetTags: {
+          snapshot: "true",
+        },
+      },
+      state: "ENABLED",
+    });
+  }
+}
+
+```
+
+### Example Event Based Policy Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCallerIdentity } from "./.gen/providers/aws/data-aws-caller-identity";
+import { DataAwsIamPolicy } from "./.gen/providers/aws/data-aws-iam-policy";
+import { DlmLifecyclePolicy } from "./.gen/providers/aws/dlm-lifecycle-policy";
+import { IamRolePolicyAttachment } from "./.gen/providers/aws/iam-role-policy-attachment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const current = new DataAwsCallerIdentity(this, "current", {});
+    const example = new DataAwsIamPolicy(this, "example", {
+      name: "AWSDataLifecycleManagerServiceRole",
+    });
+    const awsDlmLifecyclePolicyExample = new DlmLifecyclePolicy(
+      this,
+      "example_2",
+      {
+        description: "tf-acc-basic",
+        executionRoleArn: Token.asString(awsIamRoleExample.arn),
+        policyDetails: {
+          action: {
+            crossRegionCopy: [
+              {
+                encryptionConfiguration: {},
+                retainRule: {
+                  interval: 15,
+                  intervalUnit: "MONTHS",
+                },
+                target: "us-east-1",
+              },
+            ],
+            name: "tf-acc-basic",
+          },
+          eventSource: {
+            parameters: {
+              descriptionRegex:
+                "^.*Created for policy: policy-1234567890abcdef0.*$",
+              eventType: "shareSnapshot",
+              snapshotOwner: [Token.asString(current.accountId)],
+            },
+            type: "MANAGED_CWE",
+          },
+          policyType: "EVENT_BASED_POLICY",
+        },
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsDlmLifecyclePolicyExample.overrideLogicalId("example");
+    const awsIamRolePolicyAttachmentExample = new IamRolePolicyAttachment(
+      this,
+      "example_3",
+      {
+        policyArn: Token.asString(example.arn),
+        role: Token.asString(awsIamRoleExample.id),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamRolePolicyAttachmentExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `description` - (Required) A description for the DLM lifecycle policy.
+* `executionRoleArn` - (Required) The ARN of an IAM role that is able to be assumed by the DLM service.
+* `policyDetails` - (Required) See the [`policyDetails` configuration](#policy-details-arguments) block. Max of 1.
+* `state` - (Optional) Whether the lifecycle policy should be enabled or disabled. `enabled` or `disabled` are valid values. Defaults to `enabled`.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+#### Policy Details arguments
+
+* `action` - (Optional) The actions to be performed when the event-based policy is triggered. You can specify only one action per policy. This parameter is required for event-based policies only. If you are creating a snapshot or AMI policy, omit this parameter. See the [`action` configuration](#action-arguments) block.
+* `eventSource` - (Optional) The event that triggers the event-based policy. This parameter is required for event-based policies only. If you are creating a snapshot or AMI policy, omit this parameter. See the [`eventSource` configuration](#event-source-arguments) block.
+* `resourceTypes` - (Optional) A list of resource types that should be targeted by the lifecycle policy. Valid values are `volume` and `instance`.
+* `resourceLocations` - (Optional) The location of the resources to backup. If the source resources are located in an AWS Region, specify `cloud`. If the source resources are located on an Outpost in your account, specify `outpost`. If you specify `outpost`, Amazon Data Lifecycle Manager backs up all resources of the specified type with matching target tags across all of the Outposts in your account. Valid values are `cloud` and `outpost`.
+* `policyType` - (Optional) The valid target resource types and actions a policy can manage. Specify `ebsSnapshotManagement` to create a lifecycle policy that manages the lifecycle of Amazon EBS snapshots. Specify `imageManagement` to create a lifecycle policy that manages the lifecycle of EBS-backed AMIs. Specify `eventBasedPolicy` to create an event-based policy that performs specific actions when a defined event occurs in your AWS account. Default value is `ebsSnapshotManagement`.
+* `parameters` - (Optional) A set of optional parameters for snapshot and AMI lifecycle policies. See the [`parameters` configuration](#parameters-arguments) block.
+* `schedule` - (Optional) See the [`schedule` configuration](#schedule-arguments) block.
+* `targetTags` (Optional) A map of tag keys and their values. Any resources that match the `resourceTypes` and are tagged with _any_ of these tags will be targeted.
+
+~> Note: You cannot have overlapping lifecycle policies that share the same `targetTags`. Terraform is unable to detect this at plan time but it will fail during apply.
+
+#### Action arguments
+
+* `crossRegionCopy` - (Optional) The rule for copying shared snapshots across Regions. See the [`crossRegionCopy` configuration](#action-cross-region-copy-rule-arguments) block.
+* `name` - (Optional) A descriptive name for the action.
+
+##### Action Cross Region Copy Rule arguments
+
+* `encryptionConfiguration` - (Required) The encryption settings for the copied snapshot. See the [`encryptionConfiguration`](#encryption-configuration-arguments) block. Max of 1 per action.
+* `retainRule` - (Required) Specifies the retention rule for cross-Region snapshot copies. See the [`retainRule`](#cross-region-copy-rule-retain-rule-arguments) block. Max of 1 per action.
+* `target` - (Required) The target Region or the Amazon Resource Name (ARN) of the target Outpost for the snapshot copies.
+
+###### Encryption Configuration arguments
+
+* `cmkArn` - (Optional) The Amazon Resource Name (ARN) of the AWS KMS key to use for EBS encryption. If this parameter is not specified, the default KMS key for the account is used.
+* `encrypted` - (Required) To encrypt a copy of an unencrypted snapshot when encryption by default is not enabled, enable encryption using this parameter. Copies of encrypted snapshots are encrypted, even if this parameter is false or when encryption by default is not enabled.
+
+#### Event Source arguments
+
+* `parameters` - (Required) Information about the event. See the [`parameters` configuration](#event-source-parameters-arguments) block.
+* `type` - (Required) The source of the event. Currently only managed CloudWatch Events rules are supported. Valid values are `managedCwe`.
+
+##### Event Source Parameters arguments
+
+* `descriptionRegex` - (Required) The snapshot description that can trigger the policy. The description pattern is specified using a regular expression. The policy runs only if a snapshot with a description that matches the specified pattern is shared with your account.
+* `eventType` - (Required) The type of event. Currently, only `shareSnapshot` events are supported.
+* `snapshotOwner` - (Required) The IDs of the AWS accounts that can trigger policy by sharing snapshots with your account. The policy only runs if one of the specified AWS accounts shares a snapshot with your account.
+
+#### Parameters arguments
+
+* `excludeBootVolume` - (Optional) Indicates whether to exclude the root volume from snapshots created using CreateSnapshots. The default is `false`.
+* `noReboot` - (Optional) Applies to AMI lifecycle policies only. Indicates whether targeted instances are rebooted when the lifecycle policy runs. `true` indicates that targeted instances are not rebooted when the policy runs. `false` indicates that target instances are rebooted when the policy runs. The default is `true` (instances are not rebooted).
+
+#### Schedule arguments
+
+* `copyTags` - (Optional) Copy all user-defined tags on a source volume to snapshots of the volume created by this policy.
+* `createRule` - (Required) See the [`createRule`](#create-rule-arguments) block. Max of 1 per schedule.
+* `crossRegionCopyRule` (Optional) - See the [`crossRegionCopyRule`](#cross-region-copy-rule-arguments) block. Max of 3 per schedule.
+* `name` - (Required) A name for the schedule.
+* `deprecateRule` - (Required) See the [`deprecateRule`](#deprecate-rule-arguments) block. Max of 1 per schedule.
+* `fastRestoreRule` - (Required) See the [`fastRestoreRule`](#fast-restore-rule-arguments) block. Max of 1 per schedule.
+* `retainRule` - (Required) See the [`retainRule`](#retain-rule-arguments) block. Max of 1 per schedule.
+* `shareRule` - (Required) See the [`shareRule`](#share-rule-arguments) block. Max of 1 per schedule.
+* `tagsToAdd` - (Optional) A map of tag keys and their values. DLM lifecycle policies will already tag the snapshot with the tags on the volume. This configuration adds extra tags on top of these.
+* `variableTags` - (Optional) A map of tag keys and variable values, where the values are determined when the policy is executed. Only `$(instanceId)` or `$(timestamp)` are valid values. Can only be used when `resourceTypes` is `instance`.
+
+#### Create Rule arguments
+
+* `cronExpression` - (Optional) The schedule, as a Cron expression. The schedule interval must be between 1 hour and 1 year. Conflicts with `interval`, `intervalUnit`, and `times`.
+* `interval` - (Optional) How often this lifecycle policy should be evaluated. `1`, `2`,`3`,`4`,`6`,`8`,`12` or `24` are valid values. Conflicts with `cronExpression`. If set, `intervalUnit` and `times` must also be set.
+* `intervalUnit` - (Optional) The unit for how often the lifecycle policy should be evaluated. `hours` is currently the only allowed value and also the default value. Conflicts with `cronExpression`. Must be set if `interval` is set.
+* `location` - (Optional) Specifies the destination for snapshots created by the policy. To create snapshots in the same Region as the source resource, specify `cloud`. To create snapshots on the same Outpost as the source resource, specify `outpostLocal`. If you omit this parameter, `cloud` is used by default. If the policy targets resources in an AWS Region, then you must create snapshots in the same Region as the source resource. If the policy targets resources on an Outpost, then you can create snapshots on the same Outpost as the source resource, or in the Region of that Outpost. Valid values are `cloud` and `outpostLocal`.
+* `times` - (Optional) A list of times in 24 hour clock format that sets when the lifecycle policy should be evaluated. Max of 1. Conflicts with `cronExpression`. Must be set if `interval` is set.
+
+#### Deprecate Rule arguments
+
+* `count` - (Optional) Specifies the number of oldest AMIs to deprecate. Must be an integer between `1` and `1000`. Conflicts with `interval` and `intervalUnit`.
+* `interval` - (Optional) Specifies the period after which to deprecate AMIs created by the schedule. The maximum is 100 years. This is equivalent to 1200 months, 5200 weeks, or 36500 days. Conflicts with `count`. If set, `intervalUnit` must also be set.
+* `intervalUnit` - (Optional) The unit of time for time-based retention. Valid values are `days`, `weeks`, `months`, `years`. Conflicts with `count`. Must be set if `interval` is set.
+
+#### Fast Restore Rule arguments
+
+* `availabilityZones` - (Required) The Availability Zones in which to enable fast snapshot restore.
+* `count` - (Optional) The number of snapshots to be enabled with fast snapshot restore. Must be an integer between `1` and `1000`. Conflicts with `interval` and `intervalUnit`.
+* `interval` - (Optional) The amount of time to enable fast snapshot restore. The maximum is 100 years. This is equivalent to 1200 months, 5200 weeks, or 36500 days. Conflicts with `count`. If set, `intervalUnit` must also be set.
+* `intervalUnit` - (Optional) The unit of time for enabling fast snapshot restore. Valid values are `days`, `weeks`, `months`, `years`. Conflicts with `count`. Must be set if `interval` is set.
+
+#### Retain Rule arguments
+
+* `count` - (Optional) How many snapshots to keep. Must be an integer between `1` and `1000`. Conflicts with `interval` and `intervalUnit`.
+* `interval` - (Optional) The amount of time to retain each snapshot. The maximum is 100 years. This is equivalent to 1200 months, 5200 weeks, or 36500 days. Conflicts with `count`. If set, `intervalUnit` must also be set.
+* `intervalUnit` - (Optional) The unit of time for time-based retention. Valid values are `days`, `weeks`, `months`, `years`. Conflicts with `count`. Must be set if `interval` is set.
+
+#### Share Rule arguments
+
+* `targetAccounts` - (Required) The IDs of the AWS accounts with which to share the snapshots.
+* `interval` - (Optional) The period after which snapshots that are shared with other AWS accounts are automatically unshared.
+* `intervalUnit` - (Optional) The unit of time for the automatic unsharing interval. Valid values are `days`, `weeks`, `months`, `years`.
+
+#### Cross Region Copy Rule arguments
+
+* `cmkArn` - (Optional) The Amazon Resource Name (ARN) of the AWS KMS customer master key (CMK) to use for EBS encryption. If this argument is not specified, the default KMS key for the account is used.
+* `copyTags` - (Optional) Whether to copy all user-defined tags from the source snapshot to the cross-region snapshot copy.
+* `deprecateRule` - (Optional) The AMI deprecation rule for cross-Region AMI copies created by the rule. See the [`deprecateRule`](#cross-region-copy-rule-deprecate-rule-arguments) block.
+* `encrypted` - (Required) To encrypt a copy of an unencrypted snapshot if encryption by default is not enabled, enable encryption using this parameter. Copies of encrypted snapshots are encrypted, even if this parameter is false or if encryption by default is not enabled.
+* `retainRule` - (Required) The retention rule that indicates how long snapshot copies are to be retained in the destination Region. See the [`retainRule`](#cross-region-copy-rule-retain-rule-arguments) block. Max of 1 per schedule.
+* `target` - (Required) The target Region or the Amazon Resource Name (ARN) of the target Outpost for the snapshot copies.
+
+#### Cross Region Copy Rule Deprecate Rule arguments
+
+* `interval` - (Required) The period after which to deprecate the cross-Region AMI copies. The period must be less than or equal to the cross-Region AMI copy retention period, and it can't be greater than 10 years. This is equivalent to 120 months, 520 weeks, or 3650 days.
+* `intervalUnit` - (Required) The unit of time in which to measure the `interval`. Valid values: `days`, `weeks`, `months`, or `years`.
+
+#### Cross Region Copy Rule Retain Rule arguments
+
+* `interval` - (Required) The amount of time to retain each snapshot. The maximum is 100 years. This is equivalent to 1200 months, 5200 weeks, or 36500 days.
+* `intervalUnit` - (Required) The unit of time for time-based retention. Valid values: `days`, `weeks`, `months`, or `years`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the DLM Lifecycle Policy.
+* `id` - Identifier of the DLM Lifecycle Policy.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DLM lifecycle policies using their policy ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import DLM lifecycle policies using their policy ID. For example:
+
+```console
+% terraform import aws_dlm_lifecycle_policy.example policy-abcdef12345678901
+```
+
+<!-- cache-key: cdktf-0.18.0 input-cd52275658ea26bb97d5ff6b8e5c283dfc879cf7239a8546704deb3cc7ac57ec -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/dlm_lifecycle_policy.markdown b/website/docs/cdktf/typescript/r/dlm_lifecycle_policy.markdown
new file mode 100644
index 00000000000..6f218f0e0ba
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/dlm_lifecycle_policy.markdown
@@ -0,0 +1,426 @@
+---
+subcategory: "DLM (Data Lifecycle Manager)"
+layout: "aws"
+page_title: "AWS: aws_dlm_lifecycle_policy"
+description: |-
+  Provides a Data Lifecycle Manager (DLM) lifecycle policy for managing snapshots.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_dlm_lifecycle_policy
+
+Provides a [Data Lifecycle Manager (DLM) lifecycle policy](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/snapshot-lifecycle.html) for managing snapshots.
+
+## Example Usage
+
+### Basic
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { DlmLifecyclePolicy } from "./.gen/providers/aws/dlm-lifecycle-policy";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+import { IamRolePolicy } from "./.gen/providers/aws/iam-role-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const assumeRole = new DataAwsIamPolicyDocument(this, "assume_role", {
+      statement: [
+        {
+          actions: ["sts:AssumeRole"],
+          effect: "Allow",
+          principals: [
+            {
+              identifiers: ["dlm.amazonaws.com"],
+              type: "Service",
+            },
+          ],
+        },
+      ],
+    });
+    const dlmLifecycle = new DataAwsIamPolicyDocument(this, "dlm_lifecycle", {
+      statement: [
+        {
+          actions: [
+            "ec2:CreateSnapshot",
+            "ec2:CreateSnapshots",
+            "ec2:DeleteSnapshot",
+            "ec2:DescribeInstances",
+            "ec2:DescribeVolumes",
+            "ec2:DescribeSnapshots",
+          ],
+          effect: "Allow",
+          resources: ["*"],
+        },
+        {
+          actions: ["ec2:CreateTags"],
+          effect: "Allow",
+          resources: ["arn:aws:ec2:*::snapshot/*"],
+        },
+      ],
+    });
+    const dlmLifecycleRole = new IamRole(this, "dlm_lifecycle_role", {
+      assumeRolePolicy: Token.asString(assumeRole.json),
+      name: "dlm-lifecycle-role",
+    });
+    const awsIamRolePolicyDlmLifecycle = new IamRolePolicy(
+      this,
+      "dlm_lifecycle_3",
+      {
+        name: "dlm-lifecycle-policy",
+        policy: Token.asString(dlmLifecycle.json),
+        role: dlmLifecycleRole.id,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamRolePolicyDlmLifecycle.overrideLogicalId("dlm_lifecycle");
+    new DlmLifecyclePolicy(this, "example", {
+      description: "example DLM lifecycle policy",
+      executionRoleArn: dlmLifecycleRole.arn,
+      policyDetails: {
+        resourceTypes: ["VOLUME"],
+        schedule: [
+          {
+            copyTags: false,
+            createRule: {
+              interval: 24,
+              intervalUnit: "HOURS",
+              times: ["23:45"],
+            },
+            name: "2 weeks of daily snapshots",
+            retainRule: {
+              count: 14,
+            },
+            tagsToAdd: {
+              snapshotCreator: "DLM",
+            },
+          },
+        ],
+        targetTags: {
+          snapshot: "true",
+        },
+      },
+      state: "ENABLED",
+    });
+  }
+}
+
+```
+
+### Example Cross-Region Snapshot Copy Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCallerIdentity } from "./.gen/providers/aws/data-aws-caller-identity";
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { DlmLifecyclePolicy } from "./.gen/providers/aws/dlm-lifecycle-policy";
+import { KmsKey } from "./.gen/providers/aws/kms-key";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const current = new DataAwsCallerIdentity(this, "current", {});
+    const key = new DataAwsIamPolicyDocument(this, "key", {
+      statement: [
+        {
+          actions: ["kms:*"],
+          effect: "Allow",
+          principals: [
+            {
+              identifiers: ["arn:aws:iam::${" + current.accountId + "}:root"],
+              type: "AWS",
+            },
+          ],
+          resources: ["*"],
+          sid: "Enable IAM User Permissions",
+        },
+      ],
+    });
+    const dlmCrossRegionCopyCmk = new KmsKey(
+      this,
+      "dlm_cross_region_copy_cmk",
+      {
+        description: "Example Alternate Region KMS Key",
+        policy: Token.asString(key.json),
+        provider: alternate,
+      }
+    );
+    new DlmLifecyclePolicy(this, "example", {
+      description: "example DLM lifecycle policy",
+      executionRoleArn: dlmLifecycleRole.arn,
+      policyDetails: {
+        resourceTypes: ["VOLUME"],
+        schedule: [
+          {
+            copyTags: false,
+            createRule: {
+              interval: 24,
+              intervalUnit: "HOURS",
+              times: ["23:45"],
+            },
+            crossRegionCopyRule: [
+              {
+                cmkArn: dlmCrossRegionCopyCmk.arn,
+                copyTags: true,
+                encrypted: true,
+                retainRule: {
+                  interval: 30,
+                  intervalUnit: "DAYS",
+                },
+                target: "us-west-2",
+              },
+            ],
+            name: "2 weeks of daily snapshots",
+            retainRule: {
+              count: 14,
+            },
+            tagsToAdd: {
+              snapshotCreator: "DLM",
+            },
+          },
+        ],
+        targetTags: {
+          snapshot: "true",
+        },
+      },
+      state: "ENABLED",
+    });
+  }
+}
+
+```
+
+### Example Event Based Policy Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCallerIdentity } from "./.gen/providers/aws/data-aws-caller-identity";
+import { DataAwsIamPolicy } from "./.gen/providers/aws/data-aws-iam-policy";
+import { DlmLifecyclePolicy } from "./.gen/providers/aws/dlm-lifecycle-policy";
+import { IamRolePolicyAttachment } from "./.gen/providers/aws/iam-role-policy-attachment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const current = new DataAwsCallerIdentity(this, "current", {});
+    const example = new DataAwsIamPolicy(this, "example", {
+      name: "AWSDataLifecycleManagerServiceRole",
+    });
+    const awsDlmLifecyclePolicyExample = new DlmLifecyclePolicy(
+      this,
+      "example_2",
+      {
+        description: "tf-acc-basic",
+        executionRoleArn: Token.asString(awsIamRoleExample.arn),
+        policyDetails: {
+          action: {
+            crossRegionCopy: [
+              {
+                encryptionConfiguration: {},
+                retainRule: {
+                  interval: 15,
+                  intervalUnit: "MONTHS",
+                },
+                target: "us-east-1",
+              },
+            ],
+            name: "tf-acc-basic",
+          },
+          eventSource: {
+            parameters: {
+              descriptionRegex:
+                "^.*Created for policy: policy-1234567890abcdef0.*$",
+              eventType: "shareSnapshot",
+              snapshotOwner: [Token.asString(current.accountId)],
+            },
+            type: "MANAGED_CWE",
+          },
+          policyType: "EVENT_BASED_POLICY",
+        },
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsDlmLifecyclePolicyExample.overrideLogicalId("example");
+    const awsIamRolePolicyAttachmentExample = new IamRolePolicyAttachment(
+      this,
+      "example_3",
+      {
+        policyArn: Token.asString(example.arn),
+        role: Token.asString(awsIamRoleExample.id),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamRolePolicyAttachmentExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `description` - (Required) A description for the DLM lifecycle policy.
+* `executionRoleArn` - (Required) The ARN of an IAM role that is able to be assumed by the DLM service.
+* `policyDetails` - (Required) See the [`policyDetails` configuration](#policy-details-arguments) block. Max of 1.
+* `state` - (Optional) Whether the lifecycle policy should be enabled or disabled. `enabled` or `disabled` are valid values. Defaults to `enabled`.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+#### Policy Details arguments
+
+* `action` - (Optional) The actions to be performed when the event-based policy is triggered. You can specify only one action per policy. This parameter is required for event-based policies only. If you are creating a snapshot or AMI policy, omit this parameter. See the [`action` configuration](#action-arguments) block.
+* `eventSource` - (Optional) The event that triggers the event-based policy. This parameter is required for event-based policies only. If you are creating a snapshot or AMI policy, omit this parameter. See the [`eventSource` configuration](#event-source-arguments) block.
+* `resourceTypes` - (Optional) A list of resource types that should be targeted by the lifecycle policy. Valid values are `volume` and `instance`.
+* `resourceLocations` - (Optional) The location of the resources to backup. If the source resources are located in an AWS Region, specify `cloud`. If the source resources are located on an Outpost in your account, specify `outpost`. If you specify `outpost`, Amazon Data Lifecycle Manager backs up all resources of the specified type with matching target tags across all of the Outposts in your account. Valid values are `cloud` and `outpost`.
+* `policyType` - (Optional) The valid target resource types and actions a policy can manage. Specify `ebsSnapshotManagement` to create a lifecycle policy that manages the lifecycle of Amazon EBS snapshots. Specify `imageManagement` to create a lifecycle policy that manages the lifecycle of EBS-backed AMIs. Specify `eventBasedPolicy` to create an event-based policy that performs specific actions when a defined event occurs in your AWS account. Default value is `ebsSnapshotManagement`.
+* `parameters` - (Optional) A set of optional parameters for snapshot and AMI lifecycle policies. See the [`parameters` configuration](#parameters-arguments) block.
+* `schedule` - (Optional) See the [`schedule` configuration](#schedule-arguments) block.
+* `targetTags` (Optional) A map of tag keys and their values. Any resources that match the `resourceTypes` and are tagged with _any_ of these tags will be targeted.
+
+~> Note: You cannot have overlapping lifecycle policies that share the same `targetTags`. Terraform is unable to detect this at plan time but it will fail during apply.
+
+#### Action arguments
+
+* `crossRegionCopy` - (Optional) The rule for copying shared snapshots across Regions. See the [`crossRegionCopy` configuration](#action-cross-region-copy-rule-arguments) block.
+* `name` - (Optional) A descriptive name for the action.
+
+##### Action Cross Region Copy Rule arguments
+
+* `encryptionConfiguration` - (Required) The encryption settings for the copied snapshot. See the [`encryptionConfiguration`](#encryption-configuration-arguments) block. Max of 1 per action.
+* `retainRule` - (Required) Specifies the retention rule for cross-Region snapshot copies. See the [`retainRule`](#cross-region-copy-rule-retain-rule-arguments) block. Max of 1 per action.
+* `target` - (Required) The target Region or the Amazon Resource Name (ARN) of the target Outpost for the snapshot copies.
+
+###### Encryption Configuration arguments
+
+* `cmkArn` - (Optional) The Amazon Resource Name (ARN) of the AWS KMS key to use for EBS encryption. If this parameter is not specified, the default KMS key for the account is used.
+* `encrypted` - (Required) To encrypt a copy of an unencrypted snapshot when encryption by default is not enabled, enable encryption using this parameter. Copies of encrypted snapshots are encrypted, even if this parameter is false or when encryption by default is not enabled.
+
+#### Event Source arguments
+
+* `parameters` - (Required) Information about the event. See the [`parameters` configuration](#event-source-parameters-arguments) block.
+* `type` - (Required) The source of the event. Currently only managed CloudWatch Events rules are supported. Valid values are `managedCwe`.
+
+##### Event Source Parameters arguments
+
+* `descriptionRegex` - (Required) The snapshot description that can trigger the policy. The description pattern is specified using a regular expression. The policy runs only if a snapshot with a description that matches the specified pattern is shared with your account.
+* `eventType` - (Required) The type of event. Currently, only `shareSnapshot` events are supported.
+* `snapshotOwner` - (Required) The IDs of the AWS accounts that can trigger policy by sharing snapshots with your account. The policy only runs if one of the specified AWS accounts shares a snapshot with your account.
+
+#### Parameters arguments
+
+* `excludeBootVolume` - (Optional) Indicates whether to exclude the root volume from snapshots created using CreateSnapshots. The default is `false`.
+* `noReboot` - (Optional) Applies to AMI lifecycle policies only. Indicates whether targeted instances are rebooted when the lifecycle policy runs. `true` indicates that targeted instances are not rebooted when the policy runs. `false` indicates that target instances are rebooted when the policy runs. The default is `true` (instances are not rebooted).
+
+#### Schedule arguments
+
+* `copyTags` - (Optional) Copy all user-defined tags on a source volume to snapshots of the volume created by this policy.
+* `createRule` - (Required) See the [`createRule`](#create-rule-arguments) block. Max of 1 per schedule.
+* `crossRegionCopyRule` (Optional) - See the [`crossRegionCopyRule`](#cross-region-copy-rule-arguments) block. Max of 3 per schedule.
+* `name` - (Required) A name for the schedule.
+* `deprecateRule` - (Required) See the [`deprecateRule`](#deprecate-rule-arguments) block. Max of 1 per schedule.
+* `fastRestoreRule` - (Required) See the [`fastRestoreRule`](#fast-restore-rule-arguments) block. Max of 1 per schedule.
+* `retainRule` - (Required) See the [`retainRule`](#retain-rule-arguments) block. Max of 1 per schedule.
+* `shareRule` - (Required) See the [`shareRule`](#share-rule-arguments) block. Max of 1 per schedule.
+* `tagsToAdd` - (Optional) A map of tag keys and their values. DLM lifecycle policies will already tag the snapshot with the tags on the volume. This configuration adds extra tags on top of these.
+* `variableTags` - (Optional) A map of tag keys and variable values, where the values are determined when the policy is executed. Only `$(instanceId)` or `$(timestamp)` are valid values. Can only be used when `resourceTypes` is `instance`.
+
+#### Create Rule arguments
+
+* `cronExpression` - (Optional) The schedule, as a Cron expression. The schedule interval must be between 1 hour and 1 year. Conflicts with `interval`, `intervalUnit`, and `times`.
+* `interval` - (Optional) How often this lifecycle policy should be evaluated. `1`, `2`,`3`,`4`,`6`,`8`,`12` or `24` are valid values. Conflicts with `cronExpression`. If set, `intervalUnit` and `times` must also be set.
+* `intervalUnit` - (Optional) The unit for how often the lifecycle policy should be evaluated. `hours` is currently the only allowed value and also the default value. Conflicts with `cronExpression`. Must be set if `interval` is set.
+* `location` - (Optional) Specifies the destination for snapshots created by the policy. To create snapshots in the same Region as the source resource, specify `cloud`. To create snapshots on the same Outpost as the source resource, specify `outpostLocal`. If you omit this parameter, `cloud` is used by default. If the policy targets resources in an AWS Region, then you must create snapshots in the same Region as the source resource. If the policy targets resources on an Outpost, then you can create snapshots on the same Outpost as the source resource, or in the Region of that Outpost. Valid values are `cloud` and `outpostLocal`.
+* `times` - (Optional) A list of times in 24 hour clock format that sets when the lifecycle policy should be evaluated. Max of 1. Conflicts with `cronExpression`. Must be set if `interval` is set.
+
+#### Deprecate Rule arguments
+
+* `count` - (Optional) Specifies the number of oldest AMIs to deprecate. Must be an integer between `1` and `1000`. Conflicts with `interval` and `intervalUnit`.
+* `interval` - (Optional) Specifies the period after which to deprecate AMIs created by the schedule. The maximum is 100 years. This is equivalent to 1200 months, 5200 weeks, or 36500 days. Conflicts with `count`. If set, `intervalUnit` must also be set.
+* `intervalUnit` - (Optional) The unit of time for time-based retention. Valid values are `days`, `weeks`, `months`, `years`. Conflicts with `count`. Must be set if `interval` is set.
+
+#### Fast Restore Rule arguments
+
+* `availabilityZones` - (Required) The Availability Zones in which to enable fast snapshot restore.
+* `count` - (Optional) The number of snapshots to be enabled with fast snapshot restore. Must be an integer between `1` and `1000`. Conflicts with `interval` and `intervalUnit`.
+* `interval` - (Optional) The amount of time to enable fast snapshot restore. The maximum is 100 years. This is equivalent to 1200 months, 5200 weeks, or 36500 days. Conflicts with `count`. If set, `intervalUnit` must also be set.
+* `intervalUnit` - (Optional) The unit of time for enabling fast snapshot restore. Valid values are `days`, `weeks`, `months`, `years`. Conflicts with `count`. Must be set if `interval` is set.
+
+#### Retain Rule arguments
+
+* `count` - (Optional) How many snapshots to keep. Must be an integer between `1` and `1000`. Conflicts with `interval` and `intervalUnit`.
+* `interval` - (Optional) The amount of time to retain each snapshot. The maximum is 100 years. This is equivalent to 1200 months, 5200 weeks, or 36500 days. Conflicts with `count`. If set, `intervalUnit` must also be set.
+* `intervalUnit` - (Optional) The unit of time for time-based retention. Valid values are `days`, `weeks`, `months`, `years`. Conflicts with `count`. Must be set if `interval` is set.
+
+#### Share Rule arguments
+
+* `targetAccounts` - (Required) The IDs of the AWS accounts with which to share the snapshots.
+* `interval` - (Optional) The period after which snapshots that are shared with other AWS accounts are automatically unshared.
+* `intervalUnit` - (Optional) The unit of time for the automatic unsharing interval. Valid values are `days`, `weeks`, `months`, `years`.
+
+#### Cross Region Copy Rule arguments
+
+* `cmkArn` - (Optional) The Amazon Resource Name (ARN) of the AWS KMS customer master key (CMK) to use for EBS encryption. If this argument is not specified, the default KMS key for the account is used.
+* `copyTags` - (Optional) Whether to copy all user-defined tags from the source snapshot to the cross-region snapshot copy.
+* `deprecateRule` - (Optional) The AMI deprecation rule for cross-Region AMI copies created by the rule. See the [`deprecateRule`](#cross-region-copy-rule-deprecate-rule-arguments) block.
+* `encrypted` - (Required) To encrypt a copy of an unencrypted snapshot if encryption by default is not enabled, enable encryption using this parameter. Copies of encrypted snapshots are encrypted, even if this parameter is false or if encryption by default is not enabled.
+* `retainRule` - (Required) The retention rule that indicates how long snapshot copies are to be retained in the destination Region. See the [`retainRule`](#cross-region-copy-rule-retain-rule-arguments) block. Max of 1 per schedule.
+* `target` - (Required) The target Region or the Amazon Resource Name (ARN) of the target Outpost for the snapshot copies.
+
+#### Cross Region Copy Rule Deprecate Rule arguments
+
+* `interval` - (Required) The period after which to deprecate the cross-Region AMI copies. The period must be less than or equal to the cross-Region AMI copy retention period, and it can't be greater than 10 years. This is equivalent to 120 months, 520 weeks, or 3650 days.
+* `intervalUnit` - (Required) The unit of time in which to measure the `interval`. Valid values: `days`, `weeks`, `months`, or `years`.
+
+#### Cross Region Copy Rule Retain Rule arguments
+
+* `interval` - (Required) The amount of time to retain each snapshot. The maximum is 100 years. This is equivalent to 1200 months, 5200 weeks, or 36500 days.
+* `intervalUnit` - (Required) The unit of time for time-based retention. Valid values: `days`, `weeks`, `months`, or `years`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the DLM Lifecycle Policy.
+* `id` - Identifier of the DLM Lifecycle Policy.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DLM lifecycle policies using their policy ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import DLM lifecycle policies using their policy ID. For example:
+
+```console
+% terraform import aws_dlm_lifecycle_policy.example policy-abcdef12345678901
+```
+
+<!-- cache-key: cdktf-0.18.0 input-cd52275658ea26bb97d5ff6b8e5c283dfc879cf7239a8546704deb3cc7ac57ec -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/dms_certificate.html.markdown b/website/docs/cdktf/typescript/r/dms_certificate.html.markdown
new file mode 100644
index 00000000000..c26b5b3de76
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/dms_certificate.html.markdown
@@ -0,0 +1,85 @@
+---
+subcategory: "DMS (Database Migration)"
+layout: "aws"
+page_title: "AWS: aws_dms_certificate"
+description: |-
+  Provides a DMS (Data Migration Service) certificate resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_dms_certificate
+
+Provides a DMS (Data Migration Service) certificate resource. DMS certificates can be created, deleted, and imported.
+
+~> **Note:** All arguments including the PEM encoded certificate will be stored in the raw state as plain-text.
+[Read more about sensitive data in state](https://www.terraform.io/docs/state/sensitive-data.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DmsCertificate } from "./.gen/providers/aws/dms-certificate";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DmsCertificate(this, "test", {
+      certificateId: "test-dms-certificate-tf",
+      certificatePem: "...",
+      tags: {
+        Name: "test",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `certificateId` - (Required) The certificate identifier.
+
+    - Must contain from 1 to 255 alphanumeric characters and hyphens.
+
+* `certificatePem` - (Optional) The contents of the .pem X.509 certificate file for the certificate. Either `certificatePem` or `certificateWallet` must be set.
+* `certificateWallet` - (Optional) The contents of the Oracle Wallet certificate for use with SSL, provided as a base64-encoded String. Either `certificatePem` or `certificateWallet` must be set.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `certificateArn` - The Amazon Resource Name (ARN) for the certificate.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import certificates using the `certificateId`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import certificates using the `certificateId`. For example:
+
+```console
+% terraform import aws_dms_certificate.test test-dms-certificate-tf
+```
+
+<!-- cache-key: cdktf-0.18.0 input-43c2ddd8bdacc0b322a9d01379d67b520abc0514fee6ac2b769064b1afbc324d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/dms_endpoint.html.markdown b/website/docs/cdktf/typescript/r/dms_endpoint.html.markdown
new file mode 100644
index 00000000000..bf7dd16c6da
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/dms_endpoint.html.markdown
@@ -0,0 +1,247 @@
+---
+subcategory: "DMS (Database Migration)"
+layout: "aws"
+page_title: "AWS: aws_dms_endpoint"
+description: |-
+  Provides a DMS (Data Migration Service) endpoint resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_dms_endpoint
+
+Provides a DMS (Data Migration Service) endpoint resource. DMS endpoints can be created, updated, deleted, and imported.
+
+~> **Note:** All arguments including the password will be stored in the raw state as plain-text. [Read more about sensitive data in state](https://www.terraform.io/docs/state/sensitive-data.html).
+
+~> **Note:** The `s3Settings` argument is deprecated, may not be maintained, and will be removed in a future version. Use the [`awsDmsS3Endpoint`](/docs/providers/aws/r/dms_s3_endpoint.html) resource instead.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DmsEndpoint } from "./.gen/providers/aws/dms-endpoint";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DmsEndpoint(this, "test", {
+      certificateArn:
+        "arn:aws:acm:us-east-1:123456789012:certificate/12345678-1234-1234-1234-123456789012",
+      databaseName: "test",
+      endpointId: "test-dms-endpoint-tf",
+      endpointType: "source",
+      engineName: "aurora",
+      extraConnectionAttributes: "",
+      kmsKeyArn:
+        "arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012",
+      password: "test",
+      port: 3306,
+      serverName: "test",
+      sslMode: "none",
+      tags: {
+        Name: "test",
+      },
+      username: "test",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `endpointId` - (Required) Database endpoint identifier. Identifiers must contain from 1 to 255 alphanumeric characters or hyphens, begin with a letter, contain only ASCII letters, digits, and hyphens, not end with a hyphen, and not contain two consecutive hyphens.
+* `endpointType` - (Required) Type of endpoint. Valid values are `source`, `target`.
+* `engineName` - (Required) Type of engine for the endpoint. Valid values are `aurora`, `auroraPostgresql`, `azuredb`, `azureSqlManagedInstance`, `babelfish`, `db2`, `db2Zos`, `docdb`, `dynamodb`, `elasticsearch`, `kafka`, `kinesis`, `mariadb`, `mongodb`, `mysql`, `opensearch`, `oracle`, `postgres`, `redshift`, `s3`, `sqlserver`, `sybase`. Please note that some of engine names are available only for `target` endpoint type (e.g. `redshift`).
+* `kmsKeyArn` - (Required when `engineName` is `mongodb`, cannot be set when `engineName` is `s3`, optional otherwise) ARN for the KMS key that will be used to encrypt the connection parameters. If you do not specify a value for `kmsKeyArn`, then AWS DMS will use your default encryption key. AWS KMS creates the default encryption key for your AWS account. Your AWS account has a different default encryption key for each AWS region. To encrypt an S3 target with a KMS Key, use the parameter `s3SettingsServerSideEncryptionKmsKeyId`. When `engineName` is `redshift`, `kmsKeyArn` is the KMS Key for the Redshift target and the parameter `redshiftSettingsServerSideEncryptionKmsKeyId` encrypts the S3 intermediate storage.
+
+The following arguments are optional:
+
+* `certificateArn` - (Optional, Default: empty string) ARN for the certificate.
+* `databaseName` - (Optional) Name of the endpoint database.
+* `elasticsearchSettings` - (Optional) Configuration block for OpenSearch settings. See below.
+* `extraConnectionAttributes` - (Optional) Additional attributes associated with the connection. For available attributes for a `source` Endpoint, see [Sources for data migration](https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Source.html). For available attributes for a `target` Endpoint, see [Targets for data migration](https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Target.html).
+* `kafkaSettings` - (Optional) Configuration block for Kafka settings. See below.
+* `kinesisSettings` - (Optional) Configuration block for Kinesis settings. See below.
+* `mongodbSettings` - (Optional) Configuration block for MongoDB settings. See below.
+* `password` - (Optional) Password to be used to login to the endpoint database.
+* `port` - (Optional) Port used by the endpoint database.
+* `redshiftSettings` - (Optional) Configuration block for Redshift settings. See below.
+* `s3Settings` - (Optional) (**Deprecated**, use the [`awsDmsS3Endpoint`](/docs/providers/aws/r/dms_s3_endpoint.html) resource instead) Configuration block for S3 settings. See below.
+* `secretsManagerAccessRoleArn` - (Optional) ARN of the IAM role that specifies AWS DMS as the trusted entity and has the required permissions to access the value in SecretsManagerSecret.
+* `secretsManagerArn` - (Optional) Full ARN, partial ARN, or friendly name of the SecretsManagerSecret that contains the endpoint connection details. Supported only when `engineName` is `aurora`, `auroraPostgresql`, `mariadb`, `mongodb`, `mysql`, `oracle`, `postgres`, `redshift`, or `sqlserver`.
+* `serverName` - (Optional) Host name of the server.
+* `serviceAccessRole` - (Optional) ARN used by the service access IAM role for dynamodb endpoints.
+* `sslMode` - (Optional, Default: `none`) SSL mode to use for the connection. Valid values are `none`, `require`, `verifyCa`, `verifyFull`
+* `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `username` - (Optional) User name to be used to login to the endpoint database.
+
+### elasticsearch_settings
+
+-> Additional information can be found in the [Using Amazon OpenSearch Service as a Target for AWS Database Migration Service documentation](https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Target.Elasticsearch.html).
+
+* `endpointUri` - (Required) Endpoint for the OpenSearch cluster.
+* `errorRetryDuration` - (Optional) Maximum number of seconds for which DMS retries failed API requests to the OpenSearch cluster. Default is `300`.
+* `fullLoadErrorPercentage` - (Optional) Maximum percentage of records that can fail to be written before a full load operation stops. Default is `10`.
+* `serviceAccessRoleArn` - (Required) ARN of the IAM Role with permissions to write to the OpenSearch cluster.
+
+### kafka_settings
+
+-> Additional information can be found in the [Using Apache Kafka as a Target for AWS Database Migration Service documentation](https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Target.Kafka.html).
+
+* `broker` - (Required) Kafka broker location. Specify in the form broker-hostname-or-ip:port.
+* `includeControlDetails` - (Optional) Shows detailed control information for table definition, column definition, and table and column changes in the Kafka message output. Default is `false`.
+* `includeNullAndEmpty` - (Optional) Include NULL and empty columns for records migrated to the endpoint. Default is `false`.
+* `includePartitionValue` - (Optional) Shows the partition value within the Kafka message output unless the partition type is `schemaTableType`. Default is `false`.
+* `includeTableAlterOperations` - (Optional) Includes any data definition language (DDL) operations that change the table in the control data, such as `renameTable`, `dropTable`, `addColumn`, `dropColumn`, and `renameColumn`. Default is `false`.
+* `includeTransactionDetails` - (Optional) Provides detailed transaction information from the source database. This information includes a commit timestamp, a log position, and values for `transactionId`, previous `transactionId`, and `transactionRecordId` (the record offset within a transaction). Default is `false`.
+* `messageFormat` - (Optional) Output format for the records created on the endpoint. Message format is `json` (default) or `jsonUnformatted` (a single line with no tab).
+* `messageMaxBytes` - (Optional) Maximum size in bytes for records created on the endpoint Default is `1,000,000`.
+* `noHexPrefix` - (Optional) Set this optional parameter to true to avoid adding a '0x' prefix to raw data in hexadecimal format. For example, by default, AWS DMS adds a '0x' prefix to the LOB column type in hexadecimal format moving from an Oracle source to a Kafka target. Use the `noHexPrefix` endpoint setting to enable migration of RAW data type columns without adding the `'0X'` prefix.
+* `partitionIncludeSchemaTable` - (Optional) Prefixes schema and table names to partition values, when the partition type is `primaryKeyType`. Doing this increases data distribution among Kafka partitions. For example, suppose that a SysBench schema has thousands of tables and each table has only limited range for a primary key. In this case, the same primary key is sent from thousands of tables to the same partition, which causes throttling. Default is `false`.
+* `saslPassword` - (Optional) Secure password you created when you first set up your MSK cluster to validate a client identity and make an encrypted connection between server and client using SASL-SSL authentication.
+* `saslUsername` - (Optional) Secure user name you created when you first set up your MSK cluster to validate a client identity and make an encrypted connection between server and client using SASL-SSL authentication.
+* `securityProtocol` - (Optional) Set secure connection to a Kafka target endpoint using Transport Layer Security (TLS). Options include `sslEncryption`, `sslAuthentication`, and `saslSsl`. `saslSsl` requires `saslUsername` and `saslPassword`.
+* `sslCaCertificateArn` - (Optional) ARN for the private certificate authority (CA) cert that AWS DMS uses to securely connect to your Kafka target endpoint.
+* `sslClientCertificateArn` - (Optional) ARN of the client certificate used to securely connect to a Kafka target endpoint.
+* `sslClientKeyArn` - (Optional) ARN for the client private key used to securely connect to a Kafka target endpoint.
+* `sslClientKeyPassword` - (Optional) Password for the client private key used to securely connect to a Kafka target endpoint.
+* `topic` - (Optional) Kafka topic for migration. Default is `kafkaDefaultTopic`.
+
+### kinesis_settings
+
+-> Additional information can be found in the [Using Amazon Kinesis Data Streams as a Target for AWS Database Migration Service documentation](https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Target.Kinesis.html).
+
+* `includeControlDetails` - (Optional) Shows detailed control information for table definition, column definition, and table and column changes in the Kinesis message output. Default is `false`.
+* `includeNullAndEmpty` - (Optional) Include NULL and empty columns in the target. Default is `false`.
+* `includePartitionValue` - (Optional) Shows the partition value within the Kinesis message output, unless the partition type is schema-table-type. Default is `false`.
+* `includeTableAlterOperations` - (Optional) Includes any data definition language (DDL) operations that change the table in the control data. Default is `false`.
+* `includeTransactionDetails` - (Optional) Provides detailed transaction information from the source database. Default is `false`.
+* `messageFormat` - (Optional) Output format for the records created. Default is `json`. Valid values are `json` and `jsonUnformatted` (a single line with no tab).
+* `partitionIncludeSchemaTable` - (Optional) Prefixes schema and table names to partition values, when the partition type is primary-key-type. Default is `false`.
+* `serviceAccessRoleArn` - (Optional) ARN of the IAM Role with permissions to write to the Kinesis data stream.
+* `streamArn` - (Optional) ARN of the Kinesis data stream.
+
+### mongodb_settings
+
+-> Additional information can be found in the [Using MongoDB as a Source for AWS DMS documentation](https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Source.MongoDB.html).
+
+* `authMechanism` - (Optional) Authentication mechanism to access the MongoDB source endpoint. Default is `default`.
+* `authSource` - (Optional) Authentication database name. Not used when `authType` is `no`. Default is `admin`.
+* `authType` - (Optional) Authentication type to access the MongoDB source endpoint. Default is `password`.
+* `docsToInvestigate` - (Optional) Number of documents to preview to determine the document organization. Use this setting when `nestingLevel` is set to `one`. Default is `1000`.
+* `extractDocId` - (Optional) Document ID. Use this setting when `nestingLevel` is set to `none`. Default is `false`.
+* `nestingLevel` - (Optional) Specifies either document or table mode. Default is `none`. Valid values are `one` (table mode) and `none` (document mode).
+
+### redis_settings
+
+-> Additional information can be found in the [Using Redis as a target for AWS Database Migration Service](https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Target.Redis.html).
+
+* `authPassword` - (Optional) The password provided with the auth-role and auth-token options of the AuthType setting for a Redis target endpoint.
+* `authType` - (Required) The type of authentication to perform when connecting to a Redis target. Options include `none`, `authToken`, and `authRole`. The `authToken` option requires an `authPassword` value to be provided. The `authRole` option requires `authUserName` and `authPassword` values to be provided.
+* `authUserName` - (Optional) The username provided with the `authRole` option of the AuthType setting for a Redis target endpoint.
+* `serverName` - (Required) Fully qualified domain name of the endpoint.
+* `port` - (Required) Transmission Control Protocol (TCP) port for the endpoint.
+* `sslCaCertificateArn` - (Optional) The Amazon Resource Name (ARN) for the certificate authority (CA) that DMS uses to connect to your Redis target endpoint.
+* `sslSecurityProtocol`- (Optional) The plaintext option doesn't provide Transport Layer Security (TLS) encryption for traffic between endpoint and database. Options include `plaintext`, `sslEncryption`. The default is `sslEncryption`.
+
+### redshift_settings
+
+-> Additional information can be found in the [Using Amazon Redshift as a Target for AWS Database Migration Service documentation](https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Target.Redshift.html).
+
+* `bucketFolder` - (Optional) Custom S3 Bucket Object prefix for intermediate storage.
+* `bucketName` - (Optional) Custom S3 Bucket name for intermediate storage.
+* `encryptionMode` - (Optional) The server-side encryption mode that you want to encrypt your intermediate .csv object files copied to S3. Defaults to `sseS3`. Valid values are `sseS3` and `sseKms`.
+* `serverSideEncryptionKmsKeyId` - (Required when `encryptionMode` is  `sseKms`, must not be set otherwise) ARN or Id of KMS Key to use when `encryptionMode` is `sseKms`.
+* `serviceAccessRoleArn` - (Optional) Amazon Resource Name (ARN) of the IAM Role with permissions to read from or write to the S3 Bucket for intermediate storage.
+
+### s3_settings
+
+~> **Deprecated:** This argument is deprecated, may not be maintained, and will be removed in a future version. Use the [`awsDmsS3Endpoint`](/docs/providers/aws/r/dms_s3_endpoint.html) resource instead.
+
+-> Additional information can be found in the [Using Amazon S3 as a Source for AWS Database Migration Service documentation](https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Source.S3.html) and [Using Amazon S3 as a Target for AWS Database Migration Service documentation](https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Target.S3.html).
+
+* `addColumnName` - (Optional) Whether to add column name information to the .csv output file. Default is `false`.
+* `bucketFolder` - (Optional) S3 object prefix.
+* `bucketName` - (Optional) S3 bucket name.
+* `cannedAclForObjects` - (Optional) Predefined (canned) access control list for objects created in an S3 bucket. Valid values include `none`, `private`, `publicRead`, `publicReadWrite`, `authenticatedRead`, `awsExecRead`, `bucketOwnerRead`, and `bucketOwnerFullControl`. Default is `none`.
+* `cdcInsertsAndUpdates` - (Optional) Whether to write insert and update operations to .csv or .parquet output files. Default is `false`.
+* `cdcInsertsOnly` - (Optional) Whether to write insert operations to .csv or .parquet output files. Default is `false`.
+* `cdcMaxBatchInterval` - (Optional) Maximum length of the interval, defined in seconds, after which to output a file to Amazon S3. Default is `60`.
+* `cdcMinFileSize` - (Optional) Minimum file size condition as defined in kilobytes to output a file to Amazon S3. Default is `32000`. **NOTE:** Previously, this setting was measured in megabytes but now represents kilobytes. Update configurations accordingly.
+* `cdcPath` - (Optional) Folder path of CDC files. For an S3 source, this setting is required if a task captures change data; otherwise, it's optional. If `cdcPath` is set, AWS DMS reads CDC files from this path and replicates the data changes to the target endpoint. Supported in AWS DMS versions 3.4.2 and later.
+* `compressionType` - (Optional) Set to compress target files. Default is `none`. Valid values are `gzip` and `none`.
+* `csvDelimiter` - (Optional) Delimiter used to separate columns in the source files. Default is `,`.
+* `csvNoSupValue` - (Optional) String to use for all columns not included in the supplemental log.
+* `csvNullValue` - (Optional) String to as null when writing to the target.
+* `csvRowDelimiter` - (Optional) Delimiter used to separate rows in the source files. Default is `\n`.
+* `dataFormat` - (Optional) Output format for the files that AWS DMS uses to create S3 objects. Valid values are `csv` and `parquet`. Default is `csv`.
+* `dataPageSize` - (Optional) Size of one data page in bytes. Default is `1048576` (1 MiB).
+* `datePartitionDelimiter` - (Optional) Date separating delimiter to use during folder partitioning. Valid values are `slash`, `underscore`, `dash`, and `none`. Default is `slash`.
+* `datePartitionEnabled` - (Optional) Partition S3 bucket folders based on transaction commit dates. Default is `false`.
+* `datePartitionSequence` - (Optional) Date format to use during folder partitioning. Use this parameter when `datePartitionEnabled` is set to true. Valid values are `yyyymmdd`, `yyyymmddhh`, `yyyymm`, `mmyyyydd`, and `ddmmyyyy`. Default is `yyyymmdd`.
+* `dictPageSizeLimit` - (Optional) Maximum size in bytes of an encoded dictionary page of a column. Default is `1048576` (1 MiB).
+* `enableStatistics` - (Optional) Whether to enable statistics for Parquet pages and row groups. Default is `true`.
+* `encodingType` - (Optional) Type of encoding to use. Value values are `rleDictionary`, `plain`, and `plainDictionary`. Default is `rleDictionary`.
+* `encryptionMode` - (Optional) Server-side encryption mode that you want to encrypt your .csv or .parquet object files copied to S3. Valid values are `sseS3` and `sseKms`. Default is `sseS3`.
+* `externalTableDefinition` - (Optional) JSON document that describes how AWS DMS should interpret the data.
+* `glueCatalogGeneration` - (Optional) Whether to integrate AWS Glue Data Catalog with an Amazon S3 target. See [Using AWS Glue Data Catalog with an Amazon S3 target for AWS DMS](https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Target.S3.html#CHAP_Target.S3.GlueCatalog) for more information. Default is `false`.
+* `ignoreHeaderRows` - (Optional) When this value is set to `1`, DMS ignores the first row header in a .csv file. Default is `0`.
+* `includeOpForFullLoad` - (Optional) Whether to enable a full load to write INSERT operations to the .csv output files only to indicate how the rows were added to the source database. Default is `false`.
+* `maxFileSize` - (Optional) Maximum size (in KB) of any .csv file to be created while migrating to an S3 target during full load. Valid values are from `1` to `1048576`. Default is `1048576` (1 GB).
+* `parquetTimestampInMillisecond` - (Optional) - Specifies the precision of any TIMESTAMP column values written to an S3 object file in .parquet format. Default is `false`.
+* `parquetVersion` - (Optional) Version of the .parquet file format. Default is `parquet10`. Valid values are `parquet10` and `parquet20`.
+* `preserveTransactions` - (Optional) Whether DMS saves the transaction order for a CDC load on the S3 target specified by `cdcPath`. Default is `false`.
+* `rfc4180` - (Optional) For an S3 source, whether each leading double quotation mark has to be followed by an ending double quotation mark. Default is `true`.
+* `rowGroupLength` - (Optional) Number of rows in a row group. Default is `10000`.
+* `serverSideEncryptionKmsKeyId` - (Required when `encryptionMode` is  `sseKms`, must not be set otherwise) ARN or Id of KMS Key to use when `encryptionMode` is `sseKms`.
+* `serviceAccessRoleArn` - (Optional) ARN of the IAM Role with permissions to read from or write to the S3 Bucket.
+* `timestampColumnName` - (Optional) Column to add with timestamp information to the endpoint data for an Amazon S3 target.
+* `useCsvNoSupValue` - (Optional) Whether to use `csvNoSupValue` for columns not included in the supplemental log.
+* `useTaskStartTimeForFullLoadTimestamp` - (Optional) When set to true, uses the task start time as the timestamp column value instead of the time data is written to target. For full load, when set to true, each row of the timestamp column contains the task start time. For CDC loads, each row of the timestamp column contains the transaction commit time. When set to false, the full load timestamp in the timestamp column increments with the time data arrives at the target. Default is `false`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `endpointArn` - ARN for the endpoint.
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `5M`)
+- `delete` - (Default `10M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import endpoints using the `endpointId`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import endpoints using the `endpointId`. For example:
+
+```console
+% terraform import aws_dms_endpoint.test test-dms-endpoint-tf
+```
+
+<!-- cache-key: cdktf-0.18.0 input-f2f58fcc9fc681dd781d8464906ff4fb32f765c99816410fe344b23200d8740a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/dms_event_subscription.html.markdown b/website/docs/cdktf/typescript/r/dms_event_subscription.html.markdown
new file mode 100644
index 00000000000..5341c82eb55
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/dms_event_subscription.html.markdown
@@ -0,0 +1,96 @@
+---
+subcategory: "DMS (Database Migration)"
+layout: "aws"
+page_title: "AWS: aws_dms_event_subscription"
+description: |-
+  Provides a DMS (Data Migration Service) event subscription resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_dms_event_subscription
+
+Provides a DMS (Data Migration Service) event subscription resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DmsEventSubscription } from "./.gen/providers/aws/dms-event-subscription";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DmsEventSubscription(this, "example", {
+      enabled: true,
+      eventCategories: ["creation", "failure"],
+      name: "my-favorite-event-subscription",
+      snsTopicArn: Token.asString(awsSnsTopicExample.arn),
+      sourceIds: [
+        Token.asString(awsDmsReplicationTaskExample.replicationTaskId),
+      ],
+      sourceType: "replication-task",
+      tags: {
+        Name: "example",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) Name of event subscription.
+* `enabled` - (Optional, Default: true) Whether the event subscription should be enabled.
+* `eventCategories` - (Optional) List of event categories to listen for, see `describeEventCategories` for a canonical list.
+* `sourceType` - (Optional, Default: all events) Type of source for events. Valid values: `replicationInstance` or `replicationTask`
+* `sourceIds` - (Required) Ids of sources to listen to.
+* `snsTopicArn` - (Required) SNS topic arn to send events on.
+* `tags` - (Optional) Map of resource tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the DMS Event Subscription.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `10M`)
+- `update` - (Default `10M`)
+- `delete` - (Default `10M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import event subscriptions using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import event subscriptions using the `name`. For example:
+
+```console
+% terraform import aws_dms_event_subscription.test my-awesome-event-subscription
+```
+
+<!-- cache-key: cdktf-0.18.0 input-8fddb59943e1aef59e7d893b468b8a5bb1e2486c31cb4b972078535d91348ad6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/dms_replication_config.html.markdown b/website/docs/cdktf/typescript/r/dms_replication_config.html.markdown
new file mode 100644
index 00000000000..07b3b3ce0ed
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/dms_replication_config.html.markdown
@@ -0,0 +1,123 @@
+---
+subcategory: "DMS (Database Migration)"
+layout: "aws"
+page_title: "AWS: aws_dms_replication_config"
+description: |-
+  Provides a DMS Serverless replication config resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_dms_replication_config
+
+Provides a DMS Serverless replication config resource.
+
+~> **NOTE:** Changing most arguments will stop the replication if it is running. You can set `startReplication` to resume the replication afterwards.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DmsReplicationConfig } from "./.gen/providers/aws/dms-replication-config";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DmsReplicationConfig(this, "name", {
+      computeConfig: {
+        maxCapacityUnits: Token.asNumber("64"),
+        minCapacityUnits: Token.asNumber("2"),
+        preferredMaintenanceWindow: "sun:23:45-mon:00:30",
+        replicationSubnetGroupId: defaultVar.replicationSubnetGroupId,
+      },
+      replicationConfigIdentifier: "test-dms-serverless-replication-tf",
+      replicationType: "cdc",
+      resourceIdentifier: "test-dms-serverless-replication-tf",
+      sourceEndpointArn: source.endpointArn,
+      startReplication: true,
+      tableMappings:
+        '  {\n    "rules":[{"rule-type":"selection","rule-id":"1","rule-name":"1","object-locator":{"schema-name":"%%","table-name":"%%", "rule-action":"include"}]\n  }\n\n',
+      targetEndpointArn: target.endpointArn,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `computeConfig` - (Required) Configuration block for provisioning an DMS Serverless replication.
+* `startReplication` - (Optional) Whether to run or stop the serverless replication, default is false.
+* `replicationConfigIdentifier` - (Required) Unique identifier that you want to use to create the config.
+* `replicationType` - (Required) The migration type. Can be one of `full-load | cdc | full-load-and-cdc`.
+* `sourceEndpointArn` - (Required) The Amazon Resource Name (ARN) string that uniquely identifies the source endpoint.
+* `tableMappings` - (Required) An escaped JSON string that contains the table mappings. For information on table mapping see [Using Table Mapping with an AWS Database Migration Service Task to Select and Filter Data](http://docs.aws.amazon.com/dms/latest/userguide/CHAP_Tasks.CustomizingTasks.TableMapping.html)
+* `targetEndpointArn` - (Required) The Amazon Resource Name (ARN) string that uniquely identifies the target endpoint.
+* `replicationSettings` - (Optional) An escaped JSON string that are used to provision this replication configuration. For example, [Change processing tuning settings](https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Tasks.CustomizingTasks.TaskSettings.ChangeProcessingTuning.html)
+* `resourceIdentifier` - (Optional) Unique value or name that you set for a given resource that can be used to construct an Amazon Resource Name (ARN) for that resource. For more information, see [Fine-grained access control using resource names and tags](https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Security.html#CHAP_Security.FineGrainedAccess)
+* `supplementalSettings` - (Optional) JSON settings for specifying supplemental data. For more information see [Specifying supplemental data for task settings](https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Tasks.TaskData.html)
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+`computeConfig` block support the following:
+
+* `availabilityZone` - (Optional) The Availability Zone where the DMS Serverless replication using this configuration will run. The default value is a random.
+* `dnsNameServers` - (Optional) A list of custom DNS name servers supported for the DMS Serverless replication to access your source or target database.
+* `kmsKeyId` - (Optional) An Key Management Service (KMS) key Amazon Resource Name (ARN) that is used to encrypt the data during DMS Serverless replication. If you don't specify a value for the KmsKeyId parameter, DMS uses your default encryption key.
+* `maxCapacityUnits` - (Required) Specifies the maximum value of the DMS capacity units (DCUs) for which a given DMS Serverless replication can be provisioned. A single DCU is 2GB of RAM, with 2 DCUs as the minimum value allowed. The list of valid DCU values includes 2, 4, 8, 16, 32, 64, 128, 192, 256, and 384.
+* `minCapacityUnits` - (Optional) Specifies the minimum value of the DMS capacity units (DCUs) for which a given DMS Serverless replication can be provisioned. The list of valid DCU values includes 2, 4, 8, 16, 32, 64, 128, 192, 256, and 384. If this value isn't set DMS scans the current activity of available source tables to identify an optimum setting for this parameter.
+* `multiAz` - (Optional) Specifies if the replication instance is a multi-az deployment. You cannot set the `availabilityZone` parameter if the `multiAz` parameter is set to `true`.
+* `preferredMaintenanceWindow` - (Optional) The weekly time range during which system maintenance can occur, in Universal Coordinated Time (UTC).
+
+    - Default: A 30-minute window selected at random from an 8-hour block of time per region, occurring on a random day of the week.
+    - Format: `ddd:hh24:miDdd:hh24:mi`
+    - Valid Days: `mon, tue, wed, thu, fri, sat, sun`
+    - Constraints: Minimum 30-minute window.
+
+* `replicationSubnetGroupId` - (Optional) Specifies a subnet group identifier to associate with the DMS Serverless replication.
+* `vpcSecurityGroupIds` - (Optional) Specifies the virtual private cloud (VPC) security group to use with the DMS Serverless replication. The VPC security group must work with the VPC containing the replication.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) for the serverless replication config.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `60M`)
+* `update` - (Default `60M`)
+* `delete` - (Default `60M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import replication configs using the `arn`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import a replication config using the `arn`. For example:
+
+```console
+% terraform import aws_dms_replication_config.example arn:aws:dms:us-east-1:123456789012:replication-config:UX6OL6MHMMJKFFOXE3H7LLJCMEKBDUG4ZV7DRSI
+```
+
+<!-- cache-key: cdktf-0.18.0 input-d8fd85468f8a4bdafb679d4023f27b854c796261291e1127611bbb9de03be1ef -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/dms_replication_instance.html.markdown b/website/docs/cdktf/typescript/r/dms_replication_instance.html.markdown
new file mode 100644
index 00000000000..747de0dc760
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/dms_replication_instance.html.markdown
@@ -0,0 +1,197 @@
+---
+subcategory: "DMS (Database Migration)"
+layout: "aws"
+page_title: "AWS: aws_dms_replication_instance"
+description: |-
+  Provides a DMS (Data Migration Service) replication instance resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_dms_replication_instance
+
+Provides a DMS (Data Migration Service) replication instance resource. DMS replication instances can be created, updated, deleted, and imported.
+
+## Example Usage
+
+Create required roles and then create a DMS instance, setting the depends_on to the required role policy attachments.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { DmsReplicationInstance } from "./.gen/providers/aws/dms-replication-instance";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+import { IamRolePolicyAttachment } from "./.gen/providers/aws/iam-role-policy-attachment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const dmsAssumeRole = new DataAwsIamPolicyDocument(
+      this,
+      "dms_assume_role",
+      {
+        statement: [
+          {
+            actions: ["sts:AssumeRole"],
+            principals: [
+              {
+                identifiers: ["dms.amazonaws.com"],
+                type: "Service",
+              },
+            ],
+          },
+        ],
+      }
+    );
+    const dmsAccessForEndpoint = new IamRole(this, "dms-access-for-endpoint", {
+      assumeRolePolicy: Token.asString(dmsAssumeRole.json),
+      name: "dms-access-for-endpoint",
+    });
+    const dmsCloudwatchLogsRole = new IamRole(
+      this,
+      "dms-cloudwatch-logs-role",
+      {
+        assumeRolePolicy: Token.asString(dmsAssumeRole.json),
+        name: "dms-cloudwatch-logs-role",
+      }
+    );
+    const dmsVpcRole = new IamRole(this, "dms-vpc-role", {
+      assumeRolePolicy: Token.asString(dmsAssumeRole.json),
+      name: "dms-vpc-role",
+    });
+    const dmsAccessForEndpointAmazonDmsRedshiftS3Role =
+      new IamRolePolicyAttachment(
+        this,
+        "dms-access-for-endpoint-AmazonDMSRedshiftS3Role",
+        {
+          policyArn:
+            "arn:aws:iam::aws:policy/service-role/AmazonDMSRedshiftS3Role",
+          role: dmsAccessForEndpoint.name,
+        }
+      );
+    const dmsCloudwatchLogsRoleAmazonDmsCloudWatchLogsRole =
+      new IamRolePolicyAttachment(
+        this,
+        "dms-cloudwatch-logs-role-AmazonDMSCloudWatchLogsRole",
+        {
+          policyArn:
+            "arn:aws:iam::aws:policy/service-role/AmazonDMSCloudWatchLogsRole",
+          role: dmsCloudwatchLogsRole.name,
+        }
+      );
+    const dmsVpcRoleAmazonDmsvpcManagementRole = new IamRolePolicyAttachment(
+      this,
+      "dms-vpc-role-AmazonDMSVPCManagementRole",
+      {
+        policyArn:
+          "arn:aws:iam::aws:policy/service-role/AmazonDMSVPCManagementRole",
+        role: dmsVpcRole.name,
+      }
+    );
+    new DmsReplicationInstance(this, "test", {
+      allocatedStorage: 20,
+      applyImmediately: true,
+      autoMinorVersionUpgrade: true,
+      availabilityZone: "us-west-2c",
+      dependsOn: [
+        dmsAccessForEndpointAmazonDmsRedshiftS3Role,
+        dmsCloudwatchLogsRoleAmazonDmsCloudWatchLogsRole,
+        dmsVpcRoleAmazonDmsvpcManagementRole,
+      ],
+      engineVersion: "3.1.4",
+      kmsKeyArn:
+        "arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012",
+      multiAz: false,
+      preferredMaintenanceWindow: "sun:10:30-sun:14:30",
+      publiclyAccessible: true,
+      replicationInstanceClass: "dms.t2.micro",
+      replicationInstanceId: "test-dms-replication-instance-tf",
+      replicationSubnetGroupId: testDmsReplicationSubnetGroupTf.id,
+      tags: {
+        Name: "test",
+      },
+      vpcSecurityGroupIds: ["sg-12345678"],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `allocatedStorage` - (Optional, Default: 50, Min: 5, Max: 6144) The amount of storage (in gigabytes) to be initially allocated for the replication instance.
+* `allowMajorVersionUpgrade` - (Optional, Default: false) Indicates that major version upgrades are allowed.
+* `applyImmediately` - (Optional, Default: false) Indicates whether the changes should be applied immediately or during the next maintenance window. Only used when updating an existing resource.
+* `autoMinorVersionUpgrade` - (Optional, Default: false) Indicates that minor engine upgrades will be applied automatically to the replication instance during the maintenance window.
+* `availabilityZone` - (Optional) The EC2 Availability Zone that the replication instance will be created in.
+* `engineVersion` - (Optional) The engine version number of the replication instance.
+* `kmsKeyArn` - (Optional) The Amazon Resource Name (ARN) for the KMS key that will be used to encrypt the connection parameters. If you do not specify a value for `kmsKeyArn`, then AWS DMS will use your default encryption key. AWS KMS creates the default encryption key for your AWS account. Your AWS account has a different default encryption key for each AWS region.
+* `multiAz` - (Optional) Specifies if the replication instance is a multi-az deployment. You cannot set the `availabilityZone` parameter if the `multiAz` parameter is set to `true`.
+* `networkType` - (Optional) The type of IP address protocol used by a replication instance. Valid values: `ipv4`, `dual`.
+* `preferredMaintenanceWindow` - (Optional) The weekly time range during which system maintenance can occur, in Universal Coordinated Time (UTC).
+
+    - Default: A 30-minute window selected at random from an 8-hour block of time per region, occurring on a random day of the week.
+    - Format: `ddd:hh24:miDdd:hh24:mi`
+    - Valid Days: `mon, tue, wed, thu, fri, sat, sun`
+    - Constraints: Minimum 30-minute window.
+
+* `publiclyAccessible` - (Optional, Default: false) Specifies the accessibility options for the replication instance. A value of true represents an instance with a public IP address. A value of false represents an instance with a private IP address.
+* `replicationInstanceClass` - (Required) The compute and memory capacity of the replication instance as specified by the replication instance class. See [AWS DMS User Guide](https://docs.aws.amazon.com/dms/latest/userguide/CHAP_ReplicationInstance.Types.html) for available instance sizes and advice on which one to choose.
+* `replicationInstanceId` - (Required) The replication instance identifier. This parameter is stored as a lowercase string.
+
+    - Must contain from 1 to 63 alphanumeric characters or hyphens.
+    - First character must be a letter.
+    - Cannot end with a hyphen
+    - Cannot contain two consecutive hyphens.
+
+* `replicationSubnetGroupId` - (Optional) A subnet group to associate with the replication instance.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `vpcSecurityGroupIds` - (Optional) A list of VPC security group IDs to be used with the replication instance. The VPC security groups must work with the VPC containing the replication instance.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `replicationInstanceArn` - The Amazon Resource Name (ARN) of the replication instance.
+* `replicationInstancePrivateIps` -  A list of the private IP addresses of the replication instance.
+* `replicationInstancePublicIps` - A list of the public IP addresses of the replication instance.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `40M`)
+- `update` - (Default `30M`)
+- `delete` - (Default `30M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import replication instances using the `replicationInstanceId`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import replication instances using the `replicationInstanceId`. For example:
+
+```console
+% terraform import aws_dms_replication_instance.test test-dms-replication-instance-tf
+```
+
+<!-- cache-key: cdktf-0.18.0 input-2a8ab503ceaef9d74fa0c9b95408ac59f3a841f451a3553fdde42db11c32ef45 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/dms_replication_subnet_group.html.markdown b/website/docs/cdktf/typescript/r/dms_replication_subnet_group.html.markdown
new file mode 100644
index 00000000000..318d88b3b5b
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/dms_replication_subnet_group.html.markdown
@@ -0,0 +1,153 @@
+---
+subcategory: "DMS (Database Migration)"
+layout: "aws"
+page_title: "AWS: aws_dms_replication_subnet_group"
+description: |-
+  Provides a DMS (Data Migration Service) subnet group resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_dms_replication_subnet_group
+
+Provides a DMS (Data Migration Service) replication subnet group resource. DMS replication subnet groups can be created, updated, deleted, and imported.
+
+~> **Note:** AWS requires a special IAM role called `dmsVpcRole` when using this resource. See the example below to create it as part of your configuration.
+
+## Example Usage
+
+### Basic
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DmsReplicationSubnetGroup } from "./.gen/providers/aws/dms-replication-subnet-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DmsReplicationSubnetGroup(this, "example", {
+      replicationSubnetGroupDescription: "Example replication subnet group",
+      replicationSubnetGroupId: "example-dms-replication-subnet-group-tf",
+      subnetIds: ["subnet-12345678", "subnet-12345679"],
+      tags: {
+        Name: "example",
+      },
+    });
+  }
+}
+
+```
+
+### Creating special IAM role
+
+If your account does not already include the `dmsVpcRole` IAM role, you will need to create it to allow DMS to manage subnets in the VPC.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DmsReplicationSubnetGroup } from "./.gen/providers/aws/dms-replication-subnet-group";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+import { IamRolePolicyAttachment } from "./.gen/providers/aws/iam-role-policy-attachment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const dmsVpcRole = new IamRole(this, "dms-vpc-role", {
+      assumeRolePolicy: Token.asString(
+        Fn.jsonencode({
+          Statement: [
+            {
+              Action: "sts:AssumeRole",
+              Effect: "Allow",
+              Principal: {
+                Service: "dms.amazonaws.com",
+              },
+            },
+          ],
+          Version: "2012-10-17",
+        })
+      ),
+      description: "Allows DMS to manage VPC",
+      name: "dms-vpc-role",
+    });
+    const example = new IamRolePolicyAttachment(this, "example", {
+      policyArn:
+        "arn:aws:iam::aws:policy/service-role/AmazonDMSVPCManagementRole",
+      role: dmsVpcRole.name,
+    });
+    const awsDmsReplicationSubnetGroupExample = new DmsReplicationSubnetGroup(
+      this,
+      "example_2",
+      {
+        dependsOn: [example],
+        replicationSubnetGroupDescription: "Example",
+        replicationSubnetGroupId: "example-id",
+        subnetIds: ["subnet-12345678", "subnet-12345679"],
+        tags: {
+          Name: "example-id",
+        },
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsDmsReplicationSubnetGroupExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `replicationSubnetGroupDescription` - (Required) Description for the subnet group.
+* `replicationSubnetGroupId` - (Required) Name for the replication subnet group. This value is stored as a lowercase string. It must contain no more than 255 alphanumeric characters, periods, spaces, underscores, or hyphens and cannot be `default`.
+* `subnetIds` - (Required) List of at least 2 EC2 subnet IDs for the subnet group. The subnets must cover at least 2 availability zones.
+* `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `vpcId` - The ID of the VPC the subnet group is in.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `15M`)
+- `update` - (Default `15M`)
+- `delete` - (Default `15M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import replication subnet groups using the `replicationSubnetGroupId`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import replication subnet groups using the `replicationSubnetGroupId`. For example:
+
+```console
+% terraform import aws_dms_replication_subnet_group.test test-dms-replication-subnet-group-tf
+```
+
+<!-- cache-key: cdktf-0.18.0 input-fa31dcade703f4d670cd66caa1d006a3088f31feb8196071fd288c511faec143 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/dms_replication_task.html.markdown b/website/docs/cdktf/typescript/r/dms_replication_task.html.markdown
new file mode 100644
index 00000000000..6f442309148
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/dms_replication_task.html.markdown
@@ -0,0 +1,103 @@
+---
+subcategory: "DMS (Database Migration)"
+layout: "aws"
+page_title: "AWS: aws_dms_replication_task"
+description: |-
+  Provides a DMS (Data Migration Service) replication task resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_dms_replication_task
+
+Provides a DMS (Data Migration Service) replication task resource. DMS replication tasks can be created, updated, deleted, and imported.
+
+~> **NOTE:** Changing most arguments will stop the task if it is running. You can set `startReplicationTask` to resume the task afterwards.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DmsReplicationTask } from "./.gen/providers/aws/dms-replication-task";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DmsReplicationTask(this, "test", {
+      cdcStartTime: Token.asString(1484346880),
+      migrationType: "full-load",
+      replicationInstanceArn:
+        testDmsReplicationInstanceTf.replicationInstanceArn,
+      replicationTaskId: "test-dms-replication-task-tf",
+      replicationTaskSettings: "...",
+      sourceEndpointArn: testDmsSourceEndpointTf.endpointArn,
+      tableMappings:
+        '{\\"rules\\":[{\\"rule-type\\":\\"selection\\",\\"rule-id\\":\\"1\\",\\"rule-name\\":\\"1\\",\\"object-locator\\":{\\"schema-name\\":\\"%\\",\\"table-name\\":\\"%\\"},\\"rule-action\\":\\"include\\"}]}',
+      tags: {
+        Name: "test",
+      },
+      targetEndpointArn: testDmsTargetEndpointTf.endpointArn,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `cdcStartPosition` - (Optional, Conflicts with `cdcStartTime`) Indicates when you want a change data capture (CDC) operation to start. The value can be in date, checkpoint, or LSN/SCN format depending on the source engine. For more information, see [Determining a CDC native start point](https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Task.CDC.html#CHAP_Task.CDC.StartPoint.Native).
+* `cdcStartTime` - (Optional, Conflicts with `cdcStartPosition`) The Unix timestamp integer for the start of the Change Data Capture (CDC) operation.
+* `migrationType` - (Required) The migration type. Can be one of `full-load | cdc | full-load-and-cdc`.
+* `replicationInstanceArn` - (Required) The Amazon Resource Name (ARN) of the replication instance.
+* `replicationTaskId` - (Required) The replication task identifier.
+
+    - Must contain from 1 to 255 alphanumeric characters or hyphens.
+    - First character must be a letter.
+    - Cannot end with a hyphen.
+    - Cannot contain two consecutive hyphens.
+
+* `replicationTaskSettings` - (Optional) An escaped JSON string that contains the task settings. For a complete list of task settings, see [Task Settings for AWS Database Migration Service Tasks](http://docs.aws.amazon.com/dms/latest/userguide/CHAP_Tasks.CustomizingTasks.TaskSettings.html).
+* `sourceEndpointArn` - (Required) The Amazon Resource Name (ARN) string that uniquely identifies the source endpoint.
+* `startReplicationTask` - (Optional) Whether to run or stop the replication task.
+* `tableMappings` - (Required) An escaped JSON string that contains the table mappings. For information on table mapping see [Using Table Mapping with an AWS Database Migration Service Task to Select and Filter Data](http://docs.aws.amazon.com/dms/latest/userguide/CHAP_Tasks.CustomizingTasks.TableMapping.html)
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `targetEndpointArn` - (Required) The Amazon Resource Name (ARN) string that uniquely identifies the target endpoint.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `replicationTaskArn` - The Amazon Resource Name (ARN) for the replication task.
+* `status` - Replication Task status.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import replication tasks using the `replicationTaskId`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import replication tasks using the `replicationTaskId`. For example:
+
+```console
+% terraform import aws_dms_replication_task.test test-dms-replication-task-tf
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1c6fdf5f04f2d2b7b3a680bdf7b1130eb1a4ca982a963ef8d0d3f17d5c86acbb -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/dms_s3_endpoint.html.markdown b/website/docs/cdktf/typescript/r/dms_s3_endpoint.html.markdown
new file mode 100644
index 00000000000..652f3746be7
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/dms_s3_endpoint.html.markdown
@@ -0,0 +1,215 @@
+---
+subcategory: "DMS (Database Migration)"
+layout: "aws"
+page_title: "AWS: aws_dms_s3_endpoint"
+description: |-
+  Provides a DMS (Data Migration Service) S3 endpoint resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_dms_s3_endpoint
+
+Provides a DMS (Data Migration Service) S3 endpoint resource. DMS S3 endpoints can be created, updated, deleted, and imported.
+
+~> **Note:** AWS is deprecating `extraConnectionAttributes`, such as used with `awsDmsEndpoint`. This resource is an alternative to `awsDmsEndpoint` and does not use `extraConnectionAttributes`. (AWS currently includes `extraConnectionAttributes` in the raw responses to the AWS Provider requests and so they may be visible in Terraform logs.)
+
+~> **Note:** Some of this resource's arguments have default values that come from the AWS Provider. Other default values are provided by AWS and subject to change without notice. When relying on AWS defaults, the Terraform state will often have a zero value. For example, the AWS Provider does not provide a default for `cdcMaxBatchInterval` but the AWS default is `60` (seconds). However, the Terraform state will show `0` since this is the value return by AWS when no value is present. Below, we aim to flag the defaults that come from AWS (_e.g._, "AWS default...").
+
+## Example Usage
+
+### Minimal Configuration
+
+This is the minimal configuration for an `awsDmsS3Endpoint`. This endpoint will rely on the AWS Provider and AWS defaults.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DmsS3Endpoint } from "./.gen/providers/aws/dms-s3-endpoint";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DmsS3Endpoint(this, "example", {
+      bucketName: "beckut_name",
+      dependsOn: [awsIamRolePolicyExample],
+      endpointId: "donnedtipi",
+      endpointType: "target",
+      serviceAccessRoleArn: Token.asString(awsIamRoleExample.arn),
+    });
+  }
+}
+
+```
+
+### Complete Configuration
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DmsS3Endpoint } from "./.gen/providers/aws/dms-s3-endpoint";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DmsS3Endpoint(this, "example", {
+      addColumnName: true,
+      addTrailingPaddingCharacter: false,
+      bucketFolder: "folder",
+      bucketName: "bucket_name",
+      cannedAclForObjects: "private",
+      cdcInsertsAndUpdates: true,
+      cdcInsertsOnly: false,
+      cdcMaxBatchInterval: 100,
+      cdcMinFileSize: 16,
+      cdcPath: "cdc/path",
+      compressionType: "GZIP",
+      csvDelimiter: ";",
+      csvNoSupValue: "x",
+      csvNullValue: "?",
+      csvRowDelimiter: "\\r\\n",
+      dataFormat: "parquet",
+      dataPageSize: 1100000,
+      datePartitionDelimiter: "UNDERSCORE",
+      datePartitionEnabled: true,
+      datePartitionSequence: "yyyymmddhh",
+      datePartitionTimezone: "Asia/Seoul",
+      dependsOn: [awsIamRolePolicyExample],
+      dictPageSizeLimit: 1000000,
+      enableStatistics: false,
+      encodingType: "plain",
+      encryptionMode: "SSE_S3",
+      endpointId: "donnedtipi",
+      endpointType: "target",
+      expectedBucketOwner: Token.asString(current.accountId),
+      externalTableDefinition: "etd",
+      glueCatalogGeneration: true,
+      ignoreHeaderRows: 1,
+      includeOpForFullLoad: true,
+      maxFileSize: 1000000,
+      parquetTimestampInMillisecond: true,
+      parquetVersion: "parquet-2-0",
+      preserveTransactions: false,
+      rfc4180: false,
+      rowGroupLength: 11000,
+      serverSideEncryptionKmsKeyId: Token.asString(awsKmsKeyExample.arn),
+      serviceAccessRoleArn: Token.asString(awsIamRoleExample.arn),
+      sslMode: "none",
+      tags: {
+        Name: "donnedtipi",
+        Remove: "to-remove",
+        Update: "to-update",
+      },
+      timestampColumnName: "tx_commit_time",
+      useCsvNoSupValue: false,
+      useTaskStartTimeForFullLoadTimestamp: true,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `bucketName` - (Required) S3 bucket name.
+* `cdcPath` - (Required for CDC; otherwise, Optional) Folder path of CDC files. If `cdcPath` is set, AWS DMS reads CDC files from this path and replicates the data changes to the target endpoint. Supported in AWS DMS versions 3.4.2 and later.
+* `endpointId` - (Required) Database endpoint identifier. Identifiers must contain from 1 to 255 alphanumeric characters or hyphens, begin with a letter, contain only ASCII letters, digits, and hyphens, not end with a hyphen, and not contain two consecutive hyphens.
+* `endpointType` - (Required) Type of endpoint. Valid values are `source`, `target`.
+* `externalTableDefinition` - (Required for `source` endpoints; otherwise, Optional) JSON document that describes how AWS DMS should interpret the data.
+* `serviceAccessRoleArn` - (Required) ARN of the IAM role with permissions to the S3 Bucket.
+
+The following arguments are optional:
+
+* `addColumnName` - (Optional) Whether to add column name information to the .csv output file. Default is `false`.
+* `addTrailingPaddingCharacter` - (Optional) Whether to add padding. Default is `false`. (Ignored for source endpoints.)
+* `bucketFolder` - (Optional) S3 object prefix.
+* `cannedAclForObjects` - (Optional) Predefined (canned) access control list for objects created in an S3 bucket. Valid values include `none`, `private`, `publicRead`, `publicReadWrite`, `authenticatedRead`, `awsExecRead`, `bucketOwnerRead`, and `bucketOwnerFullControl`. Default is `none`.
+* `cdcInsertsAndUpdates` - (Optional) Whether to write insert and update operations to .csv or .parquet output files. Default is `false`.
+* `cdcInsertsOnly` - (Optional) Whether to write insert operations to .csv or .parquet output files. Default is `false`.
+* `cdcMaxBatchInterval` - (Optional) Maximum length of the interval, defined in seconds, after which to output a file to Amazon S3. (AWS default is `60`.)
+* `cdcMinFileSize` - (Optional) Minimum file size condition as defined in kilobytes to output a file to Amazon S3. (AWS default is 32000 KB.)
+* `certificateArn` - (Optional, Default: empty string) ARN for the certificate.
+* `compressionType` - (Optional) Set to compress target files. Valid values are `gzip` and `none`. Default is `none`. (Ignored for source endpoints.)
+* `csvDelimiter` - (Optional) Delimiter used to separate columns in the source files. Default is `,`.
+* `csvNoSupValue` - (Optional) Only applies if output files for a CDC load are written in .csv format. If `useCsvNoSupValue` is set to `true`, string to use for all columns not included in the supplemental log. If you do not specify a string value, DMS uses the null value for these columns regardless of `useCsvNoSupValue`. (Ignored for source endpoints.)
+* `csvNullValue` - (Optional) String to as null when writing to the target. (AWS default is `null`.)
+* `csvRowDelimiter` - (Optional) Delimiter used to separate rows in the source files. Default is newline (_i.e._, `\n`).
+* `dataFormat` - (Optional) Output format for the files that AWS DMS uses to create S3 objects. Valid values are `csv` and `parquet`.  (Ignored for source endpoints -- only `csv` is valid.)
+* `dataPageSize` - (Optional) Size of one data page in bytes. (AWS default is 1 MiB, _i.e._, `1048576`.)
+* `datePartitionDelimiter` - (Optional) Date separating delimiter to use during folder partitioning. Valid values are `slash`, `underscore`, `dash`, and `none`. (AWS default is `slash`.) (Ignored for source endpoints.)
+* `datePartitionEnabled` - (Optional) Partition S3 bucket folders based on transaction commit dates. Default is `false`. (Ignored for source endpoints.)
+* `datePartitionSequence` - (Optional) Date format to use during folder partitioning. Use this parameter when `datePartitionEnabled` is set to true. Valid values are `yyyymmdd`, `yyyymmddhh`, `yyyymm`, `mmyyyydd`, and `ddmmyyyy`. (AWS default is `yyyymmdd`.) (Ignored for source endpoints.)
+* `datePartitionTimezone` - (Optional) Convert the current UTC time to a timezone. The conversion occurs when a date partition folder is created and a CDC filename is generated. The timezone format is Area/Location (_e.g._, `europe/paris`). Use this when `datePartitionEnabled` is `true`. (Ignored for source endpoints.)
+* `detachTargetOnLobLookupFailureParquet` - (Optional) Undocumented argument for use as directed by AWS Support.
+* `dictPageSizeLimit` - (Optional) Maximum size in bytes of an encoded dictionary page of a column. (AWS default is 1 MiB, _i.e._, `1048576`.)
+* `enableStatistics` - (Optional) Whether to enable statistics for Parquet pages and row groups. Default is `true`.
+* `encodingType` - (Optional) Type of encoding to use. Value values are `rleDictionary`, `plain`, and `plainDictionary`. (AWS default is `rleDictionary`.)
+* `encryptionMode` - (Optional) Server-side encryption mode that you want to encrypt your .csv or .parquet object files copied to S3. Valid values are `sseS3` and `sseKms`. (AWS default is `sseS3`.) (Ignored for source endpoints -- only `sseS3` is valid.)
+* `expectedBucketOwner` - (Optional) Bucket owner to prevent sniping. Value is an AWS account ID.
+* `glueCatalogGeneration` - (Optional) Whether to integrate AWS Glue Data Catalog with an Amazon S3 target. See [Using AWS Glue Data Catalog with an Amazon S3 target for AWS DMS](https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Target.S3.html#CHAP_Target.S3.GlueCatalog) for more information. Default is `false`.
+* `ignoreHeaderRows` - (Optional, Force New) When this value is set to `1`, DMS ignores the first row header in a .csv file. (AWS default is `0`.)
+* `includeOpForFullLoad` - (Optional) Whether to enable a full load to write INSERT operations to the .csv output files only to indicate how the rows were added to the source database. Default is `false`.
+* `kmsKeyArn` - (Optional) ARN for the KMS key that will be used to encrypt the connection parameters. If you do not specify a value for `kmsKeyArn`, then AWS DMS will use your default encryption key. AWS KMS creates the default encryption key for your AWS account. Your AWS account has a different default encryption key for each AWS region.
+* `maxFileSize` - (Optional) Maximum size (in KB) of any .csv file to be created while migrating to an S3 target during full load. Valid values are from `1` to `1048576`. (AWS default is 1 GB, _i.e._, `1048576`.)
+* `parquetTimestampInMillisecond` - (Optional) - Specifies the precision of any TIMESTAMP column values written to an S3 object file in .parquet format. Default is `false`. (Ignored for source endpoints.)
+* `parquetVersion` - (Optional) Version of the .parquet file format. Valid values are `parquet10` and `parquet20`. (AWS default is `parquet10`.) (Ignored for source endpoints.)
+* `preserveTransactions` - (Optional) Whether DMS saves the transaction order for a CDC load on the S3 target specified by `cdcPath`. Default is `false`. (Ignored for source endpoints.)
+* `rfc4180` - (Optional) For an S3 source, whether each leading double quotation mark has to be followed by an ending double quotation mark. Default is `true`.
+* `rowGroupLength` - (Optional) Number of rows in a row group. (AWS default is `10000`.)
+* `serverSideEncryptionKmsKeyId` - (Optional) When `encryptionMode` is `sseKms`, ARN for the AWS KMS key. (Ignored for source endpoints -- only `sseS3` `encryptionMode` is valid.)
+* `sslMode` - (Optional) SSL mode to use for the connection. Valid values are `none`, `require`, `verifyCa`, `verifyFull`. (AWS default is `none`.)
+* `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `timestampColumnName` - (Optional) Column to add with timestamp information to the endpoint data for an Amazon S3 target.
+* `useCsvNoSupValue` - (Optional) Whether to use `csvNoSupValue` for columns not included in the supplemental log. (Ignored for source endpoints.)
+* `useTaskStartTimeForFullLoadTimestamp` - (Optional) When set to `true`, uses the task start time as the timestamp column value instead of the time data is written to target. For full load, when set to `true`, each row of the timestamp column contains the task start time. For CDC loads, each row of the timestamp column contains the transaction commit time.When set to false, the full load timestamp in the timestamp column increments with the time data arrives at the target. Default is `false`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `endpointArn` - ARN for the endpoint.
+* `engineDisplayName` - Expanded name for the engine name.
+* `externalId` - Can be used for cross-account validation. Use it in another account with `awsDmsS3Endpoint` to create the endpoint cross-account.
+* `status` - Status of the endpoint.
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `5M`)
+- `delete` - (Default `5M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import endpoints using the `endpointId`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import endpoints using the `endpointId`. For example:
+
+```console
+% terraform import aws_dms_s3_endpoint.example example-dms-endpoint-tf
+```
+
+<!-- cache-key: cdktf-0.18.0 input-5a916eee3e75e7c52d38f0617e6cc2027169298f0d0789be4639e960826d0ab3 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/docdb_cluster.html.markdown b/website/docs/cdktf/typescript/r/docdb_cluster.html.markdown
new file mode 100644
index 00000000000..fac3ec9981e
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/docdb_cluster.html.markdown
@@ -0,0 +1,140 @@
+---
+subcategory: "DocumentDB"
+layout: "aws"
+page_title: "AWS: aws_docdb_cluster"
+description: |-
+  Manages a DocumentDB Aurora Cluster
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_docdb_cluster
+
+Manages a DocumentDB Cluster.
+
+Changes to a DocumentDB Cluster can occur when you manually change a
+parameter, such as `port`, and are reflected in the next maintenance
+window. Because of this, Terraform may report a difference in its planning
+phase because a modification has not yet taken place. You can use the
+`applyImmediately` flag to instruct the service to apply the change immediately
+(see documentation below).
+
+~> **Note:** using `applyImmediately` can result in a brief downtime as the server reboots.
+~> **Note:** All arguments including the username and password will be stored in the raw state as plain-text.
+[Read more about sensitive data in state](https://www.terraform.io/docs/state/sensitive-data.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DocdbCluster } from "./.gen/providers/aws/docdb-cluster";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DocdbCluster(this, "docdb", {
+      backupRetentionPeriod: 5,
+      clusterIdentifier: "my-docdb-cluster",
+      engine: "docdb",
+      masterPassword: "mustbeeightchars",
+      masterUsername: "foo",
+      preferredBackupWindow: "07:00-09:00",
+      skipFinalSnapshot: true,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+For more detailed documentation about each argument, refer to
+the [AWS official documentation](https://docs.aws.amazon.com/cli/latest/reference/docdb/create-db-cluster.html).
+
+This argument supports the following arguments:
+
+* `allowMajorVersionUpgrade` - (Optional) A value that indicates whether major version upgrades are allowed. Constraints: You must allow major version upgrades when specifying a value for the EngineVersion parameter that is a different major version than the DB cluster's current version.
+* `applyImmediately` - (Optional) Specifies whether any cluster modifications
+     are applied immediately, or during the next maintenance window. Default is
+     `false`.
+* `availabilityZones` - (Optional) A list of EC2 Availability Zones that
+  instances in the DB cluster can be created in.
+* `backupRetentionPeriod` - (Optional) The days to retain backups for. Default `1`
+* `clusterIdentifierPrefix` - (Optional, Forces new resource) Creates a unique cluster identifier beginning with the specified prefix. Conflicts with `clusterIdentifier`.
+* `clusterIdentifier` - (Optional, Forces new resources) The cluster identifier. If omitted, Terraform will assign a random, unique identifier.
+* `dbSubnetGroupName` - (Optional) A DB subnet group to associate with this DB instance.
+* `dbClusterParameterGroupName` - (Optional) A cluster parameter group to associate with the cluster.
+* `deletionProtection` - (Optional) A value that indicates whether the DB cluster has deletion protection enabled. The database can't be deleted when deletion protection is enabled. By default, deletion protection is disabled.
+* `enabledCloudwatchLogsExports` - (Optional) List of log types to export to cloudwatch. If omitted, no logs will be exported.
+   The following log types are supported: `audit`, `profiler`.
+* `engineVersion` - (Optional) The database engine version. Updating this argument results in an outage.
+* `engine` - (Optional) The name of the database engine to be used for this DB cluster. Defaults to `docdb`. Valid Values: `docdb`
+* `finalSnapshotIdentifier` - (Optional) The name of your final DB snapshot
+    when this DB cluster is deleted. If omitted, no final snapshot will be
+    made.
+* `globalClusterIdentifier` - (Optional) The global cluster identifier specified on [`awsDocdbGlobalCluster`](/docs/providers/aws/r/docdb_global_cluster.html).
+* `kmsKeyId` - (Optional) The ARN for the KMS encryption key. When specifying `kmsKeyId`, `storageEncrypted` needs to be set to true.
+* `masterPassword` - (Required unless a `snapshotIdentifier` or unless a `globalClusterIdentifier` is provided when the cluster is the "secondary" cluster of a global database) Password for the master DB user. Note that this may
+    show up in logs, and it will be stored in the state file. Please refer to the DocumentDB Naming Constraints.
+* `masterUsername` - (Required unless a `snapshotIdentifier` or unless a `globalClusterIdentifier` is provided when the cluster is the "secondary" cluster of a global database) Username for the master DB user.
+* `port` - (Optional) The port on which the DB accepts connections
+* `preferredBackupWindow` - (Optional) The daily time range during which automated backups are created if automated backups are enabled using the BackupRetentionPeriod parameter.Time in UTC
+Default: A 30-minute window selected at random from an 8-hour block of time per regionE.g., 04:00-09:00
+* `preferredMaintenanceWindow` - (Optional) The weekly time range during which system maintenance can occur, in (UTC) e.g., wed:04:00-wed:04:30
+* `skipFinalSnapshot` - (Optional) Determines whether a final DB snapshot is created before the DB cluster is deleted. If true is specified, no DB snapshot is created. If false is specified, a DB snapshot is created before the DB cluster is deleted, using the value from `finalSnapshotIdentifier`. Default is `false`.
+* `snapshotIdentifier` - (Optional) Specifies whether or not to create this cluster from a snapshot. You can use either the name or ARN when specifying a DB cluster snapshot, or the ARN when specifying a DB snapshot. Automated snapshots **should not** be used for this attribute, unless from a different cluster. Automated snapshots are deleted as part of cluster destruction when the resource is replaced.
+* `storageEncrypted` - (Optional) Specifies whether the DB cluster is encrypted. The default is `false`.
+* `tags` - (Optional) A map of tags to assign to the DB cluster. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `vpcSecurityGroupIds` - (Optional) List of VPC security groups to associate
+  with the Cluster
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of cluster
+* `clusterMembers` – List of DocumentDB Instances that are a part of this cluster
+* `clusterResourceId` - The DocumentDB Cluster Resource ID
+* `endpoint` - The DNS address of the DocumentDB instance
+* `hostedZoneId` - The Route53 Hosted Zone ID of the endpoint
+* `id` - The DocumentDB Cluster Identifier
+* `readerEndpoint` - A read-only endpoint for the DocumentDB cluster, automatically load-balanced across replicas
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `120M`)
+- `update` - (Default `120M`)
+- `delete` - (Default `120M`)
+any cleanup task during the destroying process.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DocumentDB Clusters using the `clusterIdentifier`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import DocumentDB Clusters using the `clusterIdentifier`. For example:
+
+```console
+% terraform import aws_docdb_cluster.docdb_cluster docdb-prod-cluster
+```
+
+<!-- cache-key: cdktf-0.18.0 input-7cf348aecf73384b6129a72828575287fcb17575843e5c9cf838a6b1a7e65009 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/docdb_cluster_instance.html.markdown b/website/docs/cdktf/typescript/r/docdb_cluster_instance.html.markdown
new file mode 100644
index 00000000000..abb7c8c9cbb
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/docdb_cluster_instance.html.markdown
@@ -0,0 +1,160 @@
+---
+subcategory: "DocumentDB"
+layout: "aws"
+page_title: "AWS: aws_docdb_cluster_instance"
+description: |-
+  Provides an DocumentDB Cluster Resource Instance
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_docdb_cluster_instance
+
+Provides an DocumentDB Cluster Resource Instance. A Cluster Instance Resource defines
+attributes that are specific to a single instance in a [DocumentDB Cluster][1].
+
+You do not designate a primary and subsequent replicas. Instead, you simply add DocumentDB
+Instances and DocumentDB manages the replication. You can use the [count][3]
+meta-parameter to make multiple instances and join them all to the same DocumentDB
+Cluster, or you may specify different Cluster Instance resources with various
+`instanceClass` sizes.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformCount, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DocdbCluster } from "./.gen/providers/aws/docdb-cluster";
+import { DocdbClusterInstance } from "./.gen/providers/aws/docdb-cluster-instance";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const defaultVar = new DocdbCluster(this, "default", {
+      availabilityZones: ["us-west-2a", "us-west-2b", "us-west-2c"],
+      clusterIdentifier: "docdb-cluster-demo",
+      masterPassword: "barbut8chars",
+      masterUsername: "foo",
+    });
+    /*In most cases loops should be handled in the programming language context and 
+    not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+    you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+    you need to keep this like it is.*/
+    const clusterInstancesCount = TerraformCount.of(Token.asNumber("2"));
+    new DocdbClusterInstance(this, "cluster_instances", {
+      clusterIdentifier: defaultVar.id,
+      identifier: "docdb-cluster-demo-${" + clusterInstancesCount.index + "}",
+      instanceClass: "db.r5.large",
+      count: clusterInstancesCount,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+For more detailed documentation about each argument, refer to
+the [AWS official documentation](https://docs.aws.amazon.com/cli/latest/reference/docdb/create-db-instance.html).
+
+This argument supports the following arguments:
+
+* `applyImmediately` - (Optional) Specifies whether any database modifications
+     are applied immediately, or during the next maintenance window. Default is`false`.
+* `autoMinorVersionUpgrade` - (Optional) This parameter does not apply to Amazon DocumentDB. Amazon DocumentDB does not perform minor version upgrades regardless of the value set (see [docs](https://docs.aws.amazon.com/documentdb/latest/developerguide/API_DBInstance.html)). Default `true`.
+* `availabilityZone` - (Optional, Computed) The EC2 Availability Zone that the DB instance is created in. See [docs](https://docs.aws.amazon.com/documentdb/latest/developerguide/API_CreateDBInstance.html) about the details.
+* `clusterIdentifier` - (Required) The identifier of the [`awsDocdbCluster`](/docs/providers/aws/r/docdb_cluster.html) in which to launch this instance.
+* `copyTagsToSnapshot` – (Optional, boolean) Copy all DB instance `tags` to snapshots. Default is `false`.
+* `enablePerformanceInsights` - (Optional) A value that indicates whether to enable Performance Insights for the DB Instance. Default `false`. See [docs] (https://docs.aws.amazon.com/documentdb/latest/developerguide/performance-insights.html) about the details.
+* `engine` - (Optional) The name of the database engine to be used for the DocumentDB instance. Defaults to `docdb`. Valid Values: `docdb`.
+* `identifier` - (Optional, Forces new resource) The identifier for the DocumentDB instance, if omitted, Terraform will assign a random, unique identifier.
+* `identifierPrefix` - (Optional, Forces new resource) Creates a unique identifier beginning with the specified prefix. Conflicts with `identifier`.
+* `instanceClass` - (Required) The instance class to use. For details on CPU and memory, see [Scaling for DocumentDB Instances][2].
+  DocumentDB currently supports the below instance classes.
+  Please see [AWS Documentation][4] for complete details.
+    - db.r6g.large
+    - db.r6g.xlarge
+    - db.r6g.2xlarge
+    - db.r6g.4xlarge
+    - db.r6g.8xlarge
+    - db.r6g.12xlarge
+    - db.r6g.16xlarge
+    - db.r5.large
+    - db.r5.xlarge
+    - db.r5.2xlarge
+    - db.r5.4xlarge
+    - db.r5.12xlarge
+    - db.r5.24xlarge
+    - db.r4.large
+    - db.r4.xlarge
+    - db.r4.2xlarge
+    - db.r4.4xlarge
+    - db.r4.8xlarge
+    - db.r4.16xlarge
+    - db.t4g.medium
+    - db.t3.medium
+* `performanceInsightsKmsKeyId` - (Optional) The KMS key identifier is the key ARN, key ID, alias ARN, or alias name for the KMS key. If you do not specify a value for PerformanceInsightsKMSKeyId, then Amazon DocumentDB uses your default KMS key.
+* `preferredMaintenanceWindow` - (Optional) The window to perform maintenance in.
+  Syntax: "ddd:hh24:mi-ddd:hh24:mi". Eg: "Mon:00:00-Mon:03:00".
+* `promotionTier` - (Optional) Default 0. Failover Priority setting on instance level. The reader who has lower tier has higher priority to get promoter to writer.
+* `tags` - (Optional) A map of tags to assign to the instance. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of cluster instance
+* `dbSubnetGroupName` - The DB subnet group to associate with this DB instance.
+* `dbiResourceId` - The region-unique, immutable identifier for the DB instance.
+* `endpoint` - The DNS address for this instance. May not be writable
+* `engineVersion` - The database engine version
+* `kmsKeyId` - The ARN for the KMS encryption key if one is set to the cluster.
+* `port` - The database port
+* `preferredBackupWindow` - The daily time range during which automated backups are created if automated backups are enabled.
+* `storageEncrypted` - Specifies whether the DB cluster is encrypted.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `writer` – Boolean indicating if this instance is writable. `false` indicates this instance is a read replica.
+* `caCertIdentifier` - (Optional) The identifier of the CA certificate for the DB instance.
+
+[1]: /docs/providers/aws/r/docdb_cluster.html
+[2]: https://docs.aws.amazon.com/documentdb/latest/developerguide/db-cluster-manage-performance.html#db-cluster-manage-scaling-instance
+[3]: https://www.terraform.io/docs/configuration/meta-arguments/count.html
+[4]: https://docs.aws.amazon.com/documentdb/latest/developerguide/db-instance-classes.html#db-instance-class-specs
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `90M`)
+restoring from Snapshots
+- `update` - (Default `90M`)
+- `delete` - (Default `90M`)
+the time required to take snapshots
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DocumentDB Cluster Instances using the `identifier`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import DocumentDB Cluster Instances using the `identifier`. For example:
+
+```console
+% terraform import aws_docdb_cluster_instance.prod_instance_1 aurora-cluster-instance-1
+```
+
+<!-- cache-key: cdktf-0.18.0 input-9a6c6904f8952b2942358908c66b371b4c5097186378f30754ea569b6e4e1d71 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/docdb_cluster_parameter_group.html.markdown b/website/docs/cdktf/typescript/r/docdb_cluster_parameter_group.html.markdown
new file mode 100644
index 00000000000..dacee30c925
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/docdb_cluster_parameter_group.html.markdown
@@ -0,0 +1,94 @@
+---
+subcategory: "DocumentDB"
+layout: "aws"
+page_title: "AWS: aws_docdb_cluster_parameter_group"
+description: |-
+  Manages a DocumentDB Cluster Parameter Group
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_docdb_cluster_parameter_group
+
+Manages a DocumentDB Cluster Parameter Group
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DocdbClusterParameterGroup } from "./.gen/providers/aws/docdb-cluster-parameter-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DocdbClusterParameterGroup(this, "example", {
+      description: "docdb cluster parameter group",
+      family: "docdb3.6",
+      name: "example",
+      parameter: [
+        {
+          name: "tls",
+          value: "enabled",
+        },
+      ],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Optional, Forces new resource) The name of the DocumentDB cluster parameter group. If omitted, Terraform will assign a random, unique name.
+* `namePrefix` - (Optional, Forces new resource) Creates a unique name beginning with the specified prefix. Conflicts with `name`.
+* `family` - (Required, Forces new resource) The family of the DocumentDB cluster parameter group.
+* `description` - (Optional, Forces new resource) The description of the DocumentDB cluster parameter group. Defaults to "Managed by Terraform".
+* `parameter` - (Optional) A list of DocumentDB parameters to apply. Setting parameters to system default values may show a difference on imported resources.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+Parameter blocks support the following:
+
+~> **NOTE:** These arguments take a `string` representation of their values.
+
+* `name` - (Required) The name of the DocumentDB parameter.
+* `value` - (Required) The value of the DocumentDB parameter.
+* `applyMethod` - (Optional) Valid values are `immediate` and `pendingReboot`. Defaults to `pendingReboot`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The DocumentDB cluster parameter group name.
+* `arn` - The ARN of the DocumentDB cluster parameter group.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DocumentDB Cluster Parameter Groups using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import DocumentDB Cluster Parameter Groups using the `name`. For example:
+
+```console
+% terraform import aws_docdb_cluster_parameter_group.cluster_pg production-pg-1
+```
+
+<!-- cache-key: cdktf-0.18.0 input-419b7174b76157b8619854ef58a66430a8d320805696c26428ef99ede67bae36 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/docdb_cluster_snapshot.html.markdown b/website/docs/cdktf/typescript/r/docdb_cluster_snapshot.html.markdown
new file mode 100644
index 00000000000..eab83ee2c40
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/docdb_cluster_snapshot.html.markdown
@@ -0,0 +1,88 @@
+---
+subcategory: "DocumentDB"
+layout: "aws"
+page_title: "AWS: aws_docdb_cluster_snapshot"
+description: |-
+  Manages a DocumentDB database cluster snapshot.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_docdb_cluster_snapshot
+
+Manages a DocumentDB database cluster snapshot for DocumentDB clusters.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DocdbClusterSnapshot } from "./.gen/providers/aws/docdb-cluster-snapshot";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DocdbClusterSnapshot(this, "example", {
+      dbClusterIdentifier: Token.asString(awsDocdbClusterExample.id),
+      dbClusterSnapshotIdentifier: "resourcetestsnapshot1234",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `dbClusterIdentifier` - (Required) The DocumentDB Cluster Identifier from which to take the snapshot.
+* `dbClusterSnapshotIdentifier` - (Required) The Identifier for the snapshot.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `availabilityZones` - List of EC2 Availability Zones that instances in the DocumentDB cluster snapshot can be restored in.
+* `dbClusterSnapshotArn` - The Amazon Resource Name (ARN) for the DocumentDB Cluster Snapshot.
+* `engine` - Specifies the name of the database engine.
+* `engineVersion` - Version of the database engine for this DocumentDB cluster snapshot.
+* `kmsKeyId` - If storage_encrypted is true, the AWS KMS key identifier for the encrypted DocumentDB cluster snapshot.
+* `port` - Port that the DocumentDB cluster was listening on at the time of the snapshot.
+* `sourceDbClusterSnapshotIdentifier` - The DocumentDB Cluster Snapshot Arn that the DocumentDB Cluster Snapshot was copied from. It only has value in case of cross customer or cross region copy.
+* `storageEncrypted` - Specifies whether the DocumentDB cluster snapshot is encrypted.
+* `status` - The status of this DocumentDB Cluster Snapshot.
+* `vpcId` - The VPC ID associated with the DocumentDB cluster snapshot.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `20M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsDocdbClusterSnapshot` using the cluster snapshot identifier. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsDocdbClusterSnapshot` using the cluster snapshot identifier. For example:
+
+```console
+% terraform import aws_docdb_cluster_snapshot.example my-cluster-snapshot
+```
+
+<!-- cache-key: cdktf-0.18.0 input-8dd2ea6e382c4e0856668c83fa43a1a39b2e7be56350a64cc442fe4366d3e1c4 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/docdb_event_subscription.html.markdown b/website/docs/cdktf/typescript/r/docdb_event_subscription.html.markdown
new file mode 100644
index 00000000000..8ccb4acd648
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/docdb_event_subscription.html.markdown
@@ -0,0 +1,118 @@
+---
+subcategory: "DocumentDB"
+layout: "aws"
+page_title: "AWS: aws_docdb_event_subscription"
+description: |-
+  Provides a DocumentDB event subscription resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_docdb_event_subscription
+
+Provides a DocumentDB event subscription resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DocdbCluster } from "./.gen/providers/aws/docdb-cluster";
+import { DocdbEventSubscription } from "./.gen/providers/aws/docdb-event-subscription";
+import { SnsTopic } from "./.gen/providers/aws/sns-topic";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new DocdbCluster(this, "example", {
+      availabilityZones: [
+        Token.asString(Fn.lookupNested(available.names, ["0"])),
+        Token.asString(Fn.lookupNested(available.names, ["1"])),
+        Token.asString(Fn.lookupNested(available.names, ["2"])),
+      ],
+      clusterIdentifier: "example",
+      masterPassword: "mustbeeightcharaters",
+      masterUsername: "foo",
+      skipFinalSnapshot: true,
+    });
+    const awsSnsTopicExample = new SnsTopic(this, "example_1", {
+      name: "example-events",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSnsTopicExample.overrideLogicalId("example");
+    const awsDocdbEventSubscriptionExample = new DocdbEventSubscription(
+      this,
+      "example_2",
+      {
+        enabled: true,
+        eventCategories: ["creation", "failure"],
+        name: "example",
+        snsTopicArn: Token.asString(awsSnsTopicExample.arn),
+        sourceIds: [example.id],
+        sourceType: "db-cluster",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsDocdbEventSubscriptionExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Optional) The name of the DocumentDB event subscription. By default generated by Terraform.
+* `namePrefix` - (Optional) The name of the DocumentDB event subscription. Conflicts with `name`.
+* `snsTopic` - (Required) The SNS topic to send events to.
+* `sourceIds` - (Optional) A list of identifiers of the event sources for which events will be returned. If not specified, then all sources are included in the response. If specified, a source_type must also be specified.
+* `sourceType` - (Optional) The type of source that will be generating the events. Valid options are `dbInstance`, `dbCluster`, `dbParameterGroup`, `dbSecurityGroup`,` db-cluster-snapshot`. If not set, all sources will be subscribed to.
+* `eventCategories` - (Optional) A list of event categories for a SourceType that you want to subscribe to. See https://docs.aws.amazon.com/documentdb/latest/developerguide/API_Event.html or run `aws docdb describe-event-categories`.
+* `enabled` - (Optional) A boolean flag to enable/disable the subscription. Defaults to true.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name of the DocumentDB event notification subscription
+* `arn` - The Amazon Resource Name of the DocumentDB event notification subscription
+* `customerAwsId` - The AWS customer account associated with the DocumentDB event notification subscription
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `40M`)
+- `delete` - (Default `40M`)
+- `update` - (Default `40M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DocumentDB Event Subscriptions using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import DocumentDB Event Subscriptions using the `name`. For example:
+
+```console
+% terraform import aws_docdb_event_subscription.example event-sub
+```
+
+<!-- cache-key: cdktf-0.18.0 input-01289746062c0ecfee11e0fdbb6b08b84b9bb7709018031af990b6ef46d1dc7b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/docdb_global_cluster.html.markdown b/website/docs/cdktf/typescript/r/docdb_global_cluster.html.markdown
new file mode 100644
index 00000000000..c1bce674e26
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/docdb_global_cluster.html.markdown
@@ -0,0 +1,217 @@
+---
+subcategory: "DocumentDB"
+layout: "aws"
+page_title: "AWS: aws_docdb_global_cluster"
+description: |-
+  Manages a DocumentDB Global Cluster
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_docdb_global_cluster
+
+Manages an DocumentDB Global Cluster. A global cluster consists of one primary region and up to five read-only secondary regions. You issue write operations directly to the primary cluster in the primary region and Amazon DocumentDB automatically replicates the data to the secondary regions using dedicated infrastructure.
+
+More information about DocumentDB Global Clusters can be found in the [DocumentDB Developer Guide](https://docs.aws.amazon.com/documentdb/latest/developerguide/global-clusters.html).
+
+## Example Usage
+
+### New DocumentDB Global Cluster
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DocdbCluster } from "./.gen/providers/aws/docdb-cluster";
+import { DocdbClusterInstance } from "./.gen/providers/aws/docdb-cluster-instance";
+import { DocdbGlobalCluster } from "./.gen/providers/aws/docdb-global-cluster";
+import { AwsProvider } from "./.gen/providers/aws/provider";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const primary = new AwsProvider(this, "aws", {
+      alias: "primary",
+      region: "us-east-2",
+    });
+    const secondary = new AwsProvider(this, "aws_1", {
+      alias: "secondary",
+      region: "us-east-1",
+    });
+    const example = new DocdbGlobalCluster(this, "example", {
+      engine: "docdb",
+      engineVersion: "4.0.0",
+      globalClusterIdentifier: "global-test",
+    });
+    const awsDocdbClusterPrimary = new DocdbCluster(this, "primary", {
+      clusterIdentifier: "test-primary-cluster",
+      dbSubnetGroupName: "default",
+      engine: example.engine,
+      engineVersion: example.engineVersion,
+      globalClusterIdentifier: example.id,
+      masterPassword: "somepass123",
+      masterUsername: "username",
+      provider: primary,
+    });
+    const awsDocdbClusterSecondary = new DocdbCluster(this, "secondary", {
+      clusterIdentifier: "test-secondary-cluster",
+      dbSubnetGroupName: "default",
+      dependsOn: [awsDocdbClusterPrimary],
+      engine: example.engine,
+      engineVersion: example.engineVersion,
+      globalClusterIdentifier: example.id,
+      provider: secondary,
+    });
+    const awsDocdbClusterInstancePrimary = new DocdbClusterInstance(
+      this,
+      "primary_5",
+      {
+        clusterIdentifier: Token.asString(awsDocdbClusterPrimary.id),
+        engine: example.engine,
+        identifier: "test-primary-cluster-instance",
+        instanceClass: "db.r5.large",
+        provider: primary,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsDocdbClusterInstancePrimary.overrideLogicalId("primary");
+    const awsDocdbClusterInstanceSecondary = new DocdbClusterInstance(
+      this,
+      "secondary_6",
+      {
+        clusterIdentifier: Token.asString(awsDocdbClusterSecondary.id),
+        dependsOn: [awsDocdbClusterInstancePrimary],
+        engine: example.engine,
+        identifier: "test-secondary-cluster-instance",
+        instanceClass: "db.r5.large",
+        provider: secondary,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsDocdbClusterInstanceSecondary.overrideLogicalId("secondary");
+  }
+}
+
+```
+
+### New Global Cluster From Existing DB Cluster
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DocdbCluster } from "./.gen/providers/aws/docdb-cluster";
+import { DocdbGlobalCluster } from "./.gen/providers/aws/docdb-global-cluster";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new DocdbCluster(this, "example", {
+      lifecycle: {
+        ignoreChanges: [globalClusterIdentifier],
+      },
+    });
+    const awsDocdbGlobalClusterExample = new DocdbGlobalCluster(
+      this,
+      "example_1",
+      {
+        globalClusterIdentifier: "example",
+        sourceDbClusterIdentifier: example.arn,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsDocdbGlobalClusterExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `globalClusterIdentifier` - (Required, Forces new resources) The global cluster identifier.
+* `databaseName` - (Optional, Forces new resources) Name for an automatically created database on cluster creation.
+* `deletionProtection` - (Optional) If the Global Cluster should have deletion protection enabled. The database can't be deleted when this value is set to `true`. The default is `false`.
+* `engine` - (Optional, Forces new resources) Name of the database engine to be used for this DB cluster. Terraform will only perform drift detection if a configuration value is provided. Current Valid values: `docdb`. Defaults to `docdb`. Conflicts with `sourceDbClusterIdentifier`.
+* `engineVersion` - (Optional) Engine version of the global database. Upgrading the engine version will result in all cluster members being immediately updated and will.
+    * **NOTE:** Upgrading major versions is not supported.
+* `sourceDbClusterIdentifier` - (Optional) Amazon Resource Name (ARN) to use as the primary DB Cluster of the Global Cluster on creation. Terraform cannot perform drift detection of this value.
+* `storageEncrypted` - (Optional, Forces new resources) Specifies whether the DB cluster is encrypted. The default is `false` unless `sourceDbClusterIdentifier` is specified and encrypted. Terraform will only perform drift detection if a configuration value is provided.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Global Cluster Amazon Resource Name (ARN)
+* `globalClusterMembers` - Set of objects containing Global Cluster members.
+    * `dbClusterArn` - Amazon Resource Name (ARN) of member DB Cluster.
+    * `isWriter` - Whether the member is the primary DB Cluster.
+* `globalClusterResourceId` - AWS Region-unique, immutable identifier for the global database cluster. This identifier is found in AWS CloudTrail log entries whenever the AWS KMS key for the DB cluster is accessed.
+* `id` - DocumentDB Global Cluster ID.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `5M`)
+* `update` - (Default `5M`)
+* `delete` - (Default `5M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsDocdbGlobalCluster` using the Global Cluster identifier. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsDocdbGlobalCluster` using the Global Cluster identifier. For example:
+
+```console
+% terraform import aws_docdb_global_cluster.example example
+```
+
+Certain resource arguments, like `sourceDbClusterIdentifier`, do not have an API method for reading the information after creation. If the argument is set in the Terraform configuration on an imported resource, Terraform will always show a difference. To workaround this behavior, either omit the argument from the Terraform configuration or use [`ignoreChanges`](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html#ignore_changes) to hide the difference. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DocdbGlobalCluster } from "./.gen/providers/aws/docdb-global-cluster";
+interface MyConfig {
+  globalClusterIdentifier: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new DocdbGlobalCluster(this, "example", {
+      lifecycle: {
+        ignoreChanges: [sourceDbClusterIdentifier],
+      },
+      globalClusterIdentifier: config.globalClusterIdentifier,
+    });
+  }
+}
+
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1969b7e5823c37dcaa70faf533c61504633b6662145d39efba4b15fdc30e77b9 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/docdb_subnet_group.html.markdown b/website/docs/cdktf/typescript/r/docdb_subnet_group.html.markdown
new file mode 100644
index 00000000000..26198d311f5
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/docdb_subnet_group.html.markdown
@@ -0,0 +1,81 @@
+---
+subcategory: "DocumentDB"
+layout: "aws"
+page_title: "AWS: aws_docdb_subnet_group"
+description: |-
+  Provides an DocumentDB subnet group resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_docdb_subnet_group
+
+Provides an DocumentDB subnet group resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DocdbSubnetGroup } from "./.gen/providers/aws/docdb-subnet-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DocdbSubnetGroup(this, "default", {
+      name: "main",
+      subnetIds: [frontend.id, backend.id],
+      tags: {
+        Name: "My docdb subnet group",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Optional, Forces new resource) The name of the docDB subnet group. If omitted, Terraform will assign a random, unique name.
+* `namePrefix` - (Optional, Forces new resource) Creates a unique name beginning with the specified prefix. Conflicts with `name`.
+* `description` - (Optional) The description of the docDB subnet group. Defaults to "Managed by Terraform".
+* `subnetIds` - (Required) A list of VPC subnet IDs.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The docDB subnet group name.
+* `arn` - The ARN of the docDB subnet group.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DocumentDB Subnet groups using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import DocumentDB Subnet groups using the `name`. For example:
+
+```console
+% terraform import aws_docdb_subnet_group.default production-subnet-group
+```
+
+<!-- cache-key: cdktf-0.18.0 input-88009fd606f1c5adfe6f2ed488e5bfa54a43279608f02880560a223786cb4993 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/dx_bgp_peer.html.markdown b/website/docs/cdktf/typescript/r/dx_bgp_peer.html.markdown
new file mode 100644
index 00000000000..ced823ba650
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/dx_bgp_peer.html.markdown
@@ -0,0 +1,68 @@
+---
+subcategory: "Direct Connect"
+layout: "aws"
+page_title: "AWS: aws_dx_bgp_peer"
+description: |-
+  Provides a Direct Connect BGP peer resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_dx_bgp_peer
+
+Provides a Direct Connect BGP peer resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DxBgpPeer } from "./.gen/providers/aws/dx-bgp-peer";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DxBgpPeer(this, "peer", {
+      addressFamily: "ipv6",
+      bgpAsn: 65351,
+      virtualInterfaceId: foo.id,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `addressFamily` - (Required) The address family for the BGP peer. `ipv4 ` or `ipv6`.
+* `bgpAsn` - (Required) The autonomous system (AS) number for Border Gateway Protocol (BGP) configuration.
+* `virtualInterfaceId` - (Required) The ID of the Direct Connect virtual interface on which to create the BGP peer.
+* `amazonAddress` - (Optional) The IPv4 CIDR address to use to send traffic to Amazon.
+Required for IPv4 BGP peers on public virtual interfaces.
+* `bgpAuthKey` - (Optional) The authentication key for BGP configuration.
+* `customerAddress` - (Optional) The IPv4 CIDR destination address to which Amazon should send traffic.
+Required for IPv4 BGP peers on public virtual interfaces.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the BGP peer resource.
+* `bgpStatus` - The Up/Down state of the BGP peer.
+* `bgpPeerId` - The ID of the BGP peer.
+* `awsDevice` - The Direct Connect endpoint on which the BGP peer terminates.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `10M`)
+- `delete` - (Default `10M`)
+
+<!-- cache-key: cdktf-0.18.0 input-fce27b12427c127b90f63ebcc9725bb7d4127413367ba03f518a0e5c6f7ac443 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/dx_connection.html.markdown b/website/docs/cdktf/typescript/r/dx_connection.html.markdown
new file mode 100644
index 00000000000..babfa1e3f39
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/dx_connection.html.markdown
@@ -0,0 +1,148 @@
+---
+subcategory: "Direct Connect"
+layout: "aws"
+page_title: "AWS: aws_dx_connection"
+description: |-
+  Provides a Connection of Direct Connect.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_dx_connection
+
+Provides a Connection of Direct Connect.
+
+## Example Usage
+
+### Create a connection
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DxConnection } from "./.gen/providers/aws/dx-connection";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DxConnection(this, "hoge", {
+      bandwidth: "1Gbps",
+      location: "EqDC2",
+      name: "tf-dx-connection",
+    });
+  }
+}
+
+```
+
+### Request a MACsec-capable connection
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DxConnection } from "./.gen/providers/aws/dx-connection";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DxConnection(this, "example", {
+      bandwidth: "10Gbps",
+      location: "EqDA2",
+      name: "tf-dx-connection",
+      requestMacsec: true,
+    });
+  }
+}
+
+```
+
+### Configure encryption mode for MACsec-capable connections
+
+-> **NOTE:** You can only specify the `encryptionMode` argument once the connection is in an `available` state.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DxConnection } from "./.gen/providers/aws/dx-connection";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DxConnection(this, "example", {
+      bandwidth: "10Gbps",
+      encryptionMode: "must_encrypt",
+      location: "EqDC2",
+      name: "tf-dx-connection",
+      requestMacsec: true,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `bandwidth` - (Required) The bandwidth of the connection. Valid values for dedicated connections: 1Gbps, 10Gbps. Valid values for hosted connections: 50Mbps, 100Mbps, 200Mbps, 300Mbps, 400Mbps, 500Mbps, 1Gbps, 2Gbps, 5Gbps, 10Gbps and 100Gbps. Case sensitive.
+* `encryptionMode` - (Optional) The connection MAC Security (MACsec) encryption mode. MAC Security (MACsec) is only available on dedicated connections. Valid values are `noEncrypt`, `shouldEncrypt`, and `mustEncrypt`.
+* `location` - (Required) The AWS Direct Connect location where the connection is located. See [DescribeLocations](https://docs.aws.amazon.com/directconnect/latest/APIReference/API_DescribeLocations.html) for the list of AWS Direct Connect locations. Use `locationCode`.
+* `name` - (Required) The name of the connection.
+* `providerName` - (Optional) The name of the service provider associated with the connection.
+* `requestMacsec` - (Optional) Boolean value indicating whether you want the connection to support MAC Security (MACsec). MAC Security (MACsec) is only available on dedicated connections. See [MACsec prerequisites](https://docs.aws.amazon.com/directconnect/latest/UserGuide/direct-connect-mac-sec-getting-started.html#mac-sec-prerequisites) for more information about MAC Security (MACsec) prerequisites. Default value: `false`.
+
+~> **NOTE:** Changing the value of `requestMacsec` will cause the resource to be destroyed and re-created.
+
+* `skipDestroy` - (Optional) Set to true if you do not wish the connection to be deleted at destroy time, and instead just removed from the Terraform state.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the connection.
+* `awsDevice` - The Direct Connect endpoint on which the physical connection terminates.
+* `hasLogicalRedundancy` - Indicates whether the connection supports a secondary BGP peer in the same address family (IPv4/IPv6).
+* `id` - The ID of the connection.
+* `jumboFrameCapable` - Boolean value representing if jumbo frames have been enabled for this connection.
+* `macsecCapable` - Boolean value indicating whether the connection supports MAC Security (MACsec).
+* `ownerAccountId` - The ID of the AWS account that owns the connection.
+* `partnerName` - The name of the AWS Direct Connect service provider associated with the connection.
+* `portEncryptionStatus` - The MAC Security (MACsec) port link status of the connection.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `vlanId` - The VLAN ID.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Direct Connect connections using the connection `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Direct Connect connections using the connection `id`. For example:
+
+```console
+% terraform import aws_dx_connection.test_connection dxcon-ffre0ec3
+```
+
+<!-- cache-key: cdktf-0.18.0 input-d13e1be5ac537438097f3cb1617cb8cb47731fc5c21629b7b4afb1e95a242b92 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/dx_connection_association.html.markdown b/website/docs/cdktf/typescript/r/dx_connection_association.html.markdown
new file mode 100644
index 00000000000..d76237c3cc7
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/dx_connection_association.html.markdown
@@ -0,0 +1,69 @@
+---
+subcategory: "Direct Connect"
+layout: "aws"
+page_title: "AWS: aws_dx_connection_association"
+description: |-
+  Associates a Direct Connect Connection with a LAG.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_dx_connection_association
+
+Associates a Direct Connect Connection with a LAG.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DxConnection } from "./.gen/providers/aws/dx-connection";
+import { DxConnectionAssociation } from "./.gen/providers/aws/dx-connection-association";
+import { DxLag } from "./.gen/providers/aws/dx-lag";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new DxConnection(this, "example", {
+      bandwidth: "1Gbps",
+      location: "EqSe2-EQ",
+      name: "example",
+    });
+    const awsDxLagExample = new DxLag(this, "example_1", {
+      connectionsBandwidth: "1Gbps",
+      location: "EqSe2-EQ",
+      name: "example",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsDxLagExample.overrideLogicalId("example");
+    const awsDxConnectionAssociationExample = new DxConnectionAssociation(
+      this,
+      "example_2",
+      {
+        connectionId: example.id,
+        lagId: Token.asString(awsDxLagExample.id),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsDxConnectionAssociationExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `connectionId` - (Required) The ID of the connection.
+* `lagId` - (Required) The ID of the LAG with which to associate the connection.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+<!-- cache-key: cdktf-0.18.0 input-96feeae586392eb0efd53cf41e2bf1f425927ad87299e1068630c2fe6ba0f85c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/dx_connection_confirmation.html.markdown b/website/docs/cdktf/typescript/r/dx_connection_confirmation.html.markdown
new file mode 100644
index 00000000000..77c34625831
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/dx_connection_confirmation.html.markdown
@@ -0,0 +1,54 @@
+---
+subcategory: "Direct Connect"
+layout: "aws"
+page_title: "AWS: aws_dx_connection_confirmation"
+description: |-
+  Provides a confirmation of the creation of the specified hosted connection on an interconnect.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_dx_connection_confirmation
+
+Provides a confirmation of the creation of the specified hosted connection on an interconnect.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DxConnectionConfirmation } from "./.gen/providers/aws/dx-connection-confirmation";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DxConnectionConfirmation(this, "confirmation", {
+      connectionId: "dxcon-ffabc123",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `connectionId` - (Required) The ID of the hosted connection.
+
+### Removing `awsDxConnectionConfirmation` from your configuration
+
+Removing an `awsDxConnectionConfirmation` resource from your configuration will remove it
+from your statefile and management, **but will not destroy the Hosted Connection.**
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the connection.
+
+<!-- cache-key: cdktf-0.18.0 input-e2add46dba26c378ed4b9326ebee9569e0e5c8903ce7dbc8024cc7347469032a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/dx_gateway.html.markdown b/website/docs/cdktf/typescript/r/dx_gateway.html.markdown
new file mode 100644
index 00000000000..56efe93fde9
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/dx_gateway.html.markdown
@@ -0,0 +1,81 @@
+---
+subcategory: "Direct Connect"
+layout: "aws"
+page_title: "AWS: aws_dx_gateway"
+description: |-
+  Provides a Direct Connect Gateway.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_dx_gateway
+
+Provides a Direct Connect Gateway.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DxGateway } from "./.gen/providers/aws/dx-gateway";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DxGateway(this, "example", {
+      amazonSideAsn: "64512",
+      name: "tf-dxg-example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the connection.
+* `amazonSideAsn` - (Required) The ASN to be configured on the Amazon side of the connection. The ASN must be in the private range of 64,512 to 65,534 or 4,200,000,000 to 4,294,967,294.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the gateway.
+* `ownerAccountId` - AWS Account ID of the gateway.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `10M`)
+- `delete` - (Default `10M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Direct Connect Gateways using the gateway `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Direct Connect Gateways using the gateway `id`. For example:
+
+```console
+% terraform import aws_dx_gateway.test abcd1234-dcba-5678-be23-cdef9876ab45
+```
+
+<!-- cache-key: cdktf-0.18.0 input-db317b4e261abf2f1827c55dbc125b82d7d76ea9e8e48abeda0133e6d7d18e78 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/dx_gateway_association.html.markdown b/website/docs/cdktf/typescript/r/dx_gateway_association.html.markdown
new file mode 100644
index 00000000000..46ae1dbd6be
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/dx_gateway_association.html.markdown
@@ -0,0 +1,213 @@
+---
+subcategory: "Direct Connect"
+layout: "aws"
+page_title: "AWS: aws_dx_gateway_association"
+description: |-
+  Associates a Direct Connect Gateway with a VGW or transit gateway.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_dx_gateway_association
+
+Associates a Direct Connect Gateway with a VGW or transit gateway.
+
+To create a cross-account association, create an [`awsDxGatewayAssociationProposal` resource](/docs/providers/aws/r/dx_gateway_association_proposal.html)
+in the AWS account that owns the VGW or transit gateway and then accept the proposal in the AWS account that owns the Direct Connect Gateway
+by creating an `awsDxGatewayAssociation` resource with the `proposalId` and `associatedGatewayOwnerAccountId` attributes set.
+
+## Example Usage
+
+### VPN Gateway Association
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DxGateway } from "./.gen/providers/aws/dx-gateway";
+import { DxGatewayAssociation } from "./.gen/providers/aws/dx-gateway-association";
+import { Vpc } from "./.gen/providers/aws/vpc";
+import { VpnGateway } from "./.gen/providers/aws/vpn-gateway";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new DxGateway(this, "example", {
+      amazonSideAsn: "64512",
+      name: "example",
+    });
+    const awsVpcExample = new Vpc(this, "example_1", {
+      cidrBlock: "10.255.255.0/28",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsVpcExample.overrideLogicalId("example");
+    const awsVpnGatewayExample = new VpnGateway(this, "example_2", {
+      vpcId: Token.asString(awsVpcExample.id),
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsVpnGatewayExample.overrideLogicalId("example");
+    const awsDxGatewayAssociationExample = new DxGatewayAssociation(
+      this,
+      "example_3",
+      {
+        associatedGatewayId: Token.asString(awsVpnGatewayExample.id),
+        dxGatewayId: example.id,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsDxGatewayAssociationExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### Transit Gateway Association
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DxGateway } from "./.gen/providers/aws/dx-gateway";
+import { DxGatewayAssociation } from "./.gen/providers/aws/dx-gateway-association";
+import { Ec2TransitGateway } from "./.gen/providers/aws/ec2-transit-gateway";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new DxGateway(this, "example", {
+      amazonSideAsn: "64512",
+      name: "example",
+    });
+    const awsEc2TransitGatewayExample = new Ec2TransitGateway(
+      this,
+      "example_1",
+      {}
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsEc2TransitGatewayExample.overrideLogicalId("example");
+    const awsDxGatewayAssociationExample = new DxGatewayAssociation(
+      this,
+      "example_2",
+      {
+        allowedPrefixes: ["10.255.255.0/30", "10.255.255.8/30"],
+        associatedGatewayId: Token.asString(awsEc2TransitGatewayExample.id),
+        dxGatewayId: example.id,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsDxGatewayAssociationExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### Allowed Prefixes
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DxGateway } from "./.gen/providers/aws/dx-gateway";
+import { DxGatewayAssociation } from "./.gen/providers/aws/dx-gateway-association";
+import { Vpc } from "./.gen/providers/aws/vpc";
+import { VpnGateway } from "./.gen/providers/aws/vpn-gateway";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new DxGateway(this, "example", {
+      amazonSideAsn: "64512",
+      name: "example",
+    });
+    const awsVpcExample = new Vpc(this, "example_1", {
+      cidrBlock: "10.255.255.0/28",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsVpcExample.overrideLogicalId("example");
+    const awsVpnGatewayExample = new VpnGateway(this, "example_2", {
+      vpcId: Token.asString(awsVpcExample.id),
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsVpnGatewayExample.overrideLogicalId("example");
+    const awsDxGatewayAssociationExample = new DxGatewayAssociation(
+      this,
+      "example_3",
+      {
+        allowedPrefixes: ["210.52.109.0/24", "175.45.176.0/22"],
+        associatedGatewayId: Token.asString(awsVpnGatewayExample.id),
+        dxGatewayId: example.id,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsDxGatewayAssociationExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+A full example of how to create a VPN Gateway in one AWS account, create a Direct Connect Gateway in a second AWS account, and associate the VPN Gateway with the Direct Connect Gateway via the `awsDxGatewayAssociationProposal` and `awsDxGatewayAssociation` resources can be found in [the `/examples/dxGatewayCrossAccountVgwAssociation` directory within the Github Repository](https://github.com/hashicorp/terraform-provider-aws/tree/main/examples/dx-gateway-cross-account-vgw-association).
+
+## Argument Reference
+
+~> **NOTE:** `dxGatewayId` and `associatedGatewayId` must be specified for single account Direct Connect gateway associations.
+
+This argument supports the following arguments:
+
+* `dxGatewayId` - (Required) The ID of the Direct Connect gateway.
+* `associatedGatewayId` - (Optional) The ID of the VGW or transit gateway with which to associate the Direct Connect gateway.
+Used for single account Direct Connect gateway associations.
+* `associatedGatewayOwnerAccountId` - (Optional) The ID of the AWS account that owns the VGW or transit gateway with which to associate the Direct Connect gateway.
+Used for cross-account Direct Connect gateway associations.
+* `proposalId` - (Optional) The ID of the Direct Connect gateway association proposal.
+Used for cross-account Direct Connect gateway associations.
+* `allowedPrefixes` - (Optional) VPC prefixes (CIDRs) to advertise to the Direct Connect gateway. Defaults to the CIDR block of the VPC associated with the Virtual Gateway. To enable drift detection, must be configured.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the Direct Connect gateway association resource.
+* `associatedGatewayType` - The type of the associated gateway, `transitGateway` or `virtualPrivateGateway`.
+* `dxGatewayAssociationId` - The ID of the Direct Connect gateway association.
+* `dxGatewayOwnerAccountId` - The ID of the AWS account that owns the Direct Connect gateway.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `30M`)
+- `update` - (Default `30M`)
+- `delete` - (Default `30M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Direct Connect gateway associations using `dxGatewayId` together with `associatedGatewayId`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Direct Connect gateway associations using `dxGatewayId` together with `associatedGatewayId`. For example:
+
+```console
+% terraform import aws_dx_gateway_association.example 345508c3-7215-4aef-9832-07c125d5bd0f/vgw-98765432
+```
+
+<!-- cache-key: cdktf-0.18.0 input-a27cdf93a7d5c42337724f3a987226ae88c4ae0502a4d4160e2444683c6a343d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/dx_gateway_association_proposal.html.markdown b/website/docs/cdktf/typescript/r/dx_gateway_association_proposal.html.markdown
new file mode 100644
index 00000000000..dd5eb8babfb
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/dx_gateway_association_proposal.html.markdown
@@ -0,0 +1,109 @@
+---
+subcategory: "Direct Connect"
+layout: "aws"
+page_title: "AWS: aws_dx_gateway_association_proposal"
+description: |-
+  Manages a Direct Connect Gateway Association Proposal.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_dx_gateway_association_proposal
+
+Manages a Direct Connect Gateway Association Proposal, typically for enabling cross-account associations. For single account associations, see the [`awsDxGatewayAssociation` resource](/docs/providers/aws/r/dx_gateway_association.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DxGatewayAssociationProposal } from "./.gen/providers/aws/dx-gateway-association-proposal";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DxGatewayAssociationProposal(this, "example", {
+      associatedGatewayId: Token.asString(awsVpnGatewayExample.id),
+      dxGatewayId: Token.asString(awsDxGatewayExample.id),
+      dxGatewayOwnerAccountId: Token.asString(
+        awsDxGatewayExample.ownerAccountId
+      ),
+    });
+  }
+}
+
+```
+
+A full example of how to create a VPN Gateway in one AWS account, create a Direct Connect Gateway in a second AWS account, and associate the VPN Gateway with the Direct Connect Gateway via the `awsDxGatewayAssociationProposal` and `awsDxGatewayAssociation` resources can be found in [the `/examples/dxGatewayCrossAccountVgwAssociation` directory within the Github Repository](https://github.com/hashicorp/terraform-provider-aws/tree/main/examples/dx-gateway-cross-account-vgw-association).
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `associatedGatewayId` - (Required) The ID of the VGW or transit gateway with which to associate the Direct Connect gateway.
+* `dxGatewayId` - (Required) Direct Connect Gateway identifier.
+* `dxGatewayOwnerAccountId` - (Required) AWS Account identifier of the Direct Connect Gateway's owner.
+* `allowedPrefixes` - (Optional) VPC prefixes (CIDRs) to advertise to the Direct Connect gateway. Defaults to the CIDR block of the VPC associated with the Virtual Gateway. To enable drift detection, must be configured.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Direct Connect Gateway Association Proposal identifier.
+* `associatedGatewayOwnerAccountId` - The ID of the AWS account that owns the VGW or transit gateway with which to associate the Direct Connect gateway.
+* `associatedGatewayType` - The type of the associated gateway, `transitGateway` or `virtualPrivateGateway`.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Direct Connect Gateway Association Proposals using either a proposal ID or proposal ID, Direct Connect Gateway ID and associated gateway ID separated by `/`. For example:
+
+Using a proposal ID:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using a proposal ID, Direct Connect Gateway ID and associated gateway ID separated by `/`:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+**With `terraform import`**, import Direct Connect Gateway Association Proposals using either a proposal ID or proposal ID, Direct Connect Gateway ID and associated gateway ID separated by `/`. For example:
+
+Using a proposal ID:
+
+```console
+% terraform import aws_dx_gateway_association_proposal.example ac90e981-b718-4364-872d-65478c84fafe
+```
+
+Using a proposal ID, Direct Connect Gateway ID and associated gateway ID separated by `/`:
+
+```console
+% terraform import aws_dx_gateway_association_proposal.example ac90e981-b718-4364-872d-65478c84fafe/abcd1234-dcba-5678-be23-cdef9876ab45/vgw-12345678
+```
+
+The latter case is useful when a previous proposal has been accepted and deleted by AWS.
+The `awsDxGatewayAssociationProposal` resource will then represent a pseudo-proposal for the same Direct Connect Gateway and associated gateway. If no previous proposal is available, use a tool like [`uuidgen`](http://manpages.ubuntu.com/manpages/bionic/man1/uuidgen.1.html) to generate a new random pseudo-proposal ID.
+
+<!-- cache-key: cdktf-0.18.0 input-4c6dba02a31331ff74f6b982064aff401065a96d07736b20f32eb5d034a7822f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/dx_hosted_connection.html.markdown b/website/docs/cdktf/typescript/r/dx_hosted_connection.html.markdown
new file mode 100644
index 00000000000..9259dce964a
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/dx_hosted_connection.html.markdown
@@ -0,0 +1,67 @@
+---
+subcategory: "Direct Connect"
+layout: "aws"
+page_title: "AWS: aws_dx_hosted_connection"
+description: |-
+  Provides a hosted connection on the specified interconnect or a link aggregation group (LAG) of interconnects. Intended for use by AWS Direct Connect Partners only.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_dx_hosted_connection
+
+Provides a hosted connection on the specified interconnect or a link aggregation group (LAG) of interconnects. Intended for use by AWS Direct Connect Partners only.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DxHostedConnection } from "./.gen/providers/aws/dx-hosted-connection";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DxHostedConnection(this, "hosted", {
+      bandwidth: "100Mbps",
+      connectionId: "dxcon-ffabc123",
+      name: "tf-dx-hosted-connection",
+      ownerAccountId: "123456789012",
+      vlan: 1,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the connection.
+* `bandwidth` - (Required) The bandwidth of the connection. Valid values for dedicated connections: 1Gbps, 10Gbps. Valid values for hosted connections: 50Mbps, 100Mbps, 200Mbps, 300Mbps, 400Mbps, 500Mbps, 1Gbps, 2Gbps, 5Gbps and 10Gbps. Case sensitive.
+* `connectionId` - (Required) The ID of the interconnect or LAG.
+* `ownerAccountId` - (Required) The ID of the AWS account of the customer for the connection.
+* `vlan` - (Required) The dedicated VLAN provisioned to the hosted connection.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the connection.
+* `jumboFrameCapable` - Boolean value representing if jumbo frames have been enabled for this connection.
+* `hasLogicalRedundancy` - Indicates whether the connection supports a secondary BGP peer in the same address family (IPv4/IPv6).
+* `awsDevice` - The Direct Connect endpoint on which the physical connection terminates.
+* `state` - The state of the connection. Possible values include: ordering, requested, pending, available, down, deleting, deleted, rejected, unknown. See [AllocateHostedConnection](https://docs.aws.amazon.com/directconnect/latest/APIReference/API_AllocateHostedConnection.html) for a description of each connection state.
+* `lagId` - The ID of the LAG.
+* `loaIssueTime` - The time of the most recent call to [DescribeLoa](https://docs.aws.amazon.com/directconnect/latest/APIReference/API_DescribeLoa.html) for this connection.
+* `location` - The location of the connection.
+* `partnerName` - The name of the AWS Direct Connect service provider associated with the connection.
+* `providerName` - The name of the service provider associated with the connection.
+* `region` - The AWS Region where the connection is located.
+
+<!-- cache-key: cdktf-0.18.0 input-97bc5655cc271850c8ea111d0eeb9833b2352964ab1dc9e68ab175109b7b9dee -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/dx_hosted_private_virtual_interface.html.markdown b/website/docs/cdktf/typescript/r/dx_hosted_private_virtual_interface.html.markdown
new file mode 100644
index 00000000000..24c010835a3
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/dx_hosted_private_virtual_interface.html.markdown
@@ -0,0 +1,100 @@
+---
+subcategory: "Direct Connect"
+layout: "aws"
+page_title: "AWS: aws_dx_hosted_private_virtual_interface"
+description: |-
+  Provides a Direct Connect hosted private virtual interface resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_dx_hosted_private_virtual_interface
+
+Provides a Direct Connect hosted private virtual interface resource. This resource represents the allocator's side of the hosted virtual interface.
+A hosted virtual interface is a virtual interface that is owned by another AWS account.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DxHostedPrivateVirtualInterface } from "./.gen/providers/aws/dx-hosted-private-virtual-interface";
+interface MyConfig {
+  ownerAccountId: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new DxHostedPrivateVirtualInterface(this, "foo", {
+      addressFamily: "ipv4",
+      bgpAsn: 65352,
+      connectionId: "dxcon-zzzzzzzz",
+      name: "vif-foo",
+      vlan: 4094,
+      ownerAccountId: config.ownerAccountId,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `addressFamily` - (Required) The address family for the BGP peer. `ipv4 ` or `ipv6`.
+* `bgpAsn` - (Required) The autonomous system (AS) number for Border Gateway Protocol (BGP) configuration.
+* `connectionId` - (Required) The ID of the Direct Connect connection (or LAG) on which to create the virtual interface.
+* `name` - (Required) The name for the virtual interface.
+* `ownerAccountId` - (Required) The AWS account that will own the new virtual interface.
+* `vlan` - (Required) The VLAN ID.
+* `amazonAddress` - (Optional) The IPv4 CIDR address to use to send traffic to Amazon. Required for IPv4 BGP peers.
+* `mtu` - (Optional) The maximum transmission unit (MTU) is the size, in bytes, of the largest permissible packet that can be passed over the connection. The MTU of a virtual private interface can be either `1500` or `9001` (jumbo frames). Default is `1500`.
+* `bgpAuthKey` - (Optional) The authentication key for BGP configuration.
+* `customerAddress` - (Optional) The IPv4 CIDR destination address to which Amazon should send traffic. Required for IPv4 BGP peers.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the virtual interface.
+* `arn` - The ARN of the virtual interface.
+* `jumboFrameCapable` - Indicates whether jumbo frames (9001 MTU) are supported.
+* `awsDevice` - The Direct Connect endpoint on which the virtual interface terminates.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `10M`)
+- `update` - (Default `10M`)
+- `delete` - (Default `10M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Direct Connect hosted private virtual interfaces using the VIF `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Direct Connect hosted private virtual interfaces using the VIF `id`. For example:
+
+```console
+% terraform import aws_dx_hosted_private_virtual_interface.test dxvif-33cc44dd
+```
+
+<!-- cache-key: cdktf-0.18.0 input-30c56346b371b07a0381a9a9a399fae393a6827e0de105fc1f2ffe338e99c3e4 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/dx_hosted_private_virtual_interface_accepter.html.markdown b/website/docs/cdktf/typescript/r/dx_hosted_private_virtual_interface_accepter.html.markdown
new file mode 100644
index 00000000000..d0b7df473e5
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/dx_hosted_private_virtual_interface_accepter.html.markdown
@@ -0,0 +1,129 @@
+---
+subcategory: "Direct Connect"
+layout: "aws"
+page_title: "AWS: aws_dx_hosted_private_virtual_interface_accepter"
+description: |-
+  Provides a resource to manage the accepter's side of a Direct Connect hosted private virtual interface.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_dx_hosted_private_virtual_interface_accepter
+
+Provides a resource to manage the accepter's side of a Direct Connect hosted private virtual interface.
+This resource accepts ownership of a private virtual interface created by another AWS account.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCallerIdentity } from "./.gen/providers/aws/data-aws-caller-identity";
+import { DxHostedPrivateVirtualInterface } from "./.gen/providers/aws/dx-hosted-private-virtual-interface";
+import { DxHostedPrivateVirtualInterfaceAccepter } from "./.gen/providers/aws/dx-hosted-private-virtual-interface-accepter";
+import { AwsProvider } from "./.gen/providers/aws/provider";
+import { VpnGateway } from "./.gen/providers/aws/vpn-gateway";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AwsProvider(this, "aws", {});
+    const accepter = new AwsProvider(this, "aws_1", {
+      alias: "accepter",
+    });
+    const vpnGw = new VpnGateway(this, "vpn_gw", {
+      provider: accepter,
+    });
+    const dataAwsCallerIdentityAccepter = new DataAwsCallerIdentity(
+      this,
+      "accepter",
+      {
+        provider: accepter,
+      }
+    );
+    const creator = new DxHostedPrivateVirtualInterface(this, "creator", {
+      addressFamily: "ipv4",
+      bgpAsn: 65352,
+      connectionId: "dxcon-zzzzzzzz",
+      dependsOn: [vpnGw],
+      name: "vif-foo",
+      ownerAccountId: Token.asString(dataAwsCallerIdentityAccepter.accountId),
+      vlan: 4094,
+    });
+    const awsDxHostedPrivateVirtualInterfaceAccepterAccepter =
+      new DxHostedPrivateVirtualInterfaceAccepter(this, "accepter_5", {
+        provider: accepter,
+        tags: {
+          Side: "Accepter",
+        },
+        virtualInterfaceId: creator.id,
+        vpnGatewayId: vpnGw.id,
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsDxHostedPrivateVirtualInterfaceAccepterAccepter.overrideLogicalId(
+      "accepter"
+    );
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `virtualInterfaceId` - (Required) The ID of the Direct Connect virtual interface to accept.
+* `dxGatewayId` - (Optional) The ID of the Direct Connect gateway to which to connect the virtual interface.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `vpnGatewayId` - (Optional) The ID of the [virtual private gateway](vpn_gateway.html) to which to connect the virtual interface.
+
+### Removing `awsDxHostedPrivateVirtualInterfaceAccepter` from your configuration
+
+AWS allows a Direct Connect hosted private virtual interface to be deleted from either the allocator's or accepter's side.
+However, Terraform only allows the Direct Connect hosted private virtual interface to be deleted from the allocator's side
+by removing the corresponding `awsDxHostedPrivateVirtualInterface` resource from your configuration.
+Removing a `awsDxHostedPrivateVirtualInterfaceAccepter` resource from your configuration will remove it
+from your statefile and management, **but will not delete the Direct Connect virtual interface.**
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the virtual interface.
+* `arn` - The ARN of the virtual interface.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `10M`)
+- `delete` - (Default `10M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Direct Connect hosted private virtual interfaces using the VIF `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Direct Connect hosted private virtual interfaces using the VIF `id`. For example:
+
+```console
+% terraform import aws_dx_hosted_private_virtual_interface_accepter.test dxvif-33cc44dd
+```
+
+<!-- cache-key: cdktf-0.18.0 input-82aee1d3fc70745175c9dad52c1bbb0ad47469969a29d92069bf48c33d5539a9 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/dx_hosted_public_virtual_interface.html.markdown b/website/docs/cdktf/typescript/r/dx_hosted_public_virtual_interface.html.markdown
new file mode 100644
index 00000000000..9cf0b235b4a
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/dx_hosted_public_virtual_interface.html.markdown
@@ -0,0 +1,101 @@
+---
+subcategory: "Direct Connect"
+layout: "aws"
+page_title: "AWS: aws_dx_hosted_public_virtual_interface"
+description: |-
+  Provides a Direct Connect hosted public virtual interface resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_dx_hosted_public_virtual_interface
+
+Provides a Direct Connect hosted public virtual interface resource. This resource represents the allocator's side of the hosted virtual interface.
+A hosted virtual interface is a virtual interface that is owned by another AWS account.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DxHostedPublicVirtualInterface } from "./.gen/providers/aws/dx-hosted-public-virtual-interface";
+interface MyConfig {
+  ownerAccountId: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new DxHostedPublicVirtualInterface(this, "foo", {
+      addressFamily: "ipv4",
+      amazonAddress: "175.45.176.2/30",
+      bgpAsn: 65352,
+      connectionId: "dxcon-zzzzzzzz",
+      customerAddress: "175.45.176.1/30",
+      name: "vif-foo",
+      routeFilterPrefixes: ["210.52.109.0/24", "175.45.176.0/22"],
+      vlan: 4094,
+      ownerAccountId: config.ownerAccountId,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `addressFamily` - (Required) The address family for the BGP peer. `ipv4 ` or `ipv6`.
+* `bgpAsn` - (Required) The autonomous system (AS) number for Border Gateway Protocol (BGP) configuration.
+* `connectionId` - (Required) The ID of the Direct Connect connection (or LAG) on which to create the virtual interface.
+* `name` - (Required) The name for the virtual interface.
+* `ownerAccountId` - (Required) The AWS account that will own the new virtual interface.
+* `routeFilterPrefixes` - (Required) A list of routes to be advertised to the AWS network in this region.
+* `vlan` - (Required) The VLAN ID.
+* `amazonAddress` - (Optional) The IPv4 CIDR address to use to send traffic to Amazon. Required for IPv4 BGP peers.
+* `bgpAuthKey` - (Optional) The authentication key for BGP configuration.
+* `customerAddress` - (Optional) The IPv4 CIDR destination address to which Amazon should send traffic. Required for IPv4 BGP peers.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the virtual interface.
+* `arn` - The ARN of the virtual interface.
+* `awsDevice` - The Direct Connect endpoint on which the virtual interface terminates.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `10M`)
+- `delete` - (Default `10M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Direct Connect hosted public virtual interfaces using the VIF `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Direct Connect hosted public virtual interfaces using the VIF `id`. For example:
+
+```console
+% terraform import aws_dx_hosted_public_virtual_interface.test dxvif-33cc44dd
+```
+
+<!-- cache-key: cdktf-0.18.0 input-262d7b7a8f2eb087cdb87de5bfe3e80f0a5fe07b0c75b381a8e2e13dc74e39ca -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/dx_hosted_public_virtual_interface_accepter.html.markdown b/website/docs/cdktf/typescript/r/dx_hosted_public_virtual_interface_accepter.html.markdown
new file mode 100644
index 00000000000..ebb2fd4830b
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/dx_hosted_public_virtual_interface_accepter.html.markdown
@@ -0,0 +1,124 @@
+---
+subcategory: "Direct Connect"
+layout: "aws"
+page_title: "AWS: aws_dx_hosted_public_virtual_interface_accepter"
+description: |-
+  Provides a resource to manage the accepter's side of a Direct Connect hosted public virtual interface.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_dx_hosted_public_virtual_interface_accepter
+
+Provides a resource to manage the accepter's side of a Direct Connect hosted public virtual interface.
+This resource accepts ownership of a public virtual interface created by another AWS account.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCallerIdentity } from "./.gen/providers/aws/data-aws-caller-identity";
+import { DxHostedPublicVirtualInterface } from "./.gen/providers/aws/dx-hosted-public-virtual-interface";
+import { DxHostedPublicVirtualInterfaceAccepter } from "./.gen/providers/aws/dx-hosted-public-virtual-interface-accepter";
+import { AwsProvider } from "./.gen/providers/aws/provider";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AwsProvider(this, "aws", {});
+    const accepter = new AwsProvider(this, "aws_1", {
+      alias: "accepter",
+    });
+    const dataAwsCallerIdentityAccepter = new DataAwsCallerIdentity(
+      this,
+      "accepter",
+      {
+        provider: accepter,
+      }
+    );
+    const creator = new DxHostedPublicVirtualInterface(this, "creator", {
+      addressFamily: "ipv4",
+      amazonAddress: "175.45.176.2/30",
+      bgpAsn: 65352,
+      connectionId: "dxcon-zzzzzzzz",
+      customerAddress: "175.45.176.1/30",
+      name: "vif-foo",
+      ownerAccountId: Token.asString(dataAwsCallerIdentityAccepter.accountId),
+      routeFilterPrefixes: ["210.52.109.0/24", "175.45.176.0/22"],
+      vlan: 4094,
+    });
+    const awsDxHostedPublicVirtualInterfaceAccepterAccepter =
+      new DxHostedPublicVirtualInterfaceAccepter(this, "accepter_4", {
+        provider: accepter,
+        tags: {
+          Side: "Accepter",
+        },
+        virtualInterfaceId: creator.id,
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsDxHostedPublicVirtualInterfaceAccepterAccepter.overrideLogicalId(
+      "accepter"
+    );
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `virtualInterfaceId` - (Required) The ID of the Direct Connect virtual interface to accept.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Removing `awsDxHostedPublicVirtualInterfaceAccepter` from your configuration
+
+AWS allows a Direct Connect hosted public virtual interface to be deleted from either the allocator's or accepter's side.
+However, Terraform only allows the Direct Connect hosted public virtual interface to be deleted from the allocator's side
+by removing the corresponding `awsDxHostedPublicVirtualInterface` resource from your configuration.
+Removing a `awsDxHostedPublicVirtualInterfaceAccepter` resource from your configuration will remove it
+from your statefile and management, **but will not delete the Direct Connect virtual interface.**
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the virtual interface.
+* `arn` - The ARN of the virtual interface.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `10M`)
+- `delete` - (Default `10M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Direct Connect hosted public virtual interfaces using the VIF `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Direct Connect hosted public virtual interfaces using the VIF `id`. For example:
+
+```console
+% terraform import aws_dx_hosted_public_virtual_interface_accepter.test dxvif-33cc44dd
+```
+
+<!-- cache-key: cdktf-0.18.0 input-3fb98a54fb9a43c15d6fee296c8d86bd4a38051bd45d29bc11886d96390ceb99 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/dx_hosted_transit_virtual_interface.html.markdown b/website/docs/cdktf/typescript/r/dx_hosted_transit_virtual_interface.html.markdown
new file mode 100644
index 00000000000..922050365ee
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/dx_hosted_transit_virtual_interface.html.markdown
@@ -0,0 +1,101 @@
+---
+subcategory: "Direct Connect"
+layout: "aws"
+page_title: "AWS: aws_dx_hosted_transit_virtual_interface"
+description: |-
+  Provides a Direct Connect hosted transit virtual interface resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_dx_hosted_transit_virtual_interface
+
+Provides a Direct Connect hosted transit virtual interface resource.
+This resource represents the allocator's side of the hosted virtual interface.
+A hosted virtual interface is a virtual interface that is owned by another AWS account.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DxHostedTransitVirtualInterface } from "./.gen/providers/aws/dx-hosted-transit-virtual-interface";
+interface MyConfig {
+  ownerAccountId: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new DxHostedTransitVirtualInterface(this, "example", {
+      addressFamily: "ipv4",
+      bgpAsn: 65352,
+      connectionId: Token.asString(awsDxConnectionExample.id),
+      name: "tf-transit-vif-example",
+      vlan: 4094,
+      ownerAccountId: config.ownerAccountId,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `addressFamily` - (Required) The address family for the BGP peer. `ipv4 ` or `ipv6`.
+* `bgpAsn` - (Required) The autonomous system (AS) number for Border Gateway Protocol (BGP) configuration.
+* `connectionId` - (Required) The ID of the Direct Connect connection (or LAG) on which to create the virtual interface.
+* `name` - (Required) The name for the virtual interface.
+* `ownerAccountId` - (Required) The AWS account that will own the new virtual interface.
+* `vlan` - (Required) The VLAN ID.
+* `amazonAddress` - (Optional) The IPv4 CIDR address to use to send traffic to Amazon. Required for IPv4 BGP peers.
+* `bgpAuthKey` - (Optional) The authentication key for BGP configuration.
+* `customerAddress` - (Optional) The IPv4 CIDR destination address to which Amazon should send traffic. Required for IPv4 BGP peers.
+* `mtu` - (Optional) The maximum transmission unit (MTU) is the size, in bytes, of the largest permissible packet that can be passed over the connection. The MTU of a virtual transit interface can be either `1500` or `8500` (jumbo frames). Default is `1500`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the virtual interface.
+* `arn` - The ARN of the virtual interface.
+* `awsDevice` - The Direct Connect endpoint on which the virtual interface terminates.
+* `jumboFrameCapable` - Indicates whether jumbo frames (8500 MTU) are supported.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `10M`)
+- `update` - (Default `10M`)
+- `delete` - (Default `10M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Direct Connect hosted transit virtual interfaces using the VIF `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Direct Connect hosted transit virtual interfaces using the VIF `id`. For example:
+
+```console
+% terraform import aws_dx_hosted_transit_virtual_interface.test dxvif-33cc44dd
+```
+
+<!-- cache-key: cdktf-0.18.0 input-f81c32393a3d19d17be728198b387816f13df0e65ec9958f05a3ac37f50db5bd -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/dx_hosted_transit_virtual_interface_accepter.html.markdown b/website/docs/cdktf/typescript/r/dx_hosted_transit_virtual_interface_accepter.html.markdown
new file mode 100644
index 00000000000..c69aa993fb4
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/dx_hosted_transit_virtual_interface_accepter.html.markdown
@@ -0,0 +1,124 @@
+---
+subcategory: "Direct Connect"
+layout: "aws"
+page_title: "AWS: aws_dx_hosted_transit_virtual_interface_accepter"
+description: |-
+  Provides a resource to manage the accepter's side of a Direct Connect hosted transit virtual interface.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_dx_hosted_transit_virtual_interface_accepter
+
+Provides a resource to manage the accepter's side of a Direct Connect hosted transit virtual interface.
+This resource accepts ownership of a transit virtual interface created by another AWS account.
+
+-> **NOTE:** AWS allows a Direct Connect hosted transit virtual interface to be deleted from either the allocator's or accepter's side. However, Terraform only allows the Direct Connect hosted transit virtual interface to be deleted from the allocator's side by removing the corresponding `awsDxHostedTransitVirtualInterface` resource from your configuration. Removing a `awsDxHostedTransitVirtualInterfaceAccepter` resource from your configuration will remove it from your statefile and management, **but will not delete the Direct Connect virtual interface.**
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCallerIdentity } from "./.gen/providers/aws/data-aws-caller-identity";
+import { DxGateway } from "./.gen/providers/aws/dx-gateway";
+import { DxHostedTransitVirtualInterface } from "./.gen/providers/aws/dx-hosted-transit-virtual-interface";
+import { DxHostedTransitVirtualInterfaceAccepter } from "./.gen/providers/aws/dx-hosted-transit-virtual-interface-accepter";
+import { AwsProvider } from "./.gen/providers/aws/provider";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AwsProvider(this, "aws", {});
+    const accepter = new AwsProvider(this, "aws_1", {
+      alias: "accepter",
+    });
+    const example = new DxGateway(this, "example", {
+      amazonSideAsn: Token.asString(64512),
+      name: "tf-dxg-example",
+      provider: accepter,
+    });
+    const dataAwsCallerIdentityAccepter = new DataAwsCallerIdentity(
+      this,
+      "accepter",
+      {
+        provider: accepter,
+      }
+    );
+    const creator = new DxHostedTransitVirtualInterface(this, "creator", {
+      addressFamily: "ipv4",
+      bgpAsn: 65352,
+      connectionId: "dxcon-zzzzzzzz",
+      dependsOn: [example],
+      name: "tf-transit-vif-example",
+      ownerAccountId: Token.asString(dataAwsCallerIdentityAccepter.accountId),
+      vlan: 4094,
+    });
+    const awsDxHostedTransitVirtualInterfaceAccepterAccepter =
+      new DxHostedTransitVirtualInterfaceAccepter(this, "accepter_5", {
+        dxGatewayId: example.id,
+        provider: accepter,
+        tags: {
+          Side: "Accepter",
+        },
+        virtualInterfaceId: creator.id,
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsDxHostedTransitVirtualInterfaceAccepterAccepter.overrideLogicalId(
+      "accepter"
+    );
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `dxGatewayId` - (Required) The ID of the [Direct Connect gateway](dx_gateway.html) to which to connect the virtual interface.
+* `virtualInterfaceId` - (Required) The ID of the Direct Connect virtual interface to accept.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the virtual interface.
+* `arn` - The ARN of the virtual interface.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `10M`)
+- `delete` - (Default `10M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Direct Connect hosted transit virtual interfaces using the VIF `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Direct Connect hosted transit virtual interfaces using the VIF `id`. For example:
+
+```console
+% terraform import aws_dx_hosted_transit_virtual_interface_accepter.test dxvif-33cc44dd
+```
+
+<!-- cache-key: cdktf-0.18.0 input-11153e84fd4c6aad81c1acf38c978286aaac606a6d4e54cc6058708bc8cb04ba -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/dx_lag.html.markdown b/website/docs/cdktf/typescript/r/dx_lag.html.markdown
new file mode 100644
index 00000000000..00b7ee98039
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/dx_lag.html.markdown
@@ -0,0 +1,87 @@
+---
+subcategory: "Direct Connect"
+layout: "aws"
+page_title: "AWS: aws_dx_lag"
+description: |-
+  Provides a Direct Connect LAG.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_dx_lag
+
+Provides a Direct Connect LAG. Connections can be added to the LAG via the [`awsDxConnection`](/docs/providers/aws/r/dx_connection.html) and [`awsDxConnectionAssociation`](/docs/providers/aws/r/dx_connection_association.html) resources.
+
+~> *NOTE:* When creating a LAG, if no existing connection is specified, Direct Connect will create a connection and Terraform will remove this unmanaged connection during resource creation.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DxLag } from "./.gen/providers/aws/dx-lag";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DxLag(this, "hoge", {
+      connectionsBandwidth: "1Gbps",
+      forceDestroy: true,
+      location: "EqDC2",
+      name: "tf-dx-lag",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the LAG.
+* `connectionsBandwidth` - (Required) The bandwidth of the individual physical connections bundled by the LAG. Valid values: 50Mbps, 100Mbps, 200Mbps, 300Mbps, 400Mbps, 500Mbps, 1Gbps, 2Gbps, 5Gbps, 10Gbps and 100Gbps. Case sensitive.
+* `location` - (Required) The AWS Direct Connect location in which the LAG should be allocated. See [DescribeLocations](https://docs.aws.amazon.com/directconnect/latest/APIReference/API_DescribeLocations.html) for the list of AWS Direct Connect locations. Use `locationCode`.
+* `connectionId` - (Optional) The ID of an existing dedicated connection to migrate to the LAG.
+* `forceDestroy` - (Optional, Default:false) A boolean that indicates all connections associated with the LAG should be deleted so that the LAG can be destroyed without error. These objects are *not* recoverable.
+* `providerName` - (Optional) The name of the service provider associated with the LAG.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the LAG.
+* `hasLogicalRedundancy` - Indicates whether the LAG supports a secondary BGP peer in the same address family (IPv4/IPv6).
+* `id` - The ID of the LAG.
+* `jumboFrameCapable` -Indicates whether jumbo frames (9001 MTU) are supported.
+* `ownerAccountId` - The ID of the AWS account that owns the LAG.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Direct Connect LAGs using the LAG `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Direct Connect LAGs using the LAG `id`. For example:
+
+```console
+% terraform import aws_dx_lag.test_lag dxlag-fgnsp5rq
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ed3f72bbdf567cfec0fe7862f21073034886100b66c1dcbdcdf0587bf6a6a4c4 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/dx_macsec_key_association.html.markdown b/website/docs/cdktf/typescript/r/dx_macsec_key_association.html.markdown
new file mode 100644
index 00000000000..26582aa82d6
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/dx_macsec_key_association.html.markdown
@@ -0,0 +1,108 @@
+---
+subcategory: "Direct Connect"
+layout: "aws"
+page_title: "AWS: aws_dx_macsec_key_association"
+description: |-
+  Provides a MAC Security (MACSec) secret key resource for use with Direct Connect.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_dx_macsec_key_association
+
+Provides a MAC Security (MACSec) secret key resource for use with Direct Connect. See [MACsec prerequisites](https://docs.aws.amazon.com/directconnect/latest/UserGuide/direct-connect-mac-sec-getting-started.html#mac-sec-prerequisites) for information about MAC Security (MACsec) prerequisites.
+
+Creating this resource will also create a resource of type [`awsSecretsmanagerSecret`](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/secretsmanager_secret) which is managed by Direct Connect. While you can import this resource into your Terraform state, because this secret is managed by Direct Connect, you will not be able to make any modifications to it. See [How AWS Direct Connect uses AWS Secrets Manager](https://docs.aws.amazon.com/secretsmanager/latest/userguide/integrating_how-services-use-secrets_directconnect.html) for details.
+
+~> **Note:** All arguments including `ckn` and `cak` will be stored in the raw state as plain-text.
+[Read more about sensitive data in state](https://www.terraform.io/docs/state/sensitive-data.html).
+
+~> **Note:** The `secretArn` argument can only be used to reference a previously created MACSec key. You cannot associate a Secrets Manager secret created outside of the `awsDxMacsecKeyAssociation` resource.
+
+## Example Usage
+
+### Create MACSec key with CKN and CAK
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsDxConnection } from "./.gen/providers/aws/data-aws-dx-connection";
+import { DxMacsecKeyAssociation } from "./.gen/providers/aws/dx-macsec-key-association";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new DataAwsDxConnection(this, "example", {
+      name: "tf-dx-connection",
+    });
+    new DxMacsecKeyAssociation(this, "test", {
+      cak: "abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789",
+      ckn: "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
+      connectionId: Token.asString(example.id),
+    });
+  }
+}
+
+```
+
+### Create MACSec key with existing Secrets Manager secret
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsDxConnection } from "./.gen/providers/aws/data-aws-dx-connection";
+import { DataAwsSecretsmanagerSecret } from "./.gen/providers/aws/data-aws-secretsmanager-secret";
+import { DxMacsecKeyAssociation } from "./.gen/providers/aws/dx-macsec-key-association";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new DataAwsDxConnection(this, "example", {
+      name: "tf-dx-connection",
+    });
+    const dataAwsSecretsmanagerSecretExample = new DataAwsSecretsmanagerSecret(
+      this,
+      "example_1",
+      {
+        name: "directconnect!prod/us-east-1/directconnect/0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsSecretsmanagerSecretExample.overrideLogicalId("example");
+    new DxMacsecKeyAssociation(this, "test", {
+      connectionId: Token.asString(example.id),
+      secretArn: Token.asString(dataAwsSecretsmanagerSecretExample.arn),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `cak` - (Optional) The MAC Security (MACsec) CAK to associate with the dedicated connection. The valid values are 64 hexadecimal characters (0-9, A-E). Required if using `ckn`.
+* `ckn` - (Optional) The MAC Security (MACsec) CKN to associate with the dedicated connection. The valid values are 64 hexadecimal characters (0-9, A-E). Required if using `cak`.
+* `connectionId` - (Required) The ID of the dedicated Direct Connect connection. The connection must be a dedicated connection in the `available` state.
+* `secretArn` - (Optional) The Amazon Resource Name (ARN) of the MAC Security (MACsec) secret key to associate with the dedicated connection.
+
+~> **Note:** `ckn` and `cak` are mutually exclusive with `secretArn` - these arguments cannot be used together. If you use `ckn` and `cak`, you should not use `secretArn`. If you use the `secretArn` argument to reference an existing MAC Security (MACSec) secret key, you should not use `ckn` or `cak`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the MAC Security (MACSec) secret key resource.
+* `startOn` - The date in UTC format that the MAC Security (MACsec) secret key takes effect.
+* `state` -  The state of the MAC Security (MACsec) secret key. The possible values are: associating, associated, disassociating, disassociated. See [MacSecKey](https://docs.aws.amazon.com/directconnect/latest/APIReference/API_MacSecKey.html#DX-Type-MacSecKey-state) for descriptions of each state.
+
+<!-- cache-key: cdktf-0.18.0 input-50e631d31892cfa79cc6641d788fa0436c1b909e5a7fa4536b04ed0e3acb3b04 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/dx_private_virtual_interface.html.markdown b/website/docs/cdktf/typescript/r/dx_private_virtual_interface.html.markdown
new file mode 100644
index 00000000000..609af464761
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/dx_private_virtual_interface.html.markdown
@@ -0,0 +1,100 @@
+---
+subcategory: "Direct Connect"
+layout: "aws"
+page_title: "AWS: aws_dx_private_virtual_interface"
+description: |-
+  Provides a Direct Connect private virtual interface resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_dx_private_virtual_interface
+
+Provides a Direct Connect private virtual interface resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DxPrivateVirtualInterface } from "./.gen/providers/aws/dx-private-virtual-interface";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DxPrivateVirtualInterface(this, "foo", {
+      addressFamily: "ipv4",
+      bgpAsn: 65352,
+      connectionId: "dxcon-zzzzzzzz",
+      name: "vif-foo",
+      vlan: 4094,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `addressFamily` - (Required) The address family for the BGP peer. `ipv4 ` or `ipv6`.
+* `bgpAsn` - (Required) The autonomous system (AS) number for Border Gateway Protocol (BGP) configuration.
+* `connectionId` - (Required) The ID of the Direct Connect connection (or LAG) on which to create the virtual interface.
+* `name` - (Required) The name for the virtual interface.
+* `vlan` - (Required) The VLAN ID.
+* `amazonAddress` - (Optional) The IPv4 CIDR address to use to send traffic to Amazon. Required for IPv4 BGP peers.
+* `bgpAuthKey` - (Optional) The authentication key for BGP configuration.
+* `customerAddress` - (Optional) The IPv4 CIDR destination address to which Amazon should send traffic. Required for IPv4 BGP peers.
+* `dxGatewayId` - (Optional) The ID of the Direct Connect gateway to which to connect the virtual interface.
+* `mtu` - (Optional) The maximum transmission unit (MTU) is the size, in bytes, of the largest permissible packet that can be passed over the connection.
+The MTU of a virtual private interface can be either `1500` or `9001` (jumbo frames). Default is `1500`.
+* `sitelinkEnabled` - (Optional) Indicates whether to enable or disable SiteLink.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `vpnGatewayId` - (Optional) The ID of the [virtual private gateway](vpn_gateway.html) to which to connect the virtual interface.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the virtual interface.
+* `arn` - The ARN of the virtual interface.
+* `awsDevice` - The Direct Connect endpoint on which the virtual interface terminates.
+* `jumboFrameCapable` - Indicates whether jumbo frames (9001 MTU) are supported.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `10M`)
+- `update` - (Default `10M`)
+- `delete` - (Default `10M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Direct Connect private virtual interfaces using the VIF `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Direct Connect private virtual interfaces using the VIF `id`. For example:
+
+```console
+% terraform import aws_dx_private_virtual_interface.test dxvif-33cc44dd
+```
+
+<!-- cache-key: cdktf-0.18.0 input-c9ac0219d04bdf984abd5ff5099a9682a1da16fcc6658d74d4103ab21c9a9998 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/dx_public_virtual_interface.html.markdown b/website/docs/cdktf/typescript/r/dx_public_virtual_interface.html.markdown
new file mode 100644
index 00000000000..22aebfd056f
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/dx_public_virtual_interface.html.markdown
@@ -0,0 +1,97 @@
+---
+subcategory: "Direct Connect"
+layout: "aws"
+page_title: "AWS: aws_dx_public_virtual_interface"
+description: |-
+  Provides a Direct Connect public virtual interface resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_dx_public_virtual_interface
+
+Provides a Direct Connect public virtual interface resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DxPublicVirtualInterface } from "./.gen/providers/aws/dx-public-virtual-interface";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DxPublicVirtualInterface(this, "foo", {
+      addressFamily: "ipv4",
+      amazonAddress: "175.45.176.2/30",
+      bgpAsn: 65352,
+      connectionId: "dxcon-zzzzzzzz",
+      customerAddress: "175.45.176.1/30",
+      name: "vif-foo",
+      routeFilterPrefixes: ["210.52.109.0/24", "175.45.176.0/22"],
+      vlan: 4094,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `addressFamily` - (Required) The address family for the BGP peer. `ipv4 ` or `ipv6`.
+* `bgpAsn` - (Required) The autonomous system (AS) number for Border Gateway Protocol (BGP) configuration.
+* `connectionId` - (Required) The ID of the Direct Connect connection (or LAG) on which to create the virtual interface.
+* `name` - (Required) The name for the virtual interface.
+* `vlan` - (Required) The VLAN ID.
+* `amazonAddress` - (Optional) The IPv4 CIDR address to use to send traffic to Amazon. Required for IPv4 BGP peers.
+* `bgpAuthKey` - (Optional) The authentication key for BGP configuration.
+* `customerAddress` - (Optional) The IPv4 CIDR destination address to which Amazon should send traffic. Required for IPv4 BGP peers.
+* `routeFilterPrefixes` - (Required) A list of routes to be advertised to the AWS network in this region.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the virtual interface.
+* `arn` - The ARN of the virtual interface.
+* `awsDevice` - The Direct Connect endpoint on which the virtual interface terminates.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `10M`)
+- `delete` - (Default `10M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Direct Connect public virtual interfaces using the VIF `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Direct Connect public virtual interfaces using the VIF `id`. For example:
+
+```console
+% terraform import aws_dx_public_virtual_interface.test dxvif-33cc44dd
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ebdc8f75c16e66de8524c4ee98373933ff1fa3ba07471cde890864f94bc85d6f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/dx_transit_virtual_interface.html.markdown b/website/docs/cdktf/typescript/r/dx_transit_virtual_interface.html.markdown
new file mode 100644
index 00000000000..9a19bacd548
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/dx_transit_virtual_interface.html.markdown
@@ -0,0 +1,112 @@
+---
+subcategory: "Direct Connect"
+layout: "aws"
+page_title: "AWS: aws_dx_transit_virtual_interface"
+description: |-
+  Provides a Direct Connect transit virtual interface resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_dx_transit_virtual_interface
+
+Provides a Direct Connect transit virtual interface resource.
+A transit virtual interface is a VLAN that transports traffic from a [Direct Connect gateway](dx_gateway.html) to one or more [transit gateways](ec2_transit_gateway.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DxGateway } from "./.gen/providers/aws/dx-gateway";
+import { DxTransitVirtualInterface } from "./.gen/providers/aws/dx-transit-virtual-interface";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new DxGateway(this, "example", {
+      amazonSideAsn: Token.asString(64512),
+      name: "tf-dxg-example",
+    });
+    const awsDxTransitVirtualInterfaceExample = new DxTransitVirtualInterface(
+      this,
+      "example_1",
+      {
+        addressFamily: "ipv4",
+        bgpAsn: 65352,
+        connectionId: Token.asString(awsDxConnectionExample.id),
+        dxGatewayId: example.id,
+        name: "tf-transit-vif-example",
+        vlan: 4094,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsDxTransitVirtualInterfaceExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `addressFamily` - (Required) The address family for the BGP peer. `ipv4 ` or `ipv6`.
+* `bgpAsn` - (Required) The autonomous system (AS) number for Border Gateway Protocol (BGP) configuration.
+* `connectionId` - (Required) The ID of the Direct Connect connection (or LAG) on which to create the virtual interface.
+* `dxGatewayId` - (Required) The ID of the Direct Connect gateway to which to connect the virtual interface.
+* `name` - (Required) The name for the virtual interface.
+* `vlan` - (Required) The VLAN ID.
+* `amazonAddress` - (Optional) The IPv4 CIDR address to use to send traffic to Amazon. Required for IPv4 BGP peers.
+* `bgpAuthKey` - (Optional) The authentication key for BGP configuration.
+* `customerAddress` - (Optional) The IPv4 CIDR destination address to which Amazon should send traffic. Required for IPv4 BGP peers.
+* `mtu` - (Optional) The maximum transmission unit (MTU) is the size, in bytes, of the largest permissible packet that can be passed over the connection.
+The MTU of a virtual transit interface can be either `1500` or `8500` (jumbo frames). Default is `1500`.
+* `sitelinkEnabled` - (Optional) Indicates whether to enable or disable SiteLink.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the virtual interface.
+* `arn` - The ARN of the virtual interface.
+* `awsDevice` - The Direct Connect endpoint on which the virtual interface terminates.
+* `jumboFrameCapable` - Indicates whether jumbo frames (8500 MTU) are supported.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `10M`)
+- `update` - (Default `10M`)
+- `delete` - (Default `10M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Direct Connect transit virtual interfaces using the VIF `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Direct Connect transit virtual interfaces using the VIF `id`. For example:
+
+```console
+% terraform import aws_dx_transit_virtual_interface.test dxvif-33cc44dd
+```
+
+<!-- cache-key: cdktf-0.18.0 input-50fafeb6465a4e137f551c411cb1ceffa75181ced4f85830fcb62fdb271ace49 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/dynamodb_contributor_insights.html.markdown b/website/docs/cdktf/typescript/r/dynamodb_contributor_insights.html.markdown
new file mode 100644
index 00000000000..c00f99c3de2
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/dynamodb_contributor_insights.html.markdown
@@ -0,0 +1,70 @@
+---
+subcategory: "DynamoDB"
+layout: "aws"
+page_title: "AWS: aws_dynamodb_contributor_insights"
+description: |-
+  Provides a DynamoDB contributor insights resource
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_dynamodb_contributor_insights
+
+Provides a DynamoDB contributor insights resource
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DynamodbContributorInsights } from "./.gen/providers/aws/dynamodb-contributor-insights";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DynamodbContributorInsights(this, "test", {
+      tableName: "ExampleTableName",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `tableName` - (Required) The name of the table to enable contributor insights
+* `indexName` - (Optional) The global secondary index name
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsDynamodbContributorInsights` using the format `name:tableName/index:indexName`, followed by the account number. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsDynamodbContributorInsights` using the format `name:tableName/index:indexName`, followed by the account number. For example:
+
+```console
+% terraform import aws_dynamodb_contributor_insights.test name:ExampleTableName/index:ExampleIndexName/123456789012
+```
+
+<!-- cache-key: cdktf-0.18.0 input-d4f805846bc4797dd113a929cf5b487a41e12a9aff6d1f926f1a2fb7c8b04f60 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/dynamodb_global_table.html.markdown b/website/docs/cdktf/typescript/r/dynamodb_global_table.html.markdown
new file mode 100644
index 00000000000..eaa49399499
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/dynamodb_global_table.html.markdown
@@ -0,0 +1,133 @@
+---
+subcategory: "DynamoDB"
+layout: "aws"
+page_title: "AWS: aws_dynamodb_global_table"
+description: |-
+  Manages DynamoDB Global Tables V1 (version 2017.11.29)
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_dynamodb_global_table
+
+Manages [DynamoDB Global Tables V1 (version 2017.11.29)](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/globaltables.V1.html). These are layered on top of existing DynamoDB Tables.
+
+~> **NOTE:** To instead manage [DynamoDB Global Tables V2 (version 2019.11.21)](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/globaltables.V2.html), use the [`awsDynamodbTable` resource](/docs/providers/aws/r/dynamodb_table.html) `replica` configuration block.
+
+~> Note: There are many restrictions before you can properly create DynamoDB Global Tables in multiple regions. See the [AWS DynamoDB Global Table Requirements](http://docs.aws.amazon.com/amazondynamodb/latest/developerguide/globaltables_reqs_bestpractices.html) for more information.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DynamodbGlobalTable } from "./.gen/providers/aws/dynamodb-global-table";
+import { DynamodbTable } from "./.gen/providers/aws/dynamodb-table";
+import { AwsProvider } from "./.gen/providers/aws/provider";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const usEast1 = new AwsProvider(this, "aws", {
+      alias: "us-east-1",
+      region: "us-east-1",
+    });
+    const usWest2 = new AwsProvider(this, "aws_1", {
+      alias: "us-west-2",
+      region: "us-west-2",
+    });
+    const awsDynamodbTableUsEast1 = new DynamodbTable(this, "us-east-1", {
+      attribute: [
+        {
+          name: "myAttribute",
+          type: "S",
+        },
+      ],
+      hashKey: "myAttribute",
+      name: "myTable",
+      provider: usEast1,
+      readCapacity: 1,
+      streamEnabled: true,
+      streamViewType: "NEW_AND_OLD_IMAGES",
+      writeCapacity: 1,
+    });
+    const awsDynamodbTableUsWest2 = new DynamodbTable(this, "us-west-2", {
+      attribute: [
+        {
+          name: "myAttribute",
+          type: "S",
+        },
+      ],
+      hashKey: "myAttribute",
+      name: "myTable",
+      provider: usWest2,
+      readCapacity: 1,
+      streamEnabled: true,
+      streamViewType: "NEW_AND_OLD_IMAGES",
+      writeCapacity: 1,
+    });
+    new DynamodbGlobalTable(this, "myTable", {
+      dependsOn: [awsDynamodbTableUsEast1, awsDynamodbTableUsWest2],
+      name: "myTable",
+      provider: usEast1,
+      replica: [
+        {
+          regionName: "us-east-1",
+        },
+        {
+          regionName: "us-west-2",
+        },
+      ],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the global table. Must match underlying DynamoDB Table names in all regions.
+* `replica` - (Required) Underlying DynamoDB Table. At least 1 replica must be defined. See below.
+
+### Nested Fields
+
+#### `replica`
+
+* `regionName` - (Required) AWS region name of replica DynamoDB TableE.g., `usEast1`
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name of the DynamoDB Global Table
+* `arn` - The ARN of the DynamoDB Global Table
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DynamoDB Global Tables using the global table name. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import DynamoDB Global Tables using the global table name. For example:
+
+```console
+% terraform import aws_dynamodb_global_table.MyTable MyTable
+```
+
+<!-- cache-key: cdktf-0.18.0 input-36c3419a203344c40c1651647342ffb9754b89e09585c7824bc0dc4a9fd6a617 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/dynamodb_kinesis_streaming_destination.html.markdown b/website/docs/cdktf/typescript/r/dynamodb_kinesis_streaming_destination.html.markdown
new file mode 100644
index 00000000000..fcf4c41158e
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/dynamodb_kinesis_streaming_destination.html.markdown
@@ -0,0 +1,96 @@
+---
+subcategory: "DynamoDB"
+layout: "aws"
+page_title: "AWS: aws_dynamodb_kinesis_streaming_destination"
+description: |-
+  Enables a Kinesis streaming destination for a DynamoDB table
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_dynamodb_kinesis_streaming_destination
+
+Enables a [Kinesis streaming destination](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/kds.html) for data replication of a DynamoDB table.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DynamodbKinesisStreamingDestination } from "./.gen/providers/aws/dynamodb-kinesis-streaming-destination";
+import { DynamodbTable } from "./.gen/providers/aws/dynamodb-table";
+import { KinesisStream } from "./.gen/providers/aws/kinesis-stream";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new DynamodbTable(this, "example", {
+      attribute: [
+        {
+          name: "id",
+          type: "S",
+        },
+      ],
+      hashKey: "id",
+      name: "orders",
+    });
+    const awsKinesisStreamExample = new KinesisStream(this, "example_1", {
+      name: "order_item_changes",
+      shardCount: 1,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsKinesisStreamExample.overrideLogicalId("example");
+    const awsDynamodbKinesisStreamingDestinationExample =
+      new DynamodbKinesisStreamingDestination(this, "example_2", {
+        streamArn: Token.asString(awsKinesisStreamExample.arn),
+        tableName: example.name,
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsDynamodbKinesisStreamingDestinationExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `streamArn` - (Required) The ARN for a Kinesis data stream. This must exist in the same account and region as the DynamoDB table.
+  
+* `tableName` - (Required) The name of the DynamoDB table. There
+  can only be one Kinesis streaming destination for a given DynamoDB table.
+  
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The `tableName` and `streamArn` separated by a comma (`,`).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DynamoDB Kinesis Streaming Destinations using the `tableName` and `streamArn` separated by `,`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import DynamoDB Kinesis Streaming Destinations using the `tableName` and `streamArn` separated by `,`. For example:
+
+```console
+% terraform import aws_dynamodb_kinesis_streaming_destination.example example,arn:aws:kinesis:us-east-1:111122223333:exampleStreamName
+```
+
+<!-- cache-key: cdktf-0.18.0 input-d0a54894e87b04c66f4b0385516446c2240689109ec043bf93470658fee0ec34 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/dynamodb_table.html.markdown b/website/docs/cdktf/typescript/r/dynamodb_table.html.markdown
new file mode 100644
index 00000000000..da33b9516b8
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/dynamodb_table.html.markdown
@@ -0,0 +1,359 @@
+---
+subcategory: "DynamoDB"
+layout: "aws"
+page_title: "AWS: aws_dynamodb_table"
+description: |-
+  Provides a DynamoDB table resource
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_dynamodb_table
+
+Provides a DynamoDB table resource.
+
+~> **Note:** We recommend using `lifecycle` [`ignoreChanges`](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html#ignore_changes) for `readCapacity` and/or `writeCapacity` if there's [autoscaling policy](/docs/providers/aws/r/appautoscaling_policy.html) attached to the table.
+
+~> **Note:** When using [aws_dynamodb_table_replica](/docs/providers/aws/r/dynamodb_table_replica.html) with this resource, use `lifecycle` [`ignoreChanges`](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html#ignore_changes) for `replica`, _e.g._, `lifecycle { ignore_changes = [replica] }`.
+
+## DynamoDB Table attributes
+
+Only define attributes on the table object that are going to be used as:
+
+* Table hash key or range key
+* LSI or GSI hash key or range key
+
+The DynamoDB API expects attribute structure (name and type) to be passed along when creating or updating GSI/LSIs or creating the initial table. In these cases it expects the Hash / Range keys to be provided. Because these get re-used in numerous places (i.e the table's range key could be a part of one or more GSIs), they are stored on the table object to prevent duplication and increase consistency. If you add attributes here that are not used in these scenarios it can cause an infinite loop in planning.
+
+## Example Usage
+
+### Basic Example
+
+The following dynamodb table description models the table and GSI shown in the [AWS SDK example documentation](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/GSI.html)
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DynamodbTable } from "./.gen/providers/aws/dynamodb-table";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DynamodbTable(this, "basic-dynamodb-table", {
+      attribute: [
+        {
+          name: "UserId",
+          type: "S",
+        },
+        {
+          name: "GameTitle",
+          type: "S",
+        },
+        {
+          name: "TopScore",
+          type: "N",
+        },
+      ],
+      billingMode: "PROVISIONED",
+      globalSecondaryIndex: [
+        {
+          hashKey: "GameTitle",
+          name: "GameTitleIndex",
+          nonKeyAttributes: ["UserId"],
+          projectionType: "INCLUDE",
+          rangeKey: "TopScore",
+          readCapacity: 10,
+          writeCapacity: 10,
+        },
+      ],
+      hashKey: "UserId",
+      name: "GameScores",
+      rangeKey: "GameTitle",
+      readCapacity: 20,
+      tags: {
+        Environment: "production",
+        Name: "dynamodb-table-1",
+      },
+      ttl: {
+        attributeName: "TimeToExist",
+        enabled: false,
+      },
+      writeCapacity: 20,
+    });
+  }
+}
+
+```
+
+### Global Tables
+
+This resource implements support for [DynamoDB Global Tables V2 (version 2019.11.21)](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/globaltables.V2.html) via `replica` configuration blocks. For working with [DynamoDB Global Tables V1 (version 2017.11.29)](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/globaltables.V1.html), see the [`awsDynamodbGlobalTable` resource](/docs/providers/aws/r/dynamodb_global_table.html).
+
+~> **Note:** [aws_dynamodb_table_replica](/docs/providers/aws/r/dynamodb_table_replica.html) is an alternate way of configuring Global Tables. Do not use `replica` configuration blocks of `awsDynamodbTable` together with [aws_dynamodb_table_replica](/docs/providers/aws/r/dynamodb_table_replica.html).
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DynamodbTable } from "./.gen/providers/aws/dynamodb-table";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DynamodbTable(this, "example", {
+      attribute: [
+        {
+          name: "TestTableHashKey",
+          type: "S",
+        },
+      ],
+      billingMode: "PAY_PER_REQUEST",
+      hashKey: "TestTableHashKey",
+      name: "example",
+      replica: [
+        {
+          regionName: "us-east-2",
+        },
+        {
+          regionName: "us-west-2",
+        },
+      ],
+      streamEnabled: true,
+      streamViewType: "NEW_AND_OLD_IMAGES",
+    });
+  }
+}
+
+```
+
+### Replica Tagging
+
+You can manage global table replicas' tags in various ways. This example shows using `replica.*PropagateTags` for the first replica and the `awsDynamodbTag` resource for the other.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, Fn, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsRegion } from "./.gen/providers/aws/data-aws-region";
+import { DynamodbTable } from "./.gen/providers/aws/dynamodb-table";
+import { DynamodbTag } from "./.gen/providers/aws/dynamodb-tag";
+import { AwsProvider } from "./.gen/providers/aws/provider";
+import { AwsalternateProvider } from "./.gen/providers/awsalternate/provider";
+import { AwsthirdProvider } from "./.gen/providers/awsthird/provider";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    /*The following providers are missing schema information and might need manual adjustments to synthesize correctly: awsalternate, awsthird.
+    For a more precise conversion please use the --provider flag in convert.*/
+    new AwsProvider(this, "aws", {
+      region: "us-west-2",
+    });
+    new AwsalternateProvider(this, "awsalternate", {
+      region: "us-east-1",
+    });
+    new AwsthirdProvider(this, "awsthird", {
+      region: "us-east-2",
+    });
+    const alternate = new DataAwsRegion(this, "alternate", {
+      provider: "awsalternate",
+    });
+    const current = new DataAwsRegion(this, "current", {});
+    const third = new DataAwsRegion(this, "third", {
+      provider: "awsthird",
+    });
+    const example = new DynamodbTable(this, "example", {
+      attribute: [
+        {
+          name: "TestTableHashKey",
+          type: "S",
+        },
+      ],
+      billingMode: "PAY_PER_REQUEST",
+      hashKey: "TestTableHashKey",
+      name: "example-13281",
+      replica: [
+        {
+          regionName: Token.asString(alternate.name),
+        },
+        {
+          propagateTags: true,
+          regionName: Token.asString(third.name),
+        },
+      ],
+      streamEnabled: true,
+      streamViewType: "NEW_AND_OLD_IMAGES",
+      tags: {
+        Architect: "Eleanor",
+        Zone: "SW",
+      },
+    });
+    const awsDynamodbTagExample = new DynamodbTag(this, "example_7", {
+      key: "Architect",
+      resourceArn: Token.asString(
+        Fn.replace(
+          example.arn,
+          Token.asString(current.name),
+          Token.asString(alternate.name)
+        )
+      ),
+      value: "Gigi",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsDynamodbTagExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+Required arguments:
+
+* `attribute` - (Required) Set of nested attribute definitions. Only required for `hashKey` and `rangeKey` attributes. See below.
+* `hashKey` - (Required, Forces new resource) Attribute to use as the hash (partition) key. Must also be defined as an `attribute`. See below.
+* `name` - (Required) Unique within a region name of the table.
+
+Optional arguments:
+
+* `billingMode` - (Optional) Controls how you are charged for read and write throughput and how you manage capacity. The valid values are `provisioned` and `payPerRequest`. Defaults to `provisioned`.
+* `deletionProtectionEnabled` - (Optional) Enables deletion protection for table. Defaults to `false`.
+* `importTable` - (Optional) Import Amazon S3 data into a new table. See below.
+* `globalSecondaryIndex` - (Optional) Describe a GSI for the table; subject to the normal limits on the number of GSIs, projected attributes, etc. See below.
+* `localSecondaryIndex` - (Optional, Forces new resource) Describe an LSI on the table; these can only be allocated _at creation_ so you cannot change this definition after you have created the resource. See below.
+* `pointInTimeRecovery` - (Optional) Enable point-in-time recovery options. See below.
+* `rangeKey` - (Optional, Forces new resource) Attribute to use as the range (sort) key. Must also be defined as an `attribute`, see below.
+* `readCapacity` - (Optional) Number of read units for this table. If the `billingMode` is `provisioned`, this field is required.
+* `replica` - (Optional) Configuration block(s) with [DynamoDB Global Tables V2 (version 2019.11.21)](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/globaltables.V2.html) replication configurations. See below.
+* `restoreDateTime` - (Optional) Time of the point-in-time recovery point to restore.
+* `restoreSourceName` - (Optional) Name of the table to restore. Must match the name of an existing table.
+* `restoreToLatestTime` - (Optional) If set, restores table to the most recent point-in-time recovery point.
+* `serverSideEncryption` - (Optional) Encryption at rest options. AWS DynamoDB tables are automatically encrypted at rest with an AWS-owned Customer Master Key if this argument isn't specified. See below.
+* `streamEnabled` - (Optional) Whether Streams are enabled.
+* `streamViewType` - (Optional) When an item in the table is modified, StreamViewType determines what information is written to the table's stream. Valid values are `keysOnly`, `newImage`, `oldImage`, `newAndOldImages`.
+* `tableClass` - (Optional) Storage class of the table.
+  Valid values are `standard` and `standardInfrequentAccess`.
+  Default value is `standard`.
+* `tags` - (Optional) A map of tags to populate on the created table. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `ttl` - (Optional) Configuration block for TTL. See below.
+* `writeCapacity` - (Optional) Number of write units for this table. If the `billingMode` is `provisioned`, this field is required.
+
+### `attribute`
+
+* `name` - (Required) Name of the attribute
+* `type` - (Required) Attribute type. Valid values are `s` (string), `n` (number), `b` (binary).
+
+### `importTable`
+
+* `inputFormat` - (Required) The format of the source data. Valid values are `csv`, `dynamodbJson` and `ion`.
+* `s3BucketSource` - (Required) Values for the S3 bucket the source file is imported from. See below.
+* `clientToken` - (Optional) Makes the import idempotent, meaning that multiple identical calls have the same effect as one single call (8 hours validity).
+* `inputCompressionType` - (Optional) Type of compression to be used on the input coming from the imported table. Valid values are `gzip`, `zstd` and `none`.
+* `inputFormatOptions` - (Optional) Describe the format options for the data that was imported into the target table. There is one value, `csv`. See below.
+
+#### `inputFormatOptions`
+
+* `csv` - (Optional) This block contains the processing options for the CSV file being imported:
+    * `delimiter` - (Optional) The delimiter used for separating items in the CSV file being imported.
+    * `headerList` - (Optional) List of the headers used to specify a common header for all source CSV files being imported.
+
+#### `s3BucketSource`
+
+* `bucket` - (Required) The S3 bucket that is being imported from.
+* `bucketOwner`- (Optional) The account number of the S3 bucket that is being imported from.
+* `keyPrefix` - (Optional) The key prefix shared by all S3 Objects that are being imported.
+
+### `globalSecondaryIndex`
+
+* `hashKey` - (Required) Name of the hash key in the index; must be defined as an attribute in the resource.
+* `name` - (Required) Name of the index.
+* `nonKeyAttributes` - (Optional) Only required with `include` as a projection type; a list of attributes to project into the index. These do not need to be defined as attributes on the table.
+* `projectionType` - (Required) One of `all`, `include` or `keysOnly` where `all` projects every attribute into the index, `keysOnly` projects  into the index only the table and index hash_key and sort_key attributes ,  `include` projects into the index all of the attributes that are defined in `nonKeyAttributes` in addition to the attributes that that`keysOnly` project.
+* `rangeKey` - (Optional) Name of the range key; must be defined
+* `readCapacity` - (Optional) Number of read units for this index. Must be set if billing_mode is set to PROVISIONED.
+* `writeCapacity` - (Optional) Number of write units for this index. Must be set if billing_mode is set to PROVISIONED.
+
+### `localSecondaryIndex`
+
+* `name` - (Required) Name of the index
+* `nonKeyAttributes` - (Optional) Only required with `include` as a projection type; a list of attributes to project into the index. These do not need to be defined as attributes on the table.
+* `projectionType` - (Required) One of `all`, `include` or `keysOnly` where `all` projects every attribute into the index, `keysOnly` projects  into the index only the table and index hash_key and sort_key attributes ,  `include` projects into the index all of the attributes that are defined in `nonKeyAttributes` in addition to the attributes that that`keysOnly` project.
+* `rangeKey` - (Required) Name of the range key.
+
+### `pointInTimeRecovery`
+
+* `enabled` - (Required) Whether to enable point-in-time recovery. It can take 10 minutes to enable for new tables. If the `pointInTimeRecovery` block is not provided, this defaults to `false`.
+
+### `replica`
+
+* `kmsKeyArn` - (Optional, Forces new resource) ARN of the CMK that should be used for the AWS KMS encryption. This argument should only be used if the key is different from the default KMS-managed DynamoDB key, `alias/aws/dynamodb`. **Note:** This attribute will _not_ be populated with the ARN of _default_ keys.
+* `pointInTimeRecovery` - (Optional) Whether to enable Point In Time Recovery for the replica. Default is `false`.
+* `propagateTags` - (Optional) Whether to propagate the global table's tags to a replica. Default is `false`. Changes to tags only move in one direction: from global (source) to replica. In other words, tag drift on a replica will not trigger an update. Tag or replica changes on the global table, whether from drift or configuration changes, are propagated to replicas. Changing from `true` to `false` on a subsequent `apply` means replica tags are left as they were, unmanaged, not deleted.
+* `regionName` - (Required) Region name of the replica.
+
+### `serverSideEncryption`
+
+* `enabled` - (Required) Whether or not to enable encryption at rest using an AWS managed KMS customer master key (CMK). If `enabled` is `false` then server-side encryption is set to AWS-_owned_ key (shown as `default` in the AWS console). Potentially confusingly, if `enabled` is `true` and no `kmsKeyArn` is specified then server-side encryption is set to the _default_ KMS-_managed_ key (shown as `kms` in the AWS console). The [AWS KMS documentation](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html) explains the difference between AWS-_owned_ and KMS-_managed_ keys.
+* `kmsKeyArn` - (Optional) ARN of the CMK that should be used for the AWS KMS encryption. This argument should only be used if the key is different from the default KMS-managed DynamoDB key, `alias/aws/dynamodb`. **Note:** This attribute will _not_ be populated with the ARN of _default_ keys.
+
+### `ttl`
+
+* `enabled` - (Required) Whether TTL is enabled.
+* `attributeName` - (Required) Name of the table attribute to store the TTL timestamp in.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the table
+* `id` - Name of the table
+* `replica.*Arn` - ARN of the replica
+* `replica.*StreamArn` - ARN of the replica Table Stream. Only available when `stream_enabled = true`.
+* `replica.*StreamLabel` - Timestamp, in ISO 8601 format, for the replica stream. Note that this timestamp is not a unique identifier for the stream on its own. However, the combination of AWS customer ID, table name and this field is guaranteed to be unique. It can be used for creating CloudWatch Alarms. Only available when `stream_enabled = true`.
+* `streamArn` - ARN of the Table Stream. Only available when `stream_enabled = true`
+* `streamLabel` - Timestamp, in ISO 8601 format, for this stream. Note that this timestamp is not a unique identifier for the stream on its own. However, the combination of AWS customer ID, table name and this field is guaranteed to be unique. It can be used for creating CloudWatch Alarms. Only available when `stream_enabled = true`.
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+~> **Note:** There are a variety of default timeouts set internally. If you set a shorter custom timeout than one of the defaults, the custom timeout will not be respected as the longer of the custom or internal default will be used.
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `30M`)
+* `update` - (Default `60M`)
+* `delete` - (Default `10M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DynamoDB tables using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import DynamoDB tables using the `name`. For example:
+
+```console
+% terraform import aws_dynamodb_table.basic-dynamodb-table GameScores
+```
+
+<!-- cache-key: cdktf-0.18.0 input-331d28a11466721603dd7ef5ef376375b2685f617fa41cb89eac4c639b0b23d1 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/dynamodb_table_item.html.markdown b/website/docs/cdktf/typescript/r/dynamodb_table_item.html.markdown
new file mode 100644
index 00000000000..5bab68473ac
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/dynamodb_table_item.html.markdown
@@ -0,0 +1,80 @@
+---
+subcategory: "DynamoDB"
+layout: "aws"
+page_title: "AWS: aws_dynamodb_table_item"
+description: |-
+  Provides a DynamoDB table item resource
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_dynamodb_table_item
+
+Provides a DynamoDB table item resource
+
+-> **Note:** This resource is not meant to be used for managing large amounts of data in your table, it is not designed to scale.
+  You should perform **regular backups** of all data in the table, see [AWS docs for more](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/BackupRestore.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DynamodbTable } from "./.gen/providers/aws/dynamodb-table";
+import { DynamodbTableItem } from "./.gen/providers/aws/dynamodb-table-item";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new DynamodbTable(this, "example", {
+      attribute: [
+        {
+          name: "exampleHashKey",
+          type: "S",
+        },
+      ],
+      hashKey: "exampleHashKey",
+      name: "example-name",
+      readCapacity: 10,
+      writeCapacity: 10,
+    });
+    const awsDynamodbTableItemExample = new DynamodbTableItem(
+      this,
+      "example_1",
+      {
+        hashKey: example.hashKey,
+        item: '{\n  "exampleHashKey": {"S": "something"},\n  "one": {"N": "11111"},\n  "two": {"N": "22222"},\n  "three": {"N": "33333"},\n  "four": {"N": "44444"}\n}\n\n',
+        tableName: example.name,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsDynamodbTableItemExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+~> **Note:** Names included in `item` are represented internally with everything but letters removed. There is the possibility of collisions if two names, once filtered, are the same. For example, the names `yourNameHere` and `yournamehere` will overlap and cause an error.
+
+This argument supports the following arguments:
+
+* `hashKey` - (Required) Hash key to use for lookups and identification of the item
+* `item` - (Required) JSON representation of a map of attribute name/value pairs, one for each attribute. Only the primary key attributes are required; you can optionally provide other attribute name-value pairs for the item.
+* `rangeKey` - (Optional) Range key to use for lookups and identification of the item. Required if there is range key defined in the table.
+* `tableName` - (Required) Name of the table to contain the item.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+## Import
+
+You cannot import DynamoDB table items.
+
+<!-- cache-key: cdktf-0.18.0 input-6a024662e07162f55823fe5a6848f74b793eff6585ccc516e75fcbdfe573f734 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/dynamodb_table_replica.html.markdown b/website/docs/cdktf/typescript/r/dynamodb_table_replica.html.markdown
new file mode 100644
index 00000000000..0e389b64e68
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/dynamodb_table_replica.html.markdown
@@ -0,0 +1,136 @@
+---
+subcategory: "DynamoDB"
+layout: "aws"
+page_title: "AWS: aws_dynamodb_table_replica"
+description: |-
+  Provides a DynamoDB table replica resource
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_dynamodb_table_replica
+
+Provides a DynamoDB table replica resource for [DynamoDB Global Tables V2 (version 2019.11.21)](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/globaltables.V2.html).
+
+~> **Note:** Use `lifecycle` [`ignoreChanges`](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html#ignore_changes) for `replica` in the associated [aws_dynamodb_table](/docs/providers/aws/r/dynamodb_table.html) configuration.
+
+~> **Note:** Do not use the `replica` configuration block of [aws_dynamodb_table](/docs/providers/aws/r/dynamodb_table.html) together with this resource as the two configuration options are mutually exclusive.
+
+## Example Usage
+
+### Basic Example
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DynamodbTable } from "./.gen/providers/aws/dynamodb-table";
+import { DynamodbTableReplicaA } from "./.gen/providers/aws/dynamodb-table-replica";
+import { AwsProvider } from "./.gen/providers/aws/provider";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const main = new AwsProvider(this, "aws", {
+      alias: "main",
+      region: "us-west-2",
+    });
+    const alt = new AwsProvider(this, "aws_1", {
+      alias: "alt",
+      region: "us-east-2",
+    });
+    const example = new DynamodbTable(this, "example", {
+      attribute: [
+        {
+          name: "BrodoBaggins",
+          type: "S",
+        },
+      ],
+      billingMode: "PAY_PER_REQUEST",
+      hashKey: "BrodoBaggins",
+      lifecycle: {
+        ignoreChanges: [replica],
+      },
+      name: "TestTable",
+      provider: main,
+      streamEnabled: true,
+      streamViewType: "NEW_AND_OLD_IMAGES",
+    });
+    const awsDynamodbTableReplicaExample = new DynamodbTableReplicaA(
+      this,
+      "example_3",
+      {
+        globalTableArn: example.arn,
+        provider: alt,
+        tags: {
+          Name: "IZPAWS",
+          Pozo: "Amargo",
+        },
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsDynamodbTableReplicaExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+Required arguments:
+
+* `globalTableArn` - (Required) ARN of the _main_ or global table which this resource will replicate.
+
+Optional arguments:
+
+* `kmsKeyArn` - (Optional, Forces new resource) ARN of the CMK that should be used for the AWS KMS encryption. This argument should only be used if the key is different from the default KMS-managed DynamoDB key, `alias/aws/dynamodb`. **Note:** This attribute will _not_ be populated with the ARN of _default_ keys.
+* `pointInTimeRecovery` - (Optional) Whether to enable Point In Time Recovery for the replica. Default is `false`.
+* `tableClassOverride` - (Optional, Forces new resource) Storage class of the table replica. Valid values are `standard` and `standardInfrequentAccess`. If not used, the table replica will use the same class as the global table.
+* `tags` - (Optional) Map of tags to populate on the created table. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the table replica.
+* `id` - Name of the table and region of the main global table joined with a semicolon (_e.g._, `tableName:usEast1`).
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `30M`)
+* `update` - (Default `30M`)
+* `delete` - (Default `20M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DynamoDB table replicas using the `tableName:mainRegion`. For example:
+
+~> **Note:** When importing, use the region where the initial or _main_ global table resides, _not_ the region of the replica.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import DynamoDB table replicas using the `tableName:mainRegion`. For example:
+
+~> **Note:** When importing, use the region where the initial or _main_ global table resides, _not_ the region of the replica.
+
+```console
+% terraform import aws_dynamodb_table_replica.example TestTable:us-west-2
+```
+
+<!-- cache-key: cdktf-0.18.0 input-825c94d582679fcb249521e58e00123dba670a7f2f1b962c70bbd04b4762d01d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/dynamodb_tag.html.markdown b/website/docs/cdktf/typescript/r/dynamodb_tag.html.markdown
new file mode 100644
index 00000000000..f1fd0766a59
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/dynamodb_tag.html.markdown
@@ -0,0 +1,111 @@
+---
+subcategory: "DynamoDB"
+layout: "aws"
+page_title: "AWS: aws_dynamodb_tag"
+description: |-
+  Manages an individual DynamoDB resource tag
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_dynamodb_tag
+
+Manages an individual DynamoDB resource tag. This resource should only be used in cases where DynamoDB resources are created outside Terraform (e.g., Table replicas in other regions).
+
+~> **NOTE:** This tagging resource should not be combined with the Terraform resource for managing the parent resource. For example, using `awsDynamodbTable` and `awsDynamodbTag` to manage tags of the same DynamoDB Table in the same region will cause a perpetual difference where the `awsDynamodbCluster` resource will try to remove the tag being added by the `awsDynamodbTag` resource.
+
+~> **NOTE:** This tagging resource does not use the [provider `ignoreTags` configuration](/docs/providers/aws/index.html#ignore_tags).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, Fn, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsRegion } from "./.gen/providers/aws/data-aws-region";
+import { DynamodbTable } from "./.gen/providers/aws/dynamodb-table";
+import { DynamodbTag } from "./.gen/providers/aws/dynamodb-tag";
+import { AwsProvider } from "./.gen/providers/aws/provider";
+interface MyConfig {
+  name: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new AwsProvider(this, "aws", {
+      region: "us-west-2",
+    });
+    const replica = new AwsProvider(this, "aws_1", {
+      alias: "replica",
+      region: "us-east-1",
+    });
+    const current = new DataAwsRegion(this, "current", {});
+    const dataAwsRegionReplica = new DataAwsRegion(this, "replica", {
+      provider: replica,
+    });
+    const example = new DynamodbTable(this, "example", {
+      replica: [
+        {
+          regionName: Token.asString(dataAwsRegionReplica.name),
+        },
+      ],
+      name: config.name,
+    });
+    new DynamodbTag(this, "test", {
+      key: "testkey",
+      provider: replica,
+      resourceArn: Token.asString(
+        Fn.replace(
+          example.arn,
+          Token.asString(current.name),
+          Token.asString(dataAwsRegionReplica.name)
+        )
+      ),
+      value: "testvalue",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `resourceArn` - (Required) Amazon Resource Name (ARN) of the DynamoDB resource to tag.
+* `key` - (Required) Tag name.
+* `value` - (Required) Tag value.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - DynamoDB resource identifier and key, separated by a comma (`,`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsDynamodbTag` using the DynamoDB resource identifier and key, separated by a comma (`,`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsDynamodbTag` using the DynamoDB resource identifier and key, separated by a comma (`,`). For example:
+
+```console
+% terraform import aws_dynamodb_tag.example arn:aws:dynamodb:us-east-1:123456789012:table/example,Name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-75e8bd469b3a6122cab5fe6f134e77c1f13bdbca2f2645fd979c4c90c7684f40 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ebs_default_kms_key.html.markdown b/website/docs/cdktf/typescript/r/ebs_default_kms_key.html.markdown
new file mode 100644
index 00000000000..9587869ce82
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/ebs_default_kms_key.html.markdown
@@ -0,0 +1,76 @@
+---
+subcategory: "EBS (EC2)"
+layout: "aws"
+page_title: "AWS: aws_ebs_default_kms_key"
+description: |-
+  Manages the default customer master key (CMK) that your AWS account uses to encrypt EBS volumes.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ebs_default_kms_key
+
+Provides a resource to manage the default customer master key (CMK) that your AWS account uses to encrypt EBS volumes.
+
+Your AWS account has an AWS-managed default CMK that is used for encrypting an EBS volume when no CMK is specified in the API call that creates the volume.
+By using the `awsEbsDefaultKmsKey` resource, you can specify a customer-managed CMK to use in place of the AWS-managed default CMK.
+
+~> **NOTE:** Creating an `awsEbsDefaultKmsKey` resource does not enable default EBS encryption. Use the [`awsEbsEncryptionByDefault`](ebs_encryption_by_default.html) to enable default EBS encryption.
+
+~> **NOTE:** Destroying this resource will reset the default CMK to the account's AWS-managed default CMK for EBS.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EbsDefaultKmsKey } from "./.gen/providers/aws/ebs-default-kms-key";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new EbsDefaultKmsKey(this, "example", {
+      keyArn: Token.asString(awsKmsKeyExample.arn),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `keyArn` - (Required, ForceNew) The ARN of the AWS Key Management Service (AWS KMS) customer master key (CMK) to use to encrypt the EBS volume.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import the EBS default KMS CMK using the KMS key ARN. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import the EBS default KMS CMK using the KMS key ARN. For example:
+
+```console
+% terraform import aws_ebs_default_kms_key.example arn:aws:kms:us-east-1:123456789012:key/abcd-1234
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1b6624f3132e4695fc32d40d7c90ec4c11690a7b3a4758236262f116dc876595 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ebs_encryption_by_default.html.markdown b/website/docs/cdktf/typescript/r/ebs_encryption_by_default.html.markdown
new file mode 100644
index 00000000000..4bd239c48bd
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/ebs_encryption_by_default.html.markdown
@@ -0,0 +1,71 @@
+---
+subcategory: "EBS (EC2)"
+layout: "aws"
+page_title: "AWS: aws_ebs_encryption_by_default"
+description: |-
+  Manages whether default EBS encryption is enabled for your AWS account in the current AWS region.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ebs_encryption_by_default
+
+Provides a resource to manage whether default EBS encryption is enabled for your AWS account in the current AWS region. To manage the default KMS key for the region, see the [`awsEbsDefaultKmsKey` resource](/docs/providers/aws/r/ebs_default_kms_key.html).
+
+~> **NOTE:** Removing this Terraform resource disables default EBS encryption.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EbsEncryptionByDefault } from "./.gen/providers/aws/ebs-encryption-by-default";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new EbsEncryptionByDefault(this, "example", {
+      enabled: true,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `enabled` - (Optional) Whether or not default EBS encryption is enabled. Valid values are `true` or `false`. Defaults to `true`.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import the default EBS encryption state. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import the default EBS encryption state. For example:
+
+```console
+% terraform import aws_ebs_encryption_by_default.example default
+```
+
+<!-- cache-key: cdktf-0.18.0 input-26d56aaac9991ae4f8fb9772f7e16551e204f392912f72bea53feb7f7680cc3b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ebs_snapshot.html.markdown b/website/docs/cdktf/typescript/r/ebs_snapshot.html.markdown
new file mode 100644
index 00000000000..a923aabf0aa
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/ebs_snapshot.html.markdown
@@ -0,0 +1,103 @@
+---
+subcategory: "EBS (EC2)"
+layout: "aws"
+page_title: "AWS: aws_ebs_snapshot"
+description: |-
+  Provides an elastic block storage snapshot resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ebs_snapshot
+
+Creates a Snapshot of an EBS Volume.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EbsSnapshot } from "./.gen/providers/aws/ebs-snapshot";
+import { EbsVolume } from "./.gen/providers/aws/ebs-volume";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new EbsVolume(this, "example", {
+      availabilityZone: "us-west-2a",
+      size: 40,
+      tags: {
+        Name: "HelloWorld",
+      },
+    });
+    new EbsSnapshot(this, "example_snapshot", {
+      tags: {
+        Name: "HelloWorld_snap",
+      },
+      volumeId: example.id,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `volumeId` - (Required) The Volume ID of which to make a snapshot.
+* `description` - (Optional) A description of what the snapshot is.
+* `outpostArn` - (Optional) The Amazon Resource Name (ARN) of the Outpost on which to create a local snapshot.
+* `storageTier` - (Optional) The name of the storage tier. Valid values are `archive` and `standard`. Default value is `standard`.
+* `permanentRestore` - (Optional) Indicates whether to permanently restore an archived snapshot.
+* `temporaryRestoreDays` - (Optional) Specifies the number of days for which to temporarily restore an archived snapshot. Required for temporary restores only. The snapshot will be automatically re-archived after this period.
+* `tags` - (Optional) A map of tags to assign to the snapshot. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the EBS Snapshot.
+* `id` - The snapshot ID (e.g., snap-59fcb34e).
+* `ownerId` - The AWS account ID of the EBS snapshot owner.
+* `ownerAlias` - Value from an Amazon-maintained list (`amazon`, `awsMarketplace`, `microsoft`) of snapshot owners.
+* `encrypted` - Whether the snapshot is encrypted.
+* `volumeSize` - The size of the drive in GiBs.
+* `kmsKeyId` - The ARN for the KMS encryption key.
+* `dataEncryptionKeyId` - The data encryption key identifier for the snapshot.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `10M`)
+- `delete` - (Default `10M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EBS Snapshot using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import EBS Snapshot using the `id`. For example:
+
+```console
+% terraform import aws_ebs_snapshot.id snap-049df61146c4d7901
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1e7edd88fa309f9a2fbc01f16873ff7d886c948a085d015d286894010821fe01 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ebs_snapshot_copy.html.markdown b/website/docs/cdktf/typescript/r/ebs_snapshot_copy.html.markdown
new file mode 100644
index 00000000000..69030e0b726
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/ebs_snapshot_copy.html.markdown
@@ -0,0 +1,89 @@
+---
+subcategory: "EBS (EC2)"
+layout: "aws"
+page_title: "AWS: aws_ebs_snapshot_copy"
+description: |-
+  Duplicates an existing Amazon snapshot
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ebs_snapshot_copy
+
+Creates a Snapshot of a snapshot.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EbsSnapshot } from "./.gen/providers/aws/ebs-snapshot";
+import { EbsSnapshotCopy } from "./.gen/providers/aws/ebs-snapshot-copy";
+import { EbsVolume } from "./.gen/providers/aws/ebs-volume";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new EbsVolume(this, "example", {
+      availabilityZone: "us-west-2a",
+      size: 40,
+      tags: {
+        Name: "HelloWorld",
+      },
+    });
+    const exampleSnapshot = new EbsSnapshot(this, "example_snapshot", {
+      tags: {
+        Name: "HelloWorld_snap",
+      },
+      volumeId: example.id,
+    });
+    new EbsSnapshotCopy(this, "example_copy", {
+      sourceRegion: "us-west-2",
+      sourceSnapshotId: exampleSnapshot.id,
+      tags: {
+        Name: "HelloWorld_copy_snap",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `description` - (Optional) A description of what the snapshot is.
+* `encrypted` - Whether the snapshot is encrypted.
+* `kmsKeyId` - The ARN for the KMS encryption key.
+* `sourceSnapshotId` The ARN for the snapshot to be copied.
+* `sourceRegion` The region of the source snapshot.
+* `storageTier` - (Optional) The name of the storage tier. Valid values are `archive` and `standard`. Default value is `standard`.
+* `permanentRestore` - (Optional) Indicates whether to permanently restore an archived snapshot.
+* `temporaryRestoreDays` - (Optional) Specifies the number of days for which to temporarily restore an archived snapshot. Required for temporary restores only. The snapshot will be automatically re-archived after this period.
+* `tags` - A map of tags for the snapshot. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the EBS Snapshot.
+* `id` - The snapshot ID (e.g., snap-59fcb34e).
+* `ownerId` - The AWS account ID of the snapshot owner.
+* `ownerAlias` - Value from an Amazon-maintained list (`amazon`, `awsMarketplace`, `microsoft`) of snapshot owners.
+* `volumeSize` - The size of the drive in GiBs.
+* `dataEncryptionKeyId` - The data encryption key identifier for the snapshot.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `10M`)
+- `delete` - (Default `10M`)
+
+<!-- cache-key: cdktf-0.18.0 input-6584e150a20694a655473ad745eb449af2bb52af49f6c18028f8aa482965ddc1 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ebs_snapshot_import.html.markdown b/website/docs/cdktf/typescript/r/ebs_snapshot_import.html.markdown
new file mode 100644
index 00000000000..0261a55e67c
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/ebs_snapshot_import.html.markdown
@@ -0,0 +1,100 @@
+---
+subcategory: "EBS (EC2)"
+layout: "aws"
+page_title: "AWS: aws_ebs_snapshot_import"
+description: |-
+  Provides an elastic block storage snapshot import resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ebs_snapshot_import
+
+Imports a disk image from S3 as a Snapshot.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EbsSnapshotImport } from "./.gen/providers/aws/ebs-snapshot-import";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new EbsSnapshotImport(this, "example", {
+      diskContainer: {
+        format: "VHD",
+        userBucket: {
+          s3Bucket: "disk-images",
+          s3Key: "source.vhd",
+        },
+      },
+      roleName: "disk-image-import",
+      tags: {
+        Name: "HelloWorld",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `clientData` - (Optional) The client-specific data. Detailed below.
+* `description` - (Optional) The description string for the import snapshot task.
+* `diskContainer` - (Required) Information about the disk container. Detailed below.
+* `encrypted` - (Optional) Specifies whether the destination snapshot of the imported image should be encrypted. The default KMS key for EBS is used unless you specify a non-default KMS key using KmsKeyId.
+* `kmsKeyId` - (Optional) An identifier for the symmetric KMS key to use when creating the encrypted snapshot. This parameter is only required if you want to use a non-default KMS key; if this parameter is not specified, the default KMS key for EBS is used. If a KmsKeyId is specified, the Encrypted flag must also be set.
+* `storageTier` - (Optional) The name of the storage tier. Valid values are `archive` and `standard`. Default value is `standard`.
+* `permanentRestore` - (Optional) Indicates whether to permanently restore an archived snapshot.
+* `temporaryRestoreDays` - (Optional) Specifies the number of days for which to temporarily restore an archived snapshot. Required for temporary restores only. The snapshot will be automatically re-archived after this period.
+* `roleName` - (Optional) The name of the IAM Role the VM Import/Export service will assume. This role needs certain permissions. See https://docs.aws.amazon.com/vm-import/latest/userguide/vmie_prereqs.html#vmimport-role. Default: `vmimport`
+* `tags` - (Optional) A map of tags to assign to the snapshot.
+
+### client_data Configuration Block
+
+* `comment` - (Optional) A user-defined comment about the disk upload.
+* `uploadStart` - (Optional) The time that the disk upload starts.
+* `uploadEnd` - (Optional) The time that the disk upload ends.
+* `uploadSize` - (Optional) The size of the uploaded disk image, in GiB.
+
+### disk_container Configuration Block
+
+* `description` - (Optional) The description of the disk image being imported.
+* `format` - (Required) The format of the disk image being imported. One of `vhd` or `vmdk`.
+* `url` - (Optional) The URL to the Amazon S3-based disk image being imported. It can either be a https URL (https://..) or an Amazon S3 URL (s3://..). One of `url` or `userBucket` must be set.
+* `userBucket` - (Optional) The Amazon S3 bucket for the disk image. One of `url` or `userBucket` must be set. Detailed below.
+
+### user_bucket Configuration Block
+
+* `s3Bucket` - The name of the Amazon S3 bucket where the disk image is located.
+* `s3Key` - The file name of the disk image.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `60M`)
+- `delete` - (Default `10M`)
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the EBS Snapshot.
+* `id` - The snapshot ID (e.g., snap-59fcb34e).
+* `ownerId` - The AWS account ID of the EBS snapshot owner.
+* `ownerAlias` - Value from an Amazon-maintained list (`amazon`, `awsMarketplace`, `microsoft`) of snapshot owners.
+* `volumeSize` - The size of the drive in GiBs.
+* `dataEncryptionKeyId` - The data encryption key identifier for the snapshot.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+<!-- cache-key: cdktf-0.18.0 input-a913e99cf61c1c6954df7657480fc954e915e7e612a83eefbf5010e1f4fc479d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ebs_volume.html.markdown b/website/docs/cdktf/typescript/r/ebs_volume.html.markdown
new file mode 100644
index 00000000000..510d6135fef
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/ebs_volume.html.markdown
@@ -0,0 +1,100 @@
+---
+subcategory: "EBS (EC2)"
+layout: "aws"
+page_title: "AWS: aws_ebs_volume"
+description: |-
+  Provides an elastic block storage resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ebs_volume
+
+Manages a single EBS volume.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EbsVolume } from "./.gen/providers/aws/ebs-volume";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new EbsVolume(this, "example", {
+      availabilityZone: "us-west-2a",
+      size: 40,
+      tags: {
+        Name: "HelloWorld",
+      },
+    });
+  }
+}
+
+```
+
+~> **NOTE:** At least one of `size` or `snapshotId` is required when specifying an EBS volume
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `availabilityZone` - (Required) The AZ where the EBS volume will exist.
+* `encrypted` - (Optional) If true, the disk will be encrypted.
+* `finalSnapshot` - (Optional) If true, snapshot will be created before volume deletion. Any tags on the volume will be migrated to the snapshot. By default set to false
+* `iops` - (Optional) The amount of IOPS to provision for the disk. Only valid for `type` of `io1`, `io2` or `gp3`.
+* `multiAttachEnabled` - (Optional) Specifies whether to enable Amazon EBS Multi-Attach. Multi-Attach is supported on `io1` and `io2` volumes.
+* `size` - (Optional) The size of the drive in GiBs.
+* `snapshotId` (Optional) A snapshot to base the EBS volume off of.
+* `outpostArn` - (Optional) The Amazon Resource Name (ARN) of the Outpost.
+* `type` - (Optional) The type of EBS volume. Can be `standard`, `gp2`, `gp3`, `io1`, `io2`, `sc1` or `st1` (Default: `gp2`).
+* `kmsKeyId` - (Optional) The ARN for the KMS encryption key. When specifying `kmsKeyId`, `encrypted` needs to be set to true. Note: Terraform must be running with credentials which have the `generateDataKeyWithoutPlaintext` permission on the specified KMS key as required by the [EBS KMS CMK volume provisioning process](https://docs.aws.amazon.com/kms/latest/developerguide/services-ebs.html#ebs-cmk) to prevent a volume from being created and almost immediately deleted.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `throughput` - (Optional) The throughput that the volume supports, in MiB/s. Only valid for `type` of `gp3`.
+
+~> **NOTE:** When changing the `size`, `iops` or `type` of an instance, there are [considerations](http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/considerations.html) to be aware of.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The volume ID (e.g., vol-59fcb34e).
+* `arn` - The volume ARN (e.g., arn:aws:ec2:us-east-1:0123456789012:volume/vol-59fcb34e).
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `5M`)
+- `update` - (Default `5M`)
+- `delete` - (Default `5M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EBS Volumes using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import EBS Volumes using the `id`. For example:
+
+```console
+% terraform import aws_ebs_volume.id vol-049df61146c4d7901
+```
+
+<!-- cache-key: cdktf-0.18.0 input-92ec3ce7171663c1078ea136c38ae14a9544f626bf400bd2be9fd052c9a938d8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ec2_availability_zone_group.html.markdown b/website/docs/cdktf/typescript/r/ec2_availability_zone_group.html.markdown
index d85ad9d6400..2995cd0b726 100644
--- a/website/docs/cdktf/typescript/r/ec2_availability_zone_group.html.markdown
+++ b/website/docs/cdktf/typescript/r/ec2_availability_zone_group.html.markdown
@@ -6,6 +6,8 @@ description: |-
   Manages an EC2 Availability Zone Group.
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Resource: aws_ec2_availability_zone_group
 
 Manages an EC2 Availability Zone Group, such as updating its opt-in status.
@@ -15,15 +17,18 @@ Manages an EC2 Availability Zone Group, such as updating its opt-in status.
 ## Example Usage
 
 ```typescript
-import * as constructs from "constructs";
-import * as cdktf from "cdktf";
-/*Provider bindings are generated by running cdktf get.
-See https://cdk.tf/provider-generation for more details.*/
-import * as aws from "./.gen/providers/aws";
-class MyConvertedCode extends cdktf.TerraformStack {
-  constructor(scope: constructs.Construct, name: string) {
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Ec2AvailabilityZoneGroup } from "./.gen/providers/aws/ec2-availability-zone-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
     super(scope, name);
-    new aws.ec2AvailabilityZoneGroup.Ec2AvailabilityZoneGroup(this, "example", {
+    new Ec2AvailabilityZoneGroup(this, "example", {
       groupName: "us-west-2-lax-1",
       optInStatus: "opted-in",
     });
@@ -39,18 +44,32 @@ The following arguments are required:
 * `groupName` - (Required) Name of the Availability Zone Group.
 * `optInStatus` - (Required) Indicates whether to enable or disable Availability Zone Group. Valid values: `optedIn` or `notOptedIn`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Name of the Availability Zone Group.
 
 ## Import
 
-EC2 Availability Zone Groups can be imported using the group name, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EC2 Availability Zone Groups using the group name. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
 
 ```
-$ terraform import aws_ec2_availability_zone_group.example us-west-2-lax-1
+
+Using `terraform import`, import EC2 Availability Zone Groups using the group name. For example:
+
+```console
+% terraform import aws_ec2_availability_zone_group.example us-west-2-lax-1
 ```
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-ec04450e93feebc7cdb027063eaa1b76316b185dd8882c75d29821697f953592 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-473f003faaf663001178efaa8445c87b532a38c1e63d75f64ea2c7c9e3600f9b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ec2_capacity_reservation.html.markdown b/website/docs/cdktf/typescript/r/ec2_capacity_reservation.html.markdown
index cff3cff8264..4469bbade5e 100644
--- a/website/docs/cdktf/typescript/r/ec2_capacity_reservation.html.markdown
+++ b/website/docs/cdktf/typescript/r/ec2_capacity_reservation.html.markdown
@@ -6,6 +6,8 @@ description: |-
   Provides an EC2 Capacity Reservation. This allows you to reserve capacity for your Amazon EC2 instances in a specific Availability Zone for any duration.
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Resource: aws_ec2_capacity_reservation
 
 Provides an EC2 Capacity Reservation. This allows you to reserve capacity for your Amazon EC2 instances in a specific Availability Zone for any duration.
@@ -13,15 +15,18 @@ Provides an EC2 Capacity Reservation. This allows you to reserve capacity for yo
 ## Example Usage
 
 ```typescript
-import * as constructs from "constructs";
-import * as cdktf from "cdktf";
-/*Provider bindings are generated by running cdktf get.
-See https://cdk.tf/provider-generation for more details.*/
-import * as aws from "./.gen/providers/aws";
-class MyConvertedCode extends cdktf.TerraformStack {
-  constructor(scope: constructs.Construct, name: string) {
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Ec2CapacityReservation } from "./.gen/providers/aws/ec2-capacity-reservation";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
     super(scope, name);
-    new aws.ec2CapacityReservation.Ec2CapacityReservation(this, "default", {
+    new Ec2CapacityReservation(this, "default", {
       availabilityZone: "eu-west-1a",
       instanceCount: 1,
       instancePlatform: "Linux/UNIX",
@@ -34,7 +39,7 @@ class MyConvertedCode extends cdktf.TerraformStack {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `availabilityZone` - (Required) The Availability Zone in which to create the Capacity Reservation.
 * `ebsOptimized` - (Optional) Indicates whether the Capacity Reservation supports EBS-optimized instances.
@@ -50,9 +55,9 @@ The following arguments are supported:
 * `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 * `tenancy` - (Optional) Indicates the tenancy of the Capacity Reservation. Specify either `default` or `dedicated`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The Capacity Reservation ID.
 * `ownerId` - The ID of the AWS account that owns the Capacity Reservation.
@@ -61,10 +66,24 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Capacity Reservations can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Capacity Reservations using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
 
 ```
-$ terraform import aws_ec2_capacity_reservation.web cr-0123456789abcdef0
+
+Using `terraform import`, import Capacity Reservations using the `id`. For example:
+
+```console
+% terraform import aws_ec2_capacity_reservation.web cr-0123456789abcdef0
 ```
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-5de72e0a8199275fad3ad56e38ae6035b7b1ce0b96844b6338e061c1672a9bd9 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-93a356c14077d7db2f6957607bc33725d67bfe6e53d726dbffcc5d0f5f8dea86 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ec2_carrier_gateway.html.markdown b/website/docs/cdktf/typescript/r/ec2_carrier_gateway.html.markdown
index 6f25fe24500..527e43f492a 100644
--- a/website/docs/cdktf/typescript/r/ec2_carrier_gateway.html.markdown
+++ b/website/docs/cdktf/typescript/r/ec2_carrier_gateway.html.markdown
@@ -6,32 +6,47 @@ description: |-
   Manages an EC2 Carrier Gateway.
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Resource: aws_ec2_carrier_gateway
 
 Manages an EC2 Carrier Gateway. See the AWS [documentation](https://docs.aws.amazon.com/vpc/latest/userguide/Carrier_Gateway.html) for more information.
 
 ## Example Usage
 
-```terraform
-resource "aws_ec2_carrier_gateway" "example" {
-  vpc_id = aws_vpc.example.id
-
-  tags = {
-    Name = "example-carrier-gateway"
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Ec2CarrierGateway } from "./.gen/providers/aws/ec2-carrier-gateway";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Ec2CarrierGateway(this, "example", {
+      tags: {
+        Name: "example-carrier-gateway",
+      },
+      vpcId: Token.asString(awsVpcExample.id),
+    });
   }
 }
+
 ```
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 * `vpcId` - (Required) The ID of the VPC to associate with the carrier gateway.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The ARN of the carrier gateway.
 * `id` - The ID of the carrier gateway.
@@ -40,11 +55,24 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`awsEc2CarrierGateway` can be imported using the carrier gateway's ID,
-e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsEc2CarrierGateway` using the carrier gateway's ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
 
 ```
-$ terraform import aws_ec2_carrier_gateway.example cgw-12345
+
+Using `terraform import`, import `awsEc2CarrierGateway` using the carrier gateway's ID. For example:
+
+```console
+% terraform import aws_ec2_carrier_gateway.example cgw-12345
 ```
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-69fb2719765f13af292ecd34e9026074198e61b364e7f0845c2b65af0b9641db -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-9d4096fc983e6a4fb708311553dddf500634237507ba8f350eee35f1f925e85c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ec2_client_vpn_authorization_rule.html.markdown b/website/docs/cdktf/typescript/r/ec2_client_vpn_authorization_rule.html.markdown
index acc80488b16..53509fd691b 100644
--- a/website/docs/cdktf/typescript/r/ec2_client_vpn_authorization_rule.html.markdown
+++ b/website/docs/cdktf/typescript/r/ec2_client_vpn_authorization_rule.html.markdown
@@ -6,6 +6,8 @@ description: |-
   Provides authorization rules for AWS Client VPN endpoints.
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Resource: aws_ec2_client_vpn_authorization_rule
 
 Provides authorization rules for AWS Client VPN endpoints. For more information on usage, please see the
@@ -13,17 +15,31 @@ Provides authorization rules for AWS Client VPN endpoints. For more information
 
 ## Example Usage
 
-```terraform
-resource "aws_ec2_client_vpn_authorization_rule" "example" {
-  client_vpn_endpoint_id = aws_ec2_client_vpn_endpoint.example.id
-  target_network_cidr    = aws_subnet.example.cidr_block
-  authorize_all_groups   = true
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Ec2ClientVpnAuthorizationRule } from "./.gen/providers/aws/ec2-client-vpn-authorization-rule";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Ec2ClientVpnAuthorizationRule(this, "example", {
+      authorizeAllGroups: true,
+      clientVpnEndpointId: Token.asString(awsEc2ClientVpnEndpointExample.id),
+      targetNetworkCidr: Token.asString(awsSubnetExample.cidrBlock),
+    });
+  }
 }
+
 ```
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `clientVpnEndpointId` - (Required) The ID of the Client VPN endpoint.
 * `targetNetworkCidr` - (Required) The IPv4 address range, in CIDR notation, of the network to which the authorization rule applies.
@@ -31,9 +47,9 @@ The following arguments are supported:
 * `authorizeAllGroups` - (Optional) Indicates whether the authorization rule grants access to all clients. One of `accessGroupId` or `authorizeAllGroups` must be set.
 * `description` - (Optional) A brief description of the authorization rule.
 
-## Attributes Reference
+## Attribute Reference
 
-No additional attributes are exported.
+This resource exports no additional attributes.
 
 ## Timeouts
 
@@ -44,14 +60,48 @@ No additional attributes are exported.
 
 ## Import
 
-AWS Client VPN authorization rules can be imported using the endpoint ID and target network CIDR. If there is a specific group name that is included as well. All values are separated by a `,`.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AWS Client VPN authorization rules using the endpoint ID and target network CIDR. If there is a specific group name, include that also. All values are separated by a `,`. For example:
+
+Using the endpoint ID and target network CIDR:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
 
 ```
-$ terraform import aws_ec2_client_vpn_authorization_rule.example cvpn-endpoint-0ac3a1abbccddd666,10.1.0.0/24
+
+Using the endpoint ID, target network CIDR, and group name:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
 ```
 
+**Using `terraform import` to import** AWS Client VPN authorization rules using the endpoint ID and target network CIDR. If there is a specific group name, include that also. All values are separated by a `,`. For example:
+
+Using the endpoint ID and target network CIDR:
+
+```console
+% terraform import aws_ec2_client_vpn_authorization_rule.example cvpn-endpoint-0ac3a1abbccddd666,10.1.0.0/24
 ```
-$ terraform import aws_ec2_client_vpn_authorization_rule.example cvpn-endpoint-0ac3a1abbccddd666,10.1.0.0/24,team-a
+
+Using the endpoint ID, target network CIDR, and group name:
+
+```console
+% terraform import aws_ec2_client_vpn_authorization_rule.example cvpn-endpoint-0ac3a1abbccddd666,10.1.0.0/24,team-a
 ```
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-8993bda934e1c0dafea15ed7286e6454dd951b4e5ba094c102f6feb9fa0f98e0 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-9be9ac769186ff37ee1d96174a6329f4231687f8b5769f002ba41ebeea327607 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ec2_client_vpn_endpoint.html.markdown b/website/docs/cdktf/typescript/r/ec2_client_vpn_endpoint.html.markdown
index eff705144e8..80a6d363eab 100644
--- a/website/docs/cdktf/typescript/r/ec2_client_vpn_endpoint.html.markdown
+++ b/website/docs/cdktf/typescript/r/ec2_client_vpn_endpoint.html.markdown
@@ -6,6 +6,8 @@ description: |-
   Provides an AWS Client VPN endpoint for OpenVPN clients.
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Resource: aws_ec2_client_vpn_endpoint
 
 Provides an AWS Client VPN endpoint for OpenVPN clients. For more information on usage, please see the
@@ -13,28 +15,42 @@ Provides an AWS Client VPN endpoint for OpenVPN clients. For more information on
 
 ## Example Usage
 
-```terraform
-resource "aws_ec2_client_vpn_endpoint" "example" {
-  description            = "terraform-clientvpn-example"
-  server_certificate_arn = aws_acm_certificate.cert.arn
-  client_cidr_block      = "10.0.0.0/16"
-
-  authentication_options {
-    type                       = "certificate-authentication"
-    root_certificate_chain_arn = aws_acm_certificate.root_cert.arn
-  }
-
-  connection_log_options {
-    enabled               = true
-    cloudwatch_log_group  = aws_cloudwatch_log_group.lg.name
-    cloudwatch_log_stream = aws_cloudwatch_log_stream.ls.name
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Ec2ClientVpnEndpoint } from "./.gen/providers/aws/ec2-client-vpn-endpoint";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Ec2ClientVpnEndpoint(this, "example", {
+      authenticationOptions: [
+        {
+          rootCertificateChainArn: rootCert.arn,
+          type: "certificate-authentication",
+        },
+      ],
+      clientCidrBlock: "10.0.0.0/16",
+      connectionLogOptions: {
+        cloudwatchLogGroup: lg.name,
+        cloudwatchLogStream: ls.name,
+        enabled: true,
+      },
+      description: "terraform-clientvpn-example",
+      serverCertificateArn: cert.arn,
+    });
   }
 }
+
 ```
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `authenticationOptions` - (Required) Information about the authentication method to be used to authenticate clients.
 * `clientCidrBlock` - (Required) The IPv4 address range, in CIDR notation, from which to assign client IP addresses. The address range cannot overlap with the local CIDR of the VPC in which the associated subnet is located, or the routes that you add manually. The address range cannot be changed after the Client VPN endpoint has been created. The CIDR block should be /22 or greater.
@@ -81,21 +97,36 @@ One of the following arguments must be supplied:
 * `cloudwatchLogStream` - (Optional) The name of the CloudWatch Logs log stream to which the connection data is published.
 * `enabled` - (Required) Indicates whether connection logging is enabled.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The ARN of the Client VPN endpoint.
 * `dnsName` - The DNS name to be used by clients when establishing their VPN session.
 * `id` - The ID of the Client VPN endpoint.
+* `selfServicePortalUrl` - The URL of the self-service portal.
 * `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
 
 ## Import
 
-AWS Client VPN endpoints can be imported using the `id` value found via `aws ec2 describe-client-vpn-endpoints`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AWS Client VPN endpoints using the `id` value found via `aws ec2 describe-client-vpn-endpoints`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
 
 ```
-$ terraform import aws_ec2_client_vpn_endpoint.example cvpn-endpoint-0ac3a1abbccddd666
+
+Using `terraform import`, import AWS Client VPN endpoints using the `id` value found via `aws ec2 describe-client-vpn-endpoints`. For example:
+
+```console
+% terraform import aws_ec2_client_vpn_endpoint.example cvpn-endpoint-0ac3a1abbccddd666
 ```
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-a26501efa4c7174b2c2cb5dadf20d0288919ea642f95616bb9aaec5a718b6122 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-668469ff889101884cb8259cd8c05b2008ff8bae928811357f2cfcabe260d50a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ec2_client_vpn_network_association.html.markdown b/website/docs/cdktf/typescript/r/ec2_client_vpn_network_association.html.markdown
index 3aa5700d035..386d27b50f7 100644
--- a/website/docs/cdktf/typescript/r/ec2_client_vpn_network_association.html.markdown
+++ b/website/docs/cdktf/typescript/r/ec2_client_vpn_network_association.html.markdown
@@ -6,6 +6,8 @@ description: |-
   Provides network associations for AWS Client VPN endpoints.
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Resource: aws_ec2_client_vpn_network_association
 
 Provides network associations for AWS Client VPN endpoints. For more information on usage, please see the
@@ -13,23 +15,37 @@ Provides network associations for AWS Client VPN endpoints. For more information
 
 ## Example Usage
 
-```terraform
-resource "aws_ec2_client_vpn_network_association" "example" {
-  client_vpn_endpoint_id = aws_ec2_client_vpn_endpoint.example.id
-  subnet_id              = aws_subnet.example.id
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Ec2ClientVpnNetworkAssociation } from "./.gen/providers/aws/ec2-client-vpn-network-association";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Ec2ClientVpnNetworkAssociation(this, "example", {
+      clientVpnEndpointId: Token.asString(awsEc2ClientVpnEndpointExample.id),
+      subnetId: Token.asString(awsSubnetExample.id),
+    });
+  }
 }
+
 ```
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `clientVpnEndpointId` - (Required) The ID of the Client VPN endpoint.
 * `subnetId` - (Required) The ID of the subnet to associate with the Client VPN endpoint.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The unique ID of the target network association.
 * `associationId` - The unique ID of the target network association.
@@ -44,10 +60,24 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-AWS Client VPN network associations can be imported using the endpoint ID and the association ID. Values are separated by a `,`.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AWS Client VPN network associations using the endpoint ID and the association ID. Values are separated by a `,`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
 
 ```
-$ terraform import aws_ec2_client_vpn_network_association.example cvpn-endpoint-0ac3a1abbccddd666,vpn-assoc-0b8db902465d069ad
+
+Using `terraform import`, import AWS Client VPN network associations using the endpoint ID and the association ID. Values are separated by a `,`. For example:
+
+```console
+% terraform import aws_ec2_client_vpn_network_association.example cvpn-endpoint-0ac3a1abbccddd666,vpn-assoc-0b8db902465d069ad
 ```
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-4ee204844cf9a14e05461614c35d00163e0b5a2f0e0659277881ae5c05e91db9 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-93b06b3eb31b248a508f1acf81dceb795b39cf3f2e929e8af4cfbaad6365e994 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ec2_client_vpn_route.html.markdown b/website/docs/cdktf/typescript/r/ec2_client_vpn_route.html.markdown
index 41bf409c140..bc054baf70d 100644
--- a/website/docs/cdktf/typescript/r/ec2_client_vpn_route.html.markdown
+++ b/website/docs/cdktf/typescript/r/ec2_client_vpn_route.html.markdown
@@ -6,6 +6,8 @@ description: |-
   Provides additional routes for AWS Client VPN endpoints.
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Resource: aws_ec2_client_vpn_route
 
 Provides additional routes for AWS Client VPN endpoints. For more information on usage, please see the
@@ -13,46 +15,71 @@ Provides additional routes for AWS Client VPN endpoints. For more information on
 
 ## Example Usage
 
-```terraform
-resource "aws_ec2_client_vpn_route" "example" {
-  client_vpn_endpoint_id = aws_ec2_client_vpn_endpoint.example.id
-  destination_cidr_block = "0.0.0.0/0"
-  target_vpc_subnet_id   = aws_ec2_client_vpn_network_association.example.subnet_id
-}
-
-resource "aws_ec2_client_vpn_network_association" "example" {
-  client_vpn_endpoint_id = aws_ec2_client_vpn_endpoint.example.id
-  subnet_id              = aws_subnet.example.id
-}
-
-resource "aws_ec2_client_vpn_endpoint" "example" {
-  description            = "Example Client VPN endpoint"
-  server_certificate_arn = aws_acm_certificate.example.arn
-  client_cidr_block      = "10.0.0.0/16"
-
-  authentication_options {
-    type                       = "certificate-authentication"
-    root_certificate_chain_arn = aws_acm_certificate.example.arn
-  }
-
-  connection_log_options {
-    enabled = false
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Ec2ClientVpnEndpoint } from "./.gen/providers/aws/ec2-client-vpn-endpoint";
+import { Ec2ClientVpnNetworkAssociation } from "./.gen/providers/aws/ec2-client-vpn-network-association";
+import { Ec2ClientVpnRoute } from "./.gen/providers/aws/ec2-client-vpn-route";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new Ec2ClientVpnEndpoint(this, "example", {
+      authenticationOptions: [
+        {
+          rootCertificateChainArn: Token.asString(awsAcmCertificateExample.arn),
+          type: "certificate-authentication",
+        },
+      ],
+      clientCidrBlock: "10.0.0.0/16",
+      connectionLogOptions: {
+        enabled: false,
+      },
+      description: "Example Client VPN endpoint",
+      serverCertificateArn: Token.asString(awsAcmCertificateExample.arn),
+    });
+    const awsEc2ClientVpnNetworkAssociationExample =
+      new Ec2ClientVpnNetworkAssociation(this, "example_1", {
+        clientVpnEndpointId: example.id,
+        subnetId: Token.asString(awsSubnetExample.id),
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsEc2ClientVpnNetworkAssociationExample.overrideLogicalId("example");
+    const awsEc2ClientVpnRouteExample = new Ec2ClientVpnRoute(
+      this,
+      "example_2",
+      {
+        clientVpnEndpointId: example.id,
+        destinationCidrBlock: "0.0.0.0/0",
+        targetVpcSubnetId: Token.asString(
+          awsEc2ClientVpnNetworkAssociationExample.subnetId
+        ),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsEc2ClientVpnRouteExample.overrideLogicalId("example");
   }
 }
+
 ```
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `clientVpnEndpointId` - (Required) The ID of the Client VPN endpoint.
 * `destinationCidrBlock` - (Required) The IPv4 address range, in CIDR notation, of the route destination.
 * `description` - (Optional) A brief description of the route.
 * `targetVpcSubnetId` - (Required) The ID of the Subnet to route the traffic through. It must already be attached to the Client VPN.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the Client VPN endpoint.
 * `origin` - Indicates how the Client VPN route was added. Will be `addRoute` for routes created by this resource.
@@ -67,10 +94,24 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-AWS Client VPN routes can be imported using the endpoint ID, target subnet ID, and destination CIDR block. All values are separated by a `,`.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AWS Client VPN routes using the endpoint ID, target subnet ID, and destination CIDR block. All values are separated by a `,`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
 
 ```
-$ terraform import aws_ec2_client_vpn_route.example cvpn-endpoint-1234567890abcdef,subnet-9876543210fedcba,10.1.0.0/24
+
+Using `terraform import`, import AWS Client VPN routes using the endpoint ID, target subnet ID, and destination CIDR block. All values are separated by a `,`. For example:
+
+```console
+% terraform import aws_ec2_client_vpn_route.example cvpn-endpoint-1234567890abcdef,subnet-9876543210fedcba,10.1.0.0/24
 ```
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-ac5e35df38cbbdcd333467aae4b715320ea400fd110d67043d13b062d5c74b69 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-144efd2b6259f86199d398e7181456f408b908b3630ac4f3343668fe63a992b9 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ec2_fleet.html.markdown b/website/docs/cdktf/typescript/r/ec2_fleet.html.markdown
index 1a3f6c29677..43719965a78 100644
--- a/website/docs/cdktf/typescript/r/ec2_fleet.html.markdown
+++ b/website/docs/cdktf/typescript/r/ec2_fleet.html.markdown
@@ -6,31 +6,48 @@ description: |-
   Provides a resource to manage EC2 Fleets
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Resource: aws_ec2_fleet
 
 Provides a resource to manage EC2 Fleets.
 
 ## Example Usage
 
-```terraform
-resource "aws_ec2_fleet" "example" {
-  launch_template_config {
-    launch_template_specification {
-      launch_template_id = aws_launch_template.example.id
-      version            = aws_launch_template.example.latest_version
-    }
-  }
-
-  target_capacity_specification {
-    default_target_capacity_type = "spot"
-    total_target_capacity        = 5
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Ec2Fleet } from "./.gen/providers/aws/ec2-fleet";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Ec2Fleet(this, "example", {
+      launchTemplateConfig: [
+        {
+          launchTemplateSpecification: {
+            launchTemplateId: Token.asString(awsLaunchTemplateExample.id),
+            version: Token.asString(awsLaunchTemplateExample.latestVersion),
+          },
+        },
+      ],
+      targetCapacitySpecification: {
+        defaultTargetCapacityType: "spot",
+        totalTargetCapacity: 5,
+      },
+    });
   }
 }
+
 ```
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `context` - (Optional) Reserved.
 * `excessCapacityTerminationPolicy` - (Optional) Whether running instances should be terminated if the total target capacity of the EC2 Fleet is decreased below the current size of the EC2. Valid values: `noTermination`, `termination`. Defaults to `termination`. Supported only for fleets of type `maintain`.
@@ -67,24 +84,41 @@ Any parameters that you specify override the same parameters in the launch templ
 
 Example:
 
-```terraform
-resource "aws_ec2_fleet" "example" {
-  # ... other configuration ...
-
-  launch_template_config {
-    # ... other configuration ...
-
-    override {
-      instance_type     = "m4.xlarge"
-      weighted_capacity = 1
-    }
-
-    override {
-      instance_type     = "m4.2xlarge"
-      weighted_capacity = 2
-    }
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Ec2Fleet } from "./.gen/providers/aws/ec2-fleet";
+interface MyConfig {
+  targetCapacitySpecification: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new Ec2Fleet(this, "example", {
+      launchTemplateConfig: [
+        {
+          override: [
+            {
+              instanceType: "m4.xlarge",
+              weightedCapacity: 1,
+            },
+            {
+              instanceType: "m4.2xlarge",
+              weightedCapacity: 2,
+            },
+          ],
+        },
+      ],
+      targetCapacitySpecification: config.targetCapacitySpecification,
+    });
   }
 }
+
 ```
 
 * `availabilityZone` - (Optional) Availability Zone in which to launch the instances.
@@ -199,9 +233,9 @@ This configuration block supports the following:
 
 * `totalTargetCapacity` - (Required) The number of units to request, filled using `defaultTargetCapacityType`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Fleet identifier
 * `arn` - The ARN of the fleet
@@ -225,10 +259,24 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`awsEc2Fleet` can be imported by using the Fleet identifier, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsEc2Fleet` using the Fleet identifier. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
 
 ```
-$ terraform import aws_ec2_fleet.example fleet-b9b55d27-c5fc-41ac-a6f3-48fcc91f080c
+
+Using `terraform import`, import `awsEc2Fleet` using the Fleet identifier. For example:
+
+```console
+% terraform import aws_ec2_fleet.example fleet-b9b55d27-c5fc-41ac-a6f3-48fcc91f080c
 ```
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-fb56043e128df20faa90dd637acc56b7f555acaf2d82061066a1c5be1d60aa2d -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-c7054e3c8757a06c71fb64005ddb5aa34c48f993fd6eadf199635a28b3f099e7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ec2_host.html.markdown b/website/docs/cdktf/typescript/r/ec2_host.html.markdown
index 2036435dbc9..9d799866f9e 100644
--- a/website/docs/cdktf/typescript/r/ec2_host.html.markdown
+++ b/website/docs/cdktf/typescript/r/ec2_host.html.markdown
@@ -6,6 +6,8 @@ description: |-
   Provides an EC2 Host resource. This allows Dedicated Hosts to be allocated, modified, and released.
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Resource: aws_ec2_host
 
 Provides an EC2 Host resource. This allows Dedicated Hosts to be allocated, modified, and released.
@@ -13,15 +15,18 @@ Provides an EC2 Host resource. This allows Dedicated Hosts to be allocated, modi
 ## Example Usage
 
 ```typescript
-import * as constructs from "constructs";
-import * as cdktf from "cdktf";
-/*Provider bindings are generated by running cdktf get.
-See https://cdk.tf/provider-generation for more details.*/
-import * as aws from "./.gen/providers/aws";
-class MyConvertedCode extends cdktf.TerraformStack {
-  constructor(scope: constructs.Construct, name: string) {
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Ec2Host } from "./.gen/providers/aws/ec2-host";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
     super(scope, name);
-    new aws.ec2Host.Ec2Host(this, "test", {
+    new Ec2Host(this, "test", {
       autoPlacement: "on",
       availabilityZone: "us-west-2a",
       hostRecovery: "on",
@@ -34,8 +39,9 @@ class MyConvertedCode extends cdktf.TerraformStack {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
+* `assetId` - (Optional) The ID of the Outpost hardware asset on which to allocate the Dedicated Hosts. This parameter is supported only if you specify OutpostArn. If you are allocating the Dedicated Hosts in a Region, omit this parameter.
 * `autoPlacement` - (Optional) Indicates whether the host accepts any untargeted instance launches that match its instance type configuration, or if it only accepts Host tenancy instance launches that specify its unique host ID. Valid values: `on`, `off`. Default: `on`.
 * `availabilityZone` - (Required) The Availability Zone in which to allocate the Dedicated Host.
 * `hostRecovery` - (Optional) Indicates whether to enable or disable host recovery for the Dedicated Host. Valid values: `on`, `off`. Default: `off`.
@@ -44,9 +50,9 @@ The following arguments are supported:
 * `outpostArn` - (Optional) The Amazon Resource Name (ARN) of the AWS Outpost on which to allocate the Dedicated Host.
 * `tags` - (Optional) Map of tags to assign to this resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the allocated Dedicated Host. This is used to launch an instance onto a specific host.
 * `arn` - The ARN of the Dedicated Host.
@@ -55,10 +61,24 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Hosts can be imported using the host `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import hosts using the host `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
 
 ```
-$ terraform import aws_ec2_host.example h-0385a99d0e4b20cbb
+
+Using `terraform import`, import hosts using the host `id`. For example:
+
+```console
+% terraform import aws_ec2_host.example h-0385a99d0e4b20cbb
 ```
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-41c9a4bcef2bc29bfceae6876d0cd049e3590480296e3067c4b8334afc6193ff -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-7d7c66a25dca67846d4d6fca617b72c9903de5c7710e0dff44f2f8ae2633bebb -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ec2_image_block_public_access.markdown b/website/docs/cdktf/typescript/r/ec2_image_block_public_access.markdown
new file mode 100644
index 00000000000..840d6561a4f
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/ec2_image_block_public_access.markdown
@@ -0,0 +1,60 @@
+---
+subcategory: "EC2 (Elastic Compute Cloud)"
+layout: "aws"
+page_title: "AWS: aws_ec2_image_block_public_access"
+description: |-
+  Provides a regional public access block for AMIs. This prevents AMIs from being made publicly accessible.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ec2_image_block_public_access
+
+Provides a regional public access block for AMIs. This prevents AMIs from being made publicly accessible.
+If you already have public AMIs, they will remain publicly available.
+
+~> **NOTE:** Deleting this resource does not change the block public access value, the resource in simply removed from state instead.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Ec2ImageBlockPublicAccess } from "./.gen/providers/aws/ec2-image-block-public-access";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Ec2ImageBlockPublicAccess(this, "test", {
+      state: "block-new-sharing",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `state` - (Required) The state of block public access for AMIs at the account level in the configured AWS Region. Valid values: `unblocked` and `blockNewSharing`.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `update` - (Default `10M`)
+
+## Import
+
+You cannot import this resource.
+
+<!-- cache-key: cdktf-0.18.0 input-8368ec530535593c1f1e2aea209aa886960d23064815bc5ab871c21a27856e60 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ec2_instance_connect_endpoint.html.markdown b/website/docs/cdktf/typescript/r/ec2_instance_connect_endpoint.html.markdown
new file mode 100644
index 00000000000..8bad50b1b08
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/ec2_instance_connect_endpoint.html.markdown
@@ -0,0 +1,88 @@
+---
+subcategory: "EC2 (Elastic Compute Cloud)"
+layout: "aws"
+page_title: "AWS: aws_ec2_instance_connect_endpoint"
+description: |-
+  Provides an EC2 Instance Connect Endpoint resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ec2_instance_connect_endpoint
+
+Manages an EC2 Instance Connect Endpoint.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Ec2InstanceConnectEndpoint } from "./.gen/providers/aws/ec2-instance-connect-endpoint";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Ec2InstanceConnectEndpoint(this, "example", {
+      subnetId: Token.asString(awsSubnetExample.id),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `preserveClientIp` - (Optional) Indicates whether your client's IP address is preserved as the source. Default: `true`.
+* `securityGroupIds` - (Optional) One or more security groups to associate with the endpoint. If you don't specify a security group, the default security group for the VPC will be associated with the endpoint.
+* `subnetId` - (Required) The ID of the subnet in which to create the EC2 Instance Connect Endpoint.
+* `tags` - (Optional) Map of tags to assign to this resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `10M`)
+- `delete` - (Default `10M`)
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the EC2 Instance Connect Endpoint.
+* `availabilityZone` - The Availability Zone of the EC2 Instance Connect Endpoint.
+* `dnsName` - The DNS name of the EC2 Instance Connect Endpoint.
+* `fipsDnsName` - The DNS name of the EC2 Instance Connect FIPS Endpoint.
+* `networkInterfaceIds` - The IDs of the ENIs that Amazon EC2 automatically created when creating the EC2 Instance Connect Endpoint.
+* `ownerId` - The ID of the AWS account that created the EC2 Instance Connect Endpoint.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `vpcId` - The ID of the VPC in which the EC2 Instance Connect Endpoint was created.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EC2 Instance Connect Endpoints using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import EC2 Instance Connect Endpoints using the `id`. For example:
+
+```console
+% terraform import aws_ec2_instance_connect_endpoint.example eice-012345678
+```
+
+<!-- cache-key: cdktf-0.18.0 input-b6a7a4118c37b347c22b70a637e3a2dec2ab1a881d2fb350da6ffa550807522b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ec2_instance_state.html.markdown b/website/docs/cdktf/typescript/r/ec2_instance_state.html.markdown
index bb48123e169..97a9b705a51 100644
--- a/website/docs/cdktf/typescript/r/ec2_instance_state.html.markdown
+++ b/website/docs/cdktf/typescript/r/ec2_instance_state.html.markdown
@@ -6,6 +6,8 @@ description: |-
   Provides an EC2 instance state resource. This allows managing an instance power state. 
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Resource: aws_ec2_instance_state
 
 Provides an EC2 instance state resource. This allows managing an instance power state.
@@ -15,15 +17,20 @@ Provides an EC2 instance state resource. This allows managing an instance power
 ## Example Usage
 
 ```typescript
-import * as constructs from "constructs";
-import * as cdktf from "cdktf";
-/*Provider bindings are generated by running cdktf get.
-See https://cdk.tf/provider-generation for more details.*/
-import * as aws from "./.gen/providers/aws";
-class MyConvertedCode extends cdktf.TerraformStack {
-  constructor(scope: constructs.Construct, name: string) {
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsAmi } from "./.gen/providers/aws/data-aws-ami";
+import { Ec2InstanceState } from "./.gen/providers/aws/ec2-instance-state";
+import { Instance } from "./.gen/providers/aws/instance";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
     super(scope, name);
-    const dataAwsAmiUbuntu = new aws.dataAwsAmi.DataAwsAmi(this, "ubuntu", {
+    const ubuntu = new DataAwsAmi(this, "ubuntu", {
       filter: [
         {
           name: "name",
@@ -37,21 +44,17 @@ class MyConvertedCode extends cdktf.TerraformStack {
       mostRecent: true,
       owners: ["099720109477"],
     });
-    const awsInstanceTest = new aws.instance.Instance(this, "test", {
-      ami: cdktf.Token.asString(dataAwsAmiUbuntu.id),
+    const test = new Instance(this, "test", {
+      ami: Token.asString(ubuntu.id),
       instanceType: "t3.micro",
       tags: {
         Name: "HelloWorld",
       },
     });
-    const awsEc2InstanceStateTest = new aws.ec2InstanceState.Ec2InstanceState(
-      this,
-      "test_2",
-      {
-        instanceId: cdktf.Token.asString(awsInstanceTest.id),
-        state: "stopped",
-      }
-    );
+    const awsEc2InstanceStateTest = new Ec2InstanceState(this, "test_2", {
+      instanceId: test.id,
+      state: "stopped",
+    });
     /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
     awsEc2InstanceStateTest.overrideLogicalId("test");
   }
@@ -70,9 +73,9 @@ The following arguments are optional:
 
 * `force` - (Optional) Whether to request a forced stop when `state` is `stopped`. Otherwise (_i.e._, `state` is `running`), ignored. When an instance is forced to stop, it does not flush file system caches or file system metadata, and you must subsequently perform file system check and repair. Not recommended for Windows instances. Defaults to `false`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - ID of the instance (matches `instanceId`).
 
@@ -86,10 +89,24 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`awsEc2InstanceState` can be imported by using the `instanceId` attribute, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsEc2InstanceState` using the `instanceId` attribute. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
 
 ```
-$ terraform import aws_ec2_instance_state.test i-02cae6557dfcf2f96
+
+Using `terraform import`, import `awsEc2InstanceState` using the `instanceId` attribute. For example:
+
+```console
+% terraform import aws_ec2_instance_state.test i-02cae6557dfcf2f96
 ```
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-19c105887b99c9546865f82e4635edb9590d1b4933fa7a3973baeb84dbc5ce9c -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-55ec6962efa979f04735e3258bd738fd11e346e716880406215eee2600843353 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ec2_local_gateway_route.html.markdown b/website/docs/cdktf/typescript/r/ec2_local_gateway_route.html.markdown
index 28e1e07636b..fa67ced520a 100644
--- a/website/docs/cdktf/typescript/r/ec2_local_gateway_route.html.markdown
+++ b/website/docs/cdktf/typescript/r/ec2_local_gateway_route.html.markdown
@@ -6,18 +6,38 @@ description: |-
   Manages an EC2 Local Gateway Route
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Resource: aws_ec2_local_gateway_route
 
 Manages an EC2 Local Gateway Route. More information can be found in the [Outposts User Guide](https://docs.aws.amazon.com/outposts/latest/userguide/outposts-networking-components.html#routing).
 
 ## Example Usage
 
-```terraform
-resource "aws_ec2_local_gateway_route" "example" {
-  destination_cidr_block                   = "172.16.0.0/16"
-  local_gateway_route_table_id             = data.aws_ec2_local_gateway_route_table.example.id
-  local_gateway_virtual_interface_group_id = data.aws_ec2_local_gateway_virtual_interface_group.example.id
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Ec2LocalGatewayRoute } from "./.gen/providers/aws/ec2-local-gateway-route";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Ec2LocalGatewayRoute(this, "example", {
+      destinationCidrBlock: "172.16.0.0/16",
+      localGatewayRouteTableId: Token.asString(
+        dataAwsEc2LocalGatewayRouteTableExample.id
+      ),
+      localGatewayVirtualInterfaceGroupId: Token.asString(
+        dataAwsEc2LocalGatewayVirtualInterfaceGroupExample.id
+      ),
+    });
+  }
 }
+
 ```
 
 ## Argument Reference
@@ -28,18 +48,32 @@ The following arguments are required:
 * `localGatewayRouteTableId` - (Required) Identifier of EC2 Local Gateway Route Table.
 * `localGatewayVirtualInterfaceGroupId` - (Required) Identifier of EC2 Local Gateway Virtual Interface Group.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - EC2 Local Gateway Route Table identifier and destination CIDR block separated by underscores (`_`)
 
 ## Import
 
-`awsEc2LocalGatewayRoute` can be imported by using the EC2 Local Gateway Route Table identifier and destination CIDR block separated by underscores (`_`), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsEc2LocalGatewayRoute` using the EC2 Local Gateway Route Table identifier and destination CIDR block separated by underscores (`_`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
 
 ```
-$ terraform import aws_ec2_local_gateway_route.example lgw-rtb-12345678_172.16.0.0/16
+
+Using `terraform import`, import `awsEc2LocalGatewayRoute` using the EC2 Local Gateway Route Table identifier and destination CIDR block separated by underscores (`_`). For example:
+
+```console
+% terraform import aws_ec2_local_gateway_route.example lgw-rtb-12345678_172.16.0.0/16
 ```
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-1e91a283bb3d9d11b1b4699831f824ebe2b6e4d62ba4a95fea8fbf7e64228942 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-760f4fd810c3df45b557ef2e81d281f4a76d35aed253a5917f9f7fd6971b06b0 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ec2_local_gateway_route_table_vpc_association.html.markdown b/website/docs/cdktf/typescript/r/ec2_local_gateway_route_table_vpc_association.html.markdown
index c9c869c999f..a0451445eee 100644
--- a/website/docs/cdktf/typescript/r/ec2_local_gateway_route_table_vpc_association.html.markdown
+++ b/website/docs/cdktf/typescript/r/ec2_local_gateway_route_table_vpc_association.html.markdown
@@ -6,6 +6,8 @@ description: |-
   Manages an EC2 Local Gateway Route Table VPC Association
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Resource: aws_ec2_local_gateway_route_table_vpc_association
 
 Manages an EC2 Local Gateway Route Table VPC Association. More information can be found in the [Outposts User Guide](https://docs.aws.amazon.com/outposts/latest/userguide/outposts-local-gateways.html#vpc-associations).
@@ -13,39 +15,36 @@ Manages an EC2 Local Gateway Route Table VPC Association. More information can b
 ## Example Usage
 
 ```typescript
-import * as constructs from "constructs";
-import * as cdktf from "cdktf";
-/*Provider bindings are generated by running cdktf get.
-See https://cdk.tf/provider-generation for more details.*/
-import * as aws from "./.gen/providers/aws";
-class MyConvertedCode extends cdktf.TerraformStack {
-  constructor(scope: constructs.Construct, name: string) {
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsEc2LocalGatewayRouteTable } from "./.gen/providers/aws/data-aws-ec2-local-gateway-route-table";
+import { Ec2LocalGatewayRouteTableVpcAssociation } from "./.gen/providers/aws/ec2-local-gateway-route-table-vpc-association";
+import { Vpc } from "./.gen/providers/aws/vpc";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
     super(scope, name);
-    const awsVpcExample = new aws.vpc.Vpc(this, "example", {
+    const example = new Vpc(this, "example", {
       cidrBlock: "10.0.0.0/16",
     });
     const dataAwsEc2LocalGatewayRouteTableExample =
-      new aws.dataAwsEc2LocalGatewayRouteTable.DataAwsEc2LocalGatewayRouteTable(
-        this,
-        "example_1",
-        {
-          outpostArn:
-            "arn:aws:outposts:us-west-2:123456789012:outpost/op-1234567890abcdef",
-        }
-      );
+      new DataAwsEc2LocalGatewayRouteTable(this, "example_1", {
+        outpostArn:
+          "arn:aws:outposts:us-west-2:123456789012:outpost/op-1234567890abcdef",
+      });
     /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
     dataAwsEc2LocalGatewayRouteTableExample.overrideLogicalId("example");
     const awsEc2LocalGatewayRouteTableVpcAssociationExample =
-      new aws.ec2LocalGatewayRouteTableVpcAssociation.Ec2LocalGatewayRouteTableVpcAssociation(
-        this,
-        "example_2",
-        {
-          localGatewayRouteTableId: cdktf.Token.asString(
-            dataAwsEc2LocalGatewayRouteTableExample.id
-          ),
-          vpcId: cdktf.Token.asString(awsVpcExample.id),
-        }
-      );
+      new Ec2LocalGatewayRouteTableVpcAssociation(this, "example_2", {
+        localGatewayRouteTableId: Token.asString(
+          dataAwsEc2LocalGatewayRouteTableExample.id
+        ),
+        vpcId: example.id,
+      });
     /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
     awsEc2LocalGatewayRouteTableVpcAssociationExample.overrideLogicalId(
       "example"
@@ -66,19 +65,33 @@ The following arguments are optional:
 
 * `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Identifier of EC2 Local Gateway Route Table VPC Association.
 * `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
 
 ## Import
 
-`awsEc2LocalGatewayRouteTableVpcAssociation` can be imported by using the Local Gateway Route Table VPC Association identifier, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsEc2LocalGatewayRouteTableVpcAssociation` using the Local Gateway Route Table VPC Association identifier. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
 
 ```
-$ terraform import aws_ec2_local_gateway_route_table_vpc_association.example lgw-vpc-assoc-1234567890abcdef
+
+Using `terraform import`, import `awsEc2LocalGatewayRouteTableVpcAssociation` using the Local Gateway Route Table VPC Association identifier. For example:
+
+```console
+% terraform import aws_ec2_local_gateway_route_table_vpc_association.example lgw-vpc-assoc-1234567890abcdef
 ```
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-8a5ccaa440d2879afbbcfd1fd244061ead081eec60878025f40d64bfe098b7d2 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-f4f905dac47ee96e216b29234377003c85028f4754efe49a90ad2269ba720a64 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ec2_managed_prefix_list.html.markdown b/website/docs/cdktf/typescript/r/ec2_managed_prefix_list.html.markdown
index af7161ae114..578a9074a8d 100644
--- a/website/docs/cdktf/typescript/r/ec2_managed_prefix_list.html.markdown
+++ b/website/docs/cdktf/typescript/r/ec2_managed_prefix_list.html.markdown
@@ -6,6 +6,8 @@ description: |-
   Provides a managed prefix list resource.
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Resource: aws_ec2_managed_prefix_list
 
 Provides a managed prefix list resource.
@@ -26,31 +28,44 @@ as 20 rules for the security group.
 
 Basic usage
 
-```terraform
-resource "aws_ec2_managed_prefix_list" "example" {
-  name           = "All VPC CIDR-s"
-  address_family = "IPv4"
-  max_entries    = 5
-
-  entry {
-    cidr        = aws_vpc.example.cidr_block
-    description = "Primary"
-  }
-
-  entry {
-    cidr        = aws_vpc_ipv4_cidr_block_association.example.cidr_block
-    description = "Secondary"
-  }
-
-  tags = {
-    Env = "live"
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Ec2ManagedPrefixList } from "./.gen/providers/aws/ec2-managed-prefix-list";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Ec2ManagedPrefixList(this, "example", {
+      addressFamily: "IPv4",
+      entry: [
+        {
+          cidr: Token.asString(awsVpcExample.cidrBlock),
+          description: "Primary",
+        },
+        {
+          cidr: Token.asString(awsVpcIpv4CidrBlockAssociationExample.cidrBlock),
+          description: "Secondary",
+        },
+      ],
+      maxEntries: 5,
+      name: "All VPC CIDR-s",
+      tags: {
+        Env: "live",
+      },
+    });
   }
 }
+
 ```
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `addressFamily` - (Required, Forces new resource) Address family (`iPv4` or `iPv6`) of this prefix list.
 * `entry` - (Optional) Configuration block for prefix list entry. Detailed below. Different entries may have overlapping CIDR blocks, but a particular CIDR should not be duplicated.
@@ -63,9 +78,9 @@ The following arguments are supported:
 * `cidr` - (Required) CIDR block of this entry.
 * `description` - (Optional) Description of this entry. Due to API limitations, updating only the description of an existing entry requires temporarily removing and re-adding the entry.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the prefix list.
 * `id` - ID of the prefix list.
@@ -75,10 +90,24 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Prefix Lists can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Prefix Lists using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
 
 ```
-$ terraform import aws_ec2_managed_prefix_list.default pl-0570a1d2d725c16be
+
+Using `terraform import`, import Prefix Lists using the `id`. For example:
+
+```console
+% terraform import aws_ec2_managed_prefix_list.default pl-0570a1d2d725c16be
 ```
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-d03b2e2be51b11ee0de71dbcc39b429bde1f7958cc357946fd1044aa8a1f2a79 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-f31ae5e52895be9c6e214e756efedf3f324fec164272531bc7a2c04e0cb5b0ae -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ec2_managed_prefix_list_entry.html.markdown b/website/docs/cdktf/typescript/r/ec2_managed_prefix_list_entry.html.markdown
index 8dc5c9c2981..1bd7a0f060b 100644
--- a/website/docs/cdktf/typescript/r/ec2_managed_prefix_list_entry.html.markdown
+++ b/website/docs/cdktf/typescript/r/ec2_managed_prefix_list_entry.html.markdown
@@ -3,67 +3,88 @@ subcategory: "VPC (Virtual Private Cloud)"
 layout: "aws"
 page_title: "AWS: aws_ec2_managed_prefix_list_entry"
 description: |-
-  Provides a managed prefix list entry resource.
+  Use the `awsEc2ManagedPrefixListEntry` resource to manage a managed prefix list entry.
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Resource: aws_ec2_managed_prefix_list_entry
 
-Provides a managed prefix list entry resource.
+Use the `awsPrefixListEntry` resource to manage a managed prefix list entry.
 
-~> **NOTE on Managed Prefix Lists and Managed Prefix List Entries:** Terraform
-currently provides both a standalone Managed Prefix List Entry resource (a single entry),
-and a [Managed Prefix List resource](ec2_managed_prefix_list.html) with entries defined
-in-line. At this time you cannot use a Managed Prefix List with in-line rules in
-conjunction with any Managed Prefix List Entry resources. Doing so will cause a conflict
-of entries and will overwrite entries.
+~> **NOTE:** Terraform currently provides two resources for managing Managed Prefix Lists and Managed Prefix List Entries. The standalone resource, [Managed Prefix List Entry](ec2_managed_prefix_list_entry.html), is used to manage a single entry. The [Managed Prefix List resource](ec2_managed_prefix_list.html) is used to manage multiple entries defined in-line. It is important to note that you cannot use a Managed Prefix List with in-line rules in conjunction with any Managed Prefix List Entry resources. This will result in a conflict of entries and will cause the entries to be overwritten.
 
-~> **NOTE on Managed Prefix Lists with many entries:**  To improved execution times on larger
-updates, if you plan to create a prefix list with more than 100 entries, it is **recommended**
-that you use the inline `entry` block as part of the [Managed Prefix List resource](ec2_managed_prefix_list.html)
-resource instead.
+~> **NOTE:** To improve execution times on larger updates, it is recommended to use the inline `entry` block as part of the Managed Prefix List resource when creating a prefix list with more than 100 entries. You can find more information about the resource [here](ec2_managed_prefix_list.html).
 
 ## Example Usage
 
-Basic usage
-
-```terraform
-resource "aws_ec2_managed_prefix_list" "example" {
-  name           = "All VPC CIDR-s"
-  address_family = "IPv4"
-  max_entries    = 5
-
-  tags = {
-    Env = "live"
+Basic usage.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Ec2ManagedPrefixList } from "./.gen/providers/aws/ec2-managed-prefix-list";
+import { Ec2ManagedPrefixListEntryA } from "./.gen/providers/aws/ec2-managed-prefix-list-entry";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new Ec2ManagedPrefixList(this, "example", {
+      addressFamily: "IPv4",
+      maxEntries: 5,
+      name: "All VPC CIDR-s",
+      tags: {
+        Env: "live",
+      },
+    });
+    new Ec2ManagedPrefixListEntryA(this, "entry_1", {
+      cidr: Token.asString(awsVpcExample.cidrBlock),
+      description: "Primary",
+      prefixListId: example.id,
+    });
   }
 }
 
-resource "aws_ec2_managed_prefix_list_entry" "entry_1" {
-  cidr           = aws_vpc.example.cidr_block
-  description    = "Primary"
-  prefix_list_id = aws_ec2_managed_prefix_list.example.id
-}
 ```
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `cidr` - (Required) CIDR block of this entry.
-* `description` - (Optional) Description of this entry. Due to API limitations, updating only the description of an entry requires recreating the entry.
+* `description` - (Optional) Description of this entry. Please note that due to API limitations, updating only the description of an entry will require recreating the entry.
 * `prefixListId` - (Required) CIDR block of this entry.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - ID of the managed prefix list entry.
 
 ## Import
 
-Prefix List Entries can be imported using the `prefixListId` and `cidr` separated by a `,`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import prefix list entries using `prefixListId` and `cidr` separated by a comma (`,`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
 
 ```
-$ terraform import aws_ec2_managed_prefix_list_entry.default pl-0570a1d2d725c16be,10.0.3.0/24
+
+Using `terraform import`, import prefix list entries using `prefixListId` and `cidr` separated by a comma (`,`). For example:
+
+```console
+% terraform import aws_ec2_managed_prefix_list_entry.default pl-0570a1d2d725c16be,10.0.3.0/24
 ```
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-8044d9df33545e75bc4f855bebf836afa8d3e58985e94cca9f369fb466375d88 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-a95730eacb673234acf87d5fadae62c50b9ab8fba39c257ae0b77d4dc4586a17 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ec2_network_insights_analysis.html.markdown b/website/docs/cdktf/typescript/r/ec2_network_insights_analysis.html.markdown
index 151003b3057..706e6dfd792 100644
--- a/website/docs/cdktf/typescript/r/ec2_network_insights_analysis.html.markdown
+++ b/website/docs/cdktf/typescript/r/ec2_network_insights_analysis.html.markdown
@@ -6,22 +6,38 @@ description: |-
   Provides a Network Insights Analysis resource.
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Resource: aws_ec2_network_insights_analysis
 
 Provides a Network Insights Analysis resource. Part of the "Reachability Analyzer" service in the AWS VPC console.
 
 ## Example Usage
 
-```terraform
-resource "aws_ec2_network_insights_path" "path" {
-  source      = aws_network_interface.source.id
-  destination = aws_network_interface.destination.id
-  protocol    = "tcp"
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Ec2NetworkInsightsAnalysis } from "./.gen/providers/aws/ec2-network-insights-analysis";
+import { Ec2NetworkInsightsPath } from "./.gen/providers/aws/ec2-network-insights-path";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const path = new Ec2NetworkInsightsPath(this, "path", {
+      destination: destination.id,
+      protocol: "tcp",
+      source: source.id,
+    });
+    new Ec2NetworkInsightsAnalysis(this, "analysis", {
+      networkInsightsPathId: path.id,
+    });
+  }
 }
 
-resource "aws_ec2_network_insights_analysis" "analysis" {
-  network_insights_path_id = aws_ec2_network_insights_path.path.id
-}
 ```
 
 ## Argument Reference
@@ -36,9 +52,9 @@ The following arguments are optional:
 * `waitForCompletion` - (Optional) If enabled, the resource will wait for the Network Insights Analysis status to change to `succeeded` or `failed`. Setting this to `false` will skip the process. Default: `true`.
 * `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `alternatePathHints` - Potential intermediate components of a feasible path. Described below.
 * `arn` - ARN of the Network Insights Analysis.
@@ -60,10 +76,24 @@ The `alternatePathHints` object supports the following:
 
 ## Import
 
-Network Insights Analyses can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Network Insights Analyses using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
 
 ```
-$ terraform import aws_ec2_network_insights_analysis.test nia-0462085c957f11a55
+
+Using `terraform import`, import Network Insights Analyses using the `id`. For example:
+
+```console
+% terraform import aws_ec2_network_insights_analysis.test nia-0462085c957f11a55
 ```
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-6c52a3f45a5c53a101825e5d344e7a38516ecb14af919feddb6511f6632e0f4a -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-d364ed056c8c7e9f437f7a613d16d15bd1837a75ee3566f79b85669e4eb1f0d1 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ec2_network_insights_path.html.markdown b/website/docs/cdktf/typescript/r/ec2_network_insights_path.html.markdown
index db27bf3ed0b..acca58fae17 100644
--- a/website/docs/cdktf/typescript/r/ec2_network_insights_path.html.markdown
+++ b/website/docs/cdktf/typescript/r/ec2_network_insights_path.html.markdown
@@ -6,26 +6,42 @@ description: |-
   Provides a Network Insights Path resource.
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Resource: aws_ec2_network_insights_path
 
 Provides a Network Insights Path resource. Part of the "Reachability Analyzer" service in the AWS VPC console.
 
 ## Example Usage
 
-```terraform
-resource "aws_ec2_network_insights_path" "test" {
-  source      = aws_network_interface.source.id
-  destination = aws_network_interface.destination.id
-  protocol    = "tcp"
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Ec2NetworkInsightsPath } from "./.gen/providers/aws/ec2-network-insights-path";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Ec2NetworkInsightsPath(this, "test", {
+      destination: destination.id,
+      protocol: "tcp",
+      source: source.id,
+    });
+  }
 }
+
 ```
 
 ## Argument Reference
 
 The following arguments are required:
 
-* `source` - (Required) ID of the resource which is the source of the path. Can be an Instance, Internet Gateway, Network Interface, Transit Gateway, VPC Endpoint, VPC Peering Connection or VPN Gateway.
-* `destination` - (Required) ID of the resource which is the source of the path. Can be an Instance, Internet Gateway, Network Interface, Transit Gateway, VPC Endpoint, VPC Peering Connection or VPN Gateway.
+* `source` - (Required) ID or ARN of the resource which is the source of the path. Can be an Instance, Internet Gateway, Network Interface, Transit Gateway, VPC Endpoint, VPC Peering Connection or VPN Gateway. If the resource is in another account, you must specify an ARN.
+* `destination` - (Required) ID or ARN of the resource which is the destination of the path. Can be an Instance, Internet Gateway, Network Interface, Transit Gateway, VPC Endpoint, VPC Peering Connection or VPN Gateway. If the resource is in another account, you must specify an ARN.
 * `protocol` - (Required) Protocol to use for analysis. Valid options are `tcp` or `udp`.
 
 The following arguments are optional:
@@ -35,20 +51,36 @@ The following arguments are optional:
 * `destinationPort` - (Optional) Destination port to analyze access to.
 * `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the Network Insights Path.
+* `destinationArn` - ARN of the destination.
 * `id` - ID of the Network Insights Path.
+* `sourceArn` - ARN of the source.
 * `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
 
 ## Import
 
-Network Insights Paths can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Network Insights Paths using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
 
 ```
-$ terraform import aws_ec2_network_insights_path.test nip-00edfba169923aefd
+
+Using `terraform import`, import Network Insights Paths using the `id`. For example:
+
+```console
+% terraform import aws_ec2_network_insights_path.test nip-00edfba169923aefd
 ```
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-c926a6193628df8930deeb3e316583f9163e2d4f39989879768b5c0502ec2bc5 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-2d954457dd6558b313317ea2a62a029bb4f6b0f9fb109a2eff89ecd56e960d31 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ec2_serial_console_access.html.markdown b/website/docs/cdktf/typescript/r/ec2_serial_console_access.html.markdown
index e4778997a8d..14ebf865a8b 100644
--- a/website/docs/cdktf/typescript/r/ec2_serial_console_access.html.markdown
+++ b/website/docs/cdktf/typescript/r/ec2_serial_console_access.html.markdown
@@ -6,6 +6,8 @@ description: |-
   Manages whether serial console access is enabled for your AWS account in the current AWS region.
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Resource: aws_ec2_serial_console_access
 
 Provides a resource to manage whether serial console access is enabled for your AWS account in the current AWS region.
@@ -15,15 +17,18 @@ Provides a resource to manage whether serial console access is enabled for your
 ## Example Usage
 
 ```typescript
-import * as constructs from "constructs";
-import * as cdktf from "cdktf";
-/*Provider bindings are generated by running cdktf get.
-See https://cdk.tf/provider-generation for more details.*/
-import * as aws from "./.gen/providers/aws";
-class MyConvertedCode extends cdktf.TerraformStack {
-  constructor(scope: constructs.Construct, name: string) {
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Ec2SerialConsoleAccess } from "./.gen/providers/aws/ec2-serial-console-access";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
     super(scope, name);
-    new aws.ec2SerialConsoleAccess.Ec2SerialConsoleAccess(this, "example", {
+    new Ec2SerialConsoleAccess(this, "example", {
       enabled: true,
     });
   }
@@ -33,20 +38,34 @@ class MyConvertedCode extends cdktf.TerraformStack {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `enabled` - (Optional) Whether or not serial console access is enabled. Valid values are `true` or `false`. Defaults to `true`.
 
-## Attributes Reference
+## Attribute Reference
 
-No additional attributes are exported.
+This resource exports no additional attributes.
 
 ## Import
 
-Serial console access state can be imported, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import serial console access state. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
 
 ```
-$ terraform import aws_ec2_serial_console_access.example default
+
+Using `terraform import`, import serial console access state. For example:
+
+```console
+% terraform import aws_ec2_serial_console_access.example default
 ```
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-b3550eec1a2807a26834271d28b2d03e898cca3cd2a732d5d38c79ddf71181e6 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-a8751aa6eb0a3b96c3378b69be9c857d11be1b4723fc3142c82967475affbbbc -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ec2_subnet_cidr_reservation.html.markdown b/website/docs/cdktf/typescript/r/ec2_subnet_cidr_reservation.html.markdown
index 2047c1e5cf4..d03ee069dd2 100644
--- a/website/docs/cdktf/typescript/r/ec2_subnet_cidr_reservation.html.markdown
+++ b/website/docs/cdktf/typescript/r/ec2_subnet_cidr_reservation.html.markdown
@@ -6,42 +6,72 @@ description: |-
   Provides a subnet CIDR reservation resource.
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Resource: aws_ec2_subnet_cidr_reservation
 
 Provides a subnet CIDR reservation resource.
 
 ## Example Usage
 
-```terraform
-resource "aws_ec2_subnet_cidr_reservation" "example" {
-  cidr_block       = "10.0.0.16/28"
-  reservation_type = "prefix"
-  subnet_id        = aws_subnet.example.id
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Ec2SubnetCidrReservation } from "./.gen/providers/aws/ec2-subnet-cidr-reservation";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Ec2SubnetCidrReservation(this, "example", {
+      cidrBlock: "10.0.0.16/28",
+      reservationType: "prefix",
+      subnetId: Token.asString(awsSubnetExample.id),
+    });
+  }
 }
+
 ```
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `cidrBlock` - (Required) The CIDR block for the reservation.
 * `reservationType` - (Required) The type of reservation to create. Valid values: `explicit`, `prefix`
 * `subnetId` - (Required) The ID of the subnet to create the reservation for.
 * `description` - (Optional) A brief description of the reservation.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - ID of the CIDR reservation.
 * `ownerId` - ID of the AWS account that owns this CIDR reservation.
 
 ## Import
 
-Existing CIDR reservations can be imported using `subnetId:reservationId`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Existing CIDR reservations using `subnetId:reservationId`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
 
 ```
-$ terraform import aws_ec2_subnet_cidr_reservation.example subnet-01llsxvsxabqiymcz:scr-4mnvz6wb7otksjcs9
+
+Using `terraform import`, import Existing CIDR reservations using `subnetId:reservationId`. For example:
+
+```console
+% terraform import aws_ec2_subnet_cidr_reservation.example subnet-01llsxvsxabqiymcz:scr-4mnvz6wb7otksjcs9
 ```
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-068d78a5a45794a8e8dfb5699785f8dd8fbaf725814c393dab988a122183fd6d -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-fc461a33a61b61090347c3aebed74b1fbf423338d6a3082dc4e7dd5963cc132c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ec2_tag.html.markdown b/website/docs/cdktf/typescript/r/ec2_tag.html.markdown
index b928731433f..3b7954c9240 100644
--- a/website/docs/cdktf/typescript/r/ec2_tag.html.markdown
+++ b/website/docs/cdktf/typescript/r/ec2_tag.html.markdown
@@ -6,6 +6,8 @@ description: |-
   Manages an individual EC2 resource tag
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Resource: aws_ec2_tag
 
 Manages an individual EC2 resource tag. This resource should only be used in cases where EC2 resources are created outside Terraform (e.g., AMIs), being shared via Resource Access Manager (RAM), or implicitly created by other means (e.g., Transit Gateway VPN Attachments).
@@ -17,41 +19,42 @@ Manages an individual EC2 resource tag. This resource should only be used in cas
 ## Example Usage
 
 ```typescript
-import * as constructs from "constructs";
-import * as cdktf from "cdktf";
-/*Provider bindings are generated by running cdktf get.
-See https://cdk.tf/provider-generation for more details.*/
-import * as aws from "./.gen/providers/aws";
-class MyConvertedCode extends cdktf.TerraformStack {
-  constructor(scope: constructs.Construct, name: string) {
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CustomerGateway } from "./.gen/providers/aws/customer-gateway";
+import { Ec2Tag } from "./.gen/providers/aws/ec2-tag";
+import { Ec2TransitGateway } from "./.gen/providers/aws/ec2-transit-gateway";
+import { VpnConnection } from "./.gen/providers/aws/vpn-connection";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
     super(scope, name);
-    const awsCustomerGatewayExample = new aws.customerGateway.CustomerGateway(
+    const example = new CustomerGateway(this, "example", {
+      bgpAsn: Token.asString(65000),
+      ipAddress: "172.0.0.1",
+      type: "ipsec.1",
+    });
+    const awsEc2TransitGatewayExample = new Ec2TransitGateway(
       this,
-      "example",
-      {
-        bgpAsn: cdktf.Token.asString(65000),
-        ipAddress: "172.0.0.1",
-        type: "ipsec.1",
-      }
+      "example_1",
+      {}
     );
-    const awsEc2TransitGatewayExample =
-      new aws.ec2TransitGateway.Ec2TransitGateway(this, "example_1", {});
     /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
     awsEc2TransitGatewayExample.overrideLogicalId("example");
-    const awsVpnConnectionExample = new aws.vpnConnection.VpnConnection(
-      this,
-      "example_2",
-      {
-        customerGatewayId: cdktf.Token.asString(awsCustomerGatewayExample.id),
-        transitGatewayId: cdktf.Token.asString(awsEc2TransitGatewayExample.id),
-        type: cdktf.Token.asString(awsCustomerGatewayExample.type),
-      }
-    );
+    const awsVpnConnectionExample = new VpnConnection(this, "example_2", {
+      customerGatewayId: example.id,
+      transitGatewayId: Token.asString(awsEc2TransitGatewayExample.id),
+      type: example.type,
+    });
     /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
     awsVpnConnectionExample.overrideLogicalId("example");
-    const awsEc2TagExample = new aws.ec2Tag.Ec2Tag(this, "example_3", {
+    const awsEc2TagExample = new Ec2Tag(this, "example_3", {
       key: "Name",
-      resourceId: cdktf.Token.asString(
+      resourceId: Token.asString(
         awsVpnConnectionExample.transitGatewayAttachmentId
       ),
       value: "Hello World",
@@ -65,24 +68,38 @@ class MyConvertedCode extends cdktf.TerraformStack {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `resourceId` - (Required) The ID of the EC2 resource to manage the tag for.
 * `key` - (Required) The tag name.
 * `value` - (Required) The value of the tag.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - EC2 resource identifier and key, separated by a comma (`,`)
 
 ## Import
 
-`awsEc2Tag` can be imported by using the EC2 resource identifier and key, separated by a comma (`,`), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsEc2Tag` using the EC2 resource identifier and key, separated by a comma (`,`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
 
 ```
-$ terraform import aws_ec2_tag.example tgw-attach-1234567890abcdef,Name
+
+Using `terraform import`, import `awsEc2Tag` using the EC2 resource identifier and key, separated by a comma (`,`). For example:
+
+```console
+% terraform import aws_ec2_tag.example tgw-attach-1234567890abcdef,Name
 ```
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-a019f483855232814dd71801911c02977a3e810c118efe8f2670f5db055f687e -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-426f65492ad1473d61135571b53f491b7c40004b57450d752d563e20252feea5 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ec2_traffic_mirror_filter.html.markdown b/website/docs/cdktf/typescript/r/ec2_traffic_mirror_filter.html.markdown
index 8ede9b4237a..b748b5dbe6d 100644
--- a/website/docs/cdktf/typescript/r/ec2_traffic_mirror_filter.html.markdown
+++ b/website/docs/cdktf/typescript/r/ec2_traffic_mirror_filter.html.markdown
@@ -6,6 +6,8 @@ description: |-
   Provides an Traffic mirror filter
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Resource: aws_ec2_traffic_mirror_filter
 
 Provides an Traffic mirror filter.  
@@ -16,15 +18,18 @@ Read [limits and considerations](https://docs.aws.amazon.com/vpc/latest/mirrorin
 To create a basic traffic mirror filter
 
 ```typescript
-import * as constructs from "constructs";
-import * as cdktf from "cdktf";
-/*Provider bindings are generated by running cdktf get.
-See https://cdk.tf/provider-generation for more details.*/
-import * as aws from "./.gen/providers/aws";
-class MyConvertedCode extends cdktf.TerraformStack {
-  constructor(scope: constructs.Construct, name: string) {
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Ec2TrafficMirrorFilter } from "./.gen/providers/aws/ec2-traffic-mirror-filter";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
     super(scope, name);
-    new aws.ec2TrafficMirrorFilter.Ec2TrafficMirrorFilter(this, "foo", {
+    new Ec2TrafficMirrorFilter(this, "foo", {
       description: "traffic mirror filter - terraform example",
       networkServices: ["amazon-dns"],
     });
@@ -35,15 +40,15 @@ class MyConvertedCode extends cdktf.TerraformStack {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `description` - (Optional, Forces new resource) A description of the filter.
 * `networkServices` - (Optional) List of amazon network services that should be mirrored. Valid values: `amazonDns`.
 * `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The ARN of the traffic mirror filter.
 * `id` - The name of the filter.
@@ -51,10 +56,24 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Traffic mirror filter can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import traffic mirror filter using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
 
 ```
-$ terraform import aws_ec2_traffic_mirror_filter.foo tmf-0fbb93ddf38198f64
+
+Using `terraform import`, import traffic mirror filter using the `id`. For example:
+
+```console
+% terraform import aws_ec2_traffic_mirror_filter.foo tmf-0fbb93ddf38198f64
 ```
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-b7d0c8547ea5ec647a0886aad11141c27cca1006379ac82906bc6f26a46c5898 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-08ada8ec01a41a5d998f21a5946d9d4b579e2fe8c3ac968d45ecefd291cbd4c3 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ec2_traffic_mirror_filter_rule.html.markdown b/website/docs/cdktf/typescript/r/ec2_traffic_mirror_filter_rule.html.markdown
index 5a28fc21392..7bf381bb405 100644
--- a/website/docs/cdktf/typescript/r/ec2_traffic_mirror_filter_rule.html.markdown
+++ b/website/docs/cdktf/typescript/r/ec2_traffic_mirror_filter_rule.html.markdown
@@ -6,6 +6,8 @@ description: |-
   Provides an Traffic mirror filter rule
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Resource: aws_ec2_traffic_mirror_filter_rule
 
 Provides an Traffic mirror filter rule.  
@@ -16,58 +18,49 @@ Read [limits and considerations](https://docs.aws.amazon.com/vpc/latest/mirrorin
 To create a basic traffic mirror session
 
 ```typescript
-import * as constructs from "constructs";
-import * as cdktf from "cdktf";
-/*Provider bindings are generated by running cdktf get.
-See https://cdk.tf/provider-generation for more details.*/
-import * as aws from "./.gen/providers/aws";
-class MyConvertedCode extends cdktf.TerraformStack {
-  constructor(scope: constructs.Construct, name: string) {
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Ec2TrafficMirrorFilter } from "./.gen/providers/aws/ec2-traffic-mirror-filter";
+import { Ec2TrafficMirrorFilterRule } from "./.gen/providers/aws/ec2-traffic-mirror-filter-rule";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
     super(scope, name);
-    const awsEc2TrafficMirrorFilterFilter =
-      new aws.ec2TrafficMirrorFilter.Ec2TrafficMirrorFilter(this, "filter", {
-        description: "traffic mirror filter - terraform example",
-        networkServices: ["amazon-dns"],
-      });
-    new aws.ec2TrafficMirrorFilterRule.Ec2TrafficMirrorFilterRule(
-      this,
-      "rulein",
-      {
-        description: "test rule",
-        destinationCidrBlock: "10.0.0.0/8",
-        destinationPortRange: {
-          fromPort: 22,
-          toPort: 53,
-        },
-        protocol: 6,
-        ruleAction: "accept",
-        ruleNumber: 1,
-        sourceCidrBlock: "10.0.0.0/8",
-        sourcePortRange: {
-          fromPort: 0,
-          toPort: 10,
-        },
-        trafficDirection: "ingress",
-        trafficMirrorFilterId: cdktf.Token.asString(
-          awsEc2TrafficMirrorFilterFilter.id
-        ),
-      }
-    );
-    new aws.ec2TrafficMirrorFilterRule.Ec2TrafficMirrorFilterRule(
-      this,
-      "ruleout",
-      {
-        description: "test rule",
-        destinationCidrBlock: "10.0.0.0/8",
-        ruleAction: "accept",
-        ruleNumber: 1,
-        sourceCidrBlock: "10.0.0.0/8",
-        trafficDirection: "egress",
-        trafficMirrorFilterId: cdktf.Token.asString(
-          awsEc2TrafficMirrorFilterFilter.id
-        ),
-      }
-    );
+    const filter = new Ec2TrafficMirrorFilter(this, "filter", {
+      description: "traffic mirror filter - terraform example",
+      networkServices: ["amazon-dns"],
+    });
+    new Ec2TrafficMirrorFilterRule(this, "rulein", {
+      description: "test rule",
+      destinationCidrBlock: "10.0.0.0/8",
+      destinationPortRange: {
+        fromPort: 22,
+        toPort: 53,
+      },
+      protocol: 6,
+      ruleAction: "accept",
+      ruleNumber: 1,
+      sourceCidrBlock: "10.0.0.0/8",
+      sourcePortRange: {
+        fromPort: 0,
+        toPort: 10,
+      },
+      trafficDirection: "ingress",
+      trafficMirrorFilterId: filter.id,
+    });
+    new Ec2TrafficMirrorFilterRule(this, "ruleout", {
+      description: "test rule",
+      destinationCidrBlock: "10.0.0.0/8",
+      ruleAction: "accept",
+      ruleNumber: 1,
+      sourceCidrBlock: "10.0.0.0/8",
+      trafficDirection: "egress",
+      trafficMirrorFilterId: filter.id,
+    });
   }
 }
 
@@ -75,7 +68,7 @@ class MyConvertedCode extends cdktf.TerraformStack {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `description` - (Optional) Description of the traffic mirror filter rule.
 * `trafficMirrorFilterId`  - (Required) ID of the traffic mirror filter to which this rule should be added
@@ -93,19 +86,33 @@ Traffic mirror port range support following attributes:
 * `fromPort` - (Optional) Starting port of the range
 * `toPort` - (Optional) Ending port of the range
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the traffic mirror filter rule.
 * `id` - Name of the traffic mirror filter rule.
 
 ## Import
 
-Traffic mirror rules can be imported using the `trafficMirrorFilterId` and `id` separated by `:` e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import traffic mirror rules using the `trafficMirrorFilterId` and `id` separated by `:`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
 
 ```
-$ terraform import aws_ec2_traffic_mirror_filter_rule.rule tmf-0fbb93ddf38198f64:tmfr-05a458f06445d0aee
+
+Using `terraform import`, import traffic mirror rules using the `trafficMirrorFilterId` and `id` separated by `:`. For example:
+
+```console
+% terraform import aws_ec2_traffic_mirror_filter_rule.rule tmf-0fbb93ddf38198f64:tmfr-05a458f06445d0aee
 ```
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-ee0ef6357eca144bbb3215244fe80128101015d1bdebdadc916196862d53f340 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-ee8ae70ab3b42d0c264494b7dc21ff8f9e48c2c41596a2bf47513cd2380b21c6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ec2_traffic_mirror_session.html.markdown b/website/docs/cdktf/typescript/r/ec2_traffic_mirror_session.html.markdown
index deed6b09f89..fc6113c19fa 100644
--- a/website/docs/cdktf/typescript/r/ec2_traffic_mirror_session.html.markdown
+++ b/website/docs/cdktf/typescript/r/ec2_traffic_mirror_session.html.markdown
@@ -6,6 +6,8 @@ description: |-
   Provides a Traffic mirror session
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Resource: aws_ec2_traffic_mirror_session
 
 Provides an Traffic mirror session.  
@@ -15,28 +17,42 @@ Read [limits and considerations](https://docs.aws.amazon.com/vpc/latest/mirrorin
 
 To create a basic traffic mirror session
 
-```terraform
-resource "aws_ec2_traffic_mirror_filter" "filter" {
-  description      = "traffic mirror filter - terraform example"
-  network_services = ["amazon-dns"]
-}
-
-resource "aws_ec2_traffic_mirror_target" "target" {
-  network_load_balancer_arn = aws_lb.lb.arn
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Ec2TrafficMirrorFilter } from "./.gen/providers/aws/ec2-traffic-mirror-filter";
+import { Ec2TrafficMirrorSession } from "./.gen/providers/aws/ec2-traffic-mirror-session";
+import { Ec2TrafficMirrorTarget } from "./.gen/providers/aws/ec2-traffic-mirror-target";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const filter = new Ec2TrafficMirrorFilter(this, "filter", {
+      description: "traffic mirror filter - terraform example",
+      networkServices: ["amazon-dns"],
+    });
+    const target = new Ec2TrafficMirrorTarget(this, "target", {
+      networkLoadBalancerArn: lb.arn,
+    });
+    new Ec2TrafficMirrorSession(this, "session", {
+      description: "traffic mirror session - terraform example",
+      networkInterfaceId: test.primaryNetworkInterfaceId,
+      sessionNumber: 1,
+      trafficMirrorFilterId: filter.id,
+      trafficMirrorTargetId: target.id,
+    });
+  }
 }
 
-resource "aws_ec2_traffic_mirror_session" "session" {
-  description              = "traffic mirror session - terraform example"
-  network_interface_id     = aws_instance.test.primary_network_interface_id
-  session_number           = 1
-  traffic_mirror_filter_id = aws_ec2_traffic_mirror_filter.filter.id
-  traffic_mirror_target_id = aws_ec2_traffic_mirror_target.target.id
-}
 ```
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `description` - (Optional) A description of the traffic mirror session.
 * `networkInterfaceId` - (Required, Forces new) ID of the source network interface. Not all network interfaces are eligible as mirror sources. On EC2 instances only nitro based instances support mirroring.
@@ -47,9 +63,9 @@ The following arguments are supported:
 * `virtualNetworkId` - (Optional) - The VXLAN ID for the Traffic Mirror session. For more information about the VXLAN protocol, see RFC 7348. If you do not specify a VirtualNetworkId, an account-wide unique id is chosen at random.
 * `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The ARN of the traffic mirror session.
 * `id` - The name of the session.
@@ -58,10 +74,24 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Traffic mirror sessions can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import traffic mirror sessions using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
 
 ```
-$ terraform import aws_ec2_traffic_mirror_session.session tms-0d8aa3ca35897b82e
+
+Using `terraform import`, import traffic mirror sessions using the `id`. For example:
+
+```console
+% terraform import aws_ec2_traffic_mirror_session.session tms-0d8aa3ca35897b82e
 ```
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-5670ce5560910952c3933c8ed7317f718ceb01dc8d39fc7495f64601c87b72c4 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-bebf9726dbd8427c2549afe146e9559250616ce6b54593bc2d8e49757985351e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ec2_traffic_mirror_target.html.markdown b/website/docs/cdktf/typescript/r/ec2_traffic_mirror_target.html.markdown
index a1f502299e1..e8838b4d0a2 100644
--- a/website/docs/cdktf/typescript/r/ec2_traffic_mirror_target.html.markdown
+++ b/website/docs/cdktf/typescript/r/ec2_traffic_mirror_target.html.markdown
@@ -6,6 +6,8 @@ description: |-
   Provides a Traffic mirror target
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Resource: aws_ec2_traffic_mirror_target
 
 Provides a Traffic mirror target.  
@@ -15,26 +17,38 @@ Read [limits and considerations](https://docs.aws.amazon.com/vpc/latest/mirrorin
 
 To create a basic traffic mirror session
 
-```terraform
-resource "aws_ec2_traffic_mirror_target" "nlb" {
-  description               = "NLB target"
-  network_load_balancer_arn = aws_lb.lb.arn
-}
-
-resource "aws_ec2_traffic_mirror_target" "eni" {
-  description          = "ENI target"
-  network_interface_id = aws_instance.test.primary_network_interface_id
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Ec2TrafficMirrorTarget } from "./.gen/providers/aws/ec2-traffic-mirror-target";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Ec2TrafficMirrorTarget(this, "eni", {
+      description: "ENI target",
+      networkInterfaceId: test.primaryNetworkInterfaceId,
+    });
+    new Ec2TrafficMirrorTarget(this, "gwlb", {
+      description: "GWLB target",
+      gatewayLoadBalancerEndpointId: example.id,
+    });
+    new Ec2TrafficMirrorTarget(this, "nlb", {
+      description: "NLB target",
+      networkLoadBalancerArn: lb.arn,
+    });
+  }
 }
 
-resource "aws_ec2_traffic_mirror_target" "gwlb" {
-  description                       = "GWLB target"
-  gateway_load_balancer_endpoint_id = aws_vpc_endpoint.example.id
-}
 ```
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `description` - (Optional, Forces new) A description of the traffic mirror session.
 * `networkInterfaceId` - (Optional, Forces new) The network interface ID that is associated with the target.
@@ -44,9 +58,9 @@ The following arguments are supported:
 
 **NOTE:** Either `networkInterfaceId` or `networkLoadBalancerArn` should be specified and both should not be specified together
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the Traffic Mirror target.
 * `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
@@ -55,10 +69,24 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Traffic mirror targets can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import traffic mirror targets using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
 
 ```
-$ terraform import aws_ec2_traffic_mirror_target.target tmt-0c13a005422b86606
+
+Using `terraform import`, import traffic mirror targets using the `id`. For example:
+
+```console
+% terraform import aws_ec2_traffic_mirror_target.target tmt-0c13a005422b86606
 ```
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-992368b8db2722ef4cf35e5d727bab897b351724752b8e15f51ad89877879f51 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-0dcea120206f78ae4bab492b768957fc04e77c30670fd1496757b5d3a63f1ae0 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ec2_transit_gateway.html.markdown b/website/docs/cdktf/typescript/r/ec2_transit_gateway.html.markdown
index e073514f633..a2d84192aa1 100644
--- a/website/docs/cdktf/typescript/r/ec2_transit_gateway.html.markdown
+++ b/website/docs/cdktf/typescript/r/ec2_transit_gateway.html.markdown
@@ -6,6 +6,8 @@ description: |-
   Manages an EC2 Transit Gateway
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Resource: aws_ec2_transit_gateway
 
 Manages an EC2 Transit Gateway.
@@ -13,15 +15,18 @@ Manages an EC2 Transit Gateway.
 ## Example Usage
 
 ```typescript
-import * as constructs from "constructs";
-import * as cdktf from "cdktf";
-/*Provider bindings are generated by running cdktf get.
-See https://cdk.tf/provider-generation for more details.*/
-import * as aws from "./.gen/providers/aws";
-class MyConvertedCode extends cdktf.TerraformStack {
-  constructor(scope: constructs.Construct, name: string) {
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Ec2TransitGateway } from "./.gen/providers/aws/ec2-transit-gateway";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
     super(scope, name);
-    new aws.ec2TransitGateway.Ec2TransitGateway(this, "example", {
+    new Ec2TransitGateway(this, "example", {
       description: "example",
     });
   }
@@ -31,7 +36,7 @@ class MyConvertedCode extends cdktf.TerraformStack {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `amazonSideAsn` - (Optional) Private Autonomous System Number (ASN) for the Amazon side of a BGP session. The range is `64512` to `65534` for 16-bit ASNs and `4200000000` to `4294967294` for 32-bit ASNs. Default value: `64512`.
 
@@ -47,9 +52,9 @@ The following arguments are supported:
 * `transitGatewayCidrBlocks` - (Optional) One or more IPv4 or IPv6 CIDR blocks for the transit gateway. Must be a size /24 CIDR block or larger for IPv4, or a size /64 CIDR block or larger for IPv6.
 * `vpnEcmpSupport` - (Optional) Whether VPN Equal Cost Multipath Protocol support is enabled. Valid values: `disable`, `enable`. Default value: `enable`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - EC2 Transit Gateway Amazon Resource Name (ARN)
 * `associationDefaultRouteTableId` - Identifier of the default association route table
@@ -68,10 +73,24 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`awsEc2TransitGateway` can be imported by using the EC2 Transit Gateway identifier, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsEc2TransitGateway` using the EC2 Transit Gateway identifier. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
 
 ```
-$ terraform import aws_ec2_transit_gateway.example tgw-12345678
+
+Using `terraform import`, import `awsEc2TransitGateway` using the EC2 Transit Gateway identifier. For example:
+
+```console
+% terraform import aws_ec2_transit_gateway.example tgw-12345678
 ```
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-6e48757e816afbbf68b47d7e2d67bd6065154cade25b443bde58088cdd10f4a1 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-8abb713f19097861ce297d1a598e2ebacc47c1a42889776410c75cd929a248ea -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ec2_transit_gateway_connect.html.markdown b/website/docs/cdktf/typescript/r/ec2_transit_gateway_connect.html.markdown
index 59e486de9a5..ba1b0290843 100644
--- a/website/docs/cdktf/typescript/r/ec2_transit_gateway_connect.html.markdown
+++ b/website/docs/cdktf/typescript/r/ec2_transit_gateway_connect.html.markdown
@@ -6,39 +6,55 @@ description: |-
   Manages an EC2 Transit Gateway Connect
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Resource: aws_ec2_transit_gateway_connect
 
 Manages an EC2 Transit Gateway Connect.
 
 ## Example Usage
 
-```terraform
-resource "aws_ec2_transit_gateway_vpc_attachment" "example" {
-  subnet_ids         = [aws_subnet.example.id]
-  transit_gateway_id = aws_ec2_transit_gateway.example.id
-  vpc_id             = aws_vpc.example.id
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Ec2TransitGatewayConnect } from "./.gen/providers/aws/ec2-transit-gateway-connect";
+import { Ec2TransitGatewayVpcAttachment } from "./.gen/providers/aws/ec2-transit-gateway-vpc-attachment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new Ec2TransitGatewayVpcAttachment(this, "example", {
+      subnetIds: [Token.asString(awsSubnetExample.id)],
+      transitGatewayId: Token.asString(awsEc2TransitGatewayExample.id),
+      vpcId: Token.asString(awsVpcExample.id),
+    });
+    new Ec2TransitGatewayConnect(this, "attachment", {
+      transitGatewayId: Token.asString(awsEc2TransitGatewayExample.id),
+      transportAttachmentId: example.id,
+    });
+  }
 }
 
-resource "aws_ec2_transit_gateway_connect" "attachment" {
-  transport_attachment_id = aws_ec2_transit_gateway_vpc_attachment.example.id
-  transit_gateway_id      = aws_ec2_transit_gateway.example.id
-}
 ```
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
-* `protocol` - (Optional) The tunnel protocol. Valida values: `gre`. Default is `gre`.
+* `protocol` - (Optional) The tunnel protocol. Valid values: `gre`. Default is `gre`.
 * `tags` - (Optional) Key-value tags for the EC2 Transit Gateway Connect. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 * `transitGatewayDefaultRouteTableAssociation` - (Optional) Boolean whether the Connect should be associated with the EC2 Transit Gateway association default route table. This cannot be configured or perform drift detection with Resource Access Manager shared EC2 Transit Gateways. Default value: `true`.
 * `transitGatewayDefaultRouteTablePropagation` - (Optional) Boolean whether the Connect should propagate routes with the EC2 Transit Gateway propagation default route table. This cannot be configured or perform drift detection with Resource Access Manager shared EC2 Transit Gateways. Default value: `true`.
 * `transitGatewayId` - (Required) Identifier of EC2 Transit Gateway.
 * `transportAttachmentId` - (Required) The underlaying VPC attachment
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - EC2 Transit Gateway Attachment identifier
 * `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
@@ -53,10 +69,24 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`awsEc2TransitGatewayConnect` can be imported by using the EC2 Transit Gateway Connect identifier, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsEc2TransitGatewayConnect` using the EC2 Transit Gateway Connect identifier. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
 
 ```
-$ terraform import aws_ec2_transit_gateway_connect.example tgw-attach-12345678
+
+Using `terraform import`, import `awsEc2TransitGatewayConnect` using the EC2 Transit Gateway Connect identifier. For example:
+
+```console
+% terraform import aws_ec2_transit_gateway_connect.example tgw-attach-12345678
 ```
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-f3d6047229225fad16296092d58f858cc2275ae28af2b04cb19cf33046ea88ae -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-3587ce9a543683c2a7be3dfe58f86b578cf760c76595adf37a9f30c13a13e9b9 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ec2_transit_gateway_connect_peer.html.markdown b/website/docs/cdktf/typescript/r/ec2_transit_gateway_connect_peer.html.markdown
index 5c05f186fd7..b491ad9a1ff 100644
--- a/website/docs/cdktf/typescript/r/ec2_transit_gateway_connect_peer.html.markdown
+++ b/website/docs/cdktf/typescript/r/ec2_transit_gateway_connect_peer.html.markdown
@@ -6,28 +6,49 @@ description: |-
   Manages an EC2 Transit Gateway Connect Peer
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Resource: aws_ec2_transit_gateway_connect_peer
 
 Manages an EC2 Transit Gateway Connect Peer.
 
 ## Example Usage
 
-```terraform
-resource "aws_ec2_transit_gateway_connect" "example" {
-  transport_attachment_id = aws_ec2_transit_gateway_vpc_attachment.example.id
-  transit_gateway_id      = aws_ec2_transit_gateway.example.id
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Ec2TransitGatewayConnect } from "./.gen/providers/aws/ec2-transit-gateway-connect";
+import { Ec2TransitGatewayConnectPeer } from "./.gen/providers/aws/ec2-transit-gateway-connect-peer";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new Ec2TransitGatewayConnect(this, "example", {
+      transitGatewayId: Token.asString(awsEc2TransitGatewayExample.id),
+      transportAttachmentId: Token.asString(
+        awsEc2TransitGatewayVpcAttachmentExample.id
+      ),
+    });
+    const awsEc2TransitGatewayConnectPeerExample =
+      new Ec2TransitGatewayConnectPeer(this, "example_1", {
+        insideCidrBlocks: ["169.254.100.0/29"],
+        peerAddress: "10.1.2.3",
+        transitGatewayAttachmentId: example.id,
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsEc2TransitGatewayConnectPeerExample.overrideLogicalId("example");
+  }
 }
 
-resource "aws_ec2_transit_gateway_connect_peer" "example" {
-  peer_address                  = "10.1.2.3"
-  inside_cidr_blocks            = ["169.254.100.0/29"]
-  transit_gateway_attachment_id = aws_ec2_transit_gateway_connect.example.id
-}
 ```
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `bgpAsn` - (Optional) The BGP ASN number assigned customer device. If not provided, it will use the same BGP ASN as is associated with Transit Gateway.
 * `insideCidrBlocks` - (Required) The CIDR block that will be used for addressing within the tunnel. It must contain exactly one IPv4 CIDR block and up to one IPv6 CIDR block. The IPv4 CIDR block must be /29 size and must be within 169.254.0.0/16 range, with exception of: 169.254.0.0/29, 169.254.1.0/29, 169.254.2.0/29, 169.254.3.0/29, 169.254.4.0/29, 169.254.5.0/29, 169.254.169.248/29. The IPv6 CIDR block must be /125 size and must be within fd00::/8. The first IP from each CIDR block is assigned for customer gateway, the second and third is for Transit Gateway (An example: from range 169.254.100.0/29, .1 is assigned to customer gateway and .2 and .3 are assigned to Transit Gateway)
@@ -36,12 +57,14 @@ The following arguments are supported:
 * `transitGatewayAddress` - (Optional) The IP address assigned to Transit Gateway, which will be used as tunnel endpoint. This address must be from associated Transit Gateway CIDR block. The address must be from the same address family as `peerAddress`. If not set explicitly, it will be selected from associated Transit Gateway CIDR blocks
 * `transitGatewayAttachmentId` - (Required) The Transit Gateway Connect
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - EC2 Transit Gateway Connect Peer identifier
 * `arn` - EC2 Transit Gateway Connect Peer ARN
+* `bgpPeerAddress` - The IP address assigned to customer device, which is used as BGP IP address.
+* `bgpTransitGatewayAddresses` - The IP addresses assigned to Transit Gateway, which are used as BGP IP addresses.
 * `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
 
 ## Timeouts
@@ -53,10 +76,24 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`awsEc2TransitGatewayConnectPeer` can be imported by using the EC2 Transit Gateway Connect Peer identifier, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsEc2TransitGatewayConnectPeer` using the EC2 Transit Gateway Connect Peer identifier. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
 
 ```
-$ terraform import aws_ec2_transit_gateway_connect_peer.example tgw-connect-peer-12345678
+
+Using `terraform import`, import `awsEc2TransitGatewayConnectPeer` using the EC2 Transit Gateway Connect Peer identifier. For example:
+
+```console
+% terraform import aws_ec2_transit_gateway_connect_peer.example tgw-connect-peer-12345678
 ```
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-1f5256822c622c77c21ea6bcc2a5888752a92236b8b89351636b84119799598d -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-d6fe2e495100d4a7884cb0832674c4c28b10dc1276e47184967c743d1b05aec4 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ec2_transit_gateway_multicast_domain.html.markdown b/website/docs/cdktf/typescript/r/ec2_transit_gateway_multicast_domain.html.markdown
index 02f15ef5c67..68f8296295f 100644
--- a/website/docs/cdktf/typescript/r/ec2_transit_gateway_multicast_domain.html.markdown
+++ b/website/docs/cdktf/typescript/r/ec2_transit_gateway_multicast_domain.html.markdown
@@ -6,6 +6,8 @@ description: |-
   Manages an EC2 Transit Gateway Multicast Domain
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Resource: aws_ec2_transit_gateway_multicast_domain
 
 Manages an EC2 Transit Gateway Multicast Domain.
@@ -13,204 +15,149 @@ Manages an EC2 Transit Gateway Multicast Domain.
 ## Example Usage
 
 ```typescript
-import * as constructs from "constructs";
-import * as cdktf from "cdktf";
-/*Provider bindings are generated by running cdktf get.
-See https://cdk.tf/provider-generation for more details.*/
-import * as aws from "./.gen/providers/aws";
-class MyConvertedCode extends cdktf.TerraformStack {
-  constructor(scope: constructs.Construct, name: string) {
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsAmi } from "./.gen/providers/aws/data-aws-ami";
+import { DataAwsAvailabilityZones } from "./.gen/providers/aws/data-aws-availability-zones";
+import { Ec2TransitGateway } from "./.gen/providers/aws/ec2-transit-gateway";
+import { Ec2TransitGatewayMulticastDomain } from "./.gen/providers/aws/ec2-transit-gateway-multicast-domain";
+import { Ec2TransitGatewayMulticastDomainAssociation } from "./.gen/providers/aws/ec2-transit-gateway-multicast-domain-association";
+import { Ec2TransitGatewayMulticastGroupMember } from "./.gen/providers/aws/ec2-transit-gateway-multicast-group-member";
+import { Ec2TransitGatewayMulticastGroupSource } from "./.gen/providers/aws/ec2-transit-gateway-multicast-group-source";
+import { Ec2TransitGatewayVpcAttachment } from "./.gen/providers/aws/ec2-transit-gateway-vpc-attachment";
+import { Instance } from "./.gen/providers/aws/instance";
+import { Subnet } from "./.gen/providers/aws/subnet";
+import { Vpc } from "./.gen/providers/aws/vpc";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
     super(scope, name);
-    const awsEc2TransitGatewayTgw = new aws.ec2TransitGateway.Ec2TransitGateway(
-      this,
-      "tgw",
-      {
-        multicastSupport: "enable",
-      }
-    );
-    const awsEc2TransitGatewayMulticastDomainDomain =
-      new aws.ec2TransitGatewayMulticastDomain.Ec2TransitGatewayMulticastDomain(
-        this,
-        "domain",
-        {
-          staticSourcesSupport: "enable",
-          tags: {
-            Name: "Transit_Gateway_Multicast_Domain_Example",
-          },
-          transitGatewayId: cdktf.Token.asString(awsEc2TransitGatewayTgw.id),
-        }
-      );
-    const awsVpcVpc1 = new aws.vpc.Vpc(this, "vpc1", {
+    const tgw = new Ec2TransitGateway(this, "tgw", {
+      multicastSupport: "enable",
+    });
+    const domain = new Ec2TransitGatewayMulticastDomain(this, "domain", {
+      staticSourcesSupport: "enable",
+      tags: {
+        Name: "Transit_Gateway_Multicast_Domain_Example",
+      },
+      transitGatewayId: tgw.id,
+    });
+    const vpc1 = new Vpc(this, "vpc1", {
       cidrBlock: "10.0.0.0/16",
     });
-    const awsVpcVpc2 = new aws.vpc.Vpc(this, "vpc2", {
+    const vpc2 = new Vpc(this, "vpc2", {
       cidrBlock: "10.1.0.0/16",
     });
-    const dataAwsAmiAmazonLinux = new aws.dataAwsAmi.DataAwsAmi(
-      this,
-      "amazon_linux",
-      {
-        filter: [
-          {
-            name: "name",
-            values: ["amzn-ami-hvm-*-x86_64-gp2"],
-          },
-          {
-            name: "owner-alias",
-            values: ["amazon"],
-          },
-        ],
-        mostRecent: true,
-        owners: ["amazon"],
-      }
-    );
-    const dataAwsAvailabilityZonesAvailable =
-      new aws.dataAwsAvailabilityZones.DataAwsAvailabilityZones(
-        this,
-        "available",
+    const amazonLinux = new DataAwsAmi(this, "amazon_linux", {
+      filter: [
+        {
+          name: "name",
+          values: ["amzn-ami-hvm-*-x86_64-gp2"],
+        },
         {
-          state: "available",
-        }
-      );
-    const awsSubnetSubnet1 = new aws.subnet.Subnet(this, "subnet1", {
-      availabilityZone: cdktf.Token.asString(
-        cdktf.propertyAccess(dataAwsAvailabilityZonesAvailable.names, ["0"])
-      ),
+          name: "owner-alias",
+          values: ["amazon"],
+        },
+      ],
+      mostRecent: true,
+      owners: ["amazon"],
+    });
+    const available = new DataAwsAvailabilityZones(this, "available", {
+      state: "available",
+    });
+    const subnet1 = new Subnet(this, "subnet1", {
+      availabilityZone: Token.asString(Fn.lookupNested(available.names, ["0"])),
       cidrBlock: "10.0.1.0/24",
-      vpcId: cdktf.Token.asString(awsVpcVpc1.id),
+      vpcId: vpc1.id,
     });
-    const awsSubnetSubnet2 = new aws.subnet.Subnet(this, "subnet2", {
-      availabilityZone: cdktf.Token.asString(
-        cdktf.propertyAccess(dataAwsAvailabilityZonesAvailable.names, ["1"])
-      ),
+    const subnet2 = new Subnet(this, "subnet2", {
+      availabilityZone: Token.asString(Fn.lookupNested(available.names, ["1"])),
       cidrBlock: "10.0.2.0/24",
-      vpcId: cdktf.Token.asString(awsVpcVpc1.id),
+      vpcId: vpc1.id,
     });
-    const awsSubnetSubnet3 = new aws.subnet.Subnet(this, "subnet3", {
-      availabilityZone: cdktf.Token.asString(
-        cdktf.propertyAccess(dataAwsAvailabilityZonesAvailable.names, ["0"])
-      ),
+    const subnet3 = new Subnet(this, "subnet3", {
+      availabilityZone: Token.asString(Fn.lookupNested(available.names, ["0"])),
       cidrBlock: "10.1.1.0/24",
-      vpcId: cdktf.Token.asString(awsVpcVpc2.id),
-    });
-    const awsEc2TransitGatewayVpcAttachmentAttachment1 =
-      new aws.ec2TransitGatewayVpcAttachment.Ec2TransitGatewayVpcAttachment(
-        this,
-        "attachment1",
-        {
-          subnetIds: [
-            cdktf.Token.asString(awsSubnetSubnet1.id),
-            cdktf.Token.asString(awsSubnetSubnet2.id),
-          ],
-          transitGatewayId: cdktf.Token.asString(awsEc2TransitGatewayTgw.id),
-          vpcId: cdktf.Token.asString(awsVpcVpc1.id),
-        }
-      );
-    const awsEc2TransitGatewayVpcAttachmentAttachment2 =
-      new aws.ec2TransitGatewayVpcAttachment.Ec2TransitGatewayVpcAttachment(
-        this,
-        "attachment2",
-        {
-          subnetIds: [cdktf.Token.asString(awsSubnetSubnet3.id)],
-          transitGatewayId: cdktf.Token.asString(awsEc2TransitGatewayTgw.id),
-          vpcId: cdktf.Token.asString(awsVpcVpc2.id),
-        }
-      );
-    const awsInstanceInstance1 = new aws.instance.Instance(this, "instance1", {
-      ami: cdktf.Token.asString(dataAwsAmiAmazonLinux.id),
-      instanceType: "t2.micro",
-      subnetId: cdktf.Token.asString(awsSubnetSubnet1.id),
-    });
-    const awsInstanceInstance2 = new aws.instance.Instance(this, "instance2", {
-      ami: cdktf.Token.asString(dataAwsAmiAmazonLinux.id),
-      instanceType: "t2.micro",
-      subnetId: cdktf.Token.asString(awsSubnetSubnet2.id),
+      vpcId: vpc2.id,
     });
-    const awsInstanceInstance3 = new aws.instance.Instance(this, "instance3", {
-      ami: cdktf.Token.asString(dataAwsAmiAmazonLinux.id),
-      instanceType: "t2.micro",
-      subnetId: cdktf.Token.asString(awsSubnetSubnet3.id),
-    });
-    const awsEc2TransitGatewayMulticastDomainAssociationAssociation1 =
-      new aws.ec2TransitGatewayMulticastDomainAssociation.Ec2TransitGatewayMulticastDomainAssociation(
-        this,
-        "association1",
-        {
-          subnetId: cdktf.Token.asString(awsSubnetSubnet1.id),
-          transitGatewayAttachmentId: cdktf.Token.asString(
-            awsEc2TransitGatewayVpcAttachmentAttachment1.id
-          ),
-          transitGatewayMulticastDomainId: cdktf.Token.asString(
-            awsEc2TransitGatewayMulticastDomainDomain.id
-          ),
-        }
-      );
-    new aws.ec2TransitGatewayMulticastDomainAssociation.Ec2TransitGatewayMulticastDomainAssociation(
+    const attachment1 = new Ec2TransitGatewayVpcAttachment(
       this,
-      "association2",
+      "attachment1",
       {
-        subnetId: cdktf.Token.asString(awsSubnetSubnet2.id),
-        transitGatewayAttachmentId: cdktf.Token.asString(
-          awsEc2TransitGatewayVpcAttachmentAttachment2.id
-        ),
-        transitGatewayMulticastDomainId: cdktf.Token.asString(
-          awsEc2TransitGatewayMulticastDomainDomain.id
-        ),
+        subnetIds: [subnet1.id, subnet2.id],
+        transitGatewayId: tgw.id,
+        vpcId: vpc1.id,
       }
     );
-    const awsEc2TransitGatewayMulticastDomainAssociationAssociation3 =
-      new aws.ec2TransitGatewayMulticastDomainAssociation.Ec2TransitGatewayMulticastDomainAssociation(
-        this,
-        "association3",
-        {
-          subnetId: cdktf.Token.asString(awsSubnetSubnet3.id),
-          transitGatewayAttachmentId: cdktf.Token.asString(
-            awsEc2TransitGatewayVpcAttachmentAttachment2.id
-          ),
-          transitGatewayMulticastDomainId: cdktf.Token.asString(
-            awsEc2TransitGatewayMulticastDomainDomain.id
-          ),
-        }
-      );
-    new aws.ec2TransitGatewayMulticastGroupMember.Ec2TransitGatewayMulticastGroupMember(
+    const attachment2 = new Ec2TransitGatewayVpcAttachment(
       this,
-      "member1",
+      "attachment2",
       {
-        groupIpAddress: "224.0.0.1",
-        networkInterfaceId: cdktf.Token.asString(
-          awsInstanceInstance1.primaryNetworkInterfaceId
-        ),
-        transitGatewayMulticastDomainId: cdktf.Token.asString(
-          awsEc2TransitGatewayMulticastDomainAssociationAssociation1.transitGatewayMulticastDomainId
-        ),
+        subnetIds: [subnet3.id],
+        transitGatewayId: tgw.id,
+        vpcId: vpc2.id,
       }
     );
-    new aws.ec2TransitGatewayMulticastGroupMember.Ec2TransitGatewayMulticastGroupMember(
+    const instance1 = new Instance(this, "instance1", {
+      ami: Token.asString(amazonLinux.id),
+      instanceType: "t2.micro",
+      subnetId: subnet1.id,
+    });
+    const instance2 = new Instance(this, "instance2", {
+      ami: Token.asString(amazonLinux.id),
+      instanceType: "t2.micro",
+      subnetId: subnet2.id,
+    });
+    const instance3 = new Instance(this, "instance3", {
+      ami: Token.asString(amazonLinux.id),
+      instanceType: "t2.micro",
+      subnetId: subnet3.id,
+    });
+    const association1 = new Ec2TransitGatewayMulticastDomainAssociation(
       this,
-      "member2",
+      "association1",
       {
-        groupIpAddress: "224.0.0.1",
-        networkInterfaceId: cdktf.Token.asString(
-          awsInstanceInstance2.primaryNetworkInterfaceId
-        ),
-        transitGatewayMulticastDomainId: cdktf.Token.asString(
-          awsEc2TransitGatewayMulticastDomainAssociationAssociation1.transitGatewayMulticastDomainId
-        ),
+        subnetId: subnet1.id,
+        transitGatewayAttachmentId: attachment1.id,
+        transitGatewayMulticastDomainId: domain.id,
       }
     );
-    new aws.ec2TransitGatewayMulticastGroupSource.Ec2TransitGatewayMulticastGroupSource(
+    new Ec2TransitGatewayMulticastDomainAssociation(this, "association2", {
+      subnetId: subnet2.id,
+      transitGatewayAttachmentId: attachment2.id,
+      transitGatewayMulticastDomainId: domain.id,
+    });
+    const association3 = new Ec2TransitGatewayMulticastDomainAssociation(
       this,
-      "source",
+      "association3",
       {
-        groupIpAddress: "224.0.0.1",
-        networkInterfaceId: cdktf.Token.asString(
-          awsInstanceInstance3.primaryNetworkInterfaceId
-        ),
-        transitGatewayMulticastDomainId: cdktf.Token.asString(
-          awsEc2TransitGatewayMulticastDomainAssociationAssociation3.transitGatewayMulticastDomainId
-        ),
+        subnetId: subnet3.id,
+        transitGatewayAttachmentId: attachment2.id,
+        transitGatewayMulticastDomainId: domain.id,
       }
     );
+    new Ec2TransitGatewayMulticastGroupMember(this, "member1", {
+      groupIpAddress: "224.0.0.1",
+      networkInterfaceId: instance1.primaryNetworkInterfaceId,
+      transitGatewayMulticastDomainId:
+        association1.transitGatewayMulticastDomainId,
+    });
+    new Ec2TransitGatewayMulticastGroupMember(this, "member2", {
+      groupIpAddress: "224.0.0.1",
+      networkInterfaceId: instance2.primaryNetworkInterfaceId,
+      transitGatewayMulticastDomainId:
+        association1.transitGatewayMulticastDomainId,
+    });
+    new Ec2TransitGatewayMulticastGroupSource(this, "source", {
+      groupIpAddress: "224.0.0.1",
+      networkInterfaceId: instance3.primaryNetworkInterfaceId,
+      transitGatewayMulticastDomainId:
+        association3.transitGatewayMulticastDomainId,
+    });
   }
 }
 
@@ -218,7 +165,7 @@ class MyConvertedCode extends cdktf.TerraformStack {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `transitGatewayId` - (Required) EC2 Transit Gateway identifier. The EC2 Transit Gateway must have `multicastSupport` enabled.
 * `autoAcceptSharedAssociations` - (Optional) Whether to automatically accept cross-account subnet associations that are associated with the EC2 Transit Gateway Multicast Domain. Valid values: `disable`, `enable`. Default value: `disable`.
@@ -226,9 +173,9 @@ The following arguments are supported:
 * `staticSourcesSupport` - (Optional) Whether to enable support for statically configuring multicast group sources for the EC2 Transit Gateway Multicast Domain. Valid values: `disable`, `enable`. Default value: `disable`.
 * `tags` - (Optional) Key-value tags for the EC2 Transit Gateway Multicast Domain. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - EC2 Transit Gateway Multicast Domain identifier.
 * `arn` - EC2 Transit Gateway Multicast Domain Amazon Resource Name (ARN).
@@ -244,10 +191,24 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`awsEc2TransitGatewayMulticastDomain` can be imported by using the EC2 Transit Gateway Multicast Domain identifier, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsEc2TransitGatewayMulticastDomain` using the EC2 Transit Gateway Multicast Domain identifier. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
 
 ```
-terraform import aws_ec2_transit_gateway_multicast_domain.example tgw-mcast-domain-12345
+
+Using `terraform import`, import `awsEc2TransitGatewayMulticastDomain` using the EC2 Transit Gateway Multicast Domain identifier. For example:
+
+```console
+% terraform import aws_ec2_transit_gateway_multicast_domain.example tgw-mcast-domain-12345
 ```
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-af570cc56449ad3f3c4b5a829709b1b5977e549ce5e66e168ab6e20788f81ed8 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-8493dfab227c918d9b3e4e208962affb97781a33e5cd93321c066ab973c7252b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ec2_transit_gateway_multicast_domain_association.html.markdown b/website/docs/cdktf/typescript/r/ec2_transit_gateway_multicast_domain_association.html.markdown
index cfb4ded0a39..ef3d474b443 100644
--- a/website/docs/cdktf/typescript/r/ec2_transit_gateway_multicast_domain_association.html.markdown
+++ b/website/docs/cdktf/typescript/r/ec2_transit_gateway_multicast_domain_association.html.markdown
@@ -6,45 +6,76 @@ description: |-
   Manages an EC2 Transit Gateway Multicast Domain Association
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Resource: aws_ec2_transit_gateway_multicast_domain_association
 
 Associates the specified subnet and transit gateway attachment with the specified transit gateway multicast domain.
 
 ## Example Usage
 
-```terraform
-resource "aws_ec2_transit_gateway" "example" {
-  multicast_support = "enable"
-}
-
-resource "aws_ec2_transit_gateway_vpc_attachment" "example" {
-  subnet_ids         = [aws_subnet.example.id]
-  transit_gateway_id = aws_ec2_transit_gateway.example.id
-  vpc_id             = aws_vpc.example.id
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Ec2TransitGateway } from "./.gen/providers/aws/ec2-transit-gateway";
+import { Ec2TransitGatewayMulticastDomain } from "./.gen/providers/aws/ec2-transit-gateway-multicast-domain";
+import { Ec2TransitGatewayMulticastDomainAssociation } from "./.gen/providers/aws/ec2-transit-gateway-multicast-domain-association";
+import { Ec2TransitGatewayVpcAttachment } from "./.gen/providers/aws/ec2-transit-gateway-vpc-attachment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new Ec2TransitGateway(this, "example", {
+      multicastSupport: "enable",
+    });
+    const awsEc2TransitGatewayMulticastDomainExample =
+      new Ec2TransitGatewayMulticastDomain(this, "example_1", {
+        transitGatewayId: example.id,
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsEc2TransitGatewayMulticastDomainExample.overrideLogicalId("example");
+    const awsEc2TransitGatewayVpcAttachmentExample =
+      new Ec2TransitGatewayVpcAttachment(this, "example_2", {
+        subnetIds: [Token.asString(awsSubnetExample.id)],
+        transitGatewayId: example.id,
+        vpcId: Token.asString(awsVpcExample.id),
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsEc2TransitGatewayVpcAttachmentExample.overrideLogicalId("example");
+    const awsEc2TransitGatewayMulticastDomainAssociationExample =
+      new Ec2TransitGatewayMulticastDomainAssociation(this, "example_3", {
+        subnetId: Token.asString(awsSubnetExample.id),
+        transitGatewayAttachmentId: Token.asString(
+          awsEc2TransitGatewayVpcAttachmentExample.id
+        ),
+        transitGatewayMulticastDomainId: Token.asString(
+          awsEc2TransitGatewayMulticastDomainExample.id
+        ),
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsEc2TransitGatewayMulticastDomainAssociationExample.overrideLogicalId(
+      "example"
+    );
+  }
 }
 
-resource "aws_ec2_transit_gateway_multicast_domain" "example" {
-  transit_gateway_id = aws_ec2_transit_gateway.example.id
-}
-
-resource "aws_ec2_transit_gateway_multicast_domain_association" "example" {
-  subnet_id                           = aws_subnet.example.id
-  transit_gateway_attachment_id       = aws_ec2_transit_gateway_vpc_attachment.example.id
-  transit_gateway_multicast_domain_id = aws_ec2_transit_gateway_multicast_domain.example.id
-}
 ```
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `subnetId` - (Required) The ID of the subnet to associate with the transit gateway multicast domain.
 * `transitGatewayAttachmentId` - (Required) The ID of the transit gateway attachment.
 * `transitGatewayMulticastDomainId` - (Required) The ID of the transit gateway multicast domain.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - EC2 Transit Gateway Multicast Domain Association identifier.
 
@@ -55,4 +86,4 @@ In addition to all arguments above, the following attributes are exported:
 - `create` - (Default `10M`)
 - `delete` - (Default `10M`)
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-0aab754cf2f3ec5b55918c480d40a25c05ca4acac47f8f8d44dabc61eeb6bf26 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-6c4de69f84e7a9ddb2ed6ce4cfadb8fa72c50ebf1d30ec7a4dc0c8b0330dd7d7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ec2_transit_gateway_multicast_group_member.html.markdown b/website/docs/cdktf/typescript/r/ec2_transit_gateway_multicast_group_member.html.markdown
index 614c940b015..b8692bc4384 100644
--- a/website/docs/cdktf/typescript/r/ec2_transit_gateway_multicast_group_member.html.markdown
+++ b/website/docs/cdktf/typescript/r/ec2_transit_gateway_multicast_group_member.html.markdown
@@ -6,6 +6,8 @@ description: |-
   Manages an EC2 Transit Gateway Multicast Group Member
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Resource: aws_ec2_transit_gateway_multicast_group_member
 
 Registers members (network interfaces) with the transit gateway multicast group.
@@ -13,26 +15,42 @@ A member is a network interface associated with a supported EC2 instance that re
 
 ## Example Usage
 
-```terraform
-resource "aws_ec2_transit_gateway_multicast_group_member" "example" {
-  group_ip_address                    = "224.0.0.1"
-  network_interface_id                = aws_network_interface.example.id
-  transit_gateway_multicast_domain_id = aws_ec2_transit_gateway_multicast_domain.example.id
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Ec2TransitGatewayMulticastGroupMember } from "./.gen/providers/aws/ec2-transit-gateway-multicast-group-member";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Ec2TransitGatewayMulticastGroupMember(this, "example", {
+      groupIpAddress: "224.0.0.1",
+      networkInterfaceId: Token.asString(awsNetworkInterfaceExample.id),
+      transitGatewayMulticastDomainId: Token.asString(
+        awsEc2TransitGatewayMulticastDomainExample.id
+      ),
+    });
+  }
 }
+
 ```
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `groupIpAddress` - (Required) The IP address assigned to the transit gateway multicast group.
 * `networkInterfaceId` - (Required) The group members' network interface ID to register with the transit gateway multicast group.
 * `transitGatewayMulticastDomainId` - (Required) The ID of the transit gateway multicast domain.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - EC2 Transit Gateway Multicast Group Member identifier.
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-286c39b2f59b7534bbe97baf79dd0b9741f58e4a81a46b026a37ff2930718d60 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-91bef72daade97f93eac61bbc5f6341295847aeaaf5638e91668e61f2b73e95f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ec2_transit_gateway_multicast_group_source.html.markdown b/website/docs/cdktf/typescript/r/ec2_transit_gateway_multicast_group_source.html.markdown
index 265105d03c8..b7d72c6a220 100644
--- a/website/docs/cdktf/typescript/r/ec2_transit_gateway_multicast_group_source.html.markdown
+++ b/website/docs/cdktf/typescript/r/ec2_transit_gateway_multicast_group_source.html.markdown
@@ -6,6 +6,8 @@ description: |-
   Manages an EC2 Transit Gateway Multicast Group Source
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Resource: aws_ec2_transit_gateway_multicast_group_source
 
 Registers sources (network interfaces) with the transit gateway multicast group.
@@ -13,26 +15,42 @@ A multicast source is a network interface attached to a supported instance that
 
 ## Example Usage
 
-```terraform
-resource "aws_ec2_transit_gateway_multicast_group_source" "example" {
-  group_ip_address                    = "224.0.0.1"
-  network_interface_id                = aws_network_interface.example.id
-  transit_gateway_multicast_domain_id = aws_ec2_transit_gateway_multicast_domain.example.id
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Ec2TransitGatewayMulticastGroupSource } from "./.gen/providers/aws/ec2-transit-gateway-multicast-group-source";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Ec2TransitGatewayMulticastGroupSource(this, "example", {
+      groupIpAddress: "224.0.0.1",
+      networkInterfaceId: Token.asString(awsNetworkInterfaceExample.id),
+      transitGatewayMulticastDomainId: Token.asString(
+        awsEc2TransitGatewayMulticastDomainExample.id
+      ),
+    });
+  }
 }
+
 ```
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `groupIpAddress` - (Required) The IP address assigned to the transit gateway multicast group.
 * `networkInterfaceId` - (Required) The group members' network interface ID to register with the transit gateway multicast group.
 * `transitGatewayMulticastDomainId` - (Required) The ID of the transit gateway multicast domain.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - EC2 Transit Gateway Multicast Group Member identifier.
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-65215e11717df1869097637d2ac9989417c165158f1d4b33781b1f0782026494 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-561db583d91352dec7ba040b0abbb86f30bfd413562c455a18fa76289ce3489f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ec2_transit_gateway_peering_attachment.html.markdown b/website/docs/cdktf/typescript/r/ec2_transit_gateway_peering_attachment.html.markdown
index 5ac8ab0ffbd..7a671a3f9dd 100644
--- a/website/docs/cdktf/typescript/r/ec2_transit_gateway_peering_attachment.html.markdown
+++ b/website/docs/cdktf/typescript/r/ec2_transit_gateway_peering_attachment.html.markdown
@@ -6,6 +6,8 @@ description: |-
   Manages an EC2 Transit Gateway Peering Attachment
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Resource: aws_ec2_transit_gateway_peering_attachment
 
 Manages an EC2 Transit Gateway Peering Attachment.
@@ -14,58 +16,54 @@ For examples of custom route table association and propagation, see the [EC2 Tra
 ## Example Usage
 
 ```typescript
-import * as constructs from "constructs";
-import * as cdktf from "cdktf";
-/*Provider bindings are generated by running cdktf get.
-See https://cdk.tf/provider-generation for more details.*/
-import * as aws from "./.gen/providers/aws";
-class MyConvertedCode extends cdktf.TerraformStack {
-  constructor(scope: constructs.Construct, name: string) {
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsRegion } from "./.gen/providers/aws/data-aws-region";
+import { Ec2TransitGateway } from "./.gen/providers/aws/ec2-transit-gateway";
+import { Ec2TransitGatewayPeeringAttachment } from "./.gen/providers/aws/ec2-transit-gateway-peering-attachment";
+import { AwsProvider } from "./.gen/providers/aws/provider";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
     super(scope, name);
-    const awsLocal = new aws.provider.AwsProvider(this, "aws", {
+    const local = new AwsProvider(this, "aws", {
       alias: "local",
       region: "us-east-1",
     });
-    const awsPeer = new aws.provider.AwsProvider(this, "aws_1", {
+    const peer = new AwsProvider(this, "aws_1", {
       alias: "peer",
       region: "us-west-2",
     });
-    const awsEc2TransitGatewayLocal =
-      new aws.ec2TransitGateway.Ec2TransitGateway(this, "local", {
-        provider: awsLocal,
-        tags: {
-          Name: "Local TGW",
-        },
-      });
-    const awsEc2TransitGatewayPeer =
-      new aws.ec2TransitGateway.Ec2TransitGateway(this, "peer", {
-        provider: awsPeer,
-        tags: {
-          Name: "Peer TGW",
-        },
-      });
-    const dataAwsRegionPeer = new aws.dataAwsRegion.DataAwsRegion(
-      this,
-      "peer_4",
-      {
-        provider: awsPeer,
-      }
-    );
+    const awsEc2TransitGatewayLocal = new Ec2TransitGateway(this, "local", {
+      provider: local,
+      tags: {
+        Name: "Local TGW",
+      },
+    });
+    const awsEc2TransitGatewayPeer = new Ec2TransitGateway(this, "peer", {
+      provider: peer,
+      tags: {
+        Name: "Peer TGW",
+      },
+    });
+    const dataAwsRegionPeer = new DataAwsRegion(this, "peer_4", {
+      provider: peer,
+    });
     /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
     dataAwsRegionPeer.overrideLogicalId("peer");
-    new aws.ec2TransitGatewayPeeringAttachment.Ec2TransitGatewayPeeringAttachment(
-      this,
-      "example",
-      {
-        peerAccountId: cdktf.Token.asString(awsEc2TransitGatewayPeer.ownerId),
-        peerRegion: cdktf.Token.asString(dataAwsRegionPeer.name),
-        peerTransitGatewayId: cdktf.Token.asString(awsEc2TransitGatewayPeer.id),
-        tags: {
-          Name: "TGW Peering Requestor",
-        },
-        transitGatewayId: cdktf.Token.asString(awsEc2TransitGatewayLocal.id),
-      }
-    );
+    new Ec2TransitGatewayPeeringAttachment(this, "example", {
+      peerAccountId: Token.asString(awsEc2TransitGatewayPeer.ownerId),
+      peerRegion: Token.asString(dataAwsRegionPeer.name),
+      peerTransitGatewayId: Token.asString(awsEc2TransitGatewayPeer.id),
+      tags: {
+        Name: "TGW Peering Requestor",
+      },
+      transitGatewayId: Token.asString(awsEc2TransitGatewayLocal.id),
+    });
   }
 }
 
@@ -75,7 +73,7 @@ A full example of how to create a Transit Gateway in one AWS account, share it w
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `peerAccountId` - (Optional) Account ID of EC2 Transit Gateway to peer with. Defaults to the account ID the [AWS provider][1] is currently connected to.
 * `peerRegion` - (Required) Region of EC2 Transit Gateway to peer with.
@@ -83,21 +81,35 @@ The following arguments are supported:
 * `tags` - (Optional) Key-value tags for the EC2 Transit Gateway Peering Attachment. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 * `transitGatewayId` - (Required) Identifier of EC2 Transit Gateway.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - EC2 Transit Gateway Attachment identifier
 * `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
 
 ## Import
 
-`awsEc2TransitGatewayPeeringAttachment` can be imported by using the EC2 Transit Gateway Attachment identifier, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsEc2TransitGatewayPeeringAttachment` using the EC2 Transit Gateway Attachment identifier. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsEc2TransitGatewayPeeringAttachment` using the EC2 Transit Gateway Attachment identifier. For example:
 
-```sh
-terraform import aws_ec2_transit_gateway_peering_attachment.example tgw-attach-12345678
+```console
+% terraform import aws_ec2_transit_gateway_peering_attachment.example tgw-attach-12345678
 ```
 
 [1]: /docs/providers/aws/index.html
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-5e6980d31532832aa0ca35b8561fc1b7da555248123d68a53651ee6e3c1bfee2 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-58f6c9437a7c95b8df5161dbac8476475147b7788b6b5351cb7f1a812d59aa51 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ec2_transit_gateway_peering_attachment_accepter.html.markdown b/website/docs/cdktf/typescript/r/ec2_transit_gateway_peering_attachment_accepter.html.markdown
index fb86c563aa0..b332a64a141 100644
--- a/website/docs/cdktf/typescript/r/ec2_transit_gateway_peering_attachment_accepter.html.markdown
+++ b/website/docs/cdktf/typescript/r/ec2_transit_gateway_peering_attachment_accepter.html.markdown
@@ -6,34 +6,51 @@ description: |-
   Manages the accepter's side of an EC2 Transit Gateway peering Attachment
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Resource: aws_ec2_transit_gateway_peering_attachment_accepter
 
 Manages the accepter's side of an EC2 Transit Gateway Peering Attachment.
 
 ## Example Usage
 
-```terraform
-resource "aws_ec2_transit_gateway_peering_attachment_accepter" "example" {
-  transit_gateway_attachment_id = aws_ec2_transit_gateway_peering_attachment.example.id
-
-  tags = {
-    Name = "Example cross-account attachment"
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Ec2TransitGatewayPeeringAttachmentAccepter } from "./.gen/providers/aws/ec2-transit-gateway-peering-attachment-accepter";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Ec2TransitGatewayPeeringAttachmentAccepter(this, "example", {
+      tags: {
+        Name: "Example cross-account attachment",
+      },
+      transitGatewayAttachmentId: Token.asString(
+        awsEc2TransitGatewayPeeringAttachmentExample.id
+      ),
+    });
   }
 }
+
 ```
 
 A full example of how to create a Transit Gateway in one AWS account, share it with a second AWS account, and attach a to a Transit Gateway in the second account via the `awsEc2TransitGatewayPeeringAttachment` resource can be found in [the `/examples/transitGatewayCrossAccountPeeringAttachment` directory within the Github Repository](https://github.com/hashicorp/terraform-provider-aws/tree/main/examples/transit-gateway-cross-account-peering-attachment).
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `transitGatewayAttachmentId` - (Required) The ID of the EC2 Transit Gateway Peering Attachment to manage.
 * `tags` - (Optional) Key-value tags for the EC2 Transit Gateway Peering Attachment. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - EC2 Transit Gateway Attachment identifier
 * `transitGatewayId` - Identifier of EC2 Transit Gateway.
@@ -43,10 +60,24 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`awsEc2TransitGatewayPeeringAttachmentAccepter` can be imported by using the EC2 Transit Gateway Attachment identifier, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsEc2TransitGatewayPeeringAttachmentAccepter` using the EC2 Transit Gateway Attachment identifier. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
 
 ```
-$ terraform import aws_ec2_transit_gateway_peering_attachment_accepter.example tgw-attach-12345678
+
+Using `terraform import`, import `awsEc2TransitGatewayPeeringAttachmentAccepter` using the EC2 Transit Gateway Attachment identifier. For example:
+
+```console
+% terraform import aws_ec2_transit_gateway_peering_attachment_accepter.example tgw-attach-12345678
 ```
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-fab6deae8f43bceb887eb6da8d66bf91ec6984a573d451705f72d107809f5a68 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-6f990861cdea5515b1adb7416bea698b8254af1069c30ac70cdb56d2891f29e4 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ec2_transit_gateway_policy_table.html.markdown b/website/docs/cdktf/typescript/r/ec2_transit_gateway_policy_table.html.markdown
index 9e57efea412..3f1aee3c90b 100644
--- a/website/docs/cdktf/typescript/r/ec2_transit_gateway_policy_table.html.markdown
+++ b/website/docs/cdktf/typescript/r/ec2_transit_gateway_policy_table.html.markdown
@@ -6,32 +6,47 @@ description: |-
   Manages an EC2 Transit Gateway Policy Table
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Resource: aws_ec2_transit_gateway_policy_table
 
 Manages an EC2 Transit Gateway Policy Table.
 
 ## Example Usage
 
-```terraform
-resource "aws_ec2_transit_gateway_policy_table" "example" {
-  transit_gateway_id = aws_ec2_transit_gateway.example.id
-
-  tags = {
-    Name = "Example Policy Table"
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Ec2TransitGatewayPolicyTable } from "./.gen/providers/aws/ec2-transit-gateway-policy-table";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Ec2TransitGatewayPolicyTable(this, "example", {
+      tags: {
+        Name: "Example Policy Table",
+      },
+      transitGatewayId: Token.asString(awsEc2TransitGatewayExample.id),
+    });
   }
 }
+
 ```
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `transitGatewayId` - (Required) EC2 Transit Gateway identifier.
 * `tags` - (Optional) Key-value tags for the EC2 Transit Gateway Policy Table. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - EC2 Transit Gateway Policy Table Amazon Resource Name (ARN).
 * `id` - EC2 Transit Gateway Policy Table identifier.
@@ -40,10 +55,24 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`awsEc2TransitGatewayPolicyTable` can be imported by using the EC2 Transit Gateway Policy Table identifier, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsEc2TransitGatewayPolicyTable` using the EC2 Transit Gateway Policy Table identifier. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
 
 ```
-$ terraform import aws_ec2_transit_gateway_policy_table.example tgw-rtb-12345678
+
+Using `terraform import`, import `awsEc2TransitGatewayPolicyTable` using the EC2 Transit Gateway Policy Table identifier. For example:
+
+```console
+% terraform import aws_ec2_transit_gateway_policy_table.example tgw-rtb-12345678
 ```
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-6200610860d8045f7e9f0172434a88391558b460f129907e25f4790f7bb77806 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-74a9f90cb0d2a1a3f4d315939168fb889955b8d8ab3822d27c7d6149af4bd379 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ec2_transit_gateway_policy_table_association.html.markdown b/website/docs/cdktf/typescript/r/ec2_transit_gateway_policy_table_association.html.markdown
index f895a0e215c..110a7ed14b6 100644
--- a/website/docs/cdktf/typescript/r/ec2_transit_gateway_policy_table_association.html.markdown
+++ b/website/docs/cdktf/typescript/r/ec2_transit_gateway_policy_table_association.html.markdown
@@ -6,29 +6,49 @@ description: |-
   Manages an EC2 Transit Gateway Policy Table association
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Resource: aws_ec2_transit_gateway_policy_table_association
 
 Manages an EC2 Transit Gateway Policy Table association.
 
 ## Example Usage
 
-```terraform
-resource "aws_ec2_transit_gateway_policy_table_association" "example" {
-  transit_gateway_attachment_id   = aws_networkmanager_transit_gateway_peering.example.transit_gateway_peering_attachment_id
-  transit_gateway_policy_table_id = aws_ec2_transit_gateway_policy_table.example.id
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Ec2TransitGatewayPolicyTableAssociation } from "./.gen/providers/aws/ec2-transit-gateway-policy-table-association";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Ec2TransitGatewayPolicyTableAssociation(this, "example", {
+      transitGatewayAttachmentId: Token.asString(
+        awsNetworkmanagerTransitGatewayPeeringExample.transitGatewayPeeringAttachmentId
+      ),
+      transitGatewayPolicyTableId: Token.asString(
+        awsEc2TransitGatewayPolicyTableExample.id
+      ),
+    });
+  }
 }
+
 ```
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `transitGatewayAttachmentId` - (Required) Identifier of EC2 Transit Gateway Attachment.
 * `transitGatewayPolicyTableId` - (Required) Identifier of EC2 Transit Gateway Policy Table.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - EC2 Transit Gateway Policy Table identifier combined with EC2 Transit Gateway Attachment identifier
 * `resourceId` - Identifier of the resource
@@ -36,10 +56,24 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`awsEc2TransitGatewayPolicyTableAssociation` can be imported by using the EC2 Transit Gateway Policy Table identifier, an underscore, and the EC2 Transit Gateway Attachment identifier, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsEc2TransitGatewayPolicyTableAssociation` using the EC2 Transit Gateway Policy Table identifier, an underscore, and the EC2 Transit Gateway Attachment identifier. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
 
 ```
-$ terraform import aws_ec2_transit_gateway_policy_table_association.example tgw-rtb-12345678_tgw-attach-87654321
+
+Using `terraform import`, import `awsEc2TransitGatewayPolicyTableAssociation` using the EC2 Transit Gateway Policy Table identifier, an underscore, and the EC2 Transit Gateway Attachment identifier. For example:
+
+```console
+% terraform import aws_ec2_transit_gateway_policy_table_association.example tgw-rtb-12345678_tgw-attach-87654321
 ```
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-71380ed0eec27922255ea166a66458c5cd56cb198475d01b1f355b8ed09e3323 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-fb6c9a474c21becbfa7750b9e0ef6a384a8f2e3673c394bf8ae8f12a2b132f7b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ec2_transit_gateway_prefix_list_reference.html.markdown b/website/docs/cdktf/typescript/r/ec2_transit_gateway_prefix_list_reference.html.markdown
index 1b191a17c9d..c1e593e09f8 100644
--- a/website/docs/cdktf/typescript/r/ec2_transit_gateway_prefix_list_reference.html.markdown
+++ b/website/docs/cdktf/typescript/r/ec2_transit_gateway_prefix_list_reference.html.markdown
@@ -6,6 +6,8 @@ description: |-
   Manages an EC2 Transit Gateway Prefix List Reference
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Resource: aws_ec2_transit_gateway_prefix_list_reference
 
 Manages an EC2 Transit Gateway Prefix List Reference.
@@ -14,22 +16,56 @@ Manages an EC2 Transit Gateway Prefix List Reference.
 
 ### Attachment Routing
 
-```terraform
-resource "aws_ec2_transit_gateway_prefix_list_reference" "example" {
-  prefix_list_id                 = aws_ec2_managed_prefix_list.example.id
-  transit_gateway_attachment_id  = aws_ec2_transit_gateway_vpc_attachment.example.id
-  transit_gateway_route_table_id = aws_ec2_transit_gateway.example.association_default_route_table_id
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Ec2TransitGatewayPrefixListReference } from "./.gen/providers/aws/ec2-transit-gateway-prefix-list-reference";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Ec2TransitGatewayPrefixListReference(this, "example", {
+      prefixListId: Token.asString(awsEc2ManagedPrefixListExample.id),
+      transitGatewayAttachmentId: Token.asString(
+        awsEc2TransitGatewayVpcAttachmentExample.id
+      ),
+      transitGatewayRouteTableId: Token.asString(
+        awsEc2TransitGatewayExample.associationDefaultRouteTableId
+      ),
+    });
+  }
 }
+
 ```
 
 ### Blackhole Routing
 
-```terraform
-resource "aws_ec2_transit_gateway_prefix_list_reference" "example" {
-  blackhole                      = true
-  prefix_list_id                 = aws_ec2_managed_prefix_list.example.id
-  transit_gateway_route_table_id = aws_ec2_transit_gateway.example.association_default_route_table_id
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Ec2TransitGatewayPrefixListReference } from "./.gen/providers/aws/ec2-transit-gateway-prefix-list-reference";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Ec2TransitGatewayPrefixListReference(this, "example", {
+      blackhole: true,
+      prefixListId: Token.asString(awsEc2ManagedPrefixListExample.id),
+      transitGatewayRouteTableId: Token.asString(
+        awsEc2TransitGatewayExample.associationDefaultRouteTableId
+      ),
+    });
+  }
 }
+
 ```
 
 ## Argument Reference
@@ -44,18 +80,32 @@ The following arguments are optional:
 * `blackhole` - (Optional) Indicates whether to drop traffic that matches the Prefix List. Defaults to `false`.
 * `transitGatewayAttachmentId` - (Optional) Identifier of EC2 Transit Gateway Attachment.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - EC2 Transit Gateway Route Table identifier and EC2 Prefix List identifier, separated by an underscore (`_`)
 
 ## Import
 
-`awsEc2TransitGatewayPrefixListReference` can be imported by using the EC2 Transit Gateway Route Table identifier and EC2 Prefix List identifier, separated by an underscore (`_`), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsEc2TransitGatewayPrefixListReference` using the EC2 Transit Gateway Route Table identifier and EC2 Prefix List identifier, separated by an underscore (`_`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsEc2TransitGatewayPrefixListReference` using the EC2 Transit Gateway Route Table identifier and EC2 Prefix List identifier, separated by an underscore (`_`). For example:
 
 ```console
-$ terraform import aws_ec2_transit_gateway_prefix_list_reference.example tgw-rtb-12345678_pl-12345678
+% terraform import aws_ec2_transit_gateway_prefix_list_reference.example tgw-rtb-12345678_pl-12345678
 ```
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-dae2b5290418a326474491e4cd679453c7c96892eefcda91996a5bc3e7297a8d -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-32c5c00eacc9b022003008b236983d6790e2080f489aa235567510a3cf34f745 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ec2_transit_gateway_route.html.markdown b/website/docs/cdktf/typescript/r/ec2_transit_gateway_route.html.markdown
index df3c812a24e..6a503b774a7 100644
--- a/website/docs/cdktf/typescript/r/ec2_transit_gateway_route.html.markdown
+++ b/website/docs/cdktf/typescript/r/ec2_transit_gateway_route.html.markdown
@@ -6,6 +6,8 @@ description: |-
   Manages an EC2 Transit Gateway Route
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Resource: aws_ec2_transit_gateway_route
 
 Manages an EC2 Transit Gateway Route.
@@ -14,45 +16,93 @@ Manages an EC2 Transit Gateway Route.
 
 ### Standard usage
 
-```terraform
-resource "aws_ec2_transit_gateway_route" "example" {
-  destination_cidr_block         = "0.0.0.0/0"
-  transit_gateway_attachment_id  = aws_ec2_transit_gateway_vpc_attachment.example.id
-  transit_gateway_route_table_id = aws_ec2_transit_gateway.example.association_default_route_table_id
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Ec2TransitGatewayRoute } from "./.gen/providers/aws/ec2-transit-gateway-route";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Ec2TransitGatewayRoute(this, "example", {
+      destinationCidrBlock: "0.0.0.0/0",
+      transitGatewayAttachmentId: Token.asString(
+        awsEc2TransitGatewayVpcAttachmentExample.id
+      ),
+      transitGatewayRouteTableId: Token.asString(
+        awsEc2TransitGatewayExample.associationDefaultRouteTableId
+      ),
+    });
+  }
 }
+
 ```
 
 ### Blackhole route
 
-```terraform
-resource "aws_ec2_transit_gateway_route" "example" {
-  destination_cidr_block         = "0.0.0.0/0"
-  blackhole                      = true
-  transit_gateway_route_table_id = aws_ec2_transit_gateway.example.association_default_route_table_id
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Ec2TransitGatewayRoute } from "./.gen/providers/aws/ec2-transit-gateway-route";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Ec2TransitGatewayRoute(this, "example", {
+      blackhole: true,
+      destinationCidrBlock: "0.0.0.0/0",
+      transitGatewayRouteTableId: Token.asString(
+        awsEc2TransitGatewayExample.associationDefaultRouteTableId
+      ),
+    });
+  }
 }
+
 ```
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `destinationCidrBlock` - (Required) IPv4 or IPv6 RFC1924 CIDR used for destination matches. Routing decisions are based on the most specific match.
 * `transitGatewayAttachmentId` - (Optional) Identifier of EC2 Transit Gateway Attachment (required if `blackhole` is set to false).
 * `blackhole` - (Optional) Indicates whether to drop traffic that matches this route (default to `false`).
 * `transitGatewayRouteTableId` - (Required) Identifier of EC2 Transit Gateway Route Table.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - EC2 Transit Gateway Route Table identifier combined with destination
 
 ## Import
 
-`awsEc2TransitGatewayRoute` can be imported by using the EC2 Transit Gateway Route Table, an underscore, and the destination, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsEc2TransitGatewayRoute` using the EC2 Transit Gateway Route Table, an underscore, and the destination. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
 
 ```
-$ terraform import aws_ec2_transit_gateway_route.example tgw-rtb-12345678_0.0.0.0/0
+
+Using `terraform import`, import `awsEc2TransitGatewayRoute` using the EC2 Transit Gateway Route Table, an underscore, and the destination. For example:
+
+```console
+% terraform import aws_ec2_transit_gateway_route.example tgw-rtb-12345678_0.0.0.0/0
 ```
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-c1cd33512986d2076d7edfcf1ac44456fcdaf749f1f4263bf4eee8fa75071101 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-3f4289296824edee3b69e6fca23a5970445532afeb5abfc08517d091ea79a4c6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ec2_transit_gateway_route_table.html.markdown b/website/docs/cdktf/typescript/r/ec2_transit_gateway_route_table.html.markdown
index 61103f6bd36..09a294cc794 100644
--- a/website/docs/cdktf/typescript/r/ec2_transit_gateway_route_table.html.markdown
+++ b/website/docs/cdktf/typescript/r/ec2_transit_gateway_route_table.html.markdown
@@ -6,28 +6,44 @@ description: |-
   Manages an EC2 Transit Gateway Route Table
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Resource: aws_ec2_transit_gateway_route_table
 
 Manages an EC2 Transit Gateway Route Table.
 
 ## Example Usage
 
-```terraform
-resource "aws_ec2_transit_gateway_route_table" "example" {
-  transit_gateway_id = aws_ec2_transit_gateway.example.id
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Ec2TransitGatewayRouteTable } from "./.gen/providers/aws/ec2-transit-gateway-route-table";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Ec2TransitGatewayRouteTable(this, "example", {
+      transitGatewayId: Token.asString(awsEc2TransitGatewayExample.id),
+    });
+  }
 }
+
 ```
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `transitGatewayId` - (Required) Identifier of EC2 Transit Gateway.
 * `tags` - (Optional) Key-value tags for the EC2 Transit Gateway Route Table. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - EC2 Transit Gateway Route Table Amazon Resource Name (ARN).
 * `defaultAssociationRouteTable` - Boolean whether this is the default association route table for the EC2 Transit Gateway.
@@ -37,10 +53,24 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`awsEc2TransitGatewayRouteTable` can be imported by using the EC2 Transit Gateway Route Table identifier, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsEc2TransitGatewayRouteTable` using the EC2 Transit Gateway Route Table identifier. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
 
 ```
-$ terraform import aws_ec2_transit_gateway_route_table.example tgw-rtb-12345678
+
+Using `terraform import`, import `awsEc2TransitGatewayRouteTable` using the EC2 Transit Gateway Route Table identifier. For example:
+
+```console
+% terraform import aws_ec2_transit_gateway_route_table.example tgw-rtb-12345678
 ```
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-092be375f2f09f63bf27cf8ba5f401de29a29a0e18c98e42df9a11ae41925104 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-22bcd95f66a310e881b85f1b296248135302868e7015f65168f1d2d03e9aefba -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ec2_transit_gateway_route_table_association.html.markdown b/website/docs/cdktf/typescript/r/ec2_transit_gateway_route_table_association.html.markdown
index e8aa797c703..91ba1d6d470 100644
--- a/website/docs/cdktf/typescript/r/ec2_transit_gateway_route_table_association.html.markdown
+++ b/website/docs/cdktf/typescript/r/ec2_transit_gateway_route_table_association.html.markdown
@@ -6,29 +6,50 @@ description: |-
   Manages an EC2 Transit Gateway Route Table association
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Resource: aws_ec2_transit_gateway_route_table_association
 
 Manages an EC2 Transit Gateway Route Table association.
 
 ## Example Usage
 
-```terraform
-resource "aws_ec2_transit_gateway_route_table_association" "example" {
-  transit_gateway_attachment_id  = aws_ec2_transit_gateway_vpc_attachment.example.id
-  transit_gateway_route_table_id = aws_ec2_transit_gateway_route_table.example.id
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Ec2TransitGatewayRouteTableAssociation } from "./.gen/providers/aws/ec2-transit-gateway-route-table-association";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Ec2TransitGatewayRouteTableAssociation(this, "example", {
+      transitGatewayAttachmentId: Token.asString(
+        awsEc2TransitGatewayVpcAttachmentExample.id
+      ),
+      transitGatewayRouteTableId: Token.asString(
+        awsEc2TransitGatewayRouteTableExample.id
+      ),
+    });
+  }
 }
+
 ```
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `transitGatewayAttachmentId` - (Required) Identifier of EC2 Transit Gateway Attachment.
 * `transitGatewayRouteTableId` - (Required) Identifier of EC2 Transit Gateway Route Table.
+* `replaceExistingAssociation` - (Optional) Boolean whether the Gateway Attachment should remove any current Route Table association before associating with the specified Route Table. Default value: `false`. This argument is intended for use with EC2 Transit Gateways shared into the current account, otherwise the `transitGatewayDefaultRouteTableAssociation` argument of the `awsEc2TransitGatewayVpcAttachment` resource should be used.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - EC2 Transit Gateway Route Table identifier combined with EC2 Transit Gateway Attachment identifier
 * `resourceId` - Identifier of the resource
@@ -36,10 +57,24 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`awsEc2TransitGatewayRouteTableAssociation` can be imported by using the EC2 Transit Gateway Route Table identifier, an underscore, and the EC2 Transit Gateway Attachment identifier, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsEc2TransitGatewayRouteTableAssociation` using the EC2 Transit Gateway Route Table identifier, an underscore, and the EC2 Transit Gateway Attachment identifier. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
 
 ```
-$ terraform import aws_ec2_transit_gateway_route_table_association.example tgw-rtb-12345678_tgw-attach-87654321
+
+Using `terraform import`, import `awsEc2TransitGatewayRouteTableAssociation` using the EC2 Transit Gateway Route Table identifier, an underscore, and the EC2 Transit Gateway Attachment identifier. For example:
+
+```console
+% terraform import aws_ec2_transit_gateway_route_table_association.example tgw-rtb-12345678_tgw-attach-87654321
 ```
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-e8bd264e123bc7d73d8d6836f2d3010e1b9d33e09d6d8cab85d400cbc4c35f21 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-3ac16f5f12533178bcc9006668852009e911e3309377a5bca5cfb4099f491912 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ec2_transit_gateway_route_table_propagation.html.markdown b/website/docs/cdktf/typescript/r/ec2_transit_gateway_route_table_propagation.html.markdown
index 49921b2b128..57d868ba1b7 100644
--- a/website/docs/cdktf/typescript/r/ec2_transit_gateway_route_table_propagation.html.markdown
+++ b/website/docs/cdktf/typescript/r/ec2_transit_gateway_route_table_propagation.html.markdown
@@ -6,29 +6,49 @@ description: |-
   Manages an EC2 Transit Gateway Route Table propagation
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Resource: aws_ec2_transit_gateway_route_table_propagation
 
 Manages an EC2 Transit Gateway Route Table propagation.
 
 ## Example Usage
 
-```terraform
-resource "aws_ec2_transit_gateway_route_table_propagation" "example" {
-  transit_gateway_attachment_id  = aws_ec2_transit_gateway_vpc_attachment.example.id
-  transit_gateway_route_table_id = aws_ec2_transit_gateway_route_table.example.id
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Ec2TransitGatewayRouteTablePropagation } from "./.gen/providers/aws/ec2-transit-gateway-route-table-propagation";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Ec2TransitGatewayRouteTablePropagation(this, "example", {
+      transitGatewayAttachmentId: Token.asString(
+        awsEc2TransitGatewayVpcAttachmentExample.id
+      ),
+      transitGatewayRouteTableId: Token.asString(
+        awsEc2TransitGatewayRouteTableExample.id
+      ),
+    });
+  }
 }
+
 ```
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `transitGatewayAttachmentId` - (Required) Identifier of EC2 Transit Gateway Attachment.
 * `transitGatewayRouteTableId` - (Required) Identifier of EC2 Transit Gateway Route Table.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - EC2 Transit Gateway Route Table identifier combined with EC2 Transit Gateway Attachment identifier
 * `resourceId` - Identifier of the resource
@@ -36,10 +56,24 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`awsEc2TransitGatewayRouteTablePropagation` can be imported by using the EC2 Transit Gateway Route Table identifier, an underscore, and the EC2 Transit Gateway Attachment identifier, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsEc2TransitGatewayRouteTablePropagation` using the EC2 Transit Gateway Route Table identifier, an underscore, and the EC2 Transit Gateway Attachment identifier. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
 
 ```
-$ terraform import aws_ec2_transit_gateway_route_table_propagation.example tgw-rtb-12345678_tgw-attach-87654321
+
+Using `terraform import`, import `awsEc2TransitGatewayRouteTablePropagation` using the EC2 Transit Gateway Route Table identifier, an underscore, and the EC2 Transit Gateway Attachment identifier. For example:
+
+```console
+% terraform import aws_ec2_transit_gateway_route_table_propagation.example tgw-rtb-12345678_tgw-attach-87654321
 ```
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-3f7fc604735b965a0bdab490984fe7efcec8e99742613ec9237376463dd81611 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-0296774da3cc7e6a2540fcd890af389ccf67fa4d39cf5ee59832361eca60bcc4 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ec2_transit_gateway_vpc_attachment.html.markdown b/website/docs/cdktf/typescript/r/ec2_transit_gateway_vpc_attachment.html.markdown
index d188b741ff5..1125a1672b6 100644
--- a/website/docs/cdktf/typescript/r/ec2_transit_gateway_vpc_attachment.html.markdown
+++ b/website/docs/cdktf/typescript/r/ec2_transit_gateway_vpc_attachment.html.markdown
@@ -6,25 +6,41 @@ description: |-
   Manages an EC2 Transit Gateway VPC Attachment
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Resource: aws_ec2_transit_gateway_vpc_attachment
 
 Manages an EC2 Transit Gateway VPC Attachment. For examples of custom route table association and propagation, see the EC2 Transit Gateway Networking Examples Guide.
 
 ## Example Usage
 
-```terraform
-resource "aws_ec2_transit_gateway_vpc_attachment" "example" {
-  subnet_ids         = [aws_subnet.example.id]
-  transit_gateway_id = aws_ec2_transit_gateway.example.id
-  vpc_id             = aws_vpc.example.id
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Ec2TransitGatewayVpcAttachment } from "./.gen/providers/aws/ec2-transit-gateway-vpc-attachment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Ec2TransitGatewayVpcAttachment(this, "example", {
+      subnetIds: [Token.asString(awsSubnetExample.id)],
+      transitGatewayId: Token.asString(awsEc2TransitGatewayExample.id),
+      vpcId: Token.asString(awsVpcExample.id),
+    });
+  }
 }
+
 ```
 
 A full example of how to create a Transit Gateway in one AWS account, share it with a second AWS account, and attach a VPC in the second account to the Transit Gateway via the `awsEc2TransitGatewayVpcAttachment` and `awsEc2TransitGatewayVpcAttachmentAccepter` resources can be found in [the `/examples/transitGatewayCrossAccountVpcAttachment` directory within the Github Repository](https://github.com/hashicorp/terraform-provider-aws/tree/main/examples/transit-gateway-cross-account-vpc-attachment).
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `subnetIds` - (Required) Identifiers of EC2 Subnets.
 * `transitGatewayId` - (Required) Identifier of EC2 Transit Gateway.
@@ -36,9 +52,9 @@ The following arguments are supported:
 * `transitGatewayDefaultRouteTableAssociation` - (Optional) Boolean whether the VPC Attachment should be associated with the EC2 Transit Gateway association default route table. This cannot be configured or perform drift detection with Resource Access Manager shared EC2 Transit Gateways. Default value: `true`.
 * `transitGatewayDefaultRouteTablePropagation` - (Optional) Boolean whether the VPC Attachment should propagate routes with the EC2 Transit Gateway propagation default route table. This cannot be configured or perform drift detection with Resource Access Manager shared EC2 Transit Gateways. Default value: `true`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - EC2 Transit Gateway Attachment identifier
 * `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
@@ -46,10 +62,24 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`awsEc2TransitGatewayVpcAttachment` can be imported by using the EC2 Transit Gateway Attachment identifier, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsEc2TransitGatewayVpcAttachment` using the EC2 Transit Gateway Attachment identifier. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
 
 ```
-$ terraform import aws_ec2_transit_gateway_vpc_attachment.example tgw-attach-12345678
+
+Using `terraform import`, import `awsEc2TransitGatewayVpcAttachment` using the EC2 Transit Gateway Attachment identifier. For example:
+
+```console
+% terraform import aws_ec2_transit_gateway_vpc_attachment.example tgw-attach-12345678
 ```
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-542104b0b8b14cf70d217cb89d2940711fa38ea1e89aed4d0f46c3315423c656 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-e76943b879789e9aa1c622ff0379f66692ea0b317120aa63e121af64f6a6d4c3 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ec2_transit_gateway_vpc_attachment_accepter.html.markdown b/website/docs/cdktf/typescript/r/ec2_transit_gateway_vpc_attachment_accepter.html.markdown
index 90fe5a37126..f7a330f098f 100644
--- a/website/docs/cdktf/typescript/r/ec2_transit_gateway_vpc_attachment_accepter.html.markdown
+++ b/website/docs/cdktf/typescript/r/ec2_transit_gateway_vpc_attachment_accepter.html.markdown
@@ -6,6 +6,8 @@ description: |-
   Manages the accepter's side of an EC2 Transit Gateway VPC Attachment
 ---
 
+
+<!-- Please do not edit this file, it is generated. -->
 # Resource: aws_ec2_transit_gateway_vpc_attachment_accepter
 
 Manages the accepter's side of an EC2 Transit Gateway VPC Attachment.
@@ -18,30 +20,45 @@ connection into management.
 
 ## Example Usage
 
-```terraform
-resource "aws_ec2_transit_gateway_vpc_attachment_accepter" "example" {
-  transit_gateway_attachment_id = aws_ec2_transit_gateway_vpc_attachment.example.id
-
-  tags = {
-    Name = "Example cross-account attachment"
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Ec2TransitGatewayVpcAttachmentAccepter } from "./.gen/providers/aws/ec2-transit-gateway-vpc-attachment-accepter";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Ec2TransitGatewayVpcAttachmentAccepter(this, "example", {
+      tags: {
+        Name: "Example cross-account attachment",
+      },
+      transitGatewayAttachmentId: Token.asString(
+        awsEc2TransitGatewayVpcAttachmentExample.id
+      ),
+    });
   }
 }
+
 ```
 
 A full example of how to create a Transit Gateway in one AWS account, share it with a second AWS account, and attach a VPC in the second account to the Transit Gateway via the `awsEc2TransitGatewayVpcAttachment` and `awsEc2TransitGatewayVpcAttachmentAccepter` resources can be found in [the `/examples/transitGatewayCrossAccountVpcAttachment` directory within the Github Repository](https://github.com/hashicorp/terraform-provider-aws/tree/main/examples/transit-gateway-cross-account-vpc-attachment).
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `transitGatewayAttachmentId` - (Required) The ID of the EC2 Transit Gateway Attachment to manage.
 * `transitGatewayDefaultRouteTableAssociation` - (Optional) Boolean whether the VPC Attachment should be associated with the EC2 Transit Gateway association default route table. Default value: `true`.
 * `transitGatewayDefaultRouteTablePropagation` - (Optional) Boolean whether the VPC Attachment should propagate routes with the EC2 Transit Gateway propagation default route table. Default value: `true`.
 * `tags` - (Optional) Key-value tags for the EC2 Transit Gateway VPC Attachment. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - EC2 Transit Gateway Attachment identifier
 * `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
@@ -55,10 +72,24 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`awsEc2TransitGatewayVpcAttachmentAccepter` can be imported by using the EC2 Transit Gateway Attachment identifier, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsEc2TransitGatewayVpcAttachmentAccepter` using the EC2 Transit Gateway Attachment identifier. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
 
 ```
-$ terraform import aws_ec2_transit_gateway_vpc_attachment_accepter.example tgw-attach-12345678
+
+Using `terraform import`, import `awsEc2TransitGatewayVpcAttachmentAccepter` using the EC2 Transit Gateway Attachment identifier. For example:
+
+```console
+% terraform import aws_ec2_transit_gateway_vpc_attachment_accepter.example tgw-attach-12345678
 ```
 
-<!-- cache-key: cdktf-0.17.0-pre.15 input-232f5fcd8a6ad2c2a3f3e13403cef004626b48c5673a3cce15a3172b9006d2c5 -->
\ No newline at end of file
+<!-- cache-key: cdktf-0.18.0 input-ecbf6dbf5eb02fc6c50aa5f135ccaddf1f97a389191703614a66b382e746bf66 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ecr_lifecycle_policy.html.markdown b/website/docs/cdktf/typescript/r/ecr_lifecycle_policy.html.markdown
new file mode 100644
index 00000000000..bde994c47ee
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/ecr_lifecycle_policy.html.markdown
@@ -0,0 +1,113 @@
+---
+subcategory: "ECR (Elastic Container Registry)"
+layout: "aws"
+page_title: "AWS: aws_ecr_lifecycle_policy"
+description: |-
+  Manages an ECR repository lifecycle policy.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ecr_lifecycle_policy
+
+Manages an ECR repository lifecycle policy.
+
+~> **NOTE:** Only one `awsEcrLifecyclePolicy` resource can be used with the same ECR repository. To apply multiple rules, they must be combined in the `policy` JSON.
+
+~> **NOTE:** The AWS ECR API seems to reorder rules based on `rulePriority`. If you define multiple rules that are not sorted in ascending `rulePriority` order in the Terraform code, the resource will be flagged for recreation every `terraform plan`.
+
+## Example Usage
+
+### Policy on untagged image
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EcrLifecyclePolicy } from "./.gen/providers/aws/ecr-lifecycle-policy";
+import { EcrRepository } from "./.gen/providers/aws/ecr-repository";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const foo = new EcrRepository(this, "foo", {
+      name: "bar",
+    });
+    new EcrLifecyclePolicy(this, "foopolicy", {
+      policy:
+        '{\n    "rules": [\n        {\n            "rulePriority": 1,\n            "description": "Expire images older than 14 days",\n            "selection": {\n                "tagStatus": "untagged",\n                "countType": "sinceImagePushed",\n                "countUnit": "days",\n                "countNumber": 14\n            },\n            "action": {\n                "type": "expire"\n            }\n        }\n    ]\n}\n\n',
+      repository: foo.name,
+    });
+  }
+}
+
+```
+
+### Policy on tagged image
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EcrLifecyclePolicy } from "./.gen/providers/aws/ecr-lifecycle-policy";
+import { EcrRepository } from "./.gen/providers/aws/ecr-repository";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const foo = new EcrRepository(this, "foo", {
+      name: "bar",
+    });
+    new EcrLifecyclePolicy(this, "foopolicy", {
+      policy:
+        '{\n    "rules": [\n        {\n            "rulePriority": 1,\n            "description": "Keep last 30 images",\n            "selection": {\n                "tagStatus": "tagged",\n                "tagPrefixList": ["v"],\n                "countType": "imageCountMoreThan",\n                "countNumber": 30\n            },\n            "action": {\n                "type": "expire"\n            }\n        }\n    ]\n}\n\n',
+      repository: foo.name,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `repository` - (Required) Name of the repository to apply the policy.
+* `policy` - (Required) The policy document. This is a JSON formatted string. See more details about [Policy Parameters](http://docs.aws.amazon.com/AmazonECR/latest/userguide/LifecyclePolicies.html#lifecycle_policy_parameters) in the official AWS docs.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `repository` - The name of the repository.
+* `registryId` - The registry ID where the repository was created.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import ECR Lifecycle Policy using the name of the repository. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import ECR Lifecycle Policy using the name of the repository. For example:
+
+```console
+% terraform import aws_ecr_lifecycle_policy.example tf-example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-0e4c7e8c7cdaee9fd0d8211aaa75d4db1e461d9cccef8d7c28f406dede927735 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ecr_pull_through_cache_rule.html.markdown b/website/docs/cdktf/typescript/r/ecr_pull_through_cache_rule.html.markdown
new file mode 100644
index 00000000000..f289bff93e3
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/ecr_pull_through_cache_rule.html.markdown
@@ -0,0 +1,76 @@
+---
+subcategory: "ECR (Elastic Container Registry)"
+layout: "aws"
+page_title: "AWS: aws_ecr_pull_through_cache_rule"
+description: |-
+  Provides an Elastic Container Registry Pull Through Cache Rule.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ecr_pull_through_cache_rule
+
+Provides an Elastic Container Registry Pull Through Cache Rule.
+
+More information about pull through cache rules, including the set of supported
+upstream repositories, see [Using pull through cache rules](https://docs.aws.amazon.com/AmazonECR/latest/userguide/pull-through-cache.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EcrPullThroughCacheRule } from "./.gen/providers/aws/ecr-pull-through-cache-rule";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new EcrPullThroughCacheRule(this, "example", {
+      ecrRepositoryPrefix: "ecr-public",
+      upstreamRegistryUrl: "public.ecr.aws",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `ecrRepositoryPrefix` - (Required, Forces new resource) The repository name prefix to use when caching images from the source registry.
+* `upstreamRegistryUrl` - (Required, Forces new resource) The registry URL of the upstream public registry to use as the source.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `registryId` - The registry ID where the repository was created.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import a pull-through cache rule using the `ecrRepositoryPrefix`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import a pull-through cache rule using the `ecrRepositoryPrefix`. For example:
+
+```console
+% terraform import aws_ecr_pull_through_cache_rule.example ecr-public
+```
+
+<!-- cache-key: cdktf-0.18.0 input-6f34bbf2ac113908932d429c51221ac1598eaf73e0c126d6199e75b0b3c98d1b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ecr_registry_policy.html.markdown b/website/docs/cdktf/typescript/r/ecr_registry_policy.html.markdown
new file mode 100644
index 00000000000..d28f3c30534
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/ecr_registry_policy.html.markdown
@@ -0,0 +1,109 @@
+---
+subcategory: "ECR (Elastic Container Registry)"
+layout: "aws"
+page_title: "AWS: aws_ecr_registry_policy"
+description: |-
+  Provides an Elastic Container Registry Policy.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ecr_registry_policy
+
+Provides an Elastic Container Registry Policy.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCallerIdentity } from "./.gen/providers/aws/data-aws-caller-identity";
+import { DataAwsPartition } from "./.gen/providers/aws/data-aws-partition";
+import { DataAwsRegion } from "./.gen/providers/aws/data-aws-region";
+import { EcrRegistryPolicy } from "./.gen/providers/aws/ecr-registry-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const current = new DataAwsCallerIdentity(this, "current", {});
+    const dataAwsPartitionCurrent = new DataAwsPartition(this, "current_1", {});
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsPartitionCurrent.overrideLogicalId("current");
+    const dataAwsRegionCurrent = new DataAwsRegion(this, "current_2", {});
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsRegionCurrent.overrideLogicalId("current");
+    new EcrRegistryPolicy(this, "example", {
+      policy: Token.asString(
+        Fn.jsonencode({
+          Statement: [
+            {
+              Action: ["ecr:ReplicateImage"],
+              Effect: "Allow",
+              Principal: {
+                AWS:
+                  "arn:${" +
+                  dataAwsPartitionCurrent.partition +
+                  "}:iam::${" +
+                  current.accountId +
+                  "}:root",
+              },
+              Resource: [
+                "arn:${" +
+                  dataAwsPartitionCurrent.partition +
+                  "}:ecr:${" +
+                  dataAwsRegionCurrent.name +
+                  "}:${" +
+                  current.accountId +
+                  "}:repository/*",
+              ],
+              Sid: "testpolicy",
+            },
+          ],
+          Version: "2012-10-17",
+        })
+      ),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `policy` - (Required) The policy document. This is a JSON formatted string. For more information about building IAM policy documents with Terraform, see the [AWS IAM Policy Document Guide](https://learn.hashicorp.com/terraform/aws/iam-policy)
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `registryId` - The registry ID where the registry was created.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import ECR Registry Policy using the registry id. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import ECR Registry Policy using the registry id. For example:
+
+```console
+% terraform import aws_ecr_registry_policy.example 123456789012
+```
+
+<!-- cache-key: cdktf-0.18.0 input-a8b9e1b12da0ab4f7f9e19fe22a9fd339fcf53514637769a293dcb91b039f9b6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ecr_registry_scanning_configuration.html.markdown b/website/docs/cdktf/typescript/r/ecr_registry_scanning_configuration.html.markdown
new file mode 100644
index 00000000000..6eba93c6d04
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/ecr_registry_scanning_configuration.html.markdown
@@ -0,0 +1,132 @@
+---
+subcategory: "ECR (Elastic Container Registry)"
+layout: "aws"
+page_title: "AWS: aws_ecr_registry_scanning_configuration"
+description: |-
+  Provides an Elastic Container Registry Scanning Configuration.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ecr_registry_scanning_configuration
+
+Provides an Elastic Container Registry Scanning Configuration. Can't be completely deleted, instead reverts to the default `basic` scanning configuration without rules.
+
+## Example Usage
+
+### Basic example
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EcrRegistryScanningConfiguration } from "./.gen/providers/aws/ecr-registry-scanning-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new EcrRegistryScanningConfiguration(this, "configuration", {
+      rule: [
+        {
+          repositoryFilter: [
+            {
+              filter: "example",
+              filterType: "WILDCARD",
+            },
+          ],
+          scanFrequency: "CONTINUOUS_SCAN",
+        },
+      ],
+      scanType: "ENHANCED",
+    });
+  }
+}
+
+```
+
+### Multiple rules
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EcrRegistryScanningConfiguration } from "./.gen/providers/aws/ecr-registry-scanning-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new EcrRegistryScanningConfiguration(this, "test", {
+      rule: [
+        {
+          repositoryFilter: [
+            {
+              filter: "*",
+              filterType: "WILDCARD",
+            },
+          ],
+          scanFrequency: "SCAN_ON_PUSH",
+        },
+        {
+          repositoryFilter: [
+            {
+              filter: "example",
+              filterType: "WILDCARD",
+            },
+          ],
+          scanFrequency: "CONTINUOUS_SCAN",
+        },
+      ],
+      scanType: "ENHANCED",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+- `scanType` - (Required) the scanning type to set for the registry. Can be either `enhanced` or `basic`.
+- `rule` - (Optional) One or multiple blocks specifying scanning rules to determine which repository filters are used and at what frequency scanning will occur. See [below for schema](#rule).
+
+### rule
+
+- `repositoryFilter` - (Required) One or more repository filter blocks, containing a `filter` (required string filtering repositories, see pattern regex [here](https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_ScanningRepositoryFilter.html)) and a `filterType` (required string, currently only `wildcard` is supported).
+- `scanFrequency` - (Required) The frequency that scans are performed at for a private registry. Can be `scanOnPush`, `continuousScan`, or `manual`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `registryId` - The registry ID the scanning configuration applies to.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import ECR Scanning Configurations using the `registryId`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import ECR Scanning Configurations using the `registryId`. For example:
+
+```console
+% terraform import aws_ecr_registry_scanning_configuration.example 012345678901
+```
+
+<!-- cache-key: cdktf-0.18.0 input-878f43063e7870789fdafbc4e35da8eca405013c513258165088a92488bbfa61 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ecr_replication_configuration.html.markdown b/website/docs/cdktf/typescript/r/ecr_replication_configuration.html.markdown
new file mode 100644
index 00000000000..3bdefa6c37e
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/ecr_replication_configuration.html.markdown
@@ -0,0 +1,198 @@
+---
+subcategory: "ECR (Elastic Container Registry)"
+layout: "aws"
+page_title: "AWS: aws_ecr_replication_configuration"
+description: |-
+  Provides an Elastic Container Registry Replication Configuration.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ecr_replication_configuration
+
+Provides an Elastic Container Registry Replication Configuration.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCallerIdentity } from "./.gen/providers/aws/data-aws-caller-identity";
+import { DataAwsRegions } from "./.gen/providers/aws/data-aws-regions";
+import { EcrReplicationConfiguration } from "./.gen/providers/aws/ecr-replication-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const current = new DataAwsCallerIdentity(this, "current", {});
+    const example = new DataAwsRegions(this, "example", {});
+    const awsEcrReplicationConfigurationExample =
+      new EcrReplicationConfiguration(this, "example_2", {
+        replicationConfiguration: {
+          rule: [
+            {
+              destination: [
+                {
+                  region: Token.asString(Fn.lookupNested(example.names, ["0"])),
+                  registryId: Token.asString(current.accountId),
+                },
+              ],
+            },
+          ],
+        },
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsEcrReplicationConfigurationExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Multiple Region Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCallerIdentity } from "./.gen/providers/aws/data-aws-caller-identity";
+import { DataAwsRegions } from "./.gen/providers/aws/data-aws-regions";
+import { EcrReplicationConfiguration } from "./.gen/providers/aws/ecr-replication-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const current = new DataAwsCallerIdentity(this, "current", {});
+    const example = new DataAwsRegions(this, "example", {});
+    const awsEcrReplicationConfigurationExample =
+      new EcrReplicationConfiguration(this, "example_2", {
+        replicationConfiguration: {
+          rule: [
+            {
+              destination: [
+                {
+                  region: Token.asString(Fn.lookupNested(example.names, ["0"])),
+                  registryId: Token.asString(current.accountId),
+                },
+                {
+                  region: Token.asString(Fn.lookupNested(example.names, ["1"])),
+                  registryId: Token.asString(current.accountId),
+                },
+              ],
+            },
+          ],
+        },
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsEcrReplicationConfigurationExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Repository Filter Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCallerIdentity } from "./.gen/providers/aws/data-aws-caller-identity";
+import { DataAwsRegions } from "./.gen/providers/aws/data-aws-regions";
+import { EcrReplicationConfiguration } from "./.gen/providers/aws/ecr-replication-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const current = new DataAwsCallerIdentity(this, "current", {});
+    const example = new DataAwsRegions(this, "example", {});
+    const awsEcrReplicationConfigurationExample =
+      new EcrReplicationConfiguration(this, "example_2", {
+        replicationConfiguration: {
+          rule: [
+            {
+              destination: [
+                {
+                  region: Token.asString(Fn.lookupNested(example.names, ["0"])),
+                  registryId: Token.asString(current.accountId),
+                },
+              ],
+              repositoryFilter: [
+                {
+                  filter: "prod-microservice",
+                  filterType: "PREFIX_MATCH",
+                },
+              ],
+            },
+          ],
+        },
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsEcrReplicationConfigurationExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `replicationConfiguration` - (Required) Replication configuration for a registry. See [Replication Configuration](#replication-configuration).
+
+### Replication Configuration
+
+* `rule` - (Required) The replication rules for a replication configuration. A maximum of 10 are allowed per `replicationConfiguration`. See [Rule](#rule)
+
+### Rule
+
+* `destination` - (Required) the details of a replication destination. A maximum of 25 are allowed per `rule`. See [Destination](#destination).
+* `repositoryFilter` - (Optional) filters for a replication rule. See [Repository Filter](#repository-filter).
+
+### Destination
+
+* `region` - (Required) A Region to replicate to.
+* `registryId` - (Required) The account ID of the destination registry to replicate to.
+
+### Repository Filter
+
+* `filter` - (Required) The repository filter details.
+* `filterType` - (Required) The repository filter type. The only supported value is `prefixMatch`, which is a repository name prefix specified with the filter parameter.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `registryId` - The registry ID where the replication configuration was created.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import ECR Replication Configuration using the `registryId`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import ECR Replication Configuration using the `registryId`. For example:
+
+```console
+% terraform import aws_ecr_replication_configuration.service 012345678912
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1e720b09bffb1410913da15b1daa4aaef042cc175055603ba3335ca4406730fc -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ecr_repository.html.markdown b/website/docs/cdktf/typescript/r/ecr_repository.html.markdown
new file mode 100644
index 00000000000..0dce42cd86f
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/ecr_repository.html.markdown
@@ -0,0 +1,96 @@
+---
+subcategory: "ECR (Elastic Container Registry)"
+layout: "aws"
+page_title: "AWS: aws_ecr_repository"
+description: |-
+  Provides an Elastic Container Registry Repository.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ecr_repository
+
+Provides an Elastic Container Registry Repository.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EcrRepository } from "./.gen/providers/aws/ecr-repository";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new EcrRepository(this, "foo", {
+      imageScanningConfiguration: {
+        scanOnPush: true,
+      },
+      imageTagMutability: "MUTABLE",
+      name: "bar",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) Name of the repository.
+* `encryptionConfiguration` - (Optional) Encryption configuration for the repository. See [below for schema](#encryption_configuration).
+* `forceDelete` - (Optional) If `true`, will delete the repository even if it contains images.
+  Defaults to `false`.
+* `imageTagMutability` - (Optional) The tag mutability setting for the repository. Must be one of: `mutable` or `immutable`. Defaults to `mutable`.
+* `imageScanningConfiguration` - (Optional) Configuration block that defines image scanning configuration for the repository. By default, image scanning must be manually triggered. See the [ECR User Guide](https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html) for more information about image scanning.
+    * `scanOnPush` - (Required) Indicates whether images are scanned after being pushed to the repository (true) or not scanned (false).
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### encryption_configuration
+
+* `encryptionType` - (Optional) The encryption type to use for the repository. Valid values are `aes256` or `kms`. Defaults to `aes256`.
+* `kmsKey` - (Optional) The ARN of the KMS key to use when `encryptionType` is `kms`. If not specified, uses the default AWS managed key for ECR.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Full ARN of the repository.
+* `registryId` - The registry ID where the repository was created.
+* `repositoryUrl` - The URL of the repository (in the form `awsAccountIdDkrEcrRegionAmazonawsCom/repositoryName`).
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `delete` - (Default `20M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import ECR Repositories using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import ECR Repositories using the `name`. For example:
+
+```console
+% terraform import aws_ecr_repository.service test-service
+```
+
+<!-- cache-key: cdktf-0.18.0 input-e1209b507b315e404a10f48d280e6590a59e9ffd637d877733fc8905cf37de81 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ecr_repository_policy.html.markdown b/website/docs/cdktf/typescript/r/ecr_repository_policy.html.markdown
new file mode 100644
index 00000000000..8003330e0f1
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/ecr_repository_policy.html.markdown
@@ -0,0 +1,117 @@
+---
+subcategory: "ECR (Elastic Container Registry)"
+layout: "aws"
+page_title: "AWS: aws_ecr_repository_policy"
+description: |-
+  Provides an Elastic Container Registry Repository Policy.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ecr_repository_policy
+
+Provides an Elastic Container Registry Repository Policy.
+
+Note that currently only one policy may be applied to a repository.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { EcrRepository } from "./.gen/providers/aws/ecr-repository";
+import { EcrRepositoryPolicy } from "./.gen/providers/aws/ecr-repository-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const foo = new EcrRepository(this, "foo", {
+      name: "bar",
+    });
+    const foopolicy = new DataAwsIamPolicyDocument(this, "foopolicy", {
+      statement: [
+        {
+          actions: [
+            "ecr:GetDownloadUrlForLayer",
+            "ecr:BatchGetImage",
+            "ecr:BatchCheckLayerAvailability",
+            "ecr:PutImage",
+            "ecr:InitiateLayerUpload",
+            "ecr:UploadLayerPart",
+            "ecr:CompleteLayerUpload",
+            "ecr:DescribeRepositories",
+            "ecr:GetRepositoryPolicy",
+            "ecr:ListImages",
+            "ecr:DeleteRepository",
+            "ecr:BatchDeleteImage",
+            "ecr:SetRepositoryPolicy",
+            "ecr:DeleteRepositoryPolicy",
+          ],
+          effect: "Allow",
+          principals: [
+            {
+              identifiers: ["123456789012"],
+              type: "AWS",
+            },
+          ],
+          sid: "new policy",
+        },
+      ],
+    });
+    const awsEcrRepositoryPolicyFoopolicy = new EcrRepositoryPolicy(
+      this,
+      "foopolicy_2",
+      {
+        policy: Token.asString(foopolicy.json),
+        repository: foo.name,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsEcrRepositoryPolicyFoopolicy.overrideLogicalId("foopolicy");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `repository` - (Required) Name of the repository to apply the policy.
+* `policy` - (Required) The policy document. This is a JSON formatted string. For more information about building IAM policy documents with Terraform, see the [AWS IAM Policy Document Guide](https://learn.hashicorp.com/terraform/aws/iam-policy)
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `repository` - The name of the repository.
+* `registryId` - The registry ID where the repository was created.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import ECR Repository Policy using the repository name. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import ECR Repository Policy using the repository name. For example:
+
+```console
+% terraform import aws_ecr_repository_policy.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-0bb26796a34294f42562707b8dbdd994b19d2487ea08fdd2ae6fdedbc68aee00 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ecrpublic_repository.html.markdown b/website/docs/cdktf/typescript/r/ecrpublic_repository.html.markdown
new file mode 100644
index 00000000000..b70f0a0cfa1
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/ecrpublic_repository.html.markdown
@@ -0,0 +1,111 @@
+---
+subcategory: "ECR Public"
+layout: "aws"
+page_title: "AWS: aws_ecrpublic_repository"
+description: |-
+  Provides a Public Elastic Container Registry Repository.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ecrpublic_repository
+
+Provides a Public Elastic Container Registry Repository.
+
+~> **NOTE:** This resource can only be used in the `usEast1` region.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EcrpublicRepository } from "./.gen/providers/aws/ecrpublic-repository";
+import { AwsProvider } from "./.gen/providers/aws/provider";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const usEast1 = new AwsProvider(this, "aws", {
+      alias: "us_east_1",
+      region: "us-east-1",
+    });
+    new EcrpublicRepository(this, "foo", {
+      catalogData: {
+        aboutText: "About Text",
+        architectures: ["ARM"],
+        description: "Description",
+        logoImageBlob: Token.asString(Fn.filebase64(png)),
+        operatingSystems: ["Linux"],
+        usageText: "Usage Text",
+      },
+      provider: usEast1,
+      repositoryName: "bar",
+      tags: {
+        env: "production",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `repositoryName` - (Required) Name of the repository.
+* `catalogData` - (Optional) Catalog data configuration for the repository. See [below for schema](#catalog_data).
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### catalog_data
+
+* `aboutText` - (Optional) A detailed description of the contents of the repository. It is publicly visible in the Amazon ECR Public Gallery. The text must be in markdown format.
+* `architectures` - (Optional) The system architecture that the images in the repository are compatible with. On the Amazon ECR Public Gallery, the following supported architectures will appear as badges on the repository and are used as search filters: `arm`, `ARM 64`, `x86`, `x8664`
+* `description` - (Optional) A short description of the contents of the repository. This text appears in both the image details and also when searching for repositories on the Amazon ECR Public Gallery.
+* `logoImageBlob` - (Optional) The base64-encoded repository logo payload. (Only visible for verified accounts) Note that drift detection is disabled for this attribute.
+* `operatingSystems` -  (Optional) The operating systems that the images in the repository are compatible with. On the Amazon ECR Public Gallery, the following supported operating systems will appear as badges on the repository and are used as search filters: `linux`, `windows`
+* `usageText` -  (Optional) Detailed information on how to use the contents of the repository. It is publicly visible in the Amazon ECR Public Gallery. The usage text provides context, support information, and additional usage details for users of the repository. The text must be in markdown format.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Full ARN of the repository.
+* `id` - The repository name.
+* `registryId` - The registry ID where the repository was created.
+* `repositoryUri` - The URI of the repository.
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `delete` - (Default `20M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import ECR Public Repositories using the `repositoryName`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import ECR Public Repositories using the `repositoryName`. For example:
+
+```console
+% terraform import aws_ecrpublic_repository.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-0eb50922129c99699d4703ec9d9700079393eb47686643926f7ecccc4d057b7c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ecrpublic_repository_policy.html.markdown b/website/docs/cdktf/typescript/r/ecrpublic_repository_policy.html.markdown
new file mode 100644
index 00000000000..0b1a6fc8194
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/ecrpublic_repository_policy.html.markdown
@@ -0,0 +1,124 @@
+---
+subcategory: "ECR Public"
+layout: "aws"
+page_title: "AWS: aws_ecrpublic_repository_policy"
+description: |-
+  Provides an Elastic Container Registry Public Repository Policy.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ecrpublic_repository_policy
+
+Provides an Elastic Container Registry Public Repository Policy.
+
+Note that currently only one policy may be applied to a repository.
+
+~> **NOTE:** This resource can only be used in the `usEast1` region.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { EcrpublicRepository } from "./.gen/providers/aws/ecrpublic-repository";
+import { EcrpublicRepositoryPolicy } from "./.gen/providers/aws/ecrpublic-repository-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new EcrpublicRepository(this, "example", {
+      repositoryName: "example",
+    });
+    const dataAwsIamPolicyDocumentExample = new DataAwsIamPolicyDocument(
+      this,
+      "example_1",
+      {
+        statement: [
+          {
+            actions: [
+              "ecr:GetDownloadUrlForLayer",
+              "ecr:BatchGetImage",
+              "ecr:BatchCheckLayerAvailability",
+              "ecr:PutImage",
+              "ecr:InitiateLayerUpload",
+              "ecr:UploadLayerPart",
+              "ecr:CompleteLayerUpload",
+              "ecr:DescribeRepositories",
+              "ecr:GetRepositoryPolicy",
+              "ecr:ListImages",
+              "ecr:DeleteRepository",
+              "ecr:BatchDeleteImage",
+              "ecr:SetRepositoryPolicy",
+              "ecr:DeleteRepositoryPolicy",
+            ],
+            effect: "Allow",
+            principals: [
+              {
+                identifiers: ["123456789012"],
+                type: "AWS",
+              },
+            ],
+            sid: "new policy",
+          },
+        ],
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsIamPolicyDocumentExample.overrideLogicalId("example");
+    const awsEcrpublicRepositoryPolicyExample = new EcrpublicRepositoryPolicy(
+      this,
+      "example_2",
+      {
+        policy: Token.asString(dataAwsIamPolicyDocumentExample.json),
+        repositoryName: example.repositoryName,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsEcrpublicRepositoryPolicyExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `repositoryName` - (Required) Name of the repository to apply the policy.
+* `policy` - (Required) The policy document. This is a JSON formatted string. For more information about building IAM policy documents with Terraform, see the [AWS IAM Policy Document Guide](https://learn.hashicorp.com/terraform/aws/iam-policy)
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `registryId` - The registry ID where the repository was created.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import ECR Public Repository Policy using the repository name. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import ECR Public Repository Policy using the repository name. For example:
+
+```console
+% terraform import aws_ecrpublic_repository_policy.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-5333277a8aafe52743e3f8ec371b6439d670b524be4655ccdec7e4c63f6b5fd0 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ecs_account_setting_default.html.markdown b/website/docs/cdktf/typescript/r/ecs_account_setting_default.html.markdown
new file mode 100644
index 00000000000..90272ae5371
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/ecs_account_setting_default.html.markdown
@@ -0,0 +1,78 @@
+---
+subcategory: "ECS (Elastic Container)"
+layout: "aws"
+page_title: "AWS: aws_ecs_account_setting_default"
+description: |-
+  Provides an ECS Default account setting.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ecs_account_setting_default
+
+Provides an ECS default account setting for a specific ECS Resource name within a specific region. More information can be found on the [ECS Developer Guide](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/ecs-account-settings.html).
+
+~> **NOTE:** The AWS API does not delete this resource. When you run `destroy`, the provider will attempt to disable the setting.
+
+~> **NOTE:** Your AWS account may not support disabling `containerInstanceLongArnFormat`, `serviceLongArnFormat`, and `taskLongArnFormat`. If your account does not support disabling these, "destroying" this resource will not disable the setting nor cause a Terraform error. However, the AWS Provider will log an AWS error: `InvalidParameterException: You can no longer disable Long Arn settings`.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EcsAccountSettingDefault } from "./.gen/providers/aws/ecs-account-setting-default";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new EcsAccountSettingDefault(this, "test", {
+      name: "taskLongArnFormat",
+      value: "enabled",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) Name of the account setting to set. Valid values are `serviceLongArnFormat`, `taskLongArnFormat`, `containerInstanceLongArnFormat`, `awsvpcTrunking` and `containerInsights`.
+* `value` - (Required) State of the setting. Valid values are `enabled` and `disabled`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - ARN that identifies the account setting.
+* `prinicpalArn` - ARN that identifies the account setting.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import ECS Account Setting defaults using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import ECS Account Setting defaults using the `name`. For example:
+
+```console
+% terraform import aws_ecs_account_setting_default.example taskLongArnFormat
+```
+
+<!-- cache-key: cdktf-0.18.0 input-c6b2c30bb370dbc4f2130758dcd1fab12e3335f271b897842de52c4e4af677af -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ecs_capacity_provider.html.markdown b/website/docs/cdktf/typescript/r/ecs_capacity_provider.html.markdown
new file mode 100644
index 00000000000..7dde2431aac
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/ecs_capacity_provider.html.markdown
@@ -0,0 +1,119 @@
+---
+subcategory: "ECS (Elastic Container)"
+layout: "aws"
+page_title: "AWS: aws_ecs_capacity_provider"
+description: |-
+  Provides an ECS cluster capacity provider.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ecs_capacity_provider
+
+Provides an ECS cluster capacity provider. More information can be found on the [ECS Developer Guide](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/cluster-capacity-providers.html).
+
+~> **NOTE:** Associating an ECS Capacity Provider to an Auto Scaling Group will automatically add the `amazonEcsManaged` tag to the Auto Scaling Group. This tag should be included in the `awsAutoscalingGroup` resource configuration to prevent Terraform from removing it in subsequent executions as well as ensuring the `amazonEcsManaged` tag is propagated to all EC2 Instances in the Auto Scaling Group if `minSize` is above 0 on creation. Any EC2 Instances in the Auto Scaling Group without this tag must be manually be updated, otherwise they may cause unexpected scaling behavior and metrics.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AutoscalingGroup } from "./.gen/providers/aws/autoscaling-group";
+import { EcsCapacityProvider } from "./.gen/providers/aws/ecs-capacity-provider";
+interface MyConfig {
+  maxSize: any;
+  minSize: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    const test = new AutoscalingGroup(this, "test", {
+      tag: [
+        {
+          key: "AmazonECSManaged",
+          propagateAtLaunch: true,
+          value: Token.asString(true),
+        },
+      ],
+      maxSize: config.maxSize,
+      minSize: config.minSize,
+    });
+    const awsEcsCapacityProviderTest = new EcsCapacityProvider(this, "test_1", {
+      autoScalingGroupProvider: {
+        autoScalingGroupArn: test.arn,
+        managedScaling: {
+          maximumScalingStepSize: 1000,
+          minimumScalingStepSize: 1,
+          status: "ENABLED",
+          targetCapacity: 10,
+        },
+        managedTerminationProtection: "ENABLED",
+      },
+      name: "test",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsEcsCapacityProviderTest.overrideLogicalId("test");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `autoScalingGroupProvider` - (Required) Configuration block for the provider for the ECS auto scaling group. Detailed below.
+* `name` - (Required) Name of the capacity provider.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### `autoScalingGroupProvider`
+
+* `autoScalingGroupArn` - (Required) - ARN of the associated auto scaling group.
+* `managedScaling` - (Optional) - Configuration block defining the parameters of the auto scaling. Detailed below.
+* `managedTerminationProtection` - (Optional) - Enables or disables container-aware termination of instances in the auto scaling group when scale-in happens. Valid values are `enabled` and `disabled`.
+
+### `managedScaling`
+
+* `instanceWarmupPeriod` - (Optional) Period of time, in seconds, after a newly launched Amazon EC2 instance can contribute to CloudWatch metrics for Auto Scaling group. If this parameter is omitted, the default value of 300 seconds is used.
+* `maximumScalingStepSize` - (Optional) Maximum step adjustment size. A number between 1 and 10,000.
+* `minimumScalingStepSize` - (Optional) Minimum step adjustment size. A number between 1 and 10,000.
+* `status` - (Optional) Whether auto scaling is managed by ECS. Valid values are `enabled` and `disabled`.
+* `targetCapacity` - (Optional) Target utilization for the capacity provider. A number between 1 and 100.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN that identifies the capacity provider.
+* `id` - ARN that identifies the capacity provider.
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import ECS Capacity Providers using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import ECS Capacity Providers using the `name`. For example:
+
+```console
+% terraform import aws_ecs_capacity_provider.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-085876568cc2c4593afd22394b677657c0db3a438e0613974a494910237cb352 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ecs_cluster.html.markdown b/website/docs/cdktf/typescript/r/ecs_cluster.html.markdown
new file mode 100644
index 00000000000..9d749471b26
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/ecs_cluster.html.markdown
@@ -0,0 +1,153 @@
+---
+subcategory: "ECS (Elastic Container)"
+layout: "aws"
+page_title: "AWS: aws_ecs_cluster"
+description: |-
+  Provides an ECS cluster.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ecs_cluster
+
+Provides an ECS cluster.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EcsCluster } from "./.gen/providers/aws/ecs-cluster";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new EcsCluster(this, "foo", {
+      name: "white-hart",
+      setting: [
+        {
+          name: "containerInsights",
+          value: "enabled",
+        },
+      ],
+    });
+  }
+}
+
+```
+
+### Example with Log Configuration
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudwatchLogGroup } from "./.gen/providers/aws/cloudwatch-log-group";
+import { EcsCluster } from "./.gen/providers/aws/ecs-cluster";
+import { KmsKey } from "./.gen/providers/aws/kms-key";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new CloudwatchLogGroup(this, "example", {
+      name: "example",
+    });
+    const awsKmsKeyExample = new KmsKey(this, "example_1", {
+      deletionWindowInDays: 7,
+      description: "example",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsKmsKeyExample.overrideLogicalId("example");
+    new EcsCluster(this, "test", {
+      configuration: {
+        executeCommandConfiguration: {
+          kmsKeyId: Token.asString(awsKmsKeyExample.arn),
+          logConfiguration: {
+            cloudWatchEncryptionEnabled: true,
+            cloudWatchLogGroupName: example.name,
+          },
+          logging: "OVERRIDE",
+        },
+      },
+      name: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `configuration` - (Optional) The execute command configuration for the cluster. Detailed below.
+* `name` - (Required) Name of the cluster (up to 255 letters, numbers, hyphens, and underscores)
+* `serviceConnectDefaults` - (Optional) Configures a default Service Connect namespace. Detailed below.
+* `setting` - (Optional) Configuration block(s) with cluster settings. For example, this can be used to enable CloudWatch Container Insights for a cluster. Detailed below.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### `configuration`
+
+* `executeCommandConfiguration` - (Optional) The details of the execute command configuration. Detailed below.
+
+#### `executeCommandConfiguration`
+
+* `kmsKeyId` - (Optional) The AWS Key Management Service key ID to encrypt the data between the local client and the container.
+* `logConfiguration` - (Optional) The log configuration for the results of the execute command actions Required when `logging` is `override`. Detailed below.
+* `logging` - (Optional) The log setting to use for redirecting logs for your execute command results. Valid values are `none`, `default`, and `override`.
+
+##### `logConfiguration`
+
+* `cloudWatchEncryptionEnabled` - (Optional) Whether or not to enable encryption on the CloudWatch logs. If not specified, encryption will be disabled.
+* `cloudWatchLogGroupName` - (Optional) The name of the CloudWatch log group to send logs to.
+* `s3BucketName` - (Optional) The name of the S3 bucket to send logs to.
+* `s3BucketEncryptionEnabled` - (Optional) Whether or not to enable encryption on the logs sent to S3. If not specified, encryption will be disabled.
+* `s3KeyPrefix` - (Optional) An optional folder in the S3 bucket to place logs in.
+
+### `setting`
+
+* `name` - (Required) Name of the setting to manage. Valid values: `containerInsights`.
+* `value` -  (Required) The value to assign to the setting. Valid values are `enabled` and `disabled`.
+
+### `serviceConnectDefaults`
+
+* `namespace` - (Required) The ARN of the [`awsServiceDiscoveryHttpNamespace`](/docs/providers/aws/r/service_discovery_http_namespace.html) that's used when you create a service and don't specify a Service Connect configuration.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN that identifies the cluster.
+* `id` - ARN that identifies the cluster.
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import ECS clusters using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import ECS clusters using the `name`. For example:
+
+```console
+% terraform import aws_ecs_cluster.stateless stateless-app
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1154f096b3c84b6ef18254400c16ed7229ee1dd00d8545d69ff1e3a5e359aa99 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ecs_cluster_capacity_providers.html.markdown b/website/docs/cdktf/typescript/r/ecs_cluster_capacity_providers.html.markdown
new file mode 100644
index 00000000000..71baab3a5a2
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/ecs_cluster_capacity_providers.html.markdown
@@ -0,0 +1,96 @@
+---
+subcategory: "ECS (Elastic Container)"
+layout: "aws"
+page_title: "AWS: aws_ecs_cluster_capacity_providers"
+description: |-
+  Provides an ECS cluster capacity providers resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ecs_cluster_capacity_providers
+
+Manages the capacity providers of an ECS Cluster.
+
+More information about capacity providers can be found in the [ECS User Guide](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/cluster-capacity-providers.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EcsCluster } from "./.gen/providers/aws/ecs-cluster";
+import { EcsClusterCapacityProviders } from "./.gen/providers/aws/ecs-cluster-capacity-providers";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new EcsCluster(this, "example", {
+      name: "my-cluster",
+    });
+    const awsEcsClusterCapacityProvidersExample =
+      new EcsClusterCapacityProviders(this, "example_1", {
+        capacityProviders: ["FARGATE"],
+        clusterName: example.name,
+        defaultCapacityProviderStrategy: [
+          {
+            base: 1,
+            capacityProvider: "FARGATE",
+            weight: 100,
+          },
+        ],
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsEcsClusterCapacityProvidersExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `capacityProviders` - (Optional) Set of names of one or more capacity providers to associate with the cluster. Valid values also include `fargate` and `fargateSpot`.
+* `clusterName` - (Required, Forces new resource) Name of the ECS cluster to manage capacity providers for.
+* `defaultCapacityProviderStrategy` - (Optional) Set of capacity provider strategies to use by default for the cluster. Detailed below.
+
+### default_capacity_provider_strategy Configuration Block
+
+* `capacityProvider` - (Required) Name of the capacity provider.
+* `weight` - (Optional) The relative percentage of the total number of launched tasks that should use the specified capacity provider. The `weight` value is taken into consideration after the `base` count of tasks has been satisfied. Defaults to `0`.
+* `base` - (Optional) The number of tasks, at a minimum, to run on the specified capacity provider. Only one capacity provider in a capacity provider strategy can have a base defined. Defaults to `0`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Same as `clusterName`.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import ECS cluster capacity providers using the `clusterName` attribute. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import ECS cluster capacity providers using the `clusterName` attribute. For example:
+
+```console
+% terraform import aws_ecs_cluster_capacity_providers.example my-cluster
+```
+
+<!-- cache-key: cdktf-0.18.0 input-07d58c0c07d75ffbdc73f076ed8b48e2079c33284e6a34a1e4cdf792f6d41841 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ecs_service.html.markdown b/website/docs/cdktf/typescript/r/ecs_service.html.markdown
new file mode 100644
index 00000000000..d8af282036b
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/ecs_service.html.markdown
@@ -0,0 +1,402 @@
+---
+subcategory: "ECS (Elastic Container)"
+layout: "aws"
+page_title: "AWS: aws_ecs_service"
+description: |-
+  Provides an ECS service.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ecs_service
+
+-> **Note:** To prevent a race condition during service deletion, make sure to set `dependsOn` to the related `awsIamRolePolicy`; otherwise, the policy may be destroyed too soon and the ECS service will then get stuck in the `draining` state.
+
+Provides an ECS service - effectively a task that is expected to run until an error occurs or a user terminates it (typically a webserver or a database).
+
+See [ECS Services section in AWS developer guide](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/ecs_services.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EcsService } from "./.gen/providers/aws/ecs-service";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new EcsService(this, "mongo", {
+      cluster: foo.id,
+      dependsOn: [awsIamRolePolicyFoo],
+      desiredCount: 3,
+      iamRole: Token.asString(awsIamRoleFoo.arn),
+      loadBalancer: [
+        {
+          containerName: "mongo",
+          containerPort: 8080,
+          targetGroupArn: Token.asString(awsLbTargetGroupFoo.arn),
+        },
+      ],
+      name: "mongodb",
+      orderedPlacementStrategy: [
+        {
+          field: "cpu",
+          type: "binpack",
+        },
+      ],
+      placementConstraints: [
+        {
+          expression:
+            "attribute:ecs.availability-zone in [us-west-2a, us-west-2b]",
+          type: "memberOf",
+        },
+      ],
+      taskDefinition: Token.asString(awsEcsTaskDefinitionMongo.arn),
+    });
+  }
+}
+
+```
+
+### Ignoring Changes to Desired Count
+
+You can utilize the generic Terraform resource [lifecycle configuration block](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html) with `ignoreChanges` to create an ECS service with an initial count of running instances, then ignore any changes to that count caused externally (e.g., Application Autoscaling).
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EcsService } from "./.gen/providers/aws/ecs-service";
+interface MyConfig {
+  name: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new EcsService(this, "example", {
+      desiredCount: 2,
+      lifecycle: {
+        ignoreChanges: [desiredCount],
+      },
+      name: config.name,
+    });
+  }
+}
+
+```
+
+### Daemon Scheduling Strategy
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EcsService } from "./.gen/providers/aws/ecs-service";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new EcsService(this, "bar", {
+      cluster: foo.id,
+      name: "bar",
+      schedulingStrategy: "DAEMON",
+      taskDefinition: Token.asString(awsEcsTaskDefinitionBar.arn),
+    });
+  }
+}
+
+```
+
+### CloudWatch Deployment Alarms
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EcsService } from "./.gen/providers/aws/ecs-service";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new EcsService(this, "example", {
+      alarms: {
+        alarmNames: [Token.asString(awsCloudwatchMetricAlarmExample.alarmName)],
+        enable: true,
+        rollback: true,
+      },
+      cluster: Token.asString(awsEcsClusterExample.id),
+      name: "example",
+    });
+  }
+}
+
+```
+
+### External Deployment Controller
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EcsService } from "./.gen/providers/aws/ecs-service";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new EcsService(this, "example", {
+      cluster: Token.asString(awsEcsClusterExample.id),
+      deploymentController: {
+        type: "EXTERNAL",
+      },
+      name: "example",
+    });
+  }
+}
+
+```
+
+### Redeploy Service On Every Apply
+
+The key used with `triggers` is arbitrary.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EcsService } from "./.gen/providers/aws/ecs-service";
+interface MyConfig {
+  name: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new EcsService(this, "example", {
+      forceNewDeployment: true,
+      triggers: {
+        redeployment: Token.asString(Fn.timestamp()),
+      },
+      name: config.name,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) Name of the service (up to 255 letters, numbers, hyphens, and underscores)
+
+The following arguments are optional:
+
+* `alarms` - (Optional) Information about the CloudWatch alarms. [See below](#alarms).
+* `capacityProviderStrategy` - (Optional) Capacity provider strategies to use for the service. Can be one or more. These can be updated without destroying and recreating the service only if `force_new_deployment = true` and not changing from 0 `capacityProviderStrategy` blocks to greater than 0, or vice versa. See below.
+* `cluster` - (Optional) ARN of an ECS cluster.
+* `deploymentCircuitBreaker` - (Optional) Configuration block for deployment circuit breaker. See below.
+* `deploymentController` - (Optional) Configuration block for deployment controller configuration. See below.
+* `deploymentMaximumPercent` - (Optional) Upper limit (as a percentage of the service's desiredCount) of the number of running tasks that can be running in a service during a deployment. Not valid when using the `daemon` scheduling strategy.
+* `deploymentMinimumHealthyPercent` - (Optional) Lower limit (as a percentage of the service's desiredCount) of the number of running tasks that must remain running and healthy in a service during a deployment.
+* `desiredCount` - (Optional) Number of instances of the task definition to place and keep running. Defaults to 0. Do not specify if using the `daemon` scheduling strategy.
+* `enableEcsManagedTags` - (Optional) Specifies whether to enable Amazon ECS managed tags for the tasks within the service.
+* `enableExecuteCommand` - (Optional) Specifies whether to enable Amazon ECS Exec for the tasks within the service.
+* `forceNewDeployment` - (Optional) Enable to force a new task deployment of the service. This can be used to update tasks to use a newer Docker image with same image/tag combination (e.g., `myimage:latest`), roll Fargate tasks onto a newer platform version, or immediately deploy `orderedPlacementStrategy` and `placementConstraints` updates.
+* `healthCheckGracePeriodSeconds` - (Optional) Seconds to ignore failing load balancer health checks on newly instantiated tasks to prevent premature shutdown, up to 2147483647. Only valid for services configured to use load balancers.
+* `iamRole` - (Optional) ARN of the IAM role that allows Amazon ECS to make calls to your load balancer on your behalf. This parameter is required if you are using a load balancer with your service, but only if your task definition does not use the `awsvpc` network mode. If using `awsvpc` network mode, do not specify this role. If your account has already created the Amazon ECS service-linked role, that role is used by default for your service unless you specify a role here.
+* `launchType` - (Optional) Launch type on which to run your service. The valid values are `ec2`, `fargate`, and `external`. Defaults to `ec2`.
+* `loadBalancer` - (Optional) Configuration block for load balancers. See below.
+* `networkConfiguration` - (Optional) Network configuration for the service. This parameter is required for task definitions that use the `awsvpc` network mode to receive their own Elastic Network Interface, and it is not supported for other network modes. See below.
+* `orderedPlacementStrategy` - (Optional) Service level strategy rules that are taken into consideration during task placement. List from top to bottom in order of precedence. Updates to this configuration will take effect next task deployment unless `forceNewDeployment` is enabled. The maximum number of `orderedPlacementStrategy` blocks is `5`. See below.
+* `placementConstraints` - (Optional) Rules that are taken into consideration during task placement. Updates to this configuration will take effect next task deployment unless `forceNewDeployment` is enabled. Maximum number of `placementConstraints` is `10`. See below.
+* `platformVersion` - (Optional) Platform version on which to run your service. Only applicable for `launchType` set to `fargate`. Defaults to `latest`. More information about Fargate platform versions can be found in the [AWS ECS User Guide](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/platform_versions.html).
+* `propagateTags` - (Optional) Specifies whether to propagate the tags from the task definition or the service to the tasks. The valid values are `service` and `taskDefinition`.
+* `schedulingStrategy` - (Optional) Scheduling strategy to use for the service. The valid values are `replica` and `daemon`. Defaults to `replica`. Note that [*Tasks using the Fargate launch type or the `codeDeploy` or `external` deployment controller types don't support the `daemon` scheduling strategy*](https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_CreateService.html).
+* `serviceConnectConfiguration` - (Optional) The ECS Service Connect configuration for this service to discover and connect to services, and be discovered by, and connected from, other services within a namespace. See below.
+* `serviceRegistries` - (Optional) Service discovery registries for the service. The maximum number of `serviceRegistries` blocks is `1`. See below.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `taskDefinition` - (Optional) Family and revision (`family:revision`) or full ARN of the task definition that you want to run in your service. Required unless using the `external` deployment controller. If a revision is not specified, the latest `active` revision is used.
+* `triggers` - (Optional) Map of arbitrary keys and values that, when changed, will trigger an in-place update (redeployment). Useful with `timestamp()`. See example above.
+* `waitForSteadyState` - (Optional) If `true`, Terraform will wait for the service to reach a steady state (like [`aws ecs wait services-stable`](https://docs.aws.amazon.com/cli/latest/reference/ecs/wait/services-stable.html)) before continuing. Default `false`.
+
+### alarms
+
+The `alarms` configuration block supports the following:
+
+* `alarmNames` - (Required) One or more CloudWatch alarm names.
+* `enable` - (Required) Determines whether to use the CloudWatch alarm option in the service deployment process.
+* `rollback` - (Required) Determines whether to configure Amazon ECS to roll back the service if a service deployment fails. If rollback is used, when a service deployment fails, the service is rolled back to the last deployment that completed successfully.
+
+### capacity_provider_strategy
+
+The `capacityProviderStrategy` configuration block supports the following:
+
+* `base` - (Optional) Number of tasks, at a minimum, to run on the specified capacity provider. Only one capacity provider in a capacity provider strategy can have a base defined.
+* `capacityProvider` - (Required) Short name of the capacity provider.
+* `weight` - (Required) Relative percentage of the total number of launched tasks that should use the specified capacity provider.
+
+### deployment_circuit_breaker
+
+The `deploymentCircuitBreaker` configuration block supports the following:
+
+* `enable` - (Required) Whether to enable the deployment circuit breaker logic for the service.
+* `rollback` - (Required) Whether to enable Amazon ECS to roll back the service if a service deployment fails. If rollback is enabled, when a service deployment fails, the service is rolled back to the last deployment that completed successfully.
+
+### deployment_controller
+
+The `deploymentController` configuration block supports the following:
+
+* `type` - (Optional) Type of deployment controller. Valid values: `codeDeploy`, `ecs`, `external`. Default: `ecs`.
+
+### load_balancer
+
+`loadBalancer` supports the following:
+
+* `elbName` - (Required for ELB Classic) Name of the ELB (Classic) to associate with the service.
+* `targetGroupArn` - (Required for ALB/NLB) ARN of the Load Balancer target group to associate with the service.
+* `containerName` - (Required) Name of the container to associate with the load balancer (as it appears in a container definition).
+* `containerPort` - (Required) Port on the container to associate with the load balancer.
+
+-> **Version note:** Multiple `loadBalancer` configuration block support was added in Terraform AWS Provider version 2.22.0. This allows configuration of [ECS service support for multiple target groups](https://aws.amazon.com/about-aws/whats-new/2019/07/amazon-ecs-services-now-support-multiple-load-balancer-target-groups/).
+
+### network_configuration
+
+`networkConfiguration` support the following:
+
+* `subnets` - (Required) Subnets associated with the task or service.
+* `securityGroups` - (Optional) Security groups associated with the task or service. If you do not specify a security group, the default security group for the VPC is used.
+* `assignPublicIp` - (Optional) Assign a public IP address to the ENI (Fargate launch type only). Valid values are `true` or `false`. Default `false`.
+
+For more information, see [Task Networking](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-networking.html)
+
+### ordered_placement_strategy
+
+`orderedPlacementStrategy` supports the following:
+
+* `type` - (Required) Type of placement strategy. Must be one of: `binpack`, `random`, or `spread`
+* `field` - (Optional) For the `spread` placement strategy, valid values are `instanceId` (or `host`,
+ which has the same effect), or any platform or custom attribute that is applied to a container instance.
+ For the `binpack` type, valid values are `memory` and `cpu`. For the `random` type, this attribute is not
+ needed. For more information, see [Placement Strategy](https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_PlacementStrategy.html).
+
+-> **Note:** for `spread`, `host` and `instanceId` will be normalized, by AWS, to be `instanceId`. This means the statefile will show `instanceId` but your config will differ if you use `host`.
+
+### placement_constraints
+
+`placementConstraints` support the following:
+
+* `type` - (Required) Type of constraint. The only valid values at this time are `memberOf` and `distinctInstance`.
+* `expression` -  (Optional) Cluster Query Language expression to apply to the constraint. Does not need to be specified for the `distinctInstance` type. For more information, see [Cluster Query Language in the Amazon EC2 Container Service Developer Guide](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/cluster-query-language.html).
+
+### service_registries
+
+`serviceRegistries` support the following:
+
+* `registryArn` - (Required) ARN of the Service Registry. The currently supported service registry is Amazon Route 53 Auto Naming Service(`awsServiceDiscoveryService`). For more information, see [Service](https://docs.aws.amazon.com/Route53/latest/APIReference/API_autonaming_Service.html)
+* `port` - (Optional) Port value used if your Service Discovery service specified an SRV record.
+* `containerPort` - (Optional) Port value, already specified in the task definition, to be used for your service discovery service.
+* `containerName` - (Optional) Container name value, already specified in the task definition, to be used for your service discovery service.
+
+### service_connect_configuration
+
+`serviceConnectConfiguration` supports the following:
+
+* `enabled` - (Required) Specifies whether to use Service Connect with this service.
+* `logConfiguration` - (Optional) The log configuration for the container. See below.
+* `namespace` - (Optional) The namespace name or ARN of the [`awsServiceDiscoveryHttpNamespace`](/docs/providers/aws/r/service_discovery_http_namespace.html) for use with Service Connect.
+* `service` - (Optional) The list of Service Connect service objects. See below.
+
+### log_configuration
+
+`logConfiguration` supports the following:
+
+* `logDriver` - (Required) The log driver to use for the container.
+* `options` - (Optional) The configuration options to send to the log driver.
+* `secretOption` - (Optional) The secrets to pass to the log configuration. See below.
+
+### secret_option
+
+`secretOption` supports the following:
+
+* `name` - (Required) The name of the secret.
+* `valueFrom` - (Required) The secret to expose to the container. The supported values are either the full ARN of the AWS Secrets Manager secret or the full ARN of the parameter in the SSM Parameter Store.
+
+### service
+
+`service` supports the following:
+
+* `clientAlias` - (Optional) The list of client aliases for this Service Connect service. You use these to assign names that can be used by client applications. The maximum number of client aliases that you can have in this list is 1. See below.
+* `discoveryName` - (Optional) The name of the new AWS Cloud Map service that Amazon ECS creates for this Amazon ECS service.
+* `ingressPortOverride` - (Optional) The port number for the Service Connect proxy to listen on.
+* `portName` - (Required) The name of one of the `portMappings` from all the containers in the task definition of this Amazon ECS service.
+
+### client_alias
+
+`clientAlias` supports the following:
+
+* `dnsName` - (Optional) The name that you use in the applications of client tasks to connect to this service.
+* `port` - (Required) The listening port number for the Service Connect proxy. This port is available inside of all of the tasks within the same namespace.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `cluster` - Amazon Resource Name (ARN) of cluster which the service runs on.
+* `desiredCount` - Number of instances of the task definition.
+* `iamRole` - ARN of IAM role used for ELB.
+* `id` - ARN that identifies the service.
+* `name` - Name of the service.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `20M`)
+- `update` - (Default `20M`)
+- `delete` - (Default `20M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import ECS services using the `name` together with ecs cluster `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import ECS services using the `name` together with ecs cluster `name`. For example:
+
+```console
+% terraform import aws_ecs_service.imported cluster-name/service-name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-0c2dba4511f8b41de16532abefaed14f7708fa06b49a3887e0b136935976402d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ecs_tag.html.markdown b/website/docs/cdktf/typescript/r/ecs_tag.html.markdown
new file mode 100644
index 00000000000..b12616861e1
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/ecs_tag.html.markdown
@@ -0,0 +1,87 @@
+---
+subcategory: "ECS (Elastic Container)"
+layout: "aws"
+page_title: "AWS: aws_ecs_tag"
+description: |-
+  Manages an individual ECS resource tag
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ecs_tag
+
+Manages an individual ECS resource tag. This resource should only be used in cases where ECS resources are created outside Terraform (e.g., ECS Clusters implicitly created by Batch Compute Environments).
+
+~> **NOTE:** This tagging resource should not be combined with the Terraform resource for managing the parent resource. For example, using `awsEcsCluster` and `awsEcsTag` to manage tags of the same ECS Cluster will cause a perpetual difference where the `awsEcsCluster` resource will try to remove the tag being added by the `awsEcsTag` resource.
+
+~> **NOTE:** This tagging resource does not use the [provider `ignoreTags` configuration](/docs/providers/aws/index.html#ignore_tags).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { BatchComputeEnvironment } from "./.gen/providers/aws/batch-compute-environment";
+import { EcsTag } from "./.gen/providers/aws/ecs-tag";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new BatchComputeEnvironment(this, "example", {
+      computeEnvironmentName: "example",
+      serviceRole: Token.asString(awsIamRoleExample.arn),
+      type: "UNMANAGED",
+    });
+    const awsEcsTagExample = new EcsTag(this, "example_1", {
+      key: "Name",
+      resourceArn: example.ecsClusterArn,
+      value: "Hello World",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsEcsTagExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `resourceArn` - (Required) Amazon Resource Name (ARN) of the ECS resource to tag.
+* `key` - (Required) Tag name.
+* `value` - (Required) Tag value.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - ECS resource identifier and key, separated by a comma (`,`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsEcsTag` using the ECS resource identifier and key, separated by a comma (`,`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsEcsTag` using the ECS resource identifier and key, separated by a comma (`,`). For example:
+
+```console
+% terraform import aws_ecs_tag.example arn:aws:ecs:us-east-1:123456789012:cluster/example,Name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-6f495a4add8be734874309797134ad568af10ab0883471ac6917e03b469e68e0 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ecs_task_definition.html.markdown b/website/docs/cdktf/typescript/r/ecs_task_definition.html.markdown
new file mode 100644
index 00000000000..410e63179ce
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/ecs_task_definition.html.markdown
@@ -0,0 +1,422 @@
+---
+subcategory: "ECS (Elastic Container)"
+layout: "aws"
+page_title: "AWS: aws_ecs_task_definition"
+description: |-
+  Manages a revision of an ECS task definition.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ecs_task_definition
+
+Manages a revision of an ECS task definition to be used in `awsEcsService`.
+
+## Example Usage
+
+### Basic Example
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EcsTaskDefinition } from "./.gen/providers/aws/ecs-task-definition";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new EcsTaskDefinition(this, "service", {
+      containerDefinitions: Token.asString(
+        Fn.jsonencode([
+          {
+            cpu: 10,
+            essential: true,
+            image: "service-first",
+            memory: 512,
+            name: "first",
+            portMappings: [
+              {
+                containerPort: 80,
+                hostPort: 80,
+              },
+            ],
+          },
+          {
+            cpu: 10,
+            essential: true,
+            image: "service-second",
+            memory: 256,
+            name: "second",
+            portMappings: [
+              {
+                containerPort: 443,
+                hostPort: 443,
+              },
+            ],
+          },
+        ])
+      ),
+      family: "service",
+      placementConstraints: [
+        {
+          expression:
+            "attribute:ecs.availability-zone in [us-west-2a, us-west-2b]",
+          type: "memberOf",
+        },
+      ],
+      volume: [
+        {
+          hostPath: "/ecs/service-storage",
+          name: "service-storage",
+        },
+      ],
+    });
+  }
+}
+
+```
+
+### With AppMesh Proxy
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, Fn, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EcsTaskDefinition } from "./.gen/providers/aws/ecs-task-definition";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new EcsTaskDefinition(this, "service", {
+      containerDefinitions: Token.asString(
+        Fn.file("task-definitions/service.json")
+      ),
+      family: "service",
+      proxyConfiguration: {
+        containerName: "applicationContainerName",
+        properties: {
+          AppPorts: "8080",
+          EgressIgnoredIPs: "169.254.170.2,169.254.169.254",
+          IgnoredUID: "1337",
+          ProxyEgressPort: Token.asString(15001),
+          ProxyIngressPort: Token.asString(15000),
+        },
+        type: "APPMESH",
+      },
+    });
+  }
+}
+
+```
+
+### Example Using `dockerVolumeConfiguration`
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EcsTaskDefinition } from "./.gen/providers/aws/ecs-task-definition";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new EcsTaskDefinition(this, "service", {
+      containerDefinitions: Token.asString(
+        Fn.file("task-definitions/service.json")
+      ),
+      family: "service",
+      volume: [
+        {
+          dockerVolumeConfiguration: {
+            autoprovision: true,
+            driver: "local",
+            driverOpts: {
+              device: "${" + fs.dnsName + "}:/",
+              o:
+                "addr=${" +
+                fs.dnsName +
+                "},rsize=1048576,wsize=1048576,hard,timeo=600,retrans=2,noresvport",
+              type: "nfs",
+            },
+            scope: "shared",
+          },
+          name: "service-storage",
+        },
+      ],
+    });
+  }
+}
+
+```
+
+### Example Using `efsVolumeConfiguration`
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EcsTaskDefinition } from "./.gen/providers/aws/ecs-task-definition";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new EcsTaskDefinition(this, "service", {
+      containerDefinitions: Token.asString(
+        Fn.file("task-definitions/service.json")
+      ),
+      family: "service",
+      volume: [
+        {
+          efsVolumeConfiguration: {
+            authorizationConfig: {
+              accessPointId: test.id,
+              iam: "ENABLED",
+            },
+            fileSystemId: fs.id,
+            rootDirectory: "/opt/data",
+            transitEncryption: "ENABLED",
+            transitEncryptionPort: 2999,
+          },
+          name: "service-storage",
+        },
+      ],
+    });
+  }
+}
+
+```
+
+### Example Using `fsxWindowsFileServerVolumeConfiguration`
+
+```terraform
+resource "aws_ecs_task_definition" "service" {
+  family                = "service"
+  container_definitions = file("task-definitions/service.json")
+
+  volume {
+    name = "service-storage"
+
+    fsx_windows_file_server_volume_configuration {
+      file_system_id = aws_fsx_windows_file_system.test.id
+      root_directory = "\\data"
+
+      authorization_config {
+        credentials_parameter = aws_secretsmanager_secret_version.test.arn
+        domain                = aws_directory_service_directory.test.name
+      }
+    }
+  }
+}
+
+resource "aws_secretsmanager_secret_version" "test" {
+  secret_id     = aws_secretsmanager_secret.test.id
+  secret_string = jsonencode({ username : "admin", password : aws_directory_service_directory.test.password })
+}
+```
+
+### Example Using `containerDefinitions` and `inferenceAccelerator`
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EcsTaskDefinition } from "./.gen/providers/aws/ecs-task-definition";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new EcsTaskDefinition(this, "test", {
+      containerDefinitions:
+        '[\n  {\n    "cpu": 10,\n    "command": ["sleep", "10"],\n    "entryPoint": ["/"],\n    "environment": [\n      {"name": "VARNAME", "value": "VARVAL"}\n    ],\n    "essential": true,\n    "image": "jenkins",\n    "memory": 128,\n    "name": "jenkins",\n    "portMappings": [\n      {\n        "containerPort": 80,\n        "hostPort": 8080\n      }\n    ],\n        "resourceRequirements":[\n            {\n                "type":"InferenceAccelerator",\n                "value":"device_1"\n            }\n        ]\n  }\n]\n\n',
+      family: "test",
+      inferenceAccelerator: [
+        {
+          deviceName: "device_1",
+          deviceType: "eia1.medium",
+        },
+      ],
+    });
+  }
+}
+
+```
+
+### Example Using `runtimePlatform` and `fargate`
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EcsTaskDefinition } from "./.gen/providers/aws/ecs-task-definition";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new EcsTaskDefinition(this, "test", {
+      containerDefinitions:
+        '[\n  {\n    "name": "iis",\n    "image": "mcr.microsoft.com/windows/servercore/iis",\n    "cpu": 1024,\n    "memory": 2048,\n    "essential": true\n  }\n]\n\n',
+      cpu: Token.asString(1024),
+      family: "test",
+      memory: Token.asString(2048),
+      networkMode: "awsvpc",
+      requiresCompatibilities: ["FARGATE"],
+      runtimePlatform: {
+        cpuArchitecture: "X86_64",
+        operatingSystemFamily: "WINDOWS_SERVER_2019_CORE",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+~> **NOTE:** Proper escaping is required for JSON field values containing quotes (`"`) such as `environment` values. If directly setting the JSON, they should be escaped as `\"` in the JSON,  e.g., `"value": "I \"love\" escaped quotes"`. If using a Terraform variable value, they should be escaped as `\\\"` in the variable, e.g., `value = "I \\\"love\\\" escaped quotes"` in the variable and `"value": "${var.myvariable}"` in the JSON.
+
+The following arguments are required:
+
+* `containerDefinitions` - (Required) A list of valid [container definitions](http://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_ContainerDefinition.html) provided as a single valid JSON document. Please note that you should only provide values that are part of the container definition document. For a detailed description of what parameters are available, see the [Task Definition Parameters](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task_definition_parameters.html) section from the official [Developer Guide](https://docs.aws.amazon.com/AmazonECS/latest/developerguide).
+* `family` - (Required) A unique name for your task definition.
+
+The following arguments are optional:
+
+* `cpu` - (Optional) Number of cpu units used by the task. If the `requiresCompatibilities` is `fargate` this field is required.
+* `executionRoleArn` - (Optional) ARN of the task execution role that the Amazon ECS container agent and the Docker daemon can assume.
+* `inferenceAccelerator` - (Optional) Configuration block(s) with Inference Accelerators settings. [Detailed below.](#inference_accelerator)
+* `ipcMode` - (Optional) IPC resource namespace to be used for the containers in the task The valid values are `host`, `task`, and `none`.
+* `memory` - (Optional) Amount (in MiB) of memory used by the task. If the `requiresCompatibilities` is `fargate` this field is required.
+* `networkMode` - (Optional) Docker networking mode to use for the containers in the task. Valid values are `none`, `bridge`, `awsvpc`, and `host`.
+* `runtimePlatform` - (Optional) Configuration block for [runtime_platform](#runtime_platform) that containers in your task may use.
+* `pidMode` - (Optional) Process namespace to use for the containers in the task. The valid values are `host` and `task`.
+* `placementConstraints` - (Optional) Configuration block for rules that are taken into consideration during task placement. Maximum number of `placementConstraints` is `10`. [Detailed below](#placement_constraints).
+* `proxyConfiguration` - (Optional) Configuration block for the App Mesh proxy. [Detailed below.](#proxy_configuration)
+* `ephemeralStorage` - (Optional)  The amount of ephemeral storage to allocate for the task. This parameter is used to expand the total amount of ephemeral storage available, beyond the default amount, for tasks hosted on AWS Fargate. See [Ephemeral Storage](#ephemeral_storage).
+* `requiresCompatibilities` - (Optional) Set of launch types required by the task. The valid values are `ec2` and `fargate`.
+* `skipDestroy` - (Optional) Whether to retain the old revision when the resource is destroyed or replacement is necessary. Default is `false`.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `taskRoleArn` - (Optional) ARN of IAM role that allows your Amazon ECS container task to make calls to other AWS services.
+* `volume` - (Optional) Configuration block for [volumes](#volume) that containers in your task may use. Detailed below.
+
+### volume
+
+* `dockerVolumeConfiguration` - (Optional) Configuration block to configure a [docker volume](#docker_volume_configuration). Detailed below.
+* `efsVolumeConfiguration` - (Optional) Configuration block for an [EFS volume](#efs_volume_configuration). Detailed below.
+* `fsxWindowsFileServerVolumeConfiguration` - (Optional) Configuration block for an [FSX Windows File Server volume](#fsx_windows_file_server_volume_configuration). Detailed below.
+* `hostPath` - (Optional) Path on the host container instance that is presented to the container. If not set, ECS will create a nonpersistent data volume that starts empty and is deleted after the task has finished.
+* `name` - (Required) Name of the volume. This name is referenced in the `sourceVolume`
+parameter of container definition in the `mountPoints` section.
+
+### docker_volume_configuration
+
+For more information, see [Specifying a Docker volume in your Task Definition Developer Guide](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/docker-volumes.html#specify-volume-config)
+
+* `autoprovision` - (Optional) If this value is `true`, the Docker volume is created if it does not already exist. *Note*: This field is only used if the scope is `shared`.
+* `driverOpts` - (Optional) Map of Docker driver specific options.
+* `driver` - (Optional) Docker volume driver to use. The driver value must match the driver name provided by Docker because it is used for task placement.
+* `labels` - (Optional) Map of custom metadata to add to your Docker volume.
+* `scope` - (Optional) Scope for the Docker volume, which determines its lifecycle, either `task` or `shared`.  Docker volumes that are scoped to a `task` are automatically provisioned when the task starts and destroyed when the task stops. Docker volumes that are scoped as `shared` persist after the task stops.
+
+### efs_volume_configuration
+
+For more information, see [Specifying an EFS volume in your Task Definition Developer Guide](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/efs-volumes.html#specify-efs-config)
+
+* `fileSystemId` - (Required) ID of the EFS File System.
+* `rootDirectory` - (Optional) Directory within the Amazon EFS file system to mount as the root directory inside the host. If this parameter is omitted, the root of the Amazon EFS volume will be used. Specifying / will have the same effect as omitting this parameter. This argument is ignored when using `authorizationConfig`.
+* `transitEncryption` - (Optional) Whether or not to enable encryption for Amazon EFS data in transit between the Amazon ECS host and the Amazon EFS server. Transit encryption must be enabled if Amazon EFS IAM authorization is used. Valid values: `enabled`, `disabled`. If this parameter is omitted, the default value of `disabled` is used.
+* `transitEncryptionPort` - (Optional) Port to use for transit encryption. If you do not specify a transit encryption port, it will use the port selection strategy that the Amazon EFS mount helper uses.
+* `authorizationConfig` - (Optional) Configuration block for [authorization](#authorization_config) for the Amazon EFS file system. Detailed below.
+
+### runtime_platform
+
+* `operatingSystemFamily` - (Optional) If the `requiresCompatibilities` is `fargate` this field is required; must be set to a valid option from the [operating system family in the runtime platform](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task_definition_parameters.html#runtime-platform) setting
+* `cpuArchitecture` - (Optional) Must be set to either `x8664` or `arm64`; see [cpu architecture](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task_definition_parameters.html#runtime-platform)
+
+#### authorization_config
+
+* `accessPointId` - (Optional) Access point ID to use. If an access point is specified, the root directory value will be relative to the directory set for the access point. If specified, transit encryption must be enabled in the EFSVolumeConfiguration.
+* `iam` - (Optional) Whether or not to use the Amazon ECS task IAM role defined in a task definition when mounting the Amazon EFS file system. If enabled, transit encryption must be enabled in the EFSVolumeConfiguration. Valid values: `enabled`, `disabled`. If this parameter is omitted, the default value of `disabled` is used.
+
+### fsx_windows_file_server_volume_configuration
+
+For more information, see [Specifying an FSX Windows File Server volume in your Task Definition Developer Guide](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/tutorial-wfsx-volumes.html)
+
+* `fileSystemId` - (Required) The Amazon FSx for Windows File Server file system ID to use.
+* `rootDirectory` - (Required) The directory within the Amazon FSx for Windows File Server file system to mount as the root directory inside the host.
+* `authorizationConfig` - (Required) Configuration block for [authorization](#authorization_config) for the Amazon FSx for Windows File Server file system detailed below.
+
+#### authorization_config
+
+* `credentialsParameter` - (Required) The authorization credential option to use. The authorization credential options can be provided using either the Amazon Resource Name (ARN) of an AWS Secrets Manager secret or AWS Systems Manager Parameter Store parameter. The ARNs refer to the stored credentials.
+* `domain` - (Required) A fully qualified domain name hosted by an AWS Directory Service Managed Microsoft AD (Active Directory) or self-hosted AD on Amazon EC2.
+
+### placement_constraints
+
+* `expression` -  (Optional) Cluster Query Language expression to apply to the constraint. For more information, see [Cluster Query Language in the Amazon EC2 Container Service Developer Guide](http://docs.aws.amazon.com/AmazonECS/latest/developerguide/cluster-query-language.html).
+* `type` - (Required) Type of constraint. Use `memberOf` to restrict selection to a group of valid candidates. Note that `distinctInstance` is not supported in task definitions.
+
+### proxy_configuration
+
+* `containerName` - (Required) Name of the container that will serve as the App Mesh proxy.
+* `properties` - (Required) Set of network configuration parameters to provide the Container Network Interface (CNI) plugin, specified a key-value mapping.
+* `type` - (Optional) Proxy type. The default value is `appmesh`. The only supported value is `appmesh`.
+
+### ephemeral_storage
+
+* `sizeInGib` - (Required) The total amount, in GiB, of ephemeral storage to set for the task. The minimum supported value is `21` GiB and the maximum supported value is `200` GiB.
+
+### inference_accelerator
+
+* `deviceName` - (Required) Elastic Inference accelerator device name. The deviceName must also be referenced in a container definition as a ResourceRequirement.
+* `deviceType` - (Required) Elastic Inference accelerator type to use.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Full ARN of the Task Definition (including both `family` and `revision`).
+* `arnWithoutRevision` - ARN of the Task Definition with the trailing `revision` removed. This may be useful for situations where the latest task definition is always desired. If a revision isn't specified, the latest ACTIVE revision is used. See the [AWS documentation](https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_StartTask.html#ECS-StartTask-request-taskDefinition) for details.
+* `revision` - Revision of the task in a particular family.
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import ECS Task Definitions using their ARNs. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import ECS Task Definitions using their ARNs. For example:
+
+```console
+% terraform import aws_ecs_task_definition.example arn:aws:ecs:us-east-1:012345678910:task-definition/mytaskfamily:123
+```
+
+<!-- cache-key: cdktf-0.18.0 input-e600d146b2b55ceeb9bc9361167e95241f61a5b3e90831c8b6a3c0cb748b8f00 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ecs_task_set.html.markdown b/website/docs/cdktf/typescript/r/ecs_task_set.html.markdown
new file mode 100644
index 00000000000..34894e32b28
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/ecs_task_set.html.markdown
@@ -0,0 +1,186 @@
+---
+subcategory: "ECS (Elastic Container)"
+layout: "aws"
+page_title: "AWS: aws_ecs_task_set"
+description: |-
+  Provides an ECS task set.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ecs_task_set
+
+Provides an ECS task set - effectively a task that is expected to run until an error occurs or a user terminates it (typically a webserver or a database).
+
+See [ECS Task Set section in AWS developer guide](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/deployment-type-external.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EcsTaskSet } from "./.gen/providers/aws/ecs-task-set";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new EcsTaskSet(this, "example", {
+      cluster: Token.asString(awsEcsClusterExample.id),
+      loadBalancer: [
+        {
+          containerName: "mongo",
+          containerPort: 8080,
+          targetGroupArn: Token.asString(awsLbTargetGroupExample.arn),
+        },
+      ],
+      service: Token.asString(awsEcsServiceExample.id),
+      taskDefinition: Token.asString(awsEcsTaskDefinitionExample.arn),
+    });
+  }
+}
+
+```
+
+### Ignoring Changes to Scale
+
+You can utilize the generic Terraform resource [lifecycle configuration block](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html) with `ignoreChanges` to create an ECS service with an initial count of running instances, then ignore any changes to that count caused externally (e.g. Application Autoscaling).
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EcsTaskSet } from "./.gen/providers/aws/ecs-task-set";
+interface MyConfig {
+  cluster: any;
+  service: any;
+  taskDefinition: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new EcsTaskSet(this, "example", {
+      lifecycle: {
+        ignoreChanges: ["scale"],
+      },
+      scale: {
+        value: 50,
+      },
+      cluster: config.cluster,
+      service: config.service,
+      taskDefinition: config.taskDefinition,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `service` - (Required) The short name or ARN of the ECS service.
+* `cluster` - (Required) The short name or ARN of the cluster that hosts the service to create the task set in.
+* `taskDefinition` - (Required) The family and revision (`family:revision`) or full ARN of the task definition that you want to run in your service.
+
+The following arguments are optional:
+
+* `capacityProviderStrategy` - (Optional) The capacity provider strategy to use for the service. Can be one or more.  [Defined below](#capacity_provider_strategy).
+* `externalId` - (Optional) The external ID associated with the task set.
+* `forceDelete` - (Optional) Whether to allow deleting the task set without waiting for scaling down to 0. You can force a task set to delete even if it's in the process of scaling a resource. Normally, Terraform drains all the tasks before deleting the task set. This bypasses that behavior and potentially leaves resources dangling.
+* `launchType` - (Optional) The launch type on which to run your service. The valid values are `ec2`, `fargate`, and `external`. Defaults to `ec2`.
+* `loadBalancer` - (Optional) Details on load balancers that are used with a task set. [Detailed below](#load_balancer).
+* `platformVersion` - (Optional) The platform version on which to run your service. Only applicable for `launchType` set to `fargate`. Defaults to `latest`. More information about Fargate platform versions can be found in the [AWS ECS User Guide](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/platform_versions.html).
+* `networkConfiguration` - (Optional) The network configuration for the service. This parameter is required for task definitions that use the `awsvpc` network mode to receive their own Elastic Network Interface, and it is not supported for other network modes. [Detailed below](#network_configuration).
+* `scale` - (Optional) A floating-point percentage of the desired number of tasks to place and keep running in the task set. [Detailed below](#scale).
+* `serviceRegistries` - (Optional) The service discovery registries for the service. The maximum number of `serviceRegistries` blocks is `1`. [Detailed below](#service_registries).
+* `tags` - (Optional) A map of tags to assign to the file system. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level. If you have set `copyTagsToBackups` to true, and you specify one or more tags, no existing file system tags are copied from the file system to the backup.
+* `waitUntilStable` - (Optional) Whether `terraform` should wait until the task set has reached `steadyState`.
+* `waitUntilStableTimeout` - (Optional) Wait timeout for task set to reach `steadyState`. Valid time units include `ns`, `us` (or `µs`), `ms`, `s`, `m`, and `h`. Default `10M`.
+
+## capacity_provider_strategy
+
+The `capacityProviderStrategy` configuration block supports the following:
+
+* `capacityProvider` - (Required) The short name or full Amazon Resource Name (ARN) of the capacity provider.
+* `weight` - (Required) The relative percentage of the total number of launched tasks that should use the specified capacity provider.
+* `base` - (Optional) The number of tasks, at a minimum, to run on the specified capacity provider. Only one capacity provider in a capacity provider strategy can have a base defined.
+
+## load_balancer
+
+The `loadBalancer` configuration block supports the following:
+
+* `containerName` - (Required) The name of the container to associate with the load balancer (as it appears in a container definition).
+* `loadBalancerName` - (Optional, Required for ELB Classic) The name of the ELB (Classic) to associate with the service.
+* `targetGroupArn` - (Optional, Required for ALB/NLB) The ARN of the Load Balancer target group to associate with the service.
+* `containerPort` - (Optional) The port on the container to associate with the load balancer. Defaults to `0` if not specified.
+
+~> **Note:** Specifying multiple `loadBalancer` configurations is still not supported by AWS for ECS task set.
+
+## network_configuration
+
+The `networkConfiguration` configuration block supports the following:
+
+* `subnets` - (Required) The subnets associated with the task or service. Maximum of 16.
+* `securityGroups` - (Optional) The security groups associated with the task or service. If you do not specify a security group, the default security group for the VPC is used. Maximum of 5.
+* `assignPublicIp` - (Optional) Whether to assign a public IP address to the ENI (`fargate` launch type only). Valid values are `true` or `false`. Default `false`.
+
+For more information, see [Task Networking](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-networking.html).
+
+## scale
+
+The `scale` configuration block supports the following:
+
+* `unit` - (Optional) The unit of measure for the scale value. Default: `percent`.
+* `value` - (Optional) The value, specified as a percent total of a service's `desiredCount`, to scale the task set. Defaults to `0` if not specified. Accepted values are numbers between 0.0 and 100.0.
+
+## service_registries
+
+`serviceRegistries` support the following:
+
+* `registryArn` - (Required) The ARN of the Service Registry. The currently supported service registry is Amazon Route 53 Auto Naming Service([`awsServiceDiscoveryService` resource](/docs/providers/aws/r/service_discovery_service.html)). For more information, see [Service](https://docs.aws.amazon.com/Route53/latest/APIReference/API_autonaming_Service.html).
+* `port` - (Optional) The port value used if your Service Discovery service specified an SRV record.
+* `containerPort` - (Optional) The port value, already specified in the task definition, to be used for your service discovery service.
+* `containerName` - (Optional) The container name value, already specified in the task definition, to be used for your service discovery service.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The `taskSetId`, `service` and `cluster` separated by commas (`,`).
+* `arn` - The Amazon Resource Name (ARN) that identifies the task set.
+* `stabilityStatus` - The stability status. This indicates whether the task set has reached a steady state.
+* `status` - The status of the task set.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `taskSetId` - The ID of the task set.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import ECS Task Sets using the `taskSetId`, `service`, and `cluster` separated by commas (`,`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import ECS Task Sets using the `taskSetId`, `service`, and `cluster` separated by commas (`,`). For example:
+
+```console
+% terraform import aws_ecs_task_set.example ecs-svc/7177320696926227436,arn:aws:ecs:us-west-2:123456789101:service/example/example-1234567890,arn:aws:ecs:us-west-2:123456789101:cluster/example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-0c23f439c10bf62237c2978dae4ddbb20ffe6a937ff6356657670867f1942259 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/efs_access_point.html.markdown b/website/docs/cdktf/typescript/r/efs_access_point.html.markdown
new file mode 100644
index 00000000000..87687189d27
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/efs_access_point.html.markdown
@@ -0,0 +1,98 @@
+---
+subcategory: "EFS (Elastic File System)"
+layout: "aws"
+page_title: "AWS: aws_efs_access_point"
+description: |-
+  Provides an Elastic File System (EFS) access point.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_efs_access_point
+
+Provides an Elastic File System (EFS) access point.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EfsAccessPoint } from "./.gen/providers/aws/efs-access-point";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new EfsAccessPoint(this, "test", {
+      fileSystemId: foo.id,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `fileSystemId` - (Required) ID of the file system for which the access point is intended.
+* `posixUser` - (Optional) Operating system user and group applied to all file system requests made using the access point. [Detailed](#posix_user) below.
+* `rootDirectory`- (Optional) Directory on the Amazon EFS file system that the access point provides access to. [Detailed](#root_directory) below.
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### posix_user
+
+* `gid` - (Required) POSIX group ID used for all file system operations using this access point.
+* `secondaryGids` - (Optional) Secondary POSIX group IDs used for all file system operations using this access point.
+* `uid` - (Required) POSIX user ID used for all file system operations using this access point.
+
+### root_directory
+
+The access point exposes the specified file system path as the root directory of your file system to applications using the access point. NFS clients using the access point can only access data in the access point's RootDirectory and it's subdirectories.
+
+* `creationInfo` - (Optional) POSIX IDs and permissions to apply to the access point's Root Directory. See [Creation Info](#creation_info) below.
+* `path` - (Optional) Path on the EFS file system to expose as the root directory to NFS clients using the access point to access the EFS file system. A path can have up to four subdirectories. If the specified path does not exist, you are required to provide `creationInfo`.
+
+### creation_info
+
+If the `path` specified does not exist, EFS creates the root directory using the `creationInfo` settings when a client connects to an access point.
+
+* `ownerGid` - (Required) POSIX group ID to apply to the `rootDirectory`.
+* `ownerUid` - (Required) POSIX user ID to apply to the `rootDirectory`.
+* `permissions` - (Required) POSIX permissions to apply to the RootDirectory, in the format of an octal number representing the file's mode bits.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the access point.
+* `fileSystemArn` - ARN of the file system.
+* `id` - ID of the access point.
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import the EFS access points using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import the EFS access points using the `id`. For example:
+
+```console
+% terraform import aws_efs_access_point.test fsap-52a643fb
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ffd407eb1dbab3cdcf58701fd44811aa2c2bcc1408ea548ad5726f0832c16821 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/efs_backup_policy.html.markdown b/website/docs/cdktf/typescript/r/efs_backup_policy.html.markdown
new file mode 100644
index 00000000000..8c8311012ee
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/efs_backup_policy.html.markdown
@@ -0,0 +1,86 @@
+---
+subcategory: "EFS (Elastic File System)"
+layout: "aws"
+page_title: "AWS: aws_efs_backup_policy"
+description: |-
+  Provides an Elastic File System (EFS) Backup Policy resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_efs_backup_policy
+
+Provides an Elastic File System (EFS) Backup Policy resource.
+Backup policies turn automatic backups on or off for an existing file system.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EfsBackupPolicy } from "./.gen/providers/aws/efs-backup-policy";
+import { EfsFileSystem } from "./.gen/providers/aws/efs-file-system";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const fs = new EfsFileSystem(this, "fs", {
+      creationToken: "my-product",
+    });
+    new EfsBackupPolicy(this, "policy", {
+      backupPolicy: {
+        status: "ENABLED",
+      },
+      fileSystemId: fs.id,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `fileSystemId` - (Required) The ID of the EFS file system.
+* `backupPolicy` - (Required) A backup_policy object (documented below).
+
+### Backup Policy Arguments
+
+`backupPolicy` supports the following arguments:
+
+* `status` - (Required) A status of the backup policy. Valid values: `enabled`, `disabled`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID that identifies the file system (e.g., fs-ccfc0d65).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import the EFS backup policies using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import the EFS backup policies using the `id`. For example:
+
+```console
+% terraform import aws_efs_backup_policy.example fs-6fa144c6
+```
+
+<!-- cache-key: cdktf-0.18.0 input-2eaef1b32aa6d84fbacde458faaad79654ff49b6670f288a4068fb17b6e3960c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/efs_file_system.html.markdown b/website/docs/cdktf/typescript/r/efs_file_system.html.markdown
new file mode 100644
index 00000000000..a73e03bd425
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/efs_file_system.html.markdown
@@ -0,0 +1,135 @@
+---
+subcategory: "EFS (Elastic File System)"
+layout: "aws"
+page_title: "AWS: aws_efs_file_system"
+description: |-
+  Provides an Elastic File System (EFS) File System resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_efs_file_system
+
+Provides an Elastic File System (EFS) File System resource.
+
+## Example Usage
+
+### EFS File System w/ tags
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EfsFileSystem } from "./.gen/providers/aws/efs-file-system";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new EfsFileSystem(this, "foo", {
+      creationToken: "my-product",
+      tags: {
+        Name: "MyProduct",
+      },
+    });
+  }
+}
+
+```
+
+### Using lifecycle policy
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EfsFileSystem } from "./.gen/providers/aws/efs-file-system";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new EfsFileSystem(this, "foo_with_lifecyle_policy", {
+      creationToken: "my-product",
+      lifecyclePolicy: [
+        {
+          transitionToIa: "AFTER_30_DAYS",
+        },
+      ],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `availabilityZoneName` - (Optional) the AWS Availability Zone in which to create the file system. Used to create a file system that uses One Zone storage classes. See [user guide](https://docs.aws.amazon.com/efs/latest/ug/storage-classes.html) for more information.
+* `creationToken` - (Optional) A unique name (a maximum of 64 characters are allowed)
+used as reference when creating the Elastic File System to ensure idempotent file
+system creation. By default generated by Terraform. See [Elastic File System](http://docs.aws.amazon.com/efs/latest/ug/)
+user guide for more information.
+* `encrypted` - (Optional) If true, the disk will be encrypted.
+* `kmsKeyId` - (Optional) The ARN for the KMS encryption key. When specifying kms_key_id, encrypted needs to be set to true.
+* `lifecyclePolicy` - (Optional) A file system [lifecycle policy](https://docs.aws.amazon.com/efs/latest/ug/API_LifecyclePolicy.html) object (documented below).
+* `performanceMode` - (Optional) The file system performance mode. Can be either `"generalPurpose"` or `"maxIo"` (Default: `"generalPurpose"`).
+* `provisionedThroughputInMibps` - (Optional) The throughput, measured in MiB/s, that you want to provision for the file system. Only applicable with `throughputMode` set to `provisioned`.
+* `tags` - (Optional) A map of tags to assign to the file system. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `throughputMode` - (Optional) Throughput mode for the file system. Defaults to `bursting`. Valid values: `bursting`, `provisioned`, or `elastic`. When using `provisioned`, also set `provisionedThroughputInMibps`.
+
+### Lifecycle Policy Arguments
+
+`lifecyclePolicy` supports the following arguments:
+
+* `transitionToIa` - (Optional) Indicates how long it takes to transition files to the IA storage class. Valid values: `after1Day`, `after7Days`, `after14Days`, `after30Days`, `after60Days`, or `after90Days`.
+* `transitionToPrimaryStorageClass` - (Optional) Describes the policy used to transition a file from infequent access storage to primary storage. Valid values: `after1Access`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name of the file system.
+* `availabilityZoneId` - The identifier of the Availability Zone in which the file system's One Zone storage classes exist.
+* `id` - The ID that identifies the file system (e.g., fs-ccfc0d65).
+* `dnsName` - The DNS name for the filesystem per [documented convention](http://docs.aws.amazon.com/efs/latest/ug/mounting-fs-mount-cmd-dns-name.html).
+* `name` - The value of the file system's `name` tag.
+* `numberOfMountTargets` - The current number of mount targets that the file system has.
+* `ownerId` - The AWS account that created the file system. If the file system was createdby an IAM user, the parent account to which the user belongs is the owner.
+* `sizeInBytes` - The latest known metered size (in bytes) of data stored in the file system, the value is not the exact size that the file system was at any point in time. See [Size In Bytes](#size-in-bytes).
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+### Size In Bytes
+
+* `value` - The latest known metered size (in bytes) of data stored in the file system.
+* `valueInIa` - The latest known metered size (in bytes) of data stored in the Infrequent Access storage class.
+* `valueInStandard` - The latest known metered size (in bytes) of data stored in the Standard storage class.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import the EFS file systems using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import the EFS file systems using the `id`. For example:
+
+```console
+% terraform import aws_efs_file_system.foo fs-6fa144c6
+```
+
+<!-- cache-key: cdktf-0.18.0 input-b61c944770ac6802dbeb15c2afb8f175aaffd7b4d47e45eb8ac4c3b58d546d0b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/efs_file_system_policy.html.markdown b/website/docs/cdktf/typescript/r/efs_file_system_policy.html.markdown
new file mode 100644
index 00000000000..98f0f23ccb9
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/efs_file_system_policy.html.markdown
@@ -0,0 +1,114 @@
+---
+subcategory: "EFS (Elastic File System)"
+layout: "aws"
+page_title: "AWS: aws_efs_file_system_policy"
+description: |-
+  Provides an Elastic File System (EFS) File System Policy resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_efs_file_system_policy
+
+Provides an Elastic File System (EFS) File System Policy resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { EfsFileSystem } from "./.gen/providers/aws/efs-file-system";
+import { EfsFileSystemPolicy } from "./.gen/providers/aws/efs-file-system-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const fs = new EfsFileSystem(this, "fs", {
+      creationToken: "my-product",
+    });
+    const policy = new DataAwsIamPolicyDocument(this, "policy", {
+      statement: [
+        {
+          actions: [
+            "elasticfilesystem:ClientMount",
+            "elasticfilesystem:ClientWrite",
+          ],
+          condition: [
+            {
+              test: "Bool",
+              values: ["true"],
+              variable: "aws:SecureTransport",
+            },
+          ],
+          effect: "Allow",
+          principals: [
+            {
+              identifiers: ["*"],
+              type: "AWS",
+            },
+          ],
+          resources: [fs.arn],
+          sid: "ExampleStatement01",
+        },
+      ],
+    });
+    const awsEfsFileSystemPolicyPolicy = new EfsFileSystemPolicy(
+      this,
+      "policy_2",
+      {
+        fileSystemId: fs.id,
+        policy: Token.asString(policy.json),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsEfsFileSystemPolicyPolicy.overrideLogicalId("policy");
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `fileSystemId` - (Required) The ID of the EFS file system.
+* `policy` - (Required) The JSON formatted file system policy for the EFS file system. see [Docs](https://docs.aws.amazon.com/efs/latest/ug/access-control-overview.html#access-control-manage-access-intro-resource-policies) for more info.
+
+The following arguments are optional:
+
+* `bypassPolicyLockoutSafetyCheck` - (Optional) A flag to indicate whether to bypass the `awsEfsFileSystemPolicy` lockout safety check. The policy lockout safety check determines whether the policy in the request will prevent the principal making the request will be locked out from making future `putFileSystemPolicy` requests on the file system. Set `bypassPolicyLockoutSafetyCheck` to `true` only when you intend to prevent the principal that is making the request from making a subsequent `putFileSystemPolicy` request on the file system. The default value is `false`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID that identifies the file system (e.g., fs-ccfc0d65).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import the EFS file system policies using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import the EFS file system policies using the `id`. For example:
+
+```console
+% terraform import aws_efs_file_system_policy.foo fs-6fa144c6
+```
+
+<!-- cache-key: cdktf-0.18.0 input-51ce0e6776bd5a12b73f8fd6edc2135ed20119de727978bb7a52e39fe7641ce6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/efs_mount_target.html.markdown b/website/docs/cdktf/typescript/r/efs_mount_target.html.markdown
new file mode 100644
index 00000000000..a4c096c00d8
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/efs_mount_target.html.markdown
@@ -0,0 +1,107 @@
+---
+subcategory: "EFS (Elastic File System)"
+layout: "aws"
+page_title: "AWS: aws_efs_mount_target"
+description: |-
+  Provides an Elastic File System (EFS) mount target.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_efs_mount_target
+
+Provides an Elastic File System (EFS) mount target.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EfsMountTarget } from "./.gen/providers/aws/efs-mount-target";
+import { Subnet } from "./.gen/providers/aws/subnet";
+import { Vpc } from "./.gen/providers/aws/vpc";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const foo = new Vpc(this, "foo", {
+      cidrBlock: "10.0.0.0/16",
+    });
+    const alpha = new Subnet(this, "alpha", {
+      availabilityZone: "us-west-2a",
+      cidrBlock: "10.0.1.0/24",
+      vpcId: foo.id,
+    });
+    const awsEfsMountTargetAlpha = new EfsMountTarget(this, "alpha_2", {
+      fileSystemId: Token.asString(awsEfsFileSystemFoo.id),
+      subnetId: alpha.id,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsEfsMountTargetAlpha.overrideLogicalId("alpha");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `fileSystemId` - (Required) The ID of the file system for which the mount target is intended.
+* `subnetId` - (Required) The ID of the subnet to add the mount target in.
+* `ipAddress` - (Optional) The address (within the address range of the specified subnet) at
+which the file system may be mounted via the mount target.
+* `securityGroups` - (Optional) A list of up to 5 VPC security group IDs (that must
+be for the same VPC as subnet specified) in effect for the mount target.
+
+## Attribute Reference
+
+~> **Note:** The `dnsName` and `mountTargetDnsName` attributes are only useful if the mount target is in a VPC that has
+support for DNS hostnames enabled. See [Using DNS with Your VPC](http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/vpc-dns.html)
+and [VPC resource](/docs/providers/aws/r/vpc.html#enable_dns_hostnames) in Terraform for more information.
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the mount target.
+* `dnsName` - The DNS name for the EFS file system.
+* `mountTargetDnsName` - The DNS name for the given subnet/AZ per [documented convention](http://docs.aws.amazon.com/efs/latest/ug/mounting-fs-mount-cmd-dns-name.html).
+* `fileSystemArn` - Amazon Resource Name of the file system.
+* `networkInterfaceId` - The ID of the network interface that Amazon EFS created when it created the mount target.
+* `availabilityZoneName` - The name of the Availability Zone (AZ) that the mount target resides in.
+* `availabilityZoneId` - The unique and consistent identifier of the Availability Zone (AZ) that the mount target resides in.
+* `ownerId` - AWS account ID that owns the resource.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `30M`)
+- `delete` - (Default `10M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import the EFS mount targets using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import the EFS mount targets using the `id`. For example:
+
+```console
+% terraform import aws_efs_mount_target.alpha fsmt-52a643fb
+```
+
+<!-- cache-key: cdktf-0.18.0 input-7dcbc13dbededd010d6caa93608126170e98da8f59ca6aabaeeb59e86082c8d2 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/efs_replication_configuration.html.markdown b/website/docs/cdktf/typescript/r/efs_replication_configuration.html.markdown
new file mode 100644
index 00000000000..5f9be621939
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/efs_replication_configuration.html.markdown
@@ -0,0 +1,134 @@
+---
+subcategory: "EFS (Elastic File System)"
+layout: "aws"
+page_title: "AWS: aws_efs_replication_configuration"
+description: Provides an Elastic File System (EFS) Replication Configuration.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_efs_replication_configuration
+
+Creates a replica of an existing EFS file system in the same or another region. Creating this resource causes the source EFS file system to be replicated to a new read-only destination EFS file system. Deleting this resource will cause the replication from source to destination to stop and the destination file system will no longer be read only.
+
+~> **NOTE:** Deleting this resource does **not** delete the destination file system that was created.
+
+## Example Usage
+
+Will create a replica using regional storage in us-west-2 that will be encrypted by the default EFS KMS key `/aws/elasticfilesystem`.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EfsFileSystem } from "./.gen/providers/aws/efs-file-system";
+import { EfsReplicationConfiguration } from "./.gen/providers/aws/efs-replication-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new EfsFileSystem(this, "example", {});
+    const awsEfsReplicationConfigurationExample =
+      new EfsReplicationConfiguration(this, "example_1", {
+        destination: {
+          region: "us-west-2",
+        },
+        sourceFileSystemId: example.id,
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsEfsReplicationConfigurationExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+Replica will be created as One Zone storage in the us-west-2b Availability Zone and encrypted with the specified KMS key.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EfsFileSystem } from "./.gen/providers/aws/efs-file-system";
+import { EfsReplicationConfiguration } from "./.gen/providers/aws/efs-replication-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new EfsFileSystem(this, "example", {});
+    const awsEfsReplicationConfigurationExample =
+      new EfsReplicationConfiguration(this, "example_1", {
+        destination: {
+          availabilityZoneName: "us-west-2b",
+          kmsKeyId: "1234abcd-12ab-34cd-56ef-1234567890ab",
+        },
+        sourceFileSystemId: example.id,
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsEfsReplicationConfigurationExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `sourceFileSystemId` - (Required) The ID of the file system that is to be replicated.
+* `destination` - (Required) A destination configuration block (documented below).
+
+### Destination Arguments
+
+`destination` supports the following arguments:
+
+* `availabilityZoneName` - (Optional) The availability zone in which the replica should be created. If specified, the replica will be created with One Zone storage. If omitted, regional storage will be used.
+* `kmsKeyId` - (Optional) The Key ID, ARN, alias, or alias ARN of the KMS key that should be used to encrypt the replica file system. If omitted, the default KMS key for EFS `/aws/elasticfilesystem` will be used.
+* `region` - (Optional) The region in which the replica should be created.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `creationTime` - When the replication configuration was created.
+* `originalSourceFileSystemArn` - The Amazon Resource Name (ARN) of the original source Amazon EFS file system in the replication configuration.
+* `sourceFileSystemArn` - The Amazon Resource Name (ARN) of the current source file system in the replication configuration.
+* `sourceFileSystemRegion` - The AWS Region in which the source Amazon EFS file system is located.
+* `destination[0]FileSystemId` - The fs ID of the replica.
+* `destination[0]Status` - The status of the replication.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `10M`)
+* `delete` - (Default `20M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EFS Replication Configurations using the file system ID of either the source or destination file system. When importing, the `availabilityZoneName` and `kmsKeyId` attributes must **not** be set in the configuration. The AWS API does not return these values when querying the replication configuration and their presence will therefore show as a diff in a subsequent plan. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import EFS Replication Configurations using the file system ID of either the source or destination file system. When importing, the `availabilityZoneName` and `kmsKeyId` attributes must **not** be set in the configuration. The AWS API does not return these values when querying the replication configuration and their presence will therefore show as a diff in a subsequent plan. For example:
+
+```console
+% terraform import aws_efs_replication_configuration.example fs-id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-946efd1b44fba73bdf7367fb477373ab0672aab7b032ed389da0ec41f5bbc874 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/egress_only_internet_gateway.html.markdown b/website/docs/cdktf/typescript/r/egress_only_internet_gateway.html.markdown
new file mode 100644
index 00000000000..de6858804ac
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/egress_only_internet_gateway.html.markdown
@@ -0,0 +1,90 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_egress_only_internet_gateway"
+description: |-
+  Provides a resource to create an egress-only Internet gateway.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_egress_only_internet_gateway
+
+[IPv6 only] Creates an egress-only Internet gateway for your VPC.
+An egress-only Internet gateway is used to enable outbound communication
+over IPv6 from instances in your VPC to the Internet, and prevents hosts
+outside of your VPC from initiating an IPv6 connection with your instance.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EgressOnlyInternetGateway } from "./.gen/providers/aws/egress-only-internet-gateway";
+import { Vpc } from "./.gen/providers/aws/vpc";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new Vpc(this, "example", {
+      assignGeneratedIpv6CidrBlock: true,
+      cidrBlock: "10.1.0.0/16",
+    });
+    const awsEgressOnlyInternetGatewayExample = new EgressOnlyInternetGateway(
+      this,
+      "example_1",
+      {
+        tags: {
+          Name: "main",
+        },
+        vpcId: example.id,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsEgressOnlyInternetGatewayExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `vpcId` - (Required) The VPC ID to create in.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the egress-only Internet gateway.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Egress-only Internet gateways using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Egress-only Internet gateways using the `id`. For example:
+
+```console
+% terraform import aws_egress_only_internet_gateway.example eigw-015e0e244e24dfe8a
+```
+
+<!-- cache-key: cdktf-0.18.0 input-7ed3e94395680c60b6e40820f5a3e85dfb53bdc2a67b6dc191917e0125e4b534 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/eip.html.markdown b/website/docs/cdktf/typescript/r/eip.html.markdown
new file mode 100644
index 00000000000..915c47693da
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/eip.html.markdown
@@ -0,0 +1,220 @@
+---
+subcategory: "EC2 (Elastic Compute Cloud)"
+layout: "aws"
+page_title: "AWS: aws_eip"
+description: |-
+  Provides an Elastic IP resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_eip
+
+Provides an Elastic IP resource.
+
+~> **Note:** EIP may require IGW to exist prior to association. Use `dependsOn` to set an explicit dependency on the IGW.
+
+~> **Note:** Do not use `networkInterface` to associate the EIP to `awsLb` or `awsNatGateway` resources. Instead use the `allocationId` available in those resources to allow AWS to manage the association, otherwise you will see `authFailure` errors.
+
+## Example Usage
+
+### Single EIP associated with an instance
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Eip } from "./.gen/providers/aws/eip";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Eip(this, "lb", {
+      domain: "vpc",
+      instance: web.id,
+    });
+  }
+}
+
+```
+
+### Multiple EIPs associated with a single network interface
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Eip } from "./.gen/providers/aws/eip";
+import { NetworkInterface } from "./.gen/providers/aws/network-interface";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const multiIp = new NetworkInterface(this, "multi-ip", {
+      privateIps: ["10.0.0.10", "10.0.0.11"],
+      subnetId: main.id,
+    });
+    new Eip(this, "one", {
+      associateWithPrivateIp: "10.0.0.10",
+      domain: "vpc",
+      networkInterface: multiIp.id,
+    });
+    new Eip(this, "two", {
+      associateWithPrivateIp: "10.0.0.11",
+      domain: "vpc",
+      networkInterface: multiIp.id,
+    });
+  }
+}
+
+```
+
+### Attaching an EIP to an Instance with a pre-assigned private ip (VPC Only)
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Eip } from "./.gen/providers/aws/eip";
+import { Instance } from "./.gen/providers/aws/instance";
+import { InternetGateway } from "./.gen/providers/aws/internet-gateway";
+import { Subnet } from "./.gen/providers/aws/subnet";
+import { Vpc } from "./.gen/providers/aws/vpc";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const defaultVar = new Vpc(this, "default", {
+      cidrBlock: "10.0.0.0/16",
+      enableDnsHostnames: true,
+    });
+    const gw = new InternetGateway(this, "gw", {
+      vpcId: defaultVar.id,
+    });
+    const tfTestSubnet = new Subnet(this, "tf_test_subnet", {
+      cidrBlock: "10.0.0.0/24",
+      dependsOn: [gw],
+      mapPublicIpOnLaunch: true,
+      vpcId: defaultVar.id,
+    });
+    const foo = new Instance(this, "foo", {
+      ami: "ami-5189a661",
+      instanceType: "t2.micro",
+      privateIp: "10.0.0.12",
+      subnetId: tfTestSubnet.id,
+    });
+    new Eip(this, "bar", {
+      associateWithPrivateIp: "10.0.0.12",
+      dependsOn: [gw],
+      domain: "vpc",
+      instance: foo.id,
+    });
+  }
+}
+
+```
+
+### Allocating EIP from the BYOIP pool
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Eip } from "./.gen/providers/aws/eip";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Eip(this, "byoip-ip", {
+      domain: "vpc",
+      publicIpv4Pool: "ipv4pool-ec2-012345",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `address` - (Optional) IP address from an EC2 BYOIP pool. This option is only available for VPC EIPs.
+* `associateWithPrivateIp` - (Optional) User-specified primary or secondary private IP address to associate with the Elastic IP address. If no private IP address is specified, the Elastic IP address is associated with the primary private IP address.
+* `customerOwnedIpv4Pool` - (Optional) ID  of a customer-owned address pool. For more on customer owned IP addressed check out [Customer-owned IP addresses guide](https://docs.aws.amazon.com/outposts/latest/userguide/outposts-networking-components.html#ip-addressing).
+* `domain` - Indicates if this EIP is for use in VPC (`vpc`).
+* `instance` - (Optional) EC2 instance ID.
+* `networkBorderGroup` - (Optional) Location from which the IP address is advertised. Use this parameter to limit the address to this location.
+* `networkInterface` - (Optional) Network interface ID to associate with.
+* `publicIpv4Pool` - (Optional) EC2 IPv4 address pool identifier or `amazon`.
+  This option is only available for VPC EIPs.
+* `tags` - (Optional) Map of tags to assign to the resource. Tags can only be applied to EIPs in a VPC. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `vpc` - (Optional **Deprecated**) Boolean if the EIP is in a VPC or not. Use `domain` instead.
+  Defaults to `true` unless the region supports EC2-Classic.
+
+~> **NOTE:** You can specify either the `instance` ID or the `networkInterface` ID, but not both. Including both will **not** return an error from the AWS API, but will have undefined behavior. See the relevant [AssociateAddress API Call][1] for more information.
+
+~> **NOTE:** Specifying both `publicIpv4Pool` and `address` won't cause an error but `address` will be used in the
+case both options are defined as the api only requires one or the other.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `allocationId` - ID that AWS assigns to represent the allocation of the Elastic IP address for use with instances in a VPC.
+* `associationId` - ID representing the association of the address with an instance in a VPC.
+* `carrierIp` - Carrier IP address.
+* `customerOwnedIp` - Customer owned IP.
+* `id` - Contains the EIP allocation ID.
+* `privateDns` - The Private DNS associated with the Elastic IP address (if in VPC).
+* `privateIp` - Contains the private IP address (if in VPC).
+* `publicDns` - Public DNS associated with the Elastic IP address.
+* `publicIp` - Contains the public IP address.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+~> **Note:** The resource computes the `publicDns` and `privateDns` attributes according to the [VPC DNS Guide](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-dns.html#vpc-dns-hostnames) as they are not available with the EC2 API.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `15M`)
+- `update` - (Default `5M`)
+- `delete` - (Default `3M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EIPs in a VPC using their Allocation ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import EIPs in a VPC using their Allocation ID. For example:
+
+```console
+% terraform import aws_eip.bar eipalloc-00a10e96
+```
+
+[1]: https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AssociateAddress.html
+
+<!-- cache-key: cdktf-0.18.0 input-2894d9bbbc820133a7e6582361d7e5ae944dbddb77332e6b8487b7c5fcf90efe -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/eip_association.html.markdown b/website/docs/cdktf/typescript/r/eip_association.html.markdown
new file mode 100644
index 00000000000..c5e34df2ed5
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/eip_association.html.markdown
@@ -0,0 +1,111 @@
+---
+subcategory: "EC2 (Elastic Compute Cloud)"
+layout: "aws"
+page_title: "AWS: aws_eip_association"
+description: |-
+  Provides an AWS EIP Association
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_eip_association
+
+Provides an AWS EIP Association as a top level resource, to associate and
+disassociate Elastic IPs from AWS Instances and Network Interfaces.
+
+~> **NOTE:** Do not use this resource to associate an EIP to `awsLb` or `awsNatGateway` resources. Instead use the `allocationId` available in those resources to allow AWS to manage the association, otherwise you will see `authFailure` errors.
+
+~> **NOTE:** `awsEipAssociation` is useful in scenarios where EIPs are either
+pre-existing or distributed to customers or users and therefore cannot be changed.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Eip } from "./.gen/providers/aws/eip";
+import { EipAssociation } from "./.gen/providers/aws/eip-association";
+import { Instance } from "./.gen/providers/aws/instance";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new Eip(this, "example", {
+      domain: "vpc",
+    });
+    const web = new Instance(this, "web", {
+      ami: "ami-21f78e11",
+      availabilityZone: "us-west-2a",
+      instanceType: "t2.micro",
+      tags: {
+        Name: "HelloWorld",
+      },
+    });
+    new EipAssociation(this, "eip_assoc", {
+      allocationId: example.id,
+      instanceId: web.id,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `allocationId` - (Optional) The allocation ID. This is required for EC2-VPC.
+* `allowReassociation` - (Optional, Boolean) Whether to allow an Elastic IP to
+be re-associated. Defaults to `true` in VPC.
+* `instanceId` - (Optional) The ID of the instance. This is required for
+EC2-Classic. For EC2-VPC, you can specify either the instance ID or the
+network interface ID, but not both. The operation fails if you specify an
+instance ID unless exactly one network interface is attached.
+* `networkInterfaceId` - (Optional) The ID of the network interface. If the
+instance has more than one network interface, you must specify a network
+interface ID.
+* `privateIpAddress` - (Optional) The primary or secondary private IP address
+to associate with the Elastic IP address. If no private IP address is
+specified, the Elastic IP address is associated with the primary private IP
+address.
+* `publicIp` - (Optional) The Elastic IP address. This is required for EC2-Classic.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `associationId` - The ID that represents the association of the Elastic IP
+address with an instance.
+* `allocationId` - As above
+* `instanceId` - As above
+* `networkInterfaceId` - As above
+* `privateIpAddress` - As above
+* `publicIp` - As above
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EIP Assocations using their association IDs. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import EIP Assocations using their association IDs. For example:
+
+```console
+% terraform import aws_eip_association.test eipassoc-ab12c345
+```
+
+<!-- cache-key: cdktf-0.18.0 input-0b7dcca3745ca6b46014b918c2445a458ece3c2721fbe7d3b6d1cb5ec4e2bb32 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/eks_addon.html.markdown b/website/docs/cdktf/typescript/r/eks_addon.html.markdown
new file mode 100644
index 00000000000..cf6256aa3b2
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/eks_addon.html.markdown
@@ -0,0 +1,306 @@
+---
+subcategory: "EKS (Elastic Kubernetes)"
+layout: "aws"
+page_title: "AWS: aws_eks_addon"
+description: |-
+  Manages an EKS add-on
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_eks_addon
+
+Manages an EKS add-on.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EksAddon } from "./.gen/providers/aws/eks-addon";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new EksAddon(this, "example", {
+      addonName: "vpc-cni",
+      clusterName: Token.asString(awsEksClusterExample.name),
+    });
+  }
+}
+
+```
+
+## Example Update add-on usage with resolve_conflicts_on_update and PRESERVE
+
+`resolveConflictsOnUpdate` with `preserve` can be used to retain the config changes applied to the add-on with kubectl while upgrading to a newer version of the add-on.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EksAddon } from "./.gen/providers/aws/eks-addon";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new EksAddon(this, "example", {
+      addonName: "coredns",
+      addonVersion: "v1.10.1-eksbuild.1",
+      clusterName: Token.asString(awsEksClusterExample.name),
+      resolveConflictsOnUpdate: "PRESERVE",
+    });
+  }
+}
+
+```
+
+## Example add-on usage with custom configuration_values
+
+Custom add-on configuration can be passed using `configurationValues` as a single JSON string while creating or updating the add-on.
+
+~> **Note:** `configurationValues` is a single JSON string should match the valid JSON schema for each add-on with specific version.
+
+To find the correct JSON schema for each add-on can be extracted using [describe-addon-configuration](https://docs.aws.amazon.com/cli/latest/reference/eks/describe-addon-configuration.html) call.
+This below is an example for extracting the `configurationValues` schema for `coredns`.
+
+```bash
+ aws eks describe-addon-configuration \
+ --addon-name coredns \
+ --addon-version v1.10.1-eksbuild.1
+```
+
+Example to create a `coredns` managed addon with custom `configurationValues`.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EksAddon } from "./.gen/providers/aws/eks-addon";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new EksAddon(this, "example", {
+      addonName: "coredns",
+      addonVersion: "v1.10.1-eksbuild.1",
+      clusterName: "mycluster",
+      configurationValues: Token.asString(
+        Fn.jsonencode({
+          replicaCount: 4,
+          resources: {
+            limits: {
+              cpu: "100m",
+              memory: "150Mi",
+            },
+            requests: {
+              cpu: "100m",
+              memory: "150Mi",
+            },
+          },
+        })
+      ),
+      resolveConflictsOnCreate: "OVERWRITE",
+    });
+  }
+}
+
+```
+
+### Example IAM Role for EKS Addon "vpc-cni" with AWS managed policy
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { EksCluster } from "./.gen/providers/aws/eks-cluster";
+import { IamOpenidConnectProvider } from "./.gen/providers/aws/iam-openid-connect-provider";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+import { IamRolePolicyAttachment } from "./.gen/providers/aws/iam-role-policy-attachment";
+import { DataTlsCertificate } from "./.gen/providers/tls/data-tls-certificate";
+interface MyConfig {
+  name: any;
+  roleArn: any;
+  vpcConfig: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    /*The following providers are missing schema information and might need manual adjustments to synthesize correctly: tls.
+    For a more precise conversion please use the --provider flag in convert.*/
+    const example = new EksCluster(this, "example", {
+      name: config.name,
+      roleArn: config.roleArn,
+      vpcConfig: config.vpcConfig,
+    });
+    const dataTlsCertificateExample = new DataTlsCertificate(
+      this,
+      "example_1",
+      {
+        url: Fn.lookupNested(example.identity, ["0", "oidc", "0", "issuer"]),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataTlsCertificateExample.overrideLogicalId("example");
+    const awsIamOpenidConnectProviderExample = new IamOpenidConnectProvider(
+      this,
+      "example_2",
+      {
+        clientIdList: ["sts.amazonaws.com"],
+        thumbprintList: [
+          Token.asString(
+            Fn.lookupNested(dataTlsCertificateExample.certificates, [
+              "0",
+              "sha1_fingerprint",
+            ])
+          ),
+        ],
+        url: Token.asString(
+          Fn.lookupNested(example.identity, ["0", "oidc", "0", "issuer"])
+        ),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamOpenidConnectProviderExample.overrideLogicalId("example");
+    const exampleAssumeRolePolicy = new DataAwsIamPolicyDocument(
+      this,
+      "example_assume_role_policy",
+      {
+        statement: [
+          {
+            actions: ["sts:AssumeRoleWithWebIdentity"],
+            condition: [
+              {
+                test: "StringEquals",
+                values: ["system:serviceaccount:kube-system:aws-node"],
+                variable:
+                  Token.asString(
+                    Fn.replace(
+                      Token.asString(awsIamOpenidConnectProviderExample.url),
+                      "https://",
+                      ""
+                    )
+                  ) + ":sub",
+              },
+            ],
+            effect: "Allow",
+            principals: [
+              {
+                identifiers: [
+                  Token.asString(awsIamOpenidConnectProviderExample.arn),
+                ],
+                type: "Federated",
+              },
+            ],
+          },
+        ],
+      }
+    );
+    const awsIamRoleExample = new IamRole(this, "example_4", {
+      assumeRolePolicy: Token.asString(exampleAssumeRolePolicy.json),
+      name: "example-vpc-cni-role",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamRoleExample.overrideLogicalId("example");
+    const awsIamRolePolicyAttachmentExample = new IamRolePolicyAttachment(
+      this,
+      "example_5",
+      {
+        policyArn: "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy",
+        role: Token.asString(awsIamRoleExample.name),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamRolePolicyAttachmentExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `addonName` – (Required) Name of the EKS add-on. The name must match one of
+  the names returned by [describe-addon-versions](https://docs.aws.amazon.com/cli/latest/reference/eks/describe-addon-versions.html).
+* `clusterName` – (Required) Name of the EKS Cluster. Must be between 1-100 characters in length. Must begin with an alphanumeric character, and must only contain alphanumeric characters, dashes and underscores (`^[0-9A-Za-z][A-Za-z0-9\-_]+$`).
+
+The following arguments are optional:
+
+* `addonVersion` – (Optional) The version of the EKS add-on. The version must
+  match one of the versions returned by [describe-addon-versions](https://docs.aws.amazon.com/cli/latest/reference/eks/describe-addon-versions.html).
+* `configurationValues` - (Optional) custom configuration values for addons with single JSON string. This JSON string value must match the JSON schema derived from [describe-addon-configuration](https://docs.aws.amazon.com/cli/latest/reference/eks/describe-addon-configuration.html).
+* `resolveConflictsOnCreate` - (Optional) How to resolve field value conflicts when migrating a self-managed add-on to an Amazon EKS add-on. Valid values are `none` and `overwrite`. For more details see the [CreateAddon](https://docs.aws.amazon.com/eks/latest/APIReference/API_CreateAddon.html) API Docs.
+* `resolveConflictsOnUpdate` - (Optional) How to resolve field value conflicts for an Amazon EKS add-on if you've changed a value from the Amazon EKS default value. Valid values are `none`, `overwrite`, and `preserve`. For more details see the [UpdateAddon](https://docs.aws.amazon.com/eks/latest/APIReference/API_UpdateAddon.html) API Docs.
+* `resolveConflicts` - (**Deprecated** use the `resolveConflictsOnCreate` and `resolveConflictsOnUpdate` attributes instead) Define how to resolve parameter value conflicts when migrating an existing add-on to an Amazon EKS add-on or when applying version updates to the add-on. Valid values are `none`, `overwrite` and `preserve`. Note that `preserve` is only valid on addon update, not for initial addon creation. If you need to set this to `preserve`, use the `resolveConflictsOnCreate` and `resolveConflictsOnUpdate` attributes instead. For more details check [UpdateAddon](https://docs.aws.amazon.com/eks/latest/APIReference/API_UpdateAddon.html) API Docs.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `preserve` - (Optional) Indicates if you want to preserve the created resources when deleting the EKS add-on.
+* `serviceAccountRoleArn` - (Optional) The Amazon Resource Name (ARN) of an
+  existing IAM role to bind to the add-on's service account. The role must be
+  assigned the IAM permissions required by the add-on. If you don't specify
+  an existing IAM role, then the add-on uses the permissions assigned to the node
+  IAM role. For more information, see [Amazon EKS node IAM role](https://docs.aws.amazon.com/eks/latest/userguide/create-node-role.html)
+  in the Amazon EKS User Guide.
+
+  ~> **Note:** To specify an existing IAM role, you must have an IAM OpenID Connect (OIDC)
+  provider created for your cluster. For more information, [see Enabling IAM roles
+  for service accounts on your cluster](https://docs.aws.amazon.com/eks/latest/userguide/enable-iam-roles-for-service-accounts.html)
+  in the Amazon EKS User Guide.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the EKS add-on.
+* `id` - EKS Cluster name and EKS Addon name separated by a colon (`:`).
+* `status` - Status of the EKS add-on.
+* `createdAt` - Date and time in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8) that the EKS add-on was created.
+* `modifiedAt` - Date and time in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8) that the EKS add-on was updated.
+* `tagsAll` - (Optional) Key-value map of resource tags, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `20M`)
+* `update` - (Default `20M`)
+* `delete` - (Default `40M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EKS add-on using the `clusterName` and `addonName` separated by a colon (`:`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import EKS add-on using the `clusterName` and `addonName` separated by a colon (`:`). For example:
+
+```console
+% terraform import aws_eks_addon.my_eks_addon my_cluster_name:my_addon_name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-e953ed182a0fa1dcb61c6d51bec7e4fd4935f7e22b773c4ebbee1298edc5e49e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/eks_cluster.html.markdown b/website/docs/cdktf/typescript/r/eks_cluster.html.markdown
new file mode 100644
index 00000000000..b2bbf705685
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/eks_cluster.html.markdown
@@ -0,0 +1,440 @@
+---
+subcategory: "EKS (Elastic Kubernetes)"
+layout: "aws"
+page_title: "AWS: aws_eks_cluster"
+description: |-
+  Manages an EKS Cluster
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_eks_cluster
+
+Manages an EKS Cluster.
+
+> **Hands-on:** For an example of `awsEksCluster` in use, follow the [Provision an EKS Cluster](https://learn.hashicorp.com/tutorials/terraform/eks) tutorial on HashiCorp Learn.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformOutput, Fn, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EksCluster } from "./.gen/providers/aws/eks-cluster";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new EksCluster(this, "example", {
+      dependsOn: [
+        exampleAmazonEksClusterPolicy,
+        exampleAmazonEksvpcResourceController,
+      ],
+      name: "example",
+      roleArn: Token.asString(awsIamRoleExample.arn),
+      vpcConfig: {
+        subnetIds: [example1.id, example2.id],
+      },
+    });
+    new TerraformOutput(this, "endpoint", {
+      value: example.endpoint,
+    });
+    new TerraformOutput(this, "kubeconfig-certificate-authority-data", {
+      value: Fn.lookupNested(example.certificateAuthority, ["0", "data"]),
+    });
+  }
+}
+
+```
+
+### Example IAM Role for EKS Cluster
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+import { IamRolePolicyAttachment } from "./.gen/providers/aws/iam-role-policy-attachment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const assumeRole = new DataAwsIamPolicyDocument(this, "assume_role", {
+      statement: [
+        {
+          actions: ["sts:AssumeRole"],
+          effect: "Allow",
+          principals: [
+            {
+              identifiers: ["eks.amazonaws.com"],
+              type: "Service",
+            },
+          ],
+        },
+      ],
+    });
+    const example = new IamRole(this, "example", {
+      assumeRolePolicy: Token.asString(assumeRole.json),
+      name: "eks-cluster-example",
+    });
+    new IamRolePolicyAttachment(this, "example-AmazonEKSClusterPolicy", {
+      policyArn: "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy",
+      role: example.name,
+    });
+    new IamRolePolicyAttachment(
+      this,
+      "example-AmazonEKSVPCResourceController",
+      {
+        policyArn: "arn:aws:iam::aws:policy/AmazonEKSVPCResourceController",
+        role: example.name,
+      }
+    );
+  }
+}
+
+```
+
+### Enabling Control Plane Logging
+
+[EKS Control Plane Logging](https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html) can be enabled via the `enabledClusterLogTypes` argument. To manage the CloudWatch Log Group retention period, the [`awsCloudwatchLogGroup` resource](/docs/providers/aws/r/cloudwatch_log_group.html) can be used.
+
+-> The below configuration uses [`dependsOn`](https://www.terraform.io/docs/configuration/meta-arguments/depends_on.html) to prevent ordering issues with EKS automatically creating the log group first and a variable for naming consistency. Other ordering and naming methodologies may be more appropriate for your environment.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { VariableType, TerraformVariable, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudwatchLogGroup } from "./.gen/providers/aws/cloudwatch-log-group";
+import { EksCluster } from "./.gen/providers/aws/eks-cluster";
+interface MyConfig {
+  roleArn: any;
+  vpcConfig: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    /*Terraform Variables are not always the best fit for getting inputs in the context of Terraform CDK.
+    You can read more about this at https://cdk.tf/variables*/
+    const clusterName = new TerraformVariable(this, "cluster_name", {
+      default: "example",
+      type: VariableType.STRING,
+    });
+    const example = new CloudwatchLogGroup(this, "example", {
+      name: "/aws/eks/${" + clusterName.value + "}/cluster",
+      retentionInDays: 7,
+    });
+    const awsEksClusterExample = new EksCluster(this, "example_2", {
+      dependsOn: [example],
+      enabledClusterLogTypes: ["api", "audit"],
+      name: clusterName.stringValue,
+      roleArn: config.roleArn,
+      vpcConfig: config.vpcConfig,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsEksClusterExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### Enabling IAM Roles for Service Accounts
+
+Only available on Kubernetes version 1.13 and 1.14 clusters created or upgraded on or after September 3, 2019. For more information about this feature, see the [EKS User Guide](https://docs.aws.amazon.com/eks/latest/userguide/enable-iam-roles-for-service-accounts.html).
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { EksCluster } from "./.gen/providers/aws/eks-cluster";
+import { IamOpenidConnectProvider } from "./.gen/providers/aws/iam-openid-connect-provider";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+import { DataTlsCertificate } from "./.gen/providers/tls/data-tls-certificate";
+interface MyConfig {
+  name: any;
+  roleArn: any;
+  vpcConfig: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    /*The following providers are missing schema information and might need manual adjustments to synthesize correctly: tls.
+    For a more precise conversion please use the --provider flag in convert.*/
+    const example = new EksCluster(this, "example", {
+      name: config.name,
+      roleArn: config.roleArn,
+      vpcConfig: config.vpcConfig,
+    });
+    const dataTlsCertificateExample = new DataTlsCertificate(
+      this,
+      "example_1",
+      {
+        url: Fn.lookupNested(example.identity, ["0", "oidc", "0", "issuer"]),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataTlsCertificateExample.overrideLogicalId("example");
+    const awsIamOpenidConnectProviderExample = new IamOpenidConnectProvider(
+      this,
+      "example_2",
+      {
+        clientIdList: ["sts.amazonaws.com"],
+        thumbprintList: [
+          Token.asString(
+            Fn.lookupNested(dataTlsCertificateExample.certificates, [
+              "0",
+              "sha1_fingerprint",
+            ])
+          ),
+        ],
+        url: Token.asString(dataTlsCertificateExample.url),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamOpenidConnectProviderExample.overrideLogicalId("example");
+    const exampleAssumeRolePolicy = new DataAwsIamPolicyDocument(
+      this,
+      "example_assume_role_policy",
+      {
+        statement: [
+          {
+            actions: ["sts:AssumeRoleWithWebIdentity"],
+            condition: [
+              {
+                test: "StringEquals",
+                values: ["system:serviceaccount:kube-system:aws-node"],
+                variable:
+                  Token.asString(
+                    Fn.replace(
+                      Token.asString(awsIamOpenidConnectProviderExample.url),
+                      "https://",
+                      ""
+                    )
+                  ) + ":sub",
+              },
+            ],
+            effect: "Allow",
+            principals: [
+              {
+                identifiers: [
+                  Token.asString(awsIamOpenidConnectProviderExample.arn),
+                ],
+                type: "Federated",
+              },
+            ],
+          },
+        ],
+      }
+    );
+    const awsIamRoleExample = new IamRole(this, "example_4", {
+      assumeRolePolicy: Token.asString(exampleAssumeRolePolicy.json),
+      name: "example",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamRoleExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### EKS Cluster on AWS Outpost
+
+[Creating a local Amazon EKS cluster on an AWS Outpost](https://docs.aws.amazon.com/eks/latest/userguide/create-cluster-outpost.html)
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EksCluster } from "./.gen/providers/aws/eks-cluster";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+interface MyConfig {
+  subnetIds: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    const example = new IamRole(this, "example", {
+      assumeRolePolicy: Token.asString(exampleAssumeRolePolicy.json),
+      name: "example",
+    });
+    const awsEksClusterExample = new EksCluster(this, "example_1", {
+      name: "example-cluster",
+      outpostConfig: {
+        controlPlaneInstanceType: "m5d.large",
+        outpostArns: [Token.asString(dataAwsOutpostsOutpostExample.arn)],
+      },
+      roleArn: example.arn,
+      vpcConfig: {
+        endpointPrivateAccess: true,
+        endpointPublicAccess: false,
+        subnetIds: config.subnetIds,
+      },
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsEksClusterExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+After adding inline IAM Policies (e.g., [`awsIamRolePolicy` resource](/docs/providers/aws/r/iam_role_policy.html)) or attaching IAM Policies (e.g., [`awsIamPolicy` resource](/docs/providers/aws/r/iam_policy.html) and [`awsIamRolePolicyAttachment` resource](/docs/providers/aws/r/iam_role_policy_attachment.html)) with the desired permissions to the IAM Role, annotate the Kubernetes service account (e.g., [`kubernetesServiceAccount` resource](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/service_account)) and recreate any pods.
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` – (Required) Name of the cluster. Must be between 1-100 characters in length. Must begin with an alphanumeric character, and must only contain alphanumeric characters, dashes and underscores (`^[0-9A-Za-z][A-Za-z0-9\-_]+$`).
+* `roleArn` - (Required) ARN of the IAM role that provides permissions for the Kubernetes control plane to make calls to AWS API operations on your behalf. Ensure the resource configuration includes explicit dependencies on the IAM Role permissions by adding [`dependsOn`](https://www.terraform.io/docs/configuration/meta-arguments/depends_on.html) if using the [`awsIamRolePolicy` resource](/docs/providers/aws/r/iam_role_policy.html) or [`awsIamRolePolicyAttachment` resource](/docs/providers/aws/r/iam_role_policy_attachment.html), otherwise EKS cannot delete EKS managed EC2 infrastructure such as Security Groups on EKS Cluster deletion.
+* `vpcConfig` - (Required) Configuration block for the VPC associated with your cluster. Amazon EKS VPC resources have specific requirements to work properly with Kubernetes. For more information, see [Cluster VPC Considerations](https://docs.aws.amazon.com/eks/latest/userguide/network_reqs.html) and [Cluster Security Group Considerations](https://docs.aws.amazon.com/eks/latest/userguide/sec-group-reqs.html) in the Amazon EKS User Guide. Detailed below. Also contains attributes detailed in the Attributes section.
+
+The following arguments are optional:
+
+* `enabledClusterLogTypes` - (Optional) List of the desired control plane logging to enable. For more information, see [Amazon EKS Control Plane Logging](https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html).
+* `encryptionConfig` - (Optional) Configuration block with encryption configuration for the cluster. Only available on Kubernetes 1.13 and above clusters created after March 6, 2020. Detailed below.
+* `kubernetesNetworkConfig` - (Optional) Configuration block with kubernetes network configuration for the cluster. Detailed below. If removed, Terraform will only perform drift detection if a configuration value is provided.
+* `outpostConfig` - (Optional) Configuration block representing the configuration of your local Amazon EKS cluster on an AWS Outpost. This block isn't available for creating Amazon EKS clusters on the AWS cloud.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `version` – (Optional) Desired Kubernetes master version. If you do not specify a value, the latest available version at resource creation is used and no upgrades will occur except those automatically triggered by EKS. The value must be configured and increased to upgrade the version when desired. Downgrades are not supported by EKS.
+
+### encryption_config
+
+The `encryptionConfig` configuration block supports the following arguments:
+
+* `provider` - (Required) Configuration block with provider for encryption. Detailed below.
+* `resources` - (Required) List of strings with resources to be encrypted. Valid values: `secrets`.
+
+#### provider
+
+The `provider` configuration block supports the following arguments:
+
+* `keyArn` - (Required) ARN of the Key Management Service (KMS) customer master key (CMK). The CMK must be symmetric, created in the same region as the cluster, and if the CMK was created in a different account, the user must have access to the CMK. For more information, see [Allowing Users in Other Accounts to Use a CMK in the AWS Key Management Service Developer Guide](https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-modifying-external-accounts.html).
+
+### vpc_config Arguments
+
+* `endpointPrivateAccess` - (Optional) Whether the Amazon EKS private API server endpoint is enabled. Default is `false`.
+* `endpointPublicAccess` - (Optional) Whether the Amazon EKS public API server endpoint is enabled. Default is `true`.
+* `publicAccessCidrs` - (Optional) List of CIDR blocks. Indicates which CIDR blocks can access the Amazon EKS public API server endpoint when enabled. EKS defaults this to a list with `0000/0`. Terraform will only perform drift detection of its value when present in a configuration.
+* `securityGroupIds` – (Optional) List of security group IDs for the cross-account elastic network interfaces that Amazon EKS creates to use to allow communication between your worker nodes and the Kubernetes control plane.
+* `subnetIds` – (Required) List of subnet IDs. Must be in at least two different availability zones. Amazon EKS creates cross-account elastic network interfaces in these subnets to allow communication between your worker nodes and the Kubernetes control plane.
+
+### kubernetes_network_config
+
+The `kubernetesNetworkConfig` configuration block supports the following arguments:
+
+* `serviceIpv4Cidr` - (Optional) The CIDR block to assign Kubernetes pod and service IP addresses from. If you don't specify a block, Kubernetes assigns addresses from either the 10.100.0.0/16 or 172.20.0.0/16 CIDR blocks. We recommend that you specify a block that does not overlap with resources in other networks that are peered or connected to your VPC. You can only specify a custom CIDR block when you create a cluster, changing this value will force a new cluster to be created. The block must meet the following requirements:
+
+    * Within one of the following private IP address blocks: 10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16.
+
+    * Doesn't overlap with any CIDR block assigned to the VPC that you selected for VPC.
+
+    * Between /24 and /12.
+* `ipFamily` - (Optional) The IP family used to assign Kubernetes pod and service addresses. Valid values are `ipv4` (default) and `ipv6`. You can only specify an IP family when you create a cluster, changing this value will force a new cluster to be created.
+
+### outpost_config
+
+The `outpostConfig` configuration block supports the following arguments:
+
+* `controlPlaneInstanceType` - (Required) The Amazon EC2 instance type that you want to use for your local Amazon EKS cluster on Outposts. The instance type that you specify is used for all Kubernetes control plane instances. The instance type can't be changed after cluster creation. Choose an instance type based on the number of nodes that your cluster will have. If your cluster will have:
+
+    * 1–20 nodes, then we recommend specifying a large instance type.
+
+    * 21–100 nodes, then we recommend specifying an xlarge instance type.
+
+    * 101–250 nodes, then we recommend specifying a 2xlarge instance type.
+
+    For a list of the available Amazon EC2 instance types, see Compute and storage in AWS Outposts rack features  The control plane is not automatically scaled by Amazon EKS.
+
+* `controlPlanePlacement` - (Optional) An object representing the placement configuration for all the control plane instances of your local Amazon EKS cluster on AWS Outpost.
+The `controlPlanePlacement` configuration block supports the following arguments:
+
+    * `groupName` - (Required) The name of the placement group for the Kubernetes control plane instances. This setting can't be changed after cluster creation.
+
+* `outpostArns` - (Required) The ARN of the Outpost that you want to use for your local Amazon EKS cluster on Outposts. This argument is a list of arns, but only a single Outpost ARN is supported currently.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the cluster.
+* `certificateAuthority` - Attribute block containing `certificateAuthorityData` for your cluster. Detailed below.
+* `clusterId` - The ID of your local Amazon EKS cluster on the AWS Outpost. This attribute isn't available for an AWS EKS cluster on AWS cloud.
+* `createdAt` - Unix epoch timestamp in seconds for when the cluster was created.
+* `endpoint` - Endpoint for your Kubernetes API server.
+* `id` - Name of the cluster.
+* `identity` - Attribute block containing identity provider information for your cluster. Only available on Kubernetes version 1.13 and 1.14 clusters created or upgraded on or after September 3, 2019. Detailed below.
+* `kubernetesNetworkConfigServiceIpv6Cidr` - The CIDR block that Kubernetes pod and service IP addresses are assigned from if you specified `ipv6` for ipFamily when you created the cluster. Kubernetes assigns service addresses from the unique local address range (fc00::/7) because you can't specify a custom IPv6 CIDR block when you create the cluster.
+* `platformVersion` - Platform version for the cluster.
+* `status` - Status of the EKS cluster. One of `creating`, `active`, `deleting`, `failed`.
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `vpcConfig` - Configuration block _argument_ that also includes attributes for the VPC associated with your cluster. Detailed below.
+
+### certificate_authority
+
+* `data` - Base64 encoded certificate data required to communicate with your cluster. Add this to the `certificateAuthorityData` section of the `kubeconfig` file for your cluster.
+
+### identity
+
+* `oidc` - Nested block containing [OpenID Connect](https://openid.net/connect/) identity provider information for the cluster. Detailed below.
+
+### oidc
+
+* `issuer` - Issuer URL for the OpenID Connect identity provider.
+
+### vpc_config Attributes
+
+* `clusterSecurityGroupId` - Cluster security group that was created by Amazon EKS for the cluster. Managed node groups use this security group for control-plane-to-data-plane communication.
+* `vpcId` - ID of the VPC associated with your cluster.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `30M`)
+* `update` - (Default `60M`)
+Note that the `update` timeout is used separately for both `version` and `vpcConfig` update timeouts.
+* `delete` - (Default `15M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EKS Clusters using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import EKS Clusters using the `name`. For example:
+
+```console
+% terraform import aws_eks_cluster.my_cluster my_cluster
+```
+
+<!-- cache-key: cdktf-0.18.0 input-6cb4e58d2d6459048ce11426d7c64e17bbcb1a488c1508bd0a076ea2e1feb536 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/eks_fargate_profile.html.markdown b/website/docs/cdktf/typescript/r/eks_fargate_profile.html.markdown
new file mode 100644
index 00000000000..20712859850
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/eks_fargate_profile.html.markdown
@@ -0,0 +1,153 @@
+---
+subcategory: "EKS (Elastic Kubernetes)"
+layout: "aws"
+page_title: "AWS: aws_eks_fargate_profile"
+description: |-
+  Manages an EKS Fargate Profile
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_eks_fargate_profile
+
+Manages an EKS Fargate Profile.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, Fn, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EksFargateProfile } from "./.gen/providers/aws/eks-fargate-profile";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new EksFargateProfile(this, "example", {
+      clusterName: Token.asString(awsEksClusterExample.name),
+      fargateProfileName: "example",
+      podExecutionRoleArn: Token.asString(awsIamRoleExample.arn),
+      selector: [
+        {
+          namespace: "example",
+        },
+      ],
+      subnetIds: Token.asList(Fn.lookupNested(awsSubnetExample, ["*", "id"])),
+    });
+  }
+}
+
+```
+
+### Example IAM Role for EKS Fargate Profile
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { IamRole } from "./.gen/providers/aws/iam-role";
+import { IamRolePolicyAttachment } from "./.gen/providers/aws/iam-role-policy-attachment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new IamRole(this, "example", {
+      assumeRolePolicy: Token.asString(
+        Fn.jsonencode({
+          Statement: [
+            {
+              Action: "sts:AssumeRole",
+              Effect: "Allow",
+              Principal: {
+                Service: "eks-fargate-pods.amazonaws.com",
+              },
+            },
+          ],
+          Version: "2012-10-17",
+        })
+      ),
+      name: "eks-fargate-profile-example",
+    });
+    new IamRolePolicyAttachment(
+      this,
+      "example-AmazonEKSFargatePodExecutionRolePolicy",
+      {
+        policyArn:
+          "arn:aws:iam::aws:policy/AmazonEKSFargatePodExecutionRolePolicy",
+        role: example.name,
+      }
+    );
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `clusterName` – (Required) Name of the EKS Cluster. Must be between 1-100 characters in length. Must begin with an alphanumeric character, and must only contain alphanumeric characters, dashes and underscores (`^[0-9A-Za-z][A-Za-z0-9\-_]+$`).
+* `fargateProfileName` – (Required) Name of the EKS Fargate Profile.
+* `podExecutionRoleArn` – (Required) Amazon Resource Name (ARN) of the IAM Role that provides permissions for the EKS Fargate Profile.
+* `selector` - (Required) Configuration block(s) for selecting Kubernetes Pods to execute with this EKS Fargate Profile. Detailed below.
+* `subnetIds` – (Required) Identifiers of private EC2 Subnets to associate with the EKS Fargate Profile. These subnets must have the following resource tag: `kubernetesIo/cluster/clusterName` (where `clusterName` is replaced with the name of the EKS Cluster).
+
+The following arguments are optional:
+
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### selector Configuration Block
+
+The following arguments are required:
+
+* `namespace` - (Required) Kubernetes namespace for selection.
+
+The following arguments are optional:
+
+* `labels` - (Optional) Key-value map of Kubernetes labels for selection.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the EKS Fargate Profile.
+* `id` - EKS Cluster name and EKS Fargate Profile name separated by a colon (`:`).
+* `status` - Status of the EKS Fargate Profile.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `10M`)
+* `delete` - (Default `10M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EKS Fargate Profiles using the `clusterName` and `fargateProfileName` separated by a colon (`:`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import EKS Fargate Profiles using the `clusterName` and `fargateProfileName` separated by a colon (`:`). For example:
+
+```console
+% terraform import aws_eks_fargate_profile.my_fargate_profile my_cluster:my_fargate_profile
+```
+
+<!-- cache-key: cdktf-0.18.0 input-52dddf83ced38ed29e926dd7cc5c30ad1c64cf020058373656f323fa68137332 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/eks_identity_provider_config.html.markdown b/website/docs/cdktf/typescript/r/eks_identity_provider_config.html.markdown
new file mode 100644
index 00000000000..13cabac217c
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/eks_identity_provider_config.html.markdown
@@ -0,0 +1,99 @@
+---
+subcategory: "EKS (Elastic Kubernetes)"
+layout: "aws"
+page_title: "AWS: aws_eks_identity_provider_config"
+description: |-
+  Manages an EKS Identity Provider Configuration.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_eks_identity_provider_config
+
+Manages an EKS Identity Provider Configuration.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EksIdentityProviderConfig } from "./.gen/providers/aws/eks-identity-provider-config";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new EksIdentityProviderConfig(this, "example", {
+      clusterName: Token.asString(awsEksClusterExample.name),
+      oidc: {
+        clientId: "your client_id",
+        identityProviderConfigName: "example",
+        issuerUrl: "your issuer_url",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `clusterName` – (Required) Name of the EKS Cluster.
+* `oidc` - (Required) Nested attribute containing [OpenID Connect](https://openid.net/connect/) identity provider information for the cluster. Detailed below.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### oidc Configuration Block
+
+* `clientId` – (Required) Client ID for the OpenID Connect identity provider.
+* `groupsClaim` - (Optional) The JWT claim that the provider will use to return groups.
+* `groupsPrefix` - (Optional) A prefix that is prepended to group claims e.g., `oidc:`.
+* `identityProviderConfigName` – (Required) The name of the identity provider config.
+* `issuerUrl` - (Required) Issuer URL for the OpenID Connect identity provider.
+* `requiredClaims` - (Optional) The key value pairs that describe required claims in the identity token.
+* `usernameClaim` - (Optional) The JWT claim that the provider will use as the username.
+* `usernamePrefix` - (Optional) A prefix that is prepended to username claims.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the EKS Identity Provider Configuration.
+* `id` - EKS Cluster name and EKS Identity Provider Configuration name separated by a colon (`:`).
+* `status` - Status of the EKS Identity Provider Configuration.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `40M`)
+* `delete` - (Default `40M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EKS Identity Provider Configurations using the `clusterName` and `identityProviderConfigName` separated by a colon (`:`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import EKS Identity Provider Configurations using the `clusterName` and `identityProviderConfigName` separated by a colon (`:`). For example:
+
+```console
+% terraform import aws_eks_identity_provider_config.my_identity_provider_config my_cluster:my_identity_provider_config
+```
+
+<!-- cache-key: cdktf-0.18.0 input-5c1f7e41459f3297aafc7d76e5e6f234ff3ac373c8e28f3c212e15d50db41a0f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/eks_node_group.html.markdown b/website/docs/cdktf/typescript/r/eks_node_group.html.markdown
new file mode 100644
index 00000000000..e1f3244cd3e
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/eks_node_group.html.markdown
@@ -0,0 +1,337 @@
+---
+subcategory: "EKS (Elastic Kubernetes)"
+layout: "aws"
+page_title: "AWS: aws_eks_node_group"
+description: |-
+  Manages an EKS Node Group
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_eks_node_group
+
+Manages an EKS Node Group, which can provision and optionally update an Auto Scaling Group of Kubernetes worker nodes compatible with EKS. Additional documentation about this functionality can be found in the [EKS User Guide](https://docs.aws.amazon.com/eks/latest/userguide/managed-node-groups.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, Fn, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EksNodeGroup } from "./.gen/providers/aws/eks-node-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new EksNodeGroup(this, "example", {
+      clusterName: Token.asString(awsEksClusterExample.name),
+      dependsOn: [
+        exampleAmazonEksWorkerNodePolicy,
+        exampleAmazonEksCniPolicy,
+        exampleAmazonEc2ContainerRegistryReadOnly,
+      ],
+      nodeGroupName: "example",
+      nodeRoleArn: Token.asString(awsIamRoleExample.arn),
+      scalingConfig: {
+        desiredSize: 1,
+        maxSize: 2,
+        minSize: 1,
+      },
+      subnetIds: Token.asList(Fn.lookupNested(awsSubnetExample, ["*", "id"])),
+      updateConfig: {
+        maxUnavailable: 1,
+      },
+    });
+  }
+}
+
+```
+
+### Ignoring Changes to Desired Size
+
+You can utilize the generic Terraform resource [lifecycle configuration block](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html) with `ignoreChanges` to create an EKS Node Group with an initial size of running instances, then ignore any changes to that count caused externally (e.g., Application Autoscaling).
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EksNodeGroup } from "./.gen/providers/aws/eks-node-group";
+interface MyConfig {
+  maxSize: any;
+  minSize: any;
+  clusterName: any;
+  nodeRoleArn: any;
+  subnetIds: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new EksNodeGroup(this, "example", {
+      lifecycle: {
+        ignoreChanges: [d0.desiredSize],
+      },
+      scalingConfig: {
+        desiredSize: 2,
+        maxSize: config.maxSize,
+        minSize: config.minSize,
+      },
+      clusterName: config.clusterName,
+      nodeRoleArn: config.nodeRoleArn,
+      subnetIds: config.subnetIds,
+    });
+  }
+}
+
+```
+
+### Tracking the latest EKS Node Group AMI releases
+
+You can have the node group track the latest version of the Amazon EKS optimized Amazon Linux AMI for a given EKS version by querying an Amazon provided SSM parameter. Replace `amazonLinux2` in the parameter name below with `amazonLinux2Gpu` to retrieve the  accelerated AMI version and `amazonLinux2Arm64` to retrieve the Arm version.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, Fn, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsSsmParameter } from "./.gen/providers/aws/data-aws-ssm-parameter";
+import { EksNodeGroup } from "./.gen/providers/aws/eks-node-group";
+interface MyConfig {
+  scalingConfig: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    const eksAmiReleaseVersion = new DataAwsSsmParameter(
+      this,
+      "eks_ami_release_version",
+      {
+        name:
+          "/aws/service/eks/optimized-ami/${" +
+          example.version +
+          "}/amazon-linux-2/recommended/release_version",
+      }
+    );
+    new EksNodeGroup(this, "example", {
+      clusterName: example.name,
+      nodeGroupName: "example",
+      nodeRoleArn: Token.asString(awsIamRoleExample.arn),
+      releaseVersion: Token.asString(
+        Fn.nonsensitive(eksAmiReleaseVersion.value)
+      ),
+      subnetIds: Token.asList(Fn.lookupNested(awsSubnetExample, ["*", "id"])),
+      version: example.version,
+      scalingConfig: config.scalingConfig,
+    });
+  }
+}
+
+```
+
+### Example IAM Role for EKS Node Group
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { IamRole } from "./.gen/providers/aws/iam-role";
+import { IamRolePolicyAttachment } from "./.gen/providers/aws/iam-role-policy-attachment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new IamRole(this, "example", {
+      assumeRolePolicy: Token.asString(
+        Fn.jsonencode({
+          Statement: [
+            {
+              Action: "sts:AssumeRole",
+              Effect: "Allow",
+              Principal: {
+                Service: "ec2.amazonaws.com",
+              },
+            },
+          ],
+          Version: "2012-10-17",
+        })
+      ),
+      name: "eks-node-group-example",
+    });
+    new IamRolePolicyAttachment(
+      this,
+      "example-AmazonEC2ContainerRegistryReadOnly",
+      {
+        policyArn: "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
+        role: example.name,
+      }
+    );
+    new IamRolePolicyAttachment(this, "example-AmazonEKSWorkerNodePolicy", {
+      policyArn: "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy",
+      role: example.name,
+    });
+    new IamRolePolicyAttachment(this, "example-AmazonEKS_CNI_Policy", {
+      policyArn: "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy",
+      role: example.name,
+    });
+  }
+}
+
+```
+
+### Example Subnets for EKS Node Group
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformCount, Fn, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsAvailabilityZones } from "./.gen/providers/aws/data-aws-availability-zones";
+import { Subnet } from "./.gen/providers/aws/subnet";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const available = new DataAwsAvailabilityZones(this, "available", {
+      state: "available",
+    });
+    /*In most cases loops should be handled in the programming language context and 
+    not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+    you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+    you need to keep this like it is.*/
+    const exampleCount = TerraformCount.of(Token.asNumber("2"));
+    new Subnet(this, "example", {
+      availabilityZone: Token.asString(
+        Fn.lookupNested(available.names, [exampleCount.index])
+      ),
+      cidrBlock: Token.asString(
+        Fn.cidrsubnet(
+          Token.asString(awsVpcExample.cidrBlock),
+          8,
+          Token.asNumber(exampleCount.index)
+        )
+      ),
+      vpcId: Token.asString(awsVpcExample.id),
+      count: exampleCount,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `clusterName` – (Required) Name of the EKS Cluster. Must be between 1-100 characters in length. Must begin with an alphanumeric character, and must only contain alphanumeric characters, dashes and underscores (`^[0-9A-Za-z][A-Za-z0-9\-_]+$`).
+* `nodeRoleArn` – (Required) Amazon Resource Name (ARN) of the IAM Role that provides permissions for the EKS Node Group.
+* `scalingConfig` - (Required) Configuration block with scaling settings. See [`scalingConfig`](#scaling_config-configuration-block) below for details.
+* `subnetIds` – (Required) Identifiers of EC2 Subnets to associate with the EKS Node Group.
+
+The following arguments are optional:
+
+* `amiType` - (Optional) Type of Amazon Machine Image (AMI) associated with the EKS Node Group. See the [AWS documentation](https://docs.aws.amazon.com/eks/latest/APIReference/API_Nodegroup.html#AmazonEKS-Type-Nodegroup-amiType) for valid values. Terraform will only perform drift detection if a configuration value is provided.
+* `capacityType` - (Optional) Type of capacity associated with the EKS Node Group. Valid values: `onDemand`, `spot`. Terraform will only perform drift detection if a configuration value is provided.
+* `diskSize` - (Optional) Disk size in GiB for worker nodes. Defaults to `50` for Windows, `20` all other node groups. Terraform will only perform drift detection if a configuration value is provided.
+* `forceUpdateVersion` - (Optional) Force version update if existing pods are unable to be drained due to a pod disruption budget issue.
+* `instanceTypes` - (Optional) List of instance types associated with the EKS Node Group. Defaults to `["t3Medium"]`. Terraform will only perform drift detection if a configuration value is provided.
+* `labels` - (Optional) Key-value map of Kubernetes labels. Only labels that are applied with the EKS API are managed by this argument. Other Kubernetes labels applied to the EKS Node Group will not be managed.
+* `launchTemplate` - (Optional) Configuration block with Launch Template settings. See [`launchTemplate`](#launch_template-configuration-block) below for details.
+* `nodeGroupName` – (Optional) Name of the EKS Node Group. If omitted, Terraform will assign a random, unique name. Conflicts with `nodeGroupNamePrefix`. The node group name can't be longer than 63 characters. It must start with a letter or digit, but can also include hyphens and underscores for the remaining characters.
+* `nodeGroupNamePrefix` – (Optional) Creates a unique name beginning with the specified prefix. Conflicts with `nodeGroupName`.
+* `releaseVersion` – (Optional) AMI version of the EKS Node Group. Defaults to latest version for Kubernetes version.
+* `remoteAccess` - (Optional) Configuration block with remote access settings. See [`remoteAccess`](#remote_access-configuration-block) below for details.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `taint` - (Optional) The Kubernetes taints to be applied to the nodes in the node group. Maximum of 50 taints per node group. See [taint](#taint-configuration-block) below for details.
+* `updateConfig` - (Optional) Configuration block with update settings. See [`updateConfig`](#update_config-configuration-block) below for details.
+* `version` – (Optional) Kubernetes version. Defaults to EKS Cluster Kubernetes version. Terraform will only perform drift detection if a configuration value is provided.
+
+### launch_template Configuration Block
+
+~> **NOTE:** Either `id` or `name` must be specified.
+
+* `id` - (Optional) Identifier of the EC2 Launch Template. Conflicts with `name`.
+* `name` - (Optional) Name of the EC2 Launch Template. Conflicts with `id`.
+* `version` - (Required) EC2 Launch Template version number. While the API accepts values like `$default` and `$latest`, the API will convert the value to the associated version number (e.g., `1`) on read and Terraform will show a difference on next plan. Using the `defaultVersion` or `latestVersion` attribute of the `awsLaunchTemplate` resource or data source is recommended for this argument.
+
+### remote_access Configuration Block
+
+* `ec2SshKey` - (Optional) EC2 Key Pair name that provides access for remote communication with the worker nodes in the EKS Node Group. If you specify this configuration, but do not specify `sourceSecurityGroupIds` when you create an EKS Node Group, either port 3389 for Windows, or port 22 for all other operating systems is opened on the worker nodes to the Internet (0.0.0.0/0). For Windows nodes, this will allow you to use RDP, for all others this allows you to SSH into the worker nodes.
+* `sourceSecurityGroupIds` - (Optional) Set of EC2 Security Group IDs to allow SSH access (port 22) from on the worker nodes. If you specify `ec2SshKey`, but do not specify this configuration when you create an EKS Node Group, port 22 on the worker nodes is opened to the Internet (0.0.0.0/0).
+
+### scaling_config Configuration Block
+
+* `desiredSize` - (Required) Desired number of worker nodes.
+* `maxSize` - (Required) Maximum number of worker nodes.
+* `minSize` - (Required) Minimum number of worker nodes.
+
+### taint Configuration Block
+
+* `key` - (Required) The key of the taint. Maximum length of 63.
+* `value` - (Optional) The value of the taint. Maximum length of 63.
+* `effect` - (Required) The effect of the taint. Valid values: `noSchedule`, `noExecute`, `preferNoSchedule`.
+
+### update_config Configuration Block
+
+The following arguments are mutually exclusive.
+
+* `maxUnavailable` - (Optional) Desired max number of unavailable worker nodes during node group update.
+* `maxUnavailablePercentage` - (Optional) Desired max percentage of unavailable worker nodes during node group update.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the EKS Node Group.
+* `id` - EKS Cluster name and EKS Node Group name separated by a colon (`:`).
+* `resources` - List of objects containing information about underlying resources.
+    * `autoscalingGroups` - List of objects containing information about AutoScaling Groups.
+        * `name` - Name of the AutoScaling Group.
+    * `remoteAccessSecurityGroupId` - Identifier of the remote access EC2 Security Group.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `status` - Status of the EKS Node Group.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `60M`)
+* `update` - (Default `60M`)
+* `delete` - (Default `60M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EKS Node Groups using the `clusterName` and `nodeGroupName` separated by a colon (`:`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import EKS Node Groups using the `clusterName` and `nodeGroupName` separated by a colon (`:`). For example:
+
+```console
+% terraform import aws_eks_node_group.my_node_group my_cluster:my_node_group
+```
+
+<!-- cache-key: cdktf-0.18.0 input-129aa761b524fec3c4f03d1723899506954e7ced19cd217e1c8e264b7e760456 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/elastic_beanstalk_application.html.markdown b/website/docs/cdktf/typescript/r/elastic_beanstalk_application.html.markdown
new file mode 100644
index 00000000000..ca86edbcaf2
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/elastic_beanstalk_application.html.markdown
@@ -0,0 +1,92 @@
+---
+subcategory: "Elastic Beanstalk"
+layout: "aws"
+page_title: "AWS: aws_elastic_beanstalk_application"
+description: |-
+  Provides an Elastic Beanstalk Application Resource
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_elastic_beanstalk_application
+
+Provides an Elastic Beanstalk Application Resource. Elastic Beanstalk allows
+you to deploy and manage applications in the AWS cloud without worrying about
+the infrastructure that runs those applications.
+
+This resource creates an application that has one configuration template named
+`default`, and no application versions
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ElasticBeanstalkApplication } from "./.gen/providers/aws/elastic-beanstalk-application";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ElasticBeanstalkApplication(this, "tftest", {
+      appversionLifecycle: {
+        deleteSourceFromS3: true,
+        maxCount: 128,
+        serviceRole: beanstalkService.arn,
+      },
+      description: "tf-test-desc",
+      name: "tf-test-name",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the application, must be unique within your account
+* `description` - (Optional) Short description of the application
+* `tags` - (Optional) Key-value map of tags for the Elastic Beanstalk Application. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+Application version lifecycle (`appversionLifecycle`) supports the following settings.  Only one of either `maxCount` or `maxAgeInDays` can be provided:
+
+* `serviceRole` - (Required) The ARN of an IAM service role under which the application version is deleted.  Elastic Beanstalk must have permission to assume this role.
+* `maxCount` - (Optional) The maximum number of application versions to retain ('max_age_in_days' and 'max_count' cannot be enabled simultaneously.).
+* `maxAgeInDays` - (Optional) The number of days to retain an application version ('max_age_in_days' and 'max_count' cannot be enabled simultaneously.).
+* `deleteSourceFromS3` - (Optional) Set to `true` to delete a version's source bundle from S3 when the application version is deleted.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN assigned by AWS for this Elastic Beanstalk Application.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Elastic Beanstalk Applications using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Elastic Beanstalk Applications using the `name`. For example:
+
+```console
+% terraform import aws_elastic_beanstalk_application.tf_test tf-test-name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-6eaa1decc4c221d8dd0a8f0ef93ceb4a04389948c33dfca24f61bca9ea476b90 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/elastic_beanstalk_application_version.html.markdown b/website/docs/cdktf/typescript/r/elastic_beanstalk_application_version.html.markdown
new file mode 100644
index 00000000000..92330d349c4
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/elastic_beanstalk_application_version.html.markdown
@@ -0,0 +1,95 @@
+---
+subcategory: "Elastic Beanstalk"
+layout: "aws"
+page_title: "AWS: aws_elastic_beanstalk_application_version"
+description: |-
+  Provides an Elastic Beanstalk Application Version Resource
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_elastic_beanstalk_application_version
+
+Provides an Elastic Beanstalk Application Version Resource. Elastic Beanstalk allows
+you to deploy and manage applications in the AWS cloud without worrying about
+the infrastructure that runs those applications.
+
+This resource creates a Beanstalk Application Version that can be deployed to a Beanstalk
+Environment.
+
+~> **NOTE on Application Version Resource:**  When using the Application Version resource with multiple
+[Elastic Beanstalk Environments](elastic_beanstalk_environment.html) it is possible that an error may be returned
+when attempting to delete an Application Version while it is still in use by a different environment.
+To work around this you can either create each environment in a separate AWS account or create your `awsElasticBeanstalkApplicationVersion` resources with a unique names in your Elastic Beanstalk Application. For example &lt;revision&gt;-&lt;environment&gt;.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ElasticBeanstalkApplication } from "./.gen/providers/aws/elastic-beanstalk-application";
+import { ElasticBeanstalkApplicationVersion } from "./.gen/providers/aws/elastic-beanstalk-application-version";
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3Object } from "./.gen/providers/aws/s3-object";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ElasticBeanstalkApplication(this, "default", {
+      description: "tf-test-desc",
+      name: "tf-test-name",
+    });
+    const awsS3BucketDefault = new S3Bucket(this, "default_1", {
+      bucket: "tftest.applicationversion.bucket",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketDefault.overrideLogicalId("default");
+    const awsS3ObjectDefault = new S3Object(this, "default_2", {
+      bucket: Token.asString(awsS3BucketDefault.id),
+      key: "beanstalk/go-v1.zip",
+      source: "go-v1.zip",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3ObjectDefault.overrideLogicalId("default");
+    const awsElasticBeanstalkApplicationVersionDefault =
+      new ElasticBeanstalkApplicationVersion(this, "default_3", {
+        application: "tf-test-name",
+        bucket: Token.asString(awsS3BucketDefault.id),
+        description: "application version created by terraform",
+        key: Token.asString(awsS3ObjectDefault.id),
+        name: "tf-test-version-label",
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsElasticBeanstalkApplicationVersionDefault.overrideLogicalId("default");
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `application` - (Required) Name of the Beanstalk Application the version is associated with.
+* `bucket` - (Required) S3 bucket that contains the Application Version source bundle.
+* `key` - (Required) S3 object that is the Application Version source bundle.
+* `name` - (Required) Unique name for the this Application Version.
+
+The following arguments are optional:
+
+* `description` - (Optional) Short description of the Application Version.
+* `forceDelete` - (Optional) On delete, force an Application Version to be deleted when it may be in use by multiple Elastic Beanstalk Environments.
+* `tags` - (Optional) Key-value map of tags for the Elastic Beanstalk Application Version. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN assigned by AWS for this Elastic Beanstalk Application.
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+<!-- cache-key: cdktf-0.18.0 input-751fb6889b75c7692aeacfbc770bb96d2cd80c1b9203d93fbf9daa51aef09d4a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/elastic_beanstalk_configuration_template.html.markdown b/website/docs/cdktf/typescript/r/elastic_beanstalk_configuration_template.html.markdown
new file mode 100644
index 00000000000..d0117249de3
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/elastic_beanstalk_configuration_template.html.markdown
@@ -0,0 +1,82 @@
+---
+subcategory: "Elastic Beanstalk"
+layout: "aws"
+page_title: "AWS: aws_elastic_beanstalk_configuration_template"
+description: |-
+  Provides an Elastic Beanstalk Configuration Template
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_elastic_beanstalk_configuration_template
+
+Provides an Elastic Beanstalk Configuration Template, which are associated with
+a specific application and are used to deploy different versions of the
+application with the same configuration settings.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ElasticBeanstalkApplication } from "./.gen/providers/aws/elastic-beanstalk-application";
+import { ElasticBeanstalkConfigurationTemplate } from "./.gen/providers/aws/elastic-beanstalk-configuration-template";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const tftest = new ElasticBeanstalkApplication(this, "tftest", {
+      description: "tf-test-desc",
+      name: "tf-test-name",
+    });
+    new ElasticBeanstalkConfigurationTemplate(this, "tf_template", {
+      application: tftest.name,
+      name: "tf-test-template-config",
+      solutionStackName: "64bit Amazon Linux 2015.09 v2.0.8 running Go 1.4",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) A unique name for this Template.
+* `application` – (Required) name of the application to associate with this configuration template
+* `description` - (Optional) Short description of the Template
+* `environmentId` – (Optional) The ID of the environment used with this configuration template
+* `setting` – (Optional) Option settings to configure the new Environment. These
+  override specific values that are set as defaults. The format is detailed
+  below in [Option Settings](#option-settings)
+* `solutionStackName` – (Optional) A solution stack to base your Template
+off of. Example stacks can be found in the [Amazon API documentation][1]
+
+## Option Settings
+
+The `setting` field supports the following format:
+
+* `namespace` - unique namespace identifying the option's associated AWS resource
+* `name` - name of the configuration option
+* `value` - value for the configuration option
+* `resource` - (Optional) resource name for [scheduled action](https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/command-options-general.html#command-options-general-autoscalingscheduledaction)
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `name`
+* `application`
+* `description`
+* `environmentId`
+* `optionSettings`
+* `solutionStackName`
+
+[1]: https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/concepts.platforms.html
+
+<!-- cache-key: cdktf-0.18.0 input-abd91b17373f96fef9bb9422def3ab0d77d4ca67c22d5b83904d54987db262f7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/elastic_beanstalk_environment.html.markdown b/website/docs/cdktf/typescript/r/elastic_beanstalk_environment.html.markdown
new file mode 100644
index 00000000000..2fbff03b19d
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/elastic_beanstalk_environment.html.markdown
@@ -0,0 +1,185 @@
+---
+subcategory: "Elastic Beanstalk"
+layout: "aws"
+page_title: "AWS: aws_elastic_beanstalk_environment"
+description: |-
+  Provides an Elastic Beanstalk Environment Resource
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_elastic_beanstalk_environment
+
+Provides an Elastic Beanstalk Environment Resource. Elastic Beanstalk allows
+you to deploy and manage applications in the AWS cloud without worrying about
+the infrastructure that runs those applications.
+
+Environments are often things such as `development`, `integration`, or
+`production`.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ElasticBeanstalkApplication } from "./.gen/providers/aws/elastic-beanstalk-application";
+import { ElasticBeanstalkEnvironment } from "./.gen/providers/aws/elastic-beanstalk-environment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const tftest = new ElasticBeanstalkApplication(this, "tftest", {
+      description: "tf-test-desc",
+      name: "tf-test-name",
+    });
+    new ElasticBeanstalkEnvironment(this, "tfenvtest", {
+      application: tftest.name,
+      name: "tf-test-name",
+      solutionStackName: "64bit Amazon Linux 2015.03 v2.0.3 running Go 1.4",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) A unique name for this Environment. This name is used
+  in the application URL
+* `application` – (Required) Name of the application that contains the version
+  to be deployed
+* `cnamePrefix` - (Optional) Prefix to use for the fully qualified DNS name of
+  the Environment.
+* `description` - (Optional) Short description of the Environment
+* `tier` - (Optional) Elastic Beanstalk Environment tier. Valid values are `worker`
+  or `webServer`. If tier is left blank `webServer` will be used.
+* `setting` – (Optional) Option settings to configure the new Environment. These
+  override specific values that are set as defaults. The format is detailed
+  below in [Option Settings](#option-settings)
+* `solutionStackName` – (Optional) A solution stack to base your environment
+off of. Example stacks can be found in the [Amazon API documentation][1]
+* `templateName` – (Optional) The name of the Elastic Beanstalk Configuration
+  template to use in deployment
+* `platformArn` – (Optional) The [ARN][2] of the Elastic Beanstalk [Platform][3]
+  to use in deployment
+* `waitForReadyTimeout` - (Default `20M`) The maximum
+  [duration](https://golang.org/pkg/time/#ParseDuration) that Terraform should
+  wait for an Elastic Beanstalk Environment to be in a ready state before timing
+  out.
+* `pollInterval` – The time between polling the AWS API to
+check if changes have been applied. Use this to adjust the rate of API calls
+for any `create` or `update` action. Minimum `10S`, maximum `180S`. Omit this to
+use the default behavior, which is an exponential backoff
+* `versionLabel` - (Optional) The name of the Elastic Beanstalk Application Version
+to use in deployment.
+* `tags` - (Optional) A set of tags to apply to the Environment. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Option Settings
+
+Some options can be stack-specific, check [AWS Docs](https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/command-options-general.html)
+for supported options and examples.
+
+The `setting` and `allSettings` mappings support the following format:
+
+* `namespace` - unique namespace identifying the option's associated AWS resource
+* `name` - name of the configuration option
+* `value` - value for the configuration option
+* `resource` - (Optional) resource name for [scheduled action](https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/command-options-general.html#command-options-general-autoscalingscheduledaction)
+
+### Example With Options
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ElasticBeanstalkApplication } from "./.gen/providers/aws/elastic-beanstalk-application";
+import { ElasticBeanstalkEnvironment } from "./.gen/providers/aws/elastic-beanstalk-environment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const tftest = new ElasticBeanstalkApplication(this, "tftest", {
+      description: "tf-test-desc",
+      name: "tf-test-name",
+    });
+    new ElasticBeanstalkEnvironment(this, "tfenvtest", {
+      application: tftest.name,
+      name: "tf-test-name",
+      setting: [
+        {
+          name: "VPCId",
+          namespace: "aws:ec2:vpc",
+          value: "vpc-xxxxxxxx",
+        },
+        {
+          name: "Subnets",
+          namespace: "aws:ec2:vpc",
+          value: "subnet-xxxxxxxx",
+        },
+      ],
+      solutionStackName: "64bit Amazon Linux 2015.03 v2.0.3 running Go 1.4",
+    });
+  }
+}
+
+```
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the Elastic Beanstalk Environment.
+* `name` - Name of the Elastic Beanstalk Environment.
+* `description` - Description of the Elastic Beanstalk Environment.
+* `tier` - The environment tier specified.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `application` – The Elastic Beanstalk Application specified for this environment.
+* `setting` – Settings specifically set for this Environment.
+* `allSettings` – List of all option settings configured in this Environment. These
+  are a combination of default settings and their overrides from `setting` in
+  the configuration.
+* `cname` - Fully qualified DNS name for this Environment.
+* `autoscalingGroups` - The autoscaling groups used by this Environment.
+* `instances` - Instances used by this Environment.
+* `launchConfigurations` - Launch configurations in use by this Environment.
+* `loadBalancers` - Elastic load balancers in use by this Environment.
+* `queues` - SQS queues in use by this Environment.
+* `triggers` - Autoscaling triggers in use by this Environment.
+* `endpointUrl` - The URL to the Load Balancer for this Environment
+
+[1]: https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/concepts.platforms.html
+[2]: https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html
+[3]: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-beanstalk-environment.html#cfn-beanstalk-environment-platformarn
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Elastic Beanstalk Environments using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Elastic Beanstalk Environments using the `id`. For example:
+
+```console
+% terraform import aws_elastic_beanstalk_environment.prodenv e-rpqsewtp2j
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ad1ef9e1da7358ae03a61072b63ebad273ca716292310f87ea1ffcf0427f9d1d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/elasticache_cluster.html.markdown b/website/docs/cdktf/typescript/r/elasticache_cluster.html.markdown
new file mode 100644
index 00000000000..420ec5fc042
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/elasticache_cluster.html.markdown
@@ -0,0 +1,337 @@
+---
+subcategory: "ElastiCache"
+layout: "aws"
+page_title: "AWS: aws_elasticache_cluster"
+description: |-
+  Provides an ElastiCache Cluster resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_elasticache_cluster
+
+Provides an ElastiCache Cluster resource, which manages either a
+[Memcached cluster](https://docs.aws.amazon.com/AmazonElastiCache/latest/mem-ug/WhatIs.html), a
+[single-node Redis instance](https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/WhatIs.html), or a
+[read replica in a Redis (Cluster Mode Enabled) replication group].
+
+For working with Redis (Cluster Mode Enabled) replication groups, see the
+[`awsElasticacheReplicationGroup` resource](/docs/providers/aws/r/elasticache_replication_group.html).
+
+~> **Note:** When you change an attribute, such as `numCacheNodes`, by default
+it is applied in the next maintenance window. Because of this, Terraform may report
+a difference in its planning phase because the actual modification has not yet taken
+place. You can use the `applyImmediately` flag to instruct the service to apply the
+change immediately. Using `applyImmediately` can result in a brief downtime as the server reboots.
+See the AWS Documentation on Modifying an ElastiCache Cache Cluster for
+[ElastiCache for Memcached](https://docs.aws.amazon.com/AmazonElastiCache/latest/mem-ug/Clusters.Modify.html) or
+[ElastiCache for Redis](https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/Clusters.Modify.html)
+for more information.
+
+~> **Note:** Any attribute changes that re-create the resource will be applied immediately, regardless of the value of `applyImmediately`.
+
+## Example Usage
+
+### Memcached Cluster
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ElasticacheCluster } from "./.gen/providers/aws/elasticache-cluster";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ElasticacheCluster(this, "example", {
+      clusterId: "cluster-example",
+      engine: "memcached",
+      nodeType: "cache.m4.large",
+      numCacheNodes: 2,
+      parameterGroupName: "default.memcached1.4",
+      port: 11211,
+    });
+  }
+}
+
+```
+
+### Redis Instance
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ElasticacheCluster } from "./.gen/providers/aws/elasticache-cluster";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ElasticacheCluster(this, "example", {
+      clusterId: "cluster-example",
+      engine: "redis",
+      engineVersion: "3.2.10",
+      nodeType: "cache.m4.large",
+      numCacheNodes: 1,
+      parameterGroupName: "default.redis3.2",
+      port: 6379,
+    });
+  }
+}
+
+```
+
+### Redis Cluster Mode Disabled Read Replica Instance
+
+These inherit their settings from the replication group.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ElasticacheCluster } from "./.gen/providers/aws/elasticache-cluster";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ElasticacheCluster(this, "replica", {
+      clusterId: "cluster-example",
+      replicationGroupId: example.id,
+    });
+  }
+}
+
+```
+
+### Redis Log Delivery configuration
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ElasticacheCluster } from "./.gen/providers/aws/elasticache-cluster";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ElasticacheCluster(this, "test", {
+      applyImmediately: true,
+      clusterId: "mycluster",
+      engine: "redis",
+      logDeliveryConfiguration: [
+        {
+          destination: example.name,
+          destinationType: "cloudwatch-logs",
+          logFormat: "text",
+          logType: "slow-log",
+        },
+        {
+          destination: Token.asString(
+            awsKinesisFirehoseDeliveryStreamExample.name
+          ),
+          destinationType: "kinesis-firehose",
+          logFormat: "json",
+          logType: "engine-log",
+        },
+      ],
+      nodeType: "cache.t3.micro",
+      numCacheNodes: 1,
+      port: 6379,
+    });
+  }
+}
+
+```
+
+### Elasticache Cluster in Outpost
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsOutpostsOutpost } from "./.gen/providers/aws/data-aws-outposts-outpost";
+import { DataAwsOutpostsOutposts } from "./.gen/providers/aws/data-aws-outposts-outposts";
+import { ElasticacheCluster } from "./.gen/providers/aws/elasticache-cluster";
+import { ElasticacheSubnetGroup } from "./.gen/providers/aws/elasticache-subnet-group";
+import { Subnet } from "./.gen/providers/aws/subnet";
+import { Vpc } from "./.gen/providers/aws/vpc";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new Vpc(this, "example", {
+      cidrBlock: "10.0.0.0/16",
+    });
+    const dataAwsOutpostsOutpostsExample = new DataAwsOutpostsOutposts(
+      this,
+      "example_1",
+      {}
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsOutpostsOutpostsExample.overrideLogicalId("example");
+    const awsSubnetExample = new Subnet(this, "example_2", {
+      cidrBlock: "10.0.1.0/24",
+      tags: {
+        Name: "my-subnet",
+      },
+      vpcId: example.id,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSubnetExample.overrideLogicalId("example");
+    const dataAwsOutpostsOutpostExample = new DataAwsOutpostsOutpost(
+      this,
+      "example_3",
+      {
+        id: Token.asString(
+          Fn.lookupNested(Fn.tolist(dataAwsOutpostsOutpostsExample.ids), ["0"])
+        ),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsOutpostsOutpostExample.overrideLogicalId("example");
+    const awsElasticacheSubnetGroupExample = new ElasticacheSubnetGroup(
+      this,
+      "example_4",
+      {
+        name: "my-cache-subnet",
+        subnetIds: [Token.asString(awsSubnetExample.id)],
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsElasticacheSubnetGroupExample.overrideLogicalId("example");
+    const awsElasticacheClusterExample = new ElasticacheCluster(
+      this,
+      "example_5",
+      {
+        clusterId: "cluster-example",
+        engine: "memcached",
+        nodeType: "cache.r5.large",
+        numCacheNodes: 2,
+        outpostMode: "single-outpost",
+        parameterGroupName: "default.memcached1.4",
+        port: 11211,
+        preferredOutpostArn: Token.asString(dataAwsOutpostsOutpostExample.arn),
+        subnetGroupName: Token.asString(awsElasticacheSubnetGroupExample.name),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsElasticacheClusterExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `clusterId` – (Required) Group identifier. ElastiCache converts this name to lowercase. Changing this value will re-create the resource.
+* `engine` – (Optional, Required if `replicationGroupId` is not specified) Name of the cache engine to be used for this cache cluster. Valid values are `memcached` or `redis`.
+* `nodeType` – (Required unless `replicationGroupId` is provided) The instance class used. See AWS documentation for information on [supported node types for Redis](https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/CacheNodes.SupportedTypes.html) and [guidance on selecting node types for Redis](https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/nodes-select-size.html). See AWS documentation for information on [supported node types for Memcached](https://docs.aws.amazon.com/AmazonElastiCache/latest/mem-ug/CacheNodes.SupportedTypes.html) and [guidance on selecting node types for Memcached](https://docs.aws.amazon.com/AmazonElastiCache/latest/mem-ug/nodes-select-size.html). For Memcached, changing this value will re-create the resource.
+* `numCacheNodes` – (Required unless `replicationGroupId` is provided) The initial number of cache nodes that the cache cluster will have. For Redis, this value must be 1. For Memcached, this value must be between 1 and 40. If this number is reduced on subsequent runs, the highest numbered nodes will be removed.
+* `parameterGroupName` – (Required unless `replicationGroupId` is provided) The name of the parameter group to associate with this cache cluster.
+
+The following arguments are optional:
+
+* `applyImmediately` - (Optional) Whether any database modifications are applied immediately, or during the next maintenance window. Default is `false`. See [Amazon ElastiCache Documentation for more information.](https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_ModifyCacheCluster.html).
+* `autoMinorVersionUpgrade` - (Optional) Specifies whether minor version engine upgrades will be applied automatically to the underlying Cache Cluster instances during the maintenance window.
+  Only supported for engine type `"redis"` and if the engine version is 6 or higher.
+  Defaults to `true`.
+* `availabilityZone` - (Optional) Availability Zone for the cache cluster. If you want to create cache nodes in multi-az, use `preferredAvailabilityZones` instead. Default: System chosen Availability Zone. Changing this value will re-create the resource.
+* `azMode` - (Optional, Memcached only) Whether the nodes in this Memcached node group are created in a single Availability Zone or created across multiple Availability Zones in the cluster's region. Valid values for this parameter are `singleAz` or `crossAz`, default is `singleAz`. If you want to choose `crossAz`, `numCacheNodes` must be greater than `1`.
+* `engineVersion` – (Optional) Version number of the cache engine to be used.
+  If not set, defaults to the latest version.
+  See [Describe Cache Engine Versions](https://docs.aws.amazon.com/cli/latest/reference/elasticache/describe-cache-engine-versions.html) in the AWS Documentation for supported versions.
+  When `engine` is `redis` and the version is 7 or higher, the major and minor version should be set, e.g., `72`.
+  When the version is 6, the major and minor version can be set, e.g., `62`,
+  or the minor version can be unspecified which will use the latest version at creation time, e.g., `6X`.
+  Otherwise, specify the full version desired, e.g., `506`.
+  The actual engine version used is returned in the attribute `engineVersionActual`, see [Attribute Reference](#attribute-reference) below. Cannot be provided with `replicationGroupId`
+* `finalSnapshotIdentifier` - (Optional, Redis only) Name of your final cluster snapshot. If omitted, no final snapshot will be made.
+* `ipDiscovery` - (Optional) The IP version to advertise in the discovery protocol. Valid values are `ipv4` or `ipv6`.
+* `logDeliveryConfiguration` - (Optional, Redis only) Specifies the destination and format of Redis [SLOWLOG](https://redis.io/commands/slowlog) or Redis [Engine Log](https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/Log_Delivery.html#Log_contents-engine-log). See the documentation on [Amazon ElastiCache](https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/Log_Delivery.html). See [Log Delivery Configuration](#log-delivery-configuration) below for more details.
+* `maintenanceWindow` – (Optional) Specifies the weekly time range for when maintenance
+on the cache cluster is performed. The format is `ddd:hh24:miDdd:hh24:mi` (24H Clock UTC).
+The minimum maintenance window is a 60 minute period. Example: `sun:05:00Sun:09:00`.
+* `networkType` - (Optional) The IP versions for cache cluster connections. IPv6 is supported with Redis engine `62` onword or Memcached version `166` for all [Nitro system](https://aws.amazon.com/ec2/nitro/) instances. Valid values are `ipv4`, `ipv6` or `dualStack`.
+* `notificationTopicArn` – (Optional) ARN of an SNS topic to send ElastiCache notifications to. Example: `arn:aws:sns:usEast1:012345678999:mySnsTopic`.
+* `outpostMode` - (Optional) Specify the outpost mode that will apply to the cache cluster creation. Valid values are `"singleOutpost"` and `"crossOutpost"`, however AWS currently only supports `"singleOutpost"` mode.
+* `port` – (Optional) The port number on which each of the cache nodes will accept connections. For Memcached the default is 11211, and for Redis the default port is 6379. Cannot be provided with `replicationGroupId`. Changing this value will re-create the resource.
+* `preferredAvailabilityZones` - (Optional, Memcached only) List of the Availability Zones in which cache nodes are created. If you are creating your cluster in an Amazon VPC you can only locate nodes in Availability Zones that are associated with the subnets in the selected subnet group. The number of Availability Zones listed must equal the value of `numCacheNodes`. If you want all the nodes in the same Availability Zone, use `availabilityZone` instead, or repeat the Availability Zone multiple times in the list. Default: System chosen Availability Zones. Detecting drift of existing node availability zone is not currently supported. Updating this argument by itself to migrate existing node availability zones is not currently supported and will show a perpetual difference.
+* `preferredOutpostArn` - (Optional, Required if `outpostMode` is specified) The outpost ARN in which the cache cluster will be created.
+* `replicationGroupId` - (Optional, Required if `engine` is not specified) ID of the replication group to which this cluster should belong. If this parameter is specified, the cluster is added to the specified replication group as a read replica; otherwise, the cluster is a standalone primary that is not part of any replication group.
+* `securityGroupIds` – (Optional, VPC only) One or more VPC security groups associated with the cache cluster. Cannot be provided with `replicationGroupId`
+* `snapshotArns` – (Optional, Redis only) Single-element string list containing an Amazon Resource Name (ARN) of a Redis RDB snapshot file stored in Amazon S3. The object name cannot contain any commas. Changing `snapshotArns` forces a new resource.
+* `snapshotName` - (Optional, Redis only) Name of a snapshot from which to restore data into the new node group. Changing `snapshotName` forces a new resource.
+* `snapshotRetentionLimit` - (Optional, Redis only) Number of days for which ElastiCache will retain automatic cache cluster snapshots before deleting them. For example, if you set SnapshotRetentionLimit to 5, then a snapshot that was taken today will be retained for 5 days before being deleted. If the value of SnapshotRetentionLimit is set to zero (0), backups are turned off. Please note that setting a `snapshotRetentionLimit` is not supported on cache.t1.micro cache nodes
+* `snapshotWindow` - (Optional, Redis only) Daily time range (in UTC) during which ElastiCache will begin taking a daily snapshot of your cache cluster. Example: 05:00-09:00
+* `subnetGroupName` – (Optional, VPC only) Name of the subnet group to be used for the cache cluster. Changing this value will re-create the resource. Cannot be provided with `replicationGroupId`
+* `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `transitEncryptionEnabled` - (Optional) Enable encryption in-transit. Supported only with Memcached versions `1612` and later, running in a VPC. See the [ElastiCache in-transit encryption](https://docs.aws.amazon.com/AmazonElastiCache/latest/mem-ug/in-transit-encryption-mc.html) documentation for more details.
+
+### Log Delivery Configuration
+
+The `logDeliveryConfiguration` block allows the streaming of Redis [SLOWLOG](https://redis.io/commands/slowlog) or Redis [Engine Log](https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/Log_Delivery.html#Log_contents-engine-log) to CloudWatch Logs or Kinesis Data Firehose. Max of 2 blocks.
+
+* `destination` - Name of either the CloudWatch Logs LogGroup or Kinesis Data Firehose resource.
+* `destinationType` - For CloudWatch Logs use `cloudwatchLogs` or for Kinesis Data Firehose use `kinesisFirehose`.
+* `logFormat` - Valid values are `json` or `text`
+* `logType` - Valid values are  `slowLog` or `engineLog`. Max 1 of each.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the created ElastiCache Cluster.
+* `engineVersionActual` - Because ElastiCache pulls the latest minor or patch for a version, this attribute returns the running version of the cache engine.
+* `cacheNodes` - List of node objects including `id`, `address`, `port` and `availabilityZone`.
+* `clusterAddress` - (Memcached only) DNS name of the cache cluster without the port appended.
+* `configurationEndpoint` - (Memcached only) Configuration endpoint to allow host discovery.
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `40M`)
+- `update` - (Default `80M`)
+- `delete` - (Default `40M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import ElastiCache Clusters using the `clusterId`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import ElastiCache Clusters using the `clusterId`. For example:
+
+```console
+% terraform import aws_elasticache_cluster.my_cluster my_cluster
+```
+
+<!-- cache-key: cdktf-0.18.0 input-407a7f00eaf445bba1164068f7df66d3af3f6600a762abdab44b9baeff7de833 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/elasticache_global_replication_group.html.markdown b/website/docs/cdktf/typescript/r/elasticache_global_replication_group.html.markdown
new file mode 100644
index 00000000000..33f1d36b652
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/elasticache_global_replication_group.html.markdown
@@ -0,0 +1,191 @@
+---
+subcategory: "ElastiCache"
+layout: "aws"
+page_title: "AWS: aws_elasticache_global_replication_group"
+description: |-
+  Provides an ElastiCache Global Replication Group resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_elasticache_global_replication_group
+
+Provides an ElastiCache Global Replication Group resource, which manages replication between two or more Replication Groups in different regions. For more information, see the [ElastiCache User Guide](https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/Redis-Global-Datastore.html).
+
+## Example Usage
+
+### Global replication group with one secondary replication group
+
+The global replication group depends on the primary group existing. Secondary replication groups depend on the global replication group. Terraform dependency management will handle this transparently using resource value references.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ElasticacheGlobalReplicationGroup } from "./.gen/providers/aws/elasticache-global-replication-group";
+import { ElasticacheReplicationGroup } from "./.gen/providers/aws/elasticache-replication-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const primary = new ElasticacheReplicationGroup(this, "primary", {
+      description: "primary replication group",
+      engine: "redis",
+      engineVersion: "5.0.6",
+      nodeType: "cache.m5.large",
+      numCacheClusters: 1,
+      replicationGroupId: "example-primary",
+    });
+    const example = new ElasticacheGlobalReplicationGroup(this, "example", {
+      globalReplicationGroupIdSuffix: "example",
+      primaryReplicationGroupId: primary.id,
+    });
+    new ElasticacheReplicationGroup(this, "secondary", {
+      description: "secondary replication group",
+      globalReplicationGroupId: example.globalReplicationGroupId,
+      numCacheClusters: 1,
+      provider: otherRegion,
+      replicationGroupId: "example-secondary",
+    });
+  }
+}
+
+```
+
+### Managing Redis Engine Versions
+
+The initial Redis version is determined by the version set on the primary replication group.
+However, once it is part of a Global Replication Group,
+the Global Replication Group manages the version of all member replication groups.
+
+The member replication groups must have [`lifecycleIgnoreChanges[engineVersion]`](https://www.terraform.io/language/meta-arguments/lifecycle) set,
+or Terraform will always return a diff.
+
+In this example,
+the primary replication group will be created with Redis 6.0,
+and then upgraded to Redis 6.2 once added to the Global Replication Group.
+The secondary replication group will be created with Redis 6.2.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ElasticacheGlobalReplicationGroup } from "./.gen/providers/aws/elasticache-global-replication-group";
+import { ElasticacheReplicationGroup } from "./.gen/providers/aws/elasticache-replication-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const primary = new ElasticacheReplicationGroup(this, "primary", {
+      description: "primary replication group",
+      engine: "redis",
+      engineVersion: "6.0",
+      lifecycle: {
+        ignoreChanges: [engineVersion],
+      },
+      nodeType: "cache.m5.large",
+      numCacheClusters: 1,
+      replicationGroupId: "example-primary",
+    });
+    const example = new ElasticacheGlobalReplicationGroup(this, "example", {
+      engineVersion: "6.2",
+      globalReplicationGroupIdSuffix: "example",
+      primaryReplicationGroupId: primary.id,
+    });
+    new ElasticacheReplicationGroup(this, "secondary", {
+      description: "secondary replication group",
+      globalReplicationGroupId: example.globalReplicationGroupId,
+      lifecycle: {
+        ignoreChanges: [engineVersion],
+      },
+      numCacheClusters: 1,
+      provider: otherRegion,
+      replicationGroupId: "example-secondary",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `automaticFailoverEnabled` - (Optional) Specifies whether read-only replicas will be automatically promoted to read/write primary if the existing primary fails.
+  When creating, by default the Global Replication Group inherits the automatic failover setting of the primary replication group.
+* `cacheNodeType` - (Optional) The instance class used.
+  See AWS documentation for information on [supported node types](https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/CacheNodes.SupportedTypes.html)
+  and [guidance on selecting node types](https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/nodes-select-size.html).
+  When creating, by default the Global Replication Group inherits the node type of the primary replication group.
+* `engineVersion` - (Optional) Redis version to use for the Global Replication Group.
+  When creating, by default the Global Replication Group inherits the version of the primary replication group.
+  If a version is specified, the Global Replication Group and all member replication groups will be upgraded to this version.
+  Cannot be downgraded without replacing the Global Replication Group and all member replication groups.
+  When the version is 7 or higher, the major and minor version should be set, e.g., `72`.
+  When the version is 6, the major and minor version can be set, e.g., `62`,
+  or the minor version can be unspecified which will use the latest version at creation time, e.g., `6X`.
+  The actual engine version used is returned in the attribute `engineVersionActual`, see [Attribute Reference](#attribute-reference) below.
+* `globalReplicationGroupIdSuffix` – (Required) The suffix name of a Global Datastore. If `globalReplicationGroupIdSuffix` is changed, creates a new resource.
+* `primaryReplicationGroupId` – (Required) The ID of the primary cluster that accepts writes and will replicate updates to the secondary cluster. If `primaryReplicationGroupId` is changed, creates a new resource.
+* `globalReplicationGroupDescription` – (Optional) A user-created description for the global replication group.
+* `numNodeGroups` - (Optional) The number of node groups (shards) on the global replication group.
+* `parameterGroupName` - (Optional) An ElastiCache Parameter Group to use for the Global Replication Group.
+  Required when upgrading a major engine version, but will be ignored if left configured after the upgrade is complete.
+  Specifying without a major version upgrade will fail.
+  Note that ElastiCache creates a copy of this parameter group for each member replication group.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the ElastiCache Global Replication Group.
+* `arn` - The ARN of the ElastiCache Global Replication Group.
+* `engineVersionActual` - The full version number of the cache engine running on the members of this global replication group.
+* `atRestEncryptionEnabled` - A flag that indicate whether the encryption at rest is enabled.
+* `authTokenEnabled` - A flag that indicate whether AuthToken (password) is enabled.
+* `clusterEnabled` - Indicates whether the Global Datastore is cluster enabled.
+* `engine` - The name of the cache engine to be used for the clusters in this global replication group.
+* `globalReplicationGroupId` - The full ID of the global replication group.
+* `globalNodeGroups` - Set of node groups (shards) on the global replication group.
+  Has the values:
+    * `globalNodeGroupId` - The ID of the global node group.
+    * `slots` - The keyspace for this node group.
+* `transitEncryptionEnabled` - A flag that indicates whether the encryption in transit is enabled.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `60M`)
+* `update` - (Default `60M`)
+* `delete` - (Default `20M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import ElastiCache Global Replication Groups using the `globalReplicationGroupId`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import ElastiCache Global Replication Groups using the `globalReplicationGroupId`. For example:
+
+```console
+% terraform import aws_elasticache_global_replication_group.my_global_replication_group okuqm-global-replication-group-1
+```
+
+<!-- cache-key: cdktf-0.18.0 input-bfdf8fb8151d1dd27e56bf30242603f71120c4ececefd5c623f1f7efab72074a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/elasticache_parameter_group.html.markdown b/website/docs/cdktf/typescript/r/elasticache_parameter_group.html.markdown
new file mode 100644
index 00000000000..2468331b7af
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/elasticache_parameter_group.html.markdown
@@ -0,0 +1,95 @@
+---
+subcategory: "ElastiCache"
+layout: "aws"
+page_title: "AWS: aws_elasticache_parameter_group"
+description: |-
+  Provides an ElastiCache parameter group resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_elasticache_parameter_group
+
+Provides an ElastiCache parameter group resource.
+
+~> **NOTE:** Attempting to remove the `reservedMemory` parameter when `family` is set to `redis26` or `redis28` may show a perpetual difference in Terraform due to an ElastiCache API limitation. Leave that parameter configured with any value to workaround the issue.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ElasticacheParameterGroup } from "./.gen/providers/aws/elasticache-parameter-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ElasticacheParameterGroup(this, "default", {
+      family: "redis2.8",
+      name: "cache-params",
+      parameter: [
+        {
+          name: "activerehashing",
+          value: "yes",
+        },
+        {
+          name: "min-slaves-to-write",
+          value: "2",
+        },
+      ],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the ElastiCache parameter group.
+* `family` - (Required) The family of the ElastiCache parameter group.
+* `description` - (Optional) The description of the ElastiCache parameter group. Defaults to "Managed by Terraform".
+* `parameter` - (Optional) A list of ElastiCache parameters to apply.
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+Parameter blocks support the following:
+
+* `name` - (Required) The name of the ElastiCache parameter.
+* `value` - (Required) The value of the ElastiCache parameter.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ElastiCache parameter group name.
+* `arn` - The AWS ARN associated with the parameter group.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import ElastiCache Parameter Groups using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import ElastiCache Parameter Groups using the `name`. For example:
+
+```console
+% terraform import aws_elasticache_parameter_group.default redis-params
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1858c11d21ea62b961241aaf317216a7b9adcdbbfcf280755e49cbf394b01a06 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/elasticache_replication_group.html.markdown b/website/docs/cdktf/typescript/r/elasticache_replication_group.html.markdown
new file mode 100644
index 00000000000..25dc3b8f243
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/elasticache_replication_group.html.markdown
@@ -0,0 +1,344 @@
+---
+subcategory: "ElastiCache"
+layout: "aws"
+page_title: "AWS: aws_elasticache_replication_group"
+description: |-
+  Provides an ElastiCache Replication Group resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_elasticache_replication_group
+
+Provides an ElastiCache Replication Group resource.
+
+For working with a [Memcached cluster](https://docs.aws.amazon.com/AmazonElastiCache/latest/mem-ug/WhatIs.html) or a
+[single-node Redis instance (Cluster Mode Disabled)](https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/WhatIs.html),
+see the [`awsElasticacheCluster` resource](/docs/providers/aws/r/elasticache_cluster.html).
+
+~> **Note:** When you change an attribute, such as `engineVersion`, by
+default the ElastiCache API applies it in the next maintenance window. Because
+of this, Terraform may report a difference in its planning phase because the
+actual modification has not yet taken place. You can use the
+`applyImmediately` flag to instruct the service to apply the change
+immediately. Using `applyImmediately` can result in a brief downtime as
+servers reboots.
+See the AWS Documentation on
+[Modifying an ElastiCache Cache Cluster](https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/Clusters.Modify.html)
+for more information.
+
+~> **Note:** Any attribute changes that re-create the resource will be applied immediately, regardless of the value of `applyImmediately`.
+
+~> **Note:** Be aware of the terminology collision around "cluster" for `awsElasticacheReplicationGroup`. For example, it is possible to create a ["Cluster Mode Disabled [Redis] Cluster"](https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/Clusters.Create.CON.Redis.html). With "Cluster Mode Enabled", the data will be stored in shards (called "node groups"). See [Redis Cluster Configuration](https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/cluster-create-determine-requirements.html#redis-cluster-configuration) for a diagram of the differences. To enable cluster mode, use a parameter group that has cluster mode enabled. The default parameter groups provided by AWS end with ".cluster.on", for example `defaultRedis6XClusterOn`.
+
+## Example Usage
+
+### Redis Cluster Mode Disabled
+
+To create a single shard primary with single read replica:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ElasticacheReplicationGroup } from "./.gen/providers/aws/elasticache-replication-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ElasticacheReplicationGroup(this, "example", {
+      automaticFailoverEnabled: true,
+      description: "example description",
+      nodeType: "cache.m4.large",
+      numCacheClusters: 2,
+      parameterGroupName: "default.redis3.2",
+      port: 6379,
+      preferredCacheClusterAzs: ["us-west-2a", "us-west-2b"],
+      replicationGroupId: "tf-rep-group-1",
+    });
+  }
+}
+
+```
+
+You have two options for adjusting the number of replicas:
+
+* Adjusting `numCacheClusters` directly. This will attempt to automatically add or remove replicas, but provides no granular control (e.g., preferred availability zone, cache cluster ID) for the added or removed replicas. This also currently expects cache cluster IDs in the form of `replicationGroupId00#`.
+* Otherwise for fine grained control of the underlying cache clusters, they can be added or removed with the [`awsElasticacheCluster` resource](/docs/providers/aws/r/elasticache_cluster.html) and its `replicationGroupId` attribute. In this situation, you will need to utilize the [lifecycle configuration block](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html) with `ignoreChanges` to prevent perpetual differences during Terraform plan with the `numCacheCluster` attribute.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformCount, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ElasticacheCluster } from "./.gen/providers/aws/elasticache-cluster";
+import { ElasticacheReplicationGroup } from "./.gen/providers/aws/elasticache-replication-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new ElasticacheReplicationGroup(this, "example", {
+      automaticFailoverEnabled: true,
+      description: "example description",
+      lifecycle: {
+        ignoreChanges: [numCacheClusters],
+      },
+      nodeType: "cache.m4.large",
+      numCacheClusters: 2,
+      parameterGroupName: "default.redis3.2",
+      port: 6379,
+      preferredCacheClusterAzs: ["us-west-2a", "us-west-2b"],
+      replicationGroupId: "tf-rep-group-1",
+    });
+    /*In most cases loops should be handled in the programming language context and 
+    not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+    you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+    you need to keep this like it is.*/
+    const replicaCount = TerraformCount.of(Token.asNumber("1"));
+    new ElasticacheCluster(this, "replica", {
+      clusterId: "tf-rep-group-1-${" + replicaCount.index + "}",
+      replicationGroupId: example.id,
+      count: replicaCount,
+    });
+  }
+}
+
+```
+
+### Redis Cluster Mode Enabled
+
+To create two shards with a primary and a single read replica each:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ElasticacheReplicationGroup } from "./.gen/providers/aws/elasticache-replication-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ElasticacheReplicationGroup(this, "baz", {
+      automaticFailoverEnabled: true,
+      description: "example description",
+      nodeType: "cache.t2.small",
+      numNodeGroups: 2,
+      parameterGroupName: "default.redis3.2.cluster.on",
+      port: 6379,
+      replicasPerNodeGroup: 1,
+      replicationGroupId: "tf-redis-cluster",
+    });
+  }
+}
+
+```
+
+### Redis Log Delivery configuration
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ElasticacheReplicationGroup } from "./.gen/providers/aws/elasticache-replication-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ElasticacheReplicationGroup(this, "test", {
+      applyImmediately: true,
+      autoMinorVersionUpgrade: Token.asString(false),
+      description: "test description",
+      logDeliveryConfiguration: [
+        {
+          destination: example.name,
+          destinationType: "cloudwatch-logs",
+          logFormat: "text",
+          logType: "slow-log",
+        },
+        {
+          destination: Token.asString(
+            awsKinesisFirehoseDeliveryStreamExample.name
+          ),
+          destinationType: "kinesis-firehose",
+          logFormat: "json",
+          logType: "engine-log",
+        },
+      ],
+      maintenanceWindow: "tue:06:30-tue:07:30",
+      nodeType: "cache.t3.small",
+      port: 6379,
+      replicationGroupId: "myreplicaciongroup",
+      snapshotWindow: "01:00-02:00",
+    });
+  }
+}
+
+```
+
+~> **Note:** We currently do not support passing a `primaryClusterId` in order to create the Replication Group.
+
+~> **Note:** Automatic Failover is unavailable for Redis versions earlier than 2.8.6,
+and unavailable on T1 node types. For T2 node types, it is only available on Redis version 3.2.4 or later with cluster mode enabled. See the [High Availability Using Replication Groups](https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/Replication.html) guide
+for full details on using Replication Groups.
+
+### Creating a secondary replication group for a global replication group
+
+A Global Replication Group can have one one two secondary Replication Groups in different regions. These are added to an existing Global Replication Group.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ElasticacheGlobalReplicationGroup } from "./.gen/providers/aws/elasticache-global-replication-group";
+import { ElasticacheReplicationGroup } from "./.gen/providers/aws/elasticache-replication-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const primary = new ElasticacheReplicationGroup(this, "primary", {
+      description: "primary replication group",
+      engine: "redis",
+      engineVersion: "5.0.6",
+      nodeType: "cache.m5.large",
+      numCacheClusters: 1,
+      provider: otherRegion,
+      replicationGroupId: "example-primary",
+    });
+    const example = new ElasticacheGlobalReplicationGroup(this, "example", {
+      globalReplicationGroupIdSuffix: "example",
+      primaryReplicationGroupId: primary.id,
+      provider: otherRegion,
+    });
+    new ElasticacheReplicationGroup(this, "secondary", {
+      description: "secondary replication group",
+      globalReplicationGroupId: example.globalReplicationGroupId,
+      numCacheClusters: 1,
+      replicationGroupId: "example-secondary",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `description` – (Required) User-created description for the replication group. Must not be empty.
+* `replicationGroupId` – (Required) Replication group identifier. This parameter is stored as a lowercase string.
+
+The following arguments are optional:
+
+* `applyImmediately` - (Optional) Specifies whether any modifications are applied immediately, or during the next maintenance window. Default is `false`.
+* `atRestEncryptionEnabled` - (Optional) Whether to enable encryption at rest.
+* `authToken` - (Optional) Password used to access a password protected server. Can be specified only if `transit_encryption_enabled = true`.
+* `autoMinorVersionUpgrade` - (Optional) Specifies whether minor version engine upgrades will be applied automatically to the underlying Cache Cluster instances during the maintenance window.
+  Only supported for engine type `"redis"` and if the engine version is 6 or higher.
+  Defaults to `true`.
+* `automaticFailoverEnabled` - (Optional) Specifies whether a read-only replica will be automatically promoted to read/write primary if the existing primary fails. If enabled, `numCacheClusters` must be greater than 1. Must be enabled for Redis (cluster mode enabled) replication groups. Defaults to `false`.
+* `dataTieringEnabled` - (Optional) Enables data tiering. Data tiering is only supported for replication groups using the r6gd node type. This parameter must be set to `true` when using r6gd nodes.
+* `engine` - (Optional) Name of the cache engine to be used for the clusters in this replication group. The only valid value is `redis`.
+* `engineVersion` - (Optional) Version number of the cache engine to be used for the cache clusters in this replication group.
+  If the version is 7 or higher, the major and minor version should be set, e.g., `72`.
+  If the version is 6, the major and minor version can be set, e.g., `62`,
+  or the minor version can be unspecified which will use the latest version at creation time, e.g., `6X`.
+  Otherwise, specify the full version desired, e.g., `506`.
+  The actual engine version used is returned in the attribute `engineVersionActual`, see [Attribute Reference](#attribute-reference) below.
+* `finalSnapshotIdentifier` - (Optional) The name of your final node group (shard) snapshot. ElastiCache creates the snapshot from the primary node in the cluster. If omitted, no final snapshot will be made.
+* `globalReplicationGroupId` - (Optional) The ID of the global replication group to which this replication group should belong. If this parameter is specified, the replication group is added to the specified global replication group as a secondary replication group; otherwise, the replication group is not part of any global replication group. If `globalReplicationGroupId` is set, the `numNodeGroups` parameter cannot be set.
+* `ipDiscovery` - (Optional) The IP version to advertise in the discovery protocol. Valid values are `ipv4` or `ipv6`.
+* `kmsKeyId` - (Optional) The ARN of the key that you wish to use if encrypting at rest. If not supplied, uses service managed encryption. Can be specified only if `at_rest_encryption_enabled = true`.
+* `logDeliveryConfiguration` - (Optional, Redis only) Specifies the destination and format of Redis [SLOWLOG](https://redis.io/commands/slowlog) or Redis [Engine Log](https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/Log_Delivery.html#Log_contents-engine-log). See the documentation on [Amazon ElastiCache](https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/Log_Delivery.html#Log_contents-engine-log). See [Log Delivery Configuration](#log-delivery-configuration) below for more details.
+* `maintenanceWindow` – (Optional) Specifies the weekly time range for when maintenance on the cache cluster is performed. The format is `ddd:hh24:miDdd:hh24:mi` (24H Clock UTC). The minimum maintenance window is a 60 minute period. Example: `sun:05:00Sun:09:00`
+* `multiAzEnabled` - (Optional) Specifies whether to enable Multi-AZ Support for the replication group. If `true`, `automaticFailoverEnabled` must also be enabled. Defaults to `false`.
+* `networkType` - (Optional) The IP versions for cache cluster connections. Valid values are `ipv4`, `ipv6` or `dualStack`.
+* `nodeType` - (Optional) Instance class to be used. See AWS documentation for information on [supported node types](https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/CacheNodes.SupportedTypes.html) and [guidance on selecting node types](https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/nodes-select-size.html). Required unless `globalReplicationGroupId` is set. Cannot be set if `globalReplicationGroupId` is set.
+* `notificationTopicArn` – (Optional) ARN of an SNS topic to send ElastiCache notifications to. Example: `arn:aws:sns:usEast1:012345678999:mySnsTopic`
+* `numCacheClusters` - (Optional) Number of cache clusters (primary and replicas) this replication group will have. If Multi-AZ is enabled, the value of this parameter must be at least 2. Updates will occur before other modifications. Conflicts with `numNodeGroups`. Defaults to `1`.
+* `numNodeGroups` - (Optional) Number of node groups (shards) for this Redis replication group.
+  Changing this number will trigger a resizing operation before other settings modifications.
+* `parameterGroupName` - (Optional) Name of the parameter group to associate with this replication group. If this argument is omitted, the default cache parameter group for the specified engine is used. To enable "cluster mode", i.e., data sharding, use a parameter group that has the parameter `clusterEnabled` set to true.
+* `port` – (Optional) Port number on which each of the cache nodes will accept connections. For Memcache the default is 11211, and for Redis the default port is 6379.
+* `preferredCacheClusterAzs` - (Optional) List of EC2 availability zones in which the replication group's cache clusters will be created. The order of the availability zones in the list is considered. The first item in the list will be the primary node. Ignored when updating.
+* `replicasPerNodeGroup` - (Optional) Number of replica nodes in each node group.
+  Changing this number will trigger a resizing operation before other settings modifications.
+  Valid values are 0 to 5.
+* `securityGroupIds` - (Optional) IDs of one or more Amazon VPC security groups associated with this replication group. Use this parameter only when you are creating a replication group in an Amazon Virtual Private Cloud.
+* `securityGroupNames` - (Optional) Names of one or more Amazon VPC security groups associated with this replication group. Use this parameter only when you are creating a replication group in an Amazon Virtual Private Cloud.
+* `snapshotArns` – (Optional) List of ARNs that identify Redis RDB snapshot files stored in Amazon S3. The names object names cannot contain any commas.
+* `snapshotName` - (Optional) Name of a snapshot from which to restore data into the new node group. Changing the `snapshotName` forces a new resource.
+* `snapshotRetentionLimit` - (Optional, Redis only) Number of days for which ElastiCache will retain automatic cache cluster snapshots before deleting them. For example, if you set SnapshotRetentionLimit to 5, then a snapshot that was taken today will be retained for 5 days before being deleted. If the value of `snapshotRetentionLimit` is set to zero (0), backups are turned off. Please note that setting a `snapshotRetentionLimit` is not supported on cache.t1.micro cache nodes
+* `snapshotWindow` - (Optional, Redis only) Daily time range (in UTC) during which ElastiCache will begin taking a daily snapshot of your cache cluster. The minimum snapshot window is a 60 minute period. Example: `05:0009:00`
+* `subnetGroupName` - (Optional) Name of the cache subnet group to be used for the replication group.
+* `tags` - (Optional) Map of tags to assign to the resource. Adding tags to this resource will add or overwrite any existing tags on the clusters in the replication group and not to the group itself. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `transitEncryptionEnabled` - (Optional) Whether to enable encryption in transit.
+* `userGroupIds` - (Optional) User Group ID to associate with the replication group. Only a maximum of one (1) user group ID is valid. **NOTE:** This argument _is_ a set because the AWS specification allows for multiple IDs. However, in practice, AWS only allows a maximum size of one.
+
+### Log Delivery Configuration
+
+The `logDeliveryConfiguration` block allows the streaming of Redis [SLOWLOG](https://redis.io/commands/slowlog) or Redis [Engine Log](https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/Log_Delivery.html#Log_contents-engine-log) to CloudWatch Logs or Kinesis Data Firehose. Max of 2 blocks.
+
+* `destination` - Name of either the CloudWatch Logs LogGroup or Kinesis Data Firehose resource.
+* `destinationType` - For CloudWatch Logs use `cloudwatchLogs` or for Kinesis Data Firehose use `kinesisFirehose`.
+* `logFormat` - Valid values are `json` or `text`
+* `logType` - Valid values are  `slowLog` or `engineLog`. Max 1 of each.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the created ElastiCache Replication Group.
+* `engineVersionActual` - Because ElastiCache pulls the latest minor or patch for a version, this attribute returns the running version of the cache engine.
+* `clusterEnabled` - Indicates if cluster mode is enabled.
+* `configurationEndpointAddress` - Address of the replication group configuration endpoint when cluster mode is enabled.
+* `id` - ID of the ElastiCache Replication Group.
+* `memberClusters` - Identifiers of all the nodes that are part of this replication group.
+* `primaryEndpointAddress` - (Redis only) Address of the endpoint for the primary node in the replication group, if the cluster mode is disabled.
+* `readerEndpointAddress` - (Redis only) Address of the endpoint for the reader node in the replication group, if the cluster mode is disabled.
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `60M`)
+* `delete` - (Default `40M`)
+* `update` - (Default `40M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import ElastiCache Replication Groups using the `replicationGroupId`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import ElastiCache Replication Groups using the `replicationGroupId`. For example:
+
+```console
+% terraform import aws_elasticache_replication_group.my_replication_group replication-group-1
+```
+
+<!-- cache-key: cdktf-0.18.0 input-29e9b485cffca2848117f5e673253482a1c7125d44f2bd91aac53bf7a91444be -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/elasticache_subnet_group.html.markdown b/website/docs/cdktf/typescript/r/elasticache_subnet_group.html.markdown
new file mode 100644
index 00000000000..e0a8bd94038
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/elasticache_subnet_group.html.markdown
@@ -0,0 +1,96 @@
+---
+subcategory: "ElastiCache"
+layout: "aws"
+page_title: "AWS: aws_elasticache_subnet_group"
+description: |-
+  Provides an ElastiCache Subnet Group resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_elasticache_subnet_group
+
+Provides an ElastiCache Subnet Group resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ElasticacheSubnetGroup } from "./.gen/providers/aws/elasticache-subnet-group";
+import { Subnet } from "./.gen/providers/aws/subnet";
+import { Vpc } from "./.gen/providers/aws/vpc";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const foo = new Vpc(this, "foo", {
+      cidrBlock: "10.0.0.0/16",
+      tags: {
+        Name: "tf-test",
+      },
+    });
+    const awsSubnetFoo = new Subnet(this, "foo_1", {
+      availabilityZone: "us-west-2a",
+      cidrBlock: "10.0.0.0/24",
+      tags: {
+        Name: "tf-test",
+      },
+      vpcId: foo.id,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSubnetFoo.overrideLogicalId("foo");
+    new ElasticacheSubnetGroup(this, "bar", {
+      name: "tf-test-cache-subnet",
+      subnetIds: [Token.asString(awsSubnetFoo.id)],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` – (Required) Name for the cache subnet group. ElastiCache converts this name to lowercase.
+* `description` – (Optional) Description for the cache subnet group. Defaults to "Managed by Terraform".
+* `subnetIds` – (Required) List of VPC Subnet IDs for the cache subnet group
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `description` - The Description of the ElastiCache Subnet Group.
+* `name` - The Name of the ElastiCache Subnet Group.
+* `subnetIds` - The Subnet IDs of the ElastiCache Subnet Group.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import ElastiCache Subnet Groups using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import ElastiCache Subnet Groups using the `name`. For example:
+
+```console
+% terraform import aws_elasticache_subnet_group.bar tf-test-cache-subnet
+```
+
+<!-- cache-key: cdktf-0.18.0 input-d49c45c9808e5118d0af382be9e2a43a4d61bdb33e03f20e46b9f01473a0e825 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/elasticache_user.html.markdown b/website/docs/cdktf/typescript/r/elasticache_user.html.markdown
new file mode 100644
index 00000000000..992b889f79b
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/elasticache_user.html.markdown
@@ -0,0 +1,155 @@
+---
+subcategory: "ElastiCache"
+layout: "aws"
+page_title: "AWS: aws_elasticache_user"
+description: |-
+  Provides an ElastiCache user.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_elasticache_user
+
+Provides an ElastiCache user resource.
+
+~> **Note:** All arguments including the username and passwords will be stored in the raw state as plain-text.
+[Read more about sensitive data in state](https://www.terraform.io/docs/state/sensitive-data.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ElasticacheUser } from "./.gen/providers/aws/elasticache-user";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ElasticacheUser(this, "test", {
+      accessString:
+        "on ~app::* -@all +@read +@hash +@bitmap +@geo -setbit -bitfield -hset -hsetnx -hmset -hincrby -hincrbyfloat -hdel -bitop -geoadd -georadius -georadiusbymember",
+      engine: "REDIS",
+      passwords: ["password123456789"],
+      userId: "testUserId",
+      userName: "testUserName",
+    });
+  }
+}
+
+```
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ElasticacheUser } from "./.gen/providers/aws/elasticache-user";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ElasticacheUser(this, "test", {
+      accessString: "on ~* +@all",
+      authenticationMode: {
+        type: "iam",
+      },
+      engine: "REDIS",
+      userId: "testUserId",
+      userName: "testUserName",
+    });
+  }
+}
+
+```
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ElasticacheUser } from "./.gen/providers/aws/elasticache-user";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ElasticacheUser(this, "test", {
+      accessString: "on ~* +@all",
+      authenticationMode: {
+        passwords: ["password1", "password2"],
+        type: "password",
+      },
+      engine: "REDIS",
+      userId: "testUserId",
+      userName: "testUserName",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `accessString` - (Required) Access permissions string used for this user. See [Specifying Permissions Using an Access String](https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/Clusters.RBAC.html#Access-string) for more details.
+* `engine` - (Required) The current supported value is `redis`.
+* `userId` - (Required) The ID of the user.
+* `userName` - (Required) The username of the user.
+
+The following arguments are optional:
+
+* `authenticationMode` - (Optional) Denotes the user's authentication properties. Detailed below.
+* `noPasswordRequired` - (Optional) Indicates a password is not required for this user.
+* `passwords` - (Optional) Passwords used for this user. You can create up to two passwords for each user.
+* `tags` - (Optional) A list of tags to be added to this resource. A tag is a key-value pair.
+
+### authentication_mode Configuration Block
+
+* `passwords` - (Optional) Specifies the passwords to use for authentication if `type` is set to `password`.
+* `type` - (Required) Specifies the authentication type. Possible options are: `password`, `noPasswordRequired` or `iam`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the created ElastiCache User.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `5M`)
+- `update` - (Default `5M`)
+- `delete` - (Default `5M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import ElastiCache users using the `userId`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import ElastiCache users using the `userId`. For example:
+
+```console
+% terraform import aws_elasticache_user.my_user userId1
+```
+
+<!-- cache-key: cdktf-0.18.0 input-c37a7a3d6865b0708a24bc5e37568bc382a09c2d006a5a45f7b5eac613f84ed1 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/elasticache_user_group.html.markdown b/website/docs/cdktf/typescript/r/elasticache_user_group.html.markdown
new file mode 100644
index 00000000000..7c459815ca5
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/elasticache_user_group.html.markdown
@@ -0,0 +1,96 @@
+---
+subcategory: "ElastiCache"
+layout: "aws"
+page_title: "AWS: aws_elasticache_user_group"
+description: |-
+  Provides an ElastiCache user group.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_elasticache_user_group
+
+Provides an ElastiCache user group resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ElasticacheUser } from "./.gen/providers/aws/elasticache-user";
+import { ElasticacheUserGroup } from "./.gen/providers/aws/elasticache-user-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const test = new ElasticacheUser(this, "test", {
+      accessString:
+        "on ~app::* -@all +@read +@hash +@bitmap +@geo -setbit -bitfield -hset -hsetnx -hmset -hincrby -hincrbyfloat -hdel -bitop -geoadd -georadius -georadiusbymember",
+      engine: "REDIS",
+      passwords: ["password123456789"],
+      userId: "testUserId",
+      userName: "default",
+    });
+    const awsElasticacheUserGroupTest = new ElasticacheUserGroup(
+      this,
+      "test_1",
+      {
+        engine: "REDIS",
+        userGroupId: "userGroupId",
+        userIds: [test.userId],
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsElasticacheUserGroupTest.overrideLogicalId("test");
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `engine` - (Required) The current supported value is `redis`.
+* `userGroupId` - (Required) The ID of the user group.
+
+The following arguments are optional:
+
+* `userIds` - (Optional) The list of user IDs that belong to the user group.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The user group identifier.
+* `arn` - The ARN that identifies the user group.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import ElastiCache user groups using the `userGroupId`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import ElastiCache user groups using the `userGroupId`. For example:
+
+```console
+% terraform import aws_elasticache_user_group.my_user_group userGoupId1
+```
+
+<!-- cache-key: cdktf-0.18.0 input-273ead1e6f40d517ea4aa4538fa2dae8368c51b3c1f92a67ddcf5ffa9c8dd66f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/elasticache_user_group_association.html.markdown b/website/docs/cdktf/typescript/r/elasticache_user_group_association.html.markdown
new file mode 100644
index 00000000000..523b77d1100
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/elasticache_user_group_association.html.markdown
@@ -0,0 +1,108 @@
+---
+subcategory: "ElastiCache"
+layout: "aws"
+page_title: "AWS: aws_elasticache_user_group_association"
+description: |-
+  Associate an ElastiCache user and user group.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_elasticache_user_group_association
+
+Associate an existing ElastiCache user and an existing user group.
+
+~> **NOTE:** Terraform will detect changes in the `awsElasticacheUserGroup` since `awsElasticacheUserGroupAssociation` changes the user IDs associated with the user group. You can ignore these changes with the `lifecycle` `ignoreChanges` meta argument as shown in the example.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ElasticacheUser } from "./.gen/providers/aws/elasticache-user";
+import { ElasticacheUserGroup } from "./.gen/providers/aws/elasticache-user-group";
+import { ElasticacheUserGroupAssociation } from "./.gen/providers/aws/elasticache-user-group-association";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const defaultVar = new ElasticacheUser(this, "default", {
+      accessString:
+        "on ~app::* -@all +@read +@hash +@bitmap +@geo -setbit -bitfield -hset -hsetnx -hmset -hincrby -hincrbyfloat -hdel -bitop -geoadd -georadius -georadiusbymember",
+      engine: "REDIS",
+      passwords: ["password123456789"],
+      userId: "defaultUserID",
+      userName: "default",
+    });
+    const example = new ElasticacheUser(this, "example", {
+      accessString:
+        "on ~app::* -@all +@read +@hash +@bitmap +@geo -setbit -bitfield -hset -hsetnx -hmset -hincrby -hincrbyfloat -hdel -bitop -geoadd -georadius -georadiusbymember",
+      engine: "REDIS",
+      passwords: ["password123456789"],
+      userId: "exampleUserID",
+      userName: "exampleuser",
+    });
+    const awsElasticacheUserGroupExample = new ElasticacheUserGroup(
+      this,
+      "example_2",
+      {
+        engine: "REDIS",
+        lifecycle: {
+          ignoreChanges: [userIds],
+        },
+        userGroupId: "userGroupId",
+        userIds: [defaultVar.userId],
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsElasticacheUserGroupExample.overrideLogicalId("example");
+    const awsElasticacheUserGroupAssociationExample =
+      new ElasticacheUserGroupAssociation(this, "example_3", {
+        userGroupId: Token.asString(awsElasticacheUserGroupExample.userGroupId),
+        userId: example.userId,
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsElasticacheUserGroupAssociationExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `userGroupId` - (Required) ID of the user group.
+* `userId` - (Required) ID of the user to associated with the user group.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import ElastiCache user group associations using the `userGroupId` and `userId`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import ElastiCache user group associations using the `userGroupId` and `userId`. For example:
+
+```console
+% terraform import aws_elasticache_user_group_association.example userGoupId1,userId
+```
+
+<!-- cache-key: cdktf-0.18.0 input-0fb04431352bb053d0baffe8ca67747d1db14fc5f35be68ff3b233036b0d1ebf -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/elasticsearch_domain.html.markdown b/website/docs/cdktf/typescript/r/elasticsearch_domain.html.markdown
new file mode 100644
index 00000000000..f8429990e41
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/elasticsearch_domain.html.markdown
@@ -0,0 +1,444 @@
+---
+subcategory: "Elasticsearch"
+layout: "aws"
+page_title: "AWS: aws_elasticsearch_domain"
+description: |-
+  Terraform resource for managing an AWS Elasticsearch Domain.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_elasticsearch_domain
+
+Manages an AWS Elasticsearch Domain.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ElasticsearchDomain } from "./.gen/providers/aws/elasticsearch-domain";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ElasticsearchDomain(this, "example", {
+      clusterConfig: {
+        instanceType: "r4.large.elasticsearch",
+      },
+      domainName: "example",
+      elasticsearchVersion: "7.10",
+      tags: {
+        Domain: "TestDomain",
+      },
+    });
+  }
+}
+
+```
+
+### Access Policy
+
+-> See also: [`awsElasticsearchDomainPolicy` resource](/docs/providers/aws/r/elasticsearch_domain_policy.html)
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformVariable, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCallerIdentity } from "./.gen/providers/aws/data-aws-caller-identity";
+import { DataAwsRegion } from "./.gen/providers/aws/data-aws-region";
+import { ElasticsearchDomain } from "./.gen/providers/aws/elasticsearch-domain";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    /*Terraform Variables are not always the best fit for getting inputs in the context of Terraform CDK.
+    You can read more about this at https://cdk.tf/variables*/
+    const domain = new TerraformVariable(this, "domain", {
+      default: "tf-test",
+    });
+    const current = new DataAwsCallerIdentity(this, "current", {});
+    const dataAwsRegionCurrent = new DataAwsRegion(this, "current_2", {});
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsRegionCurrent.overrideLogicalId("current");
+    new ElasticsearchDomain(this, "example", {
+      accessPolicies:
+        '{\n  "Version": "2012-10-17",\n  "Statement": [\n    {\n      "Action": "es:*",\n      "Principal": "*",\n      "Effect": "Allow",\n      "Resource": "arn:aws:es:${' +
+        dataAwsRegionCurrent.name +
+        "}:${" +
+        current.accountId +
+        "}:domain/${" +
+        domain.value +
+        '}/*",\n      "Condition": {\n        "IpAddress": {"aws:SourceIp": ["66.193.100.22/32"]}\n      }\n    }\n  ]\n}\n\n',
+      domainName: domain.stringValue,
+    });
+  }
+}
+
+```
+
+### Log Publishing to CloudWatch Logs
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudwatchLogGroup } from "./.gen/providers/aws/cloudwatch-log-group";
+import { CloudwatchLogResourcePolicy } from "./.gen/providers/aws/cloudwatch-log-resource-policy";
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { ElasticsearchDomain } from "./.gen/providers/aws/elasticsearch-domain";
+interface MyConfig {
+  domainName: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    const example = new CloudwatchLogGroup(this, "example", {
+      name: "example",
+    });
+    const awsElasticsearchDomainExample = new ElasticsearchDomain(
+      this,
+      "example_1",
+      {
+        logPublishingOptions: [
+          {
+            cloudwatchLogGroupArn: example.arn,
+            logType: "INDEX_SLOW_LOGS",
+          },
+        ],
+        domainName: config.domainName,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsElasticsearchDomainExample.overrideLogicalId("example");
+    const dataAwsIamPolicyDocumentExample = new DataAwsIamPolicyDocument(
+      this,
+      "example_2",
+      {
+        statement: [
+          {
+            actions: [
+              "logs:PutLogEvents",
+              "logs:PutLogEventsBatch",
+              "logs:CreateLogStream",
+            ],
+            effect: "Allow",
+            principals: [
+              {
+                identifiers: ["es.amazonaws.com"],
+                type: "Service",
+              },
+            ],
+            resources: ["arn:aws:logs:*"],
+          },
+        ],
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsIamPolicyDocumentExample.overrideLogicalId("example");
+    const awsCloudwatchLogResourcePolicyExample =
+      new CloudwatchLogResourcePolicy(this, "example_3", {
+        policyDocument: Token.asString(dataAwsIamPolicyDocumentExample.json),
+        policyName: "example",
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsCloudwatchLogResourcePolicyExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### VPC based ES
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformVariable, Token, Fn, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCallerIdentity } from "./.gen/providers/aws/data-aws-caller-identity";
+import { DataAwsRegion } from "./.gen/providers/aws/data-aws-region";
+import { DataAwsSubnets } from "./.gen/providers/aws/data-aws-subnets";
+import { DataAwsVpc } from "./.gen/providers/aws/data-aws-vpc";
+import { ElasticsearchDomain } from "./.gen/providers/aws/elasticsearch-domain";
+import { IamServiceLinkedRole } from "./.gen/providers/aws/iam-service-linked-role";
+import { SecurityGroup } from "./.gen/providers/aws/security-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    /*Terraform Variables are not always the best fit for getting inputs in the context of Terraform CDK.
+    You can read more about this at https://cdk.tf/variables*/
+    const domain = new TerraformVariable(this, "domain", {
+      default: "tf-test",
+    });
+    const vpc = new TerraformVariable(this, "vpc", {});
+    const es = new IamServiceLinkedRole(this, "es", {
+      awsServiceName: "opensearchservice.amazonaws.com",
+    });
+    const current = new DataAwsCallerIdentity(this, "current", {});
+    const dataAwsRegionCurrent = new DataAwsRegion(this, "current_4", {});
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsRegionCurrent.overrideLogicalId("current");
+    const selected = new DataAwsVpc(this, "selected", {
+      tags: {
+        Name: vpc.stringValue,
+      },
+    });
+    const awsSecurityGroupEs = new SecurityGroup(this, "es_6", {
+      description: "Managed by Terraform",
+      ingress: [
+        {
+          cidrBlocks: [Token.asString(selected.cidrBlock)],
+          fromPort: 443,
+          protocol: "tcp",
+          toPort: 443,
+        },
+      ],
+      name: "${" + vpc.value + "}-elasticsearch-${" + domain.value + "}",
+      vpcId: Token.asString(selected.id),
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSecurityGroupEs.overrideLogicalId("es");
+    const dataAwsSubnetsSelected = new DataAwsSubnets(this, "selected_7", {
+      filter: [
+        {
+          name: "vpc-id",
+          values: [Token.asString(selected.id)],
+        },
+      ],
+      tags: {
+        Tier: "private",
+      },
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsSubnetsSelected.overrideLogicalId("selected");
+    const awsElasticsearchDomainEs = new ElasticsearchDomain(this, "es_8", {
+      accessPolicies:
+        '{\n\t"Version": "2012-10-17",\n\t"Statement": [\n\t\t{\n\t\t\t"Action": "es:*",\n\t\t\t"Principal": "*",\n\t\t\t"Effect": "Allow",\n\t\t\t"Resource": "arn:aws:es:${' +
+        dataAwsRegionCurrent.name +
+        "}:${" +
+        current.accountId +
+        "}:domain/${" +
+        domain.value +
+        '}/*"\n\t\t}\n\t]\n}\n\n',
+      advancedOptions: {
+        "rest.action.multi.allow_explicit_index": "true",
+      },
+      clusterConfig: {
+        instanceType: "m4.large.elasticsearch",
+        zoneAwarenessEnabled: true,
+      },
+      dependsOn: [es],
+      domainName: domain.stringValue,
+      elasticsearchVersion: "6.3",
+      tags: {
+        Domain: "TestDomain",
+      },
+      vpcOptions: {
+        securityGroupIds: [Token.asString(awsSecurityGroupEs.id)],
+        subnetIds: [
+          Token.asString(Fn.lookupNested(dataAwsSubnetsSelected.ids, ["0"])),
+          Token.asString(Fn.lookupNested(dataAwsSubnetsSelected.ids, ["1"])),
+        ],
+      },
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsElasticsearchDomainEs.overrideLogicalId("es");
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `domainName` - (Required) Name of the domain.
+
+The following arguments are optional:
+
+* `accessPolicies` - (Optional) IAM policy document specifying the access policies for the domain.
+* `advancedOptions` - (Optional) Key-value string pairs to specify advanced configuration options. Note that the values for these configuration options must be strings (wrapped in quotes) or they may be wrong and cause a perpetual diff, causing Terraform to want to recreate your Elasticsearch domain on every apply.
+* `advancedSecurityOptions` - (Optional) Configuration block for [fine-grained access control](https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/fgac.html). Detailed below.
+* `autoTuneOptions` - (Optional) Configuration block for the Auto-Tune options of the domain. Detailed below.
+* `clusterConfig` - (Optional) Configuration block for the cluster of the domain. Detailed below.
+* `cognitoOptions` - (Optional) Configuration block for authenticating Kibana with Cognito. Detailed below.
+* `domainEndpointOptions` - (Optional) Configuration block for domain endpoint HTTP(S) related options. Detailed below.
+* `ebsOptions` - (Optional) Configuration block for EBS related options, may be required based on chosen [instance size](https://aws.amazon.com/elasticsearch-service/pricing/). Detailed below.
+* `elasticsearchVersion` - (Optional) Version of Elasticsearch to deploy. Defaults to `15`.
+* `encryptAtRest` - (Optional) Configuration block for encrypt at rest options. Only available for [certain instance types](http://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/aes-supported-instance-types.html). Detailed below.
+* `logPublishingOptions` - (Optional) Configuration block for publishing slow and application logs to CloudWatch Logs. This block can be declared multiple times, for each log_type, within the same resource. Detailed below.
+* `nodeToNodeEncryption` - (Optional) Configuration block for node-to-node encryption options. Detailed below.
+* `snapshotOptions` - (Optional) Configuration block for snapshot related options. Detailed below. DEPRECATED. For domains running Elasticsearch 5.3 and later, Amazon ES takes hourly automated snapshots, making this setting irrelevant. For domains running earlier versions of Elasticsearch, Amazon ES takes daily automated snapshots.
+* `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `vpcOptions` - (Optional) Configuration block for VPC related options. Adding or removing this configuration forces a new resource ([documentation](https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-vpc.html#es-vpc-limitations)). Detailed below.
+
+### advanced_security_options
+
+* `enabled` - (Required, Forces new resource) Whether advanced security is enabled.
+* `internalUserDatabaseEnabled` - (Optional, Default: false) Whether the internal user database is enabled. If not set, defaults to `false` by the AWS API.
+* `masterUserOptions` - (Optional) Configuration block for the main user. Detailed below.
+
+#### master_user_options
+
+* `masterUserArn` - (Optional) ARN for the main user. Only specify if `internalUserDatabaseEnabled` is not set or set to `false`.
+* `masterUserName` - (Optional) Main user's username, which is stored in the Amazon Elasticsearch Service domain's internal database. Only specify if `internalUserDatabaseEnabled` is set to `true`.
+* `masterUserPassword` - (Optional) Main user's password, which is stored in the Amazon Elasticsearch Service domain's internal database. Only specify if `internalUserDatabaseEnabled` is set to `true`.
+
+### auto_tune_options
+
+* `desiredState` - (Required) The Auto-Tune desired state for the domain. Valid values: `enabled` or `disabled`.
+* `maintenanceSchedule` - (Required if `rollbackOnDisable` is set to `defaultRollback`) Configuration block for Auto-Tune maintenance windows. Can be specified multiple times for each maintenance window. Detailed below.
+* `rollbackOnDisable` - (Optional) Whether to roll back to default Auto-Tune settings when disabling Auto-Tune. Valid values: `defaultRollback` or `noRollback`.
+
+#### maintenance_schedule
+
+* `startAt` - (Required) Date and time at which to start the Auto-Tune maintenance schedule in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8).
+* `duration` - (Required) Configuration block for the duration of the Auto-Tune maintenance window. Detailed below.
+* `cronExpressionForRecurrence` - (Required) A cron expression specifying the recurrence pattern for an Auto-Tune maintenance schedule.
+
+##### duration
+
+* `value` - (Required) An integer specifying the value of the duration of an Auto-Tune maintenance window.
+* `unit` - (Required) The unit of time specifying the duration of an Auto-Tune maintenance window. Valid values: `hours`.
+
+### cluster_config
+
+* `coldStorageOptions` - (Optional) Configuration block containing cold storage configuration. Detailed below.
+* `dedicatedMasterCount` - (Optional) Number of dedicated main nodes in the cluster.
+* `dedicatedMasterEnabled` - (Optional) Whether dedicated main nodes are enabled for the cluster.
+* `dedicatedMasterType` - (Optional) Instance type of the dedicated main nodes in the cluster.
+* `instanceCount` - (Optional) Number of instances in the cluster.
+* `instanceType` - (Optional) Instance type of data nodes in the cluster.
+* `warmCount` - (Optional) Number of warm nodes in the cluster. Valid values are between `2` and `150`. `warmCount` can be only and must be set when `warmEnabled` is set to `true`.
+* `warmEnabled` - (Optional) Whether to enable warm storage.
+* `warmType` - (Optional) Instance type for the Elasticsearch cluster's warm nodes. Valid values are `ultrawarm1MediumElasticsearch`, `ultrawarm1LargeElasticsearch` and `ultrawarm1XlargeElasticsearch`. `warmType` can be only and must be set when `warmEnabled` is set to `true`.
+* `zoneAwarenessConfig` - (Optional) Configuration block containing zone awareness settings. Detailed below.
+* `zoneAwarenessEnabled` - (Optional) Whether zone awareness is enabled, set to `true` for multi-az deployment. To enable awareness with three Availability Zones, the `availabilityZoneCount` within the `zoneAwarenessConfig` must be set to `3`.
+
+#### cold_storage_options
+
+* `enabled` - (Optional) Boolean to enable cold storage for an Elasticsearch domain. Defaults to `false`. Master and ultrawarm nodes must be enabled for cold storage.
+
+#### zone_awareness_config
+
+* `availabilityZoneCount` - (Optional) Number of Availability Zones for the domain to use with `zoneAwarenessEnabled`. Defaults to `2`. Valid values: `2` or `3`.
+
+### cognito_options
+
+AWS documentation: [Amazon Cognito Authentication for Kibana](https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-cognito-auth.html)
+
+* `enabled` - (Optional, Default: false) Whether Amazon Cognito authentication with Kibana is enabled or not.
+* `identityPoolId` - (Required) ID of the Cognito Identity Pool to use.
+* `roleArn` - (Required) ARN of the IAM role that has the AmazonESCognitoAccess policy attached.
+* `userPoolId` - (Required) ID of the Cognito User Pool to use.
+
+### domain_endpoint_options
+
+* `customEndpointCertificateArn` - (Optional) ACM certificate ARN for your custom endpoint.
+* `customEndpointEnabled` - (Optional) Whether to enable custom endpoint for the Elasticsearch domain.
+* `customEndpoint` - (Optional) Fully qualified domain for your custom endpoint.
+* `enforceHttps` - (Optional) Whether or not to require HTTPS. Defaults to `true`.
+* `tlsSecurityPolicy` - (Optional) Name of the TLS security policy that needs to be applied to the HTTPS endpoint. Valid values:  `policyMinTls10201907` and `policyMinTls12201907`. Terraform will only perform drift detection if a configuration value is provided.
+
+### ebs_options
+
+* `ebsEnabled` - (Required) Whether EBS volumes are attached to data nodes in the domain.
+* `iops` - (Optional) Baseline input/output (I/O) performance of EBS volumes attached to data nodes. Applicable only for the GP3 and Provisioned IOPS EBS volume types.
+* `throughput` - (Required if `volumeType` is set to `gp3`) Specifies the throughput (in MiB/s) of the EBS volumes attached to data nodes. Applicable only for the gp3 volume type.
+* `volumeSize` - (Required if `ebsEnabled` is set to `true`.) Size of EBS volumes attached to data nodes (in GiB).
+* `volumeType` - (Optional) Type of EBS volumes attached to data nodes.
+
+### encrypt_at_rest
+
+~> **Note:** You can enable `encryptAtRest` _in place_ for an existing, unencrypted domain only if your Elasticsearch version is 6.7 or greater. For lower versions, if you enable `encryptAtRest`, Terraform with recreate the domain, potentially causing data loss. For any version, if you disable `encryptAtRest` for an existing, encrypted domain, Terraform will recreate the domain, potentially causing data loss. If you change the `kmsKeyId`, Terraform will also recreate the domain, potentially causing data loss.
+
+* `enabled` - (Required) Whether to enable encryption at rest. If the `encryptAtRest` block is not provided then this defaults to `false`. Enabling encryption on new domains requires `elasticsearchVersion` 5.1 or greater.
+* `kmsKeyId` - (Optional) KMS key ARN to encrypt the Elasticsearch domain with. If not specified then it defaults to using the `aws/es` service KMS key. Note that KMS will accept a KMS key ID but will return the key ARN. To prevent Terraform detecting unwanted changes, use the key ARN instead.
+
+### log_publishing_options
+
+* `cloudwatchLogGroupArn` - (Required) ARN of the Cloudwatch log group to which log needs to be published.
+* `enabled` - (Optional, Default: true) Whether given log publishing option is enabled or not.
+* `logType` - (Required) Type of Elasticsearch log. Valid values: `indexSlowLogs`, `searchSlowLogs`, `esApplicationLogs`, `auditLogs`.
+
+### node_to_node_encryption
+
+~> **Note:** You can enable `nodeToNodeEncryption` _in place_ for an existing, unencrypted domain only if your Elasticsearch version is 6.7 or greater. For lower versions, if you enable `nodeToNodeEncryption`, Terraform will recreate the domain, potentially causing data loss. For any version, if you disable `nodeToNodeEncryption` for an existing, node-to-node encrypted domain, Terraform will recreate the domain, potentially causing data loss.
+
+* `enabled` - (Required) Whether to enable node-to-node encryption. If the `nodeToNodeEncryption` block is not provided then this defaults to `false`. Enabling node-to-node encryption of a new domain requires an `elasticsearchVersion` of `60` or greater.
+
+### snapshot_options
+
+* `automatedSnapshotStartHour` - (Required) Hour during which the service takes an automated daily snapshot of the indices in the domain.
+
+### vpc_options
+
+AWS documentation: [VPC Support for Amazon Elasticsearch Service Domains](https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-vpc.html)
+
+~> **Note:** You must have created the service linked role for the Elasticsearch service to use `vpcOptions`. If you need to create the service linked role at the same time as the Elasticsearch domain then you must use `dependsOn` to make sure that the role is created before the Elasticsearch domain. See the [VPC based ES domain example](#vpc-based-es) above.
+
+-> Security Groups and Subnets referenced in these attributes must all be within the same VPC. This determines what VPC the endpoints are created in.
+
+* `securityGroupIds` - (Optional) List of VPC Security Group IDs to be applied to the Elasticsearch domain endpoints. If omitted, the default Security Group for the VPC will be used.
+* `subnetIds` - (Required) List of VPC Subnet IDs for the Elasticsearch domain endpoints to be created in.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the domain.
+* `domainId` - Unique identifier for the domain.
+* `domainName` - Name of the Elasticsearch domain.
+* `endpoint` - Domain-specific endpoint used to submit index, search, and data upload requests.
+* `kibanaEndpoint` - Domain-specific endpoint for kibana without https scheme.
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `vpcOptions0AvailabilityZones` - If the domain was created inside a VPC, the names of the availability zones the configured `subnetIds` were created inside.
+* `vpcOptions0VpcId` - If the domain was created inside a VPC, the ID of the VPC.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `60M`)
+* `update` - (Default `60M`)
+* `delete` - (Default `90M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Elasticsearch domains using the `domainName`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Elasticsearch domains using the `domainName`. For example:
+
+```console
+% terraform import aws_elasticsearch_domain.example domain_name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-2ba3b0b9b5de9cf5e4bfb0c3d93db7aa5852b5b15d23694c08cdf16cdf8481e6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/elasticsearch_domain_policy.html.markdown b/website/docs/cdktf/typescript/r/elasticsearch_domain_policy.html.markdown
new file mode 100644
index 00000000000..5d5b2c336d4
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/elasticsearch_domain_policy.html.markdown
@@ -0,0 +1,57 @@
+---
+subcategory: "Elasticsearch"
+layout: "aws"
+page_title: "AWS: aws_elasticsearch_domain_policy"
+description: |-
+  Provides an Elasticsearch Domain Policy.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_elasticsearch_domain_policy
+
+Allows setting policy to an Elasticsearch domain while referencing domain attributes (e.g., ARN)
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ElasticsearchDomain } from "./.gen/providers/aws/elasticsearch-domain";
+import { ElasticsearchDomainPolicy } from "./.gen/providers/aws/elasticsearch-domain-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new ElasticsearchDomain(this, "example", {
+      domainName: "tf-test",
+      elasticsearchVersion: "2.3",
+    });
+    new ElasticsearchDomainPolicy(this, "main", {
+      accessPolicies:
+        '{\n    "Version": "2012-10-17",\n    "Statement": [\n        {\n            "Action": "es:*",\n            "Principal": "*",\n            "Effect": "Allow",\n            "Condition": {\n                "IpAddress": {"aws:SourceIp": "127.0.0.1/32"}\n            },\n            "Resource": "${' +
+        example.arn +
+        '}/*"\n        }\n    ]\n}\n\n',
+      domainName: example.domainName,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `domainName` - (Required) Name of the domain.
+* `accessPolicies` - (Optional) IAM policy document specifying the access policies for the domain
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+<!-- cache-key: cdktf-0.18.0 input-74932bbb0d0c5abd0e5dc3aa9416bb7bfcf5a404e91d4a90ec6ae56e5f33bb53 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/elasticsearch_domain_saml_options.html.markdown b/website/docs/cdktf/typescript/r/elasticsearch_domain_saml_options.html.markdown
new file mode 100644
index 00000000000..2694f895d46
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/elasticsearch_domain_saml_options.html.markdown
@@ -0,0 +1,116 @@
+---
+subcategory: "Elasticsearch"
+layout: "aws"
+page_title: "AWS: aws_elasticsearch_domain_saml_options"
+description: |-
+  Terraform resource for managing SAML authentication options for an AWS Elasticsearch Domain.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_elasticsearch_domain_saml_options
+
+Manages SAML authentication options for an AWS Elasticsearch Domain.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ElasticsearchDomain } from "./.gen/providers/aws/elasticsearch-domain";
+import { ElasticsearchDomainSamlOptions } from "./.gen/providers/aws/elasticsearch-domain-saml-options";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new ElasticsearchDomain(this, "example", {
+      clusterConfig: {
+        instanceType: "r4.large.elasticsearch",
+      },
+      domainName: "example",
+      elasticsearchVersion: "1.5",
+      snapshotOptions: {
+        automatedSnapshotStartHour: 23,
+      },
+      tags: {
+        Domain: "TestDomain",
+      },
+    });
+    const awsElasticsearchDomainSamlOptionsExample =
+      new ElasticsearchDomainSamlOptions(this, "example_1", {
+        domainName: example.domainName,
+        samlOptions: {
+          enabled: true,
+          idp: {
+            entityId: "https://example.com",
+            metadataContent: Token.asString(Fn.file("./saml-metadata.xml")),
+          },
+        },
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsElasticsearchDomainSamlOptionsExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `domainName` - (Required) Name of the domain.
+
+The following arguments are optional:
+
+* `samlOptions` - (Optional) The SAML authentication options for an AWS Elasticsearch Domain.
+
+### saml_options
+
+* `enabled` - (Required) Whether SAML authentication is enabled.
+* `idp` - (Optional) Information from your identity provider.
+* `masterBackendRole` - (Optional) This backend role from the SAML IdP receives full permissions to the cluster, equivalent to a new master user.
+* `masterUserName` - (Optional) This username from the SAML IdP receives full permissions to the cluster, equivalent to a new master user.
+* `rolesKey` - (Optional) Element of the SAML assertion to use for backend roles. Default is roles.
+* `sessionTimeoutMinutes` - (Optional) Duration of a session in minutes after a user logs in. Default is 60. Maximum value is 1,440.
+* `subjectKey` - (Optional) Custom SAML attribute to use for user names. Default is an empty string - `""`. This will cause Elasticsearch to use the `nameId` element of the `subject`, which is the default location for name identifiers in the SAML specification.
+
+#### idp
+
+* `entityId` - (Required) The unique Entity ID of the application in SAML Identity Provider.
+* `metadataContent` - (Required) The Metadata of the SAML application in xml format.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name of the domain the SAML options are associated with.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Elasticsearch domains using the `domainName`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Elasticsearch domains using the `domainName`. For example:
+
+```console
+% terraform import aws_elasticsearch_domain_saml_options.example domain_name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-65d51b7512d651dc02ab5c3e4dec870cf5f9710ffdd2fa0237566b35396e143c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/elasticsearch_vpc_endpoint.html.markdown b/website/docs/cdktf/typescript/r/elasticsearch_vpc_endpoint.html.markdown
new file mode 100644
index 00000000000..f0177cb765b
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/elasticsearch_vpc_endpoint.html.markdown
@@ -0,0 +1,95 @@
+---
+subcategory: "Elasticsearch"
+layout: "aws"
+page_title: "AWS: aws_elasticsearch_vpc_endpoint"
+description: |-
+  Terraform resource for managing an AWS elasticsearch VPC Endpoint.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_elasticsearch_vpc_endpoint
+
+Manages an [AWS Elasticsearch VPC Endpoint](https://docs.aws.amazon.com/elasticsearch-service/latest/APIReference/API_CreateVpcEndpoint.html). Creates an Amazon elasticsearch Service-managed VPC endpoint.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ElasticsearchVpcEndpoint } from "./.gen/providers/aws/elasticsearch-vpc-endpoint";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ElasticsearchVpcEndpoint(this, "foo", {
+      domainArn: domain1.arn,
+      vpcOptions: {
+        securityGroupIds: [test.id, test2.id],
+        subnetIds: [
+          Token.asString(awsSubnetTest.id),
+          Token.asString(awsSubnetTest2.id),
+        ],
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `domainArn` - (Required, Forces new resource) Specifies the Amazon Resource Name (ARN) of the domain to create the endpoint for
+* `vpcOptions` - (Required) Options to specify the subnets and security groups for the endpoint.
+
+### vpc_options
+
+* `securityGroupIds` - (Optional) The list of security group IDs associated with the VPC endpoints for the domain. If you do not provide a security group ID, elasticsearch Service uses the default security group for the VPC.
+* `subnetIds` - (Required) A list of subnet IDs associated with the VPC endpoints for the domain. If your domain uses multiple Availability Zones, you need to provide two subnet IDs, one per zone. Otherwise, provide only one.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The unique identifier of the endpoint.
+* `endpoint` - The connection endpoint ID for connecting to the domain.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `60M`)
+* `update` - (Default `60M`)
+* `delete` - (Default `90M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import elasticsearch VPC endpoint connections using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import elasticsearch VPC endpoint connections using the `id`. For example:
+
+```console
+% terraform import aws_elasticsearch_vpc_endpoint_connection.example endpoint-id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-2068c0865c6751dbf0530210c6d3a7ca46d1c366f24a062e8d2eb949a01e616a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/elastictranscoder_pipeline.html.markdown b/website/docs/cdktf/typescript/r/elastictranscoder_pipeline.html.markdown
new file mode 100644
index 00000000000..62af9d1e4de
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/elastictranscoder_pipeline.html.markdown
@@ -0,0 +1,139 @@
+---
+subcategory: "Elastic Transcoder"
+layout: "aws"
+page_title: "AWS: aws_elastictranscoder_pipeline"
+description: |-
+  Provides an Elastic Transcoder pipeline resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_elastictranscoder_pipeline
+
+Provides an Elastic Transcoder pipeline resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ElastictranscoderPipeline } from "./.gen/providers/aws/elastictranscoder-pipeline";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ElastictranscoderPipeline(this, "bar", {
+      contentConfig: {
+        bucket: contentBucket.id,
+        storageClass: "Standard",
+      },
+      inputBucket: inputBucket.id,
+      name: "aws_elastictranscoder_pipeline_tf_test_",
+      role: testRole.arn,
+      thumbnailConfig: {
+        bucket: thumbBucket.id,
+        storageClass: "Standard",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+See ["Create Pipeline"](http://docs.aws.amazon.com/elastictranscoder/latest/developerguide/create-pipeline.html) in the AWS docs for reference.
+
+This argument supports the following arguments:
+
+* `awsKmsKeyArn` - (Optional) The AWS Key Management Service (AWS KMS) key that you want to use with this pipeline.
+* `contentConfig` - (Optional) The ContentConfig object specifies information about the Amazon S3 bucket in which you want Elastic Transcoder to save transcoded files and playlists. (documented below)
+* `contentConfigPermissions` - (Optional) The permissions for the `contentConfig` object. (documented below)
+* `inputBucket` - (Required) The Amazon S3 bucket in which you saved the media files that you want to transcode and the graphics that you want to use as watermarks.
+* `name` - (Optional, Forces new resource) The name of the pipeline. Maximum 40 characters
+* `notifications` - (Optional) The Amazon Simple Notification Service (Amazon SNS) topic that you want to notify to report job status. (documented below)
+* `outputBucket` - (Optional) The Amazon S3 bucket in which you want Elastic Transcoder to save the transcoded files.
+* `role` - (Required) The IAM Amazon Resource Name (ARN) for the role that you want Elastic Transcoder to use to transcode jobs for this pipeline.
+* `thumbnailConfig` - (Optional) The ThumbnailConfig object specifies information about the Amazon S3 bucket in which you want Elastic Transcoder to save thumbnail files. (documented below)
+* `thumbnailConfigPermissions` - (Optional) The permissions for the `thumbnailConfig` object. (documented below)
+
+The `contentConfig` object specifies information about the Amazon S3 bucket in
+which you want Elastic Transcoder to save transcoded files and playlists: which
+bucket to use, and the storage class that you want to assign to the files. If
+you specify values for `contentConfig`, you must also specify values for
+`thumbnailConfig`. If you specify values for `contentConfig` and
+`thumbnailConfig`, omit the `outputBucket` object.
+
+The `contentConfig` object supports the following:
+
+* `bucket` - The Amazon S3 bucket in which you want Elastic Transcoder to save transcoded files and playlists.
+* `storageClass` - The Amazon S3 storage class, `standard` or `reducedRedundancy`, that you want Elastic Transcoder to assign to the files and playlists that it stores in your Amazon S3 bucket.
+
+The `contentConfigPermissions` object supports the following:
+
+* `access` - The permission that you want to give to the AWS user that you specified in `contentConfigPermissionsGrantee`. Valid values are `read`, `readAcp`, `writeAcp` or `fullControl`.
+* `grantee` - The AWS user or group that you want to have access to transcoded files and playlists.
+* `granteeType` - Specify the type of value that appears in the `contentConfigPermissionsGrantee` object. Valid values are `canonical`, `email` or `group`.
+
+The `notifications` object supports the following:
+
+* `completed` - The topic ARN for the Amazon SNS topic that you want to notify when Elastic Transcoder has finished processing a job in this pipeline.
+* `error` - The topic ARN for the Amazon SNS topic that you want to notify when Elastic Transcoder encounters an error condition while processing a job in this pipeline.
+* `progressing` - The topic ARN for the Amazon Simple Notification Service (Amazon SNS) topic that you want to notify when Elastic Transcoder has started to process a job in this pipeline.
+* `warning` - The topic ARN for the Amazon SNS topic that you want to notify when Elastic Transcoder encounters a warning condition while processing a job in this pipeline.
+
+The `thumbnailConfig` object specifies information about the Amazon S3 bucket in
+which you want Elastic Transcoder to save thumbnail files: which bucket to use,
+which users you want to have access to the files, the type of access you want
+users to have, and the storage class that you want to assign to the files. If
+you specify values for `contentConfig`, you must also specify values for
+`thumbnailConfig` even if you don't want to create thumbnails. (You control
+whether to create thumbnails when you create a job. For more information, see
+ThumbnailPattern in the topic Create Job.) If you specify values for
+`contentConfig` and `thumbnailConfig`, omit the OutputBucket object.
+
+The `thumbnailConfig` object supports the following:
+
+* `bucket` - The Amazon S3 bucket in which you want Elastic Transcoder to save thumbnail files.
+* `storageClass` - The Amazon S3 storage class, Standard or ReducedRedundancy, that you want Elastic Transcoder to assign to the thumbnails that it stores in your Amazon S3 bucket.
+
+The `thumbnailConfigPermissions` object supports the following:
+
+* `access` - The permission that you want to give to the AWS user that you specified in `thumbnailConfigPermissionsGrantee`. Valid values are `read`, `readAcp`, `writeAcp` or `fullControl`.
+* `grantee` - The AWS user or group that you want to have access to thumbnail files.
+* `granteeType` - Specify the type of value that appears in the `thumbnailConfigPermissionsGrantee` object. Valid values are `canonical`, `email` or `group`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the Elastictranscoder pipeline.
+* `arn` - The ARN of the Elastictranscoder pipeline.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Elastic Transcoder pipelines using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Elastic Transcoder pipelines using the `id`. For example:
+
+```console
+% terraform import aws_elastictranscoder_pipeline.basic_pipeline 1407981661351-cttk8b
+```
+
+<!-- cache-key: cdktf-0.18.0 input-6b409c28f1ed17363c636a956212b4fffbbcf9da888917717aff32273f1430a2 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/elastictranscoder_preset.html.markdown b/website/docs/cdktf/typescript/r/elastictranscoder_preset.html.markdown
new file mode 100644
index 00000000000..3e32623c72a
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/elastictranscoder_preset.html.markdown
@@ -0,0 +1,202 @@
+---
+subcategory: "Elastic Transcoder"
+layout: "aws"
+page_title: "AWS: aws_elastictranscoder_preset"
+description: |-
+  Provides an Elastic Transcoder preset resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_elastictranscoder_preset
+
+Provides an Elastic Transcoder preset resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ElastictranscoderPreset } from "./.gen/providers/aws/elastictranscoder-preset";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ElastictranscoderPreset(this, "bar", {
+      audio: {
+        audioPackingMode: "SingleTrack",
+        bitRate: Token.asString(96),
+        channels: Token.asString(2),
+        codec: "AAC",
+        sampleRate: Token.asString(44100),
+      },
+      audioCodecOptions: {
+        profile: "AAC-LC",
+      },
+      container: "mp4",
+      description: "Sample Preset",
+      name: "sample_preset",
+      thumbnails: {
+        format: "png",
+        interval: Token.asString(120),
+        maxHeight: "auto",
+        maxWidth: "auto",
+        paddingPolicy: "Pad",
+        sizingPolicy: "Fit",
+      },
+      video: {
+        bitRate: "1600",
+        codec: "H.264",
+        displayAspectRatio: "16:9",
+        fixedGop: "false",
+        frameRate: "auto",
+        keyframesMaxDist: Token.asString(240),
+        maxFrameRate: "60",
+        maxHeight: "auto",
+        maxWidth: "auto",
+        paddingPolicy: "Pad",
+        sizingPolicy: "Fit",
+      },
+      videoCodecOptions: {
+        ColorSpaceConversionMode: "None",
+        InterlacedMode: "Progressive",
+        Level: "2.2",
+        MaxReferenceFrames: Token.asString(3),
+        Profile: "main",
+      },
+      videoWatermarks: [
+        {
+          horizontalAlign: "Right",
+          horizontalOffset: "10px",
+          id: "Terraform Test",
+          maxHeight: "20%",
+          maxWidth: "20%",
+          opacity: "55.5",
+          sizingPolicy: "ShrinkToFit",
+          target: "Content",
+          verticalAlign: "Bottom",
+          verticalOffset: "10px",
+        },
+      ],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+See ["Create Preset"](http://docs.aws.amazon.com/elastictranscoder/latest/developerguide/create-preset.html) in the AWS docs for reference.
+
+This argument supports the following arguments:
+
+* `audio` - (Optional, Forces new resource) Audio parameters object (documented below).
+* `audioCodecOptions` - (Optional, Forces new resource) Codec options for the audio parameters (documented below)
+* `container` - (Required, Forces new resource) The container type for the output file. Valid values are `flac`, `flv`, `fmp4`, `gif`, `mp3`, `mp4`, `mpg`, `mxf`, `oga`, `ogg`, `ts`, and `webm`.
+* `description` - (Optional, Forces new resource) A description of the preset (maximum 255 characters)
+* `name` - (Optional, Forces new resource) The name of the preset. (maximum 40 characters)
+* `thumbnails` - (Optional, Forces new resource) Thumbnail parameters object (documented below)
+* `video` - (Optional, Forces new resource) Video parameters object (documented below)
+* `videoWatermarks` - (Optional, Forces new resource) Watermark parameters for the video parameters (documented below)
+* `videoCodecOptions` (Optional, Forces new resource) Codec options for the video parameters
+
+The `audio` object supports the following:
+
+* `audioPackingMode` - The method of organizing audio channels and tracks. Use Audio:Channels to specify the number of channels in your output, and Audio:AudioPackingMode to specify the number of tracks and their relation to the channels. If you do not specify an Audio:AudioPackingMode, Elastic Transcoder uses SingleTrack.
+* `bitRate` - The bit rate of the audio stream in the output file, in kilobits/second. Enter an integer between 64 and 320, inclusive.
+* `channels` - The number of audio channels in the output file
+* `codec` - The audio codec for the output file. Valid values are `aac`, `flac`, `mp2`, `mp3`, `pcm`, and `vorbis`.
+* `sampleRate` - The sample rate of the audio stream in the output file, in hertz. Valid values are: `auto`, `22050`, `32000`, `44100`, `48000`, `96000`
+
+The `audioCodecOptions` object supports the following:
+
+* `bitDepth` - The bit depth of a sample is how many bits of information are included in the audio samples. Valid values are `16` and `24`. (FLAC/PCM Only)
+* `bitOrder` - The order the bits of a PCM sample are stored in. The supported value is LittleEndian. (PCM Only)
+* `profile` - If you specified AAC for Audio:Codec, choose the AAC profile for the output file.
+* `signed` - Whether audio samples are represented with negative and positive numbers (signed) or only positive numbers (unsigned). The supported value is Signed. (PCM Only)
+
+The `thumbnails` object supports the following:
+
+* `aspectRatio` - The aspect ratio of thumbnails. The following values are valid: auto, 1:1, 4:3, 3:2, 16:9
+* `format` - The format of thumbnails, if any. Valid formats are jpg and png.
+* `interval` - The approximate number of seconds between thumbnails. The value must be an integer. The actual interval can vary by several seconds from one thumbnail to the next.
+* `maxHeight` - The maximum height of thumbnails, in pixels. If you specify auto, Elastic Transcoder uses 1080 (Full HD) as the default value. If you specify a numeric value, enter an even integer between 32 and 3072, inclusive.
+* `maxWidth` - The maximum width of thumbnails, in pixels. If you specify auto, Elastic Transcoder uses 1920 (Full HD) as the default value. If you specify a numeric value, enter an even integer between 32 and 4096, inclusive.
+* `paddingPolicy` - When you set PaddingPolicy to Pad, Elastic Transcoder might add black bars to the top and bottom and/or left and right sides of thumbnails to make the total size of the thumbnails match the values that you specified for thumbnail MaxWidth and MaxHeight settings.
+* `resolution` - The width and height of thumbnail files in pixels, in the format WidthxHeight, where both values are even integers. The values cannot exceed the width and height that you specified in the Video:Resolution object. (To better control resolution and aspect ratio of thumbnails, we recommend that you use the thumbnail values `maxWidth`, `maxHeight`, `sizingPolicy`, and `paddingPolicy` instead of `resolution` and `aspectRatio`. The two groups of settings are mutually exclusive. Do not use them together)
+* `sizingPolicy` - A value that controls scaling of thumbnails. Valid values are: `fit`, `fill`, `stretch`, `keep`, `shrinkToFit`, and `shrinkToFill`.
+
+The `video` object supports the following:
+
+* `aspectRatio` - The display aspect ratio of the video in the output file. Valid values are: `auto`, `1:1`, `4:3`, `3:2`, `16:9`. (Note; to better control resolution and aspect ratio of output videos, we recommend that you use the values `maxWidth`, `maxHeight`, `sizingPolicy`, `paddingPolicy`, and `displayAspectRatio` instead of `resolution` and `aspectRatio`.)
+* `bitRate` - The bit rate of the video stream in the output file, in kilobits/second. You can configure variable bit rate or constant bit rate encoding.
+* `codec` - The video codec for the output file. Valid values are `gif`, `h264`, `mpeg2`, `vp8`, and `vp9`.
+* `displayAspectRatio` - The value that Elastic Transcoder adds to the metadata in the output file. If you set DisplayAspectRatio to auto, Elastic Transcoder chooses an aspect ratio that ensures square pixels. If you specify another option, Elastic Transcoder sets that value in the output file.
+* `fixedGop` - Whether to use a fixed value for Video:FixedGOP. Not applicable for containers of type gif. Valid values are true and false. Also known as, Fixed Number of Frames Between Keyframes.
+* `frameRate` - The frames per second for the video stream in the output file. The following values are valid: `auto`, `10`, `15`, `2397`, `24`, `25`, `2997`, `30`, `50`, `60`.
+* `keyframesMaxDist` - The maximum number of frames between key frames. Not applicable for containers of type gif.
+* `maxFrameRate` - If you specify auto for FrameRate, Elastic Transcoder uses the frame rate of the input video for the frame rate of the output video, up to the maximum frame rate. If you do not specify a MaxFrameRate, Elastic Transcoder will use a default of 30.
+* `maxHeight` - The maximum height of the output video in pixels. If you specify auto, Elastic Transcoder uses 1080 (Full HD) as the default value. If you specify a numeric value, enter an even integer between 96 and 3072, inclusive.
+* `maxWidth` - The maximum width of the output video in pixels. If you specify auto, Elastic Transcoder uses 1920 (Full HD) as the default value. If you specify a numeric value, enter an even integer between 128 and 4096, inclusive.
+* `paddingPolicy` - When you set PaddingPolicy to Pad, Elastic Transcoder might add black bars to the top and bottom and/or left and right sides of the output video to make the total size of the output video match the values that you specified for `maxWidth` and `maxHeight`.
+* `resolution` - The width and height of the video in the output file, in pixels. Valid values are `auto` and `widthxheight`. (see note for `aspectRatio`)
+* `sizingPolicy` - A value that controls scaling of the output video. Valid values are: `fit`, `fill`, `stretch`, `keep`, `shrinkToFit`, `shrinkToFill`.
+
+The `videoWatermarks` object supports the following:
+
+* `horizontalAlign` - The horizontal position of the watermark unless you specify a nonzero value for `horzontalOffset`.
+* `horizontalOffset` - The amount by which you want the horizontal position of the watermark to be offset from the position specified by `horizontalAlign`.
+* `id` - A unique identifier for the settings for one watermark. The value of Id can be up to 40 characters long. You can specify settings for up to four watermarks.
+* `maxHeight` - The maximum height of the watermark.
+* `maxWidth` - The maximum width of the watermark.
+* `opacity` - A percentage that indicates how much you want a watermark to obscure the video in the location where it appears.
+* `sizingPolicy` - A value that controls scaling of the watermark. Valid values are: `fit`, `stretch`, `shrinkToFit`
+* `target` - A value that determines how Elastic Transcoder interprets values that you specified for `videoWatermarksHorizontalOffset`, `videoWatermarksVerticalOffset`, `videoWatermarksMaxWidth`, and `videoWatermarksMaxHeight`. Valid values are `content` and `frame`.
+* `verticalAlign` - The vertical position of the watermark unless you specify a nonzero value for `verticalAlign`. Valid values are `top`, `bottom`, `center`.
+* `verticalOffset` - The amount by which you want the vertical position of the watermark to be offset from the position specified by `verticalAlign`
+
+The `videoCodecOptions` map supports the following:
+
+* `profile` - The codec profile that you want to use for the output file. (H.264/VP8 Only)
+* `level` - The H.264 level that you want to use for the output file. Elastic Transcoder supports the following levels: `1`, `1B`, `11`, `12`, `13`, `2`, `21`, `22`, `3`, `31`, `32`, `4`, `41` (H.264 only)
+* `maxReferenceFrames` - The maximum number of previously decoded frames to use as a reference for decoding future frames. Valid values are integers 0 through 16. (H.264 only)
+* `maxBitRate` - The maximum number of kilobits per second in the output video. Specify a value between 16 and 62,500 inclusive, or `auto`. (Optional, H.264/MPEG2/VP8/VP9 only)
+* `bufferSize` - The maximum number of kilobits in any x seconds of the output video. This window is commonly 10 seconds, the standard segment duration when you're using ts for the container type of the output video. Specify an integer greater than 0. If you specify MaxBitRate and omit BufferSize, Elastic Transcoder sets BufferSize to 10 times the value of MaxBitRate. (Optional, H.264/MPEG2/VP8/VP9 only)
+* `interlacedMode` -  The interlace mode for the output video. (Optional, H.264/MPEG2 Only)
+* `colorSpaceConversion` - The color space conversion Elastic Transcoder applies to the output video. Valid values are `none`, `bt709ToBt601`, `bt601ToBt709`, and `auto`. (Optional, H.264/MPEG2 Only)
+* `chromaSubsampling` - The sampling pattern for the chroma (color) channels of the output video. Valid values are `yuv420P` and `yuv422P`.
+* `loopCount` - The number of times you want the output gif to loop (Gif only)
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the Elastic Transcoder Preset.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Elastic Transcoder presets using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Elastic Transcoder presets using the `id`. For example:
+
+```console
+% terraform import aws_elastictranscoder_preset.basic_preset 1407981661351-cttk8b
+```
+
+<!-- cache-key: cdktf-0.18.0 input-8282c40b65cf6c7bab35ac986097ade68a35de7fee2c7e606836eefd3ed414ca -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/elb.html.markdown b/website/docs/cdktf/typescript/r/elb.html.markdown
new file mode 100644
index 00000000000..e577ee84d96
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/elb.html.markdown
@@ -0,0 +1,186 @@
+---
+subcategory: "ELB Classic"
+layout: "aws"
+page_title: "AWS: aws_elb"
+description: |-
+  Provides an Elastic Load Balancer resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_elb
+
+Provides an Elastic Load Balancer resource, also known as a "Classic
+Load Balancer" after the release of
+[Application/Network Load Balancers](/docs/providers/aws/r/lb.html).
+
+~> **NOTE on ELB Instances and ELB Attachments:** Terraform currently
+provides both a standalone [ELB Attachment resource](elb_attachment.html)
+(describing an instance attached to an ELB), and an ELB resource with
+`instances` defined in-line. At this time you cannot use an ELB with in-line
+instances in conjunction with a ELB Attachment resources. Doing so will cause a
+conflict and will overwrite attachments.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Elb } from "./.gen/providers/aws/elb";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Elb(this, "bar", {
+      accessLogs: {
+        bucket: "foo",
+        bucketPrefix: "bar",
+        interval: 60,
+      },
+      availabilityZones: ["us-west-2a", "us-west-2b", "us-west-2c"],
+      connectionDraining: true,
+      connectionDrainingTimeout: 400,
+      crossZoneLoadBalancing: true,
+      healthCheck: {
+        healthyThreshold: 2,
+        interval: 30,
+        target: "HTTP:8000/",
+        timeout: 3,
+        unhealthyThreshold: 2,
+      },
+      idleTimeout: 400,
+      instances: [foo.id],
+      listener: [
+        {
+          instancePort: 8000,
+          instanceProtocol: "http",
+          lbPort: 80,
+          lbProtocol: "http",
+        },
+        {
+          instancePort: 8000,
+          instanceProtocol: "http",
+          lbPort: 443,
+          lbProtocol: "https",
+          sslCertificateId:
+            "arn:aws:iam::123456789012:server-certificate/certName",
+        },
+      ],
+      name: "foobar-terraform-elb",
+      tags: {
+        Name: "foobar-terraform-elb",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Optional) The name of the ELB. By default generated by Terraform.
+* `namePrefix` - (Optional, Forces new resource) Creates a unique name beginning with the specified
+  prefix. Conflicts with `name`.
+* `accessLogs` - (Optional) An Access Logs block. Access Logs documented below.
+* `availabilityZones` - (Required for an EC2-classic ELB) The AZ's to serve traffic in.
+* `securityGroups` - (Optional) A list of security group IDs to assign to the ELB.
+  Only valid if creating an ELB within a VPC
+* `subnets` - (Required for a VPC ELB) A list of subnet IDs to attach to the ELB. When an update to subnets will remove all current subnets, this will force a new resource.
+* `instances` - (Optional) A list of instance ids to place in the ELB pool.
+* `internal` - (Optional) If true, ELB will be an internal ELB.
+* `listener` - (Required) A list of listener blocks. Listeners documented below.
+* `healthCheck` - (Optional) A health_check block. Health Check documented below.
+* `crossZoneLoadBalancing` - (Optional) Enable cross-zone load balancing. Default: `true`
+* `idleTimeout` - (Optional) The time in seconds that the connection is allowed to be idle. Default: `60`
+* `connectionDraining` - (Optional) Boolean to enable connection draining. Default: `false`
+* `connectionDrainingTimeout` - (Optional) The time in seconds to allow for connections to drain. Default: `300`
+* `desyncMitigationMode` - (Optional) Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+Exactly one of `availabilityZones` or `subnets` must be specified: this
+determines if the ELB exists in a VPC or in EC2-classic.
+
+Access Logs (`accessLogs`) support the following:
+
+* `bucket` - (Required) The S3 bucket name to store the logs in.
+* `bucketPrefix` - (Optional) The S3 bucket prefix. Logs are stored in the root if not configured.
+* `interval` - (Optional) The publishing interval in minutes. Valid values: `5` and `60`. Default: `60`
+* `enabled` - (Optional) Boolean to enable / disable `accessLogs`. Default is `true`
+
+Listeners (`listener`) support the following:
+
+* `instancePort` - (Required) The port on the instance to route to
+* `instanceProtocol` - (Required) The protocol to use to the instance. Valid
+  values are `http`, `https`, `tcp`, or `ssl`
+* `lbPort` - (Required) The port to listen on for the load balancer
+* `lbProtocol` - (Required) The protocol to listen on. Valid values are `http`,
+  `https`, `tcp`, or `ssl`
+* `sslCertificateId` - (Optional) The ARN of an SSL certificate you have
+uploaded to AWS IAM. **Note ECDSA-specific restrictions below.  Only valid when `lbProtocol` is either HTTPS or SSL**
+
+Health Check (`healthCheck`) supports the following:
+
+* `healthyThreshold` - (Required) The number of checks before the instance is declared healthy.
+* `unhealthyThreshold` - (Required) The number of checks before the instance is declared unhealthy.
+* `target` - (Required) The target of the check. Valid pattern is "${PROTOCOL}:${PORT}${PATH}", where PROTOCOL
+  values are:
+    * `http`, `https` - PORT and PATH are required
+    * `tcp`, `ssl` - PORT is required, PATH is not supported
+* `interval` - (Required) The interval between checks.
+* `timeout` - (Required) The length of time before the check times out.
+
+## Note on ECDSA Key Algorithm
+
+If the ARN of the `sslCertificateId` that is pointed to references a
+certificate that was signed by an ECDSA key, note that ELB only supports the
+P256 and P384 curves.  Using a certificate signed by a key using a different
+curve could produce the error `errSslVersionOrCipherMismatch` in your
+browser.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name of the ELB
+* `arn` - The ARN of the ELB
+* `name` - The name of the ELB
+* `dnsName` - The DNS name of the ELB
+* `instances` - The list of instances in the ELB
+* `sourceSecurityGroup` - The name of the security group that you can use as
+  part of your inbound rules for your load balancer's back-end application
+  instances. Use this for Classic or Default VPC only.
+* `sourceSecurityGroupId` - The ID of the security group that you can use as
+  part of your inbound rules for your load balancer's back-end application
+  instances. Only available on ELBs launched in a VPC.
+* `zoneId` - The canonical hosted zone ID of the ELB (to be used in a Route 53 Alias record)
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import ELBs using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import ELBs using the `name`. For example:
+
+```console
+% terraform import aws_elb.bar elb-production-12345
+```
+
+<!-- cache-key: cdktf-0.18.0 input-51cf9c0bd7493a8933e0ea949d5da8ff7b2aba67934ff679f9a3811feef95d7c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/elb_attachment.html.markdown b/website/docs/cdktf/typescript/r/elb_attachment.html.markdown
new file mode 100644
index 00000000000..a2cc0013b80
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/elb_attachment.html.markdown
@@ -0,0 +1,56 @@
+---
+subcategory: "ELB Classic"
+layout: "aws"
+page_title: "AWS: aws_elb_attachment"
+description: |-
+  Provides an Elastic Load Balancer Attachment resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_elb_attachment
+
+Attaches an EC2 instance to an Elastic Load Balancer (ELB). For attaching resources with Application Load Balancer (ALB) or Network Load Balancer (NLB), see the [`awsLbTargetGroupAttachment` resource](/docs/providers/aws/r/lb_target_group_attachment.html).
+
+~> **NOTE on ELB Instances and ELB Attachments:** Terraform currently provides
+both a standalone ELB Attachment resource (describing an instance attached to
+an ELB), and an [Elastic Load Balancer resource](elb.html) with
+`instances` defined in-line. At this time you cannot use an ELB with in-line
+instances in conjunction with an ELB Attachment resource. Doing so will cause a
+conflict and will overwrite attachments.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ElbAttachment } from "./.gen/providers/aws/elb-attachment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ElbAttachment(this, "baz", {
+      elb: bar.id,
+      instance: foo.id,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `elb` - (Required) The name of the ELB.
+* `instance` - (Required) Instance ID to place in the ELB pool.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+<!-- cache-key: cdktf-0.18.0 input-99c0a2bdaa3c996a4fa9095610cca1664b20df2774feb4374303141a331e823c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/emr_block_public_access_configuration.html.markdown b/website/docs/cdktf/typescript/r/emr_block_public_access_configuration.html.markdown
new file mode 100644
index 00000000000..922d6da8ce3
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/emr_block_public_access_configuration.html.markdown
@@ -0,0 +1,172 @@
+---
+subcategory: "EMR"
+layout: "aws"
+page_title: "AWS: aws_emr_block_public_access_configuration"
+description: |-
+  Terraform resource for managing an AWS EMR Block Public Access Configuration.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_emr_block_public_access_configuration
+
+Terraform resource for managing an AWS EMR block public access configuration. This region level security configuration restricts the launch of EMR clusters that have associated security groups permitting public access on unspecified ports. See the [EMR Block Public Access Configuration](https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-block-public-access.html) documentation for further information.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EmrBlockPublicAccessConfiguration } from "./.gen/providers/aws/emr-block-public-access-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new EmrBlockPublicAccessConfiguration(this, "example", {
+      blockPublicSecurityGroupRules: true,
+    });
+  }
+}
+
+```
+
+### Default Configuration
+
+By default, each AWS region is equipped with a block public access configuration that prevents EMR clusters from being launched if they have security group rules permitting public access on any port except for port 22. The default configuration can be managed using this Terraform resource.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EmrBlockPublicAccessConfiguration } from "./.gen/providers/aws/emr-block-public-access-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new EmrBlockPublicAccessConfiguration(this, "example", {
+      blockPublicSecurityGroupRules: true,
+      permittedPublicSecurityGroupRuleRange: [
+        {
+          maxRange: 22,
+          minRange: 22,
+        },
+      ],
+    });
+  }
+}
+
+```
+
+~> **NOTE:** If an `awsEmrBlockPublicAccessConfiguration` Terraform resource is destroyed, the configuration will reset to this default configuration.
+
+### Multiple Permitted Public Security Group Rule Ranges
+
+The resource permits specification of multiple `permittedPublicSecurityGroupRuleRange` blocks.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EmrBlockPublicAccessConfiguration } from "./.gen/providers/aws/emr-block-public-access-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new EmrBlockPublicAccessConfiguration(this, "example", {
+      blockPublicSecurityGroupRules: true,
+      permittedPublicSecurityGroupRuleRange: [
+        {
+          maxRange: 22,
+          minRange: 22,
+        },
+        {
+          maxRange: 101,
+          minRange: 100,
+        },
+      ],
+    });
+  }
+}
+
+```
+
+### Disabling Block Public Access
+
+To permit EMR clusters to be launched in the configured region regardless of associated security group rules, the Block Public Access feature can be disabled using this Terraform resource.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EmrBlockPublicAccessConfiguration } from "./.gen/providers/aws/emr-block-public-access-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new EmrBlockPublicAccessConfiguration(this, "example", {
+      blockPublicSecurityGroupRules: false,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `blockPublicSecurityGroupRules` - (Required) Enable or disable EMR Block Public Access.
+
+The following arguments are optional:
+
+* `permittedPublicSecurityGroupRuleRange` - (Optional) Configuration block for defining permitted public security group rule port ranges. Can be defined multiple times per resource. Only valid if `blockPublicSecurityGroupRules` is set to `true`.
+
+### `permittedPublicSecurityGroupRuleRange`
+
+This block is used to define a range of TCP ports that should form exceptions to the Block Public Access Configuration. If an attempt is made to launch an EMR cluster in the configured region and account, with `block_public_security_group_rules = true`, the EMR cluster will be permitted to launch even if there are security group rules permitting public access to ports in this range.
+
+* `minRange` - (Required) The first port in the range of TCP ports.
+* `maxRange` - (Required) The final port in the range of TCP ports.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import the current EMR Block Public Access Configuration. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import the current EMR Block Public Access Configuration. For example:
+
+```console
+% terraform import aws_emr_block_public_access_configuration.example current
+```
+
+<!-- cache-key: cdktf-0.18.0 input-aa7683c154001c04829343267ab3b769046fafe4a515b4091bc80943f1f89917 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/emr_cluster.html.markdown b/website/docs/cdktf/typescript/r/emr_cluster.html.markdown
new file mode 100644
index 00000000000..821fba0a807
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/emr_cluster.html.markdown
@@ -0,0 +1,913 @@
+---
+subcategory: "EMR"
+layout: "aws"
+page_title: "AWS: aws_emr_cluster"
+description: |-
+  Provides an Elastic MapReduce Cluster
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_emr_cluster
+
+Provides an Elastic MapReduce Cluster, a web service that makes it easy to process large amounts of data efficiently. See [Amazon Elastic MapReduce Documentation](https://aws.amazon.com/documentation/elastic-mapreduce/) for more information.
+
+To configure [Instance Groups](https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-instance-group-configuration.html#emr-plan-instance-groups) for [task nodes](https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-master-core-task-nodes.html#emr-plan-task), see the [`awsEmrInstanceGroup` resource](/docs/providers/aws/r/emr_instance_group.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EmrCluster } from "./.gen/providers/aws/emr-cluster";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new EmrCluster(this, "cluster", {
+      additionalInfo:
+        '{\n  "instanceAwsClientConfiguration": {\n    "proxyPort": 8099,\n    "proxyHost": "myproxy.example.com"\n  }\n}\n\n',
+      applications: ["Spark"],
+      bootstrapAction: [
+        {
+          args: ["instance.isMaster=true", "echo running on master node"],
+          name: "runif",
+          path: "s3://elasticmapreduce/bootstrap-actions/run-if",
+        },
+      ],
+      configurationsJson:
+        '  [\n    {\n      "Classification": "hadoop-env",\n      "Configurations": [\n        {\n          "Classification": "export",\n          "Properties": {\n            "JAVA_HOME": "/usr/lib/jvm/java-1.8.0"\n          }\n        }\n      ],\n      "Properties": {}\n    },\n    {\n      "Classification": "spark-env",\n      "Configurations": [\n        {\n          "Classification": "export",\n          "Properties": {\n            "JAVA_HOME": "/usr/lib/jvm/java-1.8.0"\n          }\n        }\n      ],\n      "Properties": {}\n    }\n  ]\n\n',
+      coreInstanceGroup: {
+        autoscalingPolicy:
+          '{\n"Constraints": {\n  "MinCapacity": 1,\n  "MaxCapacity": 2\n},\n"Rules": [\n  {\n    "Name": "ScaleOutMemoryPercentage",\n    "Description": "Scale out if YARNMemoryAvailablePercentage is less than 15",\n    "Action": {\n      "SimpleScalingPolicyConfiguration": {\n        "AdjustmentType": "CHANGE_IN_CAPACITY",\n        "ScalingAdjustment": 1,\n        "CoolDown": 300\n      }\n    },\n    "Trigger": {\n      "CloudWatchAlarmDefinition": {\n        "ComparisonOperator": "LESS_THAN",\n        "EvaluationPeriods": 1,\n        "MetricName": "YARNMemoryAvailablePercentage",\n        "Namespace": "AWS/ElasticMapReduce",\n        "Period": 300,\n        "Statistic": "AVERAGE",\n        "Threshold": 15.0,\n        "Unit": "PERCENT"\n      }\n    }\n  }\n]\n}\n\n',
+        bidPrice: "0.30",
+        ebsConfig: [
+          {
+            size: Token.asNumber("40"),
+            type: "gp2",
+            volumesPerInstance: 1,
+          },
+        ],
+        instanceCount: 1,
+        instanceType: "c4.large",
+      },
+      ebsRootVolumeSize: 100,
+      ec2Attributes: {
+        emrManagedMasterSecurityGroup: sg.id,
+        emrManagedSlaveSecurityGroup: sg.id,
+        instanceProfile: emrProfile.arn,
+        subnetId: main.id,
+      },
+      keepJobFlowAliveWhenNoSteps: true,
+      masterInstanceGroup: {
+        instanceType: "m4.large",
+      },
+      name: "emr-test-arn",
+      releaseLabel: "emr-4.6.0",
+      serviceRole: iamEmrServiceRole.arn,
+      tags: {
+        env: "env",
+        role: "rolename",
+      },
+      terminationProtection: false,
+    });
+  }
+}
+
+```
+
+The `awsEmrCluster` resource typically requires two IAM roles, one for the EMR Cluster to use as a service role, and another is assigned to every EC2 instance in a cluster and each application process that runs on a cluster assumes this role for permissions to interact with other AWS services. An additional role, the Auto Scaling role, is required if your cluster uses automatic scaling in Amazon EMR.
+
+The default AWS managed EMR service role is called `emrDefaultRole` with Amazon managed policy `amazonEmrServicePolicyV2` attached. The name of default instance profile role is `emrEc2DefaultRole` with default managed policy `amazonElasticMapReduceforEc2Role` attached, but it is on the path to deprecation and will not be replaced with another default managed policy. You'll need to create and specify an instance profile to replace the deprecated role and default policy. See the [Configure IAM service roles for Amazon EMR](https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-iam-roles.html) guide for more information on these IAM roles. There is also a fully-bootable example Terraform configuration at the bottom of this page.
+
+### Instance Fleet
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EmrCluster } from "./.gen/providers/aws/emr-cluster";
+import { EmrInstanceFleet } from "./.gen/providers/aws/emr-instance-fleet";
+interface MyConfig {
+  name: any;
+  releaseLabel: any;
+  serviceRole: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    const example = new EmrCluster(this, "example", {
+      coreInstanceFleet: {
+        instanceTypeConfigs: [
+          {
+            bidPriceAsPercentageOfOnDemandPrice: 80,
+            ebsConfig: [
+              {
+                size: 100,
+                type: "gp2",
+                volumesPerInstance: 1,
+              },
+            ],
+            instanceType: "m3.xlarge",
+            weightedCapacity: 1,
+          },
+          {
+            bidPriceAsPercentageOfOnDemandPrice: 100,
+            ebsConfig: [
+              {
+                size: 100,
+                type: "gp2",
+                volumesPerInstance: 1,
+              },
+            ],
+            instanceType: "m4.xlarge",
+            weightedCapacity: 1,
+          },
+          {
+            bidPriceAsPercentageOfOnDemandPrice: 100,
+            ebsConfig: [
+              {
+                size: 100,
+                type: "gp2",
+                volumesPerInstance: 1,
+              },
+            ],
+            instanceType: "m4.2xlarge",
+            weightedCapacity: 2,
+          },
+        ],
+        launchSpecifications: {
+          spotSpecification: [
+            {
+              allocationStrategy: "capacity-optimized",
+              blockDurationMinutes: 0,
+              timeoutAction: "SWITCH_TO_ON_DEMAND",
+              timeoutDurationMinutes: 10,
+            },
+          ],
+        },
+        name: "core fleet",
+        targetOnDemandCapacity: 2,
+        targetSpotCapacity: 2,
+      },
+      masterInstanceFleet: {
+        instanceTypeConfigs: [
+          {
+            instanceType: "m4.xlarge",
+          },
+        ],
+        targetOnDemandCapacity: 1,
+      },
+      name: config.name,
+      releaseLabel: config.releaseLabel,
+      serviceRole: config.serviceRole,
+    });
+    new EmrInstanceFleet(this, "task", {
+      clusterId: example.id,
+      instanceTypeConfigs: [
+        {
+          bidPriceAsPercentageOfOnDemandPrice: 100,
+          ebsConfig: [
+            {
+              size: 100,
+              type: "gp2",
+              volumesPerInstance: 1,
+            },
+          ],
+          instanceType: "m4.xlarge",
+          weightedCapacity: 1,
+        },
+        {
+          bidPriceAsPercentageOfOnDemandPrice: 100,
+          ebsConfig: [
+            {
+              size: 100,
+              type: "gp2",
+              volumesPerInstance: 1,
+            },
+          ],
+          instanceType: "m4.2xlarge",
+          weightedCapacity: 2,
+        },
+      ],
+      launchSpecifications: {
+        spotSpecification: [
+          {
+            allocationStrategy: "capacity-optimized",
+            blockDurationMinutes: 0,
+            timeoutAction: "TERMINATE_CLUSTER",
+            timeoutDurationMinutes: 10,
+          },
+        ],
+      },
+      name: "task fleet",
+      targetOnDemandCapacity: 1,
+      targetSpotCapacity: 1,
+    });
+  }
+}
+
+```
+
+### Enable Debug Logging
+
+[Debug logging in EMR](https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-plan-debugging.html) is implemented as a step. It is highly recommended that you utilize the [lifecycle configuration block](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html) with `ignoreChanges` if other steps are being managed outside of Terraform.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EmrCluster } from "./.gen/providers/aws/emr-cluster";
+interface MyConfig {
+  name: any;
+  releaseLabel: any;
+  serviceRole: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new EmrCluster(this, "example", {
+      lifecycle: {
+        ignoreChanges: [step],
+      },
+      step: [
+        {
+          actionOnFailure: "TERMINATE_CLUSTER",
+          hadoopJarStep: [
+            {
+              args: ["state-pusher-script"],
+              jar: "command-runner.jar",
+            },
+          ],
+          name: "Setup Hadoop Debugging",
+        },
+      ],
+      name: config.name,
+      releaseLabel: config.releaseLabel,
+      serviceRole: config.serviceRole,
+    });
+  }
+}
+
+```
+
+### Multiple Node Master Instance Group
+
+Available in EMR version 5.23.0 and later, an EMR Cluster can be launched with three master nodes for high availability. Additional information about this functionality and its requirements can be found in the [EMR Management Guide](https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-plan-ha.html).
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EmrCluster } from "./.gen/providers/aws/emr-cluster";
+import { Subnet } from "./.gen/providers/aws/subnet";
+interface MyConfig {
+  vpcId: any;
+  instanceType: any;
+  instanceProfile: any;
+  instanceType1: any;
+  name: any;
+  serviceRole: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    const example = new Subnet(this, "example", {
+      mapPublicIpOnLaunch: true,
+      vpcId: config.vpcId,
+    });
+    const awsEmrClusterExample = new EmrCluster(this, "example_1", {
+      coreInstanceGroup: {
+        instanceType: config.instanceType,
+      },
+      ec2Attributes: {
+        subnetId: example.id,
+        instanceProfile: config.instanceProfile,
+      },
+      masterInstanceGroup: {
+        instanceCount: 3,
+        instanceType: config.instanceType1,
+      },
+      releaseLabel: "emr-5.24.1",
+      terminationProtection: true,
+      name: config.name,
+      serviceRole: config.serviceRole,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsEmrClusterExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### Bootable Cluster
+
+**NOTE:** This configuration demonstrates a minimal configuration needed to boot an example EMR Cluster. It is not meant to display best practices. As with all examples, use at your own risk.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { EmrCluster } from "./.gen/providers/aws/emr-cluster";
+import { IamInstanceProfile } from "./.gen/providers/aws/iam-instance-profile";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+import { IamRolePolicy } from "./.gen/providers/aws/iam-role-policy";
+import { InternetGateway } from "./.gen/providers/aws/internet-gateway";
+import { MainRouteTableAssociation } from "./.gen/providers/aws/main-route-table-association";
+import { RouteTable } from "./.gen/providers/aws/route-table";
+import { SecurityGroup } from "./.gen/providers/aws/security-group";
+import { Subnet } from "./.gen/providers/aws/subnet";
+import { Vpc } from "./.gen/providers/aws/vpc";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const main = new Vpc(this, "main", {
+      cidrBlock: "168.31.0.0/16",
+      enableDnsHostnames: true,
+      tags: {
+        name: "emr_test",
+      },
+    });
+    const ec2AssumeRole = new DataAwsIamPolicyDocument(
+      this,
+      "ec2_assume_role",
+      {
+        statement: [
+          {
+            actions: Token.asList("sts:AssumeRole"),
+            effect: "Allow",
+            principals: [
+              {
+                identifiers: ["ec2.amazonaws.com"],
+                type: "Service",
+              },
+            ],
+          },
+        ],
+      }
+    );
+    const emrAssumeRole = new DataAwsIamPolicyDocument(
+      this,
+      "emr_assume_role",
+      {
+        statement: [
+          {
+            actions: Token.asList("sts:AssumeRole"),
+            effect: "Allow",
+            principals: [
+              {
+                identifiers: ["elasticmapreduce.amazonaws.com"],
+                type: "Service",
+              },
+            ],
+          },
+        ],
+      }
+    );
+    const iamEmrProfilePolicy = new DataAwsIamPolicyDocument(
+      this,
+      "iam_emr_profile_policy",
+      {
+        statement: [
+          {
+            actions: [
+              "cloudwatch:*",
+              "dynamodb:*",
+              "ec2:Describe*",
+              "elasticmapreduce:Describe*",
+              "elasticmapreduce:ListBootstrapActions",
+              "elasticmapreduce:ListClusters",
+              "elasticmapreduce:ListInstanceGroups",
+              "elasticmapreduce:ListInstances",
+              "elasticmapreduce:ListSteps",
+              "kinesis:CreateStream",
+              "kinesis:DeleteStream",
+              "kinesis:DescribeStream",
+              "kinesis:GetRecords",
+              "kinesis:GetShardIterator",
+              "kinesis:MergeShards",
+              "kinesis:PutRecord",
+              "kinesis:SplitShard",
+              "rds:Describe*",
+              "s3:*",
+              "sdb:*",
+              "sns:*",
+              "sqs:*",
+            ],
+            effect: "Allow",
+            resources: ["*"],
+          },
+        ],
+      }
+    );
+    const iamEmrServicePolicy = new DataAwsIamPolicyDocument(
+      this,
+      "iam_emr_service_policy",
+      {
+        statement: [
+          {
+            actions: [
+              "ec2:AuthorizeSecurityGroupEgress",
+              "ec2:AuthorizeSecurityGroupIngress",
+              "ec2:CancelSpotInstanceRequests",
+              "ec2:CreateNetworkInterface",
+              "ec2:CreateSecurityGroup",
+              "ec2:CreateTags",
+              "ec2:DeleteNetworkInterface",
+              "ec2:DeleteSecurityGroup",
+              "ec2:DeleteTags",
+              "ec2:DescribeAvailabilityZones",
+              "ec2:DescribeAccountAttributes",
+              "ec2:DescribeDhcpOptions",
+              "ec2:DescribeInstanceStatus",
+              "ec2:DescribeInstances",
+              "ec2:DescribeKeyPairs",
+              "ec2:DescribeNetworkAcls",
+              "ec2:DescribeNetworkInterfaces",
+              "ec2:DescribePrefixLists",
+              "ec2:DescribeRouteTables",
+              "ec2:DescribeSecurityGroups",
+              "ec2:DescribeSpotInstanceRequests",
+              "ec2:DescribeSpotPriceHistory",
+              "ec2:DescribeSubnets",
+              "ec2:DescribeVpcAttribute",
+              "ec2:DescribeVpcEndpoints",
+              "ec2:DescribeVpcEndpointServices",
+              "ec2:DescribeVpcs",
+              "ec2:DetachNetworkInterface",
+              "ec2:ModifyImageAttribute",
+              "ec2:ModifyInstanceAttribute",
+              "ec2:RequestSpotInstances",
+              "ec2:RevokeSecurityGroupEgress",
+              "ec2:RunInstances",
+              "ec2:TerminateInstances",
+              "ec2:DeleteVolume",
+              "ec2:DescribeVolumeStatus",
+              "ec2:DescribeVolumes",
+              "ec2:DetachVolume",
+              "iam:GetRole",
+              "iam:GetRolePolicy",
+              "iam:ListInstanceProfiles",
+              "iam:ListRolePolicies",
+              "iam:PassRole",
+              "s3:CreateBucket",
+              "s3:Get*",
+              "s3:List*",
+              "sdb:BatchPutAttributes",
+              "sdb:Select",
+              "sqs:CreateQueue",
+              "sqs:Delete*",
+              "sqs:GetQueue*",
+              "sqs:PurgeQueue",
+              "sqs:ReceiveMessage",
+            ],
+            effect: "Allow",
+            resources: ["*"],
+          },
+        ],
+      }
+    );
+    const iamEmrProfileRole = new IamRole(this, "iam_emr_profile_role", {
+      assumeRolePolicy: Token.asString(ec2AssumeRole.json),
+      name: "iam_emr_profile_role",
+    });
+    const iamEmrServiceRole = new IamRole(this, "iam_emr_service_role", {
+      assumeRolePolicy: Token.asString(emrAssumeRole.json),
+      name: "iam_emr_service_role",
+    });
+    const awsIamRolePolicyIamEmrProfilePolicy = new IamRolePolicy(
+      this,
+      "iam_emr_profile_policy_7",
+      {
+        name: "iam_emr_profile_policy",
+        policy: Token.asString(iamEmrProfilePolicy.json),
+        role: iamEmrProfileRole.id,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamRolePolicyIamEmrProfilePolicy.overrideLogicalId(
+      "iam_emr_profile_policy"
+    );
+    const awsIamRolePolicyIamEmrServicePolicy = new IamRolePolicy(
+      this,
+      "iam_emr_service_policy_8",
+      {
+        name: "iam_emr_service_policy",
+        policy: Token.asString(iamEmrServicePolicy.json),
+        role: iamEmrServiceRole.id,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamRolePolicyIamEmrServicePolicy.overrideLogicalId(
+      "iam_emr_service_policy"
+    );
+    const gw = new InternetGateway(this, "gw", {
+      vpcId: main.id,
+    });
+    const r = new RouteTable(this, "r", {
+      route: [
+        {
+          cidrBlock: "0.0.0.0/0",
+          gatewayId: gw.id,
+        },
+      ],
+      vpcId: main.id,
+    });
+    const awsSubnetMain = new Subnet(this, "main_11", {
+      cidrBlock: "168.31.0.0/20",
+      tags: {
+        name: "emr_test",
+      },
+      vpcId: main.id,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSubnetMain.overrideLogicalId("main");
+    const emrProfile = new IamInstanceProfile(this, "emr_profile", {
+      name: "emr_profile",
+      role: iamEmrProfileRole.name,
+    });
+    new MainRouteTableAssociation(this, "a", {
+      routeTableId: r.id,
+      vpcId: main.id,
+    });
+    const allowAccess = new SecurityGroup(this, "allow_access", {
+      dependsOn: [awsSubnetMain],
+      description: "Allow inbound traffic",
+      egress: [
+        {
+          cidrBlocks: ["0.0.0.0/0"],
+          fromPort: 0,
+          protocol: "-1",
+          toPort: 0,
+        },
+      ],
+      ingress: [
+        {
+          cidrBlocks: [main.cidrBlock],
+          fromPort: 0,
+          protocol: "-1",
+          toPort: 0,
+        },
+      ],
+      lifecycle: {
+        ignoreChanges: [ingress, egress],
+      },
+      name: "allow_access",
+      tags: {
+        name: "emr_test",
+      },
+      vpcId: main.id,
+    });
+    new EmrCluster(this, "cluster", {
+      applications: ["Spark"],
+      bootstrapAction: [
+        {
+          args: ["instance.isMaster=true", "echo running on master node"],
+          name: "runif",
+          path: "s3://elasticmapreduce/bootstrap-actions/run-if",
+        },
+      ],
+      configurationsJson:
+        '  [\n    {\n      "Classification": "hadoop-env",\n      "Configurations": [\n        {\n          "Classification": "export",\n          "Properties": {\n            "JAVA_HOME": "/usr/lib/jvm/java-1.8.0"\n          }\n        }\n      ],\n      "Properties": {}\n    },\n    {\n      "Classification": "spark-env",\n      "Configurations": [\n        {\n          "Classification": "export",\n          "Properties": {\n            "JAVA_HOME": "/usr/lib/jvm/java-1.8.0"\n          }\n        }\n      ],\n      "Properties": {}\n    }\n  ]\n\n',
+      coreInstanceGroup: {
+        instanceCount: 1,
+        instanceType: "m5.xlarge",
+      },
+      ec2Attributes: {
+        emrManagedMasterSecurityGroup: allowAccess.id,
+        emrManagedSlaveSecurityGroup: allowAccess.id,
+        instanceProfile: emrProfile.arn,
+        subnetId: Token.asString(awsSubnetMain.id),
+      },
+      masterInstanceGroup: {
+        instanceType: "m5.xlarge",
+      },
+      name: "emr-test-arn",
+      releaseLabel: "emr-4.6.0",
+      serviceRole: iamEmrServiceRole.arn,
+      tags: {
+        dns_zone: "env_zone",
+        env: "env",
+        name: "name-env",
+        role: "rolename",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) Name of the job flow.
+* `releaseLabel` - (Required) Release label for the Amazon EMR release.
+* `serviceRole` - (Required) IAM role that will be assumed by the Amazon EMR service to access AWS resources.
+
+The following arguments are optional:
+
+* `additionalInfo` - (Optional) JSON string for selecting additional features such as adding proxy information. Note: Currently there is no API to retrieve the value of this argument after EMR cluster creation from provider, therefore Terraform cannot detect drift from the actual EMR cluster if its value is changed outside Terraform.
+* `applications` - (Optional) A case-insensitive list of applications for Amazon EMR to install and configure when launching the cluster. For a list of applications available for each Amazon EMR release version, see the [Amazon EMR Release Guide](https://docs.aws.amazon.com/emr/latest/ReleaseGuide/emr-release-components.html).
+* `autoscalingRole` - (Optional) IAM role for automatic scaling policies. The IAM role provides permissions that the automatic scaling feature requires to launch and terminate EC2 instances in an instance group.
+* `autoTerminationPolicy` - (Optional) An auto-termination policy for an Amazon EMR cluster. An auto-termination policy defines the amount of idle time in seconds after which a cluster automatically terminates. See [Auto Termination Policy](#auto_termination_policy) Below.
+* `bootstrapAction` - (Optional) Ordered list of bootstrap actions that will be run before Hadoop is started on the cluster nodes. See below.
+* `configurations` - (Optional) List of configurations supplied for the EMR cluster you are creating. Supply a configuration object for applications to override their default configuration. See [AWS Documentation](https://docs.aws.amazon.com/emr/latest/ReleaseGuide/emr-configure-apps.html) for more information.
+* `configurationsJson` - (Optional) JSON string for supplying list of configurations for the EMR cluster.
+
+~> **NOTE on `configurationsJson`:** If the `configurations` value is empty then you should skip the `configurations` field instead of providing an empty list as a value, `"Configurations": []`.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EmrCluster } from "./.gen/providers/aws/emr-cluster";
+interface MyConfig {
+  name: any;
+  releaseLabel: any;
+  serviceRole: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new EmrCluster(this, "cluster", {
+      configurationsJson:
+        '  [\n    {\n      "Classification": "hadoop-env",\n      "Configurations": [\n        {\n          "Classification": "export",\n          "Properties": {\n            "JAVA_HOME": "/usr/lib/jvm/java-1.8.0"\n          }\n        }\n      ],\n      "Properties": {}\n    }\n  ]\n\n',
+      name: config.name,
+      releaseLabel: config.releaseLabel,
+      serviceRole: config.serviceRole,
+    });
+  }
+}
+
+```
+
+* `coreInstanceFleet` - (Optional) Configuration block to use an [Instance Fleet](https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-instance-fleet.html) for the core node type. Cannot be specified if any `coreInstanceGroup` configuration blocks are set. Detailed below.
+* `coreInstanceGroup` - (Optional) Configuration block to use an [Instance Group](https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-instance-group-configuration.html#emr-plan-instance-groups) for the [core node type](https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-master-core-task-nodes.html#emr-plan-core).
+* `customAmiId` - (Optional) Custom Amazon Linux AMI for the cluster (instead of an EMR-owned AMI). Available in Amazon EMR version 5.7.0 and later.
+* `ebsRootVolumeSize` - (Optional) Size in GiB of the EBS root device volume of the Linux AMI that is used for each EC2 instance. Available in Amazon EMR version 4.x and later.
+* `ec2Attributes` - (Optional) Attributes for the EC2 instances running the job flow. See below.
+* `keepJobFlowAliveWhenNoSteps` - (Optional) Switch on/off run cluster with no steps or when all steps are complete (default is on)
+* `kerberosAttributes` - (Optional) Kerberos configuration for the cluster. See below.
+* `listStepsStates` - (Optional) List of [step states](https://docs.aws.amazon.com/emr/latest/APIReference/API_StepStatus.html) used to filter returned steps
+* `logEncryptionKmsKeyId` - (Optional) AWS KMS customer master key (CMK) key ID or arn used for encrypting log files. This attribute is only available with EMR version 5.30.0 and later, excluding EMR 6.0.0.
+* `logUri` - (Optional) S3 bucket to write the log files of the job flow. If a value is not provided, logs are not created.
+* `masterInstanceFleet` - (Optional) Configuration block to use an [Instance Fleet](https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-instance-fleet.html) for the master node type. Cannot be specified if any `masterInstanceGroup` configuration blocks are set. Detailed below.
+* `masterInstanceGroup` - (Optional) Configuration block to use an [Instance Group](https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-instance-group-configuration.html#emr-plan-instance-groups) for the [master node type](https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-master-core-task-nodes.html#emr-plan-master).
+* `placementGroupConfig` - (Optional) The specified placement group configuration for an Amazon EMR cluster.
+* `scaleDownBehavior` - (Optional) Way that individual Amazon EC2 instances terminate when an automatic scale-in activity occurs or an `instance group` is resized.
+* `securityConfiguration` - (Optional) Security configuration name to attach to the EMR cluster. Only valid for EMR clusters with `releaseLabel` 4.8.0 or greater.
+* `step` - (Optional) List of steps to run when creating the cluster. See below. It is highly recommended to utilize the [lifecycle configuration block](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html) with `ignoreChanges` if other steps are being managed outside of Terraform. This argument is processed in [attribute-as-blocks mode](https://www.terraform.io/docs/configuration/attr-as-blocks.html).
+* `stepConcurrencyLevel` - (Optional) Number of steps that can be executed concurrently. You can specify a maximum of 256 steps. Only valid for EMR clusters with `releaseLabel` 5.28.0 or greater (default is 1).
+* `tags` - (Optional) list of tags to apply to the EMR Cluster. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `terminationProtection` - (Optional) Switch on/off termination protection (default is `false`, except when using multiple master nodes). Before attempting to destroy the resource when termination protection is enabled, this configuration must be applied with its value set to `false`.
+* `visibleToAllUsers` - (Optional) Whether the job flow is visible to all IAM users of the AWS account associated with the job flow. Default value is `true`.
+
+### bootstrap_action
+
+* `args` - (Optional) List of command line arguments to pass to the bootstrap action script.
+* `name` - (Required) Name of the bootstrap action.
+* `path` - (Required) Location of the script to run during a bootstrap action. Can be either a location in Amazon S3 or on a local file system.
+
+### auto_termination_policy
+
+* `idleTimeout` - (Optional) Specifies the amount of idle time in seconds after which the cluster automatically terminates. You can specify a minimum of `60` seconds and a maximum of `604800` seconds (seven days).
+
+### configurations
+
+A configuration classification that applies when provisioning cluster instances, which can include configurations for applications and software that run on the cluster. See [Configuring Applications](https://docs.aws.amazon.com/emr/latest/ReleaseGuide/emr-configure-apps.html).
+
+* `classification` - (Optional) Classification within a configuration.
+* `properties` - (Optional) Map of properties specified within a configuration classification.
+
+### core_instance_fleet
+
+* `instanceTypeConfigs` - (Optional) Configuration block for instance fleet.
+* `launchSpecifications` - (Optional) Configuration block for launch specification.
+* `name` - (Optional) Friendly name given to the instance fleet.
+* `targetOnDemandCapacity` - (Optional)  The target capacity of On-Demand units for the instance fleet, which determines how many On-Demand instances to provision.
+* `targetSpotCapacity` - (Optional) Target capacity of Spot units for the instance fleet, which determines how many Spot instances to provision.
+
+#### instance_type_configs
+
+* `bidPrice` - (Optional) Bid price for each EC2 Spot instance type as defined by `instanceType`. Expressed in USD. If neither `bidPrice` nor `bidPriceAsPercentageOfOnDemandPrice` is provided, `bidPriceAsPercentageOfOnDemandPrice` defaults to 100%.
+* `bidPriceAsPercentageOfOnDemandPrice` - (Optional) Bid price, as a percentage of On-Demand price, for each EC2 Spot instance as defined by `instanceType`. Expressed as a number (for example, 20 specifies 20%). If neither `bidPrice` nor `bidPriceAsPercentageOfOnDemandPrice` is provided, `bidPriceAsPercentageOfOnDemandPrice` defaults to 100%.
+* `configurations` - (Optional) Configuration classification that applies when provisioning cluster instances, which can include configurations for applications and software that run on the cluster. List of `configuration` blocks.
+* `ebsConfig` - (Optional) Configuration block(s) for EBS volumes attached to each instance in the instance group. Detailed below.
+* `instanceType` - (Required) EC2 instance type, such as m4.xlarge.
+* `weightedCapacity` - (Optional) Number of units that a provisioned instance of this type provides toward fulfilling the target capacities defined in `awsEmrInstanceFleet`.
+
+#### launch_specifications
+
+* `onDemandSpecification` - (Optional) Configuration block for on demand instances launch specifications.
+* `spotSpecification` - (Optional) Configuration block for spot instances launch specifications.
+
+##### on_demand_specification
+
+The launch specification for On-Demand instances in the instance fleet, which determines the allocation strategy.
+The instance fleet configuration is available only in Amazon EMR versions 4.8.0 and later, excluding 5.0.x versions. On-Demand instances allocation strategy is available in Amazon EMR version 5.12.1 and later.
+
+* `allocationStrategy` - (Required) Specifies the strategy to use in launching On-Demand instance fleets. Currently, the only option is `lowestPrice` (the default), which launches the lowest price first.
+
+##### spot_specification
+
+The launch specification for Spot instances in the fleet, which determines the defined duration, provisioning timeout behavior, and allocation strategy.
+
+* `allocationStrategy` - (Required) Specifies the strategy to use in launching Spot instance fleets. Valid values include `capacityOptimized`, `diversified`, `lowestPrice`, `priceCapacityOptimized`. See the [AWS documentation](https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-instance-fleet.html#emr-instance-fleet-allocation-strategy) for details on each strategy type.
+* `blockDurationMinutes` - (Optional) Defined duration for Spot instances (also known as Spot blocks) in minutes. When specified, the Spot instance does not terminate before the defined duration expires, and defined duration pricing for Spot instances applies. Valid values are 60, 120, 180, 240, 300, or 360. The duration period starts as soon as a Spot instance receives its instance ID. At the end of the duration, Amazon EC2 marks the Spot instance for termination and provides a Spot instance termination notice, which gives the instance a two-minute warning before it terminates.
+* `timeoutAction` - (Required) Action to take when TargetSpotCapacity has not been fulfilled when the TimeoutDurationMinutes has expired; that is, when all Spot instances could not be provisioned within the Spot provisioning timeout. Valid values are `terminateCluster` and `switchToOnDemand`. SWITCH_TO_ON_DEMAND specifies that if no Spot instances are available, On-Demand Instances should be provisioned to fulfill any remaining Spot capacity.
+* `timeoutDurationMinutes` - (Required) Spot provisioning timeout period in minutes. If Spot instances are not provisioned within this time period, the TimeOutAction is taken. Minimum value is 5 and maximum value is 1440. The timeout applies only during initial provisioning, when the cluster is first created.
+
+### core_instance_group
+
+* `autoscalingPolicy` - (Optional) String containing the [EMR Auto Scaling Policy](https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-automatic-scaling.html) JSON.
+* `bidPrice` - (Optional) Bid price for each EC2 instance in the instance group, expressed in USD. By setting this attribute, the instance group is being declared as a Spot Instance, and will implicitly create a Spot request. Leave this blank to use On-Demand Instances.
+* `ebsConfig` - (Optional) Configuration block(s) for EBS volumes attached to each instance in the instance group. Detailed below.
+* `instanceCount` - (Optional) Target number of instances for the instance group. Must be at least 1. Defaults to 1.
+* `instanceType` - (Required) EC2 instance type for all instances in the instance group.
+* `name` - (Optional) Friendly name given to the instance group.
+
+#### ebs_config
+
+* `iops` - (Optional) Number of I/O operations per second (IOPS) that the volume supports.
+* `size` - (Required) Volume size, in gibibytes (GiB).
+* `type` - (Required) Volume type. Valid options are `gp3`, `gp2`, `io1`, `standard`, `st1` and `sc1`. See [EBS Volume Types](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSVolumeTypes.html).
+* `throughput` - (Optional) The throughput, in mebibyte per second (MiB/s).
+* `volumesPerInstance` - (Optional) Number of EBS volumes with this configuration to attach to each EC2 instance in the instance group (default is 1).
+
+### ec2_attributes
+
+Attributes for the Amazon EC2 instances running the job flow:
+
+* `additionalMasterSecurityGroups` - (Optional) String containing a comma separated list of additional Amazon EC2 security group IDs for the master node.
+* `additionalSlaveSecurityGroups` - (Optional) String containing a comma separated list of additional Amazon EC2 security group IDs for the slave nodes as a comma separated string.
+* `emrManagedMasterSecurityGroup` - (Optional) Identifier of the Amazon EC2 EMR-Managed security group for the master node.
+* `emrManagedSlaveSecurityGroup` - (Optional) Identifier of the Amazon EC2 EMR-Managed security group for the slave nodes.
+* `instanceProfile` - (Required) Instance Profile for EC2 instances of the cluster assume this role.
+* `keyName` - (Optional) Amazon EC2 key pair that can be used to ssh to the master node as the user called `hadoop`.
+* `serviceAccessSecurityGroup` - (Optional) Identifier of the Amazon EC2 service-access security group - required when the cluster runs on a private subnet.
+* `subnetId` - (Optional) VPC subnet id where you want the job flow to launch. Cannot specify the `cc14Xlarge` instance type for nodes of a job flow launched in an Amazon VPC.
+* `subnetIds` - (Optional) List of VPC subnet id-s where you want the job flow to launch.  Amazon EMR identifies the best Availability Zone to launch instances according to your fleet specifications.
+
+~> **NOTE on EMR-Managed security groups:** These security groups will have any missing inbound or outbound access rules added and maintained by AWS, to ensure proper communication between instances in a cluster. The EMR service will maintain these rules for groups provided in `emrManagedMasterSecurityGroup` and `emrManagedSlaveSecurityGroup`; attempts to remove the required rules may succeed, only for the EMR service to re-add them in a matter of minutes. This may cause Terraform to fail to destroy an environment that contains an EMR cluster, because the EMR service does not revoke rules added on deletion, leaving a cyclic dependency between the security groups that prevents their deletion. To avoid this, use the `revokeRulesOnDelete` optional attribute for any Security Group used in `emrManagedMasterSecurityGroup` and `emrManagedSlaveSecurityGroup`. See [Amazon EMR-Managed Security Groups](http://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-man-sec-groups.html) for more information about the EMR-managed security group rules.
+
+### kerberos_attributes
+
+* `adDomainJoinPassword` - (Optional) Active Directory password for `adDomainJoinUser`. Terraform cannot perform drift detection of this configuration.
+* `adDomainJoinUser` - (Optional) Required only when establishing a cross-realm trust with an Active Directory domain. A user with sufficient privileges to join resources to the domain. Terraform cannot perform drift detection of this configuration.
+* `crossRealmTrustPrincipalPassword` - (Optional) Required only when establishing a cross-realm trust with a KDC in a different realm. The cross-realm principal password, which must be identical across realms. Terraform cannot perform drift detection of this configuration.
+* `kdcAdminPassword` - (Required) Password used within the cluster for the kadmin service on the cluster-dedicated KDC, which maintains Kerberos principals, password policies, and keytabs for the cluster. Terraform cannot perform drift detection of this configuration.
+* `realm` - (Required) Name of the Kerberos realm to which all nodes in a cluster belong. For example, `ec2Internal`
+
+### master_instance_fleet
+
+* `instanceTypeConfigs` - (Optional) Configuration block for instance fleet.
+* `launchSpecifications` - (Optional) Configuration block for launch specification.
+* `name` - (Optional) Friendly name given to the instance fleet.
+* `targetOnDemandCapacity` - (Optional) Target capacity of On-Demand units for the instance fleet, which determines how many On-Demand instances to provision.
+* `targetSpotCapacity` - (Optional) Target capacity of Spot units for the instance fleet, which determines how many Spot instances to provision.
+
+#### instance_type_configs
+
+See `instanceTypeConfigs` above, under `coreInstanceFleet`.
+
+#### launch_specifications
+
+See `launchSpecifications` above, under `coreInstanceFleet`.
+
+### master_instance_group
+
+Supported nested arguments for the `masterInstanceGroup` configuration block:
+
+* `bidPrice` - (Optional) Bid price for each EC2 instance in the instance group, expressed in USD. By setting this attribute, the instance group is being declared as a Spot Instance, and will implicitly create a Spot request. Leave this blank to use On-Demand Instances.
+* `ebsConfig` - (Optional) Configuration block(s) for EBS volumes attached to each instance in the instance group. Detailed below.
+* `instanceCount` - (Optional) Target number of instances for the instance group. Must be 1 or 3. Defaults to 1. Launching with multiple master nodes is only supported in EMR version 5.23.0+, and requires this resource's `coreInstanceGroup` to be configured. Public (Internet accessible) instances must be created in VPC subnets that have [map public IP on launch](/docs/providers/aws/r/subnet.html#map_public_ip_on_launch) enabled. Termination protection is automatically enabled when launched with multiple master nodes and Terraform must have the `termination_protection = false` configuration applied before destroying this resource.
+* `instanceType` - (Required) EC2 instance type for all instances in the instance group.
+* `name` - (Optional) Friendly name given to the instance group.
+
+#### ebs_config
+
+See `ebsConfig` under `coreInstanceGroup` above.
+
+### step
+
+This argument is processed in [attribute-as-blocks mode](https://www.terraform.io/docs/configuration/attr-as-blocks.html).
+
+* `actionOnFailure` - (Required) Action to take if the step fails. Valid values: `terminateJobFlow`, `terminateCluster`, `cancelAndWait`, and `continue`
+* `hadoopJarStep` - (Required) JAR file used for the step. See below.
+* `name` - (Required) Name of the step.
+
+#### hadoop_jar_step
+
+This argument is processed in [attribute-as-blocks mode](https://www.terraform.io/docs/configuration/attr-as-blocks.html).
+
+* `args` - (Optional) List of command line arguments passed to the JAR file's main function when executed.
+* `jar` - (Required) Path to a JAR file run during the step.
+* `mainClass` - (Optional) Name of the main class in the specified Java file. If not specified, the JAR file should specify a Main-Class in its manifest file.
+* `properties` - (Optional) Key-Value map of Java properties that are set when the step runs. You can use these properties to pass key value pairs to your main function.
+
+### placement_group_config
+
+* `instanceRole` - (Required) Role of the instance in the cluster. Valid Values: `master`, `core`, `task`.
+* `placementStrategy` - (Optional) EC2 Placement Group strategy associated with instance role. Valid Values: `spread`, `partition`, `cluster`, `none`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `applications` - Applications installed on this cluster.
+* `arn`- ARN of the cluster.
+* `bootstrapAction` - List of bootstrap actions that will be run before Hadoop is started on the cluster nodes.
+* `configurations` - List of Configurations supplied to the EMR cluster.
+* `coreInstanceGroup0Id` - Core node type Instance Group ID, if using Instance Group for this node type.
+* `ec2Attributes` - Provides information about the EC2 instances in a cluster grouped by category: key name, subnet ID, IAM instance profile, and so on.
+* `id` - ID of the cluster.
+* `logUri` - Path to the Amazon S3 location where logs for this cluster are stored.
+* `masterInstanceGroup0Id` - Master node type Instance Group ID, if using Instance Group for this node type.
+* `masterPublicDns` - The DNS name of the master node. If the cluster is on a private subnet, this is the private DNS name. On a public subnet, this is the public DNS name.
+* `name` - Name of the cluster.
+* `releaseLabel` - Release label for the Amazon EMR release.
+* `serviceRole` - IAM role that will be assumed by the Amazon EMR service to access AWS resources on your behalf.
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `visibleToAllUsers` - Indicates whether the job flow is visible to all IAM users of the AWS account associated with the job flow.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EMR clusters using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import EMR clusters using the `id`. For example:
+
+```console
+% terraform import aws_emr_cluster.cluster j-123456ABCDEF
+```
+
+Since the API does not return the actual values for Kerberos configurations, environments with those Terraform configurations will need to use the [`lifecycle` configuration block `ignoreChanges` argument](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html#ignore_changes) available to all Terraform resources to prevent perpetual differences. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EmrCluster } from "./.gen/providers/aws/emr-cluster";
+interface MyConfig {
+  name: any;
+  releaseLabel: any;
+  serviceRole: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new EmrCluster(this, "example", {
+      lifecycle: {
+        ignoreChanges: [kerberosAttributes],
+      },
+      name: config.name,
+      releaseLabel: config.releaseLabel,
+      serviceRole: config.serviceRole,
+    });
+  }
+}
+
+```
+
+<!-- cache-key: cdktf-0.18.0 input-b9d18b24d38c79ee9f688a74547cdb740e2cd654a3d3dc2a431681dd4a66d46c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/emr_instance_fleet.html.markdown b/website/docs/cdktf/typescript/r/emr_instance_fleet.html.markdown
new file mode 100644
index 00000000000..86627111e87
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/emr_instance_fleet.html.markdown
@@ -0,0 +1,174 @@
+---
+subcategory: "EMR"
+layout: "aws"
+page_title: "AWS: aws_emr_instance_fleet"
+description: |-
+  Provides an Elastic MapReduce Cluster Instance Fleet
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_emr_instance_fleet
+
+Provides an Elastic MapReduce Cluster Instance Fleet configuration.
+See [Amazon Elastic MapReduce Documentation](https://aws.amazon.com/documentation/emr/) for more information.
+
+~> **NOTE:** At this time, Instance Fleets cannot be destroyed through the API nor
+web interface. Instance Fleets are destroyed when the EMR Cluster is destroyed.
+Terraform will resize any Instance Fleet to zero when destroying the resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EmrInstanceFleet } from "./.gen/providers/aws/emr-instance-fleet";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new EmrInstanceFleet(this, "task", {
+      clusterId: cluster.id,
+      instanceTypeConfigs: [
+        {
+          bidPriceAsPercentageOfOnDemandPrice: 100,
+          ebsConfig: [
+            {
+              size: 100,
+              type: "gp2",
+              volumesPerInstance: 1,
+            },
+          ],
+          instanceType: "m4.xlarge",
+          weightedCapacity: 1,
+        },
+        {
+          bidPriceAsPercentageOfOnDemandPrice: 100,
+          ebsConfig: [
+            {
+              size: 100,
+              type: "gp2",
+              volumesPerInstance: 1,
+            },
+          ],
+          instanceType: "m4.2xlarge",
+          weightedCapacity: 2,
+        },
+      ],
+      launchSpecifications: {
+        spotSpecification: [
+          {
+            allocationStrategy: "capacity-optimized",
+            blockDurationMinutes: 0,
+            timeoutAction: "TERMINATE_CLUSTER",
+            timeoutDurationMinutes: 10,
+          },
+        ],
+      },
+      name: "task fleet",
+      targetOnDemandCapacity: 1,
+      targetSpotCapacity: 1,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `clusterId` - (Required) ID of the EMR Cluster to attach to. Changing this forces a new resource to be created.
+* `instanceTypeConfigs` - (Optional) Configuration block for instance fleet
+* `launchSpecifications` - (Optional) Configuration block for launch specification
+* `targetOnDemandCapacity` - (Optional)  The target capacity of On-Demand units for the instance fleet, which determines how many On-Demand instances to provision.
+* `targetSpotCapacity` - (Optional) The target capacity of Spot units for the instance fleet, which determines how many Spot instances to provision.
+* `name` - (Optional) Friendly name given to the instance fleet.
+
+## instance_type_configs Configuration Block
+
+* `bidPrice` - (Optional) The bid price for each EC2 Spot instance type as defined by `instanceType`. Expressed in USD. If neither `bidPrice` nor `bidPriceAsPercentageOfOnDemandPrice` is provided, `bidPriceAsPercentageOfOnDemandPrice` defaults to 100%.
+* `bidPriceAsPercentageOfOnDemandPrice` - (Optional) The bid price, as a percentage of On-Demand price, for each EC2 Spot instance as defined by `instanceType`. Expressed as a number (for example, 20 specifies 20%). If neither `bidPrice` nor `bidPriceAsPercentageOfOnDemandPrice` is provided, `bidPriceAsPercentageOfOnDemandPrice` defaults to 100%.
+* `configurations` - (Optional) A configuration classification that applies when provisioning cluster instances, which can include configurations for applications and software that run on the cluster. List of `configuration` blocks.
+* `ebsConfig` - (Optional) Configuration block(s) for EBS volumes attached to each instance in the instance group. Detailed below.
+* `instanceType` - (Required) An EC2 instance type, such as m4.xlarge.
+* `weightedCapacity` - (Optional) The number of units that a provisioned instance of this type provides toward fulfilling the target capacities defined in `awsEmrInstanceFleet`.
+
+## configurations Configuration Block
+
+A configuration classification that applies when provisioning cluster instances, which can include configurations for applications and software that run on the cluster. See [Configuring Applications](https://docs.aws.amazon.com/emr/latest/ReleaseGuide/emr-configure-apps.html).
+
+* `classification` - (Optional) The classification within a configuration.
+* `properties` - (Optional) A map of properties specified within a configuration classification
+
+## ebs_config
+
+Attributes for the EBS volumes attached to each EC2 instance in the `masterInstanceGroup` and `coreInstanceGroup` configuration blocks:
+
+* `size` - (Required) The volume size, in gibibytes (GiB).
+* `type` - (Required) The volume type. Valid options are `gp2`, `io1`, `standard` and `st1`. See [EBS Volume Types](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSVolumeTypes.html).
+* `iops` - (Optional) The number of I/O operations per second (IOPS) that the volume supports
+* `volumesPerInstance` - (Optional) The number of EBS volumes with this configuration to attach to each EC2 instance in the instance group (default is 1)
+
+## launch_specifications Configuration Block
+
+* `onDemandSpecification` - (Optional) Configuration block for on demand instances launch specifications
+* `spotSpecification` - (Optional) Configuration block for spot instances launch specifications
+
+## on_demand_specification  Configuration Block
+
+The launch specification for On-Demand instances in the instance fleet, which determines the allocation strategy.
+The instance fleet configuration is available only in Amazon EMR versions 4.8.0 and later, excluding 5.0.x versions. On-Demand instances allocation strategy is available in Amazon EMR version 5.12.1 and later.
+
+* `allocationStrategy` - (Required) Specifies the strategy to use in launching On-Demand instance fleets. Currently, the only option is `lowestPrice` (the default), which launches the lowest price first.
+
+## spot_specification  Configuration Block
+
+The launch specification for Spot instances in the fleet, which determines the defined duration, provisioning timeout behavior, and allocation strategy.
+
+* `allocationStrategy` - (Required) Specifies the strategy to use in launching Spot instance fleets. Currently, the only option is `capacityOptimized` (the default), which launches instances from Spot instance pools with optimal capacity for the number of instances that are launching.
+* `blockDurationMinutes` - (Optional) The defined duration for Spot instances (also known as Spot blocks) in minutes. When specified, the Spot instance does not terminate before the defined duration expires, and defined duration pricing for Spot instances applies. Valid values are 60, 120, 180, 240, 300, or 360. The duration period starts as soon as a Spot instance receives its instance ID. At the end of the duration, Amazon EC2 marks the Spot instance for termination and provides a Spot instance termination notice, which gives the instance a two-minute warning before it terminates.
+* `timeoutAction` - (Required) The action to take when TargetSpotCapacity has not been fulfilled when the TimeoutDurationMinutes has expired; that is, when all Spot instances could not be provisioned within the Spot provisioning timeout. Valid values are `terminateCluster` and `switchToOnDemand`. SWITCH_TO_ON_DEMAND specifies that if no Spot instances are available, On-Demand Instances should be provisioned to fulfill any remaining Spot capacity.
+* `timeoutDurationMinutes` - (Required) The spot provisioning timeout period in minutes. If Spot instances are not provisioned within this time period, the TimeOutAction is taken. Minimum value is 5 and maximum value is 1440. The timeout applies only during initial provisioning, when the cluster is first created.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The unique identifier of the instance fleet.
+
+* `provisionedOnDemandCapacity` The number of On-Demand units that have been provisioned for the instance
+fleet to fulfill TargetOnDemandCapacity. This provisioned capacity might be less than or greater than TargetOnDemandCapacity.
+
+* `provisionedSpotCapacity` The number of Spot units that have been provisioned for this instance fleet
+to fulfill TargetSpotCapacity. This provisioned capacity might be less than or greater than TargetSpotCapacity.
+
+* `status` The current status of the instance fleet.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EMR Instance Fleet using the EMR Cluster identifier and Instance Fleet identifier separated by a forward slash (`/`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import EMR Instance Fleet using the EMR Cluster identifier and Instance Fleet identifier separated by a forward slash (`/`). For example:
+
+```console
+% terraform import aws_emr_instance_fleet.example j-123456ABCDEF/if-15EK4O09RZLNR
+```
+
+<!-- cache-key: cdktf-0.18.0 input-47af6409cc7439e921a67c3063fdd66af4d873f6cbbb0f2ce7c746cff87b4eb8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/emr_instance_group.html.markdown b/website/docs/cdktf/typescript/r/emr_instance_group.html.markdown
new file mode 100644
index 00000000000..e1040487f8a
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/emr_instance_group.html.markdown
@@ -0,0 +1,123 @@
+---
+subcategory: "EMR"
+layout: "aws"
+page_title: "AWS: aws_emr_instance_group"
+description: |-
+  Provides an Elastic MapReduce Cluster Instance Group
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_emr_instance_group
+
+Provides an Elastic MapReduce Cluster Instance Group configuration.
+See [Amazon Elastic MapReduce Documentation](https://aws.amazon.com/documentation/emr/) for more information.
+
+~> **NOTE:** At this time, Instance Groups cannot be destroyed through the API nor
+web interface. Instance Groups are destroyed when the EMR Cluster is destroyed.
+Terraform will resize any Instance Group to zero when destroying the resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EmrInstanceGroup } from "./.gen/providers/aws/emr-instance-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new EmrInstanceGroup(this, "task", {
+      clusterId: tfTestCluster.id,
+      instanceCount: 1,
+      instanceType: "m5.xlarge",
+      name: "my little instance group",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` (Required) Human friendly name given to the instance group. Changing this forces a new resource to be created.
+* `clusterId` (Required) ID of the EMR Cluster to attach to. Changing this forces a new resource to be created.
+* `instanceType` (Required) The EC2 instance type for all instances in the instance group. Changing this forces a new resource to be created.
+* `instanceCount` (Optional) target number of instances for the instance group. defaults to 0.
+* `bidPrice` - (Optional) If set, the bid price for each EC2 instance in the instance group, expressed in USD. By setting this attribute, the instance group is being declared as a Spot Instance, and will implicitly create a Spot request. Leave this blank to use On-Demand Instances.
+* `ebsOptimized` (Optional) Indicates whether an Amazon EBS volume is EBS-optimized. Changing this forces a new resource to be created.
+* `ebsConfig` (Optional) One or more `ebsConfig` blocks as defined below. Changing this forces a new resource to be created.
+* `autoscalingPolicy` - (Optional) The autoscaling policy document. This is a JSON formatted string. See [EMR Auto Scaling](https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-automatic-scaling.html)
+* `configurationsJson` - (Optional) A JSON string for supplying list of configurations specific to the EMR instance group. Note that this can only be changed when using EMR release 5.21 or later.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EmrInstanceGroup } from "./.gen/providers/aws/emr-instance-group";
+interface MyConfig {
+  clusterId: any;
+  instanceType: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new EmrInstanceGroup(this, "task", {
+      configurationsJson:
+        '  [\n    {\n      "Classification": "hadoop-env",\n      "Configurations": [\n        {\n          "Classification": "export",\n          "Properties": {\n            "JAVA_HOME": "/usr/lib/jvm/java-1.8.0"\n          }\n        }\n      ],\n      "Properties": {}\n    }\n  ]\n\n',
+      clusterId: config.clusterId,
+      instanceType: config.instanceType,
+    });
+  }
+}
+
+```
+
+`ebsConfig` supports the following:
+
+* `iops` - (Optional) The number of I/O operations per second (IOPS) that the volume supports.
+* `size` - (Optional) The volume size, in gibibytes (GiB). This can be a number from 1 - 1024. If the volume type is EBS-optimized, the minimum value is 10.
+* `type` - (Optional) The volume type. Valid options are 'gp2', 'io1' and 'standard'.
+* `volumesPerInstance` - (Optional) The number of EBS Volumes to attach per instance.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The EMR Instance ID
+* `runningInstanceCount` The number of instances currently running in this instance group.
+* `status` The current status of the instance group.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EMR task instance group using their EMR Cluster id and Instance Group id separated by a forward-slash `/`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import EMR task instance group using their EMR Cluster id and Instance Group id separated by a forward-slash `/`. For example:
+
+```console
+% terraform import aws_emr_instance_group.task_group j-123456ABCDEF/ig-15EK4O09RZLNR
+```
+
+<!-- cache-key: cdktf-0.18.0 input-81ea0e37ef071af4b0b3288229252058d70fdfc3a60046cd4d509292a38b32f0 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/emr_managed_scaling_policy.html.markdown b/website/docs/cdktf/typescript/r/emr_managed_scaling_policy.html.markdown
new file mode 100644
index 00000000000..29f76c8e02e
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/emr_managed_scaling_policy.html.markdown
@@ -0,0 +1,102 @@
+---
+subcategory: "EMR"
+layout: "aws"
+page_title: "AWS: aws_emr_managed_scaling_policy"
+description: |-
+  Provides a resource for EMR Managed Scaling policy
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_emr_managed_scaling_policy
+
+Provides a Managed Scaling policy for EMR Cluster. With Amazon EMR versions 5.30.0 and later (except for Amazon EMR 6.0.0), you can enable EMR managed scaling to automatically increase or decrease the number of instances or units in your cluster based on workload. See [Using EMR Managed Scaling in Amazon EMR](https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-managed-scaling.html) for more information.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EmrCluster } from "./.gen/providers/aws/emr-cluster";
+import { EmrManagedScalingPolicy } from "./.gen/providers/aws/emr-managed-scaling-policy";
+interface MyConfig {
+  serviceRole: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    const sample = new EmrCluster(this, "sample", {
+      coreInstanceGroup: {
+        instanceType: "c4.large",
+      },
+      masterInstanceGroup: {
+        instanceType: "m4.large",
+      },
+      name: "emr-sample-cluster",
+      releaseLabel: "emr-5.30.0",
+      serviceRole: config.serviceRole,
+    });
+    new EmrManagedScalingPolicy(this, "samplepolicy", {
+      clusterId: sample.id,
+      computeLimits: [
+        {
+          maximumCapacityUnits: 10,
+          maximumCoreCapacityUnits: 10,
+          maximumOndemandCapacityUnits: 2,
+          minimumCapacityUnits: 2,
+          unitType: "Instances",
+        },
+      ],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `clusterId` - (Required) ID of the EMR cluster
+* `computeLimits` - (Required) Configuration block with compute limit settings. Described below.
+
+### compute_limits
+
+* `unitType` - (Required) The unit type used for specifying a managed scaling policy. Valid Values: `instanceFleetUnits` | `instances` | `vcpu`
+* `minimumCapacityUnits` - (Required) The lower boundary of EC2 units. It is measured through VCPU cores or instances for instance groups and measured through units for instance fleets. Managed scaling activities are not allowed beyond this boundary. The limit only applies to the core and task nodes. The master node cannot be scaled after initial configuration.
+* `maximumCapacityUnits` - (Required) The upper boundary of EC2 units. It is measured through VCPU cores or instances for instance groups and measured through units for instance fleets. Managed scaling activities are not allowed beyond this boundary. The limit only applies to the core and task nodes. The master node cannot be scaled after initial configuration.
+* `maximumOndemandCapacityUnits` - (Optional) The upper boundary of On-Demand EC2 units. It is measured through VCPU cores or instances for instance groups and measured through units for instance fleets. The On-Demand units are not allowed to scale beyond this boundary. The parameter is used to split capacity allocation between On-Demand and Spot instances.
+* `maximumCoreCapacityUnits` - (Optional) The upper boundary of EC2 units for core node type in a cluster. It is measured through VCPU cores or instances for instance groups and measured through units for instance fleets. The core units are not allowed to scale beyond this boundary. The parameter is used to split capacity allocation between core and task nodes.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EMR Managed Scaling Policies using the EMR Cluster identifier. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import EMR Managed Scaling Policies using the EMR Cluster identifier. For example:
+
+```console
+% terraform import aws_emr_managed_scaling_policy.example j-123456ABCDEF
+```
+
+<!-- cache-key: cdktf-0.18.0 input-62b04cc94e05c0974582d7b0b1123356847a607e2399a95467c580bdbc32dcb0 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/emr_security_configuration.html.markdown b/website/docs/cdktf/typescript/r/emr_security_configuration.html.markdown
new file mode 100644
index 00000000000..326a5e7abf5
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/emr_security_configuration.html.markdown
@@ -0,0 +1,79 @@
+---
+subcategory: "EMR"
+layout: "aws"
+page_title: "AWS: aws_emr_security_configuration"
+description: |-
+  Provides a resource to manage AWS EMR Security Configurations
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_emr_security_configuration
+
+Provides a resource to manage AWS EMR Security Configurations
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EmrSecurityConfiguration } from "./.gen/providers/aws/emr-security-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new EmrSecurityConfiguration(this, "foo", {
+      configuration:
+        '{\n  "EncryptionConfiguration": {\n    "AtRestEncryptionConfiguration": {\n      "S3EncryptionConfiguration": {\n        "EncryptionMode": "SSE-S3"\n      },\n      "LocalDiskEncryptionConfiguration": {\n        "EncryptionKeyProviderType": "AwsKms",\n        "AwsKmsKey": "arn:aws:kms:us-west-2:187416307283:alias/tf_emr_test_key"\n      }\n    },\n    "EnableInTransitEncryption": false,\n    "EnableAtRestEncryption": true\n  }\n}\n\n',
+      name: "emrsc_other",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Optional) The name of the EMR Security Configuration. By default generated by Terraform.
+* `namePrefix` - (Optional) Creates a unique name beginning with the specified
+  prefix. Conflicts with `name`.
+* `configuration` - (Required) A JSON formatted Security Configuration
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the EMR Security Configuration (Same as the `name`)
+* `name` - The Name of the EMR Security Configuration
+* `configuration` - The JSON formatted Security Configuration
+* `creationDate` - Date the Security Configuration was created
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EMR Security Configurations using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import EMR Security Configurations using the `name`. For example:
+
+```console
+% terraform import aws_emr_security_configuration.sc example-sc-name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-b64a1c2b9d100ab236186e61b15ae97f07452528ddea572b121afa7cc189e40f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/emr_studio.html.markdown b/website/docs/cdktf/typescript/r/emr_studio.html.markdown
new file mode 100644
index 00000000000..3a5d207fc4c
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/emr_studio.html.markdown
@@ -0,0 +1,95 @@
+---
+subcategory: "EMR"
+layout: "aws"
+page_title: "AWS: aws_emr_studio"
+description: |-
+  Provides an Elastic MapReduce Studio
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_emr_studio
+
+Provides an Elastic MapReduce Studio.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EmrStudio } from "./.gen/providers/aws/emr-studio";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new EmrStudio(this, "example", {
+      authMode: "SSO",
+      defaultS3Location: "s3://${" + test.bucket + "}/test",
+      engineSecurityGroupId: Token.asString(awsSecurityGroupTest.id),
+      name: "example",
+      serviceRole: Token.asString(awsIamRoleTest.arn),
+      subnetIds: [Token.asString(awsSubnetTest.id)],
+      userRole: Token.asString(awsIamRoleTest.arn),
+      vpcId: Token.asString(awsVpcTest.id),
+      workspaceSecurityGroupId: Token.asString(awsSecurityGroupTest.id),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `authMode`- (Required) Specifies whether the Studio authenticates users using IAM or Amazon Web Services SSO. Valid values are `sso` or `iam`.
+* `defaultS3Location` - (Required) The Amazon S3 location to back up Amazon EMR Studio Workspaces and notebook files.
+* `name` - (Required) A descriptive name for the Amazon EMR Studio.
+* `engineSecurityGroupId` - (Required) The ID of the Amazon EMR Studio Engine security group. The Engine security group allows inbound network traffic from the Workspace security group, and it must be in the same VPC specified by `vpcId`.
+* `serviceRole` - (Required) The IAM role that the Amazon EMR Studio assumes. The service role provides a way for Amazon EMR Studio to interoperate with other Amazon Web Services services.
+* `subnetIds` - (Required) A list of subnet IDs to associate with the Amazon EMR Studio. A Studio can have a maximum of 5 subnets. The subnets must belong to the VPC specified by `vpcId`. Studio users can create a Workspace in any of the specified subnets.
+* `vpcId` - (Required) The ID of the Amazon Virtual Private Cloud (Amazon VPC) to associate with the Studio.
+* `workspaceSecurityGroupId` - (Required) The ID of the Amazon EMR Studio Workspace security group. The Workspace security group allows outbound network traffic to resources in the Engine security group, and it must be in the same VPC specified by `vpcId`.
+
+The following arguments are optional:
+
+* `description` - (Optional) A detailed description of the Amazon EMR Studio.
+* `idpAuthUrl` - (Optional) The authentication endpoint of your identity provider (IdP). Specify this value when you use IAM authentication and want to let federated users log in to a Studio with the Studio URL and credentials from your IdP. Amazon EMR Studio redirects users to this endpoint to enter credentials.
+* `idpRelayStateParameterName` - (Optional) The name that your identity provider (IdP) uses for its RelayState parameter. For example, RelayState or TargetSource. Specify this value when you use IAM authentication and want to let federated users log in to a Studio using the Studio URL. The RelayState parameter differs by IdP.
+* `tags` - (Optional) list of tags to apply to the EMR Cluster. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `userRole` - (Optional) - The IAM user role that users and groups assume when logged in to an Amazon EMR Studio. Only specify a User Role when you use Amazon Web Services SSO authentication. The permissions attached to the User Role can be scoped down for each user or group using session policies.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn`- ARN of the studio.
+* `url` - The unique access URL of the Amazon EMR Studio.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EMR studios using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import EMR studios using the `id`. For example:
+
+```console
+% terraform import aws_emr_studio.studio es-123456ABCDEF
+```
+
+<!-- cache-key: cdktf-0.18.0 input-61bdc9504022130875c4d8d0fd748ffd340f18084eaa62d5583c0c5041452faf -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/emr_studio_session_mapping.html.markdown b/website/docs/cdktf/typescript/r/emr_studio_session_mapping.html.markdown
new file mode 100644
index 00000000000..f2e36c30390
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/emr_studio_session_mapping.html.markdown
@@ -0,0 +1,78 @@
+---
+subcategory: "EMR"
+layout: "aws"
+page_title: "AWS: aws_emr_studio_session_mapping"
+description: |-
+  Provides an Elastic MapReduce Studio
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_emr_studio_session_mapping
+
+Provides an Elastic MapReduce Studio Session Mapping.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EmrStudioSessionMapping } from "./.gen/providers/aws/emr-studio-session-mapping";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new EmrStudioSessionMapping(this, "example", {
+      identityId: "example",
+      identityType: "USER",
+      sessionPolicyArn: Token.asString(awsIamPolicyExample.arn),
+      studioId: Token.asString(awsEmrStudioExample.id),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `identityId`- (Optional) The globally unique identifier (GUID) of the user or group from the Amazon Web Services SSO Identity Store.
+* `identityName` - (Optional) The name of the user or group from the Amazon Web Services SSO Identity Store.
+* `identityType` - (Required) Specifies whether the identity to map to the Amazon EMR Studio is a `user` or a `group`.
+* `sessionPolicyArn` - (Required) The Amazon Resource Name (ARN) for the session policy that will be applied to the user or group. You should specify the ARN for the session policy that you want to apply, not the ARN of your user role.
+* `studioId` - (Required) The ID of the Amazon EMR Studio to which the user or group will be mapped.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id`- The id of the Elastic MapReduce Studio Session Mapping.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EMR studio session mappings using `studioId:identityType:identityId`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import EMR studio session mappings using `studioId:identityType:identityId`. For example:
+
+```console
+% terraform import aws_emr_studio_session_mapping.example es-xxxxx:USER:xxxxx-xxx-xxx
+```
+
+<!-- cache-key: cdktf-0.18.0 input-6be21ee08f5326f461796bd38e16a942ea254529c5e303950bf2b3a3f049afa4 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/emrcontainers_job_template.html.markdown b/website/docs/cdktf/typescript/r/emrcontainers_job_template.html.markdown
new file mode 100644
index 00000000000..3331340f43d
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/emrcontainers_job_template.html.markdown
@@ -0,0 +1,137 @@
+---
+subcategory: "EMR Containers"
+layout: "aws"
+page_title: "AWS: aws_emrcontainers_job_template"
+description: |-
+  Manages an EMR Containers (EMR on EKS) Job Template
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_emrcontainers_job_template
+
+Manages an EMR Containers (EMR on EKS) Job Template.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EmrcontainersJobTemplate } from "./.gen/providers/aws/emrcontainers-job-template";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new EmrcontainersJobTemplate(this, "example", {
+      jobTemplateData: {
+        executionRoleArn: Token.asString(awsIamRoleExample.arn),
+        jobDriver: {
+          sparkSqlJobDriver: {
+            entryPoint: "default",
+          },
+        },
+        releaseLabel: "emr-6.10.0-latest",
+      },
+      name: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `jobTemplateData` - (Required) The job template data which holds values of StartJobRun API request.
+* `kmsKeyArn` - (Optional) The KMS key ARN used to encrypt the job template.
+* `name` – (Required) The specified name of the job template.
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### job_template_data Arguments
+
+* `configurationOverrides` - (Optional) The configuration settings that are used to override defaults configuration.
+* `executionRoleArn` - (Required) The execution role ARN of the job run.
+* `jobDriver` - (Required) Specify the driver that the job runs on. Exactly one of the two available job drivers is required, either sparkSqlJobDriver or sparkSubmitJobDriver.
+* `jobTags` - (Optional) The tags assigned to jobs started using the job template.
+* `releaseLabel` - (Required) The release version of Amazon EMR.
+
+#### configuration_overrides Arguments
+
+* `applicationConfiguration` - (Optional) The configurations for the application running by the job run.
+* `monitoringConfiguration` - (Optional) The configurations for monitoring.
+
+##### application_configuration Arguments
+
+* `classification` - (Required) The classification within a configuration.
+* `configurations` - (Optional) A list of additional configurations to apply within a configuration object.
+* `properties` - (Optional) A set of properties specified within a configuration classification.
+
+##### monitoring_configuration Arguments
+
+* `cloudWatchMonitoringConfiguration` - (Optional) Monitoring configurations for CloudWatch.
+* `persistentAppUi` - (Optional)  Monitoring configurations for the persistent application UI.
+* `s3MonitoringConfiguration` - (Optional) Amazon S3 configuration for monitoring log publishing.
+
+###### cloud_watch_monitoring_configuration Arguments
+
+* `logGroupName` - (Required) The name of the log group for log publishing.
+* `logStreamNamePrefix` - (Optional) The specified name prefix for log streams.
+
+###### s3_monitoring_configuration Arguments
+
+* `logUri` - (Optional) Amazon S3 destination URI for log publishing.
+
+#### job_driver Arguments
+
+* `sparkSqlJobDriver` - (Optional) The job driver for job type.
+* `sparkSubmitJobDriver` - (Optional) The job driver parameters specified for spark submit.
+
+##### spark_sql_job_driver Arguments
+
+* `entryPoint` - (Optional) The SQL file to be executed.
+* `sparkSqlParameters` - (Optional) The Spark parameters to be included in the Spark SQL command.
+
+##### spark_submit_job_driver Arguments
+
+* `entryPoint` - (Required) The entry point of job application.
+* `entryPointArguments` - (Optional) The arguments for job application.
+* `sparkSubmitParameters` - (Optional) The Spark submit parameters that are used for job runs.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the job template.
+* `id` - The ID of the job template.
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EKS job templates using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import EKS job templates using the `id`. For example:
+
+```console
+% terraform import aws_emrcontainers_job_template.example a1b2c3d4e5f6g7h8i9j10k11l
+```
+
+<!-- cache-key: cdktf-0.18.0 input-40a45aaa72930deebb9754da5bddf771139ffc5f6fcddde32b7b2b44ae90f112 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/emrcontainers_job_template.markdown b/website/docs/cdktf/typescript/r/emrcontainers_job_template.markdown
new file mode 100644
index 00000000000..3331340f43d
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/emrcontainers_job_template.markdown
@@ -0,0 +1,137 @@
+---
+subcategory: "EMR Containers"
+layout: "aws"
+page_title: "AWS: aws_emrcontainers_job_template"
+description: |-
+  Manages an EMR Containers (EMR on EKS) Job Template
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_emrcontainers_job_template
+
+Manages an EMR Containers (EMR on EKS) Job Template.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EmrcontainersJobTemplate } from "./.gen/providers/aws/emrcontainers-job-template";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new EmrcontainersJobTemplate(this, "example", {
+      jobTemplateData: {
+        executionRoleArn: Token.asString(awsIamRoleExample.arn),
+        jobDriver: {
+          sparkSqlJobDriver: {
+            entryPoint: "default",
+          },
+        },
+        releaseLabel: "emr-6.10.0-latest",
+      },
+      name: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `jobTemplateData` - (Required) The job template data which holds values of StartJobRun API request.
+* `kmsKeyArn` - (Optional) The KMS key ARN used to encrypt the job template.
+* `name` – (Required) The specified name of the job template.
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### job_template_data Arguments
+
+* `configurationOverrides` - (Optional) The configuration settings that are used to override defaults configuration.
+* `executionRoleArn` - (Required) The execution role ARN of the job run.
+* `jobDriver` - (Required) Specify the driver that the job runs on. Exactly one of the two available job drivers is required, either sparkSqlJobDriver or sparkSubmitJobDriver.
+* `jobTags` - (Optional) The tags assigned to jobs started using the job template.
+* `releaseLabel` - (Required) The release version of Amazon EMR.
+
+#### configuration_overrides Arguments
+
+* `applicationConfiguration` - (Optional) The configurations for the application running by the job run.
+* `monitoringConfiguration` - (Optional) The configurations for monitoring.
+
+##### application_configuration Arguments
+
+* `classification` - (Required) The classification within a configuration.
+* `configurations` - (Optional) A list of additional configurations to apply within a configuration object.
+* `properties` - (Optional) A set of properties specified within a configuration classification.
+
+##### monitoring_configuration Arguments
+
+* `cloudWatchMonitoringConfiguration` - (Optional) Monitoring configurations for CloudWatch.
+* `persistentAppUi` - (Optional)  Monitoring configurations for the persistent application UI.
+* `s3MonitoringConfiguration` - (Optional) Amazon S3 configuration for monitoring log publishing.
+
+###### cloud_watch_monitoring_configuration Arguments
+
+* `logGroupName` - (Required) The name of the log group for log publishing.
+* `logStreamNamePrefix` - (Optional) The specified name prefix for log streams.
+
+###### s3_monitoring_configuration Arguments
+
+* `logUri` - (Optional) Amazon S3 destination URI for log publishing.
+
+#### job_driver Arguments
+
+* `sparkSqlJobDriver` - (Optional) The job driver for job type.
+* `sparkSubmitJobDriver` - (Optional) The job driver parameters specified for spark submit.
+
+##### spark_sql_job_driver Arguments
+
+* `entryPoint` - (Optional) The SQL file to be executed.
+* `sparkSqlParameters` - (Optional) The Spark parameters to be included in the Spark SQL command.
+
+##### spark_submit_job_driver Arguments
+
+* `entryPoint` - (Required) The entry point of job application.
+* `entryPointArguments` - (Optional) The arguments for job application.
+* `sparkSubmitParameters` - (Optional) The Spark submit parameters that are used for job runs.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the job template.
+* `id` - The ID of the job template.
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EKS job templates using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import EKS job templates using the `id`. For example:
+
+```console
+% terraform import aws_emrcontainers_job_template.example a1b2c3d4e5f6g7h8i9j10k11l
+```
+
+<!-- cache-key: cdktf-0.18.0 input-40a45aaa72930deebb9754da5bddf771139ffc5f6fcddde32b7b2b44ae90f112 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/emrcontainers_virtual_cluster.html.markdown b/website/docs/cdktf/typescript/r/emrcontainers_virtual_cluster.html.markdown
new file mode 100644
index 00000000000..22787a676a5
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/emrcontainers_virtual_cluster.html.markdown
@@ -0,0 +1,94 @@
+---
+subcategory: "EMR Containers"
+layout: "aws"
+page_title: "AWS: aws_emrcontainers_virtual_cluster"
+description: |-
+  Manages an EMR Containers (EMR on EKS) Virtual Cluster
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_emrcontainers_virtual_cluster
+
+Manages an EMR Containers (EMR on EKS) Virtual Cluster.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EmrcontainersVirtualCluster } from "./.gen/providers/aws/emrcontainers-virtual-cluster";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new EmrcontainersVirtualCluster(this, "example", {
+      containerProvider: {
+        id: Token.asString(awsEksClusterExample.name),
+        info: {
+          eksInfo: {
+            namespace: "default",
+          },
+        },
+        type: "EKS",
+      },
+      name: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `containerProvider` - (Required) Configuration block for the container provider associated with your cluster.
+* `name` – (Required) Name of the virtual cluster.
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### container_provider Arguments
+
+* `id` - The name of the container provider that is running your EMR Containers cluster
+* `info` - Nested list containing information about the configuration of the container provider
+    * `eksInfo` - Nested list containing EKS-specific information about the cluster where the EMR Containers cluster is running
+        * `namespace` - The namespace where the EMR Containers cluster is running
+* `type` - The type of the container provider
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the cluster.
+* `id` - The ID of the cluster.
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EKS Clusters using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import EKS Clusters using the `id`. For example:
+
+```console
+% terraform import aws_emrcontainers_virtual_cluster.example a1b2c3d4e5f6g7h8i9j10k11l
+```
+
+<!-- cache-key: cdktf-0.18.0 input-221e0f1e69a0b4a1b86a8c23d4aa75c1195f9ddf4419494ec9832c76d6a2f913 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/emrcontainers_virtual_cluster.markdown b/website/docs/cdktf/typescript/r/emrcontainers_virtual_cluster.markdown
new file mode 100644
index 00000000000..22787a676a5
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/emrcontainers_virtual_cluster.markdown
@@ -0,0 +1,94 @@
+---
+subcategory: "EMR Containers"
+layout: "aws"
+page_title: "AWS: aws_emrcontainers_virtual_cluster"
+description: |-
+  Manages an EMR Containers (EMR on EKS) Virtual Cluster
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_emrcontainers_virtual_cluster
+
+Manages an EMR Containers (EMR on EKS) Virtual Cluster.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EmrcontainersVirtualCluster } from "./.gen/providers/aws/emrcontainers-virtual-cluster";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new EmrcontainersVirtualCluster(this, "example", {
+      containerProvider: {
+        id: Token.asString(awsEksClusterExample.name),
+        info: {
+          eksInfo: {
+            namespace: "default",
+          },
+        },
+        type: "EKS",
+      },
+      name: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `containerProvider` - (Required) Configuration block for the container provider associated with your cluster.
+* `name` – (Required) Name of the virtual cluster.
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### container_provider Arguments
+
+* `id` - The name of the container provider that is running your EMR Containers cluster
+* `info` - Nested list containing information about the configuration of the container provider
+    * `eksInfo` - Nested list containing EKS-specific information about the cluster where the EMR Containers cluster is running
+        * `namespace` - The namespace where the EMR Containers cluster is running
+* `type` - The type of the container provider
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the cluster.
+* `id` - The ID of the cluster.
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EKS Clusters using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import EKS Clusters using the `id`. For example:
+
+```console
+% terraform import aws_emrcontainers_virtual_cluster.example a1b2c3d4e5f6g7h8i9j10k11l
+```
+
+<!-- cache-key: cdktf-0.18.0 input-221e0f1e69a0b4a1b86a8c23d4aa75c1195f9ddf4419494ec9832c76d6a2f913 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/emrserverless_application.html.markdown b/website/docs/cdktf/typescript/r/emrserverless_application.html.markdown
new file mode 100644
index 00000000000..e411e3a0ffd
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/emrserverless_application.html.markdown
@@ -0,0 +1,191 @@
+---
+subcategory: "EMR Serverless"
+layout: "aws"
+page_title: "AWS: aws_emrserverless_application"
+description: |-
+  Manages an EMR Serverless Application
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_emrserverless_application
+
+Manages an EMR Serverless Application.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EmrserverlessApplication } from "./.gen/providers/aws/emrserverless-application";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new EmrserverlessApplication(this, "example", {
+      name: "example",
+      releaseLabel: "emr-6.6.0",
+      type: "hive",
+    });
+  }
+}
+
+```
+
+### Initial Capacity Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EmrserverlessApplication } from "./.gen/providers/aws/emrserverless-application";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new EmrserverlessApplication(this, "example", {
+      initialCapacity: [
+        {
+          initialCapacityConfig: {
+            workerConfiguration: {
+              cpu: "2 vCPU",
+              memory: "10 GB",
+            },
+            workerCount: 1,
+          },
+          initialCapacityType: "HiveDriver",
+        },
+      ],
+      name: "example",
+      releaseLabel: "emr-6.6.0",
+      type: "hive",
+    });
+  }
+}
+
+```
+
+### Maximum Capacity Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EmrserverlessApplication } from "./.gen/providers/aws/emrserverless-application";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new EmrserverlessApplication(this, "example", {
+      maximumCapacity: {
+        cpu: "2 vCPU",
+        memory: "10 GB",
+      },
+      name: "example",
+      releaseLabel: "emr-6.6.0",
+      type: "hive",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `architecture` – (Optional) The CPU architecture of an application. Valid values are `arm64` or `x8664`. Default value is `x8664`.
+* `autoStartConfiguration` – (Optional) The configuration for an application to automatically start on job submission.
+* `autoStopConfiguration` – (Optional) The configuration for an application to automatically stop after a certain amount of time being idle.
+* `imageConfiguration` – (Optional) The image configuration applied to all worker types.
+* `initialCapacity` – (Optional) The capacity to initialize when the application is created.
+* `maximumCapacity` – (Optional) The maximum capacity to allocate when the application is created. This is cumulative across all workers at any given point in time, not just when an application is created. No new resources will be created once any one of the defined limits is hit.
+* `name` – (Required) The name of the application.
+* `networkConfiguration` – (Optional) The network configuration for customer VPC connectivity.
+* `releaseLabel` – (Required) The EMR release version associated with the application.
+* `type` – (Required) The type of application you want to start, such as `spark` or `hive`.
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### auto_start_configuration Arguments
+
+* `enabled` - (Optional) Enables the application to automatically start on job submission. Defaults to `true`.
+
+### auto_stop_configuration Arguments
+
+* `enabled` - (Optional) Enables the application to automatically stop after a certain amount of time being idle. Defaults to `true`.
+* `idleTimeoutMinutes` - (Optional) The amount of idle time in minutes after which your application will automatically stop. Defaults to `15` minutes.
+
+### initial_capacity Arguments
+
+* `initialCapacityConfig` - (Optional) The initial capacity configuration per worker.
+* `initialCapacityType` - (Required) The worker type for an analytics framework. For Spark applications, the key can either be set to `driver` or `executor`. For Hive applications, it can be set to `hiveDriver` or `tezTask`.
+
+### maximum_capacity Arguments
+
+* `cpu` - (Required) The maximum allowed CPU for an application.
+* `disk` - (Optional) The maximum allowed disk for an application.
+* `memory` - (Required) The maximum allowed resources for an application.
+
+### network_configuration Arguments
+
+* `securityGroupIds` - (Optional) The array of security group Ids for customer VPC connectivity.
+* `subnetIds` - (Optional) The array of subnet Ids for customer VPC connectivity.
+
+#### image_configuration Arguments
+
+* `imageUri` - (Required) The image URI.
+
+#### initial_capacity_config Arguments
+
+* `workerConfiguration` - (Optional) The resource configuration of the initial capacity configuration.
+* `workerCount` - (Required) The number of workers in the initial capacity configuration.
+
+##### worker_configuration Arguments
+
+* `cpu` - (Required) The CPU requirements for every worker instance of the worker type.
+* `disk` - (Optional) The disk requirements for every worker instance of the worker type.
+* `memory` - (Required) The memory requirements for every worker instance of the worker type.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the cluster.
+* `id` - The ID of the cluster.
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EMR Severless applications using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import EMR Severless applications using the `id`. For example:
+
+```console
+% terraform import aws_emrserverless_application.example id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-e44c01cb3d0245a04c0ae76333390d6e8ad9c201d82a7409ec4c28eab63c55d0 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/emrserverless_application.markdown b/website/docs/cdktf/typescript/r/emrserverless_application.markdown
new file mode 100644
index 00000000000..e411e3a0ffd
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/emrserverless_application.markdown
@@ -0,0 +1,191 @@
+---
+subcategory: "EMR Serverless"
+layout: "aws"
+page_title: "AWS: aws_emrserverless_application"
+description: |-
+  Manages an EMR Serverless Application
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_emrserverless_application
+
+Manages an EMR Serverless Application.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EmrserverlessApplication } from "./.gen/providers/aws/emrserverless-application";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new EmrserverlessApplication(this, "example", {
+      name: "example",
+      releaseLabel: "emr-6.6.0",
+      type: "hive",
+    });
+  }
+}
+
+```
+
+### Initial Capacity Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EmrserverlessApplication } from "./.gen/providers/aws/emrserverless-application";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new EmrserverlessApplication(this, "example", {
+      initialCapacity: [
+        {
+          initialCapacityConfig: {
+            workerConfiguration: {
+              cpu: "2 vCPU",
+              memory: "10 GB",
+            },
+            workerCount: 1,
+          },
+          initialCapacityType: "HiveDriver",
+        },
+      ],
+      name: "example",
+      releaseLabel: "emr-6.6.0",
+      type: "hive",
+    });
+  }
+}
+
+```
+
+### Maximum Capacity Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EmrserverlessApplication } from "./.gen/providers/aws/emrserverless-application";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new EmrserverlessApplication(this, "example", {
+      maximumCapacity: {
+        cpu: "2 vCPU",
+        memory: "10 GB",
+      },
+      name: "example",
+      releaseLabel: "emr-6.6.0",
+      type: "hive",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `architecture` – (Optional) The CPU architecture of an application. Valid values are `arm64` or `x8664`. Default value is `x8664`.
+* `autoStartConfiguration` – (Optional) The configuration for an application to automatically start on job submission.
+* `autoStopConfiguration` – (Optional) The configuration for an application to automatically stop after a certain amount of time being idle.
+* `imageConfiguration` – (Optional) The image configuration applied to all worker types.
+* `initialCapacity` – (Optional) The capacity to initialize when the application is created.
+* `maximumCapacity` – (Optional) The maximum capacity to allocate when the application is created. This is cumulative across all workers at any given point in time, not just when an application is created. No new resources will be created once any one of the defined limits is hit.
+* `name` – (Required) The name of the application.
+* `networkConfiguration` – (Optional) The network configuration for customer VPC connectivity.
+* `releaseLabel` – (Required) The EMR release version associated with the application.
+* `type` – (Required) The type of application you want to start, such as `spark` or `hive`.
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### auto_start_configuration Arguments
+
+* `enabled` - (Optional) Enables the application to automatically start on job submission. Defaults to `true`.
+
+### auto_stop_configuration Arguments
+
+* `enabled` - (Optional) Enables the application to automatically stop after a certain amount of time being idle. Defaults to `true`.
+* `idleTimeoutMinutes` - (Optional) The amount of idle time in minutes after which your application will automatically stop. Defaults to `15` minutes.
+
+### initial_capacity Arguments
+
+* `initialCapacityConfig` - (Optional) The initial capacity configuration per worker.
+* `initialCapacityType` - (Required) The worker type for an analytics framework. For Spark applications, the key can either be set to `driver` or `executor`. For Hive applications, it can be set to `hiveDriver` or `tezTask`.
+
+### maximum_capacity Arguments
+
+* `cpu` - (Required) The maximum allowed CPU for an application.
+* `disk` - (Optional) The maximum allowed disk for an application.
+* `memory` - (Required) The maximum allowed resources for an application.
+
+### network_configuration Arguments
+
+* `securityGroupIds` - (Optional) The array of security group Ids for customer VPC connectivity.
+* `subnetIds` - (Optional) The array of subnet Ids for customer VPC connectivity.
+
+#### image_configuration Arguments
+
+* `imageUri` - (Required) The image URI.
+
+#### initial_capacity_config Arguments
+
+* `workerConfiguration` - (Optional) The resource configuration of the initial capacity configuration.
+* `workerCount` - (Required) The number of workers in the initial capacity configuration.
+
+##### worker_configuration Arguments
+
+* `cpu` - (Required) The CPU requirements for every worker instance of the worker type.
+* `disk` - (Optional) The disk requirements for every worker instance of the worker type.
+* `memory` - (Required) The memory requirements for every worker instance of the worker type.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the cluster.
+* `id` - The ID of the cluster.
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EMR Severless applications using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import EMR Severless applications using the `id`. For example:
+
+```console
+% terraform import aws_emrserverless_application.example id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-e44c01cb3d0245a04c0ae76333390d6e8ad9c201d82a7409ec4c28eab63c55d0 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/evidently_feature.html.markdown b/website/docs/cdktf/typescript/r/evidently_feature.html.markdown
new file mode 100644
index 00000000000..0b67ee9b9c3
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/evidently_feature.html.markdown
@@ -0,0 +1,246 @@
+---
+subcategory: "CloudWatch Evidently"
+layout: "aws"
+page_title: "AWS: aws_evidently_feature"
+description: |-
+  Provides a CloudWatch Evidently Feature resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_evidently_feature
+
+Provides a CloudWatch Evidently Feature resource.
+
+## Example Usage
+
+### Basic
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EvidentlyFeature } from "./.gen/providers/aws/evidently-feature";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new EvidentlyFeature(this, "example", {
+      description: "example description",
+      name: "example",
+      project: Token.asString(awsEvidentlyProjectExample.name),
+      tags: {
+        Key1: "example Feature",
+      },
+      variations: [
+        {
+          name: "Variation1",
+          value: {
+            stringValue: "example",
+          },
+        },
+      ],
+    });
+  }
+}
+
+```
+
+### With default variation
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EvidentlyFeature } from "./.gen/providers/aws/evidently-feature";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new EvidentlyFeature(this, "example", {
+      defaultVariation: "Variation2",
+      name: "example",
+      project: Token.asString(awsEvidentlyProjectExample.name),
+      variations: [
+        {
+          name: "Variation1",
+          value: {
+            stringValue: "exampleval1",
+          },
+        },
+        {
+          name: "Variation2",
+          value: {
+            stringValue: "exampleval2",
+          },
+        },
+      ],
+    });
+  }
+}
+
+```
+
+### With entity overrides
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EvidentlyFeature } from "./.gen/providers/aws/evidently-feature";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new EvidentlyFeature(this, "example", {
+      entityOverrides: {
+        test1: "Variation1",
+      },
+      name: "example",
+      project: Token.asString(awsEvidentlyProjectExample.name),
+      variations: [
+        {
+          name: "Variation1",
+          value: {
+            stringValue: "exampleval1",
+          },
+        },
+        {
+          name: "Variation2",
+          value: {
+            stringValue: "exampleval2",
+          },
+        },
+      ],
+    });
+  }
+}
+
+```
+
+### With evaluation strategy
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EvidentlyFeature } from "./.gen/providers/aws/evidently-feature";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new EvidentlyFeature(this, "example", {
+      entityOverrides: {
+        test1: "Variation1",
+      },
+      evaluationStrategy: "ALL_RULES",
+      name: "example",
+      project: Token.asString(awsEvidentlyProjectExample.name),
+      variations: [
+        {
+          name: "Variation1",
+          value: {
+            stringValue: "exampleval1",
+          },
+        },
+      ],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `defaultVariation` - (Optional) The name of the variation to use as the default variation. The default variation is served to users who are not allocated to any ongoing launches or experiments of this feature. This variation must also be listed in the `variations` structure. If you omit `defaultVariation`, the first variation listed in the `variations` structure is used as the default variation.
+* `description` - (Optional) Specifies the description of the feature.
+* `entityOverrides` - (Optional) Specify users that should always be served a specific variation of a feature. Each user is specified by a key-value pair . For each key, specify a user by entering their user ID, account ID, or some other identifier. For the value, specify the name of the variation that they are to be served.
+* `evaluationStrategy` - (Optional) Specify `allRules` to activate the traffic allocation specified by any ongoing launches or experiments. Specify `defaultVariation` to serve the default variation to all users instead.
+* `name` - (Required) The name for the new feature. Minimum length of `1`. Maximum length of `127`.
+* `project` - (Required) The name or ARN of the project that is to contain the new feature.
+* `tags` - (Optional) Tags to apply to the feature. If configured with a provider [`defaultTags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `variations` - (Required) One or more blocks that contain the configuration of the feature's different variations. [Detailed below](#variations)
+
+### `variations`
+
+The `variations` block supports the following arguments:
+
+* `name` - (Required) The name of the variation. Minimum length of `1`. Maximum length of `127`.
+* `value` - (Required) A block that specifies the value assigned to this variation. [Detailed below](#value)
+
+#### `value`
+
+The `value` block supports the following arguments:
+
+~> **NOTE:** You must specify exactly one of `boolValue`, `doubleValue`, `longValue`, `stringValue`.
+
+* `boolValue` - (Optional) If this feature uses the Boolean variation type, this field contains the Boolean value of this variation.
+* `doubleValue` - (Optional) If this feature uses the double integer variation type, this field contains the double integer value of this variation.
+* `longValue` - (Optional) If this feature uses the long variation type, this field contains the long value of this variation. Minimum value of `9007199254740991`. Maximum value of `9007199254740991`.
+* `stringValue` - (Optional) If this feature uses the string variation type, this field contains the string value of this variation. Minimum length of `0`. Maximum length of `512`.
+
+## Timeouts
+
+[Configuration options](https://www.terraform.io/docs/configuration/blocks/resources/syntax.html#operation-timeouts):
+
+* `create` - (Default `2M`)
+* `delete` - (Default `2M`)
+* `update` - (Default `2M`)
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the feature.
+* `createdTime` - The date and time that the feature is created.
+* `evaluationRules` - One or more blocks that define the evaluation rules for the feature. [Detailed below](#evaluation_rules)
+* `id` - The feature `name` and the project `name` or `arn` separated by a colon (`:`).
+* `lastUpdatedTime` - The date and time that the feature was most recently updated.
+* `status` - The current state of the feature. Valid values are `available` and `updating`.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block).
+* `valueType` - Defines the type of value used to define the different feature variations. Valid Values: `string`, `long`, `double`, `boolean`.
+
+### `evaluationRules`
+
+The `evaluationRules` block supports the following attributes:
+
+* `name` - The name of the experiment or launch.
+* `type` - This value is `awsEvidentlySplits` if this is an evaluation rule for a launch, and it is `awsEvidentlyOnlineab` if this is an evaluation rule for an experiment.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudWatch Evidently Feature using the feature `name` and `name` or `arn` of the hosting CloudWatch Evidently Project separated by a `:`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import CloudWatch Evidently Feature using the feature `name` and `name` or `arn` of the hosting CloudWatch Evidently Project separated by a `:`. For example:
+
+```console
+% terraform import aws_evidently_feature.example exampleFeatureName:arn:aws:evidently:us-east-1:123456789012:project/example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-d3315398a5d858c2584803f038f31f451feb575e340aad72583ed89839e493c9 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/evidently_launch.html.markdown b/website/docs/cdktf/typescript/r/evidently_launch.html.markdown
new file mode 100644
index 00000000000..496d172866c
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/evidently_launch.html.markdown
@@ -0,0 +1,498 @@
+---
+subcategory: "CloudWatch Evidently"
+layout: "aws"
+page_title: "AWS: aws_evidently_launch"
+description: |-
+  Provides a CloudWatch Evidently Launch resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_evidently_launch
+
+Provides a CloudWatch Evidently Launch resource.
+
+## Example Usage
+
+### Basic
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EvidentlyLaunch } from "./.gen/providers/aws/evidently-launch";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new EvidentlyLaunch(this, "example", {
+      groups: [
+        {
+          feature: Token.asString(awsEvidentlyFeatureExample.name),
+          name: "Variation1",
+          variation: "Variation1",
+        },
+      ],
+      name: "example",
+      project: Token.asString(awsEvidentlyProjectExample.name),
+      scheduledSplitsConfig: {
+        steps: [
+          {
+            groupWeights: {
+              Variation1: 0,
+            },
+            startTime: "2024-01-07 01:43:59+00:00",
+          },
+        ],
+      },
+    });
+  }
+}
+
+```
+
+### With description
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EvidentlyLaunch } from "./.gen/providers/aws/evidently-launch";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new EvidentlyLaunch(this, "example", {
+      description: "example description",
+      groups: [
+        {
+          feature: Token.asString(awsEvidentlyFeatureExample.name),
+          name: "Variation1",
+          variation: "Variation1",
+        },
+      ],
+      name: "example",
+      project: Token.asString(awsEvidentlyProjectExample.name),
+      scheduledSplitsConfig: {
+        steps: [
+          {
+            groupWeights: {
+              Variation1: 0,
+            },
+            startTime: "2024-01-07 01:43:59+00:00",
+          },
+        ],
+      },
+    });
+  }
+}
+
+```
+
+### With multiple groups
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EvidentlyLaunch } from "./.gen/providers/aws/evidently-launch";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new EvidentlyLaunch(this, "example", {
+      groups: [
+        {
+          description: "first-group",
+          feature: Token.asString(awsEvidentlyFeatureExample.name),
+          name: "Variation1",
+          variation: "Variation1",
+        },
+        {
+          description: "second-group",
+          feature: Token.asString(awsEvidentlyFeatureExample.name),
+          name: "Variation2",
+          variation: "Variation2",
+        },
+      ],
+      name: "example",
+      project: Token.asString(awsEvidentlyProjectExample.name),
+      scheduledSplitsConfig: {
+        steps: [
+          {
+            groupWeights: {
+              Variation1: 0,
+              Variation2: 0,
+            },
+            startTime: "2024-01-07 01:43:59+00:00",
+          },
+        ],
+      },
+    });
+  }
+}
+
+```
+
+### With metric_monitors
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EvidentlyLaunch } from "./.gen/providers/aws/evidently-launch";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new EvidentlyLaunch(this, "example", {
+      groups: [
+        {
+          feature: Token.asString(awsEvidentlyFeatureExample.name),
+          name: "Variation1",
+          variation: "Variation1",
+        },
+      ],
+      metricMonitors: [
+        {
+          metricDefinition: {
+            entityIdKey: "entity_id_key1",
+            eventPattern:
+              '{\\"Price\\":[{\\"numeric\\":[\\">\\",11,\\"<=\\",22]}]}',
+            name: "name1",
+            unitLabel: "unit_label1",
+            valueKey: "value_key1",
+          },
+        },
+        {
+          metricDefinition: {
+            entityIdKey: "entity_id_key2",
+            eventPattern:
+              '{\\"Price\\":[{\\"numeric\\":[\\">\\",9,\\"<=\\",19]}]}',
+            name: "name2",
+            unitLabel: "unit_label2",
+            valueKey: "value_key2",
+          },
+        },
+      ],
+      name: "example",
+      project: Token.asString(awsEvidentlyProjectExample.name),
+      scheduledSplitsConfig: {
+        steps: [
+          {
+            groupWeights: {
+              Variation1: 0,
+            },
+            startTime: "2024-01-07 01:43:59+00:00",
+          },
+        ],
+      },
+    });
+  }
+}
+
+```
+
+### With randomization_salt
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EvidentlyLaunch } from "./.gen/providers/aws/evidently-launch";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new EvidentlyLaunch(this, "example", {
+      groups: [
+        {
+          feature: Token.asString(awsEvidentlyFeatureExample.name),
+          name: "Variation1",
+          variation: "Variation1",
+        },
+      ],
+      name: "example",
+      project: Token.asString(awsEvidentlyProjectExample.name),
+      randomizationSalt: "example randomization salt",
+      scheduledSplitsConfig: {
+        steps: [
+          {
+            groupWeights: {
+              Variation1: 0,
+            },
+            startTime: "2024-01-07 01:43:59+00:00",
+          },
+        ],
+      },
+    });
+  }
+}
+
+```
+
+### With multiple steps
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EvidentlyLaunch } from "./.gen/providers/aws/evidently-launch";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new EvidentlyLaunch(this, "example", {
+      groups: [
+        {
+          feature: Token.asString(awsEvidentlyFeatureExample.name),
+          name: "Variation1",
+          variation: "Variation1",
+        },
+        {
+          feature: Token.asString(awsEvidentlyFeatureExample.name),
+          name: "Variation2",
+          variation: "Variation2",
+        },
+      ],
+      name: "example",
+      project: Token.asString(awsEvidentlyProjectExample.name),
+      scheduledSplitsConfig: {
+        steps: [
+          {
+            groupWeights: {
+              Variation1: 15,
+              Variation2: 10,
+            },
+            startTime: "2024-01-07 01:43:59+00:00",
+          },
+          {
+            groupWeights: {
+              Variation1: 20,
+              Variation2: 25,
+            },
+            startTime: "2024-01-08 01:43:59+00:00",
+          },
+        ],
+      },
+    });
+  }
+}
+
+```
+
+### With segment overrides
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EvidentlyLaunch } from "./.gen/providers/aws/evidently-launch";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new EvidentlyLaunch(this, "example", {
+      groups: [
+        {
+          feature: Token.asString(awsEvidentlyFeatureExample.name),
+          name: "Variation1",
+          variation: "Variation1",
+        },
+        {
+          feature: Token.asString(awsEvidentlyFeatureExample.name),
+          name: "Variation2",
+          variation: "Variation2",
+        },
+      ],
+      name: "example",
+      project: Token.asString(awsEvidentlyProjectExample.name),
+      scheduledSplitsConfig: {
+        steps: [
+          {
+            groupWeights: {
+              Variation1: 0,
+              Variation2: 0,
+            },
+            segmentOverrides: [
+              {
+                evaluationOrder: 1,
+                segment: Token.asString(awsEvidentlySegmentExample.name),
+                weights: {
+                  Variation2: 10000,
+                },
+              },
+              {
+                evaluationOrder: 2,
+                segment: Token.asString(awsEvidentlySegmentExample.name),
+                weights: {
+                  Variation1: 40000,
+                  Variation2: 30000,
+                },
+              },
+            ],
+            startTime: "2024-01-08 01:43:59+00:00",
+          },
+        ],
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `description` - (Optional) Specifies the description of the launch.
+* `groups` - (Required) One or up to five blocks that contain the feature and variations that are to be used for the launch. [Detailed below](#groups).
+* `metricMonitors` - (Optional) One or up to three blocks that define the metrics that will be used to monitor the launch performance. [Detailed below](#metric_monitors).
+* `name` - (Required) The name for the new launch. Minimum length of `1`. Maximum length of `127`.
+* `project` - (Required) The name or ARN of the project that is to contain the new launch.
+* `randomizationSalt` - (Optional) When Evidently assigns a particular user session to a launch, it must use a randomization ID to determine which variation the user session is served. This randomization ID is a combination of the entity ID and randomizationSalt. If you omit randomizationSalt, Evidently uses the launch name as the randomizationSalt.
+* `scheduledSplitsConfig` - (Optional) A block that defines the traffic allocation percentages among the feature variations during each step of the launch. [Detailed below](#scheduled_splits_config).
+* `tags` - (Optional) Tags to apply to the launch. If configured with a provider [`defaultTags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### `groups`
+
+The `groups` block supports the following arguments:
+
+* `description` - (Optional) Specifies the description of the launch group.
+* `feature` - (Required) Specifies the name of the feature that the launch is using.
+* `name` - (Required) Specifies the name of the lahnch group.
+* `variation` - (Required) Specifies the feature variation to use for this launch group.
+
+### `metricMonitors`
+
+The `metricMonitors` block supports the following arguments:
+
+* `metricDefinition` - (Required) A block that defines the metric. [Detailed below](#metric_definition).
+
+#### `metricDefinition`
+
+The `metricDefinition` block supports the following arguments:
+
+* `entityIdKey` - (Required) Specifies the entity, such as a user or session, that does an action that causes a metric value to be recorded. An example is `userDetailsUserId`.
+* `eventPattern` - (Required) Specifies The EventBridge event pattern that defines how the metric is recorded.
+* `name` - (Required) Specifies the name for the metric.
+* `unitLabel` - (Optional) Specifies a label for the units that the metric is measuring.
+* `valueKey` - (Required) Specifies the value that is tracked to produce the metric.
+
+### `scheduledSplitsConfig`
+
+The `scheduledSplitsConfig` block supports the following arguments:
+
+* `steps` - (Required) One or up to six blocks that define the traffic allocation percentages among the feature variations during each step of the launch. This also defines the start time of each step. [Detailed below](#steps).
+
+#### `steps`
+
+The `steps` block supports the following arguments:
+
+* `groupWeights` - (Required) The traffic allocation percentages among the feature variations during one step of a launch. This is a set of key-value pairs. The keys are variation names. The values represent the percentage of traffic to allocate to that variation during this step. For more information, refer to the [AWS documentation for ScheduledSplitConfig groupWeights](https://docs.aws.amazon.com/cloudwatchevidently/latest/APIReference/API_ScheduledSplitConfig.html).
+* `segmentOverrides` - (Required) One or up to six blocks that specify different traffic splits for one or more audience segments. A segment is a portion of your audience that share one or more characteristics. Examples could be Chrome browser users, users in Europe, or Firefox browser users in Europe who also fit other criteria that your application collects, such as age. [Detailed below](#segment_overrides).
+* `startTime` - (Required) Specifies the date and time that this step of the launch starts.
+
+##### `segmentOverrides`
+
+* `evaluationOrder` - (Required) Specifies a number indicating the order to use to evaluate segment overrides, if there are more than one. Segment overrides with lower numbers are evaluated first.
+* `segment` - (Required) The name or ARN of the segment to use.
+* `weights` - (Required) The traffic allocation percentages among the feature variations to assign to this segment. This is a set of key-value pairs. The keys are variation names. The values represent the amount of traffic to allocate to that variation for this segment. This is expressed in thousandths of a percent, so a weight of 50000 represents 50% of traffic.
+
+## Timeouts
+
+[Configuration options](https://www.terraform.io/docs/configuration/blocks/resources/syntax.html#operation-timeouts):
+
+* `create` - (Default `2M`)
+* `delete` - (Default `2M`)
+* `update` - (Default `2M`)
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the launch.
+* `createdTime` - The date and time that the launch is created.
+* `execution` - A block that contains information about the start and end times of the launch. [Detailed below](#execution)
+* `id` - The launch `name` and the project `name` or `arn` separated by a colon (`:`).
+* `lastUpdatedTime` - The date and time that the launch was most recently updated.
+* `status` - The current state of the launch. Valid values are `created`, `updating`, `running`, `completed`, and `cancelled`.
+* `statusReason` - If the launch was stopped, this is the string that was entered by the person who stopped the launch, to explain why it was stopped.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block).
+* `type` - The type of launch.
+
+### `execution`
+
+The `execution` block supports the following attributes:
+
+* `endedTime` - The date and time that the launch ended.
+* `startedTime` - The date and time that the launch started.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudWatch Evidently Launch using the `name` of the launch and `name` of the project or `arn` of the hosting CloudWatch Evidently Project separated by a `:`. For example:
+
+Import using the `name` of the launch and `name` of the project separated by a `:`:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Import using the `name` of the launch and `arn` of the project separated by a `:`:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+**Using `terraform import` to import** CloudWatch Evidently Launch using the `name` of the launch and `name` of the project or `arn` of the hosting CloudWatch Evidently Project separated by a `:`. For example:
+
+Import using the `name` of the launch and `name` of the project separated by a `:`:
+
+```console
+% terraform import aws_evidently_launch.example exampleLaunchName:exampleProjectName
+```
+
+Import using the `name` of the launch and `arn` of the project separated by a `:`:
+
+```console
+% terraform import aws_evidently_launch.example exampleLaunchName:arn:aws:evidently:us-east-1:123456789012:project/exampleProjectName
+```
+
+<!-- cache-key: cdktf-0.18.0 input-aae11bd8a9c8b5e230e84e3f211fbabba6612255938e01ceece5ed580fbee328 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/evidently_project.html.markdown b/website/docs/cdktf/typescript/r/evidently_project.html.markdown
new file mode 100644
index 00000000000..03e470ca15c
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/evidently_project.html.markdown
@@ -0,0 +1,177 @@
+---
+subcategory: "CloudWatch Evidently"
+layout: "aws"
+page_title: "AWS: aws_evidently_project"
+description: |-
+  Provides a CloudWatch Evidently Project resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_evidently_project
+
+Provides a CloudWatch Evidently Project resource.
+
+## Example Usage
+
+### Basic
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EvidentlyProject } from "./.gen/providers/aws/evidently-project";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new EvidentlyProject(this, "example", {
+      description: "Example Description",
+      name: "Example",
+      tags: {
+        Key1: "example Project",
+      },
+    });
+  }
+}
+
+```
+
+### Store evaluation events in a CloudWatch Log Group
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EvidentlyProject } from "./.gen/providers/aws/evidently-project";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new EvidentlyProject(this, "example", {
+      dataDelivery: {
+        cloudwatchLogs: {
+          logGroup: "example-log-group-name",
+        },
+      },
+      description: "Example Description",
+      name: "Example",
+      tags: {
+        Key1: "example Project",
+      },
+    });
+  }
+}
+
+```
+
+### Store evaluation events in an S3 bucket
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EvidentlyProject } from "./.gen/providers/aws/evidently-project";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new EvidentlyProject(this, "example", {
+      dataDelivery: {
+        s3Destination: {
+          bucket: "example-bucket-name",
+          prefix: "example",
+        },
+      },
+      description: "Example Description",
+      name: "Example",
+      tags: {
+        Key1: "example Project",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `dataDelivery` - (Optional) A block that contains information about where Evidently is to store evaluation events for longer term storage, if you choose to do so. If you choose not to store these events, Evidently deletes them after using them to produce metrics and other experiment results that you can view. See below.
+* `description` - (Optional) Specifies the description of the project.
+* `name` - (Required) A name for the project.
+* `tags` - (Optional) Tags to apply to the project. If configured with a provider [`defaultTags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+The `dataDelivery` block supports the following arguments:
+
+~> **NOTE:** You can't specify both `cloudwatchLogs` and `s3Destination`.
+
+* `cloudwatchLogs` - (Optional) A block that defines the CloudWatch Log Group that stores the evaluation events. See below.
+* `s3Destination` - (Optional) A block that defines the S3 bucket and prefix that stores the evaluation events. See below.
+
+The `cloudwatchLogs` block supports the following arguments:
+
+* `logGroup` - (Optional) The name of the log group where the project stores evaluation events.
+
+The `s3Destination` block supports the following arguments:
+
+* `bucket` - (Optional) The name of the bucket in which Evidently stores evaluation events.
+* `prefix` - (Optional) The bucket prefix in which Evidently stores evaluation events.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `2M`)
+* `delete` - (Default `2M`)
+* `update` - (Default `2M`)
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `activeExperimentCount` - The number of ongoing experiments currently in the project.
+* `activeLaunchCount` - The number of ongoing launches currently in the project.
+* `arn` - The ARN of the project.
+* `createdTime` - The date and time that the project is created.
+* `experimentCount` - The number of experiments currently in the project. This includes all experiments that have been created and not deleted, whether they are ongoing or not.
+* `featureCount` - The number of features currently in the project.
+* `id` - The ID has the same value as the arn of the project.
+* `lastUpdatedTime` - The date and time that the project was most recently updated.
+* `launchCount` - The number of launches currently in the project. This includes all launches that have been created and not deleted, whether they are ongoing or not.
+* `status` - The current state of the project. Valid values are `available` and `updating`.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudWatch Evidently Project using the `arn`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import CloudWatch Evidently Project using the `arn`. For example:
+
+```console
+% terraform import aws_evidently_project.example arn:aws:evidently:us-east-1:123456789012:segment/example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-98108c26628ca8c5832f4e1d0f90d72906605975ec0417106000b17f811ac230 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/evidently_segment.html.markdown b/website/docs/cdktf/typescript/r/evidently_segment.html.markdown
new file mode 100644
index 00000000000..e6a577ca8ee
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/evidently_segment.html.markdown
@@ -0,0 +1,137 @@
+---
+subcategory: "CloudWatch Evidently"
+layout: "aws"
+page_title: "AWS: aws_evidently_segment"
+description: |-
+  Provides a CloudWatch Evidently Segment resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_evidently_segment
+
+Provides a CloudWatch Evidently Segment resource.
+
+## Example Usage
+
+### Basic
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EvidentlySegment } from "./.gen/providers/aws/evidently-segment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new EvidentlySegment(this, "example", {
+      name: "example",
+      pattern: '{\\"Price\\":[{\\"numeric\\":[\\">\\",10,\\"<=\\",20]}]}',
+      tags: {
+        Key1: "example Segment",
+      },
+    });
+  }
+}
+
+```
+
+### With JSON object in pattern
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EvidentlySegment } from "./.gen/providers/aws/evidently-segment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new EvidentlySegment(this, "example", {
+      name: "example",
+      pattern:
+        '  {\n    "Price": [\n      {\n        "numeric": [">",10,"<=",20]\n      }\n    ]\n  }\n\n',
+      tags: {
+        Key1: "example Segment",
+      },
+    });
+  }
+}
+
+```
+
+### With Description
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EvidentlySegment } from "./.gen/providers/aws/evidently-segment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new EvidentlySegment(this, "example", {
+      description: "example",
+      name: "example",
+      pattern: '{\\"Price\\":[{\\"numeric\\":[\\">\\",10,\\"<=\\",20]}]}',
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `description` - (Optional, Forces new resource) Specifies the description of the segment.
+* `name` - (Required, Forces new resource) A name for the segment.
+* `pattern` - (Required, Forces new resource) The pattern to use for the segment. For more information about pattern syntax, see [Segment rule pattern syntax](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-Evidently-segments.html#CloudWatch-Evidently-segments-syntax.html).
+* `tags` - (Optional) Tags to apply to the segment. If configured with a provider [`defaultTags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the segment.
+* `createdTime` - The date and time that the segment is created.
+* `experimentCount` - The number of experiments that this segment is used in. This count includes all current experiments, not just those that are currently running.
+* `id` - The ID has the same value as the ARN of the segment.
+* `lastUpdatedTime` - The date and time that this segment was most recently updated.
+* `launchCount` - The number of launches that this segment is used in. This count includes all current launches, not just those that are currently running.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudWatch Evidently Segment using the `arn`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import CloudWatch Evidently Segment using the `arn`. For example:
+
+```console
+% terraform import aws_evidently_segment.example arn:aws:evidently:us-west-2:123456789012:segment/example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-8f4f148ae07fcc5e61c1f38f8166eb6097494f8e5ccee4064e248569af124d84 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/finspace_kx_cluster.html.markdown b/website/docs/cdktf/typescript/r/finspace_kx_cluster.html.markdown
new file mode 100644
index 00000000000..8dd7ee86a47
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/finspace_kx_cluster.html.markdown
@@ -0,0 +1,223 @@
+---
+subcategory: "FinSpace"
+layout: "aws"
+page_title: "AWS: aws_finspace_kx_cluster"
+description: |-
+  Terraform resource for managing an AWS FinSpace Kx Cluster.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_finspace_kx_cluster
+
+Terraform resource for managing an AWS FinSpace Kx Cluster.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { FinspaceKxCluster } from "./.gen/providers/aws/finspace-kx-cluster";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new FinspaceKxCluster(this, "example", {
+      availabilityZoneId: "use1-az2",
+      azMode: "SINGLE",
+      cacheStorageConfigurations: [
+        {
+          size: 1200,
+          type: "CACHE_1000",
+        },
+      ],
+      capacityConfiguration: {
+        nodeCount: 2,
+        nodeType: "kx.s.2xlarge",
+      },
+      code: {
+        s3Bucket: test.id,
+        s3Key: object.key,
+      },
+      database: [
+        {
+          cache_configuration: [
+            {
+              cache_type: "CACHE_1000",
+              db_paths: "/",
+            },
+          ],
+          databaseName: Token.asString(awsFinspaceKxDatabaseExample.name),
+        },
+      ],
+      environmentId: Token.asString(awsFinspaceKxEnvironmentExample.id),
+      name: "my-tf-kx-cluster",
+      releaseLabel: "1.0",
+      type: "HDB",
+      vpcConfiguration: {
+        ipAddressType: "IP_V4",
+        securityGroupIds: [Token.asString(awsSecurityGroupExample.id)],
+        subnetIds: [Token.asString(awsSubnetExample.id)],
+        vpcId: Token.asString(awsVpcTest.id),
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `azMode` - (Required) The number of availability zones you want to assign per cluster. This can be one of the following:
+    * SINGLE - Assigns one availability zone per cluster.
+    * MULTI - Assigns all the availability zones per cluster.
+* `capacityConfiguration` - (Required) Structure for the metadata of a cluster. Includes information like the CPUs needed, memory of instances, and number of instances. See [capacity_configuration](#capacity_configuration).
+* `environmentId` - (Required) Unique identifier for the KX environment.
+* `name` - (Required) Unique name for the cluster that you want to create.
+* `releaseLabel` - (Required) Version of FinSpace Managed kdb to run.
+* `type` - (Required) Type of KDB database. The following types are available:
+    * HDB - Historical Database. The data is only accessible with read-only permissions from one of the FinSpace managed KX databases mounted to the cluster.
+    * RDB - Realtime Database. This type of database captures all the data from a ticker plant and stores it in memory until the end of day, after which it writes all of its data to a disk and reloads the HDB. This cluster type requires local storage for temporary storage of data during the savedown process. If you specify this field in your request, you must provide the `savedownStorageConfiguration` parameter.
+    * GATEWAY - A gateway cluster allows you to access data across processes in kdb systems. It allows you to create your own routing logic using the initialization scripts and custom code. This type of cluster does not require a  writable local storage.
+* `vpcConfiguration` - (Required) Configuration details about the network where the Privatelink endpoint of the cluster resides. See [vpc_configuration](#vpc_configuration).
+
+The following arguments are optional:
+
+* `autoScalingConfiguration` - (Optional) Configuration based on which FinSpace will scale in or scale out nodes in your cluster. See [auto_scaling_configuration](#auto_scaling_configuration).
+* `availabilityZoneId` - (Optional) The availability zone identifiers for the requested regions. Required when `azMode` is set to SINGLE.
+* `cacheStorageConfigurations` - (Optional) Configurations for a read only cache storage associated with a cluster. This cache will be stored as an FSx Lustre that reads from the S3 store. See [cache_storage_configuration](#cache_storage_configuration).
+* `code` - (Optional) Details of the custom code that you want to use inside a cluster when analyzing data. Consists of the S3 source bucket, location, object version, and the relative path from where the custom code is loaded into the cluster. See [code](#code).
+* `commandLineArguments` - (Optional) List of key-value pairs to make available inside the cluster.
+* `database` - (Optional) KX database that will be available for querying. Defined below.
+* `description` - (Optional) Description of the cluster.
+* `executionRole` - (Optional) An IAM role that defines a set of permissions associated with a cluster. These permissions are assumed when a cluster attempts to access another cluster.
+* `initializationScript` - (Optional) Path to Q program that will be run at launch of a cluster. This is a relative path within .zip file that contains the custom code, which will be loaded on the cluster. It must include the file name itself. For example, somedir/init.q.
+* `savedownStorageConfiguration` - (Optional) Size and type of the temporary storage that is used to hold data during the savedown process. This parameter is required when you choose `type` as RDB. All the data written to this storage space is lost when the cluster node is restarted. See [savedown_storage_configuration](#savedown_storage_configuration).
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`defaultTags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### auto_scaling_configuration
+
+The auto_scaling_configuration block supports the following arguments:
+
+* `autoScalingMetric` - (Required) Metric your cluster will track in order to scale in and out. For example, CPU_UTILIZATION_PERCENTAGE is the average CPU usage across all nodes in a cluster.
+* `minNodeCount` - (Required) Lowest number of nodes to scale. Must be at least 1 and less than the `maxNodeCount`. If nodes in cluster belong to multiple availability zones, then `minNodeCount` must be at least 3.
+* `maxNodeCount` - (Required) Highest number of nodes to scale. Cannot be greater than 5
+* `metricTarget` - (Required) Desired value of chosen `autoScalingMetric`. When metric drops below this value, cluster will scale in. When metric goes above this value, cluster will scale out. Can be set between 0 and 100 percent.
+* `scaleInCooldownSeconds` - (Required) Duration in seconds that FinSpace will wait after a scale in event before initiating another scaling event.
+* `scaleOutCooldownSeconds` - (Required) Duration in seconds that FinSpace will wait after a scale out event before initiating another scaling event.
+
+### capacity_configuration
+
+The capacity_configuration block supports the following arguments:
+
+* `nodeType` - (Required) Determines the hardware of the host computer used for your cluster instance. Each node type offers different memory and storage capabilities. Choose a node type based on the requirements of the application or software that you plan to run on your instance.
+  
+  You can only specify one of the following values:
+    * kx.s.large – The node type with a configuration of 12 GiB memory and 2 vCPUs.
+    * kx.s.xlarge – The node type with a configuration of 27 GiB memory and 4 vCPUs.
+    * kx.s.2xlarge – The node type with a configuration of 54 GiB memory and 8 vCPUs.
+    * kx.s.4xlarge – The node type with a configuration of 108 GiB memory and 16 vCPUs.
+    * kx.s.8xlarge – The node type with a configuration of 216 GiB memory and 32 vCPUs.
+    * kx.s.16xlarge – The node type with a configuration of 432 GiB memory and 64 vCPUs.
+    * kx.s.32xlarge – The node type with a configuration of 864 GiB memory and 128 vCPUs.
+* `nodeCount` - (Required) Number of instances running in a cluster. Must be at least 1 and at most 5.
+
+### cache_storage_configuration
+
+The cache_storage_configuration block supports the following arguments:
+
+* `type` - (Required) Type of cache storage . The valid values are:
+    * CACHE_1000 - This type provides 1000 MB/s disk access throughput.
+    * CACHE_250 - This type provides 250 MB/s disk access throughput.
+    * CACHE_12 - This type provides 12 MB/s disk access throughput.
+* `size` - (Required) Size of cache in Gigabytes.
+
+### code
+
+The code block supports the following arguments:
+
+* `s3Bucket` - (Required) Unique name for the S3 bucket.
+* `s3Key` - (Required) Full S3 path (excluding bucket) to the .zip file that contains the code to be loaded onto the cluster when it’s started.
+* `s3ObjectVersion` - (Optional) Version of an S3 Object.
+
+### database
+
+The database block supports the following arguments:
+
+* `databaseName` - (Required) Name of the KX database.
+* `cacheConfigurations` - (Optional) Configuration details for the disk cache to increase performance reading from a KX database mounted to the cluster. See [cache_configurations](#cache_configurations).
+* `changesetId` - (Optional) A unique identifier of the changeset that is associated with the cluster.
+
+#### cache_configurations
+
+The cache_configuration block supports the following arguments:
+
+* `cacheType` - (Required) Type of disk cache.
+* `dbPaths` - (Optional) Paths within the database to cache.
+
+### savedown_storage_configuration
+
+The savedown_storage_configuration block supports the following arguments:
+
+* `type` - (Required) Type of writeable storage space for temporarily storing your savedown data. The valid values are:
+    * SDS01 - This type represents 3000 IOPS and io2 ebs volume type.
+* `size` - (Required) Size of temporary storage in gigabytes. Must be between 10 and 16000.
+
+### vpc_configuration
+
+The vpc_configuration block supports the following arguments:
+
+* `vpcId` - (Required) Identifier of the VPC endpoint
+* `securityGroupIds` - (Required) Unique identifier of the VPC security group applied to the VPC endpoint ENI for the cluster.
+* `subnet_ids `- (Required) Identifier of the subnet that the Privatelink VPC endpoint uses to connect to the cluster.
+* `ipAddressType` - (Required) IP address type for cluster network configuration parameters. The following type is available: IP_V4 - IP address version 4.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) identifier of the KX cluster.
+* `createdTimestamp` - Timestamp at which the cluster is created in FinSpace. Value determined as epoch time in seconds. For example, the value for Monday, November 1, 2021 12:00:00 PM UTC is specified as 1635768000.
+* `id` - A comma-delimited string joining environment ID and cluster name.
+* `lastModifiedTimestamp` - Last timestamp at which the cluster was updated in FinSpace. Value determined as epoch time in seconds. For example, the value for Monday, November 1, 2021 12:00:00 PM UTC is specified as 1635768000.
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `45M`)
+* `update` - (Default `2M`)
+* `delete` - (Default `60M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import an AWS FinSpace Kx Cluster using the `id` (environment ID and cluster name, comma-delimited). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import an AWS FinSpace Kx Cluster using the `id` (environment ID and cluster name, comma-delimited). For example:
+
+```console
+% terraform import aws_finspace_kx_cluster.example n3ceo7wqxoxcti5tujqwzs,my-tf-kx-cluster
+```
+
+<!-- cache-key: cdktf-0.18.0 input-fc12ddc3549a8a0db45ead2f8a186a8a85e440b7a6cea4031c22a41e5b9963bc -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/finspace_kx_database.html.markdown b/website/docs/cdktf/typescript/r/finspace_kx_database.html.markdown
new file mode 100644
index 00000000000..d65c167731e
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/finspace_kx_database.html.markdown
@@ -0,0 +1,115 @@
+---
+subcategory: "FinSpace"
+layout: "aws"
+page_title: "AWS: aws_finspace_kx_database"
+description: |-
+  Terraform resource for managing an AWS FinSpace Kx Database.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_finspace_kx_database
+
+Terraform resource for managing an AWS FinSpace Kx Database.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { FinspaceKxDatabase } from "./.gen/providers/aws/finspace-kx-database";
+import { FinspaceKxEnvironment } from "./.gen/providers/aws/finspace-kx-environment";
+import { KmsKey } from "./.gen/providers/aws/kms-key";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new KmsKey(this, "example", {
+      deletionWindowInDays: 7,
+      description: "Example KMS Key",
+    });
+    const awsFinspaceKxEnvironmentExample = new FinspaceKxEnvironment(
+      this,
+      "example_1",
+      {
+        kmsKeyId: example.arn,
+        name: "my-tf-kx-environment",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsFinspaceKxEnvironmentExample.overrideLogicalId("example");
+    const awsFinspaceKxDatabaseExample = new FinspaceKxDatabase(
+      this,
+      "example_2",
+      {
+        description: "Example database description",
+        environmentId: Token.asString(awsFinspaceKxEnvironmentExample.id),
+        name: "my-tf-kx-database",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsFinspaceKxDatabaseExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `environmentId` - (Required) Unique identifier for the KX environment.
+* `name` - (Required) Name of the KX database.
+
+The following arguments are optional:
+
+* `description` - (Optional) Description of the KX database.
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`defaultTags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) identifier of the KX database.
+* `createdTimestamp` - Timestamp at which the databse is created in FinSpace. Value determined as epoch time in seconds. For example, the value for Monday, November 1, 2021 12:00:00 PM UTC is specified as 1635768000.
+* `id` - A comma-delimited string joining environment ID and database name.
+* `lastModifiedTimestamp` - Last timestamp at which the database was updated in FinSpace. Value determined as epoch time in seconds. For example, the value for Monday, November 1, 2021 12:00:00 PM UTC is specified as 1635768000.
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `30M`)
+* `update` - (Default `30M`)
+* `delete` - (Default `30M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import an AWS FinSpace Kx Database using the `id` (environment ID and database name, comma-delimited). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import an AWS FinSpace Kx Database using the `id` (environment ID and database name, comma-delimited). For example:
+
+```console
+% terraform import aws_finspace_kx_database.example n3ceo7wqxoxcti5tujqwzs,my-tf-kx-database
+```
+
+<!-- cache-key: cdktf-0.18.0 input-d4510cf871c3b574384323c384811db1afe4695931c813e1e9e6fb86b9433a73 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/finspace_kx_environment.html.markdown b/website/docs/cdktf/typescript/r/finspace_kx_environment.html.markdown
new file mode 100644
index 00000000000..6c8395e72d7
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/finspace_kx_environment.html.markdown
@@ -0,0 +1,256 @@
+---
+subcategory: "FinSpace"
+layout: "aws"
+page_title: "AWS: aws_finspace_kx_environment"
+description: |-
+  Terraform resource for managing an AWS FinSpace Kx Environment.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_finspace_kx_environment
+
+Terraform resource for managing an AWS FinSpace Kx Environment.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { FinspaceKxEnvironment } from "./.gen/providers/aws/finspace-kx-environment";
+import { KmsKey } from "./.gen/providers/aws/kms-key";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new KmsKey(this, "example", {
+      deletionWindowInDays: 7,
+      description: "Sample KMS Key",
+    });
+    const awsFinspaceKxEnvironmentExample = new FinspaceKxEnvironment(
+      this,
+      "example_1",
+      {
+        kmsKeyId: example.arn,
+        name: "my-tf-kx-environment",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsFinspaceKxEnvironmentExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### With Transit Gateway Configuration
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Ec2TransitGateway } from "./.gen/providers/aws/ec2-transit-gateway";
+import { FinspaceKxEnvironment } from "./.gen/providers/aws/finspace-kx-environment";
+import { KmsKey } from "./.gen/providers/aws/kms-key";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new Ec2TransitGateway(this, "example", {
+      description: "example",
+    });
+    const awsKmsKeyExample = new KmsKey(this, "example_1", {
+      deletionWindowInDays: 7,
+      description: "Sample KMS Key",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsKmsKeyExample.overrideLogicalId("example");
+    new FinspaceKxEnvironment(this, "example_env", {
+      customDnsConfiguration: [
+        {
+          customDnsServerIp: "10.0.0.76",
+          customDnsServerName: "example.finspace.amazonaws.com",
+        },
+      ],
+      description: "Environment description",
+      kmsKeyId: Token.asString(awsKmsKeyExample.arn),
+      name: "my-tf-kx-environment",
+      transitGatewayConfiguration: {
+        routableCidrSpace: "100.64.0.0/26",
+        transitGatewayId: example.id,
+      },
+    });
+  }
+}
+
+```
+
+### With Transit Gateway Attachment Network ACL Configuration
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Op, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Ec2TransitGateway } from "./.gen/providers/aws/ec2-transit-gateway";
+import { FinspaceKxEnvironment } from "./.gen/providers/aws/finspace-kx-environment";
+import { KmsKey } from "./.gen/providers/aws/kms-key";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new Ec2TransitGateway(this, "example", {
+      description: "example",
+    });
+    const awsKmsKeyExample = new KmsKey(this, "example_1", {
+      deletionWindowInDays: 7,
+      description: "Sample KMS Key",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsKmsKeyExample.overrideLogicalId("example");
+    new FinspaceKxEnvironment(this, "example_env", {
+      customDnsConfiguration: [
+        {
+          customDnsServerIp: "10.0.0.76",
+          customDnsServerName: "example.finspace.amazonaws.com",
+        },
+      ],
+      description: "Environment description",
+      kmsKeyId: Token.asString(awsKmsKeyExample.arn),
+      name: "my-tf-kx-environment",
+      transitGatewayConfiguration: {
+        attachmentNetworkAclConfiguration: [
+          {
+            cidrBlock: "0.0.0.0/0",
+            icmpTypeCode: {
+              code: Token.asNumber(Op.negate(1)),
+              type: Token.asNumber(Op.negate(1)),
+            },
+            portRange: {
+              from: 53,
+              to: 53,
+            },
+            protocol: "6",
+            ruleAction: "allow",
+            ruleNumber: 1,
+          },
+        ],
+        routableCidrSpace: "100.64.0.0/26",
+        transitGatewayId: example.id,
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) Name of the KX environment that you want to create.
+* `kmsKeyId` - (Required) KMS key ID to encrypt your data in the FinSpace environment.
+
+The following arguments are optional:
+
+* `customDnsConfiguration` - (Optional) List of DNS server name and server IP. This is used to set up Route-53 outbound resolvers. Defined below.
+* `description` - (Optional) Description for the KX environment.
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`defaultTags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `transitGatewayConfiguration` - (Optional) Transit gateway and network configuration that is used to connect the KX environment to an internal network. Defined below.
+
+### custom_dns_configuration
+
+The custom_dns_configuration block supports the following arguments:
+
+* `customDnsServerIp` - (Required) IP address of the DNS server.
+* `customDnsServerName` - (Required) Name of the DNS server.
+
+### transit_gateway_configuration
+
+The transit_gateway_configuration block supports the following arguments:
+
+* `routableCidrSpace` - (Required) Routing CIDR on behalf of KX environment. It could be any “/26 range in the 100.64.0.0 CIDR space. After providing, it will be added to the customer’s transit gateway routing table so that the traffics could be routed to KX network.
+* `transitGatewayId` - (Required) Identifier of the transit gateway created by the customer to connect outbound traffics from KX network to your internal network.
+* `attachmentNetworkAclConfiguration` - (Optional) Rules that define how you manage outbound traffic from kdb network to your internal network. Defined below.
+
+### attachment_network_acl_configuration
+
+The network access control list (ACL) is an optional layer of security for VPCs that acts as a firewall for controlling traffic in and out of one or more subnets.
+The entry is a set of numbered ingress and egress rules that determine whether a packet should be allowed in or out of a subnet associated with the ACL.
+Entries in the ACL are processed according to the rule numbers, in ascending order. The `attachmentNetworkAclConfiguration` block supports the following arguments:
+
+* `cidrBlock` - (Required) The IPv4 network range to allow or deny, in CIDR notation. The specified CIDR block is modified to its canonical form. For example, `10068018/18` will be converted to `1006800/18`.
+* `protocol` - (Required) Protocol number. A value of `1` means all the protocols.
+* `ruleAction` - (Required) Indicates whether to `allow` or `deny` the traffic that matches the rule.
+* `ruleNumber` - (Required) Rule number for the entry. All the network ACL entries are processed in ascending order by rule number.
+* `icmpTypeCode` - (Optional) Defines the ICMP protocol that consists of the ICMP type and code. Defined below.
+* `portRange` - (Optional) Range of ports the rule applies to. Defined below.
+
+### port_range
+
+The range of ports the rule applies to (between `0` and `65535`). The `portRange` block supports the following arguments:
+
+* `from` - (Required) First port in the range.
+* `to` - (Required) Last port in the range.
+
+### icmp_type_code
+
+Defines the ICMP protocol that consists of the ICMP type and code. The `icmpTypeCode` block supports the following arguments:
+
+* `code` - (Required) ICMP code. A value of `1` means all codes for the specified ICMP type.
+* `type` - (Required) ICMP type. A value of `1` means all types.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) identifier of the KX environment.
+* `availabilityZones` - AWS Availability Zone IDs that this environment is available in. Important when selecting VPC subnets to use in cluster creation.
+* `createdTimestamp` - Timestamp at which the environment is created in FinSpace. Value determined as epoch time in seconds. For example, the value for Monday, November 1, 2021 12:00:00 PM UTC is specified as 1635768000.
+* `id` - Unique identifier for the KX environment.
+* `infrastructureAccountId` - Unique identifier for the AWS environment infrastructure account.
+* `lastModifiedTimestamp` - Last timestamp at which the environment was updated in FinSpace. Value determined as epoch time in seconds. For example, the value for Monday, November 1, 2021 12:00:00 PM UTC is specified as 1635768000.
+* `status` - Status of environment creation
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `30M`)
+* `update` - (Default `30M`)
+* `delete` - (Default `45M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import an AWS FinSpace Kx Environment using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import an AWS FinSpace Kx Environment using the `id`. For example:
+
+```console
+% terraform import aws_finspace_kx_environment.example n3ceo7wqxoxcti5tujqwzs
+```
+
+<!-- cache-key: cdktf-0.18.0 input-66ff5897d5ab2c91b6931ad3c3dac3ade7477821d5c997374b18bd09ac1f1dd9 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/finspace_kx_user.html.markdown b/website/docs/cdktf/typescript/r/finspace_kx_user.html.markdown
new file mode 100644
index 00000000000..c3c8ade6dec
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/finspace_kx_user.html.markdown
@@ -0,0 +1,130 @@
+---
+subcategory: "FinSpace"
+layout: "aws"
+page_title: "AWS: aws_finspace_kx_user"
+description: |-
+  Terraform resource for managing an AWS FinSpace Kx User.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_finspace_kx_user
+
+Terraform resource for managing an AWS FinSpace Kx User.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { FinspaceKxEnvironment } from "./.gen/providers/aws/finspace-kx-environment";
+import { FinspaceKxUser } from "./.gen/providers/aws/finspace-kx-user";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+import { KmsKey } from "./.gen/providers/aws/kms-key";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new IamRole(this, "example", {
+      assumeRolePolicy: Token.asString(
+        Fn.jsonencode({
+          Statement: [
+            {
+              Action: "sts:AssumeRole",
+              Effect: "Allow",
+              Principal: {
+                Service: "ec2.amazonaws.com",
+              },
+              Sid: "",
+            },
+          ],
+          Version: "2012-10-17",
+        })
+      ),
+      name: "example-role",
+    });
+    const awsKmsKeyExample = new KmsKey(this, "example_1", {
+      deletionWindowInDays: 7,
+      description: "Example KMS Key",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsKmsKeyExample.overrideLogicalId("example");
+    const awsFinspaceKxEnvironmentExample = new FinspaceKxEnvironment(
+      this,
+      "example_2",
+      {
+        kmsKeyId: Token.asString(awsKmsKeyExample.arn),
+        name: "my-tf-kx-environment",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsFinspaceKxEnvironmentExample.overrideLogicalId("example");
+    const awsFinspaceKxUserExample = new FinspaceKxUser(this, "example_3", {
+      environmentId: Token.asString(awsFinspaceKxEnvironmentExample.id),
+      iamRole: example.arn,
+      name: "my-tf-kx-user",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsFinspaceKxUserExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) A unique identifier for the user.
+* `environmentId` - (Required) Unique identifier for the KX environment.
+* `iamRole` - (Required) IAM role ARN to be associated with the user.
+
+The following arguments are optional:
+
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`defaultTags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) identifier of the KX user.
+* `id` - A comma-delimited string joining environment ID and user name.
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `30M`)
+* `update` - (Default `30M`)
+* `delete` - (Default `30M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import an AWS FinSpace Kx User using the `id` (environment ID and user name, comma-delimited). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import an AWS FinSpace Kx User using the `id` (environment ID and user name, comma-delimited). For example:
+
+```console
+% terraform import aws_finspace_kx_user.example n3ceo7wqxoxcti5tujqwzs,my-tf-kx-user
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ca0c383fee51cd83230b9fbdc20cbdd865bb1f5eb6633d7d2d1fa7bea216bcb4 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/fis_experiment_template.html.markdown b/website/docs/cdktf/typescript/r/fis_experiment_template.html.markdown
new file mode 100644
index 00000000000..a2ae964a664
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/fis_experiment_template.html.markdown
@@ -0,0 +1,178 @@
+---
+subcategory: "FIS (Fault Injection Simulator)"
+layout: "aws"
+page_title: "AWS: aws_fis_experiment_template"
+description: |-
+  Provides an FIS Experiment Template.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_fis_experiment_template
+
+Provides an FIS Experiment Template, which can be used to run an experiment.
+An experiment template contains one or more actions to run on specified targets during an experiment.
+It also contains the stop conditions that prevent the experiment from going out of bounds.
+See [Amazon Fault Injection Simulator](https://docs.aws.amazon.com/fis/index.html)
+for more information.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { FisExperimentTemplate } from "./.gen/providers/aws/fis-experiment-template";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new FisExperimentTemplate(this, "example", {
+      action: [
+        {
+          actionId: "aws:ec2:terminate-instances",
+          name: "example-action",
+          target: {
+            key: "Instances",
+            value: "example-target",
+          },
+        },
+      ],
+      description: "example",
+      roleArn: Token.asString(awsIamRoleExample.arn),
+      stopCondition: [
+        {
+          source: "none",
+        },
+      ],
+      target: [
+        {
+          name: "example-target",
+          resourceTag: [
+            {
+              key: "env",
+              value: "example",
+            },
+          ],
+          resourceType: "aws:ec2:instance",
+          selectionMode: "COUNT(1)",
+        },
+      ],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `action` - (Required) Action to be performed during an experiment. See below.
+* `description` - (Required) Description for the experiment template.
+* `roleArn` - (Required) ARN of an IAM role that grants the AWS FIS service permission to perform service actions on your behalf.
+* `stopCondition` - (Required) When an ongoing experiment should be stopped. See below.
+
+The following arguments are optional:
+
+* `tags` - (Optional) Key-value mapping of tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `target` - (Optional) Target of an action. See below.
+* `logConfiguration` - (Optional) The configuration for experiment logging. See below.
+
+### `action`
+
+* `actionId` - (Required) ID of the action. To find out what actions are supported see [AWS FIS actions reference](https://docs.aws.amazon.com/fis/latest/userguide/fis-actions-reference.html).
+* `name` - (Required) Friendly name of the action.
+* `description` - (Optional) Description of the action.
+* `parameter` - (Optional) Parameter(s) for the action, if applicable. See below.
+* `startAfter` - (Optional) Set of action names that must complete before this action can be executed.
+* `target` - (Optional) Action's target, if applicable. See below.
+
+#### `parameter`
+
+* `key` - (Required) Parameter name.
+* `value` - (Required) Parameter value.
+
+For a list of parameters supported by each action, see [AWS FIS actions reference](https://docs.aws.amazon.com/fis/latest/userguide/fis-actions-reference.html).
+
+#### `target` (`action.*Target`)
+
+* `key` - (Required) Target type. Valid values are `cluster` (EKS Cluster), `clusters` (ECS Clusters), `dbInstances` (RDS DB Instances), `instances` (EC2 Instances), `nodegroups` (EKS Node groups), `roles` (IAM Roles), `spotInstances` (EC2 Spot Instances), `subnets` (VPC Subnets), `volumes` (EBS Volumes) , `pods` (EKS Pods), `tasks` (ECS Tasks). See the [documentation](https://docs.aws.amazon.com/fis/latest/userguide/actions.html#action-targets) for more details.
+* `value` - (Required) Target name, referencing a corresponding target.
+
+### `stopCondition`
+
+* `source` - (Required) Source of the condition. One of `none`, `aws:cloudwatch:alarm`.
+* `value` - (Optional) ARN of the CloudWatch alarm. Required if the source is a CloudWatch alarm.
+
+### `target`
+
+* `name` - (Required) Friendly name given to the target.
+* `resourceType` - (Required) AWS resource type. The resource type must be supported for the specified action. To find out what resource types are supported, see [Targets for AWS FIS](https://docs.aws.amazon.com/fis/latest/userguide/targets.html#resource-types).
+* `selectionMode` - (Required) Scopes the identified resources. Valid values are `all` (all identified resources), `count(n)` (randomly select `n` of the identified resources), `percent(n)` (randomly select `n` percent of the identified resources).
+* `filter` - (Optional) Filter(s) for the target. Filters can be used to select resources based on specific attributes returned by the respective describe action of the resource type. For more information, see [Targets for AWS FIS](https://docs.aws.amazon.com/fis/latest/userguide/targets.html#target-filters). See below.
+* `resourceArns` - (Optional) Set of ARNs of the resources to target with an action. Conflicts with `resourceTag`.
+* `resourceTag` - (Optional) Tag(s) the resources need to have to be considered a valid target for an action. Conflicts with `resourceArns`. See below.
+* `parameters` - (Optional) The resource type parameters.
+
+~> **NOTE:** The `target` configuration block requires either `resourceArns` or `resourceTag`.
+
+#### `filter`
+
+* `path` - (Required) Attribute path for the filter.
+* `values` - (Required) Set of attribute values for the filter.
+
+~> **NOTE:** Values specified in a `filter` are joined with an `or` clause, while values across multiple `filter` blocks are joined with an `and` clause. For more information, see [Targets for AWS FIS](https://docs.aws.amazon.com/fis/latest/userguide/targets.html#target-filters).
+
+#### `resourceTag`
+
+* `key` - (Required) Tag key.
+* `value` - (Required) Tag value.
+
+### `logConfiguration`
+
+* `logSchemaVersion` - (Required) The schema version. See [documentation](https://docs.aws.amazon.com/fis/latest/userguide/monitoring-logging.html#experiment-log-schema) for the list of schema versions.
+* `cloudwatchLogsConfiguration` - (Optional) The configuration for experiment logging to Amazon CloudWatch Logs. See below.
+* `s3Configuration` - (Optional) The configuration for experiment logging to Amazon S3. See below.
+
+#### `cloudwatchLogsConfiguration`
+
+* `logGroupArn` - (Required) The Amazon Resource Name (ARN) of the destination Amazon CloudWatch Logs log group.
+
+#### `s3Configuration`
+
+* `bucketName` - (Required) The name of the destination bucket.
+* `prefix` - (Optional) The bucket prefix.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Experiment Template ID.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import FIS Experiment Templates using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import FIS Experiment Templates using the `id`. For example:
+
+```console
+% terraform import aws_fis_experiment_template.template EXT123AbCdEfGhIjK
+```
+
+<!-- cache-key: cdktf-0.18.0 input-6f86f6051a01d559c0189ce9cb6d94bc035f6fe628c05e2f0aba1d5a3f86e00b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/flow_log.html.markdown b/website/docs/cdktf/typescript/r/flow_log.html.markdown
new file mode 100644
index 00000000000..8bee2f54253
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/flow_log.html.markdown
@@ -0,0 +1,331 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_flow_log"
+description: |-
+  Provides a VPC/Subnet/ENI Flow Log
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_flow_log
+
+Provides a VPC/Subnet/ENI/Transit Gateway/Transit Gateway Attachment Flow Log to capture IP traffic for a specific network
+interface, subnet, or VPC. Logs are sent to a CloudWatch Log Group, a S3 Bucket, or Amazon Kinesis Data Firehose
+
+## Example Usage
+
+### CloudWatch Logging
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudwatchLogGroup } from "./.gen/providers/aws/cloudwatch-log-group";
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { FlowLog } from "./.gen/providers/aws/flow-log";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+import { IamRolePolicy } from "./.gen/providers/aws/iam-role-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new CloudwatchLogGroup(this, "example", {
+      name: "example",
+    });
+    const assumeRole = new DataAwsIamPolicyDocument(this, "assume_role", {
+      statement: [
+        {
+          actions: ["sts:AssumeRole"],
+          effect: "Allow",
+          principals: [
+            {
+              identifiers: ["vpc-flow-logs.amazonaws.com"],
+              type: "Service",
+            },
+          ],
+        },
+      ],
+    });
+    const dataAwsIamPolicyDocumentExample = new DataAwsIamPolicyDocument(
+      this,
+      "example_2",
+      {
+        statement: [
+          {
+            actions: [
+              "logs:CreateLogGroup",
+              "logs:CreateLogStream",
+              "logs:PutLogEvents",
+              "logs:DescribeLogGroups",
+              "logs:DescribeLogStreams",
+            ],
+            effect: "Allow",
+            resources: ["*"],
+          },
+        ],
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsIamPolicyDocumentExample.overrideLogicalId("example");
+    const awsIamRoleExample = new IamRole(this, "example_3", {
+      assumeRolePolicy: Token.asString(assumeRole.json),
+      name: "example",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamRoleExample.overrideLogicalId("example");
+    const awsIamRolePolicyExample = new IamRolePolicy(this, "example_4", {
+      name: "example",
+      policy: Token.asString(dataAwsIamPolicyDocumentExample.json),
+      role: Token.asString(awsIamRoleExample.id),
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamRolePolicyExample.overrideLogicalId("example");
+    const awsFlowLogExample = new FlowLog(this, "example_5", {
+      iamRoleArn: Token.asString(awsIamRoleExample.arn),
+      logDestination: example.arn,
+      trafficType: "ALL",
+      vpcId: Token.asString(awsVpcExample.id),
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsFlowLogExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### Amazon Kinesis Data Firehose logging
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { FlowLog } from "./.gen/providers/aws/flow-log";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+import { IamRolePolicy } from "./.gen/providers/aws/iam-role-policy";
+import { KinesisFirehoseDeliveryStream } from "./.gen/providers/aws/kinesis-firehose-delivery-stream";
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketAcl } from "./.gen/providers/aws/s3-bucket-acl";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new S3Bucket(this, "example", {
+      bucket: "example",
+    });
+    const awsS3BucketAclExample = new S3BucketAcl(this, "example_1", {
+      acl: "private",
+      bucket: example.id,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketAclExample.overrideLogicalId("example");
+    const assumeRole = new DataAwsIamPolicyDocument(this, "assume_role", {
+      statement: [
+        {
+          actions: ["sts:AssumeRole"],
+          effect: "Allow",
+          principals: [
+            {
+              identifiers: ["firehose.amazonaws.com"],
+              type: "Service",
+            },
+          ],
+        },
+      ],
+    });
+    const dataAwsIamPolicyDocumentExample = new DataAwsIamPolicyDocument(
+      this,
+      "example_3",
+      {
+        actions: [
+          "logs:CreateLogDelivery",
+          "logs:DeleteLogDelivery",
+          "logs:ListLogDeliveries",
+          "logs:GetLogDelivery",
+          "firehose:TagDeliveryStream",
+        ],
+        effect: "Allow",
+        resources: ["*"],
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsIamPolicyDocumentExample.overrideLogicalId("example");
+    const awsIamRoleExample = new IamRole(this, "example_4", {
+      assumeRolePolicy: Token.asString(assumeRole.json),
+      name: "firehose_test_role",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamRoleExample.overrideLogicalId("example");
+    const awsIamRolePolicyExample = new IamRolePolicy(this, "example_5", {
+      name: "test",
+      policy: Token.asString(dataAwsIamPolicyDocumentExample.json),
+      role: Token.asString(awsIamRoleExample.id),
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamRolePolicyExample.overrideLogicalId("example");
+    const awsKinesisFirehoseDeliveryStreamExample =
+      new KinesisFirehoseDeliveryStream(this, "example_6", {
+        destination: "extended_s3",
+        extendedS3Configuration: {
+          bucketArn: example.arn,
+          roleArn: Token.asString(awsIamRoleExample.arn),
+        },
+        name: "kinesis_firehose_test",
+        tags: {
+          LogDeliveryEnabled: "true",
+        },
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsKinesisFirehoseDeliveryStreamExample.overrideLogicalId("example");
+    const awsFlowLogExample = new FlowLog(this, "example_7", {
+      logDestination: Token.asString(
+        awsKinesisFirehoseDeliveryStreamExample.arn
+      ),
+      logDestinationType: "kinesis-data-firehose",
+      trafficType: "ALL",
+      vpcId: Token.asString(awsVpcExample.id),
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsFlowLogExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### S3 Logging
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { FlowLog } from "./.gen/providers/aws/flow-log";
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new S3Bucket(this, "example", {
+      bucket: "example",
+    });
+    const awsFlowLogExample = new FlowLog(this, "example_1", {
+      logDestination: example.arn,
+      logDestinationType: "s3",
+      trafficType: "ALL",
+      vpcId: Token.asString(awsVpcExample.id),
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsFlowLogExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### S3 Logging in Apache Parquet format with per-hour partitions
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { FlowLog } from "./.gen/providers/aws/flow-log";
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new S3Bucket(this, "example", {
+      bucket: "example",
+    });
+    const awsFlowLogExample = new FlowLog(this, "example_1", {
+      destinationOptions: {
+        fileFormat: "parquet",
+        perHourPartition: true,
+      },
+      logDestination: example.arn,
+      logDestinationType: "s3",
+      trafficType: "ALL",
+      vpcId: Token.asString(awsVpcExample.id),
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsFlowLogExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+~> **NOTE:** One of `eniId`, `subnetId`, `transitGatewayId`, `transitGatewayAttachmentId`, or `vpcId` must be specified.
+
+This argument supports the following arguments:
+
+* `trafficType` - (Required) The type of traffic to capture. Valid values: `accept`,`reject`, `all`.
+* `deliverCrossAccountRole` - (Optional) ARN of the IAM role that allows Amazon EC2 to publish flow logs across accounts.
+* `eniId` - (Optional) Elastic Network Interface ID to attach to
+* `iamRoleArn` - (Optional) The ARN for the IAM role that's used to post flow logs to a CloudWatch Logs log group
+* `logDestinationType` - (Optional) The type of the logging destination. Valid values: `cloudWatchLogs`, `s3`, `kinesisDataFirehose`. Default: `cloudWatchLogs`.
+* `logDestination` - (Optional) The ARN of the logging destination. Either `logDestination` or `logGroupName` must be set.
+* `logGroupName` - (Optional) **Deprecated:** Use `logDestination` instead. The name of the CloudWatch log group. Either `logGroupName` or `logDestination` must be set.
+* `subnetId` - (Optional) Subnet ID to attach to
+* `transitGatewayId` - (Optional) Transit Gateway ID to attach to
+* `transitGatewayAttachmentId` - (Optional) Transit Gateway Attachment ID to attach to
+* `vpcId` - (Optional) VPC ID to attach to
+* `logFormat` - (Optional) The fields to include in the flow log record, in the order in which they should appear.
+* `maxAggregationInterval` - (Optional) The maximum interval of time
+  during which a flow of packets is captured and aggregated into a flow
+  log record. Valid Values: `60` seconds (1 minute) or `600` seconds (10
+  minutes). Default: `600`. When `transitGatewayId` or `transitGatewayAttachmentId` is specified, `maxAggregationInterval` *must* be 60 seconds (1 minute).
+* `destinationOptions` - (Optional) Describes the destination options for a flow log. More details below.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### destination_options
+
+Describes the destination options for a flow log.
+
+* `fileFormat` - (Optional) The format for the flow log. Default value: `plainText`. Valid values: `plainText`, `parquet`.
+* `hiveCompatiblePartitions` - (Optional) Indicates whether to use Hive-compatible prefixes for flow logs stored in Amazon S3. Default value: `false`.
+* `perHourPartition` - (Optional) Indicates whether to partition the flow log per hour. This reduces the cost and response time for queries. Default value: `false`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Flow Log ID
+* `arn` - The ARN of the Flow Log.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Flow Logs using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Flow Logs using the `id`. For example:
+
+```console
+% terraform import aws_flow_log.test_flow_log fl-1a2b3c4d
+```
+
+<!-- cache-key: cdktf-0.18.0 input-379eebee0faf6ddc6b72192ea7791d99a401f706aaa6660a39aa2f4709546656 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/fms_admin_account.html.markdown b/website/docs/cdktf/typescript/r/fms_admin_account.html.markdown
new file mode 100644
index 00000000000..0ff3a9aaf9d
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/fms_admin_account.html.markdown
@@ -0,0 +1,76 @@
+---
+subcategory: "FMS (Firewall Manager)"
+layout: "aws"
+page_title: "AWS: aws_fms_admin_account"
+description: |-
+  Provides a resource to associate/disassociate an AWS Firewall Manager administrator account
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_fms_admin_account
+
+Provides a resource to associate/disassociate an AWS Firewall Manager administrator account. This operation must be performed in the `usEast1` region.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { FmsAdminAccount } from "./.gen/providers/aws/fms-admin-account";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new FmsAdminAccount(this, "example", {});
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `accountId` - (Optional) The AWS account ID to associate with AWS Firewall Manager as the AWS Firewall Manager administrator account. This can be an AWS Organizations master account or a member account. Defaults to the current account. Must be configured to perform drift detection.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The AWS account ID of the AWS Firewall Manager administrator account.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `30M`)
+- `delete` - (Default `10M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Firewall Manager administrator account association using the account ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Firewall Manager administrator account association using the account ID. For example:
+
+```console
+% terraform import aws_fms_admin_account.example 123456789012
+```
+
+<!-- cache-key: cdktf-0.18.0 input-9887cf15245a4b734a6b9de0582fbcd635a6b8d70933e7656427281a76b59b6c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/fms_policy.html.markdown b/website/docs/cdktf/typescript/r/fms_policy.html.markdown
new file mode 100644
index 00000000000..ffdeab2fef8
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/fms_policy.html.markdown
@@ -0,0 +1,153 @@
+---
+subcategory: "FMS (Firewall Manager)"
+layout: "aws"
+page_title: "AWS: aws_fms_policy"
+description: |-
+  Provides a resource to create an AWS Firewall Manager policy
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_fms_policy
+
+Provides a resource to create an AWS Firewall Manager policy. You need to be using AWS organizations and have enabled the Firewall Manager administrator account.
+
+~> **NOTE:** Due to limitations with testing, we provide it as best effort. If you find it useful, and have the ability to help test or notice issues, consider reaching out to us on [GitHub](https://github.com/hashicorp/terraform-provider-aws).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { FmsPolicy } from "./.gen/providers/aws/fms-policy";
+import { WafregionalRuleGroup } from "./.gen/providers/aws/wafregional-rule-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new WafregionalRuleGroup(this, "example", {
+      metricName: "WAFRuleGroupExample",
+      name: "WAF-Rule-Group-Example",
+    });
+    const awsFmsPolicyExample = new FmsPolicy(this, "example_1", {
+      excludeResourceTags: false,
+      name: "FMS-Policy-Example",
+      remediationEnabled: false,
+      resourceType: "AWS::ElasticLoadBalancingV2::LoadBalancer",
+      securityServicePolicyData: {
+        managedServiceData: Token.asString(
+          Fn.jsonencode({
+            defaultAction: {
+              type: "BLOCK",
+            },
+            overrideCustomerWebACLAssociation: false,
+            ruleGroups: [
+              {
+                id: example.id,
+                overrideAction: {
+                  type: "COUNT",
+                },
+              },
+            ],
+            type: "WAF",
+          })
+        ),
+        type: "WAF",
+      },
+      tags: {
+        Name: "example-fms-policy",
+      },
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsFmsPolicyExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required, Forces new resource) The friendly name of the AWS Firewall Manager Policy.
+* `deleteAllPolicyResources` - (Optional) If true, the request will also perform a clean-up process. Defaults to `true`. More information can be found here [AWS Firewall Manager delete policy](https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_DeletePolicy.html)
+* `deleteUnusedFmManagedResources` - (Optional) If true, Firewall Manager will automatically remove protections from resources that leave the policy scope. Defaults to `false`. More information can be found here [AWS Firewall Manager policy contents](https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_Policy.html)
+* `description` - (Optional) The description of the AWS Network Firewall firewall policy.
+* `excludeMap` - (Optional) A map of lists of accounts and OU's to exclude from the policy.
+* `excludeResourceTags` - (Required, Forces new resource) A boolean value, if true the tags that are specified in the `resourceTags` are not protected by this policy. If set to false and resource_tags are populated, resources that contain tags will be protected by this policy.
+* `includeMap` - (Optional) A map of lists of accounts and OU's to include in the policy.
+* `remediationEnabled` - (Required) A boolean value, indicates if the policy should automatically applied to resources that already exist in the account.
+* `resourceTags` - (Optional) A map of resource tags, that if present will filter protections on resources based on the exclude_resource_tags.
+* `resourceType` - (Optional) A resource type to protect. Conflicts with `resourceTypeList`. See the [FMS API Reference](https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_Policy.html#fms-Type-Policy-ResourceType) for more information about supported values.
+* `resourceTypeList` - (Optional) A list of resource types to protect. Conflicts with `resourceType`. See the [FMS API Reference](https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_Policy.html#fms-Type-Policy-ResourceType) for more information about supported values. Lists with only one element are not supported, instead use `resourceType`.
+* `securityServicePolicyData` - (Required) The objects to include in Security Service Policy Data. Documented below.
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## `excludeMap` Configuration Block
+
+* `account` - (Optional) A list of AWS Organization member Accounts that you want to exclude from this AWS FMS Policy.
+* `orgunit` - (Optional) A list of IDs of the AWS Organizational Units that you want to exclude from this AWS FMS Policy. Specifying an OU is the equivalent of specifying all accounts in the OU and in any of its child OUs, including any child OUs and accounts that are added at a later time.
+
+You can specify inclusions or exclusions, but not both. If you specify an `includeMap`, AWS Firewall Manager applies the policy to all accounts specified by the `includeMap`, and does not evaluate any `excludeMap` specifications. If you do not specify an `includeMap`, then Firewall Manager applies the policy to all accounts except for those specified by the `excludeMap`.
+
+## `includeMap` Configuration Block
+
+* `account` - (Optional) A list of AWS Organization member Accounts that you want to include for this AWS FMS Policy.
+* `orgunit` - (Optional) A list of IDs of the AWS Organizational Units that you want to include for this AWS FMS Policy. Specifying an OU is the equivalent of specifying all accounts in the OU and in any of its child OUs, including any child OUs and accounts that are added at a later time.
+
+You can specify inclusions or exclusions, but not both. If you specify an `includeMap`, AWS Firewall Manager applies the policy to all accounts specified by the `includeMap`, and does not evaluate any `excludeMap` specifications. If you do not specify an `includeMap`, then Firewall Manager applies the policy to all accounts except for those specified by the `excludeMap`.
+
+## `securityServicePolicyData` Configuration Block
+
+* `managedServiceData` - (Optional) Details about the service that are specific to the service type, in JSON format. For service type `shieldAdvanced`, this is an empty string. Examples depending on `type` can be found in the [AWS Firewall Manager SecurityServicePolicyData API Reference](https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_SecurityServicePolicyData.html).
+* `policyOption` - (Optional) Contains the Network Firewall firewall policy options to configure a centralized deployment model. Documented below.
+* `type` - (Required, Forces new resource) The service that the policy is using to protect the resources. For the current list of supported types, please refer to the [AWS Firewall Manager SecurityServicePolicyData API Type Reference](https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_SecurityServicePolicyData.html#fms-Type-SecurityServicePolicyData-Type).
+
+## `policyOption` Configuration Block
+
+* `networkFirewallPolicy` - (Optional) Defines the deployment model to use for the firewall policy. Documented below.
+* `thirdpartyFirewallPolicy` - (Optional) Defines the policy options for a third-party firewall policy. Documented below.
+
+## `networkFirewallPolicy` Configuration Block
+
+* `firewallDeploymentModel` - (Optional) Defines the deployment model to use for the firewall policy. To use a distributed model, remove the `policyOption` section. Valid values are `centralized` and `distributed`.
+
+## `thirdpartyFirewallPolicy` Configuration Block
+
+* `firewallDeploymentModel` - (Optional) Defines the deployment model to use for the third-party firewall policy. Valid values are `centralized` and `distributed`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The AWS account ID of the AWS Firewall Manager administrator account.
+* `policyUpdateToken` - A unique identifier for each update to the policy.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Firewall Manager policies using the policy ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Firewall Manager policies using the policy ID. For example:
+
+```console
+% terraform import aws_fms_policy.example 5be49585-a7e3-4c49-dde1-a179fe4a619a
+```
+
+<!-- cache-key: cdktf-0.18.0 input-0ae1df390d47241169d44152adee2f18fc2ef166fb2e999418b584927f81b7b3 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/fsx_backup.html.markdown b/website/docs/cdktf/typescript/r/fsx_backup.html.markdown
new file mode 100644
index 00000000000..ecc5cec3888
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/fsx_backup.html.markdown
@@ -0,0 +1,193 @@
+---
+subcategory: "FSx"
+layout: "aws"
+page_title: "AWS: aws_fsx_backup"
+description: |-
+  Manages a FSx Backup.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_fsx_backup
+
+Provides a FSx Backup resource.
+
+## Example Usage
+
+## Lustre Example
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { FsxBackup } from "./.gen/providers/aws/fsx-backup";
+import { FsxLustreFileSystem } from "./.gen/providers/aws/fsx-lustre-file-system";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new FsxLustreFileSystem(this, "example", {
+      deploymentType: "PERSISTENT_1",
+      perUnitStorageThroughput: 50,
+      storageCapacity: 1200,
+      subnetIds: [Token.asString(awsSubnetExample.id)],
+    });
+    const awsFsxBackupExample = new FsxBackup(this, "example_1", {
+      fileSystemId: example.id,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsFsxBackupExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Windows Example
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { FsxBackup } from "./.gen/providers/aws/fsx-backup";
+import { FsxWindowsFileSystem } from "./.gen/providers/aws/fsx-windows-file-system";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new FsxWindowsFileSystem(this, "example", {
+      activeDirectoryId: eample.id,
+      skipFinalBackup: true,
+      storageCapacity: 32,
+      subnetIds: [example1.id],
+      throughputCapacity: 8,
+    });
+    const awsFsxBackupExample = new FsxBackup(this, "example_1", {
+      fileSystemId: example.id,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsFsxBackupExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## ONTAP Example
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { FsxBackup } from "./.gen/providers/aws/fsx-backup";
+import { FsxOntapVolume } from "./.gen/providers/aws/fsx-ontap-volume";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new FsxOntapVolume(this, "example", {
+      junctionPath: "/example",
+      name: "example",
+      sizeInMegabytes: 1024,
+      storageEfficiencyEnabled: true,
+      storageVirtualMachineId: test.id,
+    });
+    const awsFsxBackupExample = new FsxBackup(this, "example_1", {
+      volumeId: example.id,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsFsxBackupExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## OpenZFS Example
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { FsxBackup } from "./.gen/providers/aws/fsx-backup";
+import { FsxOpenzfsFileSystem } from "./.gen/providers/aws/fsx-openzfs-file-system";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new FsxOpenzfsFileSystem(this, "example", {
+      deploymentType: "SINGLE_AZ_1",
+      storageCapacity: 64,
+      subnetIds: [Token.asString(awsSubnetExample.id)],
+      throughputCapacity: 64,
+    });
+    const awsFsxBackupExample = new FsxBackup(this, "example_1", {
+      fileSystemId: example.id,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsFsxBackupExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+Note - Only file_system_id or volume_id can be specified. file_system_id is used for Lustre and Windows, volume_id is used for ONTAP.
+
+* `fileSystemId` - (Optional) The ID of the file system to back up. Required if backing up Lustre or Windows file systems.
+* `tags` - (Optional) A map of tags to assign to the file system. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level. If you have set `copyTagsToBackups` to true, and you specify one or more tags, no existing file system tags are copied from the file system to the backup.
+* `volumeId` - (Optional) The ID of the volume to back up. Required if backing up a ONTAP Volume.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name of the backup.
+* `id` - Identifier of the backup, e.g., `fs12345678`
+* `kmsKeyId` -  The ID of the AWS Key Management Service (AWS KMS) key used to encrypt the backup of the Amazon FSx file system's data at rest.
+* `ownerId` - AWS account identifier that created the file system.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `type` - The type of the file system backup.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `10M`)
+* `delete` - (Default `10M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import FSx Backups using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import FSx Backups using the `id`. For example:
+
+```console
+% terraform import aws_fsx_backup.example fs-543ab12b1ca672f33
+```
+
+<!-- cache-key: cdktf-0.18.0 input-0ec17c1115f996a3a9d6f257bcf0f3b19a4abf6354a302a0d56b57c97b46ab01 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/fsx_data_repository_association.html.markdown b/website/docs/cdktf/typescript/r/fsx_data_repository_association.html.markdown
new file mode 100644
index 00000000000..068cac69efb
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/fsx_data_repository_association.html.markdown
@@ -0,0 +1,133 @@
+---
+subcategory: "FSx"
+layout: "aws"
+page_title: "AWS: aws_fsx_data_repository_association"
+description: |-
+  Manages a FSx for Lustre Data Repository Association.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_fsx_data_repository_association
+
+Manages a FSx for Lustre Data Repository Association. See [Linking your file system to an S3 bucket](https://docs.aws.amazon.com/fsx/latest/LustreGuide/create-dra-linked-data-repo.html) for more information.
+
+~> **NOTE:** Data Repository Associations are only compatible with AWS FSx for Lustre File Systems and `persistent2` deployment type.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { FsxDataRepositoryAssociation } from "./.gen/providers/aws/fsx-data-repository-association";
+import { FsxLustreFileSystem } from "./.gen/providers/aws/fsx-lustre-file-system";
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketAcl } from "./.gen/providers/aws/s3-bucket-acl";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new FsxLustreFileSystem(this, "example", {
+      deploymentType: "PERSISTENT_2",
+      perUnitStorageThroughput: 125,
+      storageCapacity: 1200,
+      subnetIds: [Token.asString(awsSubnetExample.id)],
+    });
+    const awsS3BucketExample = new S3Bucket(this, "example_1", {
+      bucket: "my-bucket",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketExample.overrideLogicalId("example");
+    const awsS3BucketAclExample = new S3BucketAcl(this, "example_2", {
+      acl: "private",
+      bucket: Token.asString(awsS3BucketExample.id),
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketAclExample.overrideLogicalId("example");
+    const awsFsxDataRepositoryAssociationExample =
+      new FsxDataRepositoryAssociation(this, "example_3", {
+        dataRepositoryPath: "s3://${" + awsS3BucketExample.id + "}",
+        fileSystemId: example.id,
+        fileSystemPath: "/my-bucket",
+        s3: {
+          autoExportPolicy: {
+            events: ["NEW", "CHANGED", "DELETED"],
+          },
+          autoImportPolicy: {
+            events: ["NEW", "CHANGED", "DELETED"],
+          },
+        },
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsFsxDataRepositoryAssociationExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `batchImportMetaDataOnCreate` - (Optional) Set to true to run an import data repository task to import metadata from the data repository to the file system after the data repository association is created. Defaults to `false`.
+* `dataRepositoryPath` - (Required) The path to the Amazon S3 data repository that will be linked to the file system. The path must be an S3 bucket s3://myBucket/myPrefix/. This path specifies where in the S3 data repository files will be imported from or exported to. The same S3 bucket cannot be linked more than once to the same file system.
+* `fileSystemId` - (Required) The ID of the Amazon FSx file system to on which to create a data repository association.
+* `fileSystemPath` - (Required) A path on the file system that points to a high-level directory (such as `/ns1/`) or subdirectory (such as `/ns1/subdir/`) that will be mapped 1-1 with `dataRepositoryPath`. The leading forward slash in the name is required. Two data repository associations cannot have overlapping file system paths. For example, if a data repository is associated with file system path `/ns1/`, then you cannot link another data repository with file system path `/ns1/ns2`. This path specifies where in your file system files will be exported from or imported to. This file system directory can be linked to only one Amazon S3 bucket, and no other S3 bucket can be linked to the directory.
+* `importedFileChunkSize` - (Optional) For files imported from a data repository, this value determines the stripe count and maximum amount of data per file (in MiB) stored on a single physical disk. The maximum number of disks that a single file can be striped across is limited by the total number of disks that make up the file system.
+* `s3` - (Optional) See the [`s3` configuration](#s3-arguments) block. Max of 1.
+The configuration for an Amazon S3 data repository linked to an Amazon FSx Lustre file system with a data repository association. The configuration defines which file events (new, changed, or deleted files or directories) are automatically imported from the linked data repository to the file system or automatically exported from the file system to the data repository.
+* `deleteDataInFilesystem` - (Optional) Set to true to delete files from the file system upon deleting this data repository association. Defaults to `false`.
+* `tags` - (Optional) A map of tags to assign to the data repository association. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+#### S3 arguments
+
+* `autoExportPolicy` - (Optional) Specifies the type of updated objects that will be automatically exported from your file system to the linked S3 bucket. See the [`events` configuration](#events-arguments) block.
+* `autoImportPolicy` - (Optional) Specifies the type of updated objects that will be automatically imported from the linked S3 bucket to your file system. See the [`events` configuration](#events-arguments) block.
+
+#### Events arguments
+
+* `events` - (Optional) A list of file event types to automatically export to your linked S3 bucket or import from the linked S3 bucket. Valid values are `new`, `changed`, `deleted`. Max of 3.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name of the file system.
+* `id` - Identifier of the data repository association, e.g., `dra12345678`
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `10M`)
+* `update` - (Default `10M`)
+* `delete` - (Default `10M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import FSx Data Repository Associations using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import FSx Data Repository Associations using the `id`. For example:
+
+```console
+% terraform import aws_fsx_data_repository_association.example dra-0b1cfaeca11088b10
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ccbef1d76e1257a56bbcfd48884d7a6ba0aaf2b3d64139f2f28bb6a48fb634c8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/fsx_file_cache.html.markdown b/website/docs/cdktf/typescript/r/fsx_file_cache.html.markdown
new file mode 100644
index 00000000000..aea8598d577
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/fsx_file_cache.html.markdown
@@ -0,0 +1,158 @@
+---
+subcategory: "FSx"
+layout: "aws"
+page_title: "AWS: aws_fsx_file_cache"
+description: |-
+  Terraform resource for managing an Amazon File Cache cache.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_fsx_file_cache
+
+Terraform resource for managing an Amazon File Cache cache.
+See the [Create File Cache](https://docs.aws.amazon.com/fsx/latest/APIReference/API_CreateFileCache.html) for more information.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { FsxFileCache } from "./.gen/providers/aws/fsx-file-cache";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new FsxFileCache(this, "example", {
+      dataRepositoryAssociation: [
+        {
+          dataRepositoryPath: "nfs://filer.domain.com",
+          dataRepositorySubdirectories: ["test", "test2"],
+          fileCachePath: "/ns1",
+          nfs: [
+            {
+              dnsIps: ["192.168.0.1", "192.168.0.2"],
+              version: "NFS3",
+            },
+          ],
+        },
+      ],
+      fileCacheType: "LUSTRE",
+      fileCacheTypeVersion: "2.12",
+      lustreConfiguration: [
+        {
+          deploymentType: "CACHE_1",
+          metadataConfiguration: [
+            {
+              storageCapacity: 2400,
+            },
+          ],
+          perUnitStorageThroughput: 1000,
+          weeklyMaintenanceStartTime: "2:05:00",
+        },
+      ],
+      storageCapacity: 1200,
+      subnetIds: [test1.id],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `fileCacheType` - The type of cache that you're creating. The only supported value is `lustre`.
+* `fileCacheTypeVersion` - The version for the type of cache that you're creating. The only supported value is `212`.
+* `storageCapacity` - The storage capacity of the cache in gibibytes (GiB). Valid values are `1200` GiB, `2400` GiB, and increments of `2400` GiB.
+* `subnetIds` - A list of subnet IDs that the cache will be accessible from. You can specify only one subnet ID.
+
+The following arguments are optional:
+
+* `copyTagsToDataRepositoryAssociations` - A boolean flag indicating whether tags for the cache should be copied to data repository associations. This value defaults to false.
+* `dataRepositoryAssociation` - See the [`dataRepositoryAssociation` configuration](#data-repository-association-arguments) block. Max of 8.
+A list of up to 8 configurations for data repository associations (DRAs) to be created during the cache creation. The DRAs link the cache to either an Amazon S3 data repository or a Network File System (NFS) data repository that supports the NFSv3 protocol. The DRA configurations must meet the following requirements: 1) All configurations on the list must be of the same data repository type, either all S3 or all NFS. A cache can't link to different data repository types at the same time. 2) An NFS DRA must link to an NFS file system that supports the NFSv3 protocol. DRA automatic import and automatic export is not supported.
+* `kmsKeyId` - Specifies the ID of the AWS Key Management Service (AWS KMS) key to use for encrypting data on an Amazon File Cache. If a KmsKeyId isn't specified, the Amazon FSx-managed AWS KMS key for your account is used.
+* `lustreConfiguration` - See the [`lustreConfiguration`](#lustre-configuration-arguments) block. Required when `fileCacheType` is `lustre`.
+* `securityGroupIds` - A list of IDs specifying the security groups to apply to all network interfaces created for Amazon File Cache access.
+* `tags` - (Optional) A map of tags to assign to the file cache. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+#### Data Repository Association arguments
+
+The `dataRepositoryAssociation` configuration block supports the following arguments:
+
+* `fileCachePath` - (Required) A path on the cache that points to a high-level directory (such as /ns1/) or subdirectory (such as /ns1/subdir/) that will be mapped 1-1 with DataRepositoryPath. The leading forward slash in the name is required. Two data repository associations cannot have overlapping cache paths. For example, if a data repository is associated with cache path /ns1/, then you cannot link another data repository with cache path /ns1/ns2. This path specifies where in your cache files will be exported from. This cache directory can be linked to only one data repository, and no data repository other can be linked to the directory. Note: The cache path can only be set to root (/) on an NFS DRA when DataRepositorySubdirectories is specified. If you specify root (/) as the cache path, you can create only one DRA on the cache. The cache path cannot be set to root (/) for an S3 DRA.
+* `dataRepositoryPath` - (Optional) The path to the S3 or NFS data repository that links to the cache.
+* `dataRepositorySubdirectories` - (Optional) A list of NFS Exports that will be linked with this data repository association. The Export paths are in the format /exportpath1. To use this parameter, you must configure DataRepositoryPath as the domain name of the NFS file system. The NFS file system domain name in effect is the root of the subdirectories. Note that DataRepositorySubdirectories is not supported for S3 data repositories. Max of 500.
+* `nfs` - (Optional) - (Optional) See the [`nfs` configuration](#nfs-arguments) block.
+
+#### NFS arguments
+
+The `nfs` configuration block supports the following arguments:
+
+* `version` - (Required) - The version of the NFS (Network File System) protocol of the NFS data repository. The only supported value is NFS3, which indicates that the data repository must support the NFSv3 protocol. The only supported value is `nfs3`.
+* `dnsIps` - (Optional) - A list of up to 2 IP addresses of DNS servers used to resolve the NFS file system domain name. The provided IP addresses can either be the IP addresses of a DNS forwarder or resolver that the customer manages and runs inside the customer VPC, or the IP addresses of the on-premises DNS servers.
+
+#### Lustre Configuration arguments
+
+The `lustreConfiguration` configuration block supports the following arguments:
+
+* `deploymentType` - (Required) Specifies the cache deployment type. The only supported value is `cache1`.
+* `metadataConfiguration` - (Required) The configuration for a Lustre MDT (Metadata Target) storage volume. See the [`metadataConfiguration`](#metadata-configuration-arguments) block.
+* `perUnitStorageThroughput` - (Required) Provisions the amount of read and write throughput for each 1 tebibyte (TiB) of cache storage capacity, in MB/s/TiB. The only supported value is `1000`.
+* `weeklyMaintenanceStartTime` - (Optional) A recurring weekly time, in the format `d:hh:mm`. `d` is the day of the week, for which `1` represents Monday and `7` represents Sunday. `hh` is the zero-padded hour of the day (0-23), and `mm` is the zero-padded minute of the hour. For example, 1:05:00 specifies maintenance at 5 AM Monday. See the [ISO week date](https://en.wikipedia.org/wiki/ISO_week_date) for more information.
+
+#### Metadata Configuration arguments
+
+The `metadataConfiguration` configuration block supports the following arguments:
+
+* `storageCapacity` - (Required) The storage capacity of the Lustre MDT (Metadata Target) storage volume in gibibytes (GiB). The only supported value is `2400` GiB.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) for the resource.
+* `dataRepositoryAssociationIds` - A list of IDs of data repository associations that are associated with this cache.
+* `dnsName` - The Domain Name System (DNS) name for the cache.
+* `fileCacheId` - The system-generated, unique ID of the cache.
+* `id` - The system-generated, unique ID of the cache.
+* `networkInterfaceIds` - A list of network interface IDs.
+* `vpcId` - The ID of your virtual private cloud (VPC).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `30M`)
+* `update` - (Default `30M`)
+* `delete` - (Default `30M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Amazon File Cache cache using the resource `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Amazon File Cache cache using the resource `id`. For example:
+
+```console
+% terraform import aws_fsx_file_cache.example fc-8012925589
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1859ea99cb9d6d35c3bafa1903ea724f9611978baf76d96694a45ea873f2f1c0 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/fsx_lustre_file_system.html.markdown b/website/docs/cdktf/typescript/r/fsx_lustre_file_system.html.markdown
new file mode 100644
index 00000000000..caa5d5bceb4
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/fsx_lustre_file_system.html.markdown
@@ -0,0 +1,150 @@
+---
+subcategory: "FSx"
+layout: "aws"
+page_title: "AWS: aws_fsx_lustre_file_system"
+description: |-
+  Manages a FSx Lustre File System.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_fsx_lustre_file_system
+
+Manages a FSx Lustre File System. See the [FSx Lustre Guide](https://docs.aws.amazon.com/fsx/latest/LustreGuide/what-is.html) for more information.
+
+~> **NOTE:** `autoImportPolicy`, `exportPath`, `importPath` and `importedFileChunkSize` are not supported with the `persistent2` deployment type. Use `awsFsxDataRepositoryAssociation` instead.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { FsxLustreFileSystem } from "./.gen/providers/aws/fsx-lustre-file-system";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new FsxLustreFileSystem(this, "example", {
+      importPath: "s3://${" + awsS3BucketExample.bucket + "}",
+      storageCapacity: 1200,
+      subnetIds: [Token.asString(awsSubnetExample.id)],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `storageCapacity` - (Optional) The storage capacity (GiB) of the file system. Minimum of `1200`. See more details at [Allowed values for Fsx storage capacity](https://docs.aws.amazon.com/fsx/latest/APIReference/API_CreateFileSystem.html#FSx-CreateFileSystem-request-StorageCapacity). Update is allowed only for `scratch2`, `persistent1` and `persistent2` deployment types, See more details at [Fsx Storage Capacity Update](https://docs.aws.amazon.com/fsx/latest/APIReference/API_UpdateFileSystem.html#FSx-UpdateFileSystem-request-StorageCapacity). Required when not creating filesystem for a backup.
+* `subnetIds` - (Required) A list of IDs for the subnets that the file system will be accessible from. File systems currently support only one subnet. The file server is also launched in that subnet's Availability Zone.
+* `backupId` - (Optional) The ID of the source backup to create the filesystem from.
+* `exportPath` - (Optional) S3 URI (with optional prefix) where the root of your Amazon FSx file system is exported. Can only be specified with `importPath` argument and the path must use the same Amazon S3 bucket as specified in `importPath`. Set equal to `importPath` to overwrite files on export. Defaults to `s3://{IMPORT BUCKET}/FSxLustre{CREATION TIMESTAMP}`. Only supported on `persistent1` deployment types.
+* `importPath` - (Optional) S3 URI (with optional prefix) that you're using as the data repository for your FSx for Lustre file system. For example, `s3://exampleBucket/optionalPrefix/`. Only supported on `persistent1` deployment types.
+* `importedFileChunkSize` - (Optional) For files imported from a data repository, this value determines the stripe count and maximum amount of data per file (in MiB) stored on a single physical disk. Can only be specified with `importPath` argument. Defaults to `1024`. Minimum of `1` and maximum of `512000`. Only supported on `persistent1` deployment types.
+* `securityGroupIds` - (Optional) A list of IDs for the security groups that apply to the specified network interfaces created for file system access. These security groups will apply to all network interfaces.
+* `tags` - (Optional) A map of tags to assign to the file system. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `weeklyMaintenanceStartTime` - (Optional) The preferred start time (in `d:hh:mm` format) to perform weekly maintenance, in the UTC time zone.
+* `deploymentType` - (Optional) - The filesystem deployment type. One of: `scratch1`, `scratch2`, `persistent1`, `persistent2`.
+* `kmsKeyId` - (Optional) ARN for the KMS Key to encrypt the file system at rest, applicable for `persistent1` and `persistent2` deployment_type. Defaults to an AWS managed KMS Key.
+* `perUnitStorageThroughput` - (Optional) - Describes the amount of read and write throughput for each 1 tebibyte of storage, in MB/s/TiB, required for the `persistent1` and `persistent2` deployment_type. Valid values for `persistent1` deployment_type and `ssd` storage_type are 50, 100, 200. Valid values for `persistent1` deployment_type and `hdd` storage_type are 12, 40. Valid values for `persistent2` deployment_type and ` SSD` storage_type are 125, 250, 500, 1000.
+* `automaticBackupRetentionDays` - (Optional) The number of days to retain automatic backups. Setting this to 0 disables automatic backups. You can retain automatic backups for a maximum of 90 days. only valid for `persistent1` and `persistent2` deployment_type.
+* `storageType` - (Optional) - The filesystem storage type. Either `ssd` or `hdd`, defaults to `ssd`. `hdd` is only supported on `persistent1` deployment types.
+* `driveCacheType` - (Optional) - The type of drive cache used by `persistent1` filesystems that are provisioned with `hdd` storage_type. Required for `hdd` storage_type, set to either `read` or `none`.
+* `dailyAutomaticBackupStartTime` - (Optional) A recurring daily time, in the format HH:MM. HH is the zero-padded hour of the day (0-23), and MM is the zero-padded minute of the hour. For example, 05:00 specifies 5 AM daily. only valid for `persistent1` and `persistent2` deployment_type. Requires `automaticBackupRetentionDays` to be set.
+* `autoImportPolicy` - (Optional) How Amazon FSx keeps your file and directory listings up to date as you add or modify objects in your linked S3 bucket. see [Auto Import Data Repo](https://docs.aws.amazon.com/fsx/latest/LustreGuide/autoimport-data-repo.html) for more details. Only supported on `persistent1` deployment types.
+* `copyTagsToBackups` - (Optional) A boolean flag indicating whether tags for the file system should be copied to backups. Applicable for `persistent1` and `persistent2` deployment_type. The default value is false.
+* `dataCompressionType` - (Optional) Sets the data compression configuration for the file system. Valid values are `lz4` and `none`. Default value is `none`. Unsetting this value reverts the compression type back to `none`.
+* `fileSystemTypeVersion` - (Optional) Sets the Lustre version for the file system that you're creating. Valid values are 2.10 for `scratch1`, `scratch2` and `persistent1` deployment types. Valid values for 2.12 include all deployment types.
+* `logConfiguration` - (Optional) The Lustre logging configuration used when creating an Amazon FSx for Lustre file system. When logging is enabled, Lustre logs error and warning events for data repositories associated with your file system to Amazon CloudWatch Logs.
+* `rootSquashConfiguration` - (Optional) The Lustre root squash configuration used when creating an Amazon FSx for Lustre file system. When enabled, root squash restricts root-level access from clients that try to access your file system as a root user.
+
+### log_configuration
+
+* `destination` - (Optional) The Amazon Resource Name (ARN) that specifies the destination of the logs. The name of the Amazon CloudWatch Logs log group must begin with the `/aws/fsx` prefix. If you do not provide a destination, Amazon FSx will create and use a log stream in the CloudWatch Logs `/aws/fsx/lustre` log group.
+* `level` - (Optional) Sets which data repository events are logged by Amazon FSx. Valid values are `warnOnly`, `failureOnly`, `errorOnly`, `warnError` and `disabled`. Default value is `disabled`.
+
+### root_squash_configuration
+
+* `noSquashNids` - (Optional) When root squash is enabled, you can optionally specify an array of NIDs of clients for which root squash does not apply. A client NID is a Lustre Network Identifier used to uniquely identify a client. You can specify the NID as either a single address or a range of addresses: 1. A single address is described in standard Lustre NID format by specifying the client’s IP address followed by the Lustre network ID (for example, 10.0.1.6@tcp). 2. An address range is described using a dash to separate the range (for example, 10.0.[2-10].[1-255]@tcp).
+* `rootSquash` - (Optional) You enable root squash by setting a user ID (UID) and group ID (GID) for the file system in the format UID:GID (for example, 365534:65534). The UID and GID values can range from 0 to 4294967294.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name of the file system.
+* `dnsName` - DNS name for the file system, e.g., `fs12345678FsxUsWest2AmazonawsCom`
+* `id` - Identifier of the file system, e.g., `fs12345678`
+* `networkInterfaceIds` - Set of Elastic Network Interface identifiers from which the file system is accessible. As explained in the [documentation](https://docs.aws.amazon.com/fsx/latest/LustreGuide/mounting-on-premises.html), the first network interface returned is the primary network interface.
+* `mountName` - The value to be used when mounting the filesystem.
+* `ownerId` - AWS account identifier that created the file system.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `vpcId` - Identifier of the Virtual Private Cloud for the file system.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `30M`)
+* `update` - (Default `30M`)
+* `delete` - (Default `30M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import FSx File Systems using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import FSx File Systems using the `id`. For example:
+
+```console
+% terraform import aws_fsx_lustre_file_system.example fs-543ab12b1ca672f33
+```
+
+Certain resource arguments, like `securityGroupIds`, do not have a FSx API method for reading the information after creation. If the argument is set in the Terraform configuration on an imported resource, Terraform will always show a difference. To workaround this behavior, either omit the argument from the Terraform configuration or use [`ignoreChanges`](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html#ignore_changes) to hide the difference. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { FsxLustreFileSystem } from "./.gen/providers/aws/fsx-lustre-file-system";
+interface MyConfig {
+  subnetIds: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new FsxLustreFileSystem(this, "example", {
+      lifecycle: {
+        ignoreChanges: [securityGroupIds],
+      },
+      securityGroupIds: [Token.asString(awsSecurityGroupExample.id)],
+      subnetIds: config.subnetIds,
+    });
+  }
+}
+
+```
+
+<!-- cache-key: cdktf-0.18.0 input-2ed523e5edea92ba7aad4326103ac0db6486835dcbf78b6a54ded8c844851b3e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/fsx_ontap_file_system.html.markdown b/website/docs/cdktf/typescript/r/fsx_ontap_file_system.html.markdown
new file mode 100644
index 00000000000..35c4294d9cd
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/fsx_ontap_file_system.html.markdown
@@ -0,0 +1,156 @@
+---
+subcategory: "FSx"
+layout: "aws"
+page_title: "AWS: aws_fsx_ontap_file_system"
+description: |-
+  Manages an Amazon FSx for NetApp ONTAP file system.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_fsx_ontap_file_system
+
+Manages an Amazon FSx for NetApp ONTAP file system.
+See the [FSx ONTAP User Guide](https://docs.aws.amazon.com/fsx/latest/ONTAPGuide/what-is-fsx-ontap.html) for more information.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { FsxOntapFileSystem } from "./.gen/providers/aws/fsx-ontap-file-system";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new FsxOntapFileSystem(this, "test", {
+      deploymentType: "MULTI_AZ_1",
+      preferredSubnetId: test1.id,
+      storageCapacity: 1024,
+      subnetIds: [test1.id, test2.id],
+      throughputCapacity: 512,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `storageCapacity` - (Optional) The storage capacity (GiB) of the file system. Valid values between `1024` and `196608`.
+* `subnetIds` - (Required) A list of IDs for the subnets that the file system will be accessible from. Upto 2 subnets can be provided.
+* `preferredSubnetId` - (Required) The ID for a subnet. A subnet is a range of IP addresses in your virtual private cloud (VPC).
+* `securityGroupIds` - (Optional) A list of IDs for the security groups that apply to the specified network interfaces created for file system access. These security groups will apply to all network interfaces.
+* `weeklyMaintenanceStartTime` - (Optional) The preferred start time (in `d:hh:mm` format) to perform weekly maintenance, in the UTC time zone.
+* `deploymentType` - (Optional) - The filesystem deployment type. Supports `multiAz1` and `singleAz1`.
+* `kmsKeyId` - (Optional) ARN for the KMS Key to encrypt the file system at rest, Defaults to an AWS managed KMS Key.
+* `automaticBackupRetentionDays` - (Optional) The number of days to retain automatic backups. Setting this to 0 disables automatic backups. You can retain automatic backups for a maximum of 90 days.
+* `dailyAutomaticBackupStartTime` - (Optional) A recurring daily time, in the format HH:MM. HH is the zero-padded hour of the day (0-23), and MM is the zero-padded minute of the hour. For example, 05:00 specifies 5 AM daily. Requires `automaticBackupRetentionDays` to be set.
+* `diskIopsConfiguration` - (Optional) The SSD IOPS configuration for the Amazon FSx for NetApp ONTAP file system. See [Disk Iops Configuration](#disk-iops-configuration) below.
+* `endpointIpAddressRange` - (Optional) Specifies the IP address range in which the endpoints to access your file system will be created. By default, Amazon FSx selects an unused IP address range for you from the 198.19.* range.
+* `storageType` - (Optional) - The filesystem storage type. defaults to `ssd`.
+* `fsxAdminPassword` - (Optional) The ONTAP administrative password for the fsxadmin user that you can use to administer your file system using the ONTAP CLI and REST API.
+* `routeTableIds` - (Optional) Specifies the VPC route tables in which your file system's endpoints will be created. You should specify all VPC route tables associated with the subnets in which your clients are located. By default, Amazon FSx selects your VPC's default route table.
+* `tags` - (Optional) A map of tags to assign to the file system. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `throughputCapacity` - (Required) Sets the throughput capacity (in MBps) for the file system that you're creating. Valid values are `128`, `256`, `512`, `1024`, `2048`, and `4096`.
+
+### Disk Iops Configuration
+
+* `iops` - (Optional) - The total number of SSD IOPS provisioned for the file system.
+* `mode` - (Optional) - Specifies whether the number of IOPS for the file system is using the system. Valid values are `automatic` and `userProvisioned`. Default value is `automatic`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name of the file system.
+* `dnsName` - DNS name for the file system, e.g., `fs12345678FsxUsWest2AmazonawsCom`
+* `endpoints` - The endpoints that are used to access data or to manage the file system using the NetApp ONTAP CLI, REST API, or NetApp SnapMirror. See [Endpoints](#endpoints) below.
+* `id` - Identifier of the file system, e.g., `fs12345678`
+* `networkInterfaceIds` - Set of Elastic Network Interface identifiers from which the file system is accessible The first network interface returned is the primary network interface.
+* `ownerId` - AWS account identifier that created the file system.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `vpcId` - Identifier of the Virtual Private Cloud for the file system.
+
+### Endpoints
+
+* `intercluster` - An endpoint for managing your file system by setting up NetApp SnapMirror with other ONTAP systems. See [Endpoint](#endpoint).
+* `management` - An endpoint for managing your file system using the NetApp ONTAP CLI and NetApp ONTAP API. See [Endpoint](#endpoint).
+
+#### Endpoint
+
+* `dnsName` - The Domain Name Service (DNS) name for the file system. You can mount your file system using its DNS name.
+* `ipAddresses` - IP addresses of the file system endpoint.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `60M`)
+* `update` - (Default `60M`)
+* `delete` - (Default `60M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import FSx File Systems using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import FSx File Systems using the `id`. For example:
+
+```console
+% terraform import aws_fsx_ontap_file_system.example fs-543ab12b1ca672f33
+```
+
+Certain resource arguments, like `securityGroupIds`, do not have a FSx API method for reading the information after creation. If the argument is set in the Terraform configuration on an imported resource, Terraform will always show a difference. To workaround this behavior, either omit the argument from the Terraform configuration or use [`ignoreChanges`](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html#ignore_changes) to hide the difference. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { FsxOntapFileSystem } from "./.gen/providers/aws/fsx-ontap-file-system";
+interface MyConfig {
+  deploymentType: any;
+  preferredSubnetId: any;
+  subnetIds: any;
+  throughputCapacity: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new FsxOntapFileSystem(this, "example", {
+      lifecycle: {
+        ignoreChanges: [securityGroupIds],
+      },
+      securityGroupIds: [Token.asString(awsSecurityGroupExample.id)],
+      deploymentType: config.deploymentType,
+      preferredSubnetId: config.preferredSubnetId,
+      subnetIds: config.subnetIds,
+      throughputCapacity: config.throughputCapacity,
+    });
+  }
+}
+
+```
+
+<!-- cache-key: cdktf-0.18.0 input-134bc14f228fe82b4650aaa88cebc5d01bdf04be8f95607b99c8c282d98c71c1 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/fsx_ontap_storage_virtual_machine.html.markdown b/website/docs/cdktf/typescript/r/fsx_ontap_storage_virtual_machine.html.markdown
new file mode 100644
index 00000000000..5cc13754d63
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/fsx_ontap_storage_virtual_machine.html.markdown
@@ -0,0 +1,187 @@
+---
+subcategory: "FSx"
+layout: "aws"
+page_title: "AWS: aws_fsx_ontap_storage_virtual_machine"
+description: |-
+  Manages a FSx Storage Virtual Machine.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_fsx_ontap_storage_virtual_machine
+
+Manages a FSx Storage Virtual Machine.
+See the [FSx ONTAP User Guide](https://docs.aws.amazon.com/fsx/latest/ONTAPGuide/managing-svms.html) for more information.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { FsxOntapStorageVirtualMachine } from "./.gen/providers/aws/fsx-ontap-storage-virtual-machine";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new FsxOntapStorageVirtualMachine(this, "test", {
+      fileSystemId: Token.asString(awsFsxOntapFileSystemTest.id),
+      name: "test",
+    });
+  }
+}
+
+```
+
+### Using a Self-Managed Microsoft Active Directory
+
+Additional information for using AWS Directory Service with ONTAP File Systems can be found in the [FSx ONTAP Guide](https://docs.aws.amazon.com/fsx/latest/ONTAPGuide/self-managed-AD.html).
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { FsxOntapStorageVirtualMachine } from "./.gen/providers/aws/fsx-ontap-storage-virtual-machine";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new FsxOntapStorageVirtualMachine(this, "test", {
+      activeDirectoryConfiguration: {
+        netbiosName: "mysvm",
+        selfManagedActiveDirectoryConfiguration: {
+          dnsIps: ["10.0.0.111", "10.0.0.222"],
+          domainName: "corp.example.com",
+          password: "avoid-plaintext-passwords",
+          username: "Admin",
+        },
+      },
+      fileSystemId: Token.asString(awsFsxOntapFileSystemTest.id),
+      name: "mysvm",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `activeDirectoryConfiguration` - (Optional) Configuration block that Amazon FSx uses to join the FSx ONTAP Storage Virtual Machine(SVM) to your Microsoft Active Directory (AD) directory. Detailed below.
+* `fileSystemId` - (Required) The ID of the Amazon FSx ONTAP File System that this SVM will be created on.
+* `name` - (Required) The name of the SVM. You can use a maximum of 47 alphanumeric characters, plus the underscore (_) special character.
+* `rootVolumeSecurityStyle` - (Optional) Specifies the root volume security style, Valid values are `unix`, `ntfs`, and `mixed`. All volumes created under this SVM will inherit the root security style unless the security style is specified on the volume. Default value is `unix`.
+* `tags` - (Optional) A map of tags to assign to the storage virtual machine. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### active_directory_configuration
+
+The `activeDirectoryConfiguration` configuration block supports the following arguments:
+
+* `netbiosName` - (Required) The NetBIOS name of the Active Directory computer object that will be created for your SVM. This is often the same as the SVM name but can be different. AWS limits to 15 characters because of standard NetBIOS naming limits.
+* `selfManagedActiveDirectory` - (Optional) Configuration block that Amazon FSx uses to join the SVM to your self-managed (including on-premises) Microsoft Active Directory (AD) directory.
+
+### self_managed_active_directory
+
+The `selfManagedActiveDirectory` configuration block supports the following arguments:
+
+* `dnsIps` - (Required) A list of up to three IP addresses of DNS servers or domain controllers in the self-managed AD directory.
+* `domainName` - (Required) The fully qualified domain name of the self-managed AD directory. For example, `corpExampleCom`.
+* `password` - (Required) The password for the service account on your self-managed AD domain that Amazon FSx will use to join to your AD domain.
+* `username` - (Required) The user name for the service account on your self-managed AD domain that Amazon FSx will use to join to your AD domain.
+* `fileSystemAdministratorsGroup` - (Optional) The name of the domain group whose members are granted administrative privileges for the SVM. The group that you specify must already exist in your domain. Defaults to `Domain Admins`.
+* `organizationalUnitDistinguishedName` - (Optional) The fully qualified distinguished name of the organizational unit within your self-managed AD directory that the Windows File Server instance will join. For example, `ou=fSx,dc=yourdomain,dc=corp,dc=com`. Only accepts OU as the direct parent of the SVM. If none is provided, the SVM is created in the default location of your self-managed AD directory. To learn more, see [RFC 2253](https://tools.ietf.org/html/rfc2253).
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name of the storage virtual machine.
+* `endpoints` - The endpoints that are used to access data or to manage the storage virtual machine using the NetApp ONTAP CLI, REST API, or NetApp SnapMirror. See [Endpoints](#endpoints) below.
+* `id` - Identifier of the storage virtual machine, e.g., `svm12345678`
+* `subtype` - Describes the SVM's subtype, e.g. `default`
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `uuid` - The SVM's UUID (universally unique identifier).
+
+### Endpoints
+
+* `iscsi` - An endpoint for accessing data on your storage virtual machine via iSCSI protocol. See [Endpoint](#endpoint).
+* `management` - An endpoint for managing your file system using the NetApp ONTAP CLI and NetApp ONTAP API. See [Endpoint](#endpoint).
+* `nfs` - An endpoint for accessing data on your storage virtual machine via NFS protocol. See [Endpoint](#endpoint).
+* `smb` - An endpoint for accessing data on your storage virtual machine via SMB protocol. This is only set if an active_directory_configuration has been set. See [Endpoint](#endpoint).
+
+#### Endpoint
+
+* `dnsName` - The Domain Name Service (DNS) name for the storage virtual machine. You can mount your storage virtual machine using its DNS name.
+* `ipAddresses` - IP addresses of the storage virtual machine endpoint.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `30M`)
+* `delete` - (Default `30M`)
+* `update` - (Default `30M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import FSx Storage Virtual Machine using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import FSx Storage Virtual Machine using the `id`. For example:
+
+```console
+% terraform import aws_fsx_ontap_storage_virtual_machine.example svm-12345678abcdef123
+```
+
+Certain resource arguments, like `svmAdminPassword` and the `selfManagedActiveDirectory` configuation block `password`, do not have a FSx API method for reading the information after creation. If these arguments are set in the Terraform configuration on an imported resource, Terraform will always show a difference. To workaround this behavior, either omit the argument from the Terraform configuration or use [`ignoreChanges`](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html#ignore_changes) to hide the difference. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { FsxOntapStorageVirtualMachine } from "./.gen/providers/aws/fsx-ontap-storage-virtual-machine";
+interface MyConfig {
+  fileSystemId: any;
+  name: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new FsxOntapStorageVirtualMachine(this, "example", {
+      lifecycle: {
+        ignoreChanges: [svmAdminPassword],
+      },
+      svmAdminPassword: "avoid-plaintext-passwords",
+      fileSystemId: config.fileSystemId,
+      name: config.name,
+    });
+  }
+}
+
+```
+
+<!-- cache-key: cdktf-0.18.0 input-74ebf93c5246fec0a83d413f672feb2cd78262f5765744a5bca89505730e563b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/fsx_ontap_volume.html.markdown b/website/docs/cdktf/typescript/r/fsx_ontap_volume.html.markdown
new file mode 100644
index 00000000000..79cf1f5d542
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/fsx_ontap_volume.html.markdown
@@ -0,0 +1,171 @@
+---
+subcategory: "FSx"
+layout: "aws"
+page_title: "AWS: aws_fsx_ontap_volume"
+description: |-
+  Manages a FSx ONTAP Volume.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_fsx_ontap_volume
+
+Manages a FSx ONTAP Volume.
+See the [FSx ONTAP User Guide](https://docs.aws.amazon.com/fsx/latest/ONTAPGuide/managing-volumes.html) for more information.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { FsxOntapVolume } from "./.gen/providers/aws/fsx-ontap-volume";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new FsxOntapVolume(this, "test", {
+      junctionPath: "/test",
+      name: "test",
+      sizeInMegabytes: 1024,
+      storageEfficiencyEnabled: true,
+      storageVirtualMachineId: Token.asString(
+        awsFsxOntapStorageVirtualMachineTest.id
+      ),
+    });
+  }
+}
+
+```
+
+### Using Tiering Policy
+
+Additional information on tiering policy with ONTAP Volumes can be found in the [FSx ONTAP Guide](https://docs.aws.amazon.com/fsx/latest/ONTAPGuide/managing-volumes.html).
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { FsxOntapVolume } from "./.gen/providers/aws/fsx-ontap-volume";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new FsxOntapVolume(this, "test", {
+      junctionPath: "/test",
+      name: "test",
+      sizeInMegabytes: 1024,
+      storageEfficiencyEnabled: true,
+      storageVirtualMachineId: Token.asString(
+        awsFsxOntapStorageVirtualMachineTest.id
+      ),
+      tieringPolicy: {
+        coolingPeriod: 31,
+        name: "AUTO",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the Volume. You can use a maximum of 203 alphanumeric characters, plus the underscore (_) special character.
+* `bypassSnaplockEnterpriseRetention` - (Optional) Setting this to `true` allows a SnapLock administrator to delete an FSx for ONTAP SnapLock Enterprise volume with unexpired write once, read many (WORM) files. This configuration must be applied separately before attempting to delete the resource to have the desired behavior. Defaults to `false`.
+* `copyTagsToBackups` - (Optional) A boolean flag indicating whether tags for the volume should be copied to backups. This value defaults to `false`.
+* `junctionPath` - (Optional) Specifies the location in the storage virtual machine's namespace where the volume is mounted. The junction_path must have a leading forward slash, such as `/vol3`
+* `ontapVolumeType` - (Optional) Specifies the type of volume, valid values are `rw`, `dp`. Default value is `rw`. These can be set by the ONTAP CLI or API. This setting is used as part of migration and replication [Migrating to Amazon FSx for NetApp ONTAP](https://docs.aws.amazon.com/fsx/latest/ONTAPGuide/migrating-fsx-ontap.html)
+* `securityStyle` - (Optional) Specifies the volume security style, Valid values are `unix`, `ntfs`, and `mixed`.
+* `sizeInMegabytes` - (Required) Specifies the size of the volume, in megabytes (MB), that you are creating.
+* `skipFinalBackup` - (Optional) When enabled, will skip the default final backup taken when the volume is deleted. This configuration must be applied separately before attempting to delete the resource to have the desired behavior. Defaults to `false`.
+* `snaplockConfiguration` - (Optional) The SnapLock configuration for an FSx for ONTAP volume. See [SnapLock Configuration](#snaplock-configuration) below.
+* `snapshotPolicy` - (Optional) Specifies the snapshot policy for the volume. See [snapshot policies](https://docs.aws.amazon.com/fsx/latest/ONTAPGuide/snapshots-ontap.html#snapshot-policies) in the Amazon FSx ONTAP User Guide
+* `storageEfficiencyEnabled` - (Optional) Set to true to enable deduplication, compression, and compaction storage efficiency features on the volume.
+* `storageVirtualMachineId` - (Required) Specifies the storage virtual machine in which to create the volume.
+* `tags` - (Optional) A map of tags to assign to the volume. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `tieringPolicy` - (Optional) The data tiering policy for an FSx for ONTAP volume. See [Tiering Policy](#tiering-policy) below.
+
+### SnapLock Configuration
+
+* `auditLogVolume` - (Optional) Enables or disables the audit log volume for an FSx for ONTAP SnapLock volume. The default value is `false`.
+* `autocommitPeriod` - (Optional) The configuration object for setting the autocommit period of files in an FSx for ONTAP SnapLock volume. See [Autocommit Period](#autocommit-period) below.
+* `privilegedDelete` - (Optional) Enables, disables, or permanently disables privileged delete on an FSx for ONTAP SnapLock Enterprise volume. Valid values: `disabled`, `enabled`, `permanentlyDisabled`. The default value is `disabled`.
+* `retentionPeriod` - (Optional) The retention period of an FSx for ONTAP SnapLock volume. See [SnapLock Retention Period](#snaplock-retention-period) below.
+* `snaplockType` - (Required) Specifies the retention mode of an FSx for ONTAP SnapLock volume. After it is set, it can't be changed. Valid values: `compliance`, `enterprise`.
+* `volumeAppendModeEnabled` - (Optional) Enables or disables volume-append mode on an FSx for ONTAP SnapLock volume. The default value is `false`.
+
+### Autocommit Period
+
+* `type` - (Required) The type of time for the autocommit period of a file in an FSx for ONTAP SnapLock volume. Setting this value to `none` disables autocommit. Valid values: `minutes`, `hours`, `days`, `months`, `years`, `none`.
+* `value` - (Optional) The amount of time for the autocommit period of a file in an FSx for ONTAP SnapLock volume.
+
+### SnapLock Retention Period
+
+* `defaultRetention` - (Required) The retention period assigned to a write once, read many (WORM) file by default if an explicit retention period is not set for an FSx for ONTAP SnapLock volume. The default retention period must be greater than or equal to the minimum retention period and less than or equal to the maximum retention period. See [Retention Period](#retention-period) below.
+* `maximumRetention` - (Required) The longest retention period that can be assigned to a WORM file on an FSx for ONTAP SnapLock volume. See [Retention Period](#retention-period) below.
+* `minimumRetention` - (Required) The shortest retention period that can be assigned to a WORM file on an FSx for ONTAP SnapLock volume. See [Retention Period](#retention-period) below.
+
+### Retention Period
+
+* `type` - (Required) The type of time for the retention period of an FSx for ONTAP SnapLock volume. Set it to one of the valid types. If you set it to `infinite`, the files are retained forever. If you set it to `unspecified`, the files are retained until you set an explicit retention period. Valid values: `seconds`, `minutes`, `hours`, `days`, `months`, `years`, `infinite`, `unspecified`.
+* `value` - (Optional) The amount of time for the autocommit period of a file in an FSx for ONTAP SnapLock volume.
+
+### Tiering Policy
+
+* `name` - (Required) Specifies the tiering policy for the ONTAP volume for moving data to the capacity pool storage. Valid values are `snapshotOnly`, `auto`, `all`, `none`. Default value is `snapshotOnly`.
+* `coolingPeriod` - (Optional) Specifies the number of days that user data in a volume must remain inactive before it is considered "cold" and moved to the capacity pool. Used with `auto` and `snapshotOnly` tiering policies only. Valid values are whole numbers between 2 and 183. Default values are 31 days for `auto` and 2 days for `snapshotOnly`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name of the volune.
+* `id` - Identifier of the volume, e.g., `fsvol12345678`
+* `fileSystemId` - Describes the file system for the volume, e.g. `fs12345679`
+* `flexcacheEndpointType` - Specifies the FlexCache endpoint type of the volume, Valid values are `none`, `origin`, `cache`. Default value is `none`. These can be set by the ONTAP CLI or API and are use with FlexCache feature.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `uuid` - The Volume's UUID (universally unique identifier).
+* `volumeType` - The type of volume, currently the only valid value is `ontap`.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `30M`)
+* `delete` - (Default `30M`)
+* `update` - (Default `30M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import FSx ONTAP volume using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import FSx ONTAP volume using the `id`. For example:
+
+```console
+% terraform import aws_fsx_ontap_volume.example fsvol-12345678abcdef123
+```
+
+<!-- cache-key: cdktf-0.18.0 input-4150b6016178afdca4f0be9139d92abeffcd41f64e3fc04737a2e1147ba2af7e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/fsx_openzfs_file_system.html.markdown b/website/docs/cdktf/typescript/r/fsx_openzfs_file_system.html.markdown
new file mode 100644
index 00000000000..e41f92ff9d0
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/fsx_openzfs_file_system.html.markdown
@@ -0,0 +1,170 @@
+---
+subcategory: "FSx"
+layout: "aws"
+page_title: "AWS: aws_fsx_openzfs_file_system"
+description: |-
+  Manages an Amazon FSx for OpenZFS file system.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_fsx_openzfs_file_system
+
+Manages an Amazon FSx for OpenZFS file system.
+See the [FSx OpenZFS User Guide](https://docs.aws.amazon.com/fsx/latest/OpenZFSGuide/what-is-fsx.html) for more information.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { FsxOpenzfsFileSystem } from "./.gen/providers/aws/fsx-openzfs-file-system";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new FsxOpenzfsFileSystem(this, "test", {
+      deploymentType: "SINGLE_AZ_1",
+      storageCapacity: 64,
+      subnetIds: [test1.id],
+      throughputCapacity: 64,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `deploymentType` - (Required) - The filesystem deployment type. Valid values: `singleAz1`, `singleAz2` and `multiAz1`.
+* `storageCapacity` - (Required) The storage capacity (GiB) of the file system. Valid values between `64` and `524288`.
+* `subnetIds` - (Required) A list of IDs for the subnets that the file system will be accessible from.
+* `throughputCapacity` - (Required) Throughput (MB/s) of the file system. Valid values depend on `deploymentType`. Must be one of `64`, `128`, `256`, `512`, `1024`, `2048`, `3072`, `4096` for `singleAz1`. Must be one of `160`, `320`, `640`, `1280`, `2560`, `3840`, `5120`, `7680`, `10240` for `singleAz2`.
+* `automaticBackupRetentionDays` - (Optional) The number of days to retain automatic backups. Setting this to 0 disables automatic backups. You can retain automatic backups for a maximum of 90 days.
+* `backupId` - (Optional) The ID of the source backup to create the filesystem from.
+* `copyTagsToBackups` - (Optional) A boolean flag indicating whether tags for the file system should be copied to backups. The default value is false.
+* `copyTagsToVolumes` - (Optional) A boolean flag indicating whether tags for the file system should be copied to snapshots. The default value is false.
+* `dailyAutomaticBackupStartTime` - (Optional) A recurring daily time, in the format HH:MM. HH is the zero-padded hour of the day (0-23), and MM is the zero-padded minute of the hour. For example, 05:00 specifies 5 AM daily. Requires `automaticBackupRetentionDays` to be set.
+* `diskIopsConfiguration` - (Optional) The SSD IOPS configuration for the Amazon FSx for OpenZFS file system. See [Disk Iops Configuration](#disk-iops-configuration) below.
+* `endpointIpAddressRange` - (Optional) (Multi-AZ only) Specifies the IP address range in which the endpoints to access your file system will be created.
+* `kmsKeyId` - (Optional) ARN for the KMS Key to encrypt the file system at rest, Defaults to an AWS managed KMS Key.
+* `preferredSubnetId` - (Optional) (Multi-AZ only) Required when `deploymentType` is set to `multiAz1`. This specifies the subnet in which you want the preferred file server to be located.
+* `rootVolumeConfiguration` - (Optional) The configuration for the root volume of the file system. All other volumes are children or the root volume. See [Root Volume Configuration](#root-volume-configuration) below.
+* `routeTableIds` - (Optional) (Multi-AZ only) Specifies the route tables in which Amazon FSx creates the rules for routing traffic to the correct file server. You should specify all virtual private cloud (VPC) route tables associated with the subnets in which your clients are located. By default, Amazon FSx selects your VPC's default route table.
+* `securityGroupIds` - (Optional) A list of IDs for the security groups that apply to the specified network interfaces created for file system access. These security groups will apply to all network interfaces.
+* `storageType` - (Optional) The filesystem storage type. Only `ssd` is supported.
+* `tags` - (Optional) A map of tags to assign to the file system. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `weeklyMaintenanceStartTime` - (Optional) The preferred start time (in `d:hh:mm` format) to perform weekly maintenance, in the UTC time zone.
+
+### Disk Iops Configuration
+
+* `iops` - (Optional) - The total number of SSD IOPS provisioned for the file system.
+* `mode` - (Optional) - Specifies whether the number of IOPS for the file system is using the system. Valid values are `automatic` and `userProvisioned`. Default value is `automatic`.
+
+### Root Volume Configuration
+
+* `copyTagsToSnapshots` - (Optional) - A boolean flag indicating whether tags for the file system should be copied to snapshots. The default value is false.
+* `dataCompressionType` - (Optional) - Method used to compress the data on the volume. Valid values are `lz4`, `none` or `zstd`. Child volumes that don't specify compression option will inherit from parent volume. This option on file system applies to the root volume.
+* `nfsExports` - (Optional) - NFS export configuration for the root volume. Exactly 1 item. See [NFS Exports](#nfs-exports) Below.
+* `readOnly` - (Optional) - specifies whether the volume is read-only. Default is false.
+* `recordSizeKib` - (Optional) - Specifies the record size of an OpenZFS root volume, in kibibytes (KiB). Valid values are `4`, `8`, `16`, `32`, `64`, `128`, `256`, `512`, or `1024` KiB. The default is `128` KiB.
+* `userAndGroupQuotas` - (Optional) - Specify how much storage users or groups can use on the volume. Maximum of 100 items. See [User and Group Quotas](#user-and-group-quotas) Below.
+
+### NFS Exports
+
+* `clientConfigurations` - (Required) - A list of configuration objects that contain the client and options for mounting the OpenZFS file system. Maximum of 25 items. See [Client Configurations](#client configurations) Below.
+
+### Client Configurations
+
+* `clients` - (Required) - A value that specifies who can mount the file system. You can provide a wildcard character (*), an IP address (0.0.0.0), or a CIDR address (192.0.2.0/24. By default, Amazon FSx uses the wildcard character when specifying the client.
+* `options` - (Required) -  The options to use when mounting the file system. Maximum of 20 items. See the [Linix NFS exports man page](https://linux.die.net/man/5/exports) for more information. `crossmount` and `sync` are used by default.
+
+### User and Group Quotas
+
+* `id` - (Required) - The ID of the user or group. Valid values between `0` and `2147483647`
+* `storageCapacityQuotaGib` - (Required) - The amount of storage that the user or group can use in gibibytes (GiB). Valid values between `0` and `2147483647`
+* `type` - (Required) - A value that specifies whether the quota applies to a user or group. Valid values are `user` or `group`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name of the file system.
+* `dnsName` - DNS name for the file system, e.g., `fs12345678FsxUsWest2AmazonawsCom`
+* `id` - Identifier of the file system, e.g., `fs12345678`
+* `networkInterfaceIds` - Set of Elastic Network Interface identifiers from which the file system is accessible The first network interface returned is the primary network interface.
+* `rootVolumeId` - Identifier of the root volume, e.g., `fsvol12345678`
+* `ownerId` - AWS account identifier that created the file system.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `vpcId` - Identifier of the Virtual Private Cloud for the file system.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `60M`)
+* `update` - (Default `60M`)
+* `delete` - (Default `60M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import FSx File Systems using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import FSx File Systems using the `id`. For example:
+
+```console
+% terraform import aws_fsx_openzfs_file_system.example fs-543ab12b1ca672f33
+```
+
+Certain resource arguments, like `securityGroupIds`, do not have a FSx API method for reading the information after creation. If the argument is set in the Terraform configuration on an imported resource, Terraform will always show a difference. To workaround this behavior, either omit the argument from the Terraform configuration or use [`ignoreChanges`](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html#ignore_changes) to hide the difference. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { FsxOpenzfsFileSystem } from "./.gen/providers/aws/fsx-openzfs-file-system";
+interface MyConfig {
+  deploymentType: any;
+  subnetIds: any;
+  throughputCapacity: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new FsxOpenzfsFileSystem(this, "example", {
+      lifecycle: {
+        ignoreChanges: [securityGroupIds],
+      },
+      securityGroupIds: [Token.asString(awsSecurityGroupExample.id)],
+      deploymentType: config.deploymentType,
+      subnetIds: config.subnetIds,
+      throughputCapacity: config.throughputCapacity,
+    });
+  }
+}
+
+```
+
+<!-- cache-key: cdktf-0.18.0 input-747caeeb6ae73c2beade6eba7cdec24bd727587f1c4cbe894ef193c84d502d2e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/fsx_openzfs_snapshot.html.markdown b/website/docs/cdktf/typescript/r/fsx_openzfs_snapshot.html.markdown
new file mode 100644
index 00000000000..54b2e6f969e
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/fsx_openzfs_snapshot.html.markdown
@@ -0,0 +1,143 @@
+---
+subcategory: "FSx"
+layout: "aws"
+page_title: "AWS: aws_fsx_openzfs_snapshot"
+description: |-
+  Manages an Amazon FSx for OpenZFS snapshot.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_fsx_openzfs_snapshot
+
+Manages an Amazon FSx for OpenZFS volume.
+See the [FSx OpenZFS User Guide](https://docs.aws.amazon.com/fsx/latest/OpenZFSGuide/what-is-fsx.html) for more information.
+
+## Example Usage
+
+### Root volume Example
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { FsxOpenzfsFileSystem } from "./.gen/providers/aws/fsx-openzfs-file-system";
+import { FsxOpenzfsSnapshot } from "./.gen/providers/aws/fsx-openzfs-snapshot";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new FsxOpenzfsFileSystem(this, "example", {
+      deploymentType: "SINGLE_AZ_1",
+      storageCapacity: 64,
+      subnetIds: [Token.asString(awsSubnetExample.id)],
+      throughputCapacity: 64,
+    });
+    const awsFsxOpenzfsSnapshotExample = new FsxOpenzfsSnapshot(
+      this,
+      "example_1",
+      {
+        name: "example",
+        volumeId: example.rootVolumeId,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsFsxOpenzfsSnapshotExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### Child volume Example
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { FsxOpenzfsFileSystem } from "./.gen/providers/aws/fsx-openzfs-file-system";
+import { FsxOpenzfsSnapshot } from "./.gen/providers/aws/fsx-openzfs-snapshot";
+import { FsxOpenzfsVolume } from "./.gen/providers/aws/fsx-openzfs-volume";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new FsxOpenzfsFileSystem(this, "example", {
+      deploymentType: "SINGLE_AZ_1",
+      storageCapacity: 64,
+      subnetIds: [Token.asString(awsSubnetExample.id)],
+      throughputCapacity: 64,
+    });
+    const awsFsxOpenzfsVolumeExample = new FsxOpenzfsVolume(this, "example_1", {
+      name: "example",
+      parentVolumeId: example.rootVolumeId,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsFsxOpenzfsVolumeExample.overrideLogicalId("example");
+    const awsFsxOpenzfsSnapshotExample = new FsxOpenzfsSnapshot(
+      this,
+      "example_2",
+      {
+        name: "example",
+        volumeId: Token.asString(awsFsxOpenzfsVolumeExample.id),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsFsxOpenzfsSnapshotExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the Snapshot. You can use a maximum of 203 alphanumeric characters plus either _ or -  or : or . for the name.
+* `tags` - (Optional) A map of tags to assign to the file system. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level. If you have set `copyTagsToBackups` to true, and you specify one or more tags, no existing file system tags are copied from the file system to the backup.
+* `volumeId` - (Optional) The ID of the volume to snapshot. This can be the root volume or a child volume.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name of the snapshot.
+* `id` - Identifier of the snapshot, e.g., `fsvolsnap12345678`
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `30M`)
+* `delete` - (Default `30M`)
+* `update` - (Default `30M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import FSx OpenZFS snapshot using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import FSx OpenZFS snapshot using the `id`. For example:
+
+```console
+% terraform import aws_fsx_openzfs_snapshot.example fs-543ab12b1ca672f33
+```
+
+<!-- cache-key: cdktf-0.18.0 input-f33ba26e8f39726647995a0b6dacb8d0a5084b4411c18471d481f35f094019e6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/fsx_openzfs_volume.html.markdown b/website/docs/cdktf/typescript/r/fsx_openzfs_volume.html.markdown
new file mode 100644
index 00000000000..209716e629e
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/fsx_openzfs_volume.html.markdown
@@ -0,0 +1,110 @@
+---
+subcategory: "FSx"
+layout: "aws"
+page_title: "AWS: aws_fsx_openzfs_volume"
+description: |-
+  Manages an Amazon FSx for OpenZFS volume.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_fsx_openzfs_volume
+
+Manages an Amazon FSx for OpenZFS volume.
+See the [FSx OpenZFS User Guide](https://docs.aws.amazon.com/fsx/latest/OpenZFSGuide/what-is-fsx.html) for more information.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { FsxOpenzfsVolume } from "./.gen/providers/aws/fsx-openzfs-volume";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new FsxOpenzfsVolume(this, "test", {
+      name: "testvolume",
+      parentVolumeId: Token.asString(awsFsxOpenzfsFileSystemTest.rootVolumeId),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the Volume. You can use a maximum of 203 alphanumeric characters, plus the underscore (_) special character.
+* `parentVolumeId` - (Required) The volume id of volume that will be the parent volume for the volume being created, this could be the root volume created from the `awsFsxOpenzfsFileSystem` resource with the `rootVolumeId` or the `id` property of another `awsFsxOpenzfsVolume`.
+* `originSnapshot` - (Optional) The ARN of the source snapshot to create the volume from.
+* `copyTagsToSnapshots` - (Optional) A boolean flag indicating whether tags for the file system should be copied to snapshots. The default value is false.
+* `dataCompressionType` - (Optional) Method used to compress the data on the volume. Valid values are `none` or `zstd`. Child volumes that don't specify compression option will inherit from parent volume. This option on file system applies to the root volume.
+* `deleteVolumeOptions` - (Optional) Whether to delete all child volumes and snapshots. Valid values: `deleteChildVolumesAndSnapshots`. This configuration must be applied separately before attempting to delete the resource to have the desired behavior..
+* `nfsExports` - (Optional) NFS export configuration for the root volume. Exactly 1 item. See [NFS Exports](#nfs-exports) Below.
+* `readOnly` - (Optional) specifies whether the volume is read-only. Default is false.
+* `recordSizeKib` - (Optional) The record size of an OpenZFS volume, in kibibytes (KiB). Valid values are `4`, `8`, `16`, `32`, `64`, `128`, `256`, `512`, or `1024` KiB. The default is `128` KiB.
+* `storageCapacityQuotaGib`  - (Optional) The maximum amount of storage in gibibytes (GiB) that the volume can use from its parent.
+* `storageCapacityReservationGib`  - (Optional) The amount of storage in gibibytes (GiB) to reserve from the parent volume.
+* `userAndGroupQuotas` - (Optional) - Specify how much storage users or groups can use on the volume. Maximum of 100 items. See [User and Group Quotas](#user-and-group-quotas) Below.
+* `tags` - (Optional) A map of tags to assign to the file system. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### NFS Exports
+
+* `clientConfigurations` - (Required) - A list of configuration objects that contain the client and options for mounting the OpenZFS file system. Maximum of 25 items. See [Client Configurations](#client configurations) Below.
+
+### Client Configurations
+
+* `clients` - (Required) - A value that specifies who can mount the file system. You can provide a wildcard character (*), an IP address (0.0.0.0), or a CIDR address (192.0.2.0/24. By default, Amazon FSx uses the wildcard character when specifying the client.
+* `options` - (Required) -  The options to use when mounting the file system. Maximum of 20 items. See the [Linix NFS exports man page](https://linux.die.net/man/5/exports) for more information. `crossmount` and `sync` are used by default.
+
+### User and Group Quotas
+
+* `id` - (Required) - The ID of the user or group. Valid values between `0` and `2147483647`
+* `storageCapacityQuotaGib` - (Required) - The amount of storage that the user or group can use in gibibytes (GiB). Valid values between `0` and `2147483647`
+* `type` - (Required) - A value that specifies whether the quota applies to a user or group. Valid values are `user` or `group`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name of the file system.
+* `id` - Identifier of the file system, e.g., `fsvol12345678`
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `30M`)
+* `update` - (Default `30M`)
+* `delete` - (Default `30M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import FSx Volumes using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import FSx Volumes using the `id`. For example:
+
+```console
+% terraform import aws_fsx_openzfs_volume.example fsvol-543ab12b1ca672f33
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1179f10edd690fc9c59b2fb74afd95265abe59dfbd0b69ee2df86ce1400318a0 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/fsx_windows_file_system.html.markdown b/website/docs/cdktf/typescript/r/fsx_windows_file_system.html.markdown
new file mode 100644
index 00000000000..602b382a3c6
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/fsx_windows_file_system.html.markdown
@@ -0,0 +1,205 @@
+---
+subcategory: "FSx"
+layout: "aws"
+page_title: "AWS: aws_fsx_windows_file_system"
+description: |-
+  Manages a FSx Windows File System.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_fsx_windows_file_system
+
+Manages a FSx Windows File System. See the [FSx Windows Guide](https://docs.aws.amazon.com/fsx/latest/WindowsGuide/what-is.html) for more information.
+
+~> **NOTE:** Either the `activeDirectoryId` argument or `selfManagedActiveDirectory` configuration block must be specified.
+
+## Example Usage
+
+### Using AWS Directory Service
+
+Additional information for using AWS Directory Service with Windows File Systems can be found in the [FSx Windows Guide](https://docs.aws.amazon.com/fsx/latest/WindowsGuide/fsx-aws-managed-ad.html).
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { FsxWindowsFileSystem } from "./.gen/providers/aws/fsx-windows-file-system";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new FsxWindowsFileSystem(this, "example", {
+      activeDirectoryId: Token.asString(awsDirectoryServiceDirectoryExample.id),
+      kmsKeyId: Token.asString(awsKmsKeyExample.arn),
+      storageCapacity: 300,
+      subnetIds: [Token.asString(awsSubnetExample.id)],
+      throughputCapacity: 1024,
+    });
+  }
+}
+
+```
+
+### Using a Self-Managed Microsoft Active Directory
+
+Additional information for using AWS Directory Service with Windows File Systems can be found in the [FSx Windows Guide](https://docs.aws.amazon.com/fsx/latest/WindowsGuide/self-managed-AD.html).
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { FsxWindowsFileSystem } from "./.gen/providers/aws/fsx-windows-file-system";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new FsxWindowsFileSystem(this, "example", {
+      kmsKeyId: Token.asString(awsKmsKeyExample.arn),
+      selfManagedActiveDirectory: {
+        dnsIps: ["10.0.0.111", "10.0.0.222"],
+        domainName: "corp.example.com",
+        password: "avoid-plaintext-passwords",
+        username: "Admin",
+      },
+      storageCapacity: 300,
+      subnetIds: [Token.asString(awsSubnetExample.id)],
+      throughputCapacity: 1024,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `subnetIds` - (Required) A list of IDs for the subnets that the file system will be accessible from. To specify more than a single subnet set `deploymentType` to `multiAz1`.
+* `throughputCapacity` - (Required) Throughput (megabytes per second) of the file system in power of 2 increments. Minimum of `8` and maximum of `2048`.
+
+The following arguments are optional:
+
+* `activeDirectoryId` - (Optional) The ID for an existing Microsoft Active Directory instance that the file system should join when it's created. Cannot be specified with `selfManagedActiveDirectory`.
+* `aliases` - (Optional) An array DNS alias names that you want to associate with the Amazon FSx file system.  For more information, see [Working with DNS Aliases](https://docs.aws.amazon.com/fsx/latest/WindowsGuide/managing-dns-aliases.html)
+* `auditLogConfiguration` - (Optional) The configuration that Amazon FSx for Windows File Server uses to audit and log user accesses of files, folders, and file shares on the Amazon FSx for Windows File Server file system. See [Audit Log Configuration](#audit-log-configuration) below.
+* `automaticBackupRetentionDays` - (Optional) The number of days to retain automatic backups. Minimum of `0` and maximum of `90`. Defaults to `7`. Set to `0` to disable.
+* `backupId` - (Optional) The ID of the source backup to create the filesystem from.
+* `copyTagsToBackups` - (Optional) A boolean flag indicating whether tags on the file system should be copied to backups. Defaults to `false`.
+* `dailyAutomaticBackupStartTime` - (Optional) The preferred time (in `hh:mm` format) to take daily automatic backups, in the UTC time zone.
+* `deploymentType` - (Optional) Specifies the file system deployment type, valid values are `multiAz1`, `singleAz1` and `singleAz2`. Default value is `singleAz1`.
+* `diskIopsConfiguration` - (Optional) The SSD IOPS configuration for the Amazon FSx for Windows File Server file system. See [Disk Iops Configuration](#disk-iops-configuration) below.
+* `kmsKeyId` - (Optional) ARN for the KMS Key to encrypt the file system at rest. Defaults to an AWS managed KMS Key.
+* `preferredSubnetId` - (Optional) Specifies the subnet in which you want the preferred file server to be located. Required for when deployment type is `multiAz1`.
+* `securityGroupIds` - (Optional) A list of IDs for the security groups that apply to the specified network interfaces created for file system access. These security groups will apply to all network interfaces.
+* `selfManagedActiveDirectory` - (Optional) Configuration block that Amazon FSx uses to join the Windows File Server instance to your self-managed (including on-premises) Microsoft Active Directory (AD) directory. Cannot be specified with `activeDirectoryId`. See [Self-Managed Active Directory](#self-managed-active-directory) below.
+* `skipFinalBackup` - (Optional) When enabled, will skip the default final backup taken when the file system is deleted. This configuration must be applied separately before attempting to delete the resource to have the desired behavior. Defaults to `false`.
+* `tags` - (Optional) A map of tags to assign to the file system. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `storageCapacity` - (Optional) Storage capacity (GiB) of the file system. Minimum of 32 and maximum of 65536. If the storage type is set to `hdd` the minimum value is 2000. Required when not creating filesystem for a backup.
+* `storageType` - (Optional) Specifies the storage type, Valid values are `ssd` and `hdd`. `hdd` is supported on `singleAz2` and `multiAz1` Windows file system deployment types. Default value is `ssd`.
+* `weeklyMaintenanceStartTime` - (Optional) The preferred start time (in `d:hh:mm` format) to perform weekly maintenance, in the UTC time zone.
+
+### Disk Iops Configuration
+
+* `iops` - (Optional) - The total number of SSD IOPS provisioned for the file system.
+* `mode` - (Optional) - Specifies whether the number of IOPS for the file system is using the system. Valid values are `automatic` and `userProvisioned`. Default value is `automatic`.
+
+### Self-Managed Active Directory
+
+The `selfManagedActiveDirectory` configuration block supports the following arguments:
+
+* `dnsIps` - (Required) A list of up to two IP addresses of DNS servers or domain controllers in the self-managed AD directory. The IP addresses need to be either in the same VPC CIDR range as the file system or in the private IP version 4 (IPv4) address ranges as specified in [RFC 1918](https://tools.ietf.org/html/rfc1918).
+* `domainName` - (Required) The fully qualified domain name of the self-managed AD directory. For example, `corpExampleCom`.
+* `password` - (Required) The password for the service account on your self-managed AD domain that Amazon FSx will use to join to your AD domain.
+* `username` - (Required) The user name for the service account on your self-managed AD domain that Amazon FSx will use to join to your AD domain.
+* `fileSystemAdministratorsGroup` - (Optional) The name of the domain group whose members are granted administrative privileges for the file system. Administrative privileges include taking ownership of files and folders, and setting audit controls (audit ACLs) on files and folders. The group that you specify must already exist in your domain. Defaults to `Domain Admins`.
+* `organizationalUnitDistinguishedName` - (Optional) The fully qualified distinguished name of the organizational unit within your self-managed AD directory that the Windows File Server instance will join. For example, `ou=fSx,dc=yourdomain,dc=corp,dc=com`. Only accepts OU as the direct parent of the file system. If none is provided, the FSx file system is created in the default location of your self-managed AD directory. To learn more, see [RFC 2253](https://tools.ietf.org/html/rfc2253).
+
+### Audit Log Configuration
+
+* `auditLogDestination` - (Optional) The Amazon Resource Name (ARN) for the destination of the audit logs. The destination can be any Amazon CloudWatch Logs log group ARN or Amazon Kinesis Data Firehose delivery stream ARN. Can be specified when `fileAccessAuditLogLevel` and `fileShareAccessAuditLogLevel` are not set to `disabled`. The name of the Amazon CloudWatch Logs log group must begin with the `/aws/fsx` prefix. The name of the Amazon Kinesis Data Firehouse delivery stream must begin with the `awsFsx` prefix. If you do not provide a destination in `auditLogDestionation`, Amazon FSx will create and use a log stream in the CloudWatch Logs /aws/fsx/windows log group.
+* `fileAccessAuditLogLevel` - (Optional) Sets which attempt type is logged by Amazon FSx for file and folder accesses. Valid values are `successOnly`, `failureOnly`, `successAndFailure`, and `disabled`. Default value is `disabled`.
+* `fileShareAccessAuditLogLevel` - (Optional) Sets which attempt type is logged by Amazon FSx for file share accesses. Valid values are `successOnly`, `failureOnly`, `successAndFailure`, and `disabled`. Default value is `disabled`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name of the file system.
+* `dnsName` - DNS name for the file system, e.g., `fs12345678CorpExampleCom` (domain name matching the Active Directory domain name)
+* `id` - Identifier of the file system (e.g. `fs12345678`).
+* `networkInterfaceIds` - Set of Elastic Network Interface identifiers from which the file system is accessible.
+* `ownerId` - AWS account identifier that created the file system.
+* `preferredFileServerIp` - The IP address of the primary, or preferred, file server.
+* `remoteAdministrationEndpoint` - For `multiAz1` deployment types, use this endpoint when performing administrative tasks on the file system using Amazon FSx Remote PowerShell. For `singleAz1` deployment types, this is the DNS name of the file system.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `vpcId` - Identifier of the Virtual Private Cloud for the file system.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `45M`)
+* `delete` - (Default `30M`)
+* `update` - (Default `45M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import FSx File Systems using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import FSx File Systems using the `id`. For example:
+
+```console
+% terraform import aws_fsx_windows_file_system.example fs-543ab12b1ca672f33
+```
+
+Certain resource arguments, like `securityGroupIds` and the `selfManagedActiveDirectory` configuation block `password`, do not have a FSx API method for reading the information after creation. If these arguments are set in the Terraform configuration on an imported resource, Terraform will always show a difference. To workaround this behavior, either omit the argument from the Terraform configuration or use [`ignoreChanges`](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html#ignore_changes) to hide the difference. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { FsxWindowsFileSystem } from "./.gen/providers/aws/fsx-windows-file-system";
+interface MyConfig {
+  subnetIds: any;
+  throughputCapacity: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new FsxWindowsFileSystem(this, "example", {
+      lifecycle: {
+        ignoreChanges: [securityGroupIds],
+      },
+      securityGroupIds: [Token.asString(awsSecurityGroupExample.id)],
+      subnetIds: config.subnetIds,
+      throughputCapacity: config.throughputCapacity,
+    });
+  }
+}
+
+```
+
+<!-- cache-key: cdktf-0.18.0 input-31e24eac31454cd45208a9da64e10292bbdac7ddfbe8990731498cf18fa7de07 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/gamelift_alias.html.markdown b/website/docs/cdktf/typescript/r/gamelift_alias.html.markdown
new file mode 100644
index 00000000000..2c41f3266b0
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/gamelift_alias.html.markdown
@@ -0,0 +1,89 @@
+---
+subcategory: "GameLift"
+layout: "aws"
+page_title: "AWS: aws_gamelift_alias"
+description: |-
+  Provides a GameLift Alias resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_gamelift_alias
+
+Provides a GameLift Alias resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { GameliftAlias } from "./.gen/providers/aws/gamelift-alias";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new GameliftAlias(this, "example", {
+      description: "Example Description",
+      name: "example-alias",
+      routingStrategy: {
+        message: "Example Message",
+        type: "TERMINAL",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) Name of the alias.
+* `description` - (Optional) Description of the alias.
+* `routingStrategy` - (Required) Specifies the fleet and/or routing type to use for the alias.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Nested Fields
+
+#### `routingStrategy`
+
+* `fleetId` - (Optional) ID of the GameLift Fleet to point the alias to.
+* `message` - (Optional) Message text to be used with the `terminal` routing strategy.
+* `type` - (Required) Type of routing strategyE.g., `simple` or `terminal`
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Alias ID.
+* `arn` - Alias ARN.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import GameLift Aliases using the ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import GameLift Aliases using the ID. For example:
+
+```console
+% terraform import aws_gamelift_alias.example <alias-id>
+```
+
+<!-- cache-key: cdktf-0.18.0 input-0388556f6d66db5cdeeff13f1605184c6bf94fb66ae580f7a99c34af9b175b72 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/gamelift_build.html.markdown b/website/docs/cdktf/typescript/r/gamelift_build.html.markdown
new file mode 100644
index 00000000000..ee95db79fbc
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/gamelift_build.html.markdown
@@ -0,0 +1,92 @@
+---
+subcategory: "GameLift"
+layout: "aws"
+page_title: "AWS: aws_gamelift_build"
+description: |-
+  Provides a GameLift Build resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_gamelift_build
+
+Provides an GameLift Build resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { GameliftBuild } from "./.gen/providers/aws/gamelift-build";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new GameliftBuild(this, "test", {
+      name: "example-build",
+      operatingSystem: "WINDOWS_2012",
+      storageLocation: {
+        bucket: Token.asString(awsS3BucketTest.id),
+        key: Token.asString(awsS3ObjectTest.key),
+        roleArn: Token.asString(awsIamRoleTest.arn),
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) Name of the build
+* `operatingSystem` - (Required) Operating system that the game server binaries are built to run onE.g., `windows2012`, `amazonLinux` or `amazonLinux2`.
+* `storageLocation` - (Required) Information indicating where your game build files are stored. See below.
+* `version` - (Optional) Version that is associated with this build.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Nested Fields
+
+#### `storageLocation`
+
+* `bucket` - (Required) Name of your S3 bucket.
+* `key` - (Required) Name of the zip file containing your build files.
+* `roleArn` - (Required) ARN of the access role that allows Amazon GameLift to access your S3 bucket.
+* `objectVersion` - (Optional) A specific version of the file. If not set, the latest version of the file is retrieved.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - GameLift Build ID.
+* `arn` - GameLift Build ARN.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import GameLift Builds using the ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import GameLift Builds using the ID. For example:
+
+```console
+% terraform import aws_gamelift_build.example <build-id>
+```
+
+<!-- cache-key: cdktf-0.18.0 input-c2f0faa65301c95ac0436ad1af88ccbf7979ead6e43e9ac51b389783a62ddcfb -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/gamelift_fleet.html.markdown b/website/docs/cdktf/typescript/r/gamelift_fleet.html.markdown
new file mode 100644
index 00000000000..6fb726f59bd
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/gamelift_fleet.html.markdown
@@ -0,0 +1,122 @@
+---
+subcategory: "GameLift"
+layout: "aws"
+page_title: "AWS: aws_gamelift_fleet"
+description: |-
+  Provides a GameLift Fleet resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_gamelift_fleet
+
+Provides a GameLift Fleet resource.
+
+## Example Usage
+
+```terraform
+resource "aws_gamelift_fleet" "example" {
+  build_id          = aws_gamelift_build.example.id
+  ec2_instance_type = "t2.micro"
+  fleet_type        = "ON_DEMAND"
+  name              = "example-fleet-name"
+
+  runtime_configuration {
+    server_process {
+      concurrent_executions = 1
+      launch_path           = "C:\\game\\GomokuServer.exe"
+    }
+  }
+}
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `buildId` - (Optional) ID of the GameLift Build to be deployed on the fleet.
+* `certificateConfiguration` - (Optional) Prompts GameLift to generate a TLS/SSL certificate for the fleet. See [certificate_configuration](#certificate_configuration).
+* `description` - (Optional) Human-readable description of the fleet.
+* `ec2InboundPermission` - (Optional) Range of IP addresses and port settings that permit inbound traffic to access server processes running on the fleet. See below.
+* `ec2InstanceType` - (Required) Name of an EC2 instance typeE.g., `t2Micro`
+* `fleetType` - (Optional) Type of fleet. This value must be `onDemand` or `spot`. Defaults to `onDemand`.
+* `instanceRoleArn` - (Optional) ARN of an IAM role that instances in the fleet can assume.
+* `metricGroups` - (Optional) List of names of metric groups to add this fleet to. A metric group tracks metrics across all fleets in the group. Defaults to `default`.
+* `name` - (Required) The name of the fleet.
+* `newGameSessionProtectionPolicy` - (Optional) Game session protection policy to apply to all instances in this fleetE.g., `fullProtection`. Defaults to `noProtection`.
+* `resourceCreationLimitPolicy` - (Optional) Policy that limits the number of game sessions an individual player can create over a span of time for this fleet. See below.
+* `runtimeConfiguration` - (Optional) Instructions for launching server processes on each instance in the fleet. See below.
+* `scriptId` - (Optional) ID of the GameLift Script to be deployed on the fleet.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Nested Fields
+
+#### `certificateConfiguration`
+
+* `certificateType` - (Optional) Indicates whether a TLS/SSL certificate is generated for a fleet. Valid values are `disabled` and `generated`. Default value is `disabled`.
+
+#### `ec2InboundPermission`
+
+* `fromPort` - (Required) Starting value for a range of allowed port numbers.
+* `ipRange` - (Required) Range of allowed IP addresses expressed in CIDR notationE.g., `000.000.000.000/[subnet mask]` or `0.0.0.0/[subnet mask]`.
+* `protocol` - (Required) Network communication protocol used by the fleetE.g., `tcp` or `udp`
+* `toPort` - (Required) Ending value for a range of allowed port numbers. Port numbers are end-inclusive. This value must be higher than `fromPort`.
+
+#### `resourceCreationLimitPolicy`
+
+* `newGameSessionsPerCreator` - (Optional) Maximum number of game sessions that an individual can create during the policy period.
+* `policyPeriodInMinutes` - (Optional) Time span used in evaluating the resource creation limit policy.
+
+#### `runtimeConfiguration`
+
+* `gameSessionActivationTimeoutSeconds` - (Optional) Maximum amount of time (in seconds) that a game session can remain in status `activating`.
+* `maxConcurrentGameSessionActivations` - (Optional) Maximum number of game sessions with status `activating` to allow on an instance simultaneously.
+* `serverProcess` - (Optional) Collection of server process configurations that describe which server processes to run on each instance in a fleet. See below.
+
+#### `serverProcess`
+
+* `concurrentExecutions` - (Required) Number of server processes using this configuration to run concurrently on an instance.
+* `launchPath` - (Required) Location of the server executable in a game build. All game builds are installed on instances at the root : for Windows instances `c:\game`, and for Linux instances `/local/game`.
+* `parameters` - (Optional) Optional list of parameters to pass to the server executable on launch.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Fleet ID.
+* `arn` - Fleet ARN.
+* `buildArn` - Build ARN.
+* `operatingSystem` - Operating system of the fleet's computing resources.
+* `scriptArn` - Script ARN.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `70M`)
+* `delete` - (Default `20M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import GameLift Fleets using the ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import GameLift Fleets using the ID. For example:
+
+```console
+% terraform import aws_gamelift_fleet.example <fleet-id>
+```
+
+<!-- cache-key: cdktf-0.18.0 input-3bb7364110eb682f1c0a8b20937e245e89dbedcb5915fce66d3f5e59fd6676d6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/gamelift_game_server_group.html.markdown b/website/docs/cdktf/typescript/r/gamelift_game_server_group.html.markdown
new file mode 100644
index 00000000000..016111e84fa
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/gamelift_game_server_group.html.markdown
@@ -0,0 +1,260 @@
+---
+subcategory: "GameLift"
+layout: "aws"
+page_title: "AWS: aws_gamelift_game_server_group"
+description: |-
+  Provides a GameLift Game Server Group resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_gamelift_game_server_group
+
+Provides an GameLift Game Server Group resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { GameliftGameServerGroup } from "./.gen/providers/aws/gamelift-game-server-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new GameliftGameServerGroup(this, "example", {
+      dependsOn: [awsIamRolePolicyAttachmentExample],
+      gameServerGroupName: "example",
+      instanceDefinition: [
+        {
+          instanceType: "c5.large",
+        },
+        {
+          instanceType: "c5a.large",
+        },
+      ],
+      launchTemplate: {
+        id: Token.asString(awsLaunchTemplateExample.id),
+      },
+      maxSize: 1,
+      minSize: 1,
+      roleArn: Token.asString(awsIamRoleExample.arn),
+    });
+  }
+}
+
+```
+
+Full usage:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { GameliftGameServerGroup } from "./.gen/providers/aws/gamelift-game-server-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new GameliftGameServerGroup(this, "example", {
+      autoScalingPolicy: {
+        estimatedInstanceWarmup: 60,
+        targetTrackingConfiguration: {
+          targetValue: 75,
+        },
+      },
+      balancingStrategy: "SPOT_ONLY",
+      dependsOn: [awsIamRolePolicyAttachmentExample],
+      gameServerGroupName: "example",
+      gameServerProtectionPolicy: "FULL_PROTECTION",
+      instanceDefinition: [
+        {
+          instanceType: "c5.large",
+          weightedCapacity: "1",
+        },
+        {
+          instanceType: "c5.2xlarge",
+          weightedCapacity: "2",
+        },
+      ],
+      launchTemplate: {
+        id: Token.asString(awsLaunchTemplateExample.id),
+        version: "1",
+      },
+      maxSize: 1,
+      minSize: 1,
+      roleArn: Token.asString(awsIamRoleExample.arn),
+      tags: {
+        Name: "example",
+      },
+      vpcSubnets: ["subnet-12345678", "subnet-23456789"],
+    });
+  }
+}
+
+```
+
+### Example IAM Role for GameLift Game Server Group
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { DataAwsPartition } from "./.gen/providers/aws/data-aws-partition";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+import { IamRolePolicyAttachment } from "./.gen/providers/aws/iam-role-policy-attachment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const assumeRole = new DataAwsIamPolicyDocument(this, "assume_role", {
+      statement: [
+        {
+          actions: ["sts:AssumeRole"],
+          effect: "Allow",
+          principals: [
+            {
+              identifiers: [
+                "autoscaling.amazonaws.com",
+                "gamelift.amazonaws.com",
+              ],
+              type: "Service",
+            },
+          ],
+        },
+      ],
+    });
+    const current = new DataAwsPartition(this, "current", {});
+    const example = new IamRole(this, "example", {
+      assumeRolePolicy: Token.asString(assumeRole.json),
+      name: "gamelift-game-server-group-example",
+    });
+    const awsIamRolePolicyAttachmentExample = new IamRolePolicyAttachment(
+      this,
+      "example_3",
+      {
+        policyArn:
+          "arn:${" +
+          current.partition +
+          "}:iam::aws:policy/GameLiftGameServerGroupPolicy",
+        role: example.name,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamRolePolicyAttachmentExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `balancingStrategy` - (Optional) Indicates how GameLift FleetIQ balances the use of Spot Instances and On-Demand Instances.
+  Valid values: `spotOnly`, `spotPreferred`, `onDemandOnly`. Defaults to `spotPreferred`.
+* `gameServerGroupName` - (Required) Name of the game server group.
+  This value is used to generate unique ARN identifiers for the EC2 Auto Scaling group and the GameLift FleetIQ game server group.
+* `gameServerProtectionPolicy` - (Optional) Indicates whether instances in the game server group are protected from early termination.
+  Unprotected instances that have active game servers running might be terminated during a scale-down event,
+  causing players to be dropped from the game.
+  Protected instances cannot be terminated while there are active game servers running except in the event
+  of a forced game server group deletion.
+  Valid values: `noProtection`, `fullProtection`. Defaults to `noProtection`.
+* `maxSize` - (Required) The maximum number of instances allowed in the EC2 Auto Scaling group.
+  During automatic scaling events, GameLift FleetIQ and EC2 do not scale up the group above this maximum.
+* `minSize` - (Required) The minimum number of instances allowed in the EC2 Auto Scaling group.
+  During automatic scaling events, GameLift FleetIQ and EC2 do not scale down the group below this minimum.
+* `roleArn` - (Required) ARN for an IAM role that allows Amazon GameLift to access your EC2 Auto Scaling groups.
+* `tags` - (Optional) Key-value map of resource tags
+* `vpcSubnets` - (Optional) A list of VPC subnets to use with instances in the game server group.
+  By default, all GameLift FleetIQ-supported Availability Zones are used.
+
+### `autoScalingPolicy`
+
+Configuration settings to define a scaling policy for the Auto Scaling group that is optimized for game hosting.
+The scaling policy uses the metric `percentUtilizedGameServers` to maintain a buffer of idle game servers that
+can immediately accommodate new games and players.
+
+* `estimatedInstanceWarmup` - (Optional) Length of time, in seconds, it takes for a new instance to start
+  new game server processes and register with GameLift FleetIQ.
+  Specifying a warm-up time can be useful, particularly with game servers that take a long time to start up,
+  because it avoids prematurely starting new instances. Defaults to `60`.
+
+#### `targetTrackingConfiguration`
+
+Settings for a target-based scaling policy applied to Auto Scaling group.
+These settings are used to create a target-based policy that tracks the GameLift FleetIQ metric `percentUtilizedGameServers`
+and specifies a target value for the metric.
+
+* `targetValue` - (Required) Desired value to use with a game server group target-based scaling policy.
+
+### `instanceDefinition`
+
+The EC2 instance types and sizes to use in the Auto Scaling group.
+The instance definitions must specify at least two different instance types that are supported by GameLift FleetIQ.
+
+* `instanceType` - (Required) An EC2 instance type.
+* `weightedCapacity` - (Optional) Instance weighting that indicates how much this instance type contributes
+  to the total capacity of a game server group.
+  Instance weights are used by GameLift FleetIQ to calculate the instance type's cost per unit hour and better identify
+  the most cost-effective options.
+
+### `launchTemplate`
+
+The EC2 launch template that contains configuration settings and game server code to be deployed to all instances in the game server group.
+You can specify the template using either the template name or ID.
+
+* `id` - (Optional) A unique identifier for an existing EC2 launch template.
+* `name` - (Optional) A readable identifier for an existing EC2 launch template.
+* `version` - (Optional) The version of the EC2 launch template to use. If none is set, the default is the first version created.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name of the GameLift Game Server Group.
+* `arn` - The ARN of the GameLift Game Server Group.
+* `autoScalingGroupArn` - The ARN of the created EC2 Auto Scaling group.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `10M`)
+* `delete` - (Default `30M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import GameLift Game Server Group using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import GameLift Game Server Group using the `name`. For example:
+
+```console
+% terraform import aws_gamelift_game_server_group.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-366bd6af5a933ffff5198fbc9bb42ed30d90f3b3e04f89cb1b84627bb8a40b8c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/gamelift_game_server_group.markdown b/website/docs/cdktf/typescript/r/gamelift_game_server_group.markdown
new file mode 100644
index 00000000000..016111e84fa
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/gamelift_game_server_group.markdown
@@ -0,0 +1,260 @@
+---
+subcategory: "GameLift"
+layout: "aws"
+page_title: "AWS: aws_gamelift_game_server_group"
+description: |-
+  Provides a GameLift Game Server Group resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_gamelift_game_server_group
+
+Provides an GameLift Game Server Group resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { GameliftGameServerGroup } from "./.gen/providers/aws/gamelift-game-server-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new GameliftGameServerGroup(this, "example", {
+      dependsOn: [awsIamRolePolicyAttachmentExample],
+      gameServerGroupName: "example",
+      instanceDefinition: [
+        {
+          instanceType: "c5.large",
+        },
+        {
+          instanceType: "c5a.large",
+        },
+      ],
+      launchTemplate: {
+        id: Token.asString(awsLaunchTemplateExample.id),
+      },
+      maxSize: 1,
+      minSize: 1,
+      roleArn: Token.asString(awsIamRoleExample.arn),
+    });
+  }
+}
+
+```
+
+Full usage:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { GameliftGameServerGroup } from "./.gen/providers/aws/gamelift-game-server-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new GameliftGameServerGroup(this, "example", {
+      autoScalingPolicy: {
+        estimatedInstanceWarmup: 60,
+        targetTrackingConfiguration: {
+          targetValue: 75,
+        },
+      },
+      balancingStrategy: "SPOT_ONLY",
+      dependsOn: [awsIamRolePolicyAttachmentExample],
+      gameServerGroupName: "example",
+      gameServerProtectionPolicy: "FULL_PROTECTION",
+      instanceDefinition: [
+        {
+          instanceType: "c5.large",
+          weightedCapacity: "1",
+        },
+        {
+          instanceType: "c5.2xlarge",
+          weightedCapacity: "2",
+        },
+      ],
+      launchTemplate: {
+        id: Token.asString(awsLaunchTemplateExample.id),
+        version: "1",
+      },
+      maxSize: 1,
+      minSize: 1,
+      roleArn: Token.asString(awsIamRoleExample.arn),
+      tags: {
+        Name: "example",
+      },
+      vpcSubnets: ["subnet-12345678", "subnet-23456789"],
+    });
+  }
+}
+
+```
+
+### Example IAM Role for GameLift Game Server Group
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { DataAwsPartition } from "./.gen/providers/aws/data-aws-partition";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+import { IamRolePolicyAttachment } from "./.gen/providers/aws/iam-role-policy-attachment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const assumeRole = new DataAwsIamPolicyDocument(this, "assume_role", {
+      statement: [
+        {
+          actions: ["sts:AssumeRole"],
+          effect: "Allow",
+          principals: [
+            {
+              identifiers: [
+                "autoscaling.amazonaws.com",
+                "gamelift.amazonaws.com",
+              ],
+              type: "Service",
+            },
+          ],
+        },
+      ],
+    });
+    const current = new DataAwsPartition(this, "current", {});
+    const example = new IamRole(this, "example", {
+      assumeRolePolicy: Token.asString(assumeRole.json),
+      name: "gamelift-game-server-group-example",
+    });
+    const awsIamRolePolicyAttachmentExample = new IamRolePolicyAttachment(
+      this,
+      "example_3",
+      {
+        policyArn:
+          "arn:${" +
+          current.partition +
+          "}:iam::aws:policy/GameLiftGameServerGroupPolicy",
+        role: example.name,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamRolePolicyAttachmentExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `balancingStrategy` - (Optional) Indicates how GameLift FleetIQ balances the use of Spot Instances and On-Demand Instances.
+  Valid values: `spotOnly`, `spotPreferred`, `onDemandOnly`. Defaults to `spotPreferred`.
+* `gameServerGroupName` - (Required) Name of the game server group.
+  This value is used to generate unique ARN identifiers for the EC2 Auto Scaling group and the GameLift FleetIQ game server group.
+* `gameServerProtectionPolicy` - (Optional) Indicates whether instances in the game server group are protected from early termination.
+  Unprotected instances that have active game servers running might be terminated during a scale-down event,
+  causing players to be dropped from the game.
+  Protected instances cannot be terminated while there are active game servers running except in the event
+  of a forced game server group deletion.
+  Valid values: `noProtection`, `fullProtection`. Defaults to `noProtection`.
+* `maxSize` - (Required) The maximum number of instances allowed in the EC2 Auto Scaling group.
+  During automatic scaling events, GameLift FleetIQ and EC2 do not scale up the group above this maximum.
+* `minSize` - (Required) The minimum number of instances allowed in the EC2 Auto Scaling group.
+  During automatic scaling events, GameLift FleetIQ and EC2 do not scale down the group below this minimum.
+* `roleArn` - (Required) ARN for an IAM role that allows Amazon GameLift to access your EC2 Auto Scaling groups.
+* `tags` - (Optional) Key-value map of resource tags
+* `vpcSubnets` - (Optional) A list of VPC subnets to use with instances in the game server group.
+  By default, all GameLift FleetIQ-supported Availability Zones are used.
+
+### `autoScalingPolicy`
+
+Configuration settings to define a scaling policy for the Auto Scaling group that is optimized for game hosting.
+The scaling policy uses the metric `percentUtilizedGameServers` to maintain a buffer of idle game servers that
+can immediately accommodate new games and players.
+
+* `estimatedInstanceWarmup` - (Optional) Length of time, in seconds, it takes for a new instance to start
+  new game server processes and register with GameLift FleetIQ.
+  Specifying a warm-up time can be useful, particularly with game servers that take a long time to start up,
+  because it avoids prematurely starting new instances. Defaults to `60`.
+
+#### `targetTrackingConfiguration`
+
+Settings for a target-based scaling policy applied to Auto Scaling group.
+These settings are used to create a target-based policy that tracks the GameLift FleetIQ metric `percentUtilizedGameServers`
+and specifies a target value for the metric.
+
+* `targetValue` - (Required) Desired value to use with a game server group target-based scaling policy.
+
+### `instanceDefinition`
+
+The EC2 instance types and sizes to use in the Auto Scaling group.
+The instance definitions must specify at least two different instance types that are supported by GameLift FleetIQ.
+
+* `instanceType` - (Required) An EC2 instance type.
+* `weightedCapacity` - (Optional) Instance weighting that indicates how much this instance type contributes
+  to the total capacity of a game server group.
+  Instance weights are used by GameLift FleetIQ to calculate the instance type's cost per unit hour and better identify
+  the most cost-effective options.
+
+### `launchTemplate`
+
+The EC2 launch template that contains configuration settings and game server code to be deployed to all instances in the game server group.
+You can specify the template using either the template name or ID.
+
+* `id` - (Optional) A unique identifier for an existing EC2 launch template.
+* `name` - (Optional) A readable identifier for an existing EC2 launch template.
+* `version` - (Optional) The version of the EC2 launch template to use. If none is set, the default is the first version created.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name of the GameLift Game Server Group.
+* `arn` - The ARN of the GameLift Game Server Group.
+* `autoScalingGroupArn` - The ARN of the created EC2 Auto Scaling group.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `10M`)
+* `delete` - (Default `30M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import GameLift Game Server Group using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import GameLift Game Server Group using the `name`. For example:
+
+```console
+% terraform import aws_gamelift_game_server_group.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-366bd6af5a933ffff5198fbc9bb42ed30d90f3b3e04f89cb1b84627bb8a40b8c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/gamelift_game_session_queue.html.markdown b/website/docs/cdktf/typescript/r/gamelift_game_session_queue.html.markdown
new file mode 100644
index 00000000000..4524093d177
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/gamelift_game_session_queue.html.markdown
@@ -0,0 +1,97 @@
+---
+subcategory: "GameLift"
+layout: "aws"
+page_title: "AWS: aws_gamelift_game_session_queue"
+description: |-
+  Provides a GameLift Game Session Queue resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_gamelift_game_session_queue
+
+Provides an GameLift Game Session Queue resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { GameliftGameSessionQueue } from "./.gen/providers/aws/gamelift-game-session-queue";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new GameliftGameSessionQueue(this, "test", {
+      destinations: [usWest2Fleet.arn, euCentral1Fleet.arn],
+      name: "example-session-queue",
+      notificationTarget: gameSessionQueueNotifications.arn,
+      playerLatencyPolicy: [
+        {
+          maximumIndividualPlayerLatencyMilliseconds: 100,
+          policyDurationSeconds: 5,
+        },
+        {
+          maximumIndividualPlayerLatencyMilliseconds: 200,
+        },
+      ],
+      timeoutInSeconds: 60,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) Name of the session queue.
+* `timeoutInSeconds` - (Required) Maximum time a game session request can remain in the queue.
+* `customEventData` - (Optional) Information to be added to all events that are related to this game session queue.
+* `destinations` - (Optional) List of fleet/alias ARNs used by session queue for placing game sessions.
+* `notificationTarget` - (Optional) An SNS topic ARN that is set up to receive game session placement notifications.
+* `playerLatencyPolicy` - (Optional) One or more policies used to choose fleet based on player latency. See below.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Nested Fields
+
+#### `playerLatencyPolicy`
+
+* `maximumIndividualPlayerLatencyMilliseconds` - (Required) Maximum latency value that is allowed for any player.
+* `policyDurationSeconds` - (Optional) Length of time that the policy is enforced while placing a new game session. Absence of value for this attribute means that the policy is enforced until the queue times out.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Game Session Queue ARN.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import GameLift Game Session Queues using their `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import GameLift Game Session Queues using their `name`. For example:
+
+```console
+% terraform import aws_gamelift_game_session_queue.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1e69f1135cf583861ec3815dcbcde5d0ca2b5117945e9f7a46b7008c92b6115a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/gamelift_script.html.markdown b/website/docs/cdktf/typescript/r/gamelift_script.html.markdown
new file mode 100644
index 00000000000..b57c9a588da
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/gamelift_script.html.markdown
@@ -0,0 +1,91 @@
+---
+subcategory: "GameLift"
+layout: "aws"
+page_title: "AWS: aws_gamelift_script"
+description: |-
+  Provides a GameLift Script resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_gamelift_script
+
+Provides an GameLift Script resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { GameliftScript } from "./.gen/providers/aws/gamelift-script";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new GameliftScript(this, "example", {
+      name: "example-script",
+      storageLocation: {
+        bucket: Token.asString(awsS3BucketExample.id),
+        key: Token.asString(awsS3ObjectExample.key),
+        roleArn: Token.asString(awsIamRoleExample.arn),
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) Name of the script
+* `storageLocation` - (Optional) Information indicating where your game script files are stored. See below.
+* `version` - (Optional) Version that is associated with this script.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `zipFile` - (Optional) A data object containing your Realtime scripts and dependencies as a zip  file. The zip file can have one or multiple files. Maximum size of a zip file is 5 MB.
+
+### Nested Fields
+
+#### `storageLocation`
+
+* `bucket` - (Required) Name of your S3 bucket.
+* `key` - (Required) Name of the zip file containing your script files.
+* `roleArn` - (Required) ARN of the access role that allows Amazon GameLift to access your S3 bucket.
+* `objectVersion` - (Optional) A specific version of the file. If not set, the latest version of the file is retrieved.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - GameLift Script ID.
+* `arn` - GameLift Script ARN.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import GameLift Scripts using the ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import GameLift Scripts using the ID. For example:
+
+```console
+% terraform import aws_gamelift_script.example <script-id>
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ea65675a0727f9e5f10a03be30cedabffe531a0a9407f9d714cbdeca2fce29dc -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/glacier_vault.html.markdown b/website/docs/cdktf/typescript/r/glacier_vault.html.markdown
new file mode 100644
index 00000000000..9a531925dce
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/glacier_vault.html.markdown
@@ -0,0 +1,117 @@
+---
+subcategory: "S3 Glacier"
+layout: "aws"
+page_title: "AWS: aws_glacier_vault"
+description: |-
+  Provides a Glacier Vault.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_glacier_vault
+
+Provides a Glacier Vault Resource. You can refer to the [Glacier Developer Guide](https://docs.aws.amazon.com/amazonglacier/latest/dev/working-with-vaults.html) for a full explanation of the Glacier Vault functionality
+
+~> **NOTE:** When removing a Glacier Vault, the Vault must be empty.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { GlacierVault } from "./.gen/providers/aws/glacier-vault";
+import { SnsTopic } from "./.gen/providers/aws/sns-topic";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const awsSnsTopic = new SnsTopic(this, "aws_sns_topic", {
+      name: "glacier-sns-topic",
+    });
+    const myArchive = new DataAwsIamPolicyDocument(this, "my_archive", {
+      statement: [
+        {
+          actions: ["glacier:InitiateJob", "glacier:GetJobOutput"],
+          effect: "Allow",
+          principals: [
+            {
+              identifiers: ["*"],
+              type: "*",
+            },
+          ],
+          resources: [
+            "arn:aws:glacier:eu-west-1:432981146916:vaults/MyArchive",
+          ],
+          sid: "add-read-only-perm",
+        },
+      ],
+    });
+    const awsGlacierVaultMyArchive = new GlacierVault(this, "my_archive_2", {
+      accessPolicy: Token.asString(myArchive.json),
+      name: "MyArchive",
+      notification: {
+        events: ["ArchiveRetrievalCompleted", "InventoryRetrievalCompleted"],
+        snsTopic: awsSnsTopic.arn,
+      },
+      tags: {
+        Test: "MyArchive",
+      },
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsGlacierVaultMyArchive.overrideLogicalId("my_archive");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the Vault. Names can be between 1 and 255 characters long and the valid characters are a-z, A-Z, 0-9, '_' (underscore), '-' (hyphen), and '.' (period).
+* `accessPolicy` - (Optional) The policy document. This is a JSON formatted string.
+  The heredoc syntax or `file` function is helpful here. Use the [Glacier Developer Guide](https://docs.aws.amazon.com/amazonglacier/latest/dev/vault-access-policy.html) for more information on Glacier Vault Policy
+* `notification` - (Optional) The notifications for the Vault. Fields documented below.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+**notification** supports the following:
+
+* `events` - (Required) You can configure a vault to publish a notification for `archiveRetrievalCompleted` and `inventoryRetrievalCompleted` events.
+* `snsTopic` - (Required) The SNS Topic ARN.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `location` - The URI of the vault that was created.
+* `arn` - The ARN of the vault.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Glacier Vaults using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Glacier Vaults using the `name`. For example:
+
+```console
+% terraform import aws_glacier_vault.archive my_archive
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1bfb612252a42581f297e83a2d1f1c7c609160aeeb4a7bd67bccea5a3aa3cff5 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/glacier_vault_lock.html.markdown b/website/docs/cdktf/typescript/r/glacier_vault_lock.html.markdown
new file mode 100644
index 00000000000..009a289f33d
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/glacier_vault_lock.html.markdown
@@ -0,0 +1,135 @@
+---
+subcategory: "S3 Glacier"
+layout: "aws"
+page_title: "AWS: aws_glacier_vault_lock"
+description: |-
+  Manages a Glacier Vault Lock.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_glacier_vault_lock
+
+Manages a Glacier Vault Lock. You can refer to the [Glacier Developer Guide](https://docs.aws.amazon.com/amazonglacier/latest/dev/vault-lock.html) for a full explanation of the Glacier Vault Lock functionality.
+
+~> **NOTE:** This resource allows you to test Glacier Vault Lock policies by setting the `completeLock` argument to `false`. When testing policies in this manner, the Glacier Vault Lock automatically expires after 24 hours and Terraform will show this resource as needing recreation after that time. To permanently apply the policy, set the `completeLock` argument to `true`. When changing `completeLock` to `true`, it is expected the resource will show as recreating.
+
+!> **WARNING:** Once a Glacier Vault Lock is completed, it is immutable. The deletion of the Glacier Vault Lock is not be possible and attempting to remove it from Terraform will return an error. Set the `ignoreDeletionError` argument to `true` and apply this configuration before attempting to delete this resource via Terraform or use `terraform state rm` to remove this resource from Terraform management.
+
+## Example Usage
+
+### Testing Glacier Vault Lock Policy
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { GlacierVault } from "./.gen/providers/aws/glacier-vault";
+import { GlacierVaultLock } from "./.gen/providers/aws/glacier-vault-lock";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new GlacierVault(this, "example", {
+      name: "example",
+    });
+    const dataAwsIamPolicyDocumentExample = new DataAwsIamPolicyDocument(
+      this,
+      "example_1",
+      {
+        statement: [
+          {
+            actions: ["glacier:DeleteArchive"],
+            condition: [
+              {
+                test: "NumericLessThanEquals",
+                values: ["365"],
+                variable: "glacier:ArchiveAgeinDays",
+              },
+            ],
+            effect: "Deny",
+            resources: [example.arn],
+          },
+        ],
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsIamPolicyDocumentExample.overrideLogicalId("example");
+    const awsGlacierVaultLockExample = new GlacierVaultLock(this, "example_2", {
+      completeLock: false,
+      policy: Token.asString(dataAwsIamPolicyDocumentExample.json),
+      vaultName: example.name,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsGlacierVaultLockExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### Permanently Applying Glacier Vault Lock Policy
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { GlacierVaultLock } from "./.gen/providers/aws/glacier-vault-lock";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new GlacierVaultLock(this, "example", {
+      completeLock: true,
+      policy: Token.asString(dataAwsIamPolicyDocumentExample.json),
+      vaultName: Token.asString(awsGlacierVaultExample.name),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `completeLock` - (Required) Boolean whether to permanently apply this Glacier Lock Policy. Once completed, this cannot be undone. If set to `false`, the Glacier Lock Policy remains in a testing mode for 24 hours. After that time, the Glacier Lock Policy is automatically removed by Glacier and the Terraform resource will show as needing recreation. Changing this from `false` to `true` will show as resource recreation, which is expected. Changing this from `true` to `false` is not possible unless the Glacier Vault is recreated at the same time.
+* `policy` - (Required) JSON string containing the IAM policy to apply as the Glacier Vault Lock policy.
+* `vaultName` - (Required) The name of the Glacier Vault.
+* `ignoreDeletionError` - (Optional) Allow Terraform to ignore the error returned when attempting to delete the Glacier Lock Policy. This can be used to delete or recreate the Glacier Vault via Terraform, for example, if the Glacier Vault Lock policy permits that action. This should only be used in conjunction with `completeLock` being set to `true`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Glacier Vault name.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Glacier Vault Locks using the Glacier Vault name. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Glacier Vault Locks using the Glacier Vault name. For example:
+
+```console
+% terraform import aws_glacier_vault_lock.example example-vault
+```
+
+<!-- cache-key: cdktf-0.18.0 input-518c16374c45cebffee79cb05e96dd966379682d9c133b507d51448663341de4 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/globalaccelerator_accelerator.html.markdown b/website/docs/cdktf/typescript/r/globalaccelerator_accelerator.html.markdown
new file mode 100644
index 00000000000..ed4489f7caf
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/globalaccelerator_accelerator.html.markdown
@@ -0,0 +1,111 @@
+---
+subcategory: "Global Accelerator"
+layout: "aws"
+page_title: "AWS: aws_globalaccelerator_accelerator"
+description: |-
+  Provides a Global Accelerator accelerator.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_globalaccelerator_accelerator
+
+Creates a Global Accelerator accelerator.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { GlobalacceleratorAccelerator } from "./.gen/providers/aws/globalaccelerator-accelerator";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new GlobalacceleratorAccelerator(this, "example", {
+      attributes: {
+        flowLogsEnabled: true,
+        flowLogsS3Bucket: "example-bucket",
+        flowLogsS3Prefix: "flow-logs/",
+      },
+      enabled: true,
+      ipAddressType: "IPV4",
+      ipAddresses: ["1.2.3.4"],
+      name: "Example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the accelerator.
+* `ipAddressType` - (Optional) The value for the address type. Defaults to `ipv4`. Valid values: `ipv4`, `dualStack`.
+* `ipAddresses` - (Optional) The IP addresses to use for BYOIP accelerators. If not specified, the service assigns IP addresses. Valid values: 1 or 2 IPv4 addresses.
+* `enabled` - (Optional) Indicates whether the accelerator is enabled. Defaults to `true`. Valid values: `true`, `false`.
+* `attributes` - (Optional) The attributes of the accelerator. Fields documented below.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+`attributes` supports the following arguments:
+
+* `flowLogsEnabled` - (Optional) Indicates whether flow logs are enabled. Defaults to `false`. Valid values: `true`, `false`.
+* `flowLogsS3Bucket` - (Optional) The name of the Amazon S3 bucket for the flow logs. Required if `flowLogsEnabled` is `true`.
+* `flowLogsS3Prefix` - (Optional) The prefix for the location in the Amazon S3 bucket for the flow logs. Required if `flowLogsEnabled` is `true`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Amazon Resource Name (ARN) of the accelerator.
+* `dnsName` - The DNS name of the accelerator. For example, `a5D53Ff5Ee6Bca4CeAwsglobalacceleratorCom`.
+* `dualStackDnsName` - The Domain Name System (DNS) name that Global Accelerator creates that points to a dual-stack accelerator's four static IP addresses: two IPv4 addresses and two IPv6 addresses. For example, `a1234567890AbcdefDualstackAwsglobalacceleratorCom`.
+* `hostedZoneId` --  The Global Accelerator Route 53 zone ID that can be used to
+  route an [Alias Resource Record Set][1] to the Global Accelerator. This attribute
+  is simply an alias for the zone ID `z2Bj6Xq5Fk7U4H`.
+* `ipSets` - IP address set associated with the accelerator.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+**ip_sets** exports the following attributes:
+
+* `ipAddresses` - A list of IP addresses in the IP address set.
+* `ipFamily` - The type of IP addresses included in this IP set.
+
+[1]: https://docs.aws.amazon.com/Route53/latest/APIReference/API_AliasTarget.html
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `30M`)
+* `update` - (Default `30M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Global Accelerator accelerators using the `arn`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Global Accelerator accelerators using the `arn`. For example:
+
+```console
+% terraform import aws_globalaccelerator_accelerator.example arn:aws:globalaccelerator::111111111111:accelerator/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
+```
+
+<!-- cache-key: cdktf-0.18.0 input-7f5b36602f0875f89018a31aa91d4a8e5d30b8b26a613494ca2259ff9749c761 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/globalaccelerator_custom_routing_accelerator.html.markdown b/website/docs/cdktf/typescript/r/globalaccelerator_custom_routing_accelerator.html.markdown
new file mode 100644
index 00000000000..1f63e025f22
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/globalaccelerator_custom_routing_accelerator.html.markdown
@@ -0,0 +1,110 @@
+---
+subcategory: "Global Accelerator"
+layout: "aws"
+page_title: "AWS: aws_globalaccelerator_custom_routing_accelerator"
+description: |-
+  Provides a Global Accelerator custom routing accelerator.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_globalaccelerator_custom_routing_accelerator
+
+Creates a Global Accelerator custom routing accelerator.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { GlobalacceleratorCustomRoutingAccelerator } from "./.gen/providers/aws/globalaccelerator-custom-routing-accelerator";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new GlobalacceleratorCustomRoutingAccelerator(this, "example", {
+      attributes: {
+        flowLogsEnabled: true,
+        flowLogsS3Bucket: "example-bucket",
+        flowLogsS3Prefix: "flow-logs/",
+      },
+      enabled: true,
+      ipAddressType: "IPV4",
+      ipAddresses: ["1.2.3.4"],
+      name: "Example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of a custom routing accelerator.
+* `ipAddressType` - (Optional) The IP address type that an accelerator supports. For a custom routing accelerator, the value must be `"ipv4"`.
+* `ipAddresses` - (Optional) The IP addresses to use for BYOIP accelerators. If not specified, the service assigns IP addresses. Valid values: 1 or 2 IPv4 addresses.
+* `enabled` - (Optional) Indicates whether the accelerator is enabled. Defaults to `true`. Valid values: `true`, `false`.
+* `attributes` - (Optional) The attributes of the accelerator. Fields documented below.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+`attributes` supports the following arguments:
+
+* `flowLogsEnabled` - (Optional) Indicates whether flow logs are enabled. Defaults to `false`. Valid values: `true`, `false`.
+* `flowLogsS3Bucket` - (Optional) The name of the Amazon S3 bucket for the flow logs. Required if `flowLogsEnabled` is `true`.
+* `flowLogsS3Prefix` - (Optional) The prefix for the location in the Amazon S3 bucket for the flow logs. Required if `flowLogsEnabled` is `true`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Amazon Resource Name (ARN) of the custom accelerator.
+* `dnsName` - The DNS name of the accelerator. For example, `a5D53Ff5Ee6Bca4CeAwsglobalacceleratorCom`.
+* `hostedZoneId` --  The Global Accelerator Route 53 zone ID that can be used to
+  route an [Alias Resource Record Set][1] to the Global Accelerator. This attribute
+  is simply an alias for the zone ID `z2Bj6Xq5Fk7U4H`.
+* `ipSets` - IP address set associated with the accelerator.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+**ip_sets** exports the following attributes:
+
+* `ipAddresses` - A list of IP addresses in the IP address set.
+* `ipFamily` - The type of IP addresses included in this IP set.
+
+[1]: https://docs.aws.amazon.com/Route53/latest/APIReference/API_AliasTarget.html
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `30M`)
+* `update` - (Default `30M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Global Accelerator custom routing accelerators using the `arn`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Global Accelerator custom routing accelerators using the `arn`. For example:
+
+```console
+% terraform import aws_globalaccelerator_custom_routing_accelerator.example arn:aws:globalaccelerator::111111111111:accelerator/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
+```
+
+<!-- cache-key: cdktf-0.18.0 input-765641ba0d03ea8679c57c2c3557a0495cf7d72f403588b6664a9e2b49f09bcd -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/globalaccelerator_custom_routing_endpoint_group.html.markdown b/website/docs/cdktf/typescript/r/globalaccelerator_custom_routing_endpoint_group.html.markdown
new file mode 100644
index 00000000000..a6787df2e23
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/globalaccelerator_custom_routing_endpoint_group.html.markdown
@@ -0,0 +1,107 @@
+---
+subcategory: "Global Accelerator"
+layout: "aws"
+page_title: "AWS: aws_globalaccelerator_custom_routing_endpoint_group"
+description: |-
+  Provides a Global Accelerator custom routing endpoint group.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_globalaccelerator_custom_routing_endpoint_group
+
+Provides a Global Accelerator custom routing endpoint group.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { GlobalacceleratorCustomRoutingEndpointGroup } from "./.gen/providers/aws/globalaccelerator-custom-routing-endpoint-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new GlobalacceleratorCustomRoutingEndpointGroup(this, "example", {
+      destinationConfiguration: [
+        {
+          fromPort: 80,
+          protocols: ["TCP"],
+          toPort: 8080,
+        },
+      ],
+      endpointConfiguration: [
+        {
+          endpointId: Token.asString(awsSubnetExample.id),
+        },
+      ],
+      listenerArn: Token.asString(
+        awsGlobalacceleratorCustomRoutingListenerExample.id
+      ),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `listenerArn` - (Required) The Amazon Resource Name (ARN) of the custom routing listener.
+* `destinationConfiguration` - (Required) The port ranges and protocols for all endpoints in a custom routing endpoint group to accept client traffic on. Fields documented below.
+* `endpointConfiguration` - (Optional) The list of endpoint objects. Fields documented below.
+* `endpointGroupRegion` (Optional) - The name of the AWS Region where the custom routing endpoint group is located.
+
+`destinationConfiguration` supports the following arguments:
+
+* `fromPort` - (Required) The first port, inclusive, in the range of ports for the endpoint group that is associated with a custom routing accelerator.
+* `protocols` - (Required) The protocol for the endpoint group that is associated with a custom routing accelerator. The protocol can be either `"tcp"` or `"udp"`.
+* `toPort` - (Required) The last port, inclusive, in the range of ports for the endpoint group that is associated with a custom routing accelerator.
+
+`endpointConfiguration` supports the following arguments:
+
+* `endpointId` - (Optional) An ID for the endpoint. For custom routing accelerators, this is the virtual private cloud (VPC) subnet ID.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Amazon Resource Name (ARN) of the custom routing endpoint group.
+* `arn` - The Amazon Resource Name (ARN) of the custom routing endpoint group.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `30M`)
+* `update` - (Default `30M`)
+* `delete` - (Default `30M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Global Accelerator custom routing endpoint groups using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Global Accelerator custom routing endpoint groups using the `id`. For example:
+
+```console
+% terraform import aws_globalaccelerator_custom_routing_endpoint_group.example arn:aws:globalaccelerator::111111111111:accelerator/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/listener/xxxxxxx/endpoint-group/xxxxxxxx
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1cdf76aa1d7720de7b94c9800ff5e5f2715b300edfc472a4a81ea499fa6efa64 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/globalaccelerator_custom_routing_listener.html.markdown b/website/docs/cdktf/typescript/r/globalaccelerator_custom_routing_listener.html.markdown
new file mode 100644
index 00000000000..835f2332114
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/globalaccelerator_custom_routing_listener.html.markdown
@@ -0,0 +1,111 @@
+---
+subcategory: "Global Accelerator"
+layout: "aws"
+page_title: "AWS: aws_globalaccelerator_custom_routing_listener"
+description: |-
+  Provides a Global Accelerator custom routing listener.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_globalaccelerator_custom_routing_listener
+
+Provides a Global Accelerator custom routing listener.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { GlobalacceleratorCustomRoutingAccelerator } from "./.gen/providers/aws/globalaccelerator-custom-routing-accelerator";
+import { GlobalacceleratorCustomRoutingListener } from "./.gen/providers/aws/globalaccelerator-custom-routing-listener";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new GlobalacceleratorCustomRoutingAccelerator(
+      this,
+      "example",
+      {
+        attributes: {
+          flowLogsEnabled: true,
+          flowLogsS3Bucket: "example-bucket",
+          flowLogsS3Prefix: "flow-logs/",
+        },
+        enabled: true,
+        ipAddressType: "IPV4",
+        name: "Example",
+      }
+    );
+    const awsGlobalacceleratorCustomRoutingListenerExample =
+      new GlobalacceleratorCustomRoutingListener(this, "example_1", {
+        acceleratorArn: example.id,
+        portRange: [
+          {
+            fromPort: 80,
+            toPort: 80,
+          },
+        ],
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsGlobalacceleratorCustomRoutingListenerExample.overrideLogicalId(
+      "example"
+    );
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `acceleratorArn` - (Required) The Amazon Resource Name (ARN) of a custom routing accelerator.
+* `portRange` - (Optional) The list of port ranges for the connections from clients to the accelerator. Fields documented below.
+
+`portRange` supports the following arguments:
+
+* `fromPort` - (Optional) The first port in the range of ports, inclusive.
+* `toPort` - (Optional) The last port in the range of ports, inclusive.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Amazon Resource Name (ARN) of the custom routing listener.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `30M`)
+* `update` - (Default `30M`)
+* `delete` - (Default `30M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Global Accelerator custom routing listeners using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Global Accelerator custom routing listeners using the `id`. For example:
+
+```console
+% terraform import aws_globalaccelerator_custom_routing_listener.example arn:aws:globalaccelerator::111111111111:accelerator/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/listener/xxxxxxxx
+```
+
+<!-- cache-key: cdktf-0.18.0 input-7d9b14c85b89fb6ec7d4fa26f1cd657180812dab00b0742e6d404be95e64a568 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/globalaccelerator_endpoint_group.html.markdown b/website/docs/cdktf/typescript/r/globalaccelerator_endpoint_group.html.markdown
new file mode 100644
index 00000000000..25d2376e0ba
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/globalaccelerator_endpoint_group.html.markdown
@@ -0,0 +1,108 @@
+---
+subcategory: "Global Accelerator"
+layout: "aws"
+page_title: "AWS: aws_globalaccelerator_endpoint_group"
+description: |-
+  Provides a Global Accelerator endpoint group.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_globalaccelerator_endpoint_group
+
+Provides a Global Accelerator endpoint group.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { GlobalacceleratorEndpointGroup } from "./.gen/providers/aws/globalaccelerator-endpoint-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new GlobalacceleratorEndpointGroup(this, "example", {
+      endpointConfiguration: [
+        {
+          endpointId: Token.asString(awsLbExample.arn),
+          weight: 100,
+        },
+      ],
+      listenerArn: Token.asString(awsGlobalacceleratorListenerExample.id),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `listenerArn` - (Required) The Amazon Resource Name (ARN) of the listener.
+* `endpointGroupRegion` (Optional) - The name of the AWS Region where the endpoint group is located.
+* `healthCheckIntervalSeconds` - (Optional) The time—10 seconds or 30 seconds—between each health check for an endpoint. The default value is 30.
+* `healthCheckPath` - (Optional) If the protocol is HTTP/S, then this specifies the path that is the destination for health check targets. The default value is slash (`/`). Terraform will only perform drift detection of its value when present in a configuration.
+* `healthCheckPort` - (Optional) The port that AWS Global Accelerator uses to check the health of endpoints that are part of this endpoint group. The default port is the listener port that this endpoint group is associated with. If listener port is a list of ports, Global Accelerator uses the first port in the list.
+Terraform will only perform drift detection of its value when present in a configuration.
+* `healthCheckProtocol` - (Optional) The protocol that AWS Global Accelerator uses to check the health of endpoints that are part of this endpoint group. The default value is TCP.
+* `thresholdCount` - (Optional) The number of consecutive health checks required to set the state of a healthy endpoint to unhealthy, or to set an unhealthy endpoint to healthy. The default value is 3.
+* `trafficDialPercentage` - (Optional) The percentage of traffic to send to an AWS Region. Additional traffic is distributed to other endpoint groups for this listener. The default value is 100.
+* `endpointConfiguration` - (Optional) The list of endpoint objects. Fields documented below.
+* `portOverride` - (Optional) Override specific listener ports used to route traffic to endpoints that are part of this endpoint group. Fields documented below.
+
+`endpointConfiguration` supports the following arguments:
+
+* `clientIpPreservationEnabled` - (Optional) Indicates whether client IP address preservation is enabled for an Application Load Balancer endpoint. See the [AWS documentation](https://docs.aws.amazon.com/global-accelerator/latest/dg/preserve-client-ip-address.html) for more details. The default value is `false`.
+**Note:** When client IP address preservation is enabled, the Global Accelerator service creates an EC2 Security Group in the VPC named `globalAccelerator` that must be deleted (potentially outside of Terraform) before the VPC will successfully delete. If this EC2 Security Group is not deleted, Terraform will retry the VPC deletion for a few minutes before reporting a `dependencyViolation` error. This cannot be resolved by re-running Terraform.
+* `endpointId` - (Optional) An ID for the endpoint. If the endpoint is a Network Load Balancer or Application Load Balancer, this is the Amazon Resource Name (ARN) of the resource. If the endpoint is an Elastic IP address, this is the Elastic IP address allocation ID.
+* `weight` - (Optional) The weight associated with the endpoint. When you add weights to endpoints, you configure AWS Global Accelerator to route traffic based on proportions that you specify.
+
+`portOverride` supports the following arguments:
+
+* `endpointPort` - (Required) The endpoint port that you want a listener port to be mapped to. This is the port on the endpoint, such as the Application Load Balancer or Amazon EC2 instance.
+* `listenerPort` - (Required) The listener port that you want to map to a specific endpoint port. This is the port that user traffic arrives to the Global Accelerator on.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Amazon Resource Name (ARN) of the endpoint group.
+* `arn` - The Amazon Resource Name (ARN) of the endpoint group.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `30M`)
+* `update` - (Default `30M`)
+* `delete` - (Default `30M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Global Accelerator endpoint groups using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Global Accelerator endpoint groups using the `id`. For example:
+
+```console
+% terraform import aws_globalaccelerator_endpoint_group.example arn:aws:globalaccelerator::111111111111:accelerator/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/listener/xxxxxxx/endpoint-group/xxxxxxxx
+```
+
+<!-- cache-key: cdktf-0.18.0 input-a99822bb8d802bdee38671c5875d85175be0aff6331a6b380641cb861eac7402 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/globalaccelerator_listener.html.markdown b/website/docs/cdktf/typescript/r/globalaccelerator_listener.html.markdown
new file mode 100644
index 00000000000..9ae50636f1a
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/globalaccelerator_listener.html.markdown
@@ -0,0 +1,112 @@
+---
+subcategory: "Global Accelerator"
+layout: "aws"
+page_title: "AWS: aws_globalaccelerator_listener"
+description: |-
+  Provides a Global Accelerator listener.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_globalaccelerator_listener
+
+Provides a Global Accelerator listener.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { GlobalacceleratorAccelerator } from "./.gen/providers/aws/globalaccelerator-accelerator";
+import { GlobalacceleratorListener } from "./.gen/providers/aws/globalaccelerator-listener";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new GlobalacceleratorAccelerator(this, "example", {
+      attributes: {
+        flowLogsEnabled: true,
+        flowLogsS3Bucket: "example-bucket",
+        flowLogsS3Prefix: "flow-logs/",
+      },
+      enabled: true,
+      ipAddressType: "IPV4",
+      name: "Example",
+    });
+    const awsGlobalacceleratorListenerExample = new GlobalacceleratorListener(
+      this,
+      "example_1",
+      {
+        acceleratorArn: example.id,
+        clientAffinity: "SOURCE_IP",
+        portRange: [
+          {
+            fromPort: 80,
+            toPort: 80,
+          },
+        ],
+        protocol: "TCP",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsGlobalacceleratorListenerExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `acceleratorArn` - (Required) The Amazon Resource Name (ARN) of your accelerator.
+* `clientAffinity` - (Optional) Direct all requests from a user to the same endpoint. Valid values are `none`, `sourceIp`. Default: `none`. If `none`, Global Accelerator uses the "five-tuple" properties of source IP address, source port, destination IP address, destination port, and protocol to select the hash value. If `sourceIp`, Global Accelerator uses the "two-tuple" properties of source (client) IP address and destination IP address to select the hash value.
+* `protocol` - (Optional) The protocol for the connections from clients to the accelerator. Valid values are `tcp`, `udp`.
+* `portRange` - (Optional) The list of port ranges for the connections from clients to the accelerator. Fields documented below.
+
+`portRange` supports the following arguments:
+
+* `fromPort` - (Optional) The first port in the range of ports, inclusive.
+* `toPort` - (Optional) The last port in the range of ports, inclusive.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Amazon Resource Name (ARN) of the listener.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `30M`)
+* `update` - (Default `30M`)
+* `delete` - (Default `30M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Global Accelerator listeners using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Global Accelerator listeners using the `id`. For example:
+
+```console
+% terraform import aws_globalaccelerator_listener.example arn:aws:globalaccelerator::111111111111:accelerator/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/listener/xxxxxxxx
+```
+
+<!-- cache-key: cdktf-0.18.0 input-916b1c351e05097e7ddc260e23377eafd367b2e2e899550a7d4798b0d81ab853 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/glue_catalog_database.html.markdown b/website/docs/cdktf/typescript/r/glue_catalog_database.html.markdown
new file mode 100644
index 00000000000..6f1941907b8
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/glue_catalog_database.html.markdown
@@ -0,0 +1,125 @@
+---
+subcategory: "Glue"
+layout: "aws"
+page_title: "AWS: aws_glue_catalog_database"
+description: |-
+  Provides a Glue Catalog Database.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_glue_catalog_database
+
+Provides a Glue Catalog Database Resource. You can refer to the [Glue Developer Guide](http://docs.aws.amazon.com/glue/latest/dg/populate-data-catalog.html) for a full explanation of the Glue Data Catalog functionality
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { GlueCatalogDatabase } from "./.gen/providers/aws/glue-catalog-database";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new GlueCatalogDatabase(this, "aws_glue_catalog_database", {
+      name: "MyCatalogDatabase",
+    });
+  }
+}
+
+```
+
+### Create Table Default Permissions
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { GlueCatalogDatabase } from "./.gen/providers/aws/glue-catalog-database";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new GlueCatalogDatabase(this, "aws_glue_catalog_database", {
+      createTableDefaultPermission: [
+        {
+          permissions: ["SELECT"],
+          principal: {
+            dataLakePrincipalIdentifier: "IAM_ALLOWED_PRINCIPALS",
+          },
+        },
+      ],
+      name: "MyCatalogDatabase",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `catalogId` - (Optional) ID of the Glue Catalog to create the database in. If omitted, this defaults to the AWS Account ID.
+* `createTableDefaultPermission` - (Optional) Creates a set of default permissions on the table for principals. See [`createTableDefaultPermission`](#create_table_default_permission) below.
+* `description` - (Optional) Description of the database.
+* `locationUri` - (Optional) Location of the database (for example, an HDFS path).
+* `name` - (Required) Name of the database. The acceptable characters are lowercase letters, numbers, and the underscore character.
+* `parameters` - (Optional) List of key-value pairs that define parameters and properties of the database.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `targetDatabase` - (Optional) Configuration block for a target database for resource linking. See [`targetDatabase`](#target_database) below.
+
+### target_database
+
+* `catalogId` - (Required) ID of the Data Catalog in which the database resides.
+* `databaseName` - (Required) Name of the catalog database.
+* `region` - (Optional) Region of the target database.
+
+### create_table_default_permission
+
+* `permissions` - (Optional) The permissions that are granted to the principal.
+* `principal` - (Optional) The principal who is granted permissions.. See [`principal`](#principal) below.
+
+#### principal
+
+* `dataLakePrincipalIdentifier` - (Optional) An identifier for the Lake Formation principal.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Glue Catalog Database.
+* `id` - Catalog ID and name of the database.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Glue Catalog Databases using the `catalogId:name`. If you have not set a Catalog ID specify the AWS Account ID that the database is in. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Glue Catalog Databases using the `catalogId:name`. If you have not set a Catalog ID specify the AWS Account ID that the database is in. For example:
+
+```console
+% terraform import aws_glue_catalog_database.database 123456789012:my_database
+```
+
+<!-- cache-key: cdktf-0.18.0 input-556c19f9f828a7b00dcbf12d311ec9ce93276130015a07072b31615d6edc75d0 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/glue_catalog_table.html.markdown b/website/docs/cdktf/typescript/r/glue_catalog_table.html.markdown
new file mode 100644
index 00000000000..98647e7a7cf
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/glue_catalog_table.html.markdown
@@ -0,0 +1,248 @@
+---
+subcategory: "Glue"
+layout: "aws"
+page_title: "AWS: aws_glue_catalog_table"
+description: |-
+  Provides a Glue Catalog Table.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_glue_catalog_table
+
+Provides a Glue Catalog Table Resource. You can refer to the [Glue Developer Guide](http://docs.aws.amazon.com/glue/latest/dg/populate-data-catalog.html) for a full explanation of the Glue Data Catalog functionality.
+
+## Example Usage
+
+### Basic Table
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { GlueCatalogTable } from "./.gen/providers/aws/glue-catalog-table";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new GlueCatalogTable(this, "aws_glue_catalog_table", {
+      databaseName: "MyCatalogDatabase",
+      name: "MyCatalogTable",
+    });
+  }
+}
+
+```
+
+### Parquet Table for Athena
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { GlueCatalogTable } from "./.gen/providers/aws/glue-catalog-table";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new GlueCatalogTable(this, "aws_glue_catalog_table", {
+      databaseName: "MyCatalogDatabase",
+      name: "MyCatalogTable",
+      parameters: {
+        EXTERNAL: "TRUE",
+        "parquet.compression": "SNAPPY",
+      },
+      storageDescriptor: {
+        columns: [
+          {
+            name: "my_string",
+            type: "string",
+          },
+          {
+            name: "my_double",
+            type: "double",
+          },
+          {
+            comment: "",
+            name: "my_date",
+            type: "date",
+          },
+          {
+            comment: "",
+            name: "my_bigint",
+            type: "bigint",
+          },
+          {
+            comment: "",
+            name: "my_struct",
+            type: "struct<my_nested_string:string>",
+          },
+        ],
+        inputFormat:
+          "org.apache.hadoop.hive.ql.io.parquet.MapredParquetInputFormat",
+        location: "s3://my-bucket/event-streams/my-stream",
+        outputFormat:
+          "org.apache.hadoop.hive.ql.io.parquet.MapredParquetOutputFormat",
+        serDeInfo: {
+          name: "my-stream",
+          parameters: {
+            "serialization.format": Token.asString(1),
+          },
+          serializationLibrary:
+            "org.apache.hadoop.hive.ql.io.parquet.serde.ParquetHiveSerDe",
+        },
+      },
+      tableType: "EXTERNAL_TABLE",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) Name of the table. For Hive compatibility, this must be entirely lowercase.
+* `databaseName` - (Required) Name of the metadata database where the table metadata resides. For Hive compatibility, this must be all lowercase.
+
+The follow arguments are optional:
+
+* `catalogId` - (Optional) ID of the Glue Catalog and database to create the table in. If omitted, this defaults to the AWS Account ID plus the database name.
+* `description` - (Optional) Description of the table.
+* `owner` - (Optional) Owner of the table.
+* `openTableFormatInput` - (Optional) Configuration block for open table formats. See [`openTableFormatInput`](#open_table_format_input) below.
+* `parameters` - (Optional) Properties associated with this table, as a list of key-value pairs.
+* `partitionIndex` - (Optional) Configuration block for a maximum of 3 partition indexes. See [`partitionIndex`](#partition_index) below.
+* `partitionKeys` - (Optional) Configuration block of columns by which the table is partitioned. Only primitive types are supported as partition keys. See [`partitionKeys`](#partition_keys) below.
+* `retention` - (Optional) Retention time for this table.
+* `storageDescriptor` - (Optional) Configuration block for information about the physical storage of this table. For more information, refer to the [Glue Developer Guide](https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-tables.html#aws-glue-api-catalog-tables-StorageDescriptor). See [`storageDescriptor`](#storage_descriptor) below.
+* `tableType` - (Optional) Type of this table (EXTERNAL_TABLE, VIRTUAL_VIEW, etc.). While optional, some Athena DDL queries such as `ALTER TABLE` and `SHOW CREATE TABLE` will fail if this argument is empty.
+* `targetTable` - (Optional) Configuration block of a target table for resource linking. See [`targetTable`](#target_table) below.
+* `viewExpandedText` - (Optional) If the table is a view, the expanded text of the view; otherwise null.
+* `viewOriginalText` - (Optional) If the table is a view, the original text of the view; otherwise null.
+
+### open_table_format_input
+
+~> **NOTE:** A `openTableFormatInput` cannot be added to an existing `glueCatalogTable`.
+This will destroy and recreate the table, possibly resulting in data loss.
+
+* `icebergInput` - (Required) Configuration block for iceberg table config. See [`icebergInput`](#iceberg_input) below.
+
+### iceberg_input
+
+~> **NOTE:** A `icebergInput` cannot be added to an existing `openTableFormatInput`.
+This will destroy and recreate the table, possibly resulting in data loss.
+
+* `metadataOperation` - (Required) A required metadata operation. Can only be set to CREATE.
+* `version` - (Optional) The table version for the Iceberg table. Defaults to 2.
+
+### partition_index
+
+~> **NOTE:** A `partitionIndex` cannot be added to an existing `glueCatalogTable`.
+This will destroy and recreate the table, possibly resulting in data loss.
+To add an index to an existing table, see the [`gluePartitionIndex` resource](/docs/providers/aws/r/glue_partition_index.html) for configuration details.
+
+* `indexName` - (Required) Name of the partition index.
+* `keys` - (Required) Keys for the partition index.
+
+### partition_keys
+
+* `comment` - (Optional) Free-form text comment.
+* `name` - (Required) Name of the Partition Key.
+* `type` - (Optional) Datatype of data in the Partition Key.
+
+### storage_descriptor
+
+* `bucketColumns` - (Optional) List of reducer grouping columns, clustering columns, and bucketing columns in the table.
+* `columns` - (Optional) Configuration block for columns in the table. See [`columns`](#columns) below.
+* `compressed` - (Optional) Whether the data in the table is compressed.
+* `inputFormat` - (Optional) Input format: SequenceFileInputFormat (binary), or TextInputFormat, or a custom format.
+* `location` - (Optional) Physical location of the table. By default this takes the form of the warehouse location, followed by the database location in the warehouse, followed by the table name.
+* `numberOfBuckets` - (Optional) Must be specified if the table contains any dimension columns.
+* `outputFormat` - (Optional) Output format: SequenceFileOutputFormat (binary), or IgnoreKeyTextOutputFormat, or a custom format.
+* `parameters` - (Optional) User-supplied properties in key-value form.
+* `schemaReference` - (Optional) Object that references a schema stored in the AWS Glue Schema Registry. When creating a table, you can pass an empty list of columns for the schema, and instead use a schema reference. See [Schema Reference](#schema_reference) below.
+* `serDeInfo` - (Optional) Configuration block for serialization and deserialization ("SerDe") information. See [`serDeInfo`](#ser_de_info) below.
+* `skewedInfo` - (Optional) Configuration block with information about values that appear very frequently in a column (skewed values). See [`skewedInfo`](#skewed_info) below.
+* `sortColumns` - (Optional) Configuration block for the sort order of each bucket in the table. See [`sortColumns`](#sort_columns) below.
+* `storedAsSubDirectories` - (Optional) Whether the table data is stored in subdirectories.
+
+#### columns
+
+* `comment` - (Optional) Free-form text comment.
+* `name` - (Required) Name of the Column.
+* `parameters` - (Optional) Key-value pairs defining properties associated with the column.
+* `type` - (Optional) Datatype of data in the Column.
+
+#### schema_reference
+
+* `schemaId` - (Optional) Configuration block that contains schema identity fields. Either this or the `schemaVersionId` has to be provided. See [`schemaId`](#schema_id) below.
+* `schemaVersionId` - (Optional) Unique ID assigned to a version of the schema. Either this or the `schemaId` has to be provided.
+* `schemaVersionNumber` - (Required) Version number of the schema.
+
+##### schema_id
+
+* `registryName` - (Optional) Name of the schema registry that contains the schema. Must be provided when `schemaName` is specified and conflicts with `schemaArn`.
+* `schemaArn` - (Optional) ARN of the schema. One of `schemaArn` or `schemaName` has to be provided.
+* `schemaName` - (Optional) Name of the schema. One of `schemaArn` or `schemaName` has to be provided.
+
+#### ser_de_info
+
+* `name` - (Optional) Name of the SerDe.
+* `parameters` - (Optional) Map of initialization parameters for the SerDe, in key-value form.
+* `serializationLibrary` - (Optional) Usually the class that implements the SerDe. An example is `orgApacheHadoopHiveSerde2ColumnarColumnarSerDe`.
+
+#### sort_columns
+
+* `column` - (Required) Name of the column.
+* `sortOrder` - (Required) Whether the column is sorted in ascending (`1`) or descending order (`0`).
+
+#### skewed_info
+
+* `skewedColumnNames` - (Optional) List of names of columns that contain skewed values.
+* `skewedColumnValueLocationMaps` - (Optional) List of values that appear so frequently as to be considered skewed.
+* `skewedColumnValues` - (Optional) Map of skewed values to the columns that contain them.
+
+### target_table
+
+* `catalogId` - (Required) ID of the Data Catalog in which the table resides.
+* `databaseName` - (Required) Name of the catalog database that contains the target table.
+* `name` - (Required) Name of the target table.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the Glue Table.
+* `id` - Catalog ID, Database name and of the name table.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Glue Tables using the catalog ID (usually AWS account ID), database name, and table name. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Glue Tables using the catalog ID (usually AWS account ID), database name, and table name. For example:
+
+```console
+% terraform import aws_glue_catalog_table.MyTable 123456789012:MyDatabase:MyTable
+```
+
+<!-- cache-key: cdktf-0.18.0 input-45918d95d1ee42b18f0a38282d1c7f92c766f0d90f43a1e0cd1f7c41e6fd3936 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/glue_classifier.html.markdown b/website/docs/cdktf/typescript/r/glue_classifier.html.markdown
new file mode 100644
index 00000000000..2611d68686f
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/glue_classifier.html.markdown
@@ -0,0 +1,190 @@
+---
+subcategory: "Glue"
+layout: "aws"
+page_title: "AWS: aws_glue_classifier"
+description: |-
+  Provides an Glue Classifier resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_glue_classifier
+
+Provides a Glue Classifier resource.
+
+~> **NOTE:** It is only valid to create one type of classifier (csv, grok, JSON, or XML). Changing classifier types will recreate the classifier.
+
+## Example Usage
+
+### Csv Classifier
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { GlueClassifier } from "./.gen/providers/aws/glue-classifier";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new GlueClassifier(this, "example", {
+      csvClassifier: {
+        allowSingleColumn: false,
+        containsHeader: "PRESENT",
+        delimiter: ",",
+        disableValueTrimming: false,
+        header: ["example1", "example2"],
+        quoteSymbol: "'",
+      },
+      name: "example",
+    });
+  }
+}
+
+```
+
+### Grok Classifier
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { GlueClassifier } from "./.gen/providers/aws/glue-classifier";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new GlueClassifier(this, "example", {
+      grokClassifier: {
+        classification: "example",
+        grokPattern: "example",
+      },
+      name: "example",
+    });
+  }
+}
+
+```
+
+### JSON Classifier
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { GlueClassifier } from "./.gen/providers/aws/glue-classifier";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new GlueClassifier(this, "example", {
+      jsonClassifier: {
+        jsonPath: "example",
+      },
+      name: "example",
+    });
+  }
+}
+
+```
+
+### XML Classifier
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { GlueClassifier } from "./.gen/providers/aws/glue-classifier";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new GlueClassifier(this, "example", {
+      name: "example",
+      xmlClassifier: {
+        classification: "example",
+        rowTag: "example",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `csvClassifier` - (Optional) A classifier for Csv content. Defined below.
+* `grokClassifier` – (Optional) A classifier that uses grok patterns. Defined below.
+* `jsonClassifier` – (Optional) A classifier for JSON content. Defined below.
+* `name` – (Required) The name of the classifier.
+* `xmlClassifier` – (Optional) A classifier for XML content. Defined below.
+
+### csv_classifier
+
+* `allowSingleColumn` - (Optional) Enables the processing of files that contain only one column.
+* `containsHeader` - (Optional) Indicates whether the CSV file contains a header. This can be one of "ABSENT", "PRESENT", or "UNKNOWN".
+* `customDatatypeConfigured` - (Optional) A custom symbol to denote what combines content into a single column value. It must be different from the column delimiter.
+* `customDatatypes` - (Optional) A list of supported custom datatypes. Valid values are `binary`, `boolean`, `date`, `decimal`, `double`, `float`, `int`, `long`, `short`, `string`, `timestamp`.
+* `delimiter` - (Optional) The delimiter used in the Csv to separate columns.
+* `disableValueTrimming` - (Optional) Specifies whether to trim column values.
+* `header` - (Optional) A list of strings representing column names.
+* `quoteSymbol` - (Optional) A custom symbol to denote what combines content into a single column value. It must be different from the column delimiter.
+
+### grok_classifier
+
+* `classification` - (Required) An identifier of the data format that the classifier matches, such as Twitter, JSON, Omniture logs, Amazon CloudWatch Logs, and so on.
+* `customPatterns` - (Optional) Custom grok patterns used by this classifier.
+* `grokPattern` - (Required) The grok pattern used by this classifier.
+
+### json_classifier
+
+* `jsonPath` - (Required) A `jsonPath` string defining the JSON data for the classifier to classify. AWS Glue supports a subset of `jsonPath`, as described in [Writing JsonPath Custom Classifiers](https://docs.aws.amazon.com/glue/latest/dg/custom-classifier.html#custom-classifier-json).
+
+### xml_classifier
+
+* `classification` - (Required) An identifier of the data format that the classifier matches.
+* `rowTag` - (Required) The XML tag designating the element that contains each record in an XML document being parsed. Note that this cannot identify a self-closing element (closed by `/>`). An empty row element that contains only attributes can be parsed as long as it ends with a closing tag (for example, `<row item_a="A" item_b="B"></row>` is okay, but `<row item_a="A" item_b="B" />` is not).
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Name of the classifier
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Glue Classifiers using their name. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Glue Classifiers using their name. For example:
+
+```console
+% terraform import aws_glue_classifier.MyClassifier MyClassifier
+```
+
+<!-- cache-key: cdktf-0.18.0 input-79f267ac82abd7c066ef5dc22fae51abc346ed566400e78952a79529d3af71bd -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/glue_connection.html.markdown b/website/docs/cdktf/typescript/r/glue_connection.html.markdown
new file mode 100644
index 00000000000..84794f3f40a
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/glue_connection.html.markdown
@@ -0,0 +1,210 @@
+---
+subcategory: "Glue"
+layout: "aws"
+page_title: "AWS: aws_glue_connection"
+description: |-
+  Provides an Glue Connection resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_glue_connection
+
+Provides a Glue Connection resource.
+
+## Example Usage
+
+### Non-VPC Connection
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { GlueConnection } from "./.gen/providers/aws/glue-connection";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new GlueConnection(this, "example", {
+      connectionProperties: {
+        JDBC_CONNECTION_URL: "jdbc:mysql://example.com/exampledatabase",
+        PASSWORD: "examplepassword",
+        USERNAME: "exampleusername",
+      },
+      name: "example",
+    });
+  }
+}
+
+```
+
+### Non-VPC Connection with secret manager reference
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsSecretmanagerSecret } from "./.gen/providers/aws/";
+import { GlueConnection } from "./.gen/providers/aws/glue-connection";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new DataAwsSecretmanagerSecret(this, "example", {
+      name: "example-secret",
+    });
+    const awsGlueConnectionExample = new GlueConnection(this, "example_1", {
+      connectionProperties: {
+        JDBC_CONNECTION_URL: "jdbc:mysql://example.com/exampledatabase",
+        SECRET_ID: Token.asString(example.name),
+      },
+      name: "example",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsGlueConnectionExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### VPC Connection
+
+For more information, see the [AWS Documentation](https://docs.aws.amazon.com/glue/latest/dg/populate-add-connection.html#connection-JDBC-VPC).
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { GlueConnection } from "./.gen/providers/aws/glue-connection";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new GlueConnection(this, "example", {
+      connectionProperties: {
+        JDBC_CONNECTION_URL:
+          "jdbc:mysql://${" +
+          awsRdsClusterExample.endpoint +
+          "}/exampledatabase",
+        PASSWORD: "examplepassword",
+        USERNAME: "exampleusername",
+      },
+      name: "example",
+      physicalConnectionRequirements: {
+        availabilityZone: Token.asString(awsSubnetExample.availabilityZone),
+        securityGroupIdList: [Token.asString(awsSecurityGroupExample.id)],
+        subnetId: Token.asString(awsSubnetExample.id),
+      },
+    });
+  }
+}
+
+```
+
+### Connection using a custom connector
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsSecretmanagerSecret } from "./.gen/providers/aws/";
+import { GlueConnection } from "./.gen/providers/aws/glue-connection";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const exampleConnector = new GlueConnection(this, "example_connector", {
+      connectionProperties: {
+        CONNECTION_TYPE: "Jdbc",
+        CONNECTOR_CLASS_NAME: "net.snowflake.client.jdbc.SnowflakeDriver",
+        CONNECTOR_URL: "s3://example/snowflake-jdbc.jar",
+        JDBC_CONNECTION_URL:
+          '[[\\"default=jdbc:snowflake://example.com/?user=$${user}&password=$${password}\\"],\\",\\"]',
+      },
+      connectionType: "CUSTOM",
+      matchCriteria: ["template-connection"],
+      name: "example_connector",
+    });
+    const example = new DataAwsSecretmanagerSecret(this, "example", {
+      name: "example-secret",
+    });
+    new GlueConnection(this, "example_connection", {
+      connectionProperties: {
+        CONNECTION_TYPE: "Jdbc",
+        CONNECTOR_CLASS_NAME: "net.snowflake.client.jdbc.SnowflakeDriver",
+        CONNECTOR_URL: "s3://example/snowflake-jdbc.jar",
+        JDBC_CONNECTION_URL:
+          "jdbc:snowflake://example.com/?user=$${user}&password=$${password}",
+        SECRET_ID: Token.asString(example.name),
+      },
+      connectionType: "CUSTOM",
+      matchCriteria: ["Connection", exampleConnector.name],
+      name: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `catalogId` – (Optional) The ID of the Data Catalog in which to create the connection. If none is supplied, the AWS account ID is used by default.
+* `connectionProperties` – (Optional) A map of key-value pairs used as parameters for this connection.
+* `connectionType` – (Optional) The type of the connection. Supported are: `custom`, `jdbc`, `kafka`, `marketplace`, `mongodb`, and `network`. Defaults to `jbdc`.
+* `description` – (Optional) Description of the connection.
+* `matchCriteria` – (Optional) A list of criteria that can be used in selecting this connection.
+* `name` – (Required) The name of the connection.
+* `physicalConnectionRequirements` - (Optional) A map of physical connection requirements, such as VPC and SecurityGroup. Defined below.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### physical_connection_requirements
+
+* `availabilityZone` - (Optional) The availability zone of the connection. This field is redundant and implied by `subnetId`, but is currently an api requirement.
+* `securityGroupIdList` - (Optional) The security group ID list used by the connection.
+* `subnetId` - (Optional) The subnet ID used by the connection.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Catalog ID and name of the connection
+* `arn` - The ARN of the Glue Connection.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Glue Connections using the `catalogId` (AWS account ID if not custom) and `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Glue Connections using the `catalogId` (AWS account ID if not custom) and `name`. For example:
+
+```console
+% terraform import aws_glue_connection.MyConnection 123456789012:MyConnection
+```
+
+<!-- cache-key: cdktf-0.18.0 input-e5f54a151c81766ea8f354e5241734756142da42a3b5bcc9ad07d0060d066e20 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/glue_crawler.html.markdown b/website/docs/cdktf/typescript/r/glue_crawler.html.markdown
new file mode 100644
index 00000000000..208b53f963c
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/glue_crawler.html.markdown
@@ -0,0 +1,351 @@
+---
+subcategory: "Glue"
+layout: "aws"
+page_title: "AWS: aws_glue_crawler"
+description: |-
+  Manages a Glue Crawler
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_glue_crawler
+
+Manages a Glue Crawler. More information can be found in the [AWS Glue Developer Guide](https://docs.aws.amazon.com/glue/latest/dg/add-crawler.html)
+
+## Example Usage
+
+### DynamoDB Target Example
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { GlueCrawler } from "./.gen/providers/aws/glue-crawler";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new GlueCrawler(this, "example", {
+      databaseName: Token.asString(awsGlueCatalogDatabaseExample.name),
+      dynamodbTarget: [
+        {
+          path: "table-name",
+        },
+      ],
+      name: "example",
+      role: Token.asString(awsIamRoleExample.arn),
+    });
+  }
+}
+
+```
+
+### JDBC Target Example
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { GlueCrawler } from "./.gen/providers/aws/glue-crawler";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new GlueCrawler(this, "example", {
+      databaseName: Token.asString(awsGlueCatalogDatabaseExample.name),
+      jdbcTarget: [
+        {
+          connectionName: Token.asString(awsGlueConnectionExample.name),
+          path: "database-name/%",
+        },
+      ],
+      name: "example",
+      role: Token.asString(awsIamRoleExample.arn),
+    });
+  }
+}
+
+```
+
+### S3 Target Example
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { GlueCrawler } from "./.gen/providers/aws/glue-crawler";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new GlueCrawler(this, "example", {
+      databaseName: Token.asString(awsGlueCatalogDatabaseExample.name),
+      name: "example",
+      role: Token.asString(awsIamRoleExample.arn),
+      s3Target: [
+        {
+          path: "s3://${" + awsS3BucketExample.bucket + "}",
+        },
+      ],
+    });
+  }
+}
+
+```
+
+### Catalog Target Example
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { GlueCrawler } from "./.gen/providers/aws/glue-crawler";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new GlueCrawler(this, "example", {
+      catalogTarget: [
+        {
+          databaseName: Token.asString(awsGlueCatalogDatabaseExample.name),
+          tables: [Token.asString(awsGlueCatalogTableExample.name)],
+        },
+      ],
+      configuration:
+        '{\n  "Version":1.0,\n  "Grouping": {\n    "TableGroupingPolicy": "CombineCompatibleSchemas"\n  }\n}\n\n',
+      databaseName: Token.asString(awsGlueCatalogDatabaseExample.name),
+      name: "example",
+      role: Token.asString(awsIamRoleExample.arn),
+      schemaChangePolicy: {
+        deleteBehavior: "LOG",
+      },
+    });
+  }
+}
+
+```
+
+### MongoDB Target Example
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { GlueCrawler } from "./.gen/providers/aws/glue-crawler";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new GlueCrawler(this, "example", {
+      databaseName: Token.asString(awsGlueCatalogDatabaseExample.name),
+      mongodbTarget: [
+        {
+          connectionName: Token.asString(awsGlueConnectionExample.name),
+          path: "database-name/%",
+        },
+      ],
+      name: "example",
+      role: Token.asString(awsIamRoleExample.arn),
+    });
+  }
+}
+
+```
+
+### Configuration Settings Example
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { GlueCrawler } from "./.gen/providers/aws/glue-crawler";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new GlueCrawler(this, "events_crawler", {
+      configuration: Token.asString(
+        Fn.jsonencode({
+          CrawlerOutput: {
+            Partitions: {
+              AddOrUpdateBehavior: "InheritFromTable",
+            },
+          },
+          Grouping: {
+            TableGroupingPolicy: "CombineCompatibleSchemas",
+          },
+          Version: 1,
+        })
+      ),
+      databaseName: glueDatabase.name,
+      name: "events_crawler_${" + environmentName.value + "}",
+      role: glueRole.arn,
+      s3Target: [
+        {
+          path: "s3://${" + dataLakeBucket.bucket + "}",
+        },
+      ],
+      schedule: "cron(0 1 * * ? *)",
+      tags: Token.asStringMap(tags.value),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+~> **NOTE:** Must specify at least one of `dynamodbTarget`, `jdbcTarget`, `s3Target`, `mongodbTarget` or `catalogTarget`.
+
+This argument supports the following arguments:
+
+* `databaseName` (Required) Glue database where results are written.
+* `name` (Required) Name of the crawler.
+* `role` (Required) The IAM role friendly name (including path without leading slash), or ARN of an IAM role, used by the crawler to access other resources.
+* `classifiers` (Optional) List of custom classifiers. By default, all AWS classifiers are included in a crawl, but these custom classifiers always override the default classifiers for a given classification.
+* `configuration` (Optional) JSON string of configuration information. For more details see [Setting Crawler Configuration Options](https://docs.aws.amazon.com/glue/latest/dg/crawler-configuration.html).
+* `description` (Optional) Description of the crawler.
+* `deltaTarget` (Optional) List of nested Delta Lake target arguments. See [Delta Target](#delta-target) below.
+* `dynamodbTarget` (Optional) List of nested DynamoDB target arguments. See [Dynamodb Target](#dynamodb-target) below.
+* `jdbcTarget` (Optional) List of nested JBDC target arguments. See [JDBC Target](#jdbc-target) below.
+* `s3Target` (Optional) List of nested Amazon S3 target arguments. See [S3 Target](#s3-target) below.
+* `mongodbTarget` (Optional) List of nested MongoDB target arguments. See [MongoDB Target](#mongodb-target) below.
+* `hudiTarget` (Optional) List of nested Hudi target arguments. See [Iceberg Target](#hudi-target) below.
+* `icebergTarget` (Optional) List of nested Iceberg target arguments. See [Iceberg Target](#iceberg-target) below.
+* `schedule` (Optional) A cron expression used to specify the schedule. For more information, see [Time-Based Schedules for Jobs and Crawlers](https://docs.aws.amazon.com/glue/latest/dg/monitor-data-warehouse-schedule.html). For example, to run something every day at 12:15 UTC, you would specify: `cron(15 12 * * ? *)`.
+* `schemaChangePolicy` (Optional) Policy for the crawler's update and deletion behavior. See [Schema Change Policy](#schema-change-policy) below.
+* `lakeFormationConfiguration` (Optional) Specifies Lake Formation configuration settings for the crawler. See [Lake Formation Configuration](#lake-formation-configuration) below.
+* `lineageConfiguration` (Optional) Specifies data lineage configuration settings for the crawler. See [Lineage Configuration](#lineage-configuration) below.
+* `recrawlPolicy` (Optional)  A policy that specifies whether to crawl the entire dataset again, or to crawl only folders that were added since the last crawler run.. See [Recrawl Policy](#recrawl-policy) below.
+* `securityConfiguration` (Optional) The name of Security Configuration to be used by the crawler
+* `tablePrefix` (Optional) The table prefix used for catalog tables that are created.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Dynamodb Target
+
+* `path` - (Required) The name of the DynamoDB table to crawl.
+* `scanAll` - (Optional) Indicates whether to scan all the records, or to sample rows from the table. Scanning all the records can take a long time when the table is not a high throughput table.  defaults to `true`.
+* `scanRate` - (Optional) The percentage of the configured read capacity units to use by the AWS Glue crawler. The valid values are null or a value between 0.1 to 1.5.
+
+### JDBC Target
+
+* `connectionName` - (Required) The name of the connection to use to connect to the JDBC target.
+* `path` - (Required) The path of the JDBC target.
+* `exclusions` - (Optional) A list of glob patterns used to exclude from the crawl.
+* `enableAdditionalMetadata` - (Optional) Specify a value of `rawtypes` or `comments` to enable additional metadata intable responses. `rawtypes` provides the native-level datatype. `comments` provides comments associated with a column or table in the database.
+
+### S3 Target
+
+* `path` - (Required) The path to the Amazon S3 target.
+* `connectionName` - (Optional) The name of a connection which allows crawler to access data in S3 within a VPC.
+* `exclusions` - (Optional) A list of glob patterns used to exclude from the crawl.
+* `sampleSize` - (Optional) Sets the number of files in each leaf folder to be crawled when crawling sample files in a dataset. If not set, all the files are crawled. A valid value is an integer between 1 and 249.
+* `eventQueueArn` - (Optional) The ARN of the SQS queue to receive S3 notifications from.
+* `dlqEventQueueArn` - (Optional) The ARN of the dead-letter SQS queue.
+
+### Catalog Target
+
+* `connectionName` - (Optional) The name of the connection for an Amazon S3-backed Data Catalog table to be a target of the crawl when using a Catalog connection type paired with a `network` Connection type.
+* `databaseName` - (Required) The name of the Glue database to be synchronized.
+* `tables` - (Required) A list of catalog tables to be synchronized.
+* `eventQueueArn` - (Optional)  A valid Amazon SQS ARN.
+* `dlqEventQueueArn` - (Optional)  A valid Amazon SQS ARN.
+
+~> **Note:** `deletionBehavior` of catalog target doesn't support `deprecateInDatabase`.
+
+-> **Note:** `configuration` for catalog target crawlers will have `{ ... "Grouping": { "TableGroupingPolicy": "CombineCompatibleSchemas"} }` by default.
+
+### MongoDB Target
+
+* `connectionName` - (Required) The name of the connection to use to connect to the Amazon DocumentDB or MongoDB target.
+* `path` - (Required) The path of the Amazon DocumentDB or MongoDB target (database/collection).
+* `scanAll` - (Optional) Indicates whether to scan all the records, or to sample rows from the table. Scanning all the records can take a long time when the table is not a high throughput table. Default value is `true`.
+
+### Hudi Target
+
+* `connectionName` - (Optional) The name of the connection to use to connect to the Hudi target.
+* `paths` - (Required) One or more Amazon S3 paths that contains Hudi metadata folders as s3://bucket/prefix.
+* `exclusions` - (Optional) A list of glob patterns used to exclude from the crawl.
+* `maximumTraversalDepth` - (Required) The maximum depth of Amazon S3 paths that the crawler can traverse to discover the Hudi metadata folder in your Amazon S3 path. Used to limit the crawler run time. Valid values are between `1` and `20`.
+
+### Iceberg Target
+
+* `connectionName` - (Optional) The name of the connection to use to connect to the Iceberg target.
+* `paths` - (Required) One or more Amazon S3 paths that contains Iceberg metadata folders as s3://bucket/prefix.
+* `exclusions` - (Optional) A list of glob patterns used to exclude from the crawl.
+* `maximumTraversalDepth` - (Required) The maximum depth of Amazon S3 paths that the crawler can traverse to discover the Iceberg metadata folder in your Amazon S3 path. Used to limit the crawler run time. Valid values are between `1` and `20`.
+
+### Delta Target
+
+* `connectionName` - (Optional) The name of the connection to use to connect to the Delta table target.
+* `createNativeDeltaTable` (Optional) Specifies whether the crawler will create native tables, to allow integration with query engines that support querying of the Delta transaction log directly.
+* `deltaTables` - (Required) A list of the Amazon S3 paths to the Delta tables.
+* `writeManifest` - (Required) Specifies whether to write the manifest files to the Delta table path.
+
+### Schema Change Policy
+
+* `deleteBehavior` - (Optional) The deletion behavior when the crawler finds a deleted object. Valid values: `log`, `deleteFromDatabase`, or `deprecateInDatabase`. Defaults to `deprecateInDatabase`.
+* `updateBehavior` - (Optional) The update behavior when the crawler finds a changed schema. Valid values: `log` or `updateInDatabase`. Defaults to `updateInDatabase`.
+
+### Lake Formation Configuration
+
+* `accountId` - (Optional) Required for cross account crawls. For same account crawls as the target data, this can omitted.
+* `useLakeFormationCredentials` - (Optional) Specifies whether to use Lake Formation credentials for the crawler instead of the IAM role credentials.
+
+### Lineage Configuration
+
+* `crawlerLineageSettings` - (Optional) Specifies whether data lineage is enabled for the crawler. Valid values are: `enable` and `disable`. Default value is `disable`.
+
+### Recrawl Policy
+
+* `recrawlBehavior` - (Optional) Specifies whether to crawl the entire dataset again, crawl only folders that were added since the last crawler run, or crawl what S3 notifies the crawler of via SQS. Valid Values are: `crawlEventMode`, `crawlEverything` and `crawlNewFoldersOnly`. Default value is `crawlEverything`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Crawler name
+* `arn` - The ARN of the crawler
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Glue Crawlers using `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Glue Crawlers using `name`. For example:
+
+```console
+% terraform import aws_glue_crawler.MyJob MyJob
+```
+
+<!-- cache-key: cdktf-0.18.0 input-aa6aaa4c28c3da2b4a760961f15f17a04ceb8fb380ac8fce49211f1c27ef79ba -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/glue_data_catalog_encryption_settings.html.markdown b/website/docs/cdktf/typescript/r/glue_data_catalog_encryption_settings.html.markdown
new file mode 100644
index 00000000000..6bfdcf0d2a6
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/glue_data_catalog_encryption_settings.html.markdown
@@ -0,0 +1,96 @@
+---
+subcategory: "Glue"
+layout: "aws"
+page_title: "AWS: aws_glue_data_catalog_encryption_settings"
+description: |-
+  Provides a Glue Data Catalog Encryption Settings resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_glue_data_catalog_encryption_settings
+
+Provides a Glue Data Catalog Encryption Settings resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { GlueDataCatalogEncryptionSettings } from "./.gen/providers/aws/glue-data-catalog-encryption-settings";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new GlueDataCatalogEncryptionSettings(this, "example", {
+      dataCatalogEncryptionSettings: {
+        connectionPasswordEncryption: {
+          awsKmsKeyId: test.arn,
+          returnConnectionPasswordEncrypted: true,
+        },
+        encryptionAtRest: {
+          catalogEncryptionMode: "SSE-KMS",
+          sseAwsKmsKeyId: test.arn,
+        },
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `dataCatalogEncryptionSettings` – (Required) The security configuration to set. see [Data Catalog Encryption Settings](#data_catalog_encryption_settings).
+* `catalogId` – (Optional) The ID of the Data Catalog to set the security configuration for. If none is provided, the AWS account ID is used by default.
+
+### data_catalog_encryption_settings
+
+* `connectionPasswordEncryption` - (Required) When connection password protection is enabled, the Data Catalog uses a customer-provided key to encrypt the password as part of CreateConnection or UpdateConnection and store it in the ENCRYPTED_PASSWORD field in the connection properties. You can enable catalog encryption or only password encryption. see [Connection Password Encryption](#connection_password_encryption).
+* `encryptionAtRest` - (Required) Specifies the encryption-at-rest configuration for the Data Catalog. see [Encryption At Rest](#encryption_at_rest).
+
+### connection_password_encryption
+
+* `returnConnectionPasswordEncrypted` - (Required) When set to `true`, passwords remain encrypted in the responses of GetConnection and GetConnections. This encryption takes effect independently of the catalog encryption.
+* `awsKmsKeyId` - (Optional) A KMS key ARN that is used to encrypt the connection password. If connection password protection is enabled, the caller of CreateConnection and UpdateConnection needs at least `kms:encrypt` permission on the specified AWS KMS key, to encrypt passwords before storing them in the Data Catalog.
+
+### encryption_at_rest
+
+* `catalogEncryptionMode` - (Required) The encryption-at-rest mode for encrypting Data Catalog data. Valid values are `disabled` and `sseKms`.
+* `sseAwsKmsKeyId` - (Optional) The ARN of the AWS KMS key to use for encryption at rest.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the Data Catalog to set the security configuration for.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Glue Data Catalog Encryption Settings using `catalogId` (AWS account ID if not custom). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Glue Data Catalog Encryption Settings using `catalogId` (AWS account ID if not custom). For example:
+
+```console
+% terraform import aws_glue_data_catalog_encryption_settings.example 123456789012
+```
+
+<!-- cache-key: cdktf-0.18.0 input-c2e85f7ebdcf7cc062a847481555cf88d0fa1324f7ad5edd2567de866f418d1e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/glue_data_quality_ruleset.html.markdown b/website/docs/cdktf/typescript/r/glue_data_quality_ruleset.html.markdown
new file mode 100644
index 00000000000..7f3e6aca881
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/glue_data_quality_ruleset.html.markdown
@@ -0,0 +1,165 @@
+---
+subcategory: "Glue"
+layout: "aws"
+page_title: "AWS: aws_glue_data_quality_ruleset"
+description: |-
+  Provides a Glue Data Quality Ruleset.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_glue_data_quality_ruleset
+
+Provides a Glue Data Quality Ruleset Resource. You can refer to the [Glue Developer Guide](https://docs.aws.amazon.com/glue/latest/dg/glue-data-quality.html) for a full explanation of the Glue Data Quality Ruleset functionality
+
+## Example Usage
+
+### Basic
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { GlueDataQualityRuleset } from "./.gen/providers/aws/glue-data-quality-ruleset";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new GlueDataQualityRuleset(this, "example", {
+      name: "example",
+      ruleset: 'Rules = [Completeness \\"colA\\" between 0.4 and 0.8]',
+    });
+  }
+}
+
+```
+
+### With description
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { GlueDataQualityRuleset } from "./.gen/providers/aws/glue-data-quality-ruleset";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new GlueDataQualityRuleset(this, "example", {
+      description: "example",
+      name: "example",
+      ruleset: 'Rules = [Completeness \\"colA\\" between 0.4 and 0.8]',
+    });
+  }
+}
+
+```
+
+### With tags
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { GlueDataQualityRuleset } from "./.gen/providers/aws/glue-data-quality-ruleset";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new GlueDataQualityRuleset(this, "example", {
+      name: "example",
+      ruleset: 'Rules = [Completeness \\"colA\\" between 0.4 and 0.8]',
+      tags: {
+        hello: "world",
+      },
+    });
+  }
+}
+
+```
+
+### With target_table
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { GlueDataQualityRuleset } from "./.gen/providers/aws/glue-data-quality-ruleset";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new GlueDataQualityRuleset(this, "example", {
+      name: "example",
+      ruleset: 'Rules = [Completeness \\"colA\\" between 0.4 and 0.8]',
+      targetTable: {
+        databaseName: Token.asString(awsGlueCatalogDatabaseExample.name),
+        tableName: Token.asString(awsGlueCatalogTableExample.name),
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `description` - (Optional) Description of the data quality ruleset.
+* `name` - (Required, Forces new resource) Name of the data quality ruleset.
+* `ruleset` - (Optional) A Data Quality Definition Language (DQDL) ruleset. For more information, see the AWS Glue developer guide.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `targetTable` - (Optional, Forces new resource) A Configuration block specifying a target table associated with the data quality ruleset. See [`targetTable`](#target_table) below.
+
+### target_table
+
+* `catalogId` - (Optional, Forces new resource) The catalog id where the AWS Glue table exists.
+* `databaseName` - (Required, Forces new resource) Name of the database where the AWS Glue table exists.
+* `tableName` - (Required, Forces new resource) Name of the AWS Glue table.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Glue Data Quality Ruleset.
+* `createdOn` - The time and date that this data quality ruleset was created.
+* `lastModifiedOn` - The time and date that this data quality ruleset was created.
+* `recommendationRunId` - When a ruleset was created from a recommendation run, this run ID is generated to link the two together.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Glue Data Quality Ruleset using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Glue Data Quality Ruleset using the `name`. For example:
+
+```console
+% terraform import aws_glue_data_quality_ruleset.example exampleName
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1c73af64f9d424d885b65e53dcc6d2467ecb21df266c61f99fe72cab1b72c68d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/glue_dev_endpoint.html.markdown b/website/docs/cdktf/typescript/r/glue_dev_endpoint.html.markdown
new file mode 100644
index 00000000000..41772d47fa5
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/glue_dev_endpoint.html.markdown
@@ -0,0 +1,126 @@
+---
+subcategory: "Glue"
+layout: "aws"
+page_title: "AWS: aws_glue_dev_endpoint"
+description: |-
+  Provides a Glue Development Endpoint resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_glue_dev_endpoint
+
+Provides a Glue Development Endpoint resource.
+
+## Example Usage
+
+Basic usage:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { GlueDevEndpoint } from "./.gen/providers/aws/glue-dev-endpoint";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+import { IamRolePolicyAttachment } from "./.gen/providers/aws/iam-role-policy-attachment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new DataAwsIamPolicyDocument(this, "example", {
+      statement: [
+        {
+          actions: ["sts:AssumeRole"],
+          principals: [
+            {
+              identifiers: ["glue.amazonaws.com"],
+              type: "Service",
+            },
+          ],
+        },
+      ],
+    });
+    const awsIamRoleExample = new IamRole(this, "example_1", {
+      assumeRolePolicy: Token.asString(example.json),
+      name: "AWSGlueServiceRole-foo",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamRoleExample.overrideLogicalId("example");
+    new IamRolePolicyAttachment(this, "example-AWSGlueServiceRole", {
+      policyArn: "arn:aws:iam::aws:policy/service-role/AWSGlueServiceRole",
+      role: Token.asString(awsIamRoleExample.name),
+    });
+    const awsGlueDevEndpointExample = new GlueDevEndpoint(this, "example_3", {
+      name: "foo",
+      roleArn: Token.asString(awsIamRoleExample.arn),
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsGlueDevEndpointExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `arguments` - (Optional) A map of arguments used to configure the endpoint.
+* `extraJarsS3Path` - (Optional) Path to one or more Java Jars in an S3 bucket that should be loaded in this endpoint.
+* `extraPythonLibsS3Path` - (Optional) Path(s) to one or more Python libraries in an S3 bucket that should be loaded in this endpoint. Multiple values must be complete paths separated by a comma.
+* `glueVersion` - (Optional) -  Specifies the versions of Python and Apache Spark to use. Defaults to AWS Glue version 0.9.
+* `name` - (Required) The name of this endpoint. It must be unique in your account.
+* `numberOfNodes` - (Optional) The number of AWS Glue Data Processing Units (DPUs) to allocate to this endpoint. Conflicts with `workerType`.
+* `numberOfWorkers` - (Optional) The number of workers of a defined worker type that are allocated to this endpoint. This field is available only when you choose worker type G.1X or G.2X.
+* `publicKey` - (Optional) The public key to be used by this endpoint for authentication.
+* `publicKeys` - (Optional) A list of public keys to be used by this endpoint for authentication.
+* `roleArn` - (Required) The IAM role for this endpoint.
+* `securityConfiguration` - (Optional) The name of the Security Configuration structure to be used with this endpoint.
+* `securityGroupIds` - (Optional) Security group IDs for the security groups to be used by this endpoint.
+* `subnetId` - (Optional) The subnet ID for the new endpoint to use.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `workerType` - (Optional) The type of predefined worker that is allocated to this endpoint. Accepts a value of Standard, G.1X, or G.2X.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the endpoint.
+* `name` - The name of the new endpoint.
+* `privateAddress` - A private IP address to access the endpoint within a VPC, if this endpoint is created within one.
+* `publicAddress` - The public IP address used by this endpoint. The PublicAddress field is present only when you create a non-VPC endpoint.
+* `yarnEndpointAddress` - The YARN endpoint address used by this endpoint.
+* `zeppelinRemoteSparkInterpreterPort` - The Apache Zeppelin port for the remote Apache Spark interpreter.
+* `availabilityZone` - The AWS availability zone where this endpoint is located.
+* `vpcId` - he ID of the VPC used by this endpoint.
+* `status` - The current status of this endpoint.
+* `failureReason` - The reason for a current failure in this endpoint.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import a Glue Development Endpoint using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import a Glue Development Endpoint using the `name`. For example:
+
+```console
+% terraform import aws_glue_dev_endpoint.example foo
+```
+
+<!-- cache-key: cdktf-0.18.0 input-59223466494b9a1666a02d2c293b3450a6518da65a3ffe2d8e998ffd375782a6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/glue_dev_endpoint.markdown b/website/docs/cdktf/typescript/r/glue_dev_endpoint.markdown
new file mode 100644
index 00000000000..41772d47fa5
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/glue_dev_endpoint.markdown
@@ -0,0 +1,126 @@
+---
+subcategory: "Glue"
+layout: "aws"
+page_title: "AWS: aws_glue_dev_endpoint"
+description: |-
+  Provides a Glue Development Endpoint resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_glue_dev_endpoint
+
+Provides a Glue Development Endpoint resource.
+
+## Example Usage
+
+Basic usage:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { GlueDevEndpoint } from "./.gen/providers/aws/glue-dev-endpoint";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+import { IamRolePolicyAttachment } from "./.gen/providers/aws/iam-role-policy-attachment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new DataAwsIamPolicyDocument(this, "example", {
+      statement: [
+        {
+          actions: ["sts:AssumeRole"],
+          principals: [
+            {
+              identifiers: ["glue.amazonaws.com"],
+              type: "Service",
+            },
+          ],
+        },
+      ],
+    });
+    const awsIamRoleExample = new IamRole(this, "example_1", {
+      assumeRolePolicy: Token.asString(example.json),
+      name: "AWSGlueServiceRole-foo",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamRoleExample.overrideLogicalId("example");
+    new IamRolePolicyAttachment(this, "example-AWSGlueServiceRole", {
+      policyArn: "arn:aws:iam::aws:policy/service-role/AWSGlueServiceRole",
+      role: Token.asString(awsIamRoleExample.name),
+    });
+    const awsGlueDevEndpointExample = new GlueDevEndpoint(this, "example_3", {
+      name: "foo",
+      roleArn: Token.asString(awsIamRoleExample.arn),
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsGlueDevEndpointExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `arguments` - (Optional) A map of arguments used to configure the endpoint.
+* `extraJarsS3Path` - (Optional) Path to one or more Java Jars in an S3 bucket that should be loaded in this endpoint.
+* `extraPythonLibsS3Path` - (Optional) Path(s) to one or more Python libraries in an S3 bucket that should be loaded in this endpoint. Multiple values must be complete paths separated by a comma.
+* `glueVersion` - (Optional) -  Specifies the versions of Python and Apache Spark to use. Defaults to AWS Glue version 0.9.
+* `name` - (Required) The name of this endpoint. It must be unique in your account.
+* `numberOfNodes` - (Optional) The number of AWS Glue Data Processing Units (DPUs) to allocate to this endpoint. Conflicts with `workerType`.
+* `numberOfWorkers` - (Optional) The number of workers of a defined worker type that are allocated to this endpoint. This field is available only when you choose worker type G.1X or G.2X.
+* `publicKey` - (Optional) The public key to be used by this endpoint for authentication.
+* `publicKeys` - (Optional) A list of public keys to be used by this endpoint for authentication.
+* `roleArn` - (Required) The IAM role for this endpoint.
+* `securityConfiguration` - (Optional) The name of the Security Configuration structure to be used with this endpoint.
+* `securityGroupIds` - (Optional) Security group IDs for the security groups to be used by this endpoint.
+* `subnetId` - (Optional) The subnet ID for the new endpoint to use.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `workerType` - (Optional) The type of predefined worker that is allocated to this endpoint. Accepts a value of Standard, G.1X, or G.2X.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the endpoint.
+* `name` - The name of the new endpoint.
+* `privateAddress` - A private IP address to access the endpoint within a VPC, if this endpoint is created within one.
+* `publicAddress` - The public IP address used by this endpoint. The PublicAddress field is present only when you create a non-VPC endpoint.
+* `yarnEndpointAddress` - The YARN endpoint address used by this endpoint.
+* `zeppelinRemoteSparkInterpreterPort` - The Apache Zeppelin port for the remote Apache Spark interpreter.
+* `availabilityZone` - The AWS availability zone where this endpoint is located.
+* `vpcId` - he ID of the VPC used by this endpoint.
+* `status` - The current status of this endpoint.
+* `failureReason` - The reason for a current failure in this endpoint.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import a Glue Development Endpoint using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import a Glue Development Endpoint using the `name`. For example:
+
+```console
+% terraform import aws_glue_dev_endpoint.example foo
+```
+
+<!-- cache-key: cdktf-0.18.0 input-59223466494b9a1666a02d2c293b3450a6518da65a3ffe2d8e998ffd375782a6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/glue_job.html.markdown b/website/docs/cdktf/typescript/r/glue_job.html.markdown
new file mode 100644
index 00000000000..df82906ff52
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/glue_job.html.markdown
@@ -0,0 +1,249 @@
+---
+subcategory: "Glue"
+layout: "aws"
+page_title: "AWS: aws_glue_job"
+description: |-
+  Provides an Glue Job resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_glue_job
+
+Provides a Glue Job resource.
+
+-> Glue functionality, such as monitoring and logging of jobs, is typically managed with the `defaultArguments` argument. See the [Special Parameters Used by AWS Glue](https://docs.aws.amazon.com/glue/latest/dg/aws-glue-programming-etl-glue-arguments.html) topic in the Glue developer guide for additional information.
+
+## Example Usage
+
+### Python Job
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { GlueJob } from "./.gen/providers/aws/glue-job";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new GlueJob(this, "example", {
+      command: {
+        scriptLocation: "s3://${" + awsS3BucketExample.bucket + "}/example.py",
+      },
+      name: "example",
+      roleArn: Token.asString(awsIamRoleExample.arn),
+    });
+  }
+}
+
+```
+
+### Ray Job
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { GlueJob } from "./.gen/providers/aws/glue-job";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new GlueJob(this, "example", {
+      command: {
+        name: "glueray",
+        pythonVersion: "3.9",
+        runtime: "Ray2.4",
+        scriptLocation: "s3://${" + awsS3BucketExample.bucket + "}/example.py",
+      },
+      glueVersion: "4.0",
+      name: "example",
+      roleArn: Token.asString(awsIamRoleExample.arn),
+      workerType: "Z.2X",
+    });
+  }
+}
+
+```
+
+### Scala Job
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { GlueJob } from "./.gen/providers/aws/glue-job";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new GlueJob(this, "example", {
+      command: {
+        scriptLocation:
+          "s3://${" + awsS3BucketExample.bucket + "}/example.scala",
+      },
+      defaultArguments: {
+        "--job-language": "scala",
+      },
+      name: "example",
+      roleArn: Token.asString(awsIamRoleExample.arn),
+    });
+  }
+}
+
+```
+
+### Streaming Job
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { GlueJob } from "./.gen/providers/aws/glue-job";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new GlueJob(this, "example", {
+      command: {
+        name: "gluestreaming",
+        scriptLocation:
+          "s3://${" + awsS3BucketExample.bucket + "}/example.script",
+      },
+      name: "example streaming job",
+      roleArn: Token.asString(awsIamRoleExample.arn),
+    });
+  }
+}
+
+```
+
+### Enabling CloudWatch Logs and Metrics
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudwatchLogGroup } from "./.gen/providers/aws/cloudwatch-log-group";
+import { GlueJob } from "./.gen/providers/aws/glue-job";
+interface MyConfig {
+  command: any;
+  name: any;
+  roleArn: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    const example = new CloudwatchLogGroup(this, "example", {
+      name: "example",
+      retentionInDays: 14,
+    });
+    const awsGlueJobExample = new GlueJob(this, "example_1", {
+      defaultArguments: {
+        "--continuous-log-logGroup": example.name,
+        "--enable-continuous-cloudwatch-log": "true",
+        "--enable-continuous-log-filter": "true",
+        "--enable-metrics": "",
+      },
+      command: config.command,
+      name: config.name,
+      roleArn: config.roleArn,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsGlueJobExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `command` – (Required) The command of the job. Defined below.
+* `connections` – (Optional) The list of connections used for this job.
+* `defaultArguments` – (Optional) The map of default arguments for this job. You can specify arguments here that your own job-execution script consumes, as well as arguments that AWS Glue itself consumes. For information about how to specify and consume your own Job arguments, see the [Calling AWS Glue APIs in Python](http://docs.aws.amazon.com/glue/latest/dg/aws-glue-programming-python-calling.html) topic in the developer guide. For information about the key-value pairs that AWS Glue consumes to set up your job, see the [Special Parameters Used by AWS Glue](http://docs.aws.amazon.com/glue/latest/dg/aws-glue-programming-python-glue-arguments.html) topic in the developer guide.
+* `nonOverridableArguments` – (Optional) Non-overridable arguments for this job, specified as name-value pairs.
+* `description` – (Optional) Description of the job.
+* `executionProperty` – (Optional) Execution property of the job. Defined below.
+* `glueVersion` - (Optional) The version of glue to use, for example "1.0". Ray jobs should set this to 4.0 or greater. For information about available versions, see the [AWS Glue Release Notes](https://docs.aws.amazon.com/glue/latest/dg/release-notes.html).
+* `executionClass` - (Optional) Indicates whether the job is run with a standard or flexible execution class. The standard execution class is ideal for time-sensitive workloads that require fast job startup and dedicated resources. Valid value: `flex`, `standard`.
+* `maxCapacity` – (Optional) The maximum number of AWS Glue data processing units (DPUs) that can be allocated when this job runs. `required` when `pythonshell` is set, accept either `00625` or `10`. Use `numberOfWorkers` and `workerType` arguments instead with `glueVersion` `20` and above.
+* `maxRetries` – (Optional) The maximum number of times to retry this job if it fails.
+* `name` – (Required) The name you assign to this job. It must be unique in your account.
+* `notificationProperty` - (Optional) Notification property of the job. Defined below.
+* `roleArn` – (Required) The ARN of the IAM role associated with this job.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `timeout` – (Optional) The job timeout in minutes. The default is 2880 minutes (48 hours) for `glueetl` and `pythonshell` jobs, and null (unlimited) for `gluestreaming` jobs.
+* `securityConfiguration` - (Optional) The name of the Security Configuration to be associated with the job.
+* `workerType` - (Optional) The type of predefined worker that is allocated when a job runs. Accepts a value of Standard, G.1X, G.2X, or G.025X for Spark jobs. Accepts the value Z.2X for Ray jobs.
+    * For the Standard worker type, each worker provides 4 vCPU, 16 GB of memory and a 50GB disk, and 2 executors per worker.
+    * For the G.1X worker type, each worker maps to 1 DPU (4 vCPU, 16 GB of memory, 64 GB disk), and provides 1 executor per worker. Recommended for memory-intensive jobs.
+    * For the G.2X worker type, each worker maps to 2 DPU (8 vCPU, 32 GB of memory, 128 GB disk), and provides 1 executor per worker. Recommended for memory-intensive jobs.
+    * For the G.025X worker type, each worker maps to 0.25 DPU (2 vCPU, 4GB of memory, 64 GB disk), and provides 1 executor per worker. Recommended for low volume streaming jobs. Only available for Glue version 3.0.
+    * For the Z.2X worker type, each worker maps to 2 M-DPU (8vCPU, 64 GB of m emory, 128 GB disk), and provides up to 8 Ray workers based on the autoscaler.
+* `numberOfWorkers` - (Optional) The number of workers of a defined workerType that are allocated when a job runs.
+
+### command Argument Reference
+
+* `name` - (Optional) The name of the job command. Defaults to `glueetl`. Use `pythonshell` for Python Shell Job Type, `glueray` for Ray Job Type, or `gluestreaming` for Streaming Job Type. `maxCapacity` needs to be set if `pythonshell` is chosen.
+* `scriptLocation` - (Required) Specifies the S3 path to a script that executes a job.
+* `pythonVersion` - (Optional) The Python version being used to execute a Python shell job. Allowed values are 2, 3 or 3.9. Version 3 refers to Python 3.6.
+* `runtime` - (Optional) In Ray jobs, runtime is used to specify the versions of Ray, Python and additional libraries available in your environment. This field is not used in other job types. For supported runtime environment values, see [Working with Ray jobs](https://docs.aws.amazon.com/glue/latest/dg/ray-jobs-section.html#author-job-ray-runtimes) in the Glue Developer Guide.
+
+### execution_property Argument Reference
+
+* `maxConcurrentRuns` - (Optional) The maximum number of concurrent runs allowed for a job. The default is 1.
+
+### notification_property Argument Reference
+
+* `notifyDelayAfter` - (Optional) After a job run starts, the number of minutes to wait before sending a job run delay notification.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of Glue Job
+* `id` - Job name
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Glue Jobs using `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Glue Jobs using `name`. For example:
+
+```console
+% terraform import aws_glue_job.MyJob MyJob
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ac5c52bfdcb19605598f998f548ee765f8ef650d5dfdb2f5a9674b5f4c2f9ae2 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/glue_ml_transform.html.markdown b/website/docs/cdktf/typescript/r/glue_ml_transform.html.markdown
new file mode 100644
index 00000000000..3c5fa496028
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/glue_ml_transform.html.markdown
@@ -0,0 +1,202 @@
+---
+subcategory: "Glue"
+layout: "aws"
+page_title: "AWS: aws_glue_ml_transform"
+description: |-
+  Provides a Glue ML Transform resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_glue_ml_transform
+
+Provides a Glue ML Transform resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { GlueCatalogDatabase } from "./.gen/providers/aws/glue-catalog-database";
+import { GlueCatalogTable } from "./.gen/providers/aws/glue-catalog-table";
+import { GlueMlTransform } from "./.gen/providers/aws/glue-ml-transform";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const test = new GlueCatalogDatabase(this, "test", {
+      name: "example",
+    });
+    const awsGlueCatalogTableTest = new GlueCatalogTable(this, "test_1", {
+      databaseName: test.name,
+      name: "example",
+      owner: "my_owner",
+      parameters: {
+        param1: "param1_val",
+      },
+      partitionKeys: [
+        {
+          comment: "my_column_1_comment",
+          name: "my_column_1",
+          type: "int",
+        },
+        {
+          comment: "my_column_2_comment",
+          name: "my_column_2",
+          type: "string",
+        },
+      ],
+      retention: 1,
+      storageDescriptor: {
+        bucketColumns: ["bucket_column_1"],
+        columns: [
+          {
+            comment: "my_column1_comment",
+            name: "my_column_1",
+            type: "int",
+          },
+          {
+            comment: "my_column2_comment",
+            name: "my_column_2",
+            type: "string",
+          },
+        ],
+        compressed: false,
+        inputFormat: "SequenceFileInputFormat",
+        location: "my_location",
+        numberOfBuckets: 1,
+        outputFormat: "SequenceFileInputFormat",
+        parameters: {
+          param1: "param1_val",
+        },
+        serDeInfo: {
+          name: "ser_de_name",
+          parameters: {
+            param1: "param_val_1",
+          },
+          serializationLibrary:
+            "org.apache.hadoop.hive.serde2.columnar.ColumnarSerDe",
+        },
+        skewedInfo: {
+          skewedColumnNames: ["my_column_1"],
+          skewedColumnValueLocationMaps: {
+            my_column_1: "my_column_1_val_loc_map",
+          },
+          skewedColumnValues: ["skewed_val_1"],
+        },
+        sortColumns: [
+          {
+            column: "my_column_1",
+            sortOrder: 1,
+          },
+        ],
+        storedAsSubDirectories: false,
+      },
+      tableType: "VIRTUAL_VIEW",
+      viewExpandedText: "view_expanded_text_1",
+      viewOriginalText: "view_original_text_1",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsGlueCatalogTableTest.overrideLogicalId("test");
+    const awsGlueMlTransformTest = new GlueMlTransform(this, "test_2", {
+      dependsOn: [awsIamRolePolicyAttachmentTest],
+      inputRecordTables: [
+        {
+          databaseName: Token.asString(awsGlueCatalogTableTest.databaseName),
+          tableName: Token.asString(awsGlueCatalogTableTest.name),
+        },
+      ],
+      name: "example",
+      parameters: {
+        findMatchesParameters: {
+          primaryKeyColumnName: "my_column_1",
+        },
+        transformType: "FIND_MATCHES",
+      },
+      roleArn: Token.asString(awsIamRoleTest.arn),
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsGlueMlTransformTest.overrideLogicalId("test");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` – (Required) The name you assign to this ML Transform. It must be unique in your account.
+* `inputRecordTables` - (Required)  A list of AWS Glue table definitions used by the transform. see [Input Record Tables](#input_record_tables).
+* `parameters` - (Required) The algorithmic parameters that are specific to the transform type used. Conditionally dependent on the transform type. see [Parameters](#parameters).
+* `roleArn` – (Required) The ARN of the IAM role associated with this ML Transform.
+* `description` – (Optional) Description of the ML Transform.
+* `glueVersion` - (Optional) The version of glue to use, for example "1.0". For information about available versions, see the [AWS Glue Release Notes](https://docs.aws.amazon.com/glue/latest/dg/release-notes.html).
+* `maxCapacity` – (Optional) The number of AWS Glue data processing units (DPUs) that are allocated to task runs for this transform. You can allocate from `2` to `100` DPUs; the default is `10`. `maxCapacity` is a mutually exclusive option with `numberOfWorkers` and `workerType`.
+* `maxRetries` – (Optional) The maximum number of times to retry this ML Transform if it fails.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `timeout` – (Optional) The ML Transform timeout in minutes. The default is 2880 minutes (48 hours).
+* `workerType` - (Optional) The type of predefined worker that is allocated when an ML Transform runs. Accepts a value of `standard`, `g1X`, or `g2X`. Required with `numberOfWorkers`.
+* `numberOfWorkers` - (Optional) The number of workers of a defined `workerType` that are allocated when an ML Transform runs. Required with `workerType`.
+
+### input_record_tables
+
+* `databaseName` - (Required) A database name in the AWS Glue Data Catalog.
+* `tableName` - (Required) A table name in the AWS Glue Data Catalog.
+* `catalogId` - (Optional) A unique identifier for the AWS Glue Data Catalog.
+* `connectionName`- (Optional) The name of the connection to the AWS Glue Data Catalog.
+
+### parameters
+
+* `transformType` - (Required) The type of machine learning transform. For information about the types of machine learning transforms, see [Creating Machine Learning Transforms](http://docs.aws.amazon.com/glue/latest/dg/add-job-machine-learning-transform.html).
+* `findMatchesParameters` - (Required) The parameters for the find matches algorithm. see [Find Matches Parameters](#find_matches_parameters).
+
+#### find_matches_parameters
+
+* `accuracyCostTradeOff` - (Optional) The value that is selected when tuning your transform for a balance between accuracy and cost.
+* `enforceProvidedLabels` - (Optional) The value to switch on or off to force the output to match the provided labels from users.
+* `precisionRecallTradeOff` - (Optional) The value selected when tuning your transform for a balance between precision and recall.
+* `primaryKeyColumnName` - (Optional) The name of a column that uniquely identifies rows in the source table.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of Glue ML Transform.
+* `id` - Glue ML Transform ID.
+* `labelCount` - The number of labels available for this transform.
+* `schema` - The object that represents the schema that this transform accepts. see [Schema](#schema).
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+### schema
+
+* `name` - The name of the column.
+* `dataType` - The type of data in the column.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Glue ML Transforms using `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Glue ML Transforms using `id`. For example:
+
+```console
+% terraform import aws_glue_ml_transform.example tfm-c2cafbe83b1c575f49eaca9939220e2fcd58e2d5
+```
+
+<!-- cache-key: cdktf-0.18.0 input-295ef64caa0ed9cd96476b3d72c04967e7f94dc142182bf5b2175f9cde26f649 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/glue_partition.html.markdown b/website/docs/cdktf/typescript/r/glue_partition.html.markdown
new file mode 100644
index 00000000000..691113fa347
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/glue_partition.html.markdown
@@ -0,0 +1,122 @@
+---
+subcategory: "Glue"
+layout: "aws"
+page_title: "AWS: aws_glue_partition"
+description: |-
+  Provides a Glue Partition.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_glue_partition
+
+Provides a Glue Partition Resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { GluePartition } from "./.gen/providers/aws/glue-partition";
+interface MyConfig {
+  partitionValues: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new GluePartition(this, "example", {
+      databaseName: "some-database",
+      tableName: "some-table",
+      values: ["some-value"],
+      partitionValues: config.partitionValues,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `databaseName` - (Required) Name of the metadata database where the table metadata resides. For Hive compatibility, this must be all lowercase.
+* `partitionValues` - (Required) The values that define the partition.
+* `catalogId` - (Optional) ID of the Glue Catalog and database to create the table in. If omitted, this defaults to the AWS Account ID plus the database name.
+* `storageDescriptor` - (Optional) A [storage descriptor](#storage_descriptor) object containing information about the physical storage of this table. You can refer to the [Glue Developer Guide](https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-tables.html#aws-glue-api-catalog-tables-StorageDescriptor) for a full explanation of this object.
+* `parameters` - (Optional) Properties associated with this table, as a list of key-value pairs.
+
+##### storage_descriptor
+
+* `columns` - (Optional) A list of the [Columns](#column) in the table.
+* `location` - (Optional) The physical location of the table. By default this takes the form of the warehouse location, followed by the database location in the warehouse, followed by the table name.
+* `inputFormat` - (Optional) The input format: SequenceFileInputFormat (binary), or TextInputFormat, or a custom format.
+* `outputFormat` - (Optional) The output format: SequenceFileOutputFormat (binary), or IgnoreKeyTextOutputFormat, or a custom format.
+* `compressed` - (Optional) True if the data in the table is compressed, or False if not.
+* `numberOfBuckets` - (Optional) Must be specified if the table contains any dimension columns.
+* `serDeInfo` - (Optional) [Serialization/deserialization (SerDe)](#ser_de_info) information.
+* `bucketColumns` - (Optional) A list of reducer grouping columns, clustering columns, and bucketing columns in the table.
+* `sortColumns` - (Optional) A list of [Order](#sort_columns) objects specifying the sort order of each bucket in the table.
+* `parameters` - (Optional) User-supplied properties in key-value form.
+* `skewedInfo` - (Optional) Information about values that appear very frequently in a column (skewed values).
+* `storedAsSubDirectories` - (Optional) True if the table data is stored in subdirectories, or False if not.
+
+##### column
+
+* `name` - (Required) The name of the Column.
+* `type` - (Optional) The datatype of data in the Column.
+* `comment` - (Optional) Free-form text comment.
+
+##### ser_de_info
+
+* `name` - (Optional) Name of the SerDe.
+* `parameters` - (Optional) A map of initialization parameters for the SerDe, in key-value form.
+* `serializationLibrary` - (Optional) Usually the class that implements the SerDe. An example is: org.apache.hadoop.hive.serde2.columnar.ColumnarSerDe.
+
+##### sort_columns
+
+* `column` - (Required) The name of the column.
+* `sortOrder` - (Required) Indicates that the column is sorted in ascending order (== 1), or in descending order (==0).
+
+##### skewed_info
+
+* `skewedColumnNames` - (Optional) A list of names of columns that contain skewed values.
+* `skewedColumnValueLocationMaps` - (Optional) A list of values that appear so frequently as to be considered skewed.
+* `skewedColumnValues` - (Optional) A map of skewed values to the columns that contain them.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - partition id.
+* `creationTime` - The time at which the partition was created.
+* `lastAnalyzedTime` - The last time at which column statistics were computed for this partition.
+* `lastAccessedTime` - The last time at which the partition was accessed.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Glue Partitions using the catalog ID (usually AWS account ID), database name, table name and partition values. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Glue Partitions using the catalog ID (usually AWS account ID), database name, table name and partition values. For example:
+
+```console
+% terraform import aws_glue_partition.part 123456789012:MyDatabase:MyTable:val1#val2
+```
+
+<!-- cache-key: cdktf-0.18.0 input-82eb5064cb5a885033f5995b599111156aaf6ca6d5bd48324fd36f1a445015f1 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/glue_partition_index.html.markdown b/website/docs/cdktf/typescript/r/glue_partition_index.html.markdown
new file mode 100644
index 00000000000..fcf934622f9
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/glue_partition_index.html.markdown
@@ -0,0 +1,171 @@
+---
+subcategory: "Glue"
+layout: "aws"
+page_title: "AWS: aws_glue_partition_index"
+description: |-
+  Provides a Glue Partition Index.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_glue_partition_index
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { GlueCatalogDatabase } from "./.gen/providers/aws/glue-catalog-database";
+import { GlueCatalogTable } from "./.gen/providers/aws/glue-catalog-table";
+import { GluePartitionIndex } from "./.gen/providers/aws/glue-partition-index";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new GlueCatalogDatabase(this, "example", {
+      name: "example",
+    });
+    const awsGlueCatalogTableExample = new GlueCatalogTable(this, "example_1", {
+      databaseName: example.name,
+      name: "example",
+      owner: "my_owner",
+      parameters: {
+        param1: "param1_val",
+      },
+      partitionKeys: [
+        {
+          comment: "my_column_1_comment",
+          name: "my_column_1",
+          type: "int",
+        },
+        {
+          comment: "my_column_2_comment",
+          name: "my_column_2",
+          type: "string",
+        },
+      ],
+      retention: 1,
+      storageDescriptor: {
+        bucketColumns: ["bucket_column_1"],
+        columns: [
+          {
+            comment: "my_column1_comment",
+            name: "my_column_1",
+            type: "int",
+          },
+          {
+            comment: "my_column2_comment",
+            name: "my_column_2",
+            type: "string",
+          },
+        ],
+        compressed: false,
+        inputFormat: "SequenceFileInputFormat",
+        location: "my_location",
+        numberOfBuckets: 1,
+        outputFormat: "SequenceFileInputFormat",
+        parameters: {
+          param1: "param1_val",
+        },
+        serDeInfo: {
+          name: "ser_de_name",
+          parameters: {
+            param1: "param_val_1",
+          },
+          serializationLibrary:
+            "org.apache.hadoop.hive.serde2.columnar.ColumnarSerDe",
+        },
+        skewedInfo: {
+          skewedColumnNames: ["my_column_1"],
+          skewedColumnValueLocationMaps: {
+            my_column_1: "my_column_1_val_loc_map",
+          },
+          skewedColumnValues: ["skewed_val_1"],
+        },
+        sortColumns: [
+          {
+            column: "my_column_1",
+            sortOrder: 1,
+          },
+        ],
+        storedAsSubDirectories: false,
+      },
+      tableType: "VIRTUAL_VIEW",
+      viewExpandedText: "view_expanded_text_1",
+      viewOriginalText: "view_original_text_1",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsGlueCatalogTableExample.overrideLogicalId("example");
+    const awsGluePartitionIndexExample = new GluePartitionIndex(
+      this,
+      "example_2",
+      {
+        databaseName: example.name,
+        partitionIndex: {
+          indexName: "example",
+          keys: ["my_column_1", "my_column_2"],
+        },
+        tableName: Token.asString(awsGlueCatalogTableExample.name),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsGluePartitionIndexExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `tableName` - (Required) Name of the table. For Hive compatibility, this must be entirely lowercase.
+* `databaseName` - (Required) Name of the metadata database where the table metadata resides. For Hive compatibility, this must be all lowercase.
+* `partitionIndex` - (Required) Configuration block for a partition index. See [`partitionIndex`](#partition_index) below.
+* `catalogId` - (Optional) The catalog ID where the table resides.
+
+### partition_index
+
+* `indexName` - (Required) Name of the partition index.
+* `keys` - (Required) Keys for the partition index.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Catalog ID, Database name, table name, and index name.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `10M`)
+* `delete` - (Default `10M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Glue Partition Indexes using the catalog ID (usually AWS account ID), database name, table name, and index name. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Glue Partition Indexes using the catalog ID (usually AWS account ID), database name, table name, and index name. For example:
+
+```console
+% terraform import aws_glue_partition_index.example 123456789012:MyDatabase:MyTable:index-name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-2c1eca414462f36b306c6c36d0f8b45e95a67975829b6e6678f2b74c1376628b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/glue_registry.html.markdown b/website/docs/cdktf/typescript/r/glue_registry.html.markdown
new file mode 100644
index 00000000000..35cff811eb1
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/glue_registry.html.markdown
@@ -0,0 +1,75 @@
+---
+subcategory: "Glue"
+layout: "aws"
+page_title: "AWS: aws_glue_registry"
+description: |-
+  Provides a Glue Registry resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_glue_registry
+
+Provides a Glue Registry resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { GlueRegistry } from "./.gen/providers/aws/glue-registry";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new GlueRegistry(this, "example", {
+      registryName: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `registryName` – (Required) The Name of the registry.
+* `description` – (Optional) A description of the registry.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of Glue Registry.
+* `id` - Amazon Resource Name (ARN) of Glue Registry.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Glue Registries using `arn`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Glue Registries using `arn`. For example:
+
+```console
+% terraform import aws_glue_registry.example arn:aws:glue:us-west-2:123456789012:registry/example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ca7291533ababa19fd90f315f11beb8ec44905df2527d1937679132938c2cddd -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/glue_resource_policy.html.markdown b/website/docs/cdktf/typescript/r/glue_resource_policy.html.markdown
new file mode 100644
index 00000000000..32ab2228094
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/glue_resource_policy.html.markdown
@@ -0,0 +1,107 @@
+---
+subcategory: "Glue"
+layout: "aws"
+page_title: "AWS: aws_glue_resource_policy"
+description: |-
+  Provides a resource to configure the aws glue resource policy.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_glue_resource_policy
+
+Provides a Glue resource policy. Only one can exist per region.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCallerIdentity } from "./.gen/providers/aws/data-aws-caller-identity";
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { DataAwsPartition } from "./.gen/providers/aws/data-aws-partition";
+import { DataAwsRegion } from "./.gen/providers/aws/data-aws-region";
+import { GlueResourcePolicy } from "./.gen/providers/aws/glue-resource-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const current = new DataAwsCallerIdentity(this, "current", {});
+    const dataAwsPartitionCurrent = new DataAwsPartition(this, "current_1", {});
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsPartitionCurrent.overrideLogicalId("current");
+    const dataAwsRegionCurrent = new DataAwsRegion(this, "current_2", {});
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsRegionCurrent.overrideLogicalId("current");
+    const glueExamplePolicy = new DataAwsIamPolicyDocument(
+      this,
+      "glue-example-policy",
+      {
+        statement: [
+          {
+            actions: ["glue:CreateTable"],
+            principals: [
+              {
+                identifiers: ["*"],
+                type: "AWS",
+              },
+            ],
+            resources: [
+              "arn:${" +
+                dataAwsPartitionCurrent.partition +
+                "}:glue:${" +
+                dataAwsRegionCurrent.name +
+                "}:${" +
+                current.accountId +
+                "}:*",
+            ],
+          },
+        ],
+      }
+    );
+    new GlueResourcePolicy(this, "example", {
+      policy: Token.asString(glueExamplePolicy.json),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `policy` – (Required) The policy to be applied to the aws glue data catalog.
+* `enableHybrid` - (Optional) Indicates that you are using both methods to grant cross-account. Valid values are `true` and `false`. Note the terraform will not perform drift detetction on this field as its not return on read.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Glue Resource Policy using the account ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Glue Resource Policy using the account ID. For example:
+
+```console
+% terraform import aws_glue_resource_policy.Test 12356789012
+```
+
+<!-- cache-key: cdktf-0.18.0 input-505ce1c4e38c338e6ee96c4f345643e93eb421593db3b74a6669f3f253de8617 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/glue_schema.html.markdown b/website/docs/cdktf/typescript/r/glue_schema.html.markdown
new file mode 100644
index 00000000000..354051a1355
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/glue_schema.html.markdown
@@ -0,0 +1,88 @@
+---
+subcategory: "Glue"
+layout: "aws"
+page_title: "AWS: aws_glue_schema"
+description: |-
+  Provides a Glue Schema resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_glue_schema
+
+Provides a Glue Schema resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { GlueSchema } from "./.gen/providers/aws/glue-schema";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new GlueSchema(this, "example", {
+      compatibility: "NONE",
+      dataFormat: "AVRO",
+      registryArn: test.arn,
+      schemaDefinition:
+        '{\\"type\\": \\"record\\", \\"name\\": \\"r1\\", \\"fields\\": [ {\\"name\\": \\"f1\\", \\"type\\": \\"int\\"}, {\\"name\\": \\"f2\\", \\"type\\": \\"string\\"} ]}',
+      schemaName: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `schemaName` – (Required) The Name of the schema.
+* `registryArn` - (Required) The ARN of the Glue Registry to create the schema in.
+* `dataFormat` - (Required) The data format of the schema definition. Valid values are `avro`, `json` and `protobuf`.
+* `compatibility` - (Required) The compatibility mode of the schema. Values values are: `none`, `disabled`, `backward`, `backwardAll`, `forward`, `forwardAll`, `full`, and `fullAll`.
+* `schemaDefinition` - (Required) The schema definition using the `dataFormat` setting for `schemaName`.
+* `description` – (Optional) A description of the schema.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the schema.
+* `id` - Amazon Resource Name (ARN) of the schema.
+* `registryName` - The name of the Glue Registry.
+* `latestSchemaVersion` - The latest version of the schema associated with the returned schema definition.
+* `nextSchemaVersion` - The next version of the schema associated with the returned schema definition.
+* `schemaCheckpoint` - The version number of the checkpoint (the last time the compatibility mode was changed).
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Glue Registries using `arn`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Glue Registries using `arn`. For example:
+
+```console
+% terraform import aws_glue_schema.example arn:aws:glue:us-west-2:123456789012:schema/example/example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-07d8be72b0ef5ec7a36f90bf89a090da4b36963b4802cf618422290e600eac94 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/glue_security_configuration.html.markdown b/website/docs/cdktf/typescript/r/glue_security_configuration.html.markdown
new file mode 100644
index 00000000000..495cc08ffd3
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/glue_security_configuration.html.markdown
@@ -0,0 +1,105 @@
+---
+subcategory: "Glue"
+layout: "aws"
+page_title: "AWS: aws_glue_security_configuration"
+description: |-
+  Manages a Glue Security Configuration
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_glue_security_configuration
+
+Manages a Glue Security Configuration.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { GlueSecurityConfiguration } from "./.gen/providers/aws/glue-security-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new GlueSecurityConfiguration(this, "example", {
+      encryptionConfiguration: {
+        cloudwatchEncryption: {
+          cloudwatchEncryptionMode: "DISABLED",
+        },
+        jobBookmarksEncryption: {
+          jobBookmarksEncryptionMode: "DISABLED",
+        },
+        s3Encryption: {
+          kmsKeyArn: Token.asString(dataAwsKmsKeyExample.arn),
+          s3EncryptionMode: "SSE-KMS",
+        },
+      },
+      name: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `encryptionConfiguration` – (Required) Configuration block containing encryption configuration. Detailed below.
+* `name` – (Required) Name of the security configuration.
+
+### encryption_configuration Argument Reference
+
+* `cloudwatch_encryption ` - (Required) A `cloudwatch_encryption ` block as described below, which contains encryption configuration for CloudWatch.
+* `job_bookmarks_encryption ` - (Required) A `job_bookmarks_encryption ` block as described below, which contains encryption configuration for job bookmarks.
+* `s3Encryption` - (Required) A `s3_encryption ` block as described below, which contains encryption configuration for S3 data.
+
+#### cloudwatch_encryption Argument Reference
+
+* `cloudwatchEncryptionMode` - (Optional) Encryption mode to use for CloudWatch data. Valid values: `disabled`, `sseKms`. Default value: `disabled`.
+* `kmsKeyArn` - (Optional) Amazon Resource Name (ARN) of the KMS key to be used to encrypt the data.
+
+#### job_bookmarks_encryption Argument Reference
+
+* `jobBookmarksEncryptionMode` - (Optional) Encryption mode to use for job bookmarks data. Valid values: `cseKms`, `disabled`. Default value: `disabled`.
+* `kmsKeyArn` - (Optional) Amazon Resource Name (ARN) of the KMS key to be used to encrypt the data.
+
+#### s3_encryption Argument Reference
+
+* `s3EncryptionMode` - (Optional) Encryption mode to use for S3 data. Valid values: `disabled`, `sseKms`, `sseS3`. Default value: `disabled`.
+* `kmsKeyArn` - (Optional) Amazon Resource Name (ARN) of the KMS key to be used to encrypt the data.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Glue security configuration name
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Glue Security Configurations using `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Glue Security Configurations using `name`. For example:
+
+```console
+% terraform import aws_glue_security_configuration.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-648d5a94dbcbfce0a30b8db8178f35b6d6f0e3b9f5501dfc1bc90378045104ee -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/glue_trigger.html.markdown b/website/docs/cdktf/typescript/r/glue_trigger.html.markdown
new file mode 100644
index 00000000000..2b45d66ba05
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/glue_trigger.html.markdown
@@ -0,0 +1,271 @@
+---
+subcategory: "Glue"
+layout: "aws"
+page_title: "AWS: aws_glue_trigger"
+description: |-
+  Manages a Glue Trigger resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_glue_trigger
+
+Manages a Glue Trigger resource.
+
+## Example Usage
+
+### Conditional Trigger
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { GlueTrigger } from "./.gen/providers/aws/glue-trigger";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new GlueTrigger(this, "example", {
+      actions: [
+        {
+          jobName: example1.name,
+        },
+      ],
+      name: "example",
+      predicate: {
+        conditions: [
+          {
+            jobName: example2.name,
+            state: "SUCCEEDED",
+          },
+        ],
+      },
+      type: "CONDITIONAL",
+    });
+  }
+}
+
+```
+
+### On-Demand Trigger
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { GlueTrigger } from "./.gen/providers/aws/glue-trigger";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new GlueTrigger(this, "example", {
+      actions: [
+        {
+          jobName: Token.asString(awsGlueJobExample.name),
+        },
+      ],
+      name: "example",
+      type: "ON_DEMAND",
+    });
+  }
+}
+
+```
+
+### Scheduled Trigger
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { GlueTrigger } from "./.gen/providers/aws/glue-trigger";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new GlueTrigger(this, "example", {
+      actions: [
+        {
+          jobName: Token.asString(awsGlueJobExample.name),
+        },
+      ],
+      name: "example",
+      schedule: "cron(15 12 * * ? *)",
+      type: "SCHEDULED",
+    });
+  }
+}
+
+```
+
+### Conditional Trigger with Crawler Action
+
+**Note:** Triggers can have both a crawler action and a crawler condition, just no example provided.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { GlueTrigger } from "./.gen/providers/aws/glue-trigger";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new GlueTrigger(this, "example", {
+      actions: [
+        {
+          crawlerName: example1.name,
+        },
+      ],
+      name: "example",
+      predicate: {
+        conditions: [
+          {
+            jobName: example2.name,
+            state: "SUCCEEDED",
+          },
+        ],
+      },
+      type: "CONDITIONAL",
+    });
+  }
+}
+
+```
+
+### Conditional Trigger with Crawler Condition
+
+**Note:** Triggers can have both a crawler action and a crawler condition, just no example provided.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { GlueTrigger } from "./.gen/providers/aws/glue-trigger";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new GlueTrigger(this, "example", {
+      actions: [
+        {
+          jobName: example1.name,
+        },
+      ],
+      name: "example",
+      predicate: {
+        conditions: [
+          {
+            crawlState: "SUCCEEDED",
+            crawlerName: example2.name,
+          },
+        ],
+      },
+      type: "CONDITIONAL",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `actions` – (Required) List of actions initiated by this trigger when it fires. See [Actions](#actions) Below.
+* `description` – (Optional) A description of the new trigger.
+* `enabled` – (Optional) Start the trigger. Defaults to `true`.
+* `name` – (Required) The name of the trigger.
+* `predicate` – (Optional) A predicate to specify when the new trigger should fire. Required when trigger type is `conditional`. See [Predicate](#predicate) Below.
+* `schedule` – (Optional) A cron expression used to specify the schedule. [Time-Based Schedules for Jobs and Crawlers](https://docs.aws.amazon.com/glue/latest/dg/monitor-data-warehouse-schedule.html)
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `startOnCreation` – (Optional) Set to true to start `scheduled` and `conditional` triggers when created. True is not supported for `onDemand` triggers.
+* `type` – (Required) The type of trigger. Valid values are `conditional`, `event`, `onDemand`, and `scheduled`.
+* `workflowName` - (Optional) A workflow to which the trigger should be associated to. Every workflow graph (DAG) needs a starting trigger (`onDemand` or `scheduled` type) and can contain multiple additional `conditional` triggers.
+* `eventBatchingCondition` - (Optional) Batch condition that must be met (specified number of events received or batch time window expired) before EventBridge event trigger fires. See [Event Batching Condition](#event-batching-condition).
+
+### Actions
+
+* `arguments` - (Optional) Arguments to be passed to the job. You can specify arguments here that your own job-execution script consumes, as well as arguments that AWS Glue itself consumes.
+* `crawlerName` - (Optional) The name of the crawler to be executed. Conflicts with `jobName`.
+* `jobName` - (Optional) The name of a job to be executed. Conflicts with `crawlerName`.
+* `timeout` - (Optional) The job run timeout in minutes. It overrides the timeout value of the job.
+* `securityConfiguration` - (Optional) The name of the Security Configuration structure to be used with this action.
+* `notificationProperty` - (Optional) Specifies configuration properties of a job run notification. See [Notification Property](#notification-property) details below.
+
+#### Notification Property
+
+* `notifyDelayAfter` - (Optional) After a job run starts, the number of minutes to wait before sending a job run delay notification.
+
+### Predicate
+
+* `conditions` - (Required) A list of the conditions that determine when the trigger will fire. See [Conditions](#conditions).
+* `logical` - (Optional) How to handle multiple conditions. Defaults to `and`. Valid values are `and` or `any`.
+
+#### Conditions
+
+* `jobName` - (Optional) The name of the job to watch. If this is specified, `state` must also be specified. Conflicts with `crawlerName`.
+* `state` - (Optional) The condition job state. Currently, the values supported are `succeeded`, `stopped`, `timeout` and `failed`. If this is specified, `jobName` must also be specified. Conflicts with `crawlerState`.
+* `crawlerName` - (Optional) The name of the crawler to watch. If this is specified, `crawlState` must also be specified. Conflicts with `jobName`.
+* `crawlState` - (Optional) The condition crawl state. Currently, the values supported are `running`, `succeeded`, `cancelled`, and `failed`. If this is specified, `crawlerName` must also be specified. Conflicts with `state`.
+* `logicalOperator` - (Optional) A logical operator. Defaults to `equals`.
+
+### Event Batching Condition
+
+* `batchSize` - (Required)Number of events that must be received from Amazon EventBridge before EventBridge  event trigger fires.
+* `batchWindow` - (Optional) Window of time in seconds after which EventBridge event trigger fires. Window starts when first event is received. Default value is `900`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of Glue Trigger
+* `id` - Trigger name
+* `state` - The current state of the trigger.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `5M`)
+- `delete` - (Default `5M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Glue Triggers using `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Glue Triggers using `name`. For example:
+
+```console
+% terraform import aws_glue_trigger.MyTrigger MyTrigger
+```
+
+<!-- cache-key: cdktf-0.18.0 input-74dac647f2910891d6faab60e44decc3077a16fcd9bc0bb5252ee16bfc7e2cb5 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/glue_user_defined_function.html.markdown b/website/docs/cdktf/typescript/r/glue_user_defined_function.html.markdown
new file mode 100644
index 00000000000..b21e32e2869
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/glue_user_defined_function.html.markdown
@@ -0,0 +1,105 @@
+---
+subcategory: "Glue"
+layout: "aws"
+page_title: "AWS: aws_glue_user_defined_function"
+description: |-
+  Provides a Glue User Defined Function.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_glue_user_defined_function
+
+Provides a Glue User Defined Function Resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { GlueCatalogDatabase } from "./.gen/providers/aws/glue-catalog-database";
+import { GlueUserDefinedFunction } from "./.gen/providers/aws/glue-user-defined-function";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new GlueCatalogDatabase(this, "example", {
+      name: "my_database",
+    });
+    const awsGlueUserDefinedFunctionExample = new GlueUserDefinedFunction(
+      this,
+      "example_1",
+      {
+        catalogId: example.catalogId,
+        className: "class",
+        databaseName: example.name,
+        name: "my_func",
+        ownerName: "owner",
+        ownerType: "GROUP",
+        resourceUris: [
+          {
+            resourceType: "ARCHIVE",
+            uri: "uri",
+          },
+        ],
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsGlueUserDefinedFunctionExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the function.
+* `catalogId` - (Optional) ID of the Glue Catalog to create the function in. If omitted, this defaults to the AWS Account ID.
+* `databaseName` - (Required) The name of the Database to create the Function.
+* `className` - (Required) The Java class that contains the function code.
+* `ownerName` - (Required) The owner of the function.
+* `ownerType` - (Required) The owner type. can be one of `user`, `role`, and `group`.
+* `resourceUris` - (Optional) The configuration block for Resource URIs. See [resource uris](#resource-uris) below for more details.
+
+### Resource URIs
+
+* `resourceType` - (Required) The type of the resource. can be one of `jar`, `file`, and `archive`.
+* `uri` - (Required) The URI for accessing the resource.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id`- The id of the Glue User Defined Function.
+* `arn`- The ARN of the Glue User Defined Function.
+* `createTime`- The time at which the function was created.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Glue User Defined Functions using the `catalogId:databaseName:functionName`. If you have not set a Catalog ID specify the AWS Account ID that the database is in. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Glue User Defined Functions using the `catalogId:databaseName:functionName`. If you have not set a Catalog ID specify the AWS Account ID that the database is in. For example:
+
+```console
+% terraform import aws_glue_user_defined_function.func 123456789012:my_database:my_func
+```
+
+<!-- cache-key: cdktf-0.18.0 input-194cac21dea8d6e573aab71efbb8346e096eb5b0106430a43511971b8c50376b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/glue_workflow.html.markdown b/website/docs/cdktf/typescript/r/glue_workflow.html.markdown
new file mode 100644
index 00000000000..0496d82292e
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/glue_workflow.html.markdown
@@ -0,0 +1,108 @@
+---
+subcategory: "Glue"
+layout: "aws"
+page_title: "AWS: aws_glue_workflow"
+description: |-
+  Provides a Glue Workflow resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_glue_workflow
+
+Provides a Glue Workflow resource.
+The workflow graph (DAG) can be build using the `awsGlueTrigger` resource.
+See the example below for creating a graph with four nodes (two triggers and two jobs).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { GlueTrigger } from "./.gen/providers/aws/glue-trigger";
+import { GlueWorkflow } from "./.gen/providers/aws/glue-workflow";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new GlueWorkflow(this, "example", {
+      name: "example",
+    });
+    new GlueTrigger(this, "example-inner", {
+      actions: [
+        {
+          jobName: "another-example-job",
+        },
+      ],
+      name: "trigger-inner",
+      predicate: {
+        conditions: [
+          {
+            jobName: "example-job",
+            state: "SUCCEEDED",
+          },
+        ],
+      },
+      type: "CONDITIONAL",
+      workflowName: example.name,
+    });
+    new GlueTrigger(this, "example-start", {
+      actions: [
+        {
+          jobName: "example-job",
+        },
+      ],
+      name: "trigger-start",
+      type: "ON_DEMAND",
+      workflowName: example.name,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` – (Required) The name you assign to this workflow.
+* `defaultRunProperties` – (Optional) A map of default run properties for this workflow. These properties are passed to all jobs associated to the workflow.
+* `description` – (Optional) Description of the workflow.
+* `maxConcurrentRuns` - (Optional) Prevents exceeding the maximum number of concurrent runs of any of the component jobs. If you leave this parameter blank, there is no limit to the number of concurrent workflow runs.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of Glue Workflow
+* `id` - Workflow name
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Glue Workflows using `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Glue Workflows using `name`. For example:
+
+```console
+% terraform import aws_glue_workflow.MyWorkflow MyWorkflow
+```
+
+<!-- cache-key: cdktf-0.18.0 input-7df9adc6f57f0dd25966f803f616a0d5ba6f246209f657e6b2508d999ef81f32 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/grafana_license_association.html.markdown b/website/docs/cdktf/typescript/r/grafana_license_association.html.markdown
new file mode 100644
index 00000000000..eb626e3529b
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/grafana_license_association.html.markdown
@@ -0,0 +1,108 @@
+---
+subcategory: "Managed Grafana"
+layout: "aws"
+page_title: "AWS: aws_grafana_license_association"
+description: |-
+  Provides an Amazon Managed Grafana workspace license association resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_grafana_license_association
+
+Provides an Amazon Managed Grafana workspace license association resource.
+
+## Example Usage
+
+### Basic configuration
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { GrafanaLicenseAssociation } from "./.gen/providers/aws/grafana-license-association";
+import { GrafanaWorkspace } from "./.gen/providers/aws/grafana-workspace";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const assume = new IamRole(this, "assume", {
+      assumeRolePolicy: Token.asString(
+        Fn.jsonencode({
+          Statement: [
+            {
+              Action: "sts:AssumeRole",
+              Effect: "Allow",
+              Principal: {
+                Service: "grafana.amazonaws.com",
+              },
+              Sid: "",
+            },
+          ],
+          Version: "2012-10-17",
+        })
+      ),
+      name: "grafana-assume",
+    });
+    const example = new GrafanaWorkspace(this, "example", {
+      accountAccessType: "CURRENT_ACCOUNT",
+      authenticationProviders: ["SAML"],
+      permissionType: "SERVICE_MANAGED",
+      roleArn: assume.arn,
+    });
+    const awsGrafanaLicenseAssociationExample = new GrafanaLicenseAssociation(
+      this,
+      "example_2",
+      {
+        licenseType: "ENTERPRISE_FREE_TRIAL",
+        workspaceId: example.id,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsGrafanaLicenseAssociationExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `licenseType` - (Required) The type of license for the workspace license association. Valid values are `enterprise` and `enterpriseFreeTrial`.
+* `workspaceId` - (Required) The workspace id.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `freeTrialExpiration` - If `licenseType` is set to `enterpriseFreeTrial`, this is the expiration date of the free trial.
+* `licenseExpiration` - If `licenseType` is set to `enterprise`, this is the expiration date of the enterprise license.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Grafana workspace license association using the workspace's `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Grafana workspace license association using the workspace's `id`. For example:
+
+```console
+% terraform import aws_grafana_license_association.example g-2054c75a02
+```
+
+<!-- cache-key: cdktf-0.18.0 input-90acddbaf917f9205b009266924d2aa8cb3bd6ec3e83679cbf909ed8d07bd217 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/grafana_role_association.html.markdown b/website/docs/cdktf/typescript/r/grafana_role_association.html.markdown
new file mode 100644
index 00000000000..cb49a54d25d
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/grafana_role_association.html.markdown
@@ -0,0 +1,89 @@
+---
+subcategory: "Managed Grafana"
+layout: "aws"
+page_title: "AWS: aws_grafana_role_association"
+description: |-
+  Provides an Amazon Managed Grafana workspace role association resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_grafana_role_association
+
+Provides an Amazon Managed Grafana workspace role association resource.
+
+## Example Usage
+
+### Basic configuration
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { GrafanaRoleAssociation } from "./.gen/providers/aws/grafana-role-association";
+import { GrafanaWorkspace } from "./.gen/providers/aws/grafana-workspace";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const assume = new IamRole(this, "assume", {
+      assumeRolePolicy: Token.asString(
+        Fn.jsonencode({
+          Statement: [
+            {
+              Action: "sts:AssumeRole",
+              Effect: "Allow",
+              Principal: {
+                Service: "grafana.amazonaws.com",
+              },
+              Sid: "",
+            },
+          ],
+          Version: "2012-10-17",
+        })
+      ),
+      name: "grafana-assume",
+    });
+    const example = new GrafanaWorkspace(this, "example", {
+      accountAccessType: "CURRENT_ACCOUNT",
+      authenticationProviders: ["SAML"],
+      permissionType: "SERVICE_MANAGED",
+      roleArn: assume.arn,
+    });
+    const awsGrafanaRoleAssociationExample = new GrafanaRoleAssociation(
+      this,
+      "example_2",
+      {
+        role: "ADMIN",
+        userIds: ["USER_ID_1", "USER_ID_2"],
+        workspaceId: example.id,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsGrafanaRoleAssociationExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `role` - (Required) The grafana role. Valid values can be found [here](https://docs.aws.amazon.com/grafana/latest/APIReference/API_UpdateInstruction.html#ManagedGrafana-Type-UpdateInstruction-role).
+* `workspaceId` - (Required) The workspace id.
+
+The following arguments are optional:
+
+* `groupIds` - (Optional) The AWS SSO group ids to be assigned the role given in `role`.
+* `userIds` - (Optional) The AWS SSO user ids to be assigned the role given in `role`.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+<!-- cache-key: cdktf-0.18.0 input-4d21bedd686a943999565d73b09e0fb7f400801629b70dba191f5a85e621bf6f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/grafana_workspace.html.markdown b/website/docs/cdktf/typescript/r/grafana_workspace.html.markdown
new file mode 100644
index 00000000000..d4829f9ef59
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/grafana_workspace.html.markdown
@@ -0,0 +1,126 @@
+---
+subcategory: "Managed Grafana"
+layout: "aws"
+page_title: "AWS: aws_grafana_workspace"
+description: |-
+  Provides an Amazon Managed Grafana workspace resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_grafana_workspace
+
+Provides an Amazon Managed Grafana workspace resource.
+
+## Example Usage
+
+### Basic configuration
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { GrafanaWorkspace } from "./.gen/providers/aws/grafana-workspace";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const assume = new IamRole(this, "assume", {
+      assumeRolePolicy: Token.asString(
+        Fn.jsonencode({
+          Statement: [
+            {
+              Action: "sts:AssumeRole",
+              Effect: "Allow",
+              Principal: {
+                Service: "grafana.amazonaws.com",
+              },
+              Sid: "",
+            },
+          ],
+          Version: "2012-10-17",
+        })
+      ),
+      name: "grafana-assume",
+    });
+    new GrafanaWorkspace(this, "example", {
+      accountAccessType: "CURRENT_ACCOUNT",
+      authenticationProviders: ["SAML"],
+      permissionType: "SERVICE_MANAGED",
+      roleArn: assume.arn,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `accountAccessType` - (Required) The type of account access for the workspace. Valid values are `currentAccount` and `organization`. If `organization` is specified, then `organizationalUnits` must also be present.
+* `authenticationProviders` - (Required) The authentication providers for the workspace. Valid values are `awsSso`, `saml`, or both.
+* `permissionType` - (Required) The permission type of the workspace. If `serviceManaged` is specified, the IAM roles and IAM policy attachments are generated automatically. If `customerManaged` is specified, the IAM roles and IAM policy attachments will not be created.
+
+The following arguments are optional:
+
+* `configuration` - (Optional) The configuration string for the workspace that you create. For more information about the format and configuration options available, see [Working in your Grafana workspace](https://docs.aws.amazon.com/grafana/latest/userguide/AMG-configure-workspace.html).
+* `dataSources` - (Optional) The data sources for the workspace. Valid values are `amazonOpensearchService`, `athena`, `cloudwatch`, `prometheus`, `redshift`, `sitewise`, `timestream`, `xray`
+* `description` - (Optional) The workspace description.
+* `grafanaVersion` - (Optional) Specifies the version of Grafana to support in the new workspace. Supported values are `84` and `94`. If not specified, defaults to `84`.
+* `name` - (Optional) The Grafana workspace name.
+* `networkAccessControl` - (Optional) Configuration for network access to your workspace.See [Network Access Control](#network-access-control) below.
+* `notificationDestinations` - (Optional) The notification destinations. If a data source is specified here, Amazon Managed Grafana will create IAM roles and permissions needed to use these destinations. Must be set to `sns`.
+* `organizationRoleName` - (Optional) The role name that the workspace uses to access resources through Amazon Organizations.
+* `organizationalUnits` - (Optional) The Amazon Organizations organizational units that the workspace is authorized to use data sources from.
+* `roleArn` - (Optional) The IAM role ARN that the workspace assumes.
+* `stackSetName` - (Optional) The AWS CloudFormation stack set name that provisions IAM roles to be used by the workspace.
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `vpcConfiguration` - (Optional) The configuration settings for an Amazon VPC that contains data sources for your Grafana workspace to connect to. See [VPC Configuration](#vpc-configuration) below.
+
+### Network Access Control
+
+* `prefixListIds` - (Required) - An array of prefix list IDs.
+* `vpceIds` - (Required) - An array of Amazon VPC endpoint IDs for the workspace. The only VPC endpoints that can be specified here are interface VPC endpoints for Grafana workspaces (using the com.amazonaws.[region].grafana-workspace service endpoint). Other VPC endpoints will be ignored.
+
+### VPC Configuration
+
+* `securityGroupIds` - (Required) - The list of Amazon EC2 security group IDs attached to the Amazon VPC for your Grafana workspace to connect.
+* `subnetIds` - (Required) - The list of Amazon EC2 subnet IDs created in the Amazon VPC for your Grafana workspace to connect.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the Grafana workspace.
+* `endpoint` - The endpoint of the Grafana workspace.
+* `grafanaVersion` - The version of Grafana running on the workspace.
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Grafana Workspace using the workspace's `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Grafana Workspace using the workspace's `id`. For example:
+
+```console
+% terraform import aws_grafana_workspace.example g-2054c75a02
+```
+
+<!-- cache-key: cdktf-0.18.0 input-820d8fa60d26cc380b30e0e075e8870fa4551ee953fef3e08d695a7c4dd8f5a0 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/grafana_workspace_api_key.html.markdown b/website/docs/cdktf/typescript/r/grafana_workspace_api_key.html.markdown
new file mode 100644
index 00000000000..dc05f6ed6fe
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/grafana_workspace_api_key.html.markdown
@@ -0,0 +1,57 @@
+---
+subcategory: "Managed Grafana"
+layout: "aws"
+page_title: "AWS: aws_grafana_workspace_api_key"
+description: |-
+  Creates a Grafana API key for the workspace. This key can be used to authenticate requests sent to the workspace's HTTP API.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_grafana_workspace_api_key
+
+Provides an Amazon Managed Grafana workspace API Key resource.
+
+## Example Usage
+
+### Basic configuration
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { GrafanaWorkspaceApiKey } from "./.gen/providers/aws/grafana-workspace-api-key";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new GrafanaWorkspaceApiKey(this, "key", {
+      keyName: "test-key",
+      keyRole: "VIEWER",
+      secondsToLive: 3600,
+      workspaceId: test.id,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+- `keyName` - (Required) Specifies the name of the API key. Key names must be unique to the workspace.
+- `keyRole` - (Required) Specifies the permission level of the API key. Valid values are `viewer`, `editor`, or `admin`.
+- `secondsToLive` - (Required) Specifies the time in seconds until the API key expires. Keys can be valid for up to 30 days.
+- `workspaceId` - (Required) The ID of the workspace that the API key is valid for.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `key` - The key token in JSON format. Use this value as a bearer token to authenticate HTTP requests to the workspace.
+
+<!-- cache-key: cdktf-0.18.0 input-9633668281b65801757ef3306eb1542f89dab699a63f4f4b2b48d996c5bf8f4b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/grafana_workspace_saml_configuration.html.markdown b/website/docs/cdktf/typescript/r/grafana_workspace_saml_configuration.html.markdown
new file mode 100644
index 00000000000..e4a559ca36f
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/grafana_workspace_saml_configuration.html.markdown
@@ -0,0 +1,119 @@
+---
+subcategory: "Managed Grafana"
+layout: "aws"
+page_title: "AWS: aws_grafana_workspace_saml_configuration"
+description: |-
+  Provides an Amazon Managed Grafana workspace SAML configuration resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_grafana_workspace_saml_configuration
+
+Provides an Amazon Managed Grafana workspace SAML configuration resource.
+
+## Example Usage
+
+### Basic configuration
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { GrafanaWorkspace } from "./.gen/providers/aws/grafana-workspace";
+import { GrafanaWorkspaceSamlConfiguration } from "./.gen/providers/aws/grafana-workspace-saml-configuration";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const assume = new IamRole(this, "assume", {
+      assumeRolePolicy: Token.asString(
+        Fn.jsonencode({
+          Statement: [
+            {
+              Action: "sts:AssumeRole",
+              Effect: "Allow",
+              Principal: {
+                Service: "grafana.amazonaws.com",
+              },
+              Sid: "",
+            },
+          ],
+          Version: "2012-10-17",
+        })
+      ),
+      name: "grafana-assume",
+    });
+    const example = new GrafanaWorkspace(this, "example", {
+      accountAccessType: "CURRENT_ACCOUNT",
+      authenticationProviders: ["SAML"],
+      permissionType: "SERVICE_MANAGED",
+      roleArn: assume.arn,
+    });
+    const awsGrafanaWorkspaceSamlConfigurationExample =
+      new GrafanaWorkspaceSamlConfiguration(this, "example_2", {
+        editorRoleValues: ["editor"],
+        idpMetadataUrl: "https://my_idp_metadata.url",
+        workspaceId: example.id,
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsGrafanaWorkspaceSamlConfigurationExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `editorRoleValues` - (Required) The editor role values.
+* `workspaceId` - (Required) The workspace id.
+
+The following arguments are optional:
+
+* `adminRoleValues` - (Optional) The admin role values.
+* `allowedOrganizations` - (Optional) The allowed organizations.
+* `emailAssertion` - (Optional) The email assertion.
+* `groupsAssertion` - (Optional) The groups assertion.
+* `idpMetadataUrl` - (Optional) The IDP Metadata URL. Note that either `idpMetadataUrl` or `idpMetadataXml` (but not both) must be specified.
+* `idpMetadataXml` - (Optional) The IDP Metadata XML. Note that either `idpMetadataUrl` or `idpMetadataXml` (but not both) must be specified.
+* `loginAssertion` - (Optional) The login assertion.
+* `loginValidityDuration` - (Optional) The login validity duration.
+* `nameAssertion` - (Optional) The name assertion.
+* `orgAssertion` - (Optional) The org assertion.
+* `roleAssertion` - (Optional) The role assertion.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `status` - The status of the SAML configuration.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Grafana Workspace SAML configuration using the workspace's `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Grafana Workspace SAML configuration using the workspace's `id`. For example:
+
+```console
+% terraform import aws_grafana_workspace_saml_configuration.example g-2054c75a02
+```
+
+<!-- cache-key: cdktf-0.18.0 input-8e2fc0417f74c403628b82a9ce17055a1086f9bba22d87c4e859c5d48f99d2cb -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/guardduty_detector.html.markdown b/website/docs/cdktf/typescript/r/guardduty_detector.html.markdown
new file mode 100644
index 00000000000..97f9f29e5da
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/guardduty_detector.html.markdown
@@ -0,0 +1,153 @@
+---
+subcategory: "GuardDuty"
+layout: "aws"
+page_title: "AWS: aws_guardduty_detector"
+description: |-
+  Provides a resource to manage an Amazon GuardDuty detector
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_guardduty_detector
+
+Provides a resource to manage an Amazon GuardDuty detector.
+
+~> **NOTE:** Deleting this resource is equivalent to "disabling" GuardDuty for an AWS region, which removes all existing findings. You can set the `enable` attribute to `false` to instead "suspend" monitoring and feedback reporting while keeping existing data. See the [Suspending or Disabling Amazon GuardDuty documentation](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_suspend-disable.html) for more information.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { GuarddutyDetector } from "./.gen/providers/aws/guardduty-detector";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new GuarddutyDetector(this, "MyDetector", {
+      datasources: {
+        kubernetes: {
+          auditLogs: {
+            enable: false,
+          },
+        },
+        malwareProtection: {
+          scanEc2InstanceWithFindings: {
+            ebsVolumes: {
+              enable: true,
+            },
+          },
+        },
+        s3Logs: {
+          enable: true,
+        },
+      },
+      enable: true,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `enable` - (Optional) Enable monitoring and feedback reporting. Setting to `false` is equivalent to "suspending" GuardDuty. Defaults to `true`.
+* `findingPublishingFrequency` - (Optional) Specifies the frequency of notifications sent for subsequent finding occurrences. If the detector is a GuardDuty member account, the value is determined by the GuardDuty primary account and cannot be modified, otherwise defaults to `sixHours`. For standalone and GuardDuty primary accounts, it must be configured in Terraform to enable drift detection. Valid values for standalone and primary accounts: `fifteenMinutes`, `oneHour`, `sixHours`. See [AWS Documentation](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_findings_cloudwatch.html#guardduty_findings_cloudwatch_notification_frequency) for more information.
+* `datasources` - (Optional) Describes which data sources will be enabled for the detector. See [Data Sources](#data-sources) below for more details. [Deprecated](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-feature-object-api-changes-march2023.html) in favor of [`awsGuarddutyDetectorFeature` resources](guardduty_detector_feature.html).
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Data Sources
+
+The `datasources` block supports the following:
+
+* `s3Logs` - (Optional) Configures [S3 protection](https://docs.aws.amazon.com/guardduty/latest/ug/s3-protection.html).
+  See [S3 Logs](#s3-logs) below for more details.
+* `kubernetes` - (Optional) Configures [Kubernetes protection](https://docs.aws.amazon.com/guardduty/latest/ug/kubernetes-protection.html).
+  See [Kubernetes](#kubernetes) and [Kubernetes Audit Logs](#kubernetes-audit-logs) below for more details.
+* `malwareProtection` - (Optional) Configures [Malware Protection](https://docs.aws.amazon.com/guardduty/latest/ug/malware-protection.html).
+  See [Malware Protection](#malware-protection), [Scan EC2 instance with findings](#scan-ec2-instance-with-findings) and [EBS volumes](#ebs-volumes) below for more details.
+
+The `datasources` block is deprecated since March 2023. Use the `features` block instead and [map each `datasources` block to the corresponding `features` block](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-feature-object-api-changes-march2023.html#guardduty-feature-enablement-datasource-relation).
+
+### S3 Logs
+
+The `s3Logs` block supports the following:
+
+* `enable` - (Required) If true, enables [S3 protection](https://docs.aws.amazon.com/guardduty/latest/ug/s3-protection.html).
+  Defaults to `true`.
+
+### Kubernetes
+
+The `kubernetes` block supports the following:
+
+* `auditLogs` - (Required) Configures Kubernetes audit logs as a data source for [Kubernetes protection](https://docs.aws.amazon.com/guardduty/latest/ug/kubernetes-protection.html).
+  See [Kubernetes Audit Logs](#kubernetes-audit-logs) below for more details.
+
+### Kubernetes Audit Logs
+
+The `auditLogs` block supports the following:
+
+* `enable` - (Required) If true, enables Kubernetes audit logs as a data source for [Kubernetes protection](https://docs.aws.amazon.com/guardduty/latest/ug/kubernetes-protection.html).
+  Defaults to `true`.
+
+### Malware Protection
+
+`malwareProtection` block supports the following:
+
+* `scanEc2InstanceWithFindings` - (Required) Configure whether [Malware Protection](https://docs.aws.amazon.com/guardduty/latest/ug/malware-protection.html) is enabled as data source for EC2 instances with findings for the detector.
+  See [Scan EC2 instance with findings](#scan-ec2-instance-with-findings) below for more details.
+
+#### Scan EC2 instance with findings
+
+The `scanEc2InstanceWithFindings` block supports the following:
+
+* `ebsVolumes` - (Required) Configure whether scanning EBS volumes is enabled as data source for the detector for instances with findings.
+  See [EBS volumes](#ebs-volumes) below for more details.
+
+#### EBS volumes
+
+The `ebsVolumes` block supports the following:
+
+* `enable` - (Required) If true, enables [Malware Protection](https://docs.aws.amazon.com/guardduty/latest/ug/malware-protection.html) as data source for the detector.
+  Defaults to `true`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `accountId` - The AWS account ID of the GuardDuty detector
+* `arn` - Amazon Resource Name (ARN) of the GuardDuty detector
+* `id` - The ID of the GuardDuty detector
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import GuardDuty detectors using the detector ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import GuardDuty detectors using the detector ID. For example:
+
+```console
+% terraform import aws_guardduty_detector.MyDetector 00b00fd5aecc0ab60a708659477e9617
+```
+
+The ID of the detector can be retrieved via the [AWS CLI](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/guardduty/list-detectors.html) using `aws guardduty list-detectors`.
+
+<!-- cache-key: cdktf-0.18.0 input-302ad3286e382870d4c5a91d3567a07ae8a6c0466169ed1648e2acc9f1c51eaf -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/guardduty_detector_feature.html.markdown b/website/docs/cdktf/typescript/r/guardduty_detector_feature.html.markdown
new file mode 100644
index 00000000000..05334852acc
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/guardduty_detector_feature.html.markdown
@@ -0,0 +1,71 @@
+---
+subcategory: "GuardDuty"
+layout: "aws"
+page_title: "AWS: aws_guardduty_detector_feature"
+description: |-
+  Provides a resource to manage an Amazon GuardDuty detector feature
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_guardduty_detector_feature
+
+Provides a resource to manage a single Amazon GuardDuty [detector feature](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-features-activation-model.html#guardduty-features).
+
+~> **NOTE:** Deleting this resource does not disable the detector feature, the resource in simply removed from state instead.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { GuarddutyDetectorFeature } from "./.gen/providers/aws/";
+import { GuarddutyDetector } from "./.gen/providers/aws/guardduty-detector";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new GuarddutyDetector(this, "example", {
+      enable: true,
+    });
+    new GuarddutyDetectorFeature(this, "eks_runtime_monitoring", {
+      additional_configuration: [
+        {
+          name: "EKS_ADDON_MANAGEMENT",
+          status: "ENABLED",
+        },
+      ],
+      detector_id: example.id,
+      name: "EKS_RUNTIME_MONITORING",
+      status: "ENABLED",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `detectorId` - (Required) Amazon GuardDuty detector ID.
+* `name` - (Required) The name of the detector feature. Valid values: `s3DataEvents`, `eksAuditLogs`, `ebsMalwareProtection`, `rdsLoginEvents`, `eksRuntimeMonitoring`, `lambdaNetworkLogs`.
+* `status` - (Required) The status of the detector feature. Valid values: `enabled`, `disabled`.
+* `additionalConfiguration` - (Optional) Additional feature configuration block. See [below](#additional-configuration).
+
+### Additional Configuration
+
+The `additionalConfiguration` block supports the following:
+
+* `name` - (Required) The name of the additional configuration. Valid values: `eksAddonManagement`.
+* `status` - (Required) The status of the additional configuration. Valid values: `enabled`, `disabled`.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+<!-- cache-key: cdktf-0.18.0 input-730bfa0c7a2b94ed5a34772f00e9b6d3c65956aa82ca10d129920a025e89eb3e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/guardduty_filter.html.markdown b/website/docs/cdktf/typescript/r/guardduty_filter.html.markdown
new file mode 100644
index 00000000000..9c34fa266be
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/guardduty_filter.html.markdown
@@ -0,0 +1,115 @@
+---
+subcategory: "GuardDuty"
+layout: "aws"
+page_title: "AWS: aws_guardduty_filter"
+description: |-
+  Provides a resource to manage a GuardDuty filter
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_guardduty_filter
+
+Provides a resource to manage a GuardDuty filter.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { GuarddutyFilter } from "./.gen/providers/aws/guardduty-filter";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new GuarddutyFilter(this, "MyFilter", {
+      action: "ARCHIVE",
+      detectorId: example.id,
+      findingCriteria: {
+        criterion: [
+          {
+            equalTo: ["eu-west-1"],
+            field: "region",
+          },
+          {
+            field: "service.additionalInfo.threatListName",
+            notEquals: ["some-threat", "another-threat"],
+          },
+          {
+            field: "updatedAt",
+            greaterThan: "2020-01-01T00:00:00Z",
+            lessThan: "2020-02-01T00:00:00Z",
+          },
+          {
+            field: "severity",
+            greaterThanOrEqual: "4",
+          },
+        ],
+      },
+      name: "MyFilter",
+      rank: 1,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `detectorId` - (Required) ID of a GuardDuty detector, attached to your account.
+* `name` - (Required) The name of your filter.
+* `description` - (Optional) Description of the filter.
+* `rank` - (Required) Specifies the position of the filter in the list of current filters. Also specifies the order in which this filter is applied to the findings.
+* `action` - (Required) Specifies the action that is to be applied to the findings that match the filter. Can be one of `archive` or `noop`.
+* `tags` (Optional) - The tags that you want to add to the Filter resource. A tag consists of a key and a value. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `findingCriteria` (Required) - Represents the criteria to be used in the filter for querying findings. Contains one or more `criterion` blocks, documented [below](#criterion).
+
+### criterion
+
+The `criterion` block suports the following:
+
+* `field` - (Required) The name of the field to be evaluated. The full list of field names can be found in [AWS documentation](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_filter-findings.html#filter_criteria).
+* `equals` - (Optional) List of string values to be evaluated.
+* `notEquals` - (Optional) List of string values to be evaluated.
+* `greaterThan` - (Optional) A value to be evaluated. Accepts either an integer or a date in [RFC 3339 format](https://tools.ietf.org/html/rfc3339#section-5.8).
+* `greaterThanOrEqual` - (Optional) A value to be evaluated. Accepts either an integer or a date in [RFC 3339 format](https://tools.ietf.org/html/rfc3339#section-5.8).
+* `lessThan` - (Optional) A value to be evaluated. Accepts either an integer or a date in [RFC 3339 format](https://tools.ietf.org/html/rfc3339#section-5.8).
+* `lessThanOrEqual` - (Optional) A value to be evaluated. Accepts either an integer or a date in [RFC 3339 format](https://tools.ietf.org/html/rfc3339#section-5.8).
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the GuardDuty filter.
+* `id` - A compound field, consisting of the ID of the GuardDuty detector and the name of the filter.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import GuardDuty filters using the detector ID and filter's name separated by a colon. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import GuardDuty filters using the detector ID and filter's name separated by a colon. For example:
+
+```console
+% terraform import aws_guardduty_filter.MyFilter 00b00fd5aecc0ab60a708659477e9617:MyFilter
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1e606d1888ce4c1d9fc3a9cf0b4de2053e508ab6db3e76bc7736c3226909e127 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/guardduty_invite_accepter.html.markdown b/website/docs/cdktf/typescript/r/guardduty_invite_accepter.html.markdown
new file mode 100644
index 00000000000..85a98103061
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/guardduty_invite_accepter.html.markdown
@@ -0,0 +1,111 @@
+---
+subcategory: "GuardDuty"
+layout: "aws"
+page_title: "AWS: aws_guardduty_invite_accepter"
+description: |-
+  Provides a resource to accept a pending GuardDuty invite on creation, ensure the detector has the correct primary account on read, and disassociate with the primary account upon removal.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_guardduty_invite_accepter
+
+Provides a resource to accept a pending GuardDuty invite on creation, ensure the detector has the correct primary account on read, and disassociate with the primary account upon removal.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { GuarddutyDetector } from "./.gen/providers/aws/guardduty-detector";
+import { GuarddutyInviteAccepter } from "./.gen/providers/aws/guardduty-invite-accepter";
+import { GuarddutyMember } from "./.gen/providers/aws/guardduty-member";
+import { AwsProvider } from "./.gen/providers/aws/provider";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const primary = new AwsProvider(this, "aws", {
+      alias: "primary",
+    });
+    const member = new AwsProvider(this, "aws_1", {
+      alias: "member",
+    });
+    const awsGuarddutyDetectorMember = new GuarddutyDetector(this, "member", {
+      provider: member,
+    });
+    const awsGuarddutyDetectorPrimary = new GuarddutyDetector(this, "primary", {
+      provider: primary,
+    });
+    const awsGuarddutyMemberMember = new GuarddutyMember(this, "member_4", {
+      accountId: Token.asString(awsGuarddutyDetectorMember.accountId),
+      detectorId: Token.asString(awsGuarddutyDetectorPrimary.id),
+      email: "required@example.com",
+      invite: true,
+      provider: primary,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsGuarddutyMemberMember.overrideLogicalId("member");
+    const awsGuarddutyInviteAccepterMember = new GuarddutyInviteAccepter(
+      this,
+      "member_5",
+      {
+        dependsOn: [awsGuarddutyMemberMember],
+        detectorId: Token.asString(awsGuarddutyDetectorMember.id),
+        masterAccountId: Token.asString(awsGuarddutyDetectorPrimary.accountId),
+        provider: member,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsGuarddutyInviteAccepterMember.overrideLogicalId("member");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `detectorId` - (Required) The detector ID of the member GuardDuty account.
+* `masterAccountId` - (Required) AWS account ID for primary account.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - GuardDuty member detector ID
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `1M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsGuarddutyInviteAccepter` using the member GuardDuty detector ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsGuarddutyInviteAccepter` using the member GuardDuty detector ID. For example:
+
+```console
+% terraform import aws_guardduty_invite_accepter.member 00b00fd5aecc0ab60a708659477e9617
+```
+
+<!-- cache-key: cdktf-0.18.0 input-b368eea7537bdd5e2ab4ccd975cb44eb377f3627dcb046e902234d27ed097808 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/guardduty_ipset.html.markdown b/website/docs/cdktf/typescript/r/guardduty_ipset.html.markdown
new file mode 100644
index 00000000000..87515f25c68
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/guardduty_ipset.html.markdown
@@ -0,0 +1,105 @@
+---
+subcategory: "GuardDuty"
+layout: aws
+page_title: 'AWS: aws_guardduty_ipset'
+description: Provides a resource to manage a GuardDuty IPSet
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_guardduty_ipset
+
+Provides a resource to manage a GuardDuty IPSet.
+
+~> **Note:** Currently in GuardDuty, users from member accounts cannot upload and further manage IPSets. IPSets that are uploaded by the primary account are imposed on GuardDuty functionality in its member accounts. See the [GuardDuty API Documentation](https://docs.aws.amazon.com/guardduty/latest/ug/create-ip-set.html)
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { GuarddutyDetector } from "./.gen/providers/aws/guardduty-detector";
+import { GuarddutyIpset } from "./.gen/providers/aws/guardduty-ipset";
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketAcl } from "./.gen/providers/aws/s3-bucket-acl";
+import { S3Object } from "./.gen/providers/aws/s3-object";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const primary = new GuarddutyDetector(this, "primary", {
+      enable: true,
+    });
+    const bucket = new S3Bucket(this, "bucket", {});
+    new S3BucketAcl(this, "bucket_acl", {
+      acl: "private",
+      bucket: bucket.id,
+    });
+    const myIpSet = new S3Object(this, "MyIPSet", {
+      bucket: bucket.id,
+      content: "10.0.0.0/8\n\n",
+      key: "MyIPSet",
+    });
+    new GuarddutyIpset(this, "example", {
+      activate: true,
+      detectorId: primary.id,
+      format: "TXT",
+      location:
+        "https://s3.amazonaws.com/${" +
+        myIpSet.bucket +
+        "}/${" +
+        myIpSet.key +
+        "}",
+      name: "MyIPSet",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `activate` - (Required) Specifies whether GuardDuty is to start using the uploaded IPSet.
+* `detectorId` - (Required) The detector ID of the GuardDuty.
+* `format` - (Required) The format of the file that contains the IPSet. Valid values: `txt` | `stix` | `otxCsv` | `alienVault` | `proofPoint` | `fireEye`
+* `location` - (Required) The URI of the file that contains the IPSet.
+* `name` - (Required) The friendly name to identify the IPSet.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the GuardDuty IPSet.
+* `id` - The ID of the GuardDuty IPSet.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import GuardDuty IPSet using the primary GuardDuty detector ID and IPSet ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import GuardDuty IPSet using the primary GuardDuty detector ID and IPSet ID. For example:
+
+```console
+% terraform import aws_guardduty_ipset.MyIPSet 00b00fd5aecc0ab60a708659477e9617:123456789012
+```
+
+<!-- cache-key: cdktf-0.18.0 input-5a9aeb8596a1584664d2e630a427541e8d151a5e9c5c5912959a88b2da9c2384 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/guardduty_member.html.markdown b/website/docs/cdktf/typescript/r/guardduty_member.html.markdown
new file mode 100644
index 00000000000..5bcc4d6bfcd
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/guardduty_member.html.markdown
@@ -0,0 +1,98 @@
+---
+subcategory: "GuardDuty"
+layout: "aws"
+page_title: "AWS: aws_guardduty_member"
+description: |-
+  Provides a resource to manage a GuardDuty member
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_guardduty_member
+
+Provides a resource to manage a GuardDuty member. To accept invitations in member accounts, see the [`awsGuarddutyInviteAccepter` resource](/docs/providers/aws/r/guardduty_invite_accepter.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { GuarddutyDetector } from "./.gen/providers/aws/guardduty-detector";
+import { GuarddutyMember } from "./.gen/providers/aws/guardduty-member";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const member = new GuarddutyDetector(this, "member", {
+      enable: true,
+      provider: dev,
+    });
+    const primary = new GuarddutyDetector(this, "primary", {
+      enable: true,
+    });
+    const awsGuarddutyMemberMember = new GuarddutyMember(this, "member_2", {
+      accountId: member.accountId,
+      detectorId: primary.id,
+      email: "required@example.com",
+      invitationMessage: "please accept guardduty invitation",
+      invite: true,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsGuarddutyMemberMember.overrideLogicalId("member");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `accountId` - (Required) AWS account ID for member account.
+* `detectorId` - (Required) The detector ID of the GuardDuty account where you want to create member accounts.
+* `email` - (Required) Email address for member account.
+* `invite` - (Optional) Boolean whether to invite the account to GuardDuty as a member. Defaults to `false`. To detect if an invitation needs to be (re-)sent, the Terraform state value is `true` based on a `relationshipStatus` of `disabled`, `enabled`, `invited`, or `emailVerificationInProgress`.
+* `invitationMessage` - (Optional) Message for invitation.
+* `disableEmailNotification` - (Optional) Boolean whether an email notification is sent to the accounts. Defaults to `false`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the GuardDuty member
+* `relationshipStatus` - The status of the relationship between the member account and its primary account. More information can be found in [Amazon GuardDuty API Reference](https://docs.aws.amazon.com/guardduty/latest/ug/get-members.html).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `1M`)
+- `update` - (Default `1M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import GuardDuty members using the primary GuardDuty detector ID and member AWS account ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import GuardDuty members using the primary GuardDuty detector ID and member AWS account ID. For example:
+
+```console
+% terraform import aws_guardduty_member.MyMember 00b00fd5aecc0ab60a708659477e9617:123456789012
+```
+
+<!-- cache-key: cdktf-0.18.0 input-8c795e9bdb95e2477dec1e7c539b60d6a51b31c90c42c663ecd2ece13c210023 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/guardduty_organization_admin_account.html.markdown b/website/docs/cdktf/typescript/r/guardduty_organization_admin_account.html.markdown
new file mode 100644
index 00000000000..e2c65c010bd
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/guardduty_organization_admin_account.html.markdown
@@ -0,0 +1,88 @@
+---
+subcategory: "GuardDuty"
+layout: "aws"
+page_title: "AWS: aws_guardduty_organization_admin_account"
+description: |-
+  Manages a GuardDuty Organization Admin Account
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_guardduty_organization_admin_account
+
+Manages a GuardDuty Organization Admin Account. The AWS account utilizing this resource must be an Organizations primary account. More information about Organizations support in GuardDuty can be found in the [GuardDuty User Guide](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_organizations.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { GuarddutyDetector } from "./.gen/providers/aws/guardduty-detector";
+import { GuarddutyOrganizationAdminAccount } from "./.gen/providers/aws/guardduty-organization-admin-account";
+import { OrganizationsOrganization } from "./.gen/providers/aws/organizations-organization";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new GuarddutyDetector(this, "example", {});
+    const awsOrganizationsOrganizationExample = new OrganizationsOrganization(
+      this,
+      "example_1",
+      {
+        awsServiceAccessPrincipals: ["guardduty.amazonaws.com"],
+        featureSet: "ALL",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsOrganizationsOrganizationExample.overrideLogicalId("example");
+    const awsGuarddutyOrganizationAdminAccountExample =
+      new GuarddutyOrganizationAdminAccount(this, "example_2", {
+        adminAccountId: "123456789012",
+        dependsOn: [awsOrganizationsOrganizationExample],
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsGuarddutyOrganizationAdminAccountExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `adminAccountId` - (Required) AWS account identifier to designate as a delegated administrator for GuardDuty.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - AWS account identifier.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import GuardDuty Organization Admin Account using the AWS account ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import GuardDuty Organization Admin Account using the AWS account ID. For example:
+
+```console
+% terraform import aws_guardduty_organization_admin_account.example 123456789012
+```
+
+<!-- cache-key: cdktf-0.18.0 input-9503edb267379cc704ded824b2c1ffae37e126e5b11a01a39000716b3a61347e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/guardduty_organization_configuration.html.markdown b/website/docs/cdktf/typescript/r/guardduty_organization_configuration.html.markdown
new file mode 100644
index 00000000000..5656e6780de
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/guardduty_organization_configuration.html.markdown
@@ -0,0 +1,150 @@
+---
+subcategory: "GuardDuty"
+layout: "aws"
+page_title: "AWS: aws_guardduty_organization_configuration"
+description: |-
+  Manages the GuardDuty Organization Configuration
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_guardduty_organization_configuration
+
+Manages the GuardDuty Organization Configuration in the current AWS Region. The AWS account utilizing this resource must have been assigned as a delegated Organization administrator account, e.g., via the [`awsGuarddutyOrganizationAdminAccount` resource](/docs/providers/aws/r/guardduty_organization_admin_account.html). More information about Organizations support in GuardDuty can be found in the [GuardDuty User Guide](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_organizations.html).
+
+~> **NOTE:** This is an advanced Terraform resource. Terraform will automatically assume management of the GuardDuty Organization Configuration without import and perform no actions on removal from the Terraform configuration.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { GuarddutyDetector } from "./.gen/providers/aws/guardduty-detector";
+import { GuarddutyOrganizationConfiguration } from "./.gen/providers/aws/guardduty-organization-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new GuarddutyDetector(this, "example", {
+      enable: true,
+    });
+    const awsGuarddutyOrganizationConfigurationExample =
+      new GuarddutyOrganizationConfiguration(this, "example_1", {
+        autoEnableOrganizationMembers: "ALL",
+        datasources: {
+          kubernetes: {
+            auditLogs: {
+              enable: true,
+            },
+          },
+          malwareProtection: {
+            scanEc2InstanceWithFindings: {
+              ebsVolumes: {
+                autoEnable: true,
+              },
+            },
+          },
+          s3Logs: {
+            autoEnable: true,
+          },
+        },
+        detectorId: example.id,
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsGuarddutyOrganizationConfigurationExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+~> **NOTE:** One of `autoEnable` or `autoEnableOrganizationMembers` must be specified.
+
+This argument supports the following arguments:
+
+* `autoEnable` - (Optional) *Deprecated:* Use `autoEnableOrganizationMembers` instead. When this setting is enabled, all new accounts that are created in, or added to, the organization are added as a member accounts of the organization’s GuardDuty delegated administrator and GuardDuty is enabled in that AWS Region.
+* `autoEnableOrganizationMembers` - (Optional) Indicates the auto-enablement configuration of GuardDuty for the member accounts in the organization. Valid values are `all`, `new`, `none`.
+* `detectorId` - (Required) The detector ID of the GuardDuty account.
+* `datasources` - (Optional) Configuration for the collected datasources.
+
+`datasources` supports the following:
+
+* `s3Logs` - (Optional) Enable S3 Protection automatically for new member accounts.
+* `kubernetes` - (Optional) Enable Kubernetes Audit Logs Monitoring automatically for new member accounts.
+* `malwareProtection` - (Optional) Enable Malware Protection automatically for new member accounts.
+
+### S3 Logs
+
+`s3Logs` block supports the following:
+
+* `autoEnable` - (Optional) Set to `true` if you want S3 data event logs to be automatically enabled for new members of the organization. Default: `false`
+
+### Kubernetes
+
+`kubernetes` block supports the following:
+
+* `auditLogs` - (Required) Enable Kubernetes Audit Logs Monitoring automatically for new member accounts. [Kubernetes protection](https://docs.aws.amazon.com/guardduty/latest/ug/kubernetes-protection.html).
+  See [Kubernetes Audit Logs](#kubernetes-audit-logs) below for more details.
+
+#### Kubernetes Audit Logs
+
+The `auditLogs` block supports the following:
+
+* `enable` - (Required) If true, enables Kubernetes audit logs as a data source for [Kubernetes protection](https://docs.aws.amazon.com/guardduty/latest/ug/kubernetes-protection.html).
+  Defaults to `true`.
+
+### Malware Protection
+
+`malwareProtection` block supports the following:
+
+* `scanEc2InstanceWithFindings` - (Required) Configure whether [Malware Protection](https://docs.aws.amazon.com/guardduty/latest/ug/malware-protection.html) for EC2 instances with findings should be auto-enabled for new members joining the organization.
+   See [Scan EC2 instance with findings](#scan-ec2-instance-with-findings) below for more details.
+
+#### Scan EC2 instance with findings
+
+The `scanEc2InstanceWithFindings` block supports the following:
+
+* `ebsVolumes` - (Required) Configure whether scanning EBS volumes should be auto-enabled for new members joining the organization
+  See [EBS volumes](#ebs-volumes) below for more details.
+
+#### EBS volumes
+
+The `ebsVolumes` block supports the following:
+
+* `autoEnable` - (Required) If true, enables [Malware Protection](https://docs.aws.amazon.com/guardduty/latest/ug/malware-protection.html) for all new accounts joining the organization.
+  Defaults to `true`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Identifier of the GuardDuty Detector.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import GuardDuty Organization Configurations using the GuardDuty Detector ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import GuardDuty Organization Configurations using the GuardDuty Detector ID. For example:
+
+```console
+% terraform import aws_guardduty_organization_configuration.example 00b00fd5aecc0ab60a708659477e9617
+```
+
+<!-- cache-key: cdktf-0.18.0 input-445f6fbfec553e986e4f75415b80de0e8cbed40dec40a9dd732c3ede81c717e3 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/guardduty_organization_configuration_feature.html.markdown b/website/docs/cdktf/typescript/r/guardduty_organization_configuration_feature.html.markdown
new file mode 100644
index 00000000000..b010957aa12
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/guardduty_organization_configuration_feature.html.markdown
@@ -0,0 +1,75 @@
+---
+subcategory: "GuardDuty"
+layout: "aws"
+page_title: "AWS: aws_guardduty_organization_configuration_feature"
+description: |-
+  Provides a resource to manage an Amazon GuardDuty organization configuration feature
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_guardduty_organization_configuration_feature
+
+Provides a resource to manage a single Amazon GuardDuty [organization configuration feature](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-features-activation-model.html#guardduty-features).
+
+~> **NOTE:** Deleting this resource does not disable the organization configuration feature, the resource in simply removed from state instead.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { GuarddutyDetector } from "./.gen/providers/aws/guardduty-detector";
+import { GuarddutyOrganizationConfigurationFeature } from "./.gen/providers/aws/guardduty-organization-configuration-feature";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new GuarddutyDetector(this, "example", {
+      enable: true,
+    });
+    new GuarddutyOrganizationConfigurationFeature(
+      this,
+      "eks_runtime_monitoring",
+      {
+        additionalConfiguration: [
+          {
+            autoEnable: "NEW",
+            name: "EKS_ADDON_MANAGEMENT",
+          },
+        ],
+        autoEnable: "ALL",
+        detectorId: example.id,
+        name: "EKS_RUNTIME_MONITORING",
+      }
+    );
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `autoEnable` - (Required) The status of the feature that is configured for the member accounts within the organization. Valid values: `new`, `all`, `none`.
+* `detectorId` - (Required) The ID of the detector that configures the delegated administrator.
+* `name` - (Required) The name of the feature that will be configured for the organization. Valid values: `s3DataEvents`, `eksAuditLogs`, `ebsMalwareProtection`, `rdsLoginEvents`, `eksRuntimeMonitoring`, `lambdaNetworkLogs`.
+* `additionalConfiguration` - (Optional) The additional information that will be configured for the organization See [below](#additional-configuration).
+
+### Additional Configuration
+
+The `additionalConfiguration` block supports the following:
+
+* `autoEnable` - (Required) The status of the additional configuration that will be configured for the organization. Valid values: `new`, `all`, `none`.
+* `name` - (Required) The name of the additional configuration that will be configured for the organization. Valid values: `eksAddonManagement`.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+<!-- cache-key: cdktf-0.18.0 input-af534c2b9dc87ad328aeada98eac41421489586c67758449e011a8a7d6b7e223 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/guardduty_publishing_destination.html.markdown b/website/docs/cdktf/typescript/r/guardduty_publishing_destination.html.markdown
new file mode 100644
index 00000000000..df1d92aac91
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/guardduty_publishing_destination.html.markdown
@@ -0,0 +1,176 @@
+---
+subcategory: "GuardDuty"
+layout: aws
+page_title: 'AWS: aws_guardduty_publishing_destination'
+description: Provides a resource to manage a GuardDuty PublishingDestination
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_guardduty_publishing_destination
+
+Provides a resource to manage a GuardDuty PublishingDestination. Requires an existing GuardDuty Detector.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCallerIdentity } from "./.gen/providers/aws/data-aws-caller-identity";
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { DataAwsRegion } from "./.gen/providers/aws/data-aws-region";
+import { GuarddutyDetector } from "./.gen/providers/aws/guardduty-detector";
+import { GuarddutyPublishingDestination } from "./.gen/providers/aws/guardduty-publishing-destination";
+import { KmsKey } from "./.gen/providers/aws/kms-key";
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketAcl } from "./.gen/providers/aws/s3-bucket-acl";
+import { S3BucketPolicy } from "./.gen/providers/aws/s3-bucket-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const testGd = new GuarddutyDetector(this, "test_gd", {
+      enable: true,
+    });
+    const gdBucket = new S3Bucket(this, "gd_bucket", {
+      bucket: "example",
+      forceDestroy: true,
+    });
+    new S3BucketAcl(this, "gd_bucket_acl", {
+      acl: "private",
+      bucket: gdBucket.id,
+    });
+    const current = new DataAwsCallerIdentity(this, "current", {});
+    const bucketPol = new DataAwsIamPolicyDocument(this, "bucket_pol", {
+      statement: [
+        {
+          actions: ["s3:PutObject"],
+          principals: [
+            {
+              identifiers: ["guardduty.amazonaws.com"],
+              type: "Service",
+            },
+          ],
+          resources: ["${" + gdBucket.arn + "}/*"],
+          sid: "Allow PutObject",
+        },
+        {
+          actions: ["s3:GetBucketLocation"],
+          principals: [
+            {
+              identifiers: ["guardduty.amazonaws.com"],
+              type: "Service",
+            },
+          ],
+          resources: [gdBucket.arn],
+          sid: "Allow GetBucketLocation",
+        },
+      ],
+    });
+    const dataAwsRegionCurrent = new DataAwsRegion(this, "current_5", {});
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsRegionCurrent.overrideLogicalId("current");
+    const gdBucketPolicy = new S3BucketPolicy(this, "gd_bucket_policy", {
+      bucket: gdBucket.id,
+      policy: Token.asString(bucketPol.json),
+    });
+    const kmsPol = new DataAwsIamPolicyDocument(this, "kms_pol", {
+      statement: [
+        {
+          actions: ["kms:GenerateDataKey"],
+          principals: [
+            {
+              identifiers: ["guardduty.amazonaws.com"],
+              type: "Service",
+            },
+          ],
+          resources: [
+            "arn:aws:kms:${" +
+              dataAwsRegionCurrent.name +
+              "}:${" +
+              current.accountId +
+              "}:key/*",
+          ],
+          sid: "Allow GuardDuty to encrypt findings",
+        },
+        {
+          actions: ["kms:*"],
+          principals: [
+            {
+              identifiers: ["arn:aws:iam::${" + current.accountId + "}:root"],
+              type: "AWS",
+            },
+          ],
+          resources: [
+            "arn:aws:kms:${" +
+              dataAwsRegionCurrent.name +
+              "}:${" +
+              current.accountId +
+              "}:key/*",
+          ],
+          sid: "Allow all users to modify/delete key (test only)",
+        },
+      ],
+    });
+    const gdKey = new KmsKey(this, "gd_key", {
+      deletionWindowInDays: 7,
+      description: "Temporary key for AccTest of TF",
+      policy: Token.asString(kmsPol.json),
+    });
+    new GuarddutyPublishingDestination(this, "test", {
+      dependsOn: [gdBucketPolicy],
+      destinationArn: gdBucket.arn,
+      detectorId: testGd.id,
+      kmsKeyArn: gdKey.arn,
+    });
+  }
+}
+
+```
+
+~> **Note:** Please do not use this simple example for Bucket-Policy and KMS Key Policy in a production environment. It is much too open for such a use-case. Refer to the AWS documentation here: https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_exportfindings.html
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `detectorId` - (Required) The detector ID of the GuardDuty.
+* `destinationArn` - (Required) The bucket arn and prefix under which the findings get exported. Bucket-ARN is required, the prefix is optional and will be `awsLogs/[accountId]/guardDuty/[region]/` if not provided
+* `kmsKeyArn` - (Required) The ARN of the KMS key used to encrypt GuardDuty findings. GuardDuty enforces this to be encrypted.
+* `destinationType`- (Optional) Currently there is only "S3" available as destination type which is also the default value
+
+~> **Note:** In case of missing permissions (S3 Bucket Policy _or_ KMS Key permissions) the resource will fail to create. If the permissions are changed after resource creation, this can be asked from the AWS API via the "DescribePublishingDestination" call (https://docs.aws.amazon.com/cli/latest/reference/guardduty/describe-publishing-destination.html).
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the GuardDuty PublishingDestination and the detector ID. Format: `<DetectorID>:<PublishingDestinationID>`
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import GuardDuty PublishingDestination using the master GuardDuty detector ID and PublishingDestinationID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import GuardDuty PublishingDestination using the master GuardDuty detector ID and PublishingDestinationID. For example:
+
+```console
+% terraform import aws_guardduty_publishing_destination.test a4b86f26fa42e7e7cf0d1c333ea77777:a4b86f27a0e464e4a7e0516d242f1234
+```
+
+<!-- cache-key: cdktf-0.18.0 input-62a290b6c0d879190b7ab5d6098de0abf59abd632ca625aa1c6a6b8f48e6ac47 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/guardduty_threatintelset.html.markdown b/website/docs/cdktf/typescript/r/guardduty_threatintelset.html.markdown
new file mode 100644
index 00000000000..a21561b9305
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/guardduty_threatintelset.html.markdown
@@ -0,0 +1,111 @@
+---
+subcategory: "GuardDuty"
+layout: aws
+page_title: 'AWS: aws_guardduty_threatintelset'
+description: Provides a resource to manage a GuardDuty ThreatIntelSet
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_guardduty_threatintelset
+
+Provides a resource to manage a GuardDuty ThreatIntelSet.
+
+~> **Note:** Currently in GuardDuty, users from member accounts cannot upload and further manage ThreatIntelSets. ThreatIntelSets that are uploaded by the primary account are imposed on GuardDuty functionality in its member accounts. See the [GuardDuty API Documentation](https://docs.aws.amazon.com/guardduty/latest/ug/create-threat-intel-set.html)
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { GuarddutyDetector } from "./.gen/providers/aws/guardduty-detector";
+import { GuarddutyThreatintelset } from "./.gen/providers/aws/guardduty-threatintelset";
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketAcl } from "./.gen/providers/aws/s3-bucket-acl";
+import { S3Object } from "./.gen/providers/aws/s3-object";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const primary = new GuarddutyDetector(this, "primary", {
+      enable: true,
+    });
+    const bucket = new S3Bucket(this, "bucket", {});
+    new S3BucketAcl(this, "bucket_acl", {
+      acl: "private",
+      bucket: bucket.id,
+    });
+    const myThreatIntelSet = new S3Object(this, "MyThreatIntelSet", {
+      acl: "public-read",
+      bucket: bucket.id,
+      content: "10.0.0.0/8\n\n",
+      key: "MyThreatIntelSet",
+    });
+    const awsGuarddutyThreatintelsetMyThreatIntelSet =
+      new GuarddutyThreatintelset(this, "MyThreatIntelSet_4", {
+        activate: true,
+        detectorId: primary.id,
+        format: "TXT",
+        location:
+          "https://s3.amazonaws.com/${" +
+          myThreatIntelSet.bucket +
+          "}/${" +
+          myThreatIntelSet.key +
+          "}",
+        name: "MyThreatIntelSet",
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsGuarddutyThreatintelsetMyThreatIntelSet.overrideLogicalId(
+      "MyThreatIntelSet"
+    );
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `activate` - (Required) Specifies whether GuardDuty is to start using the uploaded ThreatIntelSet.
+* `detectorId` - (Required) The detector ID of the GuardDuty.
+* `format` - (Required) The format of the file that contains the ThreatIntelSet. Valid values: `txt` | `stix` | `otxCsv` | `alienVault` | `proofPoint` | `fireEye`
+* `location` - (Required) The URI of the file that contains the ThreatIntelSet.
+* `name` - (Required) The friendly name to identify the ThreatIntelSet.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the GuardDuty ThreatIntelSet.
+* `id` - The ID of the GuardDuty ThreatIntelSet and the detector ID. Format: `<DetectorID>:<ThreatIntelSetID>`
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import GuardDuty ThreatIntelSet using the primary GuardDuty detector ID and ThreatIntelSetID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import GuardDuty ThreatIntelSet using the primary GuardDuty detector ID and ThreatIntelSetID. For example:
+
+```console
+% terraform import aws_guardduty_threatintelset.MyThreatIntelSet 00b00fd5aecc0ab60a708659477e9617:123456789012
+```
+
+<!-- cache-key: cdktf-0.18.0 input-cffb05b04bc89aa2a4faddb04a7472478095a1942cb1aa200f8f7a8b0848a9fd -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/iam_access_key.html.markdown b/website/docs/cdktf/typescript/r/iam_access_key.html.markdown
new file mode 100644
index 00000000000..68ffd2eb3ef
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/iam_access_key.html.markdown
@@ -0,0 +1,140 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_access_key"
+description: |-
+  Provides an IAM access key. This is a set of credentials that allow API requests to be made as an IAM user.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iam_access_key
+
+Provides an IAM access key. This is a set of credentials that allow API requests to be made as an IAM user.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformOutput, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { IamAccessKey } from "./.gen/providers/aws/iam-access-key";
+import { IamUser } from "./.gen/providers/aws/iam-user";
+import { IamUserPolicy } from "./.gen/providers/aws/iam-user-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const lb = new IamUser(this, "lb", {
+      name: "loadbalancer",
+      path: "/system/",
+    });
+    const lbRo = new DataAwsIamPolicyDocument(this, "lb_ro", {
+      statement: [
+        {
+          actions: ["ec2:Describe*"],
+          effect: "Allow",
+          resources: ["*"],
+        },
+      ],
+    });
+    const awsIamAccessKeyLb = new IamAccessKey(this, "lb_2", {
+      pgpKey: "keybase:some_person_that_exists",
+      user: lb.name,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamAccessKeyLb.overrideLogicalId("lb");
+    const awsIamUserPolicyLbRo = new IamUserPolicy(this, "lb_ro_3", {
+      name: "test",
+      policy: Token.asString(lbRo.json),
+      user: lb.name,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamUserPolicyLbRo.overrideLogicalId("lb_ro");
+    new TerraformOutput(this, "secret", {
+      value: awsIamAccessKeyLb.encryptedSecret,
+    });
+  }
+}
+
+```
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformOutput, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { IamAccessKey } from "./.gen/providers/aws/iam-access-key";
+import { IamUser } from "./.gen/providers/aws/iam-user";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const test = new IamUser(this, "test", {
+      name: "test",
+      path: "/test/",
+    });
+    const awsIamAccessKeyTest = new IamAccessKey(this, "test_1", {
+      user: test.name,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamAccessKeyTest.overrideLogicalId("test");
+    new TerraformOutput(this, "aws_iam_smtp_password_v4", {
+      value: awsIamAccessKeyTest.sesSmtpPasswordV4,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `pgpKey` - (Optional) Either a base-64 encoded PGP public key, or a keybase username in the form `keybase:somePersonThatExists`, for use in the `encryptedSecret` output attribute. If providing a base-64 encoded PGP public key, make sure to provide the "raw" version and not the "armored" one (e.g. avoid passing the `a` option to `gpg --export`).
+* `status` - (Optional) Access key status to apply. Defaults to `active`. Valid values are `active` and `inactive`.
+* `user` - (Required) IAM user to associate with this access key.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `createDate` - Date and time in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8) that the access key was created.
+* `encryptedSecret` - Encrypted secret, base64 encoded, if `pgpKey` was specified. This attribute is not available for imported resources. The encrypted secret may be decrypted using the command line, for example: `terraform output -raw encrypted_secret | base64 --decode | keybase pgp decrypt`.
+* `encryptedSesSmtpPasswordV4` - Encrypted SES SMTP password, base64 encoded, if `pgpKey` was specified. This attribute is not available for imported resources. The encrypted password may be decrypted using the command line, for example: `terraform output -raw encrypted_ses_smtp_password_v4 | base64 --decode | keybase pgp decrypt`.
+* `id` - Access key ID.
+* `keyFingerprint` - Fingerprint of the PGP key used to encrypt the secret. This attribute is not available for imported resources.
+* `secret` - Secret access key. This attribute is not available for imported resources. Note that this will be written to the state file. If you use this, please protect your backend state file judiciously. Alternatively, you may supply a `pgpKey` instead, which will prevent the secret from being stored in plaintext, at the cost of preventing the use of the secret key in automation.
+* `sesSmtpPasswordV4` - Secret access key converted into an SES SMTP password by applying [AWS's documented Sigv4 conversion algorithm](https://docs.aws.amazon.com/ses/latest/DeveloperGuide/smtp-credentials.html#smtp-credentials-convert). This attribute is not available for imported resources. As SigV4 is region specific, valid Provider regions are `apSouth1`, `apSoutheast2`, `euCentral1`, `euWest1`, `usEast1` and `usWest2`. See current [AWS SES regions](https://docs.aws.amazon.com/general/latest/gr/rande.html#ses_region).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IAM Access Keys using the identifier. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import IAM Access Keys using the identifier. For example:
+
+```console
+% terraform import aws_iam_access_key.example AKIA1234567890
+```
+
+Resource attributes such as `encryptedSecret`, `keyFingerprint`, `pgpKey`, `secret`, `sesSmtpPasswordV4`, and `encryptedSesSmtpPasswordV4` are not available for imported resources as this information cannot be read from the IAM API.
+
+<!-- cache-key: cdktf-0.18.0 input-d8b11bcbc6ed9d15b50dbb95fe354dd4fff5e472be0814f1548e8af45e078918 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/iam_account_alias.html.markdown b/website/docs/cdktf/typescript/r/iam_account_alias.html.markdown
new file mode 100644
index 00000000000..2a7973dd72a
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/iam_account_alias.html.markdown
@@ -0,0 +1,71 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_account_alias"
+description: |-
+  Manages the account alias for the AWS Account.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iam_account_alias
+
+-> **Note:** There is only a single account alias per AWS account.
+
+Manages the account alias for the AWS Account.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { IamAccountAlias } from "./.gen/providers/aws/iam-account-alias";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new IamAccountAlias(this, "alias", {
+      accountAlias: "my-account-alias",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `accountAlias` - (Required) The account alias
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import the current Account Alias using the `accountAlias`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import the current Account Alias using the `accountAlias`. For example:
+
+```console
+% terraform import aws_iam_account_alias.alias my-account-alias
+```
+
+<!-- cache-key: cdktf-0.18.0 input-72640126c5720d6095332215b1cee0a5afc0db674ccec0642c743d28f1d7ef16 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/iam_account_password_policy.html.markdown b/website/docs/cdktf/typescript/r/iam_account_password_policy.html.markdown
new file mode 100644
index 00000000000..c116c160159
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/iam_account_password_policy.html.markdown
@@ -0,0 +1,88 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_account_password_policy"
+description: |-
+  Manages Password Policy for the AWS Account.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iam_account_password_policy
+
+-> **Note:** There is only a single policy allowed per AWS account. An existing policy will be lost when using this resource as an effect of this limitation.
+
+Manages Password Policy for the AWS Account.
+See more about [Account Password Policy](http://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_passwords_account-policy.html)
+in the official AWS docs.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { IamAccountPasswordPolicy } from "./.gen/providers/aws/iam-account-password-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new IamAccountPasswordPolicy(this, "strict", {
+      allowUsersToChangePassword: true,
+      minimumPasswordLength: 8,
+      requireLowercaseCharacters: true,
+      requireNumbers: true,
+      requireSymbols: true,
+      requireUppercaseCharacters: true,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `allowUsersToChangePassword` - (Optional) Whether to allow users to change their own password
+* `hardExpiry` - (Optional) Whether users are prevented from setting a new password after their password has expired (i.e., require administrator reset)
+* `maxPasswordAge` - (Optional) The number of days that an user password is valid.
+* `minimumPasswordLength` - (Optional) Minimum length to require for user passwords.
+* `passwordReusePrevention` - (Optional) The number of previous passwords that users are prevented from reusing.
+* `requireLowercaseCharacters` - (Optional) Whether to require lowercase characters for user passwords.
+* `requireNumbers` - (Optional) Whether to require numbers for user passwords.
+* `requireSymbols` - (Optional) Whether to require symbols for user passwords.
+* `requireUppercaseCharacters` - (Optional) Whether to require uppercase characters for user passwords.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `expirePasswords` - Indicates whether passwords in the account expire. Returns `true` if `maxPasswordAge` contains a value greater than `0`. Returns `false` if it is `0` or _not present_.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IAM Account Password Policy using the word `iamAccountPasswordPolicy`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import IAM Account Password Policy using the word `iamAccountPasswordPolicy`. For example:
+
+```console
+% terraform import aws_iam_account_password_policy.strict iam-account-password-policy
+```
+
+<!-- cache-key: cdktf-0.18.0 input-bc08150f6477fe05b7c648840dff00a4154ffcf28a4c1cad6ceaf55d1d45f131 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/iam_group.html.markdown b/website/docs/cdktf/typescript/r/iam_group.html.markdown
new file mode 100644
index 00000000000..f7511bc9ca7
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/iam_group.html.markdown
@@ -0,0 +1,81 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_group"
+description: |-
+  Provides an IAM group.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iam_group
+
+Provides an IAM group.
+
+~> **NOTE on user management:** Using `awsIamGroupMembership` or `awsIamUserGroupMembership` resources in addition to manually managing user/group membership using the console may lead to configuration drift or conflicts. For this reason, it's recommended to either manage membership entirely with Terraform or entirely within the AWS console.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { IamGroup } from "./.gen/providers/aws/iam-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new IamGroup(this, "developers", {
+      name: "developers",
+      path: "/users/",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The group's name. The name must consist of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: `=,.@`. Group names are not distinguished by case. For example, you cannot create groups named both "ADMINS" and "admins".
+* `path` - (Optional, default "/") Path in which to create the group.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The group's ID.
+* `arn` - The ARN assigned by AWS for this group.
+* `name` - The group's name.
+* `path` - The path of the group in IAM.
+* `uniqueId` - The [unique ID][1] assigned by AWS.
+
+  [1]: https://docs.aws.amazon.com/IAM/latest/UserGuide/Using_Identifiers.html#GUIDs
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IAM Groups using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import IAM Groups using the `name`. For example:
+
+```console
+% terraform import aws_iam_group.developers developers
+```
+
+<!-- cache-key: cdktf-0.18.0 input-19922afba524eb368c46a00c530fc921f976515589b4b61def0e5a9b38c35831 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/iam_group_membership.html.markdown b/website/docs/cdktf/typescript/r/iam_group_membership.html.markdown
new file mode 100644
index 00000000000..10c32b48e06
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/iam_group_membership.html.markdown
@@ -0,0 +1,77 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_group_membership"
+description: |-
+  Provides a top level resource to manage IAM Group membership for IAM Users.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iam_group_membership
+
+~> **WARNING:** Multiple aws_iam_group_membership resources with the same group name will produce inconsistent behavior!
+
+Provides a top level resource to manage IAM Group membership for IAM Users. For
+more information on managing IAM Groups or IAM Users, see [IAM Groups][1] or
+[IAM Users][2]
+
+~> **Note:** `awsIamGroupMembership` will conflict with itself if used more than once with the same group. To non-exclusively manage the users in a group, see the
+[`awsIamUserGroupMembership` resource][3].
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { IamGroup } from "./.gen/providers/aws/iam-group";
+import { IamGroupMembership } from "./.gen/providers/aws/iam-group-membership";
+import { IamUser } from "./.gen/providers/aws/iam-user";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const group = new IamGroup(this, "group", {
+      name: "test-group",
+    });
+    const userOne = new IamUser(this, "user_one", {
+      name: "test-user",
+    });
+    const userTwo = new IamUser(this, "user_two", {
+      name: "test-user-two",
+    });
+    new IamGroupMembership(this, "team", {
+      group: group.name,
+      name: "tf-testing-group-membership",
+      users: [userOne.name, userTwo.name],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name to identify the Group Membership
+* `users` - (Required) A list of IAM User names to associate with the Group
+* `group` – (Required) The IAM Group name to attach the list of `users` to
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `name` - The name to identify the Group Membership
+* `users` - list of IAM User names
+* `group` – IAM Group name
+
+[1]: /docs/providers/aws/r/iam_group.html
+[2]: /docs/providers/aws/r/iam_user.html
+[3]: /docs/providers/aws/r/iam_user_group_membership.html
+
+<!-- cache-key: cdktf-0.18.0 input-a689283d8ede46a18e142c30b3c6d291ef7cbbe1e20ccd369bd2df00bb2f1499 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/iam_group_policy.html.markdown b/website/docs/cdktf/typescript/r/iam_group_policy.html.markdown
new file mode 100644
index 00000000000..43966ecdfb3
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/iam_group_policy.html.markdown
@@ -0,0 +1,97 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_group_policy"
+description: |-
+  Provides an IAM policy attached to a group.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iam_group_policy
+
+Provides an IAM policy attached to a group.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { IamGroup } from "./.gen/providers/aws/iam-group";
+import { IamGroupPolicy } from "./.gen/providers/aws/iam-group-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const myDevelopers = new IamGroup(this, "my_developers", {
+      name: "developers",
+      path: "/users/",
+    });
+    new IamGroupPolicy(this, "my_developer_policy", {
+      group: myDevelopers.name,
+      name: "my_developer_policy",
+      policy: Token.asString(
+        Fn.jsonencode({
+          Statement: [
+            {
+              Action: ["ec2:Describe*"],
+              Effect: "Allow",
+              Resource: "*",
+            },
+          ],
+          Version: "2012-10-17",
+        })
+      ),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `policy` - (Required) The policy document. This is a JSON formatted string. For more information about building IAM policy documents with Terraform, see the [AWS IAM Policy Document Guide](https://learn.hashicorp.com/terraform/aws/iam-policy)
+* `name` - (Optional) The name of the policy. If omitted, Terraform will
+assign a random, unique name.
+* `namePrefix` - (Optional) Creates a unique name beginning with the specified
+  prefix. Conflicts with `name`.
+* `group` - (Required) The IAM group to attach to the policy.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The group policy ID.
+* `group` - The group to which this policy applies.
+* `name` - The name of the policy.
+* `policy` - The policy document attached to the group.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IAM Group Policies using the `groupName:groupPolicyName`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import IAM Group Policies using the `groupName:groupPolicyName`. For example:
+
+```console
+% terraform import aws_iam_group_policy.mypolicy group_of_mypolicy_name:mypolicy_name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-5e50557b38027189b87fe0810dffacfa2a5e6acdca57bdc89c62e7ac5a8f3d50 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/iam_group_policy_attachment.html.markdown b/website/docs/cdktf/typescript/r/iam_group_policy_attachment.html.markdown
new file mode 100644
index 00000000000..b37a1060f14
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/iam_group_policy_attachment.html.markdown
@@ -0,0 +1,83 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_group_policy_attachment"
+description: |-
+  Attaches a Managed IAM Policy to an IAM group
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iam_group_policy_attachment
+
+Attaches a Managed IAM Policy to an IAM group
+
+~> **NOTE:** The usage of this resource conflicts with the `awsIamPolicyAttachment` resource and will permanently show a difference if both are defined.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { IamGroup } from "./.gen/providers/aws/iam-group";
+import { IamGroupPolicyAttachment } from "./.gen/providers/aws/iam-group-policy-attachment";
+import { IamPolicy } from "./.gen/providers/aws/iam-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const group = new IamGroup(this, "group", {
+      name: "test-group",
+    });
+    const policy = new IamPolicy(this, "policy", {
+      description: "A test policy",
+      name: "test-policy",
+      policy: "{ ... policy JSON ... }",
+    });
+    new IamGroupPolicyAttachment(this, "test-attach", {
+      group: group.name,
+      policyArn: policy.arn,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `group`  (Required) - The group the policy should be applied to
+* `policyArn`  (Required) - The ARN of the policy you want to apply
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IAM group policy attachments using the group name and policy arn separated by `/`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import IAM group policy attachments using the group name and policy arn separated by `/`. For example:
+
+```console
+% terraform import aws_iam_group_policy_attachment.test-attach test-group/arn:aws:iam::xxxxxxxxxxxx:policy/test-policy
+```
+
+<!-- cache-key: cdktf-0.18.0 input-3386ee59f151e68f1f49aa0bbe51aa6530bcb898108b669fb7540481f63c523b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/iam_group_policy_attachment.markdown b/website/docs/cdktf/typescript/r/iam_group_policy_attachment.markdown
new file mode 100644
index 00000000000..b37a1060f14
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/iam_group_policy_attachment.markdown
@@ -0,0 +1,83 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_group_policy_attachment"
+description: |-
+  Attaches a Managed IAM Policy to an IAM group
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iam_group_policy_attachment
+
+Attaches a Managed IAM Policy to an IAM group
+
+~> **NOTE:** The usage of this resource conflicts with the `awsIamPolicyAttachment` resource and will permanently show a difference if both are defined.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { IamGroup } from "./.gen/providers/aws/iam-group";
+import { IamGroupPolicyAttachment } from "./.gen/providers/aws/iam-group-policy-attachment";
+import { IamPolicy } from "./.gen/providers/aws/iam-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const group = new IamGroup(this, "group", {
+      name: "test-group",
+    });
+    const policy = new IamPolicy(this, "policy", {
+      description: "A test policy",
+      name: "test-policy",
+      policy: "{ ... policy JSON ... }",
+    });
+    new IamGroupPolicyAttachment(this, "test-attach", {
+      group: group.name,
+      policyArn: policy.arn,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `group`  (Required) - The group the policy should be applied to
+* `policyArn`  (Required) - The ARN of the policy you want to apply
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IAM group policy attachments using the group name and policy arn separated by `/`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import IAM group policy attachments using the group name and policy arn separated by `/`. For example:
+
+```console
+% terraform import aws_iam_group_policy_attachment.test-attach test-group/arn:aws:iam::xxxxxxxxxxxx:policy/test-policy
+```
+
+<!-- cache-key: cdktf-0.18.0 input-3386ee59f151e68f1f49aa0bbe51aa6530bcb898108b669fb7540481f63c523b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/iam_instance_profile.html.markdown b/website/docs/cdktf/typescript/r/iam_instance_profile.html.markdown
new file mode 100644
index 00000000000..02e0ccc47c5
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/iam_instance_profile.html.markdown
@@ -0,0 +1,103 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_instance_profile"
+description: |-
+  Provides an IAM instance profile.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iam_instance_profile
+
+Provides an IAM instance profile.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { IamInstanceProfile } from "./.gen/providers/aws/iam-instance-profile";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const assumeRole = new DataAwsIamPolicyDocument(this, "assume_role", {
+      statement: [
+        {
+          actions: ["sts:AssumeRole"],
+          effect: "Allow",
+          principals: [
+            {
+              identifiers: ["ec2.amazonaws.com"],
+              type: "Service",
+            },
+          ],
+        },
+      ],
+    });
+    const role = new IamRole(this, "role", {
+      assumeRolePolicy: Token.asString(assumeRole.json),
+      name: "test_role",
+      path: "/",
+    });
+    new IamInstanceProfile(this, "test_profile", {
+      name: "test_profile",
+      role: role.name,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are optional:
+
+* `name` - (Optional, Forces new resource) Name of the instance profile. If omitted, Terraform will assign a random, unique name. Conflicts with `namePrefix`. Can be a string of characters consisting of upper and lowercase alphanumeric characters and these special characters: `_`, `+`, `=`, `,`, `.`, `@`, `-`. Spaces are not allowed.
+* `namePrefix` - (Optional, Forces new resource) Creates a unique name beginning with the specified prefix. Conflicts with `name`.
+* `path` - (Optional, default "/") Path to the instance profile. For more information about paths, see [IAM Identifiers](https://docs.aws.amazon.com/IAM/latest/UserGuide/Using_Identifiers.html) in the IAM User Guide. Can be a string of characters consisting of either a forward slash (`/`) by itself or a string that must begin and end with forward slashes. Can include any ASCII character from the ! (\u0021) through the DEL character (\u007F), including most punctuation characters, digits, and upper and lowercase letters.
+* `role` - (Optional) Name of the role to add to the profile.
+* `tags` - (Optional) Map of resource tags for the IAM Instance Profile. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN assigned by AWS to the instance profile.
+* `createDate` - Creation timestamp of the instance profile.
+* `id` - Instance profile's ID.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `uniqueId` - [Unique ID][1] assigned by AWS.
+
+  [1]: https://docs.aws.amazon.com/IAM/latest/UserGuide/Using_Identifiers.html#GUIDs
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Instance Profiles using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Instance Profiles using the `name`. For example:
+
+```console
+% terraform import aws_iam_instance_profile.test_profile app-instance-profile-1
+```
+
+<!-- cache-key: cdktf-0.18.0 input-9284929ff4a8b7fdca667e6c3b83bbaacd7a03324ca86ba8dd74b6cd6b6ed7cd -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/iam_openid_connect_provider.html.markdown b/website/docs/cdktf/typescript/r/iam_openid_connect_provider.html.markdown
new file mode 100644
index 00000000000..984a19cee60
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/iam_openid_connect_provider.html.markdown
@@ -0,0 +1,79 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_openid_connect_provider"
+description: |-
+  Provides an IAM OpenID Connect provider.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iam_openid_connect_provider
+
+Provides an IAM OpenID Connect provider.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { IamOpenidConnectProvider } from "./.gen/providers/aws/iam-openid-connect-provider";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new IamOpenidConnectProvider(this, "default", {
+      clientIdList: [
+        "266362248691-342342xasdasdasda-apps.googleusercontent.com",
+      ],
+      thumbprintList: ["cf23df2207d99a74fbe169e3eba035e633b65d94"],
+      url: "https://accounts.google.com",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `url` - (Required) The URL of the identity provider. Corresponds to the _iss_ claim.
+* `clientIdList` - (Required) A list of client IDs (also known as audiences). When a mobile or web app registers with an OpenID Connect provider, they establish a value that identifies the application. (This is the value that's sent as the client_id parameter on OAuth requests.)
+* `thumbprintList` - (Required) A list of server certificate thumbprints for the OpenID Connect (OIDC) identity provider's server certificate(s).
+* `tags` - (Optional) Map of resource tags for the IAM OIDC provider. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN assigned by AWS for this provider.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IAM OpenID Connect Providers using the `arn`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import IAM OpenID Connect Providers using the `arn`. For example:
+
+```console
+% terraform import aws_iam_openid_connect_provider.default arn:aws:iam::123456789012:oidc-provider/accounts.google.com
+```
+
+<!-- cache-key: cdktf-0.18.0 input-33b7e2c218fb4d031c4c801faca746d16b9cc40881d30775314b91b34a9400be -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/iam_policy.html.markdown b/website/docs/cdktf/typescript/r/iam_policy.html.markdown
new file mode 100644
index 00000000000..f7a00ca1408
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/iam_policy.html.markdown
@@ -0,0 +1,98 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_policy"
+description: |-
+  Provides an IAM policy.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iam_policy
+
+Provides an IAM policy.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { IamPolicy } from "./.gen/providers/aws/iam-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new IamPolicy(this, "policy", {
+      description: "My test policy",
+      name: "test_policy",
+      path: "/",
+      policy: Token.asString(
+        Fn.jsonencode({
+          Statement: [
+            {
+              Action: ["ec2:Describe*"],
+              Effect: "Allow",
+              Resource: "*",
+            },
+          ],
+          Version: "2012-10-17",
+        })
+      ),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `description` - (Optional, Forces new resource) Description of the IAM policy.
+* `name` - (Optional, Forces new resource) The name of the policy. If omitted, Terraform will assign a random, unique name.
+* `namePrefix` - (Optional, Forces new resource) Creates a unique name beginning with the specified prefix. Conflicts with `name`.
+* `path` - (Optional, default "/") Path in which to create the policy.
+  See [IAM Identifiers](https://docs.aws.amazon.com/IAM/latest/UserGuide/Using_Identifiers.html) for more information.
+* `policy` - (Required) The policy document. This is a JSON formatted string. For more information about building AWS IAM policy documents with Terraform, see the [AWS IAM Policy Document Guide](https://learn.hashicorp.com/terraform/aws/iam-policy)
+* `tags` - (Optional) Map of resource tags for the IAM Policy. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ARN assigned by AWS to this policy.
+* `arn` - The ARN assigned by AWS to this policy.
+* `description` - The description of the policy.
+* `name` - The name of the policy.
+* `path` - The path of the policy in IAM.
+* `policy` - The policy document.
+* `policyId` - The policy's ID.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IAM Policies using the `arn`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import IAM Policies using the `arn`. For example:
+
+```console
+% terraform import aws_iam_policy.administrator arn:aws:iam::123456789012:policy/UsersManageOwnCredentials
+```
+
+<!-- cache-key: cdktf-0.18.0 input-2bcb7f3dcfa6d83ce1cbd25d9b62a51db1f0fa11161d9093fc0a960b5e42ffec -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/iam_policy_attachment.html.markdown b/website/docs/cdktf/typescript/r/iam_policy_attachment.html.markdown
new file mode 100644
index 00000000000..8f79256f842
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/iam_policy_attachment.html.markdown
@@ -0,0 +1,109 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_policy_attachment"
+description: |-
+  Attaches a Managed IAM Policy to user(s), role(s), and/or group(s)
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iam_policy_attachment
+
+Attaches a Managed IAM Policy to user(s), role(s), and/or group(s)
+
+!> **WARNING:** The aws_iam_policy_attachment resource creates **exclusive** attachments of IAM policies. Across the entire AWS account, all of the users/roles/groups to which a single policy is attached must be declared by a single aws_iam_policy_attachment resource. This means that even any users/roles/groups that have the attached policy via any other mechanism (including other Terraform resources) will have that attached policy revoked by this resource. Consider `awsIamRolePolicyAttachment`, `awsIamUserPolicyAttachment`, or `awsIamGroupPolicyAttachment` instead. These resources do not enforce exclusive attachment of an IAM policy.
+
+~> **NOTE:** The usage of this resource conflicts with the `awsIamGroupPolicyAttachment`, `awsIamRolePolicyAttachment`, and `awsIamUserPolicyAttachment` resources and will permanently show a difference if both are defined.
+
+~> **NOTE:** For a given role, this resource is incompatible with using the [`awsIamRole` resource](/docs/providers/aws/r/iam_role.html) `managedPolicyArns` argument. When using that argument and this resource, both will attempt to manage the role's managed policy attachments and Terraform will show a permanent difference.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { IamGroup } from "./.gen/providers/aws/iam-group";
+import { IamPolicy } from "./.gen/providers/aws/iam-policy";
+import { IamPolicyAttachment } from "./.gen/providers/aws/iam-policy-attachment";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+import { IamUser } from "./.gen/providers/aws/iam-user";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const group = new IamGroup(this, "group", {
+      name: "test-group",
+    });
+    const user = new IamUser(this, "user", {
+      name: "test-user",
+    });
+    const assumeRole = new DataAwsIamPolicyDocument(this, "assume_role", {
+      statement: [
+        {
+          actions: ["sts:AssumeRole"],
+          effect: "Allow",
+          principals: [
+            {
+              identifiers: ["ec2.amazonaws.com"],
+              type: "Service",
+            },
+          ],
+        },
+      ],
+    });
+    const policy = new DataAwsIamPolicyDocument(this, "policy", {
+      statement: [
+        {
+          actions: ["ec2:Describe*"],
+          effect: "Allow",
+          resources: ["*"],
+        },
+      ],
+    });
+    const awsIamPolicyPolicy = new IamPolicy(this, "policy_4", {
+      description: "A test policy",
+      name: "test-policy",
+      policy: Token.asString(policy.json),
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamPolicyPolicy.overrideLogicalId("policy");
+    const role = new IamRole(this, "role", {
+      assumeRolePolicy: Token.asString(assumeRole.json),
+      name: "test-role",
+    });
+    new IamPolicyAttachment(this, "test-attach", {
+      groups: [group.name],
+      name: "test-attachment",
+      policyArn: Token.asString(awsIamPolicyPolicy.arn),
+      roles: [role.name],
+      users: [user.name],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name`    (Required) - The name of the attachment. This cannot be an empty string.
+* `users`   (Optional) - The user(s) the policy should be applied to
+* `roles`   (Optional) - The role(s) the policy should be applied to
+* `groups`  (Optional) - The group(s) the policy should be applied to
+* `policyArn`  (Required) - The ARN of the policy you want to apply
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The policy's ID.
+* `name` - The name of the attachment.
+
+<!-- cache-key: cdktf-0.18.0 input-c752eb701a68e4598f3a6661db2c072cd7097ba8d948dc18d4d1833423b0719c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/iam_role.html.markdown b/website/docs/cdktf/typescript/r/iam_role.html.markdown
new file mode 100644
index 00000000000..3e90ceea06d
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/iam_role.html.markdown
@@ -0,0 +1,330 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_role"
+description: |-
+  Provides an IAM role.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iam_role
+
+Provides an IAM role.
+
+~> **NOTE:** If policies are attached to the role via the [`awsIamPolicyAttachment` resource](/docs/providers/aws/r/iam_policy_attachment.html) and you are modifying the role `name` or `path`, the `forceDetachPolicies` argument must be set to `true` and applied before attempting the operation otherwise you will encounter a `deleteConflict` error. The [`awsIamRolePolicyAttachment` resource (recommended)](/docs/providers/aws/r/iam_role_policy_attachment.html) does not have this requirement.
+
+~> **NOTE:** If you use this resource's `managedPolicyArns` argument or `inlinePolicy` configuration blocks, this resource will take over exclusive management of the role's respective policy types (e.g., both policy types if both arguments are used). These arguments are incompatible with other ways of managing a role's policies, such as [`awsIamPolicyAttachment`](/docs/providers/aws/r/iam_policy_attachment.html), [`awsIamRolePolicyAttachment`](/docs/providers/aws/r/iam_role_policy_attachment.html), and [`awsIamRolePolicy`](/docs/providers/aws/r/iam_role_policy.html). If you attempt to manage a role's policies by multiple means, you will get resource cycling and/or errors.
+
+## Example Usage
+
+### Basic Example
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { IamRole } from "./.gen/providers/aws/iam-role";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new IamRole(this, "test_role", {
+      assumeRolePolicy: Token.asString(
+        Fn.jsonencode({
+          Statement: [
+            {
+              Action: "sts:AssumeRole",
+              Effect: "Allow",
+              Principal: {
+                Service: "ec2.amazonaws.com",
+              },
+              Sid: "",
+            },
+          ],
+          Version: "2012-10-17",
+        })
+      ),
+      name: "test_role",
+      tags: {
+        "tag-key": "tag-value",
+      },
+    });
+  }
+}
+
+```
+
+### Example of Using Data Source for Assume Role Policy
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const instanceAssumeRolePolicy = new DataAwsIamPolicyDocument(
+      this,
+      "instance_assume_role_policy",
+      {
+        statement: [
+          {
+            actions: ["sts:AssumeRole"],
+            principals: [
+              {
+                identifiers: ["ec2.amazonaws.com"],
+                type: "Service",
+              },
+            ],
+          },
+        ],
+      }
+    );
+    new IamRole(this, "instance", {
+      assumeRolePolicy: Token.asString(instanceAssumeRolePolicy.json),
+      name: "instance_role",
+      path: "/system/",
+    });
+  }
+}
+
+```
+
+### Example of Exclusive Inline Policies
+
+This example creates an IAM role with two inline IAM policies. If someone adds another inline policy out-of-band, on the next apply, Terraform will remove that policy. If someone deletes these policies out-of-band, Terraform will recreate them.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, Fn, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const inlinePolicy = new DataAwsIamPolicyDocument(this, "inline_policy", {
+      statement: [
+        {
+          actions: ["ec2:DescribeAccountAttributes"],
+          resources: ["*"],
+        },
+      ],
+    });
+    new IamRole(this, "example", {
+      assumeRolePolicy: Token.asString(instanceAssumeRolePolicy.json),
+      inlinePolicy: [
+        {
+          name: "my_inline_policy",
+          policy: Token.asString(
+            Fn.jsonencode({
+              Statement: [
+                {
+                  Action: ["ec2:Describe*"],
+                  Effect: "Allow",
+                  Resource: "*",
+                },
+              ],
+              Version: "2012-10-17",
+            })
+          ),
+        },
+        {
+          name: "policy-8675309",
+          policy: Token.asString(inlinePolicy.json),
+        },
+      ],
+      name: "yak_role",
+    });
+  }
+}
+
+```
+
+### Example of Removing Inline Policies
+
+This example creates an IAM role with what appears to be empty IAM `inlinePolicy` argument instead of using `inlinePolicy` as a configuration block. The result is that if someone were to add an inline policy out-of-band, on the next apply, Terraform will remove that policy.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { IamRole } from "./.gen/providers/aws/iam-role";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new IamRole(this, "example", {
+      assumeRolePolicy: Token.asString(instanceAssumeRolePolicy.json),
+      inlinePolicy: [{}],
+      name: "yak_role",
+    });
+  }
+}
+
+```
+
+### Example of Exclusive Managed Policies
+
+This example creates an IAM role and attaches two managed IAM policies. If someone attaches another managed policy out-of-band, on the next apply, Terraform will detach that policy. If someone detaches these policies out-of-band, Terraform will attach them again.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { IamPolicy } from "./.gen/providers/aws/iam-policy";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const policyOne = new IamPolicy(this, "policy_one", {
+      name: "policy-618033",
+      policy: Token.asString(
+        Fn.jsonencode({
+          Statement: [
+            {
+              Action: ["ec2:Describe*"],
+              Effect: "Allow",
+              Resource: "*",
+            },
+          ],
+          Version: "2012-10-17",
+        })
+      ),
+    });
+    const policyTwo = new IamPolicy(this, "policy_two", {
+      name: "policy-381966",
+      policy: Token.asString(
+        Fn.jsonencode({
+          Statement: [
+            {
+              Action: ["s3:ListAllMyBuckets", "s3:ListBucket", "s3:HeadBucket"],
+              Effect: "Allow",
+              Resource: "*",
+            },
+          ],
+          Version: "2012-10-17",
+        })
+      ),
+    });
+    new IamRole(this, "example", {
+      assumeRolePolicy: Token.asString(instanceAssumeRolePolicy.json),
+      managedPolicyArns: [policyOne.arn, policyTwo.arn],
+      name: "yak_role",
+    });
+  }
+}
+
+```
+
+### Example of Removing Managed Policies
+
+This example creates an IAM role with an empty `managedPolicyArns` argument. If someone attaches a policy out-of-band, on the next apply, Terraform will detach that policy.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { IamRole } from "./.gen/providers/aws/iam-role";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new IamRole(this, "example", {
+      assumeRolePolicy: Token.asString(instanceAssumeRolePolicy.json),
+      managedPolicyArns: [],
+      name: "yak_role",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following argument is required:
+
+* `assumeRolePolicy` - (Required) Policy that grants an entity permission to assume the role.
+
+~> **NOTE:** The `assumeRolePolicy` is very similar to but slightly different than a standard IAM policy and cannot use an `awsIamPolicy` resource.  However, it _can_ use an `awsIamPolicyDocument` [data source](/docs/providers/aws/d/iam_policy_document.html). See the example above of how this works.
+
+The following arguments are optional:
+
+* `description` - (Optional) Description of the role.
+* `forceDetachPolicies` - (Optional) Whether to force detaching any policies the role has before destroying it. Defaults to `false`.
+* `inlinePolicy` - (Optional) Configuration block defining an exclusive set of IAM inline policies associated with the IAM role. See below. If no blocks are configured, Terraform will not manage any inline policies in this resource. Configuring one empty block (i.e., `inline_policy {}`) will cause Terraform to remove _all_ inline policies added out of band on `apply`.
+* `managedPolicyArns` - (Optional) Set of exclusive IAM managed policy ARNs to attach to the IAM role. If this attribute is not configured, Terraform will ignore policy attachments to this resource. When configured, Terraform will align the role's managed policy attachments with this set by attaching or detaching managed policies. Configuring an empty set (i.e., `managed_policy_arns = []`) will cause Terraform to remove _all_ managed policy attachments.
+* `maxSessionDuration` - (Optional) Maximum session duration (in seconds) that you want to set for the specified role. If you do not specify a value for this setting, the default maximum of one hour is applied. This setting can have a value from 1 hour to 12 hours.
+* `name` - (Optional, Forces new resource) Friendly name of the role. If omitted, Terraform will assign a random, unique name. See [IAM Identifiers](https://docs.aws.amazon.com/IAM/latest/UserGuide/Using_Identifiers.html) for more information.
+* `namePrefix` - (Optional, Forces new resource) Creates a unique friendly name beginning with the specified prefix. Conflicts with `name`.
+* `path` - (Optional) Path to the role. See [IAM Identifiers](https://docs.aws.amazon.com/IAM/latest/UserGuide/Using_Identifiers.html) for more information.
+* `permissionsBoundary` - (Optional) ARN of the policy that is used to set the permissions boundary for the role.
+* `tags` - Key-value mapping of tags for the IAM role. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### inline_policy
+
+This configuration block supports the following:
+
+~> **NOTE:** Since one empty block (i.e., `inline_policy {}`) is valid syntactically to remove out of band policies on `apply`, `name` and `policy` are technically _optional_. However, they are both _required_ in order to manage actual inline policies. Not including one or the other may not result in Terraform errors but will result in unpredictable and incorrect behavior.
+
+* `name` - (Required) Name of the role policy.
+* `policy` - (Required) Policy document as a JSON formatted string. For more information about building IAM policy documents with Terraform, see the [AWS IAM Policy Document Guide](https://learn.hashicorp.com/tutorials/terraform/aws-iam-policy).
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) specifying the role.
+* `createDate` - Creation date of the IAM role.
+* `id` - Name of the role.
+* `name` - Name of the role.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `uniqueId` - Stable and unique string identifying the role.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IAM Roles using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import IAM Roles using the `name`. For example:
+
+```console
+% terraform import aws_iam_role.developer developer_name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-bd6124ae737c542517c52e9bbb2eb3419c7ff3714d8593c811602ba81fff4809 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/iam_role_policy.html.markdown b/website/docs/cdktf/typescript/r/iam_role_policy.html.markdown
new file mode 100644
index 00000000000..b1b3ff384e3
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/iam_role_policy.html.markdown
@@ -0,0 +1,113 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_role_policy"
+description: |-
+  Provides an IAM role policy.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iam_role_policy
+
+Provides an IAM role inline policy.
+
+~> **NOTE:** For a given role, this resource is incompatible with using the [`awsIamRole` resource](/docs/providers/aws/r/iam_role.html) `inlinePolicy` argument. When using that argument and this resource, both will attempt to manage the role's inline policies and Terraform will show a permanent difference.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { IamRole } from "./.gen/providers/aws/iam-role";
+import { IamRolePolicy } from "./.gen/providers/aws/iam-role-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const testRole = new IamRole(this, "test_role", {
+      assumeRolePolicy: Token.asString(
+        Fn.jsonencode({
+          Statement: [
+            {
+              Action: "sts:AssumeRole",
+              Effect: "Allow",
+              Principal: {
+                Service: "ec2.amazonaws.com",
+              },
+              Sid: "",
+            },
+          ],
+          Version: "2012-10-17",
+        })
+      ),
+      name: "test_role",
+    });
+    new IamRolePolicy(this, "test_policy", {
+      name: "test_policy",
+      policy: Token.asString(
+        Fn.jsonencode({
+          Statement: [
+            {
+              Action: ["ec2:Describe*"],
+              Effect: "Allow",
+              Resource: "*",
+            },
+          ],
+          Version: "2012-10-17",
+        })
+      ),
+      role: testRole.id,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Optional) The name of the role policy. If omitted, Terraform will
+assign a random, unique name.
+* `namePrefix` - (Optional) Creates a unique name beginning with the specified
+  prefix. Conflicts with `name`.
+* `policy` - (Required) The inline policy document. This is a JSON formatted string. For more information about building IAM policy documents with Terraform, see the [AWS IAM Policy Document Guide](https://learn.hashicorp.com/terraform/aws/iam-policy)
+* `role` - (Required) The name of the IAM role to attach to the policy.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The role policy ID, in the form of `roleName:rolePolicyName`.
+* `name` - The name of the policy.
+* `policy` - The policy document attached to the role.
+* `role` - The name of the role associated with the policy.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IAM Role Policies using the `roleName:rolePolicyName`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import IAM Role Policies using the `roleName:rolePolicyName`. For example:
+
+```console
+% terraform import aws_iam_role_policy.mypolicy role_of_mypolicy_name:mypolicy_name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-9dd1f967613333456f478e1f20726a88afa276e76829289fff1efaec15c03f59 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/iam_role_policy_attachment.html.markdown b/website/docs/cdktf/typescript/r/iam_role_policy_attachment.html.markdown
new file mode 100644
index 00000000000..c7ea8887db7
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/iam_role_policy_attachment.html.markdown
@@ -0,0 +1,112 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_role_policy_attachment"
+description: |-
+  Attaches a Managed IAM Policy to an IAM role
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iam_role_policy_attachment
+
+Attaches a Managed IAM Policy to an IAM role
+
+~> **NOTE:** The usage of this resource conflicts with the `awsIamPolicyAttachment` resource and will permanently show a difference if both are defined.
+
+~> **NOTE:** For a given role, this resource is incompatible with using the [`awsIamRole` resource](/docs/providers/aws/r/iam_role.html) `managedPolicyArns` argument. When using that argument and this resource, both will attempt to manage the role's managed policy attachments and Terraform will show a permanent difference.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { IamPolicy } from "./.gen/providers/aws/iam-policy";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+import { IamRolePolicyAttachment } from "./.gen/providers/aws/iam-role-policy-attachment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const assumeRole = new DataAwsIamPolicyDocument(this, "assume_role", {
+      statement: [
+        {
+          actions: ["sts:AssumeRole"],
+          effect: "Allow",
+          principals: [
+            {
+              identifiers: ["ec2.amazonaws.com"],
+              type: "Service",
+            },
+          ],
+        },
+      ],
+    });
+    const policy = new DataAwsIamPolicyDocument(this, "policy", {
+      statement: [
+        {
+          actions: ["ec2:Describe*"],
+          effect: "Allow",
+          resources: ["*"],
+        },
+      ],
+    });
+    const awsIamPolicyPolicy = new IamPolicy(this, "policy_2", {
+      description: "A test policy",
+      name: "test-policy",
+      policy: Token.asString(policy.json),
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamPolicyPolicy.overrideLogicalId("policy");
+    const role = new IamRole(this, "role", {
+      assumeRolePolicy: Token.asString(assumeRole.json),
+      name: "test-role",
+    });
+    new IamRolePolicyAttachment(this, "test-attach", {
+      policyArn: Token.asString(awsIamPolicyPolicy.arn),
+      role: role.name,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `role`  (Required) - The name of the IAM role to which the policy should be applied
+* `policyArn` (Required) - The ARN of the policy you want to apply
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IAM role policy attachments using the role name and policy arn separated by `/`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import IAM role policy attachments using the role name and policy arn separated by `/`. For example:
+
+```console
+% terraform import aws_iam_role_policy_attachment.test-attach test-role/arn:aws:iam::xxxxxxxxxxxx:policy/test-policy
+```
+
+<!-- cache-key: cdktf-0.18.0 input-8fa8f1d0aab28daaa2f2296516256e63edd3a1f444a588a760d3d43847fd78f4 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/iam_role_policy_attachment.markdown b/website/docs/cdktf/typescript/r/iam_role_policy_attachment.markdown
new file mode 100644
index 00000000000..c7ea8887db7
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/iam_role_policy_attachment.markdown
@@ -0,0 +1,112 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_role_policy_attachment"
+description: |-
+  Attaches a Managed IAM Policy to an IAM role
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iam_role_policy_attachment
+
+Attaches a Managed IAM Policy to an IAM role
+
+~> **NOTE:** The usage of this resource conflicts with the `awsIamPolicyAttachment` resource and will permanently show a difference if both are defined.
+
+~> **NOTE:** For a given role, this resource is incompatible with using the [`awsIamRole` resource](/docs/providers/aws/r/iam_role.html) `managedPolicyArns` argument. When using that argument and this resource, both will attempt to manage the role's managed policy attachments and Terraform will show a permanent difference.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { IamPolicy } from "./.gen/providers/aws/iam-policy";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+import { IamRolePolicyAttachment } from "./.gen/providers/aws/iam-role-policy-attachment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const assumeRole = new DataAwsIamPolicyDocument(this, "assume_role", {
+      statement: [
+        {
+          actions: ["sts:AssumeRole"],
+          effect: "Allow",
+          principals: [
+            {
+              identifiers: ["ec2.amazonaws.com"],
+              type: "Service",
+            },
+          ],
+        },
+      ],
+    });
+    const policy = new DataAwsIamPolicyDocument(this, "policy", {
+      statement: [
+        {
+          actions: ["ec2:Describe*"],
+          effect: "Allow",
+          resources: ["*"],
+        },
+      ],
+    });
+    const awsIamPolicyPolicy = new IamPolicy(this, "policy_2", {
+      description: "A test policy",
+      name: "test-policy",
+      policy: Token.asString(policy.json),
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamPolicyPolicy.overrideLogicalId("policy");
+    const role = new IamRole(this, "role", {
+      assumeRolePolicy: Token.asString(assumeRole.json),
+      name: "test-role",
+    });
+    new IamRolePolicyAttachment(this, "test-attach", {
+      policyArn: Token.asString(awsIamPolicyPolicy.arn),
+      role: role.name,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `role`  (Required) - The name of the IAM role to which the policy should be applied
+* `policyArn` (Required) - The ARN of the policy you want to apply
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IAM role policy attachments using the role name and policy arn separated by `/`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import IAM role policy attachments using the role name and policy arn separated by `/`. For example:
+
+```console
+% terraform import aws_iam_role_policy_attachment.test-attach test-role/arn:aws:iam::xxxxxxxxxxxx:policy/test-policy
+```
+
+<!-- cache-key: cdktf-0.18.0 input-8fa8f1d0aab28daaa2f2296516256e63edd3a1f444a588a760d3d43847fd78f4 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/iam_saml_provider.html.markdown b/website/docs/cdktf/typescript/r/iam_saml_provider.html.markdown
new file mode 100644
index 00000000000..9303d7c6d5c
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/iam_saml_provider.html.markdown
@@ -0,0 +1,76 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_saml_provider"
+description: |-
+  Provides an IAM SAML provider.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iam_saml_provider
+
+Provides an IAM SAML provider.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { IamSamlProvider } from "./.gen/providers/aws/iam-saml-provider";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new IamSamlProvider(this, "default", {
+      name: "myprovider",
+      samlMetadataDocument: Token.asString(Fn.file("saml-metadata.xml")),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the provider to create.
+* `samlMetadataDocument` - (Required) An XML document generated by an identity provider that supports SAML 2.0.
+* `tags` - (Optional) Map of resource tags for the IAM SAML provider. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN assigned by AWS for this provider.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `validUntil` - The expiration date and time for the SAML provider in RFC1123 format, e.g., `Mon, 02 Jan 2006 15:04:05 MST`.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IAM SAML Providers using the `arn`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import IAM SAML Providers using the `arn`. For example:
+
+```console
+% terraform import aws_iam_saml_provider.default arn:aws:iam::123456789012:saml-provider/SAMLADFS
+```
+
+<!-- cache-key: cdktf-0.18.0 input-e9450a2287d5fbbd96a01461a632b203b4d1d9ef618d8b90a0586e0b7762feb9 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/iam_security_token_service_preferences.html.markdown b/website/docs/cdktf/typescript/r/iam_security_token_service_preferences.html.markdown
new file mode 100644
index 00000000000..3d69a33ca99
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/iam_security_token_service_preferences.html.markdown
@@ -0,0 +1,49 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_security_token_service_preferences"
+description: |-
+  Provides an IAM Security Token Service Preferences resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iam_security_token_service_preferences
+
+Provides an IAM Security Token Service Preferences resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { IamSecurityTokenServicePreferences } from "./.gen/providers/aws/iam-security-token-service-preferences";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new IamSecurityTokenServicePreferences(this, "example", {
+      globalEndpointTokenVersion: "v2Token",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `globalEndpointTokenVersion` - (Required) The version of the STS global endpoint token. Valid values: `v1Token`, `v2Token`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The AWS Account ID.
+
+<!-- cache-key: cdktf-0.18.0 input-5fa3e32fa1a3cba47282a6eace02bd69c18b12299e55edef17829e4f27fde210 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/iam_server_certificate.html.markdown b/website/docs/cdktf/typescript/r/iam_server_certificate.html.markdown
new file mode 100644
index 00000000000..b3a9b52fef0
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/iam_server_certificate.html.markdown
@@ -0,0 +1,187 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_server_certificate"
+description: |-
+  Provides an IAM Server Certificate
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iam_server_certificate
+
+Provides an IAM Server Certificate resource to upload Server Certificates.
+Certs uploaded to IAM can easily work with other AWS services such as:
+
+- AWS Elastic Beanstalk
+- Elastic Load Balancing
+- CloudFront
+- AWS OpsWorks
+
+For information about server certificates in IAM, see [Managing Server
+Certificates][2] in AWS Documentation.
+
+~> **Note:** All arguments including the private key will be stored in the raw state as plain-text.
+[Read more about sensitive data in state](https://www.terraform.io/docs/state/sensitive-data.html).
+
+## Example Usage
+
+**Using certs on file:**
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { IamServerCertificate } from "./.gen/providers/aws/iam-server-certificate";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new IamServerCertificate(this, "test_cert", {
+      certificateBody: Token.asString(Fn.file("self-ca-cert.pem")),
+      name: "some_test_cert",
+      privateKey: Token.asString(Fn.file("test-key.pem")),
+    });
+  }
+}
+
+```
+
+**Example with cert in-line:**
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { IamServerCertificate } from "./.gen/providers/aws/iam-server-certificate";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new IamServerCertificate(this, "test_cert_alt", {
+      certificateBody:
+        "-----BEGIN CERTIFICATE-----\n[......] # cert contents\n-----END CERTIFICATE-----\n\n",
+      name: "alt_test_cert",
+      privateKey:
+        "-----BEGIN RSA PRIVATE KEY-----\n[......] # cert contents\n-----END RSA PRIVATE KEY-----\n\n",
+    });
+  }
+}
+
+```
+
+**Use in combination with an AWS ELB resource:**
+
+Some properties of an IAM Server Certificates cannot be updated while they are
+in use. In order for Terraform to effectively manage a Certificate in this situation, it is
+recommended you utilize the `namePrefix` attribute and enable the
+`createBeforeDestroy` [lifecycle block][lifecycle]. This will allow Terraform
+to create a new, updated `awsIamServerCertificate` resource and replace it in
+dependant resources before attempting to destroy the old version.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Elb } from "./.gen/providers/aws/elb";
+import { IamServerCertificate } from "./.gen/providers/aws/iam-server-certificate";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const testCert = new IamServerCertificate(this, "test_cert", {
+      certificateBody: Token.asString(Fn.file("self-ca-cert.pem")),
+      lifecycle: {
+        createBeforeDestroy: true,
+      },
+      namePrefix: "example-cert",
+      privateKey: Token.asString(Fn.file("test-key.pem")),
+    });
+    new Elb(this, "ourapp", {
+      availabilityZones: ["us-west-2a"],
+      crossZoneLoadBalancing: true,
+      listener: [
+        {
+          instancePort: 8000,
+          instanceProtocol: "http",
+          lbPort: 443,
+          lbProtocol: "https",
+          sslCertificateId: testCert.arn,
+        },
+      ],
+      name: "terraform-asg-deployment-example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Optional) The name of the Server Certificate. Do not include the
+  path in this value. If omitted, Terraform will assign a random, unique name.
+* `namePrefix` - (Optional) Creates a unique name beginning with the specified
+  prefix. Conflicts with `name`.
+* `certificateBody` – (Required) The contents of the public key certificate in
+  PEM-encoded format.
+* `certificateChain` – (Optional) The contents of the certificate chain.
+  This is typically a concatenation of the PEM-encoded public key certificates
+  of the chain.
+* `privateKey` – (Required) The contents of the private key in PEM-encoded format.
+* `path` - (Optional) The IAM path for the server certificate.  If it is not
+    included, it defaults to a slash (/). If this certificate is for use with
+    AWS CloudFront, the path must be in format `/cloudfront/yourPathHere`.
+    See [IAM Identifiers][1] for more details on IAM Paths.
+* `tags` - (Optional) Map of resource tags for the server certificate. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+~> **NOTE:** AWS performs behind-the-scenes modifications to some certificate files if they do not adhere to a specific format. These modifications will result in terraform forever believing that it needs to update the resources since the local and AWS file contents will not match after theses modifications occur. In order to prevent this from happening you must ensure that all your PEM-encoded files use UNIX line-breaks and that `certificateBody` contains only one certificate. All other certificates should go in `certificateChain`. It is common for some Certificate Authorities to issue certificate files that have DOS line-breaks and that are actually multiple certificates concatenated together in order to form a full certificate chain.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) specifying the server certificate.
+* `expiration` - Date and time in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8) on which the certificate is set to expire.
+* `id` - The unique Server Certificate name
+* `name` - The name of the Server Certificate
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `uploadDate` - Date and time in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8) when the server certificate was uploaded.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IAM Server Certificates using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import IAM Server Certificates using the `name`. For example:
+
+```console
+% terraform import aws_iam_server_certificate.certificate example.com-certificate-until-2018
+```
+
+[1]: https://docs.aws.amazon.com/IAM/latest/UserGuide/Using_Identifiers.html
+[2]: https://docs.aws.amazon.com/IAM/latest/UserGuide/ManagingServerCerts.html
+[lifecycle]: /docs/configuration/resources.html
+
+<!-- cache-key: cdktf-0.18.0 input-4e79a75d64fc823b8d2391e118523a861e5a2f30f4797410fdc70324a0c27272 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/iam_service_linked_role.html.markdown b/website/docs/cdktf/typescript/r/iam_service_linked_role.html.markdown
new file mode 100644
index 00000000000..e08bdd0a19c
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/iam_service_linked_role.html.markdown
@@ -0,0 +1,80 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_service_linked_role"
+description: |-
+  Provides an IAM service-linked role.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iam_service_linked_role
+
+Provides an [IAM service-linked role](https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { IamServiceLinkedRole } from "./.gen/providers/aws/iam-service-linked-role";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new IamServiceLinkedRole(this, "elasticbeanstalk", {
+      awsServiceName: "elasticbeanstalk.amazonaws.com",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `awsServiceName` - (Required, Forces new resource) The AWS service to which this role is attached. You use a string similar to a URL but without the `http://` in front. For example: `elasticbeanstalkAmazonawsCom`. To find the full list of services that support service-linked roles, check [the docs](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_aws-services-that-work-with-iam.html).
+* `customSuffix` - (Optional, forces new resource) Additional string appended to the role name. Not all AWS services support custom suffixes.
+* `description` - (Optional) The description of the role.
+* `tags` - Key-value mapping of tags for the IAM role. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Amazon Resource Name (ARN) of the role.
+* `arn` - The Amazon Resource Name (ARN) specifying the role.
+* `createDate` - The creation date of the IAM role.
+* `name` - The name of the role.
+* `path` - The path of the role.
+* `uniqueId` - The stable and unique string identifying the role.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IAM service-linked roles using role ARN. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import IAM service-linked roles using role ARN. For example:
+
+```console
+% terraform import aws_iam_service_linked_role.elasticbeanstalk arn:aws:iam::123456789012:role/aws-service-role/elasticbeanstalk.amazonaws.com/AWSServiceRoleForElasticBeanstalk
+```
+
+<!-- cache-key: cdktf-0.18.0 input-53b8bf0058bf16f68c2476ca78ddb88722c438f564338bbb9af9fab3c2d80462 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/iam_service_specific_credential.html.markdown b/website/docs/cdktf/typescript/r/iam_service_specific_credential.html.markdown
new file mode 100644
index 00000000000..547d399a6f4
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/iam_service_specific_credential.html.markdown
@@ -0,0 +1,84 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_service_specific_credential"
+description: |-
+  Provides an IAM Service Specific Credential.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iam_service_specific_credential
+
+Provides an IAM Service Specific Credential.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { IamServiceSpecificCredential } from "./.gen/providers/aws/iam-service-specific-credential";
+import { IamUser } from "./.gen/providers/aws/iam-user";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new IamUser(this, "example", {
+      name: "example",
+    });
+    const awsIamServiceSpecificCredentialExample =
+      new IamServiceSpecificCredential(this, "example_1", {
+        serviceName: "codecommit.amazonaws.com",
+        userName: example.name,
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamServiceSpecificCredentialExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `serviceName` - (Required) The name of the AWS service that is to be associated with the credentials. The service you specify here is the only service that can be accessed using these credentials.
+* `userName` - (Required) The name of the IAM user that is to be associated with the credentials. The new service-specific credentials have the same permissions as the associated user except that they can be used only to access the specified service.
+* `status` - (Optional) The status to be assigned to the service-specific credential. Valid values are `active` and `inactive`. Default value is `active`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The combination of `serviceName` and `userName` as such: `serviceName:userName:serviceSpecificCredentialId`.
+* `servicePassword` - The generated password for the service-specific credential.
+* `serviceUserName` - The generated user name for the service-specific credential. This value is generated by combining the IAM user's name combined with the ID number of the AWS account, as in `janeAt123456789012`, for example.
+* `serviceSpecificCredentialId` - The unique identifier for the service-specific credential.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IAM Service Specific Credentials using the `serviceName:userName:serviceSpecificCredentialId`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import IAM Service Specific Credentials using the `serviceName:userName:serviceSpecificCredentialId`. For example:
+
+```console
+% terraform import aws_iam_service_specific_credential.default `codecommit.amazonaws.com:example:some-id`
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1e83847adc046bae947086c436bc6f0c678e2771941ae818199da71c13912bb2 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/iam_signing_certificate.html.markdown b/website/docs/cdktf/typescript/r/iam_signing_certificate.html.markdown
new file mode 100644
index 00000000000..956410c950e
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/iam_signing_certificate.html.markdown
@@ -0,0 +1,112 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_signing_certificate"
+description: |-
+  Provides an IAM Signing Certificate
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iam_signing_certificate
+
+Provides an IAM Signing Certificate resource to upload Signing Certificates.
+
+~> **Note:** All arguments including the certificate body will be stored in the raw state as plain-text.
+[Read more about sensitive data in state](https://www.terraform.io/docs/state/sensitive-data.html).
+
+## Example Usage
+
+**Using certs on file:**
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { IamSigningCertificate } from "./.gen/providers/aws/iam-signing-certificate";
+interface MyConfig {
+  userName: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new IamSigningCertificate(this, "test_cert", {
+      certificateBody: Token.asString(Fn.file("self-ca-cert.pem")),
+      username: "some_test_cert",
+      userName: config.userName,
+    });
+  }
+}
+
+```
+
+**Example with cert in-line:**
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { IamSigningCertificate } from "./.gen/providers/aws/iam-signing-certificate";
+interface MyConfig {
+  userName: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new IamSigningCertificate(this, "test_cert_alt", {
+      certificateBody:
+        "-----BEGIN CERTIFICATE-----\n[......] # cert contents\n-----END CERTIFICATE-----\n\n",
+      username: "some_test_cert",
+      userName: config.userName,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `certificateBody` – (Required) The contents of the signing certificate in PEM-encoded format.
+* `status` – (Optional)  The status you want to assign to the certificate. `active` means that the certificate can be used for programmatic calls to Amazon Web Services `inactive` means that the certificate cannot be used.
+* `userName` – (Required) The name of the user the signing certificate is for.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `certificateId` - The ID for the signing certificate.
+* `id` - The `certificateId:userName`
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IAM Signing Certificates using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import IAM Signing Certificates using the `id`. For example:
+
+```console
+% terraform import aws_iam_signing_certificate.certificate IDIDIDIDID:user-name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-5dd149e4ec34690d2d3d0ad3b6a7ed2784cb04247b33fd1ab71da3b19a32535c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/iam_user.html.markdown b/website/docs/cdktf/typescript/r/iam_user.html.markdown
new file mode 100644
index 00000000000..d9d366158d6
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/iam_user.html.markdown
@@ -0,0 +1,112 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_user"
+description: |-
+  Provides an IAM user.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iam_user
+
+Provides an IAM user.
+
+~> *NOTE:* If policies are attached to the user via the [`awsIamPolicyAttachment` resource](/docs/providers/aws/r/iam_policy_attachment.html) and you are modifying the user `name` or `path`, the `forceDestroy` argument must be set to `true` and applied before attempting the operation otherwise you will encounter a `deleteConflict` error. The [`awsIamUserPolicyAttachment` resource (recommended)](/docs/providers/aws/r/iam_user_policy_attachment.html) does not have this requirement.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { IamAccessKey } from "./.gen/providers/aws/iam-access-key";
+import { IamUser } from "./.gen/providers/aws/iam-user";
+import { IamUserPolicy } from "./.gen/providers/aws/iam-user-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const lb = new IamUser(this, "lb", {
+      name: "loadbalancer",
+      path: "/system/",
+      tags: {
+        "tag-key": "tag-value",
+      },
+    });
+    const lbRo = new DataAwsIamPolicyDocument(this, "lb_ro", {
+      statement: [
+        {
+          actions: ["ec2:Describe*"],
+          effect: "Allow",
+          resources: ["*"],
+        },
+      ],
+    });
+    const awsIamAccessKeyLb = new IamAccessKey(this, "lb_2", {
+      user: lb.name,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamAccessKeyLb.overrideLogicalId("lb");
+    const awsIamUserPolicyLbRo = new IamUserPolicy(this, "lb_ro_3", {
+      name: "test",
+      policy: Token.asString(lbRo.json),
+      user: lb.name,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamUserPolicyLbRo.overrideLogicalId("lb_ro");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The user's name. The name must consist of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: `=,.@`. User names are not distinguished by case. For example, you cannot create users named both "TESTUSER" and "testuser".
+* `path` - (Optional, default "/") Path in which to create the user.
+* `permissionsBoundary` - (Optional) The ARN of the policy that is used to set the permissions boundary for the user.
+* `forceDestroy` - (Optional, default false) When destroying this user, destroy even if it
+  has non-Terraform-managed IAM access keys, login profile or MFA devices. Without `forceDestroy`
+  a user with non-Terraform-managed access keys and login profile will fail to be destroyed.
+* `tags` - Key-value map of tags for the IAM user. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN assigned by AWS for this user.
+* `name` - The user's name.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `uniqueId` - The [unique ID][1] assigned by AWS.
+
+  [1]: https://docs.aws.amazon.com/IAM/latest/UserGuide/Using_Identifiers.html#GUIDs
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IAM Users using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import IAM Users using the `name`. For example:
+
+```console
+% terraform import aws_iam_user.lb loadbalancer
+```
+
+<!-- cache-key: cdktf-0.18.0 input-7fa2a1117bc8c5d00748a3bbf9afeae418b9e72ed4e7d7c7c625a1d0f6a8b0b5 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/iam_user_group_membership.html.markdown b/website/docs/cdktf/typescript/r/iam_user_group_membership.html.markdown
new file mode 100644
index 00000000000..9d932aebe21
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/iam_user_group_membership.html.markdown
@@ -0,0 +1,99 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_user_group_membership"
+description: |-
+  Provides a resource for adding an IAM User to IAM Groups without conflicting
+  with itself.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iam_user_group_membership
+
+Provides a resource for adding an [IAM User][2] to [IAM Groups][1]. This
+resource can be used multiple times with the same user for non-overlapping
+groups.
+
+To exclusively manage the users in a group, see the
+[`awsIamGroupMembership` resource][3].
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { IamGroup } from "./.gen/providers/aws/iam-group";
+import { IamUser } from "./.gen/providers/aws/iam-user";
+import { IamUserGroupMembership } from "./.gen/providers/aws/iam-user-group-membership";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const group1 = new IamGroup(this, "group1", {
+      name: "group1",
+    });
+    const group2 = new IamGroup(this, "group2", {
+      name: "group2",
+    });
+    const group3 = new IamGroup(this, "group3", {
+      name: "group3",
+    });
+    const user1 = new IamUser(this, "user1", {
+      name: "user1",
+    });
+    new IamUserGroupMembership(this, "example1", {
+      groups: [group1.name, group2.name],
+      user: user1.name,
+    });
+    new IamUserGroupMembership(this, "example2", {
+      groups: [group3.name],
+      user: user1.name,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `user` - (Required) The name of the [IAM User][2] to add to groups
+* `groups` - (Required) A list of [IAM Groups][1] to add the user to
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+[1]: /docs/providers/aws/r/iam_group.html
+[2]: /docs/providers/aws/r/iam_user.html
+[3]: /docs/providers/aws/r/iam_group_membership.html
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IAM user group membership using the user name and group names separated by `/`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import IAM user group membership using the user name and group names separated by `/`. For example:
+
+```console
+% terraform import aws_iam_user_group_membership.example1 user1/group1/group2
+```
+
+<!-- cache-key: cdktf-0.18.0 input-14dd4765176954105a47943f6e53617581e2a060a1824a5c74af382ab83e177b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/iam_user_login_profile.html.markdown b/website/docs/cdktf/typescript/r/iam_user_login_profile.html.markdown
new file mode 100644
index 00000000000..32e3ba02420
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/iam_user_login_profile.html.markdown
@@ -0,0 +1,125 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_user_login_profile"
+description: |-
+  Manages an IAM User Login Profile
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iam_user_login_profile
+
+Manages an IAM User Login Profile with limited support for password creation during Terraform resource creation. Uses PGP to encrypt the password for safe transport to the user. PGP keys can be obtained from Keybase.
+
+-> To reset an IAM User login password via Terraform, you can use the [`terraform taint` command](https://www.terraform.io/docs/commands/taint.html) or change any of the arguments.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformOutput, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { IamUser } from "./.gen/providers/aws/iam-user";
+import { IamUserLoginProfile } from "./.gen/providers/aws/iam-user-login-profile";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new IamUser(this, "example", {
+      forceDestroy: true,
+      name: "example",
+      path: "/",
+    });
+    const awsIamUserLoginProfileExample = new IamUserLoginProfile(
+      this,
+      "example_1",
+      {
+        pgpKey: "keybase:some_person_that_exists",
+        user: example.name,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamUserLoginProfileExample.overrideLogicalId("example");
+    new TerraformOutput(this, "password", {
+      value: awsIamUserLoginProfileExample.encryptedPassword,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `user` - (Required) The IAM user's name.
+* `pgpKey` - (Optional) Either a base-64 encoded PGP public key, or a keybase username in the form `keybase:username`. Only applies on resource creation. Drift detection is not possible with this argument.
+* `passwordLength` - (Optional) The length of the generated password on resource creation. Only applies on resource creation. Drift detection is not possible with this argument. Default value is `20`.
+* `passwordResetRequired` - (Optional) Whether the user should be forced to reset the generated password on resource creation. Only applies on resource creation.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `password` - The plain text password, only available when `pgpKey` is not provided.
+* `keyFingerprint` - The fingerprint of the PGP key used to encrypt the password. Only available if password was handled on Terraform resource creation, not import.
+* `encryptedPassword` - The encrypted password, base64 encoded. Only available if password was handled on Terraform resource creation, not import.
+
+~> **NOTE:** The encrypted password may be decrypted using the command line,
+   for example: `terraform output password | base64 --decode | keybase pgp decrypt`.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IAM User Login Profiles without password information via the IAM User name. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import IAM User Login Profiles without password information via the IAM User name. For example:
+
+```console
+% terraform import aws_iam_user_login_profile.example myusername
+```
+
+Since Terraform has no method to read the PGP or password information during import, use the [Terraform resource `lifecycle` configuration block `ignoreChanges` argument](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html#ignore_changes) to ignore them (unless you want to recreate a password). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { IamUserLoginProfile } from "./.gen/providers/aws/iam-user-login-profile";
+interface MyConfig {
+  user: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new IamUserLoginProfile(this, "example", {
+      lifecycle: {
+        ignoreChanges: [passwordLength, passwordResetRequired, pgpKey],
+      },
+      user: config.user,
+    });
+  }
+}
+
+```
+
+<!-- cache-key: cdktf-0.18.0 input-332beff043f3f89a7086471e863d83e0d7a3e4995b3f2b9abe9a879fd8d3778f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/iam_user_policy.html.markdown b/website/docs/cdktf/typescript/r/iam_user_policy.html.markdown
new file mode 100644
index 00000000000..286de3f7cce
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/iam_user_policy.html.markdown
@@ -0,0 +1,99 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_user_policy"
+description: |-
+  Provides an IAM policy attached to a user.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iam_user_policy
+
+Provides an IAM policy attached to a user.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { IamAccessKey } from "./.gen/providers/aws/iam-access-key";
+import { IamUser } from "./.gen/providers/aws/iam-user";
+import { IamUserPolicy } from "./.gen/providers/aws/iam-user-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const lb = new IamUser(this, "lb", {
+      name: "loadbalancer",
+      path: "/system/",
+    });
+    new IamUserPolicy(this, "lb_ro", {
+      name: "test",
+      policy: Token.asString(
+        Fn.jsonencode({
+          Statement: [
+            {
+              Action: ["ec2:Describe*"],
+              Effect: "Allow",
+              Resource: "*",
+            },
+          ],
+          Version: "2012-10-17",
+        })
+      ),
+      user: lb.name,
+    });
+    const awsIamAccessKeyLb = new IamAccessKey(this, "lb_2", {
+      user: lb.name,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamAccessKeyLb.overrideLogicalId("lb");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `policy` - (Required) The policy document. This is a JSON formatted string. For more information about building AWS IAM policy documents with Terraform, see the [AWS IAM Policy Document Guide](https://learn.hashicorp.com/terraform/aws/iam-policy).
+* `name` - (Optional) The name of the policy. If omitted, Terraform will assign a random, unique name.
+* `namePrefix` - (Optional, Forces new resource) Creates a unique name beginning with the specified prefix. Conflicts with `name`.
+* `user` - (Required) IAM user to which to attach this policy.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The user policy ID, in the form of `userName:userPolicyName`.
+* `name` - The name of the policy (always set).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IAM User Policies using the `userName:userPolicyName`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import IAM User Policies using the `userName:userPolicyName`. For example:
+
+```console
+% terraform import aws_iam_user_policy.mypolicy user_of_mypolicy_name:mypolicy_name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-0e7d9174e258c37b6b2bfd4094bb5d0f358c81bf66ad2ec394e1153843121ade -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/iam_user_policy_attachment.html.markdown b/website/docs/cdktf/typescript/r/iam_user_policy_attachment.html.markdown
new file mode 100644
index 00000000000..8c0c5722d5c
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/iam_user_policy_attachment.html.markdown
@@ -0,0 +1,83 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_user_policy_attachment"
+description: |-
+  Attaches a Managed IAM Policy to an IAM user
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iam_user_policy_attachment
+
+Attaches a Managed IAM Policy to an IAM user
+
+~> **NOTE:** The usage of this resource conflicts with the `awsIamPolicyAttachment` resource and will permanently show a difference if both are defined.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { IamPolicy } from "./.gen/providers/aws/iam-policy";
+import { IamUser } from "./.gen/providers/aws/iam-user";
+import { IamUserPolicyAttachment } from "./.gen/providers/aws/iam-user-policy-attachment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const policy = new IamPolicy(this, "policy", {
+      description: "A test policy",
+      name: "test-policy",
+      policy: "{ ... policy JSON ... }",
+    });
+    const user = new IamUser(this, "user", {
+      name: "test-user",
+    });
+    new IamUserPolicyAttachment(this, "test-attach", {
+      policyArn: policy.arn,
+      user: user.name,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `user`        (Required) - The user the policy should be applied to
+* `policyArn`  (Required) - The ARN of the policy you want to apply
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IAM user policy attachments using the user name and policy arn separated by `/`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import IAM user policy attachments using the user name and policy arn separated by `/`. For example:
+
+```console
+% terraform import aws_iam_user_policy_attachment.test-attach test-user/arn:aws:iam::xxxxxxxxxxxx:policy/test-policy
+```
+
+<!-- cache-key: cdktf-0.18.0 input-be6384a6a6297b756a1ca1cf5fb8df33f6e76d728c5f3abe5755bef01c55790e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/iam_user_policy_attachment.markdown b/website/docs/cdktf/typescript/r/iam_user_policy_attachment.markdown
new file mode 100644
index 00000000000..8c0c5722d5c
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/iam_user_policy_attachment.markdown
@@ -0,0 +1,83 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_user_policy_attachment"
+description: |-
+  Attaches a Managed IAM Policy to an IAM user
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iam_user_policy_attachment
+
+Attaches a Managed IAM Policy to an IAM user
+
+~> **NOTE:** The usage of this resource conflicts with the `awsIamPolicyAttachment` resource and will permanently show a difference if both are defined.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { IamPolicy } from "./.gen/providers/aws/iam-policy";
+import { IamUser } from "./.gen/providers/aws/iam-user";
+import { IamUserPolicyAttachment } from "./.gen/providers/aws/iam-user-policy-attachment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const policy = new IamPolicy(this, "policy", {
+      description: "A test policy",
+      name: "test-policy",
+      policy: "{ ... policy JSON ... }",
+    });
+    const user = new IamUser(this, "user", {
+      name: "test-user",
+    });
+    new IamUserPolicyAttachment(this, "test-attach", {
+      policyArn: policy.arn,
+      user: user.name,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `user`        (Required) - The user the policy should be applied to
+* `policyArn`  (Required) - The ARN of the policy you want to apply
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IAM user policy attachments using the user name and policy arn separated by `/`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import IAM user policy attachments using the user name and policy arn separated by `/`. For example:
+
+```console
+% terraform import aws_iam_user_policy_attachment.test-attach test-user/arn:aws:iam::xxxxxxxxxxxx:policy/test-policy
+```
+
+<!-- cache-key: cdktf-0.18.0 input-be6384a6a6297b756a1ca1cf5fb8df33f6e76d728c5f3abe5755bef01c55790e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/iam_user_ssh_key.html.markdown b/website/docs/cdktf/typescript/r/iam_user_ssh_key.html.markdown
new file mode 100644
index 00000000000..60b9addebea
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/iam_user_ssh_key.html.markdown
@@ -0,0 +1,85 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_user_ssh_key"
+description: |-
+  Uploads an SSH public key and associates it with the specified IAM user.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iam_user_ssh_key
+
+Uploads an SSH public key and associates it with the specified IAM user.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { IamUser } from "./.gen/providers/aws/iam-user";
+import { IamUserSshKey } from "./.gen/providers/aws/iam-user-ssh-key";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const user = new IamUser(this, "user", {
+      name: "test-user",
+      path: "/",
+    });
+    const awsIamUserSshKeyUser = new IamUserSshKey(this, "user_1", {
+      encoding: "SSH",
+      publicKey:
+        "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQD3F6tyPEFEzV0LX3X8BsXdMsQz1x2cEikKDEY0aIj41qgxMCP/iteneqXSIFZBp5vizPvaoIR3Um9xK7PGoW8giupGn+EPuxIA4cDM4vzOqOkiMPhz5XK0whEjkVzTo4+S0puvDZuwIsdiW9mxhJc7tgBNL0cYlWSYVkz4G/fslNfRPW5mYAM49f4fhtxPb5ok4Q2Lg9dPKVHO/Bgeu5woMc7RY0p1ej6D4CKFE6lymSDJpW0YHX/wqE9+cfEauh7xZcG0q9t2ta6F6fmX0agvpFyZo8aFbXeUBr7osSCJNgvavWbM/06niWrOvYX2xwWdhXmXSrbX8ZbabVohBK41 mytest@mydomain.com",
+      username: user.name,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamUserSshKeyUser.overrideLogicalId("user");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `username` - (Required) The name of the IAM user to associate the SSH public key with.
+* `encoding` - (Required) Specifies the public key encoding format to use in the response. To retrieve the public key in ssh-rsa format, use `ssh`. To retrieve the public key in PEM format, use `pem`.
+* `publicKey` - (Required) The SSH public key. The public key must be encoded in ssh-rsa format or PEM format.
+* `status` - (Optional) The status to assign to the SSH public key. Active means the key can be used for authentication with an AWS CodeCommit repository. Inactive means the key cannot be used. Default is `active`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `sshPublicKeyId` - The unique identifier for the SSH public key.
+* `fingerprint` - The MD5 message digest of the SSH public key.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SSH public keys using the `username`, `sshPublicKeyId`, and `encoding`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import SSH public keys using the `username`, `sshPublicKeyId`, and `encoding`. For example:
+
+```console
+% terraform import aws_iam_user_ssh_key.user user:APKAJNCNNJICVN7CFKCA:SSH
+```
+
+<!-- cache-key: cdktf-0.18.0 input-4cbd112ce4d145630ce699ef62acae06fbe7da8a55f9e6ceccda5f739cb8e1fe -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/iam_virtual_mfa_device.html.markdown b/website/docs/cdktf/typescript/r/iam_virtual_mfa_device.html.markdown
new file mode 100644
index 00000000000..226af02525d
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/iam_virtual_mfa_device.html.markdown
@@ -0,0 +1,87 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_virtual_mfa_device"
+description: |-
+  Provides an IAM Virtual MFA Device
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iam_virtual_mfa_device
+
+Provides an IAM Virtual MFA Device.
+
+~> **Note:** All attributes will be stored in the raw state as plain-text.
+[Read more about sensitive data in state](https://www.terraform.io/docs/state/sensitive-data.html).
+
+~> **Note:** A virtual MFA device cannot be directly associated with an IAM User from Terraform.
+  To associate the virtual MFA device with a user and enable it, use the code returned in either `base32StringSeed` or `qrCodePng` to generate TOTP authentication codes.
+  The authentication codes can then be used with the AWS CLI command [`aws iam enable-mfa-device`](https://docs.aws.amazon.com/cli/latest/reference/iam/enable-mfa-device.html) or the AWS API call [`enableMfaDevice`](https://docs.aws.amazon.com/IAM/latest/APIReference/API_EnableMFADevice.html).
+
+## Example Usage
+
+**Using certs on file:**
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { IamVirtualMfaDevice } from "./.gen/providers/aws/iam-virtual-mfa-device";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new IamVirtualMfaDevice(this, "example", {
+      virtualMfaDeviceName: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `virtualMfaDeviceName` - (Required) The name of the virtual MFA device. Use with path to uniquely identify a virtual MFA device.
+* `path` – (Optional) The path for the virtual MFA device.
+* `tags` - (Optional) Map of resource tags for the virtual mfa device. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) specifying the virtual mfa device.
+* `base32StringSeed` - The base32 seed defined as specified in [RFC3548](https://tools.ietf.org/html/rfc3548.txt). The `base32StringSeed` is base64-encoded.
+* `enableDate` - The date and time when the virtual MFA device was enabled.
+* `qrCodePng` -  A QR code PNG image that encodes `otpauth://totp/$virtualMfaDeviceName@$accountName?secret=$base32String` where `$virtualMfaDeviceName` is one of the create call arguments. AccountName is the user name if set (otherwise, the account ID), and Base32String is the seed in base32 format.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `userName` - The associated IAM User name if the virtual MFA device is enabled.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IAM Virtual MFA Devices using the `arn`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import IAM Virtual MFA Devices using the `arn`. For example:
+
+```console
+% terraform import aws_iam_virtual_mfa_device.example arn:aws:iam::123456789012:mfa/example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-e8a74071097a35d1fabe1f8e98c50def43b822970d49ce5d2336e31e57fe8b7c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/identitystore_group.html.markdown b/website/docs/cdktf/typescript/r/identitystore_group.html.markdown
new file mode 100644
index 00000000000..0f88f5d7e95
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/identitystore_group.html.markdown
@@ -0,0 +1,96 @@
+---
+subcategory: "SSO Identity Store"
+layout: "aws"
+page_title: "AWS: aws_identitystore_group"
+description: |-
+  Terraform resource for managing an AWS IdentityStore Group.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_identitystore_group
+
+Terraform resource for managing an AWS IdentityStore Group.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { IdentitystoreGroup } from "./.gen/providers/aws/identitystore-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new IdentitystoreGroup(this, "this", {
+      description: "Example description",
+      displayName: "Example group",
+      identityStoreId: Token.asString(
+        Fn.lookupNested(Fn.tolist(example.identityStoreIds), ["0"])
+      ),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `identityStoreId` - (Required) The globally unique identifier for the identity store.
+
+The following arguments are optional:
+
+* `displayName` - (Optional) A string containing the name of the group. This value is commonly displayed when the group is referenced.
+* `description` - (Optional) A string containing the description of the group.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `groupId` - The identifier of the newly created group in the identity store.
+* `externalIds` - A list of external IDs that contains the identifiers issued to this resource by an external identity provider. See [External IDs](#external-ids) below.
+
+### External IDs
+
+* `id` - The identifier issued to this resource by an external identity provider.
+* `issuer` - The issuer for an external identifier.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `60M`)
+* `update` - (Default `180M`)
+* `delete` - (Default `90M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import an Identity Store Group using the combination `identityStoreId/groupId`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import an Identity Store Group using the combination `identityStoreId/groupId`. For example:
+
+```console
+% terraform import aws_identitystore_group.example d-9c6705e95c/b8a1c340-8031-7071-a2fb-7dc540320c30
+```
+
+<!-- cache-key: cdktf-0.18.0 input-77081370c526c7da03dc3c3f8a50e4bd16a1ba6cea9abd0f209e0c794a9106bf -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/identitystore_group_membership.html.markdown b/website/docs/cdktf/typescript/r/identitystore_group_membership.html.markdown
new file mode 100644
index 00000000000..6f918cdd636
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/identitystore_group_membership.html.markdown
@@ -0,0 +1,114 @@
+---
+subcategory: "SSO Identity Store"
+layout: "aws"
+page_title: "AWS: aws_identitystore_group_membership"
+description: |-
+  Terraform resource for managing an AWS IdentityStore Group Membership.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_identitystore_group_membership
+
+Terraform resource for managing an AWS IdentityStore Group Membership.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsSsoadminInstances } from "./.gen/providers/aws/data-aws-ssoadmin-instances";
+import { IdentitystoreGroup } from "./.gen/providers/aws/identitystore-group";
+import { IdentitystoreGroupMembership } from "./.gen/providers/aws/identitystore-group-membership";
+import { IdentitystoreUser } from "./.gen/providers/aws/identitystore-user";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new DataAwsSsoadminInstances(this, "example", {});
+    const awsIdentitystoreGroupExample = new IdentitystoreGroup(
+      this,
+      "example_1",
+      {
+        description: "Some group name",
+        displayName: "MyGroup",
+        identityStoreId: Token.asString(
+          Fn.lookupNested(Fn.tolist(example.identityStoreIds), ["0"])
+        ),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIdentitystoreGroupExample.overrideLogicalId("example");
+    const awsIdentitystoreUserExample = new IdentitystoreUser(
+      this,
+      "example_2",
+      {
+        displayName: "John Doe",
+        identityStoreId: Token.asString(
+          Fn.lookupNested(Fn.tolist(example.identityStoreIds), ["0"])
+        ),
+        name: {
+          familyName: "Doe",
+          givenName: "John",
+        },
+        userName: "john.doe@example.com",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIdentitystoreUserExample.overrideLogicalId("example");
+    const awsIdentitystoreGroupMembershipExample =
+      new IdentitystoreGroupMembership(this, "example_3", {
+        groupId: Token.asString(awsIdentitystoreGroupExample.groupId),
+        identityStoreId: Token.asString(
+          Fn.lookupNested(Fn.tolist(example.identityStoreIds), ["0"])
+        ),
+        memberId: Token.asString(awsIdentitystoreUserExample.userId),
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIdentitystoreGroupMembershipExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `memberId` - (Required) The identifier for a user in the Identity Store.
+* `groupId` - (Required)  The identifier for a group in the Identity Store.
+* `identityStoreId` - (Required) Identity Store ID associated with the Single Sign-On Instance.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `membershipId` - The identifier of the newly created group membership in the Identity Store.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsIdentitystoreGroupMembership` using the `identityStoreId/membershipId`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsIdentitystoreGroupMembership` using the `identityStoreId/membershipId`. For example:
+
+```console
+% terraform import aws_identitystore_group_membership.example d-0000000000/00000000-0000-0000-0000-000000000000
+```
+
+<!-- cache-key: cdktf-0.18.0 input-745ddbb430f05a4e5f0ba00082fd2e6025b969aa5422c002d78fa6aa6109ffff -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/identitystore_user.html.markdown b/website/docs/cdktf/typescript/r/identitystore_user.html.markdown
new file mode 100644
index 00000000000..2e07113ddb9
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/identitystore_user.html.markdown
@@ -0,0 +1,150 @@
+---
+subcategory: "SSO Identity Store"
+layout: "aws"
+page_title: "AWS: aws_identitystore_user"
+description: |-
+  Terraform resource for managing an AWS Identity Store User.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_identitystore_user
+
+This resource manages a User resource within an Identity Store.
+
+-> **Note:** If you use an external identity provider or Active Directory as your identity source,
+use this resource with caution. IAM Identity Center does not support outbound synchronization,
+so your identity source does not automatically update with the changes that you make to
+users using this resource.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { IdentitystoreUser } from "./.gen/providers/aws/identitystore-user";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new IdentitystoreUser(this, "example", {
+      displayName: "John Doe",
+      emails: {
+        value: "john@example.com",
+      },
+      identityStoreId: Token.asString(
+        Fn.lookupNested(
+          Fn.tolist(dataAwsSsoadminInstancesExample.identityStoreIds),
+          ["0"]
+        )
+      ),
+      name: {
+        familyName: "Doe",
+        givenName: "John",
+      },
+      userName: "johndoe",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+-> Unless specified otherwise, all fields can contain up to 1024 characters of free-form text.
+
+The following arguments are required:
+
+* `displayName` - (Required) The name that is typically displayed when the user is referenced.
+* `identityStoreId` - (Required, Forces new resource) The globally unique identifier for the identity store that this user is in.
+* `name` - (Required) Details about the user's full name. Detailed below.
+* `userName` - (Required, Forces new resource) A unique string used to identify the user. This value can consist of letters, accented characters, symbols, numbers, and punctuation. This value is specified at the time the user is created and stored as an attribute of the user object in the identity store. The limit is 128 characters.
+
+The following arguments are optional:
+
+* `addresses` - (Optional) Details about the user's address. At most 1 address is allowed. Detailed below.
+* `emails` - (Optional) Details about the user's email. At most 1 email is allowed. Detailed below.
+* `locale` - (Optional) The user's geographical region or location.
+* `nickname` - (Optional) An alternate name for the user.
+* `phoneNumbers` - (Optional) Details about the user's phone number. At most 1 phone number is allowed. Detailed below.
+* `preferredLanguage` - (Optional) The preferred language of the user.
+* `profileUrl` - (Optional) An URL that may be associated with the user.
+* `timezone` - (Optional) The user's time zone.
+* `title` - (Optional) The user's title.
+* `userType` - (Optional) The user type.
+
+### addresses Configuration Block
+
+* `country` - (Optional) The country that this address is in.
+* `formatted` - (Optional) The name that is typically displayed when the address is shown for display.
+* `locality` - (Optional) The address locality.
+* `postalCode` - (Optional) The postal code of the address.
+* `primary` - (Optional) When `true`, this is the primary address associated with the user.
+* `region` - (Optional) The region of the address.
+* `streetAddress` - (Optional) The street of the address.
+* `type` - (Optional) The type of address.
+
+### emails Configuration Block
+
+* `primary` - (Optional) When `true`, this is the primary email associated with the user.
+* `type` - (Optional) The type of email.
+* `value` - (Optional) The email address. This value must be unique across the identity store.
+
+### name Configuration Block
+
+The following arguments are required:
+
+* `familyName` - (Required) The family name of the user.
+* `givenName` - (Required) The given name of the user.
+
+The following arguments are optional:
+
+* `formatted` - (Optional) The name that is typically displayed when the name is shown for display.
+* `honorificPrefix` - (Optional) The honorific prefix of the user.
+* `honorificSuffix` - (Optional) The honorific suffix of the user.
+* `middleName` - (Optional) The middle name of the user.
+
+### phone_numbers Configuration Block
+
+* `primary` - (Optional) When `true`, this is the primary phone number associated with the user.
+* `type` - (Optional) The type of phone number.
+* `value` - (Optional) The user's phone number.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `externalIds` - A list of identifiers issued to this resource by an external identity provider.
+    * `id` - The identifier issued to this resource by an external identity provider.
+    * `issuer` - The issuer for an external identifier.
+* `userId` - The identifier for this user in the identity store.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import an Identity Store User using the combination `identityStoreId/userId`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import an Identity Store User using the combination `identityStoreId/userId`. For example:
+
+```console
+% terraform import aws_identitystore_user.example d-9c6705e95c/065212b4-9061-703b-5876-13a517ae2a7c
+```
+
+<!-- cache-key: cdktf-0.18.0 input-c1ad083569cd581aba94dd285d2251f01db365c421ea22120e81c2b7c96de33c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/imagebuilder_component.html.markdown b/website/docs/cdktf/typescript/r/imagebuilder_component.html.markdown
new file mode 100644
index 00000000000..98865ee3838
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/imagebuilder_component.html.markdown
@@ -0,0 +1,147 @@
+---
+subcategory: "EC2 Image Builder"
+layout: "aws"
+page_title: "AWS: aws_imagebuilder_component"
+description: |-
+    Manage an Image Builder Component
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_imagebuilder_component
+
+Manages an Image Builder Component.
+
+## Example Usage
+
+### Inline Data Document
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ImagebuilderComponent } from "./.gen/providers/aws/imagebuilder-component";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ImagebuilderComponent(this, "example", {
+      data: Token.asString(
+        Fn.yamlencode({
+          phases: [
+            {
+              name: "build",
+              steps: [
+                {
+                  action: "ExecuteBash",
+                  inputs: {
+                    commands: ["echo 'hello world'"],
+                  },
+                  name: "example",
+                  onFailure: "Continue",
+                },
+              ],
+            },
+          ],
+          schemaVersion: 1,
+        })
+      ),
+      name: "example",
+      platform: "Linux",
+      version: "1.0.0",
+    });
+  }
+}
+
+```
+
+### URI Document
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ImagebuilderComponent } from "./.gen/providers/aws/imagebuilder-component";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ImagebuilderComponent(this, "example", {
+      name: "example",
+      platform: "Linux",
+      uri:
+        "s3://${" +
+        awsS3ObjectExample.bucket +
+        "}/${" +
+        awsS3ObjectExample.key +
+        "}",
+      version: "1.0.0",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) Name of the component.
+* `platform` - (Required) Platform of the component.
+* `version` - (Required) Version of the component.
+
+The following attributes are optional:
+
+* `changeDescription` - (Optional) Change description of the component.
+* `data` - (Optional) Inline YAML string with data of the component. Exactly one of `data` and `uri` can be specified. Terraform will only perform drift detection of its value when present in a configuration.
+* `description` - (Optional) Description of the component.
+* `kmsKeyId` - (Optional) Amazon Resource Name (ARN) of the Key Management Service (KMS) Key used to encrypt the component.
+* `skipDestroy` - (Optional) Whether to retain the old version when the resource is destroyed or replacement is necessary. Defaults to `false`.
+* `supportedOsVersions` - (Optional) Set of Operating Systems (OS) supported by the component.
+* `tags` - (Optional) Key-value map of resource tags for the component. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `uri` - (Optional) S3 URI with data of the component. Exactly one of `data` and `uri` can be specified.
+
+~> **NOTE:** Updating `data` or `uri` requires specifying a new `version`. This causes replacement of the resource. The `skipDestroy` argument can be used to retain the old version.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - (Required) Amazon Resource Name (ARN) of the component.
+* `dateCreated` - Date the component was created.
+* `encrypted` - Encryption status of the component.
+* `owner` - Owner of the component.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `type` - Type of the component.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsImagebuilderComponents` resources using the Amazon Resource Name (ARN). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsImagebuilderComponents` resources using the Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_imagebuilder_component.example arn:aws:imagebuilder:us-east-1:123456789012:component/example/1.0.0/1
+```
+
+Certain resource arguments, such as `uri`, cannot be read via the API and imported into Terraform. Terraform will display a difference for these arguments the first run after import if declared in the Terraform configuration for an imported resource.
+
+<!-- cache-key: cdktf-0.18.0 input-7920aa22e67cfcf51eafb7a57251408d3c0e3878496f0aa735aa73051dd90d92 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/imagebuilder_container_recipe.html.markdown b/website/docs/cdktf/typescript/r/imagebuilder_container_recipe.html.markdown
new file mode 100644
index 00000000000..179972accec
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/imagebuilder_container_recipe.html.markdown
@@ -0,0 +1,167 @@
+---
+subcategory: "EC2 Image Builder"
+layout: "aws"
+page_title: "AWS: aws_imagebuilder_container_recipe"
+description: |-
+    Manage an Image Builder Container Recipe
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_imagebuilder_container_recipe
+
+Manages an Image Builder Container Recipe.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ImagebuilderContainerRecipe } from "./.gen/providers/aws/imagebuilder-container-recipe";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ImagebuilderContainerRecipe(this, "example", {
+      component: [
+        {
+          componentArn: Token.asString(awsImagebuilderComponentExample.arn),
+          parameter: [
+            {
+              name: "Parameter1",
+              value: "Value1",
+            },
+            {
+              name: "Parameter2",
+              value: "Value2",
+            },
+          ],
+        },
+      ],
+      containerType: "DOCKER",
+      dockerfileTemplateData:
+        "FROM {{{ imagebuilder:parentImage }}}\n{{{ imagebuilder:environments }}}\n{{{ imagebuilder:components }}}\n\n",
+      name: "example",
+      parentImage:
+        "arn:aws:imagebuilder:eu-central-1:aws:image/amazon-linux-x86-latest/x.x.x",
+      targetRepository: {
+        repositoryName: Token.asString(awsEcrRepositoryExample.name),
+        service: "ECR",
+      },
+      version: "1.0.0",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `component` - (Required) Ordered configuration block(s) with components for the container recipe. Detailed below.
+* `containerType` - (Required) The type of the container to create. Valid values: `docker`.
+* `name` - (Required) The name of the container recipe.
+* `parentImage` (Required) The base image for the container recipe.
+* `targetRepository` (Required) The destination repository for the container image. Detailed below.
+* `version` (Required) Version of the container recipe.
+
+The following attributes are optional:
+
+* `description` - (Optional) The description of the container recipe.
+* `dockerfileTemplateData` - (Optional) The Dockerfile template used to build the image as an inline data blob.
+* `dockerfileTemplateUri` - (Optional) The Amazon S3 URI for the Dockerfile that will be used to build the container image.
+* `instanceConfiguration` - (Optional) Configuration block used to configure an instance for building and testing container images. Detailed below.
+* `kmsKeyId` - (Optional) The KMS key used to encrypt the container image.
+* `platformOverride` - (Optional) Specifies the operating system platform when you use a custom base image.
+* `tags` - (Optional) Key-value map of resource tags for the container recipe. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `workingDirectory` - (Optional) The working directory to be used during build and test workflows.
+
+### component
+
+The `component` block supports the following arguments:
+
+* `componentArn` - (Required) Amazon Resource Name (ARN) of the Image Builder Component to associate.
+* `parameter` - (Optional) Configuration block(s) for parameters to configure the component. Detailed below.
+
+### parameter
+
+The following arguments are required:
+
+* `name` - (Required) The name of the component parameter.
+* `value` - (Required) The value for the named component parameter.
+
+### target_repository
+
+The following arguments are required:
+
+* `repositoryName` - (Required) The name of the container repository where the output container image is stored. This name is prefixed by the repository location.
+* `service` - (Required) The service in which this image is registered. Valid values: `ecr`.
+
+### instance_configuration
+
+The following arguments are optional:
+
+* `blockDeviceMapping` - (Optional) Configuration block(s) with block device mappings for the container recipe. Detailed below.
+* `image` - (Optional) The AMI ID to use as the base image for a container build and test instance. If not specified, Image Builder will use the appropriate ECS-optimized AMI as a base image.
+
+### block_device_mapping
+
+The following arguments are optional:
+
+* `deviceName` - (Optional) Name of the device. For example, `/dev/sda` or `/dev/xvdb`.
+* `ebs` - (Optional) Configuration block with Elastic Block Storage (EBS) block device mapping settings. Detailed below.
+* `noDevice` - (Optional) Set to `true` to remove a mapping from the parent image.
+* `virtualName` - (Optional) Virtual device name. For example, `ephemeral0`. Instance store volumes are numbered starting from 0.
+
+#### ebs
+
+The following arguments are optional:
+
+* `deleteOnTermination` - (Optional) Whether to delete the volume on termination. Defaults to unset, which is the value inherited from the parent image.
+* `encrypted` - (Optional) Whether to encrypt the volume. Defaults to unset, which is the value inherited from the parent image.
+* `iops` - (Optional) Number of Input/Output (I/O) operations per second to provision for an `io1` or `io2` volume.
+* `kmsKeyId` - (Optional) Amazon Resource Name (ARN) of the Key Management Service (KMS) Key for encryption.
+* `snapshotId` - (Optional) Identifier of the EC2 Volume Snapshot.
+* `throughput` - (Optional) For GP3 volumes only. The throughput in MiB/s that the volume supports.
+* `volumeSize` - (Optional) Size of the volume, in GiB.
+* `volumeType` - (Optional) Type of the volume. For example, `gp2` or `io2`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - (Required) Amazon Resource Name (ARN) of the container recipe.
+* `dateCreated` - Date the container recipe was created.
+* `encrypted` - A flag that indicates if the target container is encrypted.
+* `owner` - Owner of the container recipe.
+* `platform` - Platform of the container recipe.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsImagebuilderContainerRecipe` resources using the Amazon Resource Name (ARN). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsImagebuilderContainerRecipe` resources using the Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_imagebuilder_container_recipe.example arn:aws:imagebuilder:us-east-1:123456789012:container-recipe/example/1.0.0
+```
+
+<!-- cache-key: cdktf-0.18.0 input-b616803b9b163166c8ca8e3572b4ae2a3b7520be71fb4d2736f37a4c59c66771 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/imagebuilder_distribution_configuration.html.markdown b/website/docs/cdktf/typescript/r/imagebuilder_distribution_configuration.html.markdown
new file mode 100644
index 00000000000..2e3cd7e4296
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/imagebuilder_distribution_configuration.html.markdown
@@ -0,0 +1,168 @@
+---
+subcategory: "EC2 Image Builder"
+layout: "aws"
+page_title: "AWS: aws_imagebuilder_distribution_configuration"
+description: |-
+    Manage an Image Builder Distribution Configuration
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_imagebuilder_distribution_configuration
+
+Manages an Image Builder Distribution Configuration.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ImagebuilderDistributionConfiguration } from "./.gen/providers/aws/imagebuilder-distribution-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ImagebuilderDistributionConfiguration(this, "example", {
+      distribution: [
+        {
+          amiDistributionConfiguration: {
+            amiTags: {
+              CostCenter: "IT",
+            },
+            launchPermission: {
+              userIds: ["123456789012"],
+            },
+            name: "example-{{ imagebuilder:buildDate }}",
+          },
+          launchTemplateConfiguration: [
+            {
+              launchTemplateId: "lt-0aaa1bcde2ff3456",
+            },
+          ],
+          region: "us-east-1",
+        },
+      ],
+      name: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) Name of the distribution configuration.
+* `distribution` - (Required) One or more configuration blocks with distribution settings. Detailed below.
+
+The following arguments are optional:
+
+* `description` - (Optional) Description of the distribution configuration.
+* `tags` - (Optional) Key-value map of resource tags for the distribution configuration. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### distribution
+
+The following arguments are required:
+
+* `region` - (Required) AWS Region for the distribution.
+
+The following arguments are optional:
+
+* `amiDistributionConfiguration` - (Optional) Configuration block with Amazon Machine Image (AMI) distribution settings. Detailed below.
+* `containerDistributionConfiguration` - (Optional) Configuration block with container distribution settings. Detailed below.
+* `fastLaunchConfiguration` - (Optional) Set of Windows faster-launching configurations to use for AMI distribution. Detailed below.
+* `launchTemplateConfiguration` - (Optional) Set of launch template configuration settings that apply to image distribution. Detailed below.
+* `licenseConfigurationArns` - (Optional) Set of Amazon Resource Names (ARNs) of License Manager License Configurations.
+
+### ami_distribution_configuration
+
+The following arguments are optional:
+
+* `amiTags` - (Optional) Key-value map of tags to apply to the distributed AMI.
+* `description` - (Optional) Description to apply to the distributed AMI.
+* `kmsKeyId` - (Optional) Amazon Resource Name (ARN) of the Key Management Service (KMS) Key to encrypt the distributed AMI.
+* `launchPermission` - (Optional) Configuration block of EC2 launch permissions to apply to the distributed AMI. Detailed below.
+* `name` - (Optional) Name to apply to the distributed AMI.
+* `targetAccountIds` - (Optional) Set of AWS Account identifiers to distribute the AMI.
+
+### launch_permission
+
+The following arguments are optional:
+
+* `organizationArns` - (Optional) Set of AWS Organization ARNs to assign.
+* `organizationalUnitArns` - (Optional) Set of AWS Organizational Unit ARNs to assign.
+* `userGroups` - (Optional) Set of EC2 launch permission user groups to assign. Use `all` to distribute a public AMI.
+* `userIds` - (Optional) Set of AWS Account identifiers to assign.
+
+### container_distribution_configuration
+
+* `containerTags` - (Optional) Set of tags that are attached to the container distribution configuration.
+* `description` - (Optional) Description of the container distribution configuration.
+* `targetRepository` (Required) Configuration block with the destination repository for the container distribution configuration.
+
+### target_repository
+
+* `repositoryName` - (Required) The name of the container repository where the output container image is stored. This name is prefixed by the repository location.
+* `service` - (Required) The service in which this image is registered. Valid values: `ecr`.
+
+### fast_launch_configuration
+
+* `accountId` - (Required) The owner account ID for the fast-launch enabled Windows AMI.
+* `enabled` - (Required) A Boolean that represents the current state of faster launching for the Windows AMI. Set to `true` to start using Windows faster launching, or `false` to stop using it.
+* `launchTemplate` - (Optional) Configuration block for the launch template that the fast-launch enabled Windows AMI uses when it launches Windows instances to create pre-provisioned snapshots. Detailed below.
+* `maxParallelLaunches` - (Optional) The maximum number of parallel instances that are launched for creating resources.
+* `snapshotConfiguration` - (Optional) Configuration block for managing the number of snapshots that are created from pre-provisioned instances for the Windows AMI when faster launching is enabled. Detailed below.
+
+### launch_template
+
+* `launchTemplateId` - (Optional) The ID of the launch template to use for faster launching for a Windows AMI.
+* `launchTemplateName` - (Optional) The name of the launch template to use for faster launching for a Windows AMI.
+* `launchTemplateVersion` - (Optional) The version of the launch template to use for faster launching for a Windows AMI.
+
+### snapshot_configuration
+
+* `targetResourceCount` - (Optional) The number of pre-provisioned snapshots to keep on hand for a fast-launch enabled Windows AMI.
+
+### launch_template_configuration
+
+* `default` - (Optional) Indicates whether to set the specified Amazon EC2 launch template as the default launch template. Defaults to `true`.
+* `accountId` - The account ID that this configuration applies to.
+* `launchTemplateId` - (Required) The ID of the Amazon EC2 launch template to use.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - (Required) Amazon Resource Name (ARN) of the distribution configuration.
+* `dateCreated` - Date the distribution configuration was created.
+* `dateUpdated` - Date the distribution configuration was updated.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsImagebuilderDistributionConfigurations` resources using the Amazon Resource Name (ARN). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsImagebuilderDistributionConfigurations` resources using the Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_imagebuilder_distribution_configuration.example arn:aws:imagebuilder:us-east-1:123456789012:distribution-configuration/example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-6d8db82ff70fd71c294a27408592fa6427acf20679476b6f735995d9df579444 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/imagebuilder_image.html.markdown b/website/docs/cdktf/typescript/r/imagebuilder_image.html.markdown
new file mode 100644
index 00000000000..7ad7b5d15b7
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/imagebuilder_image.html.markdown
@@ -0,0 +1,129 @@
+---
+subcategory: "EC2 Image Builder"
+layout: "aws"
+page_title: "AWS: aws_imagebuilder_image"
+description: |-
+    Manages an Image Builder Image
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_imagebuilder_image
+
+Manages an Image Builder Image.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ImagebuilderImage } from "./.gen/providers/aws/imagebuilder-image";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ImagebuilderImage(this, "example", {
+      distributionConfigurationArn: Token.asString(
+        awsImagebuilderDistributionConfigurationExample.arn
+      ),
+      imageRecipeArn: Token.asString(awsImagebuilderImageRecipeExample.arn),
+      infrastructureConfigurationArn: Token.asString(
+        awsImagebuilderInfrastructureConfigurationExample.arn
+      ),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `infrastructureConfigurationArn` - (Required) Amazon Resource Name (ARN) of the Image Builder Infrastructure Configuration.
+
+The following arguments are optional:
+
+* `containerRecipeArn` - (Optional) - Amazon Resource Name (ARN) of the container recipe.
+* `distributionConfigurationArn` - (Optional) Amazon Resource Name (ARN) of the Image Builder Distribution Configuration.
+* `enhancedImageMetadataEnabled` - (Optional) Whether additional information about the image being created is collected. Defaults to `true`.
+* `imageRecipeArn` - (Optional) Amazon Resource Name (ARN) of the image recipe.
+* `imageTestsConfiguration` - (Optional) Configuration block with image tests configuration. Detailed below.
+* `imageScanningConfiguration` - (Optional) Configuration block with image scanning configuration. Detailed below.
+* `tags` - (Optional) Key-value map of resource tags for the Image Builder Image. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### image_tests_configuration
+
+The following arguments are optional:
+
+* `imageTestsEnabled` - (Optional) Whether image tests are enabled. Defaults to `true`.
+* `timeoutMinutes` - (Optional) Number of minutes before image tests time out. Valid values are between `60` and `1440`. Defaults to `720`.
+
+### image_scanning_configuration
+
+The following arguments are optional:
+
+* `imageScanningEnabled` - (Optional) Indicates whether Image Builder keeps a snapshot of the vulnerability scans that Amazon Inspector runs against the build instance when you create a new image. Defaults to `false`.
+* `ecrConfiguration` - (Optional) Configuration block with ECR configuration. Detailed below.
+
+### ecr_configuration
+
+The following arguments are optional:
+
+* `repositoryName` - (Optional) The name of the container repository that Amazon Inspector scans to identify findings for your container images.
+* `containerTags` - (Optional) Set of tags for Image Builder to apply to the output container image that that Amazon Inspector scans.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the image.
+* `dateCreated` - Date the image was created.
+* `platform` - Platform of the image.
+* `osVersion` - Operating System version of the image.
+* `outputResources` - List of objects with resources created by the image.
+    * `amis` - Set of objects with each Amazon Machine Image (AMI) created.
+        * `accountId` - Account identifier of the AMI.
+        * `description` - Description of the AMI.
+        * `image` - Identifier of the AMI.
+        * `name` - Name of the AMI.
+        * `region` - Region of the AMI.
+    * `containers` - Set of objects with each container image created and stored in the output repository.
+        * `imageUris` - Set of URIs for created containers.
+        * `region` - Region of the container image.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `version` - Version of the image.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `60M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsImagebuilderImage` resources using the Amazon Resource Name (ARN). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsImagebuilderImage` resources using the Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_imagebuilder_image.example arn:aws:imagebuilder:us-east-1:123456789012:image/example/1.0.0/1
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1cfd36f8fabb6982d4f93c93832c07a2a2e26fd75759b9f073c07a7c18e7453f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/imagebuilder_image_pipeline.html.markdown b/website/docs/cdktf/typescript/r/imagebuilder_image_pipeline.html.markdown
new file mode 100644
index 00000000000..489ca39d258
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/imagebuilder_image_pipeline.html.markdown
@@ -0,0 +1,131 @@
+---
+subcategory: "EC2 Image Builder"
+layout: "aws"
+page_title: "AWS: aws_imagebuilder_image_pipeline"
+description: |-
+    Manages an Image Builder Image Pipeline
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_imagebuilder_image_pipeline
+
+Manages an Image Builder Image Pipeline.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ImagebuilderImagePipeline } from "./.gen/providers/aws/imagebuilder-image-pipeline";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ImagebuilderImagePipeline(this, "example", {
+      imageRecipeArn: Token.asString(awsImagebuilderImageRecipeExample.arn),
+      infrastructureConfigurationArn: Token.asString(
+        awsImagebuilderInfrastructureConfigurationExample.arn
+      ),
+      name: "example",
+      schedule: {
+        scheduleExpression: "cron(0 0 * * ? *)",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `infrastructureConfigurationArn` - (Required) Amazon Resource Name (ARN) of the Image Builder Infrastructure Configuration.
+* `name` - (Required) Name of the image pipeline.
+
+The following arguments are optional:
+
+* `containerRecipeArn` - (Optional) Amazon Resource Name (ARN) of the container recipe.
+* `description` - (Optional) Description of the image pipeline.
+* `distributionConfigurationArn` - (Optional) Amazon Resource Name (ARN) of the Image Builder Distribution Configuration.
+* `enhancedImageMetadataEnabled` - (Optional) Whether additional information about the image being created is collected. Defaults to `true`.
+* `imageRecipeArn` - (Optional) Amazon Resource Name (ARN) of the image recipe.
+* `imageScanningConfiguration` - (Optional) Configuration block with image scanning configuration. Detailed below.
+* `imageTestsConfiguration` - (Optional) Configuration block with image tests configuration. Detailed below.
+* `schedule` - (Optional) Configuration block with schedule settings. Detailed below.
+* `status` - (Optional) Status of the image pipeline. Valid values are `disabled` and `enabled`. Defaults to `enabled`.
+* `tags` - (Optional) Key-value map of resource tags for the image pipeline. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### image_scanning_configuration
+
+The following arguments are optional:
+
+* `imageScanningEnabled` - (Optional) Whether image scans are enabled. Defaults to `false`.
+* `ecrConfiguration` - (Optional) Configuration block with ECR configuration for image scanning. Detailed below.
+
+### ecr_configuration
+
+The following arguments are optional:
+
+* `container tags` - (Optional) list of tags to apply to scanned images
+* `repositoryName` - (Optional) The name of the repository to scan
+
+### image_tests_configuration
+
+The following arguments are optional:
+
+* `imageTestsEnabled` - (Optional) Whether image tests are enabled. Defaults to `true`.
+* `timeoutMinutes` - (Optional) Number of minutes before image tests time out. Valid values are between `60` and `1440`. Defaults to `720`.
+
+### schedule
+
+The following arguments are required:
+
+* `scheduleExpression` - (Required) Cron expression of how often the pipeline start condition is evaluated. For example, `cron(0 0 * * ? *)` is evaluated every day at midnight UTC. Configurations using the five field syntax that was previously accepted by the API, such as `cron(0 0 * * *)`, must be updated to the six field syntax. For more information, see the [Image Builder User Guide](https://docs.aws.amazon.com/imagebuilder/latest/userguide/cron-expressions.html).
+
+The following arguments are optional:
+
+* `pipelineExecutionStartCondition` - (Optional) Condition when the pipeline should trigger a new image build. Valid values are `expressionMatchAndDependencyUpdatesAvailable` and `expressionMatchOnly`. Defaults to `expressionMatchAndDependencyUpdatesAvailable`.
+
+* `timezone` - (Optional) The timezone that applies to the scheduling expression. For example, "Etc/UTC", "America/Los_Angeles" in the [IANA timezone format](https://www.joda.org/joda-time/timezones.html). If not specified this defaults to UTC.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the image pipeline.
+* `dateCreated` - Date the image pipeline was created.
+* `dateLastRun` - Date the image pipeline was last run.
+* `dateNextRun` - Date the image pipeline will run next.
+* `dateUpdated` - Date the image pipeline was updated.
+* `platform` - Platform of the image pipeline.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsImagebuilderImagePipeline` resources using the Amazon Resource Name (ARN). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsImagebuilderImagePipeline` resources using the Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_imagebuilder_image_pipeline.example arn:aws:imagebuilder:us-east-1:123456789012:image-pipeline/example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-13e924ec569b627a02963bf24503600d1c77afb7d92500fcb19f3ff11c58c554 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/imagebuilder_image_recipe.html.markdown b/website/docs/cdktf/typescript/r/imagebuilder_image_recipe.html.markdown
new file mode 100644
index 00000000000..ca6bbb95a82
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/imagebuilder_image_recipe.html.markdown
@@ -0,0 +1,161 @@
+---
+subcategory: "EC2 Image Builder"
+layout: "aws"
+page_title: "AWS: aws_imagebuilder_image_recipe"
+description: |-
+    Manage an Image Builder Image Recipe
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_imagebuilder_image_recipe
+
+Manages an Image Builder Image Recipe.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ImagebuilderImageRecipe } from "./.gen/providers/aws/imagebuilder-image-recipe";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ImagebuilderImageRecipe(this, "example", {
+      blockDeviceMapping: [
+        {
+          deviceName: "/dev/xvdb",
+          ebs: {
+            deleteOnTermination: Token.asString(true),
+            volumeSize: 100,
+            volumeType: "gp2",
+          },
+        },
+      ],
+      component: [
+        {
+          componentArn: Token.asString(awsImagebuilderComponentExample.arn),
+          parameter: [
+            {
+              name: "Parameter1",
+              value: "Value1",
+            },
+            {
+              name: "Parameter2",
+              value: "Value2",
+            },
+          ],
+        },
+      ],
+      name: "example",
+      parentImage:
+        "arn:${" +
+        current.partition +
+        "}:imagebuilder:${" +
+        dataAwsRegionCurrent.name +
+        "}:aws:image/amazon-linux-2-x86/x.x.x",
+      version: "1.0.0",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `component` - Ordered configuration block(s) with components for the image recipe. Detailed below.
+* `name` - Name of the image recipe.
+* `parentImage` - The image recipe uses this image as a base from which to build your customized image. The value can be the base image ARN or an AMI ID.
+* `version` - The semantic version of the image recipe, which specifies the version in the following format, with numeric values in each position to indicate a specific version: major.minor.patch. For example: 1.0.0.
+
+The following attributes are optional:
+
+* `blockDeviceMapping` - Configuration block(s) with block device mappings for the image recipe. Detailed below.
+* `description` - Description of the image recipe.
+* `systemsManagerAgent` - Configuration block for the Systems Manager Agent installed by default by Image Builder. Detailed below.
+* `tags` - Key-value map of resource tags for the image recipe. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `userDataBase64` Base64 encoded user data. Use this to provide commands or a command script to run when you launch your build instance.
+* `workingDirectory` - The working directory to be used during build and test workflows.
+
+### block_device_mapping
+
+The following arguments are optional:
+
+* `deviceName` - Name of the device. For example, `/dev/sda` or `/dev/xvdb`.
+* `ebs` - Configuration block with Elastic Block Storage (EBS) block device mapping settings. Detailed below.
+* `noDevice` - Set to `true` to remove a mapping from the parent image.
+* `virtualName` - Virtual device name. For example, `ephemeral0`. Instance store volumes are numbered starting from 0.
+
+#### ebs
+
+The following arguments are optional:
+
+* `deleteOnTermination` - Whether to delete the volume on termination. Defaults to unset, which is the value inherited from the parent image.
+* `encrypted` - Whether to encrypt the volume. Defaults to unset, which is the value inherited from the parent image.
+* `iops` - Number of Input/Output (I/O) operations per second to provision for an `io1` or `io2` volume.
+* `kmsKeyId` - Amazon Resource Name (ARN) of the Key Management Service (KMS) Key for encryption.
+* `snapshotId` - Identifier of the EC2 Volume Snapshot.
+* `throughput` - For GP3 volumes only. The throughput in MiB/s that the volume supports.
+* `volumeSize` - Size of the volume, in GiB.
+* `volumeType` - Type of the volume. For example, `gp2` or `io2`.
+
+### component
+
+The `component` block supports the following arguments:
+
+* `componentArn` - (Required) Amazon Resource Name (ARN) of the Image Builder Component to associate.
+* `parameter` - (Optional) Configuration block(s) for parameters to configure the component. Detailed below.
+
+### parameter
+
+The following arguments are required:
+
+* `name` - The name of the component parameter.
+* `value` - The value for the named component parameter.
+
+### systems_manager_agent
+
+The following arguments are required:
+
+* `uninstallAfterBuild` - Whether to remove the Systems Manager Agent after the image has been built. Defaults to `false`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - (Required) Amazon Resource Name (ARN) of the image recipe.
+* `dateCreated` - Date the image recipe was created.
+* `owner` - Owner of the image recipe.
+* `platform` - Platform of the image recipe.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsImagebuilderImageRecipe` resources using the Amazon Resource Name (ARN). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsImagebuilderImageRecipe` resources using the Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_imagebuilder_image_recipe.example arn:aws:imagebuilder:us-east-1:123456789012:image-recipe/example/1.0.0
+```
+
+<!-- cache-key: cdktf-0.18.0 input-dc715c7a06ef2521803576e2244cbd385c894a24475a5165a46fc8e1f4b1e0b6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/imagebuilder_infrastructure_configuration.html.markdown b/website/docs/cdktf/typescript/r/imagebuilder_infrastructure_configuration.html.markdown
new file mode 100644
index 00000000000..0f777d91738
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/imagebuilder_infrastructure_configuration.html.markdown
@@ -0,0 +1,130 @@
+---
+subcategory: "EC2 Image Builder"
+layout: "aws"
+page_title: "AWS: aws_imagebuilder_infrastructure_configuration"
+description: |-
+  Manages an Image Builder Infrastructure Configuration
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_imagebuilder_infrastructure_configuration
+
+Manages an Image Builder Infrastructure Configuration.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ImagebuilderInfrastructureConfiguration } from "./.gen/providers/aws/imagebuilder-infrastructure-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ImagebuilderInfrastructureConfiguration(this, "example", {
+      description: "example description",
+      instanceProfileName: Token.asString(awsIamInstanceProfileExample.name),
+      instanceTypes: ["t2.nano", "t3.micro"],
+      keyPair: Token.asString(awsKeyPairExample.keyName),
+      logging: {
+        s3Logs: {
+          s3BucketName: Token.asString(awsS3BucketExample.bucket),
+          s3KeyPrefix: "logs",
+        },
+      },
+      name: "example",
+      securityGroupIds: [Token.asString(awsSecurityGroupExample.id)],
+      snsTopicArn: Token.asString(awsSnsTopicExample.arn),
+      subnetId: main.id,
+      tags: {
+        foo: "bar",
+      },
+      terminateInstanceOnFailure: true,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `instanceProfileName` - (Required) Name of IAM Instance Profile.
+* `name` - (Required) Name for the configuration.
+
+The following arguments are optional:
+
+* `description` - (Optional) Description for the configuration.
+* `instanceMetadataOptions` - (Optional) Configuration block with instance metadata options for the HTTP requests that pipeline builds use to launch EC2 build and test instances. Detailed below.
+* `instanceTypes` - (Optional) Set of EC2 Instance Types.
+* `keyPair` - (Optional) Name of EC2 Key Pair.
+* `logging` - (Optional) Configuration block with logging settings. Detailed below.
+* `resourceTags` - (Optional) Key-value map of resource tags to assign to infrastructure created by the configuration.
+* `securityGroupIds` - (Optional) Set of EC2 Security Group identifiers.
+* `snsTopicArn` - (Optional) Amazon Resource Name (ARN) of SNS Topic.
+* `subnetId` - (Optional) EC2 Subnet identifier. Also requires `securityGroupIds` argument.
+* `tags` - (Optional) Key-value map of resource tags to assign to the configuration. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `terminateInstanceOnFailure` - (Optional) Enable if the instance should be terminated when the pipeline fails. Defaults to `false`.
+
+### instance_metadata_options
+
+The following arguments are optional:
+
+* `httpPutResponseHopLimit` - The number of hops that an instance can traverse to reach its destonation.
+* `httpTokens` - Whether a signed token is required for instance metadata retrieval requests. Valid values: `required`, `optional`.
+
+### logging
+
+The following arguments are required:
+
+* `s3Logs` - (Required) Configuration block with S3 logging settings. Detailed below.
+
+### s3_logs
+
+The following arguments are required:
+
+* `s3BucketName` - (Required) Name of the S3 Bucket.
+
+The following arguments are optional:
+
+* `s3KeyPrefix` - (Optional) Prefix to use for S3 logs. Defaults to `/`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Amazon Resource Name (ARN) of the configuration.
+* `arn` - Amazon Resource Name (ARN) of the configuration.
+* `dateCreated` - Date when the configuration was created.
+* `dateUpdated` - Date when the configuration was updated.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsImagebuilderInfrastructureConfiguration` using the Amazon Resource Name (ARN). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsImagebuilderInfrastructureConfiguration` using the Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_imagebuilder_infrastructure_configuration.example arn:aws:imagebuilder:us-east-1:123456789012:infrastructure-configuration/example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-92ce8940a00b3a6132cb84f5e5797b0c5f3f5546af00335b30802f922e76f2ef -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/inspector2_delegated_admin_account.html.markdown b/website/docs/cdktf/typescript/r/inspector2_delegated_admin_account.html.markdown
new file mode 100644
index 00000000000..17c62128b2a
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/inspector2_delegated_admin_account.html.markdown
@@ -0,0 +1,82 @@
+---
+subcategory: "Inspector"
+layout: "aws"
+page_title: "AWS: aws_inspector2_delegated_admin_account"
+description: |-
+  Terraform resource for managing an Amazon Inspector Delegated Admin Account.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_inspector2_delegated_admin_account
+
+Terraform resource for managing an Amazon Inspector Delegated Admin Account.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCallerIdentity } from "./.gen/providers/aws/data-aws-caller-identity";
+import { Inspector2DelegatedAdminAccount } from "./.gen/providers/aws/inspector2-delegated-admin-account";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const current = new DataAwsCallerIdentity(this, "current", {});
+    new Inspector2DelegatedAdminAccount(this, "example", {
+      accountId: Token.asString(current.accountId),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `accountId` - (Required) Account to enable as delegated admin account.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `relationshipStatus` - Status of this delegated admin account.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `15M`)
+* `delete` - (Default `15M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Inspector Delegated Admin Account using the `accountId`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Inspector Delegated Admin Account using the `accountId`. For example:
+
+```console
+% terraform import aws_inspector2_delegated_admin_account.example 012345678901
+```
+
+<!-- cache-key: cdktf-0.18.0 input-5828f02fcb3f6e66bfb0cfe7ea840e097f0fe9fe69f8bc3e6a28d81ab8a5ab11 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/inspector2_enabler.html.markdown b/website/docs/cdktf/typescript/r/inspector2_enabler.html.markdown
new file mode 100644
index 00000000000..1468ec358cc
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/inspector2_enabler.html.markdown
@@ -0,0 +1,89 @@
+---
+subcategory: "Inspector"
+layout: "aws"
+page_title: "AWS: aws_inspector2_enabler"
+description: |-
+  Terraform resource for enabling Amazon Inspector resource scans.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_inspector2_enabler
+
+Terraform resource for enabling Amazon Inspector resource scans.
+
+This resource must be created in the Organization's Administrator Account.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Inspector2Enabler } from "./.gen/providers/aws/inspector2-enabler";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Inspector2Enabler(this, "example", {
+      accountIds: ["123456789012"],
+      resourceTypes: ["EC2"],
+    });
+  }
+}
+
+```
+
+### For the Calling Account
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCallerIdentity } from "./.gen/providers/aws/data-aws-caller-identity";
+import { Inspector2Enabler } from "./.gen/providers/aws/inspector2-enabler";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const current = new DataAwsCallerIdentity(this, "current", {});
+    new Inspector2Enabler(this, "test", {
+      accountIds: [Token.asString(current.accountId)],
+      resourceTypes: ["ECR", "EC2"],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `accountIds` - (Required) Set of account IDs.
+  Can contain one of: the Organization's Administrator Account, or one or more Member Accounts.
+* `resourceTypes` - (Required) Type of resources to scan.
+  Valid values are `ec2`, `ecr`, `lambda` and `lambdaCode`.
+  At least one item is required.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `5M`)
+* `update` - (Default `5M`)
+* `delete` - (Default `5M`)
+
+<!-- cache-key: cdktf-0.18.0 input-89c0c72a488b36e9c62f0a2c9cee15a41ab1fd5afcccb4a7f1813eef314ce9e8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/inspector2_member_association.html.markdown b/website/docs/cdktf/typescript/r/inspector2_member_association.html.markdown
new file mode 100644
index 00000000000..4e8b3dee99c
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/inspector2_member_association.html.markdown
@@ -0,0 +1,75 @@
+---
+subcategory: "Inspector"
+layout: "aws"
+page_title: "AWS: aws_inspector2_member_association"
+description: |-
+  Terraform resource for managing an Amazon Inspector Member Association.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_inspector2_member_association
+
+Terraform resource for associating accounts to existing Inspector instances.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Inspector2MemberAssociation } from "./.gen/providers/aws/inspector2-member-association";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Inspector2MemberAssociation(this, "example", {
+      accountId: "123456789012",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following argument is required:
+
+* `accountId` - (Required) ID of the account to associate
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `delegatedAdminAccountId` - Account ID of the delegated administrator account
+* `relationshipStatus` - Status of the member relationship
+* `updatedAt` - Date and time of the last update of the relationship
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Amazon Inspector Member Association using the `accountId`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Amazon Inspector Member Association using the `accountId`. For example:
+
+```console
+% terraform import aws_inspector2_member_association.example 123456789012
+```
+
+<!-- cache-key: cdktf-0.18.0 input-82d5942e4f4d61c9c5edbed4e78715cf0ac4b5f18beb3ce13b9684e5cadbbf9d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/inspector2_organization_configuration.html.markdown b/website/docs/cdktf/typescript/r/inspector2_organization_configuration.html.markdown
new file mode 100644
index 00000000000..35def94595d
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/inspector2_organization_configuration.html.markdown
@@ -0,0 +1,73 @@
+---
+subcategory: "Inspector"
+layout: "aws"
+page_title: "AWS: aws_inspector2_organization_configuration"
+description: |-
+  Terraform resource for managing an Amazon Inspector Organization Configuration.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_inspector2_organization_configuration
+
+Terraform resource for managing an Amazon Inspector Organization Configuration.
+
+~> **NOTE:** In order for this resource to work, the account you use must be an Inspector Delegated Admin Account.
+
+~> **NOTE:** When this resource is deleted, EC2, ECR and Lambda scans will no longer be automatically enabled for new members of your Amazon Inspector organization.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Inspector2OrganizationConfiguration } from "./.gen/providers/aws/inspector2-organization-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Inspector2OrganizationConfiguration(this, "example", {
+      autoEnable: {
+        ec2: true,
+        ecr: false,
+        lambda: true,
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `autoEnable` - (Required) Configuration block for auto enabling. See below.
+
+### `autoEnable`
+
+* `ec2` - (Required) Whether Amazon EC2 scans are automatically enabled for new members of your Amazon Inspector organization.
+* `ecr` - (Required) Whether Amazon ECR scans are automatically enabled for new members of your Amazon Inspector organization.
+* `lambda` - (Optional) Whether Lambda Function scans are automatically enabled for new members of your Amazon Inspector organization.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `maxAccountLimitReached` - Whether your configuration reached the max account limit.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `5M`)
+* `update` - (Default `5M`)
+* `delete` - (Default `5M`)
+
+<!-- cache-key: cdktf-0.18.0 input-1df42ad521b947a3a7bc404e14d2e821f7165ae91c2768891bab4bde0121e345 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/inspector_assessment_target.html.markdown b/website/docs/cdktf/typescript/r/inspector_assessment_target.html.markdown
new file mode 100644
index 00000000000..05da6f779c2
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/inspector_assessment_target.html.markdown
@@ -0,0 +1,80 @@
+---
+subcategory: "Inspector Classic"
+layout: "aws"
+page_title: "AWS: aws_inspector_assessment_target"
+description: |-
+  Provides an Inspector Classic Assessment Target.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_inspector_assessment_target
+
+Provides an Inspector Classic Assessment Target
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { InspectorAssessmentTarget } from "./.gen/providers/aws/inspector-assessment-target";
+import { InspectorResourceGroup } from "./.gen/providers/aws/inspector-resource-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const bar = new InspectorResourceGroup(this, "bar", {
+      tags: {
+        Env: "bar",
+        Name: "foo",
+      },
+    });
+    new InspectorAssessmentTarget(this, "foo", {
+      name: "assessment target",
+      resourceGroupArn: bar.arn,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the assessment target.
+* `resourceGroupArn` (Optional) Inspector Resource Group Amazon Resource Name (ARN) stating tags for instance matching. If not specified, all EC2 instances in the current AWS account and region are included in the assessment target.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The target assessment ARN.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Inspector Classic Assessment Targets using their Amazon Resource Name (ARN). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Inspector Classic Assessment Targets using their Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_inspector_assessment_target.example arn:aws:inspector:us-east-1:123456789012:target/0-xxxxxxx
+```
+
+<!-- cache-key: cdktf-0.18.0 input-751090ce084efdbf0b345dca096fd95c6240e0d6d09be01dcacf39cbb869bd19 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/inspector_assessment_template.html.markdown b/website/docs/cdktf/typescript/r/inspector_assessment_template.html.markdown
new file mode 100644
index 00000000000..858d91c35d3
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/inspector_assessment_template.html.markdown
@@ -0,0 +1,98 @@
+---
+subcategory: "Inspector Classic"
+layout: "aws"
+page_title: "AWS: aws_inspector_assessment_template"
+description: |-
+  Provides an Inspector Classic Assessment Template.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_inspector_assessment_template
+
+Provides an Inspector Classic Assessment Template
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { InspectorAssessmentTemplate } from "./.gen/providers/aws/inspector-assessment-template";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new InspectorAssessmentTemplate(this, "example", {
+      duration: 3600,
+      eventSubscription: [
+        {
+          event: "ASSESSMENT_RUN_COMPLETED",
+          topicArn: Token.asString(awsSnsTopicExample.arn),
+        },
+      ],
+      name: "example",
+      rulesPackageArns: [
+        "arn:aws:inspector:us-west-2:758058086616:rulespackage/0-9hgA516p",
+        "arn:aws:inspector:us-west-2:758058086616:rulespackage/0-H5hpSawc",
+        "arn:aws:inspector:us-west-2:758058086616:rulespackage/0-JJOtZiqQ",
+        "arn:aws:inspector:us-west-2:758058086616:rulespackage/0-vg5GGHSD",
+      ],
+      targetArn: Token.asString(awsInspectorAssessmentTargetExample.arn),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the assessment template.
+* `targetArn` - (Required) The assessment target ARN to attach the template to.
+* `duration` - (Required) The duration of the inspector run.
+* `rulesPackageArns` - (Required) The rules to be used during the run.
+* `eventSubscription` - (Optional) A block that enables sending notifications about a specified assessment template event to a designated SNS topic. See [Event Subscriptions](#event-subscriptions) for details.
+* `tags` - (Optional) Key-value map of tags for the Inspector assessment template. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Event Subscriptions
+
+The event subscription configuration block supports the following arguments:
+
+* `event` - (Required) The event for which you want to receive SNS notifications. Valid values are `assessmentRunStarted`, `assessmentRunCompleted`, `assessmentRunStateChanged`, and `findingReported`.
+* `topicArn` - (Required) The ARN of the SNS topic to which notifications are sent.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The template assessment ARN.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsInspectorAssessmentTemplate` using the template assessment ARN. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsInspectorAssessmentTemplate` using the template assessment ARN. For example:
+
+```console
+% terraform import aws_inspector_assessment_template.example arn:aws:inspector:us-west-2:123456789012:target/0-9IaAzhGR/template/0-WEcjR8CH
+```
+
+<!-- cache-key: cdktf-0.18.0 input-8ab910475a5ea18490628aba73cd2f6da8ce0d1a11648cd0f2169486753e2383 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/inspector_resource_group.html.markdown b/website/docs/cdktf/typescript/r/inspector_resource_group.html.markdown
new file mode 100644
index 00000000000..e94f87bd659
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/inspector_resource_group.html.markdown
@@ -0,0 +1,52 @@
+---
+subcategory: "Inspector Classic"
+layout: "aws"
+page_title: "AWS: aws_inspector_resource_group"
+description: |-
+  Provides an Amazon Inspector Classic Resource Group.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_inspector_resource_group
+
+Provides an Amazon Inspector Classic Resource Group.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { InspectorResourceGroup } from "./.gen/providers/aws/inspector-resource-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new InspectorResourceGroup(this, "example", {
+      tags: {
+        Env: "bar",
+        Name: "foo",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `tags` - (Required) Key-value map of tags that are used to select the EC2 instances to be included in an [Amazon Inspector assessment target](/docs/providers/aws/r/inspector_assessment_target.html).
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The resource group ARN.
+
+<!-- cache-key: cdktf-0.18.0 input-2e81e0db78f9615ccb5ac22138c773a37a41a7eac278a0a1a0e8c3b36c5946d7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/instance.html.markdown b/website/docs/cdktf/typescript/r/instance.html.markdown
new file mode 100644
index 00000000000..d688a05e23e
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/instance.html.markdown
@@ -0,0 +1,542 @@
+---
+subcategory: "EC2 (Elastic Compute Cloud)"
+layout: "aws"
+page_title: "AWS: aws_instance"
+description: |-
+  Provides an EC2 instance resource. This allows instances to be created, updated, and deleted. Instances also support provisioning.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_instance
+
+Provides an EC2 instance resource. This allows instances to be created, updated, and deleted. Instances also support [provisioning](https://www.terraform.io/docs/provisioners/index.html).
+
+## Example Usage
+
+### Basic example using AMI lookup
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsAmi } from "./.gen/providers/aws/data-aws-ami";
+import { Instance } from "./.gen/providers/aws/instance";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const ubuntu = new DataAwsAmi(this, "ubuntu", {
+      filter: [
+        {
+          name: "name",
+          values: ["ubuntu/images/hvm-ssd/ubuntu-focal-20.04-amd64-server-*"],
+        },
+        {
+          name: "virtualization-type",
+          values: ["hvm"],
+        },
+      ],
+      mostRecent: true,
+      owners: ["099720109477"],
+    });
+    new Instance(this, "web", {
+      ami: Token.asString(ubuntu.id),
+      instanceType: "t3.micro",
+      tags: {
+        Name: "HelloWorld",
+      },
+    });
+  }
+}
+
+```
+
+### Spot instance example
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsAmi } from "./.gen/providers/aws/data-aws-ami";
+import { Instance } from "./.gen/providers/aws/instance";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const thisVar = new DataAwsAmi(this, "this", {
+      filter: [
+        {
+          name: "architecture",
+          values: ["arm64"],
+        },
+        {
+          name: "name",
+          values: ["al2023-ami-2023*"],
+        },
+      ],
+      mostRecent: true,
+      owners: ["amazon"],
+    });
+    const awsInstanceThis = new Instance(this, "this_1", {
+      ami: Token.asString(thisVar.id),
+      instanceMarketOptions: {
+        spotOptions: {
+          maxPrice: Token.asString(0.0031),
+        },
+      },
+      instanceType: "t4g.nano",
+      tags: {
+        Name: "test-spot",
+      },
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsInstanceThis.overrideLogicalId("this");
+  }
+}
+
+```
+
+### Network and credit specification example
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Instance } from "./.gen/providers/aws/instance";
+import { NetworkInterface } from "./.gen/providers/aws/network-interface";
+import { Subnet } from "./.gen/providers/aws/subnet";
+import { Vpc } from "./.gen/providers/aws/vpc";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const myVpc = new Vpc(this, "my_vpc", {
+      cidrBlock: "172.16.0.0/16",
+      tags: {
+        Name: "tf-example",
+      },
+    });
+    const mySubnet = new Subnet(this, "my_subnet", {
+      availabilityZone: "us-west-2a",
+      cidrBlock: "172.16.10.0/24",
+      tags: {
+        Name: "tf-example",
+      },
+      vpcId: myVpc.id,
+    });
+    const foo = new NetworkInterface(this, "foo", {
+      privateIps: ["172.16.10.100"],
+      subnetId: mySubnet.id,
+      tags: {
+        Name: "primary_network_interface",
+      },
+    });
+    const awsInstanceFoo = new Instance(this, "foo_3", {
+      ami: "ami-005e54dee72cc1d00",
+      creditSpecification: {
+        cpuCredits: "unlimited",
+      },
+      instanceType: "t2.micro",
+      networkInterface: [
+        {
+          deviceIndex: 0,
+          networkInterfaceId: foo.id,
+        },
+      ],
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsInstanceFoo.overrideLogicalId("foo");
+  }
+}
+
+```
+
+### CPU options example
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsAmi } from "./.gen/providers/aws/data-aws-ami";
+import { Instance } from "./.gen/providers/aws/instance";
+import { Subnet } from "./.gen/providers/aws/subnet";
+import { Vpc } from "./.gen/providers/aws/vpc";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new Vpc(this, "example", {
+      cidrBlock: "172.16.0.0/16",
+      tags: {
+        Name: "tf-example",
+      },
+    });
+    const amznLinux2023Ami = new DataAwsAmi(this, "amzn-linux-2023-ami", {
+      filter: [
+        {
+          name: "name",
+          values: ["al2023-ami-2023.*-x86_64"],
+        },
+      ],
+      mostRecent: true,
+      owners: ["amazon"],
+    });
+    const awsSubnetExample = new Subnet(this, "example_2", {
+      availabilityZone: "us-east-2a",
+      cidrBlock: "172.16.10.0/24",
+      tags: {
+        Name: "tf-example",
+      },
+      vpcId: example.id,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSubnetExample.overrideLogicalId("example");
+    const awsInstanceExample = new Instance(this, "example_3", {
+      ami: Token.asString(amznLinux2023Ami.id),
+      cpuOptions: {
+        coreCount: 2,
+        threadsPerCore: 2,
+      },
+      instanceType: "c6a.2xlarge",
+      subnetId: Token.asString(awsSubnetExample.id),
+      tags: {
+        Name: "tf-example",
+      },
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsInstanceExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### Host resource group or Licence Manager registered AMI example
+
+A host resource group is a collection of Dedicated Hosts that you can manage as a single entity. As you launch instances, License Manager allocates the hosts and launches instances on them based on the settings that you configured. You can add existing Dedicated Hosts to a host resource group and take advantage of automated host management through License Manager.
+
+-> **NOTE:** A dedicated host is automatically associated with a License Manager host resource group if **Allocate hosts automatically** is enabled. Otherwise, use the `hostResourceGroupArn` argument to explicitly associate the instance with the host resource group.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Instance } from "./.gen/providers/aws/instance";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Instance(this, "this", {
+      ami: "ami-0dcc1e21636832c5d",
+      hostResourceGroupArn:
+        "arn:aws:resource-groups:us-west-2:012345678901:group/win-testhost",
+      instanceType: "m5.large",
+      tenancy: "host",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `ami` - (Optional) AMI to use for the instance. Required unless `launchTemplate` is specified and the Launch Template specifes an AMI. If an AMI is specified in the Launch Template, setting `ami` will override the AMI specified in the Launch Template.
+* `associatePublicIpAddress` - (Optional) Whether to associate a public IP address with an instance in a VPC.
+* `availabilityZone` - (Optional) AZ to start the instance in.
+
+* `capacityReservationSpecification` - (Optional) Describes an instance's Capacity Reservation targeting option. See [Capacity Reservation Specification](#capacity-reservation-specification) below for more details.
+
+-> **NOTE:** Changing `cpuCoreCount` and/or `cpuThreadsPerCore` will cause the resource to be destroyed and re-created.
+
+* `cpuCoreCount` - (Optional, **Deprecated** use the `cpuOptions` argument instead) Sets the number of CPU cores for an instance. This option is only supported on creation of instance type that support CPU Options [CPU Cores and Threads Per CPU Core Per Instance Type](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-optimize-cpu.html#cpu-options-supported-instances-values) - specifying this option for unsupported instance types will return an error from the EC2 API.
+* `cpuOptions` - (Optional) The CPU options for the instance. See [CPU Options](#cpu-options) below for more details.
+* `cpuThreadsPerCore` - (Optional - has no effect unless `cpuCoreCount` is also set, **Deprecated** use the `cpuOptions` argument instead)  If set to 1, hyperthreading is disabled on the launched instance. Defaults to 2 if not set. See [Optimizing CPU Options](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-optimize-cpu.html) for more information.
+* `creditSpecification` - (Optional) Configuration block for customizing the credit specification of the instance. See [Credit Specification](#credit-specification) below for more details. Terraform will only perform drift detection of its value when present in a configuration. Removing this configuration on existing instances will only stop managing it. It will not change the configuration back to the default for the instance type.
+* `disableApiStop` - (Optional) If true, enables [EC2 Instance Stop Protection](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Stop_Start.html#Using_StopProtection).
+* `disableApiTermination` - (Optional) If true, enables [EC2 Instance Termination Protection](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/terminating-instances.html#Using_ChangingDisableAPITermination).
+* `ebsBlockDevice` - (Optional) One or more configuration blocks with additional EBS block devices to attach to the instance. Block device configurations only apply on resource creation. See [Block Devices](#ebs-ephemeral-and-root-block-devices) below for details on attributes and drift detection. When accessing this as an attribute reference, it is a set of objects.
+* `ebsOptimized` - (Optional) If true, the launched EC2 instance will be EBS-optimized. Note that if this is not set on an instance type that is optimized by default then this will show as disabled but if the instance type is optimized by default then there is no need to set this and there is no effect to disabling it. See the [EBS Optimized section](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSOptimized.html) of the AWS User Guide for more information.
+* `enclaveOptions` - (Optional) Enable Nitro Enclaves on launched instances. See [Enclave Options](#enclave-options) below for more details.
+* `ephemeralBlockDevice` - (Optional) One or more configuration blocks to customize Ephemeral (also known as "Instance Store") volumes on the instance. See [Block Devices](#ebs-ephemeral-and-root-block-devices) below for details. When accessing this as an attribute reference, it is a set of objects.
+* `getPasswordData` - (Optional) If true, wait for password data to become available and retrieve it. Useful for getting the administrator password for instances running Microsoft Windows. The password data is exported to the `passwordData` attribute. See [GetPasswordData](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_GetPasswordData.html) for more information.
+* `hibernation` - (Optional) If true, the launched EC2 instance will support hibernation.
+* `hostId` - (Optional) ID of a dedicated host that the instance will be assigned to. Use when an instance is to be launched on a specific dedicated host.
+* `hostResourceGroupArn` - (Optional) ARN of the host resource group in which to launch the instances. If you specify an ARN, omit the `tenancy` parameter or set it to `host`.
+* `iamInstanceProfile` - (Optional) IAM Instance Profile to launch the instance with. Specified as the name of the Instance Profile. Ensure your credentials have the correct permission to assign the instance profile according to the [EC2 documentation](http://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2.html#roles-usingrole-ec2instance-permissions), notably `iam:passRole`.
+* `instanceInitiatedShutdownBehavior` - (Optional) Shutdown behavior for the instance. Amazon defaults this to `stop` for EBS-backed instances and `terminate` for instance-store instances. Cannot be set on instance-store instances. See [Shutdown Behavior](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/terminating-instances.html#Using_ChangingInstanceInitiatedShutdownBehavior) for more information.
+* `instanceMarketOptions` - (Optional) Describes the market (purchasing) option for the instances. See [Market Options](#market-options) below for details on attributes.
+* `instanceType` - (Optional) Instance type to use for the instance. Required unless `launchTemplate` is specified and the Launch Template specifies an instance type. If an instance type is specified in the Launch Template, setting `instanceType` will override the instance type specified in the Launch Template. Updates to this field will trigger a stop/start of the EC2 instance.
+* `ipv6AddressCount`- (Optional) Number of IPv6 addresses to associate with the primary network interface. Amazon EC2 chooses the IPv6 addresses from the range of your subnet.
+* `ipv6Addresses` - (Optional) Specify one or more IPv6 addresses from the range of the subnet to associate with the primary network interface
+* `keyName` - (Optional) Key name of the Key Pair to use for the instance; which can be managed using [the `awsKeyPair` resource](key_pair.html).
+* `launchTemplate` - (Optional) Specifies a Launch Template to configure the instance. Parameters configured on this resource will override the corresponding parameters in the Launch Template. See [Launch Template Specification](#launch-template-specification) below for more details.
+* `maintenanceOptions` - (Optional) Maintenance and recovery options for the instance. See [Maintenance Options](#maintenance-options) below for more details.
+* `metadataOptions` - (Optional) Customize the metadata options of the instance. See [Metadata Options](#metadata-options) below for more details.
+* `monitoring` - (Optional) If true, the launched EC2 instance will have detailed monitoring enabled. (Available since v0.6.0)
+* `networkInterface` - (Optional) Customize network interfaces to be attached at instance boot time. See [Network Interfaces](#network-interfaces) below for more details.
+* `placementGroup` - (Optional) Placement Group to start the instance in.
+* `placementPartitionNumber` - (Optional) Number of the partition the instance is in. Valid only if [the `awsPlacementGroup` resource's](placement_group.html) `strategy` argument is set to `"partition"`.
+* `privateDnsNameOptions` - (Optional) Options for the instance hostname. The default values are inherited from the subnet. See [Private DNS Name Options](#private-dns-name-options) below for more details.
+* `privateIp` - (Optional) Private IP address to associate with the instance in a VPC.
+* `rootBlockDevice` - (Optional) Configuration block to customize details about the root block device of the instance. See [Block Devices](#ebs-ephemeral-and-root-block-devices) below for details. When accessing this as an attribute reference, it is a list containing one object.
+* `secondaryPrivateIps` - (Optional) List of secondary private IPv4 addresses to assign to the instance's primary network interface (eth0) in a VPC. Can only be assigned to the primary network interface (eth0) attached at instance creation, not a pre-existing network interface i.e., referenced in a `networkInterface` block. Refer to the [Elastic network interfaces documentation](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-eni.html#AvailableIpPerENI) to see the maximum number of private IP addresses allowed per instance type.
+* `securityGroups` - (Optional, EC2-Classic and default VPC only) List of security group names to associate with.
+
+-> **NOTE:** If you are creating Instances in a VPC, use `vpcSecurityGroupIds` instead.
+
+* `sourceDestCheck` - (Optional) Controls if traffic is routed to the instance when the destination address does not match the instance. Used for NAT or VPNs. Defaults true.
+* `subnetId` - (Optional) VPC Subnet ID to launch in.
+* `tags` - (Optional) Map of tags to assign to the resource. Note that these tags apply to the instance and not block storage devices. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `tenancy` - (Optional) Tenancy of the instance (if the instance is running in a VPC). An instance with a tenancy of `dedicated` runs on single-tenant hardware. The `host` tenancy is not supported for the import-instance command. Valid values are `default`, `dedicated`, and `host`.
+* `userData` - (Optional) User data to provide when launching the instance. Do not pass gzip-compressed data via this argument; see `userDataBase64` instead. Updates to this field will trigger a stop/start of the EC2 instance by default. If the `userDataReplaceOnChange` is set then updates to this field will trigger a destroy and recreate.
+* `userDataBase64` - (Optional) Can be used instead of `userData` to pass base64-encoded binary data directly. Use this instead of `userData` whenever the value is not a valid UTF-8 string. For example, gzip-encoded user data must be base64-encoded and passed via this argument to avoid corruption. Updates to this field will trigger a stop/start of the EC2 instance by default. If the `userDataReplaceOnChange` is set then updates to this field will trigger a destroy and recreate.
+* `userDataReplaceOnChange` - (Optional) When used in combination with `userData` or `userDataBase64` will trigger a destroy and recreate when set to `true`. Defaults to `false` if not set.
+* `volumeTags` - (Optional) Map of tags to assign, at instance-creation time, to root and EBS volumes.
+
+~> **NOTE:** Do not use `volumeTags` if you plan to manage block device tags outside the `awsInstance` configuration, such as using `tags` in an [`awsEbsVolume`](/docs/providers/aws/r/ebs_volume.html) resource attached via [`awsVolumeAttachment`](/docs/providers/aws/r/volume_attachment.html). Doing so will result in resource cycling and inconsistent behavior.
+
+* `vpcSecurityGroupIds` - (Optional, VPC only) List of security group IDs to associate with.
+
+### Capacity Reservation Specification
+
+~> **NOTE:** You can specify only one argument at a time. If you specify both `capacityReservationPreference` and `capacityReservationTarget`, the request fails. Modifying `capacityReservationPreference` or `capacityReservationTarget` in this block requires the instance to be in `stopped` state.
+
+Capacity reservation specification can be applied/modified to the EC2 Instance at creation time or when the instance is `stopped`.
+
+The `capacityReservationSpecification` block supports the following:
+
+* `capacityReservationPreference` - (Optional) Indicates the instance's Capacity Reservation preferences. Can be `"open"` or `"none"`. (Default: `"open"`).
+* `capacityReservationTarget` - (Optional) Information about the target Capacity Reservation. See [Capacity Reservation Target](#capacity-reservation-target) below for more details.
+
+For more information, see the documentation on [Capacity Reservations](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/capacity-reservations-using.html).
+
+### Capacity Reservation Target
+
+~> **NOTE:** Modifying `capacityReservationId` in this block requires the instance to be in `stopped` state.
+
+Describes a target Capacity Reservation.
+
+This `capacityReservationTarget` block supports the following:
+
+* `capacityReservationId` - (Optional) ID of the Capacity Reservation in which to run the instance.
+* `capacityReservationResourceGroupArn` - (Optional) ARN of the Capacity Reservation resource group in which to run the instance.
+
+### CPU Options
+
+-> **NOTE:** Changing any of `amdSevSnp`, `coreCount`, `threadsPerCore` will cause the resource to be destroyed and re-created.
+
+CPU options apply to the instance at launch time.
+
+The `cpuOptions` block supports the following:
+
+* `amdSevSnp` - (Optional) Indicates whether to enable the instance for AMD SEV-SNP. AMD SEV-SNP is supported with M6a, R6a, and C6a instance types only. Valid values are `enabled` and `disabled`.
+* `coreCount` - (Optional) Sets the number of CPU cores for an instance. This option is only supported on creation of instance type that support CPU Options [CPU Cores and Threads Per CPU Core Per Instance Type](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-optimize-cpu.html#cpu-options-supported-instances-values) - specifying this option for unsupported instance types will return an error from the EC2 API.
+* `threadsPerCore` - (Optional - has no effect unless `coreCount` is also set)  If set to 1, hyperthreading is disabled on the launched instance. Defaults to 2 if not set. See [Optimizing CPU Options](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-optimize-cpu.html) for more information.
+
+For more information, see the documentation on [Optimizing CPU options](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-optimize-cpu.html).
+
+### Credit Specification
+
+The `creditSpecification` block supports the following:
+
+* `cpuCredits` - (Optional) Credit option for CPU usage. Valid values include `standard` or `unlimited`. T3 instances are launched as unlimited by default. T2 instances are launched as standard by default.
+
+### EBS, Ephemeral, and Root Block Devices
+
+Each of the `*BlockDevice` attributes control a portion of the EC2 Instance's "Block Device Mapping". For more information, see the [AWS Block Device Mapping documentation](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/block-device-mapping-concepts.html).
+
+The `rootBlockDevice` block supports the following:
+
+* `deleteOnTermination` - (Optional) Whether the volume should be destroyed on instance termination. Defaults to `true`.
+* `encrypted` - (Optional) Whether to enable volume encryption. Defaults to `false`. Must be configured to perform drift detection.
+* `iops` - (Optional) Amount of provisioned [IOPS](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-io-characteristics.html). Only valid for volume_type of `io1`, `io2` or `gp3`.
+* `kmsKeyId` - (Optional) Amazon Resource Name (ARN) of the KMS Key to use when encrypting the volume. Must be configured to perform drift detection.
+* `tags` - (Optional) Map of tags to assign to the device.
+* `throughput` - (Optional) Throughput to provision for a volume in mebibytes per second (MiB/s). This is only valid for `volumeType` of `gp3`.
+* `volumeSize` - (Optional) Size of the volume in gibibytes (GiB).
+* `volumeType` - (Optional) Type of volume. Valid values include `standard`, `gp2`, `gp3`, `io1`, `io2`, `sc1`, or `st1`. Defaults to the volume type that the AMI uses.
+
+Modifying the `encrypted` or `kmsKeyId` settings of the `rootBlockDevice` requires resource replacement.
+
+Each `ebsBlockDevice` block supports the following:
+
+* `deleteOnTermination` - (Optional) Whether the volume should be destroyed on instance termination. Defaults to `true`.
+* `deviceName` - (Required) Name of the device to mount.
+* `encrypted` - (Optional) Enables [EBS encryption](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html) on the volume. Defaults to `false`. Cannot be used with `snapshotId`. Must be configured to perform drift detection.
+* `iops` - (Optional) Amount of provisioned [IOPS](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-io-characteristics.html). Only valid for volume_type of `io1`, `io2` or `gp3`.
+* `kmsKeyId` - (Optional) Amazon Resource Name (ARN) of the KMS Key to use when encrypting the volume. Must be configured to perform drift detection.
+* `snapshotId` - (Optional) Snapshot ID to mount.
+* `tags` - (Optional) Map of tags to assign to the device.
+* `throughput` - (Optional) Throughput to provision for a volume in mebibytes per second (MiB/s). This is only valid for `volumeType` of `gp3`.
+* `volumeSize` - (Optional) Size of the volume in gibibytes (GiB).
+* `volumeType` - (Optional) Type of volume. Valid values include `standard`, `gp2`, `gp3`, `io1`, `io2`, `sc1`, or `st1`. Defaults to `gp2`.
+
+~> **NOTE:** Currently, changes to the `ebsBlockDevice` configuration of _existing_ resources cannot be automatically detected by Terraform. To manage changes and attachments of an EBS block to an instance, use the `awsEbsVolume` and `awsVolumeAttachment` resources instead. If you use `ebsBlockDevice` on an `awsInstance`, Terraform will assume management over the full set of non-root EBS block devices for the instance, treating additional block devices as drift. For this reason, `ebsBlockDevice` cannot be mixed with external `awsEbsVolume` and `awsVolumeAttachment` resources for a given instance.
+
+Each `ephemeralBlockDevice` block supports the following:
+
+* `deviceName` - Name of the block device to mount on the instance.
+* `noDevice` - (Optional) Suppresses the specified device included in the AMI's block device mapping.
+* `virtualName` - (Optional) [Instance Store Device Name](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/InstanceStorage.html#InstanceStoreDeviceNames) (e.g., `ephemeral0`).
+
+Each AWS Instance type has a different set of Instance Store block devices available for attachment. AWS [publishes a list](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/InstanceStorage.html#StorageOnInstanceTypes) of which ephemeral devices are available on each type. The devices are always identified by the `virtualName` in the format `ephemeral{0N}`.
+
+### Enclave Options
+
+-> **NOTE:** Changing `enabled` will cause the resource to be destroyed and re-created.
+
+Enclave options apply to the instance at boot time.
+
+The `enclaveOptions` block supports the following:
+
+* `enabled` - (Optional) Whether Nitro Enclaves will be enabled on the instance. Defaults to `false`.
+
+For more information, see the documentation on [Nitro Enclaves](https://docs.aws.amazon.com/enclaves/latest/user/nitro-enclave.html).
+
+### Maintenance Options
+
+The `maintenanceOptions` block supports the following:
+
+* `autoRecovery` - (Optional) Automatic recovery behavior of the Instance. Can be `"default"` or `"disabled"`. See [Recover your instance](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-recover.html) for more details.
+
+### Market Options
+
+The `instanceMarketOptions` block supports the following:
+
+* `marketType` - (Optional) Type of market for the instance. Valid value is `spot`. Defaults to `spot`.
+* `spotOptions` - (Optional) Block to configure the options for Spot Instances. See [Spot Options](#spot-options) below for details on attributes.
+
+### Metadata Options
+
+Metadata options can be applied/modified to the EC2 Instance at any time.
+
+The `metadataOptions` block supports the following:
+
+* `httpEndpoint` - (Optional) Whether the metadata service is available. Valid values include `enabled` or `disabled`. Defaults to `enabled`.
+* `httpProtocolIpv6` - (Optional) Whether the IPv6 endpoint for the instance metadata service is enabled. Defaults to `disabled`.
+* `httpPutResponseHopLimit` - (Optional) Desired HTTP PUT response hop limit for instance metadata requests. The larger the number, the further instance metadata requests can travel. Valid values are integer from `1` to `64`. Defaults to `1`.
+* `httpTokens` - (Optional) Whether or not the metadata service requires session tokens, also referred to as _Instance Metadata Service Version 2 (IMDSv2)_. Valid values include `optional` or `required`. Defaults to `optional`.
+* `instanceMetadataTags` - (Optional) Enables or disables access to instance tags from the instance metadata service. Valid values include `enabled` or `disabled`. Defaults to `disabled`.
+
+For more information, see the documentation on the [Instance Metadata Service](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html).
+
+### Network Interfaces
+
+Each of the `networkInterface` blocks attach a network interface to an EC2 Instance during boot time. However, because the network interface is attached at boot-time, replacing/modifying the network interface **WILL** trigger a recreation of the EC2 Instance. If you should need at any point to detach/modify/re-attach a network interface to the instance, use the `awsNetworkInterface` or `awsNetworkInterfaceAttachment` resources instead.
+
+The `networkInterface` configuration block _does_, however, allow users to supply their own network interface to be used as the default network interface on an EC2 Instance, attached at `eth0`.
+
+Each `networkInterface` block supports the following:
+
+* `deleteOnTermination` - (Optional) Whether or not to delete the network interface on instance termination. Defaults to `false`. Currently, the only valid value is `false`, as this is only supported when creating new network interfaces when launching an instance.
+* `deviceIndex` - (Required) Integer index of the network interface attachment. Limited by instance type.
+* `networkCardIndex` - (Optional) Integer index of the network card. Limited by instance type. The default index is `0`.
+* `networkInterfaceId` - (Required) ID of the network interface to attach.
+
+### Private DNS Name Options
+
+The `privateDnsNameOptions` block supports the following:
+
+* `enableResourceNameDnsAaaaRecord` - Indicates whether to respond to DNS queries for instance hostnames with DNS AAAA records.
+* `enableResourceNameDnsARecord` - Indicates whether to respond to DNS queries for instance hostnames with DNS A records.
+* `hostnameType` - Type of hostname for Amazon EC2 instances. For IPv4 only subnets, an instance DNS name must be based on the instance IPv4 address. For IPv6 native subnets, an instance DNS name must be based on the instance ID. For dual-stack subnets, you can specify whether DNS names use the instance IPv4 address or the instance ID. Valid values: `ipName` and `resourceName`.
+
+### Spot Options
+
+The `spotOptions` block supports the following:
+
+* `instanceInterruptionBehavior` - (Optional) The behavior when a Spot Instance is interrupted. Valid values include `hibernate`, `stop`, `terminate` . The default is `terminate`.
+* `maxPrice` - (Optional) The maximum hourly price that you're willing to pay for a Spot Instance.
+* `spotInstanceType` - (Optional) The Spot Instance request type. Valid values include `oneTime`, `persistent`. Persistent Spot Instance requests are only supported when the instance interruption behavior is either hibernate or stop. The default is `oneTime`.
+* `validUntil` - (Optional) The end date of the request, in UTC format (YYYY-MM-DDTHH:MM:SSZ). Supported only for persistent requests.
+
+### Launch Template Specification
+
+-> **Note:** Launch Template parameters will be used only once during instance creation. If you want to update existing instance you need to change parameters
+directly. Updating Launch Template specification will force a new instance.
+
+Any other instance parameters that you specify will override the same parameters in the launch template.
+
+The `launchTemplate` block supports the following:
+
+* `id` - ID of the launch template. Conflicts with `name`.
+* `name` - Name of the launch template. Conflicts with `id`.
+* `version` - Template version. Can be a specific version number, `$latest` or `$default`. The default value is `$default`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the instance.
+* `capacityReservationSpecification` - Capacity reservation specification of the instance.
+* `instanceState` - State of the instance. One of: `pending`, `running`, `shuttingDown`, `terminated`, `stopping`, `stopped`. See [Instance Lifecycle](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-lifecycle.html) for more information.
+* `outpostArn` - ARN of the Outpost the instance is assigned to.
+* `passwordData` - Base-64 encoded encrypted password data for the instance. Useful for getting the administrator password for instances running Microsoft Windows. This attribute is only exported if `getPasswordData` is true. Note that this encrypted value will be stored in the state file, as with all exported attributes. See [GetPasswordData](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_GetPasswordData.html) for more information.
+* `primaryNetworkInterfaceId` - ID of the instance's primary network interface.
+* `privateDns` - Private DNS name assigned to the instance. Can only be used inside the Amazon EC2, and only available if you've enabled DNS hostnames for your VPC.
+* `publicDns` - Public DNS name assigned to the instance. For EC2-VPC, this is only available if you've enabled DNS hostnames for your VPC.
+* `publicIp` - Public IP address assigned to the instance, if applicable. **NOTE**: If you are using an [`awsEip`](/docs/providers/aws/r/eip.html) with your instance, you should refer to the EIP's address directly and not use `publicIp` as this field will change after the EIP is attached.
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+For `ebsBlockDevice`, in addition to the arguments above, the following attribute is exported:
+
+* `volumeId` - ID of the volume. For example, the ID can be accessed like this, `awsInstanceWebEbsBlockDevice2VolumeId`.
+
+For `rootBlockDevice`, in addition to the arguments above, the following attributes are exported:
+
+* `volumeId` - ID of the volume. For example, the ID can be accessed like this, `awsInstanceWebRootBlockDevice0VolumeId`.
+* `deviceName` - Device name, e.g., `/dev/sdh` or `xvdh`.
+
+For `instanceMarketOptions`, in addition to the arguments above, the following attributes are exported:
+
+* `instanceLifecycle` - Indicates whether this is a Spot Instance or a Scheduled Instance.
+* `spotInstanceRequestId` - If the request is a Spot Instance request, the ID of the request.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `10M`)
+* `update` - (Default `10M`)
+* `delete` - (Default `20M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import instances using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import instances using the `id`. For example:
+
+```console
+% terraform import aws_instance.web i-12345678
+```
+
+<!-- cache-key: cdktf-0.18.0 input-3c65e83e2786a585ff91f7f409ce62e768ad71e9ab841a301904e25fdc0f6666 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/internet_gateway.html.markdown b/website/docs/cdktf/typescript/r/internet_gateway.html.markdown
new file mode 100644
index 00000000000..49b84b89209
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/internet_gateway.html.markdown
@@ -0,0 +1,112 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_internet_gateway"
+description: |-
+  Provides a resource to create a VPC Internet Gateway.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_internet_gateway
+
+Provides a resource to create a VPC Internet Gateway.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { InternetGateway } from "./.gen/providers/aws/internet-gateway";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new InternetGateway(this, "gw", {
+      tags: {
+        Name: "main",
+      },
+      vpcId: main.id,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `vpcId` - (Optional) The VPC ID to create in.  See the [aws_internet_gateway_attachment](internet_gateway_attachment.html) resource for an alternate way to attach an Internet Gateway to a VPC.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+-> **Note:** It's recommended to denote that the AWS Instance or Elastic IP depends on the Internet Gateway. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Instance } from "./.gen/providers/aws/instance";
+import { InternetGateway } from "./.gen/providers/aws/internet-gateway";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const gw = new InternetGateway(this, "gw", {
+      vpcId: main.id,
+    });
+    new Instance(this, "foo", {
+      dependsOn: [gw],
+    });
+  }
+}
+
+```
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the Internet Gateway.
+* `arn` - The ARN of the Internet Gateway.
+* `ownerId` - The ID of the AWS account that owns the internet gateway.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `20M`)
+- `update` - (Default `20M`)
+- `delete` - (Default `20M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Internet Gateways using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Internet Gateways using the `id`. For example:
+
+```console
+% terraform import aws_internet_gateway.gw igw-c0a643a9
+```
+
+<!-- cache-key: cdktf-0.18.0 input-81f1e80b898b03aa78644b4608f5a5bf4c569724d3c844941b04df531a254c3a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/internet_gateway_attachment.html.markdown b/website/docs/cdktf/typescript/r/internet_gateway_attachment.html.markdown
new file mode 100644
index 00000000000..8e9826cfc50
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/internet_gateway_attachment.html.markdown
@@ -0,0 +1,94 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_internet_gateway_attachment"
+description: |-
+  Provides a resource to create a VPC Internet Gateway Attachment.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_internet_gateway_attachment
+
+Provides a resource to create a VPC Internet Gateway Attachment.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { InternetGateway } from "./.gen/providers/aws/internet-gateway";
+import { InternetGatewayAttachment } from "./.gen/providers/aws/internet-gateway-attachment";
+import { Vpc } from "./.gen/providers/aws/vpc";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new InternetGateway(this, "example", {});
+    const awsVpcExample = new Vpc(this, "example_1", {
+      cidrBlock: "10.1.0.0/16",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsVpcExample.overrideLogicalId("example");
+    const awsInternetGatewayAttachmentExample = new InternetGatewayAttachment(
+      this,
+      "example_2",
+      {
+        internetGatewayId: example.id,
+        vpcId: Token.asString(awsVpcExample.id),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsInternetGatewayAttachmentExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `internetGatewayId` - (Required) The ID of the internet gateway.
+* `vpcId` - (Required) The ID of the VPC.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the VPC and Internet Gateway separated by a colon.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `20M`)
+- `delete` - (Default `20M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Internet Gateway Attachments using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Internet Gateway Attachments using the `id`. For example:
+
+```console
+% terraform import aws_internet_gateway_attachment.example igw-c0a643a9:vpc-123456
+```
+
+<!-- cache-key: cdktf-0.18.0 input-afa0ad650467b8c31da183ec77ac9779b620b292e7a92425cb2b77263075d02d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/internetmonitor_monitor.html.markdown b/website/docs/cdktf/typescript/r/internetmonitor_monitor.html.markdown
new file mode 100644
index 00000000000..15c61c6fb1d
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/internetmonitor_monitor.html.markdown
@@ -0,0 +1,90 @@
+---
+subcategory: "CloudWatch Internet Monitor"
+layout: "aws"
+page_title: "AWS: aws_internetmonitor_monitor"
+description: |-
+  Provides a CloudWatch Internet Monitor Monitor resource
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_internetmonitor_monitor
+
+Provides a Internet Monitor Monitor resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { InternetmonitorMonitor } from "./.gen/providers/aws/internetmonitor-monitor";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new InternetmonitorMonitor(this, "example", {
+      monitorName: "exmple",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `monitorName` - (Required) The name of the monitor.
+
+The following arguments are optional:
+
+* `healthEventsConfig` - (Optional) Health event thresholds. A health event threshold percentage, for performance and availability, determines when Internet Monitor creates a health event when there's an internet issue that affects your application end users. See [Health Events Config](#health-events-config) below.
+* `internetMeasurementsLogDelivery` - (Optional) Publish internet measurements for Internet Monitor to an Amazon S3 bucket in addition to CloudWatch Logs.
+* `maxCityNetworksToMonitor` - (Optional) The maximum number of city-networks to monitor for your resources. A city-network is the location (city) where clients access your application resources from and the network or ASN, such as an internet service provider (ISP), that clients access the resources through. This limit helps control billing costs.
+* `resources` - (Optional) The resources to include in a monitor, which you provide as a set of Amazon Resource Names (ARNs).
+* `status` - (Optional) The status for a monitor. The accepted values for Status with the UpdateMonitor API call are the following: `active` and `inactive`.
+* `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `trafficPercentageToMonitor` - (Optional) The percentage of the internet-facing traffic for your application that you want to monitor with this monitor.
+
+### Health Events Config
+
+Defines the health event threshold percentages, for performance score and availability score. Amazon CloudWatch Internet Monitor creates a health event when there's an internet issue that affects your application end users where a health score percentage is at or below a set threshold. If you don't set a health event threshold, the default value is 95%.
+
+* `availabilityScoreThreshold` - (Optional) The health event threshold percentage set for availability scores.
+* `performanceScoreThreshold` - (Optional) The health event threshold percentage set for performance scores.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Monitor.
+* `id` - Name of the monitor.
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Internet Monitor Monitors using the `monitorName`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Internet Monitor Monitors using the `monitorName`. For example:
+
+```console
+% terraform import aws_internetmonitor_monitor.some some-monitor
+```
+
+<!-- cache-key: cdktf-0.18.0 input-959844264023e663c6657a471798b74c5622af4b37ac96f4fafe7949bc5ed03b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/iot_authorizer.html.markdown b/website/docs/cdktf/typescript/r/iot_authorizer.html.markdown
new file mode 100644
index 00000000000..9dd0c7e3da3
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/iot_authorizer.html.markdown
@@ -0,0 +1,84 @@
+---
+subcategory: "IoT Core"
+layout: "aws"
+page_title: "AWS: aws_iot_authorizer"
+description: |-
+    Creates and manages an AWS IoT Authorizer.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iot_authorizer
+
+Creates and manages an AWS IoT Authorizer.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, Fn, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { IotAuthorizer } from "./.gen/providers/aws/iot-authorizer";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new IotAuthorizer(this, "example", {
+      authorizerFunctionArn: Token.asString(awsLambdaFunctionExample.arn),
+      name: "example",
+      signingDisabled: false,
+      status: "ACTIVE",
+      tokenKeyName: "Token-Header",
+      tokenSigningPublicKeys: {
+        Key1: Token.asString(
+          Fn.file("test-fixtures/iot-authorizer-signing-key.pem")
+        ),
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `authorizerFunctionArn` - (Required) The ARN of the authorizer's Lambda function.
+* `enableCachingForHttp`  - (Optional) Specifies whether the HTTP caching is enabled or not. Default: `false`.
+* `name` - (Required) The name of the authorizer.
+* `signingDisabled` - (Optional) Specifies whether AWS IoT validates the token signature in an authorization request. Default: `false`.
+* `status` - (Optional) The status of Authorizer request at creation. Valid values: `active`, `inactive`. Default: `active`.
+* `tokenKeyName` - (Optional) The name of the token key used to extract the token from the HTTP headers. This value is required if signing is enabled in your authorizer.
+* `tokenSigningPublicKeys` - (Optional) The public keys used to verify the digital signature returned by your custom authentication service. This value is required if signing is enabled in your authorizer.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the authorizer.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IOT Authorizers using the name. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import IOT Authorizers using the name. For example:
+
+```console
+% terraform import aws_iot_authorizer.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-cf8f96f38c8639fbcddf19f56615da17a9607ba975bea77bb2b1ea3d089fe7c3 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/iot_certificate.html.markdown b/website/docs/cdktf/typescript/r/iot_certificate.html.markdown
new file mode 100644
index 00000000000..c7bb8fa040b
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/iot_certificate.html.markdown
@@ -0,0 +1,110 @@
+---
+subcategory: "IoT Core"
+layout: "aws"
+page_title: "AWS: aws_iot_certificate"
+description: |-
+    Creates and manages an AWS IoT certificate.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iot_certificate
+
+Creates and manages an AWS IoT certificate.
+
+## Example Usage
+
+### With CSR
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { IotCertificate } from "./.gen/providers/aws/iot-certificate";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new IotCertificate(this, "cert", {
+      active: true,
+      csr: Token.asString(Fn.file("/my/csr.pem")),
+    });
+  }
+}
+
+```
+
+### Without CSR
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { IotCertificate } from "./.gen/providers/aws/iot-certificate";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new IotCertificate(this, "cert", {
+      active: true,
+    });
+  }
+}
+
+```
+
+### From existing certificate without a CA
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { IotCertificate } from "./.gen/providers/aws/iot-certificate";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new IotCertificate(this, "cert", {
+      active: true,
+      certificatePem: Token.asString(Fn.file("/my/cert.pem")),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `active` - (Required)  Boolean flag to indicate if the certificate should be active
+* `csr` - (Optional) The certificate signing request. Review
+  [CreateCertificateFromCsr](https://docs.aws.amazon.com/iot/latest/apireference/API_CreateCertificateFromCsr.html)
+  for more information on generating a certificate from a certificate signing request (CSR).
+  If none is specified both the certificate and keys will be generated, review [CreateKeysAndCertificate](https://docs.aws.amazon.com/iot/latest/apireference/API_CreateKeysAndCertificate.html)
+  for more information on generating keys and a certificate.
+* `certificatePem` - (Optional) The certificate to be registered. If `caPem` is unspecified, review
+  [RegisterCertificateWithoutCA](https://docs.aws.amazon.com/iot/latest/apireference/API_RegisterCertificateWithoutCA.html).
+  If `caPem` is specified, review
+  [RegisterCertificate](https://docs.aws.amazon.com/iot/latest/apireference/API_RegisterCertificate.html)
+  for more information on registering a certificate.
+* `caPem` - (Optional) The CA certificate for the certificate to be registered. If this is set, the CA needs to be registered with AWS IoT beforehand.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The internal ID assigned to this certificate.
+* `arn` - The ARN of the created certificate.
+* `certificatePem` - The certificate data, in PEM format.
+* `publicKey` - When neither CSR nor certificate is provided, the public key.
+* `privateKey` - When neither CSR nor certificate is provided, the private key.
+
+<!-- cache-key: cdktf-0.18.0 input-18d65d2043d283d5d12c775ce5c1b04cb6470c6818ca20175568246ddcc6c9cd -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/iot_domain_configuration.html.markdown b/website/docs/cdktf/typescript/r/iot_domain_configuration.html.markdown
new file mode 100644
index 00000000000..add47e7c3a8
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/iot_domain_configuration.html.markdown
@@ -0,0 +1,91 @@
+---
+subcategory: "IoT Core"
+layout: "aws"
+page_title: "AWS: aws_iot_domain_configuration"
+description: |-
+    Creates and manages an AWS IoT domain configuration.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iot_domain_configuration
+
+Creates and manages an AWS IoT domain configuration.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { IotDomainConfiguration } from "./.gen/providers/aws/iot-domain-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new IotDomainConfiguration(this, "iot", {
+      domainName: "iot.example.com",
+      name: "iot-",
+      serverCertificateArns: [cert.arn],
+      serviceType: "DATA",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `authorizerConfig` - (Optional) An object that specifies the authorization service for a domain. See below.
+* `domainName` - (Optional) Fully-qualified domain name.
+* `name` - (Required) The name of the domain configuration. This value must be unique to a region.
+* `serverCertificateArns` - (Optional) The ARNs of the certificates that IoT passes to the device during the TLS handshake. Currently you can specify only one certificate ARN. This value is not required for Amazon Web Services-managed domains. When using a custom `domainName`, the cert must include it.
+* `serviceType` - (Optional) The type of service delivered by the endpoint. Note: Amazon Web Services IoT Core currently supports only the `data` service type.
+* `tags` - (Optional) Map of tags to assign to this resource. If configured with a provider [`defaultTags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `tlsConfig` - (Optional) An object that specifies the TLS configuration for a domain. See below.
+* `validationCertificateArn` - (Optional) The certificate used to validate the server certificate and prove domain name ownership. This certificate must be signed by a public certificate authority. This value is not required for Amazon Web Services-managed domains.
+
+### authorizer_config
+
+* `allowAuthorizerOverride` - (Optional) A Boolean that specifies whether the domain configuration's authorization service can be overridden.
+* `defaultAuthorizerName` - (Optional) The name of the authorization service for a domain configuration.
+
+### tls_config
+
+* `securityPolicy` - (Optional) The security policy for a domain configuration.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the domain configuration.
+* `domainType` - The type of the domain.
+* `id` - The name of the created domain configuration.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IOT domain configurations using the name. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import domain configurations using the name. For example:
+
+```console
+% terraform import aws_iot_domain_configuration.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-2d5835d5848bd62e30c91cc17fabb8e78c6dfcf5b391c5c8303b7743fa49409e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/iot_indexing_configuration.html.markdown b/website/docs/cdktf/typescript/r/iot_indexing_configuration.html.markdown
new file mode 100644
index 00000000000..010132e7367
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/iot_indexing_configuration.html.markdown
@@ -0,0 +1,105 @@
+---
+subcategory: "IoT Core"
+layout: "aws"
+page_title: "AWS: aws_iot_indexing_configuration"
+description: |-
+    Managing IoT Thing indexing.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iot_indexing_configuration
+
+Managing [IoT Thing indexing](https://docs.aws.amazon.com/iot/latest/developerguide/managing-index.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { IotIndexingConfiguration } from "./.gen/providers/aws/iot-indexing-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new IotIndexingConfiguration(this, "example", {
+      thingIndexingConfiguration: {
+        customField: [
+          {
+            name: "shadow.desired.power",
+            type: "Boolean",
+          },
+          {
+            name: "attributes.version",
+            type: "Number",
+          },
+          {
+            name: "shadow.name.thing1shadow.desired.DefaultDesired",
+            type: "String",
+          },
+          {
+            name: "deviceDefender.securityProfile1.NUMBER_VALUE_BEHAVIOR.lastViolationValue.number",
+            type: "Number",
+          },
+        ],
+        deviceDefenderIndexingMode: "VIOLATIONS",
+        filter: {
+          namedShadowNames: ["thing1shadow"],
+        },
+        namedShadowIndexingMode: "ON",
+        thingConnectivityIndexingMode: "STATUS",
+        thingIndexingMode: "REGISTRY_AND_SHADOW",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `thingGroupIndexingConfiguration` - (Optional) Thing group indexing configuration. See below.
+* `thingIndexingConfiguration` - (Optional) Thing indexing configuration. See below.
+
+### thing_group_indexing_configuration
+
+The `thingGroupIndexingConfiguration` configuration block supports the following:
+
+* `customField` - (Optional) A list of thing group fields to index. This list cannot contain any managed fields. See below.
+* `managedField` - (Optional) Contains fields that are indexed and whose types are already known by the Fleet Indexing service. See below.
+* `thingGroupIndexingMode` - (Required) Thing group indexing mode. Valid values: `off`, `on`.
+
+### thing_indexing_configuration
+
+The `thingIndexingConfiguration` configuration block supports the following:
+
+* `customField` - (Optional) Contains custom field names and their data type. See below.
+* `deviceDefenderIndexingMode` - (Optional) Device Defender indexing mode. Valid values: `violations`, `off`. Default: `off`.
+* `managedField` - (Optional) Contains fields that are indexed and whose types are already known by the Fleet Indexing service. See below.
+* `namedShadowIndexingMode` - (Optional) [Named shadow](https://docs.aws.amazon.com/iot/latest/developerguide/iot-device-shadows.html) indexing mode. Valid values: `on`, `off`. Default: `off`.
+* `filter` - (Optional) Required if `namedShadowIndexingMode` is `on`. Enables to add named shadows filtered by `filter` to fleet indexing configuration.
+* `thingConnectivityIndexingMode` - (Optional) Thing connectivity indexing mode. Valid values: `status`, `off`. Default: `off`.
+* `thingIndexingMode` - (Required) Thing indexing mode. Valid values: `registry`, `registryAndShadow`, `off`.
+
+### field
+
+The `customField` and `managedField` configuration blocks supports the following:
+
+* `name` - (Optional) The name of the field.
+* `type` - (Optional) The data type of the field. Valid values: `number`, `string`, `boolean`.
+
+### filter
+
+The `filter` configuration block supports the following:
+
+* `namedShadowNames` - (Optional) List of shadow names that you select to index.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+<!-- cache-key: cdktf-0.18.0 input-632e1d902ca26f482ec035558f74be20583a22a0dee9c8e8349d7c76ef519f71 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/iot_logging_options.html.markdown b/website/docs/cdktf/typescript/r/iot_logging_options.html.markdown
new file mode 100644
index 00000000000..fa804ff5605
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/iot_logging_options.html.markdown
@@ -0,0 +1,48 @@
+---
+subcategory: "IoT Core"
+layout: "aws"
+page_title: "AWS: aws_iot_logging_options"
+description: |-
+    Provides a resource to manage default logging options.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iot_logging_options
+
+Provides a resource to manage [default logging options](https://docs.aws.amazon.com/iot/latest/developerguide/configure-logging.html#configure-logging-console).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { IotLoggingOptions } from "./.gen/providers/aws/iot-logging-options";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new IotLoggingOptions(this, "example", {
+      defaultLogLevel: "WARN",
+      roleArn: Token.asString(awsIamRoleExample.arn),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `defaultLogLevel` - (Optional) The default logging level. Valid Values: `"debug"`, `"info"`, `"error"`, `"warn"`, `"disabled"`.
+* `disableAllLogs` - (Optional) If `true` all logs are disabled. The default is `false`.
+* `roleArn` - (Required) The ARN of the role that allows IoT to write to Cloudwatch logs.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+<!-- cache-key: cdktf-0.18.0 input-8b571a8dda736dcc0ea1559b030643ae474e857abed2e70ef420990d6b076aa1 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/iot_policy.html.markdown b/website/docs/cdktf/typescript/r/iot_policy.html.markdown
new file mode 100644
index 00000000000..8417143ace5
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/iot_policy.html.markdown
@@ -0,0 +1,87 @@
+---
+subcategory: "IoT Core"
+layout: "aws"
+page_title: "AWS: aws_iot_policy"
+description: |-
+  Provides an IoT policy.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iot_policy
+
+Provides an IoT policy.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { IotPolicy } from "./.gen/providers/aws/iot-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new IotPolicy(this, "pubsub", {
+      name: "PubSubToAnyTopic",
+      policy: Token.asString(
+        Fn.jsonencode({
+          Statement: [
+            {
+              Action: ["iot:*"],
+              Effect: "Allow",
+              Resource: "*",
+            },
+          ],
+          Version: "2012-10-17",
+        })
+      ),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the policy.
+* `policy` - (Required) The policy document. This is a JSON formatted string. Use the [IoT Developer Guide](http://docs.aws.amazon.com/iot/latest/developerguide/iot-policies.html) for more information on IoT Policies. For more information about building AWS IAM policy documents with Terraform, see the [AWS IAM Policy Document Guide](https://learn.hashicorp.com/terraform/aws/iam-policy).
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN assigned by AWS to this policy.
+* `name` - The name of this policy.
+* `defaultVersionId` - The default version of this policy.
+* `policy` - The policy document.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IoT policies using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import IoT policies using the `name`. For example:
+
+```console
+% terraform import aws_iot_policy.pubsub PubSubToAnyTopic
+```
+
+<!-- cache-key: cdktf-0.18.0 input-aa26a18211ca20b7caee0ba0c439dfec03ce858e13ea7c24d060deccb352d0d2 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/iot_policy_attachment.html.markdown b/website/docs/cdktf/typescript/r/iot_policy_attachment.html.markdown
new file mode 100644
index 00000000000..81c982ef27e
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/iot_policy_attachment.html.markdown
@@ -0,0 +1,71 @@
+---
+subcategory: "IoT Core"
+layout: "aws"
+page_title: "AWS: aws_iot_policy_attachment"
+description: |-
+  Provides an IoT policy attachment.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iot_policy_attachment
+
+Provides an IoT policy attachment.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { IotCertificate } from "./.gen/providers/aws/iot-certificate";
+import { IotPolicy } from "./.gen/providers/aws/iot-policy";
+import { IotPolicyAttachment } from "./.gen/providers/aws/iot-policy-attachment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const cert = new IotCertificate(this, "cert", {
+      active: true,
+      csr: Token.asString(Fn.file("csr.pem")),
+    });
+    const pubsub = new DataAwsIamPolicyDocument(this, "pubsub", {
+      statement: [
+        {
+          actions: ["iot:*"],
+          effect: "Allow",
+          resources: ["*"],
+        },
+      ],
+    });
+    const awsIotPolicyPubsub = new IotPolicy(this, "pubsub_2", {
+      name: "PubSubToAnyTopic",
+      policy: Token.asString(pubsub.json),
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIotPolicyPubsub.overrideLogicalId("pubsub");
+    new IotPolicyAttachment(this, "att", {
+      policy: Token.asString(awsIotPolicyPubsub.name),
+      target: cert.arn,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `policy` - (Required) The name of the policy to attach.
+* `target` - (Required) The identity to which the policy is attached.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+<!-- cache-key: cdktf-0.18.0 input-a5726ca95eb3899fc8547f4e9540090bfecb315bb5fb71039782d36fac25dc91 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/iot_provisioning_template.html.markdown b/website/docs/cdktf/typescript/r/iot_provisioning_template.html.markdown
new file mode 100644
index 00000000000..72b700bcb6b
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/iot_provisioning_template.html.markdown
@@ -0,0 +1,161 @@
+---
+subcategory: "IoT Core"
+layout: "aws"
+page_title: "AWS: aws_iot_provisioning_template"
+description: |-
+    Manages an IoT fleet provisioning template.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iot_provisioning_template
+
+Manages an IoT fleet provisioning template. For more info, see the AWS documentation on [fleet provisioning](https://docs.aws.amazon.com/iot/latest/developerguide/provision-wo-cert.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, Fn, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+import { IamRolePolicyAttachment } from "./.gen/providers/aws/iam-role-policy-attachment";
+import { IotPolicy } from "./.gen/providers/aws/iot-policy";
+import { IotProvisioningTemplate } from "./.gen/providers/aws/iot-provisioning-template";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const devicePolicy = new DataAwsIamPolicyDocument(this, "device_policy", {
+      statement: [
+        {
+          actions: ["iot:Subscribe"],
+          resources: ["*"],
+        },
+      ],
+    });
+    const iotAssumeRolePolicy = new DataAwsIamPolicyDocument(
+      this,
+      "iot_assume_role_policy",
+      {
+        statement: [
+          {
+            actions: ["sts:AssumeRole"],
+            principals: [
+              {
+                identifiers: ["iot.amazonaws.com"],
+                type: "Service",
+              },
+            ],
+          },
+        ],
+      }
+    );
+    const iotFleetProvisioning = new IamRole(this, "iot_fleet_provisioning", {
+      assumeRolePolicy: Token.asString(iotAssumeRolePolicy.json),
+      name: "IoTProvisioningServiceRole",
+      path: "/service-role/",
+    });
+    new IamRolePolicyAttachment(this, "iot_fleet_provisioning_registration", {
+      policyArn:
+        "arn:aws:iam::aws:policy/service-role/AWSIoTThingsRegistration",
+      role: iotFleetProvisioning.name,
+    });
+    const awsIotPolicyDevicePolicy = new IotPolicy(this, "device_policy_4", {
+      name: "DevicePolicy",
+      policy: Token.asString(devicePolicy.json),
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIotPolicyDevicePolicy.overrideLogicalId("device_policy");
+    new IotProvisioningTemplate(this, "fleet", {
+      description: "My provisioning template",
+      enabled: true,
+      name: "FleetTemplate",
+      provisioningRoleArn: iotFleetProvisioning.arn,
+      templateBody: Token.asString(
+        Fn.jsonencode({
+          Parameters: {
+            SerialNumber: {
+              Type: "String",
+            },
+          },
+          Resources: {
+            certificate: {
+              Properties: {
+                CertificateId: {
+                  Ref: "AWS::IoT::Certificate::Id",
+                },
+                Status: "Active",
+              },
+              Type: "AWS::IoT::Certificate",
+            },
+            policy: {
+              Properties: {
+                PolicyName: awsIotPolicyDevicePolicy.name,
+              },
+              Type: "AWS::IoT::Policy",
+            },
+          },
+        })
+      ),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the fleet provisioning template.
+* `description` - (Optional) The description of the fleet provisioning template.
+* `enabled` - (Optional) True to enable the fleet provisioning template, otherwise false.
+* `preProvisioningHook` - (Optional) Creates a pre-provisioning hook template. Details below.
+* `provisioningRoleArn` - (Required) The role ARN for the role associated with the fleet provisioning template. This IoT role grants permission to provision a device.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `templateBody` - (Required) The JSON formatted contents of the fleet provisioning template.
+* `type` - (Optional) The type you define in a provisioning template.
+
+### pre_provisioning_hook
+
+The `preProvisioningHook` configuration block supports the following:
+
+* `payloadVersion` - (Optional) The version of the payload that was sent to the target function. The only valid (and the default) payload version is `"20200401"`.
+* `targetArn` - (Optional) The ARN of the target function.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN that identifies the provisioning template.
+* `defaultVersionId` - The default version of the fleet provisioning template.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IoT fleet provisioning templates using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import IoT fleet provisioning templates using the `name`. For example:
+
+```console
+% terraform import aws_iot_provisioning_template.fleet FleetProvisioningTemplate
+```
+
+<!-- cache-key: cdktf-0.18.0 input-0caa47853f782deb3ce1c0adf39db30dd119e9251e987dbe84f960ceed581db6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/iot_role_alias.html.markdown b/website/docs/cdktf/typescript/r/iot_role_alias.html.markdown
new file mode 100644
index 00000000000..6ad3d01f2b7
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/iot_role_alias.html.markdown
@@ -0,0 +1,90 @@
+---
+subcategory: "IoT Core"
+layout: "aws"
+page_title: "AWS: aws_iot_role_alias"
+description: |-
+  Provides an IoT role alias.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iot_role_alias
+
+Provides an IoT role alias.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+import { IotRoleAlias } from "./.gen/providers/aws/iot-role-alias";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const assumeRole = new DataAwsIamPolicyDocument(this, "assume_role", {
+      actions: ["sts:AssumeRole"],
+      effect: "Allow",
+      principals: [
+        {
+          identifiers: ["credentials.iot.amazonaws.com"],
+          type: "Service",
+        },
+      ],
+    });
+    const role = new IamRole(this, "role", {
+      assumeRolePolicy: Token.asString(assumeRole.json),
+      name: "dynamodb-access-role",
+    });
+    new IotRoleAlias(this, "alias", {
+      alias: "Thermostat-dynamodb-access-role-alias",
+      roleArn: role.arn,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `alias` - (Required) The name of the role alias.
+* `roleArn` - (Required) The identity of the role to which the alias refers.
+* `credentialDuration` - (Optional) The duration of the credential, in seconds. If you do not specify a value for this setting, the default maximum of one hour is applied. This setting can have a value from 900 seconds (15 minutes) to 43200 seconds (12 hours).
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN assigned by AWS to this role alias.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IOT Role Alias using the alias. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import IOT Role Alias using the alias. For example:
+
+```console
+% terraform import aws_iot_role_alias.example myalias
+```
+
+<!-- cache-key: cdktf-0.18.0 input-0e141253bdc6f9dae9ea2a1248664027fe4a5da717a05f264db046de823136f7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/iot_thing.html.markdown b/website/docs/cdktf/typescript/r/iot_thing.html.markdown
new file mode 100644
index 00000000000..04b9a4cdb56
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/iot_thing.html.markdown
@@ -0,0 +1,76 @@
+---
+subcategory: "IoT Core"
+layout: "aws"
+page_title: "AWS: aws_iot_thing"
+description: |-
+    Creates and manages an AWS IoT Thing.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iot_thing
+
+Creates and manages an AWS IoT Thing.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { IotThing } from "./.gen/providers/aws/iot-thing";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new IotThing(this, "example", {
+      attributes: {
+        First: "examplevalue",
+      },
+      name: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `name` - (Required) The name of the thing.
+* `attributes` - (Optional) Map of attributes of the thing.
+* `thingTypeName` - (Optional) The thing type name.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `defaultClientId` - The default client ID.
+* `version` - The current version of the thing record in the registry.
+* `arn` - The ARN of the thing.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IOT Things using the name. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import IOT Things using the name. For example:
+
+```console
+% terraform import aws_iot_thing.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-80ff616de83aba8dd5b8102e42172cd6cc340818bf3135b58cdb41c17424b73b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/iot_thing_group.html.markdown b/website/docs/cdktf/typescript/r/iot_thing_group.html.markdown
new file mode 100644
index 00000000000..b7ccef2cc15
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/iot_thing_group.html.markdown
@@ -0,0 +1,99 @@
+---
+subcategory: "IoT Core"
+layout: "aws"
+page_title: "AWS: aws_iot_thing_group"
+description: |-
+    Manages an AWS IoT Thing Group.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iot_thing_group
+
+Manages an AWS IoT Thing Group.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { IotThingGroup } from "./.gen/providers/aws/iot-thing-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const parent = new IotThingGroup(this, "parent", {
+      name: "parent",
+    });
+    new IotThingGroup(this, "example", {
+      name: "example",
+      parentGroupName: parent.name,
+      properties: {
+        attributePayload: {
+          attributes: {
+            One: "11111",
+            Two: "TwoTwo",
+          },
+        },
+        description: "This is my thing group",
+      },
+      tags: {
+        terraform: "true",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `name` - (Required) The name of the Thing Group.
+* `parentGroupName` - (Optional) The name of the parent Thing Group.
+* `properties` - (Optional) The Thing Group properties. Defined below.
+* `tags` - (Optional) Key-value mapping of resource tags
+
+### properties Reference
+
+* `attributePayload` - (Optional) The Thing Group attributes. Defined below.
+* `description` - (Optional) A description of the Thing Group.
+
+### attribute_payload Reference
+
+* `attributes` - (Optional) Key-value map.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the Thing Group.
+* `id` - The Thing Group ID.
+* `version` - The current version of the Thing Group record in the registry.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IoT Things Groups using the name. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import IoT Things Groups using the name. For example:
+
+```console
+% terraform import aws_iot_thing_group.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-d40a8b9d3295130dee82fc924f5a78064a2bcbc1d9fdc3faf7a58c297c82b090 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/iot_thing_group_membership.html.markdown b/website/docs/cdktf/typescript/r/iot_thing_group_membership.html.markdown
new file mode 100644
index 00000000000..912b2f3be5a
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/iot_thing_group_membership.html.markdown
@@ -0,0 +1,73 @@
+---
+subcategory: "IoT Core"
+layout: "aws"
+page_title: "AWS: aws_iot_thing_group_membership"
+description: |-
+    Adds an IoT Thing to an IoT Thing Group.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iot_thing_group_membership
+
+Adds an IoT Thing to an IoT Thing Group.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { IotThingGroupMembership } from "./.gen/providers/aws/iot-thing-group-membership";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new IotThingGroupMembership(this, "example", {
+      overrideDynamicGroup: true,
+      thingGroupName: "example-group",
+      thingName: "example-thing",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `thingName` - (Required) The name of the thing to add to a group.
+* `thingGroupName` - (Required) The name of the group to which you are adding a thing.
+* `overrideDynamicGroup` - (Optional) Override dynamic thing groups with static thing groups when 10-group limit is reached. If a thing belongs to 10 thing groups, and one or more of those groups are dynamic thing groups, adding a thing to a static group removes the thing from the last dynamic group.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The membership ID.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IoT Thing Group Membership using the thing group name and thing name. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import IoT Thing Group Membership using the thing group name and thing name. For example:
+
+```console
+% terraform import aws_iot_thing_group_membership.example thing_group_name/thing_name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ad3a10105917dc5ba26af081c3974b83c7083d781b1a90314ae4c28a7e5779f5 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/iot_thing_principal_attachment.html.markdown b/website/docs/cdktf/typescript/r/iot_thing_principal_attachment.html.markdown
new file mode 100644
index 00000000000..91fa3943294
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/iot_thing_principal_attachment.html.markdown
@@ -0,0 +1,56 @@
+---
+subcategory: "IoT Core"
+layout: "aws"
+page_title: "AWS: aws_iot_thing_principal_attachment"
+description: |-
+    Provides AWS IoT Thing Principal attachment.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iot_thing_principal_attachment
+
+Attaches Principal to AWS IoT Thing.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { IotCertificate } from "./.gen/providers/aws/iot-certificate";
+import { IotThing } from "./.gen/providers/aws/iot-thing";
+import { IotThingPrincipalAttachment } from "./.gen/providers/aws/iot-thing-principal-attachment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const cert = new IotCertificate(this, "cert", {
+      active: true,
+      csr: Token.asString(Fn.file("csr.pem")),
+    });
+    const example = new IotThing(this, "example", {
+      name: "example",
+    });
+    new IotThingPrincipalAttachment(this, "att", {
+      principal: cert.arn,
+      thing: example.name,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `principal` - (Required) The AWS IoT Certificate ARN or Amazon Cognito Identity ID.
+* `thing` - (Required) The name of the thing.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+<!-- cache-key: cdktf-0.18.0 input-c6b7343797508d980834fbffd7cd03e2ab8c65b3b6b1f437fd026a32bf4c5c8e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/iot_thing_type.html.markdown b/website/docs/cdktf/typescript/r/iot_thing_type.html.markdown
new file mode 100644
index 00000000000..f1c5f6d81d4
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/iot_thing_type.html.markdown
@@ -0,0 +1,75 @@
+---
+subcategory: "IoT Core"
+layout: "aws"
+page_title: "AWS: aws_iot_thing_type"
+description: |-
+    Creates and manages an AWS IoT Thing Type.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iot_thing_type
+
+Creates and manages an AWS IoT Thing Type.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { IotThingType } from "./.gen/providers/aws/iot-thing-type";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new IotThingType(this, "foo", {
+      name: "my_iot_thing",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `name` - (Required, Forces New Resource) The name of the thing type.
+* `deprecated` - (Optional, Defaults to false) Whether the thing type is deprecated. If true, no new things could be associated with this type.
+* `properties` - (Optional), Configuration block that can contain the following properties of the thing type:
+    * `description` - (Optional, Forces New Resource) The description of the thing type.
+    * `searchableAttributes` - (Optional, Forces New Resource) A list of searchable thing attribute names.
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the created AWS IoT Thing Type.
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IOT Thing Types using the name. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import IOT Thing Types using the name. For example:
+
+```console
+% terraform import aws_iot_thing_type.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-f6bb5e58ad214ec278c62df3ca0c39674a3e3f822552368c4b48cf6dedb96258 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/iot_topic_rule.html.markdown b/website/docs/cdktf/typescript/r/iot_topic_rule.html.markdown
new file mode 100644
index 00000000000..51bbd1d99c8
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/iot_topic_rule.html.markdown
@@ -0,0 +1,287 @@
+---
+subcategory: "IoT Core"
+layout: "aws"
+page_title: "AWS: aws_iot_topic_rule"
+description: |-
+    Creates and manages an AWS IoT topic rule
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iot_topic_rule
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+import { IamRolePolicy } from "./.gen/providers/aws/iam-role-policy";
+import { IotTopicRule } from "./.gen/providers/aws/iot-topic-rule";
+import { SnsTopic } from "./.gen/providers/aws/sns-topic";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const myerrortopic = new SnsTopic(this, "myerrortopic", {
+      name: "myerrortopic",
+    });
+    const mytopic = new SnsTopic(this, "mytopic", {
+      name: "mytopic",
+    });
+    const assumeRole = new DataAwsIamPolicyDocument(this, "assume_role", {
+      statement: [
+        {
+          actions: ["sts:AssumeRole"],
+          effect: "Allow",
+          principals: [
+            {
+              identifiers: ["iot.amazonaws.com"],
+              type: "Service",
+            },
+          ],
+        },
+      ],
+    });
+    const iamPolicyForLambda = new DataAwsIamPolicyDocument(
+      this,
+      "iam_policy_for_lambda",
+      {
+        statement: [
+          {
+            actions: ["sns:Publish"],
+            effect: "Allow",
+            resources: [mytopic.arn],
+          },
+        ],
+      }
+    );
+    const role = new IamRole(this, "role", {
+      assumeRolePolicy: Token.asString(assumeRole.json),
+      name: "myrole",
+    });
+    const awsIamRolePolicyIamPolicyForLambda = new IamRolePolicy(
+      this,
+      "iam_policy_for_lambda_5",
+      {
+        name: "mypolicy",
+        policy: Token.asString(iamPolicyForLambda.json),
+        role: role.id,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamRolePolicyIamPolicyForLambda.overrideLogicalId(
+      "iam_policy_for_lambda"
+    );
+    new IotTopicRule(this, "rule", {
+      description: "Example rule",
+      enabled: true,
+      errorAction: {
+        sns: {
+          messageFormat: "RAW",
+          roleArn: role.arn,
+          targetArn: myerrortopic.arn,
+        },
+      },
+      name: "MyRule",
+      sns: [
+        {
+          messageFormat: "RAW",
+          roleArn: role.arn,
+          targetArn: mytopic.arn,
+        },
+      ],
+      sql: "SELECT * FROM 'topic/test'",
+      sqlVersion: "2016-03-23",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `name` - (Required) The name of the rule.
+* `description` - (Optional) The description of the rule.
+* `enabled` - (Required) Specifies whether the rule is enabled.
+* `sql` - (Required) The SQL statement used to query the topic. For more information, see AWS IoT SQL Reference (http://docs.aws.amazon.com/iot/latest/developerguide/iot-rules.html#aws-iot-sql-reference) in the AWS IoT Developer Guide.
+* `sqlVersion` - (Required) The version of the SQL rules engine to use when evaluating the rule.
+* `errorAction` - (Optional) Configuration block with error action to be associated with the rule. See the documentation for `cloudwatchAlarm`, `cloudwatchLogs`, `cloudwatchMetric`, `dynamodb`, `dynamodbv2`, `elasticsearch`, `firehose`, `http`, `iotAnalytics`, `iotEvents`, `kafka`, `kinesis`, `lambda`, `republish`, `s3`, `sns`, `sqs`, `stepFunctions`, `timestream` configuration blocks for further configuration details.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+The `cloudwatchAlarm` object takes the following arguments:
+
+* `alarmName` - (Required) The CloudWatch alarm name.
+* `roleArn` - (Required) The IAM role ARN that allows access to the CloudWatch alarm.
+* `stateReason` - (Required) The reason for the alarm change.
+* `stateValue` - (Required) The value of the alarm state. Acceptable values are: OK, ALARM, INSUFFICIENT_DATA.
+
+The `cloudwatchLogs` object takes the following arguments:
+
+* `logGroupName` - (Required) The CloudWatch log group name.
+* `roleArn` - (Required) The IAM role ARN that allows access to the CloudWatch alarm.
+
+The `cloudwatchMetric` object takes the following arguments:
+
+* `metricName` - (Required) The CloudWatch metric name.
+* `metricNamespace` - (Required) The CloudWatch metric namespace name.
+* `metricTimestamp` - (Optional) An optional Unix timestamp (http://docs.aws.amazon.com/AmazonCloudWatch/latest/DeveloperGuide/cloudwatch_concepts.html#about_timestamp).
+* `metricUnit` - (Required) The metric unit (supported units can be found here: http://docs.aws.amazon.com/AmazonCloudWatch/latest/DeveloperGuide/cloudwatch_concepts.html#Unit)
+* `metricValue` - (Required) The CloudWatch metric value.
+* `roleArn` - (Required) The IAM role ARN that allows access to the CloudWatch metric.
+
+The `dynamodb` object takes the following arguments:
+
+* `hashKeyField` - (Required) The hash key name.
+* `hashKeyType` - (Optional) The hash key type. Valid values are "STRING" or "NUMBER".
+* `hashKeyValue` - (Required) The hash key value.
+* `payloadField` - (Optional) The action payload.
+* `rangeKeyField` - (Optional) The range key name.
+* `rangeKeyType` - (Optional) The range key type. Valid values are "STRING" or "NUMBER".
+* `rangeKeyValue` - (Optional) The range key value.
+* `operation` - (Optional) The operation. Valid values are "INSERT", "UPDATE", or "DELETE".
+* `roleArn` - (Required) The ARN of the IAM role that grants access to the DynamoDB table.
+* `tableName` - (Required) The name of the DynamoDB table.
+
+The `dynamodbv2` object takes the following arguments:
+
+* `putItem` - (Required) Configuration block with DynamoDB Table to which the message will be written. Nested arguments below.
+    * `tableName` - (Required) The name of the DynamoDB table.
+* `roleArn` - (Required) The ARN of the IAM role that grants access to the DynamoDB table.
+
+The `elasticsearch` object takes the following arguments:
+
+* `endpoint` - (Required) The endpoint of your Elasticsearch domain.
+* `id` - (Required) The unique identifier for the document you are storing.
+* `index` - (Required) The Elasticsearch index where you want to store your data.
+* `roleArn` - (Required) The IAM role ARN that has access to Elasticsearch.
+* `type` - (Required) The type of document you are storing.
+
+The `firehose` object takes the following arguments:
+
+* `deliveryStreamName` - (Required) The delivery stream name.
+* `roleArn` - (Required) The IAM role ARN that grants access to the Amazon Kinesis Firehose stream.
+* `separator` - (Optional) A character separator that is used to separate records written to the Firehose stream. Valid values are: '\n' (newline), '\t' (tab), '\r\n' (Windows newline), ',' (comma).
+* `batchMode` - (Optional) The payload that contains a JSON array of records will be sent to Kinesis Firehose via a batch call.
+
+The `http` object takes the following arguments:
+
+* `url` - (Required) The HTTPS URL.
+* `confirmationUrl` - (Optional) The HTTPS URL used to verify ownership of `url`.
+* `httpHeader` - (Optional) Custom HTTP header IoT Core should send. It is possible to define more than one custom header.
+
+The `httpHeader` object takes the following arguments:
+
+* `key` - (Required) The name of the HTTP header.
+* `value` - (Required) The value of the HTTP header.
+
+The `iotAnalytics` object takes the following arguments:
+
+* `channelName` - (Required) Name of AWS IOT Analytics channel.
+* `roleArn` - (Required) The ARN of the IAM role that grants access.
+* `batchMode` - (Optional) The payload that contains a JSON array of records will be sent to IoT Analytics via a batch call.
+
+The `iotEvents` object takes the following arguments:
+
+* `inputName` - (Required) The name of the AWS IoT Events input.
+* `roleArn` - (Required) The ARN of the IAM role that grants access.
+* `messageId` - (Optional) Use this to ensure that only one input (message) with a given messageId is processed by an AWS IoT Events detector.
+* `batchMode` - (Optional) The payload that contains a JSON array of records will be sent to IoT Events via a batch call.
+
+The `kafka` object takes the following arguments:
+
+* `clientProperties` - (Required) Properties of the Apache Kafka producer client. For more info, see the [AWS documentation](https://docs.aws.amazon.com/iot/latest/developerguide/apache-kafka-rule-action.html).
+* `destinationArn` - (Required) The ARN of Kafka action's VPC [`awsIotTopicRuleDestination`](iot_topic_rule_destination.html) .
+* `key` - (Optional) The Kafka message key.
+* `partition` - (Optional) The Kafka message partition.
+* `topic` - (Optional) The Kafka topic for messages to be sent to the Kafka broker.
+
+The `kinesis` object takes the following arguments:
+
+* `partitionKey` - (Optional) The partition key.
+* `roleArn` - (Required) The ARN of the IAM role that grants access to the Amazon Kinesis stream.
+* `streamName` - (Required) The name of the Amazon Kinesis stream.
+
+The `lambda` object takes the following arguments:
+
+* `functionArn` - (Required) The ARN of the Lambda function.
+
+The `republish` object takes the following arguments:
+
+* `roleArn` - (Required) The ARN of the IAM role that grants access.
+* `topic` - (Required) The name of the MQTT topic the message should be republished to.
+* `qos` - (Optional) The Quality of Service (QoS) level to use when republishing messages. Valid values are 0 or 1. The default value is 0.
+
+The `s3` object takes the following arguments:
+
+* `bucketName` - (Required) The Amazon S3 bucket name.
+* `cannedAcl` - (Optional) The Amazon S3 canned ACL that controls access to the object identified by the object key. [Valid values](https://docs.aws.amazon.com/AmazonS3/latest/userguide/acl-overview.html#canned-acl).
+* `key` - (Required) The object key.
+* `roleArn` - (Required) The ARN of the IAM role that grants access.
+
+The `sns` object takes the following arguments:
+
+* `messageFormat` - (Required) The message format of the message to publish. Accepted values are "JSON" and "RAW".
+* `roleArn` - (Required) The ARN of the IAM role that grants access.
+* `targetArn` - (Required) The ARN of the SNS topic.
+
+The `sqs` object takes the following arguments:
+
+* `queueUrl` - (Required) The URL of the Amazon SQS queue.
+* `roleArn` - (Required) The ARN of the IAM role that grants access.
+* `useBase64` - (Required) Specifies whether to use Base64 encoding.
+
+The `stepFunctions` object takes the following arguments:
+
+* `executionNamePrefix` - (Optional) The prefix used to generate, along with a UUID, the unique state machine execution name.
+* `stateMachineName` - (Required) The name of the Step Functions state machine whose execution will be started.
+* `roleArn` - (Required) The ARN of the IAM role that grants access to start execution of the state machine.
+
+The `timestream` object takes the following arguments:
+
+* `databaseName` - (Required) The name of an Amazon Timestream database.
+* `dimension` - (Required) Configuration blocks with metadata attributes of the time series that are written in each measure record. Nested arguments below.
+    * `name` - (Required) The metadata dimension name. This is the name of the column in the Amazon Timestream database table record.
+    * `value` - (Required) The value to write in this column of the database record.
+* `roleArn` - (Required) The ARN of the role that grants permission to write to the Amazon Timestream database table.
+* `tableName` - (Required) The name of the database table into which to write the measure records.
+* `timestamp` - (Optional) Configuration block specifying an application-defined value to replace the default value assigned to the Timestream record's timestamp in the time column. Nested arguments below.
+    * `unit` - (Required) The precision of the timestamp value that results from the expression described in value. Valid values: `seconds`, `milliseconds`, `microseconds`, `nanoseconds`.
+    * `value` - (Required) An expression that returns a long epoch time value.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name of the topic rule
+* `arn` - The ARN of the topic rule
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IoT Topic Rules using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import IoT Topic Rules using the `name`. For example:
+
+```console
+% terraform import aws_iot_topic_rule.rule <name>
+```
+
+<!-- cache-key: cdktf-0.18.0 input-4cb4989a57838eace08bc0e308834fdac933e38cc0625a3b13f328889b9cc2ff -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/iot_topic_rule_destination.html.markdown b/website/docs/cdktf/typescript/r/iot_topic_rule_destination.html.markdown
new file mode 100644
index 00000000000..fd3f2e5b4be
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/iot_topic_rule_destination.html.markdown
@@ -0,0 +1,80 @@
+---
+subcategory: "IoT Core"
+layout: "aws"
+page_title: "AWS: aws_iot_topic_rule_destination"
+description: |-
+    Creates and manages an AWS IoT topic rule destination
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_iot_topic_rule_destination
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, Fn, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { IotTopicRuleDestination } from "./.gen/providers/aws/iot-topic-rule-destination";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new IotTopicRuleDestination(this, "example", {
+      vpcConfiguration: {
+        roleArn: Token.asString(awsIamRoleExample.arn),
+        securityGroups: [Token.asString(awsSecurityGroupExample.id)],
+        subnetIds: Token.asList(Fn.lookupNested(awsSubnetExample, ["*", "id"])),
+        vpcId: Token.asString(awsVpcExample.id),
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `enabled` - (Optional) Whether or not to enable the destination. Default: `true`.
+* `vpcConfiguration` - (Required) Configuration of the virtual private cloud (VPC) connection. For more info, see the [AWS documentation](https://docs.aws.amazon.com/iot/latest/developerguide/vpc-rule-action.html).
+
+The `vpcConfiguration` object takes the following arguments:
+
+* `roleArn` - (Required) The ARN of a role that has permission to create and attach to elastic network interfaces (ENIs).
+* `securityGroups` - (Optional) The security groups of the VPC destination.
+* `subnetIds` - (Required) The subnet IDs of the VPC destination.
+* `vpcId` - (Required) The ID of the VPC.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the topic rule destination
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IoT topic rule destinations using the `arn`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import IoT topic rule destinations using the `arn`. For example:
+
+```console
+% terraform import aws_iot_topic_rule_destination.example arn:aws:iot:us-west-2:123456789012:ruledestination/vpc/2ce781c8-68a6-4c52-9c62-63fe489ecc60
+```
+
+<!-- cache-key: cdktf-0.18.0 input-84135101ecf33d388c99e663b26ee9c967e1ad73d124159690f4b098fc269b2c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ivs_channel.html.markdown b/website/docs/cdktf/typescript/r/ivs_channel.html.markdown
new file mode 100644
index 00000000000..2529b9ba499
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/ivs_channel.html.markdown
@@ -0,0 +1,89 @@
+---
+subcategory: "IVS (Interactive Video)"
+layout: "aws"
+page_title: "AWS: aws_ivs_channel"
+description: |-
+  Terraform resource for managing an AWS IVS (Interactive Video) Channel.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ivs_channel
+
+Terraform resource for managing an AWS IVS (Interactive Video) Channel.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { IvsChannel } from "./.gen/providers/aws/ivs-channel";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new IvsChannel(this, "example", {
+      name: "channel-1",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are optional:
+
+* `authorized` - (Optional) If `true`, channel is private (enabled for playback authorization).
+* `latencyMode` - (Optional) Channel latency mode. Valid values: `normal`, `low`.
+* `name` - (Optional) Channel name.
+* `recordingConfigurationArn` - (Optional) Recording configuration ARN.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `type` - (Optional) Channel type, which determines the allowable resolution and bitrate. Valid values: `standard`, `basic`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Channel.
+* `ingestEndpoint` - Channel ingest endpoint, part of the definition of an ingest server, used when setting up streaming software.
+* `playbackUrl` - Channel playback URL.
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://www.terraform.io/docs/configuration/blocks/resources/syntax.html#operation-timeouts):
+
+* `create` - (Default `5M`)
+* `update` - (Default `5M`)
+* `delete` - (Default `5M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IVS (Interactive Video) Channel using the ARN. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import IVS (Interactive Video) Channel using the ARN. For example:
+
+```console
+% terraform import aws_ivs_channel.example arn:aws:ivs:us-west-2:326937407773:channel/0Y1lcs4U7jk5
+```
+
+<!-- cache-key: cdktf-0.18.0 input-027eff160d9ed7f8a55e22eabe213339e7ec60ef328ae2f09043ed6203e4c8ab -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ivs_playback_key_pair.html.markdown b/website/docs/cdktf/typescript/r/ivs_playback_key_pair.html.markdown
new file mode 100644
index 00000000000..75dd5f842d5
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/ivs_playback_key_pair.html.markdown
@@ -0,0 +1,87 @@
+---
+subcategory: "IVS (Interactive Video)"
+layout: "aws"
+page_title: "AWS: aws_ivs_playback_key_pair"
+description: |-
+  Terraform resource for managing an AWS IVS (Interactive Video) Playback Key Pair.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ivs_playback_key_pair
+
+Terraform resource for managing an AWS IVS (Interactive Video) Playback Key Pair.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { IvsPlaybackKeyPair } from "./.gen/providers/aws/ivs-playback-key-pair";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new IvsPlaybackKeyPair(this, "example", {
+      publicKey: Token.asString(Fn.file("./public-key.pem")),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `publicKey` - (Required) Public portion of a customer-generated key pair. Must be an ECDSA public key in PEM format.
+
+The following arguments are optional:
+
+* `name` - (Optional) Playback Key Pair name.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Playback Key Pair.
+* `fingerprint` - Key-pair identifier.
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://www.terraform.io/docs/configuration/blocks/resources/syntax.html#operation-timeouts):
+
+* `create` - (Default `5M`)
+* `delete` - (Default `5M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IVS (Interactive Video) Playback Key Pair using the ARN. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import IVS (Interactive Video) Playback Key Pair using the ARN. For example:
+
+```console
+% terraform import aws_ivs_playback_key_pair.example arn:aws:ivs:us-west-2:326937407773:playback-key/KDJRJNQhiQzA
+```
+
+<!-- cache-key: cdktf-0.18.0 input-7d629869f9647ea4bb2e6762ea0a06ac8cf1d19444905446ee0e3f95d7b62b08 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ivs_recording_configuration.html.markdown b/website/docs/cdktf/typescript/r/ivs_recording_configuration.html.markdown
new file mode 100644
index 00000000000..d486d867d09
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/ivs_recording_configuration.html.markdown
@@ -0,0 +1,98 @@
+---
+subcategory: "IVS (Interactive Video)"
+layout: "aws"
+page_title: "AWS: aws_ivs_recording_configuration"
+description: |-
+  Terraform resource for managing an AWS IVS (Interactive Video) Recording Configuration.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ivs_recording_configuration
+
+Terraform resource for managing an AWS IVS (Interactive Video) Recording Configuration.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { IvsRecordingConfiguration } from "./.gen/providers/aws/ivs-recording-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new IvsRecordingConfiguration(this, "example", {
+      destinationConfiguration: {
+        s3: {
+          bucketName: "ivs-stream-archive",
+        },
+      },
+      name: "recording_configuration-1",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `destinationConfiguration` - Object containing destination configuration for where recorded video will be stored.
+    * `s3` - S3 destination configuration where recorded videos will be stored.
+        * `bucketName` - S3 bucket name where recorded videos will be stored.
+
+The following arguments are optional:
+
+* `name` - (Optional) Recording Configuration name.
+* `recordingReconnectWindowSeconds` - (Optional) If a broadcast disconnects and then reconnects within the specified interval, the multiple streams will be considered a single broadcast and merged together.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `thumbnailConfiguration` - (Optional) Object containing information to enable/disable the recording of thumbnails for a live session and modify the interval at which thumbnails are generated for the live session.
+    * `recordingMode` - (Optional) Thumbnail recording mode. Valid values: `disabled`, `interval`.
+    * `targetIntervalSeconds` (Configurable [and required] only if `recordingMode` is `interval`) - The targeted thumbnail-generation interval in seconds.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Recording Configuration.
+* `state` -  The current state of the Recording Configuration.
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://www.terraform.io/docs/configuration/blocks/resources/syntax.html#operation-timeouts):
+
+* `create` - (Default `10M`)
+* `delete` - (Default `10M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IVS (Interactive Video) Recording Configuration using the ARN. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import IVS (Interactive Video) Recording Configuration using the ARN. For example:
+
+```console
+% terraform import aws_ivs_recording_configuration.example arn:aws:ivs:us-west-2:326937407773:recording-configuration/KAk1sHBl2L47
+```
+
+<!-- cache-key: cdktf-0.18.0 input-df7c61620a9731f6911320162a0d1f3273caabbf2762a59eb62c9ab821ea994d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ivschat_logging_configuration.html.markdown b/website/docs/cdktf/typescript/r/ivschat_logging_configuration.html.markdown
new file mode 100644
index 00000000000..48dcc3f73cd
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/ivschat_logging_configuration.html.markdown
@@ -0,0 +1,217 @@
+---
+subcategory: "IVS (Interactive Video) Chat"
+layout: "aws"
+page_title: "AWS: aws_ivschat_logging_configuration"
+description: |-
+  Terraform resource for managing an AWS IVS (Interactive Video) Chat Logging Configuration.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ivschat_logging_configuration
+
+Terraform resource for managing an AWS IVS (Interactive Video) Chat Logging Configuration.
+
+## Example Usage
+
+### Basic Usage - Logging to CloudWatch
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudwatchLogGroup } from "./.gen/providers/aws/cloudwatch-log-group";
+import { IvschatLoggingConfiguration } from "./.gen/providers/aws/ivschat-logging-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new CloudwatchLogGroup(this, "example", {});
+    const awsIvschatLoggingConfigurationExample =
+      new IvschatLoggingConfiguration(this, "example_1", {
+        destinationConfiguration: {
+          cloudwatchLogs: {
+            logGroupName: example.name,
+          },
+        },
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIvschatLoggingConfigurationExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### Basic Usage - Logging to Kinesis Firehose with Extended S3
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+import { IvschatLoggingConfiguration } from "./.gen/providers/aws/ivschat-logging-configuration";
+import { KinesisFirehoseDeliveryStream } from "./.gen/providers/aws/kinesis-firehose-delivery-stream";
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketAcl } from "./.gen/providers/aws/s3-bucket-acl";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new S3Bucket(this, "example", {
+      bucketPrefix: "tf-ivschat-logging-bucket",
+    });
+    const awsS3BucketAclExample = new S3BucketAcl(this, "example_1", {
+      acl: "private",
+      bucket: example.id,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketAclExample.overrideLogicalId("example");
+    const assumeRole = new DataAwsIamPolicyDocument(this, "assume_role", {
+      statement: [
+        {
+          actions: ["sts:AssumeRole"],
+          effect: "Allow",
+          principals: [
+            {
+              identifiers: ["firehose.amazonaws.com"],
+              type: "Service",
+            },
+          ],
+        },
+      ],
+    });
+    const awsIamRoleExample = new IamRole(this, "example_3", {
+      assumeRolePolicy: Token.asString(assumeRole.json),
+      name: "firehose_example_role",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamRoleExample.overrideLogicalId("example");
+    const awsKinesisFirehoseDeliveryStreamExample =
+      new KinesisFirehoseDeliveryStream(this, "example_4", {
+        destination: "extended_s3",
+        extendedS3Configuration: {
+          bucketArn: example.arn,
+          roleArn: Token.asString(awsIamRoleExample.arn),
+        },
+        name: "terraform-kinesis-firehose-extended-s3-example-stream",
+        tags: {
+          LogDeliveryEnabled: "true",
+        },
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsKinesisFirehoseDeliveryStreamExample.overrideLogicalId("example");
+    const awsIvschatLoggingConfigurationExample =
+      new IvschatLoggingConfiguration(this, "example_5", {
+        destinationConfiguration: {
+          firehose: {
+            deliveryStreamName: Token.asString(
+              awsKinesisFirehoseDeliveryStreamExample.name
+            ),
+          },
+        },
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIvschatLoggingConfigurationExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### Basic Usage - Logging to S3
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { IvschatLoggingConfiguration } from "./.gen/providers/aws/ivschat-logging-configuration";
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new S3Bucket(this, "example", {
+      bucket_name: "tf-ivschat-logging",
+      forceDestroy: true,
+    });
+    const awsIvschatLoggingConfigurationExample =
+      new IvschatLoggingConfiguration(this, "example_1", {
+        destinationConfiguration: {
+          s3: {
+            bucketName: example.id,
+          },
+        },
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIvschatLoggingConfigurationExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `destinationConfiguration` - (Required) Object containing destination configuration for where chat activity will be logged. This object must contain exactly one of the following children arguments:
+    * `cloudwatchLogs` - An Amazon CloudWatch Logs destination configuration where chat activity will be logged.
+        * `logGroupName` - Name of the Amazon Cloudwatch Logs destination where chat activity will be logged.
+    * `firehose` - An Amazon Kinesis Data Firehose destination configuration where chat activity will be logged.
+        * `deliveryStreamName` - Name of the Amazon Kinesis Firehose delivery stream where chat activity will be logged.
+    * `s3` - An Amazon S3 destination configuration where chat activity will be logged.
+        * `bucketName` - Name of the Amazon S3 bucket where chat activity will be logged.
+
+The following arguments are optional:
+
+* `name` - (Optional) Logging Configuration name.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Logging Configuration.
+* `id` - ID of the Logging Configuration.
+* `state` - State of the Logging Configuration.
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://www.terraform.io/docs/configuration/blocks/resources/syntax.html#operation-timeouts):
+
+* `create` - (Default `5M`)
+* `update` - (Default `5M`)
+* `delete` - (Default `5M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IVS (Interactive Video) Chat Logging Configuration using the ARN. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import IVS (Interactive Video) Chat Logging Configuration using the ARN. For example:
+
+```console
+% terraform import aws_ivschat_logging_configuration.example arn:aws:ivschat:us-west-2:326937407773:logging-configuration/MMUQc8wcqZmC
+```
+
+<!-- cache-key: cdktf-0.18.0 input-bba8a6a4c3ad40b83127a5d0756507ed6f522126fec6a06bdf49e17484976b8d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ivschat_room.html.markdown b/website/docs/cdktf/typescript/r/ivschat_room.html.markdown
new file mode 100644
index 00000000000..42d0b18c0a5
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/ivschat_room.html.markdown
@@ -0,0 +1,144 @@
+---
+subcategory: "IVS (Interactive Video) Chat"
+layout: "aws"
+page_title: "AWS: aws_ivschat_room"
+description: |-
+  Terraform resource for managing an AWS IVS (Interactive Video) Chat Room.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ivschat_room
+
+Terraform resource for managing an AWS IVS (Interactive Video) Chat Room.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { IvschatRoom } from "./.gen/providers/aws/ivschat-room";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new IvschatRoom(this, "example", {
+      name: "tf-room",
+    });
+  }
+}
+
+```
+
+## Usage with Logging Configuration to S3 Bucket
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { IvschatLoggingConfiguration } from "./.gen/providers/aws/ivschat-logging-configuration";
+import { IvschatRoom } from "./.gen/providers/aws/ivschat-room";
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new S3Bucket(this, "example", {
+      bucketPrefix: "tf-ivschat-logging-bucket-",
+      forceDestroy: true,
+    });
+    const awsIvschatLoggingConfigurationExample =
+      new IvschatLoggingConfiguration(this, "example_1", {
+        destinationConfiguration: {
+          s3: {
+            bucketName: example.id,
+          },
+        },
+        lifecycle: {
+          createBeforeDestroy: true,
+        },
+        name: "tf-ivschat-loggingconfiguration",
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIvschatLoggingConfigurationExample.overrideLogicalId("example");
+    const awsIvschatRoomExample = new IvschatRoom(this, "example_2", {
+      loggingConfigurationIdentifiers: [
+        Token.asString(awsIvschatLoggingConfigurationExample.arn),
+      ],
+      name: "tf-ivschat-room",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIvschatRoomExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are optional:
+
+* `loggingConfigurationIdentifiers` - (Optional) List of Logging Configuration
+  ARNs to attach to the room.
+* `maximumMessageLength` - (Optional) Maximum number of characters in a single
+  message. Messages are expected to be UTF-8 encoded and this limit applies
+  specifically to rune/code-point count, not number of bytes.
+* `maximumMessageRatePerSecond` - (Optional) Maximum number of messages per
+  second that can be sent to the room (by all clients).
+* `messageReviewHandler` - (Optional) Configuration information for optional
+  review of messages.
+    * `fallbackResult` - (Optional) The fallback behavior (whether the message
+    is allowed or denied) if the handler does not return a valid response,
+    encounters an error, or times out. Valid values: `allow`, `deny`.
+    * `uri` - (Optional) ARN of the lambda message review handler function.
+* `name` - (Optional) Room name.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Room.
+* `id` - Room ID
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://www.terraform.io/docs/configuration/blocks/resources/syntax.html#operation-timeouts):
+
+* `create` - (Default `5M`)
+* `update` - (Default `5M`)
+* `delete` - (Default `5M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IVS (Interactive Video) Chat Room using the ARN. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import IVS (Interactive Video) Chat Room using the ARN. For example:
+
+```console
+% terraform import aws_ivschat_room.example arn:aws:ivschat:us-west-2:326937407773:room/GoXEXyB4VwHb
+```
+
+<!-- cache-key: cdktf-0.18.0 input-3fca5b37b7d82ff4310bf108852e9d4ce3f8757446324b2c39d6248a58f1f8e6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/kendra_data_source.html.markdown b/website/docs/cdktf/typescript/r/kendra_data_source.html.markdown
new file mode 100644
index 00000000000..0b51eabcfd7
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/kendra_data_source.html.markdown
@@ -0,0 +1,695 @@
+---
+subcategory: "Kendra"
+layout: "aws"
+page_title: "AWS: aws_kendra_data_source"
+description: |-
+  Terraform resource for managing an AWS Kendra Data Source.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_kendra_data_source
+
+Terraform resource for managing an AWS Kendra Data Source.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { KendraDataSource } from "./.gen/providers/aws/kendra-data-source";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new KendraDataSource(this, "example", {
+      description: "example",
+      indexId: Token.asString(awsKendraIndexExample.id),
+      languageCode: "en",
+      name: "example",
+      tags: {
+        hello: "world",
+      },
+      type: "CUSTOM",
+    });
+  }
+}
+
+```
+
+### S3 Connector
+
+#### With Schedule
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { KendraDataSource } from "./.gen/providers/aws/kendra-data-source";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new KendraDataSource(this, "example", {
+      configuration: {
+        s3Configuration: {
+          bucketName: Token.asString(awsS3BucketExample.id),
+        },
+      },
+      indexId: Token.asString(awsKendraIndexExample.id),
+      name: "example",
+      roleArn: Token.asString(awsIamRoleExample.arn),
+      schedule: "cron(9 10 1 * ? *)",
+      type: "S3",
+    });
+  }
+}
+
+```
+
+#### With Access Control List
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { KendraDataSource } from "./.gen/providers/aws/kendra-data-source";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new KendraDataSource(this, "example", {
+      configuration: {
+        s3Configuration: {
+          accessControlListConfiguration: {
+            keyPath: "s3://${" + awsS3BucketExample.id + "}/path-1",
+          },
+          bucketName: Token.asString(awsS3BucketExample.id),
+        },
+      },
+      indexId: Token.asString(awsKendraIndexExample.id),
+      name: "example",
+      roleArn: Token.asString(awsIamRoleExample.arn),
+      type: "S3",
+    });
+  }
+}
+
+```
+
+#### With Documents Metadata Configuration
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { KendraDataSource } from "./.gen/providers/aws/kendra-data-source";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new KendraDataSource(this, "example", {
+      configuration: {
+        s3Configuration: {
+          bucketName: Token.asString(awsS3BucketExample.id),
+          documentsMetadataConfiguration: {
+            s3Prefix: "example",
+          },
+          exclusionPatterns: ["example"],
+          inclusionPatterns: ["hello"],
+          inclusionPrefixes: ["world"],
+        },
+      },
+      indexId: Token.asString(awsKendraIndexExample.id),
+      name: "example",
+      roleArn: Token.asString(awsIamRoleExample.arn),
+      type: "S3",
+    });
+  }
+}
+
+```
+
+### Web Crawler Connector
+
+#### With Seed URLs
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { KendraDataSource } from "./.gen/providers/aws/kendra-data-source";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new KendraDataSource(this, "example", {
+      configuration: {
+        webCrawlerConfiguration: {
+          urls: {
+            seedUrlConfiguration: {
+              seedUrls: ["REPLACE_WITH_YOUR_URL"],
+            },
+          },
+        },
+      },
+      indexId: Token.asString(awsKendraIndexExample.id),
+      name: "example",
+      roleArn: Token.asString(awsIamRoleExample.arn),
+      type: "WEBCRAWLER",
+    });
+  }
+}
+
+```
+
+#### With Site Maps
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { KendraDataSource } from "./.gen/providers/aws/kendra-data-source";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new KendraDataSource(this, "example", {
+      configuration: {
+        webCrawlerConfiguration: {
+          urls: {
+            siteMapsConfiguration: {
+              siteMaps: ["REPLACE_WITH_YOUR_URL"],
+            },
+          },
+        },
+      },
+      indexId: Token.asString(awsKendraIndexExample.id),
+      name: "example",
+      roleArn: Token.asString(awsIamRoleExample.arn),
+      type: "WEBCRAWLER",
+    });
+  }
+}
+
+```
+
+#### With Web Crawler Mode
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { KendraDataSource } from "./.gen/providers/aws/kendra-data-source";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new KendraDataSource(this, "example", {
+      configuration: {
+        webCrawlerConfiguration: {
+          urls: {
+            seedUrlConfiguration: {
+              seedUrls: ["REPLACE_WITH_YOUR_URL"],
+              webCrawlerMode: "SUBDOMAINS",
+            },
+          },
+        },
+      },
+      indexId: Token.asString(awsKendraIndexExample.id),
+      name: "example",
+      roleArn: Token.asString(awsIamRoleExample.arn),
+      type: "WEBCRAWLER",
+    });
+  }
+}
+
+```
+
+#### With Authentication Configuration
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { KendraDataSource } from "./.gen/providers/aws/kendra-data-source";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new KendraDataSource(this, "example", {
+      configuration: {
+        webCrawlerConfiguration: {
+          authenticationConfiguration: {
+            basicAuthentication: [
+              {
+                credentials: Token.asString(awsSecretsmanagerSecretExample.arn),
+                host: "a.example.com",
+                port: Token.asNumber("443"),
+              },
+            ],
+          },
+          urls: {
+            seedUrlConfiguration: {
+              seedUrls: ["REPLACE_WITH_YOUR_URL"],
+            },
+          },
+        },
+      },
+      dependsOn: [awsSecretsmanagerSecretVersionExample],
+      indexId: Token.asString(awsKendraIndexExample.id),
+      name: "example",
+      roleArn: Token.asString(awsIamRoleExample.arn),
+      type: "WEBCRAWLER",
+    });
+  }
+}
+
+```
+
+#### With Crawl Depth
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { KendraDataSource } from "./.gen/providers/aws/kendra-data-source";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new KendraDataSource(this, "example", {
+      configuration: {
+        webCrawlerConfiguration: {
+          crawlDepth: 3,
+          urls: {
+            seedUrlConfiguration: {
+              seedUrls: ["REPLACE_WITH_YOUR_URL"],
+            },
+          },
+        },
+      },
+      indexId: Token.asString(awsKendraIndexExample.id),
+      name: "example",
+      roleArn: Token.asString(awsIamRoleExample.arn),
+      type: "WEBCRAWLER",
+    });
+  }
+}
+
+```
+
+#### With Max Links Per Page
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { KendraDataSource } from "./.gen/providers/aws/kendra-data-source";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new KendraDataSource(this, "example", {
+      configuration: {
+        webCrawlerConfiguration: {
+          maxLinksPerPage: 100,
+          urls: {
+            seedUrlConfiguration: {
+              seedUrls: ["REPLACE_WITH_YOUR_URL"],
+            },
+          },
+        },
+      },
+      indexId: Token.asString(awsKendraIndexExample.id),
+      name: "example",
+      roleArn: Token.asString(awsIamRoleExample.arn),
+      type: "WEBCRAWLER",
+    });
+  }
+}
+
+```
+
+#### With Max Urls Per Minute Crawl Rate
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { KendraDataSource } from "./.gen/providers/aws/kendra-data-source";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new KendraDataSource(this, "example", {
+      configuration: {
+        webCrawlerConfiguration: {
+          maxUrlsPerMinuteCrawlRate: 300,
+          urls: {
+            seedUrlConfiguration: {
+              seedUrls: ["REPLACE_WITH_YOUR_URL"],
+            },
+          },
+        },
+      },
+      indexId: Token.asString(awsKendraIndexExample.id),
+      name: "example",
+      roleArn: Token.asString(awsIamRoleExample.arn),
+      type: "WEBCRAWLER",
+    });
+  }
+}
+
+```
+
+#### With Proxy Configuration
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { KendraDataSource } from "./.gen/providers/aws/kendra-data-source";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new KendraDataSource(this, "example", {
+      configuration: {
+        webCrawlerConfiguration: {
+          proxyConfiguration: {
+            credentials: Token.asString(awsSecretsmanagerSecretExample.arn),
+            host: "a.example.com",
+            port: Token.asNumber("443"),
+          },
+          urls: {
+            seedUrlConfiguration: {
+              seedUrls: ["REPLACE_WITH_YOUR_URL"],
+            },
+          },
+        },
+      },
+      dependsOn: [awsSecretsmanagerSecretVersionExample],
+      indexId: Token.asString(awsKendraIndexExample.id),
+      name: "example",
+      roleArn: Token.asString(awsIamRoleExample.arn),
+      type: "WEBCRAWLER",
+    });
+  }
+}
+
+```
+
+#### With URL Exclusion and Inclusion Patterns
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { KendraDataSource } from "./.gen/providers/aws/kendra-data-source";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new KendraDataSource(this, "example", {
+      configuration: {
+        webCrawlerConfiguration: {
+          urlExclusionPatterns: ["example"],
+          urlInclusionPatterns: ["hello"],
+          urls: {
+            seedUrlConfiguration: {
+              seedUrls: ["REPLACE_WITH_YOUR_URL"],
+            },
+          },
+        },
+      },
+      indexId: Token.asString(awsKendraIndexExample.id),
+      name: "example",
+      roleArn: Token.asString(awsIamRoleExample.arn),
+      type: "WEBCRAWLER",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `indexId` - (Required, Forces new resource) The identifier of the index for your Amazon Kendra data source.
+* `name` - (Required) A name for your data source connector.
+* `roleArn` - (Required, Optional in one scenario) The Amazon Resource Name (ARN) of a role with permission to access the data source connector. For more information, see [IAM roles for Amazon Kendra](https://docs.aws.amazon.com/kendra/latest/dg/iam-roles.html). You can't specify the `roleArn` parameter when the `type` parameter is set to `custom`. The `roleArn` parameter is required for all other data sources.
+* `type` - (Required, Forces new resource) The type of data source repository. For an updated list of values, refer to [Valid Values for Type](https://docs.aws.amazon.com/kendra/latest/dg/API_CreateDataSource.html#Kendra-CreateDataSource-request-Type).
+
+The following arguments are optional:
+
+* `configuration` - (Optional) A block with the configuration information to connect to your Data Source repository. You can't specify the `configuration` block when the `type` parameter is set to `custom`. [Detailed below](#configuration-block).
+* `customDocumentEnrichmentConfiguration` - (Optional) A block with the configuration information for altering document metadata and content during the document ingestion process. For more information on how to create, modify and delete document metadata, or make other content alterations when you ingest documents into Amazon Kendra, see [Customizing document metadata during the ingestion process](https://docs.aws.amazon.com/kendra/latest/dg/custom-document-enrichment.html). [Detailed below](#custom_document_enrichment_configuration-block).
+* `description` - (Optional) A description for the Data Source connector.
+* `languageCode` - (Optional) The code for a language. This allows you to support a language for all documents when creating the Data Source connector. English is supported by default. For more information on supported languages, including their codes, see [Adding documents in languages other than English](https://docs.aws.amazon.com/kendra/latest/dg/in-adding-languages.html).
+* `schedule` - (Optional) Sets the frequency for Amazon Kendra to check the documents in your Data Source repository and update the index. If you don't set a schedule Amazon Kendra will not periodically update the index. You can call the `startDataSourceSyncJob` API to update the index.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### configuration Block
+
+The `configuration` configuration block supports the following arguments:
+
+* `s3Configuration` - (Required if `type` is set to `s3`) A block that provides the configuration information to connect to an Amazon S3 bucket as your data source. [Detailed below](#s3_configuration-block).
+* `webCrawlerConfiguration` - (Required if `type` is set to `webcrawler`) A block that provides the configuration information required for Amazon Kendra Web Crawler. [Detailed below](#web_crawler_configuration-block).
+
+### s3_configuration Block
+
+The `s3Configuration` configuration block supports the following arguments:
+
+* `accessControlListConfiguration` - (Optional) A block that provides the path to the S3 bucket that contains the user context filtering files for the data source. For the format of the file, see [Access control for S3 data sources](https://docs.aws.amazon.com/kendra/latest/dg/s3-acl.html). [Detailed below](#access_control_list_configuration-block).
+* `bucketName` - (Required) The name of the bucket that contains the documents.
+* `documentsMetadataConfiguration` - (Optional) A block that defines the Document metadata files that contain information such as the document access control information, source URI, document author, and custom attributes. Each metadata file contains metadata about a single document. [Detailed below](#documents_metadata_configuration-block).
+* `exclusionPatterns` - (Optional) A list of glob patterns for documents that should not be indexed. If a document that matches an inclusion prefix or inclusion pattern also matches an exclusion pattern, the document is not indexed. Refer to [Exclusion Patterns for more examples](https://docs.aws.amazon.com/kendra/latest/dg/API_S3DataSourceConfiguration.html#Kendra-Type-S3DataSourceConfiguration-ExclusionPatterns).
+* `inclusionPatterns` - (Optional) A list of glob patterns for documents that should be indexed. If a document that matches an inclusion pattern also matches an exclusion pattern, the document is not indexed. Refer to [Inclusion Patterns for more examples](https://docs.aws.amazon.com/kendra/latest/dg/API_S3DataSourceConfiguration.html#Kendra-Type-S3DataSourceConfiguration-InclusionPatterns).
+* `inclusionPrefixes` - (Optional) A list of S3 prefixes for the documents that should be included in the index.
+
+### access_control_list_configuration Block
+
+The `accessControlListConfiguration` configuration block supports the following arguments:
+
+* `keyPath` - (Optional) Path to the AWS S3 bucket that contains the ACL files.
+
+### documents_metadata_configuration Block
+
+The `documentsMetadataConfiguration` configuration block supports the following arguments:
+
+* `s3Prefix` - (Optional) A prefix used to filter metadata configuration files in the AWS S3 bucket. The S3 bucket might contain multiple metadata files. Use `s3Prefix` to include only the desired metadata files.
+
+### web_crawler_configuration Block
+
+The `webCrawlerConfiguration` configuration block supports the following arguments:
+
+* `authenticationConfiguration` - (Optional) A block with the configuration information required to connect to websites using authentication. You can connect to websites using basic authentication of user name and password. You use a secret in AWS Secrets Manager to store your authentication credentials. You must provide the website host name and port number. For example, the host name of `https://aExampleCom/page1Html` is `"aExampleCom"` and the port is `443`, the standard port for HTTPS. [Detailed below](#authentication_configuration-block).
+* `crawlDepth` - (Optional) Specifies the number of levels in a website that you want to crawl. The first level begins from the website seed or starting point URL. For example, if a website has 3 levels – index level (i.e. seed in this example), sections level, and subsections level – and you are only interested in crawling information up to the sections level (i.e. levels 0-1), you can set your depth to 1. The default crawl depth is set to `2`. Minimum value of `0`. Maximum value of `10`.
+* `maxContentSizePerPageInMegaBytes` - (Optional) The maximum size (in MB) of a webpage or attachment to crawl. Files larger than this size (in MB) are skipped/not crawled. The default maximum size of a webpage or attachment is set to `50` MB. Minimum value of `10E06`. Maximum value of `50`.
+* `maxLinksPerPage` - (Optional) The maximum number of URLs on a webpage to include when crawling a website. This number is per webpage. As a website’s webpages are crawled, any URLs the webpages link to are also crawled. URLs on a webpage are crawled in order of appearance. The default maximum links per page is `100`. Minimum value of `1`. Maximum value of `1000`.
+* `maxUrlsPerMinuteCrawlRate` - (Optional) The maximum number of URLs crawled per website host per minute. The default maximum number of URLs crawled per website host per minute is `300`. Minimum value of `1`. Maximum value of `300`.
+* `proxyConfiguration` - (Optional) Configuration information required to connect to your internal websites via a web proxy. You must provide the website host name and port number. For example, the host name of `https://aExampleCom/page1Html` is `"aExampleCom"` and the port is `443`, the standard port for HTTPS. Web proxy credentials are optional and you can use them to connect to a web proxy server that requires basic authentication. To store web proxy credentials, you use a secret in [AWS Secrets Manager](https://docs.aws.amazon.com/secretsmanager/latest/userguide/intro.html). [Detailed below](#proxy_configuration-block).
+* `urlExclusionPatterns` - (Optional) A list of regular expression patterns to exclude certain URLs to crawl. URLs that match the patterns are excluded from the index. URLs that don't match the patterns are included in the index. If a URL matches both an inclusion and exclusion pattern, the exclusion pattern takes precedence and the URL file isn't included in the index. Array Members: Minimum number of `0` items. Maximum number of `100` items. Length Constraints: Minimum length of `1`. Maximum length of `150`.
+* `urlInclusionPatterns` - (Optional) A list of regular expression patterns to include certain URLs to crawl. URLs that match the patterns are included in the index. URLs that don't match the patterns are excluded from the index. If a URL matches both an inclusion and exclusion pattern, the exclusion pattern takes precedence and the URL file isn't included in the index. Array Members: Minimum number of `0` items. Maximum number of `100` items. Length Constraints: Minimum length of `1`. Maximum length of `150`.
+* `urls` - (Required) A block that specifies the seed or starting point URLs of the websites or the sitemap URLs of the websites you want to crawl. You can include website subdomains. You can list up to `100` seed URLs and up to `3` sitemap URLs. You can only crawl websites that use the secure communication protocol, Hypertext Transfer Protocol Secure (HTTPS). If you receive an error when crawling a website, it could be that the website is blocked from crawling. When selecting websites to index, you must adhere to the [Amazon Acceptable Use Policy](https://aws.amazon.com/aup/) and all other Amazon terms. Remember that you must only use Amazon Kendra Web Crawler to index your own webpages, or webpages that you have authorization to index. [Detailed below](#urls-block).
+
+### authentication_configuration Block
+
+The `authenticationConfiguration` configuration block supports the following arguments:
+
+* `basicAuthentication` - (Optional) The list of configuration information that's required to connect to and crawl a website host using basic authentication credentials. The list includes the name and port number of the website host. [Detailed below](#basic_authentication-block).
+
+### basic_authentication Block
+
+The `basicAuthentication` configuration block supports the following arguments:
+
+* `credentials` - (Required) Your secret ARN, which you can create in AWS Secrets Manager. You use a secret if basic authentication credentials are required to connect to a website. The secret stores your credentials of user name and password.
+* `host` - (Required) The name of the website host you want to connect to using authentication credentials. For example, the host name of `https://aExampleCom/page1Html` is `"aExampleCom"`.
+* `port` - (Required) The port number of the website host you want to connect to using authentication credentials. For example, the port for `https://aExampleCom/page1Html` is `443`, the standard port for HTTPS.
+
+### proxy_configuration Block
+
+The `proxyConfiguration` configuration block supports the following arguments:
+
+* `credentials` - (Optional) Your secret ARN, which you can create in AWS Secrets Manager. The credentials are optional. You use a secret if web proxy credentials are required to connect to a website host. Amazon Kendra currently support basic authentication to connect to a web proxy server. The secret stores your credentials.
+* `host` - (Required) The name of the website host you want to connect to via a web proxy server. For example, the host name of `https://aExampleCom/page1Html` is `"aExampleCom"`.
+* `port` - (Required) The port number of the website host you want to connect to via a web proxy server. For example, the port for `https://aExampleCom/page1Html` is `443`, the standard port for HTTPS.
+
+### urls Block
+
+The `urls` configuration block supports the following arguments:
+
+* `seedUrlConfiguration` - (Optional) A block that specifies the configuration of the seed or starting point URLs of the websites you want to crawl. You can choose to crawl only the website host names, or the website host names with subdomains, or the website host names with subdomains and other domains that the webpages link to. You can list up to `100` seed URLs. [Detailed below](#seed_url_configuration-block).
+* `siteMapsConfiguration` - (Optional) A block that specifies the configuration of the sitemap URLs of the websites you want to crawl. Only URLs belonging to the same website host names are crawled. You can list up to `3` sitemap URLs. [Detailed below](#site_maps_configuration-block).
+
+### seed_url_configuration Block
+
+The `seedUrlConfiguration` configuration block supports the following arguments:
+
+* `seedUrls` - (Required) The list of seed or starting point URLs of the websites you want to crawl. The list can include a maximum of `100` seed URLs. Array Members: Minimum number of `0` items. Maximum number of `100` items. Length Constraints: Minimum length of `1`. Maximum length of `2048`.
+* `webCrawlerMode` - (Optional) The default mode is set to `hostOnly`. You can choose one of the following modes:
+    * `hostOnly` – crawl only the website host names. For example, if the seed URL is `"abcExampleCom"`, then only URLs with host name `"abcExampleCom"` are crawled.
+    * `subdomains` – crawl the website host names with subdomains. For example, if the seed URL is `"abcExampleCom"`, then `"aAbcExampleCom"` and `"bAbcExampleCom"` are also crawled.
+    * `everything` – crawl the website host names with subdomains and other domains that the webpages link to.
+
+### site_maps_configuration Block
+
+The `siteMapsConfiguration` configuration block supports the following arguments:
+
+* `siteMaps` - (Required) The list of sitemap URLs of the websites you want to crawl. The list can include a maximum of `3` sitemap URLs.
+
+### custom_document_enrichment_configuration Block
+
+The `customDocumentEnrichmentConfiguration` configuration block supports the following arguments:
+
+* `inlineConfigurations` - (Optional) Configuration information to alter document attributes or metadata fields and content when ingesting documents into Amazon Kendra. Minimum number of `0` items. Maximum number of `100` items. [Detailed below](#inline_configurations-block).
+* `postExtractionHookConfiguration` - (Optional) A block that specifies the configuration information for invoking a Lambda function in AWS Lambda on the structured documents with their metadata and text extracted. You can use a Lambda function to apply advanced logic for creating, modifying, or deleting document metadata and content. For more information, see [Advanced data manipulation](https://docs.aws.amazon.com/kendra/latest/dg/custom-document-enrichment.html#advanced-data-manipulation). [Detailed below](#pre_extraction_hook_configuration-and-post_extraction_hook_configuration-blocks).
+* `preExtractionHookConfiguration` - (Optional) Configuration information for invoking a Lambda function in AWS Lambda on the original or raw documents before extracting their metadata and text. You can use a Lambda function to apply advanced logic for creating, modifying, or deleting document metadata and content. For more information, see [Advanced data manipulation](https://docs.aws.amazon.com/kendra/latest/dg/custom-document-enrichment.html#advanced-data-manipulation). [Detailed below](#pre_extraction_hook_configuration-and-post_extraction_hook_configuration-blocks).
+* `roleArn` - (Optional) The Amazon Resource Name (ARN) of a role with permission to run `preExtractionHookConfiguration` and `postExtractionHookConfiguration` for altering document metadata and content during the document ingestion process. For more information, see [IAM roles for Amazon Kendra](https://docs.aws.amazon.com/kendra/latest/dg/iam-roles.html).
+
+### inline_configurations Block
+
+The `inlineConfigurations` configuration block supports the following arguments:
+
+* `condition` - (Optional) Configuration of the condition used for the target document attribute or metadata field when ingesting documents into Amazon Kendra. See [condition](#condition-block).
+* `documentContentDeletion` - (Optional) `true` to delete content if the condition used for the target attribute is met.
+* `target` - (Optional) Configuration of the target document attribute or metadata field when ingesting documents into Amazon Kendra. You can also include a value. [Detailed below](#target-block).
+
+### condition Block
+
+The `condition` configuration blocks supports the following arguments:
+
+* `conditionDocumentAttributeKey` - (Required) The identifier of the document attribute used for the condition. For example, `sourceUri` could be an identifier for the attribute or metadata field that contains source URIs associated with the documents. Amazon Kendra currently does not support `documentBody` as an attribute key used for the condition.
+* `conditionOnValue` - (Optional) The value used by the operator. For example, you can specify the value 'financial' for strings in the `sourceUri` field that partially match or contain this value. See [condition_on_value](#condition_on_value-block).
+* `operator` - (Required) The condition operator. For example, you can use `contains` to partially match a string. Valid Values: `greaterThan` | `greaterThanOrEquals` | `lessThan` | `lessThanOrEquals` | `equals` | `notEquals` | `contains` | `notContains` | `exists` | `notExists` | `beginsWith`.
+
+### target Block
+
+The `target` configuration block supports the following arguments:
+
+* `targetDocumentAttributeKey` - (Optional) The identifier of the target document attribute or metadata field. For example, 'Department' could be an identifier for the target attribute or metadata field that includes the department names associated with the documents.
+* `targetDocumentAttributeValue` - (Optional) The target value you want to create for the target attribute. For example, 'Finance' could be the target value for the target attribute key 'Department'. See [target_document_attribute_value](#target_document_attribute_value-block).
+* `targetDocumentAttributeValueDeletion` - (Optional) `true` to delete the existing target value for your specified target attribute key. You cannot create a target value and set this to `true`. To create a target value (`targetDocumentAttributeValue`), set this to `false`.
+
+### target_document_attribute_value Block
+
+The `targetDocumentAttributeValue` configuration blocks supports the following arguments:
+
+* `dateValue` - (Optional) A date expressed as an ISO 8601 string. It is important for the time zone to be included in the ISO 8601 date-time format. As of this writing only UTC is supported. For example, `20120325T12:30:10+00:00`.
+* `longValue` - (Optional) A long integer value.
+* `stringListValue` - (Optional) A list of strings.
+* `string` - (Optional) A string, such as "department".
+
+### pre_extraction_hook_configuration and post_extraction_hook_configuration Blocks
+
+The `preExtractionHookConfiguration` and `postExtractionHookConfiguration` configuration blocks each supports the following arguments:
+
+* `invocationCondition` - (Optional) A block that specifies the condition used for when a Lambda function should be invoked. For example, you can specify a condition that if there are empty date-time values, then Amazon Kendra should invoke a function that inserts the current date-time. See [invocation_condition](#invocation_condition-block).
+* `lambdaArn` - (Required) The Amazon Resource Name (ARN) of a Lambda Function that can manipulate your document metadata fields or attributes and content.
+* `s3Bucket` - (Required) Stores the original, raw documents or the structured, parsed documents before and after altering them. For more information, see [Data contracts for Lambda functions](https://docs.aws.amazon.com/kendra/latest/dg/custom-document-enrichment.html#cde-data-contracts-lambda).
+
+### invocation_condition Block
+
+The `invocationCondition` configuration blocks supports the following arguments:
+
+* `conditionDocumentAttributeKey` - (Required) The identifier of the document attribute used for the condition. For example, `sourceUri` could be an identifier for the attribute or metadata field that contains source URIs associated with the documents. Amazon Kendra currently does not support `documentBody` as an attribute key used for the condition.
+* `conditionOnValue` - (Optional) The value used by the operator. For example, you can specify the value 'financial' for strings in the `sourceUri` field that partially match or contain this value. See [condition_on_value](#condition_on_value-block).
+* `operator` - (Required) The condition operator. For example, you can use `contains` to partially match a string. Valid Values: `greaterThan` | `greaterThanOrEquals` | `lessThan` | `lessThanOrEquals` | `equals` | `notEquals` | `contains` | `notContains` | `exists` | `notExists` | `beginsWith`.
+
+### condition_on_value Block
+
+The `conditionOnValue` configuration blocks supports the following arguments:
+
+* `dateValue` - (Optional) A date expressed as an ISO 8601 string. It is important for the time zone to be included in the ISO 8601 date-time format. As of this writing only UTC is supported. For example, `20120325T12:30:10+00:00`.
+* `longValue` - (Optional) A long integer value.
+* `stringListValue` - (Optional) A list of strings.
+* `string` - (Optional) A string, such as "department".
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Data Source.
+* `createdAt` - The Unix timestamp of when the Data Source was created.
+* `dataSourceId` - The unique identifiers of the Data Source.
+* `errorMessage` - When the Status field value is `failed`, the ErrorMessage field contains a description of the error that caused the Data Source to fail.
+* `id` - The unique identifiers of the Data Source and index separated by a slash (`/`).
+* `status` - The current status of the Data Source. When the status is `active` the Data Source is ready to use. When the status is `failed`, the `errorMessage` field contains the reason that the Data Source failed.
+* `updatedAt` - The Unix timestamp of when the Data Source was last updated.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `30M`)
+* `update` - (Default `30M`)
+* `delete` - (Default `30M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Kendra Data Source using the unique identifiers of the data_source and index separated by a slash (`/`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Kendra Data Source using the unique identifiers of the data_source and index separated by a slash (`/`). For example:
+
+```console
+% terraform import aws_kendra_data_source.example 1045d08d-66ef-4882-b3ed-dfb7df183e90/b34dfdf7-1f2b-4704-9581-79e00296845f
+```
+
+<!-- cache-key: cdktf-0.18.0 input-3d8d2a0a2fb5b1865ed53ffa27e14132c1841e03d807830e180030cfe38f2630 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/kendra_experience.html.markdown b/website/docs/cdktf/typescript/r/kendra_experience.html.markdown
new file mode 100644
index 00000000000..c5362e8cb0f
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/kendra_experience.html.markdown
@@ -0,0 +1,132 @@
+---
+subcategory: "Kendra"
+layout: "aws"
+page_title: "AWS: aws_kendra_experience"
+description: |-
+  Terraform resource for managing an AWS Kendra Experience.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_kendra_experience
+
+Terraform resource for managing an AWS Kendra Experience.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { KendraExperience } from "./.gen/providers/aws/kendra-experience";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new KendraExperience(this, "example", {
+      configuration: {
+        contentSourceConfiguration: {
+          directPutContent: true,
+          faqIds: [Token.asString(awsKendraFaqExample.faqId)],
+        },
+        userIdentityConfiguration: {
+          identityAttributeName:
+            "12345ec453-1546651e-79c4-4554-91fa-00b43ccfa245",
+        },
+      },
+      description: "My Kendra Experience",
+      indexId: Token.asString(awsKendraIndexExample.id),
+      name: "example",
+      roleArn: Token.asString(awsIamRoleExample.arn),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+~> **NOTE:** By default of the AWS Kendra API, updates to an existing `awsKendraExperience` resource (e.g. updating the `name`) will also update the `configurationContentSourceConfigurationDirectPutContent` parameter to `false` if not already provided.
+
+The following arguments are required:
+
+* `indexId` - (Required, Forces new resource) The identifier of the index for your Amazon Kendra experience.
+* `name` - (Required) A name for your Amazon Kendra experience.
+* `roleArn` - (Required) The Amazon Resource Name (ARN) of a role with permission to access `Query API`, `QuerySuggestions API`, `SubmitFeedback API`, and `AWS SSO` that stores your user and group information. For more information, see [IAM roles for Amazon Kendra](https://docs.aws.amazon.com/kendra/latest/dg/iam-roles.html).
+
+The following arguments are optional:
+
+* `description` - (Optional, Forces new resource if removed) A description for your Amazon Kendra experience.
+* `configuration` - (Optional) Configuration information for your Amazon Kendra experience. Terraform will only perform drift detection of its value when present in a configuration. [Detailed below](#configuration).
+
+### `configuration`
+
+~> **NOTE:** By default of the AWS Kendra API, the `contentSourceConfigurationDirectPutContent` parameter will be set to `false` if not provided.  
+
+The `configuration` configuration block supports the following arguments:
+
+* `contentSourceConfiguration` - (Optional, Required if `userIdentityConfiguration` not provided) The identifiers of your data sources and FAQs. Or, you can specify that you want to use documents indexed via the `BatchPutDocument API`. Terraform will only perform drift detection of its value when present in a configuration. [Detailed below](#content_source_configuration).
+* `userIdentityConfiguration` - (Optional, Required if `contentSourceConfiguration` not provided) The AWS SSO field name that contains the identifiers of your users, such as their emails. [Detailed below](#user_identity_configuration).
+
+### `contentSourceConfiguration`
+
+The `contentSourceConfiguration` configuration block supports the following arguments:
+
+* `dataSourceIds` - (Optional) The identifiers of the data sources you want to use for your Amazon Kendra experience. Maximum number of 100 items.
+* `directPutContent` - (Optional) Whether to use documents you indexed directly using the `BatchPutDocument API`. Defaults to `false`.
+* `faqIds` - (Optional) The identifier of the FAQs that you want to use for your Amazon Kendra experience. Maximum number of 100 items.
+
+### `userIdentityConfiguration`
+
+The `userIdentityConfiguration` configuration block supports the following argument:
+
+* `identityAttributeName` - (Required) The AWS SSO field name that contains the identifiers of your users, such as their emails.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The unique identifiers of the experience and index separated by a slash (`/`).
+* `arn` - ARN of the Experience.
+* `endpoints` - Shows the endpoint URLs for your Amazon Kendra experiences. The URLs are unique and fully hosted by AWS.
+    * `endpoint` - The endpoint of your Amazon Kendra experience.
+    * `endpointType` - The type of endpoint for your Amazon Kendra experience.
+* `experienceId` - The unique identifier of the experience.
+* `status` - The current processing status of your Amazon Kendra experience.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `30M`)
+* `update` - (Default `30M`)
+* `delete` - (Default `30M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Kendra Experience using the unique identifiers of the experience and index separated by a slash (`/`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Kendra Experience using the unique identifiers of the experience and index separated by a slash (`/`). For example:
+
+```console
+% terraform import aws_kendra_experience.example 1045d08d-66ef-4882-b3ed-dfb7df183e90/b34dfdf7-1f2b-4704-9581-79e00296845f
+```
+
+<!-- cache-key: cdktf-0.18.0 input-477863d25f90cf21db701a32b4767e8783661101976bd8e3bf55b7323f3e6452 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/kendra_faq.html.markdown b/website/docs/cdktf/typescript/r/kendra_faq.html.markdown
new file mode 100644
index 00000000000..063284eb38d
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/kendra_faq.html.markdown
@@ -0,0 +1,169 @@
+---
+subcategory: "Kendra"
+layout: "aws"
+page_title: "AWS: aws_kendra_faq"
+description: |-
+  Terraform resource for managing an AWS Kendra FAQ.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_kendra_faq
+
+Terraform resource for managing an AWS Kendra FAQ.
+
+## Example Usage
+
+### Basic
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { KendraFaq } from "./.gen/providers/aws/kendra-faq";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new KendraFaq(this, "example", {
+      indexId: Token.asString(awsKendraIndexExample.id),
+      name: "Example",
+      roleArn: Token.asString(awsIamRoleExample.arn),
+      s3Path: {
+        bucket: Token.asString(awsS3BucketExample.id),
+        key: Token.asString(awsS3ObjectExample.key),
+      },
+      tags: {
+        Name: "Example Kendra Faq",
+      },
+    });
+  }
+}
+
+```
+
+### With File Format
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { KendraFaq } from "./.gen/providers/aws/kendra-faq";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new KendraFaq(this, "example", {
+      fileFormat: "CSV",
+      indexId: Token.asString(awsKendraIndexExample.id),
+      name: "Example",
+      roleArn: Token.asString(awsIamRoleExample.arn),
+      s3Path: {
+        bucket: Token.asString(awsS3BucketExample.id),
+        key: Token.asString(awsS3ObjectExample.key),
+      },
+    });
+  }
+}
+
+```
+
+### With Language Code
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { KendraFaq } from "./.gen/providers/aws/kendra-faq";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new KendraFaq(this, "example", {
+      indexId: Token.asString(awsKendraIndexExample.id),
+      languageCode: "en",
+      name: "Example",
+      roleArn: Token.asString(awsIamRoleExample.arn),
+      s3Path: {
+        bucket: Token.asString(awsS3BucketExample.id),
+        key: Token.asString(awsS3ObjectExample.key),
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `indexId`- (Required, Forces new resource) The identifier of the index for a FAQ.
+* `name` - (Required, Forces new resource) The name that should be associated with the FAQ.
+* `roleArn` - (Required, Forces new resource) The Amazon Resource Name (ARN) of a role with permission to access the S3 bucket that contains the FAQs. For more information, see [IAM Roles for Amazon Kendra](https://docs.aws.amazon.com/kendra/latest/dg/iam-roles.html).
+* `s3Path` - (Required, Forces new resource) The S3 location of the FAQ input data. Detailed below.
+
+The `s3Path` configuration block supports the following arguments:
+
+* `bucket` - (Required, Forces new resource) The name of the S3 bucket that contains the file.
+* `key` - (Required, Forces new resource) The name of the file.
+
+The following arguments are optional:
+
+* `description` - (Optional, Forces new resource) The description for a FAQ.
+* `fileFormat` - (Optional, Forces new resource) The file format used by the input files for the FAQ. Valid Values are `csv`, `csvWithHeader`, `json`.
+* `languageCode` - (Optional, Forces new resource) The code for a language. This shows a supported language for the FAQ document. English is supported by default. For more information on supported languages, including their codes, see [Adding documents in languages other than English](https://docs.aws.amazon.com/kendra/latest/dg/in-adding-languages.html).
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the FAQ.
+* `createdAt` - The Unix datetime that the FAQ was created.
+* `errorMessage` - When the Status field value is `failed`, this contains a message that explains why.
+* `faqId` - The identifier of the FAQ.
+* `id` - The unique identifiers of the FAQ and index separated by a slash (`/`)
+* `status` - The status of the FAQ. It is ready to use when the status is ACTIVE.
+* `updatedAt` - The date and time that the FAQ was last updated.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `30M`)
+* `delete` - (Default `30M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsKendraFaq` using the unique identifiers of the FAQ and index separated by a slash (`/`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsKendraFaq` using the unique identifiers of the FAQ and index separated by a slash (`/`). For example:
+
+```console
+% terraform import aws_kendra_faq.example faq-123456780/idx-8012925589
+```
+
+<!-- cache-key: cdktf-0.18.0 input-57f89e70ce17623b02f00b073b804b218ccbbb5d903a356e14ccc19a733fa5e6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/kendra_index.html.markdown b/website/docs/cdktf/typescript/r/kendra_index.html.markdown
new file mode 100644
index 00000000000..731e531b23c
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/kendra_index.html.markdown
@@ -0,0 +1,818 @@
+---
+subcategory: "Kendra"
+layout: "aws"
+page_title: "AWS: aws_kendra_index"
+description: |-
+  Provides an Amazon Kendra Index resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_kendra_index
+
+Provides an Amazon Kendra Index resource.
+
+## Example Usage
+
+### Basic
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { KendraIndex } from "./.gen/providers/aws/kendra-index";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new KendraIndex(this, "example", {
+      description: "example",
+      edition: "DEVELOPER_EDITION",
+      name: "example",
+      roleArn: thisVar.arn,
+      tags: {
+        Key1: "Value1",
+      },
+    });
+  }
+}
+
+```
+
+### With capacity units
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { KendraIndex } from "./.gen/providers/aws/kendra-index";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new KendraIndex(this, "example", {
+      capacityUnits: {
+        queryCapacityUnits: 2,
+        storageCapacityUnits: 2,
+      },
+      edition: "DEVELOPER_EDITION",
+      name: "example",
+      roleArn: thisVar.arn,
+    });
+  }
+}
+
+```
+
+### With server side encryption configuration
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { KendraIndex } from "./.gen/providers/aws/kendra-index";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new KendraIndex(this, "example", {
+      name: "example",
+      roleArn: thisVar.arn,
+      serverSideEncryptionConfiguration: {
+        kmsKeyId: Token.asString(dataAwsKmsKeyThis.arn),
+      },
+    });
+  }
+}
+
+```
+
+### With user group resolution configuration
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { KendraIndex } from "./.gen/providers/aws/kendra-index";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new KendraIndex(this, "example", {
+      name: "example",
+      roleArn: thisVar.arn,
+      userGroupResolutionConfiguration: {
+        userGroupResolutionMode: "AWS_SSO",
+      },
+    });
+  }
+}
+
+```
+
+### With Document Metadata Configuration Updates
+
+#### Specifying the predefined elements
+
+Refer to [Amazon Kendra documentation on built-in document fields](https://docs.aws.amazon.com/kendra/latest/dg/hiw-index.html#index-reserved-fields) for more information.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { KendraIndex } from "./.gen/providers/aws/kendra-index";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new KendraIndex(this, "example", {
+      documentMetadataConfigurationUpdates: [
+        {
+          name: "_authors",
+          relevance: {
+            importance: 1,
+          },
+          search: {
+            displayable: false,
+            facetable: false,
+            searchable: false,
+            sortable: false,
+          },
+          type: "STRING_LIST_VALUE",
+        },
+        {
+          name: "_category",
+          relevance: {
+            importance: 1,
+            valuesImportanceMap: {},
+          },
+          search: {
+            displayable: false,
+            facetable: false,
+            searchable: false,
+            sortable: true,
+          },
+          type: "STRING_VALUE",
+        },
+        {
+          name: "_created_at",
+          relevance: {
+            duration: "25920000s",
+            freshness: false,
+            importance: 1,
+            rankOrder: "ASCENDING",
+          },
+          search: {
+            displayable: false,
+            facetable: false,
+            searchable: false,
+            sortable: true,
+          },
+          type: "DATE_VALUE",
+        },
+        {
+          name: "_data_source_id",
+          relevance: {
+            importance: 1,
+            valuesImportanceMap: {},
+          },
+          search: {
+            displayable: false,
+            facetable: false,
+            searchable: false,
+            sortable: true,
+          },
+          type: "STRING_VALUE",
+        },
+        {
+          name: "_document_title",
+          relevance: {
+            importance: 2,
+            valuesImportanceMap: {},
+          },
+          search: {
+            displayable: true,
+            facetable: false,
+            searchable: true,
+            sortable: true,
+          },
+          type: "STRING_VALUE",
+        },
+        {
+          name: "_excerpt_page_number",
+          relevance: {
+            importance: 2,
+            rankOrder: "ASCENDING",
+          },
+          search: {
+            displayable: false,
+            facetable: false,
+            searchable: false,
+            sortable: false,
+          },
+          type: "LONG_VALUE",
+        },
+        {
+          name: "_faq_id",
+          relevance: {
+            importance: 1,
+            valuesImportanceMap: {},
+          },
+          search: {
+            displayable: false,
+            facetable: false,
+            searchable: false,
+            sortable: true,
+          },
+          type: "STRING_VALUE",
+        },
+        {
+          name: "_file_type",
+          relevance: {
+            importance: 1,
+            valuesImportanceMap: {},
+          },
+          search: {
+            displayable: false,
+            facetable: false,
+            searchable: false,
+            sortable: true,
+          },
+          type: "STRING_VALUE",
+        },
+        {
+          name: "_language_code",
+          relevance: {
+            importance: 1,
+            valuesImportanceMap: {},
+          },
+          search: {
+            displayable: false,
+            facetable: false,
+            searchable: false,
+            sortable: true,
+          },
+          type: "STRING_VALUE",
+        },
+        {
+          name: "_last_updated_at",
+          relevance: {
+            duration: "25920000s",
+            freshness: false,
+            importance: 1,
+            rankOrder: "ASCENDING",
+          },
+          search: {
+            displayable: false,
+            facetable: false,
+            searchable: false,
+            sortable: true,
+          },
+          type: "DATE_VALUE",
+        },
+        {
+          name: "_source_uri",
+          relevance: {
+            importance: 1,
+            valuesImportanceMap: {},
+          },
+          search: {
+            displayable: true,
+            facetable: false,
+            searchable: false,
+            sortable: false,
+          },
+          type: "STRING_VALUE",
+        },
+        {
+          name: "_tenant_id",
+          relevance: {
+            importance: 1,
+            valuesImportanceMap: {},
+          },
+          search: {
+            displayable: false,
+            facetable: false,
+            searchable: false,
+            sortable: true,
+          },
+          type: "STRING_VALUE",
+        },
+        {
+          name: "_version",
+          relevance: {
+            importance: 1,
+            valuesImportanceMap: {},
+          },
+          search: {
+            displayable: false,
+            facetable: false,
+            searchable: false,
+            sortable: true,
+          },
+          type: "STRING_VALUE",
+        },
+        {
+          name: "_view_count",
+          relevance: {
+            importance: 1,
+            rankOrder: "ASCENDING",
+          },
+          search: {
+            displayable: false,
+            facetable: false,
+            searchable: false,
+            sortable: true,
+          },
+          type: "LONG_VALUE",
+        },
+      ],
+      name: "example",
+      roleArn: thisVar.arn,
+    });
+  }
+}
+
+```
+
+#### Appending additional elements
+
+The example below shows additional elements with names, `exampleStringValue`, `exampleLongValue`, `exampleStringListValue`, `exampleDateValue` representing the 4 types of `stringValue`, `longValue`, `stringListValue`, `dateValue` respectively.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { KendraIndex } from "./.gen/providers/aws/kendra-index";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new KendraIndex(this, "example", {
+      documentMetadataConfigurationUpdates: [
+        {
+          name: "_authors",
+          relevance: {
+            importance: 1,
+          },
+          search: {
+            displayable: false,
+            facetable: false,
+            searchable: false,
+            sortable: false,
+          },
+          type: "STRING_LIST_VALUE",
+        },
+        {
+          name: "_category",
+          relevance: {
+            importance: 1,
+            valuesImportanceMap: {},
+          },
+          search: {
+            displayable: false,
+            facetable: false,
+            searchable: false,
+            sortable: true,
+          },
+          type: "STRING_VALUE",
+        },
+        {
+          name: "_created_at",
+          relevance: {
+            duration: "25920000s",
+            freshness: false,
+            importance: 1,
+            rankOrder: "ASCENDING",
+          },
+          search: {
+            displayable: false,
+            facetable: false,
+            searchable: false,
+            sortable: true,
+          },
+          type: "DATE_VALUE",
+        },
+        {
+          name: "_data_source_id",
+          relevance: {
+            importance: 1,
+            valuesImportanceMap: {},
+          },
+          search: {
+            displayable: false,
+            facetable: false,
+            searchable: false,
+            sortable: true,
+          },
+          type: "STRING_VALUE",
+        },
+        {
+          name: "_document_title",
+          relevance: {
+            importance: 2,
+            valuesImportanceMap: {},
+          },
+          search: {
+            displayable: true,
+            facetable: false,
+            searchable: true,
+            sortable: true,
+          },
+          type: "STRING_VALUE",
+        },
+        {
+          name: "_excerpt_page_number",
+          relevance: {
+            importance: 2,
+            rankOrder: "ASCENDING",
+          },
+          search: {
+            displayable: false,
+            facetable: false,
+            searchable: false,
+            sortable: false,
+          },
+          type: "LONG_VALUE",
+        },
+        {
+          name: "_faq_id",
+          relevance: {
+            importance: 1,
+            valuesImportanceMap: {},
+          },
+          search: {
+            displayable: false,
+            facetable: false,
+            searchable: false,
+            sortable: true,
+          },
+          type: "STRING_VALUE",
+        },
+        {
+          name: "_file_type",
+          relevance: {
+            importance: 1,
+            valuesImportanceMap: {},
+          },
+          search: {
+            displayable: false,
+            facetable: false,
+            searchable: false,
+            sortable: true,
+          },
+          type: "STRING_VALUE",
+        },
+        {
+          name: "_language_code",
+          relevance: {
+            importance: 1,
+            valuesImportanceMap: {},
+          },
+          search: {
+            displayable: false,
+            facetable: false,
+            searchable: false,
+            sortable: true,
+          },
+          type: "STRING_VALUE",
+        },
+        {
+          name: "_last_updated_at",
+          relevance: {
+            duration: "25920000s",
+            freshness: false,
+            importance: 1,
+            rankOrder: "ASCENDING",
+          },
+          search: {
+            displayable: false,
+            facetable: false,
+            searchable: false,
+            sortable: true,
+          },
+          type: "DATE_VALUE",
+        },
+        {
+          name: "_source_uri",
+          relevance: {
+            importance: 1,
+            valuesImportanceMap: {},
+          },
+          search: {
+            displayable: true,
+            facetable: false,
+            searchable: false,
+            sortable: false,
+          },
+          type: "STRING_VALUE",
+        },
+        {
+          name: "_tenant_id",
+          relevance: {
+            importance: 1,
+            valuesImportanceMap: {},
+          },
+          search: {
+            displayable: false,
+            facetable: false,
+            searchable: false,
+            sortable: true,
+          },
+          type: "STRING_VALUE",
+        },
+        {
+          name: "_version",
+          relevance: {
+            importance: 1,
+            valuesImportanceMap: {},
+          },
+          search: {
+            displayable: false,
+            facetable: false,
+            searchable: false,
+            sortable: true,
+          },
+          type: "STRING_VALUE",
+        },
+        {
+          name: "_view_count",
+          relevance: {
+            importance: 1,
+            rankOrder: "ASCENDING",
+          },
+          search: {
+            displayable: false,
+            facetable: false,
+            searchable: false,
+            sortable: true,
+          },
+          type: "LONG_VALUE",
+        },
+        {
+          name: "example-string-value",
+          relevance: {
+            importance: 1,
+            valuesImportanceMap: {},
+          },
+          search: {
+            displayable: true,
+            facetable: true,
+            searchable: true,
+            sortable: true,
+          },
+          type: "STRING_VALUE",
+        },
+        {
+          name: "example-long-value",
+          relevance: {
+            importance: 1,
+            rankOrder: "ASCENDING",
+          },
+          search: {
+            displayable: true,
+            facetable: true,
+            searchable: false,
+            sortable: true,
+          },
+          type: "LONG_VALUE",
+        },
+        {
+          name: "example-string-list-value",
+          relevance: {
+            importance: 1,
+          },
+          search: {
+            displayable: true,
+            facetable: true,
+            searchable: true,
+            sortable: false,
+          },
+          type: "STRING_LIST_VALUE",
+        },
+        {
+          name: "example-date-value",
+          relevance: {
+            duration: "25920000s",
+            freshness: false,
+            importance: 1,
+            rankOrder: "ASCENDING",
+          },
+          search: {
+            displayable: true,
+            facetable: true,
+            searchable: false,
+            sortable: false,
+          },
+          type: "DATE_VALUE",
+        },
+      ],
+      name: "example",
+      roleArn: thisVar.arn,
+    });
+  }
+}
+
+```
+
+### With JSON token type configuration
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { KendraIndex } from "./.gen/providers/aws/kendra-index";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new KendraIndex(this, "example", {
+      name: "example",
+      roleArn: thisVar.arn,
+      userTokenConfigurations: {
+        jsonTokenTypeConfiguration: {
+          groupAttributeField: "groups",
+          userNameAttributeField: "username",
+        },
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `capacityUnits` - (Optional) A block that sets the number of additional document storage and query capacity units that should be used by the index. [Detailed below](#capacity_units).
+* `description` - (Optional) The description of the Index.
+* `documentMetadataConfigurationUpdates` - (Optional) One or more blocks that specify the configuration settings for any metadata applied to the documents in the index. Minimum number of 0 items. Maximum number of 500 items. If specified, you must define all elements, including those that are provided by default. These index fields are documented at [Amazon Kendra Index documentation](https://docs.aws.amazon.com/kendra/latest/dg/hiw-index.html). For an example resource that defines these default index fields, refer to the [default example above](#specifying-the-predefined-elements). For an example resource that appends additional index fields, refer to the [append example above](#appending-additional-elements). All arguments for each block must be specified. Note that blocks cannot be removed since index fields cannot be deleted. This argument is [detailed below](#document_metadata_configuration_updates).
+* `edition` - (Optional) The Amazon Kendra edition to use for the index. Choose `developerEdition` for indexes intended for development, testing, or proof of concept. Use `enterpriseEdition` for your production databases. Once you set the edition for an index, it can't be changed. Defaults to `enterpriseEdition`
+* `name` - (Required) Specifies the name of the Index.
+* `roleArn` - (Required) An AWS Identity and Access Management (IAM) role that gives Amazon Kendra permissions to access your Amazon CloudWatch logs and metrics. This is also the role you use when you call the `batchPutDocument` API to index documents from an Amazon S3 bucket.
+* `serverSideEncryptionConfiguration` - (Optional) A block that specifies the identifier of the AWS KMS customer managed key (CMK) that's used to encrypt data indexed by Amazon Kendra. Amazon Kendra doesn't support asymmetric CMKs. [Detailed below](#server_side_encryption_configuration).
+* `userContextPolicy` - (Optional) The user context policy. Valid values are `attributeFilter` or `userToken`. For more information, refer to [UserContextPolicy](https://docs.aws.amazon.com/kendra/latest/APIReference/API_CreateIndex.html#kendra-CreateIndex-request-UserContextPolicy). Defaults to `attributeFilter`.
+* `userGroupResolutionConfiguration` - (Optional) A block that enables fetching access levels of groups and users from an AWS Single Sign-On identity source. To configure this, see [UserGroupResolutionConfiguration](https://docs.aws.amazon.com/kendra/latest/dg/API_UserGroupResolutionConfiguration.html). [Detailed below](#user_group_resolution_configuration).
+* `userTokenConfigurations` - (Optional) A block that specifies the user token configuration. [Detailed below](#user_token_configurations).
+* `tags` - (Optional) Tags to apply to the Index. If configured with a provider
+[`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### `capacityUnits`
+
+A `capacityUnits` block supports the following arguments:
+
+* `queryCapacityUnits` - (Required) The amount of extra query capacity for an index and GetQuerySuggestions capacity. For more information, refer to [QueryCapacityUnits](https://docs.aws.amazon.com/kendra/latest/dg/API_CapacityUnitsConfiguration.html#Kendra-Type-CapacityUnitsConfiguration-QueryCapacityUnits).
+* `storageCapacityUnits` - (Required) The amount of extra storage capacity for an index. A single capacity unit provides 30 GB of storage space or 100,000 documents, whichever is reached first. Minimum value of 0.
+
+### `documentMetadataConfigurationUpdates`
+
+A `documentMetadataConfigurationUpdates` block supports the following arguments:
+
+* `name` - (Required) The name of the index field. Minimum length of 1. Maximum length of 30.
+* `relevance` - (Required) A block that provides manual tuning parameters to determine how the field affects the search results. [Detailed below](#relevance)
+* `search` - (Required) A block that provides information about how the field is used during a search. Documented below. [Detailed below](#search)
+* `type` - (Required) The data type of the index field. Valid values are `stringValue`, `stringListValue`, `longValue`, `dateValue`.
+
+#### `relevance`
+
+A `relevance` block supports the following attributes:
+
+* `duration` - (Required if type is of `dateValue`) Specifies the time period that the boost applies to. For more information, refer to [Duration](https://docs.aws.amazon.com/kendra/latest/dg/API_Relevance.html#Kendra-Type-Relevance-Duration).
+* `freshness` - (Required if type is of `dateValue`) Indicates that this field determines how "fresh" a document is. For more information, refer to [Freshness](https://docs.aws.amazon.com/kendra/latest/dg/API_Relevance.html#Kendra-Type-Relevance-Freshness).
+* `importance` - (Required for all types) The relative importance of the field in the search. Larger numbers provide more of a boost than smaller numbers. Minimum value of 1. Maximum value of 10.
+* `rankOrder` - (Required if type is of `dateValue`, or `longValue`) Determines how values should be interpreted. For more information, refer to [RankOrder](https://docs.aws.amazon.com/kendra/latest/dg/API_Relevance.html#Kendra-Type-Relevance-RankOrder).
+* `valuesImportanceMap` - (Required if type is of `stringValue`) A list of values that should be given a different boost when they appear in the result list. For more information, refer to [ValueImportanceMap](https://docs.aws.amazon.com/kendra/latest/dg/API_Relevance.html#Kendra-Type-Relevance-ValueImportanceMap).
+
+#### `search`
+
+A `search` block supports the following attributes:
+
+* `displayable` - (Required) Determines whether the field is returned in the query response. The default is `true`.
+* `facetable` - (Required) Indicates that the field can be used to create search facets, a count of results for each value in the field. The default is `false`.
+* `searchable` - (Required) Determines whether the field is used in the search. If the Searchable field is true, you can use relevance tuning to manually tune how Amazon Kendra weights the field in the search. The default is `true` for `string` fields and `false` for `number` and `date` fields.
+* `sortable` - (Required) Determines whether the field can be used to sort the results of a query. If you specify sorting on a field that does not have Sortable set to true, Amazon Kendra returns an exception. The default is `false`.
+
+### `serverSideEncryptionConfiguration`
+
+A `serverSideEncryptionConfiguration` block supports the following arguments:
+
+* `kmsKeyId` - (Optional) The identifier of the AWS KMScustomer master key (CMK). Amazon Kendra doesn't support asymmetric CMKs.
+
+### `userGroupResolutionConfiguration`
+
+A `userGroupResolutionConfiguration` block supports the following arguments:
+
+* `userGroupResolutionMode` - (Required) The identity store provider (mode) you want to use to fetch access levels of groups and users. AWS Single Sign-On is currently the only available mode. Your users and groups must exist in an AWS SSO identity source in order to use this mode. Valid Values are `awsSso` or `none`.
+
+### `userTokenConfigurations`
+
+A `userTokenConfigurations` block supports the following arguments:
+
+* `jsonTokenTypeConfiguration` - (Optional) A block that specifies the information about the JSON token type configuration. [Detailed below](#json_token_type_configuration).
+* `jwtTokenTypeConfiguration` - (Optional) A block that specifies the information about the JWT token type configuration. [Detailed below](#jwt_token_type_configuration).
+
+#### `jsonTokenTypeConfiguration`
+
+A `jsonTokenTypeConfiguration` block supports the following arguments:
+
+* `groupAttributeField` - (Required) The group attribute field. Minimum length of 1. Maximum length of 2048.
+* `userNameAttributeField` - (Required) The user name attribute field. Minimum length of 1. Maximum length of 2048.
+
+#### `jwtTokenTypeConfiguration`
+
+A `jwtTokenTypeConfiguration` block supports the following arguments:
+
+* `claimRegex` - (Optional) The regular expression that identifies the claim. Minimum length of 1. Maximum length of 100.
+* `groupAttributeField` - (Optional) The group attribute field. Minimum length of 1. Maximum length of 100.
+* `issuer` - (Optional) The issuer of the token. Minimum length of 1. Maximum length of 65.
+* `keyLocation` - (Required) The location of the key. Valid values are `url` or `secretManager`
+* `secretsManagerArn` - (Optional) The Amazon Resource Name (ARN) of the secret.
+* `url` - (Optional) The signing key URL. Valid pattern is `^(https?|ftp|file):\/\/([^\s]*)`
+* `userNameAttributeField` - (Optional) The user name attribute field. Minimum length of 1. Maximum length of 100.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `40M`)
+* `delete` - (Default `40M`)
+* `update` - (Default `40M`)
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the Index.
+* `createdAt` - The Unix datetime that the index was created.
+* `errorMessage` - When the Status field value is `failed`, this contains a message that explains why.
+* `id` - The identifier of the Index.
+* `indexStatistics` - A block that provides information about the number of FAQ questions and answers and the number of text documents indexed. [Detailed below](#index_statistics).
+* `status` - The current status of the index. When the value is `active`, the index is ready for use. If the Status field value is `failed`, the `errorMessage` field contains a message that explains why.
+* `updatedAt` - The Unix datetime that the index was last updated.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+### `indexStatistics`
+
+A `indexStatistics` block supports the following attributes:
+
+* `faqStatistics` - A block that specifies the number of question and answer topics in the index. [Detailed below](#faq_statistics).
+* `textDocumentStatistics` - A block that specifies the number of text documents indexed. [Detailed below](#text_document_statistics).
+
+#### `faqStatistics`
+
+A `faqStatistics` block supports the following attributes:
+
+* `indexedQuestionAnswersCount` - The total number of FAQ questions and answers contained in the index.
+
+#### `textDocumentStatistics`
+
+A `textDocumentStatistics` block supports the following attributes:
+
+* `indexedTextBytes` - The total size, in bytes, of the indexed documents.
+* `indexedTextDocumentsCount` - The number of text documents indexed.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Amazon Kendra Indexes using its `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Amazon Kendra Indexes using its `id`. For example:
+
+```console
+% terraform import aws_kendra_index.example 12345678-1234-5678-9123-123456789123
+```
+
+<!-- cache-key: cdktf-0.18.0 input-00f20f85239aecb494058ad449f9a2170d10a5017c988607e2f0d4556b31b4f2 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/kendra_query_suggestions_block_list.html.markdown b/website/docs/cdktf/typescript/r/kendra_query_suggestions_block_list.html.markdown
new file mode 100644
index 00000000000..71856cdee20
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/kendra_query_suggestions_block_list.html.markdown
@@ -0,0 +1,105 @@
+---
+subcategory: "Kendra"
+layout: "aws"
+page_title: "AWS: aws_kendra_query_suggestions_block_list"
+description: |-
+  Terraform resource for managing an AWS Kendra block list used for query suggestions for an index
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_kendra_query_suggestions_block_list
+
+Use the `awsKendraIndexBlockList` resource to manage an AWS Kendra block list used for query suggestions for an index.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { KendraQuerySuggestionsBlockList } from "./.gen/providers/aws/kendra-query-suggestions-block-list";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new KendraQuerySuggestionsBlockList(this, "example", {
+      indexId: Token.asString(awsKendraIndexExample.id),
+      name: "Example",
+      roleArn: Token.asString(awsIamRoleExample.arn),
+      sourceS3Path: {
+        bucket: Token.asString(awsS3BucketExample.id),
+        key: "example/suggestions.txt",
+      },
+      tags: {
+        Name: "Example Kendra Index",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `indexId` - (Required, Forces New Resource) Identifier of the index for a block list.
+* `name` - (Required) Name for the block list.
+* `roleArn` - (Required) IAM (Identity and Access Management) role used to access the block list text file in S3.
+* `sourceS3Path` - (Required) S3 path where your block list text file is located. See details below.
+
+The `sourceS3Path` configuration block supports the following arguments:
+
+* `bucket` - (Required) Name of the S3 bucket that contains the file.
+* `key` - (Required) Name of the file.
+
+The following arguments are optional:
+
+* `description` - (Optional) Description for a block list.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block), tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the block list.
+* `querySuggestionsBlockListId` - Unique identifier of the block list.
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider's [default_tags configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+Configuration options for operation timeouts can be found [here](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts).
+
+* `create` - (Default `30M`)
+* `update` - (Default `30M`)
+* `delete` - (Default `30M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import the `awsKendraQuerySuggestionsBlockList` resource using the unique identifiers of the block list and index separated by a slash (`/`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import the `awsKendraQuerySuggestionsBlockList` resource using the unique identifiers of the block list and index separated by a slash (`/`). For example:
+
+```console
+% terraform import aws_kendra_query_suggestions_block_list.example blocklist-123456780/idx-8012925589
+```
+
+<!-- cache-key: cdktf-0.18.0 input-6163688d652d44086864869ca5678b9e49c9f4dfd42ccb33a1b997d4692a3df0 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/kendra_thesaurus.html.markdown b/website/docs/cdktf/typescript/r/kendra_thesaurus.html.markdown
new file mode 100644
index 00000000000..b34dafc9428
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/kendra_thesaurus.html.markdown
@@ -0,0 +1,104 @@
+---
+subcategory: "Kendra"
+layout: "aws"
+page_title: "AWS: aws_kendra_thesaurus"
+description: |-
+  Terraform resource for managing an AWS Kendra Thesaurus.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_kendra_thesaurus
+
+Terraform resource for managing an AWS Kendra Thesaurus.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { KendraThesaurus } from "./.gen/providers/aws/kendra-thesaurus";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new KendraThesaurus(this, "example", {
+      indexId: Token.asString(awsKendraIndexExample.id),
+      name: "Example",
+      roleArn: Token.asString(awsIamRoleExample.arn),
+      sourceS3Path: {
+        bucket: Token.asString(awsS3BucketExample.id),
+        key: Token.asString(awsS3ObjectExample.key),
+      },
+      tags: {
+        Name: "Example Kendra Thesaurus",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `indexId`- (Required, Forces new resource) The identifier of the index for a thesaurus.
+* `name` - (Required) The name for the thesaurus.
+* `roleArn` - (Required) The IAM (Identity and Access Management) role used to access the thesaurus file in S3.
+* `sourceS3Path` - (Required) The S3 path where your thesaurus file sits in S3. Detailed below.
+
+The `sourceS3Path` configuration block supports the following arguments:
+
+* `bucket` - (Required) The name of the S3 bucket that contains the file.
+* `key` - (Required) The name of the file.
+
+The following arguments are optional:
+
+* `description` - (Optional) The description for a thesaurus.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the thesaurus.
+* `id` - The unique identifiers of the thesaurus and index separated by a slash (`/`).
+* `status` - The current status of the thesaurus.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `30M`)
+* `update` - (Default `30M`)
+* `delete` - (Default `30M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsKendraThesaurus` using the unique identifiers of the thesaurus and index separated by a slash (`/`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsKendraThesaurus` using the unique identifiers of the thesaurus and index separated by a slash (`/`). For example:
+
+```console
+% terraform import aws_kendra_thesaurus.example thesaurus-123456780/idx-8012925589
+```
+
+<!-- cache-key: cdktf-0.18.0 input-c0dadf9d404f36bcb0eb8e47f42f731ded578d3015ecba91c35c34dacf029082 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/key_pair.html.markdown b/website/docs/cdktf/typescript/r/key_pair.html.markdown
new file mode 100644
index 00000000000..b62ecec82c2
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/key_pair.html.markdown
@@ -0,0 +1,92 @@
+---
+subcategory: "EC2 (Elastic Compute Cloud)"
+layout: "aws"
+page_title: "AWS: aws_key_pair"
+description: |-
+  Provides a Key Pair resource. Currently this supports importing an existing key pair but not creating a new key pair.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_key_pair
+
+Provides an [EC2 key pair](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-key-pairs.html) resource. A key pair is used to control login access to EC2 instances.
+
+Currently this resource requires an existing user-supplied key pair. This key pair's public key will be registered with AWS to allow logging-in to EC2 instances.
+
+When importing an existing key pair the public key material may be in any format supported by AWS. Supported formats (per the [AWS documentation](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-key-pairs.html#how-to-generate-your-own-key-and-import-it-to-aws)) are:
+
+* OpenSSH public key format (the format in ~/.ssh/authorized_keys)
+* Base64 encoded DER format
+* SSH public key file format as specified in RFC4716
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { KeyPair } from "./.gen/providers/aws/key-pair";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new KeyPair(this, "deployer", {
+      keyName: "deployer-key",
+      publicKey:
+        "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQD3F6tyPEFEzV0LX3X8BsXdMsQz1x2cEikKDEY0aIj41qgxMCP/iteneqXSIFZBp5vizPvaoIR3Um9xK7PGoW8giupGn+EPuxIA4cDM4vzOqOkiMPhz5XK0whEjkVzTo4+S0puvDZuwIsdiW9mxhJc7tgBNL0cYlWSYVkz4G/fslNfRPW5mYAM49f4fhtxPb5ok4Q2Lg9dPKVHO/Bgeu5woMc7RY0p1ej6D4CKFE6lymSDJpW0YHX/wqE9+cfEauh7xZcG0q9t2ta6F6fmX0agvpFyZo8aFbXeUBr7osSCJNgvavWbM/06niWrOvYX2xwWdhXmXSrbX8ZbabVohBK41 email@example.com",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `keyName` - (Optional) The name for the key pair. If neither `keyName` nor `keyNamePrefix` is provided, Terraform will create a unique key name using the prefix `terraform`.
+* `keyNamePrefix` - (Optional) Creates a unique name beginning with the specified prefix. Conflicts with `keyName`. If neither `keyName` nor `keyNamePrefix` is provided, Terraform will create a unique key name using the prefix `terraform`.
+* `publicKey` - (Required) The public key material.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The key pair name.
+* `arn` - The key pair ARN.
+* `keyName` - The key pair name.
+* `keyPairId` - The key pair ID.
+* `keyType` - The type of key pair.
+* `fingerprint` - The MD5 public key fingerprint as specified in section 4 of RFC 4716.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Key Pairs using the `keyName`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Key Pairs using the `keyName`. For example:
+
+```console
+% terraform import aws_key_pair.deployer deployer-key
+```
+
+~> **NOTE:** The AWS API does not include the public key in the response, so `terraform apply` will attempt to replace the key pair. There is currently no supported workaround for this limitation.
+
+<!-- cache-key: cdktf-0.18.0 input-bc4b2bf30b41e8b680f59b0e745bd630e891fca6baac140b343a76369eb3e8aa -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/keyspaces_keyspace.html.markdown b/website/docs/cdktf/typescript/r/keyspaces_keyspace.html.markdown
new file mode 100644
index 00000000000..3ea95c4633a
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/keyspaces_keyspace.html.markdown
@@ -0,0 +1,86 @@
+---
+subcategory: "Keyspaces (for Apache Cassandra)"
+layout: "aws"
+page_title: "AWS: aws_keyspaces_keyspace"
+description: |-
+  Provides a Keyspaces Keyspace.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_keyspaces_keyspace
+
+Provides a Keyspaces Keyspace.
+
+More information about keyspaces can be found in the [Keyspaces User Guide](https://docs.aws.amazon.com/keyspaces/latest/devguide/what-is-keyspaces.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { KeyspacesKeyspace } from "./.gen/providers/aws/keyspaces-keyspace";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new KeyspacesKeyspace(this, "example", {
+      name: "my_keyspace",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required, Forces new resource) The name of the keyspace to be created.
+
+The following arguments are optional:
+
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name of the keyspace.
+* `arn` - The ARN of the keyspace.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `1M`)
+- `delete` - (Default `1M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import a keyspace using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import a keyspace using the `name`. For example:
+
+```console
+% terraform import aws_keyspaces_keyspace.example my_keyspace
+```
+
+<!-- cache-key: cdktf-0.18.0 input-45356374226b4001cb8f4913ce874bd4156dabd51b8ab1e4fe9896d2e554989a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/keyspaces_table.html.markdown b/website/docs/cdktf/typescript/r/keyspaces_table.html.markdown
new file mode 100644
index 00000000000..01a7dffe78e
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/keyspaces_table.html.markdown
@@ -0,0 +1,161 @@
+---
+subcategory: "Keyspaces (for Apache Cassandra)"
+layout: "aws"
+page_title: "AWS: aws_keyspaces_table"
+description: |-
+  Provides a Keyspaces Table.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_keyspaces_table
+
+Provides a Keyspaces Table.
+
+More information about Keyspaces tables can be found in the [Keyspaces Developer Guide](https://docs.aws.amazon.com/keyspaces/latest/devguide/working-with-tables.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { KeyspacesTable } from "./.gen/providers/aws/keyspaces-table";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new KeyspacesTable(this, "example", {
+      keyspaceName: Token.asString(awsKeyspacesKeyspaceExample.name),
+      schemaDefinition: {
+        column: [
+          {
+            name: "Message",
+            type: "ASCII",
+          },
+        ],
+        partitionKey: [
+          {
+            name: "Message",
+          },
+        ],
+      },
+      tableName: "my_table",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `keyspaceName` - (Required) The name of the keyspace that the table is going to be created in.
+* `tableName` - (Required) The name of the table.
+
+The following arguments are optional:
+
+* `capacitySpecification` - (Optional) Specifies the read/write throughput capacity mode for the table.
+* `clientSideTimestamps` - (Optional) Enables client-side timestamps for the table. By default, the setting is disabled.
+* `comment` - (Optional) A description of the table.
+* `defaultTimeToLive` - (Optional) The default Time to Live setting in seconds for the table. More information can be found in the [Developer Guide](https://docs.aws.amazon.com/keyspaces/latest/devguide/TTL-how-it-works.html#ttl-howitworks_default_ttl).
+* `encryptionSpecification` - (Optional) Specifies how the encryption key for encryption at rest is managed for the table. More information can be found in the [Developer Guide](https://docs.aws.amazon.com/keyspaces/latest/devguide/EncryptionAtRest.html).
+* `pointInTimeRecovery` - (Optional) Specifies if point-in-time recovery is enabled or disabled for the table. More information can be found in the [Developer Guide](https://docs.aws.amazon.com/keyspaces/latest/devguide/PointInTimeRecovery.html).
+* `schemaDefinition` - (Optional) Describes the schema of the table.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `ttl` - (Optional) Enables Time to Live custom settings for the table. More information can be found in the [Developer Guide](https://docs.aws.amazon.com/keyspaces/latest/devguide/TTL.html).
+
+The `capacitySpecification` object takes the following arguments:
+
+* `readCapacityUnits` - (Optional) The throughput capacity specified for read operations defined in read capacity units (RCUs).
+* `throughputMode` - (Optional) The read/write throughput capacity mode for a table. Valid values: `payPerRequest`, `provisioned`. The default value is `payPerRequest`.
+* `writeCapacityUnits` - (Optional) The throughput capacity specified for write operations defined in write capacity units (WCUs).
+
+The `clientSideTimestamps` object takes the following arguments:
+
+* `status` - (Required) Shows how to enable client-side timestamps settings for the specified table. Valid values: `enabled`.
+
+The `comment` object takes the following arguments:
+
+* `message` - (Required) A description of the table.
+
+The `encryptionSpecification` object takes the following arguments:
+
+* `kmsKeyIdentifier` - (Optional) The Amazon Resource Name (ARN) of the customer managed KMS key.
+* `type` - (Optional) The encryption option specified for the table. Valid values: `awsOwnedKmsKey`, `customerManagedKmsKey`. The default value is `awsOwnedKmsKey`.
+
+The `pointInTimeRecovery` object takes the following arguments:
+
+* `status` - (Optional) Valid values: `enabled`, `disabled`. The default value is `disabled`.
+
+The `schemaDefinition` object takes the following arguments:
+
+* `column` - (Required) The regular columns of the table.
+* `partitionKey` - (Required) The columns that are part of the partition key of the table .
+* `clusteringKey` - (Required) The columns that are part of the clustering key of the table.
+* `staticColumn` - (Required) The columns that have been defined as `static`. Static columns store values that are shared by all rows in the same partition.
+
+The `column` object takes the following arguments:
+
+* `name` - (Required) The name of the column.
+* `type` - (Required) The data type of the column. See the [Developer Guide](https://docs.aws.amazon.com/keyspaces/latest/devguide/cql.elements.html#cql.data-types) for a list of available data types.
+
+The `partitionKey` object takes the following arguments:
+
+* `name` - (Required) The name of the partition key column.
+
+The `clusteringKey` object takes the following arguments:
+
+* `name` - (Required) The name of the clustering key column.
+* `orderBy` - (Required) The order modifier. Valid values: `asc`, `desc`.
+
+The `staticColumn` object takes the following arguments:
+
+* `name` - (Required) The name of the static column.
+
+The `ttl` object takes the following arguments:
+
+* `status` - (Optional) Valid values: `enabled`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the table.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `10M`)
+- `update` - (Default `30M`)
+- `delete` - (Default `10M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import a table using the `keyspaceName` and `tableName` separated by `/`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import a table using the `keyspaceName` and `tableName` separated by `/`. For example:
+
+```console
+% terraform import aws_keyspaces_table.example my_keyspace/my_table
+```
+
+<!-- cache-key: cdktf-0.18.0 input-e2a472d7a9fbc6d115fb0eeeff221a8837a9848972c20cbad7590570183d75aa -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/kinesis_analytics_application.html.markdown b/website/docs/cdktf/typescript/r/kinesis_analytics_application.html.markdown
new file mode 100644
index 00000000000..290dffa3473
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/kinesis_analytics_application.html.markdown
@@ -0,0 +1,413 @@
+---
+subcategory: "Kinesis Analytics"
+layout: "aws"
+page_title: "AWS: aws_kinesis_analytics_application"
+description: |-
+  Provides a AWS Kinesis Analytics Application
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_kinesis_analytics_application
+
+Provides a Kinesis Analytics Application resource. Kinesis Analytics is a managed service that
+allows processing and analyzing streaming data using standard SQL.
+
+For more details, see the [Amazon Kinesis Analytics Documentation][1].
+
+-> **Note:** To manage Amazon Kinesis Data Analytics for Apache Flink applications, use the [`awsKinesisanalyticsv2Application`](/docs/providers/aws/r/kinesisanalyticsv2_application.html) resource.
+
+## Example Usage
+
+### Kinesis Stream Input
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { KinesisAnalyticsApplication } from "./.gen/providers/aws/kinesis-analytics-application";
+import { KinesisStream } from "./.gen/providers/aws/kinesis-stream";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const testStream = new KinesisStream(this, "test_stream", {
+      name: "terraform-kinesis-test",
+      shardCount: 1,
+    });
+    new KinesisAnalyticsApplication(this, "test_application", {
+      inputs: {
+        kinesisStream: {
+          resourceArn: testStream.arn,
+          roleArn: test.arn,
+        },
+        namePrefix: "test_prefix",
+        parallelism: {
+          count: 1,
+        },
+        schema: {
+          recordColumns: [
+            {
+              mapping: "$.test",
+              name: "test",
+              sqlType: "VARCHAR(8)",
+            },
+          ],
+          recordEncoding: "UTF-8",
+          recordFormat: {
+            mappingParameters: {
+              json: {
+                recordRowPath: "$",
+              },
+            },
+          },
+        },
+      },
+      name: "kinesis-analytics-application-test",
+    });
+  }
+}
+
+```
+
+### Starting An Application
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudwatchLogGroup } from "./.gen/providers/aws/cloudwatch-log-group";
+import { CloudwatchLogStream } from "./.gen/providers/aws/cloudwatch-log-stream";
+import { KinesisAnalyticsApplication } from "./.gen/providers/aws/kinesis-analytics-application";
+import { KinesisFirehoseDeliveryStream } from "./.gen/providers/aws/kinesis-firehose-delivery-stream";
+import { KinesisStream } from "./.gen/providers/aws/kinesis-stream";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new CloudwatchLogGroup(this, "example", {
+      name: "analytics",
+    });
+    const awsCloudwatchLogStreamExample = new CloudwatchLogStream(
+      this,
+      "example_1",
+      {
+        logGroupName: example.name,
+        name: "example-kinesis-application",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsCloudwatchLogStreamExample.overrideLogicalId("example");
+    const awsKinesisFirehoseDeliveryStreamExample =
+      new KinesisFirehoseDeliveryStream(this, "example_2", {
+        destination: "extended_s3",
+        extendedS3Configuration: {
+          bucketArn: Token.asString(awsS3BucketExample.arn),
+          roleArn: Token.asString(awsIamRoleExample.arn),
+        },
+        name: "example-kinesis-delivery-stream",
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsKinesisFirehoseDeliveryStreamExample.overrideLogicalId("example");
+    const awsKinesisStreamExample = new KinesisStream(this, "example_3", {
+      name: "example-kinesis-stream",
+      shardCount: 1,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsKinesisStreamExample.overrideLogicalId("example");
+    new KinesisAnalyticsApplication(this, "test", {
+      cloudwatchLoggingOptions: {
+        logStreamArn: Token.asString(awsCloudwatchLogStreamExample.arn),
+        roleArn: Token.asString(awsIamRoleExample.arn),
+      },
+      inputs: {
+        kinesisStream: {
+          resourceArn: Token.asString(awsKinesisStreamExample.arn),
+          roleArn: Token.asString(awsIamRoleExample.arn),
+        },
+        namePrefix: "example_prefix",
+        schema: {
+          recordColumns: [
+            {
+              name: "COLUMN_1",
+              sqlType: "INTEGER",
+            },
+          ],
+          recordFormat: {
+            mappingParameters: {
+              csv: {
+                recordColumnDelimiter: ",",
+                recordRowDelimiter: "|",
+              },
+            },
+          },
+        },
+        startingPositionConfiguration: [
+          {
+            startingPosition: "NOW",
+          },
+        ],
+      },
+      name: "example-application",
+      outputs: [
+        {
+          kinesisFirehose: {
+            resourceArn: Token.asString(
+              awsKinesisFirehoseDeliveryStreamExample.arn
+            ),
+            roleArn: Token.asString(awsIamRoleExample.arn),
+          },
+          name: "OUTPUT_1",
+          schema: {
+            recordFormatType: "CSV",
+          },
+        },
+      ],
+      startApplication: true,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) Name of the Kinesis Analytics Application.
+* `code` - (Optional) SQL Code to transform input data, and generate output.
+* `description` - (Optional) Description of the application.
+* `cloudwatchLoggingOptions` - (Optional) The CloudWatch log stream options to monitor application errors.
+See [CloudWatch Logging Options](#cloudwatch-logging-options) below for more details.
+* `inputs` - (Optional) Input configuration of the application. See [Inputs](#inputs) below for more details.
+* `outputs` - (Optional) Output destination configuration of the application. See [Outputs](#outputs) below for more details.
+* `referenceDataSources` - (Optional) An S3 Reference Data Source for the application.
+See [Reference Data Sources](#reference-data-sources) below for more details.
+* `startApplication` - (Optional) Whether to start or stop the Kinesis Analytics Application. To start an application, an input with a defined `startingPosition` must be configured.
+To modify an application's starting position, first stop the application by setting `start_application = false`, then update `startingPosition` and set `start_application = true`.
+* `tags` - Key-value map of tags for the Kinesis Analytics Application. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### CloudWatch Logging Options
+
+Configure a CloudWatch Log Stream to monitor application errors.
+
+The `cloudwatchLoggingOptions` block supports the following:
+
+* `logStreamArn` - (Required) The ARN of the CloudWatch Log Stream.
+* `roleArn` - (Required) The ARN of the IAM Role used to send application messages.
+
+### Inputs
+
+Configure an Input for the Kinesis Analytics Application. You can only have 1 Input configured.
+
+The `inputs` block supports the following:
+
+* `namePrefix` - (Required) The Name Prefix to use when creating an in-application stream.
+* `schema` - (Required) The Schema format of the data in the streaming source. See [Source Schema](#source-schema) below for more details.
+* `kinesisFirehose` - (Optional) The Kinesis Firehose configuration for the streaming source. Conflicts with `kinesisStream`.
+See [Kinesis Firehose](#kinesis-firehose) below for more details.
+* `kinesisStream` - (Optional) The Kinesis Stream configuration for the streaming source. Conflicts with `kinesisFirehose`.
+See [Kinesis Stream](#kinesis-stream) below for more details.
+* `parallelism` - (Optional) The number of Parallel in-application streams to create.
+See [Parallelism](#parallelism) below for more details.
+* `processingConfiguration` - (Optional) The Processing Configuration to transform records as they are received from the stream.
+See [Processing Configuration](#processing-configuration) below for more details.
+* `startingPositionConfiguration` (Optional) The point at which the application starts processing records from the streaming source.
+See [Starting Position Configuration](#starting-position-configuration) below for more details.
+
+### Outputs
+
+Configure Output destinations for the Kinesis Analytics Application. You can have a maximum of 3 destinations configured.
+
+The `outputs` block supports the following:
+
+* `name` - (Required) The Name of the in-application stream.
+* `schema` - (Required) The Schema format of the data written to the destination. See [Destination Schema](#destination-schema) below for more details.
+* `kinesisFirehose` - (Optional) The Kinesis Firehose configuration for the destination stream. Conflicts with `kinesisStream`.
+See [Kinesis Firehose](#kinesis-firehose) below for more details.
+* `kinesisStream` - (Optional) The Kinesis Stream configuration for the destination stream. Conflicts with `kinesisFirehose`.
+See [Kinesis Stream](#kinesis-stream) below for more details.
+* `lambda` - (Optional) The Lambda function destination. See [Lambda](#lambda) below for more details.
+
+### Reference Data Sources
+
+Add a Reference Data Source to the Kinesis Analytics Application. You can only have 1 Reference Data Source.
+
+The `referenceDataSources` block supports the following:
+
+* `schema` - (Required) The Schema format of the data in the streaming source. See [Source Schema](#source-schema) below for more details.
+* `tableName` - (Required) The in-application Table Name.
+* `s3` - (Optional) The S3 configuration for the reference data source. See [S3 Reference](#s3-reference) below for more details.
+
+#### Kinesis Firehose
+
+Configuration for a Kinesis Firehose delivery stream.
+
+The `kinesisFirehose` block supports the following:
+
+* `resourceArn` - (Required) The ARN of the Kinesis Firehose delivery stream.
+* `roleArn` - (Required) The ARN of the IAM Role used to access the stream.
+
+#### Kinesis Stream
+
+Configuration for a Kinesis Stream.
+
+The `kinesisStream` block supports the following:
+
+* `resourceArn` - (Required) The ARN of the Kinesis Stream.
+* `roleArn` - (Required) The ARN of the IAM Role used to access the stream.
+
+#### Destination Schema
+
+The Schema format of the data in the destination.
+
+The `schema` block supports the following:
+
+* `recordFormatType` - (Required) The Format Type of the records on the output stream. Can be `csv` or `json`.
+
+#### Source Schema
+
+The Schema format of the data in the streaming source.
+
+The `schema` block supports the following:
+
+* `recordColumns` - (Required) The Record Column mapping for the streaming source data element.
+See [Record Columns](#record-columns) below for more details.
+* `recordFormat` - (Required) The Record Format and mapping information to schematize a record.
+See [Record Format](#record-format) below for more details.
+* `recordEncoding` - (Optional) The Encoding of the record in the streaming source.
+
+#### Parallelism
+
+Configures the number of Parallel in-application streams to create.
+
+The `parallelism` block supports the following:
+
+* `count` - (Required) The Count of streams.
+
+#### Processing Configuration
+
+The Processing Configuration to transform records as they are received from the stream.
+
+The `processingConfiguration` block supports the following:
+
+* `lambda` - (Required) The Lambda function configuration. See [Lambda](#lambda) below for more details.
+
+#### Lambda
+
+The Lambda function that pre-processes records in the stream.
+
+The `lambda` block supports the following:
+
+* `resourceArn` - (Required) The ARN of the Lambda function.
+* `roleArn` - (Required) The ARN of the IAM Role used to access the Lambda function.
+
+#### Starting Position Configuration
+
+The point at which the application reads from the streaming source.
+
+The `startingPositionConfiguration` block supports the following:
+
+* `startingPosition` - (Required) The starting position on the stream. Valid values: `lastStoppedPoint`, `now`, `trimHorizon`.
+
+#### Record Columns
+
+The Column mapping of each data element in the streaming source to the corresponding column in the in-application stream.
+
+The `recordColumns` block supports the following:
+
+* `name` - (Required) Name of the column.
+* `sqlType` - (Required) The SQL Type of the column.
+* `mapping` - (Optional) The Mapping reference to the data element.
+
+#### Record Format
+
+The Record Format and relevant mapping information that should be applied to schematize the records on the stream.
+
+The `recordFormat` block supports the following:
+
+* `recordFormatType` - (Required) The type of Record Format. Can be `csv` or `json`.
+* `mappingParameters` - (Optional) The Mapping Information for the record format.
+See [Mapping Parameters](#mapping-parameters) below for more details.
+
+#### Mapping Parameters
+
+Provides Mapping information specific to the record format on the streaming source.
+
+The `mappingParameters` block supports the following:
+
+* `csv` - (Optional) Mapping information when the record format uses delimiters.
+See [CSV Mapping Parameters](#csv-mapping-parameters) below for more details.
+* `json` - (Optional) Mapping information when JSON is the record format on the streaming source.
+See [JSON Mapping Parameters](#json-mapping-parameters) below for more details.
+
+#### CSV Mapping Parameters
+
+Mapping information when the record format uses delimiters.
+
+The `csv` block supports the following:
+
+* `recordColumnDelimiter` - (Required) The Column Delimiter.
+* `recordRowDelimiter` - (Required) The Row Delimiter.
+
+#### JSON Mapping Parameters
+
+Mapping information when JSON is the record format on the streaming source.
+
+The `json` block supports the following:
+
+* `recordRowPath` - (Required) Path to the top-level parent that contains the records.
+
+#### S3 Reference
+
+Identifies the S3 bucket and object that contains the reference data.
+
+The `s3` blcok supports the following:
+
+* `bucketArn` - (Required) The S3 Bucket ARN.
+* `fileKey` - (Required) The File Key name containing reference data.
+* `roleArn` - (Required) The IAM Role ARN to read the data.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ARN of the Kinesis Analytics Application.
+* `arn` - The ARN of the Kinesis Analytics Appliation.
+* `createTimestamp` - The Timestamp when the application version was created.
+* `lastUpdateTimestamp` - The Timestamp when the application was last updated.
+* `status` - The Status of the application.
+* `version` - The Version of the application.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+[1]: https://docs.aws.amazon.com/kinesisanalytics/latest/dev/what-is.html
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Kinesis Analytics Application using ARN. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Kinesis Analytics Application using ARN. For example:
+
+```console
+% terraform import aws_kinesis_analytics_application.example arn:aws:kinesisanalytics:us-west-2:1234567890:application/example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-14782ea879b9f73b5ee5ad2ef9ec8d20965c88da8a7cb0cb2534adfe79bb7ca6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/kinesis_firehose_delivery_stream.html.markdown b/website/docs/cdktf/typescript/r/kinesis_firehose_delivery_stream.html.markdown
new file mode 100644
index 00000000000..21129ae3647
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/kinesis_firehose_delivery_stream.html.markdown
@@ -0,0 +1,1093 @@
+---
+subcategory: "Kinesis Firehose"
+layout: "aws"
+page_title: "AWS: aws_kinesis_firehose_delivery_stream"
+description: |-
+  Provides a AWS Kinesis Firehose Delivery Stream
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_kinesis_firehose_delivery_stream
+
+Provides a Kinesis Firehose Delivery Stream resource. Amazon Kinesis Firehose is a fully managed, elastic service to easily deliver real-time data streams to destinations such as Amazon S3 and Amazon Redshift.
+
+For more details, see the [Amazon Kinesis Firehose Documentation][1].
+
+## Example Usage
+
+### Extended S3 Destination
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+import { KinesisFirehoseDeliveryStream } from "./.gen/providers/aws/kinesis-firehose-delivery-stream";
+import { LambdaFunction } from "./.gen/providers/aws/lambda-function";
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketAcl } from "./.gen/providers/aws/s3-bucket-acl";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const bucket = new S3Bucket(this, "bucket", {
+      bucket: "tf-test-bucket",
+    });
+    new S3BucketAcl(this, "bucket_acl", {
+      acl: "private",
+      bucket: bucket.id,
+    });
+    const firehoseAssumeRole = new DataAwsIamPolicyDocument(
+      this,
+      "firehose_assume_role",
+      {
+        statement: [
+          {
+            actions: ["sts:AssumeRole"],
+            effect: "Allow",
+            principals: [
+              {
+                identifiers: ["firehose.amazonaws.com"],
+                type: "Service",
+              },
+            ],
+          },
+        ],
+      }
+    );
+    const lambdaAssumeRole = new DataAwsIamPolicyDocument(
+      this,
+      "lambda_assume_role",
+      {
+        statement: [
+          {
+            actions: ["sts:AssumeRole"],
+            effect: "Allow",
+            principals: [
+              {
+                identifiers: ["lambda.amazonaws.com"],
+                type: "Service",
+              },
+            ],
+          },
+        ],
+      }
+    );
+    const firehoseRole = new IamRole(this, "firehose_role", {
+      assumeRolePolicy: Token.asString(firehoseAssumeRole.json),
+      name: "firehose_test_role",
+    });
+    const lambdaIam = new IamRole(this, "lambda_iam", {
+      assumeRolePolicy: Token.asString(lambdaAssumeRole.json),
+      name: "lambda_iam",
+    });
+    const lambdaProcessor = new LambdaFunction(this, "lambda_processor", {
+      filename: "lambda.zip",
+      functionName: "firehose_lambda_processor",
+      handler: "exports.handler",
+      role: lambdaIam.arn,
+      runtime: "nodejs16.x",
+    });
+    new KinesisFirehoseDeliveryStream(this, "extended_s3_stream", {
+      destination: "extended_s3",
+      extendedS3Configuration: {
+        bucketArn: bucket.arn,
+        processingConfiguration: {
+          enabled: Token.asBoolean("true"),
+          processors: [
+            {
+              parameters: [
+                {
+                  parameterName: "LambdaArn",
+                  parameterValue: "${" + lambdaProcessor.arn + "}:$LATEST",
+                },
+              ],
+              type: "Lambda",
+            },
+          ],
+        },
+        roleArn: firehoseRole.arn,
+      },
+      name: "terraform-kinesis-firehose-extended-s3-test-stream",
+    });
+  }
+}
+
+```
+
+### Extended S3 Destination with dynamic partitioning
+
+These examples use built-in Firehose functionality, rather than requiring a lambda.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { KinesisFirehoseDeliveryStream } from "./.gen/providers/aws/kinesis-firehose-delivery-stream";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new KinesisFirehoseDeliveryStream(this, "extended_s3_stream", {
+      destination: "extended_s3",
+      extendedS3Configuration: {
+        bucketArn: bucket.arn,
+        bufferingSize: 64,
+        dynamicPartitioningConfiguration: {
+          enabled: Token.asBoolean("true"),
+        },
+        errorOutputPrefix:
+          "errors/year=!{timestamp:yyyy}/month=!{timestamp:MM}/day=!{timestamp:dd}/hour=!{timestamp:HH}/!{firehose:error-output-type}/",
+        prefix:
+          "data/customer_id=!{partitionKeyFromQuery:customer_id}/year=!{timestamp:yyyy}/month=!{timestamp:MM}/day=!{timestamp:dd}/hour=!{timestamp:HH}/",
+        processingConfiguration: {
+          enabled: Token.asBoolean("true"),
+          processors: [
+            {
+              parameters: [
+                {
+                  parameterName: "SubRecordType",
+                  parameterValue: "JSON",
+                },
+              ],
+              type: "RecordDeAggregation",
+            },
+            {
+              type: "AppendDelimiterToRecord",
+            },
+            {
+              parameters: [
+                {
+                  parameterName: "JsonParsingEngine",
+                  parameterValue: "JQ-1.6",
+                },
+                {
+                  parameterName: "MetadataExtractionQuery",
+                  parameterValue: "{customer_id:.customer_id}",
+                },
+              ],
+              type: "MetadataExtraction",
+            },
+          ],
+        },
+        roleArn: firehoseRole.arn,
+      },
+      name: "terraform-kinesis-firehose-extended-s3-test-stream",
+    });
+  }
+}
+
+```
+
+Multiple Dynamic Partitioning Keys (maximum of 50) can be added by comma separating the `parameterValue`.
+
+The following example adds the Dynamic Partitioning Keys: `storeId` and `customerId` to the S3 prefix.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { KinesisFirehoseDeliveryStream } from "./.gen/providers/aws/kinesis-firehose-delivery-stream";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new KinesisFirehoseDeliveryStream(this, "extended_s3_stream", {
+      destination: "extended_s3",
+      extendedS3Configuration: {
+        bucketArn: bucket.arn,
+        bufferingSize: 64,
+        dynamicPartitioningConfiguration: {
+          enabled: Token.asBoolean("true"),
+        },
+        errorOutputPrefix:
+          "errors/year=!{timestamp:yyyy}/month=!{timestamp:MM}/day=!{timestamp:dd}/hour=!{timestamp:HH}/!{firehose:error-output-type}/",
+        prefix:
+          "data/store_id=!{partitionKeyFromQuery:store_id}/customer_id=!{partitionKeyFromQuery:customer_id}/year=!{timestamp:yyyy}/month=!{timestamp:MM}/day=!{timestamp:dd}/hour=!{timestamp:HH}/",
+        processingConfiguration: {
+          enabled: Token.asBoolean("true"),
+          processors: [
+            {
+              parameters: [
+                {
+                  parameterName: "JsonParsingEngine",
+                  parameterValue: "JQ-1.6",
+                },
+                {
+                  parameterName: "MetadataExtractionQuery",
+                  parameterValue:
+                    "{store_id:.store_id,customer_id:.customer_id}",
+                },
+              ],
+              type: "MetadataExtraction",
+            },
+          ],
+        },
+        roleArn: firehoseRole.arn,
+      },
+      name: "terraform-kinesis-firehose-extended-s3-test-stream",
+    });
+  }
+}
+
+```
+
+### Redshift Destination
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { KinesisFirehoseDeliveryStream } from "./.gen/providers/aws/kinesis-firehose-delivery-stream";
+import { RedshiftCluster } from "./.gen/providers/aws/redshift-cluster";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const testCluster = new RedshiftCluster(this, "test_cluster", {
+      clusterIdentifier: "tf-redshift-cluster",
+      clusterType: "single-node",
+      databaseName: "test",
+      masterPassword: "T3stPass",
+      masterUsername: "testuser",
+      nodeType: "dc1.large",
+    });
+    new KinesisFirehoseDeliveryStream(this, "test_stream", {
+      destination: "redshift",
+      name: "terraform-kinesis-firehose-test-stream",
+      redshiftConfiguration: {
+        clusterJdbcurl:
+          "jdbc:redshift://${" +
+          testCluster.endpoint +
+          "}/${" +
+          testCluster.databaseName +
+          "}",
+        copyOptions: "delimiter '|'",
+        dataTableColumns: "test-col",
+        dataTableName: "test-table",
+        password: "T3stPass",
+        roleArn: firehoseRole.arn,
+        s3BackupConfiguration: {
+          bucketArn: bucket.arn,
+          bufferingInterval: 300,
+          bufferingSize: 15,
+          compressionFormat: "GZIP",
+          roleArn: firehoseRole.arn,
+        },
+        s3BackupMode: "Enabled",
+        s3Configuration: {
+          bucketArn: bucket.arn,
+          bufferingInterval: 400,
+          bufferingSize: 10,
+          compressionFormat: "GZIP",
+          roleArn: firehoseRole.arn,
+        },
+        username: "testuser",
+      },
+    });
+  }
+}
+
+```
+
+### Elasticsearch Destination
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ElasticsearchDomain } from "./.gen/providers/aws/elasticsearch-domain";
+import { KinesisFirehoseDeliveryStream } from "./.gen/providers/aws/kinesis-firehose-delivery-stream";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const testCluster = new ElasticsearchDomain(this, "test_cluster", {
+      domainName: "firehose-es-test",
+    });
+    new KinesisFirehoseDeliveryStream(this, "test_stream", {
+      destination: "elasticsearch",
+      elasticsearchConfiguration: {
+        domainArn: testCluster.arn,
+        indexName: "test",
+        processingConfiguration: {
+          enabled: Token.asBoolean("true"),
+          processors: [
+            {
+              parameters: [
+                {
+                  parameterName: "LambdaArn",
+                  parameterValue: "${" + lambdaProcessor.arn + "}:$LATEST",
+                },
+              ],
+              type: "Lambda",
+            },
+          ],
+        },
+        roleArn: firehoseRole.arn,
+        s3Configuration: {
+          bucketArn: bucket.arn,
+          bufferingInterval: 400,
+          bufferingSize: 10,
+          compressionFormat: "GZIP",
+          roleArn: firehoseRole.arn,
+        },
+        typeName: "test",
+      },
+      name: "terraform-kinesis-firehose-test-stream",
+    });
+  }
+}
+
+```
+
+### Elasticsearch Destination With VPC
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { ElasticsearchDomain } from "./.gen/providers/aws/elasticsearch-domain";
+import { IamRolePolicy } from "./.gen/providers/aws/iam-role-policy";
+import { KinesisFirehoseDeliveryStream } from "./.gen/providers/aws/kinesis-firehose-delivery-stream";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const testCluster = new ElasticsearchDomain(this, "test_cluster", {
+      clusterConfig: {
+        instanceCount: 2,
+        instanceType: "t2.small.elasticsearch",
+        zoneAwarenessEnabled: true,
+      },
+      domainName: "es-test",
+      ebsOptions: {
+        ebsEnabled: true,
+        volumeSize: 10,
+      },
+      vpcOptions: {
+        securityGroupIds: [first.id],
+        subnetIds: [Token.asString(awsSubnetFirst.id), second.id],
+      },
+    });
+    const firehoseElasticsearch = new DataAwsIamPolicyDocument(
+      this,
+      "firehose-elasticsearch",
+      {
+        statement: [
+          {
+            actions: ["es:*"],
+            effect: "Allow",
+            resources: [testCluster.arn, "${" + testCluster.arn + "}/*"],
+          },
+          {
+            actions: [
+              "ec2:DescribeVpcs",
+              "ec2:DescribeVpcAttribute",
+              "ec2:DescribeSubnets",
+              "ec2:DescribeSecurityGroups",
+              "ec2:DescribeNetworkInterfaces",
+              "ec2:CreateNetworkInterface",
+              "ec2:CreateNetworkInterfacePermission",
+              "ec2:DeleteNetworkInterface",
+            ],
+            effect: "Allow",
+            resources: ["*"],
+          },
+        ],
+      }
+    );
+    const awsIamRolePolicyFirehoseElasticsearch = new IamRolePolicy(
+      this,
+      "firehose-elasticsearch_2",
+      {
+        name: "elasticsearch",
+        policy: Token.asString(firehoseElasticsearch.json),
+        role: firehose.id,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamRolePolicyFirehoseElasticsearch.overrideLogicalId(
+      "firehose-elasticsearch"
+    );
+    new KinesisFirehoseDeliveryStream(this, "test", {
+      dependsOn: [awsIamRolePolicyFirehoseElasticsearch],
+      destination: "elasticsearch",
+      elasticsearchConfiguration: {
+        domainArn: testCluster.arn,
+        indexName: "test",
+        roleArn: firehose.arn,
+        s3Configuration: {
+          bucketArn: bucket.arn,
+          roleArn: firehose.arn,
+        },
+        typeName: "test",
+        vpcConfig: {
+          roleArn: firehose.arn,
+          securityGroupIds: [first.id],
+          subnetIds: [Token.asString(awsSubnetFirst.id), second.id],
+        },
+      },
+      name: "terraform-kinesis-firehose-es",
+    });
+  }
+}
+
+```
+
+### OpenSearch Destination
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { KinesisFirehoseDeliveryStream } from "./.gen/providers/aws/kinesis-firehose-delivery-stream";
+import { OpensearchDomain } from "./.gen/providers/aws/opensearch-domain";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const testCluster = new OpensearchDomain(this, "test_cluster", {
+      domainName: "firehose-os-test",
+    });
+    new KinesisFirehoseDeliveryStream(this, "test_stream", {
+      destination: "opensearch",
+      name: "terraform-kinesis-firehose-test-stream",
+      opensearchConfiguration: {
+        domainArn: testCluster.arn,
+        indexName: "test",
+        processingConfiguration: {
+          enabled: Token.asBoolean("true"),
+          processors: [
+            {
+              parameters: [
+                {
+                  parameterName: "LambdaArn",
+                  parameterValue: "${" + lambdaProcessor.arn + "}:$LATEST",
+                },
+              ],
+              type: "Lambda",
+            },
+          ],
+        },
+        roleArn: firehoseRole.arn,
+        s3Configuration: {
+          bucketArn: bucket.arn,
+          bufferingInterval: 400,
+          bufferingSize: 10,
+          compressionFormat: "GZIP",
+          roleArn: firehoseRole.arn,
+        },
+      },
+    });
+  }
+}
+
+```
+
+### OpenSearch Destination With VPC
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { IamRolePolicy } from "./.gen/providers/aws/iam-role-policy";
+import { KinesisFirehoseDeliveryStream } from "./.gen/providers/aws/kinesis-firehose-delivery-stream";
+import { OpensearchDomain } from "./.gen/providers/aws/opensearch-domain";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const testCluster = new OpensearchDomain(this, "test_cluster", {
+      clusterConfig: {
+        instanceCount: 2,
+        instanceType: "m4.large.search",
+        zoneAwarenessEnabled: true,
+      },
+      domainName: "es-test",
+      ebsOptions: {
+        ebsEnabled: true,
+        volumeSize: 10,
+      },
+      vpcOptions: {
+        securityGroupIds: [first.id],
+        subnetIds: [Token.asString(awsSubnetFirst.id), second.id],
+      },
+    });
+    const firehoseOpensearch = new IamRolePolicy(this, "firehose-opensearch", {
+      name: "opensearch",
+      policy:
+        '{\n  "Version": "2012-10-17",\n  "Statement": [\n    {\n      "Effect": "Allow",\n      "Action": [\n        "es:*"\n      ],\n      "Resource": [\n        "${' +
+        testCluster.arn +
+        '}",\n        "${' +
+        testCluster.arn +
+        '}/*"\n      ]\n        },\n        {\n          "Effect": "Allow",\n          "Action": [\n            "ec2:DescribeVpcs",\n            "ec2:DescribeVpcAttribute",\n            "ec2:DescribeSubnets",\n            "ec2:DescribeSecurityGroups",\n            "ec2:DescribeNetworkInterfaces",\n            "ec2:CreateNetworkInterface",\n            "ec2:CreateNetworkInterfacePermission",\n            "ec2:DeleteNetworkInterface"\n          ],\n          "Resource": [\n            "*"\n          ]\n        }\n  ]\n}\n\n',
+      role: firehose.id,
+    });
+    new KinesisFirehoseDeliveryStream(this, "test", {
+      dependsOn: [firehoseOpensearch],
+      destination: "opensearch",
+      name: "terraform-kinesis-firehose-os",
+      opensearchConfiguration: {
+        domainArn: testCluster.arn,
+        indexName: "test",
+        roleArn: firehose.arn,
+        s3Configuration: {
+          bucketArn: bucket.arn,
+          roleArn: firehose.arn,
+        },
+        vpcConfig: {
+          roleArn: firehose.arn,
+          securityGroupIds: [first.id],
+          subnetIds: [Token.asString(awsSubnetFirst.id), second.id],
+        },
+      },
+    });
+  }
+}
+
+```
+
+### OpenSearch Serverless Destination
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { KinesisFirehoseDeliveryStream } from "./.gen/providers/aws/kinesis-firehose-delivery-stream";
+import { OpensearchserverlessCollection } from "./.gen/providers/aws/opensearchserverless-collection";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const testCollection = new OpensearchserverlessCollection(
+      this,
+      "test_collection",
+      {
+        name: "firehose-osserverless-test",
+      }
+    );
+    new KinesisFirehoseDeliveryStream(this, "test_stream", {
+      destination: "opensearchserverless",
+      name: "terraform-kinesis-firehose-test-stream",
+      opensearchserverlessConfiguration: {
+        collectionEndpoint: testCollection.collectionEndpoint,
+        indexName: "test",
+        processingConfiguration: {
+          enabled: Token.asBoolean("true"),
+          processors: [
+            {
+              parameters: [
+                {
+                  parameterName: "LambdaArn",
+                  parameterValue: "${" + lambdaProcessor.arn + "}:$LATEST",
+                },
+              ],
+              type: "Lambda",
+            },
+          ],
+        },
+        roleArn: firehoseRole.arn,
+        s3Configuration: {
+          bucketArn: bucket.arn,
+          bufferingInterval: 400,
+          bufferingSize: 10,
+          compressionFormat: "GZIP",
+          roleArn: firehoseRole.arn,
+        },
+      },
+    });
+  }
+}
+
+```
+
+### Splunk Destination
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { KinesisFirehoseDeliveryStream } from "./.gen/providers/aws/kinesis-firehose-delivery-stream";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new KinesisFirehoseDeliveryStream(this, "test_stream", {
+      destination: "splunk",
+      name: "terraform-kinesis-firehose-test-stream",
+      splunkConfiguration: {
+        hecAcknowledgmentTimeout: 600,
+        hecEndpoint: "https://http-inputs-mydomain.splunkcloud.com:443",
+        hecEndpointType: "Event",
+        hecToken: "51D4DA16-C61B-4F5F-8EC7-ED4301342A4A",
+        s3BackupMode: "FailedEventsOnly",
+        s3Configuration: {
+          bucketArn: bucket.arn,
+          bufferingInterval: 400,
+          bufferingSize: 10,
+          compressionFormat: "GZIP",
+          roleArn: firehose.arn,
+        },
+      },
+    });
+  }
+}
+
+```
+
+### HTTP Endpoint (e.g., New Relic) Destination
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { KinesisFirehoseDeliveryStream } from "./.gen/providers/aws/kinesis-firehose-delivery-stream";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new KinesisFirehoseDeliveryStream(this, "test_stream", {
+      destination: "http_endpoint",
+      httpEndpointConfiguration: {
+        accessKey: "my-key",
+        bufferingInterval: 600,
+        bufferingSize: 15,
+        name: "New Relic",
+        requestConfiguration: {
+          commonAttributes: [
+            {
+              name: "testname",
+              value: "testvalue",
+            },
+            {
+              name: "testname2",
+              value: "testvalue2",
+            },
+          ],
+          contentEncoding: "GZIP",
+        },
+        roleArn: firehose.arn,
+        s3BackupMode: "FailedDataOnly",
+        s3Configuration: {
+          bucketArn: bucket.arn,
+          bufferingInterval: 400,
+          bufferingSize: 10,
+          compressionFormat: "GZIP",
+          roleArn: firehose.arn,
+        },
+        url: "https://aws-api.newrelic.com/firehose/v1",
+      },
+      name: "terraform-kinesis-firehose-test-stream",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) A name to identify the stream. This is unique to the AWS account and region the Stream is created in. When using for WAF logging, name must be prefixed with `awsWafLogs`. See [AWS Documentation](https://docs.aws.amazon.com/waf/latest/developerguide/waf-policies.html#waf-policies-logging-config) for more details.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `kinesisSourceConfiguration` - (Optional) The stream and role Amazon Resource Names (ARNs) for a Kinesis data stream used as the source for a delivery stream. More details are given below.
+* `mskSourceConfiguration` - (Optional) The configuration for the Amazon MSK cluster to be used as the source for a delivery stream. More details are given below.
+* `serverSideEncryption` - (Optional) Encrypt at rest options.
+Server-side encryption should not be enabled when a kinesis stream is configured as the source of the firehose delivery stream.
+* `destination` – (Required) This is the destination to where the data is delivered. The only options are `s3` (Deprecated, use `extendedS3` instead), `extendedS3`, `redshift`, `elasticsearch`, `splunk`, `httpEndpoint`, `opensearch` and `opensearchserverless`.
+is redshift). More details are given below.
+* `elasticsearchConfiguration` - (Optional) Configuration options when `destination` is `elasticsearch`. More details are given below.
+* `extendedS3Configuration` - (Optional, only Required when `destination` is `extendedS3`) Enhanced configuration options for the s3 destination. More details are given below.
+* `httpEndpointConfiguration` - (Optional) Configuration options when `destination` is `httpEndpoint`. Requires the user to also specify an `s3Configuration` block.  More details are given below.
+* `opensearchConfiguration` - (Optional) Configuration options when `destination` is `opensearch`. More details are given below.
+* `opensearchserverlessConfiguration` - (Optional) Configuration options when `destination` is `opensearchserverless`. More details are given below.
+* `redshiftConfiguration` - (Optional) Configuration options when `destination` is `redshift`. Requires the user to also specify an `s3Configuration` block. More details are given below.
+* `splunkConfiguration` - (Optional) Configuration options when `destination` is `splunk`. More details are given below.
+
+The `kinesisSourceConfiguration` object supports the following:
+
+* `kinesisStreamArn` - (Required) The kinesis stream used as the source of the firehose delivery stream.
+* `roleArn` - (Required) The ARN of the role that provides access to the source Kinesis stream.
+
+The `mskSourceConfiguration` object supports the following:
+
+* `authenticationConfiguration` - (Required) The authentication configuration of the Amazon MSK cluster. More details are given below.
+* `mskClusterArn` - (Required) The ARN of the Amazon MSK cluster.
+* `topicName` - (Required) The topic name within the Amazon MSK cluster.
+
+The `authenticationConfiguration` object supports the following:
+
+* `connectivity` - (Required) The type of connectivity used to access the Amazon MSK cluster. Valid values: `public`, `private`.
+* `roleArn` - (Required) The ARN of the role used to access the Amazon MSK cluster.
+
+The `serverSideEncryption` object supports the following:
+
+* `enabled` - (Optional) Whether to enable encryption at rest. Default is `false`.
+* `keyType`- (Optional) Type of encryption key. Default is `awsOwnedCmk`. Valid values are `awsOwnedCmk` and `customerManagedCmk`
+* `keyArn` - (Optional) Amazon Resource Name (ARN) of the encryption key. Required when `keyType` is `customerManagedCmk`.
+
+The `extendedS3Configuration` object supports the same fields from [s3_configuration](#s3-configuration) as well as the following:
+
+* `dataFormatConversionConfiguration` - (Optional) Nested argument for the serializer, deserializer, and schema for converting data from the JSON format to the Parquet or ORC format before writing it to Amazon S3. More details given below.
+* `processingConfiguration` - (Optional) The data processing configuration.  More details are given below.
+* `s3BackupMode` - (Optional) The Amazon S3 backup mode.  Valid values are `disabled` and `enabled`.  Default value is `disabled`.
+* `s3BackupConfiguration` - (Optional) The configuration for backup in Amazon S3. Required if `s3BackupMode` is `enabled`. Supports the same fields as `s3Configuration` object.
+* `dynamicPartitioningConfiguration` - (Optional) The configuration for dynamic partitioning. See [Dynamic Partitioning Configuration](#dynamic_partitioning_configuration) below for more details. Required when using dynamic partitioning.
+
+The `redshiftConfiguration` object supports the following:
+
+* `clusterJdbcurl` - (Required) The jdbcurl of the redshift cluster.
+* `username` - (Required) The username that the firehose delivery stream will assume. It is strongly recommended that the username and password provided is used exclusively for Amazon Kinesis Firehose purposes, and that the permissions for the account are restricted for Amazon Redshift INSERT permissions.
+* `password` - (Required) The password for the username above.
+* `retryDuration` - (Optional) The length of time during which Firehose retries delivery after a failure, starting from the initial request and including the first attempt. The default value is 3600 seconds (60 minutes). Firehose does not retry if the value of DurationInSeconds is 0 (zero) or if the first delivery attempt takes longer than the current value.
+* `roleArn` - (Required) The arn of the role the stream assumes.
+* `s3Configuration` - (Required) The S3 Configuration. See [s3_configuration](#s3-configuration) for more details.
+* `s3BackupMode` - (Optional) The Amazon S3 backup mode.  Valid values are `disabled` and `enabled`.  Default value is `disabled`.
+* `s3BackupConfiguration` - (Optional) The configuration for backup in Amazon S3. Required if `s3BackupMode` is `enabled`. Supports the same fields as `s3Configuration` object.
+* `dataTableName` - (Required) The name of the table in the redshift cluster that the s3 bucket will copy to.
+* `copyOptions` - (Optional) Copy options for copying the data from the s3 intermediate bucket into redshift, for example to change the default delimiter. For valid values, see the [AWS documentation](http://docs.aws.amazon.com/firehose/latest/APIReference/API_CopyCommand.html)
+* `dataTableColumns` - (Optional) The data table columns that will be targeted by the copy command.
+* `cloudwatchLoggingOptions` - (Optional) The CloudWatch Logging Options for the delivery stream. More details are given below
+* `processingConfiguration` - (Optional) The data processing configuration.  More details are given below.
+
+The `elasticsearchConfiguration` object supports the following:
+
+* `bufferingInterval` - (Optional) Buffer incoming data for the specified period of time, in seconds between 60 to 900, before delivering it to the destination.  The default value is 300s.
+* `bufferingSize` - (Optional) Buffer incoming data to the specified size, in MBs between 1 to 100, before delivering it to the destination.  The default value is 5MB.
+* `domainArn` - (Optional) The ARN of the Amazon ES domain.  The pattern needs to be `arn:.*`.  Conflicts with `clusterEndpoint`.
+* `clusterEndpoint` - (Optional) The endpoint to use when communicating with the cluster. Conflicts with `domainArn`.
+* `indexName` - (Required) The Elasticsearch index name.
+* `indexRotationPeriod` - (Optional) The Elasticsearch index rotation period.  Index rotation appends a timestamp to the IndexName to facilitate expiration of old data.  Valid values are `noRotation`, `oneHour`, `oneDay`, `oneWeek`, and `oneMonth`.  The default value is `oneDay`.
+* `retryDuration` - (Optional) After an initial failure to deliver to Amazon Elasticsearch, the total amount of time, in seconds between 0 to 7200, during which Firehose re-attempts delivery (including the first attempt).  After this time has elapsed, the failed documents are written to Amazon S3.  The default value is 300s.  There will be no retry if the value is 0.
+* `roleArn` - (Required) The ARN of the IAM role to be assumed by Firehose for calling the Amazon ES Configuration API and for indexing documents.  The IAM role must have permission for `describeElasticsearchDomain`, `describeElasticsearchDomains`, and `describeElasticsearchDomainConfig`.  The pattern needs to be `arn:.*`.
+* `s3Configuration` - (Required) The S3 Configuration. See [s3_configuration](#s3-configuration) for more details.
+* `s3BackupMode` - (Optional) Defines how documents should be delivered to Amazon S3.  Valid values are `failedDocumentsOnly` and `allDocuments`.  Default value is `failedDocumentsOnly`.
+* `typeName` - (Optional) The Elasticsearch type name with maximum length of 100 characters.
+* `cloudwatchLoggingOptions` - (Optional) The CloudWatch Logging Options for the delivery stream. More details are given below
+* `vpcConfig` - (Optional) The VPC configuration for the delivery stream to connect to Elastic Search associated with the VPC. More details are given below
+* `processingConfiguration` - (Optional) The data processing configuration.  More details are given below.
+
+The `opensearchConfiguration` object supports the following:
+
+* `bufferingInterval` - (Optional) Buffer incoming data for the specified period of time, in seconds between 60 to 900, before delivering it to the destination.  The default value is 300s.
+* `bufferingSize` - (Optional) Buffer incoming data to the specified size, in MBs between 1 to 100, before delivering it to the destination.  The default value is 5MB.
+* `domainArn` - (Optional) The ARN of the Amazon ES domain.  The pattern needs to be `arn:.*`.  Conflicts with `clusterEndpoint`.
+* `clusterEndpoint` - (Optional) The endpoint to use when communicating with the cluster. Conflicts with `domainArn`.
+* `indexName` - (Required) The OpenSearch index name.
+* `indexRotationPeriod` - (Optional) The OpenSearch index rotation period.  Index rotation appends a timestamp to the IndexName to facilitate expiration of old data.  Valid values are `noRotation`, `oneHour`, `oneDay`, `oneWeek`, and `oneMonth`.  The default value is `oneDay`.
+* `retryDuration` - (Optional) After an initial failure to deliver to Amazon OpenSearch, the total amount of time, in seconds between 0 to 7200, during which Firehose re-attempts delivery (including the first attempt).  After this time has elapsed, the failed documents are written to Amazon S3.  The default value is 300s.  There will be no retry if the value is 0.
+* `roleArn` - (Required) The ARN of the IAM role to be assumed by Firehose for calling the Amazon ES Configuration API and for indexing documents.  The IAM role must have permission for `describeDomain`, `describeDomains`, and `describeDomainConfig`.  The pattern needs to be `arn:.*`.
+* `s3Configuration` - (Required) The S3 Configuration. See [s3_configuration](#s3-configuration) for more details.
+* `s3BackupMode` - (Optional) Defines how documents should be delivered to Amazon S3.  Valid values are `failedDocumentsOnly` and `allDocuments`.  Default value is `failedDocumentsOnly`.
+* `typeName` - (Optional) The Elasticsearch type name with maximum length of 100 characters. Types are deprecated in OpenSearch_1.1. TypeName must be empty.
+* `cloudwatchLoggingOptions` - (Optional) The CloudWatch Logging Options for the delivery stream. More details are given below
+* `vpcConfig` - (Optional) The VPC configuration for the delivery stream to connect to OpenSearch associated with the VPC. More details are given below
+* `processingConfiguration` - (Optional) The data processing configuration.  More details are given below.
+
+The `opensearchserverlessConfiguration` object supports the following:
+
+* `bufferingInterval` - (Optional) Buffer incoming data for the specified period of time, in seconds between 60 to 900, before delivering it to the destination.  The default value is 300s.
+* `bufferingSize` - (Optional) Buffer incoming data to the specified size, in MBs between 1 to 100, before delivering it to the destination.  The default value is 5MB.
+* `collectionEndpoint` - (Required) The endpoint to use when communicating with the collection in the Serverless offering for Amazon OpenSearch Service.
+* `indexName` - (Required) The Serverless offering for Amazon OpenSearch Service index name.
+* `retryDuration` - (Optional) After an initial failure to deliver to the Serverless offering for Amazon OpenSearch Service, the total amount of time, in seconds between 0 to 7200, during which Kinesis Data Firehose retries delivery (including the first attempt).  After this time has elapsed, the failed documents are written to Amazon S3.  The default value is 300s.  There will be no retry if the value is 0.
+* `roleArn` - (Required) The Amazon Resource Name (ARN) of the IAM role to be assumed by Kinesis Data Firehose for calling the Serverless offering for Amazon OpenSearch Service Configuration API and for indexing documents.  The pattern needs to be `arn:.*`.
+* `s3Configuration` - (Required) The S3 Configuration. See [s3_configuration](#s3-configuration) for more details.
+* `s3BackupMode` - (Optional) Defines how documents should be delivered to Amazon S3.  Valid values are `failedDocumentsOnly` and `allDocuments`.  Default value is `failedDocumentsOnly`.
+* `cloudwatchLoggingOptions` - (Optional) The CloudWatch Logging Options for the delivery stream. More details are given below
+* `vpcConfig` - (Optional) The VPC configuration for the delivery stream to connect to OpenSearch Serverless associated with the VPC. More details are given below
+* `processingConfiguration` - (Optional) The data processing configuration.  More details are given below.
+
+The `splunkConfiguration` objects supports the following:
+
+* `hecAcknowledgmentTimeout` - (Optional) The amount of time, in seconds between 180 and 600, that Kinesis Firehose waits to receive an acknowledgment from Splunk after it sends it data.
+* `hecEndpoint` - (Required) The HTTP Event Collector (HEC) endpoint to which Kinesis Firehose sends your data.
+* `hecEndpointType` - (Optional) The HEC endpoint type. Valid values are `raw` or `event`. The default value is `raw`.
+* `hecToken` - (Required) The GUID that you obtain from your Splunk cluster when you create a new HEC endpoint.
+* `s3Configuration` - (Required) The S3 Configuration. See [s3_configuration](#s3-configuration) for more details.
+* `s3BackupMode` - (Optional) Defines how documents should be delivered to Amazon S3.  Valid values are `failedEventsOnly` and `allEvents`.  Default value is `failedEventsOnly`.
+* `retryDuration` - (Optional) After an initial failure to deliver to Splunk, the total amount of time, in seconds between 0 to 7200, during which Firehose re-attempts delivery (including the first attempt).  After this time has elapsed, the failed documents are written to Amazon S3.  The default value is 300s.  There will be no retry if the value is 0.
+* `cloudwatchLoggingOptions` - (Optional) The CloudWatch Logging Options for the delivery stream. More details are given below.
+* `processingConfiguration` - (Optional) The data processing configuration.  More details are given below.
+
+The `httpEndpointConfiguration` objects supports the following:
+
+* `url` - (Required) The HTTP endpoint URL to which Kinesis Firehose sends your data.
+* `name` - (Optional) The HTTP endpoint name.
+* `accessKey` - (Optional) The access key required for Kinesis Firehose to authenticate with the HTTP endpoint selected as the destination.
+* `roleArn` - (Required) Kinesis Data Firehose uses this IAM role for all the permissions that the delivery stream needs. The pattern needs to be `arn:.*`.
+* `s3Configuration` - (Required) The S3 Configuration. See [s3_configuration](#s3-configuration) for more details.
+* `s3BackupMode` - (Optional) Defines how documents should be delivered to Amazon S3.  Valid values are `failedDataOnly` and `allData`.  Default value is `failedDataOnly`.
+* `bufferingSize` - (Optional) Buffer incoming data to the specified size, in MBs, before delivering it to the destination. The default value is 5.
+* `bufferingInterval` - (Optional) Buffer incoming data for the specified period of time, in seconds, before delivering it to the destination. The default value is 300 (5 minutes).
+* `cloudwatchLoggingOptions` - (Optional) The CloudWatch Logging Options for the delivery stream. More details are given below.
+* `processingConfiguration` - (Optional) The data processing configuration.  More details are given below.
+* `requestConfiguration` - (Optional) The request configuration.  More details are given below.
+* `retryDuration` - (Optional) Total amount of seconds Firehose spends on retries. This duration starts after the initial attempt fails, It does not include the time periods during which Firehose waits for acknowledgment from the specified destination after each attempt. Valid values between `0` and `7200`. Default is `300`.
+
+The `cloudwatchLoggingOptions` object supports the following:
+
+* `enabled` - (Optional) Enables or disables the logging. Defaults to `false`.
+* `logGroupName` - (Optional) The CloudWatch group name for logging. This value is required if `enabled` is true.
+* `logStreamName` - (Optional) The CloudWatch log stream name for logging. This value is required if `enabled` is true.
+
+The `processingConfiguration` object supports the following:
+
+* `enabled` - (Optional) Enables or disables data processing.
+* `processors` - (Optional) Array of data processors. More details are given below
+
+The `processors` array objects support the following:
+
+* `type` - (Required) The type of processor. Valid Values: `recordDeAggregation`, `lambda`, `metadataExtraction`, `appendDelimiterToRecord`. Validation is done against [AWS SDK constants](https://docs.aws.amazon.com/sdk-for-go/api/service/firehose/#pkg-constants); so that values not explicitly listed may also work.
+* `parameters` - (Optional) Array of processor parameters. More details are given below
+
+The `parameters` array objects support the following:
+
+* `parameterName` - (Required) Parameter name. Valid Values: `lambdaArn`, `numberOfRetries`, `metadataExtractionQuery`, `jsonParsingEngine`, `roleArn`, `bufferSizeInMBs`, `bufferIntervalInSeconds`, `subRecordType`, `delimiter`. Validation is done against [AWS SDK constants](https://docs.aws.amazon.com/sdk-for-go/api/service/firehose/#pkg-constants); so that values not explicitly listed may also work.
+* `parameterValue` - (Required) Parameter value. Must be between 1 and 512 length (inclusive). When providing a Lambda ARN, you should specify the resource version as well.
+
+~> **NOTE:** Parameters with default values, including `numberOfRetries`(default: 3), `roleArn`(default: firehose role ARN), `bufferSizeInMBs`(default: 3), and `bufferIntervalInSeconds`(default: 60), are not stored in terraform state. To prevent perpetual differences, it is therefore recommended to only include parameters with non-default values.
+
+The `requestConfiguration` object supports the following:
+
+* `contentEncoding` - (Optional) Kinesis Data Firehose uses the content encoding to compress the body of a request before sending the request to the destination. Valid values are `none` and `gzip`.  Default value is `none`.
+* `commonAttributes` - (Optional) Describes the metadata sent to the HTTP endpoint destination. More details are given below
+
+The `commonAttributes` array objects support the following:
+
+* `name` - (Required) The name of the HTTP endpoint common attribute.
+* `value` - (Required) The value of the HTTP endpoint common attribute.
+
+The `vpcConfig` object supports the following:
+
+* `subnetIds` - (Required) A list of subnet IDs to associate with Kinesis Firehose.
+* `securityGroupIds` - (Required) A list of security group IDs to associate with Kinesis Firehose.
+* `roleArn` - (Required) The ARN of the IAM role to be assumed by Firehose for calling the Amazon EC2 configuration API and for creating network interfaces. Make sure role has necessary [IAM permissions](https://docs.aws.amazon.com/firehose/latest/dev/controlling-access.html#using-iam-es-vpc)
+
+### data_format_conversion_configuration
+
+~> **NOTE:** Once configured, the data format conversion configuration can only be disabled, in which the configuration values will remain, but will not be active. It is not currently possible to completely remove the configuration without recreating the resource.
+
+Example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { KinesisFirehoseDeliveryStream } from "./.gen/providers/aws/kinesis-firehose-delivery-stream";
+interface MyConfig {
+  bucketArn: any;
+  roleArn: any;
+  destination: any;
+  name: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new KinesisFirehoseDeliveryStream(this, "example", {
+      extendedS3Configuration: {
+        bufferingSize: 128,
+        dataFormatConversionConfiguration: {
+          inputFormatConfiguration: {
+            deserializer: {
+              hiveJsonSerDe: {},
+            },
+          },
+          outputFormatConfiguration: {
+            serializer: {
+              orcSerDe: {},
+            },
+          },
+          schemaConfiguration: {
+            databaseName: Token.asString(
+              awsGlueCatalogTableExample.databaseName
+            ),
+            roleArn: Token.asString(awsIamRoleExample.arn),
+            tableName: Token.asString(awsGlueCatalogTableExample.name),
+          },
+        },
+        bucketArn: config.bucketArn,
+        roleArn: config.roleArn,
+      },
+      destination: config.destination,
+      name: config.name,
+    });
+  }
+}
+
+```
+
+* `inputFormatConfiguration` - (Required) Nested argument that specifies the deserializer that you want Kinesis Data Firehose to use to convert the format of your data from JSON. More details below.
+* `outputFormatConfiguration` - (Required) Nested argument that specifies the serializer that you want Kinesis Data Firehose to use to convert the format of your data to the Parquet or ORC format. More details below.
+* `schemaConfiguration` - (Required) Nested argument that specifies the AWS Glue Data Catalog table that contains the column information. More details below.
+* `enabled` - (Optional) Defaults to `true`. Set it to `false` if you want to disable format conversion while preserving the configuration details.
+
+#### S3 Configuration
+
+* `roleArn` - (Required) The ARN of the AWS credentials.
+* `bucketArn` - (Required) The ARN of the S3 bucket
+* `prefix` - (Optional) The "YYYY/MM/DD/HH" time format prefix is automatically used for delivered S3 files. You can specify an extra prefix to be added in front of the time format prefix. Note that if the prefix ends with a slash, it appears as a folder in the S3 bucket
+* `bufferingSize` - (Optional) Buffer incoming data to the specified size, in MBs, before delivering it to the destination. The default value is 5.
+  We recommend setting SizeInMBs to a value greater than the amount of data you typically ingest into the delivery stream in 10 seconds. For example, if you typically ingest data at 1 MB/sec set SizeInMBs to be 10 MB or higher.
+* `bufferingInterval` - (Optional) Buffer incoming data for the specified period of time, in seconds, before delivering it to the destination. The default value is 300.
+* `compressionFormat` - (Optional) The compression format. If no value is specified, the default is `uncompressed`. Other supported values are `gzip`, `zip`, `snappy`, & `hadoopSnappy`.
+* `errorOutputPrefix` - (Optional) Prefix added to failed records before writing them to S3. Not currently supported for `redshift` destination. This prefix appears immediately following the bucket name. For information about how to specify this prefix, see [Custom Prefixes for Amazon S3 Objects](https://docs.aws.amazon.com/firehose/latest/dev/s3-prefixes.html).
+* `kmsKeyArn` - (Optional) Specifies the KMS key ARN the stream will use to encrypt data. If not set, no encryption will
+  be used.
+* `cloudwatchLoggingOptions` - (Optional) The CloudWatch Logging Options for the delivery stream. More details are given below
+
+#### input_format_configuration
+
+* `deserializer` - (Required) Nested argument that specifies which deserializer to use. You can choose either the Apache Hive JSON SerDe or the OpenX JSON SerDe. More details below.
+
+##### deserializer
+
+~> **NOTE:** One of the deserializers must be configured. If no nested configuration needs to occur simply declare as `XXX_json_ser_de = []` or `XXX_json_ser_de {}`.
+
+* `hiveJsonSerDe` - (Optional) Nested argument that specifies the native Hive / HCatalog JsonSerDe. More details below.
+* `openXJsonSerDe` - (Optional) Nested argument that specifies the OpenX SerDe. More details below.
+
+###### hive_json_ser_de
+
+* `timestampFormats` - (Optional) A list of how you want Kinesis Data Firehose to parse the date and time stamps that may be present in your input data JSON. To specify these format strings, follow the pattern syntax of JodaTime's DateTimeFormat format strings. For more information, see [Class DateTimeFormat](https://www.joda.org/joda-time/apidocs/org/joda/time/format/DateTimeFormat.html). You can also use the special value millis to parse time stamps in epoch milliseconds. If you don't specify a format, Kinesis Data Firehose uses java.sql.Timestamp::valueOf by default.
+
+###### open_x_json_ser_de
+
+* `caseInsensitive` - (Optional) When set to true, which is the default, Kinesis Data Firehose converts JSON keys to lowercase before deserializing them.
+* `columnToJsonKeyMappings` - (Optional) A map of column names to JSON keys that aren't identical to the column names. This is useful when the JSON contains keys that are Hive keywords. For example, timestamp is a Hive keyword. If you have a JSON key named timestamp, set this parameter to `{ ts = "timestamp" }` to map this key to a column named ts.
+* `convertDotsInJsonKeysToUnderscores` - (Optional) When set to `true`, specifies that the names of the keys include dots and that you want Kinesis Data Firehose to replace them with underscores. This is useful because Apache Hive does not allow dots in column names. For example, if the JSON contains a key whose name is "a.b", you can define the column name to be "a_b" when using this option. Defaults to `false`.
+
+#### output_format_configuration
+
+* `serializer` - (Required) Nested argument that specifies which serializer to use. You can choose either the ORC SerDe or the Parquet SerDe. More details below.
+
+##### serializer
+
+~> **NOTE:** One of the serializers must be configured. If no nested configuration needs to occur simply declare as `XXX_ser_de = []` or `XXX_ser_de {}`.
+
+* `orcSerDe` - (Optional) Nested argument that specifies converting data to the ORC format before storing it in Amazon S3. For more information, see [Apache ORC](https://orc.apache.org/docs/). More details below.
+* `parquetSerDe` - (Optional) Nested argument that specifies converting data to the Parquet format before storing it in Amazon S3. For more information, see [Apache Parquet](https://parquet.apache.org/documentation/latest/). More details below.
+
+###### orc_ser_de
+
+* `blockSizeBytes` - (Optional) The Hadoop Distributed File System (HDFS) block size. This is useful if you intend to copy the data from Amazon S3 to HDFS before querying. The default is 256 MiB and the minimum is 64 MiB. Kinesis Data Firehose uses this value for padding calculations.
+* `bloomFilterColumns` - (Optional) A list of column names for which you want Kinesis Data Firehose to create bloom filters.
+* `bloomFilterFalsePositiveProbability` - (Optional) The Bloom filter false positive probability (FPP). The lower the FPP, the bigger the Bloom filter. The default value is `005`, the minimum is `0`, and the maximum is `1`.
+* `compression` - (Optional) The compression code to use over data blocks. The default is `snappy`.
+* `dictionaryKeyThreshold` - (Optional) A float that represents the fraction of the total number of non-null rows. To turn off dictionary encoding, set this fraction to a number that is less than the number of distinct keys in a dictionary. To always use dictionary encoding, set this threshold to `1`.
+* `enablePadding` - (Optional) Set this to `true` to indicate that you want stripes to be padded to the HDFS block boundaries. This is useful if you intend to copy the data from Amazon S3 to HDFS before querying. The default is `false`.
+* `formatVersion` - (Optional) The version of the file to write. The possible values are `v011` and `v012`. The default is `v012`.
+* `paddingTolerance` - (Optional) A float between 0 and 1 that defines the tolerance for block padding as a decimal fraction of stripe size. The default value is `005`, which means 5 percent of stripe size. For the default values of 64 MiB ORC stripes and 256 MiB HDFS blocks, the default block padding tolerance of 5 percent reserves a maximum of 3.2 MiB for padding within the 256 MiB block. In such a case, if the available size within the block is more than 3.2 MiB, a new, smaller stripe is inserted to fit within that space. This ensures that no stripe crosses block boundaries and causes remote reads within a node-local task. Kinesis Data Firehose ignores this parameter when `enablePadding` is `false`.
+* `rowIndexStride` - (Optional) The number of rows between index entries. The default is `10000` and the minimum is `1000`.
+* `stripeSizeBytes` - (Optional) The number of bytes in each stripe. The default is 64 MiB and the minimum is 8 MiB.
+
+###### parquet_ser_de
+
+* `blockSizeBytes` - (Optional) The Hadoop Distributed File System (HDFS) block size. This is useful if you intend to copy the data from Amazon S3 to HDFS before querying. The default is 256 MiB and the minimum is 64 MiB. Kinesis Data Firehose uses this value for padding calculations.
+* `compression` - (Optional) The compression code to use over data blocks. The possible values are `uncompressed`, `snappy`, and `gzip`, with the default being `snappy`. Use `snappy` for higher decompression speed. Use `gzip` if the compression ratio is more important than speed.
+* `enableDictionaryCompression` - (Optional) Indicates whether to enable dictionary compression.
+* `maxPaddingBytes` - (Optional) The maximum amount of padding to apply. This is useful if you intend to copy the data from Amazon S3 to HDFS before querying. The default is `0`.
+* `pageSizeBytes` - (Optional) The Parquet page size. Column chunks are divided into pages. A page is conceptually an indivisible unit (in terms of compression and encoding). The minimum value is 64 KiB and the default is 1 MiB.
+* `writerVersion` - (Optional) Indicates the version of row format to output. The possible values are `v1` and `v2`. The default is `v1`.
+
+#### schema_configuration
+
+* `databaseName` - (Required) Specifies the name of the AWS Glue database that contains the schema for the output data.
+* `roleArn` - (Required) The role that Kinesis Data Firehose can use to access AWS Glue. This role must be in the same account you use for Kinesis Data Firehose. Cross-account roles aren't allowed.
+* `tableName` - (Required) Specifies the AWS Glue table that contains the column information that constitutes your data schema.
+* `catalogId` - (Optional) The ID of the AWS Glue Data Catalog. If you don't supply this, the AWS account ID is used by default.
+* `region` - (Optional) If you don't specify an AWS Region, the default is the current region.
+* `versionId` - (Optional) Specifies the table version for the output data schema. Defaults to `latest`.
+
+#### dynamic_partitioning_configuration
+
+Required when using [dynamic partitioning](https://docs.aws.amazon.com/firehose/latest/dev/dynamic-partitioning.html).
+
+* `enabled` - (Optional) Enables or disables dynamic partitioning. Defaults to `false`.
+* `retryDuration` - (Optional) Total amount of seconds Firehose spends on retries. Valid values between 0 and 7200. Default is 300.
+
+~> **NOTE:** You can enable dynamic partitioning only when you create a new delivery stream. Once you enable dynamic partitioning on a delivery stream, it cannot be disabled on this delivery stream. Therefore, Terraform will recreate the resource whenever dynamic partitioning is enabled or disabled.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) specifying the Stream
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+[1]: https://aws.amazon.com/documentation/firehose/
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `30M`)
+* `update` - (Default `10M`)
+* `delete` - (Default `30M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Kinesis Firehose Delivery streams using the stream ARN. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Kinesis Firehose Delivery streams using the stream ARN. For example:
+
+```console
+% terraform import aws_kinesis_firehose_delivery_stream.foo arn:aws:firehose:us-east-1:XXX:deliverystream/example
+```
+
+Note: Import does not work for stream destination `s3`. Consider using `extendedS3` since `s3` destination is deprecated.
+
+<!-- cache-key: cdktf-0.18.0 input-a1a8ee815e60ee19fc9869aa9b7d23a6638e58e958bfdba7f5657d2ac077f81b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/kinesis_stream.html.markdown b/website/docs/cdktf/typescript/r/kinesis_stream.html.markdown
new file mode 100644
index 00000000000..be32da088fd
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/kinesis_stream.html.markdown
@@ -0,0 +1,112 @@
+---
+subcategory: "Kinesis"
+layout: "aws"
+page_title: "AWS: aws_kinesis_stream"
+description: |-
+  Provides a AWS Kinesis Stream
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_kinesis_stream
+
+Provides a Kinesis Stream resource. Amazon Kinesis is a managed service that
+scales elastically for real-time processing of streaming big data.
+
+For more details, see the [Amazon Kinesis Documentation][1].
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { KinesisStream } from "./.gen/providers/aws/kinesis-stream";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new KinesisStream(this, "test_stream", {
+      name: "terraform-kinesis-test",
+      retentionPeriod: 48,
+      shardCount: 1,
+      shardLevelMetrics: ["IncomingBytes", "OutgoingBytes"],
+      streamModeDetails: {
+        streamMode: "PROVISIONED",
+      },
+      tags: {
+        Environment: "test",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) A name to identify the stream. This is unique to the AWS account and region the Stream is created in.
+* `shardCount` – (Optional) The number of shards that the stream will use. If the `streamMode` is `provisioned`, this field is required.
+Amazon has guidelines for specifying the Stream size that should be referenced when creating a Kinesis stream. See [Amazon Kinesis Streams][2] for more.
+* `retentionPeriod` - (Optional) Length of time data records are accessible after they are added to the stream. The maximum value of a stream's retention period is 8760 hours. Minimum value is 24. Default is 24.
+* `shardLevelMetrics` - (Optional) A list of shard-level CloudWatch metrics which can be enabled for the stream. See [Monitoring with CloudWatch][3] for more. Note that the value ALL should not be used; instead you should provide an explicit list of metrics you wish to enable.
+* `enforceConsumerDeletion` - (Optional) A boolean that indicates all registered consumers should be deregistered from the stream so that the stream can be destroyed without error. The default value is `false`.
+* `encryptionType` - (Optional) The encryption type to use. The only acceptable values are `none` or `kms`. The default value is `none`.
+* `kmsKeyId` - (Optional) The GUID for the customer-managed KMS key to use for encryption. You can also use a Kinesis-owned master key by specifying the alias `alias/aws/kinesis`.
+* `streamModeDetails` - (Optional) Indicates the [capacity mode](https://docs.aws.amazon.com/streams/latest/dev/how-do-i-size-a-stream.html) of the data stream. Detailed below.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### stream_mode_details Configuration Block
+
+* `streamMode` - (Required) Specifies the capacity mode of the stream. Must be either `provisioned` or `onDemand`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The unique Stream id
+* `name` - The unique Stream name
+* `shardCount` - The count of Shards for this Stream
+* `arn` - The Amazon Resource Name (ARN) specifying the Stream (same as `id`)
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `5M`)
+- `update` - (Default `120M`)
+- `delete` - (Default `120M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Kinesis Streams using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Kinesis Streams using the `name`. For example:
+
+```console
+% terraform import aws_kinesis_stream.test_stream terraform-kinesis-test
+```
+
+[1]: https://aws.amazon.com/documentation/kinesis/
+[2]: https://docs.aws.amazon.com/kinesis/latest/dev/amazon-kinesis-streams.html
+[3]: https://docs.aws.amazon.com/streams/latest/dev/monitoring-with-cloudwatch.html
+
+<!-- cache-key: cdktf-0.18.0 input-972fc2cd811ba5b65f65f723f0cb5a041ff08e4079315825ec1e475538220367 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/kinesis_stream_consumer.html.markdown b/website/docs/cdktf/typescript/r/kinesis_stream_consumer.html.markdown
new file mode 100644
index 00000000000..2edce6672a1
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/kinesis_stream_consumer.html.markdown
@@ -0,0 +1,92 @@
+---
+subcategory: "Kinesis"
+layout: "aws"
+page_title: "AWS: aws_kinesis_stream_consumer"
+description: |-
+  Manages a Kinesis Stream Consumer.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_kinesis_stream_consumer
+
+Provides a resource to manage a Kinesis Stream Consumer.
+
+-> **Note:** You can register up to 20 consumers per stream. A given consumer can only be registered with one stream at a time.
+
+For more details, see the [Amazon Kinesis Stream Consumer Documentation][1].
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { KinesisStream } from "./.gen/providers/aws/kinesis-stream";
+import { KinesisStreamConsumer } from "./.gen/providers/aws/kinesis-stream-consumer";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new KinesisStream(this, "example", {
+      name: "example-stream",
+      shardCount: 1,
+    });
+    const awsKinesisStreamConsumerExample = new KinesisStreamConsumer(
+      this,
+      "example_1",
+      {
+        name: "example-consumer",
+        streamArn: example.arn,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsKinesisStreamConsumerExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required, Forces new resource) Name of the stream consumer.
+* `streamArn` – (Required, Forces new resource) Amazon Resource Name (ARN) of the data stream the consumer is registered with.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the stream consumer.
+* `creationTimestamp` - Approximate timestamp in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8) of when the stream consumer was created.
+* `id` - Amazon Resource Name (ARN) of the stream consumer.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Kinesis Stream Consumers using the Amazon Resource Name (ARN). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Kinesis Stream Consumers using the Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_kinesis_stream_consumer.example arn:aws:kinesis:us-west-2:123456789012:stream/example/consumer/example:1616044553
+```
+
+[1]: https://docs.aws.amazon.com/streams/latest/dev/amazon-kinesis-consumers.html
+
+<!-- cache-key: cdktf-0.18.0 input-faf8b78eb95acfe75982d82f725f47823646882c37a340dc5040b02aee2f21f1 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/kinesis_video_stream.html.markdown b/website/docs/cdktf/typescript/r/kinesis_video_stream.html.markdown
new file mode 100644
index 00000000000..171a3c9a5a2
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/kinesis_video_stream.html.markdown
@@ -0,0 +1,101 @@
+---
+subcategory: "Kinesis Video"
+layout: "aws"
+page_title: "AWS: aws_kinesis_video_stream"
+description: |-
+  Provides a AWS Kinesis Video Stream
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_kinesis_video_stream
+
+Provides a Kinesis Video Stream resource. Amazon Kinesis Video Streams makes it easy to securely stream video from connected devices to AWS for analytics, machine learning (ML), playback, and other processing.
+
+For more details, see the [Amazon Kinesis Documentation][1].
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { KinesisVideoStream } from "./.gen/providers/aws/kinesis-video-stream";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new KinesisVideoStream(this, "default", {
+      dataRetentionInHours: 1,
+      deviceName: "kinesis-video-device-name",
+      mediaType: "video/h264",
+      name: "terraform-kinesis-video-stream",
+      tags: {
+        Name: "terraform-kinesis-video-stream",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) A name to identify the stream. This is unique to the
+AWS account and region the Stream is created in.
+* `dataRetentionInHours` – (Optional) The number of hours that you want to retain the data in the stream. Kinesis Video Streams retains the data in a data store that is associated with the stream. The default value is `0`, indicating that the stream does not persist data.
+* `deviceName` - (Optional) The name of the device that is writing to the stream. **In the current implementation, Kinesis Video Streams does not use this name.**
+* `kmsKeyId` - (Optional) The ID of the AWS Key Management Service (AWS KMS) key that you want Kinesis Video Streams to use to encrypt stream data. If no key ID is specified, the default, Kinesis Video-managed key (`aws/kinesisvideo`) is used.
+* `mediaType` - (Optional) The media type of the stream. Consumers of the stream can use this information when processing the stream. For more information about media types, see [Media Types][2]. If you choose to specify the MediaType, see [Naming Requirements][3] for guidelines.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The unique Stream id
+* `arn` - The Amazon Resource Name (ARN) specifying the Stream (same as `id`)
+* `creationTime` - A time stamp that indicates when the stream was created.
+* `version` - The version of the stream.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `5M`)
+- `update` - (Default `120M`)
+- `delete` - (Default `120M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Kinesis Streams using the `arn`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Kinesis Streams using the `arn`. For example:
+
+```console
+% terraform import aws_kinesis_video_stream.test_stream arn:aws:kinesisvideo:us-west-2:123456789012:stream/terraform-kinesis-test/1554978910975
+```
+
+[1]: https://aws.amazon.com/documentation/kinesis/
+[2]: http://www.iana.org/assignments/media-types/media-types.xhtml
+[3]: https://tools.ietf.org/html/rfc6838#section-4.2
+
+<!-- cache-key: cdktf-0.18.0 input-9e588c14e41b8ac56c1691ef835d73ed6f334b72a8ab742e2478725e27ff938c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/kinesisanalyticsv2_application.html.markdown b/website/docs/cdktf/typescript/r/kinesisanalyticsv2_application.html.markdown
new file mode 100644
index 00000000000..47b29f02adf
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/kinesisanalyticsv2_application.html.markdown
@@ -0,0 +1,561 @@
+---
+subcategory: "Kinesis Analytics V2"
+layout: "aws"
+page_title: "AWS: aws_kinesisanalyticsv2_application"
+description: |-
+  Manages a Kinesis Analytics v2 Application.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_kinesisanalyticsv2_application
+
+Manages a Kinesis Analytics v2 Application.
+This resource can be used to manage both Kinesis Data Analytics for SQL applications and Kinesis Data Analytics for Apache Flink applications.
+
+-> **Note:** Kinesis Data Analytics for SQL applications created using this resource cannot currently be viewed in the AWS Console. To manage Kinesis Data Analytics for SQL applications that can also be viewed in the AWS Console, use the [`awsKinesisAnalyticsApplication`](/docs/providers/aws/r/kinesis_analytics_application.html) resource.
+
+## Example Usage
+
+### Apache Flink Application
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Kinesisanalyticsv2Application } from "./.gen/providers/aws/kinesisanalyticsv2-application";
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3Object } from "./.gen/providers/aws/s3-object";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new S3Bucket(this, "example", {
+      bucket: "example-flink-application",
+    });
+    const awsS3ObjectExample = new S3Object(this, "example_1", {
+      bucket: example.id,
+      key: "example-flink-application",
+      source: "flink-app.jar",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3ObjectExample.overrideLogicalId("example");
+    const awsKinesisanalyticsv2ApplicationExample =
+      new Kinesisanalyticsv2Application(this, "example_2", {
+        applicationConfiguration: {
+          applicationCodeConfiguration: {
+            codeContent: {
+              s3ContentLocation: {
+                bucketArn: example.arn,
+                fileKey: Token.asString(awsS3ObjectExample.key),
+              },
+            },
+            codeContentType: "ZIPFILE",
+          },
+          environmentProperties: {
+            propertyGroup: [
+              {
+                propertyGroupId: "PROPERTY-GROUP-1",
+                propertyMap: {
+                  Key1: "Value1",
+                },
+              },
+              {
+                propertyGroupId: "PROPERTY-GROUP-2",
+                propertyMap: {
+                  KeyA: "ValueA",
+                  KeyB: "ValueB",
+                },
+              },
+            ],
+          },
+          flinkApplicationConfiguration: {
+            checkpointConfiguration: {
+              configurationType: "DEFAULT",
+            },
+            monitoringConfiguration: {
+              configurationType: "CUSTOM",
+              logLevel: "DEBUG",
+              metricsLevel: "TASK",
+            },
+            parallelismConfiguration: {
+              autoScalingEnabled: true,
+              configurationType: "CUSTOM",
+              parallelism: 10,
+              parallelismPerKpu: 4,
+            },
+          },
+        },
+        name: "example-flink-application",
+        runtimeEnvironment: "FLINK-1_8",
+        serviceExecutionRole: Token.asString(awsIamRoleExample.arn),
+        tags: {
+          Environment: "test",
+        },
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsKinesisanalyticsv2ApplicationExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### SQL Application
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudwatchLogGroup } from "./.gen/providers/aws/cloudwatch-log-group";
+import { CloudwatchLogStream } from "./.gen/providers/aws/cloudwatch-log-stream";
+import { Kinesisanalyticsv2Application } from "./.gen/providers/aws/kinesisanalyticsv2-application";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new CloudwatchLogGroup(this, "example", {
+      name: "example-sql-application",
+    });
+    const awsCloudwatchLogStreamExample = new CloudwatchLogStream(
+      this,
+      "example_1",
+      {
+        logGroupName: example.name,
+        name: "example-sql-application",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsCloudwatchLogStreamExample.overrideLogicalId("example");
+    const awsKinesisanalyticsv2ApplicationExample =
+      new Kinesisanalyticsv2Application(this, "example_2", {
+        applicationConfiguration: {
+          applicationCodeConfiguration: {
+            codeContent: {
+              textContent: "SELECT 1;\n\n",
+            },
+            codeContentType: "PLAINTEXT",
+          },
+          sqlApplicationConfiguration: {
+            input: {
+              inputParallelism: {
+                count: 3,
+              },
+              inputSchema: {
+                recordColumn: [
+                  {
+                    mapping: "MAPPING-1",
+                    name: "COLUMN_1",
+                    sqlType: "VARCHAR(8)",
+                  },
+                  {
+                    name: "COLUMN_2",
+                    sqlType: "DOUBLE",
+                  },
+                ],
+                recordEncoding: "UTF-8",
+                recordFormat: {
+                  mappingParameters: {
+                    csvMappingParameters: {
+                      recordColumnDelimiter: ",",
+                      recordRowDelimiter: "\n\n",
+                    },
+                  },
+                  recordFormatType: "CSV",
+                },
+              },
+              kinesisStreamsInput: {
+                resourceArn: Token.asString(awsKinesisStreamExample.arn),
+              },
+              namePrefix: "PREFIX_1",
+            },
+            output: [
+              {
+                destinationSchema: {
+                  recordFormatType: "JSON",
+                },
+                lambdaOutput: {
+                  resourceArn: Token.asString(awsLambdaFunctionExample.arn),
+                },
+                name: "OUTPUT_1",
+              },
+              {
+                destinationSchema: {
+                  recordFormatType: "CSV",
+                },
+                kinesisFirehoseOutput: {
+                  resourceArn: Token.asString(
+                    awsKinesisFirehoseDeliveryStreamExample.arn
+                  ),
+                },
+                name: "OUTPUT_2",
+              },
+            ],
+            referenceDataSource: {
+              referenceSchema: {
+                recordColumn: [
+                  {
+                    name: "COLUMN_1",
+                    sqlType: "INTEGER",
+                  },
+                ],
+                recordFormat: {
+                  mappingParameters: {
+                    jsonMappingParameters: {
+                      recordRowPath: "$",
+                    },
+                  },
+                  recordFormatType: "JSON",
+                },
+              },
+              s3ReferenceDataSource: {
+                bucketArn: Token.asString(awsS3BucketExample.arn),
+                fileKey: "KEY-1",
+              },
+              tableName: "TABLE-1",
+            },
+          },
+        },
+        cloudwatchLoggingOptions: {
+          logStreamArn: Token.asString(awsCloudwatchLogStreamExample.arn),
+        },
+        name: "example-sql-application",
+        runtimeEnvironment: "SQL-1_0",
+        serviceExecutionRole: Token.asString(awsIamRoleExample.arn),
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsKinesisanalyticsv2ApplicationExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### VPC Configuration
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, Fn, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Kinesisanalyticsv2Application } from "./.gen/providers/aws/kinesisanalyticsv2-application";
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3Object } from "./.gen/providers/aws/s3-object";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new S3Bucket(this, "example", {
+      bucket: "example-flink-application",
+    });
+    const awsS3ObjectExample = new S3Object(this, "example_1", {
+      bucket: example.id,
+      key: "example-flink-application",
+      source: "flink-app.jar",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3ObjectExample.overrideLogicalId("example");
+    const awsKinesisanalyticsv2ApplicationExample =
+      new Kinesisanalyticsv2Application(this, "example_2", {
+        applicationConfiguration: {
+          applicationCodeConfiguration: {
+            codeContent: {
+              s3ContentLocation: {
+                bucketArn: example.arn,
+                fileKey: Token.asString(awsS3ObjectExample.key),
+              },
+            },
+            codeContentType: "ZIPFILE",
+          },
+          vpcConfiguration: {
+            securityGroupIds: [
+              Token.asString(
+                Fn.lookupNested(awsSecurityGroupExample, ["0", "id"])
+              ),
+              Token.asString(
+                Fn.lookupNested(awsSecurityGroupExample, ["1", "id"])
+              ),
+            ],
+            subnetIds: [Token.asString(awsSubnetExample.id)],
+          },
+        },
+        name: "example-flink-application",
+        runtimeEnvironment: "FLINK-1_8",
+        serviceExecutionRole: Token.asString(awsIamRoleExample.arn),
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsKinesisanalyticsv2ApplicationExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the application.
+* `runtimeEnvironment` - (Required) The runtime environment for the application. Valid values: `sql10`, `flink16`, `flink18`, `flink111`, `flink113`, `flink115`.
+* `serviceExecutionRole` - (Required) The ARN of the [IAM role](/docs/providers/aws/r/iam_role.html) used by the application to access Kinesis data streams, Kinesis Data Firehose delivery streams, Amazon S3 objects, and other external resources.
+* `applicationConfiguration` - (Optional) The application's configuration
+* `cloudwatchLoggingOptions` - (Optional) A [CloudWatch log stream](/docs/providers/aws/r/cloudwatch_log_stream.html) to monitor application configuration errors.
+* `description` - (Optional) A summary description of the application.
+* `forceStop` - (Optional) Whether to force stop an unresponsive Flink-based application.
+* `startApplication` - (Optional) Whether to start or stop the application.
+* `tags` - (Optional) A map of tags to assign to the application. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+The `applicationConfiguration` object supports the following:
+
+* `applicationCodeConfiguration` - (Required) The code location and type parameters for the application.
+* `applicationSnapshotConfiguration` - (Optional) Describes whether snapshots are enabled for a Flink-based application.
+* `environmentProperties` - (Optional) Describes execution properties for a Flink-based application.
+* `flinkApplicationConfiguration` - (Optional) The configuration of a Flink-based application.
+* `runConfiguration` - (Optional) Describes the starting properties for a Flink-based application.
+* `sqlApplicationConfiguration` - (Optional) The configuration of a SQL-based application.
+* `vpcConfiguration` - (Optional) The VPC configuration of a Flink-based application.
+
+The `applicationCodeConfiguration` object supports the following:
+
+* `codeContentType` - (Required) Specifies whether the code content is in text or zip format. Valid values: `plaintext`, `zipfile`.
+* `codeContent` - (Optional) The location and type of the application code.
+
+The `codeContent` object supports the following:
+
+* `s3ContentLocation` - (Optional) Information about the Amazon S3 bucket containing the application code.
+* `textContent` - (Optional) The text-format code for the application.
+
+The `s3ContentLocation` object supports the following:
+
+* `bucketArn` - (Required) The ARN for the S3 bucket containing the application code.
+* `fileKey` - (Required) The file key for the object containing the application code.
+* `objectVersion` - (Optional) The version of the object containing the application code.
+
+The `applicationSnapshotConfiguration` object supports the following:
+
+* `snapshotsEnabled` - (Required) Describes whether snapshots are enabled for a Flink-based Kinesis Data Analytics application.
+
+The `environmentProperties` object supports the following:
+
+* `propertyGroup` - (Required) Describes the execution property groups.
+
+The `propertyGroup` object supports the following:
+
+* `propertyGroupId` - (Required) The key of the application execution property key-value map.
+* `propertyMap` - (Required) Application execution property key-value map.
+
+The `flinkApplicationConfiguration` object supports the following:
+
+* `checkpointConfiguration` - (Optional) Describes an application's checkpointing configuration.
+* `monitoringConfiguration` - (Optional) Describes configuration parameters for CloudWatch logging for an application.
+* `parallelismConfiguration` - (Optional) Describes parameters for how an application executes multiple tasks simultaneously.
+
+The `checkpointConfiguration` object supports the following:
+
+* `configurationType` - (Required) Describes whether the application uses Kinesis Data Analytics' default checkpointing behavior. Valid values: `custom`, `default`. Set this attribute to `custom` in order for any specified `checkpointingEnabled`, `checkpointInterval`, or `minPauseBetweenCheckpoints` attribute values to be effective. If this attribute is set to `default`, the application will always use the following values:
+    * `checkpointing_enabled = true`
+    * `checkpoint_interval = 60000`
+    * `min_pause_between_checkpoints = 5000`
+* `checkpointingEnabled` - (Optional) Describes whether checkpointing is enabled for a Flink-based Kinesis Data Analytics application.
+* `checkpointInterval` - (Optional) Describes the interval in milliseconds between checkpoint operations.
+* `minPauseBetweenCheckpoints` - (Optional) Describes the minimum time in milliseconds after a checkpoint operation completes that a new checkpoint operation can start.
+
+The `monitoringConfiguration` object supports the following:
+
+* `configurationType` - (Required) Describes whether to use the default CloudWatch logging configuration for an application. Valid values: `custom`, `default`. Set this attribute to `custom` in order for any specified `logLevel` or `metricsLevel` attribute values to be effective.
+* `logLevel` - (Optional) Describes the verbosity of the CloudWatch Logs for an application. Valid values: `debug`, `error`, `info`, `warn`.
+* `metricsLevel` - (Optional) Describes the granularity of the CloudWatch Logs for an application. Valid values: `application`, `operator`, `parallelism`, `task`.
+
+The `parallelismConfiguration` object supports the following:
+
+* `configurationType` - (Required) Describes whether the application uses the default parallelism for the Kinesis Data Analytics service. Valid values: `custom`, `default`. Set this attribute to `custom` in order for any specified `autoScalingEnabled`, `parallelism`, or `parallelismPerKpu` attribute values to be effective.
+* `autoScalingEnabled` - (Optional) Describes whether the Kinesis Data Analytics service can increase the parallelism of the application in response to increased throughput.
+* `parallelism` - (Optional) Describes the initial number of parallel tasks that a Flink-based Kinesis Data Analytics application can perform.
+* `parallelismPerKpu` - (Optional) Describes the number of parallel tasks that a Flink-based Kinesis Data Analytics application can perform per Kinesis Processing Unit (KPU) used by the application.
+
+The `runConfiguration` object supports the following:
+
+* `applicationRestoreConfiguration` - (Optional) The restore behavior of a restarting application.
+* `flinkRunConfiguration` - (Optional) The starting parameters for a Flink-based Kinesis Data Analytics application.
+
+The `applicationRestoreConfiguration` object supports the following:
+
+* `applicationRestoreType` - (Required) Specifies how the application should be restored. Valid values: `restoreFromCustomSnapshot`, `restoreFromLatestSnapshot`, `skipRestoreFromSnapshot`.
+* `snapshotName` - (Optional) The identifier of an existing snapshot of application state to use to restart an application. The application uses this value if `restoreFromCustomSnapshot` is specified for `applicationRestoreType`.
+
+The `flinkRunConfiguration` object supports the following:
+
+* `allowNonRestoredState` - (Optional) When restoring from a snapshot, specifies whether the runtime is allowed to skip a state that cannot be mapped to the new program. Default is `false`.
+
+The `sqlApplicationConfiguration` object supports the following:
+
+* `input` - (Optional) The input stream used by the application.
+* `output` - (Optional) The destination streams used by the application.
+* `referenceDataSource` - (Optional) The reference data source used by the application.
+
+The `input` object supports the following:
+
+* `inputSchema` - (Required) Describes the format of the data in the streaming source, and how each data element maps to corresponding columns in the in-application stream that is being created.
+* `namePrefix` - (Required) The name prefix to use when creating an in-application stream.
+* `inputParallelism` - (Optional) Describes the number of in-application streams to create.
+* `inputProcessingConfiguration` - (Optional) The input processing configuration for the input.
+An input processor transforms records as they are received from the stream, before the application's SQL code executes.
+* `inputStartingPositionConfiguration` (Optional) The point at which the application starts processing records from the streaming source.
+* `kinesisFirehoseInput` - (Optional) If the streaming source is a [Kinesis Data Firehose delivery stream](/docs/providers/aws/r/kinesis_firehose_delivery_stream.html), identifies the delivery stream's ARN.
+* `kinesisStreamsInput` - (Optional) If the streaming source is a [Kinesis data stream](/docs/providers/aws/r/kinesis_stream.html), identifies the stream's Amazon Resource Name (ARN).
+
+The `inputParallelism` object supports the following:
+
+* `count` - (Optional) The number of in-application streams to create.
+
+The `inputProcessingConfiguration` object supports the following:
+
+* `inputLambdaProcessor` - (Required) Describes the [Lambda function](/docs/providers/aws/r/lambda_function.html) that is used to preprocess the records in the stream before being processed by your application code.
+
+The `inputLambdaProcessor` object supports the following:
+
+* `resourceArn` - (Required) The ARN of the Lambda function that operates on records in the stream.
+
+The `inputSchema` object supports the following:
+
+* `recordColumn` - (Required) Describes the mapping of each data element in the streaming source to the corresponding column in the in-application stream.
+* `recordFormat` - (Required) Specifies the format of the records on the streaming source.
+* `recordEncoding` - (Optional) Specifies the encoding of the records in the streaming source. For example, `utf8`.
+
+The `recordColumn` object supports the following:
+
+* `name` - (Required) The name of the column that is created in the in-application input stream or reference table.
+* `sqlType` - (Required) The type of column created in the in-application input stream or reference table.
+* `mapping` - (Optional) A reference to the data element in the streaming input or the reference data source.
+
+The `recordFormat` object supports the following:
+
+* `mappingParameters` - (Required) Provides additional mapping information specific to the record format (such as JSON, CSV, or record fields delimited by some delimiter) on the streaming source.
+* `recordFormatType` - (Required) The type of record format. Valid values: `csv`, `json`.
+
+The `mappingParameters` object supports the following:
+
+* `csvMappingParameters` - (Optional) Provides additional mapping information when the record format uses delimiters (for example, CSV).
+* `jsonMappingParameters` - (Optional) Provides additional mapping information when JSON is the record format on the streaming source.
+
+The `csvMappingParameters` object supports the following:
+
+* `recordColumnDelimiter` - (Required) The column delimiter. For example, in a CSV format, a comma (`,`) is the typical column delimiter.
+* `recordRowDelimiter` - (Required) The row delimiter. For example, in a CSV format, `\n` is the typical row delimiter.
+
+The `jsonMappingParameters` object supports the following:
+
+* `recordRowPath` - (Required) The path to the top-level parent that contains the records.
+
+The `inputStartingPositionConfiguration` object supports the following:
+
+~> **NOTE:** To modify an application's starting position, first stop the application by setting `start_application = false`, then update `startingPosition` and set `start_application = true`.
+
+* `inputStartingPosition` - (Required) The starting position on the stream. Valid values: `lastStoppedPoint`, `now`, `trimHorizon`.
+
+The `kinesisFirehoseInput` object supports the following:
+
+* `resourceArn` - (Required) The ARN of the delivery stream.
+
+The `kinesisStreamsInput` object supports the following:
+
+* `resourceArn` - (Required) The ARN of the input Kinesis data stream to read.
+
+The `output` object supports the following:
+
+* `destinationSchema` - (Required) Describes the data format when records are written to the destination.
+* `name` - (Required) The name of the in-application stream.
+* `kinesisFirehoseOutput` - (Optional) Identifies a [Kinesis Data Firehose delivery stream](/docs/providers/aws/r/kinesis_firehose_delivery_stream.html) as the destination.
+* `kinesisStreamsOutput` - (Optional) Identifies a [Kinesis data stream](/docs/providers/aws/r/kinesis_stream.html) as the destination.
+* `lambdaOutput` - (Optional) Identifies a [Lambda function](/docs/providers/aws/r/lambda_function.html) as the destination.
+
+The `destinationSchema` object supports the following:
+
+* `recordFormatType` - (Required) Specifies the format of the records on the output stream. Valid values: `csv`, `json`.
+
+The `kinesisFirehoseOutput` object supports the following:
+
+* `resourceArn` - (Required) The ARN of the destination delivery stream to write to.
+
+The `kinesisStreamsOutput` object supports the following:
+
+* `resourceArn` - (Required) The ARN of the destination Kinesis data stream to write to.
+
+The `lambdaOutput` object supports the following:
+
+* `resourceArn` - (Required) The ARN of the destination Lambda function to write to.
+
+The `referenceDataSource` object supports the following:
+
+* `referenceSchema` - (Required) Describes the format of the data in the streaming source, and how each data element maps to corresponding columns created in the in-application stream.
+* `s3ReferenceDataSource` - (Required) Identifies the S3 bucket and object that contains the reference data.
+* `tableName` - (Required) The name of the in-application table to create.
+
+The `referenceSchema` object supports the following:
+
+* `recordColumn` - (Required) Describes the mapping of each data element in the streaming source to the corresponding column in the in-application stream.
+* `recordFormat` - (Required) Specifies the format of the records on the streaming source.
+* `recordEncoding` - (Optional) Specifies the encoding of the records in the streaming source. For example, `utf8`.
+
+The `s3ReferenceDataSource` object supports the following:
+
+* `bucketArn` - (Required) The ARN of the S3 bucket.
+* `fileKey` - (Required) The object key name containing the reference data.
+
+The `vpcConfiguration` object supports the following:
+
+* `securityGroupIds` - (Required) The [Security Group](/docs/providers/aws/r/security_group.html) IDs used by the VPC configuration.
+* `subnetIds` - (Required) The [Subnet](/docs/providers/aws/r/subnet.html) IDs used by the VPC configuration.
+
+The `cloudwatchLoggingOptions` object supports the following:
+
+* `logStreamArn` - (Required) The ARN of the CloudWatch log stream to receive application messages.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The application identifier.
+* `arn` - The ARN of the application.
+* `createTimestamp` - The current timestamp when the application was created.
+* `lastUpdateTimestamp` - The current timestamp when the application was last updated.
+* `status` - The status of the application.
+* `versionId` - The current application version. Kinesis Data Analytics updates the `versionId` each time the application is updated.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `10M`)
+- `update` - (Default `10M`)
+- `delete` - (Default `10M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsKinesisanalyticsv2Application` using the application ARN. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsKinesisanalyticsv2Application` using the application ARN. For example:
+
+```console
+% terraform import aws_kinesisanalyticsv2_application.example arn:aws:kinesisanalytics:us-west-2:123456789012:application/example-sql-application
+```
+
+<!-- cache-key: cdktf-0.18.0 input-6d238f855d065dc06f35d3883f4979e1a608611ece08c6d5911d2f7d1d7c3396 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/kinesisanalyticsv2_application_snapshot.html.markdown b/website/docs/cdktf/typescript/r/kinesisanalyticsv2_application_snapshot.html.markdown
new file mode 100644
index 00000000000..adc0838bcea
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/kinesisanalyticsv2_application_snapshot.html.markdown
@@ -0,0 +1,85 @@
+---
+subcategory: "Kinesis Analytics V2"
+layout: "aws"
+page_title: "AWS: aws_kinesisanalyticsv2_application_snapshot"
+description: |-
+  Manages a Kinesis Analytics v2 Application Snapshot.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_kinesisanalyticsv2_application_snapshot
+
+Manages a Kinesis Analytics v2 Application Snapshot.
+Snapshots are the AWS implementation of [Flink Savepoints](https://ci.apache.org/projects/flink/flink-docs-release-1.11/ops/state/savepoints.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Kinesisanalyticsv2ApplicationSnapshot } from "./.gen/providers/aws/kinesisanalyticsv2-application-snapshot";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Kinesisanalyticsv2ApplicationSnapshot(this, "example", {
+      applicationName: Token.asString(
+        awsKinesisanalyticsv2ApplicationExample.name
+      ),
+      snapshotName: "example-snapshot",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `applicationName` - (Required) The name of an existing  [Kinesis Analytics v2 Application](/docs/providers/aws/r/kinesisanalyticsv2_application.html). Note that the application must be running for a snapshot to be created.
+* `snapshotName` - (Required) The name of the application snapshot.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The application snapshot identifier.
+* `applicationVersionId` - The current application version ID when the snapshot was created.
+* `snapshotCreationTimestamp` - The timestamp of the application snapshot.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `10M`)
+- `delete` - (Default `10M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsKinesisanalyticsv2Application` using `applicationName` together with `snapshotName`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsKinesisanalyticsv2Application` using `applicationName` together with `snapshotName`. For example:
+
+```console
+% terraform import aws_kinesisanalyticsv2_application_snapshot.example example-application/example-snapshot
+```
+
+<!-- cache-key: cdktf-0.18.0 input-bd3010fed4591275bcebfac88611f10eb5c9c79e722ef1789997282c4a9937ac -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/kms_alias.html.markdown b/website/docs/cdktf/typescript/r/kms_alias.html.markdown
new file mode 100644
index 00000000000..4e62877fa78
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/kms_alias.html.markdown
@@ -0,0 +1,82 @@
+---
+subcategory: "KMS (Key Management)"
+layout: "aws"
+page_title: "AWS: aws_kms_alias"
+description: |-
+  Provides a display name for a customer master key.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_kms_alias
+
+Provides an alias for a KMS customer master key. AWS Console enforces 1-to-1 mapping between aliases & keys,
+but API (hence Terraform too) allows you to create as many aliases as
+the [account limits](http://docs.aws.amazon.com/kms/latest/developerguide/limits.html) allow you.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { KmsAlias } from "./.gen/providers/aws/kms-alias";
+import { KmsKey } from "./.gen/providers/aws/kms-key";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const a = new KmsKey(this, "a", {});
+    const awsKmsAliasA = new KmsAlias(this, "a_1", {
+      name: "alias/my-key-alias",
+      targetKeyId: a.keyId,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsKmsAliasA.overrideLogicalId("a");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Optional) The display name of the alias. The name must start with the word "alias" followed by a forward slash (alias/)
+* `namePrefix` - (Optional) Creates an unique alias beginning with the specified prefix.
+The name must start with the word "alias" followed by a forward slash (alias/).  Conflicts with `name`.
+* `targetKeyId` - (Required) Identifier for the key for which the alias is for, can be either an ARN or key_id.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the key alias.
+* `targetKeyArn` - The Amazon Resource Name (ARN) of the target key identifier.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import KMS aliases using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import KMS aliases using the `name`. For example:
+
+```console
+% terraform import aws_kms_alias.a alias/my-key-alias
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ca20383ce5b8fdeb88071f1c945d966a1085da48052143ed4134dcc859d1ae7d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/kms_ciphertext.html.markdown b/website/docs/cdktf/typescript/r/kms_ciphertext.html.markdown
new file mode 100644
index 00000000000..63cf451023e
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/kms_ciphertext.html.markdown
@@ -0,0 +1,64 @@
+---
+subcategory: "KMS (Key Management)"
+layout: "aws"
+page_title: "AWS: aws_kms_ciphertext"
+description: |-
+    Provides ciphertext encrypted using a KMS key
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_kms_ciphertext
+
+The KMS ciphertext resource allows you to encrypt plaintext into ciphertext
+by using an AWS KMS customer master key. The value returned by this resource
+is stable across every apply. For a changing ciphertext value each apply, see
+the [`awsKmsCiphertext` data source](/docs/providers/aws/d/kms_ciphertext.html).
+
+~> **Note:** All arguments including the plaintext be stored in the raw state as plain-text.
+[Read more about sensitive data in state](https://www.terraform.io/docs/state/sensitive-data.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { KmsCiphertext } from "./.gen/providers/aws/kms-ciphertext";
+import { KmsKey } from "./.gen/providers/aws/kms-key";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const oauthConfig = new KmsKey(this, "oauth_config", {
+      description: "oauth config",
+      isEnabled: true,
+    });
+    new KmsCiphertext(this, "oauth", {
+      keyId: oauthConfig.keyId,
+      plaintext:
+        '{\n  "client_id": "e587dbae22222f55da22",\n  "client_secret": "8289575d00000ace55e1815ec13673955721b8a5"\n}\n\n',
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `plaintext` - (Required) Data to be encrypted. Note that this may show up in logs, and it will be stored in the state file.
+* `keyId` - (Required) Globally unique key ID for the customer master key.
+* `context` - (Optional) An optional mapping that makes up the encryption context.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `ciphertextBlob` - Base64 encoded ciphertext
+
+<!-- cache-key: cdktf-0.18.0 input-ce598613e81130a177d236116781c8c718c56f4432df7d2ca84854a22e71b32b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/kms_custom_key_store.html.markdown b/website/docs/cdktf/typescript/r/kms_custom_key_store.html.markdown
new file mode 100644
index 00000000000..db751e33d13
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/kms_custom_key_store.html.markdown
@@ -0,0 +1,87 @@
+---
+subcategory: "KMS (Key Management)"
+layout: "aws"
+page_title: "AWS: aws_kms_custom_key_store"
+description: |-
+  Terraform resource for managing an AWS KMS (Key Management) Custom Key Store.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_kms_custom_key_store
+
+Terraform resource for managing an AWS KMS (Key Management) Custom Key Store.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { KmsCustomKeyStore } from "./.gen/providers/aws/kms-custom-key-store";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new KmsCustomKeyStore(this, "test", {
+      cloudHsmClusterId: cloudHsmClusterId.stringValue,
+      customKeyStoreName: "kms-custom-key-store-test",
+      keyStorePassword: "noplaintextpasswords1",
+      trustAnchorCertificate: Token.asString(Fn.file("anchor-certificate.crt")),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `cloudHsmClusterId` - (Required) Cluster ID of CloudHSM.
+* `customKeyStoreName` - (Required) Unique name for Custom Key Store.
+* `keyStorePassword` - (Required) Password for `kmsuser` on CloudHSM.
+* `trustAnchorCertificate` - (Required) Customer certificate used for signing on CloudHSM.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Custom Key Store ID
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `15M`)
+* `update` - (Default `15M`)
+* `delete` - (Default `15M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import KMS (Key Management) Custom Key Store using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import KMS (Key Management) Custom Key Store using the `id`. For example:
+
+```console
+% terraform import aws_kms_custom_key_store.example cks-5ebd4ef395a96288e
+```
+
+<!-- cache-key: cdktf-0.18.0 input-9dcae02bd36df2fce9d93db2f8a904b6e54954716a7c73cfb8a2f6513817a111 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/kms_external_key.html.markdown b/website/docs/cdktf/typescript/r/kms_external_key.html.markdown
new file mode 100644
index 00000000000..8d3190cf70d
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/kms_external_key.html.markdown
@@ -0,0 +1,87 @@
+---
+subcategory: "KMS (Key Management)"
+layout: "aws"
+page_title: "AWS: aws_kms_external_key"
+description: |-
+  Manages a single-Region or multi-Region primary KMS key that uses external key material.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_kms_external_key
+
+Manages a single-Region or multi-Region primary KMS key that uses external key material.
+To instead manage a single-Region or multi-Region primary KMS key where AWS automatically generates and potentially rotates key material, see the [`awsKmsKey` resource](/docs/providers/aws/r/kms_key.html).
+
+~> **Note:** All arguments including the key material will be stored in the raw state as plain-text. [Read more about sensitive data in state](https://www.terraform.io/docs/state/sensitive-data.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { KmsExternalKey } from "./.gen/providers/aws/kms-external-key";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new KmsExternalKey(this, "example", {
+      description: "KMS EXTERNAL for AMI encryption",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `bypassPolicyLockoutSafetyCheck` - (Optional) Specifies whether to disable the policy lockout check performed when creating or updating the key's policy. Setting this value to `true` increases the risk that the key becomes unmanageable. For more information, refer to the scenario in the [Default Key Policy](https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default-allow-root-enable-iam) section in the AWS Key Management Service Developer Guide. Defaults to `false`.
+* `deletionWindowInDays` - (Optional) Duration in days after which the key is deleted after destruction of the resource. Must be between `7` and `30` days. Defaults to `30`.
+* `description` - (Optional) Description of the key.
+* `enabled` - (Optional) Specifies whether the key is enabled. Keys pending import can only be `false`. Imported keys default to `true` unless expired.
+* `keyMaterialBase64` - (Optional) Base64 encoded 256-bit symmetric encryption key material to import. The CMK is permanently associated with this key material. The same key material can be reimported, but you cannot import different key material.
+* `multiRegion` - (Optional) Indicates whether the KMS key is a multi-Region (`true`) or regional (`false`) key. Defaults to `false`.
+* `policy` - (Optional) A key policy JSON document. If you do not provide a key policy, AWS KMS attaches a default key policy to the CMK.
+* `tags` - (Optional) A key-value map of tags to assign to the key. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `validTo` - (Optional) Time at which the imported key material expires. When the key material expires, AWS KMS deletes the key material and the CMK becomes unusable. If not specified, key material does not expire. Valid values: [RFC3339 time string](https://tools.ietf.org/html/rfc3339#section-5.8) (`yyyyMmDdthh:mm:ssz`)
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the key.
+* `expirationModel` - Whether the key material expires. Empty when pending key material import, otherwise `keyMaterialExpires` or `keyMaterialDoesNotExpire`.
+* `id` - The unique identifier for the key.
+* `keyState` - The state of the CMK.
+* `keyUsage` - The cryptographic operations for which you can use the CMK.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import KMS External Keys using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import KMS External Keys using the `id`. For example:
+
+```console
+% terraform import aws_kms_external_key.a arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab
+```
+
+<!-- cache-key: cdktf-0.18.0 input-0484ec46a723c1a6dff8e9bc90b1793826fc146b89008eced5df42a79df9f3c2 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/kms_grant.html.markdown b/website/docs/cdktf/typescript/r/kms_grant.html.markdown
new file mode 100644
index 00000000000..73bee808c10
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/kms_grant.html.markdown
@@ -0,0 +1,121 @@
+---
+subcategory: "KMS (Key Management)"
+layout: "aws"
+page_title: "AWS: aws_kms_grant"
+description: |-
+  Provides a resource-based access control mechanism for KMS Customer Master Keys.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_kms_grant
+
+Provides a resource-based access control mechanism for a KMS customer master key.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+import { KmsGrant } from "./.gen/providers/aws/kms-grant";
+import { KmsKey } from "./.gen/providers/aws/kms-key";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const a = new KmsKey(this, "a", {});
+    const assumeRole = new DataAwsIamPolicyDocument(this, "assume_role", {
+      statement: [
+        {
+          actions: ["sts:AssumeRole"],
+          effect: "Allow",
+          principals: [
+            {
+              identifiers: Token.asList("lambda.amazonaws.com"),
+              type: "Service",
+            },
+          ],
+        },
+      ],
+    });
+    const awsIamRoleA = new IamRole(this, "a_2", {
+      assumeRolePolicy: Token.asString(assumeRole.json),
+      name: "iam-role-for-grant",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamRoleA.overrideLogicalId("a");
+    const awsKmsGrantA = new KmsGrant(this, "a_3", {
+      constraints: [
+        {
+          encryptionContextEquals: {
+            Department: "Finance",
+          },
+        },
+      ],
+      granteePrincipal: Token.asString(awsIamRoleA.arn),
+      keyId: a.keyId,
+      name: "my-grant",
+      operations: ["Encrypt", "Decrypt", "GenerateDataKey"],
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsKmsGrantA.overrideLogicalId("a");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Optional, Forces new resources) A friendly name for identifying the grant.
+* `keyId` - (Required, Forces new resources) The unique identifier for the customer master key (CMK) that the grant applies to. Specify the key ID or the Amazon Resource Name (ARN) of the CMK. To specify a CMK in a different AWS account, you must use the key ARN.
+* `granteePrincipal` - (Required, Forces new resources) The principal that is given permission to perform the operations that the grant permits in ARN format. Note that due to eventual consistency issues around IAM principals, terraform's state may not always be refreshed to reflect what is true in AWS.
+* `operations` - (Required, Forces new resources) A list of operations that the grant permits. The permitted values are: `decrypt`, `encrypt`, `generateDataKey`, `generateDataKeyWithoutPlaintext`, `reEncryptFrom`, `reEncryptTo`, `sign`, `verify`, `getPublicKey`, `createGrant`, `retireGrant`, `describeKey`, `generateDataKeyPair`, or `generateDataKeyPairWithoutPlaintext`.
+* `retiringPrincipal` - (Optional, Forces new resources) The principal that is given permission to retire the grant by using RetireGrant operation in ARN format. Note that due to eventual consistency issues around IAM principals, terraform's state may not always be refreshed to reflect what is true in AWS.
+* `constraints` - (Optional, Forces new resources) A structure that you can use to allow certain operations in the grant only when the desired encryption context is present. For more information about encryption context, see [Encryption Context](http://docs.aws.amazon.com/kms/latest/developerguide/encryption-context.html).
+* `grantCreationTokens` - (Optional, Forces new resources) A list of grant tokens to be used when creating the grant. See [Grant Tokens](http://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#grant_token) for more information about grant tokens.
+* `retireOnDelete` -(Defaults to false, Forces new resources) If set to false (the default) the grants will be revoked upon deletion, and if set to true the grants will try to be retired upon deletion. Note that retiring grants requires special permissions, hence why we default to revoking grants.
+  See [RetireGrant](https://docs.aws.amazon.com/kms/latest/APIReference/API_RetireGrant.html) for more information.
+
+The `constraints` block supports the following arguments:
+
+* `encryptionContextEquals` - (Optional) A list of key-value pairs that must match the encryption context in subsequent cryptographic operation requests. The grant allows the operation only when the encryption context in the request is the same as the encryption context specified in this constraint. Conflicts with `encryptionContextSubset`.
+* `encryptionContextSubset` - (Optional) A list of key-value pairs that must be included in the encryption context of subsequent cryptographic operation requests. The grant allows the cryptographic operation only when the encryption context in the request includes the key-value pairs specified in this constraint, although it can include additional key-value pairs. Conflicts with `encryptionContextEquals`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `grantId` - The unique identifier for the grant.
+* `grantToken` - The grant token for the created grant. For more information, see [Grant Tokens](http://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#grant_token).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import KMS Grants using the Key ID and Grant ID separated by a colon (`:`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import KMS Grants using the Key ID and Grant ID separated by a colon (`:`). For example:
+
+```console
+% terraform import aws_kms_grant.test 1234abcd-12ab-34cd-56ef-1234567890ab:abcde1237f76e4ba7987489ac329fbfba6ad343d6f7075dbd1ef191f0120514
+```
+
+<!-- cache-key: cdktf-0.18.0 input-9587e187df46d671340d0a3dbe282bc6f1942797aabd7b8c41cc9d9588d41d93 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/kms_key.html.markdown b/website/docs/cdktf/typescript/r/kms_key.html.markdown
new file mode 100644
index 00000000000..22816804b95
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/kms_key.html.markdown
@@ -0,0 +1,106 @@
+---
+subcategory: "KMS (Key Management)"
+layout: "aws"
+page_title: "AWS: aws_kms_key"
+description: |-
+  Manages a single-Region or multi-Region primary KMS key.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_kms_key
+
+Manages a single-Region or multi-Region primary KMS key.
+
+~> **NOTE on KMS Key Policy:** KMS Key Policy can be configured in either the standalone resource [`awsKmsKeyPolicy`](kms_key_policy.html)
+or with the parameter `policy` in this resource.
+Configuring with both will cause inconsistencies and may overwrite configuration.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { KmsKey } from "./.gen/providers/aws/kms-key";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new KmsKey(this, "a", {
+      deletionWindowInDays: 10,
+      description: "KMS key 1",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `description` - (Optional) The description of the key as viewed in AWS console.
+* `keyUsage` - (Optional) Specifies the intended use of the key. Valid values: `encryptDecrypt`, `signVerify`, or `generateVerifyMac`.
+Defaults to `encryptDecrypt`.
+* `customKeyStoreId` - (Optional) ID of the KMS [Custom Key Store](https://docs.aws.amazon.com/kms/latest/developerguide/create-cmk-keystore.html) where the key will be stored instead of KMS (eg CloudHSM).
+* `customerMasterKeySpec` - (Optional) Specifies whether the key contains a symmetric key or an asymmetric key pair and the encryption algorithms or signing algorithms that the key supports.
+Valid values: `symmetricDefault`,  `rsa2048`, `rsa3072`, `rsa4096`, `hmac256`, `eccNistP256`, `eccNistP384`, `eccNistP521`, or `eccSecgP256K1`. Defaults to `symmetricDefault`. For help with choosing a key spec, see the [AWS KMS Developer Guide](https://docs.aws.amazon.com/kms/latest/developerguide/symm-asymm-choose.html).
+* `policy` - (Optional) A valid policy JSON document. Although this is a key policy, not an IAM policy, an [`awsIamPolicyDocument`](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document), in the form that designates a principal, can be used. For more information about building policy documents with Terraform, see the [AWS IAM Policy Document Guide](https://learn.hashicorp.com/terraform/aws/iam-policy).
+
+~> **NOTE:** Note: All KMS keys must have a key policy. If a key policy is not specified, AWS gives the KMS key a [default key policy](https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default) that gives all principals in the owning account unlimited access to all KMS operations for the key. This default key policy effectively delegates all access control to IAM policies and KMS grants.
+
+* `bypassPolicyLockoutSafetyCheck` - (Optional) A flag to indicate whether to bypass the key policy lockout safety check.
+Setting this value to true increases the risk that the KMS key becomes unmanageable. Do not set this value to true indiscriminately.
+For more information, refer to the scenario in the [Default Key Policy](https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default-allow-root-enable-iam) section in the _AWS Key Management Service Developer Guide_.
+The default value is `false`.
+* `deletionWindowInDays` - (Optional) The waiting period, specified in number of days. After the waiting period ends, AWS KMS deletes the KMS key.
+If you specify a value, it must be between `7` and `30`, inclusive. If you do not specify a value, it defaults to `30`.
+If the KMS key is a multi-Region primary key with replicas, the waiting period begins when the last of its replica keys is deleted. Otherwise, the waiting period begins immediately.
+* `isEnabled` - (Optional) Specifies whether the key is enabled. Defaults to `true`.
+* `enableKeyRotation` - (Optional) Specifies whether [key rotation](http://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html) is enabled. Defaults to `false`.
+* `multiRegion` - (Optional) Indicates whether the KMS key is a multi-Region (`true`) or regional (`false`) key. Defaults to `false`.
+* `tags` - (Optional) A map of tags to assign to the object. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the key.
+* `keyId` - The globally unique identifier for the key.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+~> **Note:** There are a variety of default timeouts set internally. If you set a shorter custom timeout than one of the defaults, the custom timeout will not be respected as the longer of the custom or internal default will be used.
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `2M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import KMS Keys using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import KMS Keys using the `id`. For example:
+
+```console
+% terraform import aws_kms_key.a 1234abcd-12ab-34cd-56ef-1234567890ab
+```
+
+<!-- cache-key: cdktf-0.18.0 input-cadf26a57c86ad443716e9d493f3661a0240fbfa81abe024e3813fe0ac63a3dd -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/kms_key_policy.html.markdown b/website/docs/cdktf/typescript/r/kms_key_policy.html.markdown
new file mode 100644
index 00000000000..b152d55c7e4
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/kms_key_policy.html.markdown
@@ -0,0 +1,99 @@
+---
+subcategory: "KMS (Key Management)"
+layout: "aws"
+page_title: "AWS: aws_kms_key_policy"
+description: |-
+  Attaches a policy to a KMS Key.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_kms_key_policy
+
+Attaches a policy to a KMS Key.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { KmsKey } from "./.gen/providers/aws/kms-key";
+import { KmsKeyPolicy } from "./.gen/providers/aws/kms-key-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new KmsKey(this, "example", {
+      description: "example",
+    });
+    const awsKmsKeyPolicyExample = new KmsKeyPolicy(this, "example_1", {
+      keyId: example.id,
+      policy: Token.asString(
+        Fn.jsonencode({
+          Id: "example",
+          Statement: [
+            {
+              Action: "kms:*",
+              Effect: "Allow",
+              Principal: {
+                AWS: "*",
+              },
+              Resource: "*",
+              Sid: "Enable IAM User Permissions",
+            },
+          ],
+          Version: "2012-10-17",
+        })
+      ),
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsKmsKeyPolicyExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `keyId` - (Required) The ID of the KMS Key to attach the policy.
+* `policy` - (Required) A valid policy JSON document. Although this is a key policy, not an IAM policy, an [`awsIamPolicyDocument`](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document), in the form that designates a principal, can be used. For more information about building policy documents with Terraform, see the [AWS IAM Policy Document Guide](https://learn.hashicorp.com/terraform/aws/iam-policy).
+
+~> **NOTE:** Note: All KMS keys must have a key policy. If a key policy is not specified, or this resource is destroyed, AWS gives the KMS key a [default key policy](https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default) that gives all principals in the owning account unlimited access to all KMS operations for the key. This default key policy effectively delegates all access control to IAM policies and KMS grants.
+
+* `bypassPolicyLockoutSafetyCheck` - (Optional) A flag to indicate whether to bypass the key policy lockout safety check.
+Setting this value to true increases the risk that the KMS key becomes unmanageable. Do not set this value to true indiscriminately. If this value is set, and the resource is destroyed, a warning will be shown, and the resource will be removed from state.
+For more information, refer to the scenario in the [Default Key Policy](https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default-allow-root-enable-iam) section in the _AWS Key Management Service Developer Guide_.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import KMS Key Policies using the `keyId`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import KMS Key Policies using the `keyId`. For example:
+
+```console
+% terraform import aws_kms_key_policy.a 1234abcd-12ab-34cd-56ef-1234567890ab
+```
+
+<!-- cache-key: cdktf-0.18.0 input-93175acbae862906327f4f8a607a99ad40bcba6f894b59f1002cd44902d5932d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/kms_replica_external_key.html.markdown b/website/docs/cdktf/typescript/r/kms_replica_external_key.html.markdown
new file mode 100644
index 00000000000..e79f48096b5
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/kms_replica_external_key.html.markdown
@@ -0,0 +1,110 @@
+---
+subcategory: "KMS (Key Management)"
+layout: "aws"
+page_title: "AWS: aws_kms_replica_external_key"
+description: |-
+  Manages a KMS multi-Region replica key that uses external key material.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_kms_replica_external_key
+
+Manages a KMS multi-Region replica key that uses external key material.
+See the [AWS KMS Developer Guide](https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-import.html) for more information on importing key material into multi-Region keys.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { KmsExternalKey } from "./.gen/providers/aws/kms-external-key";
+import { KmsReplicaExternalKey } from "./.gen/providers/aws/kms-replica-external-key";
+import { AwsProvider } from "./.gen/providers/aws/provider";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const primary = new AwsProvider(this, "aws", {
+      alias: "primary",
+      region: "us-east-1",
+    });
+    new AwsProvider(this, "aws_1", {
+      region: "us-west-2",
+    });
+    new KmsExternalKey(this, "primary", {
+      deletionWindowInDays: 30,
+      description: "Multi-Region primary key",
+      enabled: true,
+      keyMaterialBase64: "...",
+      multiRegion: true,
+      provider: primary,
+    });
+    new KmsReplicaExternalKey(this, "replica", {
+      deletionWindowInDays: 7,
+      description: "Multi-Region replica key",
+      keyMaterialBase64: "...",
+      primaryKeyArn: Token.asString(awsKmsExternalPrimary.arn),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `bypassPolicyLockoutSafetyCheck` - (Optional) A flag to indicate whether to bypass the key policy lockout safety check.
+Setting this value to true increases the risk that the KMS key becomes unmanageable. Do not set this value to true indiscriminately.
+For more information, refer to the scenario in the [Default Key Policy](https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default-allow-root-enable-iam) section in the _AWS Key Management Service Developer Guide_.
+The default value is `false`.
+* `deletionWindowInDays` - (Optional) The waiting period, specified in number of days. After the waiting period ends, AWS KMS deletes the KMS key.
+If you specify a value, it must be between `7` and `30`, inclusive. If you do not specify a value, it defaults to `30`.
+* `description` - (Optional) A description of the KMS key.
+* `enabled` - (Optional) Specifies whether the replica key is enabled. Disabled KMS keys cannot be used in cryptographic operations. Keys pending import can only be `false`. Imported keys default to `true` unless expired.
+* `keyMaterialBase64` - (Optional) Base64 encoded 256-bit symmetric encryption key material to import. The KMS key is permanently associated with this key material. The same key material can be [reimported](https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html#reimport-key-material), but you cannot import different key material.
+* `policy` - (Optional) The key policy to attach to the KMS key. If you do not specify a key policy, AWS KMS attaches the [default key policy](https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default) to the KMS key.
+For more information about building policy documents with Terraform, see the [AWS IAM Policy Document Guide](https://learn.hashicorp.com/terraform/aws/iam-policy).
+* `primaryKeyArn` - (Required) The ARN of the multi-Region primary key to replicate. The primary key must be in a different AWS Region of the same AWS Partition. You can create only one replica of a given primary key in each AWS Region.
+* `tags` - (Optional) A map of tags to assign to the replica key. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `validTo` - (Optional) Time at which the imported key material expires. When the key material expires, AWS KMS deletes the key material and the key becomes unusable. If not specified, key material does not expire. Valid values: [RFC3339 time string](https://tools.ietf.org/html/rfc3339#section-5.8) (`yyyyMmDdthh:mm:ssz`)
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the replica key. The key ARNs of related multi-Region keys differ only in the Region value.
+* `expirationModel` - Whether the key material expires. Empty when pending key material import, otherwise `keyMaterialExpires` or `keyMaterialDoesNotExpire`.
+* `keyId` - The key ID of the replica key. Related multi-Region keys have the same key ID.
+* `keyState` - The state of the replica key.
+* `keyUsage` - The [cryptographic operations](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations) for which you can use the KMS key. This is a shared property of multi-Region keys.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import KMS multi-Region replica keys using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import KMS multi-Region replica keys using the `id`. For example:
+
+```console
+% terraform import aws_kms_replica_external_key.example 1234abcd-12ab-34cd-56ef-1234567890ab
+```
+
+<!-- cache-key: cdktf-0.18.0 input-7ff58560e5d333c365657d94a76f29c733a88f3ce8d3e119a8f1086138e57a7c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/kms_replica_key.html.markdown b/website/docs/cdktf/typescript/r/kms_replica_key.html.markdown
new file mode 100644
index 00000000000..4191912f120
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/kms_replica_key.html.markdown
@@ -0,0 +1,104 @@
+---
+subcategory: "KMS (Key Management)"
+layout: "aws"
+page_title: "AWS: aws_kms_replica_key"
+description: |-
+  Manages a KMS multi-Region replica key.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_kms_replica_key
+
+Manages a KMS multi-Region replica key.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { KmsKey } from "./.gen/providers/aws/kms-key";
+import { KmsReplicaKey } from "./.gen/providers/aws/kms-replica-key";
+import { AwsProvider } from "./.gen/providers/aws/provider";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const primary = new AwsProvider(this, "aws", {
+      alias: "primary",
+      region: "us-east-1",
+    });
+    new AwsProvider(this, "aws_1", {
+      region: "us-west-2",
+    });
+    const awsKmsKeyPrimary = new KmsKey(this, "primary", {
+      deletionWindowInDays: 30,
+      description: "Multi-Region primary key",
+      multiRegion: true,
+      provider: primary,
+    });
+    new KmsReplicaKey(this, "replica", {
+      deletionWindowInDays: 7,
+      description: "Multi-Region replica key",
+      primaryKeyArn: Token.asString(awsKmsKeyPrimary.arn),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `bypassPolicyLockoutSafetyCheck` - (Optional) A flag to indicate whether to bypass the key policy lockout safety check.
+Setting this value to true increases the risk that the KMS key becomes unmanageable. Do not set this value to true indiscriminately.
+For more information, refer to the scenario in the [Default Key Policy](https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default-allow-root-enable-iam) section in the _AWS Key Management Service Developer Guide_.
+The default value is `false`.
+* `deletionWindowInDays` - (Optional) The waiting period, specified in number of days. After the waiting period ends, AWS KMS deletes the KMS key.
+If you specify a value, it must be between `7` and `30`, inclusive. If you do not specify a value, it defaults to `30`.
+* `description` - (Optional) A description of the KMS key.
+* `enabled` - (Optional) Specifies whether the replica key is enabled. Disabled KMS keys cannot be used in cryptographic operations. The default value is `true`.
+* `policy` - (Optional) The key policy to attach to the KMS key. If you do not specify a key policy, AWS KMS attaches the [default key policy](https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default) to the KMS key.
+For more information about building policy documents with Terraform, see the [AWS IAM Policy Document Guide](https://learn.hashicorp.com/terraform/aws/iam-policy).
+* `primaryKeyArn` - (Required) The ARN of the multi-Region primary key to replicate. The primary key must be in a different AWS Region of the same AWS Partition. You can create only one replica of a given primary key in each AWS Region.
+* `tags` - (Optional) A map of tags to assign to the replica key. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the replica key. The key ARNs of related multi-Region keys differ only in the Region value.
+* `keyId` - The key ID of the replica key. Related multi-Region keys have the same key ID.
+* `keyRotationEnabled` - A Boolean value that specifies whether key rotation is enabled. This is a shared property of multi-Region keys.
+* `keySpec` - The type of key material in the KMS key. This is a shared property of multi-Region keys.
+* `keyUsage` - The [cryptographic operations](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#cryptographic-operations) for which you can use the KMS key. This is a shared property of multi-Region keys.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import KMS multi-Region replica keys using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import KMS multi-Region replica keys using the `id`. For example:
+
+```console
+% terraform import aws_kms_replica_key.example 1234abcd-12ab-34cd-56ef-1234567890ab
+```
+
+<!-- cache-key: cdktf-0.18.0 input-d9e0bf46edfbeab8b46e2d9e97a2d761d4db8938a03b29da3f959636cabf71c7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/lakeformation_data_lake_settings.html.markdown b/website/docs/cdktf/typescript/r/lakeformation_data_lake_settings.html.markdown
new file mode 100644
index 00000000000..4e1e86f802a
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/lakeformation_data_lake_settings.html.markdown
@@ -0,0 +1,149 @@
+---
+subcategory: "Lake Formation"
+layout: "aws"
+page_title: "AWS: aws_lakeformation_data_lake_settings"
+description: |-
+  Manages data lake administrators and default database and table permissions
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lakeformation_data_lake_settings
+
+Manages Lake Formation principals designated as data lake administrators and lists of principal permission entries for default create database and default create table permissions.
+
+~> **NOTE:** Lake Formation introduces fine-grained access control for data in your data lake. Part of the changes include the `iamAllowedPrincipals` principal in order to make Lake Formation backwards compatible with existing IAM and Glue permissions. For more information, see [Changing the Default Security Settings for Your Data Lake](https://docs.aws.amazon.com/lake-formation/latest/dg/change-settings.html) and [Upgrading AWS Glue Data Permissions to the AWS Lake Formation Model](https://docs.aws.amazon.com/lake-formation/latest/dg/upgrade-glue-lake-formation.html).
+
+## Example Usage
+
+### Data Lake Admins
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LakeformationDataLakeSettings } from "./.gen/providers/aws/lakeformation-data-lake-settings";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new LakeformationDataLakeSettings(this, "example", {
+      admins: [test.arn, Token.asString(awsIamRoleTest.arn)],
+    });
+  }
+}
+
+```
+
+### Create Default Permissions
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LakeformationDataLakeSettings } from "./.gen/providers/aws/lakeformation-data-lake-settings";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new LakeformationDataLakeSettings(this, "example", {
+      admins: [test.arn, Token.asString(awsIamRoleTest.arn)],
+      createDatabaseDefaultPermissions: [
+        {
+          permissions: ["SELECT", "ALTER", "DROP"],
+          principal: test.arn,
+        },
+      ],
+      createTableDefaultPermissions: [
+        {
+          permissions: ["ALL"],
+          principal: Token.asString(awsIamRoleTest.arn),
+        },
+      ],
+    });
+  }
+}
+
+```
+
+### Enable EMR access to LakeFormation resources
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LakeformationDataLakeSettings } from "./.gen/providers/aws/lakeformation-data-lake-settings";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new LakeformationDataLakeSettings(this, "example", {
+      admins: [test.arn, Token.asString(awsIamRoleTest.arn)],
+      allowExternalDataFiltering: true,
+      authorizedSessionTagValueList: ["Amazon EMR"],
+      createDatabaseDefaultPermissions: [
+        {
+          permissions: ["SELECT", "ALTER", "DROP"],
+          principal: test.arn,
+        },
+      ],
+      createTableDefaultPermissions: [
+        {
+          permissions: ["ALL"],
+          principal: Token.asString(awsIamRoleTest.arn),
+        },
+      ],
+      externalDataFilteringAllowList: [
+        Token.asString(current.accountId),
+        Token.asString(thirdParty.accountId),
+      ],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are optional:
+
+* `admins` – (Optional) Set of ARNs of AWS Lake Formation principals (IAM users or roles).
+* `readOnlyAdmins` – (Optional) Set of ARNs of AWS Lake Formation principals (IAM users or roles) with only view access to the resources.
+* `catalogId` – (Optional) Identifier for the Data Catalog. By default, the account ID.
+* `createDatabaseDefaultPermissions` - (Optional) Up to three configuration blocks of principal permissions for default create database permissions. Detailed below.
+* `createTableDefaultPermissions` - (Optional) Up to three configuration blocks of principal permissions for default create table permissions. Detailed below.
+* `trustedResourceOwners` – (Optional) List of the resource-owning account IDs that the caller's account can use to share their user access details (user ARNs).
+* `allowExternalDataFiltering` - (Optional) Whether to allow Amazon EMR clusters to access data managed by Lake Formation.
+* `externalDataFilteringAllowList` - (Optional) A list of the account IDs of Amazon Web Services accounts with Amazon EMR clusters that are to perform data filtering.
+* `authorizedSessionTagValueList` - (Optional) Lake Formation relies on a privileged process secured by Amazon EMR or the third party integrator to tag the user's role while assuming it.
+
+~> **NOTE:** Although optional, not including `admins`, `createDatabaseDefaultPermissions`, `createTableDefaultPermissions`, and/or `trustedResourceOwners` results in the setting being cleared.
+
+### create_database_default_permissions
+
+The following arguments are optional:
+
+* `permissions` - (Optional) List of permissions that are granted to the principal. Valid values may include `all`, `select`, `alter`, `drop`, `delete`, `insert`, `describe`, and `createTable`. For more details, see [Lake Formation Permissions Reference](https://docs.aws.amazon.com/lake-formation/latest/dg/lf-permissions-reference.html).
+* `principal` - (Optional) Principal who is granted permissions. To enforce metadata and underlying data access control only by IAM on new databases and tables set `principal` to `iamAllowedPrincipals` and `permissions` to `["all"]`.
+
+### create_table_default_permissions
+
+The following arguments are optional:
+
+* `permissions` - (Optional) List of permissions that are granted to the principal. Valid values may include `all`, `select`, `alter`, `drop`, `delete`, `insert`, and `describe`. For more details, see [Lake Formation Permissions Reference](https://docs.aws.amazon.com/lake-formation/latest/dg/lf-permissions-reference.html).
+* `principal` - (Optional) Principal who is granted permissions. To enforce metadata and underlying data access control only by IAM on new databases and tables set `principal` to `iamAllowedPrincipals` and `permissions` to `["all"]`.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+<!-- cache-key: cdktf-0.18.0 input-417a6f6da709dcf8d9f1bd94d43d2cf8836515780173f60b9dd4db641440c4d0 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/lakeformation_lf_tag.html.markdown b/website/docs/cdktf/typescript/r/lakeformation_lf_tag.html.markdown
new file mode 100644
index 00000000000..6ad02cdaaf0
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/lakeformation_lf_tag.html.markdown
@@ -0,0 +1,74 @@
+---
+subcategory: "Lake Formation"
+layout: "aws"
+page_title: "AWS: aws_lakeformation_lf_tag"
+description: |-
+    Creates a tag with the specified name and values.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lakeformation_lf_tag
+
+Creates an LF-Tag with the specified name and values. Each key must have at least one value. The maximum number of values permitted is 15.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LakeformationLfTag } from "./.gen/providers/aws/lakeformation-lf-tag";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new LakeformationLfTag(this, "example", {
+      key: "module",
+      values: ["Orders", "Sales", "Customers"],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `catalogId` - (Optional) ID of the Data Catalog to create the tag in. If omitted, this defaults to the AWS Account ID.
+* `key` - (Required) Key-name for the tag.
+* `values` - (Required) List of possible values an attribute can take.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Catalog ID and key-name of the tag
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Lake Formation LF-Tags using the `catalogId:key`. If you have not set a Catalog ID specify the AWS Account ID that the database is in. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Lake Formation LF-Tags using the `catalogId:key`. If you have not set a Catalog ID specify the AWS Account ID that the database is in. For example:
+
+```console
+% terraform import aws_lakeformation_lf_tag.example 123456789012:some_key
+```
+
+<!-- cache-key: cdktf-0.18.0 input-4f01d1c09d440237d766ec2a420e4ecbbbe63aaac04d99d046c18e4f145b3f8b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/lakeformation_permissions.html.markdown b/website/docs/cdktf/typescript/r/lakeformation_permissions.html.markdown
new file mode 100644
index 00000000000..8ac1a26aeda
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/lakeformation_permissions.html.markdown
@@ -0,0 +1,334 @@
+---
+subcategory: "Lake Formation"
+layout: "aws"
+page_title: "AWS: aws_lakeformation_permissions"
+description: |-
+    Grants permissions to the principal to access metadata in the Data Catalog and data organized in underlying data storage such as Amazon S3.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lakeformation_permissions
+
+Grants permissions to the principal to access metadata in the Data Catalog and data organized in underlying data storage such as Amazon S3. Permissions are granted to a principal, in a Data Catalog, relative to a Lake Formation resource, which includes the Data Catalog, databases, tables, LF-tags, and LF-tag policies. For more information, see [Security and Access Control to Metadata and Data in Lake Formation](https://docs.aws.amazon.com/lake-formation/latest/dg/security-data-access.html).
+
+!> **WARNING:** Lake Formation permissions are not in effect by default within AWS. Using this resource will not secure your data and will result in errors if you do not change the security settings for existing resources and the default security settings for new resources. See [Default Behavior and `iamAllowedPrincipals`](#default-behavior-and-iamallowedprincipals) for additional details.
+
+~> **NOTE:** In general, the `principal` should _NOT_ be a Lake Formation administrator or the entity (e.g., IAM role) that is running Terraform. Administrators have implicit permissions. These should be managed by granting or not granting administrator rights using `awsLakeformationDataLakeSettings`, _not_ with this resource.
+
+## Default Behavior and `iamAllowedPrincipals`
+
+**_Lake Formation permissions are not in effect by default within AWS._** `iamAllowedPrincipals` (i.e., `iamAllowedPrincipals`) conflicts with individual Lake Formation permissions (i.e., non-`iamAllowedPrincipals` permissions), will cause unexpected behavior, and may result in errors.
+
+When using Lake Formation, choose ONE of the following options as they are mutually exclusive:
+
+1. Use this resource (`awsLakeformationPermissions`), change the default security settings using [`awsLakeformationDataLakeSettings`](/docs/providers/aws/r/lakeformation_data_lake_settings.html), and remove existing `iamAllowedPrincipals` permissions
+2. Use `iamAllowedPrincipals` without `awsLakeformationPermissions`
+
+This example shows removing the `iamAllowedPrincipals` default security settings and making the caller a Lake Formation admin. Since `createDatabaseDefaultPermissions` and `createTableDefaultPermissions` are not set in the [`awsLakeformationDataLakeSettings`](/docs/providers/aws/r/lakeformation_data_lake_settings.html) resource, they are cleared.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCallerIdentity } from "./.gen/providers/aws/data-aws-caller-identity";
+import { DataAwsIamSessionContext } from "./.gen/providers/aws/data-aws-iam-session-context";
+import { LakeformationDataLakeSettings } from "./.gen/providers/aws/lakeformation-data-lake-settings";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const current = new DataAwsCallerIdentity(this, "current", {});
+    const dataAwsIamSessionContextCurrent = new DataAwsIamSessionContext(
+      this,
+      "current_1",
+      {
+        arn: Token.asString(current.arn),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsIamSessionContextCurrent.overrideLogicalId("current");
+    new LakeformationDataLakeSettings(this, "test", {
+      admins: [Token.asString(dataAwsIamSessionContextCurrent.issuerArn)],
+    });
+  }
+}
+
+```
+
+To remove existing `iamAllowedPrincipals` permissions, use the [AWS Lake Formation Console](https://console.aws.amazon.com/lakeformation/) or [AWS CLI](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/lakeformation/batch-revoke-permissions.html).
+
+`iamAllowedPrincipals` is a hook to maintain backwards compatibility with AWS Glue. `iamAllowedPrincipals` is a pseudo-entity group that acts like a Lake Formation principal. The group includes any IAM users and roles that are allowed access to your Data Catalog resources by your IAM policies.
+
+This is Lake Formation's default behavior:
+
+* Lake Formation grants `super` permission to `iamAllowedPrincipals` on all existing AWS Glue Data Catalog resources.
+* Lake Formation enables "Use only IAM access control" for new Data Catalog resources.
+
+For more details, see [Changing the Default Security Settings for Your Data Lake](https://docs.aws.amazon.com/lake-formation/latest/dg/change-settings.html).
+
+### Problem Using `iamAllowedPrincipals`
+
+AWS does not support combining `iamAllowedPrincipals` permissions and non-`iamAllowedPrincipals` permissions. Doing so results in unexpected permissions and behaviors. For example, this configuration grants a user `select` on a column in a table.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { GlueCatalogDatabase } from "./.gen/providers/aws/glue-catalog-database";
+import { GlueCatalogTable } from "./.gen/providers/aws/glue-catalog-table";
+import { LakeformationPermissions } from "./.gen/providers/aws/lakeformation-permissions";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new GlueCatalogDatabase(this, "example", {
+      name: "sadabate",
+    });
+    const awsGlueCatalogTableExample = new GlueCatalogTable(this, "example_1", {
+      databaseName: test.name,
+      name: "abelt",
+      storageDescriptor: {
+        columns: [
+          {
+            name: "event",
+            type: "string",
+          },
+        ],
+      },
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsGlueCatalogTableExample.overrideLogicalId("example");
+    const awsLakeformationPermissionsExample = new LakeformationPermissions(
+      this,
+      "example_2",
+      {
+        permissions: ["SELECT"],
+        principal: "arn:aws:iam:us-east-1:123456789012:user/SanHolo",
+        tableWithColumns: {
+          columnNames: ["event"],
+          databaseName: Token.asString(awsGlueCatalogTableExample.databaseName),
+          name: Token.asString(awsGlueCatalogTableExample.name),
+        },
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsLakeformationPermissionsExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+The resulting permissions depend on whether the table had `iamAllowedPrincipals` (IAP) permissions or not.
+
+| Result With IAP | Result Without IAP |
+| ---- | ---- |
+| `select` column wildcard (i.e., all columns) | `select` on `"event"` (as expected) |
+
+## Using Lake Formation Permissions
+
+Lake Formation grants implicit permissions to data lake administrators, database creators, and table creators. These implicit permissions cannot be revoked _per se_. If this resource reads implicit permissions, it will attempt to revoke them, which causes an error when the resource is destroyed.
+
+There are two ways to avoid these errors. First, and the way we recommend, is to avoid using this resource with principals that have implicit permissions. A second, error-prone option, is to grant explicit permissions (and `permissionsWithGrantOption`) to "overwrite" a principal's implicit permissions, which you can then revoke with this resource. For more information, see [Implicit Lake Formation Permissions](https://docs.aws.amazon.com/lake-formation/latest/dg/implicit-permissions.html).
+
+If the `principal` is also a data lake administrator, AWS grants implicit permissions that can cause errors using this resource. For example, AWS implicitly grants a `principal`/administrator `permissions` and `permissionsWithGrantOption` of `all`, `alter`, `delete`, `describe`, `drop`, `insert`, and `select` on a table. If you use this resource to explicitly grant the `principal`/administrator `permissions` but _not_ `permissionsWithGrantOption` of `all`, `alter`, `delete`, `describe`, `drop`, `insert`, and `select` on the table, this resource will read the implicit `permissionsWithGrantOption` and attempt to revoke them when the resource is destroyed. Doing so will cause an `InvalidInputException: No permissions revoked` error because you cannot revoke implicit permissions _per se_. To workaround this problem, explicitly grant the `principal`/administrator `permissions` _and_ `permissionsWithGrantOption`, which can then be revoked. Similarly, granting a `principal`/administrator permissions on a table with columns and providing `columnNames`, will result in a `InvalidInputException: Permissions modification is invalid` error because you are narrowing the implicit permissions. Instead, set `wildcard` to `true` and remove the `columnNames`.
+
+## Example Usage
+
+### Grant Permissions For A Lake Formation S3 Resource
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LakeformationPermissions } from "./.gen/providers/aws/lakeformation-permissions";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new LakeformationPermissions(this, "example", {
+      dataLocation: {
+        arn: Token.asString(awsLakeformationResourceExample.arn),
+      },
+      permissions: ["ALL"],
+      principal: workflowRole.arn,
+    });
+  }
+}
+
+```
+
+### Grant Permissions For A Glue Catalog Database
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LakeformationPermissions } from "./.gen/providers/aws/lakeformation-permissions";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new LakeformationPermissions(this, "example", {
+      database: {
+        catalogId: "110376042874",
+        name: Token.asString(awsGlueCatalogDatabaseExample.name),
+      },
+      permissions: ["CREATE_TABLE", "ALTER", "DROP"],
+      principal: workflowRole.arn,
+    });
+  }
+}
+
+```
+
+### Grant Permissions Using Tag-Based Access Control
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LakeformationPermissions } from "./.gen/providers/aws/lakeformation-permissions";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new LakeformationPermissions(this, "test", {
+      lfTagPolicy: {
+        expression: [
+          {
+            key: "Team",
+            values: ["Sales"],
+          },
+          {
+            key: "Environment",
+            values: ["Dev", "Production"],
+          },
+        ],
+        resourceType: "DATABASE",
+      },
+      permissions: ["CREATE_TABLE", "ALTER", "DROP"],
+      principal: salesRole.arn,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `permissions` – (Required) List of permissions granted to the principal. Valid values may include `all`, `alter`, `associate`, `createDatabase`, `createTable`, `dataLocationAccess`, `delete`, `describe`, `drop`, `insert`, and `select`. For details on each permission, see [Lake Formation Permissions Reference](https://docs.aws.amazon.com/lake-formation/latest/dg/lf-permissions-reference.html).
+* `principal` – (Required) Principal to be granted the permissions on the resource. Supported principals include `iamAllowedPrincipals` (see [Default Behavior and `iamAllowedPrincipals`](#default-behavior-and-iamallowedprincipals) above), IAM roles, users, groups, SAML groups and users, QuickSight groups, OUs, and organizations as well as AWS account IDs for cross-account permissions. For more information, see [Lake Formation Permissions Reference](https://docs.aws.amazon.com/lake-formation/latest/dg/lf-permissions-reference.html).
+
+~> **NOTE:** We highly recommend that the `principal` _NOT_ be a Lake Formation administrator (granted using `awsLakeformationDataLakeSettings`). The entity (e.g., IAM role) running Terraform will most likely need to be a Lake Formation administrator. As such, the entity will have implicit permissions and does not need permissions granted through this resource.
+
+One of the following is required:
+
+* `catalogResource` - (Optional) Whether the permissions are to be granted for the Data Catalog. Defaults to `false`.
+* `dataLocation` - (Optional) Configuration block for a data location resource. Detailed below.
+* `database` - (Optional) Configuration block for a database resource. Detailed below.
+* `lfTag` - (Optional) Configuration block for an LF-tag resource. Detailed below.
+* `lfTagPolicy` - (Optional) Configuration block for an LF-tag policy resource. Detailed below.
+* `table` - (Optional) Configuration block for a table resource. Detailed below.
+* `tableWithColumns` - (Optional) Configuration block for a table with columns resource. Detailed below.
+
+The following arguments are optional:
+
+* `catalogId` – (Optional) Identifier for the Data Catalog. By default, the account ID. The Data Catalog is the persistent metadata store. It contains database definitions, table definitions, and other control information to manage your Lake Formation environment.
+* `permissionsWithGrantOption` - (Optional) Subset of `permissions` which the principal can pass.
+
+### data_location
+
+The following argument is required:
+
+* `arn` – (Required) Amazon Resource Name (ARN) that uniquely identifies the data location resource.
+
+The following argument is optional:
+
+* `catalogId` - (Optional) Identifier for the Data Catalog where the location is registered with Lake Formation. By default, it is the account ID of the caller.
+
+### database
+
+The following argument is required:
+
+* `name` – (Required) Name of the database resource. Unique to the Data Catalog.
+
+The following argument is optional:
+
+* `catalogId` - (Optional) Identifier for the Data Catalog. By default, it is the account ID of the caller.
+
+### lf_tag
+
+The following arguments are required:
+
+* `key` – (Required) The key-name for the tag.
+* `values` - (Required) A list of possible values an attribute can take.
+
+The following argument is optional:
+
+* `catalogId` - (Optional) Identifier for the Data Catalog. By default, it is the account ID of the caller.
+
+### lf_tag_policy
+
+The following arguments are required:
+
+* `resourceType` – (Required) The resource type for which the tag policy applies. Valid values are `database` and `table`.
+* `expression` - (Required) A list of tag conditions that apply to the resource's tag policy. Configuration block for tag conditions that apply to the policy. See [`expression`](#expression) below.
+
+The following argument is optional:
+
+* `catalogId` - (Optional) Identifier for the Data Catalog. By default, it is the account ID of the caller.
+
+#### expression
+
+* `key` – (Required) The key-name of an LF-Tag.
+* `values` - (Required) A list of possible values of an LF-Tag.
+
+### table
+
+The following argument is required:
+
+* `databaseName` – (Required) Name of the database for the table. Unique to a Data Catalog.
+* `name` - (Required, at least one of `name` or `wildcard`) Name of the table.
+* `wildcard` - (Required, at least one of `name` or `wildcard`) Whether to use a wildcard representing every table under a database. Defaults to `false`.
+
+The following arguments are optional:
+
+* `catalogId` - (Optional) Identifier for the Data Catalog. By default, it is the account ID of the caller.
+
+### table_with_columns
+
+The following arguments are required:
+
+* `columnNames` - (Required, at least one of `columnNames` or `wildcard`) Set of column names for the table.
+* `databaseName` – (Required) Name of the database for the table with columns resource. Unique to the Data Catalog.
+* `name` – (Required) Name of the table resource.
+* `wildcard` - (Required, at least one of `columnNames` or `wildcard`) Whether to use a column wildcard. If `excludedColumnNames` is included, `wildcard` must be set to `true` to avoid Terraform reporting a difference.
+
+The following arguments are optional:
+
+* `catalogId` - (Optional) Identifier for the Data Catalog. By default, it is the account ID of the caller.
+* `excludedColumnNames` - (Optional) Set of column names for the table to exclude. If `excludedColumnNames` is included, `wildcard` must be set to `true` to avoid Terraform reporting a difference.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+<!-- cache-key: cdktf-0.18.0 input-fd78e0884a6908a814356ab7d33f0f75b98fe926eb713d3c171ff4fd77586027 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/lakeformation_resource.html.markdown b/website/docs/cdktf/typescript/r/lakeformation_resource.html.markdown
new file mode 100644
index 00000000000..76f0bb65044
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/lakeformation_resource.html.markdown
@@ -0,0 +1,62 @@
+---
+subcategory: "Lake Formation"
+layout: "aws"
+page_title: "AWS: aws_lakeformation_resource"
+description: |-
+  Registers a Lake Formation resource as managed by the Data Catalog.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lakeformation_resource
+
+Registers a Lake Formation resource (e.g., S3 bucket) as managed by the Data Catalog. In other words, the S3 path is added to the data lake.
+
+Choose a role that has read/write access to the chosen Amazon S3 path or use the service-linked role. When you register the S3 path, the service-linked role and a new inline policy are created on your behalf. Lake Formation adds the first path to the inline policy and attaches it to the service-linked role. When you register subsequent paths, Lake Formation adds the path to the existing policy.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsS3Bucket } from "./.gen/providers/aws/data-aws-s3-bucket";
+import { LakeformationResource } from "./.gen/providers/aws/lakeformation-resource";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new DataAwsS3Bucket(this, "example", {
+      bucket: "an-example-bucket",
+    });
+    const awsLakeformationResourceExample = new LakeformationResource(
+      this,
+      "example_1",
+      {
+        arn: Token.asString(example.arn),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsLakeformationResourceExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+* `arn` – (Required) Amazon Resource Name (ARN) of the resource, an S3 path.
+* `roleArn` – (Optional) Role that has read/write access to the resource. If not provided, the Lake Formation service-linked role must exist and is used.
+
+~> **NOTE:** AWS does not support registering an S3 location with an IAM role and subsequently updating the S3 location registration to a service-linked role.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `lastModified` - (Optional) The date and time the resource was last modified in [RFC 3339 format](https://tools.ietf.org/html/rfc3339#section-5.8).
+
+<!-- cache-key: cdktf-0.18.0 input-13bd8e71cdf5fa3e7a18a3d1a2e20ff12ed7d291e84a336a056ad1006100d7f8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/lakeformation_resource_lf_tags.html.markdown b/website/docs/cdktf/typescript/r/lakeformation_resource_lf_tags.html.markdown
new file mode 100644
index 00000000000..b0bd2c04c5a
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/lakeformation_resource_lf_tags.html.markdown
@@ -0,0 +1,194 @@
+---
+subcategory: "Lake Formation"
+layout: "aws"
+page_title: "AWS: aws_lakeformation_resource_lf_tags"
+description: |-
+    Manages an attachment between one or more LF-tags and an existing Lake Formation resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lakeformation_resource_lf_tags
+
+Manages an attachment between one or more existing LF-tags and an existing Lake Formation resource.
+
+## Example Usage
+
+### Database Example
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LakeformationLfTag } from "./.gen/providers/aws/lakeformation-lf-tag";
+import { LakeformationResourceLfTags } from "./.gen/providers/aws/lakeformation-resource-lf-tags";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new LakeformationLfTag(this, "example", {
+      key: "right",
+      values: [
+        "abbey",
+        "village",
+        "luffield",
+        "woodcote",
+        "copse",
+        "chapel",
+        "stowe",
+        "club",
+      ],
+    });
+    const awsLakeformationResourceLfTagsExample =
+      new LakeformationResourceLfTags(this, "example_1", {
+        database: {
+          name: Token.asString(awsGlueCatalogDatabaseExample.name),
+        },
+        lfTag: [
+          {
+            key: example.key,
+            value: "stowe",
+          },
+        ],
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsLakeformationResourceLfTagsExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### Multiple Tags Example
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LakeformationLfTag } from "./.gen/providers/aws/lakeformation-lf-tag";
+import { LakeformationResourceLfTags } from "./.gen/providers/aws/lakeformation-resource-lf-tags";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new LakeformationLfTag(this, "example", {
+      key: "right",
+      values: [
+        "abbey",
+        "village",
+        "luffield",
+        "woodcote",
+        "copse",
+        "chapel",
+        "stowe",
+        "club",
+      ],
+    });
+    new LakeformationLfTag(this, "example2", {
+      key: "left",
+      values: [
+        "farm",
+        "theloop",
+        "aintree",
+        "brooklands",
+        "maggotts",
+        "becketts",
+        "vale",
+      ],
+    });
+    const awsLakeformationResourceLfTagsExample =
+      new LakeformationResourceLfTags(this, "example_2", {
+        database: {
+          name: Token.asString(awsGlueCatalogDatabaseExample.name),
+        },
+        lfTag: [
+          {
+            key: "right",
+            value: "luffield",
+          },
+          {
+            key: "left",
+            value: "aintree",
+          },
+        ],
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsLakeformationResourceLfTagsExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `lfTag` – (Required) Set of LF-tags to attach to the resource. See below.
+
+Exactly one of the following is required:
+
+* `database` - (Optional) Configuration block for a database resource. See below.
+* `table` - (Optional) Configuration block for a table resource. See below.
+* `tableWithColumns` - (Optional) Configuration block for a table with columns resource. See below.
+
+The following arguments are optional:
+
+* `catalogId` – (Optional) Identifier for the Data Catalog. By default, the account ID. The Data Catalog is the persistent metadata store. It contains database definitions, table definitions, and other control information to manage your Lake Formation environment.
+
+### lf_tag
+
+The following arguments are required:
+
+* `key` – (Required) Key name for an existing LF-tag.
+* `value` - (Required) Value from the possible values for the LF-tag.
+
+The following argument is optional:
+
+* `catalogId` - (Optional) Identifier for the Data Catalog. By default, it is the account ID of the caller.
+
+### database
+
+The following argument is required:
+
+* `name` – (Required) Name of the database resource. Unique to the Data Catalog.
+
+The following argument is optional:
+
+* `catalogId` - (Optional) Identifier for the Data Catalog. By default, it is the account ID of the caller.
+
+### table
+
+The following argument is required:
+
+* `databaseName` – (Required) Name of the database for the table. Unique to a Data Catalog.
+* `name` - (Required, at least one of `name` or `wildcard`) Name of the table.
+* `wildcard` - (Required, at least one of `name` or `wildcard`) Whether to use a wildcard representing every table under a database. Defaults to `false`.
+
+The following arguments are optional:
+
+* `catalogId` - (Optional) Identifier for the Data Catalog. By default, it is the account ID of the caller.
+
+### table_with_columns
+
+The following arguments are required:
+
+* `columnNames` - (Required, at least one of `columnNames` or `wildcard`) Set of column names for the table.
+* `databaseName` – (Required) Name of the database for the table with columns resource. Unique to the Data Catalog.
+* `name` – (Required) Name of the table resource.
+* `wildcard` - (Required, at least one of `columnNames` or `wildcard`) Whether to use a column wildcard. If `excludedColumnNames` is included, `wildcard` must be set to `true` to avoid Terraform reporting a difference.
+
+The following arguments are optional:
+
+* `catalogId` - (Optional) Identifier for the Data Catalog. By default, it is the account ID of the caller.
+* `excludedColumnNames` - (Optional) Set of column names for the table to exclude. If `excludedColumnNames` is included, `wildcard` must be set to `true` to avoid Terraform reporting a difference.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+<!-- cache-key: cdktf-0.18.0 input-c545a08beff672f6286efb5bcffb1247151c3c8aba0ba2aa227296062430ce8a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/lambda_alias.html.markdown b/website/docs/cdktf/typescript/r/lambda_alias.html.markdown
new file mode 100644
index 00000000000..dee101687d0
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/lambda_alias.html.markdown
@@ -0,0 +1,93 @@
+---
+subcategory: "Lambda"
+layout: "aws"
+page_title: "AWS: aws_lambda_alias"
+description: |-
+  Creates a Lambda function alias.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lambda_alias
+
+Creates a Lambda function alias. Creates an alias that points to the specified Lambda function version.
+
+For information about Lambda and how to use it, see [What is AWS Lambda?][1]
+For information about function aliases, see [CreateAlias][2] and [AliasRoutingConfiguration][3] in the API docs.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LambdaAlias } from "./.gen/providers/aws/lambda-alias";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new LambdaAlias(this, "test_lambda_alias", {
+      description: "a sample description",
+      functionName: lambdaFunctionTest.arn,
+      functionVersion: "1",
+      name: "my_alias",
+      routingConfig: {
+        additionalVersionWeights: {
+          2: 0.5,
+        },
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `name` - (Required) Name for the alias you are creating. Pattern: `(?!^[09]+$)([aZAZ09_]+)`
+* `description` - (Optional) Description of the alias.
+* `functionName` - (Required) Lambda Function name or ARN.
+* `functionVersion` - (Required) Lambda function version for which you are creating the alias. Pattern: `(\$latest|[09]+)`.
+* `routingConfig` - (Optional) The Lambda alias' route configuration settings. Fields documented below
+
+`routingConfig` supports the following arguments:
+
+* `additionalVersionWeights` - (Optional) A map that defines the proportion of events that should be sent to different versions of a lambda function.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) identifying your Lambda function alias.
+* `invokeArn` - The ARN to be used for invoking Lambda Function from API Gateway - to be used in [`awsApiGatewayIntegration`](/docs/providers/aws/r/api_gateway_integration.html)'s `uri`
+
+[1]: http://docs.aws.amazon.com/lambda/latest/dg/welcome.html
+[2]: http://docs.aws.amazon.com/lambda/latest/dg/API_CreateAlias.html
+[3]: https://docs.aws.amazon.com/lambda/latest/dg/API_AliasRoutingConfiguration.html
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Lambda Function Aliases using the `functionName/alias`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Lambda Function Aliases using the `functionName/alias`. For example:
+
+```console
+% terraform import aws_lambda_alias.test_lambda_alias my_test_lambda_function/my_alias
+```
+
+<!-- cache-key: cdktf-0.18.0 input-8fb769e7276158548fab5fb93af4f2a28e9364558792a79cc5b94ffb6bf2c452 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/lambda_code_signing_config.html.markdown b/website/docs/cdktf/typescript/r/lambda_code_signing_config.html.markdown
new file mode 100644
index 00000000000..d17d47a255a
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/lambda_code_signing_config.html.markdown
@@ -0,0 +1,91 @@
+---
+subcategory: "Lambda"
+layout: "aws"
+page_title: "AWS: aws_lambda_code_signing_config"
+description: |-
+  Provides a Lambda Code Signing Config resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lambda_code_signing_config
+
+Provides a Lambda Code Signing Config resource. A code signing configuration defines a list of allowed signing profiles and defines the code-signing validation policy (action to be taken if deployment validation checks fail).
+
+For information about Lambda code signing configurations and how to use them, see [configuring code signing for Lambda functions][1]
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LambdaCodeSigningConfig } from "./.gen/providers/aws/lambda-code-signing-config";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new LambdaCodeSigningConfig(this, "new_csc", {
+      allowedPublishers: {
+        signingProfileVersionArns: [example1.arn, example2.arn],
+      },
+      description: "My awesome code signing config.",
+      policies: {
+        untrustedArtifactOnDeployment: "Warn",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `allowedPublishers` (Required) A configuration block of allowed publishers as signing profiles for this code signing configuration. Detailed below.
+* `policies` (Optional) A configuration block of code signing policies that define the actions to take if the validation checks fail. Detailed below.
+* `description` - (Optional) Descriptive name for this code signing configuration.
+
+The `allowedPublishers` block supports the following argument:
+
+* `signingProfileVersionArns` - (Required) The Amazon Resource Name (ARN) for each of the signing profiles. A signing profile defines a trusted user who can sign a code package.
+
+The `policies` block supports the following argument:
+
+* `untrustedArtifactOnDeployment` - (Required) Code signing configuration policy for deployment validation failure. If you set the policy to Enforce, Lambda blocks the deployment request if code-signing validation checks fail. If you set the policy to Warn, Lambda allows the deployment and creates a CloudWatch log. Valid values: `warn`, `enforce`. Default value: `warn`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the code signing configuration.
+* `configId` - Unique identifier for the code signing configuration.
+* `lastModified` - The date and time that the code signing configuration was last modified.
+
+[1]: https://docs.aws.amazon.com/lambda/latest/dg/configuration-codesigning.html
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Code Signing Configs using their ARN. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Code Signing Configs using their ARN. For example:
+
+```console
+% terraform import aws_lambda_code_signing_config.imported_csc arn:aws:lambda:us-west-2:123456789012:code-signing-config:csc-0f6c334abcdea4d8b
+```
+
+<!-- cache-key: cdktf-0.18.0 input-b27a1e90446049f7c1773fd983c1f96949a20ac313e28f81bd237fd17f96c857 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/lambda_event_source_mapping.html.markdown b/website/docs/cdktf/typescript/r/lambda_event_source_mapping.html.markdown
new file mode 100644
index 00000000000..9946f53dd60
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/lambda_event_source_mapping.html.markdown
@@ -0,0 +1,374 @@
+---
+subcategory: "Lambda"
+layout: "aws"
+page_title: "AWS: aws_lambda_event_source_mapping"
+description: |-
+  Provides a Lambda event source mapping. This allows Lambda functions to get events from Kinesis, DynamoDB, SQS, Amazon MQ and Managed Streaming for Apache Kafka (MSK).
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lambda_event_source_mapping
+
+Provides a Lambda event source mapping. This allows Lambda functions to get events from Kinesis, DynamoDB, SQS, Amazon MQ and Managed Streaming for Apache Kafka (MSK).
+
+For information about Lambda and how to use it, see [What is AWS Lambda?][1].
+For information about event source mappings, see [CreateEventSourceMapping][2] in the API docs.
+
+## Example Usage
+
+### DynamoDB
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LambdaEventSourceMapping } from "./.gen/providers/aws/lambda-event-source-mapping";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new LambdaEventSourceMapping(this, "example", {
+      eventSourceArn: Token.asString(awsDynamodbTableExample.streamArn),
+      functionName: Token.asString(awsLambdaFunctionExample.arn),
+      startingPosition: "LATEST",
+    });
+  }
+}
+
+```
+
+### Kinesis
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LambdaEventSourceMapping } from "./.gen/providers/aws/lambda-event-source-mapping";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new LambdaEventSourceMapping(this, "example", {
+      eventSourceArn: Token.asString(awsKinesisStreamExample.arn),
+      functionName: Token.asString(awsLambdaFunctionExample.arn),
+      startingPosition: "LATEST",
+    });
+  }
+}
+
+```
+
+### Managed Streaming for Apache Kafka (MSK)
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LambdaEventSourceMapping } from "./.gen/providers/aws/lambda-event-source-mapping";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new LambdaEventSourceMapping(this, "example", {
+      eventSourceArn: Token.asString(awsMskClusterExample.arn),
+      functionName: Token.asString(awsLambdaFunctionExample.arn),
+      startingPosition: "TRIM_HORIZON",
+      topics: ["Example"],
+    });
+  }
+}
+
+```
+
+### Self Managed Apache Kafka
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LambdaEventSourceMapping } from "./.gen/providers/aws/lambda-event-source-mapping";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new LambdaEventSourceMapping(this, "example", {
+      functionName: Token.asString(awsLambdaFunctionExample.arn),
+      selfManagedEventSource: {
+        endpoints: {
+          KAFKA_BOOTSTRAP_SERVERS:
+            "kafka1.example.com:9092,kafka2.example.com:9092",
+        },
+      },
+      sourceAccessConfiguration: [
+        {
+          type: "VPC_SUBNET",
+          uri: "subnet:subnet-example1",
+        },
+        {
+          type: "VPC_SUBNET",
+          uri: "subnet:subnet-example2",
+        },
+        {
+          type: "VPC_SECURITY_GROUP",
+          uri: "security_group:sg-example",
+        },
+      ],
+      startingPosition: "TRIM_HORIZON",
+      topics: ["Example"],
+    });
+  }
+}
+
+```
+
+### SQS
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LambdaEventSourceMapping } from "./.gen/providers/aws/lambda-event-source-mapping";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new LambdaEventSourceMapping(this, "example", {
+      eventSourceArn: sqsQueueTest.arn,
+      functionName: Token.asString(awsLambdaFunctionExample.arn),
+    });
+  }
+}
+
+```
+
+### SQS with event filter
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LambdaEventSourceMapping } from "./.gen/providers/aws/lambda-event-source-mapping";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new LambdaEventSourceMapping(this, "example", {
+      eventSourceArn: sqsQueueTest.arn,
+      filterCriteria: {
+        filter: [
+          {
+            pattern: Token.asString(
+              Fn.jsonencode({
+                body: {
+                  Location: ["New York"],
+                  Temperature: [
+                    {
+                      numeric: [">", 0, "<=", 100],
+                    },
+                  ],
+                },
+              })
+            ),
+          },
+        ],
+      },
+      functionName: Token.asString(awsLambdaFunctionExample.arn),
+    });
+  }
+}
+
+```
+
+### Amazon MQ (ActiveMQ)
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LambdaEventSourceMapping } from "./.gen/providers/aws/lambda-event-source-mapping";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new LambdaEventSourceMapping(this, "example", {
+      batchSize: 10,
+      enabled: true,
+      eventSourceArn: Token.asString(awsMqBrokerExample.arn),
+      functionName: Token.asString(awsLambdaFunctionExample.arn),
+      queues: ["example"],
+      sourceAccessConfiguration: [
+        {
+          type: "BASIC_AUTH",
+          uri: Token.asString(awsSecretsmanagerSecretVersionExample.arn),
+        },
+      ],
+    });
+  }
+}
+
+```
+
+### Amazon MQ (RabbitMQ)
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LambdaEventSourceMapping } from "./.gen/providers/aws/lambda-event-source-mapping";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new LambdaEventSourceMapping(this, "example", {
+      batchSize: 1,
+      enabled: true,
+      eventSourceArn: Token.asString(awsMqBrokerExample.arn),
+      functionName: Token.asString(awsLambdaFunctionExample.arn),
+      queues: ["example"],
+      sourceAccessConfiguration: [
+        {
+          type: "VIRTUAL_HOST",
+          uri: "/example",
+        },
+        {
+          type: "BASIC_AUTH",
+          uri: Token.asString(awsSecretsmanagerSecretVersionExample.arn),
+        },
+      ],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `amazonManagedKafkaEventSourceConfig` - (Optional) Additional configuration block for Amazon Managed Kafka sources. Incompatible with "self_managed_event_source" and "self_managed_kafka_event_source_config". Detailed below.
+* `batchSize` - (Optional) The largest number of records that Lambda will retrieve from your event source at the time of invocation. Defaults to `100` for DynamoDB, Kinesis, MQ and MSK, `10` for SQS.
+* `bisectBatchOnFunctionError`: - (Optional) If the function returns an error, split the batch in two and retry. Only available for stream sources (DynamoDB and Kinesis). Defaults to `false`.
+* `destinationConfig`: - (Optional) An Amazon SQS queue or Amazon SNS topic destination for failed records. Only available for stream sources (DynamoDB and Kinesis). Detailed below.
+* `documentDbEventSourceConfig`: - (Optional) Configuration settings for a DocumentDB event source. Detailed below.
+* `enabled` - (Optional) Determines if the mapping will be enabled on creation. Defaults to `true`.
+* `eventSourceArn` - (Optional) The event source ARN - this is required for Kinesis stream, DynamoDB stream, SQS queue, MQ broker, MSK cluster or DocumentDB change stream.  It is incompatible with a Self Managed Kafka source.
+* `filterCriteria` - (Optional) The criteria to use for [event filtering](https://docs.aws.amazon.com/lambda/latest/dg/invocation-eventfiltering.html) Kinesis stream, DynamoDB stream, SQS queue event sources. Detailed below.
+* `functionName` - (Required) The name or the ARN of the Lambda function that will be subscribing to events.
+* `functionResponseTypes` - (Optional) A list of current response type enums applied to the event source mapping for [AWS Lambda checkpointing](https://docs.aws.amazon.com/lambda/latest/dg/with-ddb.html#services-ddb-batchfailurereporting). Only available for SQS and stream sources (DynamoDB and Kinesis). Valid values: `reportBatchItemFailures`.
+* `maximumBatchingWindowInSeconds` - (Optional) The maximum amount of time to gather records before invoking the function, in seconds (between 0 and 300). Records will continue to buffer (or accumulate in the case of an SQS queue event source) until either `maximumBatchingWindowInSeconds` expires or `batchSize` has been met. For streaming event sources, defaults to as soon as records are available in the stream. If the batch it reads from the stream/queue only has one record in it, Lambda only sends one record to the function. Only available for stream sources (DynamoDB and Kinesis) and SQS standard queues.
+* `maximumRecordAgeInSeconds`: - (Optional) The maximum age of a record that Lambda sends to a function for processing. Only available for stream sources (DynamoDB and Kinesis). Must be either -1 (forever, and the default value) or between 60 and 604800 (inclusive).
+* `maximumRetryAttempts`: - (Optional) The maximum number of times to retry when the function returns an error. Only available for stream sources (DynamoDB and Kinesis). Minimum and default of -1 (forever), maximum of 10000.
+* `parallelizationFactor`: - (Optional) The number of batches to process from each shard concurrently. Only available for stream sources (DynamoDB and Kinesis). Minimum and default of 1, maximum of 10.
+* `queues` - (Optional) The name of the Amazon MQ broker destination queue to consume. Only available for MQ sources. The list must contain exactly one queue name.
+* `scalingConfig` - (Optional) Scaling configuration of the event source. Only available for SQS queues. Detailed below.
+* `selfManagedEventSource`: - (Optional) For Self Managed Kafka sources, the location of the self managed cluster. If set, configuration must also include `sourceAccessConfiguration`. Detailed below.
+* `selfManagedKafkaEventSourceConfig` - (Optional) Additional configuration block for Self Managed Kafka sources. Incompatible with "event_source_arn" and "amazon_managed_kafka_event_source_config". Detailed below.
+* `sourceAccessConfiguration`: (Optional) For Self Managed Kafka sources, the access configuration for the source. If set, configuration must also include `selfManagedEventSource`. Detailed below.
+* `startingPosition` - (Optional) The position in the stream where AWS Lambda should start reading. Must be one of `atTimestamp` (Kinesis only), `latest` or `trimHorizon` if getting events from Kinesis, DynamoDB, MSK or Self Managed Apache Kafka. Must not be provided if getting events from SQS. More information about these positions can be found in the [AWS DynamoDB Streams API Reference](https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_streams_GetShardIterator.html) and [AWS Kinesis API Reference](https://docs.aws.amazon.com/kinesis/latest/APIReference/API_GetShardIterator.html#Kinesis-GetShardIterator-request-ShardIteratorType).
+* `startingPositionTimestamp` - (Optional) A timestamp in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8) of the data record which to start reading when using `startingPosition` set to `atTimestamp`. If a record with this exact timestamp does not exist, the next later record is chosen. If the timestamp is older than the current trim horizon, the oldest available record is chosen.
+* `topics` - (Optional) The name of the Kafka topics. Only available for MSK sources. A single topic name must be specified.
+* `tumblingWindowInSeconds` - (Optional) The duration in seconds of a processing window for [AWS Lambda streaming analytics](https://docs.aws.amazon.com/lambda/latest/dg/with-kinesis.html#services-kinesis-windows). The range is between 1 second up to 900 seconds. Only available for stream sources (DynamoDB and Kinesis).
+
+### amazon_managed_kafka_event_source_config Configuration Block
+
+* `consumerGroupId` - (Optional) A Kafka consumer group ID between 1 and 200 characters for use when creating this event source mapping. If one is not specified, this value will be automatically generated. See [AmazonManagedKafkaEventSourceConfig Syntax](https://docs.aws.amazon.com/lambda/latest/dg/API_AmazonManagedKafkaEventSourceConfig.html).
+
+### destination_config Configuration Block
+
+* `onFailure` - (Optional) The destination configuration for failed invocations. Detailed below.
+
+#### destination_config on_failure Configuration Block
+
+* `destinationArn` - (Required) The Amazon Resource Name (ARN) of the destination resource.
+
+### document_db_event_source_config Configuration Block
+
+* `collectionName` - (Optional) The name of the collection to consume within the database. If you do not specify a collection, Lambda consumes all collections.
+* `databaseName` - (Required) The name of the database to consume within the DocumentDB cluster.
+* `fullDocument` - (Optional) Determines what DocumentDB sends to your event stream during document update operations. If set to `updateLookup`, DocumentDB sends a delta describing the changes, along with a copy of the entire document. Otherwise, DocumentDB sends only a partial document that contains the changes. Valid values: `updateLookup`, `default`.
+
+### filter_criteria Configuration Block
+
+* `filter` - (Optional) A set of up to 5 filter. If an event satisfies at least one, Lambda sends the event to the function or adds it to the next batch. Detailed below.
+
+#### filter_criteria filter Configuration Block
+
+* `pattern` - (Optional) A filter pattern up to 4096 characters. See [Filter Rule Syntax](https://docs.aws.amazon.com/lambda/latest/dg/invocation-eventfiltering.html#filtering-syntax).
+
+### scaling_config Configuration Block
+
+* `maximumConcurrency` - (Optional) Limits the number of concurrent instances that the Amazon SQS event source can invoke. Must be between `2` and `1000`. See [Configuring maximum concurrency for Amazon SQS event sources](https://docs.aws.amazon.com/lambda/latest/dg/with-sqs.html#events-sqs-max-concurrency).
+
+### self_managed_event_source Configuration Block
+
+* `endpoints` - (Required) A map of endpoints for the self managed source.  For Kafka self-managed sources, the key should be `kafkaBootstrapServers` and the value should be a string with a comma separated list of broker endpoints.
+
+### self_managed_kafka_event_source_config Configuration Block
+
+* `consumerGroupId` - (Optional) A Kafka consumer group ID between 1 and 200 characters for use when creating this event source mapping. If one is not specified, this value will be automatically generated. See [SelfManagedKafkaEventSourceConfig Syntax](https://docs.aws.amazon.com/lambda/latest/dg/API_SelfManagedKafkaEventSourceConfig.html).
+
+### source_access_configuration Configuration Block
+
+* `type` - (Required) The type of this configuration.  For Self Managed Kafka you will need to supply blocks for type `vpcSubnet` and `vpcSecurityGroup`.
+* `uri` - (Required) The URI for this configuration.  For type `vpcSubnet` the value should be `subnet:subnetId` where `subnetId` is the value you would find in an aws_subnet resource's id attribute.  For type `vpcSecurityGroup` the value should be `securityGroup:securityGroupId` where `securityGroupId` is the value you would find in an aws_security_group resource's id attribute.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `functionArn` - The the ARN of the Lambda function the event source mapping is sending events to. (Note: this is a computed value that differs from `functionName` above.)
+* `lastModified` - The date this resource was last modified.
+* `lastProcessingResult` - The result of the last AWS Lambda invocation of your Lambda function.
+* `state` - The state of the event source mapping.
+* `stateTransitionReason` - The reason the event source mapping is in its current state.
+* `uuid` - The UUID of the created event source mapping.
+
+[1]: http://docs.aws.amazon.com/lambda/latest/dg/welcome.html
+[2]: http://docs.aws.amazon.com/lambda/latest/dg/API_CreateEventSourceMapping.html
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Lambda event source mappings using the `uuid` (event source mapping identifier). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Lambda event source mappings using the `uuid` (event source mapping identifier). For example:
+
+```console
+% terraform import aws_lambda_event_source_mapping.event_source_mapping 12345kxodurf3443
+```
+
+<!-- cache-key: cdktf-0.18.0 input-9d88b308e90e49cb5ae6f4d7a9dca76ab29540094caed5a76071a24309375e14 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/lambda_function.html.markdown b/website/docs/cdktf/typescript/r/lambda_function.html.markdown
new file mode 100644
index 00000000000..cef5e6d3c6a
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/lambda_function.html.markdown
@@ -0,0 +1,476 @@
+---
+subcategory: "Lambda"
+layout: "aws"
+page_title: "AWS: aws_lambda_function"
+description: |-
+  Provides a Lambda Function resource. Lambda allows you to trigger execution of code in response to events in AWS, enabling serverless backend solutions. The Lambda Function itself includes source code and runtime configuration.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lambda_function
+
+Provides a Lambda Function resource. Lambda allows you to trigger execution of code in response to events in AWS, enabling serverless backend solutions. The Lambda Function itself includes source code and runtime configuration.
+
+For information about Lambda and how to use it, see [What is AWS Lambda?][1]
+
+For a detailed example of setting up Lambda and API Gateway, see [Serverless Applications with AWS Lambda and API Gateway.][11]
+
+~> **NOTE:** Due to [AWS Lambda improved VPC networking changes that began deploying in September 2019](https://aws.amazon.com/blogs/compute/announcing-improved-vpc-networking-for-aws-lambda-functions/), EC2 subnets and security groups associated with Lambda Functions can take up to 45 minutes to successfully delete. Terraform AWS Provider version 2.31.0 and later automatically handles this increased timeout, however prior versions require setting the customizable deletion timeouts of those Terraform resources to 45 minutes (`delete = "45m"`). AWS and HashiCorp are working together to reduce the amount of time required for resource deletion and updates can be tracked in this [GitHub issue](https://github.com/hashicorp/terraform-provider-aws/issues/10329).
+
+~> **NOTE:** If you get a `KMSAccessDeniedException: Lambda was unable to decrypt the environment variables because KMS access was denied` error when invoking an [`awsLambdaFunction`](/docs/providers/aws/r/lambda_function.html) with environment variables, the IAM role associated with the function may have been deleted and recreated _after_ the function was created. You can fix the problem two ways: 1) updating the function's role to another role and then updating it back again to the recreated role, or 2) by using Terraform to `taint` the function and `apply` your configuration again to recreate the function. (When you create a function, Lambda grants permissions on the KMS key to the function's IAM role. If the IAM role is recreated, the grant is no longer valid. Changing the function's role or recreating the function causes Lambda to update the grant.)
+
+-> To give an external source (like an EventBridge Rule, SNS, or S3) permission to access the Lambda function, use the [`awsLambdaPermission`](lambda_permission.html) resource. See [Lambda Permission Model][4] for more details. On the other hand, the `role` argument of this resource is the function's execution role for identity and access to AWS services and resources.
+
+## Example Usage
+
+### Basic Example
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataArchiveFile } from "./.gen/providers/archive/data-archive-file";
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+import { LambdaFunction } from "./.gen/providers/aws/lambda-function";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    /*The following providers are missing schema information and might need manual adjustments to synthesize correctly: archive.
+    For a more precise conversion please use the --provider flag in convert.*/
+    const lambda = new DataArchiveFile(this, "lambda", {
+      output_path: "lambda_function_payload.zip",
+      source_file: "lambda.js",
+      type: "zip",
+    });
+    const assumeRole = new DataAwsIamPolicyDocument(this, "assume_role", {
+      statement: [
+        {
+          actions: ["sts:AssumeRole"],
+          effect: "Allow",
+          principals: [
+            {
+              identifiers: ["lambda.amazonaws.com"],
+              type: "Service",
+            },
+          ],
+        },
+      ],
+    });
+    const iamForLambda = new IamRole(this, "iam_for_lambda", {
+      assumeRolePolicy: Token.asString(assumeRole.json),
+      name: "iam_for_lambda",
+    });
+    new LambdaFunction(this, "test_lambda", {
+      environment: {
+        variables: {
+          foo: "bar",
+        },
+      },
+      filename: "lambda_function_payload.zip",
+      functionName: "lambda_function_name",
+      handler: "index.test",
+      role: iamForLambda.arn,
+      runtime: "nodejs18.x",
+      sourceCodeHash: Token.asString(lambda.outputBase64Sha256),
+    });
+  }
+}
+
+```
+
+### Lambda Layers
+
+~> **NOTE:** The `awsLambdaLayerVersion` attribute values for `arn` and `layerArn` were swapped in version 2.0.0 of the Terraform AWS Provider. For version 1.x, use `layerArn` references. For version 2.x, use `arn` references.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LambdaFunction } from "./.gen/providers/aws/lambda-function";
+import { LambdaLayerVersion } from "./.gen/providers/aws/lambda-layer-version";
+interface MyConfig {
+  layerName: any;
+  functionName: any;
+  role: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    const example = new LambdaLayerVersion(this, "example", {
+      layerName: config.layerName,
+    });
+    const awsLambdaFunctionExample = new LambdaFunction(this, "example_1", {
+      layers: [example.arn],
+      functionName: config.functionName,
+      role: config.role,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsLambdaFunctionExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### Lambda Ephemeral Storage
+
+Lambda Function Ephemeral Storage(`/tmp`) allows you to configure the storage upto `10` GB. The default value set to `512` MB.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+import { LambdaFunction } from "./.gen/providers/aws/lambda-function";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const assumeRole = new DataAwsIamPolicyDocument(this, "assume_role", {
+      statement: [
+        {
+          actions: ["sts:AssumeRole"],
+          effect: "Allow",
+          principals: [
+            {
+              identifiers: ["lambda.amazonaws.com"],
+              type: "Service",
+            },
+          ],
+        },
+      ],
+    });
+    const iamForLambda = new IamRole(this, "iam_for_lambda", {
+      assumeRolePolicy: Token.asString(assumeRole.json),
+      name: "iam_for_lambda",
+    });
+    new LambdaFunction(this, "test_lambda", {
+      ephemeralStorage: {
+        size: 10240,
+      },
+      filename: "lambda_function_payload.zip",
+      functionName: "lambda_function_name",
+      handler: "index.test",
+      role: iamForLambda.arn,
+      runtime: "nodejs18.x",
+    });
+  }
+}
+
+```
+
+### Lambda File Systems
+
+Lambda File Systems allow you to connect an Amazon Elastic File System (EFS) file system to a Lambda function to share data across function invocations, access existing data including large files, and save function state.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EfsAccessPoint } from "./.gen/providers/aws/efs-access-point";
+import { EfsFileSystem } from "./.gen/providers/aws/efs-file-system";
+import { EfsMountTarget } from "./.gen/providers/aws/efs-mount-target";
+import { LambdaFunction } from "./.gen/providers/aws/lambda-function";
+interface MyConfig {
+  functionName: any;
+  role: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    const efsForLambda = new EfsFileSystem(this, "efs_for_lambda", {
+      tags: {
+        Name: "efs_for_lambda",
+      },
+    });
+    const alpha = new EfsMountTarget(this, "alpha", {
+      fileSystemId: efsForLambda.id,
+      securityGroups: [sgForLambda.id],
+      subnetId: subnetForLambda.id,
+    });
+    const accessPointForLambda = new EfsAccessPoint(
+      this,
+      "access_point_for_lambda",
+      {
+        fileSystemId: efsForLambda.id,
+        posixUser: {
+          gid: 1000,
+          uid: 1000,
+        },
+        rootDirectory: {
+          creationInfo: {
+            ownerGid: 1000,
+            ownerUid: 1000,
+            permissions: "777",
+          },
+          path: "/lambda",
+        },
+      }
+    );
+    new LambdaFunction(this, "example", {
+      dependsOn: [alpha],
+      fileSystemConfig: {
+        arn: accessPointForLambda.arn,
+        localMountPath: "/mnt/efs",
+      },
+      vpcConfig: {
+        securityGroupIds: [sgForLambda.id],
+        subnetIds: [subnetForLambda.id],
+      },
+      functionName: config.functionName,
+      role: config.role,
+    });
+  }
+}
+
+```
+
+### Lambda retries
+
+Lambda Functions allow you to configure error handling for asynchronous invocation. The settings that it supports are `Maximum age of event` and `Retry attempts` as stated in [Lambda documentation for Configuring error handling for asynchronous invocation](https://docs.aws.amazon.com/lambda/latest/dg/invocation-async.html#invocation-async-errors). To configure these settings, refer to the [aws_lambda_function_event_invoke_config resource](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_function_event_invoke_config).
+
+## CloudWatch Logging and Permissions
+
+For more information about CloudWatch Logs for Lambda, see the [Lambda User Guide](https://docs.aws.amazon.com/lambda/latest/dg/monitoring-functions-logs.html).
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformVariable, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudwatchLogGroup } from "./.gen/providers/aws/cloudwatch-log-group";
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { IamPolicy } from "./.gen/providers/aws/iam-policy";
+import { IamRolePolicyAttachment } from "./.gen/providers/aws/iam-role-policy-attachment";
+import { LambdaFunction } from "./.gen/providers/aws/lambda-function";
+interface MyConfig {
+  role: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    /*Terraform Variables are not always the best fit for getting inputs in the context of Terraform CDK.
+    You can read more about this at https://cdk.tf/variables*/
+    const lambdaFunctionName = new TerraformVariable(
+      this,
+      "lambda_function_name",
+      {
+        default: "lambda_function_name",
+      }
+    );
+    const example = new CloudwatchLogGroup(this, "example", {
+      name: "/aws/lambda/${" + lambdaFunctionName.value + "}",
+      retentionInDays: 14,
+    });
+    const lambdaLogging = new DataAwsIamPolicyDocument(this, "lambda_logging", {
+      statement: [
+        {
+          actions: [
+            "logs:CreateLogGroup",
+            "logs:CreateLogStream",
+            "logs:PutLogEvents",
+          ],
+          effect: "Allow",
+          resources: ["arn:aws:logs:*:*:*"],
+        },
+      ],
+    });
+    const awsIamPolicyLambdaLogging = new IamPolicy(this, "lambda_logging_3", {
+      description: "IAM policy for logging from a lambda",
+      name: "lambda_logging",
+      path: "/",
+      policy: Token.asString(lambdaLogging.json),
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamPolicyLambdaLogging.overrideLogicalId("lambda_logging");
+    const lambdaLogs = new IamRolePolicyAttachment(this, "lambda_logs", {
+      policyArn: Token.asString(awsIamPolicyLambdaLogging.arn),
+      role: iamForLambda.name,
+    });
+    new LambdaFunction(this, "test_lambda", {
+      dependsOn: [lambdaLogs, example],
+      functionName: lambdaFunctionName.stringValue,
+      role: config.role,
+    });
+  }
+}
+
+```
+
+## Specifying the Deployment Package
+
+AWS Lambda expects source code to be provided as a deployment package whose structure varies depending on which `runtime` is in use. See [Runtimes][6] for the valid values of `runtime`. The expected structure of the deployment package can be found in [the AWS Lambda documentation for each runtime][8].
+
+Once you have created your deployment package you can specify it either directly as a local file (using the `filename` argument) or indirectly via Amazon S3 (using the `s3Bucket`, `s3Key` and `s3ObjectVersion` arguments). When providing the deployment package via S3 it may be useful to use [the `awsS3Object` resource](s3_object.html) to upload it.
+
+For larger deployment packages it is recommended by Amazon to upload via S3, since the S3 API has better support for uploading large files efficiently.
+
+## Argument Reference
+
+The following arguments are required:
+
+* `functionName` - (Required) Unique name for your Lambda Function.
+* `role` - (Required) Amazon Resource Name (ARN) of the function's execution role. The role provides the function's identity and access to AWS services and resources.
+
+The following arguments are optional:
+
+* `architectures` - (Optional) Instruction set architecture for your Lambda function. Valid values are `["x8664"]` and `["arm64"]`. Default is `["x8664"]`. Removing this attribute, function's architecture stay the same.
+* `codeSigningConfigArn` - (Optional) To enable code signing for this function, specify the ARN of a code-signing configuration. A code-signing configuration includes a set of signing profiles, which define the trusted publishers for this function.
+* `deadLetterConfig` - (Optional) Configuration block. Detailed below.
+* `description` - (Optional) Description of what your Lambda Function does.
+* `environment` - (Optional) Configuration block. Detailed below.
+* `ephemeralStorage` - (Optional) The amount of Ephemeral storage(`/tmp`) to allocate for the Lambda Function in MB. This parameter is used to expand the total amount of Ephemeral storage available, beyond the default amount of `512`MB. Detailed below.
+* `fileSystemConfig` - (Optional) Configuration block. Detailed below.
+* `filename` - (Optional) Path to the function's deployment package within the local filesystem. Exactly one of `filename`, `imageUri`, or `s3Bucket` must be specified.
+* `handler` - (Optional) Function [entrypoint][3] in your code.
+* `imageConfig` - (Optional) Configuration block. Detailed below.
+* `imageUri` - (Optional) ECR image URI containing the function's deployment package. Exactly one of `filename`, `imageUri`,  or `s3Bucket` must be specified.
+* `kmsKeyArn` - (Optional) Amazon Resource Name (ARN) of the AWS Key Management Service (KMS) key that is used to encrypt environment variables. If this configuration is not provided when environment variables are in use, AWS Lambda uses a default service key. If this configuration is provided when environment variables are not in use, the AWS Lambda API does not save this configuration and Terraform will show a perpetual difference of adding the key. To fix the perpetual difference, remove this configuration.
+* `layers` - (Optional) List of Lambda Layer Version ARNs (maximum of 5) to attach to your Lambda Function. See [Lambda Layers][10]
+* `memorySize` - (Optional) Amount of memory in MB your Lambda Function can use at runtime. Defaults to `128`. See [Limits][5]
+* `packageType` - (Optional) Lambda deployment package type. Valid values are `zip` and `image`. Defaults to `zip`.
+* `publish` - (Optional) Whether to publish creation/change as new Lambda Function Version. Defaults to `false`.
+* `reservedConcurrentExecutions` - (Optional) Amount of reserved concurrent executions for this lambda function. A value of `0` disables lambda from being triggered and `1` removes any concurrency limitations. Defaults to Unreserved Concurrency Limits `1`. See [Managing Concurrency][9]
+* `replaceSecurityGroupsOnDestroy` - (Optional, **Deprecated**) **AWS no longer supports this operation. This attribute now has no effect and will be removed in a future major version.** Whether to replace the security groups on associated lambda network interfaces upon destruction. Removing these security groups from orphaned network interfaces can speed up security group deletion times by avoiding a dependency on AWS's internal cleanup operations. By default, the ENI security groups will be replaced with the `default` security group in the function's VPC. Set the `replacementSecurityGroupIds` attribute to use a custom list of security groups for replacement.
+* `replacementSecurityGroupIds` - (Optional, **Deprecated**) List of security group IDs to assign to orphaned Lambda function network interfaces upon destruction. `replaceSecurityGroupsOnDestroy` must be set to `true` to use this attribute.
+* `runtime` - (Optional) Identifier of the function's runtime. See [Runtimes][6] for valid values.
+* `s3Bucket` - (Optional) S3 bucket location containing the function's deployment package. This bucket must reside in the same AWS region where you are creating the Lambda function. Exactly one of `filename`, `imageUri`, or `s3Bucket` must be specified. When `s3Bucket` is set, `s3Key` is required.
+* `s3Key` - (Optional) S3 key of an object containing the function's deployment package. When `s3Bucket` is set, `s3Key` is required.
+* `s3ObjectVersion` - (Optional) Object version containing the function's deployment package. Conflicts with `filename` and `imageUri`.
+* `skipDestroy` - (Optional) Set to true if you do not wish the function to be deleted at destroy time, and instead just remove the function from the Terraform state.
+* `sourceCodeHash` - (Optional) Used to trigger updates. Must be set to a base64-encoded SHA256 hash of the package file specified with either `filename` or `s3Key`. The usual way to set this is `filebase64Sha256("fileZip")` (Terraform 0.11.12 and later) or `base64Sha256(file("fileZip"))` (Terraform 0.11.11 and earlier), where "file.zip" is the local filename of the lambda function source archive.
+* `snapStart` - (Optional) Snap start settings block. Detailed below.
+* `tags` - (Optional) Map of tags to assign to the object. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `timeout` - (Optional) Amount of time your Lambda Function has to run in seconds. Defaults to `3`. See [Limits][5].
+* `tracingConfig` - (Optional) Configuration block. Detailed below.
+* `vpcConfig` - (Optional) Configuration block. Detailed below.
+
+### dead_letter_config
+
+Dead letter queue configuration that specifies the queue or topic where Lambda sends asynchronous events when they fail processing. For more information, see [Dead Letter Queues](https://docs.aws.amazon.com/lambda/latest/dg/invocation-async.html#dlq).
+
+* `targetArn` - (Required) ARN of an SNS topic or SQS queue to notify when an invocation fails. If this option is used, the function's IAM role must be granted suitable access to write to the target object, which means allowing either the `sns:publish` or `sqs:sendMessage` action on this ARN, depending on which service is targeted.
+
+### environment
+
+* `variables` - (Optional) Map of environment variables that are accessible from the function code during execution. If provided at least one key must be present.
+
+### ephemeral_storage
+
+* `size` - (Required) The size of the Lambda function Ephemeral storage(`/tmp`) represented in MB. The minimum supported `ephemeralStorage` value defaults to `512`MB and the maximum supported value is `10240`MB.
+
+### file_system_config
+
+Connection settings for an EFS file system. Before creating or updating Lambda functions with `fileSystemConfig`, EFS mount targets must be in available lifecycle state. Use `dependsOn` to explicitly declare this dependency. See [Using Amazon EFS with Lambda][12].
+
+* `arn` - (Required) Amazon Resource Name (ARN) of the Amazon EFS Access Point that provides access to the file system.
+* `localMountPath` - (Required) Path where the function can access the file system, starting with /mnt/.
+
+### image_config
+
+Container image configuration values that override the values in the container image Dockerfile.
+
+* `command` - (Optional) Parameters that you want to pass in with `entryPoint`.
+* `entryPoint` - (Optional) Entry point to your application, which is typically the location of the runtime executable.
+* `workingDirectory` - (Optional) Working directory.
+
+### snap_start
+
+Snap start settings for low-latency startups. This feature is currently only supported for `java11` and `java17` runtimes. Remove this block to delete the associated settings (rather than setting `apply_on = "None"`).
+
+* `applyOn` - (Required) Conditions where snap start is enabled. Valid values are `publishedVersions`.
+
+### tracing_config
+
+* `mode` - (Required) Whether to sample and trace a subset of incoming requests with AWS X-Ray. Valid values are `passThrough` and `active`. If `passThrough`, Lambda will only trace the request from an upstream service if it contains a tracing header with "sampled=1". If `active`, Lambda will respect any tracing header it receives from an upstream service. If no tracing header is received, Lambda will call X-Ray for a tracing decision.
+
+### vpc_config
+
+For network connectivity to AWS resources in a VPC, specify a list of security groups and subnets in the VPC. When you connect a function to a VPC, it can only access resources and the internet through that VPC. See [VPC Settings][7].
+
+~> **NOTE:** If `subnetIds`, `securityGroupIds` and `ipv6AllowedForDualStack` are empty then `vpcConfig` is considered to be empty or unset.
+
+* `ipv6AllowedForDualStack` - (Optional) Allows outbound IPv6 traffic on VPC functions that are connected to dual-stack subnets. Default is `false`.
+* `securityGroupIds` - (Required) List of security group IDs associated with the Lambda function.
+* `subnetIds` - (Required) List of subnet IDs associated with the Lambda function.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) identifying your Lambda Function.
+* `invokeArn` - ARN to be used for invoking Lambda Function from API Gateway - to be used in [`awsApiGatewayIntegration`](/docs/providers/aws/r/api_gateway_integration.html)'s `uri`.
+* `lastModified` - Date this resource was last modified.
+* `qualifiedArn` - ARN identifying your Lambda Function Version (if versioning is enabled via `publish = true`).
+* `qualifiedInvokeArn` - Qualified ARN (ARN with lambda version number) to be used for invoking Lambda Function from API Gateway - to be used in [`awsApiGatewayIntegration`](/docs/providers/aws/r/api_gateway_integration.html)'s `uri`.
+* `signingJobArn` - ARN of the signing job.
+* `signingProfileVersionArn` - ARN of the signing profile version.
+* `snapStartOptimizationStatus` - Optimization status of the snap start configuration. Valid values are `on` and `off`.
+* `sourceCodeSize` - Size in bytes of the function .zip file.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `version` - Latest published version of your Lambda Function.
+* `vpcConfigVpcId` - ID of the VPC.
+
+[1]: https://docs.aws.amazon.com/lambda/latest/dg/welcome.html
+[3]: https://docs.aws.amazon.com/lambda/latest/dg/walkthrough-custom-events-create-test-function.html
+[4]: https://docs.aws.amazon.com/lambda/latest/dg/intro-permission-model.html
+[5]: https://docs.aws.amazon.com/lambda/latest/dg/limits.html
+[6]: https://docs.aws.amazon.com/lambda/latest/dg/API_CreateFunction.html#SSS-CreateFunction-request-Runtime
+[7]: https://docs.aws.amazon.com/lambda/latest/dg/configuration-vpc.html
+[8]: https://docs.aws.amazon.com/lambda/latest/dg/deployment-package-v2.html
+[9]: https://docs.aws.amazon.com/lambda/latest/dg/concurrent-executions.html
+[10]: https://docs.aws.amazon.com/lambda/latest/dg/configuration-layers.html
+[11]: https://learn.hashicorp.com/terraform/aws/lambda-api-gateway
+[12]: https://docs.aws.amazon.com/lambda/latest/dg/services-efs.html
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `10M`)
+* `update` - (Default `10M`)
+* `delete` - (Default `10M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Lambda Functions using the `functionName`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Lambda Functions using the `functionName`. For example:
+
+```console
+% terraform import aws_lambda_function.test_lambda my_test_lambda_function
+```
+
+<!-- cache-key: cdktf-0.18.0 input-169b7bbe476a39e939fb773a4176feae6d770083a7a351a021d29d9dd52746cd -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/lambda_function_event_invoke_config.html.markdown b/website/docs/cdktf/typescript/r/lambda_function_event_invoke_config.html.markdown
new file mode 100644
index 00000000000..82eb14b5006
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/lambda_function_event_invoke_config.html.markdown
@@ -0,0 +1,268 @@
+---
+subcategory: "Lambda"
+layout: "aws"
+page_title: "AWS: aws_lambda_function_event_invoke_config"
+description: |-
+  Manages an asynchronous invocation configuration for a Lambda Function or Alias.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lambda_function_event_invoke_config
+
+Manages an asynchronous invocation configuration for a Lambda Function or Alias. More information about asynchronous invocations and the configurable values can be found in the [Lambda Developer Guide](https://docs.aws.amazon.com/lambda/latest/dg/invocation-async.html).
+
+## Example Usage
+
+### Destination Configuration
+
+~> **NOTE:** Ensure the Lambda Function IAM Role has necessary permissions for the destination, such as `sqs:sendMessage` or `sns:publish`, otherwise the API will return a generic `InvalidParameterValueException: The destination ARN arn:PARTITION:SERVICE:REGION:ACCOUNT:RESOURCE is invalid.` error.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LambdaFunctionEventInvokeConfig } from "./.gen/providers/aws/lambda-function-event-invoke-config";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new LambdaFunctionEventInvokeConfig(this, "example", {
+      destinationConfig: {
+        onFailure: {
+          destination: Token.asString(awsSqsQueueExample.arn),
+        },
+        onSuccess: {
+          destination: Token.asString(awsSnsTopicExample.arn),
+        },
+      },
+      functionName: Token.asString(awsLambdaAliasExample.functionName),
+    });
+  }
+}
+
+```
+
+### Error Handling Configuration
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LambdaFunctionEventInvokeConfig } from "./.gen/providers/aws/lambda-function-event-invoke-config";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new LambdaFunctionEventInvokeConfig(this, "example", {
+      functionName: Token.asString(awsLambdaAliasExample.functionName),
+      maximumEventAgeInSeconds: 60,
+      maximumRetryAttempts: 0,
+    });
+  }
+}
+
+```
+
+### Configuration for Alias Name
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LambdaFunctionEventInvokeConfig } from "./.gen/providers/aws/lambda-function-event-invoke-config";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new LambdaFunctionEventInvokeConfig(this, "example", {
+      functionName: Token.asString(awsLambdaAliasExample.functionName),
+      qualifier: Token.asString(awsLambdaAliasExample.name),
+    });
+  }
+}
+
+```
+
+### Configuration for Function Latest Unpublished Version
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LambdaFunctionEventInvokeConfig } from "./.gen/providers/aws/lambda-function-event-invoke-config";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new LambdaFunctionEventInvokeConfig(this, "example", {
+      functionName: Token.asString(awsLambdaFunctionExample.functionName),
+      qualifier: "$LATEST",
+    });
+  }
+}
+
+```
+
+### Configuration for Function Published Version
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LambdaFunctionEventInvokeConfig } from "./.gen/providers/aws/lambda-function-event-invoke-config";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new LambdaFunctionEventInvokeConfig(this, "example", {
+      functionName: Token.asString(awsLambdaFunctionExample.functionName),
+      qualifier: Token.asString(awsLambdaFunctionExample.version),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `functionName` - (Required) Name or Amazon Resource Name (ARN) of the Lambda Function, omitting any version or alias qualifier.
+
+The following arguments are optional:
+
+* `destinationConfig` - (Optional) Configuration block with destination configuration. See below for details.
+* `maximumEventAgeInSeconds` - (Optional) Maximum age of a request that Lambda sends to a function for processing in seconds. Valid values between 60 and 21600.
+* `maximumRetryAttempts` - (Optional) Maximum number of times to retry when the function returns an error. Valid values between 0 and 2. Defaults to 2.
+* `qualifier` - (Optional) Lambda Function published version, `$latest`, or Lambda Alias name.
+
+### destination_config Configuration Block
+
+~> **NOTE:** At least one of `onFailure` or `onSuccess` must be configured when using this configuration block, otherwise remove it completely to prevent perpetual differences in Terraform runs.
+
+The following arguments are optional:
+
+* `onFailure` - (Optional) Configuration block with destination configuration for failed asynchronous invocations. See below for details.
+* `onSuccess` - (Optional) Configuration block with destination configuration for successful asynchronous invocations. See below for details.
+
+#### destination_config on_failure Configuration Block
+
+The following arguments are required:
+
+* `destination` - (Required) Amazon Resource Name (ARN) of the destination resource. See the [Lambda Developer Guide](https://docs.aws.amazon.com/lambda/latest/dg/invocation-async.html#invocation-async-destinations) for acceptable resource types and associated IAM permissions.
+
+#### destination_config on_success Configuration Block
+
+The following arguments are required:
+
+* `destination` - (Required) Amazon Resource Name (ARN) of the destination resource. See the [Lambda Developer Guide](https://docs.aws.amazon.com/lambda/latest/dg/invocation-async.html#invocation-async-destinations) for acceptable resource types and associated IAM permissions.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Fully qualified Lambda Function name or Amazon Resource Name (ARN)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Lambda Function Event Invoke Configs using the fully qualified Function name or Amazon Resource Name (ARN). For example:
+
+ARN without qualifier (all versions and aliases):
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+ARN with qualifier:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Name without qualifier (all versions and aliases):
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Name with qualifier:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+**Using `terraform import` to import** Lambda Function Event Invoke Configs using the fully qualified Function name or Amazon Resource Name (ARN). For example:
+
+ARN without qualifier (all versions and aliases):
+
+```console
+% terraform import aws_lambda_function_event_invoke_config.example arn:aws:us-east-1:123456789012:function:my_function
+```
+
+ARN with qualifier:
+
+```console
+% terraform import aws_lambda_function_event_invoke_config.example arn:aws:us-east-1:123456789012:function:my_function:production
+```
+
+Name without qualifier (all versions and aliases):
+
+```console
+% terraform import aws_lambda_function_event_invoke_config.example my_function
+```
+
+Name with qualifier:
+
+```console
+% terraform import aws_lambda_function_event_invoke_config.example my_function:production
+```
+
+<!-- cache-key: cdktf-0.18.0 input-609bc5423f52ca1abd7ee524d562fbd117b6915dd9a7b4012b252b00f563c6ac -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/lambda_function_url.html.markdown b/website/docs/cdktf/typescript/r/lambda_function_url.html.markdown
new file mode 100644
index 00000000000..0e621576899
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/lambda_function_url.html.markdown
@@ -0,0 +1,102 @@
+---
+subcategory: "Lambda"
+layout: "aws"
+page_title: "AWS: aws_lambda_function_url"
+description: |-
+  Provides a Lambda function URL resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lambda_function_url
+
+Provides a Lambda function URL resource. A function URL is a dedicated HTTP(S) endpoint for a Lambda function.
+
+See the [AWS Lambda documentation](https://docs.aws.amazon.com/lambda/latest/dg/lambda-urls.html) for more information.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LambdaFunctionUrl } from "./.gen/providers/aws/lambda-function-url";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new LambdaFunctionUrl(this, "test_latest", {
+      authorizationType: "NONE",
+      functionName: test.functionName,
+    });
+    new LambdaFunctionUrl(this, "test_live", {
+      authorizationType: "AWS_IAM",
+      cors: {
+        allowCredentials: true,
+        allowHeaders: ["date", "keep-alive"],
+        allowMethods: ["*"],
+        allowOrigins: ["*"],
+        exposeHeaders: ["keep-alive", "date"],
+        maxAge: 86400,
+      },
+      functionName: test.functionName,
+      qualifier: "my_alias",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `authorizationType` - (Required) The type of authentication that the function URL uses. Set to `"awsIam"` to restrict access to authenticated IAM users only. Set to `"none"` to bypass IAM authentication and create a public endpoint. See the [AWS documentation](https://docs.aws.amazon.com/lambda/latest/dg/urls-auth.html) for more details.
+* `cors` - (Optional) The [cross-origin resource sharing (CORS)](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS) settings for the function URL. Documented below.
+* `functionName` - (Required) The name (or ARN) of the Lambda function.
+* `invokeMode` - (Optional) Determines how the Lambda function responds to an invocation. Valid values are `buffered` (default) and `responseStream`. See more in [Configuring a Lambda function to stream responses](https://docs.aws.amazon.com/lambda/latest/dg/configuration-response-streaming.html).
+* `qualifier` - (Optional) The alias name or `"$latest"`.
+
+### cors
+
+This configuration block supports the following attributes:
+
+* `allowCredentials` - (Optional) Whether to allow cookies or other credentials in requests to the function URL. The default is `false`.
+* `allowHeaders` - (Optional) The HTTP headers that origins can include in requests to the function URL. For example: `["date", "keep-alive", "x-custom-header"]`.
+* `allowMethods` - (Optional) The HTTP methods that are allowed when calling the function URL. For example: `["GET", "POST", "DELETE"]`, or the wildcard character (`["*"]`).
+* `allowOrigins` - (Optional) The origins that can access the function URL. You can list any number of specific origins (or the wildcard character (`"*"`)), separated by a comma. For example: `["https://www.example.com", "http://localhost:60905"]`.
+* `exposeHeaders` - (Optional) The HTTP headers in your function response that you want to expose to origins that call the function URL.
+* `maxAge` - (Optional) The maximum amount of time, in seconds, that web browsers can cache results of a preflight request. By default, this is set to `0`, which means that the browser doesn't cache results. The maximum value is `86400`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `functionArn` - The Amazon Resource Name (ARN) of the function.
+* `functionUrl` - The HTTP URL endpoint for the function in the format `https://<urlId>LambdaUrl.<region>OnAws`.
+* `urlId` - A generated ID for the endpoint.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Lambda function URLs using the `functionName` or `functionName/qualifier`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Lambda function URLs using the `functionName` or `functionName/qualifier`. For example:
+
+```console
+% terraform import aws_lambda_function_url.test_lambda_url my_test_lambda_function
+```
+
+<!-- cache-key: cdktf-0.18.0 input-109acf5fac25dcc5daf91ea88836c775555057c7e2ea1a59edfd11a98e567940 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/lambda_invocation.html.markdown b/website/docs/cdktf/typescript/r/lambda_invocation.html.markdown
new file mode 100644
index 00000000000..579f1cb2f69
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/lambda_invocation.html.markdown
@@ -0,0 +1,190 @@
+---
+subcategory: "Lambda"
+layout: "aws"
+page_title: "AWS: aws_lambda_invocation"
+description: |-
+  Invoke AWS Lambda Function
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lambda_invocation
+
+Use this resource to invoke a lambda function. The lambda function is invoked with the [RequestResponse](https://docs.aws.amazon.com/lambda/latest/dg/API_Invoke.html#API_Invoke_RequestSyntax) invocation type.
+
+~> **NOTE:** By default this resource _only_ invokes the function when the arguments call for a create or replace. In other words, after an initial invocation on _apply_, if the arguments do not change, a subsequent _apply_ does not invoke the function again. To dynamically invoke the function, see the `triggers` example below. To always invoke a function on each _apply_, see the [`awsLambdaInvocation`](/docs/providers/aws/d/lambda_invocation.html) data source. To invoke the lambda function when the terraform resource is updated and deleted, see the [CRUD Lifecycle Scope](#crud-lifecycle-scope) example below.
+
+~> **NOTE:** If you get a `KMSAccessDeniedException: Lambda was unable to decrypt the environment variables because KMS access was denied` error when invoking an [`awsLambdaFunction`](/docs/providers/aws/r/lambda_function.html) with environment variables, the IAM role associated with the function may have been deleted and recreated _after_ the function was created. You can fix the problem two ways: 1) updating the function's role to another role and then updating it back again to the recreated role, or 2) by using Terraform to `taint` the function and `apply` your configuration again to recreate the function. (When you create a function, Lambda grants permissions on the KMS key to the function's IAM role. If the IAM role is recreated, the grant is no longer valid. Changing the function's role or recreating the function causes Lambda to update the grant.)
+
+## Example Usage
+
+### Basic Example
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformOutput, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LambdaInvocation } from "./.gen/providers/aws/lambda-invocation";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new LambdaInvocation(this, "example", {
+      functionName: lambdaFunctionTest.functionName,
+      input: Token.asString(
+        Fn.jsonencode({
+          key1: "value1",
+          key2: "value2",
+        })
+      ),
+    });
+    new TerraformOutput(this, "result_entry", {
+      value: Fn.lookupNested(Fn.jsondecode(example.result), ['"key1"']),
+    });
+  }
+}
+
+```
+
+### Dynamic Invocation Example Using Triggers
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LambdaInvocation } from "./.gen/providers/aws/lambda-invocation";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new LambdaInvocation(this, "example", {
+      functionName: lambdaFunctionTest.functionName,
+      input: Token.asString(
+        Fn.jsonencode({
+          key1: "value1",
+          key2: "value2",
+        })
+      ),
+      triggers: {
+        redeployment: Token.asString(
+          Fn.sha1(
+            Token.asString(
+              Fn.jsonencode([awsLambdaFunctionExample.environment])
+            )
+          )
+        ),
+      },
+    });
+  }
+}
+
+```
+
+### CRUD Lifecycle Scope
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LambdaInvocation } from "./.gen/providers/aws/lambda-invocation";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new LambdaInvocation(this, "example", {
+      functionName: lambdaFunctionTest.functionName,
+      input: Token.asString(
+        Fn.jsonencode({
+          key1: "value1",
+          key2: "value2",
+        })
+      ),
+      lifecycleScope: "CRUD",
+    });
+  }
+}
+
+```
+
+~> **NOTE:** `lifecycle_scope = "CRUD"` will inject a key `tf` in the input event to pass lifecycle information! This allows the lambda function to handle different lifecycle transitions uniquely.  If you need to use a key `tf` in your own input JSON, the default key name can be overridden with the `terraformKey` argument.
+
+The key `tf` gets added with subkeys:
+
+* `action` - Action Terraform performs on the resource. Values are `create`, `update`, or `delete`.
+* `prevInput` - Input JSON payload from the previous invocation. This can be used to handle update and delete events.
+
+When the resource from the example above is created, the Lambda will get following JSON payload:
+
+```json
+{
+  "key1": "value1",
+  "key2": "value2",
+  "tf": {
+    "action": "create",
+    "prev_input": null
+  }
+}
+```
+
+If the input value of `key1` changes to "valueB", then the lambda will be invoked again with the following JSON payload:
+
+```json
+{
+  "key1": "valueB",
+  "key2": "value2",
+  "tf": {
+    "action": "update",
+    "prev_input": {
+      "key1": "value1",
+      "key2": "value2"
+    }
+  }
+}
+```
+
+When the invocation resource is removed, the final invocation will have the following JSON payload:
+
+```json
+{
+  "key1": "valueB",
+  "key2": "value2",
+  "tf": {
+    "action": "delete",
+    "prev_input": {
+      "key1": "valueB",
+      "key2": "value2"
+    }
+  }
+}
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `functionName` - (Required) Name of the lambda function.
+* `input` - (Required) JSON payload to the lambda function.
+
+The following arguments are optional:
+
+* `lifecycleScope` - (Optional) Lifecycle scope of the resource to manage. Valid values are `createOnly` and `crud`. Defaults to `createOnly`. `createOnly` will invoke the function only on creation or replacement. `crud` will invoke the function on each lifecycle event, and augment the input JSON payload with additional lifecycle information.
+* `qualifier` - (Optional) Qualifier (i.e., version) of the lambda function. Defaults to `$latest`.
+* `terraformKey` - (Optional) The JSON key used to store lifecycle information in the input JSON payload. Defaults to `tf`. This additional key is only included when `lifecycleScope` is set to `crud`.
+* `triggers` - (Optional) Map of arbitrary keys and values that, when changed, will trigger a re-invocation. To force a re-invocation without changing these keys/values, use the [`terraform taint` command](https://www.terraform.io/docs/commands/taint.html).
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `result` - String result of the lambda function invocation.
+
+<!-- cache-key: cdktf-0.18.0 input-7112258209b5478d3ef1a608e7acf55c35e00752fc231e672e536ec0d294422f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/lambda_layer_version.html.markdown b/website/docs/cdktf/typescript/r/lambda_layer_version.html.markdown
new file mode 100644
index 00000000000..e9fdb8a00bb
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/lambda_layer_version.html.markdown
@@ -0,0 +1,114 @@
+---
+subcategory: "Lambda"
+layout: "aws"
+page_title: "AWS: aws_lambda_layer_version"
+description: |-
+  Provides a Lambda Layer Version resource. Lambda Layers allow you to reuse shared bits of code across multiple lambda functions.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lambda_layer_version
+
+Provides a Lambda Layer Version resource. Lambda Layers allow you to reuse shared bits of code across multiple lambda functions.
+
+For information about Lambda Layers and how to use them, see [AWS Lambda Layers][1].
+
+~> **NOTE:** Setting `skipDestroy` to `true` means that the AWS Provider will _not_ destroy any layer version, even when running `terraform destroy`. Layer versions are thus intentional dangling resources that are _not_ managed by Terraform and may incur extra expense in your AWS account.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LambdaLayerVersion } from "./.gen/providers/aws/lambda-layer-version";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new LambdaLayerVersion(this, "lambda_layer", {
+      compatibleRuntimes: ["nodejs16.x"],
+      filename: "lambda_layer_payload.zip",
+      layerName: "lambda_layer_name",
+    });
+  }
+}
+
+```
+
+## Specifying the Deployment Package
+
+AWS Lambda Layers expect source code to be provided as a deployment package whose structure varies depending on which `compatibleRuntimes` this layer specifies.
+See [Runtimes][2] for the valid values of `compatibleRuntimes`.
+
+Once you have created your deployment package you can specify it either directly as a local file (using the `filename` argument) or
+indirectly via Amazon S3 (using the `s3Bucket`, `s3Key` and `s3ObjectVersion` arguments). When providing the deployment
+package via S3 it may be useful to use [the `awsS3Object` resource](s3_object.html) to upload it.
+
+For larger deployment packages it is recommended by Amazon to upload via S3, since the S3 API has better support for uploading large files efficiently.
+
+## Argument Reference
+
+The following arguments are required:
+
+* `layerName` - (Required) Unique name for your Lambda Layer
+
+The following arguments are optional:
+
+* `compatibleArchitectures` - (Optional) List of [Architectures][4] this layer is compatible with. Currently `x8664` and `arm64` can be specified.
+* `compatibleRuntimes` - (Optional) List of [Runtimes][2] this layer is compatible with. Up to 5 runtimes can be specified.
+* `description` - (Optional) Description of what your Lambda Layer does.
+* `filename` (Optional) Path to the function's deployment package within the local filesystem. If defined, The `s3`-prefixed options cannot be used.
+* `licenseInfo` - (Optional) License info for your Lambda Layer. See [License Info][3].
+* `s3Bucket` - (Optional) S3 bucket location containing the function's deployment package. Conflicts with `filename`. This bucket must reside in the same AWS region where you are creating the Lambda function.
+* `s3Key` - (Optional) S3 key of an object containing the function's deployment package. Conflicts with `filename`.
+* `s3ObjectVersion` - (Optional) Object version containing the function's deployment package. Conflicts with `filename`.
+* `skipDestroy` - (Optional) Whether to retain the old version of a previously deployed Lambda Layer. Default is `false`. When this is not set to `true`, changing any of `compatibleArchitectures`, `compatibleRuntimes`, `description`, `filename`, `layerName`, `licenseInfo`, `s3Bucket`, `s3Key`, `s3ObjectVersion`, or `sourceCodeHash` forces deletion of the existing layer version and creation of a new layer version.
+* `sourceCodeHash` - (Optional) Used to trigger updates. Must be set to a base64-encoded SHA256 hash of the package file specified with either `filename` or `s3Key`. The usual way to set this is `${filebase64Sha256("fileZip")}` (Terraform 0.11.12 or later) or `${base64Sha256(file("fileZip"))}` (Terraform 0.11.11 and earlier), where "file.zip" is the local filename of the lambda layer source archive.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Lambda Layer with version.
+* `createdDate` - Date this resource was created.
+* `layerArn` - ARN of the Lambda Layer without version.
+* `signingJobArn` - ARN of a signing job.
+* `signingProfileVersionArn` - ARN for a signing profile version.
+* `sourceCodeSize` - Size in bytes of the function .zip file.
+* `version` - Lambda Layer version.
+
+[1]: https://docs.aws.amazon.com/lambda/latest/dg/configuration-layers.html
+[2]: https://docs.aws.amazon.com/lambda/latest/dg/API_PublishLayerVersion.html#SSS-PublishLayerVersion-request-CompatibleRuntimes
+[3]: https://docs.aws.amazon.com/lambda/latest/dg/API_PublishLayerVersion.html#SSS-PublishLayerVersion-request-LicenseInfo
+[4]: https://docs.aws.amazon.com/lambda/latest/dg/API_PublishLayerVersion.html#SSS-PublishLayerVersion-request-CompatibleArchitectures
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Lambda Layers using `arn`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Lambda Layers using `arn`. For example:
+
+```console
+% terraform import \
+    aws_lambda_layer_version.test_layer \
+    arn:aws:lambda:_REGION_:_ACCOUNT_ID_:layer:_LAYER_NAME_:_LAYER_VERSION_
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1d7deb31d6f83afe8e8355fe2da3b01431626e21fd36c30f56c344343663f003 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/lambda_layer_version_permission.html.markdown b/website/docs/cdktf/typescript/r/lambda_layer_version_permission.html.markdown
new file mode 100644
index 00000000000..3b15e61deb1
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/lambda_layer_version_permission.html.markdown
@@ -0,0 +1,89 @@
+---
+subcategory: "Lambda"
+layout: "aws"
+page_title: "AWS: aws_lambda_layer_version_permission"
+description: |-
+  Provides a Lambda Layer Version Permission resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lambda_layer_version_permission
+
+Provides a Lambda Layer Version Permission resource. It allows you to share you own Lambda Layers to another account by account ID, to all accounts in AWS organization or even to all AWS accounts.
+
+For information about Lambda Layer Permissions and how to use them, see [Using Resource-based Policies for AWS Lambda][1]
+
+~> **NOTE:** Setting `skipDestroy` to `true` means that the AWS Provider will _not_ destroy any layer version permission, even when running `terraform destroy`. Layer version permissions are thus intentional dangling resources that are _not_ managed by Terraform and may incur extra expense in your AWS account.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LambdaLayerVersionPermission } from "./.gen/providers/aws/lambda-layer-version-permission";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new LambdaLayerVersionPermission(this, "lambda_layer_permission", {
+      action: "lambda:GetLayerVersion",
+      layerName: "arn:aws:lambda:us-west-2:123456654321:layer:test_layer1",
+      principal: "111111111111",
+      statementId: "dev-account",
+      versionNumber: 1,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `action` - (Required) Action, which will be allowed. `lambda:getLayerVersion` value is suggested by AWS documantation.
+* `layerName` (Required) The name or ARN of the Lambda Layer, which you want to grant access to.
+* `organizationId` - (Optional) An identifier of AWS Organization, which should be able to use your Lambda Layer. `principal` should be equal to `*` if `organizationId` provided.
+* `principal` - (Required) AWS account ID which should be able to use your Lambda Layer. `*` can be used here, if you want to share your Lambda Layer widely.
+* `statementId` - (Required) The name of Lambda Layer Permission, for example `devAccount` - human readable note about what is this permission for.
+* `versionNumber` (Required) Version of Lambda Layer, which you want to grant access to. Note: permissions only apply to a single version of a layer.
+* `skipDestroy` - (Optional) Whether to retain the old version of a previously deployed Lambda Layer. Default is `false`. When this is not set to `true`, changing any of `compatibleArchitectures`, `compatibleRuntimes`, `description`, `filename`, `layerName`, `licenseInfo`, `s3Bucket`, `s3Key`, `s3ObjectVersion`, or `sourceCodeHash` forces deletion of the existing layer version and creation of a new layer version.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The `layerName` and `versionNumber`, separated by a comma (`,`).
+* `revisionId` - A unique identifier for the current revision of the policy.
+* `policy` - Full Lambda Layer Permission policy.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Lambda Layer Permissions using `layerName` and `versionNumber`, separated by a comma (`,`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Lambda Layer Permissions using `layerName` and `versionNumber`, separated by a comma (`,`). For example:
+
+```console
+% terraform import aws_lambda_layer_version_permission.example arn:aws:lambda:us-west-2:123456654321:layer:test_layer1,1
+```
+
+[1]: https://docs.aws.amazon.com/lambda/latest/dg/access-control-resource-based.html#permissions-resource-xaccountlayer
+
+<!-- cache-key: cdktf-0.18.0 input-fd22d59f7bda2ed8703c3b1fd6d5f0d467df5adf1b1fd76c0fa824d35f034051 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/lambda_permission.html.markdown b/website/docs/cdktf/typescript/r/lambda_permission.html.markdown
new file mode 100644
index 00000000000..0ede3512d12
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/lambda_permission.html.markdown
@@ -0,0 +1,373 @@
+---
+subcategory: "Lambda"
+layout: "aws"
+page_title: "AWS: aws_lambda_permission"
+description: |-
+  Creates a Lambda function permission.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lambda_permission
+
+Gives an external source (like an EventBridge Rule, SNS, or S3) permission to access the Lambda function.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { IamRole } from "./.gen/providers/aws/iam-role";
+import { LambdaAlias } from "./.gen/providers/aws/lambda-alias";
+import { LambdaFunction } from "./.gen/providers/aws/lambda-function";
+import { LambdaPermission } from "./.gen/providers/aws/lambda-permission";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const iamForLambda = new IamRole(this, "iam_for_lambda", {
+      assumeRolePolicy: Token.asString(
+        Fn.jsonencode({
+          Statement: [
+            {
+              Action: "sts:AssumeRole",
+              Effect: "Allow",
+              Principal: {
+                Service: "lambda.amazonaws.com",
+              },
+              Sid: "",
+            },
+          ],
+          Version: "2012-10-17",
+        })
+      ),
+      name: "iam_for_lambda",
+    });
+    const testLambda = new LambdaFunction(this, "test_lambda", {
+      filename: "lambdatest.zip",
+      functionName: "lambda_function_name",
+      handler: "exports.handler",
+      role: iamForLambda.arn,
+      runtime: "nodejs16.x",
+    });
+    const testAlias = new LambdaAlias(this, "test_alias", {
+      description: "a sample description",
+      functionName: testLambda.functionName,
+      functionVersion: "$LATEST",
+      name: "testalias",
+    });
+    new LambdaPermission(this, "allow_cloudwatch", {
+      action: "lambda:InvokeFunction",
+      functionName: testLambda.functionName,
+      principal: "events.amazonaws.com",
+      qualifier: testAlias.name,
+      sourceArn: "arn:aws:events:eu-west-1:111122223333:rule/RunDaily",
+      statementId: "AllowExecutionFromCloudWatch",
+    });
+  }
+}
+
+```
+
+### With SNS
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { IamRole } from "./.gen/providers/aws/iam-role";
+import { LambdaFunction } from "./.gen/providers/aws/lambda-function";
+import { LambdaPermission } from "./.gen/providers/aws/lambda-permission";
+import { SnsTopic } from "./.gen/providers/aws/sns-topic";
+import { SnsTopicSubscription } from "./.gen/providers/aws/sns-topic-subscription";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const defaultVar = new IamRole(this, "default", {
+      assumeRolePolicy: Token.asString(
+        Fn.jsonencode({
+          Statement: [
+            {
+              Action: "sts:AssumeRole",
+              Effect: "Allow",
+              Principal: {
+                Service: "lambda.amazonaws.com",
+              },
+              Sid: "",
+            },
+          ],
+          Version: "2012-10-17",
+        })
+      ),
+      name: "iam_for_lambda_with_sns",
+    });
+    const func = new LambdaFunction(this, "func", {
+      filename: "lambdatest.zip",
+      functionName: "lambda_called_from_sns",
+      handler: "exports.handler",
+      role: defaultVar.arn,
+      runtime: "python3.7",
+    });
+    const awsSnsTopicDefault = new SnsTopic(this, "default_2", {
+      name: "call-lambda-maybe",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSnsTopicDefault.overrideLogicalId("default");
+    new SnsTopicSubscription(this, "lambda", {
+      endpoint: func.arn,
+      protocol: "lambda",
+      topicArn: Token.asString(awsSnsTopicDefault.arn),
+    });
+    new LambdaPermission(this, "with_sns", {
+      action: "lambda:InvokeFunction",
+      functionName: func.functionName,
+      principal: "sns.amazonaws.com",
+      sourceArn: Token.asString(awsSnsTopicDefault.arn),
+      statementId: "AllowExecutionFromSNS",
+    });
+  }
+}
+
+```
+
+### With API Gateway REST API
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ApiGatewayRestApi } from "./.gen/providers/aws/api-gateway-rest-api";
+import { LambdaPermission } from "./.gen/providers/aws/lambda-permission";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const myDemoApi = new ApiGatewayRestApi(this, "MyDemoAPI", {
+      description: "This is my API for demonstration purposes",
+      name: "MyDemoAPI",
+    });
+    new LambdaPermission(this, "lambda_permission", {
+      action: "lambda:InvokeFunction",
+      functionName: "MyDemoFunction",
+      principal: "apigateway.amazonaws.com",
+      sourceArn: "${" + myDemoApi.executionArn + "}/*",
+      statementId: "AllowMyDemoAPIInvoke",
+    });
+  }
+}
+
+```
+
+### With CloudWatch Log Group
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudwatchLogGroup } from "./.gen/providers/aws/cloudwatch-log-group";
+import { CloudwatchLogSubscriptionFilter } from "./.gen/providers/aws/cloudwatch-log-subscription-filter";
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+import { LambdaFunction } from "./.gen/providers/aws/lambda-function";
+import { LambdaPermission } from "./.gen/providers/aws/lambda-permission";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const defaultVar = new CloudwatchLogGroup(this, "default", {
+      name: "/default",
+    });
+    const assumeRole = new DataAwsIamPolicyDocument(this, "assume_role", {
+      statement: [
+        {
+          actions: ["sts:AssumeRole"],
+          effect: "Allow",
+          principals: [
+            {
+              identifiers: ["lambda.amazonaws.com"],
+              type: "Service",
+            },
+          ],
+        },
+      ],
+    });
+    const awsIamRoleDefault = new IamRole(this, "default_2", {
+      assumeRolePolicy: Token.asString(assumeRole.json),
+      name: "iam_for_lambda_called_from_cloudwatch_logs",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamRoleDefault.overrideLogicalId("default");
+    const logging = new LambdaFunction(this, "logging", {
+      filename: "lamba_logging.zip",
+      functionName: "lambda_called_from_cloudwatch_logs",
+      handler: "exports.handler",
+      role: Token.asString(awsIamRoleDefault.arn),
+      runtime: "python3.7",
+    });
+    const awsLambdaPermissionLogging = new LambdaPermission(this, "logging_4", {
+      action: "lambda:InvokeFunction",
+      functionName: logging.functionName,
+      principal: "logs.eu-west-1.amazonaws.com",
+      sourceArn: "${" + defaultVar.arn + "}:*",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsLambdaPermissionLogging.overrideLogicalId("logging");
+    const awsCloudwatchLogSubscriptionFilterLogging =
+      new CloudwatchLogSubscriptionFilter(this, "logging_5", {
+        dependsOn: [awsLambdaPermissionLogging],
+        destinationArn: logging.arn,
+        filterPattern: "",
+        logGroupName: defaultVar.name,
+        name: "logging_default",
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsCloudwatchLogSubscriptionFilterLogging.overrideLogicalId("logging");
+  }
+}
+
+```
+
+### With Cross-Account Invocation Policy
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LambdaFunctionUrl } from "./.gen/providers/aws/lambda-function-url";
+import { LambdaPermission } from "./.gen/providers/aws/lambda-permission";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new LambdaFunctionUrl(this, "url", {
+      authorizationType: "AWS_IAM",
+      functionName: example.functionName,
+    });
+    const awsLambdaPermissionUrl = new LambdaPermission(this, "url_1", {
+      action: "lambda:InvokeFunctionUrl",
+      functionName: example.functionName,
+      functionUrlAuthType: "AWS_IAM",
+      principal: "arn:aws:iam::444455556666:role/example",
+      sourceAccount: "444455556666",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsLambdaPermissionUrl.overrideLogicalId("url");
+  }
+}
+
+```
+
+### With `replaceTriggeredBy` Lifecycle Configuration
+
+If omitting the `qualifier` argument (which forces re-creation each time a function version is published), a `lifecycle` block can be used to ensure permissions are re-applied on any change to the underlying function.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LambdaPermission } from "./.gen/providers/aws/lambda-permission";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new LambdaPermission(this, "logging", {
+      action: "lambda:InvokeFunction",
+      functionName: example.functionName,
+      lifecycle: {
+        replaceTriggeredBy: [example],
+      },
+      principal: "events.amazonaws.com",
+      sourceArn: "arn:aws:events:eu-west-1:111122223333:rule/RunDaily",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `action` - (Required) The AWS Lambda action you want to allow in this statement. (e.g., `lambda:invokeFunction`)
+* `eventSourceToken` - (Optional) The Event Source Token to validate.  Used with [Alexa Skills][1].
+* `functionName` - (Required) Name of the Lambda function whose resource policy you are updating
+* `functionUrlAuthType` - (Optional) Lambda Function URLs [authentication type][3]. Valid values are: `awsIam` or `none`. Only supported for `lambda:invokeFunctionUrl` action.
+* `principal` - (Required) The principal who is getting this permission e.g., `s3AmazonawsCom`, an AWS account ID, or AWS IAM principal, or AWS service principal such as `eventsAmazonawsCom` or `snsAmazonawsCom`.
+* `qualifier` - (Optional) Query parameter to specify function version or alias name. The permission will then apply to the specific qualified ARN e.g., `arn:aws:lambda:awsRegion:acctId:function:functionName:2`
+* `sourceAccount` - (Optional) This parameter is used when allowing cross-account access, or for S3 and SES. The AWS account ID (without a hyphen) of the source owner.
+* `sourceArn` - (Optional) When the principal is an AWS service, the ARN of the specific resource within that service to grant permission to.
+  Without this, any resource from `principal` will be granted permission – even if that resource is from another account.
+  For S3, this should be the ARN of the S3 Bucket.
+  For EventBridge events, this should be the ARN of the EventBridge Rule.
+  For API Gateway, this should be the ARN of the API, as described [here][2].
+* `statementId` - (Optional) A unique statement identifier. By default generated by Terraform.
+* `statementIdPrefix` - (Optional) A statement identifier prefix. Terraform will generate a unique suffix. Conflicts with `statementId`.
+* `principalOrgId` - (Optional) The identifier for your organization in AWS Organizations. Use this to grant permissions to all the AWS accounts under this organization.
+
+[1]: https://developer.amazon.com/docs/custom-skills/host-a-custom-skill-as-an-aws-lambda-function.html#use-aws-cli
+[2]: https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-control-access-using-iam-policies-to-invoke-api.html
+[3]: https://docs.aws.amazon.com/lambda/latest/dg/urls-auth.html
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Lambda permission statements using function_name/statement_id with an optional qualifier. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Lambda permission statements using function_name/statement_id with an optional qualifier. For example:
+
+```console
+% terraform import aws_lambda_permission.test_lambda_permission my_test_lambda_function/AllowExecutionFromCloudWatch
+```
+
+```console
+% terraform import aws_lambda_permission.test_lambda_permission my_test_lambda_function:qualifier_name/AllowExecutionFromCloudWatch
+```
+
+<!-- cache-key: cdktf-0.18.0 input-d4a2087f351c8ca4a69a59ef6d0c60e38de8ab53ebfbaae17642d9753dcbe762 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/lambda_provisioned_concurrency_config.html.markdown b/website/docs/cdktf/typescript/r/lambda_provisioned_concurrency_config.html.markdown
new file mode 100644
index 00000000000..8a279bebd48
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/lambda_provisioned_concurrency_config.html.markdown
@@ -0,0 +1,114 @@
+---
+subcategory: "Lambda"
+layout: "aws"
+page_title: "AWS: aws_lambda_provisioned_concurrency_config"
+description: |-
+  Manages a Lambda Provisioned Concurrency Configuration
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lambda_provisioned_concurrency_config
+
+Manages a Lambda Provisioned Concurrency Configuration.
+
+~> **NOTE:** Setting `skipDestroy` to `true` means that the AWS Provider will _not_ destroy a provisioned concurrency configuration, even when running `terraform destroy`. The configuration is thus an intentional dangling resource that is _not_ managed by Terraform and may incur extra expense in your AWS account.
+
+## Example Usage
+
+### Alias Name
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LambdaProvisionedConcurrencyConfig } from "./.gen/providers/aws/lambda-provisioned-concurrency-config";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new LambdaProvisionedConcurrencyConfig(this, "example", {
+      functionName: Token.asString(awsLambdaAliasExample.functionName),
+      provisionedConcurrentExecutions: 1,
+      qualifier: Token.asString(awsLambdaAliasExample.name),
+    });
+  }
+}
+
+```
+
+### Function Version
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LambdaProvisionedConcurrencyConfig } from "./.gen/providers/aws/lambda-provisioned-concurrency-config";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new LambdaProvisionedConcurrencyConfig(this, "example", {
+      functionName: Token.asString(awsLambdaFunctionExample.functionName),
+      provisionedConcurrentExecutions: 1,
+      qualifier: Token.asString(awsLambdaFunctionExample.version),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `functionName` - (Required) Name or Amazon Resource Name (ARN) of the Lambda Function.
+* `provisionedConcurrentExecutions` - (Required) Amount of capacity to allocate. Must be greater than or equal to `1`.
+* `qualifier` - (Required) Lambda Function version or Lambda Alias name.
+
+The following arguments are optional:
+
+* `skipDestroy` - (Optional) Whether to retain the provisoned concurrency configuration upon destruction. Defaults to `false`. If set to `true`, the resource in simply removed from state instead.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Lambda Function name and qualifier separated by a comma (`,`).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `15M`)
+* `update` - (Default `15M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import a Lambda Provisioned Concurrency Configuration using the `functionName` and `qualifier` separated by a comma (`,`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import a Lambda Provisioned Concurrency Configuration using the `functionName` and `qualifier` separated by a comma (`,`). For example:
+
+```console
+% terraform import aws_lambda_provisioned_concurrency_config.example my_function,production
+```
+
+<!-- cache-key: cdktf-0.18.0 input-6f3c5baf959ae98fc63cc91293e15ccc2810987cf437f55d4ec7eeaf83152ac9 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/launch_configuration.html.markdown b/website/docs/cdktf/typescript/r/launch_configuration.html.markdown
new file mode 100644
index 00000000000..c89737a63a4
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/launch_configuration.html.markdown
@@ -0,0 +1,297 @@
+---
+subcategory: "Auto Scaling"
+layout: "aws"
+page_title: "AWS: aws_launch_configuration"
+description: |-
+  Provides a resource to create a new launch configuration, used for autoscaling groups.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_launch_configuration
+
+Provides a resource to create a new launch configuration, used for autoscaling groups.
+
+!> **WARNING:** The use of launch configurations is discouraged in favour of launch templates. Read more in the [AWS EC2 Documentation](https://docs.aws.amazon.com/autoscaling/ec2/userguide/launch-configurations.html).
+
+-> **Note** When using `awsLaunchConfiguration` with `awsAutoscalingGroup`, it is recommended to use the `namePrefix` (Optional) instead of the `name` (Optional) attribute. This will allow Terraform lifecycles to detect changes to the launch configuration and update the autoscaling group correctly.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsAmi } from "./.gen/providers/aws/data-aws-ami";
+import { LaunchConfiguration } from "./.gen/providers/aws/launch-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const ubuntu = new DataAwsAmi(this, "ubuntu", {
+      filter: [
+        {
+          name: "name",
+          values: ["ubuntu/images/hvm-ssd/ubuntu-trusty-14.04-amd64-server-*"],
+        },
+        {
+          name: "virtualization-type",
+          values: ["hvm"],
+        },
+      ],
+      mostRecent: true,
+      owners: ["099720109477"],
+    });
+    new LaunchConfiguration(this, "as_conf", {
+      imageId: Token.asString(ubuntu.id),
+      instanceType: "t2.micro",
+      name: "web_config",
+    });
+  }
+}
+
+```
+
+## Using with AutoScaling Groups
+
+Launch Configurations cannot be updated after creation with the Amazon
+Web Service API. In order to update a Launch Configuration, Terraform will
+destroy the existing resource and create a replacement. In order to effectively
+use a Launch Configuration resource with an [AutoScaling Group resource][1],
+it's recommended to specify `createBeforeDestroy` in a [lifecycle][2] block.
+Either omit the Launch Configuration `name` attribute, or specify a partial name
+with `namePrefix`.  Example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AutoscalingGroup } from "./.gen/providers/aws/autoscaling-group";
+import { DataAwsAmi } from "./.gen/providers/aws/data-aws-ami";
+import { LaunchConfiguration } from "./.gen/providers/aws/launch-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const ubuntu = new DataAwsAmi(this, "ubuntu", {
+      filter: [
+        {
+          name: "name",
+          values: ["ubuntu/images/hvm-ssd/ubuntu-trusty-14.04-amd64-server-*"],
+        },
+        {
+          name: "virtualization-type",
+          values: ["hvm"],
+        },
+      ],
+      mostRecent: true,
+      owners: ["099720109477"],
+    });
+    const asConf = new LaunchConfiguration(this, "as_conf", {
+      imageId: Token.asString(ubuntu.id),
+      instanceType: "t2.micro",
+      lifecycle: {
+        createBeforeDestroy: true,
+      },
+      namePrefix: "terraform-lc-example-",
+    });
+    new AutoscalingGroup(this, "bar", {
+      launchConfiguration: asConf.name,
+      lifecycle: {
+        createBeforeDestroy: true,
+      },
+      maxSize: 2,
+      minSize: 1,
+      name: "terraform-asg-example",
+    });
+  }
+}
+
+```
+
+With this setup Terraform generates a unique name for your Launch
+Configuration and can then update the AutoScaling Group without conflict before
+destroying the previous Launch Configuration.
+
+## Using with Spot Instances
+
+Launch configurations can set the spot instance pricing to be used for the
+Auto Scaling Group to reserve instances. Simply specifying the `spotPrice`
+parameter will set the price on the Launch Configuration which will attempt to
+reserve your instances at this price.  See the [AWS Spot Instance
+documentation](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-spot-instances.html)
+for more information or how to launch [Spot Instances][3] with Terraform.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AutoscalingGroup } from "./.gen/providers/aws/autoscaling-group";
+import { DataAwsAmi } from "./.gen/providers/aws/data-aws-ami";
+import { LaunchConfiguration } from "./.gen/providers/aws/launch-configuration";
+interface MyConfig {
+  maxSize: any;
+  minSize: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    const ubuntu = new DataAwsAmi(this, "ubuntu", {
+      filter: [
+        {
+          name: "name",
+          values: ["ubuntu/images/hvm-ssd/ubuntu-trusty-14.04-amd64-server-*"],
+        },
+        {
+          name: "virtualization-type",
+          values: ["hvm"],
+        },
+      ],
+      mostRecent: true,
+      owners: ["099720109477"],
+    });
+    const asConf = new LaunchConfiguration(this, "as_conf", {
+      imageId: Token.asString(ubuntu.id),
+      instanceType: "m4.large",
+      lifecycle: {
+        createBeforeDestroy: true,
+      },
+      spotPrice: "0.001",
+    });
+    new AutoscalingGroup(this, "bar", {
+      launchConfiguration: asConf.name,
+      name: "terraform-asg-example",
+      maxSize: config.maxSize,
+      minSize: config.minSize,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `imageId` - (Required) The EC2 image ID to launch.
+* `instanceType` - (Required) The size of instance to launch.
+
+The following arguments are optional:
+
+* `associatePublicIpAddress` - (Optional) Associate a public ip address with an instance in a VPC.
+* `ebsBlockDevice` - (Optional) Additional EBS block devices to attach to the instance. See [Block Devices](#block-devices) below for details.
+* `ebsOptimized` - (Optional) If true, the launched EC2 instance will be EBS-optimized.
+* `enableMonitoring` - (Optional) Enables/disables detailed monitoring. This is enabled by default.
+* `ephemeralBlockDevice` - (Optional) Customize Ephemeral (also known as "Instance Store") volumes on the instance. See [Block Devices](#block-devices) below for details.
+* `iamInstanceProfile` - (Optional) The name attribute of the IAM instance profile to associate with launched instances.
+* `keyName` - (Optional) The key name that should be used for the instance.
+* `metadataOptions` - The metadata options for the instance.
+    * `httpEndpoint` - The state of the metadata service: `enabled`, `disabled`.
+    * `httpTokens` - If session tokens are required: `optional`, `required`.
+    * `httpPutResponseHopLimit` - The desired HTTP PUT response hop limit for instance metadata requests.
+* `name` - (Optional) The name of the launch configuration. If you leave this blank, Terraform will auto-generate a unique name. Conflicts with `namePrefix`.
+* `namePrefix` - (Optional) Creates a unique name beginning with the specified prefix. Conflicts with `name`.
+* `securityGroups` - (Optional) A list of associated security group IDS.
+* `placementTenancy` - (Optional) The tenancy of the instance. Valid values are `default` or `dedicated`, see [AWS's Create Launch Configuration](http://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_CreateLaunchConfiguration.html) for more details.
+* `rootBlockDevice` - (Optional) Customize details about the root block device of the instance. See [Block Devices](#block-devices) below for details.
+* `spotPrice` - (Optional; Default: On-demand price) The maximum price to use for reserving spot instances.
+* `userData` - (Optional) The user data to provide when launching the instance. Do not pass gzip-compressed data via this argument; see `userDataBase64` instead.
+* `userDataBase64` - (Optional) Can be used instead of `userData` to pass base64-encoded binary data directly. Use this instead of `userData` whenever the value is not a valid UTF-8 string. For example, gzip-encoded user data must be base64-encoded and passed via this argument to avoid corruption.
+
+## Block devices
+
+Each of the `*BlockDevice` attributes controls a portion of the AWS
+Launch Configuration's "Block Device Mapping". It's a good idea to familiarize yourself with [AWS's Block Device
+Mapping docs](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/block-device-mapping-concepts.html)
+to understand the implications of using these attributes.
+
+Each AWS Instance type has a different set of Instance Store block devices
+available for attachment. AWS [publishes a
+list](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/InstanceStorage.html#StorageOnInstanceTypes)
+of which ephemeral devices are available on each type. The devices are always
+identified by the `virtualName` in the format `ephemeral{0N}`.
+
+~> **NOTE:** Changes to `*BlockDevice` configuration of _existing_ resources
+cannot currently be detected by Terraform. After updating to block device
+configuration, resource recreation can be manually triggered by using the
+[`taint` command](https://www.terraform.io/docs/commands/taint.html).
+  
+### ebs_block_device
+
+Modifying any of the `ebsBlockDevice` settings requires resource replacement.
+
+* `deviceName` - (Required) The name of the device to mount.
+* `snapshotId` - (Optional) The Snapshot ID to mount.
+* `volumeType` - (Optional) The type of volume. Can be `standard`, `gp2`, `gp3`, `st1`, `sc1` or `io1`.
+* `volumeSize` - (Optional) The size of the volume in gigabytes.
+* `iops` - (Optional) The amount of provisioned
+  [IOPS](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-io-characteristics.html).
+  This must be set with a `volumeType` of `"io1"`.
+* `throughput` - (Optional) The throughput (MiBps) to provision for a `gp3` volume.
+* `deleteOnTermination` - (Optional) Whether the volume should be destroyed
+  on instance termination (Default: `true`).
+* `encrypted` - (Optional) Whether the volume should be encrypted or not. Defaults to `false`.
+* `noDevice` - (Optional) Whether the device in the block device mapping of the AMI is suppressed.
+
+### ephemeral_block_device
+
+* `deviceName` - (Required) The name of the block device to mount on the instance.
+* `noDevice` - (Optional) Whether the device in the block device mapping of the AMI is suppressed.
+* `virtualName` - (Optional) The [Instance Store Device Name](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/InstanceStorage.html#InstanceStoreDeviceNames).
+
+### root_block_device
+
+-> Modifying any of the `rootBlockDevice` settings requires resource replacement.
+
+* `deleteOnTermination` - (Optional) Whether the volume should be destroyed on instance termination. Defaults to `true`.
+* `encrypted` - (Optional) Whether the volume should be encrypted or not. Defaults to `false`.
+* `iops` - (Optional) The amount of provisioned [IOPS](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-io-characteristics.html). This must be set with a `volumeType` of `io1`.
+* `throughput` - (Optional) The throughput (MiBps) to provision for a `gp3` volume.
+* `volumeSize` - (Optional) The size of the volume in gigabytes.
+* `volumeType` - (Optional) The type of volume. Can be `standard`, `gp2`, `gp3`, `st1`, `sc1` or `io1`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the launch configuration.
+* `arn` - The Amazon Resource Name of the launch configuration.
+* `name` - The name of the launch configuration.
+
+[1]: /docs/providers/aws/r/autoscaling_group.html
+[2]: https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html
+[3]: /docs/providers/aws/r/spot_instance_request.html
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import launch configurations using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import launch configurations using the `name`. For example:
+
+```console
+% terraform import aws_launch_configuration.as_conf terraform-lg-123456
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1afc8a9c3b0aae557f61ece671e34889248cace0f6b278c49774c6baa830fa60 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/launch_template.html.markdown b/website/docs/cdktf/typescript/r/launch_template.html.markdown
new file mode 100644
index 00000000000..4e545eac48d
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/launch_template.html.markdown
@@ -0,0 +1,527 @@
+---
+subcategory: "EC2 (Elastic Compute Cloud)"
+layout: "aws"
+page_title: "AWS: aws_launch_template"
+description: |-
+  Provides an EC2 launch template resource. Can be used to create instances or auto scaling groups.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_launch_template
+
+Provides an EC2 launch template resource. Can be used to create instances or auto scaling groups.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, Fn, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LaunchTemplate } from "./.gen/providers/aws/launch-template";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new LaunchTemplate(this, "foo", {
+      blockDeviceMappings: [
+        {
+          deviceName: "/dev/sdf",
+          ebs: {
+            volumeSize: 20,
+          },
+        },
+      ],
+      capacityReservationSpecification: {
+        capacityReservationPreference: "open",
+      },
+      cpuOptions: {
+        coreCount: 4,
+        threadsPerCore: 2,
+      },
+      creditSpecification: {
+        cpuCredits: "standard",
+      },
+      disableApiStop: true,
+      disableApiTermination: true,
+      ebsOptimized: Token.asString(true),
+      elasticGpuSpecifications: [
+        {
+          type: "test",
+        },
+      ],
+      elasticInferenceAccelerator: {
+        type: "eia1.medium",
+      },
+      iamInstanceProfile: {
+        name: "test",
+      },
+      imageId: "ami-test",
+      instanceInitiatedShutdownBehavior: "terminate",
+      instanceMarketOptions: {
+        marketType: "spot",
+      },
+      instanceType: "t2.micro",
+      kernelId: "test",
+      keyName: "test",
+      licenseSpecification: [
+        {
+          licenseConfigurationArn:
+            "arn:aws:license-manager:eu-west-1:123456789012:license-configuration:lic-0123456789abcdef0123456789abcdef",
+        },
+      ],
+      metadataOptions: {
+        httpEndpoint: "enabled",
+        httpPutResponseHopLimit: 1,
+        httpTokens: "required",
+        instanceMetadataTags: "enabled",
+      },
+      monitoring: {
+        enabled: true,
+      },
+      name: "foo",
+      networkInterfaces: [
+        {
+          associatePublicIpAddress: Token.asString(true),
+        },
+      ],
+      placement: {
+        availabilityZone: "us-west-2a",
+      },
+      ramDiskId: "test",
+      tagSpecifications: [
+        {
+          resourceType: "instance",
+          tags: {
+            Name: "test",
+          },
+        },
+      ],
+      userData: Token.asString(Fn.filebase64("${path.module}/example.sh")),
+      vpcSecurityGroupIds: ["sg-12345678"],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `blockDeviceMappings` - (Optional) Specify volumes to attach to the instance besides the volumes specified by the AMI.
+  See [Block Devices](#block-devices) below for details.
+* `capacityReservationSpecification` - (Optional) Targeting for EC2 capacity reservations. See [Capacity Reservation Specification](#capacity-reservation-specification) below for more details.
+* `cpuOptions` - (Optional) The CPU options for the instance. See [CPU Options](#cpu-options) below for more details.
+* `creditSpecification` - (Optional) Customize the credit specification of the instance. See [Credit
+  Specification](#credit-specification) below for more details.
+* `defaultVersion` - (Optional) Default Version of the launch template.
+* `description` - (Optional) Description of the launch template.
+* `disableApiStop` - (Optional) If true, enables [EC2 Instance Stop Protection](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Stop_Start.html#Using_StopProtection).
+* `disableApiTermination` - (Optional) If `true`, enables [EC2 Instance
+  Termination Protection](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/terminating-instances.html#Using_ChangingDisableAPITermination)
+* `ebsOptimized` - (Optional) If `true`, the launched EC2 instance will be EBS-optimized.
+* `elasticGpuSpecifications` - (Optional) The elastic GPU to attach to the instance. See [Elastic GPU](#elastic-gpu)
+  below for more details.
+* `elasticInferenceAccelerator` - (Optional) Configuration block containing an Elastic Inference Accelerator to attach to the instance. See [Elastic Inference Accelerator](#elastic-inference-accelerator) below for more details.
+* `enclaveOptions` - (Optional) Enable Nitro Enclaves on launched instances. See [Enclave Options](#enclave-options) below for more details.
+* `hibernationOptions` - (Optional) The hibernation options for the instance. See [Hibernation Options](#hibernation-options) below for more details.
+* `iamInstanceProfile` - (Optional) The IAM Instance Profile to launch the instance with. See [Instance Profile](#instance-profile)
+  below for more details.
+* `imageId` - (Optional) The AMI from which to launch the instance.
+* `instanceInitiatedShutdownBehavior` - (Optional) Shutdown behavior for the instance. Can be `stop` or `terminate`.
+  (Default: `stop`).
+* `instanceMarketOptions` - (Optional) The market (purchasing) option for the instance. See [Market Options](#market-options)
+  below for details.
+* `instanceRequirements` - (Optional) The attribute requirements for the type of instance. If present then `instanceType` cannot be present.
+* `instanceType` - (Optional) The type of the instance. If present then `instanceRequirements` cannot be present.
+* `kernelId` - (Optional) The kernel ID.
+* `keyName` - (Optional) The key name to use for the instance.
+* `licenseSpecification` - (Optional) A list of license specifications to associate with. See [License Specification](#license-specification) below for more details.
+* `maintenanceOptions` - (Optional) The maintenance options for the instance. See [Maintenance Options](#maintenance-options) below for more details.
+* `metadataOptions` - (Optional) Customize the metadata options for the instance. See [Metadata Options](#metadata-options) below for more details.
+* `monitoring` - (Optional) The monitoring option for the instance. See [Monitoring](#monitoring) below for more details.
+* `name` - (Optional) The name of the launch template. If you leave this blank, Terraform will auto-generate a unique name.
+* `namePrefix` - (Optional) Creates a unique name beginning with the specified prefix. Conflicts with `name`.
+* `networkInterfaces` - (Optional) Customize network interfaces to be attached at instance boot time. See [Network
+  Interfaces](#network-interfaces) below for more details.
+* `placement` - (Optional) The placement of the instance. See [Placement](#placement) below for more details.
+* `privateDnsNameOptions` - (Optional) The options for the instance hostname. The default values are inherited from the subnet. See [Private DNS Name Options](#private-dns-name-options) below for more details.
+* `ramDiskId` - (Optional) The ID of the RAM disk.
+* `securityGroupNames` - (Optional) A list of security group names to associate with. If you are creating Instances in a VPC, use
+  `vpcSecurityGroupIds` instead.
+* `tagSpecifications` - (Optional) The tags to apply to the resources during launch. See [Tag Specifications](#tag-specifications) below for more details.
+* `tags` - (Optional) A map of tags to assign to the launch template. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `updateDefaultVersion` - (Optional) Whether to update Default Version each update. Conflicts with `defaultVersion`.
+* `userData` - (Optional) The base64-encoded user data to provide when launching the instance.
+* `vpcSecurityGroupIds` - (Optional) A list of security group IDs to associate with. Conflicts with `networkInterfacesSecurityGroups`
+
+### Block devices
+
+Configure additional volumes of the instance besides specified by the AMI. It's a good idea to familiarize yourself with
+  [AWS's Block Device Mapping docs](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/block-device-mapping-concepts.html)
+  to understand the implications of using these attributes.
+
+To find out more information for an existing AMI to override the configuration, such as `deviceName`, you can use the [AWS CLI ec2 describe-images command](https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-images.html).
+
+Each `blockDeviceMappings` supports the following:
+
+* `deviceName` - (Required) The name of the device to mount.
+* `ebs` - (Optional) Configure EBS volume properties.
+* `noDevice` - (Optional) Suppresses the specified device included in the AMI's block device mapping.
+* `virtualName` - (Optional) The [Instance Store Device
+  Name](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/InstanceStorage.html#InstanceStoreDeviceNames)
+  (e.g., `"ephemeral0"`).
+
+The `ebs` block supports the following:
+
+* `deleteOnTermination` - (Optional) Whether the volume should be destroyed on instance termination.
+  See [Preserving Amazon EBS Volumes on Instance Termination](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/terminating-instances.html#preserving-volumes-on-termination) for more information.
+* `encrypted` - (Optional) Enables [EBS encryption](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html) on the volume.
+  Cannot be used with `snapshotId`.
+* `iops` - (Optional) The amount of provisioned [IOPS](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-io-characteristics.html).
+  This must be set with a `volumeType` of `"io1/io2/gp3"`.
+* `kmsKeyId` - (Optional) The ARN of the AWS Key Management Service (AWS KMS) customer master key (CMK) to use when creating the encrypted volume.
+  `encrypted` must be set to `true` when this is set.
+* `snapshotId` - (Optional) The Snapshot ID to mount.
+* `throughput` - (Optional) The throughput to provision for a `gp3` volume in MiB/s (specified as an integer, e.g., 500), with a maximum of 1,000 MiB/s.
+* `volumeSize` - (Optional) The size of the volume in gigabytes.
+* `volumeType` - (Optional) The volume type.
+  Can be one of `standard`, `gp2`, `gp3`, `io1`, `io2`, `sc1` or `st1`.
+
+### Capacity Reservation Specification
+
+The `capacityReservationSpecification` block supports the following:
+
+* `capacityReservationPreference` - Indicates the instance's Capacity Reservation preferences. Can be `open` or `none`. (Default `none`).
+* `capacityReservationTarget` - Used to target a specific Capacity Reservation:
+
+The `capacityReservationTarget` block supports the following:
+
+* `capacityReservationId` - The ID of the Capacity Reservation in which to run the instance.
+* `capacityReservationResourceGroupArn` - The ARN of the Capacity Reservation resource group in which to run the instance.
+
+### CPU Options
+
+The `cpuOptions` block supports the following:
+
+* `amdSevSnp` - Indicates whether to enable the instance for AMD SEV-SNP. AMD SEV-SNP is supported with M6a, R6a, and C6a instance types only. Valid values are `enabled` and `disabled`.
+* `coreCount` - The number of CPU cores for the instance.
+* `threadsPerCore` - The number of threads per CPU core.
+  To disable Intel Hyper-Threading Technology for the instance, specify a value of 1.
+  Otherwise, specify the default value of 2.
+
+Both number of CPU cores and threads per core must be specified. Valid number of CPU cores and threads per core for the instance type can be found in the [CPU Options Documentation](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-optimize-cpu.html?shortFooter=true#cpu-options-supported-instances-values)
+
+### Credit Specification
+
+Credit specification can be applied/modified to the EC2 Instance at any time.
+
+The `creditSpecification` block supports the following:
+
+* `cpuCredits` - The credit option for CPU usage.
+  Can be `standard` or `unlimited`.
+  T3 instances are launched as `unlimited` by default.
+  T2 instances are launched as `standard` by default.
+
+### Elastic GPU
+
+Attach an elastic GPU the instance.
+
+The `elasticGpuSpecifications` block supports the following:
+
+* `type` - The [Elastic GPU Type](https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/elastic-gpus.html#elastic-gpus-basics)
+
+### Elastic Inference Accelerator
+
+Attach an Elastic Inference Accelerator to the instance. Additional information about Elastic Inference in EC2 can be found in the [EC2 User Guide](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/elastic-inference.html).
+
+The `elasticInferenceAccelerator` configuration block supports the following:
+
+* `type` - (Required) Accelerator type.
+
+### Enclave Options
+
+The `enclaveOptions` block supports the following:
+
+* `enabled` - If set to `true`, Nitro Enclaves will be enabled on the instance.
+
+For more information, see the documentation on [Nitro Enclaves](https://docs.aws.amazon.com/enclaves/latest/user/nitro-enclave.html).
+
+### Hibernation Options
+
+The `hibernationOptions` block supports the following:
+
+* `configured` - If set to `true`, the launched EC2 instance will hibernation enabled.
+
+### Instance Profile
+
+The [IAM Instance Profile](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2_instance-profiles.html)
+to attach.
+
+The `iamInstanceProfile` block supports the following:
+
+* `arn` - The Amazon Resource Name (ARN) of the instance profile.
+* `name` - The name of the instance profile.
+
+### Instance Requirements
+
+This configuration block supports the following:
+
+~> **NOTE:** Both `memoryMibMin` and `vcpuCountMin` must be specified.
+
+* `acceleratorCount` - (Optional) Block describing the minimum and maximum number of accelerators (GPUs, FPGAs, or AWS Inferentia chips). Default is no minimum or maximum.
+    * `min` - (Optional) Minimum.
+    * `max` - (Optional) Maximum. Set to `0` to exclude instance types with accelerators.
+* `acceleratorManufacturers` - (Optional) List of accelerator manufacturer names. Default is any manufacturer.
+
+    ```
+    Valid names:
+      * amazon-web-services
+      * amd
+      * nvidia
+      * xilinx
+    ```
+
+* `acceleratorNames` - (Optional) List of accelerator names. Default is any acclerator.
+
+    ```
+    Valid names:
+      * a100            - NVIDIA A100 GPUs
+      * v100            - NVIDIA V100 GPUs
+      * k80             - NVIDIA K80 GPUs
+      * t4              - NVIDIA T4 GPUs
+      * m60             - NVIDIA M60 GPUs
+      * radeon-pro-v520 - AMD Radeon Pro V520 GPUs
+      * vu9p            - Xilinx VU9P FPGAs
+    ```
+
+* `acceleratorTotalMemoryMib` - (Optional) Block describing the minimum and maximum total memory of the accelerators. Default is no minimum or maximum.
+    * `min` - (Optional) Minimum.
+    * `max` - (Optional) Maximum.
+* `acceleratorTypes` - (Optional) List of accelerator types. Default is any accelerator type.
+
+    ```
+    Valid types:
+      * fpga
+      * gpu
+      * inference
+    ```
+
+* `allowedInstanceTypes` - (Optional) List of instance types to apply your specified attributes against. All other instance types are ignored, even if they match your specified attributes. You can use strings with one or more wild cards, represented by an asterisk (\*), to allow an instance type, size, or generation. The following are examples: `m58Xlarge`, `c5*.*`, `m5A.*`, `r*`, `*3*`. For example, if you specify `c5*`, you are allowing the entire C5 instance family, which includes all C5a and C5n instance types. If you specify `m5A.*`, you are allowing all the M5a instance types, but not the M5n instance types. Maximum of 400 entries in the list; each entry is limited to 30 characters. Default is all instance types.
+
+    ~> **NOTE:** If you specify `allowedInstanceTypes`, you can't specify `excludedInstanceTypes`.
+
+* `bareMetal` - (Optional) Indicate whether bare metal instace types should be `included`, `excluded`, or `required`. Default is `excluded`.
+* `baselineEbsBandwidthMbps` - (Optional) Block describing the minimum and maximum baseline EBS bandwidth, in Mbps. Default is no minimum or maximum.
+    * `min` - (Optional) Minimum.
+    * `max` - (Optional) Maximum.
+* `burstablePerformance` - (Optional) Indicate whether burstable performance instance types should be `included`, `excluded`, or `required`. Default is `excluded`.
+* `cpuManufacturers` (Optional) List of CPU manufacturer names. Default is any manufacturer.
+
+    ~> **NOTE:** Don't confuse the CPU hardware manufacturer with the CPU hardware architecture. Instances will be launched with a compatible CPU architecture based on the Amazon Machine Image (AMI) that you specify in your launch template.
+
+    ```
+    Valid names:
+      * amazon-web-services
+      * amd
+      * intel
+    ```
+
+* `excludedInstanceTypes` - (Optional) List of instance types to exclude. You can use strings with one or more wild cards, represented by an asterisk (\*), to exclude an instance type, size, or generation. The following are examples: `m58Xlarge`, `c5*.*`, `m5A.*`, `r*`, `*3*`. For example, if you specify `c5*`, you are excluding the entire C5 instance family, which includes all C5a and C5n instance types. If you specify `m5A.*`, you are excluding all the M5a instance types, but not the M5n instance types. Maximum of 400 entries in the list; each entry is limited to 30 characters. Default is no excluded instance types.
+
+    ~> **NOTE:** If you specify `excludedInstanceTypes`, you can't specify `allowedInstanceTypes`.
+
+* `instanceGenerations` - (Optional) List of instance generation names. Default is any generation.
+
+    ```
+    Valid names:
+      * current  - Recommended for best performance.
+      * previous - For existing applications optimized for older instance types.
+    ```
+
+* `localStorage` - (Optional) Indicate whether instance types with local storage volumes are `included`, `excluded`, or `required`. Default is `included`.
+* `localStorageTypes` - (Optional) List of local storage type names. Default any storage type.
+
+    ```
+    Value names:
+      * hdd - hard disk drive
+      * ssd - solid state drive
+    ```
+
+* `memoryGibPerVcpu` - (Optional) Block describing the minimum and maximum amount of memory (GiB) per vCPU. Default is no minimum or maximum.
+    * `min` - (Optional) Minimum. May be a decimal number, e.g. `05`.
+    * `max` - (Optional) Maximum. May be a decimal number, e.g. `05`.
+* `memoryMib` - (Required) Block describing the minimum and maximum amount of memory (MiB). Default is no maximum.
+    * `min` - (Required) Minimum.
+    * `max` - (Optional) Maximum.
+* `networkBandwidthGbps` - (Optional) Block describing the minimum and maximum amount of network bandwidth, in gigabits per second (Gbps). Default is no minimum or maximum.
+    * `min` - (Optional) Minimum.
+    * `max` - (Optional) Maximum.
+* `networkInterfaceCount` - (Optional) Block describing the minimum and maximum number of network interfaces. Default is no minimum or maximum.
+    * `min` - (Optional) Minimum.
+    * `max` - (Optional) Maximum.
+* `onDemandMaxPricePercentageOverLowestPrice` - (Optional) The price protection threshold for On-Demand Instances. This is the maximum you’ll pay for an On-Demand Instance, expressed as a percentage higher than the cheapest M, C, or R instance type with your specified attributes. When Amazon EC2 Auto Scaling selects instance types with your attributes, we will exclude instance types whose price is higher than your threshold. The parameter accepts an integer, which Amazon EC2 Auto Scaling interprets as a percentage. To turn off price protection, specify a high value, such as 999999. Default is 20.
+
+    If you set DesiredCapacityType to vcpu or memory-mib, the price protection threshold is applied based on the per vCPU or per memory price instead of the per instance price.
+* `requireHibernateSupport` - (Optional) Indicate whether instance types must support On-Demand Instance Hibernation, either `true` or `false`. Default is `false`.
+* `spotMaxPricePercentageOverLowestPrice` - (Optional) The price protection threshold for Spot Instances. This is the maximum you’ll pay for a Spot Instance, expressed as a percentage higher than the cheapest M, C, or R instance type with your specified attributes. When Amazon EC2 Auto Scaling selects instance types with your attributes, we will exclude instance types whose price is higher than your threshold. The parameter accepts an integer, which Amazon EC2 Auto Scaling interprets as a percentage. To turn off price protection, specify a high value, such as 999999. Default is 100.
+
+    If you set DesiredCapacityType to vcpu or memory-mib, the price protection threshold is applied based on the per vCPU or per memory price instead of the per instance price.
+* `totalLocalStorageGb` - (Optional) Block describing the minimum and maximum total local storage (GB). Default is no minimum or maximum.
+    * `min` - (Optional) Minimum. May be a decimal number, e.g. `05`.
+    * `max` - (Optional) Maximum. May be a decimal number, e.g. `05`.
+* `vcpuCount` - (Required) Block describing the minimum and maximum number of vCPUs. Default is no maximum.
+    * `min` - (Required) Minimum.
+    * `max` - (Optional) Maximum.
+
+### License Specification
+
+Associate one of more license configurations.
+
+The `licenseSpecification` block supports the following:
+
+* `licenseConfigurationArn` - (Required) ARN of the license configuration.
+
+### Maintenance Options
+
+The `maintenanceOptions` block supports the following:
+
+* `autoRecovery` - (Optional) Disables the automatic recovery behavior of your instance or sets it to default. Can be `"default"` or `"disabled"`. See [Recover your instance](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-recover.html) for more details.
+
+### Market Options
+
+The market (purchasing) option for the instances.
+
+The `instanceMarketOptions` block supports the following:
+
+* `marketType` - The market type. Can be `spot`.
+* `spotOptions` - The options for [Spot Instance](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-spot-instances.html)
+
+The `spotOptions` block supports the following:
+
+* `blockDurationMinutes` - The required duration in minutes. This value must be a multiple of 60.
+* `instanceInterruptionBehavior` - The behavior when a Spot Instance is interrupted. Can be `hibernate`,
+  `stop`, or `terminate`. (Default: `terminate`).
+* `maxPrice` - The maximum hourly price you're willing to pay for the Spot Instances.
+* `spotInstanceType` - The Spot Instance request type. Can be `oneTime`, or `persistent`.
+* `validUntil` - The end date of the request.
+
+### Metadata Options
+
+The metadata options for the instances.
+
+The `metadataOptions` block supports the following:
+
+* `httpEndpoint` - (Optional) Whether the metadata service is available. Can be `"enabled"` or `"disabled"`. (Default: `"enabled"`).
+* `httpTokens` - (Optional) Whether or not the metadata service requires session tokens, also referred to as _Instance Metadata Service Version 2 (IMDSv2)_. Can be `"optional"` or `"required"`. (Default: `"optional"`).
+* `httpPutResponseHopLimit` - (Optional) The desired HTTP PUT response hop limit for instance metadata requests. The larger the number, the further instance metadata requests can travel. Can be an integer from `1` to `64`. (Default: `1`).
+* `httpProtocolIpv6` - (Optional) Enables or disables the IPv6 endpoint for the instance metadata service. Can be `"enabled"` or `"disabled"`.
+* `instanceMetadataTags` - (Optional) Enables or disables access to instance tags from the instance metadata service. Can be `"enabled"` or `"disabled"`.
+
+For more information, see the documentation on the [Instance Metadata Service](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html).
+
+### Monitoring
+
+The `monitoring` block supports the following:
+
+* `enabled` - If `true`, the launched EC2 instance will have detailed monitoring enabled.
+
+### Network Interfaces
+
+Attaches one or more [Network Interfaces](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-eni.html) to the instance.
+
+Check limitations for autoscaling group in [Creating an Auto Scaling Group Using a Launch Template Guide](https://docs.aws.amazon.com/autoscaling/ec2/userguide/create-asg-launch-template.html#limitations)
+
+Each `networkInterfaces` block supports the following:
+
+* `associateCarrierIpAddress` - (Optional) Associate a Carrier IP address with `eth0` for a new network interface.
+  Use this option when you launch an instance in a Wavelength Zone and want to associate a Carrier IP address with the network interface.
+  Boolean value, can be left unset.
+* `associatePublicIpAddress` - (Optional) Associate a public ip address with the network interface.
+  Boolean value, can be left unset.
+* `deleteOnTermination` - (Optional) Whether the network interface should be destroyed on instance termination.
+* `description` - (Optional) Description of the network interface.
+* `deviceIndex` - (Optional) The integer index of the network interface attachment.
+* `interfaceType` - (Optional) The type of network interface. To create an Elastic Fabric Adapter (EFA), specify `efa`.
+* `ipv4PrefixCount` - (Optional) The number of IPv4 prefixes to be automatically assigned to the network interface. Conflicts with `ipv4Prefixes`
+* `ipv4Prefixes` - (Optional) One or more IPv4 prefixes to be assigned to the network interface. Conflicts with `ipv4PrefixCount`
+* `ipv6Addresses` - (Optional) One or more specific IPv6 addresses from the IPv6 CIDR block range of your subnet. Conflicts with `ipv6AddressCount`
+* `ipv6AddressCount` - (Optional) The number of IPv6 addresses to assign to a network interface. Conflicts with `ipv6Addresses`
+* `ipv6PrefixCount` - (Optional) The number of IPv6 prefixes to be automatically assigned to the network interface. Conflicts with `ipv6Prefixes`
+* `ipv6Prefixes` - (Optional) One or more IPv6 prefixes to be assigned to the network interface. Conflicts with `ipv6PrefixCount`
+* `networkInterfaceId` - (Optional) The ID of the network interface to attach.
+* `networkCardIndex` - (Optional) The index of the network card. Some instance types support multiple network cards. The primary network interface must be assigned to network card index 0. The default is network card index 0.
+* `privateIpAddress` - (Optional) The primary private IPv4 address.
+* `ipv4AddressCount` - (Optional) The number of secondary private IPv4 addresses to assign to a network interface. Conflicts with `ipv4Addresses`
+* `ipv4Addresses` - (Optional) One or more private IPv4 addresses to associate. Conflicts with `ipv4AddressCount`
+* `securityGroups` - (Optional) A list of security group IDs to associate.
+* `subnetId` - (Optional) The VPC Subnet ID to associate.
+
+### Placement
+
+The [Placement Group](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/placement-groups.html) of the instance.
+
+The `placement` block supports the following:
+
+* `affinity` - (Optional) The affinity setting for an instance on a Dedicated Host.
+* `availabilityZone` - (Optional) The Availability Zone for the instance.
+* `groupName` - (Optional) The name of the placement group for the instance.
+* `hostId` - (Optional) The ID of the Dedicated Host for the instance.
+* `hostResourceGroupArn` - (Optional) The ARN of the Host Resource Group in which to launch instances.
+* `spreadDomain` - (Optional) Reserved for future use.
+* `tenancy` - (Optional) The tenancy of the instance (if the instance is running in a VPC). Can be `default`, `dedicated`, or `host`.
+* `partitionNumber` - (Optional) The number of the partition the instance should launch in. Valid only if the placement group strategy is set to partition.
+
+### Private DNS Name Options
+
+The `privateDnsNameOptions` block supports the following:
+
+* `enableResourceNameDnsAaaaRecord` - (Optional) Indicates whether to respond to DNS queries for instance hostnames with DNS AAAA records.
+* `enableResourceNameDnsARecord` - (Optional) Indicates whether to respond to DNS queries for instance hostnames with DNS A records.
+* `hostnameType` - (Optional) The type of hostname for Amazon EC2 instances. For IPv4 only subnets, an instance DNS name must be based on the instance IPv4 address. For IPv6 native subnets, an instance DNS name must be based on the instance ID. For dual-stack subnets, you can specify whether DNS names use the instance IPv4 address or the instance ID. Valid values: `ipName` and `resourceName`.
+
+### Tag Specifications
+
+The tags to apply to the resources during launch. You can tag instances, volumes, elastic GPUs and spot instance requests. More information can be found in the [EC2 API documentation](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_LaunchTemplateTagSpecificationRequest.html).
+
+Each `tagSpecifications` block supports the following:
+
+* `resourceType` - (Optional) The type of resource to tag.
+* `tags` -(Optional)  A map of tags to assign to the resource.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the launch template.
+* `id` - The ID of the launch template.
+* `latestVersion` - The latest version of the launch template.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Launch Templates using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Launch Templates using the `id`. For example:
+
+```console
+% terraform import aws_launch_template.web lt-12345678
+```
+
+<!-- cache-key: cdktf-0.18.0 input-a5333efb037c0df523bc8a52b27bb2917c678c42feabe7b2e32815b125c04e27 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/lb.html.markdown b/website/docs/cdktf/typescript/r/lb.html.markdown
new file mode 100644
index 00000000000..0713cc250c0
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/lb.html.markdown
@@ -0,0 +1,244 @@
+---
+subcategory: "ELB (Elastic Load Balancing)"
+layout: "aws"
+page_title: "AWS: aws_lb"
+description: |-
+  Provides a Load Balancer resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lb
+
+Provides a Load Balancer resource.
+
+~> **Note:** `awsAlb` is known as `awsLb`. The functionality is identical.
+
+## Example Usage
+
+### Application Load Balancer
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Lb } from "./.gen/providers/aws/lb";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Lb(this, "test", {
+      accessLogs: {
+        bucket: lbLogs.id,
+        enabled: true,
+        prefix: "test-lb",
+      },
+      enableDeletionProtection: true,
+      internal: false,
+      loadBalancerType: "application",
+      name: "test-lb-tf",
+      securityGroups: [lbSg.id],
+      subnets: Token.asList(
+        "${[ for subnet in ${" + public.fqn + "} : subnet.id]}"
+      ),
+      tags: {
+        Environment: "production",
+      },
+    });
+  }
+}
+
+```
+
+### Network Load Balancer
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Lb } from "./.gen/providers/aws/lb";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Lb(this, "test", {
+      enableDeletionProtection: true,
+      internal: false,
+      loadBalancerType: "network",
+      name: "test-lb-tf",
+      subnets: Token.asList(
+        "${[ for subnet in ${" + public.fqn + "} : subnet.id]}"
+      ),
+      tags: {
+        Environment: "production",
+      },
+    });
+  }
+}
+
+```
+
+### Specifying Elastic IPs
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Lb } from "./.gen/providers/aws/lb";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Lb(this, "example", {
+      loadBalancerType: "network",
+      name: "example",
+      subnetMapping: [
+        {
+          allocationId: example1.id,
+          subnetId: Token.asString(awsSubnetExample1.id),
+        },
+        {
+          allocationId: example2.id,
+          subnetId: Token.asString(awsSubnetExample2.id),
+        },
+      ],
+    });
+  }
+}
+
+```
+
+### Specifying private IP addresses for an internal-facing load balancer
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Lb } from "./.gen/providers/aws/lb";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Lb(this, "example", {
+      loadBalancerType: "network",
+      name: "example",
+      subnetMapping: [
+        {
+          privateIpv4Address: "10.0.1.15",
+          subnetId: example1.id,
+        },
+        {
+          privateIpv4Address: "10.0.2.15",
+          subnetId: example2.id,
+        },
+      ],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+~> **NOTE:** Please note that internal LBs can only use `ipv4` as the `ipAddressType`. You can only change to `dualstack` `ipAddressType` if the selected subnets are IPv6 enabled.
+
+~> **NOTE:** Please note that one of either `subnets` or `subnetMapping` is required.
+
+This resource supports the following arguments:
+
+* `accessLogs` - (Optional) An Access Logs block. Access Logs documented below.
+* `customerOwnedIpv4Pool` - (Optional) The ID of the customer owned ipv4 pool to use for this load balancer.
+* `desyncMitigationMode` - (Optional) Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
+* `dnsRecordClientRoutingPolicy` - (Optional) Indicates how traffic is distributed among the load balancer Availability Zones. Possible values are `anyAvailabilityZone` (default), `availabilityZoneAffinity`, or `partialAvailabilityZoneAffinity`. See   [Availability Zone DNS affinity](https://docs.aws.amazon.com/elasticloadbalancing/latest/network/network-load-balancers.html#zonal-dns-affinity) for additional details. Only valid for `network` type load balancers.
+* `dropInvalidHeaderFields` - (Optional) Indicates whether HTTP headers with header fields that are not valid are removed by the load balancer (true) or routed to targets (false). The default is false. Elastic Load Balancing requires that message header names contain only alphanumeric characters and hyphens. Only valid for Load Balancers of type `application`.
+* `enableCrossZoneLoadBalancing` - (Optional) If true, cross-zone load balancing of the load balancer will be enabled. For `network` and `gateway` type load balancers, this feature is disabled by default (`false`). For `application` load balancer this feature is always enabled (`true`) and cannot be disabled. Defaults to `false`.
+* `enableDeletionProtection` - (Optional) If true, deletion of the load balancer will be disabled via the AWS API. This will prevent Terraform from deleting the load balancer. Defaults to `false`.
+* `enableHttp2` - (Optional) Indicates whether HTTP/2 is enabled in `application` load balancers. Defaults to `true`.
+* `enableTlsVersionAndCipherSuiteHeaders` - (Optional) Indicates whether the two headers (`xAmznTlsVersion` and `xAmznTlsCipherSuite`), which contain information about the negotiated TLS version and cipher suite, are added to the client request before sending it to the target. Only valid for Load Balancers of type `application`. Defaults to `false`
+* `enableXffClientPort` - (Optional) Indicates whether the X-Forwarded-For header should preserve the source port that the client used to connect to the load balancer in `application` load balancers. Defaults to `false`.
+* `enableWafFailOpen` - (Optional) Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. Defaults to `false`.
+* `idleTimeout` - (Optional) The time in seconds that the connection is allowed to be idle. Only valid for Load Balancers of type `application`. Default: 60.
+* `internal` - (Optional) If true, the LB will be internal. Defaults to `false`.
+* `ipAddressType` - (Optional) The type of IP addresses used by the subnets for your load balancer. The possible values are `ipv4` and `dualstack`.
+* `loadBalancerType` - (Optional) The type of load balancer to create. Possible values are `application`, `gateway`, or `network`. The default value is `application`.
+* `name` - (Optional) The name of the LB. This name must be unique within your AWS account, can have a maximum of 32 characters,
+must contain only alphanumeric characters or hyphens, and must not begin or end with a hyphen. If not specified,
+Terraform will autogenerate a name beginning with `tfLb`.
+* `namePrefix` - (Optional) Creates a unique name beginning with the specified prefix. Conflicts with `name`.
+* `securityGroups` - (Optional) A list of security group IDs to assign to the LB. Only valid for Load Balancers of type `application` or `network`. For load balancers of type `network` security groups cannot be added if none are currently present, and cannot all be removed once added. If either of these conditions are met, this will force a recreation of the resource.
+* `preserveHostHeader` - (Optional) Indicates whether the Application Load Balancer should preserve the Host header in the HTTP request and send it to the target without any change. Defaults to `false`.
+* `subnetMapping` - (Optional) A subnet mapping block as documented below.
+* `subnets` - (Optional) A list of subnet IDs to attach to the LB. Subnets
+cannot be updated for Load Balancers of type `network`. Changing this value
+for load balancers of type `network` will force a recreation of the resource.
+* `xffHeaderProcessingMode` - (Optional) Determines how the load balancer modifies the `xForwardedFor` header in the HTTP request before sending the request to the target. The possible values are `append`, `preserve`, and `remove`. Only valid for Load Balancers of type `application`. The default is `append`.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### access_logs
+
+* `bucket` - (Required) The S3 bucket name to store the logs in.
+* `enabled` - (Optional) Boolean to enable / disable `accessLogs`. Defaults to `false`, even when `bucket` is specified.
+* `prefix` - (Optional) The S3 bucket prefix. Logs are stored in the root if not configured.
+
+### subnet_mapping
+
+* `subnetId` - (Required) ID of the subnet of which to attach to the load balancer. You can specify only one subnet per Availability Zone.
+* `allocationId` - (Optional) The allocation ID of the Elastic IP address for an internet-facing load balancer.
+* `ipv6Address` - (Optional) The IPv6 address. You associate IPv6 CIDR blocks with your VPC and choose the subnets where you launch both internet-facing and internal Application Load Balancers or Network Load Balancers.
+* `privateIpv4Address` - (Optional) The private IPv4 address for an internal load balancer.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the load balancer (matches `id`).
+* `arnSuffix` - The ARN suffix for use with CloudWatch Metrics.
+* `dnsName` - The DNS name of the load balancer.
+* `id` - The ARN of the load balancer (matches `arn`).
+* `subnetMapping.*OutpostId` - ID of the Outpost containing the load balancer.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `zoneId` - The canonical hosted zone ID of the load balancer (to be used in a Route 53 Alias record).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `10M`)
+- `update` - (Default `10M`)
+- `delete` - (Default `10M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import LBs using their ARN. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import LBs using their ARN. For example:
+
+```console
+% terraform import aws_lb.bar arn:aws:elasticloadbalancing:us-west-2:123456789012:loadbalancer/app/my-load-balancer/50dc6c495c0c9188
+```
+
+<!-- cache-key: cdktf-0.18.0 input-11d928929bb1ef617daceb855e42b2dfca81e2f529334101c305ff8082f913d7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/lb_cookie_stickiness_policy.html.markdown b/website/docs/cdktf/typescript/r/lb_cookie_stickiness_policy.html.markdown
new file mode 100644
index 00000000000..2956fed3f54
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/lb_cookie_stickiness_policy.html.markdown
@@ -0,0 +1,76 @@
+---
+subcategory: "ELB Classic"
+layout: "aws"
+page_title: "AWS: aws_lb_cookie_stickiness_policy"
+description: |-
+  Provides a load balancer cookie stickiness policy, which allows an ELB to control the sticky session lifetime of the browser.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lb_cookie_stickiness_policy
+
+Provides a load balancer cookie stickiness policy, which allows an ELB to control the sticky session lifetime of the browser.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Elb } from "./.gen/providers/aws/elb";
+import { LbCookieStickinessPolicy } from "./.gen/providers/aws/lb-cookie-stickiness-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const lb = new Elb(this, "lb", {
+      availabilityZones: ["us-east-1a"],
+      listener: [
+        {
+          instancePort: 8000,
+          instanceProtocol: "http",
+          lbPort: 80,
+          lbProtocol: "http",
+        },
+      ],
+      name: "test-lb",
+    });
+    new LbCookieStickinessPolicy(this, "foo", {
+      cookieExpirationPeriod: 600,
+      lbPort: 80,
+      loadBalancer: lb.id,
+      name: "foo-policy",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the stickiness policy.
+* `loadBalancer` - (Required) The load balancer to which the policy
+  should be attached.
+* `lbPort` - (Required) The load balancer port to which the policy
+  should be applied. This must be an active listener on the load
+balancer.
+* `cookieExpirationPeriod` - (Optional) The time period after which
+  the session cookie should be considered stale, expressed in seconds.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the policy.
+* `name` - The name of the stickiness policy.
+* `loadBalancer` - The load balancer to which the policy is attached.
+* `lbPort` - The load balancer port to which the policy is applied.
+* `cookieExpirationPeriod` - The time period after which the session cookie is considered stale, expressed in seconds.
+
+<!-- cache-key: cdktf-0.18.0 input-fab95ad5bcc2bdeffcc1f3be4d3e7e2ca90c885f10678f8fbce6e3f28c5c37b3 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/lb_listener.html.markdown b/website/docs/cdktf/typescript/r/lb_listener.html.markdown
new file mode 100644
index 00000000000..d83e4eec9a0
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/lb_listener.html.markdown
@@ -0,0 +1,499 @@
+---
+subcategory: "ELB (Elastic Load Balancing)"
+layout: "aws"
+page_title: "AWS: aws_lb_listener"
+description: |-
+  Provides a Load Balancer Listener resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lb_listener
+
+Provides a Load Balancer Listener resource.
+
+~> **Note:** `awsAlbListener` is known as `awsLbListener`. The functionality is identical.
+
+## Example Usage
+
+### Forward Action
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Lb } from "./.gen/providers/aws/lb";
+import { LbListener } from "./.gen/providers/aws/lb-listener";
+import { LbTargetGroup } from "./.gen/providers/aws/lb-target-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const frontEnd = new Lb(this, "front_end", {});
+    const awsLbTargetGroupFrontEnd = new LbTargetGroup(this, "front_end_1", {});
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsLbTargetGroupFrontEnd.overrideLogicalId("front_end");
+    const awsLbListenerFrontEnd = new LbListener(this, "front_end_2", {
+      certificateArn:
+        "arn:aws:iam::187416307283:server-certificate/test_cert_rab3wuqwgja25ct3n4jdj2tzu4",
+      defaultAction: [
+        {
+          targetGroupArn: Token.asString(awsLbTargetGroupFrontEnd.arn),
+          type: "forward",
+        },
+      ],
+      loadBalancerArn: frontEnd.arn,
+      port: Token.asNumber("443"),
+      protocol: "HTTPS",
+      sslPolicy: "ELBSecurityPolicy-2016-08",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsLbListenerFrontEnd.overrideLogicalId("front_end");
+  }
+}
+
+```
+
+To a NLB:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LbListener } from "./.gen/providers/aws/lb-listener";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new LbListener(this, "front_end", {
+      alpnPolicy: "HTTP2Preferred",
+      certificateArn:
+        "arn:aws:iam::187416307283:server-certificate/test_cert_rab3wuqwgja25ct3n4jdj2tzu4",
+      defaultAction: [
+        {
+          targetGroupArn: Token.asString(awsLbTargetGroupFrontEnd.arn),
+          type: "forward",
+        },
+      ],
+      loadBalancerArn: Token.asString(awsLbFrontEnd.arn),
+      port: Token.asNumber("443"),
+      protocol: "TLS",
+    });
+  }
+}
+
+```
+
+### Redirect Action
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Lb } from "./.gen/providers/aws/lb";
+import { LbListener } from "./.gen/providers/aws/lb-listener";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const frontEnd = new Lb(this, "front_end", {});
+    const awsLbListenerFrontEnd = new LbListener(this, "front_end_1", {
+      defaultAction: [
+        {
+          redirect: {
+            port: "443",
+            protocol: "HTTPS",
+            statusCode: "HTTP_301",
+          },
+          type: "redirect",
+        },
+      ],
+      loadBalancerArn: frontEnd.arn,
+      port: Token.asNumber("80"),
+      protocol: "HTTP",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsLbListenerFrontEnd.overrideLogicalId("front_end");
+  }
+}
+
+```
+
+### Fixed-response Action
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Lb } from "./.gen/providers/aws/lb";
+import { LbListener } from "./.gen/providers/aws/lb-listener";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const frontEnd = new Lb(this, "front_end", {});
+    const awsLbListenerFrontEnd = new LbListener(this, "front_end_1", {
+      defaultAction: [
+        {
+          fixedResponse: {
+            contentType: "text/plain",
+            messageBody: "Fixed response content",
+            statusCode: "200",
+          },
+          type: "fixed-response",
+        },
+      ],
+      loadBalancerArn: frontEnd.arn,
+      port: Token.asNumber("80"),
+      protocol: "HTTP",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsLbListenerFrontEnd.overrideLogicalId("front_end");
+  }
+}
+
+```
+
+### Authenticate-cognito Action
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CognitoUserPool } from "./.gen/providers/aws/cognito-user-pool";
+import { CognitoUserPoolClient } from "./.gen/providers/aws/cognito-user-pool-client";
+import { CognitoUserPoolDomain } from "./.gen/providers/aws/cognito-user-pool-domain";
+import { Lb } from "./.gen/providers/aws/lb";
+import { LbListener } from "./.gen/providers/aws/lb-listener";
+import { LbTargetGroup } from "./.gen/providers/aws/lb-target-group";
+interface MyConfig {
+  name: any;
+  name1: any;
+  userPoolId: any;
+  domain: any;
+  userPoolId1: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    const pool = new CognitoUserPool(this, "pool", {
+      name: config.name,
+    });
+    const client = new CognitoUserPoolClient(this, "client", {
+      name: config.name1,
+      userPoolId: config.userPoolId,
+    });
+    const domain = new CognitoUserPoolDomain(this, "domain", {
+      domain: config.domain,
+      userPoolId: config.userPoolId1,
+    });
+    const frontEnd = new Lb(this, "front_end", {});
+    const awsLbTargetGroupFrontEnd = new LbTargetGroup(this, "front_end_4", {});
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsLbTargetGroupFrontEnd.overrideLogicalId("front_end");
+    const awsLbListenerFrontEnd = new LbListener(this, "front_end_5", {
+      defaultAction: [
+        {
+          authenticateCognito: {
+            userPoolArn: pool.arn,
+            userPoolClientId: client.id,
+            userPoolDomain: domain.domain,
+          },
+          type: "authenticate-cognito",
+        },
+        {
+          targetGroupArn: Token.asString(awsLbTargetGroupFrontEnd.arn),
+          type: "forward",
+        },
+      ],
+      loadBalancerArn: frontEnd.arn,
+      port: Token.asNumber("80"),
+      protocol: "HTTP",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsLbListenerFrontEnd.overrideLogicalId("front_end");
+  }
+}
+
+```
+
+### Authenticate-OIDC Action
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Lb } from "./.gen/providers/aws/lb";
+import { LbListener } from "./.gen/providers/aws/lb-listener";
+import { LbTargetGroup } from "./.gen/providers/aws/lb-target-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const frontEnd = new Lb(this, "front_end", {});
+    const awsLbTargetGroupFrontEnd = new LbTargetGroup(this, "front_end_1", {});
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsLbTargetGroupFrontEnd.overrideLogicalId("front_end");
+    const awsLbListenerFrontEnd = new LbListener(this, "front_end_2", {
+      defaultAction: [
+        {
+          authenticateOidc: {
+            authorizationEndpoint: "https://example.com/authorization_endpoint",
+            clientId: "client_id",
+            clientSecret: "client_secret",
+            issuer: "https://example.com",
+            tokenEndpoint: "https://example.com/token_endpoint",
+            userInfoEndpoint: "https://example.com/user_info_endpoint",
+          },
+          type: "authenticate-oidc",
+        },
+        {
+          targetGroupArn: Token.asString(awsLbTargetGroupFrontEnd.arn),
+          type: "forward",
+        },
+      ],
+      loadBalancerArn: frontEnd.arn,
+      port: Token.asNumber("80"),
+      protocol: "HTTP",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsLbListenerFrontEnd.overrideLogicalId("front_end");
+  }
+}
+
+```
+
+### Gateway Load Balancer Listener
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Lb } from "./.gen/providers/aws/lb";
+import { LbListener } from "./.gen/providers/aws/lb-listener";
+import { LbTargetGroup } from "./.gen/providers/aws/lb-target-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new Lb(this, "example", {
+      loadBalancerType: "gateway",
+      name: "example",
+      subnetMapping: [
+        {
+          subnetId: Token.asString(awsSubnetExample.id),
+        },
+      ],
+    });
+    const awsLbTargetGroupExample = new LbTargetGroup(this, "example_1", {
+      healthCheck: {
+        port: Token.asString(80),
+        protocol: "HTTP",
+      },
+      name: "example",
+      port: 6081,
+      protocol: "GENEVE",
+      vpcId: Token.asString(awsVpcExample.id),
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsLbTargetGroupExample.overrideLogicalId("example");
+    const awsLbListenerExample = new LbListener(this, "example_2", {
+      defaultAction: [
+        {
+          targetGroupArn: Token.asString(awsLbTargetGroupExample.id),
+          type: "forward",
+        },
+      ],
+      loadBalancerArn: example.id,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsLbListenerExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `defaultAction` - (Required) Configuration block for default actions. Detailed below.
+* `loadBalancerArn` - (Required, Forces New Resource) ARN of the load balancer.
+
+The following arguments are optional:
+
+* `alpnPolicy` - (Optional)  Name of the Application-Layer Protocol Negotiation (ALPN) policy. Can be set if `protocol` is `tls`. Valid values are `http1Only`, `http2Only`, `http2Optional`, `http2Preferred`, and `none`.
+* `certificateArn` - (Optional) ARN of the default SSL server certificate. Exactly one certificate is required if the protocol is HTTPS. For adding additional SSL certificates, see the [`awsLbListenerCertificate` resource](/docs/providers/aws/r/lb_listener_certificate.html).
+* `port` - (Optional) Port on which the load balancer is listening. Not valid for Gateway Load Balancers.
+* `protocol` - (Optional) Protocol for connections from clients to the load balancer. For Application Load Balancers, valid values are `http` and `https`, with a default of `http`. For Network Load Balancers, valid values are `tcp`, `tls`, `udp`, and `tcpUdp`. Not valid to use `udp` or `tcpUdp` if dual-stack mode is enabled. Not valid for Gateway Load Balancers.
+* `sslPolicy` - (Optional) Name of the SSL Policy for the listener. Required if `protocol` is `https` or `tls`.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+~> **NOTE::** Please note that listeners that are attached to Application Load Balancers must use either `http` or `https` protocols while listeners that are attached to Network Load Balancers must use the `tcp` protocol.
+
+### default_action
+
+The following arguments are required:
+
+* `type` - (Required) Type of routing action. Valid values are `forward`, `redirect`, `fixedResponse`, `authenticateCognito` and `authenticateOidc`.
+
+The following arguments are optional:
+
+* `authenticateCognito` - (Optional) Configuration block for using Amazon Cognito to authenticate users. Specify only when `type` is `authenticateCognito`. Detailed below.
+* `authenticateOidc` - (Optional) Configuration block for an identity provider that is compliant with OpenID Connect (OIDC). Specify only when `type` is `authenticateOidc`. Detailed below.
+* `fixedResponse` - (Optional) Information for creating an action that returns a custom HTTP response. Required if `type` is `fixedResponse`.
+* `forward` - (Optional) Configuration block for creating an action that distributes requests among one or more target groups. Specify only if `type` is `forward`. If you specify both `forward` block and `targetGroupArn` attribute, you can specify only one target group using `forward` and it must be the same target group specified in `targetGroupArn`. Detailed below.
+* `order` - (Optional) Order for the action. This value is required for rules with multiple actions. The action with the lowest value for order is performed first. Valid values are between `1` and `50000`.
+* `redirect` - (Optional) Configuration block for creating a redirect action. Required if `type` is `redirect`. Detailed below.
+* `targetGroupArn` - (Optional) ARN of the Target Group to which to route traffic. Specify only if `type` is `forward` and you want to route to a single target group. To route to one or more target groups, use a `forward` block instead.
+
+#### authenticate_cognito
+
+The following arguments are required:
+
+* `userPoolArn` - (Required) ARN of the Cognito user pool.
+* `userPoolClientId` - (Required) ID of the Cognito user pool client.
+* `userPoolDomain` - (Required) Domain prefix or fully-qualified domain name of the Cognito user pool.
+
+The following arguments are optional:
+
+* `authenticationRequestExtraParams` - (Optional) Query parameters to include in the redirect request to the authorization endpoint. Max: 10. Detailed below.
+* `onUnauthenticatedRequest` - (Optional) Behavior if the user is not authenticated. Valid values are `deny`, `allow` and `authenticate`.
+* `scope` - (Optional) Set of user claims to be requested from the IdP.
+* `sessionCookieName` - (Optional) Name of the cookie used to maintain session information.
+* `sessionTimeout` - (Optional) Maximum duration of the authentication session, in seconds.
+
+##### authentication_request_extra_params
+
+* `key` - (Required) Key of query parameter.
+* `value` - (Required) Value of query parameter.
+
+#### authenticate_oidc
+
+The following arguments are required:
+
+* `authorizationEndpoint` - (Required) Authorization endpoint of the IdP.
+* `clientId` - (Required) OAuth 2.0 client identifier.
+* `clientSecret` - (Required) OAuth 2.0 client secret.
+* `issuer` - (Required) OIDC issuer identifier of the IdP.
+* `tokenEndpoint` - (Required) Token endpoint of the IdP.
+* `userInfoEndpoint` - (Required) User info endpoint of the IdP.
+
+The following arguments are optional:
+
+* `authenticationRequestExtraParams` - (Optional) Query parameters to include in the redirect request to the authorization endpoint. Max: 10.
+* `onUnauthenticatedRequest` - (Optional) Behavior if the user is not authenticated. Valid values: `deny`, `allow` and `authenticate`
+* `scope` - (Optional) Set of user claims to be requested from the IdP.
+* `sessionCookieName` - (Optional) Name of the cookie used to maintain session information.
+* `sessionTimeout` - (Optional) Maximum duration of the authentication session, in seconds.
+
+#### fixed_response
+
+The following arguments are required:
+
+* `contentType` - (Required) Content type. Valid values are `text/plain`, `text/css`, `text/html`, `application/javascript` and `application/json`.
+
+The following arguments are optional:
+
+* `messageBody` - (Optional) Message body.
+* `statusCode` - (Optional) HTTP response code. Valid values are `2Xx`, `4Xx`, or `5Xx`.
+
+#### forward
+
+The following arguments are required:
+
+* `targetGroup` - (Required) Set of 1-5 target group blocks. Detailed below.
+
+The following arguments are optional:
+
+* `stickiness` - (Optional) Configuration block for target group stickiness for the rule. Detailed below.
+
+##### target_group
+
+The following arguments are required:
+
+* `arn` - (Required) ARN of the target group.
+
+The following arguments are optional:
+
+* `weight` - (Optional) Weight. The range is 0 to 999.
+
+##### stickiness
+
+The following arguments are required:
+
+* `duration` - (Required) Time period, in seconds, during which requests from a client should be routed to the same target group. The range is 1-604800 seconds (7 days).
+
+The following arguments are optional:
+
+* `enabled` - (Optional) Whether target group stickiness is enabled. Default is `false`.
+
+#### redirect
+
+~> **NOTE::** You can reuse URI components using the following reserved keywords: `#{protocol}`, `#{host}`, `#{port}`, `#{path}` (the leading "/" is removed) and `#{query}`.
+
+The following arguments are required:
+
+* `statusCode` - (Required) HTTP redirect code. The redirect is either permanent (`http301`) or temporary (`http302`).
+
+The following arguments are optional:
+
+* `host` - (Optional) Hostname. This component is not percent-encoded. The hostname can contain `#{host}`. Defaults to `#{host}`.
+* `path` - (Optional) Absolute path, starting with the leading "/". This component is not percent-encoded. The path can contain #{host}, #{path}, and #{port}. Defaults to `/#{path}`.
+* `port` - (Optional) Port. Specify a value from `1` to `65535` or `#{port}`. Defaults to `#{port}`.
+* `protocol` - (Optional) Protocol. Valid values are `http`, `https`, or `#{protocol}`. Defaults to `#{protocol}`.
+* `query` - (Optional) Query parameters, URL-encoded when necessary, but not percent-encoded. Do not include the leading "?". Defaults to `#{query}`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the listener (matches `id`).
+* `id` - ARN of the listener (matches `arn`).
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import listeners using their ARN. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import listeners using their ARN. For example:
+
+```console
+% terraform import aws_lb_listener.front_end arn:aws:elasticloadbalancing:us-west-2:187416307283:listener/app/front-end-alb/8e4497da625e2d8a/9ab28ade35828f96
+```
+
+<!-- cache-key: cdktf-0.18.0 input-b6c6fd51a4ec9b7cab514ce3099f9bf1c4efc96f7baaabe14176ce01751b5a09 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/lb_listener_certificate.html.markdown b/website/docs/cdktf/typescript/r/lb_listener_certificate.html.markdown
new file mode 100644
index 00000000000..00a3556e7b9
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/lb_listener_certificate.html.markdown
@@ -0,0 +1,98 @@
+---
+subcategory: "ELB (Elastic Load Balancing)"
+layout: "aws"
+page_title: "AWS: aws_lb_listener_certificate"
+description: |-
+  Provides a Load Balancer Listener Certificate resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lb_listener_certificate
+
+Provides a Load Balancer Listener Certificate resource.
+
+This resource is for additional certificates and does not replace the default certificate on the listener.
+
+~> **Note:** `awsAlbListenerCertificate` is known as `awsLbListenerCertificate`. The functionality is identical.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AcmCertificate } from "./.gen/providers/aws/acm-certificate";
+import { Lb } from "./.gen/providers/aws/lb";
+import { LbListener } from "./.gen/providers/aws/lb-listener";
+import { LbListenerCertificate } from "./.gen/providers/aws/lb-listener-certificate";
+interface MyConfig {
+  defaultAction: any;
+  loadBalancerArn: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    const example = new AcmCertificate(this, "example", {});
+    new Lb(this, "front_end", {});
+    const awsLbListenerFrontEnd = new LbListener(this, "front_end_2", {
+      defaultAction: config.defaultAction,
+      loadBalancerArn: config.loadBalancerArn,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsLbListenerFrontEnd.overrideLogicalId("front_end");
+    const awsLbListenerCertificateExample = new LbListenerCertificate(
+      this,
+      "example_3",
+      {
+        certificateArn: example.arn,
+        listenerArn: Token.asString(awsLbListenerFrontEnd.arn),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsLbListenerCertificateExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `listenerArn` - (Required, Forces New Resource) The ARN of the listener to which to attach the certificate.
+* `certificateArn` - (Required, Forces New Resource) The ARN of the certificate to attach to the listener.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The `listenerArn` and `certificateArn` separated by a `_`.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Listener Certificates using the listener arn and certificate arn, separated by an underscore (`_`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Listener Certificates using the listener arn and certificate arn, separated by an underscore (`_`). For example:
+
+```console
+% terraform import aws_lb_listener_certificate.example arn:aws:elasticloadbalancing:us-west-2:123456789012:listener/app/test/8e4497da625e2d8a/9ab28ade35828f96/67b3d2d36dd7c26b_arn:aws:iam::123456789012:server-certificate/tf-acc-test-6453083910015726063
+```
+
+<!-- cache-key: cdktf-0.18.0 input-010f8a2b1d22c8dc2a66a954423bfa17378f9f952397f5501786dea62742e9f7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/lb_listener_rule.html.markdown b/website/docs/cdktf/typescript/r/lb_listener_rule.html.markdown
new file mode 100644
index 00000000000..c34b061196e
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/lb_listener_rule.html.markdown
@@ -0,0 +1,374 @@
+---
+subcategory: "ELB (Elastic Load Balancing)"
+layout: "aws"
+page_title: "AWS: aws_lb_listener_rule"
+description: |-
+  Provides a Load Balancer Listener Rule resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lb_listener_rule
+
+Provides a Load Balancer Listener Rule resource.
+
+~> **Note:** `awsAlbListenerRule` is known as `awsLbListenerRule`. The functionality is identical.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CognitoUserPool } from "./.gen/providers/aws/cognito-user-pool";
+import { CognitoUserPoolClient } from "./.gen/providers/aws/cognito-user-pool-client";
+import { CognitoUserPoolDomain } from "./.gen/providers/aws/cognito-user-pool-domain";
+import { Lb } from "./.gen/providers/aws/lb";
+import { LbListener } from "./.gen/providers/aws/lb-listener";
+import { LbListenerRule } from "./.gen/providers/aws/lb-listener-rule";
+interface MyConfig {
+  name: any;
+  name1: any;
+  userPoolId: any;
+  domain: any;
+  userPoolId1: any;
+  defaultAction: any;
+  loadBalancerArn: any;
+  condition: any;
+  condition1: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    const pool = new CognitoUserPool(this, "pool", {
+      name: config.name,
+    });
+    const client = new CognitoUserPoolClient(this, "client", {
+      name: config.name1,
+      userPoolId: config.userPoolId,
+    });
+    const domain = new CognitoUserPoolDomain(this, "domain", {
+      domain: config.domain,
+      userPoolId: config.userPoolId1,
+    });
+    new Lb(this, "front_end", {});
+    const awsLbListenerFrontEnd = new LbListener(this, "front_end_4", {
+      defaultAction: config.defaultAction,
+      loadBalancerArn: config.loadBalancerArn,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsLbListenerFrontEnd.overrideLogicalId("front_end");
+    new LbListenerRule(this, "admin", {
+      action: [
+        {
+          authenticateCognito: {
+            userPoolArn: pool.arn,
+            userPoolClientId: client.id,
+            userPoolDomain: domain.domain,
+          },
+          type: "authenticate-cognito",
+        },
+        {
+          targetGroupArn: static.arn,
+          type: "forward",
+        },
+      ],
+      listenerArn: Token.asString(awsLbListenerFrontEnd.arn),
+      condition: config.condition,
+    });
+    new LbListenerRule(this, "health_check", {
+      action: [
+        {
+          fixedResponse: {
+            contentType: "text/plain",
+            messageBody: "HEALTHY",
+            statusCode: "200",
+          },
+          type: "fixed-response",
+        },
+      ],
+      condition: [
+        {
+          queryString: [
+            {
+              key: "health",
+              value: "check",
+            },
+            {
+              value: "bar",
+            },
+          ],
+        },
+      ],
+      listenerArn: Token.asString(awsLbListenerFrontEnd.arn),
+    });
+    new LbListenerRule(this, "host_based_routing", {
+      action: [
+        {
+          forward: {
+            stickiness: {
+              duration: 600,
+              enabled: true,
+            },
+            targetGroup: [
+              {
+                arn: main.arn,
+                weight: 80,
+              },
+              {
+                arn: canary.arn,
+                weight: 20,
+              },
+            ],
+          },
+          type: "forward",
+        },
+      ],
+      condition: [
+        {
+          hostHeader: {
+            values: ["my-service.*.terraform.io"],
+          },
+        },
+      ],
+      listenerArn: Token.asString(awsLbListenerFrontEnd.arn),
+      priority: 99,
+    });
+    new LbListenerRule(this, "host_based_weighted_routing", {
+      action: [
+        {
+          targetGroupArn: static.arn,
+          type: "forward",
+        },
+      ],
+      condition: [
+        {
+          hostHeader: {
+            values: ["my-service.*.terraform.io"],
+          },
+        },
+      ],
+      listenerArn: Token.asString(awsLbListenerFrontEnd.arn),
+      priority: 99,
+    });
+    new LbListenerRule(this, "oidc", {
+      action: [
+        {
+          authenticateOidc: {
+            authorizationEndpoint: "https://example.com/authorization_endpoint",
+            clientId: "client_id",
+            clientSecret: "client_secret",
+            issuer: "https://example.com",
+            tokenEndpoint: "https://example.com/token_endpoint",
+            userInfoEndpoint: "https://example.com/user_info_endpoint",
+          },
+          type: "authenticate-oidc",
+        },
+        {
+          targetGroupArn: static.arn,
+          type: "forward",
+        },
+      ],
+      listenerArn: Token.asString(awsLbListenerFrontEnd.arn),
+      condition: config.condition1,
+    });
+    new LbListenerRule(this, "redirect_http_to_https", {
+      action: [
+        {
+          redirect: {
+            port: "443",
+            protocol: "HTTPS",
+            statusCode: "HTTP_301",
+          },
+          type: "redirect",
+        },
+      ],
+      condition: [
+        {
+          httpHeader: {
+            httpHeaderName: "X-Forwarded-For",
+            values: ["192.168.1.*"],
+          },
+        },
+      ],
+      listenerArn: Token.asString(awsLbListenerFrontEnd.arn),
+    });
+    new LbListenerRule(this, "static", {
+      action: [
+        {
+          targetGroupArn: static.arn,
+          type: "forward",
+        },
+      ],
+      condition: [
+        {
+          pathPattern: {
+            values: ["/static/*"],
+          },
+        },
+        {
+          hostHeader: {
+            values: ["example.com"],
+          },
+        },
+      ],
+      listenerArn: Token.asString(awsLbListenerFrontEnd.arn),
+      priority: 100,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `listenerArn` - (Required, Forces New Resource) The ARN of the listener to which to attach the rule.
+* `priority` - (Optional) The priority for the rule between `1` and `50000`. Leaving it unset will automatically set the rule with next available priority after currently existing highest rule. A listener can't have multiple rules with the same priority.
+* `action` - (Required) An Action block. Action blocks are documented below.
+* `condition` - (Required) A Condition block. Multiple condition blocks of different types can be set and all must be satisfied for the rule to match. Condition blocks are documented below.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Action Blocks
+
+Action Blocks (for `action`) support the following:
+
+* `type` - (Required) The type of routing action. Valid values are `forward`, `redirect`, `fixedResponse`, `authenticateCognito` and `authenticateOidc`.
+* `targetGroupArn` - (Optional) The ARN of the Target Group to which to route traffic. Specify only if `type` is `forward` and you want to route to a single target group. To route to one or more target groups, use a `forward` block instead.
+* `forward` - (Optional) Information for creating an action that distributes requests among one or more target groups. Specify only if `type` is `forward`. If you specify both `forward` block and `targetGroupArn` attribute, you can specify only one target group using `forward` and it must be the same target group specified in `targetGroupArn`.
+* `redirect` - (Optional) Information for creating a redirect action. Required if `type` is `redirect`.
+* `fixedResponse` - (Optional) Information for creating an action that returns a custom HTTP response. Required if `type` is `fixedResponse`.
+* `authenticateCognito` - (Optional) Information for creating an authenticate action using Cognito. Required if `type` is `authenticateCognito`.
+* `authenticateOidc` - (Optional) Information for creating an authenticate action using OIDC. Required if `type` is `authenticateOidc`.
+
+Forward Blocks (for `forward`) support the following:
+
+* `targetGroup` - (Required) One or more target groups block.
+* `stickiness` - (Optional) The target group stickiness for the rule.
+
+Target Group Blocks (for `targetGroup`) supports the following:
+
+* `arn` - (Required) The Amazon Resource Name (ARN) of the target group.
+* `weight` - (Optional) The weight. The range is 0 to 999.
+
+Target Group Stickiness Config Blocks (for `stickiness`) supports the following:
+
+* `enabled` - (Required) Indicates whether target group stickiness is enabled.
+* `duration` - (Optional) The time period, in seconds, during which requests from a client should be routed to the same target group. The range is 1-604800 seconds (7 days).
+
+Redirect Blocks (for `redirect`) support the following:
+
+~> **NOTE::** You can reuse URI components using the following reserved keywords: `#{protocol}`, `#{host}`, `#{port}`, `#{path}` (the leading "/" is removed) and `#{query}`.
+
+* `host` - (Optional) The hostname. This component is not percent-encoded. The hostname can contain `#{host}`. Defaults to `#{host}`.
+* `path` - (Optional) The absolute path, starting with the leading "/". This component is not percent-encoded. The path can contain #{host}, #{path}, and #{port}. Defaults to `/#{path}`.
+* `port` - (Optional) The port. Specify a value from `1` to `65535` or `#{port}`. Defaults to `#{port}`.
+* `protocol` - (Optional) The protocol. Valid values are `http`, `https`, or `#{protocol}`. Defaults to `#{protocol}`.
+* `query` - (Optional) The query parameters, URL-encoded when necessary, but not percent-encoded. Do not include the leading "?". Defaults to `#{query}`.
+* `statusCode` - (Required) The HTTP redirect code. The redirect is either permanent (`http301`) or temporary (`http302`).
+
+Fixed-response Blocks (for `fixedResponse`) support the following:
+
+* `contentType` - (Required) The content type. Valid values are `text/plain`, `text/css`, `text/html`, `application/javascript` and `application/json`.
+* `messageBody` - (Optional) The message body.
+* `statusCode` - (Optional) The HTTP response code. Valid values are `2Xx`, `4Xx`, or `5Xx`.
+
+Authenticate Cognito Blocks (for `authenticateCognito`) supports the following:
+
+* `authenticationRequestExtraParams` - (Optional) The query parameters to include in the redirect request to the authorization endpoint. Max: 10.
+* `onUnauthenticatedRequest` - (Optional) The behavior if the user is not authenticated. Valid values: `deny`, `allow` and `authenticate`
+* `scope` - (Optional) The set of user claims to be requested from the IdP.
+* `sessionCookieName` - (Optional) The name of the cookie used to maintain session information.
+* `sessionTimeout` - (Optional) The maximum duration of the authentication session, in seconds.
+* `userPoolArn` - (Required) The ARN of the Cognito user pool.
+* `userPoolClientId` - (Required) The ID of the Cognito user pool client.
+* `userPoolDomain` - (Required) The domain prefix or fully-qualified domain name of the Cognito user pool.
+
+Authenticate OIDC Blocks (for `authenticateOidc`) supports the following:
+
+* `authenticationRequestExtraParams` - (Optional) The query parameters to include in the redirect request to the authorization endpoint. Max: 10.
+* `authorizationEndpoint` - (Required) The authorization endpoint of the IdP.
+* `clientId` - (Required) The OAuth 2.0 client identifier.
+* `clientSecret` - (Required) The OAuth 2.0 client secret.
+* `issuer` - (Required) The OIDC issuer identifier of the IdP.
+* `onUnauthenticatedRequest` - (Optional) The behavior if the user is not authenticated. Valid values: `deny`, `allow` and `authenticate`
+* `scope` - (Optional) The set of user claims to be requested from the IdP.
+* `sessionCookieName` - (Optional) The name of the cookie used to maintain session information.
+* `sessionTimeout` - (Optional) The maximum duration of the authentication session, in seconds.
+* `tokenEndpoint` - (Required) The token endpoint of the IdP.
+* `userInfoEndpoint` - (Required) The user info endpoint of the IdP.
+
+Authentication Request Extra Params Blocks (for `authenticationRequestExtraParams`) supports the following:
+
+* `key` - (Required) The key of query parameter
+* `value` - (Required) The value of query parameter
+
+### Condition Blocks
+
+One or more condition blocks can be set per rule. Most condition types can only be specified once per rule except for `httpHeader` and `queryString` which can be specified multiple times.
+
+Condition Blocks (for `condition`) support the following:
+
+* `hostHeader` - (Optional) Contains a single `values` item which is a list of host header patterns to match. The maximum size of each pattern is 128 characters. Comparison is case insensitive. Wildcard characters supported: * (matches 0 or more characters) and ? (matches exactly 1 character). Only one pattern needs to match for the condition to be satisfied.
+* `httpHeader` - (Optional) HTTP headers to match. [HTTP Header block](#http-header-blocks) fields documented below.
+* `httpRequestMethod` - (Optional) Contains a single `values` item which is a list of HTTP request methods or verbs to match. Maximum size is 40 characters. Only allowed characters are A-Z, hyphen (-) and underscore (\_). Comparison is case sensitive. Wildcards are not supported. Only one needs to match for the condition to be satisfied. AWS recommends that GET and HEAD requests are routed in the same way because the response to a HEAD request may be cached.
+* `pathPattern` - (Optional) Contains a single `values` item which is a list of path patterns to match against the request URL. Maximum size of each pattern is 128 characters. Comparison is case sensitive. Wildcard characters supported: * (matches 0 or more characters) and ? (matches exactly 1 character). Only one pattern needs to match for the condition to be satisfied. Path pattern is compared only to the path of the URL, not to its query string. To compare against the query string, use a `queryString` condition.
+* `queryString` - (Optional) Query strings to match. [Query String block](#query-string-blocks) fields documented below.
+* `sourceIp` - (Optional) Contains a single `values` item which is a list of source IP CIDR notations to match. You can use both IPv4 and IPv6 addresses. Wildcards are not supported. Condition is satisfied if the source IP address of the request matches one of the CIDR blocks. Condition is not satisfied by the addresses in the `xForwardedFor` header, use `httpHeader` condition instead.
+
+~> **NOTE::** Exactly one of `hostHeader`, `httpHeader`, `httpRequestMethod`, `pathPattern`, `queryString` or `sourceIp` must be set per condition.
+
+#### HTTP Header Blocks
+
+HTTP Header Blocks (for `httpHeader`) support the following:
+
+* `httpHeaderName` - (Required) Name of HTTP header to search. The maximum size is 40 characters. Comparison is case insensitive. Only RFC7240 characters are supported. Wildcards are not supported. You cannot use HTTP header condition to specify the host header, use a `hostHeader` condition instead.
+* `values` - (Required) List of header value patterns to match. Maximum size of each pattern is 128 characters. Comparison is case insensitive. Wildcard characters supported: * (matches 0 or more characters) and ? (matches exactly 1 character). If the same header appears multiple times in the request they will be searched in order until a match is found. Only one pattern needs to match for the condition to be satisfied. To require that all of the strings are a match, create one condition block per string.
+
+#### Query String Blocks
+
+Query String Blocks (for `queryString`) support the following:
+
+* `values` - (Required) Query string pairs or values to match. Query String Value blocks documented below. Multiple `values` blocks can be specified, see example above. Maximum size of each string is 128 characters. Comparison is case insensitive. Wildcard characters supported: * (matches 0 or more characters) and ? (matches exactly 1 character). To search for a literal '\*' or '?' character in a query string, escape the character with a backslash (\\). Only one pair needs to match for the condition to be satisfied.
+
+Query String Value Blocks (for `queryStringValues`) support the following:
+
+* `key` - (Optional) Query string key pattern to match.
+* `value` - (Required) Query string value pattern to match.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ARN of the rule (matches `arn`)
+* `arn` - The ARN of the rule (matches `id`)
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import rules using their ARN. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import rules using their ARN. For example:
+
+```console
+% terraform import aws_lb_listener_rule.front_end arn:aws:elasticloadbalancing:us-west-2:187416307283:listener-rule/app/test/8e4497da625e2d8a/9ab28ade35828f96/67b3d2d36dd7c26b
+```
+
+<!-- cache-key: cdktf-0.18.0 input-12e9f21426e9efd89a154c6e8445b8894b184d7651322f0592349d28d0132dea -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/lb_ssl_negotiation_policy.html.markdown b/website/docs/cdktf/typescript/r/lb_ssl_negotiation_policy.html.markdown
new file mode 100644
index 00000000000..f6f1c57eebc
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/lb_ssl_negotiation_policy.html.markdown
@@ -0,0 +1,113 @@
+---
+subcategory: "ELB Classic"
+layout: "aws"
+page_title: "AWS: aws_lb_ssl_negotiation_policy"
+description: |-
+  Provides a load balancer SSL negotiation policy, which allows an ELB to control which ciphers and protocols are supported during SSL negotiations between a client and a load balancer.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lb_ssl_negotiation_policy
+
+Provides a load balancer SSL negotiation policy, which allows an ELB to control the ciphers and protocols that are supported during SSL negotiations between a client and a load balancer.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Elb } from "./.gen/providers/aws/elb";
+import { LbSslNegotiationPolicy } from "./.gen/providers/aws/lb-ssl-negotiation-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const lb = new Elb(this, "lb", {
+      availabilityZones: ["us-east-1a"],
+      listener: [
+        {
+          instancePort: 8000,
+          instanceProtocol: "https",
+          lbPort: 443,
+          lbProtocol: "https",
+          sslCertificateId:
+            "arn:aws:iam::123456789012:server-certificate/certName",
+        },
+      ],
+      name: "test-lb",
+    });
+    new LbSslNegotiationPolicy(this, "foo", {
+      attribute: [
+        {
+          name: "Protocol-TLSv1",
+          value: "false",
+        },
+        {
+          name: "Protocol-TLSv1.1",
+          value: "false",
+        },
+        {
+          name: "Protocol-TLSv1.2",
+          value: "true",
+        },
+        {
+          name: "Server-Defined-Cipher-Order",
+          value: "true",
+        },
+        {
+          name: "ECDHE-RSA-AES128-GCM-SHA256",
+          value: "true",
+        },
+        {
+          name: "AES128-GCM-SHA256",
+          value: "true",
+        },
+        {
+          name: "EDH-RSA-DES-CBC3-SHA",
+          value: "false",
+        },
+      ],
+      lbPort: 443,
+      loadBalancer: lb.id,
+      name: "foo-policy",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the SSL negotiation policy.
+* `loadBalancer` - (Required) The load balancer to which the policy
+  should be attached.
+* `lbPort` - (Required) The load balancer port to which the policy
+  should be applied. This must be an active listener on the load
+balancer.
+* `attribute` - (Optional) An SSL Negotiation policy attribute. Each has two properties:
+    * `name` - The name of the attribute
+    * `value` - The value of the attribute
+* `triggers` - (Optional) Map of arbitrary keys and values that, when changed, will trigger a redeployment. To force a redeployment without changing these keys/values, use the [`terraform taint` command](https://www.terraform.io/docs/commands/taint.html).
+
+To set your attributes, please see the [AWS Elastic Load Balancing Developer Guide](http://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/elb-security-policy-table.html) for a listing of the supported SSL protocols, SSL options, and SSL ciphers.
+
+~> **NOTE:** The AWS documentation references Server Order Preference, which the AWS Elastic Load Balancing API refers to as `serverDefinedCipherOrder`. If you wish to set Server Order Preference, use this value instead.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the policy.
+* `name` - The name of the stickiness policy.
+* `loadBalancer` - The load balancer to which the policy is attached.
+* `lbPort` - The load balancer port to which the policy is applied.
+* `attribute` - The SSL Negotiation policy attributes.
+
+<!-- cache-key: cdktf-0.18.0 input-594ecbf0ae1086664299c0bd8eab81534e805963be3a73733449f7041f731403 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/lb_target_group.html.markdown b/website/docs/cdktf/typescript/r/lb_target_group.html.markdown
new file mode 100644
index 00000000000..0ddd5921abb
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/lb_target_group.html.markdown
@@ -0,0 +1,259 @@
+---
+subcategory: "ELB (Elastic Load Balancing)"
+layout: "aws"
+page_title: "AWS: aws_lb_target_group"
+description: |-
+  Provides a Target Group resource for use with Load Balancers.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lb_target_group
+
+Provides a Target Group resource for use with Load Balancer resources.
+
+~> **Note:** `awsAlbTargetGroup` is known as `awsLbTargetGroup`. The functionality is identical.
+
+## Example Usage
+
+### Instance Target Group
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LbTargetGroup } from "./.gen/providers/aws/lb-target-group";
+import { Vpc } from "./.gen/providers/aws/vpc";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const main = new Vpc(this, "main", {
+      cidrBlock: "10.0.0.0/16",
+    });
+    new LbTargetGroup(this, "test", {
+      name: "tf-example-lb-tg",
+      port: 80,
+      protocol: "HTTP",
+      vpcId: main.id,
+    });
+  }
+}
+
+```
+
+### IP Target Group
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LbTargetGroup } from "./.gen/providers/aws/lb-target-group";
+import { Vpc } from "./.gen/providers/aws/vpc";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const main = new Vpc(this, "main", {
+      cidrBlock: "10.0.0.0/16",
+    });
+    new LbTargetGroup(this, "ip-example", {
+      name: "tf-example-lb-tg",
+      port: 80,
+      protocol: "HTTP",
+      targetType: "ip",
+      vpcId: main.id,
+    });
+  }
+}
+
+```
+
+### Lambda Target Group
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LbTargetGroup } from "./.gen/providers/aws/lb-target-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new LbTargetGroup(this, "lambda-example", {
+      name: "tf-example-lb-tg",
+      targetType: "lambda",
+    });
+  }
+}
+
+```
+
+### ALB Target Group
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LbTargetGroup } from "./.gen/providers/aws/lb-target-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new LbTargetGroup(this, "alb-example", {
+      name: "tf-example-lb-alb-tg",
+      port: 80,
+      protocol: "TCP",
+      targetType: "alb",
+      vpcId: main.id,
+    });
+  }
+}
+
+```
+
+### Target group with unhealthy connection termination disabled
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LbTargetGroup } from "./.gen/providers/aws/lb-target-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new LbTargetGroup(this, "tcp-example", {
+      name: "tf-example-lb-nlb-tg",
+      port: 25,
+      protocol: "TCP",
+      targetHealthState: [
+        {
+          enableUnhealthyConnectionTermination: false,
+        },
+      ],
+      vpcId: main.id,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `connectionTermination` - (Optional) Whether to terminate connections at the end of the deregistration timeout on Network Load Balancers. See [doc](https://docs.aws.amazon.com/elasticloadbalancing/latest/network/load-balancer-target-groups.html#deregistration-delay) for more information. Default is `false`.
+* `deregistrationDelay` - (Optional) Amount time for Elastic Load Balancing to wait before changing the state of a deregistering target from draining to unused. The range is 0-3600 seconds. The default value is 300 seconds.
+* `healthCheck` - (Optional, Maximum of 1) Health Check configuration block. Detailed below.
+* `lambdaMultiValueHeadersEnabled` - (Optional) Whether the request and response headers exchanged between the load balancer and the Lambda function include arrays of values or strings. Only applies when `targetType` is `lambda`. Default is `false`.
+* `loadBalancingAlgorithmType` - (Optional) Determines how the load balancer selects targets when routing requests. Only applicable for Application Load Balancer Target Groups. The value is `roundRobin` or `leastOutstandingRequests`. The default is `roundRobin`.
+* `loadBalancingCrossZoneEnabled` - (Optional) Indicates whether cross zone load balancing is enabled. The value is `"true"`, `"false"` or `"useLoadBalancerConfiguration"`. The default is `"useLoadBalancerConfiguration"`.
+* `namePrefix` - (Optional, Forces new resource) Creates a unique name beginning with the specified prefix. Conflicts with `name`. Cannot be longer than 6 characters.
+* `name` - (Optional, Forces new resource) Name of the target group. If omitted, Terraform will assign a random, unique name. This name must be unique per region per account, can have a maximum of 32 characters, must contain only alphanumeric characters or hyphens, and must not begin or end with a hyphen.
+* `port` - (May be required, Forces new resource) Port on which targets receive traffic, unless overridden when registering a specific target. Required when `targetType` is `instance`, `ip` or `alb`. Does not apply when `targetType` is `lambda`.
+* `preserveClientIp` - (Optional) Whether client IP preservation is enabled. See [doc](https://docs.aws.amazon.com/elasticloadbalancing/latest/network/load-balancer-target-groups.html#client-ip-preservation) for more information.
+* `protocolVersion` - (Optional, Forces new resource) Only applicable when `protocol` is `http` or `https`. The protocol version. Specify `grpc` to send requests to targets using gRPC. Specify `http2` to send requests to targets using HTTP/2. The default is `http1`, which sends requests to targets using HTTP/1.1
+* `protocol` - (May be required, Forces new resource) Protocol to use for routing traffic to the targets. Should be one of `geneve`, `http`, `https`, `tcp`, `tcpUdp`, `tls`, or `udp`. Required when `targetType` is `instance`, `ip` or `alb`. Does not apply when `targetType` is `lambda`.
+* `proxyProtocolV2` - (Optional) Whether to enable support for proxy protocol v2 on Network Load Balancers. See [doc](https://docs.aws.amazon.com/elasticloadbalancing/latest/network/load-balancer-target-groups.html#proxy-protocol) for more information. Default is `false`.
+* `slowStart` - (Optional) Amount time for targets to warm up before the load balancer sends them a full share of requests. The range is 30-900 seconds or 0 to disable. The default value is 0 seconds.
+* `stickiness` - (Optional, Maximum of 1) Stickiness configuration block. Detailed below.
+* `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `targetFailover` - (Optional) Target failover block. Only applicable for Gateway Load Balancer target groups. See [target_failover](#target_failover) for more information.
+* `targetHealthState` - (Optional) Target health state block. Only applicable for Network Load Balancer target groups when `protocol` is `tcp` or `tls`. See [target_health_state](#target_health_state) for more information.
+* `targetType` - (May be required, Forces new resource) Type of target that you must specify when registering targets with this target group. See [doc](https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_CreateTargetGroup.html) for supported values. The default is `instance`.
+
+  Note that you can't specify targets for a target group using both instance IDs and IP addresses.
+
+  If the target type is `ip`, specify IP addresses from the subnets of the virtual private cloud (VPC) for the target group, the RFC 1918 range (10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16), and the RFC 6598 range (100.64.0.0/10). You can't specify publicly routable IP addresses.
+
+  Network Load Balancers do not support the `lambda` target type.
+
+  Application Load Balancers do not support the `alb` target type.
+* `ipAddressType` (Optional, forces new resource) The type of IP addresses used by the target group, only supported when target type is set to `ip`. Possible values are `ipv4` or `ipv6`.
+* `vpcId` - (Optional, Forces new resource) Identifier of the VPC in which to create the target group. Required when `targetType` is `instance`, `ip` or `alb`. Does not apply when `targetType` is `lambda`.
+
+### health_check
+
+~> **Note:** The Health Check parameters you can set vary by the `protocol` of the Target Group. Many parameters cannot be set to custom values for `network` load balancers at this time. See http://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_CreateTargetGroup.html for a complete reference. Keep in mind, that health checks produce actual requests to the backend. The underlying function is invoked when `targetType` is set to `lambda`.
+
+* `enabled` - (Optional) Whether health checks are enabled. Defaults to `true`.
+* `healthyThreshold` - (Optional)  Number of consecutive health check successes required before considering a target healthy. The range is 2-10. Defaults to 3.
+* `interval` - (Optional) Approximate amount of time, in seconds, between health checks of an individual target. The range is 5-300. For `lambda` target groups, it needs to be greater than the timeout of the underlying `lambda`. Defaults to 30.
+* `matcher` (May be required) Response codes to use when checking for a healthy responses from a target. You can specify multiple values (for example, "200,202" for HTTP(s) or "0,12" for GRPC) or a range of values (for example, "200-299" or "0-99"). Required for HTTP/HTTPS/GRPC ALB. Only applies to Application Load Balancers (i.e., HTTP/HTTPS/GRPC) not Network Load Balancers (i.e., TCP).
+* `path` - (May be required) Destination for the health check request. Required for HTTP/HTTPS ALB and HTTP NLB. Only applies to HTTP/HTTPS.
+* `port` - (Optional) The port the load balancer uses when performing health checks on targets. Default is traffic-port.
+* `protocol` - (Optional) Protocol the load balancer uses when performing health checks on targets. Must be either `tcp`, `http`, or `https`. The TCP protocol is not supported for health checks if the protocol of the target group is HTTP or HTTPS. Defaults to HTTP.
+* `timeout` - (optional) Amount of time, in seconds, during which no response from a target means a failed health check. The range is 2–120 seconds. For target groups with a protocol of HTTP, the default is 6 seconds. For target groups with a protocol of TCP, TLS or HTTPS, the default is 10 seconds. For target groups with a protocol of GENEVE, the default is 5 seconds. If the target type is lambda, the default is 30 seconds.
+* `unhealthyThreshold` - (Optional) Number of consecutive health check failures required before considering a target unhealthy. The range is 2-10. Defaults to 3.
+
+### stickiness
+
+~> **NOTE:** Currently, an NLB (i.e., protocol of `http` or `https`) can have an invalid `stickiness` block with `type` set to `lbCookie` as long as `enabled` is set to `false`. However, please update your configurations to avoid errors in a future version of the provider: either remove the invalid `stickiness` block or set the `type` to `sourceIp`.
+
+* `cookieDuration` - (Optional) Only used when the type is `lbCookie`. The time period, in seconds, during which requests from a client should be routed to the same target. After this time period expires, the load balancer-generated cookie is considered stale. The range is 1 second to 1 week (604800 seconds). The default value is 1 day (86400 seconds).
+* `cookieName` - (Optional) Name of the application based cookie. AWSALB, AWSALBAPP, and AWSALBTG prefixes are reserved and cannot be used. Only needed when type is `appCookie`.
+* `enabled` - (Optional) Boolean to enable / disable `stickiness`. Default is `true`.
+* `type` - (Required) The type of sticky sessions. The only current possible values are `lbCookie`, `appCookie` for ALBs, `sourceIp` for NLBs, and `sourceIpDestIp`, `sourceIpDestIpProto` for GWLBs.
+
+### target_failover
+
+~> **NOTE:** This block is only applicable for a Gateway Load Balancer (GWLB). The two attributes `onDeregistration` and `onUnhealthy` cannot be set independently. The value you set for both attributes must be the same.
+
+* `onDeregistration` - (Optional) Indicates how the GWLB handles existing flows when a target is deregistered. Possible values are `rebalance` and `noRebalance`. Must match the attribute value set for `onUnhealthy`. Default: `noRebalance`.
+* `onUnhealthy` - Indicates how the GWLB handles existing flows when a target is unhealthy. Possible values are `rebalance` and `noRebalance`. Must match the attribute value set for `onDeregistration`. Default: `noRebalance`.
+
+### target_health_state
+
+~> **NOTE:** This block is only valid for a Network Load Balancer (NLB) target group when `protocol` is `tcp` or `tls`.
+
+* `enableUnhealthyConnectionTermination` - (Optional) Indicates whether the load balancer terminates connections to unhealthy targets. Possible values are `true` or `false`. Default: `true`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arnSuffix` - ARN suffix for use with CloudWatch Metrics.
+* `arn` - ARN of the Target Group (matches `id`).
+* `id` - ARN of the Target Group (matches `arn`).
+* `name` - Name of the Target Group.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Target Groups using their ARN. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Target Groups using their ARN. For example:
+
+```console
+% terraform import aws_lb_target_group.app_front_end arn:aws:elasticloadbalancing:us-west-2:187416307283:targetgroup/app-front-end/20cfe21448b66314
+```
+
+<!-- cache-key: cdktf-0.18.0 input-3eb6a0b53cb6c1b5567c421e59435e530f84dc8964724aea7f35f11efb516394 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/lb_target_group_attachment.html.markdown b/website/docs/cdktf/typescript/r/lb_target_group_attachment.html.markdown
new file mode 100644
index 00000000000..20cf2fdca81
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/lb_target_group_attachment.html.markdown
@@ -0,0 +1,191 @@
+---
+subcategory: "ELB (Elastic Load Balancing)"
+layout: "aws"
+page_title: "AWS: aws_lb_target_group_attachment"
+description: |-
+  Provides the ability to register instances and containers with a LB
+  target group
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lb_target_group_attachment
+
+Provides the ability to register instances and containers with an Application Load Balancer (ALB) or Network Load Balancer (NLB) target group. For attaching resources with Elastic Load Balancer (ELB), see the [`awsElbAttachment` resource](/docs/providers/aws/r/elb_attachment.html).
+
+~> **Note:** `awsAlbTargetGroupAttachment` is known as `awsLbTargetGroupAttachment`. The functionality is identical.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Instance } from "./.gen/providers/aws/instance";
+import { LbTargetGroup } from "./.gen/providers/aws/lb-target-group";
+import { LbTargetGroupAttachment } from "./.gen/providers/aws/lb-target-group-attachment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const test = new Instance(this, "test", {});
+    const awsLbTargetGroupTest = new LbTargetGroup(this, "test_1", {});
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsLbTargetGroupTest.overrideLogicalId("test");
+    const awsLbTargetGroupAttachmentTest = new LbTargetGroupAttachment(
+      this,
+      "test_2",
+      {
+        port: 80,
+        targetGroupArn: Token.asString(awsLbTargetGroupTest.arn),
+        targetId: test.id,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsLbTargetGroupAttachmentTest.overrideLogicalId("test");
+  }
+}
+
+```
+
+### Lambda Target
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LambdaFunction } from "./.gen/providers/aws/lambda-function";
+import { LambdaPermission } from "./.gen/providers/aws/lambda-permission";
+import { LbTargetGroup } from "./.gen/providers/aws/lb-target-group";
+import { LbTargetGroupAttachment } from "./.gen/providers/aws/lb-target-group-attachment";
+interface MyConfig {
+  functionName: any;
+  role: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    const test = new LambdaFunction(this, "test", {
+      functionName: config.functionName,
+      role: config.role,
+    });
+    const awsLbTargetGroupTest = new LbTargetGroup(this, "test_1", {
+      name: "test",
+      targetType: "lambda",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsLbTargetGroupTest.overrideLogicalId("test");
+    const withLb = new LambdaPermission(this, "with_lb", {
+      action: "lambda:InvokeFunction",
+      functionName: test.functionName,
+      principal: "elasticloadbalancing.amazonaws.com",
+      sourceArn: Token.asString(awsLbTargetGroupTest.arn),
+      statementId: "AllowExecutionFromlb",
+    });
+    const awsLbTargetGroupAttachmentTest = new LbTargetGroupAttachment(
+      this,
+      "test_3",
+      {
+        dependsOn: [withLb],
+        targetGroupArn: Token.asString(awsLbTargetGroupTest.arn),
+        targetId: test.arn,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsLbTargetGroupAttachmentTest.overrideLogicalId("test");
+  }
+}
+
+```
+
+### Registering Multiple Targets
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import {
+  Token,
+  TerraformCount,
+  TerraformIterator,
+  Fn,
+  TerraformStack,
+} from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Instance } from "./.gen/providers/aws/instance";
+import { LbTargetGroup } from "./.gen/providers/aws/lb-target-group";
+import { LbTargetGroupAttachment } from "./.gen/providers/aws/lb-target-group-attachment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    /*In most cases loops should be handled in the programming language context and 
+    not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+    you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+    you need to keep this like it is.*/
+    const exampleCount = TerraformCount.of(Token.asNumber("3"));
+    const example = new Instance(this, "example", {
+      count: exampleCount,
+    });
+    const awsLbTargetGroupExample = new LbTargetGroup(this, "example_1", {});
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsLbTargetGroupExample.overrideLogicalId("example");
+    /*In most cases loops should be handled in the programming language context and 
+    not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+    you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+    you need to keep this like it is.*/
+    const exampleForEachIterator = TerraformIterator.fromList(
+      Token.asAny("${{ for k, v in ${" + example.fqn + "} : v.id => v}}")
+    );
+    const awsLbTargetGroupAttachmentExample = new LbTargetGroupAttachment(
+      this,
+      "example_2",
+      {
+        port: 80,
+        targetGroupArn: Token.asString(awsLbTargetGroupExample.arn),
+        targetId: Token.asString(
+          Fn.lookupNested(exampleForEachIterator.value, ["id"])
+        ),
+        forEach: exampleForEachIterator,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsLbTargetGroupAttachmentExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `targetGroupArn` - (Required) The ARN of the target group with which to register targets.
+* `targetId` (Required) The ID of the target. This is the Instance ID for an instance, or the container ID for an ECS container. If the target type is `ip`, specify an IP address. If the target type is `lambda`, specify the Lambda function ARN. If the target type is `alb`, specify the ALB ARN.
+
+The following arguments are optional:
+
+* `availabilityZone` - (Optional) The Availability Zone where the IP address of the target is to be registered. If the private IP address is outside of the VPC scope, this value must be set to `all`.
+* `port` - (Optional) The port on which targets receive traffic.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - A unique identifier for the attachment.
+
+## Import
+
+You cannot import Target Group Attachments.
+
+<!-- cache-key: cdktf-0.18.0 input-6a9d27eafb93acb313975b710f7a1fcae6eb952e788b12cf102506b713f35b5d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/lex_bot.html.markdown b/website/docs/cdktf/typescript/r/lex_bot.html.markdown
new file mode 100644
index 00000000000..bd7f7cda8c4
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/lex_bot.html.markdown
@@ -0,0 +1,174 @@
+---
+subcategory: "Lex Model Building"
+layout: "aws"
+page_title: "AWS: aws_lex_bot"
+description: |-
+  Provides an Amazon Lex bot resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lex_bot
+
+Provides an Amazon Lex Bot resource. For more information see
+[Amazon Lex: How It Works](https://docs.aws.amazon.com/lex/latest/dg/how-it-works.html)
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LexBot } from "./.gen/providers/aws/lex-bot";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new LexBot(this, "order_flowers_bot", {
+      abortStatement: {
+        message: [
+          {
+            content: "Sorry, I am not able to assist at this time",
+            contentType: "PlainText",
+          },
+        ],
+      },
+      childDirected: false,
+      clarificationPrompt: {
+        maxAttempts: 2,
+        message: [
+          {
+            content: "I didn't understand you, what would you like to do?",
+            contentType: "PlainText",
+          },
+        ],
+      },
+      createVersion: false,
+      description: "Bot to order flowers on the behalf of a user",
+      idleSessionTtlInSeconds: 600,
+      intent: [
+        {
+          intentName: "OrderFlowers",
+          intentVersion: "1",
+        },
+      ],
+      locale: "en-US",
+      name: "OrderFlowers",
+      processBehavior: "BUILD",
+      voiceId: "Salli",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `abortStatement` - (Required) The message that Amazon Lex uses to abort a conversation. Attributes are documented under [statement](#statement).
+* `childDirected` - (Required) By specifying true, you confirm that your use of Amazon Lex is related to a website, program, or other application that is directed or targeted, in whole or in part, to children under age 13 and subject to COPPA. For more information see the [Amazon Lex FAQ](https://aws.amazon.com/lex/faqs#data-security) and the [Amazon Lex PutBot API Docs](https://docs.aws.amazon.com/lex/latest/dg/API_PutBot.html#lex-PutBot-request-childDirected).
+* `clarificationPrompt` - (Required) The message that Amazon Lex uses when it doesn't understand the user's request. Attributes are documented under [prompt](#prompt).
+* `createVersion` - (Optional) Determines if a new bot version is created when the initial resource is created and on each update. Defaults to `false`.
+* `description` - (Optional) A description of the bot. Must be less than or equal to 200 characters in length.
+* `detectSentiment` - (Optional) When set to true user utterances are sent to Amazon Comprehend for sentiment analysis. If you don't specify detectSentiment, the default is `false`.
+* `enableModelImprovements` - (Optional) Set to `true` to enable access to natural language understanding improvements. When you set the `enableModelImprovements` parameter to true you can use the `nluIntentConfidenceThreshold` parameter to configure confidence scores. For more information, see [Confidence Scores](https://docs.aws.amazon.com/lex/latest/dg/confidence-scores.html). You can only set the `enableModelImprovements` parameter in certain Regions. If you set the parameter to true, your bot has access to accuracy improvements. For more information see the [Amazon Lex Bot PutBot API Docs](https://docs.aws.amazon.com/lex/latest/dg/API_PutBot.html#lex-PutBot-request-enableModelImprovements).
+* `idleSessionTtlInSeconds` - (Optional) The maximum time in seconds that Amazon Lex retains the data gathered in a conversation. Default is `300`. Must be a number between 60 and 86400 (inclusive).
+* `locale` - (Optional) Specifies the target locale for the bot. Any intent used in the bot must be compatible with the locale of the bot. For available locales, see [Amazon Lex Bot PutBot API Docs](https://docs.aws.amazon.com/lex/latest/dg/API_PutBot.html#lex-PutBot-request-locale). Default is `enUs`.
+* `intent` - (Required) A set of Intent objects. Each intent represents a command that a user can express. Attributes are documented under [intent](#intent). Can have up to 250 Intent objects.
+* `name` - (Required) The name of the bot that you want to create, case sensitive. Must be between 2 and 50 characters in length.
+* `nluIntentConfidenceThreshold` - (Optional) Determines the threshold where Amazon Lex will insert the AMAZON.FallbackIntent, AMAZON.KendraSearchIntent, or both when returning alternative intents in a PostContent or PostText response. AMAZON.FallbackIntent and AMAZON.KendraSearchIntent are only inserted if they are configured for the bot. For more information see [Amazon Lex Bot PutBot API Docs](https://docs.aws.amazon.com/lex/latest/dg/API_PutBot.html#lex-PutBot-request-nluIntentConfidenceThreshold) This value requires `enableModelImprovements` to be set to `true` and the default is `0`. Must be a float between 0 and 1.
+* `processBehavior` - (Optional) If you set the `processBehavior` element to `build`, Amazon Lex builds the bot so that it can be run. If you set the element to `save` Amazon Lex saves the bot, but doesn't build it. Default is `save`.
+* `voiceId` - (Optional) The Amazon Polly voice ID that you want Amazon Lex to use for voice interactions with the user. The locale configured for the voice must match the locale of the bot. For more information, see [Available Voices](http://docs.aws.amazon.com/polly/latest/dg/voicelist.html) in the Amazon Polly Developer Guide.
+
+### intent
+
+Identifies the specific version of an intent.
+
+* `intentName` - (Required) The name of the intent. Must be less than or equal to 100 characters in length.
+* `intentVersion` - (Required) The version of the intent. Must be less than or equal to 64 characters in length.
+
+### message
+
+The message object that provides the message text and its type.
+
+* `content` - (Required) The text of the message.
+* `contentType` - (Required) The content type of the message string.
+* `groupNumber` - (Optional) Identifies the message group that the message belongs to. When a group
+is assigned to a message, Amazon Lex returns one message from each group in the response.
+
+### prompt
+
+Obtains information from the user. To define a prompt, provide one or more messages and specify the
+number of attempts to get information from the user. If you provide more than one message, Amazon
+Lex chooses one of the messages to use to prompt the user.
+
+* `maxAttempts` - (Required) The number of times to prompt the user for information.
+* `message` - (Required) A set of messages, each of which provides a message string and its type.
+You can specify the message string in plain text or in Speech Synthesis Markup Language (SSML).
+Attributes are documented under [message](#message).
+* `responseCard` - (Optional) The response card. Amazon Lex will substitute session attributes and
+slot values into the response card. For more information, see
+[Example: Using a Response Card](https://docs.aws.amazon.com/lex/latest/dg/ex-resp-card.html).
+
+### statement
+
+A statement is a map with a set of message maps and an optional response card string. Messages
+convey information to the user. At runtime, Amazon Lex selects the message to convey.
+
+* `message` - (Required) A set of messages, each of which provides a message string and its type. You
+can specify the message string in plain text or in Speech Synthesis Markup Language (SSML). Attributes
+are documented under [message](#message).
+* `responseCard` - (Optional) The response card. Amazon Lex will substitute session attributes and
+slot values into the response card. For more information, see
+[Example: Using a Response Card](https://docs.aws.amazon.com/lex/latest/dg/ex-resp-card.html).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `5M`)
+* `update` - (Default `5M`)
+* `delete` - (Default `5M`)
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `checksum` - Checksum identifying the version of the bot that was created. The checksum is not
+included as an argument because the resource will add it automatically when updating the bot.
+* `createdDate` - The date when the bot version was created.
+* `failureReason` - If status is FAILED, Amazon Lex provides the reason that it failed to build the bot.
+* `lastUpdatedDate` - The date when the $LATEST version of this bot was updated.
+* `status` - When you send a request to create or update a bot, Amazon Lex sets the status response
+element to BUILDING. After Amazon Lex builds the bot, it sets status to READY. If Amazon Lex can't
+build the bot, it sets status to FAILED. Amazon Lex returns the reason for the failure in the
+failure_reason response element.
+* `version` - The version of the bot.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import bots using their name. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import bots using their name. For example:
+
+```console
+% terraform import aws_lex_bot.order_flowers_bot OrderFlowers
+```
+
+<!-- cache-key: cdktf-0.18.0 input-e97de4060b2ca18f867fded9294c619effbd503e7c58dacacd804ae26ee28522 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/lex_bot_alias.html.markdown b/website/docs/cdktf/typescript/r/lex_bot_alias.html.markdown
new file mode 100644
index 00000000000..6cbf6d47975
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/lex_bot_alias.html.markdown
@@ -0,0 +1,107 @@
+---
+subcategory: "Lex Model Building"
+layout: "aws"
+page_title: "AWS: aws_lex_bot_alias"
+description: |-
+  Provides an Amazon Lex Bot Alias resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lex_bot_alias
+
+Provides an Amazon Lex Bot Alias resource. For more information see
+[Amazon Lex: How It Works](https://docs.aws.amazon.com/lex/latest/dg/how-it-works.html)
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LexBotAlias } from "./.gen/providers/aws/lex-bot-alias";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new LexBotAlias(this, "order_flowers_prod", {
+      botName: "OrderFlowers",
+      botVersion: "1",
+      description: "Production Version of the OrderFlowers Bot.",
+      name: "OrderFlowersProd",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `botName` - (Required) The name of the bot.
+* `botVersion` - (Required) The name of the bot.
+* `conversationLogs` - (Optional) The settings that determine how Amazon Lex uses conversation logs for the alias. Attributes are documented under [conversation_logs](#conversation_logs).
+* `description` - (Optional) A description of the alias. Must be less than or equal to 200 characters in length.
+* `name` - (Required) The name of the alias. The name is not case sensitive. Must be less than or equal to 100 characters in length.
+
+### conversation_logs
+
+Contains information about conversation log settings.
+
+* `iamRoleArn` - (Required) The Amazon Resource Name (ARN) of the IAM role used to write your logs to CloudWatch Logs or an S3 bucket. Must be between 20 and 2048 characters in length.
+* `logSettings` - (Optional) The settings for your conversation logs. You can log text, audio, or both. Attributes are documented under [log_settings](#log_settings).
+
+### log_settings
+
+The settings for conversation logs.
+
+* `destination` - (Required) The destination where logs are delivered. Options are `cloudwatchLogs` or `s3`.
+* `kmsKeyArn` - (Optional) The Amazon Resource Name (ARN) of the key used to encrypt audio logs in an S3 bucket. This can only be specified when `destination` is set to `s3`. Must be between 20 and 2048 characters in length.
+* `logType` - (Required) The type of logging that is enabled. Options are `audio` or `text`.
+* `resourceArn` - (Required) The Amazon Resource Name (ARN) of the CloudWatch Logs log group or S3 bucket where the logs are delivered. Must be less than or equal to 2048 characters in length.
+* `resourcePrefix` - (Computed) The prefix of the S3 object key for `audio` logs or the log stream name for `text` logs.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the bot alias.
+* `checksum` - Checksum of the bot alias.
+* `createdDate` - The date that the bot alias was created.
+* `lastUpdatedDate` - The date that the bot alias was updated. When you create a resource, the creation date and the last updated date are the same.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `1M`)
+* `update` - (Default `1M`)
+* `delete` - (Default `5M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import bot aliases using an ID with the format `botName:botAliasName`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import bot aliases using an ID with the format `botName:botAliasName`. For example:
+
+```console
+% terraform import aws_lex_bot_alias.order_flowers_prod OrderFlowers:OrderFlowersProd
+```
+
+<!-- cache-key: cdktf-0.18.0 input-45b5fa895e86b52a4a0265d1cd0006d748a86ae86a7462e4c4c8ab42d16123fc -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/lex_intent.html.markdown b/website/docs/cdktf/typescript/r/lex_intent.html.markdown
new file mode 100644
index 00000000000..f03273e045a
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/lex_intent.html.markdown
@@ -0,0 +1,289 @@
+---
+subcategory: "Lex Model Building"
+layout: "aws"
+page_title: "AWS: aws_lex_intent"
+description: |-
+  Provides an Amazon Lex intent resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lex_intent
+
+Provides an Amazon Lex Intent resource. For more information see
+[Amazon Lex: How It Works](https://docs.aws.amazon.com/lex/latest/dg/how-it-works.html)
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LexIntent } from "./.gen/providers/aws/lex-intent";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new LexIntent(this, "order_flowers_intent", {
+      confirmationPrompt: {
+        maxAttempts: 2,
+        message: [
+          {
+            content:
+              "Okay, your {FlowerType} will be ready for pickup by {PickupTime} on {PickupDate}.  Does this sound okay?",
+            contentType: "PlainText",
+          },
+        ],
+      },
+      createVersion: false,
+      description: "Intent to order a bouquet of flowers for pick up",
+      fulfillmentActivity: {
+        type: "ReturnIntent",
+      },
+      name: "OrderFlowers",
+      rejectionStatement: {
+        message: [
+          {
+            content: "Okay, I will not place your order.",
+            contentType: "PlainText",
+          },
+        ],
+      },
+      sampleUtterances: [
+        "I would like to order some flowers",
+        "I would like to pick up flowers",
+      ],
+      slot: [
+        {
+          description: "The type of flowers to pick up",
+          name: "FlowerType",
+          priority: 1,
+          sampleUtterances: ["I would like to order {FlowerType}"],
+          slotConstraint: "Required",
+          slotType: "FlowerTypes",
+          slotTypeVersion: "$$LATEST",
+          valueElicitationPrompt: {
+            maxAttempts: 2,
+            message: [
+              {
+                content: "What type of flowers would you like to order?",
+                contentType: "PlainText",
+              },
+            ],
+          },
+        },
+        {
+          description: "The date to pick up the flowers",
+          name: "PickupDate",
+          priority: 2,
+          sampleUtterances: ["I would like to order {FlowerType}"],
+          slotConstraint: "Required",
+          slotType: "AMAZON.DATE",
+          slotTypeVersion: "$$LATEST",
+          valueElicitationPrompt: {
+            maxAttempts: 2,
+            message: [
+              {
+                content:
+                  "What day do you want the {FlowerType} to be picked up?",
+                contentType: "PlainText",
+              },
+            ],
+          },
+        },
+        {
+          description: "The time to pick up the flowers",
+          name: "PickupTime",
+          priority: 3,
+          sampleUtterances: ["I would like to order {FlowerType}"],
+          slotConstraint: "Required",
+          slotType: "AMAZON.TIME",
+          slotTypeVersion: "$$LATEST",
+          valueElicitationPrompt: {
+            maxAttempts: 2,
+            message: [
+              {
+                content:
+                  "Pick up the {FlowerType} at what time on {PickupDate}?",
+                contentType: "PlainText",
+              },
+            ],
+          },
+        },
+      ],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `conclusionStatement` - (Optional) The statement that you want Amazon Lex to convey to the user
+after the intent is successfully fulfilled by the Lambda function. This element is relevant only if
+you provide a Lambda function in the `fulfillmentActivity`. If you return the intent to the client
+application, you can't specify this element. The `followUpPrompt` and `conclusionStatement` are
+mutually exclusive. You can specify only one. Attributes are documented under [statement](#statement).
+* `confirmationPrompt` - (Optional) Prompts the user to confirm the intent. This question should
+have a yes or no answer. You you must provide both the `rejectionStatement` and `confirmationPrompt`,
+or neither. Attributes are documented under [prompt](#prompt).
+* `createVersion` - (Optional) Determines if a new slot type version is created when the initial
+resource is created and on each update. Defaults to `false`.
+* `description` - (Optional) A description of the intent. Must be less than or equal to 200 characters in length.
+* `dialogCodeHook` - (Optional) Specifies a Lambda function to invoke for each user input. You can
+invoke this Lambda function to personalize user interaction. Attributes are documented under [code_hook](#code_hook).
+* `followUpPrompt` - (Optional) Amazon Lex uses this prompt to solicit additional activity after
+fulfilling an intent. For example, after the OrderPizza intent is fulfilled, you might prompt the
+user to order a drink. The `followUpPrompt` field and the `conclusionStatement` field are mutually
+exclusive. You can specify only one. Attributes are documented under [follow_up_prompt](#follow_up_prompt).
+* `fulfillmentActivity` - (Required) Describes how the intent is fulfilled. For example, after a
+user provides all of the information for a pizza order, `fulfillmentActivity` defines how the bot
+places an order with a local pizza store. Attributes are documented under [fulfillment_activity](#fulfillment_activity).
+* `name` - (Required) The name of the intent, not case sensitive. Must be less than or equal to 100 characters in length.
+* `parentIntentSignature` - (Optional) A unique identifier for the built-in intent to base this
+intent on. To find the signature for an intent, see
+[Standard Built-in Intents](https://developer.amazon.com/public/solutions/alexa/alexa-skills-kit/docs/built-in-intent-ref/standard-intents)
+in the Alexa Skills Kit.
+* `rejectionStatement` - (Optional) When the user answers "no" to the question defined in
+`confirmationPrompt`, Amazon Lex responds with this statement to acknowledge that the intent was
+canceled. You must provide both the `rejectionStatement` and the `confirmationPrompt`, or neither.
+Attributes are documented under [statement](#statement).
+* `sampleUtterances` - (Optional) An array of utterances (strings) that a user might say to signal
+the intent. For example, "I want {PizzaSize} pizza", "Order {Quantity} {PizzaSize} pizzas".
+In each utterance, a slot name is enclosed in curly braces. Must have between 1 and 10 items in the list, and each item must be less than or equal to 200 characters in length.
+* `slot` - (Optional) An list of intent slots. At runtime, Amazon Lex elicits required slot values
+from the user using prompts defined in the slots. Attributes are documented under [slot](#slot).
+
+### code_hook
+
+Specifies a Lambda function that verifies requests to a bot or fulfills the user's request to a bot.
+
+* `messageVersion` - (Required) The version of the request-response that you want Amazon Lex to use
+to invoke your Lambda function. For more information, see
+[Using Lambda Functions](https://docs.aws.amazon.com/lex/latest/dg/using-lambda.html). Must be less than or equal to 5 characters in length.
+* `uri` - (Required) The Amazon Resource Name (ARN) of the Lambda function.
+
+### follow_up_prompt
+
+A prompt for additional activity after an intent is fulfilled. For example, after the OrderPizza
+intent is fulfilled, you might prompt the user to find out whether the user wants to order drinks.
+
+* `prompt` - (Required) Prompts for information from the user. Attributes are documented under [prompt](#prompt).
+* `rejectionStatement` - (Optional) If the user answers "no" to the question defined in the prompt field,
+Amazon Lex responds with this statement to acknowledge that the intent was canceled. Attributes are
+documented below under [statement](#statement).
+
+### fulfillment_activity
+
+Describes how the intent is fulfilled after the user provides all of the information required for the intent.
+
+* `type` - (Required) How the intent should be fulfilled, either by running a Lambda function or by
+returning the slot data to the client application. Type can be either `returnIntent` or `codeHook`, as documented [here](https://docs.aws.amazon.com/lex/latest/dg/API_FulfillmentActivity.html).
+* `codeHook` - (Optional) A description of the Lambda function that is run to fulfill the intent.
+Required if type is CodeHook. Attributes are documented under [code_hook](#code_hook).
+
+### message
+
+The message object that provides the message text and its type.
+
+* `content` - (Required) The text of the message. Must be less than or equal to 1000 characters in length.
+* `contentType` - (Required) The content type of the message string.
+* `groupNumber` - (Optional) Identifies the message group that the message belongs to. When a group
+is assigned to a message, Amazon Lex returns one message from each group in the response. Must be a number between 1 and 5 (inclusive).
+
+### prompt
+
+Obtains information from the user. To define a prompt, provide one or more messages and specify the
+number of attempts to get information from the user. If you provide more than one message, Amazon
+Lex chooses one of the messages to use to prompt the user.
+
+* `maxAttempts` - (Required) The number of times to prompt the user for information. Must be a number between 1 and 5 (inclusive).
+* `message` - (Required) A set of messages, each of which provides a message string and its type.
+You can specify the message string in plain text or in Speech Synthesis Markup Language (SSML).
+Attributes are documented under [message](#message). Must contain between 1 and 15 messages.
+* `responseCard` - (Optional) The response card. Amazon Lex will substitute session attributes and
+slot values into the response card. For more information, see
+[Example: Using a Response Card](https://docs.aws.amazon.com/lex/latest/dg/ex-resp-card.html). Must be less than or equal to 50000 characters in length.
+
+### slot
+
+Identifies the version of a specific slot.
+
+* `name` - (Required) The name of the intent slot that you want to create. The name is case sensitive. Must be less than or equal to 100 characters in length.
+* `slotConstraint` - (Required) Specifies whether the slot is required or optional.
+* `description` - (Optional) A description of the bot. Must be less than or equal to 200 characters in length.
+* `priority` - (Optional) Directs Lex the order in which to elicit this slot value from the user.
+For example, if the intent has two slots with priorities 1 and 2, AWS Lex first elicits a value for
+the slot with priority 1. If multiple slots share the same priority, the order in which Lex elicits
+values is arbitrary. Must be between 1 and 100.
+* `responseCard` - (Optional) The response card. Amazon Lex will substitute session attributes and
+slot values into the response card. For more information, see
+[Example: Using a Response Card](https://docs.aws.amazon.com/lex/latest/dg/ex-resp-card.html). Must be less than or equal to 50000 characters in length.
+* `sampleUtterances` - (Optional) If you know a specific pattern with which users might respond to
+an Amazon Lex request for a slot value, you can provide those utterances to improve accuracy. This
+is optional. In most cases, Amazon Lex is capable of understanding user utterances. Must have between 1 and 10 items in the list, and each item must be less than or equal to 200 characters in length.
+* `slotType` - (Optional) The type of the slot, either a custom slot type that you defined or one of
+the built-in slot types. Must be less than or equal to 100 characters in length.
+* `slotTypeVersion` - (Optional) The version of the slot type. Must be less than or equal to 64 characters in length.
+* `valueElicitationPrompt` - (Optional) The prompt that Amazon Lex uses to elicit the slot value
+from the user. Attributes are documented under [prompt](#prompt).
+
+### statement
+
+A statement is a map with a set of message maps and an optional response card string. Messages
+convey information to the user. At runtime, Amazon Lex selects the message to convey.
+
+* `message` - (Required) A set of messages, each of which provides a message string and its type.
+You can specify the message string in plain text or in Speech Synthesis Markup Language (SSML).
+Attributes are documented under [message](#message). Must contain between 1 and 15 messages.
+* `responseCard` - (Optional) The response card. Amazon Lex will substitute session attributes and
+slot values into the response card. For more information, see
+[Example: Using a Response Card](https://docs.aws.amazon.com/lex/latest/dg/ex-resp-card.html). Must be less than or equal to 50000 characters in length.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the Lex intent.
+* `checksum` - Checksum identifying the version of the intent that was created. The checksum is not
+included as an argument because the resource will add it automatically when updating the intent.
+* `createdDate` - The date when the intent version was created.
+* `lastUpdatedDate` - The date when the $LATEST version of this intent was updated.
+* `version` - The version of the bot.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `1M`)
+* `update` - (Default `1M`)
+* `delete` - (Default `5M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import intents using their name. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import intents using their name. For example:
+
+```console
+% terraform import aws_lex_intent.order_flowers_intent OrderFlowers
+```
+
+<!-- cache-key: cdktf-0.18.0 input-bc4d0529031c21b9dbe67a57c70be3664c7edf7ad0c0512f13dbf0d1a13356b3 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/lex_slot_type.html.markdown b/website/docs/cdktf/typescript/r/lex_slot_type.html.markdown
new file mode 100644
index 00000000000..d4705786d0d
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/lex_slot_type.html.markdown
@@ -0,0 +1,120 @@
+---
+subcategory: "Lex Model Building"
+layout: "aws"
+page_title: "AWS: aws_lex_slot_type"
+description: |-
+  Provides details about a specific Amazon Lex Slot Type
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lex_slot_type
+
+Provides an Amazon Lex Slot Type resource. For more information see
+[Amazon Lex: How It Works](https://docs.aws.amazon.com/lex/latest/dg/how-it-works.html)
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LexSlotType } from "./.gen/providers/aws/lex-slot-type";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new LexSlotType(this, "flower_types", {
+      createVersion: true,
+      description: "Types of flowers to order",
+      enumerationValue: [
+        {
+          synonyms: ["Lirium", "Martagon"],
+          value: "lilies",
+        },
+        {
+          synonyms: ["Eduardoregelia", "Podonix"],
+          value: "tulips",
+        },
+      ],
+      name: "FlowerTypes",
+      valueSelectionStrategy: "ORIGINAL_VALUE",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `enumerationValue` - (Required) A list of EnumerationValue objects that defines the values that
+the slot type can take. Each value can have a list of synonyms, which are additional values that help
+train the machine learning model about the values that it resolves for a slot. Attributes are
+documented under [enumeration_value](#enumeration_value).
+* `name` - (Required) The name of the slot type. The name is not case sensitive. Must be less than or equal to 100 characters in length.
+* `createVersion` - (Optional)
+Determines if a new slot type version is created when the initial resource is created and on each
+update. Defaults to `false`.
+* `description` - (Optional) A description of the slot type. Must be less than or equal to 200 characters in length.
+* `valueSelectionStrategy` - (Optional) Determines the slot resolution strategy that Amazon Lex
+uses to return slot type values. `originalValue` returns the value entered by the user if the user
+value is similar to the slot value. `topResolution` returns the first value in the resolution list
+if there is a resolution list for the slot, otherwise null is returned. Defaults to `originalValue`.
+
+### enumeration_value
+
+Each slot type can have a set of values. Each enumeration value represents a value the slot type
+can take.
+
+For example, a pizza ordering bot could have a slot type that specifies the type of crust that the
+pizza should have. The slot type could include the values: thick, thin, stuffed.
+
+* `synonyms` - (Optional) Additional values related to the slot type value. Each item must be less than or equal to 140 characters in length.
+* `value` - (Required) The value of the slot type. Must be less than or equal to 140 characters in length.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `1M`)
+* `update` - (Default `1M`)
+* `delete` - (Default `5M`)
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `checksum` - Checksum identifying the version of the slot type that was created. The checksum is
+not included as an argument because the resource will add it automatically when updating the slot type.
+* `createdDate` - The date when the slot type version was created.
+* `lastUpdatedDate` - The date when the `$latest` version of this slot type was updated.
+* `version` - The version of the slot type.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import slot types using their name. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import slot types using their name. For example:
+
+```console
+% terraform import aws_lex_slot_type.flower_types FlowerTypes
+```
+
+<!-- cache-key: cdktf-0.18.0 input-58681a55cb640f1116beebb5be5c7d0038c7e9b4981ccd70f4a9d065bd1b8d17 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/lexv2models_bot.html.markdown b/website/docs/cdktf/typescript/r/lexv2models_bot.html.markdown
new file mode 100644
index 00000000000..ead633a4a3f
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/lexv2models_bot.html.markdown
@@ -0,0 +1,111 @@
+---
+subcategory: "Lex V2 Models"
+layout: "aws"
+page_title: "AWS: aws_lexv2models_bot"
+description: |-
+  Terraform resource for managing an AWS Lex V2 Models Bot.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lexv2models_bot
+
+Terraform resource for managing an AWS Lex V2 Models Bot.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Lexv2ModelsBot } from "./.gen/providers/aws/lexv2-models-bot";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Lexv2ModelsBot(this, "example", {
+      dataPrivacy: [
+        {
+          childDirected: Token.asBoolean("boolean"),
+        },
+      ],
+      idleSessionTtlInSeconds: 10,
+      name: "example",
+      roleArn: "bot_example_arn",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - Name of the bot. The bot name must be unique in the account that creates the bot. Type String. Length Constraints: Minimum length of 1. Maximum length of 100.
+* `dataPrivacy` - Provides information on additional privacy protections Amazon Lex should use with the bot's data. See [`dataPrivacy`](#data-privacy)
+* `idleSessionTtlInSeconds` - Time, in seconds, that Amazon Lex should keep information about a user's conversation with the bot. You can specify between 60 (1 minute) and 86,400 (24 hours) seconds.
+* `roleArn` - ARN of an IAM role that has permission to access the bot.
+
+The following arguments are optional:
+
+* `members` - List of bot members in a network to be created. See [`botMembers`](#bot-members).
+* `botTags` - List of tags to add to the bot. You can only add tags when you create a bot.
+* `botType` - Type of a bot to create.
+* `description` - Description of the bot. It appears in lists to help you identify a particular bot.
+* `testBotAliasTags` - List of tags to add to the test alias for a bot. You can only add tags when you create a bot.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Unique identifier for a particular bot.
+
+### Data Privacy
+
+* `childDirected` (Required) -  For each Amazon Lex bot created with the Amazon Lex Model Building Service, you must specify whether your use of Amazon Lex is related to a website, program, or other application that is directed or targeted, in whole or in part, to children under age 13 and subject to the Children's Online Privacy Protection Act (COPPA) by specifying true or false in the childDirected field.
+
+### Bot Members
+
+* `aliasId` (Required) - Alias ID of a bot that is a member of this network of bots.
+* `aliasName` (Required) - Alias name of a bot that is a member of this network of bots.
+* `id` (Required) - Unique ID of a bot that is a member of this network of bots.
+* `name` (Required) - Unique name of a bot that is a member of this network of bots.
+* `version` (Required) - Version of a bot that is a member of this network of bots.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `30M`)
+* `update` - (Default `30M`)
+* `delete` - (Default `30M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Lex V2 Models Bot using the `exampleIdArg`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Lex V2 Models Bot using the `exampleIdArg`. For example:
+
+```console
+% terraform import aws_lexv2models_bot.example bot-id-12345678
+```
+
+<!-- cache-key: cdktf-0.18.0 input-7e4e7c49f1d8375bbd057208e9ba1b16a7f2a964f4ba619719401e55ba5eb370 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/licensemanager_association.html.markdown b/website/docs/cdktf/typescript/r/licensemanager_association.html.markdown
new file mode 100644
index 00000000000..09a72ee46e6
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/licensemanager_association.html.markdown
@@ -0,0 +1,106 @@
+---
+subcategory: "License Manager"
+layout: "aws"
+page_title: "AWS: aws_licensemanager_association"
+description: |-
+  Provides a License Manager association resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_licensemanager_association
+
+Provides a License Manager association.
+
+~> **Note:** License configurations can also be associated with launch templates by specifying the `licenseSpecifications` block for an `awsLaunchTemplate`.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsAmi } from "./.gen/providers/aws/data-aws-ami";
+import { Instance } from "./.gen/providers/aws/instance";
+import { LicensemanagerAssociation } from "./.gen/providers/aws/licensemanager-association";
+import { LicensemanagerLicenseConfiguration } from "./.gen/providers/aws/licensemanager-license-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new LicensemanagerLicenseConfiguration(this, "example", {
+      licenseCountingType: "Instance",
+      name: "Example",
+    });
+    const dataAwsAmiExample = new DataAwsAmi(this, "example_1", {
+      filter: [
+        {
+          name: "name",
+          values: ["amzn-ami-vpc-nat*"],
+        },
+      ],
+      mostRecent: true,
+      owners: ["amazon"],
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsAmiExample.overrideLogicalId("example");
+    const awsInstanceExample = new Instance(this, "example_2", {
+      ami: Token.asString(dataAwsAmiExample.id),
+      instanceType: "t2.micro",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsInstanceExample.overrideLogicalId("example");
+    const awsLicensemanagerAssociationExample = new LicensemanagerAssociation(
+      this,
+      "example_3",
+      {
+        licenseConfigurationArn: example.arn,
+        resourceArn: Token.asString(awsInstanceExample.arn),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsLicensemanagerAssociationExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `licenseConfigurationArn` - (Required) ARN of the license configuration.
+* `resourceArn` - (Required) ARN of the resource associated with the license configuration.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The license configuration ARN.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import license configurations using `resourceArn,licenseConfigurationArn`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import license configurations using `resourceArn,licenseConfigurationArn`. For example:
+
+```console
+% terraform import aws_licensemanager_association.example arn:aws:ec2:eu-west-1:123456789012:image/ami-123456789abcdef01,arn:aws:license-manager:eu-west-1:123456789012:license-configuration:lic-0123456789abcdef0123456789abcdef
+```
+
+<!-- cache-key: cdktf-0.18.0 input-8b8e9ddcd676f43167920f5782ed96b9679e5a610aa31170c5d53aa2d9e1453d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/licensemanager_association.markdown b/website/docs/cdktf/typescript/r/licensemanager_association.markdown
new file mode 100644
index 00000000000..09a72ee46e6
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/licensemanager_association.markdown
@@ -0,0 +1,106 @@
+---
+subcategory: "License Manager"
+layout: "aws"
+page_title: "AWS: aws_licensemanager_association"
+description: |-
+  Provides a License Manager association resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_licensemanager_association
+
+Provides a License Manager association.
+
+~> **Note:** License configurations can also be associated with launch templates by specifying the `licenseSpecifications` block for an `awsLaunchTemplate`.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsAmi } from "./.gen/providers/aws/data-aws-ami";
+import { Instance } from "./.gen/providers/aws/instance";
+import { LicensemanagerAssociation } from "./.gen/providers/aws/licensemanager-association";
+import { LicensemanagerLicenseConfiguration } from "./.gen/providers/aws/licensemanager-license-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new LicensemanagerLicenseConfiguration(this, "example", {
+      licenseCountingType: "Instance",
+      name: "Example",
+    });
+    const dataAwsAmiExample = new DataAwsAmi(this, "example_1", {
+      filter: [
+        {
+          name: "name",
+          values: ["amzn-ami-vpc-nat*"],
+        },
+      ],
+      mostRecent: true,
+      owners: ["amazon"],
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsAmiExample.overrideLogicalId("example");
+    const awsInstanceExample = new Instance(this, "example_2", {
+      ami: Token.asString(dataAwsAmiExample.id),
+      instanceType: "t2.micro",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsInstanceExample.overrideLogicalId("example");
+    const awsLicensemanagerAssociationExample = new LicensemanagerAssociation(
+      this,
+      "example_3",
+      {
+        licenseConfigurationArn: example.arn,
+        resourceArn: Token.asString(awsInstanceExample.arn),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsLicensemanagerAssociationExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `licenseConfigurationArn` - (Required) ARN of the license configuration.
+* `resourceArn` - (Required) ARN of the resource associated with the license configuration.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The license configuration ARN.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import license configurations using `resourceArn,licenseConfigurationArn`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import license configurations using `resourceArn,licenseConfigurationArn`. For example:
+
+```console
+% terraform import aws_licensemanager_association.example arn:aws:ec2:eu-west-1:123456789012:image/ami-123456789abcdef01,arn:aws:license-manager:eu-west-1:123456789012:license-configuration:lic-0123456789abcdef0123456789abcdef
+```
+
+<!-- cache-key: cdktf-0.18.0 input-8b8e9ddcd676f43167920f5782ed96b9679e5a610aa31170c5d53aa2d9e1453d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/licensemanager_grant.html.markdown b/website/docs/cdktf/typescript/r/licensemanager_grant.html.markdown
new file mode 100644
index 00000000000..ce32f30a87b
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/licensemanager_grant.html.markdown
@@ -0,0 +1,89 @@
+---
+subcategory: "License Manager"
+layout: "aws"
+page_title: "AWS: aws_licensemanager_grant"
+description: |-
+  Provides a License Manager grant resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_licensemanager_grant
+
+Provides a License Manager grant. This allows for sharing licenses with other AWS accounts.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LicensemanagerGrant } from "./.gen/providers/aws/licensemanager-grant";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new LicensemanagerGrant(this, "test", {
+      allowedOperations: [
+        "ListPurchasedLicenses",
+        "CheckoutLicense",
+        "CheckInLicense",
+        "ExtendConsumptionLicense",
+        "CreateToken",
+      ],
+      homeRegion: "us-east-1",
+      licenseArn: "arn:aws:license-manager::111111111111:license:l-exampleARN",
+      name: "share-license-with-account",
+      principal: "arn:aws:iam::111111111112:root",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The Name of the grant.
+* `allowedOperations` - (Required) A list of the allowed operations for the grant. This is a subset of the allowed operations on the license.
+* `licenseArn` - (Required) The ARN of the license to grant.
+* `principal` - (Required) The target account for the grant in the form of the ARN for an account principal of the root user.
+* `homeRegion` - (Required) The home region for the license.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The grant ARN (Same as `arn`).
+* `arn` - The grant ARN.
+* `parentArn` - The parent ARN.
+* `status` - The grant status.
+* `version` - The grant version.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsLicensemanagerGrant` using the grant arn. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsLicensemanagerGrant` using the grant arn. For example:
+
+```console
+% terraform import aws_licensemanager_grant.test arn:aws:license-manager::123456789011:grant:g-01d313393d9e443d8664cc054db1e089
+```
+
+<!-- cache-key: cdktf-0.18.0 input-419b075350bd4a341920e7dd03004f5baac3d5ff8e519534de15249f89df44ab -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/licensemanager_grant_accepter.html.markdown b/website/docs/cdktf/typescript/r/licensemanager_grant_accepter.html.markdown
new file mode 100644
index 00000000000..6c4a06897d7
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/licensemanager_grant_accepter.html.markdown
@@ -0,0 +1,81 @@
+---
+subcategory: "License Manager"
+layout: "aws"
+page_title: "AWS: aws_licensemanager_grant_accepter"
+description: |-
+  Accepts a License Manager grant resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_licensemanager_grant_accepter
+
+Accepts a License Manager grant. This allows for sharing licenses with other aws accounts.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LicensemanagerGrantAccepter } from "./.gen/providers/aws/licensemanager-grant-accepter";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new LicensemanagerGrantAccepter(this, "test", {
+      grantArn:
+        "arn:aws:license-manager::123456789012:grant:g-1cf9fba4ba2f42dcab11c686c4b4d329",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `grantArn` - (Required) The ARN of the grant to accept.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The grant ARN (Same as `arn`).
+* `arn` - The grant ARN.
+* `name` - The Name of the grant.
+* `allowedOperations` - A list of the allowed operations for the grant.
+* `licenseArn` - The ARN of the license for the grant.
+* `principal` - The target account for the grant.
+* `homeRegion` - The home region for the license.
+* `parentArn` - The parent ARN.
+* `status` - The grant status.
+* `version` - The grant version.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsLicensemanagerGrantAccepter` using the grant arn. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsLicensemanagerGrantAccepter` using the grant arn. For example:
+
+```console
+% terraform import aws_licensemanager_grant_accepter.test arn:aws:license-manager::123456789012:grant:g-1cf9fba4ba2f42dcab11c686c4b4d329
+```
+
+<!-- cache-key: cdktf-0.18.0 input-b6bc3dfd68fc5e40493efa8095e697e235b9281777309cc1fb51e9af52dca95d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/licensemanager_license_configuration.html.markdown b/website/docs/cdktf/typescript/r/licensemanager_license_configuration.html.markdown
new file mode 100644
index 00000000000..a44460362b1
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/licensemanager_license_configuration.html.markdown
@@ -0,0 +1,102 @@
+---
+subcategory: "License Manager"
+layout: "aws"
+page_title: "AWS: aws_licensemanager_license_configuration"
+description: |-
+  Provides a License Manager license configuration resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_licensemanager_license_configuration
+
+Provides a License Manager license configuration resource.
+
+~> **Note:** Removing the `licenseCount` attribute is not supported by the License Manager API - use `terraform taint aws_licensemanager_license_configuration.<id>` to recreate the resource instead.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LicensemanagerLicenseConfiguration } from "./.gen/providers/aws/licensemanager-license-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new LicensemanagerLicenseConfiguration(this, "example", {
+      description: "Example",
+      licenseCount: 10,
+      licenseCountHardLimit: true,
+      licenseCountingType: "Socket",
+      licenseRules: ["#minimumSockets=2"],
+      name: "Example",
+      tags: {
+        foo: "barr",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) Name of the license configuration.
+* `description` - (Optional) Description of the license configuration.
+* `licenseCount` - (Optional) Number of licenses managed by the license configuration.
+* `licenseCountHardLimit` - (Optional) Sets the number of available licenses as a hard limit.
+* `licenseCountingType` - (Required) Dimension to use to track license inventory. Specify either `vCpu`, `instance`, `core` or `socket`.
+* `licenseRules` - (Optional) Array of configured License Manager rules.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Rules
+
+License rules should be in the format of `#ruleType=ruleValue`. Supported rule types:
+
+* `minimumVcpus` - Resource must have minimum vCPU count in order to use the license. Default: 1
+* `maximumVcpus` - Resource must have maximum vCPU count in order to use the license. Default: unbounded, limit: 10000
+* `minimumCores` - Resource must have minimum core count in order to use the license. Default: 1
+* `maximumCores` - Resource must have maximum core count in order to use the license. Default: unbounded, limit: 10000
+* `minimumSockets` - Resource must have minimum socket count in order to use the license. Default: 1
+* `maximumSockets` - Resource must have maximum socket count in order to use the license. Default: unbounded, limit: 10000
+* `allowedTenancy` - Defines where the license can be used. If set, restricts license usage to selected tenancies. Specify a comma delimited list of `ec2Default`, `ec2DedicatedHost`, `ec2DedicatedInstance`
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The license configuration ARN.
+* `id` - The license configuration ARN.
+* `ownerAccountId` - Account ID of the owner of the license configuration.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import license configurations using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import license configurations using the `id`. For example:
+
+```console
+% terraform import aws_licensemanager_license_configuration.example arn:aws:license-manager:eu-west-1:123456789012:license-configuration:lic-0123456789abcdef0123456789abcdef
+```
+
+<!-- cache-key: cdktf-0.18.0 input-5a8f27111f7375c06f96dc77659a24d2efcdd9bfe181e061904d734084d24650 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/licensemanager_license_configuration.markdown b/website/docs/cdktf/typescript/r/licensemanager_license_configuration.markdown
new file mode 100644
index 00000000000..a44460362b1
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/licensemanager_license_configuration.markdown
@@ -0,0 +1,102 @@
+---
+subcategory: "License Manager"
+layout: "aws"
+page_title: "AWS: aws_licensemanager_license_configuration"
+description: |-
+  Provides a License Manager license configuration resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_licensemanager_license_configuration
+
+Provides a License Manager license configuration resource.
+
+~> **Note:** Removing the `licenseCount` attribute is not supported by the License Manager API - use `terraform taint aws_licensemanager_license_configuration.<id>` to recreate the resource instead.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LicensemanagerLicenseConfiguration } from "./.gen/providers/aws/licensemanager-license-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new LicensemanagerLicenseConfiguration(this, "example", {
+      description: "Example",
+      licenseCount: 10,
+      licenseCountHardLimit: true,
+      licenseCountingType: "Socket",
+      licenseRules: ["#minimumSockets=2"],
+      name: "Example",
+      tags: {
+        foo: "barr",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) Name of the license configuration.
+* `description` - (Optional) Description of the license configuration.
+* `licenseCount` - (Optional) Number of licenses managed by the license configuration.
+* `licenseCountHardLimit` - (Optional) Sets the number of available licenses as a hard limit.
+* `licenseCountingType` - (Required) Dimension to use to track license inventory. Specify either `vCpu`, `instance`, `core` or `socket`.
+* `licenseRules` - (Optional) Array of configured License Manager rules.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Rules
+
+License rules should be in the format of `#ruleType=ruleValue`. Supported rule types:
+
+* `minimumVcpus` - Resource must have minimum vCPU count in order to use the license. Default: 1
+* `maximumVcpus` - Resource must have maximum vCPU count in order to use the license. Default: unbounded, limit: 10000
+* `minimumCores` - Resource must have minimum core count in order to use the license. Default: 1
+* `maximumCores` - Resource must have maximum core count in order to use the license. Default: unbounded, limit: 10000
+* `minimumSockets` - Resource must have minimum socket count in order to use the license. Default: 1
+* `maximumSockets` - Resource must have maximum socket count in order to use the license. Default: unbounded, limit: 10000
+* `allowedTenancy` - Defines where the license can be used. If set, restricts license usage to selected tenancies. Specify a comma delimited list of `ec2Default`, `ec2DedicatedHost`, `ec2DedicatedInstance`
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The license configuration ARN.
+* `id` - The license configuration ARN.
+* `ownerAccountId` - Account ID of the owner of the license configuration.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import license configurations using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import license configurations using the `id`. For example:
+
+```console
+% terraform import aws_licensemanager_license_configuration.example arn:aws:license-manager:eu-west-1:123456789012:license-configuration:lic-0123456789abcdef0123456789abcdef
+```
+
+<!-- cache-key: cdktf-0.18.0 input-5a8f27111f7375c06f96dc77659a24d2efcdd9bfe181e061904d734084d24650 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/lightsail_bucket.html.markdown b/website/docs/cdktf/typescript/r/lightsail_bucket.html.markdown
new file mode 100644
index 00000000000..ed0ec1a59e2
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/lightsail_bucket.html.markdown
@@ -0,0 +1,81 @@
+---
+subcategory: "Lightsail"
+layout: "aws"
+page_title: "AWS: aws_lightsail_bucket"
+description: |-
+  Provides a lightsail bucket
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lightsail_bucket
+
+Provides a lightsail bucket.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LightsailBucket } from "./.gen/providers/aws/lightsail-bucket";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new LightsailBucket(this, "test", {
+      bundleId: "small_1_0",
+      name: "mytestbucket",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name for the bucket.
+* `bundleId` - (Required) - The ID of the bundle to use for the bucket. A bucket bundle specifies the monthly cost, storage space, and data transfer quota for a bucket. Use the [get-bucket-bundles](https://docs.aws.amazon.com/cli/latest/reference/lightsail/get-bucket-bundles.html) cli command to get a list of bundle IDs that you can specify.
+* `forceDelete` - (Optional) - Force Delete non-empty buckets using `terraform destroy`. AWS by default will not delete an s3 bucket which is not empty, to prevent losing bucket data and affecting other resources in lightsail. If `forceDelete` is set to `true` the bucket will be deleted even when not empty.
+* `tags` - (Optional) A map of tags to assign to the resource. To create a key-only tag, use an empty string as the value. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name used for this bucket (matches `name`).
+* `arn` - The ARN of the lightsail bucket.
+* `availabilityZone` - The resource Availability Zone. Follows the format us-east-2a (case-sensitive).
+* `createdAt` - The timestamp when the bucket was created.
+* `region` - The Amazon Web Services Region name.
+* `supportCode` - The support code for the resource. Include this code in your email to support when you have questions about a resource in Lightsail. This code enables our support team to look up your Lightsail information more easily.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider `defaultTags` configuration block.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsLightsailBucket` using the `name` attribute. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsLightsailBucket` using the `name` attribute. For example:
+
+```console
+% terraform import aws_lightsail_bucket.test example-bucket
+```
+
+<!-- cache-key: cdktf-0.18.0 input-d78cdd83a8835a614b707d0e291b7c234f89104b66f2a32a7706513d7cce144c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/lightsail_bucket_access_key.html.markdown b/website/docs/cdktf/typescript/r/lightsail_bucket_access_key.html.markdown
new file mode 100644
index 00000000000..3825db38fab
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/lightsail_bucket_access_key.html.markdown
@@ -0,0 +1,83 @@
+---
+subcategory: "Lightsail"
+layout: "aws"
+page_title: "AWS: aws_lightsail_bucket_access_key"
+description: |-
+  Provides a lightsail bucket access key. This is a set of credentials that allow API requests to be made to the lightsail bucket.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lightsail_bucket_access_key
+
+Provides a lightsail bucket access key. This is a set of credentials that allow API requests to be made to the lightsail bucket.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LightsailBucketAccessKeyAccessKey } from "./.gen/providers/aws/";
+import { LightsailBucket } from "./.gen/providers/aws/lightsail-bucket";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new LightsailBucket(this, "test", {
+      bundleId: "small_1_0",
+      name: "mytestbucket",
+    });
+    const awsLightsailBucketAccessKeyAccessKeyTest =
+      new LightsailBucketAccessKeyAccessKey(this, "test_1", {
+        bucket_name: awsLightsailBucketAccessKeyTest.id,
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsLightsailBucketAccessKeyAccessKeyTest.overrideLogicalId("test");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `bucketName` - (Required) The name of the bucket that the new access key will belong to, and grant access to.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - A combination of attributes separated by a `,` to create a unique id: `bucketName`,`accessKeyId`
+* `accessKeyId` - The ID of the access key.
+* `createdAt` - The timestamp when the access key was created.
+* `secretAccessKey` - The secret access key used to sign requests. This attribute is not available for imported resources. Note that this will be written to the state file.
+* `status` - The status of the access key.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsLightsailBucketAccessKey` using the `id` attribute. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsLightsailBucketAccessKey` using the `id` attribute. For example:
+
+```console
+% terraform import aws_lightsail_bucket_access_key.test example-bucket,AKIA47VOQ2KPR7LLRZ6D
+```
+
+<!-- cache-key: cdktf-0.18.0 input-4987b702ac9d88a7d12a903a50c895eccdf400c8ee70bccc957c21e050e1eb7f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/lightsail_bucket_resource_access.html.markdown b/website/docs/cdktf/typescript/r/lightsail_bucket_resource_access.html.markdown
new file mode 100644
index 00000000000..0697afe5a7d
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/lightsail_bucket_resource_access.html.markdown
@@ -0,0 +1,90 @@
+---
+subcategory: "Lightsail"
+layout: "aws"
+page_title: "AWS: aws_lightsail_bucket_resource_access"
+description: |-
+  Provides a lightsail resource access to a bucket.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lightsail_bucket_resource_access
+
+Provides a lightsail resource access to a bucket.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LightsailBucket } from "./.gen/providers/aws/lightsail-bucket";
+import { LightsailBucketResourceAccess } from "./.gen/providers/aws/lightsail-bucket-resource-access";
+import { LightsailInstance } from "./.gen/providers/aws/lightsail-instance";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new LightsailBucket(this, "test", {
+      bundleId: "small_1_0",
+      name: "mytestbucket",
+    });
+    const awsLightsailBucketResourceAccessTest =
+      new LightsailBucketResourceAccess(this, "test_1", {
+        bucketName: Token.asString(awsLightsailBucketResourceAccessTest.id),
+        resourceName: id,
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsLightsailBucketResourceAccessTest.overrideLogicalId("test");
+    const awsLightsailInstanceTest = new LightsailInstance(this, "test_2", {
+      availabilityZone: "us-east-1b",
+      blueprintId: "amazon_linux_2",
+      bundleId: "nano_1_0",
+      name: "mytestinstance",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsLightsailInstanceTest.overrideLogicalId("test");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `bucketName` - (Required) The name of the bucket to grant access to.
+* `resourceName` - (Required) The name of the resource to be granted bucket access.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - A combination of attributes separated by a `,` to create a unique id: `bucketName`,`resourceName`
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsLightsailBucketResourceAccess` using the `id` attribute. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsLightsailBucketResourceAccess` using the `id` attribute. For example:
+
+```console
+% terraform import aws_lightsail_bucket_resource_access.test example-bucket,example-instance
+```
+
+<!-- cache-key: cdktf-0.18.0 input-e66e2caf6e37ed190e4f20bfc333ee8f9ffb8ca628a14ba9a473ab2aa2e22e18 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/lightsail_certificate.html.markdown b/website/docs/cdktf/typescript/r/lightsail_certificate.html.markdown
new file mode 100644
index 00000000000..5bdd4478d86
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/lightsail_certificate.html.markdown
@@ -0,0 +1,80 @@
+---
+subcategory: "Lightsail"
+layout: "aws"
+page_title: "AWS: aws_lightsail_certificate"
+description: |-
+  Provides a lightsail certificate
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lightsail_certificate
+
+Provides a lightsail certificate.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LightsailCertificate } from "./.gen/providers/aws/lightsail-certificate";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new LightsailCertificate(this, "test", {
+      domainName: "testdomain.com",
+      name: "test",
+      subjectAlternativeNames: ["www.testdomain.com"],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the Lightsail load balancer.
+* `domainName` - (Required) A domain name for which the certificate should be issued.
+* `subjectAlternativeNames` - (Optional) Set of domains that should be SANs in the issued certificate. `domainName` attribute is automatically added as a Subject Alternative Name.
+* `tags` - (Optional) A map of tags to assign to the resource. To create a key-only tag, use an empty string as the value. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name of the lightsail certificate (matches `name`).
+* `arn` - The ARN of the lightsail certificate.
+* `createdAt` - The timestamp when the instance was created.
+* `domainValidationOptions` - Set of domain validation objects which can be used to complete certificate validation. Can have more than one element, e.g., if SANs are defined.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider `defaultTags` configuration block.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsLightsailCertificate` using the certificate name. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsLightsailCertificate` using the certificate name. For example:
+
+```console
+% terraform import aws_lightsail_certificate.test CertificateName
+```
+
+<!-- cache-key: cdktf-0.18.0 input-fa74f908bf0e275af92966e17e2db46d1735155118450df59ddb6d8e9735f416 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/lightsail_container_service.html.markdown b/website/docs/cdktf/typescript/r/lightsail_container_service.html.markdown
new file mode 100644
index 00000000000..40da7be9b74
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/lightsail_container_service.html.markdown
@@ -0,0 +1,253 @@
+---
+subcategory: "Lightsail"
+layout: "aws"
+page_title: "AWS: aws_lightsail_container_service"
+description: |- 
+  Provides a resource to manage Lightsail container service
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lightsail_container_service
+
+An Amazon Lightsail container service is a highly scalable compute and networking resource on which you can deploy, run,
+and manage containers. For more information, see
+[Container services in Amazon Lightsail](https://lightsail.aws.amazon.com/ls/docs/en_us/articles/amazon-lightsail-container-services).
+
+~> **Note:** For more information about the AWS Regions in which you can create Amazon Lightsail container services,
+see ["Regions and Availability Zones in Amazon Lightsail"](https://lightsail.aws.amazon.com/ls/docs/overview/article/understanding-regions-and-availability-zones-in-amazon-lightsail).
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LightsailContainerService } from "./.gen/providers/aws/lightsail-container-service";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new LightsailContainerService(this, "my_container_service", {
+      isDisabled: false,
+      name: "container-service-1",
+      power: "nano",
+      scale: 1,
+      tags: {
+        foo1: "bar1",
+        foo2: "",
+      },
+    });
+  }
+}
+
+```
+
+### Public Domain Names
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LightsailContainerService } from "./.gen/providers/aws/lightsail-container-service";
+interface MyConfig {
+  name: any;
+  power: any;
+  scale: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new LightsailContainerService(this, "my_container_service", {
+      publicDomainNames: {
+        certificate: [
+          {
+            certificateName: "example-certificate",
+            domainNames: ["www.example.com"],
+          },
+        ],
+      },
+      name: config.name,
+      power: config.power,
+      scale: config.scale,
+    });
+  }
+}
+
+```
+
+### Private Registry Access
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { EcrRepositoryPolicy } from "./.gen/providers/aws/ecr-repository-policy";
+import { LightsailContainerService } from "./.gen/providers/aws/lightsail-container-service";
+interface MyConfig {
+  name: any;
+  power: any;
+  scale: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    const defaultVar = new LightsailContainerService(this, "default", {
+      privateRegistryAccess: {
+        ecrImagePullerRole: {
+          isActive: true,
+        },
+      },
+      name: config.name,
+      power: config.power,
+      scale: config.scale,
+    });
+    const dataAwsIamPolicyDocumentDefault = new DataAwsIamPolicyDocument(
+      this,
+      "default_1",
+      {
+        statement: [
+          {
+            actions: ["ecr:BatchGetImage", "ecr:GetDownloadUrlForLayer"],
+            effect: "Allow",
+            principals: [
+              {
+                identifiers: [
+                  Token.asString(
+                    Fn.lookupNested(defaultVar.privateRegistryAccess, [
+                      "0",
+                      "ecr_image_puller_role",
+                      "0",
+                      "principal_arn",
+                    ])
+                  ),
+                ],
+                type: "AWS",
+              },
+            ],
+          },
+        ],
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsIamPolicyDocumentDefault.overrideLogicalId("default");
+    const awsEcrRepositoryPolicyDefault = new EcrRepositoryPolicy(
+      this,
+      "default_2",
+      {
+        policy: Token.asString(dataAwsIamPolicyDocumentDefault.json),
+        repository: Token.asString(awsEcrRepositoryDefault.name),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsEcrRepositoryPolicyDefault.overrideLogicalId("default");
+  }
+}
+
+```
+
+## Argument Reference
+
+~> **NOTE:** You must create and validate an SSL/TLS certificate before you can use `publicDomainNames` with your
+container service. For more information, see
+[Enabling and managing custom domains for your Amazon Lightsail container services](https://lightsail.aws.amazon.com/ls/docs/en_us/articles/amazon-lightsail-creating-container-services-certificates).
+
+This argument supports the following arguments:
+
+* `name` - (Required) The name for the container service. Names must be of length 1 to 63, and be
+  unique within each AWS Region in your Lightsail account.
+* `power` - (Required) The power specification for the container service. The power specifies the amount of memory,
+  the number of vCPUs, and the monthly price of each node of the container service.
+  Possible values: `nano`, `micro`, `small`, `medium`, `large`, `xlarge`.
+* `scale` - (Required) The scale specification for the container service. The scale specifies the allocated compute
+  nodes of the container service.
+* `isDisabled` - (Optional) A Boolean value indicating whether the container service is disabled. Defaults to `false`.
+* `publicDomainNames` - (Optional) The public domain names to use with the container service, such as example.com
+  and www.example.com. You can specify up to four public domain names for a container service. The domain names that you
+  specify are used when you create a deployment with a container configured as the public endpoint of your container
+  service. If you don't specify public domain names, then you can use the default domain of the container service.
+  Defined below.
+* `privateRegistryAccess` - (Optional) An object to describe the configuration for the container service to access private container image repositories, such as Amazon Elastic Container Registry (Amazon ECR) private repositories. See [Private Registry Access](#private-registry-access) below for more details.
+* `tags` - (Optional) Map of container service tags. To tag at launch, specify the tags in the Launch Template. If
+  configured with a provider
+  [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block)
+  present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Private Registry Access
+
+The `privateRegistryAccess` block supports the following arguments:
+
+* `ecrImagePullerRole` - (Optional) Describes a request to configure an Amazon Lightsail container service to access private container image repositories, such as Amazon Elastic Container Registry (Amazon ECR) private repositories. See [ECR Image Puller Role](#ecr-image-puller-role) below for more details.
+
+### ECR Image Puller Role
+
+The `ecrImagePullerRole` blocks supports the following arguments:
+
+* `isActive` - (Optional) A Boolean value that indicates whether to activate the role. The default is `false`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the container service.
+* `availabilityZone` - The Availability Zone. Follows the format us-east-2a (case-sensitive).
+* `id` - Same as `name`.
+* `powerId` - The ID of the power of the container service.
+* `principalArn`- The principal ARN of the container service. The principal ARN can be used to create a trust
+  relationship between your standard AWS account and your Lightsail container service. This allows you to give your
+  service permission to access resources in your standard AWS account.
+* `privateDomainName` - The private domain name of the container service. The private domain name is accessible only
+  by other resources within the default virtual private cloud (VPC) of your Lightsail account.
+* `regionName` - The AWS Region name.
+* `resourceType` - The Lightsail resource type of the container service (i.e., ContainerService).
+* `state` - The current state of the container service.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider
+  [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `url` - The publicly accessible URL of the container service. If no public endpoint is specified in the
+  currentDeployment, this URL returns a 404 response.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `30M`)
+* `update` - (Default `30M`)
+* `delete` - (Default `30M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Lightsail Container Service using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Lightsail Container Service using the `name`. For example:
+
+```console
+% terraform import aws_lightsail_container_service.my_container_service container-service-1
+```
+
+<!-- cache-key: cdktf-0.18.0 input-a73e29d48c4928c341fdc728c20c41a3e699af1e8921fe46e3340cce9c056c70 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/lightsail_container_service_deployment_version.html.markdown b/website/docs/cdktf/typescript/r/lightsail_container_service_deployment_version.html.markdown
new file mode 100644
index 00000000000..a91f742cfbe
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/lightsail_container_service_deployment_version.html.markdown
@@ -0,0 +1,142 @@
+---
+subcategory: "Lightsail"
+layout: "aws"
+page_title: "AWS: aws_lightsail_container_service_deployment_version"
+description: |-
+  Provides a resource to manage a deployment version for your Amazon Lightsail container service.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lightsail_container_service_deployment_version
+
+Provides a resource to manage a deployment version for your Amazon Lightsail container service.
+
+~> **NOTE:** The Amazon Lightsail container service must be enabled to create a deployment.
+
+~> **NOTE:** This resource allows you to manage an Amazon Lightsail container service deployment version but Terraform cannot destroy it. Removing this resource from your configuration will remove it from your statefile and Terraform management.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LightsailContainerServiceDeploymentVersion } from "./.gen/providers/aws/lightsail-container-service-deployment-version";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new LightsailContainerServiceDeploymentVersion(this, "example", {
+      container: [
+        {
+          command: [],
+          containerName: "hello-world",
+          environment: {
+            MY_ENVIRONMENT_VARIABLE: "my_value",
+          },
+          image: "amazon/amazon-lightsail:hello-world",
+          ports: {
+            80: "HTTP",
+          },
+        },
+      ],
+      publicEndpoint: {
+        containerName: "hello-world",
+        containerPort: 80,
+        healthCheck: {
+          healthyThreshold: 2,
+          intervalSeconds: 5,
+          path: "/",
+          successCodes: "200-499",
+          timeoutSeconds: 2,
+          unhealthyThreshold: 2,
+        },
+      },
+      serviceName: Token.asString(awsLightsailContainerServiceExample.name),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `serviceName` - (Required) The name for the container service.
+* `container` - (Required) A set of configuration blocks that describe the settings of the containers that will be launched on the container service. Maximum of 53. [Detailed below](#container).
+* `publicEndpoint` - (Optional) A configuration block that describes the settings of the public endpoint for the container service. [Detailed below](#public_endpoint).
+
+### `container`
+
+The `container` configuration block supports the following arguments:
+
+* `containerName` - (Required) The name for the container.
+* `image` - (Required) The name of the image used for the container. Container images sourced from your Lightsail container service, that are registered and stored on your service, start with a colon (`:`). For example, `:containerService1Mystaticwebsite1`. Container images sourced from a public registry like Docker Hub don't start with a colon. For example, `nginx:latest` or `nginx`.
+* `command` - (Optional) The launch command for the container. A list of string.
+* `environment` - (Optional) A key-value map of the environment variables of the container.
+* `ports` - (Optional) A key-value map of the open firewall ports of the container. Valid values: `http`, `https`, `tcp`, `udp`.
+
+### `publicEndpoint`
+
+The `publicEndpoint` configuration block supports the following arguments:
+
+* `containerName` - (Required) The name of the container for the endpoint.
+* `containerPort` - (Required) The port of the container to which traffic is forwarded to.
+* `healthCheck` - (Required) A configuration block that describes the health check configuration of the container. [Detailed below](#health_check).
+
+### `healthCheck`
+
+The `healthCheck` configuration block supports the following arguments:
+
+* `healthyThreshold` - (Optional) The number of consecutive health checks successes required before moving the container to the Healthy state. Defaults to 2.
+* `unhealthyThreshold` - (Optional) The number of consecutive health checks failures required before moving the container to the Unhealthy state. Defaults to 2.
+* `timeoutSeconds` - (Optional) The amount of time, in seconds, during which no response means a failed health check. You can specify between 2 and 60 seconds. Defaults to 2.
+* `intervalSeconds` - (Optional) The approximate interval, in seconds, between health checks of an individual container. You can specify between 5 and 300 seconds. Defaults to 5.
+* `path` - (Optional) The path on the container on which to perform the health check. Defaults to "/".
+* `successCodes` - (Optional) The HTTP codes to use when checking for a successful response from a container. You can specify values between 200 and 499. Defaults to "200-499".
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The `serviceName` and `version` separation by a slash (`/`).
+* `createdAt` - The timestamp when the deployment was created.
+* `state` - The current state of the container service.
+* `version` - The version number of the deployment.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `30M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Lightsail Container Service Deployment Version using the `serviceName` and `version` separated by a slash (`/`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Lightsail Container Service Deployment Version using the `serviceName` and `version` separated by a slash (`/`). For example:
+
+```console
+% terraform import aws_lightsail_container_service_deployment_version.example container-service-1/1
+```
+
+<!-- cache-key: cdktf-0.18.0 input-bb1ba480fb42ed01fcc93296f85d9bb0f9f2e3da82d84722d66da594585cd420 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/lightsail_database.html.markdown b/website/docs/cdktf/typescript/r/lightsail_database.html.markdown
new file mode 100644
index 00000000000..230420d84c6
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/lightsail_database.html.markdown
@@ -0,0 +1,281 @@
+---
+subcategory: "Lightsail"
+layout: "aws"
+page_title: "AWS: aws_lightsail_database"
+description: |-
+  Provides a Lightsail Database
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lightsail_database
+
+Provides a Lightsail Database. Amazon Lightsail is a service to provide easy virtual private servers
+with custom software already setup. See [What is Amazon Lightsail?](https://lightsail.aws.amazon.com/ls/docs/getting-started/article/what-is-amazon-lightsail)
+for more information.
+
+~> **Note:** Lightsail is currently only supported in a limited number of AWS Regions, please see ["Regions and Availability Zones"](https://aws.amazon.com/about-aws/global-infrastructure/regional-product-services/) for more details
+
+## Example Usage
+
+### Basic mysql blueprint
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LightsailDatabase } from "./.gen/providers/aws/lightsail-database";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new LightsailDatabase(this, "test", {
+      availabilityZone: "us-east-1a",
+      blueprintId: "mysql_8_0",
+      bundleId: "micro_1_0",
+      masterDatabaseName: "testdatabasename",
+      masterPassword: "testdatabasepassword",
+      masterUsername: "test",
+      relationalDatabaseName: "test",
+    });
+  }
+}
+
+```
+
+### Basic postrgres blueprint
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LightsailDatabase } from "./.gen/providers/aws/lightsail-database";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new LightsailDatabase(this, "test", {
+      availabilityZone: "us-east-1a",
+      blueprintId: "postgres_12",
+      bundleId: "micro_1_0",
+      masterDatabaseName: "testdatabasename",
+      masterPassword: "testdatabasepassword",
+      masterUsername: "test",
+      relationalDatabaseName: "test",
+    });
+  }
+}
+
+```
+
+### Custom backup and maintenance windows
+
+Below is an example that sets a custom backup and maintenance window. Times are specified in UTC. This example will allow daily backups to take place between 16:00 and 16:30 each day. This example also requires any maintiance tasks (anything that would cause an outage, including changing some attributes) to take place on Tuesdays between 17:00 and 17:30. An action taken against this database that would cause an outage will wait until this time window to make the requested changes.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LightsailDatabase } from "./.gen/providers/aws/lightsail-database";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new LightsailDatabase(this, "test", {
+      availabilityZone: "us-east-1a",
+      blueprintId: "postgres_12",
+      bundleId: "micro_1_0",
+      masterDatabaseName: "testdatabasename",
+      masterPassword: "testdatabasepassword",
+      masterUsername: "test",
+      preferredBackupWindow: "16:00-16:30",
+      preferredMaintenanceWindow: "Tue:17:00-Tue:17:30",
+      relationalDatabaseName: "test",
+    });
+  }
+}
+
+```
+
+### Final Snapshots
+
+To enable creating a final snapshot of your database on deletion, use the `finalSnapshotName` argument to provide a name to be used for the snapshot.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LightsailDatabase } from "./.gen/providers/aws/lightsail-database";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new LightsailDatabase(this, "test", {
+      availabilityZone: "us-east-1a",
+      blueprintId: "postgres_12",
+      bundleId: "micro_1_0",
+      finalSnapshotName: "MyFinalSnapshot",
+      masterDatabaseName: "testdatabasename",
+      masterPassword: "testdatabasepassword",
+      masterUsername: "test",
+      preferredBackupWindow: "16:00-16:30",
+      preferredMaintenanceWindow: "Tue:17:00-Tue:17:30",
+      relationalDatabaseName: "test",
+    });
+  }
+}
+
+```
+
+### Apply Immediately
+
+To enable applying changes immediately instead of waiting for a maintiance window, use the `applyImmediately` argument.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LightsailDatabase } from "./.gen/providers/aws/lightsail-database";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new LightsailDatabase(this, "test", {
+      applyImmediately: true,
+      availabilityZone: "us-east-1a",
+      blueprintId: "postgres_12",
+      bundleId: "micro_1_0",
+      masterDatabaseName: "testdatabasename",
+      masterPassword: "testdatabasepassword",
+      masterUsername: "test",
+      relationalDatabaseName: "test",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `relationalDatabaseName` - (Required) The name to use for your new Lightsail database resource. Names be unique within each AWS Region in your Lightsail account.
+* `availabilityZone` - The Availability Zone in which to create your new database. Use the us-east-2a case-sensitive format.
+* `masterDatabaseName` - (Required) The name of the master database created when the Lightsail database resource is created.
+* `masterPassword` - (Sensitive) The password for the master user of your new database. The password can include any printable ASCII character except "/", """, or "@".
+* `masterUsername` - The master user name for your new database.
+* `blueprintId` - (Required) The blueprint ID for your new database. A blueprint describes the major engine version of a database. You can get a list of database blueprints IDs by using the AWS CLI command: `aws lightsail get-relational-database-blueprints`
+* `bundleId` - (Required)  The bundle ID for your new database. A bundle describes the performance specifications for your database (see list below). You can get a list of database bundle IDs by using the AWS CLI command: `aws lightsail get-relational-database-bundles`.
+* `preferredBackupWindow` - The daily time range during which automated backups are created for your new database if automated backups are enabled. Must be in the hh24:mi-hh24:mi format. Example: `16:0016:30`. Specified in Coordinated Universal Time (UTC).
+* `preferredMaintenanceWindow` - The weekly time range during which system maintenance can occur on your new database. Must be in the ddd:hh24:mi-ddd:hh24:mi format. Specified in Coordinated Universal Time (UTC). Example: `tue:17:00Tue:17:30`
+* `publiclyAccessible` - Specifies the accessibility options for your new database. A value of true specifies a database that is available to resources outside of your Lightsail account. A value of false specifies a database that is available only to your Lightsail resources in the same region as your database.
+* `applyImmediately` - When true , applies changes immediately. When false , applies changes during the preferred maintenance window. Some changes may cause an outage.
+* `backupRetentionEnabled` - When true, enables automated backup retention for your database. When false, disables automated backup retention for your database. Disabling backup retention deletes all automated database backups. Before disabling this, you may want to create a snapshot of your database.
+* `skipFinalSnapshot` - Determines whether a final database snapshot is created before your database is deleted. If true is specified, no database snapshot is created. If false is specified, a database snapshot is created before your database is deleted. You must specify the final relational database snapshot name parameter if the skip final snapshot parameter is false.
+* `finalSnapshotName` - (Required unless `skip_final_snapshot = true`) The name of the database snapshot created if skip final snapshot is false, which is the default value for that parameter.
+* `tags` - (Optional) A map of tags to assign to the resource. To create a key-only tag, use an empty string as the value.
+
+## Blueprint Ids
+
+A list of all available Lightsail Blueprints for Relational Databases the [aws lightsail get-relational-database-blueprints](https://docs.aws.amazon.com/cli/latest/reference/lightsail/get-relational-database-blueprints.html) aws cli command.
+
+### Examples
+
+- `mysql80`
+- `postgres12`
+
+### Prefix
+
+A Blueprint ID starts with a prefix of the engine type.
+
+### Suffix
+
+A Blueprint ID has a sufix of the engine version.
+
+## Bundles
+
+A list of all available Lightsail Bundles for Relational Databases the [aws lightsail get-relational-database-bundles](https://docs.aws.amazon.com/cli/latest/reference/lightsail/get-relational-database-bundles.html) aws cli command.
+
+### Examples
+
+- `small10`
+- `smallHa10`
+- `large10`
+- `largeHa10`
+
+### Prefix
+
+A Bundle ID starts with one of the below size prefixes:
+
+- `micro`
+- `small`
+- `medium`
+- `large`
+
+### Infixes (Optional for HA Database)
+
+A Bundle Id can have the following infix added in order to use the HA option of the selected bundle.
+
+- `ha`
+
+### Suffix
+
+A Bundle ID ends with one of the following suffix: `10`
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ARN of the Lightsail instance (matches `arn`).
+* `arn` - The ARN of the Lightsail instance (matches `id`).
+* `caCertificateIdentifier` - The certificate associated with the database.
+* `createdAt` - The timestamp when the instance was created.
+* `engine` - The database software (for example, MySQL).
+* `engineVersion` - The database engine version (for example, 5.7.23).
+* `cpuCount` - The number of vCPUs for the database.
+* `ramSize` - The amount of RAM in GB for the database.
+* `diskSize` - The size of the disk for the database.
+* `masterEndpointPort` - The master endpoint network port for the database.
+* `masterEndpointAddress` - The master endpoint fqdn for the database.
+* `secondaryAvailabilityZone` - Describes the secondary Availability Zone of a high availability database. The secondary database is used for failover support of a high availability database.
+* `supportCode` - The support code for the database. Include this code in your email to support when you have questions about a database in Lightsail. This code enables our support team to look up your Lightsail information more easily.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Lightsail Databases using their name. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Lightsail Databases using their name. For example:
+
+```console
+% terraform import aws_lightsail_database.foo 'bar'
+```
+
+<!-- cache-key: cdktf-0.18.0 input-c460ea904b2c519242690eaca4e01b78c0151a707412615588901072ae863f56 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/lightsail_disk.html.markdown b/website/docs/cdktf/typescript/r/lightsail_disk.html.markdown
new file mode 100644
index 00000000000..4a563612cba
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/lightsail_disk.html.markdown
@@ -0,0 +1,90 @@
+---
+subcategory: "Lightsail"
+layout: "aws"
+page_title: "AWS: aws_lightsail_disk"
+description: |-
+  Provides a Lightsail Disk resource
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lightsail_disk
+
+Provides a Lightsail Disk resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsAvailabilityZones } from "./.gen/providers/aws/data-aws-availability-zones";
+import { LightsailDisk } from "./.gen/providers/aws/lightsail-disk";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const available = new DataAwsAvailabilityZones(this, "available", {
+      filter: [
+        {
+          name: "opt-in-status",
+          values: ["opt-in-not-required"],
+        },
+      ],
+      state: "available",
+    });
+    new LightsailDisk(this, "test", {
+      availabilityZone: Token.asString(Fn.lookupNested(available.names, ["0"])),
+      name: "test",
+      sizeInGb: 8,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the Lightsail load balancer.
+* `sizeInGb` - (Required) The instance port the load balancer will connect.
+* `availabilityZone` - (Required) The Availability Zone in which to create your disk.
+* `tags` - (Optional) A map of tags to assign to the resource. To create a key-only tag, use an empty string as the value. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name of the disk  (matches `name`).
+* `arn` - The ARN of the Lightsail load balancer.
+* `createdAt` - The timestamp when the load balancer was created.
+* `supportCode` - The support code for the disk. Include this code in your email to support when you have questions about a disk in Lightsail. This code enables our support team to look up your Lightsail information more easily.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsLightsailDisk` using the name attribute. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsLightsailDisk` using the name attribute. For example:
+
+```console
+% terraform import aws_lightsail_disk.test test
+```
+
+<!-- cache-key: cdktf-0.18.0 input-7753e5e8b07d0ea697ccda6f53778fce21cb9f997c8e2dfbe4fb7552ab0ed771 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/lightsail_disk_attachment.html.markdown b/website/docs/cdktf/typescript/r/lightsail_disk_attachment.html.markdown
new file mode 100644
index 00000000000..980ed5e721d
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/lightsail_disk_attachment.html.markdown
@@ -0,0 +1,106 @@
+---
+subcategory: "Lightsail"
+layout: "aws"
+page_title: "AWS: aws_lightsail_disk_attachment"
+description: |-
+  Attaches a Lightsail disk to a Lightsail Instance
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lightsail_disk_attachment
+
+Attaches a Lightsail disk to a Lightsail Instance
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsAvailabilityZones } from "./.gen/providers/aws/data-aws-availability-zones";
+import { LightsailDisk } from "./.gen/providers/aws/lightsail-disk";
+import { LightsailDiskAttachment } from "./.gen/providers/aws/lightsail-disk-attachment";
+import { LightsailInstance } from "./.gen/providers/aws/lightsail-instance";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const available = new DataAwsAvailabilityZones(this, "available", {
+      filter: [
+        {
+          name: "opt-in-status",
+          values: ["opt-in-not-required"],
+        },
+      ],
+      state: "available",
+    });
+    const test = new LightsailDisk(this, "test", {
+      availabilityZone: Token.asString(Fn.lookupNested(available.names, ["0"])),
+      name: "test-disk",
+      sizeInGb: 8,
+    });
+    const awsLightsailInstanceTest = new LightsailInstance(this, "test_2", {
+      availabilityZone: Token.asString(Fn.lookupNested(available.names, ["0"])),
+      blueprintId: "amazon_linux_2",
+      bundleId: "nano_1_0",
+      name: "test-instance",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsLightsailInstanceTest.overrideLogicalId("test");
+    const awsLightsailDiskAttachmentTest = new LightsailDiskAttachment(
+      this,
+      "test_3",
+      {
+        diskName: test.name,
+        diskPath: "/dev/xvdf",
+        instanceName: Token.asString(awsLightsailInstanceTest.name),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsLightsailDiskAttachmentTest.overrideLogicalId("test");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `diskName` - (Required) The name of the Lightsail Disk.
+* `instanceName` - (Required) The name of the Lightsail Instance to attach to.
+* `diskPath` - (Required) The disk path to expose to the instance.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - A combination of attributes to create a unique id: `diskName`,`instanceName`
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsLightsailDisk` using the id attribute. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsLightsailDisk` using the id attribute. For example:
+
+```console
+% terraform import aws_lightsail_disk_attachment.test test-disk,test-instance
+```
+
+<!-- cache-key: cdktf-0.18.0 input-8aa776f81865acd643ae2da7cb03aaafbc8afae9bb63c07ef0a52959cc6fe723 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/lightsail_distribution.html.markdown b/website/docs/cdktf/typescript/r/lightsail_distribution.html.markdown
new file mode 100644
index 00000000000..ce76dccaea0
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/lightsail_distribution.html.markdown
@@ -0,0 +1,340 @@
+---
+subcategory: "Lightsail"
+layout: "aws"
+page_title: "AWS: aws_lightsail_distribution"
+description: |-
+  Terraform resource for managing an AWS Lightsail Distribution.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lightsail_distribution
+
+Terraform resource for managing an AWS Lightsail Distribution.
+
+## Example Usage
+
+### Basic Usage
+
+Below is a basic example with a bucket as an origin.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LightsailBucket } from "./.gen/providers/aws/lightsail-bucket";
+import { LightsailDistribution } from "./.gen/providers/aws/lightsail-distribution";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const test = new LightsailBucket(this, "test", {
+      bundleId: "small_1_0",
+      name: "test-bucket",
+    });
+    const awsLightsailDistributionTest = new LightsailDistribution(
+      this,
+      "test_1",
+      {
+        bundleId: "small_1_0",
+        cacheBehaviorSettings: {
+          allowedHttpMethods: "GET,HEAD,OPTIONS,PUT,PATCH,POST,DELETE",
+          cachedHttpMethods: "GET,HEAD",
+          defaultTtl: 86400,
+          forwardedCookies: {
+            option: "none",
+          },
+          forwardedHeaders: {
+            option: "default",
+          },
+          forwardedQueryStrings: {
+            option: false,
+          },
+          maximumTtl: 31536000,
+          minimumTtl: 0,
+        },
+        defaultCacheBehavior: {
+          behavior: "cache",
+        },
+        name: "test-distribution",
+        origin: {
+          name: test.name,
+          regionName: test.region,
+        },
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsLightsailDistributionTest.overrideLogicalId("test");
+  }
+}
+
+```
+
+### instance origin example
+
+Below is an example of an instance as the origin.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsAvailabilityZones } from "./.gen/providers/aws/data-aws-availability-zones";
+import { LightsailDistribution } from "./.gen/providers/aws/lightsail-distribution";
+import { LightsailInstance } from "./.gen/providers/aws/lightsail-instance";
+import { LightsailStaticIp } from "./.gen/providers/aws/lightsail-static-ip";
+import { LightsailStaticIpAttachment } from "./.gen/providers/aws/lightsail-static-ip-attachment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const test = new LightsailStaticIp(this, "test", {
+      name: "test-static-ip",
+    });
+    const available = new DataAwsAvailabilityZones(this, "available", {
+      filter: [
+        {
+          name: "opt-in-status",
+          values: ["opt-in-not-required"],
+        },
+      ],
+      state: "available",
+    });
+    const awsLightsailInstanceTest = new LightsailInstance(this, "test_2", {
+      availabilityZone: Token.asString(Fn.lookupNested(available.names, ["0"])),
+      blueprintId: "amazon_linux_2",
+      bundleId: "micro_1_0",
+      name: "test-instance",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsLightsailInstanceTest.overrideLogicalId("test");
+    const awsLightsailStaticIpAttachmentTest = new LightsailStaticIpAttachment(
+      this,
+      "test_3",
+      {
+        instanceName: Token.asString(awsLightsailInstanceTest.name),
+        staticIpName: test.name,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsLightsailStaticIpAttachmentTest.overrideLogicalId("test");
+    const awsLightsailDistributionTest = new LightsailDistribution(
+      this,
+      "test_4",
+      {
+        bundleId: "small_1_0",
+        defaultCacheBehavior: {
+          behavior: "cache",
+        },
+        dependsOn: [awsLightsailStaticIpAttachmentTest],
+        name: "test-distribution",
+        origin: {
+          name: Token.asString(awsLightsailInstanceTest.name),
+          regionName: Token.asString(available.id),
+        },
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsLightsailDistributionTest.overrideLogicalId("test");
+  }
+}
+
+```
+
+### lb origin example
+
+Below is an example with a load balancer as an origin
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, Fn, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsAvailabilityZones } from "./.gen/providers/aws/data-aws-availability-zones";
+import { LightsailDistribution } from "./.gen/providers/aws/lightsail-distribution";
+import { LightsailInstance } from "./.gen/providers/aws/lightsail-instance";
+import { LightsailLb } from "./.gen/providers/aws/lightsail-lb";
+import { LightsailLbAttachment } from "./.gen/providers/aws/lightsail-lb-attachment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const test = new LightsailLb(this, "test", {
+      healthCheckPath: "/",
+      instancePort: Token.asNumber("80"),
+      name: "test-load-balancer",
+      tags: {
+        foo: "bar",
+      },
+    });
+    const available = new DataAwsAvailabilityZones(this, "available", {
+      filter: [
+        {
+          name: "opt-in-status",
+          values: ["opt-in-not-required"],
+        },
+      ],
+      state: "available",
+    });
+    const awsLightsailInstanceTest = new LightsailInstance(this, "test_2", {
+      availabilityZone: Token.asString(Fn.lookupNested(available.names, ["0"])),
+      blueprintId: "amazon_linux_2",
+      bundleId: "nano_1_0",
+      name: "test-instance",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsLightsailInstanceTest.overrideLogicalId("test");
+    const awsLightsailLbAttachmentTest = new LightsailLbAttachment(
+      this,
+      "test_3",
+      {
+        instanceName: Token.asString(awsLightsailInstanceTest.name),
+        lbName: test.name,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsLightsailLbAttachmentTest.overrideLogicalId("test");
+    const awsLightsailDistributionTest = new LightsailDistribution(
+      this,
+      "test_4",
+      {
+        bundleId: "small_1_0",
+        defaultCacheBehavior: {
+          behavior: "cache",
+        },
+        dependsOn: [awsLightsailLbAttachmentTest],
+        name: "test-distribution",
+        origin: {
+          name: test.name,
+          regionName: Token.asString(available.id),
+        },
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsLightsailDistributionTest.overrideLogicalId("test");
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) Name of the distribution.
+* `bundleId` - (Required) Bundle ID to use for the distribution.
+* `defaultCacheBehavior` - (Required) Object that describes the default cache behavior of the distribution. [Detailed below](#default_cache_behavior)
+* `origin` - (Required) Object that describes the origin resource of the distribution, such as a Lightsail instance, bucket, or load balancer. [Detailed below](#origin)
+* `cacheBehaviorSettings` - (Required) An object that describes the cache behavior settings of the distribution. [Detailed below](#cache_behavior_settings)
+
+The following arguments are optional:
+
+* `cacheBehavior` - (Optional) A set of configuration blocks that describe the per-path cache behavior of the distribution. [Detailed below](#cache_behavior)
+* `certificateName` - (Optional) The name of the SSL/TLS certificate attached to the distribution, if any.
+* `ipAddressType` - (Optional) The IP address type of the distribution. Default: `dualstack`.
+* `isEnabled` - (Optional) Indicates whether the distribution is enabled. Default: `true`.
+* `tags` - (Optional) Map of tags for the Lightsail Distribution. If
+  configured with a provider
+  [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block)
+  present, tags with matching keys will overwrite those defined at the provider-level.
+
+### default_cache_behavior
+
+* `behavior` - (Required) The cache behavior of the distribution. Valid values: `cache` and `dontCache`.
+
+### origin
+
+* `name` - (Required) The name of the origin resource. Your origin can be an instance with an attached static IP, a bucket, or a load balancer that has at least one instance attached to it.
+* `protocolPolicy` - (Optional) The protocol that your Amazon Lightsail distribution uses when establishing a connection with your origin to pull content.
+* `regionName` - (Required) The AWS Region name of the origin resource.
+* `resourceType` - (Computed) The resource type of the origin resource (e.g., Instance).
+
+### cache_behavior_settings
+
+* `allowedHttpMethods` - (Optional) The HTTP methods that are processed and forwarded to the distribution's origin.
+* `cachedHttpMethods` - (Optional) The HTTP method responses that are cached by your distribution.
+* `defaultTtl` - (Optional) The default amount of time that objects stay in the distribution's cache before the distribution forwards another request to the origin to determine whether the content has been updated.
+* `forwardedCookies` - (Required) An object that describes the cookies that are forwarded to the origin. Your content is cached based on the cookies that are forwarded. [Detailed below](#forwarded_cookies)
+* `forwardedHeaders` - (Required) An object that describes the headers that are forwarded to the origin. Your content is cached based on the headers that are forwarded. [Detailed below](#forwarded_headers)
+* `forwardedQueryStrings` - (Required) An object that describes the query strings that are forwarded to the origin. Your content is cached based on the query strings that are forwarded. [Detailed below](#forwarded_query_strings)
+* `maximumTtl` - (Optional) The maximum amount of time that objects stay in the distribution's cache before the distribution forwards another request to the origin to determine whether the object has been updated.
+* `minimumTtl` - (Optional) The minimum amount of time that objects stay in the distribution's cache before the distribution forwards another request to the origin to determine whether the object has been updated.
+
+#### forwarded_cookies
+
+* `cookiesAllowList` - (Required) The specific cookies to forward to your distribution's origin.
+* `option` - (Optional) Specifies which cookies to forward to the distribution's origin for a cache behavior: all, none, or allow-list to forward only the cookies specified in the cookiesAllowList parameter.
+
+#### forwarded_headers
+
+* `headersAllowList` - (Required) The specific headers to forward to your distribution's origin.
+* `option` - (Optional) The headers that you want your distribution to forward to your origin and base caching on.
+
+#### forwarded_query_strings
+
+* `option` - (Optional) Indicates whether the distribution forwards and caches based on query strings.
+* `queryStringsAllowedList` - (Required) The specific query strings that the distribution forwards to the origin.
+
+### cache_behavior
+
+* `behavior` - (Required) The cache behavior for the specified path.
+* `path` - (Required) The path to a directory or file to cached, or not cache. Use an asterisk symbol to specify wildcard directories (path/to/assets/\*), and file types (\*.html, \*jpg, \*js). Directories and file paths are case-sensitive.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `alternativeDomainNames` - The alternate domain names of the distribution.
+* `arn` - The Amazon Resource Name (ARN) of the distribution.
+* `createdAt` - The timestamp when the distribution was created.
+* `domainName` - The domain name of the distribution.
+* `location` - An object that describes the location of the distribution, such as the AWS Region and Availability Zone. [Detailed below](#location)
+* `originPublicDns` - The public DNS of the origin.
+* `resourceType` - The Lightsail resource type (e.g., Distribution).
+* `status` - The status of the distribution.
+* `supportCode` - The support code. Include this code in your email to support when you have questions about your Lightsail distribution. This code enables our support team to look up your Lightsail information more easily.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+### location
+
+* `availabilityZone` - The Availability Zone. Follows the format us-east-2a (case-sensitive).
+* `regionName` - The AWS Region name.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `60M`)
+* `update` - (Default `180M`)
+* `delete` - (Default `90M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Lightsail Distribution using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Lightsail Distribution using the `id`. For example:
+
+```console
+% terraform import aws_lightsail_distribution.example rft-8012925589
+```
+
+<!-- cache-key: cdktf-0.18.0 input-b44e08c4566f08d2f501b30c7bf2c5324fc78fc14f7f0e7e555cd7b0bc5ae99f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/lightsail_domain.html.markdown b/website/docs/cdktf/typescript/r/lightsail_domain.html.markdown
new file mode 100644
index 00000000000..5d723f4e29f
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/lightsail_domain.html.markdown
@@ -0,0 +1,56 @@
+---
+subcategory: "Lightsail"
+layout: "aws"
+page_title: "AWS: aws_lightsail_domain"
+description: |-
+  Provides an Lightsail Domain
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lightsail_domain
+
+Creates a domain resource for the specified domain (e.g., example.com).
+You cannot register a new domain name using Lightsail. You must register
+a domain name using Amazon Route 53 or another domain name registrar.
+If you have already registered your domain, you can enter its name in
+this parameter to manage the DNS records for that domain.
+
+~> **Note:** Lightsail is currently only supported in a limited number of AWS Regions, please see ["Regions and Availability Zones in Amazon Lightsail"](https://lightsail.aws.amazon.com/ls/docs/overview/article/understanding-regions-and-availability-zones-in-amazon-lightsail) for more details
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LightsailDomain } from "./.gen/providers/aws/lightsail-domain";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new LightsailDomain(this, "domain_test", {
+      domainName: "mydomain.com",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `domainName` - (Required) The name of the Lightsail domain to manage
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name used for this domain
+* `arn` - The ARN of the Lightsail domain
+
+<!-- cache-key: cdktf-0.18.0 input-ffbbbe97ecce19529f1dc27d99e86dc419c73490e72176bbf4fd342ce0c31d6d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/lightsail_domain_entry.html.markdown b/website/docs/cdktf/typescript/r/lightsail_domain_entry.html.markdown
new file mode 100644
index 00000000000..c0b9ea406e7
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/lightsail_domain_entry.html.markdown
@@ -0,0 +1,90 @@
+---
+subcategory: "Lightsail"
+layout: "aws"
+page_title: "AWS: aws_lightsail_domain_entry"
+description: |-
+  Provides an Lightsail Domain Entry
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lightsail_domain_entry
+
+Creates a domain entry resource
+
+~> **NOTE on `id`:** In an effort to simplify imports, this resource `id` field has been updated to the standard resource id separator, a comma (`,`). For backward compatibility, the previous separator (underscore `_`) can still be used to read and import existing resources. When state is refreshed, the `id` will be updated to use the new standard separator. The previous separator will be deprecated in a future major release.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LightsailDomain } from "./.gen/providers/aws/lightsail-domain";
+import { LightsailDomainEntry } from "./.gen/providers/aws/lightsail-domain-entry";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new LightsailDomain(this, "test", {
+      domainName: "mydomain.com",
+    });
+    const awsLightsailDomainEntryTest = new LightsailDomainEntry(
+      this,
+      "test_1",
+      {
+        domainName: domainTest.domainName,
+        name: "www",
+        target: "127.0.0.1",
+        type: "A",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsLightsailDomainEntryTest.overrideLogicalId("test");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `domainName` - (Required) The name of the Lightsail domain in which to create the entry
+* `name` - (Required) Name of the entry record
+* `type` - (Required) Type of record
+* `target` - (Required) Target of the domain entry
+* `isAlias` - (Optional) If the entry should be an alias Defaults to `false`
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - A combination of attributes to create a unique id: `name`,`domainName`,`type`,`target`
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsLightsailDomainEntry` using the id attribute. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsLightsailDomainEntry` using the id attribute. For example:
+
+```console
+% terraform import aws_lightsail_domain_entry.example www,mydomain.com,A,127.0.0.1
+```
+
+<!-- cache-key: cdktf-0.18.0 input-5611067be5b2911c504ce2dd0c0db39671077d1db16f1803538d003af55e4cb1 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/lightsail_instance.html.markdown b/website/docs/cdktf/typescript/r/lightsail_instance.html.markdown
new file mode 100644
index 00000000000..a12da5d54fb
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/lightsail_instance.html.markdown
@@ -0,0 +1,226 @@
+---
+subcategory: "Lightsail"
+layout: "aws"
+page_title: "AWS: aws_lightsail_instance"
+description: |-
+  Provides an Lightsail Instance
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lightsail_instance
+
+Provides a Lightsail Instance. Amazon Lightsail is a service to provide easy virtual private servers
+with custom software already setup. See [What is Amazon Lightsail?](https://lightsail.aws.amazon.com/ls/docs/getting-started/article/what-is-amazon-lightsail)
+for more information.
+
+~> **Note:** Lightsail is currently only supported in a limited number of AWS Regions, please see ["Regions and Availability Zones in Amazon Lightsail"](https://lightsail.aws.amazon.com/ls/docs/overview/article/understanding-regions-and-availability-zones-in-amazon-lightsail) for more details
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LightsailInstance } from "./.gen/providers/aws/lightsail-instance";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new LightsailInstance(this, "gitlab_test", {
+      availabilityZone: "us-east-1b",
+      blueprintId: "amazon_linux_2",
+      bundleId: "nano_1_0",
+      keyPairName: "some_key_name",
+      name: "custom_gitlab",
+      tags: {
+        foo: "bar",
+      },
+    });
+  }
+}
+
+```
+
+### Example With User Data
+
+Lightsail user data is handled differently than ec2 user data. Lightsail user data only accepts a single lined string. The below example shows installing apache and creating the index page.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LightsailInstance } from "./.gen/providers/aws/lightsail-instance";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new LightsailInstance(this, "custom", {
+      availabilityZone: "us-east-1b",
+      blueprintId: "amazon_linux_2",
+      bundleId: "nano_1_0",
+      name: "custom",
+      userData:
+        "sudo yum install -y httpd && sudo systemctl start httpd && sudo systemctl enable httpd && echo '<h1>Deployed via Terraform</h1>' | sudo tee /var/www/html/index.html",
+    });
+  }
+}
+
+```
+
+### Enable Auto Snapshots
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LightsailInstance } from "./.gen/providers/aws/lightsail-instance";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new LightsailInstance(this, "test", {
+      addOn: {
+        snapshotTime: "06:00",
+        status: "Enabled",
+        type: "AutoSnapshot",
+      },
+      availabilityZone: "us-east-1b",
+      blueprintId: "amazon_linux_2",
+      bundleId: "nano_1_0",
+      name: "custom_instance",
+      tags: {
+        foo: "bar",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the Lightsail Instance. Names be unique within each AWS Region in your Lightsail account.
+* `availabilityZone` - (Required) The Availability Zone in which to create your
+instance (see list below)
+* `blueprintId` - (Required) The ID for a virtual private server image. A list of available blueprint IDs can be obtained using the AWS CLI command: `aws lightsail get-blueprints`
+* `bundleId` - (Required) The bundle of specification information (see list below)
+* `keyPairName` - (Optional) The name of your key pair. Created in the
+Lightsail console (cannot use `awsKeyPair` at this time)
+* `userData` - (Optional) Single lined launch script as a string to configure server with additional user data
+* `ipAddressType` - (Optional) The IP address type of the Lightsail Instance. Valid Values: `dualstack` | `ipv4`.
+* `addOn` - (Optional) The add on configuration for the instance. [Detailed below](#add_on).
+* `tags` - (Optional) A map of tags to assign to the resource. To create a key-only tag, use an empty string as the value. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### `addOn`
+
+Defines the add on configuration for the instance. The `addOn` configuration block supports the following arguments:
+
+* `type` - (Required) The add-on type. There is currently only one valid type `autoSnapshot`.
+* `snapshotTime` - (Required) The daily time when an automatic snapshot will be created. Must be in HH:00 format, and in an hourly increment and specified in Coordinated Universal Time (UTC). The snapshot will be automatically created between the time specified and up to 45 minutes after.
+* `status` - (Required) The status of the add on. Valid Values: `enabled`, `disabled`.
+
+## Availability Zones
+
+Lightsail currently supports the following Availability Zones (e.g., `usEast1A`):
+
+- `apNortheast1{a,c,d}`
+- `apNortheast2{a,c}`
+- `apSouth1{a,b}`
+- `apSoutheast1{a,b,c}`
+- `apSoutheast2{a,b,c}`
+- `caCentral1{a,b}`
+- `euCentral1{a,b,c}`
+- `euWest1{a,b,c}`
+- `euWest2{a,b,c}`
+- `euWest3{a,b,c}`
+- `usEast1{a,b,c,d,e,f}`
+- `usEast2{a,b,c}`
+- `usWest2{a,b,c}`
+
+## Bundles
+
+Lightsail currently supports the following Bundle IDs (e.g., an instance in `apNortheast1` would use `small20`):
+
+### Prefix
+
+A Bundle ID starts with one of the below size prefixes:
+
+- `nano`
+- `micro`
+- `small`
+- `medium`
+- `large`
+- `xlarge`
+- `2Xlarge`
+
+### Suffix
+
+A Bundle ID ends with one of the following suffixes depending on Availability Zone:
+
+- ap-northeast-1: `20`
+- ap-northeast-2: `20`
+- ap-south-1: `21`
+- ap-southeast-1: `20`
+- ap-southeast-2: `22`
+- ca-central-1: `20`
+- eu-central-1: `20`
+- eu-west-1: `20`
+- eu-west-2: `20`
+- eu-west-3: `20`
+- us-east-1: `20`
+- us-east-2: `20`
+- us-west-2: `20`
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ARN of the Lightsail instance (matches `arn`).
+* `arn` - The ARN of the Lightsail instance (matches `id`).
+* `createdAt` - The timestamp when the instance was created.
+* `cpuCount` - The number of vCPUs the instance has.
+* `ramSize` - The amount of RAM in GB on the instance (e.g., 1.0).
+* `ipv6Addresses` - List of IPv6 addresses for the Lightsail instance.
+* `privateIpAddress` - The private IP address of the instance.
+* `publicIpAddress` - The public IP address of the instance.
+* `isStaticIp` - A Boolean value indicating whether this instance has a static IP assigned to it.
+* `username` - The user name for connecting to the instance (e.g., ec2-user).
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Lightsail Instances using their name. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Lightsail Instances using their name. For example:
+
+```console
+% terraform import aws_lightsail_instance.gitlab_test 'custom_gitlab'
+```
+
+<!-- cache-key: cdktf-0.18.0 input-e45f06a6953879f3cfd81982aebd4f0e53550836431aaac4a1538503c4509c48 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/lightsail_instance_public_ports.html.markdown b/website/docs/cdktf/typescript/r/lightsail_instance_public_ports.html.markdown
new file mode 100644
index 00000000000..4528b700c19
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/lightsail_instance_public_ports.html.markdown
@@ -0,0 +1,84 @@
+---
+subcategory: "Lightsail"
+layout: "aws"
+page_title: "AWS: aws_lightsail_instance_public_ports"
+description: |-
+  Provides an Lightsail Instance
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lightsail_instance_public_ports
+
+Opens ports for a specific Amazon Lightsail instance, and specifies the IP addresses allowed to connect to the instance through the ports, and the protocol.
+
+-> See [What is Amazon Lightsail?](https://lightsail.aws.amazon.com/ls/docs/getting-started/article/what-is-amazon-lightsail) for more information.
+
+~> **Note:** Lightsail is currently only supported in a limited number of AWS Regions, please see ["Regions and Availability Zones in Amazon Lightsail"](https://lightsail.aws.amazon.com/ls/docs/overview/article/understanding-regions-and-availability-zones-in-amazon-lightsail) for more details.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LightsailInstance } from "./.gen/providers/aws/lightsail-instance";
+import { LightsailInstancePublicPorts } from "./.gen/providers/aws/lightsail-instance-public-ports";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const test = new LightsailInstance(this, "test", {
+      availabilityZone: Token.asString(Fn.lookupNested(available.names, ["0"])),
+      blueprintId: "amazon_linux_2",
+      bundleId: "nano_1_0",
+      name: "yak_sail",
+    });
+    const awsLightsailInstancePublicPortsTest =
+      new LightsailInstancePublicPorts(this, "test_1", {
+        instanceName: test.name,
+        portInfo: [
+          {
+            fromPort: 80,
+            protocol: "tcp",
+            toPort: 80,
+          },
+        ],
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsLightsailInstancePublicPortsTest.overrideLogicalId("test");
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `instanceName` - (Required) Name of the Lightsail Instance.
+* `portInfo` - (Required) Configuration block with port information. AWS closes all currently open ports that are not included in the `portInfo`. Detailed below.
+
+### port_info
+
+The following arguments are required:
+
+* `fromPort` - (Required) First port in a range of open ports on an instance.
+* `protocol` - (Required) IP protocol name. Valid values are `tcp`, `all`, `udp`, and `icmp`.
+* `toPort` - (Required) Last port in a range of open ports on an instance.
+
+The following arguments are optional:
+
+* `cidrs` - (Optional) Set of CIDR blocks.
+* `cidrListAliases` - (Optional) Set of CIDR aliases that define access for a preconfigured range of IP addresses.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the resource.
+
+<!-- cache-key: cdktf-0.18.0 input-e75c0ed1fb7d870f438bb0070ff3f05dfd9b9a1c05192739f74b37a508a5e0f0 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/lightsail_key_pair.html.markdown b/website/docs/cdktf/typescript/r/lightsail_key_pair.html.markdown
new file mode 100644
index 00000000000..b061672b96b
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/lightsail_key_pair.html.markdown
@@ -0,0 +1,116 @@
+---
+subcategory: "Lightsail"
+layout: "aws"
+page_title: "AWS: aws_lightsail_key_pair"
+description: |-
+  Provides an Lightsail Key Pair
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lightsail_key_pair
+
+Provides a Lightsail Key Pair, for use with Lightsail Instances. These key pairs
+are separate from EC2 Key Pairs, and must be created or imported for use with
+Lightsail.
+
+~> **Note:** Lightsail is currently only supported in a limited number of AWS Regions, please see ["Regions and Availability Zones in Amazon Lightsail"](https://lightsail.aws.amazon.com/ls/docs/overview/article/understanding-regions-and-availability-zones-in-amazon-lightsail) for more details
+
+## Example Usage
+
+### Create New Key Pair
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LightsailKeyPair } from "./.gen/providers/aws/lightsail-key-pair";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new LightsailKeyPair(this, "lg_key_pair", {
+      name: "lg_key_pair",
+    });
+  }
+}
+
+```
+
+### Create New Key Pair with PGP Encrypted Private Key
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LightsailKeyPair } from "./.gen/providers/aws/lightsail-key-pair";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new LightsailKeyPair(this, "lg_key_pair", {
+      name: "lg_key_pair",
+      pgpKey: "keybase:keybaseusername",
+    });
+  }
+}
+
+```
+
+### Existing Public Key Import
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LightsailKeyPair } from "./.gen/providers/aws/lightsail-key-pair";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new LightsailKeyPair(this, "lg_key_pair", {
+      name: "importing",
+      publicKey: Token.asString(Fn.file("~/.ssh/id_rsa.pub")),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Optional) The name of the Lightsail Key Pair. If omitted, a unique name will be generated by Terraform
+* `pgpKey` – (Optional) An optional PGP key to encrypt the resulting private key material. Only used when creating a new key pair
+* `publicKey` - (Required) The public key material. This public key will be imported into Lightsail
+* `tags` - (Optional) A map of tags to assign to the collection. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+~> **NOTE:** a PGP key is not required, however it is strongly encouraged. Without a PGP key, the private key material will be stored in state unencrypted.`pgpKey` is ignored if `publicKey` is supplied.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name used for this key pair.
+* `arn` - The ARN of the Lightsail key pair.
+* `encryptedFingerprint` - The MD5 public key fingerprint for the encrypted private key.
+* `encryptedPrivateKey` – the private key material, base 64 encoded and encrypted with the given `pgpKey`. This is only populated when creating a new key and `pgpKey` is supplied.
+* `fingerprint` - The MD5 public key fingerprint as specified in section 4 of RFC 4716.
+* `publicKey` - the public key, base64 encoded.
+* `privateKey` - the private key, base64 encoded. This is only populated when creating a new key, and when no `pgpKey` is provided.
+
+## Import
+
+You cannot import Lightsail Key Pairs because the private and public key are only available on initial creation.
+
+<!-- cache-key: cdktf-0.18.0 input-8cae2556d64f4771d82c095c044dbe70b70e276ad81327c6dbb63347ff51050b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/lightsail_lb.html.markdown b/website/docs/cdktf/typescript/r/lightsail_lb.html.markdown
new file mode 100644
index 00000000000..436eb89f482
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/lightsail_lb.html.markdown
@@ -0,0 +1,86 @@
+---
+subcategory: "Lightsail"
+layout: "aws"
+page_title: "AWS: aws_lightsail_lb"
+description: |-
+  Provides a Lightsail Load Balancer
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lightsail_lb
+
+Creates a Lightsail load balancer resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LightsailLb } from "./.gen/providers/aws/lightsail-lb";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new LightsailLb(this, "test", {
+      healthCheckPath: "/",
+      instancePort: Token.asNumber("80"),
+      name: "test-load-balancer",
+      tags: {
+        foo: "bar",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the Lightsail load balancer.
+* `instancePort` - (Required) The instance port the load balancer will connect.
+* `healthCheckPath` - (Optional) The health check path of the load balancer. Default value "/".
+* `tags` - (Optional) A map of tags to assign to the resource. To create a key-only tag, use an empty string as the value. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name used for this load balancer (matches `name`).
+* `arn` - The ARN of the Lightsail load balancer.
+* `createdAt` - The timestamp when the load balancer was created.
+* `dnsName` - The DNS name of the load balancer.
+* `protocol` - The protocol of the load balancer.
+* `publicPorts` - The public ports of the load balancer.
+* `supportCode` - The support code for the database. Include this code in your email to support when you have questions about a database in Lightsail. This code enables our support team to look up your Lightsail information more easily.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsLightsailLb` using the name attribute. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsLightsailLb` using the name attribute. For example:
+
+```console
+% terraform import aws_lightsail_lb.test example-load-balancer
+```
+
+<!-- cache-key: cdktf-0.18.0 input-557398008915861f1ead6c5648ac53e7bb70a90ed6370793a6f6d0800c69290d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/lightsail_lb_attachment.html.markdown b/website/docs/cdktf/typescript/r/lightsail_lb_attachment.html.markdown
new file mode 100644
index 00000000000..e23cbe91fd5
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/lightsail_lb_attachment.html.markdown
@@ -0,0 +1,107 @@
+---
+subcategory: "Lightsail"
+layout: "aws"
+page_title: "AWS: aws_lightsail_lb_attachment"
+description: |-
+  Attaches a Lightsail Instance to a Lightsail Load Balancer
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lightsail_lb_attachment
+
+Attaches a Lightsail Instance to a Lightsail Load Balancer.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, Fn, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsAvailabilityZones } from "./.gen/providers/aws/data-aws-availability-zones";
+import { LightsailInstance } from "./.gen/providers/aws/lightsail-instance";
+import { LightsailLb } from "./.gen/providers/aws/lightsail-lb";
+import { LightsailLbAttachment } from "./.gen/providers/aws/lightsail-lb-attachment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const test = new LightsailLb(this, "test", {
+      healthCheckPath: "/",
+      instancePort: Token.asNumber("80"),
+      name: "test-load-balancer",
+      tags: {
+        foo: "bar",
+      },
+    });
+    const available = new DataAwsAvailabilityZones(this, "available", {
+      filter: [
+        {
+          name: "opt-in-status",
+          values: ["opt-in-not-required"],
+        },
+      ],
+      state: "available",
+    });
+    const awsLightsailInstanceTest = new LightsailInstance(this, "test_2", {
+      availabilityZone: Token.asString(Fn.lookupNested(available.names, ["0"])),
+      blueprintId: "amazon_linux_2",
+      bundleId: "nano_1_0",
+      name: "test-instance",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsLightsailInstanceTest.overrideLogicalId("test");
+    const awsLightsailLbAttachmentTest = new LightsailLbAttachment(
+      this,
+      "test_3",
+      {
+        instanceName: Token.asString(awsLightsailInstanceTest.name),
+        lbName: test.name,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsLightsailLbAttachmentTest.overrideLogicalId("test");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `lbName` - (Required) The name of the Lightsail load balancer.
+* `instanceName` - (Required) The name of the instance to attach to the load balancer.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - A combination of attributes to create a unique id: `lbName`,`instanceName`
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsLightsailLbAttachment` using the name attribute. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsLightsailLbAttachment` using the name attribute. For example:
+
+```console
+% terraform import aws_lightsail_lb_attachment.test example-load-balancer,example-instance
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1f5a78fef900db643827102ff8c8ece3850d79f4a93a4cdfb83fba4a5ff25956 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/lightsail_lb_certificate.html.markdown b/website/docs/cdktf/typescript/r/lightsail_lb_certificate.html.markdown
new file mode 100644
index 00000000000..843e10ee3b1
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/lightsail_lb_certificate.html.markdown
@@ -0,0 +1,95 @@
+---
+subcategory: "Lightsail"
+layout: "aws"
+page_title: "AWS: aws_lightsail_lb_certificate"
+description: |-
+  Provides a Lightsail Load Balancer
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lightsail_lb_certificate
+
+Creates a Lightsail load balancer Certificate resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LightsailLb } from "./.gen/providers/aws/lightsail-lb";
+import { LightsailLbCertificate } from "./.gen/providers/aws/lightsail-lb-certificate";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const test = new LightsailLb(this, "test", {
+      healthCheckPath: "/",
+      instancePort: Token.asNumber("80"),
+      name: "test-load-balancer",
+      tags: {
+        foo: "bar",
+      },
+    });
+    const awsLightsailLbCertificateTest = new LightsailLbCertificate(
+      this,
+      "test_1",
+      {
+        domainName: "test.com",
+        lbName: test.id,
+        name: "test-load-balancer-certificate",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsLightsailLbCertificateTest.overrideLogicalId("test");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `domainName` - (Required) The domain name (e.g., example.com) for your SSL/TLS certificate.
+* `lbName` - (Required) The load balancer name where you want to create the SSL/TLS certificate.
+* `name` - (Required) The SSL/TLS certificate name.
+* `name` - (Required) The SSL/TLS certificate name.
+* `subjectAlternativeNames` - (Optional) Set of domains that should be SANs in the issued certificate. `domainName` attribute is automatically added as a Subject Alternative Name.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - A combination of attributes to create a unique id: `lbName`,`name`
+* `arn` - The ARN of the lightsail certificate.
+* `createdAt` - The timestamp when the instance was created.
+* `domainValidationOptions` - Set of domain validation objects which can be used to complete certificate validation. Can have more than one element, e.g., if SANs are defined.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsLightsailLbCertificate` using the id attribute. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsLightsailLbCertificate` using the id attribute. For example:
+
+```console
+% terraform import aws_lightsail_lb_certificate.test example-load-balancer,example-load-balancer-certificate
+```
+
+<!-- cache-key: cdktf-0.18.0 input-6dd7f018be5db76314b7c107cdfa92a9e683d7eb41cf67a52fae3873bec4f0c6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/lightsail_lb_certificate_attachment.html.markdown b/website/docs/cdktf/typescript/r/lightsail_lb_certificate_attachment.html.markdown
new file mode 100644
index 00000000000..16f2b6fa8a0
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/lightsail_lb_certificate_attachment.html.markdown
@@ -0,0 +1,97 @@
+---
+subcategory: "Lightsail"
+layout: "aws"
+page_title: "AWS: aws_lightsail_lb_certificate_attachment"
+description: |-
+  Attaches a Lightsail Load Balancer Certificate to a Lightsail Load Balancer
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lightsail_lb_certificate_attachment
+
+Attaches a Lightsail Load Balancer Certificate to a Lightsail Load Balancer.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LightsailLb } from "./.gen/providers/aws/lightsail-lb";
+import { LightsailLbCertificate } from "./.gen/providers/aws/lightsail-lb-certificate";
+import { LightsailLbCertificateAttachment } from "./.gen/providers/aws/lightsail-lb-certificate-attachment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const test = new LightsailLb(this, "test", {
+      healthCheckPath: "/",
+      instancePort: Token.asNumber("80"),
+      name: "test-load-balancer",
+      tags: {
+        foo: "bar",
+      },
+    });
+    const awsLightsailLbCertificateTest = new LightsailLbCertificate(
+      this,
+      "test_1",
+      {
+        domainName: "test.com",
+        lbName: test.id,
+        name: "test-load-balancer-certificate",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsLightsailLbCertificateTest.overrideLogicalId("test");
+    const awsLightsailLbCertificateAttachmentTest =
+      new LightsailLbCertificateAttachment(this, "test_2", {
+        certificateName: Token.asString(awsLightsailLbCertificateTest.name),
+        lbName: test.name,
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsLightsailLbCertificateAttachmentTest.overrideLogicalId("test");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `lbName` - (Required) The name of the load balancer to which you want to associate the SSL/TLS certificate.
+* `certificateName` - (Required) The name of your SSL/TLS certificate.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - A combination of attributes to create a unique id: `lbName`,`certificateName`
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsLightsailLbCertificateAttachment` using the name attribute. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsLightsailLbCertificateAttachment` using the name attribute. For example:
+
+```console
+% terraform import aws_lightsail_lb_certificate_attachment.test example-load-balancer,example-certificate
+```
+
+<!-- cache-key: cdktf-0.18.0 input-e1b37be33554c8bddba19e3fcbe7cf21f86639e8dfc8c4cce57fb7c7d7bf6028 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/lightsail_lb_https_redirection_policy.html.markdown b/website/docs/cdktf/typescript/r/lightsail_lb_https_redirection_policy.html.markdown
new file mode 100644
index 00000000000..12596e93dc4
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/lightsail_lb_https_redirection_policy.html.markdown
@@ -0,0 +1,105 @@
+---
+subcategory: "Lightsail"
+layout: "aws"
+page_title: "AWS: aws_lightsail_lb_https_redirection_policy"
+description: |-
+  Configures Https Redirection for a Lightsail Load Balancer
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lightsail_lb_https_redirection_policy
+
+Configures Https Redirection for a Lightsail Load Balancer. A valid Certificate must be attached to the load balancer in order to enable https redirection.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LightsailLb } from "./.gen/providers/aws/lightsail-lb";
+import { LightsailLbCertificate } from "./.gen/providers/aws/lightsail-lb-certificate";
+import { LightsailLbCertificateAttachment } from "./.gen/providers/aws/lightsail-lb-certificate-attachment";
+import { LightsailLbHttpsRedirectionPolicy } from "./.gen/providers/aws/lightsail-lb-https-redirection-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const test = new LightsailLb(this, "test", {
+      healthCheckPath: "/",
+      instancePort: Token.asNumber("80"),
+      name: "test-load-balancer",
+      tags: {
+        foo: "bar",
+      },
+    });
+    const awsLightsailLbCertificateTest = new LightsailLbCertificate(
+      this,
+      "test_1",
+      {
+        domainName: "test.com",
+        lbName: test.id,
+        name: "test-load-balancer-certificate",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsLightsailLbCertificateTest.overrideLogicalId("test");
+    const awsLightsailLbCertificateAttachmentTest =
+      new LightsailLbCertificateAttachment(this, "test_2", {
+        certificateName: Token.asString(awsLightsailLbCertificateTest.name),
+        lbName: test.name,
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsLightsailLbCertificateAttachmentTest.overrideLogicalId("test");
+    const awsLightsailLbHttpsRedirectionPolicyTest =
+      new LightsailLbHttpsRedirectionPolicy(this, "test_3", {
+        enabled: true,
+        lbName: test.name,
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsLightsailLbHttpsRedirectionPolicyTest.overrideLogicalId("test");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `lbName` - (Required) The name of the load balancer to which you want to enable http to https redirection.
+* `enabled` - (Required) - The Https Redirection state of the load balancer. `true` to activate http to https redirection or `false` to deactivate http to https redirection.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name used for this load balancer (matches `lbName`).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsLightsailLbHttpsRedirectionPolicy` using the `lbName` attribute. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsLightsailLbHttpsRedirectionPolicy` using the `lbName` attribute. For example:
+
+```console
+% terraform import aws_lightsail_lb_https_redirection_policy.test example-load-balancer
+```
+
+<!-- cache-key: cdktf-0.18.0 input-096d2aad822770675cf0db37d9363ce16e54bc7144846d6f81441f5de8d7d74a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/lightsail_lb_stickiness_policy.html.markdown b/website/docs/cdktf/typescript/r/lightsail_lb_stickiness_policy.html.markdown
new file mode 100644
index 00000000000..bdb22081f8b
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/lightsail_lb_stickiness_policy.html.markdown
@@ -0,0 +1,90 @@
+---
+subcategory: "Lightsail"
+layout: "aws"
+page_title: "AWS: aws_lightsail_lb_stickiness_policy"
+description: |-
+  Configures Session Stickiness for a Lightsail Load Balancer
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lightsail_lb_stickiness_policy
+
+Configures Session Stickiness for a Lightsail Load Balancer.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LightsailLb } from "./.gen/providers/aws/lightsail-lb";
+import { LightsailLbStickinessPolicy } from "./.gen/providers/aws/lightsail-lb-stickiness-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const test = new LightsailLb(this, "test", {
+      healthCheckPath: "/",
+      instancePort: Token.asNumber("80"),
+      name: "test-load-balancer",
+      tags: {
+        foo: "bar",
+      },
+    });
+    const awsLightsailLbStickinessPolicyTest = new LightsailLbStickinessPolicy(
+      this,
+      "test_1",
+      {
+        cookieDuration: 900,
+        enabled: true,
+        lbName: test.name,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsLightsailLbStickinessPolicyTest.overrideLogicalId("test");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `lbName` - (Required) The name of the load balancer to which you want to enable session stickiness.
+* `cookieDuration` - (Required) The cookie duration in seconds. This determines the length of the session stickiness.
+* `enabled` - (Required) - The Session Stickiness state of the load balancer. `true` to activate session stickiness or `false` to deactivate session stickiness.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name used for this load balancer (matches `lbName`).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsLightsailLbStickinessPolicy` using the `lbName` attribute. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsLightsailLbStickinessPolicy` using the `lbName` attribute. For example:
+
+```console
+% terraform import aws_lightsail_lb_stickiness_policy.test example-load-balancer
+```
+
+<!-- cache-key: cdktf-0.18.0 input-d81e14735db5f79619a49663b9e62b0556328959a952750a838262d10f6383c5 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/lightsail_static_ip.html.markdown b/website/docs/cdktf/typescript/r/lightsail_static_ip.html.markdown
new file mode 100644
index 00000000000..0f7b111da18
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/lightsail_static_ip.html.markdown
@@ -0,0 +1,53 @@
+---
+subcategory: "Lightsail"
+layout: "aws"
+page_title: "AWS: aws_lightsail_static_ip"
+description: |-
+  Provides an Lightsail Static IP
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lightsail_static_ip
+
+Allocates a static IP address.
+
+~> **Note:** Lightsail is currently only supported in a limited number of AWS Regions, please see ["Regions and Availability Zones in Amazon Lightsail"](https://lightsail.aws.amazon.com/ls/docs/overview/article/understanding-regions-and-availability-zones-in-amazon-lightsail) for more details
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LightsailStaticIp } from "./.gen/providers/aws/lightsail-static-ip";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new LightsailStaticIp(this, "test", {
+      name: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name for the allocated static IP
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the Lightsail static IP
+* `ipAddress` - The allocated static IP address
+* `supportCode` - The support code.
+
+<!-- cache-key: cdktf-0.18.0 input-ceefb04cc23d9c3d23bf8796be65f2fc424fa275759d495af1748286debe2c54 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/lightsail_static_ip_attachment.html.markdown b/website/docs/cdktf/typescript/r/lightsail_static_ip_attachment.html.markdown
new file mode 100644
index 00000000000..1540c3a6f9d
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/lightsail_static_ip_attachment.html.markdown
@@ -0,0 +1,73 @@
+---
+subcategory: "Lightsail"
+layout: "aws"
+page_title: "AWS: aws_lightsail_static_ip_attachment"
+description: |-
+  Provides an Lightsail Static IP Attachment
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_lightsail_static_ip_attachment
+
+Provides a static IP address attachment - relationship between a Lightsail static IP & Lightsail instance.
+
+~> **Note:** Lightsail is currently only supported in a limited number of AWS Regions, please see ["Regions and Availability Zones in Amazon Lightsail"](https://lightsail.aws.amazon.com/ls/docs/overview/article/understanding-regions-and-availability-zones-in-amazon-lightsail) for more details
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LightsailInstance } from "./.gen/providers/aws/lightsail-instance";
+import { LightsailStaticIp } from "./.gen/providers/aws/lightsail-static-ip";
+import { LightsailStaticIpAttachment } from "./.gen/providers/aws/lightsail-static-ip-attachment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const test = new LightsailInstance(this, "test", {
+      availabilityZone: "us-east-1b",
+      blueprintId: "string",
+      bundleId: "string",
+      keyPairName: "some_key_name",
+      name: "example",
+    });
+    const awsLightsailStaticIpTest = new LightsailStaticIp(this, "test_1", {
+      name: "example",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsLightsailStaticIpTest.overrideLogicalId("test");
+    const awsLightsailStaticIpAttachmentTest = new LightsailStaticIpAttachment(
+      this,
+      "test_2",
+      {
+        instanceName: test.id,
+        staticIpName: Token.asString(awsLightsailStaticIpTest.id),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsLightsailStaticIpAttachmentTest.overrideLogicalId("test");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `staticIpName` - (Required) The name of the allocated static IP
+* `instanceName` - (Required) The name of the Lightsail instance to attach the IP to
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `ipAddress` - The allocated static IP address
+
+<!-- cache-key: cdktf-0.18.0 input-6383b2c1ce9e0d3f93e326883a08bc4696b5b00c508566ea4d895b90af237860 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/load_balancer_backend_server_policy.html.markdown b/website/docs/cdktf/typescript/r/load_balancer_backend_server_policy.html.markdown
new file mode 100644
index 00000000000..0bc8f5d8c2a
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/load_balancer_backend_server_policy.html.markdown
@@ -0,0 +1,104 @@
+---
+subcategory: "ELB Classic"
+layout: "aws"
+page_title: "AWS: aws_load_balancer_backend_server_policy"
+description: |-
+  Attaches a load balancer policy to an ELB backend server.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_load_balancer_backend_server_policy
+
+Attaches a load balancer policy to an ELB backend server.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Elb } from "./.gen/providers/aws/elb";
+import { LoadBalancerBackendServerPolicy } from "./.gen/providers/aws/load-balancer-backend-server-policy";
+import { LoadBalancerPolicy } from "./.gen/providers/aws/load-balancer-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const wuTang = new Elb(this, "wu-tang", {
+      availabilityZones: ["us-east-1a"],
+      listener: [
+        {
+          instancePort: 443,
+          instanceProtocol: "http",
+          lbPort: 443,
+          lbProtocol: "https",
+          sslCertificateId:
+            "arn:aws:iam::000000000000:server-certificate/wu-tang.net",
+        },
+      ],
+      name: "wu-tang",
+      tags: {
+        Name: "wu-tang",
+      },
+    });
+    new LoadBalancerPolicy(this, "wu-tang-ca-pubkey-policy", {
+      loadBalancerName: wuTang.name,
+      policyAttribute: [
+        {
+          name: "PublicKey",
+          value: Token.asString(Fn.file("wu-tang-pubkey")),
+        },
+      ],
+      policyName: "wu-tang-ca-pubkey-policy",
+      policyTypeName: "PublicKeyPolicyType",
+    });
+    const wuTangRootCaBackendAuthPolicy = new LoadBalancerPolicy(
+      this,
+      "wu-tang-root-ca-backend-auth-policy",
+      {
+        loadBalancerName: wuTang.name,
+        policyAttribute: [
+          {
+            name: "PublicKeyPolicyName",
+            value: wuTangRootCaPubkeyPolicy.policyName,
+          },
+        ],
+        policyName: "wu-tang-root-ca-backend-auth-policy",
+        policyTypeName: "BackendServerAuthenticationPolicyType",
+      }
+    );
+    new LoadBalancerBackendServerPolicy(
+      this,
+      "wu-tang-backend-auth-policies-443",
+      {
+        instancePort: 443,
+        loadBalancerName: wuTang.name,
+        policyNames: [wuTangRootCaBackendAuthPolicy.policyName],
+      }
+    );
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `loadBalancerName` - (Required) The load balancer to attach the policy to.
+* `policyNames` - (Required) List of Policy Names to apply to the backend server.
+* `instancePort` - (Required) The instance port to apply the policy to.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the policy.
+* `loadBalancerName` - The load balancer on which the policy is defined.
+* `instancePort` - The backend port the policies are applied to
+
+<!-- cache-key: cdktf-0.18.0 input-678615497775d54f0ebc1130f0cdc63541b64d9b7e8ee65aaf87facfc558da29 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/load_balancer_listener_policy.html.markdown b/website/docs/cdktf/typescript/r/load_balancer_listener_policy.html.markdown
new file mode 100644
index 00000000000..64182e31756
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/load_balancer_listener_policy.html.markdown
@@ -0,0 +1,150 @@
+---
+subcategory: "ELB Classic"
+layout: "aws"
+page_title: "AWS: aws_load_balancer_listener_policy"
+description: |-
+  Attaches a load balancer policy to an ELB Listener.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_load_balancer_listener_policy
+
+Attaches a load balancer policy to an ELB Listener.
+
+## Example Usage
+
+### Custom Policy
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Elb } from "./.gen/providers/aws/elb";
+import { LoadBalancerListenerPolicy } from "./.gen/providers/aws/load-balancer-listener-policy";
+import { LoadBalancerPolicy } from "./.gen/providers/aws/load-balancer-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const wuTang = new Elb(this, "wu-tang", {
+      availabilityZones: ["us-east-1a"],
+      listener: [
+        {
+          instancePort: 443,
+          instanceProtocol: "http",
+          lbPort: 443,
+          lbProtocol: "https",
+          sslCertificateId:
+            "arn:aws:iam::000000000000:server-certificate/wu-tang.net",
+        },
+      ],
+      name: "wu-tang",
+      tags: {
+        Name: "wu-tang",
+      },
+    });
+    const wuTangSsl = new LoadBalancerPolicy(this, "wu-tang-ssl", {
+      loadBalancerName: wuTang.name,
+      policyAttribute: [
+        {
+          name: "ECDHE-ECDSA-AES128-GCM-SHA256",
+          value: "true",
+        },
+        {
+          name: "Protocol-TLSv1.2",
+          value: "true",
+        },
+      ],
+      policyName: "wu-tang-ssl",
+      policyTypeName: "SSLNegotiationPolicyType",
+    });
+    new LoadBalancerListenerPolicy(this, "wu-tang-listener-policies-443", {
+      loadBalancerName: wuTang.name,
+      loadBalancerPort: 443,
+      policyNames: [wuTangSsl.policyName],
+    });
+  }
+}
+
+```
+
+This example shows how to customize the TLS settings of an HTTPS listener.
+
+### AWS Predefined Security Policy
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Elb } from "./.gen/providers/aws/elb";
+import { LoadBalancerListenerPolicy } from "./.gen/providers/aws/load-balancer-listener-policy";
+import { LoadBalancerPolicy } from "./.gen/providers/aws/load-balancer-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const wuTang = new Elb(this, "wu-tang", {
+      availabilityZones: ["us-east-1a"],
+      listener: [
+        {
+          instancePort: 443,
+          instanceProtocol: "http",
+          lbPort: 443,
+          lbProtocol: "https",
+          sslCertificateId:
+            "arn:aws:iam::000000000000:server-certificate/wu-tang.net",
+        },
+      ],
+      name: "wu-tang",
+      tags: {
+        Name: "wu-tang",
+      },
+    });
+    const wuTangSslTls11 = new LoadBalancerPolicy(this, "wu-tang-ssl-tls-1-1", {
+      loadBalancerName: wuTang.name,
+      policyAttribute: [
+        {
+          name: "Reference-Security-Policy",
+          value: "ELBSecurityPolicy-TLS-1-1-2017-01",
+        },
+      ],
+      policyName: "wu-tang-ssl",
+      policyTypeName: "SSLNegotiationPolicyType",
+    });
+    new LoadBalancerListenerPolicy(this, "wu-tang-listener-policies-443", {
+      loadBalancerName: wuTang.name,
+      loadBalancerPort: 443,
+      policyNames: [wuTangSslTls11.policyName],
+    });
+  }
+}
+
+```
+
+This example shows how to add a [Predefined Security Policy for ELBs](https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/elb-security-policy-table.html)
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `loadBalancerName` - (Required) The load balancer to attach the policy to.
+* `loadBalancerPort` - (Required) The load balancer listener port to apply the policy to.
+* `policyNames` - (Required) List of Policy Names to apply to the backend server.
+* `triggers` - (Optional) Map of arbitrary keys and values that, when changed, will trigger an update. To force an update without changing these keys/values, use the [`terraform taint` command](https://www.terraform.io/docs/commands/taint.html).
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the policy.
+* `loadBalancerName` - The load balancer on which the policy is defined.
+* `loadBalancerPort` - The load balancer listener port the policies are applied to
+
+<!-- cache-key: cdktf-0.18.0 input-4c93426530ea960507c237ed921eb478f8510b255d175bf0f6382d0d0d11adbe -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/load_balancer_policy.html.markdown b/website/docs/cdktf/typescript/r/load_balancer_policy.html.markdown
new file mode 100644
index 00000000000..8eb699da6a8
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/load_balancer_policy.html.markdown
@@ -0,0 +1,138 @@
+---
+subcategory: "ELB Classic"
+layout: "aws"
+page_title: "AWS: aws_load_balancer_policy"
+description: |-
+  Provides a load balancer policy, which can be attached to an ELB listener or backend server.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_load_balancer_policy
+
+Provides a load balancer policy, which can be attached to an ELB listener or backend server.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Elb } from "./.gen/providers/aws/elb";
+import { LoadBalancerBackendServerPolicy } from "./.gen/providers/aws/load-balancer-backend-server-policy";
+import { LoadBalancerListenerPolicy } from "./.gen/providers/aws/load-balancer-listener-policy";
+import { LoadBalancerPolicy } from "./.gen/providers/aws/load-balancer-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const wuTang = new Elb(this, "wu-tang", {
+      availabilityZones: ["us-east-1a"],
+      listener: [
+        {
+          instancePort: 443,
+          instanceProtocol: "http",
+          lbPort: 443,
+          lbProtocol: "https",
+          sslCertificateId:
+            "arn:aws:iam::000000000000:server-certificate/wu-tang.net",
+        },
+      ],
+      name: "wu-tang",
+      tags: {
+        Name: "wu-tang",
+      },
+    });
+    new LoadBalancerPolicy(this, "wu-tang-ca-pubkey-policy", {
+      loadBalancerName: wuTang.name,
+      policyAttribute: [
+        {
+          name: "PublicKey",
+          value: Token.asString(Fn.file("wu-tang-pubkey")),
+        },
+      ],
+      policyName: "wu-tang-ca-pubkey-policy",
+      policyTypeName: "PublicKeyPolicyType",
+    });
+    const wuTangRootCaBackendAuthPolicy = new LoadBalancerPolicy(
+      this,
+      "wu-tang-root-ca-backend-auth-policy",
+      {
+        loadBalancerName: wuTang.name,
+        policyAttribute: [
+          {
+            name: "PublicKeyPolicyName",
+            value: wuTangRootCaPubkeyPolicy.policyName,
+          },
+        ],
+        policyName: "wu-tang-root-ca-backend-auth-policy",
+        policyTypeName: "BackendServerAuthenticationPolicyType",
+      }
+    );
+    const wuTangSsl = new LoadBalancerPolicy(this, "wu-tang-ssl", {
+      loadBalancerName: wuTang.name,
+      policyAttribute: [
+        {
+          name: "ECDHE-ECDSA-AES128-GCM-SHA256",
+          value: "true",
+        },
+        {
+          name: "Protocol-TLSv1.2",
+          value: "true",
+        },
+      ],
+      policyName: "wu-tang-ssl",
+      policyTypeName: "SSLNegotiationPolicyType",
+    });
+    new LoadBalancerPolicy(this, "wu-tang-ssl-tls-1-1", {
+      loadBalancerName: wuTang.name,
+      policyAttribute: [
+        {
+          name: "Reference-Security-Policy",
+          value: "ELBSecurityPolicy-TLS-1-1-2017-01",
+        },
+      ],
+      policyName: "wu-tang-ssl",
+      policyTypeName: "SSLNegotiationPolicyType",
+    });
+    new LoadBalancerBackendServerPolicy(
+      this,
+      "wu-tang-backend-auth-policies-443",
+      {
+        instancePort: 443,
+        loadBalancerName: wuTang.name,
+        policyNames: [wuTangRootCaBackendAuthPolicy.policyName],
+      }
+    );
+    new LoadBalancerListenerPolicy(this, "wu-tang-listener-policies-443", {
+      loadBalancerName: wuTang.name,
+      loadBalancerPort: 443,
+      policyNames: [wuTangSsl.policyName],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `loadBalancerName` - (Required) The load balancer on which the policy is defined.
+* `policyName` - (Required) The name of the load balancer policy.
+* `policyTypeName` - (Required) The policy type.
+* `policyAttribute` - (Optional) Policy attribute to apply to the policy.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the policy.
+* `policyName` - The name of the stickiness policy.
+* `policyTypeName` - The policy type of the policy.
+* `loadBalancerName` - The load balancer on which the policy is defined.
+
+<!-- cache-key: cdktf-0.18.0 input-1301aff03d8fcf31fd6731593f13d990b69c6ade1c5268a81e1297356d9df74a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/location_geofence_collection.html.markdown b/website/docs/cdktf/typescript/r/location_geofence_collection.html.markdown
new file mode 100644
index 00000000000..7e2bad0ae24
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/location_geofence_collection.html.markdown
@@ -0,0 +1,87 @@
+---
+subcategory: "Location"
+layout: "aws"
+page_title: "AWS: aws_location_geofence_collection"
+description: |-
+  Terraform resource for managing an AWS Location Geofence Collection.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_location_geofence_collection
+
+Terraform resource for managing an AWS Location Geofence Collection.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LocationGeofenceCollection } from "./.gen/providers/aws/location-geofence-collection";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new LocationGeofenceCollection(this, "example", {
+      collectionName: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `collectionName` - (Required) The name of the geofence collection.
+
+The following arguments are optional:
+
+* `description` - (Optional) The optional description for the geofence collection.
+* `kmsKeyId` - (Optional) A key identifier for an AWS KMS customer managed key assigned to the Amazon Location resource.
+* `tags` - (Optional) Key-value tags for the geofence collection. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `collectionArn` - The Amazon Resource Name (ARN) for the geofence collection resource. Used when you need to specify a resource across all AWS.
+* `createTime` - The timestamp for when the geofence collection resource was created in ISO 8601 format.
+* `updateTime` - The timestamp for when the geofence collection resource was last updated in ISO 8601 format.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `30M`)
+* `update` - (Default `30M`)
+* `delete` - (Default `30M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Location Geofence Collection using the `collectionName`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Location Geofence Collection using the `collectionName`. For example:
+
+```console
+% terraform import aws_location_geofence_collection.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-d5f8a31edd538788388ea70b948bf927302bc8710ba3768ffc3484e329693d37 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/location_map.html.markdown b/website/docs/cdktf/typescript/r/location_map.html.markdown
new file mode 100644
index 00000000000..77a2368ed74
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/location_map.html.markdown
@@ -0,0 +1,89 @@
+---
+subcategory: "Location"
+layout: "aws"
+page_title: "AWS: aws_location_map"
+description: |-
+    Provides a Location Service Map.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_location_map
+
+Provides a Location Service Map.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LocationMap } from "./.gen/providers/aws/location-map";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new LocationMap(this, "example", {
+      configuration: {
+        style: "VectorHereBerlin",
+      },
+      mapName: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `configuration` - (Required) Configuration block with the map style selected from an available data provider. Detailed below.
+* `mapName` - (Required) The name for the map resource.
+
+The following arguments are optional:
+
+* `description` - (Optional) An optional description for the map resource.
+* `tags` - (Optional) Key-value tags for the map. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### configuration
+
+The following arguments are required:
+
+* `style` - (Required) Specifies the map style selected from an available data provider. Valid values can be found in the [Location Service CreateMap API Reference](https://docs.aws.amazon.com/location/latest/APIReference/API_CreateMap.html).
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `createTime` - The timestamp for when the map resource was created in ISO 8601 format.
+* `mapArn` - The Amazon Resource Name (ARN) for the map resource. Used to specify a resource across all AWS.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `updateTime` - The timestamp for when the map resource was last updated in ISO 8601 format.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsLocationMap` resources using the map name. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsLocationMap` resources using the map name. For example:
+
+```console
+% terraform import aws_location_map.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-5dad74dad6d91da85c3886e29aba5949de61bde3e481fa21d1494017c8c095a9 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/location_place_index.html.markdown b/website/docs/cdktf/typescript/r/location_place_index.html.markdown
new file mode 100644
index 00000000000..fa3c1d2dec5
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/location_place_index.html.markdown
@@ -0,0 +1,88 @@
+---
+subcategory: "Location"
+layout: "aws"
+page_title: "AWS: aws_location_place_index"
+description: |-
+    Provides a Location Service Place Index.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_location_place_index
+
+Provides a Location Service Place Index.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LocationPlaceIndex } from "./.gen/providers/aws/location-place-index";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new LocationPlaceIndex(this, "example", {
+      dataSource: "Here",
+      indexName: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `dataSource` - (Required) Specifies the geospatial data provider for the new place index.
+* `indexName` - (Required) The name of the place index resource.
+
+The following arguments are optional:
+
+* `dataSourceConfiguration` - (Optional) Configuration block with the data storage option chosen for requesting Places. Detailed below.
+* `description` - (Optional) The optional description for the place index resource.
+* `tags` - (Optional) Key-value tags for the place index. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### data_source_configuration
+
+The following arguments are optional:
+
+* `intendedUse` - (Optional) Specifies how the results of an operation will be stored by the caller. Valid values: `singleUse`, `storage`. Default: `singleUse`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `createTime` - The timestamp for when the place index resource was created in ISO 8601 format.
+* `indexArn` - The Amazon Resource Name (ARN) for the place index resource. Used to specify a resource across AWS.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `updateTime` - The timestamp for when the place index resource was last update in ISO 8601.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsLocationPlaceIndex` resources using the place index name. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsLocationPlaceIndex` resources using the place index name. For example:
+
+```console
+% terraform import aws_location_place_index.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-394c1ee28ef77e64cf06721c4fa5a97e00829ed4736062d9087e7923bfc8ee3a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/location_route_calculator.html.markdown b/website/docs/cdktf/typescript/r/location_route_calculator.html.markdown
new file mode 100644
index 00000000000..c72efaabb30
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/location_route_calculator.html.markdown
@@ -0,0 +1,89 @@
+---
+subcategory: "Location"
+layout: "aws"
+page_title: "AWS: aws_location_route_calculator"
+description: |-
+    Provides a Location Service Route Calculator.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_location_route_calculator
+
+Provides a Location Service Route Calculator.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LocationRouteCalculator } from "./.gen/providers/aws/location-route-calculator";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new LocationRouteCalculator(this, "example", {
+      calculatorName: "example",
+      dataSource: "Here",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `calculatorName` - (Required) The name of the route calculator resource.
+* `dataSource` - (Required) Specifies the data provider of traffic and road network data.
+
+The following arguments are optional:
+
+* `description` - (Optional) The optional description for the route calculator resource.
+* `tags` - (Optional) Key-value tags for the route calculator. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `calculatorArn` - The Amazon Resource Name (ARN) for the Route calculator resource. Use the ARN when you specify a resource across AWS.
+* `createTime` - The timestamp for when the route calculator resource was created in ISO 8601 format.
+* `updateTime` - The timestamp for when the route calculator resource was last update in ISO 8601.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `30M`)
+* `update` - (Default `30M`)
+* `delete` - (Default `30M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsLocationRouteCalculator` using the route calculator name. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsLocationRouteCalculator` using the route calculator name. For example:
+
+```console
+% terraform import aws_location_route_calculator.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-f35e811fd2c633c763e78f808cf0b9c4d35fac2d693f5e1526c62049823223eb -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/location_tracker.html.markdown b/website/docs/cdktf/typescript/r/location_tracker.html.markdown
new file mode 100644
index 00000000000..14d31693f05
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/location_tracker.html.markdown
@@ -0,0 +1,81 @@
+---
+subcategory: "Location"
+layout: "aws"
+page_title: "AWS: aws_location_tracker"
+description: |-
+    Provides a Location Service Tracker.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_location_tracker
+
+Provides a Location Service Tracker.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LocationTracker } from "./.gen/providers/aws/location-tracker";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new LocationTracker(this, "example", {
+      trackerName: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `trackerName` - (Required) The name of the tracker resource.
+
+The following arguments are optional:
+
+* `description` - (Optional) The optional description for the tracker resource.
+* `kmsKeyId` - (Optional) A key identifier for an AWS KMS customer managed key assigned to the Amazon Location resource.
+* `positionFiltering` - (Optional) The position filtering method of the tracker resource. Valid values: `timeBased`, `distanceBased`, `accuracyBased`. Default: `timeBased`.
+* `tags` - (Optional) Key-value tags for the tracker. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `createTime` - The timestamp for when the tracker resource was created in ISO 8601 format.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `trackerArn` - The Amazon Resource Name (ARN) for the tracker resource. Used when you need to specify a resource across all AWS.
+* `updateTime` - The timestamp for when the tracker resource was last updated in ISO 8601 format.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsLocationTracker` resources using the tracker name. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsLocationTracker` resources using the tracker name. For example:
+
+```console
+% terraform import aws_location_tracker.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-92c1e9973bd9acd1e32bccee7a0c518d0693fd82125603fc93d69ca391807e92 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/location_tracker_association.html.markdown b/website/docs/cdktf/typescript/r/location_tracker_association.html.markdown
new file mode 100644
index 00000000000..a122e43282c
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/location_tracker_association.html.markdown
@@ -0,0 +1,94 @@
+---
+subcategory: "Location"
+layout: "aws"
+page_title: "AWS: aws_location_tracker_association"
+description: |-
+  Terraform resource for managing an AWS Location Tracker Association.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_location_tracker_association
+
+Terraform resource for managing an AWS Location Tracker Association.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LocationGeofenceCollection } from "./.gen/providers/aws/location-geofence-collection";
+import { LocationTracker } from "./.gen/providers/aws/location-tracker";
+import { LocationTrackerAssociation } from "./.gen/providers/aws/location-tracker-association";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new LocationGeofenceCollection(this, "example", {
+      collectionName: "example",
+    });
+    const awsLocationTrackerExample = new LocationTracker(this, "example_1", {
+      trackerName: "example",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsLocationTrackerExample.overrideLogicalId("example");
+    const awsLocationTrackerAssociationExample = new LocationTrackerAssociation(
+      this,
+      "example_2",
+      {
+        consumerArn: example.collectionArn,
+        trackerName: Token.asString(awsLocationTrackerExample.trackerName),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsLocationTrackerAssociationExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `consumerArn` - (Required) The Amazon Resource Name (ARN) for the geofence collection to be associated to tracker resource. Used when you need to specify a resource across all AWS.
+* `trackerName` - (Required) The name of the tracker resource to be associated with a geofence collection.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Timeouts
+
+`awsLocationTrackerAssociation` provides the following [Timeouts](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts) configuration options:
+
+* `create` - (Optional, Default: `30M`)
+* `delete` - (Optional, Default: `30M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Location Tracker Association using the `trackerName|consumerArn`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Location Tracker Association using the `trackerName|consumerArn`. For example:
+
+```console
+% terraform import aws_location_tracker_association.example "tracker_name|consumer_arn"
+```
+
+<!-- cache-key: cdktf-0.18.0 input-4b73757483307c737f70b7bfb906a6a6449e1a0b838a9a4bb533c9ccf5e4bd2b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/macie2_account.html.markdown b/website/docs/cdktf/typescript/r/macie2_account.html.markdown
new file mode 100644
index 00000000000..712497f9d42
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/macie2_account.html.markdown
@@ -0,0 +1,76 @@
+---
+subcategory: "Macie"
+layout: "aws"
+page_title: "AWS: aws_macie2_account"
+description: |-
+  Provides a resource to manage Amazon Macie on an AWS Account.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_macie2_account
+
+Provides a resource to manage an [AWS Macie Account](https://docs.aws.amazon.com/macie/latest/APIReference/macie.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Macie2Account } from "./.gen/providers/aws/macie2-account";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Macie2Account(this, "test", {
+      findingPublishingFrequency: "FIFTEEN_MINUTES",
+      status: "ENABLED",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `findingPublishingFrequency` -  (Optional) Specifies how often to publish updates to policy findings for the account. This includes publishing updates to AWS Security Hub and Amazon EventBridge (formerly called Amazon CloudWatch Events). Valid values are `fifteenMinutes`, `oneHour` or `sixHours`.
+* `status` - (Optional) Specifies the status for the account. To enable Amazon Macie and start all Macie activities for the account, set this value to `enabled`. Valid values are `enabled` or `paused`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The unique identifier (ID) of the macie account.
+* `serviceRole` - The Amazon Resource Name (ARN) of the service-linked role that allows Macie to monitor and analyze data in AWS resources for the account.
+* `createdAt` - The date and time, in UTC and extended RFC 3339 format, when the Amazon Macie account was created.
+* `updatedAt` - The date and time, in UTC and extended RFC 3339 format, of the most recent change to the status of the Macie account.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsMacie2Account` using the id. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsMacie2Account` using the id. For example:
+
+```console
+% terraform import aws_macie2_account.example abcd1
+```
+
+<!-- cache-key: cdktf-0.18.0 input-3bb36e9a7bd0b8871e777a031ed1a58fdb5d221c7af202cb42579fd8023356ae -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/macie2_classification_export_configuration.html.markdown b/website/docs/cdktf/typescript/r/macie2_classification_export_configuration.html.markdown
new file mode 100644
index 00000000000..11fad3b8ff0
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/macie2_classification_export_configuration.html.markdown
@@ -0,0 +1,93 @@
+---
+subcategory: "Macie"
+layout: "aws"
+page_title: "AWS: aws_macie2_classification_export_configuration"
+description: |-
+  Provides a resource to manage Classification Results - Export Configuration
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_macie2_classification_export_configuration
+
+Provides a resource to manage an [Amazon Macie Classification Export Configuration](https://docs.aws.amazon.com/macie/latest/APIReference/classification-export-configuration.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Macie2Account } from "./.gen/providers/aws/macie2-account";
+import { Macie2ClassificationExportConfiguration } from "./.gen/providers/aws/macie2-classification-export-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new Macie2Account(this, "example", {});
+    const awsMacie2ClassificationExportConfigurationExample =
+      new Macie2ClassificationExportConfiguration(this, "example_1", {
+        dependsOn: [example],
+        s3Destination: {
+          bucketName: Token.asString(awsS3BucketExample.bucket),
+          keyPrefix: "exampleprefix/",
+          kmsKeyArn: Token.asString(awsKmsKeyExample.arn),
+        },
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsMacie2ClassificationExportConfigurationExample.overrideLogicalId(
+      "example"
+    );
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `s3Destination` - (Required) Configuration block for a S3 Destination. Defined below
+
+### s3_destination Configuration Block
+
+The `s3Destination` configuration block supports the following arguments:
+
+* `bucketName` - (Required) The Amazon S3 bucket name in which Amazon Macie exports the data classification results.
+* `keyPrefix` - (Optional) The object key for the bucket in which Amazon Macie exports the data classification results.
+* `kmsKeyArn` - (Required) Amazon Resource Name (ARN) of the KMS key to be used to encrypt the data.
+
+Additional information can be found in the [Storing and retaining sensitive data discovery results with Amazon Macie for AWS Macie documentation](https://docs.aws.amazon.com/macie/latest/user/discovery-results-repository-s3.html).
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The unique identifier (ID) of the configuration.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsMacie2ClassificationExportConfiguration` using the account ID and region. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsMacie2ClassificationExportConfiguration` using the account ID and region. For example:
+
+```console
+% terraform import aws_macie2_classification_export_configuration.example 123456789012:us-west-2
+```
+
+<!-- cache-key: cdktf-0.18.0 input-b790e975bbab64731657718f850f0c07a6901341522f2000f5f309d87096fb71 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/macie2_classification_job.html.markdown b/website/docs/cdktf/typescript/r/macie2_classification_job.html.markdown
new file mode 100644
index 00000000000..3649b6f8e00
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/macie2_classification_job.html.markdown
@@ -0,0 +1,181 @@
+---
+subcategory: "Macie"
+layout: "aws"
+page_title: "AWS: aws_macie2_classification_job"
+description: |-
+  Provides a resource to manage an AWS Macie Classification Job.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_macie2_classification_job
+
+Provides a resource to manage an [AWS Macie Classification Job](https://docs.aws.amazon.com/macie/latest/APIReference/jobs.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Macie2Account } from "./.gen/providers/aws/macie2-account";
+import { Macie2ClassificationJob } from "./.gen/providers/aws/macie2-classification-job";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const test = new Macie2Account(this, "test", {});
+    const awsMacie2ClassificationJobTest = new Macie2ClassificationJob(
+      this,
+      "test_1",
+      {
+        dependsOn: [test],
+        jobType: "ONE_TIME",
+        name: "NAME OF THE CLASSIFICATION JOB",
+        s3JobDefinition: {
+          bucketDefinitions: [
+            {
+              accountId: "ACCOUNT ID",
+              buckets: ["S3 BUCKET NAME"],
+            },
+          ],
+        },
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsMacie2ClassificationJobTest.overrideLogicalId("test");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `scheduleFrequency` -  (Optional) The recurrence pattern for running the job. To run the job only once, don't specify a value for this property and set the value for the `jobType` property to `oneTime`. (documented below)
+* `customDataIdentifierIds` -  (Optional) The custom data identifiers to use for data analysis and classification.
+* `samplingPercentage` -  (Optional) The sampling depth, as a percentage, to apply when processing objects. This value determines the percentage of eligible objects that the job analyzes. If this value is less than 100, Amazon Macie selects the objects to analyze at random, up to the specified percentage, and analyzes all the data in those objects.
+* `name` -  (Optional) A custom name for the job. The name can contain as many as 500 characters. If omitted, Terraform will assign a random, unique name. Conflicts with `namePrefix`.
+* `namePrefix` -  (Optional) Creates a unique name beginning with the specified prefix. Conflicts with `name`.
+* `description` -  (Optional) A custom description of the job. The description can contain as many as 200 characters.
+* `initialRun` -  (Optional) Specifies whether to analyze all existing, eligible objects immediately after the job is created.
+* `jobType` -  (Required) The schedule for running the job. Valid values are: `oneTime` - Run the job only once. If you specify this value, don't specify a value for the `scheduleFrequency` property. `scheduled` - Run the job on a daily, weekly, or monthly basis. If you specify this value, use the `scheduleFrequency` property to define the recurrence pattern for the job.
+* `s3JobDefinition` -  (Optional) The S3 buckets that contain the objects to analyze, and the scope of that analysis. (documented below)
+* `tags` -  (Optional) A map of key-value pairs that specifies the tags to associate with the job. A job can have a maximum of 50 tags. Each tag consists of a tag key and an associated tag value. The maximum length of a tag key is 128 characters. The maximum length of a tag value is 256 characters.
+* `jobStatus` -  (Optional) The status for the job. Valid values are: `cancelled`, `running` and `userPaused`
+
+The `scheduleFrequency` object supports the following:
+
+* `dailySchedule` -  (Optional) Specifies a daily recurrence pattern for running the job.
+* `weeklySchedule` -  (Optional) Specifies a weekly recurrence pattern for running the job.
+* `monthlySchedule` -  (Optional) Specifies a monthly recurrence pattern for running the job.
+
+The `s3JobDefinition` object supports the following:
+
+* `bucketCriteria` - (Optional) The property- and tag-based conditions that determine which S3 buckets to include or exclude from the analysis. Conflicts with `bucketDefinitions`. (documented below)
+* `bucketDefinitions` -  (Optional) An array of objects, one for each AWS account that owns buckets to analyze. Each object specifies the account ID for an account and one or more buckets to analyze for the account. Conflicts with `bucketCriteria`. (documented below)
+* `scoping` -  (Optional) The property- and tag-based conditions that determine which objects to include or exclude from the analysis. (documented below)
+
+### bucket_criteria Configuration Block
+
+The `bucketCriteria` object supports the following:
+
+* `excludes` -  (Optional) The property- or tag-based conditions that determine which S3 buckets to exclude from the analysis. (documented below)
+* `includes` -  (Optional) The property- or tag-based conditions that determine which S3 buckets to include in the analysis. (documented below)
+
+The `excludes` and `includes` object supports the following:
+
+* `and` -  (Optional) An array of conditions, one for each condition that determines which S3 buckets to include or exclude from the job. (documented below)
+
+The `and` object supports the following:
+
+* `simpleCriterion` -  (Optional) A property-based condition that defines a property, operator, and one or more values for including or excluding an S3 buckets from the job. (documented below)
+* `tagCriterion` -  (Optional) A tag-based condition that defines the operator and tag keys or tag key and value pairs for including or excluding an S3 buckets from the job. (documented below)
+
+The `simpleCriterion` object supports the following:
+
+* `comparator` -  (Required) The operator to use in a condition. Valid combination of values are available in the [AWS Documentation](https://docs.aws.amazon.com/macie/latest/APIReference/jobs.html#jobs-model-jobcomparator)
+* `key` -  (Required) The object property to use in the condition. Valid combination of values are available in the [AWS Documentation](https://docs.aws.amazon.com/macie/latest/APIReference/jobs.html#jobs-model-simplecriterionkeyforjob)
+* `values` -  (Required) An array that lists the values to use in the condition. Valid combination of values are available in the [AWS Documentation](https://docs.aws.amazon.com/macie/latest/APIReference/jobs.html#jobs-model-simplecriterionforjob)
+
+The `tagCriterion` object supports the following:
+
+* `comparator` -  (Required) The operator to use in the condition. Valid combination and values are available in the [AWS Documentation](https://docs.aws.amazon.com/macie/latest/APIReference/jobs.html#jobs-model-jobcomparator)
+* `tagValues` -  (Required) The  tag key and value pairs to use in the condition. One or more blocks are allowed. (documented below)
+
+The `tagValues` object supports the following:
+
+* `key` - (Required) The tag key.
+* `value` - (Required) The tag value.
+
+### bucket_definitions Configuration Block
+
+The `bucketDefinitions` object supports the following:
+
+* `accountId` -  (Required) The unique identifier for the AWS account that owns the buckets.
+* `buckets` -  (Required) An array that lists the names of the buckets.
+
+### scoping Configuration Block
+
+The `scoping` object supports the following:
+
+* `excludes` -  (Optional) The property- or tag-based conditions that determine which objects to exclude from the analysis. (documented below)
+* `includes` -  (Optional) The property- or tag-based conditions that determine which objects to include in the analysis. (documented below)
+
+The `excludes` and `includes` object supports the following:
+
+* `and` -  (Optional) An array of conditions, one for each condition that determines which objects to include or exclude from the job. (documented below)
+
+The `and` object supports the following:
+
+* `simpleScopeTerm` -  (Optional) A property-based condition that defines a property, operator, and one or more values for including or excluding an object from the job. (documented below)
+* `tagScopeTerm` -  (Optional) A tag-based condition that defines the operator and tag keys or tag key and value pairs for including or excluding an object from the job. (documented below)
+
+The `simpleScopeTerm` object supports the following:
+
+* `comparator` -  (Optional) The operator to use in a condition. Valid values are: `eq`, `gt`, `gte`, `lt`, `lte`, `ne`, `contains`, `startsWith`
+* `values` -  (Optional) An array that lists the values to use in the condition.
+* `key` -  (Optional) The object property to use in the condition.
+
+The `tagScopeTerm` object supports the following:
+
+* `comparator` -  (Optional) The operator to use in the condition.
+* `tagValues` -  (Optional) The tag keys or tag key and value pairs to use in the condition.
+* `key` -  (Required) The tag key to use in the condition. The only valid value is `tag`.
+* `target` -  (Required) The type of object to apply the condition to. The only valid value is `s3Object`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The unique identifier (ID) of the macie classification job.
+* `createdAt` -  The date and time, in UTC and extended RFC 3339 format, when the job was created.
+* `userPausedDetails` - If the current status of the job is `userPaused`, specifies when the job was paused and when the job or job run will expire and be cancelled if it isn't resumed. This value is present only if the value for `jobStatus` is `userPaused`.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsMacie2ClassificationJob` using the id. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsMacie2ClassificationJob` using the id. For example:
+
+```console
+% terraform import aws_macie2_classification_job.example abcd1
+```
+
+<!-- cache-key: cdktf-0.18.0 input-9a222992d46777a40eb5928a868c445f448ac2d2331bda106271060c834b0a4f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/macie2_custom_data_identifier.html.markdown b/website/docs/cdktf/typescript/r/macie2_custom_data_identifier.html.markdown
new file mode 100644
index 00000000000..4872f6324e2
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/macie2_custom_data_identifier.html.markdown
@@ -0,0 +1,95 @@
+---
+subcategory: "Macie"
+layout: "aws"
+page_title: "AWS: aws_macie2_custom_data_identifier"
+description: |-
+  Provides a resource to manage an AWS Macie Custom Data Identifier.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_macie2_custom_data_identifier
+
+Provides a resource to manage an [AWS Macie Custom Data Identifier](https://docs.aws.amazon.com/macie/latest/APIReference/custom-data-identifiers-id.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Macie2Account } from "./.gen/providers/aws/macie2-account";
+import { Macie2CustomDataIdentifier } from "./.gen/providers/aws/macie2-custom-data-identifier";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Macie2Account(this, "example", {});
+    const awsMacie2CustomDataIdentifierExample = new Macie2CustomDataIdentifier(
+      this,
+      "example_1",
+      {
+        dependsOn: [test],
+        description: "DESCRIPTION",
+        ignoreWords: ["ignore"],
+        keywords: ["keyword"],
+        maximumMatchDistance: 10,
+        name: "NAME OF CUSTOM DATA IDENTIFIER",
+        regex: "[0-9]{3}-[0-9]{2}-[0-9]{4}",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsMacie2CustomDataIdentifierExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `regex` - (Optional) The regular expression (regex) that defines the pattern to match. The expression can contain as many as 512 characters.
+* `keywords` -  (Optional) An array that lists specific character sequences (keywords), one of which must be within proximity (`maximumMatchDistance`) of the regular expression to match. The array can contain as many as 50 keywords. Each keyword can contain 3 - 90 characters. Keywords aren't case sensitive.
+* `ignoreWords` - (Optional) An array that lists specific character sequences (ignore words) to exclude from the results. If the text matched by the regular expression is the same as any string in this array, Amazon Macie ignores it. The array can contain as many as 10 ignore words. Each ignore word can contain 4 - 90 characters. Ignore words are case sensitive.
+* `name` - (Optional) A custom name for the custom data identifier. The name can contain as many as 128 characters. If omitted, Terraform will assign a random, unique name. Conflicts with `namePrefix`.
+* `namePrefix` -  (Optional) Creates a unique name beginning with the specified prefix. Conflicts with `name`.
+* `description` - (Optional) A custom description of the custom data identifier. The description can contain as many as 512 characters.
+* `maximumMatchDistance` - (Optional) The maximum number of characters that can exist between text that matches the regex pattern and the character sequences specified by the keywords array. Macie includes or excludes a result based on the proximity of a keyword to text that matches the regex pattern. The distance can be 1 - 300 characters. The default value is 50.
+* `tags` - (Optional) A map of key-value pairs that specifies the tags to associate with the custom data identifier.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The unique identifier (ID) of the macie custom data identifier.
+* `deleted` - Specifies whether the custom data identifier was deleted. If you delete a custom data identifier, Amazon Macie doesn't delete it permanently. Instead, it soft deletes the identifier.
+* `createdAt` - The date and time, in UTC and extended RFC 3339 format, when the Amazon Macie account was created.
+* `arn` - The Amazon Resource Name (ARN) of the custom data identifier.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsMacie2CustomDataIdentifier` using the id. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsMacie2CustomDataIdentifier` using the id. For example:
+
+```console
+% terraform import aws_macie2_custom_data_identifier.example abcd1
+```
+
+<!-- cache-key: cdktf-0.18.0 input-7f26274861db2152fb5a3ebcdbcf38c145ad1a6560147c223131748340ff5d98 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/macie2_findings_filter.html.markdown b/website/docs/cdktf/typescript/r/macie2_findings_filter.html.markdown
new file mode 100644
index 00000000000..c5f0b301195
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/macie2_findings_filter.html.markdown
@@ -0,0 +1,107 @@
+---
+subcategory: "Macie"
+layout: "aws"
+page_title: "AWS: aws_macie2_findings_filter"
+description: |-
+  Provides a resource to manage an Amazon Macie Findings Filter.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_macie2_findings_filter
+
+Provides a resource to manage an [Amazon Macie Findings Filter](https://docs.aws.amazon.com/macie/latest/APIReference/findingsfilters-id.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Macie2Account } from "./.gen/providers/aws/macie2-account";
+import { Macie2FindingsFilter } from "./.gen/providers/aws/macie2-findings-filter";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Macie2Account(this, "example", {});
+    new Macie2FindingsFilter(this, "test", {
+      action: "ARCHIVE",
+      dependsOn: [awsMacie2AccountTest],
+      description: "DESCRIPTION",
+      findingCriteria: {
+        criterion: [
+          {
+            eq: [Token.asString(current.name)],
+            field: "region",
+          },
+        ],
+      },
+      name: "NAME OF THE FINDINGS FILTER",
+      position: 1,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `findingCriteria` - (Required) The criteria to use to filter findings.
+* `name` - (Optional) A custom name for the filter. The name must contain at least 3 characters and can contain as many as 64 characters. If omitted, Terraform will assign a random, unique name. Conflicts with `namePrefix`.
+* `namePrefix` -  (Optional) Creates a unique name beginning with the specified prefix. Conflicts with `name`.
+* `description` - (Optional) A custom description of the filter. The description can contain as many as 512 characters.
+* `action` - (Required) The action to perform on findings that meet the filter criteria (`findingCriteria`). Valid values are: `archive`, suppress (automatically archive) the findings; and, `noop`, don't perform any action on the findings.
+* `position` - (Optional) The position of the filter in the list of saved filters on the Amazon Macie console. This value also determines the order in which the filter is applied to findings, relative to other filters that are also applied to the findings.
+* `tags` - (Optional) A map of key-value pairs that specifies the tags to associate with the filter.
+
+The `findingCriteria` object supports the following:
+
+* `criterion` -  (Optional) A condition that specifies the property, operator, and one or more values to use to filter the results.  (documented below)
+
+The `criterion` object supports the following:
+
+* `field` - (Required) The name of the field to be evaluated.
+* `eqExactMatch` - (Optional) The value for the property exclusively matches (equals an exact match for) all the specified values. If you specify multiple values, Amazon Macie uses AND logic to join the values.
+* `eq` - (Optional) The value for the property matches (equals) the specified value. If you specify multiple values, Amazon Macie uses OR logic to join the values.
+* `neq` - (Optional) The value for the property doesn't match (doesn't equal) the specified value. If you specify multiple values, Amazon Macie uses OR logic to join the values.
+* `lt` - (Optional) The value for the property is less than the specified value.
+* `lte` - (Optional) The value for the property is less than or equal to the specified value.
+* `gt` - (Optional) The value for the property is greater than the specified value.
+* `gte` - (Optional) The value for the property is greater than or equal to the specified value.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The unique identifier (ID) of the macie Findings Filter.
+* `arn` - The Amazon Resource Name (ARN) of the Findings Filter.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsMacie2FindingsFilter` using the id. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsMacie2FindingsFilter` using the id. For example:
+
+```console
+% terraform import aws_macie2_findings_filter.example abcd1
+```
+
+<!-- cache-key: cdktf-0.18.0 input-922eadb42886940b99342f03a6f68d81b396a29ebaa5aa573f2d1fa24f21e6b5 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/macie2_invitation_accepter.html.markdown b/website/docs/cdktf/typescript/r/macie2_invitation_accepter.html.markdown
new file mode 100644
index 00000000000..1ca03d95300
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/macie2_invitation_accepter.html.markdown
@@ -0,0 +1,95 @@
+---
+subcategory: "Macie"
+layout: "aws"
+page_title: "AWS: aws_macie2_invitation_accepter"
+description: |-
+  Provides a resource to manage an Amazon Macie Invitation Accepter.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_macie2_invitation_accepter
+
+Provides a resource to manage an [Amazon Macie Invitation Accepter](https://docs.aws.amazon.com/macie/latest/APIReference/invitations-accept.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Macie2Account } from "./.gen/providers/aws/macie2-account";
+import { Macie2InvitationAccepter } from "./.gen/providers/aws/macie2-invitation-accepter";
+import { Macie2Member } from "./.gen/providers/aws/macie2-member";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Macie2Account(this, "member", {});
+    const primary = new Macie2Account(this, "primary", {
+      provider: "awsalternate",
+    });
+    const awsMacie2MemberPrimary = new Macie2Member(this, "primary_2", {
+      accountId: "ACCOUNT ID",
+      dependsOn: [primary],
+      email: "EMAIL",
+      invitationMessage: "Message of the invite",
+      invite: true,
+      provider: "awsalternate",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsMacie2MemberPrimary.overrideLogicalId("primary");
+    const awsMacie2InvitationAccepterMember = new Macie2InvitationAccepter(
+      this,
+      "member_3",
+      {
+        administratorAccountId: "ADMINISTRATOR ACCOUNT ID",
+        dependsOn: [awsMacie2MemberPrimary],
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsMacie2InvitationAccepterMember.overrideLogicalId("member");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `administratorAccountId` - (Required) The AWS account ID for the account that sent the invitation.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The unique identifier (ID) of the macie invitation accepter.
+* `invitationId` - The unique identifier for the invitation.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsMacie2InvitationAccepter` using the admin account ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsMacie2InvitationAccepter` using the admin account ID. For example:
+
+```console
+% terraform import aws_macie2_invitation_accepter.example 123456789012
+```
+
+<!-- cache-key: cdktf-0.18.0 input-189b2215e9d38a524f24ee8ee99ac1bcf4754aa1be8a0ae0ca9033c2648b9b3d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/macie2_member.html.markdown b/website/docs/cdktf/typescript/r/macie2_member.html.markdown
new file mode 100644
index 00000000000..1a37c4b6432
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/macie2_member.html.markdown
@@ -0,0 +1,91 @@
+---
+subcategory: "Macie"
+layout: "aws"
+page_title: "AWS: aws_macie2_member"
+description: |-
+  Provides a resource to manage an Amazon Macie Member.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_macie2_member
+
+Provides a resource to manage an [Amazon Macie Member](https://docs.aws.amazon.com/macie/latest/APIReference/members-id.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Macie2Account } from "./.gen/providers/aws/macie2-account";
+import { Macie2Member } from "./.gen/providers/aws/macie2-member";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new Macie2Account(this, "example", {});
+    const awsMacie2MemberExample = new Macie2Member(this, "example_1", {
+      accountId: "AWS ACCOUNT ID",
+      dependsOn: [example],
+      email: "EMAIL",
+      invitationDisableEmailNotification: true,
+      invitationMessage: "Message of the invitation",
+      invite: true,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsMacie2MemberExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `accountId` - (Required) The AWS account ID for the account.
+* `email` - (Required) The email address for the account.
+* `tags` - (Optional) A map of key-value pairs that specifies the tags to associate with the account in Amazon Macie.
+* `status` - (Optional) Specifies the status for the account. To enable Amazon Macie and start all Macie activities for the account, set this value to `enabled`. Valid values are `enabled` or `paused`.
+* `invite` - (Optional) Send an invitation to a member
+* `invitationMessage` - (Optional) A custom message to include in the invitation. Amazon Macie adds this message to the standard content that it sends for an invitation.
+* `invitationDisableEmailNotification` - (Optional) Specifies whether to send an email notification to the root user of each account that the invitation will be sent to. This notification is in addition to an alert that the root user receives in AWS Personal Health Dashboard. To send an email notification to the root user of each account, set this value to `true`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The unique identifier (ID) of the macie Member.
+* `arn` - The Amazon Resource Name (ARN) of the account.
+* `relationshipStatus` - The current status of the relationship between the account and the administrator account.
+* `administratorAccountId` - The AWS account ID for the administrator account.
+* `invitedAt` - The date and time, in UTC and extended RFC 3339 format, when an Amazon Macie membership invitation was last sent to the account. This value is null if a Macie invitation hasn't been sent to the account.
+* `updatedAt` - The date and time, in UTC and extended RFC 3339 format, of the most recent change to the status of the relationship between the account and the administrator account.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsMacie2Member` using the account ID of the member account. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsMacie2Member` using the account ID of the member account. For example:
+
+```console
+% terraform import aws_macie2_member.example 123456789012
+```
+
+<!-- cache-key: cdktf-0.18.0 input-270188c839fbbf61a15582b99048abc7d28b091c50c92930247fa2315358a77d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/macie2_organization_admin_account.html.markdown b/website/docs/cdktf/typescript/r/macie2_organization_admin_account.html.markdown
new file mode 100644
index 00000000000..02e1dadd88e
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/macie2_organization_admin_account.html.markdown
@@ -0,0 +1,77 @@
+---
+subcategory: "Macie"
+layout: "aws"
+page_title: "AWS: aws_macie2_organization_admin_account"
+description: |-
+  Provides a resource to manage an Amazon Macie Organization Admin Account.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_macie2_organization_admin_account
+
+Provides a resource to manage an [Amazon Macie Organization Admin Account](https://docs.aws.amazon.com/macie/latest/APIReference/admin.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Macie2Account } from "./.gen/providers/aws/macie2-account";
+import { Macie2OrganizationAdminAccount } from "./.gen/providers/aws/macie2-organization-admin-account";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new Macie2Account(this, "example", {});
+    const awsMacie2OrganizationAdminAccountExample =
+      new Macie2OrganizationAdminAccount(this, "example_1", {
+        adminAccountId: "ID OF THE ADMIN ACCOUNT",
+        dependsOn: [example],
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsMacie2OrganizationAdminAccountExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `adminAccountId` - (Required) The AWS account ID for the account to designate as the delegated Amazon Macie administrator account for the organization.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The unique identifier (ID) of the macie organization admin account.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsMacie2OrganizationAdminAccount` using the id. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsMacie2OrganizationAdminAccount` using the id. For example:
+
+```console
+% terraform import aws_macie2_organization_admin_account.example abcd1
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ce092bbcd6ad04e47b3e88a6f9f4f8d7424bc7880543e934e20790f46e48066f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/main_route_table_association.html.markdown b/website/docs/cdktf/typescript/r/main_route_table_association.html.markdown
new file mode 100644
index 00000000000..2dd7e5b1f02
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/main_route_table_association.html.markdown
@@ -0,0 +1,77 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_main_route_table_association"
+description: |-
+  Provides a resource for managing the main routing table of a VPC.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_main_route_table_association
+
+Provides a resource for managing the main routing table of a VPC.
+
+~> **NOTE:** **Do not** use both `awsDefaultRouteTable` to manage a default route table **and** `awsMainRouteTableAssociation` with the same VPC due to possible route conflicts. See [aws_default_route_table][tf-default-route-table] documentation for more details.
+For more information, see the Amazon VPC User Guide on [Route Tables](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Route_Tables.html). For information about managing normal route tables in Terraform, see [`awsRouteTable`](/docs/providers/aws/r/route_table.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { MainRouteTableAssociation } from "./.gen/providers/aws/main-route-table-association";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new MainRouteTableAssociation(this, "a", {
+      routeTableId: bar.id,
+      vpcId: foo.id,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `vpcId` - (Required) The ID of the VPC whose main route table should be set
+* `routeTableId` - (Required) The ID of the Route Table to set as the new
+  main route table for the target VPC
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the Route Table Association
+* `originalRouteTableId` - Used internally, see __Notes__ below
+
+## Notes
+
+On VPC creation, the AWS API always creates an initial Main Route Table. This
+resource records the ID of that Route Table under `originalRouteTableId`.
+The "Delete" action for a `mainRouteTableAssociation` consists of resetting
+this original table as the Main Route Table for the VPC. You'll see this
+additional Route Table in the AWS console; it must remain intact in order for
+the `mainRouteTableAssociation` delete to work properly.
+
+[aws-route-tables]: http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Route_Tables.html#Route_Replacing_Main_Table
+[tf-route-tables]: /docs/providers/aws/r/route_table.html
+[tf-default-route-table]: /docs/providers/aws/r/default_route_table.html
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `5M`)
+- `update` - (Default `2M`)
+- `delete` - (Default `5M`)
+
+<!-- cache-key: cdktf-0.18.0 input-8a24f73bf17fe1ade6055be9d49a3b7dead4b56fe5a89302c4898ee7002090fc -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/media_convert_queue.html.markdown b/website/docs/cdktf/typescript/r/media_convert_queue.html.markdown
new file mode 100644
index 00000000000..d6a61a8d060
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/media_convert_queue.html.markdown
@@ -0,0 +1,86 @@
+---
+subcategory: "Elemental MediaConvert"
+layout: "aws"
+page_title: "AWS: aws_media_convert_queue"
+description: |-
+  Provides an AWS Elemental MediaConvert Queue.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_media_convert_queue
+
+Provides an AWS Elemental MediaConvert Queue.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { MediaConvertQueue } from "./.gen/providers/aws/media-convert-queue";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new MediaConvertQueue(this, "test", {
+      name: "tf-test-queue",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) A unique identifier describing the queue
+* `description` - (Optional) A description of the queue
+* `pricingPlan` - (Optional) Specifies whether the pricing plan for the queue is on-demand or reserved. Valid values are `onDemand` or `reserved`. Default to `onDemand`.
+* `reservationPlanSettings` - (Optional) A detail pricing plan of the  reserved queue. See below.
+* `status` - (Optional) A status of the queue. Valid values are `active` or `reserved`. Default to `paused`.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Nested Fields
+
+#### `reservationPlanSettings`
+
+* `commitment` - (Required) The length of the term of your reserved queue pricing plan commitment. Valid value is `oneYear`.
+* `renewalType` - (Required) Specifies whether the term of your reserved queue pricing plan. Valid values are `autoRenew` or `expire`.
+* `reservedSlots` - (Required) Specifies the number of reserved transcode slots (RTS) for queue.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The same as `name`
+* `arn` - The Arn of the queue
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Media Convert Queue using the queue name. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Media Convert Queue using the queue name. For example:
+
+```console
+% terraform import aws_media_convert_queue.test tf-test-queue
+```
+
+<!-- cache-key: cdktf-0.18.0 input-4187cb7aae796644c39c65825e4388d40e4bbc13bb166ecba228fe64c9f6f4c9 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/media_package_channel.html.markdown b/website/docs/cdktf/typescript/r/media_package_channel.html.markdown
new file mode 100644
index 00000000000..67beafbb096
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/media_package_channel.html.markdown
@@ -0,0 +1,81 @@
+---
+subcategory: "Elemental MediaPackage"
+layout: "aws"
+page_title: "AWS: aws_media_package_channel"
+description: |-
+  Provides an AWS Elemental MediaPackage Channel.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_media_package_channel
+
+Provides an AWS Elemental MediaPackage Channel.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { MediaPackageChannel } from "./.gen/providers/aws/media-package-channel";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new MediaPackageChannel(this, "kittens", {
+      channelId: "kitten-channel",
+      description: "A channel dedicated to amusing videos of kittens.",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `channelId` - (Required) A unique identifier describing the channel
+* `description` - (Optional) A description of the channel
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The same as `channelId`
+* `arn` - The ARN of the channel
+* `hlsIngest` - A single item list of HLS ingest information
+    * `ingestEndpoints` - A list of the ingest endpoints
+        * `password` - The password
+        * `url` - The URL
+        * `username` - The username
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Media Package Channels using the channel ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Media Package Channels using the channel ID. For example:
+
+```console
+% terraform import aws_media_package_channel.kittens kittens-channel
+```
+
+<!-- cache-key: cdktf-0.18.0 input-749270ff3fa0c6f15341b2b41f6c3363f04071edc7478cee4ebbc36cb5e14a07 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/media_store_container.html.markdown b/website/docs/cdktf/typescript/r/media_store_container.html.markdown
new file mode 100644
index 00000000000..6783cd2bad1
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/media_store_container.html.markdown
@@ -0,0 +1,74 @@
+---
+subcategory: "Elemental MediaStore"
+layout: "aws"
+page_title: "AWS: aws_media_store_container"
+description: |-
+  Provides a MediaStore Container.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_media_store_container
+
+Provides a MediaStore Container.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { MediaStoreContainer } from "./.gen/providers/aws/media-store-container";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new MediaStoreContainer(this, "example", {
+      name: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the container. Must contain alphanumeric characters or underscores.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the container.
+* `endpoint` - The DNS endpoint of the container.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import MediaStore Container using the MediaStore Container Name. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import MediaStore Container using the MediaStore Container Name. For example:
+
+```console
+% terraform import aws_media_store_container.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-534cdde6fc1c98559d9e005ae9cd5a252af07161d62318424cfe7000b0a2d854 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/media_store_container_policy.html.markdown b/website/docs/cdktf/typescript/r/media_store_container_policy.html.markdown
new file mode 100644
index 00000000000..e11b651ede6
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/media_store_container_policy.html.markdown
@@ -0,0 +1,125 @@
+---
+subcategory: "Elemental MediaStore"
+layout: "aws"
+page_title: "AWS: aws_media_store_container_policy"
+description: |-
+  Provides a MediaStore Container Policy.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_media_store_container_policy
+
+Provides a MediaStore Container Policy.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCallerIdentity } from "./.gen/providers/aws/data-aws-caller-identity";
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { DataAwsRegion } from "./.gen/providers/aws/data-aws-region";
+import { MediaStoreContainer } from "./.gen/providers/aws/media-store-container";
+import { MediaStoreContainerPolicy } from "./.gen/providers/aws/media-store-container-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new MediaStoreContainer(this, "example", {
+      name: "example",
+    });
+    const current = new DataAwsCallerIdentity(this, "current", {});
+    const dataAwsRegionCurrent = new DataAwsRegion(this, "current_2", {});
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsRegionCurrent.overrideLogicalId("current");
+    const dataAwsIamPolicyDocumentExample = new DataAwsIamPolicyDocument(
+      this,
+      "example_3",
+      {
+        statement: [
+          {
+            actions: ["mediastore:*"],
+            condition: [
+              {
+                test: "Bool",
+                values: ["true"],
+                variable: "aws:SecureTransport",
+              },
+            ],
+            effect: "Allow",
+            principals: [
+              {
+                identifiers: ["arn:aws:iam::${" + current.accountId + "}:root"],
+                type: "AWS",
+              },
+            ],
+            resources: [
+              "arn:aws:mediastore:${" +
+                dataAwsRegionCurrent.name +
+                "}:${" +
+                current.accountId +
+                "}:container/${" +
+                example.name +
+                "}/*",
+            ],
+            sid: "MediaStoreFullAccess",
+          },
+        ],
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsIamPolicyDocumentExample.overrideLogicalId("example");
+    const awsMediaStoreContainerPolicyExample = new MediaStoreContainerPolicy(
+      this,
+      "example_4",
+      {
+        containerName: example.name,
+        policy: Token.asString(dataAwsIamPolicyDocumentExample.json),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsMediaStoreContainerPolicyExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `containerName` - (Required) The name of the container.
+* `policy` - (Required) The contents of the policy. For more information about building AWS IAM policy documents with Terraform, see the [AWS IAM Policy Document Guide](https://learn.hashicorp.com/terraform/aws/iam-policy).
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import MediaStore Container Policy using the MediaStore Container Name. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import MediaStore Container Policy using the MediaStore Container Name. For example:
+
+```console
+% terraform import aws_media_store_container_policy.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-addc870ae2e73534f5d560ba4934913eb5bf1ebcafc93b6e1cbf16f9a89254bc -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/medialive_channel.html.markdown b/website/docs/cdktf/typescript/r/medialive_channel.html.markdown
new file mode 100644
index 00000000000..4a29bbfdf8a
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/medialive_channel.html.markdown
@@ -0,0 +1,823 @@
+---
+subcategory: "Elemental MediaLive"
+layout: "aws"
+page_title: "AWS: aws_medialive_channel"
+description: |-
+  Terraform resource for managing an AWS MediaLive Channel.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_medialive_channel
+
+Terraform resource for managing an AWS MediaLive Channel.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { MedialiveChannel } from "./.gen/providers/aws/medialive-channel";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new MedialiveChannel(this, "example", {
+      channelClass: "STANDARD",
+      destinations: [
+        {
+          id: "destination",
+          settings: [
+            {
+              url: "s3://${" + main.id + "}/test1",
+            },
+            {
+              url: "s3://${" + main2.id + "}/test2",
+            },
+          ],
+        },
+      ],
+      encoderSettings: {
+        audioDescriptions: [
+          {
+            audioSelectorName: "example audio selector",
+            name: "audio-selector",
+          },
+        ],
+        outputGroups: [
+          {
+            outputGroupSettings: {
+              archiveGroupSettings: [
+                {
+                  destination: {
+                    destinationRefId: "destination",
+                  },
+                },
+              ],
+            },
+            outputs: [
+              {
+                audioDescriptionNames: ["audio-selector"],
+                outputName: "example-name",
+                outputSettings: {
+                  archiveOutputSettings: {
+                    containerSettings: {
+                      m2TsSettings: {
+                        audioBufferModel: "ATSC",
+                        bufferModel: "MULTIPLEX",
+                        rateMode: "CBR",
+                      },
+                    },
+                    extension: "m2ts",
+                    nameModifier: "_1",
+                  },
+                },
+                videoDescriptionName: "example-video",
+              },
+            ],
+          },
+        ],
+        timecodeConfig: {
+          source: "EMBEDDED",
+        },
+        videoDescriptions: [
+          {
+            name: "example-video",
+          },
+        ],
+      },
+      inputAttachments: [
+        {
+          inputAttachmentName: "example-input",
+          inputId: Token.asString(awsMedialiveInputExample.id),
+        },
+      ],
+      inputSpecification: {
+        codec: "AVC",
+        inputResolution: "HD",
+        maximumBitrate: "MAX_20_MBPS",
+      },
+      name: "example-channel",
+      roleArn: Token.asString(awsIamRoleExample.arn),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `channelClass` - (Required) Concise argument description.
+* `destinations` - (Required) Destinations for channel. See [Destinations](#destinations) for more details.
+* `encoderSettings` - (Required) Encoder settings. See [Encoder Settings](#encoder-settings) for more details.
+* `inputSpecification` - (Required) Specification of network and file inputs for the channel.
+* `name` - (Required) Name of the Channel.
+
+The following arguments are optional:
+
+* `cdiInputSpecification` - (Optional) Specification of CDI inputs for this channel. See [CDI Input Specification](#cdi-input-specification) for more details.
+* `inputAttachments` - (Optional) Input attachments for the channel. See [Input Attachments](#input-attachments) for more details.
+* `logLevel` - (Optional) The log level to write to Cloudwatch logs.
+* `maintenance` - (Optional) Maintenance settings for this channel. See [Maintenance](#maintenance) for more details.
+* `roleArn` - (Optional) Concise argument description.
+* `startChannel` - (Optional) Whether to start/stop channel. Default: `false`
+* `tags` - (Optional) A map of tags to assign to the channel. If configured with a provider [`defaultTags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `vpc` - (Optional) Settings for the VPC outputs. See [VPC](#vpc) for more details.
+
+### CDI Input Specification
+
+* `resolution` - (Required) - Maximum CDI input resolution.
+
+### Destinations
+
+* `id` - (Required) User-specified id. Ths is used in an output group or an output.
+* `mediaPackageSettings` - (Optional) Destination settings for a MediaPackage output; one destination for both encoders. See [Media Package Settings](#media-package-settings) for more details.
+* `multiplexSettings` - (Optional) Destination settings for a Multiplex output; one destination for both encoders. See [Multiplex Settings](#multiplex-settings) for more details.
+* `settings` - (Optional) Destination settings for a standard output; one destination for each redundant encoder. See [Settings](#settings) for more details.
+
+### Encoder Settings
+
+* `audioDescriptions` - (Required) Audio descriptions for the channel. See [Audio Descriptions](#audio-descriptions) for more details.
+* `outputGroups` - (Required) Output groups for the channel. See [Output Groups](#output-groups) for more details.
+* `timecodeConfig` - (Required) Contains settings used to acquire and adjust timecode information from inputs. See [Timecode Config](#timecode-config) for more details.
+* `videoDescriptions` - (Required) Video Descriptions. See [Video Descriptions](#video-descriptions) for more details.
+* `captionDescriptions` - (Optional) Caption Descriptions. See [Caption Descriptions](#caption-descriptions) for more details.
+* `globalConfiguration` - (Optional) Configuration settings that apply to the event as a whole. See [Global Configuration](#global-configuration) for more details.
+* `motionGraphicsConfiguration` - (Optional) Settings for motion graphics. See [Motion Graphics Configuration](#motion-graphics-configuration) for more details.
+* `nielsenConfiguration` - (Optional) Nielsen configuration settings. See [Nielsen Configuration](#nielsen-configuration) for more details.
+* `availBlanking` - (Optional) Settings for ad avail blanking. See [Avail Blanking](#avail-blanking) for more details.
+
+### Input Attachments
+
+* `inputAttachmentName` - (Optional) User-specified name for the attachment.
+* `inputId` - (Required) The ID of the input.
+* `inputSettings` - (Optional) Settings of an input. See [Input Settings](#input-settings) for more details.
+* `automaticInputFailoverSettings` - (Optional) User-specified settings for defining what the conditions are for declaring the input unhealthy and failing over to a different input. See [Automatic Input Failover Settings](#automatic-input-failover-settings) for more details.
+
+### Input Settings
+
+* `audioSelectors` - (Optional) Used to select the audio stream to decode for inputs that have multiple. See [Audio Selectors](#audio-selectors) for more details.
+* `captionSelectors` - (Optional) Used to select the caption input to use for inputs that have multiple available. See [Caption Selectors](#caption-selectors) for more details.
+* `deblockFilter` - (Optional) Enable or disable the deblock filter when filtering.
+* `denoiseFilter` - (Optional) Enable or disable the denoise filter when filtering.
+* `filterStrength` - (Optional) Adjusts the magnitude of filtering from 1 (minimal) to 5 (strongest).
+* `inputFilter` - (Optional) Turns on the filter for the input.
+* `networkInputSettings` - (Optional) Input settings. See [Network Input Settings](#network-input-settings) for more details.
+* `scte35Pid` - (Optional) PID from which to read SCTE-35 messages.
+* `smpte2038DataPreference` - (Optional) Specifies whether to extract applicable ancillary data from a SMPTE-2038 source in the input.
+* `sourceEndBehavior` - (Optional) Loop input if it is a file.
+
+### Audio Selectors
+
+* `name` - (Required) The name of the audio selector.
+* `selectorSettings` - (Optional) The audio selector settings. See [Audio Selector Settings](#audio-selector-settings) for more details.
+
+### Audio Selector Settings
+
+* `audioHlsRenditionSelection` - (Optional) Audio HLS Rendition Selection. See [Audio HLS Rendition Selection](#audio-hls-rendition-selection) for more details.
+* `audioLanguageSelection` - (Optional) Audio Language Selection. See [Audio Language Selection](#audio-language-selection) for more details.
+* `audioPidSelection` - (Optional) Audio Pid Selection. See [Audio PID Selection](#audio-pid-selection) for more details.
+* `audioTrackSelection` - (Optional) Audio Track Selection. See [Audio Track Selection](#audio-track-selection) for more details.
+
+### Audio HLS Rendition Selection
+
+* `groupId` - (Required) Specifies the GROUP-ID in the #EXT-X-MEDIA tag of the target HLS audio rendition.
+* `name` - (Required) Specifies the NAME in the #EXT-X-MEDIA tag of the target HLS audio rendition.
+
+### Audio Language Selection
+
+* `languageCode` - (Required) Selects a specific three-letter language code from within an audio source.
+* `languageSelectionPolicy` - (Optional) When set to “strict”, the transport stream demux strictly identifies audio streams by their language descriptor. If a PMT update occurs such that an audio stream matching the initially selected language is no longer present then mute will be encoded until the language returns. If “loose”, then on a PMT update the demux will choose another audio stream in the program with the same stream type if it can’t find one with the same language.
+
+### Audio PID Selection
+
+* `pid` - (Required) Selects a specific PID from within a source.
+
+### Audio Track Selection
+
+* `tracks` - (Required) Selects one or more unique audio tracks from within a source. See [Audio Tracks](#audio-tracks) for more details.
+* `dolbyEDecode` - (Optional) Configure decoding options for Dolby E streams - these should be Dolby E frames carried in PCM streams tagged with SMPTE-337. See [Dolby E Decode](#dolby-e-decode) for more details.
+
+### Audio Tracks
+
+* `track` - (Required) 1-based integer value that maps to a specific audio track.
+
+### Dolby E Decode
+
+* `programSelection` - (Required) Applies only to Dolby E. Enter the program ID (according to the metadata in the audio) of the Dolby E program to extract from the specified track. One program extracted per audio selector. To select multiple programs, create multiple selectors with the same Track and different Program numbers. “All channels” means to ignore the program IDs and include all the channels in this selector; useful if metadata is known to be incorrect.
+
+### Caption Selectors
+
+* `name` - (Optional) The name of the caption selector.
+* `languageCode` - (Optional) When specified this field indicates the three letter language code of the caption track to extract from the source.
+* `selectorSettings` - (Optional) Caption selector settings. See [Caption Selector Settings](#caption-selector-settings) for more details.
+
+### Caption Selector Settings
+
+* `ancillarySourceSettings` - (Optional) Ancillary Source Settings. See [Ancillary Source Settings](#ancillary-source-settings) for more details.
+* `aribSourceSettings` - (Optional) ARIB Source Settings.
+* `dvbSubSourceSettings` - (Optional) DVB Sub Source Settings. See [DVB Sub Source Settings](#dvb-sub-source-settings) for more details.
+* `embeddedSourceSettings` - (Optional) Embedded Source Settings. See [Embedded Source Settings](#embedded-source-settings) for more details.
+* `scte20SourceSettings` - (Optional) SCTE20 Source Settings. See [SCTE 20 Source Settings](#scte-20-source-settings) for more details.
+* `scte27SourceSettings` - (Optional) SCTE27 Source Settings. See [SCTE 27 Source Settings](#scte-27-source-settings) for more details.
+* `teletextSourceSettings` - (Optional) Teletext Source Settings. See [Teletext Source Settings](#teletext-source-settings) for more details.
+
+### Ancillary Source Settings
+
+* `sourceAncillaryChannelNumber` - (Optional) Specifies the number (1 to 4) of the captions channel you want to extract from the ancillary captions. If you plan to convert the ancillary captions to another format, complete this field. If you plan to choose Embedded as the captions destination in the output (to pass through all the channels in the ancillary captions), leave this field blank because MediaLive ignores the field.
+
+### DVB Sub Source Settings
+
+* `ocrLanguage` - (Optional) If you will configure a WebVTT caption description that references this caption selector, use this field to provide the language to consider when translating the image-based source to text.
+* `pid` - (Optional) When using DVB-Sub with Burn-In or SMPTE-TT, use this PID for the source content. Unused for DVB-Sub passthrough. All DVB-Sub content is passed through, regardless of selectors.
+
+### Embedded Source Settings
+
+* `convert608To708` - (Optional) If upconvert, 608 data is both passed through via the “608 compatibility bytes” fields of the 708 wrapper as well as translated into 708. 708 data present in the source content will be discarded.
+* `scte20Detection` - (Optional) Set to “auto” to handle streams with intermittent and/or non-aligned SCTE-20 and Embedded captions.
+* `source608ChannelNumber` - (Optional) Specifies the 608/708 channel number within the video track from which to extract captions. Unused for passthrough.
+
+### SCTE 20 Source Settings
+
+* `convert608To708` – (Optional) If upconvert, 608 data is both passed through via the “608 compatibility bytes” fields of the 708 wrapper as well as translated into 708. 708 data present in the source content will be discarded.
+* `source608ChannelNumber` - (Optional) Specifies the 608/708 channel number within the video track from which to extract captions. Unused for passthrough.
+
+### SCTE 27 Source Settings
+
+* `ocrLanguage` - (Optional) If you will configure a WebVTT caption description that references this caption selector, use this field to provide the language to consider when translating the image-based source to text.
+* `pid` - (Optional) The pid field is used in conjunction with the caption selector languageCode field as follows: - Specify PID and Language: Extracts captions from that PID; the language is "informational". - Specify PID and omit Language: Extracts the specified PID. - Omit PID and specify Language: Extracts the specified language, whichever PID that happens to be. - Omit PID and omit Language: Valid only if source is DVB-Sub that is being passed through; all languages will be passed through.
+
+### Teletext Source Settings
+
+* `outputRectangle` - (Optional) Optionally defines a region where TTML style captions will be displayed. See [Caption Rectangle](#caption-rectangle) for more details.
+* `pageNumber` - (Optional) Specifies the teletext page number within the data stream from which to extract captions. Range of 0x100 (256) to 0x8FF (2303). Unused for passthrough. Should be specified as a hexadecimal string with no “0x” prefix.
+
+### Caption Rectangle
+
+* `height` - (Required) See the description in left\_offset. For height, specify the entire height of the rectangle as a percentage of the underlying frame height. For example, "80" means the rectangle height is 80% of the underlying frame height. The top\_offset and rectangle\_height must add up to 100% or less. This field corresponds to tts:extent - Y in the TTML standard.
+* `leftOffset` - (Required) Applies only if you plan to convert these source captions to EBU-TT-D or TTML in an output. (Make sure to leave the default if you don’t have either of these formats in the output.) You can define a display rectangle for the captions that is smaller than the underlying video frame. You define the rectangle by specifying the position of the left edge, top edge, bottom edge, and right edge of the rectangle, all within the underlying video frame. The units for the measurements are percentages. If you specify a value for one of these fields, you must specify a value for all of them. For leftOffset, specify the position of the left edge of the rectangle, as a percentage of the underlying frame width, and relative to the left edge of the frame. For example, "10" means the measurement is 10% of the underlying frame width. The rectangle left edge starts at that position from the left edge of the frame. This field corresponds to tts:origin - X in the TTML standard.
+* `topOffset` - (Required) See the description in left\_offset. For top\_offset, specify the position of the top edge of the rectangle, as a percentage of the underlying frame height, and relative to the top edge of the frame. For example, "10" means the measurement is 10% of the underlying frame height. The rectangle top edge starts at that position from the top edge of the frame. This field corresponds to tts:origin - Y in the TTML standard.
+* `width` - (Required) See the description in left\_offset. For width, specify the entire width of the rectangle as a percentage of the underlying frame width. For example, "80" means the rectangle width is 80% of the underlying frame width. The left\_offset and rectangle\_width must add up to 100% or less. This field corresponds to tts:extent - X in the TTML standard.
+
+### Network Input Settings
+
+* `hlsInputSettings` - (Optional) Specifies HLS input settings when the uri is for a HLS manifest. See [HLS Input Settings](#hls-input-settings) for more details.
+* `serverValidation` - (Optional) Check HTTPS server certificates.
+
+### HLS Input Settings
+
+* `bandwidth` - (Optional) The bitrate is specified in bits per second, as in an HLS manifest.
+* `bufferSegments` - (Optional) Buffer segments.
+* `retries` - (Optional) The number of consecutive times that attempts to read a manifest or segment must fail before the input is considered unavailable.
+* `retryInterval` - (Optional) The number of seconds between retries when an attempt to read a manifest or segment fails.
+* `scte35SourceType` - (Optional) Identifies the source for the SCTE-35 messages that MediaLive will ingest.
+
+### Automatic Input Failover Settings
+
+* `secondaryInputId` - (Required) The input ID of the secondary input in the automatic input failover pair.
+* `errorClearTimeMsec` - (Optional) This clear time defines the requirement a recovered input must meet to be considered healthy. The input must have no failover conditions for this length of time. Enter a time in milliseconds. This value is particularly important if the input\_preference for the failover pair is set to PRIMARY\_INPUT\_PREFERRED, because after this time, MediaLive will switch back to the primary input.
+* `failoverConditions` - (Optional) A list of failover conditions. If any of these conditions occur, MediaLive will perform a failover to the other input. See [Failover Conditions](#failover-conditions) for more details.
+* `inputPreference` - (Optional) Input preference when deciding which input to make active when a previously failed input has recovered.
+
+### Failover Conditions
+
+* `failoverConditionSettings` - (Optional) Failover condition type-specific settings. See [Failover Condition Settings](#failover-condition-settings) for more details.
+
+### Failover Condition Settings
+
+* `audioSilenceSettings` - (Optional) MediaLive will perform a failover if the specified audio selector is silent for the specified period. See [Audio Silence Failover Settings](#audio-silence-failover-settings) for more details.
+* `inputLossSettings` - (Optional) MediaLive will perform a failover if content is not detected in this input for the specified period. See [Input Loss Failover Settings](#input-loss-failover-settings) for more details.
+* `videoBlackSettings` - (Optional) MediaLive will perform a failover if content is considered black for the specified period. See [Video Black Failover Settings](#video-black-failover-settings) for more details.
+
+### Audio Silence Failover Settings
+
+* `audioSelectorName` - (Required) The name of the audio selector in the input that MediaLive should monitor to detect silence. Select your most important rendition. If you didn't create an audio selector in this input, leave blank.
+* `audioSilenceThresholdMsec` - (Optional) The amount of time (in milliseconds) that the active input must be silent before automatic input failover occurs. Silence is defined as audio loss or audio quieter than -50 dBFS.
+
+### Input Loss Failover Settings
+
+* `inputLossThresholdMsec` - (Optional) The amount of time (in milliseconds) that no input is detected. After that time, an input failover will occur.
+
+### Video Black Failover Settings
+
+* `blackDetectThreshold` - (Optional) A value used in calculating the threshold below which MediaLive considers a pixel to be 'black'. For the input to be considered black, every pixel in a frame must be below this threshold. The threshold is calculated as a percentage (expressed as a decimal) of white. Therefore .1 means 10% white (or 90% black). Note how the formula works for any color depth. For example, if you set this field to 0.1 in 10-bit color depth: (10230.1=102.3), which means a pixel value of 102 or less is 'black'. If you set this field to .1 in an 8-bit color depth: (2550.1=25.5), which means a pixel value of 25 or less is 'black'. The range is 0.0 to 1.0, with any number of decimal places.
+* `videoBlackThresholdMsec` - (Optional) The amount of time (in milliseconds) that the active input must be black before automatic input failover occurs.
+
+### Maintenance
+
+* `maintenanceDay` - (Optional) The day of the week to use for maintenance.
+* `maintenanceStartTime` - (Optional) The hour maintenance will start.
+
+### Media Package Settings
+
+* `channelId` - (Required) ID of the channel in MediaPackage that is the destination for this output group.
+
+### Multiplex Settings
+
+* `multiplexId` - (Required) The ID of the Multiplex that the encoder is providing output to.
+* `programName` - (Optional) The program name of the Multiplex program that the encoder is providing output to.
+
+### Settings
+
+* `passwordParam` - (Optional) Key used to extract the password from EC2 Parameter store.
+* `streamName` - (Optional) Stream name RTMP destinations (URLs of type rtmp://)
+* `url` - (Optional) A URL specifying a destination.
+* `username` - (Optional) Username for destination.
+
+### Audio Descriptions
+
+* `audioSelectorName` - (Required) The name of the audio selector used as the source for this AudioDescription.
+* `name` - (Required) The name of this audio description.
+* `audioNormalizationSettings` - (Optional) Advanced audio normalization settings. See [Audio Normalization Settings](#audio-normalization-settings) for more details.
+* `audioType` - (Optional) Applies only if audioTypeControl is useConfigured. The values for audioType are defined in ISO-IEC 13818-1.
+* `audioTypeControl` - (Optional) Determined how audio type is determined.
+* `audioWatermarkSettings` - (Optional) Settings to configure one or more solutions that insert audio watermarks in the audio encode. See [Audio Watermark Settings](#audio-watermark-settings) for more details.
+* `codecSettings` - (Optional) Audio codec settings. See [Audio Codec Settings](#audio-codec-settings) for more details.
+
+### Audio Normalization Settings
+
+* `algorithm` - (Optional) Audio normalization algorithm to use. itu17701 conforms to the CALM Act specification, itu17702 to the EBU R-128 specification.
+* `algorithmControl` - (Optional) Algorithm control for the audio description.
+* `targetLkfs` - (Optional) Target LKFS (loudness) to adjust volume to.
+
+### Audio Watermark Settings
+
+* `nielsenWatermarkSettings` - (Optional) Settings to configure Nielsen Watermarks in the audio encode. See [Nielsen Watermark Settings](#nielsen-watermark-settings) for more details.
+
+### Audio Codec Settings
+
+* `aacSettings` - (Optional) Aac Settings. See [AAC Settings](#aac-settings) for more details.
+* `ac3Settings` - (Optional) Ac3 Settings. See [AC3 Settings](#ac3-settings) for more details.
+* `eac3AtmosSettings` - (Optional) - Eac3 Atmos Settings. See [EAC3 Atmos Settings](#eac3-atmos-settings)
+* `eac3Settings` - (Optional) - Eac3 Settings. See [EAC3 Settings](#eac3-settings)
+
+### AAC Settings
+
+* `bitrate` - (Optional) Average bitrate in bits/second.
+* `codingMode` - (Optional) Mono, Stereo, or 5.1 channel layout.
+* `inputType` - (Optional) Set to "broadcasterMixedAd" when input contains pre-mixed main audio + AD (narration) as a stereo pair.
+* `profile` - (Optional) AAC profile.
+* `rateControlMode` - (Optional) The rate control mode.
+* `rawFormat` - (Optional) Sets LATM/LOAS AAC output for raw containers.
+* `sampleRate` - (Optional) Sample rate in Hz.
+* `spec` - (Optional) Use MPEG-2 AAC audio instead of MPEG-4 AAC audio for raw or MPEG-2 Transport Stream containers.
+* `vbrQuality` - (Optional) VBR Quality Level - Only used if rateControlMode is VBR.
+
+### AC3 Settings
+
+* `bitrate` - (Optional) Average bitrate in bits/second.
+* `bitstreamMode` - (Optional) Specifies the bitstream mode (bsmod) for the emitted AC-3 stream.
+* `codingMode` - (Optional) Dolby Digital coding mode.
+* `dialnorm` - (Optional) Sets the dialnorm of the output.
+* `drcProfile` - (Optional) If set to filmStandard, adds dynamic range compression signaling to the output bitstream as defined in the Dolby Digital specification.
+* `lfeFilter` - (Optional) When set to enabled, applies a 120Hz lowpass filter to the LFE channel prior to encoding.
+* `metadataControl` - (Optional) Metadata control.
+
+### EAC3 Atmos Settings
+
+* `bitrate` - (Optional) Average bitrate in bits/second.
+* `codingMode` - (Optional) Dolby Digital Plus with Dolby Atmos coding mode.
+* `dialnorm` - (Optional) Sets the dialnorm for the output.
+* `drcLine` - (Optional) Sets the Dolby dynamic range compression profile.
+* `drcRf` - (Optional) Sets the profile for heavy Dolby dynamic range compression.
+* `heightTrim` - (Optional) Height dimensional trim.
+* `surroundTrim` - (Optional) Surround dimensional trim.
+
+### EAC3 Settings
+
+* `attenuationControl` - (Optional) Sets the attenuation control.
+* `bitrate` - (Optional) Average bitrate in bits/second.
+* `bitstreamMode` - (Optional) Specifies the bitstream mode (bsmod) for the emitted AC-3 stream.
+* `codingMode` - (Optional) Dolby Digital Plus coding mode.
+
+### Nielsen Watermark Settings
+
+* `nielsenCbetSettings` - (Optional) Used to insert watermarks of type Nielsen CBET. See [Nielsen CBET Settings](#nielsen-cbet-settings) for more details.
+* `nielsenDistributionType` - (Optional) Distribution types to assign to the watermarks. Options are `programContent` and `finalDistributor`.
+* `nielsenNaesIiNwSettings` - (Optional) Used to insert watermarks of type Nielsen NAES, II (N2) and Nielsen NAES VI (NW). See [Nielsen NAES II NW Settings](#nielsen-naes-ii-nw-settings) for more details.
+
+### Nielsen CBET Settings
+
+* `cbetCheckDigit` - (Required) CBET check digits to use for the watermark.
+* `cbetStepaside` - (Required) Determines the method of CBET insertion mode when prior encoding is detected on the same layer.
+* `csid` - (Required) CBET source ID to use in the watermark.
+
+### Nielsen NAES II NW Settings
+
+* `checkDigit` - (Required) Check digit string for the watermark.
+* `sid` - (Required) The Nielsen Source ID to include in the watermark.
+
+### Output Groups
+
+* `outputGroupSettings` - (Required) Settings associated with the output group. See [Output Group Settings](#output-group-settings) for more details.
+* `outputs` - (Required) List of outputs. See [Outputs](#outputs) for more details.
+* `name` - (Optional) Custom output group name defined by the user.
+
+### Output Group Settings
+
+* `archiveGroupSettings` - (Optional) Archive group settings. See [Archive Group Settings](#archive-group-settings) for more details.
+* `mediaPackageGroupSettings` - (Optional) Media package group settings. See [Media Package Group Settings](#media-package-group-settings) for more details.
+* `multiplexGroupSttings` - (Optional) Multiplex group settings. Attribute can be passed as an empty block.
+* `rtmpGroupSettings` - (Optional) RTMP group settings. See [RTMP Group Settings](#rtmp-group-settings) for more details.
+* `udpGroupSttings` - (Optional) UDP group settings. See [UDP Group Settings](#udp-group-settings) for more details.
+
+### Outputs
+
+* `outputSettings` - (Required) Settings for output. See [Output Settings](#output-settings) for more details.
+* `audioDescriptionNames` - (Optional) The names of the audio descriptions used as audio sources for the output.
+* `captionDescriptionNames` - (Optional) The names of the caption descriptions used as caption sources for the output.
+* `outputName` - (Required) The name used to identify an output.
+* `videoDescriptionName` - (Optional) The name of the video description used as video source for the output.
+
+### Timecode Config
+
+* `source` - (Optional) The source for the timecode that will be associated with the events outputs.
+* `syncThreshold` - (Optional) Threshold in frames beyond which output timecode is resynchronized to the input timecode.
+
+### Video Descriptions
+
+* `name` - (Required) The name of the video description.
+* `codecSettings` - (Optional) The video codec settings. See [Video Codec Settings](#video-codec-settings) for more details.
+* `height` - Output video height in pixels.
+* `respondToAfd` - (Optional) Indicate how to respond to the AFD values that might be in the input video.
+* `scalingBehavior` - (Optional) Behavior on how to scale.
+* `sharpness` - (Optional) Changes the strength of the anti-alias filter used for scaling.
+* `width` - (Optional) Output video width in pixels.
+
+### Video Codec Settings
+
+* `frameCaptureSettings` - (Optional) Frame capture settings. See [Frame Capture Settings](#frame-capture-settings) for more details.
+* `h264Settings` - (Optional) H264 settings. See [H264 Settings](#h264-settings) for more details.
+
+### Frame Capture Settings
+
+* `captureInterval` - (Optional) The frequency at which to capture frames for inclusion in the output.
+* `captureIntervalUnits` - (Optional) Unit for the frame capture interval.
+
+### H264 Settings
+
+* `adaptiveQuantization` - (Optional) Enables or disables adaptive quantization.
+* `afdSignaling` - (Optional) Indicates that AFD values will be written into the output stream.
+* `bitrate` - (Optional) Average bitrate in bits/second.
+* `bufFilPct` - (Optional) Percentage of the buffer that should initially be filled.
+* `bufSize` - (Optional) Size of buffer in bits.
+* `colorMetadata` - (Optional) Includes color space metadata in the output.
+* `entropyEncoding` - (Optional) Entropy encoding mode.
+* `filterSettings` - (Optional) Filters to apply to an encode. See [H264 Filter Settings](#h264-filter-settings) for more details.
+* `fixedAfd` - (Optional) Four bit AFD value to write on all frames of video in the output stream.
+* `flicerAq` - (Optional) Makes adjustments within each frame to reduce flicker on the I-frames.
+* `forceFieldPictures` - (Optional) Controls whether coding is performed on a field basis or on a frame basis.
+* `framerateControl` - (Optional) Indicates how the output video frame rate is specified.
+* `framerateDenominator` - (Optional) Framerate denominator.
+* `framerateNumerator` - (Optional) Framerate numerator.
+* `gopBReference` - (Optional) GOP-B reference.
+* `gopClosedCadence` - (Optional) Frequency of closed GOPs.
+* `gopNumBFrames` - (Optional) Number of B-frames between reference frames.
+* `gopSize` - (Optional) GOP size in units of either frames of seconds per `gopSizeUnits`.
+* `gopSizeUnits` - (Optional) Indicates if the `gopSize` is specified in frames or seconds.
+* `level` - (Optional) H264 level.
+* `lookAheadRateControl` - (Optional) Amount of lookahead.
+* `maxBitrate` - (Optional) Set the maximum bitrate in order to accommodate expected spikes in the complexity of the video.
+* `minInterval` - (Optional) Min interval.
+* `numRefFrames` - (Optional) Number of reference frames to use.
+* `parControl` - (Optional) Indicates how the output pixel aspect ratio is specified.
+* `parDenominator` - (Optional) Pixel Aspect Ratio denominator.
+* `parNumerator` - (Optional) Pixel Aspect Ratio numerator.
+* `profile` - (Optional) H264 profile.
+* `qualityLevel` - (Optional) Quality level.
+* `qvbrQualityLevel` - (Optional) Controls the target quality for the video encode.
+* `rateControlMode` - (Optional) Rate control mode.
+* `scanType` - (Optional) Sets the scan type of the output.
+* `sceneChangeDetect` - (Optional) Scene change detection.
+* `slices` - (Optional) Number of slices per picture.
+* `softness` - (Optional) Softness.
+* `spatialAq` - (Optional) Makes adjustments within each frame based on spatial variation of content complexity.
+* `subgopLength` - (Optional) Subgop length.
+* `syntax` - (Optional) Produces a bitstream compliant with SMPTE RP-2027.
+* `temporalAq` - (Optional) Makes adjustments within each frame based on temporal variation of content complexity.
+* `timecodeInsertion` - (Optional) Determines how timecodes should be inserted into the video elementary stream.
+
+### H264 Filter Settings
+
+* `temporalFilterSettings` - (Optional) Temporal filter settings. See [Temporal Filter Settings](#temporal-filter-settings)
+
+### H265 Settings
+
+* `adaptiveQuantization` - (Optional) Enables or disables adaptive quantization.
+* `afdSignaling` - (Optional) Indicates that AFD values will be written into the output stream.
+* `alternativeTransferFunction` - (Optional) Whether or not EML should insert an Alternative Transfer Function SEI message.
+* `bitrate` - (Required) Average bitrate in bits/second.
+* `bufSize` - (Optional) Size of buffer in bits.
+* `colorMetadata` - (Optional) Includes color space metadata in the output.
+* `colorSpaceSettings` (Optional) Define the color metadata for the output. [H265 Color Space Settings](#h265-color-space-settings) for more details.
+* `filterSettings` - (Optional) Filters to apply to an encode. See [H265 Filter Settings](#h265-filter-settings) for more details.
+* `fixedAfd` - (Optional) Four bit AFD value to write on all frames of video in the output stream.
+* `flicerAq` - (Optional) Makes adjustments within each frame to reduce flicker on the I-frames.
+* `framerateDenominator` - (Required) Framerate denominator.
+* `framerateNumerator` - (Required) Framerate numerator.
+* `gopClosedCadence` - (Optional) Frequency of closed GOPs.
+* `gopSize` - (Optional) GOP size in units of either frames of seconds per `gopSizeUnits`.
+* `gopSizeUnits` - (Optional) Indicates if the `gopSize` is specified in frames or seconds.
+* `level` - (Optional) H265 level.
+* `lookAheadRateControl` - (Optional) Amount of lookahead.
+* `maxBitrate` - (Optional) Set the maximum bitrate in order to accommodate expected spikes in the complexity of the video.
+* `minInterval` - (Optional) Min interval.
+* `parDenominator` - (Optional) Pixel Aspect Ratio denominator.
+* `parNumerator` - (Optional) Pixel Aspect Ratio numerator.
+* `profile` - (Optional) H265 profile.
+* `qvbrQualityLevel` - (Optional) Controls the target quality for the video encode.
+* `rateControlMode` - (Optional) Rate control mode.
+* `scanType` - (Optional) Sets the scan type of the output.
+* `sceneChangeDetect` - (Optional) Scene change detection.
+* `slices` - (Optional) Number of slices per picture.
+* `tier` - (Optional) Set the H265 tier in the output.
+* `timecodeBurninSettings` - (Optional) Apply a burned in timecode. See [H265 Timecode Burnin Settings](#h265-timecode-burnin-settings) for more details.
+* `timecodeInsertion` - (Optional) Determines how timecodes should be inserted into the video elementary stream.
+
+### H265 Color Space Settings
+
+* `colorSpacePassthroughSettings` - (Optional) Sets the colorspace metadata to be passed through.
+* `dolbyVision81Settings` - (Optional) Set the colorspace to Dolby Vision81.
+* `hdr10Settings` - (Optional) Set the colorspace to be HDR10. See [H265 HDR10 Settings](#h265-hdr10-settings) for more details.
+* `rec601Settings` - (Optional) Set the colorspace to Rec. 601.
+* `rec709Settings` - (Optional) Set the colorspace to Rec. 709.
+
+### H265 HDR10 Settings
+
+* `maxCll` - (Optional) Sets the MaxCLL value for HDR10.
+* `maxFall` - (Optional) Sets the MaxFALL value for HDR10.
+
+### H265 Filter Settings
+
+* `temporalFilterSettings` - (Optional) Temporal filter settings. See [Temporal Filter Settings](#temporal-filter-settings)
+
+### H265 Timecode Burnin Settings
+
+* `timecodeBurninFontSize` - (Optional) Sets the size of the burned in timecode.
+* `timecodeBurninPosition` - (Optional) Sets the position of the burned in timecode.
+* `prefix` - (Optional) Set a prefix on the burned in timecode.
+
+### Temporal Filter Settings
+
+* `postFilterSharpening` - (Optional) Post filter sharpening.
+* `strength` - (Optional) Filter strength.
+
+### Caption Descriptions
+
+* `accessibility` - (Optional) Indicates whether the caption track implements accessibility features such as written descriptions of spoken dialog, music, and sounds.
+* `captionSelectorName` - (Required) Specifies which input caption selector to use as a caption source when generating output captions. This field should match a captionSelector name.
+* `destinationSettings` - (Optional) Additional settings for captions destination that depend on the destination type. See [Destination Settings](#destination-settings) for more details.
+* `languageCode` - (Optional) ISO 639-2 three-digit code.
+* `languageDescription` - (Optional) Human readable information to indicate captions available for players (eg. English, or Spanish).
+* `name` - (Required) Name of the caption description. Used to associate a caption description with an output. Names must be unique within an event.
+
+### Destination Settings
+
+* `aribDestinationSettings` - (Optional) ARIB Destination Settings.
+* `burnInDestinationSettings` - (Optional) Burn In Destination Settings. See [Burn In Destination Settings](#burn-in-destination-settings) for more details.
+* `dvbSubDestinationSettings` - (Optional) DVB Sub Destination Settings. See [DVB Sub Destination Settings](#dvb-sub-destination-settings) for more details.
+* `ebuTtDDestinationSettings` - (Optional) EBU TT D Destination Settings. See [EBU TT D Destination Settings](#ebu-tt-d-destination-settings) for more details.
+* `embeddedDestinationSettings` - (Optional) Embedded Destination Settings.
+* `embeddedPlusScte20DestinationSettings` - (Optional) Embedded Plus SCTE20 Destination Settings.
+* `rtmpCaptionInfoDestinationSettings` - (Optional) RTMP Caption Info Destination Settings.
+* `scte20PlusEmbeddedDestinationSettings` - (Optional) SCTE20 Plus Embedded Destination Settings.
+* `scte27DestinationSettings` – (Optional) SCTE27 Destination Settings.
+* `smpteTtDestinationSettings` – (Optional) SMPTE TT Destination Settings.
+* `teletextDestinationSettings` – (Optional) Teletext Destination Settings.
+* `ttmlDestinationSettings` – (Optional) TTML Destination Settings. See [TTML Destination Settings](#ttml-destination-settings) for more details.
+* `webvttDestinationSettings` - (Optional) WebVTT Destination Settings. See [WebVTT Destination Settings](#webvtt-destination-settings) for more details.
+
+### Burn In Destination Settings
+
+* `alignment` – (Optional) If no explicit xPosition or yPosition is provided, setting alignment to centered will place the captions at the bottom center of the output. Similarly, setting a left alignment will align captions to the bottom left of the output. If x and y positions are given in conjunction with the alignment parameter, the font will be justified (either left or centered) relative to those coordinates. Selecting “smart” justification will left-justify live subtitles and center-justify pre-recorded subtitles. All burn-in and DVB-Sub font settings must match.
+* `backgroundColor` – (Optional) Specifies the color of the rectangle behind the captions. All burn-in and DVB-Sub font settings must match.
+* `backgroundOpacity` – (Optional) Specifies the opacity of the background rectangle. 255 is opaque; 0 is transparent. Leaving this parameter out is equivalent to setting it to 0 (transparent). All burn-in and DVB-Sub font settings must match.
+* `font` – (Optional) External font file used for caption burn-in. File extension must be ‘ttf’ or ‘tte’. Although the user can select output fonts for many different types of input captions, embedded, STL and teletext sources use a strict grid system. Using external fonts with these caption sources could cause unexpected display of proportional fonts. All burn-in and DVB-Sub font settings must match. See [Font](#font) for more details.
+* `fontColor` – (Optional) Specifies the color of the burned-in captions. This option is not valid for source captions that are STL, 608/embedded or teletext. These source settings are already pre-defined by the caption stream. All burn-in and DVB-Sub font settings must match.
+* `fontOpacity` – (Optional) Specifies the opacity of the burned-in captions. 255 is opaque; 0 is transparent. All burn-in and DVB-Sub font settings must match.
+* `fontResolution` – (Optional) Font resolution in DPI (dots per inch); default is 96 dpi. All burn-in and DVB-Sub font settings must match.
+* `fontSize` – (Optional) When set to ‘auto’ fontSize will scale depending on the size of the output. Giving a positive integer will specify the exact font size in points. All burn-in and DVB-Sub font settings must match.
+* `outlineColor` – (Optional) Specifies font outline color. This option is not valid for source captions that are either 608/embedded or teletext. These source settings are already pre-defined by the caption stream. All burn-in and DVB-Sub font settings must match.
+* `outlineSize` – (Optional) Specifies font outline size in pixels. This option is not valid for source captions that are either 608/embedded or teletext. These source settings are already pre-defined by the caption stream. All burn-in and DVB-Sub font settings must match.
+* `shadowColor` – (Optional) Specifies the color of the shadow cast by the captions. All burn-in and DVB-Sub font settings must match.
+* `shadowOpacity` – (Optional) Specifies the opacity of the shadow. 255 is opaque; 0 is transparent. Leaving this parameter out is equivalent to setting it to 0 (transparent). All burn-in and DVB-Sub font settings must match.
+* `shadowXOffset` – (Optional) Specifies the horizontal offset of the shadow relative to the captions in pixels. A value of -2 would result in a shadow offset 2 pixels to the left. All burn-in and DVB-Sub font settings must match.
+* `shadowYOffset` – (Optional) Specifies the vertical offset of the shadow relative to the captions in pixels. A value of -2 would result in a shadow offset 2 pixels above the text. All burn-in and DVB-Sub font settings must match.
+* `teletextGridControl` – (Optional) Controls whether a fixed grid size will be used to generate the output subtitles bitmap. Only applicable for Teletext inputs and DVB-Sub/Burn-in outputs.
+* `xPosition` – (Optional) Specifies the horizontal position of the caption relative to the left side of the output in pixels. A value of 10 would result in the captions starting 10 pixels from the left of the output. If no explicit xPosition is provided, the horizontal caption position will be determined by the alignment parameter. All burn-in and DVB-Sub font settings must match.
+* `yPosition` – (Optional) Specifies the vertical position of the caption relative to the top of the output in pixels. A value of 10 would result in the captions starting 10 pixels from the top of the output. If no explicit yPosition is provided, the caption will be positioned towards the bottom of the output. All burn-in and DVB-Sub font settings must match.
+
+### DVB Sub Destination Settings
+
+* `alignment` – (Optional) If no explicit xPosition or yPosition is provided, setting alignment to centered will place the captions at the bottom center of the output. Similarly, setting a left alignment will align captions to the bottom left of the output. If x and y positions are given in conjunction with the alignment parameter, the font will be justified (either left or centered) relative to those coordinates. Selecting “smart” justification will left-justify live subtitles and center-justify pre-recorded subtitles. This option is not valid for source captions that are STL or 608/embedded. These source settings are already pre-defined by the caption stream. All burn-in and DVB-Sub font settings must match.
+* `backgroundColor` – (Optional) Specifies the color of the rectangle behind the captions. All burn-in and DVB-Sub font settings must match.
+* `backgroundOpacity` – (Optional) Specifies the opacity of the background rectangle. 255 is opaque; 0 is transparent. Leaving this parameter blank is equivalent to setting it to 0 (transparent). All burn-in and DVB-Sub font settings must match.
+* `font` – (Optional) External font file used for caption burn-in. File extension must be ‘ttf’ or ‘tte’. Although the user can select output fonts for many different types of input captions, embedded, STL and teletext sources use a strict grid system. Using external fonts with these caption sources could cause unexpected display of proportional fonts. All burn-in and DVB-Sub font settings must match. See [Font](#font) for more details.
+* `fontColor` – (Optional) Specifies the color of the burned-in captions. This option is not valid for source captions that are STL, 608/embedded or teletext. These source settings are already pre-defined by the caption stream. All burn-in and DVB-Sub font settings must match.
+* `fontOpacity` – (Optional) Specifies the opacity of the burned-in captions. 255 is opaque; 0 is transparent. All burn-in and DVB-Sub font settings must match.
+* `fontResolution` – (Optional) Font resolution in DPI (dots per inch); default is 96 dpi. All burn-in and DVB-Sub font settings must match.
+* `fontSize` – (Optional) When set to auto fontSize will scale depending on the size of the output. Giving a positive integer will specify the exact font size in points. All burn-in and DVB-Sub font settings must match.
+* `outlineColor` – (Optional) Specifies font outline color. This option is not valid for source captions that are either 608/embedded or teletext. These source settings are already pre-defined by the caption stream. All burn-in and DVB-Sub font settings must match.
+* `outlineSize` – (Optional) Specifies font outline size in pixels. This option is not valid for source captions that are either 608/embedded or teletext. These source settings are already pre-defined by the caption stream. All burn-in and DVB-Sub font settings must match.
+* `shadowColor` – (Optional) Specifies the color of the shadow cast by the captions. All burn-in and DVB-Sub font settings must match.
+* `shadowOpacity` – (Optional) Specifies the opacity of the shadow. 255 is opaque; 0 is transparent. Leaving this parameter blank is equivalent to setting it to 0 (transparent). All burn-in and DVB-Sub font settings must match.
+* `shadowXOffset` – (Optional) Specifies the horizontal offset of the shadow relative to the captions in pixels. A value of -2 would result in a shadow offset 2 pixels to the left. All burn-in and DVB-Sub font settings must match.
+* `shadowYOffset` – (Optional) Specifies the vertical offset of the shadow relative to the captions in pixels. A value of -2 would result in a shadow offset 2 pixels above the text. All burn-in and DVB-Sub font settings must match.
+* `teletextGridControl` – (Optional) Controls whether a fixed grid size will be used to generate the output subtitles bitmap. Only applicable for Teletext inputs and DVB-Sub/Burn-in outputs.
+* `xPosition` – (Optional) Specifies the horizontal position of the caption relative to the left side of the output in pixels. A value of 10 would result in the captions starting 10 pixels from the left of the output. If no explicit xPosition is provided, the horizontal caption position will be determined by the alignment parameter. This option is not valid for source captions that are STL, 608/embedded or teletext. These source settings are already pre-defined by the caption stream. All burn-in and DVB-Sub font settings must match.
+* `yPosition` – (Optional) Specifies the vertical position of the caption relative to the top of the output in pixels. A value of 10 would result in the captions starting 10 pixels from the top of the output. If no explicit yPosition is provided, the caption will be positioned towards the bottom of the output. This option is not valid for source captions that are STL, 608/embedded or teletext. These source settings are already pre-defined by the caption stream. All burn-in and DVB-Sub font settings must match.
+
+### EBU TT D Destination Settings
+
+* `copyrightHolder` – (Optional) Complete this field if you want to include the name of the copyright holder in the copyright tag in the captions metadata.
+* `fillLineGap` – (Optional) Specifies how to handle the gap between the lines (in multi-line captions). - enabled: Fill with the captions background color (as specified in the input captions). - disabled: Leave the gap unfilled.
+* `fontFamily` – (Optional) Specifies the font family to include in the font data attached to the EBU-TT captions. Valid only if styleControl is set to include. If you leave this field empty, the font family is set to “monospaced”. (If styleControl is set to exclude, the font family is always set to “monospaced”.) You specify only the font family. All other style information (color, bold, position and so on) is copied from the input captions. The size is always set to 100% to allow the downstream player to choose the size. - Enter a list of font families, as a comma-separated list of font names, in order of preference. The name can be a font family (such as “Arial”), or a generic font family (such as “serif”), or “default” (to let the downstream player choose the font). - Leave blank to set the family to “monospace”.
+* `styleControl` – (Optional) Specifies the style information (font color, font position, and so on) to include in the font data that is attached to the EBU-TT captions. - include: Take the style information (font color, font position, and so on) from the source captions and include that information in the font data attached to the EBU-TT captions. This option is valid only if the source captions are Embedded or Teletext. - exclude: In the font data attached to the EBU-TT captions, set the font family to “monospaced”. Do not include any other style information.
+
+### TTML Destination Settings
+
+* `styleControl` – (Optional) This field is not currently supported and will not affect the output styling. Leave the default value.
+
+### WebVTT Destination Settings
+
+* `styleControl` - (Optional) Controls whether the color and position of the source captions is passed through to the WebVTT output captions. PASSTHROUGH - Valid only if the source captions are EMBEDDED or TELETEXT. NO\_STYLE\_DATA - Don’t pass through the style. The output captions will not contain any font styling information.
+
+### Font
+
+* `passwordParam` – (Optional) Key used to extract the password from EC2 Parameter store.
+* `uri` – (Required) Path to a file accessible to the live stream.
+* `username` – (Optional) Username to be used.
+
+### Global Configuration
+
+* `initialAudioGain` – (Optional) Value to set the initial audio gain for the Live Event.
+* `inputEndAction` – (Optional) Indicates the action to take when the current input completes (e.g. end-of-file). When switchAndLoopInputs is configured the encoder will restart at the beginning of the first input. When “none” is configured the encoder will transcode either black, a solid color, or a user specified slate images per the “Input Loss Behavior” configuration until the next input switch occurs (which is controlled through the Channel Schedule API).
+* `inputLossBehavior` - (Optional) Settings for system actions when input is lost. See [Input Loss Behavior](#input-loss-behavior) for more details.
+* `outputLockingMode` – (Optional) Indicates how MediaLive pipelines are synchronized. PIPELINE\_LOCKING - MediaLive will attempt to synchronize the output of each pipeline to the other. EPOCH\_LOCKING - MediaLive will attempt to synchronize the output of each pipeline to the Unix epoch.
+* `outputTimingSource` – (Optional) Indicates whether the rate of frames emitted by the Live encoder should be paced by its system clock (which optionally may be locked to another source via NTP) or should be locked to the clock of the source that is providing the input stream.
+* `supportLowFramerateInputs` – (Optional) Adjusts video input buffer for streams with very low video framerates. This is commonly set to enabled for music channels with less than one video frame per second.
+
+### Input Loss Behavior
+
+* `passwordParam` – (Optional) Key used to extract the password from EC2 Parameter store.
+* `uri` – (Required) Path to a file accessible to the live stream.
+* `username` – (Optional) Username to be used.
+
+### Motion Graphics Configuration
+
+* `motionGraphicsInsertion` – (Optional) Motion Graphics Insertion.
+* `motionGraphicsSettings`– (Required) Motion Graphics Settings. See [Motion Graphics Settings](#motion-graphics-settings) for more details.
+
+### Motion Graphics Settings
+
+* `htmlMotionGraphicsSettings` – (Optional) Html Motion Graphics Settings.
+
+### Nielsen Configuration
+
+* `distributorId` – (Optional) Enter the Distributor ID assigned to your organization by Nielsen.
+* `nielsenPcmToId3Tagging` – (Optional) Enables Nielsen PCM to ID3 tagging.
+
+### Avail Blanking
+
+* `availBlankingImage` - (Optional) Blanking image to be used. See [Avail Blanking Image](#avail-blanking-image) for more details.
+* `state` - (Optional) When set to enabled, causes video, audio and captions to be blanked when insertion metadata is added.
+
+### Avail Blanking Image
+
+* `uri` - (Required) Path to a file accessible to the live stream.
+* `passwordParam` - (Optional) Key used to extract the password from EC2 Parameter store.
+* `username` - (Optional). Username to be used.
+
+### Archive Group Settings
+
+* `destination` - (Required) A director and base filename where archive files should be written. See [Destination](#destination) for more details.
+* `archiveCdnSettings` - (Optional) Parameters that control the interactions with the CDN. See [Archive CDN Settings](#archive-cdn-settings) for more details.
+* `rolloverInterval` - (Optional) Number of seconds to write to archive file before closing and starting a new one.
+
+### Media Package Group Settings
+
+* `destination` - (Required) A director and base filename where archive files should be written. See [Destination](#destination) for more details.
+
+### RTMP Group Settings
+
+* `adMarkers` - (Optional) The ad marker type for this output group.
+* `authenticationScheme` - (Optional) Authentication scheme to use when connecting with CDN.
+* `cacheFullBehavior` - (Optional) Controls behavior when content cache fills up.
+* `cacheLength` - (Optional) Cache length in seconds, is used to calculate buffer size.
+* `captionData` - (Optional) Controls the types of data that passes to onCaptionInfo outputs.
+* `inputLossAction` - (Optional) Controls the behavior of the RTMP group if input becomes unavailable.
+* `restartDelay` - (Optional) Number of seconds to wait until a restart is initiated.
+
+### UDP Group Settings
+
+* `inputLossAction` - (Optional) Specifies behavior of last resort when input video os lost.
+* `timedMetadataId3Frame` - (Optional) Indicates ID3 frame that has the timecode.
+* `timedMetadtaId3Period`- (Optional) Timed metadata interval in seconds.
+
+### Destination
+
+* `destinationRefId` - (Required) Reference ID for the destination.
+
+### Archive CDN Settings
+
+* `archiveS3Settings` - (Optional) Archive S3 Settings. See [Archive S3 Settings](#archive-s3-settings) for more details.
+
+### Archive S3 Settings
+
+* `cannedAcl` - (Optional) Specify the canned ACL to apply to each S3 request.
+
+### Output Settings
+
+* `archiveOutputSettings` - (Optional) Archive output settings. See [Archive Output Settings](#archive-output-settings) for more details.
+* `mediaPackageOutputSettings` - (Optional) Media package output settings. This can be set as an empty block.
+* `multiplexOutputSettings` - (Optional) Multiplex output settings. See [Multiplex Output Settings](#multiplex-output-settings) for more details.
+* `rtmpOutputSettings` - (Optional) RTMP output settings. See [RTMP Output Settings](#rtmp-output-settings) for more details.
+* `udpOutputSettings` - (Optional) UDP output settings. See [UDP Output Settings](#udp-output-settings) for more details.
+
+### Archive Output Settings
+
+* `containerSettings` - (Required) Settings specific to the container type of the file. See [Container Settings](#container-settings) for more details.
+* `extension` - (Optional) Output file extension.
+* `nameModifier` - (Optional) String concatenated to the end of the destination filename. Required for multiple outputs of the same type.
+
+### Multiplex Output Settings
+
+* `destination` - (Required) Destination is a multiplex. See [Destination](#destination) for more details.
+
+### RTMP Output Settings
+
+- `destination` - (Required) The RTMP endpoint excluding the stream name. See [Destination](#destination) for more details.
+- `certificateMode` - (Optional) Setting to allow self signed or verified RTMP certificates.
+- `connectionRetryInterval` - (Optional) Number of seconds to wait before retrying connection to the flash media server if the connection is lost.
+- `numRetries` - (Optional) Number of retry attempts.
+
+### Container Settings
+
+* `m2TsSettings` - (Optional) M2TS Settings. See [M2TS Settings](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-medialive-channel-m2tssettings.html) for more details.
+* `rawSettings`- (Optional) Raw Settings. This can be set as an empty block.
+
+### UDP Output Settings
+
+* `containerSettings` - (Required) UDP container settings. See [Container Settings](#container-settings) for more details.
+* `destination` - (Required) Destination address and port number for RTP or UDP packets. See [Destination](#destination) for more details.
+* `bufferMsec` - (Optional) UDP output buffering in milliseconds.
+* `fecOutputSetting` - (Optional) Settings for enabling and adjusting Forward Error Correction on UDP outputs. See [FEC Output Settings](#fec-output-settings) for more details.
+
+### FEC Output Settings
+
+* `columnDepth` - (Optional) The height of the FEC protection matrix.
+* `includeFec` - (Optional) Enables column only or column and row based FEC.
+* `rowLength` - (Optional) The width of the FEC protection matrix.
+
+### VPC
+
+* `subnetIds` - (Required) A list of VPC subnet IDs from the same VPC. If STANDARD channel, subnet IDs must be mapped to two unique availability zones (AZ).
+* `publicAddressAllocationIds` - (Required) List of public address allocation ids to associate with ENIs that will be created in Output VPC. Must specify one for SINGLE_PIPELINE, two for STANDARD channels.
+* `securityGroupIds` - (Optional) A list of up to 5 EC2 VPC security group IDs to attach to the Output VPC network interfaces. If none are specified then the VPC default security group will be used.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Channel.
+* `channelId` - ID of the Channel.
+
+## Timeouts
+
+[Configuration options](https://www.terraform.io/docs/configuration/blocks/resources/syntax.html#operation-timeouts):
+
+* `create` - (Default `15M`)
+* `update` - (Default `15M`)
+* `delete` - (Default `15M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import MediaLive Channel using the `channelId`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import MediaLive Channel using the `channelId`. For example:
+
+```console
+% terraform import aws_medialive_channel.example 1234567
+```
+
+<!-- cache-key: cdktf-0.18.0 input-d3f7e093a01633975d88f239894e4bccf4a8cd3abaf84dcdf67f0af047ec3f42 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/medialive_input.html.markdown b/website/docs/cdktf/typescript/r/medialive_input.html.markdown
new file mode 100644
index 00000000000..bd43e52b171
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/medialive_input.html.markdown
@@ -0,0 +1,138 @@
+---
+subcategory: "Elemental MediaLive"
+layout: "aws"
+page_title: "AWS: aws_medialive_input"
+description: |-
+  Terraform resource for managing an AWS MediaLive Input.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_medialive_input
+
+Terraform resource for managing an AWS MediaLive Input.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { MedialiveInput } from "./.gen/providers/aws/medialive-input";
+import { MedialiveInputSecurityGroup } from "./.gen/providers/aws/medialive-input-security-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new MedialiveInputSecurityGroup(this, "example", {
+      tags: {
+        ENVIRONMENT: "prod",
+      },
+      whitelistRules: [
+        {
+          cidr: "10.0.0.8/32",
+        },
+      ],
+    });
+    const awsMedialiveInputExample = new MedialiveInput(this, "example_1", {
+      inputSecurityGroups: [example.id],
+      name: "example-input",
+      tags: {
+        ENVIRONMENT: "prod",
+      },
+      type: "UDP_PUSH",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsMedialiveInputExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) Name of the input.
+* `inputSecurityGroups` - (Required) List of input security groups.
+* `type` - (Required) The different types of inputs that AWS Elemental MediaLive supports.
+
+The following arguments are optional:
+
+* `destinations` - (Optional) Destination settings for PUSH type inputs. See [Destinations](#destinations) for more details.
+* `inputDevices` - (Optional) Settings for the devices. See [Input Devices](#input-devices) for more details.
+* `mediaConnectFlows` - (Optional) A list of the MediaConnect Flows. See [Media Connect Flows](#media-connect-flows) for more details.
+* `roleArn` - (Optional) The ARN of the role this input assumes during and after creation.
+* `sources` - (Optional) The source URLs for a PULL-type input. See [Sources](#sources) for more details.
+* `tags`- (Optional) A map of tags to assign to the Input. If configured with a provider [`defaultTags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `vpc` - (Optional) Settings for a private VPC Input. See [VPC](#vpc) for more details.
+
+### Destinations
+
+* `streamName` - A unique name for the location the RTMP stream is being pushed to.
+
+### Input Devices
+
+* `id` - The unique ID for the device.
+
+### Media Connect Flows
+
+* `flowArn` - The ARN of the MediaConnect Flow
+
+### Sources
+
+* `passwordParam` - The key used to extract the password from EC2 Parameter store.
+* `url` - The URL where the stream is pulled from.
+* `username` - The username for the input source.
+
+### VPC
+
+* `subnetIds` - A list of 2 VPC subnet IDs from the same VPC.
+* `securityGroupIds` - A list of up to 5 EC2 VPC security group IDs to attach to the Input.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Input.
+* `attachedChannels` - Channels attached to Input.
+* `inputClass` - The input class.
+* `inputPartnerIds` - A list of IDs for all Inputs which are partners of this one.
+* `inputSourceType` - Source type of the input.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `30M`)
+* `update` - (Default `30M`)
+* `delete` - (Default `30M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import MediaLive Input using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import MediaLive Input using the `id`. For example:
+
+```console
+% terraform import aws_medialive_input.example 12345678
+```
+
+<!-- cache-key: cdktf-0.18.0 input-e7c2ee81ba845515caa1acd230663186d94a15faebb59c803051c3bdd77ad5df -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/medialive_input_security_group.html.markdown b/website/docs/cdktf/typescript/r/medialive_input_security_group.html.markdown
new file mode 100644
index 00000000000..2f0cbccb9da
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/medialive_input_security_group.html.markdown
@@ -0,0 +1,98 @@
+---
+subcategory: "Elemental MediaLive"
+layout: "aws"
+page_title: "AWS: aws_medialive_input_security_group"
+description: |-
+  Terraform resource for managing an AWS MediaLive InputSecurityGroup.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_medialive_input_security_group
+
+Terraform resource for managing an AWS MediaLive InputSecurityGroup.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { MedialiveInputSecurityGroup } from "./.gen/providers/aws/medialive-input-security-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new MedialiveInputSecurityGroup(this, "example", {
+      tags: {
+        ENVIRONMENT: "prod",
+      },
+      whitelistRules: [
+        {
+          cidr: "10.0.0.8/32",
+        },
+      ],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `whitelistRules` - (Required) Whitelist rules. See [Whitelist Rules](#whitelist-rules) for more details.
+
+The following arguments are optional:
+
+* `tags` - (Optional) A map of tags to assign to the InputSecurityGroup. If configured with a provider [`defaultTags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Whitelist Rules
+
+* `cidr` (Required) - The IPv4 CIDR that's whitelisted.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - InputSecurityGroup Id.
+* `arn` - ARN of the InputSecurityGroup.
+* `inputs` - The list of inputs currently using this InputSecurityGroup.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `5M`)
+* `update` - (Default `5M`)
+* `delete` - (Default `5M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import MediaLive InputSecurityGroup using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import MediaLive InputSecurityGroup using the `id`. For example:
+
+```console
+% terraform import aws_medialive_input_security_group.example 123456
+```
+
+<!-- cache-key: cdktf-0.18.0 input-9f6c1160cb47fd911bf8108f99b94f58136c37097f8518ea694bbfb001e3a753 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/medialive_multiplex.html.markdown b/website/docs/cdktf/typescript/r/medialive_multiplex.html.markdown
new file mode 100644
index 00000000000..2caa700f81b
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/medialive_multiplex.html.markdown
@@ -0,0 +1,113 @@
+---
+subcategory: "Elemental MediaLive"
+layout: "aws"
+page_title: "AWS: aws_medialive_multiplex"
+description: |-
+  Terraform resource for managing an AWS MediaLive Multiplex.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_medialive_multiplex
+
+Terraform resource for managing an AWS MediaLive Multiplex.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsAvailabilityZones } from "./.gen/providers/aws/data-aws-availability-zones";
+import { MedialiveMultiplex } from "./.gen/providers/aws/medialive-multiplex";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const available = new DataAwsAvailabilityZones(this, "available", {
+      state: "available",
+    });
+    new MedialiveMultiplex(this, "example", {
+      availabilityZones: [
+        Token.asString(Fn.lookupNested(available.names, ["0"])),
+        Token.asString(Fn.lookupNested(available.names, ["1"])),
+      ],
+      multiplexSettings: {
+        maximumVideoBufferDelayMilliseconds: 1000,
+        transportStreamBitrate: 1000000,
+        transportStreamId: 1,
+        transportStreamReservedBitrate: 1,
+      },
+      name: "example-multiplex-changed",
+      startMultiplex: true,
+      tags: {
+        tag1: "value1",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `availabilityZones` - (Required) A list of availability zones. You must specify exactly two.
+* `multiplexSettings`- (Required) Multiplex settings. See [Multiplex Settings](#multiplex-settings) for more details.
+* `name` - (Required) name of Multiplex.
+
+The following arguments are optional:
+
+* `startMultiplex` - (Optional) Whether to start the Multiplex. Defaults to `false`.
+* `tags` - (Optional) A map of tags to assign to the Multiplex. If configured with a provider [`defaultTags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Multiplex Settings
+
+* `transportStreamBitrate` - (Required) Transport stream bit rate.
+* `transportStreamId` - (Required) Unique ID for each multiplex.
+* `transportStreamReservedBitrate` - (Optional) Transport stream reserved bit rate.
+* `maximumVideoBufferDelayMilliseconds` - (Optional) Maximum video buffer delay.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Multiplex.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `30M`)
+* `update` - (Default `30M`)
+* `delete` - (Default `30M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import MediaLive Multiplex using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import MediaLive Multiplex using the `id`. For example:
+
+```console
+% terraform import aws_medialive_multiplex.example 12345678
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ef0b0248360f7c92f3d75bdb422730873d3e865bff521828049e013dc339473a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/medialive_multiplex_program.html.markdown b/website/docs/cdktf/typescript/r/medialive_multiplex_program.html.markdown
new file mode 100644
index 00000000000..b61514cf33e
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/medialive_multiplex_program.html.markdown
@@ -0,0 +1,141 @@
+---
+subcategory: "Elemental MediaLive"
+layout: "aws"
+page_title: "AWS: aws_medialive_multiplex_program"
+description: |-
+  Terraform resource for managing an AWS MediaLive MultiplexProgram.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_medialive_multiplex_program
+
+Terraform resource for managing an AWS MediaLive MultiplexProgram.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsAvailabilityZones } from "./.gen/providers/aws/data-aws-availability-zones";
+import { MedialiveMultiplex } from "./.gen/providers/aws/medialive-multiplex";
+import { MedialiveMultiplexProgram } from "./.gen/providers/aws/medialive-multiplex-program";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const available = new DataAwsAvailabilityZones(this, "available", {
+      state: "available",
+    });
+    const example = new MedialiveMultiplex(this, "example", {
+      availabilityZones: [
+        Token.asString(Fn.lookupNested(available.names, ["0"])),
+        Token.asString(Fn.lookupNested(available.names, ["1"])),
+      ],
+      multiplexSettings: {
+        maximumVideoBufferDelayMilliseconds: 1000,
+        transportStreamBitrate: 1000000,
+        transportStreamId: 1,
+        transportStreamReservedBitrate: 1,
+      },
+      name: "example-multiplex-changed",
+      startMultiplex: true,
+      tags: {
+        tag1: "value1",
+      },
+    });
+    const awsMedialiveMultiplexProgramExample = new MedialiveMultiplexProgram(
+      this,
+      "example_2",
+      {
+        multiplexId: example.id,
+        multiplexProgramSettings: [
+          {
+            preferredChannelPipeline: "CURRENTLY_ACTIVE",
+            programNumber: 1,
+            videoSettings: [
+              {
+                constantBitrate: 100000,
+              },
+            ],
+          },
+        ],
+        programName: "example_program",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsMedialiveMultiplexProgramExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `multiplexId` - (Required) Multiplex ID.
+* `programName` - (Required) Unique program name.
+* `multiplexProgramSettings` - (Required) MultiplexProgram settings. See [Multiplex Program Settings](#multiple-program-settings) for more details.
+
+The following arguments are optional:
+
+### Multiple Program Settings
+
+* `programNumber` - (Required) Unique program number.
+* `preferredChannelPipeline` - (Required) Enum for preferred channel pipeline. Options are `currentlyActive`, `pipeline0`, or `pipeline1`.
+* `serviceDescriptor` - (Optional) Service Descriptor. See [Service Descriptor](#service-descriptor) for more details.
+* `videoSettings` - (Optional) Video settings. See [Video Settings](#video-settings) for more details.
+
+### Service Descriptor
+
+* `providerName` - (Required) Unique provider name.
+* `serviceName` - (Required) Unique service name.
+
+### Video Settings
+
+* `constantBitrate` - (Optional) Constant bitrate value.
+* `statmuxSettings` - (Optional) Statmux settings. See [Statmux Settings](#statmux-settings) for more details.
+
+### Statmux Settings
+
+* `minimumBitrate` - (Optional) Minimum bitrate.
+* `maximumBitrate` - (Optional) Maximum bitrate.
+* `priority` - (Optional) Priority value.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the MultiplexProgram.
+* `exampleAttribute` - Concise description.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import MediaLive MultiplexProgram using the `id`, or a combination of "`programName`/`multiplexId`". For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import MediaLive MultiplexProgram using the `id`, or a combination of "`programName`/`multiplexId`". For example:
+
+```console
+% terraform import aws_medialive_multiplex_program.example example_program/1234567
+```
+
+<!-- cache-key: cdktf-0.18.0 input-d0f4d6ecf5fbb8e34c4bfcc4ff4baddff29c0893a211fa29af99ff4cfade72b1 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/memorydb_acl.html.markdown b/website/docs/cdktf/typescript/r/memorydb_acl.html.markdown
new file mode 100644
index 00000000000..3235ba07716
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/memorydb_acl.html.markdown
@@ -0,0 +1,80 @@
+---
+subcategory: "MemoryDB for Redis"
+layout: "aws"
+page_title: "AWS: aws_memorydb_acl"
+description: |-
+  Provides a MemoryDB ACL.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_memorydb_acl
+
+Provides a MemoryDB ACL.
+
+More information about users and ACL-s can be found in the [MemoryDB User Guide](https://docs.aws.amazon.com/memorydb/latest/devguide/clusters.acls.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { MemorydbAcl } from "./.gen/providers/aws/memorydb-acl";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new MemorydbAcl(this, "example", {
+      name: "my-acl",
+      userNames: ["my-user-1", "my-user-2"],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are optional:
+
+* `name` - (Optional, Forces new resource) Name of the ACL. If omitted, Terraform will assign a random, unique name. Conflicts with `namePrefix`.
+* `namePrefix` - (Optional, Forces new resource) Creates a unique name beginning with the specified prefix. Conflicts with `name`.
+* `userNames` - (Optional) Set of MemoryDB user names to be included in this ACL.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Same as `name`.
+* `arn` - The ARN of the ACL.
+* `minimumEngineVersion` - The minimum engine version supported by the ACL.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import an ACL using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import an ACL using the `name`. For example:
+
+```console
+% terraform import aws_memorydb_acl.example my-acl
+```
+
+<!-- cache-key: cdktf-0.18.0 input-c0b11cab2ffda49ddaeadbf6cc9362150372c08b03e6b84d1bd545de5d3072f1 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/memorydb_cluster.html.markdown b/website/docs/cdktf/typescript/r/memorydb_cluster.html.markdown
new file mode 100644
index 00000000000..9085ecdf021
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/memorydb_cluster.html.markdown
@@ -0,0 +1,130 @@
+---
+subcategory: "MemoryDB for Redis"
+layout: "aws"
+page_title: "AWS: aws_memorydb_cluster"
+description: |-
+  Provides a MemoryDB Cluster.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_memorydb_cluster
+
+Provides a MemoryDB Cluster.
+
+More information about MemoryDB can be found in the [Developer Guide](https://docs.aws.amazon.com/memorydb/latest/devguide/what-is-memorydb-for-redis.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { MemorydbCluster } from "./.gen/providers/aws/memorydb-cluster";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new MemorydbCluster(this, "example", {
+      aclName: "open-access",
+      name: "my-cluster",
+      nodeType: "db.t4g.small",
+      numShards: 2,
+      securityGroupIds: [Token.asString(awsSecurityGroupExample.id)],
+      snapshotRetentionLimit: 7,
+      subnetGroupName: Token.asString(awsMemorydbSubnetGroupExample.id),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `aclName` - (Required) The name of the Access Control List to associate with the cluster.
+* `nodeType` - (Required) The compute and memory capacity of the nodes in the cluster. See AWS documentation on [supported node types](https://docs.aws.amazon.com/memorydb/latest/devguide/nodes.supportedtypes.html) as well as [vertical scaling](https://docs.aws.amazon.com/memorydb/latest/devguide/cluster-vertical-scaling.html).
+
+The following arguments are optional:
+
+* `autoMinorVersionUpgrade` - (Optional, Forces new resource) When set to `true`, the cluster will automatically receive minor engine version upgrades after launch. Defaults to `true`.
+* `dataTiering` - (Optional, Forces new resource) Enables data tiering. This option is not supported by all instance types. For more information, see [Data tiering](https://docs.aws.amazon.com/memorydb/latest/devguide/data-tiering.html).
+* `description` - (Optional) Description for the cluster. Defaults to `"Managed by Terraform"`.
+* `engineVersion` - (Optional) Version number of the Redis engine to be used for the cluster. Downgrades are not supported.
+* `finalSnapshotName` - (Optional) Name of the final cluster snapshot to be created when this resource is deleted. If omitted, no final snapshot will be made.
+* `kmsKeyArn` - (Optional, Forces new resource) ARN of the KMS key used to encrypt the cluster at rest.
+* `maintenanceWindow` - (Optional) Specifies the weekly time range during which maintenance on the cluster is performed. Specify as a range in the format `ddd:hh24:miDdd:hh24:mi` (24H Clock UTC). The minimum maintenance window is a 60 minute period. Example: `sun:23:00Mon:01:30`.
+* `name` - (Optional, Forces new resource) Name of the cluster. If omitted, Terraform will assign a random, unique name. Conflicts with `namePrefix`.
+* `namePrefix` - (Optional, Forces new resource) Creates a unique name beginning with the specified prefix. Conflicts with `name`.
+* `numReplicasPerShard` - (Optional) The number of replicas to apply to each shard, up to a maximum of 5. Defaults to `1` (i.e. 2 nodes per shard).
+* `numShards` - (Optional) The number of shards in the cluster. Defaults to `1`.
+* `parameterGroupName` - (Optional) The name of the parameter group associated with the cluster.
+* `port` - (Optional, Forces new resource) The port number on which each of the nodes accepts connections. Defaults to `6379`.
+* `securityGroupIds` - (Optional) Set of VPC Security Group ID-s to associate with this cluster.
+* `snapshotArns` - (Optional, Forces new resource) List of ARN-s that uniquely identify RDB snapshot files stored in S3. The snapshot files will be used to populate the new cluster. Object names in the ARN-s cannot contain any commas.
+* `snapshotName` - (Optional, Forces new resource) The name of a snapshot from which to restore data into the new cluster.
+* `snapshotRetentionLimit` - (Optional) The number of days for which MemoryDB retains automatic snapshots before deleting them. When set to `0`, automatic backups are disabled. Defaults to `0`.
+* `snapshotWindow` - (Optional) The daily time range (in UTC) during which MemoryDB begins taking a daily snapshot of your shard. Example: `05:0009:00`.
+* `snsTopicArn` - (Optional) ARN of the SNS topic to which cluster notifications are sent.
+* `subnetGroupName` - (Optional, Forces new resource) The name of the subnet group to be used for the cluster. Defaults to a subnet group consisting of default VPC subnets.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `tlsEnabled` - (Optional, Forces new resource) A flag to enable in-transit encryption on the cluster. When set to `false`, the `aclName` must be `openAccess`. Defaults to `true`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Same as `name`.
+* `arn` - The ARN of the cluster.
+* `clusterEndpoint`
+    * `address` - DNS hostname of the cluster configuration endpoint.
+    * `port` - Port number that the cluster configuration endpoint is listening on.
+* `enginePatchVersion` - Patch version number of the Redis engine used by the cluster.
+* `shards` - Set of shards in this cluster.
+    * `name` - Name of this shard.
+    * `numNodes` - Number of individual nodes in this shard.
+    * `slots` - Keyspace for this shard. Example: `016383`.
+    * `nodes` - Set of nodes in this shard.
+        * `availabilityZone` - The Availability Zone in which the node resides.
+        * `createTime` - The date and time when the node was created. Example: `20220101T21:00:00Z`.
+        * `name` - Name of this node.
+        * `endpoint`
+            * `address` - DNS hostname of the node.
+            * `port` - Port number that this node is listening on.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `120M`)
+- `update` - (Default `120M`)
+- `delete` - (Default `120M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import a cluster using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import a cluster using the `name`. For example:
+
+```console
+% terraform import aws_memorydb_cluster.example my-cluster
+```
+
+<!-- cache-key: cdktf-0.18.0 input-d6818a9008412346bdaa4fa4b26d098dea2f660a578683a93af8623986328ed6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/memorydb_parameter_group.html.markdown b/website/docs/cdktf/typescript/r/memorydb_parameter_group.html.markdown
new file mode 100644
index 00000000000..e8c927ccba4
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/memorydb_parameter_group.html.markdown
@@ -0,0 +1,95 @@
+---
+subcategory: "MemoryDB for Redis"
+layout: "aws"
+page_title: "AWS: aws_memorydb_parameter_group"
+description: |-
+  Provides a MemoryDB Parameter Group.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_memorydb_parameter_group
+
+Provides a MemoryDB Parameter Group.
+
+More information about parameter groups can be found in the [MemoryDB User Guide](https://docs.aws.amazon.com/memorydb/latest/devguide/parametergroups.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { MemorydbParameterGroup } from "./.gen/providers/aws/memorydb-parameter-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new MemorydbParameterGroup(this, "example", {
+      family: "memorydb_redis6",
+      name: "my-parameter-group",
+      parameter: [
+        {
+          name: "activedefrag",
+          value: "yes",
+        },
+      ],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `family` - (Required, Forces new resource) The engine version that the parameter group can be used with.
+
+The following arguments are optional:
+
+* `name` - (Optional, Forces new resource) Name of the parameter group. If omitted, Terraform will assign a random, unique name. Conflicts with `namePrefix`.
+* `namePrefix` - (Optional, Forces new resource) Creates a unique name beginning with the specified prefix. Conflicts with `name`.
+* `description` - (Optional, Forces new resource) Description for the parameter group. Defaults to `"Managed by Terraform"`.
+* `parameter` - (Optional) Set of MemoryDB parameters to apply. Any parameters not specified will fall back to their family defaults. Detailed below.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### parameter Configuration Block
+
+* `name` - (Required) The name of the parameter.
+* `value` - (Required) The value of the parameter.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Same as `name`.
+* `arn` - The ARN of the parameter group.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import a parameter group using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import a parameter group using the `name`. For example:
+
+```console
+% terraform import aws_memorydb_parameter_group.example my-parameter-group
+```
+
+<!-- cache-key: cdktf-0.18.0 input-8e9e3599e180f75dd2d3f6d66e99565f9996fadbf7ea8fdbbfa56522a00edac7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/memorydb_snapshot.html.markdown b/website/docs/cdktf/typescript/r/memorydb_snapshot.html.markdown
new file mode 100644
index 00000000000..3d7ab3a0c4b
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/memorydb_snapshot.html.markdown
@@ -0,0 +1,102 @@
+---
+subcategory: "MemoryDB for Redis"
+layout: "aws"
+page_title: "AWS: aws_memorydb_snapshot"
+description: |-
+  Provides a MemoryDB Snapshot.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_memorydb_snapshot
+
+Provides a MemoryDB Snapshot.
+
+More information about snapshot and restore can be found in the [MemoryDB User Guide](https://docs.aws.amazon.com/memorydb/latest/devguide/snapshots.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { MemorydbSnapshot } from "./.gen/providers/aws/memorydb-snapshot";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new MemorydbSnapshot(this, "example", {
+      clusterName: Token.asString(awsMemorydbClusterExample.name),
+      name: "my-snapshot",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `clusterName` - (Required, Forces new resource) Name of the MemoryDB cluster to take a snapshot of.
+* `name` - (Optional, Forces new resource) Name of the snapshot. If omitted, Terraform will assign a random, unique name. Conflicts with `namePrefix`.
+* `namePrefix` - (Optional, Forces new resource) Creates a unique name beginning with the specified prefix. Conflicts with `name`.
+* `kmsKeyArn` - (Optional, Forces new resource) ARN of the KMS key used to encrypt the snapshot at rest.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name of the snapshot.
+* `arn` - The ARN of the snapshot.
+* `clusterConfiguration` - The configuration of the cluster from which the snapshot was taken.
+    * `description` - Description for the cluster.
+    * `engineVersion` - Version number of the Redis engine used by the cluster.
+    * `maintenanceWindow` - The weekly time range during which maintenance on the cluster is performed.
+    * `name` - Name of the cluster.
+    * `nodeType` - Compute and memory capacity of the nodes in the cluster.
+    * `numShards` - Number of shards in the cluster.
+    * `parameterGroupName` - Name of the parameter group associated with the cluster.
+    * `port` - Port number on which the cluster accepts connections.
+    * `snapshotRetentionLimit` - Number of days for which MemoryDB retains automatic snapshots before deleting them.
+    * `snapshotWindow` - The daily time range (in UTC) during which MemoryDB begins taking a daily snapshot of the shard.
+    * `subnetGroupName` - Name of the subnet group used by the cluster.
+    * `topicArn` - ARN of the SNS topic to which cluster notifications are sent.
+    * `vpcId` - The VPC in which the cluster exists.
+* `source` - Indicates whether the snapshot is from an automatic backup (`automated`) or was created manually (`manual`).
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `120M`)
+- `delete` - (Default `120M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import a snapshot using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import a snapshot using the `name`. For example:
+
+```console
+% terraform import aws_memorydb_snapshot.example my-snapshot
+```
+
+<!-- cache-key: cdktf-0.18.0 input-540eb2f7a447881028486dd90d40cbfa1d108e80be222d8149c4c844371b23d5 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/memorydb_subnet_group.html.markdown b/website/docs/cdktf/typescript/r/memorydb_subnet_group.html.markdown
new file mode 100644
index 00000000000..6c190b2026a
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/memorydb_subnet_group.html.markdown
@@ -0,0 +1,102 @@
+---
+subcategory: "MemoryDB for Redis"
+layout: "aws"
+page_title: "AWS: aws_memorydb_subnet_group"
+description: |-
+  Provides a MemoryDB Subnet Group.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_memorydb_subnet_group
+
+Provides a MemoryDB Subnet Group.
+
+More information about subnet groups can be found in the [MemoryDB User Guide](https://docs.aws.amazon.com/memorydb/latest/devguide/subnetgroups.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { MemorydbSubnetGroup } from "./.gen/providers/aws/memorydb-subnet-group";
+import { Subnet } from "./.gen/providers/aws/subnet";
+import { Vpc } from "./.gen/providers/aws/vpc";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new Vpc(this, "example", {
+      cidrBlock: "10.0.0.0/16",
+    });
+    const awsSubnetExample = new Subnet(this, "example_1", {
+      availabilityZone: "us-west-2a",
+      cidrBlock: "10.0.0.0/24",
+      vpcId: example.id,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSubnetExample.overrideLogicalId("example");
+    const awsMemorydbSubnetGroupExample = new MemorydbSubnetGroup(
+      this,
+      "example_2",
+      {
+        name: "my-subnet-group",
+        subnetIds: [Token.asString(awsSubnetExample.id)],
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsMemorydbSubnetGroupExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `subnetIds` - (Required) Set of VPC Subnet ID-s for the subnet group. At least one subnet must be provided.
+
+The following arguments are optional:
+
+* `name` - (Optional, Forces new resource) Name of the subnet group. If omitted, Terraform will assign a random, unique name. Conflicts with `namePrefix`.
+* `namePrefix` - (Optional, Forces new resource) Creates a unique name beginning with the specified prefix. Conflicts with `name`.
+* `description` - (Optional) Description for the subnet group. Defaults to `"Managed by Terraform"`.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name of the subnet group.
+* `arn` - The ARN of the subnet group.
+* `vpcId` - The VPC in which the subnet group exists.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import a subnet group using its `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import a subnet group using its `name`. For example:
+
+```console
+% terraform import aws_memorydb_subnet_group.example my-subnet-group
+```
+
+<!-- cache-key: cdktf-0.18.0 input-d868401aa8e04d4973ff0ffe4eb6c8770dd89bad3180e6917e7e0015e53618af -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/memorydb_user.html.markdown b/website/docs/cdktf/typescript/r/memorydb_user.html.markdown
new file mode 100644
index 00000000000..7e402f72874
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/memorydb_user.html.markdown
@@ -0,0 +1,107 @@
+---
+subcategory: "MemoryDB for Redis"
+layout: "aws"
+page_title: "AWS: aws_memorydb_user"
+description: |-
+  Provides a MemoryDB User.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_memorydb_user
+
+Provides a MemoryDB User.
+
+More information about users and ACL-s can be found in the [MemoryDB User Guide](https://docs.aws.amazon.com/memorydb/latest/devguide/clusters.acls.html).
+
+~> **Note:** All arguments including the username and passwords will be stored in the raw state as plain-text.
+[Read more about sensitive data in state](https://www.terraform.io/docs/state/sensitive-data.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { MemorydbUser } from "./.gen/providers/aws/memorydb-user";
+import { Password } from "./.gen/providers/random/password";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    /*The following providers are missing schema information and might need manual adjustments to synthesize correctly: random.
+    For a more precise conversion please use the --provider flag in convert.*/
+    const example = new Password(this, "example", {
+      length: 16,
+    });
+    const awsMemorydbUserExample = new MemorydbUser(this, "example_1", {
+      accessString: "on ~* &* +@all",
+      authenticationMode: {
+        passwords: [Token.asString(example.result)],
+        type: "password",
+      },
+      userName: "my-user",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsMemorydbUserExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `accessString` - (Required) The access permissions string used for this user.
+* `authenticationMode` - (Required) Denotes the user's authentication properties. Detailed below.
+* `userName` - (Required, Forces new resource) Name of the MemoryDB user. Up to 40 characters.
+
+The following arguments are optional:
+
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### authentication_mode Configuration Block
+
+* `passwords` - (Required) The set of passwords used for authentication. You can create up to two passwords for each user.
+* `type` - (Required) Indicates whether the user requires a password to authenticate. Must be set to `password`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Same as `userName`.
+* `arn` - The ARN of the user.
+* `minimumEngineVersion` - The minimum engine version supported for the user.
+* `authenticationMode` configuration block
+    * `passwordCount` - The number of passwords belonging to the user.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import a user using the `userName`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import a user using the `userName`. For example:
+
+```console
+% terraform import aws_memorydb_user.example my-user
+```
+
+The `passwords` are not available for imported resources, as this information cannot be read back from the MemoryDB API.
+
+<!-- cache-key: cdktf-0.18.0 input-f5d027129bff54db7aaaaecf18b5e8da10653dddeb0e00e2f474bf78aa1508d7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/mq_broker.html.markdown b/website/docs/cdktf/typescript/r/mq_broker.html.markdown
new file mode 100644
index 00000000000..c50f92b1265
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/mq_broker.html.markdown
@@ -0,0 +1,232 @@
+---
+subcategory: "MQ"
+layout: "aws"
+page_title: "AWS: aws_mq_broker"
+description: |-
+  Provides an MQ Broker Resource
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_mq_broker
+
+Provides an Amazon MQ broker resource. This resources also manages users for the broker.
+
+-> For more information on Amazon MQ, see [Amazon MQ documentation](https://docs.aws.amazon.com/amazon-mq/latest/developer-guide/welcome.html).
+
+~> **NOTE:** Amazon MQ currently places limits on **RabbitMQ** brokers. For example, a RabbitMQ broker cannot have: instances with an associated IP address of an ENI attached to the broker, an associated LDAP server to authenticate and authorize broker connections, storage type `efs`, or audit logging. Although this resource allows you to create RabbitMQ users, RabbitMQ users cannot have console access or groups. Also, Amazon MQ does not return information about RabbitMQ users so drift detection is not possible.
+
+~> **NOTE:** Changes to an MQ Broker can occur when you change a parameter, such as `configuration` or `user`, and are reflected in the next maintenance window. Because of this, Terraform may report a difference in its planning phase because a modification has not yet taken place. You can use the `applyImmediately` flag to instruct the service to apply the change immediately (see documentation below). Using `applyImmediately` can result in a brief downtime as the broker reboots.
+
+~> **NOTE:** All arguments including the username and password will be stored in the raw state as plain-text. [Read more about sensitive data in state](https://www.terraform.io/docs/state/sensitive-data.html).
+
+## Example Usage
+
+### Basic Example
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { MqBroker } from "./.gen/providers/aws/mq-broker";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new MqBroker(this, "example", {
+      brokerName: "example",
+      configuration: {
+        id: test.id,
+        revision: test.latestRevision,
+      },
+      engineType: "ActiveMQ",
+      engineVersion: "5.15.9",
+      hostInstanceType: "mq.t2.micro",
+      securityGroups: [Token.asString(awsSecurityGroupTest.id)],
+      user: [
+        {
+          password: "MindTheGap",
+          username: "ExampleUser",
+        },
+      ],
+    });
+  }
+}
+
+```
+
+### High-throughput Optimized Example
+
+This example shows the use of EBS storage for high-throughput optimized performance.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { MqBroker } from "./.gen/providers/aws/mq-broker";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new MqBroker(this, "example", {
+      brokerName: "example",
+      configuration: {
+        id: test.id,
+        revision: test.latestRevision,
+      },
+      engineType: "ActiveMQ",
+      engineVersion: "5.15.9",
+      hostInstanceType: "mq.m5.large",
+      securityGroups: [Token.asString(awsSecurityGroupTest.id)],
+      storageType: "ebs",
+      user: [
+        {
+          password: "MindTheGap",
+          username: "ExampleUser",
+        },
+      ],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `brokerName` - (Required) Name of the broker.
+* `engineType` - (Required) Type of broker engine. Valid values are `activeMq` and `rabbitMq`.
+* `engineVersion` - (Required) Version of the broker engine. See the [AmazonMQ Broker Engine docs](https://docs.aws.amazon.com/amazon-mq/latest/developer-guide/broker-engine.html) for supported versions. For example, `5150`.
+* `hostInstanceType` - (Required) Broker's instance type. For example, `mqT3Micro`, `mqM5Large`.
+* `user` - (Required) Configuration block for broker users. For `engineType` of `rabbitMq`, Amazon MQ does not return broker users preventing this resource from making user updates and drift detection. Detailed below.
+
+The following arguments are optional:
+
+* `applyImmediately` - (Optional) Specifies whether any broker modifications are applied immediately, or during the next maintenance window. Default is `false`.
+* `authenticationStrategy` - (Optional) Authentication strategy used to secure the broker. Valid values are `simple` and `ldap`. `ldap` is not supported for `engineType` `rabbitMq`.
+* `autoMinorVersionUpgrade` - (Optional) Whether to automatically upgrade to new minor versions of brokers as Amazon MQ makes releases available.
+* `configuration` - (Optional) Configuration block for broker configuration. Applies to `engineType` of `activeMq` and `rabbitMq` only. Detailed below.
+* `deploymentMode` - (Optional) Deployment mode of the broker. Valid values are `singleInstance`, `activeStandbyMultiAz`, and `clusterMultiAz`. Default is `singleInstance`.
+* `encryptionOptions` - (Optional) Configuration block containing encryption options. Detailed below.
+* `ldapServerMetadata` - (Optional) Configuration block for the LDAP server used to authenticate and authorize connections to the broker. Not supported for `engineType` `rabbitMq`. Detailed below. (Currently, AWS may not process changes to LDAP server metadata.)
+* `logs` - (Optional) Configuration block for the logging configuration of the broker. Detailed below.
+* `maintenanceWindowStartTime` - (Optional) Configuration block for the maintenance window start time. Detailed below.
+* `publiclyAccessible` - (Optional) Whether to enable connections from applications outside of the VPC that hosts the broker's subnets.
+* `securityGroups` - (Optional) List of security group IDs assigned to the broker.
+* `storageType` - (Optional) Storage type of the broker. For `engineType` `activeMq`, the valid values are `efs` and `ebs`, and the AWS-default is `efs`. For `engineType` `rabbitMq`, only `ebs` is supported. When using `ebs`, only the `mqM5` broker instance type family is supported.
+* `subnetIds` - (Optional) List of subnet IDs in which to launch the broker. A `singleInstance` deployment requires one subnet. An `activeStandbyMultiAz` deployment requires multiple subnets.
+* `tags` - (Optional) Map of tags to assign to the broker. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### configuration
+
+The following arguments are optional:
+
+* `id` - (Optional) The Configuration ID.
+* `revision` - (Optional) Revision of the Configuration.
+
+### encryption_options
+
+The following arguments are optional:
+
+* `kmsKeyId` - (Optional) Amazon Resource Name (ARN) of Key Management Service (KMS) Customer Master Key (CMK) to use for encryption at rest. Requires setting `useAwsOwnedKey` to `false`. To perform drift detection when AWS-managed CMKs or customer-managed CMKs are in use, this value must be configured.
+* `useAwsOwnedKey` - (Optional) Whether to enable an AWS-owned KMS CMK that is not in your account. Defaults to `true`. Setting to `false` without configuring `kmsKeyId` will create an AWS-managed CMK aliased to `aws/mq` in your account.
+
+### ldap_server_metadata
+
+The following arguments are optional:
+
+* `hosts` - (Optional) List of a fully qualified domain name of the LDAP server and an optional failover server.
+* `roleBase` - (Optional) Fully qualified name of the directory to search for a user’s groups.
+* `roleName` - (Optional) Specifies the LDAP attribute that identifies the group name attribute in the object returned from the group membership query.
+* `roleSearchMatching` - (Optional) Search criteria for groups.
+* `roleSearchSubtree` - (Optional) Whether the directory search scope is the entire sub-tree.
+* `serviceAccountPassword` - (Optional) Service account password.
+* `serviceAccountUsername` - (Optional) Service account username.
+* `userBase` - (Optional) Fully qualified name of the directory where you want to search for users.
+* `userRoleName` - (Optional) Specifies the name of the LDAP attribute for the user group membership.
+* `userSearchMatching` - (Optional) Search criteria for users.
+* `userSearchSubtree` - (Optional) Whether the directory search scope is the entire sub-tree.
+
+### logs
+
+The following arguments are optional:
+
+* `audit` - (Optional) Enables audit logging. Auditing is only possible for `engineType` of `activeMq`. User management action made using JMX or the ActiveMQ Web Console is logged. Defaults to `false`.
+* `general` - (Optional) Enables general logging via CloudWatch. Defaults to `false`.
+
+### maintenance_window_start_time
+
+The following arguments are required:
+
+* `dayOfWeek` - (Required) Day of the week, e.g., `monday`, `tuesday`, or `wednesday`.
+* `timeOfDay` - (Required) Time, in 24-hour format, e.g., `02:00`.
+* `timeZone` - (Required) Time zone in either the Country/City format or the UTC offset format, e.g., `cet`.
+
+### user
+
+* `consoleAccess` - (Optional) Whether to enable access to the [ActiveMQ Web Console](http://activemq.apache.org/web-console.html) for the user. Applies to `engineType` of `activeMq` only.
+* `groups` - (Optional) List of groups (20 maximum) to which the ActiveMQ user belongs. Applies to `engineType` of `activeMq` only.
+* `password` - (Required) Password of the user. It must be 12 to 250 characters long, at least 4 unique characters, and must not contain commas.
+* `replicationUser` - (Optional) Whether to set set replication user. Defaults to `false`.
+* `username` - (Required) Username of the user.
+
+~> **NOTE:** AWS currently does not support updating RabbitMQ users. Updates to users can only be in the RabbitMQ UI.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the broker.
+* `id` - Unique ID that Amazon MQ generates for the broker.
+* `instances` - List of information about allocated brokers (both active & standby).
+    * `instances0ConsoleUrl` - The URL of the [ActiveMQ Web Console](http://activemq.apache.org/web-console.html) or the [RabbitMQ Management UI](https://www.rabbitmq.com/management.html#external-monitoring) depending on `engineType`.
+    * `instances0IpAddress` - IP Address of the broker.
+    * `instances0Endpoints` - Broker's wire-level protocol endpoints in the following order & format referenceable e.g., as `instances0Endpoints0` (SSL):
+        * For `activeMq`:
+            * `ssl://brokerIdMqUsWest2AmazonawsCom:61617`
+            * `amqp+ssl://brokerIdMqUsWest2AmazonawsCom:5671`
+            * `stomp+ssl://brokerIdMqUsWest2AmazonawsCom:61614`
+            * `mqtt+ssl://brokerIdMqUsWest2AmazonawsCom:8883`
+            * `wss://brokerIdMqUsWest2AmazonawsCom:61619`
+        * For `rabbitMq`:
+            * `amqps://brokerIdMqUsWest2AmazonawsCom:5671`
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `30M`)
+* `update` - (Default `30M`)
+* `delete` - (Default `30M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import MQ Brokers using their broker id. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import MQ Brokers using their broker id. For example:
+
+```console
+% terraform import aws_mq_broker.example a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
+```
+
+<!-- cache-key: cdktf-0.18.0 input-e4ac8cdba2a86a52d15d44c9fa76955d14e86f7fe0c194e7077682ba082c4e20 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/mq_configuration.html.markdown b/website/docs/cdktf/typescript/r/mq_configuration.html.markdown
new file mode 100644
index 00000000000..113a8164512
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/mq_configuration.html.markdown
@@ -0,0 +1,117 @@
+---
+subcategory: "MQ"
+layout: "aws"
+page_title: "AWS: aws_mq_configuration"
+description: |-
+  Provides an MQ configuration Resource
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_mq_configuration
+
+Provides an MQ Configuration Resource.
+
+For more information on Amazon MQ, see [Amazon MQ documentation](https://docs.aws.amazon.com/amazon-mq/latest/developer-guide/welcome.html).
+
+## Example Usage
+
+### ActiveMQ
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { MqConfiguration } from "./.gen/providers/aws/mq-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new MqConfiguration(this, "example", {
+      data: '<?xml version="1.0" encoding="UTF-8" standalone="yes"?>\n<broker xmlns="http://activemq.apache.org/schema/core">\n  <plugins>\n    <forcePersistencyModeBrokerPlugin persistenceFlag="true"/>\n    <statisticsBrokerPlugin/>\n    <timeStampingBrokerPlugin ttlCeiling="86400000" zeroExpirationOverride="86400000"/>\n  </plugins>\n</broker>\n\n',
+      description: "Example Configuration",
+      engineType: "ActiveMQ",
+      engineVersion: "5.15.0",
+      name: "example",
+    });
+  }
+}
+
+```
+
+### RabbitMQ
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { MqConfiguration } from "./.gen/providers/aws/mq-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new MqConfiguration(this, "example", {
+      data: "# Default RabbitMQ delivery acknowledgement timeout is 30 minutes in milliseconds\nconsumer_timeout = 1800000\n\n",
+      description: "Example Configuration",
+      engineType: "RabbitMQ",
+      engineVersion: "3.11.16",
+      name: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `data` - (Required) Broker configuration in XML format for `activeMq` or [Cuttlefish](https://github.com/Kyorai/cuttlefish) format for `rabbitMq`. See [official docs](https://docs.aws.amazon.com/amazon-mq/latest/developer-guide/amazon-mq-broker-configuration-parameters.html) for supported parameters and format of the XML.
+* `engineType` - (Required) Type of broker engine. Valid values are `activeMq` and `rabbitMq`.
+* `engineVersion` - (Required) Version of the broker engine.
+* `name` - (Required) Name of the configuration.
+
+The following arguments are optional:
+
+* `authenticationStrategy` - (Optional) Authentication strategy associated with the configuration. Valid values are `simple` and `ldap`. `ldap` is not supported for `engineType` `rabbitMq`.
+* `description` - (Optional) Description of the configuration.
+* `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the configuration.
+* `id` - Unique ID that Amazon MQ generates for the configuration.
+* `latestRevision` - Latest revision of the configuration.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import MQ Configurations using the configuration ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import MQ Configurations using the configuration ID. For example:
+
+```console
+% terraform import aws_mq_configuration.example c-0187d1eb-88c8-475a-9b79-16ef5a10c94f
+```
+
+<!-- cache-key: cdktf-0.18.0 input-04eb0aa6dff9d0a504fd0ee6b546bf9faa3350cf68b6f6ead258a17890bff141 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/msk_cluster.html.markdown b/website/docs/cdktf/typescript/r/msk_cluster.html.markdown
new file mode 100644
index 00000000000..cb14eebd1be
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/msk_cluster.html.markdown
@@ -0,0 +1,394 @@
+---
+subcategory: "Managed Streaming for Kafka"
+layout: "aws"
+page_title: "AWS: aws_msk_cluster"
+description: |-
+  Terraform resource for managing an AWS Managed Streaming for Kafka cluster.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_msk_cluster
+
+Manages an Amazon MSK cluster.
+
+-> **Note:** This resource manages _provisioned_ clusters. To manage a _serverless_ Amazon MSK cluster, use the [`awsMskServerlessCluster`](/docs/providers/aws/r/msk_serverless_cluster.html) resource.
+
+## Example Usage
+
+### Basic
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, Fn, TerraformOutput, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudwatchLogGroup } from "./.gen/providers/aws/cloudwatch-log-group";
+import { DataAwsAvailabilityZones } from "./.gen/providers/aws/data-aws-availability-zones";
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+import { KinesisFirehoseDeliveryStream } from "./.gen/providers/aws/kinesis-firehose-delivery-stream";
+import { KmsKey } from "./.gen/providers/aws/kms-key";
+import { MskCluster } from "./.gen/providers/aws/msk-cluster";
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketAcl } from "./.gen/providers/aws/s3-bucket-acl";
+import { SecurityGroup } from "./.gen/providers/aws/security-group";
+import { Subnet } from "./.gen/providers/aws/subnet";
+import { Vpc } from "./.gen/providers/aws/vpc";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const test = new CloudwatchLogGroup(this, "test", {
+      name: "msk_broker_logs",
+    });
+    const kms = new KmsKey(this, "kms", {
+      description: "example",
+    });
+    const bucket = new S3Bucket(this, "bucket", {
+      bucket: "msk-broker-logs-bucket",
+    });
+    new S3BucketAcl(this, "bucket_acl", {
+      acl: "private",
+      bucket: bucket.id,
+    });
+    const vpc = new Vpc(this, "vpc", {
+      cidrBlock: "192.168.0.0/22",
+    });
+    const azs = new DataAwsAvailabilityZones(this, "azs", {
+      state: "available",
+    });
+    const assumeRole = new DataAwsIamPolicyDocument(this, "assume_role", {
+      statement: [
+        {
+          actions: ["sts:AssumeRole"],
+          effect: "Allow",
+          principals: [
+            {
+              identifiers: ["firehose.amazonaws.com"],
+              type: "Service",
+            },
+          ],
+        },
+      ],
+    });
+    const firehoseRole = new IamRole(this, "firehose_role", {
+      assumeRolePolicy: Token.asString(assumeRole.json),
+      name: "firehose_test_role",
+    });
+    const testStream = new KinesisFirehoseDeliveryStream(this, "test_stream", {
+      destination: "extended_s3",
+      extendedS3Configuration: {
+        bucketArn: bucket.arn,
+        roleArn: firehoseRole.arn,
+      },
+      lifecycle: {
+        ignoreChanges: ["logDeliveryEnabled"],
+      },
+      name: "terraform-kinesis-firehose-msk-broker-logs-stream",
+      tags: {
+        LogDeliveryEnabled: "placeholder",
+      },
+    });
+    const sg = new SecurityGroup(this, "sg", {
+      vpcId: vpc.id,
+    });
+    const subnetAz1 = new Subnet(this, "subnet_az1", {
+      availabilityZone: Token.asString(Fn.lookupNested(azs.names, ["0"])),
+      cidrBlock: "192.168.0.0/24",
+      vpcId: vpc.id,
+    });
+    const subnetAz2 = new Subnet(this, "subnet_az2", {
+      availabilityZone: Token.asString(Fn.lookupNested(azs.names, ["1"])),
+      cidrBlock: "192.168.1.0/24",
+      vpcId: vpc.id,
+    });
+    const subnetAz3 = new Subnet(this, "subnet_az3", {
+      availabilityZone: Token.asString(Fn.lookupNested(azs.names, ["2"])),
+      cidrBlock: "192.168.2.0/24",
+      vpcId: vpc.id,
+    });
+    const example = new MskCluster(this, "example", {
+      brokerNodeGroupInfo: {
+        clientSubnets: [subnetAz1.id, subnetAz2.id, subnetAz3.id],
+        instanceType: "kafka.m5.large",
+        securityGroups: [sg.id],
+        storageInfo: {
+          ebsStorageInfo: {
+            volumeSize: 1000,
+          },
+        },
+      },
+      clusterName: "example",
+      encryptionInfo: {
+        encryptionAtRestKmsKeyArn: kms.arn,
+      },
+      kafkaVersion: "3.2.0",
+      loggingInfo: {
+        brokerLogs: {
+          cloudwatchLogs: {
+            enabled: true,
+            logGroup: test.name,
+          },
+          firehose: {
+            deliveryStream: testStream.name,
+            enabled: true,
+          },
+          s3: {
+            bucket: bucket.id,
+            enabled: true,
+            prefix: "logs/msk-",
+          },
+        },
+      },
+      numberOfBrokerNodes: 3,
+      openMonitoring: {
+        prometheus: {
+          jmxExporter: {
+            enabledInBroker: true,
+          },
+          nodeExporter: {
+            enabledInBroker: true,
+          },
+        },
+      },
+      tags: {
+        foo: "bar",
+      },
+    });
+    new TerraformOutput(this, "bootstrap_brokers_tls", {
+      value: example.bootstrapBrokersTls,
+      description: "TLS connection host:port pairs",
+    });
+    new TerraformOutput(this, "zookeeper_connect_string", {
+      value: example.zookeeperConnectString,
+    });
+  }
+}
+
+```
+
+### With volume_throughput argument
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { MskCluster } from "./.gen/providers/aws/msk-cluster";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new MskCluster(this, "example", {
+      brokerNodeGroupInfo: {
+        clientSubnets: [subnetAz1.id, subnetAz2.id, subnetAz3.id],
+        instanceType: "kafka.m5.4xlarge",
+        securityGroups: [sg.id],
+        storageInfo: {
+          ebsStorageInfo: {
+            provisionedThroughput: {
+              enabled: true,
+              volumeThroughput: 250,
+            },
+            volumeSize: 1000,
+          },
+        },
+      },
+      clusterName: "example",
+      kafkaVersion: "2.7.1",
+      numberOfBrokerNodes: 3,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `brokerNodeGroupInfo` - (Required) Configuration block for the broker nodes of the Kafka cluster.
+* `clusterName` - (Required) Name of the MSK cluster.
+* `kafkaVersion` - (Required) Specify the desired Kafka software version.
+* `numberOfBrokerNodes` - (Required) The desired total number of broker nodes in the kafka cluster.  It must be a multiple of the number of specified client subnets.
+* `clientAuthentication` - (Optional) Configuration block for specifying a client authentication. See below.
+* `configurationInfo` - (Optional) Configuration block for specifying a MSK Configuration to attach to Kafka brokers. See below.
+* `encryptionInfo` - (Optional) Configuration block for specifying encryption. See below.
+* `enhancedMonitoring` - (Optional) Specify the desired enhanced MSK CloudWatch monitoring level. See [Monitoring Amazon MSK with Amazon CloudWatch](https://docs.aws.amazon.com/msk/latest/developerguide/monitoring.html)
+* `openMonitoring` - (Optional) Configuration block for JMX and Node monitoring for the MSK cluster. See below.
+* `loggingInfo` - (Optional) Configuration block for streaming broker logs to Cloudwatch/S3/Kinesis Firehose. See below.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### broker_node_group_info Argument Reference
+
+* `clientSubnets` - (Required) A list of subnets to connect to in client VPC ([documentation](https://docs.aws.amazon.com/msk/1.0/apireference/clusters.html#clusters-prop-brokernodegroupinfo-clientsubnets)).
+* `instanceType` - (Required) Specify the instance type to use for the kafka brokersE.g., kafka.m5.large. ([Pricing info](https://aws.amazon.com/msk/pricing/))
+* `securityGroups` - (Required) A list of the security groups to associate with the elastic network interfaces to control who can communicate with the cluster.
+* `azDistribution` - (Optional) The distribution of broker nodes across availability zones ([documentation](https://docs.aws.amazon.com/msk/1.0/apireference/clusters.html#clusters-model-brokerazdistribution)). Currently the only valid value is `default`.
+* `connectivityInfo` - (Optional) Information about the cluster access configuration. See below. For security reasons, you can't turn on public access while creating an MSK cluster. However, you can update an existing cluster to make it publicly accessible. You can also create a new cluster and then update it to make it publicly accessible ([documentation](https://docs.aws.amazon.com/msk/latest/developerguide/public-access.html)).
+* `storageInfo` - (Optional) A block that contains information about storage volumes attached to MSK broker nodes. See below.
+
+### broker_node_group_info connectivity_info Argument Reference
+
+* `publicAccess` - (Optional) Access control settings for brokers. See below.
+* `vpcConnectivity` - (Optional) VPC connectivity access control for brokers. See below.
+
+### connectivity_info public_access Argument Reference
+
+* `type` - (Optional) Public access type. Valid values: `disabled`, `serviceProvidedEips`.
+
+### connectivity_info vpc_connectivity Argument Reference
+
+* `clientAuthentication` - (Optional) Includes all client authentication information for VPC connectivity. See below.
+
+### vpc_connectivity client_authentication Argument Reference
+
+* `sasl` - (Optional) SASL authentication type details for VPC connectivity. See below.
+* `tls` - (Optional) Enables TLS authentication for VPC connectivity.
+
+### vpc_connectivity client_authentication sasl Argument Reference
+
+* `iam` - (Optional) Enables SASL/IAM authentication for VPC connectivity.
+* `scram` - (Optional) Enables SASL/SCRAM authentication for VPC connectivity.
+
+### broker_node_group_info storage_info Argument Reference
+
+* `ebsStorageInfo` - (Optional) A block that contains EBS volume information. See below.
+
+### storage_info ebs_storage_info Argument Reference
+
+* `provisionedThroughput` - (Optional) A block that contains EBS volume provisioned throughput information. To provision storage throughput, you must choose broker type kafka.m5.4xlarge or larger. See below.
+* `volumeSize` - (Optional) The size in GiB of the EBS volume for the data drive on each broker node. Minimum value of `1` and maximum value of `16384`.
+
+### ebs_storage_info provisioned_throughput Argument Reference
+
+* `enabled` - (Optional) Controls whether provisioned throughput is enabled or not. Default value: `false`.
+* `volumeThroughput` - (Optional) Throughput value of the EBS volumes for the data drive on each kafka broker node in MiB per second. The minimum value is `250`. The maximum value varies between broker type. You can refer to the valid values for the maximum volume throughput at the following [documentation on throughput bottlenecks](https://docs.aws.amazon.com/msk/latest/developerguide/msk-provision-throughput.html#throughput-bottlenecks)
+
+### client_authentication Argument Reference
+
+* `sasl` - (Optional) Configuration block for specifying SASL client authentication. See below.
+* `tls` - (Optional) Configuration block for specifying TLS client authentication. See below.
+* `unauthenticated` - (Optional) Enables unauthenticated access.
+
+#### client_authentication sasl Argument Reference
+
+* `iam` - (Optional) Enables IAM client authentication. Defaults to `false`.
+* `scram` - (Optional) Enables SCRAM client authentication via AWS Secrets Manager. Defaults to `false`.
+
+#### client_authentication tls Argument Reference
+
+* `certificateAuthorityArns` - (Optional) List of ACM Certificate Authority Amazon Resource Names (ARNs).
+
+### configuration_info Argument Reference
+
+* `arn` - (Required) Amazon Resource Name (ARN) of the MSK Configuration to use in the cluster.
+* `revision` - (Required) Revision of the MSK Configuration to use in the cluster.
+
+### encryption_info Argument Reference
+
+* `encryptionInTransit` - (Optional) Configuration block to specify encryption in transit. See below.
+* `encryptionAtRestKmsKeyArn` - (Optional) You may specify a KMS key short ID or ARN (it will always output an ARN) to use for encrypting your data at rest.  If no key is specified, an AWS managed KMS ('aws/msk' managed service) key will be used for encrypting the data at rest.
+
+#### encryption_info encryption_in_transit Argument Reference
+
+* `clientBroker` - (Optional) Encryption setting for data in transit between clients and brokers. Valid values: `tls`, `tlsPlaintext`, and `plaintext`. Default value is `tls`.
+* `inCluster` - (Optional) Whether data communication among broker nodes is encrypted. Default value: `true`.
+
+#### open_monitoring Argument Reference
+
+* `prometheus` - (Required) Configuration block for Prometheus settings for open monitoring. See below.
+
+#### open_monitoring prometheus Argument Reference
+
+* `jmxExporter` - (Optional) Configuration block for JMX Exporter. See below.
+* `nodeExporter` - (Optional) Configuration block for Node Exporter. See below.
+
+#### open_monitoring prometheus jmx_exporter Argument Reference
+
+* `enabledInBroker` - (Required) Indicates whether you want to enable or disable the JMX Exporter.
+
+#### open_monitoring prometheus node_exporter Argument Reference
+
+* `enabledInBroker` - (Required) Indicates whether you want to enable or disable the Node Exporter.
+
+#### logging_info Argument Reference
+
+* `brokerLogs` - (Required) Configuration block for Broker Logs settings for logging info. See below.
+
+#### logging_info broker_logs cloudwatch_logs Argument Reference
+
+* `enabled` - (Optional) Indicates whether you want to enable or disable streaming broker logs to Cloudwatch Logs.
+* `logGroup` - (Optional) Name of the Cloudwatch Log Group to deliver logs to.
+
+#### logging_info broker_logs firehose Argument Reference
+
+* `enabled` - (Optional) Indicates whether you want to enable or disable streaming broker logs to Kinesis Data Firehose.
+* `deliveryStream` - (Optional) Name of the Kinesis Data Firehose delivery stream to deliver logs to.
+
+#### logging_info broker_logs s3 Argument Reference
+
+* `enabled` - (Optional) Indicates whether you want to enable or disable streaming broker logs to S3.
+* `bucket` - (Optional) Name of the S3 bucket to deliver logs to.
+* `prefix` - (Optional) Prefix to append to the folder name.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the MSK cluster.
+* `bootstrapBrokers` - Comma separated list of one or more hostname:port pairs of kafka brokers suitable to bootstrap connectivity to the kafka cluster. Contains a value if `encryptionInfo0EncryptionInTransit0ClientBroker` is set to `plaintext` or `tlsPlaintext`. The resource sorts values alphabetically. AWS may not always return all endpoints so this value is not guaranteed to be stable across applies.
+* `bootstrapBrokersPublicSaslIam` - One or more DNS names (or IP addresses) and SASL IAM port pairs. For example, `b1PublicExampleClusterNameAbcdeC2KafkaUsEast1AmazonawsCom:9198,b2PublicExampleClusterNameAbcdeC2KafkaUsEast1AmazonawsCom:9198,b3PublicExampleClusterNameAbcdeC2KafkaUsEast1AmazonawsCom:9198`. This attribute will have a value if `encryptionInfo0EncryptionInTransit0ClientBroker` is set to `tlsPlaintext` or `tls` and `clientAuthentication0Sasl0Iam` is set to `true` and `brokerNodeGroupInfo0ConnectivityInfo0PublicAccess0Type` is set to `serviceProvidedEips` and the cluster fulfill all other requirements for public access. The resource sorts the list alphabetically. AWS may not always return all endpoints so the values may not be stable across applies.
+* `bootstrapBrokersPublicSaslScram` - One or more DNS names (or IP addresses) and SASL SCRAM port pairs. For example, `b1PublicExampleClusterNameAbcdeC2KafkaUsEast1AmazonawsCom:9196,b2PublicExampleClusterNameAbcdeC2KafkaUsEast1AmazonawsCom:9196,b3PublicExampleClusterNameAbcdeC2KafkaUsEast1AmazonawsCom:9196`. This attribute will have a value if `encryptionInfo0EncryptionInTransit0ClientBroker` is set to `tlsPlaintext` or `tls` and `clientAuthentication0Sasl0Scram` is set to `true` and `brokerNodeGroupInfo0ConnectivityInfo0PublicAccess0Type` is set to `serviceProvidedEips` and the cluster fulfill all other requirements for public access. The resource sorts the list alphabetically. AWS may not always return all endpoints so the values may not be stable across applies.
+* `bootstrapBrokersPublicTls` - One or more DNS names (or IP addresses) and TLS port pairs. For example, `b1PublicExampleClusterNameAbcdeC2KafkaUsEast1AmazonawsCom:9194,b2PublicExampleClusterNameAbcdeC2KafkaUsEast1AmazonawsCom:9194,b3PublicExampleClusterNameAbcdeC2KafkaUsEast1AmazonawsCom:9194`. This attribute will have a value if `encryptionInfo0EncryptionInTransit0ClientBroker` is set to `tlsPlaintext` or `tls` and `brokerNodeGroupInfo0ConnectivityInfo0PublicAccess0Type` is set to `serviceProvidedEips` and the cluster fulfill all other requirements for public access. The resource sorts the list alphabetically. AWS may not always return all endpoints so the values may not be stable across applies.
+* `bootstrapBrokersSaslIam` - One or more DNS names (or IP addresses) and SASL IAM port pairs. For example, `b1ExampleClusterNameAbcdeC2KafkaUsEast1AmazonawsCom:9098,b2ExampleClusterNameAbcdeC2KafkaUsEast1AmazonawsCom:9098,b3ExampleClusterNameAbcdeC2KafkaUsEast1AmazonawsCom:9098`. This attribute will have a value if `encryptionInfo0EncryptionInTransit0ClientBroker` is set to `tlsPlaintext` or `tls` and `clientAuthentication0Sasl0Iam` is set to `true`. The resource sorts the list alphabetically. AWS may not always return all endpoints so the values may not be stable across applies.
+* `bootstrapBrokersSaslScram` - One or more DNS names (or IP addresses) and SASL SCRAM port pairs. For example, `b1ExampleClusterNameAbcdeC2KafkaUsEast1AmazonawsCom:9096,b2ExampleClusterNameAbcdeC2KafkaUsEast1AmazonawsCom:9096,b3ExampleClusterNameAbcdeC2KafkaUsEast1AmazonawsCom:9096`. This attribute will have a value if `encryptionInfo0EncryptionInTransit0ClientBroker` is set to `tlsPlaintext` or `tls` and `clientAuthentication0Sasl0Scram` is set to `true`. The resource sorts the list alphabetically. AWS may not always return all endpoints so the values may not be stable across applies.
+* `bootstrapBrokersTls` - One or more DNS names (or IP addresses) and TLS port pairs. For example, `b1ExampleClusterNameAbcdeC2KafkaUsEast1AmazonawsCom:9094,b2ExampleClusterNameAbcdeC2KafkaUsEast1AmazonawsCom:9094,b3ExampleClusterNameAbcdeC2KafkaUsEast1AmazonawsCom:9094`. This attribute will have a value if `encryptionInfo0EncryptionInTransit0ClientBroker` is set to `tlsPlaintext` or `tls`. The resource sorts the list alphabetically. AWS may not always return all endpoints so the values may not be stable across applies.
+* `bootstrapBrokersVpcConnectivitySaslIam` - A string containing one or more DNS names (or IP addresses) and SASL IAM port pairs for VPC connectivity. AWS may not always return all endpoints so the values may not be stable across applies.
+* `bootstrapBrokersVpcConnectivitySaslScram` - A string containing one or more DNS names (or IP addresses) and SASL SCRAM port pairs for VPC connectivity. AWS may not always return all endpoints so the values may not be stable across applies.
+* `bootstrapBrokersVpcConnectivityTls` - A string containing one or more DNS names (or IP addresses) and TLS port pairs for VPC connectivity. AWS may not always return all endpoints so the values may not be stable across applies.
+* `clusterUuid` - UUID of the MSK cluster, for use in IAM policies.
+* `currentVersion` - Current version of the MSK Cluster used for updates, e.g., `k13V1Ib3Viyzzh`
+* `encryptionInfo0EncryptionAtRestKmsKeyArn` - The ARN of the KMS key used for encryption at rest of the broker data volumes.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `storageMode` - Controls storage mode for supported storage tiers. Valid values are: `local` or `tiered`.
+* `zookeeperConnectString` - A comma separated list of one or more hostname:port pairs to use to connect to the Apache Zookeeper cluster. The returned values are sorted alphabetically. The AWS API may not return all endpoints, so this value is not guaranteed to be stable across applies.
+* `zookeeperConnectStringTls` - A comma separated list of one or more hostname:port pairs to use to connect to the Apache Zookeeper cluster via TLS. The returned values are sorted alphabetically. The AWS API may not return all endpoints, so this value is not guaranteed to be stable across applies.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `120M`)
+* `update` - (Default `120M`)
+Note that the `update` timeout is used separately for `storageInfo`, `instanceType`, `numberOfBrokerNodes`, `configurationInfo`, `kafkaVersion` and monitoring and logging update timeouts.
+* `delete` - (Default `120M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import MSK clusters using the cluster `arn`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import MSK clusters using the cluster `arn`. For example:
+
+```console
+% terraform import aws_msk_cluster.example arn:aws:kafka:us-west-2:123456789012:cluster/example/279c0212-d057-4dba-9aa9-1c4e5a25bfc7-3
+```
+
+<!-- cache-key: cdktf-0.18.0 input-d74467505dc35d807d612607ba3f66d806ec402f358078d3397150e5e6466657 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/msk_cluster_policy.html.markdown b/website/docs/cdktf/typescript/r/msk_cluster_policy.html.markdown
new file mode 100644
index 00000000000..3f238cd91e1
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/msk_cluster_policy.html.markdown
@@ -0,0 +1,103 @@
+---
+subcategory: "Managed Streaming for Kafka"
+layout: "aws"
+page_title: "AWS: aws_msk_cluster_policy"
+description: |-
+  Terraform resource for managing an AWS Managed Streaming for Kafka Cluster Policy.
+---
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_msk_cluster_policy
+
+Terraform resource for managing an AWS Managed Streaming for Kafka Cluster Policy.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { MskClusterPolicy } from "./.gen/providers/aws/";
+import { DataAwsCallerIdentity } from "./.gen/providers/aws/data-aws-caller-identity";
+import { DataAwsPartition } from "./.gen/providers/aws/data-aws-partition";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const current = new DataAwsCallerIdentity(this, "current", {});
+    const dataAwsPartitionCurrent = new DataAwsPartition(this, "current_1", {});
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsPartitionCurrent.overrideLogicalId("current");
+    new MskClusterPolicy(this, "example", {
+      cluster_arn: awsMskClusterExample.arn,
+      policy: Fn.jsonencode({
+        Statement: [
+          {
+            Action: [
+              "kafka:Describe*",
+              "kafka:Get*",
+              "kafka:CreateVpcConnection",
+              "kafka:GetBootstrapBrokers",
+            ],
+            Effect: "Allow",
+            Principal: {
+              AWS:
+                "arn:${" +
+                dataAwsPartitionCurrent.partition +
+                "}:iam::${" +
+                current.accountId +
+                "}:root",
+            },
+            Resource: awsMskClusterExample.arn,
+            Sid: "ExampleMskClusterPolicy",
+          },
+        ],
+        Version: "2012-10-17",
+      }),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `clusterArn` - (Required) The Amazon Resource Name (ARN) that uniquely identifies the cluster.
+* `policy` - (Required) Resource policy for cluster.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Same as `clusterArn`.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Managed Streaming for Kafka Cluster Policy using the `cluster_arn. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Managed Streaming for Kafka Cluster Policy using the `clusterArn`. For example:
+
+```console
+% terraform import aws_msk_cluster_policy.example arn:aws:kafka:us-west-2:123456789012:cluster/example/279c0212-d057-4dba-9aa9-1c4e5a25bfc7-3
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1d0af5714d8c3f37bc8001ce239abd95f2f1a370064fc908a9872519c5f9e04e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/msk_configuration.html.markdown b/website/docs/cdktf/typescript/r/msk_configuration.html.markdown
new file mode 100644
index 00000000000..4958a24cf83
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/msk_configuration.html.markdown
@@ -0,0 +1,78 @@
+---
+subcategory: "Managed Streaming for Kafka"
+layout: "aws"
+page_title: "AWS: aws_msk_configuration"
+description: |-
+  Terraform resource for managing an Amazon Managed Streaming for Kafka configuration
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_msk_configuration
+
+Manages an Amazon Managed Streaming for Kafka configuration. More information can be found on the [MSK Developer Guide](https://docs.aws.amazon.com/msk/latest/developerguide/msk-configuration.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { MskConfiguration } from "./.gen/providers/aws/msk-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new MskConfiguration(this, "example", {
+      kafkaVersions: ["2.1.0"],
+      name: "example",
+      serverProperties:
+        "auto.create.topics.enable = true\ndelete.topic.enable = true\n\n",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `serverProperties` - (Required) Contents of the server.properties file. Supported properties are documented in the [MSK Developer Guide](https://docs.aws.amazon.com/msk/latest/developerguide/msk-configuration-properties.html).
+* `kafkaVersions` - (Required) List of Apache Kafka versions which can use this configuration.
+* `name` - (Required) Name of the configuration.
+* `description` - (Optional) Description of the configuration.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the configuration.
+* `latestRevision` - Latest revision of the configuration.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import MSK configurations using the configuration ARN. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import MSK configurations using the configuration ARN. For example:
+
+```console
+% terraform import aws_msk_configuration.example arn:aws:kafka:us-west-2:123456789012:configuration/example/279c0212-d057-4dba-9aa9-1c4e5a25bfc7-3
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ec6fa52ad14d67e345a130b8ceb2e54616e97c5f4cb7c72faeeba7b9d508bcfc -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/msk_replicator.html.markdown b/website/docs/cdktf/typescript/r/msk_replicator.html.markdown
new file mode 100644
index 00000000000..97a4ff461d5
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/msk_replicator.html.markdown
@@ -0,0 +1,163 @@
+---
+subcategory: "Managed Streaming for Kafka"
+layout: "aws"
+page_title: "AWS: aws_msk_replicator"
+description: |-
+  Terraform resource for managing an AWS Managed Streaming for Kafka Replicator.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_msk_replicator
+
+Terraform resource for managing an AWS Managed Streaming for Kafka Replicator.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, Fn, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { MskReplicator } from "./.gen/providers/aws/msk-replicator";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new MskReplicator(this, "test", {
+      description: "test-description",
+      kafkaCluster: [
+        {
+          amazonMskCluster: {
+            mskClusterArn: source.arn,
+          },
+          vpcConfig: {
+            securityGroupsIds: [Token.asString(awsSecurityGroupSource.id)],
+            subnetIds: Token.asList(
+              Fn.lookupNested(awsSubnetSource, ["*", "id"])
+            ),
+          },
+        },
+        {
+          amazonMskCluster: {
+            mskClusterArn: target.arn,
+          },
+          vpcConfig: {
+            securityGroupsIds: [Token.asString(awsSecurityGroupTarget.id)],
+            subnetIds: Token.asList(
+              Fn.lookupNested(awsSubnetTarget, ["*", "id"])
+            ),
+          },
+        },
+      ],
+      replicationInfoList: {
+        consumerGroupReplication: [
+          {
+            consumerGroupsToReplicate: [".*"],
+          },
+        ],
+        sourceKafkaClusterArn: source.arn,
+        targetCompressionType: "NONE",
+        targetKafkaClusterArn: target.arn,
+        topicReplication: [
+          {
+            topicsToReplicate: [".*"],
+          },
+        ],
+      },
+      replicatorName: "test-name",
+      serviceExecutionRoleArn: Token.asString(awsIamRoleSource.arn),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `replicatorName` - (Required) The name of the replicator.
+* `kafkaCluster` - (Required) A list of Kafka clusters which are targets of the replicator.
+* `serviceExecutionRoleArn` - (Required) The ARN of the IAM role used by the replicator to access resources in the customer's account (e.g source and target clusters).
+* `replicationInfoList` - (Required) A list of replication configurations, where each configuration targets a given source cluster to target cluster replication flow.
+* `description` - (Optional) A summary description of the replicator.
+
+### kafka_cluster Argument Reference
+
+* `amazonMskCluster` - (Required) Details of an Amazon MSK cluster.
+* `vpcConfig` - (Required) Details of an Amazon VPC which has network connectivity to the Apache Kafka cluster.
+
+### amazon_msk_cluster Argument Reference
+
+* `mskClusterArn` - (Required) The ARN of an Amazon MSK cluster.
+
+### vpc_config Argument Reference
+
+* `subnetIds` - (Required) The list of subnets to connect to in the virtual private cloud (VPC). AWS creates elastic network interfaces inside these subnets to allow communication between your Kafka Cluster and the replicator.
+* `securityGroupsIds` - (Required) The AWS security groups to associate with the ENIs used by the replicator. If a security group is not specified, the default security group associated with the VPC is used.
+
+### replication_info_list Argument Reference
+
+* `sourceKafkaClusterArn` - (Required) The ARN of the source Kafka cluster.
+* `targetKafkaClusterArn` - (Required) The ARN of the target Kafka cluster.
+* `targetCompressionType` - (Required) The type of compression to use writing records to target Kafka cluster.
+* `topicReplication` - (Required) Configuration relating to topic replication.
+* `consumerGroupReplication` - (Required) Confguration relating to consumer group replication.
+
+### topic_replication Argument Reference
+
+* `topicsToReplicate` - (Required) List of regular expression patterns indicating the topics to copy.
+* `topicsToExclude` - (Optional) List of regular expression patterns indicating the topics that should not be replica.
+* `detectAndCopyNewTopics` - (Optional) Whether to periodically check for new topics and partitions.
+* `copyAccessControlListsForTopics` - (Optional) Whether to periodically configure remote topic ACLs to match their corresponding upstream topics.
+* `copyTopicConfigurations` - (Optional) Whether to periodically configure remote topics to match their corresponding upstream topics.
+
+### consumer_group_replication Argument Reference
+
+* `consumerGroupsToReplicate` - (Required) List of regular expression patterns indicating the consumer groups to copy.
+* `consumerGroupsToExclude` - (Optional) List of regular expression patterns indicating the consumer groups that should not be replicated.
+* `detectAndCopyNewConsumerGroups` - (Optional) Whether to periodically check for new consumer groups.
+* `synchroniseConsumerGroupOffsets` - (Optional) Whether to periodically write the translated offsets to __consumer_offsets topic in target cluster.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Replicator. Do not begin the description with "An", "The", "Defines", "Indicates", or "Specifies," as these are verbose. In other words, "Indicates the amount of storage," can be rewritten as "Amount of storage," without losing any information.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `60M`)
+* `update` - (Default `180M`)
+* `delete` - (Default `90M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import MSK relicators using the replicator ARN. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import MSK replicators using the replicator ARN. For example:
+
+```console
+% terraform import aws_msk_replicator.example arn:aws:kafka:us-west-2:123456789012:configuration/example/279c0212-d057-4dba-9aa9-1c4e5a25bfc7-3
+```
+
+<!-- cache-key: cdktf-0.18.0 input-63ad67b2d16605e26ce5adafa9257f85ab5b20fe8bf73b9375562f9cc014c260 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/msk_scram_secret_association.html.markdown b/website/docs/cdktf/typescript/r/msk_scram_secret_association.html.markdown
new file mode 100644
index 00000000000..994d4af62c5
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/msk_scram_secret_association.html.markdown
@@ -0,0 +1,171 @@
+---
+subcategory: "Managed Streaming for Kafka"
+layout: "aws"
+page_title: "AWS: aws_msk_scram_secret_association"
+description: |-
+  Associates SCRAM secrets with a Managed Streaming for Kafka (MSK) cluster.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_msk_scram_secret_association
+
+Associates SCRAM secrets stored in the Secrets Manager service with a Managed Streaming for Kafka (MSK) cluster.
+
+-> **Note:** The following assumes the MSK cluster has SASL/SCRAM authentication enabled. See below for example usage or refer to the [Username/Password Authentication](https://docs.aws.amazon.com/msk/latest/developerguide/msk-password.html) section of the MSK Developer Guide for more details.
+
+To set up username and password authentication for a cluster, create an [`awsSecretsmanagerSecret` resource](/docs/providers/aws/r/secretsmanager_secret.html) and associate
+a username and password with the secret with an [`awsSecretsmanagerSecretVersion` resource](/docs/providers/aws/r/secretsmanager_secret_version.html). When creating a secret for the cluster,
+the `name` must have the prefix `amazonMsk` and you must either use an existing custom AWS KMS key or create a new
+custom AWS KMS key for your secret with the [`awsKmsKey` resource](/docs/providers/aws/r/kms_key.html). It is important to note that a policy is required for the `awsSecretsmanagerSecret`
+resource in order for Kafka to be able to read it. This policy is attached automatically when the `awsMskScramSecretAssociation` is used,
+however, this policy will not be in terraform and as such, will present a diff on plan/apply. For that reason, you must use the [`awsSecretsmanagerSecretPolicy`
+resource](/docs/providers/aws/r/secretsmanager_secret_policy.html) as shown below in order to ensure that the state is in a clean state after the creation of secret and the association to the cluster.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, Fn, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { KmsKey } from "./.gen/providers/aws/kms-key";
+import { MskCluster } from "./.gen/providers/aws/msk-cluster";
+import { MskScramSecretAssociation } from "./.gen/providers/aws/msk-scram-secret-association";
+import { SecretsmanagerSecret } from "./.gen/providers/aws/secretsmanager-secret";
+import { SecretsmanagerSecretPolicy } from "./.gen/providers/aws/secretsmanager-secret-policy";
+import { SecretsmanagerSecretVersion } from "./.gen/providers/aws/secretsmanager-secret-version";
+interface MyConfig {
+  brokerNodeGroupInfo: any;
+  kafkaVersion: any;
+  numberOfBrokerNodes: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    const example = new KmsKey(this, "example", {
+      description: "Example Key for MSK Cluster Scram Secret Association",
+    });
+    const awsMskClusterExample = new MskCluster(this, "example_1", {
+      clientAuthentication: {
+        sasl: {
+          scram: true,
+        },
+      },
+      clusterName: "example",
+      brokerNodeGroupInfo: config.brokerNodeGroupInfo,
+      kafkaVersion: config.kafkaVersion,
+      numberOfBrokerNodes: config.numberOfBrokerNodes,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsMskClusterExample.overrideLogicalId("example");
+    const awsSecretsmanagerSecretExample = new SecretsmanagerSecret(
+      this,
+      "example_2",
+      {
+        kmsKeyId: example.keyId,
+        name: "AmazonMSK_example",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSecretsmanagerSecretExample.overrideLogicalId("example");
+    const awsSecretsmanagerSecretVersionExample =
+      new SecretsmanagerSecretVersion(this, "example_3", {
+        secretId: Token.asString(awsSecretsmanagerSecretExample.id),
+        secretString: Token.asString(
+          Fn.jsonencode({
+            password: "pass",
+            username: "user",
+          })
+        ),
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSecretsmanagerSecretVersionExample.overrideLogicalId("example");
+    const dataAwsIamPolicyDocumentExample = new DataAwsIamPolicyDocument(
+      this,
+      "example_4",
+      {
+        statement: [
+          {
+            actions: ["secretsmanager:getSecretValue"],
+            effect: "Allow",
+            principals: [
+              {
+                identifiers: ["kafka.amazonaws.com"],
+                type: "Service",
+              },
+            ],
+            resources: [Token.asString(awsSecretsmanagerSecretExample.arn)],
+            sid: "AWSKafkaResourcePolicy",
+          },
+        ],
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsIamPolicyDocumentExample.overrideLogicalId("example");
+    const awsMskScramSecretAssociationExample = new MskScramSecretAssociation(
+      this,
+      "example_5",
+      {
+        clusterArn: Token.asString(awsMskClusterExample.arn),
+        dependsOn: [awsSecretsmanagerSecretVersionExample],
+        secretArnList: [Token.asString(awsSecretsmanagerSecretExample.arn)],
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsMskScramSecretAssociationExample.overrideLogicalId("example");
+    const awsSecretsmanagerSecretPolicyExample = new SecretsmanagerSecretPolicy(
+      this,
+      "example_6",
+      {
+        policy: Token.asString(dataAwsIamPolicyDocumentExample.json),
+        secretArn: Token.asString(awsSecretsmanagerSecretExample.arn),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSecretsmanagerSecretPolicyExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `clusterArn` - (Required, Forces new resource) Amazon Resource Name (ARN) of the MSK cluster.
+* `secretArnList` - (Required) List of AWS Secrets Manager secret ARNs.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Amazon Resource Name (ARN) of the MSK cluster.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import MSK SCRAM Secret Associations using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import MSK SCRAM Secret Associations using the `id`. For example:
+
+```console
+% terraform import aws_msk_scram_secret_association.example arn:aws:kafka:us-west-2:123456789012:cluster/example/279c0212-d057-4dba-9aa9-1c4e5a25bfc7-3
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ec732cf5141cf9fb92cf842bde1f6a37b2aeeb88245a75584896a69388c8d988 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/msk_serverless_cluster.html.markdown b/website/docs/cdktf/typescript/r/msk_serverless_cluster.html.markdown
new file mode 100644
index 00000000000..acb511b99a0
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/msk_serverless_cluster.html.markdown
@@ -0,0 +1,117 @@
+---
+subcategory: "Managed Streaming for Kafka"
+layout: "aws"
+page_title: "AWS: aws_msk_serverless_cluster"
+description: |-
+  Terraform resource for managing an Amazon MSK Serverless cluster.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_msk_serverless_cluster
+
+Manages an Amazon MSK Serverless cluster.
+
+-> **Note:** To manage a _provisioned_ Amazon MSK cluster, use the [`awsMskCluster`](/docs/providers/aws/r/msk_cluster.html) resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, Fn, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { MskServerlessCluster } from "./.gen/providers/aws/msk-serverless-cluster";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new MskServerlessCluster(this, "example", {
+      clientAuthentication: {
+        sasl: {
+          iam: {
+            enabled: true,
+          },
+        },
+      },
+      clusterName: "Example",
+      vpcConfig: [
+        {
+          securityGroupIds: [Token.asString(awsSecurityGroupExample.id)],
+          subnetIds: Token.asList(
+            Fn.lookupNested(awsSubnetExample, ["*", "id"])
+          ),
+        },
+      ],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `clientAuthentication` - (Required) Specifies client authentication information for the serverless cluster. See below.
+* `clusterName` - (Required) The name of the serverless cluster.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `vpcConfig` - (Required) VPC configuration information. See below.
+
+### client_authentication Argument Reference
+
+* `sasl` - (Required) Details for client authentication using SASL. See below.
+
+### sasl Argument Reference
+
+* `iam` - (Required) Details for client authentication using IAM. See below.
+
+### iam Argument Reference
+
+* `enabled` - (Required) Whether SASL/IAM authentication is enabled or not.
+
+### vpc_config Argument Reference
+
+* `securityGroupIds` - (Optional) Specifies up to five security groups that control inbound and outbound traffic for the serverless cluster.
+* `subnetIds` - (Required) A list of subnets in at least two different Availability Zones that host your client applications.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the serverless cluster.
+* `clusterUuid` - UUID of the serverless cluster, for use in IAM policies.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `120M`)
+* `delete` - (Default `120M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import MSK serverless clusters using the cluster `arn`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import MSK serverless clusters using the cluster `arn`. For example:
+
+```console
+% terraform import aws_msk_serverless_cluster.example arn:aws:kafka:us-west-2:123456789012:cluster/example/279c0212-d057-4dba-9aa9-1c4e5a25bfc7-3
+```
+
+<!-- cache-key: cdktf-0.18.0 input-e874f0cb80a0744435c987dbba0dd6d2b31f5d0aeda927db3722774f9b044561 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/msk_vpc_connection.html.markdown b/website/docs/cdktf/typescript/r/msk_vpc_connection.html.markdown
new file mode 100644
index 00000000000..afac316569f
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/msk_vpc_connection.html.markdown
@@ -0,0 +1,88 @@
+---
+subcategory: "Managed Streaming for Kafka"
+layout: "aws"
+page_title: "AWS: aws_msk_vpc_connection"
+description: |-
+  Terraform resource for managing an AWS Managed Streaming for Kafka VPC Connection.
+---
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_msk_vpc_connection
+
+Terraform resource for managing an AWS Managed Streaming for Kafka VPC Connection.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { MskVpcConnection } from "./.gen/providers/aws/msk-vpc-connection";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new MskVpcConnection(this, "test", {
+      authentication: "SASL_IAM",
+      clientSubnets: Token.asList(Fn.lookupNested(awsSubnetTest, ["*", "id"])),
+      securityGroups: [Token.asString(awsSecurityGroupTest.id)],
+      targetClusterArn: "aws_msk_cluster.arn",
+      vpcId: Token.asString(awsVpcTest.id),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `authentication` - (Required) The authentication type for the client VPC connection. Specify one of these auth type strings: SASL_IAM, SASL_SCRAM, or TLS.
+* `clientSubnets` - (Required) The list of subnets in the client VPC to connect to.
+* `securityGroups` - (Required) The security groups to attach to the ENIs for the broker nodes.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `targetClusterArn` - (Required) The Amazon Resource Name (ARN) of the cluster.
+* `vpcId` - (Required) The VPC ID of the remote client.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the VPC connection.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `60M`)
+* `update` - (Default `180M`)
+* `delete` - (Default `90M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import MSK configurations using the configuration ARN. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import MSK configurations using the configuration ARN. For example:
+
+```console
+% terraform import aws_msk_vpc_connection.example arn:aws:kafka:eu-west-2:123456789012:vpc-connection/123456789012/example/38173259-79cd-4ee8-87f3-682ea6023f48-2
+```
+
+<!-- cache-key: cdktf-0.18.0 input-b1983aad22e07fb109f5b2adb453a2e83d036de6685d43ca610e71d747466b69 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/mskconnect_connector.html.markdown b/website/docs/cdktf/typescript/r/mskconnect_connector.html.markdown
new file mode 100644
index 00000000000..ae02913dec7
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/mskconnect_connector.html.markdown
@@ -0,0 +1,229 @@
+---
+subcategory: "Managed Streaming for Kafka Connect"
+layout: "aws"
+page_title: "AWS: aws_mskconnect_connector"
+description: |-
+  Provides an Amazon MSK Connect Connector resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_mskconnect_connector
+
+Provides an Amazon MSK Connect Connector resource.
+
+## Example Usage
+
+### Basic configuration
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { MskconnectConnector } from "./.gen/providers/aws/mskconnect-connector";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new MskconnectConnector(this, "example", {
+      capacity: {
+        autoscaling: {
+          maxWorkerCount: 2,
+          mcuCount: 1,
+          minWorkerCount: 1,
+          scaleInPolicy: {
+            cpuUtilizationPercentage: 20,
+          },
+          scaleOutPolicy: {
+            cpuUtilizationPercentage: 80,
+          },
+        },
+      },
+      connectorConfiguration: {
+        "connector.class":
+          "com.github.jcustenborder.kafka.connect.simulator.SimulatorSinkConnector",
+        "tasks.max": "1",
+        topics: "example",
+      },
+      kafkaCluster: {
+        apacheKafkaCluster: {
+          bootstrapServers: Token.asString(
+            awsMskClusterExample.bootstrapBrokersTls
+          ),
+          vpc: {
+            securityGroups: [Token.asString(awsSecurityGroupExample.id)],
+            subnets: [example1.id, example2.id, example3.id],
+          },
+        },
+      },
+      kafkaClusterClientAuthentication: {
+        authenticationType: "NONE",
+      },
+      kafkaClusterEncryptionInTransit: {
+        encryptionType: "TLS",
+      },
+      kafkaconnectVersion: "2.7.1",
+      name: "example",
+      plugin: [
+        {
+          customPlugin: {
+            arn: Token.asString(awsMskconnectCustomPluginExample.arn),
+            revision: Token.asNumber(
+              awsMskconnectCustomPluginExample.latestRevision
+            ),
+          },
+        },
+      ],
+      serviceExecutionRoleArn: Token.asString(awsIamRoleExample.arn),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `capacity` - (Required) Information about the capacity allocated to the connector. See below.
+* `connectorConfiguration` - (Required) A map of keys to values that represent the configuration for the connector.
+* `description` - (Optional) A summary description of the connector.
+* `kafkaCluster` - (Required) Specifies which Apache Kafka cluster to connect to. See below.
+* `kafkaClusterClientAuthentication` - (Required) Details of the client authentication used by the Apache Kafka cluster. See below.
+* `kafkaClusterEncryptionInTransit` - (Required) Details of encryption in transit to the Apache Kafka cluster. See below.
+* `kafkaconnectVersion` - (Required) The version of Kafka Connect. It has to be compatible with both the Apache Kafka cluster's version and the plugins.
+* `logDelivery` - (Optional) Details about log delivery. See below.
+* `name` - (Required) The name of the connector.
+* `plugin` - (Required) Specifies which plugins to use for the connector. See below.
+* `serviceExecutionRoleArn` - (Required) The Amazon Resource Name (ARN) of the IAM role used by the connector to access the Amazon Web Services resources that it needs. The types of resources depends on the logic of the connector. For example, a connector that has Amazon S3 as a destination must have permissions that allow it to write to the S3 destination bucket.
+* `workerConfiguration` - (Optional) Specifies which worker configuration to use with the connector. See below.
+
+### capacity Configuration Block
+
+* `autoscaling` - (Optional) Information about the auto scaling parameters for the connector. See below.
+* `provisionedCapacity` - (Optional) Details about a fixed capacity allocated to a connector. See below.
+
+### autoscaling Configuration Block
+
+* `maxWorkerCount` - (Required) The maximum number of workers allocated to the connector.
+* `mcuCount` - (Optional) The number of microcontroller units (MCUs) allocated to each connector worker. Valid values: `1`, `2`, `4`, `8`. The default value is `1`.
+* `minWorkerCount` - (Required) The minimum number of workers allocated to the connector.
+* `scaleInPolicy` - (Optional) The scale-in policy for the connector. See below.
+* `scaleOutPolicy` - (Optional) The scale-out policy for the connector. See below.
+
+### scale_in_policy Configuration Block
+
+* `cpuUtilizationPercentage` - (Required) Specifies the CPU utilization percentage threshold at which you want connector scale in to be triggered.
+
+### scale_out_policy Configuration Block
+
+* `cpuUtilizationPercentage` - (Required) The CPU utilization percentage threshold at which you want connector scale out to be triggered.
+
+### provisioned_capacity Configuration Block
+
+* `mcuCount` - (Optional) The number of microcontroller units (MCUs) allocated to each connector worker. Valid values: `1`, `2`, `4`, `8`. The default value is `1`.
+* `workerCount` - (Required) The number of workers that are allocated to the connector.
+
+### kafka_cluster Configuration Block
+
+* `apacheKafkaCluster` - (Required) The Apache Kafka cluster to which the connector is connected.
+
+### apache_kafka_cluster Configuration Block
+
+* `bootstrapServers` - (Required) The bootstrap servers of the cluster.
+* `vpc` - (Required) Details of an Amazon VPC which has network connectivity to the Apache Kafka cluster.
+
+### vpc Configuration Block
+
+* `securityGroups` - (Required) The security groups for the connector.
+* `subnets` - (Required) The subnets for the connector.
+
+### kafka_cluster_client_authentication Configuration Block
+
+* `authenticationType` - (Optional) The type of client authentication used to connect to the Apache Kafka cluster. Valid values: `iam`, `none`. A value of `none` means that no client authentication is used. The default value is `none`.
+
+### kafka_cluster_encryption_in_transit Configuration Block
+
+* `encryptionType` - (Optional) The type of encryption in transit to the Apache Kafka cluster. Valid values: `plaintext`, `tls`. The default values is `plaintext`.
+
+### log_delivery Configuration Block
+
+* `workerLogDelivery` - (Required) The workers can send worker logs to different destination types. This configuration specifies the details of these destinations. See below.
+
+### worker_log_delivery Configuration Block
+
+* `cloudwatchLogs` - (Optional) Details about delivering logs to Amazon CloudWatch Logs. See below.
+* `firehose` - (Optional) Details about delivering logs to Amazon Kinesis Data Firehose. See below.
+* `s3` - (Optional) Details about delivering logs to Amazon S3. See below.
+
+### cloudwatch_logs Configuration Block
+
+* `enabled` - (Optional) Whether log delivery to Amazon CloudWatch Logs is enabled.
+* `logGroup` - (Required) The name of the CloudWatch log group that is the destination for log delivery.
+
+### firehose Configuration Block
+
+* `deliveryStream` - (Optional) The name of the Kinesis Data Firehose delivery stream that is the destination for log delivery.
+* `enabled` - (Required) Specifies whether connector logs get delivered to Amazon Kinesis Data Firehose.
+
+### s3 Configuration Block
+
+* `bucket` - (Optional) The name of the S3 bucket that is the destination for log delivery.
+* `enabled` - (Required) Specifies whether connector logs get sent to the specified Amazon S3 destination.
+* `prefix` - (Optional) The S3 prefix that is the destination for log delivery.
+
+### plugin Configuration Block
+
+* `customPlugin` - (Required) Details about a custom plugin. See below.
+
+### custom_plugin Configuration Block
+
+* `arn` - (Required) The Amazon Resource Name (ARN) of the custom plugin.
+* `revision` - (Required) The revision of the custom plugin.
+
+### worker_configuration Configuration Block
+
+* `arn` - (Required) The Amazon Resource Name (ARN) of the worker configuration.
+* `revision` - (Required) The revision of the worker configuration.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the connector.
+* `version` - The current version of the connector.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `20M`)
+* `update` - (Default `20M`)
+* `delete` - (Default `10M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import MSK Connect Connector using the connector's `arn`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import MSK Connect Connector using the connector's `arn`. For example:
+
+```console
+% terraform import aws_mskconnect_connector.example 'arn:aws:kafkaconnect:eu-central-1:123456789012:connector/example/264edee4-17a3-412e-bd76-6681cfc93805-3'
+```
+
+<!-- cache-key: cdktf-0.18.0 input-40619f08de26cd7fcad3cf70d7685484652ad1f0806e16438690dce5d953aa3a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/mskconnect_custom_plugin.html.markdown b/website/docs/cdktf/typescript/r/mskconnect_custom_plugin.html.markdown
new file mode 100644
index 00000000000..aed15a550fe
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/mskconnect_custom_plugin.html.markdown
@@ -0,0 +1,123 @@
+---
+subcategory: "Managed Streaming for Kafka Connect"
+layout: "aws"
+page_title: "AWS: aws_mskconnect_custom_plugin"
+description: |-
+  Provides an Amazon MSK Connect custom plugin resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_mskconnect_custom_plugin
+
+Provides an Amazon MSK Connect Custom Plugin Resource.
+
+## Example Usage
+
+### Basic configuration
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { MskconnectCustomPlugin } from "./.gen/providers/aws/mskconnect-custom-plugin";
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3Object } from "./.gen/providers/aws/s3-object";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new S3Bucket(this, "example", {
+      bucket: "example",
+    });
+    const awsS3ObjectExample = new S3Object(this, "example_1", {
+      bucket: example.id,
+      key: "debezium.zip",
+      source: "debezium.zip",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3ObjectExample.overrideLogicalId("example");
+    const awsMskconnectCustomPluginExample = new MskconnectCustomPlugin(
+      this,
+      "example_2",
+      {
+        contentType: "ZIP",
+        location: {
+          s3: {
+            bucketArn: example.arn,
+            fileKey: Token.asString(awsS3ObjectExample.key),
+          },
+        },
+        name: "debezium-example",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsMskconnectCustomPluginExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) The name of the custom plugin..
+* `contentType` - (Required) The type of the plugin file. Allowed values are `zip` and `jar`.
+* `location` - (Required) Information about the location of a custom plugin. See below.
+
+The following arguments are optional:
+
+* `description` - (Optional) A summary description of the custom plugin.
+
+### location Argument Reference
+
+* `s3` - (Required) Information of the plugin file stored in Amazon S3. See below.
+
+#### location s3 Argument Reference
+
+* `bucketArn` - (Required) The Amazon Resource Name (ARN) of an S3 bucket.
+* `fileKey` - (Required) The file key for an object in an S3 bucket.
+* `objectVersion` - (Optional) The version of an object in an S3 bucket.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - the Amazon Resource Name (ARN) of the custom plugin.
+* `latestRevision` - an ID of the latest successfully created revision of the custom plugin.
+* `state` - the state of the custom plugin.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `10M`)
+* `delete` - (Default `10M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import MSK Connect Custom Plugin using the plugin's `arn`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import MSK Connect Custom Plugin using the plugin's `arn`. For example:
+
+```console
+% terraform import aws_mskconnect_custom_plugin.example 'arn:aws:kafkaconnect:eu-central-1:123456789012:custom-plugin/debezium-example/abcdefgh-1234-5678-9abc-defghijklmno-4'
+```
+
+<!-- cache-key: cdktf-0.18.0 input-fa6ff218273ad9d6a29b1b6d47850b35e3eb2ccea8af6818ee7abaf4e10e3981 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/mskconnect_worker_configuration.html.markdown b/website/docs/cdktf/typescript/r/mskconnect_worker_configuration.html.markdown
new file mode 100644
index 00000000000..d3c1c996e97
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/mskconnect_worker_configuration.html.markdown
@@ -0,0 +1,81 @@
+---
+subcategory: "Managed Streaming for Kafka Connect"
+layout: "aws"
+page_title: "AWS: aws_mskconnect_worker_configuration"
+description: |-
+  Provides an Amazon MSK Connect worker configuration resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_mskconnect_worker_configuration
+
+Provides an Amazon MSK Connect Worker Configuration Resource.
+
+## Example Usage
+
+### Basic configuration
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { MskconnectWorkerConfiguration } from "./.gen/providers/aws/mskconnect-worker-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new MskconnectWorkerConfiguration(this, "example", {
+      name: "example",
+      propertiesFileContent:
+        "key.converter=org.apache.kafka.connect.storage.StringConverter\nvalue.converter=org.apache.kafka.connect.storage.StringConverter\n\n",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) The name of the worker configuration.
+* `propertiesFileContent` - (Required) Contents of connect-distributed.properties file. The value can be either base64 encoded or in raw format.
+
+The following arguments are optional:
+
+* `description` - (Optional) A summary description of the worker configuration.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - the Amazon Resource Name (ARN) of the worker configuration.
+* `latestRevision` - an ID of the latest successfully created revision of the worker configuration.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import MSK Connect Worker Configuration using the plugin's `arn`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import MSK Connect Worker Configuration using the plugin's `arn`. For example:
+
+```console
+% terraform import aws_mskconnect_worker_configuration.example 'arn:aws:kafkaconnect:eu-central-1:123456789012:worker-configuration/example/8848493b-7fcc-478c-a646-4a52634e3378-4'
+```
+
+<!-- cache-key: cdktf-0.18.0 input-bc7b92333857615efcf55495814a13f7f290beda82616db5a0a69a043449491a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/mwaa_environment.html.markdown b/website/docs/cdktf/typescript/r/mwaa_environment.html.markdown
new file mode 100644
index 00000000000..ba58b09c638
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/mwaa_environment.html.markdown
@@ -0,0 +1,260 @@
+---
+subcategory: "MWAA (Managed Workflows for Apache Airflow)"
+layout: "aws"
+page_title: "AWS: aws_mwaa_environment"
+description: |-
+  Creates a MWAA Environment
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_mwaa_environment
+
+Creates a MWAA Environment resource.
+
+## Example Usage
+
+A MWAA Environment requires an IAM role (`awsIamRole`), two subnets in the private zone (`awsSubnet`) and a versioned S3 bucket (`awsS3Bucket`).
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, Fn, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { MwaaEnvironment } from "./.gen/providers/aws/mwaa-environment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new MwaaEnvironment(this, "example", {
+      dagS3Path: "dags/",
+      executionRoleArn: Token.asString(awsIamRoleExample.arn),
+      name: "example",
+      networkConfiguration: {
+        securityGroupIds: [Token.asString(awsSecurityGroupExample.id)],
+        subnetIds: Token.asList(Fn.lookupNested(private, ["*", "id"])),
+      },
+      sourceBucketArn: Token.asString(awsS3BucketExample.arn),
+    });
+  }
+}
+
+```
+
+### Example with Airflow configuration options
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, Fn, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { MwaaEnvironment } from "./.gen/providers/aws/mwaa-environment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new MwaaEnvironment(this, "example", {
+      airflowConfigurationOptions: {
+        "core.default_task_retries": Token.asString(16),
+        "core.parallelism": Token.asString(1),
+      },
+      dagS3Path: "dags/",
+      executionRoleArn: Token.asString(awsIamRoleExample.arn),
+      name: "example",
+      networkConfiguration: {
+        securityGroupIds: [Token.asString(awsSecurityGroupExample.id)],
+        subnetIds: Token.asList(Fn.lookupNested(private, ["*", "id"])),
+      },
+      sourceBucketArn: Token.asString(awsS3BucketExample.arn),
+    });
+  }
+}
+
+```
+
+### Example with logging configurations
+
+Note that Airflow task logs are enabled by default with the `info` log level.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, Fn, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { MwaaEnvironment } from "./.gen/providers/aws/mwaa-environment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new MwaaEnvironment(this, "example", {
+      dagS3Path: "dags/",
+      executionRoleArn: Token.asString(awsIamRoleExample.arn),
+      loggingConfiguration: {
+        dagProcessingLogs: {
+          enabled: true,
+          logLevel: "DEBUG",
+        },
+        schedulerLogs: {
+          enabled: true,
+          logLevel: "INFO",
+        },
+        taskLogs: {
+          enabled: true,
+          logLevel: "WARNING",
+        },
+        webserverLogs: {
+          enabled: true,
+          logLevel: "ERROR",
+        },
+        workerLogs: {
+          enabled: true,
+          logLevel: "CRITICAL",
+        },
+      },
+      name: "example",
+      networkConfiguration: {
+        securityGroupIds: [Token.asString(awsSecurityGroupExample.id)],
+        subnetIds: Token.asList(Fn.lookupNested(private, ["*", "id"])),
+      },
+      sourceBucketArn: Token.asString(awsS3BucketExample.arn),
+    });
+  }
+}
+
+```
+
+### Example with tags
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, Fn, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { MwaaEnvironment } from "./.gen/providers/aws/mwaa-environment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new MwaaEnvironment(this, "example", {
+      dagS3Path: "dags/",
+      executionRoleArn: Token.asString(awsIamRoleExample.arn),
+      name: "example",
+      networkConfiguration: {
+        securityGroupIds: [Token.asString(awsSecurityGroupExample.id)],
+        subnetIds: Token.asList(Fn.lookupNested(private, ["*", "id"])),
+      },
+      sourceBucketArn: Token.asString(awsS3BucketExample.arn),
+      tags: {
+        Environment: "production",
+        Name: "example",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `airflowConfigurationOptions` - (Optional) The `airflowConfigurationOptions` parameter specifies airflow override options. Check the [Official documentation](https://docs.aws.amazon.com/mwaa/latest/userguide/configuring-env-variables.html#configuring-env-variables-reference) for all possible configuration options.
+* `airflowVersion` - (Optional) Airflow version of your environment, will be set by default to the latest version that MWAA supports.
+* `dagS3Path` - (Required) The relative path to the DAG folder on your Amazon S3 storage bucket. For example, dags. For more information, see [Importing DAGs on Amazon MWAA](https://docs.aws.amazon.com/mwaa/latest/userguide/configuring-dag-import.html).
+* `environmentClass` - (Optional) Environment class for the cluster. Possible options are `mw1Small`, `mw1Medium`, `mw1Large`. Will be set by default to `mw1Small`. Please check the [AWS Pricing](https://aws.amazon.com/de/managed-workflows-for-apache-airflow/pricing/) for more information about the environment classes.
+* `executionRoleArn` - (Required) The Amazon Resource Name (ARN) of the task execution role that the Amazon MWAA and its environment can assume. Check the [official AWS documentation](https://docs.aws.amazon.com/mwaa/latest/userguide/mwaa-create-role.html) for the detailed role specification.
+* `kmsKey` - (Optional) The Amazon Resource Name (ARN) of your KMS key that you want to use for encryption. Will be set to the ARN of the managed KMS key `aws/airflow` by default. Please check the [Official Documentation](https://docs.aws.amazon.com/mwaa/latest/userguide/custom-keys-certs.html) for more information.
+* `loggingConfiguration` - (Optional) The Apache Airflow logs you want to send to Amazon CloudWatch Logs.
+* `maxWorkers` - (Optional) The maximum number of workers that can be automatically scaled up. Value need to be between `1` and `25`. Will be `10` by default.
+* `minWorkers` - (Optional) The minimum number of workers that you want to run in your environment. Will be `1` by default.
+* `name` - (Required) The name of the Apache Airflow Environment
+* `networkConfiguration` - (Required) Specifies the network configuration for your Apache Airflow Environment. This includes two private subnets as well as security groups for the Airflow environment. Each subnet requires internet connection, otherwise the deployment will fail. See [Network configuration](#network-configuration) below for details.
+* `pluginsS3ObjectVersion` - (Optional) The plugins.zip file version you want to use.
+* `pluginsS3Path` - (Optional) The relative path to the plugins.zip file on your Amazon S3 storage bucket. For example, plugins.zip. If a relative path is provided in the request, then plugins_s3_object_version is required. For more information, see [Importing DAGs on Amazon MWAA](https://docs.aws.amazon.com/mwaa/latest/userguide/configuring-dag-import.html).
+* `requirementsS3ObjectVersion` - (Optional) The requirements.txt file version you want to use.
+* `requirementsS3Path` - (Optional) The relative path to the requirements.txt file on your Amazon S3 storage bucket. For example, requirements.txt. If a relative path is provided in the request, then requirements_s3_object_version is required. For more information, see [Importing DAGs on Amazon MWAA](https://docs.aws.amazon.com/mwaa/latest/userguide/configuring-dag-import.html).
+* `schedulers` - (Optional) The number of schedulers that you want to run in your environment. v2.0.2 and above accepts `2` - `5`, default `2`. v1.10.12 accepts `1`.
+* `sourceBucketArn` - (Required) The Amazon Resource Name (ARN) of your Amazon S3 storage bucket. For example, arn:aws:s3:::airflow-mybucketname.
+* `startupScriptS3ObjectVersion` - (Optional) The version of the startup shell script you want to use. You must specify the version ID that Amazon S3 assigns to the file every time you update the script.
+* `startupScriptS3Path` - (Optional) The relative path to the script hosted in your bucket. The script runs as your environment starts before starting the Apache Airflow process. Use this script to install dependencies, modify configuration options, and set environment variables. See [Using a startup script](https://docs.aws.amazon.com/mwaa/latest/userguide/using-startup-script.html). Supported for environment versions 2.x and later.
+* `webserverAccessMode` - (Optional) Specifies whether the webserver should be accessible over the internet or via your specified VPC. Possible options: `privateOnly` (default) and `publicOnly`.
+* `weeklyMaintenanceWindowStart` - (Optional) Specifies the start date for the weekly maintenance window.
+* `tags` - (Optional) A map of resource tags to associate with the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Logging configurations
+
+The `loggingConfiguration` block supports the following arguments.
+
+* `dagProcessingLogs` - (Optional) (Optional) Log configuration options for processing DAGs. See [Module logging configuration](#module-logging-configuration) for more information. Disabled by default.
+* `schedulerLogs` - (Optional) Log configuration options for the schedulers. See [Module logging configuration](#module-logging-configuration) for more information. Disabled by default.
+* `taskLogs` - (Optional) Log configuration options for DAG tasks. See [Module logging configuration](#module-logging-configuration) for more information. Enabled by default with `info` log level.
+* `webserverLogs` - (Optional) Log configuration options for the webservers. See [Module logging configuration](#module-logging-configuration) for more information. Disabled by default.
+* `workerLogs` - (Optional) Log configuration options for the workers. See [Module logging configuration](#module-logging-configuration) for more information. Disabled by default.
+
+### Module logging configuration
+
+A configuration block to use for logging with respect to the various Apache Airflow services: DagProcessingLogs, SchedulerLogs, TaskLogs, WebserverLogs, and WorkerLogs. It supports the following arguments.
+
+* `enabled` - (Required) Enabling or disabling the collection of logs
+* `logLevel` - (Optional) Logging level. Valid values: `critical`, `error`, `warning`, `info`, `debug`. Will be `info` by default.
+
+### Network configuration
+
+The `networkConfiguration` block supports the following arguments. More information about the required subnet and security group settings can be found in the [official AWS documentation](https://docs.aws.amazon.com/mwaa/latest/userguide/vpc-create.html).
+
+* `securityGroupIds` - (Required) Security groups IDs for the environment. At least one of the security group needs to allow MWAA resources to talk to each other, otherwise MWAA cannot be provisioned.
+* `subnetIds` - (Required)  The private subnet IDs in which the environment should be created. MWAA requires two subnets.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the MWAA Environment
+* `createdAt` - The Created At date of the MWAA Environment
+* `loggingConfiguration[0].<logConfigurationType>[0]CloudWatchLogGroupArn` - Provides the ARN for the CloudWatch group where the logs will be published
+* `serviceRoleArn` - The Service Role ARN of the Amazon MWAA Environment
+* `status` - The status of the Amazon MWAA Environment
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `webserverUrl` - The webserver URL of the MWAA Environment
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `120M`)
+- `update` - (Default `90M`)
+- `delete` - (Default `90M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import MWAA Environment using `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import MWAA Environment using `name`. For example:
+
+```console
+% terraform import aws_mwaa_environment.example MyAirflowEnvironment
+```
+
+<!-- cache-key: cdktf-0.18.0 input-d3002c93c3e9fc1e98e7cfbd839e153f618d73c8c38a32a37712a4061c84cbe9 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/nat_gateway.html.markdown b/website/docs/cdktf/typescript/r/nat_gateway.html.markdown
new file mode 100644
index 00000000000..f1ac3636d8f
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/nat_gateway.html.markdown
@@ -0,0 +1,169 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_nat_gateway"
+description: |-
+  Provides a resource to create a VPC NAT Gateway.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_nat_gateway
+
+Provides a resource to create a VPC NAT Gateway.
+
+## Example Usage
+
+### Public NAT
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { NatGateway } from "./.gen/providers/aws/nat-gateway";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new NatGateway(this, "example", {
+      allocationId: Token.asString(awsEipExample.id),
+      dependsOn: [awsInternetGatewayExample],
+      subnetId: Token.asString(awsSubnetExample.id),
+      tags: {
+        Name: "gw NAT",
+      },
+    });
+  }
+}
+
+```
+
+### Public NAT with Secondary Private IP Addresses
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { NatGateway } from "./.gen/providers/aws/nat-gateway";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new NatGateway(this, "example", {
+      allocationId: Token.asString(awsEipExample.id),
+      secondaryAllocationIds: [secondary.id],
+      secondaryPrivateIpAddresses: ["10.0.1.5"],
+      subnetId: Token.asString(awsSubnetExample.id),
+    });
+  }
+}
+
+```
+
+### Private NAT
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { NatGateway } from "./.gen/providers/aws/nat-gateway";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new NatGateway(this, "example", {
+      connectivityType: "private",
+      subnetId: Token.asString(awsSubnetExample.id),
+    });
+  }
+}
+
+```
+
+### Private NAT with Secondary Private IP Addresses
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { NatGateway } from "./.gen/providers/aws/nat-gateway";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new NatGateway(this, "example", {
+      connectivityType: "private",
+      secondaryPrivateIpAddressCount: 7,
+      subnetId: Token.asString(awsSubnetExample.id),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `allocationId` - (Optional) The Allocation ID of the Elastic IP address for the NAT Gateway. Required for `connectivityType` of `public`.
+* `connectivityType` - (Optional) Connectivity type for the NAT Gateway. Valid values are `private` and `public`. Defaults to `public`.
+* `privateIp` - (Optional) The private IPv4 address to assign to the NAT Gateway. If you don't provide an address, a private IPv4 address will be automatically assigned.
+* `subnetId` - (Required) The Subnet ID of the subnet in which to place the NAT Gateway.
+* `secondaryAllocationIds` - (Optional) A list of secondary allocation EIP IDs for this NAT Gateway.
+* `secondaryPrivateIpAddressCount` - (Optional) [Private NAT Gateway only] The number of secondary private IPv4 addresses you want to assign to the NAT Gateway.
+* `secondaryPrivateIpAddresses` - (Optional) A list of secondary private IPv4 addresses to assign to the NAT Gateway.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `associationId` - The association ID of the Elastic IP address that's associated with the NAT Gateway. Only available when `connectivityType` is `public`.
+* `id` - The ID of the NAT Gateway.
+* `networkInterfaceId` - The ID of the network interface associated with the NAT Gateway.
+* `publicIp` - The Elastic IP address associated with the NAT Gateway.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `10M`)
+- `update` - (Default `10M`)
+- `delete` - (Default `30M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import NAT Gateways using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import NAT Gateways using the `id`. For example:
+
+```console
+% terraform import aws_nat_gateway.private_gw nat-05dba92075d71c408
+```
+
+<!-- cache-key: cdktf-0.18.0 input-6e34b90b4993bab91f851a578e7ddb84ebd6aef6d8220655a1d5b45186bd1edf -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/neptune_cluster.html.markdown b/website/docs/cdktf/typescript/r/neptune_cluster.html.markdown
new file mode 100644
index 00000000000..2e19a12ee4c
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/neptune_cluster.html.markdown
@@ -0,0 +1,179 @@
+---
+subcategory: "Neptune"
+layout: "aws"
+page_title: "AWS: aws_neptune_cluster"
+description: |-
+  Provides an Neptune Cluster Resource
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_neptune_cluster
+
+Provides an Neptune Cluster Resource. A Cluster Resource defines attributes that are
+applied to the entire cluster of Neptune Cluster Instances.
+
+Changes to a Neptune Cluster can occur when you manually change a
+parameter, such as `backupRetentionPeriod`, and are reflected in the next maintenance
+window. Because of this, Terraform may report a difference in its planning
+phase because a modification has not yet taken place. You can use the
+`applyImmediately` flag to instruct the service to apply the change immediately
+(see documentation below).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { NeptuneCluster } from "./.gen/providers/aws/neptune-cluster";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new NeptuneCluster(this, "default", {
+      applyImmediately: true,
+      backupRetentionPeriod: 5,
+      clusterIdentifier: "neptune-cluster-demo",
+      engine: "neptune",
+      iamDatabaseAuthenticationEnabled: true,
+      preferredBackupWindow: "07:00-09:00",
+      skipFinalSnapshot: true,
+    });
+  }
+}
+
+```
+
+~> **Note:** AWS Neptune does not support user name/password–based access control.
+See the AWS [Docs](https://docs.aws.amazon.com/neptune/latest/userguide/limits.html) for more information.
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `allowMajorVersionUpgrade` - (Optional) Specifies whether upgrades between different major versions are allowed. You must set it to `true` when providing an `engineVersion` parameter that uses a different major version than the DB cluster's current version. Default is `false`.
+* `applyImmediately` - (Optional) Specifies whether any cluster modifications are applied immediately, or during the next maintenance window. Default is `false`.
+* `availabilityZones` - (Optional) A list of EC2 Availability Zones that instances in the Neptune cluster can be created in.
+* `backupRetentionPeriod` - (Optional) The days to retain backups for. Default `1`
+* `clusterIdentifier` - (Optional, Forces new resources) The cluster identifier. If omitted, Terraform will assign a random, unique identifier.
+* `clusterIdentifierPrefix` - (Optional, Forces new resource) Creates a unique cluster identifier beginning with the specified prefix. Conflicts with `clusterIdentifier`.
+* `copyTagsToSnapshot` - (Optional) If set to true, tags are copied to any snapshot of the DB cluster that is created.
+* `enableCloudwatchLogsExports` - (Optional) A list of the log types this DB cluster is configured to export to Cloudwatch Logs. Currently only supports `audit` and `slowquery`.
+* `engine` - (Optional) The name of the database engine to be used for this Neptune cluster. Defaults to `neptune`.
+* `engineVersion` - (Optional) The database engine version.
+* `finalSnapshotIdentifier` - (Optional) The name of your final Neptune snapshot when this Neptune cluster is deleted. If omitted, no final snapshot will be made.
+* `globalClusterIdentifier` - (Optional) The global cluster identifier specified on [`awsNeptuneGlobalCluster`](/docs/providers/aws/r/neptune_global_cluster.html).
+* `iamRoles` - (Optional) A List of ARNs for the IAM roles to associate to the Neptune Cluster.
+* `iamDatabaseAuthenticationEnabled` - (Optional) Specifies whether or not mappings of AWS Identity and Access Management (IAM) accounts to database accounts is enabled.
+* `kmsKeyArn` - (Optional) The ARN for the KMS encryption key. When specifying `kmsKeyArn`, `storageEncrypted` needs to be set to true.
+* `neptuneSubnetGroupName` - (Optional) A Neptune subnet group to associate with this Neptune instance.
+* `neptuneClusterParameterGroupName` - (Optional) A cluster parameter group to associate with the cluster.
+* `neptuneInstanceParameterGroupName` - (Optional) The name of the DB parameter group to apply to all instances of the DB cluster.
+* `preferredBackupWindow` - (Optional) The daily time range during which automated backups are created if automated backups are enabled using the BackupRetentionPeriod parameter. Time in UTC. Default: A 30-minute window selected at random from an 8-hour block of time per regionE.g., 04:00-09:00
+* `preferredMaintenanceWindow` - (Optional) The weekly time range during which system maintenance can occur, in (UTC) e.g., wed:04:00-wed:04:30
+* `port` - (Optional) The port on which the Neptune accepts connections. Default is `8182`.
+* `replicationSourceIdentifier` - (Optional) ARN of a source Neptune cluster or Neptune instance if this Neptune cluster is to be created as a Read Replica.
+* `skipFinalSnapshot` - (Optional) Determines whether a final Neptune snapshot is created before the Neptune cluster is deleted. If true is specified, no Neptune snapshot is created. If false is specified, a Neptune snapshot is created before the Neptune cluster is deleted, using the value from `finalSnapshotIdentifier`. Default is `false`.
+* `snapshotIdentifier` - (Optional) Specifies whether or not to create this cluster from a snapshot. You can use either the name or ARN when specifying a Neptune cluster snapshot, or the ARN when specifying a Neptune snapshot. Automated snapshots **should not** be used for this attribute, unless from a different cluster. Automated snapshots are deleted as part of cluster destruction when the resource is replaced.
+* `storageEncrypted` - (Optional) Specifies whether the Neptune cluster is encrypted. The default is `false` if not specified.
+* `tags` - (Optional) A map of tags to assign to the Neptune cluster. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `vpcSecurityGroupIds` - (Optional) List of VPC security groups to associate with the Cluster
+* `deletionProtection` - (Optional) A value that indicates whether the DB cluster has deletion protection enabled.The database can't be deleted when deletion protection is enabled. By default, deletion protection is disabled.
+* `serverlessV2ScalingConfiguration` - (Optional) If set, create the Neptune cluster as a serverless one. See [Serverless](#serverless) for example block attributes.
+
+### Serverless
+
+**Neptune serverless has some limitations. Please see the [limitations on the AWS documentation](https://docs.aws.amazon.com/neptune/latest/userguide/neptune-serverless.html#neptune-serverless-limitations) before jumping into Neptune Serverless.**
+
+Neptune serverless requires that the `engineVersion` attribute must be `1201` or above. Also, you need to provide a cluster parameter group compatible with the family `neptune12`. In the example below, the default cluster parameter group is used.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { NeptuneCluster } from "./.gen/providers/aws/neptune-cluster";
+import { NeptuneClusterInstance } from "./.gen/providers/aws/neptune-cluster-instance";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new NeptuneCluster(this, "example", {
+      applyImmediately: true,
+      clusterIdentifier: "neptune-cluster-development",
+      engine: "neptune",
+      engineVersion: "1.2.0.1",
+      neptuneClusterParameterGroupName: "default.neptune1.2",
+      serverlessV2ScalingConfiguration: {},
+      skipFinalSnapshot: true,
+    });
+    const awsNeptuneClusterInstanceExample = new NeptuneClusterInstance(
+      this,
+      "example_1",
+      {
+        clusterIdentifier: example.clusterIdentifier,
+        instanceClass: "db.serverless",
+        neptuneParameterGroupName: "default.neptune1.2",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsNeptuneClusterInstanceExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+* `minCapacity`: (default: **2.5**) The minimum Neptune Capacity Units (NCUs) for this cluster. Must be greater or equal than **1**. See [AWS Documentation](https://docs.aws.amazon.com/neptune/latest/userguide/neptune-serverless-capacity-scaling.html) for more details.
+* `maxCapacity`: (default: **128**) The maximum Neptune Capacity Units (NCUs) for this cluster. Must be lower or equal than **128**. See [AWS Documentation](https://docs.aws.amazon.com/neptune/latest/userguide/neptune-serverless-capacity-scaling.html) for more details.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Neptune Cluster Amazon Resource Name (ARN)
+* `clusterResourceId` - The Neptune Cluster Resource ID
+* `clusterMembers` – List of Neptune Instances that are a part of this cluster
+* `endpoint` - The DNS address of the Neptune instance
+* `hostedZoneId` - The Route53 Hosted Zone ID of the endpoint
+* `id` - The Neptune Cluster Identifier
+* `readerEndpoint` - A read-only endpoint for the Neptune cluster, automatically load-balanced across replicas
+* `status` - The Neptune instance status
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `120M`)
+- `update` - (Default `120M`)
+- `delete` - (Default `120M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsNeptuneCluster` using the cluster identifier. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsNeptuneCluster` using the cluster identifier. For example:
+
+```console
+% terraform import aws_neptune_cluster.example my-cluster
+```
+
+<!-- cache-key: cdktf-0.18.0 input-b833b76b4e488cf6764ff463cd042f6a681a719ec523ce181193b508df5cc588 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/neptune_cluster_endpoint.html.markdown b/website/docs/cdktf/typescript/r/neptune_cluster_endpoint.html.markdown
new file mode 100644
index 00000000000..880e36104e3
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/neptune_cluster_endpoint.html.markdown
@@ -0,0 +1,81 @@
+---
+subcategory: "Neptune"
+layout: "aws"
+page_title: "AWS: aws_neptune_cluster_endpoint"
+description: |-
+  Provides an Neptune Cluster Endpoint Resource
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_neptune_cluster_endpoint
+
+Provides an Neptune Cluster Endpoint Resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { NeptuneClusterEndpoint } from "./.gen/providers/aws/neptune-cluster-endpoint";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new NeptuneClusterEndpoint(this, "example", {
+      clusterEndpointIdentifier: "example",
+      clusterIdentifier: test.clusterIdentifier,
+      endpointType: "READER",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `clusterIdentifier` - (Required, Forces new resources) The DB cluster identifier of the DB cluster associated with the endpoint.
+* `clusterEndpointIdentifier` - (Required, Forces new resources) The identifier of the endpoint.
+* `endpointType` - (Required) The type of the endpoint. One of: `reader`, `writer`, `any`.
+* `excludedMembers` - (Optional) List of DB instance identifiers that aren't part of the custom endpoint group. All other eligible instances are reachable through the custom endpoint. Only relevant if the list of static members is empty.
+* `staticMembers` - (Optional) List of DB instance identifiers that are part of the custom endpoint group.
+* `tags` - (Optional) A map of tags to assign to the Neptune cluster. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Neptune Cluster Endpoint Amazon Resource Name (ARN).
+* `endpoint` - The DNS address of the endpoint.
+* `id` - The Neptune Cluster Endpoint Identifier.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsNeptuneClusterEndpoint` using the `clusterIdentifier:endpointIdentfier`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsNeptuneClusterEndpoint` using the `clusterIdentifier:endpointIdentfier`. For example:
+
+```console
+% terraform import aws_neptune_cluster_endpoint.example my-cluster:my-endpoint
+```
+
+<!-- cache-key: cdktf-0.18.0 input-fe62dbee474ec48b5d17927f8e8d3998a36b2d1c434288d6e385def0ac966409 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/neptune_cluster_instance.html.markdown b/website/docs/cdktf/typescript/r/neptune_cluster_instance.html.markdown
new file mode 100644
index 00000000000..d8a2d65b163
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/neptune_cluster_instance.html.markdown
@@ -0,0 +1,131 @@
+---
+subcategory: "Neptune"
+layout: "aws"
+page_title: "AWS: aws_neptune_cluster_instance"
+description: |-
+  Provides an Neptune Cluster Resource Instance
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_neptune_cluster_instance
+
+A Cluster Instance Resource defines attributes that are specific to a single instance in a Neptune Cluster.
+
+You can simply add neptune instances and Neptune manages the replication. You can use the [count][1]
+meta-parameter to make multiple instances and join them all to the same Neptune Cluster, or you may specify different Cluster Instance resources with various `instanceClass` sizes.
+
+## Example Usage
+
+The following example will create a neptune cluster with two neptune instances(one writer and one reader).
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformCount, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { NeptuneCluster } from "./.gen/providers/aws/neptune-cluster";
+import { NeptuneClusterInstance } from "./.gen/providers/aws/neptune-cluster-instance";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const defaultVar = new NeptuneCluster(this, "default", {
+      applyImmediately: true,
+      backupRetentionPeriod: 5,
+      clusterIdentifier: "neptune-cluster-demo",
+      engine: "neptune",
+      iamDatabaseAuthenticationEnabled: true,
+      preferredBackupWindow: "07:00-09:00",
+      skipFinalSnapshot: true,
+    });
+    /*In most cases loops should be handled in the programming language context and 
+    not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+    you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+    you need to keep this like it is.*/
+    const exampleCount = TerraformCount.of(Token.asNumber("2"));
+    new NeptuneClusterInstance(this, "example", {
+      applyImmediately: true,
+      clusterIdentifier: defaultVar.id,
+      engine: "neptune",
+      instanceClass: "db.r4.large",
+      count: exampleCount,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `applyImmediately` - (Optional) Specifies whether any instance modifications
+  are applied immediately, or during the next maintenance window. Default is`false`.
+* `autoMinorVersionUpgrade` - (Optional) Indicates that minor engine upgrades will be applied automatically to the instance during the maintenance window. Default is `true`.
+* `availabilityZone` - (Optional) The EC2 Availability Zone that the neptune instance is created in.
+* `clusterIdentifier` - (Required) The identifier of the [`awsNeptuneCluster`](/docs/providers/aws/r/neptune_cluster.html) in which to launch this instance.
+* `engine` - (Optional) The name of the database engine to be used for the neptune instance. Defaults to `neptune`. Valid Values: `neptune`.
+* `engineVersion` - (Optional) The neptune engine version. Currently configuring this argumnet has no effect.
+* `identifier` - (Optional, Forces new resource) The identifier for the neptune instance, if omitted, Terraform will assign a random, unique identifier.
+* `identifierPrefix` - (Optional, Forces new resource) Creates a unique identifier beginning with the specified prefix. Conflicts with `identifier`.
+* `instanceClass` - (Required) The instance class to use.
+* `neptuneSubnetGroupName` - (Required if `publicly_accessible = false`, Optional otherwise) A subnet group to associate with this neptune instance. **NOTE:** This must match the `neptuneSubnetGroupName` of the attached [`awsNeptuneCluster`](/docs/providers/aws/r/neptune_cluster.html).
+* `neptuneParameterGroupName` - (Optional) The name of the neptune parameter group to associate with this instance.
+* `port` - (Optional) The port on which the DB accepts connections. Defaults to `8182`.
+* `preferredBackupWindow` - (Optional) The daily time range during which automated backups are created if automated backups are enabled. Eg: "04:00-09:00"
+* `preferredMaintenanceWindow` - (Optional) The window to perform maintenance in.
+  Syntax: "ddd:hh24:mi-ddd:hh24:mi". Eg: "Mon:00:00-Mon:03:00".
+* `promotionTier` - (Optional) Default 0. Failover Priority setting on instance level. The reader who has lower tier has higher priority to get promoter to writer.
+* `publiclyAccessible` - (Optional) Bool to control if instance is publicly accessible. Default is `false`.
+* `tags` - (Optional) A map of tags to assign to the instance. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `address` - The hostname of the instance. See also `endpoint` and `port`.
+* `arn` - Amazon Resource Name (ARN) of neptune instance
+* `dbiResourceId` - The region-unique, immutable identifier for the neptune instance.
+* `endpoint` - The connection endpoint in `address:port` format.
+* `id` - The Instance identifier
+* `kmsKeyArn` - The ARN for the KMS encryption key if one is set to the neptune cluster.
+* `storageEncrypted` - Specifies whether the neptune cluster is encrypted.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `writer` – Boolean indicating if this instance is writable. `false` indicates this instance is a read replica.
+
+[1]: https://www.terraform.io/docs/configuration/meta-arguments/count.html
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `90M`)
+- `update` - (Default `90M`)
+- `delete` - (Default `90M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsNeptuneClusterInstance` using the instance identifier. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsNeptuneClusterInstance` using the instance identifier. For example:
+
+```console
+% terraform import aws_neptune_cluster_instance.example my-instance
+```
+
+<!-- cache-key: cdktf-0.18.0 input-c9fbfba9a3319bef7009738e3db57be0a358b60956afc9ca57b4650ac05f9ef1 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/neptune_cluster_parameter_group.html.markdown b/website/docs/cdktf/typescript/r/neptune_cluster_parameter_group.html.markdown
new file mode 100644
index 00000000000..c0ab4ed2777
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/neptune_cluster_parameter_group.html.markdown
@@ -0,0 +1,92 @@
+---
+subcategory: "Neptune"
+layout: "aws"
+page_title: "AWS: aws_neptune_cluster_parameter_group"
+description: |-
+  Manages a Neptune Cluster Parameter Group
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_neptune_cluster_parameter_group
+
+Manages a Neptune Cluster Parameter Group
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { NeptuneClusterParameterGroup } from "./.gen/providers/aws/neptune-cluster-parameter-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new NeptuneClusterParameterGroup(this, "example", {
+      description: "neptune cluster parameter group",
+      family: "neptune1",
+      name: "example",
+      parameter: [
+        {
+          name: "neptune_enable_audit_log",
+          value: Token.asString(1),
+        },
+      ],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Optional, Forces new resource) The name of the neptune cluster parameter group. If omitted, Terraform will assign a random, unique name.
+* `namePrefix` - (Optional, Forces new resource) Creates a unique name beginning with the specified prefix. Conflicts with `name`.
+* `family` - (Required) The family of the neptune cluster parameter group.
+* `description` - (Optional) The description of the neptune cluster parameter group. Defaults to "Managed by Terraform".
+* `parameter` - (Optional) A list of neptune parameters to apply.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+Parameter blocks support the following:
+
+* `name` - (Required) The name of the neptune parameter.
+* `value` - (Required) The value of the neptune parameter.
+* `applyMethod` - (Optional) Valid values are `immediate` and `pendingReboot`. Defaults to `pendingReboot`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The neptune cluster parameter group name.
+* `arn` - The ARN of the neptune cluster parameter group.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Neptune Cluster Parameter Groups using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Neptune Cluster Parameter Groups using the `name`. For example:
+
+```console
+% terraform import aws_neptune_cluster_parameter_group.cluster_pg production-pg-1
+```
+
+<!-- cache-key: cdktf-0.18.0 input-3c39999f95e5475d491571cada3c79f247de16c4aa849b9cba8ecd969f7df95d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/neptune_cluster_snapshot.html.markdown b/website/docs/cdktf/typescript/r/neptune_cluster_snapshot.html.markdown
new file mode 100644
index 00000000000..98fe4691e06
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/neptune_cluster_snapshot.html.markdown
@@ -0,0 +1,90 @@
+---
+subcategory: "Neptune"
+layout: "aws"
+page_title: "AWS: aws_neptune_cluster_snapshot"
+description: |-
+  Manages a Neptune database cluster snapshot.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_neptune_cluster_snapshot
+
+Manages a Neptune database cluster snapshot.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { NeptuneClusterSnapshot } from "./.gen/providers/aws/neptune-cluster-snapshot";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new NeptuneClusterSnapshot(this, "example", {
+      dbClusterIdentifier: Token.asString(awsNeptuneClusterExample.id),
+      dbClusterSnapshotIdentifier: "resourcetestsnapshot1234",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `dbClusterIdentifier` - (Required) The DB Cluster Identifier from which to take the snapshot.
+* `dbClusterSnapshotIdentifier` - (Required) The Identifier for the snapshot.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `allocatedStorage` - Specifies the allocated storage size in gigabytes (GB).
+* `availabilityZones` - List of EC2 Availability Zones that instances in the DB cluster snapshot can be restored in.
+* `dbClusterSnapshotArn` - The Amazon Resource Name (ARN) for the DB Cluster Snapshot.
+* `engine` - Specifies the name of the database engine.
+* `engineVersion` - Version of the database engine for this DB cluster snapshot.
+* `kmsKeyId` - If storage_encrypted is true, the AWS KMS key identifier for the encrypted DB cluster snapshot.
+* `licenseModel` - License model information for the restored DB cluster.
+* `port` - Port that the DB cluster was listening on at the time of the snapshot.
+* `sourceDbClusterSnapshotIdentifier` - The DB Cluster Snapshot Arn that the DB Cluster Snapshot was copied from. It only has value in case of cross customer or cross region copy.
+* `storageEncrypted` - Specifies whether the DB cluster snapshot is encrypted.
+* `status` - The status of this DB Cluster Snapshot.
+* `vpcId` - The VPC ID associated with the DB cluster snapshot.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `20M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsNeptuneClusterSnapshot` using the cluster snapshot identifier. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsNeptuneClusterSnapshot` using the cluster snapshot identifier. For example:
+
+```console
+% terraform import aws_neptune_cluster_snapshot.example my-cluster-snapshot
+```
+
+<!-- cache-key: cdktf-0.18.0 input-9b22118c6b5ba9d2b522df8534493a26e09fc274f5e840772d7cfddb43741365 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/neptune_event_subscription.html.markdown b/website/docs/cdktf/typescript/r/neptune_event_subscription.html.markdown
new file mode 100644
index 00000000000..1817078b4ae
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/neptune_event_subscription.html.markdown
@@ -0,0 +1,136 @@
+---
+subcategory: "Neptune"
+layout: "aws"
+page_title: "AWS: aws_neptune_event_subscription"
+description: |-
+  Provides a Neptune event subscription resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_neptune_event_subscription
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { NeptuneCluster } from "./.gen/providers/aws/neptune-cluster";
+import { NeptuneClusterInstance } from "./.gen/providers/aws/neptune-cluster-instance";
+import { NeptuneEventSubscription } from "./.gen/providers/aws/neptune-event-subscription";
+import { SnsTopic } from "./.gen/providers/aws/sns-topic";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const defaultVar = new NeptuneCluster(this, "default", {
+      applyImmediately: Token.asBoolean("true"),
+      backupRetentionPeriod: 5,
+      clusterIdentifier: "neptune-cluster-demo",
+      engine: "neptune",
+      iamDatabaseAuthenticationEnabled: Token.asBoolean("true"),
+      preferredBackupWindow: "07:00-09:00",
+      skipFinalSnapshot: true,
+    });
+    const example = new NeptuneClusterInstance(this, "example", {
+      applyImmediately: Token.asBoolean("true"),
+      clusterIdentifier: defaultVar.id,
+      engine: "neptune",
+      instanceClass: "db.r4.large",
+    });
+    const awsSnsTopicDefault = new SnsTopic(this, "default_2", {
+      name: "neptune-events",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSnsTopicDefault.overrideLogicalId("default");
+    const awsNeptuneEventSubscriptionDefault = new NeptuneEventSubscription(
+      this,
+      "default_3",
+      {
+        eventCategories: [
+          "maintenance",
+          "availability",
+          "creation",
+          "backup",
+          "restoration",
+          "recovery",
+          "deletion",
+          "failover",
+          "failure",
+          "notification",
+          "configuration change",
+          "read replica",
+        ],
+        name: "neptune-event-sub",
+        snsTopicArn: Token.asString(awsSnsTopicDefault.arn),
+        sourceIds: [example.id],
+        sourceType: "db-instance",
+        tags: {
+          env: "test",
+        },
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsNeptuneEventSubscriptionDefault.overrideLogicalId("default");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `enabled` - (Optional) A boolean flag to enable/disable the subscription. Defaults to true.
+* `eventCategories` - (Optional) A list of event categories for a `sourceType` that you want to subscribe to. Run `aws neptune describe-event-categories` to find all the event categories.
+* `name` - (Optional) The name of the Neptune event subscription. By default generated by Terraform.
+* `namePrefix` - (Optional) The name of the Neptune event subscription. Conflicts with `name`.
+* `snsTopicArn` - (Required) The ARN of the SNS topic to send events to.
+* `sourceIds` - (Optional) A list of identifiers of the event sources for which events will be returned. If not specified, then all sources are included in the response. If specified, a `sourceType` must also be specified.
+* `sourceType` - (Optional) The type of source that will be generating the events. Valid options are `dbInstance`, `dbSecurityGroup`, `dbParameterGroup`, `dbSnapshot`, `dbCluster` or `dbClusterSnapshot`. If not set, all sources will be subscribed to.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name of the Neptune event notification subscription.
+* `arn` - The Amazon Resource Name of the Neptune event notification subscription.
+* `customerAwsId` - The AWS customer account associated with the Neptune event notification subscription.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `40M`)
+- `delete` - (Default `40M`)
+- `update` - (Default `40M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsNeptuneEventSubscription` using the event subscription name. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsNeptuneEventSubscription` using the event subscription name. For example:
+
+```console
+% terraform import aws_neptune_event_subscription.example my-event-subscription
+```
+
+<!-- cache-key: cdktf-0.18.0 input-e328d5c2f0ddd8aeab59e5a796150d1bafdd5b04018dd038f0bce4cd0cb07a04 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/neptune_global_cluster.html.markdown b/website/docs/cdktf/typescript/r/neptune_global_cluster.html.markdown
new file mode 100644
index 00000000000..eeda1a2c17b
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/neptune_global_cluster.html.markdown
@@ -0,0 +1,217 @@
+---
+subcategory: "Neptune"
+layout: "aws"
+page_title: "AWS: aws_neptune_global_cluster"
+description: |-
+  Provides an Neptune Global Cluster Resource
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_neptune_global_cluster
+
+Manages a Neptune Global Cluster. A global cluster consists of one primary region and up to five read-only secondary regions. You issue write operations directly to the primary cluster in the primary region and Amazon Neptune automatically replicates the data to the secondary regions using dedicated infrastructure.
+
+More information about Neptune Global Clusters can be found in the [Neptune User Guide](https://docs.aws.amazon.com/neptune/latest/userguide/neptune-global-database.html).
+
+## Example Usage
+
+### New Neptune Global Cluster
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { NeptuneCluster } from "./.gen/providers/aws/neptune-cluster";
+import { NeptuneClusterInstance } from "./.gen/providers/aws/neptune-cluster-instance";
+import { NeptuneGlobalCluster } from "./.gen/providers/aws/neptune-global-cluster";
+import { AwsProvider } from "./.gen/providers/aws/provider";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const primary = new AwsProvider(this, "aws", {
+      alias: "primary",
+      region: "us-east-2",
+    });
+    const secondary = new AwsProvider(this, "aws_1", {
+      alias: "secondary",
+      region: "us-east-1",
+    });
+    const example = new NeptuneGlobalCluster(this, "example", {
+      engine: "neptune",
+      engineVersion: "1.2.0.0",
+      globalClusterIdentifier: "global-test",
+    });
+    const awsNeptuneClusterPrimary = new NeptuneCluster(this, "primary", {
+      clusterIdentifier: "test-primary-cluster",
+      engine: example.engine,
+      engineVersion: example.engineVersion,
+      globalClusterIdentifier: example.id,
+      neptuneSubnetGroupName: "default",
+      provider: primary,
+    });
+    const awsNeptuneClusterSecondary = new NeptuneCluster(this, "secondary", {
+      clusterIdentifier: "test-secondary-cluster",
+      engine: example.engine,
+      engineVersion: example.engineVersion,
+      globalClusterIdentifier: example.id,
+      neptuneSubnetGroupName: "default",
+      provider: secondary,
+    });
+    const awsNeptuneClusterInstancePrimary = new NeptuneClusterInstance(
+      this,
+      "primary_5",
+      {
+        clusterIdentifier: Token.asString(awsNeptuneClusterPrimary.id),
+        engine: example.engine,
+        engineVersion: example.engineVersion,
+        identifier: "test-primary-cluster-instance",
+        instanceClass: "db.r5.large",
+        neptuneSubnetGroupName: "default",
+        provider: primary,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsNeptuneClusterInstancePrimary.overrideLogicalId("primary");
+    const awsNeptuneClusterInstanceSecondary = new NeptuneClusterInstance(
+      this,
+      "secondary_6",
+      {
+        clusterIdentifier: Token.asString(awsNeptuneClusterSecondary.id),
+        dependsOn: [awsNeptuneClusterInstancePrimary],
+        engine: example.engine,
+        engineVersion: example.engineVersion,
+        identifier: "test-secondary-cluster-instance",
+        instanceClass: "db.r5.large",
+        neptuneSubnetGroupName: "default",
+        provider: secondary,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsNeptuneClusterInstanceSecondary.overrideLogicalId("secondary");
+  }
+}
+
+```
+
+### New Global Cluster From Existing DB Cluster
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { NeptuneCluster } from "./.gen/providers/aws/neptune-cluster";
+import { NeptuneGlobalCluster } from "./.gen/providers/aws/neptune-global-cluster";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new NeptuneCluster(this, "example", {
+      lifecycle: {
+        ignoreChanges: [globalClusterIdentifier],
+      },
+    });
+    const awsNeptuneGlobalClusterExample = new NeptuneGlobalCluster(
+      this,
+      "example_1",
+      {
+        globalClusterIdentifier: "example",
+        sourceDbClusterIdentifier: example.arn,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsNeptuneGlobalClusterExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `globalClusterIdentifier` - (Required, Forces new resources) The global cluster identifier.
+* `deletionProtection` - (Optional) If the Global Cluster should have deletion protection enabled. The database can't be deleted when this value is set to `true`. The default is `false`.
+* `engine` - (Optional, Forces new resources) Name of the database engine to be used for this DB cluster. Terraform will only perform drift detection if a configuration value is provided. Current Valid values: `neptune`. Conflicts with `sourceDbClusterIdentifier`.
+* `engineVersion` - (Optional) Engine version of the global database. Upgrading the engine version will result in all cluster members being immediately updated and will.
+    * **NOTE:** Upgrading major versions is not supported.
+* `sourceDbClusterIdentifier` - (Optional) Amazon Resource Name (ARN) to use as the primary DB Cluster of the Global Cluster on creation. Terraform cannot perform drift detection of this value.
+* `storageEncrypted` - (Optional, Forces new resources) Specifies whether the DB cluster is encrypted. The default is `false` unless `sourceDbClusterIdentifier` is specified and encrypted. Terraform will only perform drift detection if a configuration value is provided.
+
+### Timeouts
+
+The `timeouts` block allows you to specify [timeouts](https://www.terraform.io/docs/configuration/blocks/resources/syntax.html#operation-timeouts) for certain actions:
+
+* `create` - (Defaults to 5 mins) Used when creating the Global Cluster
+* `update` - (Defaults to 120 mins) Used when updating the Global Cluster members (time is per member)
+* `delete` - (Defaults to 5 mins) Used when deleting the Global Cluster members (time is per member)
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Global Cluster Amazon Resource Name (ARN)
+* `globalClusterMembers` - Set of objects containing Global Cluster members.
+    * `dbClusterArn` - Amazon Resource Name (ARN) of member DB Cluster.
+    * `isWriter` - Whether the member is the primary DB Cluster.
+* `globalClusterResourceId` - AWS Region-unique, immutable identifier for the global database cluster. This identifier is found in AWS CloudTrail log entries whenever the AWS KMS key for the DB cluster is accessed.
+* `id` - Neptune Global Cluster.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsNeptuneGlobalCluster` using the Global Cluster identifier. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsNeptuneGlobalCluster` using the Global Cluster identifier. For example:
+
+```console
+% terraform import aws_neptune_global_cluster.example example
+```
+
+Certain resource arguments, like `sourceDbClusterIdentifier`, do not have an API method for reading the information after creation. If the argument is set in the Terraform configuration on an imported resource, Terraform will always show a difference. To workaround this behavior, either omit the argument from the Terraform configuration or use [`ignoreChanges`](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html#ignore_changes) to hide the difference. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { NeptuneGlobalCluster } from "./.gen/providers/aws/neptune-global-cluster";
+interface MyConfig {
+  globalClusterIdentifier: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new NeptuneGlobalCluster(this, "example", {
+      lifecycle: {
+        ignoreChanges: [sourceDbClusterIdentifier],
+      },
+      globalClusterIdentifier: config.globalClusterIdentifier,
+    });
+  }
+}
+
+```
+
+<!-- cache-key: cdktf-0.18.0 input-8950ed9539f8cfa73cf920a0d999502a62c1a0cc78e2fc0e44cf362c351b01bc -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/neptune_parameter_group.html.markdown b/website/docs/cdktf/typescript/r/neptune_parameter_group.html.markdown
new file mode 100644
index 00000000000..c7626753b05
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/neptune_parameter_group.html.markdown
@@ -0,0 +1,90 @@
+---
+subcategory: "Neptune"
+layout: "aws"
+page_title: "AWS: aws_neptune_parameter_group"
+description: |-
+  Manages a Neptune Parameter Group
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_neptune_parameter_group
+
+Manages a Neptune Parameter Group
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { NeptuneParameterGroup } from "./.gen/providers/aws/neptune-parameter-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new NeptuneParameterGroup(this, "example", {
+      family: "neptune1",
+      name: "example",
+      parameter: [
+        {
+          name: "neptune_query_timeout",
+          value: "25",
+        },
+      ],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required, Forces new resource) The name of the Neptune parameter group.
+* `family` - (Required) The family of the Neptune parameter group.
+* `description` - (Optional) The description of the Neptune parameter group. Defaults to "Managed by Terraform".
+* `parameter` - (Optional) A list of Neptune parameters to apply.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+Parameter blocks support the following:
+
+* `name`  - (Required) The name of the Neptune parameter.
+* `value` - (Required) The value of the Neptune parameter.
+* `applyMethod` - (Optional) The apply method of the Neptune parameter. Valid values are `immediate` and `pendingReboot`. Defaults to `pendingReboot`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Neptune parameter group name.
+* `arn` - The Neptune parameter group Amazon Resource Name (ARN).
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Neptune Parameter Groups using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Neptune Parameter Groups using the `name`. For example:
+
+```console
+% terraform import aws_neptune_parameter_group.some_pg some-pg
+```
+
+<!-- cache-key: cdktf-0.18.0 input-a1cb01e0292301b60c4b212670b59774de132158f48ab1dd04de5f6d3fa58b10 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/neptune_subnet_group.html.markdown b/website/docs/cdktf/typescript/r/neptune_subnet_group.html.markdown
new file mode 100644
index 00000000000..ad802d16da1
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/neptune_subnet_group.html.markdown
@@ -0,0 +1,81 @@
+---
+subcategory: "Neptune"
+layout: "aws"
+page_title: "AWS: aws_neptune_subnet_group"
+description: |-
+  Provides an Neptune subnet group resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_neptune_subnet_group
+
+Provides an Neptune subnet group resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { NeptuneSubnetGroup } from "./.gen/providers/aws/neptune-subnet-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new NeptuneSubnetGroup(this, "default", {
+      name: "main",
+      subnetIds: [frontend.id, backend.id],
+      tags: {
+        Name: "My neptune subnet group",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Optional, Forces new resource) The name of the neptune subnet group. If omitted, Terraform will assign a random, unique name.
+* `namePrefix` - (Optional, Forces new resource) Creates a unique name beginning with the specified prefix. Conflicts with `name`.
+* `description` - (Optional) The description of the neptune subnet group. Defaults to "Managed by Terraform".
+* `subnetIds` - (Required) A list of VPC subnet IDs.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The neptune subnet group name.
+* `arn` - The ARN of the neptune subnet group.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Neptune Subnet groups using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Neptune Subnet groups using the `name`. For example:
+
+```console
+% terraform import aws_neptune_subnet_group.default production-subnet-group
+```
+
+<!-- cache-key: cdktf-0.18.0 input-53e6d83abbeef75d682c8e96e0c61b5253d9fcdeb05d7a8efb0eea6a96d2b5d2 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/network_acl.html.markdown b/website/docs/cdktf/typescript/r/network_acl.html.markdown
new file mode 100644
index 00000000000..36e698a6f97
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/network_acl.html.markdown
@@ -0,0 +1,134 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_network_acl"
+description: |-
+  Provides an network ACL resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_network_acl
+
+Provides an network ACL resource. You might set up network ACLs with rules similar
+to your security groups in order to add an additional layer of security to your VPC.
+
+~> **NOTE on Network ACLs and Network ACL Rules:** Terraform currently
+provides both a standalone [Network ACL Rule](network_acl_rule.html) resource and a Network ACL resource with rules
+defined in-line. At this time you cannot use a Network ACL with in-line rules
+in conjunction with any Network ACL Rule resources. Doing so will cause
+a conflict of rule settings and will overwrite rules.
+
+~> **NOTE on Network ACLs and Network ACL Associations:** Terraform provides both a standalone [network ACL association](network_acl_association.html)
+resource and a network ACL resource with a `subnetIds` attribute. Do not use the same subnet ID in both a network ACL
+resource and a network ACL association resource. Doing so will cause a conflict of associations and will overwrite the association.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { NetworkAcl } from "./.gen/providers/aws/network-acl";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new NetworkAcl(this, "main", {
+      egress: [
+        {
+          action: "allow",
+          cidrBlock: "10.3.0.0/18",
+          fromPort: 443,
+          protocol: "tcp",
+          ruleNo: 200,
+          toPort: 443,
+        },
+      ],
+      ingress: [
+        {
+          action: "allow",
+          cidrBlock: "10.3.0.0/18",
+          fromPort: 80,
+          protocol: "tcp",
+          ruleNo: 100,
+          toPort: 80,
+        },
+      ],
+      tags: {
+        Name: "main",
+      },
+      vpcId: Token.asString(awsVpcMain.id),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `vpcId` - (Required) The ID of the associated VPC.
+* `subnetIds` - (Optional) A list of Subnet IDs to apply the ACL to
+* `ingress` - (Optional) Specifies an ingress rule. Parameters defined below.
+  This argument is processed in [attribute-as-blocks mode](https://www.terraform.io/docs/configuration/attr-as-blocks.html).
+* `egress` - (Optional) Specifies an egress rule. Parameters defined below.
+  This argument is processed in [attribute-as-blocks mode](https://www.terraform.io/docs/configuration/attr-as-blocks.html).
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### egress and ingress
+
+Both arguments are processed in [attribute-as-blocks mode](https://www.terraform.io/docs/configuration/attr-as-blocks.html).
+
+Both `egress` and `ingress` support the following keys:
+
+* `fromPort` - (Required) The from port to match.
+* `toPort` - (Required) The to port to match.
+* `ruleNo` - (Required) The rule number. Used for ordering.
+* `action` - (Required) The action to take.
+* `protocol` - (Required) The protocol to match. If using the -1 'all'
+protocol, you must specify a from and to port of 0.
+* `cidrBlock` - (Optional) The CIDR block to match. This must be a
+valid network mask.
+* `ipv6CidrBlock` - (Optional) The IPv6 CIDR block.
+* `icmpType` - (Optional) The ICMP type to be used. Default 0.
+* `icmpCode` - (Optional) The ICMP type code to be used. Default 0.
+
+~> Note: For more information on ICMP types and codes, see here: https://www.iana.org/assignments/icmp-parameters/icmp-parameters.xhtml
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the network ACL
+* `arn` - The ARN of the network ACL
+* `ownerId` - The ID of the AWS account that owns the network ACL.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Network ACLs using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Network ACLs using the `id`. For example:
+
+```console
+% terraform import aws_network_acl.main acl-7aaabd18
+```
+
+<!-- cache-key: cdktf-0.18.0 input-5b9f089b5a06ae7544fcc277d74d9e0edb7b4bb28c855db30503815cfb46f3a1 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/network_acl_association.html.markdown b/website/docs/cdktf/typescript/r/network_acl_association.html.markdown
new file mode 100644
index 00000000000..9352357c4d3
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/network_acl_association.html.markdown
@@ -0,0 +1,55 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_network_acl_association"
+description: |-
+  Provides an network ACL association resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_network_acl_association
+
+Provides an network ACL association resource which allows you to associate your network ACL with any subnet(s).
+
+~> **NOTE on Network ACLs and Network ACL Associations:** Terraform provides both a standalone network ACL association resource
+and a [network ACL](network_acl.html) resource with a `subnetIds` attribute. Do not use the same subnet ID in both a network ACL
+resource and a network ACL association resource. Doing so will cause a conflict of associations and will overwrite the association.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { NetworkAclAssociation } from "./.gen/providers/aws/network-acl-association";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new NetworkAclAssociation(this, "main", {
+      networkAclId: Token.asString(awsNetworkAclMain.id),
+      subnetId: Token.asString(awsSubnetMain.id),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `networkAclId` - (Required) The ID of the network ACL.
+* `subnetId` - (Required) The ID of the associated Subnet.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the network ACL association
+
+<!-- cache-key: cdktf-0.18.0 input-92947d863f3641bf06816a6812d14a2026718b19daf92b58b0b433978e506cb9 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/network_acl_rule.html.markdown b/website/docs/cdktf/typescript/r/network_acl_rule.html.markdown
new file mode 100644
index 00000000000..21795792c0c
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/network_acl_rule.html.markdown
@@ -0,0 +1,134 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_network_acl_rule"
+description: |-
+  Provides an network ACL Rule resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_network_acl_rule
+
+Creates an entry (a rule) in a network ACL with the specified rule number.
+
+~> **NOTE on Network ACLs and Network ACL Rules:** Terraform currently
+provides both a standalone Network ACL Rule resource and a [Network ACL](network_acl.html) resource with rules
+defined in-line. At this time you cannot use a Network ACL with in-line rules
+in conjunction with any Network ACL Rule resources. Doing so will cause
+a conflict of rule settings and will overwrite rules.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { NetworkAcl } from "./.gen/providers/aws/network-acl";
+import { NetworkAclRule } from "./.gen/providers/aws/network-acl-rule";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const bar = new NetworkAcl(this, "bar", {
+      vpcId: foo.id,
+    });
+    const awsNetworkAclRuleBar = new NetworkAclRule(this, "bar_1", {
+      cidrBlock: foo.cidrBlock,
+      egress: false,
+      fromPort: 22,
+      networkAclId: bar.id,
+      protocol: "tcp",
+      ruleAction: "allow",
+      ruleNumber: 200,
+      toPort: 22,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsNetworkAclRuleBar.overrideLogicalId("bar");
+  }
+}
+
+```
+
+~> **Note:** One of either `cidrBlock` or `ipv6CidrBlock` is required.
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `networkAclId` - (Required) The ID of the network ACL.
+* `ruleNumber` - (Required) The rule number for the entry (for example, 100). ACL entries are processed in ascending order by rule number.
+* `egress` - (Optional, bool) Indicates whether this is an egress rule (rule is applied to traffic leaving the subnet). Default `false`.
+* `protocol` - (Required) The protocol. A value of -1 means all protocols.
+* `ruleAction` - (Required) Indicates whether to allow or deny the traffic that matches the rule. Accepted values: `allow` | `deny`
+* `cidrBlock` - (Optional) The network range to allow or deny, in CIDR notation (for example 172.16.0.0/24 ).
+* `ipv6CidrBlock` - (Optional) The IPv6 CIDR block to allow or deny.
+* `fromPort` - (Optional) The from port to match.
+* `toPort` - (Optional) The to port to match.
+* `icmpType` - (Optional) ICMP protocol: The ICMP type. Required if specifying ICMP for the protocolE.g., -1
+* `icmpCode` - (Optional) ICMP protocol: The ICMP code. Required if specifying ICMP for the protocolE.g., -1
+
+~> **NOTE:** If the value of `protocol` is `1` or `all`, the `fromPort` and `toPort` values will be ignored and the rule will apply to all ports.
+
+~> **NOTE:** If the value of `icmpType` is `1` (which results in a wildcard ICMP type), the `icmpCode` must also be set to `1` (wildcard ICMP code).
+
+~> Note: For more information on ICMP types and codes, see here: https://www.iana.org/assignments/icmp-parameters/icmp-parameters.xhtml
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the network ACL Rule
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import individual rules using `networkAclId:ruleNumber:protocol:egress`, where `protocol` can be a decimal (such as "6") or string (such as "tcp") value. For example:
+
+**NOTE:** If importing a rule previously provisioned by Terraform, the `protocol` must be the input value used at creation time. For more information on protocol numbers and keywords, see here: https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml.
+
+Using the procotol's string value:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using the procotol's decimal value:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+**Using `terraform import` to import** individual rules using `networkAclId:ruleNumber:protocol:egress`, where `protocol` can be a decimal (such as "6") or string (such as "tcp") value. For example:
+
+Using the procotol's string value:
+
+```console
+% terraform import aws_network_acl_rule.my_rule acl-7aaabd18:100:tcp:false
+```
+
+Using the procotol's decimal value:
+
+```console
+% terraform import aws_network_acl_rule.my_rule acl-7aaabd18:100:6:false
+```
+
+<!-- cache-key: cdktf-0.18.0 input-0bee1d657a21ade598a9d4b01c7ed38ce1ada8aeab9c5dd0de56c1ba6dff131d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/network_interface.html.markdown b/website/docs/cdktf/typescript/r/network_interface.html.markdown
new file mode 100644
index 00000000000..5630ca00ff4
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/network_interface.html.markdown
@@ -0,0 +1,129 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_network_interface"
+description: |-
+  Provides an Elastic network interface (ENI) resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_network_interface
+
+Provides an Elastic network interface (ENI) resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { NetworkInterface } from "./.gen/providers/aws/network-interface";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new NetworkInterface(this, "test", {
+      attachment: [
+        {
+          deviceIndex: 1,
+          instance: Token.asString(awsInstanceTest.id),
+        },
+      ],
+      privateIps: ["10.0.0.50"],
+      securityGroups: [web.id],
+      subnetId: publicA.id,
+    });
+  }
+}
+
+```
+
+### Example of Managing Multiple IPs on a Network Interface
+
+By default, private IPs are managed through the `privateIps` and `privateIpsCount` arguments which manage IPs as a set of IPs that are configured without regard to order. For a new network interface, the same primary IP address is consistently selected from a given set of addresses, regardless of the order provided. However, modifications of the set of addresses of an existing interface will not alter the current primary IP address unless it has been removed from the set.
+
+In order to manage the private IPs as a sequentially ordered list, configure `privateIpListEnabled` to `true` and use `privateIpList` to manage the IPs. This will disable the `privateIps` and `privateIpsCount` settings, which must be removed from the config file but are still exported. Note that changing the first address of `privateIpList`, which is the primary, always requires a new interface.
+
+If you are managing a specific set or list of IPs, instead of just using `privateIpsCount`, this is a potential workflow for also leveraging `privateIpsCount` to have AWS automatically assign additional IP addresses:
+
+1. Comment out `privateIps`, `privateIpList`, `privateIpListEnabled` in your configuration
+2. Set the desired `privateIpsCount` (count of the number of secondaries, the primary is not included)
+3. Apply to assign the extra IPs
+4. Remove `privateIpsCount` and restore your settings from the first step
+5. Add the new IPs to your current settings
+6. Apply again to update the stored state
+
+This process can also be used to remove IP addresses in addition to the option of manually removing them. Adding IP addresses in a manually is more difficult because it requires knowledge of which addresses are available.
+
+## Argument Reference
+
+The following arguments are required:
+
+* `subnetId` - (Required) Subnet ID to create the ENI in.
+
+The following arguments are optional:
+
+* `attachment` - (Optional) Configuration block to define the attachment of the ENI. See [Attachment](#attachment) below for more details!
+* `description` - (Optional) Description for the network interface.
+* `interfaceType` - (Optional) Type of network interface to create. Set to `efa` for Elastic Fabric Adapter. Changing `interfaceType` will cause the resource to be destroyed and re-created.
+* `ipv4PrefixCount` - (Optional) Number of IPv4 prefixes that AWS automatically assigns to the network interface.
+* `ipv4Prefixes` - (Optional) One or more IPv4 prefixes assigned to the network interface.
+* `ipv6AddressCount` - (Optional) Number of IPv6 addresses to assign to a network interface. You can't use this option if specifying specific `ipv6Addresses`. If your subnet has the AssignIpv6AddressOnCreation attribute set to `true`, you can specify `0` to override this setting.
+* `ipv6AddressListEnabled` - (Optional) Whether `ipv6AddressList` is allowed and controls the IPs to assign to the ENI and `ipv6Addresses` and `ipv6AddressCount` become read-only. Default false.
+* `ipv6AddressList` - (Optional) List of private IPs to assign to the ENI in sequential order.
+* `ipv6Addresses` - (Optional) One or more specific IPv6 addresses from the IPv6 CIDR block range of your subnet. Addresses are assigned without regard to order. You can't use this option if you're specifying `ipv6AddressCount`.
+* `ipv6PrefixCount` - (Optional) Number of IPv6 prefixes that AWS automatically assigns to the network interface.
+* `ipv6Prefixes` - (Optional) One or more IPv6 prefixes assigned to the network interface.
+* `privateIpList` - (Optional) List of private IPs to assign to the ENI in sequential order. Requires setting `privateIpListEnabled` to `true`.
+* `privateIpListEnabled` - (Optional) Whether `privateIpList` is allowed and controls the IPs to assign to the ENI and `privateIps` and `privateIpsCount` become read-only. Default false.
+* `privateIps` - (Optional) List of private IPs to assign to the ENI without regard to order.
+* `privateIpsCount` - (Optional) Number of secondary private IPs to assign to the ENI. The total number of private IPs will be 1 + `privateIpsCount`, as a primary private IP will be assiged to an ENI by default.
+* `securityGroups` - (Optional) List of security group IDs to assign to the ENI.
+* `sourceDestCheck` - (Optional) Whether to enable source destination checking for the ENI. Default true.
+* `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Attachment
+
+The `attachment` block supports the following:
+
+* `instance` - (Required) ID of the instance to attach to.
+* `deviceIndex` - (Required) Integer to define the devices index.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the network interface.
+* `id` - ID of the network interface.
+* `macAddress` - MAC address of the network interface.
+* `ownerId` - AWS account ID of the owner of the network interface.
+* `privateDnsName` - Private DNS name of the network interface (IPv4).
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Network Interfaces using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Network Interfaces using the `id`. For example:
+
+```console
+% terraform import aws_network_interface.test eni-e5aa89a3
+```
+
+<!-- cache-key: cdktf-0.18.0 input-7f2ff19c4ccb49477839bee2fe3fa02741d97eacf5edb9c2e7ff7560c3a15031 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/network_interface.markdown b/website/docs/cdktf/typescript/r/network_interface.markdown
new file mode 100644
index 00000000000..5630ca00ff4
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/network_interface.markdown
@@ -0,0 +1,129 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_network_interface"
+description: |-
+  Provides an Elastic network interface (ENI) resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_network_interface
+
+Provides an Elastic network interface (ENI) resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { NetworkInterface } from "./.gen/providers/aws/network-interface";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new NetworkInterface(this, "test", {
+      attachment: [
+        {
+          deviceIndex: 1,
+          instance: Token.asString(awsInstanceTest.id),
+        },
+      ],
+      privateIps: ["10.0.0.50"],
+      securityGroups: [web.id],
+      subnetId: publicA.id,
+    });
+  }
+}
+
+```
+
+### Example of Managing Multiple IPs on a Network Interface
+
+By default, private IPs are managed through the `privateIps` and `privateIpsCount` arguments which manage IPs as a set of IPs that are configured without regard to order. For a new network interface, the same primary IP address is consistently selected from a given set of addresses, regardless of the order provided. However, modifications of the set of addresses of an existing interface will not alter the current primary IP address unless it has been removed from the set.
+
+In order to manage the private IPs as a sequentially ordered list, configure `privateIpListEnabled` to `true` and use `privateIpList` to manage the IPs. This will disable the `privateIps` and `privateIpsCount` settings, which must be removed from the config file but are still exported. Note that changing the first address of `privateIpList`, which is the primary, always requires a new interface.
+
+If you are managing a specific set or list of IPs, instead of just using `privateIpsCount`, this is a potential workflow for also leveraging `privateIpsCount` to have AWS automatically assign additional IP addresses:
+
+1. Comment out `privateIps`, `privateIpList`, `privateIpListEnabled` in your configuration
+2. Set the desired `privateIpsCount` (count of the number of secondaries, the primary is not included)
+3. Apply to assign the extra IPs
+4. Remove `privateIpsCount` and restore your settings from the first step
+5. Add the new IPs to your current settings
+6. Apply again to update the stored state
+
+This process can also be used to remove IP addresses in addition to the option of manually removing them. Adding IP addresses in a manually is more difficult because it requires knowledge of which addresses are available.
+
+## Argument Reference
+
+The following arguments are required:
+
+* `subnetId` - (Required) Subnet ID to create the ENI in.
+
+The following arguments are optional:
+
+* `attachment` - (Optional) Configuration block to define the attachment of the ENI. See [Attachment](#attachment) below for more details!
+* `description` - (Optional) Description for the network interface.
+* `interfaceType` - (Optional) Type of network interface to create. Set to `efa` for Elastic Fabric Adapter. Changing `interfaceType` will cause the resource to be destroyed and re-created.
+* `ipv4PrefixCount` - (Optional) Number of IPv4 prefixes that AWS automatically assigns to the network interface.
+* `ipv4Prefixes` - (Optional) One or more IPv4 prefixes assigned to the network interface.
+* `ipv6AddressCount` - (Optional) Number of IPv6 addresses to assign to a network interface. You can't use this option if specifying specific `ipv6Addresses`. If your subnet has the AssignIpv6AddressOnCreation attribute set to `true`, you can specify `0` to override this setting.
+* `ipv6AddressListEnabled` - (Optional) Whether `ipv6AddressList` is allowed and controls the IPs to assign to the ENI and `ipv6Addresses` and `ipv6AddressCount` become read-only. Default false.
+* `ipv6AddressList` - (Optional) List of private IPs to assign to the ENI in sequential order.
+* `ipv6Addresses` - (Optional) One or more specific IPv6 addresses from the IPv6 CIDR block range of your subnet. Addresses are assigned without regard to order. You can't use this option if you're specifying `ipv6AddressCount`.
+* `ipv6PrefixCount` - (Optional) Number of IPv6 prefixes that AWS automatically assigns to the network interface.
+* `ipv6Prefixes` - (Optional) One or more IPv6 prefixes assigned to the network interface.
+* `privateIpList` - (Optional) List of private IPs to assign to the ENI in sequential order. Requires setting `privateIpListEnabled` to `true`.
+* `privateIpListEnabled` - (Optional) Whether `privateIpList` is allowed and controls the IPs to assign to the ENI and `privateIps` and `privateIpsCount` become read-only. Default false.
+* `privateIps` - (Optional) List of private IPs to assign to the ENI without regard to order.
+* `privateIpsCount` - (Optional) Number of secondary private IPs to assign to the ENI. The total number of private IPs will be 1 + `privateIpsCount`, as a primary private IP will be assiged to an ENI by default.
+* `securityGroups` - (Optional) List of security group IDs to assign to the ENI.
+* `sourceDestCheck` - (Optional) Whether to enable source destination checking for the ENI. Default true.
+* `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Attachment
+
+The `attachment` block supports the following:
+
+* `instance` - (Required) ID of the instance to attach to.
+* `deviceIndex` - (Required) Integer to define the devices index.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the network interface.
+* `id` - ID of the network interface.
+* `macAddress` - MAC address of the network interface.
+* `ownerId` - AWS account ID of the owner of the network interface.
+* `privateDnsName` - Private DNS name of the network interface (IPv4).
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Network Interfaces using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Network Interfaces using the `id`. For example:
+
+```console
+% terraform import aws_network_interface.test eni-e5aa89a3
+```
+
+<!-- cache-key: cdktf-0.18.0 input-7f2ff19c4ccb49477839bee2fe3fa02741d97eacf5edb9c2e7ff7560c3a15031 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/network_interface_attachment.html.markdown b/website/docs/cdktf/typescript/r/network_interface_attachment.html.markdown
new file mode 100644
index 00000000000..dbb05980114
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/network_interface_attachment.html.markdown
@@ -0,0 +1,78 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_network_interface_attachment"
+description: |-
+  Attach an Elastic network interface (ENI) resource with EC2 instance.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_network_interface_attachment
+
+Attach an Elastic network interface (ENI) resource with EC2 instance.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { NetworkInterfaceAttachmentA } from "./.gen/providers/aws/network-interface-attachment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new NetworkInterfaceAttachmentA(this, "test", {
+      deviceIndex: 0,
+      instanceId: Token.asString(awsInstanceTest.id),
+      networkInterfaceId: Token.asString(awsNetworkInterfaceTest.id),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `instanceId` - (Required) Instance ID to attach.
+* `networkInterfaceId` - (Required) ENI ID to attach.
+* `deviceIndex` - (Required) Network interface index (int).
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `instanceId` - Instance ID.
+* `networkInterfaceId` - Network interface ID.
+* `attachmentId` - The ENI Attachment ID.
+* `status` - The status of the Network Interface Attachment.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Elastic network interface (ENI) Attachments using its Attachment ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Elastic network interface (ENI) Attachments using its Attachment ID. For example:
+
+```console
+% terraform import aws_network_interface_attachment.secondary_nic eni-attach-0a33842b4ec347c4c
+```
+
+<!-- cache-key: cdktf-0.18.0 input-c857f5e1172a1f296e98c2334fec654cb012784f50f94349ede0b2f1a99701bf -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/network_interface_sg_attachment.html.markdown b/website/docs/cdktf/typescript/r/network_interface_sg_attachment.html.markdown
new file mode 100644
index 00000000000..140a404991d
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/network_interface_sg_attachment.html.markdown
@@ -0,0 +1,147 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_network_interface_sg_attachment"
+description: |-
+  Associates a security group with a network interface.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_network_interface_sg_attachment
+
+This resource attaches a security group to an Elastic Network Interface (ENI).
+It can be used to attach a security group to any existing ENI, be it a
+secondary ENI or one attached as the primary interface on an instance.
+
+~> **NOTE on instances, interfaces, and security groups:** Terraform currently
+provides the capability to assign security groups via the [`awsInstance`][1]
+and the [`awsNetworkInterface`][2] resources. Using this resource in
+conjunction with security groups provided in-line in those resources will cause
+conflicts, and will lead to spurious diffs and undefined behavior - please use
+one or the other.
+
+[1]: /docs/providers/aws/d/instance.html
+[2]: /docs/providers/aws/r/network_interface.html
+
+## Example Usage
+
+The following provides a very basic example of setting up an instance (provided
+by `instance`) in the default security group, creating a security group
+(provided by `sg`) and then attaching the security group to the instance's
+primary network interface via the `awsNetworkInterfaceSgAttachment` resource,
+named `sgAttachment`:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsAmi } from "./.gen/providers/aws/data-aws-ami";
+import { Instance } from "./.gen/providers/aws/instance";
+import { NetworkInterfaceSgAttachment } from "./.gen/providers/aws/network-interface-sg-attachment";
+import { SecurityGroup } from "./.gen/providers/aws/security-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const sg = new SecurityGroup(this, "sg", {
+      tags: {
+        type: "terraform-test-security-group",
+      },
+    });
+    const ami = new DataAwsAmi(this, "ami", {
+      filter: [
+        {
+          name: "name",
+          values: ["amzn-ami-hvm-*"],
+        },
+      ],
+      mostRecent: true,
+      owners: ["amazon"],
+    });
+    const instance = new Instance(this, "instance", {
+      ami: Token.asString(ami.id),
+      instanceType: "t2.micro",
+      tags: {
+        type: "terraform-test-instance",
+      },
+    });
+    new NetworkInterfaceSgAttachment(this, "sg_attachment", {
+      networkInterfaceId: instance.primaryNetworkInterfaceId,
+      securityGroupId: sg.id,
+    });
+  }
+}
+
+```
+
+In this example, `instance` is provided by the `awsInstance` data source,
+fetching an external instance, possibly not managed by Terraform.
+`sgAttachment` then attaches to the output instance's `networkInterfaceId`:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsInstance } from "./.gen/providers/aws/data-aws-instance";
+import { NetworkInterfaceSgAttachment } from "./.gen/providers/aws/network-interface-sg-attachment";
+import { SecurityGroup } from "./.gen/providers/aws/security-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const sg = new SecurityGroup(this, "sg", {
+      tags: {
+        type: "terraform-test-security-group",
+      },
+    });
+    const instance = new DataAwsInstance(this, "instance", {
+      instanceId: "i-1234567890abcdef0",
+    });
+    new NetworkInterfaceSgAttachment(this, "sg_attachment", {
+      networkInterfaceId: Token.asString(instance.networkInterfaceId),
+      securityGroupId: sg.id,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `securityGroupId` - (Required) The ID of the security group.
+* `networkInterfaceId` - (Required) The ID of the network interface to attach to.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Network Interface Security Group attachments using the associated network interface ID and security group ID, separated by an underscore (`_`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Network Interface Security Group attachments using the associated network interface ID and security group ID, separated by an underscore (`_`). For example:
+
+```console
+% terraform import aws_network_interface_sg_attachment.sg_attachment eni-1234567890abcdef0_sg-1234567890abcdef0
+```
+
+<!-- cache-key: cdktf-0.18.0 input-42a38bfce28cae01d1d650740e7e33388caa9a68bec2272acf8014a3939bb8a8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/networkfirewall_firewall.html.markdown b/website/docs/cdktf/typescript/r/networkfirewall_firewall.html.markdown
new file mode 100644
index 00000000000..d448e44ed85
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/networkfirewall_firewall.html.markdown
@@ -0,0 +1,129 @@
+---
+subcategory: "Network Firewall"
+layout: "aws"
+page_title: "AWS: aws_networkfirewall_firewall"
+description: |-
+  Provides an AWS Network Firewall Firewall resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_networkfirewall_firewall
+
+Provides an AWS Network Firewall Firewall Resource
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { NetworkfirewallFirewall } from "./.gen/providers/aws/networkfirewall-firewall";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new NetworkfirewallFirewall(this, "example", {
+      firewallPolicyArn: Token.asString(
+        awsNetworkfirewallFirewallPolicyExample.arn
+      ),
+      name: "example",
+      subnetMapping: [
+        {
+          subnetId: Token.asString(awsSubnetExample.id),
+        },
+      ],
+      tags: {
+        Tag1: "Value1",
+        Tag2: "Value2",
+      },
+      vpcId: Token.asString(awsVpcExample.id),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `deleteProtection` - (Optional) A boolean flag indicating whether it is possible to delete the firewall. Defaults to `false`.
+
+* `description` - (Optional) A friendly description of the firewall.
+
+* `encryptionConfiguration` - (Optional) KMS encryption configuration settings. See [Encryption Configuration](#encryption-configuration) below for details.
+
+* `firewallPolicyArn` - (Required) The Amazon Resource Name (ARN) of the VPC Firewall policy.
+
+* `firewallPolicyChangeProtection` - (Option) A boolean flag indicating whether it is possible to change the associated firewall policy. Defaults to `false`.
+
+* `name` - (Required, Forces new resource) A friendly name of the firewall.
+
+* `subnetChangeProtection` - (Optional) A boolean flag indicating whether it is possible to change the associated subnet(s). Defaults to `false`.
+
+* `subnetMapping` - (Required) Set of configuration blocks describing the public subnets. Each subnet must belong to a different Availability Zone in the VPC. AWS Network Firewall creates a firewall endpoint in each subnet. See [Subnet Mapping](#subnet-mapping) below for details.
+
+* `tags` - (Optional) Map of resource tags to associate with the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+* `vpcId` - (Required, Forces new resource) The unique identifier of the VPC where AWS Network Firewall should create the firewall.
+
+### Encryption Configuration
+
+`encryptionConfiguration` settings for customer managed KMS keys. Remove this block to use the default AWS-managed KMS encryption (rather than setting `type` to `awsOwnedKmsKey`).
+
+* `keyId` - (Optional) The ID of the customer managed key. You can use any of the [key identifiers](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-id) that KMS supports, unless you're using a key that's managed by another account. If you're using a key managed by another account, then specify the key ARN.
+* `type` - (Required) The type of AWS KMS key to use for encryption of your Network Firewall resources. Valid values are `customerKms` and `awsOwnedKmsKey`.
+
+### Subnet Mapping
+
+The `subnetMapping` block supports the following arguments:
+
+* `ipAddressType` - (Optional) The subnet's IP address type. Valida values: `"dualstack"`, `"ipv4"`.
+* `subnetId` - (Required) The unique identifier for the subnet.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Amazon Resource Name (ARN) that identifies the firewall.
+
+* `arn` - The Amazon Resource Name (ARN) that identifies the firewall.
+
+* `firewallStatus` - Nested list of information about the current status of the firewall.
+    * `syncStates` - Set of subnets configured for use by the firewall.
+        * `attachment` - Nested list describing the attachment status of the firewall's association with a single VPC subnet.
+            * `endpointId` - The identifier of the firewall endpoint that AWS Network Firewall has instantiated in the subnet. You use this to identify the firewall endpoint in the VPC route tables, when you redirect the VPC traffic through the endpoint.
+            * `subnetId` - The unique identifier of the subnet that you've specified to be used for a firewall endpoint.
+        * `availabilityZone` - The Availability Zone where the subnet is configured.
+
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+* `updateToken` - A string token used when updating a firewall.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Network Firewall Firewalls using their `arn`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Network Firewall Firewalls using their `arn`. For example:
+
+```console
+% terraform import aws_networkfirewall_firewall.example arn:aws:network-firewall:us-west-1:123456789012:firewall/example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-2f79b5ba62479f655245def84991cac49da81f4de5c0c95cba76b91f27bb118b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/networkfirewall_firewall_policy.html.markdown b/website/docs/cdktf/typescript/r/networkfirewall_firewall_policy.html.markdown
new file mode 100644
index 00000000000..e6a2eae00fd
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/networkfirewall_firewall_policy.html.markdown
@@ -0,0 +1,286 @@
+---
+subcategory: "Network Firewall"
+layout: "aws"
+page_title: "AWS: aws_networkfirewall_firewall_policy"
+description: |-
+  Provides an AWS Network Firewall Policy resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_networkfirewall_firewall_policy
+
+Provides an AWS Network Firewall Firewall Policy Resource
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { NetworkfirewallFirewallPolicy } from "./.gen/providers/aws/networkfirewall-firewall-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new NetworkfirewallFirewallPolicy(this, "example", {
+      firewallPolicy: {
+        statelessDefaultActions: ["aws:pass"],
+        statelessFragmentDefaultActions: ["aws:drop"],
+        statelessRuleGroupReference: [
+          {
+            priority: 1,
+            resourceArn: Token.asString(awsNetworkfirewallRuleGroupExample.arn),
+          },
+        ],
+      },
+      name: "example",
+      tags: {
+        Tag1: "Value1",
+        Tag2: "Value2",
+      },
+    });
+  }
+}
+
+```
+
+## Policy with a HOME_NET Override
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { NetworkfirewallFirewallPolicy } from "./.gen/providers/aws/networkfirewall-firewall-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new NetworkfirewallFirewallPolicy(this, "example", {
+      firewallPolicy: {
+        policyVariables: {
+          ruleVariables: [
+            {
+              ipSet: {
+                definition: ["10.0.0.0/16", "10.1.0.0/24"],
+              },
+              key: "HOME_NET",
+            },
+          ],
+        },
+        statelessDefaultActions: ["aws:pass"],
+        statelessFragmentDefaultActions: ["aws:drop"],
+        statelessRuleGroupReference: [
+          {
+            priority: 1,
+            resourceArn: Token.asString(awsNetworkfirewallRuleGroupExample.arn),
+          },
+        ],
+      },
+      name: "example",
+      tags: {
+        Tag1: "Value1",
+        Tag2: "Value2",
+      },
+    });
+  }
+}
+
+```
+
+## Policy with a Custom Action for Stateless Inspection
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { NetworkfirewallFirewallPolicy } from "./.gen/providers/aws/networkfirewall-firewall-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new NetworkfirewallFirewallPolicy(this, "test", {
+      firewallPolicy: {
+        statelessCustomAction: [
+          {
+            actionDefinition: {
+              publishMetricAction: {
+                dimension: [
+                  {
+                    value: "1",
+                  },
+                ],
+              },
+            },
+            actionName: "ExampleCustomAction",
+          },
+        ],
+        statelessDefaultActions: ["aws:pass", "ExampleCustomAction"],
+        statelessFragmentDefaultActions: ["aws:drop"],
+      },
+      name: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `description` - (Optional) A friendly description of the firewall policy.
+
+* `encryptionConfiguration` - (Optional) KMS encryption configuration settings. See [Encryption Configuration](#encryption-configuration) below for details.
+
+* `firewallPolicy` - (Required) A configuration block describing the rule groups and policy actions to use in the firewall policy. See [Firewall Policy](#firewall-policy) below for details.
+
+* `name` - (Required, Forces new resource) A friendly name of the firewall policy.
+
+* `tags` - (Optional) Map of resource tags to associate with the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Encryption Configuration
+
+`encryptionConfiguration` settings for customer managed KMS keys. Remove this block to use the default AWS-managed KMS encryption (rather than setting `type` to `awsOwnedKmsKey`).
+
+* `keyId` - (Optional) The ID of the customer managed key. You can use any of the [key identifiers](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-id) that KMS supports, unless you're using a key that's managed by another account. If you're using a key managed by another account, then specify the key ARN.
+* `type` - (Required) The type of AWS KMS key to use for encryption of your Network Firewall resources. Valid values are `customerKms` and `awsOwnedKmsKey`.
+
+### Firewall Policy
+
+The `firewallPolicy` block supports the following arguments:
+
+* `policyVariables` - (Optional). Contains variables that you can use to override default Suricata settings in your firewall policy. See [Rule Variables](#rule-variables) for details.
+
+* `statefulDefaultActions` - (Optional) Set of actions to take on a packet if it does not match any stateful rules in the policy. This can only be specified if the policy has a `statefulEngineOptions` block with a `ruleOrder` value of `strictOrder`. You can specify one of either or neither values of `aws:dropStrict` or `aws:dropEstablished`, as well as any combination of `aws:alertStrict` and `aws:alertEstablished`.
+
+* `statefulEngineOptions` - (Optional) A configuration block that defines options on how the policy handles stateful rules. See [Stateful Engine Options](#stateful-engine-options) below for details.
+
+* `statefulRuleGroupReference` - (Optional) Set of configuration blocks containing references to the stateful rule groups that are used in the policy. See [Stateful Rule Group Reference](#stateful-rule-group-reference) below for details.
+
+* `statelessCustomAction` - (Optional) Set of configuration blocks describing the custom action definitions that are available for use in the firewall policy's `statelessDefaultActions`. See [Stateless Custom Action](#stateless-custom-action) below for details.
+
+* `statelessDefaultActions` - (Required) Set of actions to take on a packet if it does not match any of the stateless rules in the policy. You must specify one of the standard actions including: `aws:drop`, `aws:pass`, or `aws:forwardToSfe`.
+In addition, you can specify custom actions that are compatible with your standard action choice. If you want non-matching packets to be forwarded for stateful inspection, specify `aws:forwardToSfe`.
+
+* `statelessFragmentDefaultActions` - (Required) Set of actions to take on a fragmented packet if it does not match any of the stateless rules in the policy. You must specify one of the standard actions including: `aws:drop`, `aws:pass`, or `aws:forwardToSfe`.
+In addition, you can specify custom actions that are compatible with your standard action choice. If you want non-matching packets to be forwarded for stateful inspection, specify `aws:forwardToSfe`.
+
+* `statelessRuleGroupReference` - (Optional) Set of configuration blocks containing references to the stateless rule groups that are used in the policy. See [Stateless Rule Group Reference](#stateless-rule-group-reference) below for details.
+
+### Rule Variables
+
+The `ruleVariables` block supports the following arguments:
+
+* `key` - (Required) An alphanumeric string to identify the `ipSet`. Valid values: `homeNet`
+
+* `ipSet` - (Required) A configuration block that defines a set of IP addresses. See [IP Set](#ip-set) below for details.
+
+### IP Set
+
+The `ipSet` block supports the following argument:
+
+* `definition` - (Required) Set of IPv4 or IPv6 addresses in CIDR notation to use for the Suricata `homeNet` variable.
+
+### Stateful Engine Options
+
+The `statefulEngineOptions` block supports the following argument:
+
+~> **NOTE:** If the `strictOrder` rule order is specified, this firewall policy can only reference stateful rule groups that utilize `strictOrder`.
+
+* `ruleOrder` - Indicates how to manage the order of stateful rule evaluation for the policy. Default value: `defaultActionOrder`. Valid values: `defaultActionOrder`, `strictOrder`.
+
+* `streamExceptionPolicy` - Describes how to treat traffic which has broken midstream. Default value: `drop`. Valid values: `drop`, `continue`, `reject`.
+
+### Stateful Rule Group Reference
+
+The `statefulRuleGroupReference` block supports the following arguments:
+
+* `priority` - (Optional) An integer setting that indicates the order in which to apply the stateful rule groups in a single policy. This argument must be specified if the policy has a `statefulEngineOptions` block with a `ruleOrder` value of `strictOrder`. AWS Network Firewall applies each stateful rule group to a packet starting with the group that has the lowest priority setting.
+
+* `resourceArn` - (Required) The Amazon Resource Name (ARN) of the stateful rule group.
+
+* `override` - (Optional) Configuration block for override values
+
+#### Override
+
+* `action` - (Optional) The action that changes the rule group from DROP to ALERT . This only applies to managed rule groups.
+
+### Stateless Custom Action
+
+The `statelessCustomAction` block supports the following arguments:
+
+* `actionDefinition` - (Required) A configuration block describing the custom action associated with the `actionName`. See [Action Definition](#action-definition) below for details.
+
+* `actionName` - (Required, Forces new resource) A friendly name of the custom action.
+
+### Stateless Rule Group Reference
+
+The `statelessRuleGroupReference` block supports the following arguments:
+
+* `priority` - (Required) An integer setting that indicates the order in which to run the stateless rule groups in a single policy. AWS Network Firewall applies each stateless rule group to a packet starting with the group that has the lowest priority setting.
+
+* `resourceArn` - (Required) The Amazon Resource Name (ARN) of the stateless rule group.
+
+### Action Definition
+
+The `actionDefinition` block supports the following argument:
+
+* `publishMetricAction` - (Required) A configuration block describing the stateless inspection criteria that publishes the specified metrics to Amazon CloudWatch for the matching packet. You can pair this custom action with any of the standard stateless rule actions. See [Publish Metric Action](#publish-metric-action) below for details.
+
+### Publish Metric Action
+
+The `publishMetricAction` block supports the following argument:
+
+* `dimension` - (Required) Set of configuration blocks describing dimension settings to use for Amazon CloudWatch custom metrics. See [Dimension](#dimension) below for more details.
+
+### Dimension
+
+The `dimension` block supports the following argument:
+
+* `value` - (Required) The string value to use in the custom metric dimension.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Amazon Resource Name (ARN) that identifies the firewall policy.
+
+* `arn` - The Amazon Resource Name (ARN) that identifies the firewall policy.
+
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+* `updateToken` - A string token used when updating a firewall policy.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Network Firewall Policies using their `arn`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Network Firewall Policies using their `arn`. For example:
+
+```console
+% terraform import aws_networkfirewall_firewall_policy.example arn:aws:network-firewall:us-west-1:123456789012:firewall-policy/example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-17c12b43543ae699c6f2d03a7c541a3ec74530e26b24b77254c63fb4dd0c7b37 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/networkfirewall_logging_configuration.html.markdown b/website/docs/cdktf/typescript/r/networkfirewall_logging_configuration.html.markdown
new file mode 100644
index 00000000000..74475f685fe
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/networkfirewall_logging_configuration.html.markdown
@@ -0,0 +1,174 @@
+---
+subcategory: "Network Firewall"
+layout: "aws"
+page_title: "AWS: aws_networkfirewall_logging_configuration"
+description: |-
+  Provides an AWS Network Firewall Logging Configuration resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_networkfirewall_logging_configuration
+
+Provides an AWS Network Firewall Logging Configuration Resource
+
+## Example Usage
+
+### Logging to S3
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { NetworkfirewallLoggingConfiguration } from "./.gen/providers/aws/networkfirewall-logging-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new NetworkfirewallLoggingConfiguration(this, "example", {
+      firewallArn: Token.asString(awsNetworkfirewallFirewallExample.arn),
+      loggingConfiguration: {
+        logDestinationConfig: [
+          {
+            logDestination: {
+              bucketName: Token.asString(awsS3BucketExample.bucket),
+              prefix: "/example",
+            },
+            logDestinationType: "S3",
+            logType: "FLOW",
+          },
+        ],
+      },
+    });
+  }
+}
+
+```
+
+### Logging to CloudWatch
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { NetworkfirewallLoggingConfiguration } from "./.gen/providers/aws/networkfirewall-logging-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new NetworkfirewallLoggingConfiguration(this, "example", {
+      firewallArn: Token.asString(awsNetworkfirewallFirewallExample.arn),
+      loggingConfiguration: {
+        logDestinationConfig: [
+          {
+            logDestination: {
+              logGroup: Token.asString(awsCloudwatchLogGroupExample.name),
+            },
+            logDestinationType: "CloudWatchLogs",
+            logType: "ALERT",
+          },
+        ],
+      },
+    });
+  }
+}
+
+```
+
+### Logging to Kinesis Data Firehose
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { NetworkfirewallLoggingConfiguration } from "./.gen/providers/aws/networkfirewall-logging-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new NetworkfirewallLoggingConfiguration(this, "example", {
+      firewallArn: Token.asString(awsNetworkfirewallFirewallExample.arn),
+      loggingConfiguration: {
+        logDestinationConfig: [
+          {
+            logDestination: {
+              deliveryStream: Token.asString(
+                awsKinesisFirehoseDeliveryStreamExample.name
+              ),
+            },
+            logDestinationType: "KinesisDataFirehose",
+            logType: "ALERT",
+          },
+        ],
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `firewallArn` - (Required, Forces new resource) The Amazon Resource Name (ARN) of the Network Firewall firewall.
+
+* `loggingConfiguration` - (Required) A configuration block describing how AWS Network Firewall performs logging for a firewall. See [Logging Configuration](#logging-configuration) below for details.
+
+### Logging Configuration
+
+The `loggingConfiguration` block supports the following arguments:
+
+* `logDestinationConfig` - (Required) Set of configuration blocks describing the logging details for a firewall. See [Log Destination Config](#log-destination-config) below for details. At most, only two blocks can be specified; one for `flow` logs and one for `alert` logs.
+
+### Log Destination Config
+
+The `logDestinationConfig` block supports the following arguments:
+
+* `logDestination` - (Required) A map describing the logging destination for the chosen `logDestinationType`.
+    * For an Amazon S3 bucket, specify the key `bucketName` with the name of the bucket and optionally specify the key `prefix` with a path.
+    * For a CloudWatch log group, specify the key `logGroup` with the name of the CloudWatch log group.
+    * For a Kinesis Data Firehose delivery stream, specify the key `deliveryStream` with the name of the delivery stream.
+
+* `logDestinationType` - (Required) The location to send logs to. Valid values: `s3`, `cloudWatchLogs`, `kinesisDataFirehose`.
+
+* `logType` - (Required) The type of log to send. Valid values: `alert` or `flow`. Alert logs report traffic that matches a `statefulRule` with an action setting that sends a log message. Flow logs are standard network traffic flow logs.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Amazon Resource Name (ARN) of the associated firewall.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Network Firewall Logging Configurations using the `firewallArn`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Network Firewall Logging Configurations using the `firewallArn`. For example:
+
+```console
+% terraform import aws_networkfirewall_logging_configuration.example arn:aws:network-firewall:us-west-1:123456789012:firewall/example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-2700cb50e1d426b15657fe101c09e1dc07bb26140cf98ca4ff2db12e4a6d391e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/networkfirewall_resource_policy.html.markdown b/website/docs/cdktf/typescript/r/networkfirewall_resource_policy.html.markdown
new file mode 100644
index 00000000000..af6886056d6
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/networkfirewall_resource_policy.html.markdown
@@ -0,0 +1,136 @@
+---
+subcategory: "Network Firewall"
+layout: "aws"
+page_title: "AWS: aws_networkfirewall_resource_policy"
+description: |-
+  Provides an AWS Network Firewall Resource Policy resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_networkfirewall_resource_policy
+
+Provides an AWS Network Firewall Resource Policy Resource for a rule group or firewall policy.
+
+## Example Usage
+
+### For a Firewall Policy resource
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { NetworkfirewallResourcePolicy } from "./.gen/providers/aws/networkfirewall-resource-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new NetworkfirewallResourcePolicy(this, "example", {
+      policy: Token.asString(
+        Fn.jsonencode({
+          Statement: [
+            {
+              Action: [
+                "network-firewall:ListFirewallPolicies",
+                "network-firewall:CreateFirewall",
+                "network-firewall:UpdateFirewall",
+                "network-firewall:AssociateFirewallPolicy",
+              ],
+              Effect: "Allow",
+              Principal: {
+                AWS: "arn:aws:iam::123456789012:root",
+              },
+              Resource: awsNetworkfirewallFirewallPolicyExample.arn,
+            },
+          ],
+          Version: "2012-10-17",
+        })
+      ),
+      resourceArn: Token.asString(awsNetworkfirewallFirewallPolicyExample.arn),
+    });
+  }
+}
+
+```
+
+### For a Rule Group resource
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { NetworkfirewallResourcePolicy } from "./.gen/providers/aws/networkfirewall-resource-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new NetworkfirewallResourcePolicy(this, "example", {
+      policy: Token.asString(
+        Fn.jsonencode({
+          Statement: [
+            {
+              Action: [
+                "network-firewall:ListRuleGroups",
+                "network-firewall:CreateFirewallPolicy",
+                "network-firewall:UpdateFirewallPolicy",
+              ],
+              Effect: "Allow",
+              Principal: {
+                AWS: "arn:aws:iam::123456789012:root",
+              },
+              Resource: awsNetworkfirewallRuleGroupExample.arn,
+            },
+          ],
+          Version: "2012-10-17",
+        })
+      ),
+      resourceArn: Token.asString(awsNetworkfirewallRuleGroupExample.arn),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `policy` - (Required) JSON formatted policy document that controls access to the Network Firewall resource. The policy must be provided **without whitespaces**.  We recommend using [jsonencode](https://www.terraform.io/docs/configuration/functions/jsonencode.html) for formatting as seen in the examples above. For more details, including available policy statement Actions, see the [Policy](https://docs.aws.amazon.com/network-firewall/latest/APIReference/API_PutResourcePolicy.html#API_PutResourcePolicy_RequestSyntax) parameter in the AWS API documentation.
+
+* `resourceArn` - (Required, Forces new resource) The Amazon Resource Name (ARN) of the rule group or firewall policy.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Amazon Resource Name (ARN) of the rule group or firewall policy associated with the resource policy.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Network Firewall Resource Policies using the `resourceArn`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Network Firewall Resource Policies using the `resourceArn`. For example:
+
+```console
+% terraform import aws_networkfirewall_resource_policy.example aws_networkfirewall_rule_group.example arn:aws:network-firewall:us-west-1:123456789012:stateful-rulegroup/example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-c5fa671486177fa4e87a6bb581a11477626a302a6be68b0b30edb7287b73cc5c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/networkfirewall_rule_group.html.markdown b/website/docs/cdktf/typescript/r/networkfirewall_rule_group.html.markdown
new file mode 100644
index 00000000000..8a94abd588d
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/networkfirewall_rule_group.html.markdown
@@ -0,0 +1,680 @@
+---
+subcategory: "Network Firewall"
+layout: "aws"
+page_title: "AWS: aws_networkfirewall_rule_group"
+description: |-
+  Provides an AWS Network Firewall Rule Group resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_networkfirewall_rule_group
+
+Provides an AWS Network Firewall Rule Group Resource
+
+## Example Usage
+
+### Stateful Inspection for denying access to a domain
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { NetworkfirewallRuleGroup } from "./.gen/providers/aws/networkfirewall-rule-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new NetworkfirewallRuleGroup(this, "example", {
+      capacity: 100,
+      name: "example",
+      ruleGroup: {
+        rulesSource: {
+          rulesSourceList: {
+            generatedRulesType: "DENYLIST",
+            targetTypes: ["HTTP_HOST"],
+            targets: ["test.example.com"],
+          },
+        },
+      },
+      tags: {
+        Tag1: "Value1",
+        Tag2: "Value2",
+      },
+      type: "STATEFUL",
+    });
+  }
+}
+
+```
+
+### Stateful Inspection for permitting packets from a source IP address
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformIterator, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { NetworkfirewallRuleGroup } from "./.gen/providers/aws/networkfirewall-rule-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const ips = ["1.1.1.1/32", "1.0.0.1/32"];
+    /*In most cases loops should be handled in the programming language context and 
+    not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+    you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+    you need to keep this like it is.*/
+    const exampleDynamicIterator0 = TerraformIterator.fromList(
+      Token.asAny(ips)
+    );
+    new NetworkfirewallRuleGroup(this, "example", {
+      capacity: 50,
+      description: "Permits http traffic from source",
+      name: "example",
+      ruleGroup: {
+        rulesSource: {
+          statefulRule: exampleDynamicIterator0.dynamic({
+            action: "PASS",
+            header: [
+              {
+                destination: "ANY",
+                destination_port: "ANY",
+                direction: "ANY",
+                protocol: "HTTP",
+                source: exampleDynamicIterator0.value,
+                source_port: "ANY",
+              },
+            ],
+            rule_option: [
+              {
+                keyword: "sid",
+                settings: ["1"],
+              },
+            ],
+          }),
+        },
+      },
+      tags: {
+        Name: "permit HTTP from source",
+      },
+      type: "STATEFUL",
+    });
+  }
+}
+
+```
+
+### Stateful Inspection for blocking packets from going to an intended destination
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { NetworkfirewallRuleGroup } from "./.gen/providers/aws/networkfirewall-rule-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new NetworkfirewallRuleGroup(this, "example", {
+      capacity: 100,
+      name: "example",
+      ruleGroup: {
+        rulesSource: {
+          statefulRule: [
+            {
+              action: "DROP",
+              header: {
+                destination: "124.1.1.24/32",
+                destinationPort: Token.asString(53),
+                direction: "ANY",
+                protocol: "TCP",
+                source: "1.2.3.4/32",
+                sourcePort: Token.asString(53),
+              },
+              ruleOption: [
+                {
+                  keyword: "sid",
+                  settings: ["1"],
+                },
+              ],
+            },
+          ],
+        },
+      },
+      tags: {
+        Tag1: "Value1",
+        Tag2: "Value2",
+      },
+      type: "STATEFUL",
+    });
+  }
+}
+
+```
+
+### Stateful Inspection from rules specifications defined in Suricata flat format
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { NetworkfirewallRuleGroup } from "./.gen/providers/aws/networkfirewall-rule-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new NetworkfirewallRuleGroup(this, "example", {
+      capacity: 100,
+      name: "example",
+      rules: Token.asString(Fn.file("example.rules")),
+      tags: {
+        Tag1: "Value1",
+        Tag2: "Value2",
+      },
+      type: "STATEFUL",
+    });
+  }
+}
+
+```
+
+### Stateful Inspection from rule group specifications using rule variables and Suricata format rules
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { NetworkfirewallRuleGroup } from "./.gen/providers/aws/networkfirewall-rule-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new NetworkfirewallRuleGroup(this, "example", {
+      capacity: 100,
+      name: "example",
+      ruleGroup: {
+        ruleVariables: {
+          ipSets: [
+            {
+              ipSet: {
+                definition: ["10.0.0.0/16", "10.0.1.0/24", "192.168.0.0/16"],
+              },
+              key: "WEBSERVERS_HOSTS",
+            },
+            {
+              ipSet: {
+                definition: ["1.2.3.4/32"],
+              },
+              key: "EXTERNAL_HOST",
+            },
+          ],
+          portSets: [
+            {
+              key: "HTTP_PORTS",
+              portSet: {
+                definition: ["443", "80"],
+              },
+            },
+          ],
+        },
+        rulesSource: {
+          rulesString: Token.asString(Fn.file("suricata_rules_file")),
+        },
+      },
+      tags: {
+        Tag1: "Value1",
+        Tag2: "Value2",
+      },
+      type: "STATEFUL",
+    });
+  }
+}
+
+```
+
+### Stateless Inspection with a Custom Action
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { NetworkfirewallRuleGroup } from "./.gen/providers/aws/networkfirewall-rule-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new NetworkfirewallRuleGroup(this, "example", {
+      capacity: 100,
+      description: "Stateless Rate Limiting Rule",
+      name: "example",
+      ruleGroup: {
+        rulesSource: {
+          statelessRulesAndCustomActions: {
+            customAction: [
+              {
+                actionDefinition: {
+                  publishMetricAction: {
+                    dimension: [
+                      {
+                        value: "2",
+                      },
+                    ],
+                  },
+                },
+                actionName: "ExampleMetricsAction",
+              },
+            ],
+            statelessRule: [
+              {
+                priority: 1,
+                ruleDefinition: {
+                  actions: ["aws:pass", "ExampleMetricsAction"],
+                  matchAttributes: {
+                    destination: [
+                      {
+                        addressDefinition: "124.1.1.5/32",
+                      },
+                    ],
+                    destinationPort: [
+                      {
+                        fromPort: 443,
+                        toPort: 443,
+                      },
+                    ],
+                    protocols: [6],
+                    source: [
+                      {
+                        addressDefinition: "1.2.3.4/32",
+                      },
+                    ],
+                    sourcePort: [
+                      {
+                        fromPort: 443,
+                        toPort: 443,
+                      },
+                    ],
+                    tcpFlag: [
+                      {
+                        flags: ["SYN"],
+                        masks: ["SYN", "ACK"],
+                      },
+                    ],
+                  },
+                },
+              },
+            ],
+          },
+        },
+      },
+      tags: {
+        Tag1: "Value1",
+        Tag2: "Value2",
+      },
+      type: "STATELESS",
+    });
+  }
+}
+
+```
+
+### IP Set References to the Rule Group
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { NetworkfirewallRuleGroup } from "./.gen/providers/aws/networkfirewall-rule-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new NetworkfirewallRuleGroup(this, "example", {
+      capacity: 100,
+      name: "example",
+      ruleGroup: {
+        referenceSets: {
+          ipSetReferences: [
+            {
+              ipSetReference: [
+                {
+                  referenceArn: thisVar.arn,
+                },
+              ],
+              key: "example",
+            },
+          ],
+        },
+        rulesSource: {
+          rulesSourceList: {
+            generatedRulesType: "DENYLIST",
+            targetTypes: ["HTTP_HOST"],
+            targets: ["test.example.com"],
+          },
+        },
+      },
+      tags: {
+        Tag1: "Value1",
+        Tag2: "Value2",
+      },
+      type: "STATEFUL",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `capacity` - (Required, Forces new resource) The maximum number of operating resources that this rule group can use. For a stateless rule group, the capacity required is the sum of the capacity requirements of the individual rules. For a stateful rule group, the minimum capacity required is the number of individual rules.
+
+* `description` - (Optional) A friendly description of the rule group.
+
+* `encryptionConfiguration` - (Optional) KMS encryption configuration settings. See [Encryption Configuration](#encryption-configuration) below for details.
+
+* `name` - (Required, Forces new resource) A friendly name of the rule group.
+
+* `ruleGroup` - (Optional) A configuration block that defines the rule group rules. Required unless `rules` is specified. See [Rule Group](#rule-group) below for details.
+
+* `rules` - (Optional) The stateful rule group rules specifications in Suricata file format, with one rule per line. Use this to import your existing Suricata compatible rule groups. Required unless `ruleGroup` is specified.
+
+* `tags` - (Optional) A map of key:value pairs to associate with the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+* `type` - (Required) Whether the rule group is stateless (containing stateless rules) or stateful (containing stateful rules). Valid values include: `stateful` or `stateless`.
+
+### Encryption Configuration
+
+`encryptionConfiguration` settings for customer managed KMS keys. Remove this block to use the default AWS-managed KMS encryption (rather than setting `type` to `awsOwnedKmsKey`).
+
+* `keyId` - (Optional) The ID of the customer managed key. You can use any of the [key identifiers](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-id) that KMS supports, unless you're using a key that's managed by another account. If you're using a key managed by another account, then specify the key ARN.
+* `type` - (Required) The type of AWS KMS key to use for encryption of your Network Firewall resources. Valid values are `customerKms` and `awsOwnedKmsKey`.
+
+### Rule Group
+
+The `ruleGroup` block supports the following argument:
+
+* `referenceSets` - (Optional) A configuration block that defines the IP Set References for the rule group. See [Reference Sets](#reference-sets) below for details. Please notes that there can only be a maximum of 5 `referenceSets` in a `ruleGroup`. See the [AWS documentation](https://docs.aws.amazon.com/network-firewall/latest/developerguide/rule-groups-ip-set-references.html#rule-groups-ip-set-reference-limits) for details.
+
+* `ruleVariables` - (Optional) A configuration block that defines additional settings available to use in the rules defined in the rule group. Can only be specified for **stateful** rule groups. See [Rule Variables](#rule-variables) below for details.
+
+* `rulesSource` - (Required) A configuration block that defines the stateful or stateless rules for the rule group. See [Rules Source](#rules-source) below for details.
+
+* `statefulRuleOptions` - (Optional) A configuration block that defines stateful rule options for the rule group. See [Stateful Rule Options](#stateful-rule-options) below for details.
+
+### Reference Sets
+
+The `referenceSets` block supports the following arguments:
+
+* `ipSetReference` - (Optional) Set of configuration blocks that define the IP Reference information. See [IP Set Reference](#ip-set-reference) below for details.
+
+### Rule Variables
+
+The `ruleVariables` block supports the following arguments:
+
+* `ipSets` - (Optional) Set of configuration blocks that define IP address information. See [IP Sets](#ip-sets) below for details.
+
+* `portSets` - (Optional) Set of configuration blocks that define port range information. See [Port Sets](#port-sets) below for details.
+
+### IP Sets
+
+The `ipSets` block supports the following arguments:
+
+* `key` - (Required) A unique alphanumeric string to identify the `ipSet`.
+
+* `ipSet` - (Required) A configuration block that defines a set of IP addresses. See [IP Set](#ip-set) below for details.
+
+### IP Set
+
+The `ipSet` configuration block supports the following argument:
+
+* `definition` - (Required) Set of IP addresses and address ranges, in CIDR notation.
+
+### IP Set Reference
+
+The `ipSetReference` configuration block supports the following argument:
+
+* `key` - (Required) A unique alphanumeric string to identify the `ipSet`.
+
+* `referenceArn` - (Required) Set of Managed Prefix IP ARN(s)
+
+### Port Sets
+
+The `portSets` block supports the following arguments:
+
+* `key` - (Required) An unique alphanumeric string to identify the `portSet`.
+
+* `portSet` - (Required) A configuration block that defines a set of port ranges. See [Port Set](#port-set) below for details.
+
+### Port Set
+
+The `portSet` configuration block suppports the following argument:
+
+* `definition` - (Required) Set of port ranges.
+
+### Rules Source
+
+The `rulesSource` block supports the following arguments:
+
+~> **NOTE:** Only one of `rulesSourceList`, `rulesString`, `statefulRule`, or `statelessRulesAndCustomActions` must be specified.
+
+* `rulesSourceList` - (Optional) A configuration block containing **stateful** inspection criteria for a domain list rule group. See [Rules Source List](#rules-source-list) below for details.
+
+* `rulesString` - (Optional) The fully qualified name of a file in an S3 bucket that contains Suricata compatible intrusion preventions system (IPS) rules or the Suricata rules as a string. These rules contain **stateful** inspection criteria and the action to take for traffic that matches the criteria.
+
+* `statefulRule` - (Optional) Set of configuration blocks containing **stateful** inspection criteria for 5-tuple rules to be used together in a rule group. See [Stateful Rule](#stateful-rule) below for details.
+
+* `statelessRulesAndCustomActions` - (Optional) A configuration block containing **stateless** inspection criteria for a stateless rule group. See [Stateless Rules and Custom Actions](#stateless-rules-and-custom-actions) below for details.
+
+### Stateful Rule Options
+
+The `statefulRuleOptions` block supports the following argument:
+
+~> **NOTE:** If the `strictOrder` rule order is specified, this rule group can only be referenced in firewall policies that also utilize `strictOrder` for the stateful engine. `strictOrder` can only be specified when using a `rulesSource` of `rulesString` or `statefulRule`.
+
+* `ruleOrder` - (Required) Indicates how to manage the order of the rule evaluation for the rule group. Default value: `defaultActionOrder`. Valid values: `defaultActionOrder`, `strictOrder`.
+
+### Rules Source List
+
+The `rulesSourceList` block supports the following arguments:
+
+* `generatedRulesType` - (Required) String value to specify whether domains in the target list are allowed or denied access. Valid values: `allowlist`, `denylist`.
+
+* `targetTypes` - (Required) Set of types of domain specifications that are provided in the `targets` argument. Valid values: `httpHost`, `tlsSni`.
+
+* `targets` - (Required) Set of domains that you want to inspect for in your traffic flows.
+
+### Stateful Rule
+
+The `statefulRule` block supports the following arguments:
+
+* `action` - (Required) Action to take with packets in a traffic flow when the flow matches the stateful rule criteria. For all actions, AWS Network Firewall performs the specified action and discontinues stateful inspection of the traffic flow. Valid values: `alert`, `drop`, `pass`, or `reject`.
+
+* `header` - (Required) A configuration block containing the stateful 5-tuple inspection criteria for the rule, used to inspect traffic flows. See [Header](#header) below for details.
+
+* `ruleOption` - (Required) Set of configuration blocks containing additional settings for a stateful rule. See [Rule Option](#rule-option) below for details.
+
+### Stateless Rules and Custom Actions
+
+The `statelessRulesAndCustomActions` block supports the following arguments:
+
+* `customAction` - (Optional) Set of configuration blocks containing custom action definitions that are available for use by the set of `stateless rule`. See [Custom Action](#custom-action) below for details.
+
+* `statelessRule` - (Required) Set of configuration blocks containing the stateless rules for use in the stateless rule group. See [Stateless Rule](#stateless-rule) below for details.
+
+### Header
+
+The `header` block supports the following arguments:
+
+* `destination` - (Required) The destination IP address or address range to inspect for, in CIDR notation. To match with any address, specify `any`.
+
+* `destinationPort` - (Required) The destination port to inspect for. To match with any address, specify `any`.
+
+* `direction` - (Required) The direction of traffic flow to inspect. Valid values: `any` or `forward`.
+
+* `protocol` - (Required) The protocol to inspect. Valid values: `ip`, `tcp`, `udp`, `icmp`, `http`, `ftp`, `tls`, `smb`, `dns`, `dcerpc`, `ssh`, `smtp`, `imap`, `msn`, `krb5`, `ikev2`, `tftp`, `ntp`, `dhcp`.
+
+* `source` - (Required) The source IP address or address range for, in CIDR notation. To match with any address, specify `any`.
+
+* `sourcePort` - (Required) The source port to inspect for. To match with any address, specify `any`.
+
+### Rule Option
+
+The `ruleOption` block supports the following arguments:
+
+* `keyword` - (Required) Keyword defined by open source detection systems like Snort or Suricata for stateful rule inspection.
+See [Snort General Rule Options](http://manual-snort-org.s3-website-us-east-1.amazonaws.com/node31.html) or [Suricata Rule Options](https://suricata.readthedocs.io/en/suricata-5.0.1/rules/intro.html#rule-options) for more details.
+* `settings` - (Optional) Set of strings for additional settings to use in stateful rule inspection.
+
+### Custom Action
+
+The `customAction` block supports the following arguments:
+
+* `actionDefinition` - (Required) A configuration block describing the custom action associated with the `actionName`. See [Action Definition](#action-definition) below for details.
+
+* `actionName` - (Required, Forces new resource) A friendly name of the custom action.
+
+### Stateless Rule
+
+The `statelessRule` block supports the following arguments:
+
+* `priority` - (Required) A setting that indicates the order in which to run this rule relative to all of the rules that are defined for a stateless rule group. AWS Network Firewall evaluates the rules in a rule group starting with the lowest priority setting.
+
+* `ruleDefinition` - (Required) A configuration block defining the stateless 5-tuple packet inspection criteria and the action to take on a packet that matches the criteria. See [Rule Definition](#rule-definition) below for details.
+
+### Rule Definition
+
+The `ruleDefinition` block supports the following arguments:
+
+* `actions` - (Required) Set of actions to take on a packet that matches one of the stateless rule definition's `matchAttributes`. For every rule you must specify 1 standard action, and you can add custom actions. Standard actions include: `aws:pass`, `aws:drop`, `aws:forwardToSfe`.
+
+* `matchAttributes` - (Required) A configuration block containing criteria for AWS Network Firewall to use to inspect an individual packet in stateless rule inspection. See [Match Attributes](#match-attributes) below for details.
+
+### Match Attributes
+
+The `matchAttributes` block supports the following arguments:
+
+* `destination` - (Optional) Set of configuration blocks describing the destination IP address and address ranges to inspect for, in CIDR notation. If not specified, this matches with any destination address. See [Destination](#destination) below for details.
+
+* `destinationPort` - (Optional) Set of configuration blocks describing the destination ports to inspect for. If not specified, this matches with any destination port. See [Destination Port](#destination-port) below for details.
+
+* `protocols` - (Optional) Set of protocols to inspect for, specified using the protocol's assigned internet protocol number (IANA). If not specified, this matches with any protocol.
+
+* `source` - (Optional) Set of configuration blocks describing the source IP address and address ranges to inspect for, in CIDR notation. If not specified, this matches with any source address. See [Source](#source) below for details.
+
+* `sourcePort` - (Optional) Set of configuration blocks describing the source ports to inspect for. If not specified, this matches with any source port. See [Source Port](#source-port) below for details.
+
+* `tcpFlag` - (Optional) Set of configuration blocks containing the TCP flags and masks to inspect for. If not specified, this matches with any settings.
+
+### Action Definition
+
+The `actionDefinition` block supports the following argument:
+
+* `publishMetricAction` - (Required) A configuration block describing the stateless inspection criteria that publishes the specified metrics to Amazon CloudWatch for the matching packet. You can pair this custom action with any of the standard stateless rule actions. See [Publish Metric Action](#publish-metric-action) below for details.
+
+### Publish Metric Action
+
+The `publishMetricAction` block supports the following argument:
+
+* `dimension` - (Required) Set of configuration blocks containing the dimension settings to use for Amazon CloudWatch custom metrics. See [Dimension](#dimension) below for details.
+
+### Dimension
+
+The `dimension` block supports the following argument:
+
+* `value` - (Required) The value to use in the custom metric dimension.
+
+### Destination
+
+The `destination` block supports the following argument:
+
+* `addressDefinition` - (Required)  An IP address or a block of IP addresses in CIDR notation. AWS Network Firewall supports all address ranges for IPv4.
+
+### Destination Port
+
+The `destinationPort` block supports the following arguments:
+
+* `fromPort` - (Required) The lower limit of the port range. This must be less than or equal to the `toPort`.
+
+* `toPort` - (Optional) The upper limit of the port range. This must be greater than or equal to the `fromPort`.
+
+### Source
+
+The `source` block supports the following argument:
+
+* `addressDefinition` - (Required)  An IP address or a block of IP addresses in CIDR notation. AWS Network Firewall supports all address ranges for IPv4.
+
+### Source Port
+
+The `sourcePort` block supports the following arguments:
+
+* `fromPort` - (Required) The lower limit of the port range. This must be less than or equal to the `toPort`.
+
+* `toPort` - (Optional) The upper limit of the port range. This must be greater than or equal to the `fromPort`.
+
+### TCP Flag
+
+The `tcpFlag` block supports the following arguments:
+
+* `flags` - (Required) Set of flags to look for in a packet. This setting can only specify values that are also specified in `masks`.
+Valid values: `fin`, `syn`, `rst`, `psh`, `ack`, `urg`, `ece`, `cwr`.
+
+* `masks` - (Optional) Set of flags to consider in the inspection. To inspect all flags, leave this empty.
+Valid values: `fin`, `syn`, `rst`, `psh`, `ack`, `urg`, `ece`, `cwr`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Amazon Resource Name (ARN) that identifies the rule group.
+
+* `arn` - The Amazon Resource Name (ARN) that identifies the rule group.
+
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+* `updateToken` - A string token used when updating the rule group.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Network Firewall Rule Groups using their `arn`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Network Firewall Rule Groups using their `arn`. For example:
+
+```console
+% terraform import aws_networkfirewall_rule_group.example arn:aws:network-firewall:us-west-1:123456789012:stateful-rulegroup/example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ef93e2bf518258ff78b58b7d51462d1757a12fe5ecae8c6b421815590aa49874 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/networkmanager_attachment_accepter.html.markdown b/website/docs/cdktf/typescript/r/networkmanager_attachment_accepter.html.markdown
new file mode 100644
index 00000000000..8c09e17cd4d
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/networkmanager_attachment_accepter.html.markdown
@@ -0,0 +1,83 @@
+---
+subcategory: "Network Manager"
+layout: "aws"
+page_title: "AWS: aws_networkmanager_attachment_accepter"
+description: |-
+  Terraform resource for managing an AWS NetworkManager Attachment Accepter.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_networkmanager_attachment_accepter
+
+Terraform resource for managing an AWS NetworkManager Attachment Accepter.
+
+## Example Usage
+
+### Example with VPC attachment
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { NetworkmanagerAttachmentAccepter } from "./.gen/providers/aws/networkmanager-attachment-accepter";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new NetworkmanagerAttachmentAccepter(this, "test", {
+      attachmentId: vpc.id,
+      attachmentType: vpc.attachmentType,
+    });
+  }
+}
+
+```
+
+### Example with site-to-site VPN attachment
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { NetworkmanagerAttachmentAccepter } from "./.gen/providers/aws/networkmanager-attachment-accepter";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new NetworkmanagerAttachmentAccepter(this, "test", {
+      attachmentId: vpn.id,
+      attachmentType: vpn.attachmentType,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+- `attachmentId` - (Required) The ID of the attachment.
+- `attachmentType` - (Required) The type of attachment. Valid values can be found in the [AWS Documentation](https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_ListAttachments.html#API_ListAttachments_RequestSyntax)
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+- `attachmentPolicyRuleNumber` - The policy rule number associated with the attachment.
+- `coreNetworkArn` - The ARN of a core network.
+- `coreNetworkId` - The id of a core network.
+- `edgeLocation` - The Region where the edge is located.
+- `ownerAccountId` - The ID of the attachment account owner.
+- `resourceArn` - The attachment resource ARN.
+- `segmentName` - The name of the segment attachment.
+- `state` - The state of the attachment.
+
+<!-- cache-key: cdktf-0.18.0 input-b61e3d1e0402ca6c95ad2bb8ec92a7c9a9eb878f9b4a262494c1d80ad87d6549 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/networkmanager_connect_attachment.html.markdown b/website/docs/cdktf/typescript/r/networkmanager_connect_attachment.html.markdown
new file mode 100644
index 00000000000..6abcd7782de
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/networkmanager_connect_attachment.html.markdown
@@ -0,0 +1,162 @@
+---
+subcategory: "Network Manager"
+layout: "aws"
+page_title: "AWS: aws_networkmanager_connect_attachment"
+description: |-
+  Terraform resource for managing an AWS NetworkManager ConnectAttachment.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_networkmanager_connect_attachment
+
+Terraform resource for managing an AWS NetworkManager ConnectAttachment.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, Fn, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { NetworkmanagerConnectAttachment } from "./.gen/providers/aws/networkmanager-connect-attachment";
+import { NetworkmanagerVpcAttachment } from "./.gen/providers/aws/networkmanager-vpc-attachment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new NetworkmanagerVpcAttachment(this, "example", {
+      coreNetworkId: Token.asString(awsccNetworkmanagerCoreNetworkExample.id),
+      subnetArns: Token.asList(Fn.lookupNested(awsSubnetExample, ["*", "arn"])),
+      vpcArn: Token.asString(awsVpcExample.arn),
+    });
+    const awsNetworkmanagerConnectAttachmentExample =
+      new NetworkmanagerConnectAttachment(this, "example_1", {
+        coreNetworkId: Token.asString(awsccNetworkmanagerCoreNetworkExample.id),
+        edgeLocation: example.edgeLocation,
+        options: {
+          protocol: "GRE",
+        },
+        transportAttachmentId: example.id,
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsNetworkmanagerConnectAttachmentExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### Usage with attachment accepter
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, Fn, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { NetworkmanagerAttachmentAccepter } from "./.gen/providers/aws/networkmanager-attachment-accepter";
+import { NetworkmanagerConnectAttachment } from "./.gen/providers/aws/networkmanager-connect-attachment";
+import { NetworkmanagerVpcAttachment } from "./.gen/providers/aws/networkmanager-vpc-attachment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new NetworkmanagerVpcAttachment(this, "example", {
+      coreNetworkId: Token.asString(awsccNetworkmanagerCoreNetworkExample.id),
+      subnetArns: Token.asList(Fn.lookupNested(awsSubnetExample, ["*", "arn"])),
+      vpcArn: Token.asString(awsVpcExample.arn),
+    });
+    const awsNetworkmanagerAttachmentAccepterExample =
+      new NetworkmanagerAttachmentAccepter(this, "example_1", {
+        attachmentId: example.id,
+        attachmentType: example.attachmentType,
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsNetworkmanagerAttachmentAccepterExample.overrideLogicalId("example");
+    const awsNetworkmanagerConnectAttachmentExample =
+      new NetworkmanagerConnectAttachment(this, "example_2", {
+        coreNetworkId: Token.asString(awsccNetworkmanagerCoreNetworkExample.id),
+        dependsOn: ["aws_networkmanager_attachment_accepter.test"],
+        edgeLocation: example.edgeLocation,
+        options: {
+          protocol: "GRE",
+        },
+        transportAttachmentId: example.id,
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsNetworkmanagerConnectAttachmentExample.overrideLogicalId("example");
+    new NetworkmanagerAttachmentAccepter(this, "example2", {
+      attachmentId: Token.asString(
+        awsNetworkmanagerConnectAttachmentExample.id
+      ),
+      attachmentType: Token.asString(
+        awsNetworkmanagerConnectAttachmentExample.attachmentType
+      ),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+- `coreNetworkId` - (Required) The ID of a core network where you want to create the attachment.
+- `transportAttachmentId` - (Required) The ID of the attachment between the two connections.
+- `edgeLocation` - (Required) The Region where the edge is located.
+- `options` - (Required) Options block. See [options](#options) for more information.
+
+The following arguments are optional:
+
+- `tags` - (Optional) Key-value tags for the attachment. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### options
+
+* `protocol` - (Required) The protocol used for the attachment connection. Possible values are `gre` and `noEncap`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+- `arn` - The ARN of the attachment.
+- `attachmentPolicyRuleNumber` - The policy rule number associated with the attachment.
+- `attachmentType` - The type of attachment.
+- `coreNetworkArn` - The ARN of a core network.
+- `coreNetworkId` - The ID of a core network
+- `edgeLocation` - The Region where the edge is located.
+- `id` - The ID of the attachment.
+- `ownerAccountId` - The ID of the attachment account owner.
+- `resourceArn` - The attachment resource ARN.
+- `segmentName` - The name of the segment attachment.
+- `state` - The state of the attachment.
+- `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsNetworkmanagerConnectAttachment` using the attachment ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsNetworkmanagerConnectAttachment` using the attachment ID. For example:
+
+```console
+% terraform import aws_networkmanager_connect_attachment.example attachment-0f8fa60d2238d1bd8
+```
+
+<!-- cache-key: cdktf-0.18.0 input-2fa317624ffa5a6fd592516211f62a2c5fd04acb1f1cab83fc9a598feab08b2d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/networkmanager_connect_peer.html.markdown b/website/docs/cdktf/typescript/r/networkmanager_connect_peer.html.markdown
new file mode 100644
index 00000000000..55256abb38b
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/networkmanager_connect_peer.html.markdown
@@ -0,0 +1,247 @@
+---
+subcategory: "Network Manager"
+layout: "aws"
+page_title: "AWS: aws_networkmanager_connect_peer"
+description: |-
+  Terraform resource for managing an AWS NetworkManager Connect Peer.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_networkmanager_connect_peer
+
+Terraform resource for managing an AWS NetworkManager Connect Peer.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, Fn, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { NetworkmanagerConnectAttachment } from "./.gen/providers/aws/networkmanager-connect-attachment";
+import { NetworkmanagerConnectPeer } from "./.gen/providers/aws/networkmanager-connect-peer";
+import { NetworkmanagerVpcAttachment } from "./.gen/providers/aws/networkmanager-vpc-attachment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new NetworkmanagerVpcAttachment(this, "example", {
+      coreNetworkId: Token.asString(awsccNetworkmanagerCoreNetworkExample.id),
+      subnetArns: Token.asList(Fn.lookupNested(awsSubnetExample, ["*", "arn"])),
+      vpcArn: Token.asString(awsVpcExample.arn),
+    });
+    const awsNetworkmanagerConnectAttachmentExample =
+      new NetworkmanagerConnectAttachment(this, "example_1", {
+        coreNetworkId: Token.asString(awsccNetworkmanagerCoreNetworkExample.id),
+        edgeLocation: example.edgeLocation,
+        options: {
+          protocol: "GRE",
+        },
+        transportAttachmentId: example.id,
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsNetworkmanagerConnectAttachmentExample.overrideLogicalId("example");
+    const awsNetworkmanagerConnectPeerExample = new NetworkmanagerConnectPeer(
+      this,
+      "example_2",
+      {
+        bgpOptions: {
+          peerAsn: 65000,
+        },
+        connectAttachmentId: Token.asString(
+          awsNetworkmanagerConnectAttachmentExample.id
+        ),
+        insideCidrBlocks: ["172.16.0.0/16"],
+        peerAddress: "127.0.0.1",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsNetworkmanagerConnectPeerExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### Usage with attachment accepter
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, Fn, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { NetworkmanagerAttachmentAccepter } from "./.gen/providers/aws/networkmanager-attachment-accepter";
+import { NetworkmanagerConnectAttachment } from "./.gen/providers/aws/networkmanager-connect-attachment";
+import { NetworkmanagerConnectPeer } from "./.gen/providers/aws/networkmanager-connect-peer";
+import { NetworkmanagerVpcAttachment } from "./.gen/providers/aws/networkmanager-vpc-attachment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new NetworkmanagerVpcAttachment(this, "example", {
+      coreNetworkId: Token.asString(awsccNetworkmanagerCoreNetworkExample.id),
+      subnetArns: Token.asList(Fn.lookupNested(awsSubnetExample, ["*", "arn"])),
+      vpcArn: Token.asString(awsVpcExample.arn),
+    });
+    const awsNetworkmanagerAttachmentAccepterExample =
+      new NetworkmanagerAttachmentAccepter(this, "example_1", {
+        attachmentId: example.id,
+        attachmentType: example.attachmentType,
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsNetworkmanagerAttachmentAccepterExample.overrideLogicalId("example");
+    const awsNetworkmanagerConnectAttachmentExample =
+      new NetworkmanagerConnectAttachment(this, "example_2", {
+        coreNetworkId: Token.asString(awsccNetworkmanagerCoreNetworkExample.id),
+        dependsOn: ["aws_networkmanager_attachment_accepter.test"],
+        edgeLocation: example.edgeLocation,
+        options: {
+          protocol: "GRE",
+        },
+        transportAttachmentId: example.id,
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsNetworkmanagerConnectAttachmentExample.overrideLogicalId("example");
+    const awsNetworkmanagerConnectPeerExample = new NetworkmanagerConnectPeer(
+      this,
+      "example_3",
+      {
+        bgpOptions: {
+          peerAsn: 65500,
+        },
+        connectAttachmentId: Token.asString(
+          awsNetworkmanagerConnectAttachmentExample.id
+        ),
+        dependsOn: ["aws_networkmanager_attachment_accepter.example2"],
+        insideCidrBlocks: ["172.16.0.0/16"],
+        peerAddress: "127.0.0.1",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsNetworkmanagerConnectPeerExample.overrideLogicalId("example");
+    new NetworkmanagerAttachmentAccepter(this, "example2", {
+      attachmentId: Token.asString(
+        awsNetworkmanagerConnectAttachmentExample.id
+      ),
+      attachmentType: Token.asString(
+        awsNetworkmanagerConnectAttachmentExample.attachmentType
+      ),
+    });
+  }
+}
+
+```
+
+### Usage with a Tunnel-less Connect attachment
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, Fn, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { NetworkmanagerConnectAttachment } from "./.gen/providers/aws/networkmanager-connect-attachment";
+import { NetworkmanagerConnectPeer } from "./.gen/providers/aws/networkmanager-connect-peer";
+import { NetworkmanagerVpcAttachment } from "./.gen/providers/aws/networkmanager-vpc-attachment";
+interface MyConfig {
+  insideCidrBlocks: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    const example = new NetworkmanagerVpcAttachment(this, "example", {
+      coreNetworkId: Token.asString(awsccNetworkmanagerCoreNetworkExample.id),
+      subnetArns: Token.asList(Fn.lookupNested(awsSubnetExample, ["*", "arn"])),
+      vpcArn: Token.asString(awsVpcExample.arn),
+    });
+    const awsNetworkmanagerConnectAttachmentExample =
+      new NetworkmanagerConnectAttachment(this, "example_1", {
+        coreNetworkId: Token.asString(awsccNetworkmanagerCoreNetworkExample.id),
+        edgeLocation: example.edgeLocation,
+        options: {
+          protocol: "NO_ENCAP",
+        },
+        transportAttachmentId: example.id,
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsNetworkmanagerConnectAttachmentExample.overrideLogicalId("example");
+    const awsNetworkmanagerConnectPeerExample = new NetworkmanagerConnectPeer(
+      this,
+      "example_2",
+      {
+        bgpOptions: {
+          peerAsn: 65000,
+        },
+        connectAttachmentId: Token.asString(
+          awsNetworkmanagerConnectAttachmentExample.id
+        ),
+        peerAddress: "127.0.0.1",
+        subnet_arn: test2.arn,
+        insideCidrBlocks: config.insideCidrBlocks,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsNetworkmanagerConnectPeerExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+- `connectAttachmentId` - (Required) The ID of the connection attachment.
+- `peerAddress` - (Required) The Connect peer address.
+
+The following arguments are optional:
+
+- `bgpOptions` (Optional) The Connect peer BGP options.
+- `coreNetworkAddress` (Optional) A Connect peer core network address.
+- `insideCidrBlocks` - (Optional) The inside IP addresses used for BGP peering. Required when the Connect attachment protocol is `gre`. See [`awsNetworkmanagerConnectAttachment`](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/networkmanager_connect_attachment) for details.
+- `subnetArn` - (Optional) The subnet ARN for the Connect peer. Required when the Connect attachment protocol is `noEncap`. See [`awsNetworkmanagerConnectAttachment`](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/networkmanager_connect_attachment) for details.
+- `tags` - (Optional) Key-value tags for the attachment. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+- `arn` - The ARN of the attachment.
+- `configuration` - The configuration of the Connect peer.
+- `coreNetworkId` - The ID of a core network.
+- `edgeLocation` - The Region where the peer is located.
+- `id` - The ID of the Connect peer.
+- `state` - The state of the Connect peer.
+- `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsNetworkmanagerConnectPeer` using the connect peer ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsNetworkmanagerConnectPeer` using the connect peer ID. For example:
+
+```console
+% terraform import aws_networkmanager_connect_peer.example connect-peer-061f3e96275db1acc
+```
+
+<!-- cache-key: cdktf-0.18.0 input-010c7af9870efaa2d4e70fcf20dd0a8279a972e0005dd5005199d0f3752a0ded -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/networkmanager_connection.html.markdown b/website/docs/cdktf/typescript/r/networkmanager_connection.html.markdown
new file mode 100644
index 00000000000..731ee7e64b6
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/networkmanager_connection.html.markdown
@@ -0,0 +1,81 @@
+---
+subcategory: "Network Manager"
+layout: "aws"
+page_title: "AWS: aws_networkmanager_connection"
+description: |-
+  Creates a connection between two devices.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_networkmanager_connection
+
+Creates a connection between two devices.
+The devices can be a physical or virtual appliance that connects to a third-party appliance in a VPC, or a physical appliance that connects to another physical appliance in an on-premises network.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { NetworkmanagerConnection } from "./.gen/providers/aws/networkmanager-connection";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new NetworkmanagerConnection(this, "example", {
+      connectedDeviceId: example2.id,
+      deviceId: example1.id,
+      globalNetworkId: Token.asString(awsNetworkmanagerGlobalNetworkExample.id),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `connectedDeviceId` - (Required) The ID of the second device in the connection.
+* `connectedLinkId` - (Optional) The ID of the link for the second device.
+* `description` - (Optional) A description of the connection.
+* `deviceId` - (Required) The ID of the first device in the connection.
+* `globalNetworkId` - (Required) The ID of the global network.
+* `linkId` - (Optional) The ID of the link for the first device.
+* `tags` - (Optional) Key-value tags for the connection. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the connection.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsNetworkmanagerConnection` using the connection ARN. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsNetworkmanagerConnection` using the connection ARN. For example:
+
+```console
+% terraform import aws_networkmanager_connection.example arn:aws:networkmanager::123456789012:device/global-network-0d47f6t230mz46dy4/connection-07f6fd08867abc123
+```
+
+<!-- cache-key: cdktf-0.18.0 input-950e6f1e6e30f9c05d70308c91abfbf81e3cb619be3e1bdef3b486654d0ee394 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/networkmanager_core_network.html.markdown b/website/docs/cdktf/typescript/r/networkmanager_core_network.html.markdown
new file mode 100644
index 00000000000..29b8db7f951
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/networkmanager_core_network.html.markdown
@@ -0,0 +1,647 @@
+---
+subcategory: "Network Manager"
+layout: "aws"
+page_title: "AWS: aws_networkmanager_core_network"
+description: |-
+  Provides a core network resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_networkmanager_core_network
+
+Provides a core network resource.
+
+## Example Usage
+
+### Basic
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { NetworkmanagerCoreNetwork } from "./.gen/providers/aws/networkmanager-core-network";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new NetworkmanagerCoreNetwork(this, "example", {
+      globalNetworkId: Token.asString(awsNetworkmanagerGlobalNetworkExample.id),
+    });
+  }
+}
+
+```
+
+### With description
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { NetworkmanagerCoreNetwork } from "./.gen/providers/aws/networkmanager-core-network";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new NetworkmanagerCoreNetwork(this, "example", {
+      description: "example",
+      globalNetworkId: Token.asString(awsNetworkmanagerGlobalNetworkExample.id),
+    });
+  }
+}
+
+```
+
+### With tags
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { NetworkmanagerCoreNetwork } from "./.gen/providers/aws/networkmanager-core-network";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new NetworkmanagerCoreNetwork(this, "example", {
+      globalNetworkId: Token.asString(awsNetworkmanagerGlobalNetworkExample.id),
+      tags: {
+        hello: "world",
+      },
+    });
+  }
+}
+
+```
+
+### With VPC Attachment (Single Region)
+
+The example below illustrates the scenario where your policy document has static routes pointing to VPC attachments and you want to attach your VPCs to the core network before applying the desired policy document. Set the `createBasePolicy` argument to `true` if your core network does not currently have any `live` policies (e.g. this is the first `terraform apply` with the core network resource), since a `live` policy is required before VPCs can be attached to the core network. Otherwise, if your core network already has a `live` policy, you may exclude the `createBasePolicy` argument. There are 2 options to implement this:
+
+- Option 1: Use the `basePolicyDocument` argument that allows the most customizations to a base policy. Use this to customize the `edgeLocations` `asn`. In the example below, `usWest2` and ASN `65500` are used in the base policy.
+- Option 2: Use the `createBasePolicy` argument only. This creates a base policy in the region specified in the `provider` block.
+
+#### Option 1 - using base_policy_document
+
+If you require a custom ASN for the edge location, please use the `basePolicyDocument` argument to pass a specific ASN. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, Fn, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsNetworkmanagerCoreNetworkPolicyDocument } from "./.gen/providers/aws/data-aws-networkmanager-core-network-policy-document";
+import { NetworkmanagerCoreNetwork } from "./.gen/providers/aws/networkmanager-core-network";
+import { NetworkmanagerCoreNetworkPolicyAttachment } from "./.gen/providers/aws/networkmanager-core-network-policy-attachment";
+import { NetworkmanagerGlobalNetwork } from "./.gen/providers/aws/networkmanager-global-network";
+import { NetworkmanagerVpcAttachment } from "./.gen/providers/aws/networkmanager-vpc-attachment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new NetworkmanagerGlobalNetwork(this, "example", {});
+    const base = new DataAwsNetworkmanagerCoreNetworkPolicyDocument(
+      this,
+      "base",
+      {
+        coreNetworkConfiguration: [
+          {
+            asnRanges: ["65022-65534"],
+            edgeLocations: [
+              {
+                asn: "65500",
+                location: "us-west-2",
+              },
+            ],
+          },
+        ],
+        segments: [
+          {
+            name: "segment",
+          },
+        ],
+      }
+    );
+    const awsNetworkmanagerCoreNetworkExample = new NetworkmanagerCoreNetwork(
+      this,
+      "example_2",
+      {
+        basePolicyDocument: Token.asString(base.json),
+        createBasePolicy: true,
+        globalNetworkId: example.id,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsNetworkmanagerCoreNetworkExample.overrideLogicalId("example");
+    const awsNetworkmanagerVpcAttachmentExample =
+      new NetworkmanagerVpcAttachment(this, "example_3", {
+        coreNetworkId: Token.asString(awsNetworkmanagerCoreNetworkExample.id),
+        subnetArns: Token.asList(
+          Fn.lookupNested(awsSubnetExample, ["*", "arn"])
+        ),
+        vpcArn: Token.asString(awsVpcExample.arn),
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsNetworkmanagerVpcAttachmentExample.overrideLogicalId("example");
+    const dataAwsNetworkmanagerCoreNetworkPolicyDocumentExample =
+      new DataAwsNetworkmanagerCoreNetworkPolicyDocument(this, "example_4", {
+        coreNetworkConfiguration: [
+          {
+            asnRanges: ["65022-65534"],
+            edgeLocations: [
+              {
+                asn: "65500",
+                location: "us-west-2",
+              },
+            ],
+          },
+        ],
+        segmentActions: [
+          {
+            action: "create-route",
+            destinationCidrBlocks: ["0.0.0.0/0"],
+            destinations: [
+              Token.asString(awsNetworkmanagerVpcAttachmentExample.id),
+            ],
+            segment: "segment",
+          },
+        ],
+        segments: [
+          {
+            name: "segment",
+          },
+        ],
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsNetworkmanagerCoreNetworkPolicyDocumentExample.overrideLogicalId(
+      "example"
+    );
+    const awsNetworkmanagerCoreNetworkPolicyAttachmentExample =
+      new NetworkmanagerCoreNetworkPolicyAttachment(this, "example_5", {
+        coreNetworkId: Token.asString(awsNetworkmanagerCoreNetworkExample.id),
+        policyDocument: Token.asString(
+          dataAwsNetworkmanagerCoreNetworkPolicyDocumentExample.json
+        ),
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsNetworkmanagerCoreNetworkPolicyAttachmentExample.overrideLogicalId(
+      "example"
+    );
+  }
+}
+
+```
+
+#### Option 2 - create_base_policy only
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, Fn, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsNetworkmanagerCoreNetworkPolicyDocument } from "./.gen/providers/aws/data-aws-networkmanager-core-network-policy-document";
+import { NetworkmanagerCoreNetwork } from "./.gen/providers/aws/networkmanager-core-network";
+import { NetworkmanagerCoreNetworkPolicyAttachment } from "./.gen/providers/aws/networkmanager-core-network-policy-attachment";
+import { NetworkmanagerGlobalNetwork } from "./.gen/providers/aws/networkmanager-global-network";
+import { NetworkmanagerVpcAttachment } from "./.gen/providers/aws/networkmanager-vpc-attachment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new NetworkmanagerGlobalNetwork(this, "example", {});
+    const awsNetworkmanagerCoreNetworkExample = new NetworkmanagerCoreNetwork(
+      this,
+      "example_1",
+      {
+        createBasePolicy: true,
+        globalNetworkId: example.id,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsNetworkmanagerCoreNetworkExample.overrideLogicalId("example");
+    const awsNetworkmanagerVpcAttachmentExample =
+      new NetworkmanagerVpcAttachment(this, "example_2", {
+        coreNetworkId: Token.asString(awsNetworkmanagerCoreNetworkExample.id),
+        subnetArns: Token.asList(
+          Fn.lookupNested(awsSubnetExample, ["*", "arn"])
+        ),
+        vpcArn: Token.asString(awsVpcExample.arn),
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsNetworkmanagerVpcAttachmentExample.overrideLogicalId("example");
+    const dataAwsNetworkmanagerCoreNetworkPolicyDocumentExample =
+      new DataAwsNetworkmanagerCoreNetworkPolicyDocument(this, "example_3", {
+        coreNetworkConfiguration: [
+          {
+            asnRanges: ["65022-65534"],
+            edgeLocations: [
+              {
+                location: "us-west-2",
+              },
+            ],
+          },
+        ],
+        segmentActions: [
+          {
+            action: "create-route",
+            destinationCidrBlocks: ["0.0.0.0/0"],
+            destinations: [
+              Token.asString(awsNetworkmanagerVpcAttachmentExample.id),
+            ],
+            segment: "segment",
+          },
+        ],
+        segments: [
+          {
+            name: "segment",
+          },
+        ],
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsNetworkmanagerCoreNetworkPolicyDocumentExample.overrideLogicalId(
+      "example"
+    );
+    const awsNetworkmanagerCoreNetworkPolicyAttachmentExample =
+      new NetworkmanagerCoreNetworkPolicyAttachment(this, "example_4", {
+        coreNetworkId: Token.asString(awsNetworkmanagerCoreNetworkExample.id),
+        policyDocument: Token.asString(
+          dataAwsNetworkmanagerCoreNetworkPolicyDocumentExample.json
+        ),
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsNetworkmanagerCoreNetworkPolicyAttachmentExample.overrideLogicalId(
+      "example"
+    );
+  }
+}
+
+```
+
+### With VPC Attachment (Multi-Region)
+
+The example below illustrates the scenario where your policy document has static routes pointing to VPC attachments and you want to attach your VPCs to the core network before applying the desired policy document. Set the `createBasePolicy` argument of the [`awsNetworkmanagerCoreNetwork` resource](/docs/providers/aws/r/networkmanager_core_network.html) to `true` if your core network does not currently have any `live` policies (e.g. this is the first `terraform apply` with the core network resource), since a `live` policy is required before VPCs can be attached to the core network. Otherwise, if your core network already has a `live` policy, you may exclude the `createBasePolicy` argument. For multi-region in a core network that does not yet have a `live` policy, there are 2 options:
+
+- Option 1: Use the `basePolicyDocument` argument that allows the most customizations to a base policy. Use this to customize the `edgeLocations` `asn`. In the example below, `usWest2`, `usEast1` and specific ASNs are used in the base policy.
+- Option 2: Pass a list of regions to the `awsNetworkmanagerCoreNetwork` `basePolicyRegions` argument. In the example below, `usWest2` and `usEast1` are specified in the base policy.
+
+#### Option 1 - using base_policy_document
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, Fn, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsNetworkmanagerCoreNetworkPolicyDocument } from "./.gen/providers/aws/data-aws-networkmanager-core-network-policy-document";
+import { NetworkmanagerCoreNetwork } from "./.gen/providers/aws/networkmanager-core-network";
+import { NetworkmanagerCoreNetworkPolicyAttachment } from "./.gen/providers/aws/networkmanager-core-network-policy-attachment";
+import { NetworkmanagerGlobalNetwork } from "./.gen/providers/aws/networkmanager-global-network";
+import { NetworkmanagerVpcAttachment } from "./.gen/providers/aws/networkmanager-vpc-attachment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new NetworkmanagerGlobalNetwork(this, "example", {});
+    const base = new DataAwsNetworkmanagerCoreNetworkPolicyDocument(
+      this,
+      "base",
+      {
+        coreNetworkConfiguration: [
+          {
+            asnRanges: ["65022-65534"],
+            edgeLocations: [
+              {
+                asn: "65500",
+                location: "us-west-2",
+              },
+              {
+                asn: "65501",
+                location: "us-east-1",
+              },
+            ],
+          },
+        ],
+        segments: [
+          {
+            name: "segment",
+          },
+        ],
+      }
+    );
+    const awsNetworkmanagerCoreNetworkExample = new NetworkmanagerCoreNetwork(
+      this,
+      "example_2",
+      {
+        basePolicyDocument: Token.asString(base.json),
+        createBasePolicy: true,
+        globalNetworkId: example.id,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsNetworkmanagerCoreNetworkExample.overrideLogicalId("example");
+    const exampleUsEast1 = new NetworkmanagerVpcAttachment(
+      this,
+      "example_us_east_1",
+      {
+        coreNetworkId: Token.asString(awsNetworkmanagerCoreNetworkExample.id),
+        provider: "alternate",
+        subnetArns: Token.asList(
+          Fn.lookupNested(awsSubnetExampleUsEast1, ["*", "arn"])
+        ),
+        vpcArn: Token.asString(awsVpcExampleUsEast1.arn),
+      }
+    );
+    const exampleUsWest2 = new NetworkmanagerVpcAttachment(
+      this,
+      "example_us_west_2",
+      {
+        coreNetworkId: Token.asString(awsNetworkmanagerCoreNetworkExample.id),
+        subnetArns: Token.asList(
+          Fn.lookupNested(awsSubnetExampleUsWest2, ["*", "arn"])
+        ),
+        vpcArn: Token.asString(awsVpcExampleUsWest2.arn),
+      }
+    );
+    const dataAwsNetworkmanagerCoreNetworkPolicyDocumentExample =
+      new DataAwsNetworkmanagerCoreNetworkPolicyDocument(this, "example_5", {
+        coreNetworkConfiguration: [
+          {
+            asnRanges: ["65022-65534"],
+            edgeLocations: [
+              {
+                asn: "65500",
+                location: "us-west-2",
+              },
+              {
+                asn: "65501",
+                location: "us-east-1",
+              },
+            ],
+          },
+        ],
+        segmentActions: [
+          {
+            action: "create-route",
+            destinationCidrBlocks: ["10.0.0.0/16"],
+            destinations: [exampleUsWest2.id],
+            segment: "segment",
+          },
+          {
+            action: "create-route",
+            destinationCidrBlocks: ["10.1.0.0/16"],
+            destinations: [exampleUsEast1.id],
+            segment: "segment",
+          },
+        ],
+        segments: [
+          {
+            name: "segment",
+          },
+          {
+            name: "segment2",
+          },
+        ],
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsNetworkmanagerCoreNetworkPolicyDocumentExample.overrideLogicalId(
+      "example"
+    );
+    const awsNetworkmanagerCoreNetworkPolicyAttachmentExample =
+      new NetworkmanagerCoreNetworkPolicyAttachment(this, "example_6", {
+        coreNetworkId: Token.asString(awsNetworkmanagerCoreNetworkExample.id),
+        policyDocument: Token.asString(
+          dataAwsNetworkmanagerCoreNetworkPolicyDocumentExample.json
+        ),
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsNetworkmanagerCoreNetworkPolicyAttachmentExample.overrideLogicalId(
+      "example"
+    );
+  }
+}
+
+```
+
+#### Option 2 - using base_policy_regions
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, Fn, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsNetworkmanagerCoreNetworkPolicyDocument } from "./.gen/providers/aws/data-aws-networkmanager-core-network-policy-document";
+import { NetworkmanagerCoreNetwork } from "./.gen/providers/aws/networkmanager-core-network";
+import { NetworkmanagerCoreNetworkPolicyAttachment } from "./.gen/providers/aws/networkmanager-core-network-policy-attachment";
+import { NetworkmanagerGlobalNetwork } from "./.gen/providers/aws/networkmanager-global-network";
+import { NetworkmanagerVpcAttachment } from "./.gen/providers/aws/networkmanager-vpc-attachment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new NetworkmanagerGlobalNetwork(this, "example", {});
+    const awsNetworkmanagerCoreNetworkExample = new NetworkmanagerCoreNetwork(
+      this,
+      "example_1",
+      {
+        basePolicyRegions: ["us-west-2", "us-east-1"],
+        createBasePolicy: true,
+        globalNetworkId: example.id,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsNetworkmanagerCoreNetworkExample.overrideLogicalId("example");
+    const exampleUsEast1 = new NetworkmanagerVpcAttachment(
+      this,
+      "example_us_east_1",
+      {
+        coreNetworkId: Token.asString(awsNetworkmanagerCoreNetworkExample.id),
+        provider: "alternate",
+        subnetArns: Token.asList(
+          Fn.lookupNested(awsSubnetExampleUsEast1, ["*", "arn"])
+        ),
+        vpcArn: Token.asString(awsVpcExampleUsEast1.arn),
+      }
+    );
+    const exampleUsWest2 = new NetworkmanagerVpcAttachment(
+      this,
+      "example_us_west_2",
+      {
+        coreNetworkId: Token.asString(awsNetworkmanagerCoreNetworkExample.id),
+        subnetArns: Token.asList(
+          Fn.lookupNested(awsSubnetExampleUsWest2, ["*", "arn"])
+        ),
+        vpcArn: Token.asString(awsVpcExampleUsWest2.arn),
+      }
+    );
+    const dataAwsNetworkmanagerCoreNetworkPolicyDocumentExample =
+      new DataAwsNetworkmanagerCoreNetworkPolicyDocument(this, "example_4", {
+        coreNetworkConfiguration: [
+          {
+            asnRanges: ["65022-65534"],
+            edgeLocations: [
+              {
+                location: "us-west-2",
+              },
+              {
+                location: "us-east-1",
+              },
+            ],
+          },
+        ],
+        segmentActions: [
+          {
+            action: "create-route",
+            destinationCidrBlocks: ["10.0.0.0/16"],
+            destinations: [exampleUsWest2.id],
+            segment: "segment",
+          },
+          {
+            action: "create-route",
+            destinationCidrBlocks: ["10.1.0.0/16"],
+            destinations: [exampleUsEast1.id],
+            segment: "segment",
+          },
+        ],
+        segments: [
+          {
+            name: "segment",
+          },
+          {
+            name: "segment2",
+          },
+        ],
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsNetworkmanagerCoreNetworkPolicyDocumentExample.overrideLogicalId(
+      "example"
+    );
+    const awsNetworkmanagerCoreNetworkPolicyAttachmentExample =
+      new NetworkmanagerCoreNetworkPolicyAttachment(this, "example_5", {
+        coreNetworkId: Token.asString(awsNetworkmanagerCoreNetworkExample.id),
+        policyDocument: Token.asString(
+          dataAwsNetworkmanagerCoreNetworkPolicyDocumentExample.json
+        ),
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsNetworkmanagerCoreNetworkPolicyAttachmentExample.overrideLogicalId(
+      "example"
+    );
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `description` - (Optional) Description of the Core Network.
+* `basePolicyDocument` - (Optional, conflicts with `basePolicyRegion`, `basePolicyRegions`) Sets the base policy document for the core network. Refer to the [Core network policies documentation](https://docs.aws.amazon.com/network-manager/latest/cloudwan/cloudwan-policy-change-sets.html) for more information.
+* `basePolicyRegion` - (Optional, **Deprecated** use the `basePolicyRegions` or `basePolicyDocument` argument instead) The base policy created by setting the `createBasePolicy` argument to `true` requires a region to be set in the `edgeLocations`, `location` key. If `basePolicyRegion` is not specified, the region used in the base policy defaults to the region specified in the `provider` block.
+* `basePolicyRegions` - (Optional, conflicts with `basePolicyRegion`, `basePolicyDocument`) A list of regions to add to the base policy. The base policy created by setting the `createBasePolicy` argument to `true` requires one or more regions to be set in the `edgeLocations`, `location` key. If `basePolicyRegions` is not specified, the region used in the base policy defaults to the region specified in the `provider` block.
+* `createBasePolicy` - (Optional) Specifies whether to create a base policy when a core network is created or updated. A base policy is created and set to `live` to allow attachments to the core network (e.g. VPC Attachments) before applying a policy document provided using the [`awsNetworkmanagerCoreNetworkPolicyAttachment` resource](/docs/providers/aws/r/networkmanager_core_network_policy_attachment.html). This base policy is needed if your core network does not have any `live` policies and your policy document has static routes pointing to VPC attachments and you want to attach your VPCs to the core network before applying the desired policy document. Valid values are `true` or `false`. An example of this Terraform snippet can be found above [for VPC Attachment in a single region](#with-vpc-attachment-single-region) and [for VPC Attachment multi-region](#with-vpc-attachment-multi-region). An example base policy is shown below. This base policy is overridden with the policy that you specify in the [`awsNetworkmanagerCoreNetworkPolicyAttachment` resource](/docs/providers/aws/r/networkmanager_core_network_policy_attachment.html).
+
+```json
+{
+  "version": "2021.12",
+  "core-network-configuration": {
+    "asn-ranges": [
+      "64512-65534"
+    ],
+    "vpn-ecmp-support": false,
+    "edge-locations": [
+      {
+        "location": "us-east-1"
+      }
+    ]
+  },
+  "segments": [
+    {
+      "name": "segment",
+      "description": "base-policy",
+      "isolate-attachments": false,
+      "require-attachment-acceptance": false
+    }
+  ]
+}
+```
+
+* `globalNetworkId` - (Required) The ID of the global network that a core network will be a part of.
+* `tags` - (Optional) Key-value tags for the Core Network. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `30M`)
+* `delete` - (Default `30M`)
+* `update` - (Default `30M`)
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Core Network Amazon Resource Name (ARN).
+* `createdAt` - Timestamp when a core network was created.
+* `edges` - One or more blocks detailing the edges within a core network. [Detailed below](#edges).
+* `id` - Core Network ID.
+* `segments` - One or more blocks detailing the segments within a core network. [Detailed below](#segments).
+* `state` - Current state of a core network.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+### `edges`
+
+The `edges` configuration block supports the following arguments:
+
+* `asn` - ASN of a core network edge.
+* `edgeLocation` - Region where a core network edge is located.
+* `insideCidrBlocks` - Inside IP addresses used for core network edges.
+
+### `segments`
+
+The `segments` configuration block supports the following arguments:
+
+* `edgeLocations` - Regions where the edges are located.
+* `name` - Name of a core network segment.
+* `sharedSegments` - Shared segments of a core network.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsNetworkmanagerCoreNetwork` using the core network ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsNetworkmanagerCoreNetwork` using the core network ID. For example:
+
+```console
+% terraform import aws_networkmanager_core_network.example core-network-0d47f6t230mz46dy4
+```
+
+<!-- cache-key: cdktf-0.18.0 input-65bc1bb6eff4f779705d87b8ae3f33739b14d06acb55ff16a01c2f5413f72a00 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/networkmanager_core_network_policy_attachment.html.markdown b/website/docs/cdktf/typescript/r/networkmanager_core_network_policy_attachment.html.markdown
new file mode 100644
index 00000000000..1d5bc35751f
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/networkmanager_core_network_policy_attachment.html.markdown
@@ -0,0 +1,556 @@
+---
+subcategory: "Network Manager"
+layout: "aws"
+page_title: "AWS: aws_networkmanager_core_network_policy_attachment"
+description: |-
+  Provides a Core Network Policy Attachment resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_networkmanager_core_network_policy_attachment
+
+Provides a Core Network Policy Attachment resource. This puts a Core Network Policy to an existing Core Network and executes the change set, which deploys changes globally based on the policy submitted (Sets the policy to `live`).
+
+~> **NOTE:** Deleting this resource will not delete the current policy defined in this resource. Deleting this resource will also not revert the current `live` policy to the previous version.
+
+## Example Usage
+
+### Basic
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { NetworkmanagerCoreNetwork } from "./.gen/providers/aws/networkmanager-core-network";
+import { NetworkmanagerCoreNetworkPolicyAttachment } from "./.gen/providers/aws/networkmanager-core-network-policy-attachment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new NetworkmanagerCoreNetwork(this, "example", {
+      globalNetworkId: Token.asString(awsNetworkmanagerGlobalNetworkExample.id),
+    });
+    const awsNetworkmanagerCoreNetworkPolicyAttachmentExample =
+      new NetworkmanagerCoreNetworkPolicyAttachment(this, "example_1", {
+        coreNetworkId: example.id,
+        policyDocument: Token.asString(
+          dataAwsNetworkmanagerCoreNetworkPolicyDocumentExample.json
+        ),
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsNetworkmanagerCoreNetworkPolicyAttachmentExample.overrideLogicalId(
+      "example"
+    );
+  }
+}
+
+```
+
+### With VPC Attachment (Single Region)
+
+The example below illustrates the scenario where your policy document has static routes pointing to VPC attachments and you want to attach your VPCs to the core network before applying the desired policy document. Set the `createBasePolicy` argument of the [`awsNetworkmanagerCoreNetwork` resource](/docs/providers/aws/r/networkmanager_core_network.html) to `true` if your core network does not currently have any `live` policies (e.g. this is the first `terraform apply` with the core network resource), since a `live` policy is required before VPCs can be attached to the core network. Otherwise, if your core network already has a `live` policy, you may exclude the `createBasePolicy` argument. There are 2 options to implement this:
+
+- Option 1: Use the `basePolicyDocument` argument in the [`awsNetworkmanagerCoreNetwork` resource](/docs/providers/aws/r/networkmanager_core_network.html) that allows the most customizations to a base policy. Use this to customize the `edgeLocations` `asn`. In the example below, `usWest2` and ASN `65500` are used in the base policy.
+- Option 2: Use the `createBasePolicy` argument only. This creates a base policy in the region specified in the `provider` block.
+
+#### Option 1 - using base_policy_document
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, Fn, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsNetworkmanagerCoreNetworkPolicyDocument } from "./.gen/providers/aws/data-aws-networkmanager-core-network-policy-document";
+import { NetworkmanagerCoreNetwork } from "./.gen/providers/aws/networkmanager-core-network";
+import { NetworkmanagerCoreNetworkPolicyAttachment } from "./.gen/providers/aws/networkmanager-core-network-policy-attachment";
+import { NetworkmanagerGlobalNetwork } from "./.gen/providers/aws/networkmanager-global-network";
+import { NetworkmanagerVpcAttachment } from "./.gen/providers/aws/networkmanager-vpc-attachment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new NetworkmanagerGlobalNetwork(this, "example", {});
+    const base = new DataAwsNetworkmanagerCoreNetworkPolicyDocument(
+      this,
+      "base",
+      {
+        coreNetworkConfiguration: [
+          {
+            asnRanges: ["65022-65534"],
+            edgeLocations: [
+              {
+                asn: "65500",
+                location: "us-west-2",
+              },
+            ],
+          },
+        ],
+        segments: [
+          {
+            name: "segment",
+          },
+        ],
+      }
+    );
+    const awsNetworkmanagerCoreNetworkExample = new NetworkmanagerCoreNetwork(
+      this,
+      "example_2",
+      {
+        basePolicyDocument: Token.asString(base.json),
+        createBasePolicy: true,
+        globalNetworkId: example.id,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsNetworkmanagerCoreNetworkExample.overrideLogicalId("example");
+    const awsNetworkmanagerVpcAttachmentExample =
+      new NetworkmanagerVpcAttachment(this, "example_3", {
+        coreNetworkId: Token.asString(awsNetworkmanagerCoreNetworkExample.id),
+        subnetArns: Token.asList(
+          Fn.lookupNested(awsSubnetExample, ["*", "arn"])
+        ),
+        vpcArn: Token.asString(awsVpcExample.arn),
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsNetworkmanagerVpcAttachmentExample.overrideLogicalId("example");
+    const dataAwsNetworkmanagerCoreNetworkPolicyDocumentExample =
+      new DataAwsNetworkmanagerCoreNetworkPolicyDocument(this, "example_4", {
+        coreNetworkConfiguration: [
+          {
+            asnRanges: ["65022-65534"],
+            edgeLocations: [
+              {
+                asn: "65500",
+                location: "us-west-2",
+              },
+            ],
+          },
+        ],
+        segmentActions: [
+          {
+            action: "create-route",
+            destinationCidrBlocks: ["0.0.0.0/0"],
+            destinations: [
+              Token.asString(awsNetworkmanagerVpcAttachmentExample.id),
+            ],
+            segment: "segment",
+          },
+        ],
+        segments: [
+          {
+            name: "segment",
+          },
+        ],
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsNetworkmanagerCoreNetworkPolicyDocumentExample.overrideLogicalId(
+      "example"
+    );
+    const awsNetworkmanagerCoreNetworkPolicyAttachmentExample =
+      new NetworkmanagerCoreNetworkPolicyAttachment(this, "example_5", {
+        coreNetworkId: Token.asString(awsNetworkmanagerCoreNetworkExample.id),
+        policyDocument: Token.asString(
+          dataAwsNetworkmanagerCoreNetworkPolicyDocumentExample.json
+        ),
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsNetworkmanagerCoreNetworkPolicyAttachmentExample.overrideLogicalId(
+      "example"
+    );
+  }
+}
+
+```
+
+#### Option 2 - create_base_policy only
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, Fn, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsNetworkmanagerCoreNetworkPolicyDocument } from "./.gen/providers/aws/data-aws-networkmanager-core-network-policy-document";
+import { NetworkmanagerCoreNetwork } from "./.gen/providers/aws/networkmanager-core-network";
+import { NetworkmanagerCoreNetworkPolicyAttachment } from "./.gen/providers/aws/networkmanager-core-network-policy-attachment";
+import { NetworkmanagerGlobalNetwork } from "./.gen/providers/aws/networkmanager-global-network";
+import { NetworkmanagerVpcAttachment } from "./.gen/providers/aws/networkmanager-vpc-attachment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new NetworkmanagerGlobalNetwork(this, "example", {});
+    const awsNetworkmanagerCoreNetworkExample = new NetworkmanagerCoreNetwork(
+      this,
+      "example_1",
+      {
+        createBasePolicy: true,
+        globalNetworkId: example.id,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsNetworkmanagerCoreNetworkExample.overrideLogicalId("example");
+    const awsNetworkmanagerVpcAttachmentExample =
+      new NetworkmanagerVpcAttachment(this, "example_2", {
+        coreNetworkId: Token.asString(awsNetworkmanagerCoreNetworkExample.id),
+        subnetArns: Token.asList(
+          Fn.lookupNested(awsSubnetExample, ["*", "arn"])
+        ),
+        vpcArn: Token.asString(awsVpcExample.arn),
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsNetworkmanagerVpcAttachmentExample.overrideLogicalId("example");
+    const dataAwsNetworkmanagerCoreNetworkPolicyDocumentExample =
+      new DataAwsNetworkmanagerCoreNetworkPolicyDocument(this, "example_3", {
+        coreNetworkConfiguration: [
+          {
+            asnRanges: ["65022-65534"],
+            edgeLocations: [
+              {
+                location: "us-west-2",
+              },
+            ],
+          },
+        ],
+        segmentActions: [
+          {
+            action: "create-route",
+            destinationCidrBlocks: ["0.0.0.0/0"],
+            destinations: [
+              Token.asString(awsNetworkmanagerVpcAttachmentExample.id),
+            ],
+            segment: "segment",
+          },
+        ],
+        segments: [
+          {
+            name: "segment",
+          },
+        ],
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsNetworkmanagerCoreNetworkPolicyDocumentExample.overrideLogicalId(
+      "example"
+    );
+    const awsNetworkmanagerCoreNetworkPolicyAttachmentExample =
+      new NetworkmanagerCoreNetworkPolicyAttachment(this, "example_4", {
+        coreNetworkId: Token.asString(awsNetworkmanagerCoreNetworkExample.id),
+        policyDocument: Token.asString(
+          dataAwsNetworkmanagerCoreNetworkPolicyDocumentExample.json
+        ),
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsNetworkmanagerCoreNetworkPolicyAttachmentExample.overrideLogicalId(
+      "example"
+    );
+  }
+}
+
+```
+
+### With VPC Attachment (Multi-Region)
+
+The example below illustrates the scenario where your policy document has static routes pointing to VPC attachments and you want to attach your VPCs to the core network before applying the desired policy document. Set the `createBasePolicy` argument of the [`awsNetworkmanagerCoreNetwork` resource](/docs/providers/aws/r/networkmanager_core_network.html) to `true` if your core network does not currently have any `live` policies (e.g. this is the first `terraform apply` with the core network resource), since a `live` policy is required before VPCs can be attached to the core network. Otherwise, if your core network already has a `live` policy, you may exclude the `createBasePolicy` argument. For multi-region in a core network that does not yet have a `live` policy, there are 2 options:
+
+- Option 1: Use the `basePolicyDocument` argument that allows the most customizations to a base policy. Use this to customize the `edgeLocations` `asn`. In the example below, `usWest2`, `usEast1` and specific ASNs are used in the base policy.
+- Option 2: Pass a list of regions to the [`awsNetworkmanagerCoreNetwork` resource](/docs/providers/aws/r/networkmanager_core_network.html) `basePolicyRegions` argument. In the example below, `usWest2` and `usEast1` are specified in the base policy.
+
+#### Option 1 - using base_policy_document
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, Fn, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsNetworkmanagerCoreNetworkPolicyDocument } from "./.gen/providers/aws/data-aws-networkmanager-core-network-policy-document";
+import { NetworkmanagerCoreNetwork } from "./.gen/providers/aws/networkmanager-core-network";
+import { NetworkmanagerCoreNetworkPolicyAttachment } from "./.gen/providers/aws/networkmanager-core-network-policy-attachment";
+import { NetworkmanagerGlobalNetwork } from "./.gen/providers/aws/networkmanager-global-network";
+import { NetworkmanagerVpcAttachment } from "./.gen/providers/aws/networkmanager-vpc-attachment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new NetworkmanagerGlobalNetwork(this, "example", {});
+    const base = new DataAwsNetworkmanagerCoreNetworkPolicyDocument(
+      this,
+      "base",
+      {
+        coreNetworkConfiguration: [
+          {
+            asnRanges: ["65022-65534"],
+            edgeLocations: [
+              {
+                asn: "65500",
+                location: "us-west-2",
+              },
+              {
+                asn: "65501",
+                location: "us-east-1",
+              },
+            ],
+          },
+        ],
+        segments: [
+          {
+            name: "segment",
+          },
+        ],
+      }
+    );
+    const awsNetworkmanagerCoreNetworkExample = new NetworkmanagerCoreNetwork(
+      this,
+      "example_2",
+      {
+        basePolicyDocument: Token.asString(base.json),
+        createBasePolicy: true,
+        globalNetworkId: example.id,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsNetworkmanagerCoreNetworkExample.overrideLogicalId("example");
+    const exampleUsEast1 = new NetworkmanagerVpcAttachment(
+      this,
+      "example_us_east_1",
+      {
+        coreNetworkId: Token.asString(awsNetworkmanagerCoreNetworkExample.id),
+        provider: "alternate",
+        subnetArns: Token.asList(
+          Fn.lookupNested(awsSubnetExampleUsEast1, ["*", "arn"])
+        ),
+        vpcArn: Token.asString(awsVpcExampleUsEast1.arn),
+      }
+    );
+    const exampleUsWest2 = new NetworkmanagerVpcAttachment(
+      this,
+      "example_us_west_2",
+      {
+        coreNetworkId: Token.asString(awsNetworkmanagerCoreNetworkExample.id),
+        subnetArns: Token.asList(
+          Fn.lookupNested(awsSubnetExampleUsWest2, ["*", "arn"])
+        ),
+        vpcArn: Token.asString(awsVpcExampleUsWest2.arn),
+      }
+    );
+    const dataAwsNetworkmanagerCoreNetworkPolicyDocumentExample =
+      new DataAwsNetworkmanagerCoreNetworkPolicyDocument(this, "example_5", {
+        coreNetworkConfiguration: [
+          {
+            asnRanges: ["65022-65534"],
+            edgeLocations: [
+              {
+                asn: "65500",
+                location: "us-west-2",
+              },
+              {
+                asn: "65501",
+                location: "us-east-1",
+              },
+            ],
+          },
+        ],
+        segmentActions: [
+          {
+            action: "create-route",
+            destinationCidrBlocks: ["10.0.0.0/16"],
+            destinations: [exampleUsWest2.id],
+            segment: "segment",
+          },
+          {
+            action: "create-route",
+            destinationCidrBlocks: ["10.1.0.0/16"],
+            destinations: [exampleUsEast1.id],
+            segment: "segment",
+          },
+        ],
+        segments: [
+          {
+            name: "segment",
+          },
+          {
+            name: "segment2",
+          },
+        ],
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsNetworkmanagerCoreNetworkPolicyDocumentExample.overrideLogicalId(
+      "example"
+    );
+    const awsNetworkmanagerCoreNetworkPolicyAttachmentExample =
+      new NetworkmanagerCoreNetworkPolicyAttachment(this, "example_6", {
+        coreNetworkId: Token.asString(awsNetworkmanagerCoreNetworkExample.id),
+        policyDocument: Token.asString(
+          dataAwsNetworkmanagerCoreNetworkPolicyDocumentExample.json
+        ),
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsNetworkmanagerCoreNetworkPolicyAttachmentExample.overrideLogicalId(
+      "example"
+    );
+  }
+}
+
+```
+
+#### Option 2 - using base_policy_regions
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, Fn, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsNetworkmanagerCoreNetworkPolicyDocument } from "./.gen/providers/aws/data-aws-networkmanager-core-network-policy-document";
+import { NetworkmanagerCoreNetwork } from "./.gen/providers/aws/networkmanager-core-network";
+import { NetworkmanagerCoreNetworkPolicyAttachment } from "./.gen/providers/aws/networkmanager-core-network-policy-attachment";
+import { NetworkmanagerGlobalNetwork } from "./.gen/providers/aws/networkmanager-global-network";
+import { NetworkmanagerVpcAttachment } from "./.gen/providers/aws/networkmanager-vpc-attachment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new NetworkmanagerGlobalNetwork(this, "example", {});
+    const awsNetworkmanagerCoreNetworkExample = new NetworkmanagerCoreNetwork(
+      this,
+      "example_1",
+      {
+        basePolicyRegions: ["us-west-2", "us-east-1"],
+        createBasePolicy: true,
+        globalNetworkId: example.id,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsNetworkmanagerCoreNetworkExample.overrideLogicalId("example");
+    const exampleUsEast1 = new NetworkmanagerVpcAttachment(
+      this,
+      "example_us_east_1",
+      {
+        coreNetworkId: Token.asString(awsNetworkmanagerCoreNetworkExample.id),
+        provider: "alternate",
+        subnetArns: Token.asList(
+          Fn.lookupNested(awsSubnetExampleUsEast1, ["*", "arn"])
+        ),
+        vpcArn: Token.asString(awsVpcExampleUsEast1.arn),
+      }
+    );
+    const exampleUsWest2 = new NetworkmanagerVpcAttachment(
+      this,
+      "example_us_west_2",
+      {
+        coreNetworkId: Token.asString(awsNetworkmanagerCoreNetworkExample.id),
+        subnetArns: Token.asList(
+          Fn.lookupNested(awsSubnetExampleUsWest2, ["*", "arn"])
+        ),
+        vpcArn: Token.asString(awsVpcExampleUsWest2.arn),
+      }
+    );
+    const dataAwsNetworkmanagerCoreNetworkPolicyDocumentExample =
+      new DataAwsNetworkmanagerCoreNetworkPolicyDocument(this, "example_4", {
+        coreNetworkConfiguration: [
+          {
+            asnRanges: ["65022-65534"],
+            edgeLocations: [
+              {
+                location: "us-west-2",
+              },
+              {
+                location: "us-east-1",
+              },
+            ],
+          },
+        ],
+        segmentActions: [
+          {
+            action: "create-route",
+            destinationCidrBlocks: ["10.0.0.0/16"],
+            destinations: [exampleUsWest2.id],
+            segment: "segment",
+          },
+          {
+            action: "create-route",
+            destinationCidrBlocks: ["10.1.0.0/16"],
+            destinations: [exampleUsEast1.id],
+            segment: "segment",
+          },
+        ],
+        segments: [
+          {
+            name: "segment",
+          },
+          {
+            name: "segment2",
+          },
+        ],
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsNetworkmanagerCoreNetworkPolicyDocumentExample.overrideLogicalId(
+      "example"
+    );
+    const awsNetworkmanagerCoreNetworkPolicyAttachmentExample =
+      new NetworkmanagerCoreNetworkPolicyAttachment(this, "example_5", {
+        coreNetworkId: Token.asString(awsNetworkmanagerCoreNetworkExample.id),
+        policyDocument: Token.asString(
+          dataAwsNetworkmanagerCoreNetworkPolicyDocumentExample.json
+        ),
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsNetworkmanagerCoreNetworkPolicyAttachmentExample.overrideLogicalId(
+      "example"
+    );
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `coreNetworkId` - (Required) The ID of the core network that a policy will be attached to and made `live`.
+* `policyDocument` - (Required) Policy document for creating a core network. Note that updating this argument will result in the new policy document version being set as the `latest` and `live` policy document. Refer to the [Core network policies documentation](https://docs.aws.amazon.com/network-manager/latest/cloudwan/cloudwan-policy-change-sets.html) for more information.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `update` - (Default `30M`). If this is the first time attaching a policy to a core network then this timeout value is also used as the `create` timeout value.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `state` - Current state of a core network.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsNetworkmanagerCoreNetworkPolicyAttachment` using the core network ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsNetworkmanagerCoreNetworkPolicyAttachment` using the core network ID. For example:
+
+```console
+% terraform import aws_networkmanager_core_network_policy_attachment.example core-network-0d47f6t230mz46dy4
+```
+
+<!-- cache-key: cdktf-0.18.0 input-34a808698d2a9df593aff61b1eaca0c1844cef8687a30e103f1a946e027e2540 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/networkmanager_customer_gateway_association.html.markdown b/website/docs/cdktf/typescript/r/networkmanager_customer_gateway_association.html.markdown
new file mode 100644
index 00000000000..fc0b54a123b
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/networkmanager_customer_gateway_association.html.markdown
@@ -0,0 +1,151 @@
+---
+subcategory: "Network Manager"
+layout: "aws"
+page_title: "AWS: aws_networkmanager_customer_gateway_association"
+description: |-
+  Associates a customer gateway with a device and optionally, with a link.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_networkmanager_customer_gateway_association
+
+Associates a customer gateway with a device and optionally, with a link.
+If you specify a link, it must be associated with the specified device.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CustomerGateway } from "./.gen/providers/aws/customer-gateway";
+import { Ec2TransitGateway } from "./.gen/providers/aws/ec2-transit-gateway";
+import { NetworkmanagerCustomerGatewayAssociation } from "./.gen/providers/aws/networkmanager-customer-gateway-association";
+import { NetworkmanagerDevice } from "./.gen/providers/aws/networkmanager-device";
+import { NetworkmanagerGlobalNetwork } from "./.gen/providers/aws/networkmanager-global-network";
+import { NetworkmanagerSite } from "./.gen/providers/aws/networkmanager-site";
+import { NetworkmanagerTransitGatewayRegistration } from "./.gen/providers/aws/networkmanager-transit-gateway-registration";
+import { VpnConnection } from "./.gen/providers/aws/vpn-connection";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new CustomerGateway(this, "example", {
+      bgpAsn: Token.asString(65000),
+      ipAddress: "172.83.124.10",
+      type: "ipsec.1",
+    });
+    const awsEc2TransitGatewayExample = new Ec2TransitGateway(
+      this,
+      "example_1",
+      {}
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsEc2TransitGatewayExample.overrideLogicalId("example");
+    const awsNetworkmanagerGlobalNetworkExample =
+      new NetworkmanagerGlobalNetwork(this, "example_2", {
+        description: "example",
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsNetworkmanagerGlobalNetworkExample.overrideLogicalId("example");
+    const awsNetworkmanagerSiteExample = new NetworkmanagerSite(
+      this,
+      "example_3",
+      {
+        globalNetworkId: Token.asString(
+          awsNetworkmanagerGlobalNetworkExample.id
+        ),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsNetworkmanagerSiteExample.overrideLogicalId("example");
+    const awsVpnConnectionExample = new VpnConnection(this, "example_4", {
+      customerGatewayId: example.id,
+      staticRoutesOnly: true,
+      transitGatewayId: Token.asString(awsEc2TransitGatewayExample.id),
+      type: example.type,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsVpnConnectionExample.overrideLogicalId("example");
+    const awsNetworkmanagerDeviceExample = new NetworkmanagerDevice(
+      this,
+      "example_5",
+      {
+        globalNetworkId: Token.asString(
+          awsNetworkmanagerGlobalNetworkExample.id
+        ),
+        siteId: Token.asString(awsNetworkmanagerSiteExample.id),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsNetworkmanagerDeviceExample.overrideLogicalId("example");
+    const awsNetworkmanagerTransitGatewayRegistrationExample =
+      new NetworkmanagerTransitGatewayRegistration(this, "example_6", {
+        dependsOn: [awsVpnConnectionExample],
+        globalNetworkId: Token.asString(
+          awsNetworkmanagerGlobalNetworkExample.id
+        ),
+        transitGatewayArn: Token.asString(awsEc2TransitGatewayExample.arn),
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsNetworkmanagerTransitGatewayRegistrationExample.overrideLogicalId(
+      "example"
+    );
+    const awsNetworkmanagerCustomerGatewayAssociationExample =
+      new NetworkmanagerCustomerGatewayAssociation(this, "example_7", {
+        customerGatewayArn: example.arn,
+        dependsOn: [awsNetworkmanagerTransitGatewayRegistrationExample],
+        deviceId: Token.asString(awsNetworkmanagerDeviceExample.id),
+        globalNetworkId: Token.asString(
+          awsNetworkmanagerGlobalNetworkExample.id
+        ),
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsNetworkmanagerCustomerGatewayAssociationExample.overrideLogicalId(
+      "example"
+    );
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `customerGatewayArn` - (Required) The Amazon Resource Name (ARN) of the customer gateway.
+* `deviceId` - (Required) The ID of the device.
+* `globalNetworkId` - (Required) The ID of the global network.
+* `linkId` - (Optional) The ID of the link.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsNetworkmanagerCustomerGatewayAssociation` using the global network ID and customer gateway ARN. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsNetworkmanagerCustomerGatewayAssociation` using the global network ID and customer gateway ARN. For example:
+
+```console
+% terraform import aws_networkmanager_customer_gateway_association.example global-network-0d47f6t230mz46dy4,arn:aws:ec2:us-west-2:123456789012:customer-gateway/cgw-123abc05e04123abc
+```
+
+<!-- cache-key: cdktf-0.18.0 input-cd1a421b3c65ae404d64a476a24edb9bade1479a58410f9962263fcdb24c17e1 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/networkmanager_device.html.markdown b/website/docs/cdktf/typescript/r/networkmanager_device.html.markdown
new file mode 100644
index 00000000000..fbe37b5392e
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/networkmanager_device.html.markdown
@@ -0,0 +1,94 @@
+---
+subcategory: "Network Manager"
+layout: "aws"
+page_title: "AWS: aws_networkmanager_device"
+description: |-
+  Creates a device in a global network.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_networkmanager_device
+
+Creates a device in a global network. If you specify both a site ID and a location,
+the location of the site is used for visualization in the Network Manager console.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { NetworkmanagerDevice } from "./.gen/providers/aws/networkmanager-device";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new NetworkmanagerDevice(this, "example", {
+      globalNetworkId: Token.asString(awsNetworkmanagerGlobalNetworkExample.id),
+      siteId: Token.asString(awsNetworkmanagerSiteExample.id),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `awsLocation` - (Optional) The AWS location of the device. Documented below.
+* `description` - (Optional) A description of the device.
+* `globalNetworkId` - (Required) The ID of the global network.
+* `location` - (Optional) The location of the device. Documented below.
+* `model` - (Optional) The model of device.
+* `serialNumber` - (Optional) The serial number of the device.
+* `siteId` - (Optional) The ID of the site.
+* `tags` - (Optional) Key-value tags for the device. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `type` - (Optional) The type of device.
+* `vendor` - (Optional) The vendor of the device.
+
+The `awsLocation` object supports the following:
+
+* `subnetArn` - (Optional) The Amazon Resource Name (ARN) of the subnet that the device is located in.
+* `zone` - (Optional) The Zone that the device is located in. Specify the ID of an Availability Zone, Local Zone, Wavelength Zone, or an Outpost.
+
+The `location` object supports the following:
+
+* `address` - (Optional) The physical address.
+* `latitude` - (Optional) The latitude.
+* `longitude` - (Optional) The longitude.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the device.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsNetworkmanagerDevice` using the device ARN. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsNetworkmanagerDevice` using the device ARN. For example:
+
+```console
+% terraform import aws_networkmanager_device.example arn:aws:networkmanager::123456789012:device/global-network-0d47f6t230mz46dy4/device-07f6fd08867abc123
+```
+
+<!-- cache-key: cdktf-0.18.0 input-75ef73ba82c65c2eb02fee62646d84caef3f0d89552cdf12c29281e3363f4d2e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/networkmanager_global_network.html.markdown b/website/docs/cdktf/typescript/r/networkmanager_global_network.html.markdown
new file mode 100644
index 00000000000..0851163394d
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/networkmanager_global_network.html.markdown
@@ -0,0 +1,73 @@
+---
+subcategory: "Network Manager"
+layout: "aws"
+page_title: "AWS: aws_networkmanager_global_network"
+description: |-
+  Provides a global network resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_networkmanager_global_network
+
+Provides a global network resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { NetworkmanagerGlobalNetwork } from "./.gen/providers/aws/networkmanager-global-network";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new NetworkmanagerGlobalNetwork(this, "example", {
+      description: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `description` - (Optional) Description of the Global Network.
+* `tags` - (Optional) Key-value tags for the Global Network. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Global Network Amazon Resource Name (ARN)
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsNetworkmanagerGlobalNetwork` using the global network ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsNetworkmanagerGlobalNetwork` using the global network ID. For example:
+
+```console
+% terraform import aws_networkmanager_global_network.example global-network-0d47f6t230mz46dy4
+```
+
+<!-- cache-key: cdktf-0.18.0 input-45d9523e4e6abfc2c3ebc1524528ff8ab02a7954716f34dfbebd84a6acf5efeb -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/networkmanager_link.html.markdown b/website/docs/cdktf/typescript/r/networkmanager_link.html.markdown
new file mode 100644
index 00000000000..d682e937c13
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/networkmanager_link.html.markdown
@@ -0,0 +1,89 @@
+---
+subcategory: "Network Manager"
+layout: "aws"
+page_title: "AWS: aws_networkmanager_link"
+description: |-
+  Creates a link for a site.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_networkmanager_link
+
+Creates a link for a site.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { NetworkmanagerLink } from "./.gen/providers/aws/networkmanager-link";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new NetworkmanagerLink(this, "example", {
+      bandwidth: {
+        downloadSpeed: 50,
+        uploadSpeed: 10,
+      },
+      globalNetworkId: Token.asString(awsNetworkmanagerGlobalNetworkExample.id),
+      providerName: "MegaCorp",
+      siteId: Token.asString(awsNetworkmanagerSiteExample.id),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `bandwidth` - (Required) The upload speed and download speed in Mbps. Documented below.
+* `description` - (Optional) A description of the link.
+* `globalNetworkId` - (Required) The ID of the global network.
+* `providerName` - (Optional) The provider of the link.
+* `siteId` - (Required) The ID of the site.
+* `tags` - (Optional) Key-value tags for the link. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `type` - (Optional) The type of the link.
+
+The `bandwidth` object supports the following:
+
+* `downloadSpeed` - (Optional) Download speed in Mbps.
+* `uploadSpeed` - (Optional) Upload speed in Mbps.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Link Amazon Resource Name (ARN).
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsNetworkmanagerLink` using the link ARN. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsNetworkmanagerLink` using the link ARN. For example:
+
+```console
+% terraform import aws_networkmanager_link.example arn:aws:networkmanager::123456789012:link/global-network-0d47f6t230mz46dy4/link-444555aaabbb11223
+```
+
+<!-- cache-key: cdktf-0.18.0 input-b3264437514e087e6c9a780921c3cabb87dacb7cfc4e78ab6211866e572c1219 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/networkmanager_link_association.html.markdown b/website/docs/cdktf/typescript/r/networkmanager_link_association.html.markdown
new file mode 100644
index 00000000000..9ee611e1d05
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/networkmanager_link_association.html.markdown
@@ -0,0 +1,75 @@
+---
+subcategory: "Network Manager"
+layout: "aws"
+page_title: "AWS: aws_networkmanager_link_association"
+description: |-
+  Associates a link to a device.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_networkmanager_link_association
+
+Associates a link to a device.
+A device can be associated to multiple links and a link can be associated to multiple devices.
+The device and link must be in the same global network and the same site.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { NetworkmanagerLinkAssociation } from "./.gen/providers/aws/networkmanager-link-association";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new NetworkmanagerLinkAssociation(this, "example", {
+      deviceId: Token.asString(awsNetworkmanagerDeviceExample.id),
+      globalNetworkId: Token.asString(awsNetworkmanagerGlobalNetworkExample.id),
+      linkId: Token.asString(awsNetworkmanagerLinkExample.id),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `deviceId` - (Required) The ID of the device.
+* `globalNetworkId` - (Required) The ID of the global network.
+* `linkId` - (Required) The ID of the link.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsNetworkmanagerLinkAssociation` using the global network ID, link ID and device ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsNetworkmanagerLinkAssociation` using the global network ID, link ID and device ID. For example:
+
+```console
+% terraform import aws_networkmanager_link_association.example global-network-0d47f6t230mz46dy4,link-444555aaabbb11223,device-07f6fd08867abc123
+```
+
+<!-- cache-key: cdktf-0.18.0 input-40890ea635a372c98a61314c53c85c42d78dfac875eaa1ee3c91ed911965df30 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/networkmanager_site.html.markdown b/website/docs/cdktf/typescript/r/networkmanager_site.html.markdown
new file mode 100644
index 00000000000..157eac8e745
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/networkmanager_site.html.markdown
@@ -0,0 +1,89 @@
+---
+subcategory: "Network Manager"
+layout: "aws"
+page_title: "AWS: aws_networkmanager_site"
+description: |-
+  Creates a site in a global network.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_networkmanager_site
+
+Creates a site in a global network.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { NetworkmanagerGlobalNetwork } from "./.gen/providers/aws/networkmanager-global-network";
+import { NetworkmanagerSite } from "./.gen/providers/aws/networkmanager-site";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new NetworkmanagerGlobalNetwork(this, "example", {});
+    const awsNetworkmanagerSiteExample = new NetworkmanagerSite(
+      this,
+      "example_1",
+      {
+        globalNetworkId: example.id,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsNetworkmanagerSiteExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `globalNetworkId` - (Required) The ID of the Global Network to create the site in.
+* `description` - (Optional) Description of the Site.
+* `location` - (Optional) The site location as documented below.
+* `tags` - (Optional) Key-value tags for the Site. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+The `location` object supports the following:
+
+* `address` - (Optional) Address of the location.
+* `latitude` - (Optional) Latitude of the location.
+* `longitude` - (Optional) Longitude of the location.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Site Amazon Resource Name (ARN)
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsNetworkmanagerSite` using the site ARN. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsNetworkmanagerSite` using the site ARN. For example:
+
+```console
+% terraform import aws_networkmanager_site.example arn:aws:networkmanager::123456789012:site/global-network-0d47f6t230mz46dy4/site-444555aaabbb11223
+```
+
+<!-- cache-key: cdktf-0.18.0 input-e2d6d4d05d7119f51cca78b0e0f7b23a8b934476305b572e9b2f32c6097b5694 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/networkmanager_site_to_site_vpn_attachment.html.markdown b/website/docs/cdktf/typescript/r/networkmanager_site_to_site_vpn_attachment.html.markdown
new file mode 100644
index 00000000000..5ebd3522f7f
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/networkmanager_site_to_site_vpn_attachment.html.markdown
@@ -0,0 +1,231 @@
+---
+subcategory: "Network Manager"
+layout: "aws"
+page_title: "AWS: aws_networkmanager_site_to_site_vpn_attachment"
+description: |-
+  Terraform resource for managing an AWS NetworkManager SiteToSiteAttachment.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_networkmanager_site_to_site_vpn_attachment
+
+Terraform resource for managing an AWS NetworkManager SiteToSiteAttachment.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { NetworkmanagerSiteToSiteVpnAttachment } from "./.gen/providers/aws/networkmanager-site-to-site-vpn-attachment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new NetworkmanagerSiteToSiteVpnAttachment(this, "example", {
+      coreNetworkId: Token.asString(awsccNetworkmanagerCoreNetworkExample.id),
+      vpnConnectionArn: Token.asString(awsVpnConnectionExample.arn),
+    });
+  }
+}
+
+```
+
+### Full Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, Fn, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CustomerGateway } from "./.gen/providers/aws/customer-gateway";
+import { DataAwsNetworkmanagerCoreNetworkPolicyDocument } from "./.gen/providers/aws/data-aws-networkmanager-core-network-policy-document";
+import { NetworkmanagerAttachmentAccepter } from "./.gen/providers/aws/networkmanager-attachment-accepter";
+import { NetworkmanagerGlobalNetwork } from "./.gen/providers/aws/networkmanager-global-network";
+import { NetworkmanagerSiteToSiteVpnAttachment } from "./.gen/providers/aws/networkmanager-site-to-site-vpn-attachment";
+import { VpnConnection } from "./.gen/providers/aws/vpn-connection";
+import { NetworkmanagerCoreNetwork } from "./.gen/providers/awscc/networkmanager-core-network";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    /*The following providers are missing schema information and might need manual adjustments to synthesize correctly: awscc.
+    For a more precise conversion please use the --provider flag in convert.*/
+    const test = new CustomerGateway(this, "test", {
+      bgpAsn: Token.asString(65000),
+      ipAddress: "172.0.0.1",
+      type: "ipsec.1",
+    });
+    const awsNetworkmanagerGlobalNetworkTest = new NetworkmanagerGlobalNetwork(
+      this,
+      "test_1",
+      {
+        tags: {
+          Name: "test",
+        },
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsNetworkmanagerGlobalNetworkTest.overrideLogicalId("test");
+    const awsVpnConnectionTest = new VpnConnection(this, "test_2", {
+      customerGatewayId: test.id,
+      tags: {
+        Name: "test",
+      },
+      type: "ipsec.1",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsVpnConnectionTest.overrideLogicalId("test");
+    const dataAwsNetworkmanagerCoreNetworkPolicyDocumentTest =
+      new DataAwsNetworkmanagerCoreNetworkPolicyDocument(this, "test_3", {
+        attachmentPolicies: [
+          {
+            action: {
+              associationMethod: "constant",
+              segment: "shared",
+            },
+            conditionLogic: "or",
+            conditions: [
+              {
+                key: "segment",
+                operator: "equals",
+                type: "tag-value",
+                value: "shared",
+              },
+            ],
+            ruleNumber: 1,
+          },
+        ],
+        coreNetworkConfiguration: [
+          {
+            asnRanges: ["64512-64555"],
+            edgeLocations: [
+              {
+                asn: Token.asString(64512),
+                location: Token.asString(current.name),
+              },
+            ],
+            vpnEcmpSupport: false,
+          },
+        ],
+        segmentActions: [
+          {
+            action: "share",
+            mode: "attachment-route",
+            segment: "shared",
+            shareWith: ["*"],
+          },
+        ],
+        segments: [
+          {
+            description: "SegmentForSharedServices",
+            name: "shared",
+            requireAttachmentAcceptance: true,
+          },
+        ],
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsNetworkmanagerCoreNetworkPolicyDocumentTest.overrideLogicalId(
+      "test"
+    );
+    const awsccNetworkmanagerCoreNetworkTest = new NetworkmanagerCoreNetwork(
+      this,
+      "test_4",
+      {
+        global_network_id: awsNetworkmanagerGlobalNetworkTest.id,
+        policy_document: Fn.jsonencode(
+          Fn.jsondecode(
+            Token.asString(
+              dataAwsNetworkmanagerCoreNetworkPolicyDocumentTest.json
+            )
+          )
+        ),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsccNetworkmanagerCoreNetworkTest.overrideLogicalId("test");
+    const awsNetworkmanagerSiteToSiteVpnAttachmentTest =
+      new NetworkmanagerSiteToSiteVpnAttachment(this, "test_5", {
+        coreNetworkId: Token.asString(awsccNetworkmanagerCoreNetworkTest.id),
+        tags: {
+          segment: "shared",
+        },
+        vpnConnectionArn: Token.asString(awsVpnConnectionTest.arn),
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsNetworkmanagerSiteToSiteVpnAttachmentTest.overrideLogicalId("test");
+    const awsNetworkmanagerAttachmentAccepterTest =
+      new NetworkmanagerAttachmentAccepter(this, "test_6", {
+        attachmentId: Token.asString(
+          awsNetworkmanagerSiteToSiteVpnAttachmentTest.id
+        ),
+        attachmentType: Token.asString(
+          awsNetworkmanagerSiteToSiteVpnAttachmentTest.attachmentType
+        ),
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsNetworkmanagerAttachmentAccepterTest.overrideLogicalId("test");
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+- `coreNetworkId` - (Required) The ID of a core network for the VPN attachment.
+- `vpnConnectionArn` - (Required) The ARN of the site-to-site VPN connection.
+
+The following arguments are optional:
+
+- `tags` - (Optional) Key-value tags for the attachment. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+- `arn` - The ARN of the attachment.
+- `attachmentPolicyRuleNumber` - The policy rule number associated with the attachment.
+- `attachmentType` - The type of attachment.
+- `coreNetworkArn` - The ARN of a core network.
+- `coreNetworkId` - The ID of a core network
+- `edgeLocation` - The Region where the edge is located.
+- `id` - The ID of the attachment.
+- `ownerAccountId` - The ID of the attachment account owner.
+- `resourceArn` - The attachment resource ARN.
+- `segmentName` - The name of the segment attachment.
+- `state` - The state of the attachment.
+- `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsNetworkmanagerSiteToSiteVpnAttachment` using the attachment ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsNetworkmanagerSiteToSiteVpnAttachment` using the attachment ID. For example:
+
+```console
+% terraform import aws_networkmanager_site_to_site_vpn_attachment.example attachment-0f8fa60d2238d1bd8
+```
+
+<!-- cache-key: cdktf-0.18.0 input-8d596e286a25ca280c4219b11ff4ee7e96e1f115294bc53f7b30dbfae1998f54 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/networkmanager_transit_gateway_connect_peer_association.html.markdown b/website/docs/cdktf/typescript/r/networkmanager_transit_gateway_connect_peer_association.html.markdown
new file mode 100644
index 00000000000..23af2342faf
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/networkmanager_transit_gateway_connect_peer_association.html.markdown
@@ -0,0 +1,77 @@
+---
+subcategory: "Network Manager"
+layout: "aws"
+page_title: "AWS: aws_networkmanager_transit_gateway_connect_peer_association"
+description: |-
+  Associates a transit gateway Connect peer with a device, and optionally, with a link.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_networkmanager_transit_gateway_connect_peer_association
+
+Associates a transit gateway Connect peer with a device, and optionally, with a link.
+If you specify a link, it must be associated with the specified device.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { NetworkmanagerTransitGatewayConnectPeerAssociation } from "./.gen/providers/aws/networkmanager-transit-gateway-connect-peer-association";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new NetworkmanagerTransitGatewayConnectPeerAssociation(this, "example", {
+      deviceId: Token.asString(awsNetworkmanagerDeviceExample.id),
+      globalNetworkId: Token.asString(awsNetworkmanagerGlobalNetworkExample.id),
+      transitGatewayConnectPeerArn: Token.asString(
+        awsEc2TransitGatewayConnectPeerExample.arn
+      ),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `deviceId` - (Required) The ID of the device.
+* `globalNetworkId` - (Required) The ID of the global network.
+* `linkId` - (Optional) The ID of the link.
+* `transitGatewayConnectPeerArn` - (Required) The Amazon Resource Name (ARN) of the Connect peer.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsNetworkmanagerTransitGatewayConnectPeerAssociation` using the global network ID and customer gateway ARN. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsNetworkmanagerTransitGatewayConnectPeerAssociation` using the global network ID and customer gateway ARN. For example:
+
+```console
+% terraform import aws_networkmanager_transit_gateway_connect_peer_association.example global-network-0d47f6t230mz46dy4,arn:aws:ec2:us-west-2:123456789012:transit-gateway-connect-peer/tgw-connect-peer-12345678
+```
+
+<!-- cache-key: cdktf-0.18.0 input-863f9d20566b9aac9a5ea20d426d5a2e936d36dc5871ea1c3796a2beebaed7ea -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/networkmanager_transit_gateway_peering.html.markdown b/website/docs/cdktf/typescript/r/networkmanager_transit_gateway_peering.html.markdown
new file mode 100644
index 00000000000..cd3732c3050
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/networkmanager_transit_gateway_peering.html.markdown
@@ -0,0 +1,82 @@
+---
+subcategory: "Network Manager"
+layout: "aws"
+page_title: "AWS: aws_networkmanager_transit_gateway_peering"
+description: |-
+  Creates a peering connection between an AWS Cloud WAN core network and an AWS Transit Gateway.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_networkmanager_transit_gateway_peering
+
+Creates a peering connection between an AWS Cloud WAN core network and an AWS Transit Gateway.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { NetworkmanagerTransitGatewayPeering } from "./.gen/providers/aws/networkmanager-transit-gateway-peering";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new NetworkmanagerTransitGatewayPeering(this, "example", {
+      coreNetworkId: Token.asString(awsccNetworkmanagerCoreNetworkExample.id),
+      transitGatewayArn: Token.asString(awsEc2TransitGatewayExample.arn),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `coreNetworkId` - (Required) The ID of a core network.
+* `tags` - (Optional) Key-value tags for the peering. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `transitGatewayArn` - (Required) The ARN of the transit gateway for the peering request.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Peering Amazon Resource Name (ARN).
+* `coreNetworkArn` - The ARN of the core network.
+* `edgeLocation` - The edge location for the peer.
+* `id` - Peering ID.
+* `ownerAccountId` - The ID of the account owner.
+* `peeringType` - The type of peering. This will be `transitGateway`.
+* `resourceArn` - The resource ARN of the peer.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `transitGatewayPeeringAttachmentId` - The ID of the transit gateway peering attachment.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsNetworkmanagerTransitGatewayPeering` using the peering ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsNetworkmanagerTransitGatewayPeering` using the peering ID. For example:
+
+```console
+% terraform import aws_networkmanager_transit_gateway_peering.example peering-444555aaabbb11223
+```
+
+<!-- cache-key: cdktf-0.18.0 input-850761bfb6bc5f1c587cc31180329d6f710f011b3f0be9c3b8ba3055502f296f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/networkmanager_transit_gateway_registration.html.markdown b/website/docs/cdktf/typescript/r/networkmanager_transit_gateway_registration.html.markdown
new file mode 100644
index 00000000000..5854c4d383f
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/networkmanager_transit_gateway_registration.html.markdown
@@ -0,0 +1,89 @@
+---
+subcategory: "Network Manager"
+layout: "aws"
+page_title: "AWS: aws_networkmanager_transit_gateway_registration"
+description: |-
+  Registers a transit gateway to a global network.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_networkmanager_transit_gateway_registration
+
+Registers a transit gateway to a global network. The transit gateway can be in any AWS Region,
+but it must be owned by the same AWS account that owns the global network.
+You cannot register a transit gateway in more than one global network.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Ec2TransitGateway } from "./.gen/providers/aws/ec2-transit-gateway";
+import { NetworkmanagerGlobalNetwork } from "./.gen/providers/aws/networkmanager-global-network";
+import { NetworkmanagerTransitGatewayRegistration } from "./.gen/providers/aws/networkmanager-transit-gateway-registration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new Ec2TransitGateway(this, "example", {});
+    const awsNetworkmanagerGlobalNetworkExample =
+      new NetworkmanagerGlobalNetwork(this, "example_1", {
+        description: "example",
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsNetworkmanagerGlobalNetworkExample.overrideLogicalId("example");
+    const awsNetworkmanagerTransitGatewayRegistrationExample =
+      new NetworkmanagerTransitGatewayRegistration(this, "example_2", {
+        globalNetworkId: Token.asString(
+          awsNetworkmanagerGlobalNetworkExample.id
+        ),
+        transitGatewayArn: example.arn,
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsNetworkmanagerTransitGatewayRegistrationExample.overrideLogicalId(
+      "example"
+    );
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `globalNetworkId` - (Required) The ID of the Global Network to register to.
+* `transitGatewayArn` - (Required) The ARN of the Transit Gateway to register.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsNetworkmanagerTransitGatewayRegistration` using the global network ID and transit gateway ARN. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsNetworkmanagerTransitGatewayRegistration` using the global network ID and transit gateway ARN. For example:
+
+```console
+% terraform import aws_networkmanager_transit_gateway_registration.example global-network-0d47f6t230mz46dy4,arn:aws:ec2:us-west-2:123456789012:transit-gateway/tgw-123abc05e04123abc
+```
+
+<!-- cache-key: cdktf-0.18.0 input-8baed1ca903bd794c7c27da978d545077eb8d2bb46a566626335caaaaad7c781 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/networkmanager_transit_gateway_route_table_attachment.html.markdown b/website/docs/cdktf/typescript/r/networkmanager_transit_gateway_route_table_attachment.html.markdown
new file mode 100644
index 00000000000..8a57f4b59fe
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/networkmanager_transit_gateway_route_table_attachment.html.markdown
@@ -0,0 +1,89 @@
+---
+subcategory: "Network Manager"
+layout: "aws"
+page_title: "AWS: aws_networkmanager_transit_gateway_route_table_attachment"
+description: |-
+  Creates a transit gateway route table attachment.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_networkmanager_transit_gateway_route_table_attachment
+
+Creates a transit gateway route table attachment.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { NetworkmanagerTransitGatewayRouteTableAttachment } from "./.gen/providers/aws/networkmanager-transit-gateway-route-table-attachment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new NetworkmanagerTransitGatewayRouteTableAttachment(this, "example", {
+      peeringId: Token.asString(
+        awsNetworkmanagerTransitGatewayPeeringExample.id
+      ),
+      transitGatewayRouteTableArn: Token.asString(
+        awsEc2TransitGatewayRouteTableExample.arn
+      ),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `peeringId` - (Required) The ID of the peer for the attachment.
+* `tags` - (Optional) Key-value tags for the attachment. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `transitGatewayRouteTableArn` - (Required) The ARN of the transit gateway route table for the attachment.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Attachment Amazon Resource Name (ARN).
+* `attachmentPolicyRuleNumber` - The policy rule number associated with the attachment.
+* `attachmentType` - The type of attachment.
+* `coreNetworkArn` - The ARN of the core network.
+* `coreNetworkId` - The ID of the core network.
+* `edgeLocation` - The edge location for the peer.
+* `id` - The ID of the attachment.
+* `ownerAccountId` - The ID of the attachment account owner.
+* `resourceArn` - The attachment resource ARN.
+* `segmentName` - The name of the segment attachment.
+* `state` - The state of the attachment.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsNetworkmanagerTransitGatewayRouteTableAttachment` using the attachment ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsNetworkmanagerTransitGatewayRouteTableAttachment` using the attachment ID. For example:
+
+```console
+% terraform import aws_networkmanager_transit_gateway_route_table_attachment.example attachment-0f8fa60d2238d1bd8
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1ea4ce87abed77ca848c109f032b462efb14526d9c3148fc83fd547b44feb72e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/networkmanager_vpc_attachment.html.markdown b/website/docs/cdktf/typescript/r/networkmanager_vpc_attachment.html.markdown
new file mode 100644
index 00000000000..b45390a7beb
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/networkmanager_vpc_attachment.html.markdown
@@ -0,0 +1,97 @@
+---
+subcategory: "Network Manager"
+layout: "aws"
+page_title: "AWS: aws_networkmanager_vpc_attachment"
+description: |-
+  Terraform resource for managing an AWS NetworkManager VpcAttachment.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_networkmanager_vpc_attachment
+
+Terraform resource for managing an AWS NetworkManager VpcAttachment.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { NetworkmanagerVpcAttachment } from "./.gen/providers/aws/networkmanager-vpc-attachment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new NetworkmanagerVpcAttachment(this, "example", {
+      coreNetworkId: Token.asString(awsccNetworkmanagerCoreNetworkExample.id),
+      subnetArns: [Token.asString(awsSubnetExample.arn)],
+      vpcArn: Token.asString(awsVpcExample.arn),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `coreNetworkId` - (Required) The ID of a core network for the VPC attachment.
+* `subnetArns` - (Required) The subnet ARN of the VPC attachment.
+* `vpcArn` - (Required) The ARN of the VPC.
+
+The following arguments are optional:
+
+* `options` - (Optional) Options for the VPC attachment.
+* `tags` - (Optional) Key-value tags for the attachment. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### options
+
+* `applianceModeSupport` - (Optional) Indicates whether appliance mode is supported. If enabled, traffic flow between a source and destination use the same Availability Zone for the VPC attachment for the lifetime of that flow.
+* `ipv6Support` - (Optional) Indicates whether IPv6 is supported.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the attachment.
+* `attachmentPolicyRuleNumber` - The policy rule number associated with the attachment.
+* `attachmentType` - The type of attachment.
+* `coreNetworkArn` - The ARN of a core network.
+* `edgeLocation` - The Region where the edge is located.
+* `id` - The ID of the attachment.
+* `ownerAccountId` - The ID of the attachment account owner.
+* `resourceArn` - The attachment resource ARN.
+* `segmentName` - The name of the segment attachment.
+* `state` - The state of the attachment.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsNetworkmanagerVpcAttachment` using the attachment ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsNetworkmanagerVpcAttachment` using the attachment ID. For example:
+
+```console
+% terraform import aws_networkmanager_vpc_attachment.example attachment-0f8fa60d2238d1bd8
+```
+
+<!-- cache-key: cdktf-0.18.0 input-51496cec261cc73e7833584a7c4c9acbbf6b57c40ae69eab70820ff738d73283 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/oam_link.html.markdown b/website/docs/cdktf/typescript/r/oam_link.html.markdown
new file mode 100644
index 00000000000..57066681753
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/oam_link.html.markdown
@@ -0,0 +1,95 @@
+---
+subcategory: "CloudWatch Observability Access Manager"
+layout: "aws"
+page_title: "AWS: aws_oam_link"
+description: |-
+  Terraform resource for managing an AWS CloudWatch Observability Access Manager Link.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_oam_link
+
+Terraform resource for managing an AWS CloudWatch Observability Access Manager Link.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { OamLink } from "./.gen/providers/aws/oam-link";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new OamLink(this, "example", {
+      labelTemplate: "$AccountName",
+      resourceTypes: ["AWS::CloudWatch::Metric"],
+      sinkIdentifier: test.id,
+      tags: {
+        Env: "prod",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `labelTemplate` - (Required) Human-readable name to use to identify this source account when you are viewing data from it in the monitoring account.
+* `resourceTypes` - (Required) Types of data that the source account shares with the monitoring account.
+* `sinkIdentifier` - (Required) Identifier of the sink to use to create this link.
+
+The following arguments are optional:
+
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the link.
+* `label` - Label that is assigned to this link.
+* `linkId` - ID string that AWS generated as part of the link ARN.
+* `sinkArn` - ARN of the sink that is used for this link.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `1M`)
+* `update` - (Default `1M`)
+* `delete` - (Default `1M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudWatch Observability Access Manager Link using the `arn`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import CloudWatch Observability Access Manager Link using the `arn`. For example:
+
+```console
+% terraform import aws_oam_link.example arn:aws:oam:us-west-2:123456789012:link/link-id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ff78965c47d628d5cd420e2503ed25c914c1d4493bc3eefc1a9e530ca1d58967 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/oam_sink.html.markdown b/website/docs/cdktf/typescript/r/oam_sink.html.markdown
new file mode 100644
index 00000000000..ad9e8168640
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/oam_sink.html.markdown
@@ -0,0 +1,89 @@
+---
+subcategory: "CloudWatch Observability Access Manager"
+layout: "aws"
+page_title: "AWS: aws_oam_sink"
+description: |-
+  Terraform resource for managing an AWS CloudWatch Observability Access Manager Sink.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_oam_sink
+
+Terraform resource for managing an AWS CloudWatch Observability Access Manager Sink.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { OamSink } from "./.gen/providers/aws/oam-sink";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new OamSink(this, "example", {
+      name: "ExampleSink",
+      tags: {
+        Env: "prod",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) Name for the sink.
+
+The following arguments are optional:
+
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Sink.
+* `sinkId` - ID string that AWS generated as part of the sink ARN.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `1M`)
+* `update` - (Default `1M`)
+* `delete` - (Default `1M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudWatch Observability Access Manager Sink using the `arn`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import CloudWatch Observability Access Manager Sink using the `arn`. For example:
+
+```console
+% terraform import aws_oam_sink.example arn:aws:oam:us-west-2:123456789012:sink/sink-id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-bfac1b8a7916df1eba20033d354f70066d912081ba258d1753faa7d442661fb5 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/oam_sink_policy.html.markdown b/website/docs/cdktf/typescript/r/oam_sink_policy.html.markdown
new file mode 100644
index 00000000000..7c809727db2
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/oam_sink_policy.html.markdown
@@ -0,0 +1,111 @@
+---
+subcategory: "CloudWatch Observability Access Manager"
+layout: "aws"
+page_title: "AWS: aws_oam_sink_policy"
+description: |-
+  Terraform resource for managing an AWS CloudWatch Observability Access Manager Sink Policy.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_oam_sink_policy
+
+Terraform resource for managing an AWS CloudWatch Observability Access Manager Sink Policy.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { OamSink } from "./.gen/providers/aws/oam-sink";
+import { OamSinkPolicy } from "./.gen/providers/aws/oam-sink-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new OamSink(this, "example", {
+      name: "ExampleSink",
+    });
+    const awsOamSinkPolicyExample = new OamSinkPolicy(this, "example_1", {
+      policy: Token.asString(
+        Fn.jsonencode({
+          Statement: [
+            {
+              Action: ["oam:CreateLink", "oam:UpdateLink"],
+              Condition: {
+                "ForAllValues:StringEquals": {
+                  "oam:ResourceTypes": [
+                    "AWS::CloudWatch::Metric",
+                    "AWS::Logs::LogGroup",
+                  ],
+                },
+              },
+              Effect: "Allow",
+              Principal: {
+                AWS: ["1111111111111", "222222222222"],
+              },
+              Resource: "*",
+            },
+          ],
+          Version: "2012-10-17",
+        })
+      ),
+      sinkIdentifier: example.id,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsOamSinkPolicyExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `sinkIdentifier` - (Required) ARN of the sink to attach this policy to.
+* `policy` - (Required) JSON policy to use. If you are updating an existing policy, the entire existing policy is replaced by what you specify here.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Sink.
+* `sinkId` - ID string that AWS generated as part of the sink ARN.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `1M`)
+* `update` - (Default `1M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudWatch Observability Access Manager Sink Policy using the `sinkIdentifier`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import CloudWatch Observability Access Manager Sink Policy using the `sinkIdentifier`. For example:
+
+```console
+% terraform import aws_oam_sink_policy.example arn:aws:oam:us-west-2:123456789012:sink/sink-id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-037a8f8dc069aa1440effe505f18867c58c5234b21b04bc16839e7f70855a4b1 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/opensearch_domain.html.markdown b/website/docs/cdktf/typescript/r/opensearch_domain.html.markdown
new file mode 100644
index 00000000000..5b020552bc8
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/opensearch_domain.html.markdown
@@ -0,0 +1,632 @@
+---
+subcategory: "OpenSearch"
+layout: "aws"
+page_title: "AWS: aws_opensearch_domain"
+description: |-
+  Terraform resource for managing an AWS OpenSearch Domain.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_opensearch_domain
+
+Manages an Amazon OpenSearch Domain.
+
+## Elasticsearch vs. OpenSearch
+
+Amazon OpenSearch Service is the successor to Amazon Elasticsearch Service and supports OpenSearch and legacy Elasticsearch OSS (up to 7.10, the final open source version of the software).
+
+OpenSearch Domain configurations are similar in many ways to Elasticsearch Domain configurations. However, there are important differences including these:
+
+* OpenSearch has `engineVersion` while Elasticsearch has `elasticsearchVersion`
+* Versions are specified differently - _e.g._, `elasticsearch710` with OpenSearch vs. `710` for Elasticsearch.
+* `instanceType` argument values end in `search` for OpenSearch vs. `elasticsearch` for Elasticsearch (_e.g._, `t2MicroSearch` vs. `t2MicroElasticsearch`).
+* The AWS-managed service-linked role for OpenSearch is called `awsServiceRoleForAmazonOpenSearchService` instead of `awsServiceRoleForAmazonElasticsearchService` for Elasticsearch.
+
+There are also some potentially unexpected similarities in configurations:
+
+* ARNs for both are prefaced with `arn:aws:es:`.
+* Both OpenSearch and Elasticsearch use assume role policies that refer to the `principal` `service` as `esAmazonawsCom`.
+* IAM policy actions, such as those you will find in `accessPolicies`, are prefaced with `es:` for both.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { OpensearchDomain } from "./.gen/providers/aws/opensearch-domain";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new OpensearchDomain(this, "example", {
+      clusterConfig: {
+        instanceType: "r4.large.search",
+      },
+      domainName: "example",
+      engineVersion: "Elasticsearch_7.10",
+      tags: {
+        Domain: "TestDomain",
+      },
+    });
+  }
+}
+
+```
+
+### Access Policy
+
+-> See also: [`awsOpensearchDomainPolicy` resource](/docs/providers/aws/r/opensearch_domain_policy.html)
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformVariable, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCallerIdentity } from "./.gen/providers/aws/data-aws-caller-identity";
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { DataAwsRegion } from "./.gen/providers/aws/data-aws-region";
+import { OpensearchDomain } from "./.gen/providers/aws/opensearch-domain";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    /*Terraform Variables are not always the best fit for getting inputs in the context of Terraform CDK.
+    You can read more about this at https://cdk.tf/variables*/
+    const domain = new TerraformVariable(this, "domain", {
+      default: "tf-test",
+    });
+    const current = new DataAwsCallerIdentity(this, "current", {});
+    const dataAwsRegionCurrent = new DataAwsRegion(this, "current_2", {});
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsRegionCurrent.overrideLogicalId("current");
+    const example = new DataAwsIamPolicyDocument(this, "example", {
+      statement: [
+        {
+          actions: ["es:*"],
+          condition: [
+            {
+              test: "IpAddress",
+              values: ["66.193.100.22/32"],
+              variable: "aws:SourceIp",
+            },
+          ],
+          effect: "Allow",
+          principals: [
+            {
+              identifiers: ["*"],
+              type: "*",
+            },
+          ],
+          resources: [
+            "arn:aws:es:${" +
+              dataAwsRegionCurrent.name +
+              "}:${" +
+              current.accountId +
+              "}:domain/${" +
+              domain.value +
+              "}/*",
+          ],
+        },
+      ],
+    });
+    const awsOpensearchDomainExample = new OpensearchDomain(this, "example_4", {
+      accessPolicies: Token.asString(example.json),
+      domainName: domain.stringValue,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsOpensearchDomainExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### Log publishing to CloudWatch Logs
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudwatchLogGroup } from "./.gen/providers/aws/cloudwatch-log-group";
+import { CloudwatchLogResourcePolicy } from "./.gen/providers/aws/cloudwatch-log-resource-policy";
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { OpensearchDomain } from "./.gen/providers/aws/opensearch-domain";
+interface MyConfig {
+  domainName: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    const example = new CloudwatchLogGroup(this, "example", {
+      name: "example",
+    });
+    const awsOpensearchDomainExample = new OpensearchDomain(this, "example_1", {
+      logPublishingOptions: [
+        {
+          cloudwatchLogGroupArn: example.arn,
+          logType: "INDEX_SLOW_LOGS",
+        },
+      ],
+      domainName: config.domainName,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsOpensearchDomainExample.overrideLogicalId("example");
+    const dataAwsIamPolicyDocumentExample = new DataAwsIamPolicyDocument(
+      this,
+      "example_2",
+      {
+        statement: [
+          {
+            actions: [
+              "logs:PutLogEvents",
+              "logs:PutLogEventsBatch",
+              "logs:CreateLogStream",
+            ],
+            effect: "Allow",
+            principals: [
+              {
+                identifiers: ["es.amazonaws.com"],
+                type: "Service",
+              },
+            ],
+            resources: ["arn:aws:logs:*"],
+          },
+        ],
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsIamPolicyDocumentExample.overrideLogicalId("example");
+    const awsCloudwatchLogResourcePolicyExample =
+      new CloudwatchLogResourcePolicy(this, "example_3", {
+        policyDocument: Token.asString(dataAwsIamPolicyDocumentExample.json),
+        policyName: "example",
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsCloudwatchLogResourcePolicyExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### VPC based OpenSearch
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformVariable, Token, Fn, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCallerIdentity } from "./.gen/providers/aws/data-aws-caller-identity";
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { DataAwsRegion } from "./.gen/providers/aws/data-aws-region";
+import { DataAwsSubnets } from "./.gen/providers/aws/data-aws-subnets";
+import { DataAwsVpc } from "./.gen/providers/aws/data-aws-vpc";
+import { IamServiceLinkedRole } from "./.gen/providers/aws/iam-service-linked-role";
+import { OpensearchDomain } from "./.gen/providers/aws/opensearch-domain";
+import { SecurityGroup } from "./.gen/providers/aws/security-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    /*Terraform Variables are not always the best fit for getting inputs in the context of Terraform CDK.
+    You can read more about this at https://cdk.tf/variables*/
+    const domain = new TerraformVariable(this, "domain", {
+      default: "tf-test",
+    });
+    const vpc = new TerraformVariable(this, "vpc", {});
+    const example = new IamServiceLinkedRole(this, "example", {
+      awsServiceName: "opensearchservice.amazonaws.com",
+    });
+    const current = new DataAwsCallerIdentity(this, "current", {});
+    const dataAwsRegionCurrent = new DataAwsRegion(this, "current_4", {});
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsRegionCurrent.overrideLogicalId("current");
+    const dataAwsVpcExample = new DataAwsVpc(this, "example_5", {
+      tags: {
+        Name: vpc.stringValue,
+      },
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsVpcExample.overrideLogicalId("example");
+    const awsSecurityGroupExample = new SecurityGroup(this, "example_6", {
+      description: "Managed by Terraform",
+      ingress: [
+        {
+          cidrBlocks: [Token.asString(dataAwsVpcExample.cidrBlock)],
+          fromPort: 443,
+          protocol: "tcp",
+          toPort: 443,
+        },
+      ],
+      name: "${" + vpc.value + "}-opensearch-${" + domain.value + "}",
+      vpcId: Token.asString(dataAwsVpcExample.id),
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSecurityGroupExample.overrideLogicalId("example");
+    const dataAwsIamPolicyDocumentExample = new DataAwsIamPolicyDocument(
+      this,
+      "example_7",
+      {
+        statement: [
+          {
+            actions: ["es:*"],
+            effect: "Allow",
+            principals: [
+              {
+                identifiers: ["*"],
+                type: "*",
+              },
+            ],
+            resources: [
+              "arn:aws:es:${" +
+                dataAwsRegionCurrent.name +
+                "}:${" +
+                current.accountId +
+                "}:domain/${" +
+                domain.value +
+                "}/*",
+            ],
+          },
+        ],
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsIamPolicyDocumentExample.overrideLogicalId("example");
+    const dataAwsSubnetsExample = new DataAwsSubnets(this, "example_8", {
+      filter: [
+        {
+          name: "vpc-id",
+          values: [Token.asString(dataAwsVpcExample.id)],
+        },
+      ],
+      tags: {
+        Tier: "private",
+      },
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsSubnetsExample.overrideLogicalId("example");
+    const awsOpensearchDomainExample = new OpensearchDomain(this, "example_9", {
+      accessPolicies: Token.asString(dataAwsIamPolicyDocumentExample.json),
+      advancedOptions: {
+        "rest.action.multi.allow_explicit_index": "true",
+      },
+      clusterConfig: {
+        instanceType: "m4.large.search",
+        zoneAwarenessEnabled: true,
+      },
+      dependsOn: [example],
+      domainName: domain.stringValue,
+      engineVersion: "OpenSearch_1.0",
+      tags: {
+        Domain: "TestDomain",
+      },
+      vpcOptions: {
+        securityGroupIds: [Token.asString(awsSecurityGroupExample.id)],
+        subnetIds: [
+          Token.asString(Fn.lookupNested(dataAwsSubnetsExample.ids, ["0"])),
+          Token.asString(Fn.lookupNested(dataAwsSubnetsExample.ids, ["1"])),
+        ],
+      },
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsOpensearchDomainExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### Enabling fine-grained access control on an existing domain
+
+This example shows two configurations: one to create a domain without fine-grained access control and the second to modify the domain to enable fine-grained access control. For more information, see [Enabling fine-grained access control](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/fgac.html).
+
+#### First apply
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { OpensearchDomain } from "./.gen/providers/aws/opensearch-domain";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new OpensearchDomain(this, "example", {
+      advancedSecurityOptions: {
+        anonymousAuthEnabled: true,
+        enabled: false,
+        internalUserDatabaseEnabled: true,
+        masterUserOptions: {
+          masterUserName: "example",
+          masterUserPassword: "Barbarbarbar1!",
+        },
+      },
+      clusterConfig: {
+        instanceType: "r5.large.search",
+      },
+      domainEndpointOptions: {
+        enforceHttps: true,
+        tlsSecurityPolicy: "Policy-Min-TLS-1-2-2019-07",
+      },
+      domainName: "ggkitty",
+      ebsOptions: {
+        ebsEnabled: true,
+        volumeSize: 10,
+      },
+      encryptAtRest: {
+        enabled: true,
+      },
+      engineVersion: "Elasticsearch_7.1",
+      nodeToNodeEncryption: {
+        enabled: true,
+      },
+    });
+  }
+}
+
+```
+
+#### Second apply
+
+Notice that the only change is `advancedSecurityOptions0Enabled` is now set to `true`.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { OpensearchDomain } from "./.gen/providers/aws/opensearch-domain";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new OpensearchDomain(this, "example", {
+      advancedSecurityOptions: {
+        anonymousAuthEnabled: true,
+        enabled: true,
+        internalUserDatabaseEnabled: true,
+        masterUserOptions: {
+          masterUserName: "example",
+          masterUserPassword: "Barbarbarbar1!",
+        },
+      },
+      clusterConfig: {
+        instanceType: "r5.large.search",
+      },
+      domainEndpointOptions: {
+        enforceHttps: true,
+        tlsSecurityPolicy: "Policy-Min-TLS-1-2-2019-07",
+      },
+      domainName: "ggkitty",
+      ebsOptions: {
+        ebsEnabled: true,
+        volumeSize: 10,
+      },
+      encryptAtRest: {
+        enabled: true,
+      },
+      engineVersion: "Elasticsearch_7.1",
+      nodeToNodeEncryption: {
+        enabled: true,
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `domainName` - (Required) Name of the domain.
+
+The following arguments are optional:
+
+* `accessPolicies` - (Optional) IAM policy document specifying the access policies for the domain.
+* `advancedOptions` - (Optional) Key-value string pairs to specify advanced configuration options. Note that the values for these configuration options must be strings (wrapped in quotes) or they may be wrong and cause a perpetual diff, causing Terraform to want to recreate your OpenSearch domain on every apply.
+* `advancedSecurityOptions` - (Optional) Configuration block for [fine-grained access control](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/fgac.html). Detailed below.
+* `autoTuneOptions` - (Optional) Configuration block for the Auto-Tune options of the domain. Detailed below.
+* `clusterConfig` - (Optional) Configuration block for the cluster of the domain. Detailed below.
+* `cognitoOptions` - (Optional) Configuration block for authenticating dashboard with Cognito. Detailed below.
+* `domainEndpointOptions` - (Optional) Configuration block for domain endpoint HTTP(S) related options. Detailed below.
+* `ebsOptions` - (Optional) Configuration block for EBS related options, may be required based on chosen [instance size](https://aws.amazon.com/opensearch-service/pricing/). Detailed below.
+* `engineVersion` - (Optional) Either `elasticsearchXY` or `openSearchXY` to specify the engine version for the Amazon OpenSearch Service domain. For example, `openSearch10` or `elasticsearch79`.
+  See [Creating and managing Amazon OpenSearch Service domains](http://docs.aws.amazon.com/opensearch-service/latest/developerguide/createupdatedomains.html#createdomains).
+  Defaults to the lastest version of OpenSearch.
+* `encryptAtRest` - (Optional) Configuration block for encrypt at rest options. Only available for [certain instance types](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/encryption-at-rest.html). Detailed below.
+* `logPublishingOptions` - (Optional) Configuration block for publishing slow and application logs to CloudWatch Logs. This block can be declared multiple times, for each log_type, within the same resource. Detailed below.
+* `nodeToNodeEncryption` - (Optional) Configuration block for node-to-node encryption options. Detailed below.
+* `snapshotOptions` - (Optional) Configuration block for snapshot related options. Detailed below. DEPRECATED. For domains running OpenSearch 5.3 and later, Amazon OpenSearch takes hourly automated snapshots, making this setting irrelevant. For domains running earlier versions, OpenSearch takes daily automated snapshots.
+* `softwareUpdateOptions` - (Optional) Software update options for the domain. Detailed below.
+* `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `vpcOptions` - (Optional) Configuration block for VPC related options. Adding or removing this configuration forces a new resource ([documentation](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/vpc.html)). Detailed below.
+* `offPeakWindowOptions` - (Optional) Configuration to add Off Peak update options. ([documentation](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/off-peak.html)). Detailed below.
+
+### advanced_security_options
+
+* `anonymousAuthEnabled` - (Optional) Whether Anonymous auth is enabled. Enables fine-grained access control on an existing domain. Ignored unless `advancedSecurityOptions` are enabled. _Can only be enabled on an existing domain._
+* `enabled` - (Required, Forces new resource when changing from `true` to `false`) Whether advanced security is enabled.
+* `internalUserDatabaseEnabled` - (Optional) Whether the internal user database is enabled. Default is `false`.
+* `masterUserOptions` - (Optional) Configuration block for the main user. Detailed below.
+
+#### master_user_options
+
+* `masterUserArn` - (Optional) ARN for the main user. Only specify if `internalUserDatabaseEnabled` is not set or set to `false`.
+* `masterUserName` - (Optional) Main user's username, which is stored in the Amazon OpenSearch Service domain's internal database. Only specify if `internalUserDatabaseEnabled` is set to `true`.
+* `masterUserPassword` - (Optional) Main user's password, which is stored in the Amazon OpenSearch Service domain's internal database. Only specify if `internalUserDatabaseEnabled` is set to `true`.
+
+### auto_tune_options
+
+* `desiredState` - (Required) Auto-Tune desired state for the domain. Valid values: `enabled` or `disabled`.
+* `maintenanceSchedule` - (Required if `rollbackOnDisable` is set to `defaultRollback`) Configuration block for Auto-Tune maintenance windows. Can be specified multiple times for each maintenance window. Detailed below.
+* `rollbackOnDisable` - (Optional) Whether to roll back to default Auto-Tune settings when disabling Auto-Tune. Valid values: `defaultRollback` or `noRollback`.
+
+#### maintenance_schedule
+
+* `startAt` - (Required) Date and time at which to start the Auto-Tune maintenance schedule in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8).
+* `duration` - (Required) Configuration block for the duration of the Auto-Tune maintenance window. Detailed below.
+* `cronExpressionForRecurrence` - (Required) A cron expression specifying the recurrence pattern for an Auto-Tune maintenance schedule.
+
+##### duration
+
+* `value` - (Required) An integer specifying the value of the duration of an Auto-Tune maintenance window.
+* `unit` - (Required) Unit of time specifying the duration of an Auto-Tune maintenance window. Valid values: `hours`.
+
+### cluster_config
+
+* `coldStorageOptions` - (Optional) Configuration block containing cold storage configuration. Detailed below.
+* `dedicatedMasterCount` - (Optional) Number of dedicated main nodes in the cluster.
+* `dedicatedMasterEnabled` - (Optional) Whether dedicated main nodes are enabled for the cluster.
+* `dedicatedMasterType` - (Optional) Instance type of the dedicated main nodes in the cluster.
+* `instanceCount` - (Optional) Number of instances in the cluster.
+* `instanceType` - (Optional) Instance type of data nodes in the cluster.
+* `warmCount` - (Optional) Number of warm nodes in the cluster. Valid values are between `2` and `150`. `warmCount` can be only and must be set when `warmEnabled` is set to `true`.
+* `warmEnabled` - (Optional) Whether to enable warm storage.
+* `warmType` - (Optional) Instance type for the OpenSearch cluster's warm nodes. Valid values are `ultrawarm1MediumSearch`, `ultrawarm1LargeSearch` and `ultrawarm1XlargeSearch`. `warmType` can be only and must be set when `warmEnabled` is set to `true`.
+* `zoneAwarenessConfig` - (Optional) Configuration block containing zone awareness settings. Detailed below.
+* `zoneAwarenessEnabled` - (Optional) Whether zone awareness is enabled, set to `true` for multi-az deployment. To enable awareness with three Availability Zones, the `availabilityZoneCount` within the `zoneAwarenessConfig` must be set to `3`.
+
+#### cold_storage_options
+
+* `enabled` - (Optional) Boolean to enable cold storage for an OpenSearch domain. Defaults to `false`. Master and ultrawarm nodes must be enabled for cold storage.
+
+#### zone_awareness_config
+
+* `availabilityZoneCount` - (Optional) Number of Availability Zones for the domain to use with `zoneAwarenessEnabled`. Defaults to `2`. Valid values: `2` or `3`.
+
+### cognito_options
+
+AWS documentation: [Amazon Cognito Authentication for Dashboard](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/es-cognito-auth.html)
+
+* `enabled` - (Optional) Whether Amazon Cognito authentication with Dashboard is enabled or not. Default is `false`.
+* `identityPoolId` - (Required) ID of the Cognito Identity Pool to use.
+* `roleArn` - (Required) ARN of the IAM role that has the AmazonOpenSearchServiceCognitoAccess policy attached.
+* `userPoolId` - (Required) ID of the Cognito User Pool to use.
+
+### domain_endpoint_options
+
+* `customEndpointCertificateArn` - (Optional) ACM certificate ARN for your custom endpoint.
+* `customEndpointEnabled` - (Optional) Whether to enable custom endpoint for the OpenSearch domain.
+* `customEndpoint` - (Optional) Fully qualified domain for your custom endpoint.
+* `enforceHttps` - (Optional) Whether or not to require HTTPS. Defaults to `true`.
+* `tlsSecurityPolicy` - (Optional) Name of the TLS security policy that needs to be applied to the HTTPS endpoint. Valid values:  `policyMinTls10201907` and `policyMinTls12201907`. Terraform will only perform drift detection if a configuration value is provided.
+
+### ebs_options
+
+* `ebsEnabled` - (Required) Whether EBS volumes are attached to data nodes in the domain.
+* `iops` - (Optional) Baseline input/output (I/O) performance of EBS volumes attached to data nodes. Applicable only for the GP3 and Provisioned IOPS EBS volume types.
+* `throughput` - (Required if `volumeType` is set to `gp3`) Specifies the throughput (in MiB/s) of the EBS volumes attached to data nodes. Applicable only for the gp3 volume type.
+* `volumeSize` - (Required if `ebsEnabled` is set to `true`.) Size of EBS volumes attached to data nodes (in GiB).
+* `volumeType` - (Optional) Type of EBS volumes attached to data nodes.
+
+### encrypt_at_rest
+
+~> **Note:** You can enable `encryptAtRest` _in place_ for an existing, unencrypted domain only if you are using OpenSearch or your Elasticsearch version is 6.7 or greater. For other versions, if you enable `encryptAtRest`, Terraform with recreate the domain, potentially causing data loss. For any version, if you disable `encryptAtRest` for an existing, encrypted domain, Terraform will recreate the domain, potentially causing data loss. If you change the `kmsKeyId`, Terraform will also recreate the domain, potentially causing data loss.
+
+* `enabled` - (Required) Whether to enable encryption at rest. If the `encryptAtRest` block is not provided then this defaults to `false`. Enabling encryption on new domains requires an `engineVersion` of `openSearchXY` or `elasticsearch51` or greater.
+* `kmsKeyId` - (Optional) KMS key ARN to encrypt the Elasticsearch domain with. If not specified then it defaults to using the `aws/es` service KMS key. Note that KMS will accept a KMS key ID but will return the key ARN. To prevent Terraform detecting unwanted changes, use the key ARN instead.
+
+### log_publishing_options
+
+* `cloudwatchLogGroupArn` - (Required) ARN of the Cloudwatch log group to which log needs to be published.
+* `enabled` - (Optional, Default: true) Whether given log publishing option is enabled or not.
+* `logType` - (Required) Type of OpenSearch log. Valid values: `indexSlowLogs`, `searchSlowLogs`, `esApplicationLogs`, `auditLogs`.
+
+### node_to_node_encryption
+
+~> **Note:** You can enable `nodeToNodeEncryption` _in place_ for an existing, unencrypted domain only if you are using OpenSearch or your Elasticsearch version is 6.7 or greater. For other versions, if you enable `nodeToNodeEncryption`, Terraform will recreate the domain, potentially causing data loss. For any version, if you disable `nodeToNodeEncryption` for an existing, node-to-node encrypted domain, Terraform will recreate the domain, potentially causing data loss.
+
+* `enabled` - (Required) Whether to enable node-to-node encryption. If the `nodeToNodeEncryption` block is not provided then this defaults to `false`. Enabling node-to-node encryption of a new domain requires an `engineVersion` of `openSearchXY` or `elasticsearch60` or greater.
+
+### snapshot_options
+
+* `automatedSnapshotStartHour` - (Required) Hour during which the service takes an automated daily snapshot of the indices in the domain.
+
+### software_update_options
+
+* `autoSoftwareUpdateEnabled` - (Optional) Whether automatic service software updates are enabled for the domain. Defaults to `false`.
+
+### vpc_options
+
+AWS documentation: [VPC Support for Amazon OpenSearch Service Domains](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/es-vpc.html)
+
+~> **Note:** You must have created the service linked role for the OpenSearch service to use `vpcOptions`. If you need to create the service linked role at the same time as the OpenSearch domain then you must use `dependsOn` to make sure that the role is created before the OpenSearch domain. See the [VPC based ES domain example](#vpc-based-opensearch) above.
+
+-> Security Groups and Subnets referenced in these attributes must all be within the same VPC. This determines what VPC the endpoints are created in.
+
+* `securityGroupIds` - (Optional) List of VPC Security Group IDs to be applied to the OpenSearch domain endpoints. If omitted, the default Security Group for the VPC will be used.
+* `subnetIds` - (Required) List of VPC Subnet IDs for the OpenSearch domain endpoints to be created in.
+
+### off_peak_window_options
+
+AWS documentation: [Off Peak Hours Support for Amazon OpenSearch Service Domains](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/off-peak.html)
+
+* `enabled` - (Optional) Enabled disabled toggle for off-peak update window.
+* `offPeakWindow` - (Optional)
+    * `windowStartTime` - (Optional) 10h window for updates
+        * `hours` - (Required) Starting hour of the 10-hour window for updates
+        * `minutes` - (Required) Starting minute of the 10-hour window for updates
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the domain.
+* `domainId` - Unique identifier for the domain.
+* `domainName` - Name of the OpenSearch domain.
+* `endpoint` - Domain-specific endpoint used to submit index, search, and data upload requests.
+* `dashboardEndpoint` - Domain-specific endpoint for Dashboard without https scheme.
+* `kibanaEndpoint` - (**Deprecated**) Domain-specific endpoint for kibana without https scheme. Use the `dashboardEndpoint` attribute instead.
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `vpcOptions0AvailabilityZones` - If the domain was created inside a VPC, the names of the availability zones the configured `subnetIds` were created inside.
+* `vpcOptions0VpcId` - If the domain was created inside a VPC, the ID of the VPC.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `60M`)
+* `update` - (Default `180M`)
+* `delete` - (Default `90M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import OpenSearch domains using the `domainName`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import OpenSearch domains using the `domainName`. For example:
+
+```console
+% terraform import aws_opensearch_domain.example domain_name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-6be783c117732ccc247a91f3a21b873ce34ae5384be5834b261ffa5d5d287402 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/opensearch_domain_policy.html.markdown b/website/docs/cdktf/typescript/r/opensearch_domain_policy.html.markdown
new file mode 100644
index 00000000000..419f4265903
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/opensearch_domain_policy.html.markdown
@@ -0,0 +1,90 @@
+---
+subcategory: "OpenSearch"
+layout: "aws"
+page_title: "AWS: aws_opensearch_domain_policy"
+description: |-
+  Provides an OpenSearch Domain Policy.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_opensearch_domain_policy
+
+Allows setting policy to an OpenSearch domain while referencing domain attributes (e.g., ARN).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { OpensearchDomain } from "./.gen/providers/aws/opensearch-domain";
+import { OpensearchDomainPolicy } from "./.gen/providers/aws/opensearch-domain-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new OpensearchDomain(this, "example", {
+      domainName: "tf-test",
+      engineVersion: "OpenSearch_1.1",
+    });
+    const main = new DataAwsIamPolicyDocument(this, "main", {
+      statement: [
+        {
+          actions: ["es:*"],
+          condition: [
+            {
+              test: "IpAddress",
+              values: ["127.0.0.1/32"],
+              variable: "aws:SourceIp",
+            },
+          ],
+          effect: "Allow",
+          principals: [
+            {
+              identifiers: ["*"],
+              type: "*",
+            },
+          ],
+          resources: ["${" + example.arn + "}/*"],
+        },
+      ],
+    });
+    const awsOpensearchDomainPolicyMain = new OpensearchDomainPolicy(
+      this,
+      "main_2",
+      {
+        accessPolicies: Token.asString(main.json),
+        domainName: example.domainName,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsOpensearchDomainPolicyMain.overrideLogicalId("main");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `accessPolicies` - (Optional) IAM policy document specifying the access policies for the domain
+* `domainName` - (Required) Name of the domain.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `update` - (Default `180M`)
+* `delete` - (Default `90M`)
+
+<!-- cache-key: cdktf-0.18.0 input-cbfe389ed128278e78c309bf8bace7ca0adbb492e5276f6865e240b0cf869bef -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/opensearch_domain_saml_options.html.markdown b/website/docs/cdktf/typescript/r/opensearch_domain_saml_options.html.markdown
new file mode 100644
index 00000000000..c6fdcfddcf7
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/opensearch_domain_saml_options.html.markdown
@@ -0,0 +1,123 @@
+---
+subcategory: "OpenSearch"
+layout: "aws"
+page_title: "AWS: aws_opensearch_domain_saml_options"
+description: |-
+  Terraform resource for managing SAML authentication options for an AWS OpenSearch Domain.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_opensearch_domain_saml_options
+
+Manages SAML authentication options for an AWS OpenSearch Domain.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { OpensearchDomain } from "./.gen/providers/aws/opensearch-domain";
+import { OpensearchDomainSamlOptions } from "./.gen/providers/aws/opensearch-domain-saml-options";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new OpensearchDomain(this, "example", {
+      clusterConfig: {
+        instanceType: "r4.large.search",
+      },
+      domainName: "example",
+      engineVersion: "OpenSearch_1.1",
+      snapshotOptions: {
+        automatedSnapshotStartHour: 23,
+      },
+      tags: {
+        Domain: "TestDomain",
+      },
+    });
+    const awsOpensearchDomainSamlOptionsExample =
+      new OpensearchDomainSamlOptions(this, "example_1", {
+        domainName: example.domainName,
+        samlOptions: {
+          enabled: true,
+          idp: {
+            entityId: "https://example.com",
+            metadataContent: Token.asString(Fn.file("./saml-metadata.xml")),
+          },
+        },
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsOpensearchDomainSamlOptionsExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `domainName` - (Required) Name of the domain.
+
+The following arguments are optional:
+
+* `samlOptions` - (Optional) SAML authentication options for an AWS OpenSearch Domain.
+
+### saml_options
+
+* `enabled` - (Required) Whether SAML authentication is enabled.
+* `idp` - (Optional) Information from your identity provider.
+* `masterBackendRole` - (Optional) This backend role from the SAML IdP receives full permissions to the cluster, equivalent to a new master user.
+* `masterUserName` - (Optional) This username from the SAML IdP receives full permissions to the cluster, equivalent to a new master user.
+* `rolesKey` - (Optional) Element of the SAML assertion to use for backend roles. Default is roles.
+* `sessionTimeoutMinutes` - (Optional) Duration of a session in minutes after a user logs in. Default is 60. Maximum value is 1,440.
+* `subjectKey` - (Optional) Element of the SAML assertion to use for username. Default is NameID.
+
+#### idp
+
+* `entityId` - (Required) Unique Entity ID of the application in SAML Identity Provider.
+* `metadataContent` - (Required) Metadata of the SAML application in xml format.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Name of the domain the SAML options are associated with.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `update` - (Default `180M`)
+* `delete` - (Default `90M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import OpenSearch domains using the `domainName`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import OpenSearch domains using the `domainName`. For example:
+
+```console
+% terraform import aws_opensearch_domain_saml_options.example domain_name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-522ab8a3e642cd68e52068b5493dbf1fe749aa3105041d3745357f60bcae42f1 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/opensearch_inbound_connection_accepter.html.markdown b/website/docs/cdktf/typescript/r/opensearch_inbound_connection_accepter.html.markdown
new file mode 100644
index 00000000000..8cd1e11dd74
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/opensearch_inbound_connection_accepter.html.markdown
@@ -0,0 +1,104 @@
+---
+subcategory: "OpenSearch"
+layout: "aws"
+page_title: "AWS: aws_opensearch_inbound_connection_accepter"
+description: |-
+  Terraform resource for managing an AWS OpenSearch Inbound Connection Accepter.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_opensearch_inbound_connection_accepter
+
+Manages an [AWS Opensearch Inbound Connection Accepter](https://docs.aws.amazon.com/opensearch-service/latest/APIReference/API_AcceptInboundConnection.html). If connecting domains from different AWS accounts, ensure that the accepter is configured to use the AWS account where the _remote_ opensearch domain exists.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCallerIdentity } from "./.gen/providers/aws/data-aws-caller-identity";
+import { DataAwsRegion } from "./.gen/providers/aws/data-aws-region";
+import { OpensearchInboundConnectionAccepter } from "./.gen/providers/aws/opensearch-inbound-connection-accepter";
+import { OpensearchOutboundConnection } from "./.gen/providers/aws/opensearch-outbound-connection";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const current = new DataAwsCallerIdentity(this, "current", {});
+    const dataAwsRegionCurrent = new DataAwsRegion(this, "current_1", {});
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsRegionCurrent.overrideLogicalId("current");
+    const foo = new OpensearchOutboundConnection(this, "foo", {
+      connectionAlias: "outbound_connection",
+      localDomainInfo: {
+        domainName: localDomain.domainName,
+        ownerId: Token.asString(current.accountId),
+        region: Token.asString(dataAwsRegionCurrent.name),
+      },
+      remoteDomainInfo: {
+        domainName: remoteDomain.domainName,
+        ownerId: Token.asString(current.accountId),
+        region: Token.asString(dataAwsRegionCurrent.name),
+      },
+    });
+    const awsOpensearchInboundConnectionAccepterFoo =
+      new OpensearchInboundConnectionAccepter(this, "foo_3", {
+        connectionId: foo.id,
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsOpensearchInboundConnectionAccepterFoo.overrideLogicalId("foo");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `connectionId` - (Required, Forces new resource) Specifies the ID of the connection to accept.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Id of the connection to accept.
+* `connectionStatus` - Status of the connection request.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `5M`)
+* `delete` - (Default `5M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AWS Opensearch Inbound Connection Accepters using the Inbound Connection ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import AWS Opensearch Inbound Connection Accepters using the Inbound Connection ID. For example:
+
+```console
+% terraform import aws_opensearch_inbound_connection_accepter.foo connection-id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-55e95b97c434786498b87477ae28b40538814eb9c17d405e3c6f2aa8f4d59ff6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/opensearch_outbound_connection.html.markdown b/website/docs/cdktf/typescript/r/opensearch_outbound_connection.html.markdown
new file mode 100644
index 00000000000..390f091f81e
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/opensearch_outbound_connection.html.markdown
@@ -0,0 +1,127 @@
+---
+subcategory: "OpenSearch"
+layout: "aws"
+page_title: "AWS: aws_opensearch_outbound_connection"
+description: |-
+  Terraform resource for managing an AWS OpenSearch Outbound Connection.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_opensearch_outbound_connection
+
+Manages an AWS Opensearch Outbound Connection.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCallerIdentity } from "./.gen/providers/aws/data-aws-caller-identity";
+import { DataAwsRegion } from "./.gen/providers/aws/data-aws-region";
+import { OpensearchOutboundConnection } from "./.gen/providers/aws/opensearch-outbound-connection";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const current = new DataAwsCallerIdentity(this, "current", {});
+    const dataAwsRegionCurrent = new DataAwsRegion(this, "current_1", {});
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsRegionCurrent.overrideLogicalId("current");
+    new OpensearchOutboundConnection(this, "foo", {
+      connectionAlias: "outbound_connection",
+      connectionMode: "DIRECT",
+      localDomainInfo: {
+        domainName: localDomain.domainName,
+        ownerId: Token.asString(current.accountId),
+        region: Token.asString(dataAwsRegionCurrent.name),
+      },
+      remoteDomainInfo: {
+        domainName: remoteDomain.domainName,
+        ownerId: Token.asString(current.accountId),
+        region: Token.asString(dataAwsRegionCurrent.name),
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `connectionAlias` - (Required, Forces new resource) Specifies the connection alias that will be used by the customer for this connection.
+* `connectionMode` - (Required, Forces new resource) Specifies the connection mode. Accepted values are `direct` or `vpcEndpoint`.
+* `acceptConnection` - (Optional, Forces new resource) Accepts the connection.
+* `connectionProperties` - (Optional, Forces new resource) Configuration block for the outbound connection.
+* `localDomainInfo` - (Required, Forces new resource) Configuration block for the local Opensearch domain.
+* `remoteDomainInfo` - (Required, Forces new resource) Configuration block for the remote Opensearch domain.
+
+### connection_properties
+
+* `crossClusterSearch` - (Optional, Forces new resource) Configuration block for cross cluster search.
+
+### cross_cluster_search
+
+* `skipUnavailable` - (Optional, Forces new resource) Skips unavailable clusters and can only be used for cross-cluster searches. Accepted values are `enabled` or `disabled`.
+
+### local_domain_info
+
+* `ownerId` - (Required, Forces new resource) The Account ID of the owner of the local domain.
+* `domainName` - (Required, Forces new resource) The name of the local domain.
+* `region` - (Required, Forces new resource) The region of the local domain.
+
+### remote_domain_info
+
+* `ownerId` - (Required, Forces new resource) The Account ID of the owner of the remote domain.
+* `domainName` - (Required, Forces new resource) The name of the remote domain.
+* `region` - (Required, Forces new resource) The region of the remote domain.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Id of the connection.
+* `connectionStatus` - Status of the connection request.
+
+`connectionProperties` block exports the following:
+
+* `endpoint` - The endpoint of the remote domain, is only set when `connectionMode` is `vpcEndpoint` and `acceptConnection` is `true`.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `5M`)
+* `delete` - (Default `5M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AWS Opensearch Outbound Connections using the Outbound Connection ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import AWS Opensearch Outbound Connections using the Outbound Connection ID. For example:
+
+```console
+% terraform import aws_opensearch_outbound_connection.foo connection-id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-22357101732120a510373c3e4ffc6057617f56b27aa4b15000ded430bddb956a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/opensearch_package.html.markdown b/website/docs/cdktf/typescript/r/opensearch_package.html.markdown
new file mode 100644
index 00000000000..b7c74b3b094
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/opensearch_package.html.markdown
@@ -0,0 +1,104 @@
+---
+subcategory: "OpenSearch"
+layout: "aws"
+page_title: "AWS: aws_opensearch_package"
+description: |-
+  Terraform resource for managing an AWS OpenSearch package.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_opensearch_package
+
+Manages an AWS Opensearch Package.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { OpensearchPackage } from "./.gen/providers/aws/opensearch-package";
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3Object } from "./.gen/providers/aws/s3-object";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const myOpensearchPackages = new S3Bucket(this, "my_opensearch_packages", {
+      bucket: "my-opensearch-packages",
+    });
+    const example = new S3Object(this, "example", {
+      bucket: myOpensearchPackages.bucket,
+      etag: Token.asString(Fn.filemd5("./example.txt")),
+      key: "example.txt",
+      source: "./example.txt",
+    });
+    const awsOpensearchPackageExample = new OpensearchPackage(
+      this,
+      "example_2",
+      {
+        packageName: "example-txt",
+        packageSource: {
+          s3BucketName: myOpensearchPackages.bucket,
+          s3Key: example.key,
+        },
+        packageType: "TXT-DICTIONARY",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsOpensearchPackageExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `packageName` - (Required, Forces new resource) Unique name for the package.
+* `packageType` - (Required, Forces new resource) The type of package.
+* `packageSource` - (Required, Forces new resource) Configuration block for the package source options.
+* `packageDescription` - (Optional, Forces new resource) Description of the package.
+
+### package_source
+
+* `s3BucketName` - (Required, Forces new resource) The name of the Amazon S3 bucket containing the package.
+* `s3Key` - (Required, Forces new resource) Key (file name) of the package.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Id of the package.
+* `availablePackageVersion` - The current version of the package.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AWS Opensearch Packages using the Package ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import AWS Opensearch Packages using the Package ID. For example:
+
+```console
+% terraform import aws_opensearch_package.example package-id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-2ab49a0830ef6a746b9a1be0c59b35031692a911e2d8fee6ae0c1e34af4efbe8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/opensearch_package_association.html.markdown b/website/docs/cdktf/typescript/r/opensearch_package_association.html.markdown
new file mode 100644
index 00000000000..45f5f1bfc07
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/opensearch_package_association.html.markdown
@@ -0,0 +1,80 @@
+---
+subcategory: "OpenSearch"
+layout: "aws"
+page_title: "AWS: aws_opensearch_package_association"
+description: |-
+  Terraform resource for managing an AWS OpenSearch package association.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_opensearch_package_association
+
+Manages an AWS Opensearch Package Association.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { OpensearchDomain } from "./.gen/providers/aws/opensearch-domain";
+import { OpensearchPackage } from "./.gen/providers/aws/opensearch-package";
+import { OpensearchPackageAssociation } from "./.gen/providers/aws/opensearch-package-association";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const myDomain = new OpensearchDomain(this, "my_domain", {
+      clusterConfig: {
+        instanceType: "r4.large.search",
+      },
+      domainName: "my-opensearch-domain",
+      engineVersion: "Elasticsearch_7.10",
+    });
+    const example = new OpensearchPackage(this, "example", {
+      packageName: "example-txt",
+      packageSource: {
+        s3BucketName: myOpensearchPackages.bucket,
+        s3Key: Token.asString(awsS3ObjectExample.key),
+      },
+      packageType: "TXT-DICTIONARY",
+    });
+    const awsOpensearchPackageAssociationExample =
+      new OpensearchPackageAssociation(this, "example_2", {
+        domainName: myDomain.domainName,
+        packageId: example.id,
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsOpensearchPackageAssociationExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `packageId` - (Required, Forces new resource) Internal ID of the package to associate with a domain.
+* `domainName` - (Required, Forces new resource) Name of the domain to associate the package with.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Id of the package association.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `10M`)
+* `delete` - (Default `10M`)
+
+<!-- cache-key: cdktf-0.18.0 input-4bf4fb6525081557853e76c5738da147fbc00142214c947d610c2b6a03303e42 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/opensearch_vpc_endpoint.html.markdown b/website/docs/cdktf/typescript/r/opensearch_vpc_endpoint.html.markdown
new file mode 100644
index 00000000000..182b1e022cf
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/opensearch_vpc_endpoint.html.markdown
@@ -0,0 +1,94 @@
+---
+subcategory: "OpenSearch"
+layout: "aws"
+page_title: "AWS: aws_opensearch_vpc_endpoint"
+description: |-
+  Terraform resource for managing an AWS OpenSearch VPC Endpoint.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_opensearch_vpc_endpoint
+
+Manages an [AWS Opensearch VPC Endpoint](https://docs.aws.amazon.com/opensearch-service/latest/APIReference/API_CreateVpcEndpoint.html). Creates an Amazon OpenSearch Service-managed VPC endpoint.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { OpensearchVpcEndpoint } from "./.gen/providers/aws/";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new OpensearchVpcEndpoint(this, "foo", {
+      domain_arn: domain1.arn,
+      vpc_options: [
+        {
+          security_group_ids: [test.id, test2.id],
+          subnet_ids: [awsSubnetTest.id, awsSubnetTest2.id],
+        },
+      ],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `domainArn` - (Required, Forces new resource) Specifies the Amazon Resource Name (ARN) of the domain to create the endpoint for
+* `vpcOptions` - (Required) Options to specify the subnets and security groups for the endpoint.
+
+### vpc_options
+
+* `securityGroupIds` - (Optional) The list of security group IDs associated with the VPC endpoints for the domain. If you do not provide a security group ID, OpenSearch Service uses the default security group for the VPC.
+* `subnetIds` - (Required) A list of subnet IDs associated with the VPC endpoints for the domain. If your domain uses multiple Availability Zones, you need to provide two subnet IDs, one per zone. Otherwise, provide only one.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The unique identifier of the endpoint.
+* `endpoint` - The connection endpoint ID for connecting to the domain.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `60M`)
+* `update` - (Default `60M`)
+* `delete` - (Default `90M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import OpenSearch VPC endpoint connections using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import OpenSearch VPC endpoint connections using the `id`. For example:
+
+```console
+% terraform import aws_opensearch_vpc_endpoint_connection.example endpoint-id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-0cbd9462478b83364b91f1d0bd36ff42057d2b1fcd8ca135100e7948f9224f93 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/opensearchserverless_access_policy.html.markdown b/website/docs/cdktf/typescript/r/opensearchserverless_access_policy.html.markdown
new file mode 100644
index 00000000000..d6cd789b0c0
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/opensearchserverless_access_policy.html.markdown
@@ -0,0 +1,193 @@
+---
+subcategory: "OpenSearch Serverless"
+layout: "aws"
+page_title: "AWS: aws_opensearchserverless_access_policy"
+description: |-
+  Terraform resource for managing an AWS OpenSearch Serverless Access Policy.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_opensearchserverless_access_policy
+
+Terraform resource for managing an AWS OpenSearch Serverless Access Policy. See AWS documentation for [data access policies](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/serverless-data-access.html) and [supported data access policy permissions](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/serverless-data-access.html#serverless-data-supported-permissions).
+
+## Example Usage
+
+### Grant all collection and index permissions
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCallerIdentity } from "./.gen/providers/aws/data-aws-caller-identity";
+import { OpensearchserverlessAccessPolicy } from "./.gen/providers/aws/opensearchserverless-access-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const current = new DataAwsCallerIdentity(this, "current", {});
+    new OpensearchserverlessAccessPolicy(this, "example", {
+      description: "read and write permissions",
+      name: "example",
+      policy: Token.asString(
+        Fn.jsonencode([
+          {
+            Principal: [current.arn],
+            Rules: [
+              {
+                Permission: ["aoss:*"],
+                Resource: ["index/example-collection/*"],
+                ResourceType: "index",
+              },
+              {
+                Permission: ["aoss:*"],
+                Resource: ["collection/example-collection"],
+                ResourceType: "collection",
+              },
+            ],
+          },
+        ])
+      ),
+      type: "data",
+    });
+  }
+}
+
+```
+
+### Grant read-only collection and index permissions
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCallerIdentity } from "./.gen/providers/aws/data-aws-caller-identity";
+import { OpensearchserverlessAccessPolicy } from "./.gen/providers/aws/opensearchserverless-access-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const current = new DataAwsCallerIdentity(this, "current", {});
+    new OpensearchserverlessAccessPolicy(this, "example", {
+      description: "read-only permissions",
+      name: "example",
+      policy: Token.asString(
+        Fn.jsonencode([
+          {
+            Principal: [current.arn],
+            Rules: [
+              {
+                Permission: ["aoss:DescribeIndex", "aoss:ReadDocument"],
+                Resource: ["index/example-collection/*"],
+                ResourceType: "index",
+              },
+              {
+                Permission: ["aoss:DescribeCollectionItems"],
+                Resource: ["collection/example-collection"],
+                ResourceType: "collection",
+              },
+            ],
+          },
+        ])
+      ),
+      type: "data",
+    });
+  }
+}
+
+```
+
+### Grant SAML identity permissions
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { OpensearchserverlessAccessPolicy } from "./.gen/providers/aws/opensearchserverless-access-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new OpensearchserverlessAccessPolicy(this, "example", {
+      description: "saml permissions",
+      name: "example",
+      policy: Token.asString(
+        Fn.jsonencode([
+          {
+            Principal: [
+              "saml/123456789012/myprovider/user/Annie",
+              "saml/123456789012/anotherprovider/group/Accounting",
+            ],
+            Rules: [
+              {
+                Permission: ["aoss:*"],
+                Resource: ["index/example-collection/*"],
+                ResourceType: "index",
+              },
+              {
+                Permission: ["aoss:*"],
+                Resource: ["collection/example-collection"],
+                ResourceType: "collection",
+              },
+            ],
+          },
+        ])
+      ),
+      type: "data",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) Name of the policy.
+* `policy` - (Required) JSON policy document to use as the content for the new policy
+* `type` - (Required) Type of access policy. Must be `data`.
+
+The following arguments are optional:
+
+* `description` - (Optional) Description of the policy. Typically used to store information about the permissions defined in the policy.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `policyVersion` - Version of the policy.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import OpenSearchServerless Access Policy using the `name` and `type` arguments separated by a slash (`/`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import OpenSearchServerless Access Policy using the `name` and `type` arguments separated by a slash (`/`). For example:
+
+```console
+% terraform import aws_opensearchserverless_access_policy.example example/data
+```
+
+<!-- cache-key: cdktf-0.18.0 input-025702799f46af465a8f782db7f780da1b73dd0220b3ff605a2cb05cd1fc3137 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/opensearchserverless_collection.html.markdown b/website/docs/cdktf/typescript/r/opensearchserverless_collection.html.markdown
new file mode 100644
index 00000000000..ef1271fba6d
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/opensearchserverless_collection.html.markdown
@@ -0,0 +1,114 @@
+---
+subcategory: "OpenSearch Serverless"
+layout: "aws"
+page_title: "AWS: aws_opensearchserverless_collection"
+description: |-
+  Terraform resource for managing an AWS OpenSearch Collection.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_opensearchserverless_collection
+
+Terraform resource for managing an AWS OpenSearch Serverless Collection.
+
+~> **NOTE:** An `awsOpensearchserverlessCollection` cannot be created without having an applicable [encryption security policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/opensearchserverless_security_policy). Use the [`dependsOn`](https://developer.hashicorp.com/terraform/language/meta-arguments/depends_on) meta-argument to define this dependency.
+
+~> **NOTE:** An `awsOpensearchserverlessCollection` is not accessible without configuring an applicable [network security policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/opensearchserverless_security_policy). Data cannot be accessed without configuring an applicable [data access policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/opensearchserverless_access_policy).
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { OpensearchserverlessCollection } from "./.gen/providers/aws/opensearchserverless-collection";
+import { OpensearchserverlessSecurityPolicy } from "./.gen/providers/aws/opensearchserverless-security-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new OpensearchserverlessSecurityPolicy(this, "example", {
+      name: "example",
+      policy: Token.asString(
+        Fn.jsonencode({
+          AWSOwnedKey: true,
+          Rules: [
+            {
+              Resource: ["collection/example"],
+              ResourceType: "collection",
+            },
+          ],
+        })
+      ),
+      type: "encryption",
+    });
+    const awsOpensearchserverlessCollectionExample =
+      new OpensearchserverlessCollection(this, "example_1", {
+        dependsOn: [example],
+        name: "example",
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsOpensearchserverlessCollectionExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) Name of the collection.
+
+The following arguments are optional:
+
+* `description` - (Optional) Description of the collection.
+* `tags` - (Optional) A map of tags to assign to the collection. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `type` - (Optional) Type of collection. One of `search`, `timeseries`, or `vectorsearch`. Defaults to `timeseries`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the collection.
+* `collectionEndpoint` - Collection-specific endpoint used to submit index, search, and data upload requests to an OpenSearch Serverless collection.
+* `dashboardEndpoint` - Collection-specific endpoint used to access OpenSearch Dashboards.
+* `kmsKeyArn` - The ARN of the Amazon Web Services KMS key used to encrypt the collection.
+* `id` - Unique identifier for the collection.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `20M`)
+- `delete` - (Default `20M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import OpenSearchServerless Collection using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import OpenSearchServerless Collection using the `id`. For example:
+
+```console
+% terraform import aws_opensearchserverless_collection.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-6228d2d8e91060f7235e5e926282f581119f807883b0fd65b2ee82f2cc330709 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/opensearchserverless_security_config.html.markdown b/website/docs/cdktf/typescript/r/opensearchserverless_security_config.html.markdown
new file mode 100644
index 00000000000..2b15ecd243d
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/opensearchserverless_security_config.html.markdown
@@ -0,0 +1,92 @@
+---
+subcategory: "OpenSearch Serverless"
+layout: "aws"
+page_title: "AWS: aws_opensearchserverless_security_config"
+description: |-
+  Terraform resource for managing an AWS OpenSearch Serverless Security Config.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_opensearchserverless_security_config
+
+Terraform resource for managing an AWS OpenSearch Serverless Security Config.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { OpensearchserverlessSecurityConfig } from "./.gen/providers/aws/opensearchserverless-security-config";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new OpensearchserverlessSecurityConfig(this, "example", {
+      name: "example",
+      samlOptions: [
+        {
+          metadata: Token.asString(Fn.file("${path.module}/idp-metadata.xml")),
+        },
+      ],
+      type: "saml",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required, Forces new resource) Name of the policy.
+* `samlOptions` - (Required) Configuration block for SAML options.
+* `type` - (Required) Type of configuration. Must be `saml`.
+
+The following arguments are optional:
+
+* `description` - (Optional) Description of the security configuration.
+
+### saml_options
+
+* `groupAttribute` - (Optional) Group attribute for this SAML integration.
+* `metadata` - (Required) The XML IdP metadata file generated from your identity provider.
+* `sessionTimeout` - (Optional) Session timeout, in minutes. Minimum is 5 minutes and maximum is 720 minutes (12 hours). Default is 60 minutes.
+* `userAttribute` - (Optional) User attribute for this SAML integration.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `configVersion` - Version of the configuration.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import OpenSearchServerless Access Policy using the `name` argument prefixed with the string `saml/accountId/`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import OpenSearchServerless Access Policy using the `name` argument prefixed with the string `saml/accountId/`. For example:
+
+```console
+% terraform import aws_opensearchserverless_security_config.example saml/123456789012/example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-e97ed43190ce4b1c367d53c0c942b49ca04c3b1646b849a93a8705b0516e690f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/opensearchserverless_security_policy.html.markdown b/website/docs/cdktf/typescript/r/opensearchserverless_security_policy.html.markdown
new file mode 100644
index 00000000000..a54c3bee6dd
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/opensearchserverless_security_policy.html.markdown
@@ -0,0 +1,309 @@
+---
+subcategory: "OpenSearch Serverless"
+layout: "aws"
+page_title: "AWS: aws_opensearchserverless_security_policy"
+description: |-
+  Terraform resource for managing an AWS OpenSearch Serverless Security Policy.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_opensearchserverless_security_policy
+
+Terraform resource for managing an AWS OpenSearch Serverless Security Policy. See AWS documentation for [encryption policies](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/serverless-encryption.html#serverless-encryption-policies) and [network policies](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/serverless-network.html#serverless-network-policies).
+
+## Example Usage
+
+### Encryption Security Policy
+
+#### Applies to a single collection
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { OpensearchserverlessSecurityPolicy } from "./.gen/providers/aws/opensearchserverless-security-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new OpensearchserverlessSecurityPolicy(this, "example", {
+      description: "encryption security policy for example-collection",
+      name: "example",
+      policy: Token.asString(
+        Fn.jsonencode({
+          AWSOwnedKey: true,
+          Rules: [
+            {
+              Resource: ["collection/example-collection"],
+              ResourceType: "collection",
+            },
+          ],
+        })
+      ),
+      type: "encryption",
+    });
+  }
+}
+
+```
+
+#### Applies to multiple collections
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { OpensearchserverlessSecurityPolicy } from "./.gen/providers/aws/opensearchserverless-security-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new OpensearchserverlessSecurityPolicy(this, "example", {
+      description:
+        'encryption security policy for collections that begin with \\"example\\"',
+      name: "example",
+      policy: Token.asString(
+        Fn.jsonencode({
+          AWSOwnedKey: true,
+          Rules: [
+            {
+              Resource: ["collection/example*"],
+              ResourceType: "collection",
+            },
+          ],
+        })
+      ),
+      type: "encryption",
+    });
+  }
+}
+
+```
+
+#### Using a customer managed key
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { OpensearchserverlessSecurityPolicy } from "./.gen/providers/aws/opensearchserverless-security-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new OpensearchserverlessSecurityPolicy(this, "example", {
+      description: "encryption security policy using customer KMS key",
+      name: "example",
+      policy: Token.asString(
+        Fn.jsonencode({
+          AWSOwnedKey: false,
+          KmsARN:
+            "arn:aws:kms:us-east-1:123456789012:key/93fd6da4-a317-4c17-bfe9-382b5d988b36",
+          Rules: [
+            {
+              Resource: ["collection/customer-managed-key-collection"],
+              ResourceType: "collection",
+            },
+          ],
+        })
+      ),
+      type: "encryption",
+    });
+  }
+}
+
+```
+
+### Network Security Policy
+
+#### Allow public access to the collection endpoint and the Dashboards endpoint
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { OpensearchserverlessSecurityPolicy } from "./.gen/providers/aws/opensearchserverless-security-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new OpensearchserverlessSecurityPolicy(this, "example", {
+      description: "Public access",
+      name: "example",
+      policy: Token.asString(
+        Fn.jsonencode([
+          {
+            AllowFromPublic: true,
+            Description:
+              "Public access to collection and Dashboards endpoint for example collection",
+            Rules: [
+              {
+                Resource: ["collection/example-collection"],
+                ResourceType: "collection",
+              },
+              {
+                Resource: ["collection/example-collection"],
+                ResourceType: "dashboard",
+              },
+            ],
+          },
+        ])
+      ),
+      type: "network",
+    });
+  }
+}
+
+```
+
+#### Allow VPC access to the collection endpoint and the Dashboards endpoint
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { OpensearchserverlessSecurityPolicy } from "./.gen/providers/aws/opensearchserverless-security-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new OpensearchserverlessSecurityPolicy(this, "example", {
+      description: "VPC access",
+      name: "example",
+      policy: Token.asString(
+        Fn.jsonencode([
+          {
+            AllowFromPublic: false,
+            Description:
+              "VPC access to collection and Dashboards endpoint for example collection",
+            Rules: [
+              {
+                Resource: ["collection/example-collection"],
+                ResourceType: "collection",
+              },
+              {
+                Resource: ["collection/example-collection"],
+                ResourceType: "dashboard",
+              },
+            ],
+            SourceVPCEs: ["vpce-050f79086ee71ac05"],
+          },
+        ])
+      ),
+      type: "network",
+    });
+  }
+}
+
+```
+
+#### Mixed access for different collections
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { OpensearchserverlessSecurityPolicy } from "./.gen/providers/aws/opensearchserverless-security-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new OpensearchserverlessSecurityPolicy(this, "example", {
+      description: "Mixed access for marketing and sales",
+      name: "example",
+      policy: Token.asString(
+        Fn.jsonencode([
+          {
+            AllowFromPublic: false,
+            Description: "Marketing access",
+            Rules: [
+              {
+                Resource: ["collection/marketing*"],
+                ResourceType: "collection",
+              },
+              {
+                Resource: ["collection/marketing*"],
+                ResourceType: "dashboard",
+              },
+            ],
+            SourceVPCEs: ["vpce-050f79086ee71ac05"],
+          },
+          {
+            AllowFromPublic: true,
+            Description: "Sales access",
+            Rules: [
+              {
+                Resource: ["collection/finance"],
+                ResourceType: "collection",
+              },
+            ],
+          },
+        ])
+      ),
+      type: "network",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) Name of the policy.
+* `policy` - (Required) JSON policy document to use as the content for the new policy
+* `type` - (Required) Type of security policy. One of `encryption` or `network`.
+
+The following arguments are optional:
+
+* `description` - (Optional) Description of the policy. Typically used to store information about the permissions defined in the policy.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `policyVersion` - Version of the policy.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import OpenSearchServerless Security Policy using the `name` and `type` arguments separated by a slash (`/`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import OpenSearchServerless Security Policy using the `name` and `type` arguments separated by a slash (`/`). For example:
+
+```console
+% terraform import aws_opensearchserverless_security_policy.example example/encryption
+```
+
+<!-- cache-key: cdktf-0.18.0 input-becd08ee3f6a3b334c7cc8143eed41d3094a5e44bfbffe39e37ab8c8a317620e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/opensearchserverless_vpc_endpoint.html.markdown b/website/docs/cdktf/typescript/r/opensearchserverless_vpc_endpoint.html.markdown
new file mode 100644
index 00000000000..7610f7762da
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/opensearchserverless_vpc_endpoint.html.markdown
@@ -0,0 +1,89 @@
+---
+subcategory: "OpenSearch Serverless"
+layout: "aws"
+page_title: "AWS: aws_opensearchserverless_vpc_endpoint"
+description: |-
+  Terraform resource for managing an AWS OpenSearch Serverless VPC Endpoint.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_opensearchserverless_vpc_endpoint
+
+Terraform resource for managing an AWS OpenSearchServerless VPC Endpoint.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { OpensearchserverlessVpcEndpoint } from "./.gen/providers/aws/opensearchserverless-vpc-endpoint";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new OpensearchserverlessVpcEndpoint(this, "example", {
+      name: "myendpoint",
+      subnetIds: [Token.asString(awsSubnetExample.id)],
+      vpcId: Token.asString(awsVpcExample.id),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) Name of the interface endpoint.
+* `subnetIds` - (Required) One or more subnet IDs from which you'll access OpenSearch Serverless. Up to 6 subnets can be provided.
+* `vpcId` - (Required) ID of the VPC from which you'll access OpenSearch Serverless.
+
+The following arguments are optional:
+
+* `securityGroupIds` - (Optional) One or more security groups that define the ports, protocols, and sources for inbound traffic that you are authorizing into your endpoint. Up to 5 security groups can be provided.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Unique identified of the Vpc Endpoint.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `30M`)
+* `update` - (Default `30M`)
+* `delete` - (Default `30M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import OpenSearchServerless Vpc Endpointa using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import OpenSearchServerless Vpc Endpointa using the `id`. For example:
+
+```console
+% terraform import aws_opensearchserverless_vpc_endpoint.example vpce-8012925589
+```
+
+<!-- cache-key: cdktf-0.18.0 input-b9fcf6e6b2846dfbeed5befbc44e2dec7f3e97c4887cfb35c50e0ab28f293279 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/opsworks_application.html.markdown b/website/docs/cdktf/typescript/r/opsworks_application.html.markdown
new file mode 100644
index 00000000000..4e0dc467e63
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/opsworks_application.html.markdown
@@ -0,0 +1,137 @@
+---
+subcategory: "OpsWorks"
+layout: "aws"
+page_title: "AWS: aws_opsworks_application"
+description: |-
+  Provides an OpsWorks application resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_opsworks_application
+
+Provides an OpsWorks application resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, Fn, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { OpsworksApplication } from "./.gen/providers/aws/opsworks-application";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new OpsworksApplication(this, "foo-app", {
+      appSource: [
+        {
+          revision: "master",
+          type: "git",
+          url: "https://github.com/example.git",
+        },
+      ],
+      autoBundleOnDeploy: Token.asString(true),
+      description: "This is a Rails application",
+      documentRoot: "public",
+      domains: ["example.com", "sub.example.com"],
+      enableSsl: true,
+      environment: [
+        {
+          key: "key",
+          secure: false,
+          value: "value",
+        },
+      ],
+      name: "foobar application",
+      railsEnv: "staging",
+      shortName: "foobar",
+      sslConfiguration: [
+        {
+          certificate: Token.asString(Fn.file("./foobar.crt")),
+          privateKey: Token.asString(Fn.file("./foobar.key")),
+        },
+      ],
+      stackId: main.id,
+      type: "rails",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) A human-readable name for the application.
+* `shortName` - (Required) A short, machine-readable name for the application. This can only be defined on resource creation and ignored on resource update.
+* `stackId` - (Required) ID of the stack the application will belong to.
+* `type` - (Required) Opsworks application type. One of `awsFlowRuby`, `java`, `rails`, `php`, `nodejs`, `static` or `other`.
+* `description` - (Optional) A description of the app.
+* `environment` - (Optional) Object to define environment variables.  Object is described below.
+* `enableSsl` - (Optional) Whether to enable SSL for the app. This must be set in order to let `sslConfigurationPrivateKey`, `sslConfigurationCertificate` and `sslConfigurationChain` take effect.
+* `sslConfiguration` - (Optional) The SSL configuration of the app. Object is described below.
+* `appSource` - (Optional) SCM configuration of the app as described below.
+* `dataSourceArn` - (Optional) The data source's ARN.
+* `dataSourceType` - (Optional) The data source's type one of `autoSelectOpsworksMysqlInstance`, `opsworksMysqlInstance`, or `rdsDbInstance`.
+* `dataSourceDatabaseName` - (Optional) The database name.
+* `domains` -  (Optional) A list of virtual host alias.
+* `documentRoot` - (Optional) Subfolder for the document root for application of type `rails`.
+* `autoBundleOnDeploy` - (Optional) Run bundle install when deploying for application of type `rails`.
+* `railsEnv` - (Required if `type` = `rails`) The name of the Rails environment for application of type `rails`.
+* `awsFlowRubySettings` - (Optional) Specify activity and workflow workers for your app using the aws-flow gem.
+
+An `appSource` block supports the following arguments (can only be defined once per resource):
+
+* `type` - (Required) The type of source to use. For example, "archive".
+* `url` - (Required) The URL where the app resource can be found.
+* `username` - (Optional) Username to use when authenticating to the source.
+* `password` - (Optional) Password to use when authenticating to the source. Terraform cannot perform drift detection of this configuration.
+* `sshKey` - (Optional) SSH key to use when authenticating to the source. Terraform cannot perform drift detection of this configuration.
+* `revision` - (Optional) For sources that are version-aware, the revision to use.
+
+An `environment` block supports the following arguments:
+
+* `key` - (Required) Variable name.
+* `value` - (Required) Variable value.
+* `secure` - (Optional) Set visibility of the variable value to `true` or `false`.
+
+A `sslConfiguration` block supports the following arguments (can only be defined once per resource):
+
+* `privateKey` - (Required) The private key; the contents of the certificate's domain.key file.
+* `certificate` - (Required) The contents of the certificate's domain.crt file.
+* `chain` - (Optional)  Can be used to specify an intermediate certificate authority key or client authentication.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The id of the application.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Opsworks Application using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Opsworks Application using the `id`. For example:
+
+```console
+% terraform import aws_opsworks_application.test <id>
+```
+
+<!-- cache-key: cdktf-0.18.0 input-4eedaae0cb4e4e8acfb36a8488b25242904e757fb2ce525f27f16d8958622f8a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/opsworks_custom_layer.html.markdown b/website/docs/cdktf/typescript/r/opsworks_custom_layer.html.markdown
new file mode 100644
index 00000000000..14f33793587
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/opsworks_custom_layer.html.markdown
@@ -0,0 +1,150 @@
+---
+subcategory: "OpsWorks"
+layout: "aws"
+page_title: "AWS: aws_opsworks_custom_layer"
+description: |-
+  Provides an OpsWorks custom layer resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_opsworks_custom_layer
+
+Provides an OpsWorks custom layer resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { OpsworksCustomLayer } from "./.gen/providers/aws/opsworks-custom-layer";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new OpsworksCustomLayer(this, "custlayer", {
+      name: "My Awesome Custom Layer",
+      shortName: "awesome",
+      stackId: main.id,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) A human-readable name for the layer.
+* `shortName` - (Required) A short, machine-readable name for the layer, which will be used to identify it in the Chef node JSON.
+* `stackId` - (Required) ID of the stack the layer will belong to.
+* `autoAssignElasticIps` - (Optional) Whether to automatically assign an elastic IP address to the layer's instances.
+* `autoAssignPublicIps` - (Optional) For stacks belonging to a VPC, whether to automatically assign a public IP address to each of the layer's instances.
+* `cloudwatchConfiguration` - (Optional) Will create an EBS volume and connect it to the layer's instances. See [Cloudwatch Configuration](#cloudwatch-configuration).
+* `customInstanceProfileArn` - (Optional) The ARN of an IAM profile that will be used for the layer's instances.
+* `customSecurityGroupIds` - (Optional) Ids for a set of security groups to apply to the layer's instances.
+* `autoHealing` - (Optional) Whether to enable auto-healing for the layer.
+* `installUpdatesOnBoot` - (Optional) Whether to install OS and package updates on each instance when it boots.
+* `instanceShutdownTimeout` - (Optional) The time, in seconds, that OpsWorks will wait for Chef to complete after triggering the Shutdown event.
+* `elasticLoadBalancer` - (Optional) Name of an Elastic Load Balancer to attach to this layer
+* `drainElbOnShutdown` - (Optional) Whether to enable Elastic Load Balancing connection draining.
+* `loadBasedAutoScaling` - (Optional) Load-based auto scaling configuration. See [Load Based AutoScaling](#load-based-autoscaling)
+* `systemPackages` - (Optional) Names of a set of system packages to install on the layer's instances.
+* `useEbsOptimizedInstances` - (Optional) Whether to use EBS-optimized instances.
+* `ebsVolume` - (Optional) Will create an EBS volume and connect it to the layer's instances. See [EBS Volume](#ebs-volume).
+* `customJson` - (Optional) Custom JSON attributes to apply to the layer.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+The following extra optional arguments, all lists of Chef recipe names, allow
+custom Chef recipes to be applied to layer instances at the five different
+lifecycle events, if custom cookbooks are enabled on the layer's stack:
+
+* `customConfigureRecipes`
+* `customDeployRecipes`
+* `customSetupRecipes`
+* `customShutdownRecipes`
+* `customUndeployRecipes`
+
+### EBS Volume
+
+* `mountPoint` - (Required) The path to mount the EBS volume on the layer's instances.
+* `size` - (Required) The size of the volume in gigabytes.
+* `numberOfDisks` - (Required) The number of disks to use for the EBS volume.
+* `raidLevel` - (Required) The RAID level to use for the volume.
+* `type` - (Optional) The type of volume to create. This may be `standard` (the default), `io1` or `gp2`.
+* `iops` - (Optional) For PIOPS volumes, the IOPS per disk.
+* `encrypted` - (Optional) Encrypt the volume.
+
+### Cloudwatch Configuration
+
+* `enabled` - (Optional)
+* `logStreams` - (Optional) A block the specifies how an opsworks logs look like. See [Log Streams](#log-streams).
+
+#### Log Streams
+
+* `file` - (Required) Specifies log files that you want to push to CloudWatch Logs. File can point to a specific file or multiple files (by using wild card characters such as /var/log/system.log*).
+* `logGroupName` - (Required) Specifies the destination log group. A log group is created automatically if it doesn't already exist.
+* `batchCount` - (Optional) Specifies the max number of log events in a batch, up to `10000`. The default value is `1000`.
+* `batchSize` - (Optional) Specifies the maximum size of log events in a batch, in bytes, up to `1048576` bytes. The default value is `32768` bytes.
+* `bufferDuration` - (Optional) Specifies the time duration for the batching of log events. The minimum value is `5000` and default value is `5000`.
+* `datetimeFormat` - (Optional) Specifies how the timestamp is extracted from logs. For more information, see the CloudWatch Logs Agent Reference (https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/AgentReference.html).
+* `encoding` - (Optional) Specifies the encoding of the log file so that the file can be read correctly. The default is `utf8`.
+* `fileFingerprintLines` - (Optional) Specifies the range of lines for identifying a file. The valid values are one number, or two dash-delimited numbers, such as `1`, `25`. The default value is `1`.
+* `initialPosition` - (Optional) Specifies where to start to read data (`startOfFile` or `endOfFile`). The default is `startOfFile`.
+* `multilineStartPattern` - (Optional) Specifies the pattern for identifying the start of a log message.
+* `timeZone` - (Optional) Specifies the time zone of log event time stamps.
+
+### Load Based Autoscaling
+
+* `downscaling` - (Optional) The downscaling settings, as defined below, used for load-based autoscaling
+* `enable` - (Optional) Whether load-based auto scaling is enabled for the layer.
+* `upscaling` - (Optional) The upscaling settings, as defined below, used for load-based autoscaling
+
+The `downscaling` and `upscaling` blocks supports the following arguments:
+
+Though the three thresholds are optional, at least one threshold must be set when using load-based autoscaling.
+
+* `alarms` - (Optional) Custom Cloudwatch auto scaling alarms, to be used as thresholds. This parameter takes a list of up to five alarm names, which are case sensitive and must be in the same region as the stack.
+* `cpuThreshold` - (Optional) The CPU utilization threshold, as a percent of the available CPU. A value of -1 disables the threshold.
+* `ignoreMetricsTime` - (Optional) The amount of time (in minutes) after a scaling event occurs that AWS OpsWorks Stacks should ignore metrics and suppress additional scaling events.
+* `instanceCount` - (Optional) The number of instances to add or remove when the load exceeds a threshold.
+* `loadThreshold` - (Optional) The load threshold. A value of -1 disables the threshold.
+* `memoryThreshold` - (Optional) The memory utilization threshold, as a percent of the available memory. A value of -1 disables the threshold.
+* `thresholdsWaitTime` - (Optional) The amount of time, in minutes, that the load must exceed a threshold before more instances are added or removed.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The id of the layer.
+* `arn` - The Amazon Resource Name(ARN) of the layer.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import OpsWorks Custom Layers using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import OpsWorks Custom Layers using the `id`. For example:
+
+```console
+% terraform import aws_opsworks_custom_layer.bar 00000000-0000-0000-0000-000000000000
+```
+
+<!-- cache-key: cdktf-0.18.0 input-8a4b8054a10e74606cd1ea0e8f3f2e390b16a4d6d2acbbb8ade4b0281ed80aa3 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/opsworks_ecs_cluster_layer.html.markdown b/website/docs/cdktf/typescript/r/opsworks_ecs_cluster_layer.html.markdown
new file mode 100644
index 00000000000..04245547a4c
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/opsworks_ecs_cluster_layer.html.markdown
@@ -0,0 +1,86 @@
+---
+subcategory: "OpsWorks"
+layout: "aws"
+page_title: "AWS: aws_opsworks_ecs_cluster_layer"
+description: |-
+  Provides an OpsWorks HAProxy layer resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_opsworks_ecs_cluster_layer
+
+Provides an OpsWorks ECS Cluster layer resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { OpsworksEcsClusterLayer } from "./.gen/providers/aws/opsworks-ecs-cluster-layer";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new OpsworksEcsClusterLayer(this, "example", {
+      ecsClusterArn: Token.asString(awsEcsClusterExample.arn),
+      stackId: Token.asString(awsOpsworksStackExample.id),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `stackId` - (Required) ID of the stack the layer will belong to.
+* `ecsClusterArn` - (Required) The ECS Cluster ARN of the layer.
+* `name` - (Optional) A human-readable name for the layer.
+* `autoAssignElasticIps` - (Optional) Whether to automatically assign an elastic IP address to the layer's instances.
+* `autoAssignPublicIps` - (Optional) For stacks belonging to a VPC, whether to automatically assign a public IP address to each of the layer's instances.
+* `customInstanceProfileArn` - (Optional) The ARN of an IAM profile that will be used for the layer's instances.
+* `customSecurityGroupIds` - (Optional) Ids for a set of security groups to apply to the layer's instances.
+* `autoHealing` - (Optional) Whether to enable auto-healing for the layer.
+* `installUpdatesOnBoot` - (Optional) Whether to install OS and package updates on each instance when it boots.
+* `instanceShutdownTimeout` - (Optional) The time, in seconds, that OpsWorks will wait for Chef to complete after triggering the Shutdown event.
+* `elasticLoadBalancer` - (Optional) Name of an Elastic Load Balancer to attach to this layer
+* `drainElbOnShutdown` - (Optional) Whether to enable Elastic Load Balancing connection draining.
+* `systemPackages` - (Optional) Names of a set of system packages to install on the layer's instances.
+* `useEbsOptimizedInstances` - (Optional) Whether to use EBS-optimized instances.
+* `ebsVolume` - (Optional) `ebsVolume` blocks, as described below, will each create an EBS volume and connect it to the layer's instances.
+* `customJson` - (Optional) Custom JSON attributes to apply to the layer.
+* `tags` - (Optional) A mapping of tags to assign to the resource.
+
+The following extra optional arguments, all lists of Chef recipe names, allow
+custom Chef recipes to be applied to layer instances at the five different
+lifecycle events, if custom cookbooks are enabled on the layer's stack:
+
+* `customConfigureRecipes`
+* `customDeployRecipes`
+* `customSetupRecipes`
+* `customShutdownRecipes`
+* `customUndeployRecipes`
+
+An `ebsVolume` block supports the following arguments:
+
+* `mountPoint` - (Required) The path to mount the EBS volume on the layer's instances.
+* `size` - (Required) The size of the volume in gigabytes.
+* `numberOfDisks` - (Required) The number of disks to use for the EBS volume.
+* `raidLevel` - (Required) The RAID level to use for the volume.
+* `type` - (Optional) The type of volume to create. This may be `standard` (the default), `io1` or `gp2`.
+* `iops` - (Optional) For PIOPS volumes, the IOPS per disk.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The id of the layer.
+* `arn` - The Amazon Resource Name(ARN) of the layer.
+
+<!-- cache-key: cdktf-0.18.0 input-c41ce615eb693afa2fd19a1947549ef7ba89f9ef8c5826b9d872e80f1d738e7f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/opsworks_ganglia_layer.html.markdown b/website/docs/cdktf/typescript/r/opsworks_ganglia_layer.html.markdown
new file mode 100644
index 00000000000..f6ba1b13c3a
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/opsworks_ganglia_layer.html.markdown
@@ -0,0 +1,89 @@
+---
+subcategory: "OpsWorks"
+layout: "aws"
+page_title: "AWS: aws_opsworks_ganglia_layer"
+description: |-
+  Provides an OpsWorks Ganglia layer resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_opsworks_ganglia_layer
+
+Provides an OpsWorks Ganglia layer resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { OpsworksGangliaLayer } from "./.gen/providers/aws/opsworks-ganglia-layer";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new OpsworksGangliaLayer(this, "monitor", {
+      password: "foobarbaz",
+      stackId: main.id,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `stackId` - (Required) ID of the stack the layer will belong to.
+* `password` - (Required) The password to use for Ganglia.
+* `name` - (Optional) A human-readable name for the layer.
+* `autoAssignElasticIps` - (Optional) Whether to automatically assign an elastic IP address to the layer's instances.
+* `autoAssignPublicIps` - (Optional) For stacks belonging to a VPC, whether to automatically assign a public IP address to each of the layer's instances.
+* `customInstanceProfileArn` - (Optional) The ARN of an IAM profile that will be used for the layer's instances.
+* `customSecurityGroupIds` - (Optional) Ids for a set of security groups to apply to the layer's instances.
+* `autoHealing` - (Optional) Whether to enable auto-healing for the layer.
+* `installUpdatesOnBoot` - (Optional) Whether to install OS and package updates on each instance when it boots.
+* `instanceShutdownTimeout` - (Optional) The time, in seconds, that OpsWorks will wait for Chef to complete after triggering the Shutdown event.
+* `elasticLoadBalancer` - (Optional) Name of an Elastic Load Balancer to attach to this layer
+* `drainElbOnShutdown` - (Optional) Whether to enable Elastic Load Balancing connection draining.
+* `systemPackages` - (Optional) Names of a set of system packages to install on the layer's instances.
+* `url` - (Optional) The URL path to use for Ganglia. Defaults to "/ganglia".
+* `username` - (Optiona) The username to use for Ganglia. Defaults to "opsworks".
+* `useEbsOptimizedInstances` - (Optional) Whether to use EBS-optimized instances.
+* `ebsVolume` - (Optional) `ebsVolume` blocks, as described below, will each create an EBS volume and connect it to the layer's instances.
+* `customJson` - (Optional) Custom JSON attributes to apply to the layer.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+The following extra optional arguments, all lists of Chef recipe names, allow
+custom Chef recipes to be applied to layer instances at the five different
+lifecycle events, if custom cookbooks are enabled on the layer's stack:
+
+* `customConfigureRecipes`
+* `customDeployRecipes`
+* `customSetupRecipes`
+* `customShutdownRecipes`
+* `customUndeployRecipes`
+
+An `ebsVolume` block supports the following arguments:
+
+* `mountPoint` - (Required) The path to mount the EBS volume on the layer's instances.
+* `size` - (Required) The size of the volume in gigabytes.
+* `numberOfDisks` - (Required) The number of disks to use for the EBS volume.
+* `raidLevel` - (Required) The RAID level to use for the volume.
+* `type` - (Optional) The type of volume to create. This may be `standard` (the default), `io1` or `gp2`.
+* `iops` - (Optional) For PIOPS volumes, the IOPS per disk.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The id of the layer.
+* `arn` - The Amazon Resource Name(ARN) of the layer.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+<!-- cache-key: cdktf-0.18.0 input-cd3f72f3fcce85e722f3f818cc5881919d478fd39c4c26ac44c9940408fce59f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/opsworks_haproxy_layer.html.markdown b/website/docs/cdktf/typescript/r/opsworks_haproxy_layer.html.markdown
new file mode 100644
index 00000000000..7645be73adf
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/opsworks_haproxy_layer.html.markdown
@@ -0,0 +1,92 @@
+---
+subcategory: "OpsWorks"
+layout: "aws"
+page_title: "AWS: aws_opsworks_haproxy_layer"
+description: |-
+  Provides an OpsWorks HAProxy layer resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_opsworks_haproxy_layer
+
+Provides an OpsWorks haproxy layer resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { OpsworksHaproxyLayer } from "./.gen/providers/aws/opsworks-haproxy-layer";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new OpsworksHaproxyLayer(this, "lb", {
+      stackId: main.id,
+      statsPassword: "foobarbaz",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `stackId` - (Required) ID of the stack the layer will belong to.
+* `statsPassword` - (Required) The password to use for HAProxy stats.
+* `name` - (Optional) A human-readable name for the layer.
+* `autoAssignElasticIps` - (Optional) Whether to automatically assign an elastic IP address to the layer's instances.
+* `autoAssignPublicIps` - (Optional) For stacks belonging to a VPC, whether to automatically assign a public IP address to each of the layer's instances.
+* `customInstanceProfileArn` - (Optional) The ARN of an IAM profile that will be used for the layer's instances.
+* `customSecurityGroupIds` - (Optional) Ids for a set of security groups to apply to the layer's instances.
+* `autoHealing` - (Optional) Whether to enable auto-healing for the layer.
+* `healthcheckMethod` - (Optional) HTTP method to use for instance healthchecks. Defaults to "OPTIONS".
+* `healthcheckUrl` - (Optional) URL path to use for instance healthchecks. Defaults to "/".
+* `installUpdatesOnBoot` - (Optional) Whether to install OS and package updates on each instance when it boots.
+* `instanceShutdownTimeout` - (Optional) The time, in seconds, that OpsWorks will wait for Chef to complete after triggering the Shutdown event.
+* `elasticLoadBalancer` - (Optional) Name of an Elastic Load Balancer to attach to this layer
+* `drainElbOnShutdown` - (Optional) Whether to enable Elastic Load Balancing connection draining.
+* `statsEnabled` - (Optional) Whether to enable HAProxy stats.
+* `statsUrl` - (Optional) The HAProxy stats URL. Defaults to "/haproxy?stats".
+* `statsUser` - (Optional) The username for HAProxy stats. Defaults to "opsworks".
+* `systemPackages` - (Optional) Names of a set of system packages to install on the layer's instances.
+* `useEbsOptimizedInstances` - (Optional) Whether to use EBS-optimized instances.
+* `ebsVolume` - (Optional) `ebsVolume` blocks, as described below, will each create an EBS volume and connect it to the layer's instances.
+* `customJson` - (Optional) Custom JSON attributes to apply to the layer.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+The following extra optional arguments, all lists of Chef recipe names, allow
+custom Chef recipes to be applied to layer instances at the five different
+lifecycle events, if custom cookbooks are enabled on the layer's stack:
+
+* `customConfigureRecipes`
+* `customDeployRecipes`
+* `customSetupRecipes`
+* `customShutdownRecipes`
+* `customUndeployRecipes`
+
+An `ebsVolume` block supports the following arguments:
+
+* `mountPoint` - (Required) The path to mount the EBS volume on the layer's instances.
+* `size` - (Required) The size of the volume in gigabytes.
+* `numberOfDisks` - (Required) The number of disks to use for the EBS volume.
+* `raidLevel` - (Required) The RAID level to use for the volume.
+* `type` - (Optional) The type of volume to create. This may be `standard` (the default), `io1` or `gp2`.
+* `iops` - (Optional) For PIOPS volumes, the IOPS per disk.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The id of the layer.
+* `arn` - The Amazon Resource Name(ARN) of the layer.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+<!-- cache-key: cdktf-0.18.0 input-d7e3b606c224ad4d900794b3922f5773ba5b6e0545823dc60bc75ee69f563826 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/opsworks_instance.html.markdown b/website/docs/cdktf/typescript/r/opsworks_instance.html.markdown
new file mode 100644
index 00000000000..54b880f0370
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/opsworks_instance.html.markdown
@@ -0,0 +1,174 @@
+---
+subcategory: "OpsWorks"
+layout: "aws"
+page_title: "AWS: aws_opsworks_instance"
+description: |-
+  Provides an OpsWorks instance resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_opsworks_instance
+
+Provides an OpsWorks instance resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { OpsworksInstance } from "./.gen/providers/aws/opsworks-instance";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new OpsworksInstance(this, "my-instance", {
+      instanceType: "t2.micro",
+      layerIds: [myLayer.id],
+      os: "Amazon Linux 2015.09",
+      stackId: main.id,
+      state: "stopped",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `layerIds` - (Required) List of the layers the instance will belong to.
+* `stackId` - (Required) Identifier of the stack the instance will belong to.
+
+The following arguments are optional:
+
+* `agentVersion` - (Optional) OpsWorks agent to install. Default is `inherit`.
+* `amiId` - (Optional) AMI to use for the instance.  If an AMI is specified, `os` must be `custom`.
+* `architecture` - (Optional) Machine architecture for created instances.  Valid values are `x8664` or `i386`. The default is `x8664`.
+* `autoScalingType` - (Optional) Creates load-based or time-based instances.  Valid values are `load`, `timer`.
+* `availabilityZone` - (Optional) Name of the availability zone where instances will be created by default.
+* `deleteEbs` - (Optional) Whether to delete EBS volume on deletion. Default is `true`.
+* `deleteEip` - (Optional) Whether to delete the Elastic IP on deletion.
+* `ebsBlockDevice` - (Optional) Configuration block for additional EBS block devices to attach to the instance. See [Block Devices](#block-devices) below.
+* `ebsOptimized` - (Optional) Whether the launched EC2 instance will be EBS-optimized.
+* `ecsClusterArn` - (Optional) ECS cluster's ARN for container instances.
+* `elasticIp` - (Optional) Instance Elastic IP address.
+* `ephemeralBlockDevice` - (Optional) Configuration block for ephemeral (also known as "Instance Store") volumes on the instance. See [Block Devices](#block-devices) below.
+* `hostname` - (Optional) Instance's host name.
+* `infrastructureClass` - (Optional) For registered instances, infrastructure class: ec2 or on-premises.
+* `installUpdatesOnBoot` - (Optional) Controls where to install OS and package updates when the instance boots.  Default is `true`.
+* `instanceProfileArn` - (Optional) ARN of the instance's IAM profile.
+* `instanceType` - (Optional) Type of instance to start.
+* `os` - (Optional) Name of operating system that will be installed.
+* `rootBlockDevice` - (Optional) Configuration block for the root block device of the instance. See [Block Devices](#block-devices) below.
+* `rootDeviceType` - (Optional) Name of the type of root device instances will have by default. Valid values are `ebs` or `instanceStore`.
+* `sshKeyName` - (Optional) Name of the SSH keypair that instances will have by default.
+* `state` - (Optional) Desired state of the instance. Valid values are `running` or `stopped`.
+* `subnetId` - (Optional) Subnet ID to attach to.
+* `tenancy` - (Optional) Instance tenancy to use. Valid values are `default`, `dedicated` or `host`.
+* `virtualizationType` - (Optional) Keyword to choose what virtualization mode created instances will use. Valid values are `paravirtual` or `hvm`.
+
+## Block devices
+
+Each of the `*BlockDevice` attributes controls a portion of the AWS
+Instance's "Block Device Mapping". It's a good idea to familiarize yourself with [AWS's Block Device
+Mapping docs](http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/block-device-mapping-concepts.html)
+to understand the implications of using these attributes.
+
+### `ebsBlockDevice`
+
+* `deleteOnTermination` - (Optional) Whether the volume should be destroyed on instance termination. Default is `true`.
+* `deviceName` - (Required) Name of the device to mount.
+* `iops` - (Optional) Amount of provisioned [IOPS](http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-io-characteristics.html). This must be set with a `volumeType` of `io1`.
+* `snapshotId` - (Optional) Snapshot ID to mount.
+* `volumeSize` - (Optional) Size of the volume in gigabytes.
+* `volumeType` - (Optional) Type of volume. Valid values are `standard`, `gp2`, or `io1`. Default is `standard`.
+
+Modifying any `ebsBlockDevice` currently requires resource replacement.
+
+### `ephemeralBlockDevice`
+
+* `deviceName` - Name of the block device to mount on the instance.
+* `virtualName` - The [Instance Store Device Name](http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/InstanceStorage.html#InstanceStoreDeviceNames) (e.g., `ephemeral0`).
+
+Each AWS Instance type has a different set of Instance Store block devices
+available for attachment. AWS [publishes a
+list](http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/InstanceStorage.html#StorageOnInstanceTypes)
+of which ephemeral devices are available on each type. The devices are always
+identified by the `virtualName` in the format `ephemeral{0N}`.
+
+### `rootBlockDevice`
+
+* `deleteOnTermination` - (Optional) Whether the volume should be destroyed on instance termination. Default is `true`.
+* `iops` - (Optional) Amount of provisioned [IOPS](http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-io-characteristics.html). This must be set with a `volumeType` of `io1`.
+* `volumeSize` - (Optional) Size of the volume in gigabytes.
+* `volumeType` - (Optional) Type of volume. Valid values are `standard`, `gp2`, or `io1`. Default is `standard`.
+
+Modifying any of the `rootBlockDevice` settings requires resource
+replacement.
+
+~> **NOTE:** Currently, changes to `*BlockDevice` configuration of _existing_
+resources cannot be automatically detected by Terraform. After making updates
+to block device configuration, resource recreation can be manually triggered by
+using the [`taint` command](https://www.terraform.io/docs/commands/taint.html).
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `createdAt` - Time that the instance was created.
+* `ec2InstanceId` - EC2 instance ID.
+* `id` - ID of the OpsWorks instance.
+* `lastServiceErrorId` - ID of the last service error.
+* `platform` - Instance's platform.
+* `privateDns` - Private DNS name assigned to the instance. Can only be used inside the Amazon EC2, and only available if you've enabled DNS hostnames for your VPC.
+* `privateIp` - Private IP address assigned to the instance.
+* `publicDns` - Public DNS name assigned to the instance. For EC2-VPC, this is only available if you've enabled DNS hostnames for your VPC.
+* `publicIp` - Public IP address assigned to the instance, if applicable.
+* `registeredBy` - For registered instances, who performed the registration.
+* `reportedAgentVersion` - Instance's reported AWS OpsWorks Stacks agent version.
+* `reportedOsFamily` - For registered instances, the reported operating system family.
+* `reportedOsName` - For registered instances, the reported operating system name.
+* `reportedOsVersion` - For registered instances, the reported operating system version.
+* `rootDeviceVolumeId` - Root device volume ID.
+* `securityGroupIds` - Associated security groups.
+* `sshHostDsaKeyFingerprint` - SSH key's Deep Security Agent (DSA) fingerprint.
+* `sshHostRsaKeyFingerprint` - SSH key's RSA fingerprint.
+* `status` - Instance status. Will be one of `booting`, `connectionLost`, `online`, `pending`, `rebooting`, `requested`, `runningSetup`, `setupFailed`, `shuttingDown`, `startFailed`, `stopFailed`, `stopped`, `stopping`, `terminated`, or `terminating`.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `10M`)
+- `delete` - (Default `10M`)
+- `update` - (Default `10M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Opsworks Instances using the instance `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Opsworks Instances using the instance `id`. For example:
+
+```console
+% terraform import aws_opsworks_instance.my_instance 4d6d1710-ded9-42a1-b08e-b043ad7af1e2
+```
+
+<!-- cache-key: cdktf-0.18.0 input-760182d76d218ceaf2aa97bf60861140665a51f7861d5210b509e78e8f84b58d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/opsworks_java_app_layer.html.markdown b/website/docs/cdktf/typescript/r/opsworks_java_app_layer.html.markdown
new file mode 100644
index 00000000000..2ce2ea14f2b
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/opsworks_java_app_layer.html.markdown
@@ -0,0 +1,90 @@
+---
+subcategory: "OpsWorks"
+layout: "aws"
+page_title: "AWS: aws_opsworks_java_app_layer"
+description: |-
+  Provides an OpsWorks Java application layer resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_opsworks_java_app_layer
+
+Provides an OpsWorks Java application layer resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { OpsworksJavaAppLayer } from "./.gen/providers/aws/opsworks-java-app-layer";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new OpsworksJavaAppLayer(this, "app", {
+      stackId: main.id,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `stackId` - (Required) ID of the stack the layer will belong to.
+* `name` - (Optional) A human-readable name for the layer.
+* `appServer` - (Optional) Keyword for the application container to use. Defaults to "tomcat".
+* `appServerVersion` - (Optional) Version of the selected application container to use. Defaults to "7".
+* `autoAssignElasticIps` - (Optional) Whether to automatically assign an elastic IP address to the layer's instances.
+* `autoAssignPublicIps` - (Optional) For stacks belonging to a VPC, whether to automatically assign a public IP address to each of the layer's instances.
+* `customInstanceProfileArn` - (Optional) The ARN of an IAM profile that will be used for the layer's instances.
+* `customSecurityGroupIds` - (Optional) Ids for a set of security groups to apply to the layer's instances.
+* `autoHealing` - (Optional) Whether to enable auto-healing for the layer.
+* `installUpdatesOnBoot` - (Optional) Whether to install OS and package updates on each instance when it boots.
+* `instanceShutdownTimeout` - (Optional) The time, in seconds, that OpsWorks will wait for Chef to complete after triggering the Shutdown event.
+* `jvmType` - (Optional) Keyword for the type of JVM to use. Defaults to `openjdk`.
+* `jvmOptions` - (Optional) Options to set for the JVM.
+* `jvmVersion` - (Optional) Version of JVM to use. Defaults to "7".
+* `elasticLoadBalancer` - (Optional) Name of an Elastic Load Balancer to attach to this layer
+* `drainElbOnShutdown` - (Optional) Whether to enable Elastic Load Balancing connection draining.
+* `systemPackages` - (Optional) Names of a set of system packages to install on the layer's instances.
+* `useEbsOptimizedInstances` - (Optional) Whether to use EBS-optimized instances.
+* `ebsVolume` - (Optional) `ebsVolume` blocks, as described below, will each create an EBS volume and connect it to the layer's instances.
+* `customJson` - (Optional) Custom JSON attributes to apply to the layer.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+The following extra optional arguments, all lists of Chef recipe names, allow
+custom Chef recipes to be applied to layer instances at the five different
+lifecycle events, if custom cookbooks are enabled on the layer's stack:
+
+* `customConfigureRecipes`
+* `customDeployRecipes`
+* `customSetupRecipes`
+* `customShutdownRecipes`
+* `customUndeployRecipes`
+
+An `ebsVolume` block supports the following arguments:
+
+* `mountPoint` - (Required) The path to mount the EBS volume on the layer's instances.
+* `size` - (Required) The size of the volume in gigabytes.
+* `numberOfDisks` - (Required) The number of disks to use for the EBS volume.
+* `raidLevel` - (Required) The RAID level to use for the volume.
+* `type` - (Optional) The type of volume to create. This may be `standard` (the default), `io1` or `gp2`.
+* `iops` - (Optional) For PIOPS volumes, the IOPS per disk.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The id of the layer.
+* `arn` - The Amazon Resource Name(ARN) of the layer.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+<!-- cache-key: cdktf-0.18.0 input-22f1dac0366505ea416dcd52815ba922756da61064d917cfb0310e814c99266a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/opsworks_memcached_layer.html.markdown b/website/docs/cdktf/typescript/r/opsworks_memcached_layer.html.markdown
new file mode 100644
index 00000000000..fbaffbb9c1b
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/opsworks_memcached_layer.html.markdown
@@ -0,0 +1,86 @@
+---
+subcategory: "OpsWorks"
+layout: "aws"
+page_title: "AWS: aws_opsworks_memcached_layer"
+description: |-
+  Provides an OpsWorks memcached layer resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_opsworks_memcached_layer
+
+Provides an OpsWorks memcached layer resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { OpsworksMemcachedLayer } from "./.gen/providers/aws/opsworks-memcached-layer";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new OpsworksMemcachedLayer(this, "cache", {
+      stackId: main.id,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `stackId` - (Required) ID of the stack the layer will belong to.
+* `name` - (Optional) A human-readable name for the layer.
+* `allocatedMemory` - (Optional) Amount of memory to allocate for the cache on each instance, in megabytes. Defaults to 512MB.
+* `autoAssignElasticIps` - (Optional) Whether to automatically assign an elastic IP address to the layer's instances.
+* `autoAssignPublicIps` - (Optional) For stacks belonging to a VPC, whether to automatically assign a public IP address to each of the layer's instances.
+* `customInstanceProfileArn` - (Optional) The ARN of an IAM profile that will be used for the layer's instances.
+* `customSecurityGroupIds` - (Optional) Ids for a set of security groups to apply to the layer's instances.
+* `autoHealing` - (Optional) Whether to enable auto-healing for the layer.
+* `installUpdatesOnBoot` - (Optional) Whether to install OS and package updates on each instance when it boots.
+* `instanceShutdownTimeout` - (Optional) The time, in seconds, that OpsWorks will wait for Chef to complete after triggering the Shutdown event.
+* `elasticLoadBalancer` - (Optional) Name of an Elastic Load Balancer to attach to this layer
+* `drainElbOnShutdown` - (Optional) Whether to enable Elastic Load Balancing connection draining.
+* `systemPackages` - (Optional) Names of a set of system packages to install on the layer's instances.
+* `useEbsOptimizedInstances` - (Optional) Whether to use EBS-optimized instances.
+* `ebsVolume` - (Optional) `ebsVolume` blocks, as described below, will each create an EBS volume and connect it to the layer's instances.
+* `customJson` - (Optional) Custom JSON attributes to apply to the layer.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+The following extra optional arguments, all lists of Chef recipe names, allow
+custom Chef recipes to be applied to layer instances at the five different
+lifecycle events, if custom cookbooks are enabled on the layer's stack:
+
+* `customConfigureRecipes`
+* `customDeployRecipes`
+* `customSetupRecipes`
+* `customShutdownRecipes`
+* `customUndeployRecipes`
+
+An `ebsVolume` block supports the following arguments:
+
+* `mountPoint` - (Required) The path to mount the EBS volume on the layer's instances.
+* `size` - (Required) The size of the volume in gigabytes.
+* `numberOfDisks` - (Required) The number of disks to use for the EBS volume.
+* `raidLevel` - (Required) The RAID level to use for the volume.
+* `type` - (Optional) The type of volume to create. This may be `standard` (the default), `io1` or `gp2`.
+* `iops` - (Optional) For PIOPS volumes, the IOPS per disk.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The id of the layer.
+* `arn` - The Amazon Resource Name(ARN) of the layer.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+<!-- cache-key: cdktf-0.18.0 input-05a372e54fd07197c1f42442567c63b5866c6980883edb9054bbf50151850fd4 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/opsworks_mysql_layer.html.markdown b/website/docs/cdktf/typescript/r/opsworks_mysql_layer.html.markdown
new file mode 100644
index 00000000000..e0d7bc2837f
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/opsworks_mysql_layer.html.markdown
@@ -0,0 +1,90 @@
+---
+subcategory: "OpsWorks"
+layout: "aws"
+page_title: "AWS: aws_opsworks_mysql_layer"
+description: |-
+  Provides an OpsWorks MySQL layer resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_opsworks_mysql_layer
+
+Provides an OpsWorks MySQL layer resource.
+
+~> **Note:** All arguments including the root password will be stored in the raw state as plain-text.
+[Read more about sensitive data in state](https://www.terraform.io/docs/state/sensitive-data.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { OpsworksMysqlLayer } from "./.gen/providers/aws/opsworks-mysql-layer";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new OpsworksMysqlLayer(this, "db", {
+      stackId: main.id,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `stackId` - (Required) ID of the stack the layer will belong to.
+* `name` - (Optional) A human-readable name for the layer.
+* `autoAssignElasticIps` - (Optional) Whether to automatically assign an elastic IP address to the layer's instances.
+* `autoAssignPublicIps` - (Optional) For stacks belonging to a VPC, whether to automatically assign a public IP address to each of the layer's instances.
+* `customInstanceProfileArn` - (Optional) The ARN of an IAM profile that will be used for the layer's instances.
+* `customSecurityGroupIds` - (Optional) Ids for a set of security groups to apply to the layer's instances.
+* `autoHealing` - (Optional) Whether to enable auto-healing for the layer.
+* `installUpdatesOnBoot` - (Optional) Whether to install OS and package updates on each instance when it boots.
+* `instanceShutdownTimeout` - (Optional) The time, in seconds, that OpsWorks will wait for Chef to complete after triggering the Shutdown event.
+* `elasticLoadBalancer` - (Optional) Name of an Elastic Load Balancer to attach to this layer
+* `drainElbOnShutdown` - (Optional) Whether to enable Elastic Load Balancing connection draining.
+* `rootPassword` - (Optional) Root password to use for MySQL.
+* `rootPasswordOnAllInstances` - (Optional) Whether to set the root user password to all instances in the stack so they can access the instances in this layer.
+* `systemPackages` - (Optional) Names of a set of system packages to install on the layer's instances.
+* `useEbsOptimizedInstances` - (Optional) Whether to use EBS-optimized instances.
+* `ebsVolume` - (Optional) `ebsVolume` blocks, as described below, will each create an EBS volume and connect it to the layer's instances.
+* `customJson` - (Optional) Custom JSON attributes to apply to the layer.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+The following extra optional arguments, all lists of Chef recipe names, allow
+custom Chef recipes to be applied to layer instances at the five different
+lifecycle events, if custom cookbooks are enabled on the layer's stack:
+
+* `customConfigureRecipes`
+* `customDeployRecipes`
+* `customSetupRecipes`
+* `customShutdownRecipes`
+* `customUndeployRecipes`
+
+An `ebsVolume` block supports the following arguments:
+
+* `mountPoint` - (Required) The path to mount the EBS volume on the layer's instances.
+* `size` - (Required) The size of the volume in gigabytes.
+* `numberOfDisks` - (Required) The number of disks to use for the EBS volume.
+* `raidLevel` - (Required) The RAID level to use for the volume.
+* `type` - (Optional) The type of volume to create. This may be `standard` (the default), `io1` or `gp2`.
+* `iops` - (Optional) For PIOPS volumes, the IOPS per disk.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The id of the layer.
+* `arn` - The Amazon Resource Name(ARN) of the layer.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+<!-- cache-key: cdktf-0.18.0 input-6fb3f9c0066341ee3cdf3144e8a066c0d6087b4103a19b780640998ecba59777 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/opsworks_nodejs_app_layer.html.markdown b/website/docs/cdktf/typescript/r/opsworks_nodejs_app_layer.html.markdown
new file mode 100644
index 00000000000..e1ba0b6226f
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/opsworks_nodejs_app_layer.html.markdown
@@ -0,0 +1,86 @@
+---
+subcategory: "OpsWorks"
+layout: "aws"
+page_title: "AWS: aws_opsworks_nodejs_app_layer"
+description: |-
+  Provides an OpsWorks NodeJS application layer resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_opsworks_nodejs_app_layer
+
+Provides an OpsWorks NodeJS application layer resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { OpsworksNodejsAppLayer } from "./.gen/providers/aws/opsworks-nodejs-app-layer";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new OpsworksNodejsAppLayer(this, "app", {
+      stackId: main.id,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `stackId` - (Required) ID of the stack the layer will belong to.
+* `name` - (Optional) A human-readable name for the layer.
+* `autoAssignElasticIps` - (Optional) Whether to automatically assign an elastic IP address to the layer's instances.
+* `autoAssignPublicIps` - (Optional) For stacks belonging to a VPC, whether to automatically assign a public IP address to each of the layer's instances.
+* `customInstanceProfileArn` - (Optional) The ARN of an IAM profile that will be used for the layer's instances.
+* `customSecurityGroupIds` - (Optional) Ids for a set of security groups to apply to the layer's instances.
+* `autoHealing` - (Optional) Whether to enable auto-healing for the layer.
+* `installUpdatesOnBoot` - (Optional) Whether to install OS and package updates on each instance when it boots.
+* `instanceShutdownTimeout` - (Optional) The time, in seconds, that OpsWorks will wait for Chef to complete after triggering the Shutdown event.
+* `elasticLoadBalancer` - (Optional) Name of an Elastic Load Balancer to attach to this layer
+* `drainElbOnShutdown` - (Optional) Whether to enable Elastic Load Balancing connection draining.
+* `nodejsVersion` - (Optional) The version of NodeJS to use. Defaults to "0.10.38".
+* `systemPackages` - (Optional) Names of a set of system packages to install on the layer's instances.
+* `useEbsOptimizedInstances` - (Optional) Whether to use EBS-optimized instances.
+* `ebsVolume` - (Optional) `ebsVolume` blocks, as described below, will each create an EBS volume and connect it to the layer's instances.
+* `customJson` - (Optional) Custom JSON attributes to apply to the layer.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+The following extra optional arguments, all lists of Chef recipe names, allow
+custom Chef recipes to be applied to layer instances at the five different
+lifecycle events, if custom cookbooks are enabled on the layer's stack:
+
+* `customConfigureRecipes`
+* `customDeployRecipes`
+* `customSetupRecipes`
+* `customShutdownRecipes`
+* `customUndeployRecipes`
+
+An `ebsVolume` block supports the following arguments:
+
+* `mountPoint` - (Required) The path to mount the EBS volume on the layer's instances.
+* `size` - (Required) The size of the volume in gigabytes.
+* `numberOfDisks` - (Required) The number of disks to use for the EBS volume.
+* `raidLevel` - (Required) The RAID level to use for the volume.
+* `type` - (Optional) The type of volume to create. This may be `standard` (the default), `io1` or `gp2`.
+* `iops` - (Optional) For PIOPS volumes, the IOPS per disk.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The id of the layer.
+* `arn` - The Amazon Resource Name(ARN) of the layer.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+<!-- cache-key: cdktf-0.18.0 input-1df307b6876d1bd2e727d6c0695efb82596dffc396372dbe164d5ffca9daf825 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/opsworks_permission.html.markdown b/website/docs/cdktf/typescript/r/opsworks_permission.html.markdown
new file mode 100644
index 00000000000..bd9d36edd4e
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/opsworks_permission.html.markdown
@@ -0,0 +1,57 @@
+---
+subcategory: "OpsWorks"
+layout: "aws"
+page_title: "AWS: aws_opsworks_permission"
+description: |-
+  Provides an OpsWorks permission resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_opsworks_permission
+
+Provides an OpsWorks permission resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { OpsworksPermission } from "./.gen/providers/aws/opsworks-permission";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new OpsworksPermission(this, "my_stack_permission", {
+      allowSsh: true,
+      allowSudo: true,
+      level: "iam_only",
+      stackId: stack.id,
+      userArn: user.arn,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `allowSsh` - (Optional) Whether the user is allowed to use SSH to communicate with the instance
+* `allowSudo` - (Optional) Whether the user is allowed to use sudo to elevate privileges
+* `userArn` - (Required) The user's IAM ARN to set permissions for
+* `level` - (Optional) The users permission level. Mus be one of `deny`, `show`, `deploy`, `manage`, `iamOnly`
+* `stackId` - (Required) The stack to set the permissions for
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The computed id of the permission. Please note that this is only used internally to identify the permission. This value is not used in aws.
+
+<!-- cache-key: cdktf-0.18.0 input-97b4069bc5171903caa09804dda516e141af05be716dec07a132aa54f9470e02 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/opsworks_php_app_layer.html.markdown b/website/docs/cdktf/typescript/r/opsworks_php_app_layer.html.markdown
new file mode 100644
index 00000000000..80d1e3ca5e3
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/opsworks_php_app_layer.html.markdown
@@ -0,0 +1,107 @@
+---
+subcategory: "OpsWorks"
+layout: "aws"
+page_title: "AWS: aws_opsworks_php_app_layer"
+description: |-
+  Provides an OpsWorks PHP application layer resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_opsworks_php_app_layer
+
+Provides an OpsWorks PHP application layer resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { OpsworksPhpAppLayer } from "./.gen/providers/aws/opsworks-php-app-layer";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new OpsworksPhpAppLayer(this, "app", {
+      stackId: main.id,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `stackId` - (Required) ID of the stack the layer will belong to.
+* `name` - (Optional) A human-readable name for the layer.
+* `autoAssignElasticIps` - (Optional) Whether to automatically assign an elastic IP address to the layer's instances.
+* `autoAssignPublicIps` - (Optional) For stacks belonging to a VPC, whether to automatically assign a public IP address to each of the layer's instances.
+* `customInstanceProfileArn` - (Optional) The ARN of an IAM profile that will be used for the layer's instances.
+* `customSecurityGroupIds` - (Optional) Ids for a set of security groups to apply to the layer's instances.
+* `autoHealing` - (Optional) Whether to enable auto-healing for the layer.
+* `installUpdatesOnBoot` - (Optional) Whether to install OS and package updates on each instance when it boots.
+* `instanceShutdownTimeout` - (Optional) The time, in seconds, that OpsWorks will wait for Chef to complete after triggering the Shutdown event.
+* `elasticLoadBalancer` - (Optional) Name of an Elastic Load Balancer to attach to this layer
+* `drainElbOnShutdown` - (Optional) Whether to enable Elastic Load Balancing connection draining.
+* `systemPackages` - (Optional) Names of a set of system packages to install on the layer's instances.
+* `useEbsOptimizedInstances` - (Optional) Whether to use EBS-optimized instances.
+* `ebsVolume` - (Optional) `ebsVolume` blocks, as described below, will each create an EBS volume and connect it to the layer's instances.
+* `customJson` - (Optional) Custom JSON attributes to apply to the layer.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+The following extra optional arguments, all lists of Chef recipe names, allow
+custom Chef recipes to be applied to layer instances at the five different
+lifecycle events, if custom cookbooks are enabled on the layer's stack:
+
+* `customConfigureRecipes`
+* `customDeployRecipes`
+* `customSetupRecipes`
+* `customShutdownRecipes`
+* `customUndeployRecipes`
+
+An `ebsVolume` block supports the following arguments:
+
+* `mountPoint` - (Required) The path to mount the EBS volume on the layer's instances.
+* `size` - (Required) The size of the volume in gigabytes.
+* `numberOfDisks` - (Required) The number of disks to use for the EBS volume.
+* `raidLevel` - (Required) The RAID level to use for the volume.
+* `type` - (Optional) The type of volume to create. This may be `standard` (the default), `io1` or `gp2`.
+* `iops` - (Optional) For PIOPS volumes, the IOPS per disk.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The id of the layer.
+* `arn` - The Amazon Resource Name(ARN) of the layer.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import OpsWorks PHP Application Layers using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import OpsWorks PHP Application Layers using the `id`. For example:
+
+```console
+% terraform import aws_opsworks_php_app_layer.bar 00000000-0000-0000-0000-000000000000
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ac5e291147ea7833ab078073c4e098f41fa5009ff6f6cd79bf2e60602b07f542 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/opsworks_rails_app_layer.html.markdown b/website/docs/cdktf/typescript/r/opsworks_rails_app_layer.html.markdown
new file mode 100644
index 00000000000..4d5d83d17c6
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/opsworks_rails_app_layer.html.markdown
@@ -0,0 +1,91 @@
+---
+subcategory: "OpsWorks"
+layout: "aws"
+page_title: "AWS: aws_opsworks_rails_app_layer"
+description: |-
+  Provides an OpsWorks Ruby on Rails application layer resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_opsworks_rails_app_layer
+
+Provides an OpsWorks Ruby on Rails application layer resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { OpsworksRailsAppLayer } from "./.gen/providers/aws/opsworks-rails-app-layer";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new OpsworksRailsAppLayer(this, "app", {
+      stackId: main.id,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `stackId` - (Required) ID of the stack the layer will belong to.
+* `name` - (Optional) A human-readable name for the layer.
+* `appServer` - (Optional) Keyword for the app server to use. Defaults to "apache_passenger".
+* `autoAssignElasticIps` - (Optional) Whether to automatically assign an elastic IP address to the layer's instances.
+* `autoAssignPublicIps` - (Optional) For stacks belonging to a VPC, whether to automatically assign a public IP address to each of the layer's instances.
+* `bundlerVersion` - (Optional) When OpsWorks is managing Bundler, which version to use. Defaults to "1.5.3".
+* `customInstanceProfileArn` - (Optional) The ARN of an IAM profile that will be used for the layer's instances.
+* `customSecurityGroupIds` - (Optional) Ids for a set of security groups to apply to the layer's instances.
+* `autoHealing` - (Optional) Whether to enable auto-healing for the layer.
+* `installUpdatesOnBoot` - (Optional) Whether to install OS and package updates on each instance when it boots.
+* `instanceShutdownTimeout` - (Optional) The time, in seconds, that OpsWorks will wait for Chef to complete after triggering the Shutdown event.
+* `elasticLoadBalancer` - (Optional) Name of an Elastic Load Balancer to attach to this layer
+* `drainElbOnShutdown` - (Optional) Whether to enable Elastic Load Balancing connection draining.
+* `manageBundler` - (Optional) Whether OpsWorks should manage bundler. On by default.
+* `passengerVersion` - (Optional) The version of Passenger to use. Defaults to "4.0.46".
+* `rubyVersion` - (Optional) The version of Ruby to use. Defaults to "2.0.0".
+* `rubygemsVersion` - (Optional) The version of RubyGems to use. Defaults to "2.2.2".
+* `systemPackages` - (Optional) Names of a set of system packages to install on the layer's instances.
+* `useEbsOptimizedInstances` - (Optional) Whether to use EBS-optimized instances.
+* `ebsVolume` - (Optional) `ebsVolume` blocks, as described below, will each create an EBS volume and connect it to the layer's instances.
+* `customJson` - (Optional) Custom JSON attributes to apply to the layer.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+The following extra optional arguments, all lists of Chef recipe names, allow
+custom Chef recipes to be applied to layer instances at the five different
+lifecycle events, if custom cookbooks are enabled on the layer's stack:
+
+* `customConfigureRecipes`
+* `customDeployRecipes`
+* `customSetupRecipes`
+* `customShutdownRecipes`
+* `customUndeployRecipes`
+
+An `ebsVolume` block supports the following arguments:
+
+* `mountPoint` - (Required) The path to mount the EBS volume on the layer's instances.
+* `size` - (Required) The size of the volume in gigabytes.
+* `numberOfDisks` - (Required) The number of disks to use for the EBS volume.
+* `raidLevel` - (Required) The RAID level to use for the volume.
+* `type` - (Optional) The type of volume to create. This may be `standard` (the default), `io1` or `gp2`.
+* `iops` - (Optional) For PIOPS volumes, the IOPS per disk.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The id of the layer.
+* `arn` - The Amazon Resource Name(ARN) of the layer.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+<!-- cache-key: cdktf-0.18.0 input-0f3775b22189f8a94dca97cbbedc1243db234478a6e520629d72fc3e43b825a7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/opsworks_rds_db_instance.html.markdown b/website/docs/cdktf/typescript/r/opsworks_rds_db_instance.html.markdown
new file mode 100644
index 00000000000..d207d4bdf28
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/opsworks_rds_db_instance.html.markdown
@@ -0,0 +1,58 @@
+---
+subcategory: "OpsWorks"
+layout: "aws"
+page_title: "AWS: aws_opsworks_rds_db_instance"
+description: |-
+  Provides an OpsWorks RDS DB Instance resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_opsworks_rds_db_instance
+
+Provides an OpsWorks RDS DB Instance resource.
+
+~> **Note:** All arguments including the username and password will be stored in the raw state as plain-text.
+[Read more about sensitive data in state](https://www.terraform.io/docs/state/sensitive-data.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { OpsworksRdsDbInstance } from "./.gen/providers/aws/opsworks-rds-db-instance";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new OpsworksRdsDbInstance(this, "my_instance", {
+      dbPassword: "somePass",
+      dbUser: "someUser",
+      rdsDbInstanceArn: Token.asString(awsDbInstanceMyInstance.arn),
+      stackId: myStack.id,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `stackId` - (Required) The stack to register a db instance for. Changing this will force a new resource.
+* `rdsDbInstanceArn` - (Required) The db instance to register for this stack. Changing this will force a new resource.
+* `dbUser` - (Required) A db username
+* `dbPassword` - (Required) A db password
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The computed id. Please note that this is only used internally to identify the stack <-> instance relation. This value is not used in aws.
+
+<!-- cache-key: cdktf-0.18.0 input-817f20cc1cc9aa2f73aef052eaf0556b740b93e3bb7a4c3f68cb42d1fde8afc2 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/opsworks_stack.html.markdown b/website/docs/cdktf/typescript/r/opsworks_stack.html.markdown
new file mode 100644
index 00000000000..0a860680ce6
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/opsworks_stack.html.markdown
@@ -0,0 +1,114 @@
+---
+subcategory: "OpsWorks"
+layout: "aws"
+page_title: "AWS: aws_opsworks_stack"
+description: |-
+  Provides an OpsWorks stack resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_opsworks_stack
+
+Provides an OpsWorks stack resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { OpsworksStack } from "./.gen/providers/aws/opsworks-stack";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new OpsworksStack(this, "main", {
+      customJson: '{\n "foobar": {\n    "version": "1.0.0"\n  }\n}\n\n',
+      defaultInstanceProfileArn: opsworks.arn,
+      name: "awesome-stack",
+      region: "us-west-1",
+      serviceRoleArn: Token.asString(awsIamRoleOpsworks.arn),
+      tags: {
+        Name: "foobar-terraform-stack",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the stack.
+* `region` - (Required) The name of the region where the stack will exist.
+* `serviceRoleArn` - (Required) The ARN of an IAM role that the OpsWorks service will act as.
+* `defaultInstanceProfileArn` - (Required) The ARN of an IAM Instance Profile that created instances will have by default.
+* `agentVersion` - (Optional) If set to `"latest"`, OpsWorks will automatically install the latest version.
+* `berkshelfVersion` - (Optional) If `manageBerkshelf` is enabled, the version of Berkshelf to use.
+* `color` - (Optional) Color to paint next to the stack's resources in the OpsWorks console.
+* `configurationManagerName` - (Optional) Name of the configuration manager to use. Defaults to "Chef".
+* `configurationManagerVersion` - (Optional) Version of the configuration manager to use. Defaults to "11.4".
+* `customCookbooksSource` - (Optional) When `useCustomCookbooks` is set, provide this sub-object as described below.
+* `customJson` - (Optional) User defined JSON passed to "Chef". Use a "here doc" for multiline JSON.
+* `defaultAvailabilityZone` - (Optional) Name of the availability zone where instances will be created by default.
+  Cannot be set when `vpcId` is set.
+* `defaultOs` - (Optional) Name of OS that will be installed on instances by default.
+* `defaultRootDeviceType` - (Optional) Name of the type of root device instances will have by default.
+* `defaultSshKeyName` - (Optional) Name of the SSH keypair that instances will have by default.
+* `defaultSubnetId` - (Optional) ID of the subnet in which instances will be created by default.
+  Required if `vpcId` is set to a VPC other than the default VPC, and forbidden if it isn't.
+* `hostnameTheme` - (Optional) Keyword representing the naming scheme that will be used for instance hostnames within this stack.
+* `manageBerkshelf` - (Optional) Boolean value controlling whether Opsworks will run Berkshelf for this stack.
+* `tags` - (Optional) A map of tags to assign to the resource.
+  If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `useCustomCookbooks` - (Optional) Boolean value controlling whether the custom cookbook settings are enabled.
+* `useOpsworksSecurityGroups` - (Optional) Boolean value controlling whether the standard OpsWorks security groups apply to created instances.
+* `vpcId` - (Optional) ID of the VPC that this stack belongs to.
+  Defaults to the region's default VPC.
+* `customJson` - (Optional) Custom JSON attributes to apply to the entire stack.
+
+The `customCookbooksSource` block supports the following arguments:
+
+* `type` - (Required) The type of source to use. For example, "archive".
+* `url` - (Required) The URL where the cookbooks resource can be found.
+* `username` - (Optional) Username to use when authenticating to the source.
+* `password` - (Optional) Password to use when authenticating to the source. Terraform cannot perform drift detection of this configuration.
+* `sshKey` - (Optional) SSH key to use when authenticating to the source. Terraform cannot perform drift detection of this configuration.
+* `revision` - (Optional) For sources that are version-aware, the revision to use.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The id of the stack.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import OpsWorks stacks using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import OpsWorks stacks using the `id`. For example:
+
+```console
+% terraform import aws_opsworks_stack.bar 00000000-0000-0000-0000-000000000000
+```
+
+<!-- cache-key: cdktf-0.18.0 input-cbf03513c58946c4bc846b656ee35719904926d5e3f1cfba67219305564f8a4f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/opsworks_static_web_layer.html.markdown b/website/docs/cdktf/typescript/r/opsworks_static_web_layer.html.markdown
new file mode 100644
index 00000000000..da6e88cdb55
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/opsworks_static_web_layer.html.markdown
@@ -0,0 +1,106 @@
+---
+subcategory: "OpsWorks"
+layout: "aws"
+page_title: "AWS: aws_opsworks_static_web_layer"
+description: |-
+  Provides an OpsWorks static web server layer resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_opsworks_static_web_layer
+
+Provides an OpsWorks static web server layer resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { OpsworksStaticWebLayer } from "./.gen/providers/aws/opsworks-static-web-layer";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new OpsworksStaticWebLayer(this, "web", {
+      stackId: main.id,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `stackId` - (Required) ID of the stack the layer will belong to.
+* `name` - (Optional) A human-readable name for the layer.
+* `autoAssignElasticIps` - (Optional) Whether to automatically assign an elastic IP address to the layer's instances.
+* `autoAssignPublicIps` - (Optional) For stacks belonging to a VPC, whether to automatically assign a public IP address to each of the layer's instances.
+* `customInstanceProfileArn` - (Optional) The ARN of an IAM profile that will be used for the layer's instances.
+* `customSecurityGroupIds` - (Optional) Ids for a set of security groups to apply to the layer's instances.
+* `autoHealing` - (Optional) Whether to enable auto-healing for the layer.
+* `installUpdatesOnBoot` - (Optional) Whether to install OS and package updates on each instance when it boots.
+* `instanceShutdownTimeout` - (Optional) The time, in seconds, that OpsWorks will wait for Chef to complete after triggering the Shutdown event.
+* `elasticLoadBalancer` - (Optional) Name of an Elastic Load Balancer to attach to this layer
+* `drainElbOnShutdown` - (Optional) Whether to enable Elastic Load Balancing connection draining.
+* `systemPackages` - (Optional) Names of a set of system packages to install on the layer's instances.
+* `useEbsOptimizedInstances` - (Optional) Whether to use EBS-optimized instances.
+* `ebsVolume` - (Optional) `ebsVolume` blocks, as described below, will each create an EBS volume and connect it to the layer's instances.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+The following extra optional arguments, all lists of Chef recipe names, allow
+custom Chef recipes to be applied to layer instances at the five different
+lifecycle events, if custom cookbooks are enabled on the layer's stack:
+
+* `customConfigureRecipes`
+* `customDeployRecipes`
+* `customSetupRecipes`
+* `customShutdownRecipes`
+* `customUndeployRecipes`
+
+An `ebsVolume` block supports the following arguments:
+
+* `mountPoint` - (Required) The path to mount the EBS volume on the layer's instances.
+* `size` - (Required) The size of the volume in gigabytes.
+* `numberOfDisks` - (Required) The number of disks to use for the EBS volume.
+* `raidLevel` - (Required) The RAID level to use for the volume.
+* `type` - (Optional) The type of volume to create. This may be `standard` (the default), `io1` or `gp2`.
+* `iops` - (Optional) For PIOPS volumes, the IOPS per disk.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The id of the layer.
+* `arn` - The Amazon Resource Name(ARN) of the layer.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import OpsWorks static web server Layers using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import OpsWorks static web server Layers using the `id`. For example:
+
+```console
+% terraform import aws_opsworks_static_web_layer.bar 00000000-0000-0000-0000-000000000000
+```
+
+<!-- cache-key: cdktf-0.18.0 input-b665b8ab1c91c89ecda4cd4ed2a377ea3926ce423b0553dcf7179d8cd94006c6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/opsworks_user_profile.html.markdown b/website/docs/cdktf/typescript/r/opsworks_user_profile.html.markdown
new file mode 100644
index 00000000000..1460b821c9d
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/opsworks_user_profile.html.markdown
@@ -0,0 +1,53 @@
+---
+subcategory: "OpsWorks"
+layout: "aws"
+page_title: "AWS: aws_opsworks_user_profile"
+description: |-
+  Provides an OpsWorks User Profile resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_opsworks_user_profile
+
+Provides an OpsWorks User Profile resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { OpsworksUserProfile } from "./.gen/providers/aws/opsworks-user-profile";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new OpsworksUserProfile(this, "my_profile", {
+      sshUsername: "my_user",
+      userArn: user.arn,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `userArn` - (Required) The user's IAM ARN
+* `allowSelfManagement` - (Optional) Whether users can specify their own SSH public key through the My Settings page
+* `sshUsername` - (Required) The ssh username, with witch this user wants to log in
+* `sshPublicKey` - (Optional) The users public key
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Same value as `userArn`
+
+<!-- cache-key: cdktf-0.18.0 input-731328ff75f486df9bef040dc213e2c98c675ba2402982b18b6e320cea2b89f9 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/organizations_account.html.markdown b/website/docs/cdktf/typescript/r/organizations_account.html.markdown
new file mode 100644
index 00000000000..dcc13583710
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/organizations_account.html.markdown
@@ -0,0 +1,116 @@
+---
+subcategory: "Organizations"
+layout: "aws"
+page_title: "AWS: aws_organizations_account"
+description: |-
+  Provides a resource to create a member account in the current AWS Organization.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_organizations_account
+
+Provides a resource to create a member account in the current organization.
+
+~> **Note:** Account management must be done from the organization's root account.
+
+~> **Note:** By default, deleting this Terraform resource will only remove an AWS account from an organization. You must set the `closeOnDeletion` flag to true to close the account. It is worth noting that quotas are enforced when using the `closeOnDeletion` argument, which can produce a [CLOSE_ACCOUNT_QUOTA_EXCEEDED](https://docs.aws.amazon.com/organizations/latest/APIReference/API_CloseAccount.html) error, and require you to close the account manually.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { OrganizationsAccount } from "./.gen/providers/aws/organizations-account";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new OrganizationsAccount(this, "account", {
+      email: "john@doe.org",
+      name: "my_new_account",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `email` - (Required) Email address of the owner to assign to the new member account. This email address must not already be associated with another AWS account.
+* `name` - (Required) Friendly name for the member account.
+
+The following arguments are optional:
+
+* `closeOnDeletion` - (Optional) If true, a deletion event will close the account. Otherwise, it will only remove from the organization. This is not supported for GovCloud accounts.
+* `createGovcloud` - (Optional) Whether to also create a GovCloud account. The GovCloud account is tied to the main (commercial) account this resource creates. If `true`, the GovCloud account ID is available in the `govcloudId` attribute. The only way to manage the GovCloud account with Terraform is to subsequently import the account using this resource.
+* `iamUserAccessToBilling` - (Optional) If set to `allow`, the new account enables IAM users and roles to access account billing information if they have the required permissions. If set to `deny`, then only the root user (and no roles) of the new account can access account billing information. If this is unset, the AWS API will default this to `allow`. If the resource is created and this option is changed, it will try to recreate the account.
+* `parentId` - (Optional) Parent Organizational Unit ID or Root ID for the account. Defaults to the Organization default Root ID. A configuration must be present for this argument to perform drift detection.
+* `roleName` - (Optional) The name of an IAM role that Organizations automatically preconfigures in the new member account. This role trusts the root account, allowing users in the root account to assume the role, as permitted by the root account administrator. The role has administrator permissions in the new member account. The Organizations API provides no method for reading this information after account creation, so Terraform cannot perform drift detection on its value and will always show a difference for a configured value after import unless [`ignoreChanges`](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html#ignore_changes) is used.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN for this account.
+* `govcloudId` - ID for a GovCloud account created with the account.
+* `id` - The AWS account id
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import the AWS member account using the `accountId`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import the AWS member account using the `accountId`. For example:
+
+```console
+% terraform import aws_organizations_account.my_account 111111111111
+```
+
+Certain resource arguments, like `roleName`, do not have an Organizations API method for reading the information after account creation. If the argument is set in the Terraform configuration on an imported resource, Terraform will always show a difference. To workaround this behavior, either omit the argument from the Terraform configuration or use [`ignoreChanges`](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html#ignore_changes) to hide the difference. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { OrganizationsAccount } from "./.gen/providers/aws/organizations-account";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new OrganizationsAccount(this, "account", {
+      email: "john@doe.org",
+      lifecycle: {
+        ignoreChanges: [roleName],
+      },
+      name: "my_new_account",
+      roleName: "myOrganizationRole",
+    });
+  }
+}
+
+```
+
+<!-- cache-key: cdktf-0.18.0 input-89da6aca32443c4e344056b6e4e5713d71a00388c00bb09afc4a3dcf0c828f09 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/organizations_delegated_administrator.html.markdown b/website/docs/cdktf/typescript/r/organizations_delegated_administrator.html.markdown
new file mode 100644
index 00000000000..8f5b826edff
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/organizations_delegated_administrator.html.markdown
@@ -0,0 +1,80 @@
+---
+subcategory: "Organizations"
+layout: "aws"
+page_title: "AWS: aws_organizations_delegated_administrator"
+description: |-
+  Provides a resource to manage an AWS Organizations Delegated Administrator.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_organizations_delegated_administrator
+
+Provides a resource to manage an [AWS Organizations Delegated Administrator](https://docs.aws.amazon.com/organizations/latest/APIReference/API_RegisterDelegatedAdministrator.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { OrganizationsDelegatedAdministrator } from "./.gen/providers/aws/organizations-delegated-administrator";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new OrganizationsDelegatedAdministrator(this, "example", {
+      accountId: "123456789012",
+      servicePrincipal: "principal",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `accountId` - (Required) The account ID number of the member account in the organization to register as a delegated administrator.
+* `servicePrincipal` - (Required) The service principal of the AWS service for which you want to make the member account a delegated administrator.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The unique identifier (ID) of the delegated administrator.
+* `arn` - The Amazon Resource Name (ARN) of the delegated administrator's account.
+* `delegationEnabledDate` - The date when the account was made a delegated administrator.
+* `email` - The email address that is associated with the delegated administrator's AWS account.
+* `joinedMethod` - The method by which the delegated administrator's account joined the organization.
+* `joinedTimestamp` - The date when the delegated administrator's account became a part of the organization.
+* `name` - The friendly name of the delegated administrator's account.
+* `status` - The status of the delegated administrator's account in the organization.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsOrganizationsDelegatedAdministrator` using the account ID and its service principal. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsOrganizationsDelegatedAdministrator` using the account ID and its service principal. For example:
+
+```console
+% terraform import aws_organizations_delegated_administrator.example 123456789012/config.amazonaws.com
+```
+
+<!-- cache-key: cdktf-0.18.0 input-745d938c3be3fdd51b8f44d7c0633f240dd4da83077531ec5a373a21b8a1ceb8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/organizations_organization.html.markdown b/website/docs/cdktf/typescript/r/organizations_organization.html.markdown
new file mode 100644
index 00000000000..1cf18c273e3
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/organizations_organization.html.markdown
@@ -0,0 +1,104 @@
+---
+subcategory: "Organizations"
+layout: "aws"
+page_title: "AWS: aws_organizations_organization"
+description: |-
+  Provides a resource to create an organization.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_organizations_organization
+
+Provides a resource to create an organization.
+
+!> **WARNING:** When migrating from a `featureSet` of `consolidatedBilling` to `all`, the Organization account owner will received an email stating the following: "You started the process to enable all features for your AWS organization. As part of that process, all member accounts that joined your organization by invitation must approve the change. You don’t need approval from member accounts that you directly created from within your AWS organization." After all member accounts have accepted the invitation, the Organization account owner must then finalize the changes via the [AWS Console](https://console.aws.amazon.com/organizations/home#/organization/settings/migration-progress). Until these steps are performed, Terraform will perpetually show a difference, and the `describeOrganization` API will continue to show the `featureSet` as `consolidatedBilling`. See the [AWS Organizations documentation](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_org_support-all-features.html) for more information.
+
+!> **WARNING:** [Warning from the AWS Docs](https://docs.aws.amazon.com/organizations/latest/APIReference/API_EnableAWSServiceAccess.html): "We recommend that you enable integration between AWS Organizations and the specified AWS service by using the console or commands that are provided by the specified service. Doing so ensures that the service is aware that it can create the resources that are required for the integration. How the service creates those resources in the organization's accounts depends on that service. For more information, see the documentation for the other AWS service."
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { OrganizationsOrganization } from "./.gen/providers/aws/organizations-organization";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new OrganizationsOrganization(this, "org", {
+      awsServiceAccessPrincipals: [
+        "cloudtrail.amazonaws.com",
+        "config.amazonaws.com",
+      ],
+      featureSet: "ALL",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `awsServiceAccessPrincipals` - (Optional) List of AWS service principal names for which you want to enable integration with your organization. This is typically in the form of a URL, such as service-abbreviation.amazonaws.com. Organization must have `featureSet` set to `all`. Some services do not support enablement via this endpoint, see [warning in aws docs](https://docs.aws.amazon.com/organizations/latest/APIReference/API_EnableAWSServiceAccess.html).
+* `enabledPolicyTypes` - (Optional) List of Organizations policy types to enable in the Organization Root. Organization must have `featureSet` set to `all`. For additional information about valid policy types (e.g., `aiservicesOptOutPolicy`, `backupPolicy`, `serviceControlPolicy`, and `tagPolicy`), see the [AWS Organizations API Reference](https://docs.aws.amazon.com/organizations/latest/APIReference/API_EnablePolicyType.html).
+* `featureSet` - (Optional) Specify "ALL" (default) or "CONSOLIDATED_BILLING".
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `accounts` - List of organization accounts including the master account. For a list excluding the master account, see the `nonMasterAccounts` attribute. All elements have these attributes:
+    * `arn` - ARN of the account
+    * `email` - Email of the account
+    * `id` - Identifier of the account
+    * `name` - Name of the account
+    * `status` - Current status of the account
+* `arn` - ARN of the organization
+* `id` - Identifier of the organization
+* `masterAccountArn` - ARN of the master account
+* `masterAccountEmail` - Email address of the master account
+* `masterAccountId` - Identifier of the master account
+* `nonMasterAccounts` - List of organization accounts excluding the master account. For a list including the master account, see the `accounts` attribute. All elements have these attributes:
+    * `arn` - ARN of the account
+    * `email` - Email of the account
+    * `id` - Identifier of the account
+    * `name` - Name of the account
+    * `status` - Current status of the account
+* `roots` - List of organization roots. All elements have these attributes:
+    * `arn` - ARN of the root
+    * `id` - Identifier of the root
+    * `name` - Name of the root
+    * `policyTypes` - List of policy types enabled for this root. All elements have these attributes:
+        * `name` - The name of the policy type
+        * `status` - The status of the policy type as it relates to the associated root
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import the AWS organization using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import the AWS organization using the `id`. For example:
+
+```console
+% terraform import aws_organizations_organization.my_org o-1234567
+```
+
+<!-- cache-key: cdktf-0.18.0 input-94624882d07e9da3b0a6aac6dc0902e40fde096b01acc4c3e884c266bbfd7a56 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/organizations_organizational_unit.html.markdown b/website/docs/cdktf/typescript/r/organizations_organizational_unit.html.markdown
new file mode 100644
index 00000000000..fcc965062ce
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/organizations_organizational_unit.html.markdown
@@ -0,0 +1,83 @@
+---
+subcategory: "Organizations"
+layout: "aws"
+page_title: "AWS: aws_organizations_organizational_unit"
+description: |-
+  Provides a resource to create an organizational unit.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_organizations_organizational_unit
+
+Provides a resource to create an organizational unit.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { OrganizationsOrganizationalUnit } from "./.gen/providers/aws/organizations-organizational-unit";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new OrganizationsOrganizationalUnit(this, "example", {
+      name: "example",
+      parentId: Token.asString(
+        Fn.lookupNested(awsOrganizationsOrganizationExample.roots, ["0", "id"])
+      ),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - The name for the organizational unit
+* `parentId` - ID of the parent organizational unit, which may be the root
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `accounts` - List of child accounts for this Organizational Unit. Does not return account information for child Organizational Units. All elements have these attributes:
+    * `arn` - ARN of the account
+    * `email` - Email of the account
+    * `id` - Identifier of the account
+    * `name` - Name of the account
+* `arn` - ARN of the organizational unit
+* `id` - Identifier of the organization unit
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AWS Organizations Organizational Units using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import AWS Organizations Organizational Units using the `id`. For example:
+
+```console
+% terraform import aws_organizations_organizational_unit.example ou-1234567
+```
+
+<!-- cache-key: cdktf-0.18.0 input-e83646b093e28cb1e4ec4a1afa0a1e1832d418c207b7f14b799f6e614b256dc8 -->
diff --git a/website/docs/cdktf/typescript/r/organizations_policy.html.markdown b/website/docs/cdktf/typescript/r/organizations_policy.html.markdown
new file mode 100644
index 00000000000..70552069bf5
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/organizations_policy.html.markdown
@@ -0,0 +1,95 @@
+---
+subcategory: "Organizations"
+layout: "aws"
+page_title: "AWS: aws_organizations_policy"
+description: |-
+  Provides a resource to manage an AWS Organizations policy.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_organizations_policy
+
+Provides a resource to manage an [AWS Organizations policy](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { OrganizationsPolicy } from "./.gen/providers/aws/organizations-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new DataAwsIamPolicyDocument(this, "example", {
+      statement: [
+        {
+          actions: ["*"],
+          effect: "Allow",
+          resources: ["*"],
+        },
+      ],
+    });
+    const awsOrganizationsPolicyExample = new OrganizationsPolicy(
+      this,
+      "example_1",
+      {
+        content: Token.asString(example.json),
+        name: "example",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsOrganizationsPolicyExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `content` - (Required) The policy content to add to the new policy. For example, if you create a [service control policy (SCP)](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scp.html), this string must be JSON text that specifies the permissions that admins in attached accounts can delegate to their users, groups, and roles. For more information about the SCP syntax, see the [Service Control Policy Syntax documentation](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_reference_scp-syntax.html) and for more information on the Tag Policy syntax, see the [Tag Policy Syntax documentation](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_example-tag-policies.html).
+* `name` - (Required) The friendly name to assign to the policy.
+* `description` - (Optional) A description to assign to the policy.
+* `skipDestroy` - (Optional) If set to `true`, destroy will **not** delete the policy and instead just remove the resource from state. This can be useful in situations where the policies (and the associated attachment) must be preserved to meet the AWS minimum requirement of 1 attached policy.
+* `type` - (Optional) The type of policy to create. Valid values are `aiservicesOptOutPolicy`, `backupPolicy`, `serviceControlPolicy` (SCP), and `tagPolicy`. Defaults to `serviceControlPolicy`.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The unique identifier (ID) of the policy.
+* `arn` - Amazon Resource Name (ARN) of the policy.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsOrganizationsPolicy` using the policy ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsOrganizationsPolicy` using the policy ID. For example:
+
+```console
+% terraform import aws_organizations_policy.example p-12345678
+```
+
+<!-- cache-key: cdktf-0.18.0 input-128c9bb3bbac2ba8788017312dc8562e953ffd4a69f70d461a1f9b33a72a9acc -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/organizations_policy_attachment.html.markdown b/website/docs/cdktf/typescript/r/organizations_policy_attachment.html.markdown
new file mode 100644
index 00000000000..46eaabf7473
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/organizations_policy_attachment.html.markdown
@@ -0,0 +1,126 @@
+---
+subcategory: "Organizations"
+layout: "aws"
+page_title: "AWS: aws_organizations_policy_attachment"
+description: |-
+  Provides a resource to attach an AWS Organizations policy to an organization account, root, or unit.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_organizations_policy_attachment
+
+Provides a resource to attach an AWS Organizations policy to an organization account, root, or unit.
+
+## Example Usage
+
+### Organization Account
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { OrganizationsPolicyAttachment } from "./.gen/providers/aws/organizations-policy-attachment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new OrganizationsPolicyAttachment(this, "account", {
+      policyId: example.id,
+      targetId: "123456789012",
+    });
+  }
+}
+
+```
+
+### Organization Root
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { OrganizationsPolicyAttachment } from "./.gen/providers/aws/organizations-policy-attachment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new OrganizationsPolicyAttachment(this, "root", {
+      policyId: example.id,
+      targetId: Token.asString(
+        Fn.lookupNested(awsOrganizationsOrganizationExample.roots, ["0", "id"])
+      ),
+    });
+  }
+}
+
+```
+
+### Organization Unit
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { OrganizationsPolicyAttachment } from "./.gen/providers/aws/organizations-policy-attachment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new OrganizationsPolicyAttachment(this, "unit", {
+      policyId: example.id,
+      targetId: Token.asString(awsOrganizationsOrganizationalUnitExample.id),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `policyId` - (Required) The unique identifier (ID) of the policy that you want to attach to the target.
+* `targetId` - (Required) The unique identifier (ID) of the root, organizational unit, or account number that you want to attach the policy to.
+* `skipDestroy` - (Optional) If set to `true`, destroy will **not** detach the policy and instead just remove the resource from state. This can be useful in situations where the attachment must be preserved to meet the AWS minimum requirement of 1 attached policy.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsOrganizationsPolicyAttachment` using the target ID and policy ID. For example:
+
+With an account target:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsOrganizationsPolicyAttachment` using the target ID and policy ID. For example:
+
+With an account target:
+
+```console
+% terraform import aws_organizations_policy_attachment.account 123456789012:p-12345678
+```
+
+<!-- cache-key: cdktf-0.18.0 input-3828ee0215ac304d4e2eeebab26c79536b060060799e87c63d57f977fbfbfab6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/organizations_resource_policy.html.markdown b/website/docs/cdktf/typescript/r/organizations_resource_policy.html.markdown
new file mode 100644
index 00000000000..c356a2ac0cd
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/organizations_resource_policy.html.markdown
@@ -0,0 +1,75 @@
+---
+subcategory: "Organizations"
+layout: "aws"
+page_title: "AWS: aws_organizations_resource_policy"
+description: |-
+  Provides a resource to manage an AWS Organizations resource policy.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_organizations_resource_policy
+
+Provides a resource to manage a resource-based delegation policy that can be used to delegate policy management for AWS Organizations to specified member accounts to perform policy actions that are by default available only to the management account. See the [_AWS Organizations User Guide_](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_delegate_policies.html) for more information.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { OrganizationsResourcePolicy } from "./.gen/providers/aws/organizations-resource-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new OrganizationsResourcePolicy(this, "example", {
+      content:
+        '{\n  "Version": "2012-10-17",\n  "Statement": [\n    {\n      "Sid": "DelegatingNecessaryDescribeListActions",\n      "Effect": "Allow",\n      "Principal": {\n        "AWS": "arn:aws:iam::123456789012:root"\n      },\n      "Action": [\n        "organizations:DescribeOrganization",\n        "organizations:DescribeOrganizationalUnit",\n        "organizations:DescribeAccount",\n        "organizations:DescribePolicy",\n        "organizations:DescribeEffectivePolicy",\n        "organizations:ListRoots",\n        "organizations:ListOrganizationalUnitsForParent",\n        "organizations:ListParents",\n        "organizations:ListChildren",\n        "organizations:ListAccounts",\n        "organizations:ListAccountsForParent",\n        "organizations:ListPolicies",\n        "organizations:ListPoliciesForTarget",\n        "organizations:ListTargetsForPolicy",\n        "organizations:ListTagsForResource"\n      ],\n      "Resource": "*"\n    }\n  ]\n}\n\n',
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `content` - (Required) Content for the resource policy. The text must be correctly formatted JSON that complies with the syntax for the resource policy's type. See the [_AWS Organizations User Guide_](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_delegate_examples.html) for examples.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the resource policy.
+* `id` - The unique identifier (ID) of the resource policy.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsOrganizationsResourcePolicy` using the resource policy ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsOrganizationsResourcePolicy` using the resource policy ID. For example:
+
+```console
+% terraform import aws_organizations_resource_policy.example rp-12345678
+```
+
+<!-- cache-key: cdktf-0.18.0 input-8ab0a24a6a925579576b2c3639c5565582765d7c5d8c19ab463df7b7d85f9483 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/pinpoint_adm_channel.html.markdown b/website/docs/cdktf/typescript/r/pinpoint_adm_channel.html.markdown
new file mode 100644
index 00000000000..e6de4b70ecf
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/pinpoint_adm_channel.html.markdown
@@ -0,0 +1,80 @@
+---
+subcategory: "Pinpoint"
+layout: "aws"
+page_title: "AWS: aws_pinpoint_adm_channel"
+description: |-
+  Provides a Pinpoint ADM Channel resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_pinpoint_adm_channel
+
+Provides a Pinpoint ADM (Amazon Device Messaging) Channel resource.
+
+~> **Note:** All arguments including the Client ID and Client Secret will be stored in the raw state as plain-text.
+[Read more about sensitive data in state](https://www.terraform.io/docs/state/sensitive-data.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { PinpointAdmChannel } from "./.gen/providers/aws/pinpoint-adm-channel";
+import { PinpointApp } from "./.gen/providers/aws/pinpoint-app";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const app = new PinpointApp(this, "app", {});
+    new PinpointAdmChannel(this, "channel", {
+      applicationId: app.applicationId,
+      clientId: "",
+      clientSecret: "",
+      enabled: true,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `applicationId` - (Required) The application ID.
+* `clientId` - (Required) Client ID (part of OAuth Credentials) obtained via Amazon Developer Account.
+* `clientSecret` - (Required) Client Secret (part of OAuth Credentials) obtained via Amazon Developer Account.
+* `enabled` - (Optional) Specifies whether to enable the channel. Defaults to `true`.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Pinpoint ADM Channel using the `applicationId`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Pinpoint ADM Channel using the `applicationId`. For example:
+
+```console
+% terraform import aws_pinpoint_adm_channel.channel application-id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-e30cdacbcd0d1d318a6eb43fc0d36eaf1fd763528beb84e0e7303428d7cdffa4 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/pinpoint_adm_channel.markdown b/website/docs/cdktf/typescript/r/pinpoint_adm_channel.markdown
new file mode 100644
index 00000000000..e6de4b70ecf
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/pinpoint_adm_channel.markdown
@@ -0,0 +1,80 @@
+---
+subcategory: "Pinpoint"
+layout: "aws"
+page_title: "AWS: aws_pinpoint_adm_channel"
+description: |-
+  Provides a Pinpoint ADM Channel resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_pinpoint_adm_channel
+
+Provides a Pinpoint ADM (Amazon Device Messaging) Channel resource.
+
+~> **Note:** All arguments including the Client ID and Client Secret will be stored in the raw state as plain-text.
+[Read more about sensitive data in state](https://www.terraform.io/docs/state/sensitive-data.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { PinpointAdmChannel } from "./.gen/providers/aws/pinpoint-adm-channel";
+import { PinpointApp } from "./.gen/providers/aws/pinpoint-app";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const app = new PinpointApp(this, "app", {});
+    new PinpointAdmChannel(this, "channel", {
+      applicationId: app.applicationId,
+      clientId: "",
+      clientSecret: "",
+      enabled: true,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `applicationId` - (Required) The application ID.
+* `clientId` - (Required) Client ID (part of OAuth Credentials) obtained via Amazon Developer Account.
+* `clientSecret` - (Required) Client Secret (part of OAuth Credentials) obtained via Amazon Developer Account.
+* `enabled` - (Optional) Specifies whether to enable the channel. Defaults to `true`.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Pinpoint ADM Channel using the `applicationId`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Pinpoint ADM Channel using the `applicationId`. For example:
+
+```console
+% terraform import aws_pinpoint_adm_channel.channel application-id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-e30cdacbcd0d1d318a6eb43fc0d36eaf1fd763528beb84e0e7303428d7cdffa4 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/pinpoint_apns_channel.html.markdown b/website/docs/cdktf/typescript/r/pinpoint_apns_channel.html.markdown
new file mode 100644
index 00000000000..d62ab664ee8
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/pinpoint_apns_channel.html.markdown
@@ -0,0 +1,95 @@
+---
+subcategory: "Pinpoint"
+layout: "aws"
+page_title: "AWS: aws_pinpoint_apns_channel"
+description: |-
+  Provides a Pinpoint APNs Channel resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_pinpoint_apns_channel
+
+Provides a Pinpoint APNs Channel resource.
+
+~> **Note:** All arguments, including certificates and tokens, will be stored in the raw state as plain-text.
+[Read more about sensitive data in state](https://www.terraform.io/docs/state/sensitive-data.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { PinpointApnsChannel } from "./.gen/providers/aws/pinpoint-apns-channel";
+import { PinpointApp } from "./.gen/providers/aws/pinpoint-app";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const app = new PinpointApp(this, "app", {});
+    new PinpointApnsChannel(this, "apns", {
+      applicationId: app.applicationId,
+      certificate: Token.asString(Fn.file("./certificate.pem")),
+      privateKey: Token.asString(Fn.file("./private_key.key")),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `applicationId` - (Required) The application ID.
+* `enabled` - (Optional) Whether the channel is enabled or disabled. Defaults to `true`.
+* `defaultAuthenticationMethod` - (Optional) The default authentication method used for APNs.
+  __NOTE__: Amazon Pinpoint uses this default for every APNs push notification that you send using the console.
+  You can override the default when you send a message programmatically using the Amazon Pinpoint API, the AWS CLI, or an AWS SDK.
+  If your default authentication type fails, Amazon Pinpoint doesn't attempt to use the other authentication type.
+
+One of the following sets of credentials is also required.
+
+If you choose to use __Certificate credentials__ you will have to provide:
+
+* `certificate` - (Required) The pem encoded TLS Certificate from Apple.
+* `privateKey` - (Required) The Certificate Private Key file (ie. `key` file).
+
+If you choose to use __Key credentials__ you will have to provide:
+
+* `bundleId` - (Required) The ID assigned to your iOS app. To find this value, choose Certificates, IDs & Profiles, choose App IDs in the Identifiers section, and choose your app.
+* `teamId` - (Required) The ID assigned to your Apple developer account team. This value is provided on the Membership page.
+* `tokenKey` - (Required) The `p8` file that you download from your Apple developer account when you create an authentication key.
+* `tokenKeyId` - (Required) The ID assigned to your signing key. To find this value, choose Certificates, IDs & Profiles, and choose your key in the Keys section.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Pinpoint APNs Channel using the `applicationId`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Pinpoint APNs Channel using the `applicationId`. For example:
+
+```console
+% terraform import aws_pinpoint_apns_channel.apns application-id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-7eba307ddd3d08953ef6f0e4866c8fec850eff4727157433a3de2bca6b525fba -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/pinpoint_apns_channel.markdown b/website/docs/cdktf/typescript/r/pinpoint_apns_channel.markdown
new file mode 100644
index 00000000000..d62ab664ee8
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/pinpoint_apns_channel.markdown
@@ -0,0 +1,95 @@
+---
+subcategory: "Pinpoint"
+layout: "aws"
+page_title: "AWS: aws_pinpoint_apns_channel"
+description: |-
+  Provides a Pinpoint APNs Channel resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_pinpoint_apns_channel
+
+Provides a Pinpoint APNs Channel resource.
+
+~> **Note:** All arguments, including certificates and tokens, will be stored in the raw state as plain-text.
+[Read more about sensitive data in state](https://www.terraform.io/docs/state/sensitive-data.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { PinpointApnsChannel } from "./.gen/providers/aws/pinpoint-apns-channel";
+import { PinpointApp } from "./.gen/providers/aws/pinpoint-app";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const app = new PinpointApp(this, "app", {});
+    new PinpointApnsChannel(this, "apns", {
+      applicationId: app.applicationId,
+      certificate: Token.asString(Fn.file("./certificate.pem")),
+      privateKey: Token.asString(Fn.file("./private_key.key")),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `applicationId` - (Required) The application ID.
+* `enabled` - (Optional) Whether the channel is enabled or disabled. Defaults to `true`.
+* `defaultAuthenticationMethod` - (Optional) The default authentication method used for APNs.
+  __NOTE__: Amazon Pinpoint uses this default for every APNs push notification that you send using the console.
+  You can override the default when you send a message programmatically using the Amazon Pinpoint API, the AWS CLI, or an AWS SDK.
+  If your default authentication type fails, Amazon Pinpoint doesn't attempt to use the other authentication type.
+
+One of the following sets of credentials is also required.
+
+If you choose to use __Certificate credentials__ you will have to provide:
+
+* `certificate` - (Required) The pem encoded TLS Certificate from Apple.
+* `privateKey` - (Required) The Certificate Private Key file (ie. `key` file).
+
+If you choose to use __Key credentials__ you will have to provide:
+
+* `bundleId` - (Required) The ID assigned to your iOS app. To find this value, choose Certificates, IDs & Profiles, choose App IDs in the Identifiers section, and choose your app.
+* `teamId` - (Required) The ID assigned to your Apple developer account team. This value is provided on the Membership page.
+* `tokenKey` - (Required) The `p8` file that you download from your Apple developer account when you create an authentication key.
+* `tokenKeyId` - (Required) The ID assigned to your signing key. To find this value, choose Certificates, IDs & Profiles, and choose your key in the Keys section.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Pinpoint APNs Channel using the `applicationId`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Pinpoint APNs Channel using the `applicationId`. For example:
+
+```console
+% terraform import aws_pinpoint_apns_channel.apns application-id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-7eba307ddd3d08953ef6f0e4866c8fec850eff4727157433a3de2bca6b525fba -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/pinpoint_apns_sandbox_channel.html.markdown b/website/docs/cdktf/typescript/r/pinpoint_apns_sandbox_channel.html.markdown
new file mode 100644
index 00000000000..d3ea0823112
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/pinpoint_apns_sandbox_channel.html.markdown
@@ -0,0 +1,95 @@
+---
+subcategory: "Pinpoint"
+layout: "aws"
+page_title: "AWS: aws_pinpoint_apns_sandbox_channel"
+description: |-
+  Provides a Pinpoint APNs Sandbox Channel resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_pinpoint_apns_sandbox_channel
+
+Provides a Pinpoint APNs Sandbox Channel resource.
+
+~> **Note:** All arguments, including certificates and tokens, will be stored in the raw state as plain-text.
+[Read more about sensitive data in state](https://www.terraform.io/docs/state/sensitive-data.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { PinpointApnsSandboxChannel } from "./.gen/providers/aws/pinpoint-apns-sandbox-channel";
+import { PinpointApp } from "./.gen/providers/aws/pinpoint-app";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const app = new PinpointApp(this, "app", {});
+    new PinpointApnsSandboxChannel(this, "apns_sandbox", {
+      applicationId: app.applicationId,
+      certificate: Token.asString(Fn.file("./certificate.pem")),
+      privateKey: Token.asString(Fn.file("./private_key.key")),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `applicationId` - (Required) The application ID.
+* `enabled` - (Optional) Whether the channel is enabled or disabled. Defaults to `true`.
+* `defaultAuthenticationMethod` - (Optional) The default authentication method used for APNs Sandbox.
+  __NOTE__: Amazon Pinpoint uses this default for every APNs push notification that you send using the console.
+  You can override the default when you send a message programmatically using the Amazon Pinpoint API, the AWS CLI, or an AWS SDK.
+  If your default authentication type fails, Amazon Pinpoint doesn't attempt to use the other authentication type.
+
+One of the following sets of credentials is also required.
+
+If you choose to use __Certificate credentials__ you will have to provide:
+
+* `certificate` - (Required) The pem encoded TLS Certificate from Apple.
+* `privateKey` - (Required) The Certificate Private Key file (ie. `key` file).
+
+If you choose to use __Key credentials__ you will have to provide:
+
+* `bundleId` - (Required) The ID assigned to your iOS app. To find this value, choose Certificates, IDs & Profiles, choose App IDs in the Identifiers section, and choose your app.
+* `teamId` - (Required) The ID assigned to your Apple developer account team. This value is provided on the Membership page.
+* `tokenKey` - (Required) The `p8` file that you download from your Apple developer account when you create an authentication key.
+* `tokenKeyId` - (Required) The ID assigned to your signing key. To find this value, choose Certificates, IDs & Profiles, and choose your key in the Keys section.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Pinpoint APNs Sandbox Channel using the `applicationId`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Pinpoint APNs Sandbox Channel using the `applicationId`. For example:
+
+```console
+% terraform import aws_pinpoint_apns_sandbox_channel.apns_sandbox application-id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-9b39128a0fb5f80f620d484ded1a0f9f54b7b1afaaffa50e404146a69d92c38f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/pinpoint_apns_sandbox_channel.markdown b/website/docs/cdktf/typescript/r/pinpoint_apns_sandbox_channel.markdown
new file mode 100644
index 00000000000..d3ea0823112
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/pinpoint_apns_sandbox_channel.markdown
@@ -0,0 +1,95 @@
+---
+subcategory: "Pinpoint"
+layout: "aws"
+page_title: "AWS: aws_pinpoint_apns_sandbox_channel"
+description: |-
+  Provides a Pinpoint APNs Sandbox Channel resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_pinpoint_apns_sandbox_channel
+
+Provides a Pinpoint APNs Sandbox Channel resource.
+
+~> **Note:** All arguments, including certificates and tokens, will be stored in the raw state as plain-text.
+[Read more about sensitive data in state](https://www.terraform.io/docs/state/sensitive-data.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { PinpointApnsSandboxChannel } from "./.gen/providers/aws/pinpoint-apns-sandbox-channel";
+import { PinpointApp } from "./.gen/providers/aws/pinpoint-app";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const app = new PinpointApp(this, "app", {});
+    new PinpointApnsSandboxChannel(this, "apns_sandbox", {
+      applicationId: app.applicationId,
+      certificate: Token.asString(Fn.file("./certificate.pem")),
+      privateKey: Token.asString(Fn.file("./private_key.key")),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `applicationId` - (Required) The application ID.
+* `enabled` - (Optional) Whether the channel is enabled or disabled. Defaults to `true`.
+* `defaultAuthenticationMethod` - (Optional) The default authentication method used for APNs Sandbox.
+  __NOTE__: Amazon Pinpoint uses this default for every APNs push notification that you send using the console.
+  You can override the default when you send a message programmatically using the Amazon Pinpoint API, the AWS CLI, or an AWS SDK.
+  If your default authentication type fails, Amazon Pinpoint doesn't attempt to use the other authentication type.
+
+One of the following sets of credentials is also required.
+
+If you choose to use __Certificate credentials__ you will have to provide:
+
+* `certificate` - (Required) The pem encoded TLS Certificate from Apple.
+* `privateKey` - (Required) The Certificate Private Key file (ie. `key` file).
+
+If you choose to use __Key credentials__ you will have to provide:
+
+* `bundleId` - (Required) The ID assigned to your iOS app. To find this value, choose Certificates, IDs & Profiles, choose App IDs in the Identifiers section, and choose your app.
+* `teamId` - (Required) The ID assigned to your Apple developer account team. This value is provided on the Membership page.
+* `tokenKey` - (Required) The `p8` file that you download from your Apple developer account when you create an authentication key.
+* `tokenKeyId` - (Required) The ID assigned to your signing key. To find this value, choose Certificates, IDs & Profiles, and choose your key in the Keys section.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Pinpoint APNs Sandbox Channel using the `applicationId`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Pinpoint APNs Sandbox Channel using the `applicationId`. For example:
+
+```console
+% terraform import aws_pinpoint_apns_sandbox_channel.apns_sandbox application-id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-9b39128a0fb5f80f620d484ded1a0f9f54b7b1afaaffa50e404146a69d92c38f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/pinpoint_apns_voip_channel.html.markdown b/website/docs/cdktf/typescript/r/pinpoint_apns_voip_channel.html.markdown
new file mode 100644
index 00000000000..8e944961e34
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/pinpoint_apns_voip_channel.html.markdown
@@ -0,0 +1,95 @@
+---
+subcategory: "Pinpoint"
+layout: "aws"
+page_title: "AWS: aws_pinpoint_apns_voip_channel"
+description: |-
+  Provides a Pinpoint APNs VoIP Channel resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_pinpoint_apns_voip_channel
+
+Provides a Pinpoint APNs VoIP Channel resource.
+
+~> **Note:** All arguments, including certificates and tokens, will be stored in the raw state as plain-text.
+[Read more about sensitive data in state](https://www.terraform.io/docs/state/sensitive-data.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { PinpointApnsVoipChannel } from "./.gen/providers/aws/pinpoint-apns-voip-channel";
+import { PinpointApp } from "./.gen/providers/aws/pinpoint-app";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const app = new PinpointApp(this, "app", {});
+    new PinpointApnsVoipChannel(this, "apns_voip", {
+      applicationId: app.applicationId,
+      certificate: Token.asString(Fn.file("./certificate.pem")),
+      privateKey: Token.asString(Fn.file("./private_key.key")),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `applicationId` - (Required) The application ID.
+* `enabled` - (Optional) Whether the channel is enabled or disabled. Defaults to `true`.
+* `defaultAuthenticationMethod` - (Optional) The default authentication method used for APNs.
+  __NOTE__: Amazon Pinpoint uses this default for every APNs push notification that you send using the console.
+  You can override the default when you send a message programmatically using the Amazon Pinpoint API, the AWS CLI, or an AWS SDK.
+  If your default authentication type fails, Amazon Pinpoint doesn't attempt to use the other authentication type.
+
+One of the following sets of credentials is also required.
+
+If you choose to use __Certificate credentials__ you will have to provide:
+
+* `certificate` - (Required) The pem encoded TLS Certificate from Apple.
+* `privateKey` - (Required) The Certificate Private Key file (ie. `key` file).
+
+If you choose to use __Key credentials__ you will have to provide:
+
+* `bundleId` - (Required) The ID assigned to your iOS app. To find this value, choose Certificates, IDs & Profiles, choose App IDs in the Identifiers section, and choose your app.
+* `teamId` - (Required) The ID assigned to your Apple developer account team. This value is provided on the Membership page.
+* `tokenKey` - (Required) The `p8` file that you download from your Apple developer account when you create an authentication key.
+* `tokenKeyId` - (Required) The ID assigned to your signing key. To find this value, choose Certificates, IDs & Profiles, and choose your key in the Keys section.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Pinpoint APNs VoIP Channel using the `applicationId`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Pinpoint APNs VoIP Channel using the `applicationId`. For example:
+
+```console
+% terraform import aws_pinpoint_apns_voip_channel.apns_voip application-id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-0ffc83fe4540fc67436e7989e5cf3564705d88e89adc4f3fda68412be44cfc00 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/pinpoint_apns_voip_channel.markdown b/website/docs/cdktf/typescript/r/pinpoint_apns_voip_channel.markdown
new file mode 100644
index 00000000000..8e944961e34
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/pinpoint_apns_voip_channel.markdown
@@ -0,0 +1,95 @@
+---
+subcategory: "Pinpoint"
+layout: "aws"
+page_title: "AWS: aws_pinpoint_apns_voip_channel"
+description: |-
+  Provides a Pinpoint APNs VoIP Channel resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_pinpoint_apns_voip_channel
+
+Provides a Pinpoint APNs VoIP Channel resource.
+
+~> **Note:** All arguments, including certificates and tokens, will be stored in the raw state as plain-text.
+[Read more about sensitive data in state](https://www.terraform.io/docs/state/sensitive-data.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { PinpointApnsVoipChannel } from "./.gen/providers/aws/pinpoint-apns-voip-channel";
+import { PinpointApp } from "./.gen/providers/aws/pinpoint-app";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const app = new PinpointApp(this, "app", {});
+    new PinpointApnsVoipChannel(this, "apns_voip", {
+      applicationId: app.applicationId,
+      certificate: Token.asString(Fn.file("./certificate.pem")),
+      privateKey: Token.asString(Fn.file("./private_key.key")),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `applicationId` - (Required) The application ID.
+* `enabled` - (Optional) Whether the channel is enabled or disabled. Defaults to `true`.
+* `defaultAuthenticationMethod` - (Optional) The default authentication method used for APNs.
+  __NOTE__: Amazon Pinpoint uses this default for every APNs push notification that you send using the console.
+  You can override the default when you send a message programmatically using the Amazon Pinpoint API, the AWS CLI, or an AWS SDK.
+  If your default authentication type fails, Amazon Pinpoint doesn't attempt to use the other authentication type.
+
+One of the following sets of credentials is also required.
+
+If you choose to use __Certificate credentials__ you will have to provide:
+
+* `certificate` - (Required) The pem encoded TLS Certificate from Apple.
+* `privateKey` - (Required) The Certificate Private Key file (ie. `key` file).
+
+If you choose to use __Key credentials__ you will have to provide:
+
+* `bundleId` - (Required) The ID assigned to your iOS app. To find this value, choose Certificates, IDs & Profiles, choose App IDs in the Identifiers section, and choose your app.
+* `teamId` - (Required) The ID assigned to your Apple developer account team. This value is provided on the Membership page.
+* `tokenKey` - (Required) The `p8` file that you download from your Apple developer account when you create an authentication key.
+* `tokenKeyId` - (Required) The ID assigned to your signing key. To find this value, choose Certificates, IDs & Profiles, and choose your key in the Keys section.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Pinpoint APNs VoIP Channel using the `applicationId`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Pinpoint APNs VoIP Channel using the `applicationId`. For example:
+
+```console
+% terraform import aws_pinpoint_apns_voip_channel.apns_voip application-id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-0ffc83fe4540fc67436e7989e5cf3564705d88e89adc4f3fda68412be44cfc00 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/pinpoint_apns_voip_sandbox_channel.html.markdown b/website/docs/cdktf/typescript/r/pinpoint_apns_voip_sandbox_channel.html.markdown
new file mode 100644
index 00000000000..999902c1403
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/pinpoint_apns_voip_sandbox_channel.html.markdown
@@ -0,0 +1,95 @@
+---
+subcategory: "Pinpoint"
+layout: "aws"
+page_title: "AWS: aws_pinpoint_apns_voip_sandbox_channel"
+description: |-
+  Provides a Pinpoint APNs VoIP Sandbox Channel resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_pinpoint_apns_voip_sandbox_channel
+
+Provides a Pinpoint APNs VoIP Sandbox Channel resource.
+
+~> **Note:** All arguments, including certificates and tokens, will be stored in the raw state as plain-text.
+[Read more about sensitive data in state](https://www.terraform.io/docs/state/sensitive-data.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { PinpointApnsVoipSandboxChannel } from "./.gen/providers/aws/pinpoint-apns-voip-sandbox-channel";
+import { PinpointApp } from "./.gen/providers/aws/pinpoint-app";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const app = new PinpointApp(this, "app", {});
+    new PinpointApnsVoipSandboxChannel(this, "apns_voip_sandbox", {
+      applicationId: app.applicationId,
+      certificate: Token.asString(Fn.file("./certificate.pem")),
+      privateKey: Token.asString(Fn.file("./private_key.key")),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `applicationId` - (Required) The application ID.
+* `enabled` - (Optional) Whether the channel is enabled or disabled. Defaults to `true`.
+* `defaultAuthenticationMethod` - (Optional) The default authentication method used for APNs.
+  __NOTE__: Amazon Pinpoint uses this default for every APNs push notification that you send using the console.
+  You can override the default when you send a message programmatically using the Amazon Pinpoint API, the AWS CLI, or an AWS SDK.
+  If your default authentication type fails, Amazon Pinpoint doesn't attempt to use the other authentication type.
+
+One of the following sets of credentials is also required.
+
+If you choose to use __Certificate credentials__ you will have to provide:
+
+* `certificate` - (Required) The pem encoded TLS Certificate from Apple.
+* `privateKey` - (Required) The Certificate Private Key file (ie. `key` file).
+
+If you choose to use __Key credentials__ you will have to provide:
+
+* `bundleId` - (Required) The ID assigned to your iOS app. To find this value, choose Certificates, IDs & Profiles, choose App IDs in the Identifiers section, and choose your app.
+* `teamId` - (Required) The ID assigned to your Apple developer account team. This value is provided on the Membership page.
+* `tokenKey` - (Required) The `p8` file that you download from your Apple developer account when you create an authentication key.
+* `tokenKeyId` - (Required) The ID assigned to your signing key. To find this value, choose Certificates, IDs & Profiles, and choose your key in the Keys section.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Pinpoint APNs VoIP Sandbox Channel using the `applicationId`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Pinpoint APNs VoIP Sandbox Channel using the `applicationId`. For example:
+
+```console
+% terraform import aws_pinpoint_apns_voip_sandbox_channel.apns_voip_sandbox application-id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-10a8793c57ea80faa1bcc8e11505f01ac9d61ce493402a8a9a145cb769e2c84c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/pinpoint_apns_voip_sandbox_channel.markdown b/website/docs/cdktf/typescript/r/pinpoint_apns_voip_sandbox_channel.markdown
new file mode 100644
index 00000000000..999902c1403
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/pinpoint_apns_voip_sandbox_channel.markdown
@@ -0,0 +1,95 @@
+---
+subcategory: "Pinpoint"
+layout: "aws"
+page_title: "AWS: aws_pinpoint_apns_voip_sandbox_channel"
+description: |-
+  Provides a Pinpoint APNs VoIP Sandbox Channel resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_pinpoint_apns_voip_sandbox_channel
+
+Provides a Pinpoint APNs VoIP Sandbox Channel resource.
+
+~> **Note:** All arguments, including certificates and tokens, will be stored in the raw state as plain-text.
+[Read more about sensitive data in state](https://www.terraform.io/docs/state/sensitive-data.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { PinpointApnsVoipSandboxChannel } from "./.gen/providers/aws/pinpoint-apns-voip-sandbox-channel";
+import { PinpointApp } from "./.gen/providers/aws/pinpoint-app";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const app = new PinpointApp(this, "app", {});
+    new PinpointApnsVoipSandboxChannel(this, "apns_voip_sandbox", {
+      applicationId: app.applicationId,
+      certificate: Token.asString(Fn.file("./certificate.pem")),
+      privateKey: Token.asString(Fn.file("./private_key.key")),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `applicationId` - (Required) The application ID.
+* `enabled` - (Optional) Whether the channel is enabled or disabled. Defaults to `true`.
+* `defaultAuthenticationMethod` - (Optional) The default authentication method used for APNs.
+  __NOTE__: Amazon Pinpoint uses this default for every APNs push notification that you send using the console.
+  You can override the default when you send a message programmatically using the Amazon Pinpoint API, the AWS CLI, or an AWS SDK.
+  If your default authentication type fails, Amazon Pinpoint doesn't attempt to use the other authentication type.
+
+One of the following sets of credentials is also required.
+
+If you choose to use __Certificate credentials__ you will have to provide:
+
+* `certificate` - (Required) The pem encoded TLS Certificate from Apple.
+* `privateKey` - (Required) The Certificate Private Key file (ie. `key` file).
+
+If you choose to use __Key credentials__ you will have to provide:
+
+* `bundleId` - (Required) The ID assigned to your iOS app. To find this value, choose Certificates, IDs & Profiles, choose App IDs in the Identifiers section, and choose your app.
+* `teamId` - (Required) The ID assigned to your Apple developer account team. This value is provided on the Membership page.
+* `tokenKey` - (Required) The `p8` file that you download from your Apple developer account when you create an authentication key.
+* `tokenKeyId` - (Required) The ID assigned to your signing key. To find this value, choose Certificates, IDs & Profiles, and choose your key in the Keys section.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Pinpoint APNs VoIP Sandbox Channel using the `applicationId`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Pinpoint APNs VoIP Sandbox Channel using the `applicationId`. For example:
+
+```console
+% terraform import aws_pinpoint_apns_voip_sandbox_channel.apns_voip_sandbox application-id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-10a8793c57ea80faa1bcc8e11505f01ac9d61ce493402a8a9a145cb769e2c84c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/pinpoint_app.html.markdown b/website/docs/cdktf/typescript/r/pinpoint_app.html.markdown
new file mode 100644
index 00000000000..6f030c2b1aa
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/pinpoint_app.html.markdown
@@ -0,0 +1,103 @@
+---
+subcategory: "Pinpoint"
+layout: "aws"
+page_title: "AWS: aws_pinpoint_app"
+description: |-
+  Provides a Pinpoint App resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_pinpoint_app
+
+Provides a Pinpoint App resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { PinpointApp } from "./.gen/providers/aws/pinpoint-app";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new PinpointApp(this, "example", {
+      limits: {
+        maximumDuration: 600,
+      },
+      name: "test-app",
+      quietTime: {
+        end: "06:00",
+        start: "00:00",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Optional) The application name. By default generated by Terraform
+* `namePrefix` - (Optional) The name of the Pinpoint application. Conflicts with `name`
+* `campaignHook` - (Optional) Specifies settings for invoking an AWS Lambda function that customizes a segment for a campaign
+* `limits` - (Optional) The default campaign limits for the app. These limits apply to each campaign for the app, unless the campaign overrides the default with limits of its own
+* `quietTime` - (Optional) The default quiet time for the app. Each campaign for this app sends no messages during this time unless the campaign overrides the default with a quiet time of its own
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+`campaignHook` supports the following:
+
+* `lambdaFunctionName` - (Optional) Lambda function name or ARN to be called for delivery. Conflicts with `webUrl`
+* `mode` - (Required if `lambdaFunctionName` or `webUrl` are provided) What mode Lambda should be invoked in. Valid values for this parameter are `delivery`, `filter`.  
+* `webUrl` - (Optional) Web URL to call for hook. If the URL has authentication specified it will be added as authentication to the request. Conflicts with `lambdaFunctionName`
+
+`limits` supports the following:
+
+* `daily` - (Optional) The maximum number of messages that the campaign can send daily.
+* `maximumDuration` - (Optional) The length of time (in seconds) that the campaign can run before it ends and message deliveries stop. This duration begins at the scheduled start time for the campaign. The minimum value is 60.
+* `messagesPerSecond` - (Optional) The number of messages that the campaign can send per second. The minimum value is 50, and the maximum is 20000.
+* `total` - (Optional) The maximum total number of messages that the campaign can send.
+
+`quietTime` supports the following:
+
+* `end` - (Optional) The default end time for quiet time in ISO 8601 format. Required if `start` is set
+* `start` - (Optional) The default start time for quiet time in ISO 8601 format. Required if `end` is set
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `applicationId` - The Application ID of the Pinpoint App.
+* `arn` - Amazon Resource Name (ARN) of the PinPoint Application
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Pinpoint App using the `applicationId`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Pinpoint App using the `applicationId`. For example:
+
+```console
+% terraform import aws_pinpoint_app.name application-id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-69252b714649cc19bbfedeb89aa6fa806e2f32d0df2739664cb86bc692aacfc6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/pinpoint_app.markdown b/website/docs/cdktf/typescript/r/pinpoint_app.markdown
new file mode 100644
index 00000000000..6f030c2b1aa
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/pinpoint_app.markdown
@@ -0,0 +1,103 @@
+---
+subcategory: "Pinpoint"
+layout: "aws"
+page_title: "AWS: aws_pinpoint_app"
+description: |-
+  Provides a Pinpoint App resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_pinpoint_app
+
+Provides a Pinpoint App resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { PinpointApp } from "./.gen/providers/aws/pinpoint-app";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new PinpointApp(this, "example", {
+      limits: {
+        maximumDuration: 600,
+      },
+      name: "test-app",
+      quietTime: {
+        end: "06:00",
+        start: "00:00",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Optional) The application name. By default generated by Terraform
+* `namePrefix` - (Optional) The name of the Pinpoint application. Conflicts with `name`
+* `campaignHook` - (Optional) Specifies settings for invoking an AWS Lambda function that customizes a segment for a campaign
+* `limits` - (Optional) The default campaign limits for the app. These limits apply to each campaign for the app, unless the campaign overrides the default with limits of its own
+* `quietTime` - (Optional) The default quiet time for the app. Each campaign for this app sends no messages during this time unless the campaign overrides the default with a quiet time of its own
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+`campaignHook` supports the following:
+
+* `lambdaFunctionName` - (Optional) Lambda function name or ARN to be called for delivery. Conflicts with `webUrl`
+* `mode` - (Required if `lambdaFunctionName` or `webUrl` are provided) What mode Lambda should be invoked in. Valid values for this parameter are `delivery`, `filter`.  
+* `webUrl` - (Optional) Web URL to call for hook. If the URL has authentication specified it will be added as authentication to the request. Conflicts with `lambdaFunctionName`
+
+`limits` supports the following:
+
+* `daily` - (Optional) The maximum number of messages that the campaign can send daily.
+* `maximumDuration` - (Optional) The length of time (in seconds) that the campaign can run before it ends and message deliveries stop. This duration begins at the scheduled start time for the campaign. The minimum value is 60.
+* `messagesPerSecond` - (Optional) The number of messages that the campaign can send per second. The minimum value is 50, and the maximum is 20000.
+* `total` - (Optional) The maximum total number of messages that the campaign can send.
+
+`quietTime` supports the following:
+
+* `end` - (Optional) The default end time for quiet time in ISO 8601 format. Required if `start` is set
+* `start` - (Optional) The default start time for quiet time in ISO 8601 format. Required if `end` is set
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `applicationId` - The Application ID of the Pinpoint App.
+* `arn` - Amazon Resource Name (ARN) of the PinPoint Application
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Pinpoint App using the `applicationId`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Pinpoint App using the `applicationId`. For example:
+
+```console
+% terraform import aws_pinpoint_app.name application-id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-69252b714649cc19bbfedeb89aa6fa806e2f32d0df2739664cb86bc692aacfc6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/pinpoint_baidu_channel.html.markdown b/website/docs/cdktf/typescript/r/pinpoint_baidu_channel.html.markdown
new file mode 100644
index 00000000000..133e429805f
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/pinpoint_baidu_channel.html.markdown
@@ -0,0 +1,79 @@
+---
+subcategory: "Pinpoint"
+layout: "aws"
+page_title: "AWS: aws_pinpoint_baidu_channel"
+description: |-
+  Provides a Pinpoint Baidu Channel resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_pinpoint_baidu_channel
+
+Provides a Pinpoint Baidu Channel resource.
+
+~> **Note:** All arguments including the Api Key and Secret Key will be stored in the raw state as plain-text.
+[Read more about sensitive data in state](https://www.terraform.io/docs/state/sensitive-data.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { PinpointApp } from "./.gen/providers/aws/pinpoint-app";
+import { PinpointBaiduChannel } from "./.gen/providers/aws/pinpoint-baidu-channel";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const app = new PinpointApp(this, "app", {});
+    new PinpointBaiduChannel(this, "channel", {
+      apiKey: "",
+      applicationId: app.applicationId,
+      secretKey: "",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `applicationId` - (Required) The application ID.
+* `enabled` - (Optional) Specifies whether to enable the channel. Defaults to `true`.
+* `apiKey` - (Required) Platform credential API key from Baidu.
+* `secretKey` - (Required) Platform credential Secret key from Baidu.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Pinpoint Baidu Channel using the `applicationId`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Pinpoint Baidu Channel using the `applicationId`. For example:
+
+```console
+% terraform import aws_pinpoint_baidu_channel.channel application-id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-0f0737a2ecf3441f3760954b544512dca7098ae0198bf9673837a1b43aafd321 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/pinpoint_baidu_channel.markdown b/website/docs/cdktf/typescript/r/pinpoint_baidu_channel.markdown
new file mode 100644
index 00000000000..133e429805f
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/pinpoint_baidu_channel.markdown
@@ -0,0 +1,79 @@
+---
+subcategory: "Pinpoint"
+layout: "aws"
+page_title: "AWS: aws_pinpoint_baidu_channel"
+description: |-
+  Provides a Pinpoint Baidu Channel resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_pinpoint_baidu_channel
+
+Provides a Pinpoint Baidu Channel resource.
+
+~> **Note:** All arguments including the Api Key and Secret Key will be stored in the raw state as plain-text.
+[Read more about sensitive data in state](https://www.terraform.io/docs/state/sensitive-data.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { PinpointApp } from "./.gen/providers/aws/pinpoint-app";
+import { PinpointBaiduChannel } from "./.gen/providers/aws/pinpoint-baidu-channel";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const app = new PinpointApp(this, "app", {});
+    new PinpointBaiduChannel(this, "channel", {
+      apiKey: "",
+      applicationId: app.applicationId,
+      secretKey: "",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `applicationId` - (Required) The application ID.
+* `enabled` - (Optional) Specifies whether to enable the channel. Defaults to `true`.
+* `apiKey` - (Required) Platform credential API key from Baidu.
+* `secretKey` - (Required) Platform credential Secret key from Baidu.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Pinpoint Baidu Channel using the `applicationId`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Pinpoint Baidu Channel using the `applicationId`. For example:
+
+```console
+% terraform import aws_pinpoint_baidu_channel.channel application-id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-0f0737a2ecf3441f3760954b544512dca7098ae0198bf9673837a1b43aafd321 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/pinpoint_email_channel.html.markdown b/website/docs/cdktf/typescript/r/pinpoint_email_channel.html.markdown
new file mode 100644
index 00000000000..40041073429
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/pinpoint_email_channel.html.markdown
@@ -0,0 +1,128 @@
+---
+subcategory: "Pinpoint"
+layout: "aws"
+page_title: "AWS: aws_pinpoint_email_channel"
+description: |-
+  Provides a Pinpoint Email Channel resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_pinpoint_email_channel
+
+Provides a Pinpoint Email Channel resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+import { IamRolePolicy } from "./.gen/providers/aws/iam-role-policy";
+import { PinpointApp } from "./.gen/providers/aws/pinpoint-app";
+import { PinpointEmailChannel } from "./.gen/providers/aws/pinpoint-email-channel";
+import { SesDomainIdentity } from "./.gen/providers/aws/ses-domain-identity";
+interface MyConfig {
+  identity: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    const app = new PinpointApp(this, "app", {});
+    new SesDomainIdentity(this, "identity", {
+      domain: "example.com",
+    });
+    const assumeRole = new DataAwsIamPolicyDocument(this, "assume_role", {
+      statement: [
+        {
+          actions: ["sts:AssumeRole"],
+          effect: "Allow",
+          principals: [
+            {
+              identifiers: ["pinpoint.amazonaws.com"],
+              type: "Service",
+            },
+          ],
+        },
+      ],
+    });
+    const rolePolicy = new DataAwsIamPolicyDocument(this, "role_policy", {
+      statement: [
+        {
+          actions: ["mobileanalytics:PutEvents", "mobileanalytics:PutItems"],
+          effect: "Allow",
+          resources: ["*"],
+        },
+      ],
+    });
+    const role = new IamRole(this, "role", {
+      assumeRolePolicy: Token.asString(assumeRole.json),
+    });
+    const awsIamRolePolicyRolePolicy = new IamRolePolicy(
+      this,
+      "role_policy_5",
+      {
+        name: "role_policy",
+        policy: Token.asString(rolePolicy.json),
+        role: role.id,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamRolePolicyRolePolicy.overrideLogicalId("role_policy");
+    new PinpointEmailChannel(this, "email", {
+      applicationId: app.applicationId,
+      fromAddress: "user@example.com",
+      roleArn: role.arn,
+      identity: config.identity,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `applicationId` - (Required) The application ID.
+* `enabled` - (Optional) Whether the channel is enabled or disabled. Defaults to `true`.
+* `configurationSet` - (Optional) The ARN of the Amazon SES configuration set that you want to apply to messages that you send through the channel.
+* `fromAddress` - (Required) The email address used to send emails from. You can use email only (`user@exampleCom`) or friendly address (`User <user@example.com>`). This field comply with [RFC 5322](https://www.ietf.org/rfc/rfc5322.txt).
+* `identity` - (Required) The ARN of an identity verified with SES.
+* `roleArn` - (Optional) The ARN of an IAM Role used to submit events to Mobile Analytics' event ingestion service.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `messagesPerSecond` - Messages per second that can be sent.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Pinpoint Email Channel using the `applicationId`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Pinpoint Email Channel using the `applicationId`. For example:
+
+```console
+% terraform import aws_pinpoint_email_channel.email application-id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-669b9a713da9a2dec982762fd0942f91a639ba307f5affad6cecab1234f05e8f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/pinpoint_email_channel.markdown b/website/docs/cdktf/typescript/r/pinpoint_email_channel.markdown
new file mode 100644
index 00000000000..40041073429
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/pinpoint_email_channel.markdown
@@ -0,0 +1,128 @@
+---
+subcategory: "Pinpoint"
+layout: "aws"
+page_title: "AWS: aws_pinpoint_email_channel"
+description: |-
+  Provides a Pinpoint Email Channel resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_pinpoint_email_channel
+
+Provides a Pinpoint Email Channel resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+import { IamRolePolicy } from "./.gen/providers/aws/iam-role-policy";
+import { PinpointApp } from "./.gen/providers/aws/pinpoint-app";
+import { PinpointEmailChannel } from "./.gen/providers/aws/pinpoint-email-channel";
+import { SesDomainIdentity } from "./.gen/providers/aws/ses-domain-identity";
+interface MyConfig {
+  identity: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    const app = new PinpointApp(this, "app", {});
+    new SesDomainIdentity(this, "identity", {
+      domain: "example.com",
+    });
+    const assumeRole = new DataAwsIamPolicyDocument(this, "assume_role", {
+      statement: [
+        {
+          actions: ["sts:AssumeRole"],
+          effect: "Allow",
+          principals: [
+            {
+              identifiers: ["pinpoint.amazonaws.com"],
+              type: "Service",
+            },
+          ],
+        },
+      ],
+    });
+    const rolePolicy = new DataAwsIamPolicyDocument(this, "role_policy", {
+      statement: [
+        {
+          actions: ["mobileanalytics:PutEvents", "mobileanalytics:PutItems"],
+          effect: "Allow",
+          resources: ["*"],
+        },
+      ],
+    });
+    const role = new IamRole(this, "role", {
+      assumeRolePolicy: Token.asString(assumeRole.json),
+    });
+    const awsIamRolePolicyRolePolicy = new IamRolePolicy(
+      this,
+      "role_policy_5",
+      {
+        name: "role_policy",
+        policy: Token.asString(rolePolicy.json),
+        role: role.id,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamRolePolicyRolePolicy.overrideLogicalId("role_policy");
+    new PinpointEmailChannel(this, "email", {
+      applicationId: app.applicationId,
+      fromAddress: "user@example.com",
+      roleArn: role.arn,
+      identity: config.identity,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `applicationId` - (Required) The application ID.
+* `enabled` - (Optional) Whether the channel is enabled or disabled. Defaults to `true`.
+* `configurationSet` - (Optional) The ARN of the Amazon SES configuration set that you want to apply to messages that you send through the channel.
+* `fromAddress` - (Required) The email address used to send emails from. You can use email only (`user@exampleCom`) or friendly address (`User <user@example.com>`). This field comply with [RFC 5322](https://www.ietf.org/rfc/rfc5322.txt).
+* `identity` - (Required) The ARN of an identity verified with SES.
+* `roleArn` - (Optional) The ARN of an IAM Role used to submit events to Mobile Analytics' event ingestion service.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `messagesPerSecond` - Messages per second that can be sent.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Pinpoint Email Channel using the `applicationId`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Pinpoint Email Channel using the `applicationId`. For example:
+
+```console
+% terraform import aws_pinpoint_email_channel.email application-id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-669b9a713da9a2dec982762fd0942f91a639ba307f5affad6cecab1234f05e8f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/pinpoint_event_stream.html.markdown b/website/docs/cdktf/typescript/r/pinpoint_event_stream.html.markdown
new file mode 100644
index 00000000000..2d26c754c53
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/pinpoint_event_stream.html.markdown
@@ -0,0 +1,124 @@
+---
+subcategory: "Pinpoint"
+layout: "aws"
+page_title: "AWS: aws_pinpoint_event_stream"
+description: |-
+  Provides a Pinpoint Event Stream resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_pinpoint_event_stream
+
+Provides a Pinpoint Event Stream resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+import { IamRolePolicy } from "./.gen/providers/aws/iam-role-policy";
+import { KinesisStream } from "./.gen/providers/aws/kinesis-stream";
+import { PinpointApp } from "./.gen/providers/aws/pinpoint-app";
+import { PinpointEventStream } from "./.gen/providers/aws/pinpoint-event-stream";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const testStream = new KinesisStream(this, "test_stream", {
+      name: "pinpoint-kinesis-test",
+      shardCount: 1,
+    });
+    const app = new PinpointApp(this, "app", {});
+    const assumeRole = new DataAwsIamPolicyDocument(this, "assume_role", {
+      statement: [
+        {
+          actions: ["sts:AssumeRole"],
+          effect: "Allow",
+          principals: [
+            {
+              identifiers: ["pinpoint.us-east-1.amazonaws.com"],
+              type: "Service",
+            },
+          ],
+        },
+      ],
+    });
+    const testRolePolicy = new DataAwsIamPolicyDocument(
+      this,
+      "test_role_policy",
+      {
+        statement: [
+          {
+            actions: ["kinesis:PutRecords", "kinesis:DescribeStream"],
+            effect: "Allow",
+            resources: ["arn:aws:kinesis:us-east-1:*:*/*"],
+          },
+        ],
+      }
+    );
+    const testRole = new IamRole(this, "test_role", {
+      assumeRolePolicy: Token.asString(assumeRole.json),
+    });
+    const awsIamRolePolicyTestRolePolicy = new IamRolePolicy(
+      this,
+      "test_role_policy_5",
+      {
+        name: "test_policy",
+        policy: Token.asString(testRolePolicy.json),
+        role: testRole.id,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamRolePolicyTestRolePolicy.overrideLogicalId("test_role_policy");
+    new PinpointEventStream(this, "stream", {
+      applicationId: app.applicationId,
+      destinationStreamArn: testStream.arn,
+      roleArn: testRole.arn,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `applicationId` - (Required) The application ID.
+* `destinationStreamArn` - (Required) The Amazon Resource Name (ARN) of the Amazon Kinesis stream or Firehose delivery stream to which you want to publish events.
+* `roleArn` - (Required) The IAM role that authorizes Amazon Pinpoint to publish events to the stream in your account.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Pinpoint Event Stream using the `applicationId`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Pinpoint Event Stream using the `applicationId`. For example:
+
+```console
+% terraform import aws_pinpoint_event_stream.stream application-id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-781c351d9404f1abba2f962888a231281d00739d19baa3253947f07c74cba124 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/pinpoint_event_stream.markdown b/website/docs/cdktf/typescript/r/pinpoint_event_stream.markdown
new file mode 100644
index 00000000000..2d26c754c53
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/pinpoint_event_stream.markdown
@@ -0,0 +1,124 @@
+---
+subcategory: "Pinpoint"
+layout: "aws"
+page_title: "AWS: aws_pinpoint_event_stream"
+description: |-
+  Provides a Pinpoint Event Stream resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_pinpoint_event_stream
+
+Provides a Pinpoint Event Stream resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+import { IamRolePolicy } from "./.gen/providers/aws/iam-role-policy";
+import { KinesisStream } from "./.gen/providers/aws/kinesis-stream";
+import { PinpointApp } from "./.gen/providers/aws/pinpoint-app";
+import { PinpointEventStream } from "./.gen/providers/aws/pinpoint-event-stream";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const testStream = new KinesisStream(this, "test_stream", {
+      name: "pinpoint-kinesis-test",
+      shardCount: 1,
+    });
+    const app = new PinpointApp(this, "app", {});
+    const assumeRole = new DataAwsIamPolicyDocument(this, "assume_role", {
+      statement: [
+        {
+          actions: ["sts:AssumeRole"],
+          effect: "Allow",
+          principals: [
+            {
+              identifiers: ["pinpoint.us-east-1.amazonaws.com"],
+              type: "Service",
+            },
+          ],
+        },
+      ],
+    });
+    const testRolePolicy = new DataAwsIamPolicyDocument(
+      this,
+      "test_role_policy",
+      {
+        statement: [
+          {
+            actions: ["kinesis:PutRecords", "kinesis:DescribeStream"],
+            effect: "Allow",
+            resources: ["arn:aws:kinesis:us-east-1:*:*/*"],
+          },
+        ],
+      }
+    );
+    const testRole = new IamRole(this, "test_role", {
+      assumeRolePolicy: Token.asString(assumeRole.json),
+    });
+    const awsIamRolePolicyTestRolePolicy = new IamRolePolicy(
+      this,
+      "test_role_policy_5",
+      {
+        name: "test_policy",
+        policy: Token.asString(testRolePolicy.json),
+        role: testRole.id,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamRolePolicyTestRolePolicy.overrideLogicalId("test_role_policy");
+    new PinpointEventStream(this, "stream", {
+      applicationId: app.applicationId,
+      destinationStreamArn: testStream.arn,
+      roleArn: testRole.arn,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `applicationId` - (Required) The application ID.
+* `destinationStreamArn` - (Required) The Amazon Resource Name (ARN) of the Amazon Kinesis stream or Firehose delivery stream to which you want to publish events.
+* `roleArn` - (Required) The IAM role that authorizes Amazon Pinpoint to publish events to the stream in your account.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Pinpoint Event Stream using the `applicationId`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Pinpoint Event Stream using the `applicationId`. For example:
+
+```console
+% terraform import aws_pinpoint_event_stream.stream application-id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-781c351d9404f1abba2f962888a231281d00739d19baa3253947f07c74cba124 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/pinpoint_gcm_channel.html.markdown b/website/docs/cdktf/typescript/r/pinpoint_gcm_channel.html.markdown
new file mode 100644
index 00000000000..a1e0ac8f026
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/pinpoint_gcm_channel.html.markdown
@@ -0,0 +1,77 @@
+---
+subcategory: "Pinpoint"
+layout: "aws"
+page_title: "AWS: aws_pinpoint_gcm_channel"
+description: |-
+  Provides a Pinpoint GCM Channel resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_pinpoint_gcm_channel
+
+Provides a Pinpoint GCM Channel resource.
+
+~> **Note:** Api Key argument will be stored in the raw state as plain-text.
+[Read more about sensitive data in state](https://www.terraform.io/docs/state/sensitive-data.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { PinpointApp } from "./.gen/providers/aws/pinpoint-app";
+import { PinpointGcmChannel } from "./.gen/providers/aws/pinpoint-gcm-channel";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const app = new PinpointApp(this, "app", {});
+    new PinpointGcmChannel(this, "gcm", {
+      apiKey: "api_key",
+      applicationId: app.applicationId,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `applicationId` - (Required) The application ID.
+* `apiKey` - (Required) Platform credential API key from Google.
+* `enabled` - (Optional) Whether the channel is enabled or disabled. Defaults to `true`.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Pinpoint GCM Channel using the `applicationId`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Pinpoint GCM Channel using the `applicationId`. For example:
+
+```console
+% terraform import aws_pinpoint_gcm_channel.gcm application-id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-9d29303e7e3a9234396e32f826ea21b0d3e961ff30d693722c663578c7f20fd5 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/pinpoint_gcm_channel.markdown b/website/docs/cdktf/typescript/r/pinpoint_gcm_channel.markdown
new file mode 100644
index 00000000000..a1e0ac8f026
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/pinpoint_gcm_channel.markdown
@@ -0,0 +1,77 @@
+---
+subcategory: "Pinpoint"
+layout: "aws"
+page_title: "AWS: aws_pinpoint_gcm_channel"
+description: |-
+  Provides a Pinpoint GCM Channel resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_pinpoint_gcm_channel
+
+Provides a Pinpoint GCM Channel resource.
+
+~> **Note:** Api Key argument will be stored in the raw state as plain-text.
+[Read more about sensitive data in state](https://www.terraform.io/docs/state/sensitive-data.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { PinpointApp } from "./.gen/providers/aws/pinpoint-app";
+import { PinpointGcmChannel } from "./.gen/providers/aws/pinpoint-gcm-channel";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const app = new PinpointApp(this, "app", {});
+    new PinpointGcmChannel(this, "gcm", {
+      apiKey: "api_key",
+      applicationId: app.applicationId,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `applicationId` - (Required) The application ID.
+* `apiKey` - (Required) Platform credential API key from Google.
+* `enabled` - (Optional) Whether the channel is enabled or disabled. Defaults to `true`.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Pinpoint GCM Channel using the `applicationId`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Pinpoint GCM Channel using the `applicationId`. For example:
+
+```console
+% terraform import aws_pinpoint_gcm_channel.gcm application-id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-9d29303e7e3a9234396e32f826ea21b0d3e961ff30d693722c663578c7f20fd5 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/pinpoint_sms_channel.html.markdown b/website/docs/cdktf/typescript/r/pinpoint_sms_channel.html.markdown
new file mode 100644
index 00000000000..08ed941e2ed
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/pinpoint_sms_channel.html.markdown
@@ -0,0 +1,77 @@
+---
+subcategory: "Pinpoint"
+layout: "aws"
+page_title: "AWS: aws_pinpoint_sms_channel"
+description: |-
+  Use the `awsPinpointSmsChannel` resource to manage Pinpoint SMS Channels.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_pinpoint_sms_channel
+
+Use the `awsPinpointSmsChannel` resource to manage Pinpoint SMS Channels.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { PinpointApp } from "./.gen/providers/aws/pinpoint-app";
+import { PinpointSmsChannel } from "./.gen/providers/aws/pinpoint-sms-channel";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const app = new PinpointApp(this, "app", {});
+    new PinpointSmsChannel(this, "sms", {
+      applicationId: app.applicationId,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `applicationId` - (Required) ID of the application.
+* `enabled` - (Optional) Whether the channel is enabled or disabled. By default, it is set to `true`.
+* `senderId` - (Optional) Identifier of the sender for your messages.
+* `shortCode` - (Optional) Short Code registered with the phone provider.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `promotionalMessagesPerSecond` - Maximum number of promotional messages that can be sent per second.
+* `transactionalMessagesPerSecond` - Maximum number of transactional messages per second that can be sent.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import the Pinpoint SMS Channel using the `applicationId`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import the Pinpoint SMS Channel using the `applicationId`. For example:
+
+```console
+% terraform import aws_pinpoint_sms_channel.sms application-id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ea56c3123c88d22610a676fad9316e38ebe652689672bf9c9b82ddae2c457e61 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/pinpoint_sms_channel.markdown b/website/docs/cdktf/typescript/r/pinpoint_sms_channel.markdown
new file mode 100644
index 00000000000..08ed941e2ed
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/pinpoint_sms_channel.markdown
@@ -0,0 +1,77 @@
+---
+subcategory: "Pinpoint"
+layout: "aws"
+page_title: "AWS: aws_pinpoint_sms_channel"
+description: |-
+  Use the `awsPinpointSmsChannel` resource to manage Pinpoint SMS Channels.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_pinpoint_sms_channel
+
+Use the `awsPinpointSmsChannel` resource to manage Pinpoint SMS Channels.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { PinpointApp } from "./.gen/providers/aws/pinpoint-app";
+import { PinpointSmsChannel } from "./.gen/providers/aws/pinpoint-sms-channel";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const app = new PinpointApp(this, "app", {});
+    new PinpointSmsChannel(this, "sms", {
+      applicationId: app.applicationId,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `applicationId` - (Required) ID of the application.
+* `enabled` - (Optional) Whether the channel is enabled or disabled. By default, it is set to `true`.
+* `senderId` - (Optional) Identifier of the sender for your messages.
+* `shortCode` - (Optional) Short Code registered with the phone provider.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `promotionalMessagesPerSecond` - Maximum number of promotional messages that can be sent per second.
+* `transactionalMessagesPerSecond` - Maximum number of transactional messages per second that can be sent.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import the Pinpoint SMS Channel using the `applicationId`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import the Pinpoint SMS Channel using the `applicationId`. For example:
+
+```console
+% terraform import aws_pinpoint_sms_channel.sms application-id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ea56c3123c88d22610a676fad9316e38ebe652689672bf9c9b82ddae2c457e61 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/pipes_pipe.html.markdown b/website/docs/cdktf/typescript/r/pipes_pipe.html.markdown
new file mode 100644
index 00000000000..87011f3a116
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/pipes_pipe.html.markdown
@@ -0,0 +1,620 @@
+---
+subcategory: "EventBridge Pipes"
+layout: "aws"
+page_title: "AWS: aws_pipes_pipe"
+description: |-
+  Terraform resource for managing an AWS EventBridge Pipes Pipe.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_pipes_pipe
+
+Terraform resource for managing an AWS EventBridge Pipes Pipe.
+
+You can find out more about EventBridge Pipes in the [User Guide](https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-pipes.html).
+
+EventBridge Pipes are very configurable, and may require IAM permissions to work correctly. More information on the configuration options and IAM permissions can be found in the [User Guide](https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-pipes.html).
+
+~> **Note:** EventBridge was formerly known as CloudWatch Events. The functionality is identical.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCallerIdentity } from "./.gen/providers/aws/data-aws-caller-identity";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+import { IamRolePolicy } from "./.gen/providers/aws/iam-role-policy";
+import { PipesPipe } from "./.gen/providers/aws/pipes-pipe";
+import { SqsQueue } from "./.gen/providers/aws/sqs-queue";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const source = new SqsQueue(this, "source", {});
+    const target = new SqsQueue(this, "target", {});
+    const main = new DataAwsCallerIdentity(this, "main", {});
+    const example = new IamRole(this, "example", {
+      assumeRolePolicy: Token.asString(
+        Fn.jsonencode({
+          Statement: {
+            Action: "sts:AssumeRole",
+            Condition: {
+              StringEquals: {
+                "aws:SourceAccount": main.accountId,
+              },
+            },
+            Effect: "Allow",
+            Principal: {
+              Service: "pipes.amazonaws.com",
+            },
+          },
+          Version: "2012-10-17",
+        })
+      ),
+    });
+    const awsIamRolePolicySource = new IamRolePolicy(this, "source_4", {
+      policy: Token.asString(
+        Fn.jsonencode({
+          Statement: [
+            {
+              Action: [
+                "sqs:DeleteMessage",
+                "sqs:GetQueueAttributes",
+                "sqs:ReceiveMessage",
+              ],
+              Effect: "Allow",
+              Resource: [source.arn],
+            },
+          ],
+          Version: "2012-10-17",
+        })
+      ),
+      role: example.id,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamRolePolicySource.overrideLogicalId("source");
+    const awsIamRolePolicyTarget = new IamRolePolicy(this, "target_5", {
+      policy: Token.asString(
+        Fn.jsonencode({
+          Statement: [
+            {
+              Action: ["sqs:SendMessage"],
+              Effect: "Allow",
+              Resource: [target.arn],
+            },
+          ],
+          Version: "2012-10-17",
+        })
+      ),
+      role: example.id,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamRolePolicyTarget.overrideLogicalId("target");
+    const awsPipesPipeExample = new PipesPipe(this, "example_6", {
+      dependsOn: [awsIamRolePolicySource, awsIamRolePolicyTarget],
+      name: "example-pipe",
+      roleArn: example.arn,
+      source: source.arn,
+      target: target.arn,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsPipesPipeExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### Enrichment Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { PipesPipe } from "./.gen/providers/aws/pipes-pipe";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new PipesPipe(this, "example", {
+      enrichment: Token.asString(awsCloudwatchEventApiDestinationExample.arn),
+      enrichmentParameters: {
+        httpParameters: {
+          headerParameters: {
+            "example-header": "example-value",
+            "second-example-header": "second-example-value",
+          },
+          pathParameterValues: ["example-path-param"],
+          queryStringParameters: {
+            "example-query-string": "example-value",
+            "second-example-query-string": "second-example-value",
+          },
+        },
+      },
+      name: "example-pipe",
+      roleArn: Token.asString(awsIamRoleExample.arn),
+      source: source.arn,
+      target: target.arn,
+    });
+  }
+}
+
+```
+
+### Filter Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, Fn, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { PipesPipe } from "./.gen/providers/aws/pipes-pipe";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new PipesPipe(this, "example", {
+      name: "example-pipe",
+      roleArn: Token.asString(awsIamRoleExample.arn),
+      source: source.arn,
+      sourceParameters: {
+        filterCriteria: {
+          filter: [
+            {
+              pattern: Token.asString(
+                Fn.jsonencode({
+                  source: ["event-source"],
+                })
+              ),
+            },
+          ],
+        },
+      },
+      target: target.arn,
+    });
+  }
+}
+
+```
+
+### SQS Source and Target Configuration Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { PipesPipe } from "./.gen/providers/aws/pipes-pipe";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new PipesPipe(this, "example", {
+      name: "example-pipe",
+      roleArn: Token.asString(awsIamRoleExample.arn),
+      source: source.arn,
+      sourceParameters: {
+        sqsQueueParameters: {
+          batchSize: 1,
+          maximumBatchingWindowInSeconds: 2,
+        },
+      },
+      target: target.arn,
+      targetParameters: {
+        sqs_queue: [
+          {
+            message_deduplication_id: "example-dedupe",
+            message_group_id: "example-group",
+          },
+        ],
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `roleArn` - (Required) ARN of the role that allows the pipe to send data to the target.
+* `source` - (Required) Source resource of the pipe (typically an ARN).
+* `target` - (Required) Target resource of the pipe (typically an ARN).
+
+The following arguments are optional:
+
+* `description` - (Optional) A description of the pipe. At most 512 characters.
+* `desiredState` - (Optional) The state the pipe should be in. One of: `running`, `stopped`.
+* `enrichment` - (Optional) Enrichment resource of the pipe (typically an ARN). Read more about enrichment in the [User Guide](https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-pipes.html#pipes-enrichment).
+* `enrichmentParameters` - (Optional) Parameters to configure enrichment for your pipe. Detailed below.
+* `name` - (Optional) Name of the pipe. If omitted, Terraform will assign a random, unique name. Conflicts with `namePrefix`.
+* `namePrefix` - (Optional) Creates a unique name beginning with the specified prefix. Conflicts with `name`.
+* `sourceParameters` - (Optional) Parameters to configure a source for the pipe. Detailed below.
+* `targetParameters` - (Optional) Parameters to configure a target for your pipe. Detailed below.
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`defaultTags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### enrichment_parameters Configuration Block
+
+You can find out more about EventBridge Pipes Enrichment in the [User Guide](https://docs.aws.amazon.com/eventbridge/latest/userguide/pipes-enrichment.html).
+
+* `inputTemplate` - (Optional) Valid JSON text passed to the target. In this case, nothing from the event itself is passed to the target. Maximum length of 8192 characters.
+* `httpParameters` - (Optional) Contains the HTTP parameters to use when the target is a API Gateway REST endpoint or EventBridge ApiDestination. If you specify an API Gateway REST API or EventBridge ApiDestination as a target, you can use this parameter to specify headers, path parameters, and query string keys/values as part of your target invoking request. If you're using ApiDestinations, the corresponding Connection can also have these values configured. In case of any conflicting keys, values from the Connection take precedence. Detailed below.
+
+#### enrichment_parameters.http_parameters Configuration Block
+
+* `headerParameters` - (Optional) Key-value mapping of the headers that need to be sent as part of request invoking the API Gateway REST API or EventBridge ApiDestination.
+* `pathParameterValues` - (Optional) The path parameter values to be used to populate API Gateway REST API or EventBridge ApiDestination path wildcards ("*").
+* `queryStringParameters` - (Optional) Key-value mapping of the query strings that need to be sent as part of request invoking the API Gateway REST API or EventBridge ApiDestination.
+
+### source_parameters Configuration Block
+
+You can find out more about EventBridge Pipes Sources in the [User Guide](https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-pipes-event-source.html).
+
+* `activemqBrokerParameters` - (Optional) The parameters for using an Active MQ broker as a source. Detailed below.
+* `dynamodbStreamParameters` - (Optional) The parameters for using a DynamoDB stream as a source.  Detailed below.
+* `filterCriteria` - (Optional) The collection of event patterns used to [filter events](https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-pipes-event-filtering.html). Detailed below.
+* `kinesisStreamParameters` - (Optional) The parameters for using a Kinesis stream as a source. Detailed below.
+* `managedStreamingKafkaParameters` - (Optional) The parameters for using an MSK stream as a source. Detailed below.
+* `rabbitmqBrokerParameters` - (Optional) The parameters for using a Rabbit MQ broker as a source. Detailed below.
+* `selfManagedKafkaParameters` - (Optional) The parameters for using a self-managed Apache Kafka stream as a source. Detailed below.
+* `sqsQueueParameters` - (Optional) The parameters for using a Amazon SQS stream as a source. Detailed below.
+
+#### source_parameters.filter_criteria Configuration Block
+
+* `filter` - (Optional) An array of up to 5 event patterns. Detailed below.
+
+##### source_parameters.filter_criteria.filter Configuration Block
+
+* `pattern` - (Required) The event pattern. At most 4096 characters.
+
+#### source_parameters.activemq_broker_parameters Configuration Block
+
+* `batchSize` - (Optional) The maximum number of records to include in each batch. Maximum value of 10000.
+* `credentials` - (Required) The credentials needed to access the resource. Detailed below.
+* `maximumBatchingWindowInSeconds` - (Optional) The maximum length of a time to wait for events. Maximum value of 300.
+* `queueName` - (Required) The name of the destination queue to consume. Maximum length of 1000.
+
+##### source_parameters.activemq_broker_parameters.credentials Configuration Block
+
+* `basicAuth` - (Required) The ARN of the Secrets Manager secret containing the basic auth credentials.
+
+#### source_parameters.dynamodb_stream_parameters Configuration Block
+
+* `batchSize` - (Optional) The maximum number of records to include in each batch. Maximum value of 10000.
+* `deadLetterConfig` - (Optional) Define the target queue to send dead-letter queue events to. Detailed below.
+* `maximumBatchingWindowInSeconds` - (Optional) The maximum length of a time to wait for events. Maximum value of 300.
+* `maximumRecordAgeInSeconds` - (Optional) Discard records older than the specified age. The default value is -1, which sets the maximum age to infinite. When the value is set to infinite, EventBridge never discards old records. Maximum value of 604,800.
+* `maximumRetryAttempts` - (Optional) Discard records after the specified number of retries. The default value is -1, which sets the maximum number of retries to infinite. When MaximumRetryAttempts is infinite, EventBridge retries failed records until the record expires in the event source. Maximum value of 10,000.
+* `onPartialBatchItemFailure` - (Optional) Define how to handle item process failures. AUTOMATIC_BISECT halves each batch and retry each half until all the records are processed or there is one failed message left in the batch. Valid values: AUTOMATIC_BISECT.
+* `parallelizationFactor` - (Optional)The number of batches to process concurrently from each shard. The default value is 1. Maximum value of 10.
+* `startingPosition` - (Optional) The position in a stream from which to start reading. Valid values: TRIM_HORIZON, LATEST.
+
+##### source_parameters.dynamodb_stream_parameters.dead_letter_config Configuration Block
+
+* `arn` - (Optional) The ARN of the Amazon SQS queue specified as the target for the dead-letter queue.
+
+#### source_parameters.kinesis_stream_parameters Configuration Block
+
+* `batchSize` - (Optional) The maximum number of records to include in each batch. Maximum value of 10000.
+* `deadLetterConfig` - (Optional) Define the target queue to send dead-letter queue events to. Detailed below.
+* `maximumBatchingWindowInSeconds` - (Optional) The maximum length of a time to wait for events. Maximum value of 300.
+* `maximumRecordAgeInSeconds` - (Optional) Discard records older than the specified age. The default value is -1, which sets the maximum age to infinite. When the value is set to infinite, EventBridge never discards old records. Maximum value of 604,800.
+* `maximumRetryAttempts` - (Optional) Discard records after the specified number of retries. The default value is -1, which sets the maximum number of retries to infinite. When MaximumRetryAttempts is infinite, EventBridge retries failed records until the record expires in the event source. Maximum value of 10,000.
+* `onPartialBatchItemFailure` - (Optional) Define how to handle item process failures. AUTOMATIC_BISECT halves each batch and retry each half until all the records are processed or there is one failed message left in the batch. Valid values: AUTOMATIC_BISECT.
+* `parallelizationFactor` - (Optional)The number of batches to process concurrently from each shard. The default value is 1. Maximum value of 10.
+* `startingPosition` - (Required) The position in a stream from which to start reading. Valid values: TRIM_HORIZON, LATEST, AT_TIMESTAMP.
+* `startingPositionTimestamp` - (Optional) With StartingPosition set to AT_TIMESTAMP, the time from which to start reading, in Unix time seconds.
+
+##### source_parameters.kinesis_stream_parameters.dead_letter_config Configuration Block
+
+* `arn` - (Optional) The ARN of the Amazon SQS queue specified as the target for the dead-letter queue.
+
+#### source_parameters.managed_streaming_kafka_parameters Configuration Block
+
+* `batchSize` - (Optional) The maximum number of records to include in each batch. Maximum value of 10000.
+* `consumerGroupId` - (Optional) The name of the destination queue to consume. Maximum value of 200.
+* `credentials` - (Optional) The credentials needed to access the resource. Detailed below.
+* `maximumBatchingWindowInSeconds` - (Optional) The maximum length of a time to wait for events. Maximum value of 300.
+* `startingPosition` - (Optional) The position in a stream from which to start reading. Valid values: TRIM_HORIZON, LATEST.
+* `topicName` - (Required) The name of the topic that the pipe will read from. Maximum length of 249.
+
+##### source_parameters.managed_streaming_kafka_parameters.credentials Configuration Block
+
+* `clientCertificateTlsAuth` - (Optional) The ARN of the Secrets Manager secret containing the credentials.
+* `saslScram512Auth` - (Optional) The ARN of the Secrets Manager secret containing the credentials.
+
+#### source_parameters.rabbitmq_broker_parameters Configuration Block
+
+* `batchSize` - (Optional) The maximum number of records to include in each batch. Maximum value of 10000.
+* `credentials` - (Required) The credentials needed to access the resource. Detailed below.
+* `maximumBatchingWindowInSeconds` - (Optional) The maximum length of a time to wait for events. Maximum value of 300.
+* `queueName` - (Required) The name of the destination queue to consume. Maximum length of 1000.
+* `virtualHost` - (Optional) The name of the virtual host associated with the source broker. Maximum length of 200.
+
+##### source_parameters.rabbitmq_broker_parameters.credentials Configuration Block
+
+* `basicAuth` - (Required) The ARN of the Secrets Manager secret containing the credentials.
+
+#### source_parameters.self_managed_kafka_parameters Configuration Block
+
+* `additionalBootstrapServers` - (Optional) An array of server URLs. Maximum number of 2 items, each of maximum length 300.
+* `batchSize` - (Optional) The maximum number of records to include in each batch. Maximum value of 10000.
+* `consumerGroupId` - (Optional) The name of the destination queue to consume. Maximum value of 200.
+* `credentials` - (Optional) The credentials needed to access the resource. Detailed below.
+* `maximumBatchingWindowInSeconds` - (Optional) The maximum length of a time to wait for events. Maximum value of 300.
+* `serverRootCaCertificate` - (Optional) The ARN of the Secrets Manager secret used for certification.
+* `startingPosition` - (Optional) The position in a stream from which to start reading. Valid values: TRIM_HORIZON, LATEST.
+* `topicName` - (Required) The name of the topic that the pipe will read from. Maximum length of 249.
+* `vpc` - (Optional) This structure specifies the VPC subnets and security groups for the stream, and whether a public IP address is to be used. Detailed below.
+
+##### source_parameters.self_managed_kafka_parameters.credentials Configuration Block
+
+* `basicAuth` - (Optional) The ARN of the Secrets Manager secret containing the credentials.
+* `clientCertificateTlsAuth` - (Optional) The ARN of the Secrets Manager secret containing the credentials.
+* `saslScram256Auth` - (Optional) The ARN of the Secrets Manager secret containing the credentials.
+* `saslScram512Auth` - (Optional) The ARN of the Secrets Manager secret containing the credentials.
+
+##### source_parameters.self_managed_kafka_parameters.vpc Configuration Block
+
+* `securityGroups` - (Optional) List of security groups associated with the stream. These security groups must all be in the same VPC. You can specify as many as five security groups. If you do not specify a security group, the default security group for the VPC is used.
+* `subnets` - (Optional) List of the subnets associated with the stream. These subnets must all be in the same VPC. You can specify as many as 16 subnets.
+
+#### source_parameters.sqs_queue_parameters Configuration Block
+
+* `batchSize` - (Optional) The maximum number of records to include in each batch. Maximum value of 10000.
+* `maximumBatchingWindowInSeconds` - (Optional) The maximum length of a time to wait for events. Maximum value of 300.
+
+### target_parameters Configuration Block
+
+You can find out more about EventBridge Pipes Targets in the [User Guide](https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-pipes-event-target.html).
+
+* `batchJobParameters` - (Optional) The parameters for using an AWS Batch job as a target. Detailed below.
+* `cloudwatchLogsParameters` - (Optional) The parameters for using an CloudWatch Logs log stream as a target. Detailed below.
+* `ecsTaskParameters` - (Optional) The parameters for using an Amazon ECS task as a target. Detailed below.
+* `eventbridgeEventBusParameters` - (Optional) The parameters for using an EventBridge event bus as a target. Detailed below.
+* `httpParameters` - (Optional) These are custom parameter to be used when the target is an API Gateway REST APIs or EventBridge ApiDestinations. Detailed below.
+* `inputTemplate` - (Optional) Valid JSON text passed to the target. In this case, nothing from the event itself is passed to the target. Maximum length of 8192 characters.
+* `kinesisStreamParameters` - (Optional) The parameters for using a Kinesis stream as a source. Detailed below.
+* `lambdaFunctionParameters` - (Optional) The parameters for using a Lambda function as a target. Detailed below.
+* `redshiftDataParameters` - (Optional) These are custom parameters to be used when the target is a Amazon Redshift cluster to invoke the Amazon Redshift Data API BatchExecuteStatement. Detailed below.
+* `sagemakerPipelineParameters` - (Optional) The parameters for using a SageMaker pipeline as a target. Detailed below.
+* `sqsQueueParameters` - (Optional) The parameters for using a Amazon SQS stream as a target. Detailed below.
+* `stepFunctionStateMachineParameters` - (Optional) The parameters for using a Step Functions state machine as a target. Detailed below.
+
+#### target_parameters.batch_job_parameters Configuration Block
+
+* `arrayProperties` - (Optional) The array properties for the submitted job, such as the size of the array. The array size can be between 2 and 10,000. If you specify array properties for a job, it becomes an array job. This parameter is used only if the target is an AWS Batch job. Detailed below.
+* `containerOverrides` - (Optional) The overrides that are sent to a container. Detailed below.
+* `dependsOn` - (Optional) A list of dependencies for the job. A job can depend upon a maximum of 20 jobs. You can specify a SEQUENTIAL type dependency without specifying a job ID for array jobs so that each child array job completes sequentially, starting at index 0. You can also specify an N_TO_N type dependency with a job ID for array jobs. In that case, each index child of this job must wait for the corresponding index child of each dependency to complete before it can begin. Detailed below.
+* `jobDefinition` - (Required) The job definition used by this job. This value can be one of name, name:revision, or the Amazon Resource Name (ARN) for the job definition. If name is specified without a revision then the latest active revision is used.
+* `jobName` - (Required) The name of the job. It can be up to 128 letters long.
+* `parameters` - (Optional) Additional parameters passed to the job that replace parameter substitution placeholders that are set in the job definition. Parameters are specified as a key and value pair mapping. Parameters included here override any corresponding parameter defaults from the job definition. Detailed below.
+* `retryStrategy` - (Optional) The retry strategy to use for failed jobs. When a retry strategy is specified here, it overrides the retry strategy defined in the job definition. Detailed below.
+
+##### target_parameters.batch_job_parameters.array_properties Configuration Block
+
+* `size` - (Optional) The size of the array, if this is an array batch job. Minimum value of 2. Maximum value of 10,000.
+
+##### target_parameters.batch_job_parameters.container_overrides Configuration Block
+
+* `command` - (Optional) List of commands to send to the container that overrides the default command from the Docker image or the task definition.
+* `environment` - (Optional) The environment variables to send to the container. You can add new environment variables, which are added to the container at launch, or you can override the existing environment variables from the Docker image or the task definition. Environment variables cannot start with " AWS Batch ". This naming convention is reserved for variables that AWS Batch sets. Detailed below.
+* `instanceType` - (Optional) The instance type to use for a multi-node parallel job. This parameter isn't applicable to single-node container jobs or jobs that run on Fargate resources, and shouldn't be provided.
+* `resourceRequirement` - (Optional) The type and amount of resources to assign to a container. This overrides the settings in the job definition. The supported resources include GPU, MEMORY, and VCPU. Detailed below.
+
+###### target_parameters.batch_job_parameters.container_overrides.environment Configuration Block
+
+* `name` - (Optional) The name of the key-value pair. For environment variables, this is the name of the environment variable.
+* `value` - (Optional) The value of the key-value pair. For environment variables, this is the value of the environment variable.
+
+###### target_parameters.batch_job_parameters.container_overrides.resource_requirement Configuration Block
+
+* `type` - (Optional) The type of resource to assign to a container. The supported resources include GPU, MEMORY, and VCPU.
+* `value` - (Optional) The quantity of the specified resource to reserve for the container. [The values vary based on the type specified](https://docs.aws.amazon.com/eventbridge/latest/pipes-reference/API_BatchResourceRequirement.html).
+
+##### target_parameters.batch_job_parameters.depends_on Configuration Block
+
+* `jobId` - (Optional) The job ID of the AWS Batch job that's associated with this dependency.
+* `type` - (Optional) The type of the job dependency. Valid Values: N_TO_N, SEQUENTIAL.
+
+##### target_parameters.batch_job_parameters.retry_strategy Configuration Block
+
+* `attempts` - (Optional) The number of times to move a job to the RUNNABLE status. If the value of attempts is greater than one, the job is retried on failure the same number of attempts as the value. Maximum value of 10.
+
+#### target_parameters.cloudwatch_logs_parameters Configuration Block
+
+* `logStreamName` - (Optional) The name of the log stream.
+* `timestamp` - (Optional) The time the event occurred, expressed as the number of milliseconds after Jan 1, 1970 00:00:00 UTC. This is the JSON path to the field in the event e.g. $.detail.timestamp
+
+#### target_parameters.ecs_task_parameters Configuration Block
+
+* `capacityProviderStrategy` - (Optional) List of capacity provider strategies to use for the task. If a capacityProviderStrategy is specified, the launchType parameter must be omitted. If no capacityProviderStrategy or launchType is specified, the defaultCapacityProviderStrategy for the cluster is used. Detailed below.
+* `enableEcsManagedTags` - (Optional) Specifies whether to enable Amazon ECS managed tags for the task. Valid values: true, false.
+* `enableExecuteCommand` - (Optional) Whether or not to enable the execute command functionality for the containers in this task. If true, this enables execute command functionality on all containers in the task. Valid values: true, false.
+* `group` - (Optional) Specifies an Amazon ECS task group for the task. The maximum length is 255 characters.
+* `launchType` - (Optional) Specifies the launch type on which your task is running. The launch type that you specify here must match one of the launch type (compatibilities) of the target task. The FARGATE value is supported only in the Regions where AWS Fargate with Amazon ECS is supported. Valid Values: EC2, FARGATE, EXTERNAL
+* `networkConfiguration` - (Optional) Use this structure if the Amazon ECS task uses the awsvpc network mode. This structure specifies the VPC subnets and security groups associated with the task, and whether a public IP address is to be used. This structure is required if LaunchType is FARGATE because the awsvpc mode is required for Fargate tasks. If you specify NetworkConfiguration when the target ECS task does not use the awsvpc network mode, the task fails. Detailed below.
+* `overrides` - (Optional) The overrides that are associated with a task. Detailed below.
+* `placementConstraint` - (Optional) An array of placement constraint objects to use for the task. You can specify up to 10 constraints per task (including constraints in the task definition and those specified at runtime). Detailed below.
+* `placementStrategy` - (Optional) The placement strategy objects to use for the task. You can specify a maximum of five strategy rules per task. Detailed below.
+* `platformVersion` - (Optional) Specifies the platform version for the task. Specify only the numeric portion of the platform version, such as 1.1.0. This structure is used only if LaunchType is FARGATE.
+* `propagateTags` - (Optional) Specifies whether to propagate the tags from the task definition to the task. If no value is specified, the tags are not propagated. Tags can only be propagated to the task during task creation. To add tags to a task after task creation, use the TagResource API action. Valid Values: TASK_DEFINITION
+* `referenceId` - (Optional) The reference ID to use for the task. Maximum length of 1,024.
+* `tags` - (Optional) Key-value map of tags that you apply to the task to help you categorize and organize them.
+* `taskCount` - (Optional) The number of tasks to create based on TaskDefinition. The default is 1.
+* `taskDefinitionArn` - (Optional) The ARN of the task definition to use if the event target is an Amazon ECS task.
+
+##### target_parameters.ecs_task_parameters.capacity_provider_strategy Configuration Block
+
+* `base` - (Optional) The base value designates how many tasks, at a minimum, to run on the specified capacity provider. Only one capacity provider in a capacity provider strategy can have a base defined. If no value is specified, the default value of 0 is used. Maximum value of 100,000.
+* `capacityProvider` - (Optional) The short name of the capacity provider. Maximum value of 255.
+* `weight` - (Optional) The weight value designates the relative percentage of the total number of tasks launched that should use the specified capacity provider. The weight value is taken into consideration after the base value, if defined, is satisfied. Maximum value of 1,000.
+
+##### target_parameters.ecs_task_parameters.network_configuration Configuration Block
+
+* `awsVpcConfiguration` - (Optional) Use this structure to specify the VPC subnets and security groups for the task, and whether a public IP address is to be used. This structure is relevant only for ECS tasks that use the awsvpc network mode. Detailed below.
+
+###### target_parameters.ecs_task_parameters.network_configuration.aws_vpc_configuration Configuration Block
+
+* `assignPublicIp` - (Optional) Specifies whether the task's elastic network interface receives a public IP address. You can specify ENABLED only when LaunchType in EcsParameters is set to FARGATE. Valid Values: ENABLED, DISABLED.
+* `securityGroups` - (Optional) Specifies the security groups associated with the task. These security groups must all be in the same VPC. You can specify as many as five security groups. If you do not specify a security group, the default security group for the VPC is used.
+* `subnets` - (Optional) Specifies the subnets associated with the task. These subnets must all be in the same VPC. You can specify as many as 16 subnets.
+
+##### target_parameters.ecs_task_parameters.overrides Configuration Block
+
+* `containerOverride` - (Optional) One or more container overrides that are sent to a task. Detailed below.
+* `cpu` - (Optional) The cpu override for the task.
+* `ephemeralStorage` - (Optional) The ephemeral storage setting override for the task.  Detailed below.
+* `executionRoleArn` - (Optional) The Amazon Resource Name (ARN) of the task execution IAM role override for the task.
+* `inferenceAcceleratorOverride` - (Optional) List of Elastic Inference accelerator overrides for the task. Detailed below.
+* `memory` - (Optional) The memory override for the task.
+* `taskRoleArn` - (Optional) The Amazon Resource Name (ARN) of the IAM role that containers in this task can assume. All containers in this task are granted the permissions that are specified in this role.
+
+###### target_parameters.ecs_task_parameters.overrides.container_override Configuration Block
+
+* `command` - (Optional) List of commands to send to the container that overrides the default command from the Docker image or the task definition. You must also specify a container name.
+* `cpu` - (Optional) The number of cpu units reserved for the container, instead of the default value from the task definition. You must also specify a container name.
+* `environment` - (Optional) The environment variables to send to the container. You can add new environment variables, which are added to the container at launch, or you can override the existing environment variables from the Docker image or the task definition. You must also specify a container name. Detailed below.
+* `environmentFile` - (Optional) A list of files containing the environment variables to pass to a container, instead of the value from the container definition. Detailed below.
+* `memory` - (Optional) The hard limit (in MiB) of memory to present to the container, instead of the default value from the task definition. If your container attempts to exceed the memory specified here, the container is killed. You must also specify a container name.
+* `memoryReservation` - (Optional) The soft limit (in MiB) of memory to reserve for the container, instead of the default value from the task definition. You must also specify a container name.
+* `name` - (Optional) The name of the container that receives the override. This parameter is required if any override is specified.
+* `resourceRequirement` - (Optional) The type and amount of a resource to assign to a container, instead of the default value from the task definition. The only supported resource is a GPU. Detailed below.
+
+###### target_parameters.ecs_task_parameters.overrides.container_override.environment Configuration Block
+
+* `name` - (Optional) The name of the key-value pair. For environment variables, this is the name of the environment variable.
+* `value` - (Optional) The value of the key-value pair. For environment variables, this is the value of the environment variable.
+
+###### target_parameters.ecs_task_parameters.overrides.container_override.environment_file Configuration Block
+
+* `type` - (Optional) The file type to use. The only supported value is s3.
+* `value` - (Optional) The Amazon Resource Name (ARN) of the Amazon S3 object containing the environment variable file.
+
+###### target_parameters.ecs_task_parameters.overrides.container_override.resource_requirement Configuration Block
+
+* `type` - (Optional) The type of resource to assign to a container. The supported values are GPU or InferenceAccelerator.
+* `value` - (Optional) The value for the specified resource type. If the GPU type is used, the value is the number of physical GPUs the Amazon ECS container agent reserves for the container. The number of GPUs that's reserved for all containers in a task can't exceed the number of available GPUs on the container instance that the task is launched on. If the InferenceAccelerator type is used, the value matches the deviceName for an InferenceAccelerator specified in a task definition.
+
+###### target_parameters.ecs_task_parameters.overrides.ephemeral_storage Configuration Block
+
+* `sizeInGib` - (Required) The total amount, in GiB, of ephemeral storage to set for the task. The minimum supported value is 21 GiB and the maximum supported value is 200 GiB.
+
+###### target_parameters.ecs_task_parameters.overrides.inference_accelerator_override Configuration Block
+
+* `deviceName` - (Optional) The Elastic Inference accelerator device name to override for the task. This parameter must match a deviceName specified in the task definition.
+* `deviceType` - (Optional) The Elastic Inference accelerator type to use.
+
+##### target_parameters.ecs_task_parameters.placement_constraint Configuration Block
+
+* `expression` - (Optional) A cluster query language expression to apply to the constraint. You cannot specify an expression if the constraint type is distinctInstance. Maximum length of 2,000.
+* `type` - (Optional) The type of constraint. Use distinctInstance to ensure that each task in a particular group is running on a different container instance. Use memberOf to restrict the selection to a group of valid candidates. Valid Values: distinctInstance, memberOf.
+
+##### target_parameters.ecs_task_parameters.placement_strategy Configuration Block
+
+* `field` - (Optional) The field to apply the placement strategy against. For the spread placement strategy, valid values are instanceId (or host, which has the same effect), or any platform or custom attribute that is applied to a container instance, such as attribute:ecs.availability-zone. For the binpack placement strategy, valid values are cpu and memory. For the random placement strategy, this field is not used. Maximum length of 255.
+* `type` - (Optional) The type of placement strategy. The random placement strategy randomly places tasks on available candidates. The spread placement strategy spreads placement across available candidates evenly based on the field parameter. The binpack strategy places tasks on available candidates that have the least available amount of the resource that is specified with the field parameter. For example, if you binpack on memory, a task is placed on the instance with the least amount of remaining memory (but still enough to run the task). Valid Values: random, spread, binpack.
+
+#### target_parameters.eventbridge_event_bus_parameters Configuration Block
+
+* `detailType` - (Optional) A free-form string, with a maximum of 128 characters, used to decide what fields to expect in the event detail.
+* `endpointId` - (Optional) The URL subdomain of the endpoint. For example, if the URL for Endpoint is https://abcde.veo.endpoints.event.amazonaws.com, then the EndpointId is abcde.veo.
+* `resources` - (Optional) List of AWS resources, identified by Amazon Resource Name (ARN), which the event primarily concerns. Any number, including zero, may be present.
+* `source` - (Optional) The source of the event. Maximum length of 256.
+* `time` - (Optional) The time stamp of the event, per RFC3339. If no time stamp is provided, the time stamp of the PutEvents call is used. This is the JSON path to the field in the event e.g. $.detail.timestamp
+
+#### target_parameters.http_parameters Configuration Block
+
+* `headerParameters` - (Optional) Key-value mapping of the headers that need to be sent as part of request invoking the API Gateway REST API or EventBridge ApiDestination. Detailed below.
+* `pathParameterValues` - (Optional) The path parameter values to be used to populate API Gateway REST API or EventBridge ApiDestination path wildcards ("*").
+* `queryStringParameters` - (Optional) Key-value mapping of the query strings that need to be sent as part of request invoking the API Gateway REST API or EventBridge ApiDestination. Detailed below.
+
+#### target_parameters.kinesis_stream_parameters Configuration Block
+
+* `partitionKey` - (Required) Determines which shard in the stream the data record is assigned to. Partition keys are Unicode strings with a maximum length limit of 256 characters for each key. Amazon Kinesis Data Streams uses the partition key as input to a hash function that maps the partition key and associated data to a specific shard. Specifically, an MD5 hash function is used to map partition keys to 128-bit integer values and to map associated data records to shards. As a result of this hashing mechanism, all data records with the same partition key map to the same shard within the stream.
+
+#### target_parameters.lambda_function_parameters Configuration Block
+
+* `invocationType` - (Optional) Specify whether to invoke the function synchronously or asynchronously. Valid Values: REQUEST_RESPONSE, FIRE_AND_FORGET.
+
+#### target_parameters.redshift_data_parameters Configuration Block
+
+* `database` - (Required) The name of the database. Required when authenticating using temporary credentials.
+* `dbUser` - (Optional) The database user name. Required when authenticating using temporary credentials.
+* `secretManagerArn` - (Optional) The name or ARN of the secret that enables access to the database. Required when authenticating using Secrets Manager.
+* `sqls` - (Optional) List of SQL statements text to run, each of maximum length of 100,000.
+* `statementName` - (Optional) The name of the SQL statement. You can name the SQL statement when you create it to identify the query.
+* `withEvent` - (Optional) Indicates whether to send an event back to EventBridge after the SQL statement runs.
+
+#### target_parameters.sagemaker_pipeline_parameters Configuration Block
+
+* `pipelineParameter` - (Optional) List of Parameter names and values for SageMaker Model Building Pipeline execution. Detailed below.
+
+##### target_parameters.sagemaker_pipeline_parameters.parameters Configuration Block
+
+* `name` - (Optional) Name of parameter to start execution of a SageMaker Model Building Pipeline. Maximum length of 256.
+* `value` - (Optional) Value of parameter to start execution of a SageMaker Model Building Pipeline. Maximum length of 1024.
+
+#### target_parameters.sqs_queue_parameters Configuration Block
+
+* `messageDeduplicationId` - (Optional) This parameter applies only to FIFO (first-in-first-out) queues. The token used for deduplication of sent messages.
+* `messageGroupId` - (Optional) The FIFO message group ID to use as the target.
+
+#### target_parameters.step_function_state_machine_parameters Configuration Block
+
+* `invocationType` - (Optional) Specify whether to invoke the function synchronously or asynchronously. Valid Values: REQUEST_RESPONSE, FIRE_AND_FORGET.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of this pipe.
+* `id` - Same as `name`.
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `30M`)
+* `update` - (Default `30M`)
+* `delete` - (Default `30M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import pipes using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import pipes using the `name`. For example:
+
+```console
+% terraform import aws_pipes_pipe.example my-pipe
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1a860b54f52a7aaa05aba46c72e3c39fe95c80a585397250f041eb4e41a13d7f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/placement_group.html.markdown b/website/docs/cdktf/typescript/r/placement_group.html.markdown
new file mode 100644
index 00000000000..0c1d8fdb96d
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/placement_group.html.markdown
@@ -0,0 +1,83 @@
+---
+subcategory: "EC2 (Elastic Compute Cloud)"
+layout: "aws"
+page_title: "AWS: aws_placement_group"
+description: |-
+  Provides an EC2 placement group.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_placement_group
+
+Provides an EC2 placement group. Read more about placement groups
+in [AWS Docs](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/placement-groups.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { PlacementGroup } from "./.gen/providers/aws/placement-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new PlacementGroup(this, "web", {
+      name: "hunky-dory-pg",
+      strategy: "cluster",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the placement group.
+* `partitionCount` - (Optional) The number of partitions to create in the
+  placement group.  Can only be specified when the `strategy` is set to
+  `partition`.  Valid values are 1 - 7 (default is `2`).
+* `spreadLevel` - (Optional) Determines how placement groups spread instances. Can only be used
+   when the `strategy` is set to `spread`. Can be `host` or `rack`. `host` can only be used for Outpost placement groups. Defaults to `rack`.
+* `strategy` - (Required) The placement strategy. Can be `cluster`, `partition` or `spread`.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the placement group.
+* `id` - The name of the placement group.
+* `placementGroupId` - The ID of the placement group.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import placement groups using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import placement groups using the `name`. For example:
+
+```console
+% terraform import aws_placement_group.prod_pg production-placement-group
+```
+
+<!-- cache-key: cdktf-0.18.0 input-2db42e50344643d73d88a7291c495c78556f7f0f63349d8e602e23a0b1bdb180 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/prometheus_alert_manager_definition.html.markdown b/website/docs/cdktf/typescript/r/prometheus_alert_manager_definition.html.markdown
new file mode 100644
index 00000000000..3fcbcb9ff92
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/prometheus_alert_manager_definition.html.markdown
@@ -0,0 +1,77 @@
+---
+subcategory: "AMP (Managed Prometheus)"
+layout: "aws"
+page_title: "AWS: aws_prometheus_alert_manager_definition"
+description: |-
+  Manages an Amazon Managed Service for Prometheus (AMP) Alert Manager Definition
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_prometheus_alert_manager_definition
+
+Manages an Amazon Managed Service for Prometheus (AMP) Alert Manager Definition
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { PrometheusAlertManagerDefinition } from "./.gen/providers/aws/prometheus-alert-manager-definition";
+import { PrometheusWorkspace } from "./.gen/providers/aws/prometheus-workspace";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const demo = new PrometheusWorkspace(this, "demo", {});
+    const awsPrometheusAlertManagerDefinitionDemo =
+      new PrometheusAlertManagerDefinition(this, "demo_1", {
+        definition:
+          "alertmanager_config: |\n  route:\n    receiver: 'default'\n  receivers:\n    - name: 'default'\n\n",
+        workspaceId: demo.id,
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsPrometheusAlertManagerDefinitionDemo.overrideLogicalId("demo");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `workspaceId` - (Required) ID of the prometheus workspace the alert manager definition should be linked to
+* `definition` - (Required) the alert manager definition that you want to be applied. See more [in AWS Docs](https://docs.aws.amazon.com/prometheus/latest/userguide/AMP-alert-manager.html).
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import the prometheus alert manager definition using the workspace identifier. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import the prometheus alert manager definition using the workspace identifier. For example:
+
+```console
+% terraform import aws_prometheus_alert_manager_definition.demo ws-C6DCB907-F2D7-4D96-957B-66691F865D8B
+```
+
+<!-- cache-key: cdktf-0.18.0 input-6a4a52d7d4acb917f5c7ab057a46d8d09f6db1143f23bbfd0bbd195ab2a7b439 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/prometheus_rule_group_namespace.html.markdown b/website/docs/cdktf/typescript/r/prometheus_rule_group_namespace.html.markdown
new file mode 100644
index 00000000000..9075e0e959e
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/prometheus_rule_group_namespace.html.markdown
@@ -0,0 +1,78 @@
+---
+subcategory: "AMP (Managed Prometheus)"
+layout: "aws"
+page_title: "AWS: aws_prometheus_rule_group_namespace"
+description: |-
+  Manages an Amazon Managed Service for Prometheus (AMP) Rule Group Namespace
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_prometheus_rule_group_namespace
+
+Manages an Amazon Managed Service for Prometheus (AMP) Rule Group Namespace
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { PrometheusRuleGroupNamespace } from "./.gen/providers/aws/prometheus-rule-group-namespace";
+import { PrometheusWorkspace } from "./.gen/providers/aws/prometheus-workspace";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const demo = new PrometheusWorkspace(this, "demo", {});
+    const awsPrometheusRuleGroupNamespaceDemo =
+      new PrometheusRuleGroupNamespace(this, "demo_1", {
+        data: "groups:\n  - name: test\n    rules:\n    - record: metric:recording_rule\n      expr: avg(rate(container_cpu_usage_seconds_total[5m]))\n\n",
+        name: "rules",
+        workspaceId: demo.id,
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsPrometheusRuleGroupNamespaceDemo.overrideLogicalId("demo");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the rule group namespace
+* `workspaceId` - (Required) ID of the prometheus workspace the rule group namespace should be linked to
+* `data` - (Required) the rule group namespace data that you want to be applied. See more [in AWS Docs](https://docs.aws.amazon.com/prometheus/latest/userguide/AMP-Ruler.html).
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import the prometheus rule group namespace using the arn. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import the prometheus rule group namespace using the arn. For example:
+
+```console
+% terraform import aws_prometheus_rule_group_namespace.demo arn:aws:aps:us-west-2:123456789012:rulegroupsnamespace/IDstring/namespace_name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-4744fbde8b8a0aa11fdd4a09abcef647630425256c23ba232641a4e6fbd803ac -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/prometheus_workspace.html.markdown b/website/docs/cdktf/typescript/r/prometheus_workspace.html.markdown
new file mode 100644
index 00000000000..3571e422cf2
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/prometheus_workspace.html.markdown
@@ -0,0 +1,119 @@
+---
+subcategory: "AMP (Managed Prometheus)"
+layout: "aws"
+page_title: "AWS: aws_prometheus_workspace"
+description: |-
+  Manages an Amazon Managed Service for Prometheus (AMP) Workspace
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_prometheus_workspace
+
+Manages an Amazon Managed Service for Prometheus (AMP) Workspace.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { PrometheusWorkspace } from "./.gen/providers/aws/prometheus-workspace";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new PrometheusWorkspace(this, "example", {
+      alias: "example",
+      tags: {
+        Environment: "production",
+      },
+    });
+  }
+}
+
+```
+
+### CloudWatch Logging
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudwatchLogGroup } from "./.gen/providers/aws/cloudwatch-log-group";
+import { PrometheusWorkspace } from "./.gen/providers/aws/prometheus-workspace";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new CloudwatchLogGroup(this, "example", {
+      name: "example",
+    });
+    const awsPrometheusWorkspaceExample = new PrometheusWorkspace(
+      this,
+      "example_1",
+      {
+        loggingConfiguration: {
+          logGroupArn: "${" + example.arn + "}:*",
+        },
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsPrometheusWorkspaceExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `alias` - (Optional) The alias of the prometheus workspace. See more [in AWS Docs](https://docs.aws.amazon.com/prometheus/latest/userguide/AMP-onboard-create-workspace.html).
+* `loggingConfiguration` - (Optional) Logging configuration for the workspace. See [Logging Configuration](#logging-configuration) below for details.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Logging Configuration
+
+The `loggingConfiguration` block supports the following arguments:
+
+* `logGroupArn` - (Required) The ARN of the CloudWatch log group to which the vended log data will be published. This log group must exist.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the workspace.
+* `id` - Identifier of the workspace
+* `prometheusEndpoint` - Prometheus endpoint available for this workspace.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AMP Workspaces using the identifier. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import AMP Workspaces using the identifier. For example:
+
+```console
+% terraform import aws_prometheus_workspace.demo ws-C6DCB907-F2D7-4D96-957B-66691F865D8B
+```
+
+<!-- cache-key: cdktf-0.18.0 input-94364fd09dc8c162f82df7a4b9553955564416fc93204755b5fec4873553516a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/proxy_protocol_policy.html.markdown b/website/docs/cdktf/typescript/r/proxy_protocol_policy.html.markdown
new file mode 100644
index 00000000000..690d08aaf13
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/proxy_protocol_policy.html.markdown
@@ -0,0 +1,73 @@
+---
+subcategory: "ELB Classic"
+layout: "aws"
+page_title: "AWS: aws_proxy_protocol_policy"
+description: |-
+  Provides a proxy protocol policy, which allows an ELB to carry a client connection information to a backend.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_proxy_protocol_policy
+
+Provides a proxy protocol policy, which allows an ELB to carry a client connection information to a backend.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Elb } from "./.gen/providers/aws/elb";
+import { ProxyProtocolPolicy } from "./.gen/providers/aws/proxy-protocol-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const lb = new Elb(this, "lb", {
+      availabilityZones: ["us-east-1a"],
+      listener: [
+        {
+          instancePort: 25,
+          instanceProtocol: "tcp",
+          lbPort: 25,
+          lbProtocol: "tcp",
+        },
+        {
+          instancePort: 587,
+          instanceProtocol: "tcp",
+          lbPort: 587,
+          lbProtocol: "tcp",
+        },
+      ],
+      name: "test-lb",
+    });
+    new ProxyProtocolPolicy(this, "smtp", {
+      instancePorts: ["25", "587"],
+      loadBalancer: lb.name,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `loadBalancer` - (Required) The load balancer to which the policy
+  should be attached.
+* `instancePorts` - (Required) List of instance ports to which the policy
+  should be applied. This can be specified if the protocol is SSL or TCP.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the policy.
+* `loadBalancer` - The load balancer to which the policy is attached.
+
+<!-- cache-key: cdktf-0.18.0 input-09e9cd566d935abe3b4ff77b122a6204ff1a06eaa08a5a2dd8ec25b2cb1a5e20 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/qldb_ledger.html.markdown b/website/docs/cdktf/typescript/r/qldb_ledger.html.markdown
new file mode 100644
index 00000000000..cc0ab3162ef
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/qldb_ledger.html.markdown
@@ -0,0 +1,87 @@
+---
+subcategory: "QLDB (Quantum Ledger Database)"
+layout: "aws"
+page_title: "AWS: aws_qldb_ledger"
+description: |-
+  Provides an QLDB Resource resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_qldb_ledger
+
+Provides an AWS Quantum Ledger Database (QLDB) resource
+
+~> **NOTE:** Deletion protection is enabled by default. To successfully delete this resource via Terraform, `deletion_protection = false` must be applied before attempting deletion.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { QldbLedger } from "./.gen/providers/aws/qldb-ledger";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new QldbLedger(this, "sample-ledger", {
+      name: "sample-ledger",
+      permissionsMode: "STANDARD",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `deletionProtection` - (Optional) The deletion protection for the QLDB Ledger instance. By default it is `true`. To delete this resource via Terraform, this value must be configured to `false` and applied first before attempting deletion.
+* `kmsKey` - (Optional) The key in AWS Key Management Service (AWS KMS) to use for encryption of data at rest in the ledger. For more information, see the [AWS documentation](https://docs.aws.amazon.com/qldb/latest/developerguide/encryption-at-rest.html). Valid values are `"awsOwnedKmsKey"` to use an AWS KMS key that is owned and managed by AWS on your behalf, or the ARN of a valid symmetric customer managed KMS key.
+* `name` - (Optional) The friendly name for the QLDB Ledger instance. By default generated by Terraform.
+* `permissionsMode` - (Required) The permissions mode for the QLDB ledger instance. Specify either `allowAll` or `standard`.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Name of the QLDB Ledger
+* `arn` - The ARN of the QLDB Ledger
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `10M`)
+- `delete` - (Default `10M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import QLDB Ledgers using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import QLDB Ledgers using the `name`. For example:
+
+```console
+% terraform import aws_qldb_ledger.sample-ledger sample-ledger
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ce649e87d3aa63512d24a26f84548ecb8485e38743e2428127ead04a1c91c863 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/qldb_stream.html.markdown b/website/docs/cdktf/typescript/r/qldb_stream.html.markdown
new file mode 100644
index 00000000000..db8e90ab71b
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/qldb_stream.html.markdown
@@ -0,0 +1,82 @@
+---
+subcategory: "QLDB (Quantum Ledger Database)"
+layout: "aws"
+page_title: "AWS: aws_qldb_stream"
+description: |-
+  Provides a QLDB Stream resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_qldb_stream
+
+Provides an AWS Quantum Ledger Database (QLDB) Stream resource
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { QldbStream } from "./.gen/providers/aws/qldb-stream";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new QldbStream(this, "example", {
+      inclusiveStartTime: "2021-01-01T00:00:00Z",
+      kinesisConfiguration: {
+        aggregationEnabled: false,
+        streamArn:
+          "arn:aws:kinesis:us-east-1:xxxxxxxxxxxx:stream/example-kinesis-stream",
+      },
+      ledgerName: "existing-ledger-name",
+      roleArn: "sample-role-arn",
+      streamName: "sample-ledger-stream",
+      tags: {
+        example: "tag",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `exclusiveEndTime` - (Optional) The exclusive date and time that specifies when the stream ends. If you don't define this parameter, the stream runs indefinitely until you cancel it. It must be in ISO 8601 date and time format and in Universal Coordinated Time (UTC). For example: `"20190613T21:36:34Z"`.
+* `inclusiveStartTime` - (Required) The inclusive start date and time from which to start streaming journal data. This parameter must be in ISO 8601 date and time format and in Universal Coordinated Time (UTC). For example: `"20190613T21:36:34Z"`.  This cannot be in the future and must be before `exclusiveEndTime`.  If you provide a value that is before the ledger's `creationDateTime`, QLDB effectively defaults it to the ledger's `creationDateTime`.
+* `kinesisConfiguration` - (Required) The configuration settings of the Kinesis Data Streams destination for your stream request. Documented below.
+* `ledgerName` - (Required) The name of the QLDB ledger.
+* `roleArn` - (Required) The Amazon Resource Name (ARN) of the IAM role that grants QLDB permissions for a journal stream to write data records to a Kinesis Data Streams resource.
+* `streamName` - (Required) The name that you want to assign to the QLDB journal stream. User-defined names can help identify and indicate the purpose of a stream.  Your stream name must be unique among other active streams for a given ledger. Stream names have the same naming constraints as ledger names, as defined in the [Amazon QLDB Developer Guide](https://docs.aws.amazon.com/qldb/latest/developerguide/limits.html#limits.naming).
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### kinesis_configuration
+
+The `kinesisConfiguration` block supports the following arguments:
+
+* `aggregationEnabled` - (Optional) Enables QLDB to publish multiple data records in a single Kinesis Data Streams record, increasing the number of records sent per API call. Default: `true`.
+* `streamArn` - (Required) The Amazon Resource Name (ARN) of the Kinesis Data Streams resource.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the QLDB Stream.
+* `arn` - The ARN of the QLDB Stream.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `8M`)
+- `delete` - (Default `5M`)
+
+<!-- cache-key: cdktf-0.18.0 input-35ccfcf2d29f7f918b217c8f22a5948a35ed05cac3acbaacc55e0a1fd3e71f2a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/quicksight_account_subscription.html.markdown b/website/docs/cdktf/typescript/r/quicksight_account_subscription.html.markdown
new file mode 100644
index 00000000000..957fc56b41f
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/quicksight_account_subscription.html.markdown
@@ -0,0 +1,80 @@
+---
+subcategory: "QuickSight"
+layout: "aws"
+page_title: "AWS: aws_quicksight_account_subscription"
+description: |-
+  Terraform resource for managing an AWS QuickSight Account Subscription.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_quicksight_account_subscription
+
+Terraform resource for managing an AWS QuickSight Account Subscription.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { QuicksightAccountSubscription } from "./.gen/providers/aws/quicksight-account-subscription";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new QuicksightAccountSubscription(this, "subscription", {
+      accountName: "quicksight-terraform",
+      authenticationMethod: "IAM_AND_QUICKSIGHT",
+      edition: "ENTERPRISE",
+      notificationEmail: "notification@email.com",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `accountName` - (Required) Name of your Amazon QuickSight account. This name is unique over all of AWS, and it appears only when users sign in.
+* `authenticationMethod` - (Required) Method that you want to use to authenticate your Amazon QuickSight account. Currently, the valid values for this parameter are `iamAndQuicksight`, `iamOnly`, and `activeDirectory`.
+* `edition` - (Required) Edition of Amazon QuickSight that you want your account to have. Currently, you can choose from `standard`, `enterprise` or `enterpriseAndQ`.
+* `notificationEmail` - (Required) Email address that you want Amazon QuickSight to send notifications to regarding your Amazon QuickSight account or Amazon QuickSight subscription.
+
+The following arguments are optional:
+
+* `activeDirectoryName` - (Optional) Name of your Active Directory. This field is required if `activeDirectory` is the selected authentication method of the new Amazon QuickSight account.
+* `adminGroup` - (Optional) Admin group associated with your Active Directory. This field is required if `activeDirectory` is the selected authentication method of the new Amazon QuickSight account.
+* `authorGroup` - (Optional) Author group associated with your Active Directory.
+* `awsAccountId` - (Optional) AWS account ID hosting the QuickSight account. Default to provider account.
+* `contactNumber` - (Optional) A 10-digit phone number for the author of the Amazon QuickSight account to use for future communications. This field is required if `enterppriseAndQ` is the selected edition of the new Amazon QuickSight account.
+* `directoryId` - (Optional) Active Directory ID that is associated with your Amazon QuickSight account.
+* `emailAddress` - (Optional) Email address of the author of the Amazon QuickSight account to use for future communications. This field is required if `enterppriseAndQ` is the selected edition of the new Amazon QuickSight account.
+* `firstName` - (Optional) First name of the author of the Amazon QuickSight account to use for future communications. This field is required if `enterppriseAndQ` is the selected edition of the new Amazon QuickSight account.
+* `lastName` - (Optional) Last name of the author of the Amazon QuickSight account to use for future communications. This field is required if `enterppriseAndQ` is the selected edition of the new Amazon QuickSight account.
+* `readerGroup` - (Optional) Reader group associated with your Active Direcrtory.
+* `realm` - (Optional) Realm of the Active Directory that is associated with your Amazon QuickSight account.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `accountSubscriptionStatus` - Status of the Amazon QuickSight account's subscription.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `10M`)
+* `delete` - (Default `10M`)
+
+## Import
+
+You cannot import this resource.
+
+<!-- cache-key: cdktf-0.18.0 input-875d75585da05795e23c019e0ffaab500682447eb4464a05a6d4c3ae31219bd9 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/quicksight_analysis.html.markdown b/website/docs/cdktf/typescript/r/quicksight_analysis.html.markdown
new file mode 100644
index 00000000000..7ef95c06eac
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/quicksight_analysis.html.markdown
@@ -0,0 +1,224 @@
+---
+subcategory: "QuickSight"
+layout: "aws"
+page_title: "AWS: aws_quicksight_analysis"
+description: |-
+  Manages a QuickSight Analysis.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_quicksight_analysis
+
+Resource for managing a QuickSight Analysis.
+
+## Example Usage
+
+### From Source Template
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { QuicksightAnalysis } from "./.gen/providers/aws/quicksight-analysis";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new QuicksightAnalysis(this, "example", {
+      analysisId: "example-id",
+      name: "example-name",
+      sourceEntity: {
+        sourceTemplate: {
+          arn: source.arn,
+          dataSetReferences: [
+            {
+              dataSetArn: dataset.arn,
+              dataSetPlaceholder: "1",
+            },
+          ],
+        },
+      },
+    });
+  }
+}
+
+```
+
+### With Definition
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { QuicksightAnalysis } from "./.gen/providers/aws/quicksight-analysis";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new QuicksightAnalysis(this, "example", {
+      analysisId: "example-id",
+      definition: {
+        dataSetIdentifiersDeclarations: [
+          {
+            dataSetArn: dataset.arn,
+            identifier: "1",
+          },
+        ],
+        sheets: [
+          {
+            sheetId: "Example1",
+            title: "Example",
+            visuals: [
+              {
+                lineChartVisual: {
+                  chartConfiguration: {
+                    fieldWells: {
+                      lineChartAggregatedFieldWells: {
+                        category: [
+                          {
+                            categoricalDimensionField: {
+                              column: {
+                                columnName: "Column1",
+                                dataSetIdentifier: "1",
+                              },
+                              fieldId: "1",
+                            },
+                          },
+                        ],
+                        values: [
+                          {
+                            categoricalMeasureField: {
+                              aggregationFunction: "COUNT",
+                              column: {
+                                columnName: "Column1",
+                                dataSetIdentifier: "1",
+                              },
+                              fieldId: "2",
+                            },
+                          },
+                        ],
+                      },
+                    },
+                  },
+                  title: {
+                    formatText: {
+                      plainText: "Line Chart Example",
+                    },
+                  },
+                  visualId: "LineChart",
+                },
+              },
+            ],
+          },
+        ],
+      },
+      name: "example-name",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `analysisId` - (Required, Forces new resource) Identifier for the analysis.
+* `name` - (Required) Display name for the analysis.
+
+The following arguments are optional:
+
+* `awsAccountId` - (Optional, Forces new resource) AWS account ID.
+* `definition` - (Optional) A detailed analysis definition. Only one of `definition` or `sourceEntity` should be configured. See [definition](#definition).
+* `parameters` - (Optional) The parameters for the creation of the analysis, which you want to use to override the default settings. An analysis can have any type of parameters, and some parameters might accept multiple values. See [parameters](#parameters).
+* `permissions` - (Optional) A set of resource permissions on the analysis. Maximum of 64 items. See [permissions](#permissions).
+* `recoveryWindowInDays` - (Optional) A value that specifies the number of days that Amazon QuickSight waits before it deletes the analysis. Use `0` to force deletion without recovery. Minimum value of `7`. Maximum value of `30`. Default to `30`.
+* `sourceEntity` - (Optional) The entity that you are using as a source when you create the analysis (template). Only one of `definition` or `sourceEntity` should be configured. See [source_entity](#source_entity).
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `themeArn` - (Optional) The Amazon Resource Name (ARN) of the theme that is being used for this analysis. The theme ARN must exist in the same AWS account where you create the analysis.
+
+### permissions
+
+* `actions` - (Required) List of IAM actions to grant or revoke permissions on.
+* `principal` - (Required) ARN of the principal. See the [ResourcePermission documentation](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_ResourcePermission.html) for the applicable ARN values.
+
+### source_entity
+
+* `sourceTemplate` - (Optional) The source template. See [source_template](#source_template).
+
+### source_template
+
+* `arn` - (Required) The Amazon Resource Name (ARN) of the resource.
+* `dataSetReferences` - (Required) List of dataset references. See [data_set_references](#data_set_references).
+
+### data_set_references
+
+* `dataSetArn` - (Required) Dataset Amazon Resource Name (ARN).
+* `dataSetPlaceholder` - (Required) Dataset placeholder.
+
+### parameters
+
+* `dateTimeParameters` - (Optional) A list of parameters that have a data type of date-time. See [AWS API Documentation for complete description](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DateTimeParameter.html).
+* `decimalParameters` - (Optional) A list of parameters that have a data type of decimal. See [AWS API Documentation for complete description](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DecimalParameter.html).
+* `integerParameters` - (Optional) A list of parameters that have a data type of integer. See [AWS API Documentation for complete description](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_IntegerParameter.html).
+* `stringParameters` - (Optional) A list of parameters that have a data type of string. See [AWS API Documentation for complete description](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_StringParameter.html).
+
+### definition
+
+* `dataSetIdentifiersDeclarations` - (Required) A list dataset identifier declarations. With this mapping,you can use dataset identifiers instead of dataset Amazon Resource Names (ARNs) throughout the analysis sub-structures. See [AWS API Documentation for complete description](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DataSetIdentifierDeclaration.html).
+* `analysisDefaults` - (Optional) The configuration for default analysis settings. See [AWS API Documentation for complete description](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_AnalysisDefaults.html).
+* `calculatedFields` - (Optional) A list of calculated field definitions for the analysis. See [AWS API Documentation for complete description](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_CalculatedField.html).
+* `columnConfigurations` - (Optional) A list of analysis-level column configurations. Column configurations are used to set default formatting for a column that's used throughout an analysis. See [AWS API Documentation for complete description](ttps://docs.aws.amazon.com/quicksight/latest/APIReference/API_ColumnConfiguration.html).
+* `filterGroups` - (Optional) A list of filter definitions for an analysis. See [AWS API Documentation for complete description](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_FilterGroup.html). For more information, see [Filtering Data](https://docs.aws.amazon.com/quicksight/latest/user/filtering-visual-data.html) in Amazon QuickSight User Guide.
+* `parametersDeclarations` - (Optional) A list of parameter declarations for an analysis. Parameters are named variables that can transfer a value for use by an action or an object. See [AWS API Documentation for complete description](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_ParameterDeclaration.html). For more information, see [Parameters in Amazon QuickSight](https://docs.aws.amazon.com/quicksight/latest/user/parameters-in-quicksight.html) in the Amazon QuickSight User Guide.
+* `sheets` - (Optional) A list of sheet definitions for an analysis. See [AWS API Documentation for complete description](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_SheetDefinition.html).
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the analysis.
+* `createdTime` - The time that the analysis was created.
+* `id` - A comma-delimited string joining AWS account ID and analysis ID.
+* `lastUpdatedTime` - The time that the analysis was last updated.
+* `status` - The analysis creation status.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `5M`)
+* `update` - (Default `5M`)
+* `delete` - (Default `5M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import a QuickSight Analysis using the AWS account ID and analysis ID separated by a comma (`,`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import a QuickSight Analysis using the AWS account ID and analysis ID separated by a comma (`,`). For example:
+
+```console
+% terraform import aws_quicksight_analysis.example 123456789012,example-id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-da63973c1a54eccd64c52cb6d2329e99e5d72cb15c08eeb0242091234a75ffbf -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/quicksight_dashboard.html.markdown b/website/docs/cdktf/typescript/r/quicksight_dashboard.html.markdown
new file mode 100644
index 00000000000..7e8a80a39a0
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/quicksight_dashboard.html.markdown
@@ -0,0 +1,282 @@
+---
+subcategory: "QuickSight"
+layout: "aws"
+page_title: "AWS: aws_quicksight_dashboard"
+description: |-
+  Manages a QuickSight Dashboard.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_quicksight_dashboard
+
+Resource for managing a QuickSight Dashboard.
+
+## Example Usage
+
+### From Source Template
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { QuicksightDashboard } from "./.gen/providers/aws/quicksight-dashboard";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new QuicksightDashboard(this, "example", {
+      dashboardId: "example-id",
+      name: "example-name",
+      sourceEntity: {
+        sourceTemplate: {
+          arn: source.arn,
+          dataSetReferences: [
+            {
+              dataSetArn: dataset.arn,
+              dataSetPlaceholder: "1",
+            },
+          ],
+        },
+      },
+      versionDescription: "version",
+    });
+  }
+}
+
+```
+
+### With Definition
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { QuicksightDashboard } from "./.gen/providers/aws/quicksight-dashboard";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new QuicksightDashboard(this, "example", {
+      dashboardId: "example-id",
+      definition: {
+        dataSetIdentifiersDeclarations: [
+          {
+            dataSetArn: dataset.arn,
+            identifier: "1",
+          },
+        ],
+        sheets: [
+          {
+            sheetId: "Example1",
+            title: "Example",
+            visuals: [
+              {
+                lineChartVisual: {
+                  chartConfiguration: {
+                    fieldWells: {
+                      lineChartAggregatedFieldWells: {
+                        category: [
+                          {
+                            categoricalDimensionField: {
+                              column: {
+                                columnName: "Column1",
+                                dataSetIdentifier: "1",
+                              },
+                              fieldId: "1",
+                            },
+                          },
+                        ],
+                        values: [
+                          {
+                            categoricalMeasureField: {
+                              aggregationFunction: "COUNT",
+                              column: {
+                                columnName: "Column1",
+                                dataSetIdentifier: "1",
+                              },
+                              fieldId: "2",
+                            },
+                          },
+                        ],
+                      },
+                    },
+                  },
+                  title: {
+                    formatText: {
+                      plainText: "Line Chart Example",
+                    },
+                  },
+                  visualId: "LineChart",
+                },
+              },
+            ],
+          },
+        ],
+      },
+      name: "example-name",
+      versionDescription: "version",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `dashboardId` - (Required, Forces new resource) Identifier for the dashboard.
+* `name` - (Required) Display name for the dashboard.
+* `versionDescription` - (Required) A description of the current dashboard version being created/updated.
+
+The following arguments are optional:
+
+* `awsAccountId` - (Optional, Forces new resource) AWS account ID.
+* `dashboardPublishOptions` - (Optional) Options for publishing the dashboard. See [dashboard_publish_options](#dashboard_publish_options).
+* `definition` - (Optional) A detailed dashboard definition. Only one of `definition` or `sourceEntity` should be configured. See [definition](#definition).
+* `parameters` - (Optional) The parameters for the creation of the dashboard, which you want to use to override the default settings. A dashboard can have any type of parameters, and some parameters might accept multiple values. See [parameters](#parameters).
+* `permissions` - (Optional) A set of resource permissions on the dashboard. Maximum of 64 items. See [permissions](#permissions).
+* `sourceEntity` - (Optional) The entity that you are using as a source when you create the dashboard (template). Only one of `definition` or `sourceEntity` should be configured. See [source_entity](#source_entity).
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `themeArn` - (Optional) The Amazon Resource Name (ARN) of the theme that is being used for this dashboard. The theme ARN must exist in the same AWS account where you create the dashboard.
+
+### permissions
+
+* `actions` - (Required) List of IAM actions to grant or revoke permissions on.
+* `principal` - (Required) ARN of the principal. See the [ResourcePermission documentation](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_ResourcePermission.html) for the applicable ARN values.
+
+### source_entity
+
+* `sourceTemplate` - (Optional) The source template. See [source_template](#source_template).
+
+### source_template
+
+* `arn` - (Required) The Amazon Resource Name (ARN) of the resource.
+* `dataSetReferences` - (Required) List of dataset references. See [data_set_references](#data_set_references).
+
+### data_set_references
+
+* `dataSetArn` - (Required) Dataset Amazon Resource Name (ARN).
+* `dataSetPlaceholder` - (Required) Dataset placeholder.
+
+### dashboard_publish_options
+
+* `adHocFilteringOption` - (Optional) Ad hoc (one-time) filtering option. See [ad_hoc_filtering_option](#ad_hoc_filtering_option).
+* `dataPointDrillUpDownOption` - (Optional) The drill-down options of data points in a dashboard. See [data_point_drill_up_down_option](#data_point_drill_up_down_option).
+* `dataPointMenuLabelOption` - (Optional) The data point menu label options of a dashboard. See [data_point_menu_label_option](#data_point_menu_label_option).
+* `dataPointTooltipOption` - (Optional) The data point tool tip options of a dashboard. See [data_point_tooltip_option](#data_point_tooltip_option).
+* `exportToCsvOption` - (Optional) Export to .csv option. See [export_to_csv_option](#export_to_csv_option).
+* `exportWithHiddenFieldsOption` - (Optional) Determines if hidden fields are exported with a dashboard. See [export_with_hidden_fields_option](#export_with_hidden_fields_option).
+* `sheetControlsOption` - (Optional) Sheet controls option. See [sheet_controls_option](#sheet_controls_option).
+* `sheetLayoutElementMaximizationOption` - (Optional) The sheet layout maximization options of a dashboard. See [sheet_layout_element_maximization_option](#sheet_layout_element_maximization_option).
+* `visualAxisSortOption` - (Optional) The axis sort options of a dashboard. See [visual_axis_sort_option](#visual_axis_sort_option).
+* `visualMenuOption` - (Optional) The menu options of a visual in a dashboard. See [visual_menu_option](#visual_menu_option).
+
+### ad_hoc_filtering_option
+
+* `availabilityStatus` - (Optional) Availability status. Possibles values: ENABLED, DISABLED.
+
+### data_point_drill_up_down_option
+
+* `availabilityStatus` - (Optional) Availability status. Possibles values: ENABLED, DISABLED.
+
+### data_point_menu_label_option
+
+* `availabilityStatus` - (Optional) Availability status. Possibles values: ENABLED, DISABLED.
+
+### data_point_tooltip_option
+
+* `availabilityStatus` - (Optional) Availability status. Possibles values: ENABLED, DISABLED.
+
+### export_to_csv_option
+
+* `availabilityStatus` - (Optional) Availability status. Possibles values: ENABLED, DISABLED.
+
+### export_with_hidden_fields_option
+
+* `availabilityStatus` - (Optional) Availability status. Possibles values: ENABLED, DISABLED.
+
+### sheet_controls_option
+
+* `visibilityState` - (Optional) Visibility state. Possibles values: EXPANDED, COLLAPSED.
+
+### sheet_layout_element_maximization_option
+
+* `availabilityStatus` - (Optional) Availability status. Possibles values: ENABLED, DISABLED.
+
+### visual_axis_sort_option
+
+* `availabilityStatus` - (Optional) Availability status. Possibles values: ENABLED, DISABLED.
+
+### visual_menu_option
+
+* `availabilityStatus` - (Optional) Availability status. Possibles values: ENABLED, DISABLED.
+
+### parameters
+
+* `dateTimeParameters` - (Optional) A list of parameters that have a data type of date-time. See [AWS API Documentation for complete description](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DateTimeParameter.html).
+* `decimalParameters` - (Optional) A list of parameters that have a data type of decimal. See [AWS API Documentation for complete description](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DecimalParameter.html).
+* `integerParameters` - (Optional) A list of parameters that have a data type of integer. See [AWS API Documentation for complete description](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_IntegerParameter.html).
+* `stringParameters` - (Optional) A list of parameters that have a data type of string. See [AWS API Documentation for complete description](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_StringParameter.html).
+
+### definition
+
+* `dataSetIdentifiersDeclarations` - (Required) A list dataset identifier declarations. With this mapping,you can use dataset identifiers instead of dataset Amazon Resource Names (ARNs) throughout the dashboard's sub-structures. See [AWS API Documentation for complete description](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DataSetIdentifierDeclaration.html).
+* `analysisDefaults` - (Optional) The configuration for default analysis settings. See [AWS API Documentation for complete description](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_AnalysisDefaults.html).
+* `calculatedFields` - (Optional) A list of calculated field definitions for the dashboard. See [AWS API Documentation for complete description](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_CalculatedField.html).
+* `columnConfigurations` - (Optional) A list of dashboard-level column configurations. Column configurations are used to set default formatting for a column that's used throughout a dashboard. See [AWS API Documentation for complete description](ttps://docs.aws.amazon.com/quicksight/latest/APIReference/API_ColumnConfiguration.html).
+* `filterGroups` - (Optional) A list of filter definitions for a dashboard. See [AWS API Documentation for complete description](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_FilterGroup.html). For more information, see [Filtering Data](https://docs.aws.amazon.com/quicksight/latest/user/filtering-visual-data.html) in Amazon QuickSight User Guide.
+* `parametersDeclarations` - (Optional) A list of parameter declarations for a dashboard. Parameters are named variables that can transfer a value for use by an action or an object. See [AWS API Documentation for complete description](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_ParameterDeclaration.html). For more information, see [Parameters in Amazon QuickSight](https://docs.aws.amazon.com/quicksight/latest/user/parameters-in-quicksight.html) in the Amazon QuickSight User Guide.
+* `sheets` - (Optional) A list of sheet definitions for a dashboard. See [AWS API Documentation for complete description](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_SheetDefinition.html).
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the dashboard.
+* `createdTime` - The time that the dashboard was created.
+* `id` - A comma-delimited string joining AWS account ID and dashboard ID.
+* `lastUpdatedTime` - The time that the dashboard was last updated.
+* `sourceEntityArn` - Amazon Resource Name (ARN) of a template that was used to create this dashboard.
+* `status` - The dashboard creation status.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block).
+* `versionNumber` - The version number of the dashboard version.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `5M`)
+* `update` - (Default `5M`)
+* `delete` - (Default `5M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import a QuickSight Dashboard using the AWS account ID and dashboard ID separated by a comma (`,`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import a QuickSight Dashboard using the AWS account ID and dashboard ID separated by a comma (`,`). For example:
+
+```console
+% terraform import aws_quicksight_dashboard.example 123456789012,example-id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-9f686a697583cc68bcdda01d77c43a8c130a26f2d273f19d6b15acb81c7b6b53 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/quicksight_data_set.html.markdown b/website/docs/cdktf/typescript/r/quicksight_data_set.html.markdown
new file mode 100644
index 00000000000..7ccb1c9724e
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/quicksight_data_set.html.markdown
@@ -0,0 +1,516 @@
+---
+subcategory: "QuickSight"
+layout: "aws"
+page_title: "AWS: aws_quicksight_data_set"
+description: |-
+  Manages a Resource QuickSight Data Set.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_quicksight_data_set
+
+Resource for managing a QuickSight Data Set.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { QuicksightDataSet } from "./.gen/providers/aws/quicksight-data-set";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new QuicksightDataSet(this, "example", {
+      dataSetId: "example-id",
+      importMode: "SPICE",
+      name: "example-name",
+      physicalTableMap: [
+        {
+          physicalTableMapId: "example-id",
+          s3Source: {
+            dataSourceArn: Token.asString(awsQuicksightDataSourceExample.arn),
+            inputColumns: [
+              {
+                name: "Column1",
+                type: "STRING",
+              },
+            ],
+            uploadSettings: {
+              format: "JSON",
+            },
+          },
+        },
+      ],
+    });
+  }
+}
+
+```
+
+### With Column Level Permission Rules
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { QuicksightDataSet } from "./.gen/providers/aws/quicksight-data-set";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new QuicksightDataSet(this, "example", {
+      columnLevelPermissionRules: [
+        {
+          columnNames: ["Column1"],
+          principals: [Token.asString(awsQuicksightUserExample.arn)],
+        },
+      ],
+      dataSetId: "example-id",
+      importMode: "SPICE",
+      name: "example-name",
+      physicalTableMap: [
+        {
+          physicalTableMapId: "example-id",
+          s3Source: {
+            dataSourceArn: Token.asString(awsQuicksightDataSourceExample.arn),
+            inputColumns: [
+              {
+                name: "Column1",
+                type: "STRING",
+              },
+            ],
+            uploadSettings: {
+              format: "JSON",
+            },
+          },
+        },
+      ],
+    });
+  }
+}
+
+```
+
+### With Field Folders
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { QuicksightDataSet } from "./.gen/providers/aws/quicksight-data-set";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new QuicksightDataSet(this, "example", {
+      dataSetId: "example-id",
+      fieldFolders: [
+        {
+          columns: ["Column1"],
+          description: "example description",
+          fieldFoldersId: "example-id",
+        },
+      ],
+      importMode: "SPICE",
+      name: "example-name",
+      physicalTableMap: [
+        {
+          physicalTableMapId: "example-id",
+          s3Source: {
+            dataSourceArn: Token.asString(awsQuicksightDataSourceExample.arn),
+            inputColumns: [
+              {
+                name: "Column1",
+                type: "STRING",
+              },
+            ],
+            uploadSettings: {
+              format: "JSON",
+            },
+          },
+        },
+      ],
+    });
+  }
+}
+
+```
+
+### With Permissions
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { QuicksightDataSet } from "./.gen/providers/aws/quicksight-data-set";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new QuicksightDataSet(this, "example", {
+      dataSetId: "example-id",
+      importMode: "SPICE",
+      name: "example-name",
+      permissions: [
+        {
+          actions: [
+            "quicksight:DescribeDataSet",
+            "quicksight:DescribeDataSetPermissions",
+            "quicksight:PassDataSet",
+            "quicksight:DescribeIngestion",
+            "quicksight:ListIngestions",
+          ],
+          principal: Token.asString(awsQuicksightUserExample.arn),
+        },
+      ],
+      physicalTableMap: [
+        {
+          physicalTableMapId: "example-id",
+          s3Source: {
+            dataSourceArn: Token.asString(awsQuicksightDataSourceExample.arn),
+            inputColumns: [
+              {
+                name: "Column1",
+                type: "STRING",
+              },
+            ],
+            uploadSettings: {
+              format: "JSON",
+            },
+          },
+        },
+      ],
+    });
+  }
+}
+
+```
+
+### With Row Level Permission Tag Configuration
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { QuicksightDataSet } from "./.gen/providers/aws/quicksight-data-set";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new QuicksightDataSet(this, "example", {
+      dataSetId: "example-id",
+      importMode: "SPICE",
+      name: "example-name",
+      physicalTableMap: [
+        {
+          physicalTableMapId: "example-id",
+          s3Source: {
+            dataSourceArn: Token.asString(awsQuicksightDataSourceExample.arn),
+            inputColumns: [
+              {
+                name: "Column1",
+                type: "STRING",
+              },
+            ],
+            uploadSettings: {
+              format: "JSON",
+            },
+          },
+        },
+      ],
+      rowLevelPermissionTagConfiguration: {
+        status: "ENABLED",
+        tagRules: [
+          {
+            columnName: "Column1",
+            matchAllValue: "*",
+            tagKey: "tagkey",
+            tagMultiValueDelimiter: ",",
+          },
+        ],
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `dataSetId` - (Required, Forces new resource) Identifier for the data set.
+* `importMode` - (Required) Indicates whether you want to import the data into SPICE. Valid values are `spice` and `directQuery`.
+* `name` - (Required) Display name for the dataset.
+* `physicalTableMap` - (Required) Declares the physical tables that are available in the underlying data sources. See [physical_table_map](#physical_table_map).
+
+The following arguments are optional:
+
+* `awsAccountId` - (Optional, Forces new resource) AWS account ID.
+* `columnGroups` - (Optional) Groupings of columns that work together in certain Amazon QuickSight features. Currently, only geospatial hierarchy is supported. See [column_groups](#column_groups).
+* `columnLevelPermissionRules` - (Optional) A set of 1 or more definitions of a [ColumnLevelPermissionRule](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_ColumnLevelPermissionRule.html). See [column_level_permission_rules](#column_level_permission_rules).
+* `dataSetUsageConfiguration` - (Optional) The usage configuration to apply to child datasets that reference this dataset as a source. See [data_set_usage_configuration](#data_set_usage_configuration).
+* `fieldFolders` - (Optional) The folder that contains fields and nested subfolders for your dataset. See [field_folders](#field_folders).
+* `logicalTableMap` - (Optional) Configures the combination and transformation of the data from the physical tables. Maximum of 1 entry. See [logical_table_map](#logical_table_map).
+* `permissions` - (Optional) A set of resource permissions on the data source. Maximum of 64 items. See [permissions](#permissions).
+* `rowLevelPermissionDataSet` - (Optional) The row-level security configuration for the data that you want to create. See [row_level_permission_data_set](#row_level_permission_data_set).
+* `rowLevelPermissionTagConfiguration` - (Optional) The configuration of tags on a dataset to set row-level security. Row-level security tags are currently supported for anonymous embedding only. See [row_level_permission_tag_configuration](#row_level_permission_tag_configuration).
+* `refreshProperties` - (Optional) The refresh properties for the data set. **NOTE**: Only valid when `importMode` is set to `spice`. See [refresh_properties](#refresh_properties).
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### physical_table_map
+
+For a `physicalTableMap` item to be valid, only one of `customSql`, `relationalTable`, or `s3Source` should be configured.
+
+* `physicalTableMapId` - (Required) Key of the physical table map.
+* `customSql` - (Optional) A physical table type built from the results of the custom SQL query. See [custom_sql](#custom_sql).
+* `relationalTable` - (Optional) A physical table type for relational data sources. See [relational_table](#relational_table).
+* `s3Source` - (Optional) A physical table type for as S3 data source. See [s3_source](#s3_source).
+
+### custom_sql
+
+* `dataSourceArn` - (Required) ARN of the data source.
+* `name` - (Required) Display name for the SQL query result.
+* `sqlQuery` - (Required) SQL query.
+* `columns` - (Optional) Column schema from the SQL query result set. See [columns](#columns).
+
+### columns
+
+* `name` - (Required) Name of this column in the underlying data source.
+* `type` - (Required) Data type of the column.
+
+### relational_table
+
+* `dataSourceArn` - (Required) ARN of the data source.
+* `inputColumns` - (Required) Column schema of the table. See [input_columns](#input_columns).
+* `name` - (Required) Name of the relational table.
+* `catalog` - (Optional) Catalog associated with the table.
+* `schema` - (Optional) Schema name. This name applies to certain relational database engines.
+
+### input_columns
+
+* `name` - (Required) Name of this column in the underlying data source.
+* `type` - (Required) Data type of the column.
+
+### s3_source
+
+* `dataSourceArn` - (Required) ARN of the data source.
+* `inputColumns` - (Required) Column schema of the table. See [input_columns](#input_columns).
+* `uploadSettings` - (Required) Information about the format for the S3 source file or files. See [upload_settings](#upload_settings).
+
+### upload_settings
+
+* `containsHeader` - (Optional) Whether the file has a header row, or the files each have a header row.
+* `delimiter` - (Optional) Delimiter between values in the file.
+* `format` - (Optional) File format. Valid values are `csv`, `tsv`, `clf`, `elf`, `xlsx`, and `json`.
+* `startFromRow` - (Optional) A row number to start reading data from.
+* `textQualifier` - (Optional) Text qualifier. Valid values are `doubleQuote` and `singleQuote`.
+
+### column_groups
+
+* `geoSpatialColumnGroup` - (Optional) Geospatial column group that denotes a hierarchy. See [geo_spatial_column_group](#geo_spatial_column_group).
+
+### geo_spatial_column_group
+
+* `columns` - (Required) Columns in this hierarchy.
+* `countryCode` - (Required) Country code. Valid values are `us`.
+* `name` - (Required) A display name for the hierarchy.
+
+### column_level_permission_rules
+
+* `columnNames` - (Optional) An array of column names.
+* `principals` - (Optional) An array of ARNs for Amazon QuickSight users or groups.
+
+### data_set_usage_configuration
+
+* `disableUseAsDirectQuerySource` - (Optional) Controls whether a child dataset of a direct query can use this dataset as a source.
+* `disableUseAsImportedSource` - (Optional) Controls whether a child dataset that's stored in QuickSight can use this dataset as a source.
+
+### field_folders
+
+* `fieldFoldersId` - (Required) Key of the field folder map.
+* `columns` - (Optional) An array of column names to add to the folder. A column can only be in one folder.
+* `description` - (Optional) Field folder description.
+
+### logical_table_map
+
+* `alias` - (Required) A display name for the logical table.
+* `logicalTableMapId` - (Required) Key of the logical table map.
+* `dataTransforms` - (Optional) Transform operations that act on this logical table. For this structure to be valid, only one of the attributes can be non-null. See [data_transforms](#data_transforms).
+* `source` - (Optional) Source of this logical table. See [source](#source).
+
+### data_transforms
+
+* `castColumnTypeOperation` - (Optional) A transform operation that casts a column to a different type. See [cast_column_type_operation](#cast_column_type_operation).
+* `createColumnsOperation` - (Optional) An operation that creates calculated columns. Columns created in one such operation form a lexical closure. See [create_columns_operation](#create_columns_operation).
+* `filterOperation` - (Optional) An operation that filters rows based on some condition. See [filter_operation](#filter_operation).
+* `projectOperation` - (Optional) An operation that projects columns. Operations that come after a projection can only refer to projected columns. See [project_operation](#project_operation).
+* `renameColumnOperation` - (Optional) An operation that renames a column. See [rename_column_operation](#rename_column_operation).
+* `tagColumnOperation` - (Optional) An operation that tags a column with additional information. See [tag_column_operation](#tag_column_operation).
+* `untagColumnOperation` - (Optional) A transform operation that removes tags associated with a column. See [untag_column_operation](#untag_column_operation).
+
+### cast_column_type_operation
+
+* `columnName` - (Required) Column name.
+* `newColumnType` - (Required) New column data type. Valid values are `string`, `integer`, `decimal`, `datetime`.
+* `format` - (Optional) When casting a column from string to datetime type, you can supply a string in a format supported by Amazon QuickSight to denote the source data format.
+
+### create_columns_operation
+
+* `columns` - (Required) Calculated columns to create. See [columns](#columns-1).
+
+### columns
+
+* `columnId` - (Required) A unique ID to identify a calculated column. During a dataset update, if the column ID of a calculated column matches that of an existing calculated column, Amazon QuickSight preserves the existing calculated column.
+* `columnName` - (Required) Column name.
+* `expression` - (Required) An expression that defines the calculated column.
+
+### filter_operation
+
+* `conditionExpression` - (Required) An expression that must evaluate to a Boolean value. Rows for which the expression evaluates to true are kept in the dataset.
+
+### project_operation
+
+* `projectedColumns` - (Required) Projected columns.
+
+### rename_column_operation
+
+* `columnName` - (Required) Column to be renamed.
+* `newColumnName` - (Required) New name for the column.
+
+### tag_column_operation
+
+* `columnName` - (Required) Column name.
+* `tags` - (Required) The dataset column tag, currently only used for geospatial type tagging. See [tags](#tags).
+
+### tags
+
+* `columnDescription` - (Optional) A description for a column. See [column_description](#column_description).
+* `columnGeographicRole` - (Optional) A geospatial role for a column. Valid values are `country`, `state`, `county`, `city`, `postcode`, `longitude`, and `latitude`.
+
+### column_description
+
+* `text` - (Optional) The text of a description for a column.
+
+### untag_column_operation
+
+* `columnName` - (Required) Column name.
+* `tagNames` - (Required) The column tags to remove from this column.
+
+### source
+
+* `dataSetArn` - (Optional) ARN of the parent data set.
+* `joinInstruction` - (Optional) Specifies the result of a join of two logical tables. See [join_instruction](#join_instruction).
+* `physicalTableId` - (Optional) Physical table ID.
+
+### join_instruction
+
+* `leftOperand` - (Required) Operand on the left side of a join.
+* `onClause` - (Required) Join instructions provided in the ON clause of a join.
+* `rightOperand` - (Required) Operand on the right side of a join.
+* `type` - (Required) Type of join. Valid values are `inner`, `outer`, `left`, and `right`.
+* `leftJoinKeyProperties` - (Optional) Join key properties of the left operand. See [left_join_key_properties](#left_join_key_properties).
+* `rightJoinKeyProperties` - (Optional) Join key properties of the right operand. See [right_join_key_properties](#right_join_key_properties).
+
+### left_join_key_properties
+
+* `uniqueKey` - (Optional) A value that indicates that a row in a table is uniquely identified by the columns in a join key. This is used by Amazon QuickSight to optimize query performance.
+
+### right_join_key_properties
+
+* `uniqueKey` - (Optional) A value that indicates that a row in a table is uniquely identified by the columns in a join key. This is used by Amazon QuickSight to optimize query performance.
+
+### permissions
+
+* `actions` - (Required) List of IAM actions to grant or revoke permissions on.
+* `principal` - (Required) ARN of the principal. See the [ResourcePermission documentation](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_ResourcePermission.html) for the applicable ARN values.
+
+### row_level_permission_data_set
+
+* `arn` - (Required) ARN of the dataset that contains permissions for RLS.
+* `permissionPolicy` - (Required) Type of permissions to use when interpreting the permissions for RLS. Valid values are `grantAccess` and `denyAccess`.
+* `formatVersion` - (Optional) User or group rules associated with the dataset that contains permissions for RLS.
+* `namespace` - (Optional) Namespace associated with the dataset that contains permissions for RLS.
+* `status` - (Optional) Status of the row-level security permission dataset. If enabled, the status is `enabled`. If disabled, the status is `disabled`.
+
+### row_level_permission_tag_configuration
+
+* `tagRules` - (Required) A set of rules associated with row-level security, such as the tag names and columns that they are assigned to. See [tag_rules](#tag_rules).
+* `status` - (Optional) The status of row-level security tags. If enabled, the status is `enabled`. If disabled, the status is `disabled`.
+
+### refresh_properties
+
+* `refreshConfiguration` - (Required) The refresh configuration for the data set. See [refresh_configuration](#refresh_configuration).
+
+### refresh_configuration
+
+* `incrementalRefresh` - (Required) The incremental refresh for the data set. See [incremental_refresh](#incremental_refresh).
+
+### incremental_refresh
+
+* `lookbackWindow` - (Required) The lookback window setup for an incremental refresh configuration. See [lookback_window](#lookback_window).
+
+### lookback_window
+
+* `columnName` - (Required) The name of the lookback window column.
+* `size` - (Required) The lookback window column size.
+* `sizeUnit` - (Required) The size unit that is used for the lookback window column. Valid values for this structure are `hour`, `day`, and `week`.
+
+### tag_rules
+
+* `columnName` - (Required) Column name that a tag key is assigned to.
+* `tagKey` - (Required) Unique key for a tag.
+* `matchAllValue` - (Optional) A string that you want to use to filter by all the values in a column in the dataset and don’t want to list the values one by one.
+* `tagMultiValueDelimiter` - (Optional) A string that you want to use to delimit the values when you pass the values at run time.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the data set.
+* `id` - A comma-delimited string joining AWS account ID and data set ID.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import a QuickSight Data Set using the AWS account ID and data set ID separated by a comma (`,`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import a QuickSight Data Set using the AWS account ID and data set ID separated by a comma (`,`). For example:
+
+```console
+% terraform import aws_quicksight_data_set.example 123456789012,example-id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1a8603f1407762c148dd6779a52ba1f5c1ee5c07434a0e03886d6f8b8bec1425 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/quicksight_data_source.html.markdown b/website/docs/cdktf/typescript/r/quicksight_data_source.html.markdown
new file mode 100644
index 00000000000..25f50606842
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/quicksight_data_source.html.markdown
@@ -0,0 +1,254 @@
+---
+subcategory: "QuickSight"
+layout: "aws"
+page_title: "AWS: aws_quicksight_data_source"
+description: |-
+  Manages a Resource QuickSight Data Source.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_quicksight_data_source
+
+Resource for managing QuickSight Data Source
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { QuicksightDataSource } from "./.gen/providers/aws/quicksight-data-source";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new QuicksightDataSource(this, "default", {
+      dataSourceId: "example-id",
+      name: "My Cool Data in S3",
+      parameters: {
+        s3: {
+          manifestFileLocation: {
+            bucket: "my-bucket",
+            key: "path/to/manifest.json",
+          },
+        },
+      },
+      type: "S3",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `dataSourceId` - (Required, Forces new resource) An identifier for the data source.
+* `name` - (Required) A name for the data source, maximum of 128 characters.
+* `parameters` - (Required) The [parameters](#parameters-argument-reference) used to connect to this data source (exactly one).
+* `type` - (Required) The type of the data source. See the [AWS Documentation](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_CreateDataSource.html#QS-CreateDataSource-request-Type) for the complete list of valid values.
+
+The following arguments are optional:
+
+* `awsAccountId` - (Optional, Forces new resource) The ID for the AWS account that the data source is in. Currently, you use the ID for the AWS account that contains your Amazon QuickSight account.
+* `credentials` - (Optional) The credentials Amazon QuickSight uses to connect to your underlying source. Currently, only credentials based on user name and password are supported. See [Credentials](#credentials-argument-reference) below for more details.
+* `permission` - (Optional) A set of resource permissions on the data source. Maximum of 64 items. See [Permission](#permission-argument-reference) below for more details.
+* `sslProperties` - (Optional) Secure Socket Layer (SSL) properties that apply when Amazon QuickSight connects to your underlying source. See [SSL Properties](#ssl_properties-argument-reference) below for more details.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `vpcConnectionProperties`- (Optional) Use this parameter only when you want Amazon QuickSight to use a VPC connection when connecting to your underlying source. See [VPC Connection Properties](#vpc_connection_properties-argument-reference) below for more details.
+
+### credentials Argument Reference
+
+* `copySourceArn` (Optional, Conflicts with `credentialPair`) - The Amazon Resource Name (ARN) of a data source that has the credential pair that you want to use.
+When the value is not null, the `credentialPair` from the data source in the ARN is used.
+* `credentialPair` (Optional, Conflicts with `copySourceArn`) - Credential pair. See [Credential Pair](#credential_pair-argument-reference) below for more details.
+
+### credential_pair Argument Reference
+
+* `password` - (Required) Password, maximum length of 1024 characters.
+* `username` - (Required) User name, maximum length of 64 characters.
+
+### parameters Argument Reference
+
+To specify data source connection parameters, exactly one of the following sub-objects must be provided.
+
+* `amazonElasticsearch` - (Optional) [Parameters](#amazon_elasticsearch-argument-reference) for connecting to Amazon Elasticsearch.
+* `athena` - (Optional) [Parameters](#athena-argument-reference) for connecting to Athena.
+* `aurora` - (Optional) [Parameters](#aurora-argument-reference) for connecting to Aurora MySQL.
+* `auroraPostgresql` - (Optional) [Parameters](#aurora_postgresql-argument-reference) for connecting to Aurora Postgresql.
+* `awsIotAnalytics` - (Optional) [Parameters](#aws_iot_analytics-argument-reference) for connecting to AWS IOT Analytics.
+* `jira` - (Optional) [Parameters](#jira-fargument-reference) for connecting to Jira.
+* `mariaDb` - (Optional) [Parameters](#maria_db-argument-reference) for connecting to MariaDB.
+* `mysql` - (Optional) [Parameters](#mysql-argument-reference) for connecting to MySQL.
+* `oracle` - (Optional) [Parameters](#oracle-argument-reference) for connecting to Oracle.
+* `postgresql` - (Optional) [Parameters](#postgresql-argument-reference) for connecting to Postgresql.
+* `presto` - (Optional) [Parameters](#presto-argument-reference) for connecting to Presto.
+* `rds` - (Optional) [Parameters](#rds-argument-reference) for connecting to RDS.
+* `redshift` - (Optional) [Parameters](#redshift-argument-reference) for connecting to Redshift.
+* `s3` - (Optional) [Parameters](#s3-argument-reference) for connecting to S3.
+* `serviceNow` - (Optional) [Parameters](#service_now-argument-reference) for connecting to ServiceNow.
+* `snowflake` - (Optional) [Parameters](#snowflake-argument-reference) for connecting to Snowflake.
+* `spark` - (Optional) [Parameters](#spark-argument-reference) for connecting to Spark.
+* `sqlServer` - (Optional) [Parameters](#sql_server-argument-reference) for connecting to SQL Server.
+* `teradata` - (Optional) [Parameters](#teradata-argument-reference) for connecting to Teradata.
+* `twitter` - (Optional) [Parameters](#twitter-argument-reference) for connecting to Twitter.
+
+### permission Argument Reference
+
+* `actions` - (Required) Set of IAM actions to grant or revoke permissions on. Max of 16 items.
+* `principal` - (Required) The Amazon Resource Name (ARN) of the principal.
+
+### ssl_properties Argument Reference
+
+* `disableSsl` - (Required) A Boolean option to control whether SSL should be disabled.
+
+### vpc_connection_properties Argument Reference
+
+* `vpcConnectionArn` - (Required) The Amazon Resource Name (ARN) for the VPC connection.
+
+### amazon_elasticsearch Argument Reference
+
+* `domain` - (Required) The OpenSearch domain.
+
+### athena Argument Reference
+
+* `workGroup` - (Optional) The work-group to which to connect.
+
+### aurora Argument Reference
+
+* `database` - (Required) The database to which to connect.
+* `host` - (Required) The host to which to connect.
+* `port` - (Required) The port to which to connect.
+
+### aurora_postgresql Argument Reference
+
+* `database` - (Required) The database to which to connect.
+* `host` - (Required) The host to which to connect.
+* `port` - (Required) The port to which to connect.
+
+### aws_iot_analytics Argument Reference
+
+* `dataSetName` - (Required) The name of the data set to which to connect.
+
+### jira fArgument Reference
+
+* `siteBaseUrl` - (Required) The base URL of the Jira instance's site to which to connect.
+
+### maria_db Argument Reference
+
+* `database` - (Required) The database to which to connect.
+* `host` - (Required) The host to which to connect.
+* `port` - (Required) The port to which to connect.
+
+### mysql Argument Reference
+
+* `database` - (Required) The database to which to connect.
+* `host` - (Required) The host to which to connect.
+* `port` - (Required) The port to which to connect.
+
+### oracle Argument Reference
+
+* `database` - (Required) The database to which to connect.
+* `host` - (Required) The host to which to connect.
+* `port` - (Required) The port to which to connect.
+
+### postgresql Argument Reference
+
+* `database` - (Required) The database to which to connect.
+* `host` - (Required) The host to which to connect.
+* `port` - (Required) The port to which to connect.
+
+### presto Argument Reference
+
+* `catalog` - (Required) The catalog to which to connect.
+* `host` - (Required) The host to which to connect.
+* `port` - (Required) The port to which to connect.
+
+### rds Argument Reference
+
+* `database` - (Required) The database to which to connect.
+* `instanceId` - (Optional) The instance ID to which to connect.
+
+### redshift Argument Reference
+
+* `clusterId` - (Optional, Required if `host` and `port` are not provided) The ID of the cluster to which to connect.
+* `database` - (Required) The database to which to connect.
+* `host` - (Optional, Required if `clusterId` is not provided) The host to which to connect.
+* `port` - (Optional, Required if `clusterId` is not provided) The port to which to connect.
+
+### s3 Argument Reference
+
+* `manifestFileLocation` - (Required) An [object containing the S3 location](#manifest_file_location-argument-reference) of the S3 manifest file.
+
+### manifest_file_location Argument Reference
+
+* `bucket` - (Required) The name of the bucket that contains the manifest file.
+* `key` - (Required) The key of the manifest file within the bucket.
+
+### service_now Argument Reference
+
+* `siteBaseUrl` - (Required) The base URL of the Jira instance's site to which to connect.
+
+### snowflake Argument Reference
+
+* `database` - (Required) The database to which to connect.
+* `host` - (Required) The host to which to connect.
+* `warehouse` - (Required) The warehouse to which to connect.
+
+### spark Argument Reference
+
+* `host` - (Required) The host to which to connect.
+* `port` - (Required) The warehouse to which to connect.
+
+### sql_server Argument Reference
+
+* `database` - (Required) The database to which to connect.
+* `host` - (Required) The host to which to connect.
+* `port` - (Required) The warehouse to which to connect.
+
+### teradata Argument Reference
+
+* `database` - (Required) The database to which to connect.
+* `host` - (Required) The host to which to connect.
+* `port` - (Required) The warehouse to which to connect.
+
+#### twitter Argument Reference
+
+* `maxRows` - (Required) The maximum number of rows to query.
+* `query` - (Required) The Twitter query to retrieve the data.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the data source
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import a QuickSight data source using the AWS account ID, and data source ID separated by a slash (`/`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import a QuickSight data source using the AWS account ID, and data source ID separated by a slash (`/`). For example:
+
+```console
+% terraform import aws_quicksight_data_source.example 123456789123/my-data-source-id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-2de42ab036dbf7d192e1e61ccf217d0b3cc58fb437a7906bb08bf538070833e7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/quicksight_folder.html.markdown b/website/docs/cdktf/typescript/r/quicksight_folder.html.markdown
new file mode 100644
index 00000000000..044c9786e0c
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/quicksight_folder.html.markdown
@@ -0,0 +1,168 @@
+---
+subcategory: "QuickSight"
+layout: "aws"
+page_title: "AWS: aws_quicksight_folder"
+description: |-
+  Manages a QuickSight Folder.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_quicksight_folder
+
+Resource for managing a QuickSight Folder.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { QuicksightFolder } from "./.gen/providers/aws/quicksight-folder";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new QuicksightFolder(this, "example", {
+      folderId: "example-id",
+      name: "example-name",
+    });
+  }
+}
+
+```
+
+### With Permissions
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { QuicksightFolder } from "./.gen/providers/aws/quicksight-folder";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new QuicksightFolder(this, "example", {
+      folderId: "example-id",
+      name: "example-name",
+      permissions: [
+        {
+          actions: [
+            "quicksight:CreateFolder",
+            "quicksight:DescribeFolder",
+            "quicksight:UpdateFolder",
+            "quicksight:DeleteFolder",
+            "quicksight:CreateFolderMembership",
+            "quicksight:DeleteFolderMembership",
+            "quicksight:DescribeFolderPermissions",
+            "quicksight:UpdateFolderPermissions",
+          ],
+          principal: Token.asString(awsQuicksightUserExample.arn),
+        },
+      ],
+    });
+  }
+}
+
+```
+
+### With Parent Folder
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { QuicksightFolder } from "./.gen/providers/aws/quicksight-folder";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const parent = new QuicksightFolder(this, "parent", {
+      folderId: "parent-id",
+      name: "parent-name",
+    });
+    new QuicksightFolder(this, "example", {
+      folderId: "example-id",
+      name: "example-name",
+      parentFolderArn: parent.arn,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `folderId` - (Required, Forces new resource) Identifier for the folder.
+* `name` - (Required) Display name for the folder.
+
+The following arguments are optional:
+
+* `awsAccountId` - (Optional, Forces new resource) AWS account ID.
+* `folderType` - (Optional) The type of folder. By default, it is `shared`. Valid values are: `shared`.
+* `parentFolderArn` - (Optional) The Amazon Resource Name (ARN) for the parent folder. If not set, creates a root-level folder.
+* `permissions` - (Optional) A set of resource permissions on the folder. Maximum of 64 items. See [permissions](#permissions).
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### permissions
+
+* `actions` - (Required) List of IAM actions to grant or revoke permissions on.
+* `principal` - (Required) ARN of the principal. See the [ResourcePermission documentation](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_ResourcePermission.html) for the applicable ARN values.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the folder.
+* `createdTime` - The time that the folder was created.
+* `folderPath` - An array of ancestor ARN strings for the folder. Empty for root-level folders.
+* `id` - A comma-delimited string joining AWS account ID and folder ID.
+* `lastUpdatedTime` - The time that the folder was last updated.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `5M`)
+* `read`   - (Default `5M`)
+* `update` - (Default `5M`)
+* `delete` - (Default `5M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import a QuickSight folder using the AWS account ID and folder ID name separated by a comma (`,`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import a QuickSight folder using the AWS account ID and folder ID name separated by a comma (`,`). For example:
+
+```console
+% terraform import aws_quicksight_folder.example 123456789012,example-id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-bfe67ec1b66703fe4dec29123039432b9ff61c08d31438163738103ae03db233 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/quicksight_folder_membership.html.markdown b/website/docs/cdktf/typescript/r/quicksight_folder_membership.html.markdown
new file mode 100644
index 00000000000..f25f13f46c7
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/quicksight_folder_membership.html.markdown
@@ -0,0 +1,81 @@
+---
+subcategory: "QuickSight"
+layout: "aws"
+page_title: "AWS: aws_quicksight_folder_membership"
+description: |-
+  Terraform resource for managing an AWS QuickSight Folder Membership.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_quicksight_folder_membership
+
+Terraform resource for managing an AWS QuickSight Folder Membership.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { QuicksightFolderMembership } from "./.gen/providers/aws/quicksight-folder-membership";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new QuicksightFolderMembership(this, "example", {
+      folderId: Token.asString(awsQuicksightFolderExample.folderId),
+      memberId: Token.asString(awsQuicksightDataSetExample.dataSetId),
+      memberType: "DATASET",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `folderId` - (Required, Forces new resource) Identifier for the folder.
+* `memberId` - (Required, Forces new resource) ID of the asset (the dashboard, analysis, or dataset).
+* `memberType` - (Required, Forces new resource) Type of the member. Valid values are `analysis`, `dashboard`, and `dataset`.
+
+The following arguments are optional:
+
+* `awsAccountId` - (Optional, Forces new resource) AWS account ID.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - A comma-delimited string joining AWS account ID, folder ID, member type, and member ID.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import QuickSight Folder Membership using the AWS account ID, folder ID, member type, and member ID separated by commas (`,`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import QuickSight Folder Membership using the AWS account ID, folder ID, member type, and member ID separated by commas (`,`). For example:
+
+```console
+% terraform import aws_quicksight_folder_membership.example 123456789012,example-folder,DATASET,example-dataset
+```
+
+<!-- cache-key: cdktf-0.18.0 input-d86c3016c2fb02ce6bbff475bfb57b5c2ef1344603d2a5e1e68e88605800f66c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/quicksight_group.html.markdown b/website/docs/cdktf/typescript/r/quicksight_group.html.markdown
new file mode 100644
index 00000000000..05f7506848e
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/quicksight_group.html.markdown
@@ -0,0 +1,74 @@
+---
+subcategory: "QuickSight"
+layout: "aws"
+page_title: "AWS: aws_quicksight_group"
+description: |-
+  Manages a Resource QuickSight Group.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_quicksight_group
+
+Resource for managing QuickSight Group
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { QuicksightGroup } from "./.gen/providers/aws/quicksight-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new QuicksightGroup(this, "example", {
+      groupName: "tf-example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `groupName` - (Required) A name for the group.
+* `awsAccountId` - (Optional) The ID for the AWS account that the group is in. Currently, you use the ID for the AWS account that contains your Amazon QuickSight account.
+* `description` - (Optional) A description for the group.
+* `namespace` - (Optional) The namespace. Currently, you should set this to `default`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of group
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import QuickSight Group using the aws account id, namespace and group name separated by `/`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import QuickSight Group using the aws account id, namespace and group name separated by `/`. For example:
+
+```console
+% terraform import aws_quicksight_group.example 123456789123/default/tf-example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-4b80dc7995b3a3364f054a8bfdf88c630ccdea1d94a035f1e6fe2bcf10868632 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/quicksight_group_membership.html.markdown b/website/docs/cdktf/typescript/r/quicksight_group_membership.html.markdown
new file mode 100644
index 00000000000..c0c41df33b2
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/quicksight_group_membership.html.markdown
@@ -0,0 +1,73 @@
+---
+subcategory: "QuickSight"
+layout: "aws"
+page_title: "AWS: aws_quicksight_group_membership"
+description: |-
+  Manages a Resource QuickSight Group Membership.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_quicksight_group_membership
+
+Resource for managing QuickSight Group Membership
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { QuicksightGroupMembership } from "./.gen/providers/aws/quicksight-group-membership";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new QuicksightGroupMembership(this, "example", {
+      groupName: "all-access-users",
+      memberName: "john_smith",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `groupName` - (Required) The name of the group in which the member will be added.
+* `memberName` - (Required) The name of the member to add to the group.
+* `awsAccountId` - (Optional) The ID for the AWS account that the group is in. Currently, you use the ID for the AWS account that contains your Amazon QuickSight account.
+* `namespace` - (Required) The namespace that you want the user to be a part of. Defaults to `default`.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import QuickSight Group membership using the AWS account ID, namespace, group name and member name separated by `/`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import QuickSight Group membership using the AWS account ID, namespace, group name and member name separated by `/`. For example:
+
+```console
+% terraform import aws_quicksight_group_membership.example 123456789123/default/all-access-users/john_smith
+```
+
+<!-- cache-key: cdktf-0.18.0 input-725ded78aa4f9a51cf1cc232f77bcbabe71212866930b64d5720ec0459e6dc9a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/quicksight_iam_policy_assignment.html.markdown b/website/docs/cdktf/typescript/r/quicksight_iam_policy_assignment.html.markdown
new file mode 100644
index 00000000000..1e53caae697
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/quicksight_iam_policy_assignment.html.markdown
@@ -0,0 +1,94 @@
+---
+subcategory: "QuickSight"
+layout: "aws"
+page_title: "AWS: aws_quicksight_iam_policy_assignment"
+description: |-
+  Terraform resource for managing an AWS QuickSight IAM Policy Assignment.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_quicksight_iam_policy_assignment
+
+Terraform resource for managing an AWS QuickSight IAM Policy Assignment.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { QuicksightIamPolicyAssignment } from "./.gen/providers/aws/quicksight-iam-policy-assignment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new QuicksightIamPolicyAssignment(this, "example", {
+      assignmentName: "example",
+      assignmentStatus: "ENABLED",
+      identities: [
+        {
+          user: [Token.asString(awsQuicksightUserExample.userName)],
+        },
+      ],
+      policyArn: Token.asString(awsIamPolicyExample.arn),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `assignmentName` - (Required) Name of the assignment.
+* `assignmentStatus` - (Required) Status of the assignment. Valid values are `enabled`, `disabled`, and `draft`.
+
+The following arguments are optional:
+
+* `awsAccountId` - (Optional) AWS account ID.
+* `identities` - (Optional) Amazon QuickSight users, groups, or both to assign the policy to. See [`identities`](#identities).
+* `namespace` - (Optional) Namespace that contains the assignment. Defaults to `default`.
+* `policyArn` - (Optional) ARN of the IAM policy to apply to the Amazon QuickSight users and groups specified in this assignment.
+
+### identities
+
+* `groups` - (Optional) Array of Quicksight group names to assign the policy to.
+* `user` - (Optional) Array of Quicksight user names to assign the policy to.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `assignmentId` - Assignment ID.
+* `id` - A comma-delimited string joining AWS account ID, namespace, and assignment name.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import QuickSight IAM Policy Assignment using the AWS account ID, namespace, and assignment name separated by commas (`,`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import QuickSight IAM Policy Assignment using the AWS account ID, namespace, and assignment name separated by commas (`,`). For example:
+
+```console
+% terraform import aws_quicksight_iam_policy_assignment.example 123456789012,default,example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ef52d922a126d93b554f19d053cc37acca38aa991f703b223e6f2532c3d630d9 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/quicksight_ingestion.html.markdown b/website/docs/cdktf/typescript/r/quicksight_ingestion.html.markdown
new file mode 100644
index 00000000000..fc537a163a4
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/quicksight_ingestion.html.markdown
@@ -0,0 +1,83 @@
+---
+subcategory: "QuickSight"
+layout: "aws"
+page_title: "AWS: aws_quicksight_ingestion"
+description: |-
+  Terraform resource for managing an AWS QuickSight Ingestion.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_quicksight_ingestion
+
+Terraform resource for managing an AWS QuickSight Ingestion.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { QuicksightIngestion } from "./.gen/providers/aws/quicksight-ingestion";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new QuicksightIngestion(this, "example", {
+      dataSetId: Token.asString(awsQuicksightDataSetExample.dataSetId),
+      ingestionId: "example-id",
+      ingestionType: "FULL_REFRESH",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `dataSetId` - (Required) ID of the dataset used in the ingestion.
+* `ingestionId` - (Required) ID for the ingestion.
+* `ingestionType` - (Required) Type of ingestion to be created. Valid values are `incrementalRefresh` and `fullRefresh`.
+
+The following arguments are optional:
+
+* `awsAccountId` - (Optional) AWS account ID.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Ingestion.
+* `id` - A comma-delimited string joining AWS account ID, data set ID, and ingestion ID.
+* `ingestionStatus` - Ingestion status.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import QuickSight Ingestion using the AWS account ID, data set ID, and ingestion ID separated by commas (`,`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import QuickSight Ingestion using the AWS account ID, data set ID, and ingestion ID separated by commas (`,`). For example:
+
+```console
+% terraform import aws_quicksight_ingestion.example 123456789012,example-dataset-id,example-ingestion-id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-31d890ca0d6ed00093cbbdafdda99150291ae49c1b91bc06892ea8eaaaf8c038 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/quicksight_namespace.html.markdown b/website/docs/cdktf/typescript/r/quicksight_namespace.html.markdown
new file mode 100644
index 00000000000..1cf824842c4
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/quicksight_namespace.html.markdown
@@ -0,0 +1,90 @@
+---
+subcategory: "QuickSight"
+layout: "aws"
+page_title: "AWS: aws_quicksight_namespace"
+description: |-
+  Terraform resource for managing an AWS QuickSight Namespace.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_quicksight_namespace
+
+Terraform resource for managing an AWS QuickSight Namespace.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { QuicksightNamespace } from "./.gen/providers/aws/quicksight-namespace";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new QuicksightNamespace(this, "example", {
+      namespace: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `namespace` - (Required) Name of the namespace.
+
+The following arguments are optional:
+
+* `awsAccountId` - (Optional) AWS account ID.
+* `identityStore` - (Optional) User identity directory type. Defaults to `quicksight`, the only current valid value.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Namespace.
+* `capacityRegion` - Namespace AWS Region.
+* `creationStatus` - Creation status of the namespace.
+* `id` - A comma-delimited string joining AWS account ID and namespace.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `2M`)
+* `delete` - (Default `2M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import QuickSight Namespace using the AWS account ID and namespace separated by commas (`,`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import QuickSight Namespace using the AWS account ID and namespace separated by commas (`,`). For example:
+
+```console
+% terraform import aws_quicksight_namespace.example 123456789012,example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-beca84265f5d628caa51b3d90e20696177b38adfc69e699a485ae67302774c9f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/quicksight_refresh_schedule.html.markdown b/website/docs/cdktf/typescript/r/quicksight_refresh_schedule.html.markdown
new file mode 100644
index 00000000000..a01c9891f30
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/quicksight_refresh_schedule.html.markdown
@@ -0,0 +1,189 @@
+---
+subcategory: "QuickSight"
+layout: "aws"
+page_title: "AWS: aws_quicksight_refresh_schedule"
+description: |-
+  Manages a Resource QuickSight Refresh Schedule.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_quicksight_refresh_schedule
+
+Resource for managing a QuickSight Refresh Schedule.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { QuicksightRefreshSchedule } from "./.gen/providers/aws/quicksight-refresh-schedule";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new QuicksightRefreshSchedule(this, "example", {
+      dataSetId: "dataset-id",
+      schedule: [
+        {
+          refreshType: "FULL_REFRESH",
+          scheduleFrequency: [
+            {
+              interval: "HOURLY",
+            },
+          ],
+        },
+      ],
+      scheduleId: "schedule-id",
+    });
+  }
+}
+
+```
+
+### With Weekly Refresh
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { QuicksightRefreshSchedule } from "./.gen/providers/aws/quicksight-refresh-schedule";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new QuicksightRefreshSchedule(this, "example", {
+      dataSetId: "dataset-id",
+      schedule: [
+        {
+          refreshType: "INCREMENTAL_REFRESH",
+          scheduleFrequency: [
+            {
+              interval: "WEEKLY",
+              refreshOnDay: [
+                {
+                  dayOfWeek: "MONDAY",
+                },
+              ],
+              timeOfTheDay: "01:00",
+              timezone: "Europe/London",
+            },
+          ],
+        },
+      ],
+      scheduleId: "schedule-id",
+    });
+  }
+}
+
+```
+
+### With Monthly Refresh
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { QuicksightRefreshSchedule } from "./.gen/providers/aws/quicksight-refresh-schedule";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new QuicksightRefreshSchedule(this, "example", {
+      dataSetId: "dataset-id",
+      schedule: [
+        {
+          refreshType: "INCREMENTAL_REFRESH",
+          scheduleFrequency: [
+            {
+              interval: "MONTHLY",
+              refreshOnDay: [
+                {
+                  dayOfMonth: "1",
+                },
+              ],
+              timeOfTheDay: "01:00",
+              timezone: "Europe/London",
+            },
+          ],
+        },
+      ],
+      scheduleId: "schedule-id",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `dataSetId` - (Required, Forces new resource) The ID of the dataset.
+* `scheduleId` - (Required, Forces new resource) The ID of the refresh schedule.
+* `schedule` - (Required) The [refresh schedule](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_RefreshSchedule.html). See [schedule](#schedule)
+
+The following arguments are optional:
+
+* `awsAccountId` - (Optional, Forces new resource) AWS account ID.
+
+### schedule
+
+* `refreshType` - (Required) The type of refresh that the dataset undergoes. Valid values are `incrementalRefresh` and `fullRefresh`.
+* `startAfterDateTime` (Optional) Time after which the refresh schedule can be started, expressed in `yyyyMmDdthh:mm:ss` format.
+* `scheduleFrequency` - (Optional) The configuration of the [schedule frequency](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_RefreshFrequency.html). See [schedule_frequency](#schedule_frequency).
+
+### schedule_frequency
+
+* `interval` - (Required) The interval between scheduled refreshes. Valid values are `minute15`, `minute30`, `hourly`, `daily`, `weekly` and `monthly`.
+* `timeOfTheDay` - (Optional) The time of day that you want the dataset to refresh. This value is expressed in `hh:mm` format. This field is not required for schedules that refresh hourly.
+* `timezone` - (Optional) The timezone that you want the refresh schedule to use.
+* `refreshOnDay` - (Optional) The [refresh on entity](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_ScheduleRefreshOnEntity.html) configuration for weekly or monthly schedules. See [refresh_on_day](#refresh_on_day).
+
+### refresh_on_day
+
+* `dayOfMonth` - (Optional) The day of the month that you want to schedule refresh on.
+* `dayOfWeek` - (Optional) The day of the week that you want to schedule a refresh on. Valid values are `sunday`, `monday`, `tuesday`, `wednesday`, `thursday`, `friday` and `saturday`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the refresh schedule.
+* `id` - A comma-delimited string joining AWS account ID, data set ID & refresh schedule ID.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import a QuickSight Refresh Schedule using the AWS account ID, data set ID and schedule ID separated by commas (`,`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import a QuickSight Refresh Schedule using the AWS account ID, data set ID and schedule ID separated by commas (`,`). For example:
+
+```console
+% terraform import aws_quicksight_refresh_schedule.example 123456789012,dataset-id,schedule-id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-883bce749fc26eb189d4bb33cee6fff44b81f594e4f17aefe99500bd5e24ebe3 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/quicksight_template.html.markdown b/website/docs/cdktf/typescript/r/quicksight_template.html.markdown
new file mode 100644
index 00000000000..1d0af9a585f
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/quicksight_template.html.markdown
@@ -0,0 +1,226 @@
+---
+subcategory: "QuickSight"
+layout: "aws"
+page_title: "AWS: aws_quicksight_template"
+description: |-
+  Manages a QuickSight Template.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_quicksight_template
+
+Resource for managing a QuickSight Template.
+
+## Example Usage
+
+### From Source Template
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { QuicksightTemplate } from "./.gen/providers/aws/quicksight-template";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new QuicksightTemplate(this, "example", {
+      name: "example-name",
+      sourceEntity: {
+        sourceTemplate: {
+          arn: source.arn,
+        },
+      },
+      templateId: "example-id",
+      versionDescription: "version",
+    });
+  }
+}
+
+```
+
+### With Definition
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { QuicksightTemplate } from "./.gen/providers/aws/quicksight-template";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new QuicksightTemplate(this, "example", {
+      definition: {
+        dataSetConfiguration: [
+          {
+            dataSetSchema: {
+              columnSchemaList: [
+                {
+                  dataType: "STRING",
+                  name: "Column1",
+                },
+                {
+                  dataType: "INTEGER",
+                  name: "Column2",
+                },
+              ],
+            },
+            placeholder: "1",
+          },
+        ],
+        sheets: [
+          {
+            sheetId: "Test1",
+            title: "Test",
+            visuals: [
+              {
+                barChartVisual: {
+                  chartConfiguration: {
+                    fieldWells: {
+                      barChartAggregatedFieldWells: {
+                        category: [
+                          {
+                            categoricalDimensionField: {
+                              column: {
+                                columnName: "Column1",
+                                dataSetIdentifier: "1",
+                              },
+                              fieldId: "1",
+                            },
+                          },
+                        ],
+                        values: [
+                          {
+                            numericalMeasureField: {
+                              aggregationFunction: {
+                                simpleNumericalAggregation: "SUM",
+                              },
+                              column: {
+                                columnName: "Column2",
+                                dataSetIdentifier: "1",
+                              },
+                              fieldId: "2",
+                            },
+                          },
+                        ],
+                      },
+                    },
+                  },
+                  visualId: "BarChart",
+                },
+              },
+            ],
+          },
+        ],
+      },
+      name: "example-name",
+      templateId: "example-id",
+      versionDescription: "version",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `templateId` - (Required, Forces new resource) Identifier for the template.
+* `name` - (Required) Display name for the template.
+* `versionDescription` - (Required) A description of the current template version being created/updated.
+
+The following arguments are optional:
+
+* `awsAccountId` - (Optional, Forces new resource) AWS account ID.
+* `definition` - (Optional) A detailed template definition. Only one of `definition` or `sourceEntity` should be configured. See [definition](#definition).
+* `permissions` - (Optional) A set of resource permissions on the template. Maximum of 64 items. See [permissions](#permissions).
+* `sourceEntity` - (Optional) The entity that you are using as a source when you create the template (analysis or template). Only one of `definition` or `sourceEntity` should be configured. See [source_entity](#source_entity).
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### permissions
+
+* `actions` - (Required) List of IAM actions to grant or revoke permissions on.
+* `principal` - (Required) ARN of the principal. See the [ResourcePermission documentation](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_ResourcePermission.html) for the applicable ARN values.
+
+### source_entity
+
+* `sourceAnalysis` - (Optional) The source analysis, if it is based on an analysis.. Only one of `sourceAnalysis` or `sourceTemplate` should be configured. See [source_analysis](#source_analysis).
+* `sourceTemplate` - (Optional) The source template, if it is based on an template.. Only one of `sourceAnalysis` or `sourceTemplate` should be configured. See [source_template](#source_template).
+
+### source_analysis
+
+* `arn` - (Required) The Amazon Resource Name (ARN) of the resource.
+* `dataSetReferences` - (Required) A list of dataset references used as placeholders in the template. See [data_set_references](#data_set_references).
+
+### data_set_references
+
+* `dataSetArn` - (Required) Dataset Amazon Resource Name (ARN).
+* `dataSetPlaceholder` - (Required) Dataset placeholder.
+
+### source_template
+
+* `arn` - (Required) The Amazon Resource Name (ARN) of the resource.
+
+### definition
+
+* `dataSetConfiguration` - (Required) A list of dataset configurations. These configurations define the required columns for each dataset used within a template. See [AWS API Documentation for complete description](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DataSetConfiguration.html).
+* `analysisDefaults` - (Optional) The configuration for default analysis settings. See [AWS API Documentation for complete description](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_AnalysisDefaults.html).
+* `calculatedFields` - (Optional) A list of calculated field definitions for the template. See [AWS API Documentation for complete description](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_CalculatedField.html).
+* `columnConfigurations` - (Optional) A list of template-level column configurations. Column configurations are used to set default formatting for a column that's used throughout a template. See [AWS API Documentation for complete description](ttps://docs.aws.amazon.com/quicksight/latest/APIReference/API_ColumnConfiguration.html).
+* `filterGroups` - (Optional) A list of filter definitions for a template. See [AWS API Documentation for complete description](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_FilterGroup.html). For more information, see [Filtering Data](https://docs.aws.amazon.com/quicksight/latest/user/filtering-visual-data.html) in Amazon QuickSight User Guide.
+* `parametersDeclarations` - (Optional) A list of parameter declarations for a template. Parameters are named variables that can transfer a value for use by an action or an object. See [AWS API Documentation for complete description](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_ParameterDeclaration.html). For more information, see [Parameters in Amazon QuickSight](https://docs.aws.amazon.com/quicksight/latest/user/parameters-in-quicksight.html) in the Amazon QuickSight User Guide.
+* `sheets` - (Optional) A list of sheet definitions for a template. See [AWS API Documentation for complete description](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_SheetDefinition.html).
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the template.
+* `createdTime` - The time that the template was created.
+* `id` - A comma-delimited string joining AWS account ID and template ID.
+* `lastUpdatedTime` - The time that the template was last updated.
+* `sourceEntityArn` - Amazon Resource Name (ARN) of an analysis or template that was used to create this template.
+* `status` - The template creation status.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block).
+* `versionNumber` - The version number of the template version.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `5M`)
+* `update` - (Default `5M`)
+* `delete` - (Default `5M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import a QuickSight Template using the AWS account ID and template ID separated by a comma (`,`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import a QuickSight Template using the AWS account ID and template ID separated by a comma (`,`). For example:
+
+```console
+% terraform import aws_quicksight_template.example 123456789012,example-id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-684fee6425d01e2059464d789630cbb0f5fd11eece6c679b299e9511a988d107 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/quicksight_template_alias.html.markdown b/website/docs/cdktf/typescript/r/quicksight_template_alias.html.markdown
new file mode 100644
index 00000000000..573e93f5e44
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/quicksight_template_alias.html.markdown
@@ -0,0 +1,82 @@
+---
+subcategory: "QuickSight"
+layout: "aws"
+page_title: "AWS: aws_quicksight_template_alias"
+description: |-
+  Terraform resource for managing an AWS QuickSight Template Alias.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_quicksight_template_alias
+
+Terraform resource for managing an AWS QuickSight Template Alias.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { QuicksightTemplateAlias } from "./.gen/providers/aws/quicksight-template-alias";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new QuicksightTemplateAlias(this, "example", {
+      aliasName: "example-alias",
+      templateId: test.templateId,
+      templateVersionNumber: test.versionNumber,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `aliasName` - (Required, Forces new resource) Display name of the template alias.
+* `templateId` - (Required, Forces new resource) ID of the template.
+* `templateVersionNumber` - (Required) Version number of the template.
+
+The following arguments are optional:
+
+* `awsAccountId` - (Optional, Forces new resource) AWS account ID.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the template alias.
+* `id` - A comma-delimited string joining AWS account ID, template ID, and alias name.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import QuickSight Template Alias using the AWS account ID, template ID, and alias name separated by a comma (`,`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import QuickSight Template Alias using the AWS account ID, template ID, and alias name separated by a comma (`,`). For example:
+
+```console
+% terraform import aws_quicksight_template_alias.example 123456789012,example-id,example-alias
+```
+
+<!-- cache-key: cdktf-0.18.0 input-0ef4c7dd40f38e995959bc39fcd14ea01fdf8e036b7c872e0812d2486af788e0 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/quicksight_theme.html.markdown b/website/docs/cdktf/typescript/r/quicksight_theme.html.markdown
new file mode 100644
index 00000000000..bf93fc2fc43
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/quicksight_theme.html.markdown
@@ -0,0 +1,188 @@
+---
+subcategory: "QuickSight"
+layout: "aws"
+page_title: "AWS: aws_quicksight_theme"
+description: |-
+  Manages a QuickSight Theme.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_quicksight_theme
+
+Resource for managing a QuickSight Theme.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { QuicksightTheme } from "./.gen/providers/aws/quicksight-theme";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new QuicksightTheme(this, "example", {
+      baseThemeId: "MIDNIGHT",
+      configuration: {
+        dataColorPalette: {
+          colors: [
+            "#FFFFFF",
+            "#111111",
+            "#222222",
+            "#333333",
+            "#444444",
+            "#555555",
+            "#666666",
+            "#777777",
+            "#888888",
+            "#999999",
+          ],
+          emptyFillColor: "#FFFFFF",
+          minMaxGradient: ["#FFFFFF", "#111111"],
+        },
+      },
+      name: "example",
+      themeId: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `themeId` - (Required, Forces new resource) Identifier of the theme.
+* `baseThemeId` - (Required) The ID of the theme that a custom theme will inherit from. All themes inherit from one of the starting themes defined by Amazon QuickSight. For a list of the starting themes, use ListThemes or choose Themes from within an analysis.
+* `name` - (Required) Display name of the theme.
+* `configuration` - (Required) The theme configuration, which contains the theme display properties. See [configuration](#configuration).
+
+The following arguments are optional:
+
+* `awsAccountId` - (Optional, Forces new resource) AWS account ID.
+* `permissions` - (Optional) A set of resource permissions on the theme. Maximum of 64 items. See [permissions](#permissions).
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `versionDescription` - (Optional) A description of the current theme version being created/updated.
+
+### permissions
+
+* `actions` - (Required) List of IAM actions to grant or revoke permissions on.
+* `principal` - (Required) ARN of the principal. See the [ResourcePermission documentation](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_ResourcePermission.html) for the applicable ARN values.
+
+### configuration
+
+* `dataColorPalette` - (Optional) Color properties that apply to chart data colors. See [data_color_palette](#data_color_palette).
+* `sheet` - (Optional) Display options related to sheets. See [sheet](#sheet).
+* `typography` - (Optional) Determines the typography options. See [typography](#typography).
+* `uiColorPalette` - (Optional) Color properties that apply to the UI and to charts, excluding the colors that apply to data. See [ui_color_palette](#ui_color_palette).
+
+### data_color_palette
+
+* `colors` - (Optional) List of hexadecimal codes for the colors. Minimum of 8 items and maximum of 20 items.
+* `emptyFillColor` - (Optional) The hexadecimal code of a color that applies to charts where a lack of data is highlighted.
+* `minMaxGradient` - (Optional) The minimum and maximum hexadecimal codes that describe a color gradient. List of exactly 2 items.
+
+### sheet
+
+* `tile` - (Optional) The display options for tiles. See [tile](#tile).
+* `tileLayout` - (Optional) The layout options for tiles. See [tile_layout](#tile_layout).
+
+### tile
+
+* `border` - (Optional) The border around a tile. See [border](#border).
+
+### border
+
+* `show` - (Optional) The option to enable display of borders for visuals.
+
+### tile_layout
+
+* `gutter` - (Optional) The gutter settings that apply between tiles. See [gutter](#gutter).
+* `margin` - (Optional) The margin settings that apply around the outside edge of sheets. See [margin](#margin).
+
+### gutter
+
+* `show` - (Optional) This Boolean value controls whether to display a gutter space between sheet tiles.
+
+### margin
+
+* `show` - (Optional) This Boolean value controls whether to display sheet margins.
+
+### typography
+
+* `fontFamilies` - (Optional) Determines the list of font families. Maximum number of 5 items. See [font_families](#font_families).
+
+### font_families
+
+* `fontFamily` - (Optional) Font family name.
+
+### ui_color_palette
+
+* `accent` - (Optional) Color (hexadecimal) that applies to selected states and buttons.
+* `accentForeground` - (Optional) Color (hexadecimal) that applies to any text or other elements that appear over the accent color.
+* `danger` - (Optional) Color (hexadecimal) that applies to error messages.
+* `dangerForeground` - (Optional) Color (hexadecimal) that applies to any text or other elements that appear over the error color.
+* `dimension` - (Optional) Color (hexadecimal) that applies to the names of fields that are identified as dimensions.
+* `dimensionForeground` - (Optional) Color (hexadecimal) that applies to any text or other elements that appear over the dimension color.
+* `measure` - (Optional) Color (hexadecimal) that applies to the names of fields that are identified as measures.
+* `measureForeground` - (Optional) Color (hexadecimal) that applies to any text or other elements that appear over the measure color.
+* `primaryBackground` - (Optional) Color (hexadecimal) that applies to visuals and other high emphasis UI.
+* `primaryForeground` - (Optional) Color (hexadecimal) of text and other foreground elements that appear over the primary background regions, such as grid lines, borders, table banding, icons, and so on.
+* `secondaryBackground` - (Optional) Color (hexadecimal) that applies to the sheet background and sheet controls.
+* `secondaryForeground` - (Optional) Color (hexadecimal) that applies to any sheet title, sheet control text, or UI that appears over the secondary background.
+* `success` - (Optional) Color (hexadecimal) that applies to success messages, for example the check mark for a successful download.
+* `successForeground` - (Optional) Color (hexadecimal) that applies to any text or other elements that appear over the success color.
+* `warning` - (Optional) Color (hexadecimal) that applies to warning and informational messages.
+* `warningForeground` - (Optional) Color (hexadecimal) that applies to any text or other elements that appear over the warning color.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the theme.
+* `createdTime` - The time that the theme was created.
+* `id` - A comma-delimited string joining AWS account ID and theme ID.
+* `lastUpdatedTime` - The time that the theme was last updated.
+* `status` - The theme creation status.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block).
+* `versionNumber` - The version number of the theme version.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `5M`)
+* `update` - (Default `5M`)
+* `delete` - (Default `5M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import a QuickSight Theme using the AWS account ID and theme ID separated by a comma (`,`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import a QuickSight Theme using the AWS account ID and theme ID separated by a comma (`,`). For example:
+
+```console
+% terraform import aws_quicksight_theme.example 123456789012,example-id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-aa652dec5ece740b9a748611a9a30b95144c3c47e65363b38cd20d01eab3af22 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/quicksight_user.html.markdown b/website/docs/cdktf/typescript/r/quicksight_user.html.markdown
new file mode 100644
index 00000000000..00777525b23
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/quicksight_user.html.markdown
@@ -0,0 +1,65 @@
+---
+subcategory: "QuickSight"
+layout: "aws"
+page_title: "AWS: aws_quicksight_user"
+description: |-
+  Manages a Resource QuickSight User.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_quicksight_user
+
+Resource for managing QuickSight User
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { QuicksightUser } from "./.gen/providers/aws/quicksight-user";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new QuicksightUser(this, "example", {
+      email: "author@example.com",
+      iamArn: "arn:aws:iam::123456789012:user/Example",
+      identityType: "IAM",
+      namespace: "foo",
+      sessionName: "an-author",
+      userRole: "AUTHOR",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `email` - (Required) The email address of the user that you want to register.
+* `identityType` - (Required) Amazon QuickSight supports several ways of managing the identity of users. This parameter accepts either  `iam` or `quicksight`. If `iam` is specified, the `iamArn` must also be specified.
+* `userRole` - (Required) The Amazon QuickSight role of the user. The user role can be one of the following: `reader`, `author`, or `admin`
+* `userName` - (Optional) The Amazon QuickSight user name that you want to create for the user you are registering. Only valid for registering a user with `identityType` set to `quicksight`.
+* `awsAccountId` - (Optional) The ID for the AWS account that the user is in. Currently, you use the ID for the AWS account that contains your Amazon QuickSight account.
+* `iamArn` - (Optional) The ARN of the IAM user or role that you are registering with Amazon QuickSight.
+* `namespace`  - (Optional) The Amazon Quicksight namespace to create the user in. Defaults to `default`.
+* `sessionName` - (Optional) The name of the IAM session to use when assuming roles that can embed QuickSight dashboards. Only valid for registering users using an assumed IAM role. Additionally, if registering multiple users using the same IAM role, each user needs to have a unique session name.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the user
+
+## Import
+
+You cannot import this resource.
+
+<!-- cache-key: cdktf-0.18.0 input-9dc8c87fc6da12d6f8933cfaeb31b94be75e8878bade439becdab1a05ff17eaa -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/quicksight_vpc_connection.html.markdown b/website/docs/cdktf/typescript/r/quicksight_vpc_connection.html.markdown
new file mode 100644
index 00000000000..e3b99214371
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/quicksight_vpc_connection.html.markdown
@@ -0,0 +1,138 @@
+---
+subcategory: "QuickSight"
+layout: "aws"
+page_title: "AWS: aws_quicksight_vpc_connection"
+description: |-
+  Terraform resource for managing an AWS QuickSight VPC Connection.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_quicksight_vpc_connection
+
+Terraform resource for managing an AWS QuickSight VPC Connection.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { IamRole } from "./.gen/providers/aws/iam-role";
+import { QuicksightVpcConnection } from "./.gen/providers/aws/quicksight-vpc-connection";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const vpcConnectionRole = new IamRole(this, "vpc_connection_role", {
+      assumeRolePolicy: Token.asString(
+        Fn.jsonencode({
+          Statement: [
+            {
+              Action: "sts:AssumeRole",
+              Effect: "Allow",
+              Principal: {
+                Service: "quicksight.amazonaws.com",
+              },
+            },
+          ],
+          Version: "2012-10-17",
+        })
+      ),
+      inlinePolicy: [
+        {
+          name: "QuickSightVPCConnectionRolePolicy",
+          policy: Token.asString(
+            Fn.jsonencode({
+              Statement: [
+                {
+                  Action: [
+                    "ec2:CreateNetworkInterface",
+                    "ec2:ModifyNetworkInterfaceAttribute",
+                    "ec2:DeleteNetworkInterface",
+                    "ec2:DescribeSubnets",
+                    "ec2:DescribeSecurityGroups",
+                  ],
+                  Effect: "Allow",
+                  Resource: ["*"],
+                },
+              ],
+              Version: "2012-10-17",
+            })
+          ),
+        },
+      ],
+    });
+    new QuicksightVpcConnection(this, "example", {
+      name: "Example Connection",
+      roleArn: vpcConnectionRole.arn,
+      securityGroupIds: ["sg-00000000000000000"],
+      subnetIds: ["subnet-00000000000000000", "subnet-00000000000000001"],
+      vpcConnectionId: "example-connection-id",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `vpcConnectionId` - (Required) The ID of the VPC connection.
+* `name` - (Required) The display name for the VPC connection.
+* `roleArn` - (Required) The IAM role to associate with the VPC connection.
+* `securityGroupIds` - (Required) A list of security group IDs for the VPC connection.
+* `subnetIds` - (Required) A list of subnet IDs for the VPC connection.
+
+The following arguments are optional:
+
+* `awsAccountId` - (Optional) AWS account ID.
+* `dnsResolvers` - (Optional) A list of IP addresses of DNS resolver endpoints for the VPC connection.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the VPC connection.
+* `availabilityStatus` - The availability status of the VPC connection. Valid values are `available`, `unavailable` or `partiallyAvailable`.
+* `id` - A comma-delimited string joining AWS account ID and VPC connection ID.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `5M`)
+* `update` - (Default `5M`)
+* `delete` - (Default `5M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import QuickSight VPC connection using the AWS account ID and VPC connection ID separated by commas (`,`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import QuickSight VPC connection using the AWS account ID and VPC connection ID separated by commas (`,`). For example:
+
+```console
+% terraform import aws_quicksight_vpc_connection.example 123456789012,example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1a701376d2bcc1e947dddba8bc678a08ec6fbb9c8fee2196563da6dc0a40c77f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ram_principal_association.html.markdown b/website/docs/cdktf/typescript/r/ram_principal_association.html.markdown
new file mode 100644
index 00000000000..38eb9f93234
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/ram_principal_association.html.markdown
@@ -0,0 +1,122 @@
+---
+subcategory: "RAM (Resource Access Manager)"
+layout: "aws"
+page_title: "AWS: aws_ram_principal_association"
+description: |-
+  Provides a Resource Access Manager (RAM) principal association.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ram_principal_association
+
+Provides a Resource Access Manager (RAM) principal association. Depending if [RAM Sharing with AWS Organizations is enabled](https://docs.aws.amazon.com/ram/latest/userguide/getting-started-sharing.html#getting-started-sharing-orgs), the RAM behavior with different principal types changes.
+
+When RAM Sharing with AWS Organizations is enabled:
+
+- For AWS Account ID, Organization, and Organizational Unit principals within the same AWS Organization, no resource share invitation is sent and resources become available automatically after creating the association.
+- For AWS Account ID principals outside the AWS Organization, a resource share invitation is sent and must be accepted before resources become available. See the [`awsRamResourceShareAccepter` resource](/docs/providers/aws/r/ram_resource_share_accepter.html) to accept these invitations.
+
+When RAM Sharing with AWS Organizations is not enabled:
+
+- Organization and Organizational Unit principals cannot be used.
+- For AWS Account ID principals, a resource share invitation is sent and must be accepted before resources become available. See the [`awsRamResourceShareAccepter` resource](/docs/providers/aws/r/ram_resource_share_accepter.html) to accept these invitations.
+
+## Example Usage
+
+### AWS Account ID
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { RamPrincipalAssociation } from "./.gen/providers/aws/ram-principal-association";
+import { RamResourceShare } from "./.gen/providers/aws/ram-resource-share";
+interface MyConfig {
+  name: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    const example = new RamResourceShare(this, "example", {
+      allowExternalPrincipals: true,
+      name: config.name,
+    });
+    const awsRamPrincipalAssociationExample = new RamPrincipalAssociation(
+      this,
+      "example_1",
+      {
+        principal: "111111111111",
+        resourceShareArn: example.arn,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsRamPrincipalAssociationExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### AWS Organization
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { RamPrincipalAssociation } from "./.gen/providers/aws/ram-principal-association";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new RamPrincipalAssociation(this, "example", {
+      principal: Token.asString(awsOrganizationsOrganizationExample.arn),
+      resourceShareArn: Token.asString(awsRamResourceShareExample.arn),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `principal` - (Required) The principal to associate with the resource share. Possible values are an AWS account ID, an AWS Organizations Organization ARN, or an AWS Organizations Organization Unit ARN.
+* `resourceShareArn` - (Required) The Amazon Resource Name (ARN) of the resource share.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Amazon Resource Name (ARN) of the Resource Share and the principal, separated by a comma.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import RAM Principal Associations using their Resource Share ARN and the `principal` separated by a comma. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import RAM Principal Associations using their Resource Share ARN and the `principal` separated by a comma. For example:
+
+```console
+% terraform import aws_ram_principal_association.example arn:aws:ram:eu-west-1:123456789012:resource-share/73da1ab9-b94a-4ba3-8eb4-45917f7f4b12,123456789012
+```
+
+<!-- cache-key: cdktf-0.18.0 input-623c2b071e2dcf8be643331968c3fa3f7507a8b07a6370bcf13bd342be258453 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ram_principal_association.markdown b/website/docs/cdktf/typescript/r/ram_principal_association.markdown
new file mode 100644
index 00000000000..38eb9f93234
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/ram_principal_association.markdown
@@ -0,0 +1,122 @@
+---
+subcategory: "RAM (Resource Access Manager)"
+layout: "aws"
+page_title: "AWS: aws_ram_principal_association"
+description: |-
+  Provides a Resource Access Manager (RAM) principal association.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ram_principal_association
+
+Provides a Resource Access Manager (RAM) principal association. Depending if [RAM Sharing with AWS Organizations is enabled](https://docs.aws.amazon.com/ram/latest/userguide/getting-started-sharing.html#getting-started-sharing-orgs), the RAM behavior with different principal types changes.
+
+When RAM Sharing with AWS Organizations is enabled:
+
+- For AWS Account ID, Organization, and Organizational Unit principals within the same AWS Organization, no resource share invitation is sent and resources become available automatically after creating the association.
+- For AWS Account ID principals outside the AWS Organization, a resource share invitation is sent and must be accepted before resources become available. See the [`awsRamResourceShareAccepter` resource](/docs/providers/aws/r/ram_resource_share_accepter.html) to accept these invitations.
+
+When RAM Sharing with AWS Organizations is not enabled:
+
+- Organization and Organizational Unit principals cannot be used.
+- For AWS Account ID principals, a resource share invitation is sent and must be accepted before resources become available. See the [`awsRamResourceShareAccepter` resource](/docs/providers/aws/r/ram_resource_share_accepter.html) to accept these invitations.
+
+## Example Usage
+
+### AWS Account ID
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { RamPrincipalAssociation } from "./.gen/providers/aws/ram-principal-association";
+import { RamResourceShare } from "./.gen/providers/aws/ram-resource-share";
+interface MyConfig {
+  name: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    const example = new RamResourceShare(this, "example", {
+      allowExternalPrincipals: true,
+      name: config.name,
+    });
+    const awsRamPrincipalAssociationExample = new RamPrincipalAssociation(
+      this,
+      "example_1",
+      {
+        principal: "111111111111",
+        resourceShareArn: example.arn,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsRamPrincipalAssociationExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### AWS Organization
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { RamPrincipalAssociation } from "./.gen/providers/aws/ram-principal-association";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new RamPrincipalAssociation(this, "example", {
+      principal: Token.asString(awsOrganizationsOrganizationExample.arn),
+      resourceShareArn: Token.asString(awsRamResourceShareExample.arn),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `principal` - (Required) The principal to associate with the resource share. Possible values are an AWS account ID, an AWS Organizations Organization ARN, or an AWS Organizations Organization Unit ARN.
+* `resourceShareArn` - (Required) The Amazon Resource Name (ARN) of the resource share.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Amazon Resource Name (ARN) of the Resource Share and the principal, separated by a comma.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import RAM Principal Associations using their Resource Share ARN and the `principal` separated by a comma. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import RAM Principal Associations using their Resource Share ARN and the `principal` separated by a comma. For example:
+
+```console
+% terraform import aws_ram_principal_association.example arn:aws:ram:eu-west-1:123456789012:resource-share/73da1ab9-b94a-4ba3-8eb4-45917f7f4b12,123456789012
+```
+
+<!-- cache-key: cdktf-0.18.0 input-623c2b071e2dcf8be643331968c3fa3f7507a8b07a6370bcf13bd342be258453 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ram_resource_association.html.markdown b/website/docs/cdktf/typescript/r/ram_resource_association.html.markdown
new file mode 100644
index 00000000000..7914c3fe62f
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/ram_resource_association.html.markdown
@@ -0,0 +1,75 @@
+---
+subcategory: "RAM (Resource Access Manager)"
+layout: "aws"
+page_title: "AWS: aws_ram_resource_association"
+description: |-
+  Manages a Resource Access Manager (RAM) Resource Association.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ram_resource_association
+
+Manages a Resource Access Manager (RAM) Resource Association.
+
+~> *NOTE:* Certain AWS resources (e.g., EC2 Subnets) can only be shared in an AWS account that is a member of an AWS Organizations organization with organization-wide Resource Access Manager functionality enabled. See the [Resource Access Manager User Guide](https://docs.aws.amazon.com/ram/latest/userguide/what-is.html) and AWS service specific documentation for additional information.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { RamResourceAssociation } from "./.gen/providers/aws/ram-resource-association";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new RamResourceAssociation(this, "example", {
+      resourceArn: Token.asString(awsSubnetExample.arn),
+      resourceShareArn: Token.asString(awsRamResourceShareExample.arn),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `resourceArn` - (Required) Amazon Resource Name (ARN) of the resource to associate with the RAM Resource Share.
+* `resourceShareArn` - (Required) Amazon Resource Name (ARN) of the RAM Resource Share.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Amazon Resource Name (ARN) of the resource share.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import RAM Resource Associations using their Resource Share ARN and Resource ARN separated by a comma. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import RAM Resource Associations using their Resource Share ARN and Resource ARN separated by a comma. For example:
+
+```console
+% terraform import aws_ram_resource_association.example arn:aws:ram:eu-west-1:123456789012:resource-share/73da1ab9-b94a-4ba3-8eb4-45917f7f4b12,arn:aws:ec2:eu-west-1:123456789012:subnet/subnet-12345678
+```
+
+<!-- cache-key: cdktf-0.18.0 input-f89af00a7e0729a1d228ab9768d7122c9cd30990cc8c1dcb4c038628bf33b34d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ram_resource_share.html.markdown b/website/docs/cdktf/typescript/r/ram_resource_share.html.markdown
new file mode 100644
index 00000000000..2a4d74459c5
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/ram_resource_share.html.markdown
@@ -0,0 +1,80 @@
+---
+subcategory: "RAM (Resource Access Manager)"
+layout: "aws"
+page_title: "AWS: aws_ram_resource_share"
+description: |-
+  Manages a Resource Access Manager (RAM) Resource Share.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ram_resource_share
+
+Manages a Resource Access Manager (RAM) Resource Share. To associate principals with the share, see the [`awsRamPrincipalAssociation` resource](/docs/providers/aws/r/ram_principal_association.html). To associate resources with the share, see the [`awsRamResourceAssociation` resource](/docs/providers/aws/r/ram_resource_association.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { RamResourceShare } from "./.gen/providers/aws/ram-resource-share";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new RamResourceShare(this, "example", {
+      allowExternalPrincipals: true,
+      name: "example",
+      tags: {
+        Environment: "Production",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the resource share.
+* `allowExternalPrincipals` - (Optional) Indicates whether principals outside your organization can be associated with a resource share.
+* `permissionArns` - (Optional) Specifies the Amazon Resource Names (ARNs) of the RAM permission to associate with the resource share. If you do not specify an ARN for the permission, RAM automatically attaches the default version of the permission for each resource type. You can associate only one permission with each resource type included in the resource share.
+* `tags` - (Optional) A map of tags to assign to the resource share. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the resource share.
+* `id` - The Amazon Resource Name (ARN) of the resource share.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import resource shares using the `arn` of the resource share. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import resource shares using the `arn` of the resource share. For example:
+
+```console
+% terraform import aws_ram_resource_share.example arn:aws:ram:eu-west-1:123456789012:resource-share/73da1ab9-b94a-4ba3-8eb4-45917f7f4b12
+```
+
+<!-- cache-key: cdktf-0.18.0 input-d1b95a08fc3018c7477d3c340484bf53d1729e6c175ec03ca5c9a53c81d97b1e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ram_resource_share.markdown b/website/docs/cdktf/typescript/r/ram_resource_share.markdown
new file mode 100644
index 00000000000..2a4d74459c5
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/ram_resource_share.markdown
@@ -0,0 +1,80 @@
+---
+subcategory: "RAM (Resource Access Manager)"
+layout: "aws"
+page_title: "AWS: aws_ram_resource_share"
+description: |-
+  Manages a Resource Access Manager (RAM) Resource Share.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ram_resource_share
+
+Manages a Resource Access Manager (RAM) Resource Share. To associate principals with the share, see the [`awsRamPrincipalAssociation` resource](/docs/providers/aws/r/ram_principal_association.html). To associate resources with the share, see the [`awsRamResourceAssociation` resource](/docs/providers/aws/r/ram_resource_association.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { RamResourceShare } from "./.gen/providers/aws/ram-resource-share";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new RamResourceShare(this, "example", {
+      allowExternalPrincipals: true,
+      name: "example",
+      tags: {
+        Environment: "Production",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the resource share.
+* `allowExternalPrincipals` - (Optional) Indicates whether principals outside your organization can be associated with a resource share.
+* `permissionArns` - (Optional) Specifies the Amazon Resource Names (ARNs) of the RAM permission to associate with the resource share. If you do not specify an ARN for the permission, RAM automatically attaches the default version of the permission for each resource type. You can associate only one permission with each resource type included in the resource share.
+* `tags` - (Optional) A map of tags to assign to the resource share. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the resource share.
+* `id` - The Amazon Resource Name (ARN) of the resource share.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import resource shares using the `arn` of the resource share. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import resource shares using the `arn` of the resource share. For example:
+
+```console
+% terraform import aws_ram_resource_share.example arn:aws:ram:eu-west-1:123456789012:resource-share/73da1ab9-b94a-4ba3-8eb4-45917f7f4b12
+```
+
+<!-- cache-key: cdktf-0.18.0 input-d1b95a08fc3018c7477d3c340484bf53d1729e6c175ec03ca5c9a53c81d97b1e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ram_resource_share_accepter.html.markdown b/website/docs/cdktf/typescript/r/ram_resource_share_accepter.html.markdown
new file mode 100644
index 00000000000..c397f10e1f8
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/ram_resource_share_accepter.html.markdown
@@ -0,0 +1,106 @@
+---
+subcategory: "RAM (Resource Access Manager)"
+layout: "aws"
+page_title: "AWS: aws_ram_resource_share_accepter"
+description: |-
+  Manages accepting a Resource Access Manager (RAM) Resource Share invitation.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ram_resource_share_accepter
+
+Manage accepting a Resource Access Manager (RAM) Resource Share invitation. From a _receiver_ AWS account, accept an invitation to share resources that were shared by a _sender_ AWS account. To create a resource share in the _sender_, see the [`awsRamResourceShare` resource](/docs/providers/aws/r/ram_resource_share.html).
+
+~> **Note:** If both AWS accounts are in the same Organization and [RAM Sharing with AWS Organizations is enabled](https://docs.aws.amazon.com/ram/latest/userguide/getting-started-sharing.html#getting-started-sharing-orgs), this resource is not necessary as RAM Resource Share invitations are not used.
+
+## Example Usage
+
+This configuration provides an example of using multiple Terraform AWS providers to configure two different AWS accounts. In the _sender_ account, the configuration creates a `awsRamResourceShare` and uses a data source in the _receiver_ account to create a `awsRamPrincipalAssociation` resource with the _receiver's_ account ID. In the _receiver_ account, the configuration accepts the invitation to share resources with the `awsRamResourceShareAccepter`.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCallerIdentity } from "./.gen/providers/aws/data-aws-caller-identity";
+import { AwsProvider } from "./.gen/providers/aws/provider";
+import { RamPrincipalAssociation } from "./.gen/providers/aws/ram-principal-association";
+import { RamResourceShare } from "./.gen/providers/aws/ram-resource-share";
+import { RamResourceShareAccepter } from "./.gen/providers/aws/ram-resource-share-accepter";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AwsProvider(this, "aws", {
+      profile: "profile2",
+    });
+    const alternate = new AwsProvider(this, "aws_1", {
+      alias: "alternate",
+      profile: "profile1",
+    });
+    const senderShare = new RamResourceShare(this, "sender_share", {
+      allowExternalPrincipals: true,
+      name: "tf-test-resource-share",
+      provider: alternate,
+      tags: {
+        Name: "tf-test-resource-share",
+      },
+    });
+    const receiver = new DataAwsCallerIdentity(this, "receiver", {});
+    const senderInvite = new RamPrincipalAssociation(this, "sender_invite", {
+      principal: Token.asString(receiver.accountId),
+      provider: alternate,
+      resourceShareArn: senderShare.arn,
+    });
+    new RamResourceShareAccepter(this, "receiver_accept", {
+      shareArn: senderInvite.resourceShareArn,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `shareArn` - (Required) The ARN of the resource share.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `invitationArn` - The ARN of the resource share invitation.
+* `shareId` - The ID of the resource share as displayed in the console.
+* `status` - The status of the resource share (ACTIVE, PENDING, FAILED, DELETING, DELETED).
+* `receiverAccountId` - The account ID of the receiver account which accepts the invitation.
+* `senderAccountId` - The account ID of the sender account which submits the invitation.
+* `shareName` - The name of the resource share.
+* `resources` - A list of the resource ARNs shared via the resource share.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import resource share accepters using the resource share ARN. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import resource share accepters using the resource share ARN. For example:
+
+```console
+% terraform import aws_ram_resource_share_accepter.example arn:aws:ram:us-east-1:123456789012:resource-share/c4b56393-e8d9-89d9-6dc9-883752de4767
+```
+
+<!-- cache-key: cdktf-0.18.0 input-20035f07d897cc355e9d9455de1abcd873b5f6ec8141f34f4260f32e299d71a7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ram_resource_share_accepter.markdown b/website/docs/cdktf/typescript/r/ram_resource_share_accepter.markdown
new file mode 100644
index 00000000000..c397f10e1f8
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/ram_resource_share_accepter.markdown
@@ -0,0 +1,106 @@
+---
+subcategory: "RAM (Resource Access Manager)"
+layout: "aws"
+page_title: "AWS: aws_ram_resource_share_accepter"
+description: |-
+  Manages accepting a Resource Access Manager (RAM) Resource Share invitation.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ram_resource_share_accepter
+
+Manage accepting a Resource Access Manager (RAM) Resource Share invitation. From a _receiver_ AWS account, accept an invitation to share resources that were shared by a _sender_ AWS account. To create a resource share in the _sender_, see the [`awsRamResourceShare` resource](/docs/providers/aws/r/ram_resource_share.html).
+
+~> **Note:** If both AWS accounts are in the same Organization and [RAM Sharing with AWS Organizations is enabled](https://docs.aws.amazon.com/ram/latest/userguide/getting-started-sharing.html#getting-started-sharing-orgs), this resource is not necessary as RAM Resource Share invitations are not used.
+
+## Example Usage
+
+This configuration provides an example of using multiple Terraform AWS providers to configure two different AWS accounts. In the _sender_ account, the configuration creates a `awsRamResourceShare` and uses a data source in the _receiver_ account to create a `awsRamPrincipalAssociation` resource with the _receiver's_ account ID. In the _receiver_ account, the configuration accepts the invitation to share resources with the `awsRamResourceShareAccepter`.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCallerIdentity } from "./.gen/providers/aws/data-aws-caller-identity";
+import { AwsProvider } from "./.gen/providers/aws/provider";
+import { RamPrincipalAssociation } from "./.gen/providers/aws/ram-principal-association";
+import { RamResourceShare } from "./.gen/providers/aws/ram-resource-share";
+import { RamResourceShareAccepter } from "./.gen/providers/aws/ram-resource-share-accepter";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AwsProvider(this, "aws", {
+      profile: "profile2",
+    });
+    const alternate = new AwsProvider(this, "aws_1", {
+      alias: "alternate",
+      profile: "profile1",
+    });
+    const senderShare = new RamResourceShare(this, "sender_share", {
+      allowExternalPrincipals: true,
+      name: "tf-test-resource-share",
+      provider: alternate,
+      tags: {
+        Name: "tf-test-resource-share",
+      },
+    });
+    const receiver = new DataAwsCallerIdentity(this, "receiver", {});
+    const senderInvite = new RamPrincipalAssociation(this, "sender_invite", {
+      principal: Token.asString(receiver.accountId),
+      provider: alternate,
+      resourceShareArn: senderShare.arn,
+    });
+    new RamResourceShareAccepter(this, "receiver_accept", {
+      shareArn: senderInvite.resourceShareArn,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `shareArn` - (Required) The ARN of the resource share.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `invitationArn` - The ARN of the resource share invitation.
+* `shareId` - The ID of the resource share as displayed in the console.
+* `status` - The status of the resource share (ACTIVE, PENDING, FAILED, DELETING, DELETED).
+* `receiverAccountId` - The account ID of the receiver account which accepts the invitation.
+* `senderAccountId` - The account ID of the sender account which submits the invitation.
+* `shareName` - The name of the resource share.
+* `resources` - A list of the resource ARNs shared via the resource share.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import resource share accepters using the resource share ARN. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import resource share accepters using the resource share ARN. For example:
+
+```console
+% terraform import aws_ram_resource_share_accepter.example arn:aws:ram:us-east-1:123456789012:resource-share/c4b56393-e8d9-89d9-6dc9-883752de4767
+```
+
+<!-- cache-key: cdktf-0.18.0 input-20035f07d897cc355e9d9455de1abcd873b5f6ec8141f34f4260f32e299d71a7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ram_sharing_with_organization.html.markdown b/website/docs/cdktf/typescript/r/ram_sharing_with_organization.html.markdown
new file mode 100644
index 00000000000..a8bab331a52
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/ram_sharing_with_organization.html.markdown
@@ -0,0 +1,69 @@
+---
+subcategory: "RAM (Resource Access Manager)"
+layout: "aws"
+page_title: "AWS: aws_ram_sharing_with_organization"
+description: |-
+  Manages Resource Access Manager (RAM) Resource Sharing with AWS Organizations.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ram_sharing_with_organization
+
+Manages Resource Access Manager (RAM) Resource Sharing with AWS Organizations. If you enable sharing with your organization, you can share resources without using invitations. Refer to the [AWS RAM user guide](https://docs.aws.amazon.com/ram/latest/userguide/getting-started-sharing.html#getting-started-sharing-orgs) for more details.
+
+~> **NOTE:** Use this resource to manage resource sharing within your organization, **not** the [`awsOrganizationsOrganization`](organizations_organization.html) resource with `ramAmazonawsCom` configured in `awsServiceAccessPrincipals`.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { RamSharingWithOrganization } from "./.gen/providers/aws/ram-sharing-with-organization";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new RamSharingWithOrganization(this, "example", {});
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource does not support any arguments.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - AWS Account ID.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import the resource using the current AWS account ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import the resource using the current AWS account ID. For example:
+
+```console
+% terraform import aws_ram_sharing_with_organization.example 123456789012
+```
+
+<!-- cache-key: cdktf-0.18.0 input-0c4fa7fe1ef6a2bea6e88c0be32053d41d723ebfb97b9b5e06eddaaf8a239ae7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ram_sharing_with_organization.markdown b/website/docs/cdktf/typescript/r/ram_sharing_with_organization.markdown
new file mode 100644
index 00000000000..9be9e43fd4e
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/ram_sharing_with_organization.markdown
@@ -0,0 +1,69 @@
+---
+subcategory: "RAM (Resource Access Manager)"
+layout: "aws"
+page_title: "AWS: aws_ram_sharing_with_organization"
+description: |-
+  Manages Resource Access Manager (RAM) Resource Sharing with AWS Organizations.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ram_sharing_with_organization
+
+Manages Resource Access Manager (RAM) Resource Sharing with AWS Organizations. If you enable sharing with your organization, you can share resources without using invitations. Refer to the [AWS RAM user guide](https://docs.aws.amazon.com/ram/latest/userguide/getting-started-sharing.html#getting-started-sharing-orgs) for more details.
+
+~> **NOTE:** Use this resource to manage resource sharing within your organization, **not** the [`awsOrganizationsOrganization`](organizations_organization.html) resource with `ramAmazonawsCom` configured in `awsServiceAccessPrincipals`.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { RamSharingWithOrganization } from "./.gen/providers/aws/";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new RamSharingWithOrganization(this, "example", {});
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource does not support any arguments.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - AWS Account ID.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import the resource using the current AWS account ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import the resource using the current AWS account ID. For example:
+
+```console
+% terraform import aws_ram_sharing_with_organization.example 123456789012
+```
+
+<!-- cache-key: cdktf-0.18.0 input-0c4fa7fe1ef6a2bea6e88c0be32053d41d723ebfb97b9b5e06eddaaf8a239ae7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/rbin_rule.html.markdown b/website/docs/cdktf/typescript/r/rbin_rule.html.markdown
new file mode 100644
index 00000000000..f5d28313261
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/rbin_rule.html.markdown
@@ -0,0 +1,127 @@
+---
+subcategory: "Recycle Bin (RBin)"
+layout: "aws"
+page_title: "AWS: aws_rbin_rule"
+description: |-
+  Terraform resource for managing an AWS RBin Rule.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_rbin_rule
+
+Terraform resource for managing an AWS RBin Rule.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { RbinRule } from "./.gen/providers/aws/rbin-rule";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new RbinRule(this, "example", {
+      description: "example_rule",
+      resourceTags: [
+        {
+          resourceTagKey: "tag_key",
+          resourceTagValue: "tag_value",
+        },
+      ],
+      resourceType: "EBS_SNAPSHOT",
+      retentionPeriod: {
+        retentionPeriodUnit: "DAYS",
+        retentionPeriodValue: 10,
+      },
+      tags: {
+        test_tag_key: "test_tag_value",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `resourceType` - (Required) The resource type to be retained by the retention rule. Valid values are `ebsSnapshot` and `ec2Image`.
+* `retentionPeriod` - (Required) Information about the retention period for which the retention rule is to retain resources. See [`retentionPeriod`](#retention_period) below.
+
+The following arguments are optional:
+
+* `description` - (Optional) The retention rule description.
+* `resourceTags` - (Optional) Specifies the resource tags to use to identify resources that are to be retained by a tag-level retention rule. See [`resourceTags`](#resource_tags) below.
+* `lockConfiguration` - (Optional) Information about the retention rule lock configuration. See [`lockConfiguration`](#lock_configuration) below.
+
+### retention_period
+
+The following arguments are required:
+
+* `retentionPeriodUnit` - (Required) The unit of time in which the retention period is measured. Currently, only DAYS is supported.
+* `retentionPeriodValue` - (Required) The period value for which the retention rule is to retain resources. The period is measured using the unit specified for RetentionPeriodUnit.
+
+### resource_tags
+
+The following argument is required:
+
+* `resourceTagKey` - (Required) The tag key.
+
+The following argument is optional:
+
+* `resourceTagValue` - (Optional) The tag value.
+
+### lock_configuration
+
+The following argument is required:
+
+* `unlockDelay` - (Required) Information about the retention rule unlock delay. See [`unlockDelay`](#unlock_delay) below.
+
+### unlock_delay
+
+The following arguments are required:
+
+* `unlockDelayUnit` - (Required) The unit of time in which to measure the unlock delay. Currently, the unlock delay can be measure only in days.
+* `unlockDelayValue` - (Required) The unlock delay period, measured in the unit specified for UnlockDelayUnit.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - (String) ID of the Rule.
+* `lockEndTime` - (Timestamp) The date and time at which the unlock delay is set to expire. Only returned for retention rules that have been unlocked and that are still within the unlock delay period.
+* `lockState` - (Optional) The lock state of the retention rules to list. Only retention rules with the specified lock state are returned. Valid values are `locked`, `pendingUnlock`, `unlocked`.
+* `status` - (String) The state of the retention rule. Only retention rules that are in the `available` state retain resources. Valid values include `pending` and `available`.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import RBin Rule using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import RBin Rule using the `id`. For example:
+
+```console
+% terraform import aws_rbin_rule.example examplerule
+```
+
+<!-- cache-key: cdktf-0.18.0 input-fa128f027cec3535b461f4a8bc2a7d6697d0113ab8d96009de17320fb4fdffe0 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/rds_cluster.html.markdown b/website/docs/cdktf/typescript/r/rds_cluster.html.markdown
new file mode 100644
index 00000000000..10e122a1d3b
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/rds_cluster.html.markdown
@@ -0,0 +1,658 @@
+---
+subcategory: "RDS (Relational Database)"
+layout: "aws"
+page_title: "AWS: aws_rds_cluster"
+description: |-
+  Manages an RDS Aurora Cluster
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_rds_cluster
+
+Manages a [RDS Aurora Cluster][2]. To manage cluster instances that inherit configuration from the cluster (when not running the cluster in `serverless` engine mode), see the [`awsRdsClusterInstance` resource](/docs/providers/aws/r/rds_cluster_instance.html). To manage non-Aurora databases (e.g., MySQL, PostgreSQL, SQL Server, etc.), see the [`awsDbInstance` resource](/docs/providers/aws/r/db_instance.html).
+
+For information on the difference between the available Aurora MySQL engines
+see [Comparison between Aurora MySQL 1 and Aurora MySQL 2](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/AuroraMySQL.Updates.20180206.html)
+in the Amazon RDS User Guide.
+
+Changes to an RDS Cluster can occur when you manually change a
+parameter, such as `port`, and are reflected in the next maintenance
+window. Because of this, Terraform may report a difference in its planning
+phase because a modification has not yet taken place. You can use the
+`applyImmediately` flag to instruct the service to apply the change immediately
+(see documentation below).
+
+~> **Note:** using `applyImmediately` can result in a
+brief downtime as the server reboots. See the AWS Docs on [RDS Maintenance][4]
+for more information.
+
+~> **Note:** All arguments including the username and password will be stored in the raw state as plain-text.
+[Read more about sensitive data in state](https://www.terraform.io/docs/state/sensitive-data.html).
+
+~> **NOTE on RDS Clusters and RDS Cluster Role Associations:** Terraform provides both a standalone [RDS Cluster Role Association](rds_cluster_role_association.html) - (an association between an RDS Cluster and a single IAM Role) and
+an RDS Cluster resource with `iamRoles` attributes.
+Use one resource or the other to associate IAM Roles and RDS Clusters.
+Not doing so will cause a conflict of associations and will result in the association being overwritten.
+
+## Example Usage
+
+### Aurora MySQL 2.x (MySQL 5.7)
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { RdsCluster } from "./.gen/providers/aws/rds-cluster";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new RdsCluster(this, "default", {
+      availabilityZones: ["us-west-2a", "us-west-2b", "us-west-2c"],
+      backupRetentionPeriod: 5,
+      clusterIdentifier: "aurora-cluster-demo",
+      databaseName: "mydb",
+      engine: "aurora-mysql",
+      engineVersion: "5.7.mysql_aurora.2.03.2",
+      masterPassword: "bar",
+      masterUsername: "foo",
+      preferredBackupWindow: "07:00-09:00",
+    });
+  }
+}
+
+```
+
+### Aurora MySQL 1.x (MySQL 5.6)
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { RdsCluster } from "./.gen/providers/aws/rds-cluster";
+interface MyConfig {
+  engine: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new RdsCluster(this, "default", {
+      availabilityZones: ["us-west-2a", "us-west-2b", "us-west-2c"],
+      backupRetentionPeriod: 5,
+      clusterIdentifier: "aurora-cluster-demo",
+      databaseName: "mydb",
+      masterPassword: "bar",
+      masterUsername: "foo",
+      preferredBackupWindow: "07:00-09:00",
+      engine: config.engine,
+    });
+  }
+}
+
+```
+
+### Aurora with PostgreSQL engine
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { RdsCluster } from "./.gen/providers/aws/rds-cluster";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new RdsCluster(this, "postgresql", {
+      availabilityZones: ["us-west-2a", "us-west-2b", "us-west-2c"],
+      backupRetentionPeriod: 5,
+      clusterIdentifier: "aurora-cluster-demo",
+      databaseName: "mydb",
+      engine: "aurora-postgresql",
+      masterPassword: "bar",
+      masterUsername: "foo",
+      preferredBackupWindow: "07:00-09:00",
+    });
+  }
+}
+
+```
+
+### Aurora Multi-Master Cluster
+
+-> More information about Aurora Multi-Master Clusters can be found in the [RDS User Guide](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/aurora-multi-master.html).
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { RdsCluster } from "./.gen/providers/aws/rds-cluster";
+interface MyConfig {
+  engine: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new RdsCluster(this, "example", {
+      clusterIdentifier: "example",
+      dbSubnetGroupName: Token.asString(awsDbSubnetGroupExample.name),
+      engineMode: "multimaster",
+      masterPassword: "barbarbarbar",
+      masterUsername: "foo",
+      skipFinalSnapshot: true,
+      engine: config.engine,
+    });
+  }
+}
+
+```
+
+### RDS Multi-AZ Cluster
+
+-> More information about RDS Multi-AZ Clusters can be found in the [RDS User Guide](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/multi-az-db-clusters-concepts.html).
+
+To create a Multi-AZ RDS cluster, you must additionally specify the `engine`, `storageType`, `allocatedStorage`, `iops` and `dbClusterInstanceClass` attributes.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { RdsCluster } from "./.gen/providers/aws/rds-cluster";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new RdsCluster(this, "example", {
+      allocatedStorage: 100,
+      availabilityZones: ["us-west-2a", "us-west-2b", "us-west-2c"],
+      clusterIdentifier: "example",
+      dbClusterInstanceClass: "db.r6gd.xlarge",
+      engine: "mysql",
+      iops: 1000,
+      masterPassword: "mustbeeightcharaters",
+      masterUsername: "test",
+      storageType: "io1",
+    });
+  }
+}
+
+```
+
+### RDS Serverless v2 Cluster
+
+-> More information about RDS Serverless v2 Clusters can be found in the [RDS User Guide](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/aurora-serverless-v2.html).
+
+To create a Serverless v2 RDS cluster, you must additionally specify the `engineMode` and `serverlessv2ScalingConfiguration` attributes. An `awsRdsClusterInstance` resource must also be added to the cluster with the `instanceClass` attribute specified.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { RdsCluster } from "./.gen/providers/aws/rds-cluster";
+import { RdsClusterInstance } from "./.gen/providers/aws/rds-cluster-instance";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new RdsCluster(this, "example", {
+      clusterIdentifier: "example",
+      databaseName: "test",
+      engine: "aurora-postgresql",
+      engineMode: "provisioned",
+      engineVersion: "13.6",
+      masterPassword: "must_be_eight_characters",
+      masterUsername: "test",
+      serverlessv2ScalingConfiguration: {
+        maxCapacity: 1,
+        minCapacity: 0.5,
+      },
+    });
+    const awsRdsClusterInstanceExample = new RdsClusterInstance(
+      this,
+      "example_1",
+      {
+        clusterIdentifier: example.id,
+        engine: example.engine,
+        engineVersion: example.engineVersion,
+        instanceClass: "db.serverless",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsRdsClusterInstanceExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### RDS/Aurora Managed Master Passwords via Secrets Manager, default KMS Key
+
+-> More information about RDS/Aurora Aurora integrates with Secrets Manager to manage master user passwords for your DB clusters can be found in the [RDS User Guide](https://aws.amazon.com/about-aws/whats-new/2022/12/amazon-rds-integration-aws-secrets-manager/) and [Aurora User Guide](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/rds-secrets-manager.html).
+
+You can specify the `manageMasterUserPassword` attribute to enable managing the master password with Secrets Manager. You can also update an existing cluster to use Secrets Manager by specify the `manageMasterUserPassword` attribute and removing the `masterPassword` attribute (removal is required).
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { RdsCluster } from "./.gen/providers/aws/rds-cluster";
+interface MyConfig {
+  engine: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new RdsCluster(this, "test", {
+      clusterIdentifier: "example",
+      databaseName: "test",
+      manageMasterUserPassword: true,
+      masterUsername: "test",
+      engine: config.engine,
+    });
+  }
+}
+
+```
+
+### RDS/Aurora Managed Master Passwords via Secrets Manager, specific KMS Key
+
+-> More information about RDS/Aurora Aurora integrates with Secrets Manager to manage master user passwords for your DB clusters can be found in the [RDS User Guide](https://aws.amazon.com/about-aws/whats-new/2022/12/amazon-rds-integration-aws-secrets-manager/) and [Aurora User Guide](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/rds-secrets-manager.html).
+
+You can specify the `masterUserSecretKmsKeyId` attribute to specify a specific KMS Key.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { KmsKey } from "./.gen/providers/aws/kms-key";
+import { RdsCluster } from "./.gen/providers/aws/rds-cluster";
+interface MyConfig {
+  engine: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    const example = new KmsKey(this, "example", {
+      description: "Example KMS Key",
+    });
+    new RdsCluster(this, "test", {
+      clusterIdentifier: "example",
+      databaseName: "test",
+      manageMasterUserPassword: true,
+      masterUserSecretKmsKeyId: example.keyId,
+      masterUsername: "test",
+      engine: config.engine,
+    });
+  }
+}
+
+```
+
+### Global Cluster Restored From Snapshot
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsDbClusterSnapshot } from "./.gen/providers/aws/data-aws-db-cluster-snapshot";
+import { RdsCluster } from "./.gen/providers/aws/rds-cluster";
+import { RdsGlobalCluster } from "./.gen/providers/aws/rds-global-cluster";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new DataAwsDbClusterSnapshot(this, "example", {
+      dbClusterIdentifier: "example-original-cluster",
+      mostRecent: true,
+    });
+    const awsRdsClusterExample = new RdsCluster(this, "example_1", {
+      clusterIdentifier: "example",
+      engine: "aurora",
+      engineVersion: "5.6.mysql_aurora.1.22.4",
+      lifecycle: {
+        ignoreChanges: [snapshotIdentifier, globalClusterIdentifier],
+      },
+      snapshotIdentifier: Token.asString(example.id),
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsRdsClusterExample.overrideLogicalId("example");
+    const awsRdsGlobalClusterExample = new RdsGlobalCluster(this, "example_2", {
+      forceDestroy: true,
+      globalClusterIdentifier: "example",
+      sourceDbClusterIdentifier: Token.asString(awsRdsClusterExample.arn),
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsRdsGlobalClusterExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+For more detailed documentation about each argument, refer to
+the AWS official documentation :
+
+* [create-db-cluster](https://docs.aws.amazon.com/cli/latest/reference/rds/create-db-cluster.html)
+* [modify-db-cluster](https://docs.aws.amazon.com/cli/latest/reference/rds/modify-db-cluster.html)
+
+This argument supports the following arguments:
+
+* `allocatedStorage` - (Optional, Required for Multi-AZ DB cluster) The amount of storage in gibibytes (GiB) to allocate to each DB instance in the Multi-AZ DB cluster.
+* `allowMajorVersionUpgrade` - (Optional) Enable to allow major engine version upgrades when changing engine versions. Defaults to `false`.
+* `applyImmediately` - (Optional) Specifies whether any cluster modifications are applied immediately, or during the next maintenance window. Default is `false`. See [Amazon RDS Documentation for more information.](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.DBInstance.Modifying.html)
+* `availabilityZones` - (Optional) List of EC2 Availability Zones for the DB cluster storage where DB cluster instances can be created.
+  RDS automatically assigns 3 AZs if less than 3 AZs are configured, which will show as a difference requiring resource recreation next Terraform apply.
+  We recommend specifying 3 AZs or using [the `lifecycle` configuration block `ignoreChanges` argument](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html#ignore_changes) if necessary.
+  A maximum of 3 AZs can be configured.
+* `backtrackWindow` - (Optional) Target backtrack window, in seconds. Only available for `aurora` and `auroraMysql` engines currently. To disable backtracking, set this value to `0`. Defaults to `0`. Must be between `0` and `259200` (72 hours)
+* `backupRetentionPeriod` - (Optional) Days to retain backups for. Default `1`
+* `clusterIdentifierPrefix` - (Optional, Forces new resource) Creates a unique cluster identifier beginning with the specified prefix. Conflicts with `clusterIdentifier`.
+* `clusterIdentifier` - (Optional, Forces new resources) The cluster identifier. If omitted, Terraform will assign a random, unique identifier.
+* `copyTagsToSnapshot` – (Optional, boolean) Copy all Cluster `tags` to snapshots. Default is `false`.
+* `databaseName` - (Optional) Name for an automatically created database on cluster creation. There are different naming restrictions per database engine: [RDS Naming Constraints][5]
+* `dbClusterInstanceClass` - (Optional, Required for Multi-AZ DB cluster) The compute and memory capacity of each DB instance in the Multi-AZ DB cluster, for example `dbM6GXlarge`. Not all DB instance classes are available in all AWS Regions, or for all database engines. For the full list of DB instance classes and availability for your engine, see [DB instance class](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Concepts.DBInstanceClass.html) in the Amazon RDS User Guide.
+* `dbClusterParameterGroupName` - (Optional) A cluster parameter group to associate with the cluster.
+* `dbInstanceParameterGroupName` - (Optional) Instance parameter group to associate with all instances of the DB cluster. The `dbInstanceParameterGroupName` parameter is only valid in combination with the `allowMajorVersionUpgrade` parameter.
+* `dbSubnetGroupName` - (Optional) DB subnet group to associate with this DB cluster.
+  **NOTE:** This must match the `dbSubnetGroupName` specified on every [`awsRdsClusterInstance`](/docs/providers/aws/r/rds_cluster_instance.html) in the cluster.
+* `dbSystemId` - (Optional) For use with RDS Custom.
+* `deletionProtection` - (Optional) If the DB cluster should have deletion protection enabled.
+  The database can't be deleted when this value is set to `true`.
+  The default is `false`.
+* `enableGlobalWriteForwarding` - (Optional) Whether cluster should forward writes to an associated global cluster. Applied to secondary clusters to enable them to forward writes to an [`awsRdsGlobalCluster`](/docs/providers/aws/r/rds_global_cluster.html)'s primary cluster. See the [Aurora Userguide documentation](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/aurora-global-database-write-forwarding.html) for more information.
+* `enableHttpEndpoint` - (Optional) Enable HTTP endpoint (data API). Only valid when `engineMode` is set to `serverless`.
+* `enabledCloudwatchLogsExports` - (Optional) Set of log types to export to cloudwatch. If omitted, no logs will be exported. The following log types are supported: `audit`, `error`, `general`, `slowquery`, `postgresql` (PostgreSQL).
+* `engineMode` - (Optional) Database engine mode. Valid values: `global` (only valid for Aurora MySQL 1.21 and earlier), `multimaster`, `parallelquery`, `provisioned`, `serverless`. Defaults to: `provisioned`. See the [RDS User Guide](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/aurora-serverless.html) for limitations when using `serverless`.
+* `engineVersion` - (Optional) Database engine version. Updating this argument results in an outage. See the [Aurora MySQL](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/AuroraMySQL.Updates.html) and [Aurora Postgres](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/AuroraPostgreSQL.Updates.html) documentation for your configured engine to determine this value, or by running `aws rds describe-db-engine-versions`. For example with Aurora MySQL 2, a potential value for this argument is `57MysqlAurora2032`. The value can contain a partial version where supported by the API. The actual engine version used is returned in the attribute `engineVersionActual`, , see [Attribute Reference](#attribute-reference) below.
+* `engine` - (Required) Name of the database engine to be used for this DB cluster. Valid Values: `auroraMysql`, `auroraPostgresql`, `mysql`, `postgres`. (Note that `mysql` and `postgres` are Multi-AZ RDS clusters).
+* `finalSnapshotIdentifier` - (Optional) Name of your final DB snapshot when this DB cluster is deleted. If omitted, no final snapshot will be made.
+* `globalClusterIdentifier` - (Optional) Global cluster identifier specified on [`awsRdsGlobalCluster`](/docs/providers/aws/r/rds_global_cluster.html).
+* `iamDatabaseAuthenticationEnabled` - (Optional) Specifies whether or not mappings of AWS Identity and Access Management (IAM) accounts to database accounts is enabled. Please see [AWS Documentation](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/UsingWithRDS.IAMDBAuth.html) for availability and limitations.
+* `iamRoles` - (Optional) List of ARNs for the IAM roles to associate to the RDS Cluster.
+* `iops` - (Optional) Amount of Provisioned IOPS (input/output operations per second) to be initially allocated for each DB instance in the Multi-AZ DB cluster. For information about valid Iops values, see [Amazon RDS Provisioned IOPS storage to improve performance](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_Storage.html#USER_PIOPS) in the Amazon RDS User Guide. (This setting is required to create a Multi-AZ DB cluster). Must be a multiple between .5 and 50 of the storage amount for the DB cluster.
+* `kmsKeyId` - (Optional) ARN for the KMS encryption key. When specifying `kmsKeyId`, `storageEncrypted` needs to be set to true.
+* `manageMasterUserPassword` - (Optional) Set to true to allow RDS to manage the master user password in Secrets Manager. Cannot be set if `masterPassword` is provided.
+* `masterPassword` - (Required unless `manageMasterUserPassword` is set to true or unless a `snapshotIdentifier` or `replicationSourceIdentifier` is provided or unless a `globalClusterIdentifier` is provided when the cluster is the "secondary" cluster of a global database) Password for the master DB user. Note that this may show up in logs, and it will be stored in the state file. Please refer to the [RDS Naming Constraints][5]. Cannot be set if `manageMasterUserPassword` is set to `true`.
+* `masterUserSecretKmsKeyId` - (Optional) Amazon Web Services KMS key identifier is the key ARN, key ID, alias ARN, or alias name for the KMS key. To use a KMS key in a different Amazon Web Services account, specify the key ARN or alias ARN. If not specified, the default KMS key for your Amazon Web Services account is used.
+* `masterUsername` - (Required unless a `snapshotIdentifier` or `replicationSourceIdentifier` is provided or unless a `globalClusterIdentifier` is provided when the cluster is the "secondary" cluster of a global database) Username for the master DB user. Please refer to the [RDS Naming Constraints][5]. This argument does not support in-place updates and cannot be changed during a restore from snapshot.
+* `networkType` - (Optional) Network type of the cluster. Valid values: `ipv4`, `dual`.
+* `port` - (Optional) Port on which the DB accepts connections
+* `preferredBackupWindow` - (Optional) Daily time range during which automated backups are created if automated backups are enabled using the BackupRetentionPeriod parameter.Time in UTC. Default: A 30-minute window selected at random from an 8-hour block of time per regionE.g., 04:00-09:00
+* `preferredMaintenanceWindow` - (Optional) Weekly time range during which system maintenance can occur, in (UTC) e.g., wed:04:00-wed:04:30
+* `replicationSourceIdentifier` - (Optional) ARN of a source DB cluster or DB instance if this DB cluster is to be created as a Read Replica. If DB Cluster is part of a Global Cluster, use the [`lifecycle` configuration block `ignoreChanges` argument](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html#ignore_changes) to prevent Terraform from showing differences for this argument instead of configuring this value.
+* `restoreToPointInTime` - (Optional) Nested attribute for [point in time restore](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/USER_PIT.html). More details below.
+* `scalingConfiguration` - (Optional) Nested attribute with scaling properties. Only valid when `engineMode` is set to `serverless`. More details below.
+* `serverlessv2ScalingConfiguration`- (Optional) Nested attribute with scaling properties for ServerlessV2. Only valid when `engineMode` is set to `provisioned`. More details below.
+* `skipFinalSnapshot` - (Optional) Determines whether a final DB snapshot is created before the DB cluster is deleted. If true is specified, no DB snapshot is created. If false is specified, a DB snapshot is created before the DB cluster is deleted, using the value from `finalSnapshotIdentifier`. Default is `false`.
+* `snapshotIdentifier` - (Optional) Specifies whether or not to create this cluster from a snapshot. You can use either the name or ARN when specifying a DB cluster snapshot, or the ARN when specifying a DB snapshot. Conflicts with `globalClusterIdentifier`. Clusters cannot be restored from snapshot **and** joined to an existing global cluster in a single operation. See the [AWS documentation](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/aurora-global-database-getting-started.html#aurora-global-database.use-snapshot) or the [Global Cluster Restored From Snapshot example](#global-cluster-restored-from-snapshot) for instructions on building a global cluster starting with a snapshot.
+* `sourceRegion` - (Optional) The source region for an encrypted replica DB cluster.
+* `storageEncrypted` - (Optional) Specifies whether the DB cluster is encrypted. The default is `false` for `provisioned` `engineMode` and `true` for `serverless` `engineMode`. When restoring an unencrypted `snapshotIdentifier`, the `kmsKeyId` argument must be provided to encrypt the restored cluster. Terraform will only perform drift detection if a configuration value is provided.
+* `storageType` - (Optional, Required for Multi-AZ DB cluster) (Forces new for Multi-AZ DB clusters) Specifies the storage type to be associated with the DB cluster. For Aurora DB clusters, `storageType` modifications can be done in-place. For Multi-AZ DB Clusters, the `iops` argument must also be set. Valid values are: `""`, `auroraIopt1` (Aurora DB Clusters); `io1` (Multi-AZ DB Clusters). Default: `""` (Aurora DB Clusters); `io1` (Multi-AZ DB Clusters).
+* `tags` - (Optional) A map of tags to assign to the DB cluster. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `vpcSecurityGroupIds` - (Optional) List of VPC security groups to associate with the Cluster
+
+### S3 Import Options
+
+Full details on the core parameters and impacts are in the API Docs: [RestoreDBClusterFromS3](https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_RestoreDBClusterFromS3.html). Requires that the S3 bucket be in the same region as the RDS cluster you're trying to create. Sample:
+
+~> **NOTE:** RDS Aurora Serverless does not support loading data from S3, so its not possible to directly use `engineMode` set to `serverless` with `s3Import`.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { RdsCluster } from "./.gen/providers/aws/rds-cluster";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new RdsCluster(this, "db", {
+      engine: "aurora",
+      s3Import: {
+        bucketName: "mybucket",
+        bucketPrefix: "backups",
+        ingestionRole:
+          "arn:aws:iam::1234567890:role/role-xtrabackup-rds-restore",
+        sourceEngine: "mysql",
+        sourceEngineVersion: "5.6",
+      },
+    });
+  }
+}
+
+```
+
+* `bucketName` - (Required) Bucket name where your backup is stored
+* `bucketPrefix` - (Optional) Can be blank, but is the path to your backup
+* `ingestionRole` - (Required) Role applied to load the data.
+* `sourceEngine` - (Required) Source engine for the backup
+* `sourceEngineVersion` - (Required) Version of the source engine used to make the backup
+
+This will not recreate the resource if the S3 object changes in some way. It's only used to initialize the database. This only works currently with the aurora engine. See AWS for currently supported engines and options. See [Aurora S3 Migration Docs](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/AuroraMySQL.Migrating.ExtMySQL.html#AuroraMySQL.Migrating.ExtMySQL.S3).
+
+### restore_to_point_in_time Argument Reference
+
+~> **NOTE:**  The DB cluster is created from the source DB cluster with the same configuration as the original DB cluster, except that the new DB cluster is created with the default DB security group. Thus, the following arguments should only be specified with the source DB cluster's respective values: `databaseName`, `masterUsername`, `storageEncrypted`, `replicationSourceIdentifier`, and `sourceRegion`.
+
+Example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { RdsCluster } from "./.gen/providers/aws/rds-cluster";
+interface MyConfig {
+  engine: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new RdsCluster(this, "example-clone", {
+      restoreToPointInTime: {
+        restoreType: "copy-on-write",
+        sourceClusterIdentifier: "example",
+        useLatestRestorableTime: true,
+      },
+      engine: config.engine,
+    });
+  }
+}
+
+```
+
+* `sourceClusterIdentifier` - (Required) Identifier of the source database cluster from which to restore. When restoring from a cluster in another AWS account, the identifier is the ARN of that cluster.
+* `restoreType` - (Optional) Type of restore to be performed.
+   Valid options are `fullCopy` (default) and `copyOnWrite`.
+* `useLatestRestorableTime` - (Optional) Set to true to restore the database cluster to the latest restorable backup time. Defaults to false. Conflicts with `restoreToTime`.
+* `restoreToTime` - (Optional) Date and time in UTC format to restore the database cluster to. Conflicts with `useLatestRestorableTime`.
+
+### scaling_configuration Argument Reference
+
+~> **NOTE:** `scalingConfiguration` configuration is only valid when `engineMode` is set to `serverless`.
+
+Example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { RdsCluster } from "./.gen/providers/aws/rds-cluster";
+interface MyConfig {
+  engine: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new RdsCluster(this, "example", {
+      engineMode: "serverless",
+      scalingConfiguration: {
+        autoPause: true,
+        maxCapacity: 256,
+        minCapacity: 2,
+        secondsUntilAutoPause: 300,
+        timeoutAction: "ForceApplyCapacityChange",
+      },
+      engine: config.engine,
+    });
+  }
+}
+
+```
+
+* `autoPause` - (Optional) Whether to enable automatic pause. A DB cluster can be paused only when it's idle (it has no connections). If a DB cluster is paused for more than seven days, the DB cluster might be backed up with a snapshot. In this case, the DB cluster is restored when there is a request to connect to it. Defaults to `true`.
+* `maxCapacity` - (Optional) Maximum capacity for an Aurora DB cluster in `serverless` DB engine mode. The maximum capacity must be greater than or equal to the minimum capacity. Valid Aurora MySQL capacity values are `1`, `2`, `4`, `8`, `16`, `32`, `64`, `128`, `256`. Valid Aurora PostgreSQL capacity values are (`2`, `4`, `8`, `16`, `32`, `64`, `192`, and `384`). Defaults to `16`.
+* `minCapacity` - (Optional) Minimum capacity for an Aurora DB cluster in `serverless` DB engine mode. The minimum capacity must be lesser than or equal to the maximum capacity. Valid Aurora MySQL capacity values are `1`, `2`, `4`, `8`, `16`, `32`, `64`, `128`, `256`. Valid Aurora PostgreSQL capacity values are (`2`, `4`, `8`, `16`, `32`, `64`, `192`, and `384`). Defaults to `1`.
+* `secondsUntilAutoPause` - (Optional) Time, in seconds, before an Aurora DB cluster in serverless mode is paused. Valid values are `300` through `86400`. Defaults to `300`.
+* `timeoutAction` - (Optional) Action to take when the timeout is reached. Valid values: `forceApplyCapacityChange`, `rollbackCapacityChange`. Defaults to `rollbackCapacityChange`. See [documentation](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/aurora-serverless.how-it-works.html#aurora-serverless.how-it-works.timeout-action).
+
+### serverlessv2_scaling_configuration Argument Reference
+
+~> **NOTE:** serverlessv2_scaling_configuration configuration is only valid when engine_mode is set to provisioned
+
+Example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { RdsCluster } from "./.gen/providers/aws/rds-cluster";
+interface MyConfig {
+  engine: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new RdsCluster(this, "example", {
+      serverlessv2ScalingConfiguration: {
+        maxCapacity: 128,
+        minCapacity: 0.5,
+      },
+      engine: config.engine,
+    });
+  }
+}
+
+```
+
+* `maxCapacity` - (Required) Maximum capacity for an Aurora DB cluster in `provisioned` DB engine mode. The maximum capacity must be greater than or equal to the minimum capacity. Valid capacity values are in a range of `05` up to `128` in steps of `05`.
+* `minCapacity` - (Required) Minimum capacity for an Aurora DB cluster in `provisioned` DB engine mode. The minimum capacity must be lesser than or equal to the maximum capacity. Valid capacity values are in a range of `05` up to `128` in steps of `05`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of cluster
+* `id` - RDS Cluster Identifier
+* `clusterIdentifier` - RDS Cluster Identifier
+* `clusterResourceId` - RDS Cluster Resource ID
+* `clusterMembers` – List of RDS Instances that are a part of this cluster
+* `availabilityZones` - Availability zone of the instance
+* `backupRetentionPeriod` - Backup retention period
+* `preferredBackupWindow` - Daily time range during which the backups happen
+* `preferredMaintenanceWindow` - Maintenance window
+* `endpoint` - DNS address of the RDS instance
+* `readerEndpoint` - Read-only endpoint for the Aurora cluster, automatically
+load-balanced across replicas
+* `engine` - Database engine
+* `engineVersionActual` - Running version of the database.
+* `databaseName` - Database name
+* `port` - Database port
+* `masterUsername` - Master username for the database
+* `masterUserSecret` - Block that specifies the master user secret. Only available when `manageMasterUserPassword` is set to true. [Documented below](#master_user_secret).
+* `storageEncrypted` - Specifies whether the DB cluster is encrypted
+* `replicationSourceIdentifier` - ARN of the source DB cluster or DB instance if this DB cluster is created as a Read Replica.
+* `hostedZoneId` - Route53 Hosted Zone ID of the endpoint
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+[1]: https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.Replication.html
+[2]: https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_Aurora.html
+[3]: /docs/providers/aws/r/rds_cluster_instance.html
+[4]: https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_UpgradeDBInstance.Maintenance.html
+[5]: http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_Limits.html#RDS_Limits.Constraints
+
+### master_user_secret
+
+The `masterUserSecret` configuration block supports the following attributes:
+
+* `kmsKeyId` - Amazon Web Services KMS key identifier that is used to encrypt the secret.
+* `secretArn` - Amazon Resource Name (ARN) of the secret.
+* `secretStatus` - Status of the secret. Valid Values: `creating` | `active` | `rotating` | `impaired`.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `120M`)
+- `update` - (Default `120M`)
+- `delete` - (Default `120M`)
+any cleanup task during the destroying process.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import RDS Clusters using the `clusterIdentifier`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import RDS Clusters using the `clusterIdentifier`. For example:
+
+```console
+% terraform import aws_rds_cluster.aurora_cluster aurora-prod-cluster
+```
+
+<!-- cache-key: cdktf-0.18.0 input-a76812360c43b35e98c5b13afa036fb8cb63cbbf7dbd975d84293aab1f4fed49 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/rds_cluster_activity_stream.html.markdown b/website/docs/cdktf/typescript/r/rds_cluster_activity_stream.html.markdown
new file mode 100644
index 00000000000..26f20c333f5
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/rds_cluster_activity_stream.html.markdown
@@ -0,0 +1,130 @@
+---
+subcategory: "RDS (Relational Database)"
+layout: "aws"
+page_title: "AWS: aws_rds_cluster_activity_stream"
+description: |-
+  Manages RDS Aurora Cluster Database Activity Streams
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_rds_cluster_activity_stream
+
+Manages RDS Aurora Cluster Database Activity Streams.
+
+Database Activity Streams have some limits and requirements, refer to the [Monitoring Amazon Aurora using Database Activity Streams][1] documentation for detailed limitations and requirements.
+
+~> **Note:** This resource always calls the RDS [`startActivityStream`][2] API with the `applyImmediately` parameter set to `true`. This is because the Terraform needs the activity stream to be started in order for it to get the associated attributes.
+
+~> **Note:** This resource depends on having at least one `awsRdsClusterInstance` created. To avoid race conditions when all resources are being created together, add an explicit resource reference using the [resource `dependsOn` meta-argument](https://www.terraform.io/docs/configuration/resources.html#depends_on-explicit-resource-dependencies).
+
+~> **Note:** This resource is available in all regions except the following: `cnNorth1`, `cnNorthwest1`, `usGovEast1`, `usGovWest1`
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { KmsKey } from "./.gen/providers/aws/kms-key";
+import { RdsCluster } from "./.gen/providers/aws/rds-cluster";
+import { RdsClusterActivityStream } from "./.gen/providers/aws/rds-cluster-activity-stream";
+import { RdsClusterInstance } from "./.gen/providers/aws/rds-cluster-instance";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const defaultVar = new KmsKey(this, "default", {
+      description: "AWS KMS Key to encrypt Database Activity Stream",
+    });
+    const awsRdsClusterDefault = new RdsCluster(this, "default_1", {
+      availabilityZones: ["us-west-2a", "us-west-2b", "us-west-2c"],
+      clusterIdentifier: "aurora-cluster-demo",
+      databaseName: "mydb",
+      engine: "aurora-postgresql",
+      engineVersion: "13.4",
+      masterPassword: "mustbeeightcharaters",
+      masterUsername: "foo",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsRdsClusterDefault.overrideLogicalId("default");
+    const awsRdsClusterInstanceDefault = new RdsClusterInstance(
+      this,
+      "default_2",
+      {
+        clusterIdentifier: Token.asString(
+          awsRdsClusterDefault.clusterIdentifier
+        ),
+        engine: Token.asString(awsRdsClusterDefault.engine),
+        identifier: "aurora-instance-demo",
+        instanceClass: "db.r6g.large",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsRdsClusterInstanceDefault.overrideLogicalId("default");
+    const awsRdsClusterActivityStreamDefault = new RdsClusterActivityStream(
+      this,
+      "default_3",
+      {
+        dependsOn: [awsRdsClusterInstanceDefault],
+        kmsKeyId: defaultVar.keyId,
+        mode: "async",
+        resourceArn: Token.asString(awsRdsClusterDefault.arn),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsRdsClusterActivityStreamDefault.overrideLogicalId("default");
+  }
+}
+
+```
+
+## Argument Reference
+
+For more detailed documentation about each argument, refer to
+the [AWS official documentation][3].
+
+This argument supports the following arguments:
+
+* `resourceArn` - (Required, Forces new resources) The Amazon Resource Name (ARN) of the DB cluster.
+* `mode` - (Required, Forces new resources) Specifies the mode of the database activity stream. Database events such as a change or access generate an activity stream event. The database session can handle these events either synchronously or asynchronously. One of: `sync`, `async`.
+* `kmsKeyId` - (Required, Forces new resources) The AWS KMS key identifier for encrypting messages in the database activity stream. The AWS KMS key identifier is the key ARN, key ID, alias ARN, or alias name for the KMS key.
+* `engineNativeAuditFieldsIncluded` - (Optional, Forces new resources) Specifies whether the database activity stream includes engine-native audit fields. This option only applies to an Oracle DB instance. By default, no engine-native audit fields are included. Defaults `false`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Amazon Resource Name (ARN) of the DB cluster.
+* `kinesisStreamName` - The name of the Amazon Kinesis data stream to be used for the database activity stream.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import RDS Aurora Cluster Database Activity Streams using the `resourceArn`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import RDS Aurora Cluster Database Activity Streams using the `resourceArn`. For example:
+
+```console
+% terraform import aws_rds_cluster_activity_stream.default arn:aws:rds:us-west-2:123456789012:cluster:aurora-cluster-demo
+```
+
+[1]: https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/DBActivityStreams.html
+[2]: https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_StartActivityStream.html
+[3]: https://docs.aws.amazon.com/cli/latest/reference/rds/start-activity-stream.html
+
+<!-- cache-key: cdktf-0.18.0 input-fcf3731d612996fd4027d7e88ab025bc39f9569cb19372c8fee944d11a24a797 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/rds_cluster_endpoint.html.markdown b/website/docs/cdktf/typescript/r/rds_cluster_endpoint.html.markdown
new file mode 100644
index 00000000000..af5434f38ab
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/rds_cluster_endpoint.html.markdown
@@ -0,0 +1,133 @@
+---
+subcategory: "RDS (Relational Database)"
+layout: "aws"
+page_title: "AWS: aws_rds_cluster_endpoint"
+description: |-
+  Manages an RDS Aurora Cluster Endpoint
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_rds_cluster_endpoint
+
+Manages an RDS Aurora Cluster Endpoint.
+You can refer to the [User Guide][1].
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { RdsCluster } from "./.gen/providers/aws/rds-cluster";
+import { RdsClusterEndpoint } from "./.gen/providers/aws/rds-cluster-endpoint";
+import { RdsClusterInstance } from "./.gen/providers/aws/rds-cluster-instance";
+interface MyConfig {
+  engine: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    const defaultVar = new RdsCluster(this, "default", {
+      availabilityZones: ["us-west-2a", "us-west-2b", "us-west-2c"],
+      backupRetentionPeriod: 5,
+      clusterIdentifier: "aurora-cluster-demo",
+      databaseName: "mydb",
+      masterPassword: "bar",
+      masterUsername: "foo",
+      preferredBackupWindow: "07:00-09:00",
+      engine: config.engine,
+    });
+    const test1 = new RdsClusterInstance(this, "test1", {
+      applyImmediately: true,
+      clusterIdentifier: defaultVar.id,
+      engine: defaultVar.engine,
+      engineVersion: defaultVar.engineVersion,
+      identifier: "test1",
+      instanceClass: "db.t2.small",
+    });
+    const test2 = new RdsClusterInstance(this, "test2", {
+      applyImmediately: true,
+      clusterIdentifier: defaultVar.id,
+      engine: defaultVar.engine,
+      engineVersion: defaultVar.engineVersion,
+      identifier: "test2",
+      instanceClass: "db.t2.small",
+    });
+    const test3 = new RdsClusterInstance(this, "test3", {
+      applyImmediately: true,
+      clusterIdentifier: defaultVar.id,
+      engine: defaultVar.engine,
+      engineVersion: defaultVar.engineVersion,
+      identifier: "test3",
+      instanceClass: "db.t2.small",
+    });
+    new RdsClusterEndpoint(this, "eligible", {
+      clusterEndpointIdentifier: "reader",
+      clusterIdentifier: defaultVar.id,
+      customEndpointType: "READER",
+      excludedMembers: [test1.id, test2.id],
+    });
+    new RdsClusterEndpoint(this, "static", {
+      clusterEndpointIdentifier: "static",
+      clusterIdentifier: defaultVar.id,
+      customEndpointType: "READER",
+      staticMembers: [test1.id, test3.id],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+For more detailed documentation about each argument, refer to
+the [AWS official documentation](https://docs.aws.amazon.com/cli/latest/reference/rds/create-db-cluster-endpoint.html).
+
+This argument supports the following arguments:
+
+* `clusterIdentifier` - (Required, Forces new resources) The cluster identifier.
+* `clusterEndpointIdentifier` - (Required, Forces new resources) The identifier to use for the new endpoint. This parameter is stored as a lowercase string.
+* `customEndpointType` - (Required) The type of the endpoint. One of: READER , ANY .
+* `staticMembers` - (Optional) List of DB instance identifiers that are part of the custom endpoint group. Conflicts with `excludedMembers`.
+* `excludedMembers` - (Optional) List of DB instance identifiers that aren't part of the custom endpoint group. All other eligible instances are reachable through the custom endpoint. Only relevant if the list of static members is empty. Conflicts with `staticMembers`.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of cluster
+* `id` - The RDS Cluster Endpoint Identifier
+* `endpoint` - A custom endpoint for the Aurora cluster
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import RDS Clusters Endpoint using the `clusterEndpointIdentifier`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import RDS Clusters Endpoint using the `clusterEndpointIdentifier`. For example:
+
+```console
+% terraform import aws_rds_cluster_endpoint.custom_reader aurora-prod-cluster-custom-reader
+```
+
+[1]: https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/Aurora.Overview.Endpoints.html#Aurora.Endpoints.Cluster
+
+<!-- cache-key: cdktf-0.18.0 input-434900fb7bad99c986024771dc6f6eede1b08db3846985a86234a5c3c5be241e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/rds_cluster_instance.html.markdown b/website/docs/cdktf/typescript/r/rds_cluster_instance.html.markdown
new file mode 100644
index 00000000000..d0ef4756c36
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/rds_cluster_instance.html.markdown
@@ -0,0 +1,165 @@
+---
+subcategory: "RDS (Relational Database)"
+layout: "aws"
+page_title: "AWS: aws_rds_cluster_instance"
+description: |-
+  Provides an RDS Cluster Resource Instance
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_rds_cluster_instance
+
+Provides an RDS Cluster Instance Resource. A Cluster Instance Resource defines
+attributes that are specific to a single instance in a [RDS Cluster][3],
+specifically running Amazon Aurora.
+
+Unlike other RDS resources that support replication, with Amazon Aurora you do
+not designate a primary and subsequent replicas. Instead, you simply add RDS
+Instances and Aurora manages the replication. You can use the [count][5]
+meta-parameter to make multiple instances and join them all to the same RDS
+Cluster, or you may specify different Cluster Instance resources with various
+`instanceClass` sizes.
+
+For more information on Amazon Aurora, see [Aurora on Amazon RDS][2] in the Amazon RDS User Guide.
+
+~> **NOTE:** Deletion Protection from the RDS service can only be enabled at the cluster level, not for individual cluster instances. You can still add the [`preventDestroy` lifecycle behavior](https://www.terraform.io/language/meta-arguments/lifecycle#prevent_destroy) to your Terraform resource configuration if you desire protection from accidental deletion.
+
+~> **NOTE:** `aurora` is no longer a valid `engine` because of [Amazon Aurora's MySQL-Compatible Edition version 1 end of life](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/Aurora.MySQL56.EOL.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformCount, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { RdsCluster } from "./.gen/providers/aws/rds-cluster";
+import { RdsClusterInstance } from "./.gen/providers/aws/rds-cluster-instance";
+interface MyConfig {
+  engine: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    const defaultVar = new RdsCluster(this, "default", {
+      availabilityZones: ["us-west-2a", "us-west-2b", "us-west-2c"],
+      clusterIdentifier: "aurora-cluster-demo",
+      databaseName: "mydb",
+      masterPassword: "barbut8chars",
+      masterUsername: "foo",
+      engine: config.engine,
+    });
+    /*In most cases loops should be handled in the programming language context and 
+    not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+    you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+    you need to keep this like it is.*/
+    const clusterInstancesCount = TerraformCount.of(Token.asNumber("2"));
+    new RdsClusterInstance(this, "cluster_instances", {
+      clusterIdentifier: defaultVar.id,
+      engine: defaultVar.engine,
+      engineVersion: defaultVar.engineVersion,
+      identifier: "aurora-cluster-demo-${" + clusterInstancesCount.index + "}",
+      instanceClass: "db.r4.large",
+      count: clusterInstancesCount,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+For more detailed documentation about each argument, refer to
+the [AWS official documentation](https://docs.aws.amazon.com/cli/latest/reference/rds/create-db-instance.html).
+
+This argument supports the following arguments:
+
+* `applyImmediately` - (Optional) Specifies whether any database modifications are applied immediately, or during the next maintenance window. Default is`false`.
+* `autoMinorVersionUpgrade` - (Optional) Indicates that minor engine upgrades will be applied automatically to the DB instance during the maintenance window. Default `true`.
+* `availabilityZone` - (Optional, Computed, Forces new resource) EC2 Availability Zone that the DB instance is created in. See [docs](https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_CreateDBInstance.html) about the details.
+* `caCertIdentifier` - (Optional) Identifier of the CA certificate for the DB instance.
+* `clusterIdentifier` - (Required, Forces new resource) Identifier of the [`awsRdsCluster`](/docs/providers/aws/r/rds_cluster.html) in which to launch this instance.
+* `copyTagsToSnapshot` – (Optional, boolean) Indicates whether to copy all of the user-defined tags from the DB instance to snapshots of the DB instance. Default `false`.
+* `customIamInstanceProfile` - (Optional) Instance profile associated with the underlying Amazon EC2 instance of an RDS Custom DB instance.
+* `dbParameterGroupName` - (Optional) Name of the DB parameter group to associate with this instance.
+* `dbSubnetGroupName` - (Required if `publicly_accessible = false`, Optional otherwise, Forces new resource) DB subnet group to associate with this DB instance. **NOTE:** This must match the `dbSubnetGroupName` of the attached [`awsRdsCluster`](/docs/providers/aws/r/rds_cluster.html).
+* `engineVersion` - (Optional) Database engine version.
+* `engine` - (Required, Forces new resource) Name of the database engine to be used for the RDS instance. Valid Values: `auroraMysql`, `auroraPostgresql`, `mysql`, `postgres`.
+* `identifierPrefix` - (Optional, Forces new resource) Creates a unique identifier beginning with the specified prefix. Conflicts with `identifier`.
+* `identifier` - (Optional, Forces new resource) Identifier for the RDS instance, if omitted, Terraform will assign a random, unique identifier.
+* `instanceClass` - (Required) Instance class to use. For details on CPU and memory, see [Scaling Aurora DB Instances][4]. Aurora uses `db.*` instance classes/types. Please see [AWS Documentation][7] for currently available instance classes and complete details.
+* `monitoringInterval` - (Optional) Interval, in seconds, between points when Enhanced Monitoring metrics are collected for the DB instance. To disable collecting Enhanced Monitoring metrics, specify 0. The default is 0. Valid Values: 0, 1, 5, 10, 15, 30, 60.
+* `monitoringRoleArn` - (Optional) ARN for the IAM role that permits RDS to send enhanced monitoring metrics to CloudWatch Logs. You can find more information on the [AWS Documentation](http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Monitoring.html) what IAM permissions are needed to allow Enhanced Monitoring for RDS Instances.
+* `performanceInsightsEnabled` - (Optional) Specifies whether Performance Insights is enabled or not.
+* `performanceInsightsKmsKeyId` - (Optional) ARN for the KMS key to encrypt Performance Insights data. When specifying `performanceInsightsKmsKeyId`, `performanceInsightsEnabled` needs to be set to true.
+* `performanceInsightsRetentionPeriod` - (Optional) Amount of time in days to retain Performance Insights data. Valid values are `7`, `731` (2 years) or a multiple of `31`. When specifying `performanceInsightsRetentionPeriod`, `performanceInsightsEnabled` needs to be set to true. Defaults to '7'.
+* `preferredBackupWindow` - (Optional) Daily time range during which automated backups are created if automated backups are enabled. Eg: "04:00-09:00". **NOTE:** If `preferredBackupWindow` is set at the cluster level, this argument **must** be omitted.
+* `preferredMaintenanceWindow` - (Optional) Window to perform maintenance in. Syntax: "ddd:hh24:mi-ddd:hh24:mi". Eg: "Mon:00:00-Mon:03:00".
+* `promotionTier` - (Optional) Default 0. Failover Priority setting on instance level. The reader who has lower tier has higher priority to get promoted to writer.
+* `publiclyAccessible` - (Optional) Bool to control if instance is publicly accessible. Default `false`. See the documentation on [Creating DB Instances][6] for more details on controlling this property.
+* `tags` - (Optional) Map of tags to assign to the instance. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of cluster instance
+* `clusterIdentifier` - RDS Cluster Identifier
+* `identifier` - Instance identifier
+* `id` - Instance identifier
+* `writer` – Boolean indicating if this instance is writable. `false` indicates this instance is a read replica.
+* `availabilityZone` - Availability zone of the instance
+* `endpoint` - DNS address for this instance. May not be writable
+* `engine` - Database engine
+* `engineVersionActual` - Database engine version
+* `port` - Database port
+* `storageEncrypted` - Specifies whether the DB cluster is encrypted.
+* `kmsKeyId` - ARN for the KMS encryption key if one is set to the cluster.
+* `networkType` - Network type of the DB instance.
+* `dbiResourceId` - Region-unique, immutable identifier for the DB instance.
+* `performanceInsightsEnabled` - Specifies whether Performance Insights is enabled or not.
+* `performanceInsightsKmsKeyId` - ARN for the KMS encryption key used by Performance Insights.
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+[2]: https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_Aurora.html
+[3]: /docs/providers/aws/r/rds_cluster.html
+[4]: https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Aurora.Managing.html
+[5]: https://www.terraform.io/docs/configuration/meta-arguments/count.html
+[6]: https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_CreateDBInstance.html
+[7]: https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Concepts.DBInstanceClass.html
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `90M`)
+- `update` - (Default `90M`)
+- `delete` - (Default `90M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import RDS Cluster Instances using the `identifier`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import RDS Cluster Instances using the `identifier`. For example:
+
+```console
+% terraform import aws_rds_cluster_instance.prod_instance_1 aurora-cluster-instance-1
+```
+
+<!-- cache-key: cdktf-0.18.0 input-78df55554844c35c7b0301574cb78e36bb9d052650f72b31ee4ebbcccc0b9af7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/rds_cluster_parameter_group.html.markdown b/website/docs/cdktf/typescript/r/rds_cluster_parameter_group.html.markdown
new file mode 100644
index 00000000000..1734d5bdf8f
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/rds_cluster_parameter_group.html.markdown
@@ -0,0 +1,101 @@
+---
+subcategory: "RDS (Relational Database)"
+layout: "aws"
+page_title: "AWS: aws_rds_cluster_parameter_group"
+description: |-
+  Provides an RDS DB cluster parameter group resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_rds_cluster_parameter_group
+
+Provides an RDS DB cluster parameter group resource. Documentation of the available parameters for various Aurora engines can be found at:
+
+* [Aurora MySQL Parameters](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/AuroraMySQL.Reference.html)
+* [Aurora PostgreSQL Parameters](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/AuroraPostgreSQL.Reference.html)
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { RdsClusterParameterGroup } from "./.gen/providers/aws/rds-cluster-parameter-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new RdsClusterParameterGroup(this, "default", {
+      description: "RDS default cluster parameter group",
+      family: "aurora5.6",
+      name: "rds-cluster-pg",
+      parameter: [
+        {
+          name: "character_set_server",
+          value: "utf8",
+        },
+        {
+          name: "character_set_client",
+          value: "utf8",
+        },
+      ],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Optional, Forces new resource) The name of the DB cluster parameter group. If omitted, Terraform will assign a random, unique name.
+* `namePrefix` - (Optional, Forces new resource) Creates a unique name beginning with the specified prefix. Conflicts with `name`.
+* `family` - (Required) The family of the DB cluster parameter group.
+* `description` - (Optional) The description of the DB cluster parameter group. Defaults to "Managed by Terraform".
+* `parameter` - (Optional) A list of DB parameters to apply. Note that parameters may differ from a family to an other. Full list of all parameters can be discovered via [`aws rds describe-db-cluster-parameters`](https://docs.aws.amazon.com/cli/latest/reference/rds/describe-db-cluster-parameters.html) after initial creation of the group.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+Parameter blocks support the following:
+
+* `name` - (Required) The name of the DB parameter.
+* `value` - (Required) The value of the DB parameter.
+* `applyMethod` - (Optional) "immediate" (default), or "pending-reboot". Some
+    engines can't apply some parameters without a reboot, and you will need to
+    specify "pending-reboot" here.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The db cluster parameter group name.
+* `arn` - The ARN of the db cluster parameter group.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import RDS Cluster Parameter Groups using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import RDS Cluster Parameter Groups using the `name`. For example:
+
+```console
+% terraform import aws_rds_cluster_parameter_group.cluster_pg production-pg-1
+```
+
+<!-- cache-key: cdktf-0.18.0 input-33eec3977c5897f5b40f1eded02e4088f9efa632caa433fa14e96d5badc226bb -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/rds_cluster_parameter_group.markdown b/website/docs/cdktf/typescript/r/rds_cluster_parameter_group.markdown
new file mode 100644
index 00000000000..1734d5bdf8f
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/rds_cluster_parameter_group.markdown
@@ -0,0 +1,101 @@
+---
+subcategory: "RDS (Relational Database)"
+layout: "aws"
+page_title: "AWS: aws_rds_cluster_parameter_group"
+description: |-
+  Provides an RDS DB cluster parameter group resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_rds_cluster_parameter_group
+
+Provides an RDS DB cluster parameter group resource. Documentation of the available parameters for various Aurora engines can be found at:
+
+* [Aurora MySQL Parameters](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/AuroraMySQL.Reference.html)
+* [Aurora PostgreSQL Parameters](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/AuroraPostgreSQL.Reference.html)
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { RdsClusterParameterGroup } from "./.gen/providers/aws/rds-cluster-parameter-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new RdsClusterParameterGroup(this, "default", {
+      description: "RDS default cluster parameter group",
+      family: "aurora5.6",
+      name: "rds-cluster-pg",
+      parameter: [
+        {
+          name: "character_set_server",
+          value: "utf8",
+        },
+        {
+          name: "character_set_client",
+          value: "utf8",
+        },
+      ],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Optional, Forces new resource) The name of the DB cluster parameter group. If omitted, Terraform will assign a random, unique name.
+* `namePrefix` - (Optional, Forces new resource) Creates a unique name beginning with the specified prefix. Conflicts with `name`.
+* `family` - (Required) The family of the DB cluster parameter group.
+* `description` - (Optional) The description of the DB cluster parameter group. Defaults to "Managed by Terraform".
+* `parameter` - (Optional) A list of DB parameters to apply. Note that parameters may differ from a family to an other. Full list of all parameters can be discovered via [`aws rds describe-db-cluster-parameters`](https://docs.aws.amazon.com/cli/latest/reference/rds/describe-db-cluster-parameters.html) after initial creation of the group.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+Parameter blocks support the following:
+
+* `name` - (Required) The name of the DB parameter.
+* `value` - (Required) The value of the DB parameter.
+* `applyMethod` - (Optional) "immediate" (default), or "pending-reboot". Some
+    engines can't apply some parameters without a reboot, and you will need to
+    specify "pending-reboot" here.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The db cluster parameter group name.
+* `arn` - The ARN of the db cluster parameter group.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import RDS Cluster Parameter Groups using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import RDS Cluster Parameter Groups using the `name`. For example:
+
+```console
+% terraform import aws_rds_cluster_parameter_group.cluster_pg production-pg-1
+```
+
+<!-- cache-key: cdktf-0.18.0 input-33eec3977c5897f5b40f1eded02e4088f9efa632caa433fa14e96d5badc226bb -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/rds_cluster_role_association.html.markdown b/website/docs/cdktf/typescript/r/rds_cluster_role_association.html.markdown
new file mode 100644
index 00000000000..0e0367a5683
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/rds_cluster_role_association.html.markdown
@@ -0,0 +1,85 @@
+---
+subcategory: "RDS (Relational Database)"
+layout: "aws"
+page_title: "AWS: aws_rds_cluster_role_association"
+description: |-
+  Manages a RDS DB Cluster association with an IAM Role.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_rds_cluster_role_association
+
+Manages a RDS DB Cluster association with an IAM Role. Example use cases:
+
+* [Creating an IAM Role to Allow Amazon Aurora to Access AWS Services](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/AuroraMySQL.Integrating.Authorizing.IAM.CreateRole.html)
+* [Importing Amazon S3 Data into an RDS PostgreSQL DB Cluster](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_PostgreSQL.S3Import.html)
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { RdsClusterRoleAssociation } from "./.gen/providers/aws/rds-cluster-role-association";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new RdsClusterRoleAssociation(this, "example", {
+      dbClusterIdentifier: Token.asString(awsRdsClusterExample.id),
+      featureName: "S3_INTEGRATION",
+      roleArn: Token.asString(awsIamRoleExample.arn),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `dbClusterIdentifier` - (Required) DB Cluster Identifier to associate with the IAM Role.
+* `featureName` - (Required) Name of the feature for association. This can be found in the AWS documentation relevant to the integration or a full list is available in the `supportedFeatureNames` list returned by [AWS CLI rds describe-db-engine-versions](https://docs.aws.amazon.com/cli/latest/reference/rds/describe-db-engine-versions.html).
+* `roleArn` - (Required) Amazon Resource Name (ARN) of the IAM Role to associate with the DB Cluster.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - DB Cluster Identifier and IAM Role ARN separated by a comma (`,`)
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `10M`)
+- `delete` - (Default `10M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsRdsClusterRoleAssociation` using the DB Cluster Identifier and IAM Role ARN separated by a comma (`,`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsRdsClusterRoleAssociation` using the DB Cluster Identifier and IAM Role ARN separated by a comma (`,`). For example:
+
+```console
+% terraform import aws_rds_cluster_role_association.example my-db-cluster,arn:aws:iam::123456789012:role/my-role
+```
+
+<!-- cache-key: cdktf-0.18.0 input-f164c7c9d93e5509da4cca9e9ef20bfa3b9c5d4d57057579c41a0162d8f04659 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/rds_custom_db_engine_version.markdown b/website/docs/cdktf/typescript/r/rds_custom_db_engine_version.markdown
new file mode 100644
index 00000000000..d0a975226b8
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/rds_custom_db_engine_version.markdown
@@ -0,0 +1,215 @@
+---
+subcategory: "RDS (Relational Database)"
+layout: "aws"
+page_title: "AWS: aws_rds_custom_db_engine_version"
+description: |-
+  Provides an custom engine version (CEV) resource for Amazon RDS Custom.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_rds_custom_db_engine_version
+
+Provides an custom engine version (CEV) resource for Amazon RDS Custom. For additional information, see [Working with CEVs for RDS Custom for Oracle](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/custom-cev.html) and [Working with CEVs for RDS Custom for SQL Server](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/custom-cev-sqlserver.html) in the the [RDS User Guide](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Welcome.html).
+
+## Example Usage
+
+### RDS Custom for Oracle Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { KmsKey } from "./.gen/providers/aws/kms-key";
+import { RdsCustomDbEngineVersion } from "./.gen/providers/aws/rds-custom-db-engine-version";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new KmsKey(this, "example", {
+      description: "KMS symmetric key for RDS Custom for Oracle",
+    });
+    const awsRdsCustomDbEngineVersionExample = new RdsCustomDbEngineVersion(
+      this,
+      "example_1",
+      {
+        databaseInstallationFilesS3BucketName: "DOC-EXAMPLE-BUCKET",
+        databaseInstallationFilesS3Prefix: "1915_GI/",
+        engine: "custom-oracle-ee-cdb",
+        engineVersion: "19.cdb_cev1",
+        kmsKeyId: example.arn,
+        manifest:
+          '  {\n\t"databaseInstallationFileNames":["V982063-01.zip"]\n  }\n\n',
+        tags: {
+          Key: "value",
+          Name: "example",
+        },
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsRdsCustomDbEngineVersionExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### RDS Custom for Oracle External Manifest Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { KmsKey } from "./.gen/providers/aws/kms-key";
+import { RdsCustomDbEngineVersion } from "./.gen/providers/aws/rds-custom-db-engine-version";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new KmsKey(this, "example", {
+      description: "KMS symmetric key for RDS Custom for Oracle",
+    });
+    const awsRdsCustomDbEngineVersionExample = new RdsCustomDbEngineVersion(
+      this,
+      "example_1",
+      {
+        databaseInstallationFilesS3BucketName: "DOC-EXAMPLE-BUCKET",
+        databaseInstallationFilesS3Prefix: "1915_GI/",
+        engine: "custom-oracle-ee-cdb",
+        engineVersion: "19.cdb_cev1",
+        filename: "manifest_1915_GI.json",
+        kmsKeyId: example.arn,
+        manifestHash: Token.asString(Fn.filebase64sha256(json)),
+        tags: {
+          Key: "value",
+          Name: "example",
+        },
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsRdsCustomDbEngineVersionExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### RDS Custom for SQL Server Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { RdsCustomDbEngineVersion } from "./.gen/providers/aws/rds-custom-db-engine-version";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new RdsCustomDbEngineVersion(this, "test", {
+      engine: "custom-sqlserver-se",
+      engineVersion: "15.00.4249.2.cev-1",
+      sourceImageId: "ami-0aa12345678a12ab1",
+    });
+  }
+}
+
+```
+
+### RDS Custom for SQL Server Usage with AMI from another region
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AmiCopy } from "./.gen/providers/aws/ami-copy";
+import { RdsCustomDbEngineVersion } from "./.gen/providers/aws/rds-custom-db-engine-version";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new AmiCopy(this, "example", {
+      description: "A copy of ami-xxxxxxxx",
+      name: "sqlserver-se-2019-15.00.4249.2",
+      sourceAmiId: "ami-xxxxxxxx",
+      sourceAmiRegion: "us-east-1",
+    });
+    new RdsCustomDbEngineVersion(this, "test", {
+      engine: "custom-sqlserver-se",
+      engineVersion: "15.00.4249.2.cev-1",
+      sourceImageId: example.id,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `databaseInstallationFilesS3BucketName` - (Required) The name of the Amazon S3 bucket that contains the database installation files.
+* `databaseInstallationFilesS3Prefix` - (Required) The prefix for the Amazon S3 bucket that contains the database installation files.
+* `description` - (Optional) The description of the CEV.
+* `engine` - (Required) The name of the database engine. Valid values are `customOracle*`, `customSqlserver*`.
+* `engineVersion` - (Required) The version of the database engine.
+* `filename` - (Optional) The name of the manifest file within the local filesystem. Conflicts with `manifest`.
+* `kmsKeyId` - (Optional) The ARN of the AWS KMS key that is used to encrypt the database installation files. Required for RDS Custom for Oracle.
+* `manifest` - (Optional) The manifest file, in JSON format, that contains the list of database installation files. Conflicts with `filename`.
+* `manifestHash` - (Optional) Used to trigger updates. Must be set to a base64-encoded SHA256 hash of the manifest source specified with `filename`. The usual way to set this is filebase64sha256("manifest.json") where "manifest.json" is the local filename of the manifest source.
+* `status` - (Optional) The status of the CEV. Valid values are `available`, `inactive`, `inactiveExceptRestore`.
+* `sourceImageId` - (Optional) The ID of the AMI to create the CEV from. Required for RDS Custom for SQL Server. For RDS Custom for Oracle, you can specify an AMI ID that was used in a different Oracle CEV.
+* `tags` - (Optional) A mapping of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) for the custom engine version.
+* `createTime` - The date and time that the CEV was created.
+* `dbParameterGroupFamily` - The name of the DB parameter group family for the CEV.
+* `imageId` - The ID of the AMI that was created with the CEV.
+* `majorEngineVersion` - The major version of the database engine.
+* `manifestComputed` - The returned manifest file, in JSON format, service generated and often different from input `manifest`.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `240M`)
+- `update` - (Default `10M`)
+- `delete` - (Default `60M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import custom engine versions for Amazon RDS custom using the `engine` and `engineVersion` separated by a colon (`:`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import custom engine versions for Amazon RDS custom using the `engine` and `engineVersion` separated by a colon (`:`). For example:
+
+```console
+% terraform import aws_rds_custom_db_engine_version.example custom-oracle-ee-cdb:19.cdb_cev1
+```
+
+<!-- cache-key: cdktf-0.18.0 input-dae41bd3880415fe2e096d70a45f580b6bfa6f14fe785ee0edae92bb5abec604 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/rds_export_task.html.markdown b/website/docs/cdktf/typescript/r/rds_export_task.html.markdown
new file mode 100644
index 00000000000..fb23f65952c
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/rds_export_task.html.markdown
@@ -0,0 +1,226 @@
+---
+subcategory: "RDS (Relational Database)"
+layout: "aws"
+page_title: "AWS: aws_rds_export_task"
+description: |-
+  Terraform resource for managing an AWS RDS (Relational Database) Export Task.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_rds_export_task
+
+Terraform resource for managing an AWS RDS (Relational Database) Export Task.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { RdsExportTask } from "./.gen/providers/aws/rds-export-task";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new RdsExportTask(this, "example", {
+      exportTaskIdentifier: "example",
+      iamRoleArn: Token.asString(awsIamRoleExample.arn),
+      kmsKeyId: Token.asString(awsKmsKeyExample.arn),
+      s3BucketName: Token.asString(awsS3BucketExample.id),
+      sourceArn: Token.asString(awsDbSnapshotExample.dbSnapshotArn),
+    });
+  }
+}
+
+```
+
+### Complete Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { DbInstance } from "./.gen/providers/aws/db-instance";
+import { DbSnapshot } from "./.gen/providers/aws/db-snapshot";
+import { IamPolicy } from "./.gen/providers/aws/iam-policy";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+import { IamRolePolicyAttachment } from "./.gen/providers/aws/iam-role-policy-attachment";
+import { KmsKey } from "./.gen/providers/aws/kms-key";
+import { RdsExportTask } from "./.gen/providers/aws/rds-export-task";
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketAcl } from "./.gen/providers/aws/s3-bucket-acl";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new DbInstance(this, "example", {
+      allocatedStorage: 10,
+      dbName: "test",
+      engine: "mysql",
+      engineVersion: "5.7",
+      identifier: "example",
+      instanceClass: "db.t3.micro",
+      parameterGroupName: "default.mysql5.7",
+      password: "foobarbaz",
+      skipFinalSnapshot: true,
+      username: "foo",
+    });
+    const awsDbSnapshotExample = new DbSnapshot(this, "example_1", {
+      dbInstanceIdentifier: example.identifier,
+      dbSnapshotIdentifier: "example",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsDbSnapshotExample.overrideLogicalId("example");
+    const awsIamRoleExample = new IamRole(this, "example_2", {
+      assumeRolePolicy: Token.asString(
+        Fn.jsonencode({
+          Statement: [
+            {
+              Action: "sts:AssumeRole",
+              Effect: "Allow",
+              Principal: {
+                Service: "export.rds.amazonaws.com",
+              },
+              Sid: "",
+            },
+          ],
+          Version: "2012-10-17",
+        })
+      ),
+      name: "example",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamRoleExample.overrideLogicalId("example");
+    const awsKmsKeyExample = new KmsKey(this, "example_3", {
+      deletionWindowInDays: 10,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsKmsKeyExample.overrideLogicalId("example");
+    const awsS3BucketExample = new S3Bucket(this, "example_4", {
+      bucket: "example",
+      forceDestroy: true,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketExample.overrideLogicalId("example");
+    const awsS3BucketAclExample = new S3BucketAcl(this, "example_5", {
+      acl: "private",
+      bucket: Token.asString(awsS3BucketExample.id),
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketAclExample.overrideLogicalId("example");
+    const dataAwsIamPolicyDocumentExample = new DataAwsIamPolicyDocument(
+      this,
+      "example_6",
+      {
+        statement: [
+          {
+            actions: ["s3:ListAllMyBuckets"],
+            resources: ["*"],
+          },
+          {
+            actions: ["s3:GetBucketLocation", "s3:ListBucket"],
+            resources: [Token.asString(awsS3BucketExample.arn)],
+          },
+          {
+            actions: ["s3:GetObject", "s3:PutObject", "s3:DeleteObject"],
+            resources: ["${" + awsS3BucketExample.arn + "}/*"],
+          },
+        ],
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsIamPolicyDocumentExample.overrideLogicalId("example");
+    const awsIamPolicyExample = new IamPolicy(this, "example_7", {
+      name: "example",
+      policy: Token.asString(dataAwsIamPolicyDocumentExample.json),
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamPolicyExample.overrideLogicalId("example");
+    const awsIamRolePolicyAttachmentExample = new IamRolePolicyAttachment(
+      this,
+      "example_8",
+      {
+        policyArn: Token.asString(awsIamPolicyExample.arn),
+        role: Token.asString(awsIamRoleExample.name),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamRolePolicyAttachmentExample.overrideLogicalId("example");
+    const awsRdsExportTaskExample = new RdsExportTask(this, "example_9", {
+      exportOnly: ["database"],
+      exportTaskIdentifier: "example",
+      iamRoleArn: Token.asString(awsIamRoleExample.arn),
+      kmsKeyId: Token.asString(awsKmsKeyExample.arn),
+      s3BucketName: Token.asString(awsS3BucketExample.id),
+      s3Prefix: "my_prefix/example",
+      sourceArn: Token.asString(awsDbSnapshotExample.dbSnapshotArn),
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsRdsExportTaskExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `exportTaskIdentifier` - (Required) Unique identifier for the snapshot export task.
+* `iamRoleArn` - (Required) ARN of the IAM role to use for writing to the Amazon S3 bucket.
+* `kmsKeyId` - (Required) ID of the Amazon Web Services KMS key to use to encrypt the snapshot.
+* `s3BucketName` - (Required) Name of the Amazon S3 bucket to export the snapshot to.
+* `sourceArn` - (Required) Amazon Resource Name (ARN) of the snapshot to export.
+
+The following arguments are optional:
+
+* `exportOnly` - (Optional) Data to be exported from the snapshot. If this parameter is not provided, all the snapshot data is exported. Valid values are documented in the [AWS StartExportTask API documentation](https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_StartExportTask.html#API_StartExportTask_RequestParameters).
+* `s3Prefix` - (Optional) Amazon S3 bucket prefix to use as the file name and path of the exported snapshot.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `failureCause` - Reason the export failed, if it failed.
+* `id` - Unique identifier for the snapshot export task (same value as `exportTaskIdentifier`).
+* `percentProgress` - Progress of the snapshot export task as a percentage.
+* `snapshotTime` - Time that the snapshot was created.
+* `sourceType` - Type of source for the export.
+* `status` - Status of the export task.
+* `taskEndTime` - Time that the snapshot export task completed.
+* `taskStartTime` - Time that the snapshot export task started.
+* `warningMessage` - Warning about the snapshot export task, if any.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import a RDS (Relational Database) Export Task using the `exportTaskIdentifier`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import a RDS (Relational Database) Export Task using the `exportTaskIdentifier`. For example:
+
+```console
+% terraform import aws_rds_export_task.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-85f7fbc39b14c8bc604a74daa69a5c20b76d661a4af3a134d17931198e7cd32a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/rds_global_cluster.html.markdown b/website/docs/cdktf/typescript/r/rds_global_cluster.html.markdown
new file mode 100644
index 00000000000..a984cd6aaf2
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/rds_global_cluster.html.markdown
@@ -0,0 +1,360 @@
+---
+subcategory: "RDS (Relational Database)"
+layout: "aws"
+page_title: "AWS: aws_rds_global_cluster"
+description: |-
+  Manages an RDS Global Cluster
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_rds_global_cluster
+
+Manages an RDS Global Cluster, which is an Aurora global database spread across multiple regions. The global database contains a single primary cluster with read-write capability, and a read-only secondary cluster that receives data from the primary cluster through high-speed replication performed by the Aurora storage subsystem.
+
+More information about Aurora global databases can be found in the [Aurora User Guide](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/aurora-global-database.html#aurora-global-database-creating).
+
+## Example Usage
+
+### New MySQL Global Cluster
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { RdsCluster } from "./.gen/providers/aws/rds-cluster";
+import { RdsClusterInstance } from "./.gen/providers/aws/rds-cluster-instance";
+import { RdsGlobalCluster } from "./.gen/providers/aws/rds-global-cluster";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new RdsGlobalCluster(this, "example", {
+      databaseName: "example_db",
+      engine: "aurora",
+      engineVersion: "5.6.mysql_aurora.1.22.2",
+      globalClusterIdentifier: "global-test",
+    });
+    const primary = new RdsCluster(this, "primary", {
+      clusterIdentifier: "test-primary-cluster",
+      databaseName: "example_db",
+      dbSubnetGroupName: "default",
+      engine: example.engine,
+      engineVersion: example.engineVersion,
+      globalClusterIdentifier: example.id,
+      masterPassword: "somepass123",
+      masterUsername: "username",
+      provider: awsPrimary,
+    });
+    const awsRdsClusterInstancePrimary = new RdsClusterInstance(
+      this,
+      "primary_2",
+      {
+        clusterIdentifier: primary.id,
+        dbSubnetGroupName: "default",
+        engine: example.engine,
+        engineVersion: example.engineVersion,
+        identifier: "test-primary-cluster-instance",
+        instanceClass: "db.r4.large",
+        provider: awsPrimary,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsRdsClusterInstancePrimary.overrideLogicalId("primary");
+    const secondary = new RdsCluster(this, "secondary", {
+      clusterIdentifier: "test-secondary-cluster",
+      dbSubnetGroupName: "default",
+      dependsOn: [awsRdsClusterInstancePrimary],
+      engine: example.engine,
+      engineVersion: example.engineVersion,
+      globalClusterIdentifier: example.id,
+      provider: awsSecondary,
+    });
+    const awsRdsClusterInstanceSecondary = new RdsClusterInstance(
+      this,
+      "secondary_4",
+      {
+        clusterIdentifier: secondary.id,
+        dbSubnetGroupName: "default",
+        engine: example.engine,
+        engineVersion: example.engineVersion,
+        identifier: "test-secondary-cluster-instance",
+        instanceClass: "db.r4.large",
+        provider: awsSecondary,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsRdsClusterInstanceSecondary.overrideLogicalId("secondary");
+  }
+}
+
+```
+
+### New PostgreSQL Global Cluster
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AwsProvider } from "./.gen/providers/aws/provider";
+import { RdsCluster } from "./.gen/providers/aws/rds-cluster";
+import { RdsClusterInstance } from "./.gen/providers/aws/rds-cluster-instance";
+import { RdsGlobalCluster } from "./.gen/providers/aws/rds-global-cluster";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const primary = new AwsProvider(this, "aws", {
+      alias: "primary",
+      region: "us-east-2",
+    });
+    const secondary = new AwsProvider(this, "aws_1", {
+      alias: "secondary",
+      region: "us-east-1",
+    });
+    const example = new RdsGlobalCluster(this, "example", {
+      databaseName: "example_db",
+      engine: "aurora-postgresql",
+      engineVersion: "11.9",
+      globalClusterIdentifier: "global-test",
+    });
+    const awsRdsClusterPrimary = new RdsCluster(this, "primary", {
+      clusterIdentifier: "test-primary-cluster",
+      databaseName: "example_db",
+      dbSubnetGroupName: "default",
+      engine: example.engine,
+      engineVersion: example.engineVersion,
+      globalClusterIdentifier: example.id,
+      masterPassword: "somepass123",
+      masterUsername: "username",
+      provider: primary,
+    });
+    const awsRdsClusterInstancePrimary = new RdsClusterInstance(
+      this,
+      "primary_4",
+      {
+        clusterIdentifier: Token.asString(awsRdsClusterPrimary.id),
+        dbSubnetGroupName: "default",
+        engine: example.engine,
+        engineVersion: example.engineVersion,
+        identifier: "test-primary-cluster-instance",
+        instanceClass: "db.r4.large",
+        provider: primary,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsRdsClusterInstancePrimary.overrideLogicalId("primary");
+    const awsRdsClusterSecondary = new RdsCluster(this, "secondary", {
+      clusterIdentifier: "test-secondary-cluster",
+      dbSubnetGroupName: "default",
+      dependsOn: [awsRdsClusterInstancePrimary],
+      engine: example.engine,
+      engineVersion: example.engineVersion,
+      globalClusterIdentifier: example.id,
+      provider: secondary,
+      skipFinalSnapshot: true,
+    });
+    const awsRdsClusterInstanceSecondary = new RdsClusterInstance(
+      this,
+      "secondary_6",
+      {
+        clusterIdentifier: Token.asString(awsRdsClusterSecondary.id),
+        dbSubnetGroupName: "default",
+        engine: example.engine,
+        engineVersion: example.engineVersion,
+        identifier: "test-secondary-cluster-instance",
+        instanceClass: "db.r4.large",
+        provider: secondary,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsRdsClusterInstanceSecondary.overrideLogicalId("secondary");
+  }
+}
+
+```
+
+### New Global Cluster From Existing DB Cluster
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { RdsCluster } from "./.gen/providers/aws/rds-cluster";
+import { RdsGlobalCluster } from "./.gen/providers/aws/rds-global-cluster";
+interface MyConfig {
+  engine: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    const example = new RdsCluster(this, "example", {
+      lifecycle: {
+        ignoreChanges: [globalClusterIdentifier],
+      },
+      engine: config.engine,
+    });
+    const awsRdsGlobalClusterExample = new RdsGlobalCluster(this, "example_1", {
+      forceDestroy: true,
+      globalClusterIdentifier: "example",
+      sourceDbClusterIdentifier: example.arn,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsRdsGlobalClusterExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### Upgrading Engine Versions
+
+When you upgrade the version of an `awsRdsGlobalCluster`, Terraform will attempt to in-place upgrade the engine versions of all associated clusters. Since the `awsRdsCluster` resource is being updated through the `awsRdsGlobalCluster`, you are likely to get an error (`Provider produced inconsistent final plan`). To avoid this, use the `lifecycle` `ignoreChanges` meta argument as shown below on the `awsRdsCluster`.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { RdsCluster } from "./.gen/providers/aws/rds-cluster";
+import { RdsClusterInstance } from "./.gen/providers/aws/rds-cluster-instance";
+import { RdsGlobalCluster } from "./.gen/providers/aws/rds-global-cluster";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new RdsGlobalCluster(this, "example", {
+      engine: "aurora-mysql",
+      engineVersion: "5.7.mysql_aurora.2.07.5",
+      globalClusterIdentifier: "kyivkharkiv",
+    });
+    const primary = new RdsCluster(this, "primary", {
+      allowMajorVersionUpgrade: true,
+      applyImmediately: true,
+      clusterIdentifier: "odessadnipro",
+      databaseName: "totoro",
+      engine: example.engine,
+      engineVersion: example.engineVersion,
+      globalClusterIdentifier: example.id,
+      lifecycle: {
+        ignoreChanges: [engineVersion],
+      },
+      masterPassword: "satsukimae",
+      masterUsername: "maesatsuki",
+      skipFinalSnapshot: true,
+    });
+    const awsRdsClusterInstancePrimary = new RdsClusterInstance(
+      this,
+      "primary_2",
+      {
+        applyImmediately: true,
+        clusterIdentifier: primary.id,
+        engine: primary.engine,
+        engineVersion: primary.engineVersion,
+        identifier: "donetsklviv",
+        instanceClass: "db.r4.large",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsRdsClusterInstancePrimary.overrideLogicalId("primary");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `globalClusterIdentifier` - (Required, Forces new resources) Global cluster identifier.
+* `databaseName` - (Optional, Forces new resources) Name for an automatically created database on cluster creation.
+* `deletionProtection` - (Optional) If the Global Cluster should have deletion protection enabled. The database can't be deleted when this value is set to `true`. The default is `false`.
+* `engine` - (Optional, Forces new resources) Name of the database engine to be used for this DB cluster. Terraform will only perform drift detection if a configuration value is provided. Valid values: `aurora`, `auroraMysql`, `auroraPostgresql`. Defaults to `aurora`. Conflicts with `sourceDbClusterIdentifier`.
+* `engineVersion` - (Optional) Engine version of the Aurora global database. The `engine`, `engineVersion`, and `instanceClass` (on the `awsRdsClusterInstance`) must together support global databases. See [Using Amazon Aurora global databases](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/aurora-global-database.html) for more information. By upgrading the engine version, Terraform will upgrade cluster members. **NOTE:** To avoid an `inconsistent final plan` error while upgrading, use the `lifecycle` `ignoreChanges` for `engineVersion` meta argument on the associated `awsRdsCluster` resource as shown above in [Upgrading Engine Versions](#upgrading-engine-versions) example.
+* `forceDestroy` - (Optional) Enable to remove DB Cluster members from Global Cluster on destroy. Required with `sourceDbClusterIdentifier`.
+* `sourceDbClusterIdentifier` - (Optional) Amazon Resource Name (ARN) to use as the primary DB Cluster of the Global Cluster on creation. Terraform cannot perform drift detection of this value.
+* `storageEncrypted` - (Optional, Forces new resources) Specifies whether the DB cluster is encrypted. The default is `false` unless `sourceDbClusterIdentifier` is specified and encrypted. Terraform will only perform drift detection if a configuration value is provided.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - RDS Global Cluster Amazon Resource Name (ARN)
+* `globalClusterMembers` - Set of objects containing Global Cluster members.
+    * `dbClusterArn` - Amazon Resource Name (ARN) of member DB Cluster
+    * `isWriter` - Whether the member is the primary DB Cluster
+* `globalClusterResourceId` - AWS Region-unique, immutable identifier for the global database cluster. This identifier is found in AWS CloudTrail log entries whenever the AWS KMS key for the DB cluster is accessed
+* `id` - RDS Global Cluster identifier
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `30M`)
+- `update` - (Default `90M`)
+- `delete` - (Default `30M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsRdsGlobalCluster` using the RDS Global Cluster identifier. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsRdsGlobalCluster` using the RDS Global Cluster identifier. For example:
+
+```console
+% terraform import aws_rds_global_cluster.example example
+```
+
+Certain resource arguments, like `forceDestroy`, only exist within Terraform. If the argument is set in the Terraform configuration on an imported resource, Terraform will show a difference on the first plan after import to update the state value. This change is safe to apply immediately so the state matches the desired configuration.
+
+Certain resource arguments, like `sourceDbClusterIdentifier`, do not have an API method for reading the information after creation. If the argument is set in the Terraform configuration on an imported resource, Terraform will always show a difference. To workaround this behavior, either omit the argument from the Terraform configuration or use [`ignoreChanges`](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html#ignore_changes) to hide the difference. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { RdsGlobalCluster } from "./.gen/providers/aws/rds-global-cluster";
+interface MyConfig {
+  globalClusterIdentifier: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new RdsGlobalCluster(this, "example", {
+      lifecycle: {
+        ignoreChanges: [sourceDbClusterIdentifier],
+      },
+      globalClusterIdentifier: config.globalClusterIdentifier,
+    });
+  }
+}
+
+```
+
+<!-- cache-key: cdktf-0.18.0 input-fa44dd874493ca45cccbd24a626a6b3f65869bfad4964390e5844ded01172f4f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/rds_reserved_instance.html.markdown b/website/docs/cdktf/typescript/r/rds_reserved_instance.html.markdown
new file mode 100644
index 00000000000..177e607b2e9
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/rds_reserved_instance.html.markdown
@@ -0,0 +1,113 @@
+---
+subcategory: "RDS (Relational Database)"
+layout: "aws"
+page_title: "AWS: aws_rds_reserved_instance"
+description: |-
+  Manages an RDS DB Reserved Instance
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_rds_reserved_instance
+
+Manages an RDS DB Reserved Instance.
+
+~> **NOTE:** Once created, a reservation is valid for the `duration` of the provided `offeringId` and cannot be deleted. Performing a `destroy` will only remove the resource from state. For more information see [RDS Reserved Instances Documentation](https://aws.amazon.com/rds/reserved-instances/) and [PurchaseReservedDBInstancesOffering](https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_PurchaseReservedDBInstancesOffering.html).
+
+~> **NOTE:** Due to the expense of testing this resource, we provide it as best effort. If you find it useful, and have the ability to help test or notice issues, consider reaching out to us on [GitHub](https://github.com/hashicorp/terraform-provider-aws).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsRdsReservedInstanceOffering } from "./.gen/providers/aws/data-aws-rds-reserved-instance-offering";
+import { RdsReservedInstance } from "./.gen/providers/aws/rds-reserved-instance";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const test = new DataAwsRdsReservedInstanceOffering(this, "test", {
+      dbInstanceClass: "db.t2.micro",
+      duration: 31536000,
+      multiAz: false,
+      offeringType: "All Upfront",
+      productDescription: "mysql",
+    });
+    new RdsReservedInstance(this, "example", {
+      instanceCount: 3,
+      offeringId: Token.asString(test.offeringId),
+      reservationId: "optionalCustomReservationID",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `offeringId` - (Required) ID of the Reserved DB instance offering to purchase. To determine an `offeringId`, see the `awsRdsReservedInstanceOffering` data source.
+
+The following arguments are optional:
+
+* `instanceCount` - (Optional) Number of instances to reserve. Default value is `1`.
+* `reservationId` - (Optional) Customer-specified identifier to track this reservation.
+* `tags` - (Optional) Map of tags to assign to the DB reservation. If configured with a provider [`defaultTags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN for the reserved DB instance.
+* `id` - Unique identifier for the reservation. same as `reservationId`.
+* `currencyCode` - Currency code for the reserved DB instance.
+* `duration` - Duration of the reservation in seconds.
+* `fixedPrice` – Fixed price charged for this reserved DB instance.
+* `dbInstanceClass` - DB instance class for the reserved DB instance.
+* `leaseId` - Unique identifier for the lease associated with the reserved DB instance. Amazon Web Services Support might request the lease ID for an issue related to a reserved DB instance.
+* `multiAz` - Whether the reservation applies to Multi-AZ deployments.
+* `offeringType` - Offering type of this reserved DB instance.
+* `productDescription` - Description of the reserved DB instance.
+* `recurringCharges` - Recurring price charged to run this reserved DB instance.
+* `startTime` - Time the reservation started.
+* `state` - State of the reserved DB instance.
+* `usagePrice` - Hourly price charged for this reserved DB instance.
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `30M`)
+- `update` - (Default `10M`)
+- `delete` - (Default `1M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import RDS DB Instance Reservations using the `instanceId`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import RDS DB Instance Reservations using the `instanceId`. For example:
+
+```console
+% terraform import aws_rds_reserved_instance.reservation_instance CustomReservationID
+```
+
+<!-- cache-key: cdktf-0.18.0 input-9dbbdcfda3d089826e7a92e8f50666a47a4fc86a9f471174038919028f7ff28a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/redshift_authentication_profile.html.markdown b/website/docs/cdktf/typescript/r/redshift_authentication_profile.html.markdown
new file mode 100644
index 00000000000..249bf1f49a0
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/redshift_authentication_profile.html.markdown
@@ -0,0 +1,79 @@
+---
+subcategory: "Redshift"
+layout: "aws"
+page_title: "AWS: aws_redshift_authentication_profile"
+description: |-
+  Creates a Redshift authentication profile
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_redshift_authentication_profile
+
+Creates a Redshift authentication profile
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { RedshiftAuthenticationProfile } from "./.gen/providers/aws/redshift-authentication-profile";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new RedshiftAuthenticationProfile(this, "example", {
+      authenticationProfileContent: Token.asString(
+        Fn.jsonencode({
+          AllowDBUserOverride: "1",
+          App_ID: "example",
+          Client_ID: "ExampleClientID",
+        })
+      ),
+      authenticationProfileName: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `authenticationProfileName` - (Required, Forces new resource) The name of the authentication profile.
+* `authenticationProfileContent` - (Required) The content of the authentication profile in JSON format. The maximum length of the JSON string is determined by a quota for your account.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name of the authentication profile.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Redshift Authentication by `authenticationProfileName`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Redshift Authentication by `authenticationProfileName`. For example:
+
+```console
+% terraform import aws_redshift_authentication_profile.test example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-dc99cb7420c5de511051f2f61b1ee290d874bf0770374a9047ba240fbb6ae37e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/redshift_cluster.html.markdown b/website/docs/cdktf/typescript/r/redshift_cluster.html.markdown
new file mode 100644
index 00000000000..fb437ca569c
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/redshift_cluster.html.markdown
@@ -0,0 +1,181 @@
+---
+subcategory: "Redshift"
+layout: "aws"
+page_title: "AWS: aws_redshift_cluster"
+description: |-
+  Provides a Redshift Cluster resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_redshift_cluster
+
+Provides a Redshift Cluster Resource.
+
+~> **Note:** All arguments including the username and password will be stored in the raw state as plain-text.
+[Read more about sensitive data in state](https://www.terraform.io/docs/state/sensitive-data.html).
+
+~> **NOTE:** A Redshift cluster's default IAM role can be managed both by this resource's `defaultIamRoleArn` argument and the [`awsRedshiftClusterIamRoles`](redshift_cluster_iam_roles.html) resource's `defaultIamRoleArn` argument. Do not configure different values for both arguments. Doing so will cause a conflict of default IAM roles.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { RedshiftCluster } from "./.gen/providers/aws/redshift-cluster";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new RedshiftCluster(this, "example", {
+      clusterIdentifier: "tf-redshift-cluster",
+      clusterType: "single-node",
+      databaseName: "mydb",
+      masterPassword: "Mustbe8characters",
+      masterUsername: "exampleuser",
+      nodeType: "dc1.large",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+For more detailed documentation about each argument, refer to
+the [AWS official documentation](http://docs.aws.amazon.com/cli/latest/reference/redshift/index.html#cli-aws-redshift).
+
+This argument supports the following arguments:
+
+* `clusterIdentifier` - (Required) The Cluster Identifier. Must be a lower case string.
+* `databaseName` - (Optional) The name of the first database to be created when the cluster is created.
+  If you do not provide a name, Amazon Redshift will create a default database called `dev`.
+* `defaultIamRoleArn` - (Optional) The Amazon Resource Name (ARN) for the IAM role that was set as default for the cluster when the cluster was created.
+* `nodeType` - (Required) The node type to be provisioned for the cluster.
+* `clusterType` - (Optional) The cluster type to use. Either `singleNode` or `multiNode`.
+* `masterPassword` - (Required unless a `snapshotIdentifier` is provided) Password for the master DB user.
+  Note that this may show up in logs, and it will be stored in the state file. Password must contain at least 8 chars and
+  contain at least one uppercase letter, one lowercase letter, and one number.
+* `masterUsername` - (Required unless a `snapshotIdentifier` is provided) Username for the master DB user.
+* `vpcSecurityGroupIds` - (Optional) A list of Virtual Private Cloud (VPC) security groups to be associated with the cluster.
+* `clusterSubnetGroupName` - (Optional) The name of a cluster subnet group to be associated with this cluster. If this parameter is not provided the resulting cluster will be deployed outside virtual private cloud (VPC).
+* `availabilityZone` - (Optional) The EC2 Availability Zone (AZ) in which you want Amazon Redshift to provision the cluster. For example, if you have several EC2 instances running in a specific Availability Zone, then you might want the cluster to be provisioned in the same zone in order to decrease network latency. Can only be changed if `availabilityZoneRelocationEnabled` is `true`.
+* `availabilityZoneRelocationEnabled` - (Optional) If true, the cluster can be relocated to another availabity zone, either automatically by AWS or when requested. Default is `false`. Available for use on clusters from the RA3 instance family.
+* `preferredMaintenanceWindow` - (Optional) The weekly time range (in UTC) during which automated cluster maintenance can occur.
+  Format: ddd:hh24:mi-ddd:hh24:mi
+* `clusterParameterGroupName` - (Optional) The name of the parameter group to be associated with this cluster.
+* `automatedSnapshotRetentionPeriod` - (Optional) The number of days that automated snapshots are retained. If the value is 0, automated snapshots are disabled. Even if automated snapshots are disabled, you can still create manual snapshots when you want with create-cluster-snapshot. Default is 1.
+* `port` - (Optional) The port number on which the cluster accepts incoming connections. Valid values are between `1115` and `65535`.
+  The cluster is accessible only via the JDBC and ODBC connection strings.
+  Part of the connection string requires the port on which the cluster will listen for incoming connections.
+  Default port is `5439`.
+* `clusterVersion` - (Optional) The version of the Amazon Redshift engine software that you want to deploy on the cluster.
+  The version selected runs on all the nodes in the cluster.
+* `allowVersionUpgrade` - (Optional) If true , major version upgrades can be applied during the maintenance window to the Amazon Redshift engine that is running on the cluster. Default is `true`.
+* `applyImmediately` - (Optional) Specifies whether any cluster modifications are applied immediately, or during the next maintenance window. Default is `false`.
+* `aquaConfigurationStatus` - (Optional, **Deprecated**) The value represents how the cluster is configured to use AQUA (Advanced Query Accelerator) after the cluster is restored.
+  No longer supported by the AWS API.
+  Always returns `auto`.
+* `numberOfNodes` - (Optional) The number of compute nodes in the cluster. This parameter is required when the ClusterType parameter is specified as multi-node. Default is 1.
+* `publiclyAccessible` - (Optional) If true, the cluster can be accessed from a public network. Default is `true`.
+* `encrypted` - (Optional) If true , the data in the cluster is encrypted at rest.
+* `enhancedVpcRouting` - (Optional) If true , enhanced VPC routing is enabled.
+* `kmsKeyId` - (Optional) The ARN for the KMS encryption key. When specifying `kmsKeyId`, `encrypted` needs to be set to true.
+* `elasticIp` - (Optional) The Elastic IP (EIP) address for the cluster.
+* `skipFinalSnapshot` - (Optional) Determines whether a final snapshot of the cluster is created before Amazon Redshift deletes the cluster. If true , a final cluster snapshot is not created. If false , a final cluster snapshot is created before the cluster is deleted. Default is false.
+* `finalSnapshotIdentifier` - (Optional) The identifier of the final snapshot that is to be created immediately before deleting the cluster. If this parameter is provided, `skipFinalSnapshot` must be false.
+* `snapshotIdentifier` - (Optional) The name of the snapshot from which to create the new cluster.
+* `snapshotClusterIdentifier` - (Optional) The name of the cluster the source snapshot was created from.
+* `ownerAccount` - (Optional) The AWS customer account used to create or copy the snapshot. Required if you are restoring a snapshot you do not own, optional if you own the snapshot.
+* `iamRoles` - (Optional) A list of IAM Role ARNs to associate with the cluster. A Maximum of 10 can be associated to the cluster at any time.
+* `logging` - (Optional) Logging, documented below.
+* `maintenanceTrackName` - (Optional) The name of the maintenance track for the restored cluster. When you take a snapshot, the snapshot inherits the MaintenanceTrack value from the cluster. The snapshot might be on a different track than the cluster that was the source for the snapshot. For example, suppose that you take a snapshot of  a cluster that is on the current track and then change the cluster to be on the trailing track. In this case, the snapshot and the source cluster are on different tracks. Default value is `current`.
+* `manualSnapshotRetentionPeriod` - (Optional)  The default number of days to retain a manual snapshot. If the value is -1, the snapshot is retained indefinitely. This setting doesn't change the retention period of existing snapshots. Valid values are between `1` and `3653`. Default value is `1`.
+* `snapshotCopy` - (Optional) Configuration of automatic copy of snapshots from one region to another. Documented below.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Nested Blocks
+
+#### `logging`
+
+* `enable` - (Required) Enables logging information such as queries and connection attempts, for the specified Amazon Redshift cluster.
+* `bucketName` - (Optional, required when `enable` is `true` and `logDestinationType` is `s3`) The name of an existing S3 bucket where the log files are to be stored. Must be in the same region as the cluster and the cluster must have read bucket and put object permissions.
+For more information on the permissions required for the bucket, please read the AWS [documentation](http://docs.aws.amazon.com/redshift/latest/mgmt/db-auditing.html#db-auditing-enable-logging)
+* `s3KeyPrefix` - (Optional) The prefix applied to the log file names.
+* `logDestinationType` - (Optional) The log destination type. An enum with possible values of `s3` and `cloudwatch`.
+* `logExports` - (Optional) The collection of exported log types. Log types include the connection log, user log and user activity log. Required when `logDestinationType` is `cloudwatch`. Valid log types are `connectionlog`, `userlog`, and `useractivitylog`.
+
+#### `snapshotCopy`
+
+* `destinationRegion` - (Required) The destination region that you want to copy snapshots to.
+* `retentionPeriod` - (Optional) The number of days to retain automated snapshots in the destination region after they are copied from the source region. Defaults to `7`.
+* `grantName` - (Optional) The name of the snapshot copy grant to use when snapshots of an AWS KMS-encrypted cluster are copied to the destination region.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of cluster
+* `id` - The Redshift Cluster ID.
+* `clusterIdentifier` - The Cluster Identifier
+* `clusterType` - The cluster type
+* `nodeType` - The type of nodes in the cluster
+* `databaseName` - The name of the default database in the Cluster
+* `availabilityZone` - The availability zone of the Cluster
+* `automatedSnapshotRetentionPeriod` - The backup retention period
+* `preferredMaintenanceWindow` - The backup window
+* `endpoint` - The connection endpoint
+* `encrypted` - Whether the data in the cluster is encrypted
+* `vpcSecurityGroupIds` - The VPC security group Ids associated with the cluster
+* `dnsName` - The DNS name of the cluster
+* `port` - The Port the cluster responds on
+* `clusterVersion` - The version of Redshift engine software
+* `clusterParameterGroupName` - The name of the parameter group to be associated with this cluster
+* `clusterSubnetGroupName` - The name of a cluster subnet group to be associated with this cluster
+* `clusterPublicKey` - The public key for the cluster
+* `clusterRevisionNumber` - The specific revision number of the database in the cluster
+* `clusterNodes` - The nodes in the cluster. Cluster node blocks are documented below
+* `clusterNamespaceArn` - The namespace Amazon Resource Name (ARN) of the cluster
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+Cluster nodes (for `clusterNodes`) support the following attributes:
+
+* `nodeRole` - Whether the node is a leader node or a compute node
+* `privateIpAddress` - The private IP address of a node within a cluster
+* `publicIpAddress` - The public IP address of a node within a cluster
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `75M`)
+- `update` - (Default `75M`)
+- `delete` - (Default `40M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Redshift Clusters using the `clusterIdentifier`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Redshift Clusters using the `clusterIdentifier`. For example:
+
+```console
+% terraform import aws_redshift_cluster.myprodcluster tf-redshift-cluster-12345
+```
+
+<!-- cache-key: cdktf-0.18.0 input-a58a67b0f3251c111e73eb20948353a4c7ae321a95f9bf867e49b06ddc38bf5c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/redshift_cluster_iam_roles.html.markdown b/website/docs/cdktf/typescript/r/redshift_cluster_iam_roles.html.markdown
new file mode 100644
index 00000000000..b577d1c87cb
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/redshift_cluster_iam_roles.html.markdown
@@ -0,0 +1,78 @@
+---
+subcategory: "Redshift"
+layout: "aws"
+page_title: "AWS: aws_redshift_cluster_iam_roles"
+description: |-
+  Provides a Redshift Cluster IAM Roles resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_redshift_cluster_iam_roles
+
+Provides a Redshift Cluster IAM Roles resource.
+
+~> **NOTE:** A Redshift cluster's default IAM role can be managed both by this resource's `defaultIamRoleArn` argument and the [`awsRedshiftCluster`](redshift_cluster.html) resource's `defaultIamRoleArn` argument. Do not configure different values for both arguments. Doing so will cause a conflict of default IAM roles.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { RedshiftClusterIamRoles } from "./.gen/providers/aws/redshift-cluster-iam-roles";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new RedshiftClusterIamRoles(this, "example", {
+      clusterIdentifier: Token.asString(
+        awsRedshiftClusterExample.clusterIdentifier
+      ),
+      iamRoleArns: [Token.asString(awsIamRoleExample.arn)],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `clusterIdentifier` - (Required) The name of the Redshift Cluster IAM Roles.
+* `iamRoleArns` - (Optional) A list of IAM Role ARNs to associate with the cluster. A Maximum of 10 can be associated to the cluster at any time.
+* `defaultIamRoleArn` - (Optional) The Amazon Resource Name (ARN) for the IAM role that was set as default for the cluster when the cluster was created.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Redshift Cluster ID.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Redshift Cluster IAM Roless using the `clusterIdentifier`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Redshift Cluster IAM Roless using the `clusterIdentifier`. For example:
+
+```console
+% terraform import aws_redshift_cluster_iam_roles.examplegroup1 example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-91240022530f469d269e463be72eba257c8ec52cf957eb83d56ddf8c04d98dc9 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/redshift_cluster_snapshot.html.markdown b/website/docs/cdktf/typescript/r/redshift_cluster_snapshot.html.markdown
new file mode 100644
index 00000000000..0e20c5843d1
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/redshift_cluster_snapshot.html.markdown
@@ -0,0 +1,89 @@
+---
+subcategory: "Redshift"
+layout: "aws"
+page_title: "AWS: aws_redshift_cluster_snapshot"
+description: |-
+  Creates a Redshift cluster snapshot
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_redshift_cluster_snapshot
+
+Creates a Redshift cluster snapshot
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { RedshiftClusterSnapshot } from "./.gen/providers/aws/redshift-cluster-snapshot";
+interface MyConfig {
+  clusterIdentifier: any;
+  snapshotIdentifier: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new RedshiftClusterSnapshot(this, "example", {
+      cluster_snapshot_content: Fn.jsonencode({
+        AllowDBUserOverride: "1",
+        App_ID: "example",
+        Client_ID: "ExampleClientID",
+      }),
+      cluster_snapshot_name: "example",
+      clusterIdentifier: config.clusterIdentifier,
+      snapshotIdentifier: config.snapshotIdentifier,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `clusterIdentifier` - (Required, Forces new resource) The cluster identifier for which you want a snapshot.
+* `snapshotIdentifier` - (Required, Forces new resource) A unique identifier for the snapshot that you are requesting. This identifier must be unique for all snapshots within the Amazon Web Services account.
+* `manualSnapshotRetentionPeriod` - (Optional) The number of days that a manual snapshot is retained. If the value is `1`, the manual snapshot is retained indefinitely. Valid values are -1 and between `1` and `3653`.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the snapshot.
+* `id` - A unique identifier for the snapshot that you are requesting. This identifiermust be unique for all snapshots within the Amazon Web Services account.
+* `kmsKeyId` - The Key Management Service (KMS) key ID of the encryption key that was used to encrypt data in the cluster from which the snapshot was taken.
+* `ownerAccount` - For manual snapshots, the Amazon Web Services account used to create or copy the snapshot. For automatic snapshots, the owner of the cluster. The owner can perform all snapshot actions, such as sharing a manual snapshot.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Redshift Cluster Snapshots using `snapshotIdentifier`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Redshift Cluster Snapshots using `snapshotIdentifier`. For example:
+
+```console
+% terraform import aws_redshift_cluster_snapshot.test example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-a09e33c45529d48fc1c9c42a16cb50804ddf0e3d8b2c1c227d16889af8efa09b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/redshift_endpoint_access.html.markdown b/website/docs/cdktf/typescript/r/redshift_endpoint_access.html.markdown
new file mode 100644
index 00000000000..2fbed2cfc2b
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/redshift_endpoint_access.html.markdown
@@ -0,0 +1,95 @@
+---
+subcategory: "Redshift"
+layout: "aws"
+page_title: "AWS: aws_redshift_endpoint_access"
+description: |-
+  Provides a Redshift Endpoint Access resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_redshift_endpoint_access
+
+Creates a new Amazon Redshift endpoint access.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { RedshiftEndpointAccess } from "./.gen/providers/aws/redshift-endpoint-access";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new RedshiftEndpointAccess(this, "example", {
+      clusterIdentifier: Token.asString(
+        awsRedshiftClusterExample.clusterIdentifier
+      ),
+      endpointName: "example",
+      subnetGroupName: Token.asString(awsRedshiftSubnetGroupExample.id),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `clusterIdentifier` - (Required) The cluster identifier of the cluster to access.
+* `endpointName` - (Required) The Redshift-managed VPC endpoint name.
+* `resourceOwner` - (Optional) The Amazon Web Services account ID of the owner of the cluster. This is only required if the cluster is in another Amazon Web Services account.
+* `subnetGroupName` - (Required) The subnet group from which Amazon Redshift chooses the subnet to deploy the endpoint.
+* `vpcSecurityGroupIds` - (Optional) The security group that defines the ports, protocols, and sources for inbound traffic that you are authorizing into your endpoint.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `address` - The DNS address of the endpoint.
+* `id` - The Redshift-managed VPC endpoint name.
+* `port` - The port number on which the cluster accepts incoming connections.
+* `vpcEndpoint` - The connection endpoint for connecting to an Amazon Redshift cluster through the proxy. See details below.
+
+### VPC Endpoint
+
+* `networkInterface` - One or more network interfaces of the endpoint. Also known as an interface endpoint. See details below.
+* `vpcEndpointId` - The connection endpoint ID for connecting an Amazon Redshift cluster through the proxy.
+* `vpcId` - The VPC identifier that the endpoint is associated.
+
+### Network Interface
+
+* `availabilityZone` - The Availability Zone.
+* `networkInterfaceId` - The network interface identifier.
+* `privateIpAddress` - The IPv4 address of the network interface within the subnet.
+* `subnetId` - The subnet identifier.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Redshift endpoint access using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Redshift endpoint access using the `name`. For example:
+
+```console
+% terraform import aws_redshift_endpoint_access.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-b1a23f712abf5e70b5e09afe1545b494b878b5bffe5195cca6310e786a254ca9 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/redshift_endpoint_authorization.html.markdown b/website/docs/cdktf/typescript/r/redshift_endpoint_authorization.html.markdown
new file mode 100644
index 00000000000..ed93d5b7ef6
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/redshift_endpoint_authorization.html.markdown
@@ -0,0 +1,81 @@
+---
+subcategory: "Redshift"
+layout: "aws"
+page_title: "AWS: aws_redshift_endpoint_authorization"
+description: |-
+  Provides a Redshift Endpoint Authorization resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_redshift_endpoint_authorization
+
+Creates a new Amazon Redshift endpoint authorization.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { RedshiftEndpointAuthorization } from "./.gen/providers/aws/redshift-endpoint-authorization";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new RedshiftEndpointAuthorization(this, "example", {
+      account: "01234567910",
+      clusterIdentifier: Token.asString(
+        awsRedshiftClusterExample.clusterIdentifier
+      ),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `account` - (Required) The Amazon Web Services account ID to grant access to.
+* `clusterIdentifier` - (Required) The cluster identifier of the cluster to grant access to.
+* `forceDelete` - (Optional) Indicates whether to force the revoke action. If true, the Redshift-managed VPC endpoints associated with the endpoint authorization are also deleted. Default value is `false`.
+* `vpcIds` - (Optional) The virtual private cloud (VPC) identifiers to grant access to. If none are specified all VPCs in shared account are allowed.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `allowedAllVpcs` - Indicates whether all VPCs in the grantee account are allowed access to the cluster.
+* `id` - The identifier of the Redshift Endpoint Authorization, `account`, and `clusterIdentifier` separated by a colon (`:`).
+* `endpointCount` - The number of Redshift-managed VPC endpoints created for the authorization.
+* `grantee` - The Amazon Web Services account ID of the grantee of the cluster.
+* `grantor` - The Amazon Web Services account ID of the cluster owner.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Redshift endpoint authorization using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Redshift endpoint authorization using the `id`. For example:
+
+```console
+% terraform import aws_redshift_endpoint_authorization.example 01234567910:cluster-example-id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-b9e5ce4e1f7abe40dbf21f61540bacd5f31c67c081dc3bdd6f2ce8318ce44e5e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/redshift_event_subscription.html.markdown b/website/docs/cdktf/typescript/r/redshift_event_subscription.html.markdown
new file mode 100644
index 00000000000..bd35fc99c8c
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/redshift_event_subscription.html.markdown
@@ -0,0 +1,115 @@
+---
+subcategory: "Redshift"
+layout: "aws"
+page_title: "AWS: aws_redshift_event_subscription"
+description: |-
+  Provides a Redshift event subscription resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_redshift_event_subscription
+
+Provides a Redshift event subscription resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { RedshiftCluster } from "./.gen/providers/aws/redshift-cluster";
+import { RedshiftEventSubscription } from "./.gen/providers/aws/redshift-event-subscription";
+import { SnsTopic } from "./.gen/providers/aws/sns-topic";
+interface MyConfig {
+  nodeType: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    const defaultVar = new RedshiftCluster(this, "default", {
+      clusterIdentifier: "default",
+      databaseName: "default",
+      nodeType: config.nodeType,
+    });
+    const awsSnsTopicDefault = new SnsTopic(this, "default_1", {
+      name: "redshift-events",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSnsTopicDefault.overrideLogicalId("default");
+    const awsRedshiftEventSubscriptionDefault = new RedshiftEventSubscription(
+      this,
+      "default_2",
+      {
+        eventCategories: [
+          "configuration",
+          "management",
+          "monitoring",
+          "security",
+        ],
+        name: "redshift-event-sub",
+        severity: "INFO",
+        snsTopicArn: Token.asString(awsSnsTopicDefault.arn),
+        sourceIds: [defaultVar.id],
+        sourceType: "cluster",
+        tags: {
+          Name: "default",
+        },
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsRedshiftEventSubscriptionDefault.overrideLogicalId("default");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the Redshift event subscription.
+* `snsTopicArn` - (Required) The ARN of the SNS topic to send events to.
+* `sourceIds` - (Optional) A list of identifiers of the event sources for which events will be returned. If not specified, then all sources are included in the response. If specified, a `sourceType` must also be specified.
+* `sourceType` - (Optional) The type of source that will be generating the events. Valid options are `cluster`, `clusterParameterGroup`, `clusterSecurityGroup`, `clusterSnapshot`, or `scheduledAction`. If not set, all sources will be subscribed to.
+* `severity` - (Optional) The event severity to be published by the notification subscription. Valid options are `info` or `error`. Default value of `info`.
+* `eventCategories` - (Optional) A list of event categories for a SourceType that you want to subscribe to. See https://docs.aws.amazon.com/redshift/latest/mgmt/working-with-event-notifications.html or run `aws redshift describe-event-categories`.
+* `enabled` - (Optional) A boolean flag to enable/disable the subscription. Defaults to `true`.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the Redshift event notification subscription
+* `id` - The name of the Redshift event notification subscription
+* `customerAwsId` - The AWS customer account associated with the Redshift event notification subscription
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Redshift Event Subscriptions using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Redshift Event Subscriptions using the `name`. For example:
+
+```console
+% terraform import aws_redshift_event_subscription.default redshift-event-sub
+```
+
+<!-- cache-key: cdktf-0.18.0 input-15f307fc07a5350a90201b05a1ab1284198872ef394e5f0b141e17d35b730070 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/redshift_hsm_client_certificate.html.markdown b/website/docs/cdktf/typescript/r/redshift_hsm_client_certificate.html.markdown
new file mode 100644
index 00000000000..7b350d1b213
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/redshift_hsm_client_certificate.html.markdown
@@ -0,0 +1,74 @@
+---
+subcategory: "Redshift"
+layout: "aws"
+page_title: "AWS: aws_redshift_hsm_client_certificate"
+description: |-
+  Creates an HSM client certificate that an Amazon Redshift cluster will use to connect to the client's HSM in order to store and retrieve the keys used to encrypt the cluster databases.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_redshift_hsm_client_certificate
+
+Creates an HSM client certificate that an Amazon Redshift cluster will use to connect to the client's HSM in order to store and retrieve the keys used to encrypt the cluster databases.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { RedshiftHsmClientCertificate } from "./.gen/providers/aws/redshift-hsm-client-certificate";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new RedshiftHsmClientCertificate(this, "example", {
+      hsmClientCertificateIdentifier: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `hsmClientCertificateIdentifier` - (Required, Forces new resource) The identifier of the HSM client certificate.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the Hsm Client Certificate.
+* `hsmClientCertificatePublicKey` - The public key that the Amazon Redshift cluster will use to connect to the HSM. You must register the public key in the HSM.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Redshift HSM Client Certificates using `hsmClientCertificateIdentifier`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Redshift HSM Client Certificates using `hsmClientCertificateIdentifier`. For example:
+
+```console
+% terraform import aws_redshift_hsm_client_certificate.test example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-5c66db327c1839116bd09ae2b35aec09129f16566c516184eda37641b0d7234e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/redshift_hsm_configuration.html.markdown b/website/docs/cdktf/typescript/r/redshift_hsm_configuration.html.markdown
new file mode 100644
index 00000000000..6b4f9e3c6f7
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/redshift_hsm_configuration.html.markdown
@@ -0,0 +1,84 @@
+---
+subcategory: "Redshift"
+layout: "aws"
+page_title: "AWS: aws_redshift_hsm_configuration"
+description: |-
+  Creates an HSM configuration that contains the information required by an Amazon Redshift cluster to store and use database encryption keys in a Hardware Security Module (HSM).
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_redshift_hsm_configuration
+
+  Creates an HSM configuration that contains the information required by an Amazon Redshift cluster to store and use database encryption keys in a Hardware Security Module (HSM).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { RedshiftHsmConfiguration } from "./.gen/providers/aws/redshift-hsm-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new RedshiftHsmConfiguration(this, "example", {
+      description: "example",
+      hsmConfigurationIdentifier: "example",
+      hsmIpAddress: "10.0.0.1",
+      hsmPartitionName: "aws",
+      hsmPartitionPassword: "example",
+      hsmServerPublicCertificate: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `description` - (Required, Forces new resource) A text description of the HSM configuration to be created.
+* `hsmConfigurationIdentifier` - (Required, Forces new resource) The identifier to be assigned to the new Amazon Redshift HSM configuration.
+* `hsmIpAddress` - (Required, Forces new resource) The IP address that the Amazon Redshift cluster must use to access the HSM.
+* `hsmPartitionName` - (Required, Forces new resource) The name of the partition in the HSM where the Amazon Redshift clusters will store their database encryption keys.
+* `hsmPartitionPassword` - (Required, Forces new resource) The password required to access the HSM partition.
+* `hsmServerPublicCertificate` - (Required, Forces new resource) The HSMs public certificate file. When using Cloud HSM, the file name is server.pem.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the Hsm Client Certificate.
+* `hsmConfigurationPublicKey` - The public key that the Amazon Redshift cluster will use to connect to the HSM. You must register the public key in the HSM.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Redshift HSM Client Certificates using `hsmConfigurationIdentifier`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Redshift HSM Client Certificates using `hsmConfigurationIdentifier`. For example:
+
+```console
+% terraform import aws_redshift_hsm_configuration.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-bd8a362c2861dd8693c1edee0bfc416d38b5b6843e0fe94fad4b67e8798aa729 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/redshift_parameter_group.html.markdown b/website/docs/cdktf/typescript/r/redshift_parameter_group.html.markdown
new file mode 100644
index 00000000000..8144c4dae53
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/redshift_parameter_group.html.markdown
@@ -0,0 +1,99 @@
+---
+subcategory: "Redshift"
+layout: "aws"
+page_title: "AWS: aws_redshift_parameter_group"
+description: |-
+  Provides a Redshift Cluster parameter group resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_redshift_parameter_group
+
+Provides a Redshift Cluster parameter group resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { RedshiftParameterGroup } from "./.gen/providers/aws/redshift-parameter-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new RedshiftParameterGroup(this, "bar", {
+      family: "redshift-1.0",
+      name: "parameter-group-test-terraform",
+      parameter: [
+        {
+          name: "require_ssl",
+          value: "true",
+        },
+        {
+          name: "query_group",
+          value: "example",
+        },
+        {
+          name: "enable_user_activity_logging",
+          value: "true",
+        },
+      ],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the Redshift parameter group.
+* `family` - (Required) The family of the Redshift parameter group.
+* `description` - (Optional) The description of the Redshift parameter group. Defaults to "Managed by Terraform".
+* `parameter` - (Optional) A list of Redshift parameters to apply.
+
+Parameter blocks support the following:
+
+* `name` - (Required) The name of the Redshift parameter.
+* `value` - (Required) The value of the Redshift parameter.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+You can read more about the parameters that Redshift supports in the [documentation](http://docs.aws.amazon.com/redshift/latest/mgmt/working-with-parameter-groups.html)
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of parameter group
+* `id` - The Redshift parameter group name.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Redshift Parameter Groups using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Redshift Parameter Groups using the `name`. For example:
+
+```console
+% terraform import aws_redshift_parameter_group.paramgroup1 parameter-group-test-terraform
+```
+
+<!-- cache-key: cdktf-0.18.0 input-8fbf52bda44476ea1fcc81df655088804c5cc233d70ed33ebca6dd6caf8a3a7a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/redshift_partner.html.markdown b/website/docs/cdktf/typescript/r/redshift_partner.html.markdown
new file mode 100644
index 00000000000..a4a7409e67c
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/redshift_partner.html.markdown
@@ -0,0 +1,79 @@
+---
+subcategory: "Redshift"
+layout: "aws"
+page_title: "AWS: aws_redshift_partner"
+description: |-
+  Provides a Redshift Partner resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_redshift_partner
+
+Creates a new Amazon Redshift Partner Integration.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { RedshiftPartner } from "./.gen/providers/aws/redshift-partner";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new RedshiftPartner(this, "example", {
+      accountId: Token.asString(1234567910),
+      clusterIdentifier: Token.asString(awsRedshiftClusterExample.id),
+      databaseName: Token.asString(awsRedshiftClusterExample.databaseName),
+      partnerName: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `accountId` - (Required) The Amazon Web Services account ID that owns the cluster.
+* `clusterIdentifier` - (Required) The cluster identifier of the cluster that receives data from the partner.
+* `databaseName` - (Required) The name of the database that receives data from the partner.
+* `partnerName` - (Required) The name of the partner that is authorized to send data.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The identifier of the Redshift partner, `accountId`, `clusterIdentifier`, `databaseName`, `partnerName` separated by a colon (`:`).
+* `status` - (Optional) The partner integration status.
+* `statusMessage` - (Optional) The status message provided by the partner.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Redshift usage limits using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Redshift usage limits using the `id`. For example:
+
+```console
+% terraform import aws_redshift_partner.example 01234567910:cluster-example-id:example:example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-d4438832cfe9bd08e76f7dbce4113e2e512ea90f05f4a5914f89a70db35ad904 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/redshift_scheduled_action.html.markdown b/website/docs/cdktf/typescript/r/redshift_scheduled_action.html.markdown
new file mode 100644
index 00000000000..343efd8edf0
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/redshift_scheduled_action.html.markdown
@@ -0,0 +1,200 @@
+---
+subcategory: "Redshift"
+layout: "aws"
+page_title: "AWS: aws_redshift_scheduled_action"
+description: |-
+  Provides a Redshift Scheduled Action resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_redshift_scheduled_action
+
+## Example Usage
+
+### Pause Cluster Action
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { IamPolicy } from "./.gen/providers/aws/iam-policy";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+import { IamRolePolicyAttachment } from "./.gen/providers/aws/iam-role-policy-attachment";
+import { RedshiftScheduledAction } from "./.gen/providers/aws/redshift-scheduled-action";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const assumeRole = new DataAwsIamPolicyDocument(this, "assume_role", {
+      statement: [
+        {
+          actions: ["sts:AssumeRole"],
+          effect: "Allow",
+          principals: [
+            {
+              identifiers: ["scheduler.redshift.amazonaws.com"],
+              type: "Service",
+            },
+          ],
+        },
+      ],
+    });
+    const example = new DataAwsIamPolicyDocument(this, "example", {
+      statement: [
+        {
+          actions: [
+            "redshift:PauseCluster",
+            "redshift:ResumeCluster",
+            "redshift:ResizeCluster",
+          ],
+          effect: "Allow",
+          resources: ["*"],
+        },
+      ],
+    });
+    const awsIamPolicyExample = new IamPolicy(this, "example_2", {
+      name: "redshift_scheduled_action",
+      policy: Token.asString(example.json),
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamPolicyExample.overrideLogicalId("example");
+    const awsIamRoleExample = new IamRole(this, "example_3", {
+      assumeRolePolicy: Token.asString(assumeRole.json),
+      name: "redshift_scheduled_action",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamRoleExample.overrideLogicalId("example");
+    const awsIamRolePolicyAttachmentExample = new IamRolePolicyAttachment(
+      this,
+      "example_4",
+      {
+        policyArn: Token.asString(awsIamPolicyExample.arn),
+        role: Token.asString(awsIamRoleExample.name),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamRolePolicyAttachmentExample.overrideLogicalId("example");
+    const awsRedshiftScheduledActionExample = new RedshiftScheduledAction(
+      this,
+      "example_5",
+      {
+        iamRole: Token.asString(awsIamRoleExample.arn),
+        name: "tf-redshift-scheduled-action",
+        schedule: "cron(00 23 * * ? *)",
+        targetAction: {
+          pauseCluster: {
+            clusterIdentifier: "tf-redshift001",
+          },
+        },
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsRedshiftScheduledActionExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### Resize Cluster Action
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { RedshiftScheduledAction } from "./.gen/providers/aws/redshift-scheduled-action";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new RedshiftScheduledAction(this, "example", {
+      iamRole: Token.asString(awsIamRoleExample.arn),
+      name: "tf-redshift-scheduled-action",
+      schedule: "cron(00 23 * * ? *)",
+      targetAction: {
+        resizeCluster: {
+          clusterIdentifier: "tf-redshift001",
+          clusterType: "multi-node",
+          nodeType: "dc1.large",
+          numberOfNodes: 2,
+        },
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The scheduled action name.
+* `description` - (Optional) The description of the scheduled action.
+* `enable` - (Optional) Whether to enable the scheduled action. Default is `true` .
+* `startTime` - (Optional) The start time in UTC when the schedule is active, in UTC RFC3339 format(for example, YYYY-MM-DDTHH:MM:SSZ).
+* `endTime` - (Optional) The end time in UTC when the schedule is active, in UTC RFC3339 format(for example, YYYY-MM-DDTHH:MM:SSZ).
+* `schedule` - (Required) The schedule of action. The schedule is defined format of "at expression" or "cron expression", for example `at(20160304T17:27:00)` or `cron(0 10 ? * MON *)`. See [Scheduled Action](https://docs.aws.amazon.com/redshift/latest/APIReference/API_ScheduledAction.html) for more information.
+* `iamRole` - (Required) The IAM role to assume to run the scheduled action.
+* `targetAction` - (Required) Target action. Documented below.
+
+### Nested Blocks
+
+#### `targetAction`
+
+* `pauseCluster` - (Optional) An action that runs a `pauseCluster` API operation. Documented below.
+* `resizeCluster` - (Optional) An action that runs a `resizeCluster` API operation. Documented below.
+* `resumeCluster` - (Optional) An action that runs a `resumeCluster` API operation. Documented below.
+
+### `pauseCluster`
+
+* `clusterIdentifier` - (Required) The identifier of the cluster to be paused.
+
+### `resizeCluster`
+
+* `clusterIdentifier` - (Required) The unique identifier for the cluster to resize.
+* `classic` - (Optional) A boolean value indicating whether the resize operation is using the classic resize process. Default: `false`.
+* `clusterType` - (Optional)　The new cluster type for the specified cluster.
+* `nodeType` - (Optional) The new node type for the nodes you are adding.
+* `numberOfNodes` - (Optional) The new number of nodes for the cluster.
+
+### `resumeCluster`
+
+* `clusterIdentifier` - (Required) The identifier of the cluster to be resumed.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Redshift Scheduled Action name.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Redshift Scheduled Action using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Redshift Scheduled Action using the `name`. For example:
+
+```console
+% terraform import aws_redshift_scheduled_action.example tf-redshift-scheduled-action
+```
+
+<!-- cache-key: cdktf-0.18.0 input-bb46dc91c30f3bd0e92ef6f30fbb8c2c42b66b25bd27c78c262e5e212679b4d1 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/redshift_snapshot_copy_grant.html.markdown b/website/docs/cdktf/typescript/r/redshift_snapshot_copy_grant.html.markdown
new file mode 100644
index 00000000000..3e02fefbe91
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/redshift_snapshot_copy_grant.html.markdown
@@ -0,0 +1,91 @@
+---
+subcategory: "Redshift"
+layout: "aws"
+page_title: "AWS: aws_redshift_snapshot_copy_grant"
+description: |-
+  Creates a snapshot copy grant that allows AWS Redshift to encrypt copied snapshots with a customer master key from AWS KMS in a destination region.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_redshift_snapshot_copy_grant
+
+Creates a snapshot copy grant that allows AWS Redshift to encrypt copied snapshots with a customer master key from AWS KMS in a destination region.
+
+Note that the grant must exist in the destination region, and not in the region of the cluster.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { RedshiftCluster } from "./.gen/providers/aws/redshift-cluster";
+import { RedshiftSnapshotCopyGrant } from "./.gen/providers/aws/redshift-snapshot-copy-grant";
+interface MyConfig {
+  clusterIdentifier: any;
+  nodeType: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    const test = new RedshiftSnapshotCopyGrant(this, "test", {
+      snapshotCopyGrantName: "my-grant",
+    });
+    const awsRedshiftClusterTest = new RedshiftCluster(this, "test_1", {
+      snapshotCopy: {
+        destinationRegion: "us-east-2",
+        grantName: test.snapshotCopyGrantName,
+      },
+      clusterIdentifier: config.clusterIdentifier,
+      nodeType: config.nodeType,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsRedshiftClusterTest.overrideLogicalId("test");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `snapshotCopyGrantName` - (Required, Forces new resource) A friendly name for identifying the grant.
+* `kmsKeyId` - (Optional, Forces new resource) The unique identifier for the customer master key (CMK) that the grant applies to. Specify the key ID or the Amazon Resource Name (ARN) of the CMK. To specify a CMK in a different AWS account, you must use the key ARN. If not specified, the default key is used.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of snapshot copy grant
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Redshift Snapshot Copy Grants by name. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Redshift Snapshot Copy Grants by name. For example:
+
+```console
+% terraform import aws_redshift_snapshot_copy_grant.test my-grant
+```
+
+<!-- cache-key: cdktf-0.18.0 input-7132ffb13bb997106c250daca68bcc8d4f28e5d2bd7fcb63ef1d3441a64c72d3 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/redshift_snapshot_schedule.html.markdown b/website/docs/cdktf/typescript/r/redshift_snapshot_schedule.html.markdown
new file mode 100644
index 00000000000..26293b3ed1e
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/redshift_snapshot_schedule.html.markdown
@@ -0,0 +1,77 @@
+---
+subcategory: "Redshift"
+layout: "aws"
+page_title: "AWS: aws_redshift_snapshot_schedule"
+description: |-
+  Provides an Redshift Snapshot Schedule resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_redshift_snapshot_schedule
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { RedshiftSnapshotSchedule } from "./.gen/providers/aws/redshift-snapshot-schedule";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new RedshiftSnapshotSchedule(this, "default", {
+      definitions: ["rate(12 hours)"],
+      identifier: "tf-redshift-snapshot-schedule",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `identifier` - (Optional, Forces new resource) The snapshot schedule identifier. If omitted, Terraform will assign a random, unique identifier.
+* `identifierPrefix` - (Optional, Forces new resource) Creates a unique
+identifier beginning with the specified prefix. Conflicts with `identifier`.
+* `description` - (Optional) The description of the snapshot schedule.
+* `definitions` - (Optional) The definition of the snapshot schedule. The definition is made up of schedule expressions, for example `cron(30 12 *)` or `rate(12 hours)`.
+* `forceDestroy` - (Optional) Whether to destroy all associated clusters with this snapshot schedule on deletion. Must be enabled and applied before attempting deletion.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the Redshift Snapshot Schedule.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Redshift Snapshot Schedule using the `identifier`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Redshift Snapshot Schedule using the `identifier`. For example:
+
+```console
+% terraform import aws_redshift_snapshot_schedule.default tf-redshift-snapshot-schedule
+```
+
+<!-- cache-key: cdktf-0.18.0 input-0efaf47bc050c3417ad21dec274dd17ba88abe8c5b011ce8e99d3a0223fa2ffa -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/redshift_snapshot_schedule_association.html.markdown b/website/docs/cdktf/typescript/r/redshift_snapshot_schedule_association.html.markdown
new file mode 100644
index 00000000000..b568a2f13f9
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/redshift_snapshot_schedule_association.html.markdown
@@ -0,0 +1,94 @@
+---
+subcategory: "Redshift"
+layout: "aws"
+page_title: "AWS: aws_redshift_snapshot_schedule_association"
+description: |-
+  Provides an Association Redshift Cluster and Snapshot Schedule resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_redshift_snapshot_schedule_association
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { RedshiftCluster } from "./.gen/providers/aws/redshift-cluster";
+import { RedshiftSnapshotSchedule } from "./.gen/providers/aws/redshift-snapshot-schedule";
+import { RedshiftSnapshotScheduleAssociation } from "./.gen/providers/aws/redshift-snapshot-schedule-association";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const defaultVar = new RedshiftCluster(this, "default", {
+      clusterIdentifier: "tf-redshift-cluster",
+      clusterType: "single-node",
+      databaseName: "mydb",
+      masterPassword: "Mustbe8characters",
+      masterUsername: "foo",
+      nodeType: "dc1.large",
+    });
+    const awsRedshiftSnapshotScheduleDefault = new RedshiftSnapshotSchedule(
+      this,
+      "default_1",
+      {
+        definitions: ["rate(12 hours)"],
+        identifier: "tf-redshift-snapshot-schedule",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsRedshiftSnapshotScheduleDefault.overrideLogicalId("default");
+    const awsRedshiftSnapshotScheduleAssociationDefault =
+      new RedshiftSnapshotScheduleAssociation(this, "default_2", {
+        clusterIdentifier: defaultVar.id,
+        scheduleIdentifier: Token.asString(
+          awsRedshiftSnapshotScheduleDefault.id
+        ),
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsRedshiftSnapshotScheduleAssociationDefault.overrideLogicalId("default");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `clusterIdentifier` - (Required, Forces new resource) The cluster identifier.
+* `scheduleIdentifier` - (Required, Forces new resource) The snapshot schedule identifier.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Redshift Snapshot Schedule Association using the `<cluster-identifier>/<schedule-identifier>`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Redshift Snapshot Schedule Association using the `<cluster-identifier>/<schedule-identifier>`. For example:
+
+```console
+% terraform import aws_redshift_snapshot_schedule_association.default tf-redshift-cluster/tf-redshift-snapshot-schedule
+```
+
+<!-- cache-key: cdktf-0.18.0 input-cfbb9314d7e41451bce6ec8e24e4375625bd63ba89df980d70fe96df9cca5e41 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/redshift_subnet_group.html.markdown b/website/docs/cdktf/typescript/r/redshift_subnet_group.html.markdown
new file mode 100644
index 00000000000..4c289c0a20f
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/redshift_subnet_group.html.markdown
@@ -0,0 +1,105 @@
+---
+subcategory: "Redshift"
+layout: "aws"
+page_title: "AWS: aws_redshift_subnet_group"
+description: |-
+  Provides a Redshift Subnet Group resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_redshift_subnet_group
+
+Creates a new Amazon Redshift subnet group. You must provide a list of one or more subnets in your existing Amazon Virtual Private Cloud (Amazon VPC) when creating Amazon Redshift subnet group.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { RedshiftSubnetGroup } from "./.gen/providers/aws/redshift-subnet-group";
+import { Subnet } from "./.gen/providers/aws/subnet";
+import { Vpc } from "./.gen/providers/aws/vpc";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const foo = new Vpc(this, "foo", {
+      cidrBlock: "10.1.0.0/16",
+    });
+    const bar = new Subnet(this, "bar", {
+      availabilityZone: "us-west-2b",
+      cidrBlock: "10.1.2.0/24",
+      tags: {
+        Name: "tf-dbsubnet-test-2",
+      },
+      vpcId: foo.id,
+    });
+    const awsSubnetFoo = new Subnet(this, "foo_2", {
+      availabilityZone: "us-west-2a",
+      cidrBlock: "10.1.1.0/24",
+      tags: {
+        Name: "tf-dbsubnet-test-1",
+      },
+      vpcId: foo.id,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSubnetFoo.overrideLogicalId("foo");
+    const awsRedshiftSubnetGroupFoo = new RedshiftSubnetGroup(this, "foo_3", {
+      name: "foo",
+      subnetIds: [Token.asString(awsSubnetFoo.id), bar.id],
+      tags: {
+        environment: "Production",
+      },
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsRedshiftSubnetGroupFoo.overrideLogicalId("foo");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the Redshift Subnet group.
+* `description` - (Optional) The description of the Redshift Subnet group. Defaults to "Managed by Terraform".
+* `subnetIds` - (Required) An array of VPC subnet IDs.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the Redshift Subnet group name
+* `id` - The Redshift Subnet group ID.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Redshift subnet groups using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Redshift subnet groups using the `name`. For example:
+
+```console
+% terraform import aws_redshift_subnet_group.testgroup1 test-cluster-subnet-group
+```
+
+<!-- cache-key: cdktf-0.18.0 input-3d603e489c1bb01bdc966a54771f0f1ba11b9496fe058472a61fd0520c9b7c8c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/redshift_usage_limit.html.markdown b/website/docs/cdktf/typescript/r/redshift_usage_limit.html.markdown
new file mode 100644
index 00000000000..df65679ff25
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/redshift_usage_limit.html.markdown
@@ -0,0 +1,82 @@
+---
+subcategory: "Redshift"
+layout: "aws"
+page_title: "AWS: aws_redshift_usage_limit"
+description: |-
+  Provides a Redshift Usage Limit resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_redshift_usage_limit
+
+Creates a new Amazon Redshift Usage Limit.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { RedshiftUsageLimit } from "./.gen/providers/aws/redshift-usage-limit";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new RedshiftUsageLimit(this, "example", {
+      amount: 60,
+      clusterIdentifier: Token.asString(awsRedshiftClusterExample.id),
+      featureType: "concurrency-scaling",
+      limitType: "time",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `amount` - (Required) The limit amount. If time-based, this amount is in minutes. If data-based, this amount is in terabytes (TB). The value must be a positive number.
+* `breachAction` - (Optional) The action that Amazon Redshift takes when the limit is reached. The default is `log`. Valid values are `log`, `emitMetric`, and `disable`.
+* `clusterIdentifier` - (Required) The identifier of the cluster that you want to limit usage.
+* `featureType` - (Required) The Amazon Redshift feature that you want to limit. Valid values are `spectrum`, `concurrencyScaling`, and `crossRegionDatasharing`.
+* `limitType` - (Required) The type of limit. Depending on the feature type, this can be based on a time duration or data size. If FeatureType is `spectrum`, then LimitType must be `dataScanned`. If FeatureType is `concurrencyScaling`, then LimitType must be `time`. If FeatureType is `crossRegionDatasharing`, then LimitType must be `dataScanned`. Valid values are `dataScanned`, and `time`.
+* `period` - (Optional) The time period that the amount applies to. A weekly period begins on Sunday. The default is `monthly`. Valid values are `daily`, `weekly`, and `monthly`.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the Redshift Usage Limit.
+* `id` - The Redshift Usage Limit ID.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Redshift usage limits using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Redshift usage limits using the `id`. For example:
+
+```console
+% terraform import aws_redshift_usage_limit.example example-id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-66b262f3ea166c96e47be520f77ad628bb0cc4e80252fff83651756e7d728428 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/redshiftdata_statement.html.markdown b/website/docs/cdktf/typescript/r/redshiftdata_statement.html.markdown
new file mode 100644
index 00000000000..f17e61aaf26
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/redshiftdata_statement.html.markdown
@@ -0,0 +1,114 @@
+---
+subcategory: "Redshift Data"
+layout: "aws"
+page_title: "AWS: aws_redshiftdata_statement"
+description: |-
+  Provides a Redshift Data Statement execution resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_redshiftdata_statement
+
+Executes a Redshift Data Statement.
+
+## Example Usage
+
+### cluster_identifier
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { RedshiftdataStatement } from "./.gen/providers/aws/redshiftdata-statement";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new RedshiftdataStatement(this, "example", {
+      clusterIdentifier: Token.asString(
+        awsRedshiftClusterExample.clusterIdentifier
+      ),
+      database: Token.asString(awsRedshiftClusterExample.databaseName),
+      dbUser: Token.asString(awsRedshiftClusterExample.masterUsername),
+      sql: "CREATE GROUP group_name;",
+    });
+  }
+}
+
+```
+
+### workgroup_name
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { RedshiftdataStatement } from "./.gen/providers/aws/redshiftdata-statement";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new RedshiftdataStatement(this, "example", {
+      database: "dev",
+      sql: "CREATE GROUP group_name;",
+      workgroupName: Token.asString(
+        awsRedshiftserverlessWorkgroupExample.workgroupName
+      ),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `database` - (Required) The name of the database.
+* `sql` - (Required) The SQL statement text to run.
+
+The following arguments are optional:
+
+* `clusterIdentifier` - (Optional) The cluster identifier. This parameter is required when connecting to a cluster and authenticating using either Secrets Manager or temporary credentials.
+* `dbUser` - (Optional) The database user name.
+* `secretArn` - (Optional) The name or ARN of the secret that enables access to the database.
+* `statementName` - (Optional) The name of the SQL statement. You can name the SQL statement when you create it to identify the query.
+* `withEvent` - (Optional) A value that indicates whether to send an event to the Amazon EventBridge event bus after the SQL statement runs.
+* `workgroupName` - (Optional) The serverless workgroup name. This parameter is required when connecting to a serverless workgroup and authenticating using either Secrets Manager or temporary credentials.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Redshift Data Statement ID.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Redshift Data Statements using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Redshift Data Statements using the `id`. For example:
+
+```console
+% terraform import aws_redshiftdata_statement.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-890483d136320a7936958ee447618d785135e348982c003fa40f68a3e28cefbc -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/redshiftserverless_endpoint_access.html.markdown b/website/docs/cdktf/typescript/r/redshiftserverless_endpoint_access.html.markdown
new file mode 100644
index 00000000000..db9fde13ecc
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/redshiftserverless_endpoint_access.html.markdown
@@ -0,0 +1,96 @@
+---
+subcategory: "Redshift Serverless"
+layout: "aws"
+page_title: "AWS: aws_redshiftserverless_endpoint_access"
+description: |-
+  Provides a Redshift Serverless Endpoint Access resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_redshiftserverless_endpoint_access
+
+Creates a new Amazon Redshift Serverless Endpoint Access.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { RedshiftserverlessEndpointAccess } from "./.gen/providers/aws/redshiftserverless-endpoint-access";
+interface MyConfig {
+  subnetIds: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new RedshiftserverlessEndpointAccess(this, "example", {
+      endpointName: "example",
+      workgroupName: "example",
+      subnetIds: config.subnetIds,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `endpointName` - (Required) The name of the endpoint.
+* `subnetIds` - (Required) An array of VPC subnet IDs to associate with the endpoint.
+* `vpcSecurityGroupIds` - (Optional) An array of security group IDs to associate with the workgroup.
+* `workgroupName` - (Required) The name of the workgroup.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the Redshift Serverless Endpoint Access.
+* `id` - The Redshift Endpoint Access Name.
+* `address` - The DNS address of the VPC endpoint.
+* `port` - The port that Amazon Redshift Serverless listens on.
+* `vpcEndpoint` - The VPC endpoint or the Redshift Serverless workgroup. See `VPC Endpoint` below.
+
+#### VPC Endpoint
+
+* `vpcEndpointId` - The DNS address of the VPC endpoint.
+* `vpcId` - The port that Amazon Redshift Serverless listens on.
+* `networkInterface` - The network interfaces of the endpoint.. See `Network Interface` below.
+
+##### Network Interface
+
+* `availabilityZone` - The availability Zone.
+* `networkInterfaceId` - The unique identifier of the network interface.
+* `privateIpAddress` - The IPv4 address of the network interface within the subnet.
+* `subnetId` - The unique identifier of the subnet.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Redshift Serverless Endpoint Access using the `endpointName`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Redshift Serverless Endpoint Access using the `endpointName`. For example:
+
+```console
+% terraform import aws_redshiftserverless_endpoint_access.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-a869e2502d87c1ead378782f8a695ae513642420fec05b7e7f019308555ddb33 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/redshiftserverless_namespace.html.markdown b/website/docs/cdktf/typescript/r/redshiftserverless_namespace.html.markdown
new file mode 100644
index 00000000000..bd7e60d793a
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/redshiftserverless_namespace.html.markdown
@@ -0,0 +1,82 @@
+---
+subcategory: "Redshift Serverless"
+layout: "aws"
+page_title: "AWS: aws_redshiftserverless_namespace"
+description: |-
+  Provides a Redshift Serverless Namespace resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_redshiftserverless_namespace
+
+Creates a new Amazon Redshift Serverless Namespace.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { RedshiftserverlessNamespace } from "./.gen/providers/aws/redshiftserverless-namespace";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new RedshiftserverlessNamespace(this, "example", {
+      namespaceName: "concurrency-scaling",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `adminUserPassword` - (Optional) The password of the administrator for the first database created in the namespace.
+* `adminUsername` - (Optional) The username of the administrator for the first database created in the namespace.
+* `dbName` - (Optional) The name of the first database created in the namespace.
+* `defaultIamRoleArn` - (Optional) The Amazon Resource Name (ARN) of the IAM role to set as a default in the namespace. When specifying `defaultIamRoleArn`, it also must be part of `iamRoles`.
+* `iamRoles` - (Optional) A list of IAM roles to associate with the namespace.
+* `kmsKeyId` - (Optional) The ARN of the Amazon Web Services Key Management Service key used to encrypt your data.
+* `logExports` - (Optional) The types of logs the namespace can export. Available export types are `userlog`, `connectionlog`, and `useractivitylog`.
+* `namespaceName` - (Required) The name of the namespace.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the Redshift Serverless Namespace.
+* `id` - The Redshift Namespace Name.
+* `namespaceId` - The Redshift Namespace ID.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Redshift Serverless Namespaces using the `namespaceName`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Redshift Serverless Namespaces using the `namespaceName`. For example:
+
+```console
+% terraform import aws_redshiftserverless_namespace.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-3fa05a19a9755fb51145df09f985b4240171d15c6da3e7aaeeaa933a19f41ff3 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/redshiftserverless_resource_policy.html.markdown b/website/docs/cdktf/typescript/r/redshiftserverless_resource_policy.html.markdown
new file mode 100644
index 00000000000..cf2378587cf
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/redshiftserverless_resource_policy.html.markdown
@@ -0,0 +1,87 @@
+---
+subcategory: "Redshift Serverless"
+layout: "aws"
+page_title: "AWS: aws_redshiftserverless_resource_policy"
+description: |-
+  Provides a Redshift Serverless Resource Policy resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_redshiftserverless_resource_policy
+
+Creates a new Amazon Redshift Serverless Resource Policy.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { RedshiftserverlessResourcePolicy } from "./.gen/providers/aws/redshiftserverless-resource-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new RedshiftserverlessResourcePolicy(this, "example", {
+      policy: Token.asString(
+        Fn.jsonencode({
+          Statement: [
+            {
+              Action: ["redshift-serverless:RestoreFromSnapshot"],
+              Effect: "Allow",
+              Principal: {
+                AWS: ["12345678901"],
+              },
+              Sid: "",
+            },
+          ],
+          Version: "2012-10-17",
+        })
+      ),
+      resourceArn: Token.asString(awsRedshiftserverlessSnapshotExample.arn),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `resourceArn` - (Required) The Amazon Resource Name (ARN) of the account to create or update a resource policy for.
+* `policy` - (Required) The policy to create or update. For example, the following policy grants a user authorization to restore a snapshot.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Amazon Resource Name (ARN) of the account to create or update a resource policy for.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Redshift Serverless Resource Policies using the `resourceArn`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Redshift Serverless Resource Policies using the `resourceArn`. For example:
+
+```console
+% terraform import aws_redshiftserverless_resource_policy.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-a616ab40a392ade8fb2ac2a0656140773e5db2656ed7fdddaff9050c933530e7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/redshiftserverless_snapshot.html.markdown b/website/docs/cdktf/typescript/r/redshiftserverless_snapshot.html.markdown
new file mode 100644
index 00000000000..4cbe045fe98
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/redshiftserverless_snapshot.html.markdown
@@ -0,0 +1,83 @@
+---
+subcategory: "Redshift Serverless"
+layout: "aws"
+page_title: "AWS: aws_redshiftserverless_snapshot"
+description: |-
+  Provides a Redshift Serverless Snapshot resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_redshiftserverless_snapshot
+
+Creates a new Amazon Redshift Serverless Snapshot.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { RedshiftserverlessSnapshot } from "./.gen/providers/aws/redshiftserverless-snapshot";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new RedshiftserverlessSnapshot(this, "example", {
+      namespaceName: Token.asString(
+        awsRedshiftserverlessWorkgroupExample.namespaceName
+      ),
+      snapshotName: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `namespaceName` - (Required) The namespace to create a snapshot for.
+* `snapshotName` - (Required) The name of the snapshot.
+* `retentionPeriod` - (Optional) How long to retain the created snapshot. Default value is `1`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `accountsWithProvisionedRestoreAccess` - All of the Amazon Web Services accounts that have access to restore a snapshot to a provisioned cluster.
+* `accountsWithRestoreAccess` - All of the Amazon Web Services accounts that have access to restore a snapshot to a namespace.
+* `adminUsername` - The username of the database within a snapshot.
+* `arn` - The Amazon Resource Name (ARN) of the snapshot.
+* `id` - The name of the snapshot.
+* `kmsKeyId` - The unique identifier of the KMS key used to encrypt the snapshot.
+* `namespaceArn` - The Amazon Resource Name (ARN) of the namespace the snapshot was created from.
+* `ownerAccount` - The owner Amazon Web Services; account of the snapshot.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Redshift Serverless Snapshots using the `snapshotName`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Redshift Serverless Snapshots using the `snapshotName`. For example:
+
+```console
+% terraform import aws_redshiftserverless_snapshot.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-8cdad9004cc5bbc08f27efbdc59cce26713d56ad09ff5203e21e04db05d9916b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/redshiftserverless_usage_limit.html.markdown b/website/docs/cdktf/typescript/r/redshiftserverless_usage_limit.html.markdown
new file mode 100644
index 00000000000..ed33d2d49eb
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/redshiftserverless_usage_limit.html.markdown
@@ -0,0 +1,88 @@
+---
+subcategory: "Redshift Serverless"
+layout: "aws"
+page_title: "AWS: aws_redshiftserverless_usage_limit"
+description: |-
+  Provides a Redshift Serverless Usage Limit resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_redshiftserverless_usage_limit
+
+Creates a new Amazon Redshift Serverless Usage Limit.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { RedshiftserverlessUsageLimit } from "./.gen/providers/aws/redshiftserverless-usage-limit";
+import { RedshiftserverlessWorkgroup } from "./.gen/providers/aws/redshiftserverless-workgroup";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new RedshiftserverlessWorkgroup(this, "example", {
+      namespaceName: Token.asString(
+        awsRedshiftserverlessNamespaceExample.namespaceName
+      ),
+      workgroupName: "example",
+    });
+    const awsRedshiftserverlessUsageLimitExample =
+      new RedshiftserverlessUsageLimit(this, "example_1", {
+        amount: 60,
+        resourceArn: example.arn,
+        usageType: "serverless-compute",
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsRedshiftserverlessUsageLimitExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `amount` - (Required) The limit amount. If time-based, this amount is in Redshift Processing Units (RPU) consumed per hour. If data-based, this amount is in terabytes (TB) of data transferred between Regions in cross-account sharing. The value must be a positive number.
+* `breachAction` - (Optional) The action that Amazon Redshift Serverless takes when the limit is reached. Valid values are `log`, `emitMetric`, and `deactivate`. The default is `log`.
+* `period` - (Optional) The time period that the amount applies to. A weekly period begins on Sunday. Valid values are `daily`, `weekly`, and `monthly`. The default is `monthly`.
+* `resourceArn` - (Required) The Amazon Resource Name (ARN) of the Amazon Redshift Serverless resource to create the usage limit for.
+* `usageType` - (Required) The type of Amazon Redshift Serverless usage to create a usage limit for. Valid values are `serverlessCompute` or `crossRegionDatasharing`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the Redshift Serverless Usage Limit.
+* `id` - The Redshift Usage Limit id.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Redshift Serverless Usage Limits using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Redshift Serverless Usage Limits using the `id`. For example:
+
+```console
+% terraform import aws_redshiftserverless_usage_limit.example example-id
+```
+
+<!-- cache-key: cdktf-0.18.0 input-84a424322614113d9d70f498bff96348f7b00d895883170bcacbcdfd508f8a95 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/redshiftserverless_workgroup.html.markdown b/website/docs/cdktf/typescript/r/redshiftserverless_workgroup.html.markdown
new file mode 100644
index 00000000000..929e3d0a7dd
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/redshiftserverless_workgroup.html.markdown
@@ -0,0 +1,119 @@
+---
+subcategory: "Redshift Serverless"
+layout: "aws"
+page_title: "AWS: aws_redshiftserverless_workgroup"
+description: |-
+  Provides a Redshift Serverless Workgroup resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_redshiftserverless_workgroup
+
+Creates a new Amazon Redshift Serverless Workgroup.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { RedshiftserverlessWorkgroup } from "./.gen/providers/aws/redshiftserverless-workgroup";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new RedshiftserverlessWorkgroup(this, "example", {
+      namespaceName: "concurrency-scaling",
+      workgroupName: "concurrency-scaling",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `namespaceName` - (Required) The name of the namespace.
+* `workgroupName` - (Required) The name of the workgroup.
+
+The following arguments are optional:
+
+* `baseCapacity` - (Optional) The base data warehouse capacity of the workgroup in Redshift Processing Units (RPUs).
+* `configParameter` - (Optional) An array of parameters to set for more control over a serverless database. See `Config Parameter` below.
+* `enhancedVpcRouting` - (Optional) The value that specifies whether to turn on enhanced virtual private cloud (VPC) routing, which forces Amazon Redshift Serverless to route traffic through your VPC instead of over the internet.
+* `publiclyAccessible` - (Optional) A value that specifies whether the workgroup can be accessed from a public network.
+* `securityGroupIds` - (Optional) An array of security group IDs to associate with the workgroup.
+* `subnetIds` - (Optional) An array of VPC subnet IDs to associate with the workgroup. When set, must contain at least three subnets spanning three Availability Zones. A minimum number of IP addresses is required and scales with the Base Capacity. For more information, see the following [AWS document](https://docs.aws.amazon.com/redshift/latest/mgmt/serverless-known-issues.html).
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Config Parameter
+
+* `parameterKey` - (Required) The key of the parameter. The options are `autoMv`, `datestyle`, `enableCaseSensitiveIdentifier`, `enableUserActivityLogging`, `queryGroup`, `searchPath`, `requireSsl`, `useFipsSsl`, and [query monitoring metrics](https://docs.aws.amazon.com/redshift/latest/dg/cm-c-wlm-query-monitoring-rules.html#cm-c-wlm-query-monitoring-metrics-serverless) that let you define performance boundaries: `maxQueryCpuTime`, `maxQueryBlocksRead`, `maxScanRowCount`, `maxQueryExecutionTime`, `maxQueryQueueTime`, `maxQueryCpuUsagePercent`, `maxQueryTempBlocksToDisk`, `maxJoinRowCount` and `maxNestedLoopJoinRowCount`.
+* `parameterValue` - (Required) The value of the parameter to set.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the Redshift Serverless Workgroup.
+* `id` - The Redshift Workgroup Name.
+* `workgroupId` - The Redshift Workgroup ID.
+* `endpoint` - The endpoint that is created from the workgroup. See `endpoint` below.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+### Endpoint
+
+* `address` - The DNS address of the VPC endpoint.
+* `port` - The port that Amazon Redshift Serverless listens on.
+* `vpcEndpoint` - The VPC endpoint or the Redshift Serverless workgroup. See `VPC Endpoint` below.
+
+#### VPC Endpoint
+
+* `vpcEndpointId` - The DNS address of the VPC endpoint.
+* `vpcId` - The port that Amazon Redshift Serverless listens on.
+* `networkInterface` - The network interfaces of the endpoint.. See `Network Interface` below.
+
+##### Network Interface
+
+* `availabilityZone` - The availability Zone.
+* `networkInterfaceId` - The unique identifier of the network interface.
+* `privateIpAddress` - The IPv4 address of the network interface within the subnet.
+* `subnetId` - The unique identifier of the subnet.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `20M`)
+- `update` - (Default `20M`)
+- `delete` - (Default `20M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Redshift Serverless Workgroups using the `workgroupName`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Redshift Serverless Workgroups using the `workgroupName`. For example:
+
+```console
+% terraform import aws_redshiftserverless_workgroup.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-f8191fced5005bdb54568b11bf8280442d2128c6ce0381714a2d602f4d39f748 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/resourceexplorer2_index.html.markdown b/website/docs/cdktf/typescript/r/resourceexplorer2_index.html.markdown
new file mode 100644
index 00000000000..77bf40b2d12
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/resourceexplorer2_index.html.markdown
@@ -0,0 +1,81 @@
+---
+subcategory: "Resource Explorer"
+layout: "aws"
+page_title: "AWS: aws_resourceexplorer2_index"
+description: |-
+  Provides a resource to manage a Resource Explorer index in the current AWS Region.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_resourceexplorer2_index
+
+Provides a resource to manage a Resource Explorer index in the current AWS Region.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Resourceexplorer2Index } from "./.gen/providers/aws/resourceexplorer2-index";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Resourceexplorer2Index(this, "example", {
+      type: "LOCAL",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `type` - (Required) The type of the index. Valid values: `aggregator`, `local`. To understand the difference between `local` and `aggregator`, see the [_AWS Resource Explorer User Guide_](https://docs.aws.amazon.com/resource-explorer/latest/userguide/manage-aggregator-region.html).
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `2H`)
+- `update` - (Default `2H`)
+- `delete` - (Default `10M`)
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the Resource Explorer index.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Resource Explorer indexes using the `arn`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Resource Explorer indexes using the `arn`. For example:
+
+```console
+% terraform import aws_resourceexplorer2_index.example arn:aws:resource-explorer-2:us-east-1:123456789012:index/6047ac4e-207e-4487-9bcf-cb53bb0ff5cc
+```
+
+<!-- cache-key: cdktf-0.18.0 input-15aba15c558147fe93e81fd33df5a092fce89b9a9fad5f53b520dc3c70e79bbd -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/resourceexplorer2_view.html.markdown b/website/docs/cdktf/typescript/r/resourceexplorer2_view.html.markdown
new file mode 100644
index 00000000000..08e7816958c
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/resourceexplorer2_view.html.markdown
@@ -0,0 +1,109 @@
+---
+subcategory: "Resource Explorer"
+layout: "aws"
+page_title: "AWS: aws_resourceexplorer2_view"
+description: |-
+  Provides a resource to manage a Resource Explorer view.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_resourceexplorer2_view
+
+Provides a resource to manage a Resource Explorer view.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Resourceexplorer2Index } from "./.gen/providers/aws/resourceexplorer2-index";
+import { Resourceexplorer2View } from "./.gen/providers/aws/resourceexplorer2-view";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new Resourceexplorer2Index(this, "example", {
+      type: "LOCAL",
+    });
+    const awsResourceexplorer2ViewExample = new Resourceexplorer2View(
+      this,
+      "example_1",
+      {
+        dependsOn: [example],
+        filters: [
+          {
+            filterString: "resourcetype:ec2:instance",
+          },
+        ],
+        includedProperty: [
+          {
+            name: "tags",
+          },
+        ],
+        name: "exampleview",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsResourceexplorer2ViewExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `defaultView` - (Optional) Specifies whether the view is the [_default view_](https://docs.aws.amazon.com/resource-explorer/latest/userguide/manage-views-about.html#manage-views-about-default) for the AWS Region. Default: `false`.
+* `filters` - (Optional) Specifies which resources are included in the results of queries made using this view. See [Filters](#filters) below for more details.
+* `includedProperty` - (Optional) Optional fields to be included in search results from this view. See [Included Properties](#included-properties) below for more details.
+* `name` - (Required) The name of the view. The name must be no more than 64 characters long, and can include letters, digits, and the dash (-) character. The name must be unique within its AWS Region.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Filters
+
+The `filters` block supports the following:
+
+* `filterString` - (Required) The string that contains the search keywords, prefixes, and operators to control the results that can be returned by a search operation. For more details, see [Search query syntax](https://docs.aws.amazon.com/resource-explorer/latest/userguide/using-search-query-syntax.html).
+
+### Included Properties
+
+The `includedProperty` block supports the following:
+
+* `name` - (Required) The name of the property that is included in this view. Valid values: `tags`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the Resource Explorer view.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Resource Explorer views using the `arn`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Resource Explorer views using the `arn`. For example:
+
+```console
+% terraform import aws_resourceexplorer2_view.example arn:aws:resource-explorer-2:us-west-2:123456789012:view/exampleview/e0914f6c-6c27-4b47-b5d4-6b28381a2421
+```
+
+<!-- cache-key: cdktf-0.18.0 input-9a55ae10af14ad8a58159e050eea5de7e647cddfd344de98c968a90f50d26575 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/resourcegroups_group.html.markdown b/website/docs/cdktf/typescript/r/resourcegroups_group.html.markdown
new file mode 100644
index 00000000000..757a9f19ad1
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/resourcegroups_group.html.markdown
@@ -0,0 +1,95 @@
+---
+subcategory: "Resource Groups"
+layout: "aws"
+page_title: "AWS: aws_resourcegroups_group"
+description: |-
+  Provides a Resource Group.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_resourcegroups_group
+
+Provides a Resource Group.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ResourcegroupsGroup } from "./.gen/providers/aws/resourcegroups-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ResourcegroupsGroup(this, "test", {
+      name: "test-group",
+      resourceQuery: {
+        query:
+          '{\n  "ResourceTypeFilters": [\n    "AWS::EC2::Instance"\n  ],\n  "TagFilters": [\n    {\n      "Key": "Stage",\n      "Values": ["Test"]\n    }\n  ]\n}\n\n',
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The resource group's name. A resource group name can have a maximum of 127 characters, including letters, numbers, hyphens, dots, and underscores. The name cannot start with `aws` or `aws`.
+* `configuration` - (Optional) A configuration associates the resource group with an AWS service and specifies how the service can interact with the resources in the group. See below for details.
+* `description` - (Optional) A description of the resource group.
+* `resourceQuery` - (Required) A `resourceQuery` block. Resource queries are documented below.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+The `resourceQuery` block supports the following arguments:
+
+* `query` - (Required) The resource query as a JSON string.
+* `type` - (Required) The type of the resource query. Defaults to `tagFilters10`.
+
+The `configuration` block supports the following arguments:
+
+* `type` - (Required) Specifies the type of group configuration item.
+* `parameters` - (Optional) A collection of parameters for this group configuration item. See below for details.
+
+The `parameters` block supports the following arguments:
+
+* `name` - (Required) The name of the group configuration parameter.
+* `values` - (Optional) The value or values to be used for the specified parameter.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN assigned by AWS for this resource group.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import resource groups using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import resource groups using the `name`. For example:
+
+```console
+% terraform import aws_resourcegroups_group.foo resource-group-name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ffd6b1c7348fc0bfb39edb3c57aaf4b3dc4b1a11fa63096a13a4a4883d2ab21d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/resourcegroups_resource.html.markdown b/website/docs/cdktf/typescript/r/resourcegroups_resource.html.markdown
new file mode 100644
index 00000000000..747cc7d34df
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/resourcegroups_resource.html.markdown
@@ -0,0 +1,86 @@
+---
+subcategory: "Resource Groups"
+layout: "aws"
+page_title: "AWS: aws_resourcegroups_resource"
+description: |-
+  Terraform resource for managing an AWS Resource Groups Resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_resourcegroups_resource
+
+Terraform resource for managing an AWS Resource Groups Resource.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Ec2Host } from "./.gen/providers/aws/ec2-host";
+import { ResourcegroupsGroup } from "./.gen/providers/aws/resourcegroups-group";
+import { ResourcegroupsResource } from "./.gen/providers/aws/resourcegroups-resource";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new Ec2Host(this, "example", {
+      autoPlacement: "on",
+      availabilityZone: "us-east-1a",
+      hostRecovery: "off",
+      instanceFamily: "t3",
+    });
+    const awsResourcegroupsGroupExample = new ResourcegroupsGroup(
+      this,
+      "example_1",
+      {
+        name: "example",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsResourcegroupsGroupExample.overrideLogicalId("example");
+    const awsResourcegroupsResourceExample = new ResourcegroupsResource(
+      this,
+      "example_2",
+      {
+        groupArn: Token.asString(awsResourcegroupsGroupExample.arn),
+        resourceArn: example.arn,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsResourcegroupsResourceExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `groupArn` - (Required) The name or the ARN of the resource group to add resources to.
+
+The following arguments are optional:
+
+* `resourceArn` - (Required) The ARN of the resource to be added to the group.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `resourceType` - The resource type of a resource, such as `aws::ec2::instance`.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `5M`)
+* `delete` - (Default `5M`)
+
+<!-- cache-key: cdktf-0.18.0 input-aab29303cb0c6f71f3aadcea2dab227a35feb39e7e6c9a2b0ecaf85e8c6d91ff -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/rolesanywhere_profile.html.markdown b/website/docs/cdktf/typescript/r/rolesanywhere_profile.html.markdown
new file mode 100644
index 00000000000..66fe86f77ea
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/rolesanywhere_profile.html.markdown
@@ -0,0 +1,111 @@
+---
+subcategory: "Roles Anywhere"
+layout: "aws"
+page_title: "AWS: aws_rolesanywhere_profile"
+description: |-
+  Provides a Roles Anywhere Profile resource
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_rolesanywhere_profile
+
+Terraform resource for managing a Roles Anywhere Profile.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { IamRole } from "./.gen/providers/aws/iam-role";
+import { RolesanywhereProfile } from "./.gen/providers/aws/rolesanywhere-profile";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const test = new IamRole(this, "test", {
+      assumeRolePolicy: Token.asString(
+        Fn.jsonencode({
+          Statement: [
+            {
+              Action: [
+                "sts:AssumeRole",
+                "sts:TagSession",
+                "sts:SetSourceIdentity",
+              ],
+              Effect: "Allow",
+              Principal: {
+                Service: "rolesanywhere.amazonaws.com",
+              },
+              Sid: "",
+            },
+          ],
+          Version: "2012-10-17",
+        })
+      ),
+      name: "test",
+      path: "/",
+    });
+    const awsRolesanywhereProfileTest = new RolesanywhereProfile(
+      this,
+      "test_1",
+      {
+        name: "example",
+        roleArns: [test.arn],
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsRolesanywhereProfileTest.overrideLogicalId("test");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `durationSeconds` - (Optional) The number of seconds the vended session credentials are valid for. Defaults to 3600.
+* `enabled` - (Optional) Whether or not the Profile is enabled.
+* `managedPolicyArns` - (Optional) A list of managed policy ARNs that apply to the vended session credentials.
+* `name` - (Required) The name of the Profile.
+* `requireInstanceProperties` - (Optional) Specifies whether instance properties are required in [CreateSession](https://docs.aws.amazon.com/rolesanywhere/latest/APIReference/API_CreateSession.html) requests with this profile.
+* `roleArns` - (Required) A list of IAM roles that this profile can assume
+* `sessionPolicy` - (Optional) A session policy that applies to the trust boundary of the vended session credentials.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the Profile
+* `id` - The Profile ID.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsRolesanywhereProfile` using its `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsRolesanywhereProfile` using its `id`. For example:
+
+```console
+% terraform import aws_rolesanywhere_profile.example db138a85-8925-4f9f-a409-08231233cacf
+```
+
+<!-- cache-key: cdktf-0.18.0 input-6014aa495fc385a2acfb6b7b4cb2e96800954c65d55817afa8439b60e41c2538 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/rolesanywhere_trust_anchor.html.markdown b/website/docs/cdktf/typescript/r/rolesanywhere_trust_anchor.html.markdown
new file mode 100644
index 00000000000..7688585daa1
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/rolesanywhere_trust_anchor.html.markdown
@@ -0,0 +1,138 @@
+---
+subcategory: "Roles Anywhere"
+layout: "aws"
+page_title: "AWS: aws_rolesanywhere_trust_anchor"
+description: |-
+  Provides a Roles Anywhere Trust Anchor resource
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_rolesanywhere_trust_anchor
+
+Terraform resource for managing a Roles Anywhere Trust Anchor.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AcmpcaCertificate } from "./.gen/providers/aws/acmpca-certificate";
+import { AcmpcaCertificateAuthority } from "./.gen/providers/aws/acmpca-certificate-authority";
+import { AcmpcaCertificateAuthorityCertificate } from "./.gen/providers/aws/acmpca-certificate-authority-certificate";
+import { DataAwsPartition } from "./.gen/providers/aws/data-aws-partition";
+import { RolesanywhereTrustAnchor } from "./.gen/providers/aws/rolesanywhere-trust-anchor";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new AcmpcaCertificateAuthority(this, "example", {
+      certificateAuthorityConfiguration: {
+        keyAlgorithm: "RSA_4096",
+        signingAlgorithm: "SHA512WITHRSA",
+        subject: {
+          commonName: "example.com",
+        },
+      },
+      permanentDeletionTimeInDays: 7,
+      type: "ROOT",
+    });
+    const awsAcmpcaCertificateAuthorityCertificateExample =
+      new AcmpcaCertificateAuthorityCertificate(this, "example_1", {
+        certificate: Token.asString(awsAcmpcaCertificateExample.certificate),
+        certificateAuthorityArn: example.arn,
+        certificateChain: Token.asString(
+          awsAcmpcaCertificateExample.certificateChain
+        ),
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsAcmpcaCertificateAuthorityCertificateExample.overrideLogicalId(
+      "example"
+    );
+    new RolesanywhereTrustAnchor(this, "test", {
+      dependsOn: [awsAcmpcaCertificateAuthorityCertificateExample],
+      name: "example",
+      source: {
+        sourceData: {
+          acmPcaArn: example.arn,
+        },
+        sourceType: "AWS_ACM_PCA",
+      },
+    });
+    const current = new DataAwsPartition(this, "current", {});
+    const awsAcmpcaCertificateTest = new AcmpcaCertificate(this, "test_4", {
+      certificateAuthorityArn: example.arn,
+      certificateSigningRequest: example.certificateSigningRequest,
+      signingAlgorithm: "SHA512WITHRSA",
+      templateArn:
+        "arn:${" +
+        current.partition +
+        "}:acm-pca:::template/RootCACertificate/V1",
+      validity: {
+        type: "YEARS",
+        value: Token.asString(1),
+      },
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsAcmpcaCertificateTest.overrideLogicalId("test");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `enabled` - (Optional) Whether or not the Trust Anchor should be enabled.
+* `name` - (Required) The name of the Trust Anchor.
+* `source` - (Required) The source of trust, documented below
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Nested Blocks
+
+#### `source`
+
+* `sourceData` - (Required) The data denoting the source of trust, documented below
+* `sourceType` - (Required) The type of the source of trust. Must be either `awsAcmPca` or `certificateBundle`.
+
+#### `sourceData`
+
+* `acmPcaArn` - (Optional, required when `sourceType` is `awsAcmPca`) The ARN of an ACM Private Certificate Authority.
+* `x509CertificateData` - (Optional, required when `sourceType` is `certificateBundle`)
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the Trust Anchor
+* `id` - The Trust Anchor ID.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsRolesanywhereTrustAnchor` using its `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsRolesanywhereTrustAnchor` using its `id`. For example:
+
+```console
+% terraform import aws_rolesanywhere_trust_anchor.example 92b2fbbb-984d-41a3-a765-e3cbdb69ebb1
+```
+
+<!-- cache-key: cdktf-0.18.0 input-89d8cc3f15e0773b9fe438113eea5ac563a091c5c19d681db300ed32379fb0a0 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/route.html.markdown b/website/docs/cdktf/typescript/r/route.html.markdown
new file mode 100644
index 00000000000..5dd0767068e
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/route.html.markdown
@@ -0,0 +1,190 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_route"
+description: |-
+  Provides a resource to create a routing entry in a VPC routing table.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_route
+
+Provides a resource to create a routing table entry (a route) in a VPC routing table.
+
+~> **NOTE on Route Tables and Routes:** Terraform currently provides both a standalone Route resource and a [Route Table](route_table.html) resource with routes defined in-line. At this time you cannot use a Route Table with in-line routes in conjunction with any Route resources. Doing so will cause a conflict of rule settings and will overwrite rules.
+
+~> **NOTE on `gatewayId` attribute:** The AWS API is very forgiving with the resource ID passed in the `gatewayId` attribute. For example an `awsRoute` resource can be created with an [`awsNatGateway`](nat_gateway.html) or [`awsEgressOnlyInternetGateway`](egress_only_internet_gateway.html) ID specified for the `gatewayId` attribute. Specifying anything other than an [`awsInternetGateway`](internet_gateway.html) or [`awsVpnGateway`](vpn_gateway.html) ID will lead to Terraform reporting a permanent diff between your configuration and recorded state, as the AWS API returns the more-specific attribute. If you are experiencing constant diffs with an `awsRoute` resource, the first thing to check is that the correct attribute is being specified.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Route } from "./.gen/providers/aws/route";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Route(this, "r", {
+      dependsOn: [testing],
+      destinationCidrBlock: "10.0.1.0/22",
+      routeTableId: "rtb-4fbb3ac4",
+      vpcPeeringConnectionId: "pcx-45ff3dc1",
+    });
+  }
+}
+
+```
+
+## Example IPv6 Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EgressOnlyInternetGateway } from "./.gen/providers/aws/egress-only-internet-gateway";
+import { Route } from "./.gen/providers/aws/route";
+import { Vpc } from "./.gen/providers/aws/vpc";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const vpc = new Vpc(this, "vpc", {
+      assignGeneratedIpv6CidrBlock: true,
+      cidrBlock: "10.1.0.0/16",
+    });
+    const egress = new EgressOnlyInternetGateway(this, "egress", {
+      vpcId: vpc.id,
+    });
+    new Route(this, "r", {
+      destinationIpv6CidrBlock: "::/0",
+      egressOnlyGatewayId: egress.id,
+      routeTableId: "rtb-4fbb3ac4",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `routeTableId` - (Required) The ID of the routing table.
+
+One of the following destination arguments must be supplied:
+
+* `destinationCidrBlock` - (Optional) The destination CIDR block.
+* `destinationIpv6CidrBlock` - (Optional) The destination IPv6 CIDR block.
+* `destinationPrefixListId` - (Optional) The ID of a [managed prefix list](ec2_managed_prefix_list.html) destination.
+
+One of the following target arguments must be supplied:
+
+* `carrierGatewayId` - (Optional) Identifier of a carrier gateway. This attribute can only be used when the VPC contains a subnet which is associated with a Wavelength Zone.
+* `coreNetworkArn` - (Optional) The Amazon Resource Name (ARN) of a core network.
+* `egressOnlyGatewayId` - (Optional) Identifier of a VPC Egress Only Internet Gateway.
+* `gatewayId` - (Optional) Identifier of a VPC internet gateway or a virtual private gateway. Specify `local` when updating a previously [imported](#import) local route.
+* `natGatewayId` - (Optional) Identifier of a VPC NAT gateway.
+* `localGatewayId` - (Optional) Identifier of a Outpost local gateway.
+* `networkInterfaceId` - (Optional) Identifier of an EC2 network interface.
+* `transitGatewayId` - (Optional) Identifier of an EC2 Transit Gateway.
+* `vpcEndpointId` - (Optional) Identifier of a VPC Endpoint.
+* `vpcPeeringConnectionId` - (Optional) Identifier of a VPC peering connection.
+
+Note that the default route, mapping the VPC's CIDR block to "local", is created implicitly and cannot be specified.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+~> **NOTE:** Only the arguments that are configured (one of the above) will be exported as an attribute once the resource is created.
+
+* `id` - Route identifier computed from the routing table identifier and route destination.
+* `instanceId` - Identifier of an EC2 instance.
+* `instanceOwnerId` - The AWS account ID of the owner of the EC2 instance.
+* `origin` - How the route was created - `createRouteTable`, `createRoute` or `enableVgwRoutePropagation`.
+* `state` - The state of the route - `active` or `blackhole`.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `5M`)
+- `update` - (Default `2M`)
+- `delete` - (Default `5M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import individual routes using `routetableidDestination`. Import [local routes](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Route_Tables.html#RouteTables) using the VPC's IPv4 or IPv6 CIDR blocks. For example:
+
+Import a route in route table `rtb656C65616E6F72` with an IPv4 destination CIDR of `104200/16`:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Import a route in route table `rtb656C65616E6F72` with an IPv6 destination CIDR of `2620:0:2D0:200::8/125`:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Import a route in route table `rtb656C65616E6F72` with a managed prefix list destination of `pl0570A1D2D725C16Be`:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+**Using `terraform import` to import** individual routes using `routetableidDestination`. Import [local routes](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Route_Tables.html#RouteTables) using the VPC's IPv4 or IPv6 CIDR blocks. For example:
+
+Import a route in route table `rtb656C65616E6F72` with an IPv4 destination CIDR of `104200/16`:
+
+```console
+% terraform import aws_route.my_route rtb-656C65616E6F72_10.42.0.0/16
+```
+
+Import a route in route table `rtb656C65616E6F72` with an IPv6 destination CIDR of `2620:0:2D0:200::8/125`:
+
+```console
+% terraform import aws_route.my_route rtb-656C65616E6F72_2620:0:2d0:200::8/125
+```
+
+Import a route in route table `rtb656C65616E6F72` with a managed prefix list destination of `pl0570A1D2D725C16Be`:
+
+```console
+% terraform import aws_route.my_route rtb-656C65616E6F72_pl-0570a1d2d725c16be
+```
+
+<!-- cache-key: cdktf-0.18.0 input-53c7f6fd35f56da19c62820b7371f087d7dfdcf3dc6ba0a873a118f63167b0a4 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/route53_cidr_collection.html.markdown b/website/docs/cdktf/typescript/r/route53_cidr_collection.html.markdown
new file mode 100644
index 00000000000..ffa37622b52
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/route53_cidr_collection.html.markdown
@@ -0,0 +1,73 @@
+---
+subcategory: "Route 53"
+layout: "aws"
+page_title: "AWS: aws_route53_cidr_collection"
+description: |-
+  Provides a Route53 CIDR collection resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_route53_cidr_collection
+
+Provides a Route53 CIDR collection resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Route53CidrCollection } from "./.gen/providers/aws/route53-cidr-collection";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Route53CidrCollection(this, "example", {
+      name: "collection-1",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) Unique name for the CIDR collection.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the CIDR collection.
+* `id` - The CIDR collection ID.
+* `version` - The lastest version of the CIDR collection.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CIDR collections using their ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import CIDR collections using their ID. For example:
+
+```console
+% terraform import aws_route53_cidr_collection.example 9ac32814-3e67-0932-6048-8d779cc6f511
+```
+
+<!-- cache-key: cdktf-0.18.0 input-a80f886fcccf8c08717c63639feaa22b07614aee2f4ebbbbcae7b48c9718f5a1 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/route53_cidr_location.html.markdown b/website/docs/cdktf/typescript/r/route53_cidr_location.html.markdown
new file mode 100644
index 00000000000..66882ad823e
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/route53_cidr_location.html.markdown
@@ -0,0 +1,85 @@
+---
+subcategory: "Route 53"
+layout: "aws"
+page_title: "AWS: aws_route53_cidr_location"
+description: |-
+  Provides a Route53 CIDR location resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_route53_cidr_location
+
+Provides a Route53 CIDR location resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Route53CidrCollection } from "./.gen/providers/aws/route53-cidr-collection";
+import { Route53CidrLocation } from "./.gen/providers/aws/route53-cidr-location";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new Route53CidrCollection(this, "example", {
+      name: "collection-1",
+    });
+    const awsRoute53CidrLocationExample = new Route53CidrLocation(
+      this,
+      "example_1",
+      {
+        cidrBlocks: ["200.5.3.0/24", "200.6.3.0/24"],
+        cidrCollectionId: example.id,
+        name: "office",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsRoute53CidrLocationExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `cidrBlocks` - (Required) CIDR blocks for the location.
+* `cidrCollectionId` - (Required) The ID of the CIDR collection to update.
+* `name` - (Required) Name for the CIDR location.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The CIDR location ID.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CIDR locations using their the CIDR collection ID and location name. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import CIDR locations using their the CIDR collection ID and location name. For example:
+
+```console
+% terraform import aws_route53_cidr_location.example 9ac32814-3e67-0932-6048-8d779cc6f511,office
+```
+
+<!-- cache-key: cdktf-0.18.0 input-31ac6f8e84b90ca850c2546849f62b830a0e3054286c7dd59d0dfb835b14de38 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/route53_delegation_set.html.markdown b/website/docs/cdktf/typescript/r/route53_delegation_set.html.markdown
new file mode 100644
index 00000000000..c34d670be93
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/route53_delegation_set.html.markdown
@@ -0,0 +1,84 @@
+---
+subcategory: "Route 53"
+layout: "aws"
+page_title: "AWS: aws_route53_delegation_set"
+description: |-
+  Provides a Route53 Delegation Set resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_route53_delegation_set
+
+Provides a [Route53 Delegation Set](https://docs.aws.amazon.com/Route53/latest/APIReference/API-actions-by-function.html#actions-by-function-reusable-delegation-sets) resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Route53DelegationSet } from "./.gen/providers/aws/route53-delegation-set";
+import { Route53Zone } from "./.gen/providers/aws/route53-zone";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const main = new Route53DelegationSet(this, "main", {
+      referenceName: "DynDNS",
+    });
+    new Route53Zone(this, "primary", {
+      delegationSetId: main.id,
+      name: "hashicorp.com",
+    });
+    new Route53Zone(this, "secondary", {
+      delegationSetId: main.id,
+      name: "terraform.io",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `referenceName` - (Optional) This is a reference name used in Caller Reference
+  (helpful for identifying single delegation set amongst others)
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the Delegation Set.
+* `id` - The delegation set ID
+* `nameServers` - A list of authoritative name servers for the hosted zone
+  (effectively a list of NS records).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Route53 Delegation Sets using the delegation set `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Route53 Delegation Sets using the delegation set `id`. For example:
+
+```console
+% terraform import aws_route53_delegation_set.set1 N1PA6795SAMPLE
+```
+
+<!-- cache-key: cdktf-0.18.0 input-b6d9fea678079df840cfe605eac21d9ef068f83b613ae7a6bc209863fccfe750 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/route53_health_check.html.markdown b/website/docs/cdktf/typescript/r/route53_health_check.html.markdown
new file mode 100644
index 00000000000..4691ab4aaae
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/route53_health_check.html.markdown
@@ -0,0 +1,202 @@
+---
+subcategory: "Route 53"
+layout: "aws"
+page_title: "AWS: aws_route53_health_check"
+description: |-
+  Provides a Route53 health check.
+---
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_route53_health_check
+
+Provides a Route53 health check.
+
+## Example Usage
+
+### Connectivity and HTTP Status Code Check
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Route53HealthCheck } from "./.gen/providers/aws/route53-health-check";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Route53HealthCheck(this, "example", {
+      failureThreshold: Token.asNumber("5"),
+      fqdn: "example.com",
+      port: 80,
+      requestInterval: Token.asNumber("30"),
+      resourcePath: "/",
+      tags: {
+        Name: "tf-test-health-check",
+      },
+      type: "HTTP",
+    });
+  }
+}
+
+```
+
+### Connectivity and String Matching Check
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Route53HealthCheck } from "./.gen/providers/aws/route53-health-check";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Route53HealthCheck(this, "example", {
+      failureThreshold: Token.asNumber("5"),
+      fqdn: "example.com",
+      port: 443,
+      requestInterval: Token.asNumber("30"),
+      resourcePath: "/",
+      searchString: "example",
+      type: "HTTPS_STR_MATCH",
+    });
+  }
+}
+
+```
+
+### Aggregate Check
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Route53HealthCheck } from "./.gen/providers/aws/route53-health-check";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Route53HealthCheck(this, "parent", {
+      childHealthThreshold: 1,
+      childHealthchecks: [child.id],
+      tags: {
+        Name: "tf-test-calculated-health-check",
+      },
+      type: "CALCULATED",
+    });
+  }
+}
+
+```
+
+### CloudWatch Alarm Check
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudwatchMetricAlarm } from "./.gen/providers/aws/cloudwatch-metric-alarm";
+import { Route53HealthCheck } from "./.gen/providers/aws/route53-health-check";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const foobar = new CloudwatchMetricAlarm(this, "foobar", {
+      alarmDescription: "This metric monitors ec2 cpu utilization",
+      alarmName: "terraform-test-foobar5",
+      comparisonOperator: "GreaterThanOrEqualToThreshold",
+      evaluationPeriods: Token.asNumber("2"),
+      metricName: "CPUUtilization",
+      namespace: "AWS/EC2",
+      period: Token.asNumber("120"),
+      statistic: "Average",
+      threshold: Token.asNumber("80"),
+    });
+    new Route53HealthCheck(this, "foo", {
+      cloudwatchAlarmName: foobar.alarmName,
+      cloudwatchAlarmRegion: "us-west-2",
+      insufficientDataHealthStatus: "Healthy",
+      type: "CLOUDWATCH_METRIC",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+~> **Note:** At least one of either `fqdn` or `ipAddress` must be specified.
+
+* `referenceName` - (Optional) This is a reference name used in Caller Reference
+    (helpful for identifying single health_check set amongst others)
+* `fqdn` - (Optional) The fully qualified domain name of the endpoint to be checked. If a value is set for `ipAddress`, the value set for `fqdn` will be passed in the `host` header.
+* `ipAddress` - (Optional) The IP address of the endpoint to be checked.
+* `port` - (Optional) The port of the endpoint to be checked.
+* `type` - (Required) The protocol to use when performing health checks. Valid values are `http`, `https`, `httpStrMatch`, `httpsStrMatch`, `tcp`, `calculated`, `cloudwatchMetric` and `recoveryControl`.
+* `failureThreshold` - (Optional) The number of consecutive health checks that an endpoint must pass or fail.
+* `requestInterval` - (Required) The number of seconds between the time that Amazon Route 53 gets a response from your endpoint and the time that it sends the next health-check request.
+* `resourcePath` - (Optional) The path that you want Amazon Route 53 to request when performing health checks.
+* `searchString` - (Optional) String searched in the first 5120 bytes of the response body for check to be considered healthy. Only valid with `httpStrMatch` and `httpsStrMatch`.
+* `measureLatency` - (Optional) A Boolean value that indicates whether you want Route 53 to measure the latency between health checkers in multiple AWS regions and your endpoint and to display CloudWatch latency graphs in the Route 53 console.
+* `invertHealthcheck` - (Optional) A boolean value that indicates whether the status of health check should be inverted. For example, if a health check is healthy but Inverted is True , then Route 53 considers the health check to be unhealthy.
+* `disabled` - (Optional) A boolean value that stops Route 53 from performing health checks. When set to true, Route 53 will do the following depending on the type of health check:
+    * For health checks that check the health of endpoints, Route5 53 stops submitting requests to your application, server, or other resource.
+    * For calculated health checks, Route 53 stops aggregating the status of the referenced health checks.
+    * For health checks that monitor CloudWatch alarms, Route 53 stops monitoring the corresponding CloudWatch metrics.
+
+    ~> **Note:** After you disable a health check, Route 53 considers the status of the health check to always be healthy. If you configured DNS failover, Route 53 continues to route traffic to the corresponding resources. If you want to stop routing traffic to a resource, change the value of `invertHealthcheck`.
+* `enableSni` - (Optional) A boolean value that indicates whether Route53 should send the `fqdn` to the endpoint when performing the health check. This defaults to AWS' defaults: when the `type` is "HTTPS" `enableSni` defaults to `true`, when `type` is anything else `enableSni` defaults to `false`.
+* `childHealthchecks` - (Optional) For a specified parent health check, a list of HealthCheckId values for the associated child health checks.
+* `childHealthThreshold` - (Optional) The minimum number of child health checks that must be healthy for Route 53 to consider the parent health check to be healthy. Valid values are integers between 0 and 256, inclusive
+* `cloudwatchAlarmName` - (Optional) The name of the CloudWatch alarm.
+* `cloudwatchAlarmRegion` - (Optional) The CloudWatchRegion that the CloudWatch alarm was created in.
+* `insufficientDataHealthStatus` - (Optional) The status of the health check when CloudWatch has insufficient data about the state of associated alarm. Valid values are `healthy` , `unhealthy` and `lastKnownStatus`.
+* `regions` - (Optional) A list of AWS regions that you want Amazon Route 53 health checkers to check the specified endpoint from.
+* `routingControlArn` - (Optional) The Amazon Resource Name (ARN) for the Route 53 Application Recovery Controller routing control. This is used when health check type is `recoveryControl`
+* `tags` - (Optional) A map of tags to assign to the health check. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the Health Check.
+* `id` - The id of the health check
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Route53 Health Checks using the health check `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Route53 Health Checks using the health check `id`. For example:
+
+```console
+% terraform import aws_route53_health_check.http_check abcdef11-2222-3333-4444-555555fedcba
+```
+
+<!-- cache-key: cdktf-0.18.0 input-77cb2549229efadce71f35371e65ef572daabb8208abd05dfd647f7309112065 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/route53_hosted_zone_dnssec.html.markdown b/website/docs/cdktf/typescript/r/route53_hosted_zone_dnssec.html.markdown
new file mode 100644
index 00000000000..cb7f7447d6b
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/route53_hosted_zone_dnssec.html.markdown
@@ -0,0 +1,148 @@
+---
+subcategory: "Route 53"
+layout: "aws"
+page_title: "AWS: aws_route53_hosted_zone_dnssec"
+description: |-
+    Manages Route 53 Hosted Zone DNSSEC
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_route53_hosted_zone_dnssec
+
+Manages Route 53 Hosted Zone Domain Name System Security Extensions (DNSSEC). For more information about managing DNSSEC in Route 53, see the [Route 53 Developer Guide](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/dns-configuring-dnssec.html).
+
+!> **WARNING:** If you disable DNSSEC signing for your hosted zone before the DNS changes have propagated, your domain could become unavailable on the internet. When you remove the DS records, you must wait until the longest TTL for the DS records that you remove has expired before you complete the step to disable DNSSEC signing. Please refer to the [Route 53 Developer Guide - Disable DNSSEC](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/dns-configuring-dnssec-disable.html) for a detailed breakdown on the steps required to disable DNSSEC safely for a hosted zone.
+
+~> **Note:** Route53 hosted zones are global resources, and as such any `awsKmsKey` that you use as part of a signing key needs to be located in the `usEast1` region. In the example below, the main AWS provider declaration is for `usEast1`, however if you are provisioning your AWS resources in a different region, you will need to specify a provider alias and use that attached to the `awsKmsKey` resource as described in the [provider alias documentation](https://developer.hashicorp.com/terraform/language/providers/configuration#alias-multiple-provider-configurations).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCallerIdentity } from "./.gen/providers/aws/data-aws-caller-identity";
+import { KmsKey } from "./.gen/providers/aws/kms-key";
+import { AwsProvider } from "./.gen/providers/aws/provider";
+import { Route53HostedZoneDnssec } from "./.gen/providers/aws/route53-hosted-zone-dnssec";
+import { Route53KeySigningKey } from "./.gen/providers/aws/route53-key-signing-key";
+import { Route53Zone } from "./.gen/providers/aws/route53-zone";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AwsProvider(this, "aws", {
+      region: "us-east-1",
+    });
+    const example = new Route53Zone(this, "example", {
+      name: "example.com",
+    });
+    const current = new DataAwsCallerIdentity(this, "current", {});
+    const awsKmsKeyExample = new KmsKey(this, "example_3", {
+      customerMasterKeySpec: "ECC_NIST_P256",
+      deletionWindowInDays: 7,
+      keyUsage: "SIGN_VERIFY",
+      policy: Token.asString(
+        Fn.jsonencode({
+          Statement: [
+            {
+              Action: [
+                "kms:DescribeKey",
+                "kms:GetPublicKey",
+                "kms:Sign",
+                "kms:Verify",
+              ],
+              Effect: "Allow",
+              Principal: {
+                Service: "dnssec-route53.amazonaws.com",
+              },
+              Resource: "*",
+              Sid: "Allow Route 53 DNSSEC Service",
+            },
+            {
+              Action: "kms:*",
+              Effect: "Allow",
+              Principal: {
+                AWS: "arn:aws:iam::${" + current.accountId + "}:root",
+              },
+              Resource: "*",
+              Sid: "Enable IAM User Permissions",
+            },
+          ],
+          Version: "2012-10-17",
+        })
+      ),
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsKmsKeyExample.overrideLogicalId("example");
+    const awsRoute53KeySigningKeyExample = new Route53KeySigningKey(
+      this,
+      "example_4",
+      {
+        hostedZoneId: example.id,
+        keyManagementServiceArn: Token.asString(awsKmsKeyExample.arn),
+        name: "example",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsRoute53KeySigningKeyExample.overrideLogicalId("example");
+    const awsRoute53HostedZoneDnssecExample = new Route53HostedZoneDnssec(
+      this,
+      "example_5",
+      {
+        dependsOn: [awsRoute53KeySigningKeyExample],
+        hostedZoneId: Token.asString(
+          awsRoute53KeySigningKeyExample.hostedZoneId
+        ),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsRoute53HostedZoneDnssecExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `hostedZoneId` - (Required) Identifier of the Route 53 Hosted Zone.
+
+The following arguments are optional:
+
+* `signingStatus` - (Optional) Hosted Zone signing status. Valid values: `signing`, `notSigning`. Defaults to `signing`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Route 53 Hosted Zone identifier.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsRoute53HostedZoneDnssec` resources using the Route 53 Hosted Zone identifier. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsRoute53HostedZoneDnssec` resources using the Route 53 Hosted Zone identifier. For example:
+
+```console
+% terraform import aws_route53_hosted_zone_dnssec.example Z1D633PJN98FT9
+```
+
+<!-- cache-key: cdktf-0.18.0 input-c4b8c382f2fc6f33c01f94157d7d27795ecb00847b3a43f8ebf7840f68ff3214 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/route53_key_signing_key.html.markdown b/website/docs/cdktf/typescript/r/route53_key_signing_key.html.markdown
new file mode 100644
index 00000000000..5e09c9a9ab4
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/route53_key_signing_key.html.markdown
@@ -0,0 +1,167 @@
+---
+subcategory: "Route 53"
+layout: "aws"
+page_title: "AWS: aws_route53_key_signing_key"
+description: |-
+    Manages an Route 53 Key Signing Key
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_route53_key_signing_key
+
+Manages a Route 53 Key Signing Key. To manage Domain Name System Security Extensions (DNSSEC) for a Hosted Zone, see the [`awsRoute53HostedZoneDnssec` resource](route53_hosted_zone_dnssec.html). For more information about managing DNSSEC in Route 53, see the [Route 53 Developer Guide](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/dns-configuring-dnssec.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, Fn, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCallerIdentity } from "./.gen/providers/aws/data-aws-caller-identity";
+import { KmsKey } from "./.gen/providers/aws/kms-key";
+import { AwsProvider } from "./.gen/providers/aws/provider";
+import { Route53HostedZoneDnssec } from "./.gen/providers/aws/route53-hosted-zone-dnssec";
+import { Route53KeySigningKey } from "./.gen/providers/aws/route53-key-signing-key";
+import { Route53Zone } from "./.gen/providers/aws/route53-zone";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AwsProvider(this, "aws", {
+      region: "us-east-1",
+    });
+    const example = new Route53KeySigningKey(this, "example", {
+      hostedZoneId: test.id,
+      keyManagementServiceArn: Token.asString(awsKmsKeyTest.arn),
+      name: "example",
+    });
+    const awsRoute53ZoneExample = new Route53Zone(this, "example_2", {
+      name: "example.com",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsRoute53ZoneExample.overrideLogicalId("example");
+    const current = new DataAwsCallerIdentity(this, "current", {});
+    const awsKmsKeyExample = new KmsKey(this, "example_4", {
+      customerMasterKeySpec: "ECC_NIST_P256",
+      deletionWindowInDays: 7,
+      keyUsage: "SIGN_VERIFY",
+      policy: Token.asString(
+        Fn.jsonencode({
+          Statement: [
+            {
+              Action: ["kms:DescribeKey", "kms:GetPublicKey", "kms:Sign"],
+              Condition: {
+                ArnLike: {
+                  "aws:SourceArn": "arn:aws:route53:::hostedzone/*",
+                },
+                StringEquals: {
+                  "aws:SourceAccount": current.accountId,
+                },
+              },
+              Effect: "Allow",
+              Principal: {
+                Service: "dnssec-route53.amazonaws.com",
+              },
+              Resource: "*",
+              Sid: "Allow Route 53 DNSSEC Service",
+            },
+            {
+              Action: "kms:CreateGrant",
+              Condition: {
+                Bool: {
+                  "kms:GrantIsForAWSResource": "true",
+                },
+              },
+              Effect: "Allow",
+              Principal: {
+                Service: "dnssec-route53.amazonaws.com",
+              },
+              Resource: "*",
+              Sid: "Allow Route 53 DNSSEC Service to CreateGrant",
+            },
+            {
+              Action: "kms:*",
+              Effect: "Allow",
+              Principal: {
+                AWS: "arn:aws:iam::${" + current.accountId + "}:root",
+              },
+              Resource: "*",
+              Sid: "Enable IAM User Permissions",
+            },
+          ],
+          Version: "2012-10-17",
+        })
+      ),
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsKmsKeyExample.overrideLogicalId("example");
+    const awsRoute53HostedZoneDnssecExample = new Route53HostedZoneDnssec(
+      this,
+      "example_5",
+      {
+        dependsOn: [example],
+        hostedZoneId: example.hostedZoneId,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsRoute53HostedZoneDnssecExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `hostedZoneId` - (Required) Identifier of the Route 53 Hosted Zone.
+* `keyManagementServiceArn` - (Required) Amazon Resource Name (ARN) of the Key Management Service (KMS) Key. This must be unique for each key-signing key (KSK) in a single hosted zone. This key must be in the `usEast1` Region and meet certain requirements, which are described in the [Route 53 Developer Guide](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/dns-configuring-dnssec-cmk-requirements.html) and [Route 53 API Reference](https://docs.aws.amazon.com/Route53/latest/APIReference/API_CreateKeySigningKey.html).
+* `name` - (Required) Name of the key-signing key (KSK). Must be unique for each key-singing key in the same hosted zone.
+
+The following arguments are optional:
+
+* `status` - (Optional) Status of the key-signing key (KSK). Valid values: `active`, `inactive`. Defaults to `active`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `digestAlgorithmMnemonic` - A string used to represent the delegation signer digest algorithm. This value must follow the guidelines provided by [RFC-8624 Section 3.3](https://tools.ietf.org/html/rfc8624#section-3.3).
+* `digestAlgorithmType` - An integer used to represent the delegation signer digest algorithm. This value must follow the guidelines provided by [RFC-8624 Section 3.3](https://tools.ietf.org/html/rfc8624#section-3.3).
+* `digestValue` - A cryptographic digest of a DNSKEY resource record (RR). DNSKEY records are used to publish the public key that resolvers can use to verify DNSSEC signatures that are used to secure certain kinds of information provided by the DNS system.
+* `dnskeyRecord` - A string that represents a DNSKEY record.
+* `dsRecord` - A string that represents a delegation signer (DS) record.
+* `flag` - An integer that specifies how the key is used. For key-signing key (KSK), this value is always 257.
+* `id` - Route 53 Hosted Zone identifier and KMS Key identifier, separated by a comma (`,`).
+* `keyTag` - An integer used to identify the DNSSEC record for the domain name. The process used to calculate the value is described in [RFC-4034 Appendix B](https://tools.ietf.org/rfc/rfc4034.txt).
+* `publicKey` - The public key, represented as a Base64 encoding, as required by [RFC-4034 Page 5](https://tools.ietf.org/rfc/rfc4034.txt).
+* `signingAlgorithmMnemonic` - A string used to represent the signing algorithm. This value must follow the guidelines provided by [RFC-8624 Section 3.1](https://tools.ietf.org/html/rfc8624#section-3.1).
+* `signingAlgorithmType` - An integer used to represent the signing algorithm. This value must follow the guidelines provided by [RFC-8624 Section 3.1](https://tools.ietf.org/html/rfc8624#section-3.1).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsRoute53KeySigningKey` resources using the Route 53 Hosted Zone identifier and KMS Key identifier, separated by a comma (`,`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsRoute53KeySigningKey` resources using the Route 53 Hosted Zone identifier and KMS Key identifier, separated by a comma (`,`). For example:
+
+```console
+% terraform import aws_route53_key_signing_key.example Z1D633PJN98FT9,example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-eeafa23f3b2cf9c292211ba55ca229ed45cfe8d510a9b973ce0489a244999fd8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/route53_query_log.html.markdown b/website/docs/cdktf/typescript/r/route53_query_log.html.markdown
new file mode 100644
index 00000000000..006150e17ed
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/route53_query_log.html.markdown
@@ -0,0 +1,136 @@
+---
+subcategory: "Route 53"
+layout: "aws"
+page_title: "AWS: aws_route53_query_log"
+description: |-
+  Provides a Route53 query logging configuration resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_route53_query_log
+
+Provides a Route53 query logging configuration resource.
+
+~> **NOTE:** There are restrictions on the configuration of query logging. Notably,
+the CloudWatch log group must be in the `usEast1` region,
+a permissive CloudWatch log resource policy must be in place, and
+the Route53 hosted zone must be public.
+See [Configuring Logging for DNS Queries](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/query-logs.html?console_help=true#query-logs-configuring) for additional details.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudwatchLogGroup } from "./.gen/providers/aws/cloudwatch-log-group";
+import { CloudwatchLogResourcePolicy } from "./.gen/providers/aws/cloudwatch-log-resource-policy";
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { AwsProvider } from "./.gen/providers/aws/provider";
+import { Route53QueryLog } from "./.gen/providers/aws/route53-query-log";
+import { Route53Zone } from "./.gen/providers/aws/route53-zone";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const usEast1 = new AwsProvider(this, "aws", {
+      alias: "us-east-1",
+      region: "us-east-1",
+    });
+    const exampleCom = new Route53Zone(this, "example_com", {
+      name: "example.com",
+    });
+    const route53QueryLoggingPolicy = new DataAwsIamPolicyDocument(
+      this,
+      "route53-query-logging-policy",
+      {
+        statement: [
+          {
+            actions: ["logs:CreateLogStream", "logs:PutLogEvents"],
+            principals: [
+              {
+                identifiers: ["route53.amazonaws.com"],
+                type: "Service",
+              },
+            ],
+            resources: ["arn:aws:logs:*:*:log-group:/aws/route53/*"],
+          },
+        ],
+      }
+    );
+    const awsRoute53ExampleCom = new CloudwatchLogGroup(
+      this,
+      "aws_route53_example_com",
+      {
+        name: "/aws/route53/${" + exampleCom.name + "}",
+        provider: usEast1,
+        retentionInDays: 30,
+      }
+    );
+    const awsCloudwatchLogResourcePolicyRoute53QueryLoggingPolicy =
+      new CloudwatchLogResourcePolicy(this, "route53-query-logging-policy_4", {
+        policyDocument: Token.asString(route53QueryLoggingPolicy.json),
+        policyName: "route53-query-logging-policy",
+        provider: usEast1,
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsCloudwatchLogResourcePolicyRoute53QueryLoggingPolicy.overrideLogicalId(
+      "route53-query-logging-policy"
+    );
+    const awsRoute53QueryLogExampleCom = new Route53QueryLog(
+      this,
+      "example_com_5",
+      {
+        cloudwatchLogGroupArn: awsRoute53ExampleCom.arn,
+        dependsOn: [awsCloudwatchLogResourcePolicyRoute53QueryLoggingPolicy],
+        zoneId: exampleCom.zoneId,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsRoute53QueryLogExampleCom.overrideLogicalId("example_com");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `cloudwatchLogGroupArn` - (Required) CloudWatch log group ARN to send query logs.
+* `zoneId` - (Required) Route53 hosted zone ID to enable query logs.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the Query Logging Config.
+* `id` - The query logging configuration ID
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Route53 query logging configurations using their ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Route53 query logging configurations using their ID. For example:
+
+```console
+% terraform import aws_route53_query_log.example_com xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
+```
+
+<!-- cache-key: cdktf-0.18.0 input-d9656f2fc1e20251769a3e2a3d8099ca32009721211d5ef362901f305ddc7e9e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/route53_record.html.markdown b/website/docs/cdktf/typescript/r/route53_record.html.markdown
new file mode 100644
index 00000000000..2733128d04b
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/route53_record.html.markdown
@@ -0,0 +1,291 @@
+---
+subcategory: "Route 53"
+layout: "aws"
+page_title: "AWS: aws_route53_record"
+description: |-
+  Provides a Route53 record resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_route53_record
+
+Provides a Route53 record resource.
+
+## Example Usage
+
+### Simple routing policy
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Route53Record } from "./.gen/providers/aws/route53-record";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Route53Record(this, "www", {
+      name: "www.example.com",
+      records: [lb.publicIp],
+      ttl: 300,
+      type: "A",
+      zoneId: primary.zoneId,
+    });
+  }
+}
+
+```
+
+### Weighted routing policy
+
+Other routing policies are configured similarly. See [Amazon Route 53 Developer Guide](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-policy.html) for details.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Route53Record } from "./.gen/providers/aws/route53-record";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Route53Record(this, "www-dev", {
+      name: "www",
+      records: ["dev.example.com"],
+      setIdentifier: "dev",
+      ttl: 5,
+      type: "CNAME",
+      weightedRoutingPolicy: {
+        weight: 10,
+      },
+      zoneId: primary.zoneId,
+    });
+    new Route53Record(this, "www-live", {
+      name: "www",
+      records: ["live.example.com"],
+      setIdentifier: "live",
+      ttl: 5,
+      type: "CNAME",
+      weightedRoutingPolicy: {
+        weight: 90,
+      },
+      zoneId: primary.zoneId,
+    });
+  }
+}
+
+```
+
+### Alias record
+
+See [related part of Amazon Route 53 Developer Guide](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resource-record-sets-choosing-alias-non-alias.html)
+to understand differences between alias and non-alias records.
+
+TTL for all alias records is [60 seconds](https://aws.amazon.com/route53/faqs/#dns_failover_do_i_need_to_adjust),
+you cannot change this, therefore `ttl` has to be omitted in alias records.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Elb } from "./.gen/providers/aws/elb";
+import { Route53Record } from "./.gen/providers/aws/route53-record";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const main = new Elb(this, "main", {
+      availabilityZones: ["us-east-1c"],
+      listener: [
+        {
+          instancePort: 80,
+          instanceProtocol: "http",
+          lbPort: 80,
+          lbProtocol: "http",
+        },
+      ],
+      name: "foobar-terraform-elb",
+    });
+    new Route53Record(this, "www", {
+      alias: {
+        evaluateTargetHealth: true,
+        name: main.dnsName,
+        zoneId: main.zoneId,
+      },
+      name: "example.com",
+      type: "A",
+      zoneId: primary.zoneId,
+    });
+  }
+}
+
+```
+
+### NS and SOA Record Management
+
+When creating Route 53 zones, the `ns` and `soa` records for the zone are automatically created. Enabling the `allowOverwrite` argument will allow managing these records in a single Terraform run without the requirement for `terraform import`.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Route53Record } from "./.gen/providers/aws/route53-record";
+import { Route53Zone } from "./.gen/providers/aws/route53-zone";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new Route53Zone(this, "example", {
+      name: "test.example.com",
+    });
+    const awsRoute53RecordExample = new Route53Record(this, "example_1", {
+      allowOverwrite: true,
+      name: "test.example.com",
+      records: [
+        Token.asString(Fn.lookupNested(example.nameServers, ["0"])),
+        Token.asString(Fn.lookupNested(example.nameServers, ["1"])),
+        Token.asString(Fn.lookupNested(example.nameServers, ["2"])),
+        Token.asString(Fn.lookupNested(example.nameServers, ["3"])),
+      ],
+      ttl: 172800,
+      type: "NS",
+      zoneId: example.zoneId,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsRoute53RecordExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `zoneId` - (Required) The ID of the hosted zone to contain this record.
+* `name` - (Required) The name of the record.
+* `type` - (Required) The record type. Valid values are `a`, `aaaa`, `caa`, `cname`, `ds`, `mx`, `naptr`, `ns`, `ptr`, `soa`, `spf`, `srv` and `txt`.
+* `ttl` - (Required for non-alias records) The TTL of the record.
+* `records` - (Required for non-alias records) A string list of records. To specify a single record value longer than 255 characters such as a TXT record for DKIM, add `\"\"` inside the Terraform configuration string (e.g., `"first255Characters\"\"morecharacters"`).
+* `setIdentifier` - (Optional) Unique identifier to differentiate records with routing policies from one another. Required if using `cidrRoutingPolicy`, `failoverRoutingPolicy`, `geolocationRoutingPolicy`, `latencyRoutingPolicy`, `multivalueAnswerRoutingPolicy`, or `weightedRoutingPolicy`.
+* `healthCheckId` - (Optional) The health check the record should be associated with.
+* `alias` - (Optional) An alias block. Conflicts with `ttl` & `records`.
+  [Documented below](#alias).
+* `cidrRoutingPolicy` - (Optional) A block indicating a routing policy based on the IP network ranges of requestors. Conflicts with any other routing policy. [Documented below](#cidr-routing-policy).
+* `failoverRoutingPolicy` - (Optional) A block indicating the routing behavior when associated health check fails. Conflicts with any other routing policy. [Documented below](#failover-routing-policy).
+* `geolocationRoutingPolicy` - (Optional) A block indicating a routing policy based on the geolocation of the requestor. Conflicts with any other routing policy. [Documented below](#geolocation-routing-policy).
+* `latencyRoutingPolicy` - (Optional) A block indicating a routing policy based on the latency between the requestor and an AWS region. Conflicts with any other routing policy. [Documented below](#latency-routing-policy).
+* `multivalueAnswerRoutingPolicy` - (Optional) Set to `true` to indicate a multivalue answer routing policy. Conflicts with any other routing policy.
+* `weightedRoutingPolicy` - (Optional) A block indicating a weighted routing policy. Conflicts with any other routing policy. [Documented below](#weighted-routing-policy).
+* `allowOverwrite` - (Optional) Allow creation of this record in Terraform to overwrite an existing record, if any. This does not affect the ability to update the record in Terraform and does not prevent other resources within Terraform or manual Route 53 changes outside Terraform from overwriting this record. `false` by default. This configuration is not recommended for most environments.
+
+Exactly one of `records` or `alias` must be specified: this determines whether it's an alias record.
+
+### Alias
+
+Alias records support the following:
+
+* `name` - (Required) DNS domain name for a CloudFront distribution, S3 bucket, ELB, or another resource record set in this hosted zone.
+* `zoneId` - (Required) Hosted zone ID for a CloudFront distribution, S3 bucket, ELB, or Route 53 hosted zone. See [`resourceElbZoneId`](/docs/providers/aws/r/elb.html#zone_id) for example.
+* `evaluateTargetHealth` - (Required) Set to `true` if you want Route 53 to determine whether to respond to DNS queries using this resource record set by checking the health of the resource record set. Some resources have special requirements, see [related part of documentation](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resource-record-sets-values.html#rrsets-values-alias-evaluate-target-health).
+
+### CIDR Routing Policy
+
+CIDR routing policies support the following:
+
+* `collectionId` - (Required) The CIDR collection ID. See the [`awsRoute53CidrCollection` resource](route53_cidr_collection.html) for more details.
+* `locationName` - (Required) The CIDR collection location name. See the [`awsRoute53CidrLocation` resource](route53_cidr_location.html) for more details. A `locationName` with an asterisk `"*"` can be used to create a default CIDR record. `collectionId` is still required for default record.
+
+### Failover Routing Policy
+
+Failover routing policies support the following:
+
+* `type` - (Required) `primary` or `secondary`. A `primary` record will be served if its healthcheck is passing, otherwise the `secondary` will be served. See http://docs.aws.amazon.com/Route53/latest/DeveloperGuide/dns-failover-configuring-options.html#dns-failover-failover-rrsets
+
+### Geolocation Routing Policy
+
+Geolocation routing policies support the following:
+
+* `continent` - A two-letter continent code. See http://docs.aws.amazon.com/Route53/latest/APIReference/API_GetGeoLocation.html for code details. Either `continent` or `country` must be specified.
+* `country` - A two-character country code or `*` to indicate a default resource record set.
+* `subdivision` - (Optional) A subdivision code for a country.
+
+### Latency Routing Policy
+
+Latency routing policies support the following:
+
+* `region` - (Required) An AWS region from which to measure latency. See http://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-policy.html#routing-policy-latency
+
+### Weighted Routing Policy
+
+Weighted routing policies support the following:
+
+* `weight` - (Required) A numeric value indicating the relative weight of the record. See http://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-policy.html#routing-policy-weighted.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `name` - The name of the record.
+* `fqdn` - [FQDN](https://en.wikipedia.org/wiki/Fully_qualified_domain_name) built using the zone domain and `name`.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Route53 Records using the ID of the record, record name, record type, and set identifier. For example:
+
+Using the ID of the record, which is the zone identifier, record name, and record type, separated by underscores (`_`):
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+If the record also contains a set identifier, append it:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+**Using `terraform import` to import** Route53 Records using the ID of the record, record name, record type, and set identifier. For example:
+
+Using the ID of the record, which is the zone identifier, record name, and record type, separated by underscores (`_`):
+
+```console
+% terraform import aws_route53_record.myrecord Z4KAPRWWNC7JR_dev.example.com_NS
+```
+
+If the record also contains a set identifier, append it:
+
+```console
+% terraform import aws_route53_record.myrecord Z4KAPRWWNC7JR_dev.example.com_NS_dev
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ff3c2884016714726f134a120fd1d35b335e3a18fa3df771cb63253090a4eb1e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/route53_resolver_config.html.markdown b/website/docs/cdktf/typescript/r/route53_resolver_config.html.markdown
new file mode 100644
index 00000000000..6ba5e1610fa
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/route53_resolver_config.html.markdown
@@ -0,0 +1,86 @@
+---
+subcategory: "Route 53 Resolver"
+layout: "aws"
+page_title: "AWS: aws_route53_resolver_config"
+description: |-
+  Provides a Route 53 Resolver config resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_route53_resolver_config
+
+Provides a Route 53 Resolver config resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Route53ResolverConfig } from "./.gen/providers/aws/route53-resolver-config";
+import { Vpc } from "./.gen/providers/aws/vpc";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new Vpc(this, "example", {
+      cidrBlock: "10.0.0.0/16",
+      enableDnsHostnames: true,
+      enableDnsSupport: true,
+    });
+    const awsRoute53ResolverConfigExample = new Route53ResolverConfig(
+      this,
+      "example_1",
+      {
+        autodefinedReverseFlag: "DISABLE",
+        resourceId: example.id,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsRoute53ResolverConfigExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `resourceId` - (Required) The ID of the VPC that the configuration is for.
+* `autodefinedReverseFlag` - (Required) Indicates whether or not the Resolver will create autodefined rules for reverse DNS lookups. Valid values: `enable`, `disable`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the resolver configuration.
+* `ownerId` - The AWS account ID of the owner of the VPC that this resolver configuration applies to.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Route 53 Resolver configs using the Route 53 Resolver config ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Route 53 Resolver configs using the Route 53 Resolver config ID. For example:
+
+```console
+% terraform import aws_route53_resolver_config.example rslvr-rc-715aa20c73a23da7
+```
+
+<!-- cache-key: cdktf-0.18.0 input-9e9ab64717f5492816cdea672c9253b6943b2cad6b967b971fcb44194acec4cf -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/route53_resolver_dnssec_config.html.markdown b/website/docs/cdktf/typescript/r/route53_resolver_dnssec_config.html.markdown
new file mode 100644
index 00000000000..1ef8411cd43
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/route53_resolver_dnssec_config.html.markdown
@@ -0,0 +1,83 @@
+---
+subcategory: "Route 53 Resolver"
+layout: "aws"
+page_title: "AWS: aws_route53_resolver_dnssec_config"
+description: |-
+  Provides a Route 53 Resolver DNSSEC config resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_route53_resolver_dnssec_config
+
+Provides a Route 53 Resolver DNSSEC config resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Route53ResolverDnssecConfig } from "./.gen/providers/aws/route53-resolver-dnssec-config";
+import { Vpc } from "./.gen/providers/aws/vpc";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new Vpc(this, "example", {
+      cidrBlock: "10.0.0.0/16",
+      enableDnsHostnames: true,
+      enableDnsSupport: true,
+    });
+    const awsRoute53ResolverDnssecConfigExample =
+      new Route53ResolverDnssecConfig(this, "example_1", {
+        resourceId: example.id,
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsRoute53ResolverDnssecConfigExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `resourceId` - (Required) The ID of the virtual private cloud (VPC) that you're updating the DNSSEC validation status for.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN for a configuration for DNSSEC validation.
+* `id` - The ID for a configuration for DNSSEC validation.
+* `ownerId` - The owner account ID of the virtual private cloud (VPC) for a configuration for DNSSEC validation.
+* `validationStatus` - The validation status for a DNSSEC configuration. The status can be one of the following: `enabling`, `enabled`, `disabling` and `disabled`.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import  Route 53 Resolver DNSSEC configs using the Route 53 Resolver DNSSEC config ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import  Route 53 Resolver DNSSEC configs using the Route 53 Resolver DNSSEC config ID. For example:
+
+```console
+% terraform import aws_route53_resolver_dnssec_config.example rdsc-be1866ecc1683e95
+```
+
+<!-- cache-key: cdktf-0.18.0 input-65576be1323a01047ddd84b194036361eced4cbe29a22e9031f40a7283d1af9a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/route53_resolver_endpoint.html.markdown b/website/docs/cdktf/typescript/r/route53_resolver_endpoint.html.markdown
new file mode 100644
index 00000000000..35f4e6903e4
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/route53_resolver_endpoint.html.markdown
@@ -0,0 +1,108 @@
+---
+subcategory: "Route 53 Resolver"
+layout: "aws"
+page_title: "AWS: aws_route53_resolver_endpoint"
+description: |-
+  Provides a Route 53 Resolver endpoint resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_route53_resolver_endpoint
+
+Provides a Route 53 Resolver endpoint resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Route53ResolverEndpoint } from "./.gen/providers/aws/route53-resolver-endpoint";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Route53ResolverEndpoint(this, "foo", {
+      direction: "INBOUND",
+      ipAddress: [
+        {
+          subnetId: sn1.id,
+        },
+        {
+          ip: "10.0.64.4",
+          subnetId: sn2.id,
+        },
+      ],
+      name: "foo",
+      securityGroupIds: [sg1.id, sg2.id],
+      tags: {
+        Environment: "Prod",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `direction` - (Required) The direction of DNS queries to or from the Route 53 Resolver endpoint.
+Valid values are `inbound` (resolver forwards DNS queries to the DNS service for a VPC from your network or another VPC)
+or `outbound` (resolver forwards DNS queries from the DNS service for a VPC to your network or another VPC).
+* `ipAddress` - (Required) The subnets and IP addresses in your VPC that you want DNS queries to pass through on the way from your VPCs
+to your network (for outbound endpoints) or on the way from your network to your VPCs (for inbound endpoints). Described below.
+* `securityGroupIds` - (Required) The ID of one or more security groups that you want to use to control access to this VPC.
+* `name` - (Optional) The friendly name of the Route 53 Resolver endpoint.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+The `ipAddress` object supports the following:
+
+* `subnetId` - (Required) The ID of the subnet that contains the IP address.
+* `ip` - (Optional) The IP address in the subnet that you want to use for DNS queries.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the Route 53 Resolver endpoint.
+* `arn` - The ARN of the Route 53 Resolver endpoint.
+* `hostVpcId` - The ID of the VPC that you want to create the resolver endpoint in.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `10M`)
+- `update` - (Default `10M`)
+- `delete` - (Default `10M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import  Route 53 Resolver endpoints using the Route 53 Resolver endpoint ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import  Route 53 Resolver endpoints using the Route 53 Resolver endpoint ID. For example:
+
+```console
+% terraform import aws_route53_resolver_endpoint.foo rslvr-in-abcdef01234567890
+```
+
+<!-- cache-key: cdktf-0.18.0 input-17a9ce982f1bbb8ea75dad88b3aa989a8f0aad667032d40125014dcc640c486e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/route53_resolver_firewall_config.html.markdown b/website/docs/cdktf/typescript/r/route53_resolver_firewall_config.html.markdown
new file mode 100644
index 00000000000..2cf05714497
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/route53_resolver_firewall_config.html.markdown
@@ -0,0 +1,83 @@
+---
+subcategory: "Route 53 Resolver"
+layout: "aws"
+page_title: "AWS: aws_route53_resolver_firewall_config"
+description: |-
+  Provides a Route 53 Resolver DNS Firewall config resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_route53_resolver_firewall_config
+
+Provides a Route 53 Resolver DNS Firewall config resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Route53ResolverFirewallConfig } from "./.gen/providers/aws/route53-resolver-firewall-config";
+import { Vpc } from "./.gen/providers/aws/vpc";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new Vpc(this, "example", {
+      cidrBlock: "10.0.0.0/16",
+      enableDnsHostnames: true,
+      enableDnsSupport: true,
+    });
+    const awsRoute53ResolverFirewallConfigExample =
+      new Route53ResolverFirewallConfig(this, "example_1", {
+        firewallFailOpen: "ENABLED",
+        resourceId: example.id,
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsRoute53ResolverFirewallConfigExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `resourceId` - (Required) The ID of the VPC that the configuration is for.
+* `firewallFailOpen` - (Required) Determines how Route 53 Resolver handles queries during failures, for example when all traffic that is sent to DNS Firewall fails to receive a reply. By default, fail open is disabled, which means the failure mode is closed. This approach favors security over availability. DNS Firewall blocks queries that it is unable to evaluate properly. If you enable this option, the failure mode is open. This approach favors availability over security. DNS Firewall allows queries to proceed if it is unable to properly evaluate them. Valid values: `enabled`, `disabled`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the firewall configuration.
+* `ownerId` - The AWS account ID of the owner of the VPC that this firewall configuration applies to.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Route 53 Resolver DNS Firewall configs using the Route 53 Resolver DNS Firewall config ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Route 53 Resolver DNS Firewall configs using the Route 53 Resolver DNS Firewall config ID. For example:
+
+```console
+% terraform import aws_route53_resolver_firewall_config.example rdsc-be1866ecc1683e95
+```
+
+<!-- cache-key: cdktf-0.18.0 input-47300e21e1334742b1c6242fae853e95ab5ebc4549ee0296560b626b37cb47ed -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/route53_resolver_firewall_config.markdown b/website/docs/cdktf/typescript/r/route53_resolver_firewall_config.markdown
new file mode 100644
index 00000000000..2cf05714497
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/route53_resolver_firewall_config.markdown
@@ -0,0 +1,83 @@
+---
+subcategory: "Route 53 Resolver"
+layout: "aws"
+page_title: "AWS: aws_route53_resolver_firewall_config"
+description: |-
+  Provides a Route 53 Resolver DNS Firewall config resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_route53_resolver_firewall_config
+
+Provides a Route 53 Resolver DNS Firewall config resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Route53ResolverFirewallConfig } from "./.gen/providers/aws/route53-resolver-firewall-config";
+import { Vpc } from "./.gen/providers/aws/vpc";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new Vpc(this, "example", {
+      cidrBlock: "10.0.0.0/16",
+      enableDnsHostnames: true,
+      enableDnsSupport: true,
+    });
+    const awsRoute53ResolverFirewallConfigExample =
+      new Route53ResolverFirewallConfig(this, "example_1", {
+        firewallFailOpen: "ENABLED",
+        resourceId: example.id,
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsRoute53ResolverFirewallConfigExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `resourceId` - (Required) The ID of the VPC that the configuration is for.
+* `firewallFailOpen` - (Required) Determines how Route 53 Resolver handles queries during failures, for example when all traffic that is sent to DNS Firewall fails to receive a reply. By default, fail open is disabled, which means the failure mode is closed. This approach favors security over availability. DNS Firewall blocks queries that it is unable to evaluate properly. If you enable this option, the failure mode is open. This approach favors availability over security. DNS Firewall allows queries to proceed if it is unable to properly evaluate them. Valid values: `enabled`, `disabled`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the firewall configuration.
+* `ownerId` - The AWS account ID of the owner of the VPC that this firewall configuration applies to.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Route 53 Resolver DNS Firewall configs using the Route 53 Resolver DNS Firewall config ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Route 53 Resolver DNS Firewall configs using the Route 53 Resolver DNS Firewall config ID. For example:
+
+```console
+% terraform import aws_route53_resolver_firewall_config.example rdsc-be1866ecc1683e95
+```
+
+<!-- cache-key: cdktf-0.18.0 input-47300e21e1334742b1c6242fae853e95ab5ebc4549ee0296560b626b37cb47ed -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/route53_resolver_firewall_domain_list.html.markdown b/website/docs/cdktf/typescript/r/route53_resolver_firewall_domain_list.html.markdown
new file mode 100644
index 00000000000..7cc3018a474
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/route53_resolver_firewall_domain_list.html.markdown
@@ -0,0 +1,75 @@
+---
+subcategory: "Route 53 Resolver"
+layout: "aws"
+page_title: "AWS: aws_route53_resolver_firewall_domain_list"
+description: |-
+  Provides a Route 53 Resolver DNS Firewall domain list resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_route53_resolver_firewall_domain_list
+
+Provides a Route 53 Resolver DNS Firewall domain list resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Route53ResolverFirewallDomainList } from "./.gen/providers/aws/route53-resolver-firewall-domain-list";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Route53ResolverFirewallDomainList(this, "example", {
+      name: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) A name that lets you identify the domain list, to manage and use it.
+* `domains` - (Optional) A array of domains for the firewall domain list.
+* `tags` - (Optional) A map of tags to assign to the resource. f configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN (Amazon Resource Name) of the domain list.
+* `id` - The ID of the domain list.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import  Route 53 Resolver DNS Firewall domain lists using the Route 53 Resolver DNS Firewall domain list ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import  Route 53 Resolver DNS Firewall domain lists using the Route 53 Resolver DNS Firewall domain list ID. For example:
+
+```console
+% terraform import aws_route53_resolver_firewall_domain_list.example rslvr-fdl-0123456789abcdef
+```
+
+<!-- cache-key: cdktf-0.18.0 input-3154f1bdcac6cbca6a0b5ed4de8e5f387de71af6809cbe31b5fc56bec0e07a22 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/route53_resolver_firewall_domain_list.markdown b/website/docs/cdktf/typescript/r/route53_resolver_firewall_domain_list.markdown
new file mode 100644
index 00000000000..7cc3018a474
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/route53_resolver_firewall_domain_list.markdown
@@ -0,0 +1,75 @@
+---
+subcategory: "Route 53 Resolver"
+layout: "aws"
+page_title: "AWS: aws_route53_resolver_firewall_domain_list"
+description: |-
+  Provides a Route 53 Resolver DNS Firewall domain list resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_route53_resolver_firewall_domain_list
+
+Provides a Route 53 Resolver DNS Firewall domain list resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Route53ResolverFirewallDomainList } from "./.gen/providers/aws/route53-resolver-firewall-domain-list";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Route53ResolverFirewallDomainList(this, "example", {
+      name: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) A name that lets you identify the domain list, to manage and use it.
+* `domains` - (Optional) A array of domains for the firewall domain list.
+* `tags` - (Optional) A map of tags to assign to the resource. f configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN (Amazon Resource Name) of the domain list.
+* `id` - The ID of the domain list.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import  Route 53 Resolver DNS Firewall domain lists using the Route 53 Resolver DNS Firewall domain list ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import  Route 53 Resolver DNS Firewall domain lists using the Route 53 Resolver DNS Firewall domain list ID. For example:
+
+```console
+% terraform import aws_route53_resolver_firewall_domain_list.example rslvr-fdl-0123456789abcdef
+```
+
+<!-- cache-key: cdktf-0.18.0 input-3154f1bdcac6cbca6a0b5ed4de8e5f387de71af6809cbe31b5fc56bec0e07a22 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/route53_resolver_firewall_rule.html.markdown b/website/docs/cdktf/typescript/r/route53_resolver_firewall_rule.html.markdown
new file mode 100644
index 00000000000..0beef3eefeb
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/route53_resolver_firewall_rule.html.markdown
@@ -0,0 +1,106 @@
+---
+subcategory: "Route 53 Resolver"
+layout: "aws"
+page_title: "AWS: aws_route53_resolver_firewall_rule"
+description: |-
+  Provides a Route 53 Resolver DNS Firewall rule resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_route53_resolver_firewall_rule
+
+Provides a Route 53 Resolver DNS Firewall rule resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Route53ResolverFirewallDomainList } from "./.gen/providers/aws/route53-resolver-firewall-domain-list";
+import { Route53ResolverFirewallRule } from "./.gen/providers/aws/route53-resolver-firewall-rule";
+import { Route53ResolverFirewallRuleGroup } from "./.gen/providers/aws/route53-resolver-firewall-rule-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new Route53ResolverFirewallDomainList(this, "example", {
+      domains: ["example.com"],
+      name: "example",
+      tags: {},
+    });
+    const awsRoute53ResolverFirewallRuleGroupExample =
+      new Route53ResolverFirewallRuleGroup(this, "example_1", {
+        name: "example",
+        tags: {},
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsRoute53ResolverFirewallRuleGroupExample.overrideLogicalId("example");
+    const awsRoute53ResolverFirewallRuleExample =
+      new Route53ResolverFirewallRule(this, "example_2", {
+        action: "BLOCK",
+        blockOverrideDnsType: "CNAME",
+        blockOverrideDomain: "example.com",
+        blockOverrideTtl: 1,
+        blockResponse: "OVERRIDE",
+        firewallDomainListId: example.id,
+        firewallRuleGroupId: Token.asString(
+          awsRoute53ResolverFirewallRuleGroupExample.id
+        ),
+        name: "example",
+        priority: 100,
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsRoute53ResolverFirewallRuleExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) A name that lets you identify the rule, to manage and use it.
+* `action` - (Required) The action that DNS Firewall should take on a DNS query when it matches one of the domains in the rule's domain list. Valid values: `allow`, `block`, `alert`.
+* `blockOverrideDnsType` - (Required if `blockResponse` is `override`) The DNS record's type. This determines the format of the record value that you provided in BlockOverrideDomain. Value values: `cname`.
+* `blockOverrideDomain` - (Required if `blockResponse` is `override`) The custom DNS record to send back in response to the query.
+* `blockOverrideTtl` - (Required if `blockResponse` is `override`) The recommended amount of time, in seconds, for the DNS resolver or web browser to cache the provided override record. Minimum value of 0. Maximum value of 604800.
+* `blockResponse` - (Required if `action` is `block`) The way that you want DNS Firewall to block the request. Valid values: `nodata`, `nxdomain`, `override`.
+* `firewallDomainListId` - (Required) The ID of the domain list that you want to use in the rule.
+* `firewallRuleGroupId` - (Required) The unique identifier of the firewall rule group where you want to create the rule.
+* `priority` - (Required) The setting that determines the processing order of the rule in the rule group. DNS Firewall processes the rules in a rule group by order of priority, starting from the lowest setting.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the rule.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import  Route 53 Resolver DNS Firewall rules using the Route 53 Resolver DNS Firewall rule group ID and domain list ID separated by ':'. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import  Route 53 Resolver DNS Firewall rules using the Route 53 Resolver DNS Firewall rule group ID and domain list ID separated by ':'. For example:
+
+```console
+% terraform import aws_route53_resolver_firewall_rule.example rslvr-frg-0123456789abcdef:rslvr-fdl-0123456789abcdef
+```
+
+<!-- cache-key: cdktf-0.18.0 input-91abb2b9b51d1173006c0a1458d5a94bbfd790f314498d4abce090eaa02a7e45 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/route53_resolver_firewall_rule.markdown b/website/docs/cdktf/typescript/r/route53_resolver_firewall_rule.markdown
new file mode 100644
index 00000000000..0beef3eefeb
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/route53_resolver_firewall_rule.markdown
@@ -0,0 +1,106 @@
+---
+subcategory: "Route 53 Resolver"
+layout: "aws"
+page_title: "AWS: aws_route53_resolver_firewall_rule"
+description: |-
+  Provides a Route 53 Resolver DNS Firewall rule resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_route53_resolver_firewall_rule
+
+Provides a Route 53 Resolver DNS Firewall rule resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Route53ResolverFirewallDomainList } from "./.gen/providers/aws/route53-resolver-firewall-domain-list";
+import { Route53ResolverFirewallRule } from "./.gen/providers/aws/route53-resolver-firewall-rule";
+import { Route53ResolverFirewallRuleGroup } from "./.gen/providers/aws/route53-resolver-firewall-rule-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new Route53ResolverFirewallDomainList(this, "example", {
+      domains: ["example.com"],
+      name: "example",
+      tags: {},
+    });
+    const awsRoute53ResolverFirewallRuleGroupExample =
+      new Route53ResolverFirewallRuleGroup(this, "example_1", {
+        name: "example",
+        tags: {},
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsRoute53ResolverFirewallRuleGroupExample.overrideLogicalId("example");
+    const awsRoute53ResolverFirewallRuleExample =
+      new Route53ResolverFirewallRule(this, "example_2", {
+        action: "BLOCK",
+        blockOverrideDnsType: "CNAME",
+        blockOverrideDomain: "example.com",
+        blockOverrideTtl: 1,
+        blockResponse: "OVERRIDE",
+        firewallDomainListId: example.id,
+        firewallRuleGroupId: Token.asString(
+          awsRoute53ResolverFirewallRuleGroupExample.id
+        ),
+        name: "example",
+        priority: 100,
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsRoute53ResolverFirewallRuleExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) A name that lets you identify the rule, to manage and use it.
+* `action` - (Required) The action that DNS Firewall should take on a DNS query when it matches one of the domains in the rule's domain list. Valid values: `allow`, `block`, `alert`.
+* `blockOverrideDnsType` - (Required if `blockResponse` is `override`) The DNS record's type. This determines the format of the record value that you provided in BlockOverrideDomain. Value values: `cname`.
+* `blockOverrideDomain` - (Required if `blockResponse` is `override`) The custom DNS record to send back in response to the query.
+* `blockOverrideTtl` - (Required if `blockResponse` is `override`) The recommended amount of time, in seconds, for the DNS resolver or web browser to cache the provided override record. Minimum value of 0. Maximum value of 604800.
+* `blockResponse` - (Required if `action` is `block`) The way that you want DNS Firewall to block the request. Valid values: `nodata`, `nxdomain`, `override`.
+* `firewallDomainListId` - (Required) The ID of the domain list that you want to use in the rule.
+* `firewallRuleGroupId` - (Required) The unique identifier of the firewall rule group where you want to create the rule.
+* `priority` - (Required) The setting that determines the processing order of the rule in the rule group. DNS Firewall processes the rules in a rule group by order of priority, starting from the lowest setting.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the rule.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import  Route 53 Resolver DNS Firewall rules using the Route 53 Resolver DNS Firewall rule group ID and domain list ID separated by ':'. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import  Route 53 Resolver DNS Firewall rules using the Route 53 Resolver DNS Firewall rule group ID and domain list ID separated by ':'. For example:
+
+```console
+% terraform import aws_route53_resolver_firewall_rule.example rslvr-frg-0123456789abcdef:rslvr-fdl-0123456789abcdef
+```
+
+<!-- cache-key: cdktf-0.18.0 input-91abb2b9b51d1173006c0a1458d5a94bbfd790f314498d4abce090eaa02a7e45 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/route53_resolver_firewall_rule_group.html.markdown b/website/docs/cdktf/typescript/r/route53_resolver_firewall_rule_group.html.markdown
new file mode 100644
index 00000000000..12e036fda78
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/route53_resolver_firewall_rule_group.html.markdown
@@ -0,0 +1,76 @@
+---
+subcategory: "Route 53 Resolver"
+layout: "aws"
+page_title: "AWS: aws_route53_resolver_firewall_rule_group"
+description: |-
+  Provides a Route 53 Resolver DNS Firewall rule group resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_route53_resolver_firewall_rule_group
+
+Provides a Route 53 Resolver DNS Firewall rule group resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Route53ResolverFirewallRuleGroup } from "./.gen/providers/aws/route53-resolver-firewall-rule-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Route53ResolverFirewallRuleGroup(this, "example", {
+      name: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) A name that lets you identify the rule group, to manage and use it.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN (Amazon Resource Name) of the rule group.
+* `id` - The ID of the rule group.
+* `ownerId` - The AWS account ID for the account that created the rule group. When a rule group is shared with your account, this is the account that has shared the rule group with you.
+* `shareStatus` - Whether the rule group is shared with other AWS accounts, or was shared with the current account by another AWS account. Sharing is configured through AWS Resource Access Manager (AWS RAM). Valid values: `notShared`, `sharedByMe`, `sharedWithMe`
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import  Route 53 Resolver DNS Firewall rule groups using the Route 53 Resolver DNS Firewall rule group ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import  Route 53 Resolver DNS Firewall rule groups using the Route 53 Resolver DNS Firewall rule group ID. For example:
+
+```console
+% terraform import aws_route53_resolver_firewall_rule_group.example rslvr-frg-0123456789abcdef
+```
+
+<!-- cache-key: cdktf-0.18.0 input-a7027280b0156439ca87c0646923dbb1f2fe11c7d16f7cb2dd4b81387e289185 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/route53_resolver_firewall_rule_group.markdown b/website/docs/cdktf/typescript/r/route53_resolver_firewall_rule_group.markdown
new file mode 100644
index 00000000000..12e036fda78
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/route53_resolver_firewall_rule_group.markdown
@@ -0,0 +1,76 @@
+---
+subcategory: "Route 53 Resolver"
+layout: "aws"
+page_title: "AWS: aws_route53_resolver_firewall_rule_group"
+description: |-
+  Provides a Route 53 Resolver DNS Firewall rule group resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_route53_resolver_firewall_rule_group
+
+Provides a Route 53 Resolver DNS Firewall rule group resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Route53ResolverFirewallRuleGroup } from "./.gen/providers/aws/route53-resolver-firewall-rule-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Route53ResolverFirewallRuleGroup(this, "example", {
+      name: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) A name that lets you identify the rule group, to manage and use it.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN (Amazon Resource Name) of the rule group.
+* `id` - The ID of the rule group.
+* `ownerId` - The AWS account ID for the account that created the rule group. When a rule group is shared with your account, this is the account that has shared the rule group with you.
+* `shareStatus` - Whether the rule group is shared with other AWS accounts, or was shared with the current account by another AWS account. Sharing is configured through AWS Resource Access Manager (AWS RAM). Valid values: `notShared`, `sharedByMe`, `sharedWithMe`
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import  Route 53 Resolver DNS Firewall rule groups using the Route 53 Resolver DNS Firewall rule group ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import  Route 53 Resolver DNS Firewall rule groups using the Route 53 Resolver DNS Firewall rule group ID. For example:
+
+```console
+% terraform import aws_route53_resolver_firewall_rule_group.example rslvr-frg-0123456789abcdef
+```
+
+<!-- cache-key: cdktf-0.18.0 input-a7027280b0156439ca87c0646923dbb1f2fe11c7d16f7cb2dd4b81387e289185 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/route53_resolver_firewall_rule_group_association.html.markdown b/website/docs/cdktf/typescript/r/route53_resolver_firewall_rule_group_association.html.markdown
new file mode 100644
index 00000000000..751485088d7
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/route53_resolver_firewall_rule_group_association.html.markdown
@@ -0,0 +1,90 @@
+---
+subcategory: "Route 53 Resolver"
+layout: "aws"
+page_title: "AWS: aws_route53_resolver_firewall_rule_group_association"
+description: |-
+  Provides a Route 53 Resolver DNS Firewall rule group association resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_route53_resolver_firewall_rule_group_association
+
+Provides a Route 53 Resolver DNS Firewall rule group association resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Route53ResolverFirewallRuleGroup } from "./.gen/providers/aws/route53-resolver-firewall-rule-group";
+import { Route53ResolverFirewallRuleGroupAssociation } from "./.gen/providers/aws/route53-resolver-firewall-rule-group-association";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new Route53ResolverFirewallRuleGroup(this, "example", {
+      name: "example",
+    });
+    const awsRoute53ResolverFirewallRuleGroupAssociationExample =
+      new Route53ResolverFirewallRuleGroupAssociation(this, "example_1", {
+        firewallRuleGroupId: example.id,
+        name: "example",
+        priority: 100,
+        vpcId: Token.asString(awsVpcExample.id),
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsRoute53ResolverFirewallRuleGroupAssociationExample.overrideLogicalId(
+      "example"
+    );
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) A name that lets you identify the rule group association, to manage and use it.
+* `firewallRuleGroupId` - (Required) The unique identifier of the firewall rule group.
+* `mutationProtection` - (Optional) If enabled, this setting disallows modification or removal of the association, to help prevent against accidentally altering DNS firewall protections. Valid values: `enabled`, `disabled`.
+* `priority` - (Required) The setting that determines the processing order of the rule group among the rule groups that you associate with the specified VPC. DNS Firewall filters VPC traffic starting from the rule group with the lowest numeric priority setting.
+* `vpcId` - (Required) The unique identifier of the VPC that you want to associate with the rule group.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN (Amazon Resource Name) of the firewall rule group association.
+* `id` - The identifier for the association.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Route 53 Resolver DNS Firewall rule group associations using the Route 53 Resolver DNS Firewall rule group association ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Route 53 Resolver DNS Firewall rule group associations using the Route 53 Resolver DNS Firewall rule group association ID. For example:
+
+```console
+% terraform import aws_route53_resolver_firewall_rule_group_association.example rslvr-frgassoc-0123456789abcdef
+```
+
+<!-- cache-key: cdktf-0.18.0 input-51bb172b49b6d58bc2272c4f5a68cd66487cbbaeb7680be17082513297427b44 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/route53_resolver_firewall_rule_group_association.markdown b/website/docs/cdktf/typescript/r/route53_resolver_firewall_rule_group_association.markdown
new file mode 100644
index 00000000000..751485088d7
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/route53_resolver_firewall_rule_group_association.markdown
@@ -0,0 +1,90 @@
+---
+subcategory: "Route 53 Resolver"
+layout: "aws"
+page_title: "AWS: aws_route53_resolver_firewall_rule_group_association"
+description: |-
+  Provides a Route 53 Resolver DNS Firewall rule group association resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_route53_resolver_firewall_rule_group_association
+
+Provides a Route 53 Resolver DNS Firewall rule group association resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Route53ResolverFirewallRuleGroup } from "./.gen/providers/aws/route53-resolver-firewall-rule-group";
+import { Route53ResolverFirewallRuleGroupAssociation } from "./.gen/providers/aws/route53-resolver-firewall-rule-group-association";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new Route53ResolverFirewallRuleGroup(this, "example", {
+      name: "example",
+    });
+    const awsRoute53ResolverFirewallRuleGroupAssociationExample =
+      new Route53ResolverFirewallRuleGroupAssociation(this, "example_1", {
+        firewallRuleGroupId: example.id,
+        name: "example",
+        priority: 100,
+        vpcId: Token.asString(awsVpcExample.id),
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsRoute53ResolverFirewallRuleGroupAssociationExample.overrideLogicalId(
+      "example"
+    );
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) A name that lets you identify the rule group association, to manage and use it.
+* `firewallRuleGroupId` - (Required) The unique identifier of the firewall rule group.
+* `mutationProtection` - (Optional) If enabled, this setting disallows modification or removal of the association, to help prevent against accidentally altering DNS firewall protections. Valid values: `enabled`, `disabled`.
+* `priority` - (Required) The setting that determines the processing order of the rule group among the rule groups that you associate with the specified VPC. DNS Firewall filters VPC traffic starting from the rule group with the lowest numeric priority setting.
+* `vpcId` - (Required) The unique identifier of the VPC that you want to associate with the rule group.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN (Amazon Resource Name) of the firewall rule group association.
+* `id` - The identifier for the association.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Route 53 Resolver DNS Firewall rule group associations using the Route 53 Resolver DNS Firewall rule group association ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Route 53 Resolver DNS Firewall rule group associations using the Route 53 Resolver DNS Firewall rule group association ID. For example:
+
+```console
+% terraform import aws_route53_resolver_firewall_rule_group_association.example rslvr-frgassoc-0123456789abcdef
+```
+
+<!-- cache-key: cdktf-0.18.0 input-51bb172b49b6d58bc2272c4f5a68cd66487cbbaeb7680be17082513297427b44 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/route53_resolver_query_log_config.html.markdown b/website/docs/cdktf/typescript/r/route53_resolver_query_log_config.html.markdown
new file mode 100644
index 00000000000..a88c5aaf7fa
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/route53_resolver_query_log_config.html.markdown
@@ -0,0 +1,84 @@
+---
+subcategory: "Route 53 Resolver"
+layout: "aws"
+page_title: "AWS: aws_route53_resolver_query_log_config"
+description: |-
+  Provides a Route 53 Resolver query logging configuration resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_route53_resolver_query_log_config
+
+Provides a Route 53 Resolver query logging configuration resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Route53ResolverQueryLogConfig } from "./.gen/providers/aws/route53-resolver-query-log-config";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Route53ResolverQueryLogConfig(this, "example", {
+      destinationArn: Token.asString(awsS3BucketExample.arn),
+      name: "example",
+      tags: {
+        Environment: "Prod",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `destinationArn` - (Required) The ARN of the resource that you want Route 53 Resolver to send query logs.
+You can send query logs to an [S3 bucket](s3_bucket.html), a [CloudWatch Logs log group](cloudwatch_log_group.html), or a [Kinesis Data Firehose delivery stream](kinesis_firehose_delivery_stream.html).
+* `name` - (Required) The name of the Route 53 Resolver query logging configuration.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the Route 53 Resolver query logging configuration.
+* `arn` - The ARN (Amazon Resource Name) of the Route 53 Resolver query logging configuration.
+* `ownerId` - The AWS account ID of the account that created the query logging configuration.
+* `shareStatus` - An indication of whether the query logging configuration is shared with other AWS accounts, or was shared with the current account by another AWS account.
+Sharing is configured through AWS Resource Access Manager (AWS RAM).
+Values are `notShared`, `sharedByMe` or `sharedWithMe`
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import  Route 53 Resolver query logging configurations using the Route 53 Resolver query logging configuration ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import  Route 53 Resolver query logging configurations using the Route 53 Resolver query logging configuration ID. For example:
+
+```console
+% terraform import aws_route53_resolver_query_log_config.example rqlc-92edc3b1838248bf
+```
+
+<!-- cache-key: cdktf-0.18.0 input-5223f85f64c286cf17d4b87baa9cc06e62338ab91d82d959ba69e32ab94b1a4d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/route53_resolver_query_log_config_association.html.markdown b/website/docs/cdktf/typescript/r/route53_resolver_query_log_config_association.html.markdown
new file mode 100644
index 00000000000..991a72f84d6
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/route53_resolver_query_log_config_association.html.markdown
@@ -0,0 +1,75 @@
+---
+subcategory: "Route 53 Resolver"
+layout: "aws"
+page_title: "AWS: aws_route53_resolver_query_log_config_association"
+description: |-
+  Provides a Route 53 Resolver query logging configuration association resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_route53_resolver_query_log_config_association
+
+Provides a Route 53 Resolver query logging configuration association resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Route53ResolverQueryLogConfigAssociation } from "./.gen/providers/aws/route53-resolver-query-log-config-association";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Route53ResolverQueryLogConfigAssociation(this, "example", {
+      resolverQueryLogConfigId: Token.asString(
+        awsRoute53ResolverQueryLogConfigExample.id
+      ),
+      resourceId: Token.asString(awsVpcExample.id),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `resolverQueryLogConfigId` - (Required) The ID of the [Route 53 Resolver query logging configuration](route53_resolver_query_log_config.html) that you want to associate a VPC with.
+* `resourceId` - (Required) The ID of a VPC that you want this query logging configuration to log queries for.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` -The ID of the Route 53 Resolver query logging configuration association.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import  Route 53 Resolver query logging configuration associations using the Route 53 Resolver query logging configuration association ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import  Route 53 Resolver query logging configuration associations using the Route 53 Resolver query logging configuration association ID. For example:
+
+```console
+% terraform import aws_route53_resolver_query_log_config_association.example rqlca-b320624fef3c4d70
+```
+
+<!-- cache-key: cdktf-0.18.0 input-6f62f5b9b4259b2643b1af4febefb7ddfdc7693ad36af9e17d0e6b9e0c1fd40c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/route53_resolver_rule.html.markdown b/website/docs/cdktf/typescript/r/route53_resolver_rule.html.markdown
new file mode 100644
index 00000000000..fdaeaaeec5b
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/route53_resolver_rule.html.markdown
@@ -0,0 +1,124 @@
+---
+subcategory: "Route 53 Resolver"
+layout: "aws"
+page_title: "AWS: aws_route53_resolver_rule"
+description: |-
+  Provides a Route53 Resolver rule.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_route53_resolver_rule
+
+Provides a Route53 Resolver rule.
+
+## Example Usage
+
+### System rule
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Route53ResolverRule } from "./.gen/providers/aws/route53-resolver-rule";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Route53ResolverRule(this, "sys", {
+      domainName: "subdomain.example.com",
+      ruleType: "SYSTEM",
+    });
+  }
+}
+
+```
+
+### Forward rule
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Route53ResolverRule } from "./.gen/providers/aws/route53-resolver-rule";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Route53ResolverRule(this, "fwd", {
+      domainName: "example.com",
+      name: "example",
+      resolverEndpointId: foo.id,
+      ruleType: "FORWARD",
+      tags: {
+        Environment: "Prod",
+      },
+      targetIp: [
+        {
+          ip: "123.45.67.89",
+        },
+      ],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `domainName` - (Required) DNS queries for this domain name are forwarded to the IP addresses that are specified using `targetIp`.
+* `ruleType` - (Required) The rule type. Valid values are `forward`, `system` and `recursive`.
+* `name` - (Optional) A friendly name that lets you easily find a rule in the Resolver dashboard in the Route 53 console.
+* `resolverEndpointId` (Optional) The ID of the outbound resolver endpoint that you want to use to route DNS queries to the IP addresses that you specify using `targetIp`.
+This argument should only be specified for `forward` type rules.
+* `targetIp` - (Optional) Configuration block(s) indicating the IPs that you want Resolver to forward DNS queries to (documented below).
+This argument should only be specified for `forward` type rules.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+The `targetIp` object supports the following:
+
+* `ip` - (Required) One IP address that you want to forward DNS queries to. You can specify only IPv4 addresses.
+* `port` - (Optional) The port at `ip` that you want to forward DNS queries to. Default value is `53`
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the resolver rule.
+* `arn` - The ARN (Amazon Resource Name) for the resolver rule.
+* `ownerId` - When a rule is shared with another AWS account, the account ID of the account that the rule is shared with.
+* `shareStatus` - Whether the rules is shared and, if so, whether the current account is sharing the rule with another account, or another account is sharing the rule with the current account.
+Values are `notShared`, `sharedByMe` or `sharedWithMe`
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Route53 Resolver rules using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Route53 Resolver rules using the `id`. For example:
+
+```console
+% terraform import aws_route53_resolver_rule.sys rslvr-rr-0123456789abcdef0
+```
+
+<!-- cache-key: cdktf-0.18.0 input-e232908c083dc3536781f9aa9a4349eb098e85ae4ceb668269e5774249391222 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/route53_resolver_rule_association.html.markdown b/website/docs/cdktf/typescript/r/route53_resolver_rule_association.html.markdown
new file mode 100644
index 00000000000..90a24d2fbc2
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/route53_resolver_rule_association.html.markdown
@@ -0,0 +1,74 @@
+---
+subcategory: "Route 53 Resolver"
+layout: "aws"
+page_title: "AWS: aws_route53_resolver_rule_association"
+description: |-
+  Provides a Route53 Resolver rule association.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_route53_resolver_rule_association
+
+Provides a Route53 Resolver rule association.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Route53ResolverRuleAssociation } from "./.gen/providers/aws/route53-resolver-rule-association";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Route53ResolverRuleAssociation(this, "example", {
+      resolverRuleId: sys.id,
+      vpcId: foo.id,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `resolverRuleId` - (Required) The ID of the resolver rule that you want to associate with the VPC.
+* `vpcId` - (Required) The ID of the VPC that you want to associate the resolver rule with.
+* `name` - (Optional) A name for the association that you're creating between a resolver rule and a VPC.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the resolver rule association.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Route53 Resolver rule associations using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Route53 Resolver rule associations using the `id`. For example:
+
+```console
+% terraform import aws_route53_resolver_rule_association.example rslvr-rrassoc-97242eaf88example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-8c7e93b46c5b9235d6779fd392935a48ebd6544409cadb4a6bb0f7b6f8660fa4 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/route53_traffic_policy.html.markdown b/website/docs/cdktf/typescript/r/route53_traffic_policy.html.markdown
new file mode 100644
index 00000000000..b19d507af02
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/route53_traffic_policy.html.markdown
@@ -0,0 +1,81 @@
+---
+subcategory: "Route 53"
+layout: "aws"
+page_title: "AWS: aws_route53_traffic_policy"
+description: |-
+    Manages a Route53 Traffic Policy
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_route53_traffic_policy
+
+Manages a Route53 Traffic Policy.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Route53TrafficPolicy } from "./.gen/providers/aws/route53-traffic-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Route53TrafficPolicy(this, "example", {
+      comment: "example comment",
+      document:
+        '{\n  "AWSPolicyFormatVersion": "2015-10-01",\n  "RecordType": "A",\n  "Endpoints": {\n    "endpoint-start-NkPh": {\n      "Type": "value",\n      "Value": "10.0.0.2"\n    }\n  },\n  "StartEndpoint": "endpoint-start-NkPh"\n}\n\n',
+      name: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) Name of the traffic policy.
+* `document` - (Required) Policy document. This is a JSON formatted string. For more information about building Route53 traffic policy documents, see the [AWS Route53 Traffic Policy document format](https://docs.aws.amazon.com/Route53/latest/APIReference/api-policies-traffic-policy-document-format.html)
+
+The following arguments are optional:
+
+* `comment` - (Optional) Comment for the traffic policy.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the traffic policy
+* `type` - DNS type of the resource record sets that Amazon Route 53 creates when you use a traffic policy to create a traffic policy instance.
+* `version` - Version number of the traffic policy. This value is automatically incremented by AWS after each update of this resource.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Route53 Traffic Policy using the `id` and `version`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Route53 Traffic Policy using the `id` and `version`. For example:
+
+```console
+% terraform import aws_route53_traffic_policy.example 01a52019-d16f-422a-ae72-c306d2b6df7e/1
+```
+
+<!-- cache-key: cdktf-0.18.0 input-b96db7d2de859a1798fa4d7060a0fcce7e3e2591a6bc52e84df625b66db068e3 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/route53_traffic_policy_instance.html.markdown b/website/docs/cdktf/typescript/r/route53_traffic_policy_instance.html.markdown
new file mode 100644
index 00000000000..48ce5714c03
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/route53_traffic_policy_instance.html.markdown
@@ -0,0 +1,79 @@
+---
+subcategory: "Route 53"
+layout: "aws"
+page_title: "AWS: aws_route53_traffic_policy_instance"
+description: |-
+    Provides a Route53 traffic policy instance resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_route53_traffic_policy_instance
+
+Provides a Route53 traffic policy instance resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Route53TrafficPolicyInstance } from "./.gen/providers/aws/route53-traffic-policy-instance";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Route53TrafficPolicyInstance(this, "test", {
+      hostedZoneId: "Z033120931TAQO548OGJC",
+      name: "test.example.com",
+      trafficPolicyId: "b3gb108f-ea6f-45a5-baab-9d112d8b4037",
+      trafficPolicyVersion: 1,
+      ttl: 360,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) Domain name for which Amazon Route 53 responds to DNS queries by using the resource record sets that Route 53 creates for this traffic policy instance.
+* `trafficPolicyId` - (Required) ID of the traffic policy that you want to use to create resource record sets in the specified hosted zone.
+* `trafficPolicyVersion` - (Required) Version of the traffic policy
+* `hostedZoneId` - (Required) ID of the hosted zone that you want Amazon Route 53 to create resource record sets in by using the configuration in a traffic policy.
+* `ttl` - (Required) TTL that you want Amazon Route 53 to assign to all the resource record sets that it creates in the specified hosted zone.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - ID of traffic policy instance.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Route53 traffic policy instance using its id. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Route53 traffic policy instance using its id. For example:
+
+```console
+% terraform import aws_route53_traffic_policy_instance.test df579d9a-6396-410e-ac22-e7ad60cf9e7e
+```
+
+<!-- cache-key: cdktf-0.18.0 input-d3c778104dc6693266cba8a3fa2a37e8caea6700bf6cf446a41a6e4012311f41 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/route53_vpc_association_authorization.html.markdown b/website/docs/cdktf/typescript/r/route53_vpc_association_authorization.html.markdown
new file mode 100644
index 00000000000..e55ca326a1e
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/route53_vpc_association_authorization.html.markdown
@@ -0,0 +1,124 @@
+---
+subcategory: "Route 53"
+layout: "aws"
+page_title: "AWS: aws_route53_vpc_association_authorization"
+description: |-
+  Authorizes a VPC in a different account to be associated with a local Route53 Hosted Zone
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_route53_vpc_association_authorization
+
+Authorizes a VPC in a different account to be associated with a local Route53 Hosted Zone.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AwsProvider } from "./.gen/providers/aws/provider";
+import { Route53VpcAssociationAuthorization } from "./.gen/providers/aws/route53-vpc-association-authorization";
+import { Route53Zone } from "./.gen/providers/aws/route53-zone";
+import { Route53ZoneAssociation } from "./.gen/providers/aws/route53-zone-association";
+import { Vpc } from "./.gen/providers/aws/vpc";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AwsProvider(this, "aws", {});
+    const alternate = new AwsProvider(this, "aws_1", {
+      alias: "alternate",
+    });
+    const awsVpcAlternate = new Vpc(this, "alternate", {
+      cidrBlock: "10.7.0.0/16",
+      enableDnsHostnames: true,
+      enableDnsSupport: true,
+      provider: alternate,
+    });
+    const example = new Vpc(this, "example", {
+      cidrBlock: "10.6.0.0/16",
+      enableDnsHostnames: true,
+      enableDnsSupport: true,
+    });
+    const awsRoute53ZoneExample = new Route53Zone(this, "example_4", {
+      lifecycle: {
+        ignoreChanges: [vpc],
+      },
+      name: "example.com",
+      vpc: [
+        {
+          vpcId: example.id,
+        },
+      ],
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsRoute53ZoneExample.overrideLogicalId("example");
+    const awsRoute53VpcAssociationAuthorizationExample =
+      new Route53VpcAssociationAuthorization(this, "example_5", {
+        vpcId: Token.asString(awsVpcAlternate.id),
+        zoneId: Token.asString(awsRoute53ZoneExample.id),
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsRoute53VpcAssociationAuthorizationExample.overrideLogicalId("example");
+    const awsRoute53ZoneAssociationExample = new Route53ZoneAssociation(
+      this,
+      "example_6",
+      {
+        provider: alternate,
+        vpcId: Token.asString(
+          awsRoute53VpcAssociationAuthorizationExample.vpcId
+        ),
+        zoneId: Token.asString(
+          awsRoute53VpcAssociationAuthorizationExample.zoneId
+        ),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsRoute53ZoneAssociationExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `zoneId` - (Required) The ID of the private hosted zone that you want to authorize associating a VPC with.
+* `vpcId` - (Required) The VPC to authorize for association with the private hosted zone.
+* `vpcRegion` - (Optional) The VPC's region. Defaults to the region of the AWS provider.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The calculated unique identifier for the association.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Route 53 VPC Association Authorizations using the Hosted Zone ID and VPC ID, separated by a colon (`:`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Route 53 VPC Association Authorizations using the Hosted Zone ID and VPC ID, separated by a colon (`:`). For example:
+
+```console
+% terraform import aws_route53_vpc_association_authorization.example Z123456ABCDEFG:vpc-12345678
+```
+
+<!-- cache-key: cdktf-0.18.0 input-5538910c15da1bdf9d215131a092f3a81fc71383f121c9a24ab62a7757345a40 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/route53_zone.html.markdown b/website/docs/cdktf/typescript/r/route53_zone.html.markdown
new file mode 100644
index 00000000000..dda767c28e0
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/route53_zone.html.markdown
@@ -0,0 +1,159 @@
+---
+subcategory: "Route 53"
+layout: "aws"
+page_title: "AWS: aws_route53_zone"
+description: |-
+  Manages a Route53 Hosted Zone
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_route53_zone
+
+Manages a Route53 Hosted Zone. For managing Domain Name System Security Extensions (DNSSEC), see the [`awsRoute53KeySigningKey`](route53_key_signing_key.html) and [`awsRoute53HostedZoneDnssec`](route53_hosted_zone_dnssec.html) resources.
+
+## Example Usage
+
+### Public Zone
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Route53Zone } from "./.gen/providers/aws/route53-zone";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Route53Zone(this, "primary", {
+      name: "example.com",
+    });
+  }
+}
+
+```
+
+### Public Subdomain Zone
+
+For use in subdomains, note that you need to create a
+`awsRoute53Record` of type `ns` as well as the subdomain
+zone.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Route53Record } from "./.gen/providers/aws/route53-record";
+import { Route53Zone } from "./.gen/providers/aws/route53-zone";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const dev = new Route53Zone(this, "dev", {
+      name: "dev.example.com",
+      tags: {
+        Environment: "dev",
+      },
+    });
+    const main = new Route53Zone(this, "main", {
+      name: "example.com",
+    });
+    new Route53Record(this, "dev-ns", {
+      name: "dev.example.com",
+      records: Token.asList(dev.nameServers),
+      ttl: Token.asNumber("30"),
+      type: "NS",
+      zoneId: main.zoneId,
+    });
+  }
+}
+
+```
+
+### Private Zone
+
+~> **NOTE:** Terraform provides both exclusive VPC associations defined in-line in this resource via `vpc` configuration blocks and a separate [Zone VPC Association](/docs/providers/aws/r/route53_zone_association.html) resource. At this time, you cannot use in-line VPC associations in conjunction with any `awsRoute53ZoneAssociation` resources with the same zone ID otherwise it will cause a perpetual difference in plan output. You can optionally use the generic Terraform resource [lifecycle configuration block](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html) with `ignoreChanges` to manage additional associations via the `awsRoute53ZoneAssociation` resource.
+
+~> **NOTE:** Private zones require at least one VPC association at all times.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Route53Zone } from "./.gen/providers/aws/route53-zone";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Route53Zone(this, "private", {
+      name: "example.com",
+      vpc: [
+        {
+          vpcId: example.id,
+        },
+      ],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) This is the name of the hosted zone.
+* `comment` - (Optional) A comment for the hosted zone. Defaults to 'Managed by Terraform'.
+* `delegationSetId` - (Optional) The ID of the reusable delegation set whose NS records you want to assign to the hosted zone. Conflicts with `vpc` as delegation sets can only be used for public zones.
+* `forceDestroy` - (Optional) Whether to destroy all records (possibly managed outside of Terraform) in the zone when destroying the zone.
+* `tags` - (Optional) A map of tags to assign to the zone. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `vpc` - (Optional) Configuration block(s) specifying VPC(s) to associate with a private hosted zone. Conflicts with the `delegationSetId` argument in this resource and any [`awsRoute53ZoneAssociation` resource](/docs/providers/aws/r/route53_zone_association.html) specifying the same zone ID. Detailed below.
+
+### vpc Argument Reference
+
+* `vpcId` - (Required) ID of the VPC to associate.
+* `vpcRegion` - (Optional) Region of the VPC to associate. Defaults to AWS provider region.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the Hosted Zone.
+* `zoneId` - The Hosted Zone ID. This can be referenced by zone records.
+* `nameServers` - A list of name servers in associated (or default) delegation set.
+  Find more about delegation sets in [AWS docs](https://docs.aws.amazon.com/Route53/latest/APIReference/actions-on-reusable-delegation-sets.html).
+* `primaryNameServer` - The Route 53 name server that created the SOA record.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Route53 Zones using the zone `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Route53 Zones using the zone `id`. For example:
+
+```console
+% terraform import aws_route53_zone.myzone Z1D633PJN98FT9
+```
+
+<!-- cache-key: cdktf-0.18.0 input-8a7477da45196901e3ea8ac68ebc92bd2954c60b50b24acf390c93289191b92e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/route53_zone_association.html.markdown b/website/docs/cdktf/typescript/r/route53_zone_association.html.markdown
new file mode 100644
index 00000000000..2d7a2292d68
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/route53_zone_association.html.markdown
@@ -0,0 +1,132 @@
+---
+subcategory: "Route 53"
+layout: "aws"
+page_title: "AWS: aws_route53_zone_association"
+description: |-
+  Manages a Route53 Hosted Zone VPC association
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_route53_zone_association
+
+Manages a Route53 Hosted Zone VPC association. VPC associations can only be made on private zones. See the [`awsRoute53VpcAssociationAuthorization` resource](route53_vpc_association_authorization.html) for setting up cross-account associations.
+
+~> **NOTE:** Unless explicit association ordering is required (e.g., a separate cross-account association authorization), usage of this resource is not recommended. Use the `vpc` configuration blocks available within the [`awsRoute53Zone` resource](/docs/providers/aws/r/route53_zone.html) instead.
+
+~> **NOTE:** Terraform provides both this standalone Zone VPC Association resource and exclusive VPC associations defined in-line in the [`awsRoute53Zone` resource](/docs/providers/aws/r/route53_zone.html) via `vpc` configuration blocks. At this time, you cannot use those in-line VPC associations in conjunction with this resource and the same zone ID otherwise it will cause a perpetual difference in plan output. You can optionally use the generic Terraform resource [lifecycle configuration block](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html) with `ignoreChanges` in the `awsRoute53Zone` resource to manage additional associations via this resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Route53Zone } from "./.gen/providers/aws/route53-zone";
+import { Route53ZoneAssociation } from "./.gen/providers/aws/route53-zone-association";
+import { Vpc } from "./.gen/providers/aws/vpc";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const primary = new Vpc(this, "primary", {
+      cidrBlock: "10.6.0.0/16",
+      enableDnsHostnames: true,
+      enableDnsSupport: true,
+    });
+    const secondary = new Vpc(this, "secondary", {
+      cidrBlock: "10.7.0.0/16",
+      enableDnsHostnames: true,
+      enableDnsSupport: true,
+    });
+    const example = new Route53Zone(this, "example", {
+      lifecycle: {
+        ignoreChanges: [vpc],
+      },
+      name: "example.com",
+      vpc: [
+        {
+          vpcId: primary.id,
+        },
+      ],
+    });
+    const awsRoute53ZoneAssociationSecondary = new Route53ZoneAssociation(
+      this,
+      "secondary_3",
+      {
+        vpcId: secondary.id,
+        zoneId: example.zoneId,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsRoute53ZoneAssociationSecondary.overrideLogicalId("secondary");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `zoneId` - (Required) The private hosted zone to associate.
+* `vpcId` - (Required) The VPC to associate with the private hosted zone.
+* `vpcRegion` - (Optional) The VPC's region. Defaults to the region of the AWS provider.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The calculated unique identifier for the association.
+* `owningAccount` - The account ID of the account that created the hosted zone.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Route 53 Hosted Zone Associations using the Hosted Zone ID and VPC ID, separated by a colon (`:`). For example:
+
+The VPC is in the same region where you have configured the Terraform AWS Provider:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+The VPC is _not_ in the same region where you have configured the Terraform AWS Provider:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+**Using `terraform import` to import** Route 53 Hosted Zone Associations using the Hosted Zone ID and VPC ID, separated by a colon (`:`). For example:
+
+The VPC is in the same region where you have configured the Terraform AWS Provider:
+
+```console
+% terraform import aws_route53_zone_association.example Z123456ABCDEFG:vpc-12345678
+```
+
+The VPC is _not_ in the same region where you have configured the Terraform AWS Provider:
+
+```console
+% terraform import aws_route53_zone_association.example Z123456ABCDEFG:vpc-12345678:us-east-2
+```
+
+<!-- cache-key: cdktf-0.18.0 input-062f0d7494a763d26f38527047af28c7a1a99d322901f96a55935e7336484f49 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/route53domains_registered_domain.html.markdown b/website/docs/cdktf/typescript/r/route53domains_registered_domain.html.markdown
new file mode 100644
index 00000000000..95c8a51964d
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/route53domains_registered_domain.html.markdown
@@ -0,0 +1,116 @@
+---
+subcategory: "Route 53 Domains"
+layout: "aws"
+page_title: "AWS: aws_route53domains_registered_domain"
+description: |-
+  Provides a resource to manage a domain that has been registered and associated with the current AWS account.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_route53domains_registered_domain
+
+Provides a resource to manage a domain that has been [registered](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/registrar-tld-list.html) and associated with the current AWS account.
+
+**This is an advanced resource** and has special caveats to be aware of when using it. Please read this document in its entirety before using this resource.
+
+The `awsRoute53DomainsRegisteredDomain` resource behaves differently from normal resources in that if a domain has been registered, Terraform does not _register_ this domain, but instead "adopts" it into management. `terraform destroy` does not delete the domain but does remove the resource from Terraform state.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Route53DomainsRegisteredDomain } from "./.gen/providers/aws/route53-domains-registered-domain";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Route53DomainsRegisteredDomain(this, "example", {
+      domainName: "example.com",
+      nameServer: [
+        {
+          name: "ns-195.awsdns-24.com",
+        },
+        {
+          name: "ns-874.awsdns-45.net",
+        },
+      ],
+      tags: {
+        Environment: "test",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+~> **NOTE:** You must specify the same privacy setting for `adminPrivacy`, `registrantPrivacy` and `techPrivacy`.
+
+This argument supports the following arguments:
+
+* `adminContact` - (Optional) Details about the domain administrative contact.
+* `adminPrivacy` - (Optional) Whether domain administrative contact information is concealed from WHOIS queries. Default: `true`.
+* `autoRenew` - (Optional) Whether the domain registration is set to renew automatically. Default: `true`.
+* `domainName` - (Required) The name of the registered domain.
+* `nameServer` - (Optional) The list of nameservers for the domain.
+* `registrantContact` - (Optional) Details about the domain registrant.
+* `registrantPrivacy` - (Optional) Whether domain registrant contact information is concealed from WHOIS queries. Default: `true`.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `techContact` - (Optional) Details about the domain technical contact.
+* `techPrivacy` - (Optional) Whether domain technical contact information is concealed from WHOIS queries. Default: `true`.
+* `transferLock` - (Optional) Whether the domain is locked for transfer. Default: `true`.
+
+The `adminContact`, `registrantContact` and `techContact` objects support the following:
+
+* `addressLine1` - (Optional) First line of the contact's address.
+* `addressLine2` - (Optional) Second line of contact's address, if any.
+* `city` - (Optional) The city of the contact's address.
+* `contactType` - (Optional) Indicates whether the contact is a person, company, association, or public organization. See the [AWS API documentation](https://docs.aws.amazon.com/Route53/latest/APIReference/API_domains_ContactDetail.html#Route53Domains-Type-domains_ContactDetail-ContactType) for valid values.
+* `countryCode` - (Optional) Code for the country of the contact's address. See the [AWS API documentation](https://docs.aws.amazon.com/Route53/latest/APIReference/API_domains_ContactDetail.html#Route53Domains-Type-domains_ContactDetail-CountryCode) for valid values.
+* `email` - (Optional) Email address of the contact.
+* `extraParams` - (Optional) A key-value map of parameters required by certain top-level domains.
+* `fax` - (Optional) Fax number of the contact. Phone number must be specified in the format "+[country dialing code].[number including any area code]".
+* `firstName` - (Optional) First name of contact.
+* `lastName` - (Optional) Last name of contact.
+* `organizationName` - (Optional) Name of the organization for contact types other than `person`.
+* `phoneNumber` - (Optional) The phone number of the contact. Phone number must be specified in the format "+[country dialing code].[number including any area code]".
+* `state` - (Optional) The state or province of the contact's city.
+* `zipCode` - (Optional) The zip or postal code of the contact's address.
+
+The `nameServer` object supports the following:
+
+* `glueIps` - (Optional) Glue IP addresses of a name server. The list can contain only one IPv4 and one IPv6 address.
+* `name` - (Required) The fully qualified host name of the name server.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The domain name.
+* `abuseContactEmail` - Email address to contact to report incorrect contact information for a domain, to report that the domain is being used to send spam, to report that someone is cybersquatting on a domain name, or report some other type of abuse.
+* `abuseContactPhone` - Phone number for reporting abuse.
+* `creationDate` - The date when the domain was created as found in the response to a WHOIS query.
+* `expirationDate` - The date when the registration for the domain is set to expire.
+* `registrarName` - Name of the registrar of the domain as identified in the registry.
+* `registrarUrl` - Web address of the registrar.
+* `reseller` - Reseller of the domain.
+* `statusList` - List of [domain name status codes](https://www.icann.org/resources/pages/epp-status-codes-2014-06-16-en).
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `updatedDate` - The last updated date of the domain as found in the response to a WHOIS query.
+* `whoisServer` - The fully qualified name of the WHOIS server that can answer the WHOIS query for the domain.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `30M`)
+- `update` - (Default `30M`)
+
+<!-- cache-key: cdktf-0.18.0 input-98a8952abfb9875700e225d9486f8339896363be535628d57f8d8ab898718bdc -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/route53recoverycontrolconfig_cluster.html.markdown b/website/docs/cdktf/typescript/r/route53recoverycontrolconfig_cluster.html.markdown
new file mode 100644
index 00000000000..95cf8b4ef9c
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/route53recoverycontrolconfig_cluster.html.markdown
@@ -0,0 +1,78 @@
+---
+subcategory: "Route 53 Recovery Control Config"
+layout: "aws"
+page_title: "AWS: aws_route53recoverycontrolconfig_cluster"
+description: |-
+  Provides an AWS Route 53 Recovery Control Config Cluster
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_route53recoverycontrolconfig_cluster
+
+Provides an AWS Route 53 Recovery Control Config Cluster.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Route53RecoverycontrolconfigCluster } from "./.gen/providers/aws/route53-recoverycontrolconfig-cluster";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Route53RecoverycontrolconfigCluster(this, "example", {
+      name: "georgefitzgerald",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) Unique name describing the cluster.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the cluster
+* `clusterEndpoints` - List of 5 endpoints in 5 regions that can be used to talk to the cluster. See below.
+* `status` - Status of cluster. `pending` when it is being created, `pendingDeletion` when it is being deleted and `deployed` otherwise.
+
+### cluster_endpoints
+
+* `endpoint` - Cluster endpoint.
+* `region` - Region of the endpoint.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Route53 Recovery Control Config cluster using the cluster ARN. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Route53 Recovery Control Config cluster using the cluster ARN. For example:
+
+```console
+% terraform import aws_route53recoverycontrolconfig_cluster.mycluster arn:aws:route53-recovery-control::313517334327:cluster/f9ae13be-a11e-4ec7-8522-94a70468e6ea
+```
+
+<!-- cache-key: cdktf-0.18.0 input-4f9ee8256b3a92970727893900eccbfd348f2d0fcefd370211ce5756a28dbab1 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/route53recoverycontrolconfig_control_panel.html.markdown b/website/docs/cdktf/typescript/r/route53recoverycontrolconfig_control_panel.html.markdown
new file mode 100644
index 00000000000..b8e464e52e8
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/route53recoverycontrolconfig_control_panel.html.markdown
@@ -0,0 +1,77 @@
+---
+subcategory: "Route 53 Recovery Control Config"
+layout: "aws"
+page_title: "AWS: aws_route53recoverycontrolconfig_control_panel"
+description: |-
+  Provides an AWS Route 53 Recovery Control Config Control Panel
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_route53recoverycontrolconfig_control_panel
+
+Provides an AWS Route 53 Recovery Control Config Control Panel.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Route53RecoverycontrolconfigControlPanel } from "./.gen/providers/aws/route53-recoverycontrolconfig-control-panel";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Route53RecoverycontrolconfigControlPanel(this, "example", {
+      clusterArn:
+        "arn:aws:route53-recovery-control::123456789012:cluster/8d47920e-d789-437d-803a-2dcc4b204393",
+      name: "balmorhea",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `clusterArn` - (Required) ARN of the cluster in which this control panel will reside.
+* `name` - (Required) Name describing the control panel.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the control panel.
+* `defaultControlPanel` - Whether a control panel is default.
+* `routingControlCount` - Number routing controls in a control panel.
+* `status` - Status of control panel: `pending` when it is being created/updated, `pendingDeletion` when it is being deleted, and `deployed` otherwise.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Route53 Recovery Control Config Control Panel using the control panel arn. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Route53 Recovery Control Config Control Panel using the control panel arn. For example:
+
+```console
+% terraform import aws_route53recoverycontrolconfig_control_panel.mypanel arn:aws:route53-recovery-control::313517334327:controlpanel/1bfba17df8684f5dab0467b71424f7e8
+```
+
+<!-- cache-key: cdktf-0.18.0 input-2684118596a4f1a5ee55c039284d0ef47e9b181e6c6212004319ac88f885b5d3 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/route53recoverycontrolconfig_routing_control.html.markdown b/website/docs/cdktf/typescript/r/route53recoverycontrolconfig_routing_control.html.markdown
new file mode 100644
index 00000000000..dac1e355e51
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/route53recoverycontrolconfig_routing_control.html.markdown
@@ -0,0 +1,103 @@
+---
+subcategory: "Route 53 Recovery Control Config"
+layout: "aws"
+page_title: "AWS: aws_route53recoverycontrolconfig_routing_control"
+description: |-
+  Provides an AWS Route 53 Recovery Control Config Routing Control
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_route53recoverycontrolconfig_routing_control
+
+Provides an AWS Route 53 Recovery Control Config Routing Control.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Route53RecoverycontrolconfigRoutingControl } from "./.gen/providers/aws/route53-recoverycontrolconfig-routing-control";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Route53RecoverycontrolconfigRoutingControl(this, "example", {
+      clusterArn:
+        "arn:aws:route53-recovery-control::881188118811:cluster/8d47920e-d789-437d-803a-2dcc4b204393",
+      name: "tinlicker",
+    });
+  }
+}
+
+```
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Route53RecoverycontrolconfigRoutingControl } from "./.gen/providers/aws/route53-recoverycontrolconfig-routing-control";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Route53RecoverycontrolconfigRoutingControl(this, "example", {
+      clusterArn:
+        "arn:aws:route53-recovery-control::881188118811:cluster/8d47920e-d789-437d-803a-2dcc4b204393",
+      controlPanelArn:
+        "arn:aws:route53-recovery-control::428113431245:controlpanel/abd5fbfc052d4844a082dbf400f61da8",
+      name: "thomasoliver",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `clusterArn` - (Required) ARN of the cluster in which this routing control will reside.
+* `name` - (Required) The name describing the routing control.
+
+The following arguments are optional:
+
+* `controlPanelArn` - (Optional) ARN of the control panel in which this routing control will reside.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the routing control.
+* `status` - Status of routing control. `pending` when it is being created/updated, `pendingDeletion` when it is being deleted, and `deployed` otherwise.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Route53 Recovery Control Config Routing Control using the routing control arn. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Route53 Recovery Control Config Routing Control using the routing control arn. For example:
+
+```console
+% terraform import aws_route53recoverycontrolconfig_routing_control.mycontrol arn:aws:route53-recovery-control::313517334327:controlpanel/abd5fbfc052d4844a082dbf400f61da8/routingcontrol/d5d90e587870494b
+```
+
+<!-- cache-key: cdktf-0.18.0 input-44029090e1d737aa2993a65bdf6f51189fa5530e97833ff3676aa4c17b194564 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/route53recoverycontrolconfig_safety_rule.html.markdown b/website/docs/cdktf/typescript/r/route53recoverycontrolconfig_safety_rule.html.markdown
new file mode 100644
index 00000000000..f2a80c6ee67
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/route53recoverycontrolconfig_safety_rule.html.markdown
@@ -0,0 +1,138 @@
+---
+subcategory: "Route 53 Recovery Control Config"
+layout: "aws"
+page_title: "AWS: aws_route53recoverycontrolconfig_safety_rule"
+description: |-
+  Provides an AWS Route 53 Recovery Control Config Safety Rule
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_route53recoverycontrolconfig_safety_rule
+
+Provides an AWS Route 53 Recovery Control Config Safety Rule
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Route53RecoverycontrolconfigSafetyRule } from "./.gen/providers/aws/route53-recoverycontrolconfig-safety-rule";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Route53RecoverycontrolconfigSafetyRule(this, "example", {
+      assertedControls: [
+        Token.asString(
+          awsRoute53RecoverycontrolconfigRoutingControlExample.arn
+        ),
+      ],
+      controlPanelArn:
+        "arn:aws:route53-recovery-control::313517334327:controlpanel/abd5fbfc052d4844a082dbf400f61da8",
+      name: "daisyguttridge",
+      ruleConfig: {
+        inverted: false,
+        threshold: 1,
+        type: "ATLEAST",
+      },
+      waitPeriodMs: 5000,
+    });
+  }
+}
+
+```
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Route53RecoverycontrolconfigSafetyRule } from "./.gen/providers/aws/route53-recoverycontrolconfig-safety-rule";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Route53RecoverycontrolconfigSafetyRule(this, "example", {
+      controlPanelArn:
+        "arn:aws:route53-recovery-control::313517334327:controlpanel/abd5fbfc052d4844a082dbf400f61da8",
+      gatingControls: [
+        Token.asString(
+          awsRoute53RecoverycontrolconfigRoutingControlExample.arn
+        ),
+      ],
+      name: "i_o",
+      ruleConfig: {
+        inverted: false,
+        threshold: 1,
+        type: "ATLEAST",
+      },
+      targetControls: [
+        Token.asString(
+          awsRoute53RecoverycontrolconfigRoutingControlExample.arn
+        ),
+      ],
+      waitPeriodMs: 5000,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `controlPanelArn` - (Required) ARN of the control panel in which this safety rule will reside.
+* `name` - (Required) Name describing the safety rule.
+* `ruleConfig` - (Required) Configuration block for safety rule criteria. See below.
+* `waitPeriodMs` - (Required) Evaluation period, in milliseconds (ms), during which any request against the target routing controls will fail.
+
+The following arguments are optional:
+
+* `assertedControls` - (Optional) Routing controls that are part of transactions that are evaluated to determine if a request to change a routing control state is allowed.
+* `gatingControls` - (Optional) Gating controls for the new gating rule. That is, routing controls that are evaluated by the rule configuration that you specify.
+* `targetControls` - (Optional) Routing controls that can only be set or unset if the specified `ruleConfig` evaluates to true for the specified `gatingControls`.
+
+### rule_config
+
+* `inverted` - (Required) Logical negation of the rule.
+* `threshold` - (Required) Number of controls that must be set when you specify an `atleast` type rule.
+* `type` - (Required) Rule type. Valid values are `atleast`, `and`, and `or`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the safety rule.
+* `status` - Status of the safety rule. `pending` when it is being created/updated, `pendingDeletion` when it is being deleted, and `deployed` otherwise.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Route53 Recovery Control Config Safety Rule using the safety rule ARN. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Route53 Recovery Control Config Safety Rule using the safety rule ARN. For example:
+
+```console
+% terraform import aws_route53recoverycontrolconfig_safety_rule.myrule arn:aws:route53-recovery-control::313517334327:controlpanel/1bfba17df8684f5dab0467b71424f7e8/safetyrule/3bacc77003364c0f
+```
+
+<!-- cache-key: cdktf-0.18.0 input-7fff1efee90763bc95e5e1aa7048eaa46466d5f09d9ca28fd68052bc48898c54 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/route53recoveryreadiness_cell.html.markdown b/website/docs/cdktf/typescript/r/route53recoveryreadiness_cell.html.markdown
new file mode 100644
index 00000000000..e7d1b854ef0
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/route53recoveryreadiness_cell.html.markdown
@@ -0,0 +1,84 @@
+---
+subcategory: "Route 53 Recovery Readiness"
+layout: "aws"
+page_title: "AWS: aws_route53recoveryreadiness_cell"
+description: |-
+  Provides an AWS Route 53 Recovery Readiness Cell
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_route53recoveryreadiness_cell
+
+Provides an AWS Route 53 Recovery Readiness Cell.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Route53RecoveryreadinessCell } from "./.gen/providers/aws/route53-recoveryreadiness-cell";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Route53RecoveryreadinessCell(this, "example", {
+      cellName: "us-west-2-failover-cell",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `cellName` - (Required) Unique name describing the cell.
+
+The following arguments are optional:
+
+* `cells` - (Optional) List of cell arns to add as nested fault domains within this cell.
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the cell
+* `parentReadinessScopes` - List of readiness scopes (recovery groups or cells) that contain this cell.
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `delete` - (Default `5M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Route53 Recovery Readiness cells using the cell name. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Route53 Recovery Readiness cells using the cell name. For example:
+
+```console
+% terraform import aws_route53recoveryreadiness_cell.us-west-2-failover-cell us-west-2-failover-cell
+```
+
+<!-- cache-key: cdktf-0.18.0 input-d2ac826652336fbe8c626518574803e2477f46155743addd2076ff30e66c3364 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/route53recoveryreadiness_readiness_check.html.markdown b/website/docs/cdktf/typescript/r/route53recoveryreadiness_readiness_check.html.markdown
new file mode 100644
index 00000000000..f26aab7a400
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/route53recoveryreadiness_readiness_check.html.markdown
@@ -0,0 +1,84 @@
+---
+subcategory: "Route 53 Recovery Readiness"
+layout: "aws"
+page_title: "AWS: aws_route53recoveryreadiness_readiness_check"
+description: |-
+  Provides an AWS Route 53 Recovery Readiness Readiness Check
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_route53recoveryreadiness_readiness_check
+
+Provides an AWS Route 53 Recovery Readiness Readiness Check.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Route53RecoveryreadinessReadinessCheck } from "./.gen/providers/aws/route53-recoveryreadiness-readiness-check";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Route53RecoveryreadinessReadinessCheck(this, "example", {
+      readinessCheckName: myCwAlarmCheck,
+      resourceSetName: myCwAlarmSet,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `readinessCheckName` - (Required) Unique name describing the readiness check.
+* `resourceSetName` - (Required) Name describing the resource set that will be monitored for readiness.
+
+The following arguments are optional:
+
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the readiness_check
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `delete` - (Default `5M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Route53 Recovery Readiness readiness checks using the readiness check name. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Route53 Recovery Readiness readiness checks using the readiness check name. For example:
+
+```console
+% terraform import aws_route53recoveryreadiness_readiness_check.my-cw-alarm-check example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-d22917e33ca4565e013cd0a41cc427014bd53fd12e040a9c38042c7bc3197b49 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/route53recoveryreadiness_recovery_group.html.markdown b/website/docs/cdktf/typescript/r/route53recoveryreadiness_recovery_group.html.markdown
new file mode 100644
index 00000000000..0c50d24666c
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/route53recoveryreadiness_recovery_group.html.markdown
@@ -0,0 +1,83 @@
+---
+subcategory: "Route 53 Recovery Readiness"
+layout: "aws"
+page_title: "AWS: aws_route53recoveryreadiness_recovery_group"
+description: |-
+  Provides an AWS Route 53 Recovery Readiness Recovery Group
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_route53recoveryreadiness_recovery_group
+
+Provides an AWS Route 53 Recovery Readiness Recovery Group.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Route53RecoveryreadinessRecoveryGroup } from "./.gen/providers/aws/route53-recoveryreadiness-recovery-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Route53RecoveryreadinessRecoveryGroup(this, "example", {
+      recoveryGroupName: "my-high-availability-app",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `recoveryGroupName` - (Required) A unique name describing the recovery group.
+
+The following argument are optional:
+
+* `cells` - (Optional) List of cell arns to add as nested fault domains within this recovery group
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the recovery group
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `delete` - (Default `5M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Route53 Recovery Readiness recovery groups using the recovery group name. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Route53 Recovery Readiness recovery groups using the recovery group name. For example:
+
+```console
+% terraform import aws_route53recoveryreadiness_recovery_group.my-high-availability-app my-high-availability-app
+```
+
+<!-- cache-key: cdktf-0.18.0 input-8dde4cc1d205a94cf5f5ad34c54ed11d8cdcf8e43195fafdf486d08bbe56f97b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/route53recoveryreadiness_resource_set.html.markdown b/website/docs/cdktf/typescript/r/route53recoveryreadiness_resource_set.html.markdown
new file mode 100644
index 00000000000..537e2952aed
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/route53recoveryreadiness_resource_set.html.markdown
@@ -0,0 +1,119 @@
+---
+subcategory: "Route 53 Recovery Readiness"
+layout: "aws"
+page_title: "AWS: aws_route53recoveryreadiness_resource_set"
+description: |-
+  Provides an AWS Route 53 Recovery Readiness Resource Set
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_route53recoveryreadiness_resource_set
+
+Provides an AWS Route 53 Recovery Readiness Resource Set.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Route53RecoveryreadinessResourceSet } from "./.gen/providers/aws/route53-recoveryreadiness-resource-set";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Route53RecoveryreadinessResourceSet(this, "example", {
+      resourceSetName: myCwAlarmSet,
+      resourceSetType: "AWS::CloudWatch::Alarm",
+      resources: [
+        {
+          resourceArn: Token.asString(awsCloudwatchMetricAlarmExample.arn),
+        },
+      ],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `resourceSetName` - (Required) Unique name describing the resource set.
+* `resourceSetType` - (Required) Type of the resources in the resource set.
+* `resources` - (Required) List of resources to add to this resource set. See below.
+
+The following arguments are optional:
+
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### resources
+
+* `dnsTargetResource` - (Required if `resourceArn` is not set) Component for DNS/Routing Control Readiness Checks.
+* `readinessScopes` - (Optional) Recovery group ARN or cell ARN that contains this resource set.
+* `resourceArn` - (Required if `dnsTargetResource` is not set) ARN of the resource.
+
+### dns_target_resource
+
+* `domainName` - (Optional) DNS Name that acts as the ingress point to a portion of application.
+* `hostedZoneArn` - (Optional) Hosted Zone ARN that contains the DNS record with the provided name of target resource.
+* `recordSetId` - (Optional) Route53 record set id to uniquely identify a record given a `domainName` and a `recordType`.
+* `recordType` - (Optional) Type of DNS Record of target resource.
+* `targetResource` - (Optional) Target resource the R53 record specified with the above params points to.
+
+### target_resource
+
+* `nlbResource` - (Optional) NLB resource a DNS Target Resource points to. Required if `r53Resource` is not set.
+* `r53Resource` - (Optional) Route53 resource a DNS Target Resource record points to.
+
+### nlb_resource
+
+* `arn` - (Required) NLB resource ARN.
+
+### r53_resource
+
+* `domainName` - (Optional) Domain name that is targeted.
+* `recordSetId` - (Optional) Resource record set ID that is targeted.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the resource set
+* `resources.#ComponentId` - Unique identified for DNS Target Resources, use for readiness checks.
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `delete` - (Default `5M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Route53 Recovery Readiness resource set name using the resource set name. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Route53 Recovery Readiness resource set name using the resource set name. For example:
+
+```console
+% terraform import aws_route53recoveryreadiness_resource_set.my-cw-alarm-set example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-3088ad6ae6c23ba549c55a78d09934efb83080fc584e0fbb75e37b7be8ec0715 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/route_table.html.markdown b/website/docs/cdktf/typescript/r/route_table.html.markdown
new file mode 100644
index 00000000000..d3e9c41ae4c
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/route_table.html.markdown
@@ -0,0 +1,263 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_route_table"
+description: |-
+  Provides a resource to create a VPC routing table.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_route_table
+
+Provides a resource to create a VPC routing table.
+
+~> **NOTE on Route Tables and Routes:** Terraform currently
+provides both a standalone [Route resource](route.html) and a Route Table resource with routes
+defined in-line. At this time you cannot use a Route Table with in-line routes
+in conjunction with any Route resources. Doing so will cause
+a conflict of rule settings and will overwrite rules.
+
+~> **NOTE on `gatewayId` and `natGatewayId`:** The AWS API is very forgiving with these two
+attributes and the `awsRouteTable` resource can be created with a NAT ID specified as a Gateway ID attribute.
+This _will_ lead to a permanent diff between your configuration and statefile, as the API returns the correct
+parameters in the returned route table. If you're experiencing constant diffs in your `awsRouteTable` resources,
+the first thing to check is whether or not you're specifying a NAT ID instead of a Gateway ID, or vice-versa.
+
+~> **NOTE on `propagatingVgws` and the `awsVpnGatewayRoutePropagation` resource:**
+If the `propagatingVgws` argument is present, it's not supported to _also_
+define route propagations using `awsVpnGatewayRoutePropagation`, since
+this resource will delete any propagating gateways not explicitly listed in
+`propagatingVgws`. Omit this argument when defining route propagation using
+the separate resource.
+
+## Example Usage
+
+### Basic example
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { RouteTable } from "./.gen/providers/aws/route-table";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new RouteTable(this, "example", {
+      route: [
+        {
+          cidrBlock: "10.0.1.0/24",
+          gatewayId: Token.asString(awsInternetGatewayExample.id),
+        },
+        {
+          egressOnlyGatewayId: Token.asString(
+            awsEgressOnlyInternetGatewayExample.id
+          ),
+          ipv6CidrBlock: "::/0",
+        },
+      ],
+      tags: {
+        Name: "example",
+      },
+      vpcId: Token.asString(awsVpcExample.id),
+    });
+  }
+}
+
+```
+
+To subsequently remove all managed routes:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { RouteTable } from "./.gen/providers/aws/route-table";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new RouteTable(this, "example", {
+      route: [],
+      tags: {
+        Name: "example",
+      },
+      vpcId: Token.asString(awsVpcExample.id),
+    });
+  }
+}
+
+```
+
+### Adopting an existing local route
+
+AWS creates certain routes that the AWS provider mostly ignores. You can manage them by importing or adopting them. See [Import](#import) below for information on importing. This example shows adopting a route and then updating its target.
+
+First, adopt an existing AWS-created route:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { RouteTable } from "./.gen/providers/aws/route-table";
+import { Vpc } from "./.gen/providers/aws/vpc";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const test = new Vpc(this, "test", {
+      cidrBlock: "10.1.0.0/16",
+    });
+    const awsRouteTableTest = new RouteTable(this, "test_1", {
+      route: [
+        {
+          cidrBlock: "10.1.0.0/16",
+          gatewayId: "local",
+        },
+      ],
+      vpcId: test.id,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsRouteTableTest.overrideLogicalId("test");
+  }
+}
+
+```
+
+Next, update the target of the route:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { NetworkInterface } from "./.gen/providers/aws/network-interface";
+import { RouteTable } from "./.gen/providers/aws/route-table";
+import { Subnet } from "./.gen/providers/aws/subnet";
+import { Vpc } from "./.gen/providers/aws/vpc";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const test = new Vpc(this, "test", {
+      cidrBlock: "10.1.0.0/16",
+    });
+    const awsSubnetTest = new Subnet(this, "test_1", {
+      cidrBlock: "10.1.1.0/24",
+      vpcId: test.id,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSubnetTest.overrideLogicalId("test");
+    const awsNetworkInterfaceTest = new NetworkInterface(this, "test_2", {
+      subnetId: Token.asString(awsSubnetTest.id),
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsNetworkInterfaceTest.overrideLogicalId("test");
+    const awsRouteTableTest = new RouteTable(this, "test_3", {
+      route: [
+        {
+          cidrBlock: test.cidrBlock,
+          networkInterfaceId: Token.asString(awsNetworkInterfaceTest.id),
+        },
+      ],
+      vpcId: test.id,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsRouteTableTest.overrideLogicalId("test");
+  }
+}
+
+```
+
+The target could then be updated again back to `local`.
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `vpcId` - (Required) The VPC ID.
+* `route` - (Optional) A list of route objects. Their keys are documented below. This argument is processed in [attribute-as-blocks mode](https://www.terraform.io/docs/configuration/attr-as-blocks.html).
+This means that omitting this argument is interpreted as ignoring any existing routes. To remove all managed routes an empty list should be specified. See the example above.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `propagatingVgws` - (Optional) A list of virtual gateways for propagation.
+
+### route Argument Reference
+
+This argument is processed in [attribute-as-blocks mode](https://www.terraform.io/docs/configuration/attr-as-blocks.html).
+
+One of the following destination arguments must be supplied:
+
+* `cidrBlock` - (Required) The CIDR block of the route.
+* `ipv6CidrBlock` - (Optional) The Ipv6 CIDR block of the route.
+* `destinationPrefixListId` - (Optional) The ID of a [managed prefix list](ec2_managed_prefix_list.html) destination of the route.
+
+One of the following target arguments must be supplied:
+
+* `carrierGatewayId` - (Optional) Identifier of a carrier gateway. This attribute can only be used when the VPC contains a subnet which is associated with a Wavelength Zone.
+* `coreNetworkArn` - (Optional) The Amazon Resource Name (ARN) of a core network.
+* `egressOnlyGatewayId` - (Optional) Identifier of a VPC Egress Only Internet Gateway.
+* `gatewayId` - (Optional) Identifier of a VPC internet gateway, virtual private gateway, or `local`. `local` routes cannot be created but can be adopted or imported. See the [example](#adopting-an-existing-local-route) above.
+* `localGatewayId` - (Optional) Identifier of a Outpost local gateway.
+* `natGatewayId` - (Optional) Identifier of a VPC NAT gateway.
+* `networkInterfaceId` - (Optional) Identifier of an EC2 network interface.
+* `transitGatewayId` - (Optional) Identifier of an EC2 Transit Gateway.
+* `vpcEndpointId` - (Optional) Identifier of a VPC Endpoint.
+* `vpcPeeringConnectionId` - (Optional) Identifier of a VPC peering connection.
+
+Note that the default route, mapping the VPC's CIDR block to "local", is created implicitly and cannot be specified.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+~> **NOTE:** Only the target that is entered is exported as a readable
+attribute once the route resource is created.
+
+* `id` - The ID of the routing table.
+* `arn` - The ARN of the route table.
+* `ownerId` - The ID of the AWS account that owns the route table.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `5M`)
+- `update` - (Default `2M`)
+- `delete` - (Default `5M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Route Tables using the route table `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Route Tables using the route table `id`. For example:
+
+```console
+% terraform import aws_route_table.public_rt rtb-4e616f6d69
+```
+
+<!-- cache-key: cdktf-0.18.0 input-d300bb2babcdde7f3a257080c421d049a58a89200afecf3485288c3ad0d30c6d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/route_table_association.html.markdown b/website/docs/cdktf/typescript/r/route_table_association.html.markdown
new file mode 100644
index 00000000000..36c31ffa98a
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/route_table_association.html.markdown
@@ -0,0 +1,132 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_route_table_association"
+description: |-
+  Provides a resource to create an association between a route table and a subnet or a route table and an internet gateway or virtual private gateway.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_route_table_association
+
+Provides a resource to create an association between a route table and a subnet or a route table and an
+internet gateway or virtual private gateway.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { RouteTableAssociation } from "./.gen/providers/aws/route-table-association";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new RouteTableAssociation(this, "a", {
+      routeTableId: bar.id,
+      subnetId: foo.id,
+    });
+  }
+}
+
+```
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { RouteTableAssociation } from "./.gen/providers/aws/route-table-association";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new RouteTableAssociation(this, "b", {
+      gatewayId: foo.id,
+      routeTableId: bar.id,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+~> **NOTE:** Please note that one of either `subnetId` or `gatewayId` is required.
+
+This argument supports the following arguments:
+
+* `subnetId` - (Optional) The subnet ID to create an association. Conflicts with `gatewayId`.
+* `gatewayId` - (Optional) The gateway ID to create an association. Conflicts with `subnetId`.
+* `routeTableId` - (Required) The ID of the routing table to associate with.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the association
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `5M`)
+- `update` - (Default `2M`)
+- `delete` - (Default `5M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EC2 Route Table Associations using the associated resource ID and Route Table ID separated by a forward slash (`/`). For example:
+
+~> **NOTE:** Attempting to associate a route table with a subnet or gateway, where either is already associated, will result in an error (e.g., `Resource.AlreadyAssociated: the specified association for route table rtb-4176657279 conflicts with an existing association`) unless you first import the original association.
+
+With EC2 Subnets:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+With EC2 Internet Gateways:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+**Using `terraform import` to import** EC2 Route Table Associations using the associated resource ID and Route Table ID separated by a forward slash (`/`). For example:
+
+With EC2 Subnets:
+
+```console
+% terraform import aws_route_table_association.assoc subnet-6777656e646f6c796e/rtb-656c65616e6f72
+```
+
+With EC2 Internet Gateways:
+
+```console
+% terraform import aws_route_table_association.assoc igw-01b3a60780f8d034a/rtb-656c65616e6f72
+```
+
+<!-- cache-key: cdktf-0.18.0 input-4552818b4878e80d058998466d30965c95d752e528e046f4f7a9999a8dfcb719 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/rum_app_monitor.html.markdown b/website/docs/cdktf/typescript/r/rum_app_monitor.html.markdown
new file mode 100644
index 00000000000..0b2d0ee251d
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/rum_app_monitor.html.markdown
@@ -0,0 +1,97 @@
+---
+subcategory: "CloudWatch RUM"
+layout: "aws"
+page_title: "AWS: aws_rum_app_monitor"
+description: |-
+  Provides a CloudWatch RUM App Monitor resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_rum_app_monitor
+
+Provides a CloudWatch RUM App Monitor resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { RumAppMonitor } from "./.gen/providers/aws/rum-app-monitor";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new RumAppMonitor(this, "example", {
+      domain: "localhost",
+      name: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the log stream.
+* `domain` - (Required) The top-level internet domain name for which your application has administrative authority.
+* `appMonitorConfiguration` - (Optional) configuration data for the app monitor. See [app_monitor_configuration](#app_monitor_configuration) below.
+* `cwLogEnabled` - (Optional) Data collected by RUM is kept by RUM for 30 days and then deleted. This parameter  specifies whether RUM sends a copy of this telemetry data to Amazon CloudWatch Logs in your account. This enables you to keep the telemetry data for more than 30 days, but it does incur Amazon CloudWatch Logs charges. Default value is `false`.
+* `customEvents` - (Optional) Specifies whether this app monitor allows the web client to define and send custom events. If you omit this parameter, custom events are `disabled`. See [custom_events](#custom_events) below.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### app_monitor_configuration
+
+* `allowCookies` - (Optional) If you set this to `true`, RUM web client sets two cookies, a session cookie  and a user cookie. The cookies allow the RUM web client to collect data relating to the number of users an application has and the behavior of the application across a sequence of events. Cookies are stored in the top-level domain of the current page.
+* `enableXray` - (Optional) If you set this to `true`, RUM enables X-Ray tracing for the user sessions  that RUM samples. RUM adds an X-Ray trace header to allowed HTTP requests. It also records an X-Ray segment for allowed HTTP requests.
+* `excludedPages` - (Optional) A list of URLs in your website or application to exclude from RUM data collection.
+* `favoritePages` - (Optional) A list of pages in the CloudWatch RUM console that are to be displayed with a "favorite" icon.
+* `guestRoleArn` - (Optional) The ARN of the guest IAM role that is attached to the Amazon Cognito identity pool that is used to authorize the sending of data to RUM.
+* `identityPoolId` - (Optional) The ID of the Amazon Cognito identity pool that is used to authorize the sending of data to RUM.
+* `includedPages` - (Optional)  If this app monitor is to collect data from only certain pages in your application, this structure lists those pages.
+* `sessionSampleRate` - (Optional) Specifies the percentage of user sessions to use for RUM data collection. Choosing a higher percentage gives you more data but also incurs more costs. The number you specify is the percentage of user sessions that will be used. Default value is `01`.
+* `telemetries` - (Optional) An array that lists the types of telemetry data that this app monitor is to collect. Valid values are `errors`, `performance`, and `http`.
+
+### custom_events
+
+* `status` - (Optional) Specifies whether this app monitor allows the web client to define and send custom events. The default is for custom events to be `disabled`. Valid values are `disabled` and `enabled`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) specifying the app monitor.
+* `id` - The CloudWatch RUM name as it is the identifier of a RUM.
+* `appMonitorId` - The unique ID of the app monitor. Useful for JS templates.
+* `cwLogGroup` - The name of the log group where the copies are stored.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Cloudwatch RUM App Monitor using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Cloudwatch RUM App Monitor using the `name`. For example:
+
+```console
+% terraform import aws_rum_app_monitor.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-b381cc3a01207454edb5a73b4ffe67c1902d1625465d5195b0a31d7bc968ed4e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/rum_metrics_destination.html.markdown b/website/docs/cdktf/typescript/r/rum_metrics_destination.html.markdown
new file mode 100644
index 00000000000..68dc505c236
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/rum_metrics_destination.html.markdown
@@ -0,0 +1,75 @@
+---
+subcategory: "CloudWatch RUM"
+layout: "aws"
+page_title: "AWS: aws_rum_metrics_destination"
+description: |-
+  Provides a CloudWatch RUM Metrics Destination resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_rum_metrics_destination
+
+Provides a CloudWatch RUM Metrics Destination resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { RumMetricsDestination } from "./.gen/providers/aws/rum-metrics-destination";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new RumMetricsDestination(this, "example", {
+      appMonitorName: Token.asString(awsRumAppMonitorExample.name),
+      destination: "CloudWatch",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `appMonitorName` - (Required) The name of the CloudWatch RUM app monitor that will send the metrics.
+* `destination` - (Required)  Defines the destination to send the metrics to. Valid values are `cloudWatch` and `evidently`. If you specify `evidently`, you must also specify the ARN of the CloudWatchEvidently experiment that is to be the destination and an IAM role that has permission to write to the experiment.
+* `destinationArn` - (Optional) Use this parameter only if Destination is Evidently. This parameter specifies the ARN of the Evidently experiment that will receive the extended metrics.
+* `iamRoleArn` - (Optional) This parameter is required if Destination is Evidently. If Destination is CloudWatch, do not use this parameter.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name of the CloudWatch RUM app monitor that will send the metrics.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Cloudwatch RUM Metrics Destination using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Cloudwatch RUM Metrics Destination using the `id`. For example:
+
+```console
+% terraform import aws_rum_metrics_destination.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-b0a8bc87eed073c64dab3eea6177045d7d17087af1a9092e3e8b592be02eb910 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/s3_access_point.html.markdown b/website/docs/cdktf/typescript/r/s3_access_point.html.markdown
new file mode 100644
index 00000000000..be491dca988
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/s3_access_point.html.markdown
@@ -0,0 +1,187 @@
+---
+subcategory: "S3 Control"
+layout: "aws"
+page_title: "AWS: aws_s3_access_point"
+description: |-
+  Manages an S3 Access Point.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_s3_access_point
+
+Provides a resource to manage an S3 Access Point.
+
+~> **NOTE on Access Points and Access Point Policies:** Terraform provides both a standalone [Access Point Policy](s3control_access_point_policy.html) resource and an Access Point resource with a resource policy defined in-line. You cannot use an Access Point with in-line resource policy in conjunction with an Access Point Policy resource. Doing so will cause a conflict of policies and will overwrite the access point's resource policy.
+
+-> Advanced usage: To use a custom API endpoint for this Terraform resource, use the [`s3Control` endpoint provider configuration](/docs/providers/aws/index.html#s3control), not the `s3` endpoint provider configuration.
+
+## Example Usage
+
+### AWS Partition Bucket
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3AccessPoint } from "./.gen/providers/aws/s3-access-point";
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new S3Bucket(this, "example", {
+      bucket: "example",
+    });
+    const awsS3AccessPointExample = new S3AccessPoint(this, "example_1", {
+      bucket: example.id,
+      name: "example",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3AccessPointExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### S3 on Outposts Bucket
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3AccessPoint } from "./.gen/providers/aws/s3-access-point";
+import { S3ControlBucket } from "./.gen/providers/aws/s3-control-bucket";
+import { Vpc } from "./.gen/providers/aws/vpc";
+interface MyConfig {
+  outpostId: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    const example = new S3ControlBucket(this, "example", {
+      bucket: "example",
+      outpostId: config.outpostId,
+    });
+    const awsVpcExample = new Vpc(this, "example_1", {
+      cidrBlock: "10.0.0.0/16",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsVpcExample.overrideLogicalId("example");
+    const awsS3AccessPointExample = new S3AccessPoint(this, "example_2", {
+      bucket: example.arn,
+      name: "example",
+      vpcConfiguration: {
+        vpcId: Token.asString(awsVpcExample.id),
+      },
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3AccessPointExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `bucket` - (Required) Name of an AWS Partition S3 Bucket or the ARN of S3 on Outposts Bucket that you want to associate this access point with.
+* `name` - (Required) Name you want to assign to this access point.
+
+The following arguments are optional:
+
+* `accountId` - (Optional) AWS account ID for the owner of the bucket for which you want to create an access point. Defaults to automatically determined account ID of the Terraform AWS provider.
+* `bucketAccountId` - (Optional) AWS account ID associated with the S3 bucket associated with this access point.
+* `policy` - (Optional) Valid JSON document that specifies the policy that you want to apply to this access point. Removing `policy` from your configuration or setting `policy` to null or an empty string (i.e., `policy = ""`) _will not_ delete the policy since it could have been set by `awsS3ControlAccessPointPolicy`. To remove the `policy`, set it to `"{}"` (an empty JSON document).
+* `publicAccessBlockConfiguration` - (Optional) Configuration block to manage the `publicAccessBlock` configuration that you want to apply to this Amazon S3 bucket. You can enable the configuration options in any combination. Detailed below.
+* `vpcConfiguration` - (Optional) Configuration block to restrict access to this access point to requests from the specified Virtual Private Cloud (VPC). Required for S3 on Outposts. Detailed below.
+
+### public_access_block_configuration Configuration Block
+
+The following arguments are optional:
+
+* `blockPublicAcls` - (Optional) Whether Amazon S3 should block public ACLs for buckets in this account. Defaults to `true`. Enabling this setting does not affect existing policies or ACLs. When set to `true` causes the following behavior:
+    * PUT Bucket acl and PUT Object acl calls fail if the specified ACL is public.
+    * PUT Object calls fail if the request includes a public ACL.
+    * PUT Bucket calls fail if the request includes a public ACL.
+* `blockPublicPolicy` - (Optional) Whether Amazon S3 should block public bucket policies for buckets in this account. Defaults to `true`. Enabling this setting does not affect existing bucket policies. When set to `true` causes Amazon S3 to:
+    * Reject calls to PUT Bucket policy if the specified bucket policy allows public access.
+* `ignorePublicAcls` - (Optional) Whether Amazon S3 should ignore public ACLs for buckets in this account. Defaults to `true`. Enabling this setting does not affect the persistence of any existing ACLs and doesn't prevent new public ACLs from being set. When set to `true` causes Amazon S3 to:
+    * Ignore all public ACLs on buckets in this account and any objects that they contain.
+* `restrictPublicBuckets` - (Optional) Whether Amazon S3 should restrict public bucket policies for buckets in this account. Defaults to `true`. Enabling this setting does not affect previously stored bucket policies, except that public and cross-account access within any public bucket policy, including non-public delegation to specific accounts, is blocked. When set to `true`:
+    * Only the bucket owner and AWS Services can access buckets with public policies.
+
+### vpc_configuration Configuration Block
+
+The following arguments are required:
+
+* `vpcId` - (Required)  This access point will only allow connections from the specified VPC ID.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `alias` - Alias of the S3 Access Point.
+* `arn` - ARN of the S3 Access Point.
+* `domainName` - DNS domain name of the S3 Access Point in the format _`name`_-_`accountId`_.s3-accesspoint._region_.amazonaws.com.
+Note: S3 access points only support secure access by HTTPS. HTTP isn't supported.
+* `endpoints` - VPC endpoints for the S3 Access Point.
+* `hasPublicAccessPolicy` - Indicates whether this access point currently has a policy that allows public access.
+* `id` - For Access Point of an AWS Partition S3 Bucket, the AWS account ID and access point name separated by a colon (`:`). For S3 on Outposts Bucket, the ARN of the Access Point.
+* `networkOrigin` - Indicates whether this access point allows access from the public Internet. Values are `vpc` (the access point doesn't allow access from the public Internet) and `internet` (the access point allows access from the public Internet, subject to the access point and bucket access policies).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import this resource using the `accountId` and `name` separated by a colon (`:`) for Access Points associated with an AWS Partition S3 Bucket or the ARN for Access Points associated with an S3 on Outposts Bucket. For example:
+
+Import using the `accountId` and `name` separated by a colon (`:`) for Access Points associated with an AWS Partition S3 Bucket:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Import using the ARN for Access Points associated with an S3 on Outposts Bucket:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+**Using `terraform import` to import.** For example:
+
+Import using the `accountId` and `name` separated by a colon (`:`) for Access Points associated with an AWS Partition S3 Bucket:
+
+```console
+% terraform import aws_s3_access_point.example 123456789012:example
+```
+
+Import using the ARN for Access Points associated with an S3 on Outposts Bucket:
+
+```console
+% terraform import aws_s3_access_point.example arn:aws:s3-outposts:us-east-1:123456789012:outpost/op-1234567890123456/accesspoint/example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-62226ef5a5030fd4e742702fe5b17f262b9a0edbc8724a758784c5289d1270af -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/s3_account_public_access_block.html.markdown b/website/docs/cdktf/typescript/r/s3_account_public_access_block.html.markdown
new file mode 100644
index 00000000000..5b143e8b05d
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/s3_account_public_access_block.html.markdown
@@ -0,0 +1,85 @@
+---
+subcategory: "S3 Control"
+layout: "aws"
+page_title: "AWS: aws_s3_account_public_access_block"
+description: |-
+  Manages S3 account-level Public Access Block Configuration
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_s3_account_public_access_block
+
+Manages S3 account-level Public Access Block configuration. For more information about these settings, see the [AWS S3 Block Public Access documentation](https://docs.aws.amazon.com/AmazonS3/latest/dev/access-control-block-public-access.html).
+
+~> **NOTE:** Each AWS account may only have one S3 Public Access Block configuration. Multiple configurations of the resource against the same AWS account will cause a perpetual difference.
+
+-> Advanced usage: To use a custom API endpoint for this Terraform resource, use the [`s3Control` endpoint provider configuration](/docs/providers/aws/index.html#s3control), not the `s3` endpoint provider configuration.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3AccountPublicAccessBlock } from "./.gen/providers/aws/s3-account-public-access-block";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new S3AccountPublicAccessBlock(this, "example", {
+      blockPublicAcls: true,
+      blockPublicPolicy: true,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `accountId` - (Optional) AWS account ID to configure. Defaults to automatically determined account ID of the Terraform AWS provider.
+* `blockPublicAcls` - (Optional) Whether Amazon S3 should block public ACLs for buckets in this account. Defaults to `false`. Enabling this setting does not affect existing policies or ACLs. When set to `true` causes the following behavior:
+    * PUT Bucket acl and PUT Object acl calls will fail if the specified ACL allows public access.
+    * PUT Object calls fail if the request includes a public ACL.
+* `blockPublicPolicy` - (Optional) Whether Amazon S3 should block public bucket policies for buckets in this account. Defaults to `false`. Enabling this setting does not affect existing bucket policies. When set to `true` causes Amazon S3 to:
+    * Reject calls to PUT Bucket policy if the specified bucket policy allows public access.
+* `ignorePublicAcls` - (Optional) Whether Amazon S3 should ignore public ACLs for buckets in this account. Defaults to `false`. Enabling this setting does not affect the persistence of any existing ACLs and doesn't prevent new public ACLs from being set. When set to `true` causes Amazon S3 to:
+    * Ignore all public ACLs on buckets in this account and any objects that they contain.
+* `restrictPublicBuckets` - (Optional) Whether Amazon S3 should restrict public bucket policies for buckets in this account. Defaults to `false`. Enabling this setting does not affect previously stored bucket policies, except that public and cross-account access within any public bucket policy, including non-public delegation to specific accounts, is blocked. When set to `true`:
+    * Only the bucket owner and AWS Services can access buckets with public policies.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - AWS account ID
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsS3AccountPublicAccessBlock` using the AWS account ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsS3AccountPublicAccessBlock` using the AWS account ID. For example:
+
+```console
+% terraform import aws_s3_account_public_access_block.example 123456789012
+```
+
+<!-- cache-key: cdktf-0.18.0 input-0e7f009405cc9f18e00601a618698df4875b5d3f926795da6704f8e3a7160217 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/s3_bucket.html.markdown b/website/docs/cdktf/typescript/r/s3_bucket.html.markdown
new file mode 100644
index 00000000000..5e9d586d7b9
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/s3_bucket.html.markdown
@@ -0,0 +1,401 @@
+---
+subcategory: "S3 (Simple Storage)"
+layout: "aws"
+page_title: "AWS: aws_s3_bucket"
+description: |-
+  Provides a S3 bucket resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_s3_bucket
+
+Provides a S3 bucket resource.
+
+-> This functionality is for managing S3 in an AWS Partition. To manage [S3 on Outposts](https://docs.aws.amazon.com/AmazonS3/latest/dev/S3onOutposts.html), see the [`awsS3ControlBucket`](/docs/providers/aws/r/s3control_bucket.html) resource.
+
+-> In April 2023, [AWS introduced](https://aws.amazon.com/about-aws/whats-new/2022/12/amazon-s3-automatically-enable-block-public-access-disable-access-control-lists-buckets-april-2023/) updated security defaults for new S3 buckets. See [this issue](https://github.com/hashicorp/terraform-provider-aws/issues/28353) for a information on how this affects the `awsS3Bucket` resource.
+
+## Example Usage
+
+### Private Bucket With Tags
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new S3Bucket(this, "example", {
+      bucket: "my-tf-test-bucket",
+      tags: {
+        Environment: "Dev",
+        Name: "My bucket",
+      },
+    });
+  }
+}
+
+```
+
+### Static Website Hosting
+
+-> **NOTE:** The `website` attribute is deprecated.
+See [`awsS3BucketWebsiteConfiguration`](s3_bucket_website_configuration.html.markdown) for examples with static website hosting configured.
+
+### CORS Rules
+
+-> **NOTE:** The `corsRule` attribute is deprecated.
+See [`awsS3BucketCorsConfiguration`](s3_bucket_cors_configuration.html.markdown) for examples with CORS rules configured.
+
+### Versioning
+
+-> **NOTE:** The `versioning` attribute is deprecated.
+See [`awsS3BucketVersioning`](s3_bucket_versioning.html.markdown) for examples with versioning configured.
+
+### Logging
+
+-> **NOTE:** The `logging` attribute is deprecated.
+See [`awsS3BucketLogging`](s3_bucket_logging.html.markdown) for examples with logging enabled.
+
+### Object Lifecycle Rules
+
+-> **NOTE:** The `lifecycleRule` attribute is deprecated.
+See [`awsS3BucketLifecycleConfiguration`](s3_bucket_lifecycle_configuration.html.markdown) for examples with object lifecycle rules.
+
+### Object Lock Configuration
+
+-> **NOTE:** The `objectLockConfiguration` attribute is deprecated.
+See [`awsS3BucketObjectLockConfiguration`](s3_bucket_object_lock_configuration.html.markdown) for examples with object lock configurations on both new and existing buckets.
+
+### Replication Configuration
+
+-> **NOTE:** The `replicationConfiguration` attribute is deprecated.
+See [`awsS3BucketReplicationConfiguration`](s3_bucket_replication_configuration.html.markdown) for examples with replication configured.
+
+### Enable SSE-KMS Server Side Encryption
+
+-> **NOTE:** The `serverSideEncryptionConfiguration` attribute is deprecated.
+See [`awsS3BucketServerSideEncryptionConfiguration`](s3_bucket_server_side_encryption_configuration.html.markdown) for examples with server side encryption configured.
+
+### ACL Policy Grants
+
+-> **NOTE:** The `acl` and `grant` attributes are deprecated.
+See [`awsS3BucketAcl`](s3_bucket_acl.html.markdown) for examples with ACL grants.
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `bucket` - (Optional, Forces new resource) Name of the bucket. If omitted, Terraform will assign a random, unique name. Must be lowercase and less than or equal to 63 characters in length. A full list of bucket naming rules [may be found here](https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucketnamingrules.html).
+* `bucketPrefix` - (Optional, Forces new resource) Creates a unique bucket name beginning with the specified prefix. Conflicts with `bucket`. Must be lowercase and less than or equal to 37 characters in length. A full list of bucket naming rules [may be found here](https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucketnamingrules.html).
+* `forceDestroy` - (Optional, Default:`false`) Boolean that indicates all objects (including any [locked objects](https://docs.aws.amazon.com/AmazonS3/latest/dev/object-lock-overview.html)) should be deleted from the bucket *when the bucket is destroyed* so that the bucket can be destroyed without error. These objects are *not* recoverable. This only deletes objects when the bucket is destroyed, *not* when setting this parameter to `true`. Once this parameter is set to `true`, there must be a successful `terraform apply` run before a destroy is required to update this value in the resource state. Without a successful `terraform apply` after this parameter is set, this flag will have no effect. If setting this field in the same operation that would require replacing the bucket or destroying the bucket, this flag will not work. Additionally when importing a bucket, a successful `terraform apply` is required to set this value in state before it will take effect on a destroy operation.
+* `objectLockEnabled` - (Optional, Forces new resource) Indicates whether this bucket has an Object Lock configuration enabled. Valid values are `true` or `false`. This argument is not supported in all regions or partitions.
+* `tags` - (Optional) Map of tags to assign to the bucket. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+The following arguments are deprecated, and will be removed in a future major version:
+
+* `accelerationStatus` - (Optional, **Deprecated**) Sets the accelerate configuration of an existing bucket. Can be `enabled` or `suspended`. Cannot be used in `cnNorth1` or `usGovWest1`. Terraform will only perform drift detection if a configuration value is provided.
+  Use the resource [`awsS3BucketAccelerateConfiguration`](s3_bucket_accelerate_configuration.html) instead.
+* `acl` - (Optional, **Deprecated**) The [canned ACL](https://docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html#canned-acl) to apply. Valid values are `private`, `publicRead`, `publicReadWrite`, `awsExecRead`, `authenticatedRead`, and `logDeliveryWrite`. Defaults to `private`.  Conflicts with `grant`. Terraform will only perform drift detection if a configuration value is provided. Use the resource [`awsS3BucketAcl`](s3_bucket_acl.html.markdown) instead.
+* `grant` - (Optional, **Deprecated**) An [ACL policy grant](https://docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html#sample-acl). See [Grant](#grant) below for details. Conflicts with `acl`. Terraform will only perform drift detection if a configuration value is provided. Use the resource [`awsS3BucketAcl`](s3_bucket_acl.html.markdown) instead.
+* `corsRule` - (Optional, **Deprecated**) Rule of [Cross-Origin Resource Sharing](https://docs.aws.amazon.com/AmazonS3/latest/dev/cors.html). See [CORS rule](#cors-rule) below for details. Terraform will only perform drift detection if a configuration value is provided. Use the resource [`awsS3BucketCorsConfiguration`](s3_bucket_cors_configuration.html.markdown) instead.
+* `lifecycleRule` - (Optional, **Deprecated**) Configuration of [object lifecycle management](http://docs.aws.amazon.com/AmazonS3/latest/dev/object-lifecycle-mgmt.html). See [Lifecycle Rule](#lifecycle-rule) below for details. Terraform will only perform drift detection if a configuration value is provided.
+  Use the resource [`awsS3BucketLifecycleConfiguration`](s3_bucket_lifecycle_configuration.html) instead.
+* `logging` - (Optional, **Deprecated**) Configuration of [S3 bucket logging](https://docs.aws.amazon.com/AmazonS3/latest/UG/ManagingBucketLogging.html) parameters. See [Logging](#logging) below for details. Terraform will only perform drift detection if a configuration value is provided.
+  Use the resource [`awsS3BucketLogging`](s3_bucket_logging.html.markdown) instead.
+* `objectLockConfiguration` - (Optional, **Deprecated**) Configuration of [S3 object locking](https://docs.aws.amazon.com/AmazonS3/latest/dev/object-lock.html). See [Object Lock Configuration](#object-lock-configuration) below for details.
+  Terraform wil only perform drift detection if a configuration value is provided.
+  Use the `objectLockEnabled` parameter and the resource [`awsS3BucketObjectLockConfiguration`](s3_bucket_object_lock_configuration.html.markdown) instead.
+* `policy` - (Optional, **Deprecated**) Valid [bucket policy](https://docs.aws.amazon.com/AmazonS3/latest/dev/example-bucket-policies.html) JSON document. Note that if the policy document is not specific enough (but still valid), Terraform may view the policy as constantly changing in a `terraform plan`. In this case, please make sure you use the verbose/specific version of the policy. For more information about building AWS IAM policy documents with Terraform, see the [AWS IAM Policy Document Guide](https://learn.hashicorp.com/terraform/aws/iam-policy).
+  Terraform will only perform drift detection if a configuration value is provided.
+  Use the resource [`awsS3BucketPolicy`](s3_bucket_policy.html) instead.
+* `replicationConfiguration` - (Optional, **Deprecated**) Configuration of [replication configuration](http://docs.aws.amazon.com/AmazonS3/latest/dev/crr.html). See [Replication Configuration](#replication-configuration) below for details. Terraform will only perform drift detection if a configuration value is provided.
+  Use the resource [`awsS3BucketReplicationConfiguration`](s3_bucket_replication_configuration.html) instead.
+* `requestPayer` - (Optional, **Deprecated**) Specifies who should bear the cost of Amazon S3 data transfer.
+  Can be either `bucketOwner` or `requester`. By default, the owner of the S3 bucket would incur the costs of any data transfer.
+  See [Requester Pays Buckets](http://docs.aws.amazon.com/AmazonS3/latest/dev/RequesterPaysBuckets.html) developer guide for more information.
+  Terraform will only perform drift detection if a configuration value is provided.
+  Use the resource [`awsS3BucketRequestPaymentConfiguration`](s3_bucket_request_payment_configuration.html) instead.
+* `serverSideEncryptionConfiguration` - (Optional, **Deprecated**) Configuration of [server-side encryption configuration](http://docs.aws.amazon.com/AmazonS3/latest/dev/bucket-encryption.html). See [Server Side Encryption Configuration](#server-side-encryption-configuration) below for details.
+  Terraform will only perform drift detection if a configuration value is provided.
+  Use the resource [`awsS3BucketServerSideEncryptionConfiguration`](s3_bucket_server_side_encryption_configuration.html) instead.
+* `versioning` - (Optional, **Deprecated**) Configuration of the [S3 bucket versioning state](https://docs.aws.amazon.com/AmazonS3/latest/dev/Versioning.html). See [Versioning](#versioning) below for details. Terraform will only perform drift detection if a configuration value is provided. Use the resource [`awsS3BucketVersioning`](s3_bucket_versioning.html.markdown) instead.
+* `website` - (Optional, **Deprecated**) Configuration of the [S3 bucket website](https://docs.aws.amazon.com/AmazonS3/latest/userguide/WebsiteHosting.html). See [Website](#website) below for details. Terraform will only perform drift detection if a configuration value is provided.
+  Use the resource [`awsS3BucketWebsiteConfiguration`](s3_bucket_website_configuration.html.markdown) instead.
+
+### CORS Rule
+
+~> **NOTE:** Currently, changes to the `corsRule` configuration of *existing* resources cannot be automatically detected by Terraform. To manage changes of CORS rules to an S3 bucket, use the `awsS3BucketCorsConfiguration` resource instead. If you use `corsRule` on an `awsS3Bucket`, Terraform will assume management over the full set of CORS rules for the S3 bucket, treating additional CORS rules as drift. For this reason, `corsRule` cannot be mixed with the external `awsS3BucketCorsConfiguration` resource for a given S3 bucket.
+
+The `corsRule` configuration block supports the following arguments:
+
+* `allowedHeaders` - (Optional) List of headers allowed.
+* `allowedMethods` - (Required) One or more HTTP methods that you allow the origin to execute. Can be `get`, `put`, `post`, `delete` or `head`.
+* `allowedOrigins` - (Required) One or more origins you want customers to be able to access the bucket from.
+* `exposeHeaders` - (Optional) One or more headers in the response that you want customers to be able to access from their applications (for example, from a JavaScript `xmlHttpRequest` object).
+* `maxAgeSeconds` - (Optional) Specifies time in seconds that browser can cache the response for a preflight request.
+
+### Grant
+
+~> **NOTE:** Currently, changes to the `grant` configuration of *existing* resources cannot be automatically detected by Terraform. To manage changes of ACL grants to an S3 bucket, use the `awsS3BucketAcl` resource instead. If you use `grant` on an `awsS3Bucket`, Terraform will assume management over the full set of ACL grants for the S3 bucket, treating additional ACL grants as drift. For this reason, `grant` cannot be mixed with the external `awsS3BucketAcl` resource for a given S3 bucket.
+
+The `grant` configuration block supports the following arguments:
+
+* `id` - (Optional) Canonical user id to grant for. Used only when `type` is `canonicalUser`.
+* `type` - (Required) Type of grantee to apply for. Valid values are `canonicalUser` and `group`. `amazonCustomerByEmail` is not supported.
+* `permissions` - (Required) List of permissions to apply for grantee. Valid values are `read`, `write`, `readAcp`, `writeAcp`, `fullControl`.
+* `uri` - (Optional) Uri address to grant for. Used only when `type` is `group`.
+
+### Lifecycle Rule
+
+~> **NOTE:** Currently, changes to the `lifecycleRule` configuration of *existing* resources cannot be automatically detected by Terraform. To manage changes of Lifecycle rules to an S3 bucket, use the `awsS3BucketLifecycleConfiguration` resource instead. If you use `lifecycleRule` on an `awsS3Bucket`, Terraform will assume management over the full set of Lifecycle rules for the S3 bucket, treating additional Lifecycle rules as drift. For this reason, `lifecycleRule` cannot be mixed with the external `awsS3BucketLifecycleConfiguration` resource for a given S3 bucket.
+
+~> **NOTE:** At least one of `abortIncompleteMultipartUploadDays`, `expiration`, `transition`, `noncurrentVersionExpiration`, `noncurrentVersionTransition` must be specified.
+
+The `lifecycleRule` configuration block supports the following arguments:
+
+* `id` - (Optional) Unique identifier for the rule. Must be less than or equal to 255 characters in length.
+* `prefix` - (Optional) Object key prefix identifying one or more objects to which the rule applies.
+* `tags` - (Optional) Specifies object tags key and value.
+* `enabled` - (Required) Specifies lifecycle rule status.
+* `abortIncompleteMultipartUploadDays` (Optional) Specifies the number of days after initiating a multipart upload when the multipart upload must be completed.
+* `expiration` - (Optional) Specifies a period in the object's expire. See [Expiration](#expiration) below for details.
+* `transition` - (Optional) Specifies a period in the object's transitions. See [Transition](#transition) below for details.
+* `noncurrentVersionExpiration` - (Optional) Specifies when noncurrent object versions expire. See [Noncurrent Version Expiration](#noncurrent-version-expiration) below for details.
+* `noncurrentVersionTransition` - (Optional) Specifies when noncurrent object versions transitions. See [Noncurrent Version Transition](#noncurrent-version-transition) below for details.
+
+### Expiration
+
+The `expiration` configuration block supports the following arguments:
+
+* `date` - (Optional) Specifies the date after which you want the corresponding action to take effect.
+* `days` - (Optional) Specifies the number of days after object creation when the specific rule action takes effect.
+* `expiredObjectDeleteMarker` - (Optional) On a versioned bucket (versioning-enabled or versioning-suspended bucket), you can add this element in the lifecycle configuration to direct Amazon S3 to delete expired object delete markers. This cannot be specified with Days or Date in a Lifecycle Expiration Policy.
+
+### Transition
+
+The `transition` configuration block supports the following arguments:
+
+* `date` - (Optional) Specifies the date after which you want the corresponding action to take effect.
+* `days` - (Optional) Specifies the number of days after object creation when the specific rule action takes effect.
+* `storageClass` - (Required) Specifies the Amazon S3 [storage class](https://docs.aws.amazon.com/AmazonS3/latest/API/API_Transition.html#AmazonS3-Type-Transition-StorageClass) to which you want the object to transition.
+
+### Noncurrent Version Expiration
+
+The `noncurrentVersionExpiration` configuration block supports the following arguments:
+
+* `days` - (Required) Specifies the number of days noncurrent object versions expire.
+
+### Noncurrent Version Transition
+
+The `noncurrentVersionTransition` configuration supports the following arguments:
+
+* `days` - (Required) Specifies the number of days noncurrent object versions transition.
+* `storageClass` - (Required) Specifies the Amazon S3 [storage class](https://docs.aws.amazon.com/AmazonS3/latest/API/API_Transition.html#AmazonS3-Type-Transition-StorageClass) to which you want the object to transition.
+
+### Logging
+
+~> **NOTE:** Currently, changes to the `logging` configuration of *existing* resources cannot be automatically detected by Terraform. To manage changes of logging parameters to an S3 bucket, use the `awsS3BucketLogging` resource instead. If you use `logging` on an `awsS3Bucket`, Terraform will assume management over the full set of logging parameters for the S3 bucket, treating additional logging parameters as drift. For this reason, `logging` cannot be mixed with the external `awsS3BucketLogging` resource for a given S3 bucket.
+
+The `logging` configuration block supports the following arguments:
+
+* `targetBucket` - (Required) Name of the bucket that will receive the log objects.
+* `targetPrefix` - (Optional) To specify a key prefix for log objects.
+
+### Object Lock Configuration
+
+~> **NOTE:** You can only **enable** S3 Object Lock for **new** buckets. If you need to **enable** S3 Object Lock for an **existing** bucket, please contact AWS Support.
+When you create a bucket with S3 Object Lock enabled, Amazon S3 automatically enables versioning for the bucket.
+Once you create a bucket with S3 Object Lock enabled, you can't disable Object Lock or suspend versioning for the bucket.
+
+~> **NOTE:** Currently, changes to the `objectLockConfiguration` configuration of *existing* resources cannot be automatically detected by Terraform. To manage changes of Object Lock settings to an S3 bucket, use the `awsS3BucketObjectLockConfiguration` resource instead. If you use `objectLockConfiguration` on an `awsS3Bucket`, Terraform will assume management over the full set of Object Lock configuration parameters for the S3 bucket, treating additional Object Lock configuration parameters as drift. For this reason, `objectLockConfiguration` cannot be mixed with the external `awsS3BucketObjectLockConfiguration` resource for a given S3 bucket.
+
+The `objectLockConfiguration` configuration block supports the following arguments:
+
+* `objectLockEnabled` - (Optional, **Deprecated**) Indicates whether this bucket has an Object Lock configuration enabled. Valid value is `enabled`. Use the top-level argument `objectLockEnabled` instead.
+* `rule` - (Optional) Object Lock rule in place for this bucket ([documented below](#rule)).
+
+#### Rule
+
+The `rule` configuration block supports the following argument:
+
+* `defaultRetention` - (Required) Default retention period that you want to apply to new objects placed in this bucket ([documented below](#default-retention)).
+
+#### Default Retention
+
+The `defaultRetention` configuration block supports the following arguments:
+
+~> **NOTE:** Either `days` or `years` must be specified, but not both.
+
+* `mode` - (Required) Default Object Lock retention mode you want to apply to new objects placed in this bucket. Valid values are `governance` and `compliance`.
+* `days` - (Optional) Number of days that you want to specify for the default retention period.
+* `years` - (Optional) Number of years that you want to specify for the default retention period.
+
+### Replication Configuration
+
+~> **NOTE:** Currently, changes to the `replicationConfiguration` configuration of *existing* resources cannot be automatically detected by Terraform. To manage replication configuration changes to an S3 bucket, use the `awsS3BucketReplicationConfiguration` resource instead. If you use `replicationConfiguration` on an `awsS3Bucket`, Terraform will assume management over the full replication configuration for the S3 bucket, treating additional replication configuration rules as drift. For this reason, `replicationConfiguration` cannot be mixed with the external `awsS3BucketReplicationConfiguration` resource for a given S3 bucket.
+
+The `replicationConfiguration` configuration block supports the following arguments:
+
+* `role` - (Required) ARN of the IAM role for Amazon S3 to assume when replicating the objects.
+* `rules` - (Required) Specifies the rules managing the replication ([documented below](#rules)).
+
+#### Rules
+
+The `rules` configuration block supports the following arguments:
+
+~> **NOTE:** Amazon S3's latest version of the replication configuration is V2, which includes the `filter` attribute for replication rules.
+With the `filter` attribute, you can specify object filters based on the object key prefix, tags, or both to scope the objects that the rule applies to.
+Replication configuration V1 supports filtering based on only the `prefix` attribute. For backwards compatibility, Amazon S3 continues to support the V1 configuration.
+
+* `deleteMarkerReplicationStatus` - (Optional) Whether delete markers are replicated. The only valid value is `enabled`. To disable, omit this argument. This argument is only valid with V2 replication configurations (i.e., when `filter` is used).
+* `destination` - (Required) Specifies the destination for the rule ([documented below](#destination)).
+* `filter` - (Optional, Conflicts with `prefix`) Filter that identifies subset of objects to which the replication rule applies ([documented below](#filter)).
+* `id` - (Optional) Unique identifier for the rule. Must be less than or equal to 255 characters in length.
+* `prefix` - (Optional, Conflicts with `filter`) Object keyname prefix identifying one or more objects to which the rule applies. Must be less than or equal to 1024 characters in length.
+* `priority` - (Optional) Priority associated with the rule. Priority should only be set if `filter` is configured. If not provided, defaults to `0`. Priority must be unique between multiple rules.
+* `sourceSelectionCriteria` - (Optional) Specifies special object selection criteria ([documented below](#source-selection-criteria)).
+* `status` - (Required) Status of the rule. Either `enabled` or `disabled`. The rule is ignored if status is not Enabled.
+
+#### Filter
+
+The `filter` configuration block supports the following arguments:
+
+* `prefix` - (Optional) Object keyname prefix that identifies subset of objects to which the rule applies. Must be less than or equal to 1024 characters in length.
+* `tags` - (Optional)  A map of tags that identifies subset of objects to which the rule applies.
+  The rule applies only to objects having all the tags in its tagset.
+
+#### Destination
+
+~> **NOTE:** Replication to multiple destination buckets requires that `priority` is specified in the `rules` object. If the corresponding rule requires no filter, an empty configuration block `filter {}` must be specified.
+
+The `destination` configuration block supports the following arguments:
+
+* `bucket` - (Required) ARN of the S3 bucket where you want Amazon S3 to store replicas of the object identified by the rule.
+* `storageClass` - (Optional) The [storage class](https://docs.aws.amazon.com/AmazonS3/latest/API/API_Destination.html#AmazonS3-Type-Destination-StorageClass) used to store the object. By default, Amazon S3 uses the storage class of the source object to create the object replica.
+* `replicaKmsKeyId` - (Optional) Destination KMS encryption key ARN for SSE-KMS replication. Must be used in conjunction with
+  `sseKmsEncryptedObjects` source selection criteria.
+* `accessControlTranslation` - (Optional) Specifies the overrides to use for object owners on replication. Must be used in conjunction with `accountId` owner override configuration.
+* `accountId` - (Optional) Account ID to use for overriding the object owner on replication. Must be used in conjunction with `accessControlTranslation` override configuration.
+* `replicationTime` - (Optional) Enables S3 Replication Time Control (S3 RTC) ([documented below](#replication-time)).
+* `metrics` - (Optional) Enables replication metrics (required for S3 RTC) ([documented below](#metrics)).
+
+#### Replication Time
+
+The `replicationTime` configuration block supports the following arguments:
+
+* `status` - (Optional) Status of RTC. Either `enabled` or `disabled`.
+* `minutes` - (Optional) Threshold within which objects are to be replicated. The only valid value is `15`.
+
+#### Metrics
+
+The `metrics` configuration block supports the following arguments:
+
+* `status` - (Optional) Status of replication metrics. Either `enabled` or `disabled`.
+* `minutes` - (Optional) Threshold within which objects are to be replicated. The only valid value is `15`.
+
+#### Source Selection Criteria
+
+The `sourceSelectionCriteria` configuration block supports the following argument:
+
+* `sseKmsEncryptedObjects` - (Optional) Match SSE-KMS encrypted objects ([documented below](#sse-kms-encrypted-objects)). If specified, `replicaKmsKeyId`
+  in `destination` must be specified as well.
+
+#### SSE KMS Encrypted Objects
+
+The `sseKmsEncryptedObjects` configuration block supports the following argument:
+
+* `enabled` - (Required) Boolean which indicates if this criteria is enabled.
+
+### Server Side Encryption Configuration
+
+~> **NOTE:** Currently, changes to the `serverSideEncryptionConfiguration` configuration of *existing* resources cannot be automatically detected by Terraform. To manage changes in encryption of an S3 bucket, use the `awsS3BucketServerSideEncryptionConfiguration` resource instead. If you use `serverSideEncryptionConfiguration` on an `awsS3Bucket`, Terraform will assume management over the encryption configuration for the S3 bucket, treating additional encryption changes as drift. For this reason, `serverSideEncryptionConfiguration` cannot be mixed with the external `awsS3BucketServerSideEncryptionConfiguration` resource for a given S3 bucket.
+
+The `serverSideEncryptionConfiguration` configuration block supports the following argument:
+
+* `rule` - (Required) Single object for server-side encryption by default configuration. (documented below)
+
+The `rule` configuration block supports the following arguments:
+
+* `applyServerSideEncryptionByDefault` - (Required) Single object for setting server-side encryption by default. (documented below)
+* `bucketKeyEnabled` - (Optional) Whether or not to use [Amazon S3 Bucket Keys](https://docs.aws.amazon.com/AmazonS3/latest/dev/bucket-key.html) for SSE-KMS.
+
+The `applyServerSideEncryptionByDefault` configuration block supports the following arguments:
+
+* `sseAlgorithm` - (Required) Server-side encryption algorithm to use. Valid values are `aes256` and `aws:kms`
+* `kmsMasterKeyId` - (Optional) AWS KMS master key ID used for the SSE-KMS encryption. This can only be used when you set the value of `sseAlgorithm` as `aws:kms`. The default `aws/s3` AWS KMS master key is used if this element is absent while the `sseAlgorithm` is `aws:kms`.
+
+### Versioning
+
+~> **NOTE:** Currently, changes to the `versioning` configuration of *existing* resources cannot be automatically detected by Terraform. To manage changes of versioning state to an S3 bucket, use the `awsS3BucketVersioning` resource instead. If you use `versioning` on an `awsS3Bucket`, Terraform will assume management over the versioning state of the S3 bucket, treating additional versioning state changes as drift. For this reason, `versioning` cannot be mixed with the external `awsS3BucketVersioning` resource for a given S3 bucket.
+
+The `versioning` configuration block supports the following arguments:
+
+* `enabled` - (Optional) Enable versioning. Once you version-enable a bucket, it can never return to an unversioned state. You can, however, suspend versioning on that bucket.
+* `mfaDelete` - (Optional) Enable MFA delete for either `Change the versioning state of your bucket` or `Permanently delete an object version`. Default is `false`. This cannot be used to toggle this setting but is available to allow managed buckets to reflect the state in AWS
+
+### Website
+
+~> **NOTE:** Currently, changes to the `website` configuration of *existing* resources cannot be automatically detected by Terraform. To manage changes to the website configuration of an S3 bucket, use the `awsS3BucketWebsiteConfiguration` resource instead. If you use `website` on an `awsS3Bucket`, Terraform will assume management over the configuration of the website of the S3 bucket, treating additional website configuration changes as drift. For this reason, `website` cannot be mixed with the external `awsS3BucketWebsiteConfiguration` resource for a given S3 bucket.
+
+The `website` configuration block supports the following arguments:
+
+* `indexDocument` - (Required, unless using `redirectAllRequestsTo`) Amazon S3 returns this index document when requests are made to the root domain or any of the subfolders.
+* `errorDocument` - (Optional) Absolute path to the document to return in case of a 4XX error.
+* `redirectAllRequestsTo` - (Optional) Hostname to redirect all website requests for this bucket to. Hostname can optionally be prefixed with a protocol (`http://` or `https://`) to use when redirecting requests. The default is the protocol that is used in the original request.
+* `routingRules` - (Optional) JSON array containing [routing rules](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-s3-websiteconfiguration-routingrules.html)
+  describing redirect behavior and when redirects are applied.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Name of the bucket.
+* `arn` - ARN of the bucket. Will be of format `arn:aws:s3:::bucketname`.
+* `bucketDomainName` - Bucket domain name. Will be of format `bucketnameS3AmazonawsCom`.
+* `bucketRegionalDomainName` - The bucket region-specific domain name. The bucket domain name including the region name. Please refer to the [S3 endpoints reference](https://docs.aws.amazon.com/general/latest/gr/s3.html#s3_region) for format. Note: AWS CloudFront allows specifying an S3 region-specific endpoint when creating an S3 origin. This will prevent redirect issues from CloudFront to the S3 Origin URL. For more information, see the [Virtual Hosted-Style Requests for Other Regions](https://docs.aws.amazon.com/AmazonS3/latest/userguide/VirtualHosting.html#deprecated-global-endpoint) section in the AWS S3 User Guide.
+* `hostedZoneId` - [Route 53 Hosted Zone ID](https://docs.aws.amazon.com/general/latest/gr/rande.html#s3_website_region_endpoints) for this bucket's region.
+* `region` - AWS region this bucket resides in.
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `websiteEndpoint` - (**Deprecated**) Website endpoint, if the bucket is configured with a website. If not, this will be an empty string. Use the resource [`awsS3BucketWebsiteConfiguration`](s3_bucket_website_configuration.html.markdown) instead.
+* `websiteDomain` - (**Deprecated**) Domain of the website endpoint, if the bucket is configured with a website. If not, this will be an empty string. This is used to create Route 53 alias records. Use the resource [`awsS3BucketWebsiteConfiguration`](s3_bucket_website_configuration.html.markdown) instead.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `20M`)
+- `read` - (Default `20M`)
+- `update` - (Default `20M`)
+- `delete` - (Default `60M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import S3 bucket using the `bucket`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import S3 bucket using the `bucket`. For example:
+
+```console
+% terraform import aws_s3_bucket.bucket bucket-name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-23efd238c67c3da85ca9dd5d54b26a2bc3bb62edb2ea9528d1db9a9d3e044ad2 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/s3_bucket_accelerate_configuration.html.markdown b/website/docs/cdktf/typescript/r/s3_bucket_accelerate_configuration.html.markdown
new file mode 100644
index 00000000000..a99de5e8aea
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/s3_bucket_accelerate_configuration.html.markdown
@@ -0,0 +1,102 @@
+---
+subcategory: "S3 (Simple Storage)"
+layout: "aws"
+page_title: "AWS: aws_s3_bucket_accelerate_configuration"
+description: |-
+  Provides an S3 bucket accelerate configuration resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_s3_bucket_accelerate_configuration
+
+Provides an S3 bucket accelerate configuration resource. See the [Requirements for using Transfer Acceleration](https://docs.aws.amazon.com/AmazonS3/latest/userguide/transfer-acceleration.html#transfer-acceleration-requirements) for more details.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketAccelerateConfiguration } from "./.gen/providers/aws/s3-bucket-accelerate-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const mybucket = new S3Bucket(this, "mybucket", {
+      bucket: "mybucket",
+    });
+    new S3BucketAccelerateConfiguration(this, "example", {
+      bucket: mybucket.id,
+      status: "Enabled",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `bucket` - (Required, Forces new resource) Name of the bucket.
+* `expectedBucketOwner` - (Optional, Forces new resource) Account ID of the expected bucket owner.
+* `status` - (Required) Transfer acceleration state of the bucket. Valid values: `enabled`, `suspended`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The `bucket` or `bucket` and `expectedBucketOwner` separated by a comma (`,`) if the latter is provided.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import S3 bucket accelerate configuration using the `bucket` or using the `bucket` and `expectedBucketOwner` separated by a comma (`,`). For example:
+
+If the owner (account ID) of the source bucket is the same account used to configure the Terraform AWS Provider, import using the `bucket`:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+If the owner (account ID) of the source bucket differs from the account used to configure the Terraform AWS Provider, import using the `bucket` and `expectedBucketOwner` separated by a comma (`,`):
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+**Using `terraform import` to import.** For example:
+
+If the owner (account ID) of the source bucket is the same account used to configure the Terraform AWS Provider, import using the `bucket`:
+
+```console
+% terraform import aws_s3_bucket_accelerate_configuration.example bucket-name
+```
+
+If the owner (account ID) of the source bucket differs from the account used to configure the Terraform AWS Provider, import using the `bucket` and `expectedBucketOwner` separated by a comma (`,`):
+
+```console
+% terraform import aws_s3_bucket_accelerate_configuration.example bucket-name,123456789012
+```
+
+<!-- cache-key: cdktf-0.18.0 input-d5969f8a31c3a0cabfdc95aa5af8e4294acf1e21e3704ef66fc529acc0c176b8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/s3_bucket_acl.html.markdown b/website/docs/cdktf/typescript/r/s3_bucket_acl.html.markdown
new file mode 100644
index 00000000000..7dfaf3ef29a
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/s3_bucket_acl.html.markdown
@@ -0,0 +1,327 @@
+---
+subcategory: "S3 (Simple Storage)"
+layout: "aws"
+page_title: "AWS: aws_s3_bucket_acl"
+description: |-
+  Provides an S3 bucket ACL resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_s3_bucket_acl
+
+Provides an S3 bucket ACL resource.
+
+~> **Note:** `terraform destroy` does not delete the S3 Bucket ACL but does remove the resource from Terraform state.
+
+## Example Usage
+
+### With `private` ACL
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketAcl } from "./.gen/providers/aws/s3-bucket-acl";
+import { S3BucketOwnershipControls } from "./.gen/providers/aws/s3-bucket-ownership-controls";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new S3Bucket(this, "example", {
+      bucket: "my-tf-example-bucket",
+    });
+    const awsS3BucketOwnershipControlsExample = new S3BucketOwnershipControls(
+      this,
+      "example_1",
+      {
+        bucket: example.id,
+        rule: {
+          objectOwnership: "BucketOwnerPreferred",
+        },
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketOwnershipControlsExample.overrideLogicalId("example");
+    const awsS3BucketAclExample = new S3BucketAcl(this, "example_2", {
+      acl: "private",
+      bucket: example.id,
+      dependsOn: [awsS3BucketOwnershipControlsExample],
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketAclExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### With `publicRead` ACL
+
+-> This example explicitly disables the default S3 bucket security settings. This
+should be done with caution, as all bucket objects become publicly exposed.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketAcl } from "./.gen/providers/aws/s3-bucket-acl";
+import { S3BucketOwnershipControls } from "./.gen/providers/aws/s3-bucket-ownership-controls";
+import { S3BucketPublicAccessBlock } from "./.gen/providers/aws/s3-bucket-public-access-block";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new S3Bucket(this, "example", {
+      bucket: "my-tf-example-bucket",
+    });
+    const awsS3BucketOwnershipControlsExample = new S3BucketOwnershipControls(
+      this,
+      "example_1",
+      {
+        bucket: example.id,
+        rule: {
+          objectOwnership: "BucketOwnerPreferred",
+        },
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketOwnershipControlsExample.overrideLogicalId("example");
+    const awsS3BucketPublicAccessBlockExample = new S3BucketPublicAccessBlock(
+      this,
+      "example_2",
+      {
+        blockPublicAcls: false,
+        blockPublicPolicy: false,
+        bucket: example.id,
+        ignorePublicAcls: false,
+        restrictPublicBuckets: false,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketPublicAccessBlockExample.overrideLogicalId("example");
+    const awsS3BucketAclExample = new S3BucketAcl(this, "example_3", {
+      acl: "public-read",
+      bucket: example.id,
+      dependsOn: [
+        awsS3BucketOwnershipControlsExample,
+        awsS3BucketPublicAccessBlockExample,
+      ],
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketAclExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### With Grants
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCanonicalUserId } from "./.gen/providers/aws/data-aws-canonical-user-id";
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketAcl } from "./.gen/providers/aws/s3-bucket-acl";
+import { S3BucketOwnershipControls } from "./.gen/providers/aws/s3-bucket-ownership-controls";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new S3Bucket(this, "example", {
+      bucket: "my-tf-example-bucket",
+    });
+    const awsS3BucketOwnershipControlsExample = new S3BucketOwnershipControls(
+      this,
+      "example_1",
+      {
+        bucket: example.id,
+        rule: {
+          objectOwnership: "BucketOwnerPreferred",
+        },
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketOwnershipControlsExample.overrideLogicalId("example");
+    const current = new DataAwsCanonicalUserId(this, "current", {});
+    const awsS3BucketAclExample = new S3BucketAcl(this, "example_3", {
+      accessControlPolicy: {
+        grant: [
+          {
+            grantee: {
+              id: Token.asString(current.id),
+              type: "CanonicalUser",
+            },
+            permission: "READ",
+          },
+          {
+            grantee: {
+              type: "Group",
+              uri: "http://acs.amazonaws.com/groups/s3/LogDelivery",
+            },
+            permission: "READ_ACP",
+          },
+        ],
+        owner: {
+          id: Token.asString(current.id),
+        },
+      },
+      bucket: example.id,
+      dependsOn: [awsS3BucketOwnershipControlsExample],
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketAclExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `acl` - (Optional, Conflicts with `accessControlPolicy`) Canned ACL to apply to the bucket.
+* `accessControlPolicy` - (Optional, Conflicts with `acl`) Configuration block that sets the ACL permissions for an object per grantee. [See below](#access_control_policy).
+* `bucket` - (Required, Forces new resource) Name of the bucket.
+* `expectedBucketOwner` - (Optional, Forces new resource) Account ID of the expected bucket owner.
+
+### access_control_policy
+
+The `accessControlPolicy` configuration block supports the following arguments:
+
+* `grant` - (Required) Set of `grant` configuration blocks. [See below](#grant).
+* `owner` - (Required) Configuration block of the bucket owner's display name and ID. [See below](#owner).
+
+### grant
+
+The `grant` configuration block supports the following arguments:
+
+* `grantee` - (Required) Configuration block for the person being granted permissions. [See below](#grantee).
+* `permission` - (Required) Logging permissions assigned to the grantee for the bucket.
+
+### owner
+
+The `owner` configuration block supports the following arguments:
+
+* `id` - (Required) ID of the owner.
+* `displayName` - (Optional) Display name of the owner.
+
+### grantee
+
+The `grantee` configuration block supports the following arguments:
+
+* `emailAddress` - (Optional) Email address of the grantee. See [Regions and Endpoints](https://docs.aws.amazon.com/general/latest/gr/rande.html#s3_region) for supported AWS regions where this argument can be specified.
+* `id` - (Optional) Canonical user ID of the grantee.
+* `type` - (Required) Type of grantee. Valid values: `canonicalUser`, `amazonCustomerByEmail`, `group`.
+* `uri` - (Optional) URI of the grantee group.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The `bucket`, `expectedBucketOwner` (if configured), and `acl` (if configured) separated by commas (`,`).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import S3 bucket ACL using `bucket`, `expectedBucketOwner`, and/or `acl`, depending on your situation. For example:
+
+If the owner (account ID) of the source bucket is the _same_ account used to configure the Terraform AWS Provider, and the source bucket is **not configured** with a
+[canned ACL][1] (i.e. predefined grant), import using the `bucket`:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+If the owner (account ID) of the source bucket is the _same_ account used to configure the Terraform AWS Provider, and the source bucket is **configured** with a
+[canned ACL][1] (i.e. predefined grant), import using the `bucket` and `acl` separated by a comma (`,`):
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+If the owner (account ID) of the source bucket _differs_ from the account used to configure the Terraform AWS Provider, and the source bucket is **not configured** with a [canned ACL][1] (i.e. predefined grant), imported using the `bucket` and `expectedBucketOwner` separated by a comma (`,`):
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+If the owner (account ID) of the source bucket _differs_ from the account used to configure the Terraform AWS Provider, and the source bucket is **configured** with a
+[canned ACL][1] (i.e. predefined grant), imported using the `bucket`, `expectedBucketOwner`, and `acl` separated by commas (`,`):
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+**Using `terraform import` to import** using `bucket`, `expectedBucketOwner`, and/or `acl`, depending on your situation. For example:
+
+If the owner (account ID) of the source bucket is the _same_ account used to configure the Terraform AWS Provider, and the source bucket is **not configured** with a
+[canned ACL][1] (i.e. predefined grant), import using the `bucket`:
+
+```console
+% terraform import aws_s3_bucket_acl.example bucket-name
+```
+
+If the owner (account ID) of the source bucket is the _same_ account used to configure the Terraform AWS Provider, and the source bucket is **configured** with a [canned ACL][1] (i.e. predefined grant), import using the `bucket` and `acl` separated by a comma (`,`):
+
+```console
+% terraform import aws_s3_bucket_acl.example bucket-name,private
+```
+
+If the owner (account ID) of the source bucket _differs_ from the account used to configure the Terraform AWS Provider, and the source bucket is **not configured** with a [canned ACL][1] (i.e. predefined grant), imported using the `bucket` and `expectedBucketOwner` separated by a comma (`,`):
+
+```console
+% terraform import aws_s3_bucket_acl.example bucket-name,123456789012
+```
+
+If the owner (account ID) of the source bucket _differs_ from the account used to configure the Terraform AWS Provider, and the source bucket is **configured** with a [canned ACL][1] (i.e. predefined grant), imported using the `bucket`, `expectedBucketOwner`, and `acl` separated by commas (`,`):
+
+```console
+% terraform import aws_s3_bucket_acl.example bucket-name,123456789012,private
+```
+
+[1]: https://docs.aws.amazon.com/AmazonS3/latest/userguide/acl-overview.html#canned-acl
+
+<!-- cache-key: cdktf-0.18.0 input-7e8c0c7d553a8dc18f376cb79615d94086a2767d34d0f7c570f4a8267a6021d2 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/s3_bucket_analytics_configuration.html.markdown b/website/docs/cdktf/typescript/r/s3_bucket_analytics_configuration.html.markdown
new file mode 100644
index 00000000000..21a397dc041
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/s3_bucket_analytics_configuration.html.markdown
@@ -0,0 +1,150 @@
+---
+subcategory: "S3 (Simple Storage)"
+layout: "aws"
+page_title: "AWS: aws_s3_bucket_analytics_configuration"
+description: |-
+  Provides a S3 bucket analytics configuration resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_s3_bucket_analytics_configuration
+
+Provides a S3 bucket [analytics configuration](https://docs.aws.amazon.com/AmazonS3/latest/dev/analytics-storage-class.html) resource.
+
+## Example Usage
+
+### Add analytics configuration for entire S3 bucket and export results to a second S3 bucket
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketAnalyticsConfiguration } from "./.gen/providers/aws/s3-bucket-analytics-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const analytics = new S3Bucket(this, "analytics", {
+      bucket: "analytics destination",
+    });
+    const example = new S3Bucket(this, "example", {
+      bucket: "example",
+    });
+    new S3BucketAnalyticsConfiguration(this, "example-entire-bucket", {
+      bucket: example.id,
+      name: "EntireBucket",
+      storageClassAnalysis: {
+        dataExport: {
+          destination: {
+            s3BucketDestination: {
+              bucketArn: analytics.arn,
+            },
+          },
+        },
+      },
+    });
+  }
+}
+
+```
+
+### Add analytics configuration with S3 object filter
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketAnalyticsConfiguration } from "./.gen/providers/aws/s3-bucket-analytics-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new S3Bucket(this, "example", {
+      bucket: "example",
+    });
+    new S3BucketAnalyticsConfiguration(this, "example-filtered", {
+      bucket: example.id,
+      filter: {
+        prefix: "documents/",
+        tags: {
+          class: "blue",
+          priority: "high",
+        },
+      },
+      name: "ImportantBlueDocuments",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `bucket` - (Required) Name of the bucket this analytics configuration is associated with.
+* `name` - (Required) Unique identifier of the analytics configuration for the bucket.
+* `filter` - (Optional) Object filtering that accepts a prefix, tags, or a logical AND of prefix and tags (documented below).
+* `storageClassAnalysis` - (Optional) Configuration for the analytics data export (documented below).
+
+The `filter` configuration supports the following:
+
+* `prefix` - (Optional) Object prefix for filtering.
+* `tags` - (Optional) Set of object tags for filtering.
+
+The `storageClassAnalysis` configuration supports the following:
+
+* `dataExport` - (Required) Data export configuration (documented below).
+
+The `dataExport` configuration supports the following:
+
+* `outputSchemaVersion` - (Optional) Schema version of exported analytics data. Allowed values: `v1`. Default value: `v1`.
+* `destination` - (Required) Specifies the destination for the exported analytics data (documented below).
+
+The `destination` configuration supports the following:
+
+* `s3BucketDestination` - (Required) Analytics data export currently only supports an S3 bucket destination (documented below).
+
+The `s3BucketDestination` configuration supports the following:
+
+* `bucketArn` - (Required) ARN of the destination bucket.
+* `bucketAccountId` - (Optional) Account ID that owns the destination bucket.
+* `format` - (Optional) Output format of exported analytics data. Allowed values: `csv`. Default value: `csv`.
+* `prefix` - (Optional) Prefix to append to exported analytics data.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import S3 bucket analytics configurations using `bucket:analytics`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import S3 bucket analytics configurations using `bucket:analytics`. For example:
+
+```console
+% terraform import aws_s3_bucket_analytics_configuration.my-bucket-entire-bucket my-bucket:EntireBucket
+```
+
+<!-- cache-key: cdktf-0.18.0 input-e6e60be173d72b9dbbe3cb220b8b14c97464931aea892e1e32c68720b8bf5012 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/s3_bucket_cors_configuration.html.markdown b/website/docs/cdktf/typescript/r/s3_bucket_cors_configuration.html.markdown
new file mode 100644
index 00000000000..961774bd060
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/s3_bucket_cors_configuration.html.markdown
@@ -0,0 +1,133 @@
+---
+subcategory: "S3 (Simple Storage)"
+layout: "aws"
+page_title: "AWS: aws_s3_bucket_cors_configuration"
+description: |-
+  Provides an S3 bucket CORS configuration resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_s3_bucket_cors_configuration
+
+Provides an S3 bucket CORS configuration resource. For more information about CORS, go to [Enabling Cross-Origin Resource Sharing](https://docs.aws.amazon.com/AmazonS3/latest/userguide/cors.html) in the Amazon S3 User Guide.
+
+~> **NOTE:** S3 Buckets only support a single CORS configuration. Declaring multiple `awsS3BucketCorsConfiguration` resources to the same S3 Bucket will cause a perpetual difference in configuration.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketCorsConfiguration } from "./.gen/providers/aws/s3-bucket-cors-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new S3Bucket(this, "example", {
+      bucket: "mybucket",
+    });
+    const awsS3BucketCorsConfigurationExample = new S3BucketCorsConfiguration(
+      this,
+      "example_1",
+      {
+        bucket: example.id,
+        corsRule: [
+          {
+            allowedHeaders: ["*"],
+            allowedMethods: ["PUT", "POST"],
+            allowedOrigins: ["https://s3-website-test.hashicorp.com"],
+            exposeHeaders: ["ETag"],
+            maxAgeSeconds: 3000,
+          },
+          {
+            allowedMethods: ["GET"],
+            allowedOrigins: ["*"],
+          },
+        ],
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketCorsConfigurationExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `bucket` - (Required, Forces new resource) Name of the bucket.
+* `expectedBucketOwner` - (Optional, Forces new resource) Account ID of the expected bucket owner.
+* `corsRule` - (Required) Set of origins and methods (cross-origin access that you want to allow). [See below](#cors_rule). You can configure up to 100 rules.
+
+### cors_rule
+
+The `corsRule` configuration block supports the following arguments:
+
+* `allowedHeaders` - (Optional) Set of Headers that are specified in the `accessControlRequestHeaders` header.
+* `allowedMethods` - (Required) Set of HTTP methods that you allow the origin to execute. Valid values are `get`, `put`, `head`, `post`, and `delete`.
+* `allowedOrigins` - (Required) Set of origins you want customers to be able to access the bucket from.
+* `exposeHeaders` - (Optional) Set of headers in the response that you want customers to be able to access from their applications (for example, from a JavaScript `xmlHttpRequest` object).
+* `id` - (Optional) Unique identifier for the rule. The value cannot be longer than 255 characters.
+* `maxAgeSeconds` - (Optional) Time in seconds that your browser is to cache the preflight response for the specified resource.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The `bucket` or `bucket` and `expectedBucketOwner` separated by a comma (`,`) if the latter is provided.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import S3 bucket CORS configuration using the `bucket` or using the `bucket` and `expectedBucketOwner` separated by a comma (`,`). For example:
+
+If the owner (account ID) of the source bucket is the same account used to configure the Terraform AWS Provider, import using the `bucket`:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+If the owner (account ID) of the source bucket differs from the account used to configure the Terraform AWS Provider, import using the `bucket` and `expectedBucketOwner` separated by a comma (`,`):
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+**Using `terraform import` to import** S3 bucket CORS configuration using the `bucket` or using the `bucket` and `expectedBucketOwner` separated by a comma (`,`). For example:
+
+If the owner (account ID) of the source bucket is the same account used to configure the Terraform AWS Provider, import using the `bucket`:
+
+```console
+% terraform import aws_s3_bucket_cors_configuration.example bucket-name
+```
+
+If the owner (account ID) of the source bucket differs from the account used to configure the Terraform AWS Provider, import using the `bucket` and `expectedBucketOwner` separated by a comma (`,`):
+
+```console
+% terraform import aws_s3_bucket_cors_configuration.example bucket-name,123456789012
+```
+
+<!-- cache-key: cdktf-0.18.0 input-c6297f41c25d6847931e27891b8cdabf38a1ff8d7e24e15087330868928e32e8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/s3_bucket_intelligent_tiering_configuration.html.markdown b/website/docs/cdktf/typescript/r/s3_bucket_intelligent_tiering_configuration.html.markdown
new file mode 100644
index 00000000000..53c27adb9da
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/s3_bucket_intelligent_tiering_configuration.html.markdown
@@ -0,0 +1,141 @@
+---
+subcategory: "S3 (Simple Storage)"
+layout: "aws"
+page_title: "AWS: aws_s3_bucket_intelligent_tiering_configuration"
+description: |-
+  Provides an S3 Intelligent-Tiering configuration resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_s3_bucket_intelligent_tiering_configuration
+
+Provides an [S3 Intelligent-Tiering](https://docs.aws.amazon.com/AmazonS3/latest/userguide/intelligent-tiering.html) configuration resource.
+
+## Example Usage
+
+### Add intelligent tiering configuration for entire S3 bucket
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketIntelligentTieringConfiguration } from "./.gen/providers/aws/s3-bucket-intelligent-tiering-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new S3Bucket(this, "example", {
+      bucket: "example",
+    });
+    new S3BucketIntelligentTieringConfiguration(this, "example-entire-bucket", {
+      bucket: example.id,
+      name: "EntireBucket",
+      tiering: [
+        {
+          accessTier: "DEEP_ARCHIVE_ACCESS",
+          days: 180,
+        },
+        {
+          accessTier: "ARCHIVE_ACCESS",
+          days: 125,
+        },
+      ],
+    });
+  }
+}
+
+```
+
+### Add intelligent tiering configuration with S3 object filter
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketIntelligentTieringConfiguration } from "./.gen/providers/aws/s3-bucket-intelligent-tiering-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new S3Bucket(this, "example", {
+      bucket: "example",
+    });
+    new S3BucketIntelligentTieringConfiguration(this, "example-filtered", {
+      bucket: example.id,
+      filter: {
+        prefix: "documents/",
+        tags: {
+          class: "blue",
+          priority: "high",
+        },
+      },
+      name: "ImportantBlueDocuments",
+      status: "Disabled",
+      tiering: [
+        {
+          accessTier: "ARCHIVE_ACCESS",
+          days: 125,
+        },
+      ],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `bucket` - (Required) Name of the bucket this intelligent tiering configuration is associated with.
+* `name` - (Required) Unique name used to identify the S3 Intelligent-Tiering configuration for the bucket.
+* `status` - (Optional) Specifies the status of the configuration. Valid values: `enabled`, `disabled`.
+* `filter` - (Optional) Bucket filter. The configuration only includes objects that meet the filter's criteria (documented below).
+* `tiering` - (Required) S3 Intelligent-Tiering storage class tiers of the configuration (documented below).
+
+The `filter` configuration supports the following:
+
+* `prefix` - (Optional) Object key name prefix that identifies the subset of objects to which the configuration applies.
+* `tags` - (Optional) All of these tags must exist in the object's tag set in order for the configuration to apply.
+
+The `tiering` configuration supports the following:
+
+* `accessTier` - (Required) S3 Intelligent-Tiering access tier. Valid values: `archiveAccess`, `deepArchiveAccess`.
+* `days` - (Required) Number of consecutive days of no access after which an object will be eligible to be transitioned to the corresponding tier.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import S3 bucket intelligent tiering configurations using `bucket:name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import S3 bucket intelligent tiering configurations using `bucket:name`. For example:
+
+```console
+% terraform import aws_s3_bucket_intelligent_tiering_configuration.my-bucket-entire-bucket my-bucket:EntireBucket
+```
+
+<!-- cache-key: cdktf-0.18.0 input-b6b169e601dae3b6976c4585bd3676643529f574da01b5ad3983daea051c81f0 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/s3_bucket_inventory.html.markdown b/website/docs/cdktf/typescript/r/s3_bucket_inventory.html.markdown
new file mode 100644
index 00000000000..43b87f3ea15
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/s3_bucket_inventory.html.markdown
@@ -0,0 +1,171 @@
+---
+subcategory: "S3 (Simple Storage)"
+layout: "aws"
+page_title: "AWS: aws_s3_bucket_inventory"
+description: |-
+  Provides a S3 bucket inventory configuration resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_s3_bucket_inventory
+
+Provides a S3 bucket [inventory configuration](https://docs.aws.amazon.com/AmazonS3/latest/dev/storage-inventory.html) resource.
+
+## Example Usage
+
+### Add inventory configuration
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketInventory } from "./.gen/providers/aws/s3-bucket-inventory";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const inventory = new S3Bucket(this, "inventory", {
+      bucket: "my-tf-inventory-bucket",
+    });
+    const test = new S3Bucket(this, "test", {
+      bucket: "my-tf-test-bucket",
+    });
+    const awsS3BucketInventoryTest = new S3BucketInventory(this, "test_2", {
+      bucket: test.id,
+      destination: {
+        bucket: {
+          bucketArn: inventory.arn,
+          format: "ORC",
+        },
+      },
+      includedObjectVersions: "All",
+      name: "EntireBucketDaily",
+      schedule: {
+        frequency: "Daily",
+      },
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketInventoryTest.overrideLogicalId("test");
+  }
+}
+
+```
+
+### Add inventory configuration with S3 object prefix
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketInventory } from "./.gen/providers/aws/s3-bucket-inventory";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const inventory = new S3Bucket(this, "inventory", {
+      bucket: "my-tf-inventory-bucket",
+    });
+    const test = new S3Bucket(this, "test", {
+      bucket: "my-tf-test-bucket",
+    });
+    new S3BucketInventory(this, "test-prefix", {
+      bucket: test.id,
+      destination: {
+        bucket: {
+          bucketArn: inventory.arn,
+          format: "ORC",
+          prefix: "inventory",
+        },
+      },
+      filter: {
+        prefix: "documents/",
+      },
+      includedObjectVersions: "All",
+      name: "DocumentsWeekly",
+      schedule: {
+        frequency: "Daily",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `bucket` - (Required) Name of the source bucket that inventory lists the objects for.
+* `name` - (Required) Unique identifier of the inventory configuration for the bucket.
+* `includedObjectVersions` - (Required) Object versions to include in the inventory list. Valid values: `all`, `current`.
+* `schedule` - (Required) Specifies the schedule for generating inventory results (documented below).
+* `destination` - (Required) Contains information about where to publish the inventory results (documented below).
+* `enabled` - (Optional, Default: `true`) Specifies whether the inventory is enabled or disabled.
+* `filter` - (Optional) Specifies an inventory filter. The inventory only includes objects that meet the filter's criteria (documented below).
+* `optionalFields` - (Optional) List of optional fields that are included in the inventory results. Please refer to the S3 [documentation](https://docs.aws.amazon.com/AmazonS3/latest/API/API_InventoryConfiguration.html#AmazonS3-Type-InventoryConfiguration-OptionalFields) for more details.
+
+The `filter` configuration supports the following:
+
+* `prefix` - (Optional) Prefix that an object must have to be included in the inventory results.
+
+The `schedule` configuration supports the following:
+
+* `frequency` - (Required) Specifies how frequently inventory results are produced. Valid values: `daily`, `weekly`.
+
+The `destination` configuration supports the following:
+
+* `bucket` - (Required) S3 bucket configuration where inventory results are published (documented below).
+
+The `bucket` configuration supports the following:
+
+* `bucketArn` - (Required) Amazon S3 bucket ARN of the destination.
+* `format` - (Required) Specifies the output format of the inventory results. Can be `csv`, [`orc`](https://orc.apache.org/) or [`parquet`](https://parquet.apache.org/).
+* `accountId` - (Optional) ID of the account that owns the destination bucket. Recommended to be set to prevent problems if the destination bucket ownership changes.
+* `prefix` - (Optional) Prefix that is prepended to all inventory results.
+* `encryption` - (Optional) Contains the type of server-side encryption to use to encrypt the inventory (documented below).
+
+The `encryption` configuration supports the following:
+
+* `sseKms` - (Optional) Specifies to use server-side encryption with AWS KMS-managed keys to encrypt the inventory file (documented below).
+* `sseS3` - (Optional) Specifies to use server-side encryption with Amazon S3-managed keys (SSE-S3) to encrypt the inventory file.
+
+The `sseKms` configuration supports the following:
+
+* `keyId` - (Required) ARN of the KMS customer master key (CMK) used to encrypt the inventory file.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import S3 bucket inventory configurations using `bucket:inventory`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import S3 bucket inventory configurations using `bucket:inventory`. For example:
+
+```console
+% terraform import aws_s3_bucket_inventory.my-bucket-entire-bucket my-bucket:EntireBucket
+```
+
+<!-- cache-key: cdktf-0.18.0 input-b32aad34f97db0c4f5b57fbaab467ab8861aa26c814563550d6c606734ebbc3c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/s3_bucket_lifecycle_configuration.html.markdown b/website/docs/cdktf/typescript/r/s3_bucket_lifecycle_configuration.html.markdown
new file mode 100644
index 00000000000..75ad251bcb0
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/s3_bucket_lifecycle_configuration.html.markdown
@@ -0,0 +1,606 @@
+---
+subcategory: "S3 (Simple Storage)"
+layout: "aws"
+page_title: "AWS: aws_s3_bucket_lifecycle_configuration"
+description: |-
+  Provides a S3 bucket lifecycle configuration resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_s3_bucket_lifecycle_configuration
+
+Provides an independent configuration resource for S3 bucket [lifecycle configuration](https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lifecycle-mgmt.html).
+
+An S3 Lifecycle configuration consists of one or more Lifecycle rules. Each rule consists of the following:
+
+* Rule metadata (`id` and `status`)
+* [Filter](#filter) identifying objects to which the rule applies
+* One or more transition or expiration actions
+
+For more information see the Amazon S3 User Guide on [`Lifecycle Configuration Elements`](https://docs.aws.amazon.com/AmazonS3/latest/userguide/intro-lifecycle-rules.html).
+
+~> **NOTE:** S3 Buckets only support a single lifecycle configuration. Declaring multiple `awsS3BucketLifecycleConfiguration` resources to the same S3 Bucket will cause a perpetual difference in configuration.
+
+~> **NOTE:** Lifecycle configurations may take some time to fully propagate to all AWS S3 systems.
+Running Terraform operations shortly after creating a lifecycle configuration may result in changes that affect configuration idempotence.
+See the Amazon S3 User Guide on [setting lifecycle configuration on a bucket](https://docs.aws.amazon.com/AmazonS3/latest/userguide/how-to-set-lifecycle-configuration-intro.html).
+
+## Example Usage
+
+### With neither a filter nor prefix specified
+
+The Lifecycle rule applies to a subset of objects based on the key name prefix (`""`).
+
+This configuration is intended to replicate the default behavior of the `lifecycleRule`
+parameter in the Terraform AWS Provider `awsS3Bucket` resource prior to `v40`.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3BucketLifecycleConfiguration } from "./.gen/providers/aws/s3-bucket-lifecycle-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new S3BucketLifecycleConfiguration(this, "example", {
+      bucket: bucket.id,
+      rule: [
+        {
+          id: "rule-1",
+          status: "Enabled",
+        },
+      ],
+    });
+  }
+}
+
+```
+
+### Specifying an empty filter
+
+The Lifecycle rule applies to all objects in the bucket.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3BucketLifecycleConfiguration } from "./.gen/providers/aws/s3-bucket-lifecycle-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new S3BucketLifecycleConfiguration(this, "example", {
+      bucket: bucket.id,
+      rule: [
+        {
+          filter: {},
+          id: "rule-1",
+          status: "Enabled",
+        },
+      ],
+    });
+  }
+}
+
+```
+
+### Specifying a filter using key prefixes
+
+The Lifecycle rule applies to a subset of objects based on the key name prefix (`logs/`).
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3BucketLifecycleConfiguration } from "./.gen/providers/aws/s3-bucket-lifecycle-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new S3BucketLifecycleConfiguration(this, "example", {
+      bucket: bucket.id,
+      rule: [
+        {
+          filter: {
+            prefix: "logs/",
+          },
+          id: "rule-1",
+          status: "Enabled",
+        },
+      ],
+    });
+  }
+}
+
+```
+
+If you want to apply a Lifecycle action to a subset of objects based on different key name prefixes, specify separate rules.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3BucketLifecycleConfiguration } from "./.gen/providers/aws/s3-bucket-lifecycle-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new S3BucketLifecycleConfiguration(this, "example", {
+      bucket: bucket.id,
+      rule: [
+        {
+          filter: {
+            prefix: "logs/",
+          },
+          id: "rule-1",
+          status: "Enabled",
+        },
+        {
+          filter: {
+            prefix: "tmp/",
+          },
+          id: "rule-2",
+          status: "Enabled",
+        },
+      ],
+    });
+  }
+}
+
+```
+
+### Specifying a filter based on an object tag
+
+The Lifecycle rule specifies a filter based on a tag key and value. The rule then applies only to a subset of objects with the specific tag.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3BucketLifecycleConfiguration } from "./.gen/providers/aws/s3-bucket-lifecycle-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new S3BucketLifecycleConfiguration(this, "example", {
+      bucket: bucket.id,
+      rule: [
+        {
+          filter: {
+            tag: {
+              key: "Name",
+              value: "Staging",
+            },
+          },
+          id: "rule-1",
+          status: "Enabled",
+        },
+      ],
+    });
+  }
+}
+
+```
+
+### Specifying a filter based on multiple tags
+
+The Lifecycle rule directs Amazon S3 to perform lifecycle actions on objects with two tags (with the specific tag keys and values). Notice `tags` is wrapped in the `and` configuration block.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3BucketLifecycleConfiguration } from "./.gen/providers/aws/s3-bucket-lifecycle-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new S3BucketLifecycleConfiguration(this, "example", {
+      bucket: bucket.id,
+      rule: [
+        {
+          filter: {
+            and: {
+              tags: {
+                key1: "Value1",
+                key2: "Value2",
+              },
+            },
+          },
+          id: "rule-1",
+          status: "Enabled",
+        },
+      ],
+    });
+  }
+}
+
+```
+
+### Specifying a filter based on both prefix and one or more tags
+
+The Lifecycle rule directs Amazon S3 to perform lifecycle actions on objects with the specified prefix and two tags (with the specific tag keys and values). Notice both `prefix` and `tags` are wrapped in the `and` configuration block.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3BucketLifecycleConfiguration } from "./.gen/providers/aws/s3-bucket-lifecycle-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new S3BucketLifecycleConfiguration(this, "example", {
+      bucket: bucket.id,
+      rule: [
+        {
+          filter: {
+            and: {
+              prefix: "logs/",
+              tags: {
+                key1: "Value1",
+                key2: "Value2",
+              },
+            },
+          },
+          id: "rule-1",
+          status: "Enabled",
+        },
+      ],
+    });
+  }
+}
+
+```
+
+### Specifying a filter based on object size
+
+Object size values are in bytes. Maximum filter size is 5TB. Some storage classes have minimum object size limitations, for more information, see [Comparing the Amazon S3 storage classes](https://docs.aws.amazon.com/AmazonS3/latest/userguide/storage-class-intro.html#sc-compare).
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3BucketLifecycleConfiguration } from "./.gen/providers/aws/s3-bucket-lifecycle-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new S3BucketLifecycleConfiguration(this, "example", {
+      bucket: bucket.id,
+      rule: [
+        {
+          filter: {
+            objectSizeGreaterThan: Token.asString(500),
+          },
+          id: "rule-1",
+          status: "Enabled",
+        },
+      ],
+    });
+  }
+}
+
+```
+
+### Specifying a filter based on object size range and prefix
+
+The `objectSizeGreaterThan` must be less than the `objectSizeLessThan`. Notice both the object size range and prefix are wrapped in the `and` configuration block.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3BucketLifecycleConfiguration } from "./.gen/providers/aws/s3-bucket-lifecycle-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new S3BucketLifecycleConfiguration(this, "example", {
+      bucket: bucket.id,
+      rule: [
+        {
+          filter: {
+            and: {
+              objectSizeGreaterThan: 500,
+              objectSizeLessThan: 64000,
+              prefix: "logs/",
+            },
+          },
+          id: "rule-1",
+          status: "Enabled",
+        },
+      ],
+    });
+  }
+}
+
+```
+
+### Creating a Lifecycle Configuration for a bucket with versioning
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketAcl } from "./.gen/providers/aws/s3-bucket-acl";
+import { S3BucketLifecycleConfiguration } from "./.gen/providers/aws/s3-bucket-lifecycle-configuration";
+import { S3BucketVersioningA } from "./.gen/providers/aws/s3-bucket-versioning";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const bucket = new S3Bucket(this, "bucket", {
+      bucket: "my-bucket",
+    });
+    const versioningBucket = new S3Bucket(this, "versioning_bucket", {
+      bucket: "my-versioning-bucket",
+    });
+    new S3BucketAcl(this, "bucket_acl", {
+      acl: "private",
+      bucket: bucket.id,
+    });
+    new S3BucketAcl(this, "versioning_bucket_acl", {
+      acl: "private",
+      bucket: versioningBucket.id,
+    });
+    new S3BucketLifecycleConfiguration(this, "bucket-config", {
+      bucket: bucket.id,
+      rule: [
+        {
+          expiration: {
+            days: 90,
+          },
+          filter: {
+            and: {
+              prefix: "log/",
+              tags: {
+                autoclean: "true",
+                rule: "log",
+              },
+            },
+          },
+          id: "log",
+          status: "Enabled",
+          transition: [
+            {
+              days: 30,
+              storageClass: "STANDARD_IA",
+            },
+            {
+              days: 60,
+              storageClass: "GLACIER",
+            },
+          ],
+        },
+        {
+          expiration: {
+            date: "2023-01-13T00:00:00Z",
+          },
+          filter: {
+            prefix: "tmp/",
+          },
+          id: "tmp",
+          status: "Enabled",
+        },
+      ],
+    });
+    const versioning = new S3BucketVersioningA(this, "versioning", {
+      bucket: versioningBucket.id,
+      versioningConfiguration: {
+        status: "Enabled",
+      },
+    });
+    new S3BucketLifecycleConfiguration(this, "versioning-bucket-config", {
+      bucket: versioningBucket.id,
+      dependsOn: [versioning],
+      rule: [
+        {
+          filter: {
+            prefix: "config/",
+          },
+          id: "config",
+          noncurrentVersionExpiration: {
+            noncurrentDays: 90,
+          },
+          noncurrentVersionTransition: [
+            {
+              noncurrentDays: 30,
+              storageClass: "STANDARD_IA",
+            },
+            {
+              noncurrentDays: 60,
+              storageClass: "GLACIER",
+            },
+          ],
+          status: "Enabled",
+        },
+      ],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `bucket` - (Required) Name of the source S3 bucket you want Amazon S3 to monitor.
+* `expectedBucketOwner` - (Optional) Account ID of the expected bucket owner. If the bucket is owned by a different account, the request will fail with an HTTP 403 (Access Denied) error.
+* `rule` - (Required) List of configuration blocks describing the rules managing the replication. [See below](#rule).
+
+### rule
+
+~> **NOTE:** The `filter` argument, while Optional, is required if the `rule` configuration block does not contain a `prefix` **and** you intend to override the default behavior of setting the rule to filter objects with the empty string prefix (`""`).
+Since `prefix` is deprecated by Amazon S3 and will be removed in the next major version of the Terraform AWS Provider, we recommend users either specify `filter` or leave both `filter` and `prefix` unspecified.
+
+~> **NOTE:** A rule cannot be updated from having a filter (via either the `ruleFilter` parameter or when neither `ruleFilter` and `rulePrefix` are specified) to only having a prefix via the `rulePrefix` parameter.
+
+~> **NOTE** Terraform cannot distinguish a difference between configurations that use `rule.filter {}` and configurations that neither use `ruleFilter` nor `rulePrefix`, so a rule cannot be updated from applying to all objects in the bucket via `rule.filter {}` to applying to a subset of objects based on the key prefix `""` and vice versa.
+
+The `rule` configuration block supports the following arguments:
+
+* `abortIncompleteMultipartUpload` - (Optional) Configuration block that specifies the days since the initiation of an incomplete multipart upload that Amazon S3 will wait before permanently removing all parts of the upload. [See below](#abort_incomplete_multipart_upload).
+* `expiration` - (Optional) Configuration block that specifies the expiration for the lifecycle of the object in the form of date, days and, whether the object has a delete marker. [See below](#expiration).
+* `filter` - (Optional) Configuration block used to identify objects that a Lifecycle Rule applies to. [See below](#filter). If not specified, the `rule` will default to using `prefix`.
+* `id` - (Required) Unique identifier for the rule. The value cannot be longer than 255 characters.
+* `noncurrentVersionExpiration` - (Optional) Configuration block that specifies when noncurrent object versions expire. [See below](#noncurrent_version_expiration).
+* `noncurrentVersionTransition` - (Optional) Set of configuration blocks that specify the transition rule for the lifecycle rule that describes when noncurrent objects transition to a specific storage class. [See below](#noncurrent_version_transition).
+* `prefix` - (Optional) **DEPRECATED** Use `filter` instead. This has been deprecated by Amazon S3. Prefix identifying one or more objects to which the rule applies. Defaults to an empty string (`""`) if `filter` is not specified.
+* `status` - (Required) Whether the rule is currently being applied. Valid values: `enabled` or `disabled`.
+* `transition` - (Optional) Set of configuration blocks that specify when an Amazon S3 object transitions to a specified storage class. [See below](#transition).
+
+### abort_incomplete_multipart_upload
+
+The `abortIncompleteMultipartUpload` configuration block supports the following arguments:
+
+* `daysAfterInitiation` - Number of days after which Amazon S3 aborts an incomplete multipart upload.
+
+### expiration
+
+The `expiration` configuration block supports the following arguments:
+
+* `date` - (Optional) Date the object is to be moved or deleted. The date value must be in [RFC3339 full-date format](https://datatracker.ietf.org/doc/html/rfc3339#section-5.6) e.g. `20230822`.
+* `days` - (Optional) Lifetime, in days, of the objects that are subject to the rule. The value must be a non-zero positive integer.
+* `expiredObjectDeleteMarker` - (Optional, Conflicts with `date` and `days`) Indicates whether Amazon S3 will remove a delete marker with no noncurrent versions. If set to `true`, the delete marker will be expired; if set to `false` the policy takes no action.
+
+### filter
+
+~> **NOTE:** The `filter` configuration block must either be specified as the empty configuration block (`filter {}`) or with exactly one of `prefix`, `tag`, `and`, `objectSizeGreaterThan` or `objectSizeLessThan` specified.
+
+The `filter` configuration block supports the following arguments:
+
+* `and`- (Optional) Configuration block used to apply a logical `and` to two or more predicates. [See below](#and). The Lifecycle Rule will apply to any object matching all the predicates configured inside the `and` block.
+* `objectSizeGreaterThan` - (Optional) Minimum object size (in bytes) to which the rule applies.
+* `objectSizeLessThan` - (Optional) Maximum object size (in bytes) to which the rule applies.
+* `prefix` - (Optional) Prefix identifying one or more objects to which the rule applies. Defaults to an empty string (`""`) if not specified.
+* `tag` - (Optional) Configuration block for specifying a tag key and value. [See below](#tag).
+
+### noncurrent_version_expiration
+
+The `noncurrentVersionExpiration` configuration block supports the following arguments:
+
+* `newerNoncurrentVersions` - (Optional) Number of noncurrent versions Amazon S3 will retain. Must be a non-zero positive integer.
+* `noncurrentDays` - (Optional) Number of days an object is noncurrent before Amazon S3 can perform the associated action. Must be a positive integer.
+
+### noncurrent_version_transition
+
+The `noncurrentVersionTransition` configuration block supports the following arguments:
+
+* `newerNoncurrentVersions` - (Optional) Number of noncurrent versions Amazon S3 will retain. Must be a non-zero positive integer.
+* `noncurrentDays` - (Optional) Number of days an object is noncurrent before Amazon S3 can perform the associated action.
+* `storageClass` - (Required) Class of storage used to store the object. Valid Values: `glacier`, `standardIa`, `onezoneIa`, `intelligentTiering`, `deepArchive`, `glacierIr`.
+
+### transition
+
+The `transition` configuration block supports the following arguments:
+
+~> **Note:** Only one of `date` or `days` should be specified. If neither are specified, the `transition` will default to 0 `days`.
+
+* `date` - (Optional, Conflicts with `days`) Date objects are transitioned to the specified storage class. The date value must be in [RFC3339 full-date format](https://datatracker.ietf.org/doc/html/rfc3339#section-5.6) e.g. `20230822`.
+* `days` - (Optional, Conflicts with `date`) Number of days after creation when objects are transitioned to the specified storage class. The value must be a positive integer. If both `days` and `date` are not specified, defaults to `0`. Valid values depend on `storageClass`, see [Transition objects using Amazon S3 Lifecycle](https://docs.aws.amazon.com/AmazonS3/latest/userguide/lifecycle-transition-general-considerations.html) for more details.
+* `storageClass` - Class of storage used to store the object. Valid Values: `glacier`, `standardIa`, `onezoneIa`, `intelligentTiering`, `deepArchive`, `glacierIr`.
+
+### and
+
+The `and` configuration block supports the following arguments:
+
+* `objectSizeGreaterThan` - (Optional) Minimum object size to which the rule applies. Value must be at least `0` if specified.
+* `objectSizeLessThan` - (Optional) Maximum object size to which the rule applies. Value must be at least `1` if specified.
+* `prefix` - (Optional) Prefix identifying one or more objects to which the rule applies.
+* `tags` - (Optional) Key-value map of resource tags. All of these tags must exist in the object's tag set in order for the rule to apply.
+
+### tag
+
+The `tag` configuration block supports the following arguments:
+
+* `key` - (Required) Name of the object key.
+* `value` - (Required) Value of the tag.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The `bucket` or `bucket` and `expectedBucketOwner` separated by a comma (`,`) if the latter is provided.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import S3 bucket lifecycle configuration using the `bucket` or using the `bucket` and `expectedBucketOwner` separated by a comma (`,`). For example:
+
+If the owner (account ID) of the source bucket is the same account used to configure the Terraform AWS Provider, import using the `bucket`:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+If the owner (account ID) of the source bucket differs from the account used to configure the Terraform AWS Provider, import using the `bucket` and `expectedBucketOwner` separated by a comma (`,`):
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+**Using `terraform import` to import** S3 bucket lifecycle configuration using the `bucket` or using the `bucket` and `expectedBucketOwner` separated by a comma (`,`). For example:
+
+If the owner (account ID) of the source bucket is the same account used to configure the Terraform AWS Provider, import using the `bucket`:
+
+```console
+% terraform import aws_s3_bucket_lifecycle_configuration.example bucket-name
+```
+
+If the owner (account ID) of the source bucket differs from the account used to configure the Terraform AWS Provider, import using the `bucket` and `expectedBucketOwner` separated by a comma (`,`):
+
+```console
+% terraform import aws_s3_bucket_lifecycle_configuration.example bucket-name,123456789012
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ebcc41b345ec5d3bba0fcf9e93a6e372a400f2139471f2e6a527ebe13fe61bd7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/s3_bucket_logging.html.markdown b/website/docs/cdktf/typescript/r/s3_bucket_logging.html.markdown
new file mode 100644
index 00000000000..201435e1963
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/s3_bucket_logging.html.markdown
@@ -0,0 +1,141 @@
+---
+subcategory: "S3 (Simple Storage)"
+layout: "aws"
+page_title: "AWS: aws_s3_bucket_logging"
+description: |-
+  Provides an S3 bucket (server access) logging resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_s3_bucket_logging
+
+Provides an S3 bucket (server access) logging resource. For more information, see [Logging requests using server access logging](https://docs.aws.amazon.com/AmazonS3/latest/userguide/ServerLogs.html)
+in the AWS S3 User Guide.
+
+~> **Note:** Amazon S3 supports server access logging, AWS CloudTrail, or a combination of both. Refer to the [Logging options for Amazon S3](https://docs.aws.amazon.com/AmazonS3/latest/userguide/logging-with-S3.html)
+to decide which method meets your requirements.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketAcl } from "./.gen/providers/aws/s3-bucket-acl";
+import { S3BucketLoggingA } from "./.gen/providers/aws/s3-bucket-logging";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new S3Bucket(this, "example", {
+      bucket: "my-tf-example-bucket",
+    });
+    const logBucket = new S3Bucket(this, "log_bucket", {
+      bucket: "my-tf-log-bucket",
+    });
+    const awsS3BucketAclExample = new S3BucketAcl(this, "example_2", {
+      acl: "private",
+      bucket: example.id,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketAclExample.overrideLogicalId("example");
+    new S3BucketAcl(this, "log_bucket_acl", {
+      acl: "log-delivery-write",
+      bucket: logBucket.id,
+    });
+    const awsS3BucketLoggingExample = new S3BucketLoggingA(this, "example_4", {
+      bucket: example.id,
+      targetBucket: logBucket.id,
+      targetPrefix: "log/",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketLoggingExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `bucket` - (Required, Forces new resource) Name of the bucket.
+* `expectedBucketOwner` - (Optional, Forces new resource) Account ID of the expected bucket owner.
+* `targetBucket` - (Required) Name of the bucket where you want Amazon S3 to store server access logs.
+* `targetPrefix` - (Required) Prefix for all log object keys.
+* `targetGrant` - (Optional) Set of configuration blocks with information for granting permissions. [See below](#target_grant).
+
+### target_grant
+
+The `targetGrant` configuration block supports the following arguments:
+
+* `grantee` - (Required) Configuration block for the person being granted permissions. [See below](#grantee).
+* `permission` - (Required) Logging permissions assigned to the grantee for the bucket. Valid values: `fullControl`, `read`, `write`.
+
+### grantee
+
+The `grantee` configuration block supports the following arguments:
+
+* `emailAddress` - (Optional) Email address of the grantee. See [Regions and Endpoints](https://docs.aws.amazon.com/general/latest/gr/rande.html#s3_region) for supported AWS regions where this argument can be specified.
+* `id` - (Optional) Canonical user ID of the grantee.
+* `type` - (Required) Type of grantee. Valid values: `canonicalUser`, `amazonCustomerByEmail`, `group`.
+* `uri` - (Optional) URI of the grantee group.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The `bucket` or `bucket` and `expectedBucketOwner` separated by a comma (`,`) if the latter is provided.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import S3 bucket logging using the `bucket` or using the `bucket` and `expectedBucketOwner` separated by a comma (`,`). For example:
+
+If the owner (account ID) of the source bucket is the same account used to configure the Terraform AWS Provider, import using the `bucket`:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+If the owner (account ID) of the source bucket differs from the account used to configure the Terraform AWS Provider, import using the `bucket` and `expectedBucketOwner` separated by a comma (`,`):
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+**Using `terraform import` to import** S3 bucket logging using the `bucket` or using the `bucket` and `expectedBucketOwner` separated by a comma (`,`). For example:
+
+If the owner (account ID) of the source bucket is the same account used to configure the Terraform AWS Provider, import using the `bucket`:
+
+```console
+% terraform import aws_s3_bucket_logging.example bucket-name
+```
+
+If the owner (account ID) of the source bucket differs from the account used to configure the Terraform AWS Provider, import using the `bucket` and `expectedBucketOwner` separated by a comma (`,`):
+
+```console
+% terraform import aws_s3_bucket_logging.example bucket-name,123456789012
+```
+
+<!-- cache-key: cdktf-0.18.0 input-3cba2dd83f76e650304ea09cc4ee162c5bf05b0006a74f1eff49c0cb39bfcded -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/s3_bucket_metric.html.markdown b/website/docs/cdktf/typescript/r/s3_bucket_metric.html.markdown
new file mode 100644
index 00000000000..229026d0c52
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/s3_bucket_metric.html.markdown
@@ -0,0 +1,119 @@
+---
+subcategory: "S3 (Simple Storage)"
+layout: "aws"
+page_title: "AWS: aws_s3_bucket_metric"
+description: |-
+  Provides a S3 bucket metrics configuration resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_s3_bucket_metric
+
+Provides a S3 bucket [metrics configuration](http://docs.aws.amazon.com/AmazonS3/latest/dev/metrics-configurations.html) resource.
+
+## Example Usage
+
+### Add metrics configuration for entire S3 bucket
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketMetric } from "./.gen/providers/aws/s3-bucket-metric";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new S3Bucket(this, "example", {
+      bucket: "example",
+    });
+    new S3BucketMetric(this, "example-entire-bucket", {
+      bucket: example.id,
+      name: "EntireBucket",
+    });
+  }
+}
+
+```
+
+### Add metrics configuration with S3 object filter
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketMetric } from "./.gen/providers/aws/s3-bucket-metric";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new S3Bucket(this, "example", {
+      bucket: "example",
+    });
+    new S3BucketMetric(this, "example-filtered", {
+      bucket: example.id,
+      filter: {
+        prefix: "documents/",
+        tags: {
+          class: "blue",
+          priority: "high",
+        },
+      },
+      name: "ImportantBlueDocuments",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `bucket` - (Required) Name of the bucket to put metric configuration.
+* `name` - (Required) Unique identifier of the metrics configuration for the bucket. Must be less than or equal to 64 characters in length.
+* `filter` - (Optional) [Object filtering](http://docs.aws.amazon.com/AmazonS3/latest/dev/metrics-configurations.html#metrics-configurations-filter) that accepts a prefix, tags, or a logical AND of prefix and tags (documented below).
+
+The `filter` metric configuration supports the following:
+
+~> **NOTE:** At least one of `prefix` or `tags` is required when specifying a `filter`
+
+* `prefix` - (Optional) Object prefix for filtering (singular).
+* `tags` - (Optional) Object tags for filtering (up to 10).
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import S3 bucket metric configurations using `bucket:metric`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import S3 bucket metric configurations using `bucket:metric`. For example:
+
+```console
+% terraform import aws_s3_bucket_metric.my-bucket-entire-bucket my-bucket:EntireBucket
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1091c69fa9fb93d148c9ff3885128f11e533b402052266873576f08369f6d546 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/s3_bucket_notification.html.markdown b/website/docs/cdktf/typescript/r/s3_bucket_notification.html.markdown
new file mode 100644
index 00000000000..7763e58e287
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/s3_bucket_notification.html.markdown
@@ -0,0 +1,484 @@
+---
+subcategory: "S3 (Simple Storage)"
+layout: "aws"
+page_title: "AWS: aws_s3_bucket_notification"
+description: |-
+  Manages a S3 Bucket Notification Configuration
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_s3_bucket_notification
+
+Manages a S3 Bucket Notification Configuration. For additional information, see the [Configuring S3 Event Notifications section in the Amazon S3 Developer Guide](https://docs.aws.amazon.com/AmazonS3/latest/dev/NotificationHowTo.html).
+
+~> **NOTE:** S3 Buckets only support a single notification configuration. Declaring multiple `awsS3BucketNotification` resources to the same S3 Bucket will cause a perpetual difference in configuration. See the example "Trigger multiple Lambda functions" for an option.
+
+## Example Usage
+
+### Add notification configuration to SNS Topic
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketNotification } from "./.gen/providers/aws/s3-bucket-notification";
+import { SnsTopic } from "./.gen/providers/aws/sns-topic";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const bucket = new S3Bucket(this, "bucket", {
+      bucket: "your-bucket-name",
+    });
+    const topic = new DataAwsIamPolicyDocument(this, "topic", {
+      statement: [
+        {
+          actions: ["SNS:Publish"],
+          condition: [
+            {
+              test: "ArnLike",
+              values: [bucket.arn],
+              variable: "aws:SourceArn",
+            },
+          ],
+          effect: "Allow",
+          principals: [
+            {
+              identifiers: ["s3.amazonaws.com"],
+              type: "Service",
+            },
+          ],
+          resources: ["arn:aws:sns:*:*:s3-event-notification-topic"],
+        },
+      ],
+    });
+    const awsSnsTopicTopic = new SnsTopic(this, "topic_2", {
+      name: "s3-event-notification-topic",
+      policy: Token.asString(topic.json),
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSnsTopicTopic.overrideLogicalId("topic");
+    new S3BucketNotification(this, "bucket_notification", {
+      bucket: bucket.id,
+      topic: [
+        {
+          events: ["s3:ObjectCreated:*"],
+          filterSuffix: ".log",
+          topicArn: Token.asString(awsSnsTopicTopic.arn),
+        },
+      ],
+    });
+  }
+}
+
+```
+
+### Add notification configuration to SQS Queue
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketNotification } from "./.gen/providers/aws/s3-bucket-notification";
+import { SqsQueue } from "./.gen/providers/aws/sqs-queue";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const bucket = new S3Bucket(this, "bucket", {
+      bucket: "your-bucket-name",
+    });
+    const queue = new DataAwsIamPolicyDocument(this, "queue", {
+      statement: [
+        {
+          actions: ["sqs:SendMessage"],
+          condition: [
+            {
+              test: "ArnEquals",
+              values: [bucket.arn],
+              variable: "aws:SourceArn",
+            },
+          ],
+          effect: "Allow",
+          principals: [
+            {
+              identifiers: ["*"],
+              type: "*",
+            },
+          ],
+          resources: ["arn:aws:sqs:*:*:s3-event-notification-queue"],
+        },
+      ],
+    });
+    const awsSqsQueueQueue = new SqsQueue(this, "queue_2", {
+      name: "s3-event-notification-queue",
+      policy: Token.asString(queue.json),
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSqsQueueQueue.overrideLogicalId("queue");
+    new S3BucketNotification(this, "bucket_notification", {
+      bucket: bucket.id,
+      queue: [
+        {
+          events: ["s3:ObjectCreated:*"],
+          filterSuffix: ".log",
+          queueArn: Token.asString(awsSqsQueueQueue.arn),
+        },
+      ],
+    });
+  }
+}
+
+```
+
+### Add notification configuration to Lambda Function
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+import { LambdaFunction } from "./.gen/providers/aws/lambda-function";
+import { LambdaPermission } from "./.gen/providers/aws/lambda-permission";
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketNotification } from "./.gen/providers/aws/s3-bucket-notification";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const bucket = new S3Bucket(this, "bucket", {
+      bucket: "your-bucket-name",
+    });
+    const assumeRole = new DataAwsIamPolicyDocument(this, "assume_role", {
+      statement: [
+        {
+          actions: ["sts:AssumeRole"],
+          effect: "Allow",
+          principals: [
+            {
+              identifiers: ["lambda.amazonaws.com"],
+              type: "Service",
+            },
+          ],
+        },
+      ],
+    });
+    const iamForLambda = new IamRole(this, "iam_for_lambda", {
+      assumeRolePolicy: Token.asString(assumeRole.json),
+      name: "iam_for_lambda",
+    });
+    const func = new LambdaFunction(this, "func", {
+      filename: "your-function.zip",
+      functionName: "example_lambda_name",
+      handler: "exports.example",
+      role: iamForLambda.arn,
+      runtime: "go1.x",
+    });
+    const allowBucket = new LambdaPermission(this, "allow_bucket", {
+      action: "lambda:InvokeFunction",
+      functionName: func.arn,
+      principal: "s3.amazonaws.com",
+      sourceArn: bucket.arn,
+      statementId: "AllowExecutionFromS3Bucket",
+    });
+    new S3BucketNotification(this, "bucket_notification", {
+      bucket: bucket.id,
+      dependsOn: [allowBucket],
+      lambdaFunction: [
+        {
+          events: ["s3:ObjectCreated:*"],
+          filterPrefix: "AWSLogs/",
+          filterSuffix: ".log",
+          lambdaFunctionArn: func.arn,
+        },
+      ],
+    });
+  }
+}
+
+```
+
+### Trigger multiple Lambda functions
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+import { LambdaFunction } from "./.gen/providers/aws/lambda-function";
+import { LambdaPermission } from "./.gen/providers/aws/lambda-permission";
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketNotification } from "./.gen/providers/aws/s3-bucket-notification";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const bucket = new S3Bucket(this, "bucket", {
+      bucket: "your-bucket-name",
+    });
+    const assumeRole = new DataAwsIamPolicyDocument(this, "assume_role", {
+      actions: ["sts:AssumeRole"],
+      effect: "Allow",
+      principals: [
+        {
+          identifiers: ["lambda.amazonaws.com"],
+          type: "Service",
+        },
+      ],
+    });
+    const iamForLambda = new IamRole(this, "iam_for_lambda", {
+      assumeRolePolicy: Token.asString(assumeRole.json),
+      name: "iam_for_lambda",
+    });
+    const func1 = new LambdaFunction(this, "func1", {
+      filename: "your-function1.zip",
+      functionName: "example_lambda_name1",
+      handler: "exports.example",
+      role: iamForLambda.arn,
+      runtime: "go1.x",
+    });
+    const func2 = new LambdaFunction(this, "func2", {
+      filename: "your-function2.zip",
+      functionName: "example_lambda_name2",
+      handler: "exports.example",
+      role: iamForLambda.arn,
+    });
+    const allowBucket1 = new LambdaPermission(this, "allow_bucket1", {
+      action: "lambda:InvokeFunction",
+      functionName: func1.arn,
+      principal: "s3.amazonaws.com",
+      sourceArn: bucket.arn,
+      statementId: "AllowExecutionFromS3Bucket1",
+    });
+    const allowBucket2 = new LambdaPermission(this, "allow_bucket2", {
+      action: "lambda:InvokeFunction",
+      functionName: func2.arn,
+      principal: "s3.amazonaws.com",
+      sourceArn: bucket.arn,
+      statementId: "AllowExecutionFromS3Bucket2",
+    });
+    new S3BucketNotification(this, "bucket_notification", {
+      bucket: bucket.id,
+      dependsOn: [allowBucket1, allowBucket2],
+      lambdaFunction: [
+        {
+          events: ["s3:ObjectCreated:*"],
+          filterPrefix: "AWSLogs/",
+          filterSuffix: ".log",
+          lambdaFunctionArn: func1.arn,
+        },
+        {
+          events: ["s3:ObjectCreated:*"],
+          filterPrefix: "OtherLogs/",
+          filterSuffix: ".log",
+          lambdaFunctionArn: func2.arn,
+        },
+      ],
+    });
+  }
+}
+
+```
+
+### Add multiple notification configurations to SQS Queue
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketNotification } from "./.gen/providers/aws/s3-bucket-notification";
+import { SqsQueue } from "./.gen/providers/aws/sqs-queue";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const bucket = new S3Bucket(this, "bucket", {
+      bucket: "your-bucket-name",
+    });
+    const queue = new DataAwsIamPolicyDocument(this, "queue", {
+      statement: [
+        {
+          actions: ["sqs:SendMessage"],
+          condition: [
+            {
+              test: "ArnEquals",
+              values: [bucket.arn],
+              variable: "aws:SourceArn",
+            },
+          ],
+          effect: "Allow",
+          principals: [
+            {
+              identifiers: ["*"],
+              type: "*",
+            },
+          ],
+          resources: ["arn:aws:sqs:*:*:s3-event-notification-queue"],
+        },
+      ],
+    });
+    const awsSqsQueueQueue = new SqsQueue(this, "queue_2", {
+      name: "s3-event-notification-queue",
+      policy: Token.asString(queue.json),
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSqsQueueQueue.overrideLogicalId("queue");
+    new S3BucketNotification(this, "bucket_notification", {
+      bucket: bucket.id,
+      queue: [
+        {
+          events: ["s3:ObjectCreated:*"],
+          filterPrefix: "images/",
+          id: "image-upload-event",
+          queueArn: Token.asString(awsSqsQueueQueue.arn),
+        },
+        {
+          events: ["s3:ObjectCreated:*"],
+          filterPrefix: "videos/",
+          id: "video-upload-event",
+          queueArn: Token.asString(awsSqsQueueQueue.arn),
+        },
+      ],
+    });
+  }
+}
+
+```
+
+For Terraform's [JSON syntax](https://www.terraform.io/docs/configuration/syntax.html), use an array instead of defining the `queue` key twice.
+
+```json
+{
+	"bucket": "${aws_s3_bucket.bucket.id}",
+	"queue": [
+		{
+			"id": "image-upload-event",
+			"queue_arn": "${aws_sqs_queue.queue.arn}",
+			"events": ["s3:ObjectCreated:*"],
+			"filter_prefix": "images/"
+		},
+		{
+			"id": "video-upload-event",
+			"queue_arn": "${aws_sqs_queue.queue.arn}",
+			"events": ["s3:ObjectCreated:*"],
+			"filter_prefix": "videos/"
+		}
+	]
+}
+```
+
+### Emit events to EventBridge
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketNotification } from "./.gen/providers/aws/s3-bucket-notification";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const bucket = new S3Bucket(this, "bucket", {
+      bucket: "your-bucket-name",
+    });
+    new S3BucketNotification(this, "bucket_notification", {
+      bucket: bucket.id,
+      eventbridge: true,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `bucket` - (Required) Name of the bucket for notification configuration.
+
+The following arguments are optional:
+
+* `eventbridge` - (Optional) Whether to enable Amazon EventBridge notifications. Defaults to `false`.
+* `lambdaFunction` - (Optional, Multiple) Used to configure notifications to a Lambda Function. See below.
+* `queue` - (Optional) Notification configuration to SQS Queue. See below.
+* `topic` - (Optional) Notification configuration to SNS Topic. See below.
+
+### `lambdaFunction`
+
+* `events` - (Required) [Event](http://docs.aws.amazon.com/AmazonS3/latest/dev/NotificationHowTo.html#notification-how-to-event-types-and-destinations) for which to send notifications.
+* `filterPrefix` - (Optional) Object key name prefix.
+* `filterSuffix` - (Optional) Object key name suffix.
+* `id` - (Optional) Unique identifier for each of the notification configurations.
+* `lambdaFunctionArn` - (Required) Lambda function ARN.
+
+### `queue`
+
+* `events` - (Required) Specifies [event](http://docs.aws.amazon.com/AmazonS3/latest/dev/NotificationHowTo.html#notification-how-to-event-types-and-destinations) for which to send notifications.
+* `filterPrefix` - (Optional) Object key name prefix.
+* `filterSuffix` - (Optional) Object key name suffix.
+* `id` - (Optional) Unique identifier for each of the notification configurations.
+* `queueArn` - (Required) SQS queue ARN.
+
+### `topic`
+
+* `events` - (Required) [Event](http://docs.aws.amazon.com/AmazonS3/latest/dev/NotificationHowTo.html#notification-how-to-event-types-and-destinations) for which to send notifications.
+* `filterPrefix` - (Optional) Object key name prefix.
+* `filterSuffix` - (Optional) Object key name suffix.
+* `id` - (Optional) Unique identifier for each of the notification configurations.
+* `topicArn` - (Required) SNS topic ARN.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import S3 bucket notification using the `bucket`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import S3 bucket notification using the `bucket`. For example:
+
+```console
+% terraform import aws_s3_bucket_notification.bucket_notification bucket-name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-2b3d5922ed8d8483ab9bf6365c4cf548c1d93fbe385ee90435be6dfab425db07 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/s3_bucket_object.html.markdown b/website/docs/cdktf/typescript/r/s3_bucket_object.html.markdown
new file mode 100644
index 00000000000..9cff48d8911
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/s3_bucket_object.html.markdown
@@ -0,0 +1,304 @@
+---
+subcategory: "S3 (Simple Storage)"
+layout: "aws"
+page_title: "AWS: aws_s3_bucket_object"
+description: |-
+  Provides an S3 object resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_s3_bucket_object
+
+~> **NOTE:** The `awsS3BucketObject` resource is DEPRECATED and will be removed in a future version! Use `awsS3Object` instead, where new features and fixes will be added. When replacing `awsS3BucketObject` with `awsS3Object` in your configuration, on the next apply, Terraform will recreate the object. If you prefer to not have Terraform recreate the object, import the object using `awsS3Object`.
+
+Provides an S3 object resource.
+
+## Example Usage
+
+### Uploading a file to a bucket
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3BucketObject } from "./.gen/providers/aws/s3-bucket-object";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new S3BucketObject(this, "object", {
+      bucket: "your_bucket_name",
+      etag: Token.asString(Fn.filemd5("path/to/file")),
+      key: "new_object_key",
+      source: "path/to/file",
+    });
+  }
+}
+
+```
+
+### Encrypting with KMS Key
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { KmsKey } from "./.gen/providers/aws/kms-key";
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketAcl } from "./.gen/providers/aws/s3-bucket-acl";
+import { S3BucketObject } from "./.gen/providers/aws/s3-bucket-object";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const examplekms = new KmsKey(this, "examplekms", {
+      deletionWindowInDays: 7,
+      description: "KMS key 1",
+    });
+    const examplebucket = new S3Bucket(this, "examplebucket", {
+      bucket: "examplebuckettftest",
+    });
+    new S3BucketAcl(this, "example", {
+      acl: "private",
+      bucket: examplebucket.id,
+    });
+    const awsS3BucketObjectExample = new S3BucketObject(this, "example_3", {
+      bucket: examplebucket.id,
+      key: "someobject",
+      kmsKeyId: examplekms.arn,
+      source: "index.html",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketObjectExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### Server Side Encryption with S3 Default Master Key
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketAcl } from "./.gen/providers/aws/s3-bucket-acl";
+import { S3BucketObject } from "./.gen/providers/aws/s3-bucket-object";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const examplebucket = new S3Bucket(this, "examplebucket", {
+      bucket: "examplebuckettftest",
+    });
+    new S3BucketAcl(this, "example", {
+      acl: "private",
+      bucket: examplebucket.id,
+    });
+    const awsS3BucketObjectExample = new S3BucketObject(this, "example_2", {
+      bucket: examplebucket.id,
+      key: "someobject",
+      serverSideEncryption: "aws:kms",
+      source: "index.html",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketObjectExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### Server Side Encryption with AWS-Managed Key
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketAcl } from "./.gen/providers/aws/s3-bucket-acl";
+import { S3BucketObject } from "./.gen/providers/aws/s3-bucket-object";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const examplebucket = new S3Bucket(this, "examplebucket", {
+      bucket: "examplebuckettftest",
+    });
+    new S3BucketAcl(this, "example", {
+      acl: "private",
+      bucket: examplebucket.id,
+    });
+    const awsS3BucketObjectExample = new S3BucketObject(this, "example_2", {
+      bucket: examplebucket.id,
+      key: "someobject",
+      serverSideEncryption: "AES256",
+      source: "index.html",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketObjectExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### S3 Object Lock
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketAcl } from "./.gen/providers/aws/s3-bucket-acl";
+import { S3BucketObject } from "./.gen/providers/aws/s3-bucket-object";
+import { S3BucketVersioningA } from "./.gen/providers/aws/s3-bucket-versioning";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const examplebucket = new S3Bucket(this, "examplebucket", {
+      bucket: "examplebuckettftest",
+      objectLockEnabled: true,
+    });
+    new S3BucketAcl(this, "example", {
+      acl: "private",
+      bucket: examplebucket.id,
+    });
+    const awsS3BucketVersioningExample = new S3BucketVersioningA(
+      this,
+      "example_2",
+      {
+        bucket: examplebucket.id,
+        versioningConfiguration: {
+          status: "Enabled",
+        },
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketVersioningExample.overrideLogicalId("example");
+    const awsS3BucketObjectExample = new S3BucketObject(this, "example_3", {
+      bucket: examplebucket.id,
+      dependsOn: [awsS3BucketVersioningExample],
+      forceDestroy: true,
+      key: "someobject",
+      objectLockLegalHoldStatus: "ON",
+      objectLockMode: "GOVERNANCE",
+      objectLockRetainUntilDate: "2021-12-31T23:59:60Z",
+      source: "important.txt",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketObjectExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+-> **Note:** If you specify `contentEncoding` you are responsible for encoding the body appropriately. `source`, `content`, and `contentBase64` all expect already encoded/compressed bytes.
+
+The following arguments are required:
+
+* `bucket` - (Required) Name of the bucket to put the file in. Alternatively, an [S3 access point](https://docs.aws.amazon.com/AmazonS3/latest/dev/using-access-points.html) ARN can be specified.
+* `key` - (Required) Name of the object once it is in the bucket.
+
+The following arguments are optional:
+
+* `acl` - (Optional) [Canned ACL](https://docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html#canned-acl) to apply. Valid values are `private`, `publicRead`, `publicReadWrite`, `awsExecRead`, `authenticatedRead`, `bucketOwnerRead`, and `bucketOwnerFullControl`. Defaults to `private`.
+* `bucketKeyEnabled` - (Optional) Whether or not to use [Amazon S3 Bucket Keys](https://docs.aws.amazon.com/AmazonS3/latest/dev/bucket-key.html) for SSE-KMS.
+* `cacheControl` - (Optional) Caching behavior along the request/reply chain Read [w3c cache_control](http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.9) for further details.
+* `contentBase64` - (Optional, conflicts with `source` and `content`) Base64-encoded data that will be decoded and uploaded as raw bytes for the object content. This allows safely uploading non-UTF8 binary data, but is recommended only for small content such as the result of the `gzipbase64` function with small text strings. For larger objects, use `source` to stream the content from a disk file.
+* `contentDisposition` - (Optional) Presentational information for the object. Read [w3c content_disposition](http://www.w3.org/Protocols/rfc2616/rfc2616-sec19.html#sec19.5.1) for further information.
+* `contentEncoding` - (Optional) Content encodings that have been applied to the object and thus what decoding mechanisms must be applied to obtain the media-type referenced by the Content-Type header field. Read [w3c content encoding](http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.11) for further information.
+* `contentLanguage` - (Optional) Language the content is in e.g., en-US or en-GB.
+* `contentType` - (Optional) Standard MIME type describing the format of the object data, e.g., application/octet-stream. All Valid MIME Types are valid for this input.
+* `content` - (Optional, conflicts with `source` and `contentBase64`) Literal string value to use as the object content, which will be uploaded as UTF-8-encoded text.
+* `etag` - (Optional) Triggers updates when the value changes. The only meaningful value is `filemd5("path/to/file")` (Terraform 0.11.12 or later) or `${md5(file("path/to/file"))}` (Terraform 0.11.11 or earlier). This attribute is not compatible with KMS encryption, `kmsKeyId` or `server_side_encryption = "aws:kms"` (see `sourceHash` instead).
+* `forceDestroy` - (Optional) Whether to allow the object to be deleted by removing any legal hold on any object version. Default is `false`. This value should be set to `true` only if the bucket has S3 object lock enabled.
+* `kmsKeyId` - (Optional) ARN of the KMS Key to use for object encryption. If the S3 Bucket has server-side encryption enabled, that value will automatically be used. If referencing the `awsKmsKey` resource, use the `arn` attribute. If referencing the `awsKmsAlias` data source or resource, use the `targetKeyArn` attribute. Terraform will only perform drift detection if a configuration value is provided.
+* `metadata` - (Optional) Map of keys/values to provision metadata (will be automatically prefixed by `xAmzMeta`, note that only lowercase label are currently supported by the AWS Go API).
+* `objectLockLegalHoldStatus` - (Optional) [Legal hold](https://docs.aws.amazon.com/AmazonS3/latest/dev/object-lock-overview.html#object-lock-legal-holds) status that you want to apply to the specified object. Valid values are `on` and `off`.
+* `objectLockMode` - (Optional) Object lock [retention mode](https://docs.aws.amazon.com/AmazonS3/latest/dev/object-lock-overview.html#object-lock-retention-modes) that you want to apply to this object. Valid values are `governance` and `compliance`.
+* `objectLockRetainUntilDate` - (Optional) Date and time, in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8), when this object's object lock will [expire](https://docs.aws.amazon.com/AmazonS3/latest/dev/object-lock-overview.html#object-lock-retention-periods).
+* `serverSideEncryption` - (Optional) Server-side encryption of the object in S3. Valid values are "`aes256`" and "`aws:kms`".
+* `sourceHash` - (Optional) Triggers updates like `etag` but useful to address `etag` encryption limitations. Set using `filemd5("path/to/source")` (Terraform 0.11.12 or later). (The value is only stored in state and not saved by AWS.)
+* `source` - (Optional, conflicts with `content` and `contentBase64`) Path to a file that will be read and uploaded as raw bytes for the object content.
+* `storageClass` - (Optional) [Storage Class](https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutObject.html#AmazonS3-PutObject-request-header-StorageClass) for the object. Defaults to "`standard`".
+* `tags` - (Optional) Map of tags to assign to the object. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `websiteRedirect` - (Optional) Target URL for [website redirect](http://docs.aws.amazon.com/AmazonS3/latest/dev/how-to-page-redirect.html).
+
+If no content is provided through `source`, `content` or `contentBase64`, then the object will be empty.
+
+-> **Note:** Terraform ignores all leading `/`s in the object's `key` and treats multiple `/`s in the rest of the object's `key` as a single `/`, so values of `/indexHtml` and `indexHtml` correspond to the same S3 object as do `first//second///third//` and `first/second/third/`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `etag` - ETag generated for the object (an MD5 sum of the object content). For plaintext objects or objects encrypted with an AWS-managed key, the hash is an MD5 digest of the object data. For objects encrypted with a KMS key or objects created by either the Multipart Upload or Part Copy operation, the hash is not an MD5 digest, regardless of the method of encryption. More information on possible values can be found on [Common Response Headers](https://docs.aws.amazon.com/AmazonS3/latest/API/RESTCommonResponseHeaders.html).
+* `id` - `key` of the resource supplied above
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `versionId` - Unique version ID value for the object, if bucket versioning is enabled.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import objects using the `id` or S3 URL. For example:
+
+Import using the `id`, which is the bucket name and the key together:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Import using S3 URL syntax:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+**Using `terraform import` to import** objects using the `id` or S3 URL. For example:
+
+Import using the `id`, which is the bucket name and the key together:
+
+```console
+% terraform import aws_s3_bucket_object.example some-bucket-name/some/key.txt
+```
+
+Import using S3 URL syntax:
+
+```console
+% terraform import aws_s3_bucket_object.example s3://some-bucket-name/some/key.txt
+```
+
+<!-- cache-key: cdktf-0.18.0 input-14589e1ae162949ae3f6416dd42328f66eec724846549bb78e39459ea85cd9c1 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/s3_bucket_object_lock_configuration.html.markdown b/website/docs/cdktf/typescript/r/s3_bucket_object_lock_configuration.html.markdown
new file mode 100644
index 00000000000..be0f7abcff9
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/s3_bucket_object_lock_configuration.html.markdown
@@ -0,0 +1,202 @@
+---
+subcategory: "S3 (Simple Storage)"
+layout: "aws"
+page_title: "AWS: aws_s3_bucket_object_lock_configuration"
+description: |-
+  Provides an S3 bucket Object Lock configuration resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_s3_bucket_object_lock_configuration
+
+Provides an S3 bucket Object Lock configuration resource. For more information about Object Locking, go to [Using S3 Object Lock](https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock.html) in the Amazon S3 User Guide.
+
+~> **NOTE:** This resource **does not enable** Object Lock for **new** buckets. It configures a default retention period for objects placed in the specified bucket.
+Thus, to **enable** Object Lock for a **new** bucket, see the [Using object lock configuration](s3_bucket.html.markdown#using-object-lock-configuration) section in  the `awsS3Bucket` resource or the [Object Lock configuration for a new bucket](#object-lock-configuration-for-a-new-bucket) example below.
+If you want to **enable** Object Lock for an **existing** bucket, contact AWS Support and see the [Object Lock configuration for an existing bucket](#object-lock-configuration-for-an-existing-bucket) example below.
+
+## Example Usage
+
+### Object Lock configuration for a new bucket
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketObjectLockConfigurationA } from "./.gen/providers/aws/s3-bucket-object-lock-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new S3Bucket(this, "example", {
+      bucket: "mybucket",
+      objectLockEnabled: true,
+    });
+    const awsS3BucketObjectLockConfigurationExample =
+      new S3BucketObjectLockConfigurationA(this, "example_1", {
+        bucket: example.id,
+        rule: {
+          defaultRetention: {
+            days: 5,
+            mode: "COMPLIANCE",
+          },
+        },
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketObjectLockConfigurationExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### Object Lock configuration for an existing bucket
+
+This is a multistep process that requires AWS Support intervention.
+
+1. Enable versioning on your S3 bucket, if you have not already done so.
+Doing so will generate an "Object Lock token" in the back-end.
+
+<!-- markdownlint-disable MD029 -->
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketVersioningA } from "./.gen/providers/aws/s3-bucket-versioning";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new S3Bucket(this, "example", {
+      bucket: "mybucket",
+    });
+    const awsS3BucketVersioningExample = new S3BucketVersioningA(
+      this,
+      "example_1",
+      {
+        bucket: example.id,
+        versioningConfiguration: {
+          status: "Enabled",
+        },
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketVersioningExample.overrideLogicalId("example");
+  }
+}
+
+```
+<!-- markdownlint-disable MD029 -->
+
+2. Contact AWS Support to provide you with the "Object Lock token" for the specified bucket and use the token (or token ID) within your new `awsS3BucketObjectLockConfiguration` resource.
+   Notice the `objectLockEnabled` argument does not need to be specified as it defaults to `enabled`.
+
+<!-- markdownlint-disable MD029 -->
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3BucketObjectLockConfigurationA } from "./.gen/providers/aws/s3-bucket-object-lock-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new S3BucketObjectLockConfigurationA(this, "example", {
+      bucket: Token.asString(awsS3BucketExample.id),
+      rule: {
+        defaultRetention: {
+          days: 5,
+          mode: "COMPLIANCE",
+        },
+      },
+      token:
+        "NG2MKsfoLqV3A+aquXneSG4LOu/ekrlXkRXwIPFVfERT7XOPos+/k444d7RIH0E3W3p5QU6ml2exS2F/eYCFmMWHJ3hFZGk6al1sIJkmNhUMYmsv0jYVQyTTZNLM+DnfooA6SATt39mM1VW1yJh4E+XljMlWzaBwHKbss3/EjlGDjOmVhaSs4Z6427mMCaFD0RLwsYY7zX49gEc31YfOMJGxbXCXSeyNwAhhM/A8UH7gQf38RmjHjjAFbbbLtl8arsxTPW8F1IYohqwmKIr9DnotLLj8Tg44U2SPwujVaqmlKKP9s41rfgb4UbIm7khSafDBng0LGfxC4pMlT9Ny2w==",
+    });
+  }
+}
+
+```
+<!-- markdownlint-disable MD029 -->
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `bucket` - (Required, Forces new resource) Name of the bucket.
+* `expectedBucketOwner` - (Optional, Forces new resource) Account ID of the expected bucket owner.
+* `objectLockEnabled` - (Optional, Forces new resource) Indicates whether this bucket has an Object Lock configuration enabled. Defaults to `enabled`. Valid values: `enabled`.
+* `rule` - (Optional) Configuration block for specifying the Object Lock rule for the specified object. [See below](#rule).
+* `token` - (Optional) Token to allow Object Lock to be enabled for an existing bucket. You must contact AWS support for the bucket's "Object Lock token".
+The token is generated in the back-end when [versioning](https://docs.aws.amazon.com/AmazonS3/latest/userguide/manage-versioning-examples.html) is enabled on a bucket. For more details on versioning, see the [`awsS3BucketVersioning` resource](s3_bucket_versioning.html.markdown).
+
+### rule
+
+The `rule` configuration block supports the following arguments:
+
+* `defaultRetention` - (Required) Configuration block for specifying the default Object Lock retention settings for new objects placed in the specified bucket. [See below](#default_retention).
+
+### default_retention
+
+The `defaultRetention` configuration block supports the following arguments:
+
+* `days` - (Optional, Required if `years` is not specified) Number of days that you want to specify for the default retention period.
+* `mode` - (Required) Default Object Lock retention mode you want to apply to new objects placed in the specified bucket. Valid values: `compliance`, `governance`.
+* `years` - (Optional, Required if `days` is not specified) Number of years that you want to specify for the default retention period.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The `bucket` or `bucket` and `expectedBucketOwner` separated by a comma (`,`) if the latter is provided.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import S3 bucket Object Lock configuration using the `bucket` or using the `bucket` and `expectedBucketOwner` separated by a comma (`,`). For example:
+
+If the owner (account ID) of the source bucket is the same account used to configure the Terraform AWS Provider, import using the `bucket`:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+If the owner (account ID) of the source bucket differs from the account used to configure the Terraform AWS Provider, import using the `bucket` and `expectedBucketOwner` separated by a comma (`,`):
+
+import {
+  to = aws_s3_bucket_object_lock_configuration.example
+  id = "bucket-name,123456789012"
+}
+
+**Using `terraform import` to import** S3 bucket Object Lock configuration using the `bucket` or using the `bucket` and `expectedBucketOwner` separated by a comma (`,`). For example:
+
+If the owner (account ID) of the source bucket is the same account used to configure the Terraform AWS Provider, import using the `bucket`:
+
+```console
+% terraform import aws_s3_bucket_object_lock_configuration.example bucket-name
+```
+
+If the owner (account ID) of the source bucket differs from the account used to configure the Terraform AWS Provider, import using the `bucket` and `expectedBucketOwner` separated by a comma (`,`):
+
+```console
+% terraform import aws_s3_bucket_object_lock_configuration.example bucket-name,123456789012
+```
+
+<!-- cache-key: cdktf-0.18.0 input-48934903e4041e09bace32f0ac7c06d12e2ec061fd285d0370242e8daf326808 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/s3_bucket_ownership_controls.html.markdown b/website/docs/cdktf/typescript/r/s3_bucket_ownership_controls.html.markdown
new file mode 100644
index 00000000000..12dabc00f42
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/s3_bucket_ownership_controls.html.markdown
@@ -0,0 +1,94 @@
+---
+subcategory: "S3 (Simple Storage)"
+layout: "aws"
+page_title: "AWS: aws_s3_bucket_ownership_controls"
+description: |-
+  Manages S3 Bucket Ownership Controls.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_s3_bucket_ownership_controls
+
+Provides a resource to manage S3 Bucket Ownership Controls. For more information, see the [S3 Developer Guide](https://docs.aws.amazon.com/AmazonS3/latest/dev/about-object-ownership.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketOwnershipControls } from "./.gen/providers/aws/s3-bucket-ownership-controls";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new S3Bucket(this, "example", {
+      bucket: "example",
+    });
+    const awsS3BucketOwnershipControlsExample = new S3BucketOwnershipControls(
+      this,
+      "example_1",
+      {
+        bucket: example.id,
+        rule: {
+          objectOwnership: "BucketOwnerPreferred",
+        },
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketOwnershipControlsExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `bucket` - (Required) Name of the bucket that you want to associate this access point with.
+* `rule` - (Required) Configuration block(s) with Ownership Controls rules. Detailed below.
+
+### rule Configuration Block
+
+The following arguments are required:
+
+* `objectOwnership` - (Required) Object ownership. Valid values: `bucketOwnerPreferred`, `objectWriter` or `bucketOwnerEnforced`
+    * `bucketOwnerPreferred` - Objects uploaded to the bucket change ownership to the bucket owner if the objects are uploaded with the `bucketOwnerFullControl` canned ACL.
+    * `objectWriter` - Uploading account will own the object if the object is uploaded with the `bucketOwnerFullControl` canned ACL.
+    * `bucketOwnerEnforced` - Bucket owner automatically owns and has full control over every object in the bucket. ACLs no longer affect permissions to data in the S3 bucket.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - S3 Bucket name.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import S3 Bucket Ownership Controls using S3 Bucket name. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import S3 Bucket Ownership Controls using S3 Bucket name. For example:
+
+```console
+% terraform import aws_s3_bucket_ownership_controls.example my-bucket
+```
+
+<!-- cache-key: cdktf-0.18.0 input-efb4f4321500cf116368caed3eeb4a2c9b6076d8246ed5f36076a0ed3015eaff -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/s3_bucket_policy.html.markdown b/website/docs/cdktf/typescript/r/s3_bucket_policy.html.markdown
new file mode 100644
index 00000000000..9d03734ec4e
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/s3_bucket_policy.html.markdown
@@ -0,0 +1,104 @@
+---
+subcategory: "S3 (Simple Storage)"
+layout: "aws"
+page_title: "AWS: aws_s3_bucket_policy"
+description: |-
+  Attaches a policy to an S3 bucket resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_s3_bucket_policy
+
+Attaches a policy to an S3 bucket resource.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketPolicy } from "./.gen/providers/aws/s3-bucket-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new S3Bucket(this, "example", {
+      bucket: "my-tf-test-bucket",
+    });
+    const allowAccessFromAnotherAccount = new DataAwsIamPolicyDocument(
+      this,
+      "allow_access_from_another_account",
+      {
+        statement: [
+          {
+            actions: ["s3:GetObject", "s3:ListBucket"],
+            principals: [
+              {
+                identifiers: ["123456789012"],
+                type: "AWS",
+              },
+            ],
+            resources: [example.arn, "${" + example.arn + "}/*"],
+          },
+        ],
+      }
+    );
+    const awsS3BucketPolicyAllowAccessFromAnotherAccount = new S3BucketPolicy(
+      this,
+      "allow_access_from_another_account_2",
+      {
+        bucket: example.id,
+        policy: Token.asString(allowAccessFromAnotherAccount.json),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketPolicyAllowAccessFromAnotherAccount.overrideLogicalId(
+      "allow_access_from_another_account"
+    );
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `bucket` - (Required) Name of the bucket to which to apply the policy.
+* `policy` - (Required) Text of the policy. Although this is a bucket policy rather than an IAM policy, the [`awsIamPolicyDocument`](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) data source may be used, so long as it specifies a principal. For more information about building AWS IAM policy documents with Terraform, see the [AWS IAM Policy Document Guide](https://learn.hashicorp.com/terraform/aws/iam-policy). Note: Bucket policies are limited to 20 KB in size.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import S3 bucket policies using the bucket name. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import S3 bucket policies using the bucket name. For example:
+
+```console
+% terraform import aws_s3_bucket_policy.allow_access_from_another_account my-tf-test-bucket
+```
+
+<!-- cache-key: cdktf-0.18.0 input-78dda90d0687f88ff8f30cf20c2b7dab5c85cc20a65eb0998240609b14380055 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/s3_bucket_public_access_block.html.markdown b/website/docs/cdktf/typescript/r/s3_bucket_public_access_block.html.markdown
new file mode 100644
index 00000000000..48af7ea17a7
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/s3_bucket_public_access_block.html.markdown
@@ -0,0 +1,94 @@
+---
+subcategory: "S3 (Simple Storage)"
+layout: "aws"
+page_title: "AWS: aws_s3_bucket_public_access_block"
+description: |-
+  Manages S3 bucket-level Public Access Block Configuration
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_s3_bucket_public_access_block
+
+Manages S3 bucket-level Public Access Block configuration. For more information about these settings, see the [AWS S3 Block Public Access documentation](https://docs.aws.amazon.com/AmazonS3/latest/dev/access-control-block-public-access.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketPublicAccessBlock } from "./.gen/providers/aws/s3-bucket-public-access-block";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new S3Bucket(this, "example", {
+      bucket: "example",
+    });
+    const awsS3BucketPublicAccessBlockExample = new S3BucketPublicAccessBlock(
+      this,
+      "example_1",
+      {
+        blockPublicAcls: true,
+        blockPublicPolicy: true,
+        bucket: example.id,
+        ignorePublicAcls: true,
+        restrictPublicBuckets: true,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketPublicAccessBlockExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `bucket` - (Required) S3 Bucket to which this Public Access Block configuration should be applied.
+* `blockPublicAcls` - (Optional) Whether Amazon S3 should block public ACLs for this bucket. Defaults to `false`. Enabling this setting does not affect existing policies or ACLs. When set to `true` causes the following behavior:
+    * PUT Bucket acl and PUT Object acl calls will fail if the specified ACL allows public access.
+    * PUT Object calls will fail if the request includes an object ACL.
+* `blockPublicPolicy` - (Optional) Whether Amazon S3 should block public bucket policies for this bucket. Defaults to `false`. Enabling this setting does not affect the existing bucket policy. When set to `true` causes Amazon S3 to:
+    * Reject calls to PUT Bucket policy if the specified bucket policy allows public access.
+* `ignorePublicAcls` - (Optional) Whether Amazon S3 should ignore public ACLs for this bucket. Defaults to `false`. Enabling this setting does not affect the persistence of any existing ACLs and doesn't prevent new public ACLs from being set. When set to `true` causes Amazon S3 to:
+    * Ignore public ACLs on this bucket and any objects that it contains.
+* `restrictPublicBuckets` - (Optional) Whether Amazon S3 should restrict public bucket policies for this bucket. Defaults to `false`. Enabling this setting does not affect the previously stored bucket policy, except that public and cross-account access within the public bucket policy, including non-public delegation to specific accounts, is blocked. When set to `true`:
+    * Only the bucket owner and AWS Services can access this buckets if it has a public policy.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Name of the S3 bucket the configuration is attached to
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsS3BucketPublicAccessBlock` using the bucket name. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsS3BucketPublicAccessBlock` using the bucket name. For example:
+
+```console
+% terraform import aws_s3_bucket_public_access_block.example my-bucket
+```
+
+<!-- cache-key: cdktf-0.18.0 input-2e16c719c6f0cfe951257236cc5f5c735596db2bb7566ee8238215516c15c3f7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/s3_bucket_replication_configuration.html.markdown b/website/docs/cdktf/typescript/r/s3_bucket_replication_configuration.html.markdown
new file mode 100644
index 00000000000..0655f149cde
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/s3_bucket_replication_configuration.html.markdown
@@ -0,0 +1,513 @@
+---
+subcategory: "S3 (Simple Storage)"
+layout: "aws"
+page_title: "AWS: aws_s3_bucket_replication_configuration"
+description: |-
+  Provides a S3 bucket replication configuration resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_s3_bucket_replication_configuration
+
+Provides an independent configuration resource for S3 bucket [replication configuration](http://docs.aws.amazon.com/AmazonS3/latest/dev/crr.html).
+
+~> **NOTE:** S3 Buckets only support a single replication configuration. Declaring multiple `awsS3BucketReplicationConfiguration` resources to the same S3 Bucket will cause a perpetual difference in configuration.
+
+## Example Usage
+
+### Using replication configuration
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { IamPolicy } from "./.gen/providers/aws/iam-policy";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+import { IamRolePolicyAttachment } from "./.gen/providers/aws/iam-role-policy-attachment";
+import { AwsProvider } from "./.gen/providers/aws/provider";
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketAcl } from "./.gen/providers/aws/s3-bucket-acl";
+import { S3BucketReplicationConfigurationA } from "./.gen/providers/aws/s3-bucket-replication-configuration";
+import { S3BucketVersioningA } from "./.gen/providers/aws/s3-bucket-versioning";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AwsProvider(this, "aws", {
+      region: "eu-west-1",
+    });
+    const central = new AwsProvider(this, "aws_1", {
+      alias: "central",
+      region: "eu-central-1",
+    });
+    const destination = new S3Bucket(this, "destination", {
+      bucket: "tf-test-bucket-destination-12345",
+    });
+    const source = new S3Bucket(this, "source", {
+      bucket: "tf-test-bucket-source-12345",
+      provider: central,
+    });
+    new S3BucketAcl(this, "source_bucket_acl", {
+      acl: "private",
+      bucket: source.id,
+      provider: central,
+    });
+    const awsS3BucketVersioningDestination = new S3BucketVersioningA(
+      this,
+      "destination_5",
+      {
+        bucket: destination.id,
+        versioningConfiguration: {
+          status: "Enabled",
+        },
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketVersioningDestination.overrideLogicalId("destination");
+    const awsS3BucketVersioningSource = new S3BucketVersioningA(
+      this,
+      "source_6",
+      {
+        bucket: source.id,
+        provider: central,
+        versioningConfiguration: {
+          status: "Enabled",
+        },
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketVersioningSource.overrideLogicalId("source");
+    const assumeRole = new DataAwsIamPolicyDocument(this, "assume_role", {
+      statement: [
+        {
+          actions: ["sts:AssumeRole"],
+          effect: "Allow",
+          principals: [
+            {
+              identifiers: ["s3.amazonaws.com"],
+              type: "Service",
+            },
+          ],
+        },
+      ],
+    });
+    const replication = new DataAwsIamPolicyDocument(this, "replication", {
+      statement: [
+        {
+          actions: ["s3:GetReplicationConfiguration", "s3:ListBucket"],
+          effect: "Allow",
+          resources: [source.arn],
+        },
+        {
+          actions: [
+            "s3:GetObjectVersionForReplication",
+            "s3:GetObjectVersionAcl",
+            "s3:GetObjectVersionTagging",
+          ],
+          effect: "Allow",
+          resources: ["${" + source.arn + "}/*"],
+        },
+        {
+          actions: [
+            "s3:ReplicateObject",
+            "s3:ReplicateDelete",
+            "s3:ReplicateTags",
+          ],
+          effect: "Allow",
+          resources: ["${" + destination.arn + "}/*"],
+        },
+      ],
+    });
+    const awsIamPolicyReplication = new IamPolicy(this, "replication_9", {
+      name: "tf-iam-role-policy-replication-12345",
+      policy: Token.asString(replication.json),
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamPolicyReplication.overrideLogicalId("replication");
+    const awsIamRoleReplication = new IamRole(this, "replication_10", {
+      assumeRolePolicy: Token.asString(assumeRole.json),
+      name: "tf-iam-role-replication-12345",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamRoleReplication.overrideLogicalId("replication");
+    const awsIamRolePolicyAttachmentReplication = new IamRolePolicyAttachment(
+      this,
+      "replication_11",
+      {
+        policyArn: Token.asString(awsIamPolicyReplication.arn),
+        role: Token.asString(awsIamRoleReplication.name),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamRolePolicyAttachmentReplication.overrideLogicalId("replication");
+    const awsS3BucketReplicationConfigurationReplication =
+      new S3BucketReplicationConfigurationA(this, "replication_12", {
+        bucket: source.id,
+        dependsOn: [awsS3BucketVersioningSource],
+        provider: central,
+        role: Token.asString(awsIamRoleReplication.arn),
+        rule: [
+          {
+            destination: {
+              bucket: destination.arn,
+              storageClass: "STANDARD",
+            },
+            filter: {
+              prefix: "foo",
+            },
+            id: "foobar",
+            status: "Enabled",
+          },
+        ],
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketReplicationConfigurationReplication.overrideLogicalId(
+      "replication"
+    );
+  }
+}
+
+```
+
+### Bi-Directional Replication
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketReplicationConfigurationA } from "./.gen/providers/aws/s3-bucket-replication-configuration";
+import { S3BucketVersioningA } from "./.gen/providers/aws/s3-bucket-versioning";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const east = new S3Bucket(this, "east", {
+      bucket: "tf-test-bucket-east-12345",
+    });
+    const west = new S3Bucket(this, "west", {
+      bucket: "tf-test-bucket-west-12345",
+      provider: awsWest,
+    });
+    const awsS3BucketVersioningEast = new S3BucketVersioningA(this, "east_2", {
+      bucket: east.id,
+      versioningConfiguration: {
+        status: "Enabled",
+      },
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketVersioningEast.overrideLogicalId("east");
+    const awsS3BucketVersioningWest = new S3BucketVersioningA(this, "west_3", {
+      bucket: west.id,
+      provider: awsWest,
+      versioningConfiguration: {
+        status: "Enabled",
+      },
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketVersioningWest.overrideLogicalId("west");
+    new S3BucketReplicationConfigurationA(this, "east_to_west", {
+      bucket: east.id,
+      dependsOn: [awsS3BucketVersioningEast],
+      role: eastReplication.arn,
+      rule: [
+        {
+          destination: {
+            bucket: west.arn,
+            storageClass: "STANDARD",
+          },
+          filter: {
+            prefix: "foo",
+          },
+          id: "foobar",
+          status: "Enabled",
+        },
+      ],
+    });
+    new S3BucketReplicationConfigurationA(this, "west_to_east", {
+      bucket: west.id,
+      dependsOn: [awsS3BucketVersioningWest],
+      provider: awsWest,
+      role: westReplication.arn,
+      rule: [
+        {
+          destination: {
+            bucket: east.arn,
+            storageClass: "STANDARD",
+          },
+          filter: {
+            prefix: "foo",
+          },
+          id: "foobar",
+          status: "Enabled",
+        },
+      ],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `bucket` - (Required) Name of the source S3 bucket you want Amazon S3 to monitor.
+* `role` - (Required) ARN of the IAM role for Amazon S3 to assume when replicating the objects.
+* `rule` - (Required) List of configuration blocks describing the rules managing the replication. [See below](#rule).
+* `token` - (Optional) Token to allow replication to be enabled on an Object Lock-enabled bucket. You must contact AWS support for the bucket's "Object Lock token".
+For more details, see [Using S3 Object Lock with replication](https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock-managing.html#object-lock-managing-replication).
+
+### rule
+
+~> **NOTE:** Replication to multiple destination buckets requires that `priority` is specified in the `rule` object. If the corresponding rule requires no filter, an empty configuration block `filter {}` must be specified.
+
+~> **NOTE:** Amazon S3's latest version of the replication configuration is V2, which includes the `filter` attribute for replication rules.
+
+~> **NOTE:** The `existingObjectReplication` parameter is not supported by Amazon S3 at this time and should not be included in your `rule` configurations. Specifying this parameter will result in `malformedXml` errors.
+To replicate existing objects, please refer to the [Replicating existing objects with S3 Batch Replication](https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-batch-replication-batch.html) documentation in the Amazon S3 User Guide.
+
+The `rule` configuration block supports the following arguments:
+
+* `deleteMarkerReplication` - (Optional) Whether delete markers are replicated. This argument is only valid with V2 replication configurations (i.e., when `filter` is used)[documented below](#delete_marker_replication).
+* `destination` - (Required) Specifies the destination for the rule. [See below](#destination).
+* `existingObjectReplication` - (Optional) Replicate existing objects in the source bucket according to the rule configurations. [See below](#existing_object_replication).
+* `filter` - (Optional, Conflicts with `prefix`) Filter that identifies subset of objects to which the replication rule applies. [See below](#filter). If not specified, the `rule` will default to using `prefix`.
+* `id` - (Optional) Unique identifier for the rule. Must be less than or equal to 255 characters in length.
+* `prefix` - (Optional, Conflicts with `filter`, **Deprecated**) Object key name prefix identifying one or more objects to which the rule applies. Must be less than or equal to 1024 characters in length. Defaults to an empty string (`""`) if `filter` is not specified.
+* `priority` - (Optional) Priority associated with the rule. Priority should only be set if `filter` is configured. If not provided, defaults to `0`. Priority must be unique between multiple rules.
+* `sourceSelectionCriteria` - (Optional) Specifies special object selection criteria. [See below](#source_selection_criteria).
+* `status` - (Required) Status of the rule. Either `"enabled"` or `"disabled"`. The rule is ignored if status is not "Enabled".
+
+### delete_marker_replication
+
+~> **NOTE:** This argument is only available with V2 replication configurations.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+The `deleteMarkerReplication` configuration block supports the following arguments:
+
+* `status` - (Required) Whether delete markers should be replicated. Either `"enabled"` or `"disabled"`.
+
+### destination
+
+The `destination` configuration block supports the following arguments:
+
+* `accessControlTranslation` - (Optional) Configuration block that specifies the overrides to use for object owners on replication. [See below](#access_control_translation). Specify this only in a cross-account scenario (where source and destination bucket owners are not the same), and you want to change replica ownership to the AWS account that owns the destination bucket. If this is not specified in the replication configuration, the replicas are owned by same AWS account that owns the source object. Must be used in conjunction with `account` owner override configuration.
+* `account` - (Optional) Account ID to specify the replica ownership. Must be used in conjunction with `accessControlTranslation` override configuration.
+* `bucket` - (Required) ARN of the bucket where you want Amazon S3 to store the results.
+* `encryptionConfiguration` - (Optional) Configuration block that provides information about encryption. [See below](#encryption_configuration). If `sourceSelectionCriteria` is specified, you must specify this element.
+* `metrics` - (Optional) Configuration block that specifies replication metrics-related settings enabling replication metrics and events. [See below](#metrics).
+* `replicationTime` - (Optional) Configuration block that specifies S3 Replication Time Control (S3 RTC), including whether S3 RTC is enabled and the time when all objects and operations on objects must be replicated. [See below](#replication_time). Replication Time Control must be used in conjunction with `metrics`.
+* `storageClass` - (Optional) The [storage class](https://docs.aws.amazon.com/AmazonS3/latest/API/API_Destination.html#AmazonS3-Type-Destination-StorageClass) used to store the object. By default, Amazon S3 uses the storage class of the source object to create the object replica.
+
+### access_control_translation
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+The `accessControlTranslation` configuration block supports the following arguments:
+
+* `owner` - (Required) Specifies the replica ownership. For default and valid values, see [PUT bucket replication](https://docs.aws.amazon.com/AmazonS3/latest/API/RESTBucketPUTreplication.html) in the Amazon S3 API Reference. Valid values: `destination`.
+
+### encryption_configuration
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+The `encryptionConfiguration` configuration block supports the following arguments:
+
+* `replicaKmsKeyId` - (Required) ID (Key ARN or Alias ARN) of the customer managed AWS KMS key stored in AWS Key Management Service (KMS) for the destination bucket.
+
+### metrics
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+The `metrics` configuration block supports the following arguments:
+
+* `eventThreshold` - (Optional) Configuration block that specifies the time threshold for emitting the `s3:replication:operationMissedThreshold` event. [See below](#event_threshold).
+* `status` - (Required) Status of the Destination Metrics. Either `"enabled"` or `"disabled"`.
+
+### event_threshold
+
+The `eventThreshold` configuration block supports the following arguments:
+
+* `minutes` - (Required) Time in minutes. Valid values: `15`.
+
+### replication_time
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+The `replicationTime` configuration block supports the following arguments:
+
+* `status` - (Required) Status of the Replication Time Control. Either `"enabled"` or `"disabled"`.
+* `time` - (Required) Configuration block specifying the time by which replication should be complete for all objects and operations on objects. [See below](#time).
+
+### time
+
+The `time` configuration block supports the following arguments:
+
+* `minutes` - (Required) Time in minutes. Valid values: `15`.
+
+### existing_object_replication
+
+~> **NOTE:** Replication for existing objects requires activation by AWS Support.  See [userguide/replication-what-is-isnot-replicated](https://docs.aws.amazon.com/AmazonS3/latest/userguide/replication-what-is-isnot-replicated.html#existing-object-replication)
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+The `existingObjectReplication` configuration block supports the following arguments:
+
+* `status` - (Required) Whether the existing objects should be replicated. Either `"enabled"` or `"disabled"`.
+
+### filter
+
+~> **NOTE:** The `filter` argument must be specified as either an empty configuration block (`filter {}`) to imply the rule requires no filter or with exactly one of `prefix`, `tag`, or `and`.
+Replication configuration V1 supports filtering based on only the `prefix` attribute. For backwards compatibility, Amazon S3 continues to support the V1 configuration.
+
+The `filter` configuration block supports the following arguments:
+
+* `and` - (Optional) Configuration block for specifying rule filters. This element is required only if you specify more than one filter. See [and](#and) below for more details.
+* `prefix` - (Optional) Object key name prefix that identifies subset of objects to which the rule applies. Must be less than or equal to 1024 characters in length.
+* `tag` - (Optional) Configuration block for specifying a tag key and value. [See below](#tag).
+
+### and
+
+The `and` configuration block supports the following arguments:
+
+* `prefix` - (Optional) Object key name prefix that identifies subset of objects to which the rule applies. Must be less than or equal to 1024 characters in length.
+* `tags` - (Optional, Required if `prefix` is configured) Map of tags (key and value pairs) that identifies a subset of objects to which the rule applies. The rule applies only to objects having all the tags in its tagset.
+
+### tag
+
+The `tag` configuration block supports the following arguments:
+
+* `key` - (Required) Name of the object key.
+* `value` - (Required) Value of the tag.
+
+### source_selection_criteria
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+The `sourceSelectionCriteria` configuration block supports the following arguments:
+
+* `replicaModifications` - (Optional) Configuration block that you can specify for selections for modifications on replicas. Amazon S3 doesn't replicate replica modifications by default. In the latest version of replication configuration (when `filter` is specified), you can specify this element and set the status to `enabled` to replicate modifications on replicas.
+
+* `sseKmsEncryptedObjects` - (Optional) Configuration block for filter information for the selection of Amazon S3 objects encrypted with AWS KMS. If specified, `replicaKmsKeyId` in `destination` `encryptionConfiguration` must be specified as well.
+
+### replica_modifications
+
+The `replicaModifications` configuration block supports the following arguments:
+
+* `status` - (Required) Whether the existing objects should be replicated. Either `"enabled"` or `"disabled"`.
+
+### sse_kms_encrypted_objects
+
+The `sseKmsEncryptedObjects` configuration block supports the following arguments:
+
+* `status` - (Required) Whether the existing objects should be replicated. Either `"enabled"` or `"disabled"`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - S3 source bucket name.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import S3 bucket replication configuration using the `bucket`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import S3 bucket replication configuration using the `bucket`. For example:
+
+```console
+% terraform import aws_s3_bucket_replication_configuration.replication bucket-name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-fb3dd63caebf8f9a5354d73fe9c5e62bdefe563725f98aa597f6c1c77451e28c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/s3_bucket_request_payment_configuration.html.markdown b/website/docs/cdktf/typescript/r/s3_bucket_request_payment_configuration.html.markdown
new file mode 100644
index 00000000000..5463b103562
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/s3_bucket_request_payment_configuration.html.markdown
@@ -0,0 +1,100 @@
+---
+subcategory: "S3 (Simple Storage)"
+layout: "aws"
+page_title: "AWS: aws_s3_bucket_request_payment_configuration"
+description: |-
+  Provides an S3 bucket request payment configuration resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_s3_bucket_request_payment_configuration
+
+Provides an S3 bucket request payment configuration resource. For more information, see [Requester Pays Buckets](https://docs.aws.amazon.com/AmazonS3/latest/dev/RequesterPaysBuckets.html).
+
+~> **NOTE:** Destroying an `awsS3BucketRequestPaymentConfiguration` resource resets the bucket's `payer` to the S3 default: the bucket owner.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3BucketRequestPaymentConfiguration } from "./.gen/providers/aws/s3-bucket-request-payment-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new S3BucketRequestPaymentConfiguration(this, "example", {
+      bucket: Token.asString(awsS3BucketExample.id),
+      payer: "Requester",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `bucket` - (Required, Forces new resource) Name of the bucket.
+* `expectedBucketOwner` - (Optional, Forces new resource) Account ID of the expected bucket owner.
+* `payer` - (Required) Specifies who pays for the download and request fees. Valid values: `bucketOwner`, `requester`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The `bucket` or `bucket` and `expectedBucketOwner` separated by a comma (`,`) if the latter is provided.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import S3 bucket request payment configuration using the `bucket` or using the `bucket` and `expectedBucketOwner` separated by a comma (`,`). For example:
+
+If the owner (account ID) of the source bucket is the same account used to configure the Terraform AWS Provider, import using the `bucket`:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+If the owner (account ID) of the source bucket differs from the account used to configure the Terraform AWS Provider, import using the `bucket` and `expectedBucketOwner` separated by a comma (`,`):
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+**Using `terraform import` to import** S3 bucket request payment configuration using the `bucket` or using the `bucket` and `expectedBucketOwner` separated by a comma (`,`). For example:
+
+If the owner (account ID) of the source bucket is the same account used to configure the Terraform AWS Provider, import using the `bucket`:
+
+```console
+% terraform import aws_s3_bucket_request_payment_configuration.example bucket-name
+```
+
+If the owner (account ID) of the source bucket differs from the account used to configure the Terraform AWS Provider, import using the `bucket` and `expectedBucketOwner` separated by a comma (`,`):
+
+```console
+% terraform import aws_s3_bucket_request_payment_configuration.example bucket-name,123456789012
+```
+
+<!-- cache-key: cdktf-0.18.0 input-924fef526db0a2463aa429766935ae82fbffff4fc791593d59efff4dfb0debed -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/s3_bucket_server_side_encryption_configuration.html.markdown b/website/docs/cdktf/typescript/r/s3_bucket_server_side_encryption_configuration.html.markdown
new file mode 100644
index 00000000000..738c5317081
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/s3_bucket_server_side_encryption_configuration.html.markdown
@@ -0,0 +1,130 @@
+---
+subcategory: "S3 (Simple Storage)"
+layout: "aws"
+page_title: "AWS: aws_s3_bucket_server_side_encryption_configuration"
+description: |-
+  Provides a S3 bucket server-side encryption configuration resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_s3_bucket_server_side_encryption_configuration
+
+Provides a S3 bucket server-side encryption configuration resource.
+
+~> **NOTE:** Destroying an `awsS3BucketServerSideEncryptionConfiguration` resource resets the bucket to [Amazon S3 bucket default encryption](https://docs.aws.amazon.com/AmazonS3/latest/userguide/default-encryption-faq.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { KmsKey } from "./.gen/providers/aws/kms-key";
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketServerSideEncryptionConfigurationA } from "./.gen/providers/aws/s3-bucket-server-side-encryption-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const mykey = new KmsKey(this, "mykey", {
+      deletionWindowInDays: 10,
+      description: "This key is used to encrypt bucket objects",
+    });
+    const mybucket = new S3Bucket(this, "mybucket", {
+      bucket: "mybucket",
+    });
+    new S3BucketServerSideEncryptionConfigurationA(this, "example", {
+      bucket: mybucket.id,
+      rule: [
+        {
+          applyServerSideEncryptionByDefault: {
+            kmsMasterKeyId: mykey.arn,
+            sseAlgorithm: "aws:kms",
+          },
+        },
+      ],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `bucket` - (Required, Forces new resource) ID (name) of the bucket.
+* `expectedBucketOwner` - (Optional, Forces new resource) Account ID of the expected bucket owner.
+* `rule` - (Required) Set of server-side encryption configuration rules. [See below](#rule). Currently, only a single rule is supported.
+
+### rule
+
+The `rule` configuration block supports the following arguments:
+
+* `applyServerSideEncryptionByDefault` - (Optional) Single object for setting server-side encryption by default. [See below](#apply_server_side_encryption_by_default).
+* `bucketKeyEnabled` - (Optional) Whether or not to use [Amazon S3 Bucket Keys](https://docs.aws.amazon.com/AmazonS3/latest/dev/bucket-key.html) for SSE-KMS.
+
+### apply_server_side_encryption_by_default
+
+The `applyServerSideEncryptionByDefault` configuration block supports the following arguments:
+
+* `sseAlgorithm` - (Required) Server-side encryption algorithm to use. Valid values are `aes256`, `aws:kms`, and `aws:kms:dsse`
+* `kmsMasterKeyId` - (Optional) AWS KMS master key ID used for the SSE-KMS encryption. This can only be used when you set the value of `sseAlgorithm` as `aws:kms`. The default `aws/s3` AWS KMS master key is used if this element is absent while the `sseAlgorithm` is `aws:kms`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The `bucket` or `bucket` and `expectedBucketOwner` separated by a comma (`,`) if the latter is provided.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import S3 bucket server-side encryption configuration using the `bucket` or using the `bucket` and `expectedBucketOwner` separated by a comma (`,`). For example:
+
+If the owner (account ID) of the source bucket is the same account used to configure the Terraform AWS Provider, import using the `bucket`:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+If the owner (account ID) of the source bucket differs from the account used to configure the Terraform AWS Provider, import using the `bucket` and `expectedBucketOwner` separated by a comma (`,`):
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+**Using `terraform import` to import** S3 bucket server-side encryption configuration using the `bucket` or using the `bucket` and `expectedBucketOwner` separated by a comma (`,`). For example:
+
+If the owner (account ID) of the source bucket is the same account used to configure the Terraform AWS Provider, import using the `bucket`:
+
+```console
+% terraform import aws_s3_bucket_server_side_encryption_configuration.example bucket-name
+```
+
+If the owner (account ID) of the source bucket differs from the account used to configure the Terraform AWS Provider, import using the `bucket` and `expectedBucketOwner` separated by a comma (`,`):
+
+```console
+% terraform import aws_s3_bucket_server_side_encryption_configuration.example bucket-name,123456789012
+```
+
+<!-- cache-key: cdktf-0.18.0 input-20fc65b1b77aa12edd3562b565214ad5b0b456226cc87c90a6ba2cfb792b9ea9 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/s3_bucket_versioning.html.markdown b/website/docs/cdktf/typescript/r/s3_bucket_versioning.html.markdown
new file mode 100644
index 00000000000..b3f7d4a8597
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/s3_bucket_versioning.html.markdown
@@ -0,0 +1,215 @@
+---
+subcategory: "S3 (Simple Storage)"
+layout: "aws"
+page_title: "AWS: aws_s3_bucket_versioning"
+description: |-
+  Provides an S3 bucket versioning resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_s3_bucket_versioning
+
+Provides a resource for controlling versioning on an S3 bucket.
+Deleting this resource will either suspend versioning on the associated S3 bucket or
+simply remove the resource from Terraform state if the associated S3 bucket is unversioned.
+
+For more information, see [How S3 versioning works](https://docs.aws.amazon.com/AmazonS3/latest/userguide/manage-versioning-examples.html).
+
+~> **NOTE:** If you are enabling versioning on the bucket for the first time, AWS recommends that you wait for 15 minutes after enabling versioning before issuing write operations (PUT or DELETE) on objects in the bucket.
+
+## Example Usage
+
+### With Versioning Enabled
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketAcl } from "./.gen/providers/aws/s3-bucket-acl";
+import { S3BucketVersioningA } from "./.gen/providers/aws/s3-bucket-versioning";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new S3Bucket(this, "example", {
+      bucket: "example-bucket",
+    });
+    const awsS3BucketAclExample = new S3BucketAcl(this, "example_1", {
+      acl: "private",
+      bucket: example.id,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketAclExample.overrideLogicalId("example");
+    new S3BucketVersioningA(this, "versioning_example", {
+      bucket: example.id,
+      versioningConfiguration: {
+        status: "Enabled",
+      },
+    });
+  }
+}
+
+```
+
+### With Versioning Disabled
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketAcl } from "./.gen/providers/aws/s3-bucket-acl";
+import { S3BucketVersioningA } from "./.gen/providers/aws/s3-bucket-versioning";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new S3Bucket(this, "example", {
+      bucket: "example-bucket",
+    });
+    const awsS3BucketAclExample = new S3BucketAcl(this, "example_1", {
+      acl: "private",
+      bucket: example.id,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketAclExample.overrideLogicalId("example");
+    new S3BucketVersioningA(this, "versioning_example", {
+      bucket: example.id,
+      versioningConfiguration: {
+        status: "Disabled",
+      },
+    });
+  }
+}
+
+```
+
+### Object Dependency On Versioning
+
+When you create an object whose `versionId` you need and an `awsS3BucketVersioning` resource in the same configuration, you are more likely to have success by ensuring the `s3Object` depends either implicitly (see below) or explicitly (i.e., using `depends_on = [aws_s3_bucket_versioning.example]`) on the `awsS3BucketVersioning` resource.
+
+~> **NOTE:** For critical and/or production S3 objects, do not create a bucket, enable versioning, and create an object in the bucket within the same configuration. Doing so will not allow the AWS-recommended 15 minutes between enabling versioning and writing to the bucket.
+
+This example shows the `awsS3ObjectExample` depending implicitly on the versioning resource through the reference to `awsS3BucketVersioningExampleBucket` to define `bucket`:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketVersioningA } from "./.gen/providers/aws/s3-bucket-versioning";
+import { S3Object } from "./.gen/providers/aws/s3-object";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new S3Bucket(this, "example", {
+      bucket: "yotto",
+    });
+    const awsS3BucketVersioningExample = new S3BucketVersioningA(
+      this,
+      "example_1",
+      {
+        bucket: example.id,
+        versioningConfiguration: {
+          status: "Enabled",
+        },
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketVersioningExample.overrideLogicalId("example");
+    const awsS3ObjectExample = new S3Object(this, "example_2", {
+      bucket: Token.asString(awsS3BucketVersioningExample.id),
+      key: "droeloe",
+      source: "example.txt",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3ObjectExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `bucket` - (Required, Forces new resource) Name of the S3 bucket.
+* `versioningConfiguration` - (Required) Configuration block for the versioning parameters. [See below](#versioning_configuration).
+* `expectedBucketOwner` - (Optional, Forces new resource) Account ID of the expected bucket owner.
+* `mfa` - (Optional, Required if `versioningConfiguration` `mfaDelete` is enabled) Concatenation of the authentication device's serial number, a space, and the value that is displayed on your authentication device.
+
+### versioning_configuration
+
+~> **Note:** While the `versioningConfigurationStatus` parameter supports `disabled`, this value is only intended for _creating_ or _importing_ resources that correspond to unversioned S3 buckets.
+Updating the value from `enabled` or `suspended` to `disabled` will result in errors as the AWS S3 API does not support returning buckets to an unversioned state.
+
+The `versioningConfiguration` configuration block supports the following arguments:
+
+* `status` - (Required) Versioning state of the bucket. Valid values: `enabled`, `suspended`, or `disabled`. `disabled` should only be used when creating or importing resources that correspond to unversioned S3 buckets.
+* `mfaDelete` - (Optional) Specifies whether MFA delete is enabled in the bucket versioning configuration. Valid values: `enabled` or `disabled`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The `bucket` or `bucket` and `expectedBucketOwner` separated by a comma (`,`) if the latter is provided.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import S3 bucket versioning using the `bucket` or using the `bucket` and `expectedBucketOwner` separated by a comma (`,`). For example:
+
+If the owner (account ID) of the source bucket is the same account used to configure the Terraform AWS Provider, import using the `bucket`:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+If the owner (account ID) of the source bucket differs from the account used to configure the Terraform AWS Provider, import using the `bucket` and `expectedBucketOwner` separated by a comma (`,`):
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+**Using `terraform import` to import** S3 bucket versioning using the `bucket` or using the `bucket` and `expectedBucketOwner` separated by a comma (`,`). For example:
+
+If the owner (account ID) of the source bucket is the same account used to configure the Terraform AWS Provider, import using the `bucket`:
+
+```console
+% terraform import aws_s3_bucket_versioning.example bucket-name
+```
+
+If the owner (account ID) of the source bucket differs from the account used to configure the Terraform AWS Provider, import using the `bucket` and `expectedBucketOwner` separated by a comma (`,`):
+
+```console
+% terraform import aws_s3_bucket_versioning.example bucket-name,123456789012
+```
+
+<!-- cache-key: cdktf-0.18.0 input-3f84c98fe9b700bccf273478828122f05fe2e305acb212ed114e7d70a9c33251 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/s3_bucket_website_configuration.html.markdown b/website/docs/cdktf/typescript/r/s3_bucket_website_configuration.html.markdown
new file mode 100644
index 00000000000..6e2a0516cbb
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/s3_bucket_website_configuration.html.markdown
@@ -0,0 +1,197 @@
+---
+subcategory: "S3 (Simple Storage)"
+layout: "aws"
+page_title: "AWS: aws_s3_bucket_website_configuration"
+description: |-
+  Provides an S3 bucket website configuration resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_s3_bucket_website_configuration
+
+Provides an S3 bucket website configuration resource. For more information, see [Hosting Websites on S3](https://docs.aws.amazon.com/AmazonS3/latest/dev/WebsiteHosting.html).
+
+## Example Usage
+
+### With `routingRule` configured
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3BucketWebsiteConfiguration } from "./.gen/providers/aws/s3-bucket-website-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new S3BucketWebsiteConfiguration(this, "example", {
+      bucket: Token.asString(awsS3BucketExample.id),
+      errorDocument: {
+        key: "error.html",
+      },
+      indexDocument: {
+        suffix: "index.html",
+      },
+      routingRule: [
+        {
+          condition: {
+            keyPrefixEquals: "docs/",
+          },
+          redirect: {
+            replaceKeyPrefixWith: "documents/",
+          },
+        },
+      ],
+    });
+  }
+}
+
+```
+
+### With `routingRules` configured
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3BucketWebsiteConfiguration } from "./.gen/providers/aws/s3-bucket-website-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new S3BucketWebsiteConfiguration(this, "example", {
+      bucket: Token.asString(awsS3BucketExample.id),
+      errorDocument: {
+        key: "error.html",
+      },
+      indexDocument: {
+        suffix: "index.html",
+      },
+      routingRules:
+        '[{\n    "Condition": {\n        "KeyPrefixEquals": "docs/"\n    },\n    "Redirect": {\n        "ReplaceKeyPrefixWith": ""\n    }\n}]\n\n',
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `bucket` - (Required, Forces new resource) Name of the bucket.
+* `errorDocument` - (Optional, Conflicts with `redirectAllRequestsTo`) Name of the error document for the website. [See below](#error_document).
+* `expectedBucketOwner` - (Optional, Forces new resource) Account ID of the expected bucket owner.
+* `indexDocument` - (Optional, Required if `redirectAllRequestsTo` is not specified) Name of the index document for the website. [See below](#index_document).
+* `redirectAllRequestsTo` - (Optional, Required if `indexDocument` is not specified) Redirect behavior for every request to this bucket's website endpoint. [See below](#redirect_all_requests_to). Conflicts with `errorDocument`, `indexDocument`, and `routingRule`.
+* `routingRule` - (Optional, Conflicts with `redirectAllRequestsTo` and `routingRules`) List of rules that define when a redirect is applied and the redirect behavior. [See below](#routing_rule).
+* `routingRules` - (Optional, Conflicts with `routingRule` and `redirectAllRequestsTo`) JSON array containing [routing rules](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-s3-websiteconfiguration-routingrules.html)
+  describing redirect behavior and when redirects are applied. Use this parameter when your routing rules contain empty String values (`""`) as seen in the [example above](#with-routing_rules-configured).
+
+### error_document
+
+The `errorDocument` configuration block supports the following arguments:
+
+* `key` - (Required) Object key name to use when a 4XX class error occurs.
+
+### index_document
+
+The `indexDocument` configuration block supports the following arguments:
+
+* `suffix` - (Required) Suffix that is appended to a request that is for a directory on the website endpoint.
+For example, if the suffix is `indexHtml` and you make a request to `samplebucket/images/`, the data that is returned will be for the object with the key name `images/indexHtml`.
+The suffix must not be empty and must not include a slash character.
+
+### redirect_all_requests_to
+
+The `redirectAllRequestsTo` configuration block supports the following arguments:
+
+* `hostName` - (Required) Name of the host where requests are redirected.
+* `protocol` - (Optional) Protocol to use when redirecting requests. The default is the protocol that is used in the original request. Valid values: `http`, `https`.
+
+### routing_rule
+
+The `routingRule` configuration block supports the following arguments:
+
+* `condition` - (Optional) Configuration block for describing a condition that must be met for the specified redirect to apply. [See below](#condition).
+* `redirect` - (Required) Configuration block for redirect information. [See below](#redirect).
+
+### condition
+
+The `condition` configuration block supports the following arguments:
+
+* `httpErrorCodeReturnedEquals` - (Optional, Required if `keyPrefixEquals` is not specified) HTTP error code when the redirect is applied. If specified with `keyPrefixEquals`, then both must be true for the redirect to be applied.
+* `keyPrefixEquals` - (Optional, Required if `httpErrorCodeReturnedEquals` is not specified) Object key name prefix when the redirect is applied. If specified with `httpErrorCodeReturnedEquals`, then both must be true for the redirect to be applied.
+
+### redirect
+
+The `redirect` configuration block supports the following arguments:
+
+* `hostName` - (Optional) Host name to use in the redirect request.
+* `httpRedirectCode` - (Optional) HTTP redirect code to use on the response.
+* `protocol` - (Optional) Protocol to use when redirecting requests. The default is the protocol that is used in the original request. Valid values: `http`, `https`.
+* `replaceKeyPrefixWith` - (Optional, Conflicts with `replaceKeyWith`) Object key prefix to use in the redirect request. For example, to redirect requests for all pages with prefix `docs/` (objects in the `docs/` folder) to `documents/`, you can set a `condition` block with `keyPrefixEquals` set to `docs/` and in the `redirect` set `replaceKeyPrefixWith` to `/documents`.
+* `replaceKeyWith` - (Optional, Conflicts with `replaceKeyPrefixWith`) Specific object key to use in the redirect request. For example, redirect request to `errorHtml`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The `bucket` or `bucket` and `expectedBucketOwner` separated by a comma (`,`) if the latter is provided.
+* `websiteDomain` - Domain of the website endpoint. This is used to create Route 53 alias records.
+* `websiteEndpoint` - Website endpoint.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import S3 bucket website configuration using the `bucket` or using the `bucket` and `expectedBucketOwner` separated by a comma (`,`). For example:
+
+If the owner (account ID) of the source bucket is the same account used to configure the Terraform AWS Provider, import using the `bucket`:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+If the owner (account ID) of the source bucket differs from the account used to configure the Terraform AWS Provider, import using the `bucket` and `expectedBucketOwner` separated by a comma (`,`):
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+**Using `terraform import` to import** S3 bucket website configuration using the `bucket` or using the `bucket` and `expectedBucketOwner` separated by a comma (`,`). For example:
+
+If the owner (account ID) of the source bucket is the same account used to configure the Terraform AWS Provider, import using the `bucket`:
+
+```console
+% terraform import aws_s3_bucket_website_configuration.example bucket-name
+```
+
+If the owner (account ID) of the source bucket differs from the account used to configure the Terraform AWS Provider, import using the `bucket` and `expectedBucketOwner` separated by a comma (`,`):
+
+```console
+% terraform import aws_s3_bucket_website_configuration.example bucket-name,123456789012
+```
+
+<!-- cache-key: cdktf-0.18.0 input-41a0e7bf7a7343429d1d7cf6e55d272d2709263fda9bdf55fa57e0879a7d920a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/s3_object.html.markdown b/website/docs/cdktf/typescript/r/s3_object.html.markdown
new file mode 100644
index 00000000000..ca12a5b8e3a
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/s3_object.html.markdown
@@ -0,0 +1,305 @@
+---
+subcategory: "S3 (Simple Storage)"
+layout: "aws"
+page_title: "AWS: aws_s3_object"
+description: |-
+  Provides an S3 object resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_s3_object
+
+Provides an S3 object resource.
+
+## Example Usage
+
+### Uploading a file to a bucket
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Object } from "./.gen/providers/aws/s3-object";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new S3Object(this, "object", {
+      bucket: "your_bucket_name",
+      etag: Token.asString(Fn.filemd5("path/to/file")),
+      key: "new_object_key",
+      source: "path/to/file",
+    });
+  }
+}
+
+```
+
+### Encrypting with KMS Key
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { KmsKey } from "./.gen/providers/aws/kms-key";
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketAcl } from "./.gen/providers/aws/s3-bucket-acl";
+import { S3Object } from "./.gen/providers/aws/s3-object";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const examplekms = new KmsKey(this, "examplekms", {
+      deletionWindowInDays: 7,
+      description: "KMS key 1",
+    });
+    const examplebucket = new S3Bucket(this, "examplebucket", {
+      bucket: "examplebuckettftest",
+    });
+    new S3BucketAcl(this, "example", {
+      acl: "private",
+      bucket: examplebucket.id,
+    });
+    const awsS3ObjectExample = new S3Object(this, "example_3", {
+      bucket: examplebucket.id,
+      key: "someobject",
+      kmsKeyId: examplekms.arn,
+      source: "index.html",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3ObjectExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### Server Side Encryption with S3 Default Master Key
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketAcl } from "./.gen/providers/aws/s3-bucket-acl";
+import { S3Object } from "./.gen/providers/aws/s3-object";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const examplebucket = new S3Bucket(this, "examplebucket", {
+      bucket: "examplebuckettftest",
+    });
+    new S3BucketAcl(this, "example", {
+      acl: "private",
+      bucket: examplebucket.id,
+    });
+    const awsS3ObjectExample = new S3Object(this, "example_2", {
+      bucket: examplebucket.id,
+      key: "someobject",
+      serverSideEncryption: "aws:kms",
+      source: "index.html",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3ObjectExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### Server Side Encryption with AWS-Managed Key
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketAcl } from "./.gen/providers/aws/s3-bucket-acl";
+import { S3Object } from "./.gen/providers/aws/s3-object";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const examplebucket = new S3Bucket(this, "examplebucket", {
+      bucket: "examplebuckettftest",
+    });
+    new S3BucketAcl(this, "example", {
+      acl: "private",
+      bucket: examplebucket.id,
+    });
+    const awsS3ObjectExample = new S3Object(this, "example_2", {
+      bucket: examplebucket.id,
+      key: "someobject",
+      serverSideEncryption: "AES256",
+      source: "index.html",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3ObjectExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### S3 Object Lock
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketAcl } from "./.gen/providers/aws/s3-bucket-acl";
+import { S3BucketVersioningA } from "./.gen/providers/aws/s3-bucket-versioning";
+import { S3Object } from "./.gen/providers/aws/s3-object";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const examplebucket = new S3Bucket(this, "examplebucket", {
+      bucket: "examplebuckettftest",
+      objectLockEnabled: true,
+    });
+    new S3BucketAcl(this, "example", {
+      acl: "private",
+      bucket: examplebucket.id,
+    });
+    const awsS3BucketVersioningExample = new S3BucketVersioningA(
+      this,
+      "example_2",
+      {
+        bucket: examplebucket.id,
+        versioningConfiguration: {
+          status: "Enabled",
+        },
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketVersioningExample.overrideLogicalId("example");
+    new S3Object(this, "examplebucket_object", {
+      bucket: examplebucket.id,
+      dependsOn: [awsS3BucketVersioningExample],
+      forceDestroy: true,
+      key: "someobject",
+      objectLockLegalHoldStatus: "ON",
+      objectLockMode: "GOVERNANCE",
+      objectLockRetainUntilDate: "2021-12-31T23:59:60Z",
+      source: "important.txt",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+-> **Note:** If you specify `contentEncoding` you are responsible for encoding the body appropriately. `source`, `content`, and `contentBase64` all expect already encoded/compressed bytes.
+
+The following arguments are required:
+
+* `bucket` - (Required) Name of the bucket to put the file in. Alternatively, an [S3 access point](https://docs.aws.amazon.com/AmazonS3/latest/dev/using-access-points.html) ARN can be specified.
+* `key` - (Required) Name of the object once it is in the bucket.
+
+The following arguments are optional:
+
+* `acl` - (Optional) [Canned ACL](https://docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html#canned-acl) to apply. Valid values are `private`, `publicRead`, `publicReadWrite`, `awsExecRead`, `authenticatedRead`, `bucketOwnerRead`, and `bucketOwnerFullControl`.
+* `bucketKeyEnabled` - (Optional) Whether or not to use [Amazon S3 Bucket Keys](https://docs.aws.amazon.com/AmazonS3/latest/dev/bucket-key.html) for SSE-KMS.
+* `cacheControl` - (Optional) Caching behavior along the request/reply chain Read [w3c cache_control](http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.9) for further details.
+* `checksumAlgorithm` - (Optional) Indicates the algorithm used to create the checksum for the object. If a value is specified and the object is encrypted with KMS, you must have permission to use the `kms:decrypt` action. Valid values: `crc32`, `crc32C`, `sha1`, `sha256`.
+* `contentBase64` - (Optional, conflicts with `source` and `content`) Base64-encoded data that will be decoded and uploaded as raw bytes for the object content. This allows safely uploading non-UTF8 binary data, but is recommended only for small content such as the result of the `gzipbase64` function with small text strings. For larger objects, use `source` to stream the content from a disk file.
+* `contentDisposition` - (Optional) Presentational information for the object. Read [w3c content_disposition](http://www.w3.org/Protocols/rfc2616/rfc2616-sec19.html#sec19.5.1) for further information.
+* `contentEncoding` - (Optional) Content encodings that have been applied to the object and thus what decoding mechanisms must be applied to obtain the media-type referenced by the Content-Type header field. Read [w3c content encoding](http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.11) for further information.
+* `contentLanguage` - (Optional) Language the content is in e.g., en-US or en-GB.
+* `contentType` - (Optional) Standard MIME type describing the format of the object data, e.g., application/octet-stream. All Valid MIME Types are valid for this input.
+* `content` - (Optional, conflicts with `source` and `contentBase64`) Literal string value to use as the object content, which will be uploaded as UTF-8-encoded text.
+* `etag` - (Optional) Triggers updates when the value changes. The only meaningful value is `filemd5("path/to/file")` (Terraform 0.11.12 or later) or `${md5(file("path/to/file"))}` (Terraform 0.11.11 or earlier). This attribute is not compatible with KMS encryption, `kmsKeyId` or `server_side_encryption = "aws:kms"`, also if an object is larger than 16 MB, the AWS Management Console will upload or copy that object as a Multipart Upload, and therefore the ETag will not be an MD5 digest (see `sourceHash` instead).
+* `forceDestroy` - (Optional) Whether to allow the object to be deleted by removing any legal hold on any object version. Default is `false`. This value should be set to `true` only if the bucket has S3 object lock enabled.
+* `kmsKeyId` - (Optional) ARN of the KMS Key to use for object encryption. If the S3 Bucket has server-side encryption enabled, that value will automatically be used. If referencing the `awsKmsKey` resource, use the `arn` attribute. If referencing the `awsKmsAlias` data source or resource, use the `targetKeyArn` attribute. Terraform will only perform drift detection if a configuration value is provided.
+* `metadata` - (Optional) Map of keys/values to provision metadata (will be automatically prefixed by `xAmzMeta`, note that only lowercase label are currently supported by the AWS Go API).
+* `objectLockLegalHoldStatus` - (Optional) [Legal hold](https://docs.aws.amazon.com/AmazonS3/latest/dev/object-lock-overview.html#object-lock-legal-holds) status that you want to apply to the specified object. Valid values are `on` and `off`.
+* `objectLockMode` - (Optional) Object lock [retention mode](https://docs.aws.amazon.com/AmazonS3/latest/dev/object-lock-overview.html#object-lock-retention-modes) that you want to apply to this object. Valid values are `governance` and `compliance`.
+* `objectLockRetainUntilDate` - (Optional) Date and time, in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8), when this object's object lock will [expire](https://docs.aws.amazon.com/AmazonS3/latest/dev/object-lock-overview.html#object-lock-retention-periods).
+* `serverSideEncryption` - (Optional) Server-side encryption of the object in S3. Valid values are "`aes256`" and "`aws:kms`".
+* `sourceHash` - (Optional) Triggers updates like `etag` but useful to address `etag` encryption limitations. Set using `filemd5("path/to/source")` (Terraform 0.11.12 or later). (The value is only stored in state and not saved by AWS.)
+* `source` - (Optional, conflicts with `content` and `contentBase64`) Path to a file that will be read and uploaded as raw bytes for the object content.
+* `storageClass` - (Optional) [Storage Class](https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutObject.html#AmazonS3-PutObject-request-header-StorageClass) for the object. Defaults to "`standard`".
+* `tags` - (Optional) Map of tags to assign to the object. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `websiteRedirect` - (Optional) Target URL for [website redirect](http://docs.aws.amazon.com/AmazonS3/latest/dev/how-to-page-redirect.html).
+
+If no content is provided through `source`, `content` or `contentBase64`, then the object will be empty.
+
+-> **Note:** Terraform ignores all leading `/`s in the object's `key` and treats multiple `/`s in the rest of the object's `key` as a single `/`, so values of `/indexHtml` and `indexHtml` correspond to the same S3 object as do `first//second///third//` and `first/second/third/`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `checksumCrc32` - The base64-encoded, 32-bit CRC32 checksum of the object.
+* `checksumCrc32C` - The base64-encoded, 32-bit CRC32C checksum of the object.
+* `checksumSha1` - The base64-encoded, 160-bit SHA-1 digest of the object.
+* `checksumSha256` - The base64-encoded, 256-bit SHA-256 digest of the object.
+* `etag` - ETag generated for the object (an MD5 sum of the object content). For plaintext objects or objects encrypted with an AWS-managed key, the hash is an MD5 digest of the object data. For objects encrypted with a KMS key or objects created by either the Multipart Upload or Part Copy operation, the hash is not an MD5 digest, regardless of the method of encryption. More information on possible values can be found on [Common Response Headers](https://docs.aws.amazon.com/AmazonS3/latest/API/RESTCommonResponseHeaders.html).
+* `id` - `key` of the resource supplied above
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `versionId` - Unique version ID value for the object, if bucket versioning is enabled.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import objects using the `id` or S3 URL. For example:
+
+Import using the `id`, which is the bucket name and the key together:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Import using S3 URL syntax:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+**Using `terraform import` to import** objects using the `id` or S3 URL. For example:
+
+Import using the `id`, which is the bucket name and the key together:
+
+```console
+% terraform import aws_s3_object.example some-bucket-name/some/key.txt
+```
+
+Import using S3 URL syntax:
+
+```console
+% terraform import aws_s3_object.example s3://some-bucket-name/some/key.txt
+```
+
+<!-- cache-key: cdktf-0.18.0 input-313d011adadfcc4b1dac5806690d7004dca8bb94690486322b189890ab15b7de -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/s3_object_copy.html.markdown b/website/docs/cdktf/typescript/r/s3_object_copy.html.markdown
new file mode 100644
index 00000000000..31c561e6227
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/s3_object_copy.html.markdown
@@ -0,0 +1,126 @@
+---
+subcategory: "S3 (Simple Storage)"
+layout: "aws"
+page_title: "AWS: aws_s3_object_copy"
+description: |-
+  Provides a resource for copying an S3 object.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_s3_object_copy
+
+Provides a resource for copying an S3 object.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3ObjectCopy } from "./.gen/providers/aws/s3-object-copy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new S3ObjectCopy(this, "test", {
+      bucket: "destination_bucket",
+      grant: [
+        {
+          permissions: ["READ"],
+          type: "Group",
+          uri: "http://acs.amazonaws.com/groups/global/AllUsers",
+        },
+      ],
+      key: "destination_key",
+      source: "source_bucket/source_key",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `bucket` - (Required) Name of the bucket to put the file in.
+* `key` - (Required) Name of the object once it is in the bucket.
+* `source` - (Required) Specifies the source object for the copy operation. You specify the value in one of two formats. For objects not accessed through an access point, specify the name of the source bucket and the key of the source object, separated by a slash (`/`). For example, `testbucket/test1Json`. For objects accessed through access points, specify the ARN of the object as accessed through the access point, in the format `arn:aws:s3:<region>:<accountId>:accesspoint/<accessPointName>/object/<key>`. For example, `arn:aws:s3:usWest2:9999912999:accesspoint/myAccessPoint/object/testbucket/test1Json`.
+
+The following arguments are optional:
+
+* `acl` - (Optional) [Canned ACL](https://docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html#canned-acl) to apply. Valid values are `private`, `publicRead`, `publicReadWrite`, `authenticatedRead`, `awsExecRead`, `bucketOwnerRead`, and `bucketOwnerFullControl`. Conflicts with `grant`.
+* `cacheControl` - (Optional) Specifies caching behavior along the request/reply chain Read [w3c cache_control](http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.9) for further details.
+* `checksumAlgorithm` - (Optional) Indicates the algorithm used to create the checksum for the object. If a value is specified and the object is encrypted with KMS, you must have permission to use the `kms:decrypt` action. Valid values: `crc32`, `crc32C`, `sha1`, `sha256`.
+* `contentDisposition` - (Optional) Specifies presentational information for the object. Read [w3c content_disposition](http://www.w3.org/Protocols/rfc2616/rfc2616-sec19.html#sec19.5.1) for further information.
+* `contentEncoding` - (Optional) Specifies what content encodings have been applied to the object and thus what decoding mechanisms must be applied to obtain the media-type referenced by the Content-Type header field. Read [w3c content encoding](http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.11) for further information.
+* `contentLanguage` - (Optional) Language the content is in e.g., en-US or en-GB.
+* `contentType` - (Optional) Standard MIME type describing the format of the object data, e.g., `application/octetStream`. All Valid MIME Types are valid for this input.
+* `copyIfMatch` - (Optional) Copies the object if its entity tag (ETag) matches the specified tag.
+* `copyIfModifiedSince` - (Optional) Copies the object if it has been modified since the specified time, in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8).
+* `copyIfNoneMatch` - (Optional) Copies the object if its entity tag (ETag) is different than the specified ETag.
+* `copyIfUnmodifiedSince` - (Optional) Copies the object if it hasn't been modified since the specified time, in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8).
+* `customerAlgorithm` - (Optional) Specifies the algorithm to use to when encrypting the object (for example, AES256).
+* `customerKey` - (Optional) Specifies the customer-provided encryption key for Amazon S3 to use in encrypting data. This value is used to store the object and then it is discarded; Amazon S3 does not store the encryption key. The key must be appropriate for use with the algorithm specified in the x-amz-server-side-encryption-customer-algorithm header.
+* `customerKeyMd5` - (Optional) Specifies the 128-bit MD5 digest of the encryption key according to RFC 1321. Amazon S3 uses this header for a message integrity check to ensure that the encryption key was transmitted without error.
+* `expectedBucketOwner` - (Optional) Account id of the expected destination bucket owner. If the destination bucket is owned by a different account, the request will fail with an HTTP 403 (Access Denied) error.
+* `expectedSourceBucketOwner` - (Optional) Account id of the expected source bucket owner. If the source bucket is owned by a different account, the request will fail with an HTTP 403 (Access Denied) error.
+* `expires` - (Optional) Date and time at which the object is no longer cacheable, in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8).
+* `forceDestroy` - (Optional) Allow the object to be deleted by removing any legal hold on any object version. Default is `false`. This value should be set to `true` only if the bucket has S3 object lock enabled.
+* `grant` - (Optional) Configuration block for header grants. Documented below. Conflicts with `acl`.
+* `kmsEncryptionContext` - (Optional) Specifies the AWS KMS Encryption Context to use for object encryption. The value is a base64-encoded UTF-8 string holding JSON with the encryption context key-value pairs.
+* `kmsKeyId` - (Optional) Specifies the AWS KMS Key ARN to use for object encryption. This value is a fully qualified **ARN** of the KMS Key. If using `awsKmsKey`, use the exported `arn` attribute: `kms_key_id = aws_kms_key.foo.arn`
+* `metadata` - (Optional) Map of keys/values to provision metadata (will be automatically prefixed by `xAmzMeta`, note that only lowercase label are currently supported by the AWS Go API).
+* `metadataDirective` - (Optional) Specifies whether the metadata is copied from the source object or replaced with metadata provided in the request. Valid values are `copy` and `replace`.
+* `objectLockLegalHoldStatus` - (Optional) The [legal hold](https://docs.aws.amazon.com/AmazonS3/latest/dev/object-lock-overview.html#object-lock-legal-holds) status that you want to apply to the specified object. Valid values are `on` and `off`.
+* `objectLockMode` - (Optional) Object lock [retention mode](https://docs.aws.amazon.com/AmazonS3/latest/dev/object-lock-overview.html#object-lock-retention-modes) that you want to apply to this object. Valid values are `governance` and `compliance`.
+* `objectLockRetainUntilDate` - (Optional) Date and time, in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8), when this object's object lock will [expire](https://docs.aws.amazon.com/AmazonS3/latest/dev/object-lock-overview.html#object-lock-retention-periods).
+* `requestPayer` - (Optional) Confirms that the requester knows that they will be charged for the request. Bucket owners need not specify this parameter in their requests. For information about downloading objects from requester pays buckets, see Downloading Objects in Requestor Pays Buckets (https://docs.aws.amazon.com/AmazonS3/latest/dev/ObjectsinRequesterPaysBuckets.html) in the Amazon S3 Developer Guide. If included, the only valid value is `requester`.
+* `serverSideEncryption` - (Optional) Specifies server-side encryption of the object in S3. Valid values are `aes256` and `aws:kms`.
+* `sourceCustomerAlgorithm` - (Optional) Specifies the algorithm to use when decrypting the source object (for example, AES256).
+* `sourceCustomerKey` - (Optional) Specifies the customer-provided encryption key for Amazon S3 to use to decrypt the source object. The encryption key provided in this header must be one that was used when the source object was created.
+* `sourceCustomerKeyMd5` - (Optional) Specifies the 128-bit MD5 digest of the encryption key according to RFC 1321. Amazon S3 uses this header for a message integrity check to ensure that the encryption key was transmitted without error.
+* `storageClass` - (Optional) Specifies the desired [storage class](https://docs.aws.amazon.com/AmazonS3/latest/API/API_CopyObject.html#AmazonS3-CopyObject-request-header-StorageClass) for the object. Defaults to `standard`.
+* `taggingDirective` - (Optional) Specifies whether the object tag-set are copied from the source object or replaced with tag-set provided in the request. Valid values are `copy` and `replace`.
+* `tags` - (Optional) Map of tags to assign to the object. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `websiteRedirect` - (Optional) Specifies a target URL for [website redirect](http://docs.aws.amazon.com/AmazonS3/latest/dev/how-to-page-redirect.html).
+
+### grant
+
+-> For more information on header grants, see the Amazon Simple Storage Service (S3) [API Reference: PutObjectAcl](https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutObjectAcl.html).
+
+This configuration block has the following required arguments:
+
+* `permissions` - (Required) List of permissions to grant to grantee. Valid values are `read`, `readAcp`, `writeAcp`, `fullControl`.
+* `type` - (Required) - Type of grantee. Valid values are `canonicalUser`, `group`, and `amazonCustomerByEmail`.
+
+This configuration block has the following optional arguments (one of the three is required):
+
+* `email` - (Optional) Email address of the grantee. Used only when `type` is `amazonCustomerByEmail`.  
+* `id` - (Optional) Canonical user ID of the grantee. Used only when `type` is `canonicalUser`.  
+* `uri` - (Optional) URI of the grantee group. Used only when `type` is `group`.
+
+-> **Note:** Terraform ignores all leading `/`s in the object's `key` and treats multiple `/`s in the rest of the object's `key` as a single `/`, so values of `/indexHtml` and `indexHtml` correspond to the same S3 object as do `first//second///third//` and `first/second/third/`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `checksumCrc32` - The base64-encoded, 32-bit CRC32 checksum of the object.
+* `checksumCrc32C` - The base64-encoded, 32-bit CRC32C checksum of the object.
+* `checksumSha1` - The base64-encoded, 160-bit SHA-1 digest of the object.
+* `checksumSha256` - The base64-encoded, 256-bit SHA-256 digest of the object.
+* `etag` - ETag generated for the object (an MD5 sum of the object content). For plaintext objects or objects encrypted with an AWS-managed key, the hash is an MD5 digest of the object data. For objects encrypted with a KMS key or objects created by either the Multipart Upload or Part Copy operation, the hash is not an MD5 digest, regardless of the method of encryption. More information on possible values can be found on [Common Response Headers](https://docs.aws.amazon.com/AmazonS3/latest/API/RESTCommonResponseHeaders.html).
+* `expiration` - If the object expiration is configured, this attribute will be set.
+* `id` - The `key` of the resource supplied above.
+* `lastModified` - Returns the date that the object was last modified, in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8).
+* `requestCharged` - If present, indicates that the requester was successfully charged for the request.
+* `sourceVersionId` - Version of the copied object in the source bucket.
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `versionId` - Version ID of the newly created copy.
+
+<!-- cache-key: cdktf-0.18.0 input-a85f1ab646454d1b2a5db0ee8a76202e123a448298b840089b1ec7bd23a4c87c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/s3control_access_point_policy.html.markdown b/website/docs/cdktf/typescript/r/s3control_access_point_policy.html.markdown
new file mode 100644
index 00000000000..f6735212b19
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/s3control_access_point_policy.html.markdown
@@ -0,0 +1,116 @@
+---
+subcategory: "S3 Control"
+layout: "aws"
+page_title: "AWS: aws_s3control_access_point_policy"
+description: |-
+  Provides a resource to manage an S3 Access Point resource policy.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_s3control_access_point_policy
+
+Provides a resource to manage an S3 Access Point resource policy.
+
+~> **NOTE on Access Points and Access Point Policies:** Terraform provides both a standalone Access Point Policy resource and an [Access Point](s3_access_point.html) resource with a resource policy defined in-line. You cannot use an Access Point with in-line resource policy in conjunction with an Access Point Policy resource. Doing so will cause a conflict of policies and will overwrite the access point's resource policy.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, Fn, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3AccessPoint } from "./.gen/providers/aws/s3-access-point";
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3ControlAccessPointPolicy } from "./.gen/providers/aws/s3-control-access-point-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new S3Bucket(this, "example", {
+      bucket: "example",
+    });
+    const awsS3AccessPointExample = new S3AccessPoint(this, "example_1", {
+      bucket: example.id,
+      lifecycle: {
+        ignoreChanges: [policy],
+      },
+      name: "example",
+      publicAccessBlockConfiguration: {
+        blockPublicAcls: true,
+        blockPublicPolicy: false,
+        ignorePublicAcls: true,
+        restrictPublicBuckets: false,
+      },
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3AccessPointExample.overrideLogicalId("example");
+    const awsS3ControlAccessPointPolicyExample = new S3ControlAccessPointPolicy(
+      this,
+      "example_2",
+      {
+        accessPointArn: Token.asString(awsS3AccessPointExample.arn),
+        policy: Token.asString(
+          Fn.jsonencode({
+            Statement: [
+              {
+                Action: "s3:GetObjectTagging",
+                Effect: "Allow",
+                Principal: {
+                  AWS: "*",
+                },
+                Resource: "${" + awsS3AccessPointExample.arn + "}/object/*",
+              },
+            ],
+            Version: "2008-10-17",
+          })
+        ),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3ControlAccessPointPolicyExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `accessPointArn` - (Required) The ARN of the access point that you want to associate with the specified policy.
+* `policy` - (Required) The policy that you want to apply to the specified access point.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `hasPublicAccessPolicy` - Indicates whether this access point currently has a policy that allows public access.
+* `id` - The AWS account ID and access point name separated by a colon (`:`).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Access Point policies using the `accessPointArn`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Access Point policies using the `accessPointArn`. For example:
+
+```console
+% terraform import aws_s3control_access_point_policy.example arn:aws:s3:us-west-2:123456789012:accesspoint/example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-e5c457db50c72d6b30534efccf23fc63cd4d7f721d03d7a1b36a6e8875fa8261 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/s3control_bucket.html.markdown b/website/docs/cdktf/typescript/r/s3control_bucket.html.markdown
new file mode 100644
index 00000000000..18b6b68f39c
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/s3control_bucket.html.markdown
@@ -0,0 +1,80 @@
+---
+subcategory: "S3 Control"
+layout: "aws"
+page_title: "AWS: aws_s3control_bucket"
+description: |-
+  Manages an S3 Control Bucket.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_s3control_bucket
+
+Provides a resource to manage an S3 Control Bucket.
+
+-> This functionality is for managing [S3 on Outposts](https://docs.aws.amazon.com/AmazonS3/latest/dev/S3onOutposts.html). To manage S3 Buckets in an AWS Partition, see the [`awsS3Bucket` resource](/docs/providers/aws/r/s3_bucket.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3ControlBucket } from "./.gen/providers/aws/s3-control-bucket";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new S3ControlBucket(this, "example", {
+      bucket: "example",
+      outpostId: Token.asString(dataAwsOutpostsOutpostExample.id),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `bucket` - (Required) Name of the bucket.
+* `outpostId` - (Required) Identifier of the Outpost to contain this bucket.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the bucket.
+* `creationDate` - UTC creation date in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8).
+* `id` - Amazon Resource Name (ARN) of the bucket.
+* `publicAccessBlockEnabled` - Boolean whether Public Access Block is enabled.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import S3 Control Buckets using Amazon Resource Name (ARN). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import S3 Control Buckets using Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_s3control_bucket.example arn:aws:s3-outposts:us-east-1:123456789012:outpost/op-12345678/bucket/example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-2e4677b75d6cbb099b0dd2b2385879475c02ebb3643475b93a119fd3833d7929 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/s3control_bucket_lifecycle_configuration.html.markdown b/website/docs/cdktf/typescript/r/s3control_bucket_lifecycle_configuration.html.markdown
new file mode 100644
index 00000000000..6f368d851d8
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/s3control_bucket_lifecycle_configuration.html.markdown
@@ -0,0 +1,107 @@
+---
+subcategory: "S3 Control"
+layout: "aws"
+page_title: "AWS: aws_s3control_bucket_lifecycle_configuration"
+description: |-
+  Manages an S3 Control Bucket Lifecycle Configuration.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_s3control_bucket_lifecycle_configuration
+
+Provides a resource to manage an S3 Control Bucket Lifecycle Configuration.
+
+~> **NOTE:** Each S3 Control Bucket can only have one Lifecycle Configuration. Using multiple of this resource against the same S3 Control Bucket will result in perpetual differences each Terraform run.
+
+-> This functionality is for managing [S3 on Outposts](https://docs.aws.amazon.com/AmazonS3/latest/dev/S3onOutposts.html). To manage S3 Bucket Lifecycle Configurations in an AWS Partition, see the [`awsS3Bucket` resource](/docs/providers/aws/r/s3_bucket.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3ControlBucketLifecycleConfiguration } from "./.gen/providers/aws/s3-control-bucket-lifecycle-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new S3ControlBucketLifecycleConfiguration(this, "example", {
+      bucket: Token.asString(awsS3ControlBucketExample.arn),
+      rule: [
+        {
+          expiration: {
+            days: 365,
+          },
+          filter: {
+            prefix: "logs/",
+          },
+          id: "logs",
+        },
+        {
+          expiration: {
+            days: 7,
+          },
+          filter: {
+            prefix: "temp/",
+          },
+          id: "temp",
+        },
+      ],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `bucket` - (Required) Amazon Resource Name (ARN) of the bucket.
+* `rule` - (Required) Configuration block(s) containing lifecycle rules for the bucket.
+    * `abortIncompleteMultipartUpload` - (Optional) Configuration block containing settings for abort incomplete multipart upload.
+        * `daysAfterInitiation` - (Required) Number of days after which Amazon S3 aborts an incomplete multipart upload.
+    * `expiration` - (Optional) Configuration block containing settings for expiration of objects.
+        * `date` - (Optional) Date the object is to be deleted. Should be in `yyyyMmDd` date format, e.g., `20200930`.
+        * `days` - (Optional) Number of days before the object is to be deleted.
+        * `expiredObjectDeleteMarker` - (Optional) Enable to remove a delete marker with no noncurrent versions. Cannot be specified with `date` or `days`.
+    * `filter` - (Optional) Configuration block containing settings for filtering.
+        * `prefix` - (Optional) Object prefix for rule filtering.
+        * `tags` - (Optional) Key-value map of object tags for rule filtering.
+    * `id` - (Required) Unique identifier for the rule.
+    * `status` - (Optional) Status of the rule. Valid values: `enabled` and `disabled`. Defaults to `enabled`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Amazon Resource Name (ARN) of the bucket.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import S3 Control Bucket Lifecycle Configurations using the Amazon Resource Name (ARN). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import S3 Control Bucket Lifecycle Configurations using the Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_s3control_bucket_lifecycle_configuration.example arn:aws:s3-outposts:us-east-1:123456789012:outpost/op-12345678/bucket/example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-edd708f39cae61085d23015d0a484630286f25fd5088717d8cc3d17bdb735870 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/s3control_bucket_policy.html.markdown b/website/docs/cdktf/typescript/r/s3control_bucket_policy.html.markdown
new file mode 100644
index 00000000000..b3d1226ca9f
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/s3control_bucket_policy.html.markdown
@@ -0,0 +1,91 @@
+---
+subcategory: "S3 Control"
+layout: "aws"
+page_title: "AWS: aws_s3control_bucket_policy"
+description: |-
+  Manages an S3 Control Bucket Policy.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_s3control_bucket_policy
+
+Provides a resource to manage an S3 Control Bucket Policy.
+
+-> This functionality is for managing [S3 on Outposts](https://docs.aws.amazon.com/AmazonS3/latest/dev/S3onOutposts.html). To manage S3 Bucket Policies in an AWS Partition, see the [`awsS3BucketPolicy` resource](/docs/providers/aws/r/s3_bucket_policy.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, Fn, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3ControlBucketPolicy } from "./.gen/providers/aws/s3-control-bucket-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new S3ControlBucketPolicy(this, "example", {
+      bucket: Token.asString(awsS3ControlBucketExample.arn),
+      policy: Token.asString(
+        Fn.jsonencode({
+          Id: "testBucketPolicy",
+          Statement: [
+            {
+              Action: "s3-outposts:PutBucketLifecycleConfiguration",
+              Effect: "Deny",
+              Principal: {
+                AWS: "*",
+              },
+              Resource: awsS3ControlBucketExample.arn,
+              Sid: "statement1",
+            },
+          ],
+          Version: "2012-10-17",
+        })
+      ),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `bucket` - (Required) Amazon Resource Name (ARN) of the bucket.
+* `policy` - (Required) JSON string of the resource policy. For more information about building AWS IAM policy documents with Terraform, see the [AWS IAM Policy Document Guide](https://learn.hashicorp.com/terraform/aws/iam-policy).
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Amazon Resource Name (ARN) of the bucket.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import S3 Control Bucket Policies using the Amazon Resource Name (ARN). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import S3 Control Bucket Policies using the Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_s3control_bucket_policy.example arn:aws:s3-outposts:us-east-1:123456789012:outpost/op-12345678/bucket/example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-476caf1030f6a6d008cc6514d741ddf15b7e806dd275bf24bf545b7689e2f554 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/s3control_multi_region_access_point.html.markdown b/website/docs/cdktf/typescript/r/s3control_multi_region_access_point.html.markdown
new file mode 100644
index 00000000000..0b9052dc0d1
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/s3control_multi_region_access_point.html.markdown
@@ -0,0 +1,145 @@
+---
+subcategory: "S3 Control"
+layout: "aws"
+page_title: "AWS: aws_s3control_multi_region_access_point"
+description: |-
+  Provides a resource to manage an S3 Multi-Region Access Point associated with specified buckets.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_s3control_multi_region_access_point
+
+Provides a resource to manage an S3 Multi-Region Access Point associated with specified buckets.
+
+## Example Usage
+
+### Multiple AWS Buckets in Different Regions
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { AwsProvider } from "./.gen/providers/aws/provider";
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3ControlMultiRegionAccessPoint } from "./.gen/providers/aws/s3-control-multi-region-access-point";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const primaryRegion = new AwsProvider(this, "aws", {
+      alias: "primary_region",
+      region: "us-east-1",
+    });
+    const secondaryRegion = new AwsProvider(this, "aws_1", {
+      alias: "secondary_region",
+      region: "us-west-2",
+    });
+    const barBucket = new S3Bucket(this, "bar_bucket", {
+      bucket: "example-bucket-bar",
+      provider: secondaryRegion,
+    });
+    const fooBucket = new S3Bucket(this, "foo_bucket", {
+      bucket: "example-bucket-foo",
+      provider: primaryRegion,
+    });
+    new S3ControlMultiRegionAccessPoint(this, "example", {
+      details: {
+        name: "example",
+        region: [
+          {
+            bucket: fooBucket.id,
+          },
+          {
+            bucket: barBucket.id,
+          },
+        ],
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `accountId` - (Optional) The AWS account ID for the owner of the buckets for which you want to create a Multi-Region Access Point. Defaults to automatically determined account ID of the Terraform AWS provider.
+* `details` - (Required) A configuration block containing details about the Multi-Region Access Point. See [Details Configuration Block](#details-configuration) below for more details
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `60M`)
+* `delete` - (Default `15M`)
+
+### Details Configuration
+
+The `details` block supports the following:
+
+* `name` - (Required) The name of the Multi-Region Access Point.
+* `publicAccessBlock` - (Optional) Configuration block to manage the `publicAccessBlock` configuration that you want to apply to this Multi-Region Access Point. You can enable the configuration options in any combination. See [Public Access Block Configuration](#public-access-block-configuration) below for more details.
+* `region` - (Required) The Region configuration block to specify the bucket associated with the Multi-Region Access Point. See [Region Configuration](#region-configuration) below for more details.
+
+For more information, see the documentation on [Multi-Region Access Points](https://docs.aws.amazon.com/AmazonS3/latest/userguide/MultiRegionAccessPoints.html).
+
+### Public Access Block Configuration
+
+The `publicAccessBlock` block supports the following:
+
+* `blockPublicAcls` - (Optional) Whether Amazon S3 should block public ACLs for buckets in this account. Defaults to `true`. Enabling this setting does not affect existing policies or ACLs. When set to `true` causes the following behavior:
+    * PUT Bucket acl and PUT Object acl calls fail if the specified ACL is public.
+    * PUT Object calls fail if the request includes a public ACL.
+    * PUT Bucket calls fail if the request includes a public ACL.
+* `blockPublicPolicy` - (Optional) Whether Amazon S3 should block public bucket policies for buckets in this account. Defaults to `true`. Enabling this setting does not affect existing bucket policies. When set to `true` causes Amazon S3 to:
+    * Reject calls to PUT Bucket policy if the specified bucket policy allows public access.
+* `ignorePublicAcls` - (Optional) Whether Amazon S3 should ignore public ACLs for buckets in this account. Defaults to `true`. Enabling this setting does not affect the persistence of any existing ACLs and doesn't prevent new public ACLs from being set. When set to `true` causes Amazon S3 to:
+    * Ignore all public ACLs on buckets in this account and any objects that they contain.
+* `restrictPublicBuckets` - (Optional) Whether Amazon S3 should restrict public bucket policies for buckets in this account. Defaults to `true`. Enabling this setting does not affect previously stored bucket policies, except that public and cross-account access within any public bucket policy, including non-public delegation to specific accounts, is blocked. When set to `true`:
+    * Only the bucket owner and AWS Services can access buckets with public policies.
+
+### Region Configuration
+
+The `region` block supports the following:
+
+* `bucket` - (Required) The name of the associated bucket for the Region.
+* `bucketAccountId` - (Optional) The AWS account ID that owns the Amazon S3 bucket that's associated with this Multi-Region Access Point.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `alias` - The alias for the Multi-Region Access Point.
+* `arn` - Amazon Resource Name (ARN) of the Multi-Region Access Point.
+* `domainName` - The DNS domain name of the S3 Multi-Region Access Point in the format _`alias`_.accesspoint.s3-global.amazonaws.com. For more information, see the documentation on [Multi-Region Access Point Requests](https://docs.aws.amazon.com/AmazonS3/latest/userguide/MultiRegionAccessPointRequests.html).
+* `id` - The AWS account ID and access point name separated by a colon (`:`).
+* `status` - The current status of the Multi-Region Access Point. One of: `ready`, `inconsistentAcrossRegions`, `creating`, `partiallyCreated`, `partiallyDeleted`, `deleting`.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Multi-Region Access Points using the `accountId` and `name` of the Multi-Region Access Point separated by a colon (`:`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Multi-Region Access Points using the `accountId` and `name` of the Multi-Region Access Point separated by a colon (`:`). For example:
+
+```console
+% terraform import aws_s3control_multi_region_access_point.example 123456789012:example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-561f76eaf08b8898b3aa821b8c028e27dcb6512218497d376c771b48c1350f6b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/s3control_multi_region_access_point_policy.html.markdown b/website/docs/cdktf/typescript/r/s3control_multi_region_access_point_policy.html.markdown
new file mode 100644
index 00000000000..7a11644f2d0
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/s3control_multi_region_access_point_policy.html.markdown
@@ -0,0 +1,143 @@
+---
+subcategory: "S3 Control"
+layout: "aws"
+page_title: "AWS: aws_s3control_multi_region_access_point_policy"
+description: |-
+  Provides a resource to manage an S3 Multi-Region Access Point access control policy.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_s3control_multi_region_access_point_policy
+
+Provides a resource to manage an S3 Multi-Region Access Point access control policy.
+
+## Example Usage
+
+### Basic Example
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCallerIdentity } from "./.gen/providers/aws/data-aws-caller-identity";
+import { DataAwsPartition } from "./.gen/providers/aws/data-aws-partition";
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3ControlMultiRegionAccessPoint } from "./.gen/providers/aws/s3-control-multi-region-access-point";
+import { S3ControlMultiRegionAccessPointPolicy } from "./.gen/providers/aws/s3-control-multi-region-access-point-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const fooBucket = new S3Bucket(this, "foo_bucket", {
+      bucket: "example-bucket-foo",
+    });
+    const example = new S3ControlMultiRegionAccessPoint(this, "example", {
+      details: {
+        name: "example",
+        region: [
+          {
+            bucket: fooBucket.id,
+          },
+        ],
+      },
+    });
+    const current = new DataAwsCallerIdentity(this, "current", {});
+    const dataAwsPartitionCurrent = new DataAwsPartition(this, "current_3", {});
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsPartitionCurrent.overrideLogicalId("current");
+    const awsS3ControlMultiRegionAccessPointPolicyExample =
+      new S3ControlMultiRegionAccessPointPolicy(this, "example_4", {
+        details: {
+          name: Token.asString(Fn.element(Fn.split(":", example.id), 1)),
+          policy: Token.asString(
+            Fn.jsonencode({
+              Statement: [
+                {
+                  Action: ["s3:GetObject", "s3:PutObject"],
+                  Effect: "Allow",
+                  Principal: {
+                    AWS: current.accountId,
+                  },
+                  Resource:
+                    "arn:${" +
+                    dataAwsPartitionCurrent.partition +
+                    "}:s3::${" +
+                    current.accountId +
+                    "}:accesspoint/${" +
+                    example.alias +
+                    "}/object/*",
+                  Sid: "Example",
+                },
+              ],
+              Version: "2012-10-17",
+            })
+          ),
+        },
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3ControlMultiRegionAccessPointPolicyExample.overrideLogicalId(
+      "example"
+    );
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `accountId` - (Optional) The AWS account ID for the owner of the Multi-Region Access Point. Defaults to automatically determined account ID of the Terraform AWS provider.
+* `details` - (Required) A configuration block containing details about the policy for the Multi-Region Access Point. See [Details Configuration Block](#details-configuration) below for more details
+
+### Details Configuration
+
+The `details` block supports the following:
+
+* `name` - (Required) The name of the Multi-Region Access Point.
+* `policy` - (Required) A valid JSON document that specifies the policy that you want to associate with this Multi-Region Access Point. Once applied, the policy can be edited, but not deleted. For more information, see the documentation on [Multi-Region Access Point Permissions](https://docs.aws.amazon.com/AmazonS3/latest/userguide/MultiRegionAccessPointPermissions.html).
+
+-> **NOTE:** When you update the `policy`, the update is first listed as the proposed policy. After the update is finished and all Regions have been updated, the proposed policy is listed as the established policy. If both policies have the same version number, the proposed policy is the established policy.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `established` - The last established policy for the Multi-Region Access Point.
+* `id` - The AWS account ID and access point name separated by a colon (`:`).
+* `proposed` - The proposed policy for the Multi-Region Access Point.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `15M`)
+* `update` - (Default `15M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Multi-Region Access Point Policies using the `accountId` and `name` of the Multi-Region Access Point separated by a colon (`:`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Multi-Region Access Point Policies using the `accountId` and `name` of the Multi-Region Access Point separated by a colon (`:`). For example:
+
+```console
+% terraform import aws_s3control_multi_region_access_point_policy.example 123456789012:example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-6d84687c8ce8ec13e291535641985a9d28347a18d016dfb47e30527efbd4dfec -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/s3control_object_lambda_access_point.html.markdown b/website/docs/cdktf/typescript/r/s3control_object_lambda_access_point.html.markdown
new file mode 100644
index 00000000000..e843bac2a28
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/s3control_object_lambda_access_point.html.markdown
@@ -0,0 +1,132 @@
+---
+subcategory: "S3 Control"
+layout: "aws"
+page_title: "AWS: aws_s3control_object_lambda_access_point"
+description: |-
+  Provides a resource to manage an S3 Object Lambda Access Point.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_s3control_object_lambda_access_point
+
+Provides a resource to manage an S3 Object Lambda Access Point.
+An Object Lambda access point is associated with exactly one [standard access point](s3_access_point.html) and thus one Amazon S3 bucket.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3AccessPoint } from "./.gen/providers/aws/s3-access-point";
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3ControlObjectLambdaAccessPoint } from "./.gen/providers/aws/s3-control-object-lambda-access-point";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new S3Bucket(this, "example", {
+      bucket: "example",
+    });
+    const awsS3AccessPointExample = new S3AccessPoint(this, "example_1", {
+      bucket: example.id,
+      name: "example",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3AccessPointExample.overrideLogicalId("example");
+    const awsS3ControlObjectLambdaAccessPointExample =
+      new S3ControlObjectLambdaAccessPoint(this, "example_2", {
+        configuration: {
+          supportingAccessPoint: Token.asString(awsS3AccessPointExample.arn),
+          transformationConfiguration: [
+            {
+              actions: ["GetObject"],
+              contentTransformation: {
+                awsLambda: {
+                  functionArn: Token.asString(awsLambdaFunctionExample.arn),
+                },
+              },
+            },
+          ],
+        },
+        name: "example",
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3ControlObjectLambdaAccessPointExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `accountId` - (Optional) The AWS account ID for the owner of the bucket for which you want to create an Object Lambda Access Point. Defaults to automatically determined account ID of the Terraform AWS provider.
+* `configuration` - (Required) A configuration block containing details about the Object Lambda Access Point. See [Configuration](#configuration) below for more details.
+* `name` - (Required) The name for this Object Lambda Access Point.
+
+### Configuration
+
+The `configuration` block supports the following:
+
+* `allowedFeatures` - (Optional) Allowed features. Valid values: `getObjectRange`, `getObjectPartNumber`.
+* `cloudWatchMetricsEnabled` - (Optional) Whether or not the CloudWatch metrics configuration is enabled.
+* `supportingAccessPoint` - (Required) Standard access point associated with the Object Lambda Access Point.
+* `transformationConfiguration` - (Required) List of transformation configurations for the Object Lambda Access Point. See [Transformation Configuration](#transformation-configuration) below for more details.
+
+### Transformation Configuration
+
+The `transformationConfiguration` block supports the following:
+
+* `actions` - (Required) The actions of an Object Lambda Access Point configuration. Valid values: `getObject`.
+* `contentTransformation` - (Required) The content transformation of an Object Lambda Access Point configuration. See [Content Transformation](#content-transformation) below for more details.
+
+### Content Transformation
+
+The `contentTransformation` block supports the following:
+
+* `awsLambda` - (Required) Configuration for an AWS Lambda function. See [AWS Lambda](#aws-lambda) below for more details.
+
+### AWS Lambda
+
+The `awsLambda` block supports the following:
+
+* `functionArn` - (Required) The Amazon Resource Name (ARN) of the AWS Lambda function.
+* `functionPayload` - (Optional) Additional JSON that provides supplemental data to the Lambda function used to transform objects.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `alias` - Alias for the S3 Object Lambda Access Point.
+* `arn` - Amazon Resource Name (ARN) of the Object Lambda Access Point.
+* `id` - The AWS account ID and access point name separated by a colon (`:`).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Object Lambda Access Points using the `accountId` and `name`, separated by a colon (`:`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Object Lambda Access Points using the `accountId` and `name`, separated by a colon (`:`). For example:
+
+```console
+% terraform import aws_s3control_object_lambda_access_point.example 123456789012:example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1722496a257bb581d51080c0ab0b09b859a573051013001e69e87f94d3f99bed -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/s3control_object_lambda_access_point_policy.html.markdown b/website/docs/cdktf/typescript/r/s3control_object_lambda_access_point_policy.html.markdown
new file mode 100644
index 00000000000..aa82f6e9e69
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/s3control_object_lambda_access_point_policy.html.markdown
@@ -0,0 +1,125 @@
+---
+subcategory: "S3 Control"
+layout: "aws"
+page_title: "AWS: aws_s3control_object_lambda_access_point_policy"
+description: |-
+  Provides a resource to manage an S3 Object Lambda Access Point resource policy.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_s3control_object_lambda_access_point_policy
+
+Provides a resource to manage an S3 Object Lambda Access Point resource policy.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, Fn, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3AccessPoint } from "./.gen/providers/aws/s3-access-point";
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3ControlObjectLambdaAccessPoint } from "./.gen/providers/aws/s3-control-object-lambda-access-point";
+import { S3ControlObjectLambdaAccessPointPolicy } from "./.gen/providers/aws/s3-control-object-lambda-access-point-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new S3Bucket(this, "example", {
+      bucket: "example",
+    });
+    const awsS3AccessPointExample = new S3AccessPoint(this, "example_1", {
+      bucket: example.id,
+      name: "example",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3AccessPointExample.overrideLogicalId("example");
+    const awsS3ControlObjectLambdaAccessPointExample =
+      new S3ControlObjectLambdaAccessPoint(this, "example_2", {
+        configuration: {
+          supportingAccessPoint: Token.asString(awsS3AccessPointExample.arn),
+          transformationConfiguration: [
+            {
+              actions: ["GetObject"],
+              contentTransformation: {
+                awsLambda: {
+                  functionArn: Token.asString(awsLambdaFunctionExample.arn),
+                },
+              },
+            },
+          ],
+        },
+        name: "example",
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3ControlObjectLambdaAccessPointExample.overrideLogicalId("example");
+    const awsS3ControlObjectLambdaAccessPointPolicyExample =
+      new S3ControlObjectLambdaAccessPointPolicy(this, "example_3", {
+        name: Token.asString(awsS3ControlObjectLambdaAccessPointExample.name),
+        policy: Token.asString(
+          Fn.jsonencode({
+            Statement: [
+              {
+                Action: "s3-object-lambda:GetObject",
+                Effect: "Allow",
+                Principal: {
+                  AWS: current.accountId,
+                },
+                Resource: awsS3ControlObjectLambdaAccessPointExample.arn,
+              },
+            ],
+            Version: "2008-10-17",
+          })
+        ),
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3ControlObjectLambdaAccessPointPolicyExample.overrideLogicalId(
+      "example"
+    );
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `accountId` - (Optional) The AWS account ID for the account that owns the Object Lambda Access Point. Defaults to automatically determined account ID of the Terraform AWS provider.
+* `name` - (Required) The name of the Object Lambda Access Point.
+* `policy` - (Required) The Object Lambda Access Point resource policy document.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `hasPublicAccessPolicy` - Indicates whether this access point currently has a policy that allows public access.
+* `id` - The AWS account ID and access point name separated by a colon (`:`).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Object Lambda Access Point policies using the `accountId` and `name`, separated by a colon (`:`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Object Lambda Access Point policies using the `accountId` and `name`, separated by a colon (`:`). For example:
+
+```console
+% terraform import aws_s3control_object_lambda_access_point_policy.example 123456789012:example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-5b9c13a7dd0a431d893638258adc51525d5b10d18a0ee8ec93b51bafe8ccf083 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/s3control_storage_lens_configuration.html.markdown b/website/docs/cdktf/typescript/r/s3control_storage_lens_configuration.html.markdown
new file mode 100644
index 00000000000..17e54f2804a
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/s3control_storage_lens_configuration.html.markdown
@@ -0,0 +1,241 @@
+---
+subcategory: "S3 Control"
+layout: "aws"
+page_title: "AWS: aws_s3control_storage_lens_configuration"
+description: |-
+  Provides a resource to manage an S3 Storage Lens configuration.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_s3control_storage_lens_configuration
+
+Provides a resource to manage an S3 Storage Lens configuration.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCallerIdentity } from "./.gen/providers/aws/data-aws-caller-identity";
+import { S3ControlStorageLensConfiguration } from "./.gen/providers/aws/s3-control-storage-lens-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const current = new DataAwsCallerIdentity(this, "current", {});
+    new S3ControlStorageLensConfiguration(this, "example", {
+      configId: "example-1",
+      storageLensConfiguration: {
+        accountLevel: {
+          activityMetrics: {
+            enabled: true,
+          },
+          bucketLevel: {
+            activityMetrics: {
+              enabled: true,
+            },
+          },
+        },
+        dataExport: {
+          cloudWatchMetrics: {
+            enabled: true,
+          },
+          s3BucketDestination: {
+            accountId: Token.asString(current.accountId),
+            arn: target.arn,
+            encryption: {
+              sseS3: [{}],
+            },
+            format: "CSV",
+            outputSchemaVersion: "V_1",
+          },
+        },
+        enabled: true,
+        exclude: {
+          buckets: [b1.arn, b2.arn],
+          regions: ["us-east-2"],
+        },
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `accountId` - (Optional) The AWS account ID for the S3 Storage Lens configuration. Defaults to automatically determined account ID of the Terraform AWS provider.
+* `configId` - (Required) The ID of the S3 Storage Lens configuration.
+* `storageLensConfiguration` - (Required) The S3 Storage Lens configuration. See [Storage Lens Configuration](#storage-lens-configuration) below for more details.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Storage Lens Configuration
+
+The `storageLensConfiguration` block supports the following:
+
+* `accountLevel` (Required) The account-level configurations of the S3 Storage Lens configuration. See [Account Level](#account-level) below for more details.
+* `awsOrg` (Optional) The Amazon Web Services organization for the S3 Storage Lens configuration. See [AWS Org](#aws-org) below for more details.
+* `dataExport` (Optional) Properties of S3 Storage Lens metrics export including the destination, schema and format. See [Data Export](#data-export) below for more details.
+* `enabled` (Required) Whether the S3 Storage Lens configuration is enabled.
+* `exclude` (Optional) What is excluded in this configuration. Conflicts with `include`. See [Exclude](#exclude) below for more details.
+* `include` (Optional) What is included in this configuration. Conflicts with `exclude`. See [Include](#include) below for more details.
+
+### Account Level
+
+The `accountLevel` block supports the following:
+
+* `activityMetrics` (Optional) S3 Storage Lens activity metrics. See [Activity Metrics](#activity-metrics) below for more details.
+* `advancedCostOptimizationMetrics` (Optional) Advanced cost-optimization metrics for S3 Storage Lens. See [Advanced Cost-Optimization Metrics](#advanced-cost-optimization-metrics) below for more details.
+* `advancedDataProtectionMetrics` (Optional) Advanced data-protection metrics for S3 Storage Lens. See [Advanced Data-Protection Metrics](#advanced-data-protection-metrics) below for more details.
+* `bucketLevel` (Required) S3 Storage Lens bucket-level configuration. See [Bucket Level](#bucket-level) below for more details.
+* `detailedStatusCodeMetrics` (Optional) Detailed status code metrics for S3 Storage Lens. See [Detailed Status Code Metrics](#detailed-status-code-metrics) below for more details.
+
+### Activity Metrics
+
+The `activityMetrics` block supports the following:
+
+* `enabled` (Optional) Whether the activity metrics are enabled.
+
+### Advanced Cost-Optimization Metrics
+
+The `advancedCostOptimizationMetrics` block supports the following:
+
+* `enabled` (Optional) Whether advanced cost-optimization metrics are enabled.
+
+### Advanced Data-Protection Metrics
+
+The `advancedDataProtectionMetrics` block supports the following:
+
+* `enabled` (Optional) Whether advanced data-protection metrics are enabled.
+
+### Detailed Status Code Metrics
+
+The `detailedStatusCodeMetrics` block supports the following:
+
+* `enabled` (Optional) Whether detailed status code metrics are enabled.
+
+### Bucket Level
+
+The `bucketLevel` block supports the following:
+
+* `activityMetrics` (Optional) S3 Storage Lens activity metrics. See [Activity Metrics](#activity-metrics) above for more details.
+* `advancedCostOptimizationMetrics` (Optional) Advanced cost-optimization metrics for S3 Storage Lens. See [Advanced Cost-Optimization Metrics](#advanced-cost-optimization-metrics) above for more details.
+* `advancedDataProtectionMetrics` (Optional) Advanced data-protection metrics for S3 Storage Lens. See [Advanced Data-Protection Metrics](#advanced-data-protection-metrics) above for more details.
+* `detailedStatusCodeMetrics` (Optional) Detailed status code metrics for S3 Storage Lens. See [Detailed Status Code Metrics](#detailed-status-code-metrics) above for more details.
+* `prefixLevel` (Optional) Prefix-level metrics for S3 Storage Lens. See [Prefix Level](#prefix-level) below for more details.
+
+### Prefix Level
+
+The `prefixLevel` block supports the following:
+
+* `storageMetrics` (Required) Prefix-level storage metrics for S3 Storage Lens. See [Prefix Level Storage Metrics](#prefix-level-storage-metrics) below for more details.
+
+### Prefix Level Storage Metrics
+
+The `storageMetrics` block supports the following:
+
+* `enabled` (Optional) Whether prefix-level storage metrics are enabled.
+* `selectionCriteria` (Optional) Selection criteria. See [Selection Criteria](#selection-criteria) below for more details.
+
+### Selection Criteria
+
+The `selectionCriteria` block supports the following:
+
+* `delimiter` (Optional) The delimiter of the selection criteria being used.
+* `maxDepth` (Optional) The max depth of the selection criteria.
+* `minStorageBytesPercentage` (Optional) The minimum number of storage bytes percentage whose metrics will be selected.
+
+### AWS Org
+
+The `awsOrg` block supports the following:
+
+* `arn` (Required) The Amazon Resource Name (ARN) of the Amazon Web Services organization.
+
+### Data Export
+
+The `dataExport` block supports the following:
+
+* `cloudWatchMetrics` (Optional) Amazon CloudWatch publishing for S3 Storage Lens metrics. See [Cloud Watch Metrics](#cloud-watch-metrics) below for more details.
+* `s3BucketDestination` (Optional) The bucket where the S3 Storage Lens metrics export will be located. See [S3 Bucket Destination](#s3-bucket-destination) below for more details.
+
+### Cloud Watch Metrics
+
+The `cloudWatchMetrics` block supports the following:
+
+* `enabled` (Required) Whether CloudWatch publishing for S3 Storage Lens metrics is enabled.
+
+### S3 Bucket Destination
+
+The `s3BucketDestination` block supports the following:
+
+* `accountId` (Required) The account ID of the owner of the S3 Storage Lens metrics export bucket.
+* `arn` (Required) The Amazon Resource Name (ARN) of the bucket.
+* `encryption` (Optional) Encryption of the metrics exports in this bucket. See [Encryption](#encryption) below for more details.
+* `format` (Required) The export format. Valid values: `csv`, `parquet`.
+* `outputSchemaVersion` (Required) The schema version of the export file. Valid values: `v1`.
+* `prefix` (Optional) The prefix of the destination bucket where the metrics export will be delivered.
+
+### Encryption
+
+The `encryption` block supports the following:
+
+* `sseKms` (Optional) SSE-KMS encryption. See [SSE KMS](#sse-kms) below for more details.
+* `sseS3` (Optional) SSE-S3 encryption. An empty configuration block `{}` should be used.
+
+### SSE KMS
+
+The `sseKms` block supports the following:
+
+* `keyId` (Required) KMS key ARN.
+
+### Exclude
+
+The `exclude` block supports the following:
+
+* `buckets` (Optional) List of S3 bucket ARNs.
+* `regions` (Optional) List of AWS Regions.
+
+### Include
+
+The `include` block supports the following:
+
+* `buckets` (Optional) List of S3 bucket ARNs.
+* `regions` (Optional) List of AWS Regions.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the S3 Storage Lens configuration.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import S3 Storage Lens configurations using the `accountId` and `configId`, separated by a colon (`:`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import S3 Storage Lens configurations using the `accountId` and `configId`, separated by a colon (`:`). For example:
+
+```console
+% terraform import aws_s3control_storage_lens_configuration.example 123456789012:example-1
+```
+
+<!-- cache-key: cdktf-0.18.0 input-9a78e0cfb3d6a96dedf49697ad6a9c2449a751f987c0e874d9a0f885a390fd34 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/s3outposts_endpoint.html.markdown b/website/docs/cdktf/typescript/r/s3outposts_endpoint.html.markdown
new file mode 100644
index 00000000000..97be72d6df6
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/s3outposts_endpoint.html.markdown
@@ -0,0 +1,82 @@
+---
+subcategory: "S3 on Outposts"
+layout: "aws"
+page_title: "AWS: aws_s3outposts_endpoint"
+description: |-
+  Manages an S3 Outposts Endpoint.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_s3outposts_endpoint
+
+Provides a resource to manage an S3 Outposts Endpoint.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3OutpostsEndpoint } from "./.gen/providers/aws/s3-outposts-endpoint";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new S3OutpostsEndpoint(this, "example", {
+      outpostId: Token.asString(dataAwsOutpostsOutpostExample.id),
+      securityGroupId: Token.asString(awsSecurityGroupExample.id),
+      subnetId: Token.asString(awsSubnetExample.id),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `outpostId` - (Required) Identifier of the Outpost to contain this endpoint.
+* `securityGroupId` - (Required) Identifier of the EC2 Security Group.
+* `subnetId` - (Required) Identifier of the EC2 Subnet.
+* `accessType` - (Optional) Type of access for the network connectivity. Valid values are `private` or `customerOwnedIp`.
+* `customerOwnedIpv4Pool` - (Optional) The ID of a Customer Owned IP Pool. For more on customer owned IP addresses see the [User Guide](https://docs.aws.amazon.com/outposts/latest/userguide/local-rack.html#local-gateway-subnet).
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the endpoint.
+* `cidrBlock` - VPC CIDR block of the endpoint.
+* `creationTime` - UTC creation time in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8).
+* `id` - Amazon Resource Name (ARN) of the endpoint.
+* `networkInterfaces` - Set of nested attributes for associated Elastic Network Interfaces (ENIs).
+    * `networkInterfaceId` - Identifier of the Elastic Network Interface (ENI).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import S3 Outposts Endpoints using Amazon Resource Name (ARN), EC2 Security Group identifier, and EC2 Subnet identifier, separated by commas (`,`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import S3 Outposts Endpoints using Amazon Resource Name (ARN), EC2 Security Group identifier, and EC2 Subnet identifier, separated by commas (`,`). For example:
+
+```console
+% terraform import aws_s3outposts_endpoint.example arn:aws:s3-outposts:us-east-1:123456789012:outpost/op-12345678/endpoint/0123456789abcdef,sg-12345678,subnet-12345678
+```
+
+<!-- cache-key: cdktf-0.18.0 input-b93127d0ddadbf29aad3870a10cc0f25e4ba9456be004933e642fe9c8e38df8b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/sagemaker_app.html.markdown b/website/docs/cdktf/typescript/r/sagemaker_app.html.markdown
new file mode 100644
index 00000000000..dae6ab3b808
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/sagemaker_app.html.markdown
@@ -0,0 +1,93 @@
+---
+subcategory: "SageMaker"
+layout: "aws"
+page_title: "AWS: aws_sagemaker_app"
+description: |-
+  Provides a SageMaker App resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sagemaker_app
+
+Provides a SageMaker App resource.
+
+## Example Usage
+
+### Basic usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SagemakerApp } from "./.gen/providers/aws/sagemaker-app";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SagemakerApp(this, "example", {
+      appName: "example",
+      appType: "JupyterServer",
+      domainId: Token.asString(awsSagemakerDomainExample.id),
+      userProfileName: Token.asString(
+        awsSagemakerUserProfileExample.userProfileName
+      ),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `appName` - (Required) The name of the app.
+* `appType` - (Required) The type of app. Valid values are `jupyterServer`, `kernelGateway`, `rStudioServerPro`, `rSessionGateway` and `tensorBoard`.
+* `domainId` - (Required) The domain ID.
+* `userProfileName` - (Optional) The user profile name. At least one of `userProfileName` or `spaceName` required.
+* `resourceSpec` - (Optional) The instance type and the Amazon Resource Name (ARN) of the SageMaker image created on the instance.See [Resource Spec](#resource-spec) below.
+* `spaceName` - (Optional) The name of the space. At least one of `userProfileName` or `spaceName` required.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Resource Spec
+
+* `instanceType` - (Optional) The instance type that the image version runs on. For valid values see [SageMaker Instance Types](https://docs.aws.amazon.com/sagemaker/latest/dg/notebooks-available-instance-types.html).
+* `lifecycleConfigArn` - (Optional) The Amazon Resource Name (ARN) of the Lifecycle Configuration attached to the Resource.
+* `sagemakerImageArn` - (Optional) The ARN of the SageMaker image that the image version belongs to.
+* `sagemakerImageVersionArn` - (Optional) The ARN of the image version created on the instance.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Amazon Resource Name (ARN) of the app.
+* `arn` - The Amazon Resource Name (ARN) of the app.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SageMaker Apps using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import SageMaker Apps using the `id`. For example:
+
+```console
+% terraform import aws_sagemaker_app.example arn:aws:sagemaker:us-west-2:012345678912:app/domain-id/user-profile-name/app-type/app-name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-4688869d2d0264f189f117e28cdcaf279c2dff5e6217ac2d39772da0562dc585 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/sagemaker_app_image_config.html.markdown b/website/docs/cdktf/typescript/r/sagemaker_app_image_config.html.markdown
new file mode 100644
index 00000000000..0f5feb44fa6
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/sagemaker_app_image_config.html.markdown
@@ -0,0 +1,128 @@
+---
+subcategory: "SageMaker"
+layout: "aws"
+page_title: "AWS: aws_sagemaker_app_image_config"
+description: |-
+  Provides a SageMaker App Image Config resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sagemaker_app_image_config
+
+Provides a SageMaker App Image Config resource.
+
+## Example Usage
+
+### Basic usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SagemakerAppImageConfig } from "./.gen/providers/aws/sagemaker-app-image-config";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SagemakerAppImageConfig(this, "test", {
+      appImageConfigName: "example",
+      kernelGatewayImageConfig: {
+        kernelSpec: {
+          name: "example",
+        },
+      },
+    });
+  }
+}
+
+```
+
+### Default File System Config
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SagemakerAppImageConfig } from "./.gen/providers/aws/sagemaker-app-image-config";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SagemakerAppImageConfig(this, "test", {
+      appImageConfigName: "example",
+      kernelGatewayImageConfig: {
+        fileSystemConfig: {},
+        kernelSpec: {
+          name: "example",
+        },
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `appImageConfigName` - (Required) The name of the App Image Config.
+* `kernelGatewayImageConfig` - (Optional) The configuration for the file system and kernels in a SageMaker image running as a KernelGateway app. See [Kernel Gateway Image Config](#kernel-gateway-image-config) details below.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Kernel Gateway Image Config
+
+* `fileSystemConfig` - (Optional) The URL where the Git repository is located. See [File System Config](#file-system-config) details below.
+* `kernelSpec` - (Required) The default branch for the Git repository. See [Kernel Spec](#kernel-spec) details below.
+
+#### File System Config
+
+* `defaultGid` - (Optional) The default POSIX group ID (GID). If not specified, defaults to `100`. Valid values are `0` and `100`.
+* `defaultUid` - (Optional) The default POSIX user ID (UID). If not specified, defaults to `1000`. Valid values are `0` and `1000`.
+* `mountPath` - (Optional) The path within the image to mount the user's EFS home directory. The directory should be empty. If not specified, defaults to `/home/sagemakerUser`.
+
+~> **Note:** When specifying `defaultGid` and `defaultUid`, Valid value pairs are [`0`, `0`] and [`100`, `1000`].
+
+#### Kernel Spec
+
+* `name` - (Required) The name of the kernel.
+* `displayName` - (Optional) The display name of the kernel.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name of the App Image Config.
+* `arn` - The Amazon Resource Name (ARN) assigned by AWS to this App Image Config.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SageMaker App Image Configs using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import SageMaker App Image Configs using the `name`. For example:
+
+```console
+% terraform import aws_sagemaker_app_image_config.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-14b8c3e01271c34e8ad48f2ba367733e64aa64d95172742acd5b077fbda38cb8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/sagemaker_code_repository.html.markdown b/website/docs/cdktf/typescript/r/sagemaker_code_repository.html.markdown
new file mode 100644
index 00000000000..b0a5742e64a
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/sagemaker_code_repository.html.markdown
@@ -0,0 +1,138 @@
+---
+subcategory: "SageMaker"
+layout: "aws"
+page_title: "AWS: aws_sagemaker_code_repository"
+description: |-
+  Provides a SageMaker Code Repository resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sagemaker_code_repository
+
+Provides a SageMaker Code Repository resource.
+
+## Example Usage
+
+### Basic usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SagemakerCodeRepository } from "./.gen/providers/aws/sagemaker-code-repository";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SagemakerCodeRepository(this, "example", {
+      codeRepositoryName: "example",
+      gitConfig: {
+        repositoryUrl:
+          "https://github.com/hashicorp/terraform-provider-aws.git",
+      },
+    });
+  }
+}
+
+```
+
+### Example with Secret
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SagemakerCodeRepository } from "./.gen/providers/aws/sagemaker-code-repository";
+import { SecretsmanagerSecret } from "./.gen/providers/aws/secretsmanager-secret";
+import { SecretsmanagerSecretVersion } from "./.gen/providers/aws/secretsmanager-secret-version";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new SecretsmanagerSecret(this, "example", {
+      name: "example",
+    });
+    const awsSecretsmanagerSecretVersionExample =
+      new SecretsmanagerSecretVersion(this, "example_1", {
+        secretId: example.id,
+        secretString: Token.asString(
+          Fn.jsonencode({
+            password: "example",
+            username: "example",
+          })
+        ),
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSecretsmanagerSecretVersionExample.overrideLogicalId("example");
+    const awsSagemakerCodeRepositoryExample = new SagemakerCodeRepository(
+      this,
+      "example_2",
+      {
+        codeRepositoryName: "example",
+        dependsOn: [awsSecretsmanagerSecretVersionExample],
+        gitConfig: {
+          repositoryUrl:
+            "https://github.com/hashicorp/terraform-provider-aws.git",
+          secretArn: example.arn,
+        },
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSagemakerCodeRepositoryExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `codeRepositoryName` - (Required) The name of the Code Repository (must be unique).
+* `gitConfig` - (Required) Specifies details about the repository. see [Git Config](#git-config) details below.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Git Config
+
+* `repositoryUrl` - (Required) The URL where the Git repository is located.
+* `branch` - (Optional) The default branch for the Git repository.
+* `secretArn` - (Optional) The Amazon Resource Name (ARN) of the AWS Secrets Manager secret that contains the credentials used to access the git repository. The secret must have a staging label of AWSCURRENT and must be in the following format: `{"username": UserName, "password": Password}`
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name of the Code Repository.
+* `arn` - The Amazon Resource Name (ARN) assigned by AWS to this Code Repository.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SageMaker Code Repositories using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import SageMaker Code Repositories using the `name`. For example:
+
+```console
+% terraform import aws_sagemaker_code_repository.test_code_repository my-code-repo
+```
+
+<!-- cache-key: cdktf-0.18.0 input-f41c8a9771692edb44a7045ff9315ec42a11e03a25966ecdac6ca144a79c5a90 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/sagemaker_data_quality_job_definition.html.markdown b/website/docs/cdktf/typescript/r/sagemaker_data_quality_job_definition.html.markdown
new file mode 100644
index 00000000000..16c89d3e1a8
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/sagemaker_data_quality_job_definition.html.markdown
@@ -0,0 +1,202 @@
+---
+subcategory: "SageMaker"
+layout: "aws"
+page_title: "AWS: aws_sagemaker_data_quality_job_definition"
+description: |-
+  Provides a SageMaker Data Quality Job Definition resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sagemaker_data_quality_job_definition
+
+Provides a SageMaker data quality job definition resource.
+
+## Example Usage
+
+Basic usage:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SagemakerDataQualityJobDefinition } from "./.gen/providers/aws/sagemaker-data-quality-job-definition";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SagemakerDataQualityJobDefinition(this, "test", {
+      dataQualityAppSpecification: {
+        imageUri: Token.asString(monitor.registryPath),
+      },
+      dataQualityJobInput: {
+        endpointInput: {
+          endpointName: myEndpoint.name,
+        },
+      },
+      dataQualityJobOutputConfig: {
+        monitoringOutputs: {
+          s3Output: {
+            s3Uri:
+              "https://${" + myBucket.bucketRegionalDomainName + "}/output",
+          },
+        },
+      },
+      jobResources: {
+        clusterConfig: {
+          instanceCount: 1,
+          instanceType: "ml.t3.medium",
+          volumeSizeInGb: 20,
+        },
+      },
+      name: "my-data-quality-job-definition",
+      roleArn: myRole.arn,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `dataQualityAppSpecification` - (Required) Specifies the container that runs the monitoring job. Fields are documented below.
+* `dataQualityBaselineConfig` - (Optional) Configures the constraints and baselines for the monitoring job. Fields are documented below.
+* `dataQualityJobInput` - (Required) A list of inputs for the monitoring job. Fields are documented below.
+* `dataQualityJobOutputConfig` - (Required) The output configuration for monitoring jobs. Fields are documented below.
+* `jobResources` - (Required) Identifies the resources to deploy for a monitoring job. Fields are documented below.
+* `name` - (Optional) The name of the data quality job definition. If omitted, Terraform will assign a random, unique name.
+* `networkConfig` - (Optional) Specifies networking configuration for the monitoring job. Fields are documented below.
+* `roleArn` - (Required) The Amazon Resource Name (ARN) of an IAM role that Amazon SageMaker can assume to perform tasks on your behalf.
+* `stoppingCondition` - (Optional) A time limit for how long the monitoring job is allowed to run before stopping. Fields are documented below.
+* `tags` - (Optional) A mapping of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### data_quality_app_specification
+
+* `environment` - (Optional) Sets the environment variables in the container that the monitoring job runs. A list of key value pairs.
+* `imageUri` - (Required) The container image that the data quality monitoring job runs.
+* `postAnalyticsProcessorSourceUri` - (Optional) An Amazon S3 URI to a script that is called after analysis has been performed. Applicable only for the built-in (first party) containers.
+* `recordPreprocessorSourceUri` - (Optional) An Amazon S3 URI to a script that is called per row prior to running analysis. It can base64 decode the payload and convert it into a flatted json so that the built-in container can use the converted data. Applicable only for the built-in (first party) containers.
+
+### data_quality_baseline_config
+
+* `constraintsResource` - (Optional) The constraints resource for a monitoring job. Fields are documented below.
+* `statisticsResource` - (Optional) The statistics resource for a monitoring job. Fields are documented below.
+
+#### constraints_resource
+
+* `s3Uri` - (Optional) The Amazon S3 URI for the constraints resource.
+
+#### statistics_resource
+
+* `s3Uri` - (Optional) The Amazon S3 URI for the statistics resource.
+
+### data_quality_job_input
+
+* `batchTransformInput` - (Optional) Input object for the batch transform job. Fields are documented below.
+* `endpointInput` - (Optional) Input object for the endpoint. Fields are documented below.
+
+#### batch_transform_input
+
+* `dataCapturedDestinationS3Uri` - (Required) The Amazon S3 location being used to capture the data.
+* `datasetFormat` - (Required) The dataset format for your batch transform job. Fields are documented below.
+* `localPath` - (Optional) Path to the filesystem where the batch transform data is available to the container. Defaults to `/opt/ml/processing/input`.
+* `s3DataDistributionType` - (Optional) Whether input data distributed in Amazon S3 is fully replicated or sharded by an S3 key. Defaults to `fullyReplicated`. Valid values are `fullyReplicated` or `shardedByS3Key`
+* `s3InputMode` - (Optional) Whether the `pipe` or `file` is used as the input mode for transferring data for the monitoring job. `pipe` mode is recommended for large datasets. `file` mode is useful for small files that fit in memory. Defaults to `file`.  Valid values are `pipe` or `file`
+
+##### dataset_format
+
+* `csv` - (Optional) The CSV dataset used in the monitoring job. Fields are documented below.
+* `json` - (Optional) The JSON dataset used in the monitoring job. Fields are documented below.
+
+###### csv
+
+* `header` - (Optional) Indicates if the CSV data has a header.
+
+###### json
+
+* `line` - (Optional) Indicates if the file should be read as a json object per line.
+
+#### endpoint_input
+
+* `endpointName` - (Required) An endpoint in customer's account which has `dataCaptureConfig` enabled.
+* `localPath` - (Optional) Path to the filesystem where the endpoint data is available to the container. Defaults to `/opt/ml/processing/input`.
+* `s3DataDistributionType` - (Optional) Whether input data distributed in Amazon S3 is fully replicated or sharded by an S3 key. Defaults to `fullyReplicated`. Valid values are `fullyReplicated` or `shardedByS3Key`
+* `s3InputMode` - (Optional) Whether the `pipe` or `file` is used as the input mode for transferring data for the monitoring job. `pipe` mode is recommended for large datasets. `file` mode is useful for small files that fit in memory. Defaults to `file`.  Valid values are `pipe` or `file`
+
+### data_quality_job_output_config
+
+* `kmsKeyId` - (Optional) The AWS Key Management Service (AWS KMS) key that Amazon SageMaker uses to encrypt the model artifacts at rest using Amazon S3 server-side encryption.
+* `monitoringOutputs` - (Required) Monitoring outputs for monitoring jobs. This is where the output of the periodic monitoring jobs is uploaded. Fields are documented below.
+
+#### monitoring_outputs
+
+* `s3Output` - (Required) The Amazon S3 storage location where the results of a monitoring job are saved. Fields are documented below.
+
+##### s3_output
+
+* `localPath` - (Optional) The local path to the Amazon S3 storage location where Amazon SageMaker saves the results of a monitoring job. LocalPath is an absolute path for the output data. Defaults to `/opt/ml/processing/output`.
+* `s3UploadMode` - (Optional) Whether to upload the results of the monitoring job continuously or after the job completes. Valid values are `continuous` or `endOfJob`
+* `s3Uri` - (Required) A URI that identifies the Amazon S3 storage location where Amazon SageMaker saves the results of a monitoring job.
+
+### job_resources
+
+* `clusterConfig` - (Required) The configuration for the cluster resources used to run the processing job. Fields are documented below.
+
+#### cluster_config
+
+* `instanceCount` - (Required) The number of ML compute instances to use in the model monitoring job. For distributed processing jobs, specify a value greater than 1.
+* `instanceType` - (Required) The ML compute instance type for the processing job.
+* `volumeKmsKeyId` - (Optional) The AWS Key Management Service (AWS KMS) key that Amazon SageMaker uses to encrypt data on the storage volume attached to the ML compute instance(s) that run the model monitoring job.
+* `volumeSizeInGb` - (Required) The size of the ML storage volume, in gigabytes, that you want to provision. You must specify sufficient ML storage for your scenario.
+
+### network_config
+
+* `enableInterContainerTrafficEncryption` - (Optional) Whether to encrypt all communications between the instances used for the monitoring jobs. Choose `true` to encrypt communications. Encryption provides greater security for distributed jobs, but the processing might take longer.
+* `enableNetworkIsolation` - (Optional) Whether to allow inbound and outbound network calls to and from the containers used for the monitoring job.
+* `vpcConfig` - (Optional) Specifies a VPC that your training jobs and hosted models have access to. Control access to and from your training and model containers by configuring the VPC. Fields are documented below.
+
+#### vpc_config
+
+* `securityGroupIds` - (Required) The VPC security group IDs, in the form sg-xxxxxxxx. Specify the security groups for the VPC that is specified in the `subnets` field.
+* `subnets` - (Required) The ID of the subnets in the VPC to which you want to connect your training job or model.
+
+### stopping_condition
+
+* `maxRuntimeInSeconds` - (Required) The maximum runtime allowed in seconds.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) assigned by AWS to this data quality job definition.
+* `name` - The name of the data quality job definition.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import data quality job definitions using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import data quality job definitions using the `name`. For example:
+
+```console
+% terraform import aws_sagemaker_data_quality_job_definition.test_data_quality_job_definition data-quality-job-definition-foo
+```
+
+<!-- cache-key: cdktf-0.18.0 input-89befb37e0c306bddb162e6069b25cc35d269452c0d563034978f681c073a661 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/sagemaker_device.html.markdown b/website/docs/cdktf/typescript/r/sagemaker_device.html.markdown
new file mode 100644
index 00000000000..b328067998e
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/sagemaker_device.html.markdown
@@ -0,0 +1,86 @@
+---
+subcategory: "SageMaker"
+layout: "aws"
+page_title: "AWS: aws_sagemaker_device"
+description: |-
+  Provides a SageMaker Device resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sagemaker_device
+
+Provides a SageMaker Device resource.
+
+## Example Usage
+
+### Basic usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SagemakerDevice } from "./.gen/providers/aws/sagemaker-device";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SagemakerDevice(this, "example", {
+      device: {
+        deviceName: "example",
+      },
+      deviceFleetName: Token.asString(
+        awsSagemakerDeviceFleetExample.deviceFleetName
+      ),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `deviceFleetName` - (Required) The name of the Device Fleet.
+* `device` - (Required) The device to register with SageMaker Edge Manager. See [Device](#device) details below.
+
+### Device
+
+* `description` - (Required) A description for the device.
+* `deviceName` - (Optional) The name of the device.
+* `iotThingName` - (Optional) Amazon Web Services Internet of Things (IoT) object name.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The id is constructed from `deviceFleetName/deviceName`.
+* `arn` - The Amazon Resource Name (ARN) assigned by AWS to this Device.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SageMaker Devices using the `deviceFleetName/deviceName`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import SageMaker Devices using the `deviceFleetName/deviceName`. For example:
+
+```console
+% terraform import aws_sagemaker_device.example my-fleet/my-device
+```
+
+<!-- cache-key: cdktf-0.18.0 input-baa6c522eea0c7f933208c4fefa045d0c6a31387586c39061b3b1a1c768ab3ca -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/sagemaker_device_fleet.html.markdown b/website/docs/cdktf/typescript/r/sagemaker_device_fleet.html.markdown
new file mode 100644
index 00000000000..6a05ec97893
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/sagemaker_device_fleet.html.markdown
@@ -0,0 +1,89 @@
+---
+subcategory: "SageMaker"
+layout: "aws"
+page_title: "AWS: aws_sagemaker_device_fleet"
+description: |-
+  Provides a SageMaker Device Fleet resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sagemaker_device_fleet
+
+Provides a SageMaker Device Fleet resource.
+
+## Example Usage
+
+### Basic usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SagemakerDeviceFleet } from "./.gen/providers/aws/sagemaker-device-fleet";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SagemakerDeviceFleet(this, "example", {
+      deviceFleetName: "example",
+      outputConfig: {
+        s3OutputLocation: "s3://${" + awsS3BucketExample.bucket + "}/prefix/",
+      },
+      roleArn: test.arn,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `deviceFleetName` - (Required) The name of the Device Fleet (must be unique).
+* `roleArn` - (Required) The Amazon Resource Name (ARN) that has access to AWS Internet of Things (IoT).
+* `outputConfig` - (Required) Specifies details about the repository. see [Output Config](#output-config) details below.
+* `description` - (Optional) A description of the fleet.
+* `enableIotRoleAlias` - (Optional) Whether to create an AWS IoT Role Alias during device fleet creation. The name of the role alias generated will match this pattern: "SageMakerEdge-{DeviceFleetName}".
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Output Config
+
+* `s3OutputLocation` - (Required) The Amazon Simple Storage (S3) bucker URI.
+* `kmsKeyId` - (Optional) The AWS Key Management Service (AWS KMS) key that Amazon SageMaker uses to encrypt data on the storage volume after compilation job. If you don't provide a KMS key ID, Amazon SageMaker uses the default KMS key for Amazon S3 for your role's account.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name of the Device Fleet.
+* `arn` - The Amazon Resource Name (ARN) assigned by AWS to this Device Fleet.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SageMaker Device Fleets using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import SageMaker Device Fleets using the `name`. For example:
+
+```console
+% terraform import aws_sagemaker_device_fleet.example my-fleet
+```
+
+<!-- cache-key: cdktf-0.18.0 input-02fc3724649faa5d99b8102304ae3dbcf8bf2eccc9a7bae5038774ad140d380e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/sagemaker_domain.html.markdown b/website/docs/cdktf/typescript/r/sagemaker_domain.html.markdown
new file mode 100644
index 00000000000..9096087deee
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/sagemaker_domain.html.markdown
@@ -0,0 +1,296 @@
+---
+subcategory: "SageMaker"
+layout: "aws"
+page_title: "AWS: aws_sagemaker_domain"
+description: |-
+  Provides a SageMaker Domain resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sagemaker_domain
+
+Provides a SageMaker Domain resource.
+
+## Example Usage
+
+### Basic usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+import { SagemakerDomain } from "./.gen/providers/aws/sagemaker-domain";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new DataAwsIamPolicyDocument(this, "example", {
+      statement: [
+        {
+          actions: ["sts:AssumeRole"],
+          principals: [
+            {
+              identifiers: ["sagemaker.amazonaws.com"],
+              type: "Service",
+            },
+          ],
+        },
+      ],
+    });
+    const awsIamRoleExample = new IamRole(this, "example_1", {
+      assumeRolePolicy: Token.asString(example.json),
+      name: "example",
+      path: "/",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamRoleExample.overrideLogicalId("example");
+    const awsSagemakerDomainExample = new SagemakerDomain(this, "example_2", {
+      authMode: "IAM",
+      defaultUserSettings: {
+        executionRole: Token.asString(awsIamRoleExample.arn),
+      },
+      domainName: "example",
+      subnetIds: [Token.asString(awsSubnetExample.id)],
+      vpcId: Token.asString(awsVpcExample.id),
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSagemakerDomainExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### Using Custom Images
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SagemakerAppImageConfig } from "./.gen/providers/aws/sagemaker-app-image-config";
+import { SagemakerDomain } from "./.gen/providers/aws/sagemaker-domain";
+import { SagemakerImage } from "./.gen/providers/aws/sagemaker-image";
+import { SagemakerImageVersion } from "./.gen/providers/aws/sagemaker-image-version";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new SagemakerAppImageConfig(this, "example", {
+      appImageConfigName: "example",
+      kernelGatewayImageConfig: {
+        kernelSpec: {
+          name: "example",
+        },
+      },
+    });
+    const awsSagemakerImageExample = new SagemakerImage(this, "example_1", {
+      imageName: "example",
+      roleArn: Token.asString(awsIamRoleExample.arn),
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSagemakerImageExample.overrideLogicalId("example");
+    const awsSagemakerImageVersionExample = new SagemakerImageVersion(
+      this,
+      "example_2",
+      {
+        baseImage: "base-image",
+        imageName: Token.asString(awsSagemakerImageExample.id),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSagemakerImageVersionExample.overrideLogicalId("example");
+    const awsSagemakerDomainExample = new SagemakerDomain(this, "example_3", {
+      authMode: "IAM",
+      defaultUserSettings: {
+        executionRole: Token.asString(awsIamRoleExample.arn),
+        kernelGatewayAppSettings: {
+          customImage: [
+            {
+              appImageConfigName: example.appImageConfigName,
+              imageName: Token.asString(
+                awsSagemakerImageVersionExample.imageName
+              ),
+            },
+          ],
+        },
+      },
+      domainName: "example",
+      subnetIds: [Token.asString(awsSubnetExample.id)],
+      vpcId: Token.asString(awsVpcExample.id),
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSagemakerDomainExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `authMode` - (Required) The mode of authentication that members use to access the domain. Valid values are `iam` and `sso`.
+* `defaultSpaceSettings` - (Required) The default space settings. See [Default Space Settings](#default_space_settings) below.
+* `defaultUserSettings` - (Required) The default user settings. See [Default User Settings](#default_user_settings) below.* `domainName` - (Required) The domain name.
+* `subnetIds` - (Required) The VPC subnets that Studio uses for communication.
+* `vpcId` - (Required) The ID of the Amazon Virtual Private Cloud (VPC) that Studio uses for communication.
+
+The following arguments are optional:
+
+* `appNetworkAccessType` - (Optional) Specifies the VPC used for non-EFS traffic. The default value is `publicInternetOnly`. Valid values are `publicInternetOnly` and `vpcOnly`.
+* `appSecurityGroupManagement` - (Optional) The entity that creates and manages the required security groups for inter-app communication in `vpcOnly` mode. Valid values are `service` and `customer`.
+* `domainSettings` - (Optional) The domain settings. See [Domain Settings](#domain_settings) below.
+* `domainSettings` - (Optional) The domain's settings.
+* `kmsKeyId` - (Optional) The AWS KMS customer managed CMK used to encrypt the EFS volume attached to the domain.
+* `retentionPolicy` - (Optional) The retention policy for this domain, which specifies whether resources will be retained after the Domain is deleted. By default, all resources are retained. See [Retention Policy](#retention_policy) below.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### default_space_settings
+
+* `executionRole` - (Required) The execution role for the space.
+* `jupyterServerAppSettings` - (Optional) The Jupyter server's app settings. See [Jupyter Server App Settings](#jupyter_server_app_settings) below.
+* `kernelGatewayAppSettings` - (Optional) The kernel gateway app settings. See [Kernel Gateway App Settings](#kernel_gateway_app_settings) below.
+* `securityGroups` - (Optional) The security groups for the Amazon Virtual Private Cloud that the space uses for communication.
+
+### default_user_settings
+
+* `executionRole` - (Required) The execution role ARN for the user.
+* `canvasAppSettings` - (Optional) The Canvas app settings. See [Canvas App Settings](#canvas_app_settings) below.
+* `jupyterServerAppSettings` - (Optional) The Jupyter server's app settings. See [Jupyter Server App Settings](#jupyter_server_app_settings) below.
+* `kernelGatewayAppSettings` - (Optional) The kernel gateway app settings. See [Kernel Gateway App Settings](#kernel_gateway_app_settings) below.
+* `rSessionAppSettings` - (Optional) The RSession app settings. See [RSession App Settings](#r_session_app_settings) below.
+* `rStudioServerProAppSettings` - (Optional) A collection of settings that configure user interaction with the RStudioServerPro app. See [RStudioServerProAppSettings](#r_studio_server_pro_app_settings) below.
+* `securityGroups` - (Optional) A list of security group IDs that will be attached to the user.
+* `sharingSettings` - (Optional) The sharing settings. See [Sharing Settings](#sharing_settings) below.
+* `tensorBoardAppSettings` - (Optional) The TensorBoard app settings. See [TensorBoard App Settings](#tensor_board_app_settings) below.
+
+#### r_studio_server_pro_app_settings
+
+* `accessStatus` - (Optional) Indicates whether the current user has access to the RStudioServerPro app. Valid values are `enabled` and `disabled`.
+* `userGroup` - (Optional) The level of permissions that the user has within the RStudioServerPro app. This value defaults to `rStudioUser`. The `rStudioAdmin` value allows the user access to the RStudio Administrative Dashboard. Valid values are `rStudioUser` and `rStudioAdmin`.
+
+#### canvas_app_settings
+
+* `modelRegisterSettings` - (Optional) The model registry settings for the SageMaker Canvas application. See [Model Register Settings](#model_register_settings) below.
+* `timeSeriesForecastingSettings` - (Optional) Time series forecast settings for the Canvas app. See [Time Series Forecasting Settings](#time_series_forecasting_settings) below.
+* `workspaceSettings` - (Optional) The workspace settings for the SageMaker Canvas application. See [Workspace Settings](#workspace_settings) below.
+
+##### model_register_settings
+
+* `crossAccountModelRegisterRoleArn` - (Optional) The Amazon Resource Name (ARN) of the SageMaker model registry account. Required only to register model versions created by a different SageMaker Canvas AWS account than the AWS account in which SageMaker model registry is set up.
+* `status` - (Optional) Describes whether the integration to the model registry is enabled or disabled in the Canvas application. Valid values are `enabled` and `disabled`.
+
+##### time_series_forecasting_settings
+
+* `amazonForecastRoleArn` - (Optional) The IAM role that Canvas passes to Amazon Forecast for time series forecasting. By default, Canvas uses the execution role specified in the UserProfile that launches the Canvas app. If an execution role is not specified in the UserProfile, Canvas uses the execution role specified in the Domain that owns the UserProfile. To allow time series forecasting, this IAM role should have the [AmazonSageMakerCanvasForecastAccess](https://docs.aws.amazon.com/sagemaker/latest/dg/security-iam-awsmanpol-canvas.html#security-iam-awsmanpol-AmazonSageMakerCanvasForecastAccess) policy attached and forecast.amazonaws.com added in the trust relationship as a service principal.
+* `status` - (Optional) Describes whether time series forecasting is enabled or disabled in the Canvas app. Valid values are `enabled` and `disabled`.
+
+##### workspace_settings
+
+* `s3ArtifactPath` - (Optional) The Amazon S3 bucket used to store artifacts generated by Canvas. Updating the Amazon S3 location impacts existing configuration settings, and Canvas users no longer have access to their artifacts. Canvas users must log out and log back in to apply the new location.
+* `s3KmsKeyId` - (Optional) The Amazon Web Services Key Management Service (KMS) encryption key ID that is used to encrypt artifacts generated by Canvas in the Amazon S3 bucket.
+
+#### sharing_settings
+
+* `notebookOutputOption` - (Optional) Whether to include the notebook cell output when sharing the notebook. The default is `disabled`. Valid values are `allowed` and `disabled`.
+* `s3KmsKeyId` - (Optional) When `notebookOutputOption` is Allowed, the AWS Key Management Service (KMS) encryption key ID used to encrypt the notebook cell output in the Amazon S3 bucket.
+* `s3OutputPath` - (Optional) When `notebookOutputOption` is Allowed, the Amazon S3 bucket used to save the notebook cell output.
+
+#### tensor_board_app_settings
+
+* `defaultResourceSpec` - (Optional) The default instance type and the Amazon Resource Name (ARN) of the SageMaker image created on the instance. see [Default Resource Spec](#default_resource_spec) below.
+
+#### kernel_gateway_app_settings
+
+* `customImage` - (Optional) A list of custom SageMaker images that are configured to run as a KernelGateway app. see [Custom Image](#custom_image) below.
+* `defaultResourceSpec` - (Optional) The default instance type and the Amazon Resource Name (ARN) of the SageMaker image created on the instance. see [Default Resource Spec](#default_resource_spec) below.
+* `lifecycleConfigArns` - (Optional) The Amazon Resource Name (ARN) of the Lifecycle Configurations.
+
+#### jupyter_server_app_settings
+
+* `codeRepository` - (Optional) A list of Git repositories that SageMaker automatically displays to users for cloning in the JupyterServer application. see [Code Repository](#code_repository) below.
+* `defaultResourceSpec` - (Optional) The default instance type and the Amazon Resource Name (ARN) of the SageMaker image created on the instance. see [Default Resource Spec](#default_resource_spec) below.
+* `lifecycleConfigArns` - (Optional) The Amazon Resource Name (ARN) of the Lifecycle Configurations.
+
+##### code_repository
+
+* `repositoryUrl` - (Optional) The URL of the Git repository.
+
+##### default_resource_spec
+
+* `instanceType` - (Optional) The instance type that the image version runs on.. For valid values see [SageMaker Instance Types](https://docs.aws.amazon.com/sagemaker/latest/dg/notebooks-available-instance-types.html).
+* `lifecycleConfigArn` - (Optional) The Amazon Resource Name (ARN) of the Lifecycle Configuration attached to the Resource.
+* `sagemakerImageArn` - (Optional) The ARN of the SageMaker image that the image version belongs to.
+* `sagemakerImageVersionArn` - (Optional) The ARN of the image version created on the instance.
+
+#### r_session_app_settings
+
+* `customImage` - (Optional) A list of custom SageMaker images that are configured to run as a KernelGateway app. see [Custom Image](#custom_image) below.
+* `defaultResourceSpec` - (Optional) The default instance type and the Amazon Resource Name (ARN) of the SageMaker image created on the instance. see [Default Resource Spec](#default_resource_spec) below.
+
+##### custom_image
+
+* `appImageConfigName` - (Required) The name of the App Image Config.
+* `imageName` - (Required) The name of the Custom Image.
+* `imageVersionNumber` - (Optional) The version number of the Custom Image.
+
+### domain_settings
+
+* `executionRoleIdentityConfig` - (Optional) The configuration for attaching a SageMaker user profile name to the execution role as a sts:SourceIdentity key [AWS Docs](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_control-access_monitor.html). Valid values are `userProfileName` and `disabled`.
+* `rStudioServerProDomainSettings` - (Optional) A collection of settings that configure the RStudioServerPro Domain-level app. see [RStudioServerProDomainSettings](#r_studio_server_pro_domain_settings) below.
+* `securityGroupIds` - (Optional) The security groups for the Amazon Virtual Private Cloud that the Domain uses for communication between Domain-level apps and user apps.
+
+#### r_studio_server_pro_domain_settings
+
+* `defaultResourceSpec` - (Optional) The default instance type and the Amazon Resource Name (ARN) of the SageMaker image created on the instance. see [Default Resource Spec](#default_resource_spec) below.
+* `domainExecutionRoleArn` - (Required) The ARN of the execution role for the RStudioServerPro Domain-level app.
+* `rStudioConnectUrl` - (Optional) A URL pointing to an RStudio Connect server.
+* `rStudioPackageManagerUrl` - (Optional) A URL pointing to an RStudio Package Manager server.
+
+### retention_policy
+
+* `homeEfsFileSystem` - (Optional) The retention policy for data stored on an Amazon Elastic File System (EFS) volume. Valid values are `retain` or `delete`.  Default value is `retain`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the Domain.
+* `arn` - The Amazon Resource Name (ARN) assigned by AWS to this Domain.
+* `url` - The domain's URL.
+* `singleSignOnManagedApplicationInstanceId` - The SSO managed application instance ID.
+* `securityGroupIdForDomainBoundary` - The ID of the security group that authorizes traffic between the RSessionGateway apps and the RStudioServerPro app.
+* `homeEfsFileSystemId` - The ID of the Amazon Elastic File System (EFS) managed by this Domain.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SageMaker Domains using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import SageMaker Domains using the `id`. For example:
+
+```console
+% terraform import aws_sagemaker_domain.test_domain d-8jgsjtilstu8
+```
+
+<!-- cache-key: cdktf-0.18.0 input-19db5ea50c6e2c5430e3020c46bbc94271da9af4b5dcb1c6e538ebe50443f56a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/sagemaker_endpoint.html.markdown b/website/docs/cdktf/typescript/r/sagemaker_endpoint.html.markdown
new file mode 100644
index 00000000000..c1082a26430
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/sagemaker_endpoint.html.markdown
@@ -0,0 +1,136 @@
+---
+subcategory: "SageMaker"
+layout: "aws"
+page_title: "AWS: aws_sagemaker_endpoint"
+description: |-
+  Provides a SageMaker Endpoint resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sagemaker_endpoint
+
+Provides a SageMaker Endpoint resource.
+
+## Example Usage
+
+Basic usage:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SagemakerEndpoint } from "./.gen/providers/aws/sagemaker-endpoint";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SagemakerEndpoint(this, "e", {
+      endpointConfigName: ec.name,
+      name: "my-endpoint",
+      tags: {
+        Name: "foo",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `endpointConfigName` - (Required) The name of the endpoint configuration to use.
+* `deploymentConfig` - (Optional) The deployment configuration for an endpoint, which contains the desired deployment strategy and rollback configurations. See [Deployment Config](#deployment-config).
+* `name` - (Optional) The name of the endpoint. If omitted, Terraform will assign a random, unique name.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Deployment Config
+
+* `blueGreenUpdatePolicy` - (Optional) Update policy for a blue/green deployment. If this update policy is specified, SageMaker creates a new fleet during the deployment while maintaining the old fleet. SageMaker flips traffic to the new fleet according to the specified traffic routing configuration. Only one update policy should be used in the deployment configuration. If no update policy is specified, SageMaker uses a blue/green deployment strategy with all at once traffic shifting by default. See [Blue Green Update Config](#blue-green-update-config).
+* `autoRollbackConfiguration` - (Optional) Automatic rollback configuration for handling endpoint deployment failures and recovery. See [Auto Rollback Configuration](#auto-rollback-configuration).
+* `rollingUpdatePolicy` - (Optional) Specifies a rolling deployment strategy for updating a SageMaker endpoint. See [Rolling Update Policy](#rolling-update-policy).
+
+#### Blue Green Update Config
+
+* `trafficRoutingConfiguration` - (Required) Defines the traffic routing strategy to shift traffic from the old fleet to the new fleet during an endpoint deployment. See [Traffic Routing Configuration](#traffic-routing-configuration).
+* `maximumExecutionTimeoutInSeconds` - (Optional) Maximum execution timeout for the deployment. Note that the timeout value should be larger than the total waiting time specified in `terminationWaitInSeconds` and `waitIntervalInSeconds`. Valid values are between `600` and `14400`.
+* `terminationWaitInSeconds` - (Optional) Additional waiting time in seconds after the completion of an endpoint deployment before terminating the old endpoint fleet. Default is `0`. Valid values are between `0` and `3600`.
+
+#### Rolling Update Policy
+
+* `maximumBatchSize` - (Required) Batch size for each rolling step to provision capacity and turn on traffic on the new endpoint fleet, and terminate capacity on the old endpoint fleet. Value must be between 5% to 50% of the variant's total instance count. See [Maximum Batch Size](#maximum-batch-size).
+* `maximumExecutionTimeoutInSeconds` - (Optional) The time limit for the total deployment. Exceeding this limit causes a timeout. Valid values are between `600` and `14400`.
+* `rollbackMaximumBatchSize` - (Optional) Batch size for rollback to the old endpoint fleet. Each rolling step to provision capacity and turn on traffic on the old endpoint fleet, and terminate capacity on the new endpoint fleet. If this field is absent, the default value will be set to 100% of total capacity which means to bring up the whole capacity of the old fleet at once during rollback. See [Rollback Maximum Batch Size](#rollback-maximum-batch-size).
+* `waitIntervalInSeconds` - (Required) The length of the baking period, during which SageMaker monitors alarms for each batch on the new fleet. Valid values are between `0` and `3600`.
+
+##### Traffic Routing Configuration
+
+* `type` - (Required) Traffic routing strategy type. Valid values are: `allAtOnce`, `canary`, and `linear`.
+* `waitIntervalInSeconds` - (Required) The waiting time (in seconds) between incremental steps to turn on traffic on the new endpoint fleet. Valid values are between `0` and `3600`.
+* `canarySize` - (Optional) Batch size for the first step to turn on traffic on the new endpoint fleet. Value must be less than or equal to 50% of the variant's total instance count. See [Canary Size](#canary-size).
+* `linearStepSize` - (Optional) Batch size for each step to turn on traffic on the new endpoint fleet. Value must be 10-50% of the variant's total instance count. See [Linear Step Size](#linear-step-size).
+
+###### Maximum Batch Size
+
+* `type` - (Required) Specifies the endpoint capacity type. Valid values are: `instanceCount`, or `capacityPercent`.
+* `value` - (Required) Defines the capacity size, either as a number of instances or a capacity percentage.
+
+###### Rollback Maximum Batch Size
+
+* `type` - (Required) Specifies the endpoint capacity type. Valid values are: `instanceCount`, or `capacityPercent`.
+* `value` - (Required) Defines the capacity size, either as a number of instances or a capacity percentage.
+
+###### Canary Size
+
+* `type` - (Required) Specifies the endpoint capacity type. Valid values are: `instanceCount`, or `capacityPercent`.
+* `value` - (Required) Defines the capacity size, either as a number of instances or a capacity percentage.
+
+###### Linear Step Size
+
+* `type` - (Required) Specifies the endpoint capacity type. Valid values are: `instanceCount`, or `capacityPercent`.
+* `value` - (Required) Defines the capacity size, either as a number of instances or a capacity percentage.
+
+#### Auto Rollback Configuration
+
+* `alarms` - (Required) List of CloudWatch alarms in your account that are configured to monitor metrics on an endpoint. If any alarms are tripped during a deployment, SageMaker rolls back the deployment. See [Alarms](#alarms).
+
+##### Alarms
+
+* `alarmName` - (Required) The name of a CloudWatch alarm in your account.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) assigned by AWS to this endpoint.
+* `name` - The name of the endpoint.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import endpoints using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import endpoints using the `name`. For example:
+
+```console
+% terraform import aws_sagemaker_endpoint.test_endpoint my-endpoint
+```
+
+<!-- cache-key: cdktf-0.18.0 input-6f77eb68ca400c61f27b4fe0845a1a77a41772c28e3c6f22dc1c8cd4be29cc30 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/sagemaker_endpoint_configuration.html.markdown b/website/docs/cdktf/typescript/r/sagemaker_endpoint_configuration.html.markdown
new file mode 100644
index 00000000000..30d4567e6ea
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/sagemaker_endpoint_configuration.html.markdown
@@ -0,0 +1,159 @@
+---
+subcategory: "SageMaker"
+layout: "aws"
+page_title: "AWS: aws_sagemaker_endpoint_configuration"
+description: |-
+  Provides a SageMaker Endpoint Configuration resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sagemaker_endpoint_configuration
+
+Provides a SageMaker endpoint configuration resource.
+
+## Example Usage
+
+Basic usage:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SagemakerEndpointConfiguration } from "./.gen/providers/aws/sagemaker-endpoint-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SagemakerEndpointConfiguration(this, "ec", {
+      name: "my-endpoint-config",
+      productionVariants: [
+        {
+          initialInstanceCount: 1,
+          instanceType: "ml.t2.medium",
+          modelName: m.name,
+          variantName: "variant-1",
+        },
+      ],
+      tags: {
+        Name: "foo",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `productionVariants` - (Required) An list of ProductionVariant objects, one for each model that you want to host at this endpoint. Fields are documented below.
+* `kmsKeyArn` - (Optional) Amazon Resource Name (ARN) of a AWS Key Management Service key that Amazon SageMaker uses to encrypt data on the storage volume attached to the ML compute instance that hosts the endpoint.
+* `name` - (Optional) The name of the endpoint configuration. If omitted, Terraform will assign a random, unique name. Conflicts with `namePrefix`.
+* `namePrefix` - (Optional) Creates a unique endpoint configuration name beginning with the specified prefix. Conflicts with `name`.
+* `tags` - (Optional) A mapping of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `dataCaptureConfig` - (Optional) Specifies the parameters to capture input/output of SageMaker models endpoints. Fields are documented below.
+* `asyncInferenceConfig` - (Optional) Specifies configuration for how an endpoint performs asynchronous inference.
+* `shadowProductionVariants` - (Optional) Array of ProductionVariant objects. There is one for each model that you want to host at this endpoint in shadow mode with production traffic replicated from the model specified on ProductionVariants.If you use this field, you can only specify one variant for ProductionVariants and one variant for ShadowProductionVariants. Fields are documented below.
+
+### production_variants
+
+* `acceleratorType` - (Optional) The size of the Elastic Inference (EI) instance to use for the production variant.
+* `containerStartupHealthCheckTimeoutInSeconds` - (Optional) The timeout value, in seconds, for your inference container to pass health check by SageMaker Hosting. For more information about health check, see [How Your Container Should Respond to Health Check (Ping) Requests](https://docs.aws.amazon.com/sagemaker/latest/dg/your-algorithms-inference-code.html#your-algorithms-inference-algo-ping-requests). Valid values between `60` and `3600`.
+* `coreDumpConfig` - (Optional) Specifies configuration for a core dump from the model container when the process crashes. Fields are documented below.
+* `enableSsmAccess` - (Optional) You can use this parameter to turn on native Amazon Web Services Systems Manager (SSM) access for a production variant behind an endpoint. By default, SSM access is disabled for all production variants behind an endpoints.
+* `initialInstanceCount` - (Optional) Initial number of instances used for auto-scaling.
+* `instanceType` - (Optional)  The type of instance to start.
+* `initialVariantWeight` - (Optional) Determines initial traffic distribution among all of the models that you specify in the endpoint configuration. If unspecified, it defaults to `10`.
+* `modelDataDownloadTimeoutInSeconds` - (Optional) The timeout value, in seconds, to download and extract the model that you want to host from Amazon S3 to the individual inference instance associated with this production variant. Valid values between `60` and `3600`.
+* `modelName` - (Required) The name of the model to use.
+* `serverlessConfig` - (Optional) Specifies configuration for how an endpoint performs asynchronous inference.
+* `variantName` - (Optional) The name of the variant. If omitted, Terraform will assign a random, unique name.
+* `volumeSizeInGb` - (Optional) The size, in GB, of the ML storage volume attached to individual inference instance associated with the production variant. Valid values between `1` and `512`.
+
+#### core_dump_config
+
+* `destinationS3Uri` - (Required) The Amazon S3 bucket to send the core dump to.
+* `kmsKeyId` - (Required) The Amazon Web Services Key Management Service (Amazon Web Services KMS) key that SageMaker uses to encrypt the core dump data at rest using Amazon S3 server-side encryption.
+
+#### serverless_config
+
+* `maxConcurrency` - (Required) The maximum number of concurrent invocations your serverless endpoint can process. Valid values are between `1` and `200`.
+* `memorySizeInMb` - (Required) The memory size of your serverless endpoint. Valid values are in 1 GB increments: `1024` MB, `2048` MB, `3072` MB, `4096` MB, `5120` MB, or `6144` MB.
+* `provisionedConcurrency` - The amount of provisioned concurrency to allocate for the serverless endpoint. Should be less than or equal to `maxConcurrency`. Valid values are between `1` and `200`.
+
+### data_capture_config
+
+* `initialSamplingPercentage` - (Required) Portion of data to capture. Should be between 0 and 100.
+* `destinationS3Uri` - (Required) The URL for S3 location where the captured data is stored.
+* `captureOptions` - (Required) Specifies what data to capture. Fields are documented below.
+* `kmsKeyId` - (Optional) Amazon Resource Name (ARN) of a AWS Key Management Service key that Amazon SageMaker uses to encrypt the captured data on Amazon S3.
+* `enableCapture` - (Optional) Flag to enable data capture. Defaults to `false`.
+* `captureContentTypeHeader` - (Optional) The content type headers to capture. Fields are documented below.
+
+#### capture_options
+
+* `captureMode` - (Required) Specifies the data to be captured. Should be one of `input` or `output`.
+
+#### capture_content_type_header
+
+* `csvContentTypes` - (Optional) The CSV content type headers to capture.
+* `jsonContentTypes` - (Optional) The JSON content type headers to capture.
+
+### async_inference_config
+
+* `outputConfig` - (Required) Specifies the configuration for asynchronous inference invocation outputs.
+* `clientConfig` - (Optional) Configures the behavior of the client used by Amazon SageMaker to interact with the model container during asynchronous inference.
+
+#### client_config
+
+* `maxConcurrentInvocationsPerInstance` - (Optional) The maximum number of concurrent requests sent by the SageMaker client to the model container. If no value is provided, Amazon SageMaker will choose an optimal value for you.
+
+#### output_config
+
+* `s3OutputPath` - (Required) The Amazon S3 location to upload inference responses to.
+* `s3FailurePath` - (Optional) The Amazon S3 location to upload failure inference responses to.
+* `kmsKeyId` - (Optional) The Amazon Web Services Key Management Service (Amazon Web Services KMS) key that Amazon SageMaker uses to encrypt the asynchronous inference output in Amazon S3.
+* `notificationConfig` - (Optional) Specifies the configuration for notifications of inference results for asynchronous inference.
+
+##### notification_config
+
+* `includeInferenceResponseIn` - (Optional) The Amazon SNS topics where you want the inference response to be included. Valid values are `successNotificationTopic` and `errorNotificationTopic`.
+* `errorTopic` - (Optional) Amazon SNS topic to post a notification to when inference fails. If no topic is provided, no notification is sent on failure.
+* `successTopic` - (Optional) Amazon SNS topic to post a notification to when inference completes successfully. If no topic is provided, no notification is sent on success.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) assigned by AWS to this endpoint configuration.
+* `name` - The name of the endpoint configuration.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import endpoint configurations using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import endpoint configurations using the `name`. For example:
+
+```console
+% terraform import aws_sagemaker_endpoint_configuration.test_endpoint_config endpoint-config-foo
+```
+
+<!-- cache-key: cdktf-0.18.0 input-a480c542052fe4577930c727244f5ec85cceca16de58e98751ed63acbfadd2a7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/sagemaker_feature_group.html.markdown b/website/docs/cdktf/typescript/r/sagemaker_feature_group.html.markdown
new file mode 100644
index 00000000000..113a9e5113f
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/sagemaker_feature_group.html.markdown
@@ -0,0 +1,127 @@
+---
+subcategory: "SageMaker"
+layout: "aws"
+page_title: "AWS: aws_sagemaker_feature_group"
+description: |-
+  Provides a SageMaker Feature Group resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sagemaker_feature_group
+
+Provides a SageMaker Feature Group resource.
+
+## Example Usage
+
+Basic usage:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SagemakerFeatureGroup } from "./.gen/providers/aws/sagemaker-feature-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SagemakerFeatureGroup(this, "example", {
+      eventTimeFeatureName: "example",
+      featureDefinition: [
+        {
+          featureName: "example",
+          featureType: "String",
+        },
+      ],
+      featureGroupName: "example",
+      onlineStoreConfig: {
+        enableOnlineStore: true,
+      },
+      recordIdentifierFeatureName: "example",
+      roleArn: test.arn,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `featureGroupName` - (Required) The name of the Feature Group. The name must be unique within an AWS Region in an AWS account.
+* `recordIdentifierFeatureName` - (Required) The name of the Feature whose value uniquely identifies a Record defined in the Feature Store. Only the latest record per identifier value will be stored in the Online Store.
+* `eventTimeFeatureName` - (Required) The name of the feature that stores the EventTime of a Record in a Feature Group.
+* `description` (Optional) - A free-form description of a Feature Group.
+* `roleArn` (Required) - The Amazon Resource Name (ARN) of the IAM execution role used to persist data into the Offline Store if an `offlineStoreConfig` is provided.
+* `featureDefinition` (Optional) - A list of Feature names and types. See [Feature Definition](#feature-definition) Below.
+* `offlineStoreConfig` (Optional) - The Offline Feature Store Configuration. See [Offline Store Config](#offline-store-config) Below.
+* `onlineStoreConfig` (Optional) - The Online Feature Store Configuration. See [Online Store Config](#online-store-config) Below.
+* `tags` - (Optional) Map of resource tags for the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Feature Definition
+
+* `featureName` - (Required) The name of a feature. `featureName` cannot be any of the following: `isDeleted`, `writeTime`, `apiInvocationTime`.
+* `featureType` - (Required) The value type of a feature. Valid values are `integral`, `fractional`, or `string`.
+
+### Offline Store Config
+
+* `enableOnlineStore` - (Optional) Set to `true` to disable the automatic creation of an AWS Glue table when configuring an OfflineStore.
+* `s3StorageConfig` - (Required) The Amazon Simple Storage (Amazon S3) location of OfflineStore. See [S3 Storage Config](#s3-storage-config) Below.
+* `dataCatalogConfig` - (Optional) The meta data of the Glue table that is autogenerated when an OfflineStore is created. See [Data Catalog Config](#data-catalog-config) Below.
+* `tableFormat` - (Optional) Format for the offline store table. Supported formats are `glue` (Default) and Apache `iceberg` (https://iceberg.apache.org/).
+
+### Online Store Config
+
+* `disableGlueTableCreation` - (Optional) Set to `true` to turn Online Store On.
+* `securityConfig` - (Required) Security config for at-rest encryption of your OnlineStore. See [Security Config](#security-config) Below.
+
+#### S3 Storage Config
+
+* `kmsKeyId` - (Optional) The AWS Key Management Service (KMS) key ID of the key used to encrypt any objects written into the OfflineStore S3 location.
+* `s3Uri` - (Required) The S3 URI, or location in Amazon S3, of OfflineStore.
+
+#### Data Catalog Config
+
+* `catalog` - (Optional) The name of the Glue table catalog.
+* `database` - (Optional) The name of the Glue table database.
+* `tableName` - (Optional) The name of the Glue table.
+
+#### Security Config
+
+* `kmsKeyId` - (Optional) The ID of the AWS Key Management Service (AWS KMS) key that SageMaker Feature Store uses to encrypt the Amazon S3 objects at rest using Amazon S3 server-side encryption.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `name` - The name of the Feature Group.
+* `arn` - The Amazon Resource Name (ARN) assigned by AWS to this feature_group.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Feature Groups using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Feature Groups using the `name`. For example:
+
+```console
+% terraform import aws_sagemaker_feature_group.test_feature_group feature_group-foo
+```
+
+<!-- cache-key: cdktf-0.18.0 input-eefb539961fb646527b2555da9a1fead250ca66d7e9a8832078ebf9470d482a3 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/sagemaker_flow_definition.html.markdown b/website/docs/cdktf/typescript/r/sagemaker_flow_definition.html.markdown
new file mode 100644
index 00000000000..5e8f8b796f5
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/sagemaker_flow_definition.html.markdown
@@ -0,0 +1,219 @@
+---
+subcategory: "SageMaker"
+layout: "aws"
+page_title: "AWS: aws_sagemaker_flow_definition"
+description: |-
+  Provides a SageMaker Flow Definition resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sagemaker_flow_definition
+
+Provides a SageMaker Flow Definition resource.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SagemakerFlowDefinition } from "./.gen/providers/aws/sagemaker-flow-definition";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SagemakerFlowDefinition(this, "example", {
+      flowDefinitionName: "example",
+      humanLoopConfig: {
+        humanTaskUiArn: Token.asString(awsSagemakerHumanTaskUiExample.arn),
+        taskAvailabilityLifetimeInSeconds: 1,
+        taskCount: 1,
+        taskDescription: "example",
+        taskTitle: "example",
+        workteamArn: Token.asString(awsSagemakerWorkteamExample.arn),
+      },
+      outputConfig: {
+        s3OutputPath: "s3://${" + awsS3BucketExample.bucket + "}/",
+      },
+      roleArn: Token.asString(awsIamRoleExample.arn),
+    });
+  }
+}
+
+```
+
+### Public Workteam Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SagemakerFlowDefinition } from "./.gen/providers/aws/sagemaker-flow-definition";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SagemakerFlowDefinition(this, "example", {
+      flowDefinitionName: "example",
+      humanLoopConfig: {
+        humanTaskUiArn: Token.asString(awsSagemakerHumanTaskUiExample.arn),
+        publicWorkforceTaskPrice: {
+          amountInUsd: {
+            cents: 1,
+            tenthFractionsOfACent: 2,
+          },
+        },
+        taskAvailabilityLifetimeInSeconds: 1,
+        taskCount: 1,
+        taskDescription: "example",
+        taskTitle: "example",
+        workteamArn:
+          "arn:aws:sagemaker:${" +
+          current.name +
+          "}:394669845002:workteam/public-crowd/default",
+      },
+      outputConfig: {
+        s3OutputPath: "s3://${" + awsS3BucketExample.bucket + "}/",
+      },
+      roleArn: Token.asString(awsIamRoleExample.arn),
+    });
+  }
+}
+
+```
+
+### Human Loop Activation Config Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SagemakerFlowDefinition } from "./.gen/providers/aws/sagemaker-flow-definition";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SagemakerFlowDefinition(this, "example", {
+      flowDefinitionName: "example",
+      humanLoopActivationConfig: {
+        humanLoopActivationConditionsConfig: {
+          humanLoopActivationConditions:
+            '        {\n\t\t\t"Conditions": [\n\t\t\t  {\n\t\t\t\t"ConditionType": "Sampling",\n\t\t\t\t"ConditionParameters": {\n\t\t\t\t  "RandomSamplingPercentage": 5\n\t\t\t\t}\n\t\t\t  }\n\t\t\t]\n\t\t}\n\n',
+        },
+      },
+      humanLoopConfig: {
+        humanTaskUiArn: Token.asString(awsSagemakerHumanTaskUiExample.arn),
+        taskAvailabilityLifetimeInSeconds: 1,
+        taskCount: 1,
+        taskDescription: "example",
+        taskTitle: "example",
+        workteamArn: Token.asString(awsSagemakerWorkteamExample.arn),
+      },
+      humanLoopRequestSource: {
+        awsManagedHumanLoopRequestSource:
+          "AWS/Textract/AnalyzeDocument/Forms/V1",
+      },
+      outputConfig: {
+        s3OutputPath: "s3://${" + awsS3BucketExample.bucket + "}/",
+      },
+      roleArn: Token.asString(awsIamRoleExample.arn),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `flowDefinitionName` - (Required) The name of your flow definition.
+* `humanLoopConfig` - (Required)  An object containing information about the tasks the human reviewers will perform. See [Human Loop Config](#human-loop-config) details below.
+* `roleArn` - (Required) The Amazon Resource Name (ARN) of the role needed to call other services on your behalf.
+* `outputConfig` - (Required) An object containing information about where the human review results will be uploaded. See [Output Config](#output-config) details below.
+* `humanLoopActivationConfig` - (Optional) An object containing information about the events that trigger a human workflow. See [Human Loop Activation Config](#human-loop-activation-config) details below.
+* `humanLoopRequestSource` - (Optional) Container for configuring the source of human task requests. Use to specify if Amazon Rekognition or Amazon Textract is used as an integration source. See [Human Loop Request Source](#human-loop-request-source) details below.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Human Loop Config
+
+* `humanTaskUiArn` - (Required) The Amazon Resource Name (ARN) of the human task user interface.
+* `publicWorkforceTaskPrice` - (Optional) Defines the amount of money paid to an Amazon Mechanical Turk worker for each task performed. See [Public Workforce Task Price](#public-workforce-task-price) details below.
+* `taskAvailabilityLifetimeInSeconds` - (Required) The length of time that a task remains available for review by human workers. Valid value range between `1` and `864000`.
+* `taskCount` - (Required) The number of distinct workers who will perform the same task on each object. Valid value range between `1` and `3`.
+* `taskDescription` - (Required) A description for the human worker task.
+* `taskKeywords` - (Optional) An array of keywords used to describe the task so that workers can discover the task.
+* `taskTimeLimitInSeconds` - (Optional) The amount of time that a worker has to complete a task. The default value is `3600` seconds.
+* `taskTitle` - (Required) A title for the human worker task.
+* `workteamArn` - (Required) The Amazon Resource Name (ARN) of the human task user interface. Amazon Resource Name (ARN) of a team of workers. For Public workforces see [AWS Docs](https://docs.aws.amazon.com/sagemaker/latest/dg/sms-workforce-management-public.html).
+
+#### Public Workforce Task Price
+
+* `amountInUsd` - (Optional) Defines the amount of money paid to an Amazon Mechanical Turk worker in United States dollars. See [Amount In Usd](#amount-in-usd) details below.
+
+##### Amount In Usd
+
+* `cents` - (Optional) The fractional portion, in cents, of the amount. Valid value range between `0` and `99`.
+* `dollars` - (Optional) The whole number of dollars in the amount. Valid value range between `0` and `2`.
+* `tenthFractionsOfACent` - (Optional) Fractions of a cent, in tenths. Valid value range between `0` and `9`.
+
+### Human Loop Activation Config
+
+* `humanLoopActivationConditionsConfig` - (Required) defines under what conditions SageMaker creates a human loop. See [Human Loop Activation Conditions Config](#human-loop-activation-conditions-config) details below.
+
+#### Human Loop Activation Conditions Config
+
+* `humanLoopActivationConditions` - (Required) A JSON expressing use-case specific conditions declaratively. If any condition is matched, atomic tasks are created against the configured work team. For more information about how to structure the JSON, see [JSON Schema for Human Loop Activation Conditions in Amazon Augmented AI](https://docs.aws.amazon.com/sagemaker/latest/dg/a2i-human-fallback-conditions-json-schema.html).
+
+### Human Loop Request Source
+
+* `awsManagedHumanLoopRequestSource` - (Required) Specifies whether Amazon Rekognition or Amazon Textract are used as the integration source. Valid values are: `aws/rekognition/detectModerationLabels/image/v3` and `aws/textract/analyzeDocument/forms/v1`.
+
+### Output Config
+
+* `s3OutputPath` - (Required) The Amazon S3 path where the object containing human output will be made available.
+* `kmsKeyId` - (Optional) The Amazon Key Management Service (KMS) key ARN for server-side encryption.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) assigned by AWS to this Flow Definition.
+* `id` - The name of the Flow Definition.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SageMaker Flow Definitions using the `flowDefinitionName`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import SageMaker Flow Definitions using the `flowDefinitionName`. For example:
+
+```console
+% terraform import aws_sagemaker_flow_definition.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-e8fd07fc83ab3a1b65cb95209fcf2268f33197e551f1560760b16e1b34bf135b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/sagemaker_human_task_ui.html.markdown b/website/docs/cdktf/typescript/r/sagemaker_human_task_ui.html.markdown
new file mode 100644
index 00000000000..ebb85e566b0
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/sagemaker_human_task_ui.html.markdown
@@ -0,0 +1,90 @@
+---
+subcategory: "SageMaker"
+layout: "aws"
+page_title: "AWS: aws_sagemaker_human_task_ui"
+description: |-
+  Provides a SageMaker Human Task UI resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sagemaker_human_task_ui
+
+Provides a SageMaker Human Task UI resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SagemakerHumanTaskUi } from "./.gen/providers/aws/sagemaker-human-task-ui";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SagemakerHumanTaskUi(this, "example", {
+      humanTaskUiName: "example",
+      uiTemplate: {
+        content: Token.asString(
+          Fn.file("sagemaker-human-task-ui-template.html")
+        ),
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `humanTaskUiName` - (Required) The name of the Human Task UI.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `uiTemplate` - (Required) The Liquid template for the worker user interface. See [UI Template](#ui-template) below.
+
+### UI Template
+
+* `content` - (Required) The content of the Liquid template for the worker user interface.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) assigned by AWS to this Human Task UI.
+* `id` - The name of the Human Task UI.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `uiTemplate` - (Required) The Liquid template for the worker user interface. See [UI Template](#ui-template) below.
+
+### UI Template
+
+* `contentSha256` - The SHA-256 digest of the contents of the template.
+* `url` - The URL for the user interface template.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SageMaker Human Task UIs using the `humanTaskUiName`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import SageMaker Human Task UIs using the `humanTaskUiName`. For example:
+
+```console
+% terraform import aws_sagemaker_human_task_ui.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-0347aefb03f4de7b1e49c0835befda079c2fb5ecf326b1ae8183cd0caffa6dc5 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/sagemaker_image.html.markdown b/website/docs/cdktf/typescript/r/sagemaker_image.html.markdown
new file mode 100644
index 00000000000..0221085953a
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/sagemaker_image.html.markdown
@@ -0,0 +1,80 @@
+---
+subcategory: "SageMaker"
+layout: "aws"
+page_title: "AWS: aws_sagemaker_image"
+description: |-
+  Provides a SageMaker Image resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sagemaker_image
+
+Provides a SageMaker Image resource.
+
+## Example Usage
+
+### Basic usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SagemakerImage } from "./.gen/providers/aws/sagemaker-image";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SagemakerImage(this, "example", {
+      imageName: "example",
+      roleArn: test.arn,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `imageName` - (Required) The name of the image. Must be unique to your account.
+* `roleArn` - (Required) The Amazon Resource Name (ARN) of an IAM role that enables Amazon SageMaker to perform tasks on your behalf.
+* `displayName` - (Optional) The display name of the image. When the image is added to a domain (must be unique to the domain).
+* `description` - (Optional) The description of the image.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name of the Image.
+* `arn` - The Amazon Resource Name (ARN) assigned by AWS to this Image.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SageMaker Code Images using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import SageMaker Code Images using the `name`. For example:
+
+```console
+% terraform import aws_sagemaker_image.test_image my-code-repo
+```
+
+<!-- cache-key: cdktf-0.18.0 input-472a9b03f1ba8f793494df35ff1917699a39c258036a86d840cd026d9a0bfc60 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/sagemaker_image_version.html.markdown b/website/docs/cdktf/typescript/r/sagemaker_image_version.html.markdown
new file mode 100644
index 00000000000..fcfc9c45557
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/sagemaker_image_version.html.markdown
@@ -0,0 +1,78 @@
+---
+subcategory: "SageMaker"
+layout: "aws"
+page_title: "AWS: aws_sagemaker_image_version"
+description: |-
+  Provides a SageMaker Image Version resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sagemaker_image_version
+
+Provides a SageMaker Image Version resource.
+
+## Example Usage
+
+### Basic usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SagemakerImageVersion } from "./.gen/providers/aws/sagemaker-image-version";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SagemakerImageVersion(this, "test", {
+      baseImage: "012345678912.dkr.ecr.us-west-2.amazonaws.com/image:latest",
+      imageName: Token.asString(awsSagemakerImageTest.id),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `imageName` - (Required) The name of the image. Must be unique to your account.
+* `baseImage` - (Required) The registry path of the container image on which this image version is based.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name of the Image.
+* `arn` - The Amazon Resource Name (ARN) assigned by AWS to this Image Version.
+* `imageArn`- The Amazon Resource Name (ARN) of the image the version is based on.
+* `containerImage` - The registry path of the container image that contains this image version.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SageMaker Image Versions using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import SageMaker Image Versions using the `name`. For example:
+
+```console
+% terraform import aws_sagemaker_image_version.test_image my-code-repo
+```
+
+<!-- cache-key: cdktf-0.18.0 input-76269e9df5df1c846e439fc126e26d818b1de6f9baec3ce92b8c2bf4480e0909 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/sagemaker_model.html.markdown b/website/docs/cdktf/typescript/r/sagemaker_model.html.markdown
new file mode 100644
index 00000000000..59c209e87c9
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/sagemaker_model.html.markdown
@@ -0,0 +1,134 @@
+---
+subcategory: "SageMaker"
+layout: "aws"
+page_title: "AWS: aws_sagemaker_model"
+description: |-
+  Provides a SageMaker model resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sagemaker_model
+
+Provides a SageMaker model resource.
+
+## Example Usage
+
+Basic usage:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { DataAwsSagemakerPrebuiltEcrImage } from "./.gen/providers/aws/data-aws-sagemaker-prebuilt-ecr-image";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+import { SagemakerModel } from "./.gen/providers/aws/sagemaker-model";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const assumeRole = new DataAwsIamPolicyDocument(this, "assume_role", {
+      statement: [
+        {
+          actions: ["sts:AssumeRole"],
+          principals: [
+            {
+              identifiers: ["sagemaker.amazonaws.com"],
+              type: "Service",
+            },
+          ],
+        },
+      ],
+    });
+    const test = new DataAwsSagemakerPrebuiltEcrImage(this, "test", {
+      repositoryName: "kmeans",
+    });
+    const example = new IamRole(this, "example", {
+      assumeRolePolicy: Token.asString(assumeRole.json),
+    });
+    const awsSagemakerModelExample = new SagemakerModel(this, "example_3", {
+      executionRoleArn: example.arn,
+      name: "my-model",
+      primaryContainer: {
+        image: Token.asString(test.registryPath),
+      },
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSagemakerModelExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Optional) The name of the model (must be unique). If omitted, Terraform will assign a random, unique name.
+* `primaryContainer` - (Optional) The primary docker image containing inference code that is used when the model is deployed for predictions.  If not specified, the `container` argument is required. Fields are documented below.
+* `executionRoleArn` - (Required) A role that SageMaker can assume to access model artifacts and docker images for deployment.
+* `inferenceExecutionConfig` - (Optional) Specifies details of how containers in a multi-container endpoint are called. see [Inference Execution Config](#inference-execution-config).
+* `container` (Optional) -  Specifies containers in the inference pipeline. If not specified, the `primaryContainer` argument is required. Fields are documented below.
+* `enableNetworkIsolation` (Optional) - Isolates the model container. No inbound or outbound network calls can be made to or from the model container.
+* `vpcConfig` (Optional) - Specifies the VPC that you want your model to connect to. VpcConfig is used in hosting services and in batch transform.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+The `primaryContainer` and `container` block both support:
+
+* `image` - (Optional) The registry path where the inference code image is stored in Amazon ECR.
+* `mode` - (Optional) The container hosts value `singleModel/multiModel`. The default value is `singleModel`.
+* `modelDataUrl` - (Optional) The URL for the S3 location where model artifacts are stored.
+* `modelPackageName` - (Optional) The Amazon Resource Name (ARN) of the model package to use to create the model.
+* `containerHostname` - (Optional) The DNS host name for the container.
+* `environment` - (Optional) Environment variables for the Docker container.
+   A list of key value pairs.
+* `imageConfig` - (Optional) Specifies whether the model container is in Amazon ECR or a private Docker registry accessible from your Amazon Virtual Private Cloud (VPC). For more information see [Using a Private Docker Registry for Real-Time Inference Containers](https://docs.aws.amazon.com/sagemaker/latest/dg/your-algorithms-containers-inference-private.html). see [Image Config](#image-config).
+
+### Image Config
+
+* `repositoryAccessMode` - (Required) Specifies whether the model container is in Amazon ECR or a private Docker registry accessible from your Amazon Virtual Private Cloud (VPC). Allowed values are: `platform` and `vpc`.
+* `repositoryAuthConfig` - (Optional) Specifies an authentication configuration for the private docker registry where your model image is hosted. Specify a value for this property only if you specified Vpc as the value for the RepositoryAccessMode field, and the private Docker registry where the model image is hosted requires authentication. see [Repository Auth Config](#repository-auth-config).
+
+#### Repository Auth Config
+
+* `repositoryCredentialsProviderArn` - (Required) The Amazon Resource Name (ARN) of an AWS Lambda function that provides credentials to authenticate to the private Docker registry where your model image is hosted. For information about how to create an AWS Lambda function, see [Create a Lambda function with the console](https://docs.aws.amazon.com/lambda/latest/dg/getting-started-create-function.html) in the _AWS Lambda Developer Guide_.
+
+## Inference Execution Config
+
+* `mode` - (Required) How containers in a multi-container are run. The following values are valid `serial` and `direct`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `name` - The name of the model.
+* `arn` - The Amazon Resource Name (ARN) assigned by AWS to this model.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import models using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import models using the `name`. For example:
+
+```console
+% terraform import aws_sagemaker_model.test_model model-foo
+```
+
+<!-- cache-key: cdktf-0.18.0 input-53d6c468eddd1f29a98ecc8fc36ce24bea38081a6d6c05a93d9d1f563dbc5e78 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/sagemaker_model_package_group.html.markdown b/website/docs/cdktf/typescript/r/sagemaker_model_package_group.html.markdown
new file mode 100644
index 00000000000..fe37b83e369
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/sagemaker_model_package_group.html.markdown
@@ -0,0 +1,77 @@
+---
+subcategory: "SageMaker"
+layout: "aws"
+page_title: "AWS: aws_sagemaker_model_package_group"
+description: |-
+  Provides a SageMaker Model Package Group resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sagemaker_model_package_group
+
+Provides a SageMaker Model Package Group resource.
+
+## Example Usage
+
+### Basic usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SagemakerModelPackageGroup } from "./.gen/providers/aws/sagemaker-model-package-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SagemakerModelPackageGroup(this, "example", {
+      modelPackageGroupName: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `modelPackageGroupName` - (Required) The name of the model group.
+* `modelPackageGroupDescription` - (Optional) A description for the model group.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name of the Model Package Group.
+* `arn` - The Amazon Resource Name (ARN) assigned by AWS to this Model Package Group.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SageMaker Model Package Groups using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import SageMaker Model Package Groups using the `name`. For example:
+
+```console
+% terraform import aws_sagemaker_model_package_group.test_model_package_group my-code-repo
+```
+
+<!-- cache-key: cdktf-0.18.0 input-6cbdd92d6f2cf691b1eaf71a2be21368117e7d969b21a38c0f34bdf3312ebe2d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/sagemaker_model_package_group_policy.html.markdown b/website/docs/cdktf/typescript/r/sagemaker_model_package_group_policy.html.markdown
new file mode 100644
index 00000000000..5dcb5efb947
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/sagemaker_model_package_group_policy.html.markdown
@@ -0,0 +1,112 @@
+---
+subcategory: "SageMaker"
+layout: "aws"
+page_title: "AWS: aws_sagemaker_model_package_group_policy"
+description: |-
+  Provides a SageMaker Model Package Group Policy resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sagemaker_model_package_group_policy
+
+Provides a SageMaker Model Package Group Policy resource.
+
+## Example Usage
+
+### Basic usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, Fn, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCallerIdentity } from "./.gen/providers/aws/data-aws-caller-identity";
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { SagemakerModelPackageGroup } from "./.gen/providers/aws/sagemaker-model-package-group";
+import { SagemakerModelPackageGroupPolicy } from "./.gen/providers/aws/sagemaker-model-package-group-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new SagemakerModelPackageGroup(this, "example", {
+      modelPackageGroupName: "example",
+    });
+    const current = new DataAwsCallerIdentity(this, "current", {});
+    const dataAwsIamPolicyDocumentExample = new DataAwsIamPolicyDocument(
+      this,
+      "example_2",
+      {
+        statement: [
+          {
+            actions: [
+              "sagemaker:DescribeModelPackage",
+              "sagemaker:ListModelPackages",
+            ],
+            principals: [
+              {
+                identifiers: [Token.asString(current.accountId)],
+                type: "AWS",
+              },
+            ],
+            resources: [example.arn],
+            sid: "AddPermModelPackageGroup",
+          },
+        ],
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsIamPolicyDocumentExample.overrideLogicalId("example");
+    const awsSagemakerModelPackageGroupPolicyExample =
+      new SagemakerModelPackageGroupPolicy(this, "example_3", {
+        modelPackageGroupName: example.modelPackageGroupName,
+        resourcePolicy: Token.asString(
+          Fn.jsonencode(
+            Fn.jsondecode(Token.asString(dataAwsIamPolicyDocumentExample.json))
+          )
+        ),
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSagemakerModelPackageGroupPolicyExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `modelPackageGroupName` - (Required) The name of the model package group.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name of the Model Package Package Group.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SageMaker Model Package Groups using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import SageMaker Model Package Groups using the `name`. For example:
+
+```console
+% terraform import aws_sagemaker_model_package_group_policy.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-46286c0641f184f18c019c6248020bf4125d9e8e0f2d0db78bf45be76f1e8205 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/sagemaker_monitoring_schedule.html.markdown b/website/docs/cdktf/typescript/r/sagemaker_monitoring_schedule.html.markdown
new file mode 100644
index 00000000000..a59b693a5d0
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/sagemaker_monitoring_schedule.html.markdown
@@ -0,0 +1,93 @@
+---
+subcategory: "SageMaker"
+layout: "aws"
+page_title: "AWS: aws_sagemaker_monitoring_schedule"
+description: |-
+  Provides a SageMaker Monitoring Schedule resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sagemaker_monitoring_schedule
+
+Provides a SageMaker monitoring schedule resource.
+
+## Example Usage
+
+Basic usage:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SagemakerMonitoringSchedule } from "./.gen/providers/aws/sagemaker-monitoring-schedule";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SagemakerMonitoringSchedule(this, "test", {
+      monitoringScheduleConfig: {
+        monitoringJobDefinitionName: Token.asString(
+          awsSagemakerDataQualityJobDefinitionTest.name
+        ),
+        monitoringType: "DataQuality",
+      },
+      name: "my-monitoring-schedule",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `monitoringScheduleConfig` - (Required) The configuration object that specifies the monitoring schedule and defines the monitoring job. Fields are documented below.
+* `name` - (Optional) The name of the monitoring schedule. The name must be unique within an AWS Region within an AWS account. If omitted, Terraform will assign a random, unique name.
+* `tags` - (Optional) A mapping of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### monitoring_schedule_config
+
+* `monitoringJobDefinitionName` - (Required) The name of the monitoring job definition to schedule.
+* `monitoringType` - (Required) The type of the monitoring job definition to schedule. Valid values are `dataQuality`, `modelQuality`, `modelBias` or `modelExplainability`
+* `scheduleConfig` - (Optional) Configures the monitoring schedule. Fields are documented below.
+
+#### schedule_config
+
+* `scheduleExpression` - (Required) A cron expression that describes details about the monitoring schedule. For example, and hourly schedule would be `cron(0 * ? * * *)`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) assigned by AWS to this monitoring schedule.
+* `name` - The name of the monitoring schedule.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import monitoring schedules using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import monitoring schedules using the `name`. For example:
+
+```console
+% terraform import aws_sagemaker_monitoring_schedule.test_monitoring_schedule monitoring-schedule-foo
+```
+
+<!-- cache-key: cdktf-0.18.0 input-7596aa085f871099e9a876409d5f5ffeface2d09e575c3ce7a5e6974cf591269 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/sagemaker_notebook_instance.html.markdown b/website/docs/cdktf/typescript/r/sagemaker_notebook_instance.html.markdown
new file mode 100644
index 00000000000..3a6529621c8
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/sagemaker_notebook_instance.html.markdown
@@ -0,0 +1,138 @@
+---
+subcategory: "SageMaker"
+layout: "aws"
+page_title: "AWS: aws_sagemaker_notebook_instance"
+description: |-
+  Provides a SageMaker Notebook Instance resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sagemaker_notebook_instance
+
+Provides a SageMaker Notebook Instance resource.
+
+## Example Usage
+
+### Basic usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SagemakerNotebookInstance } from "./.gen/providers/aws/sagemaker-notebook-instance";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SagemakerNotebookInstance(this, "ni", {
+      instanceType: "ml.t2.medium",
+      name: "my-notebook-instance",
+      roleArn: role.arn,
+      tags: {
+        Name: "foo",
+      },
+    });
+  }
+}
+
+```
+
+### Code repository usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SagemakerCodeRepository } from "./.gen/providers/aws/sagemaker-code-repository";
+import { SagemakerNotebookInstance } from "./.gen/providers/aws/sagemaker-notebook-instance";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new SagemakerCodeRepository(this, "example", {
+      codeRepositoryName: "my-notebook-instance-code-repo",
+      gitConfig: {
+        repositoryUrl:
+          "https://github.com/hashicorp/terraform-provider-aws.git",
+      },
+    });
+    new SagemakerNotebookInstance(this, "ni", {
+      defaultCodeRepository: example.codeRepositoryName,
+      instanceType: "ml.t2.medium",
+      name: "my-notebook-instance",
+      roleArn: role.arn,
+      tags: {
+        Name: "foo",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the notebook instance (must be unique).
+* `roleArn` - (Required) The ARN of the IAM role to be used by the notebook instance which allows SageMaker to call other services on your behalf.
+* `instanceType` - (Required) The name of ML compute instance type.
+* `platformIdentifier` - (Optional) The platform identifier of the notebook instance runtime environment. This value can be either `notebookAl1V1`, `notebookAl2V1`, or  `notebookAl2V2`, depending on which version of Amazon Linux you require.
+* `volumeSize` - (Optional) The size, in GB, of the ML storage volume to attach to the notebook instance. The default value is 5 GB.
+* `subnetId` - (Optional) The VPC subnet ID.
+* `securityGroups` - (Optional) The associated security groups.
+* `acceleratorTypes` - (Optional) A list of Elastic Inference (EI) instance types to associate with this notebook instance. See [Elastic Inference Accelerator](https://docs.aws.amazon.com/sagemaker/latest/dg/ei.html) for more details. Valid values: `mlEia1Medium`, `mlEia1Large`, `mlEia1Xlarge`, `mlEia2Medium`, `mlEia2Large`, `mlEia2Xlarge`.
+* `additionalCodeRepositories` - (Optional) An array of up to three Git repositories to associate with the notebook instance.
+ These can be either the names of Git repositories stored as resources in your account, or the URL of Git repositories in [AWS CodeCommit](https://docs.aws.amazon.com/codecommit/latest/userguide/welcome.html) or in any other Git repository. These repositories are cloned at the same level as the default repository of your notebook instance.
+* `defaultCodeRepository` - (Optional) The Git repository associated with the notebook instance as its default code repository. This can be either the name of a Git repository stored as a resource in your account, or the URL of a Git repository in [AWS CodeCommit](https://docs.aws.amazon.com/codecommit/latest/userguide/welcome.html) or in any other Git repository.
+* `directInternetAccess` - (Optional) Set to `disabled` to disable internet access to notebook. Requires `securityGroups` and `subnetId` to be set. Supported values: `enabled` (Default) or `disabled`. If set to `disabled`, the notebook instance will be able to access resources only in your VPC, and will not be able to connect to Amazon SageMaker training and endpoint services unless your configure a NAT Gateway in your VPC.
+* `instanceMetadataServiceConfiguration` - (Optional) Information on the IMDS configuration of the notebook instance. Conflicts with `instanceMetadataServiceConfiguration`. see details below.
+* `kmsKeyId` - (Optional) The AWS Key Management Service (AWS KMS) key that Amazon SageMaker uses to encrypt the model artifacts at rest using Amazon S3 server-side encryption.
+* `lifecycleConfigName` - (Optional) The name of a lifecycle configuration to associate with the notebook instance.
+* `rootAccess` - (Optional) Whether root access is `enabled` or `disabled` for users of the notebook instance. The default value is `enabled`.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### instance_metadata_service_configuration
+
+* `minimumInstanceMetadataServiceVersion` - (Optional) Indicates the minimum IMDS version that the notebook instance supports. When passed "1" is passed. This means that both IMDSv1 and IMDSv2 are supported. Valid values are `1` and `2`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name of the notebook instance.
+* `arn` - The Amazon Resource Name (ARN) assigned by AWS to this notebook instance.
+* `url` - The URL that you use to connect to the Jupyter notebook that is running in your notebook instance.
+* `networkInterfaceId` - The network interface ID that Amazon SageMaker created at the time of creating the instance. Only available when setting `subnetId`.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SageMaker Notebook Instances using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import SageMaker Notebook Instances using the `name`. For example:
+
+```console
+% terraform import aws_sagemaker_notebook_instance.test_notebook_instance my-notebook-instance
+```
+
+<!-- cache-key: cdktf-0.18.0 input-5e252144d6a5568e5371adc34a319d772ad3c8b4f238312ded06d5c31a1b0f15 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/sagemaker_notebook_instance_lifecycle_configuration.html.markdown b/website/docs/cdktf/typescript/r/sagemaker_notebook_instance_lifecycle_configuration.html.markdown
new file mode 100644
index 00000000000..59975b2e314
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/sagemaker_notebook_instance_lifecycle_configuration.html.markdown
@@ -0,0 +1,77 @@
+---
+subcategory: "SageMaker"
+layout: "aws"
+page_title: "AWS: aws_sagemaker_notebook_instance_lifecycle_configuration"
+description: |-
+  Provides a lifecycle configuration for SageMaker Notebook Instances.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sagemaker_notebook_instance_lifecycle_configuration
+
+Provides a lifecycle configuration for SageMaker Notebook Instances.
+
+## Example Usage
+
+Usage:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SagemakerNotebookInstanceLifecycleConfiguration } from "./.gen/providers/aws/sagemaker-notebook-instance-lifecycle-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SagemakerNotebookInstanceLifecycleConfiguration(this, "lc", {
+      name: "foo",
+      onCreate: Token.asString(Fn.base64encode("echo foo")),
+      onStart: Token.asString(Fn.base64encode("echo bar")),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Optional) The name of the lifecycle configuration (must be unique). If omitted, Terraform will assign a random, unique name.
+* `onCreate` - (Optional) A shell script (base64-encoded) that runs only once when the SageMaker Notebook Instance is created.
+* `onStart` - (Optional) A shell script (base64-encoded) that runs every time the SageMaker Notebook Instance is started including the time it's created.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) assigned by AWS to this lifecycle configuration.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import models using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import models using the `name`. For example:
+
+```console
+% terraform import aws_sagemaker_notebook_instance_lifecycle_configuration.lc foo
+```
+
+<!-- cache-key: cdktf-0.18.0 input-5e110cd77e6a012eaab724d615a7f74ade584854ae6093e0bce3c82605f33152 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/sagemaker_pipeline.html.markdown b/website/docs/cdktf/typescript/r/sagemaker_pipeline.html.markdown
new file mode 100644
index 00000000000..f0b6ba8d587
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/sagemaker_pipeline.html.markdown
@@ -0,0 +1,108 @@
+---
+subcategory: "SageMaker"
+layout: "aws"
+page_title: "AWS: aws_sagemaker_pipeline"
+description: |-
+  Provides a SageMaker Pipeline resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sagemaker_pipeline
+
+Provides a SageMaker Pipeline resource.
+
+## Example Usage
+
+### Basic usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SagemakerPipeline } from "./.gen/providers/aws/sagemaker-pipeline";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SagemakerPipeline(this, "example", {
+      pipelineDefinition: Token.asString(
+        Fn.jsonencode({
+          Steps: [
+            {
+              Arguments: {
+                ErrorMessage: "test",
+              },
+              Name: "Test",
+              Type: "Fail",
+            },
+          ],
+          Version: "2020-12-01",
+        })
+      ),
+      pipelineDisplayName: "example",
+      pipelineName: "example",
+      roleArn: Token.asString(awsIamRoleExample.arn),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `pipelineName` - (Required) The name of the pipeline.
+* `pipelineDescription` - (Optional) A description of the pipeline.
+* `pipelineDisplayName` - (Required) The display name of the pipeline.
+* `pipelineDefinition` - (Optional) The [JSON pipeline definition](https://aws-sagemaker-mlops.github.io/sagemaker-model-building-pipeline-definition-JSON-schema/) of the pipeline.
+* `pipelineDefinitionS3Location` - (Optional) The location of the pipeline definition stored in Amazon S3. If specified, SageMaker will retrieve the pipeline definition from this location. see [Pipeline Definition S3 Location](#pipeline-definition-s3-location) details below.
+* `roleArn` - (Required) The name of the Pipeline (must be unique).
+* `parallelismConfiguration` - (Optional) This is the configuration that controls the parallelism of the pipeline. If specified, it applies to all runs of this pipeline by default. see [Parallelism Configuration](#parallelism-configuration) details below.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Parallelism Configuration
+
+* `maxParallelExecutionSteps` - (Required) The max number of steps that can be executed in parallel.
+
+### Pipeline Definition S3 Location
+
+* `bucket` - (Required) Name of the S3 bucket.
+* `objectKey` - (Required) The object key (or key name) uniquely identifies the object in an S3 bucket.
+* `versionId` - (Optional) Version Id of the pipeline definition file. If not specified, Amazon SageMaker will retrieve the latest version.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name of the Pipeline.
+* `arn` - The Amazon Resource Name (ARN) assigned by AWS to this Pipeline.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import pipelines using the `pipelineName`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import pipelines using the `pipelineName`. For example:
+
+```console
+% terraform import aws_sagemaker_pipeline.test_pipeline pipeline
+```
+
+<!-- cache-key: cdktf-0.18.0 input-77df217f0bd5424f0de8e1484ad88c9938cdb5dd0e244c67997eeafb13cfaed4 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/sagemaker_project.html.markdown b/website/docs/cdktf/typescript/r/sagemaker_project.html.markdown
new file mode 100644
index 00000000000..6998b0ab96a
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/sagemaker_project.html.markdown
@@ -0,0 +1,94 @@
+---
+subcategory: "SageMaker"
+layout: "aws"
+page_title: "AWS: aws_sagemaker_project"
+description: |-
+  Provides a SageMaker Project resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sagemaker_project
+
+Provides a SageMaker Project resource.
+
+ -> Note: If you are trying to use SageMaker projects with SageMaker studio you will need to add a tag with the key `sagemaker:studioVisibility` with value `true`. For more on requirements to use projects and permission needed see [AWS Docs](https://docs.aws.amazon.com/sagemaker/latest/dg/sagemaker-projects-templates-custom.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SagemakerProject } from "./.gen/providers/aws/sagemaker-project";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SagemakerProject(this, "example", {
+      projectName: "example",
+      serviceCatalogProvisioningDetails: {
+        productId: Token.asString(awsServicecatalogProductExample.id),
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `projectName` - (Required) The name of the Project.
+* `projectDescription` - (Optional) A description for the project.
+* `serviceCatalogProvisioningDetails` - (Required) The product ID and provisioning artifact ID to provision a service catalog. See [Service Catalog Provisioning Details](#service-catalog-provisioning-details) below.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Service Catalog Provisioning Details
+
+* `pathId` - (Optional) The path identifier of the product. This value is optional if the product has a default path, and required if the product has more than one path.
+* `productId` - (Required) The ID of the product to provision.
+* `provisioningArtifactId` - (Optional) The ID of the provisioning artifact.
+* `provisioningParameter` - (Optional) A list of key value pairs that you specify when you provision a product. See [Provisioning Parameter](#provisioning-parameter) below.
+
+#### Provisioning Parameter
+
+* `key` - (Required) The key that identifies a provisioning parameter.
+* `value` - (Optional) The value of the provisioning parameter.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) assigned by AWS to this Project.
+* `id` - The name of the Project.
+* `projectId` - The ID of the project.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SageMaker Projects using the `projectName`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import SageMaker Projects using the `projectName`. For example:
+
+```console
+% terraform import aws_sagemaker_project.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-5d67b37f736cf104db6893c21c2531fd0183fe8f2dd008b379c345da42e3802b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/sagemaker_servicecatalog_portfolio_status.html.markdown b/website/docs/cdktf/typescript/r/sagemaker_servicecatalog_portfolio_status.html.markdown
new file mode 100644
index 00000000000..618f9bd5742
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/sagemaker_servicecatalog_portfolio_status.html.markdown
@@ -0,0 +1,73 @@
+---
+subcategory: "SageMaker"
+layout: "aws"
+page_title: "AWS: aws_sagemaker_servicecatalog_portfolio_status"
+description: |-
+  Manages status of Service Catalog in SageMaker. Service Catalog is used to create SageMaker projects.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sagemaker_servicecatalog_portfolio_status
+
+Manages status of Service Catalog in SageMaker. Service Catalog is used to create SageMaker projects.
+
+## Example Usage
+
+Usage:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SagemakerServicecatalogPortfolioStatus } from "./.gen/providers/aws/sagemaker-servicecatalog-portfolio-status";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SagemakerServicecatalogPortfolioStatus(this, "example", {
+      status: "Enabled",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `status` - (Required) Whether Service Catalog is enabled or disabled in SageMaker. Valid values are `enabled` and `disabled`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The AWS Region the Servicecatalog portfolio status resides in.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import models using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import models using the `id`. For example:
+
+```console
+% terraform import aws_sagemaker_servicecatalog_portfolio_status.example us-east-1
+```
+
+<!-- cache-key: cdktf-0.18.0 input-2e0548d06e23711e11dc17dd10cee2ad35217d3c9b0c59bd26f59909041dd9a9 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/sagemaker_space.html.markdown b/website/docs/cdktf/typescript/r/sagemaker_space.html.markdown
new file mode 100644
index 00000000000..cb52e196553
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/sagemaker_space.html.markdown
@@ -0,0 +1,114 @@
+---
+subcategory: "SageMaker"
+layout: "aws"
+page_title: "AWS: aws_sagemaker_space"
+description: |-
+  Provides a SageMaker Space resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sagemaker_space
+
+Provides a SageMaker Space resource.
+
+## Example Usage
+
+### Basic usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SagemakerSpace } from "./.gen/providers/aws/sagemaker-space";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SagemakerSpace(this, "example", {
+      domainId: test.id,
+      spaceName: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `spaceName` - (Required) The name of the space.
+* `domainId` - (Required) The ID of the associated Domain.
+* `spaceSettings` - (Required) A collection of space settings. See [Space Settings](#space-settings) below.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Space Settings
+
+* `jupyterServerAppSettings` - (Optional) The Jupyter server's app settings. See [Jupyter Server App Settings](#jupyter-server-app-settings) below.
+* `kernelGatewayAppSettings` - (Optional) The kernel gateway app settings. See [Kernel Gateway App Settings](#kernel-gateway-app-settings) below.
+
+#### Kernel Gateway App Settings
+
+* `defaultResourceSpec` - (Optional) The default instance type and the Amazon Resource Name (ARN) of the SageMaker image created on the instance. see [Default Resource Spec](#default-resource-spec) below.
+* `customImage` - (Optional) A list of custom SageMaker images that are configured to run as a KernelGateway app. see [Custom Image](#custom-image) below.
+* `lifecycleConfigArns` - (Optional) The Amazon Resource Name (ARN) of the Lifecycle Configurations.
+
+#### Jupyter Server App Settings
+
+* `codeRepository` - (Optional) A list of Git repositories that SageMaker automatically displays to users for cloning in the JupyterServer application. see [Code Repository](#code-repository) below.
+* `defaultResourceSpec` - (Optional) The default instance type and the Amazon Resource Name (ARN) of the SageMaker image created on the instance. see [Default Resource Spec](#default-resource-spec) below.
+* `lifecycleConfigArns` - (Optional) The Amazon Resource Name (ARN) of the Lifecycle Configurations.
+
+##### Code Repository
+
+* `repositoryUrl` - (Optional) The URL of the Git repository.
+
+##### Default Resource Spec
+
+* `instanceType` - (Optional) The instance type.
+* `lifecycleConfigArn` - (Optional) The Amazon Resource Name (ARN) of the Lifecycle Configuration attached to the Resource.
+* `sagemakerImageArn` - (Optional) The Amazon Resource Name (ARN) of the SageMaker image created on the instance.
+* `sagemakerImageVersionArn` - (Optional) The ARN of the image version created on the instance.
+
+##### Custom Image
+
+* `appImageConfigName` - (Required) The name of the App Image Config.
+* `imageName` - (Required) The name of the Custom Image.
+* `imageVersionNumber` - (Optional) The version number of the Custom Image.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The space's Amazon Resource Name (ARN).
+* `arn` - The space's Amazon Resource Name (ARN).
+* `homeEfsFileSystemUid` - The ID of the space's profile in the Amazon Elastic File System volume.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SageMaker Spaces using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import SageMaker Spaces using the `id`. For example:
+
+```console
+% terraform import aws_sagemaker_space.test_space arn:aws:sagemaker:us-west-2:123456789012:space/domain-id/space-name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-8d8bef8d2f394c96f9e18caac696a38bb4da69984c3c443105f8620c1e13b1be -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/sagemaker_studio_lifecycle_config.html.markdown b/website/docs/cdktf/typescript/r/sagemaker_studio_lifecycle_config.html.markdown
new file mode 100644
index 00000000000..6fa66d3f0b4
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/sagemaker_studio_lifecycle_config.html.markdown
@@ -0,0 +1,82 @@
+---
+subcategory: "SageMaker"
+layout: "aws"
+page_title: "AWS: aws_sagemaker_studio_lifecycle_config"
+description: |-
+  Provides a SageMaker Studio Lifecycle Config resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sagemaker_studio_lifecycle_config
+
+Provides a SageMaker Studio Lifecycle Config resource.
+
+## Example Usage
+
+### Basic usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SagemakerStudioLifecycleConfig } from "./.gen/providers/aws/sagemaker-studio-lifecycle-config";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SagemakerStudioLifecycleConfig(this, "example", {
+      studioLifecycleConfigAppType: "JupyterServer",
+      studioLifecycleConfigContent: Token.asString(
+        Fn.base64encode("echo Hello")
+      ),
+      studioLifecycleConfigName: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `studioLifecycleConfigName` - (Required) The name of the Studio Lifecycle Configuration to create.
+* `studioLifecycleConfigAppType` - (Required) The App type that the Lifecycle Configuration is attached to. Valid values are `jupyterServer` and `kernelGateway`.
+* `studioLifecycleConfigContent` - (Required) The content of your Studio Lifecycle Configuration script. This content must be base64 encoded.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name of the Studio Lifecycle Config.
+* `arn` - The Amazon Resource Name (ARN) assigned by AWS to this Studio Lifecycle Config.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SageMaker Studio Lifecycle Configs using the `studioLifecycleConfigName`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import SageMaker Studio Lifecycle Configs using the `studioLifecycleConfigName`. For example:
+
+```console
+% terraform import aws_sagemaker_studio_lifecycle_config.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-00bef775048f861308f13944fa8e3c7a8115b71e1ec29477cd558e7cfbe782d8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/sagemaker_user_profile.html.markdown b/website/docs/cdktf/typescript/r/sagemaker_user_profile.html.markdown
new file mode 100644
index 00000000000..f7668b757de
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/sagemaker_user_profile.html.markdown
@@ -0,0 +1,164 @@
+---
+subcategory: "SageMaker"
+layout: "aws"
+page_title: "AWS: aws_sagemaker_user_profile"
+description: |-
+  Provides a SageMaker User Profile resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sagemaker_user_profile
+
+Provides a SageMaker User Profile resource.
+
+## Example Usage
+
+### Basic usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SagemakerUserProfile } from "./.gen/providers/aws/sagemaker-user-profile";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SagemakerUserProfile(this, "example", {
+      domainId: test.id,
+      userProfileName: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `userProfileName` - (Required) The name for the User Profile.
+* `domainId` - (Required) The ID of the associated Domain.
+* `singleSignOnUserIdentifier` - (Optional) A specifier for the type of value specified in `singleSignOnUserValue`. Currently, the only supported value is `userName`. If the Domain's AuthMode is SSO, this field is required. If the Domain's AuthMode is not SSO, this field cannot be specified.
+* `singleSignOnUserValue` - (Required) The username of the associated AWS Single Sign-On User for this User Profile. If the Domain's AuthMode is SSO, this field is required, and must match a valid username of a user in your directory. If the Domain's AuthMode is not SSO, this field cannot be specified.
+* `userSettings` - (Required) The user settings. See [User Settings](#user-settings) below.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### User Settings
+
+* `executionRole` - (Required) The execution role ARN for the user.
+* `securityGroups` - (Optional) The security groups.
+* `sharingSettings` - (Optional) The sharing settings. See [Sharing Settings](#sharing-settings) below.
+* `tensorBoardAppSettings` - (Optional) The TensorBoard app settings. See [TensorBoard App Settings](#tensorboard-app-settings) below.
+* `jupyterServerAppSettings` - (Optional) The Jupyter server's app settings. See [Jupyter Server App Settings](#jupyter-server-app-settings) below.
+* `kernelGatewayAppSettings` - (Optional) The kernel gateway app settings. See [Kernel Gateway App Settings](#kernel-gateway-app-settings) below.
+* `rSessionAppSettings` - (Optional) The RSession app settings. See [RSession App Settings](#rsession-app-settings) below.
+* `rStudioServerProAppSettings` - (Optional) A collection of settings that configure user interaction with the RStudioServerPro app. See [RStudio Server Pro App Settings](#rstudio-server-pro-app-settings) below.
+* `canvasAppSettings` - (Optional) The Canvas app settings. See [Canvas App Settings](#canvas-app-settings) below.
+
+#### Canvas App Settings
+
+* `modelRegisterSettings` - (Optional) The model registry settings for the SageMaker Canvas application. See [Model Register Settings](#model-register-settings) below.
+* `timeSeriesForecastingSettings` - (Optional) Time series forecast settings for the Canvas app. see [Time Series Forecasting Settings](#time-series-forecasting-settings) below.
+* `workspaceSettings` - (Optional) The workspace settings for the SageMaker Canvas application. See [Workspace Settings](#workspace-settings) below.
+
+#### Sharing Settings
+
+* `notebookOutputOption` - (Optional) Whether to include the notebook cell output when sharing the notebook. The default is `disabled`. Valid values are `allowed` and `disabled`.
+* `s3KmsKeyId` - (Optional) When `notebookOutputOption` is Allowed, the AWS Key Management Service (KMS) encryption key ID used to encrypt the notebook cell output in the Amazon S3 bucket.
+* `s3OutputPath` - (Optional) When `notebookOutputOption` is Allowed, the Amazon S3 bucket used to save the notebook cell output.
+
+#### TensorBoard App Settings
+
+* `defaultResourceSpec` - (Optional) The default instance type and the Amazon Resource Name (ARN) of the SageMaker image created on the instance. see [Default Resource Spec](#default-resource-spec) below.
+
+#### Kernel Gateway App Settings
+
+* `defaultResourceSpec` - (Optional) The default instance type and the Amazon Resource Name (ARN) of the SageMaker image created on the instance. see [Default Resource Spec](#default-resource-spec) below.
+* `customImage` - (Optional) A list of custom SageMaker images that are configured to run as a KernelGateway app. see [Custom Image](#custom-image) below.
+* `lifecycleConfigArns` - (Optional) The Amazon Resource Name (ARN) of the Lifecycle Configurations.
+
+#### Jupyter Server App Settings
+
+* `codeRepository` - (Optional) A list of Git repositories that SageMaker automatically displays to users for cloning in the JupyterServer application. see [Code Repository](#code-repository) below.
+* `defaultResourceSpec` - (Optional) The default instance type and the Amazon Resource Name (ARN) of the SageMaker image created on the instance. see [Default Resource Spec](#default-resource-spec) below.
+* `lifecycleConfigArns` - (Optional) The Amazon Resource Name (ARN) of the Lifecycle Configurations.
+
+#### RSession App Settings
+
+* `defaultResourceSpec` - (Optional) The default instance type and the Amazon Resource Name (ARN) of the SageMaker image created on the instance. see [Default Resource Spec](#default-resource-spec) below.
+* `customImage` - (Optional) A list of custom SageMaker images that are configured to run as a KernelGateway app. see [Custom Image](#custom-image) below.
+
+#### RStudio Server Pro App Settings
+
+* `accessStatus` - (Optional) Indicates whether the current user has access to the RStudioServerPro app. Valid values are `enabled` and `disabled`.
+* `userGroup` - (Optional) The level of permissions that the user has within the RStudioServerPro app. This value defaults to `rStudioUser`. The `rStudioAdmin` value allows the user access to the RStudio Administrative Dashboard. Valid values are `rStudioUser` and `rStudioAdmin`.
+
+##### Code Repository
+
+* `repositoryUrl` - (Optional) The URL of the Git repository.
+
+##### Default Resource Spec
+
+* `instanceType` - (Optional) The instance type.
+* `lifecycleConfigArn` - (Optional) The Amazon Resource Name (ARN) of the Lifecycle Configuration attached to the Resource.
+* `sagemakerImageArn` - (Optional) The Amazon Resource Name (ARN) of the SageMaker image created on the instance.
+* `sagemakerImageVersionArn` - (Optional) The ARN of the image version created on the instance.
+
+##### Custom Image
+
+* `appImageConfigName` - (Required) The name of the App Image Config.
+* `imageName` - (Required) The name of the Custom Image.
+* `imageVersionNumber` - (Optional) The version number of the Custom Image.
+
+##### Time Series Forecasting Settings
+
+* `amazonForecastRoleArn` - (Optional)  The IAM role that Canvas passes to Amazon Forecast for time series forecasting. By default, Canvas uses the execution role specified in the UserProfile that launches the Canvas app. If an execution role is not specified in the UserProfile, Canvas uses the execution role specified in the Domain that owns the UserProfile. To allow time series forecasting, this IAM role should have the [AmazonSageMakerCanvasForecastAccess](https://docs.aws.amazon.com/sagemaker/latest/dg/security-iam-awsmanpol-canvas.html#security-iam-awsmanpol-AmazonSageMakerCanvasForecastAccess) policy attached and forecast.amazonaws.com added in the trust relationship as a service principal.
+* `status` - (Optional) Describes whether time series forecasting is enabled or disabled in the Canvas app. Valid values are `enabled` and `disabled`.
+
+##### Model Register Settings
+
+* `crossAccountModelRegisterRoleArn` - (Optional) The Amazon Resource Name (ARN) of the SageMaker model registry account. Required only to register model versions created by a different SageMaker Canvas AWS account than the AWS account in which SageMaker model registry is set up.
+* `status` - (Optional) Describes whether the integration to the model registry is enabled or disabled in the Canvas application. Valid values are `enabled` and `disabled`.
+
+##### Workspace Settings
+
+* `s3ArtifactPath` - (Optional) The Amazon S3 bucket used to store artifacts generated by Canvas. Updating the Amazon S3 location impacts existing configuration settings, and Canvas users no longer have access to their artifacts. Canvas users must log out and log back in to apply the new location.
+* `s3KmsKeyId` - (Optional) The Amazon Web Services Key Management Service (KMS) encryption key ID that is used to encrypt artifacts generated by Canvas in the Amazon S3 bucket.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The user profile Amazon Resource Name (ARN).
+* `arn` - The user profile Amazon Resource Name (ARN).
+* `homeEfsFileSystemUid` - The ID of the user's profile in the Amazon Elastic File System (EFS) volume.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SageMaker User Profiles using the `arn`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import SageMaker User Profiles using the `arn`. For example:
+
+```console
+% terraform import aws_sagemaker_user_profile.test_user_profile arn:aws:sagemaker:us-west-2:123456789012:user-profile/domain-id/profile-name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1492833bb8413e9155281273553ca4896e7889971ba95eee58026c164fc0fdb7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/sagemaker_workforce.html.markdown b/website/docs/cdktf/typescript/r/sagemaker_workforce.html.markdown
new file mode 100644
index 00000000000..e75d2325095
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/sagemaker_workforce.html.markdown
@@ -0,0 +1,175 @@
+---
+subcategory: "SageMaker"
+layout: "aws"
+page_title: "AWS: aws_sagemaker_workforce"
+description: |-
+  Provides a SageMaker Workforce resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sagemaker_workforce
+
+Provides a SageMaker Workforce resource.
+
+## Example Usage
+
+### Cognito Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CognitoUserPool } from "./.gen/providers/aws/cognito-user-pool";
+import { CognitoUserPoolClient } from "./.gen/providers/aws/cognito-user-pool-client";
+import { CognitoUserPoolDomain } from "./.gen/providers/aws/cognito-user-pool-domain";
+import { SagemakerWorkforce } from "./.gen/providers/aws/sagemaker-workforce";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new CognitoUserPool(this, "example", {
+      name: "example",
+    });
+    const awsCognitoUserPoolClientExample = new CognitoUserPoolClient(
+      this,
+      "example_1",
+      {
+        generateSecret: true,
+        name: "example",
+        userPoolId: example.id,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsCognitoUserPoolClientExample.overrideLogicalId("example");
+    const awsCognitoUserPoolDomainExample = new CognitoUserPoolDomain(
+      this,
+      "example_2",
+      {
+        domain: "example",
+        userPoolId: example.id,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsCognitoUserPoolDomainExample.overrideLogicalId("example");
+    const awsSagemakerWorkforceExample = new SagemakerWorkforce(
+      this,
+      "example_3",
+      {
+        cognitoConfig: {
+          clientId: Token.asString(awsCognitoUserPoolClientExample.id),
+          userPool: Token.asString(awsCognitoUserPoolDomainExample.userPoolId),
+        },
+        workforceName: "example",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSagemakerWorkforceExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### Oidc Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SagemakerWorkforce } from "./.gen/providers/aws/sagemaker-workforce";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SagemakerWorkforce(this, "example", {
+      oidcConfig: {
+        authorizationEndpoint: "https://example.com",
+        clientId: "example",
+        clientSecret: "example",
+        issuer: "https://example.com",
+        jwksUri: "https://example.com",
+        logoutEndpoint: "https://example.com",
+        tokenEndpoint: "https://example.com",
+        userInfoEndpoint: "https://example.com",
+      },
+      workforceName: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `workforceName` - (Required) The name of the Workforce (must be unique).
+* `cognitoConfig` - (Optional) Use this parameter to configure an Amazon Cognito private workforce. A single Cognito workforce is created using and corresponds to a single Amazon Cognito user pool. Conflicts with `oidcConfig`. see [Cognito Config](#cognito-config) details below.
+* `oidcConfig` - (Optional) Use this parameter to configure a private workforce using your own OIDC Identity Provider. Conflicts with `cognitoConfig`. see [OIDC Config](#oidc-config) details below.
+* `sourceIpConfig` - (Optional) A list of IP address ranges Used to create an allow list of IP addresses for a private workforce. By default, a workforce isn't restricted to specific IP addresses. see [Source Ip Config](#source-ip-config) details below.
+* `workforceVpcConfig` - (Optional) configure a workforce using VPC. see [Workforce VPC Config](#workforce-vpc-config) details below.
+
+### Cognito Config
+
+* `clientId` - (Required) The client ID for your Amazon Cognito user pool.
+* `userPool` - (Required) ID for your Amazon Cognito user pool.
+
+### Oidc Config
+
+* `authorizationEndpoint` - (Required) The OIDC IdP authorization endpoint used to configure your private workforce.
+* `clientId` - (Required) The OIDC IdP client ID used to configure your private workforce.
+* `clientSecret` - (Required) The OIDC IdP client secret used to configure your private workforce.
+* `issuer` - (Required) The OIDC IdP issuer used to configure your private workforce.
+* `jwksUri` - (Required) The OIDC IdP JSON Web Key Set (Jwks) URI used to configure your private workforce.
+* `logoutEndpoint` - (Required) The OIDC IdP logout endpoint used to configure your private workforce.
+* `tokenEndpoint` - (Required) The OIDC IdP token endpoint used to configure your private workforce.
+* `userInfoEndpoint` - (Required) The OIDC IdP user information endpoint used to configure your private workforce.
+
+### Source Ip Config
+
+* `cidrs` - (Required) A list of up to 10 CIDR values.
+
+### Workforce VPC Config
+
+* `securityGroupIds` - (Optional) The VPC security group IDs. The security groups must be for the same VPC as specified in the subnet.
+* `subnets` - (Optional) The ID of the subnets in the VPC that you want to connect.
+* `vpcId` - (Optional) The ID of the VPC that the workforce uses for communication.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) assigned by AWS to this Workforce.
+* `id` - The name of the Workforce.
+* `subdomain` - The subdomain for your OIDC Identity Provider.
+* `workforceVpcConfig0VpcEndpointId` - The IDs for the VPC service endpoints of your VPC workforce.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SageMaker Workforces using the `workforceName`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import SageMaker Workforces using the `workforceName`. For example:
+
+```console
+% terraform import aws_sagemaker_workforce.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-b4c9ab9708ddac7777a4511e715674b772e0a778ceb4beb60491fda22462d138 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/sagemaker_workteam.html.markdown b/website/docs/cdktf/typescript/r/sagemaker_workteam.html.markdown
new file mode 100644
index 00000000000..e0a270c00df
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/sagemaker_workteam.html.markdown
@@ -0,0 +1,144 @@
+---
+subcategory: "SageMaker"
+layout: "aws"
+page_title: "AWS: aws_sagemaker_workteam"
+description: |-
+  Provides a SageMaker Workteam resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sagemaker_workteam
+
+Provides a SageMaker Workteam resource.
+
+## Example Usage
+
+### Cognito Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SagemakerWorkteam } from "./.gen/providers/aws/sagemaker-workteam";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SagemakerWorkteam(this, "example", {
+      description: "example",
+      memberDefinition: [
+        {
+          cognitoMemberDefinition: {
+            clientId: Token.asString(awsCognitoUserPoolClientExample.id),
+            userGroup: Token.asString(awsCognitoUserGroupExample.id),
+            userPool: Token.asString(
+              awsCognitoUserPoolDomainExample.userPoolId
+            ),
+          },
+        },
+      ],
+      workforceName: Token.asString(awsSagemakerWorkforceExample.id),
+      workteamName: "example",
+    });
+  }
+}
+
+```
+
+### Oidc Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SagemakerWorkteam } from "./.gen/providers/aws/sagemaker-workteam";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SagemakerWorkteam(this, "example", {
+      description: "example",
+      memberDefinition: [
+        {
+          oidcMemberDefinition: {
+            groups: ["example"],
+          },
+        },
+      ],
+      workforceName: Token.asString(awsSagemakerWorkforceExample.id),
+      workteamName: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `description` - (Required) A description of the work team.
+* `workforceName` - (Required) The name of the Workteam (must be unique).
+* `workteamName` - (Required) The name of the workforce.
+* `memberDefinition` - (Required) A list of Member Definitions that contains objects that identify the workers that make up the work team. Workforces can be created using Amazon Cognito or your own OIDC Identity Provider (IdP). For private workforces created using Amazon Cognito use `cognitoMemberDefinition`. For workforces created using your own OIDC identity provider (IdP) use `oidcMemberDefinition`. Do not provide input for both of these parameters in a single request. see [Member Definition](#member-definition) details below.
+* `notificationConfiguration` - (Optional) Configures notification of workers regarding available or expiring work items. see [Notification Configuration](#notification-configuration) details below.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Member Definition
+
+* `cognitoMemberDefinition` - (Optional) The Amazon Cognito user group that is part of the work team. See [Cognito Member Definition](#cognito-member-definition) details below.
+* `oidcMemberDefinition` - (Optional) A list user groups that exist in your OIDC Identity Provider (IdP). One to ten groups can be used to create a single private work team. See [Cognito Member Definition](#oidc-member-definition) details below.
+
+#### Cognito Member Definition
+
+* `clientId` - (Required) An identifier for an application client. You must create the app client ID using Amazon Cognito.
+* `userPool` - (Required) An identifier for a user pool. The user pool must be in the same region as the service that you are calling.
+* `userGroup` - (Required) An identifier for a user group.
+
+#### Oidc Member Definition
+
+* `groups` - (Required) A list of comma separated strings that identifies user groups in your OIDC IdP. Each user group is made up of a group of private workers.
+
+### Notification Configuration
+
+* `notificationTopicArn` - (Required) The ARN for the SNS topic to which notifications should be published.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) assigned by AWS to this Workteam.
+* `id` - The name of the Workteam.
+* `subdomain` - The subdomain for your OIDC Identity Provider.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SageMaker Workteams using the `workteamName`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import SageMaker Workteams using the `workteamName`. For example:
+
+```console
+% terraform import aws_sagemaker_workteam.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-3a7cf1fb125ebeb37f30bd90666ac5def329d2504804e10053f90547efe5df34 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/scheduler_schedule.html.markdown b/website/docs/cdktf/typescript/r/scheduler_schedule.html.markdown
new file mode 100644
index 00000000000..7cd2f679bdc
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/scheduler_schedule.html.markdown
@@ -0,0 +1,243 @@
+---
+subcategory: "EventBridge Scheduler"
+layout: "aws"
+page_title: "AWS: aws_scheduler_schedule"
+description: |-
+  Provides an EventBridge Scheduler Schedule resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_scheduler_schedule
+
+Provides an EventBridge Scheduler Schedule resource.
+
+You can find out more about EventBridge Scheduler in the [User Guide](https://docs.aws.amazon.com/scheduler/latest/UserGuide/what-is-scheduler.html).
+
+~> **Note:** EventBridge was formerly known as CloudWatch Events. The functionality is identical.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SchedulerSchedule } from "./.gen/providers/aws/scheduler-schedule";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SchedulerSchedule(this, "example", {
+      flexibleTimeWindow: {
+        mode: "OFF",
+      },
+      groupName: "default",
+      name: "my-schedule",
+      scheduleExpression: "rate(1 hours)",
+      target: {
+        arn: Token.asString(awsSqsQueueExample.arn),
+        roleArn: Token.asString(awsIamRoleExample.arn),
+      },
+    });
+  }
+}
+
+```
+
+### Universal Target
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SchedulerSchedule } from "./.gen/providers/aws/scheduler-schedule";
+import { SqsQueue } from "./.gen/providers/aws/sqs-queue";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new SqsQueue(this, "example", {});
+    const awsSchedulerScheduleExample = new SchedulerSchedule(
+      this,
+      "example_1",
+      {
+        flexibleTimeWindow: {
+          mode: "OFF",
+        },
+        name: "my-schedule",
+        scheduleExpression: "rate(1 hours)",
+        target: {
+          arn: "arn:aws:scheduler:::aws-sdk:sqs:sendMessage",
+          input: Token.asString(
+            Fn.jsonencode({
+              MessageBody: "Greetings, programs!",
+              QueueUrl: example.url,
+            })
+          ),
+          roleArn: Token.asString(awsIamRoleExample.arn),
+        },
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSchedulerScheduleExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `flexibleTimeWindow` - (Required) Configures a time window during which EventBridge Scheduler invokes the schedule. Detailed below.
+* `scheduleExpression` - (Required) Defines when the schedule runs. Read more in [Schedule types on EventBridge Scheduler](https://docs.aws.amazon.com/scheduler/latest/UserGuide/schedule-types.html).
+* `target` - (Required) Configures the target of the schedule. Detailed below.
+
+The following arguments are optional:
+
+* `description` - (Optional) Brief description of the schedule.
+* `endDate` - (Optional) The date, in UTC, before which the schedule can invoke its target. Depending on the schedule's recurrence expression, invocations might stop on, or before, the end date you specify. EventBridge Scheduler ignores the end date for one-time schedules. Example: `20300101T01:00:00Z`.
+* `groupName` - (Optional, Forces new resource) Name of the schedule group to associate with this schedule. When omitted, the `default` schedule group is used.
+* `kmsKeyArn` - (Optional) ARN for the customer managed KMS key that EventBridge Scheduler will use to encrypt and decrypt your data.
+* `name` - (Optional, Forces new resource) Name of the schedule. If omitted, Terraform will assign a random, unique name. Conflicts with `namePrefix`.
+* `namePrefix` - (Optional, Forces new resource) Creates a unique name beginning with the specified prefix. Conflicts with `name`.
+* `scheduleExpressionTimezone` - (Optional) Timezone in which the scheduling expression is evaluated. Defaults to `utc`. Example: `australia/sydney`.
+* `startDate` - (Optional) The date, in UTC, after which the schedule can begin invoking its target. Depending on the schedule's recurrence expression, invocations might occur on, or after, the start date you specify. EventBridge Scheduler ignores the start date for one-time schedules. Example: `20300101T01:00:00Z`.
+* `state` - (Optional) Specifies whether the schedule is enabled or disabled. One of: `enabled` (default), `disabled`.
+
+### flexible_time_window Configuration Block
+
+* `maximumWindowInMinutes` - (Optional) Maximum time window during which a schedule can be invoked. Ranges from `1` to `1440` minutes.
+* `mode` - (Required) Determines whether the schedule is invoked within a flexible time window. One of: `off`, `flexible`.
+
+### target Configuration Block
+
+The following arguments are required:
+
+* `arn` - (Required) ARN of the target of this schedule, such as a SQS queue or ECS cluster. For universal targets, this is a [Service ARN specific to the target service](https://docs.aws.amazon.com/scheduler/latest/UserGuide/managing-targets-universal.html#supported-universal-targets).
+* `roleArn` - (Required) ARN of the IAM role that EventBridge Scheduler will use for this target when the schedule is invoked. Read more in [Set up the execution role](https://docs.aws.amazon.com/scheduler/latest/UserGuide/setting-up.html#setting-up-execution-role).
+
+The following arguments are optional:
+
+* `deadLetterConfig` - (Optional) Information about an Amazon SQS queue that EventBridge Scheduler uses as a dead-letter queue for your schedule. If specified, EventBridge Scheduler delivers failed events that could not be successfully delivered to a target to the queue. Detailed below.
+* `ecsParameters` - (Optional) Templated target type for the Amazon ECS [`runTask`](https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_RunTask.html) API operation. Detailed below.
+* `eventbridgeParameters` - (Optional) Templated target type for the EventBridge [`putEvents`](https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_PutEvents.html) API operation. Detailed below.
+* `input` - (Optional) Text, or well-formed JSON, passed to the target. Read more in [Universal target](https://docs.aws.amazon.com/scheduler/latest/UserGuide/managing-targets-universal.html).
+* `kinesisParameters` - (Optional) Templated target type for the Amazon Kinesis [`putRecord`](https://docs.aws.amazon.com/kinesis/latest/APIReference/API_PutRecord.html) API operation. Detailed below.
+* `retryPolicy` - (Optional) Information about the retry policy settings. Detailed below.
+* `sagemakerPipelineParameters` - (Optional) Templated target type for the Amazon SageMaker [`startPipelineExecution`](https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_StartPipelineExecution.html) API operation. Detailed below.
+* `sqsParameters` - (Optional) The templated target type for the Amazon SQS [`sendMessage`](https://docs.aws.amazon.com/AWSSimpleQueueService/latest/APIReference/API_SendMessage.html) API operation. Detailed below.
+
+#### dead_letter_config Configuration Block
+
+* `arn` - (Required) ARN of the SQS queue specified as the destination for the dead-letter queue.
+
+#### ecs_parameters Configuration Block
+
+The following arguments are required:
+
+* `taskDefinitionArn` - (Required) ARN of the task definition to use.
+
+The following arguments are optional:
+
+* `capacityProviderStrategy` - (Optional) Up to `6` capacity provider strategies to use for the task. Detailed below.
+* `enableEcsManagedTags` - (Optional) Specifies whether to enable Amazon ECS managed tags for the task. For more information, see [Tagging Your Amazon ECS Resources](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/ecs-using-tags.html) in the Amazon ECS Developer Guide.
+* `enableExecuteCommand` - (Optional) Specifies whether to enable the execute command functionality for the containers in this task.
+* `group` - (Optional) Specifies an ECS task group for the task. At most 255 characters.
+* `launchType` - (Optional) Specifies the launch type on which your task is running. The launch type that you specify here must match one of the launch type (compatibilities) of the target task. One of: `ec2`, `fargate`, `external`.
+* `networkConfiguration` - (Optional) Configures the networking associated with the task. Detailed below.
+* `placementConstraints` - (Optional) A set of up to 10 placement constraints to use for the task. Detailed below.
+* `placementStrategy` - (Optional) A set of up to 5 placement strategies. Detailed below.
+* `platformVersion` - (Optional) Specifies the platform version for the task. Specify only the numeric portion of the platform version, such as `110`.
+* `propagateTags` - (Optional) Specifies whether to propagate the tags from the task definition to the task. One of: `taskDefinition`.
+* `referenceId` - (Optional) Reference ID to use for the task.
+* `tags` - (Optional) The metadata that you apply to the task. Each tag consists of a key and an optional value. For more information, see [`runTask`](https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_RunTask.html) in the Amazon ECS API Reference.
+* `taskCount` - (Optional) The number of tasks to create. Ranges from `1` (default) to `10`.
+
+##### capacity_provider_strategy Configuration Block
+
+* `base` - (Optional) How many tasks, at a minimum, to run on the specified capacity provider. Only one capacity provider in a capacity provider strategy can have a base defined. Ranges from `0` (default) to `100000`.
+* `capacityProvider` - (Required) Short name of the capacity provider.
+* `weight` - (Optional) Designates the relative percentage of the total number of tasks launched that should use the specified capacity provider. The weight value is taken into consideration after the base value, if defined, is satisfied. Ranges from from `0` to `1000`.
+
+##### network_configuration Configuration Block
+
+* `assignPublicIp` - (Optional) Specifies whether the task's elastic network interface receives a public IP address. This attribute is a boolean type, where `true` maps to `enabled` and `false` to `disabled`. You can specify `true` only when the `launchType` is set to `fargate`.
+* `securityGroups` - (Optional) Set of 1 to 5 Security Group ID-s to be associated with the task. These security groups must all be in the same VPC.
+* `subnets` - (Optional) Set of 1 to 16 subnets to be associated with the task. These subnets must all be in the same VPC.
+
+##### placement_constraints Configuration Block
+
+* `expression` - (Optional) A cluster query language expression to apply to the constraint. You cannot specify an expression if the constraint type is `distinctInstance`. For more information, see [Cluster query language](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/cluster-query-language.html) in the Amazon ECS Developer Guide.
+* `type` - (Required) The type of constraint. One of: `distinctInstance`, `memberOf`.
+
+##### placement_strategy Configuration Block
+
+* `field` - (Optional) The field to apply the placement strategy against.
+* `type` - (Required) The type of placement strategy. One of: `random`, `spread`, `binpack`.
+
+#### eventbridge_parameters Configuration Block
+
+* `detailType` - (Required) Free-form string used to decide what fields to expect in the event detail. Up to 128 characters.
+* `source` - (Required) Source of the event.
+
+#### kinesis_parameters Configuration Block
+
+* `partitionKey` - (Required) Specifies the shard to which EventBridge Scheduler sends the event. Up to 256 characters.
+
+#### retry_policy Configuration Block
+
+* `maximumEventAgeInSeconds` - (Optional) Maximum amount of time, in seconds, to continue to make retry attempts. Ranges from `60` to `86400` (default).
+* `maximumRetryAttempts` - (Optional) Maximum number of retry attempts to make before the request fails. Ranges from `0` to `185` (default).
+
+#### sagemaker_pipeline_parameters Configuration Block
+
+* `pipelineParameter` - (Optional) Set of up to 200 parameter names and values to use when executing the SageMaker Model Building Pipeline. Detailed below.
+
+##### pipeline_parameter Configuration Block
+
+* `name` - (Required) Name of parameter to start execution of a SageMaker Model Building Pipeline.
+* `value` - (Required) Value of parameter to start execution of a SageMaker Model Building Pipeline.
+
+#### sqs_parameters Configuration Block
+
+* `messageGroupId` - (Optional) FIFO message group ID to use as the target.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Name of the schedule.
+* `arn` - ARN of the schedule.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import schedules using the combination `groupName/name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import schedules using the combination `groupName/name`. For example:
+
+```console
+% terraform import aws_scheduler_schedule.example my-schedule-group/my-schedule
+```
+
+<!-- cache-key: cdktf-0.18.0 input-95ba3e7c2dcc364c2b888e21f8830e94c2d1a70691fedb123bb008ebd8c952d3 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/scheduler_schedule_group.html.markdown b/website/docs/cdktf/typescript/r/scheduler_schedule_group.html.markdown
new file mode 100644
index 00000000000..d37ee780980
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/scheduler_schedule_group.html.markdown
@@ -0,0 +1,89 @@
+---
+subcategory: "EventBridge Scheduler"
+layout: "aws"
+page_title: "AWS: aws_scheduler_schedule_group"
+description: |-
+  Provides an EventBridge Scheduler Schedule Group resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_scheduler_schedule_group
+
+Provides an EventBridge Scheduler Schedule Group resource.
+
+You can find out more about EventBridge Scheduler in the [User Guide](https://docs.aws.amazon.com/scheduler/latest/UserGuide/what-is-scheduler.html).
+
+~> **Note:** EventBridge was formerly known as CloudWatch Events. The functionality is identical.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SchedulerScheduleGroup } from "./.gen/providers/aws/scheduler-schedule-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SchedulerScheduleGroup(this, "example", {
+      name: "my-schedule-group",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are optional:
+
+* `name` - (Optional, Forces new resource) Name of the schedule group. If omitted, Terraform will assign a random, unique name. Conflicts with `namePrefix`.
+* `namePrefix` - (Optional, Forces new resource) Creates a unique name beginning with the specified prefix. Conflicts with `name`.
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`defaultTags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Name of the schedule group.
+* `arn` - ARN of the schedule group.
+* `creationDate` - Time at which the schedule group was created.
+* `lastModificationDate` - Time at which the schedule group was last modified.
+* `state` - State of the schedule group. Can be `active` or `deleting`.
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `5M`)
+- `delete` - (Default `5M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import schedule groups using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import schedule groups using the `name`. For example:
+
+```console
+% terraform import aws_scheduler_schedule_group.example my-schedule-group
+```
+
+<!-- cache-key: cdktf-0.18.0 input-10168b28a6e4905d4caa31ec8a7ac8f50e27b681fd289f91d98f6ade6ba63b5c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/schemas_discoverer.html.markdown b/website/docs/cdktf/typescript/r/schemas_discoverer.html.markdown
new file mode 100644
index 00000000000..e1413a9c850
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/schemas_discoverer.html.markdown
@@ -0,0 +1,82 @@
+---
+subcategory: "EventBridge Schemas"
+layout: "aws"
+page_title: "AWS: aws_schemas_discoverer"
+description: |-
+  Provides an EventBridge Schema Discoverer resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_schemas_discoverer
+
+Provides an EventBridge Schema Discoverer resource.
+
+~> **Note:** EventBridge was formerly known as CloudWatch Events. The functionality is identical.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudwatchEventBus } from "./.gen/providers/aws/cloudwatch-event-bus";
+import { SchemasDiscoverer } from "./.gen/providers/aws/schemas-discoverer";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const messenger = new CloudwatchEventBus(this, "messenger", {
+      name: "chat-messages",
+    });
+    new SchemasDiscoverer(this, "test", {
+      description: "Auto discover event schemas",
+      sourceArn: messenger.arn,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `sourceArn` - (Required) The ARN of the event bus to discover event schemas on.
+* `description` - (Optional) The description of the discoverer. Maximum of 256 characters.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the discoverer.
+* `id` - The ID of the discoverer.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EventBridge discoverers using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import EventBridge discoverers using the `id`. For example:
+
+```console
+% terraform import aws_schemas_discoverer.test 123
+```
+
+<!-- cache-key: cdktf-0.18.0 input-5d0121c0f1733e52e29ed11dfdf085e2536a62771b5c5d2f16c8193227f29a29 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/schemas_registry.html.markdown b/website/docs/cdktf/typescript/r/schemas_registry.html.markdown
new file mode 100644
index 00000000000..e2f991c81e3
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/schemas_registry.html.markdown
@@ -0,0 +1,77 @@
+---
+subcategory: "EventBridge Schemas"
+layout: "aws"
+page_title: "AWS: aws_schemas_registry"
+description: |-
+  Provides an EventBridge Custom Schema Registry resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_schemas_registry
+
+Provides an EventBridge Custom Schema Registry resource.
+
+~> **Note:** EventBridge was formerly known as CloudWatch Events. The functionality is identical.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SchemasRegistry } from "./.gen/providers/aws/schemas-registry";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SchemasRegistry(this, "test", {
+      description: "A custom schema registry",
+      name: "my_own_registry",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the custom event schema registry. Maximum of 64 characters consisting of lower case letters, upper case letters, 0-9, ., -, _.
+* `description` - (Optional) The description of the discoverer. Maximum of 256 characters.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the discoverer.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EventBridge schema registries using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import EventBridge schema registries using the `name`. For example:
+
+```console
+% terraform import aws_schemas_registry.test my_own_registry
+```
+
+<!-- cache-key: cdktf-0.18.0 input-5af6f76005b958271bcf75ab6df88eb3a8ded497a3eed14e2d8ed999dcc783d2 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/schemas_registry_policy.html.markdown b/website/docs/cdktf/typescript/r/schemas_registry_policy.html.markdown
new file mode 100644
index 00000000000..b2ae4d4a25a
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/schemas_registry_policy.html.markdown
@@ -0,0 +1,107 @@
+---
+subcategory: "EventBridge Schemas"
+layout: "aws"
+page_title: "AWS: aws_schemas_registry_policy"
+description: |-
+  Terraform resource for managing an AWS EventBridge Schemas Registry Policy.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_schemas_registry_policy
+
+Terraform resource for managing an AWS EventBridge Schemas Registry Policy.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { SchemasRegistryPolicy } from "./.gen/providers/aws/schemas-registry-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new DataAwsIamPolicyDocument(this, "example", {
+      statement: [
+        {
+          actions: ["schemas:*"],
+          effect: "Allow",
+          principals: [
+            {
+              identifiers: ["109876543210"],
+              type: "AWS",
+            },
+          ],
+          resources: [
+            "arn:aws:schemas:us-east-1:012345678901:registry/example",
+            "arn:aws:schemas:us-east-1:012345678901:schema/example*",
+          ],
+          sid: "example",
+        },
+      ],
+    });
+    const awsSchemasRegistryPolicyExample = new SchemasRegistryPolicy(
+      this,
+      "example_1",
+      {
+        policy: Token.asString(example.json),
+        registryName: "example",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSchemasRegistryPolicyExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `registryName` - (Required) Name of EventBridge Schema Registry
+* `policy` - (Required) Resource Policy for EventBridge Schema Registry
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Timeouts
+
+[Configuration options](https://www.terraform.io/docs/configuration/blocks/resources/syntax.html#operation-timeouts):
+
+* `create` - (Default `5M`)
+* `update` - (Default `5M`)
+* `delete` - (Default `5M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EventBridge Schema Registry Policy using the `registryName`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import EventBridge Schema Registry Policy using the `registryName`. For example:
+
+```console
+% terraform import aws_schemas_registry_policy.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-9012f6db2847612db1042a8a2bfd8eded85a88882cdbccfc86d64bfed094f01b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/schemas_schema.html.markdown b/website/docs/cdktf/typescript/r/schemas_schema.html.markdown
new file mode 100644
index 00000000000..2039a9bb530
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/schemas_schema.html.markdown
@@ -0,0 +1,113 @@
+---
+subcategory: "EventBridge Schemas"
+layout: "aws"
+page_title: "AWS: aws_schemas_schema"
+description: |-
+  Provides an EventBridge Schema resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_schemas_schema
+
+Provides an EventBridge Schema resource.
+
+~> **Note:** EventBridge was formerly known as CloudWatch Events. The functionality is identical.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SchemasRegistry } from "./.gen/providers/aws/schemas-registry";
+import { SchemasSchema } from "./.gen/providers/aws/schemas-schema";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const test = new SchemasRegistry(this, "test", {
+      name: "my_own_registry",
+    });
+    const awsSchemasSchemaTest = new SchemasSchema(this, "test_1", {
+      content: Token.asString(
+        Fn.jsonencode({
+          components: {
+            schemas: {
+              Event: {
+                properties: {
+                  name: {
+                    type: "string",
+                  },
+                },
+                type: "object",
+              },
+            },
+          },
+          info: {
+            title: "Event",
+            version: "1.0.0",
+          },
+          openapi: "3.0.0",
+          paths: {},
+        })
+      ),
+      description: "The schema definition for my event",
+      name: "my_schema",
+      registryName: test.name,
+      type: "OpenApi3",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSchemasSchemaTest.overrideLogicalId("test");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the schema. Maximum of 385 characters consisting of lower case letters, upper case letters, ., -, _, @.
+* `content` - (Required) The schema specification. Must be a valid Open API 3.0 spec.
+* `registryName` - (Required) The name of the registry in which this schema belongs.
+* `type` - (Required) The type of the schema. Valid values: `openApi3` or `jsonSchemaDraft4`.
+* `description` - (Optional) The description of the schema. Maximum of 256 characters.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the discoverer.
+* `lastModified` - The last modified date of the schema.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `version` - The version of the schema.
+* `versionCreatedDate` - The created date of the version of the schema.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EventBridge schema using the `name` and `registryName`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import EventBridge schema using the `name` and `registryName`. For example:
+
+```console
+% terraform import aws_schemas_schema.test name/registry
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ebc2fd95aa82c21b5b6f551a7043512b14e59815f8ffb599ebc2d14cfbaf7eb8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/secretsmanager_secret.html.markdown b/website/docs/cdktf/typescript/r/secretsmanager_secret.html.markdown
new file mode 100644
index 00000000000..4e9eeba8c6f
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/secretsmanager_secret.html.markdown
@@ -0,0 +1,95 @@
+---
+subcategory: "Secrets Manager"
+layout: "aws"
+page_title: "AWS: aws_secretsmanager_secret"
+description: |-
+  Provides a resource to manage AWS Secrets Manager secret metadata
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_secretsmanager_secret
+
+Provides a resource to manage AWS Secrets Manager secret metadata. To manage secret rotation, see the [`awsSecretsmanagerSecretRotation` resource](/docs/providers/aws/r/secretsmanager_secret_rotation.html). To manage a secret value, see the [`awsSecretsmanagerSecretVersion` resource](/docs/providers/aws/r/secretsmanager_secret_version.html).
+
+## Example Usage
+
+### Basic
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SecretsmanagerSecret } from "./.gen/providers/aws/secretsmanager-secret";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SecretsmanagerSecret(this, "example", {
+      name: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `description` - (Optional) Description of the secret.
+* `kmsKeyId` - (Optional) ARN or Id of the AWS KMS key to be used to encrypt the secret values in the versions stored in this secret. If you need to reference a CMK in a different account, you can use only the key ARN. If you don't specify this value, then Secrets Manager defaults to using the AWS account's default KMS key (the one named `aws/secretsmanager`). If the default KMS key with that name doesn't yet exist, then AWS Secrets Manager creates it for you automatically the first time.
+* `namePrefix` - (Optional) Creates a unique name beginning with the specified prefix. Conflicts with `name`.
+* `name` - (Optional) Friendly name of the new secret. The secret name can consist of uppercase letters, lowercase letters, digits, and any of the following characters: `/_+=.@` Conflicts with `namePrefix`.
+* `policy` - (Optional) Valid JSON document representing a [resource policy](https://docs.aws.amazon.com/secretsmanager/latest/userguide/auth-and-access_resource-based-policies.html). For more information about building AWS IAM policy documents with Terraform, see the [AWS IAM Policy Document Guide](https://learn.hashicorp.com/terraform/aws/iam-policy). Removing `policy` from your configuration or setting `policy` to null or an empty string (i.e., `policy = ""`) _will not_ delete the policy since it could have been set by `awsSecretsmanagerSecretPolicy`. To delete the `policy`, set it to `"{}"` (an empty JSON document).
+* `recoveryWindowInDays` - (Optional) Number of days that AWS Secrets Manager waits before it can delete the secret. This value can be `0` to force deletion without recovery or range from `7` to `30` days. The default value is `30`.
+* `replica` - (Optional) Configuration block to support secret replication. See details below.
+* `forceOverwriteReplicaSecret` - (Optional) Accepts boolean value to specify whether to overwrite a secret with the same name in the destination Region.
+* `tags` - (Optional) Key-value map of user-defined tags that are attached to the secret. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### replica
+
+* `kmsKeyId` - (Optional) ARN, Key ID, or Alias of the AWS KMS key within the region secret is replicated to. If one is not specified, then Secrets Manager defaults to using the AWS account's default KMS key (`aws/secretsmanager`) in the region or creates one for use if non-existent.
+* `region` - (Required) Region for replicating the secret.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - ARN of the secret.
+* `arn` - ARN of the secret.
+* `replica` - Attributes of a replica are described below.
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+### replica
+
+* `lastAccessedDate` - Date that you last accessed the secret in the Region.
+* `status` - Status can be `inProgress`, `failed`, or `inSync`.
+* `statusMessage` - Message such as `Replication succeeded` or `Secret with this name already exists in this region`.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsSecretsmanagerSecret` using the secret Amazon Resource Name (ARN). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsSecretsmanagerSecret` using the secret Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_secretsmanager_secret.example arn:aws:secretsmanager:us-east-1:123456789012:secret:example-123456
+```
+
+<!-- cache-key: cdktf-0.18.0 input-f44bb9eb3bae8b018f7e6a78dcbe04e2e4a77f8946d831c31f854ca198346489 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/secretsmanager_secret_policy.html.markdown b/website/docs/cdktf/typescript/r/secretsmanager_secret_policy.html.markdown
new file mode 100644
index 00000000000..ce523d874e2
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/secretsmanager_secret_policy.html.markdown
@@ -0,0 +1,112 @@
+---
+subcategory: "Secrets Manager"
+layout: "aws"
+page_title: "AWS: aws_secretsmanager_secret_policy"
+description: |-
+  Provides a resource to manage AWS Secrets Manager secret policy
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_secretsmanager_secret_policy
+
+Provides a resource to manage AWS Secrets Manager secret policy.
+
+## Example Usage
+
+### Basic
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { SecretsmanagerSecret } from "./.gen/providers/aws/secretsmanager-secret";
+import { SecretsmanagerSecretPolicy } from "./.gen/providers/aws/secretsmanager-secret-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new SecretsmanagerSecret(this, "example", {
+      name: "example",
+    });
+    const dataAwsIamPolicyDocumentExample = new DataAwsIamPolicyDocument(
+      this,
+      "example_1",
+      {
+        statement: [
+          {
+            actions: ["secretsmanager:GetSecretValue"],
+            effect: "Allow",
+            principals: [
+              {
+                identifiers: ["arn:aws:iam::123456789012:root"],
+                type: "AWS",
+              },
+            ],
+            resources: ["*"],
+            sid: "EnableAnotherAWSAccountToReadTheSecret",
+          },
+        ],
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsIamPolicyDocumentExample.overrideLogicalId("example");
+    const awsSecretsmanagerSecretPolicyExample = new SecretsmanagerSecretPolicy(
+      this,
+      "example_2",
+      {
+        policy: Token.asString(dataAwsIamPolicyDocumentExample.json),
+        secretArn: example.arn,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSecretsmanagerSecretPolicyExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `policy` - (Required) Valid JSON document representing a [resource policy](https://docs.aws.amazon.com/secretsmanager/latest/userguide/auth-and-access_resource-based-policies.html). For more information about building AWS IAM policy documents with Terraform, see the [AWS IAM Policy Document Guide](https://learn.hashicorp.com/terraform/aws/iam-policy). Unlike `awsSecretsmanagerSecret`, where `policy` can be set to `"{}"` to delete the policy, `"{}"` is not a valid policy since `policy` is required.
+* `secretArn` - (Required) Secret ARN.
+
+The following arguments are optional:
+
+* `blockPublicPolicy` - (Optional) Makes an optional API call to Zelkova to validate the Resource Policy to prevent broad access to your secret.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Amazon Resource Name (ARN) of the secret.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsSecretsmanagerSecretPolicy` using the secret Amazon Resource Name (ARN). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsSecretsmanagerSecretPolicy` using the secret Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_secretsmanager_secret_policy.example arn:aws:secretsmanager:us-east-1:123456789012:secret:example-123456
+```
+
+<!-- cache-key: cdktf-0.18.0 input-645c813817dc94994f91896c0dc33ab5185045f6665587858a142de45a69dfb5 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/secretsmanager_secret_rotation.html.markdown b/website/docs/cdktf/typescript/r/secretsmanager_secret_rotation.html.markdown
new file mode 100644
index 00000000000..7fbbe9bec68
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/secretsmanager_secret_rotation.html.markdown
@@ -0,0 +1,95 @@
+---
+subcategory: "Secrets Manager"
+layout: "aws"
+page_title: "AWS: aws_secretsmanager_secret_rotation"
+description: |-
+  Provides a resource to manage AWS Secrets Manager secret rotation
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_secretsmanager_secret_rotation
+
+Provides a resource to manage AWS Secrets Manager secret rotation. To manage a secret, see the [`awsSecretsmanagerSecret` resource](/docs/providers/aws/r/secretsmanager_secret.html). To manage a secret value, see the [`awsSecretsmanagerSecretVersion` resource](/docs/providers/aws/r/secretsmanager_secret_version.html).
+
+## Example Usage
+
+### Basic
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SecretsmanagerSecretRotation } from "./.gen/providers/aws/secretsmanager-secret-rotation";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SecretsmanagerSecretRotation(this, "example", {
+      rotationLambdaArn: Token.asString(awsLambdaFunctionExample.arn),
+      rotationRules: {
+        automaticallyAfterDays: 30,
+      },
+      secretId: Token.asString(awsSecretsmanagerSecretExample.id),
+    });
+  }
+}
+
+```
+
+### Rotation Configuration
+
+To enable automatic secret rotation, the Secrets Manager service requires usage of a Lambda function. The [Rotate Secrets section in the Secrets Manager User Guide](https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotating-secrets.html) provides additional information about deploying a prebuilt Lambda functions for supported credential rotation (e.g., RDS) or deploying a custom Lambda function.
+
+~> **NOTE:** Configuring rotation causes the secret to rotate once as soon as you enable rotation. Before you do this, you must ensure that all of your applications that use the credentials stored in the secret are updated to retrieve the secret from AWS Secrets Manager. The old credentials might no longer be usable after the initial rotation and any applications that you fail to update will break as soon as the old credentials are no longer valid.
+
+~> **NOTE:** If you cancel a rotation that is in progress (by removing the `rotation` configuration), it can leave the VersionStage labels in an unexpected state. Depending on what step of the rotation was in progress, you might need to remove the staging label AWSPENDING from the partially created version, specified by the SecretVersionId response value. You should also evaluate the partially rotated new version to see if it should be deleted, which you can do by removing all staging labels from the new version's VersionStage field.
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `secretId` - (Required) Specifies the secret to which you want to add a new version. You can specify either the Amazon Resource Name (ARN) or the friendly name of the secret. The secret must already exist.
+* `rotationLambdaArn` - (Required) Specifies the ARN of the Lambda function that can rotate the secret.
+* `rotationRules` - (Required) A structure that defines the rotation configuration for this secret. Defined below.
+
+### rotation_rules
+
+* `automaticallyAfterDays` - (Optional) Specifies the number of days between automatic scheduled rotations of the secret. Either `automaticallyAfterDays` or `scheduleExpression` must be specified.
+* `duration` - (Optional) - The length of the rotation window in hours. For example, `3H` for a three hour window.
+* `scheduleExpression` - (Optional) A `cron()` or `rate()` expression that defines the schedule for rotating your secret. Either `automaticallyAfterDays` or `scheduleExpression` must be specified.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Amazon Resource Name (ARN) of the secret.
+* `arn` - Amazon Resource Name (ARN) of the secret.
+* `rotationEnabled` - Specifies whether automatic rotation is enabled for this secret.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsSecretsmanagerSecretRotation` using the secret Amazon Resource Name (ARN). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsSecretsmanagerSecretRotation` using the secret Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_secretsmanager_secret_rotation.example arn:aws:secretsmanager:us-east-1:123456789012:secret:example-123456
+```
+
+<!-- cache-key: cdktf-0.18.0 input-cc47ff7adf2afa181189161981103bc0665261d0e6839ac663513dfdf24e3c49 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/secretsmanager_secret_version.html.markdown b/website/docs/cdktf/typescript/r/secretsmanager_secret_version.html.markdown
new file mode 100644
index 00000000000..84eb0456c5f
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/secretsmanager_secret_version.html.markdown
@@ -0,0 +1,147 @@
+---
+subcategory: "Secrets Manager"
+layout: "aws"
+page_title: "AWS: aws_secretsmanager_secret_version"
+description: |-
+  Provides a resource to manage AWS Secrets Manager secret version including its secret value
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_secretsmanager_secret_version
+
+Provides a resource to manage AWS Secrets Manager secret version including its secret value. To manage secret metadata, see the [`awsSecretsmanagerSecret` resource](/docs/providers/aws/r/secretsmanager_secret.html).
+
+~> **NOTE:** If the `awscurrent` staging label is present on this version during resource deletion, that label cannot be removed and will be skipped to prevent errors when fully deleting the secret. That label will leave this secret version active even after the resource is deleted from Terraform unless the secret itself is deleted. Move the `awscurrent` staging label before or after deleting this resource from Terraform to fully trigger version deprecation if necessary.
+
+## Example Usage
+
+### Simple String Value
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SecretsmanagerSecretVersion } from "./.gen/providers/aws/secretsmanager-secret-version";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SecretsmanagerSecretVersion(this, "example", {
+      secretId: Token.asString(awsSecretsmanagerSecretExample.id),
+      secretString: "example-string-to-protect",
+    });
+  }
+}
+
+```
+
+### Key-Value Pairs
+
+Secrets Manager also accepts key-value pairs in JSON.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import {
+  VariableType,
+  TerraformVariable,
+  Token,
+  Fn,
+  TerraformStack,
+} from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SecretsmanagerSecretVersion } from "./.gen/providers/aws/secretsmanager-secret-version";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    /*Terraform Variables are not always the best fit for getting inputs in the context of Terraform CDK.
+    You can read more about this at https://cdk.tf/variables*/
+    const example = new TerraformVariable(this, "example", {
+      default: [
+        {
+          key1: "value1",
+          key2: "value2",
+        },
+      ],
+      type: VariableType.map(VariableType.STRING),
+    });
+    const awsSecretsmanagerSecretVersionExample =
+      new SecretsmanagerSecretVersion(this, "example_1", {
+        secretId: Token.asString(awsSecretsmanagerSecretExample.id),
+        secretString: Token.asString(Fn.jsonencode(example.value)),
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSecretsmanagerSecretVersionExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+-> **Note:** In Terraform 0.14 and later, use `sensitive = true` to protect the values of the variable from being printed in logs and console output (see [Protect Sensitive Input Variables](https://learn.hashicorp.com/tutorials/terraform/sensitive-variables)).
+
+Reading key-value pairs from JSON back into a native Terraform map can be accomplished in Terraform 0.12 and later with the [`jsondecode()` function](https://www.terraform.io/docs/configuration/functions/jsondecode.html):
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformOutput, Fn, TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new TerraformOutput(this, "example", {
+      value: Fn.lookupNested(Fn.jsondecode(example.secretString), ['"key1"']),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `secretId` - (Required) Specifies the secret to which you want to add a new version. You can specify either the Amazon Resource Name (ARN) or the friendly name of the secret. The secret must already exist.
+* `secretString` - (Optional) Specifies text data that you want to encrypt and store in this version of the secret. This is required if secret_binary is not set.
+* `secretBinary` - (Optional) Specifies binary data that you want to encrypt and store in this version of the secret. This is required if secret_string is not set. Needs to be encoded to base64.
+* `versionStages` - (Optional) Specifies a list of staging labels that are attached to this version of the secret. A staging label must be unique to a single version of the secret. If you specify a staging label that's already associated with a different version of the same secret then that staging label is automatically removed from the other version and attached to this version. If you do not specify a value, then AWS Secrets Manager automatically moves the staging label `awscurrent` to this new version on creation.
+
+~> **NOTE:** If `versionStages` is configured, you must include the `awscurrent` staging label if this secret version is the only version or if the label is currently present on this secret version, otherwise Terraform will show a perpetual difference.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the secret.
+* `id` - A pipe delimited combination of secret ID and version ID.
+* `versionId` - The unique identifier of the version of the secret.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsSecretsmanagerSecretVersion` using the secret ID and version ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsSecretsmanagerSecretVersion` using the secret ID and version ID. For example:
+
+```console
+% terraform import aws_secretsmanager_secret_version.example 'arn:aws:secretsmanager:us-east-1:123456789012:secret:example-123456|xxxxx-xxxxxxx-xxxxxxx-xxxxx'
+```
+
+<!-- cache-key: cdktf-0.18.0 input-5f65f3c5e87dc3ce9fac6b2ac4088089f1f88f7a6df546f616bc7e3d7b3fd19d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/security_group.html.markdown b/website/docs/cdktf/typescript/r/security_group.html.markdown
new file mode 100644
index 00000000000..583110f5625
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/security_group.html.markdown
@@ -0,0 +1,421 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_security_group"
+description: |-
+  Provides a security group resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_security_group
+
+Provides a security group resource.
+
+~> **NOTE on Security Groups and Security Group Rules:** Terraform currently provides a Security Group resource with `ingress` and `egress` rules defined in-line and a [Security Group Rule resource](security_group_rule.html) which manages one or more `ingress` or `egress` rules. Both of these resource were added before AWS assigned a [security group rule unique ID](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/security-group-rules.html), and they do not work well in all scenarios using the`description` and `tags` attributes, which rely on the unique ID. The [`awsVpcSecurityGroupEgressRule`](vpc_security_group_egress_rule.html) and [`awsVpcSecurityGroupIngressRule`](vpc_security_group_ingress_rule.html) resources have been added to address these limitations and should be used for all new security group rules. You should not use the `awsVpcSecurityGroupEgressRule` and `awsVpcSecurityGroupIngressRule` resources in conjunction with an `awsSecurityGroup` resource with in-line rules or with `awsSecurityGroupRule` resources defined for the same Security Group, as rule conflicts may occur and rules will be overwritten.
+
+~> **NOTE:** Referencing Security Groups across VPC peering has certain restrictions. More information is available in the [VPC Peering User Guide](https://docs.aws.amazon.com/vpc/latest/peering/vpc-peering-security-groups.html).
+
+~> **NOTE:** Due to [AWS Lambda improved VPC networking changes that began deploying in September 2019](https://aws.amazon.com/blogs/compute/announcing-improved-vpc-networking-for-aws-lambda-functions/), security groups associated with Lambda Functions can take up to 45 minutes to successfully delete. Terraform AWS Provider version 2.31.0 and later automatically handles this increased timeout, however prior versions require setting the [customizable deletion timeout](#timeouts) to 45 minutes (`delete = "45m"`). AWS and HashiCorp are working together to reduce the amount of time required for resource deletion and updates can be tracked in this [GitHub issue](https://github.com/hashicorp/terraform-provider-aws/issues/10329).
+
+~> **NOTE:** The `cidrBlocks` and `ipv6CidrBlocks` parameters are optional in the `ingress` and `egress` blocks. If nothing is specified, traffic will be blocked as described in _NOTE on Egress rules_ later.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SecurityGroup } from "./.gen/providers/aws/security-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SecurityGroup(this, "allow_tls", {
+      description: "Allow TLS inbound traffic",
+      egress: [
+        {
+          cidrBlocks: ["0.0.0.0/0"],
+          fromPort: 0,
+          ipv6CidrBlocks: ["::/0"],
+          protocol: "-1",
+          toPort: 0,
+        },
+      ],
+      ingress: [
+        {
+          cidrBlocks: [main.cidrBlock],
+          description: "TLS from VPC",
+          fromPort: 443,
+          ipv6CidrBlocks: [main.ipv6CidrBlock],
+          protocol: "tcp",
+          toPort: 443,
+        },
+      ],
+      name: "allow_tls",
+      tags: {
+        Name: "allow_tls",
+      },
+      vpcId: main.id,
+    });
+  }
+}
+
+```
+
+~> **NOTE on Egress rules:** By default, AWS creates an `ALLOW ALL` egress rule when creating a new Security Group inside of a VPC. When creating a new Security Group inside a VPC, **Terraform will remove this default rule**, and require you specifically re-create it if you desire that rule. We feel this leads to fewer surprises in terms of controlling your egress rules. If you desire this rule to be in place, you can use this `egress` block:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SecurityGroup } from "./.gen/providers/aws/security-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SecurityGroup(this, "example", {
+      egress: [
+        {
+          cidrBlocks: ["0.0.0.0/0"],
+          fromPort: 0,
+          ipv6CidrBlocks: ["::/0"],
+          protocol: "-1",
+          toPort: 0,
+        },
+      ],
+    });
+  }
+}
+
+```
+
+### Usage With Prefix List IDs
+
+Prefix Lists are either managed by AWS internally, or created by the customer using a
+[Prefix List resource](ec2_managed_prefix_list.html). Prefix Lists provided by
+AWS are associated with a prefix list name, or service name, that is linked to a specific region.
+Prefix list IDs are exported on VPC Endpoints, so you can use this format:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SecurityGroup } from "./.gen/providers/aws/security-group";
+import { VpcEndpoint } from "./.gen/providers/aws/vpc-endpoint";
+interface MyConfig {
+  serviceName: any;
+  vpcId: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    const myEndpoint = new VpcEndpoint(this, "my_endpoint", {
+      serviceName: config.serviceName,
+      vpcId: config.vpcId,
+    });
+    new SecurityGroup(this, "example", {
+      egress: [
+        {
+          fromPort: 0,
+          prefixListIds: [myEndpoint.prefixListId],
+          protocol: "-1",
+          toPort: 0,
+        },
+      ],
+    });
+  }
+}
+
+```
+
+You can also find a specific Prefix List using the `awsPrefixList` data source.
+
+### Removing All Ingress and Egress Rules
+
+The `ingress` and `egress` arguments are processed in [attributes-as-blocks](https://developer.hashicorp.com/terraform/language/attr-as-blocks) mode. Due to this, removing these arguments from the configuration will **not** cause Terraform to destroy the managed rules. To subsequently remove all managed ingress and egress rules:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SecurityGroup } from "./.gen/providers/aws/security-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SecurityGroup(this, "example", {
+      egress: [],
+      ingress: [],
+      name: "sg",
+      vpcId: Token.asString(awsVpcExample.id),
+    });
+  }
+}
+
+```
+
+### Recreating a Security Group
+
+A simple security group `name` change "forces new" the security group--Terraform destroys the security group and creates a new one. (Likewise, `description`, `namePrefix`, or `vpcId` [cannot be changed](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/working-with-security-groups.html#creating-security-group).) Attempting to recreate the security group leads to a variety of complications depending on how it is used.
+
+Security groups are generally associated with other resources--**more than 100** AWS Provider resources reference security groups. Referencing a resource from another resource creates a one-way dependency. For example, if you create an EC2 `awsInstance` that has a `vpcSecurityGroupIds` argument that refers to an `awsSecurityGroup` resource, the `awsSecurityGroup` is a dependent of the `awsInstance`. Because of this, Terraform will create the security group first so that it can then be associated with the EC2 instance.
+
+However, the dependency relationship actually goes both directions causing the _Security Group Deletion Problem_. AWS does not allow you to delete the security group associated with another resource (_e.g._, the `awsInstance`).
+
+Terraform does [not model bi-directional dependencies](https://developer.hashicorp.com/terraform/internals/graph) like this, but, even if it did, simply knowing the dependency situation would not be enough to solve it. For example, some resources must always have an associated security group while others don't need to. In addition, when the `awsSecurityGroup` resource attempts to recreate, it receives a dependent object error, which does not provide information on whether the dependent object is a security group rule or, for example, an associated EC2 instance. Within Terraform, the associated resource (_e.g._, `awsInstance`) does not receive an error when the `awsSecurityGroup` is trying to recreate even though that is where changes to the associated resource would need to take place (_e.g._, removing the security group association).
+
+Despite these sticky problems, below are some ways to improve your experience when you find it necessary to recreate a security group.
+
+#### `createBeforeDestroy`
+
+(This example is one approach to [recreating security groups](#recreating-a-security-group). For more information on the challenges and the _Security Group Deletion Problem_, see [the section above](#recreating-a-security-group).)
+
+Normally, Terraform first deletes the existing security group resource and then creates a new one. When a security group is associated with a resource, the delete won't succeed. You can invert the default behavior using the [`createBeforeDestroy` meta argument](https://www.terraform.io/language/meta-arguments/lifecycle#create_before_destroy):
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SecurityGroup } from "./.gen/providers/aws/security-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SecurityGroup(this, "example", {
+      lifecycle: {
+        createBeforeDestroy: true,
+      },
+      name: "changeable-name",
+    });
+  }
+}
+
+```
+
+#### `replaceTriggeredBy`
+
+(This example is one approach to [recreating security groups](#recreating-a-security-group). For more information on the challenges and the _Security Group Deletion Problem_, see [the section above](#recreating-a-security-group).)
+
+To replace a resource when a security group changes, use the [`replaceTriggeredBy` meta argument](https://www.terraform.io/language/meta-arguments/lifecycle#replace_triggered_by). Note that in this example, the `awsInstance` will be destroyed and created again when the `awsSecurityGroup` changes.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Instance } from "./.gen/providers/aws/instance";
+import { SecurityGroup } from "./.gen/providers/aws/security-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new SecurityGroup(this, "example", {
+      name: "sg",
+    });
+    const awsInstanceExample = new Instance(this, "example_1", {
+      instanceType: "t3.small",
+      lifecycle: {
+        replaceTriggeredBy: [example],
+      },
+      vpcSecurityGroupIds: [test.id],
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsInstanceExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+#### Shorter timeout
+
+(This example is one approach to [recreating security groups](#recreating-a-security-group). For more information on the challenges and the _Security Group Deletion Problem_, see [the section above](#recreating-a-security-group).)
+
+If destroying a security group takes a long time, it may be because Terraform cannot distinguish between a dependent object (_e.g._, a security group rule or EC2 instance) that is _in the process of being deleted_ and one that is not. In other words, it may be waiting for a train that isn't scheduled to arrive. To fail faster, shorten the `delete` [timeout](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts) from the default timeout:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SecurityGroup } from "./.gen/providers/aws/security-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SecurityGroup(this, "example", {
+      name: "izizavle",
+      timeouts: [
+        {
+          delete: "2m",
+        },
+      ],
+    });
+  }
+}
+
+```
+
+#### Provisioners
+
+(This example is one approach to [recreating security groups](#recreating-a-security-group). For more information on the challenges and the _Security Group Deletion Problem_, see [the section above](#recreating-a-security-group).)
+
+**DISCLAIMER:** We **_HIGHLY_** recommend using one of the above approaches and _NOT_ using local provisioners. Provisioners, like the one shown below, should be considered a **last resort** since they are _not readable_, _require skills outside standard Terraform configuration_, are _error prone_ and _difficult to maintain_, are not compatible with cloud environments and upgrade tools, require AWS CLI installation, and are subject to AWS CLI and Terraform changes outside the AWS Provider.
+
+```terraform
+data "aws_security_group" "default" {
+  name = "default"
+  # ... other configuration ...
+}
+
+resource "aws_security_group" "example" {
+  name = "sg"
+  # ... other configuration ...
+
+  # The downstream resource must have at least one SG attached, therefore we
+  # attach the default SG of the VPC temporarily and remove it later on
+  provisioner "local-exec" {
+    when       = destroy
+    command    = <<DOC
+            ENDPOINT_ID=`aws ec2 describe-vpc-endpoints --filters "Name=tag:Name,Values=${self.tags.workaround1}" --query "VpcEndpoints[0].VpcEndpointId" --output text` &&
+            aws ec2 modify-vpc-endpoint --vpc-endpoint-id $${ENDPOINT_ID} --add-security-group-ids ${self.tags.workaround2} --remove-security-group-ids ${self.id}
+        DOC
+    on_failure = continue
+  }
+
+  tags = {
+    workaround1 = "tagged-name"
+    workaround2 = data.aws_security_group.default.id
+  }
+}
+
+resource "null_resource" "example" {
+  provisioner "local-exec" {
+    command    = <<DOC
+            aws ec2 modify-vpc-endpoint --vpc-endpoint-id ${aws_vpc_endpoint.example.id} --remove-security-group-ids ${data.aws_security_group.default.id}
+        DOC
+    on_failure = continue
+  }
+
+  triggers = {
+    rerun_upon_change_of = join(",", aws_vpc_endpoint.example.security_group_ids)
+  }
+}
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `description` - (Optional, Forces new resource) Security group description. Defaults to `Managed by Terraform`. Cannot be `""`. **NOTE**: This field maps to the AWS `groupDescription` attribute, for which there is no Update API. If you'd like to classify your security groups in a way that can be updated, use `tags`.
+* `egress` - (Optional, VPC only) Configuration block for egress rules. Can be specified multiple times for each egress rule. Each egress block supports fields documented below. This argument is processed in [attribute-as-blocks mode](https://www.terraform.io/docs/configuration/attr-as-blocks.html).
+* `ingress` - (Optional) Configuration block for ingress rules. Can be specified multiple times for each ingress rule. Each ingress block supports fields documented below. This argument is processed in [attribute-as-blocks mode](https://www.terraform.io/docs/configuration/attr-as-blocks.html).
+* `namePrefix` - (Optional, Forces new resource) Creates a unique name beginning with the specified prefix. Conflicts with `name`.
+* `name` - (Optional, Forces new resource) Name of the security group. If omitted, Terraform will assign a random, unique name.
+* `revokeRulesOnDelete` - (Optional) Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. This is normally not needed, however certain AWS services such as Elastic Map Reduce may automatically add required rules to security groups used with the service, and those rules may contain a cyclic dependency that prevent the security groups from being destroyed without removing the dependency first. Default `false`.
+* `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `vpcId` - (Optional, Forces new resource) VPC ID. Defaults to the region's default VPC.
+
+### ingress
+
+This argument is processed in [attribute-as-blocks mode](https://www.terraform.io/docs/configuration/attr-as-blocks.html).
+
+The following arguments are required:
+
+* `fromPort` - (Required) Start port (or ICMP type number if protocol is `icmp` or `icmpv6`).
+* `toPort` - (Required) End range port (or ICMP code if protocol is `icmp`).
+* `protocol` - (Required) Protocol. If you select a protocol of `1` (semantically equivalent to `all`, which is not a valid value here), you must specify a `fromPort` and `toPort` equal to 0.  The supported values are defined in the `ipProtocol` argument on the [IpPermission](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_IpPermission.html) API reference. This argument is normalized to a lowercase value to match the AWS API requirement when using with Terraform 0.12.x and above, please make sure that the value of the protocol is specified as lowercase when using with older version of Terraform to avoid an issue during upgrade.
+
+The following arguments are optional:
+
+~> **Note** Although `cidrBlocks`, `ipv6CidrBlocks`, `prefixListIds`, and `securityGroups` are all marked as optional, you _must_ provide one of them in order to configure the source of the traffic.
+
+* `cidrBlocks` - (Optional) List of CIDR blocks.
+* `description` - (Optional) Description of this ingress rule.
+* `ipv6CidrBlocks` - (Optional) List of IPv6 CIDR blocks.
+* `prefixListIds` - (Optional) List of Prefix List IDs.
+* `securityGroups` - (Optional) List of security groups. A group name can be used relative to the default VPC. Otherwise, group ID.
+* `self` - (Optional) Whether the security group itself will be added as a source to this ingress rule.
+
+### egress
+
+This argument is processed in [attribute-as-blocks mode](https://www.terraform.io/docs/configuration/attr-as-blocks.html).
+
+The following arguments are required:
+
+* `fromPort` - (Required) Start port (or ICMP type number if protocol is `icmp`)
+* `toPort` - (Required) End range port (or ICMP code if protocol is `icmp`).
+
+The following arguments are optional:
+
+~> **Note** Although `cidrBlocks`, `ipv6CidrBlocks`, `prefixListIds`, and `securityGroups` are all marked as optional, you _must_ provide one of them in order to configure the destination of the traffic.
+
+* `cidrBlocks` - (Optional) List of CIDR blocks.
+* `description` - (Optional) Description of this egress rule.
+* `ipv6CidrBlocks` - (Optional) List of IPv6 CIDR blocks.
+* `prefixListIds` - (Optional) List of Prefix List IDs.
+* `protocol` - (Required) Protocol. If you select a protocol of `1` (semantically equivalent to `all`, which is not a valid value here), you must specify a `fromPort` and `toPort` equal to 0.  The supported values are defined in the `ipProtocol` argument in the [IpPermission](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_IpPermission.html) API reference. This argument is normalized to a lowercase value to match the AWS API requirement when using Terraform 0.12.x and above. Please make sure that the value of the protocol is specified as lowercase when used with older version of Terraform to avoid issues during upgrade.
+* `securityGroups` - (Optional) List of security groups. A group name can be used relative to the default VPC. Otherwise, group ID.
+* `self` - (Optional) Whether the security group itself will be added as a source to this egress rule.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the security group.
+* `id` - ID of the security group.
+* `ownerId` - Owner ID.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `10M`)
+- `delete` - (Default `15M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Security Groups using the security group `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Security Groups using the security group `id`. For example:
+
+```console
+% terraform import aws_security_group.elb_sg sg-903004f8
+```
+
+<!-- cache-key: cdktf-0.18.0 input-6bcc9835f16447ac7bb124f5ed74bb0497f70dd790dd17824e05e55e14536c7a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/security_group_rule.html.markdown b/website/docs/cdktf/typescript/r/security_group_rule.html.markdown
new file mode 100644
index 00000000000..dd2541217a5
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/security_group_rule.html.markdown
@@ -0,0 +1,317 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_security_group_rule"
+description: |-
+  Provides an security group rule resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_security_group_rule
+
+Provides a security group rule resource. Represents a single `ingress` or
+`egress` group rule, which can be added to external Security Groups.
+
+~> **NOTE on Security Groups and Security Group Rules:** Terraform currently provides a [Security Group resource](security_group.html) with `ingress` and `egress` rules defined in-line and a Security Group Rule resource which manages one or more `ingress` or
+`egress` rules. Both of these resource were added before AWS assigned a [security group rule unique ID](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/security-group-rules.html), and they do not work well in all scenarios using the`description` and `tags` attributes, which rely on the unique ID.
+The [`awsVpcSecurityGroupEgressRule`](vpc_security_group_egress_rule.html) and [`awsVpcSecurityGroupIngressRule`](vpc_security_group_ingress_rule.html) resources have been added to address these limitations and should be used for all new security group rules.
+You should not use the `awsVpcSecurityGroupEgressRule` and `awsVpcSecurityGroupIngressRule` resources in conjunction with an `awsSecurityGroup` resource with in-line rules or with `awsSecurityGroupRule` resources defined for the same Security Group, as rule conflicts may occur and rules will be overwritten.
+
+~> **NOTE:** Setting `protocol = "all"` or `protocol = -1` with `fromPort` and `toPort` will result in the EC2 API creating a security group rule with all ports open. This API behavior cannot be controlled by Terraform and may generate warnings in the future.
+
+~> **NOTE:** Referencing Security Groups across VPC peering has certain restrictions. More information is available in the [VPC Peering User Guide](https://docs.aws.amazon.com/vpc/latest/peering/vpc-peering-security-groups.html).
+
+## Example Usage
+
+Basic usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SecurityGroupRule } from "./.gen/providers/aws/security-group-rule";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SecurityGroupRule(this, "example", {
+      cidrBlocks: [Token.asString(awsVpcExample.cidrBlock)],
+      fromPort: 0,
+      ipv6CidrBlocks: [Token.asString(awsVpcExample.ipv6CidrBlock)],
+      protocol: "tcp",
+      securityGroupId: "sg-123456",
+      toPort: 65535,
+      type: "ingress",
+    });
+  }
+}
+
+```
+
+### Usage With Prefix List IDs
+
+Prefix Lists are either managed by AWS internally, or created by the customer using a
+[Managed Prefix List resource](ec2_managed_prefix_list.html). Prefix Lists provided by
+AWS are associated with a prefix list name, or service name, that is linked to a specific region.
+
+Prefix list IDs are exported on VPC Endpoints, so you can use this format:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SecurityGroupRule } from "./.gen/providers/aws/security-group-rule";
+import { VpcEndpoint } from "./.gen/providers/aws/vpc-endpoint";
+interface MyConfig {
+  serviceName: any;
+  vpcId: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    const myEndpoint = new VpcEndpoint(this, "my_endpoint", {
+      serviceName: config.serviceName,
+      vpcId: config.vpcId,
+    });
+    new SecurityGroupRule(this, "allow_all", {
+      fromPort: 0,
+      prefixListIds: [myEndpoint.prefixListId],
+      protocol: "-1",
+      securityGroupId: "sg-123456",
+      toPort: 0,
+      type: "egress",
+    });
+  }
+}
+
+```
+
+You can also find a specific Prefix List using the [`awsPrefixList`](/docs/providers/aws/d/prefix_list.html)
+or [`ec2ManagedPrefixList`](/docs/providers/aws/d/ec2_managed_prefix_list.html) data sources:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsPrefixList } from "./.gen/providers/aws/data-aws-prefix-list";
+import { DataAwsRegion } from "./.gen/providers/aws/data-aws-region";
+import { SecurityGroupRule } from "./.gen/providers/aws/security-group-rule";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const current = new DataAwsRegion(this, "current", {});
+    const s3 = new DataAwsPrefixList(this, "s3", {
+      name: "com.amazonaws.${" + current.name + "}.s3",
+    });
+    new SecurityGroupRule(this, "s3_gateway_egress", {
+      description: "S3 Gateway Egress",
+      fromPort: 443,
+      prefixListIds: [Token.asString(s3.id)],
+      protocol: "tcp",
+      securityGroupId: "sg-123456",
+      toPort: 443,
+      type: "egress",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `fromPort` - (Required) Start port (or ICMP type number if protocol is "icmp" or "icmpv6").
+* `protocol` - (Required) Protocol. If not icmp, icmpv6, tcp, udp, or all use the [protocol number](https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml)
+* `securityGroupId` - (Required) Security group to apply this rule to.
+* `toPort` - (Required) End port (or ICMP code if protocol is "icmp").
+* `type` - (Required) Type of rule being created. Valid options are `ingress` (inbound)
+or `egress` (outbound).
+
+The following arguments are optional:
+
+~> **Note** Although `cidrBlocks`, `ipv6CidrBlocks`, `prefixListIds`, and `sourceSecurityGroupId` are all marked as optional, you _must_ provide one of them in order to configure the source of the traffic.
+
+* `cidrBlocks` - (Optional) List of CIDR blocks. Cannot be specified with `sourceSecurityGroupId` or `self`.
+* `description` - (Optional) Description of the rule.
+* `ipv6CidrBlocks` - (Optional) List of IPv6 CIDR blocks. Cannot be specified with `sourceSecurityGroupId` or `self`.
+* `prefixListIds` - (Optional) List of Prefix List IDs.
+* `self` - (Optional) Whether the security group itself will be added as a source to this ingress rule. Cannot be specified with `cidrBlocks`, `ipv6CidrBlocks`, or `sourceSecurityGroupId`.
+* `sourceSecurityGroupId` - (Optional) Security group id to allow access to/from, depending on the `type`. Cannot be specified with `cidrBlocks`, `ipv6CidrBlocks`, or `self`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the security group rule.
+* `securityGroupRuleId` - If the `awsSecurityGroupRule` resource has a single source or destination then this is the AWS Security Group Rule resource ID. Otherwise it is empty.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `5M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Security Group Rules using the `securityGroupId`, `type`, `protocol`, `fromPort`, `toPort`, and source(s)/destination(s) (such as a `cidrBlock`) separated by underscores (`_`). All parts are required. For example:
+
+**NOTE:** Not all rule permissions (e.g., not all of a rule's CIDR blocks) need to be imported for Terraform to manage rule permissions. However, importing some of a rule's permissions but not others, and then making changes to the rule will result in the creation of an additional rule to capture the updated permissions. Rule permissions that were not imported are left intact in the original rule.
+
+Import an ingress rule in security group `sg6E616F6D69` for TCP port 8000 with an IPv4 destination CIDR of `10030/24`:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Import a rule with various IPv4 and IPv6 source CIDR blocks:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Import a rule, applicable to all ports, with a protocol other than TCP/UDP/ICMP/ICMPV6/ALL, e.g., Multicast Transport Protocol (MTP), using the IANA protocol number. For example: 92.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Import a default any/any egress rule to 0.0.0.0/0:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Import an egress rule with a prefix list ID destination:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Import a rule applicable to all protocols and ports with a security group source:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Import a rule that has itself and an IPv6 CIDR block as sources:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+**Using `terraform import` to import** Security Group Rules using the `securityGroupId`, `type`, `protocol`, `fromPort`, `toPort`, and source(s)/destination(s) (such as a `cidrBlock`) separated by underscores (`_`). All parts are required. For example:
+
+**NOTE:** Not all rule permissions (e.g., not all of a rule's CIDR blocks) need to be imported for Terraform to manage rule permissions. However, importing some of a rule's permissions but not others, and then making changes to the rule will result in the creation of an additional rule to capture the updated permissions. Rule permissions that were not imported are left intact in the original rule.
+
+Import an ingress rule in security group `sg6E616F6D69` for TCP port 8000 with an IPv4 destination CIDR of `10030/24`:
+
+```console
+% terraform import aws_security_group_rule.ingress sg-6e616f6d69_ingress_tcp_8000_8000_10.0.3.0/24
+```
+
+Import a rule with various IPv4 and IPv6 source CIDR blocks:
+
+```console
+% terraform import aws_security_group_rule.ingress sg-4973616163_ingress_tcp_100_121_10.1.0.0/16_2001:db8::/48_10.2.0.0/16_2002:db8::/48
+```
+
+Import a rule, applicable to all ports, with a protocol other than TCP/UDP/ICMP/ICMPV6/ALL, e.g., Multicast Transport Protocol (MTP), using the IANA protocol number. For example: 92.
+
+```console
+% terraform import aws_security_group_rule.ingress sg-6777656e646f6c796e_ingress_92_0_65536_10.0.3.0/24_10.0.4.0/24
+```
+
+Import a default any/any egress rule to 0.0.0.0/0:
+
+```console
+% terraform import aws_security_group_rule.default_egress sg-6777656e646f6c796e_egress_all_0_0_0.0.0.0/0
+```
+
+Import an egress rule with a prefix list ID destination:
+
+```console
+% terraform import aws_security_group_rule.egress sg-62726f6479_egress_tcp_8000_8000_pl-6469726b
+```
+
+Import a rule applicable to all protocols and ports with a security group source:
+
+```console
+% terraform import aws_security_group_rule.ingress_rule sg-7472697374616e_ingress_all_0_65536_sg-6176657279
+```
+
+Import a rule that has itself and an IPv6 CIDR block as sources:
+
+```console
+% terraform import aws_security_group_rule.rule_name sg-656c65616e6f72_ingress_tcp_80_80_self_2001:db8::/48
+```
+
+<!-- cache-key: cdktf-0.18.0 input-db0dbf623f1a56f51f8c29803443104e878f48f4aaaba90059e21bccd58f7112 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/securityhub_account.html.markdown b/website/docs/cdktf/typescript/r/securityhub_account.html.markdown
new file mode 100644
index 00000000000..32ca6e7bc54
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/securityhub_account.html.markdown
@@ -0,0 +1,72 @@
+---
+subcategory: "Security Hub"
+layout: "aws"
+page_title: "AWS: aws_securityhub_account"
+description: |-
+  Enables Security Hub for an AWS account.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_securityhub_account
+
+Enables Security Hub for this AWS account.
+
+~> **NOTE:** Destroying this resource will disable Security Hub for this AWS account.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SecurityhubAccount } from "./.gen/providers/aws/securityhub-account";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SecurityhubAccount(this, "example", {});
+  }
+}
+
+```
+
+## Argument Reference
+
+* `enableDefaultStandards` - (Optional) Whether to enable the security standards that Security Hub has designated as automatically enabled including: ` AWS Foundational Security Best Practices v1.0.0` and `CIS AWS Foundations Benchmark v1.2.0`. Defaults to `true`.
+* `controlFindingGenerator` - (Optional) Updates whether the calling account has consolidated control findings turned on. If the value for this field is set to `securityControl`, Security Hub generates a single finding for a control check even when the check applies to multiple enabled standards. If the value for this field is set to `standardControl`, Security Hub generates separate findings for a control check when the check applies to multiple enabled standards. For accounts that are part of an organization, this value can only be updated in the administrator account.
+* `autoEnableControls` - (Optional) Whether to automatically enable new controls when they are added to standards that are enabled. By default, this is set to true, and new controls are enabled automatically. To not automatically enable new controls, set this to false.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - AWS Account ID.
+* `arn` - ARN of the SecurityHub Hub created in the account.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import an existing Security Hub enabled account using the AWS account ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import an existing Security Hub enabled account using the AWS account ID. For example:
+
+```console
+% terraform import aws_securityhub_account.example 123456789012
+```
+
+<!-- cache-key: cdktf-0.18.0 input-3c29f6fa3b1da1b294f8e57fd126a24487344bdb5307bd88d0e5c955b64f2338 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/securityhub_account.markdown b/website/docs/cdktf/typescript/r/securityhub_account.markdown
new file mode 100644
index 00000000000..32ca6e7bc54
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/securityhub_account.markdown
@@ -0,0 +1,72 @@
+---
+subcategory: "Security Hub"
+layout: "aws"
+page_title: "AWS: aws_securityhub_account"
+description: |-
+  Enables Security Hub for an AWS account.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_securityhub_account
+
+Enables Security Hub for this AWS account.
+
+~> **NOTE:** Destroying this resource will disable Security Hub for this AWS account.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SecurityhubAccount } from "./.gen/providers/aws/securityhub-account";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SecurityhubAccount(this, "example", {});
+  }
+}
+
+```
+
+## Argument Reference
+
+* `enableDefaultStandards` - (Optional) Whether to enable the security standards that Security Hub has designated as automatically enabled including: ` AWS Foundational Security Best Practices v1.0.0` and `CIS AWS Foundations Benchmark v1.2.0`. Defaults to `true`.
+* `controlFindingGenerator` - (Optional) Updates whether the calling account has consolidated control findings turned on. If the value for this field is set to `securityControl`, Security Hub generates a single finding for a control check even when the check applies to multiple enabled standards. If the value for this field is set to `standardControl`, Security Hub generates separate findings for a control check when the check applies to multiple enabled standards. For accounts that are part of an organization, this value can only be updated in the administrator account.
+* `autoEnableControls` - (Optional) Whether to automatically enable new controls when they are added to standards that are enabled. By default, this is set to true, and new controls are enabled automatically. To not automatically enable new controls, set this to false.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - AWS Account ID.
+* `arn` - ARN of the SecurityHub Hub created in the account.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import an existing Security Hub enabled account using the AWS account ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import an existing Security Hub enabled account using the AWS account ID. For example:
+
+```console
+% terraform import aws_securityhub_account.example 123456789012
+```
+
+<!-- cache-key: cdktf-0.18.0 input-3c29f6fa3b1da1b294f8e57fd126a24487344bdb5307bd88d0e5c955b64f2338 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/securityhub_action_target.html.markdown b/website/docs/cdktf/typescript/r/securityhub_action_target.html.markdown
new file mode 100644
index 00000000000..9e5fc2a66d1
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/securityhub_action_target.html.markdown
@@ -0,0 +1,84 @@
+---
+subcategory: "Security Hub"
+layout: "aws"
+page_title: "AWS: aws_securityhub_action_target"
+description: |-
+  Creates Security Hub custom action.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_securityhub_action_target
+
+Creates Security Hub custom action.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SecurityhubAccount } from "./.gen/providers/aws/securityhub-account";
+import { SecurityhubActionTarget } from "./.gen/providers/aws/securityhub-action-target";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new SecurityhubAccount(this, "example", {});
+    const awsSecurityhubActionTargetExample = new SecurityhubActionTarget(
+      this,
+      "example_1",
+      {
+        dependsOn: [example],
+        description: "This is custom action sends selected findings to chat",
+        identifier: "SendToChat",
+        name: "Send notification to chat",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSecurityhubActionTargetExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The description for the custom action target.
+* `identifier` - (Required) The ID for the custom action target.
+* `description` - (Required) The name of the custom action target.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the Security Hub custom action target.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Security Hub custom action using the action target ARN. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Security Hub custom action using the action target ARN. For example:
+
+```console
+% terraform import aws_securityhub_action_target.example arn:aws:securityhub:eu-west-1:312940875350:action/custom/a
+```
+
+<!-- cache-key: cdktf-0.18.0 input-f331888c82c7ef74de6bccfde47e4f271fbed25da322bc1a1b5a3647406b7908 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/securityhub_finding_aggregator.html.markdown b/website/docs/cdktf/typescript/r/securityhub_finding_aggregator.html.markdown
new file mode 100644
index 00000000000..332b26ab6bf
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/securityhub_finding_aggregator.html.markdown
@@ -0,0 +1,144 @@
+---
+subcategory: "Security Hub"
+layout: "aws"
+page_title: "AWS: aws_securityhub_finding_aggregator"
+description: |-
+  Manages a Security Hub finding aggregator
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_securityhub_finding_aggregator
+
+Manages a Security Hub finding aggregator. Security Hub needs to be enabled in a region in order for the aggregator to pull through findings.
+
+## Example Usage
+
+### All Regions Usage
+
+The following example will enable the aggregator for every region.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SecurityhubAccount } from "./.gen/providers/aws/securityhub-account";
+import { SecurityhubFindingAggregator } from "./.gen/providers/aws/securityhub-finding-aggregator";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new SecurityhubAccount(this, "example", {});
+    const awsSecurityhubFindingAggregatorExample =
+      new SecurityhubFindingAggregator(this, "example_1", {
+        dependsOn: [example],
+        linkingMode: "ALL_REGIONS",
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSecurityhubFindingAggregatorExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### All Regions Except Specified Regions Usage
+
+The following example will enable the aggregator for every region except those specified in `specifiedRegions`.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SecurityhubAccount } from "./.gen/providers/aws/securityhub-account";
+import { SecurityhubFindingAggregator } from "./.gen/providers/aws/securityhub-finding-aggregator";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new SecurityhubAccount(this, "example", {});
+    const awsSecurityhubFindingAggregatorExample =
+      new SecurityhubFindingAggregator(this, "example_1", {
+        dependsOn: [example],
+        linkingMode: "ALL_REGIONS_EXCEPT_SPECIFIED",
+        specifiedRegions: ["eu-west-1", "eu-west-2"],
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSecurityhubFindingAggregatorExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### Specified Regions Usage
+
+The following example will enable the aggregator for every region specified in `specifiedRegions`.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SecurityhubAccount } from "./.gen/providers/aws/securityhub-account";
+import { SecurityhubFindingAggregator } from "./.gen/providers/aws/securityhub-finding-aggregator";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new SecurityhubAccount(this, "example", {});
+    const awsSecurityhubFindingAggregatorExample =
+      new SecurityhubFindingAggregator(this, "example_1", {
+        dependsOn: [example],
+        linkingMode: "SPECIFIED_REGIONS",
+        specifiedRegions: ["eu-west-1", "eu-west-2"],
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSecurityhubFindingAggregatorExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+- `linkingMode` - (Required) Indicates whether to aggregate findings from all of the available Regions or from a specified list. The options are `allRegions`, `allRegionsExceptSpecified` or `specifiedRegions`. When `allRegions` or `allRegionsExceptSpecified` are used, Security Hub will automatically aggregate findings from new Regions as Security Hub supports them and you opt into them.
+- `specifiedRegions` - (Optional) List of regions to include or exclude (required if `linkingMode` is set to `allRegionsExceptSpecified` or `specifiedRegions`)
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+- `arn` - Amazon Resource Name (ARN) of the Security Hub finding aggregator.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import an existing Security Hub finding aggregator using the `arn`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import an existing Security Hub finding aggregator using the `arn`. For example:
+
+```console
+% terraform import aws_securityhub_finding_aggregator.example arn:aws:securityhub:eu-west-1:123456789098:finding-aggregator/abcd1234-abcd-1234-1234-abcdef123456
+```
+
+<!-- cache-key: cdktf-0.18.0 input-b0a0cef9ae9a2e4ba102b890bdf1e0083eb9b71a497b601f823d3d520dd935aa -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/securityhub_finding_aggregator.markdown b/website/docs/cdktf/typescript/r/securityhub_finding_aggregator.markdown
new file mode 100644
index 00000000000..332b26ab6bf
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/securityhub_finding_aggregator.markdown
@@ -0,0 +1,144 @@
+---
+subcategory: "Security Hub"
+layout: "aws"
+page_title: "AWS: aws_securityhub_finding_aggregator"
+description: |-
+  Manages a Security Hub finding aggregator
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_securityhub_finding_aggregator
+
+Manages a Security Hub finding aggregator. Security Hub needs to be enabled in a region in order for the aggregator to pull through findings.
+
+## Example Usage
+
+### All Regions Usage
+
+The following example will enable the aggregator for every region.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SecurityhubAccount } from "./.gen/providers/aws/securityhub-account";
+import { SecurityhubFindingAggregator } from "./.gen/providers/aws/securityhub-finding-aggregator";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new SecurityhubAccount(this, "example", {});
+    const awsSecurityhubFindingAggregatorExample =
+      new SecurityhubFindingAggregator(this, "example_1", {
+        dependsOn: [example],
+        linkingMode: "ALL_REGIONS",
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSecurityhubFindingAggregatorExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### All Regions Except Specified Regions Usage
+
+The following example will enable the aggregator for every region except those specified in `specifiedRegions`.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SecurityhubAccount } from "./.gen/providers/aws/securityhub-account";
+import { SecurityhubFindingAggregator } from "./.gen/providers/aws/securityhub-finding-aggregator";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new SecurityhubAccount(this, "example", {});
+    const awsSecurityhubFindingAggregatorExample =
+      new SecurityhubFindingAggregator(this, "example_1", {
+        dependsOn: [example],
+        linkingMode: "ALL_REGIONS_EXCEPT_SPECIFIED",
+        specifiedRegions: ["eu-west-1", "eu-west-2"],
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSecurityhubFindingAggregatorExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### Specified Regions Usage
+
+The following example will enable the aggregator for every region specified in `specifiedRegions`.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SecurityhubAccount } from "./.gen/providers/aws/securityhub-account";
+import { SecurityhubFindingAggregator } from "./.gen/providers/aws/securityhub-finding-aggregator";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new SecurityhubAccount(this, "example", {});
+    const awsSecurityhubFindingAggregatorExample =
+      new SecurityhubFindingAggregator(this, "example_1", {
+        dependsOn: [example],
+        linkingMode: "SPECIFIED_REGIONS",
+        specifiedRegions: ["eu-west-1", "eu-west-2"],
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSecurityhubFindingAggregatorExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+- `linkingMode` - (Required) Indicates whether to aggregate findings from all of the available Regions or from a specified list. The options are `allRegions`, `allRegionsExceptSpecified` or `specifiedRegions`. When `allRegions` or `allRegionsExceptSpecified` are used, Security Hub will automatically aggregate findings from new Regions as Security Hub supports them and you opt into them.
+- `specifiedRegions` - (Optional) List of regions to include or exclude (required if `linkingMode` is set to `allRegionsExceptSpecified` or `specifiedRegions`)
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+- `arn` - Amazon Resource Name (ARN) of the Security Hub finding aggregator.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import an existing Security Hub finding aggregator using the `arn`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import an existing Security Hub finding aggregator using the `arn`. For example:
+
+```console
+% terraform import aws_securityhub_finding_aggregator.example arn:aws:securityhub:eu-west-1:123456789098:finding-aggregator/abcd1234-abcd-1234-1234-abcdef123456
+```
+
+<!-- cache-key: cdktf-0.18.0 input-b0a0cef9ae9a2e4ba102b890bdf1e0083eb9b71a497b601f823d3d520dd935aa -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/securityhub_insight.html.markdown b/website/docs/cdktf/typescript/r/securityhub_insight.html.markdown
new file mode 100644
index 00000000000..8982f411ee6
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/securityhub_insight.html.markdown
@@ -0,0 +1,413 @@
+---
+subcategory: "Security Hub"
+layout: "aws"
+page_title: "AWS: aws_securityhub_insight"
+description: |-
+  Provides a Security Hub custom insight resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_securityhub_insight
+
+Provides a Security Hub custom insight resource. See the [Managing custom insights section](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-custom-insights.html) of the AWS User Guide for more information.
+
+## Example Usage
+
+### Filter by AWS account ID
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SecurityhubAccount } from "./.gen/providers/aws/securityhub-account";
+import { SecurityhubInsight } from "./.gen/providers/aws/securityhub-insight";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new SecurityhubAccount(this, "example", {});
+    const awsSecurityhubInsightExample = new SecurityhubInsight(
+      this,
+      "example_1",
+      {
+        dependsOn: [example],
+        filters: {
+          awsAccountId: [
+            {
+              comparison: "EQUALS",
+              value: "1234567890",
+            },
+            {
+              comparison: "EQUALS",
+              value: "09876543210",
+            },
+          ],
+        },
+        groupByAttribute: "AwsAccountId",
+        name: "example-insight",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSecurityhubInsightExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### Filter by date range
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SecurityhubAccount } from "./.gen/providers/aws/securityhub-account";
+import { SecurityhubInsight } from "./.gen/providers/aws/securityhub-insight";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new SecurityhubAccount(this, "example", {});
+    const awsSecurityhubInsightExample = new SecurityhubInsight(
+      this,
+      "example_1",
+      {
+        dependsOn: [example],
+        filters: {
+          createdAt: [
+            {
+              dateRange: {
+                unit: "DAYS",
+                value: 5,
+              },
+            },
+          ],
+        },
+        groupByAttribute: "CreatedAt",
+        name: "example-insight",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSecurityhubInsightExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### Filter by destination IPv4 address
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SecurityhubAccount } from "./.gen/providers/aws/securityhub-account";
+import { SecurityhubInsight } from "./.gen/providers/aws/securityhub-insight";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new SecurityhubAccount(this, "example", {});
+    const awsSecurityhubInsightExample = new SecurityhubInsight(
+      this,
+      "example_1",
+      {
+        dependsOn: [example],
+        filters: {
+          networkDestinationIpv4: [
+            {
+              cidr: "10.0.0.0/16",
+            },
+          ],
+        },
+        groupByAttribute: "NetworkDestinationIpV4",
+        name: "example-insight",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSecurityhubInsightExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### Filter by finding's confidence
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SecurityhubAccount } from "./.gen/providers/aws/securityhub-account";
+import { SecurityhubInsight } from "./.gen/providers/aws/securityhub-insight";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new SecurityhubAccount(this, "example", {});
+    const awsSecurityhubInsightExample = new SecurityhubInsight(
+      this,
+      "example_1",
+      {
+        dependsOn: [example],
+        filters: {
+          confidence: [
+            {
+              gte: "80",
+            },
+          ],
+        },
+        groupByAttribute: "Confidence",
+        name: "example-insight",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSecurityhubInsightExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### Filter by resource tags
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SecurityhubAccount } from "./.gen/providers/aws/securityhub-account";
+import { SecurityhubInsight } from "./.gen/providers/aws/securityhub-insight";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new SecurityhubAccount(this, "example", {});
+    const awsSecurityhubInsightExample = new SecurityhubInsight(
+      this,
+      "example_1",
+      {
+        dependsOn: [example],
+        filters: {
+          resourceTags: [
+            {
+              comparison: "EQUALS",
+              key: "Environment",
+              value: "Production",
+            },
+          ],
+        },
+        groupByAttribute: "ResourceTags",
+        name: "example-insight",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSecurityhubInsightExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `filters` - (Required) A configuration block including one or more (up to 10 distinct) attributes used to filter the findings included in the insight. The insight only includes findings that match criteria defined in the filters. See [filters](#filters) below for more details.
+* `groupByAttribute` - (Required) The attribute used to group the findings for the insight e.g., if an insight is grouped by `resourceId`, then the insight produces a list of resource identifiers.
+* `name` - (Required) The name of the custom insight.
+
+### filters
+
+The `filters` configuration block supports the following arguments:
+
+~> **NOTE:** For each argument below, up to 20 can be provided.
+
+* `awsAccountId` - (Optional) AWS account ID that a finding is generated in. See [String_Filter](#string-filter-argument-reference) below for more details.
+* `companyName` - (Optional) The name of the findings provider (company) that owns the solution (product) that generates findings. See [String_Filter](#string-filter-argument-reference) below for more details.
+* `complianceStatus` - (Optional) Exclusive to findings that are generated as the result of a check run against a specific rule in a supported standard, such as CIS AWS Foundations. Contains security standard-related finding details. See [String Filter](#string-filter-argument-reference) below for more details.
+* `confidence` - (Optional) A finding's confidence. Confidence is defined as the likelihood that a finding accurately identifies the behavior or issue that it was intended to identify. Confidence is scored on a 0-100 basis using a ratio scale, where 0 means zero percent confidence and 100 means 100 percent confidence. See [Number Filter](#number-filter-argument-reference) below for more details.
+* `createdAt` - (Optional) An ISO8601-formatted timestamp that indicates when the security-findings provider captured the potential security issue that a finding captured. See [Date Filter](#date-filter-argument-reference) below for more details.
+* `criticality` - (Optional) The level of importance assigned to the resources associated with the finding. A score of 0 means that the underlying resources have no criticality, and a score of 100 is reserved for the most critical resources. See [Number Filter](#number-filter-argument-reference) below for more details.
+* `description` - (Optional) A finding's description. See [String Filter](#string-filter-argument-reference) below for more details.
+* `findingProviderFieldsConfidence` - (Optional) The finding provider value for the finding confidence. Confidence is defined as the likelihood that a finding accurately identifies the behavior or issue that it was intended to identify. Confidence is scored on a 0-100 basis using a ratio scale, where 0 means zero percent confidence and 100 means 100 percent confidence. See [Number Filter](#number-filter-argument-reference) below for more details.
+* `findingProviderFieldsCriticality` - (Optional) The finding provider value for the level of importance assigned to the resources associated with the findings. A score of 0 means that the underlying resources have no criticality, and a score of 100 is reserved for the most critical resources. See [Number Filter](#number-filter-argument-reference) below for more details.
+* `findingProviderFieldsRelatedFindingsId` - (Optional) The finding identifier of a related finding that is identified by the finding provider. See [String Filter](#string-filter-argument-reference) below for more details.
+* `findingProviderFieldsRelatedFindingsProductArn` - (Optional) The ARN of the solution that generated a related finding that is identified by the finding provider. See [String Filter](#string-filter-argument-reference) below for more details.
+* `findingProviderFieldsSeverityLabel` - (Optional) The finding provider value for the severity label. See [String Filter](#string-filter-argument-reference) below for more details.
+* `findingProviderFieldsSeverityOriginal` - (Optional) The finding provider's original value for the severity. See [String Filter](#string-filter-argument-reference) below for more details.
+* `findingProviderFieldsTypes` - (Optional) One or more finding types that the finding provider assigned to the finding. Uses the format of `namespace/category/classifier` that classify a finding. Valid namespace values include: `Software and Configuration Checks`, `ttPs`, `effects`, `Unusual Behaviors`, and `Sensitive Data Identifications`. See [String Filter](#string-filter-argument-reference) below for more details.
+* `firstObservedAt` - (Optional) An ISO8601-formatted timestamp that indicates when the security-findings provider first observed the potential security issue that a finding captured. See [Date Filter](#date-filter-argument-reference) below for more details.
+* `generatorId` - (Optional) The identifier for the solution-specific component (a discrete unit of logic) that generated a finding. See [String Filter](#string-filter-argument-reference) below for more details.
+* `id` - (Optional) The security findings provider-specific identifier for a finding. See [String Filter](#string-filter-argument-reference) below for more details.
+* `keyword` - (Optional) A keyword for a finding. See [Keyword Filter](#keyword-filter-argument-reference) below for more details.
+* `lastObservedAt` - (Optional) An ISO8601-formatted timestamp that indicates when the security-findings provider most recently observed the potential security issue that a finding captured. See [Date Filter](#date-filter-argument-reference) below for more details.
+* `malwareName` - (Optional) The name of the malware that was observed. See [String Filter](#string-filter-argument-reference) below for more details.
+* `malwarePath` - (Optional) The filesystem path of the malware that was observed. See [String Filter](#string-filter-argument-reference) below for more details.
+* `malwareState` - (Optional) The state of the malware that was observed. See [String Filter](#string-filter-argument-reference) below for more details.
+* `malwareType` - (Optional) The type of the malware that was observed. See [String Filter](#string-filter-argument-reference) below for more details.
+* `networkDestinationDomain` - (Optional) The destination domain of network-related information about a finding. See [String Filter](#string-filter-argument-reference) below for more details.
+* `networkDestinationIpv4` - (Optional) The destination IPv4 address of network-related information about a finding. See [Ip Filter](#ip-filter-argument-reference) below for more details.
+* `networkDestinationIpv6` - (Optional) The destination IPv6 address of network-related information about a finding. See [Ip Filter](#ip-filter-argument-reference) below for more details.
+* `networkDestinationPort` - (Optional) The destination port of network-related information about a finding. See [Number Filter](#number-filter-argument-reference) below for more details.
+* `networkDirection` - (Optional) Indicates the direction of network traffic associated with a finding. See [String Filter](#string-filter-argument-reference) below for more details.
+* `networkProtocol` - (Optional) The protocol of network-related information about a finding. See [String Filter](#string-filter-argument-reference) below for more details.
+* `networkSourceDomain` - (Optional) The source domain of network-related information about a finding. See [String Filter](#string-filter-argument-reference) below for more details.
+* `networkSourceIpv4` - (Optional) The source IPv4 address of network-related information about a finding. See [Ip Filter](#ip-filter-argument-reference) below for more details.
+* `networkSourceIpv6` - (Optional) The source IPv6 address of network-related information about a finding. See [Ip Filter](#ip-filter-argument-reference) below for more details.
+* `networkSourceMac` - (Optional) The source media access control (MAC) address of network-related information about a finding. See [String Filter](#string-filter-argument-reference) below for more details.
+* `networkSourcePort` - (Optional) The source port of network-related information about a finding. See [Number Filter](#number-filter-argument-reference) below for more details.
+* `noteText` - (Optional) The text of a note. See [String Filter](#string-filter-argument-reference) below for more details.
+* `noteUpdatedAt` - (Optional) The timestamp of when the note was updated. See [Date Filter](#date-filter-argument-reference) below for more details.
+* `noteUpdatedBy` - (Optional) The principal that created a note. See [String Filter](#string-filter-argument-reference) below for more details.
+* `processLaunchedAt` - (Optional) The date/time that the process was launched. See [Date Filter](#date-filter-argument-reference) below for more details.
+* `processName` - (Optional) The name of the process. See [String Filter](#string-filter-argument-reference) below for more details.
+* `processParentPid` - (Optional) The parent process ID. See [Number Filter](#number-filter-argument-reference) below for more details.
+* `processPath` - (Optional) The path to the process executable. See [String Filter](#string-filter-argument-reference) below for more details.
+* `processPid` - (Optional) The process ID. See [Number Filter](#number-filter-argument-reference) below for more details.
+* `processTerminatedAt` - (Optional) The date/time that the process was terminated. See [Date Filter](#date-filter-argument-reference) below for more details.
+* `productArn` - (Optional) The ARN generated by Security Hub that uniquely identifies a third-party company (security findings provider) after this provider's product (solution that generates findings) is registered with Security Hub. See [String Filter](#string-filter-argument-reference) below for more details.
+* `productFields` - (Optional) A data type where security-findings providers can include additional solution-specific details that aren't part of the defined `awsSecurityFinding` format. See [Map Filter](#map-filter-argument-reference) below for more details.
+* `productName` - (Optional) The name of the solution (product) that generates findings. See [String Filter](#string-filter-argument-reference) below for more details.
+* `recommendationText` - (Optional) The recommendation of what to do about the issue described in a finding. See [String Filter](#string-filter-argument-reference) below for more details.
+* `recordState` - (Optional) The updated record state for the finding. See [String Filter](#string-filter-argument-reference) below for more details.
+* `relatedFindingsId` - (Optional) The solution-generated identifier for a related finding. See [String Filter](#string-filter-argument-reference) below for more details.
+* `relatedFindingsProductArn` - (Optional) The ARN of the solution that generated a related finding. See [String Filter](#string-filter-argument-reference) below for more details.
+* `resourceAwsEc2InstanceIamInstanceProfileArn` - (Optional) The IAM profile ARN of the instance. See [String Filter](#string-filter-argument-reference) below for more details.
+* `resourceAwsEc2InstanceImageId` - (Optional) The Amazon Machine Image (AMI) ID of the instance. See [String Filter](#string-filter-argument-reference) below for more details.
+* `resourceAwsEc2InstanceIpv4Addresses` - (Optional) The IPv4 addresses associated with the instance. See [Ip Filter](#ip-filter-argument-reference) below for more details.
+* `resourceAwsEc2InstanceIpv6Addresses` - (Optional) The IPv6 addresses associated with the instance. See [Ip Filter](#ip-filter-argument-reference) below for more details.
+* `resourceAwsEc2InstanceKeyName` - (Optional) The key name associated with the instance. See [String Filter](#string-filter-argument-reference) below for more details.
+* `resourceAwsEc2InstanceLaunchedAt` - (Optional) The date and time the instance was launched. See [Date Filter](#date-filter-argument-reference) below for more details.
+* `resourceAwsEc2InstanceSubnetId` - (Optional) The identifier of the subnet that the instance was launched in. See [String Filter](#string-filter-argument-reference) below for more details.
+* `resourceAwsEc2InstanceType` - (Optional) The instance type of the instance. See [String Filter](#string-filter-argument-reference) below for more details.
+* `resourceAwsEc2InstanceVpcId` - (Optional) The identifier of the VPC that the instance was launched in. See [String Filter](#string-filter-argument-reference) below for more details.
+* `resourceAwsIamAccessKeyCreatedAt` - (Optional) The creation date/time of the IAM access key related to a finding. See [Date Filter](#date-filter-argument-reference) below for more details.
+* `resourceAwsIamAccessKeyStatus` - (Optional) The status of the IAM access key related to a finding. See [String Filter](#string-filter-argument-reference) below for more details.
+* `resourceAwsIamAccessKeyUserName` - (Optional) The user associated with the IAM access key related to a finding. See [String Filter](#string-filter-argument-reference) below for more details.
+* `resourceAwsS3BucketOwnerId` - (Optional) The canonical user ID of the owner of the S3 bucket. See [String Filter](#string-filter-argument-reference) below for more details.
+* `resourceAwsS3BucketOwnerName` - (Optional) The display name of the owner of the S3 bucket. See [String Filter](#string-filter-argument-reference) below for more details.
+* `resourceContainerImageId` - (Optional) The identifier of the image related to a finding. See [String Filter](#string-filter-argument-reference) below for more details.
+* `resourceContainerImageName` - (Optional) The name of the image related to a finding. See [String Filter](#string-filter-argument-reference) below for more details.
+* `resourceContainerLaunchedAt` - (Optional) The date/time that the container was started. See [Date Filter](#date-filter-argument-reference) below for more details.
+* `resourceContainerName` - (Optional) The name of the container related to a finding. See [String Filter](#string-filter-argument-reference) below for more details.
+* `resourceDetailsOther` - (Optional) The details of a resource that doesn't have a specific subfield for the resource type defined. See [Map Filter](#map-filter-argument-reference) below for more details.
+* `resourceId` - (Optional) The canonical identifier for the given resource type. See [String Filter](#string-filter-argument-reference) below for more details.
+* `resourcePartition` - (Optional) The canonical AWS partition name that the Region is assigned to. See [String Filter](#string-filter-argument-reference) below for more details.
+* `resourceRegion` - (Optional) The canonical AWS external Region name where this resource is located. See [String Filter](#string-filter-argument-reference) below for more details.
+* `resourceTags` - (Optional) A list of AWS tags associated with a resource at the time the finding was processed. See [Map Filter](#map-filter-argument-reference) below for more details.
+* `resourceType` - (Optional) Specifies the type of the resource that details are provided for. See [String Filter](#string-filter-argument-reference) below for more details.
+* `severityLabel` - (Optional) The label of a finding's severity. See [String Filter](#string-filter-argument-reference) below for more details.
+* `sourceUrl` - (Optional) A URL that links to a page about the current finding in the security-findings provider's solution. See [String Filter](#string-filter-argument-reference) below for more details.
+* `threatIntelIndicatorCategory` - (Optional) The category of a threat intelligence indicator. See [String Filter](#string-filter-argument-reference) below for more details.
+* `threatIntelIndicatorLastObservedAt` - (Optional) The date/time of the last observation of a threat intelligence indicator. See [Date Filter](#date-filter-argument-reference) below for more details.
+* `threatIntelIndicatorSource` - (Optional) The source of the threat intelligence. See [String Filter](#string-filter-argument-reference) below for more details.
+* `threatIntelIndicatorSourceUrl` - (Optional) The URL for more details from the source of the threat intelligence. See [String Filter](#string-filter-argument-reference) below for more details.
+* `threatIntelIndicatorType` - (Optional) The type of a threat intelligence indicator. See [String Filter](#string-filter-argument-reference) below for more details.
+* `threatIntelIndicatorValue` - (Optional) The value of a threat intelligence indicator. See [String Filter](#string-filter-argument-reference) below for more details.
+* `title` - (Optional) A finding's title. See [String Filter](#string-filter-argument-reference) below for more details.
+* `type` - (Optional) A finding type in the format of `namespace/category/classifier` that classifies a finding. See [String Filter](#string-filter-argument-reference) below for more details.
+* `updatedAt` - (Optional) An ISO8601-formatted timestamp that indicates when the security-findings provider last updated the finding record. See [Date Filter](#date-filter-argument-reference) below for more details.
+* `userDefinedValues` - (Optional) A list of name/value string pairs associated with the finding. These are custom, user-defined fields added to a finding. See [Map Filter](#map-filter-argument-reference) below for more details.
+* `verificationState` - (Optional) The veracity of a finding. See [String Filter](#string-filter-argument-reference) below for more details.
+* `workflowStatus` - (Optional) The status of the investigation into a finding. See [Workflow Status Filter](#workflow-status-filter-argument-reference) below for more details.
+
+### Date Filter Argument reference
+
+The date filter configuration block supports the following arguments:
+
+* `dateRange` - (Optional) A configuration block of the date range for the date filter. See [date_range](#date_range-argument-reference) below for more details.
+* `end` - (Optional) An end date for the date filter. Required with `start` if `dateRange` is not specified.
+* `start` - (Optional) A start date for the date filter. Required with `end` if `dateRange` is not specified.
+
+### date_range Argument reference
+
+The `dateRange` configuration block supports the following arguments:
+
+* `unit` - (Required) A date range unit for the date filter. Valid values: `days`.
+* `value` - (Required) A date range value for the date filter, provided as an Integer.
+
+### Ip Filter Argument Reference
+
+The Ip filter configuration block supports the following arguments:
+
+* `cidr` - (Required) A finding's CIDR value.
+
+### Keyword Filter Argument Reference
+
+The keyword filter configuration block supports the following arguments:
+
+* `value` - (Required) A value for the keyword.
+
+### Map Filter Argument reference
+
+The map filter configuration block supports the following arguments:
+
+* `comparison` - (Required) The condition to apply to a string value when querying for findings. Valid values include: `equals` and `notEquals`.
+* `key` - (Required) The key of the map filter. For example, for `resourceTags`, `key` identifies the name of the tag. For `userDefinedFields`, `key` is the name of the field.
+* `value` - (Required) The value for the key in the map filter. Filter values are case sensitive. For example, one of the values for a tag called `department` might be `security`. If you provide `security` as the filter value, then there is no match.
+
+### Number Filter Argument reference
+
+The number filter configuration block supports the following arguments:
+
+~> **NOTE:** Only one of `eg`, `gte`, or `lte` must be specified.
+
+* `eq` - (Optional) The equal-to condition to be applied to a single field when querying for findings, provided as a String.
+* `gte` - (Optional) The greater-than-equal condition to be applied to a single field when querying for findings, provided as a String.
+* `lte` - (Optional) The less-than-equal condition to be applied to a single field when querying for findings, provided as a String.
+
+### String Filter Argument reference
+
+The string filter configuration block supports the following arguments:
+
+* `comparison` - (Required) The condition to apply to a string value when querying for findings. Valid values include: `equals`, `prefix`, `notEquals`, `prefixNotEquals`.
+* `value` - (Required) The string filter value. Filter values are case sensitive.
+
+### Workflow Status Filter Argument reference
+
+The workflow status filter configuration block supports the following arguments:
+
+* `comparison` - (Required) The condition to apply to a string value when querying for findings. Valid values include: `equals`, `prefix`, `notEquals`, `prefixNotEquals`.
+* `value` - (Required) The string filter value. Valid values include: `new`, `notified`, `suppressed`, and `resolved`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - ARN of the insight.
+* `arn` - ARN of the insight.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Security Hub insights using the ARN. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Security Hub insights using the ARN. For example:
+
+```console
+% terraform import aws_securityhub_insight.example arn:aws:securityhub:us-west-2:1234567890:insight/1234567890/custom/91299ed7-abd0-4e44-a858-d0b15e37141a
+```
+
+<!-- cache-key: cdktf-0.18.0 input-d3d847819c495e43242ec5ec238846c5d4424861a5d61bc30612afcfd23a2887 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/securityhub_invite_accepter.html.markdown b/website/docs/cdktf/typescript/r/securityhub_invite_accepter.html.markdown
new file mode 100644
index 00000000000..5025c9e9d44
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/securityhub_invite_accepter.html.markdown
@@ -0,0 +1,98 @@
+---
+subcategory: "Security Hub"
+layout: "aws"
+page_title: "AWS: aws_securityhub_invite_accepter"
+description: |-
+  Accepts a Security Hub invitation.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_securityhub_invite_accepter
+
+-> **Note:** AWS accounts can only be associated with a single Security Hub master account. Destroying this resource will disassociate the member account from the master account.
+
+Accepts a Security Hub invitation.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SecurityhubAccount } from "./.gen/providers/aws/securityhub-account";
+import { SecurityhubInviteAccepter } from "./.gen/providers/aws/securityhub-invite-accepter";
+import { SecurityhubMember } from "./.gen/providers/aws/securityhub-member";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SecurityhubAccount(this, "example", {});
+    const invitee = new SecurityhubAccount(this, "invitee", {
+      provider: "aws.invitee",
+    });
+    const awsSecurityhubMemberExample = new SecurityhubMember(
+      this,
+      "example_2",
+      {
+        accountId: "123456789012",
+        email: "example@example.com",
+        invite: true,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSecurityhubMemberExample.overrideLogicalId("example");
+    const awsSecurityhubInviteAccepterInvitee = new SecurityhubInviteAccepter(
+      this,
+      "invitee_3",
+      {
+        dependsOn: [invitee],
+        masterId: Token.asString(awsSecurityhubMemberExample.masterId),
+        provider: "aws.invitee",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSecurityhubInviteAccepterInvitee.overrideLogicalId("invitee");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `masterId` - (Required) The account ID of the master Security Hub account whose invitation you're accepting.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `invitationId` - The ID of the invitation.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Security Hub invite acceptance using the account ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Security Hub invite acceptance using the account ID. For example:
+
+```console
+% terraform import aws_securityhub_invite_accepter.example 123456789012
+```
+
+<!-- cache-key: cdktf-0.18.0 input-47799ffb1b46661d89c8c190f8ee1ae51146d3c40022d01eb9ce32bcbbe707ae -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/securityhub_invite_accepter.markdown b/website/docs/cdktf/typescript/r/securityhub_invite_accepter.markdown
new file mode 100644
index 00000000000..5025c9e9d44
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/securityhub_invite_accepter.markdown
@@ -0,0 +1,98 @@
+---
+subcategory: "Security Hub"
+layout: "aws"
+page_title: "AWS: aws_securityhub_invite_accepter"
+description: |-
+  Accepts a Security Hub invitation.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_securityhub_invite_accepter
+
+-> **Note:** AWS accounts can only be associated with a single Security Hub master account. Destroying this resource will disassociate the member account from the master account.
+
+Accepts a Security Hub invitation.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SecurityhubAccount } from "./.gen/providers/aws/securityhub-account";
+import { SecurityhubInviteAccepter } from "./.gen/providers/aws/securityhub-invite-accepter";
+import { SecurityhubMember } from "./.gen/providers/aws/securityhub-member";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SecurityhubAccount(this, "example", {});
+    const invitee = new SecurityhubAccount(this, "invitee", {
+      provider: "aws.invitee",
+    });
+    const awsSecurityhubMemberExample = new SecurityhubMember(
+      this,
+      "example_2",
+      {
+        accountId: "123456789012",
+        email: "example@example.com",
+        invite: true,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSecurityhubMemberExample.overrideLogicalId("example");
+    const awsSecurityhubInviteAccepterInvitee = new SecurityhubInviteAccepter(
+      this,
+      "invitee_3",
+      {
+        dependsOn: [invitee],
+        masterId: Token.asString(awsSecurityhubMemberExample.masterId),
+        provider: "aws.invitee",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSecurityhubInviteAccepterInvitee.overrideLogicalId("invitee");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `masterId` - (Required) The account ID of the master Security Hub account whose invitation you're accepting.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `invitationId` - The ID of the invitation.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Security Hub invite acceptance using the account ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Security Hub invite acceptance using the account ID. For example:
+
+```console
+% terraform import aws_securityhub_invite_accepter.example 123456789012
+```
+
+<!-- cache-key: cdktf-0.18.0 input-47799ffb1b46661d89c8c190f8ee1ae51146d3c40022d01eb9ce32bcbbe707ae -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/securityhub_member.html.markdown b/website/docs/cdktf/typescript/r/securityhub_member.html.markdown
new file mode 100644
index 00000000000..3247939619f
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/securityhub_member.html.markdown
@@ -0,0 +1,86 @@
+---
+subcategory: "Security Hub"
+layout: "aws"
+page_title: "AWS: aws_securityhub_member"
+description: |-
+  Provides a Security Hub member resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_securityhub_member
+
+Provides a Security Hub member resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SecurityhubAccount } from "./.gen/providers/aws/securityhub-account";
+import { SecurityhubMember } from "./.gen/providers/aws/securityhub-member";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new SecurityhubAccount(this, "example", {});
+    const awsSecurityhubMemberExample = new SecurityhubMember(
+      this,
+      "example_1",
+      {
+        accountId: "123456789012",
+        dependsOn: [example],
+        email: "example@example.com",
+        invite: true,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSecurityhubMemberExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `accountId` - (Required) The ID of the member AWS account.
+* `email` - (Optional) The email of the member AWS account.
+* `invite` - (Optional) Boolean whether to invite the account to Security Hub as a member. Defaults to `false`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the member AWS account (matches `accountId`).
+* `masterId` - The ID of the master Security Hub AWS account.
+* `memberStatus` - The status of the member account relationship.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Security Hub members using their account ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Security Hub members using their account ID. For example:
+
+```console
+% terraform import aws_securityhub_member.example 123456789012
+```
+
+<!-- cache-key: cdktf-0.18.0 input-b2f811f0ff3e2bff9fde29d7ad1d4c2d9fa7578b2c00bebd2e51ff8635a9fa1c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/securityhub_member.markdown b/website/docs/cdktf/typescript/r/securityhub_member.markdown
new file mode 100644
index 00000000000..3247939619f
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/securityhub_member.markdown
@@ -0,0 +1,86 @@
+---
+subcategory: "Security Hub"
+layout: "aws"
+page_title: "AWS: aws_securityhub_member"
+description: |-
+  Provides a Security Hub member resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_securityhub_member
+
+Provides a Security Hub member resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SecurityhubAccount } from "./.gen/providers/aws/securityhub-account";
+import { SecurityhubMember } from "./.gen/providers/aws/securityhub-member";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new SecurityhubAccount(this, "example", {});
+    const awsSecurityhubMemberExample = new SecurityhubMember(
+      this,
+      "example_1",
+      {
+        accountId: "123456789012",
+        dependsOn: [example],
+        email: "example@example.com",
+        invite: true,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSecurityhubMemberExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `accountId` - (Required) The ID of the member AWS account.
+* `email` - (Optional) The email of the member AWS account.
+* `invite` - (Optional) Boolean whether to invite the account to Security Hub as a member. Defaults to `false`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the member AWS account (matches `accountId`).
+* `masterId` - The ID of the master Security Hub AWS account.
+* `memberStatus` - The status of the member account relationship.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Security Hub members using their account ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Security Hub members using their account ID. For example:
+
+```console
+% terraform import aws_securityhub_member.example 123456789012
+```
+
+<!-- cache-key: cdktf-0.18.0 input-b2f811f0ff3e2bff9fde29d7ad1d4c2d9fa7578b2c00bebd2e51ff8635a9fa1c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/securityhub_organization_admin_account.html.markdown b/website/docs/cdktf/typescript/r/securityhub_organization_admin_account.html.markdown
new file mode 100644
index 00000000000..e6ffb275c8b
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/securityhub_organization_admin_account.html.markdown
@@ -0,0 +1,95 @@
+---
+subcategory: "Security Hub"
+layout: "aws"
+page_title: "AWS: aws_securityhub_organization_admin_account"
+description: |-
+  Manages a Security Hub administrator account for an organization.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_securityhub_organization_admin_account
+
+Manages a Security Hub administrator account for an organization. The AWS account utilizing this resource must be an Organizations primary account. More information about Organizations support in Security Hub can be found in the [Security Hub User Guide](https://docs.aws.amazon.com/securityhub/latest/userguide/designate-orgs-admin-account.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { OrganizationsOrganization } from "./.gen/providers/aws/organizations-organization";
+import { SecurityhubAccount } from "./.gen/providers/aws/securityhub-account";
+import { SecurityhubOrganizationAdminAccount } from "./.gen/providers/aws/securityhub-organization-admin-account";
+import { SecurityhubOrganizationConfiguration } from "./.gen/providers/aws/securityhub-organization-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new OrganizationsOrganization(this, "example", {
+      awsServiceAccessPrincipals: ["securityhub.amazonaws.com"],
+      featureSet: "ALL",
+    });
+    const awsSecurityhubAccountExample = new SecurityhubAccount(
+      this,
+      "example_1",
+      {}
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSecurityhubAccountExample.overrideLogicalId("example");
+    const awsSecurityhubOrganizationAdminAccountExample =
+      new SecurityhubOrganizationAdminAccount(this, "example_2", {
+        adminAccountId: "123456789012",
+        dependsOn: [example],
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSecurityhubOrganizationAdminAccountExample.overrideLogicalId("example");
+    const awsSecurityhubOrganizationConfigurationExample =
+      new SecurityhubOrganizationConfiguration(this, "example_3", {
+        autoEnable: true,
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSecurityhubOrganizationConfigurationExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `adminAccountId` - (Required) The AWS account identifier of the account to designate as the Security Hub administrator account.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - AWS account identifier.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Security Hub Organization Admin Accounts using the AWS account ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Security Hub Organization Admin Accounts using the AWS account ID. For example:
+
+```console
+% terraform import aws_securityhub_organization_admin_account.example 123456789012
+```
+
+<!-- cache-key: cdktf-0.18.0 input-83f23d6f1c3f73f98991d420d396e1f7a78ea374e63126ce3c3d410cf5917cbd -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/securityhub_organization_configuration.html.markdown b/website/docs/cdktf/typescript/r/securityhub_organization_configuration.html.markdown
new file mode 100644
index 00000000000..9cb692a0501
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/securityhub_organization_configuration.html.markdown
@@ -0,0 +1,92 @@
+---
+subcategory: "Security Hub"
+layout: "aws"
+page_title: "AWS: aws_securityhub_organization_configuration"
+description: |-
+  Manages the Security Hub Organization Configuration
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_securityhub_organization_configuration
+
+Manages the Security Hub Organization Configuration.
+
+~> **NOTE:** This resource requires an [`awsSecurityhubOrganizationAdminAccount`](/docs/providers/aws/r/securityhub_organization_admin_account.html) to be configured (not necessarily with Terraform). More information about managing Security Hub in an organization can be found in the [Managing administrator and member accounts](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-accounts.html) documentation
+
+~> **NOTE:** This is an advanced Terraform resource. Terraform will automatically assume management of the Security Hub Organization Configuration without import and perform no actions on removal from the Terraform configuration.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { OrganizationsOrganization } from "./.gen/providers/aws/organizations-organization";
+import { SecurityhubOrganizationAdminAccount } from "./.gen/providers/aws/securityhub-organization-admin-account";
+import { SecurityhubOrganizationConfiguration } from "./.gen/providers/aws/securityhub-organization-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new OrganizationsOrganization(this, "example", {
+      awsServiceAccessPrincipals: ["securityhub.amazonaws.com"],
+      featureSet: "ALL",
+    });
+    const awsSecurityhubOrganizationAdminAccountExample =
+      new SecurityhubOrganizationAdminAccount(this, "example_1", {
+        adminAccountId: "123456789012",
+        dependsOn: [example],
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSecurityhubOrganizationAdminAccountExample.overrideLogicalId("example");
+    const awsSecurityhubOrganizationConfigurationExample =
+      new SecurityhubOrganizationConfiguration(this, "example_2", {
+        autoEnable: true,
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSecurityhubOrganizationConfigurationExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `autoEnable` - (Required) Whether to automatically enable Security Hub for new accounts in the organization.
+* `autoEnableStandards` - (Optional) Whether to automatically enable Security Hub default standards for new member accounts in the organization. By default, this parameter is equal to `default`, and new member accounts are automatically enabled with default Security Hub standards. To opt out of enabling default standards for new member accounts, set this parameter equal to `none`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - AWS Account ID.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import an existing Security Hub enabled account using the AWS account ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import an existing Security Hub enabled account using the AWS account ID. For example:
+
+```console
+% terraform import aws_securityhub_organization_configuration.example 123456789012
+```
+
+<!-- cache-key: cdktf-0.18.0 input-5b0a80355870042433f0256e95b1b1ca23a8a89ac8d72a202dca64a9bd9f9132 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/securityhub_organization_configuration.markdown b/website/docs/cdktf/typescript/r/securityhub_organization_configuration.markdown
new file mode 100644
index 00000000000..9cb692a0501
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/securityhub_organization_configuration.markdown
@@ -0,0 +1,92 @@
+---
+subcategory: "Security Hub"
+layout: "aws"
+page_title: "AWS: aws_securityhub_organization_configuration"
+description: |-
+  Manages the Security Hub Organization Configuration
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_securityhub_organization_configuration
+
+Manages the Security Hub Organization Configuration.
+
+~> **NOTE:** This resource requires an [`awsSecurityhubOrganizationAdminAccount`](/docs/providers/aws/r/securityhub_organization_admin_account.html) to be configured (not necessarily with Terraform). More information about managing Security Hub in an organization can be found in the [Managing administrator and member accounts](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-accounts.html) documentation
+
+~> **NOTE:** This is an advanced Terraform resource. Terraform will automatically assume management of the Security Hub Organization Configuration without import and perform no actions on removal from the Terraform configuration.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { OrganizationsOrganization } from "./.gen/providers/aws/organizations-organization";
+import { SecurityhubOrganizationAdminAccount } from "./.gen/providers/aws/securityhub-organization-admin-account";
+import { SecurityhubOrganizationConfiguration } from "./.gen/providers/aws/securityhub-organization-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new OrganizationsOrganization(this, "example", {
+      awsServiceAccessPrincipals: ["securityhub.amazonaws.com"],
+      featureSet: "ALL",
+    });
+    const awsSecurityhubOrganizationAdminAccountExample =
+      new SecurityhubOrganizationAdminAccount(this, "example_1", {
+        adminAccountId: "123456789012",
+        dependsOn: [example],
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSecurityhubOrganizationAdminAccountExample.overrideLogicalId("example");
+    const awsSecurityhubOrganizationConfigurationExample =
+      new SecurityhubOrganizationConfiguration(this, "example_2", {
+        autoEnable: true,
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSecurityhubOrganizationConfigurationExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `autoEnable` - (Required) Whether to automatically enable Security Hub for new accounts in the organization.
+* `autoEnableStandards` - (Optional) Whether to automatically enable Security Hub default standards for new member accounts in the organization. By default, this parameter is equal to `default`, and new member accounts are automatically enabled with default Security Hub standards. To opt out of enabling default standards for new member accounts, set this parameter equal to `none`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - AWS Account ID.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import an existing Security Hub enabled account using the AWS account ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import an existing Security Hub enabled account using the AWS account ID. For example:
+
+```console
+% terraform import aws_securityhub_organization_configuration.example 123456789012
+```
+
+<!-- cache-key: cdktf-0.18.0 input-5b0a80355870042433f0256e95b1b1ca23a8a89ac8d72a202dca64a9bd9f9132 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/securityhub_product_subscription.html.markdown b/website/docs/cdktf/typescript/r/securityhub_product_subscription.html.markdown
new file mode 100644
index 00000000000..3da8fb58eea
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/securityhub_product_subscription.html.markdown
@@ -0,0 +1,120 @@
+---
+subcategory: "Security Hub"
+layout: "aws"
+page_title: "AWS: aws_securityhub_product_subscription"
+description: |-
+  Subscribes to a Security Hub product.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_securityhub_product_subscription
+
+Subscribes to a Security Hub product.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsRegion } from "./.gen/providers/aws/data-aws-region";
+import { SecurityhubAccount } from "./.gen/providers/aws/securityhub-account";
+import { SecurityhubProductSubscription } from "./.gen/providers/aws/securityhub-product-subscription";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new SecurityhubAccount(this, "example", {});
+    const current = new DataAwsRegion(this, "current", {});
+    const awsSecurityhubProductSubscriptionExample =
+      new SecurityhubProductSubscription(this, "example_2", {
+        dependsOn: [example],
+        productArn:
+          "arn:aws:securityhub:${" +
+          current.name +
+          "}:733251395267:product/alertlogic/althreatmanagement",
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSecurityhubProductSubscriptionExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `productArn` - (Required) The ARN of the product that generates findings that you want to import into Security Hub - see below.
+
+Amazon maintains a list of [Product integrations in AWS Security Hub](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-findings-providers.html) that changes over time. Any of the products on the linked [Available AWS service integrations](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-internal-providers.html) or [Available third-party partner product integrations](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-partner-providers.html) can be configured using `awsSecurityhubProductSubscription`.
+
+Available products can also be listed by running the AWS CLI command `aws securityhub describe-products`.
+
+A subset of currently available products (remember to replace `${varRegion}` as appropriate) includes:
+
+* `arn:aws:securityhub:${varRegion}::product/aws/guardduty`
+* `arn:aws:securityhub:${varRegion}::product/aws/inspector`
+* `arn:aws:securityhub:${varRegion}::product/aws/macie`
+* `arn:aws:securityhub:${varRegion}::product/alertlogic/althreatmanagement`
+* `arn:aws:securityhub:${varRegion}::product/armordefense/armoranywhere`
+* `arn:aws:securityhub:${varRegion}::product/barracuda/cloudsecurityguardian`
+* `arn:aws:securityhub:${varRegion}::product/checkpoint/cloudguardIaas`
+* `arn:aws:securityhub:${varRegion}::product/checkpoint/dome9Arc`
+* `arn:aws:securityhub:${varRegion}::product/crowdstrike/crowdstrikeFalcon`
+* `arn:aws:securityhub:${varRegion}::product/cyberark/cyberarkPta`
+* `arn:aws:securityhub:${varRegion}::product/f5Networks/f5AdvancedWaf`
+* `arn:aws:securityhub:${varRegion}::product/fortinet/fortigate`
+* `arn:aws:securityhub:${varRegion}::product/guardicore/awsInfectionMonkey`
+* `arn:aws:securityhub:${varRegion}::product/guardicore/guardicore`
+* `arn:aws:securityhub:${varRegion}::product/ibm/qradarSiem`
+* `arn:aws:securityhub:${varRegion}::product/imperva/impervaAttackAnalytics`
+* `arn:aws:securityhub:${varRegion}::product/mcafeeSkyhigh/mcafeeMvisionCloudAws`
+* `arn:aws:securityhub:${varRegion}::product/paloaltonetworks/redlock`
+* `arn:aws:securityhub:${varRegion}::product/paloaltonetworks/vmSeries`
+* `arn:aws:securityhub:${varRegion}::product/qualys/qualysPc`
+* `arn:aws:securityhub:${varRegion}::product/qualys/qualysVm`
+* `arn:aws:securityhub:${varRegion}::product/rapid7/insightvm`
+* `arn:aws:securityhub:${varRegion}::product/sophos/sophosServerProtection`
+* `arn:aws:securityhub:${varRegion}::product/splunk/splunkEnterprise`
+* `arn:aws:securityhub:${varRegion}::product/splunk/splunkPhantom`
+* `arn:aws:securityhub:${varRegion}::product/sumologicinc/sumologicMda`
+* `arn:aws:securityhub:${varRegion}::product/symantecCorp/symantecCwp`
+* `arn:aws:securityhub:${varRegion}::product/tenable/tenableIo`
+* `arn:aws:securityhub:${varRegion}::product/trendMicro/deepSecurity`
+* `arn:aws:securityhub:${varRegion}::product/turbot/turbot`
+* `arn:aws:securityhub:${varRegion}::product/twistlock/twistlockEnterprise`
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of a resource that represents your subscription to the product that generates the findings that you want to import into Security Hub.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Security Hub product subscriptions using `productArn,arn`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Security Hub product subscriptions using `productArn,arn`. For example:
+
+```console
+% terraform import aws_securityhub_product_subscription.example arn:aws:securityhub:eu-west-1:733251395267:product/alertlogic/althreatmanagement,arn:aws:securityhub:eu-west-1:123456789012:product-subscription/alertlogic/althreatmanagement
+```
+
+<!-- cache-key: cdktf-0.18.0 input-e197181eaf1cbe693f21b8aefda6622e11891c6a8de2cc04fb6a75cee9693f4c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/securityhub_product_subscription.markdown b/website/docs/cdktf/typescript/r/securityhub_product_subscription.markdown
new file mode 100644
index 00000000000..3da8fb58eea
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/securityhub_product_subscription.markdown
@@ -0,0 +1,120 @@
+---
+subcategory: "Security Hub"
+layout: "aws"
+page_title: "AWS: aws_securityhub_product_subscription"
+description: |-
+  Subscribes to a Security Hub product.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_securityhub_product_subscription
+
+Subscribes to a Security Hub product.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsRegion } from "./.gen/providers/aws/data-aws-region";
+import { SecurityhubAccount } from "./.gen/providers/aws/securityhub-account";
+import { SecurityhubProductSubscription } from "./.gen/providers/aws/securityhub-product-subscription";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new SecurityhubAccount(this, "example", {});
+    const current = new DataAwsRegion(this, "current", {});
+    const awsSecurityhubProductSubscriptionExample =
+      new SecurityhubProductSubscription(this, "example_2", {
+        dependsOn: [example],
+        productArn:
+          "arn:aws:securityhub:${" +
+          current.name +
+          "}:733251395267:product/alertlogic/althreatmanagement",
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSecurityhubProductSubscriptionExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `productArn` - (Required) The ARN of the product that generates findings that you want to import into Security Hub - see below.
+
+Amazon maintains a list of [Product integrations in AWS Security Hub](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-findings-providers.html) that changes over time. Any of the products on the linked [Available AWS service integrations](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-internal-providers.html) or [Available third-party partner product integrations](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-partner-providers.html) can be configured using `awsSecurityhubProductSubscription`.
+
+Available products can also be listed by running the AWS CLI command `aws securityhub describe-products`.
+
+A subset of currently available products (remember to replace `${varRegion}` as appropriate) includes:
+
+* `arn:aws:securityhub:${varRegion}::product/aws/guardduty`
+* `arn:aws:securityhub:${varRegion}::product/aws/inspector`
+* `arn:aws:securityhub:${varRegion}::product/aws/macie`
+* `arn:aws:securityhub:${varRegion}::product/alertlogic/althreatmanagement`
+* `arn:aws:securityhub:${varRegion}::product/armordefense/armoranywhere`
+* `arn:aws:securityhub:${varRegion}::product/barracuda/cloudsecurityguardian`
+* `arn:aws:securityhub:${varRegion}::product/checkpoint/cloudguardIaas`
+* `arn:aws:securityhub:${varRegion}::product/checkpoint/dome9Arc`
+* `arn:aws:securityhub:${varRegion}::product/crowdstrike/crowdstrikeFalcon`
+* `arn:aws:securityhub:${varRegion}::product/cyberark/cyberarkPta`
+* `arn:aws:securityhub:${varRegion}::product/f5Networks/f5AdvancedWaf`
+* `arn:aws:securityhub:${varRegion}::product/fortinet/fortigate`
+* `arn:aws:securityhub:${varRegion}::product/guardicore/awsInfectionMonkey`
+* `arn:aws:securityhub:${varRegion}::product/guardicore/guardicore`
+* `arn:aws:securityhub:${varRegion}::product/ibm/qradarSiem`
+* `arn:aws:securityhub:${varRegion}::product/imperva/impervaAttackAnalytics`
+* `arn:aws:securityhub:${varRegion}::product/mcafeeSkyhigh/mcafeeMvisionCloudAws`
+* `arn:aws:securityhub:${varRegion}::product/paloaltonetworks/redlock`
+* `arn:aws:securityhub:${varRegion}::product/paloaltonetworks/vmSeries`
+* `arn:aws:securityhub:${varRegion}::product/qualys/qualysPc`
+* `arn:aws:securityhub:${varRegion}::product/qualys/qualysVm`
+* `arn:aws:securityhub:${varRegion}::product/rapid7/insightvm`
+* `arn:aws:securityhub:${varRegion}::product/sophos/sophosServerProtection`
+* `arn:aws:securityhub:${varRegion}::product/splunk/splunkEnterprise`
+* `arn:aws:securityhub:${varRegion}::product/splunk/splunkPhantom`
+* `arn:aws:securityhub:${varRegion}::product/sumologicinc/sumologicMda`
+* `arn:aws:securityhub:${varRegion}::product/symantecCorp/symantecCwp`
+* `arn:aws:securityhub:${varRegion}::product/tenable/tenableIo`
+* `arn:aws:securityhub:${varRegion}::product/trendMicro/deepSecurity`
+* `arn:aws:securityhub:${varRegion}::product/turbot/turbot`
+* `arn:aws:securityhub:${varRegion}::product/twistlock/twistlockEnterprise`
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of a resource that represents your subscription to the product that generates the findings that you want to import into Security Hub.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Security Hub product subscriptions using `productArn,arn`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Security Hub product subscriptions using `productArn,arn`. For example:
+
+```console
+% terraform import aws_securityhub_product_subscription.example arn:aws:securityhub:eu-west-1:733251395267:product/alertlogic/althreatmanagement,arn:aws:securityhub:eu-west-1:123456789012:product-subscription/alertlogic/althreatmanagement
+```
+
+<!-- cache-key: cdktf-0.18.0 input-e197181eaf1cbe693f21b8aefda6622e11891c6a8de2cc04fb6a75cee9693f4c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/securityhub_standards_control.html.markdown b/website/docs/cdktf/typescript/r/securityhub_standards_control.html.markdown
new file mode 100644
index 00000000000..ae4bb30e9aa
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/securityhub_standards_control.html.markdown
@@ -0,0 +1,82 @@
+---
+subcategory: "Security Hub"
+layout: "aws"
+page_title: "AWS: aws_securityhub_standards_control"
+description: |-
+  Enable/disable Security Hub standards controls.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_securityhub_standards_control
+
+Disable/enable Security Hub standards control in the current region.
+
+The `awsSecurityhubStandardsControl` behaves differently from normal resources, in that
+Terraform does not _create_ this resource, but instead "adopts" it
+into management. When you _delete_ this resource configuration, Terraform "abandons" resource as is and just removes it from the state.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SecurityhubAccount } from "./.gen/providers/aws/securityhub-account";
+import { SecurityhubStandardsControl } from "./.gen/providers/aws/securityhub-standards-control";
+import { SecurityhubStandardsSubscription } from "./.gen/providers/aws/securityhub-standards-subscription";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new SecurityhubAccount(this, "example", {});
+    const cisAwsFoundationsBenchmark = new SecurityhubStandardsSubscription(
+      this,
+      "cis_aws_foundations_benchmark",
+      {
+        dependsOn: [example],
+        standardsArn:
+          "arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0",
+      }
+    );
+    new SecurityhubStandardsControl(
+      this,
+      "ensure_iam_password_policy_prevents_password_reuse",
+      {
+        controlStatus: "DISABLED",
+        dependsOn: [cisAwsFoundationsBenchmark],
+        disabledReason: "We handle password policies within Okta",
+        standardsControlArn:
+          "arn:aws:securityhub:us-east-1:111111111111:control/cis-aws-foundations-benchmark/v/1.2.0/1.10",
+      }
+    );
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `standardsControlArn` - (Required) The standards control ARN. See the AWS documentation for how to list existing controls using [`getEnabledStandards`](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/securityhub/get-enabled-standards.html) and [`describeStandardsControls`](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/securityhub/describe-standards-controls.html).
+* `controlStatus` – (Required) The control status could be `enabled` or `disabled`. You have to specify `disabledReason` argument for `disabled` control status.
+* `disabledReason` – (Optional) A description of the reason why you are disabling a security standard control. If you specify this attribute, `controlStatus` will be set to `disabled` automatically.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The standard control ARN.
+* `controlId` – The identifier of the security standard control.
+* `controlStatusUpdatedAt` – The date and time that the status of the security standard control was most recently updated.
+* `description` – The standard control longer description. Provides information about what the control is checking for.
+* `relatedRequirements` – The list of requirements that are related to this control.
+* `remediationUrl` – A link to remediation information for the control in the Security Hub user documentation.
+* `severityRating` – The severity of findings generated from this security standard control.
+* `title` – The standard control title.
+
+<!-- cache-key: cdktf-0.18.0 input-4f2686dbc145e094fc564010e6dbf6ac103f5be38f045e92ccb633c43bb96b39 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/securityhub_standards_control.markdown b/website/docs/cdktf/typescript/r/securityhub_standards_control.markdown
new file mode 100644
index 00000000000..ae4bb30e9aa
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/securityhub_standards_control.markdown
@@ -0,0 +1,82 @@
+---
+subcategory: "Security Hub"
+layout: "aws"
+page_title: "AWS: aws_securityhub_standards_control"
+description: |-
+  Enable/disable Security Hub standards controls.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_securityhub_standards_control
+
+Disable/enable Security Hub standards control in the current region.
+
+The `awsSecurityhubStandardsControl` behaves differently from normal resources, in that
+Terraform does not _create_ this resource, but instead "adopts" it
+into management. When you _delete_ this resource configuration, Terraform "abandons" resource as is and just removes it from the state.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SecurityhubAccount } from "./.gen/providers/aws/securityhub-account";
+import { SecurityhubStandardsControl } from "./.gen/providers/aws/securityhub-standards-control";
+import { SecurityhubStandardsSubscription } from "./.gen/providers/aws/securityhub-standards-subscription";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new SecurityhubAccount(this, "example", {});
+    const cisAwsFoundationsBenchmark = new SecurityhubStandardsSubscription(
+      this,
+      "cis_aws_foundations_benchmark",
+      {
+        dependsOn: [example],
+        standardsArn:
+          "arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0",
+      }
+    );
+    new SecurityhubStandardsControl(
+      this,
+      "ensure_iam_password_policy_prevents_password_reuse",
+      {
+        controlStatus: "DISABLED",
+        dependsOn: [cisAwsFoundationsBenchmark],
+        disabledReason: "We handle password policies within Okta",
+        standardsControlArn:
+          "arn:aws:securityhub:us-east-1:111111111111:control/cis-aws-foundations-benchmark/v/1.2.0/1.10",
+      }
+    );
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `standardsControlArn` - (Required) The standards control ARN. See the AWS documentation for how to list existing controls using [`getEnabledStandards`](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/securityhub/get-enabled-standards.html) and [`describeStandardsControls`](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/securityhub/describe-standards-controls.html).
+* `controlStatus` – (Required) The control status could be `enabled` or `disabled`. You have to specify `disabledReason` argument for `disabled` control status.
+* `disabledReason` – (Optional) A description of the reason why you are disabling a security standard control. If you specify this attribute, `controlStatus` will be set to `disabled` automatically.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The standard control ARN.
+* `controlId` – The identifier of the security standard control.
+* `controlStatusUpdatedAt` – The date and time that the status of the security standard control was most recently updated.
+* `description` – The standard control longer description. Provides information about what the control is checking for.
+* `relatedRequirements` – The list of requirements that are related to this control.
+* `remediationUrl` – A link to remediation information for the control in the Security Hub user documentation.
+* `severityRating` – The severity of findings generated from this security standard control.
+* `title` – The standard control title.
+
+<!-- cache-key: cdktf-0.18.0 input-4f2686dbc145e094fc564010e6dbf6ac103f5be38f045e92ccb633c43bb96b39 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/securityhub_standards_subscription.html.markdown b/website/docs/cdktf/typescript/r/securityhub_standards_subscription.html.markdown
new file mode 100644
index 00000000000..7f5e16dd07b
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/securityhub_standards_subscription.html.markdown
@@ -0,0 +1,126 @@
+---
+subcategory: "Security Hub"
+layout: "aws"
+page_title: "AWS: aws_securityhub_standards_subscription"
+description: |-
+  Subscribes to a Security Hub standard.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_securityhub_standards_subscription
+
+Subscribes to a Security Hub standard.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsRegion } from "./.gen/providers/aws/data-aws-region";
+import { SecurityhubAccount } from "./.gen/providers/aws/securityhub-account";
+import { SecurityhubStandardsSubscription } from "./.gen/providers/aws/securityhub-standards-subscription";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new SecurityhubAccount(this, "example", {});
+    new SecurityhubStandardsSubscription(this, "cis", {
+      dependsOn: [example],
+      standardsArn:
+        "arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0",
+    });
+    const current = new DataAwsRegion(this, "current", {});
+    new SecurityhubStandardsSubscription(this, "pci_321", {
+      dependsOn: [example],
+      standardsArn:
+        "arn:aws:securityhub:${" +
+        current.name +
+        "}::standards/pci-dss/v/3.2.1",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `standardsArn` - (Required) The ARN of a standard - see below.
+
+Currently available standards (remember to replace `${varRegion}` as appropriate):
+
+| Name                                     | ARN                                                                                             |
+|------------------------------------------|-------------------------------------------------------------------------------------------------|
+| AWS Foundational Security Best Practices | `arn:aws:securityhub:${varRegion}::standards/awsFoundationalSecurityBestPractices/v/100` |
+| CIS AWS Foundations Benchmark v1.2.0     | `arn:aws:securityhub:::ruleset/cisAwsFoundationsBenchmark/v/120`                           |
+| CIS AWS Foundations Benchmark v1.4.0     | `arn:aws:securityhub:${varRegion}::standards/cisAwsFoundationsBenchmark/v/140`            |
+| NIST SP 800-53 Rev. 5                    | `arn:aws:securityhub:${varRegion}::standards/nist80053/v/500`                              |
+| PCI DSS                                  | `arn:aws:securityhub:${varRegion}::standards/pciDss/v/321`                                  |
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ARN of a resource that represents your subscription to a supported standard.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Security Hub standards subscriptions using the standards subscription ARN. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Security Hub standards subscriptions using the standards subscription ARN. For example:
+
+```console
+% terraform import aws_securityhub_standards_subscription.cis arn:aws:securityhub:eu-west-1:123456789012:subscription/cis-aws-foundations-benchmark/v/1.2.0
+```
+
+```console
+% terraform import aws_securityhub_standards_subscription.pci_321 arn:aws:securityhub:eu-west-1:123456789012:subscription/pci-dss/v/3.2.1
+```
+
+```console
+% terraform import aws_securityhub_standards_subscription.nist_800_53_rev_5 arn:aws:securityhub:eu-west-1:123456789012:subscription/nist-800-53/v/5.0.0
+```
+
+<!-- cache-key: cdktf-0.18.0 input-87f38b34c6cd1e5a8b36b0f50996b817110ec2206abee08341de02841e9f3b5f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/securityhub_standards_subscription.markdown b/website/docs/cdktf/typescript/r/securityhub_standards_subscription.markdown
new file mode 100644
index 00000000000..7f5e16dd07b
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/securityhub_standards_subscription.markdown
@@ -0,0 +1,126 @@
+---
+subcategory: "Security Hub"
+layout: "aws"
+page_title: "AWS: aws_securityhub_standards_subscription"
+description: |-
+  Subscribes to a Security Hub standard.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_securityhub_standards_subscription
+
+Subscribes to a Security Hub standard.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsRegion } from "./.gen/providers/aws/data-aws-region";
+import { SecurityhubAccount } from "./.gen/providers/aws/securityhub-account";
+import { SecurityhubStandardsSubscription } from "./.gen/providers/aws/securityhub-standards-subscription";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new SecurityhubAccount(this, "example", {});
+    new SecurityhubStandardsSubscription(this, "cis", {
+      dependsOn: [example],
+      standardsArn:
+        "arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0",
+    });
+    const current = new DataAwsRegion(this, "current", {});
+    new SecurityhubStandardsSubscription(this, "pci_321", {
+      dependsOn: [example],
+      standardsArn:
+        "arn:aws:securityhub:${" +
+        current.name +
+        "}::standards/pci-dss/v/3.2.1",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `standardsArn` - (Required) The ARN of a standard - see below.
+
+Currently available standards (remember to replace `${varRegion}` as appropriate):
+
+| Name                                     | ARN                                                                                             |
+|------------------------------------------|-------------------------------------------------------------------------------------------------|
+| AWS Foundational Security Best Practices | `arn:aws:securityhub:${varRegion}::standards/awsFoundationalSecurityBestPractices/v/100` |
+| CIS AWS Foundations Benchmark v1.2.0     | `arn:aws:securityhub:::ruleset/cisAwsFoundationsBenchmark/v/120`                           |
+| CIS AWS Foundations Benchmark v1.4.0     | `arn:aws:securityhub:${varRegion}::standards/cisAwsFoundationsBenchmark/v/140`            |
+| NIST SP 800-53 Rev. 5                    | `arn:aws:securityhub:${varRegion}::standards/nist80053/v/500`                              |
+| PCI DSS                                  | `arn:aws:securityhub:${varRegion}::standards/pciDss/v/321`                                  |
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ARN of a resource that represents your subscription to a supported standard.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Security Hub standards subscriptions using the standards subscription ARN. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Security Hub standards subscriptions using the standards subscription ARN. For example:
+
+```console
+% terraform import aws_securityhub_standards_subscription.cis arn:aws:securityhub:eu-west-1:123456789012:subscription/cis-aws-foundations-benchmark/v/1.2.0
+```
+
+```console
+% terraform import aws_securityhub_standards_subscription.pci_321 arn:aws:securityhub:eu-west-1:123456789012:subscription/pci-dss/v/3.2.1
+```
+
+```console
+% terraform import aws_securityhub_standards_subscription.nist_800_53_rev_5 arn:aws:securityhub:eu-west-1:123456789012:subscription/nist-800-53/v/5.0.0
+```
+
+<!-- cache-key: cdktf-0.18.0 input-87f38b34c6cd1e5a8b36b0f50996b817110ec2206abee08341de02841e9f3b5f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/serverlessapplicationrepository_cloudformation_stack.html.markdown b/website/docs/cdktf/typescript/r/serverlessapplicationrepository_cloudformation_stack.html.markdown
new file mode 100644
index 00000000000..5a3878312f3
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/serverlessapplicationrepository_cloudformation_stack.html.markdown
@@ -0,0 +1,100 @@
+---
+subcategory: "Serverless Application Repository"
+layout: "aws"
+page_title: "AWS: aws_serverlessapplicationrepository_cloudformation_stack"
+description: |-
+  Deploys an Application CloudFormation Stack from the Serverless Application Repository.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_serverlessapplicationrepository_cloudformation_stack
+
+Deploys an Application CloudFormation Stack from the Serverless Application Repository.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsPartition } from "./.gen/providers/aws/data-aws-partition";
+import { DataAwsRegion } from "./.gen/providers/aws/data-aws-region";
+import { ServerlessapplicationrepositoryCloudformationStack } from "./.gen/providers/aws/serverlessapplicationrepository-cloudformation-stack";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const current = new DataAwsPartition(this, "current", {});
+    const dataAwsRegionCurrent = new DataAwsRegion(this, "current_1", {});
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsRegionCurrent.overrideLogicalId("current");
+    new ServerlessapplicationrepositoryCloudformationStack(
+      this,
+      "postgres-rotator",
+      {
+        applicationId:
+          "arn:aws:serverlessrepo:us-east-1:297356227824:applications/SecretsManagerRDSPostgreSQLRotationSingleUser",
+        capabilities: ["CAPABILITY_IAM", "CAPABILITY_RESOURCE_POLICY"],
+        name: "postgres-rotator",
+        parameters: {
+          endpoint:
+            "secretsmanager.${" +
+            dataAwsRegionCurrent.name +
+            "}.${" +
+            current.dnsSuffix +
+            "}",
+          functionName: "func-postgres-rotator",
+        },
+      }
+    );
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the stack to create. The resource deployed in AWS will be prefixed with `serverlessrepo`
+* `applicationId` - (Required) The ARN of the application from the Serverless Application Repository.
+* `capabilities` - (Required) A list of capabilities. Valid values are `capabilityIam`, `capabilityNamedIam`, `capabilityResourcePolicy`, or `capabilityAutoExpand`
+* `parameters` - (Optional) A map of Parameter structures that specify input parameters for the stack.
+* `semanticVersion` - (Optional) The version of the application to deploy. If not supplied, deploys the latest version.
+* `tags` - (Optional) A list of tags to associate with this stack. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - A unique identifier of the stack.
+* `outputs` - A map of outputs from the stack.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Serverless Application Repository Stack using the CloudFormation Stack name (with or without the `serverlessrepo` prefix) or the CloudFormation Stack ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Serverless Application Repository Stack using the CloudFormation Stack name (with or without the `serverlessrepo` prefix) or the CloudFormation Stack ID. For example:
+
+```console
+% terraform import aws_serverlessapplicationrepository_cloudformation_stack.example serverlessrepo-postgres-rotator
+```
+
+<!-- cache-key: cdktf-0.18.0 input-3c56c5981c41da613753a417692699808c2eda591b3a00277762ed97e8d26af7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/service_discovery_http_namespace.html.markdown b/website/docs/cdktf/typescript/r/service_discovery_http_namespace.html.markdown
new file mode 100644
index 00000000000..567c7b92c37
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/service_discovery_http_namespace.html.markdown
@@ -0,0 +1,75 @@
+---
+subcategory: "Cloud Map"
+layout: "aws"
+page_title: "AWS: aws_service_discovery_http_namespace"
+description: |-
+  Provides a Service Discovery HTTP Namespace resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_service_discovery_http_namespace
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ServiceDiscoveryHttpNamespace } from "./.gen/providers/aws/service-discovery-http-namespace";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ServiceDiscoveryHttpNamespace(this, "example", {
+      description: "example",
+      name: "development",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the http namespace.
+* `description` - (Optional) The description that you specify for the namespace when you create it.
+* `tags` - (Optional) A map of tags to assign to the namespace. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of a namespace.
+* `arn` - The ARN that Amazon Route 53 assigns to the namespace when you create it.
+* `httpName` - The name of an HTTP namespace.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Service Discovery HTTP Namespace using the namespace ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Service Discovery HTTP Namespace using the namespace ID. For example:
+
+```console
+% terraform import aws_service_discovery_http_namespace.example ns-1234567890
+```
+
+<!-- cache-key: cdktf-0.18.0 input-72ee12af572418f0c5d18cd5ae2d5d173e51de9928465723b81dfdbd70c4804b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/service_discovery_instance.html.markdown b/website/docs/cdktf/typescript/r/service_discovery_instance.html.markdown
new file mode 100644
index 00000000000..e000d885050
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/service_discovery_instance.html.markdown
@@ -0,0 +1,170 @@
+---
+subcategory: "Cloud Map"
+layout: "aws"
+page_title: "AWS: aws_service_discovery_instance"
+description: |-
+  Provides a Service Discovery Instance resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_service_discovery_instance
+
+Provides a Service Discovery Instance resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ServiceDiscoveryInstance } from "./.gen/providers/aws/service-discovery-instance";
+import { ServiceDiscoveryPrivateDnsNamespace } from "./.gen/providers/aws/service-discovery-private-dns-namespace";
+import { ServiceDiscoveryService } from "./.gen/providers/aws/service-discovery-service";
+import { Vpc } from "./.gen/providers/aws/vpc";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new Vpc(this, "example", {
+      cidrBlock: "10.0.0.0/16",
+      enableDnsHostnames: true,
+      enableDnsSupport: true,
+    });
+    const awsServiceDiscoveryPrivateDnsNamespaceExample =
+      new ServiceDiscoveryPrivateDnsNamespace(this, "example_1", {
+        description: "example",
+        name: "example.terraform.local",
+        vpc: example.id,
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsServiceDiscoveryPrivateDnsNamespaceExample.overrideLogicalId("example");
+    const awsServiceDiscoveryServiceExample = new ServiceDiscoveryService(
+      this,
+      "example_2",
+      {
+        dnsConfig: {
+          dnsRecords: [
+            {
+              ttl: 10,
+              type: "A",
+            },
+          ],
+          namespaceId: Token.asString(
+            awsServiceDiscoveryPrivateDnsNamespaceExample.id
+          ),
+          routingPolicy: "MULTIVALUE",
+        },
+        healthCheckCustomConfig: {
+          failureThreshold: 1,
+        },
+        name: "example",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsServiceDiscoveryServiceExample.overrideLogicalId("example");
+    const awsServiceDiscoveryInstanceExample = new ServiceDiscoveryInstance(
+      this,
+      "example_3",
+      {
+        attributes: {
+          AWS_INSTANCE_IPV4: "172.18.0.1",
+          custom_attribute: "custom",
+        },
+        instanceId: "example-instance-id",
+        serviceId: Token.asString(awsServiceDiscoveryServiceExample.id),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsServiceDiscoveryInstanceExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ServiceDiscoveryHttpNamespace } from "./.gen/providers/aws/service-discovery-http-namespace";
+import { ServiceDiscoveryInstance } from "./.gen/providers/aws/service-discovery-instance";
+import { ServiceDiscoveryService } from "./.gen/providers/aws/service-discovery-service";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new ServiceDiscoveryHttpNamespace(this, "example", {
+      description: "example",
+      name: "example.terraform.com",
+    });
+    const awsServiceDiscoveryServiceExample = new ServiceDiscoveryService(
+      this,
+      "example_1",
+      {
+        name: "example",
+        namespaceId: example.id,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsServiceDiscoveryServiceExample.overrideLogicalId("example");
+    const awsServiceDiscoveryInstanceExample = new ServiceDiscoveryInstance(
+      this,
+      "example_2",
+      {
+        attributes: {
+          AWS_EC2_INSTANCE_ID: "i-0abdg374kd892cj6dl",
+        },
+        instanceId: "example-instance-id",
+        serviceId: Token.asString(awsServiceDiscoveryServiceExample.id),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsServiceDiscoveryInstanceExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `instanceId` - (Required, ForceNew) The ID of the service instance.
+* `serviceId` - (Required, ForceNew) The ID of the service that you want to use to create the instance.
+* `attributes` - (Required) A map contains the attributes of the instance. Check the [doc](https://docs.aws.amazon.com/cloud-map/latest/api/API_RegisterInstance.html#API_RegisterInstance_RequestSyntax) for the supported attributes and syntax.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the instance.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Service Discovery Instance using the service ID and instance ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Service Discovery Instance using the service ID and instance ID. For example:
+
+```console
+% terraform import aws_service_discovery_instance.example 0123456789/i-0123
+```
+
+<!-- cache-key: cdktf-0.18.0 input-81e46074d207df4789822f0bad31c495113362f2fbc8b6456fb894ad88def8b7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/service_discovery_private_dns_namespace.html.markdown b/website/docs/cdktf/typescript/r/service_discovery_private_dns_namespace.html.markdown
new file mode 100644
index 00000000000..d05bb8f4ff1
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/service_discovery_private_dns_namespace.html.markdown
@@ -0,0 +1,86 @@
+---
+subcategory: "Cloud Map"
+layout: "aws"
+page_title: "AWS: aws_service_discovery_private_dns_namespace"
+description: |-
+  Provides a Service Discovery Private DNS Namespace resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_service_discovery_private_dns_namespace
+
+Provides a Service Discovery Private DNS Namespace resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ServiceDiscoveryPrivateDnsNamespace } from "./.gen/providers/aws/service-discovery-private-dns-namespace";
+import { Vpc } from "./.gen/providers/aws/vpc";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new Vpc(this, "example", {
+      cidrBlock: "10.0.0.0/16",
+    });
+    const awsServiceDiscoveryPrivateDnsNamespaceExample =
+      new ServiceDiscoveryPrivateDnsNamespace(this, "example_1", {
+        description: "example",
+        name: "hoge.example.local",
+        vpc: example.id,
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsServiceDiscoveryPrivateDnsNamespaceExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the namespace.
+* `vpc` - (Required) The ID of VPC that you want to associate the namespace with.
+* `description` - (Optional) The description that you specify for the namespace when you create it.
+* `tags` - (Optional) A map of tags to assign to the namespace. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of a namespace.
+* `arn` - The ARN that Amazon Route 53 assigns to the namespace when you create it.
+* `hostedZone` - The ID for the hosted zone that Amazon Route 53 creates when you create a namespace.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Service Discovery Private DNS Namespace using the namespace ID and VPC ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Service Discovery Private DNS Namespace using the namespace ID and VPC ID. For example:
+
+```console
+% terraform import aws_service_discovery_private_dns_namespace.example 0123456789:vpc-123345
+```
+
+<!-- cache-key: cdktf-0.18.0 input-6f146701ebde1d502a5742b49eee835afec6daf02f5ca55955ff340c638c7c5b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/service_discovery_public_dns_namespace.html.markdown b/website/docs/cdktf/typescript/r/service_discovery_public_dns_namespace.html.markdown
new file mode 100644
index 00000000000..d0bd27d9d23
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/service_discovery_public_dns_namespace.html.markdown
@@ -0,0 +1,77 @@
+---
+subcategory: "Cloud Map"
+layout: "aws"
+page_title: "AWS: aws_service_discovery_public_dns_namespace"
+description: |-
+  Provides a Service Discovery Public DNS Namespace resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_service_discovery_public_dns_namespace
+
+Provides a Service Discovery Public DNS Namespace resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ServiceDiscoveryPublicDnsNamespace } from "./.gen/providers/aws/service-discovery-public-dns-namespace";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ServiceDiscoveryPublicDnsNamespace(this, "example", {
+      description: "example",
+      name: "hoge.example.com",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the namespace.
+* `description` - (Optional) The description that you specify for the namespace when you create it.
+* `tags` - (Optional) A map of tags to assign to the namespace. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of a namespace.
+* `arn` - The ARN that Amazon Route 53 assigns to the namespace when you create it.
+* `hostedZone` - The ID for the hosted zone that Amazon Route 53 creates when you create a namespace.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Service Discovery Public DNS Namespace using the namespace ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Service Discovery Public DNS Namespace using the namespace ID. For example:
+
+```console
+% terraform import aws_service_discovery_public_dns_namespace.example 0123456789
+```
+
+<!-- cache-key: cdktf-0.18.0 input-3f12246f59ce121e0bff5235dbb078efa0ee1d1e73f30312abd5b446e223694a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/service_discovery_service.html.markdown b/website/docs/cdktf/typescript/r/service_discovery_service.html.markdown
new file mode 100644
index 00000000000..e1e4acaf4f9
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/service_discovery_service.html.markdown
@@ -0,0 +1,191 @@
+---
+subcategory: "Cloud Map"
+layout: "aws"
+page_title: "AWS: aws_service_discovery_service"
+description: |-
+  Provides a Service Discovery Service resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_service_discovery_service
+
+Provides a Service Discovery Service resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ServiceDiscoveryPrivateDnsNamespace } from "./.gen/providers/aws/service-discovery-private-dns-namespace";
+import { ServiceDiscoveryService } from "./.gen/providers/aws/service-discovery-service";
+import { Vpc } from "./.gen/providers/aws/vpc";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new Vpc(this, "example", {
+      cidrBlock: "10.0.0.0/16",
+      enableDnsHostnames: true,
+      enableDnsSupport: true,
+    });
+    const awsServiceDiscoveryPrivateDnsNamespaceExample =
+      new ServiceDiscoveryPrivateDnsNamespace(this, "example_1", {
+        description: "example",
+        name: "example.terraform.local",
+        vpc: example.id,
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsServiceDiscoveryPrivateDnsNamespaceExample.overrideLogicalId("example");
+    const awsServiceDiscoveryServiceExample = new ServiceDiscoveryService(
+      this,
+      "example_2",
+      {
+        dnsConfig: {
+          dnsRecords: [
+            {
+              ttl: 10,
+              type: "A",
+            },
+          ],
+          namespaceId: Token.asString(
+            awsServiceDiscoveryPrivateDnsNamespaceExample.id
+          ),
+          routingPolicy: "MULTIVALUE",
+        },
+        healthCheckCustomConfig: {
+          failureThreshold: 1,
+        },
+        name: "example",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsServiceDiscoveryServiceExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ServiceDiscoveryPublicDnsNamespace } from "./.gen/providers/aws/service-discovery-public-dns-namespace";
+import { ServiceDiscoveryService } from "./.gen/providers/aws/service-discovery-service";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new ServiceDiscoveryPublicDnsNamespace(this, "example", {
+      description: "example",
+      name: "example.terraform.com",
+    });
+    const awsServiceDiscoveryServiceExample = new ServiceDiscoveryService(
+      this,
+      "example_1",
+      {
+        dnsConfig: {
+          dnsRecords: [
+            {
+              ttl: 10,
+              type: "A",
+            },
+          ],
+          namespaceId: example.id,
+        },
+        healthCheckConfig: {
+          failureThreshold: 10,
+          resourcePath: "path",
+          type: "HTTP",
+        },
+        name: "example",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsServiceDiscoveryServiceExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required, ForceNew) The name of the service.
+* `description` - (Optional) The description of the service.
+* `dnsConfig` - (Optional) A complex type that contains information about the resource record sets that you want Amazon Route 53 to create when you register an instance.
+* `healthCheckConfig` - (Optional) A complex type that contains settings for an optional health check. Only for Public DNS namespaces.
+* `forceDestroy` - (Optional, Default:false ) A boolean that indicates all instances should be deleted from the service so that the service can be destroyed without error. These instances are not recoverable.
+* `healthCheckCustomConfig` - (Optional, ForceNew) A complex type that contains settings for ECS managed health checks.
+* `namespaceId` - (Optional) The ID of the namespace that you want to use to create the service.
+* `type` - (Optional) If present, specifies that the service instances are only discoverable using the `discoverInstances` API operation. No DNS records is registered for the service instances. The only valid value is `http`.
+* `tags` - (Optional) A map of tags to assign to the service. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### dns_config
+
+This argument supports the following arguments:
+
+* `namespaceId` - (Required, ForceNew) The ID of the namespace to use for DNS configuration.
+* `dnsRecords` - (Required) An array that contains one DnsRecord object for each resource record set.
+* `routingPolicy` - (Optional) The routing policy that you want to apply to all records that Route 53 creates when you register an instance and specify the service. Valid Values: MULTIVALUE, WEIGHTED
+
+#### dns_records
+
+This argument supports the following arguments:
+
+* `ttl` - (Required) The amount of time, in seconds, that you want DNS resolvers to cache the settings for this resource record set.
+* `type` - (Required, ForceNew) The type of the resource, which indicates the value that Amazon Route 53 returns in response to DNS queries. Valid Values: A, AAAA, SRV, CNAME
+
+### health_check_config
+
+This argument supports the following arguments:
+
+* `failureThreshold` - (Optional) The number of consecutive health checks. Maximum value of 10.
+* `resourcePath` - (Optional) The path that you want Route 53 to request when performing health checks. Route 53 automatically adds the DNS name for the service. If you don't specify a value, the default value is /.
+* `type` - (Optional, ForceNew) The type of health check that you want to create, which indicates how Route 53 determines whether an endpoint is healthy. Valid Values: HTTP, HTTPS, TCP
+
+### health_check_custom_config
+
+This argument supports the following arguments:
+
+* `failureThreshold` - (Optional, ForceNew) The number of 30-second intervals that you want service discovery to wait before it changes the health status of a service instance.  Maximum value of 10.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the service.
+* `arn` - The ARN of the service.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Service Discovery Service using the service ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Service Discovery Service using the service ID. For example:
+
+```console
+% terraform import aws_service_discovery_service.example 0123456789
+```
+
+<!-- cache-key: cdktf-0.18.0 input-5ade767584d977305ecc43e9b30413e85a11a275bc3038025a2c51ba270c6462 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/servicecatalog_budget_resource_association.html.markdown b/website/docs/cdktf/typescript/r/servicecatalog_budget_resource_association.html.markdown
new file mode 100644
index 00000000000..e986e804aeb
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/servicecatalog_budget_resource_association.html.markdown
@@ -0,0 +1,85 @@
+---
+subcategory: "Service Catalog"
+layout: "aws"
+page_title: "AWS: aws_servicecatalog_budget_resource_association"
+description: |-
+  Manages a Service Catalog Budget Resource Association
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_servicecatalog_budget_resource_association
+
+Manages a Service Catalog Budget Resource Association.
+
+-> **Tip:** A "resource" is either a Service Catalog portfolio or product.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ServicecatalogBudgetResourceAssociation } from "./.gen/providers/aws/servicecatalog-budget-resource-association";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ServicecatalogBudgetResourceAssociation(this, "example", {
+      budgetName: "budget-pjtvyakdlyo3m",
+      resourceId: "prod-dnigbtea24ste",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `budgetName` - (Required) Budget name.
+* `resourceId` - (Required) Resource identifier.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Identifier of the association.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `3M`)
+- `read` - (Default `10M`)
+- `delete` - (Default `3M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsServicecatalogBudgetResourceAssociation` using the budget name and resource ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsServicecatalogBudgetResourceAssociation` using the budget name and resource ID. For example:
+
+```console
+% terraform import aws_servicecatalog_budget_resource_association.example budget-pjtvyakdlyo3m:prod-dnigbtea24ste
+```
+
+<!-- cache-key: cdktf-0.18.0 input-a2e52fd530130cd91bdd5732dbafc57e0d37162974732ff3d849486e557d12fa -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/servicecatalog_constraint.html.markdown b/website/docs/cdktf/typescript/r/servicecatalog_constraint.html.markdown
new file mode 100644
index 00000000000..b9cc9071c6c
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/servicecatalog_constraint.html.markdown
@@ -0,0 +1,135 @@
+---
+subcategory: "Service Catalog"
+layout: "aws"
+page_title: "AWS: aws_servicecatalog_constraint"
+description: |-
+  Manages a Service Catalog Constraint
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_servicecatalog_constraint
+
+Manages a Service Catalog Constraint.
+
+~> **NOTE:** This resource does not associate a Service Catalog product and portfolio. However, the product and portfolio must be associated (see the `awsServicecatalogProductPortfolioAssociation` resource) prior to creating a constraint or you will receive an error.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ServicecatalogConstraint } from "./.gen/providers/aws/servicecatalog-constraint";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ServicecatalogConstraint(this, "example", {
+      description: "Back off, man. I'm a scientist.",
+      parameters: Token.asString(
+        Fn.jsonencode({
+          RoleArn: "arn:aws:iam::123456789012:role/LaunchRole",
+        })
+      ),
+      portfolioId: Token.asString(awsServicecatalogPortfolioExample.id),
+      productId: Token.asString(awsServicecatalogProductExample.id),
+      type: "LAUNCH",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `parameters` - (Required) Constraint parameters in JSON format. The syntax depends on the constraint type. See details below.
+* `portfolioId` - (Required) Portfolio identifier.
+* `productId` - (Required) Product identifier.
+* `type` - (Required) Type of constraint. Valid values are `launch`, `notification`, `resourceUpdate`, `stackset`, and `template`.
+
+The following arguments are optional:
+
+* `acceptLanguage` - (Optional) Language code. Valid values: `en` (English), `jp` (Japanese), `zh` (Chinese). Default value is `en`.
+* `description` - (Optional) Description of the constraint.
+
+### `parameters`
+
+The `type` you specify determines what must be included in the `parameters` JSON:
+
+* `launch`: You are required to specify either the RoleArn or the LocalRoleName but can't use both. If you specify the `localRoleName` property, when an account uses the launch constraint, the IAM role with that name in the account will be used. This allows launch-role constraints to be account-agnostic so the administrator can create fewer resources per shared account. The given role name must exist in the account used to create the launch constraint and the account of the user who launches a product with this launch constraint. You cannot have both a `launch` and a `stackset` constraint. You also cannot have more than one `launch` constraint on an `awsServicecatalogProduct` and `awsServicecatalogPortfolio`. Specify the `roleArn` and `localRoleName` properties as follows:
+
+```json
+{ "RoleArn" : "arn:aws:iam::123456789012:role/LaunchRole" }
+```
+
+```json
+{ "LocalRoleName" : "SCBasicLaunchRole" }
+```
+
+* `notification`: Specify the `notificationArns` property as follows:
+
+```json
+{ "NotificationArns" : ["arn:aws:sns:us-east-1:123456789012:Topic"] }
+```
+
+* `resourceUpdate`: Specify the `tagUpdatesOnProvisionedProduct` property as follows. The `tagUpdatesOnProvisionedProduct` property accepts a string value of `allowed` or `notAllowed`.
+
+```json
+{ "Version" : "2.0","Properties" :{ "TagUpdateOnProvisionedProduct" : "String" }}
+```
+
+* `stackset`: Specify the Parameters property as follows. You cannot have both a `launch` and a `stackset` constraint. You also cannot have more than one `stackset` constraint on on an `awsServicecatalogProduct` and `awsServicecatalogPortfolio`. Products with a `stackset` constraint will launch an AWS CloudFormation stack set.
+
+```json
+{ "Version" : "String", "Properties" : { "AccountList" : [ "String" ], "RegionList" : [ "String" ], "AdminRole" : "String", "ExecutionRole" : "String" }}
+```
+
+* `template`: Specify the Rules property. For more information, see [Template Constraint Rules](http://docs.aws.amazon.com/servicecatalog/latest/adminguide/reference-template_constraint_rules.html).
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Constraint identifier.
+* `owner` - Owner of the constraint.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `3M`)
+- `read` - (Default `10M`)
+- `update` - (Default `3M`)
+- `delete` - (Default `3M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsServicecatalogConstraint` using the constraint ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsServicecatalogConstraint` using the constraint ID. For example:
+
+```console
+% terraform import aws_servicecatalog_constraint.example cons-nmdkb6cgxfcrs
+```
+
+<!-- cache-key: cdktf-0.18.0 input-f391e00f1f29453b1e81c01e36db6ce37af9e3b44513a1ffefd379e9b7d4ba13 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/servicecatalog_organizations_access.html.markdown b/website/docs/cdktf/typescript/r/servicecatalog_organizations_access.html.markdown
new file mode 100644
index 00000000000..5c4439ec096
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/servicecatalog_organizations_access.html.markdown
@@ -0,0 +1,59 @@
+---
+subcategory: "Service Catalog"
+layout: "aws"
+page_title: "AWS: aws_servicecatalog_organizations_access"
+description: |-
+  Manages Service Catalog Organizations Access
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_servicecatalog_organizations_access
+
+Manages Service Catalog AWS Organizations Access, a portfolio sharing feature through AWS Organizations. This allows Service Catalog to receive updates on your organization in order to sync your shares with the current structure. This resource will prompt AWS to set `organizations:enableAwsServiceAccess` on your behalf so that your shares can be in sync with any changes in your AWS Organizations structure.
+
+~> **NOTE:** This resource can only be used by the management account in the organization. In other words, a delegated administrator is not authorized to use the resource.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ServicecatalogOrganizationsAccess } from "./.gen/providers/aws/servicecatalog-organizations-access";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ServicecatalogOrganizationsAccess(this, "example", {
+      enabled: Token.asBoolean("true"),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `enabled` - (Required) Whether to enable AWS Organizations access.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Account ID for the account using the resource.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `read` - (Default `10M`)
+
+<!-- cache-key: cdktf-0.18.0 input-d1af255796a486bb9a3bd8cc8478755ac5b38d989c70b85aaacdec5fc40b2642 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/servicecatalog_portfolio.html.markdown b/website/docs/cdktf/typescript/r/servicecatalog_portfolio.html.markdown
new file mode 100644
index 00000000000..c971718651a
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/servicecatalog_portfolio.html.markdown
@@ -0,0 +1,86 @@
+---
+subcategory: "Service Catalog"
+layout: "aws"
+page_title: "AWS: aws_servicecatalog_portfolio"
+description: |-
+  Provides a resource to create a Service Catalog portfolio
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_servicecatalog_portfolio
+
+Provides a resource to create a Service Catalog Portfolio.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ServicecatalogPortfolio } from "./.gen/providers/aws/servicecatalog-portfolio";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ServicecatalogPortfolio(this, "portfolio", {
+      description: "List of my organizations apps",
+      name: "My App Portfolio",
+      providerName: "Brett",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the portfolio.
+* `description` - (Required) Description of the portfolio
+* `providerName` - (Required) Name of the person or organization who owns the portfolio.
+* `tags` - (Optional) Tags to apply to the connection. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the Service Catalog Portfolio.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `30M`)
+- `read` - (Default `10M`)
+- `update` - (Default `30M`)
+- `delete` - (Default `30M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Service Catalog Portfolios using the Service Catalog Portfolio `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Service Catalog Portfolios using the Service Catalog Portfolio `id`. For example:
+
+```console
+% terraform import aws_servicecatalog_portfolio.testfolio port-12344321
+```
+
+<!-- cache-key: cdktf-0.18.0 input-da174375baa38ca503a2ff97599b160bf147cf7877cecc0642771beb1b8b5543 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/servicecatalog_portfolio_share.html.markdown b/website/docs/cdktf/typescript/r/servicecatalog_portfolio_share.html.markdown
new file mode 100644
index 00000000000..614fbd8c9b9
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/servicecatalog_portfolio_share.html.markdown
@@ -0,0 +1,101 @@
+---
+subcategory: "Service Catalog"
+layout: "aws"
+page_title: "AWS: aws_servicecatalog_portfolio_share"
+description: |-
+  Manages a Service Catalog Portfolio Share
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_servicecatalog_portfolio_share
+
+Manages a Service Catalog Portfolio Share. Shares the specified portfolio with the specified account or organization node. You can share portfolios to an organization, an organizational unit, or a specific account.
+
+If the portfolio share with the specified account or organization node already exists, using this resource to re-create the share will have no effect and will not return an error. You can then use this resource to update the share.
+
+~> **NOTE:** Shares to an organization node can only be created by the management account of an organization or by a delegated administrator. If a delegated admin is de-registered, they can no longer create portfolio shares.
+
+~> **NOTE:** AWSOrganizationsAccess must be enabled in order to create a portfolio share to an organization node.
+
+~> **NOTE:** You can't share a shared resource, including portfolios that contain a shared product.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ServicecatalogPortfolioShare } from "./.gen/providers/aws/servicecatalog-portfolio-share";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ServicecatalogPortfolioShare(this, "example", {
+      portfolioId: Token.asString(awsServicecatalogPortfolioExample.id),
+      principalId: "012128675309",
+      type: "ACCOUNT",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `portfolioId` - (Required) Portfolio identifier.
+* `principalId` - (Required) Identifier of the principal with whom you will share the portfolio. Valid values AWS account IDs and ARNs of AWS Organizations and organizational units.
+* `type` - (Required) Type of portfolio share. Valid values are `account` (an external account), `organization` (a share to every account in an organization), `organizationalUnit`, `organizationMemberAccount` (a share to an account in an organization).
+
+The following arguments are optional:
+
+* `acceptLanguage` - (Optional) Language code. Valid values: `en` (English), `jp` (Japanese), `zh` (Chinese). Default value is `en`.
+* `sharePrincipals` - (Optional) Enables or disables Principal sharing when creating the portfolio share. If this flag is not provided, principal sharing is disabled.
+* `shareTagOptions` - (Optional) Whether to enable sharing of `awsServicecatalogTagOption` resources when creating the portfolio share.
+* `waitForAcceptance` - (Optional) Whether to wait (up to the timeout) for the share to be accepted. Organizational shares are automatically accepted.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `accepted` - Whether the shared portfolio is imported by the recipient account. If the recipient is organizational, the share is automatically imported, and the field is always set to true.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `3M`)
+- `read` - (Default `10M`)
+- `update` - (Default `3M`)
+- `delete` - (Default `3M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsServicecatalogPortfolioShare` using the portfolio share ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsServicecatalogPortfolioShare` using the portfolio share ID. For example:
+
+```console
+% terraform import aws_servicecatalog_portfolio_share.example port-12344321:ACCOUNT:123456789012
+```
+
+<!-- cache-key: cdktf-0.18.0 input-2bfc4e872e821217e1db9b54e4495ec060f98eb8c8810ca144d89c25443c542e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/servicecatalog_principal_portfolio_association.html.markdown b/website/docs/cdktf/typescript/r/servicecatalog_principal_portfolio_association.html.markdown
new file mode 100644
index 00000000000..b961ae3ecef
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/servicecatalog_principal_portfolio_association.html.markdown
@@ -0,0 +1,88 @@
+---
+subcategory: "Service Catalog"
+layout: "aws"
+page_title: "AWS: aws_servicecatalog_principal_portfolio_association"
+description: |-
+  Manages a Service Catalog Principal Portfolio Association
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_servicecatalog_principal_portfolio_association
+
+Manages a Service Catalog Principal Portfolio Association.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ServicecatalogPrincipalPortfolioAssociation } from "./.gen/providers/aws/servicecatalog-principal-portfolio-association";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ServicecatalogPrincipalPortfolioAssociation(this, "example", {
+      portfolioId: "port-68656c6c6f",
+      principalArn: "arn:aws:iam::123456789012:user/Eleanor",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `portfolioId` - (Required) Portfolio identifier.
+* `principalArn` - (Required) Principal ARN.
+
+The following arguments are optional:
+
+* `acceptLanguage` - (Optional) Language code. Valid values: `en` (English), `jp` (Japanese), `zh` (Chinese). Default value is `en`.
+* `principalType` - (Optional) Principal type. Setting this argument empty (e.g., `principal_type = ""`) will result in an error. Valid values are `iam` and `iamPattern`. Default is `iam`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Identifier of the association.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `3M`)
+- `read` - (Default `10M`)
+- `delete` - (Default `3M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsServicecatalogPrincipalPortfolioAssociation` using `acceptLanguage`, `principalArn`, `portfolioId`, and `principalType` separated by a comma. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsServicecatalogPrincipalPortfolioAssociation` using `acceptLanguage`, `principalArn`, `portfolioId`, and `principalType` separated by a comma. For example:
+
+```console
+% terraform import aws_servicecatalog_principal_portfolio_association.example en,arn:aws:iam::123456789012:user/Eleanor,port-68656c6c6f,IAM
+```
+
+<!-- cache-key: cdktf-0.18.0 input-e6d6f9fdac81517f3102dae36363cdc0c25088bd03ba2f1ace568fed9c2cef49 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/servicecatalog_product.html.markdown b/website/docs/cdktf/typescript/r/servicecatalog_product.html.markdown
new file mode 100644
index 00000000000..6f99bc059d4
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/servicecatalog_product.html.markdown
@@ -0,0 +1,124 @@
+---
+subcategory: "Service Catalog"
+layout: "aws"
+page_title: "AWS: aws_servicecatalog_product"
+description: |-
+  Manages a Service Catalog Product
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_servicecatalog_product
+
+Manages a Service Catalog Product.
+
+~> **NOTE:** The user or role that uses this resources must have the `cloudformation:getTemplate` IAM policy permission. This policy permission is required when using the `templatePhysicalId` argument.
+
+-> A "provisioning artifact" is also referred to as a "version." A "distributor" is also referred to as a "vendor."
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ServicecatalogProduct } from "./.gen/providers/aws/servicecatalog-product";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ServicecatalogProduct(this, "example", {
+      name: "example",
+      owner: "example-owner",
+      provisioningArtifactParameters: {
+        templateUrl:
+          "https://s3.amazonaws.com/cf-templates-ozkq9d3hgiq2-us-east-1/temp1.json",
+      },
+      tags: {
+        foo: "bar",
+      },
+      type: "CLOUD_FORMATION_TEMPLATE",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) Name of the product.
+* `owner` - (Required) Owner of the product.
+* `provisioningArtifactParameters` - (Required) Configuration block for provisioning artifact (i.e., version) parameters. Detailed below.
+* `type` - (Required) Type of product. See [AWS Docs](https://docs.aws.amazon.com/servicecatalog/latest/dg/API_CreateProduct.html#API_CreateProduct_RequestSyntax) for valid list of values.
+
+The following arguments are optional:
+
+* `acceptLanguage` - (Optional) Language code. Valid values: `en` (English), `jp` (Japanese), `zh` (Chinese). Default value is `en`.
+* `description` - (Optional) Description of the product.
+* `distributor` - (Optional) Distributor (i.e., vendor) of the product.
+* `supportDescription` - (Optional) Support information about the product.
+* `supportEmail` - (Optional) Contact email for product support.
+* `supportUrl` - (Optional) Contact URL for product support.
+* `tags` - (Optional) Tags to apply to the product. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### provisioning_artifact_parameters
+
+This argument supports the following arguments:
+
+* `description` - (Optional) Description of the provisioning artifact (i.e., version), including how it differs from the previous provisioning artifact.
+* `disableTemplateValidation` - (Optional) Whether AWS Service Catalog stops validating the specified provisioning artifact template even if it is invalid.
+* `name` - (Optional) Name of the provisioning artifact (for example, `v1`, `v2Beta`). No spaces are allowed.
+* `templatePhysicalId` - (Required if `templateUrl` is not provided) Template source as the physical ID of the resource that contains the template. Currently only supports CloudFormation stack ARN. Specify the physical ID as `arn:[partition]:cloudformation:[region]:[account ID]:stack/[stack name]/[resource ID]`.
+* `templateUrl` - (Required if `templatePhysicalId` is not provided) Template source as URL of the CloudFormation template in Amazon S3.
+* `type` - (Optional) Type of provisioning artifact. See [AWS Docs](https://docs.aws.amazon.com/servicecatalog/latest/dg/API_ProvisioningArtifactProperties.html) for valid list of values.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the product.
+* `createdTime` - Time when the product was created.
+* `hasDefaultPath` - Whether the product has a default path. If the product does not have a default path, call `listLaunchPaths` to disambiguate between paths.  Otherwise, `listLaunchPaths` is not required, and the output of ProductViewSummary can be used directly with `describeProvisioningParameters`.
+* `id` - Product ID. For example, `prodDnigbtea24Ste`.
+* `status` - Status of the product.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `5M`)
+- `read` - (Default `10M`)
+- `update` - (Default `5M`)
+- `delete` - (Default `5M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsServicecatalogProduct` using the product ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsServicecatalogProduct` using the product ID. For example:
+
+```console
+% terraform import aws_servicecatalog_product.example prod-dnigbtea24ste
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1f4523af61444a389c63a7aa67dc5375eed39f2f4564f496463f6674fac90f74 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/servicecatalog_product_portfolio_association.html.markdown b/website/docs/cdktf/typescript/r/servicecatalog_product_portfolio_association.html.markdown
new file mode 100644
index 00000000000..28eb2237ed3
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/servicecatalog_product_portfolio_association.html.markdown
@@ -0,0 +1,86 @@
+---
+subcategory: "Service Catalog"
+layout: "aws"
+page_title: "AWS: aws_servicecatalog_product_portfolio_association"
+description: |-
+  Manages a Service Catalog Product Portfolio Association
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_servicecatalog_product_portfolio_association
+
+Manages a Service Catalog Product Portfolio Association.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ServicecatalogProductPortfolioAssociation } from "./.gen/providers/aws/servicecatalog-product-portfolio-association";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ServicecatalogProductPortfolioAssociation(this, "example", {
+      portfolioId: "port-68656c6c6f",
+      productId: "prod-dnigbtea24ste",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `portfolioId` - (Required) Portfolio identifier.
+* `productId` - (Required) Product identifier.
+
+The following arguments are optional:
+
+* `acceptLanguage` - (Optional) Language code. Valid values: `en` (English), `jp` (Japanese), `zh` (Chinese). Default value is `en`.
+* `sourcePortfolioId` - (Optional) Identifier of the source portfolio.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Identifier of the association.
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `3M`)
+- `read` - (Default `10M`)
+- `delete` - (Default `3M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsServicecatalogProductPortfolioAssociation` using the accept language, portfolio ID, and product ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsServicecatalogProductPortfolioAssociation` using the accept language, portfolio ID, and product ID. For example:
+
+```console
+% terraform import aws_servicecatalog_product_portfolio_association.example en:port-68656c6c6f:prod-dnigbtea24ste
+```
+
+<!-- cache-key: cdktf-0.18.0 input-a3af1254e2031bb30383dd299c3aac7b7de830390f5b4d5f6d57c3f44312464e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/servicecatalog_provisioned_product.html.markdown b/website/docs/cdktf/typescript/r/servicecatalog_provisioned_product.html.markdown
new file mode 100644
index 00000000000..622dcd0df5b
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/servicecatalog_provisioned_product.html.markdown
@@ -0,0 +1,161 @@
+---
+subcategory: "Service Catalog"
+layout: "aws"
+page_title: "AWS: aws_servicecatalog_provisioned_product"
+description: |-
+  Manages a Service Catalog Provisioned Product
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_servicecatalog_provisioned_product
+
+This resource provisions and manages a Service Catalog provisioned product.
+
+A provisioned product is a resourced instance of a product. For example, provisioning a product based on a CloudFormation template launches a CloudFormation stack and its underlying resources.
+
+Like this resource, the `awsServicecatalogRecord` data source also provides information about a provisioned product. Although a Service Catalog record provides some overlapping information with this resource, a record is tied to a provisioned product event, such as provisioning, termination, and updating.
+
+-> **Tip:** If you include conflicted keys as tags, AWS will report an error, "Parameter validation failed: Missing required parameter in Tags[N]:Value".
+
+-> **Tip:** A "provisioning artifact" is also referred to as a "version." A "distributor" is also referred to as a "vendor."
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ServicecatalogProvisionedProduct } from "./.gen/providers/aws/servicecatalog-provisioned-product";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ServicecatalogProvisionedProduct(this, "example", {
+      name: "example",
+      productName: "Example product",
+      provisioningArtifactName: "Example version",
+      provisioningParameters: [
+        {
+          key: "foo",
+          value: "bar",
+        },
+      ],
+      tags: {
+        foo: "bar",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) User-friendly name of the provisioned product.
+
+The following arguments are optional:
+
+* `acceptLanguage` - (Optional) Language code. Valid values: `en` (English), `jp` (Japanese), `zh` (Chinese). Default value is `en`.
+* `ignoreErrors` - (Optional) _Only applies to deleting._ If set to `true`, AWS Service Catalog stops managing the specified provisioned product even if it cannot delete the underlying resources. The default value is `false`.
+* `notificationArns` - (Optional) Passed to CloudFormation. The SNS topic ARNs to which to publish stack-related events.
+* `pathId` - (Optional) Path identifier of the product. This value is optional if the product has a default path, and required if the product has more than one path. To list the paths for a product, use `awsServicecatalogLaunchPaths`. When required, you must provide `pathId` or `pathName`, but not both.
+* `pathName` - (Optional) Name of the path. You must provide `pathId` or `pathName`, but not both.
+* `productId` - (Optional) Product identifier. For example, `prodAbcdzk7Xy33Qa`. You must provide `productId` or `productName`, but not both.
+* `productName` - (Optional) Name of the product. You must provide `productId` or `productName`, but not both.
+* `provisioningArtifactId` - (Optional) Identifier of the provisioning artifact. For example, `pa4Abcdjnxjj6Ne`. You must provide the `provisioningArtifactId` or `provisioningArtifactName`, but not both.
+* `provisioningArtifactName` - (Optional) Name of the provisioning artifact. You must provide the `provisioningArtifactId` or `provisioningArtifactName`, but not both.
+* `provisioningParameters` - (Optional) Configuration block with parameters specified by the administrator that are required for provisioning the product. See details below.
+* `retainPhysicalResources` - (Optional) _Only applies to deleting._ Whether to delete the Service Catalog provisioned product but leave the CloudFormation stack, stack set, or the underlying resources of the deleted provisioned product. The default value is `false`.
+* `stackSetProvisioningPreferences` - (Optional) Configuration block with information about the provisioning preferences for a stack set. See details below.
+* `tags` - (Optional) Tags to apply to the provisioned product. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### provisioning_parameters
+
+This argument supports the following arguments:
+
+* `key` - (Required) Parameter key.
+* `usePreviousValue` - (Optional) Whether to ignore `value` and keep the previous parameter value. Ignored when initially provisioning a product.
+* `value` - (Optional) Parameter value.
+
+### stack_set_provisioning_preferences
+
+All of the `stackSetProvisioningPreferences` are only applicable to a `cfnStackset` provisioned product type.
+
+This argument supports the following arguments:
+
+* `accounts` - (Optional) One or more AWS accounts that will have access to the provisioned product. The AWS accounts specified should be within the list of accounts in the STACKSET constraint. To get the list of accounts in the STACKSET constraint, use the `awsServicecatalogProvisioningParameters` data source. If no values are specified, the default value is all accounts from the STACKSET constraint.
+* `failureToleranceCount` - (Optional) Number of accounts, per region, for which this operation can fail before AWS Service Catalog stops the operation in that region. If the operation is stopped in a region, AWS Service Catalog doesn't attempt the operation in any subsequent regions. You must specify either `failureToleranceCount` or `failureTolerancePercentage`, but not both. The default value is 0 if no value is specified.
+* `failureTolerancePercentage` - (Optional) Percentage of accounts, per region, for which this stack operation can fail before AWS Service Catalog stops the operation in that region. If the operation is stopped in a region, AWS Service Catalog doesn't attempt the operation in any subsequent regions. When calculating the number of accounts based on the specified percentage, AWS Service Catalog rounds down to the next whole number. You must specify either `failureToleranceCount` or `failureTolerancePercentage`, but not both.
+* `maxConcurrencyCount` - (Optional) Maximum number of accounts in which to perform this operation at one time. This is dependent on the value of `failureToleranceCount`. `maxConcurrencyCount` is at most one more than the `failureToleranceCount`. Note that this setting lets you specify the maximum for operations. For large deployments, under certain circumstances the actual number of accounts acted upon concurrently may be lower due to service throttling. You must specify either `maxConcurrencyCount` or `maxConcurrencyPercentage`, but not both.
+* `maxConcurrencyPercentage` - (Optional) Maximum percentage of accounts in which to perform this operation at one time. When calculating the number of accounts based on the specified percentage, AWS Service Catalog rounds down to the next whole number. This is true except in cases where rounding down would result is zero. In this case, AWS Service Catalog sets the number as 1 instead. Note that this setting lets you specify the maximum for operations. For large deployments, under certain circumstances the actual number of accounts acted upon concurrently may be lower due to service throttling. You must specify either `maxConcurrencyCount` or `maxConcurrencyPercentage`, but not both.
+* `regions` - (Optional) One or more AWS Regions where the provisioned product will be available. The specified regions should be within the list of regions from the STACKSET constraint. To get the list of regions in the STACKSET constraint, use the `awsServicecatalogProvisioningParameters` data source. If no values are specified, the default value is all regions from the STACKSET constraint.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the provisioned product.
+* `cloudwatchDashboardNames` - Set of CloudWatch dashboards that were created when provisioning the product.
+* `createdTime` - Time when the provisioned product was created.
+* `id` - Provisioned Product ID.
+* `lastProvisioningRecordId` - Record identifier of the last request performed on this provisioned product of the following types: `provisionedProduct`, `updateProvisionedProduct`, `executeProvisionedProductPlan`, `terminateProvisionedProduct`.
+* `lastRecordId` - Record identifier of the last request performed on this provisioned product.
+* `lastSuccessfulProvisioningRecordId` - Record identifier of the last successful request performed on this provisioned product of the following types: `provisionedProduct`, `updateProvisionedProduct`, `executeProvisionedProductPlan`, `terminateProvisionedProduct`.
+* `launchRoleArn` - ARN of the launch role associated with the provisioned product.
+* `outputs` - The set of outputs for the product created.
+    * `description` -  The description of the output.
+    * `key` - The output key.
+    * `value` - The output value.
+* `status` - Current status of the provisioned product. See meanings below.
+* `statusMessage` - Current status message of the provisioned product.
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `type` - Type of provisioned product. Valid values are `cfnStack` and `cfnStackset`.
+
+### `status` Meanings
+
+* `available` - Stable state, ready to perform any operation. The most recent operation succeeded and completed.
+* `underChange` - Transitive state. Operations performed might not have valid results. Wait for an `available` status before performing operations.
+* `tainted` - Stable state, ready to perform any operation. The stack has completed the requested operation but is not exactly what was requested. For example, a request to update to a new version failed and the stack rolled back to the current version.
+* `error` - An unexpected error occurred. The provisioned product exists but the stack is not running. For example, CloudFormation received a parameter value that was not valid and could not launch the stack.
+* `planInProgress` - Transitive state. The plan operations were performed to provision a new product, but resources have not yet been created. After reviewing the list of resources to be created, execute the plan. Wait for an `available` status before performing operations.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `30M`)
+- `read` - (Default `10M`)
+- `update` - (Default `30M`)
+- `delete` - (Default `30M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsServicecatalogProvisionedProduct` using the provisioned product ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsServicecatalogProvisionedProduct` using the provisioned product ID. For example:
+
+```console
+% terraform import aws_servicecatalog_provisioned_product.example pp-dnigbtea24ste
+```
+
+<!-- cache-key: cdktf-0.18.0 input-edd3b705e95bac2e25f2eb97a79b3f04705398287d665fe5f005143d89f697e6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/servicecatalog_provisioning_artifact.html.markdown b/website/docs/cdktf/typescript/r/servicecatalog_provisioning_artifact.html.markdown
new file mode 100644
index 00000000000..8d355610681
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/servicecatalog_provisioning_artifact.html.markdown
@@ -0,0 +1,111 @@
+---
+subcategory: "Service Catalog"
+layout: "aws"
+page_title: "AWS: aws_servicecatalog_provisioning_artifact"
+description: |-
+  Manages a Service Catalog Provisioning Artifact
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_servicecatalog_provisioning_artifact
+
+Manages a Service Catalog Provisioning Artifact for a specified product.
+
+-> A "provisioning artifact" is also referred to as a "version."
+
+~> **NOTE:** You cannot create a provisioning artifact for a product that was shared with you.
+
+~> **NOTE:** The user or role that use this resource must have the `cloudformation:getTemplate` IAM policy permission. This policy permission is required when using the `templatePhysicalId` argument.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ServicecatalogProvisioningArtifact } from "./.gen/providers/aws/servicecatalog-provisioning-artifact";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ServicecatalogProvisioningArtifact(this, "example", {
+      name: "example",
+      productId: Token.asString(awsServicecatalogProductExample.id),
+      templateUrl:
+        "https://${" +
+        awsS3BucketExample.bucketRegionalDomainName +
+        "}/${" +
+        awsS3ObjectExample.key +
+        "}",
+      type: "CLOUD_FORMATION_TEMPLATE",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `productId` - (Required) Identifier of the product.
+* `templatePhysicalId` - (Required if `templateUrl` is not provided) Template source as the physical ID of the resource that contains the template. Currently only supports CloudFormation stack ARN. Specify the physical ID as `arn:[partition]:cloudformation:[region]:[account ID]:stack/[stack name]/[resource ID]`.
+* `templateUrl` - (Required if `templatePhysicalId` is not provided) Template source as URL of the CloudFormation template in Amazon S3.
+
+The following arguments are optional:
+
+* `acceptLanguage` - (Optional) Language code. Valid values: `en` (English), `jp` (Japanese), `zh` (Chinese). The default value is `en`.
+* `active` - (Optional) Whether the product version is active. Inactive provisioning artifacts are invisible to end users. End users cannot launch or update a provisioned product from an inactive provisioning artifact. Default is `true`.
+* `description` - (Optional) Description of the provisioning artifact (i.e., version), including how it differs from the previous provisioning artifact.
+* `disableTemplateValidation` - (Optional) Whether AWS Service Catalog stops validating the specified provisioning artifact template even if it is invalid.
+* `guidance` - (Optional) Information set by the administrator to provide guidance to end users about which provisioning artifacts to use. Valid values are `default` and `deprecated`. The default is `default`. Users are able to make updates to a provisioned product of a deprecated version but cannot launch new provisioned products using a deprecated version.
+* `name` - (Optional) Name of the provisioning artifact (for example, `v1`, `v2Beta`). No spaces are allowed.
+* `type` - (Optional) Type of provisioning artifact. See [AWS Docs](https://docs.aws.amazon.com/servicecatalog/latest/dg/API_ProvisioningArtifactProperties.html) for valid list of values.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `createdTime` - Time when the provisioning artifact was created.
+* `id` - Provisioning artifact identifier and product identifier separated by a colon.
+* `provisioningArtifactId` - Provisioning artifact identifier.
+* `status` - Status of the provisioning artifact.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `3M`)
+- `read` - (Default `10M`)
+- `update` - (Default `3M`)
+- `delete` - (Default `3M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsServicecatalogProvisioningArtifact` using the provisioning artifact ID and product ID separated by a colon. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsServicecatalogProvisioningArtifact` using the provisioning artifact ID and product ID separated by a colon. For example:
+
+```console
+% terraform import aws_servicecatalog_provisioning_artifact.example pa-ij2b6lusy6dec:prod-el3an0rma3
+```
+
+<!-- cache-key: cdktf-0.18.0 input-a7d327a6dfcafe1faac099b2d4490b5d1603912ff87a7717d27d809de4e883f3 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/servicecatalog_service_action.html.markdown b/website/docs/cdktf/typescript/r/servicecatalog_service_action.html.markdown
new file mode 100644
index 00000000000..63bf8d97e6d
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/servicecatalog_service_action.html.markdown
@@ -0,0 +1,106 @@
+---
+subcategory: "Service Catalog"
+layout: "aws"
+page_title: "AWS: aws_servicecatalog_service_action"
+description: |-
+  Manages a Service Catalog Service Action
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_servicecatalog_service_action
+
+Manages a Service Catalog self-service action.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ServicecatalogServiceAction } from "./.gen/providers/aws/servicecatalog-service-action";
+interface MyConfig {
+  version: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new ServicecatalogServiceAction(this, "example", {
+      definition: {
+        name: "AWS-RestartEC2Instance",
+        version: config.version,
+      },
+      description: "Motor generator unit",
+      name: "MGU",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `definition` - (Required) Self-service action definition configuration block. Detailed below.
+* `name` - (Required) Self-service action name.
+
+The following arguments are optional:
+
+* `acceptLanguage` - (Optional) Language code. Valid values are `en` (English), `jp` (Japanese), and `zh` (Chinese). Default is `en`.
+* `description` - (Optional) Self-service action description.
+
+### `definition`
+
+The `definition` configuration block supports the following attributes:
+
+* `assumeRole` - (Optional) ARN of the role that performs the self-service actions on your behalf. For example, `arn:aws:iam::12345678910:role/actionRole`. To reuse the provisioned product launch role, set to `launchRole`.
+* `name` - (Required) Name of the SSM document. For example, `awsRestartEc2Instance`. If you are using a shared SSM document, you must provide the ARN instead of the name.
+* `parameters` - (Optional) List of parameters in JSON format. For example: `[{\"name\":\"instanceId\",\"type\":\"target\"}]` or `[{\"name\":\"instanceId\",\"type\":\"textValue\"}]`.
+* `type` - (Optional) Service action definition type. Valid value is `ssmAutomation`. Default is `ssmAutomation`.
+* `version` - (Required) SSM document version. For example, `1`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Identifier of the service action.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `3M`)
+- `read` - (Default `10M`)
+- `update` - (Default `3M`)
+- `delete` - (Default `3M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsServicecatalogServiceAction` using the service action ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsServicecatalogServiceAction` using the service action ID. For example:
+
+```console
+% terraform import aws_servicecatalog_service_action.example act-f1w12eperfslh
+```
+
+<!-- cache-key: cdktf-0.18.0 input-b03d24933f6fa4d9688080ccdcaa7ae9e07d0a55178d18a59825eb23b87e379c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/servicecatalog_tag_option.html.markdown b/website/docs/cdktf/typescript/r/servicecatalog_tag_option.html.markdown
new file mode 100644
index 00000000000..f16d139272a
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/servicecatalog_tag_option.html.markdown
@@ -0,0 +1,89 @@
+---
+subcategory: "Service Catalog"
+layout: "aws"
+page_title: "AWS: aws_servicecatalog_tag_option"
+description: |-
+  Manages a Service Catalog Tag Option
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_servicecatalog_tag_option
+
+Manages a Service Catalog Tag Option.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ServicecatalogTagOption } from "./.gen/providers/aws/servicecatalog-tag-option";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ServicecatalogTagOption(this, "example", {
+      key: "nyckel",
+      value: "v\xE4rde",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `key` - (Required) Tag option key.
+* `value` - (Required) Tag option value.
+
+The following arguments are optional:
+
+* `active` - (Optional) Whether tag option is active. Default is `true`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Identifier (e.g., `tagPjtvagohlyo3M`).
+* `ownerId` - AWS account ID of the owner account that created the tag option.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `3M`)
+- `read` - (Default `10M`)
+- `update` - (Default `3M`)
+- `delete` - (Default `3M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsServicecatalogTagOption` using the tag option ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsServicecatalogTagOption` using the tag option ID. For example:
+
+```console
+% terraform import aws_servicecatalog_tag_option.example tag-pjtvagohlyo3m
+```
+
+<!-- cache-key: cdktf-0.18.0 input-728b29f4f06d3333a9bc0717ffd7b59ae4e6dcb209ccc4e9ac76b0b4c6cfb651 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/servicecatalog_tag_option_resource_association.html.markdown b/website/docs/cdktf/typescript/r/servicecatalog_tag_option_resource_association.html.markdown
new file mode 100644
index 00000000000..39899fd5b48
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/servicecatalog_tag_option_resource_association.html.markdown
@@ -0,0 +1,89 @@
+---
+subcategory: "Service Catalog"
+layout: "aws"
+page_title: "AWS: aws_servicecatalog_tag_option_resource_association"
+description: |-
+  Manages a Service Catalog Tag Option Resource Association
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_servicecatalog_tag_option_resource_association
+
+Manages a Service Catalog Tag Option Resource Association.
+
+-> **Tip:** A "resource" is either a Service Catalog portfolio or product.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ServicecatalogTagOptionResourceAssociation } from "./.gen/providers/aws/servicecatalog-tag-option-resource-association";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ServicecatalogTagOptionResourceAssociation(this, "example", {
+      resourceId: "prod-dnigbtea24ste",
+      tagOptionId: "tag-pjtvyakdlyo3m",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `resourceId` - (Required) Resource identifier.
+* `tagOptionId` - (Required) Tag Option identifier.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Identifier of the association.
+* `resourceArn` - ARN of the resource.
+* `resourceCreatedTime` - Creation time of the resource.
+* `resourceDescription` - Description of the resource.
+* `resourceName` - Description of the resource.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `3M`)
+- `read` - (Default `10M`)
+- `delete` - (Default `3M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsServicecatalogTagOptionResourceAssociation` using the tag option ID and resource ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsServicecatalogTagOptionResourceAssociation` using the tag option ID and resource ID. For example:
+
+```console
+% terraform import aws_servicecatalog_tag_option_resource_association.example tag-pjtvyakdlyo3m:prod-dnigbtea24ste
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ae36ed874f6f516a2530c784f0fe767eaadd12cbb9e4007a768baa831153ddc9 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/servicequotas_service_quota.html.markdown b/website/docs/cdktf/typescript/r/servicequotas_service_quota.html.markdown
new file mode 100644
index 00000000000..924933f819f
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/servicequotas_service_quota.html.markdown
@@ -0,0 +1,95 @@
+---
+subcategory: "Service Quotas"
+layout: "aws"
+page_title: "AWS: aws_servicequotas_service_quota"
+description: |-
+  Manages an individual Service Quota
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_servicequotas_service_quota
+
+Manages an individual Service Quota.
+
+~> **NOTE:** Global quotas apply to all AWS regions, but can only be accessed in `usEast1` in the Commercial partition or `usGovWest1` in the GovCloud partition. In other regions, the AWS API will return the error `The request failed because the specified service does not exist.`
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ServicequotasServiceQuota } from "./.gen/providers/aws/servicequotas-service-quota";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ServicequotasServiceQuota(this, "example", {
+      quotaCode: "L-F678F1CE",
+      serviceCode: "vpc",
+      value: 75,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `quotaCode` - (Required) Code of the service quota to track. For example: `lF678F1Ce`. Available values can be found with the [AWS CLI service-quotas list-service-quotas command](https://docs.aws.amazon.com/cli/latest/reference/service-quotas/list-service-quotas.html).
+* `serviceCode` - (Required) Code of the service to track. For example: `vpc`. Available values can be found with the [AWS CLI service-quotas list-services command](https://docs.aws.amazon.com/cli/latest/reference/service-quotas/list-services.html).
+* `value` - (Required) Float specifying the desired value for the service quota. If the desired value is higher than the current value, a quota increase request is submitted. When a known request is submitted and pending, the value reflects the desired value of the pending request.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `adjustable` - Whether the service quota can be increased.
+* `arn` - Amazon Resource Name (ARN) of the service quota.
+* `defaultValue` - Default value of the service quota.
+* `id` - Service code and quota code, separated by a front slash (`/`)
+* `quotaName` - Name of the quota.
+* `serviceName` - Name of the service.
+* `usageMetric` - Information about the measurement.
+    * `metricDimensions` - The metric dimensions.
+        * `class`
+        * `resource`
+        * `service`
+        * `type`
+    * `metricName` - The name of the metric.
+    * `metricNamespace` - The namespace of the metric.
+    * `metricStatisticRecommendation` - The metric statistic that AWS recommend you use when determining quota usage.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsServicequotasServiceQuota` using the service code and quota code, separated by a front slash (`/`). For example:
+
+~> **NOTE:** This resource does not require explicit import and will assume management of an existing service quota on Terraform resource creation.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsServicequotasServiceQuota` using the service code and quota code, separated by a front slash (`/`). For example:
+
+~> **NOTE:** This resource does not require explicit import and will assume management of an existing service quota on Terraform resource creation.
+
+```console
+% terraform import aws_servicequotas_service_quota.example vpc/L-F678F1CE
+```
+
+<!-- cache-key: cdktf-0.18.0 input-8925c6b8aa699116dcad422ba2332dd43139659327e20ceb1d3df872c9c113ea -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/servicequotas_template.html.markdown b/website/docs/cdktf/typescript/r/servicequotas_template.html.markdown
new file mode 100644
index 00000000000..55f0c230294
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/servicequotas_template.html.markdown
@@ -0,0 +1,84 @@
+---
+subcategory: "Service Quotas"
+layout: "aws"
+page_title: "AWS: aws_servicequotas_template"
+description: |-
+  Terraform resource for managing an AWS Service Quotas Template.
+---
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_servicequotas_template
+
+Terraform resource for managing an AWS Service Quotas Template.
+
+-> Only the management account of an organization can alter Service Quota templates, and this must be done from the `usEast1` region.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ServicequotasTemplate } from "./.gen/providers/aws/servicequotas-template";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ServicequotasTemplate(this, "example", {
+      quotaCode: "L-2ACBD22F",
+      region: "us-east-1",
+      serviceCode: "lambda",
+      value: Token.asNumber("80"),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `region` - (Required) AWS Region to which the template applies.
+* `quotaCode` - (Required) Quota identifier. To find the quota code for a specific quota, use the [aws_servicequotas_service_quota](../d/servicequotas_service_quota.html.markdown) data source.
+* `serviceCode` - (Required) Service identifier. To find the service code value for an AWS service, use the [aws_servicequotas_service](../d/servicequotas_service.html.markdown) data source.
+* `value` - (Required) The new, increased value for the quota.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `globalQuota` - Indicates whether the quota is global.
+* `id` - Unique identifier for the resource, which is a comma-delimited string separating `region`, `quotaCode`, and `serviceCode`.
+* `quotaName` - Quota name.
+* `serviceName` - Service name.
+* `unit` - Unit of measurement.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Service Quotas Template using the `exampleIdArg`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Service Quotas Template using the `id`. For example:
+
+```console
+% terraform import aws_servicequotas_template.example us-east-1,L-2ACBD22F,lambda
+```
+
+<!-- cache-key: cdktf-0.18.0 input-59282bf548034739d1f0003d1269d0e89ecfc39f7eb69a22de9c8d495c122b6f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/servicequotas_template_association.html.markdown b/website/docs/cdktf/typescript/r/servicequotas_template_association.html.markdown
new file mode 100644
index 00000000000..69a536e1ae2
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/servicequotas_template_association.html.markdown
@@ -0,0 +1,73 @@
+---
+subcategory: "Service Quotas"
+layout: "aws"
+page_title: "AWS: aws_servicequotas_template_association"
+description: |-
+  Terraform resource for managing an AWS Service Quotas Template Association.
+---
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_servicequotas_template_association
+
+Terraform resource for managing an AWS Service Quotas Template Association.
+
+-> Only the management account of an organization can associate Service Quota templates, and this must be done from the `usEast1` region.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ServicequotasTemplateAssociation } from "./.gen/providers/aws/servicequotas-template-association";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ServicequotasTemplateAssociation(this, "example", {});
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are optional:
+
+* `skipDestroy` - (Optional) Skip disassociating the quota increase template upon destruction. This will remove the resource from Terraform state, but leave the remote association in place.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - AWS account ID.
+* `status` - Association status. Creating this resource will result in an `associated` status, and quota increase requests in the template are automatically applied to new AWS accounts in the organization.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Service Quotas Template Association using the `exampleIdArg`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Service Quotas Template Association using the `id`. For example:
+
+```console
+% terraform import aws_servicequotas_template_association.example 012345678901 
+```
+
+<!-- cache-key: cdktf-0.18.0 input-fdad063536f53c98a55bc859f198823854c380bdaf86b74a52d56b0f744c6e20 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ses_active_receipt_rule_set.html.markdown b/website/docs/cdktf/typescript/r/ses_active_receipt_rule_set.html.markdown
new file mode 100644
index 00000000000..e6b8fbd199c
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/ses_active_receipt_rule_set.html.markdown
@@ -0,0 +1,72 @@
+---
+subcategory: "SES (Simple Email)"
+layout: "aws"
+page_title: "AWS: aws_ses_active_receipt_rule_set"
+description: |-
+  Provides a resource to designate the active SES receipt rule set
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ses_active_receipt_rule_set
+
+Provides a resource to designate the active SES receipt rule set
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SesActiveReceiptRuleSet } from "./.gen/providers/aws/ses-active-receipt-rule-set";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SesActiveReceiptRuleSet(this, "main", {
+      ruleSetName: "primary-rules",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `ruleSetName` - (Required) The name of the rule set
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The SES receipt rule set name.
+* `arn` - The SES receipt rule set ARN.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import active SES receipt rule sets using the rule set name. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import active SES receipt rule sets using the rule set name. For example:
+
+```console
+% terraform import aws_ses_active_receipt_rule_set.my_rule_set my_rule_set_name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-8aa116a29d3ebaa80524e2c31efd1f8f2d61078377ae336e09f4241a5b71237e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ses_configuration_set.html.markdown b/website/docs/cdktf/typescript/r/ses_configuration_set.html.markdown
new file mode 100644
index 00000000000..74b2ad49721
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/ses_configuration_set.html.markdown
@@ -0,0 +1,113 @@
+---
+subcategory: "SES (Simple Email)"
+layout: "aws"
+page_title: "AWS: aws_ses_configuration_set"
+description: |-
+  Provides an SES configuration set
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ses_configuration_set
+
+Provides an SES configuration set resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SesConfigurationSet } from "./.gen/providers/aws/ses-configuration-set";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SesConfigurationSet(this, "test", {
+      name: "some-configuration-set-test",
+    });
+  }
+}
+
+```
+
+### Require TLS Connections
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SesConfigurationSet } from "./.gen/providers/aws/ses-configuration-set";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SesConfigurationSet(this, "test", {
+      deliveryOptions: {
+        tlsPolicy: "Require",
+      },
+      name: "some-configuration-set-test",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following argument is required:
+
+* `name` - (Required) Name of the configuration set.
+
+The following argument is optional:
+
+* `deliveryOptions` - (Optional) Whether messages that use the configuration set are required to use TLS. See below.
+* `reputationMetricsEnabled` - (Optional) Whether or not Amazon SES publishes reputation metrics for the configuration set, such as bounce and complaint rates, to Amazon CloudWatch. The default value is `false`.
+* `sendingEnabled` - (Optional) Whether email sending is enabled or disabled for the configuration set. The default value is `true`.
+* `trackingOptions` - (Optional) Domain that is used to redirect email recipients to an Amazon SES-operated domain. See below. **NOTE:** This functionality is best effort.
+
+### delivery_options
+
+* `tlsPolicy` - (Optional) Whether messages that use the configuration set are required to use Transport Layer Security (TLS). If the value is `require`, messages are only delivered if a TLS connection can be established. If the value is `optional`, messages can be delivered in plain text if a TLS connection can't be established. Valid values: `require` or `optional`. Defaults to `optional`.
+
+### tracking_options
+
+* `customRedirectDomain` - (Optional) Custom subdomain that is used to redirect email recipients to the Amazon SES event tracking domain.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - SES configuration set ARN.
+* `id` - SES configuration set name.
+* `lastFreshStart` - Date and time at which the reputation metrics for the configuration set were last reset. Resetting these metrics is known as a fresh start.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SES Configuration Sets using their `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import SES Configuration Sets using their `name`. For example:
+
+```console
+% terraform import aws_ses_configuration_set.test some-configuration-set-test
+```
+
+<!-- cache-key: cdktf-0.18.0 input-f167d5f7a447e1e139965df3ad14d43f4a2543a8bacced24d5237b68849262b5 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ses_domain_dkim.html.markdown b/website/docs/cdktf/typescript/r/ses_domain_dkim.html.markdown
new file mode 100644
index 00000000000..28a1485f245
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/ses_domain_dkim.html.markdown
@@ -0,0 +1,111 @@
+---
+subcategory: "SES (Simple Email)"
+layout: "aws"
+page_title: "AWS: aws_ses_domain_dkim"
+description: |-
+  Provides an SES domain DKIM generation resource
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ses_domain_dkim
+
+Provides an SES domain DKIM generation resource.
+
+Domain ownership needs to be confirmed first using [ses_domain_identity Resource](/docs/providers/aws/r/ses_domain_identity.html)
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `domain` - (Required) Verified domain name to generate DKIM tokens for.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `dkimTokens` - DKIM tokens generated by SES.
+  These tokens should be used to create CNAME records used to verify SES Easy DKIM.
+  See below for an example of how this might be achieved
+  when the domain is hosted in Route 53 and managed by Terraform.
+  Find out more about verifying domains in Amazon SES
+  in the [AWS SES docs](http://docs.aws.amazon.com/ses/latest/DeveloperGuide/easy-dkim-dns-records.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformCount, Fn, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Route53Record } from "./.gen/providers/aws/route53-record";
+import { SesDomainDkim } from "./.gen/providers/aws/ses-domain-dkim";
+import { SesDomainIdentity } from "./.gen/providers/aws/ses-domain-identity";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new SesDomainIdentity(this, "example", {
+      domain: "example.com",
+    });
+    const awsSesDomainDkimExample = new SesDomainDkim(this, "example_1", {
+      domain: example.domain,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSesDomainDkimExample.overrideLogicalId("example");
+    /*In most cases loops should be handled in the programming language context and 
+    not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+    you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+    you need to keep this like it is.*/
+    const exampleAmazonsesDkimRecordCount = TerraformCount.of(
+      Token.asNumber("3")
+    );
+    new Route53Record(this, "example_amazonses_dkim_record", {
+      name:
+        Token.asString(
+          Fn.lookupNested(awsSesDomainDkimExample.dkimTokens, [
+            exampleAmazonsesDkimRecordCount.index,
+          ])
+        ) + "._domainkey",
+      records: [
+        Token.asString(
+          Fn.lookupNested(awsSesDomainDkimExample.dkimTokens, [
+            exampleAmazonsesDkimRecordCount.index,
+          ])
+        ) + ".dkim.amazonses.com",
+      ],
+      ttl: Token.asNumber("600"),
+      type: "CNAME",
+      zoneId: "ABCDEFGHIJ123",
+      count: exampleAmazonsesDkimRecordCount,
+    });
+  }
+}
+
+```
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DKIM tokens using the `domain` attribute. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import DKIM tokens using the `domain` attribute. For example:
+
+```console
+% terraform import aws_ses_domain_dkim.example example.com
+```
+
+<!-- cache-key: cdktf-0.18.0 input-39725dfa611ba6cca577c30709217ceb82a4f67575d3367fd44ba5c674ea4983 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ses_domain_identity.html.markdown b/website/docs/cdktf/typescript/r/ses_domain_identity.html.markdown
new file mode 100644
index 00000000000..b16558e3955
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/ses_domain_identity.html.markdown
@@ -0,0 +1,111 @@
+---
+subcategory: "SES (Simple Email)"
+layout: "aws"
+page_title: "AWS: aws_ses_domain_identity"
+description: |-
+  Provides an SES domain identity resource
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ses_domain_identity
+
+Provides an SES domain identity resource
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SesDomainIdentity } from "./.gen/providers/aws/ses-domain-identity";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SesDomainIdentity(this, "example", {
+      domain: "example.com",
+    });
+  }
+}
+
+```
+
+### With Route53 Record
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Route53Record } from "./.gen/providers/aws/route53-record";
+import { SesDomainIdentity } from "./.gen/providers/aws/ses-domain-identity";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new SesDomainIdentity(this, "example", {
+      domain: "example.com",
+    });
+    new Route53Record(this, "example_amazonses_verification_record", {
+      name: "_amazonses.example.com",
+      records: [example.verificationToken],
+      ttl: Token.asNumber("600"),
+      type: "TXT",
+      zoneId: "ABCDEFGHIJ123",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `domain` - (Required) The domain name to assign to SES
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the domain identity.
+* `verificationToken` - A code which when added to the domain as a TXT record
+  will signal to SES that the owner of the domain has authorised SES to act on
+  their behalf. The domain identity will be in state "verification pending"
+  until this is done. See the [With Route53 Record](#with-route53-record) example
+  for how this might be achieved when the domain is hosted in Route 53 and
+  managed by Terraform.  Find out more about verifying domains in Amazon
+  SES in the [AWS SES
+  docs](http://docs.aws.amazon.com/ses/latest/DeveloperGuide/verify-domains.html).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SES domain identities using the domain name. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import SES domain identities using the domain name. For example:
+
+```console
+% terraform import aws_ses_domain_identity.example example.com
+```
+
+<!-- cache-key: cdktf-0.18.0 input-cc2858bb0b9356bccdccc74446c2439c161fce45d5adfa4eb3e71a8f789e30b8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ses_domain_identity_verification.html.markdown b/website/docs/cdktf/typescript/r/ses_domain_identity_verification.html.markdown
new file mode 100644
index 00000000000..449d3c6ed5a
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/ses_domain_identity_verification.html.markdown
@@ -0,0 +1,79 @@
+---
+subcategory: "SES (Simple Email)"
+layout: "aws"
+page_title: "AWS: aws_ses_domain_identity_verification"
+description: |-
+  Waits for and checks successful verification of an SES domain identity.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ses_domain_identity_verification
+
+Represents a successful verification of an SES domain identity.
+
+Most commonly, this resource is used together with [`awsRoute53Record`](route53_record.html) and
+[`awsSesDomainIdentity`](ses_domain_identity.html) to request an SES domain identity,
+deploy the required DNS verification records, and wait for verification to complete.
+
+~> **WARNING:** This resource implements a part of the verification workflow. It does not represent a real-world entity in AWS, therefore changing or deleting this resource on its own has no immediate effect.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Route53Record } from "./.gen/providers/aws/route53-record";
+import { SesDomainIdentity } from "./.gen/providers/aws/ses-domain-identity";
+import { SesDomainIdentityVerification } from "./.gen/providers/aws/ses-domain-identity-verification";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new SesDomainIdentity(this, "example", {
+      domain: "example.com",
+    });
+    const exampleAmazonsesVerificationRecord = new Route53Record(
+      this,
+      "example_amazonses_verification_record",
+      {
+        name: "_amazonses.${" + example.id + "}",
+        records: [example.verificationToken],
+        ttl: Token.asNumber("600"),
+        type: "TXT",
+        zoneId: Token.asString(awsRoute53ZoneExample.zoneId),
+      }
+    );
+    new SesDomainIdentityVerification(this, "example_verification", {
+      dependsOn: [exampleAmazonsesVerificationRecord],
+      domain: example.id,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `domain` - (Required) The domain name of the SES domain identity to verify.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The domain name of the domain identity.
+* `arn` - The ARN of the domain identity.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `45M`)
+
+<!-- cache-key: cdktf-0.18.0 input-01264da5e2e5cedeff8b5da6bb3720236b99d8827e99483d8586f6e5626fdcb4 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ses_domain_mail_from.html.markdown b/website/docs/cdktf/typescript/r/ses_domain_mail_from.html.markdown
new file mode 100644
index 00000000000..46079642aeb
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/ses_domain_mail_from.html.markdown
@@ -0,0 +1,139 @@
+---
+subcategory: "SES (Simple Email)"
+layout: "aws"
+page_title: "AWS: aws_ses_domain_mail_from"
+description: |-
+  Provides an SES domain MAIL FROM resource
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ses_domain_mail_from
+
+Provides an SES domain MAIL FROM resource.
+
+~> **NOTE:** For the MAIL FROM domain to be fully usable, this resource should be paired with the [aws_ses_domain_identity resource](/docs/providers/aws/r/ses_domain_identity.html). To validate the MAIL FROM domain, a DNS MX record is required. To pass SPF checks, a DNS TXT record may also be required. See the [Amazon SES MAIL FROM documentation](https://docs.aws.amazon.com/ses/latest/dg/mail-from.html) for more information.
+
+## Example Usage
+
+### Domain Identity MAIL FROM
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Route53Record } from "./.gen/providers/aws/route53-record";
+import { SesDomainIdentity } from "./.gen/providers/aws/ses-domain-identity";
+import { SesDomainMailFrom } from "./.gen/providers/aws/ses-domain-mail-from";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new SesDomainIdentity(this, "example", {
+      domain: "example.com",
+    });
+    const awsSesDomainMailFromExample = new SesDomainMailFrom(
+      this,
+      "example_1",
+      {
+        domain: example.domain,
+        mailFromDomain: "bounce.${" + example.domain + "}",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSesDomainMailFromExample.overrideLogicalId("example");
+    new Route53Record(this, "example_ses_domain_mail_from_mx", {
+      name: Token.asString(awsSesDomainMailFromExample.mailFromDomain),
+      records: ["10 feedback-smtp.us-east-1.amazonses.com"],
+      ttl: Token.asNumber("600"),
+      type: "MX",
+      zoneId: Token.asString(awsRoute53ZoneExample.id),
+    });
+    new Route53Record(this, "example_ses_domain_mail_from_txt", {
+      name: Token.asString(awsSesDomainMailFromExample.mailFromDomain),
+      records: ["v=spf1 include:amazonses.com -all"],
+      ttl: Token.asNumber("600"),
+      type: "TXT",
+      zoneId: Token.asString(awsRoute53ZoneExample.id),
+    });
+  }
+}
+
+```
+
+### Email Identity MAIL FROM
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SesDomainMailFrom } from "./.gen/providers/aws/ses-domain-mail-from";
+import { SesEmailIdentity } from "./.gen/providers/aws/ses-email-identity";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new SesEmailIdentity(this, "example", {
+      email: "user@example.com",
+    });
+    const awsSesDomainMailFromExample = new SesDomainMailFrom(
+      this,
+      "example_1",
+      {
+        domain: example.email,
+        mailFromDomain: "mail.example.com",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSesDomainMailFromExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `domain` - (Required) Verified domain name or email identity to generate DKIM tokens for.
+* `mailFromDomain` - (Required) Subdomain (of above domain) which is to be used as MAIL FROM address (Required for DMARC validation)
+
+The following arguments are optional:
+
+* `behaviorOnMxFailure` - (Optional) The action that you want Amazon SES to take if it cannot successfully read the required MX record when you send an email. Defaults to `useDefaultValue`. See the [SES API documentation](https://docs.aws.amazon.com/ses/latest/APIReference/API_SetIdentityMailFromDomain.html) for more information.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The domain name.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import MAIL FROM domain using the `domain` attribute. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import MAIL FROM domain using the `domain` attribute. For example:
+
+```console
+% terraform import aws_ses_domain_mail_from.example example.com
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ca24fb442521ea4cf6a544f70a00738a2579cf348f475450dda372fb8e1b83f2 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ses_email_identity.html.markdown b/website/docs/cdktf/typescript/r/ses_email_identity.html.markdown
new file mode 100644
index 00000000000..a3e284dc42a
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/ses_email_identity.html.markdown
@@ -0,0 +1,71 @@
+---
+subcategory: "SES (Simple Email)"
+layout: "aws"
+page_title: "AWS: aws_ses_email_identity"
+description: |-
+  Provides an SES email identity resource
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ses_email_identity
+
+Provides an SES email identity resource
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `email` - (Required) The email address to assign to SES.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the email identity.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SesEmailIdentity } from "./.gen/providers/aws/ses-email-identity";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SesEmailIdentity(this, "example", {
+      email: "email@example.com",
+    });
+  }
+}
+
+```
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SES email identities using the email address. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import SES email identities using the email address. For example:
+
+```console
+% terraform import aws_ses_email_identity.example email@example.com
+```
+
+<!-- cache-key: cdktf-0.18.0 input-9ee137609ad9cb08db52c9c4a87855644f4683c0869afce90196dedff75a0c90 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ses_event_destination.html.markdown b/website/docs/cdktf/typescript/r/ses_event_destination.html.markdown
new file mode 100644
index 00000000000..29ad92f2243
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/ses_event_destination.html.markdown
@@ -0,0 +1,164 @@
+---
+subcategory: "SES (Simple Email)"
+layout: "aws"
+page_title: "AWS: aws_ses_event_destination"
+description: |-
+  Provides an SES event destination
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ses_event_destination
+
+Provides an SES event destination
+
+## Example Usage
+
+### CloudWatch Destination
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SesEventDestination } from "./.gen/providers/aws/ses-event-destination";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SesEventDestination(this, "cloudwatch", {
+      cloudwatchDestination: [
+        {
+          defaultValue: "default",
+          dimensionName: "dimension",
+          valueSource: "emailHeader",
+        },
+      ],
+      configurationSetName: example.name,
+      enabled: true,
+      matchingTypes: ["bounce", "send"],
+      name: "event-destination-cloudwatch",
+    });
+  }
+}
+
+```
+
+### Kinesis Destination
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SesEventDestination } from "./.gen/providers/aws/ses-event-destination";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SesEventDestination(this, "kinesis", {
+      configurationSetName: example.name,
+      enabled: true,
+      kinesisDestination: {
+        roleArn: Token.asString(awsIamRoleExample.arn),
+        streamArn: Token.asString(awsKinesisFirehoseDeliveryStreamExample.arn),
+      },
+      matchingTypes: ["bounce", "send"],
+      name: "event-destination-kinesis",
+    });
+  }
+}
+
+```
+
+### SNS Destination
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SesEventDestination } from "./.gen/providers/aws/ses-event-destination";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SesEventDestination(this, "sns", {
+      configurationSetName: example.name,
+      enabled: true,
+      matchingTypes: ["bounce", "send"],
+      name: "event-destination-sns",
+      snsDestination: {
+        topicArn: Token.asString(awsSnsTopicExample.arn),
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the event destination
+* `configurationSetName` - (Required) The name of the configuration set
+* `enabled` - (Optional) If true, the event destination will be enabled
+* `matchingTypes` - (Required) A list of matching types. May be any of `"send"`, `"reject"`, `"bounce"`, `"complaint"`, `"delivery"`, `"open"`, `"click"`, or `"renderingFailure"`.
+* `cloudwatchDestination` - (Optional) CloudWatch destination for the events
+* `kinesisDestination` - (Optional) Send the events to a kinesis firehose destination
+* `snsDestination` - (Optional) Send the events to an SNS Topic destination
+
+~> **NOTE:** You can specify `"cloudwatchDestination"` or `"kinesisDestination"` but not both
+
+### cloudwatch_destination Argument Reference
+
+* `defaultValue` - (Required) The default value for the event
+* `dimensionName` - (Required) The name for the dimension
+* `valueSource` - (Required) The source for the value. May be any of `"messageTag"`, `"emailHeader"` or `"linkTag"`.
+
+### kinesis_destination Argument Reference
+
+* `streamArn` - (Required) The ARN of the Kinesis Stream
+* `roleArn` - (Required) The ARN of the role that has permissions to access the Kinesis Stream
+
+### sns_destination Argument Reference
+
+* `topicArn` - (Required) The ARN of the SNS topic
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The SES event destination name.
+* `arn` - The SES event destination ARN.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SES event destinations using `configurationSetName` together with the event destination's `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import SES event destinations using `configurationSetName` together with the event destination's `name`. For example:
+
+```console
+% terraform import aws_ses_event_destination.sns some-configuration-set-test/event-destination-sns
+```
+
+<!-- cache-key: cdktf-0.18.0 input-03d0657b4ec477015386f442c464924c2a2cf73364ec9a281d1dab9658fde299 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ses_identity_notification_topic.html.markdown b/website/docs/cdktf/typescript/r/ses_identity_notification_topic.html.markdown
new file mode 100644
index 00000000000..e1308fc08eb
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/ses_identity_notification_topic.html.markdown
@@ -0,0 +1,75 @@
+---
+subcategory: "SES (Simple Email)"
+layout: "aws"
+page_title: "AWS: aws_ses_identity_notification_topic"
+description: |-
+  Setting AWS SES Identity Notification Topic
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ses_identity_notification_topic
+
+Resource for managing SES Identity Notification Topics
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SesIdentityNotificationTopic } from "./.gen/providers/aws/ses-identity-notification-topic";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SesIdentityNotificationTopic(this, "test", {
+      identity: example.domain,
+      includeOriginalHeaders: true,
+      notificationType: "Bounce",
+      topicArn: Token.asString(awsSnsTopicExample.arn),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `topicArn` - (Optional) The Amazon Resource Name (ARN) of the Amazon SNS topic. Can be set to `""` (an empty string) to disable publishing.
+* `notificationType` - (Required) The type of notifications that will be published to the specified Amazon SNS topic. Valid Values: `bounce`, `complaint` or `delivery`.
+* `identity` - (Required) The identity for which the Amazon SNS topic will be set. You can specify an identity by using its name or by using its Amazon Resource Name (ARN).
+* `includeOriginalHeaders` - (Optional) Whether SES should include original email headers in SNS notifications of this type. `false` by default.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Identity Notification Topics using the ID of the record. The ID is made up as `identity|type` where `identity` is the SES Identity and `type` is the Notification Type. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Identity Notification Topics using the ID of the record. The ID is made up as `identity|type` where `identity` is the SES Identity and `type` is the Notification Type. For example:
+
+```console
+% terraform import aws_ses_identity_notification_topic.test 'example.com|Bounce'
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1fd58b89206153f067a3a6422fdd5ac0bb0cbc19db85bec1ae6fff15e992d4ac -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ses_identity_notification_topic.markdown b/website/docs/cdktf/typescript/r/ses_identity_notification_topic.markdown
new file mode 100644
index 00000000000..e1308fc08eb
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/ses_identity_notification_topic.markdown
@@ -0,0 +1,75 @@
+---
+subcategory: "SES (Simple Email)"
+layout: "aws"
+page_title: "AWS: aws_ses_identity_notification_topic"
+description: |-
+  Setting AWS SES Identity Notification Topic
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ses_identity_notification_topic
+
+Resource for managing SES Identity Notification Topics
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SesIdentityNotificationTopic } from "./.gen/providers/aws/ses-identity-notification-topic";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SesIdentityNotificationTopic(this, "test", {
+      identity: example.domain,
+      includeOriginalHeaders: true,
+      notificationType: "Bounce",
+      topicArn: Token.asString(awsSnsTopicExample.arn),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `topicArn` - (Optional) The Amazon Resource Name (ARN) of the Amazon SNS topic. Can be set to `""` (an empty string) to disable publishing.
+* `notificationType` - (Required) The type of notifications that will be published to the specified Amazon SNS topic. Valid Values: `bounce`, `complaint` or `delivery`.
+* `identity` - (Required) The identity for which the Amazon SNS topic will be set. You can specify an identity by using its name or by using its Amazon Resource Name (ARN).
+* `includeOriginalHeaders` - (Optional) Whether SES should include original email headers in SNS notifications of this type. `false` by default.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Identity Notification Topics using the ID of the record. The ID is made up as `identity|type` where `identity` is the SES Identity and `type` is the Notification Type. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Identity Notification Topics using the ID of the record. The ID is made up as `identity|type` where `identity` is the SES Identity and `type` is the Notification Type. For example:
+
+```console
+% terraform import aws_ses_identity_notification_topic.test 'example.com|Bounce'
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1fd58b89206153f067a3a6422fdd5ac0bb0cbc19db85bec1ae6fff15e992d4ac -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ses_identity_policy.html.markdown b/website/docs/cdktf/typescript/r/ses_identity_policy.html.markdown
new file mode 100644
index 00000000000..84784abecba
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/ses_identity_policy.html.markdown
@@ -0,0 +1,104 @@
+---
+subcategory: "SES (Simple Email)"
+layout: "aws"
+page_title: "AWS: aws_ses_identity_policy"
+description: |-
+  Manages a SES Identity Policy
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ses_identity_policy
+
+Manages a SES Identity Policy. More information about SES Sending Authorization Policies can be found in the [SES Developer Guide](https://docs.aws.amazon.com/ses/latest/DeveloperGuide/sending-authorization-policies.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { SesDomainIdentity } from "./.gen/providers/aws/ses-domain-identity";
+import { SesIdentityPolicy } from "./.gen/providers/aws/ses-identity-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new SesDomainIdentity(this, "example", {
+      domain: "example.com",
+    });
+    const dataAwsIamPolicyDocumentExample = new DataAwsIamPolicyDocument(
+      this,
+      "example_1",
+      {
+        statement: [
+          {
+            actions: ["SES:SendEmail", "SES:SendRawEmail"],
+            principals: [
+              {
+                identifiers: ["*"],
+                type: "AWS",
+              },
+            ],
+            resources: [example.arn],
+          },
+        ],
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsIamPolicyDocumentExample.overrideLogicalId("example");
+    const awsSesIdentityPolicyExample = new SesIdentityPolicy(
+      this,
+      "example_2",
+      {
+        identity: example.arn,
+        name: "example",
+        policy: Token.asString(dataAwsIamPolicyDocumentExample.json),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSesIdentityPolicyExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `identity` - (Required) Name or Amazon Resource Name (ARN) of the SES Identity.
+* `name` - (Required) Name of the policy.
+* `policy` - (Required) JSON string of the policy. For more information about building AWS IAM policy documents with Terraform, see the [AWS IAM Policy Document Guide](https://learn.hashicorp.com/terraform/aws/iam-policy).
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SES Identity Policies using the identity and policy name, separated by a pipe character (`|`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import SES Identity Policies using the identity and policy name, separated by a pipe character (`|`). For example:
+
+```console
+% terraform import aws_ses_identity_policy.example 'example.com|example'
+```
+
+<!-- cache-key: cdktf-0.18.0 input-2c45ba1c268b42067effb76b3698082d64f075923127efb622a58e4e81a1ba1a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ses_receipt_filter.html.markdown b/website/docs/cdktf/typescript/r/ses_receipt_filter.html.markdown
new file mode 100644
index 00000000000..2c4cacfc701
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/ses_receipt_filter.html.markdown
@@ -0,0 +1,76 @@
+---
+subcategory: "SES (Simple Email)"
+layout: "aws"
+page_title: "AWS: aws_ses_receipt_filter"
+description: |-
+  Provides an SES receipt filter
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ses_receipt_filter
+
+Provides an SES receipt filter resource
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SesReceiptFilter } from "./.gen/providers/aws/ses-receipt-filter";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SesReceiptFilter(this, "filter", {
+      cidr: "10.10.10.10",
+      name: "block-spammer",
+      policy: "Block",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the filter
+* `cidr` - (Required) The IP address or address range to filter, in CIDR notation
+* `policy` - (Required) Block or Allow
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The SES receipt filter name.
+* `arn` - The SES receipt filter ARN.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SES Receipt Filter using their `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import SES Receipt Filter using their `name`. For example:
+
+```console
+% terraform import aws_ses_receipt_filter.test some-filter
+```
+
+<!-- cache-key: cdktf-0.18.0 input-8c7377efc81dac65453231c48c63abd93967d88ece4a6461b108dcb4049f1c6b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ses_receipt_rule.html.markdown b/website/docs/cdktf/typescript/r/ses_receipt_rule.html.markdown
new file mode 100644
index 00000000000..952711b9cb9
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/ses_receipt_rule.html.markdown
@@ -0,0 +1,150 @@
+---
+subcategory: "SES (Simple Email)"
+layout: "aws"
+page_title: "AWS: aws_ses_receipt_rule"
+description: |-
+  Provides an SES receipt rule resource
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ses_receipt_rule
+
+Provides an SES receipt rule resource
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SesReceiptRule } from "./.gen/providers/aws/ses-receipt-rule";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SesReceiptRule(this, "store", {
+      addHeaderAction: [
+        {
+          headerName: "Custom-Header",
+          headerValue: "Added by SES",
+          position: 1,
+        },
+      ],
+      enabled: true,
+      name: "store",
+      recipients: ["karen@example.com"],
+      ruleSetName: "default-rule-set",
+      s3Action: [
+        {
+          bucketName: "emails",
+          position: 2,
+        },
+      ],
+      scanEnabled: true,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the rule
+* `ruleSetName` - (Required) The name of the rule set
+* `after` - (Optional) The name of the rule to place this rule after
+* `enabled` - (Optional) If true, the rule will be enabled
+* `recipients` - (Optional) A list of email addresses
+* `scanEnabled` - (Optional) If true, incoming emails will be scanned for spam and viruses
+* `tlsPolicy` - (Optional) `require` or `optional`
+* `addHeaderAction` - (Optional) A list of Add Header Action blocks. Documented below.
+* `bounceAction` - (Optional) A list of Bounce Action blocks. Documented below.
+* `lambdaAction` - (Optional) A list of Lambda Action blocks. Documented below.
+* `s3Action` - (Optional) A list of S3 Action blocks. Documented below.
+* `snsAction` - (Optional) A list of SNS Action blocks. Documented below.
+* `stopAction` - (Optional) A list of Stop Action blocks. Documented below.
+* `workmailAction` - (Optional) A list of WorkMail Action blocks. Documented below.
+
+Add header actions support the following:
+
+* `headerName` - (Required) The name of the header to add
+* `headerValue` - (Required) The value of the header to add
+* `position` - (Required) The position of the action in the receipt rule
+
+Bounce actions support the following:
+
+* `message` - (Required) The message to send
+* `sender` - (Required) The email address of the sender
+* `smtpReplyCode` - (Required) The RFC 5321 SMTP reply code
+* `statusCode` - (Optional) The RFC 3463 SMTP enhanced status code
+* `topicArn` - (Optional) The ARN of an SNS topic to notify
+* `position` - (Required) The position of the action in the receipt rule
+
+Lambda actions support the following:
+
+* `functionArn` - (Required) The ARN of the Lambda function to invoke
+* `invocationType` - (Optional) `event` or `requestResponse`
+* `topicArn` - (Optional) The ARN of an SNS topic to notify
+* `position` - (Required) The position of the action in the receipt rule
+
+S3 actions support the following:
+
+* `bucketName` - (Required) The name of the S3 bucket
+* `kmsKeyArn` - (Optional) The ARN of the KMS key
+* `objectKeyPrefix` - (Optional) The key prefix of the S3 bucket
+* `topicArn` - (Optional) The ARN of an SNS topic to notify
+* `position` - (Required) The position of the action in the receipt rule
+
+SNS actions support the following:
+
+* `topicArn` - (Required) The ARN of an SNS topic to notify
+* `position` - (Required) The position of the action in the receipt rule
+* `encoding` - (Optional) The encoding to use for the email within the Amazon SNS notification. Default value is `utf8`.
+
+Stop actions support the following:
+
+* `scope` - (Required) The scope to apply. The only acceptable value is `ruleSet`.
+* `topicArn` - (Optional) The ARN of an SNS topic to notify
+* `position` - (Required) The position of the action in the receipt rule
+
+WorkMail actions support the following:
+
+* `organizationArn` - (Required) The ARN of the WorkMail organization
+* `topicArn` - (Optional) The ARN of an SNS topic to notify
+* `position` - (Required) The position of the action in the receipt rule
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The SES receipt rule name.
+* `arn` - The SES receipt rule ARN.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SES receipt rules using the ruleset name and rule name separated by `:`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import SES receipt rules using the ruleset name and rule name separated by `:`. For example:
+
+```console
+% terraform import aws_ses_receipt_rule.my_rule my_rule_set:my_rule
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ab45199c3afbc7c5a3c72ec3d4ff7c87e01a23be591b82978865a7ece9fb3494 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ses_receipt_rule_set.html.markdown b/website/docs/cdktf/typescript/r/ses_receipt_rule_set.html.markdown
new file mode 100644
index 00000000000..80bad905d99
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/ses_receipt_rule_set.html.markdown
@@ -0,0 +1,72 @@
+---
+subcategory: "SES (Simple Email)"
+layout: "aws"
+page_title: "AWS: aws_ses_receipt_rule_set"
+description: |-
+  Provides an SES receipt rule set resource
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ses_receipt_rule_set
+
+Provides an SES receipt rule set resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SesReceiptRuleSet } from "./.gen/providers/aws/ses-receipt-rule-set";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SesReceiptRuleSet(this, "main", {
+      ruleSetName: "primary-rules",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `ruleSetName` - (Required) Name of the rule set.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - SES receipt rule set ARN.
+* `id` - SES receipt rule set name.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SES receipt rule sets using the rule set name. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import SES receipt rule sets using the rule set name. For example:
+
+```console
+% terraform import aws_ses_receipt_rule_set.my_rule_set my_rule_set_name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-0d877bac24ed87212b80e2c78837bf3e21a1e3f3f1043d12a6eba7d226aa1682 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ses_template.html.markdown b/website/docs/cdktf/typescript/r/ses_template.html.markdown
new file mode 100644
index 00000000000..f1d6c02a9a0
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/ses_template.html.markdown
@@ -0,0 +1,78 @@
+---
+subcategory: "SES (Simple Email)"
+layout: "aws"
+page_title: "AWS: aws_ses_template"
+description: |-
+  Provides a resource to create a SES template
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ses_template
+
+Provides a resource to create a SES template.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SesTemplate } from "./.gen/providers/aws/ses-template";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SesTemplate(this, "MyTemplate", {
+      html: "<h1>Hello {{name}},</h1><p>Your favorite animal is {{favoriteanimal}}.</p>",
+      name: "MyTemplate",
+      subject: "Greetings, {{name}}!",
+      text: "Hello {{name}},\r\nYour favorite animal is {{favoriteanimal}}.\n",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the template. Cannot exceed 64 characters. You will refer to this name when you send email.
+* `html` - (Optional) The HTML body of the email. Must be less than 500KB in size, including both the text and HTML parts.
+* `subject` - (Optional) The subject line of the email.
+* `text` - (Optional) The email body that will be visible to recipients whose email clients do not display HTML. Must be less than 500KB in size, including both the text and HTML parts.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the SES template
+* `id` - The name of the SES template
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SES templates using the template name. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import SES templates using the template name. For example:
+
+```console
+% terraform import aws_ses_template.MyTemplate MyTemplate
+```
+
+<!-- cache-key: cdktf-0.18.0 input-89f6a47e22acad1bd893a7574f8e49d30c8778128ae5a667746ded2b1f55f3f8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/sesv2_account_vdm_attributes.html.markdown b/website/docs/cdktf/typescript/r/sesv2_account_vdm_attributes.html.markdown
new file mode 100644
index 00000000000..a12ec7aaec2
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/sesv2_account_vdm_attributes.html.markdown
@@ -0,0 +1,90 @@
+---
+subcategory: "SESv2 (Simple Email V2)"
+layout: "aws"
+page_title: "AWS: aws_sesv2_account_vdm_attributes"
+description: |-
+  Terraform resource for managing an AWS SESv2 (Simple Email V2) Account VDM Attributes.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sesv2_account_vdm_attributes
+
+Terraform resource for managing an AWS SESv2 (Simple Email V2) Account VDM Attributes.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Sesv2AccountVdmAttributes } from "./.gen/providers/aws/sesv2-account-vdm-attributes";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Sesv2AccountVdmAttributes(this, "example", {
+      dashboardAttributes: {
+        engagementMetrics: "ENABLED",
+      },
+      guardianAttributes: {
+        optimizedSharedDelivery: "ENABLED",
+      },
+      vdmEnabled: "ENABLED",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `vdmEnabled` - (Required) Specifies the status of your VDM configuration. Valid values: `enabled`, `disabled`.
+
+The following arguments are optional:
+
+* `dashboardAttributes` - (Optional) Specifies additional settings for your VDM configuration as applicable to the Dashboard.
+* `guardianAttributes` - (Optional) Specifies additional settings for your VDM configuration as applicable to the Guardian.
+
+### dashboard_attributes
+
+* `engagementMetrics` - (Optional) Specifies the status of your VDM engagement metrics collection. Valid values: `enabled`, `disabled`.
+
+### guardian_attributes
+
+* `optimizedSharedDelivery` - (Optional) Specifies the status of your VDM optimized shared delivery. Valid values: `enabled`, `disabled`.
+
+## Attribute Reference
+
+This data source exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SESv2 (Simple Email V2) Account VDM Attributes using the word `sesAccountVdmAttributes`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import SESv2 (Simple Email V2) Account VDM Attributes using the word `sesAccountVdmAttributes`. For example:
+
+```console
+% terraform import aws_sesv2_account_vdm_attributes.example ses-account-vdm-attributes
+```
+
+<!-- cache-key: cdktf-0.18.0 input-b4d0b06f4304f2a2394a2efa012918dd4528d7fc4bfc11ed8de9b1f68d2751e1 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/sesv2_configuration_set.html.markdown b/website/docs/cdktf/typescript/r/sesv2_configuration_set.html.markdown
new file mode 100644
index 00000000000..fcb3d4dc3d2
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/sesv2_configuration_set.html.markdown
@@ -0,0 +1,137 @@
+---
+subcategory: "SESv2 (Simple Email V2)"
+layout: "aws"
+page_title: "AWS: aws_sesv2_configuration_set"
+description: |-
+  Terraform resource for managing an AWS SESv2 (Simple Email V2) Configuration Set.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sesv2_configuration_set
+
+Terraform resource for managing an AWS SESv2 (Simple Email V2) Configuration Set.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Sesv2ConfigurationSet } from "./.gen/providers/aws/sesv2-configuration-set";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Sesv2ConfigurationSet(this, "example", {
+      configurationSetName: "example",
+      deliveryOptions: {
+        tlsPolicy: "REQUIRE",
+      },
+      reputationOptions: {
+        reputationMetricsEnabled: false,
+      },
+      sendingOptions: {
+        sendingEnabled: true,
+      },
+      suppressionOptions: {
+        suppressedReasons: ["BOUNCE", "COMPLAINT"],
+      },
+      trackingOptions: {
+        customRedirectDomain: "example.com",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `configurationSetName` - (Required) The name of the configuration set.
+* `deliveryOptions` - (Optional) An object that defines the dedicated IP pool that is used to send emails that you send using the configuration set.
+* `reputationOptions` - (Optional) An object that defines whether or not Amazon SES collects reputation metrics for the emails that you send that use the configuration set.
+* `sendingOptions` - (Optional) An object that defines whether or not Amazon SES can send email that you send using the configuration set.
+* `suppressionOptions` - (Optional) An object that contains information about the suppression list preferences for your account.
+* `tags` - (Optional) A map of tags to assign to the service. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `trackingOptions` - (Optional) An object that defines the open and click tracking options for emails that you send using the configuration set.
+* `vdmOptions` - (Optional) An object that defines the VDM settings that apply to emails that you send using the configuration set.
+
+### delivery_options
+
+This argument supports the following arguments:
+
+* `sendingPoolName` - (Optional) The name of the dedicated IP pool to associate with the configuration set.
+* `tlsPolicy` - (Optional) Specifies whether messages that use the configuration set are required to use Transport Layer Security (TLS). Valid values: `require`, `optional`.
+
+### reputation_options
+
+This argument supports the following arguments:
+
+* `reputationMetricsEnabled` - (Optional) If `true`, tracking of reputation metrics is enabled for the configuration set. If `false`, tracking of reputation metrics is disabled for the configuration set.
+
+### sending_options
+
+This argument supports the following arguments:
+
+* `sendingEnabled` - (Optional) If `true`, email sending is enabled for the configuration set. If `false`, email sending is disabled for the configuration set.
+
+### suppression_options
+
+* `suppressedReasons` - (Optional) A list that contains the reasons that email addresses are automatically added to the suppression list for your account. Valid values: `bounce`, `complaint`.
+
+### tracking_options
+
+* `customRedirectDomain` - (Required) The domain to use for tracking open and click events.
+
+### vdm_options
+
+* `dashboardOptions` - (Optional) Specifies additional settings for your VDM configuration as applicable to the Dashboard.
+* `guardianOptions` - (Optional) Specifies additional settings for your VDM configuration as applicable to the Guardian.
+
+### dashboard_options
+
+* `engagementMetrics` - (Optional) Specifies the status of your VDM engagement metrics collection. Valid values: `enabled`, `disabled`.
+
+### guardian_options
+
+* `optimizedSharedDelivery` - (Optional) Specifies the status of your VDM optimized shared delivery. Valid values: `enabled`, `disabled`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Configuration Set.
+* `reputationOptions` - An object that defines whether or not Amazon SES collects reputation metrics for the emails that you send that use the configuration set.
+    * `lastFreshStart` - The date and time (in Unix time) when the reputation metrics were last given a fresh start. When your account is given a fresh start, your reputation metrics are calculated starting from the date of the fresh start.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SESv2 (Simple Email V2) Configuration Set using the `configurationSetName`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import SESv2 (Simple Email V2) Configuration Set using the `configurationSetName`. For example:
+
+```console
+% terraform import aws_sesv2_configuration_set.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-10e28775dfdb49d09b8bd0c0f6dc69fead8aab4b14b0a6b4b6476ac6de7c155d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/sesv2_configuration_set_event_destination.html.markdown b/website/docs/cdktf/typescript/r/sesv2_configuration_set_event_destination.html.markdown
new file mode 100644
index 00000000000..6b638ac0bef
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/sesv2_configuration_set_event_destination.html.markdown
@@ -0,0 +1,265 @@
+---
+subcategory: "SESv2 (Simple Email V2)"
+layout: "aws"
+page_title: "AWS: aws_sesv2_configuration_set_event_destination"
+description: |-
+  Terraform resource for managing an AWS SESv2 (Simple Email V2) Configuration Set Event Destination.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sesv2_configuration_set_event_destination
+
+Terraform resource for managing an AWS SESv2 (Simple Email V2) Configuration Set Event Destination.
+
+## Example Usage
+
+### Cloud Watch Destination
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Sesv2ConfigurationSet } from "./.gen/providers/aws/sesv2-configuration-set";
+import { Sesv2ConfigurationSetEventDestination } from "./.gen/providers/aws/sesv2-configuration-set-event-destination";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new Sesv2ConfigurationSet(this, "example", {
+      configurationSetName: "example",
+    });
+    const awsSesv2ConfigurationSetEventDestinationExample =
+      new Sesv2ConfigurationSetEventDestination(this, "example_1", {
+        configurationSetName: example.configurationSetName,
+        eventDestination: {
+          cloudWatchDestination: {
+            dimensionConfiguration: [
+              {
+                defaultDimensionValue: "example",
+                dimensionName: "example",
+                dimensionValueSource: "MESSAGE_TAG",
+              },
+            ],
+          },
+          enabled: true,
+          matchingEventTypes: ["SEND"],
+        },
+        eventDestinationName: "example",
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSesv2ConfigurationSetEventDestinationExample.overrideLogicalId(
+      "example"
+    );
+  }
+}
+
+```
+
+### Kinesis Firehose Destination
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Sesv2ConfigurationSet } from "./.gen/providers/aws/sesv2-configuration-set";
+import { Sesv2ConfigurationSetEventDestination } from "./.gen/providers/aws/sesv2-configuration-set-event-destination";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new Sesv2ConfigurationSet(this, "example", {
+      configurationSetName: "example",
+    });
+    const awsSesv2ConfigurationSetEventDestinationExample =
+      new Sesv2ConfigurationSetEventDestination(this, "example_1", {
+        configurationSetName: example.configurationSetName,
+        eventDestination: {
+          enabled: true,
+          kinesisFirehoseDestination: {
+            deliveryStreamArn: Token.asString(
+              awsKinesisFirehoseDeliveryStreamExample.arn
+            ),
+            iamRoleArn: Token.asString(awsIamRoleExample.arn),
+          },
+          matchingEventTypes: ["SEND"],
+        },
+        eventDestinationName: "example",
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSesv2ConfigurationSetEventDestinationExample.overrideLogicalId(
+      "example"
+    );
+  }
+}
+
+```
+
+### Pinpoint Destination
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Sesv2ConfigurationSet } from "./.gen/providers/aws/sesv2-configuration-set";
+import { Sesv2ConfigurationSetEventDestination } from "./.gen/providers/aws/sesv2-configuration-set-event-destination";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new Sesv2ConfigurationSet(this, "example", {
+      configurationSetName: "example",
+    });
+    const awsSesv2ConfigurationSetEventDestinationExample =
+      new Sesv2ConfigurationSetEventDestination(this, "example_1", {
+        configurationSetName: example.configurationSetName,
+        eventDestination: {
+          enabled: true,
+          matchingEventTypes: ["SEND"],
+          pinpointDestination: {
+            applicationArn: Token.asString(awsPinpointAppExample.arn),
+          },
+        },
+        eventDestinationName: "example",
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSesv2ConfigurationSetEventDestinationExample.overrideLogicalId(
+      "example"
+    );
+  }
+}
+
+```
+
+### SNS Destination
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Sesv2ConfigurationSet } from "./.gen/providers/aws/sesv2-configuration-set";
+import { Sesv2ConfigurationSetEventDestination } from "./.gen/providers/aws/sesv2-configuration-set-event-destination";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new Sesv2ConfigurationSet(this, "example", {
+      configurationSetName: "example",
+    });
+    const awsSesv2ConfigurationSetEventDestinationExample =
+      new Sesv2ConfigurationSetEventDestination(this, "example_1", {
+        configurationSetName: example.configurationSetName,
+        eventDestination: {
+          enabled: true,
+          matchingEventTypes: ["SEND"],
+          snsDestination: {
+            topicArn: Token.asString(awsSnsTopicExample.arn),
+          },
+        },
+        eventDestinationName: "example",
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSesv2ConfigurationSetEventDestinationExample.overrideLogicalId(
+      "example"
+    );
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `configurationSetName` - (Required) The name of the configuration set.
+* `eventDestination` - (Required) A name that identifies the event destination within the configuration set.
+* `eventDestinationName` - (Required) An object that defines the event destination. See [event_destination](#event_destination) below.
+
+### event_destination
+
+The following arguments are required:
+
+* `matchingEventTypes` - (Required) - An array that specifies which events the Amazon SES API v2 should send to the destinations. Valid values: `send`, `reject`, `bounce`, `complaint`, `delivery`, `open`, `click`, `renderingFailure`, `deliveryDelay`, `subscription`.
+
+The following arguments are optional:
+
+* `cloudWatchDestination` - (Optional) An object that defines an Amazon CloudWatch destination for email events. See [cloud_watch_destination](#cloud_watch_destination) below
+* `enabled` - (Optional) When the event destination is enabled, the specified event types are sent to the destinations. Default: `false`.
+* `kinesisFirehoseDestination` - (Optional) An object that defines an Amazon Kinesis Data Firehose destination for email events. See [kinesis_firehose_destination](#kinesis_firehose_destination) below.
+* `pinpointDestination` - (Optional) An object that defines an Amazon Pinpoint project destination for email events. See [pinpoint_destination](#pinpoint_destination) below.
+* `snsDestination` - (Optional) An object that defines an Amazon SNS destination for email events. See [sns_destination](#sns_destination) below.
+
+### cloud_watch_destination
+
+The following arguments are required:
+
+* `dimensionConfiguration` - (Required) An array of objects that define the dimensions to use when you send email events to Amazon CloudWatch. See [dimension_configuration](#dimension_configuration) below.
+
+### dimension_configuration
+
+The following arguments are required:
+
+* `defaultDimensionValue` - (Required) The default value of the dimension that is published to Amazon CloudWatch if you don't provide the value of the dimension when you send an email.
+* `dimensionName` - (Required) The name of an Amazon CloudWatch dimension associated with an email sending metric.
+* `dimensionValueSource` - (Required) The location where the Amazon SES API v2 finds the value of a dimension to publish to Amazon CloudWatch. Valid values: `messageTag`, `emailHeader`, `linkTag`.
+
+### kinesis_firehose_destination
+
+The following arguments are required:
+
+* `deliveryStreamArn` - (Required) The Amazon Resource Name (ARN) of the Amazon Kinesis Data Firehose stream that the Amazon SES API v2 sends email events to.
+* `iamRoleArn` - (Required) The Amazon Resource Name (ARN) of the IAM role that the Amazon SES API v2 uses to send email events to the Amazon Kinesis Data Firehose stream.
+
+### pinpoint_destination
+
+The following arguments are required:
+
+* `pinpointApplicationArn` - (Required) The Amazon Resource Name (ARN) of the Amazon Pinpoint project to send email events to.
+
+### sns_destination
+
+The following arguments are required:
+
+* `topicArn` - (Required) The Amazon Resource Name (ARN) of the Amazon SNS topic to publish email events to.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - A pipe-delimited string combining `configurationSetName` and `eventDestinationName`.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SESv2 (Simple Email V2) Configuration Set Event Destination using the `id` (`configurationSetName|eventDestinationName`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import SESv2 (Simple Email V2) Configuration Set Event Destination using the `id` (`configurationSetName|eventDestinationName`). For example:
+
+```console
+% terraform import aws_sesv2_configuration_set_event_destination.example example_configuration_set|example_event_destination
+```
+
+<!-- cache-key: cdktf-0.18.0 input-cad711a1f404bc31687becda354a170176c8e53426698806bef4713eb256b918 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/sesv2_contact_list.html.markdown b/website/docs/cdktf/typescript/r/sesv2_contact_list.html.markdown
new file mode 100644
index 00000000000..84fb0202424
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/sesv2_contact_list.html.markdown
@@ -0,0 +1,123 @@
+---
+subcategory: "SESv2 (Simple Email V2)"
+layout: "aws"
+page_title: "AWS: aws_sesv2_contact_list"
+description: |-
+  Terraform resource for managing an AWS SESv2 (Simple Email V2) Contact List.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sesv2_contact_list
+
+Terraform resource for managing an AWS SESv2 (Simple Email V2) Contact List.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Sesv2ContactList } from "./.gen/providers/aws/sesv2-contact-list";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Sesv2ContactList(this, "example", {
+      contactListName: "example",
+    });
+  }
+}
+
+```
+
+### Extended Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Sesv2ContactList } from "./.gen/providers/aws/sesv2-contact-list";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Sesv2ContactList(this, "example", {
+      contactListName: "example",
+      description: "description",
+      topic: [
+        {
+          defaultSubscriptionStatus: "OPT_IN",
+          description: "topic description",
+          displayName: "Example Topic",
+          topicName: "example-topic",
+        },
+      ],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `contactListName` - (Required) The name of the contact list.
+
+The following arguments are optional:
+
+* `description` - (Optional) A description of what the contact list is about.
+* `tags` - (Optional) Key-value map of resource tags for the contact list. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `topic` - (Optional) Configuration block(s) with topic for the contact list. Detailed below.
+
+### topic
+
+The following arguments are required:
+
+* `defaultSubscriptionStatus` - (Required) The default subscription status to be applied to a contact if the contact has not noted their preference for subscribing to a topic.
+* `displayName` - (Required) The name of the topic the contact will see.
+* `topicName` - (Required) The name of the topic.
+
+The following arguments are optional:
+
+* `description` - (Optional) A description of what the topic is about, which the contact will see.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `createdTimestamp` - A timestamp noting when the contact list was created in ISO 8601 format.
+* `lastUpdatedTimestamp` - A timestamp noting the last time the contact list was updated in ISO 8601 format.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SESv2 (Simple Email V2) Contact List using the `exampleIdArg`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import SESv2 (Simple Email V2) Contact List using the `exampleIdArg`. For example:
+
+```console
+% terraform import aws_sesv2_contact_list.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-bf6ee9d89685af78292cb0d5392a6357f5844d7e092a1f578086fbf6539e59a5 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/sesv2_dedicated_ip_assignment.html.markdown b/website/docs/cdktf/typescript/r/sesv2_dedicated_ip_assignment.html.markdown
new file mode 100644
index 00000000000..8b8a196a898
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/sesv2_dedicated_ip_assignment.html.markdown
@@ -0,0 +1,84 @@
+---
+subcategory: "SESv2 (Simple Email V2)"
+layout: "aws"
+page_title: "AWS: aws_sesv2_dedicated_ip_assignment"
+description: |-
+  Terraform resource for managing an AWS SESv2 (Simple Email V2) Dedicated IP Assignment.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sesv2_dedicated_ip_assignment
+
+Terraform resource for managing an AWS SESv2 (Simple Email V2) Dedicated IP Assignment.
+
+This resource is used with "Standard" dedicated IP addresses. This includes addresses [requested and relinquished manually](https://docs.aws.amazon.com/ses/latest/dg/dedicated-ip-case.html) via an AWS support case, or [Bring Your Own IP](https://docs.aws.amazon.com/ses/latest/dg/dedicated-ip-byo.html) addresses. Once no longer assigned, this resource returns the IP to the [`sesDefaultDedicatedPool`](https://docs.aws.amazon.com/ses/latest/dg/managing-ip-pools.html), managed by AWS.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Sesv2DedicatedIpAssignment } from "./.gen/providers/aws/sesv2-dedicated-ip-assignment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Sesv2DedicatedIpAssignment(this, "example", {
+      destinationPoolName: "my-pool",
+      ip: "0.0.0.0",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `ip` - (Required) Dedicated IP address.
+* `destinationPoolName` - (Required) Dedicated IP address.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - A comma-separated string made up of `ip` and `destinationPoolName`.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `30M`)
+* `delete` - (Default `30M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SESv2 (Simple Email V2) Dedicated IP Assignment using the `id`, which is a comma-separated string made up of `ip` and `destinationPoolName`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import SESv2 (Simple Email V2) Dedicated IP Assignment using the `id`, which is a comma-separated string made up of `ip` and `destinationPoolName`. For example:
+
+```console
+% terraform import aws_sesv2_dedicated_ip_assignment.example "0.0.0.0,my-pool"
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ad1eca5879354d37ff31d84910a7c75bc98ff4e0846d438b18b1ca96ed71fe9f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/sesv2_dedicated_ip_pool.html.markdown b/website/docs/cdktf/typescript/r/sesv2_dedicated_ip_pool.html.markdown
new file mode 100644
index 00000000000..926c33f9610
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/sesv2_dedicated_ip_pool.html.markdown
@@ -0,0 +1,109 @@
+---
+subcategory: "SESv2 (Simple Email V2)"
+layout: "aws"
+page_title: "AWS: aws_sesv2_dedicated_ip_pool"
+description: |-
+  Terraform resource for managing an AWS SESv2 (Simple Email V2) Dedicated IP Pool.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sesv2_dedicated_ip_pool
+
+Terraform resource for managing an AWS SESv2 (Simple Email V2) Dedicated IP Pool.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Sesv2DedicatedIpPool } from "./.gen/providers/aws/sesv2-dedicated-ip-pool";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Sesv2DedicatedIpPool(this, "example", {
+      poolName: "my-pool",
+    });
+  }
+}
+
+```
+
+### Managed Pool
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Sesv2DedicatedIpPool } from "./.gen/providers/aws/sesv2-dedicated-ip-pool";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Sesv2DedicatedIpPool(this, "example", {
+      poolName: "my-managed-pool",
+      scalingMode: "MANAGED",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `poolName` - (Required) Name of the dedicated IP pool.
+
+The following arguments are optional:
+
+* `scalingMode` - (Optional) IP pool scaling mode. Valid values: `standard`, `managed`. If omitted, the AWS API will default to a standard pool.
+* `tags` - (Optional) A map of tags to assign to the pool. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Dedicated IP Pool.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `30M`)
+* `update` - (Default `30M`)
+* `delete` - (Default `30M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SESv2 (Simple Email V2) Dedicated IP Pool using the `poolName`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import SESv2 (Simple Email V2) Dedicated IP Pool using the `poolName`. For example:
+
+```console
+% terraform import aws_sesv2_dedicated_ip_pool.example my-pool
+```
+
+<!-- cache-key: cdktf-0.18.0 input-0803493a6210a46636d12167a1f3177b733cfc4fbdc40d4043f26a173d0508db -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/sesv2_email_identity.html.markdown b/website/docs/cdktf/typescript/r/sesv2_email_identity.html.markdown
new file mode 100644
index 00000000000..57283229258
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/sesv2_email_identity.html.markdown
@@ -0,0 +1,182 @@
+---
+subcategory: "SESv2 (Simple Email V2)"
+layout: "aws"
+page_title: "AWS: aws_sesv2_email_identity"
+description: |-
+  Terraform resource for managing an AWS SESv2 (Simple Email V2) Email Identity.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sesv2_email_identity
+
+Terraform resource for managing an AWS SESv2 (Simple Email V2) Email Identity.
+
+## Example Usage
+
+### Basic Usage
+
+#### Email Address Identity
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Sesv2EmailIdentity } from "./.gen/providers/aws/sesv2-email-identity";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Sesv2EmailIdentity(this, "example", {
+      emailIdentity: "testing@example.com",
+    });
+  }
+}
+
+```
+
+#### Domain Identity
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Sesv2EmailIdentity } from "./.gen/providers/aws/sesv2-email-identity";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Sesv2EmailIdentity(this, "example", {
+      emailIdentity: "example.com",
+    });
+  }
+}
+
+```
+
+#### Configuration Set
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Sesv2ConfigurationSet } from "./.gen/providers/aws/sesv2-configuration-set";
+import { Sesv2EmailIdentity } from "./.gen/providers/aws/sesv2-email-identity";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new Sesv2ConfigurationSet(this, "example", {
+      configurationSetName: "example",
+    });
+    const awsSesv2EmailIdentityExample = new Sesv2EmailIdentity(
+      this,
+      "example_1",
+      {
+        configurationSetName: example.configurationSetName,
+        emailIdentity: "example.com",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSesv2EmailIdentityExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+#### DKIM Signing Attributes (BYODKIM)
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Sesv2EmailIdentity } from "./.gen/providers/aws/sesv2-email-identity";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Sesv2EmailIdentity(this, "example", {
+      dkimSigningAttributes: {
+        domainSigningPrivateKey:
+          "MIIJKAIBAAKCAgEA2Se7p8zvnI4yh+Gh9j2rG5e2aRXjg03Y8saiupLnadPH9xvM...",
+        domainSigningSelector: "example",
+      },
+      emailIdentity: "example.com",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `emailIdentity` - (Required) The email address or domain to verify.
+
+The following arguments are optional:
+
+* `configurationSetName` - (Optional) The configuration set to use by default when sending from this identity. Note that any configuration set defined in the email sending request takes precedence.
+* `dkimSigningAttributes` - (Optional) The configuration of the DKIM authentication settings for an email domain identity.
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`defaultTags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### dkim_signing_attributes
+
+* `domainSigningPrivateKey` - (Optional, Sensitive) [Bring Your Own DKIM] A private key that's used to generate a DKIM signature. The private key must use 1024 or 2048-bit RSA encryption, and must be encoded using base64 encoding.
+
+-> **NOTE:** You have to delete the first and last lines ('-----BEGIN PRIVATE KEY-----' and '-----END PRIVATE KEY-----', respectively) of the generated private key. Additionally, you have to remove the line breaks in the generated private key. The resulting value is a string of characters with no spaces or line breaks.
+
+* `domainSigningSelector` - (Optional) [Bring Your Own DKIM] A string that's used to identify a public key in the DNS configuration for a domain.
+* `nextSigningKeyLength` - (Optional) [Easy DKIM] The key length of the future DKIM key pair to be generated. This can be changed at most once per day. Valid values: `rsa1024Bit`, `rsa2048Bit`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Email Identity.
+* `dkimSigningAttributes` - A list of objects that contains at most one element with information about the private key and selector that you want to use to configure DKIM for the identity for Bring Your Own DKIM (BYODKIM) for the identity, or, configures the key length to be used for Easy DKIM.
+    * `currentSigningKeyLength` - [Easy DKIM] The key length of the DKIM key pair in use.
+    * `lastKeyGenerationTimestamp` - [Easy DKIM] The last time a key pair was generated for this identity.
+    * `nextSigningKeyLength` - [Easy DKIM] The key length of the future DKIM key pair to be generated. This can be changed at most once per day.
+    * `signingAttributesOrigin` - A string that indicates how DKIM was configured for the identity. `awsSes` indicates that DKIM was configured for the identity by using Easy DKIM. `external` indicates that DKIM was configured for the identity by using Bring Your Own DKIM (BYODKIM).
+    * `status` - Describes whether or not Amazon SES has successfully located the DKIM records in the DNS records for the domain. See the [AWS SES API v2 Reference](https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_DkimAttributes.html#SES-Type-DkimAttributes-Status) for supported statuses.
+    * `tokens` - If you used Easy DKIM to configure DKIM authentication for the domain, then this object contains a set of unique strings that you use to create a set of CNAME records that you add to the DNS configuration for your domain. When Amazon SES detects these records in the DNS configuration for your domain, the DKIM authentication process is complete. If you configured DKIM authentication for the domain by providing your own public-private key pair, then this object contains the selector for the public key.
+* `identityType` - The email identity type. Valid values: `emailAddress`, `domain`.
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block).
+* `verifiedForSendingStatus` - Specifies whether or not the identity is verified.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SESv2 (Simple Email V2) Email Identity using the `emailIdentity`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import SESv2 (Simple Email V2) Email Identity using the `emailIdentity`. For example:
+
+```console
+% terraform import aws_sesv2_email_identity.example example.com
+```
+
+<!-- cache-key: cdktf-0.18.0 input-28f1021df6e78a4dec2007cff0687b2638fab5bbf6cfb378ee2edfc2129cd0b1 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/sesv2_email_identity_feedback_attributes.html.markdown b/website/docs/cdktf/typescript/r/sesv2_email_identity_feedback_attributes.html.markdown
new file mode 100644
index 00000000000..ce6bd80198f
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/sesv2_email_identity_feedback_attributes.html.markdown
@@ -0,0 +1,80 @@
+---
+subcategory: "SESv2 (Simple Email V2)"
+layout: "aws"
+page_title: "AWS: aws_sesv2_email_identity_feedback_attributes"
+description: |-
+  Terraform resource for managing an AWS SESv2 (Simple Email V2) Email Identity Feedback Attributes.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sesv2_email_identity_feedback_attributes
+
+Terraform resource for managing an AWS SESv2 (Simple Email V2) Email Identity Feedback Attributes.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Sesv2EmailIdentity } from "./.gen/providers/aws/sesv2-email-identity";
+import { Sesv2EmailIdentityFeedbackAttributes } from "./.gen/providers/aws/sesv2-email-identity-feedback-attributes";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new Sesv2EmailIdentity(this, "example", {
+      emailIdentity: "example.com",
+    });
+    const awsSesv2EmailIdentityFeedbackAttributesExample =
+      new Sesv2EmailIdentityFeedbackAttributes(this, "example_1", {
+        emailForwardingEnabled: true,
+        emailIdentity: example.emailIdentity,
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSesv2EmailIdentityFeedbackAttributesExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `emailIdentity` - (Required) The email identity.
+* `emailForwardingEnabled` - (Optional) Sets the feedback forwarding configuration for the identity.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SESv2 (Simple Email V2) Email Identity Feedback Attributes using the `emailIdentity`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import SESv2 (Simple Email V2) Email Identity Feedback Attributes using the `emailIdentity`. For example:
+
+```console
+% terraform import aws_sesv2_email_identity_feedback_attributes.example example.com
+```
+
+<!-- cache-key: cdktf-0.18.0 input-a16fc314df24381c673aaaa9609cba3c1505976385baba55655cc1f20a10ac61 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/sesv2_email_identity_mail_from_attributes.html.markdown b/website/docs/cdktf/typescript/r/sesv2_email_identity_mail_from_attributes.html.markdown
new file mode 100644
index 00000000000..440d02ea992
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/sesv2_email_identity_mail_from_attributes.html.markdown
@@ -0,0 +1,82 @@
+---
+subcategory: "SESv2 (Simple Email V2)"
+layout: "aws"
+page_title: "AWS: aws_sesv2_email_identity_mail_from_attributes"
+description: |-
+  Terraform resource for managing an AWS SESv2 (Simple Email V2) Email Identity Mail From Attributes.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sesv2_email_identity_mail_from_attributes
+
+Terraform resource for managing an AWS SESv2 (Simple Email V2) Email Identity Mail From Attributes.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Sesv2EmailIdentity } from "./.gen/providers/aws/sesv2-email-identity";
+import { Sesv2EmailIdentityMailFromAttributes } from "./.gen/providers/aws/sesv2-email-identity-mail-from-attributes";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new Sesv2EmailIdentity(this, "example", {
+      emailIdentity: "example.com",
+    });
+    const awsSesv2EmailIdentityMailFromAttributesExample =
+      new Sesv2EmailIdentityMailFromAttributes(this, "example_1", {
+        behaviorOnMxFailure: "REJECT_MESSAGE",
+        emailIdentity: example.emailIdentity,
+        mailFromDomain: "subdomain.${" + example.emailIdentity + "}",
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSesv2EmailIdentityMailFromAttributesExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `emailIdentity` - (Required) The verified email identity.
+* `behaviorOnMxFailure` - (Optional) The action to take if the required MX record isn't found when you send an email. Valid values: `useDefaultValue`, `rejectMessage`.
+* `mailFromDomain` - (Optional) The custom MAIL FROM domain that you want the verified identity to use. Required if `behaviorOnMxFailure` is `rejectMessage`.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SESv2 (Simple Email V2) Email Identity Mail From Attributes using the `emailIdentity`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import SESv2 (Simple Email V2) Email Identity Mail From Attributes using the `emailIdentity`. For example:
+
+```console
+% terraform import aws_sesv2_email_identity_mail_from_attributes.example example.com
+```
+
+<!-- cache-key: cdktf-0.18.0 input-3a9a88db16593e085c12ffe4c38e264061edc67814a816a38867c84c36efd10f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/sfn_activity.html.markdown b/website/docs/cdktf/typescript/r/sfn_activity.html.markdown
new file mode 100644
index 00000000000..897047acc50
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/sfn_activity.html.markdown
@@ -0,0 +1,75 @@
+---
+subcategory: "SFN (Step Functions)"
+layout: "aws"
+page_title: "AWS: aws_sfn_activity"
+description: |-
+  Provides a Step Function Activity resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sfn_activity
+
+Provides a Step Function Activity resource
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SfnActivity } from "./.gen/providers/aws/sfn-activity";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SfnActivity(this, "sfn_activity", {
+      name: "my-activity",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the activity to create.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Amazon Resource Name (ARN) that identifies the created activity.
+* `name` - The name of the activity.
+* `creationDate` - The date the activity was created.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import activities using the `arn`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import activities using the `arn`. For example:
+
+```console
+% terraform import aws_sfn_activity.foo arn:aws:states:eu-west-1:123456789098:activity:bar
+```
+
+<!-- cache-key: cdktf-0.18.0 input-b746a508f0ba70e5e33d2b67354b7a5e7df87f2c17e0b40685ebc5ce6df1ca33 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/sfn_alias.html.markdown b/website/docs/cdktf/typescript/r/sfn_alias.html.markdown
new file mode 100644
index 00000000000..2a20bbeffee
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/sfn_alias.html.markdown
@@ -0,0 +1,102 @@
+---
+subcategory: "SFN (Step Functions)"
+layout: "aws"
+page_title: "AWS: aws_sfn_alias"
+description: |-
+  Provides a Step Function State Machine Alias.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sfn_alias
+
+Provides a Step Function State Machine Alias.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SfnAlias } from "./.gen/providers/aws/sfn-alias";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SfnAlias(this, "my_sfn_alias", {
+      name: "my_sfn_alias",
+      routingConfiguration: [
+        {
+          stateMachineVersionArn:
+            "arn:aws:states:us-east-1:12345:stateMachine:demo:3",
+          weight: 50,
+        },
+        {
+          stateMachineVersionArn:
+            "arn:aws:states:us-east-1:12345:stateMachine:demo:2",
+          weight: 50,
+        },
+      ],
+    });
+    new SfnAlias(this, "sfn_alias", {
+      name: "my_sfn_alias",
+      routingConfiguration: [
+        {
+          stateMachineVersionArn: sfnTest.stateMachineVersionArn,
+          weight: 100,
+        },
+      ],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) Name for the alias you are creating.
+* `description` - (Optional) Description of the alias.
+* `routingConfiguration` - (Required) The StateMachine alias' route configuration settings. Fields documented below
+
+`routingConfiguration` supports the following arguments:
+
+* `stateMachineVersionArn` - (Required) The Amazon Resource Name (ARN) of the state machine version.
+* `weight` - (Required) Percentage of traffic routed to the state machine version.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) identifying your state machine alias.
+* `creationDate` - The date the state machine alias was created.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SFN (Step Functions) Alias using the `arn`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import SFN (Step Functions) Alias using the `arn`. For example:
+
+```console
+% terraform import aws_sfn_alias.foo arn:aws:states:us-east-1:123456789098:stateMachine:myStateMachine:foo
+```
+
+<!-- cache-key: cdktf-0.18.0 input-bfd0b99447354a387498343e81e37140646e8c656cabd51886388e3b57f53683 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/sfn_state_machine.html.markdown b/website/docs/cdktf/typescript/r/sfn_state_machine.html.markdown
new file mode 100644
index 00000000000..427c99a89d7
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/sfn_state_machine.html.markdown
@@ -0,0 +1,199 @@
+---
+subcategory: "SFN (Step Functions)"
+layout: "aws"
+page_title: "AWS: aws_sfn_state_machine"
+description: |-
+  Provides a Step Function State Machine resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sfn_state_machine
+
+Provides a Step Function State Machine resource
+
+## Example Usage
+
+### Basic (Standard Workflow)
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SfnStateMachine } from "./.gen/providers/aws/sfn-state-machine";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SfnStateMachine(this, "sfn_state_machine", {
+      definition:
+        '{\n  "Comment": "A Hello World example of the Amazon States Language using an AWS Lambda Function",\n  "StartAt": "HelloWorld",\n  "States": {\n    "HelloWorld": {\n      "Type": "Task",\n      "Resource": "${' +
+        lambda.arn +
+        '}",\n      "End": true\n    }\n  }\n}\n\n',
+      name: "my-state-machine",
+      roleArn: iamForSfn.arn,
+    });
+  }
+}
+
+```
+
+### Basic (Express Workflow)
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SfnStateMachine } from "./.gen/providers/aws/sfn-state-machine";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SfnStateMachine(this, "sfn_state_machine", {
+      definition:
+        '{\n  "Comment": "A Hello World example of the Amazon States Language using an AWS Lambda Function",\n  "StartAt": "HelloWorld",\n  "States": {\n    "HelloWorld": {\n      "Type": "Task",\n      "Resource": "${' +
+        lambda.arn +
+        '}",\n      "End": true\n    }\n  }\n}\n\n',
+      name: "my-state-machine",
+      roleArn: iamForSfn.arn,
+      type: "EXPRESS",
+    });
+  }
+}
+
+```
+
+### Publish (Publish SFN version)
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SfnStateMachine } from "./.gen/providers/aws/sfn-state-machine";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SfnStateMachine(this, "sfn_state_machine", {
+      definition:
+        '{\n  "Comment": "A Hello World example of the Amazon States Language using an AWS Lambda Function",\n  "StartAt": "HelloWorld",\n  "States": {\n    "HelloWorld": {\n      "Type": "Task",\n      "Resource": "${' +
+        lambda.arn +
+        '}",\n      "End": true\n    }\n  }\n}\n\n',
+      name: "my-state-machine",
+      publish: true,
+      roleArn: iamForSfn.arn,
+      type: "EXPRESS",
+    });
+  }
+}
+
+```
+
+### Logging
+
+~> *NOTE:* See the [AWS Step Functions Developer Guide](https://docs.aws.amazon.com/step-functions/latest/dg/welcome.html) for more information about enabling Step Function logging.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SfnStateMachine } from "./.gen/providers/aws/sfn-state-machine";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SfnStateMachine(this, "sfn_state_machine", {
+      definition:
+        '{\n  "Comment": "A Hello World example of the Amazon States Language using an AWS Lambda Function",\n  "StartAt": "HelloWorld",\n  "States": {\n    "HelloWorld": {\n      "Type": "Task",\n      "Resource": "${' +
+        lambda.arn +
+        '}",\n      "End": true\n    }\n  }\n}\n\n',
+      loggingConfiguration: {
+        includeExecutionData: true,
+        level: "ERROR",
+        logDestination: "${" + logGroupForSfn.arn + "}:*",
+      },
+      name: "my-state-machine",
+      roleArn: iamForSfn.arn,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `definition` - (Required) The [Amazon States Language](https://docs.aws.amazon.com/step-functions/latest/dg/concepts-amazon-states-language.html) definition of the state machine.
+* `loggingConfiguration` - (Optional) Defines what execution history events are logged and where they are logged. The `loggingConfiguration` parameter is only valid when `type` is set to `express`. Defaults to `off`. For more information see [Logging Express Workflows](https://docs.aws.amazon.com/step-functions/latest/dg/cw-logs.html) and [Log Levels](https://docs.aws.amazon.com/step-functions/latest/dg/cloudwatch-log-level.html) in the AWS Step Functions User Guide.
+* `name` - (Optional) The name of the state machine. The name should only contain `0`-`9`, `a`-`z`, `a`-`z`, `-` and `_`. If omitted, Terraform will assign a random, unique name.
+* `namePrefix` - (Optional) Creates a unique name beginning with the specified prefix. Conflicts with `name`.
+* `publish` - (Optional) Set to true to publish a version of the state machine during creation. Default: false.
+* `roleArn` - (Required) The Amazon Resource Name (ARN) of the IAM role to use for this state machine.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `tracingConfiguration` - (Optional) Selects whether AWS X-Ray tracing is enabled.
+* `type` - (Optional) Determines whether a Standard or Express state machine is created. The default is `standard`. You cannot update the type of a state machine once it has been created. Valid values: `standard`, `express`.
+
+### `loggingConfiguration` Configuration Block
+
+* `includeExecutionData` - (Optional) Determines whether execution data is included in your log. When set to `false`, data is excluded.
+* `level` - (Optional) Defines which category of execution history events are logged. Valid values: `all`, `error`, `fatal`, `off`
+* `logDestination` - (Optional) Amazon Resource Name (ARN) of a CloudWatch log group. Make sure the State Machine has the correct IAM policies for logging. The ARN must end with `:*`
+
+### `tracingConfiguration` Configuration Block
+
+* `enabled` - (Optional) When set to `true`, AWS X-Ray tracing is enabled. Make sure the State Machine has the correct IAM policies for logging. See the [AWS Step Functions Developer Guide](https://docs.aws.amazon.com/step-functions/latest/dg/xray-iam.html) for details.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ARN of the state machine.
+* `arn` - The ARN of the state machine.
+* `creationDate` - The date the state machine was created.
+* `status` - The current status of the state machine. Either `active` or `deleting`.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `5M`)
+* `update` - (Default `1M`)
+* `delete` - (Default `5M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import State Machines using the `arn`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import State Machines using the `arn`. For example:
+
+```console
+% terraform import aws_sfn_state_machine.foo arn:aws:states:eu-west-1:123456789098:stateMachine:bar
+```
+
+<!-- cache-key: cdktf-0.18.0 input-f08ea369e176242c031d2aef1b09ffa720bc2fe422b8ec36899abd05e99d76aa -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/shield_application_layer_automatic_response.html.markdown b/website/docs/cdktf/typescript/r/shield_application_layer_automatic_response.html.markdown
new file mode 100644
index 00000000000..506834a066c
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/shield_application_layer_automatic_response.html.markdown
@@ -0,0 +1,68 @@
+---
+subcategory: "Shield"
+layout: "aws"
+page_title: "AWS: aws_shield_application_layer_automatic_response"
+description: |-
+  Terraform resource for managing an AWS Shield Application Layer Automatic Response.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_shield_application_layer_automatic_response
+
+Terraform resource for managing an AWS Shield Application Layer Automatic Response for automatic DDoS mitigation.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCallerIdentity } from "./.gen/providers/aws/data-aws-caller-identity";
+import { DataAwsPartition } from "./.gen/providers/aws/data-aws-partition";
+import { DataAwsRegion } from "./.gen/providers/aws/data-aws-region";
+import { ShieldApplicationLayerAutomaticResponse } from "./.gen/providers/aws/shield-application-layer-automatic-response";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const current = new DataAwsCallerIdentity(this, "current", {});
+    const dataAwsPartitionCurrent = new DataAwsPartition(this, "current_1", {});
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsPartitionCurrent.overrideLogicalId("current");
+    const dataAwsRegionCurrent = new DataAwsRegion(this, "current_2", {});
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsRegionCurrent.overrideLogicalId("current");
+    new ShieldApplicationLayerAutomaticResponse(this, "example", {
+      action: "COUNT",
+      resourceArn:
+        "arn:${" +
+        dataAwsPartitionCurrent.partition +
+        "}:cloudfront:${" +
+        current.accountId +
+        "}:distribution/${" +
+        distributionId.value +
+        "}",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `resourceArn` - (Required) ARN of the resource to protect (Cloudfront Distributions and ALBs only at this time).
+* `action` - (Required) One of `count` or `block`
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+<!-- cache-key: cdktf-0.18.0 input-f7a331080867c085f8aaa43e07461e7380ab4d874abfb04d35ff548376c8399b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/shield_drt_access_log_bucket_association.html.markdown b/website/docs/cdktf/typescript/r/shield_drt_access_log_bucket_association.html.markdown
new file mode 100644
index 00000000000..bda9ca671fd
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/shield_drt_access_log_bucket_association.html.markdown
@@ -0,0 +1,64 @@
+---
+subcategory: "Shield"
+layout: "aws"
+page_title: "AWS: aws_shield_drt_access_log_bucket_association"
+description: |-
+  Terraform resource for managing an AWS Shield DRT Access Log Bucket Association.
+---
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_shield_drt_access_log_bucket_association
+
+Terraform resource for managing an AWS Shield DRT Access Log Bucket Association. Up to 10 log buckets can be associated for DRT Access sharing with the Shield Response Team (SRT).
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ShieldDrtAccessLogBucketAssociation } from "./.gen/providers/aws/shield-drt-access-log-bucket-association";
+import { ShieldDrtAccessRoleArnAssociation } from "./.gen/providers/aws/shield-drt-access-role-arn-association";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const test = new ShieldDrtAccessRoleArnAssociation(this, "test", {
+      roleArn:
+        "arn:aws:iam:${" +
+        current.name +
+        "}:${" +
+        dataAwsCallerIdentityCurrent.accountId +
+        "}:${" +
+        shieldDrtAccessRoleName.value +
+        "}",
+    });
+    const awsShieldDrtAccessLogBucketAssociationTest =
+      new ShieldDrtAccessLogBucketAssociation(this, "test_1", {
+        logBucket: shieldDrtAccessLogBucket.stringValue,
+        roleArnAssociationId: test.id,
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsShieldDrtAccessLogBucketAssociationTest.overrideLogicalId("test");
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `logBucket` - (Required) The Amazon S3 bucket that contains the logs that you want to share.
+* `roleArnAssociationId` - (Required) The ID of the Role Arn association used for allowing Shield DRT Access.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+<!-- cache-key: cdktf-0.18.0 input-656b1afbb8775b70190efdaf5f68489d2af84b003cf6a6c301a6cbe7edd709fe -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/shield_drt_access_role_arn_association.html.markdown b/website/docs/cdktf/typescript/r/shield_drt_access_role_arn_association.html.markdown
new file mode 100644
index 00000000000..500a4f6ee5e
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/shield_drt_access_role_arn_association.html.markdown
@@ -0,0 +1,82 @@
+---
+subcategory: "Shield"
+layout: "aws"
+page_title: "AWS: aws_shield_drt_access_role_arn_association"
+description: |-
+  Terraform resource for managing an AWS Shield DRT Access Role Arn Association.
+---
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_shield_drt_access_role_arn_association
+
+Authorizes the Shield Response Team (SRT) using the specified role, to access your AWS account to assist with DDoS attack mitigation during potential attacks. For more information see [Configure AWS SRT Support](https://docs.aws.amazon.com/waf/latest/developerguide/authorize-srt.html)
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { IamRole } from "./.gen/providers/aws/iam-role";
+import { IamRolePolicyAttachment } from "./.gen/providers/aws/iam-role-policy-attachment";
+import { ShieldDrtAccessRoleArnAssociation } from "./.gen/providers/aws/shield-drt-access-role-arn-association";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const test = new IamRole(this, "test", {
+      assumeRolePolicy: Token.asString(
+        Fn.jsonencode({
+          Statement: [
+            {
+              Action: "sts:AssumeRole",
+              Effect: "Allow",
+              Principal: {
+                Service: "drt.shield.amazonaws.com",
+              },
+              Sid: "",
+            },
+          ],
+          Version: "2012-10-17",
+        })
+      ),
+      name: awsShieldDrtAccessRoleArn.stringValue,
+    });
+    const awsIamRolePolicyAttachmentTest = new IamRolePolicyAttachment(
+      this,
+      "test_1",
+      {
+        policyArn:
+          "arn:aws:iam::aws:policy/service-role/AWSShieldDRTAccessPolicy",
+        role: test.name,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamRolePolicyAttachmentTest.overrideLogicalId("test");
+    const awsShieldDrtAccessRoleArnAssociationTest =
+      new ShieldDrtAccessRoleArnAssociation(this, "test_2", {
+        roleArn: test.arn,
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsShieldDrtAccessRoleArnAssociationTest.overrideLogicalId("test");
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `roleArn` - (Required) The Amazon Resource Name (ARN) of the role the SRT will use to access your AWS account. Prior to making the AssociateDRTRole request, you must attach the `awsShieldDrtAccessPolicy` managed policy to this role.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+<!-- cache-key: cdktf-0.18.0 input-87f4a7efb72b32010cf15694804e32b6ba653e7f1593d4f49f88dd39db828bfb -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/shield_protection.html.markdown b/website/docs/cdktf/typescript/r/shield_protection.html.markdown
new file mode 100644
index 00000000000..b552262fe94
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/shield_protection.html.markdown
@@ -0,0 +1,103 @@
+---
+subcategory: "Shield"
+layout: "aws"
+page_title: "AWS: aws_shield_protection"
+description: |-
+  Enables AWS Shield Advanced for a specific AWS resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_shield_protection
+
+Enables AWS Shield Advanced for a specific AWS resource.
+The resource can be an Amazon CloudFront distribution, Elastic Load Balancing load balancer, AWS Global Accelerator accelerator, Elastic IP Address, or an Amazon Route 53 hosted zone.
+
+## Example Usage
+
+### Create protection
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsAvailabilityZones } from "./.gen/providers/aws/data-aws-availability-zones";
+import { DataAwsCallerIdentity } from "./.gen/providers/aws/data-aws-caller-identity";
+import { DataAwsRegion } from "./.gen/providers/aws/data-aws-region";
+import { Eip } from "./.gen/providers/aws/eip";
+import { ShieldProtection } from "./.gen/providers/aws/shield-protection";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new Eip(this, "example", {
+      domain: "vpc",
+    });
+    new DataAwsAvailabilityZones(this, "available", {});
+    const current = new DataAwsCallerIdentity(this, "current", {});
+    const dataAwsRegionCurrent = new DataAwsRegion(this, "current_3", {});
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsRegionCurrent.overrideLogicalId("current");
+    const awsShieldProtectionExample = new ShieldProtection(this, "example_4", {
+      name: "example",
+      resourceArn:
+        "arn:aws:ec2:${" +
+        dataAwsRegionCurrent.name +
+        "}:${" +
+        current.accountId +
+        "}:eip-allocation/${" +
+        example.id +
+        "}",
+      tags: {
+        Environment: "Dev",
+      },
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsShieldProtectionExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) A friendly name for the Protection you are creating.
+* `resourceArn` - (Required) The ARN (Amazon Resource Name) of the resource to be protected.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The unique identifier (ID) for the Protection object that is created.
+* `arn` - The ARN of the Protection.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Shield protection resources using specifying their ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Shield protection resources using specifying their ID. For example:
+
+```console
+% terraform import aws_shield_protection.example ff9592dc-22f3-4e88-afa1-7b29fde9669a
+```
+
+<!-- cache-key: cdktf-0.18.0 input-35847768aaaa80ceec4dd0e0320b0024c8b87792dc136354d8b49f64094399b6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/shield_protection_group.html.markdown b/website/docs/cdktf/typescript/r/shield_protection_group.html.markdown
new file mode 100644
index 00000000000..73e5844c644
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/shield_protection_group.html.markdown
@@ -0,0 +1,172 @@
+---
+subcategory: "Shield"
+layout: "aws"
+page_title: "AWS: aws_shield_protection_group"
+description: |-
+  Creates a grouping of protected resources so they can be handled as a collective.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_shield_protection_group
+
+Creates a grouping of protected resources so they can be handled as a collective.
+This resource grouping improves the accuracy of detection and reduces false positives. For more information see
+[Managing AWS Shield Advanced protection groups](https://docs.aws.amazon.com/waf/latest/developerguide/manage-protection-group.html)
+
+## Example Usage
+
+### Create protection group for all resources
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ShieldProtectionGroup } from "./.gen/providers/aws/shield-protection-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ShieldProtectionGroup(this, "example", {
+      aggregation: "MAX",
+      pattern: "ALL",
+      protectionGroupId: "example",
+    });
+  }
+}
+
+```
+
+### Create protection group for arbitrary number of resources
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCallerIdentity } from "./.gen/providers/aws/data-aws-caller-identity";
+import { DataAwsRegion } from "./.gen/providers/aws/data-aws-region";
+import { Eip } from "./.gen/providers/aws/eip";
+import { ShieldProtection } from "./.gen/providers/aws/shield-protection";
+import { ShieldProtectionGroup } from "./.gen/providers/aws/shield-protection-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new Eip(this, "example", {
+      domain: "vpc",
+    });
+    const current = new DataAwsCallerIdentity(this, "current", {});
+    const dataAwsRegionCurrent = new DataAwsRegion(this, "current_2", {});
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsRegionCurrent.overrideLogicalId("current");
+    const awsShieldProtectionExample = new ShieldProtection(this, "example_3", {
+      name: "example",
+      resourceArn:
+        "arn:aws:ec2:${" +
+        dataAwsRegionCurrent.name +
+        "}:${" +
+        current.accountId +
+        "}:eip-allocation/${" +
+        example.id +
+        "}",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsShieldProtectionExample.overrideLogicalId("example");
+    const awsShieldProtectionGroupExample = new ShieldProtectionGroup(
+      this,
+      "example_4",
+      {
+        aggregation: "MEAN",
+        dependsOn: [awsShieldProtectionExample],
+        members: [
+          "arn:aws:ec2:${" +
+            dataAwsRegionCurrent.name +
+            "}:${" +
+            current.accountId +
+            "}:eip-allocation/${" +
+            example.id +
+            "}",
+        ],
+        pattern: "ARBITRARY",
+        protectionGroupId: "example",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsShieldProtectionGroupExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### Create protection group for a type of resource
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { ShieldProtectionGroup } from "./.gen/providers/aws/shield-protection-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new ShieldProtectionGroup(this, "example", {
+      aggregation: "SUM",
+      pattern: "BY_RESOURCE_TYPE",
+      protectionGroupId: "example",
+      resourceType: "ELASTIC_IP_ALLOCATION",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `aggregation` - (Required) Defines how AWS Shield combines resource data for the group in order to detect, mitigate, and report events.
+* `members` - (Optional) The Amazon Resource Names (ARNs) of the resources to include in the protection group. You must set this when you set `pattern` to ARBITRARY and you must not set it for any other `pattern` setting.
+* `pattern` - (Required) The criteria to use to choose the protected resources for inclusion in the group.
+* `protectionGroupId` - (Required) The name of the protection group.
+* `resourceType` - (Optional) The resource type to include in the protection group. You must set this when you set `pattern` to BY_RESOURCE_TYPE and you must not set it for any other `pattern` setting.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `protectionGroupArn` - The ARN (Amazon Resource Name) of the protection group.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Shield protection group resources using their protection group id. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Shield protection group resources using their protection group id. For example:
+
+```console
+% terraform import aws_shield_protection_group.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-9103f77296ecb9a47e4f678129df33c848d457b7cd5625270622bbbb051fbbf4 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/shield_protection_health_check_association.html.markdown b/website/docs/cdktf/typescript/r/shield_protection_health_check_association.html.markdown
new file mode 100644
index 00000000000..f51a09d7741
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/shield_protection_health_check_association.html.markdown
@@ -0,0 +1,134 @@
+---
+subcategory: "Shield"
+layout: "aws"
+page_title: "AWS: aws_shield_protection_health_check_association"
+description: |-
+  Creates an association between a Route53 Health Check and a Shield Advanced protected resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_shield_protection_health_check_association
+
+Creates an association between a Route53 Health Check and a Shield Advanced protected resource.
+This association uses the health of your applications to improve responsiveness and accuracy in attack detection and mitigation.
+
+Blog post: [AWS Shield Advanced now supports Health Based Detection](https://aws.amazon.com/about-aws/whats-new/2020/02/aws-shield-advanced-now-supports-health-based-detection/)
+
+## Example Usage
+
+### Create an association between a protected EIP and a Route53 Health Check
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCallerIdentity } from "./.gen/providers/aws/data-aws-caller-identity";
+import { DataAwsPartition } from "./.gen/providers/aws/data-aws-partition";
+import { DataAwsRegion } from "./.gen/providers/aws/data-aws-region";
+import { Eip } from "./.gen/providers/aws/eip";
+import { Route53HealthCheck } from "./.gen/providers/aws/route53-health-check";
+import { ShieldProtection } from "./.gen/providers/aws/shield-protection";
+import { ShieldProtectionHealthCheckAssociation } from "./.gen/providers/aws/shield-protection-health-check-association";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new Eip(this, "example", {
+      domain: "vpc",
+      tags: {
+        Name: "example",
+      },
+    });
+    const awsRoute53HealthCheckExample = new Route53HealthCheck(
+      this,
+      "example_1",
+      {
+        failureThreshold: Token.asNumber("3"),
+        ipAddress: example.publicIp,
+        port: 80,
+        requestInterval: Token.asNumber("30"),
+        resourcePath: "/ready",
+        tags: {
+          Name: "tf-example-health-check",
+        },
+        type: "HTTP",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsRoute53HealthCheckExample.overrideLogicalId("example");
+    const current = new DataAwsCallerIdentity(this, "current", {});
+    const dataAwsPartitionCurrent = new DataAwsPartition(this, "current_3", {});
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsPartitionCurrent.overrideLogicalId("current");
+    const dataAwsRegionCurrent = new DataAwsRegion(this, "current_4", {});
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsRegionCurrent.overrideLogicalId("current");
+    const awsShieldProtectionExample = new ShieldProtection(this, "example_5", {
+      name: "example-protection",
+      resourceArn:
+        "arn:${" +
+        dataAwsPartitionCurrent.partition +
+        "}:ec2:${" +
+        dataAwsRegionCurrent.name +
+        "}:${" +
+        current.accountId +
+        "}:eip-allocation/${" +
+        example.id +
+        "}",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsShieldProtectionExample.overrideLogicalId("example");
+    const awsShieldProtectionHealthCheckAssociationExample =
+      new ShieldProtectionHealthCheckAssociation(this, "example_6", {
+        healthCheckArn: Token.asString(awsRoute53HealthCheckExample.arn),
+        shieldProtectionId: Token.asString(awsShieldProtectionExample.id),
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsShieldProtectionHealthCheckAssociationExample.overrideLogicalId(
+      "example"
+    );
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `healthCheckArn` - (Required) The ARN (Amazon Resource Name) of the Route53 Health Check resource which will be associated to the protected resource.
+* `shieldProtectionId` - (Required) The ID of the protected resource.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The unique identifier (ID) for the Protection object that is created.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Shield protection health check association resources using the `shieldProtectionId` and `healthCheckArn`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Shield protection health check association resources using the `shieldProtectionId` and `healthCheckArn`. For example:
+
+```console
+% terraform import aws_shield_protection_health_check_association.example ff9592dc-22f3-4e88-afa1-7b29fde9669a+arn:aws:route53:::healthcheck/3742b175-edb9-46bc-9359-f53e3b794b1b
+```
+
+<!-- cache-key: cdktf-0.18.0 input-478a1032d8fe5c2226eef877393c56223519392521f48d921b8d7bf25f16a9aa -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/signer_signing_job.html.markdown b/website/docs/cdktf/typescript/r/signer_signing_job.html.markdown
new file mode 100644
index 00000000000..17da395d53c
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/signer_signing_job.html.markdown
@@ -0,0 +1,130 @@
+---
+subcategory: "Signer"
+layout: "aws"
+page_title: "AWS: aws_signer_signing_job"
+description: |-
+  Creates a Signer Signing Job.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_signer_signing_job
+
+Creates a Signer Signing Job.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SignerSigningJob } from "./.gen/providers/aws/signer-signing-job";
+import { SignerSigningProfile } from "./.gen/providers/aws/signer-signing-profile";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const testSp = new SignerSigningProfile(this, "test_sp", {
+      platformId: "AWSLambda-SHA384-ECDSA",
+    });
+    new SignerSigningJob(this, "build_signing_job", {
+      destination: {
+        s3: {
+          bucket: "s3-bucket-name",
+          prefix: "signed/",
+        },
+      },
+      ignoreSigningJobFailure: true,
+      profileName: testSp.name,
+      source: {
+        s3: {
+          bucket: "s3-bucket-name",
+          key: "object-to-be-signed.zip",
+          version: "jADjFYYYEXAMPLETszPjOmCMFDzd9dN1",
+        },
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `profileName` - (Required) The name of the profile to initiate the signing operation.
+* `source` - (Required) The S3 bucket that contains the object to sign. See [Source](#source) below for details.
+* `destination` - (Required) The S3 bucket in which to save your signed object. See [Destination](#destination) below for details.
+* `ignoreSigningJobFailure` - (Optional) Set this argument to `true` to ignore signing job failures and retrieve failed status and reason. Default `false`.
+
+### Source
+
+The source configuration block supports the following arguments:
+
+* `s3` - (Required) A configuration block describing the S3 Source object: See [S3 Source](#s3-source) below for details.
+
+### S3 Source
+
+The configuration block supports the following arguments:
+
+* `bucket` - (Required) Name of the S3 bucket.
+* `key` - (Required) Key name of the object that contains your unsigned code.
+* `version` - (Required) Version of your source image in your version enabled S3 bucket.
+
+### Destination
+
+The destination configuration block supports the following arguments:
+
+* `s3` - (Required) A configuration block describing the S3 Destination object: See [S3 Destination](#s3-destination) below for details.
+
+### S3 Destination
+
+The configuration block supports the following arguments:
+
+* `bucket` - (Required) Name of the S3 bucket.
+* `prefix` - (Optional) An Amazon S3 object key prefix that you can use to limit signed objects keys to begin with the specified prefix.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `completedAt` - Date and time in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8) that the signing job was completed.
+* `createdAt` - Date and time in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8) that the signing job was created.
+* `jobId` - The ID of the signing job on output.
+* `jobInvoker` - The IAM entity that initiated the signing job.
+* `jobOwner` - The AWS account ID of the job owner.
+* `platformDisplayName` - A human-readable name for the signing platform associated with the signing job.
+* `platformId` - The platform to which your signed code image will be distributed.
+* `profileVersion` - The version of the signing profile used to initiate the signing job.
+* `requestedBy` - The IAM principal that requested the signing job.
+* `revocationRecord` - A revocation record if the signature generated by the signing job has been revoked. Contains a timestamp and the ID of the IAM entity that revoked the signature.
+* `signatureExpiresAt` - The time when the signature of a signing job expires.
+* `signedObject` - Name of the S3 bucket where the signed code image is saved by code signing.
+* `status` - Status of the signing job.
+* `statusReason` - String value that contains the status reason.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Signer signing jobs using the `jobId`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Signer signing jobs using the `jobId`. For example:
+
+```console
+% terraform import aws_signer_signing_job.test_signer_signing_job 9ed7e5c3-b8d4-4da0-8459-44e0b068f7ee
+```
+
+<!-- cache-key: cdktf-0.18.0 input-c1b438ff5be624709d7988f68eee2a0f8bb3759d4c25af0f1c443c2548e0904f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/signer_signing_profile.html.markdown b/website/docs/cdktf/typescript/r/signer_signing_profile.html.markdown
new file mode 100644
index 00000000000..679c83ad0f7
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/signer_signing_profile.html.markdown
@@ -0,0 +1,92 @@
+---
+subcategory: "Signer"
+layout: "aws"
+page_title: "AWS: aws_signer_signing_profile"
+description: |-
+  Creates a Signer Signing Profile.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_signer_signing_profile
+
+Creates a Signer Signing Profile. A signing profile contains information about the code signing configuration parameters that can be used by a given code signing user.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SignerSigningProfile } from "./.gen/providers/aws/signer-signing-profile";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SignerSigningProfile(this, "prod_sp", {
+      namePrefix: "prod_sp_",
+      platformId: "AWSLambda-SHA384-ECDSA",
+      signatureValidityPeriod: {
+        type: "YEARS",
+        value: 5,
+      },
+      tags: {
+        tag1: "value1",
+        tag2: "value2",
+      },
+    });
+    new SignerSigningProfile(this, "test_sp", {
+      platformId: "AWSLambda-SHA384-ECDSA",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `platformId` - (Required) The ID of the platform that is used by the target signing profile.
+* `name` - (Optional) A unique signing profile name. By default generated by Terraform. Signing profile names are immutable and cannot be reused after canceled.
+* `namePrefix` - (Optional) A signing profile name prefix. Terraform will generate a unique suffix. Conflicts with `name`.
+* `signatureValidityPeriod` - (Optional) The validity period for a signing job.
+* `tags` - (Optional) A list of tags associated with the signing profile. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) for the signing profile.
+* `name` - The name of the target signing profile.
+* `platformDisplayName` - A human-readable name for the signing platform associated with the signing profile.
+* `revocationRecord` - Revocation information for a signing profile.
+* `status` - The status of the target signing profile.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `version` - The current version of the signing profile.
+* `versionArn` - The signing profile ARN, including the profile version.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Signer signing profiles using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Signer signing profiles using the `name`. For example:
+
+```console
+% terraform import aws_signer_signing_profile.test_signer_signing_profile test_sp_DdW3Mk1foYL88fajut4mTVFGpuwfd4ACO6ANL0D1uIj7lrn8adK
+```
+
+<!-- cache-key: cdktf-0.18.0 input-57f63022a116376a3735a2b30f488c72b5caa6858cda3ba458b57d9add75c8c7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/signer_signing_profile_permission.html.markdown b/website/docs/cdktf/typescript/r/signer_signing_profile_permission.html.markdown
new file mode 100644
index 00000000000..e13b3191071
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/signer_signing_profile_permission.html.markdown
@@ -0,0 +1,100 @@
+---
+subcategory: "Signer"
+layout: "aws"
+page_title: "AWS: aws_signer_signing_profile_permission"
+description: |-
+  Creates a Signer Signing Profile Permission.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_signer_signing_profile_permission
+
+Creates a Signer Signing Profile Permission. That is, a cross-account permission for a signing profile.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SignerSigningProfile } from "./.gen/providers/aws/signer-signing-profile";
+import { SignerSigningProfilePermission } from "./.gen/providers/aws/signer-signing-profile-permission";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const prodSp = new SignerSigningProfile(this, "prod_sp", {
+      namePrefix: "prod_sp_",
+      platformId: "AWSLambda-SHA384-ECDSA",
+      signatureValidityPeriod: {
+        type: "YEARS",
+        value: 5,
+      },
+      tags: {
+        tag1: "value1",
+        tag2: "value2",
+      },
+    });
+    new SignerSigningProfilePermission(this, "sp_permission_1", {
+      action: "signer:StartSigningJob",
+      principal: awsAccount.stringValue,
+      profileName: prodSp.name,
+    });
+    new SignerSigningProfilePermission(this, "sp_permission_2", {
+      action: "signer:GetSigningProfile",
+      principal: awsTeamRoleArn.stringValue,
+      profileName: prodSp.name,
+      statementId: "ProdAccountStartSigningJob_StatementId",
+    });
+    new SignerSigningProfilePermission(this, "sp_permission_3", {
+      action: "signer:RevokeSignature",
+      principal: "123456789012",
+      profileName: prodSp.name,
+      profileVersion: prodSp.version,
+      statementIdPrefix: "version-permission-",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `profileName` - (Required) Name of the signing profile to add the cross-account permissions.
+* `action` - (Required) An AWS Signer action permitted as part of cross-account permissions. Valid values: `signer:startSigningJob`, `signer:getSigningProfile`, `signer:revokeSignature`, or `signer:signPayload`.
+* `principal` - (Required) The AWS principal to be granted a cross-account permission.
+* `profileVersion` - (Optional) The signing profile version that a permission applies to.
+* `statementId` - (Optional) A unique statement identifier. By default generated by Terraform.
+* `statementIdPrefix` - (Optional) A statement identifier prefix. Terraform will generate a unique suffix. Conflicts with `statementId`.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Signer signing profile permission statements using profile_name/statement_id. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Signer signing profile permission statements using profile_name/statement_id. For example:
+
+```console
+% terraform import aws_signer_signing_profile_permission.test_signer_signing_profile_permission prod_profile_DdW3Mk1foYL88fajut4mTVFGpuwfd4ACO6ANL0D1uIj7lrn8adK/ProdAccountStartSigningJobStatementId
+```
+
+<!-- cache-key: cdktf-0.18.0 input-7edfee662c248d246aee9cd63641e317eed424d97a2a7b8b34328c55504385f6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/simpledb_domain.html.markdown b/website/docs/cdktf/typescript/r/simpledb_domain.html.markdown
new file mode 100644
index 00000000000..5193cb3ab78
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/simpledb_domain.html.markdown
@@ -0,0 +1,71 @@
+---
+subcategory: "SDB (SimpleDB)"
+layout: "aws"
+page_title: "AWS: aws_simpledb_domain"
+description: |-
+  Provides a SimpleDB domain resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_simpledb_domain
+
+Provides a SimpleDB domain resource
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SimpledbDomain } from "./.gen/providers/aws/simpledb-domain";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SimpledbDomain(this, "users", {
+      name: "users",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the SimpleDB domain
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name of the SimpleDB domain
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SimpleDB Domains using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import SimpleDB Domains using the `name`. For example:
+
+```console
+% terraform import aws_simpledb_domain.users users
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1ecaa39696110cd8e92af5219414c477bbcb42224f0ea02ced4ca49a594cc2e2 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/snapshot_create_volume_permission.html.markdown b/website/docs/cdktf/typescript/r/snapshot_create_volume_permission.html.markdown
new file mode 100644
index 00000000000..6066fa03c61
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/snapshot_create_volume_permission.html.markdown
@@ -0,0 +1,60 @@
+---
+subcategory: "EBS (EC2)"
+layout: "aws"
+page_title: "AWS: aws_snapshot_create_volume_permission"
+description: |-
+  Adds create volume permission to an EBS Snapshot
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_snapshot_create_volume_permission
+
+Adds permission to create volumes off of a given EBS Snapshot.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EbsSnapshot } from "./.gen/providers/aws/ebs-snapshot";
+import { EbsVolume } from "./.gen/providers/aws/ebs-volume";
+import { SnapshotCreateVolumePermission } from "./.gen/providers/aws/snapshot-create-volume-permission";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new EbsVolume(this, "example", {
+      availabilityZone: "us-west-2a",
+      size: 40,
+    });
+    const exampleSnapshot = new EbsSnapshot(this, "example_snapshot", {
+      volumeId: example.id,
+    });
+    new SnapshotCreateVolumePermission(this, "example_perm", {
+      accountId: "12345678",
+      snapshotId: exampleSnapshot.id,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `snapshotId` - (Required) A snapshot ID
+* `accountId` - (Required) An AWS Account ID to add create volume permissions. The AWS Account cannot be the snapshot's owner
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - A combination of "`snapshotId`-`accountId`".
+
+<!-- cache-key: cdktf-0.18.0 input-1dcd90ebf6e64f894d48700c8915b1ac0302acfb0e05cf97d2a2a97312bf066c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/sns_platform_application.html.markdown b/website/docs/cdktf/typescript/r/sns_platform_application.html.markdown
new file mode 100644
index 00000000000..65abaea7eaf
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/sns_platform_application.html.markdown
@@ -0,0 +1,146 @@
+---
+subcategory: "SNS (Simple Notification)"
+layout: "aws"
+page_title: "AWS: aws_sns_platform_application"
+description: |-
+  Provides an SNS platform application resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sns_platform_application
+
+Provides an SNS platform application resource
+
+## Example Usage
+
+### Apple Push Notification Service (APNS) using certificate-based authentication
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SnsPlatformApplication } from "./.gen/providers/aws/sns-platform-application";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SnsPlatformApplication(this, "apns_application", {
+      name: "apns_application",
+      platform: "APNS",
+      platformCredential: "<APNS PRIVATE KEY>",
+      platformPrincipal: "<APNS CERTIFICATE>",
+    });
+  }
+}
+
+```
+
+### Apple Push Notification Service (APNS) using token-based authentication
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SnsPlatformApplication } from "./.gen/providers/aws/sns-platform-application";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SnsPlatformApplication(this, "apns_application", {
+      applePlatformBundleId: "<APPLE BUNDLE ID>",
+      applePlatformTeamId: "<APPLE TEAM ID>",
+      name: "apns_application",
+      platform: "APNS",
+      platformCredential: "<APNS SIGNING KEY>",
+      platformPrincipal: "<APNS SIGNING KEY ID>",
+    });
+  }
+}
+
+```
+
+### Google Cloud Messaging (GCM)
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SnsPlatformApplication } from "./.gen/providers/aws/sns-platform-application";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SnsPlatformApplication(this, "gcm_application", {
+      name: "gcm_application",
+      platform: "GCM",
+      platformCredential: "<GCM API KEY>",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The friendly name for the SNS platform application
+* `platform` - (Required) The platform that the app is registered with. See [Platform][1] for supported platforms.
+* `platformCredential` - (Required) Application Platform credential. See [Credential][1] for type of credential required for platform. The value of this attribute when stored into the Terraform state is only a hash of the real value, so therefore it is not practical to use this as an attribute for other resources.
+* `eventDeliveryFailureTopicArn` - (Optional) The ARN of the SNS Topic triggered when a delivery to any of the platform endpoints associated with your platform application encounters a permanent failure.
+* `eventEndpointCreatedTopicArn` - (Optional) The ARN of the SNS Topic triggered when a new platform endpoint is added to your platform application.
+* `eventEndpointDeletedTopicArn` - (Optional) The ARN of the SNS Topic triggered when an existing platform endpoint is deleted from your platform application.
+* `eventEndpointUpdatedTopicArn` - (Optional) The ARN of the SNS Topic triggered when an existing platform endpoint is changed from your platform application.
+* `failureFeedbackRoleArn` - (Optional) The IAM role ARN permitted to receive failure feedback for this application and give SNS write access to use CloudWatch logs on your behalf.
+* `platformPrincipal` - (Optional) Application Platform principal. See [Principal][2] for type of principal required for platform. The value of this attribute when stored into the Terraform state is only a hash of the real value, so therefore it is not practical to use this as an attribute for other resources.
+* `successFeedbackRoleArn` - (Optional) The IAM role ARN permitted to receive success feedback for this application and give SNS write access to use CloudWatch logs on your behalf.
+* `successFeedbackSampleRate` - (Optional) The sample rate percentage (0-100) of successfully delivered messages.
+
+The following attributes are needed only when using APNS token credentials:
+
+* `applePlatformTeamId` - (Required) The identifier that's assigned to your Apple developer account team. Must be 10 alphanumeric characters.
+* `applePlatformBundleId` - (Required) The bundle identifier that's assigned to your iOS app. May only include alphanumeric characters, hyphens (-), and periods (.).
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ARN of the SNS platform application
+* `arn` - The ARN of the SNS platform application
+
+[1]: http://docs.aws.amazon.com/sns/latest/dg/mobile-push-send-register.html
+[2]: http://docs.aws.amazon.com/sns/latest/api/API_CreatePlatformApplication.html
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SNS platform applications using the ARN. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import SNS platform applications using the ARN. For example:
+
+```console
+% terraform import aws_sns_platform_application.gcm_application arn:aws:sns:us-west-2:0123456789012:app/GCM/gcm_application
+```
+
+<!-- cache-key: cdktf-0.18.0 input-cab192bfd8c23eada362cd924116cfcfef5154b99069d7d8bda52c652e5e8436 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/sns_sms_preferences.html.markdown b/website/docs/cdktf/typescript/r/sns_sms_preferences.html.markdown
new file mode 100644
index 00000000000..9585f2ea995
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/sns_sms_preferences.html.markdown
@@ -0,0 +1,50 @@
+---
+subcategory: "SNS (Simple Notification)"
+layout: "aws"
+page_title: "AWS: aws_sns_sms_preferences"
+description: |-
+  Provides a way to set SNS SMS preferences.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sns_sms_preferences
+
+Provides a way to set SNS SMS preferences.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SnsSmsPreferences } from "./.gen/providers/aws/sns-sms-preferences";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SnsSmsPreferences(this, "update_sms_prefs", {});
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `monthlySpendLimit` - (Optional) The maximum amount in USD that you are willing to spend each month to send SMS messages.
+* `deliveryStatusIamRoleArn` - (Optional) The ARN of the IAM role that allows Amazon SNS to write logs about SMS deliveries in CloudWatch Logs.
+* `deliveryStatusSuccessSamplingRate` - (Optional) The percentage of successful SMS deliveries for which Amazon SNS will write logs in CloudWatch Logs. The value must be between 0 and 100.
+* `defaultSenderId` - (Optional) A string, such as your business brand, that is displayed as the sender on the receiving device.
+* `defaultSmsType` - (Optional) The type of SMS message that you will send by default. Possible values are: Promotional, Transactional
+* `usageReportS3Bucket` - (Optional) The name of the Amazon S3 bucket to receive daily SMS usage reports from Amazon SNS.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+<!-- cache-key: cdktf-0.18.0 input-fb3841d6bcaa58c6f6663ac36ae2dd4fc2b84b493c3c7984f840593cb184fb68 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/sns_topic.html.markdown b/website/docs/cdktf/typescript/r/sns_topic.html.markdown
new file mode 100644
index 00000000000..f9c1aad56b2
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/sns_topic.html.markdown
@@ -0,0 +1,174 @@
+---
+subcategory: "SNS (Simple Notification)"
+layout: "aws"
+page_title: "AWS: aws_sns_topic"
+description: |-
+  Provides an SNS topic resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sns_topic
+
+Provides an SNS topic resource
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SnsTopic } from "./.gen/providers/aws/sns-topic";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SnsTopic(this, "user_updates", {
+      name: "user-updates-topic",
+    });
+  }
+}
+
+```
+
+## Example with Delivery Policy
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SnsTopic } from "./.gen/providers/aws/sns-topic";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SnsTopic(this, "user_updates", {
+      deliveryPolicy:
+        '{\n  "http": {\n    "defaultHealthyRetryPolicy": {\n      "minDelayTarget": 20,\n      "maxDelayTarget": 20,\n      "numRetries": 3,\n      "numMaxDelayRetries": 0,\n      "numNoDelayRetries": 0,\n      "numMinDelayRetries": 0,\n      "backoffFunction": "linear"\n    },\n    "disableSubscriptionOverrides": false,\n    "defaultThrottlePolicy": {\n      "maxReceivesPerSecond": 1\n    }\n  }\n}\n\n',
+      name: "user-updates-topic",
+    });
+  }
+}
+
+```
+
+## Example with Server-side encryption (SSE)
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SnsTopic } from "./.gen/providers/aws/sns-topic";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SnsTopic(this, "user_updates", {
+      kmsMasterKeyId: "alias/aws/sns",
+      name: "user-updates-topic",
+    });
+  }
+}
+
+```
+
+## Example with First-In-First-Out (FIFO)
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SnsTopic } from "./.gen/providers/aws/sns-topic";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SnsTopic(this, "user_updates", {
+      contentBasedDeduplication: true,
+      fifoTopic: true,
+      name: "user-updates-topic.fifo",
+    });
+  }
+}
+
+```
+
+## Message Delivery Status Arguments
+
+The `<endpoint>SuccessFeedbackRoleArn` and `<endpoint>FailureFeedbackRoleArn` arguments are used to give Amazon SNS write access to use CloudWatch Logs on your behalf. The `<endpoint>SuccessFeedbackSampleRate` argument is for specifying the sample rate percentage (0-100) of successfully delivered messages. After you configure the  `<endpoint>FailureFeedbackRoleArn` argument, then all failed message deliveries generate CloudWatch Logs.
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Optional) The name of the topic. Topic names must be made up of only uppercase and lowercase ASCII letters, numbers, underscores, and hyphens, and must be between 1 and 256 characters long. For a FIFO (first-in-first-out) topic, the name must end with the `fifo` suffix. If omitted, Terraform will assign a random, unique name. Conflicts with `namePrefix`
+* `namePrefix` - (Optional) Creates a unique name beginning with the specified prefix. Conflicts with `name`
+* `displayName` - (Optional) The display name for the topic
+* `policy` - (Optional) The fully-formed AWS policy as JSON. For more information about building AWS IAM policy documents with Terraform, see the [AWS IAM Policy Document Guide](https://learn.hashicorp.com/terraform/aws/iam-policy).
+* `deliveryPolicy` - (Optional) The SNS delivery policy. More on [AWS documentation](https://docs.aws.amazon.com/sns/latest/dg/DeliveryPolicies.html)
+* `applicationSuccessFeedbackRoleArn` - (Optional) The IAM role permitted to receive success feedback for this topic
+* `applicationSuccessFeedbackSampleRate` - (Optional) Percentage of success to sample
+* `applicationFailureFeedbackRoleArn` - (Optional) IAM role for failure feedback
+* `httpSuccessFeedbackRoleArn` - (Optional) The IAM role permitted to receive success feedback for this topic
+* `httpSuccessFeedbackSampleRate` - (Optional) Percentage of success to sample
+* `httpFailureFeedbackRoleArn` - (Optional) IAM role for failure feedback
+* `kmsMasterKeyId` - (Optional) The ID of an AWS-managed customer master key (CMK) for Amazon SNS or a custom CMK. For more information, see [Key Terms](https://docs.aws.amazon.com/sns/latest/dg/sns-server-side-encryption.html#sse-key-terms)
+* `signatureVersion` - (Optional) If `signatureVersion` should be [1 (SHA1) or 2 (SHA256)](https://docs.aws.amazon.com/sns/latest/dg/sns-verify-signature-of-message.html). The signature version corresponds to the hashing algorithm used while creating the signature of the notifications, subscription confirmations, or unsubscribe confirmation messages sent by Amazon SNS.
+* `tracingConfig` - (Optional) Tracing mode of an Amazon SNS topic. Valid values: `"passThrough"`, `"active"`.
+* `fifoTopic` - (Optional) Boolean indicating whether or not to create a FIFO (first-in-first-out) topic (default is `false`).
+* `contentBasedDeduplication` - (Optional) Enables content-based deduplication for FIFO topics. For more information, see the [related documentation](https://docs.aws.amazon.com/sns/latest/dg/fifo-message-dedup.html)
+* `lambdaSuccessFeedbackRoleArn` - (Optional) The IAM role permitted to receive success feedback for this topic
+* `lambdaSuccessFeedbackSampleRate` - (Optional) Percentage of success to sample
+* `lambdaFailureFeedbackRoleArn` - (Optional) IAM role for failure feedback
+* `sqsSuccessFeedbackRoleArn` - (Optional) The IAM role permitted to receive success feedback for this topic
+* `sqsSuccessFeedbackSampleRate` - (Optional) Percentage of success to sample
+* `sqsFailureFeedbackRoleArn` - (Optional) IAM role for failure feedback
+* `firehoseSuccessFeedbackRoleArn` - (Optional) The IAM role permitted to receive success feedback for this topic
+* `firehoseSuccessFeedbackSampleRate` - (Optional) Percentage of success to sample
+* `firehoseFailureFeedbackRoleArn` - (Optional) IAM role for failure feedback
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ARN of the SNS topic
+* `arn` - The ARN of the SNS topic, as a more obvious property (clone of id)
+* `owner` - The AWS Account ID of the SNS topic owner
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SNS Topics using the topic `arn`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import SNS Topics using the topic `arn`. For example:
+
+```console
+% terraform import aws_sns_topic.user_updates arn:aws:sns:us-west-2:0123456789012:my-topic
+```
+
+<!-- cache-key: cdktf-0.18.0 input-0d5a35abbfaca86d4dd3ed7192fda282da053dc7b804f69b6b227e9ae60cda2f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/sns_topic_data_protection_policy.html.markdown b/website/docs/cdktf/typescript/r/sns_topic_data_protection_policy.html.markdown
new file mode 100644
index 00000000000..0cf4627c0a5
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/sns_topic_data_protection_policy.html.markdown
@@ -0,0 +1,97 @@
+---
+subcategory: "SNS (Simple Notification)"
+layout: "aws"
+page_title: "AWS: aws_sns_topic_data_protection_policy"
+description: |-
+  Provides an SNS data protection topic policy resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sns_topic_data_protection_policy
+
+Provides an SNS data protection topic policy resource
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SnsTopic } from "./.gen/providers/aws/sns-topic";
+import { SnsTopicDataProtectionPolicy } from "./.gen/providers/aws/sns-topic-data-protection-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new SnsTopic(this, "example", {
+      name: "example",
+    });
+    const awsSnsTopicDataProtectionPolicyExample =
+      new SnsTopicDataProtectionPolicy(this, "example_1", {
+        arn: example.arn,
+        policy: Token.asString(
+          Fn.jsonencode({
+            Description: "Example data protection policy",
+            Name: "__example_data_protection_policy",
+            Statement: [
+              {
+                DataDirection: "Inbound",
+                DataIdentifier: [
+                  "arn:aws:dataprotection::aws:data-identifier/EmailAddress",
+                ],
+                Operation: {
+                  Deny: {},
+                },
+                Principal: ["*"],
+                Sid: "__deny_statement_11ba9d96",
+              },
+            ],
+            Version: "2021-06-01",
+          })
+        ),
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSnsTopicDataProtectionPolicyExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `arn` - (Required) The ARN of the SNS topic
+* `policy` - (Required) The fully-formed AWS policy as JSON. For more information about building AWS IAM policy documents with Terraform, see the [AWS IAM Policy Document Guide](https://learn.hashicorp.com/terraform/aws/iam-policy).
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SNS Data Protection Topic Policy using the topic ARN. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import SNS Data Protection Topic Policy using the topic ARN. For example:
+
+```console
+% terraform import aws_sns_topic_data_protection_policy.example arn:aws:sns:us-west-2:0123456789012:example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-9873cc188a9eeb3e1e9911705d4e32ec2577e6f0a3d25c0c52f1bdca092cd422 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/sns_topic_policy.html.markdown b/website/docs/cdktf/typescript/r/sns_topic_policy.html.markdown
new file mode 100644
index 00000000000..2d28dd133b3
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/sns_topic_policy.html.markdown
@@ -0,0 +1,118 @@
+---
+subcategory: "SNS (Simple Notification)"
+layout: "aws"
+page_title: "AWS: aws_sns_topic_policy"
+description: |-
+  Provides an SNS topic policy resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sns_topic_policy
+
+Provides an SNS topic policy resource
+
+~> **NOTE:** If a Principal is specified as just an AWS account ID rather than an ARN, AWS silently converts it to the ARN for the root user, causing future terraform plans to differ. To avoid this problem, just specify the full ARN, e.g., `arn:aws:iam::123456789012:root`
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { SnsTopic } from "./.gen/providers/aws/sns-topic";
+import { SnsTopicPolicy } from "./.gen/providers/aws/sns-topic-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const test = new SnsTopic(this, "test", {
+      name: "my-topic-with-policy",
+    });
+    const snsTopicPolicy = new DataAwsIamPolicyDocument(
+      this,
+      "sns_topic_policy",
+      {
+        policyId: "__default_policy_ID",
+        statement: [
+          {
+            actions: [
+              "SNS:Subscribe",
+              "SNS:SetTopicAttributes",
+              "SNS:RemovePermission",
+              "SNS:Receive",
+              "SNS:Publish",
+              "SNS:ListSubscriptionsByTopic",
+              "SNS:GetTopicAttributes",
+              "SNS:DeleteTopic",
+              "SNS:AddPermission",
+            ],
+            condition: [
+              {
+                test: "StringEquals",
+                values: [accountId.stringValue],
+                variable: "AWS:SourceOwner",
+              },
+            ],
+            effect: "Allow",
+            principals: [
+              {
+                identifiers: ["*"],
+                type: "AWS",
+              },
+            ],
+            resources: [test.arn],
+            sid: "__default_statement_ID",
+          },
+        ],
+      }
+    );
+    new SnsTopicPolicy(this, "default", {
+      arn: test.arn,
+      policy: Token.asString(snsTopicPolicy.json),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `arn` - (Required) The ARN of the SNS topic
+* `policy` - (Required) The fully-formed AWS policy as JSON. For more information about building AWS IAM policy documents with Terraform, see the [AWS IAM Policy Document Guide](https://learn.hashicorp.com/terraform/aws/iam-policy).
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `owner` - The AWS Account ID of the SNS topic owner
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SNS Topic Policy using the topic ARN. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import SNS Topic Policy using the topic ARN. For example:
+
+```console
+% terraform import aws_sns_topic_policy.user_updates arn:aws:sns:us-west-2:0123456789012:my-topic
+```
+
+<!-- cache-key: cdktf-0.18.0 input-5367b280c7c37833f246feb7e18158b32cf70822bccb3de74447a6068d898a1b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/sns_topic_subscription.html.markdown b/website/docs/cdktf/typescript/r/sns_topic_subscription.html.markdown
new file mode 100644
index 00000000000..03d4bc96458
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/sns_topic_subscription.html.markdown
@@ -0,0 +1,403 @@
+---
+subcategory: "SNS (Simple Notification)"
+layout: "aws"
+page_title: "AWS: aws_sns_topic_subscription"
+description: |-
+  Provides a resource for subscribing to SNS topics.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sns_topic_subscription
+
+Provides a resource for subscribing to SNS topics. Requires that an SNS topic exist for the subscription to attach to. This resource allows you to automatically place messages sent to SNS topics in SQS queues, send them as HTTP(S) POST requests to a given endpoint, send SMS messages, or notify devices / applications. The most likely use case for Terraform users will probably be SQS queues.
+
+~> **NOTE:** If the SNS topic and SQS queue are in different AWS regions, the `awsSnsTopicSubscription` must use an AWS provider that is in the same region as the SNS topic. If the `awsSnsTopicSubscription` uses a provider with a different region than the SNS topic, Terraform will fail to create the subscription.
+
+~> **NOTE:** Setup of cross-account subscriptions from SNS topics to SQS queues requires Terraform to have access to BOTH accounts.
+
+~> **NOTE:** If an SNS topic and SQS queue are in different AWS accounts but the same region, the `awsSnsTopicSubscription` must use the AWS provider for the account with the SQS queue. If `awsSnsTopicSubscription` uses a Provider with a different account than the SQS queue, Terraform creates the subscription but does not keep state and tries to re-create the subscription at every `apply`.
+
+~> **NOTE:** If an SNS topic and SQS queue are in different AWS accounts and different AWS regions, the subscription needs to be initiated from the account with the SQS queue but in the region of the SNS topic.
+
+~> **NOTE:** You cannot unsubscribe to a subscription that is pending confirmation. If you use `email`, `emailJson`, or `http`/`https` (without auto-confirmation enabled), until the subscription is confirmed (e.g., outside of Terraform), AWS does not allow Terraform to delete / unsubscribe the subscription. If you `destroy` an unconfirmed subscription, Terraform will remove the subscription from its state but the subscription will still exist in AWS. However, if you delete an SNS topic, SNS [deletes all the subscriptions](https://docs.aws.amazon.com/sns/latest/dg/sns-delete-subscription-topic.html) associated with the topic. Also, you can import a subscription after confirmation and then have the capability to delete it.
+
+## Example Usage
+
+You can directly supply a topic and ARN by hand in the `topicArn` property along with the queue ARN:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SnsTopicSubscription } from "./.gen/providers/aws/sns-topic-subscription";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SnsTopicSubscription(this, "user_updates_sqs_target", {
+      endpoint: "arn:aws:sqs:us-west-2:432981146916:terraform-queue-too",
+      protocol: "sqs",
+      topicArn: "arn:aws:sns:us-west-2:432981146916:user-updates-topic",
+    });
+  }
+}
+
+```
+
+Alternatively you can use the ARN properties of a managed SNS topic and SQS queue:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SnsTopic } from "./.gen/providers/aws/sns-topic";
+import { SnsTopicSubscription } from "./.gen/providers/aws/sns-topic-subscription";
+import { SqsQueue } from "./.gen/providers/aws/sqs-queue";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const userUpdates = new SnsTopic(this, "user_updates", {
+      name: "user-updates-topic",
+    });
+    const userUpdatesQueue = new SqsQueue(this, "user_updates_queue", {
+      name: "user-updates-queue",
+    });
+    new SnsTopicSubscription(this, "user_updates_sqs_target", {
+      endpoint: userUpdatesQueue.arn,
+      protocol: "sqs",
+      topicArn: userUpdates.arn,
+    });
+  }
+}
+
+```
+
+You can subscribe SNS topics to SQS queues in different Amazon accounts and regions:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformVariable, Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { AwsProvider } from "./.gen/providers/aws/provider";
+import { SnsTopic } from "./.gen/providers/aws/sns-topic";
+import { SnsTopicSubscription } from "./.gen/providers/aws/sns-topic-subscription";
+import { SqsQueue } from "./.gen/providers/aws/sqs-queue";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    /*Terraform Variables are not always the best fit for getting inputs in the context of Terraform CDK.
+    You can read more about this at https://cdk.tf/variables*/
+    const sns = new TerraformVariable(this, "sns", {
+      default: [
+        {
+          "account-id": "111111111111",
+          display_name: "example",
+          name: "example-sns-topic",
+          region: "us-west-1",
+          "role-name": "service/service-hashicorp-terraform",
+        },
+      ],
+    });
+    const sqs = new TerraformVariable(this, "sqs", {
+      default: [
+        {
+          "account-id": "222222222222",
+          name: "example-sqs-queue",
+          region: "us-east-1",
+          "role-name": "service/service-hashicorp-terraform",
+        },
+      ],
+    });
+    const snsTopicPolicy = new DataAwsIamPolicyDocument(
+      this,
+      "sns-topic-policy",
+      {
+        policyId: "__default_policy_ID",
+        statement: [
+          {
+            actions: [
+              "SNS:Subscribe",
+              "SNS:SetTopicAttributes",
+              "SNS:RemovePermission",
+              "SNS:Publish",
+              "SNS:ListSubscriptionsByTopic",
+              "SNS:GetTopicAttributes",
+              "SNS:DeleteTopic",
+              "SNS:AddPermission",
+            ],
+            condition: [
+              {
+                test: "StringEquals",
+                values: [
+                  Token.asString(Fn.lookupNested(sns.value, ['"account-id"'])),
+                ],
+                variable: "AWS:SourceOwner",
+              },
+            ],
+            effect: "Allow",
+            principals: [
+              {
+                identifiers: ["*"],
+                type: "AWS",
+              },
+            ],
+            resources: [
+              "arn:aws:sns:" +
+                Token.asString(Fn.lookupNested(sns.value, ['"region"'])) +
+                ":" +
+                Token.asString(Fn.lookupNested(sns.value, ['"account-id"'])) +
+                ":" +
+                Token.asString(Fn.lookupNested(sns.value, ['"name"'])),
+            ],
+            sid: "__default_statement_ID",
+          },
+          {
+            actions: ["SNS:Subscribe", "SNS:Receive"],
+            condition: [
+              {
+                test: "StringLike",
+                values: [
+                  "arn:aws:sqs:" +
+                    Token.asString(Fn.lookupNested(sqs.value, ['"region"'])) +
+                    ":" +
+                    Token.asString(
+                      Fn.lookupNested(sqs.value, ['"account-id"'])
+                    ) +
+                    ":" +
+                    Token.asString(Fn.lookupNested(sqs.value, ['"name"'])),
+                ],
+                variable: "SNS:Endpoint",
+              },
+            ],
+            effect: "Allow",
+            principals: [
+              {
+                identifiers: ["*"],
+                type: "AWS",
+              },
+            ],
+            resources: [
+              "arn:aws:sns:" +
+                Token.asString(Fn.lookupNested(sns.value, ['"region"'])) +
+                ":" +
+                Token.asString(Fn.lookupNested(sns.value, ['"account-id"'])) +
+                ":" +
+                Token.asString(Fn.lookupNested(sns.value, ['"name"'])),
+            ],
+            sid: "__console_sub_0",
+          },
+        ],
+      }
+    );
+    const sqsQueuePolicy = new DataAwsIamPolicyDocument(
+      this,
+      "sqs-queue-policy",
+      {
+        policyId:
+          "arn:aws:sqs:" +
+          Token.asString(Fn.lookupNested(sqs.value, ['"region"'])) +
+          ":" +
+          Token.asString(Fn.lookupNested(sqs.value, ['"account-id"'])) +
+          ":" +
+          Token.asString(Fn.lookupNested(sqs.value, ['"name"'])) +
+          "/SQSDefaultPolicy",
+        statement: [
+          {
+            actions: ["SQS:SendMessage"],
+            condition: [
+              {
+                test: "ArnEquals",
+                values: [
+                  "arn:aws:sns:" +
+                    Token.asString(Fn.lookupNested(sns.value, ['"region"'])) +
+                    ":" +
+                    Token.asString(
+                      Fn.lookupNested(sns.value, ['"account-id"'])
+                    ) +
+                    ":" +
+                    Token.asString(Fn.lookupNested(sns.value, ['"name"'])),
+                ],
+                variable: "aws:SourceArn",
+              },
+            ],
+            effect: "Allow",
+            principals: [
+              {
+                identifiers: ["*"],
+                type: "AWS",
+              },
+            ],
+            resources: [
+              "arn:aws:sqs:" +
+                Token.asString(Fn.lookupNested(sqs.value, ['"region"'])) +
+                ":" +
+                Token.asString(Fn.lookupNested(sqs.value, ['"account-id"'])) +
+                ":" +
+                Token.asString(Fn.lookupNested(sqs.value, ['"name"'])),
+            ],
+            sid: "example-sns-topic",
+          },
+        ],
+      }
+    );
+    const awsSns = new AwsProvider(this, "aws", {
+      alias: "sns",
+      assumeRole: [
+        {
+          roleArn:
+            "arn:aws:iam::" +
+            Token.asString(Fn.lookupNested(sns.value, ['"account-id"'])) +
+            ":role/" +
+            Token.asString(Fn.lookupNested(sns.value, ['"role-name"'])),
+          sessionName:
+            "sns-" + Token.asString(Fn.lookupNested(sns.value, ['"region"'])),
+        },
+      ],
+      region: Token.asString(Fn.lookupNested(sns.value, ['"region"'])),
+    });
+    const awsSqs = new AwsProvider(this, "aws_5", {
+      alias: "sqs",
+      assumeRole: [
+        {
+          roleArn:
+            "arn:aws:iam::" +
+            Token.asString(Fn.lookupNested(sqs.value, ['"account-id"'])) +
+            ":role/" +
+            Token.asString(Fn.lookupNested(sqs.value, ['"role-name"'])),
+          sessionName:
+            "sqs-" + Token.asString(Fn.lookupNested(sqs.value, ['"region"'])),
+        },
+      ],
+      region: Token.asString(Fn.lookupNested(sqs.value, ['"region"'])),
+    });
+    const sns2Sqs = new AwsProvider(this, "aws_6", {
+      alias: "sns2sqs",
+      assumeRole: [
+        {
+          roleArn:
+            "arn:aws:iam::" +
+            Token.asString(Fn.lookupNested(sqs.value, ['"account-id"'])) +
+            ":role/" +
+            Token.asString(Fn.lookupNested(sqs.value, ['"role-name"'])),
+          sessionName:
+            "sns2sqs-" +
+            Token.asString(Fn.lookupNested(sns.value, ['"region"'])),
+        },
+      ],
+      region: Token.asString(Fn.lookupNested(sns.value, ['"region"'])),
+    });
+    const snsTopic = new SnsTopic(this, "sns-topic", {
+      displayName: Token.asString(
+        Fn.lookupNested(sns.value, ['"display_name"'])
+      ),
+      name: Token.asString(Fn.lookupNested(sns.value, ['"name"'])),
+      policy: Token.asString(snsTopicPolicy.json),
+      provider: "${aws.sns}",
+    });
+    const sqsQueue = new SqsQueue(this, "sqs-queue", {
+      name: Token.asString(Fn.lookupNested(sqs.value, ['"name"'])),
+      policy: Token.asString(sqsQueuePolicy.json),
+      provider: "${aws.sqs}",
+    });
+    const awsSnsTopicSubscriptionSnsTopic = new SnsTopicSubscription(
+      this,
+      "sns-topic_9",
+      {
+        endpoint: sqsQueue.arn,
+        protocol: "sqs",
+        provider: sns2Sqs,
+        topicArn: snsTopic.arn,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSnsTopicSubscriptionSnsTopic.overrideLogicalId("sns-topic");
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `endpoint` - (Required) Endpoint to send data to. The contents vary with the protocol. See details below.
+* `protocol` - (Required) Protocol to use. Valid values are: `sqs`, `sms`, `lambda`, `firehose`, and `application`. Protocols `email`, `emailJson`, `http` and `https` are also valid but partially supported. See details below.
+* `subscriptionRoleArn` - (Required if `protocol` is `firehose`) ARN of the IAM role to publish to Kinesis Data Firehose delivery stream. Refer to [SNS docs](https://docs.aws.amazon.com/sns/latest/dg/sns-firehose-as-subscriber.html).
+* `topicArn` - (Required) ARN of the SNS topic to subscribe to.
+
+The following arguments are optional:
+
+* `confirmationTimeoutInMinutes` - (Optional) Integer indicating number of minutes to wait in retrying mode for fetching subscription arn before marking it as failure. Only applicable for http and https protocols. Default is `1`.
+* `deliveryPolicy` - (Optional) JSON String with the delivery policy (retries, backoff, etc.) that will be used in the subscription - this only applies to HTTP/S subscriptions. Refer to the [SNS docs](https://docs.aws.amazon.com/sns/latest/dg/DeliveryPolicies.html) for more details.
+* `endpointAutoConfirms` - (Optional) Whether the endpoint is capable of [auto confirming subscription](http://docs.aws.amazon.com/sns/latest/dg/SendMessageToHttp.html#SendMessageToHttp.prepare) (e.g., PagerDuty). Default is `false`.
+* `filterPolicy` - (Optional) JSON String with the filter policy that will be used in the subscription to filter messages seen by the target resource. Refer to the [SNS docs](https://docs.aws.amazon.com/sns/latest/dg/message-filtering.html) for more details.
+* `filterPolicyScope` - (Optional) Whether the `filterPolicy` applies to `messageAttributes` (default) or `messageBody`.
+* `rawMessageDelivery` - (Optional) Whether to enable raw message delivery (the original message is directly passed, not wrapped in JSON with the original message in the message property). Default is `false`.
+* `redrivePolicy` - (Optional) JSON String with the redrive policy that will be used in the subscription. Refer to the [SNS docs](https://docs.aws.amazon.com/sns/latest/dg/sns-dead-letter-queues.html#how-messages-moved-into-dead-letter-queue) for more details.
+
+### Protocol support
+
+Supported values for `protocol` include:
+
+* `application` - Delivers JSON-encoded messages. `endpoint` is the endpoint ARN of a mobile app and device.
+* `firehose` - Delivers JSON-encoded messages. `endpoint` is the ARN of an Amazon Kinesis Data Firehose delivery stream (e.g.,
+`arn:aws:firehose:usEast1:123456789012:deliverystream/ticketUploadStream`).
+* `lambda` - Delivers JSON-encoded messages. `endpoint` is the ARN of an AWS Lambda function.
+* `sms` - Delivers text messages via SMS. `endpoint` is the phone number of an SMS-enabled device.
+* `sqs` - Delivers JSON-encoded messages. `endpoint` is the ARN of an Amazon SQS queue (e.g., `arn:aws:sqs:usWest2:123456789012:terraformQueueToo`).
+
+Partially supported values for `protocol` include:
+
+~> **NOTE:** If an `awsSnsTopicSubscription` uses a partially-supported protocol and the subscription is not confirmed, either through automatic confirmation or means outside of Terraform (e.g., clicking on a "Confirm Subscription" link in an email), Terraform cannot delete / unsubscribe the subscription. Attempting to `destroy` an unconfirmed subscription will remove the `awsSnsTopicSubscription` from Terraform's state but **_will not_** remove the subscription from AWS. The `pendingConfirmation` attribute provides confirmation status.
+
+* `email` - Delivers messages via SMTP. `endpoint` is an email address.
+* `emailJson` - Delivers JSON-encoded messages via SMTP. `endpoint` is an email address.
+* `http` -- Delivers JSON-encoded messages via HTTP POST. `endpoint` is a URL beginning with `http://`.
+* `https` -- Delivers JSON-encoded messages via HTTPS POST. `endpoint` is a URL beginning with `https://`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the subscription.
+* `confirmationWasAuthenticated` - Whether the subscription confirmation request was authenticated.
+* `id` - ARN of the subscription.
+* `ownerId` - AWS account ID of the subscription's owner.
+* `pendingConfirmation` - Whether the subscription has not been confirmed.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SNS Topic Subscriptions using the subscription `arn`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import SNS Topic Subscriptions using the subscription `arn`. For example:
+
+```console
+% terraform import aws_sns_topic_subscription.user_updates_sqs_target arn:aws:sns:us-west-2:0123456789012:my-topic:8a21d249-4329-4871-acc6-7be709c6ea7f
+```
+
+<!-- cache-key: cdktf-0.18.0 input-5b34e1ee5476100d66df854cd8d8f41ffb1973a2919f7c877f7e67fbb902e1f0 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/spot_datafeed_subscription.html.markdown b/website/docs/cdktf/typescript/r/spot_datafeed_subscription.html.markdown
new file mode 100644
index 00000000000..13a37772462
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/spot_datafeed_subscription.html.markdown
@@ -0,0 +1,82 @@
+---
+subcategory: "EC2 (Elastic Compute Cloud)"
+layout: "aws"
+page_title: "AWS: aws_spot_datafeed_subscription"
+description: |-
+  Provides a Spot Datafeed Subscription resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_spot_datafeed_subscription
+
+-> **Note:** There is only a single subscription allowed per account.
+
+To help you understand the charges for your Spot instances, Amazon EC2 provides a data feed that describes your Spot instance usage and pricing.
+This data feed is sent to an Amazon S3 bucket that you specify when you subscribe to the data feed.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { SpotDatafeedSubscription } from "./.gen/providers/aws/spot-datafeed-subscription";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const defaultVar = new S3Bucket(this, "default", {
+      bucket: "tf-spot-datafeed",
+    });
+    const awsSpotDatafeedSubscriptionDefault = new SpotDatafeedSubscription(
+      this,
+      "default_1",
+      {
+        bucket: defaultVar.id,
+        prefix: "my_subdirectory",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSpotDatafeedSubscriptionDefault.overrideLogicalId("default");
+  }
+}
+
+```
+
+## Argument Reference
+
+* `bucket` - (Required) The Amazon S3 bucket in which to store the Spot instance data feed.
+* `prefix` - (Optional) Path of folder inside bucket to place spot pricing data.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import a Spot Datafeed Subscription using the word `spotDatafeedSubscription`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import a Spot Datafeed Subscription using the word `spotDatafeedSubscription`. For example:
+
+```console
+% terraform import aws_spot_datafeed_subscription.mysubscription spot-datafeed-subscription
+```
+
+<!-- cache-key: cdktf-0.18.0 input-70bf26be611a3ee0c49d03716734469d118e9b44f2ed7494fad6b135c57c3c2e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/spot_fleet_request.html.markdown b/website/docs/cdktf/typescript/r/spot_fleet_request.html.markdown
new file mode 100644
index 00000000000..fe604f5457c
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/spot_fleet_request.html.markdown
@@ -0,0 +1,532 @@
+---
+subcategory: "EC2 (Elastic Compute Cloud)"
+layout: "aws"
+page_title: "AWS: aws_spot_fleet_request"
+description: |-
+  Provides a Spot Fleet Request resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_spot_fleet_request
+
+Provides an EC2 Spot Fleet Request resource. This allows a fleet of Spot
+instances to be requested on the Spot market.
+
+~> **NOTE [AWS strongly discourages](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/spot-best-practices.html#which-spot-request-method-to-use) the use of the legacy APIs called by this resource.
+We recommend using the [EC2 Fleet](ec2_fleet.html) or [Auto Scaling Group](autoscaling_group.html) resources instead.
+
+## Example Usage
+
+### Using launch specifications
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SpotFleetRequest } from "./.gen/providers/aws/spot-fleet-request";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SpotFleetRequest(this, "cheap_compute", {
+      allocationStrategy: "diversified",
+      iamFleetRole: "arn:aws:iam::12345678:role/spot-fleet",
+      launchSpecification: [
+        {
+          ami: "ami-1234",
+          iamInstanceProfileArn: example.arn,
+          instanceType: "m4.10xlarge",
+          placementTenancy: "dedicated",
+          spotPrice: "2.793",
+        },
+        {
+          ami: "ami-5678",
+          availabilityZone: "us-west-1a",
+          iamInstanceProfileArn: example.arn,
+          instanceType: "m4.4xlarge",
+          keyName: "my-key",
+          rootBlockDevice: [
+            {
+              volumeSize: Token.asNumber("300"),
+              volumeType: "gp2",
+            },
+          ],
+          spotPrice: "1.117",
+          subnetId: "subnet-1234",
+          tags: {
+            Name: "spot-fleet-example",
+          },
+          weightedCapacity: Token.asString(35),
+        },
+      ],
+      spotPrice: "0.03",
+      targetCapacity: 6,
+      validUntil: "2019-11-04T20:44:20Z",
+    });
+  }
+}
+
+```
+
+### Using launch templates
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { LaunchTemplate } from "./.gen/providers/aws/launch-template";
+import { SpotFleetRequest } from "./.gen/providers/aws/spot-fleet-request";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const foo = new LaunchTemplate(this, "foo", {
+      imageId: "ami-516b9131",
+      instanceType: "m1.small",
+      keyName: "some-key",
+      name: "launch-template",
+    });
+    const awsSpotFleetRequestFoo = new SpotFleetRequest(this, "foo_1", {
+      dependsOn: [testAttach],
+      iamFleetRole: "arn:aws:iam::12345678:role/spot-fleet",
+      launchTemplateConfig: [
+        {
+          launchTemplateSpecification: {
+            id: foo.id,
+            version: Token.asString(foo.latestVersion),
+          },
+        },
+      ],
+      spotPrice: "0.005",
+      targetCapacity: 2,
+      validUntil: "2019-11-04T20:44:20Z",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSpotFleetRequestFoo.overrideLogicalId("foo");
+  }
+}
+
+```
+
+~> **NOTE:** Terraform does not support the functionality where multiple `subnetId` or `availabilityZone` parameters can be specified in the same
+launch configuration block. If you want to specify multiple values, then separate launch configuration blocks should be used or launch template overrides should be configured, one per subnet:
+
+### Using multiple launch specifications
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SpotFleetRequest } from "./.gen/providers/aws/spot-fleet-request";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SpotFleetRequest(this, "foo", {
+      iamFleetRole: "arn:aws:iam::12345678:role/spot-fleet",
+      launchSpecification: [
+        {
+          ami: "ami-d06a90b0",
+          availabilityZone: "us-west-2a",
+          instanceType: "m1.small",
+          keyName: "my-key",
+        },
+        {
+          ami: "ami-d06a90b0",
+          availabilityZone: "us-west-2a",
+          instanceType: "m5.large",
+          keyName: "my-key",
+        },
+      ],
+      spotPrice: "0.005",
+      targetCapacity: 2,
+      validUntil: "2019-11-04T20:44:20Z",
+    });
+  }
+}
+
+```
+
+-> In this example, we use a [`dynamic` block](https://www.terraform.io/language/expressions/dynamic-blocks) to define zero or more `launchSpecification` blocks, producing one for each element in the list of subnet ids.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import {
+  TerraformVariable,
+  Token,
+  TerraformIterator,
+  Fn,
+  TerraformStack,
+} from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SpotFleetRequest } from "./.gen/providers/aws/spot-fleet-request";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    /*Terraform Variables are not always the best fit for getting inputs in the context of Terraform CDK.
+    You can read more about this at https://cdk.tf/variables*/
+    const subnets = new TerraformVariable(this, "subnets", {});
+    /*In most cases loops should be handled in the programming language context and 
+    not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+    you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+    you need to keep this like it is.*/
+    const exampleDynamicIterator0 = TerraformIterator.fromList(
+      Token.asAny(
+        "${[ for s in ${" +
+          subnets.value +
+          "} : {\n      subnet_id = s[1]\n    }]}"
+      )
+    );
+    new SpotFleetRequest(this, "example", {
+      allocationStrategy: "lowestPrice",
+      fleetType: "request",
+      iamFleetRole: "arn:aws:iam::12345678:role/spot-fleet",
+      targetCapacity: 3,
+      terminateInstancesWithExpiration: Token.asBoolean("true"),
+      validUntil: "2019-11-04T20:44:20Z",
+      waitForFulfillment: Token.asBoolean("true"),
+      launchSpecification: exampleDynamicIterator0.dynamic({
+        ami: "ami-1234",
+        instance_type: "m4.4xlarge",
+        root_block_device: [
+          {
+            delete_on_termination: "true",
+            volume_size: "8",
+            volume_type: "gp2",
+          },
+        ],
+        subnet_id: Fn.lookupNested(exampleDynamicIterator0.value, [
+          "subnet_id",
+        ]),
+        tags: {
+          Name: "Spot Node",
+          tag_builder: "builder",
+        },
+        vpc_security_group_ids: "sg-123456",
+      }),
+    });
+  }
+}
+
+```
+
+### Using multiple launch configurations
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, Fn, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsSubnets } from "./.gen/providers/aws/data-aws-subnets";
+import { LaunchTemplate } from "./.gen/providers/aws/launch-template";
+import { SpotFleetRequest } from "./.gen/providers/aws/spot-fleet-request";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const foo = new LaunchTemplate(this, "foo", {
+      imageId: "ami-516b9131",
+      instanceType: "m1.small",
+      keyName: "some-key",
+      name: "launch-template",
+    });
+    const example = new DataAwsSubnets(this, "example", {
+      filter: [
+        {
+          name: "vpc-id",
+          values: [vpcId.stringValue],
+        },
+      ],
+    });
+    const awsSpotFleetRequestFoo = new SpotFleetRequest(this, "foo_2", {
+      dependsOn: [testAttach],
+      iamFleetRole: "arn:aws:iam::12345678:role/spot-fleet",
+      launchTemplateConfig: [
+        {
+          launchTemplateSpecification: {
+            id: foo.id,
+            version: Token.asString(foo.latestVersion),
+          },
+          overrides: [
+            {
+              subnetId: Token.asString(Fn.lookupNested(example.ids, ["0"])),
+            },
+            {
+              subnetId: Token.asString(Fn.lookupNested(example.ids, ["1"])),
+            },
+            {
+              subnetId: Token.asString(Fn.lookupNested(example.ids, ["2"])),
+            },
+          ],
+        },
+      ],
+      spotPrice: "0.005",
+      targetCapacity: 2,
+      validUntil: "2019-11-04T20:44:20Z",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSpotFleetRequestFoo.overrideLogicalId("foo");
+  }
+}
+
+```
+
+## Argument Reference
+
+Most of these arguments directly correspond to the
+[official API](http://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_SpotFleetRequestConfigData.html).
+
+* `iamFleetRole` - (Required) Grants the Spot fleet permission to terminate
+  Spot instances on your behalf when you cancel its Spot fleet request using
+CancelSpotFleetRequests or when the Spot fleet request expires, if you set
+terminateInstancesWithExpiration.
+* `context` - (Optional) Reserved.
+* `replaceUnhealthyInstances` - (Optional) Indicates whether Spot fleet should replace unhealthy instances. Default `false`.
+* `launchSpecification` - (Optional) Used to define the launch configuration of the
+  spot-fleet request. Can be specified multiple times to define different bids
+across different markets and instance types. Conflicts with `launchTemplateConfig`. At least one of `launchSpecification` or `launchTemplateConfig` is required.
+
+    **Note**: This takes in similar but not
+    identical inputs as [`awsInstance`](instance.html).  There are limitations on
+    what you can specify. See the list of officially supported inputs in the
+    [reference documentation](http://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_SpotFleetLaunchSpecification.html). Any normal [`awsInstance`](instance.html) parameter that corresponds to those inputs may be used and it have
+    a additional parameter `iamInstanceProfileArn` takes `awsIamInstanceProfile` attribute `arn` as input.
+
+* `launchTemplateConfig` - (Optional) Launch template configuration block. See [Launch Template Configs](#launch-template-configs) below for more details. Conflicts with `launchSpecification`. At least one of `launchSpecification` or `launchTemplateConfig` is required.
+* `spotMaintenanceStrategies` - (Optional) Nested argument containing maintenance strategies for managing your Spot Instances that are at an elevated risk of being interrupted. Defined below.
+* `spotPrice` - (Optional; Default: On-demand price) The maximum bid price per unit hour.
+* `waitForFulfillment` - (Optional; Default: false) If set, Terraform will
+  wait for the Spot Request to be fulfilled, and will throw an error if the
+  timeout of 10m is reached.
+* `targetCapacity` - The number of units to request. You can choose to set the
+  target capacity in terms of instances or a performance characteristic that is
+  important to your application workload, such as vCPUs, memory, or I/O.
+* `targetCapacityUnitType` - (Optional) The unit for the target capacity. This can only be done with `instanceRequirements` defined
+* `allocationStrategy` - Indicates how to allocate the target capacity across
+  the Spot pools specified by the Spot fleet request. Valid values: `lowestPrice`, `diversified`, `capacityOptimized`, `capacityOptimizedPrioritized`, and `priceCapacityOptimized`. The default is
+  `lowestPrice`.
+* `instancePoolsToUseCount` - (Optional; Default: 1)
+  The number of Spot pools across which to allocate your target Spot capacity.
+  Valid only when `allocationStrategy` is set to `lowestPrice`. Spot Fleet selects
+  the cheapest Spot pools and evenly allocates your target Spot capacity across
+  the number of Spot pools that you specify.
+* `excessCapacityTerminationPolicy` - Indicates whether running Spot
+  instances should be terminated if the target capacity of the Spot fleet
+  request is decreased below the current size of the Spot fleet.
+* `terminateInstancesWithExpiration` - (Optional) Indicates whether running Spot
+  instances should be terminated when the Spot fleet request expires.
+* `terminateInstancesOnDelete` - (Optional) Indicates whether running Spot
+  instances should be terminated when the resource is deleted (and the Spot fleet request cancelled).
+  If no value is specified, the value of the `terminateInstancesWithExpiration` argument is used.
+* `instanceInterruptionBehaviour` - (Optional) Indicates whether a Spot
+  instance stops or terminates when it is interrupted. Default is
+  `terminate`.
+* `fleetType` - (Optional) The type of fleet request. Indicates whether the Spot Fleet only requests the target
+  capacity or also attempts to maintain it. Default is `maintain`.
+* `validUntil` - (Optional) The end date and time of the request, in UTC [RFC3339](https://tools.ietf.org/html/rfc3339#section-5.8) format(for example, YYYY-MM-DDTHH:MM:SSZ). At this point, no new Spot instance requests are placed or enabled to fulfill the request.
+* `validFrom` - (Optional) The start date and time of the request, in UTC [RFC3339](https://tools.ietf.org/html/rfc3339#section-5.8) format(for example, YYYY-MM-DDTHH:MM:SSZ). The default is to start fulfilling the request immediately.
+* `loadBalancers` (Optional) A list of elastic load balancer names to add to the Spot fleet.
+* `targetGroupArns` (Optional) A list of `awsAlbTargetGroup` ARNs, for use with Application Load Balancing.
+* `onDemandAllocationStrategy` - The order of the launch template overrides to use in fulfilling On-Demand capacity. the possible values are: `lowestPrice` and `prioritized`. the default is `lowestPrice`.
+* `onDemandMaxTotalPrice` - The maximum amount per hour for On-Demand Instances that you're willing to pay. When the maximum amount you're willing to pay is reached, the fleet stops launching instances even if it hasn’t met the target capacity.
+* `onDemandTargetCapacity` - The number of On-Demand units to request. If the request type is `maintain`, you can specify a target capacity of 0 and add capacity later.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Launch Template Configs
+
+The `launchTemplateConfig` block supports the following:
+
+* `launchTemplateSpecification` - (Required) Launch template specification. See [Launch Template Specification](#launch-template-specification) below for more details.
+* `overrides` - (Optional) One or more override configurations. See [Overrides](#overrides) below for more details.
+
+### Launch Template Specification
+
+* `id` - The ID of the launch template. Conflicts with `name`.
+* `name` - The name of the launch template. Conflicts with `id`.
+* `version` - (Optional) Template version. Unlike the autoscaling equivalent, does not support `$latest` or `$default`, so use the launch_template resource's attribute, e.g., `"${awsLaunchTemplateFooLatestVersion}"`. It will use the default version if omitted.
+
+    **Note:** The specified launch template can specify only a subset of the
+    inputs of [`awsLaunchTemplate`](launch_template.html).  There are limitations on
+    what you can specify as spot fleet does not support all the attributes that are supported by autoscaling groups. [AWS documentation](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-launch-templates.html#launch-templates-spot-fleet) is currently sparse, but at least `instanceInitiatedShutdownBehavior` is confirmed unsupported.
+
+### spot_maintenance_strategies
+
+* `capacityRebalance` - (Optional) Nested argument containing the capacity rebalance for your fleet request. Defined below.
+
+### capacity_rebalance
+
+* `replacementStrategy` - (Optional) The replacement strategy to use. Only available for spot fleets with `fleetType` set to `maintain`. Valid values: `launch`.
+
+### Overrides
+
+* `availabilityZone` - (Optional) The availability zone in which to place the request.
+* `instanceRequirements` - (Optional) The instance requirements. See below.
+* `instanceType` - (Optional) The type of instance to request.
+* `priority` - (Optional) The priority for the launch template override. The lower the number, the higher the priority. If no number is set, the launch template override has the lowest priority.
+* `spotPrice` - (Optional) The maximum spot bid for this override request.
+* `subnetId` - (Optional) The subnet in which to launch the requested instance.
+* `weightedCapacity` - (Optional) The capacity added to the fleet by a fulfilled request.
+
+### Instance Requirements
+
+This configuration block supports the following:
+
+* `acceleratorCount` - (Optional) Block describing the minimum and maximum number of accelerators (GPUs, FPGAs, or AWS Inferentia chips). Default is no minimum or maximum.
+    * `min` - (Optional) Minimum.
+    * `max` - (Optional) Maximum. Set to `0` to exclude instance types with accelerators.
+* `acceleratorManufacturers` - (Optional) List of accelerator manufacturer names. Default is any manufacturer.
+
+    ```
+    Valid names:
+      * amazon-web-services
+      * amd
+      * nvidia
+      * xilinx
+    ```
+
+* `acceleratorNames` - (Optional) List of accelerator names. Default is any acclerator.
+
+    ```
+    Valid names:
+      * a100            - NVIDIA A100 GPUs
+      * v100            - NVIDIA V100 GPUs
+      * k80             - NVIDIA K80 GPUs
+      * t4              - NVIDIA T4 GPUs
+      * m60             - NVIDIA M60 GPUs
+      * radeon-pro-v520 - AMD Radeon Pro V520 GPUs
+      * vu9p            - Xilinx VU9P FPGAs
+    ```
+
+* `acceleratorTotalMemoryMib` - (Optional) Block describing the minimum and maximum total memory of the accelerators. Default is no minimum or maximum.
+    * `min` - (Optional) Minimum.
+    * `max` - (Optional) Maximum.
+* `acceleratorTypes` - (Optional) List of accelerator types. Default is any accelerator type.
+
+    ```
+    Valid types:
+      * fpga
+      * gpu
+      * inference
+    ```
+
+* `allowedInstanceTypes` - (Optional) List of instance types to apply your specified attributes against. All other instance types are ignored, even if they match your specified attributes. You can use strings with one or more wild cards, represented by an asterisk (\*), to allow an instance type, size, or generation. The following are examples: `m58Xlarge`, `c5*.*`, `m5A.*`, `r*`, `*3*`. For example, if you specify `c5*`, you are allowing the entire C5 instance family, which includes all C5a and C5n instance types. If you specify `m5A.*`, you are allowing all the M5a instance types, but not the M5n instance types. Maximum of 400 entries in the list; each entry is limited to 30 characters. Default is all instance types.
+
+    ~> **NOTE:** If you specify `allowedInstanceTypes`, you can't specify `excludedInstanceTypes`.
+
+* `bareMetal` - (Optional) Indicate whether bare metal instace types should be `included`, `excluded`, or `required`. Default is `excluded`.
+* `baselineEbsBandwidthMbps` - (Optional) Block describing the minimum and maximum baseline EBS bandwidth, in Mbps. Default is no minimum or maximum.
+    * `min` - (Optional) Minimum.
+    * `max` - (Optional) Maximum.
+* `burstablePerformance` - (Optional) Indicate whether burstable performance instance types should be `included`, `excluded`, or `required`. Default is `excluded`.
+* `cpuManufacturers` (Optional) List of CPU manufacturer names. Default is any manufacturer.
+
+    ~> **NOTE:** Don't confuse the CPU hardware manufacturer with the CPU hardware architecture. Instances will be launched with a compatible CPU architecture based on the Amazon Machine Image (AMI) that you specify in your launch template.
+
+    ```
+    Valid names:
+      * amazon-web-services
+      * amd
+      * intel
+    ```
+
+* `excludedInstanceTypes` - (Optional) List of instance types to exclude. You can use strings with one or more wild cards, represented by an asterisk (\*), to exclude an instance type, size, or generation. The following are examples: `m58Xlarge`, `c5*.*`, `m5A.*`, `r*`, `*3*`. For example, if you specify `c5*`, you are excluding the entire C5 instance family, which includes all C5a and C5n instance types. If you specify `m5A.*`, you are excluding all the M5a instance types, but not the M5n instance types. Maximum of 400 entries in the list; each entry is limited to 30 characters. Default is no excluded instance types.
+
+    ~> **NOTE:** If you specify `excludedInstanceTypes`, you can't specify `allowedInstanceTypes`.
+
+* `instanceGenerations` - (Optional) List of instance generation names. Default is any generation.
+
+    ```
+    Valid names:
+      * current  - Recommended for best performance.
+      * previous - For existing applications optimized for older instance types.
+    ```
+
+* `localStorage` - (Optional) Indicate whether instance types with local storage volumes are `included`, `excluded`, or `required`. Default is `included`.
+* `localStorageTypes` - (Optional) List of local storage type names. Default any storage type.
+
+    ```
+    Value names:
+      * hdd - hard disk drive
+      * ssd - solid state drive
+    ```
+
+* `memoryGibPerVcpu` - (Optional) Block describing the minimum and maximum amount of memory (GiB) per vCPU. Default is no minimum or maximum.
+    * `min` - (Optional) Minimum. May be a decimal number, e.g. `05`.
+    * `max` - (Optional) Maximum. May be a decimal number, e.g. `05`.
+* `memoryMib` - (Optional) Block describing the minimum and maximum amount of memory (MiB). Default is no maximum.
+    * `min` - (Optional) Minimum.
+    * `max` - (Optional) Maximum.
+* `networkBandwidthGbps` - (Optional) Block describing the minimum and maximum amount of network bandwidth, in gigabits per second (Gbps). Default is no minimum or maximum.
+    * `min` - (Optional) Minimum.
+    * `max` - (Optional) Maximum.
+* `networkInterfaceCount` - (Optional) Block describing the minimum and maximum number of network interfaces. Default is no minimum or maximum.
+    * `min` - (Optional) Minimum.
+    * `max` - (Optional) Maximum.
+* `onDemandMaxPricePercentageOverLowestPrice` - (Optional) The price protection threshold for On-Demand Instances. This is the maximum you’ll pay for an On-Demand Instance, expressed as a percentage higher than the cheapest M, C, or R instance type with your specified attributes. When Amazon EC2 Auto Scaling selects instance types with your attributes, we will exclude instance types whose price is higher than your threshold. The parameter accepts an integer, which Amazon EC2 Auto Scaling interprets as a percentage. To turn off price protection, specify a high value, such as 999999. Default is 20.
+
+    If you set DesiredCapacityType to vcpu or memory-mib, the price protection threshold is applied based on the per vCPU or per memory price instead of the per instance price.
+* `requireHibernateSupport` - (Optional) Indicate whether instance types must support On-Demand Instance Hibernation, either `true` or `false`. Default is `false`.
+* `spotMaxPricePercentageOverLowestPrice` - (Optional) The price protection threshold for Spot Instances. This is the maximum you’ll pay for a Spot Instance, expressed as a percentage higher than the cheapest M, C, or R instance type with your specified attributes. When Amazon EC2 Auto Scaling selects instance types with your attributes, we will exclude instance types whose price is higher than your threshold. The parameter accepts an integer, which Amazon EC2 Auto Scaling interprets as a percentage. To turn off price protection, specify a high value, such as 999999. Default is 100.
+
+    If you set DesiredCapacityType to vcpu or memory-mib, the price protection threshold is applied based on the per vCPU or per memory price instead of the per instance price.
+* `totalLocalStorageGb` - (Optional) Block describing the minimum and maximum total local storage (GB). Default is no minimum or maximum.
+    * `min` - (Optional) Minimum. May be a decimal number, e.g. `05`.
+    * `max` - (Optional) Maximum. May be a decimal number, e.g. `05`.
+* `vcpuCount` - (Optional) Block describing the minimum and maximum number of vCPUs. Default is no maximum.
+    * `min` - (Optional) Minimum.
+    * `max` - (Optional) Maximum.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Spot fleet request ID
+* `spotRequestState` - The state of the Spot fleet request.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `10M`)
+* `delete` - (Default `15M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Spot Fleet Requests using `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Spot Fleet Requests using `id`. For example:
+
+```console
+% terraform import aws_spot_fleet_request.fleet sfr-005e9ec8-5546-4c31-b317-31a62325411e
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1ecd23c004a4840044b58f08e2d76b93455d0e78ffddfd4a1e1ae619c9c18174 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/spot_instance_request.html.markdown b/website/docs/cdktf/typescript/r/spot_instance_request.html.markdown
new file mode 100644
index 00000000000..3a4a9191b7e
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/spot_instance_request.html.markdown
@@ -0,0 +1,120 @@
+---
+subcategory: "EC2 (Elastic Compute Cloud)"
+layout: "aws"
+page_title: "AWS: aws_spot_instance_request"
+description: |-
+  Provides a Spot Instance Request resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_spot_instance_request
+
+Provides an EC2 Spot Instance Request resource. This allows instances to be
+requested on the spot market.
+
+By default Terraform creates Spot Instance Requests with a `persistent` type,
+which means that for the duration of their lifetime, AWS will launch an
+instance with the configured details if and when the spot market will accept
+the requested price.
+
+On destruction, Terraform will make an attempt to terminate the associated Spot
+Instance if there is one present.
+
+Spot Instances requests with a `oneTime` type will close the spot request
+when the instance is terminated either by the request being below the current spot
+price availability or by a user.
+
+~> **NOTE:** Because their behavior depends on the live status of the spot
+market, Spot Instance Requests have a unique lifecycle that makes them behave
+differently than other Terraform resources. Most importantly: there is __no
+guarantee__ that a Spot Instance exists to fulfill the request at any given
+point in time. See the [AWS Spot Instance
+documentation](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-spot-instances.html)
+for more information.
+
+~> **NOTE [AWS strongly discourages](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/spot-best-practices.html#which-spot-request-method-to-use) the use of the legacy APIs called by this resource.
+We recommend using the [EC2 Instance](instance.html) resource with `instanceMarketOptions` instead.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SpotInstanceRequest } from "./.gen/providers/aws/spot-instance-request";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SpotInstanceRequest(this, "cheap_worker", {
+      ami: "ami-1234",
+      instanceType: "c4.xlarge",
+      spotPrice: "0.03",
+      tags: {
+        Name: "CheapWorker",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+Spot Instance Requests support all the same arguments as
+[`awsInstance`](instance.html), with the addition of:
+
+* `spotPrice` - (Optional; Default: On-demand price) The maximum price to request on the spot market.
+* `waitForFulfillment` - (Optional; Default: false) If set, Terraform will
+  wait for the Spot Request to be fulfilled, and will throw an error if the
+  timeout of 10m is reached.
+* `spotType` - (Optional; Default: `persistent`) If set to `oneTime`, after
+  the instance is terminated, the spot request will be closed.
+* `launchGroup` - (Optional) A launch group is a group of spot instances that launch together and terminate together.
+  If left empty instances are launched and terminated individually.
+* `blockDurationMinutes` - (Optional) The required duration for the Spot instances, in minutes. This value must be a multiple of 60 (60, 120, 180, 240, 300, or 360).
+  The duration period starts as soon as your Spot instance receives its instance ID. At the end of the duration period, Amazon EC2 marks the Spot instance for termination and provides a Spot instance termination notice, which gives the instance a two-minute warning before it terminates.
+  Note that you can't specify an Availability Zone group or a launch group if you specify a duration.
+* `instanceInterruptionBehavior` - (Optional) Indicates Spot instance behavior when it is interrupted. Valid values are `terminate`, `stop`, or `hibernate`. Default value is `terminate`.
+* `validUntil` - (Optional) The end date and time of the request, in UTC [RFC3339](https://tools.ietf.org/html/rfc3339#section-5.8) format(for example, YYYY-MM-DDTHH:MM:SSZ). At this point, no new Spot instance requests are placed or enabled to fulfill the request. The default end date is 7 days from the current date.
+* `validFrom` - (Optional) The start date and time of the request, in UTC [RFC3339](https://tools.ietf.org/html/rfc3339#section-5.8) format(for example, YYYY-MM-DDTHH:MM:SSZ). The default is to start fulfilling the request immediately.
+* `tags` - (Optional) A map of tags to assign to the Spot Instance Request. These tags are not automatically applied to the launched Instance. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Spot Instance Request ID.
+
+These attributes are exported, but they are expected to change over time and so
+should only be used for informational purposes, not for resource dependencies:
+
+* `spotBidStatus` - The current [bid
+  status](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/spot-bid-status.html)
+  of the Spot Instance Request.
+* `spotRequestState` The current [request
+  state](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/spot-requests.html#creating-spot-request-status)
+  of the Spot Instance Request.
+* `spotInstanceId` - The Instance ID (if any) that is currently fulfilling
+  the Spot Instance request.
+* `publicDns` - The public DNS name assigned to the instance. For EC2-VPC, this
+  is only available if you've enabled DNS hostnames for your VPC
+* `publicIp` - The public IP address assigned to the instance, if applicable.
+* `privateDns` - The private DNS name assigned to the instance. Can only be
+  used inside the Amazon EC2, and only available if you've enabled DNS hostnames
+  for your VPC
+* `privateIp` - The private IP address assigned to the instance
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `10M`)
+* `delete` - (Default `20M`)
+
+<!-- cache-key: cdktf-0.18.0 input-c3c3583217fff10aa06f5c451738196ae8dc39997f2223d31cdbbf7593fbebc2 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/sqs_queue.html.markdown b/website/docs/cdktf/typescript/r/sqs_queue.html.markdown
new file mode 100644
index 00000000000..4fd27a8ef59
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/sqs_queue.html.markdown
@@ -0,0 +1,228 @@
+---
+subcategory: "SQS (Simple Queue)"
+layout: "aws"
+page_title: "AWS: aws_sqs_queue"
+description: |-
+  Provides a SQS resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sqs_queue
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SqsQueue } from "./.gen/providers/aws/sqs-queue";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SqsQueue(this, "terraform_queue", {
+      delaySeconds: 90,
+      maxMessageSize: 2048,
+      messageRetentionSeconds: 86400,
+      name: "terraform-example-queue",
+      receiveWaitTimeSeconds: 10,
+      redrivePolicy: Token.asString(
+        Fn.jsonencode({
+          deadLetterTargetArn: terraformQueueDeadletter.arn,
+          maxReceiveCount: 4,
+        })
+      ),
+      tags: {
+        Environment: "production",
+      },
+    });
+  }
+}
+
+```
+
+## FIFO queue
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SqsQueue } from "./.gen/providers/aws/sqs-queue";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SqsQueue(this, "terraform_queue", {
+      contentBasedDeduplication: true,
+      fifoQueue: true,
+      name: "terraform-example-queue.fifo",
+    });
+  }
+}
+
+```
+
+## High-throughput FIFO queue
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SqsQueue } from "./.gen/providers/aws/sqs-queue";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SqsQueue(this, "terraform_queue", {
+      deduplicationScope: "messageGroup",
+      fifoQueue: true,
+      fifoThroughputLimit: "perMessageGroupId",
+      name: "terraform-example-queue.fifo",
+    });
+  }
+}
+
+```
+
+## Dead-letter queue
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SqsQueue } from "./.gen/providers/aws/sqs-queue";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SqsQueue(this, "terraform_queue_deadletter", {
+      name: "terraform-example-deadletter-queue",
+      redriveAllowPolicy: Token.asString(
+        Fn.jsonencode({
+          redrivePermission: "byQueue",
+          sourceQueueArns: [terraformQueue.arn],
+        })
+      ),
+    });
+  }
+}
+
+```
+
+## Server-side encryption (SSE)
+
+Using [SSE-SQS](https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-configure-sqs-sse-queue.html):
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SqsQueue } from "./.gen/providers/aws/sqs-queue";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SqsQueue(this, "terraform_queue", {
+      name: "terraform-example-queue",
+      sqsManagedSseEnabled: true,
+    });
+  }
+}
+
+```
+
+Using [SSE-KMS](https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-configure-sse-existing-queue.html):
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SqsQueue } from "./.gen/providers/aws/sqs-queue";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SqsQueue(this, "terraform_queue", {
+      kmsDataKeyReusePeriodSeconds: 300,
+      kmsMasterKeyId: "alias/aws/sqs",
+      name: "terraform-example-queue",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Optional) The name of the queue. Queue names must be made up of only uppercase and lowercase ASCII letters, numbers, underscores, and hyphens, and must be between 1 and 80 characters long. For a FIFO (first-in-first-out) queue, the name must end with the `fifo` suffix. If omitted, Terraform will assign a random, unique name. Conflicts with `namePrefix`
+* `namePrefix` - (Optional) Creates a unique name beginning with the specified prefix. Conflicts with `name`
+* `visibilityTimeoutSeconds` - (Optional) The visibility timeout for the queue. An integer from 0 to 43200 (12 hours). The default for this attribute is 30. For more information about visibility timeout, see [AWS docs](https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/AboutVT.html).
+* `messageRetentionSeconds` - (Optional) The number of seconds Amazon SQS retains a message. Integer representing seconds, from 60 (1 minute) to 1209600 (14 days). The default for this attribute is 345600 (4 days).
+* `maxMessageSize` - (Optional) The limit of how many bytes a message can contain before Amazon SQS rejects it. An integer from 1024 bytes (1 KiB) up to 262144 bytes (256 KiB). The default for this attribute is 262144 (256 KiB).
+* `delaySeconds` - (Optional) The time in seconds that the delivery of all messages in the queue will be delayed. An integer from 0 to 900 (15 minutes). The default for this attribute is 0 seconds.
+* `receiveWaitTimeSeconds` - (Optional) The time for which a ReceiveMessage call will wait for a message to arrive (long polling) before returning. An integer from 0 to 20 (seconds). The default for this attribute is 0, meaning that the call will return immediately.
+* `policy` - (Optional) The JSON policy for the SQS queue. For more information about building AWS IAM policy documents with Terraform, see the [AWS IAM Policy Document Guide](https://learn.hashicorp.com/terraform/aws/iam-policy).
+* `redrivePolicy` - (Optional) The JSON policy to set up the Dead Letter Queue, see [AWS docs](https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/SQSDeadLetterQueue.html). **Note:** when specifying `maxReceiveCount`, you must specify it as an integer (`5`), and not a string (`"5"`).
+* `redriveAllowPolicy` - (Optional) The JSON policy to set up the Dead Letter Queue redrive permission, see [AWS docs](https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/SQSDeadLetterQueue.html).
+* `fifoQueue` - (Optional) Boolean designating a FIFO queue. If not set, it defaults to `false` making it standard.
+* `contentBasedDeduplication` - (Optional) Enables content-based deduplication for FIFO queues. For more information, see the [related documentation](http://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/FIFO-queues.html#FIFO-queues-exactly-once-processing)
+* `sqsManagedSseEnabled` - (Optional) Boolean to enable server-side encryption (SSE) of message content with SQS-owned encryption keys. See [Encryption at rest](https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-server-side-encryption.html). Terraform will only perform drift detection of its value when present in a configuration.
+* `kmsMasterKeyId` - (Optional) The ID of an AWS-managed customer master key (CMK) for Amazon SQS or a custom CMK. For more information, see [Key Terms](http://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-server-side-encryption.html#sqs-sse-key-terms).
+* `kmsDataKeyReusePeriodSeconds` - (Optional) The length of time, in seconds, for which Amazon SQS can reuse a data key to encrypt or decrypt messages before calling AWS KMS again. An integer representing seconds, between 60 seconds (1 minute) and 86,400 seconds (24 hours). The default is 300 (5 minutes).
+* `deduplicationScope` - (Optional) Specifies whether message deduplication occurs at the message group or queue level. Valid values are `messageGroup` and `queue` (default).
+* `fifoThroughputLimit` - (Optional) Specifies whether the FIFO queue throughput quota applies to the entire queue or per message group. Valid values are `perQueue` (default) and `perMessageGroupId`.
+* `tags` - (Optional) A map of tags to assign to the queue. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The URL for the created Amazon SQS queue.
+* `arn` - The ARN of the SQS queue
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `url` - Same as `id`: The URL for the created Amazon SQS queue.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SQS Queues using the queue `url`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import SQS Queues using the queue `url`. For example:
+
+```console
+% terraform import aws_sqs_queue.public_queue https://queue.amazonaws.com/80398EXAMPLE/MyQueue
+```
+
+<!-- cache-key: cdktf-0.18.0 input-61c8bbd892ec566ac1dba66044b682f7399f3a0480c812df8151302e52b9e635 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/sqs_queue_policy.html.markdown b/website/docs/cdktf/typescript/r/sqs_queue_policy.html.markdown
new file mode 100644
index 00000000000..ef1b78fed53
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/sqs_queue_policy.html.markdown
@@ -0,0 +1,102 @@
+---
+subcategory: "SQS (Simple Queue)"
+layout: "aws"
+page_title: "AWS: aws_sqs_queue_policy"
+description: |-
+  Provides a SQS Queue Policy resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sqs_queue_policy
+
+Allows you to set a policy of an SQS Queue
+while referencing ARN of the queue within the policy.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { SqsQueue } from "./.gen/providers/aws/sqs-queue";
+import { SqsQueuePolicy } from "./.gen/providers/aws/sqs-queue-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const q = new SqsQueue(this, "q", {
+      name: "examplequeue",
+    });
+    const test = new DataAwsIamPolicyDocument(this, "test", {
+      statement: [
+        {
+          actions: ["sqs:SendMessage"],
+          condition: [
+            {
+              test: "ArnEquals",
+              values: [example.arn],
+              variable: "aws:SourceArn",
+            },
+          ],
+          effect: "Allow",
+          principals: [
+            {
+              identifiers: ["*"],
+              type: "*",
+            },
+          ],
+          resources: [q.arn],
+          sid: "First",
+        },
+      ],
+    });
+    const awsSqsQueuePolicyTest = new SqsQueuePolicy(this, "test_2", {
+      policy: Token.asString(test.json),
+      queueUrl: q.id,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSqsQueuePolicyTest.overrideLogicalId("test");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `queueUrl` - (Required) The URL of the SQS Queue to which to attach the policy
+* `policy` - (Required) The JSON policy for the SQS queue. For more information about building AWS IAM policy documents with Terraform, see the [AWS IAM Policy Document Guide](https://learn.hashicorp.com/terraform/aws/iam-policy).
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SQS Queue Policies using the queue URL. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import SQS Queue Policies using the queue URL. For example:
+
+```console
+% terraform import aws_sqs_queue_policy.test https://queue.amazonaws.com/0123456789012/myqueue
+```
+
+<!-- cache-key: cdktf-0.18.0 input-07637ff0b9efc607148fb133417a818d191130d7adbc072b948e54c46e471ace -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/sqs_queue_redrive_allow_policy.html.markdown b/website/docs/cdktf/typescript/r/sqs_queue_redrive_allow_policy.html.markdown
new file mode 100644
index 00000000000..2a1f48f9210
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/sqs_queue_redrive_allow_policy.html.markdown
@@ -0,0 +1,95 @@
+---
+subcategory: "SQS (Simple Queue)"
+layout: "aws"
+page_title: "AWS: aws_sqs_queue_redrive_allow_policy"
+description: |-
+  Provides a SQS Queue Redrive Allow Policy resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sqs_queue_redrive_allow_policy
+
+Provides a SQS Queue Redrive Allow Policy resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SqsQueue } from "./.gen/providers/aws/sqs-queue";
+import { SqsQueueRedriveAllowPolicy } from "./.gen/providers/aws/sqs-queue-redrive-allow-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new SqsQueue(this, "example", {
+      name: "examplequeue",
+    });
+    const src = new SqsQueue(this, "src", {
+      name: "srcqueue",
+      redrivePolicy: Token.asString(
+        Fn.jsonencode({
+          deadLetterTargetArn: example.arn,
+          maxReceiveCount: 4,
+        })
+      ),
+    });
+    const awsSqsQueueRedriveAllowPolicyExample = new SqsQueueRedriveAllowPolicy(
+      this,
+      "example_2",
+      {
+        queueUrl: example.id,
+        redriveAllowPolicy: Token.asString(
+          Fn.jsonencode({
+            redrivePermission: "byQueue",
+            sourceQueueArns: [src.arn],
+          })
+        ),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSqsQueueRedriveAllowPolicyExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `queueUrl` - (Required) The URL of the SQS Queue to which to attach the policy
+* `redriveAllowPolicy` - (Required) The JSON redrive allow policy for the SQS queue. Learn more in the [Amazon SQS dead-letter queues documentation](https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-dead-letter-queues.html).
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SQS Queue Redrive Allow Policies using the queue URL. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import SQS Queue Redrive Allow Policies using the queue URL. For example:
+
+```console
+% terraform import aws_sqs_queue_redrive_allow_policy.test https://queue.amazonaws.com/0123456789012/myqueue
+```
+
+<!-- cache-key: cdktf-0.18.0 input-20610df5ca53af34101414784f648f77a8c2ab89455909b2c2cae249011aae9c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/sqs_queue_redrive_policy.html.markdown b/website/docs/cdktf/typescript/r/sqs_queue_redrive_policy.html.markdown
new file mode 100644
index 00000000000..33cef97420e
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/sqs_queue_redrive_policy.html.markdown
@@ -0,0 +1,96 @@
+---
+subcategory: "SQS (Simple Queue)"
+layout: "aws"
+page_title: "AWS: aws_sqs_queue_redrive_policy"
+description: |-
+  Provides a SQS Queue Redrive Policy resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_sqs_queue_redrive_policy
+
+Allows you to set a redrive policy of an SQS Queue
+while referencing ARN of the dead letter queue inside the redrive policy.
+
+This is useful when you want to set a dedicated
+dead letter queue for a standard or FIFO queue, but need
+the dead letter queue to exist before setting the redrive policy.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SqsQueue } from "./.gen/providers/aws/sqs-queue";
+import { SqsQueueRedrivePolicy } from "./.gen/providers/aws/sqs-queue-redrive-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const q = new SqsQueue(this, "q", {
+      name: "examplequeue",
+    });
+    const ddl = new SqsQueue(this, "ddl", {
+      name: "examplequeue-ddl",
+      redriveAllowPolicy: Token.asString(
+        Fn.jsonencode({
+          redrivePermission: "byQueue",
+          sourceQueueArns: [q.arn],
+        })
+      ),
+    });
+    const awsSqsQueueRedrivePolicyQ = new SqsQueueRedrivePolicy(this, "q_2", {
+      queueUrl: q.id,
+      redrivePolicy: Token.asString(
+        Fn.jsonencode({
+          deadLetterTargetArn: ddl.arn,
+          maxReceiveCount: 4,
+        })
+      ),
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSqsQueueRedrivePolicyQ.overrideLogicalId("q");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `queueUrl` - (Required) The URL of the SQS Queue to which to attach the policy
+* `redrivePolicy` - (Required) The JSON redrive policy for the SQS queue. Accepts two key/val pairs: `deadLetterTargetArn` and `maxReceiveCount`. Learn more in the [Amazon SQS dead-letter queues documentation](https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-dead-letter-queues.html).
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SQS Queue Redrive Policies using the queue URL. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import SQS Queue Redrive Policies using the queue URL. For example:
+
+```console
+% terraform import aws_sqs_queue_redrive_policy.test https://queue.amazonaws.com/0123456789012/myqueue
+```
+
+<!-- cache-key: cdktf-0.18.0 input-e7f48e464819827bf219c6c6888346afabe01cbaae381206aa80f3e9ec43811a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ssm_activation.html.markdown b/website/docs/cdktf/typescript/r/ssm_activation.html.markdown
new file mode 100644
index 00000000000..f1b011c8bee
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/ssm_activation.html.markdown
@@ -0,0 +1,116 @@
+---
+subcategory: "SSM (Systems Manager)"
+layout: "aws"
+page_title: "AWS: aws_ssm_activation"
+description: |-
+  Registers an on-premises server or virtual machine with Amazon EC2 so that it can be managed using Run Command.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ssm_activation
+
+Registers an on-premises server or virtual machine with Amazon EC2 so that it can be managed using Run Command.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+import { IamRolePolicyAttachment } from "./.gen/providers/aws/iam-role-policy-attachment";
+import { SsmActivation } from "./.gen/providers/aws/ssm-activation";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const assumeRole = new DataAwsIamPolicyDocument(this, "assume_role", {
+      statement: [
+        {
+          actions: ["sts:AssumeRole"],
+          effect: "Allow",
+          principals: [
+            {
+              identifiers: ["ssm.amazonaws.com"],
+              type: "Service",
+            },
+          ],
+        },
+      ],
+    });
+    const testRole = new IamRole(this, "test_role", {
+      assumeRolePolicy: Token.asString(assumeRole.json),
+      name: "test_role",
+    });
+    const testAttach = new IamRolePolicyAttachment(this, "test_attach", {
+      policyArn: "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore",
+      role: testRole.name,
+    });
+    new SsmActivation(this, "foo", {
+      dependsOn: [testAttach],
+      description: "Test",
+      iamRole: testRole.id,
+      name: "test_ssm_activation",
+      registrationLimit: Token.asNumber("5"),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Optional) The default name of the registered managed instance.
+* `description` - (Optional) The description of the resource that you want to register.
+* `expirationDate` - (Optional) UTC timestamp in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8) by which this activation request should expire. The default value is 24 hours from resource creation time. Terraform will only perform drift detection of its value when present in a configuration.
+* `iamRole` - (Required) The IAM Role to attach to the managed instance.
+* `registrationLimit` - (Optional) The maximum number of managed instances you want to register. The default value is 1 instance.
+* `tags` - (Optional) A map of tags to assign to the object. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The activation ID.
+* `activationCode` - The code the system generates when it processes the activation.
+* `name` - The default name of the registered managed instance.
+* `description` - The description of the resource that was registered.
+* `expired` - If the current activation has expired.
+* `expirationDate` - The date by which this activation request should expire. The default value is 24 hours.
+* `iamRole` - The IAM Role attached to the managed instance.
+* `registrationLimit` - The maximum number of managed instances you want to be registered. The default value is 1 instance.
+* `registrationCount` - The number of managed instances that are currently registered using this activation.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AWS SSM Activation using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import AWS SSM Activation using the `id`. For example:
+
+```console
+% terraform import aws_ssm_activation.example e488f2f6-e686-4afb-8a04-ef6dfEXAMPLE
+```
+
+-> **Note:** The `activationCode` attribute cannot be imported.
+
+<!-- cache-key: cdktf-0.18.0 input-e0dcbe52e67919de9e8b8b10107faae656e18b0e36f4833aba51256613ff37fd -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ssm_association.html.markdown b/website/docs/cdktf/typescript/r/ssm_association.html.markdown
new file mode 100644
index 00000000000..225ffb69ec1
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/ssm_association.html.markdown
@@ -0,0 +1,199 @@
+---
+subcategory: "SSM (Systems Manager)"
+layout: "aws"
+page_title: "AWS: aws_ssm_association"
+description: |-
+  Associates an SSM Document to an instance or EC2 tag.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ssm_association
+
+Associates an SSM Document to an instance or EC2 tag.
+
+## Example Usage
+
+### Create an association for a specific instance
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SsmAssociation } from "./.gen/providers/aws/ssm-association";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SsmAssociation(this, "example", {
+      name: Token.asString(awsSsmDocumentExample.name),
+      targets: [
+        {
+          key: "InstanceIds",
+          values: [Token.asString(awsInstanceExample.id)],
+        },
+      ],
+    });
+  }
+}
+
+```
+
+### Create an association for all managed instances in an AWS account
+
+To target all managed instances in an AWS account, set the `key` as `"instanceIds"` with `values` set as `["*"]`. This example also illustrates how to use an Amazon owned SSM document named `amazonCloudWatchManageAgent`.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SsmAssociation } from "./.gen/providers/aws/ssm-association";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SsmAssociation(this, "example", {
+      name: "AmazonCloudWatch-ManageAgent",
+      targets: [
+        {
+          key: "InstanceIds",
+          values: ["*"],
+        },
+      ],
+    });
+  }
+}
+
+```
+
+### Create an association for a specific tag
+
+This example shows how to target all managed instances that are assigned a tag key of `environment` and value of `development`.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SsmAssociation } from "./.gen/providers/aws/ssm-association";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SsmAssociation(this, "example", {
+      name: "AmazonCloudWatch-ManageAgent",
+      targets: [
+        {
+          key: "tag:Environment",
+          values: ["Development"],
+        },
+      ],
+    });
+  }
+}
+
+```
+
+### Create an association with a specific schedule
+
+This example shows how to schedule an association in various ways.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SsmAssociation } from "./.gen/providers/aws/ssm-association";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SsmAssociation(this, "example", {
+      name: Token.asString(awsSsmDocumentExample.name),
+      scheduleExpression: "cron(0 2 ? * SUN *)",
+      targets: [
+        {
+          key: "InstanceIds",
+          values: [Token.asString(awsInstanceExample.id)],
+        },
+      ],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the SSM document to apply.
+* `applyOnlyAtCronInterval` - (Optional) By default, when you create a new or update associations, the system runs it immediately and then according to the schedule you specified. Enable this option if you do not want an association to run immediately after you create or update it. This parameter is not supported for rate expressions. Default: `false`.
+* `associationName` - (Optional) The descriptive name for the association.
+* `automationTargetParameterName` - (Optional) Specify the target for the association. This target is required for associations that use an `automation` document and target resources by using rate controls. This should be set to the SSM document `parameter` that will define how your automation will branch out.
+* `complianceSeverity` - (Optional) The compliance severity for the association. Can be one of the following: `unspecified`, `low`, `medium`, `high` or `critical`
+* `documentVersion` - (Optional) The document version you want to associate with the target(s). Can be a specific version or the default version.
+* `instanceId` - (Optional, **Deprecated**) The instance ID to apply an SSM document to. Use `targets` with key `instanceIds` for document schema versions 2.0 and above. Use the `targets` attribute instead.
+* `maxConcurrency` - (Optional) The maximum number of targets allowed to run the association at the same time. You can specify a number, for example 10, or a percentage of the target set, for example 10%.
+* `maxErrors` - (Optional) The number of errors that are allowed before the system stops sending requests to run the association on additional targets. You can specify a number, for example 10, or a percentage of the target set, for example 10%. If you specify a threshold of 3, the stop command is sent when the fourth error is returned. If you specify a threshold of 10% for 50 associations, the stop command is sent when the sixth error is returned.
+* `outputLocation` - (Optional) An output location block. Output Location is documented below.
+* `parameters` - (Optional) A block of arbitrary string parameters to pass to the SSM document.
+* `scheduleExpression` - (Optional) A [cron or rate expression](https://docs.aws.amazon.com/systems-manager/latest/userguide/reference-cron-and-rate-expressions.html) that specifies when the association runs.
+* `syncCompliance` - (Optional) The mode for generating association compliance. You can specify `auto` or `manual`.
+* `targets` - (Optional) A block containing the targets of the SSM association. Targets are documented below. AWS currently supports a maximum of 5 targets.
+* `waitForSuccessTimeoutSeconds` - (Optional) The number of seconds to wait for the association status to be `success`. If `success` status is not reached within the given time, create opration will fail.
+
+Output Location (`outputLocation`) is an S3 bucket where you want to store the results of this association:
+
+* `s3BucketName` - (Required) The S3 bucket name.
+* `s3KeyPrefix` - (Optional) The S3 bucket prefix. Results stored in the root if not configured.
+* `s3Region` - (Optional) The S3 bucket region.
+
+Targets specify what instance IDs or tags to apply the document to and has these keys:
+
+* `key` - (Required) Either `instanceIds` or `tag:Tag Name` to specify an EC2 tag.
+* `values` - (Required) A list of instance IDs or tag values. AWS currently limits this list size to one value.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the SSM association
+* `associationId` - The ID of the SSM association.
+* `instanceId` - The instance id that the SSM document was applied to.
+* `name` - The name of the SSM document to apply.
+* `parameters` - Additional parameters passed to the SSM document.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SSM associations using the `associationId`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import SSM associations using the `associationId`. For example:
+
+```console
+% terraform import aws_ssm_association.test-association 10abcdef-0abc-1234-5678-90abcdef123456
+```
+
+<!-- cache-key: cdktf-0.18.0 input-10e8a92532503c7bcda87673db04c7e87ed3c1cf117ab0f43ec4186c48be49c7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ssm_default_patch_baseline.html.markdown b/website/docs/cdktf/typescript/r/ssm_default_patch_baseline.html.markdown
new file mode 100644
index 00000000000..874c043487c
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/ssm_default_patch_baseline.html.markdown
@@ -0,0 +1,144 @@
+---
+subcategory: "SSM (Systems Manager)"
+layout: "aws"
+page_title: "AWS: aws_ssm_default_patch_baseline"
+description: |-
+  Terraform resource for managing an AWS Systems Manager Default Patch Baseline.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ssm_default_patch_baseline
+
+Terraform resource for registering an AWS Systems Manager Default Patch Baseline.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SsmDefaultPatchBaseline } from "./.gen/providers/aws/ssm-default-patch-baseline";
+import { SsmPatchBaseline } from "./.gen/providers/aws/ssm-patch-baseline";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new SsmPatchBaseline(this, "example", {
+      approvedPatches: ["KB123456"],
+      name: "example",
+    });
+    const awsSsmDefaultPatchBaselineExample = new SsmDefaultPatchBaseline(
+      this,
+      "example_1",
+      {
+        baselineId: example.id,
+        operatingSystem: example.operatingSystem,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSsmDefaultPatchBaselineExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `baselineId` - (Required) ID of the patch baseline.
+  Can be an ID or an ARN.
+  When specifying an AWS-provided patch baseline, must be the ARN.
+* `operatingSystem` - (Required) The operating system the patch baseline applies to.
+  Valid values are
+  `amazonLinux`,
+  `amazonLinux2`,
+  `amazonLinux2022`,
+  `centos`,
+  `debian`,
+  `macos`,
+  `oracleLinux`,
+  `raspbian`,
+  `redhatEnterpriseLinux`,
+  `rockyLinux`,
+  `suse`,
+  `ubuntu`, and
+  `windows`.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import the Systems Manager Default Patch Baseline using the patch baseline ID, patch baseline ARN, or the operating system value. For example:
+
+Using the patch baseline ID:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using the patch baseline ARN:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using the operating system value:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+**Using `terraform import` to import** the Systems Manager Default Patch Baseline using the patch baseline ID, patch baseline ARN, or the operating system value. For example:
+
+Using the patch baseline ID:
+
+```console
+% terraform import aws_ssm_default_patch_baseline.example pb-1234567890abcdef1
+```
+
+Using the patch baseline ARN:
+
+```console
+% terraform import aws_ssm_default_patch_baseline.example arn:aws:ssm:us-west-2:123456789012:patchbaseline/pb-1234567890abcdef1
+```
+
+Using the operating system value:
+
+```console
+% terraform import aws_ssm_default_patch_baseline.example CENTOS
+```
+
+<!-- cache-key: cdktf-0.18.0 input-c7888a2bf80f497e5fee504012a5094fc9dc5491b266b6f048528ab317dd5ecd -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ssm_document.html.markdown b/website/docs/cdktf/typescript/r/ssm_document.html.markdown
new file mode 100644
index 00000000000..b8193517835
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/ssm_document.html.markdown
@@ -0,0 +1,183 @@
+---
+subcategory: "SSM (Systems Manager)"
+layout: "aws"
+page_title: "AWS: aws_ssm_document"
+description: |-
+  Provides an SSM Document resource
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ssm_document
+
+Provides an SSM Document resource
+
+~> **NOTE on updating SSM documents:** Only documents with a schema version of 2.0
+or greater can update their content once created, see [SSM Schema Features][1]. To update a document with an older schema version you must recreate the resource. Not all document types support a schema version of 2.0 or greater. Refer to [SSM document schema features and examples][2] for information about which schema versions are supported for the respective `documentType`.
+
+## Example Usage
+
+### Create an ssm document in JSON format
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SsmDocument } from "./.gen/providers/aws/ssm-document";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SsmDocument(this, "foo", {
+      content:
+        '  {\n    "schemaVersion": "1.2",\n    "description": "Check ip configuration of a Linux instance.",\n    "parameters": {\n\n    },\n    "runtimeConfig": {\n      "aws:runShellScript": {\n        "properties": [\n          {\n            "id": "0.aws:runShellScript",\n            "runCommand": ["ifconfig"]\n          }\n        ]\n      }\n    }\n  }\n\n',
+      documentType: "Command",
+      name: "test_document",
+    });
+  }
+}
+
+```
+
+### Create an ssm document in YAML format
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SsmDocument } from "./.gen/providers/aws/ssm-document";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SsmDocument(this, "foo", {
+      content:
+        "schemaVersion: '1.2'\ndescription: Check ip configuration of a Linux instance.\nparameters: {}\nruntimeConfig:\n  'aws:runShellScript':\n    properties:\n      - id: '0.aws:runShellScript'\n        runCommand:\n          - ifconfig\n\n",
+      documentFormat: "YAML",
+      documentType: "Command",
+      name: "test_document",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the document.
+* `attachmentsSource` - (Optional) One or more configuration blocks describing attachments sources to a version of a document. Defined below.
+* `content` - (Required) The JSON or YAML content of the document.
+* `documentFormat` - (Optional, defaults to JSON) The format of the document. Valid document types include: `json` and `yaml`
+* `documentType` - (Required) The type of the document. Valid document types include: `automation`, `command`, `package`, `policy`, and `session`
+* `permissions` - (Optional) Additional Permissions to attach to the document. See [Permissions](#permissions) below for details.
+* `targetType` - (Optional) The target type which defines the kinds of resources the document can run on. For example, /AWS::EC2::Instance. For a list of valid resource types, see AWS Resource Types Reference (http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-template-resource-type-ref.html)
+* `tags` - (Optional) A map of tags to assign to the object. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `versionName` - (Optional) A field specifying the version of the artifact you are creating with the document. For example, "Release 12, Update 6". This value is unique across all versions of a document and cannot be changed for an existing document version.
+
+## attachments_source
+
+The `attachmentsSource` block supports the following:
+
+* `key` - (Required) The key describing the location of an attachment to a document. Valid key types include: `sourceUrl` and `s3FileUrl`
+* `values` - (Required) The value describing the location of an attachment to a document
+* `name` - (Optional) The name of the document attachment file
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `createdDate` - The date the document was created.
+* `description` - The description of the document.
+* `schemaVersion` - The schema version of the document.
+* `defaultVersion` - The default version of the document.
+* `documentVersion` - The document version.
+* `hash` - The sha1 or sha256 of the document content
+* `hashType` - "Sha1" "Sha256". The hashing algorithm used when hashing the content.
+* `latestVersion` - The latest version of the document.
+* `owner` - The AWS user account of the person who created the document.
+* `status` - "Creating", "Active" or "Deleting". The current status of the document.
+* `parameter` - The parameters that are available to this document.
+* `platformTypes` - A list of OS platforms compatible with this SSM document, either "Windows" or "Linux".
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+[1]: http://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-ssm-docs.html#document-schemas-features
+[2]: https://docs.aws.amazon.com/systems-manager/latest/userguide/document-schemas-features.html
+
+## Permissions
+
+The permissions attribute specifies how you want to share the document. If you share a document privately,
+you must specify the AWS user account IDs for those people who can use the document. If you share a document
+publicly, you must specify All as the account ID.
+
+The permissions mapping supports the following:
+
+* `type` - The permission type for the document. The permission type can be `share`.
+* `accountIds` - The AWS user accounts that should have access to the document. The account IDs can either be a group of account IDs or `all`.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SSM Documents using the name. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import SSM Documents using the name. For example:
+
+```console
+% terraform import aws_ssm_document.example example
+```
+
+The `attachmentsSource` argument does not have an SSM API method for reading the attachment information detail after creation. If the argument is set in the Terraform configuration on an imported resource, Terraform will always show a difference. To workaround this behavior, either omit the argument from the Terraform configuration or use [`ignoreChanges`](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html#ignore_changes) to hide the difference. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SsmDocument } from "./.gen/providers/aws/ssm-document";
+interface MyConfig {
+  content: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new SsmDocument(this, "test", {
+      attachmentsSource: [
+        {
+          key: "SourceUrl",
+          values: ["s3://${" + objectBucket.bucket + "}/test.zip"],
+        },
+      ],
+      documentType: "Package",
+      lifecycle: {
+        ignoreChanges: [attachmentsSource],
+      },
+      name: "test_document",
+      content: config.content,
+    });
+  }
+}
+
+```
+
+<!-- cache-key: cdktf-0.18.0 input-0f47ccad709627d6f83189f2b6d41b8032365327e11d5385345cf2f96e8c2bad -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ssm_maintenance_window.html.markdown b/website/docs/cdktf/typescript/r/ssm_maintenance_window.html.markdown
new file mode 100644
index 00000000000..cdb49ce905d
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/ssm_maintenance_window.html.markdown
@@ -0,0 +1,86 @@
+---
+subcategory: "SSM (Systems Manager)"
+layout: "aws"
+page_title: "AWS: aws_ssm_maintenance_window"
+description: |-
+  Provides an SSM Maintenance Window resource
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ssm_maintenance_window
+
+Provides an SSM Maintenance Window resource
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SsmMaintenanceWindow } from "./.gen/providers/aws/ssm-maintenance-window";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SsmMaintenanceWindow(this, "production", {
+      cutoff: 1,
+      duration: 3,
+      name: "maintenance-window-application",
+      schedule: "cron(0 16 ? * TUE *)",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the maintenance window.
+* `schedule` - (Required) The schedule of the Maintenance Window in the form of a [cron or rate expression](https://docs.aws.amazon.com/systems-manager/latest/userguide/reference-cron-and-rate-expressions.html).
+* `cutoff` - (Required) The number of hours before the end of the Maintenance Window that Systems Manager stops scheduling new tasks for execution.
+* `duration` - (Required) The duration of the Maintenance Window in hours.
+* `description` - (Optional) A description for the maintenance window.
+* `allowUnassociatedTargets` - (Optional) Whether targets must be registered with the Maintenance Window before tasks can be defined for those targets.
+* `enabled` - (Optional) Whether the maintenance window is enabled. Default: `true`.
+* `endDate` - (Optional) Timestamp in [ISO-8601 extended format](https://www.iso.org/iso-8601-date-and-time-format.html) when to no longer run the maintenance window.
+* `scheduleTimezone` - (Optional) Timezone for schedule in [Internet Assigned Numbers Authority (IANA) Time Zone Database format](https://www.iana.org/time-zones). For example: `america/losAngeles`, `etc/utc`, or `asia/seoul`.
+* `scheduleOffset` - (Optional) The number of days to wait after the date and time specified by a CRON expression before running the maintenance window.
+* `startDate` - (Optional) Timestamp in [ISO-8601 extended format](https://www.iso.org/iso-8601-date-and-time-format.html) when to begin the maintenance window.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the maintenance window.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SSM  Maintenance Windows using the maintenance window `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import SSM  Maintenance Windows using the maintenance window `id`. For example:
+
+```console
+% terraform import aws_ssm_maintenance_window.imported-window mw-0123456789
+```
+
+<!-- cache-key: cdktf-0.18.0 input-07f87819be5fb27d9bf208fabda5d907108534ce8f73af29e7515be2e194f293 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ssm_maintenance_window_target.html.markdown b/website/docs/cdktf/typescript/r/ssm_maintenance_window_target.html.markdown
new file mode 100644
index 00000000000..8cdaac79aeb
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/ssm_maintenance_window_target.html.markdown
@@ -0,0 +1,133 @@
+---
+subcategory: "SSM (Systems Manager)"
+layout: "aws"
+page_title: "AWS: aws_ssm_maintenance_window_target"
+description: |-
+  Provides an SSM Maintenance Window Target resource
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ssm_maintenance_window_target
+
+Provides an SSM Maintenance Window Target resource
+
+## Example Usage
+
+### Instance Target
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SsmMaintenanceWindow } from "./.gen/providers/aws/ssm-maintenance-window";
+import { SsmMaintenanceWindowTarget } from "./.gen/providers/aws/ssm-maintenance-window-target";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const window = new SsmMaintenanceWindow(this, "window", {
+      cutoff: 1,
+      duration: 3,
+      name: "maintenance-window-webapp",
+      schedule: "cron(0 16 ? * TUE *)",
+    });
+    new SsmMaintenanceWindowTarget(this, "target1", {
+      description: "This is a maintenance window target",
+      name: "maintenance-window-target",
+      resourceType: "INSTANCE",
+      targets: [
+        {
+          key: "tag:Name",
+          values: ["acceptance_test"],
+        },
+      ],
+      windowId: window.id,
+    });
+  }
+}
+
+```
+
+### Resource Group Target
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SsmMaintenanceWindow } from "./.gen/providers/aws/ssm-maintenance-window";
+import { SsmMaintenanceWindowTarget } from "./.gen/providers/aws/ssm-maintenance-window-target";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const window = new SsmMaintenanceWindow(this, "window", {
+      cutoff: 1,
+      duration: 3,
+      name: "maintenance-window-webapp",
+      schedule: "cron(0 16 ? * TUE *)",
+    });
+    new SsmMaintenanceWindowTarget(this, "target1", {
+      description: "This is a maintenance window target",
+      name: "maintenance-window-target",
+      resourceType: "RESOURCE_GROUP",
+      targets: [
+        {
+          key: "resource-groups:ResourceTypeFilters",
+          values: ["AWS::EC2::Instance"],
+        },
+      ],
+      windowId: window.id,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `windowId` - (Required) The Id of the maintenance window to register the target with.
+* `name` - (Optional) The name of the maintenance window target.
+* `description` - (Optional) The description of the maintenance window target.
+* `resourceType` - (Required) The type of target being registered with the Maintenance Window. Possible values are `instance` and `resourceGroup`.
+* `targets` - (Required) The targets to register with the maintenance window. In other words, the instances to run commands on when the maintenance window runs. You can specify targets using instance IDs, resource group names, or tags that have been applied to instances. For more information about these examples formats see
+ (https://docs.aws.amazon.com/systems-manager/latest/userguide/mw-cli-tutorial-targets-examples.html)
+* `ownerInformation` - (Optional) User-provided value that will be included in any CloudWatch events raised while running tasks for these targets in this Maintenance Window.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the maintenance window target.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SSM Maintenance Window targets using `windowId/windowTargetId`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import SSM Maintenance Window targets using `windowId/windowTargetId`. For example:
+
+```console
+% terraform import aws_ssm_maintenance_window_target.example mw-0c50858d01EXAMPLE/23639a0b-ddbc-4bca-9e72-78d96EXAMPLE
+```
+
+<!-- cache-key: cdktf-0.18.0 input-23b182db6aa7bfeef9866d68456e0abddd9b0255898371206b63dfe63dfee54e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ssm_maintenance_window_task.html.markdown b/website/docs/cdktf/typescript/r/ssm_maintenance_window_task.html.markdown
new file mode 100644
index 00000000000..5785d3e2942
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/ssm_maintenance_window_task.html.markdown
@@ -0,0 +1,292 @@
+---
+subcategory: "SSM (Systems Manager)"
+layout: "aws"
+page_title: "AWS: aws_ssm_maintenance_window_task"
+description: |-
+  Provides an SSM Maintenance Window Task resource
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ssm_maintenance_window_task
+
+Provides an SSM Maintenance Window Task resource
+
+## Example Usage
+
+### Automation Tasks
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SsmMaintenanceWindowTask } from "./.gen/providers/aws/ssm-maintenance-window-task";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SsmMaintenanceWindowTask(this, "example", {
+      maxConcurrency: Token.asString(2),
+      maxErrors: Token.asString(1),
+      priority: 1,
+      targets: [
+        {
+          key: "InstanceIds",
+          values: [Token.asString(awsInstanceExample.id)],
+        },
+      ],
+      taskArn: "AWS-RestartEC2Instance",
+      taskInvocationParameters: {
+        automationParameters: {
+          documentVersion: "$LATEST",
+          parameter: [
+            {
+              name: "InstanceId",
+              values: [Token.asString(awsInstanceExample.id)],
+            },
+          ],
+        },
+      },
+      taskType: "AUTOMATION",
+      windowId: Token.asString(awsSsmMaintenanceWindowExample.id),
+    });
+  }
+}
+
+```
+
+### Lambda Tasks
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, Fn, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SsmMaintenanceWindowTask } from "./.gen/providers/aws/ssm-maintenance-window-task";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SsmMaintenanceWindowTask(this, "example", {
+      maxConcurrency: Token.asString(2),
+      maxErrors: Token.asString(1),
+      priority: 1,
+      targets: [
+        {
+          key: "InstanceIds",
+          values: [Token.asString(awsInstanceExample.id)],
+        },
+      ],
+      taskArn: Token.asString(awsLambdaFunctionExample.arn),
+      taskInvocationParameters: {
+        lambdaParameters: {
+          clientContext: Token.asString(
+            Fn.base64encode('{\\"key1\\":\\"value1\\"}')
+          ),
+          payload: '{\\"key1\\":\\"value1\\"}',
+        },
+      },
+      taskType: "LAMBDA",
+      windowId: Token.asString(awsSsmMaintenanceWindowExample.id),
+    });
+  }
+}
+
+```
+
+### Run Command Tasks
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SsmMaintenanceWindowTask } from "./.gen/providers/aws/ssm-maintenance-window-task";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SsmMaintenanceWindowTask(this, "example", {
+      maxConcurrency: Token.asString(2),
+      maxErrors: Token.asString(1),
+      priority: 1,
+      targets: [
+        {
+          key: "InstanceIds",
+          values: [Token.asString(awsInstanceExample.id)],
+        },
+      ],
+      taskArn: "AWS-RunShellScript",
+      taskInvocationParameters: {
+        runCommandParameters: {
+          notificationConfig: {
+            notificationArn: Token.asString(awsSnsTopicExample.arn),
+            notificationEvents: ["All"],
+            notificationType: "Command",
+          },
+          outputS3Bucket: Token.asString(awsS3BucketExample.id),
+          outputS3KeyPrefix: "output",
+          parameter: [
+            {
+              name: "commands",
+              values: ["date"],
+            },
+          ],
+          serviceRoleArn: Token.asString(awsIamRoleExample.arn),
+          timeoutSeconds: 600,
+        },
+      },
+      taskType: "RUN_COMMAND",
+      windowId: Token.asString(awsSsmMaintenanceWindowExample.id),
+    });
+  }
+}
+
+```
+
+### Step Function Tasks
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SsmMaintenanceWindowTask } from "./.gen/providers/aws/ssm-maintenance-window-task";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SsmMaintenanceWindowTask(this, "example", {
+      maxConcurrency: Token.asString(2),
+      maxErrors: Token.asString(1),
+      priority: 1,
+      targets: [
+        {
+          key: "InstanceIds",
+          values: [Token.asString(awsInstanceExample.id)],
+        },
+      ],
+      taskArn: Token.asString(awsSfnActivityExample.id),
+      taskInvocationParameters: {
+        stepFunctionsParameters: {
+          input: '{\\"key1\\":\\"value1\\"}',
+          name: "example",
+        },
+      },
+      taskType: "STEP_FUNCTIONS",
+      windowId: Token.asString(awsSsmMaintenanceWindowExample.id),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `windowId` - (Required) The Id of the maintenance window to register the task with.
+* `maxConcurrency` - (Optional) The maximum number of targets this task can be run for in parallel.
+* `maxErrors` - (Optional) The maximum number of errors allowed before this task stops being scheduled.
+* `cutoffBehavior` - (Optional) Indicates whether tasks should continue to run after the cutoff time specified in the maintenance windows is reached. Valid values are `continueTask` and `cancelTask`.
+* `taskType` - (Required) The type of task being registered. Valid values: `automation`, `lambda`, `runCommand` or `stepFunctions`.
+* `taskArn` - (Required) The ARN of the task to execute.
+* `serviceRoleArn` - (Optional) The role that should be assumed when executing the task. If a role is not provided, Systems Manager uses your account's service-linked role. If no service-linked role for Systems Manager exists in your account, it is created for you.
+* `name` - (Optional) The name of the maintenance window task.
+* `description` - (Optional) The description of the maintenance window task.
+* `targets` - (Optional) The targets (either instances or window target ids). Instances are specified using Key=InstanceIds,Values=instanceid1,instanceid2. Window target ids are specified using Key=WindowTargetIds,Values=window target id1, window target id2.
+* `priority` - (Optional) The priority of the task in the Maintenance Window, the lower the number the higher the priority. Tasks in a Maintenance Window are scheduled in priority order with tasks that have the same priority scheduled in parallel.
+* `taskInvocationParameters` - (Optional) Configuration block with parameters for task execution.
+
+`taskInvocationParameters` supports the following:
+
+* `automationParameters` - (Optional) The parameters for an AUTOMATION task type. Documented below.
+* `lambdaParameters` - (Optional) The parameters for a LAMBDA task type. Documented below.
+* `runCommandParameters` - (Optional) The parameters for a RUN_COMMAND task type. Documented below.
+* `stepFunctionsParameters` - (Optional) The parameters for a STEP_FUNCTIONS task type. Documented below.
+
+`automationParameters` supports the following:
+
+* `documentVersion` - (Optional) The version of an Automation document to use during task execution.
+* `parameter` - (Optional) The parameters for the RUN_COMMAND task execution. Documented below.
+
+`lambdaParameters` supports the following:
+
+* `clientContext` - (Optional) Pass client-specific information to the Lambda function that you are invoking.
+* `payload` - (Optional) JSON to provide to your Lambda function as input.
+* `qualifier` - (Optional) Specify a Lambda function version or alias name.
+
+`runCommandParameters` supports the following:
+
+* `comment` - (Optional) Information about the command(s) to execute.
+* `documentHash` - (Optional) The SHA-256 or SHA-1 hash created by the system when the document was created. SHA-1 hashes have been deprecated.
+* `documentHashType` - (Optional) SHA-256 or SHA-1. SHA-1 hashes have been deprecated. Valid values: `sha256` and `sha1`
+* `notificationConfig` - (Optional) Configurations for sending notifications about command status changes on a per-instance basis. Documented below.
+* `outputS3Bucket` - (Optional) The name of the Amazon S3 bucket.
+* `outputS3KeyPrefix` - (Optional) The Amazon S3 bucket subfolder.
+* `parameter` - (Optional) The parameters for the RUN_COMMAND task execution. Documented below.
+* `serviceRoleArn` - (Optional) The Amazon Resource Name (ARN) of the AWS Identity and Access Management (IAM) service role to use to publish Amazon Simple Notification Service (Amazon SNS) notifications for maintenance window Run Command tasks.
+* `timeoutSeconds` - (Optional) If this time is reached and the command has not already started executing, it doesn't run.
+* `cloudwatchConfig` - (Optional) Configuration options for sending command output to CloudWatch Logs. Documented below.
+
+`stepFunctionsParameters` supports the following:
+
+* `input` - (Optional) The inputs for the STEP_FUNCTION task.
+* `name` - (Optional) The name of the STEP_FUNCTION task.
+
+`notificationConfig` supports the following:
+
+* `notificationArn` - (Optional) An Amazon Resource Name (ARN) for a Simple Notification Service (SNS) topic. Run Command pushes notifications about command status changes to this topic.
+* `notificationEvents` - (Optional) The different events for which you can receive notifications. Valid values: `all`, `inProgress`, `success`, `timedOut`, `cancelled`, and `failed`
+* `notificationType` - (Optional) When specified with `command`, receive notification when the status of a command changes. When specified with `invocation`, for commands sent to multiple instances, receive notification on a per-instance basis when the status of a command changes. Valid values: `command` and `invocation`
+
+`cloudwatchConfig` supports the following:
+
+* `cloudwatchLogGroupName` - (Optional) The name of the CloudWatch log group where you want to send command output. If you don't specify a group name, Systems Manager automatically creates a log group for you. The log group uses the following naming format: aws/ssm/SystemsManagerDocumentName.
+* `cloudwatchOutputEnabled` - (Optional) Enables Systems Manager to send command output to CloudWatch Logs.
+
+`parameter` supports the following:
+
+* `name` - (Required) The parameter name.
+* `values` - (Required) The array of strings.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the maintenance window task.
+* `id` - The ID of the maintenance window task.
+* `windowTaskId` - The ID of the maintenance window task.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AWS Maintenance Window Task using the `windowId` and `windowTaskId` separated by `/`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import AWS Maintenance Window Task using the `windowId` and `windowTaskId` separated by `/`. For example:
+
+```console
+% terraform import aws_ssm_maintenance_window_task.task <window_id>/<window_task_id>
+```
+
+<!-- cache-key: cdktf-0.18.0 input-c897099591bdcacb9f61cf4c76d292fedaf9671e665a81bf657daf724fcf0e5c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ssm_parameter.html.markdown b/website/docs/cdktf/typescript/r/ssm_parameter.html.markdown
new file mode 100644
index 00000000000..f75baa6ad82
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/ssm_parameter.html.markdown
@@ -0,0 +1,138 @@
+---
+subcategory: "SSM (Systems Manager)"
+layout: "aws"
+page_title: "AWS: aws_ssm_parameter"
+description: |-
+  Provides a SSM Parameter resource
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ssm_parameter
+
+Provides an SSM Parameter resource.
+
+~> **Note:** `overwrite` also makes it possible to overwrite an existing SSM Parameter that's not created by Terraform before. This argument has been deprecated and will be removed in v6.0.0 of the provider. For more information on how this affects the behavior of this resource, see [this issue comment](https://github.com/hashicorp/terraform-provider-aws/issues/25636#issuecomment-1623661159).
+
+## Example Usage
+
+### Basic example
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SsmParameter } from "./.gen/providers/aws/ssm-parameter";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SsmParameter(this, "foo", {
+      name: "foo",
+      type: "String",
+      value: "bar",
+    });
+  }
+}
+
+```
+
+### Encrypted string using default SSM KMS key
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DbInstance } from "./.gen/providers/aws/db-instance";
+import { SsmParameter } from "./.gen/providers/aws/ssm-parameter";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new DbInstance(this, "default", {
+      allocatedStorage: 10,
+      dbName: "mydb",
+      dbSubnetGroupName: "my_database_subnet_group",
+      engine: "mysql",
+      engineVersion: "5.7.16",
+      instanceClass: "db.t2.micro",
+      parameterGroupName: "default.mysql5.7",
+      password: databaseMasterPassword.stringValue,
+      storageType: "gp2",
+      username: "foo",
+    });
+    new SsmParameter(this, "secret", {
+      description: "The parameter description",
+      name: "/production/database/password/master",
+      tags: {
+        environment: "production",
+      },
+      type: "SecureString",
+      value: databaseMasterPassword.stringValue,
+    });
+  }
+}
+
+```
+
+~> **Note:** The unencrypted value of a SecureString will be stored in the raw state as plain-text.
+[Read more about sensitive data in state](https://www.terraform.io/docs/state/sensitive-data.html).
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) Name of the parameter. If the name contains a path (e.g., any forward slashes (`/`)), it must be fully qualified with a leading forward slash (`/`). For additional requirements and constraints, see the [AWS SSM User Guide](https://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-parameter-name-constraints.html).
+* `type` - (Required) Type of the parameter. Valid types are `string`, `stringList` and `secureString`.
+
+The following arguments are optional:
+
+* `allowedPattern` - (Optional) Regular expression used to validate the parameter value.
+* `dataType` - (Optional) Data type of the parameter. Valid values: `text`, `aws:ssm:integration` and `aws:ec2:image` for AMI format, see the [Native parameter support for Amazon Machine Image IDs](https://docs.aws.amazon.com/systems-manager/latest/userguide/parameter-store-ec2-aliases.html).
+* `description` - (Optional) Description of the parameter.
+* `insecureValue` - (Optional, exactly one of `value` or `insecureValue` is required) Value of the parameter. **Use caution:** This value is _never_ marked as sensitive in the Terraform plan output. This argument is not valid with a `type` of `secureString`.
+* `keyId` - (Optional) KMS key ID or ARN for encrypting a SecureString.
+* `overwrite` - (Optional, **Deprecated**) Overwrite an existing parameter. If not specified, defaults to `false` if the resource has not been created by Terraform to avoid overwrite of existing resource, and will default to `true` otherwise (Terraform lifecycle rules should then be used to manage the update behavior).
+* `tags` - (Optional) Map of tags to assign to the object. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `tier` - (Optional) Parameter tier to assign to the parameter. If not specified, will use the default parameter tier for the region. Valid tiers are `standard`, `advanced`, and `intelligentTiering`. Downgrading an `advanced` tier parameter to `standard` will recreate the resource. For more information on parameter tiers, see the [AWS SSM Parameter tier comparison and guide](https://docs.aws.amazon.com/systems-manager/latest/userguide/parameter-store-advanced-parameters.html).
+* `value` - (Optional, exactly one of `value` or `insecureValue` is required) Value of the parameter. This value is always marked as sensitive in the Terraform plan output, regardless of `type`. In Terraform CLI version 0.15 and later, this may require additional configuration handling for certain scenarios. For more information, see the [Terraform v0.15 Upgrade Guide](https://www.terraform.io/upgrade-guides/0-15.html#sensitive-output-values).
+
+~> **NOTE:** `aws:ssm:integration` data_type parameters must be of the type `secureString` and the name must start with the prefix `/d9d01087-4a3f-49e0-b0b4-d568d7826553/ssm/integrations/webhook/`. See [here](https://docs.aws.amazon.com/systems-manager/latest/userguide/creating-integrations.html) for information on the usage of `aws:ssm:integration` parameters.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the parameter.
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `version` - Version of the parameter.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SSM Parameters using the parameter store `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import SSM Parameters using the parameter store `name`. For example:
+
+```console
+% terraform import aws_ssm_parameter.my_param /my_path/my_paramname
+```
+
+<!-- cache-key: cdktf-0.18.0 input-a457572541c0a51d72bd59e88605ac40f08c24ad59c69cf3a0bfb414556b5891 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ssm_patch_baseline.html.markdown b/website/docs/cdktf/typescript/r/ssm_patch_baseline.html.markdown
new file mode 100644
index 00000000000..d8d07853dbc
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/ssm_patch_baseline.html.markdown
@@ -0,0 +1,315 @@
+---
+subcategory: "SSM (Systems Manager)"
+layout: "aws"
+page_title: "AWS: aws_ssm_patch_baseline"
+description: |-
+  Provides an SSM Patch Baseline resource
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ssm_patch_baseline
+
+Provides an SSM Patch Baseline resource.
+
+~> **NOTE on Patch Baselines:** The `approvedPatches` and `approvalRule` are
+both marked as optional fields, but the Patch Baseline requires that at least one
+of them is specified.
+
+## Example Usage
+
+### Basic Usage
+
+Using `approvedPatches` only.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SsmPatchBaseline } from "./.gen/providers/aws/ssm-patch-baseline";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SsmPatchBaseline(this, "production", {
+      approvedPatches: ["KB123456"],
+      name: "patch-baseline",
+    });
+  }
+}
+
+```
+
+### Advanced Usage, specifying patch filters
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SsmPatchBaseline } from "./.gen/providers/aws/ssm-patch-baseline";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SsmPatchBaseline(this, "production", {
+      approvalRule: [
+        {
+          approveAfterDays: 7,
+          complianceLevel: "HIGH",
+          patchFilter: [
+            {
+              key: "PRODUCT",
+              values: ["WindowsServer2016"],
+            },
+            {
+              key: "CLASSIFICATION",
+              values: ["CriticalUpdates", "SecurityUpdates", "Updates"],
+            },
+            {
+              key: "MSRC_SEVERITY",
+              values: ["Critical", "Important", "Moderate"],
+            },
+          ],
+        },
+        {
+          approveAfterDays: 7,
+          patchFilter: [
+            {
+              key: "PRODUCT",
+              values: ["WindowsServer2012"],
+            },
+          ],
+        },
+      ],
+      approvedPatches: ["KB123456", "KB456789"],
+      description: "Patch Baseline Description",
+      globalFilter: [
+        {
+          key: "PRODUCT",
+          values: ["WindowsServer2008"],
+        },
+        {
+          key: "CLASSIFICATION",
+          values: ["ServicePacks"],
+        },
+        {
+          key: "MSRC_SEVERITY",
+          values: ["Low"],
+        },
+      ],
+      name: "patch-baseline",
+      rejectedPatches: ["KB987654"],
+    });
+  }
+}
+
+```
+
+### Advanced usage, specifying Microsoft application and Windows patch rules
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SsmPatchBaseline } from "./.gen/providers/aws/ssm-patch-baseline";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SsmPatchBaseline(this, "windows_os_apps", {
+      approvalRule: [
+        {
+          approveAfterDays: 7,
+          patchFilter: [
+            {
+              key: "CLASSIFICATION",
+              values: ["CriticalUpdates", "SecurityUpdates"],
+            },
+            {
+              key: "MSRC_SEVERITY",
+              values: ["Critical", "Important"],
+            },
+          ],
+        },
+        {
+          approveAfterDays: 7,
+          patchFilter: [
+            {
+              key: "PATCH_SET",
+              values: ["APPLICATION"],
+            },
+            {
+              key: "PRODUCT",
+              values: ["Office 2013", "Office 2016"],
+            },
+          ],
+        },
+      ],
+      description: "Patch both Windows and Microsoft apps",
+      name: "WindowsOSAndMicrosoftApps",
+      operatingSystem: "WINDOWS",
+    });
+  }
+}
+
+```
+
+### Advanced usage, specifying alternate patch source repository
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SsmPatchBaseline } from "./.gen/providers/aws/ssm-patch-baseline";
+interface MyConfig {
+  patchFilter: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new SsmPatchBaseline(this, "al_2017_09", {
+      approvalRule: [
+        {
+          patchFilter: config.patchFilter,
+        },
+      ],
+      description: "My patch repository for Amazon Linux 2017.09",
+      name: "Amazon-Linux-2017.09",
+      operatingSystem: "AMAZON_LINUX",
+      source: [
+        {
+          configuration:
+            "[amzn-main]\nname=amzn-main-Base\nmirrorlist=http://repo./$awsregion./$awsdomain//$releasever/main/mirror.list\nmirrorlist_expire=300\nmetadata_expire=300\npriority=10\nfailovermethod=priority\nfastestmirror_enabled=0\ngpgcheck=1\ngpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-amazon-ga\nenabled=1\nretries=3\ntimeout=5\nreport_instanceid=yes\n\n",
+          name: "My-AL2017.09",
+          products: ["AmazonLinux2017.09"],
+        },
+      ],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the patch baseline.
+* `description` - (Optional) The description of the patch baseline.
+* `operatingSystem` - (Optional) The operating system the patch baseline applies to.
+  Valid values are
+  `almaLinux`,
+  `amazonLinux`,
+  `amazonLinux2`,
+  `amazonLinux2022`,
+  `amazonLinux2023`,
+  `centos`,
+  `debian`,
+  `macos`,
+  `oracleLinux`,
+  `raspbian`,
+  `redhatEnterpriseLinux`,
+  `rockyLinux`,
+  `suse`,
+  `ubuntu`, and
+  `windows`.
+  The default value is `windows`.
+* `approvedPatchesComplianceLevel` - (Optional) The compliance level for approved patches.
+  This means that if an approved patch is reported as missing, this is the severity of the compliance violation.
+  Valid values are `critical`, `high`, `medium`, `low`, `informational`, `unspecified`.
+  The default value is `unspecified`.
+* `approvedPatches` - (Optional) A list of explicitly approved patches for the baseline.
+  Cannot be specified with `approvalRule`.
+* `rejectedPatches` - (Optional) A list of rejected patches.
+* `globalFilter` - (Optional) A set of global filters used to exclude patches from the baseline.
+  Up to 4 global filters can be specified using Key/Value pairs.
+  Valid Keys are `product`, `classification`, `msrcSeverity`, and `patchId`.
+* `approvalRule` - (Optional) A set of rules used to include patches in the baseline.
+  Up to 10 approval rules can be specified.
+  See [`approvalRule`](#approval_rule-block) below.
+* `source` - (Optional) Configuration block with alternate sources for patches.
+  Applies to Linux instances only.
+  See [`source`](#source-block) below.
+* `rejectedPatchesAction` - (Optional) The action for Patch Manager to take on patches included in the `rejectedPatches` list.
+  Valid values are `allowAsDependency` and `block`.
+* `approvedPatchesEnableNonSecurity` - (Optional) Indicates whether the list of approved patches includes non-security updates that should be applied to the instances.
+  Applies to Linux instances only.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### `approvalRule` Block
+
+The `approvalRule` block supports:
+
+* `approveAfterDays` - (Optional) The number of days after the release date of each patch matched by the rule the patch is marked as approved in the patch baseline.
+  Valid Range: 0 to 100.
+  Conflicts with `approveUntilDate`.
+* `approveUntilDate` - (Optional) The cutoff date for auto approval of released patches.
+  Any patches released on or before this date are installed automatically.
+  Date is formatted as `yyyyMmDd`.
+  Conflicts with `approveAfterDays`
+* `patchFilter` - (Required) The patch filter group that defines the criteria for the rule.
+  Up to 5 patch filters can be specified per approval rule using Key/Value pairs.
+  Valid combinations of these Keys and the `operatingSystem` value can be found in the [SSM DescribePatchProperties API Reference](https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DescribePatchProperties.html).
+  Valid Values are exact values for the patch property given as the key, or a wildcard `*`, which matches all values.
+    * `patchSet` defaults to `os` if unspecified
+* `complianceLevel` - (Optional) The compliance level for patches approved by this rule.
+  Valid values are `critical`, `high`, `medium`, `low`, `informational`, and `unspecified`.
+  The default value is `unspecified`.
+* `enableNonSecurity` - (Optional) Boolean enabling the application of non-security updates.
+  The default value is `false`.
+  Valid for Linux instances only.
+
+### `source` Block
+
+The `source` block supports:
+
+* `name` - (Required) The name specified to identify the patch source.
+* `configuration` - (Required) The value of the yum repo configuration.
+  For information about other options available for your yum repository configuration, see the [`dnfConf` documentation](https://man7.org/linux/man-pages/man5/dnf.conf.5.html)
+* `products` - (Required) The specific operating system versions a patch repository applies to, such as `"ubuntu1604"`, `"amazonLinux201609"`, `"redhatEnterpriseLinux72"` or `"suse127"`.
+  For lists of supported product values, see [PatchFilter](https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_PatchFilter.html).
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the patch baseline.
+* `arn` - The ARN of the patch baseline.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SSM Patch Baselines using their baseline ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import SSM Patch Baselines using their baseline ID. For example:
+
+```console
+% terraform import aws_ssm_patch_baseline.example pb-12345678
+```
+
+<!-- cache-key: cdktf-0.18.0 input-8564c1040b94d2bca2a77bd1f5497dbfad332cf94b1bfaa55582ef2dc819bc93 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ssm_patch_group.html.markdown b/website/docs/cdktf/typescript/r/ssm_patch_group.html.markdown
new file mode 100644
index 00000000000..63bb06ff37e
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/ssm_patch_group.html.markdown
@@ -0,0 +1,56 @@
+---
+subcategory: "SSM (Systems Manager)"
+layout: "aws"
+page_title: "AWS: aws_ssm_patch_group"
+description: |-
+  Provides an SSM Patch Group resource
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ssm_patch_group
+
+Provides an SSM Patch Group resource
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SsmPatchBaseline } from "./.gen/providers/aws/ssm-patch-baseline";
+import { SsmPatchGroup } from "./.gen/providers/aws/ssm-patch-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const production = new SsmPatchBaseline(this, "production", {
+      approvedPatches: ["KB123456"],
+      name: "patch-baseline",
+    });
+    new SsmPatchGroup(this, "patchgroup", {
+      baselineId: production.id,
+      patchGroup: "patch-group-name",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `baselineId` - (Required) The ID of the patch baseline to register the patch group with.
+* `patchGroup` - (Required) The name of the patch group that should be registered with the patch baseline.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name of the patch group and ID of the patch baseline separated by a comma (`,`).
+
+<!-- cache-key: cdktf-0.18.0 input-8fb71b4f9d0ba4c81e7e46ea58c2d79b16be2c22faf937bdd4e9cd0fb98b0c0d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ssm_resource_data_sync.html.markdown b/website/docs/cdktf/typescript/r/ssm_resource_data_sync.html.markdown
new file mode 100644
index 00000000000..0f90c6eda07
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/ssm_resource_data_sync.html.markdown
@@ -0,0 +1,137 @@
+---
+subcategory: "SSM (Systems Manager)"
+layout: "aws"
+page_title: "AWS: aws_ssm_resource_data_sync"
+description: |-
+  Provides a SSM resource data sync.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ssm_resource_data_sync
+
+Provides a SSM resource data sync.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3BucketPolicy } from "./.gen/providers/aws/s3-bucket-policy";
+import { SsmResourceDataSync } from "./.gen/providers/aws/ssm-resource-data-sync";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const hoge = new S3Bucket(this, "hoge", {
+      bucket: "tf-test-bucket-1234",
+    });
+    new SsmResourceDataSync(this, "foo", {
+      name: "foo",
+      s3Destination: {
+        bucketName: hoge.bucket,
+        region: hoge.region,
+      },
+    });
+    const dataAwsIamPolicyDocumentHoge = new DataAwsIamPolicyDocument(
+      this,
+      "hoge_2",
+      {
+        statement: [
+          {
+            actions: ["s3:GetBucketAcl"],
+            effect: "Allow",
+            principals: [
+              {
+                identifiers: ["ssm.amazonaws.com"],
+                type: "Service",
+              },
+            ],
+            resources: ["arn:aws:s3:::tf-test-bucket-1234"],
+            sid: "SSMBucketPermissionsCheck",
+          },
+          {
+            actions: ["s3:PutObject"],
+            condition: [
+              {
+                test: "StringEquals",
+                values: ["bucket-owner-full-control"],
+                variable: "s3:x-amz-acl",
+              },
+            ],
+            effect: "Allow",
+            principals: [
+              {
+                identifiers: ["ssm.amazonaws.com"],
+                type: "Service",
+              },
+            ],
+            resources: ["arn:aws:s3:::tf-test-bucket-1234/*"],
+            sid: "SSMBucketDelivery",
+          },
+        ],
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsIamPolicyDocumentHoge.overrideLogicalId("hoge");
+    const awsS3BucketPolicyHoge = new S3BucketPolicy(this, "hoge_3", {
+      bucket: hoge.id,
+      policy: Token.asString(dataAwsIamPolicyDocumentHoge.json),
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsS3BucketPolicyHoge.overrideLogicalId("hoge");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) Name for the configuration.
+* `s3Destination` - (Required) Amazon S3 configuration details for the sync.
+
+## s3_destination
+
+`s3Destination` supports the following:
+
+* `bucketName` - (Required) Name of S3 bucket where the aggregated data is stored.
+* `region` - (Required) Region with the bucket targeted by the Resource Data Sync.
+* `kmsKeyArn` - (Optional) ARN of an encryption key for a destination in Amazon S3.
+* `prefix` - (Optional) Prefix for the bucket.
+* `syncFormat` - (Optional) A supported sync format. Only JsonSerDe is currently supported. Defaults to JsonSerDe.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SSM resource data sync using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import SSM resource data sync using the `name`. For example:
+
+```console
+% terraform import aws_ssm_resource_data_sync.example example-name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1ca6cbc4ead65662883453fcaa95a776d79c46af9c730c2c622c39264e48c38b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ssm_service_setting.html.markdown b/website/docs/cdktf/typescript/r/ssm_service_setting.html.markdown
new file mode 100644
index 00000000000..56dbb427485
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/ssm_service_setting.html.markdown
@@ -0,0 +1,75 @@
+---
+subcategory: "SSM (Systems Manager)"
+layout: "aws"
+page_title: "AWS: aws_ssm_service_setting"
+description: |-
+  Defines how a user interacts with or uses a service or a feature of a service.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ssm_service_setting
+
+This setting defines how a user interacts with or uses a service or a feature of a service.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SsmServiceSetting } from "./.gen/providers/aws/ssm-service-setting";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SsmServiceSetting(this, "test_setting", {
+      settingId:
+        "arn:aws:ssm:us-east-1:123456789012:servicesetting/ssm/parameter-store/high-throughput-enabled",
+      settingValue: "true",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `settingId` - (Required) ID of the service setting.
+* `settingValue` - (Required) Value of the service setting.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the service setting.
+* `status` - Status of the service setting. Value can be `default`, `customized` or `pendingUpdate`.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AWS SSM Service Setting using the `settingId`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import AWS SSM Service Setting using the `settingId`. For example:
+
+```console
+% terraform import aws_ssm_service_setting.example arn:aws:ssm:us-east-1:123456789012:servicesetting/ssm/parameter-store/high-throughput-enabled
+```
+
+<!-- cache-key: cdktf-0.18.0 input-489362aa670f8e29ed8ee958af1a046523f1410820fe12b9bf0f827690afb34c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ssmcontacts_contact.html.markdown b/website/docs/cdktf/typescript/r/ssmcontacts_contact.html.markdown
new file mode 100644
index 00000000000..9e3acc09c41
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/ssmcontacts_contact.html.markdown
@@ -0,0 +1,116 @@
+---
+subcategory: "SSM Contacts"
+layout: "aws"
+page_title: "AWS: aws_ssmcontacts_contact"
+description: |-
+  Terraform resource for managing an AWS SSM Contact.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ssmcontacts_contact
+
+Terraform resource for managing an AWS SSM Contact.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SsmcontactsContact } from "./.gen/providers/aws/ssmcontacts-contact";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SsmcontactsContact(this, "example", {
+      alias: "alias",
+      dependsOn: [awsSsmincidentsReplicationSetExample],
+      type: "PERSONAL",
+    });
+  }
+}
+
+```
+
+### Usage With All Fields
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SsmcontactsContact } from "./.gen/providers/aws/ssmcontacts-contact";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SsmcontactsContact(this, "example", {
+      alias: "alias",
+      dependsOn: [awsSsmincidentsReplicationSetExample],
+      displayName: "displayName",
+      tags: {
+        key: "value",
+      },
+      type: "ESCALATION",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+~> **NOTE:** A contact implicitly depends on a replication set. If you configured your replication set in Terraform, we recommend you add it to the `dependsOn` argument for the Terraform Contact Resource.
+
+The following arguments are required:
+
+- `alias` - (Required) A unique and identifiable alias for the contact or escalation plan. Must be between 1 and 255 characters, and may contain alphanumerics, underscores (`_`), and hyphens (`-`).
+
+- `type` - (Required) The type of contact engaged. A single contact is type PERSONAL and an escalation
+  plan is type ESCALATION.
+
+The following arguments are optional:
+
+- `displayName` - (Optional) Full friendly name of the contact or escalation plan. If set, must be between 1 and 255 characters, and may contain alphanumerics, underscores (`_`), hyphens (`-`), periods (`.`), and spaces.
+
+- `tags` - (Optional) Map of tags to assign to the resource.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+- `arn` - The Amazon Resource Name (ARN) of the contact or escalation plan.
+
+- `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SSM Contact using the `arn`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import SSM Contact using the `arn`. For example:
+
+```console
+% terraform import aws_ssmcontacts_contact.example {ARNValue}
+```
+
+<!-- cache-key: cdktf-0.18.0 input-2663536b417f222904b9f9c62ac959d51fabe5b14bf73e4c198bb18616b00366 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ssmcontacts_contact_channel.html.markdown b/website/docs/cdktf/typescript/r/ssmcontacts_contact_channel.html.markdown
new file mode 100644
index 00000000000..d5f9fc13dbe
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/ssmcontacts_contact_channel.html.markdown
@@ -0,0 +1,125 @@
+---
+subcategory: "SSM Contacts"
+layout: "aws"
+page_title: "AWS: aws_ssmcontacts_contact_channel"
+description: |-
+  Terraform resource for managing an AWS SSM Contacts Contact Channel.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ssmcontacts_contact_channel
+
+Terraform resource for managing an AWS SSM Contacts Contact Channel.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SsmcontactsContactChannel } from "./.gen/providers/aws/ssmcontacts-contact-channel";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SsmcontactsContactChannel(this, "example", {
+      contactId:
+        "arn:aws:ssm-contacts:us-west-2:123456789012:contact/contactalias",
+      deliveryAddress: {
+        simpleAddress: "email@example.com",
+      },
+      name: "Example contact channel",
+      type: "EMAIL",
+    });
+  }
+}
+
+```
+
+### Usage with SSM Contact
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SsmcontactsContact } from "./.gen/providers/aws/ssmcontacts-contact";
+import { SsmcontactsContactChannel } from "./.gen/providers/aws/ssmcontacts-contact-channel";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const exampleContact = new SsmcontactsContact(this, "example_contact", {
+      alias: "example_contact",
+      type: "PERSONAL",
+    });
+    new SsmcontactsContactChannel(this, "example", {
+      contactId: exampleContact.arn,
+      deliveryAddress: {
+        simpleAddress: "email@example.com",
+      },
+      name: "Example contact channel",
+      type: "EMAIL",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+~> **NOTE:** The contact channel needs to be activated in the AWS Systems Manager console, otherwise it can't be used to engage the contact. See the [Contacts section of the Incident Manager User Guide](https://docs.aws.amazon.com/incident-manager/latest/userguide/contacts.html) for more information.
+
+The following arguments are required:
+
+- `contactId` - (Required) Amazon Resource Name (ARN) of the AWS SSM Contact that the contact channel belongs to.
+
+- `deliveryAddress` - (Required) Block that contains contact engagement details. See details below.
+
+- `name` - (Required) Name of the contact channel. Must be between 1 and 255 characters, and may contain alphanumerics, underscores (`_`), hyphens (`-`), periods (`.`), and spaces.
+
+- `type` - (Required) Type of the contact channel. One of `sms`, `voice` or `email`.
+
+### delivery_address
+
+- `simpleAddress` - (Required) Details to engage this contact channel. The expected format depends on the contact channel type and is described in the [`contactChannelAddress` section of the SSM Contacts API Reference](https://docs.aws.amazon.com/incident-manager/latest/APIReference/API_SSMContacts_ContactChannelAddress.html).
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+- `activationStatus` - Whether the contact channel is activated. The contact channel must be activated to use it to engage the contact. One of `activated` or `notActivated`.
+
+- `arn` - Amazon Resource Name (ARN) of the contact channel.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SSM Contact Channel using the `arn`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import SSM Contact Channel using the `arn`. For example:
+
+```console
+% terraform import aws_ssmcontacts_contact_channel.example arn:aws:ssm-contacts:us-west-2:123456789012:contact-channel/example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-875a737831eeadb1d936d18c2cf26aad7a60fef9a50f2c0c60f64676b0763b4f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ssmcontacts_plan.html.markdown b/website/docs/cdktf/typescript/r/ssmcontacts_plan.html.markdown
new file mode 100644
index 00000000000..262670e5a8a
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/ssmcontacts_plan.html.markdown
@@ -0,0 +1,164 @@
+---
+subcategory: "SSM Contacts"
+layout: "aws"
+page_title: "AWS: aws_ssmcontacts_plan"
+description: |-
+  Terraform resource for managing an AWS SSM Contact Plan.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ssmcontacts_plan
+
+Terraform resource for managing an AWS SSM Contact Plan.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SsmcontactsPlan } from "./.gen/providers/aws/ssmcontacts-plan";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SsmcontactsPlan(this, "example", {
+      contactId:
+        "arn:aws:ssm-contacts:us-west-2:123456789012:contact/contactalias",
+      stage: [
+        {
+          durationInMinutes: 1,
+        },
+      ],
+    });
+  }
+}
+
+```
+
+### Usage with SSM Contact
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SsmcontactsContact } from "./.gen/providers/aws/ssmcontacts-contact";
+import { SsmcontactsPlan } from "./.gen/providers/aws/ssmcontacts-plan";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const contact = new SsmcontactsContact(this, "contact", {
+      alias: "alias",
+      type: "PERSONAL",
+    });
+    new SsmcontactsPlan(this, "plan", {
+      contactId: contact.arn,
+      stage: [
+        {
+          durationInMinutes: 1,
+        },
+      ],
+    });
+  }
+}
+
+```
+
+### Usage With All Fields
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SsmcontactsContact } from "./.gen/providers/aws/ssmcontacts-contact";
+import { SsmcontactsPlan } from "./.gen/providers/aws/ssmcontacts-plan";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const contactOne = new SsmcontactsContact(this, "contact_one", {
+      alias: "alias",
+      type: "PERSONAL",
+    });
+    const contactTwo = new SsmcontactsContact(this, "contact_two", {
+      alias: "alias",
+      type: "PERSONAL",
+    });
+    const escalationPlan = new SsmcontactsContact(this, "escalation_plan", {
+      alias: "escalation-plan-alias",
+      type: "ESCALATION",
+    });
+    new SsmcontactsPlan(this, "test", {
+      contactId: escalationPlan.arn,
+      stage: [
+        {
+          durationInMinutes: 0,
+          target: [
+            {
+              contactTargetInfo: {
+                contactId: contactOne.arn,
+                isEssential: false,
+              },
+            },
+            {
+              contactTargetInfo: {
+                contactId: contactTwo.arn,
+                isEssential: true,
+              },
+            },
+          ],
+        },
+      ],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `contactId` - (Required) The Amazon Resource Name (ARN) of the contact or escalation plan.
+* `stage` - (Required) List of stages. A contact has an engagement plan with stages that contact specified contact channels. An escalation plan uses stages that contact specified contacts.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SSM Contact Plan using the Contact ARN. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import SSM Contact Plan using the Contact ARN. For example:
+
+```console
+% terraform import aws_ssmcontacts_plan.example {ARNValue}
+```
+
+<!-- cache-key: cdktf-0.18.0 input-b4cf46452def53401430a7de3b756aa75f94fe3fbe79d237dcc4e08ea43938c8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ssmincidents_replication_set.html.markdown b/website/docs/cdktf/typescript/r/ssmincidents_replication_set.html.markdown
new file mode 100644
index 00000000000..7e466531e16
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/ssmincidents_replication_set.html.markdown
@@ -0,0 +1,217 @@
+---
+subcategory: "SSM Incident Manager Incidents"
+layout: "aws"
+page_title: "AWS: aws_ssmincidents_replication_set"
+description: |-
+  Terraform resource for managing an incident replication set for AWS Systems Manager Incident Manager.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ssmincidents_replication_set
+
+Provides a resource for managing a replication set in AWS Systems Manager Incident Manager.
+
+~> **NOTE:** Deleting a replication set also deletes all Incident Manager related data including response plans, incident records, contacts and escalation plans.
+
+## Example Usage
+
+### Basic Usage
+
+Create a replication set.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SsmincidentsReplicationSet } from "./.gen/providers/aws/ssmincidents-replication-set";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SsmincidentsReplicationSet(this, "replicationSetName", {
+      region: [
+        {
+          name: "us-west-2",
+        },
+      ],
+      tags: {
+        exampleTag: "exampleValue",
+      },
+    });
+  }
+}
+
+```
+
+Add a Region to a replication set. (You can add only one Region at a time.)
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SsmincidentsReplicationSet } from "./.gen/providers/aws/ssmincidents-replication-set";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SsmincidentsReplicationSet(this, "replicationSetName", {
+      region: [
+        {
+          name: "us-west-2",
+        },
+        {
+          name: "ap-southeast-2",
+        },
+      ],
+    });
+  }
+}
+
+```
+
+Delete a Region from a replication set. (You can delete only one Region at a time.)
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SsmincidentsReplicationSet } from "./.gen/providers/aws/ssmincidents-replication-set";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SsmincidentsReplicationSet(this, "replicationSetName", {
+      region: [
+        {
+          name: "us-west-2",
+        },
+      ],
+    });
+  }
+}
+
+```
+
+## Basic Usage with an AWS Customer Managed Key
+
+Create a replication set with an AWS Key Management Service (AWS KMS) customer manager key:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { KmsKey } from "./.gen/providers/aws/kms-key";
+import { SsmincidentsReplicationSet } from "./.gen/providers/aws/ssmincidents-replication-set";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const exampleKey = new KmsKey(this, "example_key", {});
+    new SsmincidentsReplicationSet(this, "replicationSetName", {
+      region: [
+        {
+          kmsKeyArn: exampleKey.arn,
+          name: "us-west-2",
+        },
+      ],
+      tags: {
+        exampleTag: "exampleValue",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+~> **NOTE:** The Region specified by a Terraform provider must always be one of the Regions specified for the replication set. This is especially important when you perform complex update operations.
+
+~> **NOTE:** After a replication set is created, you can add or delete only one Region at a time.
+
+~> **NOTE:** Incident Manager does not support updating the customer managed key associated with a replication set. Instead, for a replication set with multiple Regions, you must first delete a Region from the replication set, then re-add it with a different customer managed key in separate `terraform apply` operations. For a replication set with only one Region, the entire replication set must be deleted and recreated. To do this, comment out the replication set and all response plans, and then run the `terraform apply` command to recreate the replication set with the new customer managed key.
+
+~> **NOTE:** You must either use AWS-owned keys on all regions of a replication set, or customer managed keys. To change between an AWS owned key and a customer managed key, a replication set and it associated data must be deleted and recreated.
+
+~> **NOTE:** If possible, create all the customer managed keys you need (using the `terraform apply` command) before you create the replication set, or create the keys and replication set in the same `terraform apply` command. Otherwise, to delete a replication set, you must run one `terraform apply` command to delete the replication set and another to delete the AWS KMS keys used by the replication set. Deleting the AWS KMS keys before deleting the replication set results in an error. In that case, you must manually reenable the deleted key using the AWS Management Console before you can delete the replication set.
+
+The `region` configuration block is required and supports the following arguments:
+
+* `name` - (Required) The name of the Region, such as `apSoutheast2`.
+* `kmsKeyArn` - (Optional) The Amazon Resource name (ARN) of the customer managed key. If omitted, AWS manages the AWS KMS keys for you, using an AWS owned key, as indicated by a default value of `defaultKey`.
+
+The following arguments are optional:
+
+* `tags` - Tags applied to the replication set.
+
+For information about the maximum allowed number of Regions and tag value constraints, see [CreateReplicationSet in the *AWS Systems Manager Incident Manager API Reference*](https://docs.aws.amazon.com/incident-manager/latest/APIReference/API_CreateReplicationSet.html).
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the replication set.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `createdBy` - The ARN of the user who created the replication set.
+* `createdTime` - A timestamp showing when the replication set was created.
+* `deletionProtected` - If `true`, the last region in a replication set cannot be deleted.
+* `lastModifiedBy` - A timestamp showing when the replication set was last modified.
+* `lastModifiedTime` - When the replication set was last modified
+* `status` - The overall status of a replication set.
+    * Valid Values: `active` | `creating` | `updating` | `deleting` | `failed`
+
+In addition to the preceding arguments, the `region` configuration block exports the following attributes for each Region:
+
+* `status` - The current status of the Region.
+    * Valid Values: `active` | `creating` | `updating` | `deleting` | `failed`
+* `statusUpdateTime` - A timestamp showing when the Region status was last updated.
+* `statusMessage` - More information about the status of a Region.
+
+## Timeouts
+
+~> **NOTE:** `update` and `delete` operations applied to replication sets with large numbers of response plans and data take longer to complete. We recommend that you configure custom timeouts for this situation.
+
+~> **NOTE:** Each additional Region included when you create a replication set increases the amount of time required to complete the `create` operation.
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `120M`)
+* `update` - (Default `120M`)
+* `delete` - (Default `120M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import an Incident Manager replication. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import an Incident Manager replication. For example:
+
+```console
+% terraform import aws_ssmincidents_replication_set.replicationSetName import
+```
+
+<!-- cache-key: cdktf-0.18.0 input-db40342720668c450b5bd2187447758810506f9aa388358f6b3d9c52cf3d9ebf -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ssmincidents_response_plan.html.markdown b/website/docs/cdktf/typescript/r/ssmincidents_response_plan.html.markdown
new file mode 100644
index 00000000000..9d3579f9de0
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/ssmincidents_response_plan.html.markdown
@@ -0,0 +1,205 @@
+---
+subcategory: "SSM Incident Manager Incidents"
+layout: "aws"
+page_title: "AWS: aws_ssmincidents_response_plan"
+description: |-
+  Terraform resource for managing an incident response plan in AWS Systems Manager Incident Manager.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ssmincidents_response_plan
+
+Provides a Terraform resource to manage response plans in AWS Systems Manager Incident Manager.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SsmincidentsResponsePlan } from "./.gen/providers/aws/ssmincidents-response-plan";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SsmincidentsResponsePlan(this, "example", {
+      dependsOn: [awsSsmincidentsReplicationSetExample],
+      incidentTemplate: {
+        impact: Token.asNumber("3"),
+        title: "title",
+      },
+      name: "name",
+      tags: {
+        key: "value",
+      },
+    });
+  }
+}
+
+```
+
+### Usage With All Fields
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SsmincidentsResponsePlan } from "./.gen/providers/aws/ssmincidents-response-plan";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SsmincidentsResponsePlan(this, "example", {
+      action: {
+        ssmAutomation: [
+          {
+            documentName: document1.name,
+            documentVersion: "version1",
+            dynamicParameters: {
+              anotherKey: "INCIDENT_RECORD_ARN",
+              someKey: "INVOLVED_RESOURCES",
+            },
+            parameter: [
+              {
+                name: "key",
+                values: ["value1", "value2"],
+              },
+              {
+                name: "foo",
+                values: ["bar"],
+              },
+            ],
+            roleArn: role1.arn,
+            targetAccount: "RESPONSE_PLAN_OWNER_ACCOUNT",
+          },
+        ],
+      },
+      chatChannel: [topic.arn],
+      dependsOn: [awsSsmincidentsReplicationSetExample],
+      displayName: "display name",
+      engagements: [
+        "arn:aws:ssm-contacts:us-east-2:111122223333:contact/test1",
+      ],
+      incidentTemplate: {
+        dedupeString: "dedupe",
+        impact: Token.asNumber("3"),
+        incidentTags: {
+          key: "value",
+        },
+        notificationTarget: [
+          {
+            snsTopicArn: example1.arn,
+          },
+          {
+            snsTopicArn: example2.arn,
+          },
+        ],
+        summary: "summary",
+        title: "title",
+      },
+      integration: {
+        pagerduty: [
+          {
+            name: "pagerdutyIntergration",
+            secretId: "example",
+            serviceId: "example",
+          },
+        ],
+      },
+      name: "name",
+      tags: {
+        key: "value",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+~> NOTE: A response plan implicitly depends on a replication set. If you configured your replication set in Terraform,
+we recommend you add it to the `dependsOn` argument for the Terraform ResponsePlan Resource.
+
+The following arguments are required:
+
+* `name` - (Required) The name of the response plan.
+
+The `incidentTemplate` configuration block is required and supports the following arguments:
+
+* `title` - (Required) The title of a generated incident.
+* `impact` - (Required) The impact value of a generated incident. The following values are supported:
+    * `1` - Severe Impact
+    * `2` - High Impact
+    * `3` - Medium Impact
+    * `4` - Low Impact
+    * `5` - No Impact
+* `dedupeString` - (Optional) A string used to stop Incident Manager from creating multiple incident records for the same incident.
+* `incidentTags` - (Optional) The tags assigned to an incident template. When an incident starts, Incident Manager assigns the tags specified in the template to the incident.
+* `summary` - (Optional) The summary of an incident.
+* `notificationTarget` - (Optional) The Amazon Simple Notification Service (Amazon SNS) targets that this incident notifies when it is updated. The `notificationTarget` configuration block supports the following argument:
+    * `snsTopicArn` - (Required) The ARN of the Amazon SNS topic.
+
+The following arguments are optional:
+
+* `tags` - (Optional) The tags applied to the response plan.
+* `displayName` - (Optional) The long format of the response plan name. This field can contain spaces.
+* `chatChannel` - (Optional) The Chatbot chat channel used for collaboration during an incident.
+* `engagements` - (Optional) The Amazon Resource Name (ARN) for the contacts and escalation plans that the response plan engages during an incident.
+* `action` - (Optional) The actions that the response plan starts at the beginning of an incident.
+    * `ssmAutomation` - (Optional) The Systems Manager automation document to start as the runbook at the beginning of the incident. The following values are supported:
+        * `documentName` - (Required) The automation document's name.
+        * `roleArn` - (Required) The Amazon Resource Name (ARN) of the role that the automation document assumes when it runs commands.
+        * `documentVersion` - (Optional) The version of the automation document to use at runtime.
+        * `targetAccount` -  (Optional) The account that the automation document runs in. This can be in either the management account or an application account.
+        * `parameter` - (Optional) The key-value pair parameters to use when the automation document runs. The following values are supported:
+            * `name` - The name of parameter.
+            * `values` - The values for the associated parameter name.
+        * `dynamicParameters` - (Optional) The key-value pair to resolve dynamic parameter values when processing a Systems Manager Automation runbook.
+* `integration` - (Optional) Information about third-party services integrated into the response plan. The following values are supported:
+    * `pagerduty` - (Optional) Details about the PagerDuty configuration for a response plan. The following values are supported:
+        * `name` - (Required) The name of the PagerDuty configuration.
+        * `serviceId` - (Required) The ID of the PagerDuty service that the response plan associated with the incident at launch.
+        * `secretId` - (Required) The ID of the AWS Secrets Manager secret that stores your PagerDuty key &mdash; either a General Access REST API Key or User Token REST API Key &mdash; and other user credentials.
+
+For more information about the constraints for each field, see [CreateResponsePlan](https://docs.aws.amazon.com/incident-manager/latest/APIReference/API_CreateResponsePlan.html) in the *AWS Systems Manager Incident Manager API Reference*.
+  
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the response plan.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import an Incident Manager response plan using the response plan ARN. You can find the response plan ARN in the AWS Management Console. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import an Incident Manager response plan using the response plan ARN. You can find the response plan ARN in the AWS Management Console. For example:
+
+```console
+% terraform import aws_ssmincidents_response_plan.responsePlanName ARNValue
+```
+
+<!-- cache-key: cdktf-0.18.0 input-5361abe938254390d796107fc777680b0ac2ec3e08a7c3e24cc29d54aae3c456 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ssoadmin_account_assignment.html.markdown b/website/docs/cdktf/typescript/r/ssoadmin_account_assignment.html.markdown
new file mode 100644
index 00000000000..9ca05dab56c
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/ssoadmin_account_assignment.html.markdown
@@ -0,0 +1,128 @@
+---
+subcategory: "SSO Admin"
+layout: "aws"
+page_title: "AWS: aws_ssoadmin_account_assignment"
+description: |-
+  Manages a Single Sign-On (SSO) Account Assignment
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ssoadmin_account_assignment
+
+Provides a Single Sign-On (SSO) Account Assignment resource
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIdentitystoreGroup } from "./.gen/providers/aws/data-aws-identitystore-group";
+import { DataAwsSsoadminInstances } from "./.gen/providers/aws/data-aws-ssoadmin-instances";
+import { DataAwsSsoadminPermissionSet } from "./.gen/providers/aws/data-aws-ssoadmin-permission-set";
+import { SsoadminAccountAssignment } from "./.gen/providers/aws/ssoadmin-account-assignment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new DataAwsSsoadminInstances(this, "example", {});
+    const dataAwsSsoadminPermissionSetExample =
+      new DataAwsSsoadminPermissionSet(this, "example_1", {
+        instanceArn: Token.asString(
+          Fn.lookupNested(Fn.tolist(example.arns), ["0"])
+        ),
+        name: "AWSReadOnlyAccess",
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsSsoadminPermissionSetExample.overrideLogicalId("example");
+    const dataAwsIdentitystoreGroupExample = new DataAwsIdentitystoreGroup(
+      this,
+      "example_2",
+      {
+        alternateIdentifier: {
+          uniqueAttribute: {
+            attributePath: "DisplayName",
+            attributeValue: "ExampleGroup",
+          },
+        },
+        identityStoreId: Token.asString(
+          Fn.lookupNested(Fn.tolist(example.identityStoreIds), ["0"])
+        ),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsIdentitystoreGroupExample.overrideLogicalId("example");
+    const awsSsoadminAccountAssignmentExample = new SsoadminAccountAssignment(
+      this,
+      "example_3",
+      {
+        instanceArn: Token.asString(
+          Fn.lookupNested(Fn.tolist(example.arns), ["0"])
+        ),
+        permissionSetArn: Token.asString(
+          dataAwsSsoadminPermissionSetExample.arn
+        ),
+        principalId: Token.asString(dataAwsIdentitystoreGroupExample.groupId),
+        principalType: "GROUP",
+        targetId: "012347678910",
+        targetType: "AWS_ACCOUNT",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSsoadminAccountAssignmentExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `instanceArn` - (Required, Forces new resource) The Amazon Resource Name (ARN) of the SSO Instance.
+* `permissionSetArn` - (Required, Forces new resource) The Amazon Resource Name (ARN) of the Permission Set that the admin wants to grant the principal access to.
+* `principalId` - (Required, Forces new resource) An identifier for an object in SSO, such as a user or group. PrincipalIds are GUIDs (For example, `f81D4Fae7Dec11D0A76500A0C91E6Bf6`).
+* `principalType` - (Required, Forces new resource) The entity type for which the assignment will be created. Valid values: `user`, `group`.
+* `targetId` - (Required, Forces new resource) An AWS account identifier, typically a 10-12 digit string.
+* `targetType` - (Optional, Forces new resource) The entity type for which the assignment will be created. Valid values: `awsAccount`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The identifier of the Account Assignment i.e., `principalId`, `principalType`, `targetId`, `targetType`, `permissionSetArn`, `instanceArn` separated by commas (`,`).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `5M`)
+- `delete` - (Default `5M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SSO Account Assignments using the `principalId`, `principalType`, `targetId`, `targetType`, `permissionSetArn`, `instanceArn` separated by commas (`,`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import SSO Account Assignments using the `principalId`, `principalType`, `targetId`, `targetType`, `permissionSetArn`, `instanceArn` separated by commas (`,`). For example:
+
+```console
+% terraform import aws_ssoadmin_account_assignment.example f81d4fae-7dec-11d0-a765-00a0c91e6bf6,GROUP,1234567890,AWS_ACCOUNT,arn:aws:sso:::permissionSet/ssoins-0123456789abcdef/ps-0123456789abcdef,arn:aws:sso:::instance/ssoins-0123456789abcdef
+```
+
+<!-- cache-key: cdktf-0.18.0 input-8b452aa69c7edc6b5216675cd1c17412026fe86f918609ce3cea201495fc2f0e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ssoadmin_customer_managed_policy_attachment.html.markdown b/website/docs/cdktf/typescript/r/ssoadmin_customer_managed_policy_attachment.html.markdown
new file mode 100644
index 00000000000..5e358b31488
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/ssoadmin_customer_managed_policy_attachment.html.markdown
@@ -0,0 +1,141 @@
+---
+subcategory: "SSO Admin"
+layout: "aws"
+page_title: "AWS: aws_ssoadmin_customer_managed_policy_attachment"
+description: |-
+  Manages a customer managed policy for a Single Sign-On (SSO) Permission Set
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ssoadmin_customer_managed_policy_attachment
+
+Provides a customer managed policy attachment for a Single Sign-On (SSO) Permission Set resource
+
+~> **NOTE:** Creating this resource will automatically [Provision the Permission Set](https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_ProvisionPermissionSet.html) to apply the corresponding updates to all assigned accounts.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsSsoadminInstances } from "./.gen/providers/aws/data-aws-ssoadmin-instances";
+import { IamPolicy } from "./.gen/providers/aws/iam-policy";
+import { SsoadminCustomerManagedPolicyAttachment } from "./.gen/providers/aws/ssoadmin-customer-managed-policy-attachment";
+import { SsoadminPermissionSet } from "./.gen/providers/aws/ssoadmin-permission-set";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new IamPolicy(this, "example", {
+      description: "My test policy",
+      name: "TestPolicy",
+      policy: Token.asString(
+        Fn.jsonencode({
+          Statement: [
+            {
+              Action: ["ec2:Describe*"],
+              Effect: "Allow",
+              Resource: "*",
+            },
+          ],
+          Version: "2012-10-17",
+        })
+      ),
+    });
+    const dataAwsSsoadminInstancesExample = new DataAwsSsoadminInstances(
+      this,
+      "example_1",
+      {}
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsSsoadminInstancesExample.overrideLogicalId("example");
+    const awsSsoadminPermissionSetExample = new SsoadminPermissionSet(
+      this,
+      "example_2",
+      {
+        instanceArn: Token.asString(
+          Fn.lookupNested(Fn.tolist(dataAwsSsoadminInstancesExample.arns), [
+            "0",
+          ])
+        ),
+        name: "Example",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSsoadminPermissionSetExample.overrideLogicalId("example");
+    const awsSsoadminCustomerManagedPolicyAttachmentExample =
+      new SsoadminCustomerManagedPolicyAttachment(this, "example_3", {
+        customerManagedPolicyReference: {
+          name: example.name,
+          path: "/",
+        },
+        instanceArn: Token.asString(
+          awsSsoadminPermissionSetExample.instanceArn
+        ),
+        permissionSetArn: Token.asString(awsSsoadminPermissionSetExample.arn),
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSsoadminCustomerManagedPolicyAttachmentExample.overrideLogicalId(
+      "example"
+    );
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `instanceArn` - (Required, Forces new resource) The Amazon Resource Name (ARN) of the SSO Instance under which the operation will be executed.
+* `permissionSetArn` - (Required, Forces new resource) The Amazon Resource Name (ARN) of the Permission Set.
+* `customerManagedPolicyReference` - (Required, Forces new resource) Specifies the name and path of a customer managed policy. See below.
+
+### Customer Managed Policy Reference
+
+The `customerManagedPolicyReference` config block describes a customer managed IAM policy. You must have an IAM policy that matches the name and path in each AWS account where you want to deploy your specified permission set.
+
+* `name` - (Required, Forces new resource) Name of the customer managed IAM Policy to be attached.
+* `path` - (Optional, Forces new resource) The path to the IAM policy to be attached. The default is `/`. See [IAM Identifiers](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html#identifiers-friendly-names) for more information.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Policy Name, Policy Path, Permission Set Amazon Resource Name (ARN), and SSO Instance ARN, each separated by a comma (`,`).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `10M`)
+- `delete` - (Default `10M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SSO Managed Policy Attachments using the `name`, `path`, `permissionSetArn`, and `instanceArn` separated by a comma (`,`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import SSO Managed Policy Attachments using the `name`, `path`, `permissionSetArn`, and `instanceArn` separated by a comma (`,`). For example:
+
+```console
+% terraform import aws_ssoadmin_customer_managed_policy_attachment.example TestPolicy,/,arn:aws:sso:::permissionSet/ssoins-2938j0x8920sbj72/ps-80383020jr9302rk,arn:aws:sso:::instance/ssoins-2938j0x8920sbj72
+```
+
+<!-- cache-key: cdktf-0.18.0 input-a04c10d6fcfe1554e5e21b7e379b1eef18d14ec57155c17e159d69d18e318c3e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ssoadmin_instance_access_control_attributes.html.markdown b/website/docs/cdktf/typescript/r/ssoadmin_instance_access_control_attributes.html.markdown
new file mode 100644
index 00000000000..083b32e2fe2
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/ssoadmin_instance_access_control_attributes.html.markdown
@@ -0,0 +1,108 @@
+---
+subcategory: "SSO Admin"
+layout: "aws"
+page_title: "AWS: aws_ssoadmin_instance_access_control_attributes"
+description: |-
+  Provides a Single Sign-On (SSO) ABAC Resource: https://docs.aws.amazon.com/singlesignon/latest/userguide/abac.html
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ssoadmin_instance_access_control_attributes
+
+Provides a Single Sign-On (SSO) ABAC Resource: https://docs.aws.amazon.com/singlesignon/latest/userguide/abac.html
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsSsoadminInstances } from "./.gen/providers/aws/data-aws-ssoadmin-instances";
+import { SsoadminInstanceAccessControlAttributes } from "./.gen/providers/aws/ssoadmin-instance-access-control-attributes";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new DataAwsSsoadminInstances(this, "example", {});
+    const awsSsoadminInstanceAccessControlAttributesExample =
+      new SsoadminInstanceAccessControlAttributes(this, "example_1", {
+        attribute: [
+          {
+            key: "name",
+            value: [
+              {
+                source: ["$${path:name.givenName}"],
+              },
+            ],
+          },
+          {
+            key: "last",
+            value: [
+              {
+                source: ["$${path:name.familyName}"],
+              },
+            ],
+          },
+        ],
+        instanceArn: Token.asString(
+          Fn.lookupNested(Fn.tolist(example.arns), ["0"])
+        ),
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSsoadminInstanceAccessControlAttributesExample.overrideLogicalId(
+      "example"
+    );
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `instanceArn` - (Required, Forces new resource) The Amazon Resource Name (ARN) of the SSO Instance.
+* `attribute` - (Required) See [AccessControlAttribute](#accesscontrolattribute) for more details.
+
+### AccessControlAttribute
+
+* `key` - (Required) The name of the attribute associated with your identities in your identity source. This is used to map a specified attribute in your identity source with an attribute in AWS SSO.
+* `value` - (Required) The value used for mapping a specified attribute to an identity source. See [AccessControlAttributeValue](#accesscontrolattributevalue)
+
+### AccessControlAttributeValue
+
+* `source` - (Required) The identity source to use when mapping a specified attribute to AWS SSO.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The identifier of the Instance Access Control Attribute `instanceArn`.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SSO Account Assignments using the `instanceArn`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import SSO Account Assignments using the `instanceArn`. For example:
+
+```console
+% terraform import aws_ssoadmin_instance_access_control_attributes.example arn:aws:sso:::instance/ssoins-0123456789abcdef
+```
+
+<!-- cache-key: cdktf-0.18.0 input-0555b8646d1cd7133c5af6d918c5eb794a739e08734bb46a2e6ae815ff87af3f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ssoadmin_managed_policy_attachment.html.markdown b/website/docs/cdktf/typescript/r/ssoadmin_managed_policy_attachment.html.markdown
new file mode 100644
index 00000000000..ca646fa829c
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/ssoadmin_managed_policy_attachment.html.markdown
@@ -0,0 +1,105 @@
+---
+subcategory: "SSO Admin"
+layout: "aws"
+page_title: "AWS: aws_ssoadmin_managed_policy_attachment"
+description: |-
+  Manages an IAM managed policy for a Single Sign-On (SSO) Permission Set
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ssoadmin_managed_policy_attachment
+
+Provides an IAM managed policy for a Single Sign-On (SSO) Permission Set resource
+
+~> **NOTE:** Creating this resource will automatically [Provision the Permission Set](https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_ProvisionPermissionSet.html) to apply the corresponding updates to all assigned accounts.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsSsoadminInstances } from "./.gen/providers/aws/data-aws-ssoadmin-instances";
+import { SsoadminManagedPolicyAttachment } from "./.gen/providers/aws/ssoadmin-managed-policy-attachment";
+import { SsoadminPermissionSet } from "./.gen/providers/aws/ssoadmin-permission-set";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new DataAwsSsoadminInstances(this, "example", {});
+    const awsSsoadminPermissionSetExample = new SsoadminPermissionSet(
+      this,
+      "example_1",
+      {
+        instanceArn: Token.asString(
+          Fn.lookupNested(Fn.tolist(example.arns), ["0"])
+        ),
+        name: "Example",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSsoadminPermissionSetExample.overrideLogicalId("example");
+    const awsSsoadminManagedPolicyAttachmentExample =
+      new SsoadminManagedPolicyAttachment(this, "example_2", {
+        instanceArn: Token.asString(
+          Fn.lookupNested(Fn.tolist(example.arns), ["0"])
+        ),
+        managedPolicyArn: "arn:aws:iam::aws:policy/AlexaForBusinessDeviceSetup",
+        permissionSetArn: Token.asString(awsSsoadminPermissionSetExample.arn),
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSsoadminManagedPolicyAttachmentExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `instanceArn` - (Required, Forces new resource) The Amazon Resource Name (ARN) of the SSO Instance under which the operation will be executed.
+* `managedPolicyArn` - (Required, Forces new resource) The IAM managed policy Amazon Resource Name (ARN) to be attached to the Permission Set.
+* `permissionSetArn` - (Required, Forces new resource) The Amazon Resource Name (ARN) of the Permission Set.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Amazon Resource Names (ARNs) of the Managed Policy, Permission Set, and SSO Instance, separated by a comma (`,`).
+* `managedPolicyName` - The name of the IAM Managed Policy.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `10M`)
+- `delete` - (Default `10M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SSO Managed Policy Attachments using the `managedPolicyArn`, `permissionSetArn`, and `instanceArn` separated by a comma (`,`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import SSO Managed Policy Attachments using the `managedPolicyArn`, `permissionSetArn`, and `instanceArn` separated by a comma (`,`). For example:
+
+```console
+% terraform import aws_ssoadmin_managed_policy_attachment.example arn:aws:iam::aws:policy/AlexaForBusinessDeviceSetup,arn:aws:sso:::permissionSet/ssoins-2938j0x8920sbj72/ps-80383020jr9302rk,arn:aws:sso:::instance/ssoins-2938j0x8920sbj72
+```
+
+<!-- cache-key: cdktf-0.18.0 input-804f184ebfee68df4dc2222676baddc797e81d49b0ca41f4f287c92a6ac426ca -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ssoadmin_permission_set.html.markdown b/website/docs/cdktf/typescript/r/ssoadmin_permission_set.html.markdown
new file mode 100644
index 00000000000..94aaf0a8133
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/ssoadmin_permission_set.html.markdown
@@ -0,0 +1,102 @@
+---
+subcategory: "SSO Admin"
+layout: "aws"
+page_title: "AWS: aws_ssoadmin_permission_set"
+description: |-
+  Manages a Single Sign-On (SSO) Permission Set
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ssoadmin_permission_set
+
+Provides a Single Sign-On (SSO) Permission Set resource
+
+~> **NOTE:** Updating this resource will automatically [Provision the Permission Set](https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_ProvisionPermissionSet.html) to apply the corresponding updates to all assigned accounts.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsSsoadminInstances } from "./.gen/providers/aws/data-aws-ssoadmin-instances";
+import { SsoadminPermissionSet } from "./.gen/providers/aws/ssoadmin-permission-set";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new DataAwsSsoadminInstances(this, "example", {});
+    const awsSsoadminPermissionSetExample = new SsoadminPermissionSet(
+      this,
+      "example_1",
+      {
+        description: "An example",
+        instanceArn: Token.asString(
+          Fn.lookupNested(Fn.tolist(example.arns), ["0"])
+        ),
+        name: "Example",
+        relayState:
+          "https://s3.console.aws.amazon.com/s3/home?region=us-east-1#",
+        sessionDuration: "PT2H",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSsoadminPermissionSetExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `description` - (Optional) The description of the Permission Set.
+* `instanceArn` - (Required, Forces new resource) The Amazon Resource Name (ARN) of the SSO Instance under which the operation will be executed.
+* `name` - (Required, Forces new resource) The name of the Permission Set.
+* `relayState` - (Optional) The relay state URL used to redirect users within the application during the federation authentication process.
+* `sessionDuration` - (Optional) The length of time that the application user sessions are valid in the ISO-8601 standard. Default: `pt1H`.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the Permission Set.
+* `id` - The Amazon Resource Names (ARNs) of the Permission Set and SSO Instance, separated by a comma (`,`).
+* `createdDate` - The date the Permission Set was created in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8).
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `update` - (Default `10M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SSO Permission Sets using the `arn` and `instanceArn` separated by a comma (`,`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import SSO Permission Sets using the `arn` and `instanceArn` separated by a comma (`,`). For example:
+
+```console
+% terraform import aws_ssoadmin_permission_set.example arn:aws:sso:::permissionSet/ssoins-2938j0x8920sbj72/ps-80383020jr9302rk,arn:aws:sso:::instance/ssoins-2938j0x8920sbj72
+```
+
+<!-- cache-key: cdktf-0.18.0 input-2c1f2076ed612356260a73ee4a57bd14c4cf5a5dd7d59da0d248e8cda59c8f43 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ssoadmin_permission_set_inline_policy.html.markdown b/website/docs/cdktf/typescript/r/ssoadmin_permission_set_inline_policy.html.markdown
new file mode 100644
index 00000000000..ce8c5ef54d3
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/ssoadmin_permission_set_inline_policy.html.markdown
@@ -0,0 +1,125 @@
+---
+subcategory: "SSO Admin"
+layout: "aws"
+page_title: "AWS: aws_ssoadmin_permission_set_inline_policy"
+description: |-
+  Manages an IAM inline policy for a Single Sign-On (SSO) Permission Set
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ssoadmin_permission_set_inline_policy
+
+Provides an IAM inline policy for a Single Sign-On (SSO) Permission Set resource
+
+~> **NOTE:** AWS Single Sign-On (SSO) only supports one IAM inline policy per [`awsSsoadminPermissionSet`](ssoadmin_permission_set.html) resource.
+Creating or updating this resource will automatically [Provision the Permission Set](https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_ProvisionPermissionSet.html) to apply the corresponding updates to all assigned accounts.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { DataAwsSsoadminInstances } from "./.gen/providers/aws/data-aws-ssoadmin-instances";
+import { SsoadminPermissionSet } from "./.gen/providers/aws/ssoadmin-permission-set";
+import { SsoadminPermissionSetInlinePolicy } from "./.gen/providers/aws/ssoadmin-permission-set-inline-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new DataAwsIamPolicyDocument(this, "example", {
+      statement: [
+        {
+          actions: ["s3:ListAllMyBuckets", "s3:GetBucketLocation"],
+          resources: ["arn:aws:s3:::*"],
+          sid: "1",
+        },
+      ],
+    });
+    const dataAwsSsoadminInstancesExample = new DataAwsSsoadminInstances(
+      this,
+      "example_1",
+      {}
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsSsoadminInstancesExample.overrideLogicalId("example");
+    const awsSsoadminPermissionSetExample = new SsoadminPermissionSet(
+      this,
+      "example_2",
+      {
+        instanceArn: Token.asString(
+          Fn.lookupNested(Fn.tolist(dataAwsSsoadminInstancesExample.arns), [
+            "0",
+          ])
+        ),
+        name: "Example",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSsoadminPermissionSetExample.overrideLogicalId("example");
+    const awsSsoadminPermissionSetInlinePolicyExample =
+      new SsoadminPermissionSetInlinePolicy(this, "example_3", {
+        inlinePolicy: Token.asString(example.json),
+        instanceArn: Token.asString(
+          Fn.lookupNested(Fn.tolist(dataAwsSsoadminInstancesExample.arns), [
+            "0",
+          ])
+        ),
+        permissionSetArn: Token.asString(awsSsoadminPermissionSetExample.arn),
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSsoadminPermissionSetInlinePolicyExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `inlinePolicy` - (Required) The IAM inline policy to attach to a Permission Set.
+* `instanceArn` - (Required, Forces new resource) The Amazon Resource Name (ARN) of the SSO Instance under which the operation will be executed.
+* `permissionSetArn` - (Required, Forces new resource) The Amazon Resource Name (ARN) of the Permission Set.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Amazon Resource Names (ARNs) of the Permission Set and SSO Instance, separated by a comma (`,`).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `10M`)
+- `delete` - (Default `10M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SSO Permission Set Inline Policies using the `permissionSetArn` and `instanceArn` separated by a comma (`,`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import SSO Permission Set Inline Policies using the `permissionSetArn` and `instanceArn` separated by a comma (`,`). For example:
+
+```console
+% terraform import aws_ssoadmin_permission_set_inline_policy.example arn:aws:sso:::permissionSet/ssoins-2938j0x8920sbj72/ps-80383020jr9302rk,arn:aws:sso:::instance/ssoins-2938j0x8920sbj72
+```
+
+<!-- cache-key: cdktf-0.18.0 input-f84fb52afb87edc6b7246f6e44d458f33af2b054e17ae0d967f945cade307d27 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/ssoadmin_permissions_boundary_attachment.html.markdown b/website/docs/cdktf/typescript/r/ssoadmin_permissions_boundary_attachment.html.markdown
new file mode 100644
index 00000000000..976daf56601
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/ssoadmin_permissions_boundary_attachment.html.markdown
@@ -0,0 +1,178 @@
+---
+subcategory: "SSO Admin"
+layout: "aws"
+page_title: "AWS: aws_ssoadmin_permissions_boundary_attachment"
+description: |-
+  Attaches a permissions boundary policy to a Single Sign-On (SSO) Permission Set resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_ssoadmin_permissions_boundary_attachment
+
+Attaches a permissions boundary policy to a Single Sign-On (SSO) Permission Set resource.
+
+~> **NOTE:** A permission set can have at most one permissions boundary attached; using more than one `awsSsoadminPermissionsBoundaryAttachment` references the same permission set will show a permanent difference.
+
+## Example Usage
+
+### Attaching a customer-managed policy
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsSsoadminInstances } from "./.gen/providers/aws/data-aws-ssoadmin-instances";
+import { IamPolicy } from "./.gen/providers/aws/iam-policy";
+import { SsoadminPermissionSet } from "./.gen/providers/aws/ssoadmin-permission-set";
+import { SsoadminPermissionsBoundaryAttachment } from "./.gen/providers/aws/ssoadmin-permissions-boundary-attachment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new IamPolicy(this, "example", {
+      description: "My test policy",
+      name: "TestPolicy",
+      policy: Token.asString(
+        Fn.jsonencode({
+          Statement: [
+            {
+              Action: ["ec2:Describe*"],
+              Effect: "Allow",
+              Resource: "*",
+            },
+          ],
+          Version: "2012-10-17",
+        })
+      ),
+    });
+    const dataAwsSsoadminInstancesExample = new DataAwsSsoadminInstances(
+      this,
+      "example_1",
+      {}
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsSsoadminInstancesExample.overrideLogicalId("example");
+    const awsSsoadminPermissionSetExample = new SsoadminPermissionSet(
+      this,
+      "example_2",
+      {
+        instanceArn: Token.asString(
+          Fn.lookupNested(Fn.tolist(dataAwsSsoadminInstancesExample.arns), [
+            "0",
+          ])
+        ),
+        name: "Example",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSsoadminPermissionSetExample.overrideLogicalId("example");
+    const awsSsoadminPermissionsBoundaryAttachmentExample =
+      new SsoadminPermissionsBoundaryAttachment(this, "example_3", {
+        instanceArn: Token.asString(
+          awsSsoadminPermissionSetExample.instanceArn
+        ),
+        permissionSetArn: Token.asString(awsSsoadminPermissionSetExample.arn),
+        permissionsBoundary: {
+          customerManagedPolicyReference: {
+            name: example.name,
+            path: "/",
+          },
+        },
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSsoadminPermissionsBoundaryAttachmentExample.overrideLogicalId(
+      "example"
+    );
+  }
+}
+
+```
+
+### Attaching an AWS-managed policy
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SsoadminPermissionsBoundaryAttachment } from "./.gen/providers/aws/ssoadmin-permissions-boundary-attachment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SsoadminPermissionsBoundaryAttachment(this, "example", {
+      instanceArn: Token.asString(awsSsoadminPermissionSetExample.instanceArn),
+      permissionSetArn: Token.asString(awsSsoadminPermissionSetExample.arn),
+      permissionsBoundary: {
+        managedPolicyArn: "arn:aws:iam::aws:policy/ReadOnlyAccess",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `instanceArn` - (Required, Forces new resource) The Amazon Resource Name (ARN) of the SSO Instance under which the operation will be executed.
+* `permissionSetArn` - (Required, Forces new resource) The Amazon Resource Name (ARN) of the Permission Set.
+* `permissionsBoundary` - (Required, Forces new resource) The permissions boundary policy. See below.
+
+### Permissions Boundary
+
+The `permissionsBoundary` config block describes the permissions boundary policy to attach. You can reference either an AWS-managed policy, or a customer managed policy, but only one may be set.
+
+* `managedPolicyArn` - (Optional) AWS-managed IAM policy ARN to use as the permissions boundary.
+* `customerManagedPolicyReference` - (Optional) Specifies the name and path of a customer managed policy. See below.
+
+### Customer Managed Policy Reference
+
+The `customerManagedPolicyReference` config block describes a customer managed IAM policy. You must have an IAM policy that matches the name and path in each AWS account where you want to deploy your specified permission set.
+
+* `name` - (Required, Forces new resource) Name of the customer managed IAM Policy to be attached.
+* `path` - (Optional, Forces new resource) The path to the IAM policy to be attached. The default is `/`. See [IAM Identifiers](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html#identifiers-friendly-names) for more information.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Permission Set Amazon Resource Name (ARN) and SSO Instance ARN, separated by a comma (`,`).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `10M`)
+- `delete` - (Default `10M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SSO Admin Permissions Boundary Attachments using the `permissionSetArn` and `instanceArn`, separated by a comma (`,`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import SSO Admin Permissions Boundary Attachments using the `permissionSetArn` and `instanceArn`, separated by a comma (`,`). For example:
+
+```console
+% terraform import aws_ssoadmin_permissions_boundary_attachment.example arn:aws:sso:::permissionSet/ssoins-2938j0x8920sbj72/ps-80383020jr9302rk,arn:aws:sso:::instance/ssoins-2938j0x8920sbj72
+```
+
+<!-- cache-key: cdktf-0.18.0 input-b18b40e74ac6a4c483e12a6c4261d755ba4289cd16e5a156898b6ed4b6af7691 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/storagegateway_cache.html.markdown b/website/docs/cdktf/typescript/r/storagegateway_cache.html.markdown
new file mode 100644
index 00000000000..00864fe109d
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/storagegateway_cache.html.markdown
@@ -0,0 +1,75 @@
+---
+subcategory: "Storage Gateway"
+layout: "aws"
+page_title: "AWS: aws_storagegateway_cache"
+description: |-
+  Manages an AWS Storage Gateway cache
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_storagegateway_cache
+
+Manages an AWS Storage Gateway cache.
+
+~> **NOTE:** The Storage Gateway API provides no method to remove a cache disk. Destroying this Terraform resource does not perform any Storage Gateway actions.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { StoragegatewayCache } from "./.gen/providers/aws/storagegateway-cache";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new StoragegatewayCache(this, "example", {
+      diskId: Token.asString(dataAwsStoragegatewayLocalDiskExample.id),
+      gatewayArn: Token.asString(awsStoragegatewayGatewayExample.arn),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `diskId` - (Required) Local disk identifier. For example, `pci0000:03:000Scsi0:0:0:0`.
+* `gatewayArn` - (Required) The Amazon Resource Name (ARN) of the gateway.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Combined gateway Amazon Resource Name (ARN) and local disk identifier.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsStoragegatewayCache` using the gateway Amazon Resource Name (ARN) and local disk identifier separated with a colon (`:`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsStoragegatewayCache` using the gateway Amazon Resource Name (ARN) and local disk identifier separated with a colon (`:`). For example:
+
+```console
+% terraform import aws_storagegateway_cache.example arn:aws:storagegateway:us-east-1:123456789012:gateway/sgw-12345678:pci-0000:03:00.0-scsi-0:0:0:0
+```
+
+<!-- cache-key: cdktf-0.18.0 input-71c425b426e8be6b2795e6720d1217aa0af1c682498abb9c938909327c75ac67 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/storagegateway_cached_iscsi_volume.html.markdown b/website/docs/cdktf/typescript/r/storagegateway_cached_iscsi_volume.html.markdown
new file mode 100644
index 00000000000..7f0ac5c6381
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/storagegateway_cached_iscsi_volume.html.markdown
@@ -0,0 +1,155 @@
+---
+subcategory: "Storage Gateway"
+layout: "aws"
+page_title: "AWS: aws_storagegateway_cached_iscsi_volume"
+description: |-
+  Manages an AWS Storage Gateway cached iSCSI volume
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_storagegateway_cached_iscsi_volume
+
+Manages an AWS Storage Gateway cached iSCSI volume.
+
+~> **NOTE:** The gateway must have cache added (e.g., via the [`awsStoragegatewayCache`](/docs/providers/aws/r/storagegateway_cache.html) resource) before creating volumes otherwise the Storage Gateway API will return an error.
+
+~> **NOTE:** The gateway must have an upload buffer added (e.g., via the [`awsStoragegatewayUploadBuffer`](/docs/providers/aws/r/storagegateway_upload_buffer.html) resource) before the volume is operational to clients, however the Storage Gateway API will allow volume creation without error in that case and return volume status as `UPLOAD BUFFER NOT CONFIGURED`.
+
+## Example Usage
+
+~> **NOTE:** These examples are referencing the [`awsStoragegatewayCache`](/docs/providers/aws/r/storagegateway_cache.html) resource `gatewayArn` attribute to ensure Terraform properly adds cache before creating the volume. If you are not using this method, you may need to declare an expicit dependency (e.g., via `depends_on = [aws_storagegateway_cache.example]`) to ensure proper ordering.
+
+### Create Empty Cached iSCSI Volume
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { StoragegatewayCachedIscsiVolume } from "./.gen/providers/aws/storagegateway-cached-iscsi-volume";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new StoragegatewayCachedIscsiVolume(this, "example", {
+      gatewayArn: Token.asString(awsStoragegatewayCacheExample.gatewayArn),
+      networkInterfaceId: Token.asString(awsInstanceExample.privateIp),
+      targetName: "example",
+      volumeSizeInBytes: 5368709120,
+    });
+  }
+}
+
+```
+
+### Create Cached iSCSI Volume From Snapshot
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, Op, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { StoragegatewayCachedIscsiVolume } from "./.gen/providers/aws/storagegateway-cached-iscsi-volume";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new StoragegatewayCachedIscsiVolume(this, "example", {
+      gatewayArn: Token.asString(awsStoragegatewayCacheExample.gatewayArn),
+      networkInterfaceId: Token.asString(awsInstanceExample.privateIp),
+      snapshotId: Token.asString(awsEbsSnapshotExample.id),
+      targetName: "example",
+      volumeSizeInBytes: Token.asNumber(
+        Op.mul(
+          Op.mul(Op.mul(awsEbsSnapshotExample.volumeSize, 1024), 1024),
+          1024
+        )
+      ),
+    });
+  }
+}
+
+```
+
+### Create Cached iSCSI Volume From Source Volume
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { StoragegatewayCachedIscsiVolume } from "./.gen/providers/aws/storagegateway-cached-iscsi-volume";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new StoragegatewayCachedIscsiVolume(this, "example", {
+      gatewayArn: Token.asString(awsStoragegatewayCacheExample.gatewayArn),
+      networkInterfaceId: Token.asString(awsInstanceExample.privateIp),
+      sourceVolumeArn: existing.arn,
+      targetName: "example",
+      volumeSizeInBytes: existing.volumeSizeInBytes,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `gatewayArn` - (Required) The Amazon Resource Name (ARN) of the gateway.
+* `networkInterfaceId` - (Required) The network interface of the gateway on which to expose the iSCSI target. Only IPv4 addresses are accepted.
+* `targetName` - (Required) The name of the iSCSI target used by initiators to connect to the target and as a suffix for the target ARN. The target name must be unique across all volumes of a gateway.
+* `volumeSizeInBytes` - (Required) The size of the volume in bytes.
+* `snapshotId` - (Optional) The snapshot ID of the snapshot to restore as the new cached volumeE.g., `snap1122Aabb`.
+* `sourceVolumeArn` - (Optional) The ARN for an existing volume. Specifying this ARN makes the new volume into an exact copy of the specified existing volume's latest recovery point. The `volumeSizeInBytes` value for this new volume must be equal to or larger than the size of the existing volume, in bytes.
+* `kmsEncrypted` - (Optional) Set to `true` to use Amazon S3 server side encryption with your own AWS KMS key, or `false` to use a key managed by Amazon S3.
+* `kmsKey` - (Optional) The Amazon Resource Name (ARN) of the AWS KMS key used for Amazon S3 server side encryption. Is required when `kmsEncrypted` is set.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Volume Amazon Resource Name (ARN), e.g., `arn:aws:storagegateway:usEast1:123456789012:gateway/sgw12345678/volume/vol12345678`.
+* `chapEnabled` - Whether mutual CHAP is enabled for the iSCSI target.
+* `id` - Volume Amazon Resource Name (ARN), e.g., `arn:aws:storagegateway:usEast1:123456789012:gateway/sgw12345678/volume/vol12345678`.
+* `lunNumber` - Logical disk number.
+* `networkInterfacePort` - The port used to communicate with iSCSI targets.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `targetArn` - Target Amazon Resource Name (ARN), e.g., `arn:aws:storagegateway:usEast1:123456789012:gateway/sgw12345678/target/iqn199705ComAmazon:targetName`.
+* `volumeArn` - Volume Amazon Resource Name (ARN), e.g., `arn:aws:storagegateway:usEast1:123456789012:gateway/sgw12345678/volume/vol12345678`.
+* `volumeId` - Volume ID, e.g., `vol12345678`.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsStoragegatewayCachedIscsiVolume` using the volume Amazon Resource Name (ARN). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsStoragegatewayCachedIscsiVolume` using the volume Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_storagegateway_cached_iscsi_volume.example arn:aws:storagegateway:us-east-1:123456789012:gateway/sgw-12345678/volume/vol-12345678
+```
+
+<!-- cache-key: cdktf-0.18.0 input-fbd53663d449fd1b382a8d59bc64c857ce61a3216c6189065bd24cb002807e26 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/storagegateway_file_system_association.html.markdown b/website/docs/cdktf/typescript/r/storagegateway_file_system_association.html.markdown
new file mode 100644
index 00000000000..6c24e420409
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/storagegateway_file_system_association.html.markdown
@@ -0,0 +1,166 @@
+---
+subcategory: "Storage Gateway"
+layout: "aws"
+page_title: "AWS: aws_storagegateway_file_system_association"
+description: |-
+  Mananges an association between an Amazon FSx file system and an Amazon FSx File Gateway.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_storagegateway_file_system_association
+
+Associate an Amazon FSx file system with the FSx File Gateway. After the association process is complete, the file shares on the Amazon FSx file system are available for access through the gateway. This operation only supports the FSx File Gateway type.
+
+[FSx File Gateway requirements](https://docs.aws.amazon.com/filegateway/latest/filefsxw/Requirements.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { StoragegatewayFileSystemAssociation } from "./.gen/providers/aws/storagegateway-file-system-association";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new StoragegatewayFileSystemAssociation(this, "example", {
+      auditDestinationArn: Token.asString(awsS3BucketExample.arn),
+      gatewayArn: Token.asString(awsStoragegatewayGatewayExample.arn),
+      locationArn: Token.asString(awsFsxWindowsFileSystemExample.arn),
+      password: "avoid-plaintext-passwords",
+      username: "Admin",
+    });
+  }
+}
+
+```
+
+## Required Services Example
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, Fn, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsSsmParameter } from "./.gen/providers/aws/data-aws-ssm-parameter";
+import { FsxWindowsFileSystem } from "./.gen/providers/aws/fsx-windows-file-system";
+import { Instance } from "./.gen/providers/aws/instance";
+import { StoragegatewayFileSystemAssociation } from "./.gen/providers/aws/storagegateway-file-system-association";
+import { StoragegatewayGateway } from "./.gen/providers/aws/storagegateway-gateway";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const test = new FsxWindowsFileSystem(this, "test", {
+      activeDirectoryId: Token.asString(awsDirectoryServiceDirectoryTest.id),
+      securityGroupIds: [Token.asString(awsSecurityGroupTest.id)],
+      skipFinalBackup: true,
+      storageCapacity: 32,
+      subnetIds: [Token.asString(Fn.lookupNested(awsSubnetTest, ["0", "id"]))],
+      throughputCapacity: 8,
+    });
+    const awsServiceStoragegatewayAmiFileS3Latest = new DataAwsSsmParameter(
+      this,
+      "aws_service_storagegateway_ami_FILE_S3_latest",
+      {
+        name: "/aws/service/storagegateway/ami/FILE_S3/latest",
+      }
+    );
+    const awsInstanceTest = new Instance(this, "test_2", {
+      ami: Token.asString(awsServiceStoragegatewayAmiFileS3Latest.value),
+      associatePublicIpAddress: true,
+      dependsOn: [awsRouteTest, awsVpcDhcpOptionsAssociationTest],
+      instanceType: Token.asString(available.instanceType),
+      subnetId: Token.asString(Fn.lookupNested(awsSubnetTest, ["0", "id"])),
+      vpcSecurityGroupIds: [Token.asString(awsSecurityGroupTest.id)],
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsInstanceTest.overrideLogicalId("test");
+    const awsStoragegatewayGatewayTest = new StoragegatewayGateway(
+      this,
+      "test_3",
+      {
+        gatewayIpAddress: Token.asString(awsInstanceTest.publicIp),
+        gatewayName: "test-sgw",
+        gatewayTimezone: "GMT",
+        gatewayType: "FILE_FSX_SMB",
+        smbActiveDirectorySettings: {
+          domainName: Token.asString(awsDirectoryServiceDirectoryTest.name),
+          password: Token.asString(awsDirectoryServiceDirectoryTest.password),
+          username: "Admin",
+        },
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsStoragegatewayGatewayTest.overrideLogicalId("test");
+    new StoragegatewayFileSystemAssociation(this, "fsx", {
+      auditDestinationArn: Token.asString(awsCloudwatchLogGroupTest.arn),
+      cacheAttributes: {
+        cacheStaleTimeoutInSeconds: 400,
+      },
+      gatewayArn: Token.asString(awsStoragegatewayGatewayTest.arn),
+      locationArn: test.arn,
+      password: Token.asString(awsDirectoryServiceDirectoryTest.password),
+      username: "Admin",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `gatewayArn` - (Required) The Amazon Resource Name (ARN) of the gateway.
+* `locationArn` - (Required) The Amazon Resource Name (ARN) of the Amazon FSx file system to associate with the FSx File Gateway.
+* `username` - (Required) The user name of the user credential that has permission to access the root share of the Amazon FSx file system. The user account must belong to the Amazon FSx delegated admin user group.
+* `password` - (Required, sensitive) The password of the user credential.
+* `auditDestinationArn` - (Optional) The Amazon Resource Name (ARN) of the storage used for the audit logs.
+* `cacheAttributes` - (Optional) Refresh cache information. see [Cache Attributes](#cache_attributes) for more details.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### cache_attributes
+
+* `cacheStaleTimeoutInSeconds` - (Optional) Refreshes a file share's cache by using Time To Live (TTL).
+ TTL is the length of time since the last refresh after which access to the directory would cause the file gateway
+  to first refresh that directory's contents from the Amazon S3 bucket. Valid Values: `0` or `300` to `2592000` seconds (5 minutes to 30 days). Defaults to `0`
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Amazon Resource Name (ARN) of the FSx file system association
+* `arn` - Amazon Resource Name (ARN) of the newly created file system association.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsStoragegatewayFileSystemAssociation` using the FSx file system association Amazon Resource Name (ARN). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsStoragegatewayFileSystemAssociation` using the FSx file system association Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_storagegateway_file_system_association.example arn:aws:storagegateway:us-east-1:123456789012:fs-association/fsa-0DA347732FDB40125
+```
+
+<!-- cache-key: cdktf-0.18.0 input-25ffcf0143f211628c624df50a48a4f56f62a6e23545b746731989404c66e06e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/storagegateway_gateway.html.markdown b/website/docs/cdktf/typescript/r/storagegateway_gateway.html.markdown
new file mode 100644
index 00000000000..cf3acb9668b
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/storagegateway_gateway.html.markdown
@@ -0,0 +1,314 @@
+---
+subcategory: "Storage Gateway"
+layout: "aws"
+page_title: "AWS: aws_storagegateway_gateway"
+description: |-
+  Manages an AWS Storage Gateway file, tape, or volume gateway in the provider region
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_storagegateway_gateway
+
+Manages an AWS Storage Gateway file, tape, or volume gateway in the provider region.
+
+~> **NOTE:** The Storage Gateway API requires the gateway to be connected to properly return information after activation. If you are receiving `The specified gateway is not connected` errors during resource creation (gateway activation), ensure your gateway instance meets the [Storage Gateway requirements](https://docs.aws.amazon.com/storagegateway/latest/userguide/Requirements.html).
+
+## Example Usage
+
+### Local Cache
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsStoragegatewayLocalDisk } from "./.gen/providers/aws/data-aws-storagegateway-local-disk";
+import { StoragegatewayCache } from "./.gen/providers/aws/storagegateway-cache";
+import { VolumeAttachment } from "./.gen/providers/aws/volume-attachment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new VolumeAttachment(this, "test", {
+      deviceName: "/dev/xvdb",
+      instanceId: Token.asString(awsInstanceTest.id),
+      volumeId: Token.asString(awsEbsVolumeTest.id),
+    });
+    const dataAwsStoragegatewayLocalDiskTest =
+      new DataAwsStoragegatewayLocalDisk(this, "test_1", {
+        diskNode: Token.asString(dataAwsVolumeAttachmentTest.deviceName),
+        gatewayArn: Token.asString(awsStoragegatewayGatewayTest.arn),
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsStoragegatewayLocalDiskTest.overrideLogicalId("test");
+    const awsStoragegatewayCacheTest = new StoragegatewayCache(this, "test_2", {
+      diskId: Token.asString(dataAwsStoragegatewayLocalDiskTest.diskId),
+      gatewayArn: Token.asString(awsStoragegatewayGatewayTest.arn),
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsStoragegatewayCacheTest.overrideLogicalId("test");
+  }
+}
+
+```
+
+### FSx File Gateway
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { StoragegatewayGateway } from "./.gen/providers/aws/storagegateway-gateway";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new StoragegatewayGateway(this, "example", {
+      gatewayIpAddress: "1.2.3.4",
+      gatewayName: "example",
+      gatewayTimezone: "GMT",
+      gatewayType: "FILE_FSX_SMB",
+      smbActiveDirectorySettings: {
+        domainName: "corp.example.com",
+        password: "avoid-plaintext-passwords",
+        username: "Admin",
+      },
+    });
+  }
+}
+
+```
+
+### S3 File Gateway
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { StoragegatewayGateway } from "./.gen/providers/aws/storagegateway-gateway";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new StoragegatewayGateway(this, "example", {
+      gatewayIpAddress: "1.2.3.4",
+      gatewayName: "example",
+      gatewayTimezone: "GMT",
+      gatewayType: "FILE_S3",
+    });
+  }
+}
+
+```
+
+### Tape Gateway
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { StoragegatewayGateway } from "./.gen/providers/aws/storagegateway-gateway";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new StoragegatewayGateway(this, "example", {
+      gatewayIpAddress: "1.2.3.4",
+      gatewayName: "example",
+      gatewayTimezone: "GMT",
+      gatewayType: "VTL",
+      mediumChangerType: "AWS-Gateway-VTL",
+      tapeDriveType: "IBM-ULT3580-TD5",
+    });
+  }
+}
+
+```
+
+### Volume Gateway (Cached)
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { StoragegatewayGateway } from "./.gen/providers/aws/storagegateway-gateway";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new StoragegatewayGateway(this, "example", {
+      gatewayIpAddress: "1.2.3.4",
+      gatewayName: "example",
+      gatewayTimezone: "GMT",
+      gatewayType: "CACHED",
+    });
+  }
+}
+
+```
+
+### Volume Gateway (Stored)
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { StoragegatewayGateway } from "./.gen/providers/aws/storagegateway-gateway";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new StoragegatewayGateway(this, "example", {
+      gatewayIpAddress: "1.2.3.4",
+      gatewayName: "example",
+      gatewayTimezone: "GMT",
+      gatewayType: "STORED",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+~> **NOTE:** One of `activationKey` or `gatewayIpAddress` must be provided for resource creation (gateway activation). Neither is required for resource import. If using `gatewayIpAddress`, Terraform must be able to make an HTTP (port 80) GET request to the specified IP address from where it is running.
+
+This argument supports the following arguments:
+
+* `gatewayName` - (Required) Name of the gateway.
+* `gatewayTimezone` - (Required) Time zone for the gateway. The time zone is of the format "GMT", "GMT-hr:mm", or "GMT+hr:mm". For example, `gmt4:00` indicates the time is 4 hours behind GMT. The time zone is used, for example, for scheduling snapshots and your gateway's maintenance schedule.
+* `activationKey` - (Optional) Gateway activation key during resource creation. Conflicts with `gatewayIpAddress`. Additional information is available in the [Storage Gateway User Guide](https://docs.aws.amazon.com/storagegateway/latest/userguide/get-activation-key.html).
+* `averageDownloadRateLimitInBitsPerSec` - (Optional) The average download bandwidth rate limit in bits per second. This is supported for the `cached`, `stored`, and `vtl` gateway types.
+* `averageUploadRateLimitInBitsPerSec` - (Optional) The average upload bandwidth rate limit in bits per second. This is supported for the `cached`, `stored`, and `vtl` gateway types.
+* `gatewayIpAddress` - (Optional) Gateway IP address to retrieve activation key during resource creation. Conflicts with `activationKey`. Gateway must be accessible on port 80 from where Terraform is running. Additional information is available in the [Storage Gateway User Guide](https://docs.aws.amazon.com/storagegateway/latest/userguide/get-activation-key.html).
+* `gatewayType` - (Optional) Type of the gateway. The default value is `stored`. Valid values: `cached`, `fileFsxSmb`, `fileS3`, `stored`, `vtl`.
+* `gatewayVpcEndpoint` - (Optional) VPC endpoint address to be used when activating your gateway. This should be used when your instance is in a private subnet. Requires HTTP access from client computer running terraform. More info on what ports are required by your VPC Endpoint Security group in [Activating a Gateway in a Virtual Private Cloud](https://docs.aws.amazon.com/storagegateway/latest/userguide/gateway-private-link.html).
+* `cloudwatchLogGroupArn` - (Optional) The Amazon Resource Name (ARN) of the Amazon CloudWatch log group to use to monitor and log events in the gateway.
+* `maintenanceStartTime` - (Optional) The gateway's weekly maintenance start time information, including day and time of the week. The maintenance time is the time in your gateway's time zone. More details below.
+* `mediumChangerType` - (Optional) Type of medium changer to use for tape gateway. Terraform cannot detect drift of this argument. Valid values: `stkL700`, `awsGatewayVtl`, `ibm03584L320402`.
+* `smbActiveDirectorySettings` - (Optional) Nested argument with Active Directory domain join information for Server Message Block (SMB) file shares. Only valid for `fileS3` and `fileFsxSmb` gateway types. Must be set before creating `activeDirectory` authentication SMB file shares. More details below.
+* `smbGuestPassword` - (Optional) Guest password for Server Message Block (SMB) file shares. Only valid for `fileS3` and `fileFsxSmb` gateway types. Must be set before creating `guestAccess` authentication SMB file shares. Terraform can only detect drift of the existence of a guest password, not its actual value from the gateway. Terraform can however update the password with changing the argument.
+* `smbSecurityStrategy` - (Optional) Specifies the type of security strategy. Valid values are: `clientSpecified`, `mandatorySigning`, and `mandatoryEncryption`. See [Setting a Security Level for Your Gateway](https://docs.aws.amazon.com/storagegateway/latest/userguide/managing-gateway-file.html#security-strategy) for more information.
+* `smbFileShareVisibility` - (Optional) Specifies whether the shares on this gateway appear when listing shares.
+* `tapeDriveType` - (Optional) Type of tape drive to use for tape gateway. Terraform cannot detect drift of this argument. Valid values: `ibmUlt3580Td5`.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### maintenance_start_time
+
+* `dayOfMonth` - (Optional) The day of the month component of the maintenance start time represented as an ordinal number from 1 to 28, where 1 represents the first day of the month and 28 represents the last day of the month.
+* `dayOfWeek` - (Optional) The day of the week component of the maintenance start time week represented as an ordinal number from 0 to 6, where 0 represents Sunday and 6 Saturday.
+* `hourOfDay` - (Required) The hour component of the maintenance start time represented as _hh_, where _hh_ is the hour (00 to 23). The hour of the day is in the time zone of the gateway.
+* `minuteOfHour` - (Required) The minute component of the maintenance start time represented as _mm_, where _mm_ is the minute (00 to 59). The minute of the hour is in the time zone of the gateway.
+
+### smb_active_directory_settings
+
+Information to join the gateway to an Active Directory domain for Server Message Block (SMB) file shares.
+
+~> **NOTE** It is not possible to unconfigure this setting without recreating the gateway. Also, Terraform can only detect drift of the `domainName` argument from the gateway.
+
+~> **NOTE:** The Storage Gateway needs to be able to resolve the name of your Active Directory Domain Controller. If the gateway is hosted on EC2, ensure that DNS/DHCP is configured prior to creating the EC2 instance. If you are receiving `networkError` errors during resource creation (gateway joining the domain), ensure your gateway instance meets the [FSx File Gateway requirements](https://docs.aws.amazon.com/filegateway/latest/filefsxw/Requirements.html).
+
+* `domainName` - (Required) The name of the domain that you want the gateway to join.
+* `password` - (Required) The password of the user who has permission to add the gateway to the Active Directory domain.
+* `username` - (Required) The user name of user who has permission to add the gateway to the Active Directory domain.
+* `timeoutInSeconds` - (Optional) Specifies the time in seconds, in which the JoinDomain operation must complete. The default is `20` seconds.
+* `organizationalUnit` - (Optional) The organizational unit (OU) is a container in an Active Directory that can hold users, groups,
+ computers, and other OUs and this parameter specifies the OU that the gateway will join within the AD domain.
+* `domainControllers` - (Optional) List of IPv4 addresses, NetBIOS names, or host names of your domain server.
+ If you need to specify the port number include it after the colon (“:”). For example, `mydcMydomainCom:389`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Amazon Resource Name (ARN) of the gateway.
+* `arn` - Amazon Resource Name (ARN) of the gateway.
+* `gatewayId` - Identifier of the gateway.
+* `ec2InstanceId` - The ID of the Amazon EC2 instance that was used to launch the gateway.
+* `endpointType` - The type of endpoint for your gateway.
+* `hostEnvironment` - The type of hypervisor environment used by the host.
+* `gatewayNetworkInterface` - An array that contains descriptions of the gateway network interfaces. See [Gateway Network Interface](#gateway-network-interface).
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+### Gateway Network Interface
+
+* `ipv4Address` - The Internet Protocol version 4 (IPv4) address of the interface.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `10M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsStoragegatewayGateway` using the gateway Amazon Resource Name (ARN). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsStoragegatewayGateway` using the gateway Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_storagegateway_gateway.example arn:aws:storagegateway:us-east-1:123456789012:gateway/sgw-12345678
+```
+
+Certain resource arguments, like `gatewayIpAddress` do not have a Storage Gateway API method for reading the information after creation, either omit the argument from the Terraform configuration or use [`ignoreChanges`](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html#ignore_changes) to hide the difference. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { StoragegatewayGateway } from "./.gen/providers/aws/storagegateway-gateway";
+interface MyConfig {
+  gatewayName: any;
+  gatewayTimezone: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new StoragegatewayGateway(this, "example", {
+      gatewayIpAddress: sgw.privateIp,
+      lifecycle: {
+        ignoreChanges: ["gateway_ip_address"],
+      },
+      gatewayName: config.gatewayName,
+      gatewayTimezone: config.gatewayTimezone,
+    });
+  }
+}
+
+```
+
+<!-- cache-key: cdktf-0.18.0 input-187ed7975b77b44dfe286243ecbc501bccd2e04c4172f96f87a4eb47a54fcf77 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/storagegateway_nfs_file_share.html.markdown b/website/docs/cdktf/typescript/r/storagegateway_nfs_file_share.html.markdown
new file mode 100644
index 00000000000..23c2c8c5c05
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/storagegateway_nfs_file_share.html.markdown
@@ -0,0 +1,120 @@
+---
+subcategory: "Storage Gateway"
+layout: "aws"
+page_title: "AWS: aws_storagegateway_nfs_file_share"
+description: |-
+  Manages an AWS Storage Gateway NFS File Share
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_storagegateway_nfs_file_share
+
+Manages an AWS Storage Gateway NFS File Share.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { StoragegatewayNfsFileShare } from "./.gen/providers/aws/storagegateway-nfs-file-share";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new StoragegatewayNfsFileShare(this, "example", {
+      clientList: ["0.0.0.0/0"],
+      gatewayArn: Token.asString(awsStoragegatewayGatewayExample.arn),
+      locationArn: Token.asString(awsS3BucketExample.arn),
+      roleArn: Token.asString(awsIamRoleExample.arn),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `clientList` - (Required) The list of clients that are allowed to access the file gateway. The list must contain either valid IP addresses or valid CIDR blocks. Set to `["0000/0"]` to not limit access. Minimum 1 item. Maximum 100 items.
+* `gatewayArn` - (Required) Amazon Resource Name (ARN) of the file gateway.
+* `locationArn` - (Required) The ARN of the backed storage used for storing file data.
+* `vpcEndpointDnsName` - (Optional) The DNS name of the VPC endpoint for S3 PrivateLink.
+* `bucketRegion` - (Optional) The region of the S3 bucket used by the file share. Required when specifying `vpcEndpointDnsName`.
+* `roleArn` - (Required) The ARN of the AWS Identity and Access Management (IAM) role that a file gateway assumes when it accesses the underlying storage.
+* `auditDestinationArn` - (Optional) The Amazon Resource Name (ARN) of the storage used for audit logs.
+* `defaultStorageClass` - (Optional) The default [storage class](https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_CreateNFSFileShare.html#StorageGateway-CreateNFSFileShare-request-DefaultStorageClass) for objects put into an Amazon S3 bucket by the file gateway. Defaults to `s3Standard`.
+* `guessMimeTypeEnabled` - (Optional) Boolean value that enables guessing of the MIME type for uploaded objects based on file extensions. Defaults to `true`.
+* `kmsEncrypted` - (Optional) Boolean value if `true` to use Amazon S3 server side encryption with your own AWS KMS key, or `false` to use a key managed by Amazon S3. Defaults to `false`.
+* `kmsKeyArn` - (Optional) Amazon Resource Name (ARN) for KMS key used for Amazon S3 server side encryption. This value can only be set when `kmsEncrypted` is true.
+* `nfsFileShareDefaults` - (Optional) Nested argument with file share default values. More information below. see [NFS File Share Defaults](#nfs_file_share_defaults) for more details.
+* `cacheAttributes` - (Optional) Refresh cache information. see [Cache Attributes](#cache_attributes) for more details.
+* `objectAcl` - (Optional) Access Control List permission for S3 objects. Defaults to `private`.
+* `readOnly` - (Optional) Boolean to indicate write status of file share. File share does not accept writes if `true`. Defaults to `false`.
+* `requesterPays` - (Optional) Boolean who pays the cost of the request and the data download from the Amazon S3 bucket. Set this value to `true` if you want the requester to pay instead of the bucket owner. Defaults to `false`.
+* `squash` - (Optional) Maps a user to anonymous user. Defaults to `rootSquash`. Valid values: `rootSquash` (only root is mapped to anonymous user), `noSquash` (no one is mapped to anonymous user), `allSquash` (everyone is mapped to anonymous user)
+* `fileShareName` - (Optional) The name of the file share. Must be set if an S3 prefix name is set in `locationArn`.
+* `notificationPolicy` - (Optional) The notification policy of the file share. For more information see the [AWS Documentation](https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_CreateNFSFileShare.html#StorageGateway-CreateNFSFileShare-request-NotificationPolicy). Default value is `{}`.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### nfs_file_share_defaults
+
+Files and folders stored as Amazon S3 objects in S3 buckets don't, by default, have Unix file permissions assigned to them. Upon discovery in an S3 bucket by Storage Gateway, the S3 objects that represent files and folders are assigned these default Unix permissions.
+
+* `directoryMode` - (Optional) The Unix directory mode in the string form "nnnn". Defaults to `"0777"`.
+* `fileMode` - (Optional) The Unix file mode in the string form "nnnn". Defaults to `"0666"`.
+* `groupId` - (Optional) The default group ID for the file share (unless the files have another group ID specified). Defaults to `65534` (`nfsnobody`). Valid values: `0` through `4294967294`.
+* `ownerId` - (Optional) The default owner ID for the file share (unless the files have another owner ID specified). Defaults to `65534` (`nfsnobody`). Valid values: `0` through `4294967294`.
+
+### cache_attributes
+
+* `cacheStaleTimeoutInSeconds` - (Optional) Refreshes a file share's cache by using Time To Live (TTL).
+ TTL is the length of time since the last refresh after which access to the directory would cause the file gateway
+  to first refresh that directory's contents from the Amazon S3 bucket. Valid Values: 300 to 2,592,000 seconds (5 minutes to 30 days)
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Amazon Resource Name (ARN) of the NFS File Share.
+* `arn` - Amazon Resource Name (ARN) of the NFS File Share.
+* `fileshareId` - ID of the NFS File Share.
+* `path` - File share path used by the NFS client to identify the mount point.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `10M`)
+* `update` - (Default `10M`)
+* `delete` - (Default `10M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsStoragegatewayNfsFileShare` using the NFS File Share Amazon Resource Name (ARN). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsStoragegatewayNfsFileShare` using the NFS File Share Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_storagegateway_nfs_file_share.example arn:aws:storagegateway:us-east-1:123456789012:share/share-12345678
+```
+
+<!-- cache-key: cdktf-0.18.0 input-37dcb9904d5b8589febdac999a43883747910390dad15f3d634a4d7806b3b88b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/storagegateway_smb_file_share.html.markdown b/website/docs/cdktf/typescript/r/storagegateway_smb_file_share.html.markdown
new file mode 100644
index 00000000000..709fc9331a9
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/storagegateway_smb_file_share.html.markdown
@@ -0,0 +1,147 @@
+---
+subcategory: "Storage Gateway"
+layout: "aws"
+page_title: "AWS: aws_storagegateway_smb_file_share"
+description: |-
+  Manages an AWS Storage Gateway SMB File Share
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_storagegateway_smb_file_share
+
+Manages an AWS Storage Gateway SMB File Share.
+
+## Example Usage
+
+### Active Directory Authentication
+
+~> **NOTE:** The gateway must have already joined the Active Directory domain prior to SMB file share creationE.g., via "SMB Settings" in the AWS Storage Gateway console or `smbActiveDirectorySettings` in the [`awsStoragegatewayGateway` resource](/docs/providers/aws/r/storagegateway_gateway.html).
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { StoragegatewaySmbFileShare } from "./.gen/providers/aws/storagegateway-smb-file-share";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new StoragegatewaySmbFileShare(this, "example", {
+      authentication: "ActiveDirectory",
+      gatewayArn: Token.asString(awsStoragegatewayGatewayExample.arn),
+      locationArn: Token.asString(awsS3BucketExample.arn),
+      roleArn: Token.asString(awsIamRoleExample.arn),
+    });
+  }
+}
+
+```
+
+### Guest Authentication
+
+~> **NOTE:** The gateway must have already had the SMB guest password set prior to SMB file share creationE.g., via "SMB Settings" in the AWS Storage Gateway console or `smbGuestPassword` in the [`awsStoragegatewayGateway` resource](/docs/providers/aws/r/storagegateway_gateway.html).
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { StoragegatewaySmbFileShare } from "./.gen/providers/aws/storagegateway-smb-file-share";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new StoragegatewaySmbFileShare(this, "example", {
+      authentication: "GuestAccess",
+      gatewayArn: Token.asString(awsStoragegatewayGatewayExample.arn),
+      locationArn: Token.asString(awsS3BucketExample.arn),
+      roleArn: Token.asString(awsIamRoleExample.arn),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `gatewayArn` - (Required) Amazon Resource Name (ARN) of the file gateway.
+* `locationArn` - (Required) The ARN of the backed storage used for storing file data.
+* `vpcEndpointDnsName` - (Optional) The DNS name of the VPC endpoint for S3 private link.
+* `bucketRegion` - (Optional) The region of the S3 buck used by the file share. Required when specifying a `vpcEndpointDnsName`.
+* `roleArn` - (Required) The ARN of the AWS Identity and Access Management (IAM) role that a file gateway assumes when it accesses the underlying storage.
+* `adminUserList` - (Optional) A list of users in the Active Directory that have admin access to the file share. Only valid if `authentication` is set to `activeDirectory`.
+* `authentication` - (Optional) The authentication method that users use to access the file share. Defaults to `activeDirectory`. Valid values: `activeDirectory`, `guestAccess`.
+* `auditDestinationArn` - (Optional) The Amazon Resource Name (ARN) of the CloudWatch Log Group used for the audit logs.
+* `defaultStorageClass` - (Optional) The default [storage class](https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_CreateNFSFileShare.html#StorageGateway-CreateNFSFileShare-request-DefaultStorageClass) for objects put into an Amazon S3 bucket by the file gateway. Defaults to `s3Standard`.
+* `fileShareName` - (Optional) The name of the file share. Must be set if an S3 prefix name is set in `locationArn`.
+* `guessMimeTypeEnabled` - (Optional) Boolean value that enables guessing of the MIME type for uploaded objects based on file extensions. Defaults to `true`.
+* `invalidUserList` - (Optional) A list of users in the Active Directory that are not allowed to access the file share. Only valid if `authentication` is set to `activeDirectory`.
+* `kmsEncrypted` - (Optional) Boolean value if `true` to use Amazon S3 server side encryption with your own AWS KMS key, or `false` to use a key managed by Amazon S3. Defaults to `false`.
+* `kmsKeyArn` - (Optional) Amazon Resource Name (ARN) for KMS key used for Amazon S3 server side encryption. This value can only be set when `kmsEncrypted` is true.
+* `objectAcl` - (Optional) Access Control List permission for S3 objects. Defaults to `private`.
+* `oplocksEnabled` - (Optional) Boolean to indicate Opportunistic lock (oplock) status. Defaults to `true`.
+* `cacheAttributes` - (Optional) Refresh cache information. see [Cache Attributes](#cache_attributes) for more details.
+* `readOnly` - (Optional) Boolean to indicate write status of file share. File share does not accept writes if `true`. Defaults to `false`.
+* `requesterPays` - (Optional) Boolean who pays the cost of the request and the data download from the Amazon S3 bucket. Set this value to `true` if you want the requester to pay instead of the bucket owner. Defaults to `false`.
+* `smbAclEnabled` - (Optional) Set this value to `true` to enable ACL (access control list) on the SMB fileshare. Set it to `false` to map file and directory permissions to the POSIX permissions. This setting applies only to `activeDirectory` authentication type.
+* `caseSensitivity` - (Optional) The case of an object name in an Amazon S3 bucket. For `clientSpecified`, the client determines the case sensitivity. For `caseSensitive`, the gateway determines the case sensitivity. The default value is `clientSpecified`.
+* `validUserList` - (Optional) A list of users in the Active Directory that are allowed to access the file share. If you need to specify an Active directory group, add '@' before the name of the group. It will be set on Allowed group in AWS console. Only valid if `authentication` is set to `activeDirectory`.
+* `accessBasedEnumeration` - (Optional) The files and folders on this share will only be visible to users with read access. Default value is `false`.
+* `notificationPolicy` - (Optional) The notification policy of the file share. For more information see the [AWS Documentation](https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_CreateNFSFileShare.html#StorageGateway-CreateNFSFileShare-request-NotificationPolicy). Default value is `{}`.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### cache_attributes
+
+* `cacheStaleTimeoutInSeconds` - (Optional) Refreshes a file share's cache by using Time To Live (TTL).
+ TTL is the length of time since the last refresh after which access to the directory would cause the file gateway
+  to first refresh that directory's contents from the Amazon S3 bucket. Valid Values: 300 to 2,592,000 seconds (5 minutes to 30 days)
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Amazon Resource Name (ARN) of the SMB File Share.
+* `arn` - Amazon Resource Name (ARN) of the SMB File Share.
+* `fileshareId` - ID of the SMB File Share.
+* `path` - File share path used by the NFS client to identify the mount point.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `10M`)
+* `update` - (Default `10M`)
+* `delete` - (Default `15M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsStoragegatewaySmbFileShare` using the SMB File Share Amazon Resource Name (ARN). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsStoragegatewaySmbFileShare` using the SMB File Share Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_storagegateway_smb_file_share.example arn:aws:storagegateway:us-east-1:123456789012:share/share-12345678
+```
+
+<!-- cache-key: cdktf-0.18.0 input-f3a37c6e0c1b6271a67b3fb55500798b56d200124be7a8d27c9e48b68c4fc362 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/storagegateway_stored_iscsi_volume.html.markdown b/website/docs/cdktf/typescript/r/storagegateway_stored_iscsi_volume.html.markdown
new file mode 100644
index 00000000000..fbb427330f8
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/storagegateway_stored_iscsi_volume.html.markdown
@@ -0,0 +1,126 @@
+---
+subcategory: "Storage Gateway"
+layout: "aws"
+page_title: "AWS: aws_storagegateway_stored_iscsi_volume"
+description: |-
+  Manages an AWS Storage Gateway stored iSCSI volume
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_storagegateway_stored_iscsi_volume
+
+Manages an AWS Storage Gateway stored iSCSI volume.
+
+~> **NOTE:** The gateway must have a working storage added (e.g., via the [`awsStoragegatewayWorkingStorage`](/docs/providers/aws/r/storagegateway_working_storage.html) resource) before the volume is operational to clients, however the Storage Gateway API will allow volume creation without error in that case and return volume status as `WORKING STORAGE NOT CONFIGURED`.
+
+## Example Usage
+
+### Create Empty Stored iSCSI Volume
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { StoragegatewayStoredIscsiVolume } from "./.gen/providers/aws/storagegateway-stored-iscsi-volume";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new StoragegatewayStoredIscsiVolume(this, "example", {
+      diskId: Token.asString(test.id),
+      gatewayArn: Token.asString(awsStoragegatewayCacheExample.gatewayArn),
+      networkInterfaceId: Token.asString(awsInstanceExample.privateIp),
+      preserveExistingData: false,
+      targetName: "example",
+    });
+  }
+}
+
+```
+
+### Create Stored iSCSI Volume From Snapshot
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { StoragegatewayStoredIscsiVolume } from "./.gen/providers/aws/storagegateway-stored-iscsi-volume";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new StoragegatewayStoredIscsiVolume(this, "example", {
+      diskId: Token.asString(test.id),
+      gatewayArn: Token.asString(awsStoragegatewayCacheExample.gatewayArn),
+      networkInterfaceId: Token.asString(awsInstanceExample.privateIp),
+      preserveExistingData: false,
+      snapshotId: Token.asString(awsEbsSnapshotExample.id),
+      targetName: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `gatewayArn` - (Required) The Amazon Resource Name (ARN) of the gateway.
+* `networkInterfaceId` - (Required) The network interface of the gateway on which to expose the iSCSI target. Only IPv4 addresses are accepted.
+* `targetName` - (Required) The name of the iSCSI target used by initiators to connect to the target and as a suffix for the target ARN. The target name must be unique across all volumes of a gateway.
+* `diskId` - (Required) The unique identifier for the gateway local disk that is configured as a stored volume.
+* `preserveExistingData` - (Required) Specify this field as `true` if you want to preserve the data on the local disk. Otherwise, specifying this field as false creates an empty volume.
+* `snapshotId` - (Optional) The snapshot ID of the snapshot to restore as the new stored volumeE.g., `snap1122Aabb`.
+* `kmsEncrypted` - (Optional) `true` to use Amazon S3 server side encryption with your own AWS KMS key, or `false` to use a key managed by Amazon S3. Optional.
+* `kmsKey` - (Optional) The Amazon Resource Name (ARN) of the AWS KMS key used for Amazon S3 server side encryption. This value can only be set when `kmsEncrypted` is `true`.
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Volume Amazon Resource Name (ARN), e.g., `arn:aws:storagegateway:usEast1:123456789012:gateway/sgw12345678/volume/vol12345678`.
+* `chapEnabled` - Whether mutual CHAP is enabled for the iSCSI target.
+* `id` - Volume Amazon Resource Name (ARN), e.g., `arn:aws:storagegateway:usEast1:123456789012:gateway/sgw12345678/volume/vol12345678`.
+* `lunNumber` - Logical disk number.
+* `networkInterfacePort` - The port used to communicate with iSCSI targets.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `targetArn` - Target Amazon Resource Name (ARN), e.g., `arn:aws:storagegateway:usEast1:123456789012:gateway/sgw12345678/target/iqn199705ComAmazon:targetName`.
+* `volumeArn` - Volume Amazon Resource Name (ARN), e.g., `arn:aws:storagegateway:usEast1:123456789012:gateway/sgw12345678/volume/vol12345678`.
+* `volumeId` - Volume ID, e.g., `vol12345678`.
+* `volumeStatus` - indicates the state of the storage volume.
+* `volumeType` - indicates the type of the volume.
+* `volumeSizeInBytes` - The size of the data stored on the volume in bytes.
+* `volumeAttachmentStatus` - A value that indicates whether a storage volume is attached to, detached from, or is in the process of detaching from a gateway.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsStoragegatewayStoredIscsiVolume` using the volume Amazon Resource Name (ARN). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsStoragegatewayStoredIscsiVolume` using the volume Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_storagegateway_stored_iscsi_volume.example arn:aws:storagegateway:us-east-1:123456789012:gateway/sgw-12345678/volume/vol-12345678
+```
+
+<!-- cache-key: cdktf-0.18.0 input-6fe2ebb39bb0b37be955143dd7b495f22fd2e46c96d511b682dd5411c04272ed -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/storagegateway_tape_pool.html.markdown b/website/docs/cdktf/typescript/r/storagegateway_tape_pool.html.markdown
new file mode 100644
index 00000000000..b8559f75fac
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/storagegateway_tape_pool.html.markdown
@@ -0,0 +1,77 @@
+---
+subcategory: "Storage Gateway"
+layout: "aws"
+page_title: "AWS: aws_storagegateway_tape_pool"
+description: |-
+  Manages an AWS Storage Gateway Tape Pool
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_storagegateway_tape_pool
+
+Manages an AWS Storage Gateway Tape Pool.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { StoragegatewayTapePool } from "./.gen/providers/aws/storagegateway-tape-pool";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new StoragegatewayTapePool(this, "example", {
+      poolName: "example",
+      storageClass: "GLACIER",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `poolName` - (Required) The name of the new custom tape pool.
+* `storageClass` - (Required) The storage class that is associated with the new custom pool. When you use your backup application to eject the tape, the tape is archived directly into the storage class that corresponds to the pool. Possible values are `deepArchive` or `glacier`.
+* `retentionLockType` - (Required) Tape retention lock can be configured in two modes. When configured in governance mode, AWS accounts with specific IAM permissions are authorized to remove the tape retention lock from archived virtual tapes. When configured in compliance mode, the tape retention lock cannot be removed by any user, including the root AWS account. Possible values are `compliance`, `governance`, and `none`. Default value is `none`.
+* `retentionLockTimeInDays` - (Optional) Tape retention lock time is set in days. Tape retention lock can be enabled for up to 100 years (36,500 days). Default value is 0.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Volume Amazon Resource Name (ARN), e.g., `aws_storagegateway_tape_pool.example arn:aws:storagegateway:us-east-1:123456789012:tapepool/pool-12345678`.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsStoragegatewayTapePool` using the volume Amazon Resource Name (ARN). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsStoragegatewayTapePool` using the volume Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_storagegateway_tape_pool.example arn:aws:storagegateway:us-east-1:123456789012:tapepool/pool-12345678
+```
+
+<!-- cache-key: cdktf-0.18.0 input-dba7df3eb905d7a9811189b7532fba2b7eb6c8127d9f909ad0446160863c1c13 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/storagegateway_upload_buffer.html.markdown b/website/docs/cdktf/typescript/r/storagegateway_upload_buffer.html.markdown
new file mode 100644
index 00000000000..7d35074a68a
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/storagegateway_upload_buffer.html.markdown
@@ -0,0 +1,117 @@
+---
+subcategory: "Storage Gateway"
+layout: "aws"
+page_title: "AWS: aws_storagegateway_upload_buffer"
+description: |-
+  Manages an AWS Storage Gateway upload buffer
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_storagegateway_upload_buffer
+
+Manages an AWS Storage Gateway upload buffer.
+
+~> **NOTE:** The Storage Gateway API provides no method to remove an upload buffer disk. Destroying this Terraform resource does not perform any Storage Gateway actions.
+
+## Example Usage
+
+### Cached and VTL Gateway Type
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsStoragegatewayLocalDisk } from "./.gen/providers/aws/data-aws-storagegateway-local-disk";
+import { StoragegatewayUploadBuffer } from "./.gen/providers/aws/storagegateway-upload-buffer";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const test = new DataAwsStoragegatewayLocalDisk(this, "test", {
+      diskNode: Token.asString(awsVolumeAttachmentTest.deviceName),
+      gatewayArn: Token.asString(awsStoragegatewayGatewayTest.arn),
+    });
+    const awsStoragegatewayUploadBufferTest = new StoragegatewayUploadBuffer(
+      this,
+      "test_1",
+      {
+        diskPath: Token.asString(test.diskPath),
+        gatewayArn: Token.asString(awsStoragegatewayGatewayTest.arn),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsStoragegatewayUploadBufferTest.overrideLogicalId("test");
+  }
+}
+
+```
+
+### Stored Gateway Type
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsStoragegatewayLocalDisk } from "./.gen/providers/aws/data-aws-storagegateway-local-disk";
+import { StoragegatewayUploadBuffer } from "./.gen/providers/aws/storagegateway-upload-buffer";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new StoragegatewayUploadBuffer(this, "example", {
+      diskId: Token.asString(dataAwsStoragegatewayLocalDiskExample.id),
+      gatewayArn: Token.asString(awsStoragegatewayGatewayExample.arn),
+    });
+    new DataAwsStoragegatewayLocalDisk(this, "test", {
+      diskNode: Token.asString(awsVolumeAttachmentTest.deviceName),
+      gatewayArn: Token.asString(awsStoragegatewayGatewayTest.arn),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `diskId` - (Optional) Local disk identifier. For example, `pci0000:03:000Scsi0:0:0:0`.
+* `diskPath` - (Optional) Local disk path. For example, `/dev/nvme1N1`.
+* `gatewayArn` - (Required) The Amazon Resource Name (ARN) of the gateway.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Combined gateway Amazon Resource Name (ARN) and local disk identifier.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsStoragegatewayUploadBuffer` using the gateway Amazon Resource Name (ARN) and local disk identifier separated with a colon (`:`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsStoragegatewayUploadBuffer` using the gateway Amazon Resource Name (ARN) and local disk identifier separated with a colon (`:`). For example:
+
+```console
+% terraform import aws_storagegateway_upload_buffer.example arn:aws:storagegateway:us-east-1:123456789012:gateway/sgw-12345678:pci-0000:03:00.0-scsi-0:0:0:0
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ae944e6e1a1a59199a21cc4f4ff9f7913523ee122e7485caccc7b645c0699488 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/storagegateway_working_storage.html.markdown b/website/docs/cdktf/typescript/r/storagegateway_working_storage.html.markdown
new file mode 100644
index 00000000000..6d528a8ae2c
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/storagegateway_working_storage.html.markdown
@@ -0,0 +1,75 @@
+---
+subcategory: "Storage Gateway"
+layout: "aws"
+page_title: "AWS: aws_storagegateway_working_storage"
+description: |-
+  Manages an AWS Storage Gateway working storage
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_storagegateway_working_storage
+
+Manages an AWS Storage Gateway working storage.
+
+~> **NOTE:** The Storage Gateway API provides no method to remove a working storage disk. Destroying this Terraform resource does not perform any Storage Gateway actions.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { StoragegatewayWorkingStorage } from "./.gen/providers/aws/storagegateway-working-storage";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new StoragegatewayWorkingStorage(this, "example", {
+      diskId: Token.asString(dataAwsStoragegatewayLocalDiskExample.id),
+      gatewayArn: Token.asString(awsStoragegatewayGatewayExample.arn),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `diskId` - (Required) Local disk identifier. For example, `pci0000:03:000Scsi0:0:0:0`.
+* `gatewayArn` - (Required) The Amazon Resource Name (ARN) of the gateway.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Combined gateway Amazon Resource Name (ARN) and local disk identifier.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsStoragegatewayWorkingStorage` using the gateway Amazon Resource Name (ARN) and local disk identifier separated with a colon (`:`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsStoragegatewayWorkingStorage` using the gateway Amazon Resource Name (ARN) and local disk identifier separated with a colon (`:`). For example:
+
+```console
+% terraform import aws_storagegateway_working_storage.example arn:aws:storagegateway:us-east-1:123456789012:gateway/sgw-12345678:pci-0000:03:00.0-scsi-0:0:0:0
+```
+
+<!-- cache-key: cdktf-0.18.0 input-70cd2153af665dbf7aff736700a2d421553e7a7e40d49fdf71a96c7ff2a5aa9d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/subnet.html.markdown b/website/docs/cdktf/typescript/r/subnet.html.markdown
new file mode 100644
index 00000000000..7fff6ce93c8
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/subnet.html.markdown
@@ -0,0 +1,146 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_subnet"
+description: |-
+  Provides an VPC subnet resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_subnet
+
+Provides an VPC subnet resource.
+
+~> **NOTE:** Due to [AWS Lambda improved VPC networking changes that began deploying in September 2019](https://aws.amazon.com/blogs/compute/announcing-improved-vpc-networking-for-aws-lambda-functions/), subnets associated with Lambda Functions can take up to 45 minutes to successfully delete. Terraform AWS Provider version 2.31.0 and later automatically handles this increased timeout, however prior versions require setting the [customizable deletion timeout](#timeouts) to 45 minutes (`delete = "45m"`). AWS and HashiCorp are working together to reduce the amount of time required for resource deletion and updates can be tracked in this [GitHub issue](https://github.com/hashicorp/terraform-provider-aws/issues/10329).
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Subnet } from "./.gen/providers/aws/subnet";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Subnet(this, "main", {
+      cidrBlock: "10.0.1.0/24",
+      tags: {
+        Name: "Main",
+      },
+      vpcId: Token.asString(awsVpcMain.id),
+    });
+  }
+}
+
+```
+
+### Subnets In Secondary VPC CIDR Blocks
+
+When managing subnets in one of a VPC's secondary CIDR blocks created using a [`awsVpcIpv4CidrBlockAssociation`](vpc_ipv4_cidr_block_association.html)
+resource, it is recommended to reference that resource's `vpcId` attribute to ensure correct dependency ordering.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Subnet } from "./.gen/providers/aws/subnet";
+import { VpcIpv4CidrBlockAssociation } from "./.gen/providers/aws/vpc-ipv4-cidr-block-association";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const secondaryCidr = new VpcIpv4CidrBlockAssociation(
+      this,
+      "secondary_cidr",
+      {
+        cidrBlock: "172.20.0.0/16",
+        vpcId: main.id,
+      }
+    );
+    new Subnet(this, "in_secondary_cidr", {
+      cidrBlock: "172.20.0.0/24",
+      vpcId: secondaryCidr.vpcId,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `assignIpv6AddressOnCreation` - (Optional) Specify true to indicate
+    that network interfaces created in the specified subnet should be
+    assigned an IPv6 address. Default is `false`
+* `availabilityZone` - (Optional) AZ for the subnet.
+* `availabilityZoneId` - (Optional) AZ ID of the subnet. This argument is not supported in all regions or partitions. If necessary, use `availabilityZone` instead.
+* `cidrBlock` - (Optional) The IPv4 CIDR block for the subnet.
+* `customerOwnedIpv4Pool` - (Optional) The customer owned IPv4 address pool. Typically used with the `mapCustomerOwnedIpOnLaunch` argument. The `outpostArn` argument must be specified when configured.
+* `enableDns64` - (Optional) Indicates whether DNS queries made to the Amazon-provided DNS Resolver in this subnet should return synthetic IPv6 addresses for IPv4-only destinations. Default: `false`.
+* `enableLniAtDeviceIndex` - (Optional) Indicates the device position for local network interfaces in this subnet. For example, 1 indicates local network interfaces in this subnet are the secondary network interface (eth1). A local network interface cannot be the primary network interface (eth0).
+* `enableResourceNameDnsAaaaRecordOnLaunch` - (Optional) Indicates whether to respond to DNS queries for instance hostnames with DNS AAAA records. Default: `false`.
+* `enableResourceNameDnsARecordOnLaunch` - (Optional) Indicates whether to respond to DNS queries for instance hostnames with DNS A records. Default: `false`.
+* `ipv6CidrBlock` - (Optional) The IPv6 network range for the subnet,
+    in CIDR notation. The subnet size must use a /64 prefix length.
+* `ipv6Native` - (Optional) Indicates whether to create an IPv6-only subnet. Default: `false`.
+* `mapCustomerOwnedIpOnLaunch` -  (Optional) Specify `true` to indicate that network interfaces created in the subnet should be assigned a customer owned IP address. The `customerOwnedIpv4Pool` and `outpostArn` arguments must be specified when set to `true`. Default is `false`.
+* `mapPublicIpOnLaunch` -  (Optional) Specify true to indicate
+    that instances launched into the subnet should be assigned
+    a public IP address. Default is `false`.
+* `outpostArn` - (Optional) The Amazon Resource Name (ARN) of the Outpost.
+* `privateDnsHostnameTypeOnLaunch` - (Optional) The type of hostnames to assign to instances in the subnet at launch. For IPv6-only subnets, an instance DNS name must be based on the instance ID. For dual-stack and IPv4-only subnets, you can specify whether DNS names use the instance IPv4 address or the instance ID. Valid values: `ipName`, `resourceName`.
+* `vpcId` - (Required) The VPC ID.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the subnet
+* `arn` - The ARN of the subnet.
+* `ipv6CidrBlockAssociationId` - The association ID for the IPv6 CIDR block.
+* `ownerId` - The ID of the AWS account that owns the subnet.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `10M`)
+- `delete` - (Default `20M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import subnets using the subnet `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import subnets using the subnet `id`. For example:
+
+```console
+% terraform import aws_subnet.public_subnet subnet-9d4a7b6c
+```
+
+<!-- cache-key: cdktf-0.18.0 input-800b4894a44d3fb10c7ed4e02828a98cc6bb1ba25ee4607e803d5cddf8afc2ed -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/swf_domain.html.markdown b/website/docs/cdktf/typescript/r/swf_domain.html.markdown
new file mode 100644
index 00000000000..2ce2f46be26
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/swf_domain.html.markdown
@@ -0,0 +1,81 @@
+---
+subcategory: "SWF (Simple Workflow)"
+layout: "aws"
+page_title: "AWS: aws_swf_domain"
+description: |-
+  Provides an SWF Domain resource
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_swf_domain
+
+Provides an SWF Domain resource.
+
+## Example Usage
+
+To register a basic SWF domain:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SwfDomain } from "./.gen/providers/aws/swf-domain";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SwfDomain(this, "foo", {
+      description: "Terraform SWF Domain",
+      name: "foo",
+      workflowExecutionRetentionPeriodInDays: Token.asString(30),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Optional, Forces new resource) The name of the domain. If omitted, Terraform will assign a random, unique name.
+* `namePrefix` - (Optional, Forces new resource) Creates a unique name beginning with the specified prefix. Conflicts with `name`.
+* `description` - (Optional, Forces new resource) The domain description.
+* `workflowExecutionRetentionPeriodInDays` - (Required, Forces new resource) Length of time that SWF will continue to retain information about the workflow execution after the workflow execution is complete, must be between 0 and 90 days.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name of the domain.
+* `arn` - Amazon Resource Name (ARN)
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SWF Domains using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import SWF Domains using the `name`. For example:
+
+```console
+% terraform import aws_swf_domain.foo test-domain
+```
+
+<!-- cache-key: cdktf-0.18.0 input-54abbc51f16eec052393c1102198887c7a517cee82c16898c2f3b8d0f149a603 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/synthetics_canary.html.markdown b/website/docs/cdktf/typescript/r/synthetics_canary.html.markdown
new file mode 100644
index 00000000000..a02e499bfcd
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/synthetics_canary.html.markdown
@@ -0,0 +1,146 @@
+---
+subcategory: "CloudWatch Synthetics"
+layout: "aws"
+page_title: "AWS: aws_synthetics_canary"
+description: |-
+  Provides a Synthetics Canary resource
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_synthetics_canary
+
+Provides a Synthetics Canary resource.
+
+~> **NOTE:** When you create a canary, AWS creates supporting implicit resources. See the Amazon CloudWatch Synthetics documentation on [DeleteCanary](https://docs.aws.amazon.com/AmazonSynthetics/latest/APIReference/API_DeleteCanary.html) for a full list. Neither AWS nor Terraform deletes these implicit resources automatically when the canary is deleted. Before deleting a canary, ensure you have all the information about the canary that you need to delete the implicit resources using Terraform shell commands, the AWS Console, or AWS CLI.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SyntheticsCanary } from "./.gen/providers/aws/synthetics-canary";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SyntheticsCanary(this, "some", {
+      artifactS3Location: "s3://some-bucket/",
+      executionRoleArn: "some-role",
+      handler: "exports.handler",
+      name: "some-canary",
+      runtimeVersion: "syn-1.0",
+      schedule: {
+        expression: "rate(0 minute)",
+      },
+      zipFile: "test-fixtures/lambdatest.zip",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `artifactS3Location` - (Required) Location in Amazon S3 where Synthetics stores artifacts from the test runs of this canary.
+* `executionRoleArn` - (Required) ARN of the IAM role to be used to run the canary. see [AWS Docs](https://docs.aws.amazon.com/AmazonSynthetics/latest/APIReference/API_CreateCanary.html#API_CreateCanary_RequestSyntax) for permissions needs for IAM Role.
+* `handler` - (Required) Entry point to use for the source code when running the canary. This value must end with the string `handler` .
+* `name` - (Required) Name for this canary. Has a maximum length of 21 characters. Valid characters are lowercase alphanumeric, hyphen, or underscore.
+* `runtimeVersion` - (Required) Runtime version to use for the canary. Versions change often so consult the [Amazon CloudWatch documentation](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch_Synthetics_Canaries_Library.html) for the latest valid versions. Values include `synPythonSelenium10`, `synNodejsPuppeteer30`, `synNodejs22`, `synNodejs21`, `synNodejs20`, and `syn10`.
+* `schedule` -  (Required) Configuration block providing how often the canary is to run and when these test runs are to stop. Detailed below.
+
+The following arguments are optional:
+
+* `deleteLambda` - (Optional)  Specifies whether to also delete the Lambda functions and layers used by this canary. The default is `false`.
+* `vpcConfig` - (Optional) Configuration block. Detailed below.
+* `failureRetentionPeriod` - (Optional) Number of days to retain data about failed runs of this canary. If you omit this field, the default of 31 days is used. The valid range is 1 to 455 days.
+* `runConfig` - (Optional) Configuration block for individual canary runs. Detailed below.
+* `s3Bucket` - (Optional) Full bucket name which is used if your canary script is located in S3. The bucket must already exist. **Conflicts with `zipFile`.**
+* `s3Key` - (Optional) S3 key of your script. **Conflicts with `zipFile`.**
+* `s3Version` - (Optional) S3 version ID of your script. **Conflicts with `zipFile`.**
+* `startCanary` - (Optional) Whether to run or stop the canary.
+* `successRetentionPeriod` - (Optional) Number of days to retain data about successful runs of this canary. If you omit this field, the default of 31 days is used. The valid range is 1 to 455 days.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `artifactConfig` - (Optional) configuration for canary artifacts, including the encryption-at-rest settings for artifacts that the canary uploads to Amazon S3. See [Artifact Config](#artifact_config).
+* `zipFile` - (Optional) ZIP file that contains the script, if you input your canary script directly into the canary instead of referring to an S3 location. It can be up to 225KB. **Conflicts with `s3Bucket`, `s3Key`, and `s3Version`.**
+
+### artifact_config
+
+* `s3Encryption` - (Optional) Configuration of the encryption-at-rest settings for artifacts that the canary uploads to Amazon S3. See [S3 Encryption](#s3_encryption).
+
+### s3_encryption
+
+* `encryptionMode` - (Optional) The encryption method to use for artifacts created by this canary. Valid values are: `sseS3` and `sseKms`.
+* `kmsKeyArn` - (Optional) The ARN of the customer-managed KMS key to use, if you specify `sseKms` for `encryptionMode`.
+
+### schedule
+
+* `expression` - (Required) Rate expression or cron expression that defines how often the canary is to run. For rate expression, the syntax is `rate(number unit)`. _unit_ can be `minute`, `minutes`, or `hour`. For cron expression, the syntax is `cron(expression)`. For more information about the syntax for cron expressions, see [Scheduling canary runs using cron](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch_Synthetics_Canaries_cron.html).
+* `durationInSeconds` - (Optional) Duration in seconds, for the canary to continue making regular runs according to the schedule in the Expression value.
+
+### run_config
+
+* `timeoutInSeconds` - (Optional) Number of seconds the canary is allowed to run before it must stop. If you omit this field, the frequency of the canary is used, up to a maximum of 840 (14 minutes).
+* `memoryInMb` - (Optional) Maximum amount of memory available to the canary while it is running, in MB. The value you specify must be a multiple of 64.
+* `activeTracing` - (Optional) Whether this canary is to use active AWS X-Ray tracing when it runs. You can enable active tracing only for canaries that use version syn-nodejs-2.0 or later for their canary runtime.
+* `environmentVariables` - (Optional) Map of environment variables that are accessible from the canary during execution. Please see [AWS Docs](https://docs.aws.amazon.com/lambda/latest/dg/configuration-envvars.html#configuration-envvars-runtime) for variables reserved for Lambda.
+
+### vpc_config
+
+If this canary tests an endpoint in a VPC, this structure contains information about the subnet and security groups of the VPC endpoint. For more information, see [Running a Canary in a VPC](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch_Synthetics_Canaries_VPC.html).
+
+* `subnetIds` - (Required) IDs of the subnets where this canary is to run.
+* `securityGroupIds` - (Required) IDs of the security groups for this canary.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the Canary.
+* `engineArn` - ARN of the Lambda function that is used as your canary's engine.
+* `id` - Name for this canary.
+* `sourceLocationArn` - ARN of the Lambda layer where Synthetics stores the canary script code.
+* `status` - Canary status.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `timeline` - Structure that contains information about when the canary was created, modified, and most recently run. see [Timeline](#timeline).
+
+### vpc_config
+
+* `vpcId` - ID of the VPC where this canary is to run.
+
+### timeline
+
+* `created` - Date and time the canary was created.
+* `lastModified` - Date and time the canary was most recently modified.
+* `lastStarted` - Date and time that the canary's most recent run started.
+* `lastStopped` - Date and time that the canary's most recent run ended.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Synthetics Canaries using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Synthetics Canaries using the `name`. For example:
+
+```console
+% terraform import aws_synthetics_canary.some some-canary
+```
+
+<!-- cache-key: cdktf-0.18.0 input-7a9e3e1413440a0151e0d113031ae787861be1f778da70a162639b9434cfd1fb -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/synthetics_group.html.markdown b/website/docs/cdktf/typescript/r/synthetics_group.html.markdown
new file mode 100644
index 00000000000..71bdb7f31f8
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/synthetics_group.html.markdown
@@ -0,0 +1,79 @@
+---
+subcategory: "CloudWatch Synthetics"
+layout: "aws"
+page_title: "AWS: aws_synthetics_group"
+description: |-
+  Provides a Synthetics Group resource
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_synthetics_group
+
+Provides a Synthetics Group resource.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SyntheticsGroup } from "./.gen/providers/aws/synthetics-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SyntheticsGroup(this, "example", {
+      name: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) Name of the group.
+
+The following arguments are optional:
+
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`defaultTags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Group.
+* `groupId` - ID of the Group.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudWatch Synthetics Group using the `name`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import CloudWatch Synthetics Group using the `name`. For example:
+
+```console
+% terraform import aws_synthetics_group.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-a60f694e7f99a87c98a47c4127d04528abd45230d213848a0dd79453012e6e75 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/synthetics_group_association.html.markdown b/website/docs/cdktf/typescript/r/synthetics_group_association.html.markdown
new file mode 100644
index 00000000000..d96a92cd44e
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/synthetics_group_association.html.markdown
@@ -0,0 +1,76 @@
+---
+subcategory: "CloudWatch Synthetics"
+layout: "aws"
+page_title: "AWS: aws_synthetics_group_association"
+description: |-
+  Provides a Synthetics Group Association resource
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_synthetics_group_association
+
+Provides a Synthetics Group Association resource.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { SyntheticsGroupAssociation } from "./.gen/providers/aws/synthetics-group-association";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new SyntheticsGroupAssociation(this, "example", {
+      canaryArn: Token.asString(awsSyntheticsCanaryExample.arn),
+      groupName: Token.asString(awsSyntheticsGroupExample.name),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `groupName` - (Required) Name of the group that the canary will be associated with.
+* `canaryArn` - (Required) ARN of the canary.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `groupName` - Name of the Group.
+* `groupId` - ID of the Group.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudWatch Synthetics Group Association using the `canaryArn,groupName`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import CloudWatch Synthetics Group Association using the `canaryArn,groupName`. For example:
+
+```console
+% terraform import aws_synthetics_group_association.example arn:aws:synthetics:us-west-2:123456789012:canary:tf-acc-test-abcd1234,examplename
+```
+
+<!-- cache-key: cdktf-0.18.0 input-586109c93710a862721820ba7c1a1a3dc69aaa17f27c7d2609f2031c6672b318 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/timestreamwrite_database.html.markdown b/website/docs/cdktf/typescript/r/timestreamwrite_database.html.markdown
new file mode 100644
index 00000000000..afc90a51faf
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/timestreamwrite_database.html.markdown
@@ -0,0 +1,105 @@
+---
+subcategory: "Timestream Write"
+layout: "aws"
+page_title: "AWS: aws_timestreamwrite_database"
+description: |-
+  Provides a Timestream database resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_timestreamwrite_database
+
+Provides a Timestream database resource.
+
+## Example Usage
+
+### Basic usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { TimestreamwriteDatabase } from "./.gen/providers/aws/timestreamwrite-database";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new TimestreamwriteDatabase(this, "example", {
+      databaseName: "database-example",
+    });
+  }
+}
+
+```
+
+### Full usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { TimestreamwriteDatabase } from "./.gen/providers/aws/timestreamwrite-database";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new TimestreamwriteDatabase(this, "example", {
+      databaseName: "database-example",
+      kmsKeyId: Token.asString(awsKmsKeyExample.arn),
+      tags: {
+        Name: "value",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `databaseName` – (Required) The name of the Timestream database. Minimum length of 3. Maximum length of 64.
+* `kmsKeyId` - (Optional) The ARN (not Alias ARN) of the KMS key to be used to encrypt the data stored in the database. If the KMS key is not specified, the database will be encrypted with a Timestream managed KMS key located in your account. Refer to [AWS managed KMS keys](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk) for more info.
+* `tags` - (Optional) Map of tags to assign to this resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name of the Timestream database.
+* `arn` - The ARN that uniquely identifies this database.
+* `kmsKeyId` - The ARN of the KMS key used to encrypt the data stored in the database.
+* `tableCount` - The total number of tables found within the Timestream database.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Timestream databases using the `databaseName`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Timestream databases using the `databaseName`. For example:
+
+```console
+% terraform import aws_timestreamwrite_database.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-f9e466cc597e77e2955216c4193bd02e93e398df89c5fb4b6c43b2048b014651 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/timestreamwrite_table.html.markdown b/website/docs/cdktf/typescript/r/timestreamwrite_table.html.markdown
new file mode 100644
index 00000000000..a5a6ca0652d
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/timestreamwrite_table.html.markdown
@@ -0,0 +1,190 @@
+---
+subcategory: "Timestream Write"
+layout: "aws"
+page_title: "AWS: aws_timestreamwrite_table"
+description: |-
+  Provides a Timestream table resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_timestreamwrite_table
+
+Provides a Timestream table resource.
+
+## Example Usage
+
+### Basic usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { TimestreamwriteTable } from "./.gen/providers/aws/timestreamwrite-table";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new TimestreamwriteTable(this, "example", {
+      databaseName: Token.asString(
+        awsTimestreamwriteDatabaseExample.databaseName
+      ),
+      tableName: "example",
+    });
+  }
+}
+
+```
+
+### Full usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { TimestreamwriteTable } from "./.gen/providers/aws/timestreamwrite-table";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new TimestreamwriteTable(this, "example", {
+      databaseName: Token.asString(
+        awsTimestreamwriteDatabaseExample.databaseName
+      ),
+      retentionProperties: {
+        magneticStoreRetentionPeriodInDays: 30,
+        memoryStoreRetentionPeriodInHours: 8,
+      },
+      tableName: "example",
+      tags: {
+        Name: "example-timestream-table",
+      },
+    });
+  }
+}
+
+```
+
+### Customer-defined Partition Key
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { TimestreamwriteTable } from "./.gen/providers/aws/timestreamwrite-table";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new TimestreamwriteTable(this, "example", {
+      databaseName: Token.asString(
+        awsTimestreamwriteDatabaseExample.databaseName
+      ),
+      schema: {
+        compositePartitionKey: {
+          enforcementInRecord: "REQUIRED",
+          name: "attr1",
+          type: "DIMENSION",
+        },
+      },
+      tableName: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `databaseName` – (Required) The name of the Timestream database.
+* `magneticStoreWriteProperties` - (Optional) Contains properties to set on the table when enabling magnetic store writes. See [Magnetic Store Write Properties](#magnetic-store-write-properties) below for more details.
+* `retentionProperties` - (Optional) The retention duration for the memory store and magnetic store. See [Retention Properties](#retention-properties) below for more details. If not provided, `magneticStoreRetentionPeriodInDays` default to 73000 and `memoryStoreRetentionPeriodInHours` defaults to 6.
+* `schema` - (Optional) The schema of the table. See [Schema](#schema) below for more details.
+* `tableName` - (Required) The name of the Timestream table.
+* `tags` - (Optional) Map of tags to assign to this resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Magnetic Store Write Properties
+
+The `magneticStoreWriteProperties` block supports the following arguments:
+
+* `enableMagneticStoreWrites` - (Required) A flag to enable magnetic store writes.
+* `magneticStoreRejectedDataLocation` - (Optional) The location to write error reports for records rejected asynchronously during magnetic store writes. See [Magnetic Store Rejected Data Location](#magnetic-store-rejected-data-location) below for more details.
+
+#### Magnetic Store Rejected Data Location
+
+The `magneticStoreRejectedDataLocation` block supports the following arguments:
+
+* `s3Configuration` - (Optional) Configuration of an S3 location to write error reports for records rejected, asynchronously, during magnetic store writes. See [S3 Configuration](#s3-configuration) below for more details.
+
+##### S3 Configuration
+
+The `s3Configuration` block supports the following arguments:
+
+* `bucketName` - (Optional) Bucket name of the customer S3 bucket.
+* `encryptionOption` - (Optional) Encryption option for the customer s3 location. Options are S3 server side encryption with an S3-managed key or KMS managed key. Valid values are `sseKms` and `sseS3`.
+* `kmsKeyId` - (Optional) KMS key arn for the customer s3 location when encrypting with a KMS managed key.
+* `objectKeyPrefix` - (Optional) Object key prefix for the customer S3 location.
+
+### Retention Properties
+
+The `retentionProperties` block supports the following arguments:
+
+* `magneticStoreRetentionPeriodInDays` - (Required) The duration for which data must be stored in the magnetic store. Minimum value of 1. Maximum value of 73000.
+* `memoryStoreRetentionPeriodInHours` - (Required) The duration for which data must be stored in the memory store. Minimum value of 1. Maximum value of 8766.
+
+### Schema
+
+The `schema` block supports the following arguments:
+
+* `compositePartitionKey` - (Required) A non-empty list of partition keys defining the attributes used to partition the table data. The order of the list determines the partition hierarchy. The name and type of each partition key as well as the partition key order cannot be changed after the table is created. However, the enforcement level of each partition key can be changed. See [Composite Partition Key](#composite-partition-key) below for more details.
+
+### Composite Partition Key
+
+The `compositePartitionKey` block supports the following arguments:
+
+* `enforcementInRecord` - (Optional) The level of enforcement for the specification of a dimension key in ingested records. Valid values: `required`, `optional`.
+* `name` - (Optional) The name of the attribute used for a dimension key.
+* `type` - (Required) The type of the partition key. Valid values: `dimension`, `measure`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The `tableName` and `databaseName` separated by a colon (`:`).
+* `arn` - The ARN that uniquely identifies this table.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Timestream tables using the `tableName` and `databaseName` separate by a colon (`:`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Timestream tables using the `tableName` and `databaseName` separate by a colon (`:`). For example:
+
+```console
+% terraform import aws_timestreamwrite_table.example ExampleTable:ExampleDatabase
+```
+
+<!-- cache-key: cdktf-0.18.0 input-f3b0a12c378c166ac42527e7ddfa6ae43b71b326a2b2a3f2abcf892be6820171 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/transcribe_language_model.html.markdown b/website/docs/cdktf/typescript/r/transcribe_language_model.html.markdown
new file mode 100644
index 00000000000..30149f1e611
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/transcribe_language_model.html.markdown
@@ -0,0 +1,165 @@
+---
+subcategory: "Transcribe"
+layout: "aws"
+page_title: "AWS: aws_transcribe_language_model"
+description: |-
+  Terraform resource for managing an AWS Transcribe LanguageModel.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_transcribe_language_model
+
+Terraform resource for managing an AWS Transcribe LanguageModel.
+
+-> This resource can take a significant amount of time to provision. See Language Model [FAQ](https://aws.amazon.com/transcribe/faqs/) for more details.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, Fn, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+import { IamRolePolicy } from "./.gen/providers/aws/iam-role-policy";
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3Object } from "./.gen/providers/aws/s3-object";
+import { TranscribeLanguageModel } from "./.gen/providers/aws/transcribe-language-model";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new S3Bucket(this, "example", {
+      bucket: "example-transcribe",
+      forceDestroy: true,
+    });
+    new S3Object(this, "object", {
+      bucket: example.id,
+      key: "transcribe/test1.txt",
+      source: "test1.txt",
+    });
+    const dataAwsIamPolicyDocumentExample = new DataAwsIamPolicyDocument(
+      this,
+      "example_2",
+      {
+        statement: [
+          {
+            actions: ["sts:AssumeRole"],
+            principals: [
+              {
+                identifiers: ["transcribe.amazonaws.com"],
+                type: "Service",
+              },
+            ],
+          },
+        ],
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsIamPolicyDocumentExample.overrideLogicalId("example");
+    const awsIamRoleExample = new IamRole(this, "example_3", {
+      assumeRolePolicy: Token.asString(dataAwsIamPolicyDocumentExample.json),
+      name: "example",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamRoleExample.overrideLogicalId("example");
+    new IamRolePolicy(this, "test_policy", {
+      name: "example",
+      policy: Token.asString(
+        Fn.jsonencode({
+          Statement: [
+            {
+              Action: ["s3:GetObject", "s3:ListBucket"],
+              Effect: "Allow",
+              Resource: ["*"],
+            },
+          ],
+          Version: "2012-10-17",
+        })
+      ),
+      role: Token.asString(awsIamRoleExample.id),
+    });
+    const awsTranscribeLanguageModelExample = new TranscribeLanguageModel(
+      this,
+      "example_5",
+      {
+        baseModelName: "NarrowBand",
+        inputDataConfig: {
+          dataAccessRoleArn: Token.asString(awsIamRoleExample.arn),
+          s3Uri: "s3://${" + example.id + "}/transcribe/",
+        },
+        languageCode: "en-US",
+        modelName: "example",
+        tags: {
+          ENVIRONMENT: "development",
+        },
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsTranscribeLanguageModelExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `baseModelName` - (Required) Name of reference base model.
+* `inputDataConfig` - (Required) The input data config for the LanguageModel. See [Input Data Config](#input-data-config) for more details.
+* `languageCode` - (Required) The language code you selected for your language model. Refer to the [supported languages](https://docs.aws.amazon.com/transcribe/latest/dg/supported-languages.html) page for accepted codes.
+* `modelName` - (Required) The model name.
+
+### Input Data Config
+
+* `dataAccessRoleArn` - (Required) IAM role with access to S3 bucket.
+* `s3Uri` - (Required) S3 URI where training data is located.
+* `tuningDataS3Uri` - (Optional) S3 URI where tuning data is located.
+
+The following arguments are optional:
+
+* `tags` - (Optional) A map of tags to assign to the LanguageModel. If configured with a provider [`defaultTags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - LanguageModel name.
+* `arn` - ARN of the LanguageModel.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `600M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Transcribe LanguageModel using the `modelName`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Transcribe LanguageModel using the `modelName`. For example:
+
+```console
+% terraform import aws_transcribe_language_model.example example-name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-85a81f3a3aae68cdb05de1abee14c19e807278023470592c0e052318dc2bff47 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/transcribe_medical_vocabulary.html.markdown b/website/docs/cdktf/typescript/r/transcribe_medical_vocabulary.html.markdown
new file mode 100644
index 00000000000..67d39eef0a5
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/transcribe_medical_vocabulary.html.markdown
@@ -0,0 +1,110 @@
+---
+subcategory: "Transcribe"
+layout: "aws"
+page_title: "AWS: aws_transcribe_medical_vocabulary"
+description: |-
+  Terraform resource for managing an AWS Transcribe MedicalVocabulary.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_transcribe_medical_vocabulary
+
+Terraform resource for managing an AWS Transcribe MedicalVocabulary.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3Object } from "./.gen/providers/aws/s3-object";
+import { TranscribeMedicalVocabulary } from "./.gen/providers/aws/transcribe-medical-vocabulary";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new S3Bucket(this, "example", {
+      bucket: "example-medical-vocab-123",
+      forceDestroy: true,
+    });
+    const object = new S3Object(this, "object", {
+      bucket: example.id,
+      key: "transcribe/test1.txt",
+      source: "test.txt",
+    });
+    const awsTranscribeMedicalVocabularyExample =
+      new TranscribeMedicalVocabulary(this, "example_2", {
+        dependsOn: [object],
+        languageCode: "en-US",
+        tags: {
+          tag1: "value1",
+          tag2: "value3",
+        },
+        vocabularyFileUri: "s3://${" + example.id + "}/${" + object.key + "}",
+        vocabularyName: "example",
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsTranscribeMedicalVocabularyExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `languageCode` - (Required) The language code you selected for your medical vocabulary. US English (en-US) is the only language supported with Amazon Transcribe Medical.
+* `vocabularyFileUri` - (Required) The Amazon S3 location (URI) of the text file that contains your custom medical vocabulary.
+* `vocabularyName` - (Required) The name of the Medical Vocabulary.
+
+The following arguments are optional:
+
+* `tags` - (Optional) A map of tags to assign to the MedicalVocabulary. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Name of the MedicalVocabulary.
+* `arn` - ARN of the MedicalVocabulary.
+* `downloadUri` - Generated download URI.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `30M`)
+* `update` - (Default `30M`)
+* `delete` - (Default `30M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Transcribe MedicalVocabulary using the `vocabularyName`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Transcribe MedicalVocabulary using the `vocabularyName`. For example:
+
+```console
+% terraform import aws_transcribe_medical_vocabulary.example example-name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ec2666cdcba506c91a439366946ad3db8a956be1cc1dfb2a6e10b62b3551dac0 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/transcribe_vocabulary.html.markdown b/website/docs/cdktf/typescript/r/transcribe_vocabulary.html.markdown
new file mode 100644
index 00000000000..fc6ee6527b8
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/transcribe_vocabulary.html.markdown
@@ -0,0 +1,115 @@
+---
+subcategory: "Transcribe"
+layout: "aws"
+page_title: "AWS: aws_transcribe_vocabulary"
+description: |-
+  Terraform resource for managing an AWS Transcribe Vocabulary.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_transcribe_vocabulary
+
+Terraform resource for managing an AWS Transcribe Vocabulary.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { S3Bucket } from "./.gen/providers/aws/s3-bucket";
+import { S3Object } from "./.gen/providers/aws/s3-object";
+import { TranscribeVocabulary } from "./.gen/providers/aws/transcribe-vocabulary";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new S3Bucket(this, "example", {
+      bucket: "example-vocab-123",
+      forceDestroy: true,
+    });
+    const object = new S3Object(this, "object", {
+      bucket: example.id,
+      key: "transcribe/test1.txt",
+      source: "test.txt",
+    });
+    const awsTranscribeVocabularyExample = new TranscribeVocabulary(
+      this,
+      "example_2",
+      {
+        dependsOn: [object],
+        languageCode: "en-US",
+        tags: {
+          tag1: "value1",
+          tag2: "value3",
+        },
+        vocabularyFileUri: "s3://${" + example.id + "}/${" + object.key + "}",
+        vocabularyName: "example",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsTranscribeVocabularyExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `languageCode` - (Required) The language code you selected for your vocabulary.
+* `vocabularyFileUri` - (Required) The Amazon S3 location (URI) of the text file that contains your custom vocabulary.
+* `vocabularyName` - (Required) The name of the Vocabulary.
+
+The following arguments are optional:
+
+* `phrases` - (Optional) - A list of terms to include in the vocabulary. Conflicts with `vocabularyFileUri`
+* `vocabularyFileUri` - (Optional) The Amazon S3 location (URI) of the text file that contains your custom vocabulary. Conflicts wth `phrases`.
+* `tags` - (Optional) A map of tags to assign to the Vocabulary. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Name of the Vocabulary.
+* `arn` - ARN of the Vocabulary.
+* `downloadUri` - Generated download URI.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `30M`)
+* `update` - (Default `30M`)
+* `delete` - (Default `30M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Transcribe Vocabulary using the `vocabularyName`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Transcribe Vocabulary using the `vocabularyName`. For example:
+
+```console
+% terraform import aws_transcribe_vocabulary.example example-name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-4a63881191c0f51840ddf42c0326273b5b41ebbdda248795a18439aec52f460c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/transcribe_vocabulary_filter.html.markdown b/website/docs/cdktf/typescript/r/transcribe_vocabulary_filter.html.markdown
new file mode 100644
index 00000000000..b30182ddcf5
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/transcribe_vocabulary_filter.html.markdown
@@ -0,0 +1,88 @@
+---
+subcategory: "Transcribe"
+layout: "aws"
+page_title: "AWS: aws_transcribe_vocabulary_filter"
+description: |-
+  Terraform resource for managing an AWS Transcribe VocabularyFilter.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_transcribe_vocabulary_filter
+
+Terraform resource for managing an AWS Transcribe VocabularyFilter.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { TranscribeVocabularyFilter } from "./.gen/providers/aws/transcribe-vocabulary-filter";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new TranscribeVocabularyFilter(this, "example", {
+      languageCode: "en-US",
+      tags: {
+        tag1: "value1",
+        tag2: "value3",
+      },
+      vocabularyFilterName: "example",
+      words: ["cars", "bucket"],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `languageCode` - (Required) The language code you selected for your vocabulary filter. Refer to the [supported languages](https://docs.aws.amazon.com/transcribe/latest/dg/supported-languages.html) page for accepted codes.
+* `vocabularyFilterName` - (Required) The name of the VocabularyFilter.
+
+The following arguments are optional:
+
+* `vocabularyFilterFileUri` - (Optional) The Amazon S3 location (URI) of the text file that contains your custom VocabularyFilter. Conflicts with `words` argument.
+* `tags` - (Optional) A map of tags to assign to the VocabularyFilter. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `words` - (Optional) - A list of terms to include in the vocabulary. Conflicts with `vocabularyFilterFileUri` argument.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - VocabularyFilter name.
+* `arn` - ARN of the VocabularyFilter.
+* `downloadUri` - Generated download URI.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Transcribe VocabularyFilter using the `vocabularyFilterName`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Transcribe VocabularyFilter using the `vocabularyFilterName`. For example:
+
+```console
+% terraform import aws_transcribe_vocabulary_filter.example example-name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-16b5be2fa7e21b3d5f8eb7e880ca04a14415ca27a321bb6d553621e84cea648d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/transfer_access.html.markdown b/website/docs/cdktf/typescript/r/transfer_access.html.markdown
new file mode 100644
index 00000000000..5c0d2ea20e2
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/transfer_access.html.markdown
@@ -0,0 +1,123 @@
+---
+subcategory: "Transfer Family"
+layout: "aws"
+page_title: "AWS: aws_transfer_access"
+description: |-
+  Provides a AWS Transfer Access resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_transfer_access
+
+Provides a AWS Transfer Access resource.
+
+## Example Usage
+
+### Basic S3
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { TransferAccess } from "./.gen/providers/aws/transfer-access";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new TransferAccess(this, "example", {
+      externalId: "S-1-1-12-1234567890-123456789-1234567890-1234",
+      homeDirectory: "/${" + awsS3BucketExample.id + "}/",
+      role: Token.asString(awsIamRoleExample.arn),
+      serverId: Token.asString(awsTransferServerExample.id),
+    });
+  }
+}
+
+```
+
+### Basic EFS
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { TransferAccess } from "./.gen/providers/aws/transfer-access";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new TransferAccess(this, "test", {
+      externalId: "S-1-1-12-1234567890-123456789-1234567890-1234",
+      homeDirectory: "/${" + awsEfsFileSystemTest.id + "}/",
+      posixProfile: {
+        gid: 1000,
+        uid: 1000,
+      },
+      role: Token.asString(awsIamRoleTest.arn),
+      serverId: Token.asString(awsTransferServerTest.id),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `externalId` - (Required) The SID of a group in the directory connected to the Transfer Server (e.g., `s1112123456789012345678912345678901234`)
+* `serverId` - (Required) The Server ID of the Transfer Server (e.g., `s12345678`)
+* `homeDirectory` - (Optional) The landing directory (folder) for a user when they log in to the server using their SFTP client.  It should begin with a `/`.  The first item in the path is the name of the home bucket (accessible as `${transfer:homeBucket}` in the policy) and the rest is the home directory (accessible as `${transfer:homeDirectory}` in the policy). For example, `/exampleBucket1234/username` would set the home bucket to `exampleBucket1234` and the home directory to `username`.
+* `homeDirectoryMappings` - (Optional) Logical directory mappings that specify what S3 paths and keys should be visible to your user and how you want to make them visible. See [Home Directory Mappings](#home-directory-mappings) below.
+* `homeDirectoryType` - (Optional) The type of landing directory (folder) you mapped for your users' home directory. Valid values are `path` and `logical`.
+* `policy` - (Optional) An IAM JSON policy document that scopes down user access to portions of their Amazon S3 bucket. IAM variables you can use inside this policy include `${transfer:userName}`, `${transfer:homeDirectory}`, and `${transfer:homeBucket}`. Since the IAM variable syntax matches Terraform's interpolation syntax, they must be escaped inside Terraform configuration strings (`$${transfer:userName}`).  These are evaluated on-the-fly when navigating the bucket.
+* `posixProfile` - (Optional) Specifies the full POSIX identity, including user ID (Uid), group ID (Gid), and any secondary groups IDs (SecondaryGids), that controls your users' access to your Amazon EFS file systems. See [Posix Profile](#posix-profile) below.
+* `role` - (Required) Amazon Resource Name (ARN) of an IAM role that allows the service to controls your user’s access to your Amazon S3 bucket.
+
+### Home Directory Mappings
+
+* `entry` - (Required) Represents an entry and a target.
+* `target` - (Required) Represents the map target.
+
+### Posix Profile
+
+* `gid` - (Required) The POSIX group ID used for all EFS operations by this user.
+* `uid` - (Required) The POSIX user ID used for all EFS operations by this user.
+* `secondaryGids` - (Optional) The secondary POSIX group IDs used for all EFS operations by this user.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id`  - The ID of the resource
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Transfer Accesses using the `serverId` and `externalId`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Transfer Accesses using the `serverId` and `externalId`. For example:
+
+```console
+% terraform import aws_transfer_access.example s-12345678/S-1-1-12-1234567890-123456789-1234567890-1234
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ff8299ab25d391a1af99874bcb28fb7deeeece3c742e6251e861258034467d2f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/transfer_agreement.html.markdown b/website/docs/cdktf/typescript/r/transfer_agreement.html.markdown
new file mode 100644
index 00000000000..71278789398
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/transfer_agreement.html.markdown
@@ -0,0 +1,86 @@
+---
+subcategory: "Transfer Family"
+layout: "aws"
+page_title: "AWS: aws_transfer_agreement"
+description: |-
+  Provides a AWS Transfer AS2 Agreement Resource
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_transfer_agreement
+
+Provides a AWS Transfer AS2 Agreement resource.
+
+## Example Usage
+
+### Basic
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { TransferAgreement } from "./.gen/providers/aws/transfer-agreement";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new TransferAgreement(this, "example", {
+      accessRole: test.arn,
+      baseDirectory: "/DOC-EXAMPLE-BUCKET/home/mydirectory",
+      description: "example",
+      localProfileId: local.profileId,
+      partnerProfileId: partner.profileId,
+      serverId: Token.asString(awsTransferServerTest.id),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `accessRole` - (Required) The IAM Role which provides read and write access to the parent directory of the file location mentioned in the StartFileTransfer request.
+* `baseDirectory` - (Required) The landing directory for the files transferred by using the AS2 protocol.
+* `description` - (Optional) The Optional description of the transdfer.
+* `localProfileId` - (Required) The unique identifier for the AS2 local profile.
+* `partnerProfileId` - (Required) The unique identifier for the AS2 partner profile.
+* `serverId` - (Required) The unique server identifier for the server instance. This is the specific server the agreement uses.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `agreementId`  - The unique identifier for the AS2 agreement.
+* `arn` - The ARN of the agreement.
+* `staus`  - The staus of the agreement which is either ACTIVE or INACTIVE.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Transfer AS2 Agreement using the `serverId/agreementId`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Transfer AS2 Agreement using the `serverId/agreementId`. For example:
+
+```console
+% terraform import aws_transfer_agreement.example s-4221a88afd5f4362a/a-4221a88afd5f4362a
+```
+
+<!-- cache-key: cdktf-0.18.0 input-68e33cbd7ad4965dddc102db9b300dde49f777c8ef6bfaa3845050362aa8992d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/transfer_certificate.html.markdown b/website/docs/cdktf/typescript/r/transfer_certificate.html.markdown
new file mode 100644
index 00000000000..8039680b9fe
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/transfer_certificate.html.markdown
@@ -0,0 +1,91 @@
+---
+subcategory: "Transfer Family"
+layout: "aws"
+page_title: "AWS: aws_transfer_certificate"
+description: |-
+  Provides a AWS Transfer AS2 Certificate Resource
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_transfer_certificate
+
+Provides a AWS Transfer AS2 Certificate resource.
+
+## Example Usage
+
+### Basic
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { TransferCertificate } from "./.gen/providers/aws/transfer-certificate";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new TransferCertificate(this, "example", {
+      certificate: Token.asString(
+        Fn.file("${path.module}/example.com/example.crt")
+      ),
+      certificateChain: Token.asString(
+        Fn.file("${path.module}/example.com/ca.crt")
+      ),
+      description: "example",
+      privateKey: Token.asString(
+        Fn.file("${path.module}/example.com/example.key")
+      ),
+      usage: "SIGNING",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `certificate` - (Required) The valid certificate file required for the transfer.
+* `certificateChain` - (Optional) The optional list of certificate that make up the chain for the certificate that is being imported.
+* `description` - (Optional) A short description that helps identify the certificate.
+* `privateKey` - (Optional) The private key associated with the certificate being imported.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `usage` - (Required) Specifies if a certificate is being used for signing or encryption. The valid values are SIGNING and ENCRYPTION.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the certificate
+* `certificateId` - The unique identifier for the AS2 certificate
+* `activeDate` - An date when the certificate becomes active
+* `inactiveDate` - An date when the certificate becomes inactive
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Transfer AS2 Certificate using the `certificateId`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Transfer AS2 Certificate using the `certificateId`. For example:
+
+```console
+% terraform import aws_transfer_certificate.example c-4221a88afd5f4362a
+```
+
+<!-- cache-key: cdktf-0.18.0 input-9e7f080d0a6c4946e22084c4f2ae3c03144eb7cd8a58f89d9fd2f1afa2ea612e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/transfer_connector.html.markdown b/website/docs/cdktf/typescript/r/transfer_connector.html.markdown
new file mode 100644
index 00000000000..950b37812f2
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/transfer_connector.html.markdown
@@ -0,0 +1,133 @@
+---
+subcategory: "Transfer Family"
+layout: "aws"
+page_title: "AWS: aws_transfer_connector"
+description: |-
+  Provides a AWS Transfer AS2 Connector Resource
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_transfer_connector
+
+Provides a AWS Transfer AS2 Connector resource.
+
+## Example Usage
+
+### Basic
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { TransferConnector } from "./.gen/providers/aws/transfer-connector";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new TransferConnector(this, "example", {
+      accessRole: test.arn,
+      as2Config: {
+        compression: "DISABLED",
+        encryptionAlgorithm: "AWS128_CBC",
+        localProfileId: local.profileId,
+        mdnResponse: "NONE",
+        mdnSigningAlgorithm: "NONE",
+        messageSubject: "For Connector",
+        partnerProfileId: partner.profileId,
+        signingAlgorithm: "NONE",
+      },
+      url: "http://www.test.com",
+    });
+  }
+}
+
+```
+
+### SFTP Connector
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { TransferConnector } from "./.gen/providers/aws/transfer-connector";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new TransferConnector(this, "example", {
+      accessRole: test.arn,
+      sftpConfig: {
+        trustedHostKeys: ["ssh-rsa AAAAB3NYourKeysHere"],
+        userSecretId: Token.asString(awsSecretsmanagerSecretExample.id),
+      },
+      url: "sftp://test.com",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `accessRole` - (Required) The IAM Role which provides read and write access to the parent directory of the file location mentioned in the StartFileTransfer request.
+* `as2Config` - (Optional) Either SFTP or AS2 is configured.The parameters to configure for the connector object. Fields documented below.
+* `loggingRole` - (Optional) The IAM Role which is required for allowing the connector to turn on CloudWatch logging for Amazon S3 events.
+* `sftpConfig` - (Optional) Either SFTP or AS2 is configured.The parameters to configure for the connector object. Fields documented below.
+* `url` - (Required) The URL of the partners AS2 endpoint or SFTP endpoint.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### As2Config Details
+
+* `compression` - (Required) Specifies weather AS2 file is compressed. The valud values are ZLIB and  DISABLED.
+* `encryptionAlgorithm` - (Required) The algorithm that is used to encrypt the file. The valid values are AES128_CBC | AES192_CBC | AES256_CBC | NONE.
+* `localProfileId` - (Required) The unique identifier for the AS2 local profile.
+* `mdnResponse` - (Required) Used for outbound requests to determine if a partner response for transfers is synchronous or asynchronous. The valid values are SYNC and NONE.
+* `mdnSigningAlgorithm` - (Optional) The signing algorithm for the Mdn response. The valid values are SHA256 | SHA384 | SHA512 | SHA1 | NONE | DEFAULT.
+* `messageSubject` - (Optional) Used as the subject HTTP header attribute in AS2 messages that are being sent with the connector.
+* `partnerProfileId` - (Required) The unique identifier for the AS2 partner profile.
+* `signingAlgorithm` - (Required) The algorithm that is used to sign AS2 messages sent with the connector. The valid values are SHA256 | SHA384 | SHA512 | SHA1 | NONE .
+
+### SftpConfig Details
+
+* `trustedHostKeys` - (Required) A list of public portion of the host key, or keys, that are used to authenticate the user to the external server to which you are connecting.(https://docs.aws.amazon.com/transfer/latest/userguide/API_SftpConnectorConfig.html)
+* `userSecretId` - (Required) The identifier for the secret (in AWS Secrets Manager) that contains the SFTP user's private key, password, or both. The identifier can be either the Amazon Resource Name (ARN) or the name of the secret.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the connector.
+* `connectorId`  - The unique identifier for the AS2 profile or SFTP Profile.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Transfer AS2 Connector using the `connectorId`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Transfer AS2 Connector using the `connectorId`. For example:
+
+```console
+% terraform import aws_transfer_connector.example c-4221a88afd5f4362a
+```
+
+<!-- cache-key: cdktf-0.18.0 input-08a2d3ed33597d19d5aea6b0a9938d36219bbcfc9565866ef46ddd1ae4b69a1b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/transfer_profile.html.markdown b/website/docs/cdktf/typescript/r/transfer_profile.html.markdown
new file mode 100644
index 00000000000..69f0d6e8925
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/transfer_profile.html.markdown
@@ -0,0 +1,85 @@
+---
+subcategory: "Transfer Family"
+layout: "aws"
+page_title: "AWS: aws_transfer_profile"
+description: |-
+  Provides a AWS Transfer AS2 Profile Resource
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_transfer_profile
+
+Provides a AWS Transfer AS2 Profile resource.
+
+## Example Usage
+
+### Basic
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { TransferProfile } from "./.gen/providers/aws/transfer-profile";
+interface MyConfig {
+  profileType: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new TransferProfile(this, "example", {
+      as2Id: "example",
+      certificateIds: [
+        Token.asString(awsTransferCertificateExample.certificateId),
+      ],
+      usage: "LOCAL",
+      profileType: config.profileType,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `as2Id` - (Required) The As2Id is the AS2 name as defined in the RFC 4130. For inbound ttransfers this is the AS2 From Header for the AS2 messages sent from the partner. For Outbound messages this is the AS2 To Header for the AS2 messages sent to the partner. his ID cannot include spaces.
+* `certificateIds` - (Optional) The list of certificate Ids from the imported certificate operation.
+* `profileType` - (Required) The profile type should be LOCAL or PARTNER.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the profile.
+* `profileId`  - The unique identifier for the AS2 profile.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Transfer AS2 Profile using the `profileId`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Transfer AS2 Profile using the `profileId`. For example:
+
+```console
+% terraform import aws_transfer_profile.example p-4221a88afd5f4362a
+```
+
+<!-- cache-key: cdktf-0.18.0 input-16bf118d7f42726eb3b4479223e202a1b8630bdd949a41b0aec899a9608267bf -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/transfer_server.html.markdown b/website/docs/cdktf/typescript/r/transfer_server.html.markdown
new file mode 100644
index 00000000000..717d0ee4206
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/transfer_server.html.markdown
@@ -0,0 +1,321 @@
+---
+subcategory: "Transfer Family"
+layout: "aws"
+page_title: "AWS: aws_transfer_server"
+description: |-
+  Provides a AWS Transfer Server resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_transfer_server
+
+Provides a AWS Transfer Server resource.
+
+~> **NOTE on AWS IAM permissions:** If the `endpointType` is set to `vpc`, the `ec2:describeVpcEndpoints` and `ec2:modifyVpcEndpoint` [actions](https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonec2.html#amazonec2-actions-as-permissions) are used.
+
+~> **NOTE:** Use the [`awsTransferTag`](transfer_tag.html) resource to manage the system tags used for [custom hostnames](https://docs.aws.amazon.com/transfer/latest/userguide/requirements-dns.html#tag-custom-hostname-cdk).
+
+## Example Usage
+
+### Basic
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { TransferServer } from "./.gen/providers/aws/transfer-server";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new TransferServer(this, "example", {
+      tags: {
+        Name: "Example",
+      },
+    });
+  }
+}
+
+```
+
+### Security Policy Name
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { TransferServer } from "./.gen/providers/aws/transfer-server";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new TransferServer(this, "example", {
+      securityPolicyName: "TransferSecurityPolicy-2020-06",
+    });
+  }
+}
+
+```
+
+### VPC Endpoint
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { TransferServer } from "./.gen/providers/aws/transfer-server";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new TransferServer(this, "example", {
+      endpointDetails: {
+        addressAllocationIds: [Token.asString(awsEipExample.id)],
+        subnetIds: [Token.asString(awsSubnetExample.id)],
+        vpcId: Token.asString(awsVpcExample.id),
+      },
+      endpointType: "VPC",
+    });
+  }
+}
+
+```
+
+### AWS Directory authentication
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { TransferServer } from "./.gen/providers/aws/transfer-server";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new TransferServer(this, "example", {
+      directoryId: Token.asString(awsDirectoryServiceDirectoryExample.id),
+      identityProviderType: "AWS_DIRECTORY_SERVICE",
+    });
+  }
+}
+
+```
+
+### AWS Lambda authentication
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { TransferServer } from "./.gen/providers/aws/transfer-server";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new TransferServer(this, "example", {
+      function: Token.asString(awsLambdaIdentityProviderExample.arn),
+      identityProviderType: "AWS_LAMBDA",
+    });
+  }
+}
+
+```
+
+### Protocols
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { TransferServer } from "./.gen/providers/aws/transfer-server";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new TransferServer(this, "example", {
+      certificate: Token.asString(awsAcmCertificateExample.arn),
+      endpointDetails: {
+        subnetIds: [Token.asString(awsSubnetExample.id)],
+        vpcId: Token.asString(awsVpcExample.id),
+      },
+      endpointType: "VPC",
+      identityProviderType: "API_GATEWAY",
+      protocols: ["FTP", "FTPS"],
+      url:
+        "${" +
+        awsApiGatewayDeploymentExample.invokeUrl +
+        "${" +
+        awsApiGatewayResourceExample.path +
+        "}",
+    });
+  }
+}
+
+```
+
+### Using Structured Logging Destinations
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudwatchLogGroup } from "./.gen/providers/aws/cloudwatch-log-group";
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+import { TransferServer } from "./.gen/providers/aws/transfer-server";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const transfer = new CloudwatchLogGroup(this, "transfer", {
+      namePrefix: "transfer_test_",
+    });
+    const transferAssumeRole = new DataAwsIamPolicyDocument(
+      this,
+      "transfer_assume_role",
+      {
+        statement: [
+          {
+            actions: ["sts:AssumeRole"],
+            effect: "Allow",
+            principals: [
+              {
+                identifiers: ["transfer.amazonaws.com"],
+                type: "Service",
+              },
+            ],
+          },
+        ],
+      }
+    );
+    const iamForTransfer = new IamRole(this, "iam_for_transfer", {
+      assumeRolePolicy: Token.asString(transferAssumeRole.json),
+      managedPolicyArns: [
+        "arn:aws:iam::aws:policy/service-role/AWSTransferLoggingAccess",
+      ],
+      namePrefix: "iam_for_transfer_",
+    });
+    const awsTransferServerTransfer = new TransferServer(this, "transfer_3", {
+      endpointType: "PUBLIC",
+      loggingRole: iamForTransfer.arn,
+      protocols: ["SFTP"],
+      structuredLogDestinations: ["${" + transfer.arn + "}:*"],
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsTransferServerTransfer.overrideLogicalId("transfer");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `certificate` - (Optional) The Amazon Resource Name (ARN) of the AWS Certificate Manager (ACM) certificate. This is required when `protocols` is set to `ftps`
+* `domain` - (Optional) The domain of the storage system that is used for file transfers. Valid values are: `s3` and `efs`. The default value is `s3`.
+* `protocols` - (Optional) Specifies the file transfer protocol or protocols over which your file transfer protocol client can connect to your server's endpoint. This defaults to `sftp` . The available protocols are:
+    * `as2`: File transfer over Applicability Statement 2
+    * `sftp`: File transfer over SSH
+    * `ftps`: File transfer with TLS encryption
+    * `ftp`: Unencrypted file transfer
+* `endpointDetails` - (Optional) The virtual private cloud (VPC) endpoint settings that you want to configure for your SFTP server. Fields documented below.
+* `endpointType` - (Optional) The type of endpoint that you want your SFTP server connect to. If you connect to a `vpc` (or `vpcEndpoint`), your SFTP server isn't accessible over the public internet. If you want to connect your SFTP server via public internet, set `public`.  Defaults to `public`.
+* `invocationRole` - (Optional) Amazon Resource Name (ARN) of the IAM role used to authenticate the user account with an `identityProviderType` of `apiGateway`.
+* `hostKey` - (Optional) RSA, ECDSA, or ED25519 private key (e.g., as generated by the `ssh-keygen -t rsa -b 2048 -N "" -m PEM -f my-new-server-key`, `ssh-keygen -t ecdsa -b 256 -N "" -m PEM -f my-new-server-key` or `ssh-keygen -t ed25519 -N "" -f my-new-server-key` commands).
+* `url` - (Optional) - URL of the service endpoint used to authenticate users with an `identityProviderType` of `apiGateway`.
+* `identityProviderType` - (Optional) The mode of authentication enabled for this service. The default value is `serviceManaged`, which allows you to store and access SFTP user credentials within the service. `apiGateway` indicates that user authentication requires a call to an API Gateway endpoint URL provided by you to integrate an identity provider of your choice. Using `awsDirectoryService` will allow for authentication against AWS Managed Active Directory or Microsoft Active Directory in your on-premises environment, or in AWS using AD Connectors. Use the `awsLambda` value to directly use a Lambda function as your identity provider. If you choose this value, you must specify the ARN for the lambda function in the `function` argument.
+* `directoryId` - (Optional) The directory service ID of the directory service you want to connect to with an `identityProviderType` of `awsDirectoryService`.
+* `function` - (Optional) The ARN for a lambda function to use for the Identity provider.
+* `loggingRole` - (Optional) Amazon Resource Name (ARN) of an IAM role that allows the service to write your SFTP users’ activity to your Amazon CloudWatch logs for monitoring and auditing purposes.
+* `forceDestroy` - (Optional) A boolean that indicates all users associated with the server should be deleted so that the Server can be destroyed without error. The default value is `false`. This option only applies to servers configured with a `serviceManaged` `identityProviderType`.
+* `postAuthenticationLoginBanner`- (Optional) Specify a string to display when users connect to a server. This string is displayed after the user authenticates. The SFTP protocol does not support post-authentication display banners.
+* `preAuthenticationLoginBanner`- (Optional) Specify a string to display when users connect to a server. This string is displayed before the user authenticates.
+* `protocolDetails`- (Optional) The protocol settings that are configured for your server.
+* `securityPolicyName` - (Optional) Specifies the name of the security policy that is attached to the server. Possible values are `transferSecurityPolicy201811`, `transferSecurityPolicy202006`, `transferSecurityPolicyFips202006`, `transferSecurityPolicy202203` and `transferSecurityPolicy202305`. Default value is: `transferSecurityPolicy201811`.
+* `structuredLogDestinations` - (Optional) A set of ARNs of destinations that will receive structured logs from the transfer server such as CloudWatch Log Group ARNs. If provided this enables the transfer server to emit structured logs to the specified locations.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `workflowDetails` - (Optional) Specifies the workflow details. See Workflow Details below.
+
+### Endpoint Details
+
+* `addressAllocationIds` - (Optional) A list of address allocation IDs that are required to attach an Elastic IP address to your SFTP server's endpoint. This property can only be used when `endpointType` is set to `vpc`.
+* `securityGroupIds` - (Optional) A list of security groups IDs that are available to attach to your server's endpoint. If no security groups are specified, the VPC's default security groups are automatically assigned to your endpoint. This property can only be used when `endpointType` is set to `vpc`.
+* `subnetIds` - (Optional) A list of subnet IDs that are required to host your SFTP server endpoint in your VPC. This property can only be used when `endpointType` is set to `vpc`.
+* `vpcEndpointId` - (Optional) The ID of the VPC endpoint. This property can only be used when `endpointType` is set to `vpcEndpoint`
+* `vpcId` - (Optional) The VPC ID of the virtual private cloud in which the SFTP server's endpoint will be hosted. This property can only be used when `endpointType` is set to `vpc`.
+
+### Protocol Details
+
+* `as2Transports` - (Optional) Indicates the transport method for the AS2 messages. Currently, only `http` is supported.
+* `passiveIp` - (Optional) Indicates passive mode, for FTP and FTPS protocols. Enter a single IPv4 address, such as the public IP address of a firewall, router, or load balancer.
+* `setStatOption` - (Optional) Use to ignore the error that is generated when the client attempts to use `setstat` on a file you are uploading to an S3 bucket. Valid values: `default`, `enableNoOp`.
+* `tlsSessionResumptionMode` - (Optional) A property used with Transfer Family servers that use the FTPS protocol. Provides a mechanism to resume or share a negotiated secret key between the control and data connection for an FTPS session. Valid values: `disabled`, `enabled`, `enforced`.
+  
+### Workflow Details
+
+* `onUpload` - (Optional) A trigger that starts a workflow: the workflow begins to execute after a file is uploaded. See Workflow Detail below.
+* `onPartialUpload` - (Optional) A trigger that starts a workflow if a file is only partially uploaded. See Workflow Detail below.
+
+#### Workflow Detail
+
+* `executionRole` - (Required) Includes the necessary permissions for S3, EFS, and Lambda operations that Transfer can assume, so that all workflow steps can operate on the required resources.
+* `workflowId` - (Required)  A unique identifier for the workflow.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of Transfer Server
+* `id`  - The Server ID of the Transfer Server (e.g., `s12345678`)
+* `endpoint` - The endpoint of the Transfer Server (e.g., `s12345678ServerTransferRegionAmazonawsCom`)
+* `hostKeyFingerprint` - This value contains the message-digest algorithm (MD5) hash of the server's host key. This value is equivalent to the output of the `ssh-keygen -l -E md5 -f my-new-server-key` command.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Transfer Servers using the server `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Transfer Servers using the server `id`. For example:
+
+```console
+% terraform import aws_transfer_server.example s-12345678
+```
+
+Certain resource arguments, such as `hostKey`, cannot be read via the API and imported into Terraform. Terraform will display a difference for these arguments the first run after import if declared in the Terraform configuration for an imported resource.
+
+<!-- cache-key: cdktf-0.18.0 input-ad0054a3522d24a16b0248e7bf252083058382ba661c98eb47eb333f6a02723b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/transfer_ssh_key.html.markdown b/website/docs/cdktf/typescript/r/transfer_ssh_key.html.markdown
new file mode 100644
index 00000000000..53afab0943e
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/transfer_ssh_key.html.markdown
@@ -0,0 +1,139 @@
+---
+subcategory: "Transfer Family"
+layout: "aws"
+page_title: "AWS: aws_transfer_ssh_key"
+description: |-
+  Provides a AWS Transfer SSH Public Key resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_transfer_ssh_key
+
+Provides a AWS Transfer User SSH Key resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+import { IamRolePolicy } from "./.gen/providers/aws/iam-role-policy";
+import { TransferServer } from "./.gen/providers/aws/transfer-server";
+import { TransferSshKey } from "./.gen/providers/aws/transfer-ssh-key";
+import { TransferUser } from "./.gen/providers/aws/transfer-user";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new TransferServer(this, "example", {
+      identityProviderType: "SERVICE_MANAGED",
+      tags: {
+        NAME: "tf-acc-test-transfer-server",
+      },
+    });
+    const assumeRole = new DataAwsIamPolicyDocument(this, "assume_role", {
+      statement: [
+        {
+          actions: ["sts:AssumeRole"],
+          effect: "Allow",
+          principals: [
+            {
+              identifiers: ["transfer.amazonaws.com"],
+              type: "Service",
+            },
+          ],
+        },
+      ],
+    });
+    const dataAwsIamPolicyDocumentExample = new DataAwsIamPolicyDocument(
+      this,
+      "example_2",
+      {
+        statement: [
+          {
+            actions: ["s3:*"],
+            effect: "Allow",
+            resources: ["*"],
+            sid: "AllowFullAccesstoS3",
+          },
+        ],
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsIamPolicyDocumentExample.overrideLogicalId("example");
+    const awsIamRoleExample = new IamRole(this, "example_3", {
+      assumeRolePolicy: Token.asString(assumeRole.json),
+      name: "tf-test-transfer-user-iam-role",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamRoleExample.overrideLogicalId("example");
+    const awsIamRolePolicyExample = new IamRolePolicy(this, "example_4", {
+      name: "tf-test-transfer-user-iam-policy",
+      policy: Token.asString(dataAwsIamPolicyDocumentExample.json),
+      role: Token.asString(awsIamRoleExample.id),
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamRolePolicyExample.overrideLogicalId("example");
+    const awsTransferUserExample = new TransferUser(this, "example_5", {
+      role: Token.asString(awsIamRoleExample.arn),
+      serverId: example.id,
+      tags: {
+        NAME: "tftestuser",
+      },
+      userName: "tftestuser",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsTransferUserExample.overrideLogicalId("example");
+    const awsTransferSshKeyExample = new TransferSshKey(this, "example_6", {
+      body: "... SSH key ...",
+      serverId: example.id,
+      userName: Token.asString(awsTransferUserExample.userName),
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsTransferSshKeyExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `serverId` - (Requirement) The Server ID of the Transfer Server (e.g., `s12345678`)
+* `userName` - (Requirement) The name of the user account that is assigned to one or more servers.
+* `body` - (Requirement) The public key portion of an SSH key pair.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Transfer SSH Public Key using the `serverId` and `userName` and `sshPublicKeyId` separated by `/`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Transfer SSH Public Key using the `serverId` and `userName` and `sshPublicKeyId` separated by `/`. For example:
+
+```console
+% terraform import aws_transfer_ssh_key.bar s-12345678/test-username/key-12345
+```
+
+<!-- cache-key: cdktf-0.18.0 input-f16407da495aabd5e5cb11259213032844864d47c447730f78f40b9901749b2e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/transfer_tag.html.markdown b/website/docs/cdktf/typescript/r/transfer_tag.html.markdown
new file mode 100644
index 00000000000..ccc27afbdc5
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/transfer_tag.html.markdown
@@ -0,0 +1,88 @@
+---
+subcategory: "Transfer Family"
+layout: "aws"
+page_title: "AWS: aws_transfer_tag"
+description: |-
+  Manages an individual Transfer Family resource tag
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_transfer_tag
+
+Manages an individual Transfer Family resource tag. This resource should only be used in cases where Transfer Family resources are created outside Terraform (e.g., Servers without AWS Management Console) or the tag key has the `aws:` prefix.
+
+~> **NOTE:** This tagging resource should not be combined with the Terraform resource for managing the parent resource. For example, using `awsTransferServer` and `awsTransferTag` to manage tags of the same server will cause a perpetual difference where the `awsTransferServer` resource will try to remove the tag being added by the `awsTransferTag` resource.
+
+~> **NOTE:** This tagging resource does not use the [provider `ignoreTags` configuration](/docs/providers/aws/index.html#ignore_tags).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { TransferServer } from "./.gen/providers/aws/transfer-server";
+import { TransferTag } from "./.gen/providers/aws/transfer-tag";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new TransferServer(this, "example", {
+      identityProviderType: "SERVICE_MANAGED",
+    });
+    new TransferTag(this, "hostname", {
+      key: "aws:transfer:customHostname",
+      resourceArn: example.arn,
+      value: "example.com",
+    });
+    new TransferTag(this, "zone_id", {
+      key: "aws:transfer:route53HostedZoneId",
+      resourceArn: example.arn,
+      value: "/hostedzone/MyHostedZoneId",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `resourceArn` - (Required) Amazon Resource Name (ARN) of the Transfer Family resource to tag.
+* `key` - (Required) Tag name.
+* `value` - (Required) Tag value.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Transfer Family resource identifier and key, separated by a comma (`,`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsTransferTag` using the Transfer Family resource identifier and key, separated by a comma (`,`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsTransferTag` using the Transfer Family resource identifier and key, separated by a comma (`,`). For example:
+
+```console
+% terraform import aws_transfer_tag.example arn:aws:transfer:us-east-1:123456789012:server/s-1234567890abcdef0,Name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-e2764988d2c43be249db77ec49fff55b3d8ec29f4531f3fe791ef9e27ae5b2a6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/transfer_user.html.markdown b/website/docs/cdktf/typescript/r/transfer_user.html.markdown
new file mode 100644
index 00000000000..9cf662df9cf
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/transfer_user.html.markdown
@@ -0,0 +1,175 @@
+---
+subcategory: "Transfer Family"
+layout: "aws"
+page_title: "AWS: aws_transfer_user"
+description: |-
+  Provides a AWS Transfer User resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_transfer_user
+
+Provides a AWS Transfer User resource. Managing SSH keys can be accomplished with the [`awsTransferSshKey` resource](/docs/providers/aws/r/transfer_ssh_key.html).
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+import { IamRolePolicy } from "./.gen/providers/aws/iam-role-policy";
+import { TransferServer } from "./.gen/providers/aws/transfer-server";
+import { TransferUser } from "./.gen/providers/aws/transfer-user";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const foo = new TransferServer(this, "foo", {
+      identityProviderType: "SERVICE_MANAGED",
+      tags: {
+        NAME: "tf-acc-test-transfer-server",
+      },
+    });
+    const assumeRole = new DataAwsIamPolicyDocument(this, "assume_role", {
+      statement: [
+        {
+          actions: ["sts:AssumeRole"],
+          effect: "Allow",
+          principals: [
+            {
+              identifiers: ["transfer.amazonaws.com"],
+              type: "Service",
+            },
+          ],
+        },
+      ],
+    });
+    const dataAwsIamPolicyDocumentFoo = new DataAwsIamPolicyDocument(
+      this,
+      "foo_2",
+      {
+        statement: [
+          {
+            actions: ["s3:*"],
+            effect: "Allow",
+            resources: ["*"],
+            sid: "AllowFullAccesstoS3",
+          },
+        ],
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsIamPolicyDocumentFoo.overrideLogicalId("foo");
+    const awsIamRoleFoo = new IamRole(this, "foo_3", {
+      assumeRolePolicy: Token.asString(assumeRole.json),
+      name: "tf-test-transfer-user-iam-role",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamRoleFoo.overrideLogicalId("foo");
+    const awsIamRolePolicyFoo = new IamRolePolicy(this, "foo_4", {
+      name: "tf-test-transfer-user-iam-policy",
+      policy: Token.asString(dataAwsIamPolicyDocumentFoo.json),
+      role: Token.asString(awsIamRoleFoo.id),
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsIamRolePolicyFoo.overrideLogicalId("foo");
+    const awsTransferUserFoo = new TransferUser(this, "foo_5", {
+      homeDirectoryMappings: [
+        {
+          entry: "/test.pdf",
+          target: "/bucket3/test-path/tftestuser.pdf",
+        },
+      ],
+      homeDirectoryType: "LOGICAL",
+      role: Token.asString(awsIamRoleFoo.arn),
+      serverId: foo.id,
+      userName: "tftestuser",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsTransferUserFoo.overrideLogicalId("foo");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `serverId` - (Required) The Server ID of the Transfer Server (e.g., `s12345678`)
+* `userName` - (Required) The name used for log in to your SFTP server.
+* `homeDirectory` - (Optional) The landing directory (folder) for a user when they log in to the server using their SFTP client.  It should begin with a `/`.  The first item in the path is the name of the home bucket (accessible as `${transfer:homeBucket}` in the policy) and the rest is the home directory (accessible as `${transfer:homeDirectory}` in the policy). For example, `/exampleBucket1234/username` would set the home bucket to `exampleBucket1234` and the home directory to `username`.
+* `homeDirectoryMappings` - (Optional) Logical directory mappings that specify what S3 paths and keys should be visible to your user and how you want to make them visible. See [Home Directory Mappings](#home-directory-mappings) below.
+* `homeDirectoryType` - (Optional) The type of landing directory (folder) you mapped for your users' home directory. Valid values are `path` and `logical`.
+* `policy` - (Optional) An IAM JSON policy document that scopes down user access to portions of their Amazon S3 bucket. IAM variables you can use inside this policy include `${transfer:userName}`, `${transfer:homeDirectory}`, and `${transfer:homeBucket}`. Since the IAM variable syntax matches Terraform's interpolation syntax, they must be escaped inside Terraform configuration strings (`$${transfer:userName}`).  These are evaluated on-the-fly when navigating the bucket.
+* `posixProfile` - (Optional) Specifies the full POSIX identity, including user ID (Uid), group ID (Gid), and any secondary groups IDs (SecondaryGids), that controls your users' access to your Amazon EFS file systems. See [Posix Profile](#posix-profile) below.
+* `role` - (Required) Amazon Resource Name (ARN) of an IAM role that allows the service to control your user’s access to your Amazon S3 bucket.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Home Directory Mappings
+
+* `entry` - (Required) Represents an entry and a target.
+* `target` - (Required) Represents the map target.
+
+The `restricted` option is achieved using the following mapping:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+### Posix Profile
+
+* `gid` - (Required) The POSIX group ID used for all EFS operations by this user.
+* `uid` - (Required) The POSIX user ID used for all EFS operations by this user.
+* `secondaryGids` - (Optional) The secondary POSIX group IDs used for all EFS operations by this user.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of Transfer User
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `delete` - (Default `10M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Transfer Users using the `serverId` and `userName` separated by `/`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Transfer Users using the `serverId` and `userName` separated by `/`. For example:
+
+```console
+% terraform import aws_transfer_user.bar s-12345678/test-username
+```
+
+<!-- cache-key: cdktf-0.18.0 input-20283ed3a3e6abff667008f255442da0f4606486f3db71039d382ec9cd99e4b2 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/transfer_workflow.html.markdown b/website/docs/cdktf/typescript/r/transfer_workflow.html.markdown
new file mode 100644
index 00000000000..b6946b19a6a
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/transfer_workflow.html.markdown
@@ -0,0 +1,193 @@
+---
+subcategory: "Transfer Family"
+layout: "aws"
+page_title: "AWS: aws_transfer_workflow"
+description: |-
+  Provides a AWS Transfer Workflow resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_transfer_workflow
+
+Provides a AWS Transfer Workflow resource.
+
+## Example Usage
+
+### Basic single step example
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { TransferWorkflow } from "./.gen/providers/aws/transfer-workflow";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new TransferWorkflow(this, "example", {
+      steps: [
+        {
+          deleteStepDetails: {
+            name: "example",
+            sourceFileLocation: "$${original.file}",
+          },
+          type: "DELETE",
+        },
+      ],
+    });
+  }
+}
+
+```
+
+### Multistep example
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { TransferWorkflow } from "./.gen/providers/aws/transfer-workflow";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new TransferWorkflow(this, "example", {
+      steps: [
+        {
+          customStepDetails: {
+            name: "example",
+            sourceFileLocation: "$${original.file}",
+            target: Token.asString(awsLambdaFunctionExample.arn),
+            timeoutSeconds: 60,
+          },
+          type: "CUSTOM",
+        },
+        {
+          tagStepDetails: {
+            name: "example",
+            sourceFileLocation: "$${original.file}",
+            tags: [
+              {
+                key: "Name",
+                value: "Hello World",
+              },
+            ],
+          },
+          type: "TAG",
+        },
+      ],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `description` - (Optional) A textual description for the workflow.
+* `onExceptionSteps` - (Optional) Specifies the steps (actions) to take if errors are encountered during execution of the workflow. See Workflow Steps below.
+* `steps` - (Required) Specifies the details for the steps that are in the specified workflow. See Workflow Steps below.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Workflow Steps
+
+* `copyStepDetails` - (Optional) Details for a step that performs a file copy. See Copy Step Details below.
+* `customStepDetails` - (Optional) Details for a step that invokes a lambda function.
+* `decryptStepDetails` - (Optional) Details for a step that decrypts the file.
+* `deleteStepDetails` - (Optional) Details for a step that deletes the file.
+* `tagStepDetails` - (Optional) Details for a step that creates one or more tags.
+* `type` - (Required) One of the following step types are supported. `copy`, `custom`, `decrypt`, `delete`, and `tag`.
+
+#### Copy Step Details
+
+* `destinationFileLocation` - (Optional) Specifies the location for the file being copied. Use ${Transfer:username} in this field to parametrize the destination prefix by username.
+* `name` - (Optional) The name of the step, used as an identifier.
+* `overwriteExisting` - (Optional) A flag that indicates whether or not to overwrite an existing file of the same name. The default is `false`. Valid values are `true` and `false`.
+* `sourceFileLocation` - (Optional) Specifies which file to use as input to the workflow step: either the output from the previous step, or the originally uploaded file for the workflow. Enter ${previous.file} to use the previous file as the input. In this case, this workflow step uses the output file from the previous workflow step as input. This is the default value. Enter ${original.file} to use the originally-uploaded file location as input for this step.
+
+#### Custom Step Details
+
+* `name` - (Optional) The name of the step, used as an identifier.
+* `sourceFileLocation` - (Optional) Specifies which file to use as input to the workflow step: either the output from the previous step, or the originally uploaded file for the workflow. Enter ${previous.file} to use the previous file as the input. In this case, this workflow step uses the output file from the previous workflow step as input. This is the default value. Enter ${original.file} to use the originally-uploaded file location as input for this step.
+* `target` - (Optional) The ARN for the lambda function that is being called.
+* `timeoutSeconds` - (Optional) Timeout, in seconds, for the step.
+
+#### Decrypt Step Details
+
+* `destinationFileLocation` - (Optional) Specifies the location for the file being copied. Use ${Transfer:username} in this field to parametrize the destination prefix by username.
+* `name` - (Optional) The name of the step, used as an identifier.
+* `overwriteExisting` - (Optional) A flag that indicates whether or not to overwrite an existing file of the same name. The default is `false`. Valid values are `true` and `false`.
+* `sourceFileLocation` - (Optional) Specifies which file to use as input to the workflow step: either the output from the previous step, or the originally uploaded file for the workflow. Enter ${previous.file} to use the previous file as the input. In this case, this workflow step uses the output file from the previous workflow step as input. This is the default value. Enter ${original.file} to use the originally-uploaded file location as input for this step.
+* `type` - (Required) The type of encryption used. Currently, this value must be `"pgp"`.
+
+#### Delete Step Details
+
+* `name` - (Optional) The name of the step, used as an identifier.
+* `sourceFileLocation` - (Optional) Specifies which file to use as input to the workflow step: either the output from the previous step, or the originally uploaded file for the workflow. Enter ${previous.file} to use the previous file as the input. In this case, this workflow step uses the output file from the previous workflow step as input. This is the default value. Enter ${original.file} to use the originally-uploaded file location as input for this step.
+
+#### Tag Step Details
+
+* `name` - (Optional) The name of the step, used as an identifier.
+* `sourceFileLocation` - (Optional) Specifies which file to use as input to the workflow step: either the output from the previous step, or the originally uploaded file for the workflow. Enter ${previous.file} to use the previous file as the input. In this case, this workflow step uses the output file from the previous workflow step as input. This is the default value. Enter ${original.file} to use the originally-uploaded file location as input for this step.
+* `tags` - (Optional) Array that contains from 1 to 10 key/value pairs. See S3 Tags below.
+
+##### Destination File Location
+
+* `efsFileLocation` - (Optional) Specifies the details for the EFS file being copied.
+* `s3FileLocation` - (Optional) Specifies the details for the S3 file being copied.
+
+###### EFS File Location
+
+* `fileSystemId` - (Optional) The ID of the file system, assigned by Amazon EFS.
+* `path` - (Optional) The pathname for the folder being used by a workflow.
+
+###### S3 File Location
+
+* `bucket` - (Optional) Specifies the S3 bucket for the customer input file.
+* `key` - (Optional) The name assigned to the file when it was created in S3. You use the object key to retrieve the object.
+
+##### S3 Tag
+
+* `key` - (Required) The name assigned to the tag that you create.
+* `value` - (Required) The value that corresponds to the key.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Workflow ARN.
+* `id` - The Workflow id.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Transfer Workflows using the `worflowId`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Transfer Workflows using the `worflowId`. For example:
+
+```console
+% terraform import aws_transfer_workflow.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-cd26b4eb2c7b6d9241f3db734757f36018a8ddd76361c4116bc6c49c94847364 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/verifiedaccess_group.html.markdown b/website/docs/cdktf/typescript/r/verifiedaccess_group.html.markdown
new file mode 100644
index 00000000000..2e892a6531b
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/verifiedaccess_group.html.markdown
@@ -0,0 +1,72 @@
+---
+subcategory: "Verified Access"
+layout: "aws"
+page_title: "AWS: aws_verifiedaccess_group"
+description: |-
+  Terraform resource for managing a Verified Access Group.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_verifiedaccess_group
+
+Terraform resource for managing a Verified Access Group.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { VerifiedaccessGroup } from "./.gen/providers/aws/verifiedaccess-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new VerifiedaccessGroup(this, "example", {
+      verifiedaccessInstanceId: Token.asString(
+        awsVerifiedaccessInstanceExample.id
+      ),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `verifiedaccessInstanceId` - (Required) The id of the verified access instance this group is associated with.
+
+The following arguments are optional:
+
+* `description` - (Optional) Description of the verified access group.
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `policyDocment` - (Optional) The policy document that is associated with this resource.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `creationTime` - Timestamp when the access group was created.
+* `deletionTime` - Timestamp when the access group was deleted.
+* `lastUpdatedTime` - Timestamp when the access group was last updated.
+* `owner` - AWS account number owning this resource.
+* `verifiedaccessGroupArn` - ARN of this verified acess group.
+* `verifiedaccessGroupId` - ID of this verified access group.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `60M`)
+* `update` - (Default `180M`)
+* `delete` - (Default `90M`)
+
+<!-- cache-key: cdktf-0.18.0 input-74642a11cfb0cd052c78234e7ffeb2b3744dcc462e3e42eceff666725d831322 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/verifiedaccess_instance.html.markdown b/website/docs/cdktf/typescript/r/verifiedaccess_instance.html.markdown
new file mode 100644
index 00000000000..00e58a6d0ef
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/verifiedaccess_instance.html.markdown
@@ -0,0 +1,113 @@
+---
+subcategory: "Verified Access"
+layout: "aws"
+page_title: "AWS: aws_verifiedaccess_instance"
+description: |-
+  Terraform resource for managing a Verified Access Instance.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_verifiedaccess_instance
+
+Terraform resource for managing a Verified Access Instance.
+
+## Example Usage
+
+### Basic
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { VerifiedaccessInstance } from "./.gen/providers/aws/verifiedaccess-instance";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new VerifiedaccessInstance(this, "example", {
+      description: "example",
+      tags: {
+        Name: "example",
+      },
+    });
+  }
+}
+
+```
+
+### With `fipsEnabled`
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { VerifiedaccessInstance } from "./.gen/providers/aws/verifiedaccess-instance";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new VerifiedaccessInstance(this, "example", {
+      fipsEnabled: true,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are optional:
+
+* `description` - (Optional) A description for the AWS Verified Access Instance.
+* `fipsEnabled` - (Optional, Forces new resource) Enable or disable support for Federal Information Processing Standards (FIPS) on the AWS Verified Access Instance.
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `creationTime` - The time that the Verified Access Instance was created.
+* `id` - The ID of the AWS Verified Access Instance.
+* `lastUpdatedTime` - The time that the Verified Access Instance was last updated.
+* `verifiedAccessTrustProviders` - One or more blocks of providing information about the AWS Verified Access Trust Providers. See [verified_access_trust_providers](#verified_access_trust_providers) below for details.One or more blocks
+
+### verified_access_trust_providers
+
+Each `verifiedAccessTrustProviders` supports the following argument:
+
+* `description` - The description of trust provider.
+* `deviceTrustProviderType` - The type of device-based trust provider.
+* `trustProviderType` - The type of trust provider (user- or device-based).
+* `userTrustProviderType` - The type of user-based trust provider.
+* `verifiedAccessTrustProviderId` - The ID of the trust provider.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Verified Access Instances using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Verified Access Instances using the  `id`. For example:
+
+```console
+% terraform import aws_verifiedaccess_instance.example vai-1234567890abcdef0
+```
+
+<!-- cache-key: cdktf-0.18.0 input-c933a4a83a27d8a7c453603ace502b409683c5a0ec3444abd304067d056ba8ad -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/verifiedaccess_instance_logging_configuration.html.markdown b/website/docs/cdktf/typescript/r/verifiedaccess_instance_logging_configuration.html.markdown
new file mode 100644
index 00000000000..e41de8019bb
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/verifiedaccess_instance_logging_configuration.html.markdown
@@ -0,0 +1,270 @@
+---
+subcategory: "Verified Access"
+layout: "aws"
+page_title: "AWS: aws_verifiedaccess_instance_logging_configuration"
+description: |-
+  Terraform resource for managing a Verified Access Instance Logging Configuration.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_verifiedaccess_instance_logging_configuration
+
+Terraform resource for managing a Verified Access Logging Configuration.
+
+## Example Usage
+
+### With CloudWatch Logging
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { VerifiedaccessInstanceLoggingConfiguration } from "./.gen/providers/aws/verifiedaccess-instance-logging-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new VerifiedaccessInstanceLoggingConfiguration(this, "example", {
+      accessLogs: {
+        cloudwatchLogs: {
+          enabled: true,
+          logGroup: Token.asString(awsCloudwatchLogGroupExample.id),
+        },
+      },
+      verifiedaccessInstanceId: Token.asString(
+        awsVerifiedaccessInstanceExample.id
+      ),
+    });
+  }
+}
+
+```
+
+### With Kinesis Data Firehose Logging
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { VerifiedaccessInstanceLoggingConfiguration } from "./.gen/providers/aws/verifiedaccess-instance-logging-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new VerifiedaccessInstanceLoggingConfiguration(this, "example", {
+      accessLogs: {
+        kinesisDataFirehose: {
+          deliveryStream: Token.asString(
+            awsKinesisFirehoseDeliveryStreamExample.name
+          ),
+          enabled: true,
+        },
+      },
+      verifiedaccessInstanceId: Token.asString(
+        awsVerifiedaccessInstanceExample.id
+      ),
+    });
+  }
+}
+
+```
+
+### With S3 logging
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { VerifiedaccessInstanceLoggingConfiguration } from "./.gen/providers/aws/verifiedaccess-instance-logging-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new VerifiedaccessInstanceLoggingConfiguration(this, "example", {
+      accessLogs: {
+        s3: {
+          bucketName: Token.asString(awsS3BucketExample.id),
+          enabled: true,
+          prefix: "example",
+        },
+      },
+      verifiedaccessInstanceId: Token.asString(
+        awsVerifiedaccessInstanceExample.id
+      ),
+    });
+  }
+}
+
+```
+
+### With all three logging options
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { VerifiedaccessInstanceLoggingConfiguration } from "./.gen/providers/aws/verifiedaccess-instance-logging-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new VerifiedaccessInstanceLoggingConfiguration(this, "example", {
+      accessLogs: {
+        cloudwatchLogs: {
+          enabled: true,
+          logGroup: Token.asString(awsCloudwatchLogGroupExample.id),
+        },
+        kinesisDataFirehose: {
+          deliveryStream: Token.asString(
+            awsKinesisFirehoseDeliveryStreamExample.name
+          ),
+          enabled: true,
+        },
+        s3: {
+          bucketName: Token.asString(awsS3BucketExample.id),
+          enabled: true,
+        },
+      },
+      verifiedaccessInstanceId: Token.asString(
+        awsVerifiedaccessInstanceExample.id
+      ),
+    });
+  }
+}
+
+```
+
+### With `includeTrustContext`
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { VerifiedaccessInstanceLoggingConfiguration } from "./.gen/providers/aws/verifiedaccess-instance-logging-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new VerifiedaccessInstanceLoggingConfiguration(this, "example", {
+      accessLogs: {
+        includeTrustContext: true,
+      },
+      verifiedaccessInstanceId: Token.asString(
+        awsVerifiedaccessInstanceExample.id
+      ),
+    });
+  }
+}
+
+```
+
+### With `logVersion`
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { VerifiedaccessInstanceLoggingConfiguration } from "./.gen/providers/aws/verifiedaccess-instance-logging-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new VerifiedaccessInstanceLoggingConfiguration(this, "example", {
+      accessLogs: {
+        logVersion: "ocsf-1.0.0-rc.2",
+      },
+      verifiedaccessInstanceId: Token.asString(
+        awsVerifiedaccessInstanceExample.id
+      ),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `accessLogs` - (Required) A block that specifies the configuration options for Verified Access instances. [Detailed below](#access_logs).
+* `verifiedaccessInstanceId` - (Required - Forces New resource) The ID of the Verified Access instance.
+
+### access_logs
+
+A `accessLogs` block supports the following arguments:
+
+* `cloudwatchLogs` - (Optional) A block that specifies configures sending Verified Access logs to CloudWatch Logs. [Detailed below](#cloudwatch_logs).
+* `includeTrustContext` - (Optional) Include trust data sent by trust providers into the logs.
+* `kinesisDataFirehose` - (Optional) A block that specifies configures sending Verified Access logs to Kinesis. [Detailed below](#kinesis_data_firehose).
+* `logVersion` - (Optional) The logging version to use. Refer to [VerifiedAccessLogOptions](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_VerifiedAccessLogOptions.html) for the allowed values.
+* `s3` - (Optional) A block that specifies configures sending Verified Access logs to S3. [Detailed below](#s3).
+
+#### cloudwatch_logs
+
+A `cloudwatchLogs` block supports the following arguments:
+
+* `enabled` - (Required) Indicates whether logging is enabled.
+* `logGroup` - (Optional) The name of the CloudWatch Logs Log Group.
+
+#### kinesis_data_firehose
+
+A `kinesisDataFirehose` block supports the following arguments:
+
+* `deliveryStream` - (Optional) The name of the delivery stream.
+* `enabled` - (Required) Indicates whether logging is enabled.
+
+#### s3
+
+A `s3` block supports the following arguments:
+
+* `bucketName` - (Optional) The name of S3 bucket.
+* `bucketOwner` - (Optional) The ID of the AWS account that owns the Amazon S3 bucket.
+* `enabled` - (Required) Indicates whether logging is enabled.
+* `prefix` - (Optional) The bucket prefix.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Verified Access Logging Configuration using the Verified Access Instance `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Verified Access Logging Configuration using the Verified Access Instance `id`. For example:
+
+```console
+% terraform import aws_verifiedaccess_instance_logging_configuration.example vai-1234567890abcdef0
+```
+
+<!-- cache-key: cdktf-0.18.0 input-79065eedd6b6f9585bd07a6cdc493096940c3c74f302f0f330a123cc337d069b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/verifiedaccess_instance_trust_provider_attachment.html.markdown b/website/docs/cdktf/typescript/r/verifiedaccess_instance_trust_provider_attachment.html.markdown
new file mode 100644
index 00000000000..5d6c33f04c6
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/verifiedaccess_instance_trust_provider_attachment.html.markdown
@@ -0,0 +1,94 @@
+---
+subcategory: "Verified Access"
+layout: "aws"
+page_title: "AWS: aws_verifiedaccess_instance_trust_provider_attachment"
+description: |-
+  Terraform resource for managing a Verified Access Instance Trust Provider Attachment.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_verifiedaccess_instance_trust_provider_attachment
+
+Terraform resource for managing a Verified Access Instance Trust Provider Attachment.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { VerifiedaccessInstance } from "./.gen/providers/aws/verifiedaccess-instance";
+import { VerifiedaccessInstanceTrustProviderAttachment } from "./.gen/providers/aws/verifiedaccess-instance-trust-provider-attachment";
+import { VerifiedaccessTrustProvider } from "./.gen/providers/aws/verifiedaccess-trust-provider";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new VerifiedaccessInstance(this, "example", {});
+    const awsVerifiedaccessTrustProviderExample =
+      new VerifiedaccessTrustProvider(this, "example_1", {
+        deviceOptions: {
+          tenantId: "example",
+        },
+        deviceTrustProviderType: "jamf",
+        policyReferenceName: "example",
+        trustProviderType: "device",
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsVerifiedaccessTrustProviderExample.overrideLogicalId("example");
+    const awsVerifiedaccessInstanceTrustProviderAttachmentExample =
+      new VerifiedaccessInstanceTrustProviderAttachment(this, "example_2", {
+        verifiedaccessInstanceId: example.id,
+        verifiedaccessTrustProviderId: Token.asString(
+          awsVerifiedaccessTrustProviderExample.id
+        ),
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsVerifiedaccessInstanceTrustProviderAttachmentExample.overrideLogicalId(
+      "example"
+    );
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `verifiedaccessInstanceId` - (Required) The ID of the Verified Access instance to attach the Trust Provider to.
+* `verifiedaccessTrustProviderId` - (Required) The ID of the Verified Access trust provider.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - A combination of attributes, separated by a `/` to create a unique id: `verifiedaccessInstanceId`,`verifiedaccessTrustProviderId`
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Verified Access Instance Trust Provider Attachments using the `verifiedaccessInstanceId` and `verifiedaccessTrustProviderId` separated by a forward slash (`/`). For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Verified Access Instance Trust Provider Attachments using the `verifiedaccessInstanceId` and `verifiedaccessTrustProviderId` separated by a forward slash (`/`). For example:
+
+```console
+% terraform import aws_verifiedaccess_instance_trust_provider_attachment.example vai-1234567890abcdef0/vatp-8012925589
+```
+
+<!-- cache-key: cdktf-0.18.0 input-0166dda69fa58c229770979a9c41f2063a0855d337e923d65532e9982cc3d392 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/verifiedaccess_trust_provider.html.markdown b/website/docs/cdktf/typescript/r/verifiedaccess_trust_provider.html.markdown
new file mode 100644
index 00000000000..b5d2c4db47c
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/verifiedaccess_trust_provider.html.markdown
@@ -0,0 +1,91 @@
+---
+subcategory: "Verified Access"
+layout: "aws"
+page_title: "AWS: aws_verifiedaccess_trust_provider"
+description: |-
+  Terraform resource for managing a Verified Access Trust Provider.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_verifiedaccess_trust_provider
+
+Terraform resource for managing a Verified Access Trust Provider.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { VerifiedaccessTrustProvider } from "./.gen/providers/aws/verifiedaccess-trust-provider";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new VerifiedaccessTrustProvider(this, "example", {
+      policyReferenceName: "example",
+      trustProviderType: "user",
+      userTrustProviderType: "iam-identity-center",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `policyReferenceName` - (Required) The identifier to be used when working with policy rules.
+* `trustProviderType` - (Required) The type of trust provider can be either user or device-based.
+
+The following arguments are optional:
+
+* `description` - (Optional) A description for the AWS Verified Access trust provider.
+* `deviceOptions` - (Optional) A block of options for device identity based trust providers.
+* `deviceTrustProviderType` (Optional) The type of device-based trust provider.
+* `oidcOptions` - (Optional) The OpenID Connect details for an oidc-type, user-identity based trust provider.
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `userTrustProviderType` - (Optional) The type of user-based trust provider.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the AWS Verified Access trust provider.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `60M`)
+* `update` - (Default `180M`)
+* `delete` - (Default `90M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Transfer Workflows using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Transfer Workflows using the  `id`. For example:
+
+```console
+% terraform import aws_verifiedaccess_trust_provider.example vatp-8012925589
+```
+
+<!-- cache-key: cdktf-0.18.0 input-2750aebf3d558cbde0da2f4c4cdd13becc482ee01d0d3f03dd896dff73393961 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/volume_attachment.html.markdown b/website/docs/cdktf/typescript/r/volume_attachment.html.markdown
new file mode 100644
index 00000000000..fab92aacd14
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/volume_attachment.html.markdown
@@ -0,0 +1,110 @@
+---
+subcategory: "EBS (EC2)"
+layout: "aws"
+page_title: "AWS: aws_volume_attachment"
+description: |-
+  Provides an AWS EBS Volume Attachment
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_volume_attachment
+
+Provides an AWS EBS Volume Attachment as a top level resource, to attach and
+detach volumes from AWS Instances.
+
+~> **NOTE on EBS block devices:** If you use `ebsBlockDevice` on an `awsInstance`, Terraform will assume management over the full set of non-root EBS block devices for the instance, and treats additional block devices as drift. For this reason, `ebsBlockDevice` cannot be mixed with external `awsEbsVolume` + `awsVolumeAttachment` resources for a given instance.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { EbsVolume } from "./.gen/providers/aws/ebs-volume";
+import { Instance } from "./.gen/providers/aws/instance";
+import { VolumeAttachment } from "./.gen/providers/aws/volume-attachment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new EbsVolume(this, "example", {
+      availabilityZone: "us-west-2a",
+      size: 1,
+    });
+    const web = new Instance(this, "web", {
+      ami: "ami-21f78e11",
+      availabilityZone: "us-west-2a",
+      instanceType: "t2.micro",
+      tags: {
+        Name: "HelloWorld",
+      },
+    });
+    new VolumeAttachment(this, "ebs_att", {
+      deviceName: "/dev/sdh",
+      instanceId: web.id,
+      volumeId: example.id,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `deviceName` - (Required) The device name to expose to the instance (for
+example, `/dev/sdh` or `xvdh`).  See [Device Naming on Linux Instances][1] and [Device Naming on Windows Instances][2] for more information.
+* `instanceId` - (Required) ID of the Instance to attach to
+* `volumeId` - (Required) ID of the Volume to be attached
+* `forceDetach` - (Optional, Boolean) Set to `true` if you want to force the
+volume to detach. Useful if previous attempts failed, but use this option only
+as a last resort, as this can result in **data loss**. See
+[Detaching an Amazon EBS Volume from an Instance][3] for more information.
+* `skipDestroy` - (Optional, Boolean) Set this to true if you do not wish
+to detach the volume from the instance to which it is attached at destroy
+time, and instead just remove the attachment from Terraform state. This is
+useful when destroying an instance which has volumes created by some other
+means attached.
+* `stopInstanceBeforeDetaching` - (Optional, Boolean) Set this to true to ensure that the target instance is stopped
+before trying to detach the volume. Stops the instance, if it is not already stopped.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `deviceName` - The device name exposed to the instance
+* `instanceId` - ID of the Instance
+* `volumeId` - ID of the Volume
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EBS Volume Attachments using `deviceName:volumeId:instanceId`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import EBS Volume Attachments using `deviceName:volumeId:instanceId`. For example:
+
+```console
+% terraform import aws_volume_attachment.example /dev/sdh:vol-049df61146c4d7901:i-12345678
+```
+
+[1]: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/device_naming.html#available-ec2-device-names
+[2]: https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/device_naming.html#available-ec2-device-names
+[3]: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-detaching-volume.html
+
+<!-- cache-key: cdktf-0.18.0 input-8d70c75bb952f6c2a4ba80ab20190c8861ad57f287b2752a94e208c0c56f0a76 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/vpc.html.markdown b/website/docs/cdktf/typescript/r/vpc.html.markdown
new file mode 100644
index 00000000000..7e033e36ae6
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/vpc.html.markdown
@@ -0,0 +1,177 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_vpc"
+description: |-
+  Provides a VPC resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_vpc
+
+Provides a VPC resource.
+
+## Example Usage
+
+Basic usage:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Vpc } from "./.gen/providers/aws/vpc";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Vpc(this, "main", {
+      cidrBlock: "10.0.0.0/16",
+    });
+  }
+}
+
+```
+
+Basic usage with tags:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Vpc } from "./.gen/providers/aws/vpc";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Vpc(this, "main", {
+      cidrBlock: "10.0.0.0/16",
+      instanceTenancy: "default",
+      tags: {
+        Name: "main",
+      },
+    });
+  }
+}
+
+```
+
+VPC with CIDR from AWS IPAM:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsRegion } from "./.gen/providers/aws/data-aws-region";
+import { Vpc } from "./.gen/providers/aws/vpc";
+import { VpcIpam } from "./.gen/providers/aws/vpc-ipam";
+import { VpcIpamPool } from "./.gen/providers/aws/vpc-ipam-pool";
+import { VpcIpamPoolCidr } from "./.gen/providers/aws/vpc-ipam-pool-cidr";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const current = new DataAwsRegion(this, "current", {});
+    const test = new VpcIpam(this, "test", {
+      operatingRegions: [
+        {
+          regionName: Token.asString(current.name),
+        },
+      ],
+    });
+    const awsVpcIpamPoolTest = new VpcIpamPool(this, "test_2", {
+      addressFamily: "ipv4",
+      ipamScopeId: test.privateDefaultScopeId,
+      locale: Token.asString(current.name),
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsVpcIpamPoolTest.overrideLogicalId("test");
+    const awsVpcIpamPoolCidrTest = new VpcIpamPoolCidr(this, "test_3", {
+      cidr: "172.20.0.0/16",
+      ipamPoolId: Token.asString(awsVpcIpamPoolTest.id),
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsVpcIpamPoolCidrTest.overrideLogicalId("test");
+    const awsVpcTest = new Vpc(this, "test_4", {
+      dependsOn: [awsVpcIpamPoolCidrTest],
+      ipv4IpamPoolId: Token.asString(awsVpcIpamPoolTest.id),
+      ipv4NetmaskLength: 28,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsVpcTest.overrideLogicalId("test");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `cidrBlock` - (Optional) The IPv4 CIDR block for the VPC. CIDR can be explicitly set or it can be derived from IPAM using `ipv4NetmaskLength`.
+* `instanceTenancy` - (Optional) A tenancy option for instances launched into the VPC. Default is `default`, which ensures that EC2 instances launched in this VPC use the EC2 instance tenancy attribute specified when the EC2 instance is launched. The only other option is `dedicated`, which ensures that EC2 instances launched in this VPC are run on dedicated tenancy instances regardless of the tenancy attribute specified at launch. This has a dedicated per region fee of $2 per hour, plus an hourly per instance usage fee.
+* `ipv4IpamPoolId` - (Optional) The ID of an IPv4 IPAM pool you want to use for allocating this VPC's CIDR. IPAM is a VPC feature that you can use to automate your IP address management workflows including assigning, tracking, troubleshooting, and auditing IP addresses across AWS Regions and accounts. Using IPAM you can monitor IP address usage throughout your AWS Organization.
+* `ipv4NetmaskLength` - (Optional) The netmask length of the IPv4 CIDR you want to allocate to this VPC. Requires specifying a `ipv4IpamPoolId`.
+* `ipv6CidrBlock` - (Optional) IPv6 CIDR block to request from an IPAM Pool. Can be set explicitly or derived from IPAM using `ipv6NetmaskLength`.
+* `ipv6IpamPoolId` - (Optional) IPAM Pool ID for a IPv6 pool. Conflicts with `assignGeneratedIpv6CidrBlock`.
+* `ipv6NetmaskLength` - (Optional) Netmask length to request from IPAM Pool. Conflicts with `ipv6CidrBlock`. This can be omitted if IPAM pool as a `allocationDefaultNetmaskLength` set. Valid values: `56`.
+* `ipv6CidrBlockNetworkBorderGroup` - (Optional) By default when an IPv6 CIDR is assigned to a VPC a default ipv6_cidr_block_network_border_group will be set to the region of the VPC. This can be changed to restrict advertisement of public addresses to specific Network Border Groups such as LocalZones.
+* `enableDnsSupport` - (Optional) A boolean flag to enable/disable DNS support in the VPC. Defaults to true.
+* `enableNetworkAddressUsageMetrics` - (Optional) Indicates whether Network Address Usage metrics are enabled for your VPC. Defaults to false.
+* `enableDnsHostnames` - (Optional) A boolean flag to enable/disable DNS hostnames in the VPC. Defaults false.
+* `assignGeneratedIpv6CidrBlock` - (Optional) Requests an Amazon-provided IPv6 CIDR block with a /56 prefix length for the VPC. You cannot specify the range of IP addresses, or the size of the CIDR block. Default is `false`. Conflicts with `ipv6IpamPoolId`
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of VPC
+* `id` - The ID of the VPC
+* `instanceTenancy` - Tenancy of instances spin up within VPC
+* `enableDnsSupport` - Whether or not the VPC has DNS support
+* `enableNetworkAddressUsageMetrics` - Whether Network Address Usage metrics are enabled for the VPC
+* `enableDnsHostnames` - Whether or not the VPC has DNS hostname support
+* `mainRouteTableId` - The ID of the main route table associated with
+     this VPC. Note that you can change a VPC's main route table by using an
+     [`awsMainRouteTableAssociation`](/docs/providers/aws/r/main_route_table_association.html).
+* `defaultNetworkAclId` - The ID of the network ACL created by default on VPC creation
+* `defaultSecurityGroupId` - The ID of the security group created by default on VPC creation
+* `defaultRouteTableId` - The ID of the route table created by default on VPC creation
+* `ipv6AssociationId` - The association ID for the IPv6 CIDR block.
+* `ipv6CidrBlockNetworkBorderGroup` - The Network Border Group Zone name
+* `ownerId` - The ID of the AWS account that owns the VPC.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import VPCs using the VPC `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import VPCs using the VPC `id`. For example:
+
+```console
+% terraform import aws_vpc.test_vpc vpc-a01106c2
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ae6df6e7b2fd061f8aef4637ee76c64d6bc7f7657d175ee9d2e9140d0df3c94b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/vpc_dhcp_options.html.markdown b/website/docs/cdktf/typescript/r/vpc_dhcp_options.html.markdown
new file mode 100644
index 00000000000..74fb546d929
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/vpc_dhcp_options.html.markdown
@@ -0,0 +1,121 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_vpc_dhcp_options"
+description: |-
+  Provides a VPC DHCP Options resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_vpc_dhcp_options
+
+Provides a VPC DHCP Options resource.
+
+## Example Usage
+
+Basic usage:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { VpcDhcpOptions } from "./.gen/providers/aws/vpc-dhcp-options";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new VpcDhcpOptions(this, "dns_resolver", {
+      domainNameServers: ["8.8.8.8", "8.8.4.4"],
+    });
+  }
+}
+
+```
+
+Full usage:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { VpcDhcpOptions } from "./.gen/providers/aws/vpc-dhcp-options";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new VpcDhcpOptions(this, "foo", {
+      domainName: "service.consul",
+      domainNameServers: ["127.0.0.1", "10.0.0.2"],
+      netbiosNameServers: ["127.0.0.1"],
+      netbiosNodeType: Token.asString(2),
+      ntpServers: ["127.0.0.1"],
+      tags: {
+        Name: "foo-name",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `domainName` - (Optional) the suffix domain name to use by default when resolving non Fully Qualified Domain Names. In other words, this is what ends up being the `search` value in the `/etc/resolvConf` file.
+* `domainNameServers` - (Optional) List of name servers to configure in `/etc/resolvConf`. If you want to use the default AWS nameservers you should set this to `amazonProvidedDns`.
+* `ntpServers` - (Optional) List of NTP servers to configure.
+* `netbiosNameServers` - (Optional) List of NETBIOS name servers.
+* `netbiosNodeType` - (Optional) The NetBIOS node type (1, 2, 4, or 8). AWS recommends to specify 2 since broadcast and multicast are not supported in their network. For more information about these node types, see [RFC 2132](http://www.ietf.org/rfc/rfc2132.txt).
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Remarks
+
+* Notice that all arguments are optional but you have to specify at least one argument.
+* `domainNameServers`, `netbiosNameServers`, `ntpServers` are limited by AWS to maximum four servers only.
+* To actually use the DHCP Options Set you need to associate it to a VPC using [`awsVpcDhcpOptionsAssociation`](/docs/providers/aws/r/vpc_dhcp_options_association.html).
+* If you delete a DHCP Options Set, all VPCs using it will be associated to AWS's `default` DHCP Option Set.
+* In most cases unless you're configuring your own DNS you'll want to set `domainNameServers` to `amazonProvidedDns`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the DHCP Options Set.
+* `arn` - The ARN of the DHCP Options Set.
+* `ownerId` - The ID of the AWS account that owns the DHCP options set.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+You can find more technical documentation about DHCP Options Set in the
+official [AWS User Guide](https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_DHCP_Options.html).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import VPC DHCP Options using the DHCP Options `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import VPC DHCP Options using the DHCP Options `id`. For example:
+
+```console
+% terraform import aws_vpc_dhcp_options.my_options dopt-d9070ebb
+```
+
+<!-- cache-key: cdktf-0.18.0 input-e86ad5600e185c6fcfac37962334f477301d705d06ab42100c161640170994e2 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/vpc_dhcp_options_association.html.markdown b/website/docs/cdktf/typescript/r/vpc_dhcp_options_association.html.markdown
new file mode 100644
index 00000000000..e6d50b6e8d7
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/vpc_dhcp_options_association.html.markdown
@@ -0,0 +1,78 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_vpc_dhcp_options_association"
+description: |-
+  Provides a VPC DHCP Options Association resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_vpc_dhcp_options_association
+
+Provides a VPC DHCP Options Association resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { VpcDhcpOptionsAssociation } from "./.gen/providers/aws/vpc-dhcp-options-association";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new VpcDhcpOptionsAssociation(this, "dns_resolver", {
+      dhcpOptionsId: foo.id,
+      vpcId: Token.asString(awsVpcFoo.id),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `vpcId` - (Required) The ID of the VPC to which we would like to associate a DHCP Options Set.
+* `dhcpOptionsId` - (Required) The ID of the DHCP Options Set to associate to the VPC.
+
+## Remarks
+
+* You can only associate one DHCP Options Set to a given VPC ID.
+* Removing the DHCP Options Association automatically sets AWS's `default` DHCP Options Set to the VPC.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the DHCP Options Set Association.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DHCP associations using the VPC ID associated with the options. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import DHCP associations using the VPC ID associated with the options. For example:
+
+```console
+% terraform import aws_vpc_dhcp_options_association.imported vpc-0f001273ec18911b1
+```
+
+<!-- cache-key: cdktf-0.18.0 input-38bb6adf7a2cdaed08e8a7d0f22e47d0c02836ef15bfce74b53d370722c7efd7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/vpc_endpoint.html.markdown b/website/docs/cdktf/typescript/r/vpc_endpoint.html.markdown
new file mode 100644
index 00000000000..117857c9af0
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/vpc_endpoint.html.markdown
@@ -0,0 +1,262 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_vpc_endpoint"
+description: |-
+  Provides a VPC Endpoint resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_vpc_endpoint
+
+Provides a VPC Endpoint resource.
+
+~> **NOTE on VPC Endpoints and VPC Endpoint Associations:** Terraform provides both standalone VPC Endpoint Associations for
+[Route Tables](vpc_endpoint_route_table_association.html) - (an association between a VPC endpoint and a single `routeTableId`),
+[Security Groups](vpc_endpoint_security_group_association.html) - (an association between a VPC endpoint and a single `securityGroupId`),
+and [Subnets](vpc_endpoint_subnet_association.html) - (an association between a VPC endpoint and a single `subnetId`) and
+a VPC Endpoint resource with `routeTableIds` and `subnetIds` attributes.
+Do not use the same resource ID in both a VPC Endpoint resource and a VPC Endpoint Association resource.
+Doing so will cause a conflict of associations and will overwrite the association.
+
+## Example Usage
+
+### Basic
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { VpcEndpoint } from "./.gen/providers/aws/vpc-endpoint";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new VpcEndpoint(this, "s3", {
+      serviceName: "com.amazonaws.us-west-2.s3",
+      vpcId: main.id,
+    });
+  }
+}
+
+```
+
+### Basic w/ Tags
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { VpcEndpoint } from "./.gen/providers/aws/vpc-endpoint";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new VpcEndpoint(this, "s3", {
+      serviceName: "com.amazonaws.us-west-2.s3",
+      tags: {
+        Environment: "test",
+      },
+      vpcId: main.id,
+    });
+  }
+}
+
+```
+
+### Interface Endpoint Type
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { VpcEndpoint } from "./.gen/providers/aws/vpc-endpoint";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new VpcEndpoint(this, "ec2", {
+      privateDnsEnabled: true,
+      securityGroupIds: [sg1.id],
+      serviceName: "com.amazonaws.us-west-2.ec2",
+      vpcEndpointType: "Interface",
+      vpcId: main.id,
+    });
+  }
+}
+
+```
+
+### Gateway Load Balancer Endpoint Type
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCallerIdentity } from "./.gen/providers/aws/data-aws-caller-identity";
+import { VpcEndpoint } from "./.gen/providers/aws/vpc-endpoint";
+import { VpcEndpointService } from "./.gen/providers/aws/vpc-endpoint-service";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const current = new DataAwsCallerIdentity(this, "current", {});
+    const example = new VpcEndpointService(this, "example", {
+      acceptanceRequired: false,
+      allowedPrincipals: [Token.asString(current.arn)],
+      gatewayLoadBalancerArns: [Token.asString(awsLbExample.arn)],
+    });
+    const awsVpcEndpointExample = new VpcEndpoint(this, "example_2", {
+      serviceName: example.serviceName,
+      subnetIds: [Token.asString(awsSubnetExample.id)],
+      vpcEndpointType: example.serviceType,
+      vpcId: Token.asString(awsVpcExample.id),
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsVpcEndpointExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### Non-AWS Service
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, Fn, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsRoute53Zone } from "./.gen/providers/aws/data-aws-route53-zone";
+import { Route53Record } from "./.gen/providers/aws/route53-record";
+import { VpcEndpoint } from "./.gen/providers/aws/vpc-endpoint";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const ptfeService = new VpcEndpoint(this, "ptfe_service", {
+      privateDnsEnabled: false,
+      securityGroupIds: [Token.asString(awsSecurityGroupPtfeService.id)],
+      serviceName: Token.asString(varPtfeService.value),
+      subnetIds: [subnetIds],
+      vpcEndpointType: "Interface",
+      vpcId: vpcId.stringValue,
+    });
+    const internal = new DataAwsRoute53Zone(this, "internal", {
+      name: "vpc.internal.",
+      privateZone: true,
+      vpcId: vpcId.stringValue,
+    });
+    const awsRoute53RecordPtfeService = new Route53Record(
+      this,
+      "ptfe_service_2",
+      {
+        name: "ptfe.${" + internal.name + "}",
+        records: [
+          Token.asString(
+            Fn.lookupNested(ptfeService.dnsEntry, ["0", '"dns_name"'])
+          ),
+        ],
+        ttl: Token.asNumber("300"),
+        type: "CNAME",
+        zoneId: Token.asString(internal.zoneId),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsRoute53RecordPtfeService.overrideLogicalId("ptfe_service");
+  }
+}
+
+```
+
+~> **NOTE The `dnsEntry` output is a list of maps:** Terraform interpolation support for lists of maps requires the `lookup` and `[]` until full support of lists of maps is available
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `serviceName` - (Required) The service name. For AWS services the service name is usually in the form `comAmazonaws.<region>.<service>` (the SageMaker Notebook service is an exception to this rule, the service name is in the form `awsSagemaker.<region>Notebook`).
+* `vpcId` - (Required) The ID of the VPC in which the endpoint will be used.
+* `autoAccept` - (Optional) Accept the VPC endpoint (the VPC endpoint and service need to be in the same AWS account).
+* `policy` - (Optional) A policy to attach to the endpoint that controls access to the service. This is a JSON formatted string. Defaults to full access. All `gateway` and some `interface` endpoints support policies - see the [relevant AWS documentation](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-endpoints-access.html) for more details. For more information about building AWS IAM policy documents with Terraform, see the [AWS IAM Policy Document Guide](https://learn.hashicorp.com/terraform/aws/iam-policy).
+* `privateDnsEnabled` - (Optional; AWS services and AWS Marketplace partner services only) Whether or not to associate a private hosted zone with the specified VPC. Applicable for endpoints of type `interface`.
+Defaults to `false`.
+* `dnsOptions` - (Optional) The DNS options for the endpoint. See dns_options below.
+* `ipAddressType` - (Optional) The IP address type for the endpoint. Valid values are `ipv4`, `dualstack`, and `ipv6`.
+* `routeTableIds` - (Optional) One or more route table IDs. Applicable for endpoints of type `gateway`.
+* `subnetIds` - (Optional) The ID of one or more subnets in which to create a network interface for the endpoint. Applicable for endpoints of type `gatewayLoadBalancer` and `interface`.
+* `securityGroupIds` - (Optional) The ID of one or more security groups to associate with the network interface. Applicable for endpoints of type `interface`.
+If no security groups are specified, the VPC's [default security group](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html#DefaultSecurityGroup) is associated with the endpoint.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `vpcEndpointType` - (Optional) The VPC endpoint type, `gateway`, `gatewayLoadBalancer`, or `interface`. Defaults to `gateway`.
+
+### dns_options
+
+* `dnsRecordIpType` - (Optional) The DNS records created for the endpoint. Valid values are `ipv4`, `dualstack`, `serviceDefined`, and `ipv6`.
+* `privateDnsOnlyForInboundResolverEndpoint` - (Optional) Indicates whether to enable private DNS only for inbound endpoints. This option is available only for services that support both gateway and interface endpoints. It routes traffic that originates from the VPC to the gateway endpoint and traffic that originates from on-premises to the interface endpoint. Default is `false`. Can only be specified if private_dns_enabled is `true`.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `10M`)
+- `update` - (Default `10M`)
+- `delete` - (Default `10M`)
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the VPC endpoint.
+* `arn` - The Amazon Resource Name (ARN) of the VPC endpoint.
+* `cidrBlocks` - The list of CIDR blocks for the exposed AWS service. Applicable for endpoints of type `gateway`.
+* `dnsEntry` - The DNS entries for the VPC Endpoint. Applicable for endpoints of type `interface`. DNS blocks are documented below.
+* `networkInterfaceIds` - One or more network interfaces for the VPC Endpoint. Applicable for endpoints of type `interface`.
+* `ownerId` - The ID of the AWS account that owns the VPC endpoint.
+* `prefixListId` - The prefix list ID of the exposed AWS service. Applicable for endpoints of type `gateway`.
+* `requesterManaged` -  Whether or not the VPC Endpoint is being managed by its service - `true` or `false`.
+* `state` - The state of the VPC endpoint.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+DNS blocks (for `dnsEntry`) support the following attributes:
+
+* `dnsName` - The DNS name.
+* `hostedZoneId` - The ID of the private hosted zone.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import VPC Endpoints using the VPC endpoint `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import VPC Endpoints using the VPC endpoint `id`. For example:
+
+```console
+% terraform import aws_vpc_endpoint.endpoint1 vpce-3ecf2a57
+```
+
+<!-- cache-key: cdktf-0.18.0 input-f297fba86f49311b28d9ad61069addf2f69a6357bfa1356f16d2fce2023ca56d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/vpc_endpoint_connection_accepter.html.markdown b/website/docs/cdktf/typescript/r/vpc_endpoint_connection_accepter.html.markdown
new file mode 100644
index 00000000000..932ebbc4dc4
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/vpc_endpoint_connection_accepter.html.markdown
@@ -0,0 +1,99 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_vpc_endpoint_connection_accepter"
+description: |-
+  Provides a resource to accept a pending VPC Endpoint accept request to VPC Endpoint Service.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_vpc_endpoint_connection_accepter
+
+Provides a resource to accept a pending VPC Endpoint Connection accept request to VPC Endpoint Service.
+
+## Example Usage
+
+### Accept cross-account request
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { VpcEndpoint } from "./.gen/providers/aws/vpc-endpoint";
+import { VpcEndpointConnectionAccepter } from "./.gen/providers/aws/vpc-endpoint-connection-accepter";
+import { VpcEndpointService } from "./.gen/providers/aws/vpc-endpoint-service";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new VpcEndpoint(this, "example", {
+      privateDnsEnabled: false,
+      provider: alternate,
+      securityGroupIds: [test.id],
+      serviceName: Token.asString(awsVpcEndpointServiceTest.serviceName),
+      vpcEndpointType: "Interface",
+      vpcId: testAlternate.id,
+    });
+    const awsVpcEndpointServiceExample = new VpcEndpointService(
+      this,
+      "example_1",
+      {
+        acceptanceRequired: false,
+        networkLoadBalancerArns: [Token.asString(awsLbExample.arn)],
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsVpcEndpointServiceExample.overrideLogicalId("example");
+    const awsVpcEndpointConnectionAccepterExample =
+      new VpcEndpointConnectionAccepter(this, "example_2", {
+        vpcEndpointId: example.id,
+        vpcEndpointServiceId: Token.asString(awsVpcEndpointServiceExample.id),
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsVpcEndpointConnectionAccepterExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `vpcEndpointId` - (Required) AWS VPC Endpoint ID.
+* `vpcEndpointServiceId` - (Required) AWS VPC Endpoint Service ID.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the VPC Endpoint Connection.
+* `vpcEndpointState` - State of the VPC Endpoint.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import VPC Endpoint Services using ID of the connection, which is the `VPC Endpoint Service ID` and `VPC Endpoint ID` separated by underscore (`_`).. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import VPC Endpoint Services using ID of the connection, which is the `VPC Endpoint Service ID` and `VPC Endpoint ID` separated by underscore (`_`).. For example:
+
+```console
+% terraform import aws_vpc_endpoint_connection_accepter.foo vpce-svc-0f97a19d3fa8220bc_vpce-010601a6db371e263
+```
+
+<!-- cache-key: cdktf-0.18.0 input-34b764c039bd7ffaa91905d63054f3f94f3c9291f5e1d627a203fd2af7e505b7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/vpc_endpoint_connection_notification.html.markdown b/website/docs/cdktf/typescript/r/vpc_endpoint_connection_notification.html.markdown
new file mode 100644
index 00000000000..7e39f9a20a8
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/vpc_endpoint_connection_notification.html.markdown
@@ -0,0 +1,112 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_vpc_endpoint_connection_notification"
+description: |-
+  Provides a VPC Endpoint connection notification resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_vpc_endpoint_connection_notification
+
+Provides a VPC Endpoint connection notification resource.
+Connection notifications notify subscribers of VPC Endpoint events.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { SnsTopic } from "./.gen/providers/aws/sns-topic";
+import { VpcEndpointConnectionNotification } from "./.gen/providers/aws/vpc-endpoint-connection-notification";
+import { VpcEndpointService } from "./.gen/providers/aws/vpc-endpoint-service";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const foo = new VpcEndpointService(this, "foo", {
+      acceptanceRequired: false,
+      networkLoadBalancerArns: [test.arn],
+    });
+    const topic = new DataAwsIamPolicyDocument(this, "topic", {
+      statement: [
+        {
+          actions: ["SNS:Publish"],
+          effect: "Allow",
+          principals: [
+            {
+              identifiers: ["vpce.amazonaws.com"],
+              type: "Service",
+            },
+          ],
+          resources: ["arn:aws:sns:*:*:vpce-notification-topic"],
+        },
+      ],
+    });
+    const awsSnsTopicTopic = new SnsTopic(this, "topic_2", {
+      name: "vpce-notification-topic",
+      policy: Token.asString(topic.json),
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSnsTopicTopic.overrideLogicalId("topic");
+    const awsVpcEndpointConnectionNotificationFoo =
+      new VpcEndpointConnectionNotification(this, "foo_3", {
+        connectionEvents: ["Accept", "Reject"],
+        connectionNotificationArn: Token.asString(awsSnsTopicTopic.arn),
+        vpcEndpointServiceId: foo.id,
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsVpcEndpointConnectionNotificationFoo.overrideLogicalId("foo");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `vpcEndpointServiceId` - (Optional) The ID of the VPC Endpoint Service to receive notifications for.
+* `vpcEndpointId` - (Optional) The ID of the VPC Endpoint to receive notifications for.
+* `connectionNotificationArn` - (Required) The ARN of the SNS topic for the notifications.
+* `connectionEvents` - (Required) One or more endpoint [events](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateVpcEndpointConnectionNotification.html#API_CreateVpcEndpointConnectionNotification_RequestParameters) for which to receive notifications.
+
+~> **NOTE:** One of `vpcEndpointServiceId` or `vpcEndpointId` must be specified.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the VPC connection notification.
+* `state` - The state of the notification.
+* `notificationType` - The type of notification.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import VPC Endpoint connection notifications using the VPC endpoint connection notification `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import VPC Endpoint connection notifications using the VPC endpoint connection notification `id`. For example:
+
+```console
+% terraform import aws_vpc_endpoint_connection_notification.foo vpce-nfn-09e6ed3b4efba2263
+```
+
+<!-- cache-key: cdktf-0.18.0 input-0a73ca44fb468e8731df240f6476acb6d3f8563d6140121d0844ddbde55b7aff -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/vpc_endpoint_policy.html.markdown b/website/docs/cdktf/typescript/r/vpc_endpoint_policy.html.markdown
new file mode 100644
index 00000000000..c7f26f2189e
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/vpc_endpoint_policy.html.markdown
@@ -0,0 +1,115 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_vpc_endpoint_policy"
+description: |-
+  Provides a VPC Endpoint Policy resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_vpc_endpoint_policy
+
+Provides a VPC Endpoint Policy resource.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, Fn, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsVpcEndpointService } from "./.gen/providers/aws/data-aws-vpc-endpoint-service";
+import { Vpc } from "./.gen/providers/aws/vpc";
+import { VpcEndpoint } from "./.gen/providers/aws/vpc-endpoint";
+import { VpcEndpointPolicy } from "./.gen/providers/aws/vpc-endpoint-policy";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new Vpc(this, "example", {
+      cidrBlock: "10.0.0.0/16",
+    });
+    const dataAwsVpcEndpointServiceExample = new DataAwsVpcEndpointService(
+      this,
+      "example_1",
+      {
+        service: "dynamodb",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsVpcEndpointServiceExample.overrideLogicalId("example");
+    const awsVpcEndpointExample = new VpcEndpoint(this, "example_2", {
+      serviceName: Token.asString(dataAwsVpcEndpointServiceExample.serviceName),
+      vpcId: example.id,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsVpcEndpointExample.overrideLogicalId("example");
+    const awsVpcEndpointPolicyExample = new VpcEndpointPolicy(
+      this,
+      "example_3",
+      {
+        policy: Token.asString(
+          Fn.jsonencode({
+            Statement: [
+              {
+                Action: ["dynamodb:*"],
+                Effect: "Allow",
+                Principal: {
+                  AWS: "*",
+                },
+                Resource: "*",
+                Sid: "AllowAll",
+              },
+            ],
+            Version: "2012-10-17",
+          })
+        ),
+        vpcEndpointId: Token.asString(awsVpcEndpointExample.id),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsVpcEndpointPolicyExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `vpcEndpointId` - (Required) The VPC Endpoint ID.
+* `policy` - (Optional) A policy to attach to the endpoint that controls access to the service. Defaults to full access. All `gateway` and some `interface` endpoints support policies - see the [relevant AWS documentation](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-endpoints-access.html) for more details. For more information about building AWS IAM policy documents with Terraform, see the [AWS IAM Policy Document Guide](https://learn.hashicorp.com/terraform/aws/iam-policy).
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the VPC endpoint.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import VPC Endpoint Policies using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import VPC Endpoint Policies using the `id`. For example:
+
+```console
+% terraform import aws_vpc_endpoint_policy.example vpce-3ecf2a57
+```
+
+<!-- cache-key: cdktf-0.18.0 input-a5b2784f8f44ade8f56c203390d38d1010def6c1bdaafcb341605772236d19d6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/vpc_endpoint_route_table_association.html.markdown b/website/docs/cdktf/typescript/r/vpc_endpoint_route_table_association.html.markdown
new file mode 100644
index 00000000000..32de8ac582e
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/vpc_endpoint_route_table_association.html.markdown
@@ -0,0 +1,73 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_vpc_endpoint_route_table_association"
+description: |-
+  Manages a VPC Endpoint Route Table Association
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_vpc_endpoint_route_table_association
+
+Manages a VPC Endpoint Route Table Association
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { VpcEndpointRouteTableAssociation } from "./.gen/providers/aws/vpc-endpoint-route-table-association";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new VpcEndpointRouteTableAssociation(this, "example", {
+      routeTableId: Token.asString(awsRouteTableExample.id),
+      vpcEndpointId: Token.asString(awsVpcEndpointExample.id),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `routeTableId` - (Required) Identifier of the EC2 Route Table to be associated with the VPC Endpoint.
+* `vpcEndpointId` - (Required) Identifier of the VPC Endpoint with which the EC2 Route Table will be associated.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - A hash of the EC2 Route Table and VPC Endpoint identifiers.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import VPC Endpoint Route Table Associations using `vpcEndpointId` together with `routeTableId`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import VPC Endpoint Route Table Associations using `vpcEndpointId` together with `routeTableId`. For example:
+
+```console
+% terraform import aws_vpc_endpoint_route_table_association.example vpce-aaaaaaaa/rtb-bbbbbbbb
+```
+
+<!-- cache-key: cdktf-0.18.0 input-9279baef908b3e9fb91a1e81d78619bda99e30247b0ce7926ced7862a33683e2 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/vpc_endpoint_security_group_association.html.markdown b/website/docs/cdktf/typescript/r/vpc_endpoint_security_group_association.html.markdown
new file mode 100644
index 00000000000..eda0bda8241
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/vpc_endpoint_security_group_association.html.markdown
@@ -0,0 +1,60 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_vpc_endpoint_security_group_association"
+description: |-
+  Provides a resource to create an association between a VPC endpoint and a security group.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_vpc_endpoint_security_group_association
+
+Provides a resource to create an association between a VPC endpoint and a security group.
+
+~> **NOTE on VPC Endpoints and VPC Endpoint Security Group Associations:** Terraform provides
+both a standalone VPC Endpoint Security Group Association (an association between a VPC endpoint
+and a single `securityGroupId`) and a [VPC Endpoint](vpc_endpoint.html) resource with a `securityGroupIds`
+attribute. Do not use the same security group ID in both a VPC Endpoint resource and a VPC Endpoint Security
+Group Association resource. Doing so will cause a conflict of associations and will overwrite the association.
+
+## Example Usage
+
+Basic usage:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { VpcEndpointSecurityGroupAssociation } from "./.gen/providers/aws/vpc-endpoint-security-group-association";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new VpcEndpointSecurityGroupAssociation(this, "sg_ec2", {
+      securityGroupId: sg.id,
+      vpcEndpointId: ec2.id,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `securityGroupId` - (Required) The ID of the security group to be associated with the VPC endpoint.
+* `vpcEndpointId` - (Required) The ID of the VPC endpoint with which the security group will be associated.
+* `replaceDefaultAssociation` - (Optional) Whether this association should replace the association with the VPC's default security group that is created when no security groups are specified during VPC endpoint creation. At most 1 association per-VPC endpoint should be configured with `replace_default_association = true`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the association.
+
+<!-- cache-key: cdktf-0.18.0 input-e0b24d11f8b79893f0c7abf7d276f5c7e882e53eb0977668d0e09c4fa0c3576b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/vpc_endpoint_service.html.markdown b/website/docs/cdktf/typescript/r/vpc_endpoint_service.html.markdown
new file mode 100644
index 00000000000..215312c7560
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/vpc_endpoint_service.html.markdown
@@ -0,0 +1,123 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_vpc_endpoint_service"
+description: |-
+  Provides a VPC Endpoint Service resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_vpc_endpoint_service
+
+Provides a VPC Endpoint Service resource.
+Service consumers can create an _Interface_ [VPC Endpoint](vpc_endpoint.html) to connect to the service.
+
+~> **NOTE on VPC Endpoint Services and VPC Endpoint Service Allowed Principals:** Terraform provides
+both a standalone [VPC Endpoint Service Allowed Principal](vpc_endpoint_service_allowed_principal.html) resource
+and a VPC Endpoint Service resource with an `allowedPrincipals` attribute. Do not use the same principal ARN in both
+a VPC Endpoint Service resource and a VPC Endpoint Service Allowed Principal resource. Doing so will cause a conflict
+and will overwrite the association.
+
+## Example Usage
+
+### Network Load Balancers
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { VpcEndpointService } from "./.gen/providers/aws/vpc-endpoint-service";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new VpcEndpointService(this, "example", {
+      acceptanceRequired: false,
+      networkLoadBalancerArns: [Token.asString(awsLbExample.arn)],
+    });
+  }
+}
+
+```
+
+### Gateway Load Balancers
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { VpcEndpointService } from "./.gen/providers/aws/vpc-endpoint-service";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new VpcEndpointService(this, "example", {
+      acceptanceRequired: false,
+      gatewayLoadBalancerArns: [Token.asString(awsLbExample.arn)],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `acceptanceRequired` - (Required) Whether or not VPC endpoint connection requests to the service must be accepted by the service owner - `true` or `false`.
+* `allowedPrincipals` - (Optional) The ARNs of one or more principals allowed to discover the endpoint service.
+* `gatewayLoadBalancerArns` - (Optional) Amazon Resource Names (ARNs) of one or more Gateway Load Balancers for the endpoint service.
+* `networkLoadBalancerArns` - (Optional) Amazon Resource Names (ARNs) of one or more Network Load Balancers for the endpoint service.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `privateDnsName` - (Optional) The private DNS name for the service.
+* `supportedIpAddressTypes` - (Optional) The supported IP address types. The possible values are `ipv4` and `ipv6`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the VPC endpoint service.
+* `availabilityZones` - A set of Availability Zones in which the service is available.
+* `arn` - The Amazon Resource Name (ARN) of the VPC endpoint service.
+* `baseEndpointDnsNames` - A set of DNS names for the service.
+* `managesVpcEndpoints` - Whether or not the service manages its VPC endpoints - `true` or `false`.
+* `serviceName` - The service name.
+* `serviceType` - The service type, `gateway` or `interface`.
+* `state` - The state of the VPC endpoint service.
+* `privateDnsNameConfiguration` - List of objects containing information about the endpoint service private DNS name configuration.
+    * `name` - Name of the record subdomain the service provider needs to create.
+    * `state` - Verification state of the VPC endpoint service. Consumers of the endpoint service can use the private name only when the state is `verified`.
+    * `type` - Endpoint service verification type, for example `txt`.
+    * `value` - Value the service provider adds to the private DNS name domain record before verification.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import VPC Endpoint Services using the VPC endpoint service `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import VPC Endpoint Services using the VPC endpoint service `id`. For example:
+
+```console
+% terraform import aws_vpc_endpoint_service.foo vpce-svc-0f97a19d3fa8220bc
+```
+
+<!-- cache-key: cdktf-0.18.0 input-c09a7b5d8b527c0d1b6c1d63d0ebeee104d7dd496159317437a0efb2c6008154 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/vpc_endpoint_service_allowed_principal.html.markdown b/website/docs/cdktf/typescript/r/vpc_endpoint_service_allowed_principal.html.markdown
new file mode 100644
index 00000000000..78f8f5f40c9
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/vpc_endpoint_service_allowed_principal.html.markdown
@@ -0,0 +1,61 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_vpc_endpoint_service_allowed_principal"
+description: |-
+  Provides a resource to allow a principal to discover a VPC endpoint service.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_vpc_endpoint_service_allowed_principal
+
+Provides a resource to allow a principal to discover a VPC endpoint service.
+
+~> **NOTE on VPC Endpoint Services and VPC Endpoint Service Allowed Principals:** Terraform provides
+both a standalone [VPC Endpoint Service Allowed Principal](vpc_endpoint_service_allowed_principal.html) resource
+and a VPC Endpoint Service resource with an `allowedPrincipals` attribute. Do not use the same principal ARN in both
+a VPC Endpoint Service resource and a VPC Endpoint Service Allowed Principal resource. Doing so will cause a conflict
+and will overwrite the association.
+
+## Example Usage
+
+Basic usage:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCallerIdentity } from "./.gen/providers/aws/data-aws-caller-identity";
+import { VpcEndpointServiceAllowedPrincipal } from "./.gen/providers/aws/vpc-endpoint-service-allowed-principal";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const current = new DataAwsCallerIdentity(this, "current", {});
+    new VpcEndpointServiceAllowedPrincipal(this, "allow_me_to_foo", {
+      principalArn: Token.asString(current.arn),
+      vpcEndpointServiceId: foo.id,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `vpcEndpointServiceId` - (Required) The ID of the VPC endpoint service to allow permission.
+* `principalArn` - (Required) The ARN of the principal to allow permissions.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the association.
+
+<!-- cache-key: cdktf-0.18.0 input-8ff7831d801343519ca1bf1af9bc9600a8326d54f66a019278e06cc2bc3ebf39 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/vpc_endpoint_subnet_association.html.markdown b/website/docs/cdktf/typescript/r/vpc_endpoint_subnet_association.html.markdown
new file mode 100644
index 00000000000..8c9bb573aab
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/vpc_endpoint_subnet_association.html.markdown
@@ -0,0 +1,88 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_vpc_endpoint_subnet_association"
+description: |-
+  Provides a resource to create an association between a VPC endpoint and a subnet.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_vpc_endpoint_subnet_association
+
+Provides a resource to create an association between a VPC endpoint and a subnet.
+
+~> **NOTE on VPC Endpoints and VPC Endpoint Subnet Associations:** Terraform provides
+both a standalone VPC Endpoint Subnet Association (an association between a VPC endpoint
+and a single `subnetId`) and a [VPC Endpoint](vpc_endpoint.html) resource with a `subnetIds`
+attribute. Do not use the same subnet ID in both a VPC Endpoint resource and a VPC Endpoint Subnet
+Association resource. Doing so will cause a conflict of associations and will overwrite the association.
+
+## Example Usage
+
+Basic usage:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { VpcEndpointSubnetAssociation } from "./.gen/providers/aws/vpc-endpoint-subnet-association";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new VpcEndpointSubnetAssociation(this, "sn_ec2", {
+      subnetId: sn.id,
+      vpcEndpointId: ec2.id,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `vpcEndpointId` - (Required) The ID of the VPC endpoint with which the subnet will be associated.
+* `subnetId` - (Required) The ID of the subnet to be associated with the VPC endpoint.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the association.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `10M`)
+- `delete` - (Default `10M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import VPC Endpoint Subnet Associations using `vpcEndpointId` together with `subnetId`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import VPC Endpoint Subnet Associations using `vpcEndpointId` together with `subnetId`. For example:
+
+```console
+% terraform import aws_vpc_endpoint_subnet_association.example vpce-aaaaaaaa/subnet-bbbbbbbbbbbbbbbbb
+```
+
+<!-- cache-key: cdktf-0.18.0 input-5669b71eb1929dcdffdde12d53b4824d055cb34a6173d0e6db8bbbcb9c7d5708 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/vpc_ipam.html.markdown b/website/docs/cdktf/typescript/r/vpc_ipam.html.markdown
new file mode 100644
index 00000000000..745da02cc43
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/vpc_ipam.html.markdown
@@ -0,0 +1,148 @@
+---
+subcategory: "VPC IPAM (IP Address Manager)"
+layout: "aws"
+page_title: "AWS: aws_vpc_ipam"
+description: |-
+  Provides an IPAM resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_vpc_ipam
+
+Provides an IPAM resource.
+
+## Example Usage
+
+Basic usage:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsRegion } from "./.gen/providers/aws/data-aws-region";
+import { VpcIpam } from "./.gen/providers/aws/vpc-ipam";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const current = new DataAwsRegion(this, "current", {});
+    new VpcIpam(this, "main", {
+      description: "My IPAM",
+      operatingRegions: [
+        {
+          regionName: Token.asString(current.name),
+        },
+      ],
+      tags: {
+        Test: "Main",
+      },
+    });
+  }
+}
+
+```
+
+Shared with multiple operating_regions:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import {
+  VariableType,
+  TerraformVariable,
+  Fn,
+  Token,
+  TerraformIterator,
+  TerraformStack,
+} from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsRegion } from "./.gen/providers/aws/data-aws-region";
+import { VpcIpam } from "./.gen/providers/aws/vpc-ipam";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    /*Terraform Variables are not always the best fit for getting inputs in the context of Terraform CDK.
+    You can read more about this at https://cdk.tf/variables*/
+    const ipamRegions = new TerraformVariable(this, "ipam_regions", {
+      default: ["us-east-1", "us-west-2"],
+      type: VariableType.ANY,
+    });
+    const current = new DataAwsRegion(this, "current", {});
+    const allIpamRegions = Fn.distinct(
+      Token.asAny(Fn.concat([[current.name], ipamRegions.value]))
+    );
+    /*In most cases loops should be handled in the programming language context and 
+    not inside of the Terraform context. If you are looping over something external, e.g. a variable or a file input
+    you should consider using a for loop. If you are looping over something only known to Terraform, e.g. a result of a data source
+    you need to keep this like it is.*/
+    const mainDynamicIterator0 = TerraformIterator.fromList(
+      Token.asAny(allIpamRegions)
+    );
+    new VpcIpam(this, "main", {
+      description: "multi region ipam",
+      operatingRegions: mainDynamicIterator0.dynamic({
+        region_name: mainDynamicIterator0.value,
+      }),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `description` - (Optional) A description for the IPAM.
+* `operatingRegions` - (Required) Determines which locales can be chosen when you create pools. Locale is the Region where you want to make an IPAM pool available for allocations. You can only create pools with locales that match the operating Regions of the IPAM. You can only create VPCs from a pool whose locale matches the VPC's Region. You specify a region using the [region_name](#operating_regions) parameter. You **must** set your provider block region as an operating_region.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `cascade` - (Optional) Enables you to quickly delete an IPAM, private scopes, pools in private scopes, and any allocations in the pools in private scopes.
+
+### operating_regions
+
+* `regionName` - (Required) The name of the Region you want to add to the IPAM.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of IPAM
+* `id` - The ID of the IPAM
+* `defaultResourceDiscoveryId` - The IPAM's default resource discovery ID.
+* `defaultResourceDiscoveryAssociationId` - The IPAM's default resource discovery association ID.
+* `privateDefaultScopeId` - The ID of the IPAM's private scope. A scope is a top-level container in IPAM. Each scope represents an IP-independent network. Scopes enable you to represent networks where you have overlapping IP space. When you create an IPAM, IPAM automatically creates two scopes: public and private. The private scope is intended for private IP space. The public scope is intended for all internet-routable IP space.
+* `publicDefaultScopeId` - The ID of the IPAM's public scope. A scope is a top-level container in IPAM. Each scope represents an IP-independent network. Scopes enable you to represent networks where you have overlapping IP space. When you create an IPAM, IPAM automatically creates two scopes: public and private. The private scope is intended for private
+IP space. The public scope is intended for all internet-routable IP space.
+* `scopeCount` - The number of scopes in the IPAM.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IPAMs using the IPAM `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import IPAMs using the IPAM `id`. For example:
+
+```console
+% terraform import aws_vpc_ipam.example ipam-0178368ad2146a492
+```
+
+<!-- cache-key: cdktf-0.18.0 input-84aa9bd97b463b7e0ef48338b382158ae378ddfa622a5c06c2b8e8c82c2fa598 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/vpc_ipam_organization_admin_account.html.markdown b/website/docs/cdktf/typescript/r/vpc_ipam_organization_admin_account.html.markdown
new file mode 100644
index 00000000000..a7382eefe59
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/vpc_ipam_organization_admin_account.html.markdown
@@ -0,0 +1,85 @@
+---
+subcategory: "VPC IPAM (IP Address Manager)"
+layout: "aws"
+page_title: "AWS: aws_vpc_ipam_organization_admin_account"
+description: |-
+  Enables the IPAM Service and promotes an account to delegated administrator for the service.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_vpc_ipam_organization_admin_account
+
+Enables the IPAM Service and promotes a delegated administrator.
+
+## Example Usage
+
+Basic usage:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCallerIdentity } from "./.gen/providers/aws/data-aws-caller-identity";
+import { AwsProvider } from "./.gen/providers/aws/provider";
+import { VpcIpamOrganizationAdminAccount } from "./.gen/providers/aws/vpc-ipam-organization-admin-account";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const ipamDelegateAccount = new AwsProvider(this, "aws", {
+      alias: "ipam_delegate_account",
+    });
+    const delegated = new DataAwsCallerIdentity(this, "delegated", {
+      provider: ipamDelegateAccount,
+    });
+    new VpcIpamOrganizationAdminAccount(this, "example", {
+      delegatedAdminAccountId: Token.asString(delegated.accountId),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `delegatedAdminAccountId` - (Required)
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Organizations ARN for the delegate account.
+* `id` - The Organizations member account ID that you want to enable as the IPAM account.
+* `email` - The Organizations email for the delegate account.
+* `name` - The Organizations name for the delegate account.
+* `servicePrincipal` - The AWS service principal.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IPAMs using the delegate account `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import IPAMs using the delegate account `id`. For example:
+
+```console
+% terraform import aws_vpc_ipam_organization_admin_account.example 12345678901
+```
+
+<!-- cache-key: cdktf-0.18.0 input-756ca0efb94e8ad92deb19a5ce28731120d9b49f07ca56b39bba452b2ffecbdd -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/vpc_ipam_pool.html.markdown b/website/docs/cdktf/typescript/r/vpc_ipam_pool.html.markdown
new file mode 100644
index 00000000000..16b760b26cf
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/vpc_ipam_pool.html.markdown
@@ -0,0 +1,152 @@
+---
+subcategory: "VPC IPAM (IP Address Manager)"
+layout: "aws"
+page_title: "AWS: aws_vpc_ipam_pool"
+description: |-
+  Provides a IP address pool resource for IPAM.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_vpc_ipam_pool
+
+Provides an IP address pool resource for IPAM.
+
+## Example Usage
+
+Basic usage:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsRegion } from "./.gen/providers/aws/data-aws-region";
+import { VpcIpam } from "./.gen/providers/aws/vpc-ipam";
+import { VpcIpamPool } from "./.gen/providers/aws/vpc-ipam-pool";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const current = new DataAwsRegion(this, "current", {});
+    const example = new VpcIpam(this, "example", {
+      operatingRegions: [
+        {
+          regionName: Token.asString(current.name),
+        },
+      ],
+    });
+    const awsVpcIpamPoolExample = new VpcIpamPool(this, "example_2", {
+      addressFamily: "ipv4",
+      ipamScopeId: example.privateDefaultScopeId,
+      locale: Token.asString(current.name),
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsVpcIpamPoolExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+Nested Pools:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsRegion } from "./.gen/providers/aws/data-aws-region";
+import { VpcIpam } from "./.gen/providers/aws/vpc-ipam";
+import { VpcIpamPool } from "./.gen/providers/aws/vpc-ipam-pool";
+import { VpcIpamPoolCidr } from "./.gen/providers/aws/vpc-ipam-pool-cidr";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const current = new DataAwsRegion(this, "current", {});
+    const example = new VpcIpam(this, "example", {
+      operatingRegions: [
+        {
+          regionName: Token.asString(current.name),
+        },
+      ],
+    });
+    const parent = new VpcIpamPool(this, "parent", {
+      addressFamily: "ipv4",
+      ipamScopeId: example.privateDefaultScopeId,
+    });
+    new VpcIpamPoolCidr(this, "parent_test", {
+      cidr: "172.20.0.0/16",
+      ipamPoolId: parent.id,
+    });
+    const child = new VpcIpamPool(this, "child", {
+      addressFamily: "ipv4",
+      ipamScopeId: example.privateDefaultScopeId,
+      locale: Token.asString(current.name),
+      sourceIpamPoolId: parent.id,
+    });
+    new VpcIpamPoolCidr(this, "child_test", {
+      cidr: "172.20.0.0/24",
+      ipamPoolId: child.id,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `addressFamily` - (Optional) The IP protocol assigned to this pool. You must choose either IPv4 or IPv6 protocol for a pool.
+* `allocationDefaultNetmaskLength` - (Optional) A default netmask length for allocations added to this pool. If, for example, the CIDR assigned to this pool is 10.0.0.0/8 and you enter 16 here, new allocations will default to 10.0.0.0/16 (unless you provide a different netmask value when you create the new allocation).
+* `allocationMaxNetmaskLength` - (Optional) The maximum netmask length that will be required for CIDR allocations in this pool.
+* `allocationMinNetmaskLength` - (Optional) The minimum netmask length that will be required for CIDR allocations in this pool.
+* `allocationResourceTags` - (Optional) Tags that are required for resources that use CIDRs from this IPAM pool. Resources that do not have these tags will not be allowed to allocate space from the pool. If the resources have their tags changed after they have allocated space or if the allocation tagging requirements are changed on the pool, the resource may be marked as noncompliant.
+* `autoImport` - (Optional) If you include this argument, IPAM automatically imports any VPCs you have in your scope that fall
+within the CIDR range in the pool.
+* `awsService` - (Optional) Limits which AWS service the pool can be used in. Only useable on public scopes. Valid Values: `ec2`.
+* `description` - (Optional) A description for the IPAM pool.
+* `ipamScopeId` - (Optional) The ID of the scope in which you would like to create the IPAM pool.
+* `locale` - (Optional) The locale in which you would like to create the IPAM pool. Locale is the Region where you want to make an IPAM pool available for allocations. You can only create pools with locales that match the operating Regions of the IPAM. You can only create VPCs from a pool whose locale matches the VPC's Region. Possible values: Any AWS region, such as `usEast1`.
+* `publiclyAdvertisable` - (Optional) Defines whether or not IPv6 pool space is publicly advertisable over the internet. This argument is required if `address_family = "ipv6"` and `public_ip_source = "byoip"`, default is `false`. This option is not available for IPv4 pool space or if `public_ip_source = "amazon"`.
+* `publicIpSource` - (Optional) The IP address source for pools in the public scope. Only used for provisioning IP address CIDRs to pools in the public scope. Valid values are `byoip` or `amazon`. Default is `byoip`.
+* `sourceIpamPoolId` - (Optional) The ID of the source IPAM pool. Use this argument to create a child pool within an existing pool.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of IPAM
+* `id` - The ID of the IPAM
+* `state` - The ID of the IPAM
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IPAMs using the IPAM pool `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import IPAMs using the IPAM pool `id`. For example:
+
+```console
+% terraform import aws_vpc_ipam_pool.example ipam-pool-0958f95207d978e1e
+```
+
+<!-- cache-key: cdktf-0.18.0 input-b9340bd3375bf2193e4b206451c8af86918bbc16f3f51661ef310d88085a12de -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/vpc_ipam_pool_cidr.html.markdown b/website/docs/cdktf/typescript/r/vpc_ipam_pool_cidr.html.markdown
new file mode 100644
index 00000000000..6e727057cdc
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/vpc_ipam_pool_cidr.html.markdown
@@ -0,0 +1,161 @@
+---
+subcategory: "VPC IPAM (IP Address Manager)"
+layout: "aws"
+page_title: "AWS: aws_vpc_ipam_pool_cidr"
+description: |-
+  Provisions a CIDR from an IPAM address pool.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_vpc_ipam_pool_cidr
+
+Provisions a CIDR from an IPAM address pool.
+
+~> **NOTE:** Provisioning Public IPv4 or Public IPv6 require [steps outside the scope of this resource](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-byoip.html#prepare-for-byoip). The resource accepts `message` and `signature` as part of the `cidrAuthorizationContext` attribute but those must be generated ahead of time. Public IPv6 CIDRs that are provisioned into a Pool with `publicly_advertisable = true` and all public IPv4 CIDRs also require creating a Route Origin Authorization (ROA) object in your Regional Internet Registry (RIR).
+
+~> **NOTE:** In order to deprovision CIDRs all Allocations must be released. Allocations created by a VPC take up to 30 minutes to be released. However, for IPAM to properly manage the removal of allocation records created by VPCs and other resources, you must [grant it permissions](https://docs.aws.amazon.com/vpc/latest/ipam/choose-single-user-or-orgs-ipam.html) in
+either a single account or organizationally. If you are unable to deprovision a cidr after waiting over 30 minutes, you may be missing the Service Linked Role.
+
+## Example Usage
+
+Basic usage:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsRegion } from "./.gen/providers/aws/data-aws-region";
+import { VpcIpam } from "./.gen/providers/aws/vpc-ipam";
+import { VpcIpamPool } from "./.gen/providers/aws/vpc-ipam-pool";
+import { VpcIpamPoolCidr } from "./.gen/providers/aws/vpc-ipam-pool-cidr";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const current = new DataAwsRegion(this, "current", {});
+    const example = new VpcIpam(this, "example", {
+      operatingRegions: [
+        {
+          regionName: Token.asString(current.name),
+        },
+      ],
+    });
+    const awsVpcIpamPoolExample = new VpcIpamPool(this, "example_2", {
+      addressFamily: "ipv4",
+      ipamScopeId: example.privateDefaultScopeId,
+      locale: Token.asString(current.name),
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsVpcIpamPoolExample.overrideLogicalId("example");
+    const awsVpcIpamPoolCidrExample = new VpcIpamPoolCidr(this, "example_3", {
+      cidr: "172.20.0.0/16",
+      ipamPoolId: Token.asString(awsVpcIpamPoolExample.id),
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsVpcIpamPoolCidrExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+Provision Public IPv6 Pool CIDRs:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsRegion } from "./.gen/providers/aws/data-aws-region";
+import { VpcIpam } from "./.gen/providers/aws/vpc-ipam";
+import { VpcIpamPool } from "./.gen/providers/aws/vpc-ipam-pool";
+import { VpcIpamPoolCidr } from "./.gen/providers/aws/vpc-ipam-pool-cidr";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const current = new DataAwsRegion(this, "current", {});
+    const example = new VpcIpam(this, "example", {
+      operatingRegions: [
+        {
+          regionName: Token.asString(current.name),
+        },
+      ],
+    });
+    const ipv6TestPublic = new VpcIpamPool(this, "ipv6_test_public", {
+      addressFamily: "ipv6",
+      awsService: "ec2",
+      description: "public ipv6",
+      ipamScopeId: example.publicDefaultScopeId,
+      locale: "us-east-1",
+      publicIpSource: "amazon",
+      publiclyAdvertisable: false,
+    });
+    const awsVpcIpamPoolCidrIpv6TestPublic = new VpcIpamPoolCidr(
+      this,
+      "ipv6_test_public_3",
+      {
+        ipamPoolId: ipv6TestPublic.id,
+        netmaskLength: 52,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsVpcIpamPoolCidrIpv6TestPublic.overrideLogicalId("ipv6_test_public");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `cidr` - (Optional) The CIDR you want to assign to the pool. Conflicts with `netmaskLength`.
+* `cidrAuthorizationContext` - (Optional) A signed document that proves that you are authorized to bring the specified IP address range to Amazon using BYOIP. This is not stored in the state file. See [cidr_authorization_context](#cidr_authorization_context) for more information.
+* `ipamPoolId` - (Required) The ID of the pool to which you want to assign a CIDR.
+* `netmaskLength` - (Optional) If provided, the cidr provisioned into the specified pool will be the next available cidr given this declared netmask length. Conflicts with `cidr`.
+
+### cidr_authorization_context
+
+* `message` - (Optional) The plain-text authorization message for the prefix and account.
+* `signature` - (Optional) The signed authorization message for the prefix and account.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the IPAM Pool Cidr concatenated with the IPAM Pool ID.
+* `ipamPoolCidrId` - The unique ID generated by AWS for the pool cidr. Typically this is the resource `id` but this attribute was added to the API calls after the fact and is therefore not used as the terraform resource id.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IPAMs using the `<cidr>_<ipam-pool-id>`. For example:
+
+**NOTE:** Do not use the IPAM Pool Cidr ID as this was introduced after the resource already existed.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import IPAMs using the `<cidr>_<ipam-pool-id>`. For example:
+
+**NOTE:** Do not use the IPAM Pool Cidr ID as this was introduced after the resource already existed.
+
+```console
+% terraform import aws_vpc_ipam_pool_cidr.example 172.20.0.0/24_ipam-pool-0e634f5a1517cccdc
+```
+
+<!-- cache-key: cdktf-0.18.0 input-9510d76ea7d66c26049583f9c5d435912df190bc1c3c78f5fda73a13a93912cc -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/vpc_ipam_pool_cidr_allocation.html.markdown b/website/docs/cdktf/typescript/r/vpc_ipam_pool_cidr_allocation.html.markdown
new file mode 100644
index 00000000000..3614bc42514
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/vpc_ipam_pool_cidr_allocation.html.markdown
@@ -0,0 +1,169 @@
+---
+subcategory: "VPC IPAM (IP Address Manager)"
+layout: "aws"
+page_title: "AWS: aws_vpc_ipam_pool_cidr_allocation"
+description: |-
+  Allocates (reserves) a CIDR from an IPAM address pool, preventing usage by IPAM.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_vpc_ipam_pool_cidr_allocation
+
+Allocates (reserves) a CIDR from an IPAM address pool, preventing usage by IPAM. Only works for private IPv4.
+
+## Example Usage
+
+Basic usage:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsRegion } from "./.gen/providers/aws/data-aws-region";
+import { VpcIpam } from "./.gen/providers/aws/vpc-ipam";
+import { VpcIpamPool } from "./.gen/providers/aws/vpc-ipam-pool";
+import { VpcIpamPoolCidr } from "./.gen/providers/aws/vpc-ipam-pool-cidr";
+import { VpcIpamPoolCidrAllocation } from "./.gen/providers/aws/vpc-ipam-pool-cidr-allocation";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const current = new DataAwsRegion(this, "current", {});
+    const example = new VpcIpam(this, "example", {
+      operatingRegions: [
+        {
+          regionName: Token.asString(current.name),
+        },
+      ],
+    });
+    const awsVpcIpamPoolExample = new VpcIpamPool(this, "example_2", {
+      addressFamily: "ipv4",
+      ipamScopeId: example.privateDefaultScopeId,
+      locale: Token.asString(current.name),
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsVpcIpamPoolExample.overrideLogicalId("example");
+    const awsVpcIpamPoolCidrExample = new VpcIpamPoolCidr(this, "example_3", {
+      cidr: "172.20.0.0/16",
+      ipamPoolId: Token.asString(awsVpcIpamPoolExample.id),
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsVpcIpamPoolCidrExample.overrideLogicalId("example");
+    const awsVpcIpamPoolCidrAllocationExample = new VpcIpamPoolCidrAllocation(
+      this,
+      "example_4",
+      {
+        cidr: "172.20.0.0/24",
+        dependsOn: [awsVpcIpamPoolCidrExample],
+        ipamPoolId: Token.asString(awsVpcIpamPoolExample.id),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsVpcIpamPoolCidrAllocationExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+With the `disallowedCidrs` attribute:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsRegion } from "./.gen/providers/aws/data-aws-region";
+import { VpcIpam } from "./.gen/providers/aws/vpc-ipam";
+import { VpcIpamPool } from "./.gen/providers/aws/vpc-ipam-pool";
+import { VpcIpamPoolCidr } from "./.gen/providers/aws/vpc-ipam-pool-cidr";
+import { VpcIpamPoolCidrAllocation } from "./.gen/providers/aws/vpc-ipam-pool-cidr-allocation";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const current = new DataAwsRegion(this, "current", {});
+    const example = new VpcIpam(this, "example", {
+      operatingRegions: [
+        {
+          regionName: Token.asString(current.name),
+        },
+      ],
+    });
+    const awsVpcIpamPoolExample = new VpcIpamPool(this, "example_2", {
+      addressFamily: "ipv4",
+      ipamScopeId: example.privateDefaultScopeId,
+      locale: Token.asString(current.name),
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsVpcIpamPoolExample.overrideLogicalId("example");
+    const awsVpcIpamPoolCidrExample = new VpcIpamPoolCidr(this, "example_3", {
+      cidr: "172.20.0.0/16",
+      ipamPoolId: Token.asString(awsVpcIpamPoolExample.id),
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsVpcIpamPoolCidrExample.overrideLogicalId("example");
+    const awsVpcIpamPoolCidrAllocationExample = new VpcIpamPoolCidrAllocation(
+      this,
+      "example_4",
+      {
+        dependsOn: [awsVpcIpamPoolCidrExample],
+        disallowedCidrs: ["172.20.0.0/28"],
+        ipamPoolId: Token.asString(awsVpcIpamPoolExample.id),
+        netmaskLength: 28,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsVpcIpamPoolCidrAllocationExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `cidr` - (Optional) The CIDR you want to assign to the pool.
+* `description` - (Optional) The description for the allocation.
+* `disallowedCidrs` - (Optional) Exclude a particular CIDR range from being returned by the pool.
+* `ipamPoolId` - (Required) The ID of the pool to which you want to assign a CIDR.
+* `netmaskLength` - (Optional) The netmask length of the CIDR you would like to allocate to the IPAM pool. Valid Values: `0128`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the allocation.
+* `resourceId` - The ID of the resource.
+* `resourceOwner` - The owner of the resource.
+* `resourceType` - The type of the resource.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IPAM allocations using the allocation `id` and `pool id`, separated by `_`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import IPAM allocations using the allocation `id` and `pool id`, separated by `_`. For example:
+
+```console
+% terraform import aws_vpc_ipam_pool_cidr_allocation.example ipam-pool-alloc-0dc6d196509c049ba8b549ff99f639736_ipam-pool-07cfb559e0921fcbe
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ddd73bf852bf7f559291762467aeca147a50810e7c21dd054f1b8efa8376bf13 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/vpc_ipam_preview_next_cidr.html.markdown b/website/docs/cdktf/typescript/r/vpc_ipam_preview_next_cidr.html.markdown
new file mode 100644
index 00000000000..6d78a2c3e7f
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/vpc_ipam_preview_next_cidr.html.markdown
@@ -0,0 +1,88 @@
+---
+subcategory: "VPC IPAM (IP Address Manager)"
+layout: "aws"
+page_title: "AWS: aws_vpc_ipam_preview_next_cidr"
+description: |-
+  Previews a CIDR from an IPAM address pool.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_vpc_ipam_preview_next_cidr
+
+Previews a CIDR from an IPAM address pool. Only works for private IPv4.
+
+## Example Usage
+
+Basic usage:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsRegion } from "./.gen/providers/aws/data-aws-region";
+import { VpcIpam } from "./.gen/providers/aws/vpc-ipam";
+import { VpcIpamPool } from "./.gen/providers/aws/vpc-ipam-pool";
+import { VpcIpamPoolCidr } from "./.gen/providers/aws/vpc-ipam-pool-cidr";
+import { VpcIpamPreviewNextCidr } from "./.gen/providers/aws/vpc-ipam-preview-next-cidr";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const current = new DataAwsRegion(this, "current", {});
+    const example = new VpcIpam(this, "example", {
+      operatingRegions: [
+        {
+          regionName: Token.asString(current.name),
+        },
+      ],
+    });
+    const awsVpcIpamPoolExample = new VpcIpamPool(this, "example_2", {
+      addressFamily: "ipv4",
+      ipamScopeId: example.privateDefaultScopeId,
+      locale: Token.asString(current.name),
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsVpcIpamPoolExample.overrideLogicalId("example");
+    const awsVpcIpamPoolCidrExample = new VpcIpamPoolCidr(this, "example_3", {
+      cidr: "172.20.0.0/16",
+      ipamPoolId: Token.asString(awsVpcIpamPoolExample.id),
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsVpcIpamPoolCidrExample.overrideLogicalId("example");
+    const awsVpcIpamPreviewNextCidrExample = new VpcIpamPreviewNextCidr(
+      this,
+      "example_4",
+      {
+        dependsOn: [awsVpcIpamPoolCidrExample],
+        disallowedCidrs: ["172.2.0.0/32"],
+        ipamPoolId: Token.asString(awsVpcIpamPoolExample.id),
+        netmaskLength: 28,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsVpcIpamPreviewNextCidrExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `disallowedCidrs` - (Optional) Exclude a particular CIDR range from being returned by the pool.
+* `ipamPoolId` - (Required) The ID of the pool to which you want to assign a CIDR.
+* `netmaskLength` - (Optional) The netmask length of the CIDR you would like to preview from the IPAM pool.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `cidr` - The previewed CIDR from the pool.
+* `id` - The ID of the preview.
+
+<!-- cache-key: cdktf-0.18.0 input-db4b1871b5157cc9d4a7fcfd29b8fc4970d630b294fcf9dd81f44145d3e4f936 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/vpc_ipam_resource_discovery.html.markdown b/website/docs/cdktf/typescript/r/vpc_ipam_resource_discovery.html.markdown
new file mode 100644
index 00000000000..a8acf71b54d
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/vpc_ipam_resource_discovery.html.markdown
@@ -0,0 +1,94 @@
+---
+subcategory: "VPC IPAM (IP Address Manager)"
+layout: "aws"
+page_title: "AWS: aws_vpc_ipam_resource_discovery"
+description: |-
+  Provides an IPAM Resource Discovery resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_vpc_ipam_resource_discovery
+
+Provides an IPAM Resource Discovery resource. IPAM Resource Discoveries are resources meant for multi-organization customers. If you wish to use a single IPAM across multiple orgs, a resource discovery can be created and shared from a subordinate organization to the management organizations IPAM delegated admin account. For a full deployment example, see `awsVpcIpamResourceDiscoveryAssociation` resource.
+
+## Example Usage
+
+Basic usage:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsRegion } from "./.gen/providers/aws/data-aws-region";
+import { VpcIpamResourceDiscovery } from "./.gen/providers/aws/vpc-ipam-resource-discovery";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const current = new DataAwsRegion(this, "current", {});
+    new VpcIpamResourceDiscovery(this, "main", {
+      description: "My IPAM Resource Discovery",
+      operatingRegions: [
+        {
+          regionName: Token.asString(current.name),
+        },
+      ],
+      tags: {
+        Test: "Main",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `description` - (Optional) A description for the IPAM Resource Discovery.
+* `operatingRegions` - (Required) Determines which regions the Resource Discovery will enable IPAM features for usage and monitoring. Locale is the Region where you want to make an IPAM pool available for allocations. You can only create pools with locales that match the operating Regions of the IPAM Resource Discovery. You can only create VPCs from a pool whose locale matches the VPC's Region. You specify a region using the [region_name](#operating_regions) parameter. **You must set your provider block region as an operating_region.**
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### operating_regions
+
+* `regionName` - (Required) The name of the Region you want to add to the IPAM.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of IPAM Resource Discovery
+* `id` - The ID of the IPAM Resource Discovery
+* `isDefault` - A boolean to identify if the Resource Discovery is the accounts default resource discovery
+* `ownerId` - The account ID for the account that manages the Resource Discovery
+* `ipamResourceDiscoveryRegion` - The home region of the Resource Discovery
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IPAMs using the IPAM resource discovery `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import IPAMs using the IPAM resource discovery `id`. For example:
+
+```console
+% terraform import aws_vpc_ipam_resource_discovery.example ipam-res-disco-0178368ad2146a492
+```
+
+<!-- cache-key: cdktf-0.18.0 input-e397380d953ebd30e61a0c3d1b2b84c946cea9f478b02e0627708ce5f413dc35 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/vpc_ipam_resource_discovery_association.html.markdown b/website/docs/cdktf/typescript/r/vpc_ipam_resource_discovery_association.html.markdown
new file mode 100644
index 00000000000..fca158ac6bf
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/vpc_ipam_resource_discovery_association.html.markdown
@@ -0,0 +1,90 @@
+---
+subcategory: "VPC IPAM (IP Address Manager)"
+layout: "aws"
+page_title: "AWS: aws_vpc_ipam_resource_discovery_association"
+description: |-
+  Provides an IPAM Resource Discovery Association resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_vpc_ipam_resource_discovery_association
+
+Provides an association between an Amazon IP Address Manager (IPAM) and a IPAM Resource Discovery. IPAM Resource Discoveries are resources meant for multi-organization customers. If you wish to use a single IPAM across multiple orgs, a resource discovery can be created and shared from a subordinate organization to the management organizations IPAM delegated admin account.
+
+Once an association is created between two organizations via IPAM & a IPAM Resource Discovery, IPAM Pools can be shared via Resource Access Manager (RAM) to accounts in the subordinate organization; these RAM shares must be accepted by the end user account. Pools can then also discover and monitor IPAM resources in the subordinate organization.
+
+## Example Usage
+
+Basic usage:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { VpcIpamResourceDiscoveryAssociation } from "./.gen/providers/aws/vpc-ipam-resource-discovery-association";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new VpcIpamResourceDiscoveryAssociation(this, "test", {
+      ipamId: Token.asString(awsVpcIpamTest.id),
+      ipamResourceDiscoveryId: Token.asString(
+        awsVpcIpamResourceDiscoveryTest.id
+      ),
+      tags: {
+        Name: "test",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `ipamId` - (Required) The ID of the IPAM to associate.
+* `ipamResourceDiscoveryId` - (Required) The ID of the Resource Discovery to associate.
+* `tags` - (Optional) A map of tags to add to the IPAM resource discovery association resource.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of IPAM Resource Discovery Association.
+* `id` - The ID of the IPAM Resource Discovery Association.
+* `ownerId` - The account ID for the account that manages the Resource Discovery
+* `ipamArn` - The Amazon Resource Name (ARN) of the IPAM.
+* `ipamRegion` - The home region of the IPAM.
+* `isDefault` - A boolean to identify if the Resource Discovery is the accounts default resource discovery.
+* `state` - The lifecycle state of the association when you associate or disassociate a resource discovery.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IPAMs using the IPAM resource discovery association `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import IPAMs using the IPAM resource discovery association `id`. For example:
+
+```console
+% terraform import aws_vpc_ipam_resource_discovery_association.example ipam-res-disco-assoc-0178368ad2146a492
+```
+
+<!-- cache-key: cdktf-0.18.0 input-f38914c02b6478a3d1a5d0b4590df76302aa42ccd4610ae8d1077dfd286db5df -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/vpc_ipam_scope.html.markdown b/website/docs/cdktf/typescript/r/vpc_ipam_scope.html.markdown
new file mode 100644
index 00000000000..95cdc88c566
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/vpc_ipam_scope.html.markdown
@@ -0,0 +1,93 @@
+---
+subcategory: "VPC IPAM (IP Address Manager)"
+layout: "aws"
+page_title: "AWS: aws_vpc_ipam_scope"
+description: |-
+  Creates a scope for AWS IPAM.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_vpc_ipam_scope
+
+Creates a scope for AWS IPAM.
+
+## Example Usage
+
+Basic usage:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsRegion } from "./.gen/providers/aws/data-aws-region";
+import { VpcIpam } from "./.gen/providers/aws/vpc-ipam";
+import { VpcIpamScope } from "./.gen/providers/aws/vpc-ipam-scope";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const current = new DataAwsRegion(this, "current", {});
+    const example = new VpcIpam(this, "example", {
+      operatingRegions: [
+        {
+          regionName: Token.asString(current.name),
+        },
+      ],
+    });
+    const awsVpcIpamScopeExample = new VpcIpamScope(this, "example_2", {
+      description: "Another Scope",
+      ipamId: example.id,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsVpcIpamScopeExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `ipamId` - The ID of the IPAM for which you're creating this scope.
+* `description` - (Optional) A description for the scope you're creating.
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the scope.
+* `id` - The ID of the IPAM Scope.
+* `ipamArn` - The ARN of the IPAM for which you're creating this scope.
+* `isDefault` - Defines if the scope is the default scope or not.
+* `poolCount` - The number of pools in the scope.
+* `type` - The type of the scope.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IPAMs using the `scopeId`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import IPAMs using the `scopeId`. For example:
+
+```console
+% terraform import aws_vpc_ipam_scope.example ipam-scope-0513c69f283d11dfb
+```
+
+<!-- cache-key: cdktf-0.18.0 input-68c08f61045d93ee20b37304de2497b2ea7ce59df7aaa4d8e18944d3dc0ddf4e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/vpc_ipv4_cidr_block_association.html.markdown b/website/docs/cdktf/typescript/r/vpc_ipv4_cidr_block_association.html.markdown
new file mode 100644
index 00000000000..e41003c73db
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/vpc_ipv4_cidr_block_association.html.markdown
@@ -0,0 +1,89 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_vpc_ipv4_cidr_block_association"
+description: |-
+  Associate additional IPv4 CIDR blocks with a VPC
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_vpc_ipv4_cidr_block_association
+
+Provides a resource to associate additional IPv4 CIDR blocks with a VPC.
+
+When a VPC is created, a primary IPv4 CIDR block for the VPC must be specified.
+The `awsVpcIpv4CidrBlockAssociation` resource allows further IPv4 CIDR blocks to be added to the VPC.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Vpc } from "./.gen/providers/aws/vpc";
+import { VpcIpv4CidrBlockAssociation } from "./.gen/providers/aws/vpc-ipv4-cidr-block-association";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const main = new Vpc(this, "main", {
+      cidrBlock: "10.0.0.0/16",
+    });
+    new VpcIpv4CidrBlockAssociation(this, "secondary_cidr", {
+      cidrBlock: "172.20.0.0/16",
+      vpcId: main.id,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `cidrBlock` - (Optional) The IPv4 CIDR block for the VPC. CIDR can be explicitly set or it can be derived from IPAM using `ipv4NetmaskLength`.
+* `ipv4IpamPoolId` - (Optional) The ID of an IPv4 IPAM pool you want to use for allocating this VPC's CIDR. IPAM is a VPC feature that you can use to automate your IP address management workflows including assigning, tracking, troubleshooting, and auditing IP addresses across AWS Regions and accounts. Using IPAM you can monitor IP address usage throughout your AWS Organization.
+* `ipv4NetmaskLength` - (Optional) The netmask length of the IPv4 CIDR you want to allocate to this VPC. Requires specifying a `ipv4IpamPoolId`.
+* `vpcId` - (Required) The ID of the VPC to make the association with.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the VPC CIDR association
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `10M`)
+- `delete` - (Default `10M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsVpcIpv4CidrBlockAssociation` using the VPC CIDR Association ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsVpcIpv4CidrBlockAssociation` using the VPC CIDR Association ID. For example:
+
+```console
+% terraform import aws_vpc_ipv4_cidr_block_association.example vpc-cidr-assoc-xxxxxxxx
+```
+
+<!-- cache-key: cdktf-0.18.0 input-e6e4470001cf2936d2999e896d3abef4818433b72b60c96368624c0b9f649444 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/vpc_ipv6_cidr_block_association.html.markdown b/website/docs/cdktf/typescript/r/vpc_ipv6_cidr_block_association.html.markdown
new file mode 100644
index 00000000000..e8d47d1fce0
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/vpc_ipv6_cidr_block_association.html.markdown
@@ -0,0 +1,94 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_vpc_ipv6_cidr_block_association"
+description: |-
+  Associate additional IPv6 CIDR blocks with a VPC
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_vpc_ipv6_cidr_block_association
+
+Provides a resource to associate additional IPv6 CIDR blocks with a VPC.
+
+The `awsVpcIpv6CidrBlockAssociation` resource allows IPv6 CIDR blocks to be added to the VPC.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Vpc } from "./.gen/providers/aws/vpc";
+import { VpcIpv6CidrBlockAssociation } from "./.gen/providers/aws/vpc-ipv6-cidr-block-association";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const test = new Vpc(this, "test", {
+      cidrBlock: "10.0.0.0/16",
+    });
+    const awsVpcIpv6CidrBlockAssociationTest = new VpcIpv6CidrBlockAssociation(
+      this,
+      "test_1",
+      {
+        ipv6IpamPoolId: Token.asString(awsVpcIpamPoolTest.id),
+        vpcId: test.id,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsVpcIpv6CidrBlockAssociationTest.overrideLogicalId("test");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `ipv6CidrBlock` - (Optional) The IPv6 CIDR block for the VPC. CIDR can be explicitly set or it can be derived from IPAM using `ipv6NetmaskLength`. This parameter is required if `ipv6NetmaskLength` is not set and the IPAM pool does not have `allocationDefaultNetmask` set.
+* `ipv6IpamPoolId` - (Required) The ID of an IPv6 IPAM pool you want to use for allocating this VPC's CIDR. IPAM is a VPC feature that you can use to automate your IP address management workflows including assigning, tracking, troubleshooting, and auditing IP addresses across AWS Regions and accounts.
+* `ipv6NetmaskLength` - (Optional) The netmask length of the IPv6 CIDR you want to allocate to this VPC. Requires specifying a `ipv6IpamPoolId`. This parameter is optional if the IPAM pool has `allocationDefaultNetmask` set, otherwise it or `cidrBlock` are required
+* `vpcId` - (Required) The ID of the VPC to make the association with.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `10M`)
+- `delete` - (Default `10M`)
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the VPC CIDR association
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `awsVpcIpv6CidrBlockAssociation` using the VPC CIDR Association ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import `awsVpcIpv6CidrBlockAssociation` using the VPC CIDR Association ID. For example:
+
+```console
+% terraform import aws_vpc_ipv6_cidr_block_association.example vpc-cidr-assoc-xxxxxxxx
+```
+
+<!-- cache-key: cdktf-0.18.0 input-2a201569794abd4dddb78258ff009909eca49be072f28d838cf246ae7161cc63 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/vpc_network_performance_metric_subscription.html.markdown b/website/docs/cdktf/typescript/r/vpc_network_performance_metric_subscription.html.markdown
new file mode 100644
index 00000000000..07b9b0d425d
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/vpc_network_performance_metric_subscription.html.markdown
@@ -0,0 +1,53 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_vpc_network_performance_metric_subscription"
+description: |-
+  Provides a resource to manage an Infrastructure Performance subscription.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_vpc_network_performance_metric_subscription
+
+Provides a resource to manage an Infrastructure Performance subscription.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { VpcNetworkPerformanceMetricSubscription } from "./.gen/providers/aws/vpc-network-performance-metric-subscription";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new VpcNetworkPerformanceMetricSubscription(this, "example", {
+      destination: "us-west-1",
+      source: "us-east-1",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `destination` - (Required) The target Region or Availability Zone that the metric subscription is enabled for. For example, `euWest1`.
+* `metric` - (Optional) The metric used for the enabled subscription. Valid values: `aggregateLatency`. Default: `aggregateLatency`.
+* `source` - (Required) The source Region or Availability Zone that the metric subscription is enabled for. For example, `usEast1`.
+* `statistic` - (Optional) The statistic used for the enabled subscription. Valid values: `p50`. Default: `p50`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `period` - The data aggregation time for the subscription.
+
+<!-- cache-key: cdktf-0.18.0 input-9d68b5453f7e730fab6a7906222b20f270436a0a63a8e8c8fed51dab43b1b2e7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/vpc_peering_connection.html.markdown b/website/docs/cdktf/typescript/r/vpc_peering_connection.html.markdown
new file mode 100644
index 00000000000..3fe0cc6c565
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/vpc_peering_connection.html.markdown
@@ -0,0 +1,232 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_vpc_peering_connection"
+description: |-
+  Provides a resource to manage a VPC peering connection.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_vpc_peering_connection
+
+Provides a resource to manage a VPC peering connection.
+
+~> **NOTE on VPC Peering Connections and VPC Peering Connection Options:** Terraform provides
+both a standalone [VPC Peering Connection Options](vpc_peering_connection_options.html) and a VPC Peering Connection
+resource with `accepter` and `requester` attributes. Do not manage options for the same VPC peering
+connection in both a VPC Peering Connection resource and a VPC Peering Connection Options resource.
+Doing so will cause a conflict of options and will overwrite the options.
+Using a VPC Peering Connection Options resource decouples management of the connection options from
+management of the VPC Peering Connection and allows options to be set correctly in cross-account scenarios.
+
+-> **Note:** For cross-account (requester's AWS account differs from the accepter's AWS account) or inter-region
+VPC Peering Connections use the `awsVpcPeeringConnection` resource to manage the requester's side of the
+connection and use the `awsVpcPeeringConnectionAccepter` resource to manage the accepter's side of the connection.
+
+-> **Note:** Creating multiple `awsVpcPeeringConnection` resources with the same `peerVpcId` and `vpcId` will not produce an error. Instead, AWS will return the connection `id` that already exists, resulting in multiple `awsVpcPeeringConnection` resources with the same `id`.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { VpcPeeringConnection } from "./.gen/providers/aws/vpc-peering-connection";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new VpcPeeringConnection(this, "foo", {
+      peerOwnerId: peerOwnerId.stringValue,
+      peerVpcId: bar.id,
+      vpcId: Token.asString(awsVpcFoo.id),
+    });
+  }
+}
+
+```
+
+Basic usage with connection options:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { VpcPeeringConnection } from "./.gen/providers/aws/vpc-peering-connection";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new VpcPeeringConnection(this, "foo", {
+      accepter: {
+        allowRemoteVpcDnsResolution: true,
+      },
+      peerOwnerId: peerOwnerId.stringValue,
+      peerVpcId: bar.id,
+      requester: {
+        allowRemoteVpcDnsResolution: true,
+      },
+      vpcId: Token.asString(awsVpcFoo.id),
+    });
+  }
+}
+
+```
+
+Basic usage with tags:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Vpc } from "./.gen/providers/aws/vpc";
+import { VpcPeeringConnection } from "./.gen/providers/aws/vpc-peering-connection";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const bar = new Vpc(this, "bar", {
+      cidrBlock: "10.2.0.0/16",
+    });
+    const foo = new Vpc(this, "foo", {
+      cidrBlock: "10.1.0.0/16",
+    });
+    const awsVpcPeeringConnectionFoo = new VpcPeeringConnection(this, "foo_2", {
+      autoAccept: true,
+      peerOwnerId: peerOwnerId.stringValue,
+      peerVpcId: bar.id,
+      tags: {
+        Name: "VPC Peering between foo and bar",
+      },
+      vpcId: foo.id,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsVpcPeeringConnectionFoo.overrideLogicalId("foo");
+  }
+}
+
+```
+
+Basic usage with region:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Vpc } from "./.gen/providers/aws/vpc";
+import { VpcPeeringConnection } from "./.gen/providers/aws/vpc-peering-connection";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const bar = new Vpc(this, "bar", {
+      cidrBlock: "10.2.0.0/16",
+      provider: usEast1,
+    });
+    const foo = new Vpc(this, "foo", {
+      cidrBlock: "10.1.0.0/16",
+      provider: usWest2,
+    });
+    const awsVpcPeeringConnectionFoo = new VpcPeeringConnection(this, "foo_2", {
+      peerOwnerId: peerOwnerId.stringValue,
+      peerRegion: "us-east-1",
+      peerVpcId: bar.id,
+      vpcId: foo.id,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsVpcPeeringConnectionFoo.overrideLogicalId("foo");
+  }
+}
+
+```
+
+## Argument Reference
+
+-> **Note:** Modifying the VPC Peering Connection options requires peering to be active. An automatic activation
+can be done using the [`autoAccept`](vpc_peering_connection.html#auto_accept) attribute. Alternatively, the VPC Peering
+Connection has to be made active manually using other means. See [notes](vpc_peering_connection.html#notes) below for
+more information.
+
+This argument supports the following arguments:
+
+* `peerOwnerId` - (Optional) The AWS account ID of the owner of the peer VPC.
+   Defaults to the account ID the [AWS provider][1] is currently connected to.
+* `peerVpcId` - (Required) The ID of the VPC with which you are creating the VPC Peering Connection.
+* `vpcId` - (Required) The ID of the requester VPC.
+* `autoAccept` - (Optional) Accept the peering (both VPCs need to be in the same AWS account and region).
+* `peerRegion` - (Optional) The region of the accepter VPC of the VPC Peering Connection. `autoAccept` must be `false`,
+and use the `awsVpcPeeringConnectionAccepter` to manage the accepter side.
+* `accepter` (Optional) - An optional configuration block that allows for [VPC Peering Connection](https://docs.aws.amazon.com/vpc/latest/peering/what-is-vpc-peering.html) options to be set for the VPC that accepts
+the peering connection (a maximum of one).
+* `requester` (Optional) - A optional configuration block that allows for [VPC Peering Connection](https://docs.aws.amazon.com/vpc/latest/peering/what-is-vpc-peering.html) options to be set for the VPC that requests
+the peering connection (a maximum of one).
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+#### Accepter and Requester Arguments
+
+-> **Note:** When enabled, the DNS resolution feature requires that VPCs participating in the peering
+must have support for the DNS hostnames enabled. This can be done using the [`enableDnsHostnames`](vpc.html#enable_dns_hostnames) attribute in the [`awsVpc`](vpc.html) resource. See [Using DNS with Your VPC](http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/vpc-dns.html) user guide for more information.
+
+* `allowRemoteVpcDnsResolution` - (Optional) Allow a local VPC to resolve public DNS hostnames to
+private IP addresses when queried from instances in the peer VPC.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the VPC Peering Connection.
+* `acceptStatus` - The status of the VPC Peering Connection request.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Notes
+
+If both VPCs are not in the same AWS account and region do not enable the `autoAccept` attribute.
+The accepter can manage its side of the connection using the `awsVpcPeeringConnectionAccepter` resource
+or accept the connection manually using the AWS Management Console, AWS CLI, through SDKs, etc.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `1M`)
+- `update` - (Default `1M`)
+- `delete` - (Default `1M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import VPC Peering resources using the VPC peering `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import VPC Peering resources using the VPC peering `id`. For example:
+
+```console
+% terraform import aws_vpc_peering_connection.test_connection pcx-111aaa111
+```
+
+[1]: /docs/providers/aws/index.html
+
+<!-- cache-key: cdktf-0.18.0 input-73a508d459b90465fa5267c1055341add54eefba044dcb055a7d430ee33449de -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/vpc_peering_connection_accepter.html.markdown b/website/docs/cdktf/typescript/r/vpc_peering_connection_accepter.html.markdown
new file mode 100644
index 00000000000..3d65b0d8f25
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/vpc_peering_connection_accepter.html.markdown
@@ -0,0 +1,182 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_vpc_peering_connection_accepter"
+description: |-
+  Manage the accepter's side of a VPC Peering Connection.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_vpc_peering_connection_accepter
+
+Provides a resource to manage the accepter's side of a VPC Peering Connection.
+
+When a cross-account (requester's AWS account differs from the accepter's AWS account) or an inter-region
+VPC Peering Connection is created, a VPC Peering Connection resource is automatically created in the
+accepter's account.
+The requester can use the `awsVpcPeeringConnection` resource to manage its side of the connection
+and the accepter can use the `awsVpcPeeringConnectionAccepter` resource to "adopt" its side of the
+connection into management.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCallerIdentity } from "./.gen/providers/aws/data-aws-caller-identity";
+import { AwsProvider } from "./.gen/providers/aws/provider";
+import { Vpc } from "./.gen/providers/aws/vpc";
+import { VpcPeeringConnection } from "./.gen/providers/aws/vpc-peering-connection";
+import { VpcPeeringConnectionAccepterA } from "./.gen/providers/aws/vpc-peering-connection-accepter";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new AwsProvider(this, "aws", {
+      region: "us-east-1",
+    });
+    const peer = new AwsProvider(this, "aws_1", {
+      alias: "peer",
+      region: "us-west-2",
+    });
+    const main = new Vpc(this, "main", {
+      cidrBlock: "10.0.0.0/16",
+    });
+    const awsVpcPeer = new Vpc(this, "peer", {
+      cidrBlock: "10.1.0.0/16",
+      provider: peer,
+    });
+    const dataAwsCallerIdentityPeer = new DataAwsCallerIdentity(
+      this,
+      "peer_4",
+      {
+        provider: peer,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsCallerIdentityPeer.overrideLogicalId("peer");
+    const awsVpcPeeringConnectionPeer = new VpcPeeringConnection(
+      this,
+      "peer_5",
+      {
+        autoAccept: false,
+        peerOwnerId: Token.asString(dataAwsCallerIdentityPeer.accountId),
+        peerRegion: "us-west-2",
+        peerVpcId: Token.asString(awsVpcPeer.id),
+        tags: {
+          Side: "Requester",
+        },
+        vpcId: main.id,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsVpcPeeringConnectionPeer.overrideLogicalId("peer");
+    const awsVpcPeeringConnectionAccepterPeer =
+      new VpcPeeringConnectionAccepterA(this, "peer_6", {
+        autoAccept: true,
+        provider: peer,
+        tags: {
+          Side: "Accepter",
+        },
+        vpcPeeringConnectionId: Token.asString(awsVpcPeeringConnectionPeer.id),
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsVpcPeeringConnectionAccepterPeer.overrideLogicalId("peer");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `vpcPeeringConnectionId` - (Required) The VPC Peering Connection ID to manage.
+* `autoAccept` - (Optional) Whether or not to accept the peering request. Defaults to `false`.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Removing `awsVpcPeeringConnectionAccepter` from your configuration
+
+AWS allows a cross-account VPC Peering Connection to be deleted from either the requester's or accepter's side.
+However, Terraform only allows the VPC Peering Connection to be deleted from the requester's side
+by removing the corresponding `awsVpcPeeringConnection` resource from your configuration.
+Removing a `awsVpcPeeringConnectionAccepter` resource from your configuration will remove it
+from your statefile and management, **but will not destroy the VPC Peering Connection.**
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the VPC Peering Connection.
+* `acceptStatus` - The status of the VPC Peering Connection request.
+* `vpcId` - The ID of the accepter VPC.
+* `peerVpcId` - The ID of the requester VPC.
+* `peerOwnerId` - The AWS account ID of the owner of the requester VPC.
+* `peerRegion` - The region of the accepter VPC.
+* `accepter` - A configuration block that describes [VPC Peering Connection]
+(https://docs.aws.amazon.com/vpc/latest/peering/what-is-vpc-peering.html) options set for the accepter VPC.
+* `requester` - A configuration block that describes [VPC Peering Connection]
+(https://docs.aws.amazon.com/vpc/latest/peering/what-is-vpc-peering.html) options set for the requester VPC.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+#### Accepter and Requester Attribute Reference
+
+* `allowRemoteVpcDnsResolution` - Indicates whether a local VPC can resolve public DNS hostnames to
+private IP addresses when queried from instances in a peer VPC.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import VPC Peering Connection Accepters using the Peering Connection ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import VPC Peering Connection Accepters using the Peering Connection ID. For example:
+
+```console
+% terraform import aws_vpc_peering_connection_accepter.example pcx-12345678
+```
+
+Certain resource arguments, like `autoAccept`, do not have an EC2 API method for reading the information after peering connection creation. If the argument is set in the Terraform configuration on an imported resource, Terraform will always show a difference. To workaround this behavior, either omit the argument from the Terraform configuration or use [`ignoreChanges`](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html#ignore_changes) to hide the difference. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { VpcPeeringConnectionAccepterA } from "./.gen/providers/aws/vpc-peering-connection-accepter";
+interface MyConfig {
+  vpcPeeringConnectionId: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new VpcPeeringConnectionAccepterA(this, "example", {
+      lifecycle: {
+        ignoreChanges: [autoAccept],
+      },
+      vpcPeeringConnectionId: config.vpcPeeringConnectionId,
+    });
+  }
+}
+
+```
+
+<!-- cache-key: cdktf-0.18.0 input-dbb400c8499f3d1bd1cf4007a705760a09da1d8679355ddec9917b7f40b9f101 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/vpc_peering_connection_options.html.markdown b/website/docs/cdktf/typescript/r/vpc_peering_connection_options.html.markdown
new file mode 100644
index 00000000000..971588b02be
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/vpc_peering_connection_options.html.markdown
@@ -0,0 +1,210 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_vpc_peering_connection_options"
+description: |-
+  Provides a resource to manage VPC peering connection options.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_vpc_peering_connection_options
+
+Provides a resource to manage VPC peering connection options.
+
+~> **NOTE on VPC Peering Connections and VPC Peering Connection Options:** Terraform provides
+both a standalone VPC Peering Connection Options and a [VPC Peering Connection](vpc_peering_connection.html)
+resource with `accepter` and `requester` attributes. Do not manage options for the same VPC peering
+connection in both a VPC Peering Connection resource and a VPC Peering Connection Options resource.
+Doing so will cause a conflict of options and will overwrite the options.
+Using a VPC Peering Connection Options resource decouples management of the connection options from
+management of the VPC Peering Connection and allows options to be set correctly in cross-region and
+cross-account scenarios.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Vpc } from "./.gen/providers/aws/vpc";
+import { VpcPeeringConnection } from "./.gen/providers/aws/vpc-peering-connection";
+import { VpcPeeringConnectionOptions } from "./.gen/providers/aws/vpc-peering-connection-options";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const bar = new Vpc(this, "bar", {
+      cidrBlock: "10.1.0.0/16",
+    });
+    const foo = new Vpc(this, "foo", {
+      cidrBlock: "10.0.0.0/16",
+    });
+    const awsVpcPeeringConnectionFoo = new VpcPeeringConnection(this, "foo_2", {
+      autoAccept: true,
+      peerVpcId: bar.id,
+      vpcId: foo.id,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsVpcPeeringConnectionFoo.overrideLogicalId("foo");
+    const awsVpcPeeringConnectionOptionsFoo = new VpcPeeringConnectionOptions(
+      this,
+      "foo_3",
+      {
+        accepter: {
+          allowRemoteVpcDnsResolution: true,
+        },
+        vpcPeeringConnectionId: Token.asString(awsVpcPeeringConnectionFoo.id),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsVpcPeeringConnectionOptionsFoo.overrideLogicalId("foo");
+  }
+}
+
+```
+
+### Cross-Account Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCallerIdentity } from "./.gen/providers/aws/data-aws-caller-identity";
+import { AwsProvider } from "./.gen/providers/aws/provider";
+import { Vpc } from "./.gen/providers/aws/vpc";
+import { VpcPeeringConnection } from "./.gen/providers/aws/vpc-peering-connection";
+import { VpcPeeringConnectionAccepterA } from "./.gen/providers/aws/vpc-peering-connection-accepter";
+import { VpcPeeringConnectionOptions } from "./.gen/providers/aws/vpc-peering-connection-options";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const requester = new AwsProvider(this, "aws", {
+      alias: "requester",
+    });
+    const accepter = new AwsProvider(this, "aws_1", {
+      alias: "accepter",
+    });
+    const main = new Vpc(this, "main", {
+      cidrBlock: "10.0.0.0/16",
+      enableDnsHostnames: true,
+      enableDnsSupport: true,
+      provider: requester,
+    });
+    const peer = new Vpc(this, "peer", {
+      cidrBlock: "10.1.0.0/16",
+      enableDnsHostnames: true,
+      enableDnsSupport: true,
+      provider: accepter,
+    });
+    const dataAwsCallerIdentityPeer = new DataAwsCallerIdentity(
+      this,
+      "peer_4",
+      {
+        provider: accepter,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsCallerIdentityPeer.overrideLogicalId("peer");
+    const awsVpcPeeringConnectionPeer = new VpcPeeringConnection(
+      this,
+      "peer_5",
+      {
+        autoAccept: false,
+        peerOwnerId: Token.asString(dataAwsCallerIdentityPeer.accountId),
+        peerVpcId: peer.id,
+        provider: requester,
+        tags: {
+          Side: "Requester",
+        },
+        vpcId: main.id,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsVpcPeeringConnectionPeer.overrideLogicalId("peer");
+    const awsVpcPeeringConnectionAccepterPeer =
+      new VpcPeeringConnectionAccepterA(this, "peer_6", {
+        autoAccept: true,
+        provider: accepter,
+        tags: {
+          Side: "Accepter",
+        },
+        vpcPeeringConnectionId: Token.asString(awsVpcPeeringConnectionPeer.id),
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsVpcPeeringConnectionAccepterPeer.overrideLogicalId("peer");
+    new VpcPeeringConnectionOptions(this, "accepter", {
+      accepter: {
+        allowRemoteVpcDnsResolution: true,
+      },
+      provider: accepter,
+      vpcPeeringConnectionId: Token.asString(
+        awsVpcPeeringConnectionAccepterPeer.id
+      ),
+    });
+    new VpcPeeringConnectionOptions(this, "requester", {
+      provider: requester,
+      requester: {
+        allowRemoteVpcDnsResolution: true,
+      },
+      vpcPeeringConnectionId: Token.asString(
+        awsVpcPeeringConnectionAccepterPeer.id
+      ),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `vpcPeeringConnectionId` - (Required) The ID of the requester VPC peering connection.
+* `accepter` (Optional) - An optional configuration block that allows for [VPC Peering Connection](https://docs.aws.amazon.com/vpc/latest/peering/what-is-vpc-peering.html) options to be set for the VPC that acceptsthe peering connection (a maximum of one).
+* `requester` (Optional) - A optional configuration block that allows for [VPC Peering Connection](https://docs.aws.amazon.com/vpc/latest/peering/what-is-vpc-peering.html) options to be set for the VPC that requeststhe peering connection (a maximum of one).
+
+#### Accepter and Requester Arguments
+
+-> **Note:** When enabled, the DNS resolution feature requires that VPCs participating in the peering must have support for the DNS hostnames enabled. This can be done using the [`enableDnsHostnames`](vpc.html#enable_dns_hostnames) attribute in the [`awsVpc`](vpc.html) resource. See [Using DNS with Your VPC](http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/vpc-dns.html) user guide for more information.
+
+* `allowRemoteVpcDnsResolution` - (Optional) Allow a local VPC to resolve public DNS hostnames to private IP addresses when queried from instances in the peer VPC.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the VPC Peering Connection Options.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import VPC Peering Connection Options using the VPC peering `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import VPC Peering Connection Options using the VPC peering `id`. For example:
+
+```console
+% terraform import aws_vpc_peering_connection_options.foo pcx-111aaa111
+```
+
+<!-- cache-key: cdktf-0.18.0 input-0062ec18a4f742aa15c04ce7c0dc2438cb0c8699001025a2f42368b3d237e0ac -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/vpc_security_group_egress_rule.html.markdown b/website/docs/cdktf/typescript/r/vpc_security_group_egress_rule.html.markdown
new file mode 100644
index 00000000000..8cb6c3ebc6b
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/vpc_security_group_egress_rule.html.markdown
@@ -0,0 +1,95 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_vpc_security_group_egress_rule"
+description: |-
+  Provides a VPC security group egress rule resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_vpc_security_group_egress_rule
+
+Manages an outbound (egress) rule for a security group.
+
+When specifying an outbound rule for your security group in a VPC, the configuration must include a destination for the traffic.
+
+~> **NOTE on Security Groups and Security Group Rules:** Terraform currently provides a [Security Group resource](security_group.html) with `ingress` and `egress` rules defined in-line and a [Security Group Rule resource](security_group_rule.html) which manages one or more `ingress` or
+`egress` rules. Both of these resource were added before AWS assigned a [security group rule unique ID](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/security-group-rules.html), and they do not work well in all scenarios using the`description` and `tags` attributes, which rely on the unique ID.
+The `awsVpcSecurityGroupEgressRule` resource has been added to address these limitations and should be used for all new security group rules.
+You should not use the `awsVpcSecurityGroupEgressRule` resource in conjunction with an `awsSecurityGroup` resource with in-line rules or with `awsSecurityGroupRule` resources defined for the same Security Group, as rule conflicts may occur and rules will be overwritten.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { VpcSecurityGroupEgressRule } from "./.gen/providers/aws/vpc-security-group-egress-rule";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new VpcSecurityGroupEgressRule(this, "example", {
+      cidrIpv4: "10.0.0.0/8",
+      fromPort: 80,
+      ipProtocol: "tcp",
+      securityGroupId: Token.asString(awsSecurityGroupExample.id),
+      toPort: 80,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+~> **Note** Although `cidrIpv4`, `cidrIpv6`, `prefixListId`, and `referencedSecurityGroupId` are all marked as optional, you *must* provide one of them in order to configure the destination of the traffic. The `fromPort` and `toPort` arguments are required unless `ipProtocol` is set to `1` or `icmpv6`.
+
+This argument supports the following arguments:
+
+* `cidrIpv4` - (Optional) The destination IPv4 CIDR range.
+* `cidrIpv6` - (Optional) The destination IPv6 CIDR range.
+* `description` - (Optional) The security group rule description.
+* `fromPort` - (Optional) The start of port range for the TCP and UDP protocols, or an ICMP/ICMPv6 type.
+* `ipProtocol` - (Optional) The IP protocol name or number. Use `1` to specify all protocols. Note that if `ipProtocol` is set to `1`, it translates to all protocols, all port ranges, and `fromPort` and `toPort` values should not be defined.
+* `prefixListId` - (Optional) The ID of the destination prefix list.
+* `referencedSecurityGroupId` - (Optional) The destination security group that is referenced in the rule.
+* `securityGroupId` - (Required) The ID of the security group.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `toPort` - (Optional) The end of port range for the TCP and UDP protocols, or an ICMP/ICMPv6 code.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the security group rule.
+* `securityGroupRuleId` - The ID of the security group rule.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import security group egress rules using the `securityGroupRuleId`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import security group egress rules using the `securityGroupRuleId`. For example:
+
+```console
+% terraform import aws_vpc_security_group_egress_rule.example sgr-02108b27edd666983
+```
+
+<!-- cache-key: cdktf-0.18.0 input-3621cd75bed627759b23d79804e271902694303345d1faee64fd0fa94f65fd5d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/vpc_security_group_ingress_rule.html.markdown b/website/docs/cdktf/typescript/r/vpc_security_group_ingress_rule.html.markdown
new file mode 100644
index 00000000000..72862ac7a78
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/vpc_security_group_ingress_rule.html.markdown
@@ -0,0 +1,95 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_vpc_security_group_ingress_rule"
+description: |-
+  Provides a VPC security group ingress rule resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_vpc_security_group_ingress_rule
+
+Manages an inbound (ingress) rule for a security group.
+
+When specifying an inbound rule for your security group in a VPC, the configuration must include a source for the traffic.
+
+~> **NOTE on Security Groups and Security Group Rules:** Terraform currently provides a [Security Group resource](security_group.html) with `ingress` and `egress` rules defined in-line and a [Security Group Rule resource](security_group_rule.html) which manages one or more `ingress` or
+`egress` rules. Both of these resource were added before AWS assigned a [security group rule unique ID](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/security-group-rules.html), and they do not work well in all scenarios using the`description` and `tags` attributes, which rely on the unique ID.
+The `awsVpcSecurityGroupIngressRule` resource has been added to address these limitations and should be used for all new security group rules.
+You should not use the `awsVpcSecurityGroupIngressRule` resource in conjunction with an `awsSecurityGroup` resource with in-line rules or with `awsSecurityGroupRule` resources defined for the same Security Group, as rule conflicts may occur and rules will be overwritten.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { VpcSecurityGroupIngressRule } from "./.gen/providers/aws/vpc-security-group-ingress-rule";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new VpcSecurityGroupIngressRule(this, "example", {
+      cidrIpv4: "10.0.0.0/8",
+      fromPort: 80,
+      ipProtocol: "tcp",
+      securityGroupId: Token.asString(awsSecurityGroupExample.id),
+      toPort: 80,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+~> **Note** Although `cidrIpv4`, `cidrIpv6`, `prefixListId`, and `referencedSecurityGroupId` are all marked as optional, you *must* provide one of them in order to configure the destination of the traffic. The `fromPort` and `toPort` arguments are required unless `ipProtocol` is set to `1` or `icmpv6`.
+
+* `cidrIpv4` - (Optional) The source IPv4 CIDR range.
+* `cidrIpv6` - (Optional) The source IPv6 CIDR range.
+* `description` - (Optional) The security group rule description.
+* `fromPort` - (Optional) The start of port range for the TCP and UDP protocols, or an ICMP/ICMPv6 type.
+* `ipProtocol` - (Required) The IP protocol name or number. Use `1` to specify all protocols. Note that if `ipProtocol` is set to `1`, it translates to all protocols, all port ranges, and `fromPort` and `toPort` values should not be defined.
+* `prefixListId` - (Optional) The ID of the source prefix list.
+* `referencedSecurityGroupId` - (Optional) The source security group that is referenced in the rule.
+* `securityGroupId` - (Required) The ID of the security group.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `toPort` - (Optional) The end of port range for the TCP and UDP protocols, or an ICMP/ICMPv6 code.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the security group rule.
+* `securityGroupRuleId` - The ID of the security group rule.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import security group ingress rules using the `securityGroupRuleId`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import security group ingress rules using the `securityGroupRuleId`. For example:
+
+```console
+% terraform import aws_vpc_security_group_ingress_rule.example sgr-02108b27edd666983
+```
+
+<!-- cache-key: cdktf-0.18.0 input-342da4e18ab78aa5e23ae36caa8f6f8db7a836ccfe08cb53a9e1fe0b87ef8b39 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/vpclattice_access_log_subscription.html.markdown b/website/docs/cdktf/typescript/r/vpclattice_access_log_subscription.html.markdown
new file mode 100644
index 00000000000..40a6eacce5a
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/vpclattice_access_log_subscription.html.markdown
@@ -0,0 +1,77 @@
+---
+subcategory: "VPC Lattice"
+layout: "aws"
+page_title: "AWS: aws_vpclattice_access_log_subscription"
+description: |-
+  Terraform resource for managing an AWS VPC Lattice Service Network or Services Access log subscription.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_vpclattice_access_log_subscription
+
+Terraform resource for managing an AWS VPC Lattice Service Network or Service Access log subscription.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { VpclatticeAccessLogSubscription } from "./.gen/providers/aws/vpclattice-access-log-subscription";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new VpclatticeAccessLogSubscription(this, "example", {
+      destinationArn: Token.asString(bucket.arn),
+      resourceIdentifier: Token.asString(awsVpclatticeServiceNetworkExample.id),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `destinationArn` - (Required) Amazon Resource Name (ARN) of the log destination.
+* `resourceIdentifier` - (Required) The ID or Amazon Resource Identifier (ARN) of the service network or service. You must use the ARN if the resources specified in the operation are in different accounts.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the access log subscription.
+* `arn` - Amazon Resource Name (ARN) of the access log subscription.
+* `resourceArn` - Amazon Resource Name (ARN) of the service network or service.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import VPC Lattice Access Log Subscription using the access log subscription ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import VPC Lattice Access Log Subscription using the access log subscription ID. For example:
+
+```console
+% terraform import aws_vpclattice_access_log_subscription.example rft-8012925589
+```
+
+<!-- cache-key: cdktf-0.18.0 input-071e5e00ee8c7257836217b64dd4601a37eae349f38d2cca190da1ad40bc2a7d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/vpclattice_auth_policy.html.markdown b/website/docs/cdktf/typescript/r/vpclattice_auth_policy.html.markdown
new file mode 100644
index 00000000000..1c21882b256
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/vpclattice_auth_policy.html.markdown
@@ -0,0 +1,113 @@
+---
+subcategory: "VPC Lattice"
+layout: "aws"
+page_title: "AWS: aws_vpclattice_auth_policy"
+description: |-
+  Terraform resource for managing an AWS VPC Lattice Auth Policy.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_vpclattice_auth_policy
+
+Terraform resource for managing an AWS VPC Lattice Auth Policy.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { VpclatticeAuthPolicy } from "./.gen/providers/aws/vpclattice-auth-policy";
+import { VpclatticeService } from "./.gen/providers/aws/vpclattice-service";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new VpclatticeService(this, "example", {
+      authType: "AWS_IAM",
+      customDomainName: "example.com",
+      name: "example-vpclattice-service",
+    });
+    const awsVpclatticeAuthPolicyExample = new VpclatticeAuthPolicy(
+      this,
+      "example_1",
+      {
+        policy: Token.asString(
+          Fn.jsonencode({
+            Statement: [
+              {
+                Action: "*",
+                Condition: {
+                  StringNotEqualsIgnoreCase: {
+                    "aws:PrincipalType": "anonymous",
+                  },
+                },
+                Effect: "Allow",
+                Principal: "*",
+                Resource: "*",
+              },
+            ],
+            Version: "2012-10-17",
+          })
+        ),
+        resourceIdentifier: example.arn,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsVpclatticeAuthPolicyExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `resourceIdentifier` - (Required) The ID or Amazon Resource Name (ARN) of the service network or service for which the policy is created.
+* `policy` - (Required) The auth policy. The policy string in JSON must not contain newlines or blank lines.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `policy` - The auth policy. The policy string in JSON must not contain newlines or blank lines.
+* `state` - The state of the auth policy. The auth policy is only active when the auth type is set to AWS_IAM. If you provide a policy, then authentication and authorization decisions are made based on this policy and the client's IAM policy. If the Auth type is NONE, then, any auth policy you provide will remain inactive.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `60M`)
+* `update` - (Default `180M`)
+* `delete` - (Default `90M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import VPC Lattice Auth Policy using the `exampleIdArg`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import VPC Lattice Auth Policy using the `exampleIdArg`. For example:
+
+```console
+% terraform import aws_vpclattice_auth_policy.example rft-8012925589
+```
+
+<!-- cache-key: cdktf-0.18.0 input-b4a5732fa3a54f088c4124bbf3f60126a39eedadb80630bef753b4e9195b528d -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/vpclattice_listener.html.markdown b/website/docs/cdktf/typescript/r/vpclattice_listener.html.markdown
new file mode 100644
index 00000000000..410fa68ef89
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/vpclattice_listener.html.markdown
@@ -0,0 +1,227 @@
+---
+subcategory: "VPC Lattice"
+layout: "aws"
+page_title: "AWS: aws_vpclattice_listener"
+description: |-
+  Terraform resource for managing an AWS VPC Lattice Listener.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_vpclattice_listener
+
+Terraform resource for managing an AWS VPC Lattice Listener.
+
+## Example Usage
+
+### Fixed response action
+
+```
+resource "aws_vpclattice_service" "test" {
+  name = %[1]q
+}
+
+resource "aws_vpclattice_listener" "test" {
+  name               = %[1]q
+  protocol           = "HTTPS"
+  service_identifier = aws_vpclattice_service.test.id
+  default_action {
+    fixed_response {
+      status_code = 404
+    }
+  }
+}
+```
+
+### Forward action
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { VpclatticeListener } from "./.gen/providers/aws/vpclattice-listener";
+import { VpclatticeService } from "./.gen/providers/aws/vpclattice-service";
+import { VpclatticeTargetGroup } from "./.gen/providers/aws/vpclattice-target-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new VpclatticeService(this, "test", {
+      name: "example",
+    });
+    const example = new VpclatticeTargetGroup(this, "example", {
+      config: {
+        port: 80,
+        protocol: "HTTP",
+        vpcIdentifier: Token.asString(awsVpcTest.id),
+      },
+      name: "example-target-group-1",
+      type: "INSTANCE",
+    });
+    const awsVpclatticeListenerExample = new VpclatticeListener(
+      this,
+      "example_2",
+      {
+        defaultAction: {
+          forward: [
+            {
+              targetGroups: [
+                {
+                  targetGroupIdentifier: example.id,
+                },
+              ],
+            },
+          ],
+        },
+        name: "example",
+        protocol: "HTTP",
+        serviceIdentifier: Token.asString(awsVpclatticeServiceExample.id),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsVpclatticeListenerExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### Forward action with weighted target groups
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { VpclatticeListener } from "./.gen/providers/aws/vpclattice-listener";
+import { VpclatticeService } from "./.gen/providers/aws/vpclattice-service";
+import { VpclatticeTargetGroup } from "./.gen/providers/aws/vpclattice-target-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new VpclatticeService(this, "test", {
+      name: "example",
+    });
+    const example1 = new VpclatticeTargetGroup(this, "example1", {
+      config: {
+        port: 80,
+        protocol: "HTTP",
+        vpcIdentifier: Token.asString(awsVpcTest.id),
+      },
+      name: "example-target-group-1",
+      type: "INSTANCE",
+    });
+    const example2 = new VpclatticeTargetGroup(this, "example2", {
+      config: {
+        port: 8080,
+        protocol: "HTTP",
+        vpcIdentifier: Token.asString(awsVpcTest.id),
+      },
+      name: "example-target-group-2",
+      type: "INSTANCE",
+    });
+    new VpclatticeListener(this, "example", {
+      defaultAction: {
+        forward: [
+          {
+            targetGroups: [
+              {
+                targetGroupIdentifier: example1.id,
+                weight: 80,
+              },
+              {
+                targetGroupIdentifier: example2.id,
+                weight: 20,
+              },
+            ],
+          },
+        ],
+      },
+      name: "example",
+      protocol: "HTTP",
+      serviceIdentifier: Token.asString(awsVpclatticeServiceExample.id),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `defaultAction` - (Required) Default action block for the default listener rule. Default action blocks are defined below.
+* `name` - (Required, Forces new resource) Name of the listener. A listener name must be unique within a service. Valid characters are a-z, 0-9, and hyphens (-). You can't use a hyphen as the first or last character, or immediately after another hyphen.
+* `port` - (Optional, Forces new resource) Listener port. You can specify a value from 1 to 65535. If `port` is not specified and `protocol` is HTTP, the value will default to 80. If `port` is not specified and `protocol` is HTTPS, the value will default to 443.
+* `protocol` - (Required, Forces new resource) Protocol for the listener. Supported values are `http` or `https`
+* `serviceArn` - (Optional) Amazon Resource Name (ARN) of the VPC Lattice service. You must include either the `serviceArn` or `serviceIdentifier` arguments.
+* `serviceIdentifier` - (Optional) ID of the VPC Lattice service. You must include either the `serviceArn` or `serviceIdentifier` arguments.
+-> **NOTE:** You must specify one of the following arguments: `serviceArn` or `serviceIdentifier`.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Default Action
+
+Default action blocks (for `defaultAction`) must include at least one of the following argument blocks:
+
+* `fixedResponse` - (Optional) Configuration block for returning a fixed response. See Fixed Response blocks below.
+* `forward` - (Optional) Route requests to one or more target groups. See Forward blocks below.
+
+-> **NOTE:** You must specify exactly one of the following argument blocks: `fixedResponse` or `forward`.
+
+### Fixed Response
+
+Fixed response blocks (for `fixedResponse`) must include the following argument:
+
+* `statusCode` - (Required) Custom HTTP status code to return, e.g. a 404 response code. See [Listeners](https://docs.aws.amazon.com/vpc-lattice/latest/ug/listeners.html) in the AWS documentation for a list of supported codes.
+
+### Forward
+
+Forward blocks (for `forward`) must include the following arguments:
+
+* `targetGroups` - (Required) One or more target group blocks.
+
+### Target Groups
+
+Target group blocks (for `targetGroup`) must include the following arguments:
+
+* `targetGroupIdentifier` - (Required) ID or Amazon Resource Name (ARN) of the target group.
+* `weight` - (Optional) Determines how requests are distributed to the target group. Only required if you specify multiple target groups for a forward action. For example, if you specify two target groups, one with a
+weight of 10 and the other with a weight of 20, the target group with a weight of 20 receives twice as many requests as the other target group. See [Listener rules](https://docs.aws.amazon.com/vpc-lattice/latest/ug/listeners.html#listener-rules) in the AWS documentation for additional examples. Default: `100`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the listener.
+* `createdAt` - Date and time that the listener was created, specified in ISO-8601 format.
+* `listenerId` - Standalone ID of the listener, e.g. `listener0A1B2C3D4E5F6G`.
+* `updatedAt` - Date and time that the listener was last updated, specified in ISO-8601 format.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import VPC Lattice Listener using the `listenerId` of the listener and the `id` of the VPC Lattice service combined with a `/` character. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import VPC Lattice Listener using the `listenerId` of the listener and the `id` of the VPC Lattice service combined with a `/` character. For example:
+
+```console
+% terraform import aws_vpclattice_listener.example svc-1a2b3c4d/listener-987654321
+```
+
+<!-- cache-key: cdktf-0.18.0 input-e2bae928892603c6e366f96e2b306e1d9cc0375cc0bc9fe47de944099b3dfbab -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/vpclattice_listener_rule.html.markdown b/website/docs/cdktf/typescript/r/vpclattice_listener_rule.html.markdown
new file mode 100644
index 00000000000..88c826c195a
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/vpclattice_listener_rule.html.markdown
@@ -0,0 +1,215 @@
+---
+subcategory: "VPC Lattice"
+layout: "aws"
+page_title: "AWS: aws_vpclattice_listener_rule"
+description: |-
+  Terraform resource for managing an AWS VPC Lattice Listener Rule.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_vpclattice_listener_rule
+
+Terraform resource for managing an AWS VPC Lattice Listener Rule.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { VpclatticeListenerRule } from "./.gen/providers/aws/vpclattice-listener-rule";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new VpclatticeListenerRule(this, "test", {
+      action: {
+        forward: {
+          targetGroups: [
+            {
+              targetGroupIdentifier: example.id,
+              weight: 1,
+            },
+            {
+              targetGroupIdentifier: example2.id,
+              weight: 2,
+            },
+          ],
+        },
+      },
+      listenerIdentifier: Token.asString(
+        awsVpclatticeListenerExample.listenerId
+      ),
+      match: {
+        httpMatch: {
+          headerMatches: [
+            {
+              caseSensitive: false,
+              match: {
+                exact: "example-contains",
+              },
+              name: "example-header",
+            },
+          ],
+          pathMatch: {
+            caseSensitive: true,
+            match: {
+              prefix: "/example-path",
+            },
+          },
+        },
+      },
+      name: "example",
+      priority: 20,
+      serviceIdentifier: Token.asString(awsVpclatticeServiceExample.id),
+    });
+  }
+}
+
+```
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { VpclatticeListenerRule } from "./.gen/providers/aws/vpclattice-listener-rule";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new VpclatticeListenerRule(this, "test", {
+      action: {
+        fixedResponse: {
+          statusCode: 404,
+        },
+      },
+      listenerIdentifier: example.listenerId,
+      match: {
+        httpMatch: {
+          pathMatch: {
+            caseSensitive: false,
+            match: {
+              exact: "/example-path",
+            },
+          },
+        },
+      },
+      name: "example",
+      priority: 10,
+      serviceIdentifier: Token.asString(awsVpclatticeServiceExample.id),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `serviceIdentifier` - (Required) The ID or Amazon Resource Identifier (ARN) of the service.
+* `listenerIdentifier` - (Required) The ID or Amazon Resource Name (ARN) of the listener.
+* `action` - (Required) The action for the listener rule.
+* `match` - (Required) The rule match.
+* `name` - (Required) The name of the rule. The name must be unique within the listener. The valid characters are a-z, 0-9, and hyphens (-). You can't use a hyphen as the first or last character, or immediately after another hyphen.
+* `priority` - (Required) The priority assigned to the rule. Each rule for a specific listener must have a unique priority. The lower the priority number the higher the priority.
+
+The following arguments are optional:
+
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`defaultTags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+action (`action`) supports the following:
+
+* `fixedResponse` - (Optional) Describes the rule action that returns a custom HTTP response.
+* `forward` - (Optional) The forward action. Traffic that matches the rule is forwarded to the specified target groups.
+
+fixed response (`fixedResponse`) supports the following:
+
+* `statusCode` - (Optional) The HTTP response code.
+
+forward (`forward`) supports the following:
+
+* `targetGroups` - (Optional) The target groups. Traffic matching the rule is forwarded to the specified target groups. With forward actions, you can assign a weight that controls the prioritization and selection of each target group. This means that requests are distributed to individual target groups based on their weights. For example, if two target groups have the same weight, each target group receives half of the traffic.
+
+The default value is 1 with maximum number of 2. If only one target group is provided, there is no need to set the weight; 100% of traffic will go to that target group.
+
+action (`match`) supports the following:
+
+* `httpMatch` - (Optional) The HTTP criteria that a rule must match.
+
+http match (`httpMatch`) supports the following:
+
+* `headerMatches` - (Optional) The header matches. Matches incoming requests with rule based on request header value before applying rule action.
+* `method` - (Optional) The HTTP method type.
+* `pathMatch` - (Optional) The path match.
+
+header matches (`headerMatches`) supports the following:
+
+* `caseSensitive` - (Optional) Indicates whether the match is case sensitive. Defaults to false.
+* `match` - (Optional) The header match type.
+* `name` - (Optional) The name of the header.
+
+header matches match (`match`) supports the following:
+
+* `contains` - (Optional) Specifies a contains type match.
+* `exact` - (Optional) Specifies an exact type match.
+* `prefix` - (Optional) Specifies a prefix type match. Matches the value with the prefix.
+
+path match (`pathMatch`) supports the following:
+
+* `caseSensitive` - (Optional) Indicates whether the match is case sensitive. Defaults to false.
+* `match` - (Optional) The header match type.
+
+path match match (`match`) supports the following:
+
+* `exact` - (Optional) Specifies an exact type match.
+* `prefix` - (Optional) Specifies a prefix type match. Matches the value with the prefix.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN for the listener rule.
+* `ruleId` - Unique identifier for the listener rule.
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `60M`)
+* `update` - (Default `180M`)
+* `delete` - (Default `90M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import VPC Lattice Listener Rule using the `exampleIdArg`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import VPC Lattice Listener Rule using the `exampleIdArg`. For example:
+
+```console
+% terraform import aws_vpclattice_listener_rule.example rft-8012925589
+```
+
+<!-- cache-key: cdktf-0.18.0 input-18c4d701108689bcdef68a561bb727fff88960c4bf3c3a870cba068fc4e67f93 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/vpclattice_resource_policy.html.markdown b/website/docs/cdktf/typescript/r/vpclattice_resource_policy.html.markdown
new file mode 100644
index 00000000000..a5d333209b1
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/vpclattice_resource_policy.html.markdown
@@ -0,0 +1,113 @@
+---
+subcategory: "VPC Lattice"
+layout: "aws"
+page_title: "AWS: aws_vpclattice_resource_policy"
+description: |-
+  Terraform resource for managing an AWS VPC Lattice Resource Policy.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_vpclattice_resource_policy
+
+Terraform resource for managing an AWS VPC Lattice Resource Policy.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCallerIdentity } from "./.gen/providers/aws/data-aws-caller-identity";
+import { DataAwsPartition } from "./.gen/providers/aws/data-aws-partition";
+import { VpclatticeResourcePolicy } from "./.gen/providers/aws/vpclattice-resource-policy";
+import { VpclatticeServiceNetwork } from "./.gen/providers/aws/vpclattice-service-network";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new VpclatticeServiceNetwork(this, "example", {
+      name: "example-vpclattice-service-network",
+    });
+    const current = new DataAwsCallerIdentity(this, "current", {});
+    const dataAwsPartitionCurrent = new DataAwsPartition(this, "current_2", {});
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsPartitionCurrent.overrideLogicalId("current");
+    const awsVpclatticeResourcePolicyExample = new VpclatticeResourcePolicy(
+      this,
+      "example_3",
+      {
+        policy: Token.asString(
+          Fn.jsonencode({
+            Statement: [
+              {
+                Action: [
+                  "vpc-lattice:CreateServiceNetworkVpcAssociation",
+                  "vpc-lattice:CreateServiceNetworkServiceAssociation",
+                  "vpc-lattice:GetServiceNetwork",
+                ],
+                Effect: "Allow",
+                Principal: {
+                  AWS:
+                    "arn:${" +
+                    dataAwsPartitionCurrent.partition +
+                    "}:iam::${" +
+                    current.accountId +
+                    "}:root",
+                },
+                Resource: example.arn,
+                Sid: "test-pol-principals-6",
+              },
+            ],
+            Version: "2012-10-17",
+          })
+        ),
+        resourceArn: example.arn,
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsVpclatticeResourcePolicyExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `resourceArn` - (Required) The ID or Amazon Resource Name (ARN) of the service network or service for which the policy is created.
+* `policy` - (Required) An IAM policy. The policy string in JSON must not contain newlines or blank lines.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import VPC Lattice Resource Policy using the `resourceArn`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import VPC Lattice Resource Policy using the `resourceArn`. For example:
+
+```console
+% terraform import aws_vpclattice_resource_policy.example rft-8012925589
+```
+
+<!-- cache-key: cdktf-0.18.0 input-c969eed7a7377f14bd03d1b92b78d4bf654be694271ee442b4563386ee2c88bd -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/vpclattice_service.html.markdown b/website/docs/cdktf/typescript/r/vpclattice_service.html.markdown
new file mode 100644
index 00000000000..e261b049e02
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/vpclattice_service.html.markdown
@@ -0,0 +1,93 @@
+---
+subcategory: "VPC Lattice"
+layout: "aws"
+page_title: "AWS: aws_vpclattice_service"
+description: |-
+  Terraform resource for managing an AWS VPC Lattice Service.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_vpclattice_service
+
+Terraform resource for managing an AWS VPC Lattice Service.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { VpclatticeService } from "./.gen/providers/aws/vpclattice-service";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new VpclatticeService(this, "example", {
+      authType: "AWS_IAM",
+      customDomainName: "example.com",
+      name: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) Name of the service. The name must be unique within the account. The valid characters are a-z, 0-9, and hyphens (-). You can't use a hyphen as the first or last character, or immediately after another hyphen.Must be between 3 and 40 characters in length.
+
+The following arguments are optional:
+
+* `authType` - (Optional) Type of IAM policy. Either `none` or `awsIam`.
+* `certificateArn` - (Optional) Amazon Resource Name (ARN) of the certificate.
+* `customDomainName` - (Optional) Custom domain name of the service.
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`defaultTags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the service. Do not begin the description with "An", "The", "Defines", "Indicates", or "Specifies," as these are verbose. In other words, "Indicates the amount of storage," can be rewritten as "Amount of storage," without losing any information.
+* `dnsEntry` - Concise description. Do not begin the description with "An", "The", "Defines", "Indicates", or "Specifies," as these are verbose. In other words, "Indicates the amount of storage," can be rewritten as "Amount of storage," without losing any information.
+* `id` - Unique identifier for the service.
+* `status` - Status of the service.
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `5M`)
+* `delete` - (Default `5M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import VPC Lattice Service using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import VPC Lattice Service using the `id`. For example:
+
+```console
+% terraform import aws_vpclattice_service.example svc-06728e2357ea55f8a
+```
+
+<!-- cache-key: cdktf-0.18.0 input-9538031e1f3e91a6025513a51240647cd5ea1ebb1f5f4cc3598ae3498c4720e0 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/vpclattice_service_network.html.markdown b/website/docs/cdktf/typescript/r/vpclattice_service_network.html.markdown
new file mode 100644
index 00000000000..3b9a6c0be1d
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/vpclattice_service_network.html.markdown
@@ -0,0 +1,80 @@
+---
+subcategory: "VPC Lattice"
+layout: "aws"
+page_title: "AWS: aws_vpclattice_service_network"
+description: |-
+  Terraform resource for managing an AWS VPC Lattice Service Network.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_vpclattice_service_network
+
+Terraform resource for managing an AWS VPC Lattice Service Network.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { VpclatticeServiceNetwork } from "./.gen/providers/aws/vpclattice-service-network";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new VpclatticeServiceNetwork(this, "example", {
+      authType: "AWS_IAM",
+      name: "example",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) Name of the service network
+
+The following arguments are optional:
+
+* `authType` - (Optional) Type of IAM policy. Either `none` or `awsIam`.
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`defaultTags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Service Network.
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import VPC Lattice Service Network using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import VPC Lattice Service Network using the `id`. For example:
+
+```console
+% terraform import aws_vpclattice_service_network.example sn-0158f91c1e3358dba
+```
+
+<!-- cache-key: cdktf-0.18.0 input-bd399060a3ff40174d174d00151279d434802a5189dee061f444da739500f832 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/vpclattice_service_network_service_association.html.markdown b/website/docs/cdktf/typescript/r/vpclattice_service_network_service_association.html.markdown
new file mode 100644
index 00000000000..eb9ef41b6a3
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/vpclattice_service_network_service_association.html.markdown
@@ -0,0 +1,95 @@
+---
+subcategory: "VPC Lattice"
+layout: "aws"
+page_title: "AWS: aws_vpclattice_service_network_service_association"
+description: |-
+  Terraform resource for managing an AWS VPC Lattice Service Network Service Association.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_vpclattice_service_network_service_association
+
+Terraform resource for managing an AWS VPC Lattice Service Network Service Association.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { VpclatticeServiceNetworkServiceAssociation } from "./.gen/providers/aws/vpclattice-service-network-service-association";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new VpclatticeServiceNetworkServiceAssociation(this, "example", {
+      serviceIdentifier: Token.asString(awsVpclatticeServiceExample.id),
+      serviceNetworkIdentifier: Token.asString(
+        awsVpclatticeServiceNetworkExample.id
+      ),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `serviceIdentifier` - (Required) The ID or Amazon Resource Identifier (ARN) of the service.
+* `serviceNetworkIdentifier` - (Required) The ID or Amazon Resource Identifier (ARN) of the service network. You must use the ARN if the resources specified in the operation are in different accounts.
+The following arguments are optional:
+
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`defaultTags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the Association.
+* `createdBy` - The account that created the association.
+* `customDomainName` - The custom domain name of the service.
+* `dnsEntry` - The DNS name of the service.
+    * `domainName` - The domain name of the service.
+    * `hostedZoneId` - The ID of the hosted zone.
+* `id` - The ID of the association.
+* `status` - The operations status. Valid Values are CREATE_IN_PROGRESS | ACTIVE | DELETE_IN_PROGRESS | CREATE_FAILED | DELETE_FAILED
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `5M`)
+* `delete` - (Default `5M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import VPC Lattice Service Network Service Association using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import VPC Lattice Service Network Service Association using the `id`. For example:
+
+```console
+% terraform import aws_vpclattice_service_network_service_association.example snsa-05e2474658a88f6ba
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ed0fbd858c03d6277e22292ff2f9c7e7102bc8ebdee62a4f130453206c0b83a7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/vpclattice_service_network_vpc_association.html.markdown b/website/docs/cdktf/typescript/r/vpclattice_service_network_vpc_association.html.markdown
new file mode 100644
index 00000000000..440e42c237c
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/vpclattice_service_network_vpc_association.html.markdown
@@ -0,0 +1,93 @@
+---
+subcategory: "VPC Lattice"
+layout: "aws"
+page_title: "AWS: aws_vpclattice_service_network_vpc_association"
+description: |-
+  Terraform resource for managing an AWS VPC Lattice Service Network VPC Association.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_vpclattice_service_network_vpc_association
+
+Terraform resource for managing an AWS VPC Lattice Service Network VPC Association.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { VpclatticeServiceNetworkVpcAssociation } from "./.gen/providers/aws/vpclattice-service-network-vpc-association";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new VpclatticeServiceNetworkVpcAssociation(this, "example", {
+      securityGroupIds: [Token.asString(awsSecurityGroupExample.id)],
+      serviceNetworkIdentifier: Token.asString(
+        awsVpclatticeServiceNetworkExample.id
+      ),
+      vpcIdentifier: Token.asString(awsVpcExample.id),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `vpcIdentifier` - (Required) The ID of the VPC.
+* `serviceNetworkIdentifier` - (Required) The ID or Amazon Resource Identifier (ARN) of the service network. You must use the ARN if the resources specified in the operation are in different accounts.
+The following arguments are optional:
+
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`defaultTags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `securityGroupIds` - (Optional) The IDs of the security groups.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the Association.
+* `createdBy` - The account that created the association.
+* `id` - The ID of the association.
+* `status` - The operations status. Valid Values are CREATE_IN_PROGRESS | ACTIVE | DELETE_IN_PROGRESS | CREATE_FAILED | DELETE_FAILED
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `5M`)
+* `delete` - (Default `5M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import VPC Lattice Service Network VPC Association using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import VPC Lattice Service Network VPC Association using the `id`. For example:
+
+```console
+% terraform import aws_vpclattice_service_network_vpc_association.example snsa-05e2474658a88f6ba
+```
+
+<!-- cache-key: cdktf-0.18.0 input-7c8b2edfc9c8f937c0cca70fd647384595bc839a9f7ba74d190e7819a13b08d8 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/vpclattice_target_group.html.markdown b/website/docs/cdktf/typescript/r/vpclattice_target_group.html.markdown
new file mode 100644
index 00000000000..c2dd9d0a22e
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/vpclattice_target_group.html.markdown
@@ -0,0 +1,219 @@
+---
+subcategory: "VPC Lattice"
+layout: "aws"
+page_title: "AWS: aws_vpclattice_target_group"
+description: |-
+  Terraform resource for managing an AWS VPC Lattice Target Group.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_vpclattice_target_group
+
+Terraform resource for managing an AWS VPC Lattice Target Group.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { VpclatticeTargetGroup } from "./.gen/providers/aws/vpclattice-target-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new VpclatticeTargetGroup(this, "example", {
+      config: {
+        port: 443,
+        protocol: "HTTPS",
+        vpcIdentifier: Token.asString(awsVpcExample.id),
+      },
+      name: "example",
+      type: "INSTANCE",
+    });
+  }
+}
+
+```
+
+### Basic usage with Health check
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { VpclatticeTargetGroup } from "./.gen/providers/aws/vpclattice-target-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new VpclatticeTargetGroup(this, "example", {
+      config: {
+        healthCheck: {
+          enabled: true,
+          healthCheckIntervalSeconds: 20,
+          healthCheckTimeoutSeconds: 10,
+          healthyThresholdCount: 7,
+          matcher: {
+            value: "200-299",
+          },
+          path: "/instance",
+          port: 80,
+          protocol: "HTTP",
+          protocolVersion: "HTTP1",
+          unhealthyThresholdCount: 3,
+        },
+        ipAddressType: "IPV4",
+        port: 443,
+        protocol: "HTTPS",
+        protocolVersion: "HTTP1",
+        vpcIdentifier: Token.asString(awsVpcExample.id),
+      },
+      name: "example",
+      type: "IP",
+    });
+  }
+}
+
+```
+
+### ALB
+
+If the type is ALB, `healthCheck` block is not supported.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { VpclatticeTargetGroup } from "./.gen/providers/aws/vpclattice-target-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new VpclatticeTargetGroup(this, "example", {
+      config: {
+        port: 443,
+        protocol: "HTTPS",
+        protocolVersion: "HTTP1",
+        vpcIdentifier: Token.asString(awsVpcExample.id),
+      },
+      name: "example",
+      type: "ALB",
+    });
+  }
+}
+
+```
+
+### Lambda
+
+If the type is Lambda, `config` block is not supported.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { VpclatticeTargetGroup } from "./.gen/providers/aws/vpclattice-target-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new VpclatticeTargetGroup(this, "example", {
+      name: "example",
+      type: "LAMBDA",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) The name of the target group. The name must be unique within the account. The valid characters are a-z, 0-9, and hyphens (-). You can't use a hyphen as the first or last character, or immediately after another hyphen.
+* `type` - (Required) The type of target group. Valid Values are `ip` | `lambda` | `instance` | `alb`
+
+The following arguments are optional:
+
+* `config` - (Optional) The target group configuration.
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`defaultTags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+Config (`config`) supports the following:
+
+* `healthCheck` - (Optional) The health check configuration.
+* `ipAddressType` - (Optional) The type of IP address used for the target group. Valid values: `ipv4` | `ipv6`.
+* `lambdaEventStructureVersion` - (Optional) The version of the event structure that the Lambda function receives. Supported only if `type` is `lambda`. Valid Values are `v1` | `v2`.
+* `port` - (Optional) The port on which the targets are listening.
+* `protocol` - (Optional) The protocol to use for routing traffic to the targets. Valid Values are `http` | `https`.
+* `protocolVersion` - (Optional) The protocol version. Valid Values are `http1` | `http2` | `grpc`. Default value is `http1`.
+* `vpcIdentifier` - (Optional) The ID of the VPC.
+
+Health Check (`healthCheck`) supports the following:
+
+* `enabled` - (Optional) Indicates whether health checking is enabled. Defaults to `true`.
+* `healthCheckIntervalSeconds` - (Optional) The approximate amount of time, in seconds, between health checks of an individual target. The range is 5–300 seconds. The default is 30 seconds.
+* `healthCheckTimeoutSeconds` - (Optional) The amount of time, in seconds, to wait before reporting a target as unhealthy. The range is 1–120 seconds. The default is 5 seconds.
+* `healthy_threshold_count ` - (Optional) The number of consecutive successful health checks required before considering an unhealthy target healthy. The range is 2–10. The default is 5.
+* `matcher` - (Optional) The codes to use when checking for a successful response from a target. These are called _Success codes_ in the console.
+    * `value` - (Optional) The HTTP codes to use when checking for a successful response from a target.
+* `path` - (Optional) The destination for health checks on the targets. If the protocol version is HTTP/1.1 or HTTP/2, specify a valid URI (for example, /path?query). The default path is `/`. Health checks are not supported if the protocol version is gRPC, however, you can choose HTTP/1.1 or HTTP/2 and specify a valid URI.
+* `port` - (Optional) The port used when performing health checks on targets. The default setting is the port that a target receives traffic on.
+* `protocol` - (Optional) The protocol used when performing health checks on targets. The possible protocols are `http` and `https`.
+* `protocolVersion` - (Optional) The protocol version used when performing health checks on targets. The possible protocol versions are `http1` and `http2`. The default is `http1`.
+* `unhealthyThresholdCount` - (Optional) The number of consecutive failed health checks required before considering a target unhealthy. The range is 2–10. The default is 2.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the target group.
+* `id` - Unique identifier for the target group.
+* `status` - Status of the target group.
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `5M`)
+* `delete` - (Default `5M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import VPC Lattice Target Group using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import VPC Lattice Target Group using the `id`. For example:
+
+```console
+% terraform import aws_vpclattice_target_group.example tg-0c11d4dc16ed96bdb
+```
+
+<!-- cache-key: cdktf-0.18.0 input-8b0f63dce846bb387e0c2e47e763aeda9a0b71702c33c2b21f0f39c8cf773e37 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/vpclattice_target_group_attachment.html.markdown b/website/docs/cdktf/typescript/r/vpclattice_target_group_attachment.html.markdown
new file mode 100644
index 00000000000..b1a690dbab2
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/vpclattice_target_group_attachment.html.markdown
@@ -0,0 +1,59 @@
+---
+subcategory: "VPC Lattice"
+layout: "aws"
+page_title: "AWS: aws_vpclattice_target_group_attachment"
+description: |-
+  Provides the ability to register a target with an AWS VPC Lattice Target Group.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_vpclattice_target_group_attachment
+
+Provides the ability to register a target with an AWS VPC Lattice Target Group.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { VpclatticeTargetGroupAttachment } from "./.gen/providers/aws/vpclattice-target-group-attachment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new VpclatticeTargetGroupAttachment(this, "example", {
+      target: {
+        id: Token.asString(awsLbExample.arn),
+        port: 80,
+      },
+      targetGroupIdentifier: Token.asString(awsVpclatticeTargetGroupExample.id),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+- `targetGroupIdentifier` - (Required) The ID or Amazon Resource Name (ARN) of the target group.
+- `target` - (Required) The target.
+
+`target` supports the following:
+
+- `id` - (Required) The ID of the target. If the target type of the target group is INSTANCE, this is an instance ID. If the target type is IP , this is an IP address. If the target type is LAMBDA, this is the ARN of the Lambda function. If the target type is ALB, this is the ARN of the Application Load Balancer.
+- `port` - (Optional) This port is used for routing traffic to the target, and defaults to the target group port. However, you can override the default and specify a custom port.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+<!-- cache-key: cdktf-0.18.0 input-07d016dd19914a4941aa50badc7be37f87be2205c9b19ece183e96d29c4e875b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/vpn_connection.html.markdown b/website/docs/cdktf/typescript/r/vpn_connection.html.markdown
new file mode 100644
index 00000000000..8fa17a96cbb
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/vpn_connection.html.markdown
@@ -0,0 +1,326 @@
+---
+subcategory: "VPN (Site-to-Site)"
+layout: "aws"
+page_title: "AWS: aws_vpn_connection"
+description: |-
+  Manages a Site-to-Site VPN connection. A Site-to-Site VPN connection is an Internet Protocol security (IPsec) VPN connection between a VPC and an on-premises network.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_vpn_connection
+
+Manages a Site-to-Site VPN connection. A Site-to-Site VPN connection is an Internet Protocol security (IPsec) VPN connection between a VPC and an on-premises network.
+Any new Site-to-Site VPN connection that you create is an [AWS VPN connection](https://docs.aws.amazon.com/vpn/latest/s2svpn/vpn-categories.html).
+
+~> **Note:** All arguments including `tunnel1PresharedKey` and `tunnel2PresharedKey` will be stored in the raw state as plain-text.
+[Read more about sensitive data in state](https://www.terraform.io/docs/state/sensitive-data.html).
+
+~> **Note:** The CIDR blocks in the arguments `tunnel1InsideCidr` and `tunnel2InsideCidr` must have a prefix of /30 and be a part of a specific range.
+[Read more about this in the AWS documentation](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_VpnTunnelOptionsSpecification.html).
+
+## Example Usage
+
+### EC2 Transit Gateway
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CustomerGateway } from "./.gen/providers/aws/customer-gateway";
+import { Ec2TransitGateway } from "./.gen/providers/aws/ec2-transit-gateway";
+import { VpnConnection } from "./.gen/providers/aws/vpn-connection";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new CustomerGateway(this, "example", {
+      bgpAsn: Token.asString(65000),
+      ipAddress: "172.0.0.1",
+      type: "ipsec.1",
+    });
+    const awsEc2TransitGatewayExample = new Ec2TransitGateway(
+      this,
+      "example_1",
+      {}
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsEc2TransitGatewayExample.overrideLogicalId("example");
+    const awsVpnConnectionExample = new VpnConnection(this, "example_2", {
+      customerGatewayId: example.id,
+      transitGatewayId: Token.asString(awsEc2TransitGatewayExample.id),
+      type: example.type,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsVpnConnectionExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### Virtual Private Gateway
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CustomerGateway } from "./.gen/providers/aws/customer-gateway";
+import { Vpc } from "./.gen/providers/aws/vpc";
+import { VpnConnection } from "./.gen/providers/aws/vpn-connection";
+import { VpnGateway } from "./.gen/providers/aws/vpn-gateway";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const customerGateway = new CustomerGateway(this, "customer_gateway", {
+      bgpAsn: Token.asString(65000),
+      ipAddress: "172.0.0.1",
+      type: "ipsec.1",
+    });
+    const vpc = new Vpc(this, "vpc", {
+      cidrBlock: "10.0.0.0/16",
+    });
+    const vpnGateway = new VpnGateway(this, "vpn_gateway", {
+      vpcId: vpc.id,
+    });
+    new VpnConnection(this, "main", {
+      customerGatewayId: customerGateway.id,
+      staticRoutesOnly: true,
+      type: "ipsec.1",
+      vpnGatewayId: vpnGateway.id,
+    });
+  }
+}
+
+```
+
+### AWS Site to Site Private VPN
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CustomerGateway } from "./.gen/providers/aws/customer-gateway";
+import { DataAwsEc2TransitGatewayDxGatewayAttachment } from "./.gen/providers/aws/data-aws-ec2-transit-gateway-dx-gateway-attachment";
+import { DxGateway } from "./.gen/providers/aws/dx-gateway";
+import { DxGatewayAssociation } from "./.gen/providers/aws/dx-gateway-association";
+import { Ec2TransitGateway } from "./.gen/providers/aws/ec2-transit-gateway";
+import { VpnConnection } from "./.gen/providers/aws/vpn-connection";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new CustomerGateway(this, "example", {
+      bgpAsn: Token.asString(64514),
+      ipAddress: "10.0.0.1",
+      tags: {
+        Name: "terraform_ipsec_vpn_example",
+      },
+      type: "ipsec.1",
+    });
+    const awsDxGatewayExample = new DxGateway(this, "example_1", {
+      amazonSideAsn: "64512",
+      name: "terraform_ipsec_vpn_example",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsDxGatewayExample.overrideLogicalId("example");
+    const awsEc2TransitGatewayExample = new Ec2TransitGateway(
+      this,
+      "example_2",
+      {
+        amazonSideAsn: Token.asNumber("64513"),
+        description: "terraform_ipsec_vpn_example",
+        transitGatewayCidrBlocks: ["10.0.0.0/24"],
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsEc2TransitGatewayExample.overrideLogicalId("example");
+    const awsDxGatewayAssociationExample = new DxGatewayAssociation(
+      this,
+      "example_3",
+      {
+        allowedPrefixes: ["10.0.0.0/8"],
+        associatedGatewayId: Token.asString(awsEc2TransitGatewayExample.id),
+        dxGatewayId: Token.asString(awsDxGatewayExample.id),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsDxGatewayAssociationExample.overrideLogicalId("example");
+    const dataAwsEc2TransitGatewayDxGatewayAttachmentExample =
+      new DataAwsEc2TransitGatewayDxGatewayAttachment(this, "example_4", {
+        dependsOn: [awsDxGatewayAssociationExample],
+        dxGatewayId: Token.asString(awsDxGatewayExample.id),
+        transitGatewayId: Token.asString(awsEc2TransitGatewayExample.id),
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsEc2TransitGatewayDxGatewayAttachmentExample.overrideLogicalId(
+      "example"
+    );
+    const awsVpnConnectionExample = new VpnConnection(this, "example_5", {
+      customerGatewayId: example.id,
+      outsideIpAddressType: "PrivateIpv4",
+      tags: {
+        Name: "terraform_ipsec_vpn_example",
+      },
+      transitGatewayId: Token.asString(awsEc2TransitGatewayExample.id),
+      transportTransitGatewayAttachmentId: Token.asString(
+        dataAwsEc2TransitGatewayDxGatewayAttachmentExample.id
+      ),
+      type: "ipsec.1",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsVpnConnectionExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `customerGatewayId` - (Required) The ID of the customer gateway.
+* `type` - (Required) The type of VPN connection. The only type AWS supports at this time is "ipsec.1".
+* `transitGatewayId` - (Optional) The ID of the EC2 Transit Gateway.
+* `vpnGatewayId` - (Optional) The ID of the Virtual Private Gateway.
+* `staticRoutesOnly` - (Optional, Default `false`) Whether the VPN connection uses static routes exclusively. Static routes must be used for devices that don't support BGP.
+* `enableAcceleration` - (Optional, Default `false`) Indicate whether to enable acceleration for the VPN connection. Supports only EC2 Transit Gateway.
+* `tags` - (Optional) Tags to apply to the connection. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `localIpv4NetworkCidr` - (Optional, Default `0000/0`) The IPv4 CIDR on the customer gateway (on-premises) side of the VPN connection.
+* `localIpv6NetworkCidr` - (Optional, Default `::/0`) The IPv6 CIDR on the customer gateway (on-premises) side of the VPN connection.
+* `outsideIpAddressType` - (Optional, Default `publicIpv4`) Indicates if a Public S2S VPN or Private S2S VPN over AWS Direct Connect. Valid values are `PublicIpv4 | PrivateIpv4`
+* `remoteIpv4NetworkCidr` - (Optional, Default `0000/0`) The IPv4 CIDR on the AWS side of the VPN connection.
+* `remoteIpv6NetworkCidr` - (Optional, Default `::/0`) The IPv6 CIDR on the customer gateway (on-premises) side of the VPN connection.
+* `transportTransitGatewayAttachmentId` - (Required when outside_ip_address_type is set to `privateIpv4`). The attachment ID of the Transit Gateway attachment to Direct Connect Gateway. The ID is obtained through a data source only.
+* `tunnelInsideIpVersion` - (Optional, Default `ipv4`) Indicate whether the VPN tunnels process IPv4 or IPv6 traffic. Valid values are `ipv4 | ipv6`. `ipv6` Supports only EC2 Transit Gateway.
+* `tunnel1InsideCidr` - (Optional) The CIDR block of the inside IP addresses for the first VPN tunnel. Valid value is a size /30 CIDR block from the 169.254.0.0/16 range.
+* `tunnel2InsideCidr` - (Optional) The CIDR block of the inside IP addresses for the second VPN tunnel. Valid value is a size /30 CIDR block from the 169.254.0.0/16 range.
+* `tunnel1InsideIpv6Cidr` - (Optional) The range of inside IPv6 addresses for the first VPN tunnel. Supports only EC2 Transit Gateway. Valid value is a size /126 CIDR block from the local fd00::/8 range.
+* `tunnel2InsideIpv6Cidr` - (Optional) The range of inside IPv6 addresses for the second VPN tunnel. Supports only EC2 Transit Gateway. Valid value is a size /126 CIDR block from the local fd00::/8 range.
+* `tunnel1PresharedKey` - (Optional) The preshared key of the first VPN tunnel. The preshared key must be between 8 and 64 characters in length and cannot start with zero(0). Allowed characters are alphanumeric characters, periods(.) and underscores(_).
+* `tunnel2PresharedKey` - (Optional) The preshared key of the second VPN tunnel. The preshared key must be between 8 and 64 characters in length and cannot start with zero(0). Allowed characters are alphanumeric characters, periods(.) and underscores(_).
+* `tunnel1DpdTimeoutAction` - (Optional, Default `clear`) The action to take after DPD timeout occurs for the first VPN tunnel. Specify restart to restart the IKE initiation. Specify clear to end the IKE session. Valid values are `clear | none | restart`.
+* `tunnel2DpdTimeoutAction` - (Optional, Default `clear`) The action to take after DPD timeout occurs for the second VPN tunnel. Specify restart to restart the IKE initiation. Specify clear to end the IKE session. Valid values are `clear | none | restart`.
+* `tunnel1DpdTimeoutSeconds` - (Optional, Default `30`) The number of seconds after which a DPD timeout occurs for the first VPN tunnel. Valid value is equal or higher than `30`.
+* `tunnel2DpdTimeoutSeconds` - (Optional, Default `30`) The number of seconds after which a DPD timeout occurs for the second VPN tunnel. Valid value is equal or higher than `30`.
+* `tunnel1EnableTunnelLifecycleControl` - (Optional, Default `false`) Turn on or off tunnel endpoint lifecycle control feature for the first VPN tunnel. Valid values are `true | false`.
+* `tunnel2EnableTunnelLifecycleControl` - (Optional, Default `false`) Turn on or off tunnel endpoint lifecycle control feature for the second VPN tunnel. Valid values are `true | false`.
+* `tunnel1IkeVersions` - (Optional) The IKE versions that are permitted for the first VPN tunnel. Valid values are `ikev1 | ikev2`.
+* `tunnel2IkeVersions` - (Optional) The IKE versions that are permitted for the second VPN tunnel. Valid values are `ikev1 | ikev2`.
+* `tunnel1LogOptions` - (Optional) Options for logging VPN tunnel activity. See [Log Options](#log-options) below for more details.
+* `tunnel2LogOptions` - (Optional) Options for logging VPN tunnel activity. See [Log Options](#log-options) below for more details.
+* `tunnel1Phase1DhGroupNumbers` - (Optional) List of one or more Diffie-Hellman group numbers that are permitted for the first VPN tunnel for phase 1 IKE negotiations. Valid values are ` 2 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24`.
+* `tunnel2Phase1DhGroupNumbers` - (Optional) List of one or more Diffie-Hellman group numbers that are permitted for the second VPN tunnel for phase 1 IKE negotiations. Valid values are ` 2 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24`.
+* `tunnel1Phase1EncryptionAlgorithms` - (Optional) List of one or more encryption algorithms that are permitted for the first VPN tunnel for phase 1 IKE negotiations. Valid values are `AES128 | AES256 | AES128-GCM-16 | AES256-GCM-16`.
+* `tunnel2Phase1EncryptionAlgorithms` - (Optional) List of one or more encryption algorithms that are permitted for the second VPN tunnel for phase 1 IKE negotiations. Valid values are `AES128 | AES256 | AES128-GCM-16 | AES256-GCM-16`.
+* `tunnel1Phase1IntegrityAlgorithms` - (Optional) One or more integrity algorithms that are permitted for the first VPN tunnel for phase 1 IKE negotiations. Valid values are `SHA1 | SHA2-256 | SHA2-384 | SHA2-512`.
+* `tunnel2Phase1IntegrityAlgorithms` - (Optional) One or more integrity algorithms that are permitted for the second VPN tunnel for phase 1 IKE negotiations. Valid values are `SHA1 | SHA2-256 | SHA2-384 | SHA2-512`.
+* `tunnel1Phase1LifetimeSeconds` - (Optional, Default `28800`) The lifetime for phase 1 of the IKE negotiation for the first VPN tunnel, in seconds. Valid value is between `900` and `28800`.
+* `tunnel2Phase1LifetimeSeconds` - (Optional, Default `28800`) The lifetime for phase 1 of the IKE negotiation for the second VPN tunnel, in seconds. Valid value is between `900` and `28800`.
+* `tunnel1Phase2DhGroupNumbers` - (Optional) List of one or more Diffie-Hellman group numbers that are permitted for the first VPN tunnel for phase 2 IKE negotiations. Valid values are `2 | 5 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24`.
+* `tunnel2Phase2DhGroupNumbers` - (Optional) List of one or more Diffie-Hellman group numbers that are permitted for the second VPN tunnel for phase 2 IKE negotiations. Valid values are `2 | 5 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24`.
+* `tunnel1Phase2EncryptionAlgorithms` - (Optional) List of one or more encryption algorithms that are permitted for the first VPN tunnel for phase 2 IKE negotiations. Valid values are `AES128 | AES256 | AES128-GCM-16 | AES256-GCM-16`.
+* `tunnel2Phase2EncryptionAlgorithms` - (Optional) List of one or more encryption algorithms that are permitted for the second VPN tunnel for phase 2 IKE negotiations. Valid values are `AES128 | AES256 | AES128-GCM-16 | AES256-GCM-16`.
+* `tunnel1Phase2IntegrityAlgorithms` - (Optional) List of one or more integrity algorithms that are permitted for the first VPN tunnel for phase 2 IKE negotiations. Valid values are `SHA1 | SHA2-256 | SHA2-384 | SHA2-512`.
+* `tunnel2Phase2IntegrityAlgorithms` - (Optional) List of one or more integrity algorithms that are permitted for the second VPN tunnel for phase 2 IKE negotiations. Valid values are `SHA1 | SHA2-256 | SHA2-384 | SHA2-512`.
+* `tunnel1Phase2LifetimeSeconds` - (Optional, Default `3600`) The lifetime for phase 2 of the IKE negotiation for the first VPN tunnel, in seconds. Valid value is between `900` and `3600`.
+* `tunnel2Phase2LifetimeSeconds` - (Optional, Default `3600`) The lifetime for phase 2 of the IKE negotiation for the second VPN tunnel, in seconds. Valid value is between `900` and `3600`.
+* `tunnel1RekeyFuzzPercentage` - (Optional, Default `100`) The percentage of the rekey window for the first VPN tunnel (determined by `tunnel1RekeyMarginTimeSeconds`) during which the rekey time is randomly selected. Valid value is between `0` and `100`.
+* `tunnel2RekeyFuzzPercentage` - (Optional, Default `100`) The percentage of the rekey window for the second VPN tunnel (determined by `tunnel2RekeyMarginTimeSeconds`) during which the rekey time is randomly selected. Valid value is between `0` and `100`.
+* `tunnel1RekeyMarginTimeSeconds` - (Optional, Default `540`) The margin time, in seconds, before the phase 2 lifetime expires, during which the AWS side of the first VPN connection performs an IKE rekey. The exact time of the rekey is randomly selected based on the value for `tunnel1RekeyFuzzPercentage`. Valid value is between `60` and half of `tunnel1Phase2LifetimeSeconds`.
+* `tunnel2RekeyMarginTimeSeconds` - (Optional, Default `540`) The margin time, in seconds, before the phase 2 lifetime expires, during which the AWS side of the second VPN connection performs an IKE rekey. The exact time of the rekey is randomly selected based on the value for `tunnel2RekeyFuzzPercentage`. Valid value is between `60` and half of `tunnel2Phase2LifetimeSeconds`.
+* `tunnel1ReplayWindowSize` - (Optional, Default `1024`) The number of packets in an IKE replay window for the first VPN tunnel. Valid value is between `64` and `2048`.
+* `tunnel2ReplayWindowSize` - (Optional, Default `1024`) The number of packets in an IKE replay window for the second VPN tunnel. Valid value is between `64` and `2048`.
+* `tunnel1StartupAction` - (Optional, Default `add`) The action to take when the establishing the tunnel for the first VPN connection. By default, your customer gateway device must initiate the IKE negotiation and bring up the tunnel. Specify start for AWS to initiate the IKE negotiation. Valid values are `add | start`.
+* `tunnel2StartupAction` - (Optional, Default `add`) The action to take when the establishing the tunnel for the second VPN connection. By default, your customer gateway device must initiate the IKE negotiation and bring up the tunnel. Specify start for AWS to initiate the IKE negotiation. Valid values are `add | start`.
+
+### Log Options
+
+The `tunnel1LogOptions` and `tunnel2LogOptions` block supports the following arguments:
+
+* `cloudwatchLogOptions` - (Optional) Options for sending VPN tunnel logs to CloudWatch. See [CloudWatch Log Options](#cloudwatch-log-options) below for more details.
+
+### CloudWatch Log Options
+
+The `cloudwatchLogOptions` blocks supports the following arguments:
+
+* `logEnabled` - (Optional) Enable or disable VPN tunnel logging feature. The default is `false`.
+* `logGroupArn` - (Optional) The Amazon Resource Name (ARN) of the CloudWatch log group to send logs to.
+* `logOutputFormat` - (Optional) Set log format. Default format is json. Possible values are: `json` and `text`. The default is `json`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the VPN Connection.
+* `id` - The amazon-assigned ID of the VPN connection.
+* `coreNetworkArn` - The ARN of the core network.
+* `coreNetworkAttachmentArn` - The ARN of the core network attachment.
+* `customerGatewayConfiguration` - The configuration information for the VPN connection's customer gateway (in the native XML format).
+* `customerGatewayId` - The ID of the customer gateway to which the connection is attached.
+* `routes` - The static routes associated with the VPN connection. Detailed below.
+* `staticRoutesOnly` - Whether the VPN connection uses static routes exclusively.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `transitGatewayAttachmentId` - When associated with an EC2 Transit Gateway (`transitGatewayId` argument), the attachment ID. See also the [`awsEc2Tag` resource](/docs/providers/aws/r/ec2_tag.html) for tagging the EC2 Transit Gateway VPN Attachment.
+* `tunnel1Address` - The public IP address of the first VPN tunnel.
+* `tunnel1CgwInsideAddress` - The RFC 6890 link-local address of the first VPN tunnel (Customer Gateway Side).
+* `tunnel1VgwInsideAddress` - The RFC 6890 link-local address of the first VPN tunnel (VPN Gateway Side).
+* `tunnel1PresharedKey` - The preshared key of the first VPN tunnel.
+* `tunnel1BgpAsn` - The bgp asn number of the first VPN tunnel.
+* `tunnel1BgpHoldtime` - The bgp holdtime of the first VPN tunnel.
+* `tunnel2Address` - The public IP address of the second VPN tunnel.
+* `tunnel2CgwInsideAddress` - The RFC 6890 link-local address of the second VPN tunnel (Customer Gateway Side).
+* `tunnel2VgwInsideAddress` - The RFC 6890 link-local address of the second VPN tunnel (VPN Gateway Side).
+* `tunnel2PresharedKey` - The preshared key of the second VPN tunnel.
+* `tunnel2BgpAsn` - The bgp asn number of the second VPN tunnel.
+* `tunnel2BgpHoldtime` - The bgp holdtime of the second VPN tunnel.
+* `vgwTelemetry` - Telemetry for the VPN tunnels. Detailed below.
+* `vpnGatewayId` - The ID of the virtual private gateway to which the connection is attached.
+
+### routes
+
+* `destinationCidrBlock` - The CIDR block associated with the local subnet of the customer data center.
+* `source` - Indicates how the routes were provided.
+* `state` - The current state of the static route.
+
+### vgw_telemetry
+
+* `acceptedRouteCount` - The number of accepted routes.
+* `certificateArn` - The Amazon Resource Name (ARN) of the VPN tunnel endpoint certificate.
+* `lastStatusChange` - The date and time of the last change in status.
+* `outsideIpAddress` - The Internet-routable IP address of the virtual private gateway's outside interface.
+* `status` - The status of the VPN tunnel.
+* `statusMessage` - If an error occurs, a description of the error.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import VPN Connections using the VPN connection `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import VPN Connections using the VPN connection `id`. For example:
+
+```console
+% terraform import aws_vpn_connection.testvpnconnection vpn-40f41529
+```
+
+<!-- cache-key: cdktf-0.18.0 input-3d90dfa10b9036a076f1ef132a7b8d5011c2699fea5ecbd9ed76a20dc1755eae -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/vpn_connection_route.html.markdown b/website/docs/cdktf/typescript/r/vpn_connection_route.html.markdown
new file mode 100644
index 00000000000..b8518773348
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/vpn_connection_route.html.markdown
@@ -0,0 +1,73 @@
+---
+subcategory: "VPN (Site-to-Site)"
+layout: "aws"
+page_title: "AWS: aws_vpn_connection_route"
+description: |-
+  Provides a static route between a VPN connection and a customer gateway.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_vpn_connection_route
+
+Provides a static route between a VPN connection and a customer gateway.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CustomerGateway } from "./.gen/providers/aws/customer-gateway";
+import { Vpc } from "./.gen/providers/aws/vpc";
+import { VpnConnection } from "./.gen/providers/aws/vpn-connection";
+import { VpnConnectionRoute } from "./.gen/providers/aws/vpn-connection-route";
+import { VpnGateway } from "./.gen/providers/aws/vpn-gateway";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const customerGateway = new CustomerGateway(this, "customer_gateway", {
+      bgpAsn: Token.asString(65000),
+      ipAddress: "172.0.0.1",
+      type: "ipsec.1",
+    });
+    const vpc = new Vpc(this, "vpc", {
+      cidrBlock: "10.0.0.0/16",
+    });
+    const vpnGateway = new VpnGateway(this, "vpn_gateway", {
+      vpcId: vpc.id,
+    });
+    const main = new VpnConnection(this, "main", {
+      customerGatewayId: customerGateway.id,
+      staticRoutesOnly: true,
+      type: "ipsec.1",
+      vpnGatewayId: vpnGateway.id,
+    });
+    new VpnConnectionRoute(this, "office", {
+      destinationCidrBlock: "192.168.10.0/24",
+      vpnConnectionId: main.id,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `destinationCidrBlock` - (Required) The CIDR block associated with the local subnet of the customer network.
+* `vpnConnectionId` - (Required) The ID of the VPN connection.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `destinationCidrBlock` - The CIDR block associated with the local subnet of the customer network.
+* `vpnConnectionId` - The ID of the VPN connection.
+
+<!-- cache-key: cdktf-0.18.0 input-64b067c6df57ea0b47856274e104f5456078a8dcbea6eef290dbd19011659e4a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/vpn_gateway.html.markdown b/website/docs/cdktf/typescript/r/vpn_gateway.html.markdown
new file mode 100644
index 00000000000..54f0a3b0e15
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/vpn_gateway.html.markdown
@@ -0,0 +1,79 @@
+---
+subcategory: "VPN (Site-to-Site)"
+layout: "aws"
+page_title: "AWS: aws_vpn_gateway"
+description: |-
+  Provides a resource to create a VPC VPN Gateway.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_vpn_gateway
+
+Provides a resource to create a VPC VPN Gateway.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { VpnGateway } from "./.gen/providers/aws/vpn-gateway";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new VpnGateway(this, "vpn_gw", {
+      tags: {
+        Name: "main",
+      },
+      vpcId: main.id,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `vpcId` - (Optional) The VPC ID to create in.
+* `availabilityZone` - (Optional) The Availability Zone for the virtual private gateway.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `amazonSideAsn` - (Optional) The Autonomous System Number (ASN) for the Amazon side of the gateway. If you don't specify an ASN, the virtual private gateway is created with the default ASN.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the VPN Gateway.
+* `id` - The ID of the VPN Gateway.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import VPN Gateways using the VPN gateway `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import VPN Gateways using the VPN gateway `id`. For example:
+
+```console
+% terraform import aws_vpn_gateway.testvpngateway vgw-9a4cacf3
+```
+
+<!-- cache-key: cdktf-0.18.0 input-23251df1f50c37a9ee6f1698ee1bc52e7ae914120d59db5552c6f4fc31ca25f4 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/vpn_gateway_attachment.html.markdown b/website/docs/cdktf/typescript/r/vpn_gateway_attachment.html.markdown
new file mode 100644
index 00000000000..c254af3165b
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/vpn_gateway_attachment.html.markdown
@@ -0,0 +1,75 @@
+---
+subcategory: "VPN (Site-to-Site)"
+layout: "aws"
+page_title: "AWS: aws_vpn_gateway_attachment"
+description: |-
+  Provides a Virtual Private Gateway attachment resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_vpn_gateway_attachment
+
+Provides a Virtual Private Gateway attachment resource, allowing for an existing
+hardware VPN gateway to be attached and/or detached from a VPC.
+
+-> **Note:** The [`awsVpnGateway`](vpn_gateway.html)
+resource can also automatically attach the Virtual Private Gateway it creates
+to an existing VPC by setting the [`vpcId`](vpn_gateway.html#vpc_id) attribute accordingly.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Vpc } from "./.gen/providers/aws/vpc";
+import { VpnGateway } from "./.gen/providers/aws/vpn-gateway";
+import { VpnGatewayAttachment } from "./.gen/providers/aws/vpn-gateway-attachment";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const network = new Vpc(this, "network", {
+      cidrBlock: "10.0.0.0/16",
+    });
+    const vpn = new VpnGateway(this, "vpn", {
+      tags: {
+        Name: "example-vpn-gateway",
+      },
+    });
+    new VpnGatewayAttachment(this, "vpn_attachment", {
+      vpcId: network.id,
+      vpnGatewayId: vpn.id,
+    });
+  }
+}
+
+```
+
+See [Virtual Private Cloud](http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Introduction.html)
+and [Virtual Private Gateway](http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_VPN.html) user
+guides for more information.
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `vpcId` - (Required) The ID of the VPC.
+* `vpnGatewayId` - (Required) The ID of the Virtual Private Gateway.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `vpcId` - The ID of the VPC that Virtual Private Gateway is attached to.
+* `vpnGatewayId` - The ID of the Virtual Private Gateway.
+
+## Import
+
+You cannot import this resource.
+
+<!-- cache-key: cdktf-0.18.0 input-2348f137f23e9e2ad9c5fe33e3628594f5ea4a23246976fd2266c1cbe04f05d2 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/vpn_gateway_route_propagation.html.markdown b/website/docs/cdktf/typescript/r/vpn_gateway_route_propagation.html.markdown
new file mode 100644
index 00000000000..88ba8a13f80
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/vpn_gateway_route_propagation.html.markdown
@@ -0,0 +1,60 @@
+---
+subcategory: "VPN (Site-to-Site)"
+layout: "aws"
+page_title: "AWS: aws_vpn_gateway_route_propagation"
+description: |-
+  Requests automatic route propagation between a VPN gateway and a route table.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_vpn_gateway_route_propagation
+
+Requests automatic route propagation between a VPN gateway and a route table.
+
+~> **Note:** This resource should not be used with a route table that has
+the `propagatingVgws` argument set. If that argument is set, any route
+propagation not explicitly listed in its value will be removed.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { VpnGatewayRoutePropagation } from "./.gen/providers/aws/vpn-gateway-route-propagation";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new VpnGatewayRoutePropagation(this, "example", {
+      routeTableId: Token.asString(awsRouteTableExample.id),
+      vpnGatewayId: Token.asString(awsVpnGatewayExample.id),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `vpnGatewayId` - The id of the `awsVpnGateway` to propagate routes from.
+* `routeTableId` - The id of the `awsRouteTable` to propagate routes into.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `2M`)
+- `delete` - (Default `2M`)
+
+<!-- cache-key: cdktf-0.18.0 input-1c3c2e8d2f812de0afe226b6fe030874cca2a61ce5a4b402872d573b9b0adc66 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/waf_byte_match_set.html.markdown b/website/docs/cdktf/typescript/r/waf_byte_match_set.html.markdown
new file mode 100644
index 00000000000..40bede80ab3
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/waf_byte_match_set.html.markdown
@@ -0,0 +1,119 @@
+---
+subcategory: "WAF Classic"
+layout: "aws"
+page_title: "AWS: aws_waf_byte_match_set"
+description: |-
+  Provides a AWS WAF Byte Match Set resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_waf_byte_match_set
+
+Provides a WAF Byte Match Set Resource
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { WafByteMatchSet } from "./.gen/providers/aws/waf-byte-match-set";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new WafByteMatchSet(this, "byte_set", {
+      byteMatchTuples: [
+        {
+          fieldToMatch: {
+            data: "referer",
+            type: "HEADER",
+          },
+          positionalConstraint: "CONTAINS",
+          targetString: "badrefer1",
+          textTransformation: "NONE",
+        },
+      ],
+      name: "tf_waf_byte_match_set",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name or description of the Byte Match Set.
+* `byteMatchTuples` - Specifies the bytes (typically a string that corresponds
+  with ASCII characters) that you want to search for in web requests,
+  the location in requests that you want to search, and other settings.
+
+## Nested blocks
+
+### `byteMatchTuples`
+
+#### Arguments
+
+* `fieldToMatch` - (Required) The part of a web request that you want to search, such as a specified header or a query string.
+* `positionalConstraint` - (Required) Within the portion of a web request that you want to search
+  (for example, in the query string, if any), specify where you want to search.
+  e.g., `contains`, `containsWord` or `exactly`.
+  See [docs](http://docs.aws.amazon.com/waf/latest/APIReference/API_ByteMatchTuple.html#WAF-Type-ByteMatchTuple-PositionalConstraint)
+  for all supported values.
+* `targetString` - (Optional) The value that you want to search for within the field specified by `fieldToMatch`, e.g., `badrefer1`.
+  See [docs](https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_ByteMatchTuple.html)
+  for all supported values.
+* `textTransformation` - (Required) Text transformations used to eliminate unusual formatting that attackers use in web requests in an effort to bypass AWS WAF.
+  If you specify a transformation, AWS WAF performs the transformation on `targetString` before inspecting a request for a match.
+  e.g., `cmdLine`, `htmlEntityDecode` or `none`.
+  See [docs](http://docs.aws.amazon.com/waf/latest/APIReference/API_ByteMatchTuple.html#WAF-Type-ByteMatchTuple-TextTransformation)
+  for all supported values.
+
+### `fieldToMatch`
+
+#### Arguments
+
+* `data` - (Optional) When `type` is `header`, enter the name of the header that you want to search, e.g., `userAgent` or `referer`.
+  If `type` is any other value, omit this field.
+* `type` - (Required) The part of the web request that you want AWS WAF to search for a specified string.
+  e.g., `header`, `method` or `body`.
+  See [docs](http://docs.aws.amazon.com/waf/latest/APIReference/API_FieldToMatch.html)
+  for all supported values.
+
+## Remarks
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the WAF Byte Match Set.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WAF Byte Match Set using the id. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import WAF Byte Match Set using the id. For example:
+
+```console
+% terraform import aws_waf_byte_match_set.byte_set a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
+```
+
+<!-- cache-key: cdktf-0.18.0 input-a06ceb0ddbbc765dc1c16cfd7dbd1d081a410429cadf571ebee08f28fa270e27 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/waf_geo_match_set.html.markdown b/website/docs/cdktf/typescript/r/waf_geo_match_set.html.markdown
new file mode 100644
index 00000000000..547cf76f555
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/waf_geo_match_set.html.markdown
@@ -0,0 +1,96 @@
+---
+subcategory: "WAF Classic"
+layout: "aws"
+page_title: "AWS: aws_waf_geo_match_set"
+description: |-
+  Provides a AWS WAF GeoMatchSet resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_waf_geo_match_set
+
+Provides a WAF Geo Match Set Resource
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { WafGeoMatchSet } from "./.gen/providers/aws/waf-geo-match-set";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new WafGeoMatchSet(this, "geo_match_set", {
+      geoMatchConstraint: [
+        {
+          type: "Country",
+          value: "US",
+        },
+        {
+          type: "Country",
+          value: "CA",
+        },
+      ],
+      name: "geo_match_set",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name or description of the GeoMatchSet.
+* `geoMatchConstraint` - (Optional) The GeoMatchConstraint objects which contain the country that you want AWS WAF to search for.
+
+## Nested Blocks
+
+### `geoMatchConstraint`
+
+#### Arguments
+
+* `type` - (Required) The type of geographical area you want AWS WAF to search for. Currently Country is the only valid value.
+* `value` - (Required) The country that you want AWS WAF to search for.
+  This is the two-letter country code, e.g., `us`, `ca`, `ru`, `cn`, etc.
+  See [docs](https://docs.aws.amazon.com/waf/latest/APIReference/API_GeoMatchConstraint.html) for all supported values.
+
+## Remarks
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the WAF GeoMatchSet.
+* `arn` - Amazon Resource Name (ARN)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WAF Geo Match Set using their ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import WAF Geo Match Set using their ID. For example:
+
+```console
+% terraform import aws_waf_geo_match_set.example a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
+```
+
+<!-- cache-key: cdktf-0.18.0 input-c1ffab5d5b03d4b8b05b08bb866e76580c89d0afb01bede81ffc61a97685962b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/waf_ipset.html.markdown b/website/docs/cdktf/typescript/r/waf_ipset.html.markdown
new file mode 100644
index 00000000000..b57797248cb
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/waf_ipset.html.markdown
@@ -0,0 +1,92 @@
+---
+subcategory: "WAF Classic"
+layout: "aws"
+page_title: "AWS: aws_waf_ipset"
+description: |-
+  Provides a AWS WAF IPSet resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_waf_ipset
+
+Provides a WAF IPSet Resource
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { WafIpset } from "./.gen/providers/aws/waf-ipset";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new WafIpset(this, "ipset", {
+      ipSetDescriptors: [
+        {
+          type: "IPV4",
+          value: "192.0.7.0/24",
+        },
+        {
+          type: "IPV4",
+          value: "10.16.16.0/16",
+        },
+      ],
+      name: "tfIPSet",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name or description of the IPSet.
+* `ipSetDescriptors` - (Optional) One or more pairs specifying the IP address type (IPV4 or IPV6) and the IP address range (in CIDR format) from which web requests originate.
+
+## Nested Blocks
+
+### `ipSetDescriptors`
+
+#### Arguments
+
+* `type` - (Required) Type of the IP address - `ipv4` or `ipv6`.
+* `value` - (Required) An IPv4 or IPv6 address specified via CIDR notationE.g., `1920244/32` or `1111:0000:0000:0000:0000:0000:0000:0000/64`
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the WAF IPSet.
+* `arn` - The ARN of the WAF IPSet.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WAF IPSets using their ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import WAF IPSets using their ID. For example:
+
+```console
+% terraform import aws_waf_ipset.example a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
+```
+
+<!-- cache-key: cdktf-0.18.0 input-199b162a3b94acefad74ab099acfcf5a728844c2fbdd1d414b2e9f701182033c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/waf_rate_based_rule.html.markdown b/website/docs/cdktf/typescript/r/waf_rate_based_rule.html.markdown
new file mode 100644
index 00000000000..d7de8168a9f
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/waf_rate_based_rule.html.markdown
@@ -0,0 +1,116 @@
+---
+subcategory: "WAF Classic"
+layout: "aws"
+page_title: "AWS: aws_waf_rate_based_rule"
+description: |-
+  Provides a AWS WAF rule resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_waf_rate_based_rule
+
+Provides a WAF Rate Based Rule Resource
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { WafIpset } from "./.gen/providers/aws/waf-ipset";
+import { WafRateBasedRule } from "./.gen/providers/aws/waf-rate-based-rule";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const ipset = new WafIpset(this, "ipset", {
+      ipSetDescriptors: [
+        {
+          type: "IPV4",
+          value: "192.0.7.0/24",
+        },
+      ],
+      name: "tfIPSet",
+    });
+    new WafRateBasedRule(this, "wafrule", {
+      dependsOn: [ipset],
+      metricName: "tfWAFRule",
+      name: "tfWAFRule",
+      predicates: [
+        {
+          dataId: ipset.id,
+          negated: false,
+          type: "IPMatch",
+        },
+      ],
+      rateKey: "IP",
+      rateLimit: 100,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `metricName` - (Required) The name or description for the Amazon CloudWatch metric of this rule.
+* `name` - (Required) The name or description of the rule.
+* `rateKey` - (Required) Valid value is IP.
+* `rateLimit` - (Required) The maximum number of requests, which have an identical value in the field specified by the RateKey, allowed in a five-minute period. Minimum value is 100.
+* `predicates` - (Optional) The objects to include in a rule (documented below).
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Nested Blocks
+
+### `predicates`
+
+See the [WAF Documentation](https://docs.aws.amazon.com/waf/latest/APIReference/API_Predicate.html) for more information.
+
+#### Arguments
+
+* `negated` - (Required) Set this to `false` if you want to allow, block, or count requests
+  based on the settings in the specified `byteMatchSet`, `ipSet`, `sqlInjectionMatchSet`, `xssMatchSet`, or `sizeConstraintSet`.
+  For example, if an IPSet includes the IP address `1920244`, AWS WAF will allow or block requests based on that IP address.
+  If set to `true`, AWS WAF will allow, block, or count requests based on all IP addresses _except_ `1920244`.
+* `dataId` - (Required) A unique identifier for a predicate in the rule, such as Byte Match Set ID or IPSet ID.
+* `type` - (Required) The type of predicate in a rule. Valid values: `byteMatch`, `geoMatch`, `ipMatch`, `regexMatch`, `sizeConstraint`, `sqlInjectionMatch`, or `xssMatch`.
+
+## Remarks
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the WAF rule.
+* `arn` - Amazon Resource Name (ARN)
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WAF Rated Based Rule using the id. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import WAF Rated Based Rule using the id. For example:
+
+```console
+% terraform import aws_waf_rate_based_rule.wafrule a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
+```
+
+<!-- cache-key: cdktf-0.18.0 input-530aa2bf29dc90170951e958f2fab3eca6770263da54a51c9aba805d25697e07 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/waf_regex_match_set.html.markdown b/website/docs/cdktf/typescript/r/waf_regex_match_set.html.markdown
new file mode 100644
index 00000000000..4a8ab5227d0
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/waf_regex_match_set.html.markdown
@@ -0,0 +1,110 @@
+---
+subcategory: "WAF Classic"
+layout: "aws"
+page_title: "AWS: aws_waf_regex_match_set"
+description: |-
+  Provides a AWS WAF Regex Match Set resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_waf_regex_match_set
+
+Provides a WAF Regex Match Set Resource
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { WafRegexMatchSet } from "./.gen/providers/aws/waf-regex-match-set";
+import { WafRegexPatternSet } from "./.gen/providers/aws/waf-regex-pattern-set";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new WafRegexPatternSet(this, "example", {
+      name: "example",
+      regexPatternStrings: ["one", "two"],
+    });
+    const awsWafRegexMatchSetExample = new WafRegexMatchSet(this, "example_1", {
+      name: "example",
+      regexMatchTuple: [
+        {
+          fieldToMatch: {
+            data: "User-Agent",
+            type: "HEADER",
+          },
+          regexPatternSetId: example.id,
+          textTransformation: "NONE",
+        },
+      ],
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsWafRegexMatchSetExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name or description of the Regex Match Set.
+* `regexMatchTuple` - (Required) The regular expression pattern that you want AWS WAF to search for in web requests, the location in requests that you want AWS WAF to search, and other settings. See below.
+
+### Nested Arguments
+
+#### `regexMatchTuple`
+
+* `fieldToMatch` - (Required) The part of a web request that you want to search, such as a specified header or a query string.
+* `regexPatternSetId` - (Required) The ID of a [Regex Pattern Set](/docs/providers/aws/r/waf_regex_pattern_set.html).
+* `textTransformation` - (Required) Text transformations used to eliminate unusual formatting that attackers use in web requests in an effort to bypass AWS WAF.
+  e.g., `cmdLine`, `htmlEntityDecode` or `none`.
+  See [docs](http://docs.aws.amazon.com/waf/latest/APIReference/API_ByteMatchTuple.html#WAF-Type-ByteMatchTuple-TextTransformation)
+  for all supported values.
+
+#### `fieldToMatch`
+
+* `data` - (Optional) When `type` is `header`, enter the name of the header that you want to search, e.g., `userAgent` or `referer`.
+  If `type` is any other value, omit this field.
+* `type` - (Required) The part of the web request that you want AWS WAF to search for a specified string.
+  e.g., `header`, `method` or `body`.
+  See [docs](http://docs.aws.amazon.com/waf/latest/APIReference/API_FieldToMatch.html)
+  for all supported values.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the WAF Regex Match Set.
+* `arn` - Amazon Resource Name (ARN)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WAF Regex Match Set using their ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import WAF Regex Match Set using their ID. For example:
+
+```console
+% terraform import aws_waf_regex_match_set.example a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ce0a33802205206c3df8153ccf35320eadb17a76e385e935a563c75b8193cf45 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/waf_regex_pattern_set.html.markdown b/website/docs/cdktf/typescript/r/waf_regex_pattern_set.html.markdown
new file mode 100644
index 00000000000..bc02106b6dc
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/waf_regex_pattern_set.html.markdown
@@ -0,0 +1,74 @@
+---
+subcategory: "WAF Classic"
+layout: "aws"
+page_title: "AWS: aws_waf_regex_pattern_set"
+description: |-
+  Provides a AWS WAF Regex Pattern Set resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_waf_regex_pattern_set
+
+Provides a WAF Regex Pattern Set Resource
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { WafRegexPatternSet } from "./.gen/providers/aws/waf-regex-pattern-set";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new WafRegexPatternSet(this, "example", {
+      name: "tf_waf_regex_pattern_set",
+      regexPatternStrings: ["one", "two"],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name or description of the Regex Pattern Set.
+* `regexPatternStrings` - (Optional) A list of regular expression (regex) patterns that you want AWS WAF to search for, such as `b[a@]dB[o0]t`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the WAF Regex Pattern Set.
+* `arn` - Amazon Resource Name (ARN)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AWS WAF Regex Pattern Set using their ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import AWS WAF Regex Pattern Set using their ID. For example:
+
+```console
+% terraform import aws_waf_regex_pattern_set.example a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
+```
+
+<!-- cache-key: cdktf-0.18.0 input-c7a01b91a902b53fb081fc1a31da6a9bab5a071453ba698e3fa3b714308491e7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/waf_rule.html.markdown b/website/docs/cdktf/typescript/r/waf_rule.html.markdown
new file mode 100644
index 00000000000..24ca54acfc1
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/waf_rule.html.markdown
@@ -0,0 +1,110 @@
+---
+subcategory: "WAF Classic"
+layout: "aws"
+page_title: "AWS: aws_waf_rule"
+description: |-
+  Provides a AWS WAF rule resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_waf_rule
+
+Provides a WAF Rule Resource
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { WafIpset } from "./.gen/providers/aws/waf-ipset";
+import { WafRule } from "./.gen/providers/aws/waf-rule";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const ipset = new WafIpset(this, "ipset", {
+      ipSetDescriptors: [
+        {
+          type: "IPV4",
+          value: "192.0.7.0/24",
+        },
+      ],
+      name: "tfIPSet",
+    });
+    new WafRule(this, "wafrule", {
+      dependsOn: [ipset],
+      metricName: "tfWAFRule",
+      name: "tfWAFRule",
+      predicates: [
+        {
+          dataId: ipset.id,
+          negated: false,
+          type: "IPMatch",
+        },
+      ],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `metricName` - (Required) The name or description for the Amazon CloudWatch metric of this rule. The name can contain only alphanumeric characters (A-Z, a-z, 0-9); the name can't contain whitespace.
+* `name` - (Required) The name or description of the rule.
+* `predicates` - (Optional) The objects to include in a rule (documented below).
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Nested Blocks
+
+### `predicates`
+
+See the [WAF Documentation](https://docs.aws.amazon.com/waf/latest/APIReference/API_Predicate.html) for more information.
+
+#### Arguments
+
+* `negated` - (Required) Set this to `false` if you want to allow, block, or count requests
+  based on the settings in the specified [waf_byte_match_set](/docs/providers/aws/r/waf_byte_match_set.html), [waf_ipset](/docs/providers/aws/r/waf_ipset.html), [aws_waf_size_constraint_set](/docs/providers/aws/r/waf_size_constraint_set.html), [aws_waf_sql_injection_match_set](/docs/providers/aws/r/waf_sql_injection_match_set.html) or [aws_waf_xss_match_set](/docs/providers/aws/r/waf_xss_match_set.html).
+  For example, if an IPSet includes the IP address `1920244`, AWS WAF will allow or block requests based on that IP address.
+  If set to `true`, AWS WAF will allow, block, or count requests based on all IP addresses except `1920244`.
+* `dataId` - (Required) A unique identifier for a predicate in the rule, such as Byte Match Set ID or IPSet ID.
+* `type` - (Required) The type of predicate in a rule. Valid values: `byteMatch`, `geoMatch`, `ipMatch`, `regexMatch`, `sizeConstraint`, `sqlInjectionMatch`, or `xssMatch`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the WAF rule.
+* `arn` - The ARN of the WAF rule.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WAF rules using the id. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import WAF rules using the id. For example:
+
+```console
+% terraform import aws_waf_rule.example a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
+```
+
+<!-- cache-key: cdktf-0.18.0 input-2c43340a2d06e3942756017a4add4fafed5cbb5d7c4a714075fea348a36c1c0b -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/waf_rule_group.html.markdown b/website/docs/cdktf/typescript/r/waf_rule_group.html.markdown
new file mode 100644
index 00000000000..b70226cc56f
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/waf_rule_group.html.markdown
@@ -0,0 +1,106 @@
+---
+subcategory: "WAF Classic"
+layout: "aws"
+page_title: "AWS: aws_waf_rule_group"
+description: |-
+  Provides a AWS WAF rule group resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_waf_rule_group
+
+Provides a WAF Rule Group Resource
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { WafRule } from "./.gen/providers/aws/waf-rule";
+import { WafRuleGroup } from "./.gen/providers/aws/waf-rule-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new WafRule(this, "example", {
+      metricName: "example",
+      name: "example",
+    });
+    const awsWafRuleGroupExample = new WafRuleGroup(this, "example_1", {
+      activatedRule: [
+        {
+          action: {
+            type: "COUNT",
+          },
+          priority: 50,
+          ruleId: example.id,
+        },
+      ],
+      metricName: "example",
+      name: "example",
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsWafRuleGroupExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Optional) Name of the rule group. If omitted, Terraform will assign a random, unique name. Conflicts with `namePrefix`.
+* `namePrefix` - (Optional) Creates a unique name beginning with the specified prefix. Conflicts with `name`.
+* `metricName` - (Required) A friendly name for the metrics from the rule group
+* `activatedRule` - (Optional) A list of activated rules, see below
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Nested Blocks
+
+### `activatedRule`
+
+#### Arguments
+
+* `action` - (Required) Specifies the action that CloudFront or AWS WAF takes when a web request matches the conditions in the rule.
+    * `type` - (Required) e.g., `block`, `allow`, or `count`
+* `priority` - (Required) Specifies the order in which the rules are evaluated. Rules with a lower value are evaluated before rules with a higher value.
+* `ruleId` - (Required) The ID of a [rule](/docs/providers/aws/r/waf_rule.html)
+* `type` - (Optional) The rule type, either [`regular`](/docs/providers/aws/r/waf_rule.html), [`rateBased`](/docs/providers/aws/r/waf_rate_based_rule.html), or `group`. Defaults to `regular`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the WAF rule group.
+* `arn` - The ARN of the WAF rule group.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WAF Rule Group using the id. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import WAF Rule Group using the id. For example:
+
+```console
+% terraform import aws_waf_rule_group.example a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
+```
+
+<!-- cache-key: cdktf-0.18.0 input-55ab96b827dc2a0f93ec875d666102ecc7d13a2de2d65c381747b9a8c9c72a79 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/waf_size_constraint_set.html.markdown b/website/docs/cdktf/typescript/r/waf_size_constraint_set.html.markdown
new file mode 100644
index 00000000000..e3e438ded77
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/waf_size_constraint_set.html.markdown
@@ -0,0 +1,113 @@
+---
+subcategory: "WAF Classic"
+layout: "aws"
+page_title: "AWS: aws_waf_size_constraint_set"
+description: |-
+  Provides a AWS WAF Size Constraint Set resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_waf_size_constraint_set
+
+Provides a WAF Size Constraint Set Resource
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { WafSizeConstraintSet } from "./.gen/providers/aws/waf-size-constraint-set";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new WafSizeConstraintSet(this, "size_constraint_set", {
+      name: "tfsize_constraints",
+      sizeConstraints: [
+        {
+          comparisonOperator: "EQ",
+          fieldToMatch: {
+            type: "BODY",
+          },
+          size: Token.asNumber("4096"),
+          textTransformation: "NONE",
+        },
+      ],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name or description of the Size Constraint Set.
+* `sizeConstraints` - (Optional) Specifies the parts of web requests that you want to inspect the size of.
+
+## Nested Blocks
+
+### `sizeConstraints`
+
+#### Arguments
+
+* `fieldToMatch` - (Required) Specifies where in a web request to look for the size constraint.
+* `comparisonOperator` - (Required) The type of comparison you want to perform.
+  e.g., `eq`, `ne`, `lt`, `gt`.
+  See [docs](https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_SizeConstraint.html) for all supported values.
+* `size` - (Required) The size in bytes that you want to compare against the size of the specified `fieldToMatch`.
+  Valid values are between 0 - 21474836480 bytes (0 - 20 GB).
+* `textTransformation` - (Required) Text transformations used to eliminate unusual formatting that attackers use in web requests in an effort to bypass AWS WAF.
+  If you specify a transformation, AWS WAF performs the transformation on `fieldToMatch` before inspecting a request for a match.
+  e.g., `cmdLine`, `htmlEntityDecode` or `none`.
+  See [docs](http://docs.aws.amazon.com/waf/latest/APIReference/API_SizeConstraint.html#WAF-Type-SizeConstraint-TextTransformation)
+  for all supported values.
+  **Note:** if you choose `body` as `type`, you must choose `none` because CloudFront forwards only the first 8192 bytes for inspection.
+
+### `fieldToMatch`
+
+#### Arguments
+
+* `data` - (Optional) When `type` is `header`, enter the name of the header that you want to search, e.g., `userAgent` or `referer`.
+  If `type` is any other value, omit this field.
+* `type` - (Required) The part of the web request that you want AWS WAF to search for a specified string.
+  e.g., `header`, `method` or `body`.
+  See [docs](http://docs.aws.amazon.com/waf/latest/APIReference/API_FieldToMatch.html)
+  for all supported values.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the WAF Size Constraint Set.
+* `arn` - Amazon Resource Name (ARN)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AWS WAF Size Constraint Set using their ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import AWS WAF Size Constraint Set using their ID. For example:
+
+```console
+% terraform import aws_waf_size_constraint_set.example a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
+```
+
+<!-- cache-key: cdktf-0.18.0 input-8aed729c72fd1d4b82992bc8b3dac7aa0adf754f46bba56e2c3fc9d20546c234 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/waf_sql_injection_match_set.html.markdown b/website/docs/cdktf/typescript/r/waf_sql_injection_match_set.html.markdown
new file mode 100644
index 00000000000..09f50a3ed10
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/waf_sql_injection_match_set.html.markdown
@@ -0,0 +1,104 @@
+---
+subcategory: "WAF Classic"
+layout: "aws"
+page_title: "AWS: aws_waf_sql_injection_match_set"
+description: |-
+  Provides a AWS WAF SQL Injection Match Set resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_waf_sql_injection_match_set
+
+Provides a WAF SQL Injection Match Set Resource
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { WafSqlInjectionMatchSet } from "./.gen/providers/aws/waf-sql-injection-match-set";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new WafSqlInjectionMatchSet(this, "sql_injection_match_set", {
+      name: "tf-sql_injection_match_set",
+      sqlInjectionMatchTuples: [
+        {
+          fieldToMatch: {
+            type: "QUERY_STRING",
+          },
+          textTransformation: "URL_DECODE",
+        },
+      ],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name or description of the SQL Injection Match Set.
+* `sqlInjectionMatchTuples` - (Optional) The parts of web requests that you want AWS WAF to inspect for malicious SQL code and, if you want AWS WAF to inspect a header, the name of the header.
+
+## Nested Blocks
+
+### `sqlInjectionMatchTuples`
+
+* `fieldToMatch` - (Required) Specifies where in a web request to look for snippets of malicious SQL code.
+* `textTransformation` - (Required) Text transformations used to eliminate unusual formatting that attackers use in web requests in an effort to bypass AWS WAF.
+  If you specify a transformation, AWS WAF performs the transformation on `fieldToMatch` before inspecting a request for a match.
+  e.g., `cmdLine`, `htmlEntityDecode` or `none`.
+  See [docs](http://docs.aws.amazon.com/waf/latest/APIReference/API_SqlInjectionMatchTuple.html#WAF-Type-SqlInjectionMatchTuple-TextTransformation)
+  for all supported values.
+
+### `fieldToMatch`
+
+#### Arguments
+
+* `data` - (Optional) When `type` is `header`, enter the name of the header that you want to search, e.g., `userAgent` or `referer`.
+  If `type` is any other value, omit this field.
+* `type` - (Required) The part of the web request that you want AWS WAF to search for a specified string.
+  e.g., `header`, `method` or `body`.
+  See [docs](http://docs.aws.amazon.com/waf/latest/APIReference/API_FieldToMatch.html)
+  for all supported values.
+
+## Remarks
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the WAF SQL Injection Match Set.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AWS WAF SQL Injection Match Set using their ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import AWS WAF SQL Injection Match Set using their ID. For example:
+
+```console
+% terraform import aws_waf_sql_injection_match_set.example a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
+```
+
+<!-- cache-key: cdktf-0.18.0 input-a47ebe8da0dc48ddfdde164b586f5f77d04e0387919e7dfd6d04e602fd7caae2 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/waf_web_acl.html.markdown b/website/docs/cdktf/typescript/r/waf_web_acl.html.markdown
new file mode 100644
index 00000000000..e048ac6e6c0
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/waf_web_acl.html.markdown
@@ -0,0 +1,199 @@
+---
+subcategory: "WAF Classic"
+layout: "aws"
+page_title: "AWS: aws_waf_web_acl"
+description: |-
+  Provides a AWS WAF web access control group (ACL) resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_waf_web_acl
+
+Provides a WAF Web ACL Resource
+
+## Example Usage
+
+This example blocks requests coming from `192070/24` and allows everything else.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { WafIpset } from "./.gen/providers/aws/waf-ipset";
+import { WafRule } from "./.gen/providers/aws/waf-rule";
+import { WafWebAcl } from "./.gen/providers/aws/waf-web-acl";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const ipset = new WafIpset(this, "ipset", {
+      ipSetDescriptors: [
+        {
+          type: "IPV4",
+          value: "192.0.7.0/24",
+        },
+      ],
+      name: "tfIPSet",
+    });
+    const wafrule = new WafRule(this, "wafrule", {
+      dependsOn: [ipset],
+      metricName: "tfWAFRule",
+      name: "tfWAFRule",
+      predicates: [
+        {
+          dataId: ipset.id,
+          negated: false,
+          type: "IPMatch",
+        },
+      ],
+    });
+    new WafWebAcl(this, "waf_acl", {
+      defaultAction: {
+        type: "ALLOW",
+      },
+      dependsOn: [ipset, wafrule],
+      metricName: "tfWebACL",
+      name: "tfWebACL",
+      rules: [
+        {
+          action: {
+            type: "BLOCK",
+          },
+          priority: 1,
+          ruleId: wafrule.id,
+          type: "REGULAR",
+        },
+      ],
+    });
+  }
+}
+
+```
+
+### Logging
+
+~> *NOTE:* The Kinesis Firehose Delivery Stream name must begin with `awsWafLogs` and be located in `usEast1` region. See the [AWS WAF Developer Guide](https://docs.aws.amazon.com/waf/latest/developerguide/logging.html) for more information about enabling WAF logging.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { WafWebAcl } from "./.gen/providers/aws/waf-web-acl";
+interface MyConfig {
+  defaultAction: any;
+  metricName: any;
+  name: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new WafWebAcl(this, "example", {
+      loggingConfiguration: {
+        logDestination: Token.asString(
+          awsKinesisFirehoseDeliveryStreamExample.arn
+        ),
+        redactedFields: {
+          fieldToMatch: [
+            {
+              type: "URI",
+            },
+            {
+              data: "referer",
+              type: "HEADER",
+            },
+          ],
+        },
+      },
+      defaultAction: config.defaultAction,
+      metricName: config.metricName,
+      name: config.name,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `defaultAction` - (Required) Configuration block with action that you want AWS WAF to take when a request doesn't match the criteria in any of the rules that are associated with the web ACL. Detailed below.
+* `metricName` - (Required) The name or description for the Amazon CloudWatch metric of this web ACL.
+* `name` - (Required) The name or description of the web ACL.
+* `rules` - (Optional) Configuration blocks containing rules to associate with the web ACL and the settings for each rule. Detailed below.
+* `loggingConfiguration` - (Optional) Configuration block to enable WAF logging. Detailed below.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### `defaultAction` Configuration Block
+
+* `type` - (Required) Specifies how you want AWS WAF to respond to requests that don't match the criteria in any of the `rules`.
+  e.g., `allow` or `block`
+
+### `loggingConfiguration` Configuration Block
+
+* `logDestination` - (Required) Amazon Resource Name (ARN) of Kinesis Firehose Delivery Stream
+* `redactedFields` - (Optional) Configuration block containing parts of the request that you want redacted from the logs. Detailed below.
+
+#### `redactedFields` Configuration Block
+
+* `fieldToMatch` - (Required) Set of configuration blocks for fields to redact. Detailed below.
+
+##### `fieldToMatch` Configuration Block
+
+-> Additional information about this configuration can be found in the [AWS WAF Regional API Reference](https://docs.aws.amazon.com/waf/latest/APIReference/API_regional_FieldToMatch.html).
+
+* `data` - (Optional) When the value of `type` is `header`, enter the name of the header that you want the WAF to search, for example, `userAgent` or `referer`. If the value of `type` is any other value, omit `data`.
+* `type` - (Required) The part of the web request that you want AWS WAF to search for a specified stringE.g., `header` or `method`
+
+### `rules` Configuration Block
+
+See [docs](http://docs.aws.amazon.com/waf/latest/APIReference/API_ActivatedRule.html) for all details and supported values.
+
+* `action` - (Optional) The action that CloudFront or AWS WAF takes when a web request matches the conditions in the rule. Not used if `type` is `group`.
+    * `type` - (Required) valid values are: `block`, `allow`, or `count`
+* `overrideAction` - (Optional) Override the action that a group requests CloudFront or AWS WAF takes when a web request matches the conditions in the rule. Only used if `type` is `group`.
+    * `type` - (Required) valid values are: `none` or `count`
+* `priority` - (Required) Specifies the order in which the rules in a WebACL are evaluated.
+  Rules with a lower value are evaluated before rules with a higher value.
+* `ruleId` - (Required) ID of the associated WAF (Global) rule (e.g., [`awsWafRule`](/docs/providers/aws/r/waf_rule.html)). WAF (Regional) rules cannot be used.
+* `type` - (Optional) The rule type, either `regular`, as defined by [Rule](http://docs.aws.amazon.com/waf/latest/APIReference/API_Rule.html), `rateBased`, as defined by [RateBasedRule](http://docs.aws.amazon.com/waf/latest/APIReference/API_RateBasedRule.html), or `group`, as defined by [RuleGroup](https://docs.aws.amazon.com/waf/latest/APIReference/API_RuleGroup.html). The default is REGULAR. If you add a RATE_BASED rule, you need to set `type` as `rateBased`. If you add a GROUP rule, you need to set `type` as `group`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the WAF WebACL.
+* `arn` - The ARN of the WAF WebACL.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WAF Web ACL using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import WAF Web ACL using the `id`. For example:
+
+```console
+% terraform import aws_waf_web_acl.main 0c8e583e-18f3-4c13-9e2a-67c4805d2f94
+```
+
+<!-- cache-key: cdktf-0.18.0 input-ef78a6170a502ab8d3c2771bf4b7f7c113cf688e0a9d2aa577e013e90b14709a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/waf_xss_match_set.html.markdown b/website/docs/cdktf/typescript/r/waf_xss_match_set.html.markdown
new file mode 100644
index 00000000000..05235b7d565
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/waf_xss_match_set.html.markdown
@@ -0,0 +1,111 @@
+---
+subcategory: "WAF Classic"
+layout: "aws"
+page_title: "AWS: aws_waf_xss_match_set"
+description: |-
+  Provides a AWS WAF XssMatchSet resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_waf_xss_match_set
+
+Provides a WAF XSS Match Set Resource
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { WafXssMatchSet } from "./.gen/providers/aws/waf-xss-match-set";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new WafXssMatchSet(this, "xss_match_set", {
+      name: "xss_match_set",
+      xssMatchTuples: [
+        {
+          fieldToMatch: {
+            type: "URI",
+          },
+          textTransformation: "NONE",
+        },
+        {
+          fieldToMatch: {
+            type: "QUERY_STRING",
+          },
+          textTransformation: "NONE",
+        },
+      ],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name or description of the SizeConstraintSet.
+* `xssMatchTuples` - (Optional) The parts of web requests that you want to inspect for cross-site scripting attacks.
+
+## Nested Blocks
+
+### `xssMatchTuples`
+
+* `fieldToMatch` - (Required) Specifies where in a web request to look for cross-site scripting attacks.
+* `textTransformation` - (Required) Text transformations used to eliminate unusual formatting that attackers use in web requests in an effort to bypass AWS WAF.
+  If you specify a transformation, AWS WAF performs the transformation on `targetString` before inspecting a request for a match.
+  e.g., `cmdLine`, `htmlEntityDecode` or `none`.
+  See [docs](http://docs.aws.amazon.com/waf/latest/APIReference/API_XssMatchTuple.html#WAF-Type-XssMatchTuple-TextTransformation)
+  for all supported values.
+
+### `fieldToMatch`
+
+#### Arguments
+
+* `data` - (Optional) When `type` is `header`, enter the name of the header that you want to search, e.g., `userAgent` or `referer`.
+  If `type` is any other value, omit this field.
+* `type` - (Required) The part of the web request that you want AWS WAF to search for a specified string.
+  e.g., `header`, `method` or `body`.
+  See [docs](http://docs.aws.amazon.com/waf/latest/APIReference/API_FieldToMatch.html)
+  for all supported values.
+
+## Remarks
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the WAF XssMatchSet.
+* `arn` - Amazon Resource Name (ARN)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WAF XSS Match Set using their ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import WAF XSS Match Set using their ID. For example:
+
+```console
+% terraform import aws_waf_xss_match_set.example a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
+```
+
+<!-- cache-key: cdktf-0.18.0 input-b20024f44c940ead290498f06ec9b2d740a6fb68cd9745d06916f73db65eaaa6 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/wafregional_byte_match_set.html.markdown b/website/docs/cdktf/typescript/r/wafregional_byte_match_set.html.markdown
new file mode 100644
index 00000000000..a517480ca2e
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/wafregional_byte_match_set.html.markdown
@@ -0,0 +1,97 @@
+---
+subcategory: "WAF Classic Regional"
+layout: "aws"
+page_title: "AWS: aws_wafregional_byte_match_set"
+description: |-
+  Provides a AWS WAF Regional ByteMatchSet resource for use with ALB.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_wafregional_byte_match_set
+
+Provides a WAF Regional Byte Match Set Resource for use with Application Load Balancer.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { WafregionalByteMatchSet } from "./.gen/providers/aws/wafregional-byte-match-set";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new WafregionalByteMatchSet(this, "byte_set", {
+      byteMatchTuples: [
+        {
+          fieldToMatch: {
+            data: "referer",
+            type: "HEADER",
+          },
+          positionalConstraint: "CONTAINS",
+          targetString: "badrefer1",
+          textTransformation: "NONE",
+        },
+      ],
+      name: "tf_waf_byte_match_set",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name or description of the ByteMatchSet.
+* `byteMatchTuples` - (Optional)Settings for the ByteMatchSet, such as the bytes (typically a string that corresponds with ASCII characters) that you want AWS WAF to search for in web requests. ByteMatchTuple documented below.
+
+ByteMatchTuples(byte_match_tuples) support the following:
+
+* `fieldToMatch` - (Required) Settings for the ByteMatchTuple. FieldToMatch documented below.
+* `positionalConstraint` - (Required) Within the portion of a web request that you want to search.
+* `targetString` - (Required) The value that you want AWS WAF to search for. The maximum length of the value is 50 bytes.
+* `textTransformation` - (Required) The formatting way for web request.
+
+FieldToMatch(field_to_match) support following:
+
+* `data` - (Optional) When the value of Type is HEADER, enter the name of the header that you want AWS WAF to search, for example, User-Agent or Referer. If the value of Type is any other value, omit Data.
+* `type` - (Required) The part of the web request that you want AWS WAF to search for a specified string.
+
+## Remarks
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the WAF ByteMatchSet.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WAF Regional Byte Match Set using the id. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import WAF Regional Byte Match Set using the id. For example:
+
+```console
+% terraform import aws_wafregional_byte_match_set.byte_set a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
+```
+
+<!-- cache-key: cdktf-0.18.0 input-d354d98336a367dcda2900aef5df37bc2a4674f135a53bf8117fd2307be17d3e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/wafregional_geo_match_set.html.markdown b/website/docs/cdktf/typescript/r/wafregional_geo_match_set.html.markdown
new file mode 100644
index 00000000000..3b19020a9a3
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/wafregional_geo_match_set.html.markdown
@@ -0,0 +1,93 @@
+---
+subcategory: "WAF Classic Regional"
+layout: "aws"
+page_title: "AWS: aws_wafregional_geo_match_set"
+description: |-
+  Provides a AWS WAF Regional Geo Match Set resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_wafregional_geo_match_set
+
+Provides a WAF Regional Geo Match Set Resource
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { WafregionalGeoMatchSet } from "./.gen/providers/aws/wafregional-geo-match-set";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new WafregionalGeoMatchSet(this, "geo_match_set", {
+      geoMatchConstraint: [
+        {
+          type: "Country",
+          value: "US",
+        },
+        {
+          type: "Country",
+          value: "CA",
+        },
+      ],
+      name: "geo_match_set",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name or description of the Geo Match Set.
+* `geoMatchConstraint` - (Optional) The Geo Match Constraint objects which contain the country that you want AWS WAF to search for.
+
+## Nested Blocks
+
+### `geoMatchConstraint`
+
+#### Arguments
+
+* `type` - (Required) The type of geographical area you want AWS WAF to search for. Currently Country is the only valid value.
+* `value` - (Required) The country that you want AWS WAF to search for.
+  This is the two-letter country code, e.g., `us`, `ca`, `ru`, `cn`, etc.
+  See [docs](https://docs.aws.amazon.com/waf/latest/APIReference/API_GeoMatchConstraint.html) for all supported values.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the WAF Regional Geo Match Set.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WAF Regional Geo Match Set using the id. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import WAF Regional Geo Match Set using the id. For example:
+
+```console
+% terraform import aws_wafregional_geo_match_set.geo_match_set a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
+```
+
+<!-- cache-key: cdktf-0.18.0 input-076708092d61d2d1e6c278cff3a1595b6f32efbba2e3ac89150e24303f965c61 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/wafregional_ipset.html.markdown b/website/docs/cdktf/typescript/r/wafregional_ipset.html.markdown
new file mode 100644
index 00000000000..6d42d3688f6
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/wafregional_ipset.html.markdown
@@ -0,0 +1,94 @@
+---
+subcategory: "WAF Classic Regional"
+layout: "aws"
+page_title: "AWS: aws_wafregional_ipset"
+description: |-
+  Provides a AWS WAF Regional IPSet resource for use with ALB.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_wafregional_ipset
+
+Provides a WAF Regional IPSet Resource for use with Application Load Balancer.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { WafregionalIpset } from "./.gen/providers/aws/wafregional-ipset";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new WafregionalIpset(this, "ipset", {
+      ipSetDescriptor: [
+        {
+          type: "IPV4",
+          value: "192.0.7.0/24",
+        },
+        {
+          type: "IPV4",
+          value: "10.16.16.0/16",
+        },
+      ],
+      name: "tfIPSet",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name or description of the IPSet.
+* `ipSetDescriptor` - (Optional) One or more pairs specifying the IP address type (IPV4 or IPV6) and the IP address range (in CIDR notation) from which web requests originate.
+
+## Nested Blocks
+
+### `ipSetDescriptor`
+
+#### Arguments
+
+* `type` - (Required) The string like IPV4 or IPV6.
+* `value` - (Required) The CIDR notation.
+
+## Remarks
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the WAF IPSet.
+* `arn` - The ARN of the WAF IPSet.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WAF Regional IPSets using their ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import WAF Regional IPSets using their ID. For example:
+
+```console
+% terraform import aws_wafregional_ipset.example a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
+```
+
+<!-- cache-key: cdktf-0.18.0 input-bd423cc7eae4bc7869d7e7f89697634be360c63540ee5c25595e89016d52dd6a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/wafregional_rate_based_rule.html.markdown b/website/docs/cdktf/typescript/r/wafregional_rate_based_rule.html.markdown
new file mode 100644
index 00000000000..ae6b0c2174a
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/wafregional_rate_based_rule.html.markdown
@@ -0,0 +1,114 @@
+---
+subcategory: "WAF Classic Regional"
+layout: "aws"
+page_title: "AWS: aws_wafregional_rate_based_rule"
+description: |-
+  Provides a AWS WAF Regional rate based rule resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_wafregional_rate_based_rule
+
+Provides a WAF Rate Based Rule Resource
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { WafregionalIpset } from "./.gen/providers/aws/wafregional-ipset";
+import { WafregionalRateBasedRule } from "./.gen/providers/aws/wafregional-rate-based-rule";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const ipset = new WafregionalIpset(this, "ipset", {
+      ipSetDescriptor: [
+        {
+          type: "IPV4",
+          value: "192.0.7.0/24",
+        },
+      ],
+      name: "tfIPSet",
+    });
+    new WafregionalRateBasedRule(this, "wafrule", {
+      dependsOn: [ipset],
+      metricName: "tfWAFRule",
+      name: "tfWAFRule",
+      predicate: [
+        {
+          dataId: ipset.id,
+          negated: false,
+          type: "IPMatch",
+        },
+      ],
+      rateKey: "IP",
+      rateLimit: 100,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `metricName` - (Required) The name or description for the Amazon CloudWatch metric of this rule.
+* `name` - (Required) The name or description of the rule.
+* `rateKey` - (Required) Valid value is IP.
+* `rateLimit` - (Required) The maximum number of requests, which have an identical value in the field specified by the RateKey, allowed in a five-minute period. Minimum value is 100.
+* `predicate` - (Optional) The objects to include in a rule (documented below).
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Nested Blocks
+
+### `predicate`
+
+See the [WAF Documentation](https://docs.aws.amazon.com/waf/latest/APIReference/API_Predicate.html) for more information.
+
+#### Arguments
+
+* `negated` - (Required) Set this to `false` if you want to allow, block, or count requests
+  based on the settings in the specified `byteMatchSet`, `ipSet`, `sqlInjectionMatchSet`, `xssMatchSet`, or `sizeConstraintSet`.
+  For example, if an IPSet includes the IP address `1920244`, AWS WAF will allow or block requests based on that IP address.
+  If set to `true`, AWS WAF will allow, block, or count requests based on all IP addresses _except_ `1920244`.
+* `dataId` - (Required) A unique identifier for a predicate in the rule, such as Byte Match Set ID or IPSet ID.
+* `type` - (Required) The type of predicate in a rule. Valid values: `byteMatch`, `geoMatch`, `ipMatch`, `regexMatch`, `sizeConstraint`, `sqlInjectionMatch`, or `xssMatch`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the WAF Regional Rate Based Rule.
+* `arn` - The ARN of the WAF Regional Rate Based Rule.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WAF Regional Rate Based Rule using the id. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import WAF Regional Rate Based Rule using the id. For example:
+
+```console
+% terraform import aws_wafregional_rate_based_rule.wafrule a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
+```
+
+<!-- cache-key: cdktf-0.18.0 input-c9528cd637559b06111f0a86770cfd3352bea18039b8f306e153eeb9fb06d57f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/wafregional_regex_match_set.html.markdown b/website/docs/cdktf/typescript/r/wafregional_regex_match_set.html.markdown
new file mode 100644
index 00000000000..07969b47f99
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/wafregional_regex_match_set.html.markdown
@@ -0,0 +1,113 @@
+---
+subcategory: "WAF Classic Regional"
+layout: "aws"
+page_title: "AWS: aws_wafregional_regex_match_set"
+description: |-
+  Provides a AWS WAF Regional Regex Match Set resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_wafregional_regex_match_set
+
+Provides a WAF Regional Regex Match Set Resource
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { WafregionalRegexMatchSet } from "./.gen/providers/aws/wafregional-regex-match-set";
+import { WafregionalRegexPatternSet } from "./.gen/providers/aws/wafregional-regex-pattern-set";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new WafregionalRegexPatternSet(this, "example", {
+      name: "example",
+      regexPatternStrings: ["one", "two"],
+    });
+    const awsWafregionalRegexMatchSetExample = new WafregionalRegexMatchSet(
+      this,
+      "example_1",
+      {
+        name: "example",
+        regexMatchTuple: [
+          {
+            fieldToMatch: {
+              data: "User-Agent",
+              type: "HEADER",
+            },
+            regexPatternSetId: example.id,
+            textTransformation: "NONE",
+          },
+        ],
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsWafregionalRegexMatchSetExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name or description of the Regex Match Set.
+* `regexMatchTuple` - (Required) The regular expression pattern that you want AWS WAF to search for in web requests, the location in requests that you want AWS WAF to search, and other settings. See below.
+
+### Nested Arguments
+
+#### `regexMatchTuple`
+
+* `fieldToMatch` - (Required) The part of a web request that you want to search, such as a specified header or a query string.
+* `regexPatternSetId` - (Required) The ID of a [Regex Pattern Set](/docs/providers/aws/r/waf_regex_pattern_set.html).
+* `textTransformation` - (Required) Text transformations used to eliminate unusual formatting that attackers use in web requests in an effort to bypass AWS WAF.
+  e.g., `cmdLine`, `htmlEntityDecode` or `none`.
+  See [docs](http://docs.aws.amazon.com/waf/latest/APIReference/API_ByteMatchTuple.html#WAF-Type-ByteMatchTuple-TextTransformation)
+  for all supported values.
+
+#### `fieldToMatch`
+
+* `data` - (Optional) When `type` is `header`, enter the name of the header that you want to search, e.g., `userAgent` or `referer`.
+  If `type` is any other value, omit this field.
+* `type` - (Required) The part of the web request that you want AWS WAF to search for a specified string.
+  e.g., `header`, `method` or `body`.
+  See [docs](http://docs.aws.amazon.com/waf/latest/APIReference/API_FieldToMatch.html)
+  for all supported values.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the WAF Regional Regex Match Set.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WAF Regional Regex Match Set using the id. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import WAF Regional Regex Match Set using the id. For example:
+
+```console
+% terraform import aws_wafregional_regex_match_set.example a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
+```
+
+<!-- cache-key: cdktf-0.18.0 input-280a1a139f7548e59dbaac6d77fc6dec1f0577b42b89b3bfe2b5a8ac5c257759 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/wafregional_regex_pattern_set.html.markdown b/website/docs/cdktf/typescript/r/wafregional_regex_pattern_set.html.markdown
new file mode 100644
index 00000000000..3bbfee9ac80
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/wafregional_regex_pattern_set.html.markdown
@@ -0,0 +1,73 @@
+---
+subcategory: "WAF Classic Regional"
+layout: "aws"
+page_title: "AWS: aws_wafregional_regex_pattern_set"
+description: |-
+  Provides a AWS WAF Regional Regex Pattern Set resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_wafregional_regex_pattern_set
+
+Provides a WAF Regional Regex Pattern Set Resource
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { WafregionalRegexPatternSet } from "./.gen/providers/aws/wafregional-regex-pattern-set";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new WafregionalRegexPatternSet(this, "example", {
+      name: "example",
+      regexPatternStrings: ["one", "two"],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name or description of the Regex Pattern Set.
+* `regexPatternStrings` - (Optional) A list of regular expression (regex) patterns that you want AWS WAF to search for, such as `b[a@]dB[o0]t`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the WAF Regional Regex Pattern Set.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WAF Regional Regex Pattern Set using the id. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import WAF Regional Regex Pattern Set using the id. For example:
+
+```console
+% terraform import aws_wafregional_regex_pattern_set.example a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
+```
+
+<!-- cache-key: cdktf-0.18.0 input-cff1466a5daff624aa9ded6cc255388e5ab53f5a98b6e49b1cd55ad6eb538fca -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/wafregional_rule.html.markdown b/website/docs/cdktf/typescript/r/wafregional_rule.html.markdown
new file mode 100644
index 00000000000..518b6bf8dfe
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/wafregional_rule.html.markdown
@@ -0,0 +1,108 @@
+---
+subcategory: "WAF Classic Regional"
+layout: "aws"
+page_title: "AWS: aws_wafregional_rule"
+description: |-
+  Provides an AWS WAF Regional rule resource for use with ALB.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_wafregional_rule
+
+Provides an WAF Regional Rule Resource for use with Application Load Balancer.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { WafregionalIpset } from "./.gen/providers/aws/wafregional-ipset";
+import { WafregionalRule } from "./.gen/providers/aws/wafregional-rule";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const ipset = new WafregionalIpset(this, "ipset", {
+      ipSetDescriptor: [
+        {
+          type: "IPV4",
+          value: "192.0.7.0/24",
+        },
+      ],
+      name: "tfIPSet",
+    });
+    new WafregionalRule(this, "wafrule", {
+      metricName: "tfWAFRule",
+      name: "tfWAFRule",
+      predicate: [
+        {
+          dataId: ipset.id,
+          negated: false,
+          type: "IPMatch",
+        },
+      ],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name or description of the rule.
+* `metricName` - (Required) The name or description for the Amazon CloudWatch metric of this rule.
+* `predicate` - (Optional) The objects to include in a rule (documented below).
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Nested Fields
+
+### `predicate`
+
+See the [WAF Documentation](https://docs.aws.amazon.com/waf/latest/APIReference/API_Predicate.html) for more information.
+
+#### Arguments
+
+* `type` - (Required) The type of predicate in a rule. Valid values: `byteMatch`, `geoMatch`, `ipMatch`, `regexMatch`, `sizeConstraint`, `sqlInjectionMatch`, or `xssMatch`
+* `dataId` - (Required) The unique identifier of a predicate, such as the ID of a `byteMatchSet` or `ipSet`.
+* `negated` - (Required) Whether to use the settings or the negated settings that you specified in the objects.
+
+## Remarks
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the WAF Regional Rule.
+* `arn` - The ARN of the WAF Regional Rule.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WAF Regional Rule using the id. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import WAF Regional Rule using the id. For example:
+
+```console
+% terraform import aws_wafregional_rule.wafrule a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
+```
+
+<!-- cache-key: cdktf-0.18.0 input-a40cdd272300595e743e666f37c7f58fb8e82cbebd3677921ecf317be3ff42df -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/wafregional_rule_group.html.markdown b/website/docs/cdktf/typescript/r/wafregional_rule_group.html.markdown
new file mode 100644
index 00000000000..ffa7dcbb518
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/wafregional_rule_group.html.markdown
@@ -0,0 +1,109 @@
+---
+subcategory: "WAF Classic Regional"
+layout: "aws"
+page_title: "AWS: aws_wafregional_rule_group"
+description: |-
+  Provides a AWS WAF Regional Rule Group resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_wafregional_rule_group
+
+Provides a WAF Regional Rule Group Resource
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { WafregionalRule } from "./.gen/providers/aws/wafregional-rule";
+import { WafregionalRuleGroup } from "./.gen/providers/aws/wafregional-rule-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new WafregionalRule(this, "example", {
+      metricName: "example",
+      name: "example",
+    });
+    const awsWafregionalRuleGroupExample = new WafregionalRuleGroup(
+      this,
+      "example_1",
+      {
+        activatedRule: [
+          {
+            action: {
+              type: "COUNT",
+            },
+            priority: 50,
+            ruleId: example.id,
+          },
+        ],
+        metricName: "example",
+        name: "example",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsWafregionalRuleGroupExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) A friendly name of the rule group
+* `metricName` - (Required) A friendly name for the metrics from the rule group
+* `activatedRule` - (Optional) A list of activated rules, see below
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Nested Blocks
+
+### `activatedRule`
+
+#### Arguments
+
+* `action` - (Required) Specifies the action that CloudFront or AWS WAF takes when a web request matches the conditions in the rule.
+    * `type` - (Required) e.g., `block`, `allow`, or `count`
+* `priority` - (Required) Specifies the order in which the rules are evaluated. Rules with a lower value are evaluated before rules with a higher value.
+* `ruleId` - (Required) The ID of a [rule](/docs/providers/aws/r/wafregional_rule.html)
+* `type` - (Optional) The rule type, either [`regular`](/docs/providers/aws/r/wafregional_rule.html), [`rateBased`](/docs/providers/aws/r/wafregional_rate_based_rule.html), or `group`. Defaults to `regular`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the WAF Regional Rule Group.
+* `arn` - The ARN of the WAF Regional Rule Group.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WAF Regional Rule Group using the id. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import WAF Regional Rule Group using the id. For example:
+
+```console
+% terraform import aws_wafregional_rule_group.example a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
+```
+
+<!-- cache-key: cdktf-0.18.0 input-2935ebb79c393d1d70c3018dc3927bc8f00af67f128cb5a4088d52b0c5dc4769 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/wafregional_size_constraint_set.html.markdown b/website/docs/cdktf/typescript/r/wafregional_size_constraint_set.html.markdown
new file mode 100644
index 00000000000..ff4499bf905
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/wafregional_size_constraint_set.html.markdown
@@ -0,0 +1,112 @@
+---
+subcategory: "WAF Classic Regional"
+layout: "aws"
+page_title: "AWS: aws_wafregional_size_constraint_set"
+description: |-
+  Provides an AWS WAF Regional Size Constraint Set resource for use with ALB.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_wafregional_size_constraint_set
+
+Provides a WAF Regional Size Constraint Set Resource for use with Application Load Balancer.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { WafregionalSizeConstraintSet } from "./.gen/providers/aws/wafregional-size-constraint-set";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new WafregionalSizeConstraintSet(this, "size_constraint_set", {
+      name: "tfsize_constraints",
+      sizeConstraints: [
+        {
+          comparisonOperator: "EQ",
+          fieldToMatch: {
+            type: "BODY",
+          },
+          size: Token.asNumber("4096"),
+          textTransformation: "NONE",
+        },
+      ],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name or description of the Size Constraint Set.
+* `sizeConstraints` - (Optional) Specifies the parts of web requests that you want to inspect the size of.
+
+## Nested Blocks
+
+### `sizeConstraints`
+
+#### Arguments
+
+* `fieldToMatch` - (Required) Specifies where in a web request to look for the size constraint.
+* `comparisonOperator` - (Required) The type of comparison you want to perform.
+  e.g., `eq`, `ne`, `lt`, `gt`.
+  See [docs](https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_SizeConstraint.html) for all supported values.
+* `size` - (Required) The size in bytes that you want to compare against the size of the specified `fieldToMatch`.
+  Valid values are between 0 - 21474836480 bytes (0 - 20 GB).
+* `textTransformation` - (Required) Text transformations used to eliminate unusual formatting that attackers use in web requests in an effort to bypass AWS WAF.
+  If you specify a transformation, AWS WAF performs the transformation on `fieldToMatch` before inspecting a request for a match.
+  e.g., `cmdLine`, `htmlEntityDecode` or `none`.
+  See [docs](http://docs.aws.amazon.com/waf/latest/APIReference/API_SizeConstraint.html#WAF-Type-SizeConstraint-TextTransformation)
+  for all supported values.
+  **Note:** if you choose `body` as `type`, you must choose `none` because CloudFront forwards only the first 8192 bytes for inspection.
+
+### `fieldToMatch`
+
+#### Arguments
+
+* `data` - (Optional) When `type` is `header`, enter the name of the header that you want to search, e.g., `userAgent` or `referer`.
+  If `type` is any other value, omit this field.
+* `type` - (Required) The part of the web request that you want AWS WAF to search for a specified string.
+  e.g., `header`, `method` or `body`.
+  See [docs](http://docs.aws.amazon.com/waf/latest/APIReference/API_FieldToMatch.html)
+  for all supported values.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the WAF Size Constraint Set.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WAF Size Constraint Set using the id. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import WAF Size Constraint Set using the id. For example:
+
+```console
+% terraform import aws_wafregional_size_constraint_set.size_constraint_set a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
+```
+
+<!-- cache-key: cdktf-0.18.0 input-64d9f0d82b2b891198f8ccc4cee325bd0e4f4efb84239342a4238efc9f6b5a0e -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/wafregional_sql_injection_match_set.html.markdown b/website/docs/cdktf/typescript/r/wafregional_sql_injection_match_set.html.markdown
new file mode 100644
index 00000000000..af7586d0ac4
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/wafregional_sql_injection_match_set.html.markdown
@@ -0,0 +1,100 @@
+---
+subcategory: "WAF Classic Regional"
+layout: "aws"
+page_title: "AWS: aws_wafregional_sql_injection_match_set"
+description: |-
+  Provides a AWS WAF Regional SqlInjectionMatchSet resource for use with ALB.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_wafregional_sql_injection_match_set
+
+Provides a WAF Regional SQL Injection Match Set Resource for use with Application Load Balancer.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { WafregionalSqlInjectionMatchSet } from "./.gen/providers/aws/wafregional-sql-injection-match-set";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new WafregionalSqlInjectionMatchSet(this, "sql_injection_match_set", {
+      name: "tf-sql_injection_match_set",
+      sqlInjectionMatchTuple: [
+        {
+          fieldToMatch: {
+            type: "QUERY_STRING",
+          },
+          textTransformation: "URL_DECODE",
+        },
+      ],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name or description of the SizeConstraintSet.
+* `sqlInjectionMatchTuple` - (Optional) The parts of web requests that you want AWS WAF to inspect for malicious SQL code and, if you want AWS WAF to inspect a header, the name of the header.
+
+### Nested fields
+
+### `sqlInjectionMatchTuple`
+
+* `fieldToMatch` - (Required) Specifies where in a web request to look for snippets of malicious SQL code.
+* `textTransformation` - (Required) Text transformations used to eliminate unusual formatting that attackers use in web requests in an effort to bypass AWS WAF.
+  If you specify a transformation, AWS WAF performs the transformation on `fieldToMatch` before inspecting a request for a match.
+  e.g., `cmdLine`, `htmlEntityDecode` or `none`.
+  See [docs](https://docs.aws.amazon.com/waf/latest/APIReference/API_regional_SqlInjectionMatchTuple.html#WAF-Type-regional_SqlInjectionMatchTuple-TextTransformation)
+  for all supported values.
+
+### `fieldToMatch`
+
+* `data` - (Optional) When `type` is `header`, enter the name of the header that you want to search, e.g., `userAgent` or `referer`.
+  If `type` is any other value, omit this field.
+* `type` - (Required) The part of the web request that you want AWS WAF to search for a specified string.
+  e.g., `header`, `method` or `body`.
+  See [docs](https://docs.aws.amazon.com/waf/latest/APIReference/API_regional_FieldToMatch.html)
+  for all supported values.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the WAF SqlInjectionMatchSet.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WAF Regional Sql Injection Match Set using the id. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import WAF Regional Sql Injection Match Set using the id. For example:
+
+```console
+% terraform import aws_wafregional_sql_injection_match_set.sql_injection_match_set a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
+```
+
+<!-- cache-key: cdktf-0.18.0 input-adfcd685dca95982844290477cadf9fa51737f4a170db60101e185299508456a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/wafregional_web_acl.html.markdown b/website/docs/cdktf/typescript/r/wafregional_web_acl.html.markdown
new file mode 100644
index 00000000000..48dac7e9528
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/wafregional_web_acl.html.markdown
@@ -0,0 +1,234 @@
+---
+subcategory: "WAF Classic Regional"
+layout: "aws"
+page_title: "AWS: aws_wafregional_web_acl"
+description: |-
+  Provides a AWS WAF Regional web access control group (ACL) resource for use with ALB.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_wafregional_web_acl
+
+Provides a WAF Regional Web ACL Resource for use with Application Load Balancer.
+
+## Example Usage
+
+### Regular Rule
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { WafregionalIpset } from "./.gen/providers/aws/wafregional-ipset";
+import { WafregionalRule } from "./.gen/providers/aws/wafregional-rule";
+import { WafregionalWebAcl } from "./.gen/providers/aws/wafregional-web-acl";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const ipset = new WafregionalIpset(this, "ipset", {
+      ipSetDescriptor: [
+        {
+          type: "IPV4",
+          value: "192.0.7.0/24",
+        },
+      ],
+      name: "tfIPSet",
+    });
+    const wafrule = new WafregionalRule(this, "wafrule", {
+      metricName: "tfWAFRule",
+      name: "tfWAFRule",
+      predicate: [
+        {
+          dataId: ipset.id,
+          negated: false,
+          type: "IPMatch",
+        },
+      ],
+    });
+    new WafregionalWebAcl(this, "wafacl", {
+      defaultAction: {
+        type: "ALLOW",
+      },
+      metricName: "tfWebACL",
+      name: "tfWebACL",
+      rule: [
+        {
+          action: {
+            type: "BLOCK",
+          },
+          priority: 1,
+          ruleId: wafrule.id,
+          type: "REGULAR",
+        },
+      ],
+    });
+  }
+}
+
+```
+
+### Group Rule
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { WafregionalWebAcl } from "./.gen/providers/aws/wafregional-web-acl";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new WafregionalWebAcl(this, "example", {
+      defaultAction: {
+        type: "ALLOW",
+      },
+      metricName: "example",
+      name: "example",
+      rule: [
+        {
+          overrideAction: {
+            type: "NONE",
+          },
+          priority: 1,
+          ruleId: Token.asString(awsWafregionalRuleGroupExample.id),
+          type: "GROUP",
+        },
+      ],
+    });
+  }
+}
+
+```
+
+### Logging
+
+~> *NOTE:* The Kinesis Firehose Delivery Stream name must begin with `awsWafLogs`. See the [AWS WAF Developer Guide](https://docs.aws.amazon.com/waf/latest/developerguide/logging.html) for more information about enabling WAF logging.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { WafregionalWebAcl } from "./.gen/providers/aws/wafregional-web-acl";
+interface MyConfig {
+  defaultAction: any;
+  metricName: any;
+  name: any;
+}
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string, config: MyConfig) {
+    super(scope, name);
+    new WafregionalWebAcl(this, "example", {
+      loggingConfiguration: {
+        logDestination: Token.asString(
+          awsKinesisFirehoseDeliveryStreamExample.arn
+        ),
+        redactedFields: {
+          fieldToMatch: [
+            {
+              type: "URI",
+            },
+            {
+              data: "referer",
+              type: "HEADER",
+            },
+          ],
+        },
+      },
+      defaultAction: config.defaultAction,
+      metricName: config.metricName,
+      name: config.name,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `defaultAction` - (Required) The action that you want AWS WAF Regional to take when a request doesn't match the criteria in any of the rules that are associated with the web ACL.
+* `metricName` - (Required) The name or description for the Amazon CloudWatch metric of this web ACL.
+* `name` - (Required) The name or description of the web ACL.
+* `loggingConfiguration` - (Optional) Configuration block to enable WAF logging. Detailed below.
+* `rule` - (Optional) Set of configuration blocks containing rules for the web ACL. Detailed below.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### `defaultAction` Configuration Block
+
+* `type` - (Required) Specifies how you want AWS WAF Regional to respond to requests that match the settings in a ruleE.g., `allow`, `block` or `count`
+
+### `loggingConfiguration` Configuration Block
+
+* `logDestination` - (Required) Amazon Resource Name (ARN) of Kinesis Firehose Delivery Stream
+* `redactedFields` - (Optional) Configuration block containing parts of the request that you want redacted from the logs. Detailed below.
+
+#### `redactedFields` Configuration Block
+
+* `fieldToMatch` - (Required) Set of configuration blocks for fields to redact. Detailed below.
+
+##### `fieldToMatch` Configuration Block
+
+-> Additional information about this configuration can be found in the [AWS WAF Regional API Reference](https://docs.aws.amazon.com/waf/latest/APIReference/API_regional_FieldToMatch.html).
+
+* `data` - (Optional) When the value of `type` is `header`, enter the name of the header that you want the WAF to search, for example, `userAgent` or `referer`. If the value of `type` is any other value, omit `data`.
+* `type` - (Required) The part of the web request that you want AWS WAF to search for a specified stringE.g., `header` or `method`
+
+### `rule` Configuration Block
+
+-> Additional information about this configuration can be found in the [AWS WAF Regional API Reference](https://docs.aws.amazon.com/waf/latest/APIReference/API_regional_ActivatedRule.html).
+
+* `priority` - (Required) Specifies the order in which the rules in a WebACL are evaluated.
+  Rules with a lower value are evaluated before rules with a higher value.
+* `ruleId` - (Required) ID of the associated WAF (Regional) rule (e.g., [`awsWafregionalRule`](/docs/providers/aws/r/wafregional_rule.html)). WAF (Global) rules cannot be used.
+* `action` - (Optional) Configuration block of the action that CloudFront or AWS WAF takes when a web request matches the conditions in the rule.  Not used if `type` is `group`. Detailed below.
+* `overrideAction` - (Optional) Configuration block of the override the action that a group requests CloudFront or AWS WAF takes when a web request matches the conditions in the rule.  Only used if `type` is `group`. Detailed below.
+* `type` - (Optional) The rule type, either `regular`, as defined by [Rule](http://docs.aws.amazon.com/waf/latest/APIReference/API_Rule.html), `rateBased`, as defined by [RateBasedRule](http://docs.aws.amazon.com/waf/latest/APIReference/API_RateBasedRule.html), or `group`, as defined by [RuleGroup](https://docs.aws.amazon.com/waf/latest/APIReference/API_RuleGroup.html). The default is REGULAR. If you add a RATE_BASED rule, you need to set `type` as `rateBased`. If you add a GROUP rule, you need to set `type` as `group`.
+
+#### `action` / `overrideAction` Configuration Block
+
+* `type` - (Required) Specifies how you want AWS WAF Regional to respond to requests that match the settings in a rule. Valid values for `action` are `allow`, `block` or `count`. Valid values for `overrideAction` are `count` and `none`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the WAF Regional WebACL.
+* `id` - The ID of the WAF Regional WebACL.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WAF Regional Web ACL using the id. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import WAF Regional Web ACL using the id. For example:
+
+```console
+% terraform import aws_wafregional_web_acl.wafacl a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
+```
+
+<!-- cache-key: cdktf-0.18.0 input-becb283a0bf3a66968d3b5835eb6a5ff193e490c6ee5cb1289a6144e0f32490f -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/wafregional_web_acl_association.html.markdown b/website/docs/cdktf/typescript/r/wafregional_web_acl_association.html.markdown
new file mode 100644
index 00000000000..17306cd78d1
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/wafregional_web_acl_association.html.markdown
@@ -0,0 +1,241 @@
+---
+subcategory: "WAF Classic Regional"
+layout: "aws"
+page_title: "AWS: aws_wafregional_web_acl_association"
+description: |-
+  Manages an association with WAF Regional Web ACL
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_wafregional_web_acl_association
+
+Manages an association with WAF Regional Web ACL.
+
+-> **Note:** An Application Load Balancer can only be associated with one WAF Regional WebACL.
+
+## Example Usage
+
+### Application Load Balancer Association
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, Fn, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Alb } from "./.gen/providers/aws/alb";
+import { DataAwsAvailabilityZones } from "./.gen/providers/aws/data-aws-availability-zones";
+import { Subnet } from "./.gen/providers/aws/subnet";
+import { Vpc } from "./.gen/providers/aws/vpc";
+import { WafregionalIpset } from "./.gen/providers/aws/wafregional-ipset";
+import { WafregionalRule } from "./.gen/providers/aws/wafregional-rule";
+import { WafregionalWebAcl } from "./.gen/providers/aws/wafregional-web-acl";
+import { WafregionalWebAclAssociation } from "./.gen/providers/aws/wafregional-web-acl-association";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const foo = new Vpc(this, "foo", {
+      cidrBlock: "10.1.0.0/16",
+    });
+    const ipset = new WafregionalIpset(this, "ipset", {
+      ipSetDescriptor: [
+        {
+          type: "IPV4",
+          value: "192.0.7.0/24",
+        },
+      ],
+      name: "tfIPSet",
+    });
+    const awsWafregionalRuleFoo = new WafregionalRule(this, "foo_2", {
+      metricName: "tfWAFRule",
+      name: "tfWAFRule",
+      predicate: [
+        {
+          dataId: ipset.id,
+          negated: false,
+          type: "IPMatch",
+        },
+      ],
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsWafregionalRuleFoo.overrideLogicalId("foo");
+    const awsWafregionalWebAclFoo = new WafregionalWebAcl(this, "foo_3", {
+      defaultAction: {
+        type: "ALLOW",
+      },
+      metricName: "foo",
+      name: "foo",
+      rule: [
+        {
+          action: {
+            type: "BLOCK",
+          },
+          priority: 1,
+          ruleId: Token.asString(awsWafregionalRuleFoo.id),
+        },
+      ],
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsWafregionalWebAclFoo.overrideLogicalId("foo");
+    const available = new DataAwsAvailabilityZones(this, "available", {});
+    const bar = new Subnet(this, "bar", {
+      availabilityZone: Token.asString(Fn.lookupNested(available.names, ["1"])),
+      cidrBlock: "10.1.2.0/24",
+      vpcId: foo.id,
+    });
+    const awsSubnetFoo = new Subnet(this, "foo_6", {
+      availabilityZone: Token.asString(Fn.lookupNested(available.names, ["0"])),
+      cidrBlock: "10.1.1.0/24",
+      vpcId: foo.id,
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsSubnetFoo.overrideLogicalId("foo");
+    const awsAlbFoo = new Alb(this, "foo_7", {
+      internal: true,
+      subnets: [Token.asString(awsSubnetFoo.id), bar.id],
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsAlbFoo.overrideLogicalId("foo");
+    const awsWafregionalWebAclAssociationFoo = new WafregionalWebAclAssociation(
+      this,
+      "foo_8",
+      {
+        resourceArn: Token.asString(awsAlbFoo.arn),
+        webAclId: Token.asString(awsWafregionalWebAclFoo.id),
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsWafregionalWebAclAssociationFoo.overrideLogicalId("foo");
+  }
+}
+
+```
+
+### API Gateway Association
+
+```terraform
+resource "aws_wafregional_ipset" "ipset" {
+  name = "tfIPSet"
+
+  ip_set_descriptor {
+    type  = "IPV4"
+    value = "192.0.7.0/24"
+  }
+}
+
+resource "aws_wafregional_rule" "foo" {
+  name        = "tfWAFRule"
+  metric_name = "tfWAFRule"
+
+  predicate {
+    data_id = aws_wafregional_ipset.ipset.id
+    negated = false
+    type    = "IPMatch"
+  }
+}
+
+resource "aws_wafregional_web_acl" "foo" {
+  name        = "foo"
+  metric_name = "foo"
+
+  default_action {
+    type = "ALLOW"
+  }
+
+  rule {
+    action {
+      type = "BLOCK"
+    }
+
+    priority = 1
+    rule_id  = aws_wafregional_rule.foo.id
+  }
+}
+
+resource "aws_api_gateway_rest_api" "example" {
+  body = jsonencode({
+    openapi = "3.0.1"
+    info = {
+      title   = "example"
+      version = "1.0"
+    }
+    paths = {
+      "/path1" = {
+        get = {
+          x-amazon-apigateway-integration = {
+            httpMethod           = "GET"
+            payloadFormatVersion = "1.0"
+            type                 = "HTTP_PROXY"
+            uri                  = "https://ip-ranges.amazonaws.com/ip-ranges.json"
+          }
+        }
+      }
+    }
+  })
+
+  name = "example"
+}
+
+resource "aws_api_gateway_deployment" "example" {
+  rest_api_id = aws_api_gateway_rest_api.example.id
+
+  triggers = {
+    redeployment = sha1(jsonencode(aws_api_gateway_rest_api.example.body))
+  }
+
+  lifecycle {
+    create_before_destroy = true
+  }
+}
+
+resource "aws_api_gateway_stage" "example" {
+  deployment_id = aws_api_gateway_deployment.example.id
+  rest_api_id   = aws_api_gateway_rest_api.example.id
+  stage_name    = "example"
+}
+
+resource "aws_wafregional_web_acl_association" "association" {
+  resource_arn = aws_api_gateway_stage.example.arn
+  web_acl_id   = aws_wafregional_web_acl.foo.id
+}
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `webAclId` - (Required) The ID of the WAF Regional WebACL to create an association.
+* `resourceArn` - (Required) ARN of the resource to associate with. For example, an Application Load Balancer or API Gateway Stage.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the association
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WAF Regional Web ACL Association using their `webAclId:resourceArn`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import WAF Regional Web ACL Association using their `webAclId:resourceArn`. For example:
+
+```console
+% terraform import aws_wafregional_web_acl_association.foo web_acl_id:resource_arn
+```
+
+<!-- cache-key: cdktf-0.18.0 input-92667f5c1ba12f0dd670b9a0c354eaa6a7710825c86ec694fd9b66942f7d2390 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/wafregional_xss_match_set.html.markdown b/website/docs/cdktf/typescript/r/wafregional_xss_match_set.html.markdown
new file mode 100644
index 00000000000..3c8f9b0dc8e
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/wafregional_xss_match_set.html.markdown
@@ -0,0 +1,98 @@
+---
+subcategory: "WAF Classic Regional"
+layout: "aws"
+page_title: "AWS: aws_wafregional_xss_match_set"
+description: |-
+  Provides an AWS WAF Regional XSS Match Set resource for use with ALB.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_wafregional_xss_match_set
+
+Provides a WAF Regional XSS Match Set Resource for use with Application Load Balancer.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { WafregionalXssMatchSet } from "./.gen/providers/aws/wafregional-xss-match-set";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new WafregionalXssMatchSet(this, "xss_match_set", {
+      name: "xss_match_set",
+      xssMatchTuple: [
+        {
+          fieldToMatch: {
+            type: "URI",
+          },
+          textTransformation: "NONE",
+        },
+        {
+          fieldToMatch: {
+            type: "QUERY_STRING",
+          },
+          textTransformation: "NONE",
+        },
+      ],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the set
+* `xssMatchTuple` - (Optional) The parts of web requests that you want to inspect for cross-site scripting attacks.
+
+### Nested fields
+
+#### `xssMatchTuple`
+
+* `fieldToMatch` - (Required) Specifies where in a web request to look for cross-site scripting attacks.
+* `textTransformation` - (Required) Which text transformation, if any, to perform on the web request before inspecting the request for cross-site scripting attacks.
+
+#### `fieldToMatch`
+
+* `data` - (Optional) When the value of `type` is `header`, enter the name of the header that you want the WAF to search, for example, `userAgent` or `referer`. If the value of `type` is any other value, omit `data`.
+* `type` - (Required) The part of the web request that you want AWS WAF to search for a specified stringE.g., `header` or `method`
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the Regional WAF XSS Match Set.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AWS WAF Regional XSS Match using the `id`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import AWS WAF Regional XSS Match using the `id`. For example:
+
+```console
+% terraform import aws_wafregional_xss_match_set.example 12345abcde
+```
+
+<!-- cache-key: cdktf-0.18.0 input-4f4d2ad8398170e5434a031da6cefde1dcdd17702dcd9c227325415752575f4a -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/wafv2_ip_set.html.markdown b/website/docs/cdktf/typescript/r/wafv2_ip_set.html.markdown
new file mode 100644
index 00000000000..d19d986e43b
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/wafv2_ip_set.html.markdown
@@ -0,0 +1,86 @@
+---
+subcategory: "WAF"
+layout: "aws"
+page_title: "AWS: aws_wafv2_ip_set"
+description: |-
+  Provides an AWS WAFv2 IP Set resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_wafv2_ip_set
+
+Provides a WAFv2 IP Set Resource
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Wafv2IpSet } from "./.gen/providers/aws/wafv2-ip-set";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Wafv2IpSet(this, "example", {
+      addresses: ["1.2.3.4/32", "5.6.7.8/32"],
+      description: "Example IP set",
+      ipAddressVersion: "IPV4",
+      name: "example",
+      scope: "REGIONAL",
+      tags: {
+        Tag1: "Value1",
+        Tag2: "Value2",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) A friendly name of the IP set.
+* `description` - (Optional) A friendly description of the IP set.
+* `scope` - (Required) Specifies whether this is for an AWS CloudFront distribution or for a regional application. Valid values are `cloudfront` or `regional`. To work with CloudFront, you must also specify the Region US East (N. Virginia).
+* `ipAddressVersion` - (Required) Specify IPV4 or IPV6. Valid values are `ipv4` or `ipv6`.
+* `addresses` - (Required) Contains an array of strings that specifies zero or more IP addresses or blocks of IP addresses. All addresses must be specified using Classless Inter-Domain Routing (CIDR) notation. WAF supports all IPv4 and IPv6 CIDR ranges except for `/0`.
+* `tags` - (Optional) An array of key:value pairs to associate with the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - A unique identifier for the IP set.
+* `arn` - The Amazon Resource Name (ARN) of the IP set.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WAFv2 IP Sets using `id/name/scope`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import WAFv2 IP Sets using `id/name/scope`. For example:
+
+```console
+% terraform import aws_wafv2_ip_set.example a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc/example/REGIONAL
+```
+
+<!-- cache-key: cdktf-0.18.0 input-b479c9f718a616c5596b789c7ff158e99147f52c44de441fab9ea4c4e4b4ab65 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/wafv2_regex_pattern_set.html.markdown b/website/docs/cdktf/typescript/r/wafv2_regex_pattern_set.html.markdown
new file mode 100644
index 00000000000..5755190ca45
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/wafv2_regex_pattern_set.html.markdown
@@ -0,0 +1,95 @@
+---
+subcategory: "WAF"
+layout: "aws"
+page_title: "AWS: aws_wafv2_regex_pattern_set"
+description: |-
+  Provides an AWS WAFv2 Regex Pattern Set resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_wafv2_regex_pattern_set
+
+Provides an AWS WAFv2 Regex Pattern Set Resource
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Wafv2RegexPatternSet } from "./.gen/providers/aws/wafv2-regex-pattern-set";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Wafv2RegexPatternSet(this, "example", {
+      description: "Example regex pattern set",
+      name: "example",
+      regularExpression: [
+        {
+          regexString: "one",
+        },
+        {
+          regexString: "two",
+        },
+      ],
+      scope: "REGIONAL",
+      tags: {
+        Tag1: "Value1",
+        Tag2: "Value2",
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) A friendly name of the regular expression pattern set.
+* `description` - (Optional) A friendly description of the regular expression pattern set.
+* `scope` - (Required) Specifies whether this is for an AWS CloudFront distribution or for a regional application. Valid values are `cloudfront` or `regional`. To work with CloudFront, you must also specify the region `usEast1` (N. Virginia) on the AWS provider.
+* `regularExpression` - (Optional) One or more blocks of regular expression patterns that you want AWS WAF to search for, such as `b[a@]dB[o0]t`. See [Regular Expression](#regular-expression) below for details. A maximum of 10 `regularExpression` blocks may be specified.
+* `tags` - (Optional) An array of key:value pairs to associate with the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Regular Expression
+
+* `regexString` - (Required) The string representing the regular expression, see the AWS WAF [documentation](https://docs.aws.amazon.com/waf/latest/developerguide/waf-regex-pattern-set-creating.html) for more information.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - A unique identifier for the set.
+* `arn` - The Amazon Resource Name (ARN) that identifies the cluster.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WAFv2 Regex Pattern Sets using `id/name/scope`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import WAFv2 Regex Pattern Sets using `id/name/scope`. For example:
+
+```console
+% terraform import aws_wafv2_regex_pattern_set.example a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc/example/REGIONAL
+```
+
+<!-- cache-key: cdktf-0.18.0 input-eed21a5d34f7cebe366e9c7f2f0e99fea6caa3cbfe03c93ecf2ee8118271fa64 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/wafv2_rule_group.html.markdown b/website/docs/cdktf/typescript/r/wafv2_rule_group.html.markdown
new file mode 100644
index 00000000000..a988c86bed6
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/wafv2_rule_group.html.markdown
@@ -0,0 +1,812 @@
+---
+subcategory: "WAF"
+layout: "aws"
+page_title: "AWS: aws_wafv2_rule_group"
+description: |-
+  Creates a WAFv2 rule group resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_wafv2_rule_group
+
+Creates a WAFv2 Rule Group resource.
+
+## Example Usage
+
+### Simple
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Wafv2RuleGroup } from "./.gen/providers/aws/wafv2-rule-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Wafv2RuleGroup(this, "example", {
+      capacity: 2,
+      name: "example-rule",
+      rule: [
+        {
+          action: {
+            allow: {},
+          },
+          name: "rule-1",
+          priority: 1,
+          statement: {
+            geoMatchStatement: {
+              countryCodes: ["US", "NL"],
+            },
+          },
+          visibilityConfig: {
+            cloudwatchMetricsEnabled: false,
+            metricName: "friendly-rule-metric-name",
+            sampledRequestsEnabled: false,
+          },
+        },
+      ],
+      scope: "REGIONAL",
+      visibilityConfig: {
+        cloudwatchMetricsEnabled: false,
+        metricName: "friendly-metric-name",
+        sampledRequestsEnabled: false,
+      },
+    });
+  }
+}
+
+```
+
+### Complex
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Wafv2IpSet } from "./.gen/providers/aws/wafv2-ip-set";
+import { Wafv2RegexPatternSet } from "./.gen/providers/aws/wafv2-regex-pattern-set";
+import { Wafv2RuleGroup } from "./.gen/providers/aws/wafv2-rule-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const test = new Wafv2IpSet(this, "test", {
+      addresses: ["1.1.1.1/32", "2.2.2.2/32"],
+      ipAddressVersion: "IPV4",
+      name: "test",
+      scope: "REGIONAL",
+    });
+    const awsWafv2RegexPatternSetTest = new Wafv2RegexPatternSet(
+      this,
+      "test_1",
+      {
+        name: "test",
+        regularExpression: [
+          {
+            regexString: "one",
+          },
+        ],
+        scope: "REGIONAL",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsWafv2RegexPatternSetTest.overrideLogicalId("test");
+    new Wafv2RuleGroup(this, "example", {
+      capacity: 500,
+      captcha_config: [
+        {
+          immunity_time_property: [
+            {
+              immunity_time: 120,
+            },
+          ],
+        },
+      ],
+      description: "An rule group containing all statements",
+      name: "complex-example",
+      rule: [
+        {
+          action: {
+            block: {},
+          },
+          name: "rule-1",
+          priority: 1,
+          statement: {
+            notStatement: {
+              statement: [
+                {
+                  andStatement: {
+                    statement: [
+                      {
+                        geoMatchStatement: {
+                          countryCodes: ["US"],
+                        },
+                      },
+                      {
+                        byteMatchStatement: {
+                          fieldToMatch: {
+                            allQueryArguments: {},
+                          },
+                          positionalConstraint: "CONTAINS",
+                          searchString: "word",
+                          textTransformation: [
+                            {
+                              priority: 5,
+                              type: "CMD_LINE",
+                            },
+                            {
+                              priority: 2,
+                              type: "LOWERCASE",
+                            },
+                          ],
+                        },
+                      },
+                    ],
+                  },
+                },
+              ],
+            },
+          },
+          visibilityConfig: {
+            cloudwatchMetricsEnabled: false,
+            metricName: "rule-1",
+            sampledRequestsEnabled: false,
+          },
+        },
+        {
+          action: {
+            count: {},
+          },
+          captchaConfig: {
+            immunityTimeProperty: {
+              immunityTime: 240,
+            },
+          },
+          name: "rule-2",
+          priority: 2,
+          statement: {
+            orStatement: {
+              statement: [
+                {
+                  regexMatchStatement: {
+                    fieldToMatch: {
+                      singleHeader: {
+                        name: "user-agent",
+                      },
+                    },
+                    regexString: "[a-z]([a-z0-9_-]*[a-z0-9])?",
+                    textTransformation: [
+                      {
+                        priority: 6,
+                        type: "NONE",
+                      },
+                    ],
+                  },
+                },
+                {
+                  sqliMatchStatement: {
+                    fieldToMatch: {
+                      body: {},
+                    },
+                    textTransformation: [
+                      {
+                        priority: 5,
+                        type: "URL_DECODE",
+                      },
+                      {
+                        priority: 4,
+                        type: "HTML_ENTITY_DECODE",
+                      },
+                      {
+                        priority: 3,
+                        type: "COMPRESS_WHITE_SPACE",
+                      },
+                    ],
+                  },
+                },
+                {
+                  xssMatchStatement: {
+                    fieldToMatch: {
+                      method: {},
+                    },
+                    textTransformation: [
+                      {
+                        priority: 2,
+                        type: "NONE",
+                      },
+                    ],
+                  },
+                },
+              ],
+            },
+          },
+          visibilityConfig: {
+            cloudwatchMetricsEnabled: false,
+            metricName: "rule-2",
+            sampledRequestsEnabled: false,
+          },
+        },
+        {
+          action: {
+            block: {},
+          },
+          name: "rule-3",
+          priority: 3,
+          statement: {
+            sizeConstraintStatement: {
+              comparisonOperator: "GT",
+              fieldToMatch: {
+                singleQueryArgument: {
+                  name: "username",
+                },
+              },
+              size: 100,
+              textTransformation: [
+                {
+                  priority: 5,
+                  type: "NONE",
+                },
+              ],
+            },
+          },
+          visibilityConfig: {
+            cloudwatchMetricsEnabled: false,
+            metricName: "rule-3",
+            sampledRequestsEnabled: false,
+          },
+        },
+        {
+          action: {
+            block: {},
+          },
+          name: "rule-4",
+          priority: 4,
+          statement: {
+            orStatement: {
+              statement: [
+                {
+                  ipSetReferenceStatement: {
+                    arn: test.arn,
+                  },
+                },
+                {
+                  regexPatternSetReferenceStatement: {
+                    arn: Token.asString(awsWafv2RegexPatternSetTest.arn),
+                    fieldToMatch: {
+                      singleHeader: {
+                        name: "referer",
+                      },
+                    },
+                    textTransformation: [
+                      {
+                        priority: 2,
+                        type: "NONE",
+                      },
+                    ],
+                  },
+                },
+              ],
+            },
+          },
+          visibilityConfig: {
+            cloudwatchMetricsEnabled: false,
+            metricName: "rule-4",
+            sampledRequestsEnabled: false,
+          },
+        },
+      ],
+      scope: "REGIONAL",
+      tags: {
+        Code: "123456",
+        Name: "example-and-statement",
+      },
+      visibilityConfig: {
+        cloudwatchMetricsEnabled: false,
+        metricName: "friendly-metric-name",
+        sampledRequestsEnabled: false,
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `capacity` - (Required, Forces new resource) The web ACL capacity units (WCUs) required for this rule group. See [here](https://docs.aws.amazon.com/waf/latest/APIReference/API_CreateRuleGroup.html#API_CreateRuleGroup_RequestSyntax) for general information and [here](https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-statements-list.html) for capacity specific information.
+* `customResponseBody` - (Optional) Defines custom response bodies that can be referenced by `customResponse` actions. See [Custom Response Body](#custom-response-body) below for details.
+* `description` - (Optional) A friendly description of the rule group.
+* `name` - (Required, Forces new resource) A friendly name of the rule group.
+* `rule` - (Optional) The rule blocks used to identify the web requests that you want to `allow`, `block`, or `count`. See [Rules](#rules) below for details.
+* `scope` - (Required, Forces new resource) Specifies whether this is for an AWS CloudFront distribution or for a regional application. Valid values are `cloudfront` or `regional`. To work with CloudFront, you must also specify the region `usEast1` (N. Virginia) on the AWS provider.
+* `tags` - (Optional) An array of key:value pairs to associate with the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `visibilityConfig` - (Required) Defines and enables Amazon CloudWatch metrics and web request sample collection. See [Visibility Configuration](#visibility-configuration) below for details.
+
+### Custom Response Body
+
+Each `customResponseBody` block supports the following arguments:
+
+* `key` - (Required) A unique key identifying the custom response body. This is referenced by the `customResponseBodyKey` argument in the [Custom Response](#custom-response) block.
+* `content` - (Required) The payload of the custom response.
+* `contentType` - (Required) The type of content in the payload that you are defining in the `content` argument. Valid values are `textPlain`, `textHtml`, or `applicationJson`.
+
+### Rules
+
+Each `rule` supports the following arguments:
+
+* `action` - (Required) The action that AWS WAF should take on a web request when it matches the rule's statement. Settings at the `awsWafv2WebAcl` level can override the rule action setting. See [Action](#action) below for details.
+* `captchaConfig` - (Optional) Specifies how AWS WAF should handle CAPTCHA evaluations. See [Captcha Configuration](#captcha-configuration) below for details.
+* `name` - (Required, Forces new resource) A friendly name of the rule.
+* `priority` - (Required) If you define more than one Rule in a WebACL, AWS WAF evaluates each request against the `rules` in order based on the value of `priority`. AWS WAF processes rules with lower priority first.
+* `ruleLabel` - (Optional) Labels to apply to web requests that match the rule match statement. See [Rule Label](#rule-label) below for details.
+* `statement` - (Required) The AWS WAF processing statement for the rule, for example `byteMatchStatement` or `geoMatchStatement`. See [Statement](#statement) below for details.
+* `visibilityConfig` - (Required) Defines and enables Amazon CloudWatch metrics and web request sample collection. See [Visibility Configuration](#visibility-configuration) below for details.
+
+### Action
+
+The `action` block supports the following arguments:
+
+~> **NOTE:** One of `allow`, `block`, or `count`, is required when specifying an `action`.
+
+* `allow` - (Optional) Instructs AWS WAF to allow the web request. See [Allow](#action) below for details.
+* `block` - (Optional) Instructs AWS WAF to block the web request. See [Block](#block) below for details.
+* `captcha` - (Optional) Instructs AWS WAF to run a `captcha` check against the web request. See [Captcha](#captcha) below for details.
+* `challenge` - (Optional) Instructs AWS WAF to run a check against the request to verify that the request is coming from a legitimate client session. See [Challenge](#challenge) below for details.
+* `count` - (Optional) Instructs AWS WAF to count the web request and allow it. See [Count](#count) below for details.
+
+### Allow
+
+The `allow` block supports the following arguments:
+
+* `customRequestHandling` - (Optional) Defines custom handling for the web request. See [Custom Request Handling](#custom-request-handling) below for details.
+
+### Block
+
+The `block` block supports the following arguments:
+
+* `customResponse` - (Optional) Defines a custom response for the web request. See [Custom Response](#custom-response) below for details.
+
+### Captcha
+
+The `captcha` block supports the following arguments:
+
+* `customRequestHandling` - (Optional) Defines custom handling for the web request. See [Custom Request Handling](#custom-request-handling) below for details.
+
+#### Challenge
+
+The `challenge` block supports the following arguments:
+
+* `customRequestHandling` - (Optional) Defines custom handling for the web request. See [Custom Request Handling](#custom-request-handling) below for details.
+
+### Count
+
+The `count` block supports the following arguments:
+
+* `customRequestHandling` - (Optional) Defines custom handling for the web request. See [Custom Request Handling](#custom-request-handling) below for details.
+
+### Custom Request Handling
+
+The `customRequestHandling` block supports the following arguments:
+
+* `insertHeader` - (Required) The `insertHeader` blocks used to define HTTP headers added to the request. See [Custom HTTP Header](#custom-http-header) below for details.
+
+### Custom Response
+
+The `customResponse` block supports the following arguments:
+
+* `customResponseBodyKey` - (Optional) References the response body that you want AWS WAF to return to the web request client. This must reference a `key` defined in a `customResponseBody` block of this resource.
+* `responseCode` - (Required) The HTTP status code to return to the client.
+* `responseHeader` - (Optional) The `responseHeader` blocks used to define the HTTP response headers added to the response. See [Custom HTTP Header](#custom-http-header) below for details.
+
+### Custom HTTP Header
+
+Each block supports the following arguments. Duplicate header names are not allowed:
+
+* `name` - The name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `xAmznWaf`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `xAmznWafSample`.
+* `value` - The value of the custom header.
+
+### Rule Label
+
+Each block supports the following arguments:
+
+* `name` - The label string.
+
+### Statement
+
+The processing guidance for a Rule, used by AWS WAF to determine whether a web request matches the rule. See the [documentation](https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-statements-list.html) for more information.
+
+-> **NOTE:** Although the `statement` block is recursive, currently only 3 levels are supported.
+
+The `statement` block supports the following arguments:
+
+* `andStatement` - (Optional) A logical rule statement used to combine other rule statements with AND logic. See [AND Statement](#and-statement) below for details.
+* `byteMatchStatement` - (Optional) A rule statement that defines a string match search for AWS WAF to apply to web requests. See [Byte Match Statement](#byte-match-statement) below for details.
+* `geoMatchStatement` - (Optional) A rule statement used to identify web requests based on country of origin. See [GEO Match Statement](#geo-match-statement) below for details.
+* `labelMatchStatement` - (Optional) A rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See [Label Match Statement](#label-match-statement) below for details.
+* `ipSetReferenceStatement` - (Optional) A rule statement used to detect web requests coming from particular IP addresses or address ranges. See [IP Set Reference Statement](#ip-set-reference-statement) below for details.
+* `notStatement` - (Optional) A logical rule statement used to negate the results of another rule statement. See [NOT Statement](#not-statement) below for details.
+* `orStatement` - (Optional) A logical rule statement used to combine other rule statements with OR logic. See [OR Statement](#or-statement) below for details.
+* `rateBasedStatement` - (Optional) A rate-based rule tracks the rate of requests for each originating `IP address`, and triggers the rule action when the rate exceeds a limit that you specify on the number of requests in any `5Minute` time span. This statement can not be nested. See [Rate Based Statement](#rate-based-statement) below for details.
+* `regexMatchStatement` - (Optional) A rule statement used to search web request components for a match against a single regular expression. See [Regex Match Statement](#regex-match-statement) below for details.
+* `regexPatternSetReferenceStatement` - (Optional) A rule statement used to search web request components for matches with regular expressions. See [Regex Pattern Set Reference Statement](#regex-pattern-set-reference-statement) below for details.
+* `sizeConstraintStatement` - (Optional) A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See [Size Constraint Statement](#size-constraint-statement) below for more details.
+* `sqliMatchStatement` - (Optional) An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See [SQL Injection Match Statement](#sql-injection-match-statement) below for details.
+* `xssMatchStatement` - (Optional) A rule statement that defines a cross-site scripting (XSS) match search for AWS WAF to apply to web requests. See [XSS Match Statement](#xss-match-statement) below for details.
+
+### AND Statement
+
+A logical rule statement used to combine other rule statements with `and` logic. You provide more than one `statement` within the `andStatement`.
+
+The `andStatement` block supports the following arguments:
+
+* `statement` - (Required) The statements to combine with `and` logic. You can use any statements that can be nested. See [Statement](#statement) above for details.
+
+### Byte Match Statement
+
+The byte match statement provides the bytes to search for, the location in requests that you want AWS WAF to search, and other settings. The bytes to search for are typically a string that corresponds with ASCII characters.
+
+The `byteMatchStatement` block supports the following arguments:
+
+* `fieldToMatch` - (Required) The part of a web request that you want AWS WAF to inspect. See [Field to Match](#field-to-match) below for details.
+* `positionalConstraint` - (Required) The area within the portion of a web request that you want AWS WAF to search for `searchString`. Valid values include the following: `exactly`, `startsWith`, `endsWith`, `contains`, `containsWord`. See the AWS [documentation](https://docs.aws.amazon.com/waf/latest/APIReference/API_ByteMatchStatement.html) for more information.
+* `searchString` - (Required) A string value that you want AWS WAF to search for. AWS WAF searches only in the part of web requests that you designate for inspection in `fieldToMatch`. The maximum length of the value is 50 bytes.
+* `textTransformation` - (Required) Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection.
+  At least one required.
+  See [Text Transformation](#text-transformation) below for details.
+
+### GEO Match Statement
+
+The `geoMatchStatement` block supports the following arguments:
+
+* `countryCodes` - (Required) An array of two-character country codes, for example, [ "US", "CN" ], from the alpha-2 country ISO codes of the `ISO 3166` international standard. See the [documentation](https://docs.aws.amazon.com/waf/latest/APIReference/API_GeoMatchStatement.html) for valid values.
+* `forwardedIpConfig` - (Optional) The configuration for inspecting IP addresses in an HTTP header that you specify, instead of using the IP address that's reported by the web request origin. See [Forwarded IP Config](#forwarded-ip-config) below for details.
+
+### Label Match Statement
+
+The `labelMatchStatement` block supports the following arguments:
+
+* `scope` - (Required) Specify whether you want to match using the label name or just the namespace. Valid values are `label` or `namespace`.
+* `key` - (Required) The string to match against.
+
+### IP Set Reference Statement
+
+A rule statement used to detect web requests coming from particular IP addresses or address ranges. To use this, create an `awsWafv2IpSet` that specifies the addresses you want to detect, then use the `arn` of that set in this statement.
+
+The `ipSetReferenceStatement` block supports the following arguments:
+
+* `arn` - (Required) The Amazon Resource Name (ARN) of the IP Set that this statement references.
+* `ipSetForwardedIpConfig` - (Optional) The configuration for inspecting IP addresses in an HTTP header that you specify, instead of using the IP address that's reported by the web request origin. See [IPSet Forwarded IP Config](#ipset-forwarded-ip-config) below for more details.
+
+### NOT Statement
+
+A logical rule statement used to negate the results of another rule statement. You provide one `statement` within the `notStatement`.
+
+The `notStatement` block supports the following arguments:
+
+* `statement` - (Required) The statement to negate. You can use any statement that can be nested. See [Statement](#statement) above for details.
+
+### OR Statement
+
+A logical rule statement used to combine other rule statements with `or` logic. You provide more than one `statement` within the `orStatement`.
+
+The `orStatement` block supports the following arguments:
+
+* `statement` - (Required) The statements to combine with `or` logic. You can use any statements that can be nested. See [Statement](#statement) above for details.
+
+### Rate Based Statement
+
+A rate-based rule tracks the rate of requests for each originating IP address, and triggers the rule action when the rate exceeds a limit that you specify on the number of requests in any 5-minute time span. You can use this to put a temporary block on requests from an IP address that is sending excessive requests. See the [documentation](https://docs.aws.amazon.com/waf/latest/APIReference/API_RateBasedStatement.html) for more information.
+
+You can't nest a `rateBasedStatement`, for example for use inside a `notStatement` or `orStatement`. It can only be referenced as a `topLevel` statement within a `rule`.
+
+The `rateBasedStatement` block supports the following arguments:
+
+* `aggregateKeyType` - (Optional) Setting that indicates how to aggregate the request counts. Valid values include: `constant`, `customKeys`, `forwardedIp` or `ip`. Default: `ip`.
+* `customKey` - (Optional) Aggregate the request counts using one or more web request components as the aggregate keys. See [`customKey`](#custom_key-block) below for details.
+* `forwardedIpConfig` - (Optional) The configuration for inspecting IP addresses in an HTTP header that you specify, instead of using the IP address that's reported by the web request origin. If `aggregateKeyType` is set to `forwardedIp`, this block is required. See [Forwarded IP Config](#forwarded-ip-config) below for details.
+* `limit` - (Required) The limit on requests per 5-minute period for a single originating IP address.
+* `scopeDownStatement` - (Optional) An optional nested statement that narrows the scope of the rate-based statement to matching web requests. This can be any nestable statement, and you can nest statements at any level below this scope-down statement. See [Statement](#statement) above for details. If `aggregateKeyType` is set to `constant`, this block is required.
+
+### Regex Match Statement
+
+A rule statement used to search web request components for a match against a single regular expression.
+
+The `regexMatchStatement` block supports the following arguments:
+
+* `regexString` - (Required) The string representing the regular expression. Minimum of `1` and maximum of `512` characters.
+* `fieldToMatch` - (Required) The part of a web request that you want AWS WAF to inspect. See [Field to Match](#field-to-match) below for details.
+* `textTransformation` - (Required) Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection.
+  At least one required.
+  See [Text Transformation](#text-transformation) below for details.
+
+### Regex Pattern Set Reference Statement
+
+A rule statement used to search web request components for matches with regular expressions. To use this, create a `awsWafv2RegexPatternSet` that specifies the expressions that you want to detect, then use the `arn` of that set in this statement. A web request matches the pattern set rule statement if the request component matches any of the patterns in the set.
+
+The `regexPatternSetReferenceStatement` block supports the following arguments:
+
+* `arn` - (Required) The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
+* `fieldToMatch` - (Required) The part of a web request that you want AWS WAF to inspect. See [Field to Match](#field-to-match) below for details.
+* `textTransformation` - (Required) Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection.
+  At least one required.
+  See [Text Transformation](#text-transformation) below for details.
+
+### Size Constraint Statement
+
+A rule statement that uses a comparison operator to compare a number of bytes against the size of a request component. AWS WAFv2 inspects up to the first 8192 bytes (8 KB) of a request body, and when inspecting the request URI Path, the slash `/` in
+the URI counts as one character.
+
+The `sizeConstraintStatement` block supports the following arguments:
+
+* `comparisonOperator` - (Required) The operator to use to compare the request part to the size setting. Valid values include: `eq`, `ne`, `le`, `lt`, `ge`, or `gt`.
+* `fieldToMatch` - (Optional) The part of a web request that you want AWS WAF to inspect. See [Field to Match](#field-to-match) below for details.
+* `size` - (Required) The size, in bytes, to compare to the request part, after any transformations. Valid values are integers between 0 and 21474836480, inclusive.
+* `textTransformation` - (Required) Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection.
+  At least one required.
+  See [Text Transformation](#text-transformation) below for details.
+
+### SQL Injection Match Statement
+
+An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. Later in the process, when you create a web ACL, you specify whether to allow or block requests that appear to contain malicious SQL code.
+
+The `sqliMatchStatement` block supports the following arguments:
+
+* `fieldToMatch` - (Required) The part of a web request that you want AWS WAF to inspect. See [Field to Match](#field-to-match) below for details.
+* `textTransformation` - (Required) Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection.
+  At least one required.
+  See [Text Transformation](#text-transformation) below for details.
+
+### XSS Match Statement
+
+The XSS match statement provides the location in requests that you want AWS WAF to search and text transformations to use on the search area before AWS WAF searches for character sequences that are likely to be malicious strings.
+
+The `xssMatchStatement` block supports the following arguments:
+
+* `fieldToMatch` - (Required) The part of a web request that you want AWS WAF to inspect. See [Field to Match](#field-to-match) below for details.
+* `textTransformation` - (Required) Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection.
+  At least one required.
+  See [Text Transformation](#text-transformation) below for details.
+
+### Field to Match
+
+The part of a web request that you want AWS WAF to inspect. Include the single `fieldToMatch` type that you want to inspect, with additional specifications as needed, according to the type. You specify a single request component in `fieldToMatch` for each rule statement that requires it. To inspect more than one component of a web request, create a separate rule statement for each component. See the [documentation](https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-statement-fields.html#waf-rule-statement-request-component) for more details.
+
+The `fieldToMatch` block supports the following arguments:
+
+~> **NOTE:** Only one of `allQueryArguments`, `body`, `cookies`, `headers`, `jsonBody`, `method`, `queryString`, `singleHeader`, `singleQueryArgument`, or `uriPath` can be specified.
+An empty configuration block `{}` should be used when specifying `allQueryArguments`, `body`, `method`, or `queryString` attributes.
+
+* `allQueryArguments` - (Optional) Inspect all query arguments.
+* `body` - (Optional) Inspect the request body, which immediately follows the request headers.
+* `cookies` - (Optional) Inspect the cookies in the web request. See [Cookies](#cookies) below for details.
+* `headers` - (Optional) Inspect the request headers. See [Headers](#headers) below for details.
+* `jsonBody` - (Optional) Inspect the request body as JSON. See [JSON Body](#json-body) for details.
+* `method` - (Optional) Inspect the HTTP method. The method indicates the type of operation that the request is asking the origin to perform.
+* `queryString` - (Optional) Inspect the query string. This is the part of a URL that appears after a `?` character, if any.
+* `singleHeader` - (Optional) Inspect a single header. See [Single Header](#single-header) below for details.
+* `singleQueryArgument` - (Optional) Inspect a single query argument. See [Single Query Argument](#single-query-argument) below for details.
+* `uriPath` - (Optional) Inspect the request URI path. This is the part of a web request that identifies a resource, for example, `/images/dailyAdJpg`.
+
+### Forwarded IP Config
+
+The configuration for inspecting IP addresses in an HTTP header that you specify, instead of using the IP address that's reported by the web request origin. Commonly, this is the X-Forwarded-For (XFF) header, but you can specify
+any header name. If the specified header isn't present in the request, AWS WAFv2 doesn't apply the rule to the web request at all.
+AWS WAFv2 only evaluates the first IP address found in the specified HTTP header.
+
+The `forwardedIpConfig` block supports the following arguments:
+
+* `fallbackBehavior` - (Required) - The match status to assign to the web request if the request doesn't have a valid IP address in the specified position. Valid values include: `match` or `noMatch`.
+* `headerName` - (Required) - The name of the HTTP header to use for the IP address.
+
+### IPSet Forwarded IP Config
+
+The configuration for inspecting IP addresses in an HTTP header that you specify, instead of using the IP address that's reported by the web request origin. Commonly, this is the X-Forwarded-For (XFF) header, but you can specify any header name.
+
+The `ipSetForwardedIpConfig` block supports the following arguments:
+
+* `fallbackBehavior` - (Required) - The match status to assign to the web request if the request doesn't have a valid IP address in the specified position. Valid values include: `match` or `noMatch`.
+* `headerName` - (Required) - The name of the HTTP header to use for the IP address.
+* `position` - (Required) - The position in the header to search for the IP address. Valid values include: `first`, `last`, or `any`. If `any` is specified and the header contains more than 10 IP addresses, AWS WAFv2 inspects the last 10.
+
+### Headers
+
+Inspect the request headers.
+
+The `headers` block supports the following arguments:
+
+* `matchPattern` - (Required) The filter to use to identify the subset of headers to inspect in a web request. The `matchPattern` block supports only one of the following arguments:
+    * `all` - An empty configuration block that is used for inspecting all headers.
+    * `includedHeaders` - An array of strings that will be used for inspecting headers that have a key that matches one of the provided values.
+    * `excludedHeaders` - An array of strings that will be used for inspecting headers that do not have a key that matches one of the provided values.
+* `matchScope` - (Required) The parts of the headers to inspect with the rule inspection criteria. If you specify `all`, AWS WAF inspects both keys and values. Valid values include the following: `all`, `key`, `value`.
+* `oversizeHandling` - (Required) Oversize handling tells AWS WAF what to do with a web request when the request component that the rule inspects is over the limits. Valid values include the following: `continue`, `match`, `noMatch`. See the AWS [documentation](https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-statement-oversize-handling.html) for more information.
+
+### JSON Body
+
+The `jsonBody` block supports the following arguments:
+
+* `invalidFallbackBehavior` - (Optional) What to do when JSON parsing fails. Defaults to evaluating up to the first parsing failure. Valid values are `evaluateAsString`, `match` and `noMatch`.
+* `matchPattern` - (Required) The patterns to look for in the JSON body. You must specify exactly one setting: either `all` or `includedPaths`. See [JsonMatchPattern](https://docs.aws.amazon.com/waf/latest/APIReference/API_JsonMatchPattern.html) for details.
+* `matchScope` - (Required) The parts of the JSON to match against using the `matchPattern`. Valid values are `all`, `key` and `value`.
+* `oversizeHandling` - (Optional) What to do if the body is larger than can be inspected. Valid values are `continue` (default), `match` and `noMatch`.
+
+### Single Header
+
+Inspect a single header. Provide the name of the header to inspect, for example, `userAgent` or `referer` (provided as lowercase strings).
+
+The `singleHeader` block supports the following arguments:
+
+* `name` - (Optional) The name of the query header to inspect. This setting must be provided as lower case characters.
+
+### Single Query Argument
+
+Inspect a single query argument. Provide the name of the query argument to inspect, such as `userName` or `salesRegion` (provided as lowercase strings).
+
+The `singleQueryArgument` block supports the following arguments:
+
+* `name` - (Optional) The name of the query header to inspect. This setting must be provided as lower case characters.
+
+### Cookies
+
+Inspect the cookies in the web request. You can specify the parts of the cookies to inspect and you can narrow the set of cookies to inspect by including or excluding specific keys.
+This is used to indicate the web request component to inspect, in the [FieldToMatch](https://docs.aws.amazon.com/waf/latest/APIReference/API_FieldToMatch.html) specification.
+
+The `cookies` block supports the following arguments:
+
+* `matchPattern` - (Required) The filter to use to identify the subset of cookies to inspect in a web request. You must specify exactly one setting: either `all`, `includedCookies` or `excludedCookies`. More details: [CookieMatchPattern](https://docs.aws.amazon.com/waf/latest/APIReference/API_CookieMatchPattern.html)
+* `matchScope` - (Required) The parts of the cookies to inspect with the rule inspection criteria. If you specify All, AWS WAF inspects both keys and values. Valid values: `all`, `key`, `value`
+* `oversizeHandling` - (Required) What AWS WAF should do if the cookies of the request are larger than AWS WAF can inspect. AWS WAF does not support inspecting the entire contents of request cookies when they exceed 8 KB (8192 bytes) or 200 total cookies. The underlying host service forwards a maximum of 200 cookies and at most 8 KB of cookie contents to AWS WAF. Valid values: `continue`, `match`, `noMatch`
+
+### Text Transformation
+
+The `textTransformation` block supports the following arguments:
+
+* `priority` - (Required) The relative processing order for multiple transformations that are defined for a rule statement. AWS WAF processes all transformations, from lowest priority to highest, before inspecting the transformed content.
+* `type` - (Required) The transformation to apply, please refer to the Text Transformation [documentation](https://docs.aws.amazon.com/waf/latest/APIReference/API_TextTransformation.html) for more details.
+
+### Visibility Configuration
+
+The `visibilityConfig` block supports the following arguments:
+
+* `cloudwatchMetricsEnabled` - (Required) A boolean indicating whether the associated resource sends metrics to CloudWatch. For the list of available metrics, see [AWS WAF Metrics](https://docs.aws.amazon.com/waf/latest/developerguide/monitoring-cloudwatch.html#waf-metrics).
+* `metricName` - (Required, Forces new resource) A friendly name of the CloudWatch metric. The name can contain only alphanumeric characters (A-Z, a-z, 0-9) hyphen(-) and underscore (_), with length from one to 128 characters. It can't contain whitespace or metric names reserved for AWS WAF, for example `all` and `defaultAction`.
+* `sampledRequestsEnabled` - (Required) A boolean indicating whether AWS WAF should store a sampling of the web requests that match the rules. You can view the sampled requests through the AWS WAF console.
+
+### Captcha Configuration
+
+The `captchaConfig` block supports the following arguments:
+
+* `immunityTimeProperty` - (Optional) Defines custom immunity time. See [Immunity Time Property](#immunity-time-property) below for details.
+
+### Immunity Time Property
+
+The `immunityTimeProperty` block supports the following arguments:
+
+* `immunityTime` - (Optional) The amount of time, in seconds, that a CAPTCHA or challenge timestamp is considered valid by AWS WAF. The default setting is 300.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the WAF rule group.
+* `arn` - The ARN of the WAF rule group.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+### `customKey` Block
+
+Aggregate the request counts using one or more web request components as the aggregate keys. With this option, you must specify the aggregate keys in the `customKeys` block. To aggregate on only the IP address or only the forwarded IP address, don't use custom keys. Instead, set the `aggregateKeyType` to `ip` or `forwardedIp`.
+
+The `customKey` block supports the following arguments:
+
+* `cookie` - (Optional) Use the value of a cookie in the request as an aggregate key. See [RateLimit `cookie`](#ratelimit-cookie-block) below for details.
+* `forwardedIp` - (Optional) Use the first IP address in an HTTP header as an aggregate key. See [`forwardedIp`](#ratelimit-forwarded_ip-block) below for details.
+* `httpMethod` - (Optional) Use the request's HTTP method as an aggregate key. See [RateLimit `httpMethod`](#ratelimit-http_method-block) below for details.
+* `header` - (Optional) Use the value of a header in the request as an aggregate key. See [RateLimit `header`](#ratelimit-header-block) below for details.
+* `ip` - (Optional) Use the request's originating IP address as an aggregate key. See [`RateLimit ip`](#ratelimit-ip-block) below for details.
+* `labelNamespace` - (Optional) Use the specified label namespace as an aggregate key. See [RateLimit `labelNamespace`](#ratelimit-label_namespace-block) below for details.
+* `queryArgument` - (Optional) Use the specified query argument as an aggregate key. See [RateLimit `queryArgument`](#ratelimit-query_argument-block) below for details.
+* `queryString` - (Optional) Use the request's query string as an aggregate key. See [RateLimit `queryString`](#ratelimit-query_string-block) below for details.
+* `uriPath` - (Optional) Use the request's URI path as an aggregate key. See [RateLimit `uriPath`](#ratelimit-uri_path-block) below for details.
+
+### RateLimit `cookie` Block
+
+Use the value of a cookie in the request as an aggregate key. Each distinct value in the cookie contributes to the aggregation instance. If you use a single cookie as your custom key, then each value fully defines an aggregation instance.
+
+The `cookie` block supports the following arguments:
+
+* `name`: The name of the cookie to use.
+* `textTransformation`: Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection. They are used in rate-based rule statements, to transform request components before using them as custom aggregation keys. Atleast one transformation is required.  See [Text Transformation](#text-transformation) above for details.
+
+### RateLimit `forwardedIp` Block
+
+Use the first IP address in an HTTP header as an aggregate key. Each distinct forwarded IP address contributes to the aggregation instance. When you specify an IP or forwarded IP in the custom key settings, you must also specify at least one other key to use. You can aggregate on only the forwarded IP address by specifying `forwardedIp` in your rate-based statement's `aggregateKeyType`. With this option, you must specify the header to use in the rate-based rule's [Forwarded IP Config](#forwarded-ip-config) block.
+
+The `forwardedIp` block is configured as an empty block `{}`.
+
+### RateLimit `httpMethod` Block
+
+Use the request's HTTP method as an aggregate key. Each distinct HTTP method contributes to the aggregation instance. If you use just the HTTP method as your custom key, then each method fully defines an aggregation instance.
+
+The `httpMethod` block is configured as an empty block `{}`.
+
+### RateLimit `header` Block
+
+Use the value of a header in the request as an aggregate key. Each distinct value in the header contributes to the aggregation instance. If you use a single header as your custom key, then each value fully defines an aggregation instance.
+
+The `header` block supports the following arguments:
+
+* `name`: The name of the header to use.
+* `textTransformation`: Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection. They are used in rate-based rule statements, to transform request components before using them as custom aggregation keys. Atleast one transformation is required.  See [Text Transformation](#text-transformation) above for details.
+
+### RateLimit `ip` Block
+
+Use the request's originating IP address as an aggregate key. Each distinct IP address contributes to the aggregation instance. When you specify an IP or forwarded IP in the custom key settings, you must also specify at least one other key to use. You can aggregate on only the IP address by specifying `ip` in your rate-based statement's `aggregateKeyType`.
+
+The `ip` block is configured as an empty block `{}`.
+
+### RateLimit `labelNamespace` Block
+
+Use the specified label namespace as an aggregate key. Each distinct fully qualified label name that has the specified label namespace contributes to the aggregation instance. If you use just one label namespace as your custom key, then each label name fully defines an aggregation instance. This uses only labels that have been added to the request by rules that are evaluated before this rate-based rule in the web ACL. For information about label namespaces and names, see Label syntax and naming requirements (https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-label-requirements.html) in the WAF Developer Guide.
+
+The `labelNamespace` block supports the following arguments:
+
+* `namespace`: The namespace to use for aggregation
+
+### RateLimit `queryArgument` Block
+
+Use the specified query argument as an aggregate key. Each distinct value for the named query argument contributes to the aggregation instance. If you use a single query argument as your custom key, then each value fully defines an aggregation instance.
+
+The `queryArgument` block supports the following arguments:
+
+* `name`: The name of the query argument to use.
+* `textTransformation`: Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection. They are used in rate-based rule statements, to transform request components before using them as custom aggregation keys. Atleast one transformation is required. See [Text Transformation](#text-transformation) above for details.
+
+### RateLimit `queryString` Block
+
+Use the request's query string as an aggregate key. Each distinct string contributes to the aggregation instance. If you use just the query string as your custom key, then each string fully defines an aggregation instance.
+
+The `queryString` block supports the following arguments:
+
+* `textTransformation`: Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection. They are used in rate-based rule statements, to transform request components before using them as custom aggregation keys. Atleast one transformation is required. See [Text Transformation](#text-transformation) above for details.
+
+### RateLimit `uriPath` Block
+
+Use the request's URI path as an aggregate key. Each distinct URI path contributes to the aggregation instance. If you use just the URI path as your custom key, then each URI path fully defines an aggregation instance.
+
+The `uriPath` block supports the following arguments:
+
+* `textTransformation`: Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection. They are used in rate-based rule statements, to transform request components before using them as custom aggregation keys. Atleast one transformation is required. See [Text Transformation](#text-transformation) above for details.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WAFv2 Rule Group using `id/name/scope`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import WAFv2 Rule Group using `id/name/scope`. For example:
+
+```console
+% terraform import aws_wafv2_rule_group.example a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc/example/REGIONAL
+```
+
+<!-- cache-key: cdktf-0.18.0 input-d2bb4de24461011d76bbc3333d69c2766c8e9c558c45b18a7db45691e9d58825 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/wafv2_web_acl.html.markdown b/website/docs/cdktf/typescript/r/wafv2_web_acl.html.markdown
new file mode 100644
index 00000000000..65cb4c51d3c
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/wafv2_web_acl.html.markdown
@@ -0,0 +1,1089 @@
+---
+subcategory: "WAF"
+layout: "aws"
+page_title: "AWS: aws_wafv2_web_acl"
+description: |-
+  Creates a WAFv2 Web ACL resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_wafv2_web_acl
+
+Creates a WAFv2 Web ACL resource.
+
+~> **Note** In `fieldToMatch` blocks, _e.g._, in `byteMatchStatement`, the `body` block includes an optional argument `oversizeHandling`. AWS indicates this argument will be required starting February 2023. To avoid configurations breaking when that change happens, treat the `oversizeHandling` argument as **required** as soon as possible.
+
+## Example Usage
+
+This resource is based on `awsWafv2RuleGroup`, check the documentation of the `awsWafv2RuleGroup` resource to see examples of the various available statements.
+
+### Managed Rule
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Wafv2WebAcl } from "./.gen/providers/aws/wafv2-web-acl";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Wafv2WebAcl(this, "example", {
+      defaultAction: {
+        allow: {},
+      },
+      description: "Example of a managed rule.",
+      name: "managed-rule-example",
+      rule: [
+        {
+          name: "rule-1",
+          overrideAction: {
+            count: {},
+          },
+          priority: 1,
+          statement: {
+            managedRuleGroupStatement: {
+              name: "AWSManagedRulesCommonRuleSet",
+              ruleActionOverride: [
+                {
+                  actionToUse: {
+                    count: {},
+                  },
+                  name: "SizeRestrictions_QUERYSTRING",
+                },
+                {
+                  actionToUse: {
+                    count: {},
+                  },
+                  name: "NoUserAgent_HEADER",
+                },
+              ],
+              scopeDownStatement: {
+                geoMatchStatement: {
+                  countryCodes: ["US", "NL"],
+                },
+              },
+              vendorName: "AWS",
+            },
+          },
+          token_domains: ["mywebsite.com", "myotherwebsite.com"],
+          visibilityConfig: {
+            cloudwatchMetricsEnabled: false,
+            metricName: "friendly-rule-metric-name",
+            sampledRequestsEnabled: false,
+          },
+        },
+      ],
+      scope: "REGIONAL",
+      tags: {
+        Tag1: "Value1",
+        Tag2: "Value2",
+      },
+      visibilityConfig: {
+        cloudwatchMetricsEnabled: false,
+        metricName: "friendly-metric-name",
+        sampledRequestsEnabled: false,
+      },
+    });
+  }
+}
+
+```
+
+### Account Creation Fraud Prevention
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Wafv2WebAcl } from "./.gen/providers/aws/wafv2-web-acl";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Wafv2WebAcl(this, "acfp-example", {
+      defaultAction: {
+        allow: {},
+      },
+      description: "Example of a managed ACFP rule.",
+      name: "managed-acfp-example",
+      rule: [
+        {
+          name: "acfp-rule-1",
+          overrideAction: {
+            count: {},
+          },
+          priority: 1,
+          statement: {
+            managedRuleGroupStatement: {
+              managedRuleGroupConfigs: [
+                {
+                  awsManagedRulesAcfpRuleSet: {
+                    creationPath: "/signin",
+                    registrationPagePath: "/register",
+                    requestInspection: {
+                      emailField: {
+                        identifier: "/email",
+                      },
+                      passwordField: {
+                        identifier: "/password",
+                      },
+                      payloadType: "JSON",
+                      usernameField: {
+                        identifier: "/username",
+                      },
+                    },
+                    responseInspection: {
+                      statusCode: {
+                        failureCodes: [Token.asNumber("403")],
+                        successCodes: [Token.asNumber("200")],
+                      },
+                    },
+                  },
+                },
+              ],
+              name: "AWSManagedRulesACFPRuleSet",
+              vendorName: "AWS",
+            },
+          },
+          visibilityConfig: {
+            cloudwatchMetricsEnabled: false,
+            metricName: "friendly-rule-metric-name",
+            sampledRequestsEnabled: false,
+          },
+        },
+      ],
+      scope: "CLOUDFRONT",
+      visibilityConfig: {
+        cloudwatchMetricsEnabled: false,
+        metricName: "friendly-metric-name",
+        sampledRequestsEnabled: false,
+      },
+    });
+  }
+}
+
+```
+
+### Account Takeover Protection
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Wafv2WebAcl } from "./.gen/providers/aws/wafv2-web-acl";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Wafv2WebAcl(this, "atp-example", {
+      defaultAction: {
+        allow: {},
+      },
+      description: "Example of a managed ATP rule.",
+      name: "managed-atp-example",
+      rule: [
+        {
+          name: "atp-rule-1",
+          overrideAction: {
+            count: {},
+          },
+          priority: 1,
+          statement: {
+            managedRuleGroupStatement: {
+              managedRuleGroupConfigs: [
+                {
+                  awsManagedRulesAtpRuleSet: {
+                    loginPath: "/api/1/signin",
+                    requestInspection: {
+                      passwordField: {
+                        identifier: "/password",
+                      },
+                      payloadType: "JSON",
+                      usernameField: {
+                        identifier: "/email",
+                      },
+                    },
+                    responseInspection: {
+                      statusCode: {
+                        failureCodes: [Token.asNumber("403")],
+                        successCodes: [Token.asNumber("200")],
+                      },
+                    },
+                  },
+                },
+              ],
+              name: "AWSManagedRulesATPRuleSet",
+              vendorName: "AWS",
+            },
+          },
+          visibilityConfig: {
+            cloudwatchMetricsEnabled: false,
+            metricName: "friendly-rule-metric-name",
+            sampledRequestsEnabled: false,
+          },
+        },
+      ],
+      scope: "CLOUDFRONT",
+      visibilityConfig: {
+        cloudwatchMetricsEnabled: false,
+        metricName: "friendly-metric-name",
+        sampledRequestsEnabled: false,
+      },
+    });
+  }
+}
+
+```
+
+### Rate Based
+
+Rate-limit US and NL-based clients to 10,000 requests for every 5 minutes.
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Wafv2WebAcl } from "./.gen/providers/aws/wafv2-web-acl";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Wafv2WebAcl(this, "example", {
+      defaultAction: {
+        allow: {},
+      },
+      description: "Example of a Cloudfront rate based statement.",
+      name: "rate-based-example",
+      rule: [
+        {
+          action: {
+            block: {},
+          },
+          name: "rule-1",
+          priority: 1,
+          statement: {
+            rateBasedStatement: {
+              aggregateKeyType: "IP",
+              limit: 10000,
+              scopeDownStatement: {
+                geoMatchStatement: {
+                  countryCodes: ["US", "NL"],
+                },
+              },
+            },
+          },
+          visibilityConfig: {
+            cloudwatchMetricsEnabled: false,
+            metricName: "friendly-rule-metric-name",
+            sampledRequestsEnabled: false,
+          },
+        },
+      ],
+      scope: "CLOUDFRONT",
+      tags: {
+        Tag1: "Value1",
+        Tag2: "Value2",
+      },
+      visibilityConfig: {
+        cloudwatchMetricsEnabled: false,
+        metricName: "friendly-metric-name",
+        sampledRequestsEnabled: false,
+      },
+    });
+  }
+}
+
+```
+
+### Rule Group Reference
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Wafv2RuleGroup } from "./.gen/providers/aws/wafv2-rule-group";
+import { Wafv2WebAcl } from "./.gen/providers/aws/wafv2-web-acl";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new Wafv2RuleGroup(this, "example", {
+      capacity: 10,
+      name: "example-rule-group",
+      rule: [
+        {
+          action: {
+            count: {},
+          },
+          name: "rule-1",
+          priority: 1,
+          statement: {
+            geoMatchStatement: {
+              countryCodes: ["NL"],
+            },
+          },
+          visibilityConfig: {
+            cloudwatchMetricsEnabled: false,
+            metricName: "friendly-rule-metric-name",
+            sampledRequestsEnabled: false,
+          },
+        },
+        {
+          action: {
+            allow: {},
+          },
+          name: "rule-to-exclude-a",
+          priority: 10,
+          statement: {
+            geoMatchStatement: {
+              countryCodes: ["US"],
+            },
+          },
+          visibilityConfig: {
+            cloudwatchMetricsEnabled: false,
+            metricName: "friendly-rule-metric-name",
+            sampledRequestsEnabled: false,
+          },
+        },
+        {
+          action: {
+            allow: {},
+          },
+          name: "rule-to-exclude-b",
+          priority: 15,
+          statement: {
+            geoMatchStatement: {
+              countryCodes: ["GB"],
+            },
+          },
+          visibilityConfig: {
+            cloudwatchMetricsEnabled: false,
+            metricName: "friendly-rule-metric-name",
+            sampledRequestsEnabled: false,
+          },
+        },
+      ],
+      scope: "REGIONAL",
+      visibilityConfig: {
+        cloudwatchMetricsEnabled: false,
+        metricName: "friendly-metric-name",
+        sampledRequestsEnabled: false,
+      },
+    });
+    new Wafv2WebAcl(this, "test", {
+      defaultAction: {
+        block: {},
+      },
+      name: "rule-group-example",
+      rule: [
+        {
+          name: "rule-1",
+          overrideAction: {
+            count: {},
+          },
+          priority: 1,
+          statement: {
+            ruleGroupReferenceStatement: {
+              arn: example.arn,
+              ruleActionOverride: [
+                {
+                  actionToUse: {
+                    count: {},
+                  },
+                  name: "rule-to-exclude-b",
+                },
+                {
+                  actionToUse: {
+                    count: {},
+                  },
+                  name: "rule-to-exclude-a",
+                },
+              ],
+            },
+          },
+          visibilityConfig: {
+            cloudwatchMetricsEnabled: false,
+            metricName: "friendly-rule-metric-name",
+            sampledRequestsEnabled: false,
+          },
+        },
+      ],
+      scope: "REGIONAL",
+      tags: {
+        Tag1: "Value1",
+        Tag2: "Value2",
+      },
+      visibilityConfig: {
+        cloudwatchMetricsEnabled: false,
+        metricName: "friendly-metric-name",
+        sampledRequestsEnabled: false,
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `associationConfig` - (Optional) Specifies custom configurations for the associations between the web ACL and protected resources. See [`associationConfig`](#association_config-block) below for details.
+* `customResponseBody` - (Optional) Defines custom response bodies that can be referenced by `customResponse` actions. See [`customResponseBody`](#custom_response_body-block) below for details.
+* `defaultAction` - (Required) Action to perform if none of the `rules` contained in the WebACL match. See [`defaultAction`](#default_action-block) below for details.
+* `description` - (Optional) Friendly description of the WebACL.
+* `name` - (Required) Friendly name of the WebACL.
+* `rule` - (Optional) Rule blocks used to identify the web requests that you want to `allow`, `block`, or `count`. See [`rule`](#rule-block) below for details.
+* `scope` - (Required) Specifies whether this is for an AWS CloudFront distribution or for a regional application. Valid values are `cloudfront` or `regional`. To work with CloudFront, you must also specify the region `usEast1` (N. Virginia) on the AWS provider.
+* `tags` - (Optional) Map of key-value pairs to associate with the resource. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `tokenDomains` - (Optional) Specifies the domains that AWS WAF should accept in a web request token. This enables the use of tokens across multiple protected websites. When AWS WAF provides a token, it uses the domain of the AWS resource that the web ACL is protecting. If you don't specify a list of token domains, AWS WAF accepts tokens only for the domain of the protected resource. With a token domain list, AWS WAF accepts the resource's host domain plus all domains in the token domain list, including their prefixed subdomains.
+* `visibilityConfig` - (Required) Defines and enables Amazon CloudWatch metrics and web request sample collection. See [`visibilityConfig`](#visibility_config-block) below for details.
+
+### `associationConfig` Block
+
+The `associationConfig` block supports the following arguments:
+
+* `requestBody` - (Optional) Customizes the request body that your protected resource forward to AWS WAF for inspection. See [`requestBody`](#request_body-block) below for details.
+
+### `customResponseBody` Block
+
+Each `customResponseBody` block supports the following arguments:
+
+* `key` - (Required) Unique key identifying the custom response body. This is referenced by the `customResponseBodyKey` argument in the [`customResponse`](#custom_response-block) block.
+* `content` - (Required) Payload of the custom response.
+* `contentType` - (Required) Type of content in the payload that you are defining in the `content` argument. Valid values are `textPlain`, `textHtml`, or `applicationJson`.
+
+### `defaultAction` Block
+
+The `defaultAction` block supports the following arguments:
+
+~> **Note** One of `allow` or `block`, expressed as an empty configuration block `{}`, is required when specifying a `defaultAction`
+
+* `allow` - (Optional) Specifies that AWS WAF should allow requests by default. See [`allow`](#allow-block) below for details.
+* `block` - (Optional) Specifies that AWS WAF should block requests by default. See [`block`](#block-block) below for details.
+
+### `rule` Block
+
+~> **Note** One of `action` or `overrideAction` is required when specifying a rule
+
+Each `rule` supports the following arguments:
+
+* `action` - (Optional) Action that AWS WAF should take on a web request when it matches the rule's statement. This is used only for rules whose **statements do not reference a rule group**. See [`action`](#action-block) for details.
+* `captchaConfig` - (Optional) Specifies how AWS WAF should handle CAPTCHA evaluations. See [`captchaConfig`](#captcha_config-block) below for details.
+* `name` - (Required) Friendly name of the rule. Note that the provider assumes that rules with names matching this pattern, `^shieldMitigationRuleGroup_<accountId>_<webAclGuid>_.*`, are AWS-added for [automatic application layer DDoS mitigation activities](https://docs.aws.amazon.com/waf/latest/developerguide/ddos-automatic-app-layer-response-rg.html). Such rules will be ignored by the provider unless you explicitly include them in your configuration (for example, by using the AWS CLI to discover their properties and creating matching configuration). However, since these rules are owned and managed by AWS, you may get permission errors.
+* `overrideAction` - (Optional) Override action to apply to the rules in a rule group. Used only for rule **statements that reference a rule group**, like `ruleGroupReferenceStatement` and `managedRuleGroupStatement`. See [`overrideAction`](#override_action-block) below for details.
+* `priority` - (Required) If you define more than one Rule in a WebACL, AWS WAF evaluates each request against the `rules` in order based on the value of `priority`. AWS WAF processes rules with lower priority first.
+* `ruleLabel` - (Optional) Labels to apply to web requests that match the rule match statement. See [`ruleLabel`](#rule_label-block) below for details.
+* `statement` - (Required) The AWS WAF processing statement for the rule, for example `byteMatchStatement` or `geoMatchStatement`. See [`statement`](#statement-block) below for details.
+* `visibilityConfig` - (Required) Defines and enables Amazon CloudWatch metrics and web request sample collection. See [`visibilityConfig`](#visibility_config-block) below for details.
+
+### `action` Block
+
+The `action` block supports the following arguments:
+
+~> **Note** One of `allow`, `block`, or `count`, is required when specifying an `action`.
+
+* `allow` - (Optional) Instructs AWS WAF to allow the web request. See [`allow`](#allow-block) below for details.
+* `block` - (Optional) Instructs AWS WAF to block the web request. See [`block`](#block-block) below for details.
+* `captcha` - (Optional) Instructs AWS WAF to run a Captcha check against the web request. See [`captcha`](#captcha-block) below for details.
+* `challenge` - (Optional) Instructs AWS WAF to run a check against the request to verify that the request is coming from a legitimate client session. See [`challenge`](#challenge-block) below for details.
+* `count` - (Optional) Instructs AWS WAF to count the web request and allow it. See [`count`](#count-block) below for details.
+
+### `overrideAction` Block
+
+The `overrideAction` block supports the following arguments:
+
+~> **Note** One of `count` or `none`, expressed as an empty configuration block `{}`, is required when specifying an `overrideAction`
+
+* `count` - (Optional) Override the rule action setting to count (i.e., only count matches). Configured as an empty block `{}`.
+* `none` - (Optional) Don't override the rule action setting. Configured as an empty block `{}`.
+
+### `allow` Block
+
+The `allow` block supports the following arguments:
+
+* `customRequestHandling` - (Optional) Defines custom handling for the web request. See [`customRequestHandling`](#custom_request_handling-block) below for details.
+
+### `block` Block
+
+The `block` block supports the following arguments:
+
+* `customResponse` - (Optional) Defines a custom response for the web request. See [`customResponse`](#custom_response-block) below for details.
+
+### `captcha` Block
+
+The `captcha` block supports the following arguments:
+
+* `customRequestHandling` - (Optional) Defines custom handling for the web request. See [`customRequestHandling`](#custom_request_handling-block) below for details.
+
+### `challenge` Block
+
+The `challenge` block supports the following arguments:
+
+* `customRequestHandling` - (Optional) Defines custom handling for the web request. See [`customRequestHandling`](#custom_request_handling-block) below for details.
+
+### `count` Block
+
+The `count` block supports the following arguments:
+
+* `customRequestHandling` - (Optional) Defines custom handling for the web request. See [`customRequestHandling`](#custom_request_handling-block) below for details.
+
+### `customRequestHandling` Block
+
+The `customRequestHandling` block supports the following arguments:
+
+* `insertHeader` - (Required) The `insertHeader` blocks used to define HTTP headers added to the request. See [`insertHeader`](#insert_header-block) below for details.
+
+### `insertHeader` Block
+
+Each `insertHeader` block supports the following arguments. Duplicate header names are not allowed:
+
+* `name` - Name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `xAmznWaf`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `xAmznWafSample`.
+* `value` - Value of the custom header.
+
+### `customResponse` Block
+
+The `customResponse` block supports the following arguments:
+
+* `customResponseBodyKey` - (Optional) References the response body that you want AWS WAF to return to the web request client. This must reference a `key` defined in a `customResponseBody` block of this resource.
+* `responseCode` - (Required) The HTTP status code to return to the client.
+* `responseHeader` - (Optional) The `responseHeader` blocks used to define the HTTP response headers added to the response. See [`responseHeader`](#response_header-block) below for details.
+
+### `responseHeader` Block
+
+Each `responseHeader` block supports the following arguments. Duplicate header names are not allowed:
+
+* `name` - Name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `xAmznWaf`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `xAmznWafSample`.
+* `value` - Value of the custom header.
+
+### `ruleLabel` Block
+
+Each block supports the following arguments:
+
+* `name` - Label string.
+
+### `statement` Block
+
+The processing guidance for a Rule, used by AWS WAF to determine whether a web request matches the rule. See the [documentation](https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-statements-list.html) for more information.
+
+-> **Note** Although the `statement` block is recursive, currently only 3 levels are supported.
+
+The `statement` block supports the following arguments:
+
+* `andStatement` - (Optional) Logical rule statement used to combine other rule statements with AND logic. See [`andStatement`](#and_statement-block) below for details.
+* `byteMatchStatement` - (Optional) Rule statement that defines a string match search for AWS WAF to apply to web requests. See [`byteMatchStatement`](#byte_match_statement-block) below for details.
+* `geoMatchStatement` - (Optional) Rule statement used to identify web requests based on country of origin. See [`geoMatchStatement`](#geo_match_statement-block) below for details.
+* `ipSetReferenceStatement` - (Optional) Rule statement used to detect web requests coming from particular IP addresses or address ranges. See [`ipSetReferenceStatement`](#ip_set_reference_statement-block) below for details.
+* `labelMatchStatement` - (Optional) Rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See [`labelMatchStatement`](#label_match_statement-block) below for details.
+* `managedRuleGroupStatement` - (Optional) Rule statement used to run the rules that are defined in a managed rule group.  This statement can not be nested. See [`managedRuleGroupStatement`](#managed_rule_group_statement-block) below for details.
+* `notStatement` - (Optional) Logical rule statement used to negate the results of another rule statement. See [`notStatement`](#not_statement-block) below for details.
+* `orStatement` - (Optional) Logical rule statement used to combine other rule statements with OR logic. See [`orStatement`](#or_statement-block) below for details.
+* `rateBasedStatement` - (Optional) Rate-based rule tracks the rate of requests for each originating `IP address`, and triggers the rule action when the rate exceeds a limit that you specify on the number of requests in any `5Minute` time span. This statement can not be nested. See [`rateBasedStatement`](#rate_based_statement-block) below for details.
+* `regexMatchStatement` - (Optional) Rule statement used to search web request components for a match against a single regular expression. See [`regexMatchStatement`](#regex_match_statement-block) below for details.
+* `regexPatternSetReferenceStatement` - (Optional) Rule statement used to search web request components for matches with regular expressions. See [`regexPatternSetReferenceStatement`](#regex_pattern_set_reference_statement-block) below for details.
+* `ruleGroupReferenceStatement` - (Optional) Rule statement used to run the rules that are defined in an WAFv2 Rule Group. See [`ruleGroupReferenceStatement`](#rule_group_reference_statement-block) below for details.
+* `sizeConstraintStatement` - (Optional) Rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See [`sizeConstraintStatement`](#size_constraint_statement-block) below for more details.
+* `sqliMatchStatement` - (Optional) An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See [`sqliMatchStatement`](#sqli_match_statement-block) below for details.
+* `xssMatchStatement` - (Optional) Rule statement that defines a cross-site scripting (XSS) match search for AWS WAF to apply to web requests. See [`xssMatchStatement`](#xss_match_statement-block) below for details.
+
+### `andStatement` Block
+
+A logical rule statement used to combine other rule statements with `and` logic. You provide more than one `statement` within the `andStatement`.
+
+The `andStatement` block supports the following arguments:
+
+* `statement` - (Required) Statements to combine with `and` logic. You can use any statements that can be nested. See [`statement`](#statement-block) above for details.
+
+### `byteMatchStatement` Block
+
+The byte match statement provides the bytes to search for, the location in requests that you want AWS WAF to search, and other settings. The bytes to search for are typically a string that corresponds with ASCII characters.
+
+The `byteMatchStatement` block supports the following arguments:
+
+* `fieldToMatch` - (Optional) Part of a web request that you want AWS WAF to inspect. See [`fieldToMatch`](#field_to_match-block) below for details.
+* `positionalConstraint` - (Required) Area within the portion of a web request that you want AWS WAF to search for `searchString`. Valid values include the following: `exactly`, `startsWith`, `endsWith`, `contains`, `containsWord`. See the AWS [documentation](https://docs.aws.amazon.com/waf/latest/APIReference/API_ByteMatchStatement.html) for more information.
+* `searchString` - (Required) String value that you want AWS WAF to search for. AWS WAF searches only in the part of web requests that you designate for inspection in `fieldToMatch`. The maximum length of the value is 50 bytes.
+* `textTransformation` - (Required) Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection. At least one transformation is required. See [`textTransformation`](#text_transformation-block) below for details.
+
+### `geoMatchStatement` Block
+
+The `geoMatchStatement` block supports the following arguments:
+
+* `countryCodes` - (Required) Array of two-character country codes, for example, [ "US", "CN" ], from the alpha-2 country ISO codes of the `ISO 3166` international standard. See the [documentation](https://docs.aws.amazon.com/waf/latest/APIReference/API_GeoMatchStatement.html) for valid values.
+* `forwardedIpConfig` - (Optional) Configuration for inspecting IP addresses in an HTTP header that you specify, instead of using the IP address that's reported by the web request origin. See [`forwardedIpConfig`](#forwarded_ip_config-block) below for details.
+
+### `ipSetReferenceStatement` Block
+
+A rule statement used to detect web requests coming from particular IP addresses or address ranges. To use this, create an `awsWafv2IpSet` that specifies the addresses you want to detect, then use the `arn` of that set in this statement.
+
+The `ipSetReferenceStatement` block supports the following arguments:
+
+* `arn` - (Required) The Amazon Resource Name (ARN) of the IP Set that this statement references.
+* `ipSetForwardedIpConfig` - (Optional) Configuration for inspecting IP addresses in an HTTP header that you specify, instead of using the IP address that's reported by the web request origin. See [`ipSetForwardedIpConfig`](#ip_set_forwarded_ip_config-block) below for more details.
+
+### `labelMatchStatement` Block
+
+The `labelMatchStatement` block supports the following arguments:
+
+* `scope` - (Required) Specify whether you want to match using the label name or just the namespace. Valid values are `label` or `namespace`.
+* `key` - (Required) String to match against.
+
+### `managedRuleGroupStatement` Block
+
+A rule statement used to run the rules that are defined in a managed rule group.
+
+You can't nest a `managedRuleGroupStatement`, for example for use inside a `notStatement` or `orStatement`. It can only be referenced as a `topLevel` statement within a `rule`.
+
+The `managedRuleGroupStatement` block supports the following arguments:
+
+* `name` - (Required) Name of the managed rule group.
+* `ruleActionOverride` - (Optional) Action settings to use in the place of the rule actions that are configured inside the rule group. You specify one override for each rule whose action you want to change. See [`ruleActionOverride`](#rule_action_override-block) below for details.
+* `managedRuleGroupConfigs`- (Optional) Additional information that's used by a managed rule group. Only one rule attribute is allowed in each config. See [`managedRuleGroupConfigs`](#managed_rule_group_configs-block) for more details
+* `scopeDownStatement` - Narrows the scope of the statement to matching web requests. This can be any nestable statement, and you can nest statements at any level below this scope-down statement. See [`statement`](#statement-block) above for details.
+* `vendorName` - (Required) Name of the managed rule group vendor.
+* `version` - (Optional) Version of the managed rule group. You can set `version10` or `version11` etc. If you want to use the default version, do not set anything.
+
+### `notStatement` Block
+
+A logical rule statement used to negate the results of another rule statement. You provide one `statement` within the `notStatement`.
+
+The `notStatement` block supports the following arguments:
+
+* `statement` - (Required) Statement to negate. You can use any statement that can be nested. See [`statement`](#statement-block) above for details.
+
+### `orStatement` Block
+
+A logical rule statement used to combine other rule statements with `or` logic. You provide more than one `statement` within the `orStatement`.
+
+The `orStatement` block supports the following arguments:
+
+* `statement` - (Required) Statements to combine with `or` logic. You can use any statements that can be nested. See [`statement`](#statement-block) above for details.
+
+### `rateBasedStatement` Block
+
+A rate-based rule tracks the rate of requests for each originating IP address, and triggers the rule action when the rate exceeds a limit that you specify on the number of requests in any 5-minute time span. You can use this to put a temporary block on requests from an IP address that is sending excessive requests. See the [documentation](https://docs.aws.amazon.com/waf/latest/APIReference/API_RateBasedStatement.html) for more information.
+
+You can't nest a `rateBasedStatement`, for example for use inside a `notStatement` or `orStatement`. It can only be referenced as a `topLevel` statement within a `rule`.
+
+The `rateBasedStatement` block supports the following arguments:
+
+* `aggregateKeyType` - (Optional) Setting that indicates how to aggregate the request counts. Valid values include: `constant`, `customKeys`, `forwardedIp`, or `ip`. Default: `ip`.
+* `customKey` - (Optional) Aggregate the request counts using one or more web request components as the aggregate keys. See [`customKey`](#custom_key-block) below for details.
+* `forwardedIpConfig` - (Optional) Configuration for inspecting IP addresses in an HTTP header that you specify, instead of using the IP address that's reported by the web request origin. If `aggregateKeyType` is set to `forwardedIp`, this block is required. See [`forwardedIpConfig`](#forwarded_ip_config-block) below for details.
+* `limit` - (Required) Limit on requests per 5-minute period for a single originating IP address.
+* `scopeDownStatement` - (Optional) Optional nested statement that narrows the scope of the rate-based statement to matching web requests. This can be any nestable statement, and you can nest statements at any level below this scope-down statement. See [`statement`](#statement-block) above for details. If `aggregateKeyType` is set to `constant`, this block is required.
+
+### `regexMatchStatement` Block
+
+A rule statement used to search web request components for a match against a single regular expression.
+
+The `regexMatchStatement` block supports the following arguments:
+
+* `regexString` - (Required) String representing the regular expression. Minimum of `1` and maximum of `512` characters.
+* `fieldToMatch` - (Required) The part of a web request that you want AWS WAF to inspect. See [`fieldToMatch`](#field_to_match-block) below for details.
+* `textTransformation` - (Required) Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection. At least one transformation is required. See [`textTransformation`](#text_transformation-block) below for details.
+
+### `regexPatternSetReferenceStatement` Block
+
+A rule statement used to search web request components for matches with regular expressions. To use this, create a `awsWafv2RegexPatternSet` that specifies the expressions that you want to detect, then use the `arn` of that set in this statement. A web request matches the pattern set rule statement if the request component matches any of the patterns in the set.
+
+The `regexPatternSetReferenceStatement` block supports the following arguments:
+
+* `arn` - (Required) The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
+* `fieldToMatch` - (Optional) Part of a web request that you want AWS WAF to inspect. See [`fieldToMatch`](#field_to_match-block) below for details.
+* `textTransformation` - (Required) Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection. At least one transformation is required. See [`textTransformation`](#text_transformation-block) below for details.
+
+### `ruleGroupReferenceStatement` Block
+
+A rule statement used to run the rules that are defined in an WAFv2 Rule Group or `awsWafv2RuleGroup` resource.
+
+You can't nest a `ruleGroupReferenceStatement`, for example for use inside a `notStatement` or `orStatement`. It can only be referenced as a `topLevel` statement within a `rule`.
+
+The `ruleGroupReferenceStatement` block supports the following arguments:
+
+* `arn` - (Required) The Amazon Resource Name (ARN) of the `awsWafv2RuleGroup` resource.
+* `ruleActionOverride` - (Optional) Action settings to use in the place of the rule actions that are configured inside the rule group. You specify one override for each rule whose action you want to change. See [`ruleActionOverride`](#rule_action_override-block) below for details.
+
+### `sizeConstraintStatement` Block
+
+A rule statement that uses a comparison operator to compare a number of bytes against the size of a request component. AWS WAFv2 inspects up to the first 8192 bytes (8 KB) of a request body, and when inspecting the request URI Path, the slash `/` in
+the URI counts as one character.
+
+The `sizeConstraintStatement` block supports the following arguments:
+
+* `comparisonOperator` - (Required) Operator to use to compare the request part to the size setting. Valid values include: `eq`, `ne`, `le`, `lt`, `ge`, or `gt`.
+* `fieldToMatch` - (Optional) Part of a web request that you want AWS WAF to inspect. See [`fieldToMatch`](#field_to_match-block) below for details.
+* `size` - (Required) Size, in bytes, to compare to the request part, after any transformations. Valid values are integers between 0 and 21474836480, inclusive.
+* `textTransformation` - (Required) Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection. At least one transformation is required. See [`textTransformation`](#text_transformation-block) below for details.
+
+### `sqliMatchStatement` Block
+
+An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. Later in the process, when you create a web ACL, you specify whether to allow or block requests that appear to contain malicious SQL code.
+
+The `sqliMatchStatement` block supports the following arguments:
+
+* `fieldToMatch` - (Optional) Part of a web request that you want AWS WAF to inspect. See [`fieldToMatch`](#field_to_match-block) below for details.
+* `textTransformation` - (Required) Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection. At least one transformation is required. See [`textTransformation`](#text_transformation-block) below for details.
+
+### `xssMatchStatement` Block
+
+The XSS match statement provides the location in requests that you want AWS WAF to search and text transformations to use on the search area before AWS WAF searches for character sequences that are likely to be malicious strings.
+
+The `xssMatchStatement` block supports the following arguments:
+
+* `fieldToMatch` - (Optional) Part of a web request that you want AWS WAF to inspect. See [`fieldToMatch`](#field_to_match-block) below for details.
+* `textTransformation` - (Required) Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection. At least one transformation is required. See [`textTransformation`](#text_transformation-block) below for details.
+
+### `ruleActionOverride` Block
+
+The `ruleActionOverride` block supports the following arguments:
+
+* `actionToUse` - (Required) Override action to use, in place of the configured action of the rule in the rule group. See [`action`](#action-block) for details.
+* `name` - (Required) Name of the rule to override. See the [documentation](https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-list.html) for a list of names in the appropriate rule group in use.
+
+### `managedRuleGroupConfigs` Block
+
+The `managedRuleGroupConfigs` block support the following arguments:
+
+* `awsManagedRulesBotControlRuleSet` - (Optional) Additional configuration for using the Bot Control managed rule group. Use this to specify the inspection level that you want to use. See [`awsManagedRulesBotControlRuleSet`](#aws_managed_rules_bot_control_rule_set-block) for more details
+* `awsManagedRulesAcfpRuleSet` - (Optional) Additional configuration for using the Account Creation Fraud Prevention managed rule group. Use this to specify information such as the registration page of your application and the type of content to accept or reject from the client.
+* `awsManagedRulesAtpRuleSet` - (Optional) Additional configuration for using the Account Takeover Protection managed rule group. Use this to specify information such as the sign-in page of your application and the type of content to accept or reject from the client.
+* `loginPath` - (Optional, **Deprecated**) The path of the login endpoint for your application.
+* `passwordField` - (Optional, **Deprecated**) Details about your login page password field. See [`passwordField`](#password_field-block) for more details.
+* `payloadType`- (Optional, **Deprecated**) The payload type for your login endpoint, either JSON or form encoded.
+* `usernameField` - (Optional, **Deprecated**) Details about your login page username field. See [`usernameField`](#username_field-block) for more details.
+
+### `awsManagedRulesBotControlRuleSet` Block
+
+* `inspectionLevel` - (Optional) The inspection level to use for the Bot Control rule group.
+
+### `awsManagedRulesAcfpRuleSet` Block
+
+* `creationPath` - (Required) The path of the account creation endpoint for your application. This is the page on your website that accepts the completed registration form for a new user. This page must accept POST requests.
+* `enableRegexInPath` - (Optional) Whether or not to allow the use of regular expressions in the login page path.
+* `registrationPagePath` - (Required) The path of the account registration endpoint for your application. This is the page on your website that presents the registration form to new users. This page must accept GET text/html requests.
+* `requestInspection` - (Optional) The criteria for inspecting login requests, used by the ATP rule group to validate credentials usage. See [`requestInspection`](#request_inspection-block) for more details.
+* `responseInspection` - (Optional) The criteria for inspecting responses to login requests, used by the ATP rule group to track login failure rates. Note that Response Inspection is available only on web ACLs that protect CloudFront distributions. See [`responseInspection`](#response_inspection-block) for more details.
+
+### `awsManagedRulesAtpRuleSet` Block
+
+* `enableRegexInPath` - (Optional) Whether or not to allow the use of regular expressions in the login page path.
+* `loginPath` - (Required) The path of the login endpoint for your application.
+* `requestInspection` - (Optional) The criteria for inspecting login requests, used by the ATP rule group to validate credentials usage. See [`requestInspection`](#request_inspection-block) for more details.
+* `responseInspection` - (Optional) The criteria for inspecting responses to login requests, used by the ATP rule group to track login failure rates. Note that Response Inspection is available only on web ACLs that protect CloudFront distributions. See [`responseInspection`](#response_inspection-block) for more details.
+
+### `requestInspection` Block
+
+* `payloadType` (Required) The payload type for your login endpoint, either JSON or form encoded.
+* `usernameField` (Required) Details about your login page username field. See [`usernameField`](#username_field-block) for more details.
+* `passwordField` (Required) Details about your login page password field. See [`passwordField`](#password_field-block) for more details.
+
+### `passwordField` Block
+
+* `identifier` - (Optional) The name of the password field.
+
+### `usernameField` Block
+
+* `identifier` - (Optional) The name of the username field.
+
+### `responseInspection` Block
+
+* `bodyContains` (Optional) Configures inspection of the response body. See [`bodyContains`](#body_contains-block) for more details.
+* `header` (Optional) Configures inspection of the response header.See [`header`](#header-block) for more details.
+* `json` (Optional) Configures inspection of the response JSON. See [`json`](#json-block) for more details.
+* `statusCode` (Optional) Configures inspection of the response status code.See [`statusCode`](#status_code-block) for more details.
+
+### `bodyContains` Block
+
+* `successStrings` (Required) Strings in the body of the response that indicate a successful login attempt.
+* `failureStrings` (Required) Strings in the body of the response that indicate a failed login attempt.
+
+### `header` Block
+
+* `name` (Required) The name of the header to match against. The name must be an exact match, including case.
+* `successValues` (Required) Values in the response header with the specified name that indicate a successful login attempt.
+* `failureValues` (Required) Values in the response header with the specified name that indicate a failed login attempt.
+
+### `json` Block
+
+* `identifier` (Required) The identifier for the value to match against in the JSON.
+* `successStrings` (Required) Strings in the body of the response that indicate a successful login attempt.
+* `failureStrings` (Required) Strings in the body of the response that indicate a failed login attempt.
+
+### `statusCode` Block
+
+* `successCodes` (Required) Status codes in the response that indicate a successful login attempt.
+* `failureCodes` (Required) Status codes in the response that indicate a failed login attempt.
+
+### `fieldToMatch` Block
+
+The part of a web request that you want AWS WAF to inspect. Include the single `fieldToMatch` type that you want to inspect, with additional specifications as needed, according to the type. You specify a single request component in `fieldToMatch` for each rule statement that requires it. To inspect more than one component of a web request, create a separate rule statement for each component. See the [documentation](https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-statement-fields.html#waf-rule-statement-request-component) for more details.
+
+The `fieldToMatch` block supports the following arguments:
+
+~> **Note** Only one of `allQueryArguments`, `body`, `cookies`, `headers`, `ja3Fingerprint`, `jsonBody`, `method`, `queryString`, `singleHeader`, `singleQueryArgument`, or `uriPath` can be specified. An empty configuration block `{}` should be used when specifying `allQueryArguments`, `method`, or `queryString` attributes.
+
+* `allQueryArguments` - (Optional) Inspect all query arguments.
+* `body` - (Optional) Inspect the request body, which immediately follows the request headers. See [`body`](#body-block) below for details.
+* `cookies` - (Optional) Inspect the cookies in the web request. See [`cookies`](#cookies-block) below for details.
+* `headers` - (Optional) Inspect the request headers. See [`headers`](#headers-block) below for details.
+* `ja3Fingerprint` - (Optional) Inspect the JA3 fingerprint. See [`ja3Fingerprint`](#ja3_fingerprint-block) below for details.
+* `jsonBody` - (Optional) Inspect the request body as JSON. See [`jsonBody`](#json_body-block) for details.
+* `method` - (Optional) Inspect the HTTP method. The method indicates the type of operation that the request is asking the origin to perform.
+* `queryString` - (Optional) Inspect the query string. This is the part of a URL that appears after a `?` character, if any.
+* `singleHeader` - (Optional) Inspect a single header. See [`singleHeader`](#single_header-block) below for details.
+* `singleQueryArgument` - (Optional) Inspect a single query argument. See [`singleQueryArgument`](#single_query_argument-block) below for details.
+* `uriPath` - (Optional) Inspect the request URI path. This is the part of a web request that identifies a resource, for example, `/images/dailyAdJpg`.
+
+### `forwardedIpConfig` Block
+
+The configuration for inspecting IP addresses in an HTTP header that you specify, instead of using the IP address that's reported by the web request origin. Commonly, this is the X-Forwarded-For (XFF) header, but you can specify any header name. If the specified header isn't present in the request, AWS WAFv2 doesn't apply the rule to the web request at all. AWS WAFv2 only evaluates the first IP address found in the specified HTTP header.
+
+The `forwardedIpConfig` block supports the following arguments:
+
+* `fallbackBehavior` - (Required) - Match status to assign to the web request if the request doesn't have a valid IP address in the specified position. Valid values include: `match` or `noMatch`.
+* `headerName` - (Required) - Name of the HTTP header to use for the IP address.
+
+### `ipSetForwardedIpConfig` Block
+
+The configuration for inspecting IP addresses in an HTTP header that you specify, instead of using the IP address that's reported by the web request origin. Commonly, this is the X-Forwarded-For (XFF) header, but you can specify any header name.
+
+The `ipSetForwardedIpConfig` block supports the following arguments:
+
+* `fallbackBehavior` - (Required) - Match status to assign to the web request if the request doesn't have a valid IP address in the specified position. Valid values include: `match` or `noMatch`.
+* `headerName` - (Required) - Name of the HTTP header to use for the IP address.
+* `position` - (Required) - Position in the header to search for the IP address. Valid values include: `first`, `last`, or `any`. If `any` is specified and the header contains more than 10 IP addresses, AWS WAFv2 inspects the last 10.
+
+### `headers` Block
+
+Inspect the request headers.
+
+The `headers` block supports the following arguments:
+
+* `matchPattern` - (Required) The filter to use to identify the subset of headers to inspect in a web request. The `matchPattern` block supports only one of the following arguments:
+    * `all` - An empty configuration block that is used for inspecting all headers.
+    * `includedHeaders` - An array of strings that will be used for inspecting headers that have a key that matches one of the provided values.
+    * `excludedHeaders` - An array of strings that will be used for inspecting headers that do not have a key that matches one of the provided values.
+* `matchScope` - (Required) The parts of the headers to inspect with the rule inspection criteria. If you specify `all`, AWS WAF inspects both keys and values. Valid values include the following: `all`, `key`, `value`.
+* `oversizeHandling` - (Required) Oversize handling tells AWS WAF what to do with a web request when the request component that the rule inspects is over the limits. Valid values include the following: `continue`, `match`, `noMatch`. See the AWS [documentation](https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-statement-oversize-handling.html) for more information.
+
+### `ja3Fingerprint` Block
+
+The `ja3Fingerprint` block supports the following arguments:
+
+* `fallbackBehavior` - (Required) The match status to assign to the web request if the request doesn't have a JA3 fingerprint. Valid values include: `match` or `noMatch`.
+
+### `jsonBody` Block
+
+The `jsonBody` block supports the following arguments:
+
+* `invalidFallbackBehavior` - (Optional) What to do when JSON parsing fails. Defaults to evaluating up to the first parsing failure. Valid values are `evaluateAsString`, `match` and `noMatch`.
+* `matchPattern` - (Required) The patterns to look for in the JSON body. You must specify exactly one setting: either `all` or `includedPaths`. See [JsonMatchPattern](https://docs.aws.amazon.com/waf/latest/APIReference/API_JsonMatchPattern.html) for details.
+* `matchScope` - (Required) The parts of the JSON to match against using the `matchPattern`. Valid values are `all`, `key` and `value`.
+* `oversizeHandling` - (Optional) What to do if the body is larger than can be inspected. Valid values are `continue` (default), `match` and `noMatch`.
+
+### `singleHeader` Block
+
+Inspect a single header. Provide the name of the header to inspect, for example, `userAgent` or `referer` (provided as lowercase strings).
+
+The `singleHeader` block supports the following arguments:
+
+* `name` - (Optional) Name of the query header to inspect. This setting must be provided as lower case characters.
+
+### `singleQueryArgument` Block
+
+Inspect a single query argument. Provide the name of the query argument to inspect, such as `userName` or `salesRegion` (provided as lowercase strings).
+
+The `singleQueryArgument` block supports the following arguments:
+
+* `name` - (Optional) Name of the query header to inspect. This setting must be provided as lower case characters.
+
+### `body` Block
+
+The `body` block supports the following arguments:
+
+* `oversizeHandling` - (Optional) What WAF should do if the body is larger than WAF can inspect. WAF does not support inspecting the entire contents of the body of a web request when the body exceeds 8 KB (8192 bytes). Only the first 8 KB of the request body are forwarded to WAF by the underlying host service. Valid values: `continue`, `match`, `noMatch`.
+
+### `cookies` Block
+
+Inspect the cookies in the web request. You can specify the parts of the cookies to inspect and you can narrow the set of cookies to inspect by including or excluding specific keys. This is used to indicate the web request component to inspect, in the [FieldToMatch](https://docs.aws.amazon.com/waf/latest/APIReference/API_FieldToMatch.html) specification.
+
+The `cookies` block supports the following arguments:
+
+* `matchPattern` - (Required) The filter to use to identify the subset of cookies to inspect in a web request. You must specify exactly one setting: either `all`, `includedCookies` or `excludedCookies`. More details: [CookieMatchPattern](https://docs.aws.amazon.com/waf/latest/APIReference/API_CookieMatchPattern.html)
+* `matchScope` - (Required) The parts of the cookies to inspect with the rule inspection criteria. If you specify All, AWS WAF inspects both keys and values. Valid values: `all`, `key`, `value`
+* `oversizeHandling` - (Required) What AWS WAF should do if the cookies of the request are larger than AWS WAF can inspect. AWS WAF does not support inspecting the entire contents of request cookies when they exceed 8 KB (8192 bytes) or 200 total cookies. The underlying host service forwards a maximum of 200 cookies and at most 8 KB of cookie contents to AWS WAF. Valid values: `continue`, `match`, `noMatch`.
+
+### `textTransformation` Block
+
+The `textTransformation` block supports the following arguments:
+
+* `priority` - (Required) Relative processing order for multiple transformations that are defined for a rule statement. AWS WAF processes all transformations, from lowest priority to highest, before inspecting the transformed content.
+* `type` - (Required) Transformation to apply, please refer to the Text Transformation [documentation](https://docs.aws.amazon.com/waf/latest/APIReference/API_TextTransformation.html) for more details.
+
+### `visibilityConfig` Block
+
+The `visibilityConfig` block supports the following arguments:
+
+* `cloudwatchMetricsEnabled` - (Required) Whether the associated resource sends metrics to CloudWatch. For the list of available metrics, see [AWS WAF Metrics](https://docs.aws.amazon.com/waf/latest/developerguide/monitoring-cloudwatch.html#waf-metrics).
+* `metricName` - (Required) A friendly name of the CloudWatch metric. The name can contain only alphanumeric characters (A-Z, a-z, 0-9) hyphen(-) and underscore (\_), with length from one to 128 characters. It can't contain whitespace or metric names reserved for AWS WAF, for example `all` and `defaultAction`.
+* `sampledRequestsEnabled` - (Required) Whether AWS WAF should store a sampling of the web requests that match the rules. You can view the sampled requests through the AWS WAF console.
+
+### `captchaConfig` Block
+
+The `captchaConfig` block supports the following arguments:
+
+* `immunityTimeProperty` - (Optional) Defines custom immunity time. See [`immunityTimeProperty`](#immunity_time_property-block) below for details.
+
+### `immunityTimeProperty` Block
+
+The `immunityTimeProperty` block supports the following arguments:
+
+* `immunityTime` - (Optional) The amount of time, in seconds, that a CAPTCHA or challenge timestamp is considered valid by AWS WAF. The default setting is 300.
+
+### `requestBody` Block
+
+The `requestBody` block supports the following arguments:
+
+* `cloudfront` - (Optional) Customizes the request body that your protected CloudFront distributions forward to AWS WAF for inspection. See [`cloudfront`](#cloudfront-block) below for details.
+
+### `cloudfront` Block
+
+The `cloudfront` block supports the following arguments:
+
+* `defaultSizeInspectionLimit` - (Required) Specifies the maximum size of the web request body component that an associated CloudFront distribution should send to AWS WAF for inspection. This applies to statements in the web ACL that inspect the body or JSON body. Valid values are `kb16`, `kb32`, `kb48` and `kb64`.
+
+### `customKey` Block
+
+Aggregate the request counts using one or more web request components as the aggregate keys. With this option, you must specify the aggregate keys in the `customKeys` block. To aggregate on only the IP address or only the forwarded IP address, don't use custom keys. Instead, set the `aggregateKeyType` to `ip` or `forwardedIp`.
+
+The `customKey` block supports the following arguments:
+
+* `cookie` - (Optional) Use the value of a cookie in the request as an aggregate key. See [RateLimit `cookie`](#ratelimit-cookie-block) below for details.
+* `forwardedIp` - (Optional) Use the first IP address in an HTTP header as an aggregate key. See [`forwardedIp`](#ratelimit-forwarded_ip-block) below for details.
+* `httpMethod` - (Optional) Use the request's HTTP method as an aggregate key. See [RateLimit `httpMethod`](#ratelimit-http_method-block) below for details.
+* `header` - (Optional) Use the value of a header in the request as an aggregate key. See [RateLimit `header`](#ratelimit-header-block) below for details.
+* `ip` - (Optional) Use the request's originating IP address as an aggregate key. See [`RateLimit ip`](#ratelimit-ip-block) below for details.
+* `labelNamespace` - (Optional) Use the specified label namespace as an aggregate key. See [RateLimit `labelNamespace`](#ratelimit-label_namespace-block) below for details.
+* `queryArgument` - (Optional) Use the specified query argument as an aggregate key. See [RateLimit `queryArgument`](#ratelimit-query_argument-block) below for details.
+* `queryString` - (Optional) Use the request's query string as an aggregate key. See [RateLimit `queryString`](#ratelimit-query_string-block) below for details.
+* `uriPath` - (Optional) Use the request's URI path as an aggregate key. See [RateLimit `uriPath`](#ratelimit-uri_path-block) below for details.
+
+### RateLimit `cookie` Block
+
+Use the value of a cookie in the request as an aggregate key. Each distinct value in the cookie contributes to the aggregation instance. If you use a single cookie as your custom key, then each value fully defines an aggregation instance.
+
+The `cookie` block supports the following arguments:
+
+* `name`: The name of the cookie to use.
+* `textTransformation`: Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection. They are used in rate-based rule statements, to transform request components before using them as custom aggregation keys. Atleast one transformation is required. See [`textTransformation`](#text_transformation-block) above for details.
+
+### RateLimit `forwardedIp` Block
+
+Use the first IP address in an HTTP header as an aggregate key. Each distinct forwarded IP address contributes to the aggregation instance. When you specify an IP or forwarded IP in the custom key settings, you must also specify at least one other key to use. You can aggregate on only the forwarded IP address by specifying `forwardedIp` in your rate-based statement's `aggregateKeyType`. With this option, you must specify the header to use in the rate-based rule's [`forwardedIpConfig`](#forwarded_ip_config-block) block.
+
+The `forwardedIp` block is configured as an empty block `{}`.
+
+### RateLimit `httpMethod` Block
+
+Use the request's HTTP method as an aggregate key. Each distinct HTTP method contributes to the aggregation instance. If you use just the HTTP method as your custom key, then each method fully defines an aggregation instance.
+
+The `httpMethod` block is configured as an empty block `{}`.
+
+### RateLimit `header` Block
+
+Use the value of a header in the request as an aggregate key. Each distinct value in the header contributes to the aggregation instance. If you use a single header as your custom key, then each value fully defines an aggregation instance.
+
+The `header` block supports the following arguments:
+
+* `name`: The name of the header to use.
+* `textTransformation`: Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection. They are used in rate-based rule statements, to transform request components before using them as custom aggregation keys. Atleast one transformation is required. See [`textTransformation`](#text_transformation-block) above for details.
+
+### RateLimit `ip` Block
+
+Use the request's originating IP address as an aggregate key. Each distinct IP address contributes to the aggregation instance. When you specify an IP or forwarded IP in the custom key settings, you must also specify at least one other key to use. You can aggregate on only the IP address by specifying `ip` in your rate-based statement's `aggregateKeyType`.
+
+The `ip` block is configured as an empty block `{}`.
+
+### RateLimit `labelNamespace` Block
+
+Use the specified label namespace as an aggregate key. Each distinct fully qualified label name that has the specified label namespace contributes to the aggregation instance. If you use just one label namespace as your custom key, then each label name fully defines an aggregation instance. This uses only labels that have been added to the request by rules that are evaluated before this rate-based rule in the web ACL. For information about label namespaces and names, see Label syntax and naming requirements (https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-label-requirements.html) in the WAF Developer Guide.
+
+The `labelNamespace` block supports the following arguments:
+
+* `namespace`: The namespace to use for aggregation
+
+### RateLimit `queryArgument` Block
+
+Use the specified query argument as an aggregate key. Each distinct value for the named query argument contributes to the aggregation instance. If you use a single query argument as your custom key, then each value fully defines an aggregation instance.
+
+The `queryArgument` block supports the following arguments:
+
+* `name`: The name of the query argument to use.
+* `textTransformation`: Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection. They are used in rate-based rule statements, to transform request components before using them as custom aggregation keys. Atleast one transformation is required. See [`textTransformation`](#text_transformation-block) above for details.
+
+### RateLimit `queryString` Block
+
+Use the request's query string as an aggregate key. Each distinct string contributes to the aggregation instance. If you use just the query string as your custom key, then each string fully defines an aggregation instance.
+
+The `queryString` block supports the following arguments:
+
+* `textTransformation`: Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection. They are used in rate-based rule statements, to transform request components before using them as custom aggregation keys. Atleast one transformation is required. See [`textTransformation`](#text_transformation-block) above for details.
+
+### RateLimit `uriPath` Block
+
+Use the request's URI path as an aggregate key. Each distinct URI path contributes to the aggregation instance. If you use just the URI path as your custom key, then each URI path fully defines an aggregation instance.
+
+The `uriPath` block supports the following arguments:
+
+* `textTransformation`: Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection. They are used in rate-based rule statements, to transform request components before using them as custom aggregation keys. Atleast one transformation is required. See [`textTransformation`](#text_transformation-block) above for details.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the WAF WebACL.
+* `capacity` - Web ACL capacity units (WCUs) currently being used by this web ACL.
+* `id` - The ID of the WAF WebACL.
+* `tagsAll` - Map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WAFv2 Web ACLs using `id/name/scope`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import WAFv2 Web ACLs using `id/name/scope`. For example:
+
+```console
+% terraform import aws_wafv2_web_acl.example a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc/example/REGIONAL
+```
+
+<!-- cache-key: cdktf-0.18.0 input-bb7e42f63763364f8c9c28922974f072b6dc15b1c389b5eb3fceec122747038c -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/wafv2_web_acl_association.html.markdown b/website/docs/cdktf/typescript/r/wafv2_web_acl_association.html.markdown
new file mode 100644
index 00000000000..a7239029421
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/wafv2_web_acl_association.html.markdown
@@ -0,0 +1,125 @@
+---
+subcategory: "WAF"
+layout: "aws"
+page_title: "AWS: aws_wafv2_web_acl_association"
+description: |-
+  Creates a WAFv2 Web ACL Association.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_wafv2_web_acl_association
+
+Creates a WAFv2 Web ACL Association.
+
+~> **NOTE on associating a WAFv2 Web ACL with a Cloudfront distribution:** Do not use this resource to associate a WAFv2 Web ACL with a Cloudfront Distribution. The [AWS API call backing this resource][1] notes that you should use the [`webAclId`][2] property on the [`cloudfrontDistribution`][2] instead.
+
+[1]: https://docs.aws.amazon.com/waf/latest/APIReference/API_AssociateWebACL.html
+[2]: /docs/providers/aws/r/cloudfront_distribution.html#web_acl_id
+
+## Example Usage
+
+```terraform
+resource "aws_api_gateway_rest_api" "example" {
+  body = jsonencode({
+    openapi = "3.0.1"
+    info = {
+      title   = "example"
+      version = "1.0"
+    }
+    paths = {
+      "/path1" = {
+        get = {
+          x-amazon-apigateway-integration = {
+            httpMethod           = "GET"
+            payloadFormatVersion = "1.0"
+            type                 = "HTTP_PROXY"
+            uri                  = "https://ip-ranges.amazonaws.com/ip-ranges.json"
+          }
+        }
+      }
+    }
+  })
+
+  name = "example"
+}
+
+resource "aws_api_gateway_deployment" "example" {
+  rest_api_id = aws_api_gateway_rest_api.example.id
+
+  triggers = {
+    redeployment = sha1(jsonencode(aws_api_gateway_rest_api.example.body))
+  }
+
+  lifecycle {
+    create_before_destroy = true
+  }
+}
+
+resource "aws_api_gateway_stage" "example" {
+  deployment_id = aws_api_gateway_deployment.example.id
+  rest_api_id   = aws_api_gateway_rest_api.example.id
+  stage_name    = "example"
+}
+
+resource "aws_wafv2_web_acl" "example" {
+  name  = "web-acl-association-example"
+  scope = "REGIONAL"
+
+  default_action {
+    allow {}
+  }
+
+  visibility_config {
+    cloudwatch_metrics_enabled = false
+    metric_name                = "friendly-metric-name"
+    sampled_requests_enabled   = false
+  }
+}
+
+resource "aws_wafv2_web_acl_association" "example" {
+  resource_arn = aws_api_gateway_stage.example.arn
+  web_acl_arn  = aws_wafv2_web_acl.example.arn
+}
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `resourceArn` - (Required) The Amazon Resource Name (ARN) of the resource to associate with the web ACL. This must be an ARN of an Application Load Balancer, an Amazon API Gateway stage, an Amazon Cognito User Pool, an Amazon AppSync GraphQL API, an Amazon App Runner service, or an Amazon Verified Access instance.
+* `webAclArn` - (Required) The Amazon Resource Name (ARN) of the Web ACL that you want to associate with the resource.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Timeouts
+
+[Configuration options](https://www.terraform.io/docs/configuration/blocks/resources/syntax.html#operation-timeouts):
+
+* `create` - (Default `5M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WAFv2 Web ACL Association using `webAclArn,resourceArn`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import WAFv2 Web ACL Association using `webAclArn,resourceArn`. For example:
+
+```console
+% terraform import aws_wafv2_web_acl_association.example arn:aws:wafv2:...7ce849ea,arn:aws:apigateway:...ages/name
+```
+
+<!-- cache-key: cdktf-0.18.0 input-1e2fe2da46ac8dc4f7bb916c998d2fa6d086f0a49db050025c26062f5eca9dc3 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/wafv2_web_acl_logging_configuration.html.markdown b/website/docs/cdktf/typescript/r/wafv2_web_acl_logging_configuration.html.markdown
new file mode 100644
index 00000000000..e9f8452b5cf
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/wafv2_web_acl_logging_configuration.html.markdown
@@ -0,0 +1,286 @@
+---
+subcategory: "WAF"
+layout: "aws"
+page_title: "AWS: aws_wafv2_web_acl_logging_configuration"
+description: |-
+  Create a resource for WAFv2 Web ACL Logging Configuration.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_wafv2_web_acl_logging_configuration
+
+This resource creates a WAFv2 Web ACL Logging Configuration.
+
+!> **WARNING:** When logging from a WAFv2 Web ACL to a CloudWatch Log Group, the WAFv2 service tries to create or update a generic Log Resource Policy named `awswafLogs`. However, if there are a large number of Web ACLs or if the account frequently creates and deletes Web ACLs, this policy may exceed the maximum policy size. As a result, this resource type will fail to be created. More details about this issue can be found in [this issue](https://github.com/hashicorp/terraform-provider-aws/issues/25296). To prevent this issue, you can manage a specific resource policy. Please refer to the [example](#with-cloudwatch-log-group-and-managed-cloudwatch-log-resource-policy) below for managing a CloudWatch Log Group with a managed CloudWatch Log Resource Policy.
+
+## Example Usage
+
+### With Redacted Fields
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Wafv2WebAclLoggingConfiguration } from "./.gen/providers/aws/wafv2-web-acl-logging-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Wafv2WebAclLoggingConfiguration(this, "example", {
+      logDestinationConfigs: [
+        Token.asString(awsKinesisFirehoseDeliveryStreamExample.arn),
+      ],
+      redactedFields: [
+        {
+          singleHeader: {
+            name: "user-agent",
+          },
+        },
+      ],
+      resourceArn: Token.asString(awsWafv2WebAclExample.arn),
+    });
+  }
+}
+
+```
+
+### With Logging Filter
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { Wafv2WebAclLoggingConfiguration } from "./.gen/providers/aws/wafv2-web-acl-logging-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new Wafv2WebAclLoggingConfiguration(this, "example", {
+      logDestinationConfigs: [
+        Token.asString(awsKinesisFirehoseDeliveryStreamExample.arn),
+      ],
+      loggingFilter: {
+        defaultBehavior: "KEEP",
+        filter: [
+          {
+            behavior: "DROP",
+            condition: [
+              {
+                actionCondition: {
+                  action: "COUNT",
+                },
+              },
+              {
+                labelNameCondition: {
+                  labelName:
+                    "awswaf:111122223333:rulegroup:testRules:LabelNameZ",
+                },
+              },
+            ],
+            requirement: "MEETS_ALL",
+          },
+          {
+            behavior: "KEEP",
+            condition: [
+              {
+                actionCondition: {
+                  action: "ALLOW",
+                },
+              },
+            ],
+            requirement: "MEETS_ANY",
+          },
+        ],
+      },
+      resourceArn: Token.asString(awsWafv2WebAclExample.arn),
+    });
+  }
+}
+
+```
+
+### With CloudWatch Log Group and managed CloudWatch Log Resource Policy
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, Fn, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { CloudwatchLogGroup } from "./.gen/providers/aws/cloudwatch-log-group";
+import { CloudwatchLogResourcePolicy } from "./.gen/providers/aws/cloudwatch-log-resource-policy";
+import { DataAwsCallerIdentity } from "./.gen/providers/aws/data-aws-caller-identity";
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { DataAwsRegion } from "./.gen/providers/aws/data-aws-region";
+import { Wafv2WebAclLoggingConfiguration } from "./.gen/providers/aws/wafv2-web-acl-logging-configuration";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new CloudwatchLogGroup(this, "example", {
+      name: "aws-waf-logs-some-uniq-suffix",
+    });
+    const awsWafv2WebAclLoggingConfigurationExample =
+      new Wafv2WebAclLoggingConfiguration(this, "example_1", {
+        logDestinationConfigs: [example.arn],
+        resourceArn: Token.asString(awsWafv2WebAclExample.arn),
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsWafv2WebAclLoggingConfigurationExample.overrideLogicalId("example");
+    const current = new DataAwsCallerIdentity(this, "current", {});
+    const dataAwsRegionCurrent = new DataAwsRegion(this, "current_3", {});
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsRegionCurrent.overrideLogicalId("current");
+    const dataAwsIamPolicyDocumentExample = new DataAwsIamPolicyDocument(
+      this,
+      "example_4",
+      {
+        statement: [
+          {
+            actions: ["logs:CreateLogStream", "logs:PutLogEvents"],
+            condition: [
+              {
+                test: "ArnLike",
+                values: [
+                  "arn:aws:logs:${" +
+                    dataAwsRegionCurrent.name +
+                    "}:${" +
+                    current.accountId +
+                    "}:*",
+                ],
+                variable: "aws:SourceArn",
+              },
+              {
+                test: "StringEquals",
+                values: [Token.asString(Fn.tostring(current.accountId))],
+                variable: "aws:SourceAccount",
+              },
+            ],
+            effect: "Allow",
+            principals: [
+              {
+                identifiers: ["delivery.logs.amazonaws.com"],
+                type: "Service",
+              },
+            ],
+            resources: ["${" + example.arn + "}:*"],
+          },
+        ],
+        version: "2012-10-17",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    dataAwsIamPolicyDocumentExample.overrideLogicalId("example");
+    const awsCloudwatchLogResourcePolicyExample =
+      new CloudwatchLogResourcePolicy(this, "example_5", {
+        policyDocument: Token.asString(dataAwsIamPolicyDocumentExample.json),
+        policyName: "webacl-policy-uniq-name",
+      });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsCloudwatchLogResourcePolicyExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `logDestinationConfigs` - (Required) Configuration block that allows you to associate Amazon Kinesis Data Firehose, Cloudwatch Log log group, or S3 bucket Amazon Resource Names (ARNs) with the web ACL. **Note:** data firehose, log group, or bucket name **must** be prefixed with `awsWafLogs`, e.g. `awsWafLogsExampleFirehose`, `awsWafLogsExampleLogGroup`, or `awsWafLogsExampleBucket`.
+* `loggingFilter` - (Optional) Configuration block that specifies which web requests are kept in the logs and which are dropped. It allows filtering based on the rule action and the web request labels applied by matching rules during web ACL evaluation. For more details, refer to the [Logging Filter](#logging-filter) section below.
+* `redactedFields` - (Optional) Configuration for parts of the request that you want to keep out of the logs. Up to 100 `redactedFields` blocks are supported. See [Redacted Fields](#redacted-fields) below for more details.
+* `resourceArn` - (Required) Amazon Resource Name (ARN) of the web ACL that you want to associate with `logDestinationConfigs`.
+
+### Logging Filter
+
+The `loggingFilter` block supports the following arguments:
+
+* `defaultBehavior` - (Required) Default handling for logs that don't match any of the specified filtering conditions. Valid values for `defaultBehavior` are `keep` or `drop`.
+* `filter` - (Required) Filter(s) that you want to apply to the logs. See [Filter](#filter) below for more details.
+
+### Filter
+
+The `filter` block supports the following arguments:
+
+* `behavior` - (Required) Parameter that determines how to handle logs that meet the conditions and requirements of the filter. The valid values for `behavior` are `keep` or `drop`.
+* `condition` - (Required) Match condition(s) for the filter. See [Condition](#condition) below for more details.
+* `requirement` - (Required) Logic to apply to the filtering conditions. You can specify that a log must match all conditions or at least one condition in order to satisfy the filter. Valid values for `requirement` are `meetsAll` or `meetsAny`.
+
+### Condition
+
+The `condition` block supports the following arguments:
+
+~> **NOTE:** Either the `actionCondition` or `labelNameCondition` must be specified.
+
+* `actionCondition` - (Optional) Configuration for a single action condition. See [Action Condition](#action-condition) below for more details.
+* `labelNameCondition` - (Optional) Condition for a single label name. See [Label Name Condition](#label-name-condition) below for more details.
+
+### Action Condition
+
+The `actionCondition` block supports the following argument:
+
+* `action` - (Required) Action setting that a log record must contain in order to meet the condition. Valid values for `action` are `allow`, `block`, and `count`.
+
+### Label Name Condition
+
+The `labelNameCondition` block supports the following argument:
+
+* `labelName` - (Required) Name of the label that a log record must contain in order to meet the condition. It must be a fully qualified label name, which includes a prefix, optional namespaces, and the label name itself. The prefix identifies the rule group or web ACL context of the rule that added the label.
+
+### Redacted Fields
+
+The `redactedFields` block supports the following arguments:
+
+~> **NOTE:** You can only specify one of the following: `method`, `queryString`, `singleHeader`, or `uriPath`.
+
+* `method` - (Optional) HTTP method to be redacted. It must be specified as an empty configuration block `{}`. The method indicates the type of operation that the request is asking the origin to perform.
+* `queryString` - (Optional) Whether to redact the query string. It must be specified as an empty configuration block `{}`. The query string is the part of a URL that appears after a `?` character, if any.
+* `singleHeader` - (Optional) "single_header" refers to the redaction of a single header. For more information, please see the details below under [Single Header](#single-header).
+* `uriPath` - (Optional) Configuration block that redacts the request URI path. It should be specified as an empty configuration block `{}`. The URI path is the part of a web request that identifies a resource, such as `/images/dailyAdJpg`.
+
+### Single Header
+
+To redact a single header, provide the name of the header to be redacted. For example, use `userAgent` or `referer` (provided as lowercase strings).
+
+The `singleHeader` block supports the following arguments:
+
+* `name` - (Optional) Name of the query header to redact. This setting must be provided in lowercase characters.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Amazon Resource Name (ARN) of the WAFv2 Web ACL.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WAFv2 Web ACL Logging Configurations using the ARN of the WAFv2 Web ACL. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import WAFv2 Web ACL Logging Configurations using the ARN of the WAFv2 Web ACL. For example:
+
+```console
+% terraform import aws_wafv2_web_acl_logging_configuration.example arn:aws:wafv2:us-west-2:123456789012:regional/webacl/test-logs/a1b2c3d4-5678-90ab-cdef
+```
+
+<!-- cache-key: cdktf-0.18.0 input-25f3c0d8db1fe2e19c84f4ebb5edd1ab40bd0204a16eb4042e8db839d72d6f44 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/worklink_fleet.html.markdown b/website/docs/cdktf/typescript/r/worklink_fleet.html.markdown
new file mode 100644
index 00000000000..9b061231b8b
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/worklink_fleet.html.markdown
@@ -0,0 +1,151 @@
+---
+subcategory: "WorkLink"
+layout: "aws"
+page_title: "AWS: aws_worklink_fleet"
+description: |-
+  Provides a AWS WorkLink Fleet resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_worklink_fleet
+
+## Example Usage
+
+Basic usage:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { WorklinkFleet } from "./.gen/providers/aws/worklink-fleet";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new WorklinkFleet(this, "example", {
+      name: "terraform-example",
+    });
+  }
+}
+
+```
+
+Network Configuration Usage:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { WorklinkFleet } from "./.gen/providers/aws/worklink-fleet";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new WorklinkFleet(this, "example", {
+      name: "terraform-example",
+      network: {
+        securityGroupIds: [test.id],
+        subnetIds: [
+          Token.asString(Fn.lookupNested(awsSubnetTest, ["*", "id"])),
+        ],
+        vpcId: Token.asString(awsVpcTest.id),
+      },
+    });
+  }
+}
+
+```
+
+Identity Provider Configuration Usage:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { WorklinkFleet } from "./.gen/providers/aws/worklink-fleet";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new WorklinkFleet(this, "test", {
+      identityProvider: {
+        samlMetadata: Token.asString(Fn.file("saml-metadata.xml")),
+        type: "SAML",
+      },
+      name: "tf-worklink-fleet",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) A region-unique name for the AMI.
+* `auditStreamArn` - (Optional) The ARN of the Amazon Kinesis data stream that receives the audit events. Kinesis data stream name must begin with `"amazonWorkLink-"`.
+* `deviceCaCertificate` - (Optional) The certificate chain, including intermediate certificates and the root certificate authority certificate used to issue device certificates.
+* `identityProvider` - (Optional) Provide this to allow manage the identity provider configuration for the fleet. Fields documented below.
+* `displayName` - (Optional) The name of the fleet.
+* `network` - (Optional) Provide this to allow manage the company network configuration for the fleet. Fields documented below.
+* `optimizeForEndUserLocation` - (Optional) The option to optimize for better performance by routing traffic through the closest AWS Region to users, which may be outside of your home Region. Defaults to `true`.
+
+**network** requires the following:
+
+~> **NOTE:** `network` cannot be removed without force recreating by `terraform taint`.
+
+* `vpcId` - (Required) The VPC ID with connectivity to associated websites.
+* `subnetIds` - (Required) A list of subnet IDs used for X-ENI connections from Amazon WorkLink rendering containers.
+* `securityGroupIds` - (Required) A list of security group IDs associated with access to the provided subnets.
+
+**identity_provider** requires the following:
+
+~> **NOTE:** `identityProvider` cannot be removed without force recreating by `terraform taint`.
+
+* `type` - (Required) The type of identity provider.
+* `samlMetadata` - (Required) The SAML metadata document provided by the customer’s identity provider.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ARN of the created WorkLink Fleet.
+* `arn` - The ARN of the created WorkLink Fleet.
+* `companyCode` - The identifier used by users to sign in to the Amazon WorkLink app.
+* `createdTime` - The time that the fleet was created.
+* `lastUpdatedTime` - The time that the fleet was last updated.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WorkLink using the ARN. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import WorkLink using the ARN. For example:
+
+```console
+% terraform import aws_worklink_fleet.test arn:aws:worklink::123456789012:fleet/example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-e7ee1bb443346fba441c55fe6024eae415cbde38eca738fd5b316c9affc96fc9 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/worklink_website_certificate_authority_association.html.markdown b/website/docs/cdktf/typescript/r/worklink_website_certificate_authority_association.html.markdown
new file mode 100644
index 00000000000..08ea873481c
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/worklink_website_certificate_authority_association.html.markdown
@@ -0,0 +1,76 @@
+---
+subcategory: "WorkLink"
+layout: "aws"
+page_title: "AWS: aws_worklink_website_certificate_authority_association"
+description: |-
+  Provides a AWS WorkLink Website Certificate Authority Association resource.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_worklink_website_certificate_authority_association
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Fn, Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { WorklinkFleet } from "./.gen/providers/aws/worklink-fleet";
+import { WorklinkWebsiteCertificateAuthorityAssociation } from "./.gen/providers/aws/worklink-website-certificate-authority-association";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new WorklinkFleet(this, "example", {
+      name: "terraform-example",
+    });
+    new WorklinkWebsiteCertificateAuthorityAssociation(this, "test", {
+      certificate: Token.asString(Fn.file("certificate.pem")),
+      fleetArn: Token.asString(awsWorklinkFleetTest.arn),
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `fleetArn` - (Required, ForceNew) The ARN of the fleet.
+* `certificate` - (Required, ForceNew) The root certificate of the Certificate Authority.
+* `displayName` - (Optional, ForceNew) The certificate name to display.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `websiteCaId` - A unique identifier for the Certificate Authority.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WorkLink Website Certificate Authority using `fleetArn,websiteCaId`. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import WorkLink Website Certificate Authority using `fleetArn,websiteCaId`. For example:
+
+```console
+% terraform import aws_worklink_website_certificate_authority_association.example arn:aws:worklink::123456789012:fleet/example,abcdefghijk
+```
+
+<!-- cache-key: cdktf-0.18.0 input-2b2af5570bf7a64a89f55e81e480cfdcd1196d55b06f0523cabcef0e95e941f7 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/workspaces_connection_alias.html.markdown b/website/docs/cdktf/typescript/r/workspaces_connection_alias.html.markdown
new file mode 100644
index 00000000000..ed53f55a943
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/workspaces_connection_alias.html.markdown
@@ -0,0 +1,85 @@
+---
+subcategory: "WorkSpaces"
+layout: "aws"
+page_title: "AWS: aws_workspaces_connection_alias"
+description: |-
+  Terraform resource for managing an AWS WorkSpaces Connection Alias.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_workspaces_connection_alias
+
+Terraform resource for managing an AWS WorkSpaces Connection Alias.
+
+## Example Usage
+
+### Basic Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { WorkspacesConnectionAlias } from "./.gen/providers/aws/workspaces-connection-alias";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new WorkspacesConnectionAlias(this, "example", {
+      connectionString: "testdomain.test",
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `connectionString` - (Required) The connection string specified for the connection alias. The connection string must be in the form of a fully qualified domain name (FQDN), such as www.example.com.
+* `tags` – (Optional) A map of tags assigned to the WorkSpaces Connection Alias. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The identifier of the connection alias.
+* `ownerAccountId` - The identifier of the Amazon Web Services account that owns the connection alias.
+* `state` - The current state of the connection alias.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `60M`)
+* `update` - (Default `180M`)
+* `delete` - (Default `90M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WorkSpaces Connection Alias using the connection alias ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import WorkSpaces Connection Alias using the connection alias ID. For example:
+
+```console
+% terraform import aws_workspaces_connection_alias.example rft-8012925589
+```
+
+<!-- cache-key: cdktf-0.18.0 input-413fd75316cfeb359e07cefddd821d90ecf5ceabe738b42d92da1fd7d2704797 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/workspaces_directory.html.markdown b/website/docs/cdktf/typescript/r/workspaces_directory.html.markdown
new file mode 100644
index 00000000000..2d0b7ea27b1
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/workspaces_directory.html.markdown
@@ -0,0 +1,266 @@
+---
+subcategory: "WorkSpaces"
+layout: "aws"
+page_title: "AWS: aws_workspaces_directory"
+description: |-
+  Provides a WorkSpaces directory in AWS WorkSpaces Service.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_workspaces_directory
+
+Provides a WorkSpaces directory in AWS WorkSpaces Service.
+
+~> **NOTE:** AWS WorkSpaces service requires [`workspacesDefaultRole`](https://docs.aws.amazon.com/workspaces/latest/adminguide/workspaces-access-control.html#create-default-role) IAM role to operate normally.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { DirectoryServiceDirectory } from "./.gen/providers/aws/directory-service-directory";
+import { IamRole } from "./.gen/providers/aws/iam-role";
+import { IamRolePolicyAttachment } from "./.gen/providers/aws/iam-role-policy-attachment";
+import { Subnet } from "./.gen/providers/aws/subnet";
+import { Vpc } from "./.gen/providers/aws/vpc";
+import { WorkspacesDirectory } from "./.gen/providers/aws/workspaces-directory";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new Vpc(this, "example", {
+      cidrBlock: "10.0.0.0/16",
+    });
+    const workspaces = new DataAwsIamPolicyDocument(this, "workspaces", {
+      statement: [
+        {
+          actions: ["sts:AssumeRole"],
+          principals: [
+            {
+              identifiers: ["workspaces.amazonaws.com"],
+              type: "Service",
+            },
+          ],
+        },
+      ],
+    });
+    const workspacesDefault = new IamRole(this, "workspaces_default", {
+      assumeRolePolicy: Token.asString(workspaces.json),
+      name: "workspaces_DefaultRole",
+    });
+    const workspacesDefaultSelfServiceAccess = new IamRolePolicyAttachment(
+      this,
+      "workspaces_default_self_service_access",
+      {
+        policyArn: "arn:aws:iam::aws:policy/AmazonWorkSpacesSelfServiceAccess",
+        role: workspacesDefault.name,
+      }
+    );
+    const workspacesDefaultServiceAccess = new IamRolePolicyAttachment(
+      this,
+      "workspaces_default_service_access",
+      {
+        policyArn: "arn:aws:iam::aws:policy/AmazonWorkSpacesServiceAccess",
+        role: workspacesDefault.name,
+      }
+    );
+    const exampleA = new Subnet(this, "example_a", {
+      availabilityZone: "us-east-1a",
+      cidrBlock: "10.0.0.0/24",
+      vpcId: example.id,
+    });
+    const exampleB = new Subnet(this, "example_b", {
+      availabilityZone: "us-east-1b",
+      cidrBlock: "10.0.1.0/24",
+      vpcId: example.id,
+    });
+    const exampleC = new Subnet(this, "example_c", {
+      availabilityZone: "us-east-1c",
+      cidrBlock: "10.0.2.0/24",
+      vpcId: example.id,
+    });
+    const exampleD = new Subnet(this, "example_d", {
+      availabilityZone: "us-east-1d",
+      cidrBlock: "10.0.3.0/24",
+      vpcId: example.id,
+    });
+    const awsDirectoryServiceDirectoryExample = new DirectoryServiceDirectory(
+      this,
+      "example_9",
+      {
+        name: "corp.example.com",
+        password: "#S1ncerely",
+        size: "Small",
+        vpcSettings: {
+          subnetIds: [exampleA.id, exampleB.id],
+          vpcId: example.id,
+        },
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsDirectoryServiceDirectoryExample.overrideLogicalId("example");
+    const awsWorkspacesDirectoryExample = new WorkspacesDirectory(
+      this,
+      "example_10",
+      {
+        dependsOn: [
+          workspacesDefaultServiceAccess,
+          workspacesDefaultSelfServiceAccess,
+        ],
+        directoryId: Token.asString(awsDirectoryServiceDirectoryExample.id),
+        selfServicePermissions: {
+          changeComputeType: true,
+          increaseVolumeSize: true,
+          rebuildWorkspace: true,
+          restartWorkspace: true,
+          switchRunningMode: true,
+        },
+        subnetIds: [exampleC.id, exampleD.id],
+        tags: {
+          Example: Token.asString(true),
+        },
+        workspaceAccessProperties: {
+          deviceTypeAndroid: "ALLOW",
+          deviceTypeChromeos: "ALLOW",
+          deviceTypeIos: "ALLOW",
+          deviceTypeLinux: "DENY",
+          deviceTypeOsx: "ALLOW",
+          deviceTypeWeb: "DENY",
+          deviceTypeWindows: "DENY",
+          deviceTypeZeroclient: "DENY",
+        },
+        workspaceCreationProperties: {
+          customSecurityGroupId: Token.asString(awsSecurityGroupExample.id),
+          defaultOu: "OU=AWS,DC=Workgroup,DC=Example,DC=com",
+          enableInternetAccess: true,
+          enableMaintenanceMode: true,
+          userEnabledAsLocalAdministrator: true,
+        },
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsWorkspacesDirectoryExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+### IP Groups
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { WorkspacesDirectory } from "./.gen/providers/aws/workspaces-directory";
+import { WorkspacesIpGroup } from "./.gen/providers/aws/workspaces-ip-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const example = new WorkspacesIpGroup(this, "example", {
+      name: "example",
+    });
+    const awsWorkspacesDirectoryExample = new WorkspacesDirectory(
+      this,
+      "example_1",
+      {
+        directoryId: Token.asString(awsDirectoryServiceDirectoryExample.id),
+        ipGroupIds: [example.id],
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsWorkspacesDirectoryExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `directoryId` - (Required) The directory identifier for registration in WorkSpaces service.
+* `subnetIds` - (Optional) The identifiers of the subnets where the directory resides.
+* `ipGroupIds` - The identifiers of the IP access control groups associated with the directory.
+* `tags` – (Optional) A map of tags assigned to the WorkSpaces directory. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `selfServicePermissions` – (Optional) Permissions to enable or disable self-service capabilities. Defined below.
+* `workspaceAccessProperties` – (Optional) Specifies which devices and operating systems users can use to access their WorkSpaces. Defined below.
+* `workspaceCreationProperties` – (Optional) Default properties that are used for creating WorkSpaces. Defined below.
+
+### self_service_permissions
+
+* `changeComputeType` – (Optional) Whether WorkSpaces directory users can change the compute type (bundle) for their workspace. Default `false`.
+* `increaseVolumeSize` – (Optional) Whether WorkSpaces directory users can increase the volume size of the drives on their workspace. Default `false`.
+* `rebuildWorkspace` – (Optional) Whether WorkSpaces directory users can rebuild the operating system of a workspace to its original state. Default `false`.
+* `restartWorkspace` – (Optional) Whether WorkSpaces directory users can restart their workspace. Default `true`.
+* `switchRunningMode` – (Optional) Whether WorkSpaces directory users can switch the running mode of their workspace. Default `false`.
+
+### workspace_access_properties
+
+* `deviceTypeAndroid` – (Optional) Indicates whether users can use Android devices to access their WorkSpaces.
+* `deviceTypeChromeos` – (Optional) Indicates whether users can use Chromebooks to access their WorkSpaces.
+* `deviceTypeIos` – (Optional) Indicates whether users can use iOS devices to access their WorkSpaces.
+* `deviceTypeLinux` – (Optional) Indicates whether users can use Linux clients to access their WorkSpaces.
+* `deviceTypeOsx` – (Optional) Indicates whether users can use macOS clients to access their WorkSpaces.
+* `deviceTypeWeb` – (Optional) Indicates whether users can access their WorkSpaces through a web browser.
+* `deviceTypeWindows` – (Optional) Indicates whether users can use Windows clients to access their WorkSpaces.
+* `deviceTypeZeroclient` – (Optional) Indicates whether users can use zero client devices to access their WorkSpaces.
+
+### workspace_creation_properties
+
+-> **Note:** Once you specified `customSecurityGroupId` or `defaultOu`, there is no way to delete these attributes. If you cleanup them from the configuration, they still be present in state.
+
+* `customSecurityGroupId` – (Optional) The identifier of your custom security group. Should relate to the same VPC, where workspaces reside in.
+* `defaultOu` – (Optional) The default organizational unit (OU) for your WorkSpace directories. Should conform `"ou=<value>,dc=<value>,...,dc=<value>"` pattern.
+* `enableInternetAccess` – (Optional) Indicates whether internet access is enabled for your WorkSpaces.
+* `enableMaintenanceMode` – (Optional) Indicates whether maintenance mode is enabled for your WorkSpaces. For more information, see [WorkSpace Maintenance](https://docs.aws.amazon.com/workspaces/latest/adminguide/workspace-maintenance.html)..
+* `userEnabledAsLocalAdministrator` – (Optional) Indicates whether users are local administrators of their WorkSpaces.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The WorkSpaces directory identifier.
+* `alias` - The directory alias.
+* `customerUserName` - The user name for the service account.
+* `directoryName` - The name of the directory.
+* `directoryType` - The directory type.
+* `dnsIpAddresses` - The IP addresses of the DNS servers for the directory.
+* `iamRoleId` - The identifier of the IAM role. This is the role that allows Amazon WorkSpaces to make calls to other services, such as Amazon EC2, on your behalf.
+* `ipGroupIds` - The identifiers of the IP access control groups associated with the directory.
+* `registrationCode` - The registration code for the directory. This is the code that users enter in their Amazon WorkSpaces client application to connect to the directory.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `workspaceSecurityGroupId` - The identifier of the security group that is assigned to new WorkSpaces.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Workspaces directory using the directory ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Workspaces directory using the directory ID. For example:
+
+```console
+% terraform import aws_workspaces_directory.main d-4444444444
+```
+
+<!-- cache-key: cdktf-0.18.0 input-d3c63279ed03f48d66f7e43838d7dd34eb898e70056d69f86ad10924bad87a77 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/workspaces_ip_group.html.markdown b/website/docs/cdktf/typescript/r/workspaces_ip_group.html.markdown
new file mode 100644
index 00000000000..0f5d94a06f5
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/workspaces_ip_group.html.markdown
@@ -0,0 +1,99 @@
+---
+subcategory: "WorkSpaces"
+layout: "aws"
+page_title: "AWS: aws_workspaces_ip_group"
+description: |-
+  Provides an IP access control group in AWS WorkSpaces Service.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_workspaces_ip_group
+
+Provides an IP access control group in AWS WorkSpaces Service
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { WorkspacesIpGroup } from "./.gen/providers/aws/workspaces-ip-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new WorkspacesIpGroup(this, "contractors", {
+      description: "Contractors IP access control group",
+      name: "Contractors",
+      rules: [
+        {
+          description: "NY",
+          source: "150.24.14.0/24",
+        },
+        {
+          description: "LA",
+          source: "125.191.14.85/32",
+        },
+        {
+          description: "STL",
+          source: "44.98.100.0/24",
+        },
+      ],
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the IP group.
+* `description` - (Optional) The description of the IP group.
+* `rules` - (Optional) One or more pairs specifying the IP group rule (in CIDR format) from which web requests originate.
+* `tags` – (Optional) A map of tags assigned to the WorkSpaces directory. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Nested Blocks
+
+### `rules`
+
+#### Arguments
+
+* `source` - (Required) The IP address range, in CIDR notation, e.g., `10000/16`
+* `description` - (Optional) The description.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The IP group identifier.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WorkSpaces IP groups using their GroupID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import WorkSpaces IP groups using their GroupID. For example:
+
+```console
+% terraform import aws_workspaces_ip_group.example wsipg-488lrtl3k
+```
+
+<!-- cache-key: cdktf-0.18.0 input-4b601bcbe6ec03a647bced3e04fee24a2ec058d79738bc0ec9fc5dbfd30d43de -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/workspaces_workspace.html.markdown b/website/docs/cdktf/typescript/r/workspaces_workspace.html.markdown
new file mode 100644
index 00000000000..c69ddd6a5a9
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/workspaces_workspace.html.markdown
@@ -0,0 +1,123 @@
+---
+subcategory: "WorkSpaces"
+layout: "aws"
+page_title: "AWS: aws_workspaces_workspace"
+description: |-
+  Provides a workspaces in AWS Workspaces Service.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_workspaces_workspace
+
+Provides a workspace in [AWS Workspaces](https://docs.aws.amazon.com/workspaces/latest/adminguide/amazon-workspaces.html) Service
+
+~> **NOTE:** AWS WorkSpaces service requires [`workspacesDefaultRole`](https://docs.aws.amazon.com/workspaces/latest/adminguide/workspaces-access-control.html#create-default-role) IAM role to operate normally.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsWorkspacesBundle } from "./.gen/providers/aws/data-aws-workspaces-bundle";
+import { WorkspacesWorkspace } from "./.gen/providers/aws/workspaces-workspace";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const valueWindows10 = new DataAwsWorkspacesBundle(
+      this,
+      "value_windows_10",
+      {
+        bundleId: "wsb-bh8rsxt14",
+      }
+    );
+    new WorkspacesWorkspace(this, "example", {
+      bundleId: Token.asString(valueWindows10.id),
+      directoryId: Token.asString(awsWorkspacesDirectoryExample.id),
+      rootVolumeEncryptionEnabled: true,
+      tags: {
+        Department: "IT",
+      },
+      userName: "john.doe",
+      userVolumeEncryptionEnabled: true,
+      volumeEncryptionKey: "alias/aws/workspaces",
+      workspaceProperties: {
+        computeTypeName: "VALUE",
+        rootVolumeSizeGib: 80,
+        runningMode: "AUTO_STOP",
+        runningModeAutoStopTimeoutInMinutes: 60,
+        userVolumeSizeGib: 10,
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `directoryId` - (Required) The ID of the directory for the WorkSpace.
+* `bundleId` - (Required) The ID of the bundle for the WorkSpace.
+* `userName` – (Required) The user name of the user for the WorkSpace. This user name must exist in the directory for the WorkSpace.
+* `rootVolumeEncryptionEnabled` - (Optional) Indicates whether the data stored on the root volume is encrypted.
+* `userVolumeEncryptionEnabled` – (Optional) Indicates whether the data stored on the user volume is encrypted.
+* `volumeEncryptionKey` – (Optional) The symmetric AWS KMS customer master key (CMK) used to encrypt data stored on your WorkSpace. Amazon WorkSpaces does not support asymmetric CMKs.
+* `tags` - (Optional) The tags for the WorkSpace. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `workspaceProperties` – (Optional) The WorkSpace properties.
+
+`workspaceProperties` supports the following:
+
+* `computeTypeName` – (Optional) The compute type. For more information, see [Amazon WorkSpaces Bundles](http://aws.amazon.com/workspaces/details/#Amazon_WorkSpaces_Bundles). Valid values are `value`, `standard`, `performance`, `power`, `graphics`, `powerpro`, `graphicspro`, `graphicsG4Dn`, and `graphicsproG4Dn`.
+* `rootVolumeSizeGib` – (Optional) The size of the root volume.
+* `runningMode` – (Optional) The running mode. For more information, see [Manage the WorkSpace Running Mode](https://docs.aws.amazon.com/workspaces/latest/adminguide/running-mode.html). Valid values are `autoStop` and `alwaysOn`.
+* `runningModeAutoStopTimeoutInMinutes` – (Optional) The time after a user logs off when WorkSpaces are automatically stopped. Configured in 60-minute intervals.
+* `userVolumeSizeGib` – (Optional) The size of the user storage.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The workspaces ID.
+* `ipAddress` - The IP address of the WorkSpace.
+* `computerName` - The name of the WorkSpace, as seen by the operating system.
+* `state` - The operational state of the WorkSpace.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `30M`)
+- `update` - (Default `10M`)
+- `delete` - (Default `10M`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Workspaces using their ID. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import Workspaces using their ID. For example:
+
+```console
+% terraform import aws_workspaces_workspace.example ws-9z9zmbkhv
+```
+
+<!-- cache-key: cdktf-0.18.0 input-574adeff5bd705e5554426bab9884c262aeb7fe0041d5694569aac9e50fca556 -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/xray_encryption_config.html.markdown b/website/docs/cdktf/typescript/r/xray_encryption_config.html.markdown
new file mode 100644
index 00000000000..c57c422589a
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/xray_encryption_config.html.markdown
@@ -0,0 +1,128 @@
+---
+subcategory: "X-Ray"
+layout: "aws"
+page_title: "AWS: aws_xray_encryption_config"
+description: |-
+    Creates and manages an AWS XRay Encryption Config.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_xray_encryption_config
+
+Creates and manages an AWS XRay Encryption Config.
+
+~> **NOTE:** Removing this resource from Terraform has no effect to the encryption configuration within X-Ray.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { XrayEncryptionConfig } from "./.gen/providers/aws/xray-encryption-config";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new XrayEncryptionConfig(this, "example", {
+      type: "NONE",
+    });
+  }
+}
+
+```
+
+## Example Usage with KMS Key
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { Token, TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { DataAwsCallerIdentity } from "./.gen/providers/aws/data-aws-caller-identity";
+import { DataAwsIamPolicyDocument } from "./.gen/providers/aws/data-aws-iam-policy-document";
+import { KmsKey } from "./.gen/providers/aws/kms-key";
+import { XrayEncryptionConfig } from "./.gen/providers/aws/xray-encryption-config";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    const current = new DataAwsCallerIdentity(this, "current", {});
+    const example = new DataAwsIamPolicyDocument(this, "example", {
+      statement: [
+        {
+          actions: ["kms:*"],
+          effect: "Allow",
+          principals: [
+            {
+              identifiers: ["arn:aws:iam::${" + current.accountId + "}:root"],
+              type: "AWS",
+            },
+          ],
+          resources: ["*"],
+          sid: "Enable IAM User Permissions",
+        },
+      ],
+    });
+    const awsKmsKeyExample = new KmsKey(this, "example_2", {
+      deletionWindowInDays: 7,
+      description: "Some Key",
+      policy: Token.asString(example.json),
+    });
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsKmsKeyExample.overrideLogicalId("example");
+    const awsXrayEncryptionConfigExample = new XrayEncryptionConfig(
+      this,
+      "example_3",
+      {
+        keyId: Token.asString(awsKmsKeyExample.arn),
+        type: "KMS",
+      }
+    );
+    /*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
+    awsXrayEncryptionConfigExample.overrideLogicalId("example");
+  }
+}
+
+```
+
+## Argument Reference
+
+* `type` - (Required) The type of encryption. Set to `kms` to use your own key for encryption. Set to `none` for default encryption.
+* `keyId` - (Optional) An AWS KMS customer master key (CMK) ARN.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Region name.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import XRay Encryption Config using the region name. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import XRay Encryption Config using the region name. For example:
+
+```console
+% terraform import aws_xray_encryption_config.example us-west-2
+```
+
+<!-- cache-key: cdktf-0.18.0 input-55d226205a72425f4aa1a56a07d4e3a41a8d86c6c3b3f83bf024e6de8c19b0ed -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/xray_group.html.markdown b/website/docs/cdktf/typescript/r/xray_group.html.markdown
new file mode 100644
index 00000000000..22dacae5d81
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/xray_group.html.markdown
@@ -0,0 +1,86 @@
+---
+subcategory: "X-Ray"
+layout: "aws"
+page_title: "AWS: aws_xray_group"
+description: |-
+    Creates and manages an AWS XRay Group.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_xray_group
+
+Creates and manages an AWS XRay Group.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { XrayGroup } from "./.gen/providers/aws/xray-group";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new XrayGroup(this, "example", {
+      filterExpression: "responsetime > 5",
+      groupName: "example",
+      insightsConfiguration: {
+        insightsEnabled: true,
+        notificationsEnabled: true,
+      },
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `groupName` - (Required) The name of the group.
+* `filterExpression` - (Required) The filter expression defining criteria by which to group traces. more info can be found in official [docs](https://docs.aws.amazon.com/xray/latest/devguide/xray-console-filters.html).
+* `insightsConfiguration` - (Optional) Configuration options for enabling insights.
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Nested fields
+
+#### `insightsConfiguration`
+
+* `insightsEnabled` - (Required) Specifies whether insights are enabled.
+* `notificationsEnabled` - (Optional) Specifies whether insight notifications are enabled.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ARN of the Group.
+* `arn` - The ARN of the Group.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import XRay Groups using the ARN. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import XRay Groups using the ARN. For example:
+
+```console
+% terraform import aws_xray_group.example arn:aws:xray:us-west-2:1234567890:group/example-group/TNGX7SW5U6QY36T4ZMOUA3HVLBYCZTWDIOOXY3CJAXTHSS3YCWUA
+```
+
+<!-- cache-key: cdktf-0.18.0 input-9e9af30b9adec288e781cee25a67533fbf3d979628ed12ff8336468434aab2be -->
\ No newline at end of file
diff --git a/website/docs/cdktf/typescript/r/xray_sampling_rule.html.markdown b/website/docs/cdktf/typescript/r/xray_sampling_rule.html.markdown
new file mode 100644
index 00000000000..9bb06a69ba6
--- /dev/null
+++ b/website/docs/cdktf/typescript/r/xray_sampling_rule.html.markdown
@@ -0,0 +1,96 @@
+---
+subcategory: "X-Ray"
+layout: "aws"
+page_title: "AWS: aws_xray_sampling_rule"
+description: |-
+    Creates and manages an AWS XRay Sampling Rule.
+---
+
+
+<!-- Please do not edit this file, it is generated. -->
+# Resource: aws_xray_sampling_rule
+
+Creates and manages an AWS XRay Sampling Rule.
+
+## Example Usage
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+/*
+ * Provider bindings are generated by running `cdktf get`.
+ * See https://cdk.tf/provider-generation for more details.
+ */
+import { XraySamplingRule } from "./.gen/providers/aws/xray-sampling-rule";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+    new XraySamplingRule(this, "example", {
+      attributes: {
+        Hello: "Tris",
+      },
+      fixedRate: 0.05,
+      host: "*",
+      httpMethod: "*",
+      priority: 9999,
+      reservoirSize: 1,
+      resourceArn: "*",
+      ruleName: "example",
+      serviceName: "*",
+      serviceType: "*",
+      urlPath: "*",
+      version: 1,
+    });
+  }
+}
+
+```
+
+## Argument Reference
+
+* `ruleName` - (Required) The name of the sampling rule.
+* `resourceArn` - (Required) Matches the ARN of the AWS resource on which the service runs.
+* `priority` - (Required) The priority of the sampling rule.
+* `fixedRate` - (Required) The percentage of matching requests to instrument, after the reservoir is exhausted.
+* `reservoirSize` - (Required) A fixed number of matching requests to instrument per second, prior to applying the fixed rate. The reservoir is not used directly by services, but applies to all services using the rule collectively.
+* `serviceName` - (Required) Matches the `name` that the service uses to identify itself in segments.
+* `serviceType` - (Required) Matches the `origin` that the service uses to identify its type in segments.
+* `host` - (Required) Matches the hostname from a request URL.
+* `httpMethod` - (Required) Matches the HTTP method of a request.
+* `urlPath` - (Required) Matches the path from a request URL.
+* `version` - (Required) The version of the sampling rule format (`1` )
+* `attributes` - (Optional) Matches attributes derived from the request.
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name of the sampling rule.
+* `arn` - The ARN of the sampling rule.
+* `tagsAll` - A map of tags assigned to the resource, including those inherited from the provider [`defaultTags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import XRay Sampling Rules using the name. For example:
+
+```typescript
+// DO NOT EDIT. Code generated by 'cdktf convert' - Please report bugs at https://cdk.tf/bug
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+class MyConvertedCode extends TerraformStack {
+  constructor(scope: Construct, name: string) {
+    super(scope, name);
+  }
+}
+
+```
+
+Using `terraform import`, import XRay Sampling Rules using the name. For example:
+
+```console
+% terraform import aws_xray_sampling_rule.example example
+```
+
+<!-- cache-key: cdktf-0.18.0 input-3ca0f87f60b2af282993155f8f46c69e0703d25d278651c0017302f1714b4c23 -->
\ No newline at end of file
diff --git a/website/docs/d/acm_certificate.html.markdown b/website/docs/d/acm_certificate.html.markdown
index f8be3c4fb81..d000f1e53cb 100644
--- a/website/docs/d/acm_certificate.html.markdown
+++ b/website/docs/d/acm_certificate.html.markdown
@@ -45,7 +45,9 @@ data "aws_acm_certificate" "rsa_4096" {
 * `types` - (Optional) List of types on which to filter the returned list. Valid values are `AMAZON_ISSUED`, `PRIVATE`, and `IMPORTED`.
 * `most_recent` - (Optional) If set to true, it sorts the certificates matched by previous criteria by the NotBefore field, returning only the most recent one. If set to false, it returns an error if more than one certificate is found. Defaults to false.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the found certificate, suitable for referencing in other resources that support ACM certificates.
 * `id` - ARN of the found certificate, suitable for referencing in other resources that support ACM certificates.
diff --git a/website/docs/d/acmpca_certificate.html.markdown b/website/docs/d/acmpca_certificate.html.markdown
index 36b98cb9bb6..b3b4df66344 100644
--- a/website/docs/d/acmpca_certificate.html.markdown
+++ b/website/docs/d/acmpca_certificate.html.markdown
@@ -21,14 +21,14 @@ data "aws_acmpca_certificate" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `arn` - (Required) ARN of the certificate issued by the private certificate authority.
 * `certificate_authority_arn` - (Required) ARN of the certificate authority.
 
 ## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `certificate` - PEM-encoded certificate value.
 * `certificate_chain` - PEM-encoded certificate chain that includes any intermediate certificates and chains up to root CA.
diff --git a/website/docs/d/acmpca_certificate_authority.html.markdown b/website/docs/d/acmpca_certificate_authority.html.markdown
index b58b46873ad..b6670ea481d 100644
--- a/website/docs/d/acmpca_certificate_authority.html.markdown
+++ b/website/docs/d/acmpca_certificate_authority.html.markdown
@@ -20,13 +20,13 @@ data "aws_acmpca_certificate_authority" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `arn` - (Required) ARN of the certificate authority.
 
 ## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - ARN of the certificate authority.
 * `certificate` - Base64-encoded certificate authority (CA) certificate. Only available after the certificate authority certificate has been imported.
diff --git a/website/docs/d/ami.html.markdown b/website/docs/d/ami.html.markdown
index 04c68f3d714..4d0c0fadb5e 100644
--- a/website/docs/d/ami.html.markdown
+++ b/website/docs/d/ami.html.markdown
@@ -64,7 +64,7 @@ Terraform will fail. Ensure that your search is specific enough to return
 a single AMI ID only, or use `most_recent` to choose the most recent one. If
 you want to match multiple AMIs, use the `aws_ami_ids` data source instead.
 
-## Attributes Reference
+## Attribute Reference
 
 `id` is set to the ID of the found AMI. In addition, the following attributes
 are exported:
diff --git a/website/docs/d/ami_ids.html.markdown b/website/docs/d/ami_ids.html.markdown
index 285ed13df3a..73fd673247a 100644
--- a/website/docs/d/ami_ids.html.markdown
+++ b/website/docs/d/ami_ids.html.markdown
@@ -46,7 +46,7 @@ If no value is specified, the default value is `false`.
 * `include_deprecated` - (Optional) If true, all deprecated AMIs are included in the response.
 If false, no deprecated AMIs are included in the response. If no value is specified, the default value is `false`.
 
-## Attributes Reference
+## Attribute Reference
 
 `ids` is set to the list of AMI IDs, sorted by creation time according to `sort_ascending`.
 
diff --git a/website/docs/d/api_gateway_api_key.html.markdown b/website/docs/d/api_gateway_api_key.html.markdown
index 8e5dcd0ffb2..cda11bc4d2a 100644
--- a/website/docs/d/api_gateway_api_key.html.markdown
+++ b/website/docs/d/api_gateway_api_key.html.markdown
@@ -23,13 +23,16 @@ data "aws_api_gateway_api_key" "my_api_key" {
 
 * `id` - (Required) ID of the API Key to look up.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - Set to the ID of the API Key.
 * `name` - Set to the name of the API Key.
 * `value` - Set to the value of the API Key.
 * `created_date` - Date and time when the API Key was created.
 * `last_updated_date` - Date and time when the API Key was last updated.
+* `customer_id` - Amazon Web Services Marketplace customer identifier, when integrating with the Amazon Web Services SaaS Marketplace.
 * `description` - Description of the API Key.
 * `enabled` - Whether the API Key is enabled.
 * `tags` - Map of tags for the resource.
diff --git a/website/docs/d/api_gateway_authorizer.html.markdown b/website/docs/d/api_gateway_authorizer.html.markdown
index d7189176479..6a36dc32564 100644
--- a/website/docs/d/api_gateway_authorizer.html.markdown
+++ b/website/docs/d/api_gateway_authorizer.html.markdown
@@ -26,9 +26,9 @@ The following arguments are required:
 * `authorizer_id` - (Required) Authorizer identifier.
 * `rest_api_id` - (Required) ID of the associated REST API.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the API Gateway Authorizer.
 * `authorizer_credentials` - Credentials required for the authorizer.
diff --git a/website/docs/d/api_gateway_authorizers.html.markdown b/website/docs/d/api_gateway_authorizers.html.markdown
index 88a25085254..6cbaf300a8e 100644
--- a/website/docs/d/api_gateway_authorizers.html.markdown
+++ b/website/docs/d/api_gateway_authorizers.html.markdown
@@ -24,8 +24,8 @@ The following arguments are required:
 
 * `rest_api_id` - (Required) ID of the associated REST API.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `ids` - List of Authorizer identifiers.
diff --git a/website/docs/d/api_gateway_domain_name.html.markdown b/website/docs/d/api_gateway_domain_name.html.markdown
index fd74b595ad2..a02d4393182 100644
--- a/website/docs/d/api_gateway_domain_name.html.markdown
+++ b/website/docs/d/api_gateway_domain_name.html.markdown
@@ -22,9 +22,9 @@ data "aws_api_gateway_domain_name" "example" {
 
 * `domain_name` - (Required) Fully-qualified domain name to look up. If no domain name is found, an error will be returned.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to the arguments, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the found custom domain name.
 * `certificate_arn` - ARN for an AWS-managed certificate that is used by edge-optimized endpoint for this domain name.
diff --git a/website/docs/d/api_gateway_export.html.markdown b/website/docs/d/api_gateway_export.html.markdown
index aa89433846b..784016013ee 100644
--- a/website/docs/d/api_gateway_export.html.markdown
+++ b/website/docs/d/api_gateway_export.html.markdown
@@ -26,7 +26,9 @@ data "aws_api_gateway_export" "example" {
 * `accepts` - (Optional) Content-type of the export. Valid values are `application/json` and `application/yaml` are supported for `export_type` `ofoas30` and `swagger`.
 * `parameters` - (Optional) Key-value map of query string parameters that specify properties of the export. the following parameters are supported: `extensions='integrations'` or `extensions='apigateway'` will export the API with x-amazon-apigateway-integration extensions. `extensions='authorizers'` will export the API with x-amazon-apigateway-authorizer extensions.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - The `REST-API-ID:STAGE-NAME`
 * `body` - API Spec.
diff --git a/website/docs/d/api_gateway_resource.html.markdown b/website/docs/d/api_gateway_resource.html.markdown
index cfb5b02ba58..4d705939bdb 100644
--- a/website/docs/d/api_gateway_resource.html.markdown
+++ b/website/docs/d/api_gateway_resource.html.markdown
@@ -29,7 +29,9 @@ data "aws_api_gateway_resource" "my_resource" {
 * `rest_api_id` - (Required) REST API id that owns the resource. If no REST API is found, an error will be returned.
 * `path` - (Required) Full path of the resource.  If no path is found, an error will be returned.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - Set to the ID of the found Resource.
 * `parent_id` - Set to the ID of the parent Resource.
diff --git a/website/docs/d/api_gateway_rest_api.html.markdown b/website/docs/d/api_gateway_rest_api.html.markdown
index 1abf576fa72..0bdf325f9b5 100644
--- a/website/docs/d/api_gateway_rest_api.html.markdown
+++ b/website/docs/d/api_gateway_rest_api.html.markdown
@@ -25,7 +25,9 @@ data "aws_api_gateway_rest_api" "my_rest_api" {
 
 * `name` - (Required) Name of the REST API to look up. If no REST API is found with this name, an error will be returned. If multiple REST APIs are found with this name, an error will be returned.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `api_key_source` - Source of the API key for requests.
 * `arn` - ARN of the REST API.
diff --git a/website/docs/d/api_gateway_sdk.html.markdown b/website/docs/d/api_gateway_sdk.html.markdown
index a74dc91c138..200239f0bc8 100644
--- a/website/docs/d/api_gateway_sdk.html.markdown
+++ b/website/docs/d/api_gateway_sdk.html.markdown
@@ -32,7 +32,9 @@ data "aws_api_gateway_sdk" "example" {
 * `sdk_type` - (Required) Language for the generated SDK. Currently `java`, `javascript`, `android`, `objectivec` (for iOS), `swift` (for iOS), and `ruby` are supported.
 * `parameters` - (Optional) Key-value map of query string parameters `sdk_type` properties of the SDK. For SDK Type of `objectivec` or `swift`, a parameter named `classPrefix` is required. For SDK Type of `android`, parameters named `groupId`, `artifactId`, `artifactVersion`, and `invokerPackage` are required. For SDK Type of `java`, parameters named `serviceName` and `javaPackageName` are required.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - The `REST-API-ID:STAGE-NAME`
 * `body` - SDK as a string.
diff --git a/website/docs/d/api_gateway_vpc_link.html.markdown b/website/docs/d/api_gateway_vpc_link.html.markdown
index 44864e4e937..200922922e5 100644
--- a/website/docs/d/api_gateway_vpc_link.html.markdown
+++ b/website/docs/d/api_gateway_vpc_link.html.markdown
@@ -26,7 +26,9 @@ data "aws_api_gateway_vpc_link" "my_api_gateway_vpc_link" {
 * `name` - (Required) Name of the API Gateway VPC Link to look up. If no API Gateway VPC Link is found with this name, an error will be returned.
  If multiple API Gateway VPC Links are found with this name, an error will be returned.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - Set to the ID of the found API Gateway VPC Link.
 * `description` - Description of the VPC link.
diff --git a/website/docs/d/apigatewayv2_api.html.markdown b/website/docs/d/apigatewayv2_api.html.markdown
index ffe9f7558f0..7629375d4e1 100644
--- a/website/docs/d/apigatewayv2_api.html.markdown
+++ b/website/docs/d/apigatewayv2_api.html.markdown
@@ -23,13 +23,13 @@ data "aws_apigatewayv2_api" "example" {
 The arguments of this data source act as filters for querying the available APIs in the current region.
 The given filters must match exactly one API whose data will be exported as attributes.
 
-The following arguments are supported:
+This argument supports the following arguments:
 
 * `api_id` - (Required) API identifier.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `api_endpoint` - URI of the API, of the form `https://{api-id}.execute-api.{region}.amazonaws.com` for HTTP APIs and `wss://{api-id}.execute-api.{region}.amazonaws.com` for WebSocket APIs.
 * `api_key_selection_expression` - An [API key selection expression](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-websocket-api-selection-expressions.html#apigateway-websocket-api-apikey-selection-expressions).
diff --git a/website/docs/d/apigatewayv2_apis.html.markdown b/website/docs/d/apigatewayv2_apis.html.markdown
index 4e17548f499..2afc17c5120 100644
--- a/website/docs/d/apigatewayv2_apis.html.markdown
+++ b/website/docs/d/apigatewayv2_apis.html.markdown
@@ -20,15 +20,15 @@ data "aws_apigatewayv2_apis" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `name` - (Optional) API name.
 * `protocol_type` - (Optional) API protocol.
 * `tags` - (Optional) Map of tags, each pair of which must exactly match
   a pair on the desired APIs.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `ids` - Set of API identifiers.
diff --git a/website/docs/d/apigatewayv2_export.html.markdown b/website/docs/d/apigatewayv2_export.html.markdown
index 47005d8c169..4be95b17736 100644
--- a/website/docs/d/apigatewayv2_export.html.markdown
+++ b/website/docs/d/apigatewayv2_export.html.markdown
@@ -22,7 +22,7 @@ data "aws_apigatewayv2_export" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `api_id` - (Required) API identifier.
 * `specification` - (Required) Version of the API specification to use. `OAS30`, for OpenAPI 3.0, is the only supported value.
@@ -31,9 +31,9 @@ The following arguments are supported:
 * `include_extensions` - (Optional) Whether to include API Gateway extensions in the exported API definition. API Gateway extensions are included by default.
 * `stage_name` - (Optional) Name of the API stage to export. If you don't specify this property, a representation of the latest API configuration is exported.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - API identifier.
 * `body` - ID of the API.
diff --git a/website/docs/d/appconfig_configuration_profile.html.markdown b/website/docs/d/appconfig_configuration_profile.html.markdown
index f8f61287ea9..90a5c85f634 100644
--- a/website/docs/d/appconfig_configuration_profile.html.markdown
+++ b/website/docs/d/appconfig_configuration_profile.html.markdown
@@ -28,9 +28,9 @@ The following arguments are required:
 * `application_id` - (Required) ID of the AppConfig application to which this configuration profile belongs.
 * `configuration_profile_id` - (Required) ID of the Configuration Profile.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the Configuration Profile.
 * `description` - Description of the Configuration Profile.
diff --git a/website/docs/d/appconfig_configuration_profiles.html.markdown b/website/docs/d/appconfig_configuration_profiles.html.markdown
index efcbaadd697..322f5cb2c15 100644
--- a/website/docs/d/appconfig_configuration_profiles.html.markdown
+++ b/website/docs/d/appconfig_configuration_profiles.html.markdown
@@ -33,8 +33,8 @@ The following arguments are required:
 
 * `application_id` - (Required) ID of the AppConfig Application.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `configuration_profile_ids` - Set of Configuration Profile IDs associated with the AppConfig Application.
diff --git a/website/docs/d/appconfig_environment.html.markdown b/website/docs/d/appconfig_environment.html.markdown
index c419fb9f630..788b6702e25 100644
--- a/website/docs/d/appconfig_environment.html.markdown
+++ b/website/docs/d/appconfig_environment.html.markdown
@@ -28,9 +28,9 @@ The following arguments are required:
 * `application_id` - (Required) ID of the AppConfig Application to which this Environment belongs.
 * `environment_id` - (Required) ID of the AppConfig Environment.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the environment.
 * `name` - Name of the environment.
diff --git a/website/docs/d/appconfig_environments.html.markdown b/website/docs/d/appconfig_environments.html.markdown
index 8eb7c0abac7..3b12d5f1e16 100644
--- a/website/docs/d/appconfig_environments.html.markdown
+++ b/website/docs/d/appconfig_environments.html.markdown
@@ -27,8 +27,8 @@ The following arguments are required:
 
 * `application_id` - (Required) ID of the AppConfig Application.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `environment_ids` - Set of Environment IDs associated with this AppConfig Application.
diff --git a/website/docs/d/appintegrations_event_integration.html.markdown b/website/docs/d/appintegrations_event_integration.html.markdown
index 98f566f283c..12d701a18ed 100644
--- a/website/docs/d/appintegrations_event_integration.html.markdown
+++ b/website/docs/d/appintegrations_event_integration.html.markdown
@@ -20,13 +20,13 @@ data "aws_appintegrations_event_integration" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `name` - (Required) The AppIntegrations Event Integration name.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to the arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - The ARN of the AppIntegrations Event Integration.
 * `description` - The description of the Event Integration.
@@ -37,6 +37,6 @@ In addition to the arguments above, the following attributes are exported:
 
 ### Event Filter Attributes
 
-For **event_filter** the following attributes are supported:
+`event_filter` has the following attributes:
 
 * `source` - The source of the events.
diff --git a/website/docs/d/appmesh_gateway_route.html.markdown b/website/docs/d/appmesh_gateway_route.html.markdown
index ae6d8ce1be4..153c546ebd6 100644
--- a/website/docs/d/appmesh_gateway_route.html.markdown
+++ b/website/docs/d/appmesh_gateway_route.html.markdown
@@ -22,16 +22,16 @@ data "aws_appmesh_gateway_route" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `name` - (Required) Name of the gateway route.
 * `mesh_name` - (Required) Name of the service mesh in which the virtual gateway exists.
 * `virtual_gateway_name` - (Required) Name of the virtual gateway in which the route exists.
 * `mesh_owner` - (Optional) AWS account ID of the service mesh's owner.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the gateway route.
 * `created_date` - Creation date of the gateway route.
diff --git a/website/docs/d/appmesh_mesh.html.markdown b/website/docs/d/appmesh_mesh.html.markdown
index 1a05c2b7a6d..093a0ec14c2 100644
--- a/website/docs/d/appmesh_mesh.html.markdown
+++ b/website/docs/d/appmesh_mesh.html.markdown
@@ -29,14 +29,14 @@ data "aws_appmesh_mesh" "simple" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `name` - (Required) Name of the service mesh.
 * `mesh_owner` - (Optional) AWS account ID of the service mesh's owner.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the service mesh.
 * `created_date` - Creation date of the service mesh.
diff --git a/website/docs/d/appmesh_route.html.markdown b/website/docs/d/appmesh_route.html.markdown
index 1c5ee0d9afe..e7eb09addc7 100644
--- a/website/docs/d/appmesh_route.html.markdown
+++ b/website/docs/d/appmesh_route.html.markdown
@@ -22,16 +22,16 @@ data "aws_appmesh_virtual_service" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `name` - (Required) Name of the route.
 * `mesh_name` - (Required) Name of the service mesh in which the virtual router exists.
 * `virtual_router_name` - (Required) Name of the virtual router in which the route exists.
 * `mesh_owner` - (Optional) AWS account ID of the service mesh's owner.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the route.
 * `created_date` - Creation date of the route.
diff --git a/website/docs/d/appmesh_virtual_gateway.html.markdown b/website/docs/d/appmesh_virtual_gateway.html.markdown
index 6200ca4873d..27d55432924 100644
--- a/website/docs/d/appmesh_virtual_gateway.html.markdown
+++ b/website/docs/d/appmesh_virtual_gateway.html.markdown
@@ -39,9 +39,9 @@ The following arguments are required:
 * `mesh_name` - (Required) Name of the service mesh in which the virtual gateway exists.
 * `mesh_owner` - (Optional) AWS account ID of the service mesh's owner.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the virtual gateway.
 * `created_date` - Creation date of the virtual gateway.
diff --git a/website/docs/d/appmesh_virtual_node.html.markdown b/website/docs/d/appmesh_virtual_node.html.markdown
index 86f097c1c25..08325d54087 100644
--- a/website/docs/d/appmesh_virtual_node.html.markdown
+++ b/website/docs/d/appmesh_virtual_node.html.markdown
@@ -21,15 +21,15 @@ data "aws_appmesh_virtual_node" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `name` - (Required) Name of the virtual node.
 * `mesh_name` - (Required) Name of the service mesh in which the virtual node exists.
 * `mesh_owner` - (Optional) AWS account ID of the service mesh's owner.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the virtual node.
 * `created_date` - Creation date of the virtual node.
diff --git a/website/docs/d/appmesh_virtual_router.html.markdown b/website/docs/d/appmesh_virtual_router.html.markdown
index 36a830de7f2..adb986d0d55 100644
--- a/website/docs/d/appmesh_virtual_router.html.markdown
+++ b/website/docs/d/appmesh_virtual_router.html.markdown
@@ -21,14 +21,14 @@ data "aws_appmesh_virtual_router" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `name` - (Required) Name of the virtual router.
 * `mesh_name` - (Required) Name of the mesh in which the virtual router exists
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the virtual router.
 * `created_date` - Creation date of the virtual router.
diff --git a/website/docs/d/appmesh_virtual_service.html.markdown b/website/docs/d/appmesh_virtual_service.html.markdown
index afdcbb45e5b..2181ab82b56 100644
--- a/website/docs/d/appmesh_virtual_service.html.markdown
+++ b/website/docs/d/appmesh_virtual_service.html.markdown
@@ -31,15 +31,15 @@ data "aws_appmesh_virtual_service" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `name` - (Required) Name of the virtual service.
 * `mesh_name` - (Required) Name of the service mesh in which the virtual service exists.
 * `mesh_owner` - (Optional) AWS account ID of the service mesh's owner.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the virtual service.
 * `created_date` - Creation date of the virtual service.
diff --git a/website/docs/d/arn.html.markdown b/website/docs/d/arn.html.markdown
index 8bce94e65d0..13af95690e4 100644
--- a/website/docs/d/arn.html.markdown
+++ b/website/docs/d/arn.html.markdown
@@ -20,13 +20,13 @@ data "aws_arn" "db_instance" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `arn` - (Required) ARN to parse.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `partition` - Partition that the resource is in.
 
diff --git a/website/docs/d/auditmanager_control.html.markdown b/website/docs/d/auditmanager_control.html.markdown
index 86c96114c9c..1f3dfb54b49 100644
--- a/website/docs/d/auditmanager_control.html.markdown
+++ b/website/docs/d/auditmanager_control.html.markdown
@@ -59,6 +59,6 @@ The following arguments are required:
 * `name` - (Required) Name of the control.
 * `type` - (Required) Type of control. Valid values are `Custom` and `Standard`.
 
-## Attributes Reference
+## Attribute Reference
 
 See the [`aws_auditmanager_control` resource](/docs/providers/aws/r/auditmanager_control.html) for details on the returned attributes - they are identical.
diff --git a/website/docs/d/auditmanager_framework.html.markdown b/website/docs/d/auditmanager_framework.html.markdown
index 8e48e2a1606..df4da66fbba 100644
--- a/website/docs/d/auditmanager_framework.html.markdown
+++ b/website/docs/d/auditmanager_framework.html.markdown
@@ -28,6 +28,6 @@ The following arguments are required:
 * `name` - (Required) Name of the framework.
 * `type` - (Required) Type of framework. Valid values are `Custom` and `Standard`.
 
-## Attributes Reference
+## Attribute Reference
 
 See the [`aws_auditmanager_framework` resource](/docs/providers/aws/r/auditmanager_framework.html) for details on the returned attributes - they are identical.
diff --git a/website/docs/d/autoscaling_group.html.markdown b/website/docs/d/autoscaling_group.html.markdown
index ff1045a63b0..e8b295e5d37 100644
--- a/website/docs/d/autoscaling_group.html.markdown
+++ b/website/docs/d/autoscaling_group.html.markdown
@@ -22,7 +22,7 @@ data "aws_autoscaling_group" "foo" {
 
 * `name` - Specify the exact name of the desired autoscaling group.
 
-## Attributes Reference
+## Attribute Reference
 
 ~> **NOTE:** Some values are not always set and may not be available for
 interpolation.
diff --git a/website/docs/d/autoscaling_groups.html.markdown b/website/docs/d/autoscaling_groups.html.markdown
index 20743356d77..7a06385c437 100644
--- a/website/docs/d/autoscaling_groups.html.markdown
+++ b/website/docs/d/autoscaling_groups.html.markdown
@@ -47,9 +47,9 @@ resource "aws_autoscaling_notification" "slack_notifications" {
     * `name` - (Required) Name of the DescribeAutoScalingGroup filter. The recommended values are: `tag-key`, `tag-value`, and `tag:<tag name>`
     * `values` - (Required) Value of the filter.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arns` - List of the Autoscaling Groups Arns in the current region.
 * `id` - AWS Region.
diff --git a/website/docs/d/availability_zone.html.markdown b/website/docs/d/availability_zone.html.markdown
index bb21400f11d..1641e1e2e70 100644
--- a/website/docs/d/availability_zone.html.markdown
+++ b/website/docs/d/availability_zone.html.markdown
@@ -82,14 +82,14 @@ zone whose data will be exported as attributes.
 
 ### filter Configuration Block
 
-The following arguments are supported by the `filter` configuration block:
+The `filter` configuration block supports the following arguments:
 
 * `name` - (Required) Name of the filter field. Valid values can be found in the [EC2 DescribeAvailabilityZones API Reference](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeAvailabilityZones.html).
 * `values` - (Required) Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `group_name` - For Availability Zones, this is the same value as the Region name. For Local Zones, the name of the associated group, for example `us-west-2-lax-1`.
 * `name_suffix` - Part of the AZ name that appears after the region name, uniquely identifying the AZ within its region.
diff --git a/website/docs/d/availability_zones.html.markdown b/website/docs/d/availability_zones.html.markdown
index a0b35cd158d..286ae6ef7c9 100644
--- a/website/docs/d/availability_zones.html.markdown
+++ b/website/docs/d/availability_zones.html.markdown
@@ -70,7 +70,7 @@ data "aws_availability_zones" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `all_availability_zones` - (Optional) Set to `true` to include all Availability Zones and Local Zones regardless of your opt in status.
 * `filter` - (Optional) Configuration block(s) for filtering. Detailed below.
@@ -83,14 +83,14 @@ to which the underlying AWS account has access, regardless of their state.
 
 ### filter Configuration Block
 
-The following arguments are supported by the `filter` configuration block:
+The `filter` configuration block supports the following arguments:
 
 * `name` - (Required) Name of the filter field. Valid values can be found in the [EC2 DescribeAvailabilityZones API Reference](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeAvailabilityZones.html).
 * `values` - (Required) Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `group_names` A set of the Availability Zone Group names. For Availability Zones, this is the same value as the Region name. For Local Zones, the name of the associated group, for example `us-west-2-lax-1`.
 * `id` - Region of the Availability Zones.
diff --git a/website/docs/d/backup_framework.html.markdown b/website/docs/d/backup_framework.html.markdown
index 53c04e84cea..ff4b4c6a6a9 100644
--- a/website/docs/d/backup_framework.html.markdown
+++ b/website/docs/d/backup_framework.html.markdown
@@ -20,13 +20,13 @@ data "aws_backup_framework" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `name` - (Required) Backup framework name.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to the arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the backup framework.
 * `control` - One or more control blocks that make up the framework. Each control in the list has a name, input parameters, and scope. Detailed below.
@@ -39,7 +39,7 @@ In addition to the arguments above, the following attributes are exported:
 
 ### Control Attributes
 
-For **control** the following attributes are supported:
+`control` has the following attributes:
 
 * `input_parameter` - One or more input parameter blocks. An example of a control with two parameters is: "backup plan frequency is at least daily and the retention period is at least 1 year". The first parameter is daily. The second parameter is 1 year. Detailed below.
 * `name` - Name of a control.
@@ -47,14 +47,14 @@ For **control** the following attributes are supported:
 
 ### Input Parameter Attributes
 
-For **input_parameter** the following attributes are supported:
+`input_parameter` has the following attributes:
 
 * `name` - Name of a parameter, for example, BackupPlanFrequency.
 * `value` - Value of parameter, for example, hourly.
 
 ### Scope Attributes
 
-For **scope** the following attributes are supported:
+`scope` has the following attributes:
 
 * `compliance_resource_ids` - The ID of the only AWS resource that you want your control scope to contain.
 * `compliance_resource_types` - Describes whether the control scope includes one or more types of resources, such as EFS or RDS.
diff --git a/website/docs/d/backup_plan.html.markdown b/website/docs/d/backup_plan.html.markdown
index 91e870f9163..a1b18fce908 100644
--- a/website/docs/d/backup_plan.html.markdown
+++ b/website/docs/d/backup_plan.html.markdown
@@ -20,13 +20,13 @@ data "aws_backup_plan" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `plan_id` - (Required) Backup plan ID.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to the arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the backup plan.
 * `name` - Display name of a backup plan.
diff --git a/website/docs/d/backup_report_plan.html.markdown b/website/docs/d/backup_report_plan.html.markdown
index 3bc0ff04eed..a3806699768 100644
--- a/website/docs/d/backup_report_plan.html.markdown
+++ b/website/docs/d/backup_report_plan.html.markdown
@@ -20,13 +20,13 @@ data "aws_backup_report_plan" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `name` - (Required) Backup report plan name.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to the arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the backup report plan.
 * `creation_time` - Date and time that a report plan is created, in Unix format and Coordinated Universal Time (UTC).
@@ -39,7 +39,7 @@ In addition to the arguments above, the following attributes are exported:
 
 ### Report Delivery Channel Attributes
 
-For **report_delivery_channel** the following attributes are supported:
+`report_delivery_channel` has the following attributes:
 
 * `formats` - List of the format of your reports: CSV, JSON, or both.
 * `s3_bucket_name` - Unique name of the S3 bucket that receives your reports.
@@ -47,7 +47,7 @@ For **report_delivery_channel** the following attributes are supported:
 
 ### Report Setting Attributes
 
-For **report_setting** the following attributes are supported:
+`report_setting` has the following attributes:
 
 * `accounts` - (Optional) Specifies the list of accounts a report covers.
 * `framework_arns` - ARNs of the frameworks a report covers.
diff --git a/website/docs/d/backup_selection.html.markdown b/website/docs/d/backup_selection.html.markdown
index 6b6c7ef44f6..9eb23f70796 100644
--- a/website/docs/d/backup_selection.html.markdown
+++ b/website/docs/d/backup_selection.html.markdown
@@ -6,7 +6,7 @@ description: |-
   Provides details about an AWS Backup selection.
 ---
 
-# Data source: aws_backup_selection
+# Data Source: aws_backup_selection
 
 Use this data source to get information on an existing backup selection.
 
@@ -21,14 +21,14 @@ data "aws_backup_selection" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `plan_id` - (Required) Backup plan ID associated with the selection of resources.
 * `selection_id` - (Required) Backup selection ID.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are available:
+This data source exports the following attributes in addition to the arguments above:
 
 * `name` - Display name of a resource selection document.
 * `iam_role_arn` - ARN of the IAM role that AWS Backup uses to authenticate when restoring and backing up the target resource. See the [AWS Backup Developer Guide](https://docs.aws.amazon.com/aws-backup/latest/devguide/access-control.html#managed-policies) for additional information about using AWS managed policies or creating custom policies attached to the IAM role.
diff --git a/website/docs/d/backup_vault.html.markdown b/website/docs/d/backup_vault.html.markdown
index 5db989724fa..c37e7e98192 100644
--- a/website/docs/d/backup_vault.html.markdown
+++ b/website/docs/d/backup_vault.html.markdown
@@ -20,13 +20,13 @@ data "aws_backup_vault" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `name` - (Required) Name of the backup vault.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the vault.
 * `kms_key_arn` - Server-side encryption key that is used to protect your backups.
diff --git a/website/docs/d/batch_compute_environment.html.markdown b/website/docs/d/batch_compute_environment.html.markdown
index 2ebb3ae7607..85e37ca542d 100644
--- a/website/docs/d/batch_compute_environment.html.markdown
+++ b/website/docs/d/batch_compute_environment.html.markdown
@@ -21,13 +21,13 @@ data "aws_batch_compute_environment" "batch-mongo" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `compute_environment_name` - (Required) Name of the Batch Compute Environment
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the compute environment.
 * `ecs_cluster_arn` - ARN of the underlying Amazon ECS cluster used by the compute environment.
diff --git a/website/docs/d/batch_job_queue.html.markdown b/website/docs/d/batch_job_queue.html.markdown
index 4f52a5d0e79..7b122cae84d 100644
--- a/website/docs/d/batch_job_queue.html.markdown
+++ b/website/docs/d/batch_job_queue.html.markdown
@@ -21,13 +21,13 @@ data "aws_batch_job_queue" "test-queue" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `name` - (Required) Name of the job queue.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the job queue.
 * `scheduling_policy_arn` - The ARN of the fair share scheduling policy. If this attribute has a value, the job queue uses a fair share scheduling policy. If this attribute does not have a value, the job queue uses a first in, first out (FIFO) scheduling policy.
diff --git a/website/docs/d/batch_scheduling_policy.html.markdown b/website/docs/d/batch_scheduling_policy.html.markdown
index 38e79823f02..9ce8e0ccdea 100644
--- a/website/docs/d/batch_scheduling_policy.html.markdown
+++ b/website/docs/d/batch_scheduling_policy.html.markdown
@@ -20,13 +20,13 @@ data "aws_batch_scheduling_policy" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `arn` - (Required) ARN of the scheduling policy.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all the arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `fairshare_policy` - Fairshare policy block specifies the `compute_reservation`, `share_delay_seconds`, and `share_distribution` of the scheduling policy. The `fairshare_policy` block is documented below.
 * `name` - Name of the scheduling policy.
diff --git a/website/docs/d/billing_service_account.html.markdown b/website/docs/d/billing_service_account.html.markdown
index 680af8db557..d998359df9f 100644
--- a/website/docs/d/billing_service_account.html.markdown
+++ b/website/docs/d/billing_service_account.html.markdown
@@ -60,7 +60,9 @@ resource "aws_s3_bucket_policy" "allow_billing_logging" {
 }
 ```
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - ID of the AWS billing service account.
 * `arn` - ARN of the AWS billing service account.
diff --git a/website/docs/d/budgets_budget.html.markdown b/website/docs/d/budgets_budget.html.markdown
index 9597fd3d775..9c949509cfb 100644
--- a/website/docs/d/budgets_budget.html.markdown
+++ b/website/docs/d/budgets_budget.html.markdown
@@ -31,21 +31,22 @@ The following arguments are optional:
 * `account_id` - The ID of the target account for budget. Will use current user's account_id by default if omitted.
 * `name_prefix` - The prefix of the name of a budget. Unique within accounts.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `auto_adjust_data` - Object containing [AutoAdjustData] which determines the budget amount for an auto-adjusting budget.
+* `budget_exceeded` - Boolean indicating whether this budget has been exceeded.
+* `budget_limit` - The total amount of cost, usage, RI utilization, RI coverage, Savings Plans utilization, or Savings Plans coverage that you want to track with your budget. Contains object [Spend](#spend).
 * `budget_type` - Whether this budget tracks monetary cost or usage.
-* `budget_limit` - The total amount of cost, usage, RI utilization, RI coverage, Savings Plans utilization, or Savings Plans coverage that you want to track with your budget. Contains object [Spend](#spend)
 * `calculated_spend` - The spend objects that are associated with this budget. The [actualSpend](#actual-spend) tracks how much you've used, cost, usage, RI units, or Savings Plans units and the [forecastedSpend](#forecasted-spend) tracks how much that you're predicted to spend based on your historical usage profile.
 * `cost_filter` - A list of [CostFilter](#cost-filter) name/values pair to apply to budget.
 * `cost_types` - Object containing [CostTypes](#cost-types) The types of cost included in a budget, such as tax and subscriptions.
+* `notification` - Object containing [Budget Notifications](#budget-notification). Can be used multiple times to define more than one budget notification.
+* `planned_limit` - Object containing [Planned Budget Limits](#planned-budget-limits). Can be used multiple times to plan more than one budget limit. See [PlannedBudgetLimits](https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_budgets_Budget.html#awscostmanagement-Type-budgets_Budget-PlannedBudgetLimits) documentation.
 * `time_period_end` - The end of the time period covered by the budget. There are no restrictions on the end date. Format: `2017-01-01_12:00`.
 * `time_period_start` - The start of the time period covered by the budget. If you don't specify a start date, AWS defaults to the start of your chosen time period. The start date must come before the end date. Format: `2017-01-01_12:00`.
 * `time_unit` - The length of time until a budget resets the actual and forecasted spend. Valid values: `MONTHLY`, `QUARTERLY`, `ANNUALLY`, and `DAILY`.
-* `notification` - Object containing [Budget Notifications](#budget-notification). Can be used multiple times to define more than one budget notification.
-* `planned_limit` - Object containing [Planned Budget Limits](#planned-budget-limits). Can be used multiple times to plan more than one budget limit. See [PlannedBudgetLimits](https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_budgets_Budget.html#awscostmanagement-Type-budgets_Budget-PlannedBudgetLimits) documentation.
 
 ### Actual Spend
 
@@ -55,9 +56,9 @@ The amount of cost, usage, RI units, or Savings Plans units that you used. Type
 
 The parameters that determine the budget amount for an auto-adjusting budget.
 
-`auto_adjust_type` (Required) - The string that defines whether your budget auto-adjusts based on historical or forecasted data. Valid values: `FORECAST`,`HISTORICAL`
-`historical_options` (Optional) - Configuration block of [Historical Options](#historical-options). Required for `auto_adjust_type` of `HISTORICAL` Configuration block that defines the historical data that your auto-adjusting budget is based on.
-`last_auto_adjust_time` (Optional) - The last time that your budget was auto-adjusted.
+* `auto_adjust_type` (Required) - The string that defines whether your budget auto-adjusts based on historical or forecasted data. Valid values: `FORECAST`,`HISTORICAL`.
+* `historical_options` (Optional) - Configuration block of [Historical Options](#historical-options). Required for `auto_adjust_type` of `HISTORICAL` Configuration block that defines the historical data that your auto-adjusting budget is based on.
+* `last_auto_adjust_time` (Optional) - The last time that your budget was auto-adjusted.
 
 ### Budget Notification
 
@@ -66,7 +67,7 @@ Valid keys for `notification` parameter.
 * `comparison_operator` - (Required) Comparison operator to use to evaluate the condition. Can be `LESS_THAN`, `EQUAL_TO` or `GREATER_THAN`.
 * `threshold` - (Required) Threshold when the notification should be sent.
 * `threshold_type` - (Required) What kind of threshold is defined. Can be `PERCENTAGE` OR `ABSOLUTE_VALUE`.
-* `notification_type` - (Required) What kind of budget value to notify on. Can be `ACTUAL` or `FORECASTED`
+* `notification_type` - (Required) What kind of budget value to notify on. Can be `ACTUAL` or `FORECASTED`.
 * `subscriber_email_addresses` - (Optional) E-Mail addresses to notify. Either this or `subscriber_sns_topic_arns` is required.
 * `subscriber_sns_topic_arns` - (Optional) SNS topics to notify. Either this or `subscriber_email_addresses` is required.
 
@@ -95,17 +96,17 @@ Refer to [AWS CostFilter documentation](https://docs.aws.amazon.com/cost-managem
 
 Valid keys for `cost_types` parameter.
 
-* `include_credit` - A boolean value whether to include credits in the cost budget. Defaults to `true`
-* `include_discount` - Whether a budget includes discounts. Defaults to `true`
-* `include_other_subscription` - A boolean value whether to include other subscription costs in the cost budget. Defaults to `true`
-* `include_recurring` - A boolean value whether to include recurring costs in the cost budget. Defaults to `true`
-* `include_refund` - A boolean value whether to include refunds in the cost budget. Defaults to `true`
-* `include_subscription` - A boolean value whether to include subscriptions in the cost budget. Defaults to `true`
-* `include_support` - A boolean value whether to include support costs in the cost budget. Defaults to `true`
-* `include_tax` - A boolean value whether to include tax in the cost budget. Defaults to `true`
-* `include_upfront` - A boolean value whether to include upfront costs in the cost budget. Defaults to `true`
-* `use_amortized` - Whether a budget uses the amortized rate. Defaults to `false`
-* `use_blended` - A boolean value whether to use blended costs in the cost budget. Defaults to `false`
+* `include_credit` - A boolean value whether to include credits in the cost budget. Defaults to `true`.
+* `include_discount` - Whether a budget includes discounts. Defaults to `true`.
+* `include_other_subscription` - A boolean value whether to include other subscription costs in the cost budget. Defaults to `true`.
+* `include_recurring` - A boolean value whether to include recurring costs in the cost budget. Defaults to `true`.
+* `include_refund` - A boolean value whether to include refunds in the cost budget. Defaults to `true`.
+* `include_subscription` - A boolean value whether to include subscriptions in the cost budget. Defaults to `true`.
+* `include_support` - A boolean value whether to include support costs in the cost budget. Defaults to `true`.
+* `include_tax` - A boolean value whether to include tax in the cost budget. Defaults to `true`.
+* `include_upfront` - A boolean value whether to include upfront costs in the cost budget. Defaults to `true`.
+* `use_amortized` - Whether a budget uses the amortized rate. Defaults to `false`.
+* `use_blended` - A boolean value whether to use blended costs in the cost budget. Defaults to `false`.
 
 Refer to [AWS CostTypes documentation](https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_budgets_CostTypes.html) for further detail.
 
@@ -116,18 +117,18 @@ Type is [Spend](#spend)
 
 ### Historical Options
 
-`budget_adjustment_period` (Required) - The number of budget periods included in the moving-average calculation that determines your auto-adjusted budget amount.
-`lookback_available_periods` (Optional) - The integer that describes how many budget periods in your BudgetAdjustmentPeriod are included in the calculation of your current budget limit. If the first budget period in your BudgetAdjustmentPeriod has no cost data, then that budget period isn’t included in the average that determines your budget limit. You can’t set your own LookBackAvailablePeriods. The value is automatically calculated from the `budget_adjustment_period` and your historical cost data.
+* `budget_adjustment_period` (Required) - The number of budget periods included in the moving-average calculation that determines your auto-adjusted budget amount.
+* `lookback_available_periods` (Optional) - The integer that describes how many budget periods in your BudgetAdjustmentPeriod are included in the calculation of your current budget limit. If the first budget period in your BudgetAdjustmentPeriod has no cost data, then that budget period isn’t included in the average that determines your budget limit. You can’t set your own LookBackAvailablePeriods. The value is automatically calculated from the `budget_adjustment_period` and your historical cost data.
 
 ### Planned Budget Limits
 
 Valid keys for `planned_limit` parameter.
 
-* `start_time` - (Required) The start time of the budget limit. Format: `2017-01-01_12:00`. See [PlannedBudgetLimits](https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_budgets_Budget.html#awscostmanagement-Type-budgets_Budget-PlannedBudgetLimits) documentation.
 * `amount` - (Required) The amount of cost or usage being measured for a budget.
+* `start_time` - (Required) The start time of the budget limit. Format: `2017-01-01_12:00`. See [PlannedBudgetLimits](https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_budgets_Budget.html#awscostmanagement-Type-budgets_Budget-PlannedBudgetLimits) documentation.
 * `unit` - (Required) The unit of measurement used for the budget forecast, actual spend, or budget threshold, such as dollars or GB. See [Spend](http://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/data-type-spend.html) documentation.
 
 ### Spend
 
-`amount` - The cost or usage amount that's associated with a budget forecast, actual spend, or budget threshold. Length Constraints: Minimum length of `1`. Maximum length of `2147483647`.
-`unit` - The unit of measurement that's used for the budget forecast, actual spend, or budget threshold, such as USD or GBP. Length Constraints: Minimum length of `1`. Maximum length of `2147483647`.
+* `amount` - The cost or usage amount that's associated with a budget forecast, actual spend, or budget threshold. Length Constraints: Minimum length of `1`. Maximum length of `2147483647`.
+* `unit` - The unit of measurement that's used for the budget forecast, actual spend, or budget threshold, such as USD or GBP. Length Constraints: Minimum length of `1`. Maximum length of `2147483647`.
diff --git a/website/docs/d/caller_identity.html.markdown b/website/docs/d/caller_identity.html.markdown
index 180a181629a..92d7e033cde 100644
--- a/website/docs/d/caller_identity.html.markdown
+++ b/website/docs/d/caller_identity.html.markdown
@@ -34,7 +34,9 @@ output "caller_user" {
 
 There are no arguments available for this data source.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `account_id` - AWS Account ID number of the account that owns or contains the calling entity.
 * `arn` - ARN associated with the calling entity.
diff --git a/website/docs/d/canonical_user_id.html.markdown b/website/docs/d/canonical_user_id.html.markdown
index 35a53860e50..bb1c4d77701 100644
--- a/website/docs/d/canonical_user_id.html.markdown
+++ b/website/docs/d/canonical_user_id.html.markdown
@@ -28,9 +28,9 @@ output "canonical_user_id" {
 
 There are no arguments available for this data source.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - Canonical user ID associated with the AWS account.
 
diff --git a/website/docs/d/ce_cost_category.html.markdown b/website/docs/d/ce_cost_category.html.markdown
index 1edca9a4eb0..3d97fb2bbff 100644
--- a/website/docs/d/ce_cost_category.html.markdown
+++ b/website/docs/d/ce_cost_category.html.markdown
@@ -24,9 +24,9 @@ The following arguments are required:
 
 * `cost_category_arn` - (Required) Unique name for the Cost Category.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the cost category.
 * `default_value` - Default value for the cost category.
diff --git a/website/docs/d/ce_tags.html.markdown b/website/docs/d/ce_tags.html.markdown
index 364ce17274f..85c07392b59 100644
--- a/website/docs/d/ce_tags.html.markdown
+++ b/website/docs/d/ce_tags.html.markdown
@@ -71,9 +71,9 @@ The following arguments are optional:
 * `key` - (Required) key that's used to sort the data. Valid values are: `BlendedCost`,  `UnblendedCost`, `AmortizedCost`, `NetAmortizedCost`, `NetUnblendedCost`, `UsageQuantity`, `NormalizedUsageAmount`.
 * `sort_order` - (Optional) order that's used to sort the data. Valid values are: `ASCENDING`,  `DESCENDING`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - Unique ID of the tag.
 * `tags` - Tags that match your request.
diff --git a/website/docs/d/cloudcontrolapi_resource.html.markdown b/website/docs/d/cloudcontrolapi_resource.html.markdown
index 2269a31edc1..2ec544eb975 100644
--- a/website/docs/d/cloudcontrolapi_resource.html.markdown
+++ b/website/docs/d/cloudcontrolapi_resource.html.markdown
@@ -31,8 +31,8 @@ The following arguments are optional:
 * `role_arn` - (Optional) ARN of the IAM Role to assume for operations.
 * `type_version_id` - (Optional) Identifier of the CloudFormation resource type version.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `properties` - JSON string matching the CloudFormation resource type schema with current configuration. Underlying attributes can be referenced via the [`jsondecode()` function](https://www.terraform.io/docs/language/functions/jsondecode.html), for example, `jsondecode(data.aws_cloudcontrolapi_resource.example.properties)["example"]`.
diff --git a/website/docs/d/cloudformation_export.html.markdown b/website/docs/d/cloudformation_export.html.markdown
index b3e859ff1d1..ae4f31bb728 100644
--- a/website/docs/d/cloudformation_export.html.markdown
+++ b/website/docs/d/cloudformation_export.html.markdown
@@ -31,9 +31,9 @@ resource "aws_instance" "web" {
 
 * `name` - (Required) Name of the export as it appears in the console or from [list-exports](http://docs.aws.amazon.com/cli/latest/reference/cloudformation/list-exports.html)
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `value` - Value from Cloudformation export identified by the export name found from [list-exports](http://docs.aws.amazon.com/cli/latest/reference/cloudformation/list-exports.html)
 * `exporting_stack_id` - ARN of stack that contains the exported output name and value.
diff --git a/website/docs/d/cloudformation_stack.html.markdown b/website/docs/d/cloudformation_stack.html.markdown
index cb20a545576..021888f37a4 100644
--- a/website/docs/d/cloudformation_stack.html.markdown
+++ b/website/docs/d/cloudformation_stack.html.markdown
@@ -31,13 +31,13 @@ resource "aws_instance" "web" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `name` - (Required) Name of the stack
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `capabilities` - List of capabilities
 * `description` - Description of the stack
diff --git a/website/docs/d/cloudformation_type.html.markdown b/website/docs/d/cloudformation_type.html.markdown
index 1b58a48994c..6a3bb5461a8 100644
--- a/website/docs/d/cloudformation_type.html.markdown
+++ b/website/docs/d/cloudformation_type.html.markdown
@@ -21,16 +21,16 @@ data "aws_cloudformation_type" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `arn` - (Optional) ARN of the CloudFormation Type. For example, `arn:aws:cloudformation:us-west-2::type/resource/AWS-EC2-VPC`.
 * `type` - (Optional) CloudFormation Registry Type. For example, `RESOURCE`.
 * `type_name` - (Optional) CloudFormation Type name. For example, `AWS::EC2::VPC`.
 * `version_id` - (Optional) Identifier of the CloudFormation Type version.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `default_version_id` - Identifier of the CloudFormation Type default version.
 * `deprecated_status` - Deprecation status of the CloudFormation Type.
diff --git a/website/docs/d/cloudfront_cache_policy.html.markdown b/website/docs/d/cloudfront_cache_policy.html.markdown
index 9618896213a..06ff98384fa 100644
--- a/website/docs/d/cloudfront_cache_policy.html.markdown
+++ b/website/docs/d/cloudfront_cache_policy.html.markdown
@@ -6,7 +6,7 @@ description: |-
   Use this data source to retrieve information about a CloudFront cache policy.
 ---
 
-# Data source: aws_cloudfront_cache_policy
+# Data Source: aws_cloudfront_cache_policy
 
 Use this data source to retrieve information about a CloudFront cache policy.
 
@@ -32,14 +32,14 @@ data "aws_cloudfront_cache_policy" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `name` - (Optional) Unique name to identify the cache policy.
 * `id` - (Optional) Identifier for the cache policy.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `etag` - Current version of the cache policy.
 * `min_ttl` - Minimum amount of time, in seconds, that you want objects to stay in the CloudFront cache before CloudFront sends another request to the origin to see if the object has been updated.
diff --git a/website/docs/d/cloudfront_distribution.html.markdown b/website/docs/d/cloudfront_distribution.html.markdown
index 9458697fb6c..cce04a7a9bf 100644
--- a/website/docs/d/cloudfront_distribution.html.markdown
+++ b/website/docs/d/cloudfront_distribution.html.markdown
@@ -6,7 +6,7 @@ description: |-
   Provides a CloudFront web distribution data source.
 ---
 
-# Data source: aws_cloudfront_distribution
+# Data Source: aws_cloudfront_distribution
 
 Use this data source to retrieve information about a CloudFront distribution.
 
@@ -22,9 +22,9 @@ data "aws_cloudfront_distribution" "test" {
 
 * `id` - Identifier for the distribution. For example: `EDFDVBD632BHDS5`.
 
-## Attributes Reference
+## Attribute Reference
 
-The following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - Identifier for the distribution. For example: `EDFDVBD632BHDS5`.
 
@@ -50,3 +50,4 @@ The following attributes are exported:
 * `hosted_zone_id` - CloudFront Route 53 zone ID that can be used to
      route an [Alias Resource Record Set][7] to. This attribute is simply an
      alias for the zone ID `Z2FDTNDATAQYW2`.
+* `web_acl_id` AWS WAF web ACL associated with this distribution.
diff --git a/website/docs/d/cloudfront_function.html.markdown b/website/docs/d/cloudfront_function.html.markdown
index 1a8d914780c..ea91802c5e4 100644
--- a/website/docs/d/cloudfront_function.html.markdown
+++ b/website/docs/d/cloudfront_function.html.markdown
@@ -24,14 +24,14 @@ data "aws_cloudfront_function" "existing" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `name` - (Required) Name of the CloudFront function.
 * `stage` - (Required) Function’s stage, either `DEVELOPMENT` or `LIVE`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN identifying your CloudFront Function.
 * `code` - Source code of the function
diff --git a/website/docs/d/cloudfront_log_delivery_canonical_user_id.html.markdown b/website/docs/d/cloudfront_log_delivery_canonical_user_id.html.markdown
index 4df41306030..ee75d7e30d2 100644
--- a/website/docs/d/cloudfront_log_delivery_canonical_user_id.html.markdown
+++ b/website/docs/d/cloudfront_log_delivery_canonical_user_id.html.markdown
@@ -37,12 +37,12 @@ resource "aws_s3_bucket_acl" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `region` - (Optional) Region you'd like the zone for. By default, fetches the current region.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - Canonical user ID for the AWS `awslogsdelivery` account in the region.
diff --git a/website/docs/d/cloudfront_origin_access_identities.html.markdown b/website/docs/d/cloudfront_origin_access_identities.html.markdown
index b58cd1c8966..5a049a00fea 100644
--- a/website/docs/d/cloudfront_origin_access_identities.html.markdown
+++ b/website/docs/d/cloudfront_origin_access_identities.html.markdown
@@ -32,9 +32,9 @@ data "aws_cloudfront_origin_access_identities" "example" {
 
 * `comments` (Optional) - Filter origin access identities by comment.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `iam_arns` - Set of ARNs of the matched origin access identities.
 * `ids` - Set of ids of the matched origin access identities.
diff --git a/website/docs/d/cloudfront_origin_access_identity.html.markdown b/website/docs/d/cloudfront_origin_access_identity.html.markdown
index 067c9faa427..892ffa6f10d 100644
--- a/website/docs/d/cloudfront_origin_access_identity.html.markdown
+++ b/website/docs/d/cloudfront_origin_access_identity.html.markdown
@@ -24,9 +24,9 @@ data "aws_cloudfront_origin_access_identity" "example" {
 
 * `id` (Required) -  The identifier for the distribution. For example: `EDFDVBD632BHDS5`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `caller_reference` - Internal value used by CloudFront to allow future
    updates to the origin access identity.
diff --git a/website/docs/d/cloudfront_origin_request_policy.html.markdown b/website/docs/d/cloudfront_origin_request_policy.html.markdown
index de004582b19..954a04243da 100644
--- a/website/docs/d/cloudfront_origin_request_policy.html.markdown
+++ b/website/docs/d/cloudfront_origin_request_policy.html.markdown
@@ -30,14 +30,14 @@ data "aws_cloudfront_origin_request_policy" "ua_referer" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `name` - Unique name to identify the origin request policy.
 * `id` - Identifier for the origin request policy.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `comment` - Comment to describe the origin request policy.
 * `cookies_config` - Object that determines whether any cookies in viewer requests (and if so, which cookies) are included in the origin request key and automatically included in requests that CloudFront sends to the origin. See [Cookies Config](#cookies-config) for more information.
diff --git a/website/docs/d/cloudfront_realtime_log_config.html.markdown b/website/docs/d/cloudfront_realtime_log_config.html.markdown
index afb6936095b..575ffc97872 100644
--- a/website/docs/d/cloudfront_realtime_log_config.html.markdown
+++ b/website/docs/d/cloudfront_realtime_log_config.html.markdown
@@ -20,13 +20,13 @@ data "aws_cloudfront_realtime_log_config" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `name` - (Required) Unique name to identify this real-time log configuration.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN (Amazon Resource Name) of the CloudFront real-time log configuration.
 * `endpoint` - (Required) Amazon Kinesis data streams where real-time log data is sent.
diff --git a/website/docs/d/cloudfront_response_headers_policy.html.markdown b/website/docs/d/cloudfront_response_headers_policy.html.markdown
index 032374aeee6..954cb5eeeb8 100644
--- a/website/docs/d/cloudfront_response_headers_policy.html.markdown
+++ b/website/docs/d/cloudfront_response_headers_policy.html.markdown
@@ -6,7 +6,7 @@ description: |-
   Use this data source to retrieve information about a CloudFront response headers policy.
 ---
 
-# Data source: aws_cloudfront_response_headers_policy
+# Data Source: aws_cloudfront_response_headers_policy
 
 Use this data source to retrieve information about a CloudFront cache policy.
 
@@ -32,14 +32,14 @@ data "aws_cloudfront_response_headers_policy" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `name` - (Optional) Unique name to identify the response headers policy.
 * `id` - (Optional) Identifier for the response headers policy.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `comment` - Comment to describe the response headers policy. The comment cannot be longer than 128 characters.
 * `etag` - Current version of the response headers policy.
diff --git a/website/docs/d/cloudhsm_v2_cluster.html.markdown b/website/docs/d/cloudhsm_v2_cluster.html.markdown
index 8abdf030dda..3c7517b40ed 100644
--- a/website/docs/d/cloudhsm_v2_cluster.html.markdown
+++ b/website/docs/d/cloudhsm_v2_cluster.html.markdown
@@ -20,14 +20,14 @@ data "aws_cloudhsm_v2_cluster" "cluster" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `cluster_id` - (Required) ID of Cloud HSM v2 cluster.
 * `cluster_state` - (Optional) State of the cluster to be found.
 
-## Attributes Reference
+## Attribute Reference
 
-The following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `vpc_id` - ID of the VPC that the CloudHSM cluster resides in.
 * `security_group_id` - ID of the security group associated with the CloudHSM cluster.
diff --git a/website/docs/d/cloudtrail_service_account.html.markdown b/website/docs/d/cloudtrail_service_account.html.markdown
index 0b08f3134dc..e2d94d8158e 100644
--- a/website/docs/d/cloudtrail_service_account.html.markdown
+++ b/website/docs/d/cloudtrail_service_account.html.markdown
@@ -60,7 +60,9 @@ resource "aws_s3_bucket_policy" "allow_cloudtrail_logging" {
 * `region` - (Optional) Name of the region whose AWS CloudTrail account ID is desired.
 Defaults to the region from the AWS provider configuration.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - ID of the AWS CloudTrail service account in the selected region.
 * `arn` - ARN of the AWS CloudTrail service account in the selected region.
diff --git a/website/docs/d/cloudwatch_event_bus.html.markdown b/website/docs/d/cloudwatch_event_bus.html.markdown
index 43141209ad9..d3232cc7bc9 100644
--- a/website/docs/d/cloudwatch_event_bus.html.markdown
+++ b/website/docs/d/cloudwatch_event_bus.html.markdown
@@ -24,6 +24,8 @@ data "aws_cloudwatch_event_bus" "example" {
 
 * `name` - (Required) Friendly EventBridge event bus name.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN.
diff --git a/website/docs/d/cloudwatch_event_connection.html.markdown b/website/docs/d/cloudwatch_event_connection.html.markdown
index 2707291de25..1e724139386 100644
--- a/website/docs/d/cloudwatch_event_connection.html.markdown
+++ b/website/docs/d/cloudwatch_event_connection.html.markdown
@@ -6,7 +6,7 @@ description: |-
   Provides an EventBridge connection data source.
 ---
 
-# Data source: aws_cloudwatch_event_connection
+# Data Source: aws_cloudwatch_event_connection
 
 Use this data source to retrieve information about an EventBridge connection.
 
@@ -24,9 +24,9 @@ data "aws_cloudwatch_event_connection" "test" {
 
 * `name` - Name of the connection.
 
-## Attributes Reference
+## Attribute Reference
 
-The following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `name` - Name of the connection.
 
diff --git a/website/docs/d/cloudwatch_event_source.html.markdown b/website/docs/d/cloudwatch_event_source.html.markdown
index dd7014a0b4c..c3ecf625131 100644
--- a/website/docs/d/cloudwatch_event_source.html.markdown
+++ b/website/docs/d/cloudwatch_event_source.html.markdown
@@ -22,13 +22,13 @@ data "aws_cloudwatch_event_source" "examplepartner" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `name_prefix` - (Optional) Specifying this limits the results to only those partner event sources with names that start with the specified prefix
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the partner event source
 * `created_by` - Name of the SaaS partner that created the event source
diff --git a/website/docs/d/cloudwatch_log_data_protection_policy_document.html.markdown b/website/docs/d/cloudwatch_log_data_protection_policy_document.html.markdown
index 0c5af16cd7a..02e051151a9 100644
--- a/website/docs/d/cloudwatch_log_data_protection_policy_document.html.markdown
+++ b/website/docs/d/cloudwatch_log_data_protection_policy_document.html.markdown
@@ -118,8 +118,8 @@ The following arguments are optional:
 
 * `mask_config` - (Required) An empty object that configures masking.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `json` - Standard JSON policy document rendered based on the arguments above.
diff --git a/website/docs/d/cloudwatch_log_group.html.markdown b/website/docs/d/cloudwatch_log_group.html.markdown
index 181d6168d4d..b96df2ca6cb 100644
--- a/website/docs/d/cloudwatch_log_group.html.markdown
+++ b/website/docs/d/cloudwatch_log_group.html.markdown
@@ -20,13 +20,13 @@ data "aws_cloudwatch_log_group" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `name` - (Required) Name of the Cloudwatch log group
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the Cloudwatch log group. Any `:*` suffix added by the API, denoting all CloudWatch Log Streams under the CloudWatch Log Group, is removed for greater compatibility with other AWS services that do not accept the suffix.
 * `creation_time` - Creation time of the log group, expressed as the number of milliseconds after Jan 1, 1970 00:00:00 UTC.
diff --git a/website/docs/d/cloudwatch_log_groups.html.markdown b/website/docs/d/cloudwatch_log_groups.html.markdown
index e0957449b76..2e334575c55 100644
--- a/website/docs/d/cloudwatch_log_groups.html.markdown
+++ b/website/docs/d/cloudwatch_log_groups.html.markdown
@@ -20,13 +20,13 @@ data "aws_cloudwatch_log_groups" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `log_group_name_prefix` - (Optional) Group prefix of the Cloudwatch log groups to list
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arns` - Set of ARNs of the Cloudwatch log groups
 * `log_group_names` - Set of names of the Cloudwatch log groups
diff --git a/website/docs/d/codeartifact_authorization_token.html.markdown b/website/docs/d/codeartifact_authorization_token.html.markdown
index 5ed5cb6967d..4595be015e8 100644
--- a/website/docs/d/codeartifact_authorization_token.html.markdown
+++ b/website/docs/d/codeartifact_authorization_token.html.markdown
@@ -20,15 +20,15 @@ data "aws_codeartifact_authorization_token" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `domain` - (Required) Name of the domain that is in scope for the generated authorization token.
 * `domain_owner` - (Optional) Account number of the AWS account that owns the domain.
 * `duration_seconds` - (Optional) Time, in seconds, that the generated authorization token is valid. Valid values are `0` and between `900` and `43200`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to the argument above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `authorization_token` - Temporary authorization token.
 * `expiration` - Time in UTC RFC3339 format when the authorization token expires.
diff --git a/website/docs/d/codeartifact_repository_endpoint.html.markdown b/website/docs/d/codeartifact_repository_endpoint.html.markdown
index b0e6b749796..3cfee4ed3d8 100644
--- a/website/docs/d/codeartifact_repository_endpoint.html.markdown
+++ b/website/docs/d/codeartifact_repository_endpoint.html.markdown
@@ -22,15 +22,15 @@ data "aws_codeartifact_repository_endpoint" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `domain` - (Required) Name of the domain that contains the repository.
 * `repository` - (Required) Name of the repository.
 * `format` - (Required) Which endpoint of a repository to return. A repository has one endpoint for each package format: `npm`, `pypi`, `maven`, and `nuget`.
 * `domain_owner` - (Optional) Account number of the AWS account that owns the domain.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to the argument above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `repository_endpoint` - URL of the returned endpoint.
diff --git a/website/docs/d/codecatalyst_dev_environment.html.markdown b/website/docs/d/codecatalyst_dev_environment.html.markdown
new file mode 100644
index 00000000000..0da1475849a
--- /dev/null
+++ b/website/docs/d/codecatalyst_dev_environment.html.markdown
@@ -0,0 +1,45 @@
+---
+subcategory: "CodeCatalyst"
+layout: "aws"
+page_title: "AWS: aws_codecatalyst_dev_environment"
+description: |-
+  Terraform data source for managing an AWS CodeCatalyst Dev Environment.
+---
+# Data Source: aws_codecatalyst_dev_environment
+
+Terraform data source for managing an AWS CodeCatalyst Dev Environment.
+
+## Example Usage
+
+### Basic Usage
+
+```terraform
+data "aws_codecatalyst_dev_environment" "example" {
+  space_name   = "myspace"
+  project_name = "myproject"
+  env_id       = aws_codecatalyst_dev_environment.example.id
+}
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `env_id` - - (Required) The system-generated unique ID of the Dev Environment for which you want to view information. To retrieve a list of Dev Environment IDs, use [ListDevEnvironments](https://docs.aws.amazon.com/codecatalyst/latest/APIReference/API_ListDevEnvironments.html).
+* `project_name` - (Required) The name of the project in the space.
+* `space_name` - (Required) The name of the space.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `alias` - The user-specified alias for the Dev Environment.
+* `creator_id` - The system-generated unique ID of the user who created the Dev Environment.
+* `ides` - Information about the integrated development environment (IDE) configured for a Dev Environment.
+* `inactivity_timeout_minutes` - The amount of time the Dev Environment will run without any activity detected before stopping, in minutes. Only whole integers are allowed. Dev Environments consume compute minutes when running.
+* `instance_type` - The Amazon EC2 instace type to use for the Dev Environment.
+* `last_updated_time` - The time when the Dev Environment was last updated, in coordinated universal time (UTC) timestamp format as specified in [RFC 3339](https://www.rfc-editor.org/rfc/rfc3339#section-5.6).
+* `persistent_storage` - Information about the amount of storage allocated to the Dev Environment.
+* `repositories` - The source repository that contains the branch to clone into the Dev Environment.
+* `status` - The current status of the Dev Environment. From: PENDING | RUNNING | STARTING | STOPPING | STOPPED | FAILED | DELETING | DELETED.
+* `status_reason` - The reason for the status.
diff --git a/website/docs/d/codecommit_approval_rule_template.html.markdown b/website/docs/d/codecommit_approval_rule_template.html.markdown
index f5a11b0c785..8491a11abd1 100644
--- a/website/docs/d/codecommit_approval_rule_template.html.markdown
+++ b/website/docs/d/codecommit_approval_rule_template.html.markdown
@@ -20,13 +20,13 @@ data "aws_codecommit_approval_rule_template" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `name` - (Required) Name for the approval rule template. This needs to be less than 100 characters.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `approval_rule_template_id` - The ID of the approval rule template.
 * `content` - Content of the approval rule template.
diff --git a/website/docs/d/codecommit_repository.html.markdown b/website/docs/d/codecommit_repository.html.markdown
index 9df336766d5..ad8da358c36 100644
--- a/website/docs/d/codecommit_repository.html.markdown
+++ b/website/docs/d/codecommit_repository.html.markdown
@@ -20,13 +20,13 @@ data "aws_codecommit_repository" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `repository_name` - (Required) Name for the repository. This needs to be less than 100 characters.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `repository_id` - ID of the repository
 * `arn` - ARN of the repository
diff --git a/website/docs/d/codestarconnections_connection.html.markdown b/website/docs/d/codestarconnections_connection.html.markdown
index d56ffdf6637..bc6623c3fb6 100644
--- a/website/docs/d/codestarconnections_connection.html.markdown
+++ b/website/docs/d/codestarconnections_connection.html.markdown
@@ -30,16 +30,16 @@ data "aws_codestarconnections_connection" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `arn` - (Optional) CodeStar Connection ARN.
 * `name` - (Optional) CodeStar Connection name.
 
 ~> **NOTE:** When both `arn` and `name` are specified, `arn` takes precedence.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `connection_status` - CodeStar Connection status. Possible values are `PENDING`, `AVAILABLE` and `ERROR`.
 * `id` - CodeStar Connection ARN.
diff --git a/website/docs/d/cognito_identity_pool.html.markdown b/website/docs/d/cognito_identity_pool.html.markdown
new file mode 100644
index 00000000000..df22b1eb09f
--- /dev/null
+++ b/website/docs/d/cognito_identity_pool.html.markdown
@@ -0,0 +1,42 @@
+---
+subcategory: "Cognito Identity"
+layout: "aws"
+page_title: "AWS: aws_cognito_identity_pool"
+description: |-
+  Terraform data source for managing an AWS Cognito Identity Pool.
+---
+
+# Data Source: aws_cognito_identity_pool
+
+Terraform data source for managing an AWS Cognito Identity Pool.
+
+## Example Usage
+
+### Basic Usage
+
+```terraform
+data "aws_cognito_identity_pool" "example" {
+  identity_pool_name = "test pool"
+}
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `identity_pool_name` - (Required)  The Cognito Identity Pool name.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - An identity pool ID, e.g. `us-west-2:1a234567-8901-234b-5cde-f6789g01h2i3`.
+* `arn` - ARN of the Pool.
+* `allow_unauthenticated_identities` - Whether the identity pool supports unauthenticated logins or not.
+* `allow_classic_flow` - Whether the classic / basic authentication flow is enabled.
+* `developer_provider_name` - The "domain" by which Cognito will refer to your users.
+* `cognito_identity_providers` - An array of Amazon Cognito Identity user pools and their client IDs.
+* `openid_connect_provider_arns` - Set of OpendID Connect provider ARNs.
+* `saml_provider_arns` - An array of Amazon Resource Names (ARNs) of the SAML provider for your identity.
+* `supported_login_providers` - Key-Value pairs mapping provider names to provider app IDs.
+* `tags` - A map of tags to assigned to the Identity Pool.
diff --git a/website/docs/d/cognito_user_pool_client.html.markdown b/website/docs/d/cognito_user_pool_client.html.markdown
new file mode 100644
index 00000000000..521e3f53af0
--- /dev/null
+++ b/website/docs/d/cognito_user_pool_client.html.markdown
@@ -0,0 +1,69 @@
+---
+subcategory: "Cognito IDP (Identity Provider)"
+layout: "aws"
+page_title: "AWS: aws_cognito_user_pool_client"
+description: |-
+  Provides a Cognito User Pool Client
+---
+
+# Data Source: aws_cognito_user_pool_client
+
+Provides a Cognito User Pool Client resource.
+
+## Example Usage
+
+```terraform
+data "aws_cognito_user_pool_client" "client" {
+  client_id    = "38fjsnc484p94kpqsnet7mpld0"
+  user_pool_id = "us-west-2_aaaaaaaaa"
+}
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `client_id` - (Required) Client Id of the user pool.
+* `user_pool_id` - (Required) User pool the client belongs to.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `access_token_validity` - (Optional) Time limit, between 5 minutes and 1 day, after which the access token is no longer valid and cannot be used. This value will be overridden if you have entered a value in `token_validity_units`.
+* `allowed_oauth_flows_user_pool_client` - (Optional) Whether the client is allowed to follow the OAuth protocol when interacting with Cognito user pools.
+* `allowed_oauth_flows` - (Optional) List of allowed OAuth flows (code, implicit, client_credentials).
+* `allowed_oauth_scopes` - (Optional) List of allowed OAuth scopes (phone, email, openid, profile, and aws.cognito.signin.user.admin).
+* `analytics_configuration` - (Optional) Configuration block for Amazon Pinpoint analytics for collecting metrics for this user pool. [Detailed below](#analytics_configuration).
+* `callback_urls` - (Optional) List of allowed callback URLs for the identity providers.
+* `client_secret` - Client secret of the user pool client.
+* `default_redirect_uri` - (Optional) Default redirect URI. Must be in the list of callback URLs.
+* `enable_token_revocation` - (Optional) Enables or disables token revocation.
+* `explicit_auth_flows` - (Optional) List of authentication flows (ADMIN_NO_SRP_AUTH, CUSTOM_AUTH_FLOW_ONLY, USER_PASSWORD_AUTH, ALLOW_ADMIN_USER_PASSWORD_AUTH, ALLOW_CUSTOM_AUTH, ALLOW_USER_PASSWORD_AUTH, ALLOW_USER_SRP_AUTH, ALLOW_REFRESH_TOKEN_AUTH).
+* `generate_secret` - (Optional) Should an application secret be generated.
+* `id_token_validity` - (Optional) Time limit, between 5 minutes and 1 day, after which the ID token is no longer valid and cannot be used. This value will be overridden if you have entered a value in `token_validity_units`.
+* `logout_urls` - (Optional) List of allowed logout URLs for the identity providers.
+* `prevent_user_existence_errors` - (Optional) Choose which errors and responses are returned by Cognito APIs during authentication, account confirmation, and password recovery when the user does not exist in the user pool. When set to `ENABLED` and the user does not exist, authentication returns an error indicating either the username or password was incorrect, and account confirmation and password recovery return a response indicating a code was sent to a simulated destination. When set to `LEGACY`, those APIs will return a `UserNotFoundException` exception if the user does not exist in the user pool.
+* `read_attributes` - (Optional) List of user pool attributes the application client can read from.
+* `refresh_token_validity` - (Optional) Time limit in days refresh tokens are valid for.
+* `supported_identity_providers` - (Optional) List of provider names for the identity providers that are supported on this client. Uses the `provider_name` attribute of `aws_cognito_identity_provider` resource(s), or the equivalent string(s).
+* `token_validity_units` - (Optional) Configuration block for units in which the validity times are represented in. [Detailed below](#token_validity_units).
+* `write_attributes` - (Optional) List of user pool attributes the application client can write to.
+
+### analytics_configuration
+
+Either `application_arn` or `application_id` is required.
+
+* `application_arn` - (Optional) Application ARN for an Amazon Pinpoint application. Conflicts with `external_id` and `role_arn`.
+* `application_id` - (Optional) Application ID for an Amazon Pinpoint application.
+* `external_id` - (Optional) ID for the Analytics Configuration. Conflicts with `application_arn`.
+* `role_arn` - (Optional) ARN of an IAM role that authorizes Amazon Cognito to publish events to Amazon Pinpoint analytics. Conflicts with `application_arn`.
+* `user_data_shared` (Optional) If set to `true`, Amazon Cognito will include user data in the events it publishes to Amazon Pinpoint analytics.
+
+### token_validity_units
+
+Valid values for the following arguments are: `seconds`, `minutes`, `hours` or `days`.
+
+* `access_token` - (Optional) Time unit in for the value in `access_token_validity`, defaults to `hours`.
+* `id_token` - (Optional) Time unit in for the value in `id_token_validity`, defaults to `hours`.
+* `refresh_token` - (Optional) Time unit in for the value in `refresh_token_validity`, defaults to `days`.
diff --git a/website/docs/d/cognito_user_pool_client.markdown b/website/docs/d/cognito_user_pool_client.markdown
deleted file mode 100644
index 32dac6c12cf..00000000000
--- a/website/docs/d/cognito_user_pool_client.markdown
+++ /dev/null
@@ -1,69 +0,0 @@
----
-subcategory: "Cognito IDP (Identity Provider)"
-layout: "aws"
-page_title: "AWS: aws_cognito_user_pool_client"
-description: |-
-  Provides a Cognito User Pool Client
----
-
-# Data Source: aws_cognito_user_pool_client
-
-Provides a Cognito User Pool Client resource.
-
-## Example Usage
-
-```terraform
-data "aws_cognito_user_pool_client" "client" {
-  client_id    = "38fjsnc484p94kpqsnet7mpld0"
-  user_pool_id = "us-west-2_aaaaaaaaa"
-}
-```
-
-## Argument Reference
-
-The following arguments are required:
-
-* `client_id` - (Required) Client Id of the user pool.
-* `user_pool_id` - (Required) User pool the client belongs to.
-
-## Attributes Reference
-
-In addition to all arguments above, the following attributes are exported:
-
-* `access_token_validity` - (Optional) Time limit, between 5 minutes and 1 day, after which the access token is no longer valid and cannot be used. This value will be overridden if you have entered a value in `token_validity_units`.
-* `allowed_oauth_flows_user_pool_client` - (Optional) Whether the client is allowed to follow the OAuth protocol when interacting with Cognito user pools.
-* `allowed_oauth_flows` - (Optional) List of allowed OAuth flows (code, implicit, client_credentials).
-* `allowed_oauth_scopes` - (Optional) List of allowed OAuth scopes (phone, email, openid, profile, and aws.cognito.signin.user.admin).
-* `analytics_configuration` - (Optional) Configuration block for Amazon Pinpoint analytics for collecting metrics for this user pool. [Detailed below](#analytics_configuration).
-* `callback_urls` - (Optional) List of allowed callback URLs for the identity providers.
-* `client_secret` - Client secret of the user pool client.
-* `default_redirect_uri` - (Optional) Default redirect URI. Must be in the list of callback URLs.
-* `enable_token_revocation` - (Optional) Enables or disables token revocation.
-* `explicit_auth_flows` - (Optional) List of authentication flows (ADMIN_NO_SRP_AUTH, CUSTOM_AUTH_FLOW_ONLY, USER_PASSWORD_AUTH, ALLOW_ADMIN_USER_PASSWORD_AUTH, ALLOW_CUSTOM_AUTH, ALLOW_USER_PASSWORD_AUTH, ALLOW_USER_SRP_AUTH, ALLOW_REFRESH_TOKEN_AUTH).
-* `generate_secret` - (Optional) Should an application secret be generated.
-* `id_token_validity` - (Optional) Time limit, between 5 minutes and 1 day, after which the ID token is no longer valid and cannot be used. This value will be overridden if you have entered a value in `token_validity_units`.
-* `logout_urls` - (Optional) List of allowed logout URLs for the identity providers.
-* `prevent_user_existence_errors` - (Optional) Choose which errors and responses are returned by Cognito APIs during authentication, account confirmation, and password recovery when the user does not exist in the user pool. When set to `ENABLED` and the user does not exist, authentication returns an error indicating either the username or password was incorrect, and account confirmation and password recovery return a response indicating a code was sent to a simulated destination. When set to `LEGACY`, those APIs will return a `UserNotFoundException` exception if the user does not exist in the user pool.
-* `read_attributes` - (Optional) List of user pool attributes the application client can read from.
-* `refresh_token_validity` - (Optional) Time limit in days refresh tokens are valid for.
-* `supported_identity_providers` - (Optional) List of provider names for the identity providers that are supported on this client. Uses the `provider_name` attribute of `aws_cognito_identity_provider` resource(s), or the equivalent string(s).
-* `token_validity_units` - (Optional) Configuration block for units in which the validity times are represented in. [Detailed below](#token_validity_units).
-* `write_attributes` - (Optional) List of user pool attributes the application client can write to.
-
-### analytics_configuration
-
-Either `application_arn` or `application_id` is required.
-
-* `application_arn` - (Optional) Application ARN for an Amazon Pinpoint application. Conflicts with `external_id` and `role_arn`.
-* `application_id` - (Optional) Application ID for an Amazon Pinpoint application.
-* `external_id` - (Optional) ID for the Analytics Configuration. Conflicts with `application_arn`.
-* `role_arn` - (Optional) ARN of an IAM role that authorizes Amazon Cognito to publish events to Amazon Pinpoint analytics. Conflicts with `application_arn`.
-* `user_data_shared` (Optional) If set to `true`, Amazon Cognito will include user data in the events it publishes to Amazon Pinpoint analytics.
-
-### token_validity_units
-
-Valid values for the following arguments are: `seconds`, `minutes`, `hours` or `days`.
-
-* `access_token` - (Optional) Time unit in for the value in `access_token_validity`, defaults to `hours`.
-* `id_token` - (Optional) Time unit in for the value in `id_token_validity`, defaults to `hours`.
-* `refresh_token` - (Optional) Time unit in for the value in `refresh_token_validity`, defaults to `days`.
diff --git a/website/docs/d/cognito_user_pool_clients.html.markdown b/website/docs/d/cognito_user_pool_clients.html.markdown
new file mode 100644
index 00000000000..cc9ecc906b6
--- /dev/null
+++ b/website/docs/d/cognito_user_pool_clients.html.markdown
@@ -0,0 +1,30 @@
+---
+subcategory: "Cognito IDP (Identity Provider)"
+layout: "aws"
+page_title: "AWS: aws_cognito_user_pool_clients"
+description: |-
+  Get list of cognito user pool clients connected to user pool.
+---
+
+# Data Source: aws_cognito_user_pool_clients
+
+Use this data source to get a list of Cognito user pools clients for a Cognito IdP user pool.
+
+## Example Usage
+
+```terraform
+data "aws_cognito_user_pool_clients" "main" {
+  user_pool_id = aws_cognito_user_pool.main.id
+}
+```
+
+## Argument Reference
+
+* `user_pool_id` - (Required) Cognito user pool ID.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `client_ids` - List of Cognito user pool client IDs.
+* `client_names` - List of Cognito user pool client names.
diff --git a/website/docs/d/cognito_user_pool_clients.markdown b/website/docs/d/cognito_user_pool_clients.markdown
deleted file mode 100644
index 7bb958005b6..00000000000
--- a/website/docs/d/cognito_user_pool_clients.markdown
+++ /dev/null
@@ -1,28 +0,0 @@
----
-subcategory: "Cognito IDP (Identity Provider)"
-layout: "aws"
-page_title: "AWS: aws_cognito_user_pool_clients"
-description: |-
-  Get list of cognito user pool clients connected to user pool.
----
-
-# Data Source: aws_cognito_user_pool_clients
-
-Use this data source to get a list of Cognito user pools clients for a Cognito IdP user pool.
-
-## Example Usage
-
-```terraform
-data "aws_cognito_user_pool_clients" "main" {
-  user_pool_id = aws_cognito_user_pool.main.id
-}
-```
-
-## Argument Reference
-
-* `user_pool_id` - (Required) Cognito user pool ID.
-
-## Attributes Reference
-
-* `client_ids` - List of Cognito user pool client IDs.
-* `client_names` - List of Cognito user pool client names.
diff --git a/website/docs/d/cognito_user_pool_signing_certificate.html.markdown b/website/docs/d/cognito_user_pool_signing_certificate.html.markdown
new file mode 100644
index 00000000000..aa30d63b8ff
--- /dev/null
+++ b/website/docs/d/cognito_user_pool_signing_certificate.html.markdown
@@ -0,0 +1,29 @@
+---
+subcategory: "Cognito IDP (Identity Provider)"
+layout: "aws"
+page_title: "AWS: aws_cognito_user_pool_signing_certificate"
+description: |-
+  Get signing certificate of user pool
+---
+
+# Data Source: aws_cognito_user_pool_signing_certificate
+
+Use this data source to get the signing certificate for a Cognito IdP user pool.
+
+## Example Usage
+
+```terraform
+data "aws_cognito_user_pool_signing_certificate" "sc" {
+  user_pool_id = aws_cognito_user_pool.my_pool.id
+}
+```
+
+## Argument Reference
+
+* `user_pool_id` - (Required) Cognito user pool ID.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `certificate` - Certificate string
diff --git a/website/docs/d/cognito_user_pool_signing_certificate.markdown b/website/docs/d/cognito_user_pool_signing_certificate.markdown
deleted file mode 100644
index ebffcdaa19c..00000000000
--- a/website/docs/d/cognito_user_pool_signing_certificate.markdown
+++ /dev/null
@@ -1,27 +0,0 @@
----
-subcategory: "Cognito IDP (Identity Provider)"
-layout: "aws"
-page_title: "AWS: aws_cognito_user_pool_signing_certificate"
-description: |-
-  Get signing certificate of user pool
----
-
-# Data Source: aws_cognito_user_pool_signing_certificate
-
-Use this data source to get the signing certificate for a Cognito IdP user pool.
-
-## Example Usage
-
-```terraform
-data "aws_cognito_user_pool_signing_certificate" "sc" {
-  user_pool_id = aws_cognito_user_pool.my_pool.id
-}
-```
-
-## Argument Reference
-
-* `user_pool_id` - (Required) Cognito user pool ID.
-
-## Attributes Reference
-
-* `certificate` - Certificate string
diff --git a/website/docs/d/cognito_user_pools.html.markdown b/website/docs/d/cognito_user_pools.html.markdown
new file mode 100644
index 00000000000..e94f2915686
--- /dev/null
+++ b/website/docs/d/cognito_user_pools.html.markdown
@@ -0,0 +1,41 @@
+---
+subcategory: "Cognito IDP (Identity Provider)"
+layout: "aws"
+page_title: "AWS: aws_cognito_user_pools"
+description: |-
+  Get list of cognito user pools.
+---
+
+# Data Source: aws_cognito_user_pools
+
+Use this data source to get a list of cognito user pools.
+
+## Example Usage
+
+```terraform
+data "aws_api_gateway_rest_api" "selected" {
+  name = var.api_gateway_name
+}
+
+data "aws_cognito_user_pools" "selected" {
+  name = var.cognito_user_pool_name
+}
+
+resource "aws_api_gateway_authorizer" "cognito" {
+  name          = "cognito"
+  type          = "COGNITO_USER_POOLS"
+  rest_api_id   = data.aws_api_gateway_rest_api.selected.id
+  provider_arns = data.aws_cognito_user_pools.selected.arns
+}
+```
+
+## Argument Reference
+
+* `name` - (Required) Name of the cognito user pools. Name is not a unique attribute for cognito user pool, so multiple pools might be returned with given name. If the pool name is expected to be unique, you can reference the pool id via ```tolist(data.aws_cognito_user_pools.selected.ids)[0]```
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `ids` - Set of cognito user pool ids.
+* `arns` - Set of cognito user pool Amazon Resource Names (ARNs).
diff --git a/website/docs/d/cognito_user_pools.markdown b/website/docs/d/cognito_user_pools.markdown
deleted file mode 100644
index a35dbf40092..00000000000
--- a/website/docs/d/cognito_user_pools.markdown
+++ /dev/null
@@ -1,39 +0,0 @@
----
-subcategory: "Cognito IDP (Identity Provider)"
-layout: "aws"
-page_title: "AWS: aws_cognito_user_pools"
-description: |-
-  Get list of cognito user pools.
----
-
-# Data Source: aws_cognito_user_pools
-
-Use this data source to get a list of cognito user pools.
-
-## Example Usage
-
-```terraform
-data "aws_api_gateway_rest_api" "selected" {
-  name = var.api_gateway_name
-}
-
-data "aws_cognito_user_pools" "selected" {
-  name = var.cognito_user_pool_name
-}
-
-resource "aws_api_gateway_authorizer" "cognito" {
-  name          = "cognito"
-  type          = "COGNITO_USER_POOLS"
-  rest_api_id   = data.aws_api_gateway_rest_api.selected.id
-  provider_arns = data.aws_cognito_user_pools.selected.arns
-}
-```
-
-## Argument Reference
-
-* `name` - (Required) Name of the cognito user pools. Name is not a unique attribute for cognito user pool, so multiple pools might be returned with given name. If the pool name is expected to be unique, you can reference the pool id via ```tolist(data.aws_cognito_user_pools.selected.ids)[0]```
-
-## Attributes Reference
-
-* `ids` - Set of cognito user pool ids.
-* `arns` - Set of cognito user pool Amazon Resource Names (ARNs).
diff --git a/website/docs/d/connect_bot_association.html.markdown b/website/docs/d/connect_bot_association.html.markdown
new file mode 100644
index 00000000000..b1289daae0a
--- /dev/null
+++ b/website/docs/d/connect_bot_association.html.markdown
@@ -0,0 +1,38 @@
+---
+subcategory: "Connect"
+layout: "aws"
+page_title: "AWS: aws_connect_bot_association"
+description: |-
+  Provides details about a specific Lex (V1) Bot associated with an Amazon Connect instance
+---
+
+# Data Source: aws_connect_bot_association
+
+Provides details about a specific Lex (V1) Bot associated with an Amazon Connect instance.
+
+## Example Usage
+
+### By name
+
+```terraform
+data "aws_connect_bot_association" "example" {
+  instance_id = "aaaaaaaa-bbbb-cccc-dddd-111111111111"
+  lex_bot {
+    name = "Test"
+  }
+}
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `instance_id` - (Required) Identifier of the Amazon Connect instance. You can find the instanceId in the ARN of the instance.
+* `lex_bot` - (Required) Configuration information of an Amazon Lex (V1) bot. Detailed below.
+
+### lex_bot
+
+The `lex_bot` configuration block supports the following:
+
+* `name` - (Required) Name of the Amazon Lex (V1) bot.
+* `lex_region` - (Optional) Region that the Amazon Lex (V1) bot was created in.
diff --git a/website/docs/d/connect_bot_association.markdown b/website/docs/d/connect_bot_association.markdown
deleted file mode 100644
index b7ec11473f9..00000000000
--- a/website/docs/d/connect_bot_association.markdown
+++ /dev/null
@@ -1,38 +0,0 @@
----
-subcategory: "Connect"
-layout: "aws"
-page_title: "AWS: aws_connect_bot_association"
-description: |-
-  Provides details about a specific Lex (V1) Bot associated with an Amazon Connect instance
----
-
-# Data Source: aws_connect_bot_association
-
-Provides details about a specific Lex (V1) Bot associated with an Amazon Connect instance.
-
-## Example Usage
-
-### By name
-
-```terraform
-data "aws_connect_bot_association" "example" {
-  instance_id = "aaaaaaaa-bbbb-cccc-dddd-111111111111"
-  lex_bot {
-    name = "Test"
-  }
-}
-```
-
-## Argument Reference
-
-The following arguments are supported:
-
-* `instance_id` - (Required) Identifier of the Amazon Connect instance. You can find the instanceId in the ARN of the instance.
-* `lex_bot` - (Required) Configuration information of an Amazon Lex (V1) bot. Detailed below.
-
-### lex_bot
-
-The `lex_bot` configuration block supports the following:
-
-* `name` - (Required) Name of the Amazon Lex (V1) bot.
-* `lex_region` - (Optional) Region that the Amazon Lex (V1) bot was created in.
diff --git a/website/docs/d/connect_contact_flow.html.markdown b/website/docs/d/connect_contact_flow.html.markdown
index 7cd1bf24328..699c5780a78 100644
--- a/website/docs/d/connect_contact_flow.html.markdown
+++ b/website/docs/d/connect_contact_flow.html.markdown
@@ -34,15 +34,15 @@ data "aws_connect_contact_flow" "test" {
 
 ~> **NOTE:** `instance_id` and one of either `name` or `contact_flow_id` is required.
 
-The following arguments are supported:
+This argument supports the following arguments:
 
 * `contact_flow_id` - (Optional) Returns information on a specific Contact Flow by contact flow id
 * `instance_id` - (Required) Reference to the hosting Amazon Connect Instance
 * `name` - (Optional) Returns information on a specific Contact Flow by name
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all of the arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the Contact Flow.
 * `content` - Logic of the Contact Flow.
diff --git a/website/docs/d/connect_contact_flow_module.html.markdown b/website/docs/d/connect_contact_flow_module.html.markdown
index e5ee54df106..9b984df18d5 100644
--- a/website/docs/d/connect_contact_flow_module.html.markdown
+++ b/website/docs/d/connect_contact_flow_module.html.markdown
@@ -34,15 +34,15 @@ data "aws_connect_contact_flow_module" "example" {
 
 ~> **NOTE:** `instance_id` and one of either `name` or `contact_flow_module_id` is required.
 
-The following arguments are supported:
+This argument supports the following arguments:
 
 * `contact_flow_module_id` - (Optional) Returns information on a specific Contact Flow Module by contact flow module id
 * `instance_id` - (Required) Reference to the hosting Amazon Connect Instance
 * `name` - (Optional) Returns information on a specific Contact Flow Module by name
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all of the arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the Contact Flow Module.
 * `content` - Logic of the Contact Flow Module.
diff --git a/website/docs/d/connect_hours_of_operation.html.markdown b/website/docs/d/connect_hours_of_operation.html.markdown
index b4a117cdfb7..0d80251e9b1 100644
--- a/website/docs/d/connect_hours_of_operation.html.markdown
+++ b/website/docs/d/connect_hours_of_operation.html.markdown
@@ -34,15 +34,15 @@ data "aws_connect_hours_of_operation" "test" {
 
 ~> **NOTE:** `instance_id` and one of either `name` or `hours_of_operation_id` is required.
 
-The following arguments are supported:
+This argument supports the following arguments:
 
 * `hours_of_operation_id` - (Optional) Returns information on a specific Hours of Operation by hours of operation id
 * `instance_id` - (Required) Reference to the hosting Amazon Connect Instance
 * `name` - (Optional) Returns information on a specific Hours of Operation by name
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all of the arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the Hours of Operation.
 * `config` - Configuration information for the hours of operation: day, start time, and end time . Config blocks are documented below. Config blocks are documented below.
diff --git a/website/docs/d/connect_instance.html.markdown b/website/docs/d/connect_instance.html.markdown
index 63f2c5dd897..56530d9fb29 100644
--- a/website/docs/d/connect_instance.html.markdown
+++ b/website/docs/d/connect_instance.html.markdown
@@ -32,15 +32,15 @@ data "aws_connect_instance" "foo" {
 
 ~> **NOTE:** One of either `instance_id` or `instance_alias` is required.
 
-The following arguments are supported:
+This argument supports the following arguments:
 
 * `instance_id` - (Optional) Returns information on a specific connect instance by id
 
 * `instance_alias` - (Optional) Returns information on a specific connect instance by alias
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `created_time` - When the instance was created.
 * `arn` - ARN of the instance.
diff --git a/website/docs/d/connect_instance_storage_config.html.markdown b/website/docs/d/connect_instance_storage_config.html.markdown
index f803869cdfd..5eef55a496a 100644
--- a/website/docs/d/connect_instance_storage_config.html.markdown
+++ b/website/docs/d/connect_instance_storage_config.html.markdown
@@ -22,15 +22,15 @@ data "aws_connect_instance_storage_config" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `association_id` - (Required) The existing association identifier that uniquely identifies the resource type and storage config for the given instance ID.
 * `instance_id` - (Required) Reference to the hosting Amazon Connect Instance
-* `resource_type` - (Required) A valid resource type. Valid Values: `CHAT_TRANSCRIPTS` | `CALL_RECORDINGS` | `SCHEDULED_REPORTS` | `MEDIA_STREAMS` | `CONTACT_TRACE_RECORDS` | `AGENT_EVENTS` | `REAL_TIME_CONTACT_ANALYSIS_SEGMENTS`.
+* `resource_type` - (Required) A valid resource type. Valid Values: `AGENT_EVENTS` | `ATTACHMENTS` | `CALL_RECORDINGS` | `CHAT_TRANSCRIPTS` | `CONTACT_EVALUATIONS` | `CONTACT_TRACE_RECORDS` | `MEDIA_STREAMS` | `REAL_TIME_CONTACT_ANALYSIS_SEGMENTS` | `SCHEDULED_REPORTS` |  `SCREEN_RECORDINGS`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all of the arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - The identifier of the hosting Amazon Connect Instance, `association_id`, and `resource_type` separated by a colon (`:`).
 * `storage_config` - Specifies the storage configuration options for the Connect Instance. [Documented below](#storage_config).
diff --git a/website/docs/d/connect_lambda_function_association.html.markdown b/website/docs/d/connect_lambda_function_association.html.markdown
new file mode 100644
index 00000000000..2d26890d1fc
--- /dev/null
+++ b/website/docs/d/connect_lambda_function_association.html.markdown
@@ -0,0 +1,33 @@
+---
+subcategory: "Connect"
+layout: "aws"
+page_title: "AWS: aws_connect_lambda_function_association"
+description: |-
+  Provides details about a specific Connect Lambda Function Association.
+---
+
+# Data Source: aws_connect_lambda_function_association
+
+Provides details about a specific Connect Lambda Function Association.
+
+## Example Usage
+
+```terraform
+data "aws_connect_lambda_function_association" "example" {
+  function_arn = "arn:aws:lambda:us-west-2:123456789123:function:abcdefg"
+  instance_id  = "aaaaaaaa-bbbb-cccc-dddd-111111111111"
+}
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `function_arn` - (Required) ARN of the Lambda Function, omitting any version or alias qualifier.
+* `instance_id` - (Required) Identifier of the Amazon Connect instance. You can find the instanceId in the ARN of the instance.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - AWS Region.
diff --git a/website/docs/d/connect_lambda_function_association.markdown b/website/docs/d/connect_lambda_function_association.markdown
deleted file mode 100644
index cbdb519b05d..00000000000
--- a/website/docs/d/connect_lambda_function_association.markdown
+++ /dev/null
@@ -1,33 +0,0 @@
----
-subcategory: "Connect"
-layout: "aws"
-page_title: "AWS: aws_connect_lambda_function_association"
-description: |-
-  Provides details about a specific Connect Lambda Function Association.
----
-
-# Data Source: aws_connect_lambda_function_association
-
-Provides details about a specific Connect Lambda Function Association.
-
-## Example Usage
-
-```terraform
-data "aws_connect_lambda_function_association" "example" {
-  function_arn = "arn:aws:lambda:us-west-2:123456789123:function:abcdefg"
-  instance_id  = "aaaaaaaa-bbbb-cccc-dddd-111111111111"
-}
-```
-
-## Argument Reference
-
-The following arguments are supported:
-
-* `function_arn` - (Required) ARN of the Lambda Function, omitting any version or alias qualifier.
-* `instance_id` - (Required) Identifier of the Amazon Connect instance. You can find the instanceId in the ARN of the instance.
-
-## Attributes Reference
-
-In addition to all arguments above, the following attributes are exported:
-
-* `id` - AWS Region.
diff --git a/website/docs/d/connect_prompt.html.markdown b/website/docs/d/connect_prompt.html.markdown
index 78cada3ecaf..5797f9408c8 100644
--- a/website/docs/d/connect_prompt.html.markdown
+++ b/website/docs/d/connect_prompt.html.markdown
@@ -23,14 +23,14 @@ data "aws_connect_prompt" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `instance_id` - (Required) Reference to the hosting Amazon Connect Instance
 * `name` - (Required) Returns information on a specific Prompt by name
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all of the arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the Prompt.
 * `prompt_id` - Identifier for the prompt.
diff --git a/website/docs/d/connect_queue.html.markdown b/website/docs/d/connect_queue.html.markdown
new file mode 100644
index 00000000000..252d869ec7b
--- /dev/null
+++ b/website/docs/d/connect_queue.html.markdown
@@ -0,0 +1,61 @@
+---
+subcategory: "Connect"
+layout: "aws"
+page_title: "AWS: aws_connect_queue"
+description: |-
+  Provides details about a specific Amazon Connect Queue.
+---
+
+# Data Source: aws_connect_queue
+
+Provides details about a specific Amazon Connect Queue.
+
+## Example Usage
+
+By `name`
+
+```hcl
+data "aws_connect_queue" "example" {
+  instance_id = "aaaaaaaa-bbbb-cccc-dddd-111111111111"
+  name        = "Example"
+}
+```
+
+By `queue_id`
+
+```hcl
+data "aws_connect_queue" "example" {
+  instance_id = "aaaaaaaa-bbbb-cccc-dddd-111111111111"
+  queue_id    = "cccccccc-bbbb-cccc-dddd-111111111111"
+}
+```
+
+## Argument Reference
+
+~> **NOTE:** `instance_id` and one of either `name` or `queue_id` is required.
+
+This argument supports the following arguments:
+
+* `queue_id` - (Optional) Returns information on a specific Queue by Queue id
+* `instance_id` - (Required) Reference to the hosting Amazon Connect Instance
+* `name` - (Optional) Returns information on a specific Queue by name
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Queue.
+* `description` - Description of the Queue.
+* `hours_of_operation_id` - Specifies the identifier of the Hours of Operation.
+* `id` - Identifier of the hosting Amazon Connect Instance and identifier of the Queue separated by a colon (`:`).
+* `max_contacts` - Maximum number of contacts that can be in the queue before it is considered full. Minimum value of 0.
+* `outbound_caller_config` - A block that defines the outbound caller ID name, number, and outbound whisper flow. The Outbound Caller Config block is documented below.
+* `queue_id` - Identifier for the Queue.
+* `status` - Description of the Queue. Values are `ENABLED` or `DISABLED`.
+* `tags` - Map of tags assigned to the Queue.
+
+A `outbound_caller_config` block supports the following arguments:
+
+* `outbound_caller_id_name` - Specifies the caller ID name.
+* `outbound_caller_id_number_id` - Specifies the caller ID number.
+* `outbound_flow_id` - Outbound whisper flow to be used during an outbound call.
diff --git a/website/docs/d/connect_queue.markdown b/website/docs/d/connect_queue.markdown
deleted file mode 100644
index d303be18572..00000000000
--- a/website/docs/d/connect_queue.markdown
+++ /dev/null
@@ -1,61 +0,0 @@
----
-subcategory: "Connect"
-layout: "aws"
-page_title: "AWS: aws_connect_queue"
-description: |-
-  Provides details about a specific Amazon Connect Queue.
----
-
-# Data Source: aws_connect_queue
-
-Provides details about a specific Amazon Connect Queue.
-
-## Example Usage
-
-By `name`
-
-```hcl
-data "aws_connect_queue" "example" {
-  instance_id = "aaaaaaaa-bbbb-cccc-dddd-111111111111"
-  name        = "Example"
-}
-```
-
-By `queue_id`
-
-```hcl
-data "aws_connect_queue" "example" {
-  instance_id = "aaaaaaaa-bbbb-cccc-dddd-111111111111"
-  queue_id    = "cccccccc-bbbb-cccc-dddd-111111111111"
-}
-```
-
-## Argument Reference
-
-~> **NOTE:** `instance_id` and one of either `name` or `queue_id` is required.
-
-The following arguments are supported:
-
-* `queue_id` - (Optional) Returns information on a specific Queue by Queue id
-* `instance_id` - (Required) Reference to the hosting Amazon Connect Instance
-* `name` - (Optional) Returns information on a specific Queue by name
-
-## Attributes Reference
-
-In addition to all of the arguments above, the following attributes are exported:
-
-* `arn` - ARN of the Queue.
-* `description` - Description of the Queue.
-* `hours_of_operation_id` - Specifies the identifier of the Hours of Operation.
-* `id` - Identifier of the hosting Amazon Connect Instance and identifier of the Queue separated by a colon (`:`).
-* `max_contacts` - Maximum number of contacts that can be in the queue before it is considered full. Minimum value of 0.
-* `outbound_caller_config` - A block that defines the outbound caller ID name, number, and outbound whisper flow. The Outbound Caller Config block is documented below.
-* `queue_id` - Identifier for the Queue.
-* `status` - Description of the Queue. Values are `ENABLED` or `DISABLED`.
-* `tags` - Map of tags assigned to the Queue.
-
-A `outbound_caller_config` block supports the following arguments:
-
-* `outbound_caller_id_name` - Specifies the caller ID name.
-* `outbound_caller_id_number_id` - Specifies the caller ID number.
-* `outbound_flow_id` - Outbound whisper flow to be used during an outbound call.
diff --git a/website/docs/d/connect_quick_connect.html.markdown b/website/docs/d/connect_quick_connect.html.markdown
new file mode 100644
index 00000000000..549b5f45bc9
--- /dev/null
+++ b/website/docs/d/connect_quick_connect.html.markdown
@@ -0,0 +1,73 @@
+---
+subcategory: "Connect"
+layout: "aws"
+page_title: "AWS: aws_connect_quick_connect"
+description: |-
+  Provides details about a specific Amazon Connect Quick Connect.
+---
+
+# Data Source: aws_connect_quick_connect
+
+Provides details about a specific Amazon Connect Quick Connect.
+
+## Example Usage
+
+By `name`
+
+```hcl
+data "aws_connect_quick_connect" "example" {
+  instance_id = "aaaaaaaa-bbbb-cccc-dddd-111111111111"
+  name        = "Example"
+}
+```
+
+By `quick_connect_id`
+
+```hcl
+data "aws_connect_quick_connect" "example" {
+  instance_id      = "aaaaaaaa-bbbb-cccc-dddd-111111111111"
+  quick_connect_id = "cccccccc-bbbb-cccc-dddd-111111111111"
+}
+```
+
+## Argument Reference
+
+~> **NOTE:** `instance_id` and one of either `name` or `quick_connect_id` is required.
+
+This argument supports the following arguments:
+
+* `quick_connect_id` - (Optional) Returns information on a specific Quick Connect by Quick Connect id
+* `instance_id` - (Required) Reference to the hosting Amazon Connect Instance
+* `name` - (Optional) Returns information on a specific Quick Connect by name
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Quick Connect.
+* `description` - Description of the Quick Connect.
+* `id` - Identifier of the hosting Amazon Connect Instance and identifier of the Quick Connect separated by a colon (`:`).
+* `quick_connect_config` - A block that defines the configuration information for the Quick Connect: `quick_connect_type` and one of `phone_config`, `queue_config`, `user_config` . The Quick Connect Config block is documented below.
+* `quick_connect_id` - Identifier for the Quick Connect.
+* `tags` - Map of tags to assign to the Quick Connect.
+
+A `quick_connect_config` block contains the following arguments:
+
+* `quick_connect_type` - Configuration type of the Quick Connect. Valid values are `PHONE_NUMBER`, `QUEUE`, `USER`.
+* `phone_config` - Phone configuration of the Quick Connect. This is returned only if `quick_connect_type` is `PHONE_NUMBER`. The `phone_config` block is documented below.
+* `queue_config` - Queue configuration of the Quick Connect. This is returned only if `quick_connect_type` is `QUEUE`. The `queue_config` block is documented below.
+* `user_config` - User configuration of the Quick Connect. This is returned only if `quick_connect_type` is `USER`. The `user_config` block is documented below.
+
+A `phone_config` block contains the following arguments:
+
+* `phone_number` - Phone number in in E.164 format.
+
+A `queue_config` block contains the following arguments:
+
+* `contact_flow_id` - Identifier of the contact flow.
+* `queue_id` - Identifier for the queue.
+
+A `user_config` block contains the following arguments:
+
+* `contact_flow_id` - Identifier of the contact flow.
+* `user_id` - Identifier for the user.
diff --git a/website/docs/d/connect_quick_connect.markdown b/website/docs/d/connect_quick_connect.markdown
deleted file mode 100644
index 5526525daec..00000000000
--- a/website/docs/d/connect_quick_connect.markdown
+++ /dev/null
@@ -1,73 +0,0 @@
----
-subcategory: "Connect"
-layout: "aws"
-page_title: "AWS: aws_connect_quick_connect"
-description: |-
-  Provides details about a specific Amazon Connect Quick Connect.
----
-
-# Data Source: aws_connect_quick_connect
-
-Provides details about a specific Amazon Connect Quick Connect.
-
-## Example Usage
-
-By `name`
-
-```hcl
-data "aws_connect_quick_connect" "example" {
-  instance_id = "aaaaaaaa-bbbb-cccc-dddd-111111111111"
-  name        = "Example"
-}
-```
-
-By `quick_connect_id`
-
-```hcl
-data "aws_connect_quick_connect" "example" {
-  instance_id      = "aaaaaaaa-bbbb-cccc-dddd-111111111111"
-  quick_connect_id = "cccccccc-bbbb-cccc-dddd-111111111111"
-}
-```
-
-## Argument Reference
-
-~> **NOTE:** `instance_id` and one of either `name` or `quick_connect_id` is required.
-
-The following arguments are supported:
-
-* `quick_connect_id` - (Optional) Returns information on a specific Quick Connect by Quick Connect id
-* `instance_id` - (Required) Reference to the hosting Amazon Connect Instance
-* `name` - (Optional) Returns information on a specific Quick Connect by name
-
-## Attributes Reference
-
-In addition to all of the arguments above, the following attributes are exported:
-
-* `arn` - ARN of the Quick Connect.
-* `description` - Description of the Quick Connect.
-* `id` - Identifier of the hosting Amazon Connect Instance and identifier of the Quick Connect separated by a colon (`:`).
-* `quick_connect_config` - A block that defines the configuration information for the Quick Connect: `quick_connect_type` and one of `phone_config`, `queue_config`, `user_config` . The Quick Connect Config block is documented below.
-* `quick_connect_id` - Identifier for the Quick Connect.
-* `tags` - Map of tags to assign to the Quick Connect.
-
-A `quick_connect_config` block contains the following arguments:
-
-* `quick_connect_type` - Configuration type of the Quick Connect. Valid values are `PHONE_NUMBER`, `QUEUE`, `USER`.
-* `phone_config` - Phone configuration of the Quick Connect. This is returned only if `quick_connect_type` is `PHONE_NUMBER`. The `phone_config` block is documented below.
-* `queue_config` - Queue configuration of the Quick Connect. This is returned only if `quick_connect_type` is `QUEUE`. The `queue_config` block is documented below.
-* `user_config` - User configuration of the Quick Connect. This is returned only if `quick_connect_type` is `USER`. The `user_config` block is documented below.
-
-A `phone_config` block contains the following arguments:
-
-* `phone_number` - Phone number in in E.164 format.
-
-A `queue_config` block contains the following arguments:
-
-* `contact_flow_id` - Identifier of the contact flow.
-* `queue_id` - Identifier for the queue.
-
-A `user_config` block contains the following arguments:
-
-* `contact_flow_id` - Identifier of the contact flow.
-* `user_id` - Identifier for the user.
diff --git a/website/docs/d/connect_routing_profile.html.markdown b/website/docs/d/connect_routing_profile.html.markdown
index cff3f637556..befe6c3ce31 100644
--- a/website/docs/d/connect_routing_profile.html.markdown
+++ b/website/docs/d/connect_routing_profile.html.markdown
@@ -34,15 +34,15 @@ data "aws_connect_routing_profile" "example" {
 
 ~> **NOTE:** `instance_id` and one of either `name` or `routing_profile_id` is required.
 
-The following arguments are supported:
+This argument supports the following arguments:
 
 * `instance_id` - Reference to the hosting Amazon Connect Instance
 * `name` - (Optional) Returns information on a specific Routing Profile by name
 * `routing_profile_id` - (Optional) Returns information on a specific Routing Profile by Routing Profile id
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all of the arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the Routing Profile.
 * `default_outbound_queue_id` - Specifies the default outbound queue for the Routing Profile.
diff --git a/website/docs/d/connect_security_profile.html.markdown b/website/docs/d/connect_security_profile.html.markdown
index fdbe3405fe0..ace74b991ae 100644
--- a/website/docs/d/connect_security_profile.html.markdown
+++ b/website/docs/d/connect_security_profile.html.markdown
@@ -34,15 +34,15 @@ data "aws_connect_security_profile" "example" {
 
 ~> **NOTE:** `instance_id` and one of either `name` or `security_profile_id` is required.
 
-The following arguments are supported:
+This argument supports the following arguments:
 
 * `security_profile_id` - (Optional) Returns information on a specific Security Profile by Security Profile id
 * `instance_id` - (Required) Reference to the hosting Amazon Connect Instance
 * `name` - (Optional) Returns information on a specific Security Profile by name
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all of the arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the Security Profile.
 * `description` - Description of the Security Profile.
diff --git a/website/docs/d/connect_user.html.markdown b/website/docs/d/connect_user.html.markdown
index 33d39e1dee7..0a786bff723 100644
--- a/website/docs/d/connect_user.html.markdown
+++ b/website/docs/d/connect_user.html.markdown
@@ -34,15 +34,15 @@ data "aws_connect_user" "example" {
 
 ~> **NOTE:** `instance_id` and one of either `name` or `user_id` is required.
 
-The following arguments are supported:
+This argument supports the following arguments:
 
 * `instance_id` - (Required) Reference to the hosting Amazon Connect Instance
 * `name` - (Optional) Returns information on a specific User by name
 * `user_id` - (Optional) Returns information on a specific User by User id
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all of the arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - The Amazon Resource Name (ARN) of the User.
 * `directory_user_id` - The identifier of the user account in the directory used for identity management.
diff --git a/website/docs/d/connect_user_hierarchy_group.html.markdown b/website/docs/d/connect_user_hierarchy_group.html.markdown
index 27aeb1bbf93..2e245151214 100644
--- a/website/docs/d/connect_user_hierarchy_group.html.markdown
+++ b/website/docs/d/connect_user_hierarchy_group.html.markdown
@@ -34,15 +34,15 @@ data "aws_connect_user_hierarchy_group" "example" {
 
 ~> **NOTE:** `instance_id` and one of either `name` or `hierarchy_group_id` is required.
 
-The following arguments are supported:
+This argument supports the following arguments:
 
 * `hierarchy_group_id` - (Optional) Returns information on a specific hierarchy group by hierarchy group id
 * `instance_id` - (Required) Reference to the hosting Amazon Connect Instance
 * `name` - (Optional) Returns information on a specific hierarchy group by name
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all of the arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the hierarchy group.
 * `hierarchy_path` - Block that contains information about the levels in the hierarchy group. The `hierarchy_path` block is documented below.
diff --git a/website/docs/d/connect_user_hierarchy_structure.html.markdown b/website/docs/d/connect_user_hierarchy_structure.html.markdown
index 50623273f25..2c95af7c892 100644
--- a/website/docs/d/connect_user_hierarchy_structure.html.markdown
+++ b/website/docs/d/connect_user_hierarchy_structure.html.markdown
@@ -20,13 +20,13 @@ data "aws_connect_user_hierarchy_structure" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `instance_id` - (Required) Reference to the hosting Amazon Connect Instance
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all of the argument above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `hierarchy_structure` - Block that defines the hierarchy structure's levels. The `hierarchy_structure` block is documented below.
 
diff --git a/website/docs/d/connect_vocabulary.html.markdown b/website/docs/d/connect_vocabulary.html.markdown
index 59ed650c8bc..a6018d72d7e 100644
--- a/website/docs/d/connect_vocabulary.html.markdown
+++ b/website/docs/d/connect_vocabulary.html.markdown
@@ -34,15 +34,15 @@ data "aws_connect_vocabulary" "example" {
 
 ~> **NOTE:** `instance_id` and one of either `name` or `vocabulary_id` is required.
 
-The following arguments are supported:
+This argument supports the following arguments:
 
 * `instance_id` - (Required) Reference to the hosting Amazon Connect Instance
 * `name` - (Optional) Returns information on a specific Vocabulary by name
 * `vocabulary_id` - (Optional) Returns information on a specific Vocabulary by Vocabulary id
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all of the arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - The Amazon Resource Name (ARN) of the Vocabulary.
 * `content` - The content of the custom vocabulary in plain-text format with a table of values. Each row in the table represents a word or a phrase, described with Phrase, IPA, SoundsLike, and DisplayAs fields. Separate the fields with TAB characters. For more information, see [Create a custom vocabulary using a table](https://docs.aws.amazon.com/transcribe/latest/dg/custom-vocabulary.html#create-vocabulary-table).
diff --git a/website/docs/d/controltower_controls.html.markdown b/website/docs/d/controltower_controls.html.markdown
index 76dd4ec644d..62f61bb466f 100644
--- a/website/docs/d/controltower_controls.html.markdown
+++ b/website/docs/d/controltower_controls.html.markdown
@@ -38,6 +38,6 @@ The following arguments are required:
 
 ## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `enabled_controls` - List of all the ARNs for the controls applied to the `target_identifier`.
diff --git a/website/docs/d/cur_report_definition.html.markdown b/website/docs/d/cur_report_definition.html.markdown
index 0c5e8293358..ff396611b79 100644
--- a/website/docs/d/cur_report_definition.html.markdown
+++ b/website/docs/d/cur_report_definition.html.markdown
@@ -24,11 +24,13 @@ data "aws_cur_report_definition" "report_definition" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `report_name` - (Required) Name of the report definition to match.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `time_unit` - Frequency on which report data are measured and displayed.
 * `format` - Preferred compression format for report.
diff --git a/website/docs/d/customer_gateway.html.markdown b/website/docs/d/customer_gateway.html.markdown
index bc650d42f41..d0042cec14d 100644
--- a/website/docs/d/customer_gateway.html.markdown
+++ b/website/docs/d/customer_gateway.html.markdown
@@ -35,7 +35,7 @@ resource "aws_vpn_connection" "transit" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `id` - (Optional) ID of the gateway.
 * `filter` - (Optional) One or more [name-value pairs][dcg-filters] to filter by.
@@ -44,7 +44,7 @@ The following arguments are supported:
 
 ## Attribute Reference
 
-In addition to the arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the customer gateway.
 * `bgp_asn` - Gateway's Border Gateway Protocol (BGP) Autonomous System Number (ASN).
diff --git a/website/docs/d/datapipeline_pipeline.html.markdown b/website/docs/d/datapipeline_pipeline.html.markdown
index a19cbfad82c..0c61ce9ed81 100644
--- a/website/docs/d/datapipeline_pipeline.html.markdown
+++ b/website/docs/d/datapipeline_pipeline.html.markdown
@@ -24,9 +24,9 @@ The following arguments are required:
 
 * `pipeline_id` - (Required) ID of the pipeline.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `name` - Name of Pipeline.
 * `description` - Description of Pipeline.
diff --git a/website/docs/d/datapipeline_pipeline_definition.html.markdown b/website/docs/d/datapipeline_pipeline_definition.html.markdown
index e3d3079b8b8..42e800c8d41 100644
--- a/website/docs/d/datapipeline_pipeline_definition.html.markdown
+++ b/website/docs/d/datapipeline_pipeline_definition.html.markdown
@@ -24,9 +24,9 @@ The following arguments are required:
 
 * `pipeline_id` - (Required) ID of the pipeline.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `parameter_object` - Parameter objects used in the pipeline definition. See below
 * `parameter_value` - Parameter values used in the pipeline definition. See below
diff --git a/website/docs/d/db_cluster_snapshot.html.markdown b/website/docs/d/db_cluster_snapshot.html.markdown
index 7b5112976b8..142f9688f01 100644
--- a/website/docs/d/db_cluster_snapshot.html.markdown
+++ b/website/docs/d/db_cluster_snapshot.html.markdown
@@ -42,28 +42,25 @@ resource "aws_rds_cluster_instance" "aurora" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `most_recent` - (Optional) If more than one result is returned, use the most recent Snapshot.
-
 * `db_cluster_identifier` - (Optional) Returns the list of snapshots created by the specific db_cluster
-
 * `db_cluster_snapshot_identifier` - (Optional) Returns information on a specific snapshot_id.
-
 * `snapshot_type` - (Optional) Type of snapshots to be returned. If you don't specify a SnapshotType
 value, then both automated and manual DB cluster snapshots are returned. Shared and public DB Cluster Snapshots are not
 included in the returned results by default. Possible values are, `automated`, `manual`, `shared`, `public` and `awsbackup`.
-
 * `include_shared` - (Optional) Set this value to true to include shared manual DB Cluster Snapshots from other
 AWS accounts that this AWS account has been given permission to copy or restore, otherwise set this value to false.
 The default is `false`.
-
 * `include_public` - (Optional) Set this value to true to include manual DB Cluster Snapshots that are public and can be
 copied or restored by any AWS account, otherwise set this value to false. The default is `false`.
+* `tags` - (Optional) Mapping of tags, each pair of which must exactly match
+  a pair on the desired DB cluster snapshot.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `allocated_storage` - Allocated storage size in gigabytes (GB).
 * `availability_zones` - List of EC2 Availability Zones that instances in the DB cluster snapshot can be restored in.
diff --git a/website/docs/d/db_event_categories.html.markdown b/website/docs/d/db_event_categories.html.markdown
index 8282dca42a4..6360f2478b7 100644
--- a/website/docs/d/db_event_categories.html.markdown
+++ b/website/docs/d/db_event_categories.html.markdown
@@ -34,13 +34,13 @@ output "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `source_type` - (Optional) Type of source that will be generating the events. Valid options are db-instance, db-security-group, db-parameter-group, db-snapshot, db-cluster or db-cluster-snapshot.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `event_categories` - List of the event categories.
 * `id` - Region of the event categories.
diff --git a/website/docs/d/db_instance.html.markdown b/website/docs/d/db_instance.html.markdown
index de7e872520a..ade4a86fbb6 100644
--- a/website/docs/d/db_instance.html.markdown
+++ b/website/docs/d/db_instance.html.markdown
@@ -20,15 +20,16 @@ data "aws_db_instance" "database" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
-* `db_instance_identifier` - (Required) Name of the RDS instance
+* `db_instance_identifier` - (Optional) Name of the RDS instance.
+* `tags` - (Optional) Map of tags, each pair of which must exactly match a pair on the desired instance.
 
-## Attributes Reference
+## Attribute Reference
 
 ~> **NOTE:** The `port` field may be empty while an Aurora cluster is still in the process of being created. This can occur if the cluster was initiated with the [AWS CLI `create-db-cluster`](https://docs.aws.amazon.com/cli/latest/reference/rds/create-db-cluster.html) command, but no DB instance has yet been added to it.
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `address` - Hostname of the RDS instance. See also `endpoint` and `port`.
 * `allocated_storage` - Allocated storage size specified in gigabytes.
@@ -52,6 +53,7 @@ In addition to all arguments above, the following attributes are exported:
 * `license_model` - License model information for this DB instance.
 * `master_username` - Contains the master username for the DB instance.
 * `master_user_secret` - Provides the master user secret. Only available when `manage_master_user_password` is set to true. [Documented below](#master_user_secret).
+* `max_allocated_storage` - The upper limit to which Amazon RDS can automatically scale the storage of the DB instance.
 * `monitoring_interval` - Interval, in seconds, between points when Enhanced Monitoring metrics are collected for the DB instance.
 * `monitoring_role_arn` - ARN for the IAM role that permits RDS to send Enhanced Monitoring metrics to CloudWatch Logs.
 * `multi_az` - If the DB instance is a Multi-AZ deployment.
diff --git a/website/docs/d/db_instances.html.markdown b/website/docs/d/db_instances.html.markdown
index 4e947a8ebde..3bd004db4bc 100644
--- a/website/docs/d/db_instances.html.markdown
+++ b/website/docs/d/db_instances.html.markdown
@@ -23,22 +23,33 @@ data "aws_db_instances" "example" {
 }
 ```
 
+### Using tags
+
+```terraform
+data "aws_db_instances" "example" {
+  tags = {
+    Env = "test"
+  }
+}
+```
+
 ## Argument Reference
 
 The following arguments are optional:
 
-* `filter` - (Optional) Configuration block(s) for filtering. Detailed below.
+* `filter` - (Optional) Configuration block(s) used to filter instances with AWS supported attributes, such as `engine`, `db-cluster-id` or `db-instance-id` for example. Detailed below.
+* `tags` - (Optional) Map of tags, each pair of which must exactly match a pair on the desired instances.
 
 ### filter Configuration block
 
-The following arguments are supported by the `filter` configuration block:
+The `filter` configuration block supports the following arguments:
 
-* `name` - (Required) Name of the filter field. Valid values can be found in the [RDS DescribeDBClusters API Reference](https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeDBClusters.html).
+* `name` - (Required) Name of the filter field. Valid values can be found in the [RDS DescribeDBClusters API Reference](https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeDBClusters.html) or [RDS DescribeDBInstances API Reference](https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeDBInstances.html).
 * `values` - (Required) Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `instance_arns` - ARNs of the matched RDS instances.
 * `instance_identifiers` - Identifiers of the matched RDS instances.
diff --git a/website/docs/d/db_proxy.html.markdown b/website/docs/d/db_proxy.html.markdown
index e8a51715d87..6fe743ea854 100644
--- a/website/docs/d/db_proxy.html.markdown
+++ b/website/docs/d/db_proxy.html.markdown
@@ -20,13 +20,13 @@ data "aws_db_proxy" "proxy" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `name` - (Required) Name of the DB proxy.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the DB Proxy.
 * `auth` - Configuration(s) with authorization mechanisms to connect to the associated instance or cluster.
diff --git a/website/docs/d/db_snapshot.html.markdown b/website/docs/d/db_snapshot.html.markdown
index bd133abe2c6..7dc0e5243f1 100644
--- a/website/docs/d/db_snapshot.html.markdown
+++ b/website/docs/d/db_snapshot.html.markdown
@@ -49,29 +49,26 @@ resource "aws_db_instance" "dev" {
 
 ~> **NOTE:** One of either `db_instance_identifier` or `db_snapshot_identifier` is required.
 
-The following arguments are supported:
+This argument supports the following arguments:
 
 * `most_recent` - (Optional) If more than one result is returned, use the most
 recent Snapshot.
-
 * `db_instance_identifier` - (Optional) Returns the list of snapshots created by the specific db_instance
-
 * `db_snapshot_identifier` - (Optional) Returns information on a specific snapshot_id.
-
 * `snapshot_type` - (Optional) Type of snapshots to be returned. If you don't specify a SnapshotType
 value, then both automated and manual snapshots are returned. Shared and public DB snapshots are not
 included in the returned results by default. Possible values are, `automated`, `manual`, `shared`, `public` and `awsbackup`.
-
 * `include_shared` - (Optional) Set this value to true to include shared manual DB snapshots from other
 AWS accounts that this AWS account has been given permission to copy or restore, otherwise set this value to false.
 The default is `false`.
-
 * `include_public` - (Optional) Set this value to true to include manual DB snapshots that are public and can be
 copied or restored by any AWS account, otherwise set this value to false. The default is `false`.
+* `tags` - (Optional) Mapping of tags, each pair of which must exactly match
+  a pair on the desired DB snapshot.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - Snapshot ID.
 * `allocated_storage` - Allocated storage size in gigabytes (GB).
diff --git a/website/docs/d/db_subnet_group.html.markdown b/website/docs/d/db_subnet_group.html.markdown
index cd98a5f722d..607f9239e28 100644
--- a/website/docs/d/db_subnet_group.html.markdown
+++ b/website/docs/d/db_subnet_group.html.markdown
@@ -20,13 +20,13 @@ data "aws_db_subnet_group" "database" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `name` - (Required) Name of the RDS database subnet group.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN for the DB subnet group.
 * `description` - Provides the description of the DB subnet group.
diff --git a/website/docs/d/default_tags.html.markdown b/website/docs/d/default_tags.html.markdown
new file mode 100644
index 00000000000..463a2978a79
--- /dev/null
+++ b/website/docs/d/default_tags.html.markdown
@@ -0,0 +1,63 @@
+---
+subcategory: "Meta Data Sources"
+layout: "aws"
+page_title: "AWS: aws_default_tags"
+description: |-
+  Access the default tags configured on the provider.
+---
+
+# Data Source: aws_default_tags
+
+Use this data source to get the default tags configured on the provider.
+
+With this data source, you can apply default tags to resources not _directly_ managed by a Terraform resource, such as the instances underneath an Auto Scaling group or the volumes created for an EC2 instance.
+
+## Example Usage
+
+### Basic Usage
+
+```terraform
+data "aws_default_tags" "example" {}
+```
+
+### Dynamically Apply Default Tags to Auto Scaling Group
+
+```terraform
+provider "aws" {
+  default_tags {
+    tags = {
+      Environment = "Test"
+      Name        = "Provider Tag"
+    }
+  }
+}
+
+data "aws_default_tags" "example" {}
+
+resource "aws_autoscaling_group" "example" {
+  # ...
+  dynamic "tag" {
+    for_each = data.aws_default_tags.example.tags
+    content {
+      key                 = tag.key
+      value               = tag.value
+      propagate_at_launch = true
+    }
+  }
+}
+```
+
+## Argument Reference
+
+This data source has no arguments.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `tags` - Blocks of default tags set on the provider. See details below.
+
+### tags
+
+* `key` - Key name of the tag (i.e., `tags.#.key`).
+* `value` - Value of the tag (i.e., `tags.#.value`).
diff --git a/website/docs/d/default_tags.markdown b/website/docs/d/default_tags.markdown
deleted file mode 100644
index 611905397ee..00000000000
--- a/website/docs/d/default_tags.markdown
+++ /dev/null
@@ -1,63 +0,0 @@
----
-subcategory: "Meta Data Sources"
-layout: "aws"
-page_title: "AWS: aws_default_tags"
-description: |-
-  Access the default tags configured on the provider.
----
-
-# Data Source: aws_default_tags
-
-Use this data source to get the default tags configured on the provider.
-
-With this data source, you can apply default tags to resources not _directly_ managed by a Terraform resource, such as the instances underneath an Auto Scaling group or the volumes created for an EC2 instance.
-
-## Example Usage
-
-### Basic Usage
-
-```terraform
-data "aws_default_tags" "example" {}
-```
-
-### Dynamically Apply Default Tags to Auto Scaling Group
-
-```terraform
-provider "aws" {
-  default_tags {
-    tags = {
-      Environment = "Test"
-      Name        = "Provider Tag"
-    }
-  }
-}
-
-data "aws_default_tags" "example" {}
-
-resource "aws_autoscaling_group" "example" {
-  # ...
-  dynamic "tag" {
-    for_each = data.aws_default_tags.example.tags
-    content {
-      key                 = tag.key
-      value               = tag.value
-      propagate_at_launch = true
-    }
-  }
-}
-```
-
-## Argument Reference
-
-This data source has no arguments.
-
-## Attributes Reference
-
-In addition to all arguments above, the following attributes are exported:
-
-* `tags` - Blocks of default tags set on the provider. See details below.
-
-### tags
-
-* `key` - Key name of the tag (i.e., `tags.#.key`).
-* `value` - Value of the tag (i.e., `tags.#.value`).
diff --git a/website/docs/d/directory_service_directory.html.markdown b/website/docs/d/directory_service_directory.html.markdown
index a2b3a876f2a..c6b8d0a27d9 100644
--- a/website/docs/d/directory_service_directory.html.markdown
+++ b/website/docs/d/directory_service_directory.html.markdown
@@ -22,7 +22,9 @@ data "aws_directory_service_directory" "example" {
 
 * `directory_id` - (Required) ID of the directory.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `type` - Directory type (`SimpleAD`, `ADConnector` or `MicrosoftAD`).
 * `edition` - (for `MicrosoftAD`) Microsoft AD edition (`Standard` or `Enterprise`).
diff --git a/website/docs/d/dms_certificate.html.markdown b/website/docs/d/dms_certificate.html.markdown
index b37b0c544f9..4e1fcabc05b 100644
--- a/website/docs/d/dms_certificate.html.markdown
+++ b/website/docs/d/dms_certificate.html.markdown
@@ -26,9 +26,9 @@ The following arguments are required:
 
 * `certificate_id` - (Required) A customer-assigned name for the certificate. Identifiers must begin with a letter and must contain only ASCII letters, digits, and hyphens. They can't end with a hyphen or contain two consecutive hyphens.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `certificate_creation_date` - The date that the certificate was created.
 * `certificate_pem` - The contents of a .pem file, which contains an X.509 certificate.
diff --git a/website/docs/d/dms_endpoint.html.markdown b/website/docs/d/dms_endpoint.html.markdown
index 474259cce2b..98e30df5cb7 100644
--- a/website/docs/d/dms_endpoint.html.markdown
+++ b/website/docs/d/dms_endpoint.html.markdown
@@ -26,6 +26,6 @@ The following arguments are required:
 
 * `endpoint_id` - (Required) Database endpoint identifier. Identifiers must contain from 1 to 255 alphanumeric characters or hyphens, begin with a letter, contain only ASCII letters, digits, and hyphens, not end with a hyphen, and not contain two consecutive hyphens.
 
-## Attributes Reference
+## Attribute Reference
 
 See the [`aws_dms_endpoint` resource](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/dms_endpoint) for details on the returned attributes - they are identical.
diff --git a/website/docs/d/dms_replication_instance.html.markdown b/website/docs/d/dms_replication_instance.html.markdown
index 892f3fd9eed..d5108a7fca2 100644
--- a/website/docs/d/dms_replication_instance.html.markdown
+++ b/website/docs/d/dms_replication_instance.html.markdown
@@ -1,7 +1,7 @@
 ---
 subcategory: "DMS (Database Migration)"
 layout: "aws"
-page_title: "AWS: aws_dms_certificate"
+page_title: "AWS: aws_dms_replication_instance"
 description: |-
   Terraform data source for managing an AWS DMS (Database Migration) Replication Instance.
 ---
@@ -22,36 +22,24 @@ data "aws_dms_replication_instance" "test" {
 
 The following arguments are required:
 
-* `replication_instance_id` - (Required) The replication instance identifier. This parameter is stored as a lowercase string.
+* `replication_instance_id` - (Required) The replication instance identifier.
 
-    - Must contain from 1 to 63 alphanumeric characters or hyphens.
-    - First character must be a letter.
-    - Cannot end with a hyphen
-    - Cannot contain two consecutive hyphens.
+## Attribute Reference
 
-## Attributes Reference
+This data source exports the following attributes in addition to the arguments above:
 
-In addition to all arguments above, the following attributes are exported:
-
-* `allocated_storage` - (Default: 50, Min: 5, Max: 6144) The amount of storage (in gigabytes) to be initially allocated for the replication instance.
-* `allow_major_version_upgrade` - (Default: false) Indicates that major version upgrades are allowed.
-* `apply_immediately` - (Default: false) Indicates whether the changes should be applied immediately or during the next maintenance window. Only used when updating an existing resource.
-* `auto_minor_version_upgrade` - (Default: false) Indicates that minor engine upgrades will be applied automatically to the replication instance during the maintenance window.
+* `allocated_storage` - The amount of storage (in gigabytes) to be initially allocated for the replication instance.
+* `auto_minor_version_upgrade` - Indicates that minor engine upgrades will be applied automatically to the replication instance during the maintenance window.
 * `availability_zone` - The EC2 Availability Zone that the replication instance will be created in.
 * `engine_version` - The engine version number of the replication instance.
-* `kms_key_arn` - The Amazon Resource Name (ARN) for the KMS key that will be used to encrypt the connection parameters. If you do not specify a value for `kms_key_arn`, then AWS DMS will use your default encryption key. AWS KMS creates the default encryption key for your AWS account. Your AWS account has a different default encryption key for each AWS region.
-* `multi_az` - Specifies if the replication instance is a multi-az deployment. You cannot set the `availability_zone` parameter if the `multi_az` parameter is set to `true`.
+* `kms_key_arn` - The Amazon Resource Name (ARN) for the KMS key used to encrypt the connection parameters.
+* `multi_az` - Specifies if the replication instance is a multi-az deployment.
+* `network_type` - The type of IP address protocol used by the replication instance.
 * `preferred_maintenance_window` - The weekly time range during which system maintenance can occur, in Universal Coordinated Time (UTC).
-
-    - Default: A 30-minute window selected at random from an 8-hour block of time per region, occurring on a random day of the week.
-    - Format: `ddd:hh24:mi-ddd:hh24:mi`
-    - Valid Days: `mon, tue, wed, thu, fri, sat, sun`
-    - Constraints: Minimum 30-minute window.
-
-* `publicly_accessible` - (Default: false) Specifies the accessibility options for the replication instance. A value of true represents an instance with a public IP address. A value of false represents an instance with a private IP address.
+* `publicly_accessible` - Specifies the accessibility options for the replication instance. A value of true represents an instance with a public IP address. A value of false represents an instance with a private IP address.
 * `replication_instance_arn` - The Amazon Resource Name (ARN) of the replication instance.
-* `replication_instance_class` - The compute and memory capacity of the replication instance as specified by the replication instance class. See [AWS DMS User Guide](https://docs.aws.amazon.com/dms/latest/userguide/CHAP_ReplicationInstance.Types.html) for available instance sizes and advice on which one to choose.
+* `replication_instance_class` - The compute and memory capacity of the replication instance as specified by the replication instance class. See [AWS DMS User Guide](https://docs.aws.amazon.com/dms/latest/userguide/CHAP_ReplicationInstance.Types.html) for information on instance classes.
 * `replication_instance_private_ips` - A list of the private IP addresses of the replication instance.
 * `replication_instance_public_ips` - A list of the public IP addresses of the replication instance.
-* `replication_subnet_group_id` - (Optional) A subnet group to associate with the replication instance.
-* `vpc_security_group_ids` - (Optional) A list of VPC security group IDs to be used with the replication instance. The VPC security groups must work with the VPC containing the replication instance.
+* `replication_subnet_group_id` - A subnet group to associate with the replication instance.
+* `vpc_security_group_ids` - A set of VPC security group IDs that are used with the replication instance.
diff --git a/website/docs/d/dms_replication_subnet_group.html.markdown b/website/docs/d/dms_replication_subnet_group.html.markdown
index 7e2716c1f99..c0e859df5d5 100644
--- a/website/docs/d/dms_replication_subnet_group.html.markdown
+++ b/website/docs/d/dms_replication_subnet_group.html.markdown
@@ -26,9 +26,9 @@ The following arguments are required:
 
 * `replication_subnet_group_id` - (Required) Name for the replication subnet group. This value is stored as a lowercase string. It must contain no more than 255 alphanumeric characters, periods, spaces, underscores, or hyphens and cannot be `default`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `replication_subnet_group_description` - Description for the subnet group.
 * `subnet_ids` - List of at least 2 EC2 subnet IDs for the subnet group. The subnets must cover at least 2 availability zones.
diff --git a/website/docs/d/dms_replication_task.html.markdown b/website/docs/d/dms_replication_task.html.markdown
index 85a1d89cbef..3dbfe3c7cbc 100644
--- a/website/docs/d/dms_replication_task.html.markdown
+++ b/website/docs/d/dms_replication_task.html.markdown
@@ -31,9 +31,9 @@ The following arguments are required:
     - Cannot end with a hyphen.
     - Cannot contain two consecutive hyphens.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `cdc_start_position` - (Conflicts with `cdc_start_time`) Indicates when you want a change data capture (CDC) operation to start. The value can be in date, checkpoint, or LSN/SCN format depending on the source engine. For more information, see [Determining a CDC native start point](https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Task.CDC.html#CHAP_Task.CDC.StartPoint.Native).
 * `cdc_start_time` - (Conflicts with `cdc_start_position`) The Unix timestamp integer for the start of the Change Data Capture (CDC) operation.
diff --git a/website/docs/d/docdb_engine_version.html.markdown b/website/docs/d/docdb_engine_version.html.markdown
new file mode 100644
index 00000000000..97eb9ee3cfa
--- /dev/null
+++ b/website/docs/d/docdb_engine_version.html.markdown
@@ -0,0 +1,38 @@
+---
+subcategory: "DocumentDB"
+layout: "aws"
+page_title: "AWS: aws_docdb_engine_version"
+description: |-
+  Information about a DocumentDB engine version.
+---
+
+# Data Source: aws_docdb_engine_version
+
+Information about a DocumentDB engine version.
+
+## Example Usage
+
+```terraform
+data "aws_docdb_engine_version" "test" {
+  version = "3.6.0"
+}
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `engine` - (Optional) DB engine. (Default: `docdb`)
+* `parameter_group_family` - (Optional) Name of a specific DB parameter group family. An example parameter group family is `docdb3.6`.
+* `preferred_versions` - (Optional) Ordered list of preferred engine versions. The first match in this list will be returned. If no preferred matches are found and the original search returned more than one result, an error is returned. If both the `version` and `preferred_versions` arguments are not configured, the data source will return the default version for the engine.
+* `version` - (Optional) Version of the DB engine. For example, `3.6.0`. If `version` and `preferred_versions` are not set, the data source will provide information for the AWS-defined default version. If both the `version` and `preferred_versions` arguments are not configured, the data source will return the default version for the engine.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `engine_description` - Description of the database engine.
+* `exportable_log_types` - Set of log types that the database engine has available for export to CloudWatch Logs.
+* `supports_log_exports_to_cloudwatch` - Indicates whether the engine version supports exporting the log types specified by `exportable_log_types` to CloudWatch Logs.
+* `valid_upgrade_targets` - A set of engine versions that this database engine version can be upgraded to.
+* `version_description` - Description of the database engine version.
diff --git a/website/docs/d/docdb_engine_version.markdown b/website/docs/d/docdb_engine_version.markdown
deleted file mode 100644
index 0cfdccd850c..00000000000
--- a/website/docs/d/docdb_engine_version.markdown
+++ /dev/null
@@ -1,38 +0,0 @@
----
-subcategory: "DocumentDB"
-layout: "aws"
-page_title: "AWS: aws_docdb_engine_version"
-description: |-
-  Information about a DocumentDB engine version.
----
-
-# Data Source: aws_docdb_engine_version
-
-Information about a DocumentDB engine version.
-
-## Example Usage
-
-```terraform
-data "aws_docdb_engine_version" "test" {
-  version = "3.6.0"
-}
-```
-
-## Argument Reference
-
-The following arguments are supported:
-
-* `engine` - (Optional) DB engine. (Default: `docdb`)
-* `parameter_group_family` - (Optional) Name of a specific DB parameter group family. An example parameter group family is `docdb3.6`.
-* `preferred_versions` - (Optional) Ordered list of preferred engine versions. The first match in this list will be returned. If no preferred matches are found and the original search returned more than one result, an error is returned. If both the `version` and `preferred_versions` arguments are not configured, the data source will return the default version for the engine.
-* `version` - (Optional) Version of the DB engine. For example, `3.6.0`. If `version` and `preferred_versions` are not set, the data source will provide information for the AWS-defined default version. If both the `version` and `preferred_versions` arguments are not configured, the data source will return the default version for the engine.
-
-## Attribute Reference
-
-In addition to all arguments above, the following attributes are exported:
-
-* `engine_description` - Description of the database engine.
-* `exportable_log_types` - Set of log types that the database engine has available for export to CloudWatch Logs.
-* `supports_log_exports_to_cloudwatch` - Indicates whether the engine version supports exporting the log types specified by `exportable_log_types` to CloudWatch Logs.
-* `valid_upgrade_targets` - A set of engine versions that this database engine version can be upgraded to.
-* `version_description` - Description of the database engine version.
diff --git a/website/docs/d/docdb_orderable_db_instance.html.markdown b/website/docs/d/docdb_orderable_db_instance.html.markdown
new file mode 100644
index 00000000000..103f4a88549
--- /dev/null
+++ b/website/docs/d/docdb_orderable_db_instance.html.markdown
@@ -0,0 +1,40 @@
+---
+subcategory: "DocumentDB"
+layout: "aws"
+page_title: "AWS: aws_docdb_orderable_db_instance"
+description: |-
+  Information about DocumentDB orderable DB instances.
+---
+
+# Data Source: aws_docdb_orderable_db_instance
+
+Information about DocumentDB orderable DB instances.
+
+## Example Usage
+
+```terraform
+data "aws_docdb_orderable_db_instance" "test" {
+  engine         = "docdb"
+  engine_version = "3.6.0"
+  license_model  = "na"
+
+  preferred_instance_classes = ["db.r5.large", "db.r4.large", "db.t3.medium"]
+}
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `engine` - (Optional) DB engine. Default: `docdb`
+* `engine_version` - (Optional) Version of the DB engine.
+* `instance_class` - (Optional) DB instance class. Examples of classes are `db.r5.12xlarge`, `db.r5.24xlarge`, `db.r5.2xlarge`, `db.r5.4xlarge`, `db.r5.large`, `db.r5.xlarge`, and `db.t3.medium`. (Conflicts with `preferred_instance_classes`.)
+* `license_model` - (Optional) License model. Default: `na`
+* `preferred_instance_classes` - (Optional) Ordered list of preferred DocumentDB DB instance classes. The first match in this list will be returned. If no preferred matches are found and the original search returned more than one result, an error is returned. (Conflicts with `instance_class`.)
+* `vpc` - (Optional) Enable to show only VPC.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `availability_zones` - Availability zones where the instance is available.
diff --git a/website/docs/d/docdb_orderable_db_instance.markdown b/website/docs/d/docdb_orderable_db_instance.markdown
deleted file mode 100644
index bceba226f92..00000000000
--- a/website/docs/d/docdb_orderable_db_instance.markdown
+++ /dev/null
@@ -1,40 +0,0 @@
----
-subcategory: "DocumentDB"
-layout: "aws"
-page_title: "AWS: aws_docdb_orderable_db_instance"
-description: |-
-  Information about DocumentDB orderable DB instances.
----
-
-# Data Source: aws_docdb_orderable_db_instance
-
-Information about DocumentDB orderable DB instances.
-
-## Example Usage
-
-```terraform
-data "aws_docdb_orderable_db_instance" "test" {
-  engine         = "docdb"
-  engine_version = "3.6.0"
-  license_model  = "na"
-
-  preferred_instance_classes = ["db.r5.large", "db.r4.large", "db.t3.medium"]
-}
-```
-
-## Argument Reference
-
-The following arguments are supported:
-
-* `engine` - (Optional) DB engine. Default: `docdb`
-* `engine_version` - (Optional) Version of the DB engine.
-* `instance_class` - (Optional) DB instance class. Examples of classes are `db.r5.12xlarge`, `db.r5.24xlarge`, `db.r5.2xlarge`, `db.r5.4xlarge`, `db.r5.large`, `db.r5.xlarge`, and `db.t3.medium`. (Conflicts with `preferred_instance_classes`.)
-* `license_model` - (Optional) License model. Default: `na`
-* `preferred_instance_classes` - (Optional) Ordered list of preferred DocumentDB DB instance classes. The first match in this list will be returned. If no preferred matches are found and the original search returned more than one result, an error is returned. (Conflicts with `instance_class`.)
-* `vpc` - (Optional) Enable to show only VPC.
-
-## Attribute Reference
-
-In addition to all arguments above, the following attribute is exported:
-
-* `availability_zones` - Availability zones where the instance is available.
diff --git a/website/docs/d/dx_connection.html.markdown b/website/docs/d/dx_connection.html.markdown
index 89ff6e0999c..b3bcf5d6363 100644
--- a/website/docs/d/dx_connection.html.markdown
+++ b/website/docs/d/dx_connection.html.markdown
@@ -22,9 +22,9 @@ data "aws_dx_connection" "example" {
 
 * `name` - (Required) Name of the connection to retrieve.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the connection.
 * `aws_device` - Direct Connect endpoint on which the physical connection terminates.
diff --git a/website/docs/d/dx_gateway.html.markdown b/website/docs/d/dx_gateway.html.markdown
index 06500967eb3..225dabc9610 100644
--- a/website/docs/d/dx_gateway.html.markdown
+++ b/website/docs/d/dx_gateway.html.markdown
@@ -22,7 +22,9 @@ data "aws_dx_gateway" "example" {
 
 * `name` - (Required) Name of the gateway to retrieve.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `amazon_side_asn` - ASN on the Amazon side of the connection.
 * `id` - ID of the gateway.
diff --git a/website/docs/d/dx_location.html.markdown b/website/docs/d/dx_location.html.markdown
index 031ee6046ec..7a775328675 100644
--- a/website/docs/d/dx_location.html.markdown
+++ b/website/docs/d/dx_location.html.markdown
@@ -25,9 +25,9 @@ data "aws_dx_location" "example" {
 
 * `location_code` - (Required) Code for the location to retrieve.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `available_macsec_port_speeds` - The available MAC Security (MACsec) port speeds for the location.
 * `available_port_speeds` - The available port speeds for the location.
diff --git a/website/docs/d/dx_locations.html.markdown b/website/docs/d/dx_locations.html.markdown
index e5d372c1184..3e5f27986d8 100644
--- a/website/docs/d/dx_locations.html.markdown
+++ b/website/docs/d/dx_locations.html.markdown
@@ -23,6 +23,8 @@ data "aws_dx_locations" "available" {}
 
 There are no arguments available for this data source.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `location_codes` - Code for the locations.
diff --git a/website/docs/d/dx_router_configuration.html.markdown b/website/docs/d/dx_router_configuration.html.markdown
index 64fbe4485f9..12a44875025 100644
--- a/website/docs/d/dx_router_configuration.html.markdown
+++ b/website/docs/d/dx_router_configuration.html.markdown
@@ -45,9 +45,9 @@ There is currently no AWS API to retrieve the full list of `router_type_identifi
 }
 ```
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `customer_router_config` - Instructions for configuring your router
 * `router` - Block of the router type details
diff --git a/website/docs/d/dynamodb_table.html.markdown b/website/docs/d/dynamodb_table.html.markdown
index 21518950f04..3e58d9cc643 100644
--- a/website/docs/d/dynamodb_table.html.markdown
+++ b/website/docs/d/dynamodb_table.html.markdown
@@ -20,11 +20,11 @@ data "aws_dynamodb_table" "tableName" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `name` - (Required) Name of the DynamoDB table.
 
-## Attributes Reference
+## Attribute Reference
 
 See the [DynamoDB Table Resource](/docs/providers/aws/r/dynamodb_table.html) for details on the
 returned attributes - they are identical.
diff --git a/website/docs/d/dynamodb_table_item.html.markdown b/website/docs/d/dynamodb_table_item.html.markdown
index b7e9433e2fb..94354404b2e 100644
--- a/website/docs/d/dynamodb_table_item.html.markdown
+++ b/website/docs/d/dynamodb_table_item.html.markdown
@@ -44,8 +44,8 @@ The following arguments are optional:
 * `projection_expression` - (Optional) A string that identifies one or more attributes to retrieve from the table. These attributes can include scalars, sets, or elements of a JSON document. The attributes in the expression must be separated by commas.
 If no attribute names are specified, then all attributes are returned. If any of the requested attributes are not found, they do not appear in the result.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `item` - JSON representation of a map of attribute names to [AttributeValue](https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_AttributeValue.html) objects, as specified by ProjectionExpression.
diff --git a/website/docs/d/ebs_default_kms_key.html.markdown b/website/docs/d/ebs_default_kms_key.html.markdown
index c1471e6db19..3db60c5bd05 100644
--- a/website/docs/d/ebs_default_kms_key.html.markdown
+++ b/website/docs/d/ebs_default_kms_key.html.markdown
@@ -23,9 +23,9 @@ resource "aws_ebs_volume" "example" {
 }
 ```
 
-## Attributes Reference
+## Attribute Reference
 
-The following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `key_arn` - ARN of the default KMS key uses to encrypt an EBS volume in this region when no key is specified in an API call that creates the volume and encryption by default is enabled.
 * `id` - Region of the default KMS Key.
diff --git a/website/docs/d/ebs_encryption_by_default.html.markdown b/website/docs/d/ebs_encryption_by_default.html.markdown
index 8816ffe47f0..58d55b7aba9 100644
--- a/website/docs/d/ebs_encryption_by_default.html.markdown
+++ b/website/docs/d/ebs_encryption_by_default.html.markdown
@@ -16,9 +16,9 @@ Provides a way to check whether default EBS encryption is enabled for your AWS a
 data "aws_ebs_encryption_by_default" "current" {}
 ```
 
-## Attributes Reference
+## Attribute Reference
 
-The following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `enabled` - Whether or not default EBS encryption is enabled. Returns as `true` or `false`.
 * `id` - Region of default EBS encryption.
diff --git a/website/docs/d/ebs_snapshot.html.markdown b/website/docs/d/ebs_snapshot.html.markdown
index d937b8127bd..2d04b719175 100644
--- a/website/docs/d/ebs_snapshot.html.markdown
+++ b/website/docs/d/ebs_snapshot.html.markdown
@@ -31,7 +31,7 @@ data "aws_ebs_snapshot" "ebs_volume" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `most_recent` - (Optional) If more than one result is returned, use the most recent snapshot.
 
@@ -45,9 +45,9 @@ The following arguments are supported:
 several valid keys, for a full reference, check out
 [describe-snapshots in the AWS CLI reference][1].
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the EBS Snapshot.
 * `id` - Snapshot ID (e.g., snap-59fcb34e).
diff --git a/website/docs/d/ebs_snapshot_ids.html.markdown b/website/docs/d/ebs_snapshot_ids.html.markdown
index c947606ffe7..86c22fac8ce 100644
--- a/website/docs/d/ebs_snapshot_ids.html.markdown
+++ b/website/docs/d/ebs_snapshot_ids.html.markdown
@@ -31,7 +31,7 @@ data "aws_ebs_snapshot_ids" "ebs_volumes" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `owners` - (Optional) Returns the snapshots owned by the specified owner id. Multiple owners can be specified.
 
@@ -41,7 +41,9 @@ The following arguments are supported:
 several valid keys, for a full reference, check out
 [describe-volumes in the AWS CLI reference][1].
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - AWS Region.
 * `ids` - Set of EBS snapshot IDs, sorted by creation time in descending order.
diff --git a/website/docs/d/ebs_volume.html.markdown b/website/docs/d/ebs_volume.html.markdown
index 4777e66eab0..b1f526f0e12 100644
--- a/website/docs/d/ebs_volume.html.markdown
+++ b/website/docs/d/ebs_volume.html.markdown
@@ -31,7 +31,7 @@ data "aws_ebs_volume" "ebs_volume" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `most_recent` - (Optional) If more than one result is returned, use the most
 recent Volume.
@@ -39,9 +39,9 @@ recent Volume.
 several valid keys, for a full reference, check out
 [describe-volumes in the AWS CLI reference][1].
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - Volume ID (e.g., vol-59fcb34e).
 * `volume_id` - Volume ID (e.g., vol-59fcb34e).
diff --git a/website/docs/d/ebs_volumes.html.markdown b/website/docs/d/ebs_volumes.html.markdown
index 4545b542d8b..c1c2481829e 100644
--- a/website/docs/d/ebs_volumes.html.markdown
+++ b/website/docs/d/ebs_volumes.html.markdown
@@ -62,7 +62,9 @@ data "aws_ebs_volumes" "ten_or_twenty_gb_volumes" {
 * `values` - (Required) Set of values that are accepted for the given field.
   EBS Volume IDs will be selected if any one of the given values match.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - AWS Region.
 * `ids` - Set of all the EBS Volume IDs found. This data source will fail if
diff --git a/website/docs/d/ec2_client_vpn_endpoint.html.markdown b/website/docs/d/ec2_client_vpn_endpoint.html.markdown
index 52035bc38c1..e6c47a70653 100644
--- a/website/docs/d/ec2_client_vpn_endpoint.html.markdown
+++ b/website/docs/d/ec2_client_vpn_endpoint.html.markdown
@@ -33,7 +33,7 @@ data "aws_ec2_client_vpn_endpoint" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `client_vpn_endpoint_id` - (Optional) ID of the Client VPN endpoint.
 * `filter` - (Optional) One or more configuration blocks containing name-values filters. Detailed below.
@@ -50,7 +50,7 @@ The following arguments are required:
 
 ## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` -  The ARN of the Client VPN endpoint.
 * `authentication_options` - Information about the authentication method used by the Client VPN endpoint.
@@ -63,6 +63,7 @@ In addition to all arguments above, the following attributes are exported:
 * `dns_servers` - Information about the DNS servers to be used for DNS resolution.
 * `security_group_ids` - IDs of the security groups for the target network associated with the Client VPN endpoint.
 * `self_service_portal` - Whether the self-service portal for the Client VPN endpoint is enabled.
+* `self_service_portal_url` - The URL of the self-service portal.
 * `server_certificate_arn` - The ARN of the server certificate.
 * `session_timeout_hours` - The maximum VPN session duration time in hours.
 * `split_tunnel` - Whether split-tunnel is enabled in the AWS Client VPN endpoint.
diff --git a/website/docs/d/ec2_coip_pool.html.markdown b/website/docs/d/ec2_coip_pool.html.markdown
index d20b25c53de..e0cf00ef165 100644
--- a/website/docs/d/ec2_coip_pool.html.markdown
+++ b/website/docs/d/ec2_coip_pool.html.markdown
@@ -48,14 +48,14 @@ which take the following arguments:
 * `values` - (Required) Set of values that are accepted for the given field.
   A COIP Pool will be selected if any one of the given values matches.
 
-## Attributes Reference
+## Attribute Reference
 
 All of the argument attributes except `filter` blocks are also exported as
 result attributes. This data source will complete the data by populating
 any fields that are not included in the configuration with the data for
 the selected COIP Pool.
 
-In addition, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the COIP pool
 * `pool_cidrs` - Set of CIDR blocks in pool
diff --git a/website/docs/d/ec2_coip_pools.html.markdown b/website/docs/d/ec2_coip_pools.html.markdown
index bc94811b52d..0798942e90b 100644
--- a/website/docs/d/ec2_coip_pools.html.markdown
+++ b/website/docs/d/ec2_coip_pools.html.markdown
@@ -38,7 +38,9 @@ which take the following arguments:
 * `values` - (Required) Set of values that are accepted for the given field.
   A COIP Pool will be selected if any one of the given values matches.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - AWS Region.
 * `pool_ids` - Set of COIP Pool Identifiers
diff --git a/website/docs/d/ec2_host.html.markdown b/website/docs/d/ec2_host.html.markdown
index 92d814cf3c2..a7969315d5e 100644
--- a/website/docs/d/ec2_host.html.markdown
+++ b/website/docs/d/ec2_host.html.markdown
@@ -51,12 +51,13 @@ The following arguments are required:
 * `name` - (Required) Name of the field to filter by, as defined by [the underlying AWS API](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeHosts.html).
 * `values` - (Required) Set of values that are accepted for the given field. A host will be selected if any one of the given values matches.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to the attributes above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - ID of the Dedicated Host.
 * `arn` - ARN of the Dedicated Host.
+* `asset_id` - The ID of the Outpost hardware asset on which the Dedicated Host is allocated.
 * `auto_placement` - Whether auto-placement is on or off.
 * `availability_zone` - Availability Zone of the Dedicated Host.
 * `cores` - Number of cores on the Dedicated Host.
diff --git a/website/docs/d/ec2_instance_type.html.markdown b/website/docs/d/ec2_instance_type.html.markdown
index 20f42b74bdd..5c544a9969e 100644
--- a/website/docs/d/ec2_instance_type.html.markdown
+++ b/website/docs/d/ec2_instance_type.html.markdown
@@ -22,13 +22,13 @@ data "aws_ec2_instance_type" "example" {
 
 ## Argument Reference
 
-The following argument is supported:
+This data source supports the following arguments:
 
 * `instance_type` - (Required) Instance
 
 ## Attribute Reference
 
-In addition to the argument above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 ~> **NOTE:** Not all attributes are set for every instance type.
 
diff --git a/website/docs/d/ec2_instance_type_offering.html.markdown b/website/docs/d/ec2_instance_type_offering.html.markdown
index d33e2c66f5b..edfafbf2e6c 100644
--- a/website/docs/d/ec2_instance_type_offering.html.markdown
+++ b/website/docs/d/ec2_instance_type_offering.html.markdown
@@ -25,7 +25,7 @@ data "aws_ec2_instance_type_offering" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `filter` - (Optional) One or more configuration blocks containing name-values filters. See the [EC2 API Reference](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeInstanceTypeOfferings.html) for supported filters. Detailed below.
 * `location_type` - (Optional) Location type. Defaults to `region`. Valid values: `availability-zone`, `availability-zone-id`, and `region`.
@@ -38,7 +38,7 @@ The following arguments are supported:
 
 ## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - EC2 Instance Type.
 * `instance_type` - EC2 Instance Type.
diff --git a/website/docs/d/ec2_instance_type_offerings.html.markdown b/website/docs/d/ec2_instance_type_offerings.html.markdown
index 69ac54d3d82..1a03a0381d7 100644
--- a/website/docs/d/ec2_instance_type_offerings.html.markdown
+++ b/website/docs/d/ec2_instance_type_offerings.html.markdown
@@ -30,7 +30,7 @@ data "aws_ec2_instance_type_offerings" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `filter` - (Optional) One or more configuration blocks containing name-values filters. See the [EC2 API Reference](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeInstanceTypeOfferings.html) for supported filters. Detailed below.
 * `location_type` - (Optional) Location type. Defaults to `region`. Valid values: `availability-zone`, `availability-zone-id`, and `region`.
@@ -42,7 +42,7 @@ The following arguments are supported:
 
 ## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - AWS Region.
 * `instance_types` - List of EC2 Instance Types.
diff --git a/website/docs/d/ec2_instance_types.html.markdown b/website/docs/d/ec2_instance_types.html.markdown
index 44160fffe88..d6889a288c9 100644
--- a/website/docs/d/ec2_instance_types.html.markdown
+++ b/website/docs/d/ec2_instance_types.html.markdown
@@ -38,7 +38,7 @@ data "aws_ec2_instance_types" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `filter` - (Optional) One or more configuration blocks containing name-values filters. See the [EC2 API Reference](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeInstanceTypes.html) for supported filters. Detailed below.
 
@@ -49,7 +49,7 @@ The following arguments are supported:
 
 ## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - AWS Region.
 * `instance_types` - List of EC2 Instance Types.
diff --git a/website/docs/d/ec2_local_gateway.html.markdown b/website/docs/d/ec2_local_gateway.html.markdown
index 6f926e929ec..5d7b7958c34 100644
--- a/website/docs/d/ec2_local_gateway.html.markdown
+++ b/website/docs/d/ec2_local_gateway.html.markdown
@@ -47,7 +47,7 @@ which take the following arguments:
 * `values` - (Required) Set of values that are accepted for the given field.
   A Local Gateway will be selected if any one of the given values matches.
 
-## Attributes Reference
+## Attribute Reference
 
 All of the argument attributes except `filter` blocks are also exported as
 result attributes. This data source will complete the data by populating
diff --git a/website/docs/d/ec2_local_gateway_route_tables.html.markdown b/website/docs/d/ec2_local_gateway_route_tables.html.markdown
index 41645fdf90c..ff0341e9193 100644
--- a/website/docs/d/ec2_local_gateway_route_tables.html.markdown
+++ b/website/docs/d/ec2_local_gateway_route_tables.html.markdown
@@ -38,7 +38,9 @@ which take the following arguments:
 * `values` - (Required) Set of values that are accepted for the given field.
   A Local Gateway Route Table will be selected if any one of the given values matches.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - AWS Region.
 * `ids` - Set of Local Gateway Route Table identifiers
diff --git a/website/docs/d/ec2_local_gateway_virtual_interface.html.markdown b/website/docs/d/ec2_local_gateway_virtual_interface.html.markdown
index 67704e6ce30..6505e81a5af 100644
--- a/website/docs/d/ec2_local_gateway_virtual_interface.html.markdown
+++ b/website/docs/d/ec2_local_gateway_virtual_interface.html.markdown
@@ -37,7 +37,7 @@ The `filter` configuration block supports the following arguments:
 
 ## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `local_address` - Local address.
 * `local_bgp_asn` - Border Gateway Protocol (BGP) Autonomous System Number (ASN) of the EC2 Local Gateway.
diff --git a/website/docs/d/ec2_local_gateway_virtual_interface_group.html.markdown b/website/docs/d/ec2_local_gateway_virtual_interface_group.html.markdown
index 65e4d7a0e59..76c75ab01e3 100644
--- a/website/docs/d/ec2_local_gateway_virtual_interface_group.html.markdown
+++ b/website/docs/d/ec2_local_gateway_virtual_interface_group.html.markdown
@@ -36,7 +36,7 @@ The `filter` configuration block supports the following arguments:
 
 ## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `local_gateway_virtual_interface_ids` - Set of EC2 Local Gateway Virtual Interface identifiers.
 
diff --git a/website/docs/d/ec2_local_gateway_virtual_interface_groups.html.markdown b/website/docs/d/ec2_local_gateway_virtual_interface_groups.html.markdown
index ff34838a0bb..38b01658d0f 100644
--- a/website/docs/d/ec2_local_gateway_virtual_interface_groups.html.markdown
+++ b/website/docs/d/ec2_local_gateway_virtual_interface_groups.html.markdown
@@ -32,7 +32,7 @@ The `filter` configuration block supports the following arguments:
 
 ## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - AWS Region.
 * `ids` - Set of EC2 Local Gateway Virtual Interface Group identifiers.
diff --git a/website/docs/d/ec2_local_gateways.html.markdown b/website/docs/d/ec2_local_gateways.html.markdown
index 84a1f5b7ca4..7861ef55190 100644
--- a/website/docs/d/ec2_local_gateways.html.markdown
+++ b/website/docs/d/ec2_local_gateways.html.markdown
@@ -42,7 +42,9 @@ which take the following arguments:
 * `values` - (Required) Set of values that are accepted for the given field.
   A Local Gateway will be selected if any one of the given values matches.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - AWS Region.
 * `ids` - Set of all the Local Gateway identifiers
diff --git a/website/docs/d/ec2_managed_prefix_list.html.markdown b/website/docs/d/ec2_managed_prefix_list.html.markdown
index 7529c3836ae..ea3ae29b2ae 100644
--- a/website/docs/d/ec2_managed_prefix_list.html.markdown
+++ b/website/docs/d/ec2_managed_prefix_list.html.markdown
@@ -46,14 +46,14 @@ whose data will be exported as attributes.
 
 ### filter Configuration Block
 
-The following arguments are supported by the `filter` configuration block:
+The `filter` configuration block supports the following arguments:
 
 * `name` - (Required) Name of the filter field. Valid values can be found in the EC2 [DescribeManagedPrefixLists](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeManagedPrefixLists.html) API Reference.
 * `values` - (Required) Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - ID of the selected prefix list.
 * `arn` - ARN of the selected prefix list.
diff --git a/website/docs/d/ec2_managed_prefix_lists.html.markdown b/website/docs/d/ec2_managed_prefix_lists.html.markdown
index 145077f2903..f8a2c257b52 100644
--- a/website/docs/d/ec2_managed_prefix_lists.html.markdown
+++ b/website/docs/d/ec2_managed_prefix_lists.html.markdown
@@ -41,7 +41,9 @@ which take the following arguments:
 * `values` - (Required) Set of values that are accepted for the given field.
   A managed prefix list will be selected if any one of the given values matches.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - AWS Region.
 * `ids` - List of all the managed prefix list ids found.
diff --git a/website/docs/d/ec2_network_insights_analysis.html.markdown b/website/docs/d/ec2_network_insights_analysis.html.markdown
index ff356fb3d44..ae82013fca1 100644
--- a/website/docs/d/ec2_network_insights_analysis.html.markdown
+++ b/website/docs/d/ec2_network_insights_analysis.html.markdown
@@ -29,14 +29,14 @@ whose data will be exported as attributes.
 
 ### filter Configuration Block
 
-The following arguments are supported by the `filter` configuration block:
+The `filter` configuration block supports the following arguments:
 
 * `name` - (Required) Name of the filter field. Valid values can be found in the EC2 [`DescribeNetworkInsightsAnalyses`](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeNetworkInsightsAnalyses.html) API Reference.
 * `values` - (Required) Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `alternate_path_hints` - Potential intermediate components of a feasible path.
 * `arn` - ARN of the selected Network Insights Analysis.
diff --git a/website/docs/d/ec2_network_insights_path.html.markdown b/website/docs/d/ec2_network_insights_path.html.markdown
index 57e11a96163..8b46e787325 100644
--- a/website/docs/d/ec2_network_insights_path.html.markdown
+++ b/website/docs/d/ec2_network_insights_path.html.markdown
@@ -29,20 +29,22 @@ whose data will be exported as attributes.
 
 ### filter Configuration Block
 
-The following arguments are supported by the `filter` configuration block:
+The `filter` configuration block supports the following arguments:
 
 * `name` - (Required) Name of the filter field. Valid values can be found in the EC2 [`DescribeNetworkInsightsPaths`](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeNetworkInsightsPaths.html) API Reference.
 * `values` - (Required) Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the selected Network Insights Path.
 * `destination` - AWS resource that is the destination of the path.
+* `destination_arn` - ARN of the destination.
 * `destination_ip` - IP address of the AWS resource that is the destination of the path.
 * `destination_port` - Destination port.
 * `protocol` - Protocol.
 * `source` - AWS resource that is the source of the path.
+* `source_arn` - ARN of the source.
 * `source_ip` - IP address of the AWS resource that is the source of the path.
 * `tags` - Map of tags assigned to the resource.
diff --git a/website/docs/d/ec2_public_ipv4_pool.html.markdown b/website/docs/d/ec2_public_ipv4_pool.html.markdown
index f62cf07d828..eba4c86dc66 100644
--- a/website/docs/d/ec2_public_ipv4_pool.html.markdown
+++ b/website/docs/d/ec2_public_ipv4_pool.html.markdown
@@ -26,9 +26,9 @@ The following arguments are required:
 
 * `pool_id` - (Required) AWS resource IDs of a public IPv4 pool (as a string) for which this data source will fetch detailed information.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `description` - Description of the pool, if any.
 * `network_border_group` - Name of the location from which the address pool is advertised.
diff --git a/website/docs/d/ec2_public_ipv4_pools.html.markdown b/website/docs/d/ec2_public_ipv4_pools.html.markdown
index 409453dffce..120874393f8 100644
--- a/website/docs/d/ec2_public_ipv4_pools.html.markdown
+++ b/website/docs/d/ec2_public_ipv4_pools.html.markdown
@@ -43,6 +43,8 @@ which take the following arguments:
 * `name` - (Required) Name of the field to filter by, as defined by [the underlying AWS API](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribePublicIpv4Pools.html).
 * `values` - (Required) Set of values that are accepted for the given field. Pool IDs will be selected if any one of the given values match.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `pool_ids` - List of all the pool IDs found.
diff --git a/website/docs/d/ec2_serial_console_access.html.markdown b/website/docs/d/ec2_serial_console_access.html.markdown
index 518793d5876..f46fafdee74 100644
--- a/website/docs/d/ec2_serial_console_access.html.markdown
+++ b/website/docs/d/ec2_serial_console_access.html.markdown
@@ -16,9 +16,9 @@ Provides a way to check whether serial console access is enabled for your AWS ac
 data "aws_ec2_serial_console_access" "current" {}
 ```
 
-## Attributes Reference
+## Attribute Reference
 
-The following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `enabled` - Whether or not serial console access is enabled. Returns as `true` or `false`.
 * `id` - Region of serial console access.
diff --git a/website/docs/d/ec2_spot_price.html.markdown b/website/docs/d/ec2_spot_price.html.markdown
index 01ecea83695..c2b571838ac 100644
--- a/website/docs/d/ec2_spot_price.html.markdown
+++ b/website/docs/d/ec2_spot_price.html.markdown
@@ -26,7 +26,7 @@ data "aws_ec2_spot_price" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `instance_type` - (Optional) Type of instance for which to query Spot Price information.
 * `availability_zone` - (Optional) Availability zone in which to query Spot price information.
@@ -39,7 +39,7 @@ The following arguments are supported:
 
 ## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - AWS Region.
 * `spot_price` - Most recent Spot Price value for the given instance type and AZ.
diff --git a/website/docs/d/ec2_transit_gateway.html.markdown b/website/docs/d/ec2_transit_gateway.html.markdown
index 53f85a98473..72714ed9186 100644
--- a/website/docs/d/ec2_transit_gateway.html.markdown
+++ b/website/docs/d/ec2_transit_gateway.html.markdown
@@ -33,7 +33,7 @@ data "aws_ec2_transit_gateway" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `filter` - (Optional) One or more configuration blocks containing name-values filters. Detailed below.
 * `id` - (Optional) Identifier of the EC2 Transit Gateway.
@@ -45,7 +45,7 @@ The following arguments are supported:
 
 ## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `amazon_side_asn` - Private Autonomous System Number (ASN) for the Amazon side of a BGP session
 * `arn` - EC2 Transit Gateway ARN
diff --git a/website/docs/d/ec2_transit_gateway_attachment.html.markdown b/website/docs/d/ec2_transit_gateway_attachment.html.markdown
index 3992cdf2210..9abb4b47238 100644
--- a/website/docs/d/ec2_transit_gateway_attachment.html.markdown
+++ b/website/docs/d/ec2_transit_gateway_attachment.html.markdown
@@ -28,7 +28,7 @@ data "aws_ec2_transit_gateway_attachment" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `filter` - (Optional) One or more configuration blocks containing name-values filters. Detailed below.
 * `transit_gateway_attachment_id` - (Optional) ID of the attachment.
@@ -40,7 +40,7 @@ The following arguments are supported:
 
 ## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the attachment.
 * `association_state` - The state of the association (see [the underlying AWS API](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_TransitGatewayAttachmentAssociation.html) for valid values).
diff --git a/website/docs/d/ec2_transit_gateway_attachments.html.markdown b/website/docs/d/ec2_transit_gateway_attachments.html.markdown
index 683efcb4056..b53b11c5628 100644
--- a/website/docs/d/ec2_transit_gateway_attachments.html.markdown
+++ b/website/docs/d/ec2_transit_gateway_attachments.html.markdown
@@ -35,7 +35,7 @@ data "aws_ec2_transit_gateway_attachment" "unit" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `filter` - (Optional) One or more configuration blocks containing name-values filters. Detailed below.
 
@@ -46,7 +46,7 @@ The following arguments are supported:
 
 ## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `ids` A list of all attachments ids matching the filter. You can retrieve more information about the attachment using the [aws_ec2_transit_gateway_attachment][2] data source, searching by identifier.
 
diff --git a/website/docs/d/ec2_transit_gateway_connect.html.markdown b/website/docs/d/ec2_transit_gateway_connect.html.markdown
index 3c91f4958b3..cf163c6e67d 100644
--- a/website/docs/d/ec2_transit_gateway_connect.html.markdown
+++ b/website/docs/d/ec2_transit_gateway_connect.html.markdown
@@ -33,7 +33,7 @@ data "aws_ec2_transit_gateway_connect" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `filter` - (Optional) One or more configuration blocks containing name-values filters. Detailed below.
 * `transit_gateway_connect_id` - (Optional) Identifier of the EC2 Transit Gateway Connect.
@@ -45,7 +45,7 @@ The following arguments are supported:
 
 ## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `protocol` - Tunnel protocol
 * `tags` - Key-value tags for the EC2 Transit Gateway Connect
diff --git a/website/docs/d/ec2_transit_gateway_connect_peer.html.markdown b/website/docs/d/ec2_transit_gateway_connect_peer.html.markdown
index c8615df1a9c..ddb6a0bba78 100644
--- a/website/docs/d/ec2_transit_gateway_connect_peer.html.markdown
+++ b/website/docs/d/ec2_transit_gateway_connect_peer.html.markdown
@@ -33,7 +33,7 @@ data "aws_ec2_transit_gateway_connect_peer" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `filter` - (Optional) One or more configuration blocks containing name-values filters. Detailed below.
 * `transit_gateway_connect_peer_id` - (Optional) Identifier of the EC2 Transit Gateway Connect Peer.
@@ -45,7 +45,7 @@ The following arguments are supported:
 
 ## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - EC2 Transit Gateway Connect Peer ARN
 * `bgp_asn` - BGP ASN number assigned customer device
diff --git a/website/docs/d/ec2_transit_gateway_dx_gateway_attachment.html.markdown b/website/docs/d/ec2_transit_gateway_dx_gateway_attachment.html.markdown
index 2cad2286072..871b29aaa67 100644
--- a/website/docs/d/ec2_transit_gateway_dx_gateway_attachment.html.markdown
+++ b/website/docs/d/ec2_transit_gateway_dx_gateway_attachment.html.markdown
@@ -23,7 +23,7 @@ data "aws_ec2_transit_gateway_dx_gateway_attachment" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `transit_gateway_id` - (Optional) Identifier of the EC2 Transit Gateway.
 * `dx_gateway_id` - (Optional) Identifier of the Direct Connect Gateway.
@@ -32,14 +32,14 @@ The following arguments are supported:
 
 ### filter Configuration Block
 
-The following arguments are supported by the `filter` configuration block:
+The `filter` configuration block supports the following arguments:
 
 * `name` - (Required) Name of the filter field. Valid values can be found in the [EC2 DescribeTransitGatewayAttachments API Reference](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeTransitGatewayAttachments.html).
 * `values` - (Required) Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
 
 ## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - EC2 Transit Gateway Attachment identifier
 * `tags` - Key-value tags for the EC2 Transit Gateway Attachment
diff --git a/website/docs/d/ec2_transit_gateway_multicast_domain.html.markdown b/website/docs/d/ec2_transit_gateway_multicast_domain.html.markdown
index 6d4e3d2e230..3a66b6d476f 100644
--- a/website/docs/d/ec2_transit_gateway_multicast_domain.html.markdown
+++ b/website/docs/d/ec2_transit_gateway_multicast_domain.html.markdown
@@ -33,7 +33,7 @@ data "aws_ec2_transit_gateway_multicast_domain" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `filter` - (Optional) One or more configuration blocks containing name-values filters. Detailed below.
 * `transit_gateway_multicast_domain_id` - (Optional) Identifier of the EC2 Transit Gateway Multicast Domain.
@@ -49,7 +49,7 @@ The following arguments are required:
 
 ## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - EC2 Transit Gateway Multicast Domain identifier.
 * `arn` - EC2 Transit Gateway Multicast Domain ARN.
diff --git a/website/docs/d/ec2_transit_gateway_peering_attachment.html.markdown b/website/docs/d/ec2_transit_gateway_peering_attachment.html.markdown
index 12043deed8e..63a63b8c8de 100644
--- a/website/docs/d/ec2_transit_gateway_peering_attachment.html.markdown
+++ b/website/docs/d/ec2_transit_gateway_peering_attachment.html.markdown
@@ -33,7 +33,7 @@ data "aws_ec2_transit_gateway_peering_attachment" "attachment" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `filter` - (Optional) One or more configuration blocks containing name-values filters. Detailed below.
 * `id` - (Optional) Identifier of the EC2 Transit Gateway Peering Attachment.
@@ -50,7 +50,7 @@ which take the following arguments:
 
 ## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `peer_account_id` - Identifier of the peer AWS account
 * `peer_region` - Identifier of the peer AWS region
diff --git a/website/docs/d/ec2_transit_gateway_route_table.html.markdown b/website/docs/d/ec2_transit_gateway_route_table.html.markdown
index 605a099c06a..827bb0c1d30 100644
--- a/website/docs/d/ec2_transit_gateway_route_table.html.markdown
+++ b/website/docs/d/ec2_transit_gateway_route_table.html.markdown
@@ -38,7 +38,7 @@ data "aws_ec2_transit_gateway_route_table" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `filter` - (Optional) One or more configuration blocks containing name-values filters. Detailed below.
 * `id` - (Optional) Identifier of the EC2 Transit Gateway Route Table.
@@ -50,7 +50,7 @@ The following arguments are supported:
 
 ## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - EC2 Transit Gateway Route Table ARN.
 * `default_association_route_table` - Boolean whether this is the default association route table for the EC2 Transit Gateway
diff --git a/website/docs/d/ec2_transit_gateway_route_table_associations.html.markdown b/website/docs/d/ec2_transit_gateway_route_table_associations.html.markdown
index 53c62a3d557..6c78a4bf1b7 100644
--- a/website/docs/d/ec2_transit_gateway_route_table_associations.html.markdown
+++ b/website/docs/d/ec2_transit_gateway_route_table_associations.html.markdown
@@ -39,9 +39,9 @@ which take the following arguments:
 * `values` - (Required) Set of values that are accepted for the given field.
   A Transit Gateway Route Table will be selected if any one of the given values matches.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - AWS Region.
 * `ids` - Set of Transit Gateway Route Table Association identifiers.
diff --git a/website/docs/d/ec2_transit_gateway_route_table_propagations.html.markdown b/website/docs/d/ec2_transit_gateway_route_table_propagations.html.markdown
index 6e7f58f1ef1..fc4d5f3979f 100644
--- a/website/docs/d/ec2_transit_gateway_route_table_propagations.html.markdown
+++ b/website/docs/d/ec2_transit_gateway_route_table_propagations.html.markdown
@@ -39,9 +39,9 @@ which take the following arguments:
 * `values` - (Required) Set of values that are accepted for the given field.
   A Transit Gateway Route Table will be selected if any one of the given values matches.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - AWS Region.
 * `ids` - Set of Transit Gateway Route Table Association identifiers.
diff --git a/website/docs/d/ec2_transit_gateway_route_table_routes.html.markdown b/website/docs/d/ec2_transit_gateway_route_table_routes.html.markdown
new file mode 100644
index 00000000000..b13d9ee6809
--- /dev/null
+++ b/website/docs/d/ec2_transit_gateway_route_table_routes.html.markdown
@@ -0,0 +1,198 @@
+---
+subcategory: "Transit Gateway"
+layout: "aws"
+page_title: "AWS: aws_ec2_transit_gateway_route_table_routes"
+description: |-
+   Provides informations for routes of a specific transit gateway
+---
+
+# Data Source: aws_ec2_transit_gateway_route_table_routes
+
+Provides informations for routes of a specific transit gateway, such as state, type, cidr
+
+## Example Usage
+
+```terraform
+data "aws_ec2_transit_gateway_route_table_routes" "test" {
+  filter {
+    name   = "type"
+    values = ["propagated"]
+  }
+  transit_gateway_route_table_id = aws_ec2_transit_gateway_route_table.example.id
+}
+```
+
+### Complexe use case with transit gateway peering
+
+This example allow to create a mesh of transit gateway for différent regions routing all traffic to on-prem VPN
+
+```terraform
+resource "aws_ec2_transit_gateway" "this" {
+  default_route_table_association = "disable"
+  default_route_table_propagation = "disable"
+}
+
+resource "aws_ec2_transit_gateway_vpc_attachment" "this" {
+  subnet_ids                                      = [for s in aws_subnet.private : s.id]
+  transit_gateway_id                              = aws_ec2_transit_gateway.this[0].id
+  vpc_id                                          = aws_vpc.this.id
+  transit_gateway_default_route_table_association = false
+  transit_gateway_default_route_table_propagation = false
+  depends_on                                      = [aws_subnet.private, aws_subnet.public]
+}
+
+resource "aws_ec2_transit_gateway_route_table" "this" {
+  transit_gateway_id = local.my_transit_gateway_id
+}
+
+resource "aws_ec2_transit_gateway_route_table_association" "vpc" {
+  transit_gateway_attachment_id  = aws_ec2_transit_gateway_vpc_attachment.this.id
+  transit_gateway_route_table_id = local.my_transit_gateway_id_route_table
+}
+
+resource "aws_ec2_transit_gateway_route_table_association" "vpn" {
+  transit_gateway_attachment_id  = aws_vpn_connection.this[0].transit_gateway_attachment_id
+  transit_gateway_route_table_id = local.my_transit_gateway_id_route_table
+}
+
+resource "aws_ec2_transit_gateway_route_table_propagation" "vpc" {
+  transit_gateway_attachment_id  = aws_ec2_transit_gateway_vpc_attachment.this.id
+  transit_gateway_route_table_id = aws_ec2_transit_gateway_route_table.this.id
+}
+
+resource "aws_ec2_transit_gateway_route_table_propagation" "vpn" {
+  transit_gateway_attachment_id  = aws_vpn_connection.this[0].transit_gateway_attachment_id
+  transit_gateway_route_table_id = aws_ec2_transit_gateway_route_table.this.id
+}
+
+provider "aws" {
+  alias  = "eu-central-1"
+  region = "eu-central-1"
+}
+
+resource "aws_ec2_transit_gateway" "eu-central-1" {
+  default_route_table_association = "disable"
+  default_route_table_propagation = "disable"
+  provider                        = aws.eu-central-1
+}
+
+resource "aws_ec2_transit_gateway_peering_attachment" "eu-central-1" {
+  peer_region             = "eu-central-1"
+  peer_transit_gateway_id = aws_ec2_transit_gateway.eu-central-1.id
+  transit_gateway_id      = aws_ec2_transit_gateway.this[0].id
+
+  tags = {
+    Name = "TGW mesh from eu-central-1"
+  }
+}
+
+resource "aws_ec2_transit_gateway_route_table" "eu-central-1" {
+  transit_gateway_id = aws_ec2_transit_gateway.eu-central-1.id
+  tags               = merge({ Name = "wl-transit-gateway-routetable-eu-central-1" }, local.global_tags)
+  provider           = aws.eu-central-1
+}
+
+resource "aws_ec2_transit_gateway_peering_attachment_accepter" "eu-central-1" {
+  transit_gateway_attachment_id = aws_ec2_transit_gateway_peering_attachment.eu-central-1.id
+  provider                      = aws.eu-central-1
+  tags = {
+    Name = "Accepter TGW peering eu-central-1"
+  }
+}
+
+data "aws_ec2_transit_gateway_vpc_attachments" "filtered-eu-central-1" {
+  provider = aws.eu-central-1
+  filter {
+    name   = "state"
+    values = ["pendingAcceptance", "available"]
+  }
+}
+
+data "aws_ec2_transit_gateway_vpc_attachment" "unit-eu-central-1" {
+  for_each = toset(data.aws_ec2_transit_gateway_vpc_attachments.filtered-eu-central-1.ids)
+  id       = each.value
+  provider = aws.eu-central-1
+}
+
+locals {
+  trusted_aws_accounts_ids = {} # add to this list all account ids you trust
+
+  trusted_vpc_attachments_list_eu-central-1 = compact([for k, tva in data.aws_ec2_transit_gateway_vpc_attachment.unit-eu-central-1 : contains(local.trusted_aws_accounts_ids, lookup(tva, "vpc_owner_id", "")) ? tva.id : ""])
+  ## create a map with all vpc attachments trusted to be able to use for_each to avoid conflict on plan/apply ##
+  trusted_vpc_attachements_eu-central-1 = toset(sort(local.trusted_vpc_attachments_list_eu-central-1))
+
+}
+
+resource "aws_ec2_transit_gateway_vpc_attachment_accepter" "trusted_accounts_eu-central-1_tgw" {
+  for_each                                        = local.trusted_vpc_attachements_eu-central-1
+  transit_gateway_attachment_id                   = each.value
+  transit_gateway_default_route_table_propagation = false
+  transit_gateway_default_route_table_association = false
+  tags                                            = local.global_tags
+  provider                                        = aws.eu-central-1
+  lifecycle {
+    prevent_destroy = false
+    ignore_changes  = [subnet_ids, id, dns_support, ipv6_support, transit_gateway_id, vpc_id, vpc_owner_id]
+  }
+}
+
+resource "aws_ec2_transit_gateway_route_table_association" "trusted_accounts_eu-central-1" {
+  for_each                       = aws_ec2_transit_gateway_vpc_attachment_accepter.trusted_accounts_eu-central-1_tgw
+  transit_gateway_attachment_id  = each.value.transit_gateway_attachment_id
+  transit_gateway_route_table_id = aws_ec2_transit_gateway_route_table.eu-central-1.id
+  provider                       = aws.eu-central-1
+}
+
+resource "aws_ec2_transit_gateway_route_table_propagation" "trusted_accounts_eu-central-1" {
+  for_each                       = aws_ec2_transit_gateway_vpc_attachment_accepter.trusted_accounts_eu-central-1_tgw
+  transit_gateway_attachment_id  = each.value.transit_gateway_attachment_id
+  transit_gateway_route_table_id = aws_ec2_transit_gateway_route_table.eu-central-1.id
+  provider                       = aws.eu-central-1
+}
+
+data "aws_ec2_transit_gateway_route_table_routes" "test" {
+  filter {
+    name   = "type"
+    values = ["propagated"]
+  }
+  transit_gateway_route_table_id = aws_ec2_transit_gateway_route_table.eu-central-1.id
+  provider                       = aws.eu-central-1
+  depends_on                     = [aws_ec2_transit_gateway_route_table_propagation.trusted_accounts_eu-central-1]
+}
+
+resource "aws_ec2_transit_gateway_route" "default-region-to-eu-central-1" {
+  for_each                       = { for r in data.aws_ec2_transit_gateway_route_table_routes.test.routes : r.destination_cidr_block => r }
+  destination_cidr_block         = each.key
+  transit_gateway_route_table_id = aws_ec2_transit_gateway_route_table.this.id
+  transit_gateway_attachment_id  = aws_ec2_transit_gateway_peering_attachment.eu-central-1.id
+}
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `filter` - (Required) Custom filter block as described below.
+* `transit_gateway_route_table_id` - (Required) Identifier of EC2 Transit Gateway Route Table.
+
+More complex filters can be expressed using one or more `filter` sub-blocks,
+which take the following arguments:
+
+* `name` - (Required) Name of the field to filter by, as defined by
+  [the underlying AWS API](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_SearchTransitGatewayRoutes.html).
+* `values` - (Required) Set of values that are accepted for the given field.
+
+## Attributes Reference
+
+In addition to all arguments above, the following attributes are exported:
+
+* `id` - The transit gateway route table id suffixed by `-routes`
+* `routes` - List of Transit Gateway Routes.
+
+#### Routes list Attributes Reference
+
+* `destination_cidr_block` - The CIDR used for route destination matches.
+* `prefix_list_id` - The ID of the prefix list used for destination matches.
+* `state` - The current state of the route, can be `active`, `deleted`, `pending`, `blackhole`, `deleting`.
+* `transit_gateway_route_table_announcement_id` - The id of the transit gateway route table announcement, most of the time it is an empty string.
+* `type` - The type of the route, can be `propagated` or `static`.
diff --git a/website/docs/d/ec2_transit_gateway_route_tables.html.markdown b/website/docs/d/ec2_transit_gateway_route_tables.html.markdown
index dbc00f455cb..6d4b9a6c267 100644
--- a/website/docs/d/ec2_transit_gateway_route_tables.html.markdown
+++ b/website/docs/d/ec2_transit_gateway_route_tables.html.markdown
@@ -24,7 +24,7 @@ output "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `filter` - (Optional) Custom filter block as described below.
 
@@ -40,9 +40,9 @@ which take the following arguments:
 * `values` - (Required) Set of values that are accepted for the given field.
   A Transit Gateway Route Table will be selected if any one of the given values matches.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - AWS Region.
 * `ids` - Set of Transit Gateway Route Table identifiers.
diff --git a/website/docs/d/ec2_transit_gateway_vpc_attachment.html.markdown b/website/docs/d/ec2_transit_gateway_vpc_attachment.html.markdown
index d14cce96bf2..84013c56203 100644
--- a/website/docs/d/ec2_transit_gateway_vpc_attachment.html.markdown
+++ b/website/docs/d/ec2_transit_gateway_vpc_attachment.html.markdown
@@ -33,7 +33,7 @@ data "aws_ec2_transit_gateway_vpc_attachment" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `filter` - (Optional) One or more configuration blocks containing name-values filters. Detailed below.
 * `id` - (Optional) Identifier of the EC2 Transit Gateway VPC Attachment.
@@ -45,7 +45,7 @@ The following arguments are supported:
 
 ## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `appliance_mode_support` - Whether Appliance Mode support is enabled.
 * `dns_support` - Whether DNS support is enabled.
diff --git a/website/docs/d/ec2_transit_gateway_vpc_attachments.html.markdown b/website/docs/d/ec2_transit_gateway_vpc_attachments.html.markdown
index 33671d4286c..c40ec93b09a 100644
--- a/website/docs/d/ec2_transit_gateway_vpc_attachments.html.markdown
+++ b/website/docs/d/ec2_transit_gateway_vpc_attachments.html.markdown
@@ -30,7 +30,7 @@ data "aws_ec2_transit_gateway_vpc_attachment" "unit" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `filter` - (Optional) One or more configuration blocks containing name-values filters. Detailed below.
 
@@ -41,7 +41,7 @@ The following arguments are supported:
 
 ## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `ids` A list of all attachments ids matching the filter. You can retrieve more information about the attachment using the [aws_ec2_transit_gateway_vpc_attachment][2] data source, searching by identifier.
 
diff --git a/website/docs/d/ec2_transit_gateway_vpn_attachment.html.markdown b/website/docs/d/ec2_transit_gateway_vpn_attachment.html.markdown
index 46f3820d99e..994b930fcd9 100644
--- a/website/docs/d/ec2_transit_gateway_vpn_attachment.html.markdown
+++ b/website/docs/d/ec2_transit_gateway_vpn_attachment.html.markdown
@@ -36,7 +36,7 @@ data "aws_ec2_transit_gateway_vpn_attachment" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `transit_gateway_id` - (Optional) Identifier of the EC2 Transit Gateway.
 * `vpn_connection_id` - (Optional) Identifier of the EC2 VPN Connection.
@@ -45,14 +45,14 @@ The following arguments are supported:
 
 ### filter Configuration Block
 
-The following arguments are supported by the `filter` configuration block:
+The `filter` configuration block supports the following arguments:
 
 * `name` - (Required) Name of the filter field. Valid values can be found in the [EC2 DescribeTransitGatewayAttachments API Reference](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeTransitGatewayAttachments.html).
 * `values` - (Required) Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
 
 ## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - EC2 Transit Gateway VPN Attachment identifier
 * `tags` - Key-value tags for the EC2 Transit Gateway VPN Attachment
diff --git a/website/docs/d/ecr_authorization_token.html.markdown b/website/docs/d/ecr_authorization_token.html.markdown
index 457a3c9ec73..8c1e4fdc013 100644
--- a/website/docs/d/ecr_authorization_token.html.markdown
+++ b/website/docs/d/ecr_authorization_token.html.markdown
@@ -19,13 +19,13 @@ data "aws_ecr_authorization_token" "token" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `registry_id` - (Optional) AWS account ID of the ECR Repository. If not specified the default account is assumed.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to the argument above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `authorization_token` - Temporary IAM authentication credentials to access the ECR repository encoded in base64 in the form of `user_name:password`.
 * `expires_at` - Time in UTC RFC3339 format when the authorization token expires.
diff --git a/website/docs/d/ecr_image.html.markdown b/website/docs/d/ecr_image.html.markdown
index 3ecbbcdc2bf..96a8d88e902 100644
--- a/website/docs/d/ecr_image.html.markdown
+++ b/website/docs/d/ecr_image.html.markdown
@@ -21,7 +21,7 @@ data "aws_ecr_image" "service_image" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `registry_id` - (Optional) ID of the Registry where the repository resides.
 * `repository_name` - (Required) Name of the ECR Repository.
@@ -29,9 +29,9 @@ The following arguments are supported:
 * `image_tag` - (Optional) Tag associated with this image. At least one of `image_digest`, `image_tag`, or `most_recent` must be specified.
 * `most_recent` - (Optional) Return the most recently pushed image. At least one of `image_digest`, `image_tag`, or `most_recent` must be specified.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - SHA256 digest of the image manifest.
 * `image_pushed_at` - Date and time, expressed as a unix timestamp, at which the current image was pushed to the repository.
diff --git a/website/docs/d/ecr_pull_through_cache_rule.html.markdown b/website/docs/d/ecr_pull_through_cache_rule.html.markdown
index b43ce8f4df0..ec4f3ff6458 100644
--- a/website/docs/d/ecr_pull_through_cache_rule.html.markdown
+++ b/website/docs/d/ecr_pull_through_cache_rule.html.markdown
@@ -20,13 +20,13 @@ data "aws_ecr_pull_through_cache_rule" "ecr_public" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 - `ecr_repository_prefix` - (Required) The repository name prefix to use when caching images from the source registry.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 - `id` - The repository name prefix.
 - `upstream_registry_url` - The registry URL of the upstream public registry to use as the source.
diff --git a/website/docs/d/ecr_repository.html.markdown b/website/docs/d/ecr_repository.html.markdown
index 81d7332eddb..fd439fbabc2 100644
--- a/website/docs/d/ecr_repository.html.markdown
+++ b/website/docs/d/ecr_repository.html.markdown
@@ -20,14 +20,14 @@ data "aws_ecr_repository" "service" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `name` - (Required) Name of the ECR Repository.
 * `registry_id` - (Optional) Registry ID where the repository was created.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - Full ARN of the repository.
 * `encryption_configuration` - Encryption configuration for the repository. See [Encryption Configuration](#encryption-configuration) below.
diff --git a/website/docs/d/ecrpublic_authorization_token.html.markdown b/website/docs/d/ecrpublic_authorization_token.html.markdown
index d837dd02d43..0d085f041e2 100644
--- a/website/docs/d/ecrpublic_authorization_token.html.markdown
+++ b/website/docs/d/ecrpublic_authorization_token.html.markdown
@@ -19,9 +19,9 @@ data "aws_ecrpublic_authorization_token" "token" {
 }
 ```
 
-## Attributes Reference
+## Attribute Reference
 
-The following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `authorization_token` - Temporary IAM authentication credentials to access the ECR repository encoded in base64 in the form of `user_name:password`.
 * `expires_at` - Time in UTC RFC3339 format when the authorization token expires.
diff --git a/website/docs/d/ecs_cluster.html.markdown b/website/docs/d/ecs_cluster.html.markdown
index 5e919667d5d..dc7666e16d1 100644
--- a/website/docs/d/ecs_cluster.html.markdown
+++ b/website/docs/d/ecs_cluster.html.markdown
@@ -21,13 +21,13 @@ data "aws_ecs_cluster" "ecs-mongo" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `cluster_name` - (Required) Name of the ECS Cluster
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the ECS Cluster
 * `status` - Status of the ECS Cluster
diff --git a/website/docs/d/ecs_container_definition.html.markdown b/website/docs/d/ecs_container_definition.html.markdown
index 81acbd3fcb4..5d4780ceff1 100644
--- a/website/docs/d/ecs_container_definition.html.markdown
+++ b/website/docs/d/ecs_container_definition.html.markdown
@@ -22,14 +22,14 @@ data "aws_ecs_container_definition" "ecs-mongo" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `task_definition` - (Required) ARN of the task definition which contains the container
 * `container_name` - (Required) Name of the container definition
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `image` - Docker image in use, including the digest
 * `image_digest` - Digest of the docker image in use
diff --git a/website/docs/d/ecs_service.html.markdown b/website/docs/d/ecs_service.html.markdown
index 124947e33ce..2ab7bb270d9 100644
--- a/website/docs/d/ecs_service.html.markdown
+++ b/website/docs/d/ecs_service.html.markdown
@@ -22,14 +22,14 @@ data "aws_ecs_service" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `service_name` - (Required) Name of the ECS Service
 * `cluster_arn` - (Required) ARN of the ECS Cluster
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the ECS Service
 * `desired_count` - Number of tasks for the ECS Service
diff --git a/website/docs/d/ecs_task_definition.html.markdown b/website/docs/d/ecs_task_definition.html.markdown
index dc4f692a161..92b356bad3f 100644
--- a/website/docs/d/ecs_task_definition.html.markdown
+++ b/website/docs/d/ecs_task_definition.html.markdown
@@ -56,13 +56,13 @@ resource "aws_ecs_service" "mongo" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `task_definition` - (Required) Family for the latest ACTIVE revision, family and revision (family:revision) for a specific revision in the family, the ARN of the task definition to access to.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - ARN of the task definition.
 * `arn` - ARN of the task definition.
diff --git a/website/docs/d/ecs_task_execution.html.markdown b/website/docs/d/ecs_task_execution.html.markdown
index 6ea191b3e5a..6793098565b 100644
--- a/website/docs/d/ecs_task_execution.html.markdown
+++ b/website/docs/d/ecs_task_execution.html.markdown
@@ -116,9 +116,9 @@ For more information, see the [Task Networking](https://docs.aws.amazon.com/Amaz
 
 For more information, see the [Placement Strategy](https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_PlacementStrategy.html) documentation.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `task_arns` - A list of the provisioned task ARNs.
 * `id` - The unique identifier, which is a comma-delimited string joining the `cluster` and `task_definition` attributes.
diff --git a/website/docs/d/efs_access_point.html.markdown b/website/docs/d/efs_access_point.html.markdown
index c95d7bdfe18..fa589d60a1a 100644
--- a/website/docs/d/efs_access_point.html.markdown
+++ b/website/docs/d/efs_access_point.html.markdown
@@ -20,13 +20,13 @@ data "aws_efs_access_point" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `access_point_id` - (Required) ID that identifies the file system.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - ID of the access point.
 * `arn` - Amazon Resource Name of the file system.
diff --git a/website/docs/d/efs_access_points.html.markdown b/website/docs/d/efs_access_points.html.markdown
index 6db8561a1d6..6953d003eda 100644
--- a/website/docs/d/efs_access_points.html.markdown
+++ b/website/docs/d/efs_access_points.html.markdown
@@ -20,13 +20,13 @@ data "aws_efs_access_points" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `file_system_id` - (Required) EFS File System identifier.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arns` - Set of Amazon Resource Names (ARNs).
 * `id` - EFS File System identifier.
diff --git a/website/docs/d/efs_file_system.html.markdown b/website/docs/d/efs_file_system.html.markdown
index 28e54e8d5bc..cfb64e9450a 100644
--- a/website/docs/d/efs_file_system.html.markdown
+++ b/website/docs/d/efs_file_system.html.markdown
@@ -31,15 +31,15 @@ data "aws_efs_file_system" "by_tag" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `file_system_id` - (Optional) ID that identifies the file system (e.g., fs-ccfc0d65).
 * `creation_token` - (Optional) Restricts the list to the file system with this creation token.
 * `tags` - (Optional) Restricts the list to the file system with these tags.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name of the file system.
 * `availability_zone_name` - The Availability Zone name in which the file system's One Zone storage classes exist.
@@ -48,6 +48,7 @@ In addition to all arguments above, the following attributes are exported:
 * `encrypted` - Whether EFS is encrypted.
 * `kms_key_id` - ARN for the KMS encryption key.
 * `lifecycle_policy` - File system [lifecycle policy](https://docs.aws.amazon.com/efs/latest/ug/API_LifecyclePolicy.html) object.
+* `name` - The value of the file system's `Name` tag.
 * `performance_mode` - File system performance mode.
 * `provisioned_throughput_in_mibps` - The throughput, measured in MiB/s, that you want to provision for the file system.
 * `tags` -A map of tags to assign to the file system.
diff --git a/website/docs/d/efs_mount_target.html.markdown b/website/docs/d/efs_mount_target.html.markdown
index b86d580c49f..4c1ba7de156 100644
--- a/website/docs/d/efs_mount_target.html.markdown
+++ b/website/docs/d/efs_mount_target.html.markdown
@@ -25,15 +25,15 @@ data "aws_efs_mount_target" "by_id" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `access_point_id` - (Optional) ID or ARN of the access point whose mount target that you want to find. It must be included if a `file_system_id` and `mount_target_id` are not included.
 * `file_system_id` - (Optional) ID or ARN of the file system whose mount target that you want to find. It must be included if an `access_point_id` and `mount_target_id` are not included.
 * `mount_target_id` - (Optional) ID or ARN of the mount target that you want to find. It must be included in your request if an `access_point_id` and `file_system_id` are not included.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `file_system_arn` - Amazon Resource Name of the file system for which the mount target is intended.
 * `subnet_id` - ID of the mount target's subnet.
diff --git a/website/docs/d/eip.html.markdown b/website/docs/d/eip.html.markdown
index 911a4ae68ca..f5e83274d2f 100644
--- a/website/docs/d/eip.html.markdown
+++ b/website/docs/d/eip.html.markdown
@@ -60,9 +60,9 @@ Elastic IP whose data will be exported as attributes.
 * `public_ip` - (Optional) Public IP of the specific EIP to retrieve.
 * `tags` - (Optional) Map of tags, each pair of which must exactly match a pair on the desired Elastic IP
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `association_id` - ID representing the association of the address with an instance in a VPC.
 * `domain` - Whether the address is for use in EC2-Classic (standard) or in a VPC (vpc).
diff --git a/website/docs/d/eips.html.markdown b/website/docs/d/eips.html.markdown
index d8c80a257f7..aaf50754311 100644
--- a/website/docs/d/eips.html.markdown
+++ b/website/docs/d/eips.html.markdown
@@ -43,7 +43,9 @@ More complex filters can be expressed using one or more `filter` sub-blocks, whi
   [the underlying AWS API](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeAddresses.html).
 * `values` - (Required) Set of values that are accepted for the given field. An Elastic IP will be selected if any one of the given values matches.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - AWS Region.
 * `allocation_ids` - List of all the allocation IDs for address for use with EC2-VPC.
diff --git a/website/docs/d/eks_addon.html.markdown b/website/docs/d/eks_addon.html.markdown
index 2fc6c2e35f0..7b342c444e0 100644
--- a/website/docs/d/eks_addon.html.markdown
+++ b/website/docs/d/eks_addon.html.markdown
@@ -29,9 +29,9 @@ output "eks_addon_outputs" {
   the names returned by [list-addon](https://docs.aws.amazon.com/cli/latest/reference/eks/list-addons.html).
 * `cluster_name` – (Required) Name of the EKS Cluster. Must be between 1-100 characters in length. Must begin with an alphanumeric character, and must only contain alphanumeric characters, dashes and underscores (`^[0-9A-Za-z][A-Za-z0-9\-_]+$`).
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the EKS add-on.
 * `addon_version` - Version of EKS add-on.
diff --git a/website/docs/d/eks_addon_version.html.markdown b/website/docs/d/eks_addon_version.html.markdown
index 678ea76e316..830d627a41d 100644
--- a/website/docs/d/eks_addon_version.html.markdown
+++ b/website/docs/d/eks_addon_version.html.markdown
@@ -46,9 +46,9 @@ output "latest" {
 * `kubernetes_version` – (Required) Version of the EKS Cluster. Must be between 1-100 characters in length. Must begin with an alphanumeric character, and must only contain alphanumeric characters, dashes and underscores (`^[0-9A-Za-z][A-Za-z0-9\-_]+$`).
 * `most_recent` - (Optional) Determines if the most recent or default version of the addon should be returned.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - Name of the add-on
 * `version` - Version of the EKS add-on.
diff --git a/website/docs/d/eks_cluster.html.markdown b/website/docs/d/eks_cluster.html.markdown
index 6960a95a24a..cea2d6c498e 100644
--- a/website/docs/d/eks_cluster.html.markdown
+++ b/website/docs/d/eks_cluster.html.markdown
@@ -35,7 +35,9 @@ output "identity-oidc-issuer" {
 
 * `name` - (Required) Name of the cluster. Must be between 1-100 characters in length. Must begin with an alphanumeric character, and must only contain alphanumeric characters, dashes and underscores (`^[0-9A-Za-z][A-Za-z0-9\-_]+$`).
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - Name of the cluster
 * `arn` - ARN of the cluster.
diff --git a/website/docs/d/eks_cluster_auth.html.markdown b/website/docs/d/eks_cluster_auth.html.markdown
index 95bd11ee1b2..422f1b7c8d9 100644
--- a/website/docs/d/eks_cluster_auth.html.markdown
+++ b/website/docs/d/eks_cluster_auth.html.markdown
@@ -15,7 +15,7 @@ Uses IAM credentials from the AWS provider to generate a temporary token that is
 This can be used to authenticate to an EKS cluster or to a cluster that has the AWS IAM Authenticator
 server configured.
 
-~> **NOTE:** Dynamically configuring a Terraform Provider via data sources currently has implications on [resource import support](https://github.com/hashicorp/terraform/issues/13018).
+~> **NOTE:** Dynamically configuring a Terraform Provider via data sources currently has implications on [resource import support](https://github.com/hashicorp/terraform/issues/13018) on Terraform `<1.3.0`.
 
 ## Example Usage
 
@@ -39,7 +39,9 @@ provider "kubernetes" {
 
 * `name` - (Required) Name of the cluster
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - Name of the cluster.
 * `token` - Token to use to authenticate with the cluster.
diff --git a/website/docs/d/eks_clusters.html.markdown b/website/docs/d/eks_clusters.html.markdown
index 4b3659fb442..51645df3671 100644
--- a/website/docs/d/eks_clusters.html.markdown
+++ b/website/docs/d/eks_clusters.html.markdown
@@ -21,7 +21,9 @@ data "aws_eks_cluster" "example" {
 }
 ```
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - AWS Region.
 * `names` - Set of EKS clusters names
diff --git a/website/docs/d/eks_node_group.html.markdown b/website/docs/d/eks_node_group.html.markdown
index a7d5708c9d5..3313334378a 100644
--- a/website/docs/d/eks_node_group.html.markdown
+++ b/website/docs/d/eks_node_group.html.markdown
@@ -24,7 +24,9 @@ data "aws_eks_node_group" "example" {
 * `cluster_name` - (Required) Name of the cluster.
 * `node_group_name` - (Required) Name of the node group.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - EKS Cluster name and EKS Node Group name separated by a colon (`:`).
 * `ami_type` - Type of Amazon Machine Image (AMI) associated with the EKS Node Group.
diff --git a/website/docs/d/eks_node_groups.html.markdown b/website/docs/d/eks_node_groups.html.markdown
index 938c38231ed..b440ddf5dab 100644
--- a/website/docs/d/eks_node_groups.html.markdown
+++ b/website/docs/d/eks_node_groups.html.markdown
@@ -29,7 +29,9 @@ data "aws_eks_node_group" "example" {
 
 * `cluster_name` - (Required) Name of the cluster.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - Cluster name.
 * `names` - Set of all node group names in an EKS Cluster.
diff --git a/website/docs/d/elastic_beanstalk_application.html.markdown b/website/docs/d/elastic_beanstalk_application.html.markdown
index f6cd4f86517..5fbc7c5c424 100644
--- a/website/docs/d/elastic_beanstalk_application.html.markdown
+++ b/website/docs/d/elastic_beanstalk_application.html.markdown
@@ -30,7 +30,9 @@ output "description" {
 
 * `name` - (Required) Name of the application
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - Name of the application
 * `arn` - ARN of the application.
diff --git a/website/docs/d/elastic_beanstalk_hosted_zone.html.markdown b/website/docs/d/elastic_beanstalk_hosted_zone.html.markdown
index ad0b364ae24..82302357a15 100644
--- a/website/docs/d/elastic_beanstalk_hosted_zone.html.markdown
+++ b/website/docs/d/elastic_beanstalk_hosted_zone.html.markdown
@@ -20,7 +20,9 @@ data "aws_elastic_beanstalk_hosted_zone" "current" {}
 
 * `region` - (Optional) Region you'd like the zone for. By default, fetches the current region.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - ID of the hosted zone.
 
diff --git a/website/docs/d/elastic_beanstalk_solution_stack.html.markdown b/website/docs/d/elastic_beanstalk_solution_stack.html.markdown
index 9a4ff6cb6b3..2528bf7735e 100644
--- a/website/docs/d/elastic_beanstalk_solution_stack.html.markdown
+++ b/website/docs/d/elastic_beanstalk_solution_stack.html.markdown
@@ -33,7 +33,9 @@ AWS documentation for reference solution stack names.
 Terraform will fail. Ensure that your search is specific enough to return
 a single solution stack, or use `most_recent` to choose the most recent one.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `name` - Name of the solution stack.
 
diff --git a/website/docs/d/elasticache_cluster.html.markdown b/website/docs/d/elasticache_cluster.html.markdown
index b10e4f347b5..fb2b67a7f76 100644
--- a/website/docs/d/elasticache_cluster.html.markdown
+++ b/website/docs/d/elasticache_cluster.html.markdown
@@ -20,13 +20,13 @@ data "aws_elasticache_cluster" "my_cluster" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `cluster_id` – (Required) Group identifier.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `node_type` – The cluster node type.
 * `num_cache_nodes` – The number of cache nodes that the cache cluster has.
diff --git a/website/docs/d/elasticache_replication_group.html.markdown b/website/docs/d/elasticache_replication_group.html.markdown
index 75e52661600..5675f0e8024 100644
--- a/website/docs/d/elasticache_replication_group.html.markdown
+++ b/website/docs/d/elasticache_replication_group.html.markdown
@@ -20,13 +20,13 @@ data "aws_elasticache_replication_group" "bar" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `replication_group_id` – (Required) Identifier for the replication group.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `description` - Description of the replication group.
 * `arn` - ARN of the created ElastiCache Replication Group.
diff --git a/website/docs/d/elasticache_subnet_group.html.markdown b/website/docs/d/elasticache_subnet_group.html.markdown
index 6a48ba5a954..557677d09ed 100644
--- a/website/docs/d/elasticache_subnet_group.html.markdown
+++ b/website/docs/d/elasticache_subnet_group.html.markdown
@@ -24,9 +24,9 @@ The following arguments are required:
 
 * `name` - (Required) Name of the subnet group.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - Name of the subnet group.
 * `arn` - ARN of the subnet group.
diff --git a/website/docs/d/elasticache_user.html.markdown b/website/docs/d/elasticache_user.html.markdown
index fc68f0e7e5b..94780d724a8 100644
--- a/website/docs/d/elasticache_user.html.markdown
+++ b/website/docs/d/elasticache_user.html.markdown
@@ -20,13 +20,13 @@ data "aws_elasticache_user" "bar" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `user_id` – (Required) Identifier for the user.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `user_id` - Identifier for the user.
 * `user_name` - User name of the user.
diff --git a/website/docs/d/elasticsearch_domain.html.markdown b/website/docs/d/elasticsearch_domain.html.markdown
index e9e357532d4..a8967f6d0aa 100644
--- a/website/docs/d/elasticsearch_domain.html.markdown
+++ b/website/docs/d/elasticsearch_domain.html.markdown
@@ -20,13 +20,13 @@ data "aws_elasticsearch_domain" "my_domain" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `domain_name` – (Required) Name of the domain.
 
-## Attributes Reference
+## Attribute Reference
 
-The following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `access_policies` – The policy document attached to the domain.
 * `advanced_options` - Key-value string pairs to specify advanced configuration options.
diff --git a/website/docs/d/elb.html.markdown b/website/docs/d/elb.html.markdown
index 716240c6f77..0a4bca2f15d 100644
--- a/website/docs/d/elb.html.markdown
+++ b/website/docs/d/elb.html.markdown
@@ -31,11 +31,11 @@ data "aws_elb" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `name` - (Required) Unique name of the load balancer.
 
-## Attributes Reference
+## Attribute Reference
 
 See the [ELB Resource](/docs/providers/aws/r/elb.html) for details on the
 returned attributes - they are identical.
diff --git a/website/docs/d/elb_hosted_zone_id.html.markdown b/website/docs/d/elb_hosted_zone_id.html.markdown
index ca53024a902..03934051e02 100644
--- a/website/docs/d/elb_hosted_zone_id.html.markdown
+++ b/website/docs/d/elb_hosted_zone_id.html.markdown
@@ -34,6 +34,8 @@ resource "aws_route53_record" "www" {
 * `region` - (Optional) Name of the region whose AWS ELB HostedZoneId is desired.
   Defaults to the region from the AWS provider configuration.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - ID of the AWS ELB HostedZoneId in the selected region.
diff --git a/website/docs/d/elb_service_account.html.markdown b/website/docs/d/elb_service_account.html.markdown
index f043fe1db30..f585b64afa4 100644
--- a/website/docs/d/elb_service_account.html.markdown
+++ b/website/docs/d/elb_service_account.html.markdown
@@ -69,7 +69,9 @@ resource "aws_elb" "bar" {
 * `region` - (Optional) Name of the region whose AWS ELB account ID is desired.
   Defaults to the region from the AWS provider configuration.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - ID of the AWS ELB service account in the selected region.
 * `arn` - ARN of the AWS ELB service account in the selected region.
diff --git a/website/docs/d/emr_release_labels.html.markdown b/website/docs/d/emr_release_labels.html.markdown
new file mode 100644
index 00000000000..b467bcc5f1f
--- /dev/null
+++ b/website/docs/d/emr_release_labels.html.markdown
@@ -0,0 +1,37 @@
+---
+subcategory: "EMR"
+layout: "aws"
+page_title: "AWS: aws_emr_release_labels"
+description: |-
+  Retrieve information about EMR Release Labels
+---
+
+# Data Source: aws_emr_release_labels
+
+Retrieve information about EMR Release Labels.
+
+## Example Usage
+
+```terraform
+data "aws_emr_release_labels" "example" {
+  filters {
+    application = "spark@2.1.0"
+    prefix      = "emr-5"
+  }
+}
+```
+
+## Argument Reference
+
+* `filters` – (Optional) Filters the results of the request. Prefix specifies the prefix of release labels to return. Application specifies the application (with/without version) of release labels to return. See [Filters](#filters).
+
+### Filters
+
+* `application` - (Optional) Optional release label application filter. For example, `Spark@2.1.0` or `Spark`.
+* `prefix` - (Optional) Optional release label version prefix filter. For example, `emr-5`.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `release_labels` - Returned release labels.
diff --git a/website/docs/d/emr_release_labels.markdown b/website/docs/d/emr_release_labels.markdown
deleted file mode 100644
index a73c07f9ab5..00000000000
--- a/website/docs/d/emr_release_labels.markdown
+++ /dev/null
@@ -1,37 +0,0 @@
----
-subcategory: "EMR"
-layout: "aws"
-page_title: "AWS: aws_emr_release_labels"
-description: |-
-  Retrieve information about EMR Release Labels
----
-
-# Data Source: aws_emr_release_labels
-
-Retrieve information about EMR Release Labels.
-
-## Example Usage
-
-```terraform
-data "aws_emr_release_labels" "example" {
-  filters {
-    application = "spark@2.1.0"
-    prefix      = "emr-5"
-  }
-}
-```
-
-## Argument Reference
-
-* `filters` – (Optional) Filters the results of the request. Prefix specifies the prefix of release labels to return. Application specifies the application (with/without version) of release labels to return. See [Filters](#filters).
-
-### Filters
-
-* `application` - (Optional) Optional release label application filter. For example, `Spark@2.1.0` or `Spark`.
-* `prefix` - (Optional) Optional release label version prefix filter. For example, `emr-5`.
-
-## Attributes Reference
-
-In addition to all arguments above, the following attributes are exported:
-
-* `release_labels` - Returned release labels.
diff --git a/website/docs/d/emrcontainers_virtual_cluster.html.markdown b/website/docs/d/emrcontainers_virtual_cluster.html.markdown
new file mode 100644
index 00000000000..c6695507c31
--- /dev/null
+++ b/website/docs/d/emrcontainers_virtual_cluster.html.markdown
@@ -0,0 +1,48 @@
+---
+subcategory: "EMR Containers"
+layout: "aws"
+page_title: "AWS: aws_emrcontainers_virtual_cluster"
+description: |-
+  Retrieve information about an EMR Containers (EMR on EKS) Virtual Cluster
+---
+
+# Data Source: aws_emrcontainers_virtual_cluster
+
+Retrieve information about an EMR Containers (EMR on EKS) Virtual Cluster.
+
+## Example Usage
+
+```terraform
+data "aws_emrcontainers_virtual_cluster" "example" {
+  virtual_cluster_id = "example id"
+}
+
+output "name" {
+  value = data.aws_emrcontainers_virtual_cluster.example.name
+}
+
+output "arn" {
+  value = data.aws_emrcontainers_virtual_cluster.example.arn
+}
+```
+
+## Argument Reference
+
+* `virtual_cluster_id` - (Required) ID of the cluster.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `id` - ID of the cluster.
+* `name` - Name of the cluster.
+* `arn` - ARN of the cluster.
+* `container_provider` - Nested attribute containing information about the underlying container provider (EKS cluster) for your EMR Containers cluster.
+    * `id` - The name of the container provider that is running your EMR Containers cluster
+    * `info` - Nested list containing information about the configuration of the container provider
+        * `eks_info` - Nested list containing EKS-specific information about the cluster where the EMR Containers cluster is running
+            * `namespace` - The namespace where the EMR Containers cluster is running
+    * `type` - The type of the container provider
+* `created_at` - Unix epoch time stamp in seconds for when the cluster was created.
+* `state` - Status of the EKS cluster. One of `RUNNING`, `TERMINATING`, `TERMINATED`, `ARRESTED`.
+* `tags` - Key-value mapping of resource tags.
diff --git a/website/docs/d/emrcontainers_virtual_cluster.markdown b/website/docs/d/emrcontainers_virtual_cluster.markdown
deleted file mode 100644
index 222e79d5333..00000000000
--- a/website/docs/d/emrcontainers_virtual_cluster.markdown
+++ /dev/null
@@ -1,46 +0,0 @@
----
-subcategory: "EMR Containers"
-layout: "aws"
-page_title: "AWS: aws_emrcontainers_virtual_cluster"
-description: |-
-  Retrieve information about an EMR Containers (EMR on EKS) Virtual Cluster
----
-
-# Data Source: aws_emrcontainers_virtual_cluster
-
-Retrieve information about an EMR Containers (EMR on EKS) Virtual Cluster.
-
-## Example Usage
-
-```terraform
-data "aws_emrcontainers_virtual_cluster" "example" {
-  virtual_cluster_id = "example id"
-}
-
-output "name" {
-  value = data.aws_emrcontainers_virtual_cluster.example.name
-}
-
-output "arn" {
-  value = data.aws_emrcontainers_virtual_cluster.example.arn
-}
-```
-
-## Argument Reference
-
-* `virtual_cluster_id` - (Required) ID of the cluster.
-
-## Attributes Reference
-
-* `id` - ID of the cluster.
-* `name` - Name of the cluster.
-* `arn` - ARN of the cluster.
-* `container_provider` - Nested attribute containing information about the underlying container provider (EKS cluster) for your EMR Containers cluster.
-    * `id` - The name of the container provider that is running your EMR Containers cluster
-    * `info` - Nested list containing information about the configuration of the container provider
-        * `eks_info` - Nested list containing EKS-specific information about the cluster where the EMR Containers cluster is running
-            * `namespace` - The namespace where the EMR Containers cluster is running
-    * `type` - The type of the container provider
-* `created_at` - Unix epoch time stamp in seconds for when the cluster was created.
-* `state` - Status of the EKS cluster. One of `RUNNING`, `TERMINATING`, `TERMINATED`, `ARRESTED`.
-* `tags` - Key-value mapping of resource tags.
diff --git a/website/docs/d/fsx_ontap_file_system.html.markdown b/website/docs/d/fsx_ontap_file_system.html.markdown
new file mode 100644
index 00000000000..065ed1932ca
--- /dev/null
+++ b/website/docs/d/fsx_ontap_file_system.html.markdown
@@ -0,0 +1,68 @@
+---
+subcategory: "FSx"
+layout: "aws"
+page_title: "AWS: aws_fsx_ontap_file_system"
+description: |-
+  Retrieve information on FSx ONTAP File System.
+---
+
+# Data Source: aws_fsx_ontap_file_system
+
+Retrieve information on FSx ONTAP File System.
+
+## Example Usage
+
+### Basic Usage
+
+```terraform
+data "aws_fsx_ontap_file_system" "example" {
+  id = "fs-12345678"
+}
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `id` - (Required) Identifier of the file system (e.g. `fs-12345678`).
+
+## Attributes Reference
+
+In addition to all arguments above, the following attributes are exported:
+
+* `arn` - Amazon Resource Name of the file system.
+* `automatic_backup_retention_days` - The number of days to retain automatic backups.
+* `daily_automatic_backup_start_time` - The preferred time (in `HH:MM` format) to take daily automatic backups, in the UTC time zone.
+* `deployment_type` - The file system deployment type.
+* `disk_iops_configuration` - The SSD IOPS configuration for the Amazon FSx for NetApp ONTAP file system, specifying the number of provisioned IOPS and the provision mode. See [Disk IOPS](#disk-iops) Below.
+* `dns_name` - DNS name for the file system (e.g. `fs-12345678.corp.example.com`).
+* `endpoint_ip_address_range` - (Multi-AZ only) Specifies the IP address range in which the endpoints to access your file system exist.
+* `endpoints` - The Management and Intercluster FileSystemEndpoints that are used to access data or to manage the file system using the NetApp ONTAP CLI, REST API, or NetApp SnapMirror. See [FileSystemEndpoints](#file-system-endpoints) below.
+* `id` - Identifier of the file system (e.g. `fs-12345678`).
+* `kms_key_id` - ARN for the KMS Key to encrypt the file system at rest.
+* `network_interface_ids` - The IDs of the elastic network interfaces from which a specific file system is accessible.
+* `owner_id` - AWS account identifier that created the file system.
+* `preferred_subnet_id` - Specifies the subnet in which you want the preferred file server to be located.
+* `route_table_ids` - (Multi-AZ only) The VPC route tables in which your file system's endpoints exist.
+* `storage_capacity` - The storage capacity of the file system in gibibytes (GiB).
+* `storage_type` - The type of storage the file system is using. If set to `SSD`, the file system uses solid state drive storage. If set to `HDD`, the file system uses hard disk drive storage.
+* `subnet_ids` - Specifies the IDs of the subnets that the file system is accessible from. For the MULTI_AZ_1 file system deployment type, there are two subnet IDs, one for the preferred file server and one for the standby file server. The preferred file server subnet identified in the `preferred_subnet_id` property.
+* `tags` - The tags associated with the file system.
+* `throughput_capacity` - The sustained throughput of an Amazon FSx file system in Megabytes per second (MBps).
+* `vpc_id` - The ID of the primary virtual private cloud (VPC) for the file system.
+* `weekly_maintenance_start_time` - The preferred start time (in `D:HH:MM` format) to perform weekly maintenance, in the UTC time zone.
+
+### Disk IOPS
+
+* `iops` - The total number of SSD IOPS provisioned for the file system.
+* `mode` - Specifies whether the file system is using the `AUTOMATIC` setting of SSD IOPS of 3 IOPS per GB of storage capacity, or if it using a `USER_PROVISIONED` value.
+
+### File System Endpoints
+
+* `intercluster` - A FileSystemEndpoint for managing your file system by setting up NetApp SnapMirror with other ONTAP systems. See [FileSystemEndpoint](#file-system-endpoint) below.
+* `management` - A FileSystemEndpoint for managing your file system using the NetApp ONTAP CLI and NetApp ONTAP API. See [FileSystemEndpoint](#file-system-endpoint) below.
+
+### File System Endpoint
+
+* `DNSName` - The file system's DNS name. You can mount your file system using its DNS name.
+* `IpAddresses` - IP addresses of the file system endpoint.
diff --git a/website/docs/d/fsx_ontap_storage_virtual_machine.html.markdown b/website/docs/d/fsx_ontap_storage_virtual_machine.html.markdown
new file mode 100644
index 00000000000..f8815943588
--- /dev/null
+++ b/website/docs/d/fsx_ontap_storage_virtual_machine.html.markdown
@@ -0,0 +1,97 @@
+---
+subcategory: "FSx"
+layout: "aws"
+page_title: "AWS: aws_fsx_ontap_storage_virtual_machine"
+description: |-
+  Retrieve information on FSx ONTAP Storage Virtual Machine (SVM).
+---
+
+# Data Source: aws_fsx_ontap_storage_virtual_machine
+
+Retrieve information on FSx ONTAP Storage Virtual Machine (SVM).
+
+## Example Usage
+
+### Basic Usage
+
+```terraform
+data "aws_fsx_ontap_storage_virtual_machine" "example" {
+  id = "svm-12345678"
+}
+```
+
+### Filter Example
+
+```
+data "aws_fsx_ontap_storage_virtual_machine" "example" {
+  filter {
+    name   = "file-system-id"
+    values = ["fs-12345678"]
+  }
+}
+```
+
+## Argument Reference
+
+The arguments of this data source act as filters for querying the available ONTAP Storage Virtual Machines in the current region. The given filters must match exactly one Storage Virtual Machine whose data will be exported as attributes.
+
+The following arguments are optional:
+
+* `filter` - (Optional) Configuration block. Detailed below.
+* `id` - (Optional) Identifier of the storage virtual machine (e.g. `svm-12345678`).
+
+### filter
+
+This block allows for complex filters.
+
+The following arguments are required:
+
+* `name` - (Required) Name of the field to filter by, as defined by [the underlying AWS API](https://docs.aws.amazon.com/fsx/latest/APIReference/API_StorageVirtualMachineFilter.html).
+* `values` - (Required) Set of values that are accepted for the given field. An SVM will be selected if any one of the given values matches.
+
+## Attributes Reference
+
+In addition to all arguments above, the following attributes are exported:
+
+* `arn` - Amazon Resource Name of the SVM.
+* `active_directory_configuration` - The Microsoft Active Directory configuration to which the SVM is joined, if applicable. See [Active Directory Configuration](#active-directory-configuration) below.
+* `creation_time` - The time that the SVM was created.
+* `endpoints` - The endpoints that are used to access data or to manage the SVM using the NetApp ONTAP CLI, REST API, or NetApp CloudManager. They are the Iscsi, Management, Nfs, and Smb endpoints. See [SVM Endpoints](#svm-endpoints) below.
+* `file_system_id` - Identifier of the file system (e.g. `fs-12345678`).
+* `id` - The SVM's system generated unique ID.
+* `lifecycle_status` - The SVM's lifecycle status.
+* `lifecycle_transition_reason` - Describes why the SVM lifecycle state changed. See [Lifecycle Transition Reason](#lifecycle-transition-reason) below.
+* `name` - The name of the SVM, if provisioned.
+* `subtype` - The SVM's subtype.
+* `uuid` - The SVM's UUID.
+
+### Active Directory Configuration
+
+The following arguments are supported for `active_directory_configuration` configuration block:
+
+* `netbios_name` - The NetBIOS name of the AD computer object to which the SVM is joined.
+* `self_managed_active_directory` - The configuration of the self-managed Microsoft Active Directory (AD) directory to which the Windows File Server or ONTAP storage virtual machine (SVM) instance is joined. See [Self Managed Active Directory](#self-managed-active-directory) below.
+
+### Self Managed Active Directory
+
+* `dns_ips` - A list of up to three IP addresses of DNS servers or domain controllers in the self-managed AD directory.
+* `domain_name` - The fully qualified domain name of the self-managed AD directory.
+* `file_system_administrators_group` - The name of the domain group whose members have administrative privileges for the FSx file system.
+* `organizational_unit_distinguished_name` - The fully qualified distinguished name of the organizational unit within the self-managed AD directory to which the Windows File Server or ONTAP storage virtual machine (SVM) instance is joined.
+* `username` - The user name for the service account on your self-managed AD domain that FSx uses to join to your AD domain.
+
+### Lifecycle Transition Reason
+
+* `message` - A detailed message.
+
+### SVM Endpoints
+
+* `Iscsi` - An endpoint for connecting using the Internet Small Computer Systems Interface (iSCSI) protocol. See [SVM Endpoint](#svm-endpoint) below.
+* `management` - An endpoint for managing SVMs using the NetApp ONTAP CLI, NetApp ONTAP API, or NetApp CloudManager. See [SVM Endpoint](#svm-endpoint) below.
+* `nfs` - An endpoint for connecting using the Network File System (NFS) protocol. See [SVM Endpoint](#svm-endpoint) below.
+* `smb` - An endpoint for connecting using the Server Message Block (SMB) protocol. See [SVM Endpoint](#svm-endpoint) below.
+
+### SVM Endpoint
+
+* `DNSName` - The file system's DNS name. You can mount your file system using its DNS name.
+* `IpAddresses` - The SVM endpoint's IP addresses.
diff --git a/website/docs/d/fsx_ontap_storage_virtual_machines.html.markdown b/website/docs/d/fsx_ontap_storage_virtual_machines.html.markdown
new file mode 100644
index 00000000000..fa0bd66926b
--- /dev/null
+++ b/website/docs/d/fsx_ontap_storage_virtual_machines.html.markdown
@@ -0,0 +1,41 @@
+---
+subcategory: "FSx"
+layout: "aws"
+page_title: "AWS: aws_fsx_ontap_storage_virtual_machines"
+description: |-
+  This resource can be useful for getting back a set of FSx ONTAP Storage Virtual Machine (SVM) IDs.
+---
+
+# Data Source: aws_fsx_ontap_storage_virtual_machines
+
+This resource can be useful for getting back a set of FSx ONTAP Storage Virtual Machine (SVM) IDs.
+
+## Example Usage
+
+The following shows outputting all SVM IDs for a given FSx ONTAP File System.
+
+```
+data "aws_fsx_ontap_storage_virtual_machines" "example" {
+  filter {
+    name   = "file-system-id"
+    values = ["fs-12345678"]
+  }
+}
+```
+
+## Argument Reference
+
+* `filter` - (Optional) Configuration block. Detailed below.
+
+### filter
+
+This block allows for complex filters.
+
+The following arguments are required:
+
+* `name` - (Required) Name of the field to filter by, as defined by [the underlying AWS API](https://docs.aws.amazon.com/fsx/latest/APIReference/API_StorageVirtualMachineFilter.html).
+* `values` - (Required) Set of values that are accepted for the given field. An SVM will be selected if any one of the given values matches.
+
+## Attributes Reference
+
+* `ids` - List of all SVM IDs found.
diff --git a/website/docs/d/fsx_openzfs_snapshot.html.markdown b/website/docs/d/fsx_openzfs_snapshot.html.markdown
index 7f927faae71..de69b742cc2 100644
--- a/website/docs/d/fsx_openzfs_snapshot.html.markdown
+++ b/website/docs/d/fsx_openzfs_snapshot.html.markdown
@@ -27,7 +27,7 @@ data "aws_fsx_openzfs_snapshot" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `most_recent` - (Optional) If more than one result is returned, use the most recent snapshot.
 
@@ -36,9 +36,9 @@ The following arguments are supported:
 * `filter` - (Optional) One or more name/value pairs to filter off of. The
 supported names are file-system-id or volume-id.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name of the snapshot.
 * `creation_time` - Time that the resource was created.
diff --git a/website/docs/d/fsx_windows_file_system.html.markdown b/website/docs/d/fsx_windows_file_system.html.markdown
index beb6a920325..c583309bc85 100644
--- a/website/docs/d/fsx_windows_file_system.html.markdown
+++ b/website/docs/d/fsx_windows_file_system.html.markdown
@@ -26,9 +26,9 @@ The following arguments are required:
 
 * `id` - (Required) Identifier of the file system (e.g. `fs-12345678`).
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `active_directory_id` - The ID for Microsoft Active Directory instance that the file system is join to.
 * `aliases` - An array DNS alias names associated with the Amazon FSx file system.
@@ -38,6 +38,7 @@ In addition to all arguments above, the following attributes are exported:
 * `copy_tags_to_backups` - A boolean flag indicating whether tags on the file system should be copied to backups.
 * `daily_automatic_backup_start_time` - The preferred time (in `HH:MM` format) to take daily automatic backups, in the UTC time zone.
 * `deployment_type` - The file system deployment type.
+* `disk_iops_configuration` - The SSD IOPS configuration for the file system.
 * `dns_name` - DNS name for the file system (e.g. `fs-12345678.corp.example.com`).
 * `id` - Identifier of the file system (e.g. `fs-12345678`).
 * `kms_key_id` - ARN for the KMS Key to encrypt the file system at rest.
diff --git a/website/docs/d/globalaccelerator_accelerator.html.markdown b/website/docs/d/globalaccelerator_accelerator.html.markdown
index 43b880c1622..4c20977e616 100644
--- a/website/docs/d/globalaccelerator_accelerator.html.markdown
+++ b/website/docs/d/globalaccelerator_accelerator.html.markdown
@@ -31,14 +31,14 @@ data "aws_globalaccelerator_accelerator" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `arn` - (Optional) Full ARN of the Global Accelerator.
 * `name` - (Optional) Unique name of the Global Accelerator.
 
 ~> **NOTE:** When both `arn` and `name` are specified, `arn` takes precedence.
 
-## Attributes Reference
+## Attribute Reference
 
 See the [`aws_globalaccelerator_accelerator` resource](/docs/providers/aws/r/globalaccelerator_accelerator.html) for details on the
 returned attributes - they are identical.
diff --git a/website/docs/d/globalaccelerator_custom_routing_accelerator.html.markdown b/website/docs/d/globalaccelerator_custom_routing_accelerator.html.markdown
index ca118d94f81..4fa6a72221e 100644
--- a/website/docs/d/globalaccelerator_custom_routing_accelerator.html.markdown
+++ b/website/docs/d/globalaccelerator_custom_routing_accelerator.html.markdown
@@ -31,14 +31,14 @@ data "aws_globalaccelerator_custom_routing_accelerator" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `arn` - (Optional) Full ARN of the custom routing accelerator.
 * `name` - (Optional) Unique name of the custom routing accelerator.
 
 ~> **NOTE:** When both `arn` and `name` are specified, `arn` takes precedence.
 
-## Attributes Reference
+## Attribute Reference
 
 See the [`aws_globalaccelerator_custom_routing_accelerator` resource](/docs/providers/aws/r/globalaccelerator_custom_routing_accelerator.html) for details on the
 returned attributes - they are identical.
diff --git a/website/docs/d/glue_catalog_table.html.markdown b/website/docs/d/glue_catalog_table.html.markdown
index 636cd66df79..d0479f12ba8 100644
--- a/website/docs/d/glue_catalog_table.html.markdown
+++ b/website/docs/d/glue_catalog_table.html.markdown
@@ -21,7 +21,7 @@ data "aws_glue_catalog_table" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `name` - (Required) Name of the table.
 * `database_name` - (Required) Name of the metadata database where the table metadata resides.
@@ -29,7 +29,9 @@ The following arguments are supported:
 * `query_as_of_time`- (Optional) The time as of when to read the table contents. If not set, the most recent transaction commit time will be used. Cannot be specified along with `transaction_id`. Specified in RFC 3339 format, e.g. `2006-01-02T15:04:05Z07:00`.
 * `transaction_id` - (Optional) The transaction ID at which to read the table contents.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - Catalog ID, Database name and of the name table.
 * `arn` - The ARN of the Glue Table.
diff --git a/website/docs/d/glue_connection.html.markdown b/website/docs/d/glue_connection.html.markdown
index 24d8ede1b31..eccce61a3a0 100644
--- a/website/docs/d/glue_connection.html.markdown
+++ b/website/docs/d/glue_connection.html.markdown
@@ -23,7 +23,9 @@ data "aws_glue_connection" "example" {
 * `id` - (Required) Concatenation of the catalog ID and connection name. For example, if your account ID is
 `123456789123` and the connection name is `conn` then the ID is `123456789123:conn`.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the Glue Connection.
 * `catalog_id` - Catalog ID of the Glue Connection.
diff --git a/website/docs/d/glue_data_catalog_encryption_settings.html.markdown b/website/docs/d/glue_data_catalog_encryption_settings.html.markdown
index b266211a62f..1ed5bcb7dfb 100644
--- a/website/docs/d/glue_data_catalog_encryption_settings.html.markdown
+++ b/website/docs/d/glue_data_catalog_encryption_settings.html.markdown
@@ -22,7 +22,9 @@ data "aws_glue_data_catalog_encryption_settings" "example" {
 
 * `catalog_id` - (Required) ID of the Data Catalog. This is typically the AWS account ID.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `data_catalog_encryption_settings` – The security configuration to set. see [Data Catalog Encryption Settings](#data_catalog_encryption_settings).
 * `id` – The ID of the Data Catalog to set the security configuration for.
diff --git a/website/docs/d/glue_script.html.markdown b/website/docs/d/glue_script.html.markdown
index f02b7a32d59..e79ef244be2 100644
--- a/website/docs/d/glue_script.html.markdown
+++ b/website/docs/d/glue_script.html.markdown
@@ -241,7 +241,9 @@ output "scala_code" {
 * `value` - (Required) Value of the argument or property.
 * `param` - (Optional) Boolean if the value is used as a parameter. Defaults to `false`.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - AWS Region.
 * `python_script` - Python script generated from the DAG when the `language` argument is set to `PYTHON`.
diff --git a/website/docs/d/grafana_workspace.html.markdown b/website/docs/d/grafana_workspace.html.markdown
index ee83bb3c279..1fc1ef829af 100644
--- a/website/docs/d/grafana_workspace.html.markdown
+++ b/website/docs/d/grafana_workspace.html.markdown
@@ -26,9 +26,9 @@ The following arguments are required:
 
 * `workspace_id` - (Required) Grafana workspace ID.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `account_access_type` - (Required) Type of account access for the workspace. Valid values are `CURRENT_ACCOUNT` and `ORGANIZATION`. If `ORGANIZATION` is specified, then `organizational_units` must also be present.
 * `authentication_providers` - (Required) Authentication providers for the workspace. Valid values are `AWS_SSO`, `SAML`, or both.
diff --git a/website/docs/d/guardduty_detector.html.markdown b/website/docs/d/guardduty_detector.html.markdown
index 94888fa40f0..bce278dcdbf 100644
--- a/website/docs/d/guardduty_detector.html.markdown
+++ b/website/docs/d/guardduty_detector.html.markdown
@@ -20,10 +20,16 @@ data "aws_guardduty_detector" "example" {}
 
 * `id` - (Optional) ID of the detector.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
+* `features` - Current configuration of the detector features.
+    * `additional_configuration` - Additional feature configuration.
+        * `name` - The name of the additional configuration.
+        * `status` - The status of the additional configuration.
+    * `name` - The name of the detector feature.
+    * `status` - The status of the detector feature.
 * `finding_publishing_frequency` - The frequency of notifications sent about subsequent finding occurrences.
 * `service_role_arn` - Service-linked role that grants GuardDuty access to the resources in the AWS account.
 * `status` - Current status of the detector.
diff --git a/website/docs/d/guardduty_finding_ids.html.markdown b/website/docs/d/guardduty_finding_ids.html.markdown
index 6ab4b0d970d..ee522aec78c 100644
--- a/website/docs/d/guardduty_finding_ids.html.markdown
+++ b/website/docs/d/guardduty_finding_ids.html.markdown
@@ -26,9 +26,9 @@ The following arguments are required:
 
 * `detector_id` - (Required) ID of the GuardDuty detector.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `has_findings` - Indicates whether findings are present for the specified detector.
 * `finding_ids` - A list of finding IDs for the specified detector.
diff --git a/website/docs/d/iam_access_keys.html.markdown b/website/docs/d/iam_access_keys.html.markdown
index 73b7c465602..97b93017355 100644
--- a/website/docs/d/iam_access_keys.html.markdown
+++ b/website/docs/d/iam_access_keys.html.markdown
@@ -25,9 +25,9 @@ The following arguments are required:
 
 * `user` - (Required) Name of the IAM user associated with the access keys.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `access_keys` - List of the IAM access keys associated with the specified user. See below.
 
diff --git a/website/docs/d/iam_account_alias.html.markdown b/website/docs/d/iam_account_alias.html.markdown
index 13f81c95541..d627110936a 100644
--- a/website/docs/d/iam_account_alias.html.markdown
+++ b/website/docs/d/iam_account_alias.html.markdown
@@ -26,9 +26,9 @@ output "account_id" {
 
 There are no arguments available for this data source.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `account_alias` - Alias associated with the AWS account.
 * `id` - Alias associated with the AWS account.
diff --git a/website/docs/d/iam_group.html.markdown b/website/docs/d/iam_group.html.markdown
index eafbc088c63..b5abbfd25a5 100644
--- a/website/docs/d/iam_group.html.markdown
+++ b/website/docs/d/iam_group.html.markdown
@@ -24,7 +24,9 @@ data "aws_iam_group" "example" {
 
 * `group_name` - (Required) Friendly IAM group name to match.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - Group ARN.
 * `group_id` - Stable and unique string identifying the group.
diff --git a/website/docs/d/iam_instance_profile.html.markdown b/website/docs/d/iam_instance_profile.html.markdown
index 1f6713b1414..df6fa21a709 100644
--- a/website/docs/d/iam_instance_profile.html.markdown
+++ b/website/docs/d/iam_instance_profile.html.markdown
@@ -24,7 +24,9 @@ data "aws_iam_instance_profile" "example" {
 
 * `name` - (Required) Friendly IAM instance profile name to match.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN.
 * `create_date` - String representation of the date the instance profile was created.
diff --git a/website/docs/d/iam_instance_profiles.html.markdown b/website/docs/d/iam_instance_profiles.html.markdown
index 213ea259ebd..35f0f828339 100644
--- a/website/docs/d/iam_instance_profiles.html.markdown
+++ b/website/docs/d/iam_instance_profiles.html.markdown
@@ -24,7 +24,9 @@ data "aws_iam_instance_profiles" "example" {
 
 * `role_name` - (Required) IAM role name.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `arns` - Set of ARNs of instance profiles.
 * `names` - Set of IAM instance profile names.
diff --git a/website/docs/d/iam_openid_connect_provider.html.markdown b/website/docs/d/iam_openid_connect_provider.html.markdown
index 93f4ba68c3c..3ff67fa67c5 100644
--- a/website/docs/d/iam_openid_connect_provider.html.markdown
+++ b/website/docs/d/iam_openid_connect_provider.html.markdown
@@ -31,7 +31,9 @@ data "aws_iam_openid_connect_provider" "example" {
 * `arn` - (Optional) ARN of the OpenID Connect provider.
 * `url` - (Optional) URL of the OpenID Connect provider.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `client_id_list` - List of client IDs (also known as audiences). When a mobile or web app registers with an OpenID Connect provider, they establish a value that identifies the application. (This is the value that's sent as the client_id parameter on OAuth requests.)
 * `thumbprint_list` - List of server certificate thumbprints for the OpenID Connect (OIDC) identity provider's server certificate(s).
diff --git a/website/docs/d/iam_policy.html.markdown b/website/docs/d/iam_policy.html.markdown
index fb685679a3b..4a325d87775 100644
--- a/website/docs/d/iam_policy.html.markdown
+++ b/website/docs/d/iam_policy.html.markdown
@@ -39,9 +39,9 @@ data "aws_iam_policy" "example" {
   Defaults to a slash (`/`).
   Conflicts with `arn`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the policy.
 * `path` - Path to the policy.
diff --git a/website/docs/d/iam_policy_document.html.markdown b/website/docs/d/iam_policy_document.html.markdown
index 913e54f14eb..30cf2852ab2 100644
--- a/website/docs/d/iam_policy_document.html.markdown
+++ b/website/docs/d/iam_policy_document.html.markdown
@@ -531,8 +531,8 @@ The following arguments are required:
 * `identifiers` (Required) List of identifiers for principals. When `type` is `AWS`, these are IAM principal ARNs, e.g., `arn:aws:iam::12345678901:role/yak-role`.  When `type` is `Service`, these are AWS Service roles, e.g., `lambda.amazonaws.com`. When `type` is `Federated`, these are web identity users or SAML provider ARNs, e.g., `accounts.google.com` or `arn:aws:iam::12345678901:saml-provider/yak-saml-provider`. When `type` is `CanonicalUser`, these are [canonical user IDs](https://docs.aws.amazon.com/general/latest/gr/acct-identifiers.html#FindingCanonicalId), e.g., `79a59df900b949e55d96a1e698fbacedfd6e09d98eacf8f8d5218e7cd47ef2be`.
 * `type` (Required) Type of principal. Valid values include `AWS`, `Service`, `Federated`, `CanonicalUser` and `*`.
 
-## Attributes Reference
+## Attribute Reference
 
-The following attribute is exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `json` - Standard JSON policy document rendered based on the arguments above.
diff --git a/website/docs/d/iam_principal_policy_simulation.html.markdown b/website/docs/d/iam_principal_policy_simulation.html.markdown
index b5a9e41b735..8ae3bb901b4 100644
--- a/website/docs/d/iam_principal_policy_simulation.html.markdown
+++ b/website/docs/d/iam_principal_policy_simulation.html.markdown
@@ -195,9 +195,9 @@ The following arguments are all required in each `context` block:
 
 * `values` (Required) - A set of one or more values for this context entry.
 
-## Attributes Reference
+## Attribute Reference
 
-The following attribute is exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `all_allowed` - `true` if all of the simulation results have decision "allowed", or `false` otherwise.
 
diff --git a/website/docs/d/iam_role.html.markdown b/website/docs/d/iam_role.html.markdown
index 6454be7e7b4..62ad8ec47b1 100644
--- a/website/docs/d/iam_role.html.markdown
+++ b/website/docs/d/iam_role.html.markdown
@@ -24,7 +24,9 @@ data "aws_iam_role" "example" {
 
 * `name` - (Required) Friendly IAM role name to match.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - Friendly IAM role name to match.
 * `arn` - ARN of the role.
diff --git a/website/docs/d/iam_roles.html.markdown b/website/docs/d/iam_roles.html.markdown
index 0411264b13a..d303e12df6a 100644
--- a/website/docs/d/iam_roles.html.markdown
+++ b/website/docs/d/iam_roles.html.markdown
@@ -74,12 +74,14 @@ output "arns" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `name_regex` - (Optional) Regex string to apply to the IAM roles list returned by AWS. This allows more advanced filtering not supported from the AWS API. This filtering is done locally on what AWS returns, and could have a performance impact if the result is large. Combine this with other options to narrow down the list AWS returns.
 * `path_prefix` - (Optional) Path prefix for filtering the results. For example, the prefix `/application_abc/component_xyz/` gets all roles whose path starts with `/application_abc/component_xyz/`. If it is not included, it defaults to a slash (`/`), listing all roles. For more details, check out [list-roles in the AWS CLI reference][1].
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `arns` - Set of ARNs of the matched IAM roles.
 * `names` - Set of Names of the matched IAM roles.
diff --git a/website/docs/d/iam_saml_provider.html.markdown b/website/docs/d/iam_saml_provider.html.markdown
index ba9ee9d104b..c990c6cc1e0 100644
--- a/website/docs/d/iam_saml_provider.html.markdown
+++ b/website/docs/d/iam_saml_provider.html.markdown
@@ -24,9 +24,9 @@ data "aws_iam_saml_provider" "example" {
 
 * `arn` - (Required) ARN assigned by AWS for the provider.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `create_date` - Creation date of the SAML provider in RFC1123 format, e.g. `Mon, 02 Jan 2006 15:04:05 MST`.
 * `name` - Name of the provider.
diff --git a/website/docs/d/iam_server_certificate.html.markdown b/website/docs/d/iam_server_certificate.html.markdown
index 7f8019bd8a8..6bd9642e2e4 100644
--- a/website/docs/d/iam_server_certificate.html.markdown
+++ b/website/docs/d/iam_server_certificate.html.markdown
@@ -38,7 +38,9 @@ resource "aws_elb" "elb" {
 * `name` - exact name of the cert to lookup
 * `latest` - sort results by expiration date. returns the certificate with expiration date in furthest in the future.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` is set to the unique id of the IAM Server Certificate
 * `arn` is set to the ARN of the IAM Server Certificate
@@ -50,5 +52,19 @@ resource "aws_elb" "elb" {
 
 ## Import
 
-The terraform import function will read in certificate body, certificate chain (if it exists), id, name, path, and arn.
-It will not retrieve the private key which is not available through the AWS API.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import an IAM server certificate using `name`. For example:
+
+```terraform
+import {
+  to = aws_iam_server_certificate.example
+  id = "example"
+}
+```
+
+Using `terraform import`, import an IAM server certificate using `name`. For example:
+
+```console
+% terraform import aws_iam_server_certificate.example example
+```
+
+Import will read in the certificate body, certificate chain (if it exists), ID, name, path, and ARN. It will not retrieve the private key which is not available through the AWS API.
diff --git a/website/docs/d/iam_session_context.html.markdown b/website/docs/d/iam_session_context.html.markdown
new file mode 100644
index 00000000000..78b3dc9bbda
--- /dev/null
+++ b/website/docs/d/iam_session_context.html.markdown
@@ -0,0 +1,50 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_session_context"
+description: |-
+  Get information on the IAM source role of an STS assumed role
+---
+
+# Data Source: aws_iam_session_context
+
+This data source provides information on the IAM source role of an STS assumed role. For non-role ARNs, this data source simply passes the ARN through in `issuer_arn`.
+
+For some AWS resources, multiple types of principals are allowed in the same argument (e.g., IAM users and IAM roles). However, these arguments often do not allow assumed-role (i.e., STS, temporary credential) principals. Given an STS ARN, this data source provides the ARN for the source IAM role.
+
+## Example Usage
+
+### Basic Example
+
+```terraform
+data "aws_iam_session_context" "example" {
+  arn = "arn:aws:sts::123456789012:assumed-role/Audien-Heaven/MatyNoyes"
+}
+```
+
+### Find the Terraform Runner's Source Role
+
+Combined with `aws_caller_identity`, you can get the current user's source IAM role ARN (`issuer_arn`) if you're using an assumed role. If you're not using an assumed role, the caller's (e.g., an IAM user's) ARN will simply be passed through. In environments where both IAM users and individuals using assumed roles need to apply the same configurations, this data source enables seamless use.
+
+```terraform
+data "aws_caller_identity" "current" {}
+
+data "aws_iam_session_context" "example" {
+  arn = data.aws_caller_identity.current.arn
+}
+```
+
+## Argument Reference
+
+* `arn` - (Required) ARN for an assumed role.
+
+~> If `arn` is a non-role ARN, Terraform gives no error and `issuer_arn` will be equal to the `arn` value. For STS assumed-role ARNs, Terraform gives an error if the identified IAM role does not exist.
+
+## Attribute Reference
+
+~> With the exception of `issuer_arn`, the attributes will not be populated unless the `arn` corresponds to an STS assumed role.
+
+* `issuer_arn` - IAM source role ARN if `arn` corresponds to an STS assumed role. Otherwise, `issuer_arn` is equal to `arn`.
+* `issuer_id` - Unique identifier of the IAM role that issues the STS assumed role.
+* `issuer_name` - Name of the source role. Only available if `arn` corresponds to an STS assumed role.
+* `session_name` - Name of the STS session. Only available if `arn` corresponds to an STS assumed role.
diff --git a/website/docs/d/iam_session_context.markdown b/website/docs/d/iam_session_context.markdown
deleted file mode 100644
index a4ce7512fc6..00000000000
--- a/website/docs/d/iam_session_context.markdown
+++ /dev/null
@@ -1,50 +0,0 @@
----
-subcategory: "IAM (Identity & Access Management)"
-layout: "aws"
-page_title: "AWS: aws_iam_session_context"
-description: |-
-  Get information on the IAM source role of an STS assumed role
----
-
-# Data Source: aws_iam_session_context
-
-This data source provides information on the IAM source role of an STS assumed role. For non-role ARNs, this data source simply passes the ARN through in `issuer_arn`.
-
-For some AWS resources, multiple types of principals are allowed in the same argument (e.g., IAM users and IAM roles). However, these arguments often do not allow assumed-role (i.e., STS, temporary credential) principals. Given an STS ARN, this data source provides the ARN for the source IAM role.
-
-## Example Usage
-
-### Basic Example
-
-```terraform
-data "aws_iam_session_context" "example" {
-  arn = "arn:aws:sts::123456789012:assumed-role/Audien-Heaven/MatyNoyes"
-}
-```
-
-### Find the Terraform Runner's Source Role
-
-Combined with `aws_caller_identity`, you can get the current user's source IAM role ARN (`issuer_arn`) if you're using an assumed role. If you're not using an assumed role, the caller's (e.g., an IAM user's) ARN will simply be passed through. In environments where both IAM users and individuals using assumed roles need to apply the same configurations, this data source enables seamless use.
-
-```terraform
-data "aws_caller_identity" "current" {}
-
-data "aws_iam_session_context" "example" {
-  arn = data.aws_caller_identity.current.arn
-}
-```
-
-## Argument Reference
-
-* `arn` - (Required) ARN for an assumed role.
-
-~> If `arn` is a non-role ARN, Terraform gives no error and `issuer_arn` will be equal to the `arn` value. For STS assumed-role ARNs, Terraform gives an error if the identified IAM role does not exist.
-
-## Attributes Reference
-
-~> With the exception of `issuer_arn`, the attributes will not be populated unless the `arn` corresponds to an STS assumed role.
-
-* `issuer_arn` - IAM source role ARN if `arn` corresponds to an STS assumed role. Otherwise, `issuer_arn` is equal to `arn`.
-* `issuer_id` - Unique identifier of the IAM role that issues the STS assumed role.
-* `issuer_name` - Name of the source role. Only available if `arn` corresponds to an STS assumed role.
-* `session_name` - Name of the STS session. Only available if `arn` corresponds to an STS assumed role.
diff --git a/website/docs/d/iam_user.html.markdown b/website/docs/d/iam_user.html.markdown
index a7631fbcd3a..6c015c924f8 100644
--- a/website/docs/d/iam_user.html.markdown
+++ b/website/docs/d/iam_user.html.markdown
@@ -24,7 +24,9 @@ data "aws_iam_user" "example" {
 
 * `user_name` - (Required) Friendly IAM user name to match.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN assigned by AWS for this user.
 * `path` - Path in which this user was created.
diff --git a/website/docs/d/iam_user_ssh_key.html.markdown b/website/docs/d/iam_user_ssh_key.html.markdown
index f97b124bc8d..944f93f63ec 100644
--- a/website/docs/d/iam_user_ssh_key.html.markdown
+++ b/website/docs/d/iam_user_ssh_key.html.markdown
@@ -26,9 +26,9 @@ data "aws_iam_user_ssh_key" "example" {
 * `ssh_public_key_id` - (Required) Unique identifier for the SSH public key.
 * `username` - (Required) Name of the IAM user associated with the SSH public key.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `fingerprint` - MD5 message digest of the SSH public key.
 * `public_key` - SSH public key.
diff --git a/website/docs/d/iam_users.html.markdown b/website/docs/d/iam_users.html.markdown
index 7cb0a706259..1184380377d 100644
--- a/website/docs/d/iam_users.html.markdown
+++ b/website/docs/d/iam_users.html.markdown
@@ -38,12 +38,14 @@ data "aws_iam_users" "users" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `name_regex` - (Optional) Regex string to apply to the IAM users list returned by AWS. This allows more advanced filtering not supported from the AWS API. This filtering is done locally on what AWS returns, and could have a performance impact if the result is large. Combine this with other options to narrow down the list AWS returns.
 * `path_prefix` - (Optional) Path prefix for filtering the results. For example, the prefix `/division_abc/subdivision_xyz/` gets all users whose path starts with `/division_abc/subdivision_xyz/`. If it is not included, it defaults to a slash (`/`), listing all users. For more details, check out [list-users in the AWS CLI reference][1].
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `arns` - Set of ARNs of the matched IAM users.
 * `names` - Set of Names of the matched IAM users.
diff --git a/website/docs/d/identitystore_group.html.markdown b/website/docs/d/identitystore_group.html.markdown
index 788c4668659..2022057fcc6 100644
--- a/website/docs/d/identitystore_group.html.markdown
+++ b/website/docs/d/identitystore_group.html.markdown
@@ -39,14 +39,15 @@ The following arguments are required:
 
 The following arguments are optional:
 
-* `alternate_identifier` (Optional) A unique identifier for the group that is not the primary identifier. Conflicts with `group_id`. Detailed below.
+* `alternate_identifier` (Optional) A unique identifier for the group that is not the primary identifier. Conflicts with `group_id` and `filter`. Detailed below.
+* `filter` - (Optional, **Deprecated** use the `alternate_identifier` attribute instead) Configuration block for filtering by a unique attribute of the group. Detailed below.
 * `group_id` - (Optional) The identifier for a group in the Identity Store.
 
--> Exactly one of the above arguments must be provided.
+-> Exactly one of the above arguments must be provided. Passing both `filter` and `group_id` is allowed for backwards compatibility.
 
 ### `alternate_identifier` Configuration Block
 
-The following arguments are supported by the `alternate_identifier` configuration block:
+The `alternate_identifier` configuration block supports the following arguments:
 
 * `external_id` - (Optional) Configuration block for filtering by the identifier issued by an external identity provider. Detailed below.
 * `unique_attribute` - (Optional) An entity attribute that's unique to a specific entity. Detailed below.
@@ -55,21 +56,30 @@ The following arguments are supported by the `alternate_identifier` configuratio
 
 ### `external_id` Configuration Block
 
-The following arguments are supported by the `external_id` configuration block:
+The `external_id` configuration block supports the following arguments:
 
 * `id` - (Required) The identifier issued to this resource by an external identity provider.
 * `issuer` - (Required) The issuer for an external identifier.
 
+### `filter` Configuration Block
+
+~> The `filter` configuration block has been deprecated. Use `alternate_identifier` instead.
+
+The following arguments are supported by the `filter` configuration block:
+
+* `attribute_path` - (Required) Attribute path that is used to specify which attribute name to search. Currently, `DisplayName` is the only valid attribute path.
+* `attribute_value` - (Required) Value for an attribute.
+
 ### `unique_attribute` Configuration Block
 
-The following arguments are supported by the `unique_attribute` configuration block:
+The `unique_attribute` configuration block supports the following arguments:
 
 * `attribute_path` - (Required) Attribute path that is used to specify which attribute name to search. For example: `DisplayName`. Refer to the [Group data type](https://docs.aws.amazon.com/singlesignon/latest/IdentityStoreAPIReference/API_Group.html).
 * `attribute_value` - (Required) Value for an attribute.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - Identifier of the group in the Identity Store.
 * `description` - Description of the specified group.
diff --git a/website/docs/d/identitystore_user.html.markdown b/website/docs/d/identitystore_user.html.markdown
index 99546e176e3..edfdc3b9e38 100644
--- a/website/docs/d/identitystore_user.html.markdown
+++ b/website/docs/d/identitystore_user.html.markdown
@@ -39,14 +39,15 @@ The following arguments are required:
 
 The following arguments are optional:
 
-* `alternate_identifier` (Optional) A unique identifier for a user or group that is not the primary identifier. Conflicts with `user_id`. Detailed below.
+* `alternate_identifier` (Optional) A unique identifier for a user or group that is not the primary identifier. Conflicts with `user_id` and `filter`. Detailed below.
+* `filter` - (Optional, **Deprecated** use the `alternate_identifier` attribute instead) Configuration block for filtering by a unique attribute of the user. Detailed below.
 * `user_id` - (Optional) The identifier for a user in the Identity Store.
 
--> Exactly one of the above arguments must be provided.
+-> Exactly one of the above arguments must be provided. Passing both `filter` and `user_id` is allowed for backwards compatibility.
 
 ### `alternate_identifier` Configuration Block
 
-The following arguments are supported by the `alternate_identifier` configuration block:
+The `alternate_identifier` configuration block supports the following arguments:
 
 * `external_id` - (Optional) Configuration block for filtering by the identifier issued by an external identity provider. Detailed below.
 * `unique_attribute` - (Optional) An entity attribute that's unique to a specific entity. Detailed below.
@@ -55,21 +56,30 @@ The following arguments are supported by the `alternate_identifier` configuratio
 
 ### `external_id` Configuration Block
 
-The following arguments are supported by the `external_id` configuration block:
+The `external_id` configuration block supports the following arguments:
 
 * `id` - (Required) The identifier issued to this resource by an external identity provider.
 * `issuer` - (Required) The issuer for an external identifier.
 
+### `filter` Configuration Block
+
+~> The `filter` configuration block has been deprecated. Use `alternate_identifier` instead.
+
+The following arguments are supported by the `filter` configuration block:
+
+* `attribute_path` - (Required) Attribute path that is used to specify which attribute name to search. Currently, `UserName` is the only valid attribute path.
+* `attribute_value` - (Required) Value for an attribute.
+
 ### `unique_attribute` Configuration Block
 
-The following arguments are supported by the `unique_attribute` configuration block:
+The `unique_attribute` configuration block supports the following arguments:
 
 * `attribute_path` - (Required) Attribute path that is used to specify which attribute name to search. For example: `UserName`. Refer to the [User data type](https://docs.aws.amazon.com/singlesignon/latest/IdentityStoreAPIReference/API_User.html).
 * `attribute_value` - (Required) Value for an attribute.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - Identifier of the user in the Identity Store.
 * `addresses` - List of details about the user's address.
diff --git a/website/docs/d/imagebuilder_component.html.markdown b/website/docs/d/imagebuilder_component.html.markdown
index 3248c93b37b..2b10c1dab9c 100644
--- a/website/docs/d/imagebuilder_component.html.markdown
+++ b/website/docs/d/imagebuilder_component.html.markdown
@@ -22,9 +22,9 @@ data "aws_imagebuilder_component" "example" {
 
 * `arn` - (Required) ARN of the component.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `change_description` - Change description of the component.
 * `data` - Data of the component.
diff --git a/website/docs/d/imagebuilder_components.html.markdown b/website/docs/d/imagebuilder_components.html.markdown
index 3bfa141f805..13fcbdd2403 100644
--- a/website/docs/d/imagebuilder_components.html.markdown
+++ b/website/docs/d/imagebuilder_components.html.markdown
@@ -30,12 +30,14 @@ data "aws_imagebuilder_components" "example" {
 
 ### filter Configuration Block
 
-The following arguments are supported by the `filter` configuration block:
+The `filter` configuration block supports the following arguments:
 
 * `name` - (Required) Name of the filter field. Valid values can be found in the [Image Builder ListComponents API Reference](https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_ListComponents.html).
 * `values` - (Required) Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `arns` - Set of ARNs of the matched Image Builder Components.
 * `names` - Set of names of the matched Image Builder Components.
diff --git a/website/docs/d/imagebuilder_container_recipe.html.markdown b/website/docs/d/imagebuilder_container_recipe.html.markdown
index aff580a8334..d151c9e4ee4 100644
--- a/website/docs/d/imagebuilder_container_recipe.html.markdown
+++ b/website/docs/d/imagebuilder_container_recipe.html.markdown
@@ -24,9 +24,9 @@ The following arguments are required:
 
 * `arn` - (Required) ARN of the container recipe.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `component` - List of objects with components for the container recipe.
     * `component_arn` - ARN of the Image Builder Component.
diff --git a/website/docs/d/imagebuilder_container_recipes.html.markdown b/website/docs/d/imagebuilder_container_recipes.html.markdown
index 55f5f98f736..e1c6482be9f 100644
--- a/website/docs/d/imagebuilder_container_recipes.html.markdown
+++ b/website/docs/d/imagebuilder_container_recipes.html.markdown
@@ -30,12 +30,14 @@ data "aws_imagebuilder_container_recipes" "example" {
 
 ### filter Configuration Block
 
-The following arguments are supported by the `filter` configuration block:
+The `filter` configuration block supports the following arguments:
 
 * `name` - (Required) Name of the filter field. Valid values can be found in the [Image Builder ListContainerRecipes API Reference](https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_ListContainerRecipes.html).
 * `values` - (Required) Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `arns` - Set of ARNs of the matched Image Builder Container Recipes.
 * `names` - Set of names of the matched Image Builder Container Recipes.
diff --git a/website/docs/d/imagebuilder_distribution_configuration.html.markdown b/website/docs/d/imagebuilder_distribution_configuration.html.markdown
index 0cacc1c76d1..358c4fb9c41 100644
--- a/website/docs/d/imagebuilder_distribution_configuration.html.markdown
+++ b/website/docs/d/imagebuilder_distribution_configuration.html.markdown
@@ -22,9 +22,9 @@ data "aws_imagebuilder_distribution_configuration" "example" {
 
 * `arn` - (Required) ARN of the distribution configuration.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `date_created` - Date the distribution configuration was created.
 * `date_updated` - Date the distribution configuration was updated.
diff --git a/website/docs/d/imagebuilder_distribution_configurations.html.markdown b/website/docs/d/imagebuilder_distribution_configurations.html.markdown
index 9dee6c0b46b..17dca6ebae7 100644
--- a/website/docs/d/imagebuilder_distribution_configurations.html.markdown
+++ b/website/docs/d/imagebuilder_distribution_configurations.html.markdown
@@ -27,12 +27,14 @@ data "aws_imagebuilder_distribution_configurations" "example" {
 
 ## filter Configuration Block
 
-The following arguments are supported by the `filter` configuration block:
+The `filter` configuration block supports the following arguments:
 
 * `name` - (Required) Name of the filter field. Valid values can be found in the [Image Builder ListDistributionConfigurations API Reference](https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_ListDistributionConfigurations.html).
 * `values` - (Required) Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `arns` - Set of ARNs of the matched Image Builder Distribution Configurations.
 * `names` - Set of names of the matched Image Builder Distribution Configurations.
diff --git a/website/docs/d/imagebuilder_image.html.markdown b/website/docs/d/imagebuilder_image.html.markdown
index 2ed75e009ba..31ff08533fa 100644
--- a/website/docs/d/imagebuilder_image.html.markdown
+++ b/website/docs/d/imagebuilder_image.html.markdown
@@ -24,9 +24,9 @@ data "aws_imagebuilder_image" "example" {
 
 * `arn` - (Required) ARN of the image. The suffix can either be specified with wildcards (`x.x.x`) to fetch the latest build version or a full build version (e.g., `2020.11.26/1`) to fetch an exact version.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `build_version_arn` - Build version ARN of the image. This will always have the `#.#.#/#` suffix.
 * `container_recipe_arn` - ARN of the container recipe.
@@ -34,6 +34,11 @@ In addition to all arguments above, the following attributes are exported:
 * `distribution_configuration_arn` - ARN of the Image Builder Distribution Configuration.
 * `enhanced_image_metadata_enabled` - Whether additional information about the image being created is collected.
 * `image_recipe_arn` - ARN of the image recipe.
+* `image_scanning_configuration` - List of an object with image scanning configuration fields.
+    * `image_scanning_enabled` - Indicates whether Image Builder keeps a snapshot of the vulnerability scans that Amazon Inspector runs against the build instance when you create a new image.
+    * `ecr_configuration` - Configuration block with ECR configuration.
+        * `repository_name` - The name of the container repository that Amazon Inspector scans to identify findings for your container images.
+        * `container_tags` - Set of tags for Image Builder to apply to the output container image that that Amazon Inspector scans.
 * `image_tests_configuration` - List of an object with image tests configuration.
     * `image_tests_enabled` - Whether image tests are enabled.
     * `timeout_minutes` - Number of minutes before image tests time out.
diff --git a/website/docs/d/imagebuilder_image_pipeline.html.markdown b/website/docs/d/imagebuilder_image_pipeline.html.markdown
index 92f68e1d6dd..fe08eb5e942 100644
--- a/website/docs/d/imagebuilder_image_pipeline.html.markdown
+++ b/website/docs/d/imagebuilder_image_pipeline.html.markdown
@@ -22,9 +22,9 @@ data "aws_imagebuilder_image_pipeline" "example" {
 
 * `arn` - (Required) ARN of the image pipeline.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `container_recipe_arn` - ARN of the container recipe.
 * `date_created` - Date the image pipeline was created.
@@ -35,6 +35,11 @@ In addition to all arguments above, the following attributes are exported:
 * `distribution_configuration_arn` - ARN of the Image Builder Distribution Configuration.
 * `enhanced_image_metadata_enabled` - Whether additional information about the image being created is collected.
 * `image_recipe_arn` - ARN of the image recipe.
+* `image_tests_configuration` - List of an object with image scanning configuration.
+    * `image_scanning_enabled`  - Whether image scanning is enabled.
+    * `ecr_configuration`  - List if an object with ecr configuration for image scanning
+        * `container_tags`  - Tags that are added to the output containers that are scanned
+        * `repository_name`  - The name of the container repository that Amazon Inspector scans
 * `image_tests_configuration` - List of an object with image tests configuration.
     * `image_tests_enabled` - Whether image tests are enabled.
     * `timeout_minutes` - Number of minutes before image tests time out.
diff --git a/website/docs/d/imagebuilder_image_pipelines.html.markdown b/website/docs/d/imagebuilder_image_pipelines.html.markdown
index 67dabacb6a1..d2820486c0f 100644
--- a/website/docs/d/imagebuilder_image_pipelines.html.markdown
+++ b/website/docs/d/imagebuilder_image_pipelines.html.markdown
@@ -27,12 +27,14 @@ data "aws_imagebuilder_image_pipelines" "example" {
 
 ### filter Configuration Block
 
-The following arguments are supported by the `filter` configuration block:
+The `filter` configuration block supports the following arguments:
 
 * `name` - (Required) Name of the filter field. Valid values can be found in the [Image Builder ListImagePipelines API Reference](https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_ListImagePipelines.html).
 * `values` - (Required) Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `arns` - Set of ARNs of the matched Image Builder Image Pipelines.
 * `names` - Set of names of the matched Image Builder Image Pipelines.
diff --git a/website/docs/d/imagebuilder_image_recipe.html.markdown b/website/docs/d/imagebuilder_image_recipe.html.markdown
index fb5b04c46a1..642feacfa0f 100644
--- a/website/docs/d/imagebuilder_image_recipe.html.markdown
+++ b/website/docs/d/imagebuilder_image_recipe.html.markdown
@@ -24,9 +24,9 @@ The following arguments are required:
 
 * `arn` - (Required) ARN of the image recipe.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `block_device_mapping` - Set of objects with block device mappings for the image recipe.
     * `device_name` - Name of the device. For example, `/dev/sda` or `/dev/xvdb`.
diff --git a/website/docs/d/imagebuilder_image_recipes.html.markdown b/website/docs/d/imagebuilder_image_recipes.html.markdown
index 95114c474ef..93de7874c1f 100644
--- a/website/docs/d/imagebuilder_image_recipes.html.markdown
+++ b/website/docs/d/imagebuilder_image_recipes.html.markdown
@@ -30,12 +30,14 @@ data "aws_imagebuilder_image_recipes" "example" {
 
 ### filter Configuration Block
 
-The following arguments are supported by the `filter` configuration block:
+The `filter` configuration block supports the following arguments:
 
 * `name` - (Required) Name of the filter field. Valid values can be found in the [Image Builder ListImageRecipes API Reference](https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_ListImageRecipes.html).
 * `values` - (Required) Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `arns` - Set of ARNs of the matched Image Builder Image Recipes.
 * `names` - Set of names of the matched Image Builder Image Recipes.
diff --git a/website/docs/d/imagebuilder_infrastructure_configuration.html.markdown b/website/docs/d/imagebuilder_infrastructure_configuration.html.markdown
index e5a8ff1a53c..be98813eba7 100644
--- a/website/docs/d/imagebuilder_infrastructure_configuration.html.markdown
+++ b/website/docs/d/imagebuilder_infrastructure_configuration.html.markdown
@@ -24,9 +24,9 @@ The following arguments are required:
 
 * `arn` - (Required) ARN of the infrastructure configuration.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `date_created` - Date the infrastructure configuration was created.
 * `date_created` - Date the infrastructure configuration was updated.
diff --git a/website/docs/d/imagebuilder_infrastructure_configurations.html.markdown b/website/docs/d/imagebuilder_infrastructure_configurations.html.markdown
index 4dda8c72da0..b9bc4df3585 100644
--- a/website/docs/d/imagebuilder_infrastructure_configurations.html.markdown
+++ b/website/docs/d/imagebuilder_infrastructure_configurations.html.markdown
@@ -27,12 +27,14 @@ data "aws_imagebuilder_infrastructure_configurations" "example" {
 
 ## filter Configuration Block
 
-The following arguments are supported by the `filter` configuration block:
+The `filter` configuration block supports the following arguments:
 
 * `name` - (Required) Name of the filter field. Valid values can be found in the [Image Builder ListInfrastructureConfigurations API Reference](https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_ListInfrastructureConfigurations.html).
 * `values` - (Required) Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `arns` - Set of ARNs of the matched Image Builder Infrastructure Configurations.
 * `names` - Set of names of the matched Image Builder Infrastructure Configurations.
diff --git a/website/docs/d/inspector_rules_packages.html.markdown b/website/docs/d/inspector_rules_packages.html.markdown
index 212d91b695a..16ac64589fa 100644
--- a/website/docs/d/inspector_rules_packages.html.markdown
+++ b/website/docs/d/inspector_rules_packages.html.markdown
@@ -39,9 +39,9 @@ resource "aws_inspector_assessment_template" "assessment" {
 }
 ```
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - AWS Region.
 * `arns` - List of the Amazon Inspector Classic Rules Packages arns available in the AWS region.
diff --git a/website/docs/d/instance.html.markdown b/website/docs/d/instance.html.markdown
index 9d60ac6f973..38071202494 100644
--- a/website/docs/d/instance.html.markdown
+++ b/website/docs/d/instance.html.markdown
@@ -49,7 +49,7 @@ several valid keys, for a full reference, check out
 Terraform will fail. Ensure that your search is specific enough to return
 a single Instance ID only.
 
-## Attributes Reference
+## Attribute Reference
 
 `id` is set to the ID of the found Instance. In addition, the following attributes
 are exported:
@@ -92,6 +92,7 @@ interpolation.
     * `auto_recovery` - Automatic recovery behavior of the instance.
 * `metadata_options` - Metadata options of the Instance.
     * `http_endpoint` - State of the metadata service: `enabled`, `disabled`.
+    * `http_protocol_ipv6` - Whether the IPv6 endpoint for the instance metadata service is `enabled` or `disabled`
     * `http_tokens` - If session tokens are required: `optional`, `required`.
     * `http_put_response_hop_limit` - Desired HTTP PUT response hop limit for instance metadata requests.
     * `instance_metadata_tags` - If access to instance tags is allowed from the metadata service: `enabled`, `disabled`.
diff --git a/website/docs/d/instances.html.markdown b/website/docs/d/instances.html.markdown
index b0d34f0a409..7e4fad4eb4f 100644
--- a/website/docs/d/instances.html.markdown
+++ b/website/docs/d/instances.html.markdown
@@ -54,7 +54,9 @@ exactly match a pair on desired instances.
 several valid keys, for a full reference, check out
 [describe-instances in the AWS CLI reference][1].
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - AWS Region.
 * `ids` - IDs of instances found through the filter
diff --git a/website/docs/d/internet_gateway.html.markdown b/website/docs/d/internet_gateway.html.markdown
index ad5b6ee4b96..46357dd6d10 100644
--- a/website/docs/d/internet_gateway.html.markdown
+++ b/website/docs/d/internet_gateway.html.markdown
@@ -45,7 +45,9 @@ which take the following arguments:
 * `values` - (Required) Set of values that are accepted for the given field.
   An Internet Gateway will be selected if any one of the given values matches.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the Internet Gateway.
 
diff --git a/website/docs/d/iot_endpoint.html.markdown b/website/docs/d/iot_endpoint.html.markdown
index 77584a4a7b4..49f1c9bc276 100644
--- a/website/docs/d/iot_endpoint.html.markdown
+++ b/website/docs/d/iot_endpoint.html.markdown
@@ -38,7 +38,9 @@ resource "kubernetes_pod" "agent" {
 
 * `endpoint_type` - (Optional) Endpoint type. Valid values: `iot:CredentialProvider`, `iot:Data`, `iot:Data-ATS`, `iot:Jobs`.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `endpoint_address` - Endpoint based on `endpoint_type`:
     * No `endpoint_type`: Either `iot:Data` or `iot:Data-ATS` [depending on region](https://aws.amazon.com/blogs/iot/aws-iot-core-ats-endpoints/)
diff --git a/website/docs/d/ip_ranges.html.markdown b/website/docs/d/ip_ranges.html.markdown
index 46b8d442ea2..288c9c8a401 100644
--- a/website/docs/d/ip_ranges.html.markdown
+++ b/website/docs/d/ip_ranges.html.markdown
@@ -53,7 +53,9 @@ CIDR blocks, Terraform will fail.
 
 * `url` - (Optional) Custom URL for source JSON file. Syntax must match [AWS IP Address Ranges documentation][1]. Defaults to `https://ip-ranges.amazonaws.com/ip-ranges.json`.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `cidr_blocks` - Lexically ordered list of CIDR blocks.
 * `ipv6_cidr_blocks` - Lexically ordered list of IPv6 CIDR blocks.
diff --git a/website/docs/d/ivs_stream_key.html.markdown b/website/docs/d/ivs_stream_key.html.markdown
index 9aebab85544..123e5dc1afa 100644
--- a/website/docs/d/ivs_stream_key.html.markdown
+++ b/website/docs/d/ivs_stream_key.html.markdown
@@ -26,9 +26,9 @@ The following arguments are required:
 
 * `channel_arn` - (Required) ARN of the Channel.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the Stream Key.
 * `tags` - Map of tags assigned to the resource.
diff --git a/website/docs/d/kendra_experience.html.markdown b/website/docs/d/kendra_experience.html.markdown
index 7af78abb102..d8f956da068 100644
--- a/website/docs/d/kendra_experience.html.markdown
+++ b/website/docs/d/kendra_experience.html.markdown
@@ -21,14 +21,14 @@ data "aws_kendra_experience" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `experience_id` - (Required) Identifier of the Experience.
 * `index_id` - (Required) Identifier of the index that contains the Experience.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all of the arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the Experience.
 * `configuration` - Block that specifies the configuration information for your Amazon Kendra Experience. This includes `content_source_configuration`, which specifies the data source IDs and/or FAQ IDs, and `user_identity_configuration`, which specifies the user or group information to grant access to your Amazon Kendra Experience. Documented below.
diff --git a/website/docs/d/kendra_faq.html.markdown b/website/docs/d/kendra_faq.html.markdown
index cfd4efdee33..6d2fc296fff 100644
--- a/website/docs/d/kendra_faq.html.markdown
+++ b/website/docs/d/kendra_faq.html.markdown
@@ -21,14 +21,14 @@ data "aws_kendra_faq" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `faq_id` - (Required) Identifier of the FAQ.
 * `index_id` - (Required) Identifier of the index that contains the FAQ.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all of the arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the FAQ.
 * `created_at` - Unix datetime that the faq was created.
diff --git a/website/docs/d/kendra_index.html.markdown b/website/docs/d/kendra_index.html.markdown
index cd8ad09af06..878c9fca58b 100644
--- a/website/docs/d/kendra_index.html.markdown
+++ b/website/docs/d/kendra_index.html.markdown
@@ -20,13 +20,13 @@ data "aws_kendra_index" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `id` - (Required) Returns information on a specific Index by id.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all of the arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the Index.
 * `capacity_units` - Block that sets the number of additional document storage and query capacity units that should be used by the index. Documented below.
diff --git a/website/docs/d/kendra_query_suggestions_block_list.html.markdown b/website/docs/d/kendra_query_suggestions_block_list.html.markdown
index 76dd2be7944..236d259960b 100644
--- a/website/docs/d/kendra_query_suggestions_block_list.html.markdown
+++ b/website/docs/d/kendra_query_suggestions_block_list.html.markdown
@@ -21,14 +21,14 @@ data "aws_kendra_query_suggestions_block_list" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `index_id` - (Required) Identifier of the index that contains the block list.
 * `query_suggestions_block_list_id` - (Required) Identifier of the block list.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all of the arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the block list.
 * `created_at` - Date-time a block list was created.
diff --git a/website/docs/d/kendra_thesaurus.html.markdown b/website/docs/d/kendra_thesaurus.html.markdown
index 662819ee7a8..a5c97ab0d17 100644
--- a/website/docs/d/kendra_thesaurus.html.markdown
+++ b/website/docs/d/kendra_thesaurus.html.markdown
@@ -21,14 +21,14 @@ data "aws_kendra_thesaurus" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `index_id` - (Required) Identifier of the index that contains the Thesaurus.
 * `thesaurus_id` - (Required) Identifier of the Thesaurus.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all of the arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the Thesaurus.
 * `created_at` - Unix datetime that the Thesaurus was created.
diff --git a/website/docs/d/key_pair.html.markdown b/website/docs/d/key_pair.html.markdown
index 446e9570423..be83318ece0 100644
--- a/website/docs/d/key_pair.html.markdown
+++ b/website/docs/d/key_pair.html.markdown
@@ -51,14 +51,14 @@ whose data will be exported as attributes.
 
 ### filter Configuration Block
 
-The following arguments are supported by the `filter` configuration block:
+The `filter` configuration block supports the following arguments:
 
 * `name` - (Required) Name of the filter field. Valid values can be found in the [EC2 DescribeKeyPairs API Reference](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeKeyPairs.html).
 * `values` - (Required) Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - ID of the Key Pair.
 * `arn` - ARN of the Key Pair.
diff --git a/website/docs/d/kinesis_firehose_delivery_stream.html.markdown b/website/docs/d/kinesis_firehose_delivery_stream.html.markdown
index 96c8285573a..62fc5ae8085 100644
--- a/website/docs/d/kinesis_firehose_delivery_stream.html.markdown
+++ b/website/docs/d/kinesis_firehose_delivery_stream.html.markdown
@@ -24,7 +24,7 @@ data "aws_kinesis_firehose_delivery_stream" "stream" {
 
 * `name` - (Required) Name of the Kinesis Stream.
 
-## Attributes Reference
+## Attribute Reference
 
 `id` is set to the ARN of the Kinesis Stream. In addition, the following attributes
 are exported:
diff --git a/website/docs/d/kinesis_stream.html.markdown b/website/docs/d/kinesis_stream.html.markdown
index be699476970..043e4654ad4 100644
--- a/website/docs/d/kinesis_stream.html.markdown
+++ b/website/docs/d/kinesis_stream.html.markdown
@@ -25,7 +25,7 @@ data "aws_kinesis_stream" "stream" {
 
 * `name` - (Required) Name of the Kinesis Stream.
 
-## Attributes Reference
+## Attribute Reference
 
 `id` is set to the ARN of the Kinesis Stream. In addition, the following attributes
 are exported:
diff --git a/website/docs/d/kinesis_stream_consumer.html.markdown b/website/docs/d/kinesis_stream_consumer.html.markdown
index 4a3aa8e41e3..a0fb9519ef8 100644
--- a/website/docs/d/kinesis_stream_consumer.html.markdown
+++ b/website/docs/d/kinesis_stream_consumer.html.markdown
@@ -27,9 +27,9 @@ data "aws_kinesis_stream_consumer" "example" {
 * `name` - (Optional) Name of the stream consumer.
 * `stream_arn` - (Required) ARN of the data stream the consumer is registered with.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `creation_timestamp` - Approximate timestamp in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8) of when the stream consumer was created.
 * `id` - ARN of the stream consumer.
diff --git a/website/docs/d/kms_alias.html.markdown b/website/docs/d/kms_alias.html.markdown
index 2f26de98489..a7af555d2f0 100644
--- a/website/docs/d/kms_alias.html.markdown
+++ b/website/docs/d/kms_alias.html.markdown
@@ -24,7 +24,9 @@ data "aws_kms_alias" "s3" {
 
 * `name` - (Required) Display name of the alias. The name must start with the word "alias" followed by a forward slash (alias/)
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name(ARN) of the key alias.
 * `id` - Amazon Resource Name(ARN) of the key alias.
diff --git a/website/docs/d/kms_ciphertext.html.markdown b/website/docs/d/kms_ciphertext.html.markdown
index c8fbcad15ce..fbdca38613f 100644
--- a/website/docs/d/kms_ciphertext.html.markdown
+++ b/website/docs/d/kms_ciphertext.html.markdown
@@ -38,13 +38,13 @@ EOF
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `plaintext` - (Required) Data to be encrypted. Note that this may show up in logs, and it will be stored in the state file.
 * `key_id` - (Required) Globally unique key ID for the customer master key.
 * `context` - (Optional) An optional mapping that makes up the encryption context.
 
-## Attributes Reference
+## Attribute Reference
 
 All of the argument attributes are also exported as result attributes.
 
diff --git a/website/docs/d/kms_custom_key_store.html.markdown b/website/docs/d/kms_custom_key_store.html.markdown
index dfc03248357..53e3883f19b 100644
--- a/website/docs/d/kms_custom_key_store.html.markdown
+++ b/website/docs/d/kms_custom_key_store.html.markdown
@@ -25,7 +25,9 @@ data "aws_kms_custom_key_store" "keystore" {
 * `custom_key_store_id` - (Optional) The ID for the custom key store.
 * `custom_key_store_name` - (Optional) The user-specified friendly name for the custom key store.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - The ID for the custom key store.
 * `cloudhsm_cluster_id` - ID for the CloudHSM cluster that is associated with the custom key store.
diff --git a/website/docs/d/kms_key.html.markdown b/website/docs/d/kms_key.html.markdown
index 7ac9deab787..e8adeffb902 100644
--- a/website/docs/d/kms_key.html.markdown
+++ b/website/docs/d/kms_key.html.markdown
@@ -42,7 +42,9 @@ data "aws_kms_key" "by_key_arn" {
     * Alias ARN: E.g.: `arn:aws:kms:us-east-1:111122223333:alias/my-key`
 * `grant_tokens` - (Optional) List of grant tokens
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `id`: The globally unique identifier for the key
 * `arn`: The ARN of the key
diff --git a/website/docs/d/kms_public_key.html.markdown b/website/docs/d/kms_public_key.html.markdown
index b4a792862c2..1442c0256fc 100644
--- a/website/docs/d/kms_public_key.html.markdown
+++ b/website/docs/d/kms_public_key.html.markdown
@@ -32,7 +32,7 @@ data "aws_kms_public_key" "by_key_arn" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `key_id` - (Required) Key identifier which can be one of the following format:
     * Key ID. E.g - `1234abcd-12ab-34cd-56ef-1234567890ab`
@@ -41,9 +41,9 @@ The following arguments are supported:
     * Alias ARN - E.g. - `arn:aws:kms:us-east-1:111122223333:alias/my-key`
 * `grant_tokens` - (Optional) List of grant tokens
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - Key ARN of the asymmetric CMK from which the public key was downloaded.
 * `customer_master_key_spec` - Type of the public key that was downloaded.
diff --git a/website/docs/d/kms_secret.html.markdown b/website/docs/d/kms_secret.html.markdown
index d5313bfd612..09d27e28840 100644
--- a/website/docs/d/kms_secret.html.markdown
+++ b/website/docs/d/kms_secret.html.markdown
@@ -8,4 +8,4 @@ description: |-
 
 # Data Source: aws_kms_secret
 
-!> **WARNING:** This data source was removed in version 2.0.0 of the Terraform AWS Provider. You can migrate existing configurations to the [`aws_kms_secrets` data source](/docs/providers/aws/d/kms_secrets.html) following instructions available in the [Version 2 Upgrade Guide](/docs/providers/aws/guides/version-2-upgrade.html#data-source-aws_kms_secret).
+!> **WARNING:** This data source was removed in version 2.0.0 of the Terraform AWS Provider. You can migrate existing configurations to the [`aws_kms_secrets` data source](/docs/providers/aws/d/kms_secrets.html) following instructions available in the [Version 2 Upgrade Guide](../guides/version-2-upgrade.html#data-source-aws_kms_secret).
diff --git a/website/docs/d/kms_secrets.html.markdown b/website/docs/d/kms_secrets.html.markdown
index 52acd42c184..a5bff5ed119 100644
--- a/website/docs/d/kms_secrets.html.markdown
+++ b/website/docs/d/kms_secrets.html.markdown
@@ -19,11 +19,11 @@ If you do not already have a `CiphertextBlob` from encrypting a KMS secret, you
 -> If you have a newline character at the end of your file, it will be decrypted with this newline character intact. For most use cases this is undesirable and leads to incorrect passwords or invalid values, as well as possible changes in the plan. Be sure to use `echo -n` if necessary.
 -> If you are using asymmetric keys ensure you are using the right encryption algorithm when you encrypt and decrypt else you will get IncorrectKeyException during the decrypt phase.
 
-```sh
-$ echo -n 'master-password' > plaintext-password
-$ aws kms encrypt --key-id ab123456-c012-4567-890a-deadbeef123 --plaintext fileb://plaintext-password --encryption-context foo=bar --output text --query CiphertextBlob
+```console
+% echo -n 'master-password' > plaintext-password
+% aws kms encrypt --key-id ab123456-c012-4567-890a-deadbeef123 --plaintext fileb://plaintext-password --encryption-context foo=bar --output text --query CiphertextBlob
 AQECAHgaPa0J8WadplGCqqVAr4HNvDaFSQ+NaiwIBhmm6qDSFwAAAGIwYAYJKoZIhvcNAQcGoFMwUQIBADBMBgkqhkiG9w0BBwEwHgYJYIZIAWUDBAEuMBEEDI+LoLdvYv8l41OhAAIBEIAfx49FFJCLeYrkfMfAw6XlnxP23MmDBdqP8dPp28OoAQ==
-$ aws kms encrypt --key-id ab123456-c012-4567-890a-deadbeef123 --plaintext fileb://plaintext-password --encryption-algorithm RSAES_OAEP_SHA_256 --output text --query CiphertextBlob
+% aws kms encrypt --key-id ab123456-c012-4567-890a-deadbeef123 --plaintext fileb://plaintext-password --encryption-algorithm RSAES_OAEP_SHA_256 --output text --query CiphertextBlob
 AQECAHgaPa0J8WadplGCqqVAr4HNvDaFSQ+NaiwIBhmm6qDSFwAAAGIwYAYJKoZIhvcNAQcGoFMwUQIBADBMBgkqhkiG9w0BBwEwHgYJYIZIAWUDBAEuMBEEDI+LoLdvYv8l41OhAAIBEIAfx49FFJCLeYrkfMfAw6XlnxP23MmDBdqP8dPp28OoAQ==
 ```
 
@@ -68,7 +68,7 @@ data "aws_kms_secrets" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `secret` - (Required) One or more encrypted payload definitions from the KMS service. See the Secret Definitions below.
 
@@ -86,8 +86,8 @@ Each `secret` supports the following arguments:
 For more information on `context` and `grant_tokens` see the [KMS
 Concepts](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html)
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `plaintext` - Map containing each `secret` `name` as the key with its decrypted plaintext value
diff --git a/website/docs/d/lakeformation_data_lake_settings.html.markdown b/website/docs/d/lakeformation_data_lake_settings.html.markdown
index 58a96297cda..1a1cdaef72a 100644
--- a/website/docs/d/lakeformation_data_lake_settings.html.markdown
+++ b/website/docs/d/lakeformation_data_lake_settings.html.markdown
@@ -24,11 +24,12 @@ The following arguments are optional:
 
 * `catalog_id` – (Optional) Identifier for the Data Catalog. By default, the account ID.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to arguments above, the following attributes are exported.
+This data source exports the following attributes in addition to the arguments above:
 
 * `admins` – List of ARNs of AWS Lake Formation principals (IAM users or roles).
+* `read_only_admins` – List of ARNs of AWS Lake Formation principals (IAM users or roles) with only view access to the resources.
 * `create_database_default_permissions` - Up to three configuration blocks of principal permissions for default create database permissions. Detailed below.
 * `create_table_default_permissions` - Up to three configuration blocks of principal permissions for default create table permissions. Detailed below.
 * `trusted_resource_owners` – List of the resource-owning account IDs that the caller's account can use to share their user access details (user ARNs).
diff --git a/website/docs/d/lakeformation_permissions.html.markdown b/website/docs/d/lakeformation_permissions.html.markdown
index 27be66d5ec3..ed3bbbab651 100644
--- a/website/docs/d/lakeformation_permissions.html.markdown
+++ b/website/docs/d/lakeformation_permissions.html.markdown
@@ -150,7 +150,7 @@ The following arguments are optional:
 * `column_names` - (Optional) Set of column names for the table. At least one of `column_names` or `excluded_column_names` is required.
 * `excluded_column_names` - (Optional) Set of column names for the table to exclude. At least one of `column_names` or `excluded_column_names` is required.
 
-## Attributes Reference
+## Attribute Reference
 
 In addition to the above arguments, the following attribute is exported:
 
diff --git a/website/docs/d/lakeformation_resource.html.markdown b/website/docs/d/lakeformation_resource.html.markdown
index 3103ddeaae4..8a22e038acd 100644
--- a/website/docs/d/lakeformation_resource.html.markdown
+++ b/website/docs/d/lakeformation_resource.html.markdown
@@ -22,9 +22,9 @@ data "aws_lakeformation_resource" "example" {
 
 * `arn` – (Required) ARN of the resource, an S3 path.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `last_modified` - Date and time the resource was last modified in [RFC 3339 format](https://tools.ietf.org/html/rfc3339#section-5.8).
 * `role_arn` – Role that the resource was registered with.
diff --git a/website/docs/d/lambda_alias.html.markdown b/website/docs/d/lambda_alias.html.markdown
index d8a75cffa7b..209f7ee7e02 100644
--- a/website/docs/d/lambda_alias.html.markdown
+++ b/website/docs/d/lambda_alias.html.markdown
@@ -21,14 +21,14 @@ data "aws_lambda_alias" "production" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `function_name` - (Required) Name of the aliased Lambda function.
 * `name` - (Required) Name of the Lambda alias.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN identifying the Lambda function alias.
 * `description` - Description of alias.
diff --git a/website/docs/d/lambda_code_signing_config.html.markdown b/website/docs/d/lambda_code_signing_config.html.markdown
index de988cacd0e..e104aedd4e7 100644
--- a/website/docs/d/lambda_code_signing_config.html.markdown
+++ b/website/docs/d/lambda_code_signing_config.html.markdown
@@ -22,13 +22,13 @@ data "aws_lambda_code_signing_config" "existing_csc" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `arn` - (Required) ARN of the code signing configuration.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `allowed_publishers` - List of allowed publishers as signing profiles for this code signing configuration.
 * `config_id` - Unique identifier for the code signing configuration.
diff --git a/website/docs/d/lambda_function.html.markdown b/website/docs/d/lambda_function.html.markdown
index a22b44570a0..090b14bef67 100644
--- a/website/docs/d/lambda_function.html.markdown
+++ b/website/docs/d/lambda_function.html.markdown
@@ -24,14 +24,14 @@ data "aws_lambda_function" "existing" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `function_name` - (Required) Name of the lambda function.
 * `qualifier` - (Optional) Alias name or version number of the lambda functionE.g., `$LATEST`, `my-alias`, or `1`. When not included: the data source resolves to the most recent published version; if no published version exists: it resolves to the most recent unpublished version.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `architectures` - Instruction set architecture for the Lambda function.
 * `arn` - Unqualified (no `:QUALIFIER` or `:VERSION` suffix) ARN identifying your Lambda Function. See also `qualified_arn`.
diff --git a/website/docs/d/lambda_function_url.html.markdown b/website/docs/d/lambda_function_url.html.markdown
index b409c8d2f06..bb9bc1bf91f 100644
--- a/website/docs/d/lambda_function_url.html.markdown
+++ b/website/docs/d/lambda_function_url.html.markdown
@@ -24,14 +24,14 @@ data "aws_lambda_function_url" "existing" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
-* `function_name` - (Required) he name (or ARN) of the Lambda function.
+* `function_name` - (Required) The name (or ARN) of the Lambda function.
 * `qualifier` - (Optional) Alias name or `"$LATEST"`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `authorization_type` - Type of authentication that the function URL uses.
 * `cors` - The [cross-origin resource sharing (CORS)](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS) settings for the function URL. See the [`aws_lambda_function_url` resource](/docs/providers/aws/r/lambda_function_url.html) documentation for more details.
diff --git a/website/docs/d/lambda_functions.html.markdown b/website/docs/d/lambda_functions.html.markdown
index 5ccfc19ca91..1dcff5e493a 100644
--- a/website/docs/d/lambda_functions.html.markdown
+++ b/website/docs/d/lambda_functions.html.markdown
@@ -20,9 +20,9 @@ data "aws_lambda_functions" "all" {}
 
 The resource does not support any arguments.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `function_names` - A list of Lambda Function names.
 * `function_arns` - A list of Lambda Function ARNs.
diff --git a/website/docs/d/lambda_invocation.html.markdown b/website/docs/d/lambda_invocation.html.markdown
index e05dbc07d33..6266af78b47 100644
--- a/website/docs/d/lambda_invocation.html.markdown
+++ b/website/docs/d/lambda_invocation.html.markdown
@@ -40,6 +40,8 @@ output "result_entry" {
 * `qualifier` - (Optional) Qualifier (a.k.a version) of the lambda function. Defaults
  to `$LATEST`.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `result` - String result of the lambda function invocation.
diff --git a/website/docs/d/lambda_layer_version.html.markdown b/website/docs/d/lambda_layer_version.html.markdown
index da9a5f79d7b..afa041d4af8 100644
--- a/website/docs/d/lambda_layer_version.html.markdown
+++ b/website/docs/d/lambda_layer_version.html.markdown
@@ -24,16 +24,16 @@ data "aws_lambda_layer_version" "existing" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `layer_name` - (Required) Name of the lambda layer.
 * `version` - (Optional) Specific layer version. Conflicts with `compatible_runtime` and `compatible_architecture`. If omitted, the latest available layer version will be used.
 * `compatible_runtime` (Optional) Specific runtime the layer version must support. Conflicts with `version`. If specified, the latest available layer version supporting the provided runtime will be used.
 * `compatible_architecture` (Optional) Specific architecture the layer version could support. Conflicts with `version`. If specified, the latest available layer version supporting the provided architecture will be used.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `description` - Description of the specific Lambda Layer version.
 * `license_info` - License info associated with the specific Lambda Layer version.
diff --git a/website/docs/d/launch_configuration.html.markdown b/website/docs/d/launch_configuration.html.markdown
index 1570179bc7d..b88554f70cc 100644
--- a/website/docs/d/launch_configuration.html.markdown
+++ b/website/docs/d/launch_configuration.html.markdown
@@ -20,13 +20,13 @@ data "aws_launch_configuration" "ubuntu" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `name` - (Required) Name of the launch configuration.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - ID of the launch configuration.
 * `arn` - Amazon Resource Name of the launch configuration.
diff --git a/website/docs/d/launch_template.html.markdown b/website/docs/d/launch_template.html.markdown
index 0ec04fc86e6..e6eaac92e73 100644
--- a/website/docs/d/launch_template.html.markdown
+++ b/website/docs/d/launch_template.html.markdown
@@ -31,7 +31,7 @@ data "aws_launch_template" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `filter` - (Optional) Configuration block(s) for filtering. Detailed below.
 * `id` - (Optional) ID of the specific launch template to retrieve.
@@ -40,14 +40,14 @@ The following arguments are supported:
 
 ### filter Configuration Block
 
-The following arguments are supported by the `filter` configuration block:
+The `filter` configuration block supports the following arguments:
 
 * `name` - (Required) Name of the filter field. Valid values can be found in the [EC2 DescribeLaunchTemplates API Reference](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeLaunchTemplates.html).
 * `values` - (Required) Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - ID of the launch template.
 
diff --git a/website/docs/d/lb.html.markdown b/website/docs/d/lb.html.markdown
index b1caf17c182..b9e9f101cdf 100644
--- a/website/docs/d/lb.html.markdown
+++ b/website/docs/d/lb.html.markdown
@@ -37,7 +37,7 @@ data "aws_lb" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `arn` - (Optional) Full ARN of the load balancer.
 * `name` - (Optional) Unique name of the load balancer.
@@ -45,7 +45,7 @@ The following arguments are supported:
 
 ~> **NOTE:** When both `arn` and `name` are specified, `arn` takes precedence. `tags` has lowest precedence.
 
-## Attributes Reference
+## Attribute Reference
 
 See the [LB Resource](/docs/providers/aws/r/lb.html) for details on the
 returned attributes - they are identical.
diff --git a/website/docs/d/lb_hosted_zone_id.html.markdown b/website/docs/d/lb_hosted_zone_id.html.markdown
index 36e0916e3d8..f658d16a39e 100644
--- a/website/docs/d/lb_hosted_zone_id.html.markdown
+++ b/website/docs/d/lb_hosted_zone_id.html.markdown
@@ -35,6 +35,8 @@ resource "aws_route53_record" "www" {
 
 * `load_balancer_type` - (Optional) Type of load balancer to create. Possible values are `application` or `network`. The default value is `application`.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - ID of the AWS ELB HostedZoneId in the selected region.
diff --git a/website/docs/d/lb_listener.html.markdown b/website/docs/d/lb_listener.html.markdown
index ec9ca46b4ff..65c46159fa9 100644
--- a/website/docs/d/lb_listener.html.markdown
+++ b/website/docs/d/lb_listener.html.markdown
@@ -41,13 +41,13 @@ data "aws_lb_listener" "selected443" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `arn` - (Optional) ARN of the listener. Required if `load_balancer_arn` and `port` is not set.
 * `load_balancer_arn` - (Optional) ARN of the load balancer. Required if `arn` is not set.
 * `port` - (Optional) Port of the listener. Required if `arn` is not set.
 
-## Attributes Reference
+## Attribute Reference
 
 See the [LB Listener Resource](/docs/providers/aws/r/lb_listener.html) for details on the returned attributes - they are identical.
 
diff --git a/website/docs/d/lb_target_group.html.markdown b/website/docs/d/lb_target_group.html.markdown
index bd18a997b21..01a98e5ddae 100644
--- a/website/docs/d/lb_target_group.html.markdown
+++ b/website/docs/d/lb_target_group.html.markdown
@@ -37,7 +37,7 @@ data "aws_lb_target_group" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `arn` - (Optional) Full ARN of the target group.
 * `name` - (Optional) Unique name of the target group.
@@ -45,7 +45,7 @@ The following arguments are supported:
 
 ~> **NOTE:** When both `arn` and `name` are specified, `arn` takes precedence. `tags` has the lowest precedence.
 
-## Attributes Reference
+## Attribute Reference
 
 See the [LB Target Group Resource](/docs/providers/aws/r/lb_target_group.html) for details
 on the returned attributes - they are identical.
diff --git a/website/docs/d/lbs.html.markdown b/website/docs/d/lbs.html.markdown
index 88a5a43b87e..b4ceb7841be 100644
--- a/website/docs/d/lbs.html.markdown
+++ b/website/docs/d/lbs.html.markdown
@@ -30,8 +30,8 @@ The following arguments are optional:
 * `tags` - (Optional) Map of tags, each pair of which must exactly match
    a pair on the desired Load Balancers.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arns` - Set of Load Balancer ARNs.
diff --git a/website/docs/d/lex_bot.html.markdown b/website/docs/d/lex_bot.html.markdown
index b7213cea252..d894f1b43b7 100644
--- a/website/docs/d/lex_bot.html.markdown
+++ b/website/docs/d/lex_bot.html.markdown
@@ -21,14 +21,14 @@ data "aws_lex_bot" "order_flowers_bot" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `name` - (Required) Name of the bot. The name is case sensitive.
 * `version` - (Optional) Version or alias of the bot.
 
-## Attributes Reference
+## Attribute Reference
 
-The following attributes are exported.
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the bot.
 * `checksum` - Checksum of the bot used to identify a specific revision of the bot's `$LATEST` version.
diff --git a/website/docs/d/lex_bot_alias.html.markdown b/website/docs/d/lex_bot_alias.html.markdown
index fde54f6411b..f21e93d8823 100644
--- a/website/docs/d/lex_bot_alias.html.markdown
+++ b/website/docs/d/lex_bot_alias.html.markdown
@@ -21,14 +21,14 @@ data "aws_lex_bot_alias" "order_flowers_prod" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `bot_name` - (Required) Name of the bot.
 * `name` - (Required) Name of the bot alias. The name is case sensitive.
 
-## Attributes Reference
+## Attribute Reference
 
-The following attributes are exported.
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the bot alias.
 * `bot_name` - Name of the bot.
diff --git a/website/docs/d/lex_intent.html.markdown b/website/docs/d/lex_intent.html.markdown
index 4e801d5bcfc..df4d6366655 100644
--- a/website/docs/d/lex_intent.html.markdown
+++ b/website/docs/d/lex_intent.html.markdown
@@ -21,14 +21,14 @@ data "aws_lex_intent" "order_flowers" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `name` - (Required) Name of the intent. The name is case sensitive.
 * `version` - (Optional) Version of the intent.
 
-## Attributes Reference
+## Attribute Reference
 
-The following attributes are exported.
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the Lex intent.
 * `checksum` - Checksum identifying the version of the intent that was created. The checksum is not
diff --git a/website/docs/d/lex_slot_type.html.markdown b/website/docs/d/lex_slot_type.html.markdown
index 049648fd6d7..a2a71567cae 100644
--- a/website/docs/d/lex_slot_type.html.markdown
+++ b/website/docs/d/lex_slot_type.html.markdown
@@ -21,14 +21,14 @@ data "aws_lex_slot_type" "flower_types" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `name` - (Required) Name of the slot type. The name is case sensitive.
 * `version` - (Optional) Version of the slot type.
 
-## Attributes Reference
+## Attribute Reference
 
-The following attributes are exported.
+This data source exports the following attributes in addition to the arguments above:
 
 * `checksum` - Checksum identifying the version of the slot type that was created. The checksum is
 not included as an argument because the resource will add it automatically when updating the slot type.
diff --git a/website/docs/d/licensemanager_grants.html.markdown b/website/docs/d/licensemanager_grants.html.markdown
index 8369ffc24f8..221741e1be6 100644
--- a/website/docs/d/licensemanager_grants.html.markdown
+++ b/website/docs/d/licensemanager_grants.html.markdown
@@ -49,6 +49,8 @@ data "aws_licensemanager_grants" "selected" {
 
 * `values` - (Required) Set of values that are accepted for the given field.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `arns` - List of all the license grant ARNs found.
diff --git a/website/docs/d/licensemanager_received_license.html.markdown b/website/docs/d/licensemanager_received_license.html.markdown
index 102fd521bde..5083863c091 100644
--- a/website/docs/d/licensemanager_received_license.html.markdown
+++ b/website/docs/d/licensemanager_received_license.html.markdown
@@ -24,7 +24,9 @@ data "aws_licensemanager_received_license" "test" {
 
 * `license_arn` - (Required) The ARN of the received license you want data for.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - The received license ARN (Same as: `license_arn`).
 * `beneficiary` - Granted license beneficiary. This is in the form of the ARN of the root user of the account.
diff --git a/website/docs/d/licensemanager_received_licenses.html.markdown b/website/docs/d/licensemanager_received_licenses.html.markdown
index 6a36d53e184..f59104c7fc3 100644
--- a/website/docs/d/licensemanager_received_licenses.html.markdown
+++ b/website/docs/d/licensemanager_received_licenses.html.markdown
@@ -47,6 +47,8 @@ data "aws_licensemanager_received_licenses" "selected" {
 
 * `values` - (Required) Set of values that are accepted for the given field.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `arns` - List of all the license ARNs found.
diff --git a/website/docs/d/location_geofence_collection.html.markdown b/website/docs/d/location_geofence_collection.html.markdown
index a734578369a..bb75b028d72 100644
--- a/website/docs/d/location_geofence_collection.html.markdown
+++ b/website/docs/d/location_geofence_collection.html.markdown
@@ -26,9 +26,9 @@ The following arguments are required:
 
 * `collection_name` - (Required) Name of the geofence collection.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `collection_arn` - ARN for the geofence collection resource. Used when you need to specify a resource across all AWS.
 * `create_time` - Timestamp for when the geofence collection resource was created in ISO 8601 format.
diff --git a/website/docs/d/location_map.html.markdown b/website/docs/d/location_map.html.markdown
index 296e39f46c9..3b7eedc6438 100644
--- a/website/docs/d/location_map.html.markdown
+++ b/website/docs/d/location_map.html.markdown
@@ -24,6 +24,8 @@ data "aws_location_map" "example" {
 
 ## Attribute Reference
 
+This data source exports the following attributes in addition to the arguments above:
+
 * `configuration` - List of configurations that specify the map tile style selected from a partner data provider.
     * `style` - The map style selected from an available data provider.
 * `create_time` - Timestamp for when the map resource was created in ISO 8601 format.
diff --git a/website/docs/d/location_place_index.html.markdown b/website/docs/d/location_place_index.html.markdown
index 798bd3d28ba..7b62544bd90 100644
--- a/website/docs/d/location_place_index.html.markdown
+++ b/website/docs/d/location_place_index.html.markdown
@@ -24,6 +24,8 @@ data "aws_location_place_index" "example" {
 
 ## Attribute Reference
 
+This data source exports the following attributes in addition to the arguments above:
+
 * `create_time` - Timestamp for when the place index resource was created in ISO 8601 format.
 * `data_source` - Data provider of geospatial data.
 * `data_source_configuration` - List of configurations that specify data storage option for requesting Places.
diff --git a/website/docs/d/location_route_calculator.html.markdown b/website/docs/d/location_route_calculator.html.markdown
index d5587910578..36ef65df13c 100644
--- a/website/docs/d/location_route_calculator.html.markdown
+++ b/website/docs/d/location_route_calculator.html.markdown
@@ -22,7 +22,9 @@ data "aws_location_route_calculator" "example" {
 
 * `calculator_name` - (Required) Name of the route calculator resource.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `calculator_arn` - ARN for the Route calculator resource. Use the ARN when you specify a resource across AWS.
 * `create_time` - Timestamp for when the route calculator resource was created in ISO 8601 format.
diff --git a/website/docs/d/location_tracker.html.markdown b/website/docs/d/location_tracker.html.markdown
index 213e130cf0a..ab3740f9310 100644
--- a/website/docs/d/location_tracker.html.markdown
+++ b/website/docs/d/location_tracker.html.markdown
@@ -24,6 +24,8 @@ data "aws_location_tracker" "example" {
 
 ## Attribute Reference
 
+This data source exports the following attributes in addition to the arguments above:
+
 * `create_time` - Timestamp for when the tracker resource was created in ISO 8601 format.
 * `description` - Optional description for the tracker resource.
 * `kms_key_id` - Key identifier for an AWS KMS customer managed key assigned to the Amazon Location resource.
diff --git a/website/docs/d/location_tracker_association.html.markdown b/website/docs/d/location_tracker_association.html.markdown
index e7ba80c4d9e..8c288471cd5 100644
--- a/website/docs/d/location_tracker_association.html.markdown
+++ b/website/docs/d/location_tracker_association.html.markdown
@@ -28,6 +28,6 @@ The following arguments are required:
 * `consumer_arn` - (Required) ARN of the geofence collection associated to tracker resource.
 * `tracker_name` - (Required) Name of the tracker resource associated with a geofence collection.
 
-## Attributes Reference
+## Attribute Reference
 
-No additional attributes are exported.
+This data source exports no additional attributes.
diff --git a/website/docs/d/location_tracker_associations.html.markdown b/website/docs/d/location_tracker_associations.html.markdown
index 5d9079dbdf0..20e605fc16d 100644
--- a/website/docs/d/location_tracker_associations.html.markdown
+++ b/website/docs/d/location_tracker_associations.html.markdown
@@ -26,8 +26,8 @@ The following arguments are required:
 
 * `tracker_name` - (Required) Name of the tracker resource associated with a geofence collection.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `consumer_arns` - List of geofence collection ARNs associated to the tracker resource.
diff --git a/website/docs/d/media_convert_queue.html.markdown b/website/docs/d/media_convert_queue.html.markdown
new file mode 100644
index 00000000000..318f561b6bb
--- /dev/null
+++ b/website/docs/d/media_convert_queue.html.markdown
@@ -0,0 +1,32 @@
+---
+subcategory: "Elemental MediaConvert"
+layout: "aws"
+page_title: "AWS: aws_media_convert_queue"
+description: |-
+  Retrieve information about a AWS Elemental MediaConvert Queue.
+---
+
+# Resource: aws_media_convert_queue
+
+Retrieve information about a AWS Elemental MediaConvert Queue.
+
+## Example Usage
+
+```terraform
+data "aws_media_convert_queue" "example" {
+  id = "tf-example-queue"
+}
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `id` - (Required) Unique identifier of the queue. The same as `name`.
+
+## Attributes Reference
+
+* `arn` - The Arn of the queue.
+* `name` - The same as `id`.
+* `status` - The status of the queue.
+* `tags` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
diff --git a/website/docs/d/memorydb_acl.html.markdown b/website/docs/d/memorydb_acl.html.markdown
index 87287d306ef..56c0e4def26 100644
--- a/website/docs/d/memorydb_acl.html.markdown
+++ b/website/docs/d/memorydb_acl.html.markdown
@@ -24,9 +24,9 @@ The following arguments are required:
 
 * `name` - (Required) Name of the ACL.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - Name of the ACL.
 * `arn` - ARN of the ACL.
diff --git a/website/docs/d/memorydb_cluster.html.markdown b/website/docs/d/memorydb_cluster.html.markdown
index bd24d05604d..f9294037af4 100644
--- a/website/docs/d/memorydb_cluster.html.markdown
+++ b/website/docs/d/memorydb_cluster.html.markdown
@@ -24,9 +24,9 @@ The following arguments are required:
 
 * `name` - (Required) Name of the cluster.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - Same as `name`.
 * `arn` - ARN of the cluster.
diff --git a/website/docs/d/memorydb_parameter_group.html.markdown b/website/docs/d/memorydb_parameter_group.html.markdown
index 51392f90832..c073c18a12b 100644
--- a/website/docs/d/memorydb_parameter_group.html.markdown
+++ b/website/docs/d/memorydb_parameter_group.html.markdown
@@ -24,9 +24,9 @@ The following arguments are required:
 
 * `name` - (Required) Name of the parameter group.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - Name of the parameter group.
 * `arn` - ARN of the parameter group.
diff --git a/website/docs/d/memorydb_snapshot.html.markdown b/website/docs/d/memorydb_snapshot.html.markdown
index 4083d149fb9..2c2a63e73c3 100644
--- a/website/docs/d/memorydb_snapshot.html.markdown
+++ b/website/docs/d/memorydb_snapshot.html.markdown
@@ -24,9 +24,9 @@ The following arguments are required:
 
 * `name` - (Required) Name of the snapshot.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - Name of the snapshot.
 * `arn` - ARN of the snapshot.
diff --git a/website/docs/d/memorydb_subnet_group.html.markdown b/website/docs/d/memorydb_subnet_group.html.markdown
index 3f22b65ad89..e0f7fec956d 100644
--- a/website/docs/d/memorydb_subnet_group.html.markdown
+++ b/website/docs/d/memorydb_subnet_group.html.markdown
@@ -24,9 +24,9 @@ The following arguments are required:
 
 * `name` - (Required) Name of the subnet group.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - Name of the subnet group.
 * `arn` - ARN of the subnet group.
diff --git a/website/docs/d/memorydb_user.html.markdown b/website/docs/d/memorydb_user.html.markdown
index 8dc389c2798..616e7ca0a21 100644
--- a/website/docs/d/memorydb_user.html.markdown
+++ b/website/docs/d/memorydb_user.html.markdown
@@ -24,9 +24,9 @@ The following arguments are required:
 
 * `user_name` - (Required) Name of the user.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - Name of the user.
 * `access_string` - Access permissions string used for this user.
diff --git a/website/docs/d/mq_broker.html.markdown b/website/docs/d/mq_broker.html.markdown
index 22d5a8b8934..b65e95844ee 100644
--- a/website/docs/d/mq_broker.html.markdown
+++ b/website/docs/d/mq_broker.html.markdown
@@ -34,12 +34,12 @@ data "aws_mq_broker" "by_name" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `broker_id` - (Optional) Unique id of the mq broker.
 * `broker_name` - (Optional) Unique name of the mq broker.
 
-## Attributes Reference
+## Attribute Reference
 
 See the [`aws_mq_broker` resource](/docs/providers/aws/r/mq_broker.html) for details on the returned attributes.
 They are identical except for user password, which is not returned when describing broker.
diff --git a/website/docs/d/mq_broker_instance_type_offerings.html.markdown b/website/docs/d/mq_broker_instance_type_offerings.html.markdown
new file mode 100644
index 00000000000..05589b69bd8
--- /dev/null
+++ b/website/docs/d/mq_broker_instance_type_offerings.html.markdown
@@ -0,0 +1,62 @@
+---
+subcategory: "MQ"
+layout: "aws"
+page_title: "AWS: aws_mq_broker_instance_type_offerings"
+description: |-
+  Provides a MQ Broker Instance Offerings data source.
+---
+
+# Data Source: aws_mq_broker_instance_type_offerings
+
+Provides information about a MQ Broker Instance Offerings.
+
+## Example Usage
+
+```terraform
+data "aws_mq_broker_instance_type_offerings" "empty" {}
+
+data "aws_mq_broker_instance_type_offerings" "engine" {
+  engine_type = "ACTIVEMQ"
+}
+
+data "aws_mq_broker_instance_type_offerings" "storage" {
+  storage_type = "EBS"
+}
+
+data "aws_mq_broker_instance_type_offerings" "instance" {
+  host_instance_type = "mq.m5.large"
+}
+
+data "aws_mq_broker_instance_type_offerings" "all" {
+  host_instance_type = "mq.m5.large"
+  storage_type       = "EBS"
+  engine_type        = "ACTIVEMQ"
+}
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `engine_type` - (Optional) Filter response by engine type.
+* `host_instance_type` - (Optional) Filter response by host instance type.
+* `storage_type` - (Optional) Filter response by storage type.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `broker_instance_options` -  Option for host instance type. See Broker Instance Options below.
+
+### Broker Instance Options
+
+* `availability_zones` - List of available AZs. See Availability Zones. below
+* `engine_type` - Broker's engine type.
+* `host_instance_type` - Broker's instance type.
+* `storage_type` - Broker's storage type.
+* `supported_deployment_modes` - The list of supported deployment modes.
+* `supported_engine_versions` - The list of supported engine versions.
+
+### Availability Zones
+
+* `name` - Name of the Availability Zone.
diff --git a/website/docs/d/mq_broker_instance_type_offerings.markdown b/website/docs/d/mq_broker_instance_type_offerings.markdown
deleted file mode 100644
index c4984382c27..00000000000
--- a/website/docs/d/mq_broker_instance_type_offerings.markdown
+++ /dev/null
@@ -1,60 +0,0 @@
----
-subcategory: "MQ"
-layout: "aws"
-page_title: "AWS: aws_mq_broker_instance_type_offerings"
-description: |-
-  Provides a MQ Broker Instance Offerings data source.
----
-
-# Data Source: aws_mq_broker_instance_type_offerings
-
-Provides information about a MQ Broker Instance Offerings.
-
-## Example Usage
-
-```terraform
-data "aws_mq_broker_instance_type_offerings" "empty" {}
-
-data "aws_mq_broker_instance_type_offerings" "engine" {
-  engine_type = "ACTIVEMQ"
-}
-
-data "aws_mq_broker_instance_type_offerings" "storage" {
-  storage_type = "EBS"
-}
-
-data "aws_mq_broker_instance_type_offerings" "instance" {
-  host_instance_type = "mq.m5.large"
-}
-
-data "aws_mq_broker_instance_type_offerings" "all" {
-  host_instance_type = "mq.m5.large"
-  storage_type       = "EBS"
-  engine_type        = "ACTIVEMQ"
-}
-```
-
-## Argument Reference
-
-The following arguments are supported:
-
-* `engine_type` - (Optional) Filter response by engine type.
-* `host_instance_type` - (Optional) Filter response by host instance type.
-* `storage_type` - (Optional) Filter response by storage type.
-
-## Attributes Reference
-
-* `broker_instance_options` -  Option for host instance type. See Broker Instance Options below.
-
-### Broker Instance Options
-
-* `availability_zones` - List of available AZs. See Availability Zones. below
-* `engine_type` - Broker's engine type.
-* `host_instance_type` - Broker's instance type.
-* `storage_type` - Broker's storage type.
-* `supported_deployment_modes` - The list of supported deployment modes.
-* `supported_engine_versions` - The list of supported engine versions.
-
-### Availability Zones
-
-* `name` - Name of the Availability Zone.
diff --git a/website/docs/d/msk_broker_nodes.html.markdown b/website/docs/d/msk_broker_nodes.html.markdown
index fcffa43cdfd..9834e307baf 100644
--- a/website/docs/d/msk_broker_nodes.html.markdown
+++ b/website/docs/d/msk_broker_nodes.html.markdown
@@ -20,13 +20,13 @@ data "aws_msk_broker_nodes" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `cluster_arn` - (Required) ARN of the cluster the nodes belong to.
 
 ## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * [`node_info_list`](#nodes) - List of MSK Broker Nodes, sorted by broker ID in ascending order.
 
diff --git a/website/docs/d/msk_cluster.html.markdown b/website/docs/d/msk_cluster.html.markdown
index d31d04cccf4..42e33e43690 100644
--- a/website/docs/d/msk_cluster.html.markdown
+++ b/website/docs/d/msk_cluster.html.markdown
@@ -22,13 +22,13 @@ data "aws_msk_cluster" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `cluster_name` - (Required) Name of the cluster.
 
 ## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the MSK cluster.
 * `bootstrap_brokers` - Comma separated list of one or more hostname:port pairs of kafka brokers suitable to bootstrap connectivity to the kafka cluster. Contains a value if `encryption_info.0.encryption_in_transit.0.client_broker` is set to `PLAINTEXT` or `TLS_PLAINTEXT`. The resource sorts values alphabetically. AWS may not always return all endpoints so this value is not guaranteed to be stable across applies.
@@ -38,6 +38,7 @@ In addition to all arguments above, the following attributes are exported:
 * `bootstrap_brokers_sasl_iam` - One or more DNS names (or IP addresses) and SASL IAM port pairs. For example, `b-1.exampleClusterName.abcde.c2.kafka.us-east-1.amazonaws.com:9098,b-2.exampleClusterName.abcde.c2.kafka.us-east-1.amazonaws.com:9098,b-3.exampleClusterName.abcde.c2.kafka.us-east-1.amazonaws.com:9098`. This attribute will have a value if `encryption_info.0.encryption_in_transit.0.client_broker` is set to `TLS_PLAINTEXT` or `TLS` and `client_authentication.0.sasl.0.iam` is set to `true`. The resource sorts the list alphabetically. AWS may not always return all endpoints so the values may not be stable across applies.
 * `bootstrap_brokers_sasl_scram` - One or more DNS names (or IP addresses) and SASL SCRAM port pairs. For example, `b-1.exampleClusterName.abcde.c2.kafka.us-east-1.amazonaws.com:9096,b-2.exampleClusterName.abcde.c2.kafka.us-east-1.amazonaws.com:9096,b-3.exampleClusterName.abcde.c2.kafka.us-east-1.amazonaws.com:9096`. This attribute will have a value if `encryption_info.0.encryption_in_transit.0.client_broker` is set to `TLS_PLAINTEXT` or `TLS` and `client_authentication.0.sasl.0.scram` is set to `true`. The resource sorts the list alphabetically. AWS may not always return all endpoints so the values may not be stable across applies.
 * `bootstrap_brokers_tls` - One or more DNS names (or IP addresses) and TLS port pairs. For example, `b-1.exampleClusterName.abcde.c2.kafka.us-east-1.amazonaws.com:9094,b-2.exampleClusterName.abcde.c2.kafka.us-east-1.amazonaws.com:9094,b-3.exampleClusterName.abcde.c2.kafka.us-east-1.amazonaws.com:9094`. This attribute will have a value if `encryption_info.0.encryption_in_transit.0.client_broker` is set to `TLS_PLAINTEXT` or `TLS`. The resource sorts the list alphabetically. AWS may not always return all endpoints so the values may not be stable across applies.
+* `cluster_uuid` - UUID of the MSK cluster, for use in IAM policies.
 * `kafka_version` - Apache Kafka version.
 * `number_of_broker_nodes` - Number of broker nodes in the cluster.
 * `tags` - Map of key-value pairs assigned to the cluster.
diff --git a/website/docs/d/msk_configuration.html.markdown b/website/docs/d/msk_configuration.html.markdown
index c1999bd20ab..1c58cc53f70 100644
--- a/website/docs/d/msk_configuration.html.markdown
+++ b/website/docs/d/msk_configuration.html.markdown
@@ -20,13 +20,13 @@ data "aws_msk_configuration" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `name` - (Required) Name of the configuration.
 
 ## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the configuration.
 * `latest_revision` - Latest revision of the configuration.
diff --git a/website/docs/d/msk_kafka_version.html.markdown b/website/docs/d/msk_kafka_version.html.markdown
index 683da4dd9f6..634c2d5b4f6 100644
--- a/website/docs/d/msk_kafka_version.html.markdown
+++ b/website/docs/d/msk_kafka_version.html.markdown
@@ -24,13 +24,13 @@ data "aws_msk_kafka_version" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `preferred_versions` - (Optional) Ordered list of preferred Kafka versions. The first match in this list will be returned. Either `preferred_versions` or `version` must be set.
 * `version` - (Optional) Version of MSK Kafka. For example 2.4.1.1 or "2.2.1" etc. Either `preferred_versions` or `version` must be set.
 
 ## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `status` - Status of the MSK Kafka version eg. `ACTIVE` or `DEPRECATED`.
diff --git a/website/docs/d/msk_vpc_connection.html.markdown b/website/docs/d/msk_vpc_connection.html.markdown
new file mode 100644
index 00000000000..28fd442a075
--- /dev/null
+++ b/website/docs/d/msk_vpc_connection.html.markdown
@@ -0,0 +1,35 @@
+---
+subcategory: "Managed Streaming for Kafka"
+layout: "aws"
+page_title: "AWS: aws_msk_vpc_connection"
+description: |-
+  Get information on an Amazon MSK VPC Connection.
+---
+# Data Source: aws_msk_vpc_connection
+
+Get information on an Amazon MSK VPC Connection.
+
+## Example Usage
+
+```terraform
+data "aws_msk_vpc_connection" "example" {
+  arn = aws_msk_vpc_connection.example.arn
+}
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `arn` - (Required) ARN of the VPC Connection.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `authentication` - The authentication type for the client VPC Connection.
+* `client_subnets` - The list of subnets in the client VPC.
+* `security_groups` - The security groups attached to the ENIs for the broker nodes.
+* `tags` - Map of key-value pairs assigned to the VPC Connection.
+* `target_cluster_arn` - The Amazon Resource Name (ARN) of the cluster.
+* `vpc_id` - The VPC ID of the remote client.
diff --git a/website/docs/d/mskconnect_connector.html.markdown b/website/docs/d/mskconnect_connector.html.markdown
index 147e0a043fe..4504eba101b 100644
--- a/website/docs/d/mskconnect_connector.html.markdown
+++ b/website/docs/d/mskconnect_connector.html.markdown
@@ -20,13 +20,13 @@ data "aws_mskconnect_connector" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `name` - (Required) Name of the connector.
 
 ## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the connector.
 * `description` - Summary description of the connector.
diff --git a/website/docs/d/mskconnect_custom_plugin.html.markdown b/website/docs/d/mskconnect_custom_plugin.html.markdown
index 7cfa338f211..ec2f1f1ee41 100644
--- a/website/docs/d/mskconnect_custom_plugin.html.markdown
+++ b/website/docs/d/mskconnect_custom_plugin.html.markdown
@@ -20,13 +20,13 @@ data "aws_mskconnect_custom_plugin" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `name` - (Required) Name of the custom plugin.
 
 ## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - the ARN of the custom plugin.
 * `description` - a summary description of the custom plugin.
diff --git a/website/docs/d/mskconnect_worker_configuration.html.markdown b/website/docs/d/mskconnect_worker_configuration.html.markdown
index 71dbff344f3..ebca2b24581 100644
--- a/website/docs/d/mskconnect_worker_configuration.html.markdown
+++ b/website/docs/d/mskconnect_worker_configuration.html.markdown
@@ -20,13 +20,13 @@ data "aws_mskconnect_worker_configuration" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `name` - (Required) Name of the worker configuration.
 
 ## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - the ARN of the worker configuration.
 * `description` - a summary description of the worker configuration.
diff --git a/website/docs/d/nat_gateway.html.markdown b/website/docs/d/nat_gateway.html.markdown
index 4f4c4d95801..0a63face609 100644
--- a/website/docs/d/nat_gateway.html.markdown
+++ b/website/docs/d/nat_gateway.html.markdown
@@ -3,12 +3,12 @@ subcategory: "VPC (Virtual Private Cloud)"
 layout: "aws"
 page_title: "AWS: aws_nat_gateway"
 description: |-
-    Provides details about a specific Nat Gateway
+    Provides details about a specific VPC NAT Gateway.
 ---
 
 # Data Source: aws_nat_gateway
 
-Provides details about a specific Nat Gateway.
+Provides details about a specific VPC NAT Gateway.
 
 ## Example Usage
 
@@ -18,7 +18,7 @@ data "aws_nat_gateway" "default" {
 }
 ```
 
-Usage with tags:
+### With tags
 
 ```terraform
 data "aws_nat_gateway" "default" {
@@ -33,15 +33,15 @@ data "aws_nat_gateway" "default" {
 ## Argument Reference
 
 The arguments of this data source act as filters for querying the available
-Nat Gateways in the current region. The given filters must match exactly one
-Nat Gateway whose data will be exported as attributes.
+NAT Gateways in the current Region. The given filters must match exactly one
+NAT Gateway whose data will be exported as attributes.
 
-* `id` - (Optional) ID of the specific Nat Gateway to retrieve.
-* `subnet_id` - (Optional) ID of subnet that the Nat Gateway resides in.
-* `vpc_id` - (Optional) ID of the VPC that the Nat Gateway resides in.
-* `state` - (Optional) State of the NAT gateway (pending | failed | available | deleting | deleted ).
+* `id` - (Optional) ID of the specific NAT Gateway to retrieve.
+* `subnet_id` - (Optional) ID of subnet that the NAT Gateway resides in.
+* `vpc_id` - (Optional) ID of the VPC that the NAT Gateway resides in.
+* `state` - (Optional) State of the NAT Gateway (pending | failed | available | deleting | deleted ).
 * `tags` - (Optional) Map of tags, each pair of which must exactly match
-  a pair on the desired Nat Gateway.
+  a pair on the desired NAT Gateway.
 * `filter` - (Optional) Custom filter block as described below.
 
 More complex filters can be expressed using one or more `filter` sub-blocks,
@@ -52,22 +52,22 @@ which take the following arguments:
 * `values` - (Required) Set of values that are accepted for the given field.
   An Nat Gateway will be selected if any one of the given values matches.
 
-## Attributes Reference
+## Attribute Reference
 
 All of the argument attributes except `filter` block are also exported as
 result attributes. This data source will complete the data by populating
 any fields that are not included in the configuration with the data for
 the selected Nat Gateway.
 
-`addresses` are also exported with the following attributes, when they are relevant:
-Each attachment supports the following:
-
-* `allocation_id` - ID of the EIP allocated to the selected Nat Gateway.
-* `association_id` - The association ID of the Elastic IP address that's associated with the NAT gateway. Only available when `connectivity_type` is `public`.
+* `allocation_id` - ID of the EIP allocated to the selected NAT Gateway.
+* `association_id` - The association ID of the Elastic IP address that's associated with the NAT Gateway. Only available when `connectivity_type` is `public`.
 * `connectivity_type` - Connectivity type of the NAT Gateway.
-* `network_interface_id` - The ID of the ENI allocated to the selected Nat Gateway.
-* `private_ip` - Private Ip address of the selected Nat Gateway.
-* `public_ip` - Public Ip (EIP) address of the selected Nat Gateway.
+* `network_interface_id` - The ID of the ENI allocated to the selected NAT Gateway.
+* `private_ip` - Private IP address of the selected NAT Gateway.
+* `public_ip` - Public IP (EIP) address of the selected NAT Gateway.
+* `secondary_allocation_ids` - Secondary allocation EIP IDs for the selected NAT Gateway.
+* `secondary_private_ip_address_count` - The number of secondary private IPv4 addresses assigned to the selected NAT Gateway.
+* `secondary_private_ip_addresses` - Secondary private IPv4 addresses assigned to the selected NAT Gateway.
 
 ## Timeouts
 
diff --git a/website/docs/d/nat_gateways.html.markdown b/website/docs/d/nat_gateways.html.markdown
index b2edf8fbf2b..c5278210adc 100644
--- a/website/docs/d/nat_gateways.html.markdown
+++ b/website/docs/d/nat_gateways.html.markdown
@@ -45,7 +45,9 @@ which take the following arguments:
 * `values` - (Required) Set of values that are accepted for the given field.
   A Nat Gateway will be selected if any one of the given values matches.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - AWS Region.
 * `ids` - List of all the NAT gateway ids found.
diff --git a/website/docs/d/neptune_engine_version.html.markdown b/website/docs/d/neptune_engine_version.html.markdown
new file mode 100644
index 00000000000..02925791175
--- /dev/null
+++ b/website/docs/d/neptune_engine_version.html.markdown
@@ -0,0 +1,40 @@
+---
+subcategory: "Neptune"
+layout: "aws"
+page_title: "AWS: aws_neptune_engine_version"
+description: |-
+  Information about a Neptune engine version.
+---
+
+# Data Source: aws_neptune_engine_version
+
+Information about a Neptune engine version.
+
+## Example Usage
+
+```terraform
+data "aws_neptune_engine_version" "test" {
+  preferred_versions = ["1.0.3.0", "1.0.2.2", "1.0.2.1"]
+}
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `engine` - (Optional) DB engine. (Default: `neptune`)
+* `parameter_group_family` - (Optional) Name of a specific DB parameter group family. An example parameter group family is `neptune1`.
+* `preferred_versions` - (Optional) Ordered list of preferred engine versions. The first match in this list will be returned. If no preferred matches are found and the original search returned more than one result, an error is returned. If both the `version` and `preferred_versions` arguments are not configured, the data source will return the default version for the engine.
+* `version` - (Optional) Version of the DB engine. For example, `1.0.1.0`, `1.0.2.2`, and `1.0.3.0`. If both the `version` and `preferred_versions` arguments are not configured, the data source will return the default version for the engine.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `engine_description` - Description of the database engine.
+* `exportable_log_types` - Set of log types that the database engine has available for export to CloudWatch Logs.
+* `supported_timezones` - Set of the time zones supported by this engine.
+* `supports_log_exports_to_cloudwatch` - Indicates whether the engine version supports exporting the log types specified by `exportable_log_types` to CloudWatch Logs.
+* `supports_read_replica` - Indicates whether the database engine version supports read replicas.
+* `valid_upgrade_targets` - Set of engine versions that this database engine version can be upgraded to.
+* `version_description` - Description of the database engine version.
diff --git a/website/docs/d/neptune_engine_version.markdown b/website/docs/d/neptune_engine_version.markdown
deleted file mode 100644
index ade2cb56bae..00000000000
--- a/website/docs/d/neptune_engine_version.markdown
+++ /dev/null
@@ -1,40 +0,0 @@
----
-subcategory: "Neptune"
-layout: "aws"
-page_title: "AWS: aws_neptune_engine_version"
-description: |-
-  Information about a Neptune engine version.
----
-
-# Data Source: aws_neptune_engine_version
-
-Information about a Neptune engine version.
-
-## Example Usage
-
-```terraform
-data "aws_neptune_engine_version" "test" {
-  preferred_versions = ["1.0.3.0", "1.0.2.2", "1.0.2.1"]
-}
-```
-
-## Argument Reference
-
-The following arguments are supported:
-
-* `engine` - (Optional) DB engine. (Default: `neptune`)
-* `parameter_group_family` - (Optional) Name of a specific DB parameter group family. An example parameter group family is `neptune1`.
-* `preferred_versions` - (Optional) Ordered list of preferred engine versions. The first match in this list will be returned. If no preferred matches are found and the original search returned more than one result, an error is returned. If both the `version` and `preferred_versions` arguments are not configured, the data source will return the default version for the engine.
-* `version` - (Optional) Version of the DB engine. For example, `1.0.1.0`, `1.0.2.2`, and `1.0.3.0`. If both the `version` and `preferred_versions` arguments are not configured, the data source will return the default version for the engine.
-
-## Attribute Reference
-
-In addition to all arguments above, the following attributes are exported:
-
-* `engine_description` - Description of the database engine.
-* `exportable_log_types` - Set of log types that the database engine has available for export to CloudWatch Logs.
-* `supported_timezones` - Set of the time zones supported by this engine.
-* `supports_log_exports_to_cloudwatch` - Indicates whether the engine version supports exporting the log types specified by `exportable_log_types` to CloudWatch Logs.
-* `supports_read_replica` - Indicates whether the database engine version supports read replicas.
-* `valid_upgrade_targets` - Set of engine versions that this database engine version can be upgraded to.
-* `version_description` - Description of the database engine version.
diff --git a/website/docs/d/neptune_orderable_db_instance.html.markdown b/website/docs/d/neptune_orderable_db_instance.html.markdown
new file mode 100644
index 00000000000..da4470fc05d
--- /dev/null
+++ b/website/docs/d/neptune_orderable_db_instance.html.markdown
@@ -0,0 +1,51 @@
+---
+subcategory: "Neptune"
+layout: "aws"
+page_title: "AWS: aws_neptune_orderable_db_instance"
+description: |-
+  Information about Neptune orderable DB instances.
+---
+
+# Data Source: aws_neptune_orderable_db_instance
+
+Information about Neptune orderable DB instances.
+
+## Example Usage
+
+```terraform
+data "aws_neptune_orderable_db_instance" "test" {
+  engine_version             = "1.0.3.0"
+  preferred_instance_classes = ["db.r5.large", "db.r4.large", "db.t3.medium"]
+}
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `engine` - (Optional) DB engine. (Default: `neptune`)
+* `engine_version` - (Optional) Version of the DB engine. For example, `1.0.1.0`, `1.0.1.2`, `1.0.2.2`, and `1.0.3.0`.
+* `instance_class` - (Optional) DB instance class. Examples of classes are `db.r5.large`, `db.r5.xlarge`, `db.r4.large`, `db.r5.4xlarge`, `db.r5.12xlarge`, `db.r4.xlarge`, and `db.t3.medium`.
+* `license_model` - (Optional) License model. (Default: `amazon-license`)
+* `preferred_instance_classes` - (Optional) Ordered list of preferred Neptune DB instance classes. The first match in this list will be returned. If no preferred matches are found and the original search returned more than one result, an error is returned.
+* `vpc` - (Optional) Enable to show only VPC offerings.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `availability_zones` - Availability zones where the instance is available.
+* `max_iops_per_db_instance` - Maximum total provisioned IOPS for a DB instance.
+* `max_iops_per_gib` - Maximum provisioned IOPS per GiB for a DB instance.
+* `max_storage_size` - Maximum storage size for a DB instance.
+* `min_iops_per_db_instance` - Minimum total provisioned IOPS for a DB instance.
+* `min_iops_per_gib` - Minimum provisioned IOPS per GiB for a DB instance.
+* `min_storage_size` - Minimum storage size for a DB instance.
+* `multi_az_capable` - Whether a DB instance is Multi-AZ capable.
+* `read_replica_capable` - Whether a DB instance can have a read replica.
+* `storage_type` - Storage type for a DB instance.
+* `supports_enhanced_monitoring` - Whether a DB instance supports Enhanced Monitoring at intervals from 1 to 60 seconds.
+* `supports_iam_database_authentication` - Whether a DB instance supports IAM database authentication.
+* `supports_iops` - Whether a DB instance supports provisioned IOPS.
+* `supports_performance_insights` - Whether a DB instance supports Performance Insights.
+* `supports_storage_encryption` - Whether a DB instance supports encrypted storage.
diff --git a/website/docs/d/neptune_orderable_db_instance.markdown b/website/docs/d/neptune_orderable_db_instance.markdown
deleted file mode 100644
index da04772520c..00000000000
--- a/website/docs/d/neptune_orderable_db_instance.markdown
+++ /dev/null
@@ -1,51 +0,0 @@
----
-subcategory: "Neptune"
-layout: "aws"
-page_title: "AWS: aws_neptune_orderable_db_instance"
-description: |-
-  Information about Neptune orderable DB instances.
----
-
-# Data Source: aws_neptune_orderable_db_instance
-
-Information about Neptune orderable DB instances.
-
-## Example Usage
-
-```terraform
-data "aws_neptune_orderable_db_instance" "test" {
-  engine_version             = "1.0.3.0"
-  preferred_instance_classes = ["db.r5.large", "db.r4.large", "db.t3.medium"]
-}
-```
-
-## Argument Reference
-
-The following arguments are supported:
-
-* `engine` - (Optional) DB engine. (Default: `neptune`)
-* `engine_version` - (Optional) Version of the DB engine. For example, `1.0.1.0`, `1.0.1.2`, `1.0.2.2`, and `1.0.3.0`.
-* `instance_class` - (Optional) DB instance class. Examples of classes are `db.r5.large`, `db.r5.xlarge`, `db.r4.large`, `db.r5.4xlarge`, `db.r5.12xlarge`, `db.r4.xlarge`, and `db.t3.medium`.
-* `license_model` - (Optional) License model. (Default: `amazon-license`)
-* `preferred_instance_classes` - (Optional) Ordered list of preferred Neptune DB instance classes. The first match in this list will be returned. If no preferred matches are found and the original search returned more than one result, an error is returned.
-* `vpc` - (Optional) Enable to show only VPC offerings.
-
-## Attribute Reference
-
-In addition to all arguments above, the following attributes are exported:
-
-* `availability_zones` - Availability zones where the instance is available.
-* `max_iops_per_db_instance` - Maximum total provisioned IOPS for a DB instance.
-* `max_iops_per_gib` - Maximum provisioned IOPS per GiB for a DB instance.
-* `max_storage_size` - Maximum storage size for a DB instance.
-* `min_iops_per_db_instance` - Minimum total provisioned IOPS for a DB instance.
-* `min_iops_per_gib` - Minimum provisioned IOPS per GiB for a DB instance.
-* `min_storage_size` - Minimum storage size for a DB instance.
-* `multi_az_capable` - Whether a DB instance is Multi-AZ capable.
-* `read_replica_capable` - Whether a DB instance can have a read replica.
-* `storage_type` - Storage type for a DB instance.
-* `supports_enhanced_monitoring` - Whether a DB instance supports Enhanced Monitoring at intervals from 1 to 60 seconds.
-* `supports_iam_database_authentication` - Whether a DB instance supports IAM database authentication.
-* `supports_iops` - Whether a DB instance supports provisioned IOPS.
-* `supports_performance_insights` - Whether a DB instance supports Performance Insights.
-* `supports_storage_encryption` - Whether a DB instance supports encrypted storage.
diff --git a/website/docs/d/network_acls.html.markdown b/website/docs/d/network_acls.html.markdown
index 0c6a67abf3f..97678da31b7 100644
--- a/website/docs/d/network_acls.html.markdown
+++ b/website/docs/d/network_acls.html.markdown
@@ -67,7 +67,9 @@ which take the following arguments:
 * `values` - (Required) Set of values that are accepted for the given field.
   A VPC will be selected if any one of the given values matches.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - AWS Region.
 * `ids` - List of all the network ACL ids found.
diff --git a/website/docs/d/network_interface.html.markdown b/website/docs/d/network_interface.html.markdown
index fa422632fef..367eefad5ea 100644
--- a/website/docs/d/network_interface.html.markdown
+++ b/website/docs/d/network_interface.html.markdown
@@ -20,12 +20,12 @@ data "aws_network_interface" "bar" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `id` – (Optional) Identifier for the network interface.
 * `filter` – (Optional) One or more name/value pairs to filter off of. There are several valid keys, for a full reference, check out [describe-network-interfaces](https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-network-interfaces.html) in the AWS CLI reference.
 
-## Attributes Reference
+## Attribute Reference
 
 See the [Network Interface](/docs/providers/aws/r/network_interface.html) for details on the returned attributes.
 
diff --git a/website/docs/d/network_interfaces.html.markdown b/website/docs/d/network_interfaces.html.markdown
index e97a7a77d2d..617e2427cbd 100644
--- a/website/docs/d/network_interfaces.html.markdown
+++ b/website/docs/d/network_interfaces.html.markdown
@@ -65,7 +65,9 @@ which take the following arguments:
 
 * `values` - (Required) Set of values that are accepted for the given field.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - AWS Region.
 * `ids` - List of all the network interface ids found.
diff --git a/website/docs/d/networkfirewall_firewall.html.markdown b/website/docs/d/networkfirewall_firewall.html.markdown
index 419bd703a13..769df9037c0 100644
--- a/website/docs/d/networkfirewall_firewall.html.markdown
+++ b/website/docs/d/networkfirewall_firewall.html.markdown
@@ -44,9 +44,9 @@ One or more of the following arguments are required:
 * `arn` - ARN of the firewall.
 * `name` - Descriptive name of the firewall.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the firewall.
 * `delete_protection` - Boolean flag indicating whether it is possible to delete the firewall.
diff --git a/website/docs/d/networkfirewall_firewall_policy.html.markdown b/website/docs/d/networkfirewall_firewall_policy.html.markdown
index 00fab556396..4285d2e6eb7 100644
--- a/website/docs/d/networkfirewall_firewall_policy.html.markdown
+++ b/website/docs/d/networkfirewall_firewall_policy.html.markdown
@@ -48,9 +48,9 @@ One or more of the following arguments are required:
 * `arn` - ARN of the firewall policy.
 * `name` - Descriptive name of the firewall policy.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `description` - Description of the firewall policy.
 * `firewall_policy` - The [policy][2] for the specified firewall policy.
diff --git a/website/docs/d/networkfirewall_resource_policy.html.markdown b/website/docs/d/networkfirewall_resource_policy.html.markdown
index 8c57e5fc477..16f1d24801b 100644
--- a/website/docs/d/networkfirewall_resource_policy.html.markdown
+++ b/website/docs/d/networkfirewall_resource_policy.html.markdown
@@ -22,9 +22,9 @@ data "aws_networkfirewall_resource_policy" "example" {
 
 * `resource_arn` - (Required) The Amazon Resource Name (ARN) that identifies the resource policy.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - The Amazon Resource Name (ARN) that identifies the resource policy.
 * `policy` - The [policy][1] for the resource.
diff --git a/website/docs/d/networkmanager_connection.html.markdown b/website/docs/d/networkmanager_connection.html.markdown
index 89f8697d01e..256d8d53736 100644
--- a/website/docs/d/networkmanager_connection.html.markdown
+++ b/website/docs/d/networkmanager_connection.html.markdown
@@ -24,9 +24,9 @@ data "aws_networkmanager_connection" "example" {
 * `global_network_id` - (Required) ID of the Global Network of the connection to retrieve.
 * `connection_id` - (Required) ID of the specific connection to retrieve.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the connection.
 * `connected_device_id` - ID of the second device in the connection.
diff --git a/website/docs/d/networkmanager_connections.html.markdown b/website/docs/d/networkmanager_connections.html.markdown
index 1baede013d1..02c06b84220 100644
--- a/website/docs/d/networkmanager_connections.html.markdown
+++ b/website/docs/d/networkmanager_connections.html.markdown
@@ -28,8 +28,8 @@ data "aws_networkmanager_connections" "example" {
 * `global_network_id` - (Required) ID of the Global Network of the connections to retrieve.
 * `tags` - (Optional) Restricts the list to the connections with these tags.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `ids` - IDs of the connections.
diff --git a/website/docs/d/networkmanager_core_network_policy_document.html.markdown b/website/docs/d/networkmanager_core_network_policy_document.html.markdown
index 15ed0ae4254..ebab0508e4f 100644
--- a/website/docs/d/networkmanager_core_network_policy_document.html.markdown
+++ b/website/docs/d/networkmanager_core_network_policy_document.html.markdown
@@ -247,8 +247,8 @@ The following arguments are available:
 * `share_with` (Optional) - A list of strings to share with. Must be a substring is all segments. Valid values include: `["*"]` or `["<segment-names>"]`.
 * `share_with_except` (Optional) - A set subtraction of segments to not share with.
 
-## Attributes Reference
+## Attribute Reference
 
-The following attribute is exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `json` - Standard JSON policy document rendered based on the arguments above.
diff --git a/website/docs/d/networkmanager_device.html.markdown b/website/docs/d/networkmanager_device.html.markdown
index 0e25231f737..97410e79faa 100644
--- a/website/docs/d/networkmanager_device.html.markdown
+++ b/website/docs/d/networkmanager_device.html.markdown
@@ -24,9 +24,9 @@ data "aws_networkmanager_device" "example" {
 * `device_id` - (Required) ID of the device.
 * `global_network_id` - (Required) ID of the global network.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the device.
 * `aws_location` - AWS location of the device. Documented below.
diff --git a/website/docs/d/networkmanager_devices.html.markdown b/website/docs/d/networkmanager_devices.html.markdown
index 43e632e51b5..2b8c60cb4fc 100644
--- a/website/docs/d/networkmanager_devices.html.markdown
+++ b/website/docs/d/networkmanager_devices.html.markdown
@@ -28,8 +28,8 @@ data "aws_networkmanager_devices" "example" {
 * `site_id` - (Optional) ID of the site of the devices to retrieve.
 * `tags` - (Optional) Restricts the list to the devices with these tags.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `ids` - IDs of the devices.
diff --git a/website/docs/d/networkmanager_global_network.html.markdown b/website/docs/d/networkmanager_global_network.html.markdown
index 5c15a46a0de..e645d011fc5 100644
--- a/website/docs/d/networkmanager_global_network.html.markdown
+++ b/website/docs/d/networkmanager_global_network.html.markdown
@@ -22,9 +22,9 @@ data "aws_networkmanager_global_network" "example" {
 
 * `global_network_id` - (Required) ID of the specific global network to retrieve.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the global network.
 * `description` - Description of the global network.
diff --git a/website/docs/d/networkmanager_global_networks.html.markdown b/website/docs/d/networkmanager_global_networks.html.markdown
index 8690c43f4a0..ae97e021c8a 100644
--- a/website/docs/d/networkmanager_global_networks.html.markdown
+++ b/website/docs/d/networkmanager_global_networks.html.markdown
@@ -24,8 +24,8 @@ data "aws_networkmanager_global_networks" "example" {
 
 * `tags` - (Optional) Restricts the list to the global networks with these tags.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `ids` - IDs of the global networks.
diff --git a/website/docs/d/networkmanager_link.html.markdown b/website/docs/d/networkmanager_link.html.markdown
index 1c396a436a9..18c8bbe8c7b 100644
--- a/website/docs/d/networkmanager_link.html.markdown
+++ b/website/docs/d/networkmanager_link.html.markdown
@@ -24,9 +24,9 @@ data "aws_networkmanager_link" "example" {
 * `global_network_id` - (Required) ID of the Global Network of the link to retrieve.
 * `link_id` - (Required) ID of the specific link to retrieve.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the link.
 * `bandwidth` - Upload speed and download speed of the link as documented below
diff --git a/website/docs/d/networkmanager_links.html.markdown b/website/docs/d/networkmanager_links.html.markdown
index fc46d785a3d..9793d672255 100644
--- a/website/docs/d/networkmanager_links.html.markdown
+++ b/website/docs/d/networkmanager_links.html.markdown
@@ -30,8 +30,8 @@ data "aws_networkmanager_links" "example" {
 * `tags` - (Optional) Restricts the list to the links with these tags.
 * `type` - (Optional) Link type to retrieve.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `ids` - IDs of the links.
diff --git a/website/docs/d/networkmanager_site.html.markdown b/website/docs/d/networkmanager_site.html.markdown
index 6c6bf641605..55e9ad5ae52 100644
--- a/website/docs/d/networkmanager_site.html.markdown
+++ b/website/docs/d/networkmanager_site.html.markdown
@@ -24,9 +24,9 @@ data "aws_networkmanager_site" "example" {
 * `global_network_id` - (Required) ID of the Global Network of the site to retrieve.
 * `site_id` - (Required) ID of the specific site to retrieve.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the site.
 * `description` - Description of the site.
diff --git a/website/docs/d/networkmanager_sites.html.markdown b/website/docs/d/networkmanager_sites.html.markdown
index 60a184abac9..4c55c124f49 100644
--- a/website/docs/d/networkmanager_sites.html.markdown
+++ b/website/docs/d/networkmanager_sites.html.markdown
@@ -27,8 +27,8 @@ data "aws_networkmanager_sites" "example" {
 * `global_network_id` - (Required) ID of the Global Network of the sites to retrieve.
 * `tags` - (Optional) Restricts the list to the sites with these tags.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `ids` - IDs of the sites.
diff --git a/website/docs/d/oam_link.html.markdown b/website/docs/d/oam_link.html.markdown
index 4f7b91cd89b..fe7024000d9 100644
--- a/website/docs/d/oam_link.html.markdown
+++ b/website/docs/d/oam_link.html.markdown
@@ -26,9 +26,9 @@ The following arguments are required:
 
 * `link_identifier` - (Required) ARN of the link.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the link.
 * `label` - Label that is assigned to this link.
diff --git a/website/docs/d/oam_links.html.markdown b/website/docs/d/oam_links.html.markdown
index 5c5f86bd3f1..6d74d500110 100644
--- a/website/docs/d/oam_links.html.markdown
+++ b/website/docs/d/oam_links.html.markdown
@@ -19,8 +19,8 @@ data "aws_oam_links" "example" {
 }
 ```
 
-## Attributes Reference
+## Attribute Reference
 
-The following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arns` - Set of ARN of the Links.
diff --git a/website/docs/d/oam_sink.html.markdown b/website/docs/d/oam_sink.html.markdown
index 82b19cc1f5d..f251532eac8 100644
--- a/website/docs/d/oam_sink.html.markdown
+++ b/website/docs/d/oam_sink.html.markdown
@@ -26,9 +26,9 @@ The following arguments are required:
 
 * `sink_identifier` - (Required) ARN of the sink.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the sink.
 * `name` - Name of the sink.
diff --git a/website/docs/d/oam_sinks.html.markdown b/website/docs/d/oam_sinks.html.markdown
index 21df55c7980..09c7775da47 100644
--- a/website/docs/d/oam_sinks.html.markdown
+++ b/website/docs/d/oam_sinks.html.markdown
@@ -19,8 +19,8 @@ data "aws_oam_sinks" "example" {
 }
 ```
 
-## Attributes Reference
+## Attribute Reference
 
-The following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arns` - Set of ARN of the Sinks.
diff --git a/website/docs/d/opensearch_domain.html.markdown b/website/docs/d/opensearch_domain.html.markdown
index 10b86d1fd9d..daaeca17f44 100644
--- a/website/docs/d/opensearch_domain.html.markdown
+++ b/website/docs/d/opensearch_domain.html.markdown
@@ -20,13 +20,13 @@ data "aws_opensearch_domain" "my_domain" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `domain_name` – (Required) Name of the domain.
 
-## Attributes Reference
+## Attribute Reference
 
-The following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `access_policies` – Policy document attached to the domain.
 * `advanced_options` - Key-value string pairs to specify advanced configuration options.
@@ -93,6 +93,8 @@ The following attributes are exported:
 * `processing` – Status of a configuration change in the domain.
 * `snapshot_options` – Domain snapshot related options.
     * `automated_snapshot_start_hour` - Hour during which the service takes an automated daily snapshot of the indices in the domain.
+* `software_update_options` - Software update options for the domain
+    * `auto_software_update_enabled` - Enabled or disabled.
 * `tags` - Tags assigned to the domain.
 * `vpc_options` - VPC Options for private OpenSearch domains.
     * `availability_zones` - Availability zones used by the domain.
diff --git a/website/docs/d/opensearchserverless_access_policy.html.markdown b/website/docs/d/opensearchserverless_access_policy.html.markdown
new file mode 100644
index 00000000000..23bfbf0c557
--- /dev/null
+++ b/website/docs/d/opensearchserverless_access_policy.html.markdown
@@ -0,0 +1,37 @@
+---
+subcategory: "OpenSearch Serverless"
+layout: "aws"
+page_title: "AWS: aws_opensearchserverless_access_policy"
+description: |-
+  Terraform data source for managing an AWS OpenSearch Serverless Access Policy.
+---
+
+# Data Source: aws_opensearchserverless_access_policy
+
+Terraform data source for managing an AWS OpenSearch Serverless Access Policy.
+
+## Example Usage
+
+### Basic Usage
+
+```terraform
+data "aws_opensearchserverless_access_policy" "example" {
+  name = aws_opensearchserverless_access_policy.example.name
+  type = aws_opensearchserverless_access_policy.example.type
+}
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) Name of the policy.
+* `type` - (Required) Type of access policy. Must be `data`.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `description` - Description of the policy. Typically used to store information about the permissions defined in the policy.
+* `policy` - JSON policy document to use as the content for the new policy.
+* `policy_version` - Version of the policy.
diff --git a/website/docs/d/opensearchserverless_collection.html.markdown b/website/docs/d/opensearchserverless_collection.html.markdown
new file mode 100644
index 00000000000..7abacc736cb
--- /dev/null
+++ b/website/docs/d/opensearchserverless_collection.html.markdown
@@ -0,0 +1,42 @@
+---
+subcategory: "OpenSearch Serverless"
+layout: "aws"
+page_title: "AWS: aws_opensearchserverless_collection"
+description: |-
+  Terraform data source for managing an AWS OpenSearch Serverless Collection.
+---
+
+# Data Source: aws_opensearchserverless_collection
+
+Terraform data source for managing an AWS OpenSearch Serverless Collection.
+
+## Example Usage
+
+### Basic Usage
+
+```terraform
+data "aws_opensearchserverless_collection" "example" {
+  name = "example"
+}
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `id` - (Required) ID of the collection. Either `id` or `name` must be provided.
+* `name` - (Required) Name of the collection. Either `name` or `id` must be provided.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the collection.
+* `collection_endpoint` - Collection-specific endpoint used to submit index, search, and data upload requests to an OpenSearch Serverless collection.
+* `created_date` - Date the Collection was created.
+* `dashboard_endpoint` - Collection-specific endpoint used to access OpenSearch Dashboards.
+* `description` - Description of the collection.
+* `kms_key_arn` - The ARN of the Amazon Web Services KMS key used to encrypt the collection.
+* `last_modified_date` - Date the Collection was last modified.
+* `tags` - A map of tags to assign to the collection.
+* `type` - Type of collection.
diff --git a/website/docs/d/opensearchserverless_security_config.html.markdown b/website/docs/d/opensearchserverless_security_config.html.markdown
new file mode 100644
index 00000000000..22ec0d16c52
--- /dev/null
+++ b/website/docs/d/opensearchserverless_security_config.html.markdown
@@ -0,0 +1,47 @@
+---
+subcategory: "OpenSearch Serverless"
+layout: "aws"
+page_title: "AWS: aws_opensearchserverless_security_config"
+description: |-
+  Terraform data source for managing an AWS OpenSearch Serverless Security Config.
+---
+
+# Data Source: aws_opensearchserverless_security_config
+
+Terraform data source for managing an AWS OpenSearch Serverless Security Config.
+
+## Example Usage
+
+### Basic Usage
+
+```terraform
+data "aws_opensearchserverless_security_config" "example" {
+  id = "saml/12345678912/example"
+}
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `id` - (Required) The unique identifier of the security configuration.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `config_version` - The version of the security configuration.
+* `created_date` - The date the configuration was created.
+* `description` - The description of the security configuration.
+* `last_modified_date` - The date the configuration was last modified.
+* `saml_options` - SAML options for the security configuration.
+* `type` - The type of security configuration.
+
+### saml_options
+
+SAML options for the security configuration.
+
+* `group_attribute` - Group attribute for this SAML integration.
+* `metadata` - The XML IdP metadata file generated from your identity provider.
+* `session_timeout` - Session timeout, in minutes. Minimum is 5 minutes and maximum is 720 minutes (12 hours). Default is 60 minutes.
+* `user_attribute` - User attribute for this SAML integration.
diff --git a/website/docs/d/opensearchserverless_security_policy.html.markdown b/website/docs/d/opensearchserverless_security_policy.html.markdown
new file mode 100644
index 00000000000..4423db1560c
--- /dev/null
+++ b/website/docs/d/opensearchserverless_security_policy.html.markdown
@@ -0,0 +1,37 @@
+---
+subcategory: "OpenSearch Serverless"
+layout: "aws"
+page_title: "AWS: aws_opensearchserverless_security_policy"
+description: |-
+  Get information on an OpenSearch Serverless Security Policy.
+---
+
+# Data Source: aws_opensearchserverless_security_policy
+
+Use this data source to get information about an AWS OpenSearch Serverless Security Policy.
+
+## Example Usage
+
+```terraform
+data "aws_opensearchserverless_security_policy" "example" {
+  name = "example-security-policy"
+  type = "encryption"
+}
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `name` - (Required) Name of the policy
+* `type` - (Required) Type of security policy. One of `encryption` or `network`.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `created_date` - The date the security policy was created.
+* `description` - Description of the security policy.
+* `last_modified_date` - The date the security policy was last modified.
+* `policy` - The JSON policy document without any whitespaces.
+* `policy_version` - Version of the policy.
diff --git a/website/docs/d/opensearchserverless_vpc_endpoint.html.markdown b/website/docs/d/opensearchserverless_vpc_endpoint.html.markdown
new file mode 100644
index 00000000000..1635da970cd
--- /dev/null
+++ b/website/docs/d/opensearchserverless_vpc_endpoint.html.markdown
@@ -0,0 +1,35 @@
+---
+subcategory: "OpenSearch Serverless"
+layout: "aws"
+page_title: "AWS: aws_opensearchserverless_vpc_endpoint"
+description: |-
+  Terraform data source for managing an AWS OpenSearch Serverless VPC Endpoint.
+---
+
+# Data Source: aws_opensearchserverless_vpc_endpoint
+
+Terraform data source for managing an AWS OpenSearch Serverless VPC Endpoint.
+
+## Example Usage
+
+```terraform
+data "aws_opensearchserverless_vpc_endpoint" "example" {
+  vpc_endpoint_id = "vpce-829a4487959e2a839"
+}
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `vpc_endpoint_id` - (Required) The unique identifier of the endpoint.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `created_date` - The date the endpoint was created.
+* `name` - The name of the endpoint.
+* `security_group_ids` - The IDs of the security groups that define the ports, protocols, and sources for inbound traffic that you are authorizing into your endpoint.
+* `subnet_ids` - The IDs of the subnets from which you access OpenSearch Serverless.
+* `vpc_id` - The ID of the VPC from which you access OpenSearch Serverless.
diff --git a/website/docs/d/organizations_delegated_administrators.html.markdown b/website/docs/d/organizations_delegated_administrators.html.markdown
index c8e52f6691d..155fa40c61b 100644
--- a/website/docs/d/organizations_delegated_administrators.html.markdown
+++ b/website/docs/d/organizations_delegated_administrators.html.markdown
@@ -22,7 +22,9 @@ data "aws_organizations_delegated_administrators" "example" {
 
 * `service_principal` - (Optional) Specifies a service principal name. If specified, then the operation lists the delegated administrators only for the specified service. If you don't specify a service principal, the operation lists all delegated administrators for all services in your organization.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `delegated_administrators` - The list of delegated administrators in your organization, which have the following attributes:
     * `arn` - The ARN of the delegated administrator's account.
diff --git a/website/docs/d/organizations_delegated_services.html.markdown b/website/docs/d/organizations_delegated_services.html.markdown
index c29c9fb62de..0f632747aab 100644
--- a/website/docs/d/organizations_delegated_services.html.markdown
+++ b/website/docs/d/organizations_delegated_services.html.markdown
@@ -22,7 +22,9 @@ data "aws_organizations_delegated_services" "example" {
 
 * `account_id` - (Required) Account ID number of a delegated administrator account in the organization.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `delegated_services` - Services for which the account is a delegated administrator, which have the following attributes:
     * `delegation_enabled_date` - The date that the account became a delegated administrator for this service.
diff --git a/website/docs/d/organizations_organization.html.markdown b/website/docs/d/organizations_organization.html.markdown
index 391efeb01ab..8cdbf03cf40 100644
--- a/website/docs/d/organizations_organization.html.markdown
+++ b/website/docs/d/organizations_organization.html.markdown
@@ -71,9 +71,9 @@ data "aws_iam_policy_document" "sns_topic_policy" {
 
 There are no arguments available for this data source.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the organization.
 * `feature_set` - FeatureSet of the organization.
@@ -82,7 +82,7 @@ In addition to all arguments above, the following attributes are exported:
 * `master_account_email` - The email address that is associated with the AWS account that is designated as the master account for the organization.
 * `master_account_id` - Unique identifier (ID) of the master account of an organization.
 
-### Master Account or Delegated Administrator Attributes Reference
+### Master Account or Delegated Administrator Attribute Reference
 
 If the account is the master account or a delegated administrator for the organization, the following attributes are also exported:
 
diff --git a/website/docs/d/organizations_organizational_unit.html.markdown b/website/docs/d/organizations_organizational_unit.html.markdown
new file mode 100644
index 00000000000..11f8884972f
--- /dev/null
+++ b/website/docs/d/organizations_organizational_unit.html.markdown
@@ -0,0 +1,40 @@
+---
+subcategory: "Organizations"
+layout: "aws"
+page_title: "AWS: aws_organizations_organizational_unit"
+description: |-
+  Terraform data source for getting an AWS Organizations Organizational Unit.
+---
+
+# Data Source: aws_organizations_organizational_unit
+
+Terraform data source for getting an AWS Organizations Organizational Unit.
+
+## Example Usage
+
+### Basic Usage
+
+```terraform
+data "aws_organizations_organization" "org" {}
+
+data "aws_organizations_organizational_unit" "ou" {
+  parent_id = data.aws_organizations_organization.org.roots[0].id
+  name      = "dev"
+}
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `parent_id` - (Required) Parent ID of the organizational unit.
+
+* `name` - (Required) Name of the organizational unit
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the organizational unit
+
+* `id` - ID of the organizational unit
diff --git a/website/docs/d/organizations_organizational_unit_child_accounts.html.markdown b/website/docs/d/organizations_organizational_unit_child_accounts.html.markdown
index fb19afb9291..9817b62679c 100644
--- a/website/docs/d/organizations_organizational_unit_child_accounts.html.markdown
+++ b/website/docs/d/organizations_organizational_unit_child_accounts.html.markdown
@@ -24,7 +24,9 @@ data "aws_organizations_organizational_unit_child_accounts" "accounts" {
 
 * `parent_id` - (Required) The parent ID of the accounts.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `accounts` - List of child accounts, which have the following attributes:
     * `arn` - The Amazon Resource Name (ARN) of the account.
diff --git a/website/docs/d/organizations_organizational_unit_descendant_accounts.html.markdown b/website/docs/d/organizations_organizational_unit_descendant_accounts.html.markdown
index 032c246e436..6ce76a6b33e 100644
--- a/website/docs/d/organizations_organizational_unit_descendant_accounts.html.markdown
+++ b/website/docs/d/organizations_organizational_unit_descendant_accounts.html.markdown
@@ -24,7 +24,9 @@ data "aws_organizations_organizational_unit_descendant_accounts" "accounts" {
 
 * `parent_id` - (Required) The parent ID of the accounts.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `accounts` - List of child accounts, which have the following attributes:
     * `arn` - The Amazon Resource Name (ARN) of the account.
diff --git a/website/docs/d/organizations_organizational_units.html.markdown b/website/docs/d/organizations_organizational_units.html.markdown
index af46afc44a2..e568c7e9223 100644
--- a/website/docs/d/organizations_organizational_units.html.markdown
+++ b/website/docs/d/organizations_organizational_units.html.markdown
@@ -24,7 +24,9 @@ data "aws_organizations_organizational_units" "ou" {
 
 * `parent_id` - (Required) Parent ID of the organizational unit.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `children` - List of child organizational units, which have the following attributes:
     * `arn` - ARN of the organizational unit
diff --git a/website/docs/d/organizations_policies.html.markdown b/website/docs/d/organizations_policies.html.markdown
index 17be2be0595..3a8cce1b7a4 100644
--- a/website/docs/d/organizations_policies.html.markdown
+++ b/website/docs/d/organizations_policies.html.markdown
@@ -31,6 +31,8 @@ The following arguments are required:
 
 * `filter` - (Required) The type of policies to be returned in the response. Valid values are `SERVICE_CONTROL_POLICY | TAG_POLICY | BACKUP_POLICY | AISERVICES_OPT_OUT_POLICY`
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `ids` - List of all the policy ids found.
diff --git a/website/docs/d/organizations_policies_for_target.html.markdown b/website/docs/d/organizations_policies_for_target.html.markdown
index 8ff4444f1b0..d7952fa2dfb 100644
--- a/website/docs/d/organizations_policies_for_target.html.markdown
+++ b/website/docs/d/organizations_policies_for_target.html.markdown
@@ -35,6 +35,8 @@ The following arguments are required:
 * `target_id` - (Required) The root (string that begins with "r-" followed by 4-32 lowercase letters or digits), account (12 digit string), or Organizational Unit (string starting with "ou-" followed by 4-32 lowercase letters or digits. This string is followed by a second "-" dash and from 8-32 additional lowercase letters or digits.)
 * `filter` - (Required) Must supply one of the 4 different policy filters for a target (SERVICE_CONTROL_POLICY | TAG_POLICY | BACKUP_POLICY | AISERVICES_OPT_OUT_POLICY)
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `ids` - List of all the policy ids found.
diff --git a/website/docs/d/organizations_policy.html.markdown b/website/docs/d/organizations_policy.html.markdown
index 03b4b4c9320..cc7deeb961b 100644
--- a/website/docs/d/organizations_policy.html.markdown
+++ b/website/docs/d/organizations_policy.html.markdown
@@ -32,9 +32,9 @@ The following arguments are required:
 
 * `policy_id` - (Required) The unique identifier (ID) of the policy that you want more details on. Policy id starts with a "p-" followed by 8-28 lowercase or uppercase letters, digits, and underscores.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - The Amazon Resource Name of the policy.
 * `aws_managed` - Indicates if a policy is an AWS managed policy.
diff --git a/website/docs/d/organizations_resource_tags.html.markdown b/website/docs/d/organizations_resource_tags.html.markdown
index 90d25c42c10..28fd212e4c9 100644
--- a/website/docs/d/organizations_resource_tags.html.markdown
+++ b/website/docs/d/organizations_resource_tags.html.markdown
@@ -31,8 +31,8 @@ You can specify any of the following taggable resources.
 * Root – specify the root ID that begins with `r-` and looks similar to: `r-1a2b`
 * Policy – specify the policy ID that begins with `p-` and looks similar to: `p-12abcdefg3`
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `tags` - Map of key=value pairs for each tag set on the resource.
diff --git a/website/docs/d/outposts_asset.html.markdown b/website/docs/d/outposts_asset.html.markdown
index cf35b3dd4a4..e22a195c967 100644
--- a/website/docs/d/outposts_asset.html.markdown
+++ b/website/docs/d/outposts_asset.html.markdown
@@ -34,7 +34,7 @@ The following arguments are required:
 
 ## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `asset_type` - Type of the asset.
 * `host_id` - Host ID of the Dedicated Hosts on the asset, if a Dedicated Host is provisioned.
diff --git a/website/docs/d/outposts_assets.html.markdown b/website/docs/d/outposts_assets.html.markdown
index b0cca185323..2d20969a5cb 100644
--- a/website/docs/d/outposts_assets.html.markdown
+++ b/website/docs/d/outposts_assets.html.markdown
@@ -40,7 +40,7 @@ data "aws_outposts_assets" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `arn` - (Required) Outpost ARN.
 * `host_id_filter` - (Optional) Filters by list of Host IDs of a Dedicated Host.
@@ -48,6 +48,6 @@ The following arguments are supported:
 
 ## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `asset_ids` - List of all the asset ids found. This data source will fail if none are found.
diff --git a/website/docs/d/outposts_outpost.html.markdown b/website/docs/d/outposts_outpost.html.markdown
index 3f3f84a3ab6..9646f3712e9 100644
--- a/website/docs/d/outposts_outpost.html.markdown
+++ b/website/docs/d/outposts_outpost.html.markdown
@@ -20,7 +20,7 @@ data "aws_outposts_outpost" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `id` - (Optional) Identifier of the Outpost.
 * `name` - (Optional) Name of the Outpost.
@@ -29,7 +29,7 @@ The following arguments are supported:
 
 ## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `availability_zone` - Availability Zone name.
 * `availability_zone_id` - Availability Zone identifier.
diff --git a/website/docs/d/outposts_outpost_instance_type.html.markdown b/website/docs/d/outposts_outpost_instance_type.html.markdown
index 911dbfb3435..8df5204f8b7 100644
--- a/website/docs/d/outposts_outpost_instance_type.html.markdown
+++ b/website/docs/d/outposts_outpost_instance_type.html.markdown
@@ -38,6 +38,6 @@ The following arguments are optional:
 
 ## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - Outpost identifier.
diff --git a/website/docs/d/outposts_outpost_instance_types.html.markdown b/website/docs/d/outposts_outpost_instance_types.html.markdown
index e589c8ed3f4..0df8102f3ee 100644
--- a/website/docs/d/outposts_outpost_instance_types.html.markdown
+++ b/website/docs/d/outposts_outpost_instance_types.html.markdown
@@ -26,6 +26,6 @@ The following arguments are required:
 
 ## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `instance_types` - Set of instance types.
diff --git a/website/docs/d/outposts_outposts.html.markdown b/website/docs/d/outposts_outposts.html.markdown
index a9782ee2146..788840474f0 100644
--- a/website/docs/d/outposts_outposts.html.markdown
+++ b/website/docs/d/outposts_outposts.html.markdown
@@ -20,7 +20,7 @@ data "aws_outposts_outposts" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `availability_zone` - (Optional) Availability Zone name.
 * `availability_zone_id` - (Optional) Availability Zone identifier.
@@ -29,7 +29,7 @@ The following arguments are supported:
 
 ## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arns` - Set of Amazon Resource Names (ARNs).
 * `id` - AWS Region.
diff --git a/website/docs/d/outposts_site.html.markdown b/website/docs/d/outposts_site.html.markdown
index 778e6ece86d..8acc629a7ec 100644
--- a/website/docs/d/outposts_site.html.markdown
+++ b/website/docs/d/outposts_site.html.markdown
@@ -20,14 +20,14 @@ data "aws_outposts_site" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `id` - (Optional) Identifier of the Site.
 * `name` - (Optional) Name of the Site.
 
 ## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `account_id` - AWS Account identifier.
 * `description` - Description.
diff --git a/website/docs/d/outposts_sites.html.markdown b/website/docs/d/outposts_sites.html.markdown
index c9e623578ab..661404a2b06 100644
--- a/website/docs/d/outposts_sites.html.markdown
+++ b/website/docs/d/outposts_sites.html.markdown
@@ -22,7 +22,7 @@ There are no arguments available for this data source.
 
 ## Attribute Reference
 
-The following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - AWS Region.
 * `ids` - Set of Outposts Site identifiers.
diff --git a/website/docs/d/partition.html.markdown b/website/docs/d/partition.html.markdown
index 5a3e37c658e..2daeaf9b0d5 100644
--- a/website/docs/d/partition.html.markdown
+++ b/website/docs/d/partition.html.markdown
@@ -35,7 +35,9 @@ data "aws_iam_policy_document" "s3_policy" {
 
 There are no arguments available for this data source.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `dns_suffix` - Base DNS domain name for the current partition (e.g., `amazonaws.com` in AWS Commercial, `amazonaws.com.cn` in AWS China).
 * `id` - Identifier of the current partition (e.g., `aws` in AWS Commercial, `aws-cn` in AWS China).
diff --git a/website/docs/d/prefix_list.html.markdown b/website/docs/d/prefix_list.html.markdown
index 181d717cfe1..7c1e28b816c 100644
--- a/website/docs/d/prefix_list.html.markdown
+++ b/website/docs/d/prefix_list.html.markdown
@@ -69,14 +69,14 @@ whose data will be exported as attributes.
 
 ### filter Configuration Block
 
-The following arguments are supported by the `filter` configuration block:
+The `filter` configuration block supports the following arguments:
 
 * `name` - (Required) Name of the filter field. Valid values can be found in the [EC2 DescribePrefixLists API Reference](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribePrefixLists.html).
 * `values` - (Required) Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - ID of the selected prefix list.
 * `name` - Name of the selected prefix list.
diff --git a/website/docs/d/pricing_product.html.markdown b/website/docs/d/pricing_product.html.markdown
index 86873ca6148..fcdfc127ec8 100644
--- a/website/docs/d/pricing_product.html.markdown
+++ b/website/docs/d/pricing_product.html.markdown
@@ -80,6 +80,8 @@ data "aws_pricing_product" "example" {
 * `field` (Required) Product attribute name that you want to filter on.
 * `value` (Required) Product attribute value that you want to filter on.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `result` - Set to the product returned from the API.
diff --git a/website/docs/d/prometheus_workspace.html.markdown b/website/docs/d/prometheus_workspace.html.markdown
index 0821aab9fe7..2e17ae00cf7 100644
--- a/website/docs/d/prometheus_workspace.html.markdown
+++ b/website/docs/d/prometheus_workspace.html.markdown
@@ -26,9 +26,9 @@ The following arguments are required:
 
 * `workspace_id` - (Required) Prometheus workspace ID.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the Prometheus workspace.
 * `created_date` - Creation date of the Prometheus workspace.
diff --git a/website/docs/d/prometheus_workspaces.html.markdown b/website/docs/d/prometheus_workspaces.html.markdown
index bcddb9cfc89..af48f35d900 100644
--- a/website/docs/d/prometheus_workspaces.html.markdown
+++ b/website/docs/d/prometheus_workspaces.html.markdown
@@ -29,13 +29,13 @@ data "aws_prometheus_workspaces" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `alias_prefix` - (Optional) Limits results to workspaces with aliases that begin with this value.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `aliases` - List of aliases of the matched Prometheus workspaces.
 * `arns` - List of ARNs of the matched Prometheus workspaces.
diff --git a/website/docs/d/qldb_ledger.html.markdown b/website/docs/d/qldb_ledger.html.markdown
index 8fda6419480..6b5164a6581 100644
--- a/website/docs/d/qldb_ledger.html.markdown
+++ b/website/docs/d/qldb_ledger.html.markdown
@@ -22,7 +22,7 @@ data "aws_qldb_ledger" "example" {
 
 * `name` - (Required) Friendly name of the ledger to match.
 
-## Attributes Reference
+## Attribute Reference
 
 See the [QLDB Ledger Resource](/docs/providers/aws/r/qldb_ledger.html) for details on the
 returned attributes - they are identical.
diff --git a/website/docs/d/quicksight_data_set.html.markdown b/website/docs/d/quicksight_data_set.html.markdown
index e08d309d3ae..a04111aed8b 100644
--- a/website/docs/d/quicksight_data_set.html.markdown
+++ b/website/docs/d/quicksight_data_set.html.markdown
@@ -30,7 +30,7 @@ The following arguments are optional:
 
 * `aws_account_id` - (Optional) AWS account ID.
 
-## Attributes Reference
+## Attribute Reference
 
 See the [Data Set Resource](/docs/providers/aws/r/quicksight_data_set.html) for details on the
 returned attributes - they are identical.
diff --git a/website/docs/d/quicksight_group.html.markdown b/website/docs/d/quicksight_group.html.markdown
index 283f9fe016a..425f0b062f9 100644
--- a/website/docs/d/quicksight_group.html.markdown
+++ b/website/docs/d/quicksight_group.html.markdown
@@ -33,7 +33,9 @@ The following arguments are optional:
 * `aws_account_id` - (Optional) AWS account ID.
 * `namespace` - (Optional) QuickSight namespace. Defaults to `default`.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - The Amazon Resource Name (ARN) for the group.
 * `description` - The group description.
diff --git a/website/docs/d/quicksight_theme.html.markdown b/website/docs/d/quicksight_theme.html.markdown
index 8cf386d38e9..a94c67376f0 100644
--- a/website/docs/d/quicksight_theme.html.markdown
+++ b/website/docs/d/quicksight_theme.html.markdown
@@ -30,9 +30,9 @@ The following arguments are optional:
 
 * `aws_account_id` - AWS account ID.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the theme.
 * `base_theme_id` - The ID of the theme that a custom theme will inherit from. All themes inherit from one of the starting themes defined by Amazon QuickSight.
diff --git a/website/docs/d/quicksight_user.html.markdown b/website/docs/d/quicksight_user.html.markdown
index 285f088be6a..0486651125b 100644
--- a/website/docs/d/quicksight_user.html.markdown
+++ b/website/docs/d/quicksight_user.html.markdown
@@ -33,7 +33,9 @@ The following arguments are optional:
 * `aws_account_id` - (Optional) AWS account ID.
 * `namespace` - (Optional) QuickSight namespace. Defaults to `default`.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `active` - The active status of user. When you create an Amazon QuickSight user that’s not an IAM user or an Active Directory user, that user is inactive until they sign in and provide a password.
 * `arn` - The Amazon Resource Name (ARN) for the user.
diff --git a/website/docs/d/ram_resource_share.html.markdown b/website/docs/d/ram_resource_share.html.markdown
index 5b31a5fb573..f30d3e8bd5a 100644
--- a/website/docs/d/ram_resource_share.html.markdown
+++ b/website/docs/d/ram_resource_share.html.markdown
@@ -35,7 +35,7 @@ data "aws_ram_resource_share" "tag_filter" {
 
 ## Argument Reference
 
-The following Arguments are supported
+This data source supports the following arguments:
 
 * `name` - (Required) Name of the resource share to retrieve.
 * `resource_owner` (Required) Owner of the resource share. Valid values are `SELF` or `OTHER-ACCOUNTS`.
@@ -45,12 +45,13 @@ The following Arguments are supported
     * `name` - (Required) Name of the tag key to filter on.
     * `values` - (Required) Value of the tag key.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the resource share.
 * `id` - ARN of the resource share.
-* `status` - Status of the RAM share.
 * `owning_account_id` - ID of the AWS account that owns the resource share.
-* `tags` - Tags attached to the RAM share
+* `resource_arns` - A list of resource ARNs associated with the resource share.
+* `status` - Status of the resource share.
+* `tags` - Tags attached to the resource share.
diff --git a/website/docs/d/rds_certificate.html.markdown b/website/docs/d/rds_certificate.html.markdown
index 6991995eff7..308fdcb4889 100644
--- a/website/docs/d/rds_certificate.html.markdown
+++ b/website/docs/d/rds_certificate.html.markdown
@@ -20,14 +20,14 @@ data "aws_rds_certificate" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `id` - (Optional) Certificate identifier. For example, `rds-ca-2019`.
 * `latest_valid_till` - (Optional) When enabled, returns the certificate with the latest `ValidTill`.
 
 ## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the certificate.
 * `certificate_type` - Type of certificate. For example, `CA`.
diff --git a/website/docs/d/rds_cluster.html.markdown b/website/docs/d/rds_cluster.html.markdown
index 04844774116..a100376b0e1 100644
--- a/website/docs/d/rds_cluster.html.markdown
+++ b/website/docs/d/rds_cluster.html.markdown
@@ -20,11 +20,11 @@ data "aws_rds_cluster" "clusterName" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `cluster_identifier` - (Required) Cluster identifier of the RDS cluster.
 
-## Attributes Reference
+## Attribute Reference
 
 See the [RDS Cluster Resource](/docs/providers/aws/r/rds_cluster.html) for details on the
 returned attributes - they are identical for all attributes, except the `tags_all`. If you need to get the tags for this resource, use the attribute `tags` as described below.
diff --git a/website/docs/d/rds_clusters.html.markdown b/website/docs/d/rds_clusters.html.markdown
index 9e4cd9f3b8f..cebe855629c 100644
--- a/website/docs/d/rds_clusters.html.markdown
+++ b/website/docs/d/rds_clusters.html.markdown
@@ -31,14 +31,14 @@ The following arguments are optional:
 
 ### filter Configuration block
 
-The following arguments are supported by the `filter` configuration block:
+The `filter` configuration block supports the following arguments:
 
 * `name` - (Required) Name of the filter field. Valid values can be found in the [RDS DescribeDBClusters API Reference](https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeDBClusters.html).
 * `values` - (Required) Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `cluster_arns` - Set of cluster ARNs of the matched RDS clusters.
 * `cluster_identifiers` - Set of ARNs of cluster identifiers of the matched RDS clusters.
diff --git a/website/docs/d/rds_engine_version.html.markdown b/website/docs/d/rds_engine_version.html.markdown
new file mode 100644
index 00000000000..34573625de4
--- /dev/null
+++ b/website/docs/d/rds_engine_version.html.markdown
@@ -0,0 +1,68 @@
+---
+subcategory: "RDS (Relational Database)"
+layout: "aws"
+page_title: "AWS: aws_rds_engine_version"
+description: |-
+  Information about an RDS engine version.
+---
+
+# Data Source: aws_rds_engine_version
+
+Information about an RDS engine version.
+
+## Example Usage
+
+### Basic Usage
+
+```terraform
+data "aws_rds_engine_version" "test" {
+  engine             = "mysql"
+  preferred_versions = ["8.0.27", "8.0.26"]
+}
+```
+
+### With `filter`
+
+```terraform
+data "aws_rds_engine_version" "test" {
+  engine      = "aurora-postgresql"
+  version     = "10.14"
+  include_all = true
+
+  filter {
+    name   = "engine-mode"
+    values = ["serverless"]
+  }
+}
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `engine` - (Required) DB engine. Engine values include `aurora`, `aurora-mysql`, `aurora-postgresql`, `docdb`, `mariadb`, `mysql`, `neptune`, `oracle-ee`, `oracle-se`, `oracle-se1`, `oracle-se2`, `postgres`, `sqlserver-ee`, `sqlserver-ex`, `sqlserver-se`, and `sqlserver-web`.
+* `default_only` - (Optional) When set to `true`, the default version for the specified `engine` or combination of `engine` and major `version` will be returned. Can be used to limit responses to a single version when they would otherwise fail for returning multiple versions.
+* `filter` - (Optional) One or more name/value pairs to filter off of. There are several valid keys; for a full reference, check out [describe-db-engine-versions in the AWS CLI reference](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/rds/describe-db-engine-versions.html).
+* `include_all` - (Optional) When set to `true`, the specified `version` or member of `preferred_versions` will be returned even if it is `deprecated`. Otherwise, only `available` versions will be returned.
+* `parameter_group_family` - (Optional) Name of a specific DB parameter group family. Examples of parameter group families are `mysql8.0`, `mariadb10.4`, and `postgres12`.
+* `preferred_versions` - (Optional) Ordered list of preferred engine versions. The first match in this list will be returned. If no preferred matches are found and the original search returned more than one result, an error is returned. If both the `version` and `preferred_versions` arguments are not configured, the data source will return the default version for the engine.
+* `version` - (Optional) Version of the DB engine. For example, `5.7.22`, `10.1.34`, and `12.3`. If both the `version` and `preferred_versions` arguments are not configured, the data source will return the default version for the engine.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `default_character_set` - The default character set for new instances of this engine version.
+* `engine_description` - Description of the database engine.
+* `exportable_log_types` - Set of log types that the database engine has available for export to CloudWatch Logs.
+* `status` - Status of the DB engine version, either available or deprecated.
+* `supported_character_sets` - Set of the character sets supported by this engine.
+* `supported_feature_names` - Set of features supported by the DB engine.
+* `supported_modes` - Set of the supported DB engine modes.
+* `supported_timezones` - Set of the time zones supported by this engine.
+* `supports_global_databases` - Indicates whether you can use Aurora global databases with a specific DB engine version.
+* `supports_log_exports_to_cloudwatch` - Indicates whether the engine version supports exporting the log types specified by `exportable_log_types` to CloudWatch Logs.
+* `supports_parallel_query` - Indicates whether you can use Aurora parallel query with a specific DB engine version.
+* `supports_read_replica` - Indicates whether the database engine version supports read replicas.
+* `valid_upgrade_targets` - Set of engine versions that this database engine version can be upgraded to.
+* `version_description` - Description of the database engine version.
diff --git a/website/docs/d/rds_engine_version.markdown b/website/docs/d/rds_engine_version.markdown
deleted file mode 100644
index 6fdb1c69b82..00000000000
--- a/website/docs/d/rds_engine_version.markdown
+++ /dev/null
@@ -1,68 +0,0 @@
----
-subcategory: "RDS (Relational Database)"
-layout: "aws"
-page_title: "AWS: aws_rds_engine_version"
-description: |-
-  Information about an RDS engine version.
----
-
-# Data Source: aws_rds_engine_version
-
-Information about an RDS engine version.
-
-## Example Usage
-
-### Basic Usage
-
-```terraform
-data "aws_rds_engine_version" "test" {
-  engine             = "mysql"
-  preferred_versions = ["8.0.27", "8.0.26"]
-}
-```
-
-### With `filter`
-
-```terraform
-data "aws_rds_engine_version" "test" {
-  engine      = "aurora-postgresql"
-  version     = "10.14"
-  include_all = true
-
-  filter {
-    name   = "engine-mode"
-    values = ["serverless"]
-  }
-}
-```
-
-## Argument Reference
-
-The following arguments are supported:
-
-* `engine` - (Required) DB engine. Engine values include `aurora`, `aurora-mysql`, `aurora-postgresql`, `docdb`, `mariadb`, `mysql`, `neptune`, `oracle-ee`, `oracle-se`, `oracle-se1`, `oracle-se2`, `postgres`, `sqlserver-ee`, `sqlserver-ex`, `sqlserver-se`, and `sqlserver-web`.
-* `default_only` - (Optional) When set to `true`, the default version for the specified `engine` or combination of `engine` and major `version` will be returned. Can be used to limit responses to a single version when they would otherwise fail for returning multiple versions.
-* `filter` - (Optional) One or more name/value pairs to filter off of. There are several valid keys; for a full reference, check out [describe-db-engine-versions in the AWS CLI reference](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/rds/describe-db-engine-versions.html).
-* `include_all` - (Optional) When set to `true`, the specified `version` or member of `preferred_versions` will be returned even if it is `deprecated`. Otherwise, only `available` versions will be returned.
-* `parameter_group_family` - (Optional) Name of a specific DB parameter group family. Examples of parameter group families are `mysql8.0`, `mariadb10.4`, and `postgres12`.
-* `preferred_versions` - (Optional) Ordered list of preferred engine versions. The first match in this list will be returned. If no preferred matches are found and the original search returned more than one result, an error is returned. If both the `version` and `preferred_versions` arguments are not configured, the data source will return the default version for the engine.
-* `version` - (Optional) Version of the DB engine. For example, `5.7.22`, `10.1.34`, and `12.3`. If both the `version` and `preferred_versions` arguments are not configured, the data source will return the default version for the engine.
-
-## Attribute Reference
-
-In addition to all arguments above, the following attributes are exported:
-
-* `default_character_set` - The default character set for new instances of this engine version.
-* `engine_description` - Description of the database engine.
-* `exportable_log_types` - Set of log types that the database engine has available for export to CloudWatch Logs.
-* `status` - Status of the DB engine version, either available or deprecated.
-* `supported_character_sets` - Set of the character sets supported by this engine.
-* `supported_feature_names` - Set of features supported by the DB engine.
-* `supported_modes` - Set of the supported DB engine modes.
-* `supported_timezones` - Set of the time zones supported by this engine.
-* `supports_global_databases` - Indicates whether you can use Aurora global databases with a specific DB engine version.
-* `supports_log_exports_to_cloudwatch` - Indicates whether the engine version supports exporting the log types specified by `exportable_log_types` to CloudWatch Logs.
-* `supports_parallel_query` - Indicates whether you can use Aurora parallel query with a specific DB engine version.
-* `supports_read_replica` - Indicates whether the database engine version supports read replicas.
-* `valid_upgrade_targets` - Set of engine versions that this database engine version can be upgraded to.
-* `version_description` - Description of the database engine version.
diff --git a/website/docs/d/rds_orderable_db_instance.html.markdown b/website/docs/d/rds_orderable_db_instance.html.markdown
new file mode 100644
index 00000000000..2aac944e96d
--- /dev/null
+++ b/website/docs/d/rds_orderable_db_instance.html.markdown
@@ -0,0 +1,75 @@
+---
+subcategory: "RDS (Relational Database)"
+layout: "aws"
+page_title: "AWS: aws_rds_orderable_db_instance"
+description: |-
+  Information about RDS orderable DB instances.
+---
+
+# Data Source: aws_rds_orderable_db_instance
+
+Information about RDS orderable DB instances and valid parameter combinations.
+
+## Example Usage
+
+```terraform
+data "aws_rds_orderable_db_instance" "test" {
+  engine         = "mysql"
+  engine_version = "5.7.22"
+  license_model  = "general-public-license"
+  storage_type   = "standard"
+
+  preferred_instance_classes = ["db.r6.xlarge", "db.m4.large", "db.t3.small"]
+}
+```
+
+Valid parameter combinations can also be found with `preferred_engine_versions` and/or `preferred_instance_classes`.
+
+```terraform
+data "aws_rds_orderable_db_instance" "test" {
+  engine        = "mysql"
+  license_model = "general-public-license"
+
+  preferred_engine_versions  = ["5.6.35", "5.6.41", "5.6.44"]
+  preferred_instance_classes = ["db.t2.small", "db.t3.medium", "db.t3.large"]
+}
+```
+
+## Argument Reference
+
+This data source supports the following arguments:
+
+* `availability_zone_group` - (Optional) Availability zone group.
+* `engine` - (Required) DB engine. Engine values include `aurora`, `aurora-mysql`, `aurora-postgresql`, `docdb`, `mariadb`, `mysql`, `neptune`, `oracle-ee`, `oracle-se`, `oracle-se1`, `oracle-se2`, `postgres`, `sqlserver-ee`, `sqlserver-ex`, `sqlserver-se`, and `sqlserver-web`.
+* `engine_version` - (Optional) Version of the DB engine. If none is provided, the AWS-defined default version will be used.
+* `instance_class` - (Optional) DB instance class. Examples of classes are `db.m3.2xlarge`, `db.t2.small`, and `db.m3.medium`.
+* `license_model` - (Optional) License model. Examples of license models are `general-public-license`, `bring-your-own-license`, and `amazon-license`.
+* `preferred_instance_classes` - (Optional) Ordered list of preferred RDS DB instance classes. The first match in this list will be returned. If no preferred matches are found and the original search returned more than one result, an error is returned.
+* `preferred_engine_versions` - (Optional) Ordered list of preferred RDS DB instance engine versions. The first match in this list will be returned. If no preferred matches are found and the original search returned more than one result, an error is returned.
+* `storage_type` - (Optional) Storage types. Examples of storage types are `standard`, `io1`, `gp2`, and `aurora`.
+* `supports_enhanced_monitoring` - (Optional) Enable this to ensure a DB instance supports Enhanced Monitoring at intervals from 1 to 60 seconds.
+* `supports_global_databases` - (Optional) Enable this to ensure a DB instance supports Aurora global databases with a specific combination of other DB engine attributes.
+* `supports_iam_database_authentication` - (Optional) Enable this to ensure a DB instance supports IAM database authentication.
+* `supports_iops` - (Optional) Enable this to ensure a DB instance supports provisioned IOPS.
+* `supports_kerberos_authentication` - (Optional) Enable this to ensure a DB instance supports Kerberos Authentication.
+* `supports_performance_insights` - (Optional) Enable this to ensure a DB instance supports Performance Insights.
+* `supports_storage_autoscaling` - (Optional) Enable this to ensure Amazon RDS can automatically scale storage for DB instances that use the specified DB instance class.
+* `supports_storage_encryption` - (Optional) Enable this to ensure a DB instance supports encrypted storage.
+* `vpc` - (Optional) Boolean that indicates whether to show only VPC or non-VPC offerings.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `availability_zones` - Availability zones where the instance is available.
+* `max_iops_per_db_instance` - Maximum total provisioned IOPS for a DB instance.
+* `max_iops_per_gib` - Maximum provisioned IOPS per GiB for a DB instance.
+* `max_storage_size` - Maximum storage size for a DB instance.
+* `min_iops_per_db_instance` - Minimum total provisioned IOPS for a DB instance.
+* `min_iops_per_gib` - Minimum provisioned IOPS per GiB for a DB instance.
+* `min_storage_size` - Minimum storage size for a DB instance.
+* `multi_az_capable` - Whether a DB instance is Multi-AZ capable.
+* `outpost_capable` - Whether a DB instance supports RDS on Outposts.
+* `read_replica_capable` - Whether a DB instance can have a read replica.
+* `supported_engine_modes` - A list of the supported DB engine modes.
+* `supported_network_types` - The network types supported by the DB instance (`IPV4` or `DUAL`).
diff --git a/website/docs/d/rds_orderable_db_instance.markdown b/website/docs/d/rds_orderable_db_instance.markdown
deleted file mode 100644
index 4e0fe15e89a..00000000000
--- a/website/docs/d/rds_orderable_db_instance.markdown
+++ /dev/null
@@ -1,75 +0,0 @@
----
-subcategory: "RDS (Relational Database)"
-layout: "aws"
-page_title: "AWS: aws_rds_orderable_db_instance"
-description: |-
-  Information about RDS orderable DB instances.
----
-
-# Data Source: aws_rds_orderable_db_instance
-
-Information about RDS orderable DB instances and valid parameter combinations.
-
-## Example Usage
-
-```terraform
-data "aws_rds_orderable_db_instance" "test" {
-  engine         = "mysql"
-  engine_version = "5.7.22"
-  license_model  = "general-public-license"
-  storage_type   = "standard"
-
-  preferred_instance_classes = ["db.r6.xlarge", "db.m4.large", "db.t3.small"]
-}
-```
-
-Valid parameter combinations can also be found with `preferred_engine_versions` and/or `preferred_instance_classes`.
-
-```terraform
-data "aws_rds_orderable_db_instance" "test" {
-  engine        = "mysql"
-  license_model = "general-public-license"
-
-  preferred_engine_versions  = ["5.6.35", "5.6.41", "5.6.44"]
-  preferred_instance_classes = ["db.t2.small", "db.t3.medium", "db.t3.large"]
-}
-```
-
-## Argument Reference
-
-The following arguments are supported:
-
-* `availability_zone_group` - (Optional) Availability zone group.
-* `engine` - (Required) DB engine. Engine values include `aurora`, `aurora-mysql`, `aurora-postgresql`, `docdb`, `mariadb`, `mysql`, `neptune`, `oracle-ee`, `oracle-se`, `oracle-se1`, `oracle-se2`, `postgres`, `sqlserver-ee`, `sqlserver-ex`, `sqlserver-se`, and `sqlserver-web`.
-* `engine_version` - (Optional) Version of the DB engine. If none is provided, the AWS-defined default version will be used.
-* `instance_class` - (Optional) DB instance class. Examples of classes are `db.m3.2xlarge`, `db.t2.small`, and `db.m3.medium`.
-* `license_model` - (Optional) License model. Examples of license models are `general-public-license`, `bring-your-own-license`, and `amazon-license`.
-* `preferred_instance_classes` - (Optional) Ordered list of preferred RDS DB instance classes. The first match in this list will be returned. If no preferred matches are found and the original search returned more than one result, an error is returned.
-* `preferred_engine_versions` - (Optional) Ordered list of preferred RDS DB instance engine versions. The first match in this list will be returned. If no preferred matches are found and the original search returned more than one result, an error is returned.
-* `storage_type` - (Optional) Storage types. Examples of storage types are `standard`, `io1`, `gp2`, and `aurora`.
-* `supports_enhanced_monitoring` - (Optional) Enable this to ensure a DB instance supports Enhanced Monitoring at intervals from 1 to 60 seconds.
-* `supports_global_databases` - (Optional) Enable this to ensure a DB instance supports Aurora global databases with a specific combination of other DB engine attributes.
-* `supports_iam_database_authentication` - (Optional) Enable this to ensure a DB instance supports IAM database authentication.
-* `supports_iops` - (Optional) Enable this to ensure a DB instance supports provisioned IOPS.
-* `supports_kerberos_authentication` - (Optional) Enable this to ensure a DB instance supports Kerberos Authentication.
-* `supports_performance_insights` - (Optional) Enable this to ensure a DB instance supports Performance Insights.
-* `supports_storage_autoscaling` - (Optional) Enable this to ensure Amazon RDS can automatically scale storage for DB instances that use the specified DB instance class.
-* `supports_storage_encryption` - (Optional) Enable this to ensure a DB instance supports encrypted storage.
-* `vpc` - (Optional) Boolean that indicates whether to show only VPC or non-VPC offerings.
-
-## Attribute Reference
-
-In addition to all arguments above, the following attributes are exported:
-
-* `availability_zones` - Availability zones where the instance is available.
-* `max_iops_per_db_instance` - Maximum total provisioned IOPS for a DB instance.
-* `max_iops_per_gib` - Maximum provisioned IOPS per GiB for a DB instance.
-* `max_storage_size` - Maximum storage size for a DB instance.
-* `min_iops_per_db_instance` - Minimum total provisioned IOPS for a DB instance.
-* `min_iops_per_gib` - Minimum provisioned IOPS per GiB for a DB instance.
-* `min_storage_size` - Minimum storage size for a DB instance.
-* `multi_az_capable` - Whether a DB instance is Multi-AZ capable.
-* `outpost_capable` - Whether a DB instance supports RDS on Outposts.
-* `read_replica_capable` - Whether a DB instance can have a read replica.
-* `supported_engine_modes` - A list of the supported DB engine modes.
-* `supported_network_types` - The network types supported by the DB instance (`IPV4` or `DUAL`).
diff --git a/website/docs/d/rds_reserved_instance_offering.html.markdown b/website/docs/d/rds_reserved_instance_offering.html.markdown
index 8d9108b4f27..a4c1bf90e80 100644
--- a/website/docs/d/rds_reserved_instance_offering.html.markdown
+++ b/website/docs/d/rds_reserved_instance_offering.html.markdown
@@ -24,7 +24,7 @@ data "aws_rds_reserved_instance_offering" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `db_instance_class` - (Required) DB instance class for the reserved DB instance.
 * `duration` - (Required) Duration of the reservation in years or seconds. Valid values are `1`, `3`, `31536000`, `94608000`
@@ -34,7 +34,7 @@ The following arguments are supported:
 
 ## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - Unique identifier for the reservation. Same as `offering_id`.
 * `currency_code` - Currency code for the reserved DB instance.
diff --git a/website/docs/d/redshift_cluster.html.markdown b/website/docs/d/redshift_cluster.html.markdown
index cacb7165136..41de46c8b51 100644
--- a/website/docs/d/redshift_cluster.html.markdown
+++ b/website/docs/d/redshift_cluster.html.markdown
@@ -43,13 +43,13 @@ resource "aws_kinesis_firehose_delivery_stream" "example_stream" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `cluster_identifier` - (Required) Cluster identifier
 
 ## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of cluster.
 * `allow_version_upgrade` - Whether major version upgrades can be applied during maintenance period
diff --git a/website/docs/d/redshift_cluster_credentials.html.markdown b/website/docs/d/redshift_cluster_credentials.html.markdown
index 83381a7e329..1ac2419d772 100644
--- a/website/docs/d/redshift_cluster_credentials.html.markdown
+++ b/website/docs/d/redshift_cluster_credentials.html.markdown
@@ -21,7 +21,7 @@ data "aws_redshift_cluster_credentials" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `auto_create` - (Optional)  Create a database user with the name specified for the user named in `db_user` if one does not exist.
 * `cluster_identifier` - (Required) Unique identifier of the cluster that contains the database for which your are requesting credentials.
@@ -32,7 +32,7 @@ The following arguments are supported:
 
 ## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `db_password` - Temporary password that authorizes the user name returned by `db_user` to log on to the database `db_name`.
 * `expiration` - Date and time the password in `db_password` expires.
diff --git a/website/docs/d/redshift_orderable_cluster.html.markdown b/website/docs/d/redshift_orderable_cluster.html.markdown
index 93f53e42682..be60b847e2c 100644
--- a/website/docs/d/redshift_orderable_cluster.html.markdown
+++ b/website/docs/d/redshift_orderable_cluster.html.markdown
@@ -21,7 +21,7 @@ data "aws_redshift_orderable_cluster" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `cluster_type` - (Optional) Reshift Cluster typeE.g., `multi-node` or `single-node`
 * `cluster_version` - (Optional) Redshift Cluster versionE.g., `1.0`
@@ -30,6 +30,6 @@ The following arguments are supported:
 
 ## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `availability_zones` - List of Availability Zone names where the Redshift Cluster is available.
diff --git a/website/docs/d/redshift_service_account.html.markdown b/website/docs/d/redshift_service_account.html.markdown
index 02c009f7ef9..e7044b0e9ea 100644
--- a/website/docs/d/redshift_service_account.html.markdown
+++ b/website/docs/d/redshift_service_account.html.markdown
@@ -65,7 +65,9 @@ resource "aws_s3_bucket_policy" "allow_audit_logging" {
 * `region` - (Optional) Name of the region whose AWS Redshift account ID is desired.
 Defaults to the region from the AWS provider configuration.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - ID of the AWS Redshift service account in the selected region.
 * `arn` - ARN of the AWS Redshift service account in the selected region.
diff --git a/website/docs/d/redshift_subnet_group.html.markdown b/website/docs/d/redshift_subnet_group.html.markdown
index 3a6ebe7cc5d..18b5c3c6b26 100644
--- a/website/docs/d/redshift_subnet_group.html.markdown
+++ b/website/docs/d/redshift_subnet_group.html.markdown
@@ -20,13 +20,13 @@ data "aws_redshift_subnet_group" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `name` - (Required) Name of the cluster subnet group for which information is requested.
 
 ## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the Redshift Subnet Group name.
 * `description` - Description of the Redshift Subnet group.
diff --git a/website/docs/d/redshiftserverless_credentials.html.markdown b/website/docs/d/redshiftserverless_credentials.html.markdown
index 3e37d78da20..e58a2c35c33 100644
--- a/website/docs/d/redshiftserverless_credentials.html.markdown
+++ b/website/docs/d/redshiftserverless_credentials.html.markdown
@@ -20,7 +20,7 @@ data "aws_redshiftserverless_credentials" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `workgroup_name` - (Required) The name of the workgroup associated with the database.
 * `db_name` - (Optional) The name of the database to get temporary authorization to log on to.
@@ -28,7 +28,7 @@ The following arguments are supported:
 
 ## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `db_password` - Temporary password that authorizes the user name returned by `db_user` to log on to the database `db_name`.
 * `db_user` - A database user name that is authorized to log on to the database `db_name` using the password `db_password` . If the specified `db_user` exists in the database, the new user name has the same database privileges as the user named in `db_user` . By default, the user is added to PUBLIC. the user doesn't exist in the database.
diff --git a/website/docs/d/redshiftserverless_namespace.html.markdown b/website/docs/d/redshiftserverless_namespace.html.markdown
index 8e7686da2dc..f64b3fe92cb 100644
--- a/website/docs/d/redshiftserverless_namespace.html.markdown
+++ b/website/docs/d/redshiftserverless_namespace.html.markdown
@@ -20,13 +20,13 @@ data "aws_redshiftserverless_namespace" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `namespace_name` - (Required) The name of the namespace.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `admin_username` - The username of the administrator for the first database created in the namespace.
 * `arn` - Amazon Resource Name (ARN) of the Redshift Serverless Namespace.
diff --git a/website/docs/d/redshiftserverless_workgroup.html.markdown b/website/docs/d/redshiftserverless_workgroup.html.markdown
index c323f40e4df..b7b22bca89e 100644
--- a/website/docs/d/redshiftserverless_workgroup.html.markdown
+++ b/website/docs/d/redshiftserverless_workgroup.html.markdown
@@ -26,9 +26,9 @@ The following arguments are required:
 
 * `workgroup_name` - (Required) The name of the workgroup associated with the database.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name (ARN) of the Redshift Serverless Workgroup.
 * `id` - The Redshift Workgroup Name.
diff --git a/website/docs/d/region.html.markdown b/website/docs/d/region.html.markdown
index 58a1f685b57..4325aad3ca0 100644
--- a/website/docs/d/region.html.markdown
+++ b/website/docs/d/region.html.markdown
@@ -34,9 +34,9 @@ exported as attributes.
 
 * `endpoint` - (Optional) EC2 endpoint of the region to select.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `name` - Name of the selected region.
 
diff --git a/website/docs/d/regions.html.markdown b/website/docs/d/regions.html.markdown
index abb5f01d8ef..a87008d538e 100644
--- a/website/docs/d/regions.html.markdown
+++ b/website/docs/d/regions.html.markdown
@@ -41,7 +41,7 @@ data "aws_regions" "current" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `all_regions` - (Optional) If true the source will query all regions regardless of availability.
 
@@ -49,14 +49,14 @@ The following arguments are supported:
 
 ### filter Configuration Block
 
-The following arguments are supported by the `filter` configuration block:
+The `filter` configuration block supports the following arguments:
 
 * `name` - (Required) Name of the filter field. Valid values can be found in the [describe-regions AWS CLI Reference][1].
 * `values` - (Required) Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - Identifier of the current partition (e.g., `aws` in AWS Commercial, `aws-cn` in AWS China).
 * `names` - Names of regions that meets the criteria.
diff --git a/website/docs/d/resourcegroupstaggingapi_resources.html.markdown b/website/docs/d/resourcegroupstaggingapi_resources.html.markdown
index 8e87f6fa1d1..1ea35245650 100644
--- a/website/docs/d/resourcegroupstaggingapi_resources.html.markdown
+++ b/website/docs/d/resourcegroupstaggingapi_resources.html.markdown
@@ -39,7 +39,7 @@ data "aws_resourcegroupstaggingapi_resources" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `exclude_compliant_resources` - (Optional) Specifies whether to exclude resources that are compliant with the tag policy. You can use this parameter only if the `include_compliance_details` argument is also set to `true`.
 * `include_compliance_details` - (Optional) Specifies whether to include details regarding the compliance with the effective tag policy.
@@ -57,9 +57,9 @@ If you don't specify a `tag_filter`, the response includes all resources that we
 * `key` - (Required) One part of a key-value pair that makes up a tag.
 * `values` - (Optional) Optional part of a key-value pair that make up a tag.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `resource_tag_mapping_list` - List of objects matching the search criteria.
     * `compliance_details` - List of objects with information that shows whether a resource is compliant with the effective tag policy, including details on any noncompliant tag keys.
diff --git a/website/docs/d/route.html.markdown b/website/docs/d/route.html.markdown
index 23553c37fe8..8c4c5002e6c 100644
--- a/website/docs/d/route.html.markdown
+++ b/website/docs/d/route.html.markdown
@@ -57,7 +57,7 @@ The following arguments are optional:
 * `transit_gateway_id` - (Optional) EC2 Transit Gateway ID of the Route belonging to the Route Table.
 * `vpc_peering_connection_id` - (Optional) VPC Peering Connection ID of the Route belonging to the Route Table.
 
-## Attributes Reference
+## Attribute Reference
 
 All of the argument attributes are also exported as result attributes when there is data available. For example, the `vpc_peering_connection_id` field will be empty when the route is attached to a Network Interface.
 
diff --git a/website/docs/d/route53_resolver_firewall_rules.html.markdown b/website/docs/d/route53_resolver_firewall_rules.html.markdown
index 77c31dafc89..2f2b6f0e3e2 100644
--- a/website/docs/d/route53_resolver_firewall_rules.html.markdown
+++ b/website/docs/d/route53_resolver_firewall_rules.html.markdown
@@ -29,7 +29,9 @@ The given filters must match exactly one resolver rule whose data will be export
 * `action` - (Optional) The action that DNS Firewall should take on a DNS query when it matches one of the domains in the rule's domain list.
 * `priority` - (Optional) The setting that determines the processing order of the rules in a rule group.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `firewall_rules` - List with information about the firewall rules. See details below.
 
diff --git a/website/docs/d/route53_resolver_rule.html.markdown b/website/docs/d/route53_resolver_rule.html.markdown
index 0007409c2e2..94b5326a9b2 100644
--- a/website/docs/d/route53_resolver_rule.html.markdown
+++ b/website/docs/d/route53_resolver_rule.html.markdown
@@ -32,9 +32,9 @@ The given filters must match exactly one resolver rule whose data will be export
 * `resolver_rule_id` (Optional) ID of the desired resolver rule. Conflicts with `domain_name`, `name`, `resolver_endpoint_id` and `rule_type`.
 * `rule_type` - (Optional) Rule type of the desired resolver rule. Valid values are `FORWARD`, `SYSTEM` and `RECURSIVE`. Conflicts with `resolver_rule_id`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - ID of the resolver rule.
 * `arn` - ARN (Amazon Resource Name) for the resolver rule.
diff --git a/website/docs/d/route53_resolver_rules.html.markdown b/website/docs/d/route53_resolver_rules.html.markdown
index 2073ad0132e..6fc50045ca2 100644
--- a/website/docs/d/route53_resolver_rules.html.markdown
+++ b/website/docs/d/route53_resolver_rules.html.markdown
@@ -53,9 +53,9 @@ The arguments of this data source act as filters for querying the available reso
 * `rule_type` (Optional) Rule type of the desired resolver rules. Valid values are `FORWARD`, `SYSTEM` and `RECURSIVE`.
 * `share_status` (Optional) Whether the desired resolver rules are shared and, if so, whether the current account is sharing the rules with another account, or another account is sharing the rules with the current account. Valid values are `NOT_SHARED`, `SHARED_BY_ME` or `SHARED_WITH_ME`
 
-## Attributes Reference
+## Attribute Reference
 
-The following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - AWS Region.
 * `resolver_rule_ids` - IDs of the matched resolver rules.
diff --git a/website/docs/d/route53_traffic_policy_document.html.markdown b/website/docs/d/route53_traffic_policy_document.html.markdown
index 818456de816..2b474a30122 100644
--- a/website/docs/d/route53_traffic_policy_document.html.markdown
+++ b/website/docs/d/route53_traffic_policy_document.html.markdown
@@ -209,8 +209,8 @@ The following arguments are optional:
 * `endpoint_reference` - (Optional) References to an endpoint.
 * `health_check` - (Optional) If you want to associate a health check with the endpoint or rule.
 
-## Attributes Reference
+## Attribute Reference
 
-The following attribute is exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `json` - Standard JSON policy document rendered based on the arguments above.
diff --git a/website/docs/d/route53_zone.html.markdown b/website/docs/d/route53_zone.html.markdown
index 6aad745088a..6993f7ee7f7 100644
--- a/website/docs/d/route53_zone.html.markdown
+++ b/website/docs/d/route53_zone.html.markdown
@@ -44,7 +44,7 @@ Hosted Zone. If you use `name` field for private Hosted Zone, you need to add `p
 * `vpc_id` - (Optional) Used with `name` field to get a private Hosted Zone associated with the vpc_id (in this case, private_zone is not mandatory).
 * `tags` - (Optional) Used with `name` field. A map of tags, each pair of which must exactly match a pair on the desired Hosted Zone.
 
-## Attributes Reference
+## Attribute Reference
 
 All of the argument attributes are also exported as
 result attributes. This data source will complete the data by populating
diff --git a/website/docs/d/route_table.html.markdown b/website/docs/d/route_table.html.markdown
index 0cc9e6a4934..bff030d82e8 100644
--- a/website/docs/d/route_table.html.markdown
+++ b/website/docs/d/route_table.html.markdown
@@ -52,9 +52,9 @@ The following arguments are required:
 * `name` - (Required) Name of the field to filter by, as defined by [the underlying AWS API](http://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeRouteTables.html).
 * `values` - (Required) Set of values that are accepted for the given field. A Route Table will be selected if any one of the given values matches.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to the arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the route table.
 * `associations` - List of associations with attributes detailed below.
diff --git a/website/docs/d/route_tables.html.markdown b/website/docs/d/route_tables.html.markdown
index bc445dc10f4..130d892139a 100644
--- a/website/docs/d/route_tables.html.markdown
+++ b/website/docs/d/route_tables.html.markdown
@@ -52,7 +52,9 @@ which take the following arguments:
 * `values` - (Required) Set of values that are accepted for the given field.
   A Route Table will be selected if any one of the given values matches.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - AWS Region.
 * `ids` - List of all the route table ids found.
diff --git a/website/docs/d/s3_account_public_access_block.html.markdown b/website/docs/d/s3_account_public_access_block.html.markdown
index a71ee89be75..9f669e3c2ec 100644
--- a/website/docs/d/s3_account_public_access_block.html.markdown
+++ b/website/docs/d/s3_account_public_access_block.html.markdown
@@ -19,13 +19,13 @@ data "aws_s3_account_public_access_block" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `account_id` - (Optional) AWS account ID to configure. Defaults to automatically determined account ID of the Terraform AWS provider.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - AWS account ID
 * `block_public_acls` - Whether or not Amazon S3 should block public ACLs for buckets in this account is enabled. Returns as `true` or `false`.
diff --git a/website/docs/d/s3_bucket.html.markdown b/website/docs/d/s3_bucket.html.markdown
index 8f924855349..c0a22f8dc6e 100644
--- a/website/docs/d/s3_bucket.html.markdown
+++ b/website/docs/d/s3_bucket.html.markdown
@@ -55,13 +55,13 @@ resource "aws_cloudfront_distribution" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `bucket` - (Required) Name of the bucket
 
 ## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - Name of the bucket.
 * `arn` - ARN of the bucket. Will be of format `arn:aws:s3:::bucketname`.
diff --git a/website/docs/d/s3_bucket_object.html.markdown b/website/docs/d/s3_bucket_object.html.markdown
index 2e6d905a3a9..4a9c252435c 100644
--- a/website/docs/d/s3_bucket_object.html.markdown
+++ b/website/docs/d/s3_bucket_object.html.markdown
@@ -57,15 +57,15 @@ resource "aws_lambda_function" "test_lambda" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `bucket` - (Required) Name of the bucket to read the object from. Alternatively, an [S3 access point](https://docs.aws.amazon.com/AmazonS3/latest/dev/using-access-points.html) ARN can be specified
 * `key` - (Required) Full path to the object inside the bucket
 * `version_id` - (Optional) Specific version ID of the object returned (defaults to latest version)
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `body` - Object data (see **limitations above** to understand cases in which this field is actually available)
 * `bucket_key_enabled` - (Optional) Whether or not to use [Amazon S3 Bucket Keys](https://docs.aws.amazon.com/AmazonS3/latest/dev/bucket-key.html) for SSE-KMS.
@@ -79,7 +79,7 @@ In addition to all arguments above, the following attributes are exported:
 * `expiration` - If the object expiration is configured (see [object lifecycle management](http://docs.aws.amazon.com/AmazonS3/latest/dev/object-lifecycle-mgmt.html)), the field includes this header. It includes the expiry-date and rule-id key value pairs providing object expiration information. The value of the rule-id is URL encoded.
 * `expires` - Date and time at which the object is no longer cacheable.
 * `last_modified` - Last modified date of the object in RFC1123 format (e.g., `Mon, 02 Jan 2006 15:04:05 MST`)
-* `metadata` - Map of metadata stored with the object in S3
+* `metadata` - Map of metadata stored with the object in S3. [Keys](https://developer.hashicorp.com/terraform/language/expressions/types#maps-objects) are always returned in lowercase.
 * `object_lock_legal_hold_status` - Indicates whether this object has an active [legal hold](https://docs.aws.amazon.com/AmazonS3/latest/dev/object-lock-overview.html#object-lock-legal-holds). This field is only returned if you have permission to view an object's legal hold status.
 * `object_lock_mode` - Object lock [retention mode](https://docs.aws.amazon.com/AmazonS3/latest/dev/object-lock-overview.html#object-lock-retention-modes) currently in place for this object.
 * `object_lock_retain_until_date` - The date and time when this object's object lock will expire.
diff --git a/website/docs/d/s3_bucket_objects.html.markdown b/website/docs/d/s3_bucket_objects.html.markdown
index 3c7b28c1862..6f7d66d0b93 100644
--- a/website/docs/d/s3_bucket_objects.html.markdown
+++ b/website/docs/d/s3_bucket_objects.html.markdown
@@ -32,7 +32,7 @@ data "aws_s3_object" "object_info" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `bucket` - (Required) Lists object keys in this S3 bucket. Alternatively, an [S3 access point](https://docs.aws.amazon.com/AmazonS3/latest/dev/using-access-points.html) ARN can be specified
 * `prefix` - (Optional) Limits results to object keys with this prefix (Default: none)
@@ -42,9 +42,9 @@ The following arguments are supported:
 * `start_after` - (Optional) Returns key names lexicographically after a specific object key in your bucket (Default: none; S3 lists object keys in UTF-8 character encoding in lexicographical order)
 * `fetch_owner` - (Optional) Boolean specifying whether to populate the owner list (Default: false)
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `keys` - List of strings representing object keys
 * `common_prefixes` - List of any keys between `prefix` and the next occurrence of `delimiter` (i.e., similar to subdirectories of the `prefix` "directory"); the list is only returned when you specify `delimiter`
diff --git a/website/docs/d/s3_bucket_policy.html.markdown b/website/docs/d/s3_bucket_policy.html.markdown
index 88e6d2b46a3..0bc3eb38073 100644
--- a/website/docs/d/s3_bucket_policy.html.markdown
+++ b/website/docs/d/s3_bucket_policy.html.markdown
@@ -26,12 +26,12 @@ output "foo" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `bucket` - (Required) Bucket name.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `policy` - IAM bucket policy.
diff --git a/website/docs/d/s3_object.html.markdown b/website/docs/d/s3_object.html.markdown
index 2f31c929833..65a8d0df481 100644
--- a/website/docs/d/s3_object.html.markdown
+++ b/website/docs/d/s3_object.html.markdown
@@ -55,19 +55,24 @@ resource "aws_lambda_function" "test_lambda" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `bucket` - (Required) Name of the bucket to read the object from. Alternatively, an [S3 access point](https://docs.aws.amazon.com/AmazonS3/latest/dev/using-access-points.html) ARN can be specified
+* `checksum_mode` - (Optional) To retrieve the object's checksum, this argument must be `ENABLED`. If you enable `checksum_mode` and the object is encrypted with KMS, you must have permission to use the `kms:Decrypt` action. Valid values: `ENABLED`
 * `key` - (Required) Full path to the object inside the bucket
 * `version_id` - (Optional) Specific version ID of the object returned (defaults to latest version)
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `body` - Object data (see **limitations above** to understand cases in which this field is actually available)
 * `bucket_key_enabled` - (Optional) Whether or not to use [Amazon S3 Bucket Keys](https://docs.aws.amazon.com/AmazonS3/latest/dev/bucket-key.html) for SSE-KMS.
 * `cache_control` - Caching behavior along the request/reply chain.
+* `checksum_crc32` - The base64-encoded, 32-bit CRC32 checksum of the object.
+* `checksum_crc32c` - The base64-encoded, 32-bit CRC32C checksum of the object.
+* `checksum_sha1` - The base64-encoded, 160-bit SHA-1 digest of the object.
+* `checksum_sha256` - The base64-encoded, 256-bit SHA-256 digest of the object.
 * `content_disposition` - Presentational information for the object.
 * `content_encoding` - What content encodings have been applied to the object and thus what decoding mechanisms must be applied to obtain the media-type referenced by the Content-Type header field.
 * `content_language` - Language the content is in.
@@ -77,7 +82,7 @@ In addition to all arguments above, the following attributes are exported:
 * `expiration` - If the object expiration is configured (see [object lifecycle management](http://docs.aws.amazon.com/AmazonS3/latest/dev/object-lifecycle-mgmt.html)), the field includes this header. It includes the expiry-date and rule-id key value pairs providing object expiration information. The value of the rule-id is URL encoded.
 * `expires` - Date and time at which the object is no longer cacheable.
 * `last_modified` - Last modified date of the object in RFC1123 format (e.g., `Mon, 02 Jan 2006 15:04:05 MST`)
-* `metadata` - Map of metadata stored with the object in S3
+* `metadata` - Map of metadata stored with the object in S3. [Keys](https://developer.hashicorp.com/terraform/language/expressions/types#maps-objects) are always returned in lowercase.
 * `object_lock_legal_hold_status` - Indicates whether this object has an active [legal hold](https://docs.aws.amazon.com/AmazonS3/latest/dev/object-lock-overview.html#object-lock-legal-holds). This field is only returned if you have permission to view an object's legal hold status.
 * `object_lock_mode` - Object lock [retention mode](https://docs.aws.amazon.com/AmazonS3/latest/dev/object-lock-overview.html#object-lock-retention-modes) currently in place for this object.
 * `object_lock_retain_until_date` - The date and time when this object's object lock will expire.
diff --git a/website/docs/d/s3_objects.html.markdown b/website/docs/d/s3_objects.html.markdown
index a94806e961e..8a6fe73f5a2 100644
--- a/website/docs/d/s3_objects.html.markdown
+++ b/website/docs/d/s3_objects.html.markdown
@@ -30,7 +30,7 @@ data "aws_s3_object" "object_info" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `bucket` - (Required) Lists object keys in this S3 bucket. Alternatively, an [S3 access point](https://docs.aws.amazon.com/AmazonS3/latest/dev/using-access-points.html) ARN can be specified
 * `prefix` - (Optional) Limits results to object keys with this prefix (Default: none)
@@ -39,12 +39,14 @@ The following arguments are supported:
 * `max_keys` - (Optional) Maximum object keys to return (Default: 1000)
 * `start_after` - (Optional) Returns key names lexicographically after a specific object key in your bucket (Default: none; S3 lists object keys in UTF-8 character encoding in lexicographical order)
 * `fetch_owner` - (Optional) Boolean specifying whether to populate the owner list (Default: false)
+* `request_payer` - (Optional) Confirms that the requester knows that they will be charged for the request. Bucket owners need not specify this parameter in their requests. If included, the only valid value is `requester`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `keys` - List of strings representing object keys
 * `common_prefixes` - List of any keys between `prefix` and the next occurrence of `delimiter` (i.e., similar to subdirectories of the `prefix` "directory"); the list is only returned when you specify `delimiter`
 * `id` - S3 Bucket.
 * `owners` - List of strings representing object owner IDs (see `fetch_owner` above)
+* `request_charged` - If present, indicates that the requester was successfully charged for the request.
diff --git a/website/docs/d/s3control_multi_region_access_point.html.markdown b/website/docs/d/s3control_multi_region_access_point.html.markdown
index 1804b71134e..24e1f4a7910 100644
--- a/website/docs/d/s3control_multi_region_access_point.html.markdown
+++ b/website/docs/d/s3control_multi_region_access_point.html.markdown
@@ -20,14 +20,14 @@ data "aws_s3control_multi_region_access_point" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `account_id` - (Optional) The AWS account ID of the S3 Multi-Region Access Point. Defaults to automatically determined account ID of the Terraform AWS provider.
 * `name` - (Required) The name of the Multi-Region Access Point.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `alias` - The alias for the Multi-Region Access Point.
 * `arn` - Amazon Resource Name (ARN) of the Multi-Region Access Point.
@@ -53,4 +53,5 @@ In addition to all arguments above, the following attributes are exported:
 ### regions
 
 * `bucket` - The name of the bucket.
+* `bucket_account_id` - The AWS account ID that owns the bucket.
 * `region` - The name of the region.
diff --git a/website/docs/d/sagemaker_prebuilt_ecr_image.html.markdown b/website/docs/d/sagemaker_prebuilt_ecr_image.html.markdown
index 85baa8273d2..8256cd3a1f9 100644
--- a/website/docs/d/sagemaker_prebuilt_ecr_image.html.markdown
+++ b/website/docs/d/sagemaker_prebuilt_ecr_image.html.markdown
@@ -25,16 +25,16 @@ data "aws_sagemaker_prebuilt_ecr_image" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `repository_name` - (Required) Name of the repository, which is generally the algorithm or library. Values include `blazingtext`, `factorization-machines`, `forecasting-deepar`, `image-classification`, `ipinsights`, `kmeans`, `knn`, `lda`, `linear-learner`, `mxnet-inference-eia`, `mxnet-inference`, `mxnet-training`, `ntm`, `object-detection`, `object2vec`, `pca`, `pytorch-inference-eia`, `pytorch-inference`, `pytorch-training`, `randomcutforest`, `sagemaker-scikit-learn`, `sagemaker-sparkml-serving`, `sagemaker-xgboost`, `semantic-segmentation`, `seq2seq`, `tensorflow-inference-eia`, `tensorflow-inference`, `tensorflow-training`, `huggingface-tensorflow-training`, `huggingface-tensorflow-inference`, `huggingface-pytorch-training`, and `huggingface-pytorch-inference`.
 * `dns_suffix` - (Optional) DNS suffix to use in the registry path. If not specified, the AWS provider sets it to the DNS suffix for the current region.
 * `image_tag` - (Optional) Image tag for the Docker image. If not specified, the AWS provider sets the value to `1`, which for many repositories indicates the latest version. Some repositories, such as XGBoost, do not support `1` or `latest` and specific version must be used.
 * `region` (Optional) - Region to use in the registry path. If not specified, the AWS provider sets it to the current region.
 
-## Attributes Reference
+## Attribute Reference
 
-The following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `registry_id` - Account ID containing the image. For example, `469771592824`.
 * `registry_path` - Docker image URL. For example, `341280168497.dkr.ecr.ca-central-1.amazonaws.com/sagemaker-sparkml-serving:2.4`.
diff --git a/website/docs/d/secretsmanager_random_password.html.markdown b/website/docs/d/secretsmanager_random_password.html.markdown
index 108dde1203f..9aa07bd729d 100644
--- a/website/docs/d/secretsmanager_random_password.html.markdown
+++ b/website/docs/d/secretsmanager_random_password.html.markdown
@@ -30,6 +30,8 @@ data "aws_secretsmanager_random_password" "test" {
 * `password_length` - (Optional) Length of the password.
 * `require_each_included_type` - (Optional) Specifies whether to include at least one upper and lowercase letter, one number, and one punctuation.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `random_password` - Random password.
diff --git a/website/docs/d/secretsmanager_secret.html.markdown b/website/docs/d/secretsmanager_secret.html.markdown
index 9a88cafd988..113a86c3da1 100644
--- a/website/docs/d/secretsmanager_secret.html.markdown
+++ b/website/docs/d/secretsmanager_secret.html.markdown
@@ -33,7 +33,9 @@ data "aws_secretsmanager_secret" "by-name" {
 * `arn` - (Optional) ARN of the secret to retrieve.
 * `name` - (Optional) Name of the secret to retrieve.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the secret.
 * `description` - Description of the secret.
diff --git a/website/docs/d/secretsmanager_secret_rotation.html.markdown b/website/docs/d/secretsmanager_secret_rotation.html.markdown
index 2ce6810db32..87a8f97568d 100644
--- a/website/docs/d/secretsmanager_secret_rotation.html.markdown
+++ b/website/docs/d/secretsmanager_secret_rotation.html.markdown
@@ -24,7 +24,9 @@ data "aws_secretsmanager_secret_rotation" "example" {
 
 * `secret_id` - (Required) Specifies the secret containing the version that you want to retrieve. You can specify either the ARN or the friendly name of the secret.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `rotation_enabled` - ARN of the secret.
 * `rotation_lambda_arn` - Decrypted part of the protected secret information that was originally provided as a string.
diff --git a/website/docs/d/secretsmanager_secret_version.html.markdown b/website/docs/d/secretsmanager_secret_version.html.markdown
index aa4be70b32d..a19c97db6b6 100644
--- a/website/docs/d/secretsmanager_secret_version.html.markdown
+++ b/website/docs/d/secretsmanager_secret_version.html.markdown
@@ -47,7 +47,9 @@ output "example" {
 * `version_id` - (Optional) Specifies the unique identifier of the version of the secret that you want to retrieve. Overrides `version_stage`.
 * `version_stage` - (Optional) Specifies the secret version that you want to retrieve by the staging label attached to the version. Defaults to `AWSCURRENT`.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the secret.
 * `id` - Unique identifier of this version of the secret.
diff --git a/website/docs/d/secretsmanager_secrets.html.markdown b/website/docs/d/secretsmanager_secrets.html.markdown
index b9d20a306f5..fd6ae140536 100644
--- a/website/docs/d/secretsmanager_secrets.html.markdown
+++ b/website/docs/d/secretsmanager_secrets.html.markdown
@@ -27,12 +27,14 @@ data "aws_secretsmanager_secrets" "example" {
 
 ## filter Configuration Block
 
-The following arguments are supported by the `filter` configuration block:
+The `filter` configuration block supports the following arguments:
 
 * `name` - (Required) Name of the filter field. Valid values can be found in the [Secrets Manager ListSecrets API Reference](https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_ListSecrets.html).
 * `values` - (Required) Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `arns` - Set of ARNs of the matched Secrets Manager secrets.
 * `names` - Set of names of the matched Secrets Manager secrets.
diff --git a/website/docs/d/security_group.html.markdown b/website/docs/d/security_group.html.markdown
index 1f60605eef1..9615ecb5d2d 100644
--- a/website/docs/d/security_group.html.markdown
+++ b/website/docs/d/security_group.html.markdown
@@ -58,7 +58,7 @@ which take the following arguments:
 * `values` - (Required) Set of values that are accepted for the given field.
   A Security Group will be selected if any one of the given values matches.
 
-## Attributes Reference
+## Attribute Reference
 
 All of the argument attributes except `filter` blocks are also exported as
 result attributes. This data source will complete the data by populating
diff --git a/website/docs/d/security_groups.html.markdown b/website/docs/d/security_groups.html.markdown
index 96e4e12d304..66d61e9be69 100644
--- a/website/docs/d/security_groups.html.markdown
+++ b/website/docs/d/security_groups.html.markdown
@@ -40,7 +40,9 @@ data "aws_security_groups" "test" {
 * `tags` - (Optional) Map of tags, each pair of which must exactly match for desired security groups.
 * `filter` - (Optional) One or more name/value pairs to use as filters. There are several valid keys, for a full reference, check out [describe-security-groups in the AWS CLI reference][1].
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `arns` - ARNs of the matched security groups.
 * `id` - AWS Region.
diff --git a/website/docs/d/serverlessapplicationrepository_application.html.markdown b/website/docs/d/serverlessapplicationrepository_application.html.markdown
index 2ea0ec9a9d4..eab70d58714 100644
--- a/website/docs/d/serverlessapplicationrepository_application.html.markdown
+++ b/website/docs/d/serverlessapplicationrepository_application.html.markdown
@@ -30,7 +30,9 @@ resource "aws_serverlessapplicationrepository_cloudformation_stack" "example" {
 * `application_id` - (Required) ARN of the application.
 * `semantic_version` - (Optional) Requested version of the application. By default, retrieves the latest version.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `application_id` - ARN of the application.
 * `name` - Name of the application.
diff --git a/website/docs/d/service.html.markdown b/website/docs/d/service.html.markdown
index de2ef64eaf1..757a716524e 100644
--- a/website/docs/d/service.html.markdown
+++ b/website/docs/d/service.html.markdown
@@ -50,8 +50,8 @@ The following arguments are optional:
 * `reverse_dns_prefix` - (Optional) Prefix of the service (_e.g.,_ `com.amazonaws` in AWS Commercial, `cn.com.amazonaws` in AWS China).
 * `service_id` - (Optional) Service (_e.g.,_ `s3`, `rds`, `ec2`). One of `dns_name`, `reverse_dns_name`, or `service_id` is required.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `supported` - Whether the service is supported in the region's partition. New services may not be listed immediately as supported.
diff --git a/website/docs/d/service_discovery_dns_namespace.html.markdown b/website/docs/d/service_discovery_dns_namespace.html.markdown
index 90815d8ee17..091377ba348 100644
--- a/website/docs/d/service_discovery_dns_namespace.html.markdown
+++ b/website/docs/d/service_discovery_dns_namespace.html.markdown
@@ -24,7 +24,9 @@ data "aws_service_discovery_dns_namespace" "test" {
 * `name` - (Required) Name of the namespace.
 * `type` - (Required) Type of the namespace. Allowed values are `DNS_PUBLIC` or `DNS_PRIVATE`.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the namespace.
 * `description` - Description of the namespace.
diff --git a/website/docs/d/service_discovery_http_namespace.html.markdown b/website/docs/d/service_discovery_http_namespace.html.markdown
index ce177b84114..d0e086bff78 100644
--- a/website/docs/d/service_discovery_http_namespace.html.markdown
+++ b/website/docs/d/service_discovery_http_namespace.html.markdown
@@ -18,13 +18,13 @@ data "aws_service_discovery_http_namespace" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `name` - (Required) Name of the http namespace.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - ID of a namespace.
 * `arn` - ARN that Amazon Route 53 assigns to the namespace when you create it.
diff --git a/website/docs/d/service_discovery_service.html.markdown b/website/docs/d/service_discovery_service.html.markdown
index 8b8a9336e8f..22907175db7 100644
--- a/website/docs/d/service_discovery_service.html.markdown
+++ b/website/docs/d/service_discovery_service.html.markdown
@@ -21,14 +21,14 @@ data "aws_service_discovery_service" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `name` - (Required) Name of the service.
 * `namespace_id` - (Required) ID of the namespace that the service belongs to.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - ID of the service.
 * `arn` - ARN of the service.
@@ -41,7 +41,7 @@ In addition to all arguments above, the following attributes are exported:
 
 ### dns_config
 
-The following arguments are supported:
+This argument supports the following arguments:
 
 * `namespace_id` - ID of the namespace to use for DNS configuration.
 * `dns_records` - An array that contains one DnsRecord object for each resource record set.
@@ -49,14 +49,14 @@ The following arguments are supported:
 
 #### dns_records
 
-The following arguments are supported:
+This argument supports the following arguments:
 
 * `ttl` - Amount of time, in seconds, that you want DNS resolvers to cache the settings for this resource record set.
 * `type` - Type of the resource, which indicates the value that Amazon Route 53 returns in response to DNS queries. Valid Values: A, AAAA, SRV, CNAME
 
 ### health_check_config
 
-The following arguments are supported:
+This argument supports the following arguments:
 
 * `failure_threshold` - Number of consecutive health checks. Maximum value of 10.
 * `resource_path` - Path that you want Route 53 to request when performing health checks. Route 53 automatically adds the DNS name for the service. If you don't specify a value, the default value is /.
@@ -64,6 +64,6 @@ The following arguments are supported:
 
 ### health_check_custom_config
 
-The following arguments are supported:
+This argument supports the following arguments:
 
 * `failure_threshold` -  The number of 30-second intervals that you want service discovery to wait before it changes the health status of a service instance.  Maximum value of 10.
diff --git a/website/docs/d/servicecatalog_constraint.html.markdown b/website/docs/d/servicecatalog_constraint.html.markdown
index bf69c9b3067..de1db56f335 100644
--- a/website/docs/d/servicecatalog_constraint.html.markdown
+++ b/website/docs/d/servicecatalog_constraint.html.markdown
@@ -6,7 +6,7 @@ description: |-
   Provides information on a Service Catalog Constraint
 ---
 
-# Data source: aws_servicecatalog_constraint
+# Data Source: aws_servicecatalog_constraint
 
 Provides information on a Service Catalog Constraint.
 
@@ -31,9 +31,9 @@ The following arguments are optional:
 
 * `accept_language` - (Optional) Language code. Valid values: `en` (English), `jp` (Japanese), `zh` (Chinese). Default value is `en`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `description` - Description of the constraint.
 * `owner` - Owner of the constraint.
diff --git a/website/docs/d/servicecatalog_launch_paths.html.markdown b/website/docs/d/servicecatalog_launch_paths.html.markdown
index 22ebc62d90b..4f952211b15 100644
--- a/website/docs/d/servicecatalog_launch_paths.html.markdown
+++ b/website/docs/d/servicecatalog_launch_paths.html.markdown
@@ -30,9 +30,9 @@ The following arguments are optional:
 
 * `accept_language` - (Optional) Language code. Valid values: `en` (English), `jp` (Japanese), `zh` (Chinese). Default value is `en`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `summaries` - Block with information about the launch path. See details below.
 
diff --git a/website/docs/d/servicecatalog_portfolio.html.markdown b/website/docs/d/servicecatalog_portfolio.html.markdown
index 438c25fd3f4..11ba65f2d0e 100644
--- a/website/docs/d/servicecatalog_portfolio.html.markdown
+++ b/website/docs/d/servicecatalog_portfolio.html.markdown
@@ -28,9 +28,9 @@ The following arguments are optional:
 
 * `accept_language` - (Optional) Language code. Valid values: `en` (English), `jp` (Japanese), `zh` (Chinese). Default value is `en`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - Portfolio ARN.
 * `created_time` - Time the portfolio was created.
diff --git a/website/docs/d/servicecatalog_portfolio_constraints.html.markdown b/website/docs/d/servicecatalog_portfolio_constraints.html.markdown
index 176fdfcf01b..bc872d8482b 100644
--- a/website/docs/d/servicecatalog_portfolio_constraints.html.markdown
+++ b/website/docs/d/servicecatalog_portfolio_constraints.html.markdown
@@ -6,7 +6,7 @@ description: |-
   Provides information on Service Catalog Portfolio Constraints
 ---
 
-# Data source: aws_servicecatalog_portfolio_constraints
+# Data Source: aws_servicecatalog_portfolio_constraints
 
 Provides information on Service Catalog Portfolio Constraints.
 
@@ -31,9 +31,9 @@ The following arguments are optional:
 * `accept_language` - (Optional) Language code. Valid values: `en` (English), `jp` (Japanese), `zh` (Chinese). Default value is `en`.
 * `product_id` - (Optional) Product identifier.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `details` - List of information about the constraints. See details below.
 
diff --git a/website/docs/d/servicecatalog_product.html.markdown b/website/docs/d/servicecatalog_product.html.markdown
index dfde282c810..5c7bdad1bf6 100644
--- a/website/docs/d/servicecatalog_product.html.markdown
+++ b/website/docs/d/servicecatalog_product.html.markdown
@@ -3,14 +3,14 @@ subcategory: "Service Catalog"
 layout: "aws"
 page_title: "AWS: aws_servicecatalog_product"
 description: |-
-  Provides information on a Service Catalog Product
+  This data source provides information about a Service Catalog product.
 ---
 
-# Data source: aws_servicecatalog_product
+# Data Source: aws_servicecatalog_product
 
-Provides information on a Service Catalog Product.
+Use this data source to retrieve information about a Service Catalog product.
 
--> **Tip:** A "provisioning artifact" is also referred to as a "version." A "distributor" is also referred to as a "vendor."
+~> **NOTE:** A "provisioning artifact" is also known as a "version," and a "distributor" is also known as a "vendor."
 
 ## Example Usage
 
@@ -26,26 +26,26 @@ data "aws_servicecatalog_product" "example" {
 
 The following arguments are required:
 
-* `id` - (Required) Product ID.
+* `id` - (Required) ID of the product.
 
 The following arguments are optional:
 
-* `accept_language` - (Optional) Language code. Valid values: `en` (English), `jp` (Japanese), `zh` (Chinese). Default value is `en`.
+* `accept_language` - (Optional) Language code. Valid values are `en` (English), `jp` (Japanese), `zh` (Chinese). The default value is `en`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the product.
 * `created_time` - Time when the product was created.
 * `description` - Description of the product.
-* `distributor` - Distributor (i.e., vendor) of the product.
+* `distributor` - Vendor of the product.
 * `has_default_path` - Whether the product has a default path.
 * `name` - Name of the product.
 * `owner` - Owner of the product.
 * `status` - Status of the product.
-* `support_description` - Support information about the product.
+* `support_description` - Field that provides support information about the product.
 * `support_email` - Contact email for product support.
 * `support_url` - Contact URL for product support.
-* `tags` - Tags to apply to the product.
+* `tags` - Tags applied to the product.
 * `type` - Type of product.
diff --git a/website/docs/d/servicecatalog_provisioning_artifacts.html.markdown b/website/docs/d/servicecatalog_provisioning_artifacts.html.markdown
index 78e9d42c3f6..c8043008e7e 100644
--- a/website/docs/d/servicecatalog_provisioning_artifacts.html.markdown
+++ b/website/docs/d/servicecatalog_provisioning_artifacts.html.markdown
@@ -30,9 +30,9 @@ The following arguments are optional:
 
 * `accept_language` - (Optional) Language code. Valid values: `en` (English), `jp` (Japanese), `zh` (Chinese). Default value is `en`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `provisioning_artifact_details` - List with information about the provisioning artifacts. See details below.
 
diff --git a/website/docs/d/servicequotas_service.html.markdown b/website/docs/d/servicequotas_service.html.markdown
index 35be5f1974a..8afbcc58878 100644
--- a/website/docs/d/servicequotas_service.html.markdown
+++ b/website/docs/d/servicequotas_service.html.markdown
@@ -24,7 +24,9 @@ data "aws_servicequotas_service" "example" {
 
 * `service_name` - (Required) Service name to lookup within Service Quotas. Available values can be found with the [AWS CLI service-quotas list-services command](https://docs.aws.amazon.com/cli/latest/reference/service-quotas/list-services.html).
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - Code of the service.
 * `service_code` - Code of the service.
diff --git a/website/docs/d/servicequotas_service_quota.html.markdown b/website/docs/d/servicequotas_service_quota.html.markdown
index 06a2909bbcf..d075586481d 100644
--- a/website/docs/d/servicequotas_service_quota.html.markdown
+++ b/website/docs/d/servicequotas_service_quota.html.markdown
@@ -34,9 +34,9 @@ data "aws_servicequotas_service_quota" "by_quota_name" {
 * `quota_code` - (Optional) Quota code within the service. When configured, the data source directly looks up the service quota. Available values can be found with the [AWS CLI service-quotas list-service-quotas command](https://docs.aws.amazon.com/cli/latest/reference/service-quotas/list-service-quotas.html). One of `quota_code` or `quota_name` must be specified.
 * `quota_name` - (Optional) Quota name within the service. When configured, the data source searches through all service quotas to find the matching quota name. Available values can be found with the [AWS CLI service-quotas list-service-quotas command](https://docs.aws.amazon.com/cli/latest/reference/service-quotas/list-service-quotas.html). One of `quota_name` or `quota_code` must be specified.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `adjustable` - Whether the service quota is adjustable.
 * `arn` - ARN of the service quota.
diff --git a/website/docs/d/servicequotas_templates.html.markdown b/website/docs/d/servicequotas_templates.html.markdown
new file mode 100644
index 00000000000..e62157737da
--- /dev/null
+++ b/website/docs/d/servicequotas_templates.html.markdown
@@ -0,0 +1,44 @@
+---
+subcategory: "Service Quotas"
+layout: "aws"
+page_title: "AWS: aws_servicequotas_templates"
+description: |-
+  Terraform data source for managing an AWS Service Quotas Templates.
+---
+
+# Data Source: aws_servicequotas_templates
+
+Terraform data source for managing an AWS Service Quotas Templates.
+
+## Example Usage
+
+### Basic Usage
+
+```terraform
+data "aws_servicequotas_templates" "example" {
+  region = "us-east-1"
+}
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `region` - (Required) AWS Region to which the quota increases apply.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `templates` - A list of quota increase templates for specified region. See [`templates`](#templates).
+
+### `templates`
+
+* `global_quota` - Indicates whether the quota is global.
+* `quota_name` - Quota name.
+* `quota_code` - Quota identifier.
+* `region` - AWS Region to which the template applies.
+* `service_code` - (Required) Service identifier.
+* `service_name` - Service name.
+* `unit` - Unit of measurement.
+* `value` - (Required) The new, increased value for the quota.
diff --git a/website/docs/d/ses_active_receipt_rule_set.html.markdown b/website/docs/d/ses_active_receipt_rule_set.html.markdown
index d3edc8fcc85..5268b6ece5a 100644
--- a/website/docs/d/ses_active_receipt_rule_set.html.markdown
+++ b/website/docs/d/ses_active_receipt_rule_set.html.markdown
@@ -16,9 +16,9 @@ Retrieve the active SES receipt rule set
 data "aws_ses_active_receipt_rule_set" "main" {}
 ```
 
-## Attributes Reference
+## Attribute Reference
 
-The following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - SES receipt rule set ARN.
 * `rule_set_name` - Name of the rule set
diff --git a/website/docs/d/ses_domain_identity.html.markdown b/website/docs/d/ses_domain_identity.html.markdown
new file mode 100644
index 00000000000..f9ef3c358a6
--- /dev/null
+++ b/website/docs/d/ses_domain_identity.html.markdown
@@ -0,0 +1,27 @@
+---
+subcategory: "SES (Simple Email)"
+layout: "aws"
+page_title: "AWS: aws_ses_domain_identity"
+description: |-
+  Retrieve the SES domain identity
+---
+
+# Data Source: aws_ses_domain_identity
+
+Retrieve the SES domain identity
+
+## Example Usage
+
+```terraform
+data "aws_ses_domain_identity" "example" {
+  domain = "example.com"
+}
+```
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the domain identity.
+* `domain` - Name of the domain
+* `verification_token` - Code which when added to the domain as a TXT record will signal to SES that the owner of the domain has authorized SES to act on their behalf.
diff --git a/website/docs/d/ses_domain_identity.markdown b/website/docs/d/ses_domain_identity.markdown
deleted file mode 100644
index b4e427cbd37..00000000000
--- a/website/docs/d/ses_domain_identity.markdown
+++ /dev/null
@@ -1,27 +0,0 @@
----
-subcategory: "SES (Simple Email)"
-layout: "aws"
-page_title: "AWS: aws_ses_domain_identity"
-description: |-
-  Retrieve the SES domain identity
----
-
-# Data Source: aws_ses_domain_identity
-
-Retrieve the SES domain identity
-
-## Example Usage
-
-```terraform
-data "aws_ses_domain_identity" "example" {
-  domain = "example.com"
-}
-```
-
-## Attributes Reference
-
-The following attributes are exported:
-
-* `arn` - ARN of the domain identity.
-* `domain` - Name of the domain
-* `verification_token` - Code which when added to the domain as a TXT record will signal to SES that the owner of the domain has authorized SES to act on their behalf.
diff --git a/website/docs/d/ses_email_identity.html.markdown b/website/docs/d/ses_email_identity.html.markdown
new file mode 100644
index 00000000000..be1c7b78a9c
--- /dev/null
+++ b/website/docs/d/ses_email_identity.html.markdown
@@ -0,0 +1,26 @@
+---
+subcategory: "SES (Simple Email)"
+layout: "aws"
+page_title: "AWS: aws_ses_email_identity"
+description: |-
+  Retrieve the active SES email identity
+---
+
+# Data Source: aws_ses_email_identity
+
+Retrieve the active SES email identity
+
+## Example Usage
+
+```terraform
+data "aws_ses_email_identity" "example" {
+  email = "awesome@example.com"
+}
+```
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` -  The ARN of the email identity.
+* `email` - Email identity.
diff --git a/website/docs/d/ses_email_identity.markdown b/website/docs/d/ses_email_identity.markdown
deleted file mode 100644
index bc3ce19d22a..00000000000
--- a/website/docs/d/ses_email_identity.markdown
+++ /dev/null
@@ -1,26 +0,0 @@
----
-subcategory: "SES (Simple Email)"
-layout: "aws"
-page_title: "AWS: aws_ses_email_identity"
-description: |-
-  Retrieve the active SES email identity
----
-
-# Data Source: aws_ses_email_identity
-
-Retrieve the active SES email identity
-
-## Example Usage
-
-```terraform
-data "aws_ses_email_identity" "example" {
-  email = "awesome@example.com"
-}
-```
-
-## Attributes Reference
-
-The following attributes are exported:
-
-* `arn` -  The ARN of the email identity.
-* `email` - Email identity.
diff --git a/website/docs/d/sesv2_configuration_set.html.markdown b/website/docs/d/sesv2_configuration_set.html.markdown
index d5e0d10d673..3b44e63b316 100644
--- a/website/docs/d/sesv2_configuration_set.html.markdown
+++ b/website/docs/d/sesv2_configuration_set.html.markdown
@@ -26,9 +26,9 @@ The following arguments are required:
 
 * `configuration_set_name` - (Required) The name of the configuration set.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `delivery_options` - An object that defines the dedicated IP pool that is used to send emails that you send using the configuration set.
     * `sending_pool_name` - The name of the dedicated IP pool to associate with the configuration set.
diff --git a/website/docs/d/sesv2_dedicated_ip_pool.html.markdown b/website/docs/d/sesv2_dedicated_ip_pool.html.markdown
index 784dda6750f..fb2c9539271 100644
--- a/website/docs/d/sesv2_dedicated_ip_pool.html.markdown
+++ b/website/docs/d/sesv2_dedicated_ip_pool.html.markdown
@@ -26,9 +26,9 @@ The following arguments are required:
 
 * `pool_name` - (Required) Name of the dedicated IP pool.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the Dedicated IP Pool.
 * `dedicated_ips` - A list of objects describing the pool's dedicated IP's. See [`dedicated_ips`](#dedicated_ips).
diff --git a/website/docs/d/sesv2_email_identity.html.markdown b/website/docs/d/sesv2_email_identity.html.markdown
new file mode 100644
index 00000000000..e25a991a7c3
--- /dev/null
+++ b/website/docs/d/sesv2_email_identity.html.markdown
@@ -0,0 +1,43 @@
+---
+subcategory: "SESv2 (Simple Email V2)"
+layout: "aws"
+page_title: "AWS: aws_sesv2_email_identity"
+description: |-
+  Terraform data source for managing an AWS SESv2 (Simple Email V2) Email Identity.
+---
+
+# Data Source: aws_sesv2_email_identity
+
+Terraform data source for managing an AWS SESv2 (Simple Email V2) Email Identity.
+
+## Example Usage
+
+### Basic Usage
+
+```terraform
+data "aws_sesv2_email_identity" "example" {
+  email_identity = "example.com"
+}
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `email_identity` - (Required) The name of the email identity.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Email Identity.
+* `dkim_signing_attributes` - A list of objects that contains at most one element with information about the private key and selector that you want to use to configure DKIM for the identity for Bring Your Own DKIM (BYODKIM) for the identity, or, configures the key length to be used for Easy DKIM.
+    * `current_signing_key_length` - [Easy DKIM] The key length of the DKIM key pair in use.
+    * `last_key_generation_timestamp` - [Easy DKIM] The last time a key pair was generated for this identity.
+    * `next_signing_key_length` - [Easy DKIM] The key length of the future DKIM key pair to be generated. This can be changed at most once per day.
+    * `signing_attributes_origin` - A string that indicates how DKIM was configured for the identity. `AWS_SES` indicates that DKIM was configured for the identity by using Easy DKIM. `EXTERNAL` indicates that DKIM was configured for the identity by using Bring Your Own DKIM (BYODKIM).
+    * `status` - Describes whether or not Amazon SES has successfully located the DKIM records in the DNS records for the domain. See the [AWS SES API v2 Reference](https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_DkimAttributes.html#SES-Type-DkimAttributes-Status) for supported statuses.
+    * `tokens` - If you used Easy DKIM to configure DKIM authentication for the domain, then this object contains a set of unique strings that you use to create a set of CNAME records that you add to the DNS configuration for your domain. When Amazon SES detects these records in the DNS configuration for your domain, the DKIM authentication process is complete. If you configured DKIM authentication for the domain by providing your own public-private key pair, then this object contains the selector for the public key.
+* `identity_type` - The email identity type. Valid values: `EMAIL_ADDRESS`, `DOMAIN`.
+* `tags` - Key-value mapping of resource tags.
+* `verified_for_sending_status` - Specifies whether or not the identity is verified.
diff --git a/website/docs/d/sesv2_email_identity_mail_from_attributes.html.markdown b/website/docs/d/sesv2_email_identity_mail_from_attributes.html.markdown
new file mode 100644
index 00000000000..779a5c02d5d
--- /dev/null
+++ b/website/docs/d/sesv2_email_identity_mail_from_attributes.html.markdown
@@ -0,0 +1,38 @@
+---
+subcategory: "SESv2 (Simple Email V2)"
+layout: "aws"
+page_title: "AWS: aws_sesv2_email_identity_mail_from_attributes"
+description: |-
+  Terraform data source for managing an AWS SESv2 (Simple Email V2) Email Identity Mail From Attributes.
+---
+
+# Data Source: aws_sesv2_email_identity_mail_from_attributes
+
+Terraform data source for managing an AWS SESv2 (Simple Email V2) Email Identity Mail From Attributes.
+
+## Example Usage
+
+### Basic Usage
+
+```terraform
+data "aws_sesv2_email_identity" "example" {
+  email_identity = "example.com"
+}
+
+data "aws_sesv2_email_identity_mail_from_attributes" "example" {
+  email_identity = data.aws_sesv2_email_identity.example.email_identity
+}
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `email_identity` - (Required) The name of the email identity.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `behavior_on_mx_failure` - The action to take if the required MX record isn't found when you send an email. Valid values: `USE_DEFAULT_VALUE`, `REJECT_MESSAGE`.
+* `mail_from_domain` - The custom MAIL FROM domain that you want the verified identity to use.
diff --git a/website/docs/d/sfn_activity.html.markdown b/website/docs/d/sfn_activity.html.markdown
index e582b8a7af3..dc136eb257d 100644
--- a/website/docs/d/sfn_activity.html.markdown
+++ b/website/docs/d/sfn_activity.html.markdown
@@ -20,14 +20,14 @@ data "aws_sfn_activity" "sfn_activity" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `name` - (Optional) Name that identifies the activity.
 * `arn` - (Optional) ARN that identifies the activity.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - ARN that identifies the activity.
 * `creation_date` - Date the activity was created.
diff --git a/website/docs/d/sfn_alias.html.markdown b/website/docs/d/sfn_alias.html.markdown
new file mode 100644
index 00000000000..edbf21a48c1
--- /dev/null
+++ b/website/docs/d/sfn_alias.html.markdown
@@ -0,0 +1,38 @@
+---
+subcategory: "SFN (Step Functions)"
+layout: "aws"
+page_title: "AWS: aws_sfn_alias"
+description: |-
+  Terraform data source for managing an AWS SFN (Step Functions) State Machine Alias.
+---
+
+# Data Source: aws_sfn_alias
+
+Terraform data source for managing an AWS SFN (Step Functions) State Machine Alias.
+
+## Example Usage
+
+### Basic Usage
+
+```terraform
+data "aws_sfn_alias" "example" {
+  name             = "my_sfn_alias"
+  statemachine_arn = aws_sfn_state_machine.sfn_test.arn
+}
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) Name of the State Machine alias.
+* `statemachine_arn` - (Required) ARN of the State Machine.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN identifying the State Machine alias.
+* `creation_date` - Date the state machine Alias was created.
+* `description` - Description of state machine alias.
+* `routing_configuration` - Routing Configuration of state machine alias
diff --git a/website/docs/d/sfn_state_machine.html.markdown b/website/docs/d/sfn_state_machine.html.markdown
index 0b7e2e0b6cf..a4b93784489 100644
--- a/website/docs/d/sfn_state_machine.html.markdown
+++ b/website/docs/d/sfn_state_machine.html.markdown
@@ -24,11 +24,14 @@ data "aws_sfn_state_machine" "example" {
 
 * `name` - (Required) Friendly name of the state machine to match.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - Set to the ARN of the found state machine, suitable for referencing in other resources that support State Machines.
 * `arn` - Set to the arn of the state function.
 * `role_arn` - Set to the role_arn used by the state function.
 * `definition` - Set to the state machine definition.
 * `creation_date` - Date the state machine was created.
+* `revision_id` - The revision identifier for the state machine.
 * `status` - Set to the current status of the state machine.
diff --git a/website/docs/d/sfn_state_machine_versions.html.markdown b/website/docs/d/sfn_state_machine_versions.html.markdown
new file mode 100644
index 00000000000..72400d60a65
--- /dev/null
+++ b/website/docs/d/sfn_state_machine_versions.html.markdown
@@ -0,0 +1,34 @@
+---
+subcategory: "SFN (Step Functions)"
+layout: "aws"
+page_title: "AWS: aws_sfn_state_machine_versions"
+description: |-
+  Terraform data source for managing an AWS SFN (Step Functions) State Machine Versions.
+---
+
+# Data Source: aws_sfn_state_machine_versions
+
+Terraform data source for managing an AWS SFN (Step Functions) State Machine Versions.
+
+## Example Usage
+
+### Basic Usage
+
+```terraform
+data "aws_sfn_state_machine_versions" "test" {
+  statemachine_arn = aws_sfn_state_machine.test.arn
+}
+
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `statemachine_arn` - (Required) ARN of the State Machine.
+
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
+
+* `statemachine_versions` - ARN List identifying the statemachine versions.
diff --git a/website/docs/d/signer_signing_job.html.markdown b/website/docs/d/signer_signing_job.html.markdown
index aff7d6f9c26..7f519c7d145 100644
--- a/website/docs/d/signer_signing_job.html.markdown
+++ b/website/docs/d/signer_signing_job.html.markdown
@@ -20,13 +20,13 @@ data "aws_signer_signing_job" "build_signing_job" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `job_id` - (Required) ID of the signing job on output.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `completed_at` - Date and time in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8) that the signing job was completed.
 * `created_at` - Date and time in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8) that the signing job was created.
diff --git a/website/docs/d/signer_signing_profile.html.markdown b/website/docs/d/signer_signing_profile.html.markdown
index a35e29cd8f9..4d4c304f37e 100644
--- a/website/docs/d/signer_signing_profile.html.markdown
+++ b/website/docs/d/signer_signing_profile.html.markdown
@@ -20,13 +20,13 @@ data "aws_signer_signing_profile" "production_signing_profile" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `name` - (Required) Name of the target signing profile.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN for the signing profile.
 * `platform_display_name` - A human-readable name for the signing platform associated with the signing profile.
diff --git a/website/docs/d/sns_topic.html.markdown b/website/docs/d/sns_topic.html.markdown
index ae009aa9cd6..ad6f4ce6de4 100644
--- a/website/docs/d/sns_topic.html.markdown
+++ b/website/docs/d/sns_topic.html.markdown
@@ -24,9 +24,9 @@ data "aws_sns_topic" "example" {
 
 * `name` - (Required) Friendly name of the topic to match.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the found topic, suitable for referencing in other resources that support SNS topics.
 * `id` - ARN of the found topic, suitable for referencing in other resources that support SNS topics.
diff --git a/website/docs/d/sqs_queue.html.markdown b/website/docs/d/sqs_queue.html.markdown
index 995971a8bbf..a67d1fcac58 100644
--- a/website/docs/d/sqs_queue.html.markdown
+++ b/website/docs/d/sqs_queue.html.markdown
@@ -24,7 +24,9 @@ data "aws_sqs_queue" "example" {
 
 * `name` - (Required) Name of the queue to match.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the queue.
 * `url` - URL of the queue.
diff --git a/website/docs/d/sqs_queues.html.markdown b/website/docs/d/sqs_queues.html.markdown
index 3104b8fd113..62544ac0b84 100644
--- a/website/docs/d/sqs_queues.html.markdown
+++ b/website/docs/d/sqs_queues.html.markdown
@@ -26,8 +26,8 @@ The following arguments are optional:
 
 * `queue_name_prefix` - (Optional) A string to use for filtering the list results. Only those queues whose name begins with the specified string are returned. Queue URLs and names are case-sensitive.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `queue_urls` - A list of queue URLs.
diff --git a/website/docs/d/ssm_document.html.markdown b/website/docs/d/ssm_document.html.markdown
index 6c7fabfdf1d..06d57abb117 100644
--- a/website/docs/d/ssm_document.html.markdown
+++ b/website/docs/d/ssm_document.html.markdown
@@ -36,15 +36,15 @@ data "aws_ssm_document" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `name` - (Required) Name of the Systems Manager document.
 * `document_format` - (Optional) Returns the document in the specified format. The document format can be either `JSON`, `YAML` and `TEXT`. JSON is the default format.
 * `document_version` - (Optional) Document version for which you want information.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the document. If the document is an AWS managed document, this value will be set to the name of the document instead.
 * `content` - Contents of the document.
diff --git a/website/docs/d/ssm_instances.html.markdown b/website/docs/d/ssm_instances.html.markdown
index c0054ec8ec0..a8790d01398 100644
--- a/website/docs/d/ssm_instances.html.markdown
+++ b/website/docs/d/ssm_instances.html.markdown
@@ -27,11 +27,13 @@ data "aws_ssm_instances" "example" {
 
 ### filter Configuration Block
 
-The following arguments are supported by the `filter` configuration block:
+The `filter` configuration block supports the following arguments:
 
 * `name` - (Required) Name of the filter field. Valid values can be found in the [SSM InstanceInformationStringFilter API Reference](https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_InstanceInformationStringFilter.html).
 * `values` - (Required) Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `ids` - Set of instance IDs of the matched SSM managed instances.
diff --git a/website/docs/d/ssm_maintenance_windows.html.markdown b/website/docs/d/ssm_maintenance_windows.html.markdown
index 55209d9d66c..acd4214b666 100644
--- a/website/docs/d/ssm_maintenance_windows.html.markdown
+++ b/website/docs/d/ssm_maintenance_windows.html.markdown
@@ -27,11 +27,13 @@ data "aws_ssm_maintenance_windows" "example" {
 
 ### filter Configuration Block
 
-The following arguments are supported by the `filter` configuration block:
+The `filter` configuration block supports the following arguments:
 
 * `name` - (Required) Name of the filter field. Valid values can be found in the [SSM DescribeMaintenanceWindows API Reference](https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DescribeMaintenanceWindows.html#API_DescribeMaintenanceWindows_RequestSyntax).
 * `values` - (Required) Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `ids` - List of window IDs of the matched SSM maintenance windows.
diff --git a/website/docs/d/ssm_parameter.html.markdown b/website/docs/d/ssm_parameter.html.markdown
index 6f929ab6aed..585d1c9788a 100644
--- a/website/docs/d/ssm_parameter.html.markdown
+++ b/website/docs/d/ssm_parameter.html.markdown
@@ -25,7 +25,7 @@ data "aws_ssm_parameter" "foo" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `name` - (Required) Name of the parameter.
 * `with_decryption` - (Optional) Whether to return decrypted `SecureString` value. Defaults to `true`.
@@ -36,4 +36,5 @@ In addition to all arguments above, the following attributes are exported:
 * `name` - Name of the parameter.
 * `type` - Type of the parameter. Valid types are `String`, `StringList` and `SecureString`.
 * `value` - Value of the parameter. This value is always marked as sensitive in the Terraform plan output, regardless of `type`. In Terraform CLI version 0.15 and later, this may require additional configuration handling for certain scenarios. For more information, see the [Terraform v0.15 Upgrade Guide](https://www.terraform.io/upgrade-guides/0-15.html#sensitive-output-values).
+* `insecure_value` - Value of the parameter. **Use caution:** This value is never marked as sensitive.
 * `version` - Version of the parameter.
diff --git a/website/docs/d/ssm_parameters_by_path.html.markdown b/website/docs/d/ssm_parameters_by_path.html.markdown
index bb2cd75859e..9036dcf00b2 100644
--- a/website/docs/d/ssm_parameters_by_path.html.markdown
+++ b/website/docs/d/ssm_parameters_by_path.html.markdown
@@ -25,7 +25,7 @@ data "aws_ssm_parameters_by_path" "foo" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `path` - (Required) Prefix path of the parameter.
 * `with_decryption` - (Optional) Whether to return decrypted `SecureString` value. Defaults to `true`.
diff --git a/website/docs/d/ssm_patch_baseline.html.markdown b/website/docs/d/ssm_patch_baseline.html.markdown
index 5ad038f5818..66d1a1e97b4 100644
--- a/website/docs/d/ssm_patch_baseline.html.markdown
+++ b/website/docs/d/ssm_patch_baseline.html.markdown
@@ -35,16 +35,16 @@ data "aws_ssm_patch_baseline" "default_custom" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `owner` - (Required) Owner of the baseline. Valid values: `All`, `AWS`, `Self` (the current account).
 * `name_prefix` - (Optional) Filter results by the baseline name prefix.
 * `default_baseline` - (Optional) Filters the results against the baselines default_baseline field.
 * `operating_system` - (Optional) Specified OS for the baseline. Valid values: `AMAZON_LINUX`, `AMAZON_LINUX_2`, `UBUNTU`, `REDHAT_ENTERPRISE_LINUX`, `SUSE`, `CENTOS`, `ORACLE_LINUX`, `DEBIAN`, `MACOS`, `RASPBIAN` and `ROCKY_LINUX`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `approved_patches` - List of explicitly approved patches for the baseline.
 * `approved_patches_compliance_level` - The compliance level for approved patches.
diff --git a/website/docs/d/ssmcontacts_contact.html.markdown b/website/docs/d/ssmcontacts_contact.html.markdown
index 61f393d55c2..d86eeb5fd55 100644
--- a/website/docs/d/ssmcontacts_contact.html.markdown
+++ b/website/docs/d/ssmcontacts_contact.html.markdown
@@ -26,9 +26,9 @@ The following arguments are required:
 
 * `arn` - (Required) The Amazon Resource Name (ARN) of the contact or escalation plan.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `alias` - A unique and identifiable alias of the contact or escalation plan.
 * `type` - The type of contact engaged. A single contact is type `PERSONAL` and an escalation plan is type `ESCALATION`.
diff --git a/website/docs/d/ssmcontacts_contact_channel.html.markdown b/website/docs/d/ssmcontacts_contact_channel.html.markdown
index b3d71e9fba6..4fcca6d4651 100644
--- a/website/docs/d/ssmcontacts_contact_channel.html.markdown
+++ b/website/docs/d/ssmcontacts_contact_channel.html.markdown
@@ -26,9 +26,9 @@ The following arguments are required:
 
 - `arn` - Amazon Resource Name (ARN) of the contact channel.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 - `activation_status` - Whether the contact channel is activated.
 
diff --git a/website/docs/d/ssmcontacts_plan.html.markdown b/website/docs/d/ssmcontacts_plan.html.markdown
index 96e1f8916f0..6348d45a271 100644
--- a/website/docs/d/ssmcontacts_plan.html.markdown
+++ b/website/docs/d/ssmcontacts_plan.html.markdown
@@ -26,8 +26,8 @@ The following arguments are required:
 
 * `contact_id` - (Required) The Amazon Resource Name (ARN) of the contact or escalation plan.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `stage` - List of stages. A contact has an engagement plan with stages that contact specified contact channels. An escalation plan uses stages that contact specified contacts.
diff --git a/website/docs/d/ssmincidents_replication_set.html.markdown b/website/docs/d/ssmincidents_replication_set.html.markdown
index 87c0875b807..fc9b48a181a 100644
--- a/website/docs/d/ssmincidents_replication_set.html.markdown
+++ b/website/docs/d/ssmincidents_replication_set.html.markdown
@@ -25,9 +25,9 @@ data "aws_ssmincidents_replication_set" "example" {}
 
 No arguments are required.
 
-## Attributes Reference
+## Attribute Reference
 
-The following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - The Amazon Resouce Name (ARN) of the replication set.
 * `tags` - All tags applied to the replication set.
diff --git a/website/docs/d/ssmincidents_response_plan.html.markdown b/website/docs/d/ssmincidents_response_plan.html.markdown
index 3840925db9b..a2638280608 100644
--- a/website/docs/d/ssmincidents_response_plan.html.markdown
+++ b/website/docs/d/ssmincidents_response_plan.html.markdown
@@ -26,9 +26,9 @@ The following arguments are required:
 
 * `arn` - (Required) The Amazon Resource Name (ARN) of the response plan.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to the preceding arguments, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `name` - The name of the response plan.
 * `tags` - The tags applied to the response plan.
diff --git a/website/docs/d/ssoadmin_instances.html.markdown b/website/docs/d/ssoadmin_instances.html.markdown
index 951c470706e..ea814662674 100644
--- a/website/docs/d/ssoadmin_instances.html.markdown
+++ b/website/docs/d/ssoadmin_instances.html.markdown
@@ -28,7 +28,9 @@ output "identity_store_id" {
 
 There are no arguments available for this data source.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `arns` - Set of Amazon Resource Names (ARNs) of the SSO Instances.
 * `id` - AWS Region.
diff --git a/website/docs/d/ssoadmin_permission_set.html.markdown b/website/docs/d/ssoadmin_permission_set.html.markdown
index 9adbce22c52..bb0fc4b25a1 100644
--- a/website/docs/d/ssoadmin_permission_set.html.markdown
+++ b/website/docs/d/ssoadmin_permission_set.html.markdown
@@ -27,7 +27,7 @@ output "arn" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 ~> **NOTE:** Either `arn` or `name` must be configured.
 
@@ -35,9 +35,9 @@ The following arguments are supported:
 * `instance_arn` - (Required) ARN of the SSO Instance associated with the permission set.
 * `name` - (Optional) Name of the SSO Permission Set.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - ARN of the Permission Set.
 * `description` - Description of the Permission Set.
diff --git a/website/docs/d/storagegateway_local_disk.html.markdown b/website/docs/d/storagegateway_local_disk.html.markdown
index 4fac5f28acf..828cc13f3ed 100644
--- a/website/docs/d/storagegateway_local_disk.html.markdown
+++ b/website/docs/d/storagegateway_local_disk.html.markdown
@@ -25,9 +25,9 @@ data "aws_storagegateway_local_disk" "test" {
 * `disk_node` - (Optional) Device node of the local disk to retrieve. For example, `/dev/sdb`.
 * `disk_path` - (Optional) Device path of the local disk to retrieve. For example, `/dev/xvdb` or `/dev/nvme1n1`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `disk_id` - Disk identifierE.g., `pci-0000:03:00.0-scsi-0:0:0:0`
 * `id` - Disk identifierE.g., `pci-0000:03:00.0-scsi-0:0:0:0`
diff --git a/website/docs/d/subnet.html.markdown b/website/docs/d/subnet.html.markdown
index b637a2eb56c..7c36df54d31 100644
--- a/website/docs/d/subnet.html.markdown
+++ b/website/docs/d/subnet.html.markdown
@@ -74,9 +74,9 @@ The following arguments are required:
 * `name` - (Required) Name of the field to filter by, as defined by [the underlying AWS API](http://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeSubnets.html).
 * `values` - (Required) Set of values that are accepted for the given field. A subnet will be selected if any one of the given values matches.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to the attributes above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the subnet.
 * `assign_ipv6_address_on_creation` - Whether an IPv6 address is assigned on creation.
diff --git a/website/docs/d/subnets.html.markdown b/website/docs/d/subnets.html.markdown
index 3a0d2d9ce1b..0f4a6161286 100644
--- a/website/docs/d/subnets.html.markdown
+++ b/website/docs/d/subnets.html.markdown
@@ -81,7 +81,9 @@ data "aws_subnets" "selected" {
 * `values` - (Required) Set of values that are accepted for the given field.
   Subnet IDs will be selected if any one of the given values match.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `ids` - List of all the subnet ids found.
 
diff --git a/website/docs/d/transfer_server.html.markdown b/website/docs/d/transfer_server.html.markdown
index f6bae31d615..53ec9368ca2 100644
--- a/website/docs/d/transfer_server.html.markdown
+++ b/website/docs/d/transfer_server.html.markdown
@@ -23,7 +23,9 @@ data "aws_transfer_server" "example" {
 
 * `server_id` - (Required) ID for an SFTP server.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of Transfer Server.
 * `certificate` - ARN of any certificate.
@@ -35,4 +37,5 @@ data "aws_transfer_server" "example" {
 * `logging_role` - ARN of an IAM role that allows the service to write your SFTP users’ activity to your Amazon CloudWatch logs for monitoring and auditing purposes.
 * `protocols` - File transfer protocol or protocols over which your file transfer protocol client can connect to your server's endpoint.
 * `security_policy_name` - The name of the security policy that is attached to the server.
+* `structured_log_destinations` - A set of ARNs of destinations that will receive structured logs from the transfer server such as CloudWatch Log Group ARNs.
 * `url` - URL of the service endpoint used to authenticate users with an `identity_provider_type` of `API_GATEWAY`.
diff --git a/website/docs/d/vpc.html.markdown b/website/docs/d/vpc.html.markdown
index 31246dc9ace..2415170f971 100644
--- a/website/docs/d/vpc.html.markdown
+++ b/website/docs/d/vpc.html.markdown
@@ -66,7 +66,7 @@ which take the following arguments:
 * `values` - (Required) Set of values that are accepted for the given field.
   A VPC will be selected if any one of the given values matches.
 
-## Attributes Reference
+## Attribute Reference
 
 All of the argument attributes except `filter` blocks are also exported as
 result attributes. This data source will complete the data by populating
diff --git a/website/docs/d/vpc_dhcp_options.html.markdown b/website/docs/d/vpc_dhcp_options.html.markdown
index 2a8d61d3391..c46f13b3fe1 100644
--- a/website/docs/d/vpc_dhcp_options.html.markdown
+++ b/website/docs/d/vpc_dhcp_options.html.markdown
@@ -48,7 +48,9 @@ For more information about filtering, see the [EC2 API documentation](https://do
 * `name` - (Required) Name of the field to filter.
 * `values` - (Required) Set of values for filtering.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the DHCP Options Set.
 * `dhcp_options_id` - EC2 DHCP Options ID
diff --git a/website/docs/d/vpc_endpoint.html.markdown b/website/docs/d/vpc_endpoint.html.markdown
index 2feee7841ec..886b672f72a 100644
--- a/website/docs/d/vpc_endpoint.html.markdown
+++ b/website/docs/d/vpc_endpoint.html.markdown
@@ -47,13 +47,14 @@ which take the following arguments:
 * `values` - (Required) Set of values that are accepted for the given field.
   A VPC Endpoint will be selected if any one of the given values matches.
 
-## Attributes Reference
+## Attribute Reference
 
 In addition to all arguments above except `filter`, the following attributes are exported:
 
 * `arn` - ARN of the VPC endpoint.
 * `cidr_blocks` - List of CIDR blocks for the exposed AWS service. Applicable for endpoints of type `Gateway`.
-* `dns_entry` - DNS entries for the VPC Endpoint. Applicable for endpoints of type `Interface`. DNS blocks are documented below.
+* `dns_entry` - DNS entries for the VPC Endpoint. Applicable for endpoints of type `Interface`. [DNS entry blocks are documented below](#dns_entry-block).
+* `dns_options` - DNS options for the VPC Endpoint. [DNS options blocks are documented below](#dns_options-block).
 * `network_interface_ids` - One or more network interfaces for the VPC Endpoint. Applicable for endpoints of type `Interface`.
 * `owner_id` - ID of the AWS account that owns the VPC endpoint.
 * `policy` - Policy document associated with the VPC Endpoint. Applicable for endpoints of type `Gateway`.
@@ -65,11 +66,20 @@ In addition to all arguments above except `filter`, the following attributes are
 * `subnet_ids` - One or more subnets in which the VPC Endpoint is located. Applicable for endpoints of type `Interface`.
 * `vpc_endpoint_type` - VPC Endpoint type, `Gateway` or `Interface`.
 
+### `dns_entry` Block
+
 DNS blocks (for `dns_entry`) support the following attributes:
 
 * `dns_name` - DNS name.
 * `hosted_zone_id` - ID of the private hosted zone.
 
+### `dns_options` Block
+
+DNS options (for `dns_options`) support the following attributes:
+
+* `dns_record_ip_type` - The DNS records created for the endpoint.
+* `private_dns_only_for_inbound_resolver_endpoint` - Indicates whether to enable private DNS only for inbound endpoints.
+
 ## Timeouts
 
 [Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
diff --git a/website/docs/d/vpc_endpoint_service.html.markdown b/website/docs/d/vpc_endpoint_service.html.markdown
index 34cd93aa2c4..9729f805dca 100644
--- a/website/docs/d/vpc_endpoint_service.html.markdown
+++ b/website/docs/d/vpc_endpoint_service.html.markdown
@@ -68,14 +68,14 @@ The given filters must match exactly one VPC endpoint service whose data will be
 
 ### filter Configuration Block
 
-The following arguments are supported by the `filter` configuration block:
+The `filter` configuration block supports the following arguments:
 
 * `name` - (Required) Name of the filter field. Valid values can be found in the [EC2 DescribeVpcEndpointServices API Reference](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeVpcEndpointServices.html).
 * `values` - (Required) Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `acceptance_required` - Whether or not VPC endpoint connection requests to the service must be accepted by the service owner - `true` or `false`.
 * `arn` - ARN of the VPC endpoint service.
diff --git a/website/docs/d/vpc_ipam_pool.html.markdown b/website/docs/d/vpc_ipam_pool.html.markdown
index 5f2e38cf1ce..77a4a4ef582 100644
--- a/website/docs/d/vpc_ipam_pool.html.markdown
+++ b/website/docs/d/vpc_ipam_pool.html.markdown
@@ -53,7 +53,7 @@ VPC whose data will be exported as attributes.
 * `name` - (Required) The name of the filter. Filter names are case-sensitive.
 * `values` - (Required) The filter values. Filter values are case-sensitive.
 
-## Attributes Reference
+## Attribute Reference
 
 All of the argument attributes except `filter` blocks are also exported as
 result attributes. This data source will complete the data by populating
diff --git a/website/docs/d/vpc_ipam_pool_cidrs.html.markdown b/website/docs/d/vpc_ipam_pool_cidrs.html.markdown
index 079f1d9e2c3..4cba86ccdd9 100644
--- a/website/docs/d/vpc_ipam_pool_cidrs.html.markdown
+++ b/website/docs/d/vpc_ipam_pool_cidrs.html.markdown
@@ -75,7 +75,7 @@ VPC whose data will be exported as attributes.
 * `ipam_pool_id` - ID of the IPAM pool you would like the list of provisioned CIDRs.
 * `filter` - Custom filter block as described below.
 
-## Attributes Reference
+## Attribute Reference
 
 All of the argument attributes except `filter` blocks are also exported as
 result attributes. This data source will complete the data by populating
diff --git a/website/docs/d/vpc_ipam_pools.html.markdown b/website/docs/d/vpc_ipam_pools.html.markdown
index 6e121c8bf25..0df0f23f659 100644
--- a/website/docs/d/vpc_ipam_pools.html.markdown
+++ b/website/docs/d/vpc_ipam_pools.html.markdown
@@ -42,9 +42,9 @@ IPAM Pools in the current region.
 * `name` - (Required) The name of the filter. Filter names are case-sensitive.
 * `values` - (Required) The filter values. Filter values are case-sensitive.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all of the arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `ipam_pools` - List of IPAM pools and their attributes. See below for details
 
diff --git a/website/docs/d/vpc_ipam_preview_next_cidr.html.markdown b/website/docs/d/vpc_ipam_preview_next_cidr.html.markdown
index be3ed183451..a1b70641883 100644
--- a/website/docs/d/vpc_ipam_preview_next_cidr.html.markdown
+++ b/website/docs/d/vpc_ipam_preview_next_cidr.html.markdown
@@ -38,15 +38,15 @@ resource "aws_vpc_ipam_pool_cidr_allocation" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `disallowed_cidrs` - (Optional) Exclude a particular CIDR range from being returned by the pool.
 * `ipam_pool_id` - (Required) ID of the pool to which you want to assign a CIDR.
 * `netmask_length` - (Optional) Netmask length of the CIDR you would like to preview from the IPAM pool.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `cidr` - Previewed CIDR from the pool.
 * `id` - ID of the preview.
diff --git a/website/docs/d/vpc_peering_connection.html.markdown b/website/docs/d/vpc_peering_connection.html.markdown
index 9e30a6e3fa6..0282ebedca1 100644
--- a/website/docs/d/vpc_peering_connection.html.markdown
+++ b/website/docs/d/vpc_peering_connection.html.markdown
@@ -72,7 +72,7 @@ which take the following arguments:
 * `values` - (Required) Set of values that are accepted for the given field.
   A VPC Peering Connection will be selected if any one of the given values matches.
 
-## Attributes Reference
+## Attribute Reference
 
 All of the argument attributes except `filter` are also exported as result attributes.
 
@@ -86,12 +86,12 @@ All of the argument attributes except `filter` are also exported as result attri
 * `requester` - Configuration block that describes [VPC Peering Connection]
 (https://docs.aws.amazon.com/vpc/latest/peering/what-is-vpc-peering.html) options set for the requester VPC.
 
-#### Accepter and Requester Attributes Reference
+#### Accepter and Requester Attribute Reference
 
 * `allow_remote_vpc_dns_resolution` - Indicates whether a local VPC can resolve public DNS hostnames to
 private IP addresses when queried from instances in a peer VPC.
 
-#### CIDR block set Attributes Reference
+#### CIDR block set Attribute Reference
 
 * `cidr_block` - CIDR block associated to the VPC of the specific VPC Peering Connection.
 
diff --git a/website/docs/d/vpc_peering_connections.html.markdown b/website/docs/d/vpc_peering_connections.html.markdown
index 787e4c9342d..b168b232897 100644
--- a/website/docs/d/vpc_peering_connections.html.markdown
+++ b/website/docs/d/vpc_peering_connections.html.markdown
@@ -50,7 +50,7 @@ which take the following arguments:
 * `values` - (Required) Set of values that are accepted for the given field.
   A VPC Peering Connection will be selected if any one of the given values matches.
 
-## Attributes Reference
+## Attribute Reference
 
 All of the argument attributes except `filter` are also exported as result attributes.
 
diff --git a/website/docs/d/vpc_security_group_rule.html.markdown b/website/docs/d/vpc_security_group_rule.html.markdown
index c9e4c7539a4..dff76f1cfcd 100644
--- a/website/docs/d/vpc_security_group_rule.html.markdown
+++ b/website/docs/d/vpc_security_group_rule.html.markdown
@@ -29,14 +29,14 @@ whose data will be exported as attributes.
 
 ### filter Configuration Block
 
-The following arguments are supported by the `filter` configuration block:
+The `filter` configuration block supports the following arguments:
 
 * `name` - (Required) Name of the filter field. Valid values can be found in the EC2 [`DescribeSecurityGroupRules`](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeSecurityGroupRules.html) API Reference.
 * `values` - (Required) Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - The Amazon Resource Name (ARN) of the security group rule.
 * `cidr_ipv4` - The destination IPv4 CIDR range.
diff --git a/website/docs/d/vpc_security_group_rules.html.markdown b/website/docs/d/vpc_security_group_rules.html.markdown
index 569b57449ae..7e4033bb178 100644
--- a/website/docs/d/vpc_security_group_rules.html.markdown
+++ b/website/docs/d/vpc_security_group_rules.html.markdown
@@ -35,6 +35,8 @@ which take the following arguments:
 * `values` - (Required) Set of values that are accepted for the given field.
   Security group rule IDs will be selected if any one of the given values match.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `ids` - List of all the security group rule IDs found.
diff --git a/website/docs/d/vpclattice_auth_policy.html.markdown b/website/docs/d/vpclattice_auth_policy.html.markdown
index 4417f1a91c4..2f165fc7250 100644
--- a/website/docs/d/vpclattice_auth_policy.html.markdown
+++ b/website/docs/d/vpclattice_auth_policy.html.markdown
@@ -26,9 +26,9 @@ The following arguments are required:
 
 * `resource_identifier` - (Required) The ID or Amazon Resource Name (ARN) of the service network or service for which the policy is created.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `policy` - The auth policy. The policy string in JSON must not contain newlines or blank lines.
 * `state` - The state of the auth policy. The auth policy is only active when the auth type is set to AWS_IAM. If you provide a policy, then authentication and authorization decisions are made based on this policy and the client's IAM policy. If the Auth type is NONE, then, any auth policy you provide will remain inactive.
diff --git a/website/docs/d/vpclattice_listener.html.markdown b/website/docs/d/vpclattice_listener.html.markdown
index d3b2791009d..80c540dc88b 100644
--- a/website/docs/d/vpclattice_listener.html.markdown
+++ b/website/docs/d/vpclattice_listener.html.markdown
@@ -26,9 +26,9 @@ The following arguments are required:
 * `service_identifier` - (Required) ID or Amazon Resource Name (ARN) of the service network
 * `listener_identifier` - (Required) ID or Amazon Resource Name (ARN) of the listener
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the listener.
 * `created_at` - The date and time that the listener was created.
diff --git a/website/docs/d/vpclattice_resource_policy.html.markdown b/website/docs/d/vpclattice_resource_policy.html.markdown
index c7ccff9e2ad..ac41d589551 100644
--- a/website/docs/d/vpclattice_resource_policy.html.markdown
+++ b/website/docs/d/vpclattice_resource_policy.html.markdown
@@ -26,8 +26,8 @@ The following arguments are required:
 
 * `resource_arn` - (Required) Resource ARN of the resource for which a policy is retrieved.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `policy` - JSON-encoded string representation of the applied resource policy.
diff --git a/website/docs/d/vpclattice_service.html.markdown b/website/docs/d/vpclattice_service.html.markdown
index 31600ee4b29..f1dc5a6ca9a 100644
--- a/website/docs/d/vpclattice_service.html.markdown
+++ b/website/docs/d/vpclattice_service.html.markdown
@@ -16,18 +16,21 @@ Terraform data source for managing an AWS VPC Lattice Service.
 
 ```terraform
 data "aws_vpclattice_service" "example" {
+  name = "example"
 }
 ```
 
 ## Argument Reference
 
-The following arguments are required:
+The arguments of this data source act as filters for querying the available VPC lattice services.
+The given filters must match exactly one VPC lattice service whose data will be exported as attributes.
 
-* `service_identifier` - (Required) ID or Amazon Resource Name (ARN) of the service network
+* `name` - (Optional) Service name.
+* `service_identifier` - (Optional) ID or Amazon Resource Name (ARN) of the service.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the service.
 * `auth_type` - Type of IAM policy. Either `NONE` or `AWS_IAM`.
diff --git a/website/docs/d/vpclattice_service_network.html.markdown b/website/docs/d/vpclattice_service_network.html.markdown
index e982abd5c6b..89e4a5fa613 100644
--- a/website/docs/d/vpclattice_service_network.html.markdown
+++ b/website/docs/d/vpclattice_service_network.html.markdown
@@ -16,7 +16,7 @@ Terraform data source for managing an AWS VPC Lattice Service Network.
 
 ```terraform
 data "aws_vpclattice_service_network" "example" {
-  service_network_identifier = ""
+  service_network_identifier = "snsa-01112223334445556"
 }
 ```
 
@@ -24,11 +24,11 @@ data "aws_vpclattice_service_network" "example" {
 
 The following arguments are required:
 
-* `service_network_identifier` - (Required) Identifier of the network service.
+* `service_network_identifier` - (Required) Identifier of the service network.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the Service Network.
 * `auth_type` - Authentication type for the service network. Either `NONE` or `AWS_IAM`.
diff --git a/website/docs/d/vpcs.html.markdown b/website/docs/d/vpcs.html.markdown
index 1634543b545..7f0faf42d38 100644
--- a/website/docs/d/vpcs.html.markdown
+++ b/website/docs/d/vpcs.html.markdown
@@ -68,7 +68,9 @@ which take the following arguments:
 * `values` - (Required) Set of values that are accepted for the given field.
   A VPC will be selected if any one of the given values matches.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - AWS Region.
 * `ids` - List of all the VPC Ids found.
diff --git a/website/docs/d/vpn_gateway.html.markdown b/website/docs/d/vpn_gateway.html.markdown
index 169a7443a8d..36e79d1e628 100644
--- a/website/docs/d/vpn_gateway.html.markdown
+++ b/website/docs/d/vpn_gateway.html.markdown
@@ -55,7 +55,7 @@ which take the following arguments:
 * `values` - (Required) Set of values that are accepted for the given field.
   A VPN Gateway will be selected if any one of the given values matches.
 
-## Attributes Reference
+## Attribute Reference
 
 All of the argument attributes are also exported as result attributes.
 
diff --git a/website/docs/d/waf_ipset.html.markdown b/website/docs/d/waf_ipset.html.markdown
index 97d6bdd6a1b..95afe94eb31 100644
--- a/website/docs/d/waf_ipset.html.markdown
+++ b/website/docs/d/waf_ipset.html.markdown
@@ -20,12 +20,12 @@ data "aws_waf_ipset" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `name` - (Required) Name of the WAF IP set.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - ID of the WAF IP set.
diff --git a/website/docs/d/waf_rate_based_rule.html.markdown b/website/docs/d/waf_rate_based_rule.html.markdown
index ec231199eb1..abc95e225f9 100644
--- a/website/docs/d/waf_rate_based_rule.html.markdown
+++ b/website/docs/d/waf_rate_based_rule.html.markdown
@@ -21,12 +21,12 @@ data "aws_waf_rate_based_rule" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `name` - (Required) Name of the WAF rate based rule.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - ID of the WAF rate based rule.
diff --git a/website/docs/d/waf_rule.html.markdown b/website/docs/d/waf_rule.html.markdown
index 9cb475188b5..737fbba5fda 100644
--- a/website/docs/d/waf_rule.html.markdown
+++ b/website/docs/d/waf_rule.html.markdown
@@ -21,12 +21,12 @@ data "aws_waf_rule" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `name` - (Required) Name of the WAF rule.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - ID of the WAF rule.
diff --git a/website/docs/d/waf_subscribed_rule_group.html.markdown b/website/docs/d/waf_subscribed_rule_group.html.markdown
index c7256dae13e..849680e4946 100644
--- a/website/docs/d/waf_subscribed_rule_group.html.markdown
+++ b/website/docs/d/waf_subscribed_rule_group.html.markdown
@@ -40,13 +40,13 @@ resource "aws_waf_web_acl" "acl" {
 
 ## Argument Reference
 
-The following arguments are supported (at least one needs to be specified):
+This data source supports the following arguments: (at least one needs to be specified)
 
 * `name` - (Optional) Name of the WAF rule group.
 * `metric_name` - (Optional) Name of the WAF rule group.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - ID of the WAF rule group.
diff --git a/website/docs/d/waf_web_acl.html.markdown b/website/docs/d/waf_web_acl.html.markdown
index 0e71d2a29fd..d3b54cc10d3 100644
--- a/website/docs/d/waf_web_acl.html.markdown
+++ b/website/docs/d/waf_web_acl.html.markdown
@@ -20,12 +20,12 @@ data "aws_waf_web_acl" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `name` - (Required) Name of the WAF Web ACL.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - ID of the WAF Web ACL.
diff --git a/website/docs/d/wafregional_ipset.html.markdown b/website/docs/d/wafregional_ipset.html.markdown
index b4729f22647..2ecd31ea3ce 100644
--- a/website/docs/d/wafregional_ipset.html.markdown
+++ b/website/docs/d/wafregional_ipset.html.markdown
@@ -20,12 +20,12 @@ data "aws_wafregional_ipset" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `name` - (Required) Name of the WAF Regional IP set.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - ID of the WAF Regional IP set.
diff --git a/website/docs/d/wafregional_rate_based_rule.html.markdown b/website/docs/d/wafregional_rate_based_rule.html.markdown
index 307404cb118..dd9a31a79ee 100644
--- a/website/docs/d/wafregional_rate_based_rule.html.markdown
+++ b/website/docs/d/wafregional_rate_based_rule.html.markdown
@@ -20,12 +20,12 @@ data "aws_wafregional_rate_based_rule" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `name` - (Required) Name of the WAF Regional rate based rule.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - ID of the WAF Regional rate based rule.
diff --git a/website/docs/d/wafregional_rule.html.markdown b/website/docs/d/wafregional_rule.html.markdown
index 66e43b61360..7ccf31e3bc0 100644
--- a/website/docs/d/wafregional_rule.html.markdown
+++ b/website/docs/d/wafregional_rule.html.markdown
@@ -20,12 +20,12 @@ data "aws_wafregional_rule" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `name` - (Required) Name of the WAF Regional rule.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - ID of the WAF Regional rule.
diff --git a/website/docs/d/wafregional_subscribed_rule_group.html.markdown b/website/docs/d/wafregional_subscribed_rule_group.html.markdown
index 9de62c0e6d0..575ef5ae92c 100644
--- a/website/docs/d/wafregional_subscribed_rule_group.html.markdown
+++ b/website/docs/d/wafregional_subscribed_rule_group.html.markdown
@@ -41,13 +41,13 @@ resource "aws_wafregional_web_acl" "acl" {
 
 ## Argument Reference
 
-The following arguments are supported (at least one needs to be specified):
+This data source supports the following arguments: (at least one needs to be specified)
 
 * `name` - (Optional) Name of the WAF rule group.
 * `metric_name` - (Optional) Name of the WAF rule group.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - ID of the WAF rule group.
diff --git a/website/docs/d/wafregional_web_acl.html.markdown b/website/docs/d/wafregional_web_acl.html.markdown
index 43ac4a85fe8..62c3b11dfa8 100644
--- a/website/docs/d/wafregional_web_acl.html.markdown
+++ b/website/docs/d/wafregional_web_acl.html.markdown
@@ -20,12 +20,12 @@ data "aws_wafregional_web_acl" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `name` - (Required) Name of the WAF Regional Web ACL.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - ID of the WAF Regional Web ACL.
diff --git a/website/docs/d/wafv2_ip_set.html.markdown b/website/docs/d/wafv2_ip_set.html.markdown
index 580047739cd..e26389f8879 100644
--- a/website/docs/d/wafv2_ip_set.html.markdown
+++ b/website/docs/d/wafv2_ip_set.html.markdown
@@ -21,16 +21,16 @@ data "aws_wafv2_ip_set" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `name` - (Required) Name of the WAFv2 IP Set.
 * `scope` - (Required) Specifies whether this is for an AWS CloudFront distribution or for a regional application. Valid values are `CLOUDFRONT` or `REGIONAL`. To work with CloudFront, you must also specify the region `us-east-1` (N. Virginia) on the AWS provider.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
-* `addresses` - An array of strings that specify one or more IP addresses or blocks of IP addresses in Classless Inter-Domain Routing (CIDR) notation.
+* `addresses` - An array of strings that specifies zero or more IP addresses or blocks of IP addresses in Classless Inter-Domain Routing (CIDR) notation.
 * `arn` - ARN of the entity.
 * `description` - Description of the set that helps with identification.
 * `id` - Unique identifier for the set.
diff --git a/website/docs/d/wafv2_regex_pattern_set.html.markdown b/website/docs/d/wafv2_regex_pattern_set.html.markdown
index cf1eab8210d..4ce6a70cea5 100644
--- a/website/docs/d/wafv2_regex_pattern_set.html.markdown
+++ b/website/docs/d/wafv2_regex_pattern_set.html.markdown
@@ -21,14 +21,14 @@ data "aws_wafv2_regex_pattern_set" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `name` - (Required) Name of the WAFv2 Regex Pattern Set.
 * `scope` - (Required) Specifies whether this is for an AWS CloudFront distribution or for a regional application. Valid values are `CLOUDFRONT` or `REGIONAL`. To work with CloudFront, you must also specify the region `us-east-1` (N. Virginia) on the AWS provider.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the entity.
 * `description` - Description of the set that helps with identification.
diff --git a/website/docs/d/wafv2_rule_group.html.markdown b/website/docs/d/wafv2_rule_group.html.markdown
index b65f5dc233f..a3a5f1d6fe8 100644
--- a/website/docs/d/wafv2_rule_group.html.markdown
+++ b/website/docs/d/wafv2_rule_group.html.markdown
@@ -21,14 +21,14 @@ data "aws_wafv2_rule_group" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `name` - (Required) Name of the WAFv2 Rule Group.
 * `scope` - (Required) Specifies whether this is for an AWS CloudFront distribution or for a regional application. Valid values are `CLOUDFRONT` or `REGIONAL`. To work with CloudFront, you must also specify the region `us-east-1` (N. Virginia) on the AWS provider.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the entity.
 * `description` - Description of the rule group that helps with identification.
diff --git a/website/docs/d/wafv2_web_acl.html.markdown b/website/docs/d/wafv2_web_acl.html.markdown
index 498572ba146..67f6d4d18cc 100644
--- a/website/docs/d/wafv2_web_acl.html.markdown
+++ b/website/docs/d/wafv2_web_acl.html.markdown
@@ -21,14 +21,14 @@ data "aws_wafv2_web_acl" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `name` - (Required) Name of the WAFv2 Web ACL.
 * `scope` - (Required) Specifies whether this is for an AWS CloudFront distribution or for a regional application. Valid values are `CLOUDFRONT` or `REGIONAL`. To work with CloudFront, you must also specify the region `us-east-1` (N. Virginia) on the AWS provider.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the entity.
 * `description` - Description of the WebACL that helps with identification.
diff --git a/website/docs/d/workspaces_bundle.html.markdown b/website/docs/d/workspaces_bundle.html.markdown
index 3d3c3401023..f89193565c0 100644
--- a/website/docs/d/workspaces_bundle.html.markdown
+++ b/website/docs/d/workspaces_bundle.html.markdown
@@ -31,13 +31,15 @@ data "aws_workspaces_bundle" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `bundle_id` – (Optional) ID of the bundle.
 * `owner` – (Optional) Owner of the bundles. You have to leave it blank for own bundles. You cannot combine this parameter with `bundle_id`.
 * `name` – (Optional) Name of the bundle. You cannot combine this parameter with `bundle_id`.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `description` – The description of the bundle.
 * `bundle_id` – The ID of the bundle.
diff --git a/website/docs/d/workspaces_directory.html.markdown b/website/docs/d/workspaces_directory.html.markdown
index ad551eb38b5..3e85d306909 100644
--- a/website/docs/d/workspaces_directory.html.markdown
+++ b/website/docs/d/workspaces_directory.html.markdown
@@ -22,7 +22,9 @@ data "aws_workspaces_directory" "example" {
 
 * `directory_id` - (Required) Directory identifier for registration in WorkSpaces service.
 
-## Attributes Reference
+## Attribute Reference
+
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - WorkSpaces directory identifier.
 * `alias` - Directory alias.
diff --git a/website/docs/d/workspaces_image.html.markdown b/website/docs/d/workspaces_image.html.markdown
index 70598456dbc..17831e206ca 100644
--- a/website/docs/d/workspaces_image.html.markdown
+++ b/website/docs/d/workspaces_image.html.markdown
@@ -20,13 +20,13 @@ data aws_workspaces_image example {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `image_id` – (Required) ID of the image.
 
-## Attributes Reference
+## Attribute Reference
 
-The following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `name` – The name of the image.
 * `description` – The description of the image.
diff --git a/website/docs/d/workspaces_workspace.html.markdown b/website/docs/d/workspaces_workspace.html.markdown
index 7dd3c533d6e..def886cf2ec 100644
--- a/website/docs/d/workspaces_workspace.html.markdown
+++ b/website/docs/d/workspaces_workspace.html.markdown
@@ -31,7 +31,7 @@ data "aws_workspaces_workspace" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This data source supports the following arguments:
 
 * `bundle_id` - (Optional) ID of the bundle for the WorkSpace.
 * `directory_id` - (Optional) ID of the directory for the WorkSpace. You have to specify `user_name` along with `directory_id`. You cannot combine this parameter with `workspace_id`.
@@ -51,9 +51,9 @@ The following arguments are supported:
 * `running_mode_auto_stop_timeout_in_minutes` – (Optional) Time after a user logs off when WorkSpaces are automatically stopped. Configured in 60-minute intervals.
 * `user_volume_size_gib` – (Optional) Size of the user storage.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This data source exports the following attributes in addition to the arguments above:
 
 * `id` - Workspaces ID.
 * `ip_address` - IP address of the WorkSpace.
diff --git a/website/docs/guides/continuous-validation-examples.html.md b/website/docs/guides/continuous-validation-examples.html.markdown
similarity index 100%
rename from website/docs/guides/continuous-validation-examples.html.md
rename to website/docs/guides/continuous-validation-examples.html.markdown
diff --git a/website/docs/guides/custom-service-endpoints.html.markdown b/website/docs/guides/custom-service-endpoints.html.markdown
new file mode 100644
index 00000000000..4edfc133f23
--- /dev/null
+++ b/website/docs/guides/custom-service-endpoints.html.markdown
@@ -0,0 +1,353 @@
+---
+subcategory: ""
+layout: "aws"
+page_title: "Terraform AWS Provider Custom Service Endpoint Configuration"
+description: |-
+  Configuring the Terraform AWS Provider to connect to custom AWS service endpoints and AWS compatible solutions.
+---
+
+<!-- Generated by internal/generate/customends/main.go; DO NOT EDIT. -->
+
+# Custom Service Endpoint Configuration
+
+The Terraform AWS Provider configuration can be customized to connect to non-default AWS service endpoints and AWS compatible solutions. This may be useful for environments with specific compliance requirements, such as using [AWS FIPS 140-2 endpoints](https://aws.amazon.com/compliance/fips/), connecting to AWS Snowball, SC2S, or C2S environments, or local testing.
+
+This guide outlines how to get started with customizing endpoints, the available endpoint configurations, and offers example configurations for working with certain local development and testing solutions.
+
+~> **NOTE:** Support for connecting the Terraform AWS Provider with custom endpoints and AWS compatible solutions is offered as best effort. Individual Terraform resources may require compatibility updates to work in certain environments. Integration testing by HashiCorp during provider changes is exclusively done against default AWS endpoints at this time.
+
+<!-- TOC depthFrom:2 -->
+
+- [Getting Started with Custom Endpoints](#getting-started-with-custom-endpoints)
+- [Available Endpoint Customizations](#available-endpoint-customizations)
+- [Connecting to Local AWS Compatible Solutions](#connecting-to-local-aws-compatible-solutions)
+    - [DynamoDB Local](#dynamodb-local)
+    - [LocalStack](#localstack)
+
+<!-- /TOC -->
+
+## Getting Started with Custom Endpoints
+
+To configure the Terraform AWS Provider to use customized endpoints, it can be done within `provider` declarations using the `endpoints` configuration block, e.g.,
+
+```terraform
+provider "aws" {
+  # ... potentially other provider configuration ...
+
+  endpoints {
+    dynamodb = "http://localhost:4569"
+    s3       = "http://localhost:4572"
+  }
+}
+```
+
+If multiple, different Terraform AWS Provider configurations are required, see the [Terraform documentation on multiple provider instances](https://www.terraform.io/docs/configuration/providers.html#alias-multiple-provider-instances) for additional information about the `alias` provider configuration and its usage.
+
+## Available Endpoint Customizations
+
+The Terraform AWS Provider allows the following endpoints to be customized.
+
+**Note:** The Provider allows some service endpoints to be customized despite not supporting those services.
+
+**Note:** For backward compatibility, some endpoints can be assigned using multiple service "keys" (_e.g._, `dms`, `databasemigration`, or `databasemigrationservice`). If you use more than one equivalent service key in your configuration, the provider will use the _first_ endpoint value set. For example, in the configuration below we have set the DMS service endpoints using both `dms` and `databasemigration`. The provider will set the endpoint to whichever appears first. Subsequent values are ignored.
+
+```terraform
+provider "aws" {
+  endpoints {
+    dms               = "http://this.value.will.be.used.com"
+    databasemigration = "http://this.value.will.be.ignored.com"
+  }
+}
+```
+
+<!-- markdownlint-disable no-inline-html -->
+<!--
+    The division splits this long list into multiple columns without manually
+    maintaining a table. The terraform.io Markdown parser previously allowed
+    for Markdown within HTML elements, however the Terraform Registry parser
+    is more accurate/strict, so we use raw HTML to maintain this list.
+-->
+<!-- Generated by internal/generate/customends/main.go; DO NOT EDIT. -->
+<div style="column-width: 14em;">
+<ul>
+  <li><code>accessanalyzer</code></li>
+  <li><code>account</code></li>
+  <li><code>acm</code></li>
+  <li><code>acmpca</code></li>
+  <li><code>amp</code> (or <code>prometheus</code> or <code>prometheusservice</code>)</li>
+  <li><code>amplify</code></li>
+  <li><code>apigateway</code></li>
+  <li><code>apigatewayv2</code></li>
+  <li><code>appautoscaling</code> (or <code>applicationautoscaling</code>)</li>
+  <li><code>appconfig</code></li>
+  <li><code>appflow</code></li>
+  <li><code>appintegrations</code> (or <code>appintegrationsservice</code>)</li>
+  <li><code>applicationinsights</code></li>
+  <li><code>appmesh</code></li>
+  <li><code>apprunner</code></li>
+  <li><code>appstream</code></li>
+  <li><code>appsync</code></li>
+  <li><code>athena</code></li>
+  <li><code>auditmanager</code></li>
+  <li><code>autoscaling</code></li>
+  <li><code>autoscalingplans</code></li>
+  <li><code>backup</code></li>
+  <li><code>batch</code></li>
+  <li><code>bedrock</code></li>
+  <li><code>budgets</code></li>
+  <li><code>ce</code> (or <code>costexplorer</code>)</li>
+  <li><code>chime</code></li>
+  <li><code>chimesdkmediapipelines</code></li>
+  <li><code>chimesdkvoice</code></li>
+  <li><code>cleanrooms</code></li>
+  <li><code>cloud9</code></li>
+  <li><code>cloudcontrol</code> (or <code>cloudcontrolapi</code>)</li>
+  <li><code>cloudformation</code></li>
+  <li><code>cloudfront</code></li>
+  <li><code>cloudhsmv2</code> (or <code>cloudhsm</code>)</li>
+  <li><code>cloudsearch</code></li>
+  <li><code>cloudtrail</code></li>
+  <li><code>cloudwatch</code></li>
+  <li><code>codeartifact</code></li>
+  <li><code>codebuild</code></li>
+  <li><code>codecatalyst</code></li>
+  <li><code>codecommit</code></li>
+  <li><code>codegurureviewer</code></li>
+  <li><code>codepipeline</code></li>
+  <li><code>codestarconnections</code></li>
+  <li><code>codestarnotifications</code></li>
+  <li><code>cognitoidentity</code></li>
+  <li><code>cognitoidp</code> (or <code>cognitoidentityprovider</code>)</li>
+  <li><code>comprehend</code></li>
+  <li><code>computeoptimizer</code></li>
+  <li><code>configservice</code> (or <code>config</code>)</li>
+  <li><code>connect</code></li>
+  <li><code>controltower</code></li>
+  <li><code>cur</code> (or <code>costandusagereportservice</code>)</li>
+  <li><code>dataexchange</code></li>
+  <li><code>datapipeline</code></li>
+  <li><code>datasync</code></li>
+  <li><code>dax</code></li>
+  <li><code>deploy</code> (or <code>codedeploy</code>)</li>
+  <li><code>detective</code></li>
+  <li><code>devicefarm</code></li>
+  <li><code>directconnect</code></li>
+  <li><code>dlm</code></li>
+  <li><code>dms</code> (or <code>databasemigration</code> or <code>databasemigrationservice</code>)</li>
+  <li><code>docdb</code></li>
+  <li><code>docdbelastic</code></li>
+  <li><code>ds</code> (or <code>directoryservice</code>)</li>
+  <li><code>dynamodb</code></li>
+  <li><code>ec2</code></li>
+  <li><code>ecr</code></li>
+  <li><code>ecrpublic</code></li>
+  <li><code>ecs</code></li>
+  <li><code>efs</code></li>
+  <li><code>eks</code></li>
+  <li><code>elasticache</code></li>
+  <li><code>elasticbeanstalk</code> (or <code>beanstalk</code>)</li>
+  <li><code>elasticsearch</code> (or <code>es</code> or <code>elasticsearchservice</code>)</li>
+  <li><code>elastictranscoder</code></li>
+  <li><code>elb</code> (or <code>elasticloadbalancing</code>)</li>
+  <li><code>elbv2</code> (or <code>elasticloadbalancingv2</code>)</li>
+  <li><code>emr</code></li>
+  <li><code>emrcontainers</code></li>
+  <li><code>emrserverless</code></li>
+  <li><code>events</code> (or <code>eventbridge</code> or <code>cloudwatchevents</code>)</li>
+  <li><code>evidently</code> (or <code>cloudwatchevidently</code>)</li>
+  <li><code>finspace</code></li>
+  <li><code>firehose</code></li>
+  <li><code>fis</code></li>
+  <li><code>fms</code></li>
+  <li><code>fsx</code></li>
+  <li><code>gamelift</code></li>
+  <li><code>glacier</code></li>
+  <li><code>globalaccelerator</code></li>
+  <li><code>glue</code></li>
+  <li><code>grafana</code> (or <code>managedgrafana</code> or <code>amg</code>)</li>
+  <li><code>greengrass</code></li>
+  <li><code>guardduty</code></li>
+  <li><code>healthlake</code></li>
+  <li><code>iam</code></li>
+  <li><code>identitystore</code></li>
+  <li><code>imagebuilder</code></li>
+  <li><code>inspector</code></li>
+  <li><code>inspector2</code> (or <code>inspectorv2</code>)</li>
+  <li><code>internetmonitor</code></li>
+  <li><code>iot</code></li>
+  <li><code>iotanalytics</code></li>
+  <li><code>iotevents</code></li>
+  <li><code>ivs</code></li>
+  <li><code>ivschat</code></li>
+  <li><code>kafka</code> (or <code>msk</code>)</li>
+  <li><code>kafkaconnect</code></li>
+  <li><code>kendra</code></li>
+  <li><code>keyspaces</code></li>
+  <li><code>kinesis</code></li>
+  <li><code>kinesisanalytics</code></li>
+  <li><code>kinesisanalyticsv2</code></li>
+  <li><code>kinesisvideo</code></li>
+  <li><code>kms</code></li>
+  <li><code>lakeformation</code></li>
+  <li><code>lambda</code></li>
+  <li><code>lexmodels</code> (or <code>lexmodelbuilding</code> or <code>lexmodelbuildingservice</code> or <code>lex</code>)</li>
+  <li><code>lexv2models</code> (or <code>lexmodelsv2</code>)</li>
+  <li><code>licensemanager</code></li>
+  <li><code>lightsail</code></li>
+  <li><code>location</code> (or <code>locationservice</code>)</li>
+  <li><code>logs</code> (or <code>cloudwatchlog</code> or <code>cloudwatchlogs</code>)</li>
+  <li><code>macie2</code></li>
+  <li><code>mediaconnect</code></li>
+  <li><code>mediaconvert</code></li>
+  <li><code>medialive</code></li>
+  <li><code>mediapackage</code></li>
+  <li><code>mediastore</code></li>
+  <li><code>memorydb</code></li>
+  <li><code>mq</code></li>
+  <li><code>mwaa</code></li>
+  <li><code>neptune</code></li>
+  <li><code>networkfirewall</code></li>
+  <li><code>networkmanager</code></li>
+  <li><code>oam</code> (or <code>cloudwatchobservabilityaccessmanager</code>)</li>
+  <li><code>opensearch</code> (or <code>opensearchservice</code>)</li>
+  <li><code>opensearchserverless</code></li>
+  <li><code>opsworks</code></li>
+  <li><code>organizations</code></li>
+  <li><code>outposts</code></li>
+  <li><code>pinpoint</code></li>
+  <li><code>pipes</code></li>
+  <li><code>pricing</code></li>
+  <li><code>qldb</code></li>
+  <li><code>quicksight</code></li>
+  <li><code>ram</code></li>
+  <li><code>rbin</code> (or <code>recyclebin</code>)</li>
+  <li><code>rds</code></li>
+  <li><code>redshift</code></li>
+  <li><code>redshiftdata</code> (or <code>redshiftdataapiservice</code>)</li>
+  <li><code>redshiftserverless</code></li>
+  <li><code>resourceexplorer2</code></li>
+  <li><code>resourcegroups</code></li>
+  <li><code>resourcegroupstaggingapi</code> (or <code>resourcegroupstagging</code>)</li>
+  <li><code>rolesanywhere</code></li>
+  <li><code>route53</code></li>
+  <li><code>route53domains</code></li>
+  <li><code>route53recoverycontrolconfig</code></li>
+  <li><code>route53recoveryreadiness</code></li>
+  <li><code>route53resolver</code></li>
+  <li><code>rum</code> (or <code>cloudwatchrum</code>)</li>
+  <li><code>s3</code> (or <code>s3api</code>)</li>
+  <li><code>s3control</code></li>
+  <li><code>s3outposts</code></li>
+  <li><code>sagemaker</code></li>
+  <li><code>scheduler</code></li>
+  <li><code>schemas</code></li>
+  <li><code>secretsmanager</code></li>
+  <li><code>securityhub</code></li>
+  <li><code>securitylake</code></li>
+  <li><code>serverlessrepo</code> (or <code>serverlessapprepo</code> or <code>serverlessapplicationrepository</code>)</li>
+  <li><code>servicecatalog</code></li>
+  <li><code>servicediscovery</code></li>
+  <li><code>servicequotas</code></li>
+  <li><code>ses</code></li>
+  <li><code>sesv2</code></li>
+  <li><code>sfn</code> (or <code>stepfunctions</code>)</li>
+  <li><code>shield</code></li>
+  <li><code>signer</code></li>
+  <li><code>simpledb</code> (or <code>sdb</code>)</li>
+  <li><code>sns</code></li>
+  <li><code>sqs</code></li>
+  <li><code>ssm</code></li>
+  <li><code>ssmcontacts</code></li>
+  <li><code>ssmincidents</code></li>
+  <li><code>ssoadmin</code></li>
+  <li><code>storagegateway</code></li>
+  <li><code>sts</code></li>
+  <li><code>swf</code></li>
+  <li><code>synthetics</code></li>
+  <li><code>timestreamwrite</code></li>
+  <li><code>transcribe</code> (or <code>transcribeservice</code>)</li>
+  <li><code>transfer</code></li>
+  <li><code>verifiedpermissions</code></li>
+  <li><code>vpclattice</code></li>
+  <li><code>waf</code></li>
+  <li><code>wafregional</code></li>
+  <li><code>wafv2</code></li>
+  <li><code>worklink</code></li>
+  <li><code>workspaces</code></li>
+  <li><code>xray</code></li>
+</ul>
+</div>
+<!-- markdownlint-enable no-inline-html -->
+
+As a convenience, for compatibility with the [Terraform S3 Backend](https://www.terraform.io/language/settings/backends/s3),
+the following service endpoints can be configured using environment variables:
+
+* DynamoDB: `TF_AWS_DYNAMODB_ENDPOINT` (or **Deprecated** `AWS_DYNAMODB_ENDPOINT`)
+* IAM: `TF_AWS_IAM_ENDPOINT` (or **Deprecated** `AWS_IAM_ENDPOINT`)
+* S3: `TF_AWS_S3_ENDPOINT` (or **Deprecated** `AWS_S3_ENDPOINT`)
+* STS: `TF_AWS_STS_ENDPOINT` (or **Deprecated** `AWS_STS_ENDPOINT`)
+
+## Connecting to Local AWS Compatible Solutions
+
+~> **NOTE:** This information is not intended to be exhaustive for all local AWS compatible solutions or necessarily authoritative configurations for those documented. Check the documentation for each of these solutions for the most up to date information.
+
+### DynamoDB Local
+
+The Amazon DynamoDB service offers a downloadable version for writing and testing applications without accessing the DynamoDB web service. For more information about this solution, see the [DynamoDB Local documentation in the Amazon DynamoDB Developer Guide](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/DynamoDBLocal.html).
+
+An example provider configuration:
+
+```terraform
+provider "aws" {
+  access_key                  = "mock_access_key"
+  region                      = "us-east-1"
+  secret_key                  = "mock_secret_key"
+  skip_credentials_validation = true
+  skip_metadata_api_check     = true
+  skip_requesting_account_id  = true
+
+  endpoints {
+    dynamodb = "http://localhost:8000"
+  }
+}
+```
+
+### LocalStack
+
+[LocalStack](https://localstack.cloud/) provides an easy-to-use test/mocking framework for developing Cloud applications.
+
+An example provider configuration:
+
+```terraform
+provider "aws" {
+  access_key                  = "mock_access_key"
+  region                      = "us-east-1"
+  s3_use_path_style           = true
+  secret_key                  = "mock_secret_key"
+  skip_credentials_validation = true
+  skip_metadata_api_check     = true
+  skip_requesting_account_id  = true
+
+  endpoints {
+    apigateway     = "http://localhost:4566"
+    cloudformation = "http://localhost:4566"
+    cloudwatch     = "http://localhost:4566"
+    dynamodb       = "http://localhost:4566"
+    es             = "http://localhost:4566"
+    firehose       = "http://localhost:4566"
+    iam            = "http://localhost:4566"
+    kinesis        = "http://localhost:4566"
+    lambda         = "http://localhost:4566"
+    route53        = "http://localhost:4566"
+    redshift       = "http://localhost:4566"
+    s3             = "http://localhost:4566"
+    secretsmanager = "http://localhost:4566"
+    ses            = "http://localhost:4566"
+    sns            = "http://localhost:4566"
+    sqs            = "http://localhost:4566"
+    ssm            = "http://localhost:4566"
+    stepfunctions  = "http://localhost:4566"
+    sts            = "http://localhost:4566"
+  }
+}
+```
diff --git a/website/docs/guides/custom-service-endpoints.html.md b/website/docs/guides/custom-service-endpoints.html.md
deleted file mode 100644
index bf5da3f2d8f..00000000000
--- a/website/docs/guides/custom-service-endpoints.html.md
+++ /dev/null
@@ -1,464 +0,0 @@
----
-subcategory: ""
-layout: "aws"
-page_title: "Terraform AWS Provider Custom Service Endpoint Configuration"
-description: |-
-  Configuring the Terraform AWS Provider to connect to custom AWS service endpoints and AWS compatible solutions.
----
-
-<!-- Generated by internal/generate/customends/main.go; DO NOT EDIT. -->
-
-# Custom Service Endpoint Configuration
-
-The Terraform AWS Provider configuration can be customized to connect to non-default AWS service endpoints and AWS compatible solutions. This may be useful for environments with specific compliance requirements, such as using [AWS FIPS 140-2 endpoints](https://aws.amazon.com/compliance/fips/), connecting to AWS Snowball, SC2S, or C2S environments, or local testing.
-
-This guide outlines how to get started with customizing endpoints, the available endpoint configurations, and offers example configurations for working with certain local development and testing solutions.
-
-~> **NOTE:** Support for connecting the Terraform AWS Provider with custom endpoints and AWS compatible solutions is offered as best effort. Individual Terraform resources may require compatibility updates to work in certain environments. Integration testing by HashiCorp during provider changes is exclusively done against default AWS endpoints at this time.
-
-<!-- TOC depthFrom:2 -->
-
-- [Getting Started with Custom Endpoints](#getting-started-with-custom-endpoints)
-- [Available Endpoint Customizations](#available-endpoint-customizations)
-- [Connecting to Local AWS Compatible Solutions](#connecting-to-local-aws-compatible-solutions)
-    - [DynamoDB Local](#dynamodb-local)
-    - [LocalStack](#localstack)
-
-<!-- /TOC -->
-
-## Getting Started with Custom Endpoints
-
-To configure the Terraform AWS Provider to use customized endpoints, it can be done within `provider` declarations using the `endpoints` configuration block, e.g.,
-
-```terraform
-provider "aws" {
-  # ... potentially other provider configuration ...
-
-  endpoints {
-    dynamodb = "http://localhost:4569"
-    s3       = "http://localhost:4572"
-  }
-}
-```
-
-If multiple, different Terraform AWS Provider configurations are required, see the [Terraform documentation on multiple provider instances](https://www.terraform.io/docs/configuration/providers.html#alias-multiple-provider-instances) for additional information about the `alias` provider configuration and its usage.
-
-## Available Endpoint Customizations
-
-The Terraform AWS Provider allows the following endpoints to be customized.
-
-**Note:** The Provider allows some service endpoints to be customized despite not supporting those services.
-
-**Note:** For backward compatibility, some endpoints can be assigned using multiple service "keys" (_e.g._, `dms`, `databasemigration`, or `databasemigrationservice`). If you use more than one equivalent service key in your configuration, the provider will use the _first_ endpoint value set. For example, in the configuration below we have set the DMS service endpoints using both `dms` and `databasemigration`. The provider will set the endpoint to whichever appears first. Subsequent values are ignored.
-
-```terraform
-provider "aws" {
-  endpoints {
-    dms               = "http://this.value.will.be.used.com"
-    databasemigration = "http://this.value.will.be.ignored.com"
-  }
-}
-```
-
-<!-- markdownlint-disable no-inline-html -->
-<!--
-    The division splits this long list into multiple columns without manually
-    maintaining a table. The terraform.io Markdown parser previously allowed
-    for Markdown within HTML elements, however the Terraform Registry parser
-    is more accurate/strict, so we use raw HTML to maintain this list.
--->
-<!-- Generated by internal/generate/customends/main.go; DO NOT EDIT. -->
-<div style="column-width: 14em;">
-<ul>
-  <li><code>accessanalyzer</code></li>
-  <li><code>account</code></li>
-  <li><code>acm</code></li>
-  <li><code>acmpca</code></li>
-  <li><code>alexaforbusiness</code></li>
-  <li><code>amp</code> (or <code>prometheus</code> or <code>prometheusservice</code>)</li>
-  <li><code>amplify</code></li>
-  <li><code>amplifybackend</code></li>
-  <li><code>amplifyuibuilder</code></li>
-  <li><code>apigateway</code></li>
-  <li><code>apigatewaymanagementapi</code></li>
-  <li><code>apigatewayv2</code></li>
-  <li><code>appautoscaling</code> (or <code>applicationautoscaling</code>)</li>
-  <li><code>appconfig</code></li>
-  <li><code>appconfigdata</code></li>
-  <li><code>appflow</code></li>
-  <li><code>appintegrations</code> (or <code>appintegrationsservice</code>)</li>
-  <li><code>applicationcostprofiler</code></li>
-  <li><code>applicationinsights</code></li>
-  <li><code>appmesh</code></li>
-  <li><code>apprunner</code></li>
-  <li><code>appstream</code></li>
-  <li><code>appsync</code></li>
-  <li><code>athena</code></li>
-  <li><code>auditmanager</code></li>
-  <li><code>autoscaling</code></li>
-  <li><code>autoscalingplans</code></li>
-  <li><code>backup</code></li>
-  <li><code>backupgateway</code></li>
-  <li><code>batch</code></li>
-  <li><code>billingconductor</code></li>
-  <li><code>braket</code></li>
-  <li><code>budgets</code></li>
-  <li><code>ce</code> (or <code>costexplorer</code>)</li>
-  <li><code>chime</code></li>
-  <li><code>chimesdkidentity</code></li>
-  <li><code>chimesdkmediapipelines</code></li>
-  <li><code>chimesdkmeetings</code></li>
-  <li><code>chimesdkmessaging</code></li>
-  <li><code>chimesdkvoice</code></li>
-  <li><code>cleanrooms</code></li>
-  <li><code>cloud9</code></li>
-  <li><code>cloudcontrol</code> (or <code>cloudcontrolapi</code>)</li>
-  <li><code>clouddirectory</code></li>
-  <li><code>cloudformation</code></li>
-  <li><code>cloudfront</code></li>
-  <li><code>cloudhsmv2</code> (or <code>cloudhsm</code>)</li>
-  <li><code>cloudsearch</code></li>
-  <li><code>cloudsearchdomain</code></li>
-  <li><code>cloudtrail</code></li>
-  <li><code>cloudwatch</code></li>
-  <li><code>codeartifact</code></li>
-  <li><code>codebuild</code></li>
-  <li><code>codecommit</code></li>
-  <li><code>codeguruprofiler</code></li>
-  <li><code>codegurureviewer</code></li>
-  <li><code>codepipeline</code></li>
-  <li><code>codestar</code></li>
-  <li><code>codestarconnections</code></li>
-  <li><code>codestarnotifications</code></li>
-  <li><code>cognitoidentity</code></li>
-  <li><code>cognitoidp</code> (or <code>cognitoidentityprovider</code>)</li>
-  <li><code>cognitosync</code></li>
-  <li><code>comprehend</code></li>
-  <li><code>comprehendmedical</code></li>
-  <li><code>computeoptimizer</code></li>
-  <li><code>configservice</code> (or <code>config</code>)</li>
-  <li><code>connect</code></li>
-  <li><code>connectcontactlens</code></li>
-  <li><code>connectparticipant</code></li>
-  <li><code>controltower</code></li>
-  <li><code>cur</code> (or <code>costandusagereportservice</code>)</li>
-  <li><code>customerprofiles</code></li>
-  <li><code>databrew</code> (or <code>gluedatabrew</code>)</li>
-  <li><code>dataexchange</code></li>
-  <li><code>datapipeline</code></li>
-  <li><code>datasync</code></li>
-  <li><code>dax</code></li>
-  <li><code>deploy</code> (or <code>codedeploy</code>)</li>
-  <li><code>detective</code></li>
-  <li><code>devicefarm</code></li>
-  <li><code>devopsguru</code></li>
-  <li><code>directconnect</code></li>
-  <li><code>discovery</code> (or <code>applicationdiscovery</code> or <code>applicationdiscoveryservice</code>)</li>
-  <li><code>dlm</code></li>
-  <li><code>dms</code> (or <code>databasemigration</code> or <code>databasemigrationservice</code>)</li>
-  <li><code>docdb</code></li>
-  <li><code>docdbelastic</code></li>
-  <li><code>drs</code></li>
-  <li><code>ds</code> (or <code>directoryservice</code>)</li>
-  <li><code>dynamodb</code></li>
-  <li><code>dynamodbstreams</code></li>
-  <li><code>ebs</code></li>
-  <li><code>ec2</code></li>
-  <li><code>ec2instanceconnect</code></li>
-  <li><code>ecr</code></li>
-  <li><code>ecrpublic</code></li>
-  <li><code>ecs</code></li>
-  <li><code>efs</code></li>
-  <li><code>eks</code></li>
-  <li><code>elasticache</code></li>
-  <li><code>elasticbeanstalk</code> (or <code>beanstalk</code>)</li>
-  <li><code>elasticinference</code></li>
-  <li><code>elasticsearch</code> (or <code>es</code> or <code>elasticsearchservice</code>)</li>
-  <li><code>elastictranscoder</code></li>
-  <li><code>elb</code> (or <code>elasticloadbalancing</code>)</li>
-  <li><code>elbv2</code> (or <code>elasticloadbalancingv2</code>)</li>
-  <li><code>emr</code></li>
-  <li><code>emrcontainers</code></li>
-  <li><code>emrserverless</code></li>
-  <li><code>events</code> (or <code>eventbridge</code> or <code>cloudwatchevents</code>)</li>
-  <li><code>evidently</code> (or <code>cloudwatchevidently</code>)</li>
-  <li><code>finspace</code></li>
-  <li><code>finspacedata</code></li>
-  <li><code>firehose</code></li>
-  <li><code>fis</code></li>
-  <li><code>fms</code></li>
-  <li><code>forecast</code> (or <code>forecastservice</code>)</li>
-  <li><code>forecastquery</code> (or <code>forecastqueryservice</code>)</li>
-  <li><code>frauddetector</code></li>
-  <li><code>fsx</code></li>
-  <li><code>gamelift</code></li>
-  <li><code>glacier</code></li>
-  <li><code>globalaccelerator</code></li>
-  <li><code>glue</code></li>
-  <li><code>grafana</code> (or <code>managedgrafana</code> or <code>amg</code>)</li>
-  <li><code>greengrass</code></li>
-  <li><code>greengrassv2</code></li>
-  <li><code>groundstation</code></li>
-  <li><code>guardduty</code></li>
-  <li><code>health</code></li>
-  <li><code>healthlake</code></li>
-  <li><code>honeycode</code></li>
-  <li><code>iam</code></li>
-  <li><code>identitystore</code></li>
-  <li><code>imagebuilder</code></li>
-  <li><code>inspector</code></li>
-  <li><code>inspector2</code> (or <code>inspectorv2</code>)</li>
-  <li><code>internetmonitor</code></li>
-  <li><code>iot</code></li>
-  <li><code>iot1clickdevices</code> (or <code>iot1clickdevicesservice</code>)</li>
-  <li><code>iot1clickprojects</code></li>
-  <li><code>iotanalytics</code></li>
-  <li><code>iotdata</code> (or <code>iotdataplane</code>)</li>
-  <li><code>iotdeviceadvisor</code></li>
-  <li><code>iotevents</code></li>
-  <li><code>ioteventsdata</code></li>
-  <li><code>iotfleethub</code></li>
-  <li><code>iotjobsdata</code> (or <code>iotjobsdataplane</code>)</li>
-  <li><code>iotsecuretunneling</code></li>
-  <li><code>iotsitewise</code></li>
-  <li><code>iotthingsgraph</code></li>
-  <li><code>iottwinmaker</code></li>
-  <li><code>iotwireless</code></li>
-  <li><code>ivs</code></li>
-  <li><code>ivschat</code></li>
-  <li><code>kafka</code> (or <code>msk</code>)</li>
-  <li><code>kafkaconnect</code></li>
-  <li><code>kendra</code></li>
-  <li><code>keyspaces</code></li>
-  <li><code>kinesis</code></li>
-  <li><code>kinesisanalytics</code></li>
-  <li><code>kinesisanalyticsv2</code></li>
-  <li><code>kinesisvideo</code></li>
-  <li><code>kinesisvideoarchivedmedia</code></li>
-  <li><code>kinesisvideomedia</code></li>
-  <li><code>kinesisvideosignaling</code> (or <code>kinesisvideosignalingchannels</code>)</li>
-  <li><code>kms</code></li>
-  <li><code>lakeformation</code></li>
-  <li><code>lambda</code></li>
-  <li><code>lexmodels</code> (or <code>lexmodelbuilding</code> or <code>lexmodelbuildingservice</code> or <code>lex</code>)</li>
-  <li><code>lexmodelsv2</code> (or <code>lexv2models</code>)</li>
-  <li><code>lexruntime</code> (or <code>lexruntimeservice</code>)</li>
-  <li><code>lexruntimev2</code> (or <code>lexv2runtime</code>)</li>
-  <li><code>licensemanager</code></li>
-  <li><code>lightsail</code></li>
-  <li><code>location</code> (or <code>locationservice</code>)</li>
-  <li><code>logs</code> (or <code>cloudwatchlog</code> or <code>cloudwatchlogs</code>)</li>
-  <li><code>lookoutequipment</code></li>
-  <li><code>lookoutmetrics</code></li>
-  <li><code>lookoutvision</code> (or <code>lookoutforvision</code>)</li>
-  <li><code>machinelearning</code></li>
-  <li><code>macie</code></li>
-  <li><code>macie2</code></li>
-  <li><code>managedblockchain</code></li>
-  <li><code>marketplacecatalog</code></li>
-  <li><code>marketplacecommerceanalytics</code></li>
-  <li><code>marketplaceentitlement</code> (or <code>marketplaceentitlementservice</code>)</li>
-  <li><code>marketplacemetering</code> (or <code>meteringmarketplace</code>)</li>
-  <li><code>mediaconnect</code></li>
-  <li><code>mediaconvert</code></li>
-  <li><code>medialive</code></li>
-  <li><code>mediapackage</code></li>
-  <li><code>mediapackagevod</code></li>
-  <li><code>mediastore</code></li>
-  <li><code>mediastoredata</code></li>
-  <li><code>mediatailor</code></li>
-  <li><code>memorydb</code></li>
-  <li><code>mgh</code> (or <code>migrationhub</code>)</li>
-  <li><code>mgn</code></li>
-  <li><code>migrationhubconfig</code></li>
-  <li><code>migrationhubrefactorspaces</code></li>
-  <li><code>migrationhubstrategy</code> (or <code>migrationhubstrategyrecommendations</code>)</li>
-  <li><code>mobile</code></li>
-  <li><code>mq</code></li>
-  <li><code>mturk</code></li>
-  <li><code>mwaa</code></li>
-  <li><code>neptune</code></li>
-  <li><code>networkfirewall</code></li>
-  <li><code>networkmanager</code></li>
-  <li><code>nimble</code> (or <code>nimblestudio</code>)</li>
-  <li><code>oam</code> (or <code>cloudwatchobservabilityaccessmanager</code>)</li>
-  <li><code>opensearch</code> (or <code>opensearchservice</code>)</li>
-  <li><code>opensearchserverless</code></li>
-  <li><code>opsworks</code></li>
-  <li><code>opsworkscm</code></li>
-  <li><code>organizations</code></li>
-  <li><code>outposts</code></li>
-  <li><code>panorama</code></li>
-  <li><code>personalize</code></li>
-  <li><code>personalizeevents</code></li>
-  <li><code>personalizeruntime</code></li>
-  <li><code>pi</code></li>
-  <li><code>pinpoint</code></li>
-  <li><code>pinpointemail</code></li>
-  <li><code>pinpointsmsvoice</code></li>
-  <li><code>pipes</code></li>
-  <li><code>polly</code></li>
-  <li><code>pricing</code></li>
-  <li><code>proton</code></li>
-  <li><code>qldb</code></li>
-  <li><code>qldbsession</code></li>
-  <li><code>quicksight</code></li>
-  <li><code>ram</code></li>
-  <li><code>rbin</code> (or <code>recyclebin</code>)</li>
-  <li><code>rds</code></li>
-  <li><code>rdsdata</code> (or <code>rdsdataservice</code>)</li>
-  <li><code>redshift</code></li>
-  <li><code>redshiftdata</code> (or <code>redshiftdataapiservice</code>)</li>
-  <li><code>redshiftserverless</code></li>
-  <li><code>rekognition</code></li>
-  <li><code>resiliencehub</code></li>
-  <li><code>resourceexplorer2</code></li>
-  <li><code>resourcegroups</code></li>
-  <li><code>resourcegroupstaggingapi</code> (or <code>resourcegroupstagging</code>)</li>
-  <li><code>robomaker</code></li>
-  <li><code>rolesanywhere</code></li>
-  <li><code>route53</code></li>
-  <li><code>route53domains</code></li>
-  <li><code>route53recoverycluster</code></li>
-  <li><code>route53recoverycontrolconfig</code></li>
-  <li><code>route53recoveryreadiness</code></li>
-  <li><code>route53resolver</code></li>
-  <li><code>rum</code> (or <code>cloudwatchrum</code>)</li>
-  <li><code>s3</code> (or <code>s3api</code>)</li>
-  <li><code>s3control</code></li>
-  <li><code>s3outposts</code></li>
-  <li><code>sagemaker</code></li>
-  <li><code>sagemakera2iruntime</code> (or <code>augmentedairuntime</code>)</li>
-  <li><code>sagemakeredge</code> (or <code>sagemakeredgemanager</code>)</li>
-  <li><code>sagemakerfeaturestoreruntime</code></li>
-  <li><code>sagemakerruntime</code></li>
-  <li><code>savingsplans</code></li>
-  <li><code>scheduler</code></li>
-  <li><code>schemas</code></li>
-  <li><code>secretsmanager</code></li>
-  <li><code>securityhub</code></li>
-  <li><code>securitylake</code></li>
-  <li><code>serverlessrepo</code> (or <code>serverlessapprepo</code> or <code>serverlessapplicationrepository</code>)</li>
-  <li><code>servicecatalog</code></li>
-  <li><code>servicecatalogappregistry</code> (or <code>appregistry</code>)</li>
-  <li><code>servicediscovery</code></li>
-  <li><code>servicequotas</code></li>
-  <li><code>ses</code></li>
-  <li><code>sesv2</code></li>
-  <li><code>sfn</code> (or <code>stepfunctions</code>)</li>
-  <li><code>shield</code></li>
-  <li><code>signer</code></li>
-  <li><code>simpledb</code> (or <code>sdb</code>)</li>
-  <li><code>sms</code></li>
-  <li><code>snowball</code></li>
-  <li><code>snowdevicemanagement</code></li>
-  <li><code>sns</code></li>
-  <li><code>sqs</code></li>
-  <li><code>ssm</code></li>
-  <li><code>ssmcontacts</code></li>
-  <li><code>ssmincidents</code></li>
-  <li><code>sso</code></li>
-  <li><code>ssoadmin</code></li>
-  <li><code>ssooidc</code></li>
-  <li><code>storagegateway</code></li>
-  <li><code>sts</code></li>
-  <li><code>support</code></li>
-  <li><code>swf</code></li>
-  <li><code>synthetics</code></li>
-  <li><code>textract</code></li>
-  <li><code>timestreamquery</code></li>
-  <li><code>timestreamwrite</code></li>
-  <li><code>transcribe</code> (or <code>transcribeservice</code>)</li>
-  <li><code>transcribestreaming</code> (or <code>transcribestreamingservice</code>)</li>
-  <li><code>transfer</code></li>
-  <li><code>translate</code></li>
-  <li><code>voiceid</code></li>
-  <li><code>vpclattice</code></li>
-  <li><code>waf</code></li>
-  <li><code>wafregional</code></li>
-  <li><code>wafv2</code></li>
-  <li><code>wellarchitected</code></li>
-  <li><code>wisdom</code> (or <code>connectwisdomservice</code>)</li>
-  <li><code>workdocs</code></li>
-  <li><code>worklink</code></li>
-  <li><code>workmail</code></li>
-  <li><code>workmailmessageflow</code></li>
-  <li><code>workspaces</code></li>
-  <li><code>workspacesweb</code></li>
-  <li><code>xray</code></li>
-</ul>
-</div>
-<!-- markdownlint-enable no-inline-html -->
-
-As a convenience, for compatibility with the [Terraform S3 Backend](https://www.terraform.io/language/settings/backends/s3),
-the following service endpoints can be configured using environment variables:
-
-* DynamoDB: `TF_AWS_DYNAMODB_ENDPOINT` (or **Deprecated** `AWS_DYNAMODB_ENDPOINT`)
-* IAM: `TF_AWS_IAM_ENDPOINT` (or **Deprecated** `AWS_IAM_ENDPOINT`)
-* S3: `TF_AWS_S3_ENDPOINT` (or **Deprecated** `AWS_S3_ENDPOINT`)
-* STS: `TF_AWS_STS_ENDPOINT` (or **Deprecated** `AWS_STS_ENDPOINT`)
-
-## Connecting to Local AWS Compatible Solutions
-
-~> **NOTE:** This information is not intended to be exhaustive for all local AWS compatible solutions or necessarily authoritative configurations for those documented. Check the documentation for each of these solutions for the most up to date information.
-
-### DynamoDB Local
-
-The Amazon DynamoDB service offers a downloadable version for writing and testing applications without accessing the DynamoDB web service. For more information about this solution, see the [DynamoDB Local documentation in the Amazon DynamoDB Developer Guide](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/DynamoDBLocal.html).
-
-An example provider configuration:
-
-```terraform
-provider "aws" {
-  access_key                  = "mock_access_key"
-  region                      = "us-east-1"
-  secret_key                  = "mock_secret_key"
-  skip_credentials_validation = true
-  skip_metadata_api_check     = true
-  skip_requesting_account_id  = true
-
-  endpoints {
-    dynamodb = "http://localhost:8000"
-  }
-}
-```
-
-### LocalStack
-
-[LocalStack](https://localstack.cloud/) provides an easy-to-use test/mocking framework for developing Cloud applications.
-
-An example provider configuration:
-
-```terraform
-provider "aws" {
-  access_key                  = "mock_access_key"
-  region                      = "us-east-1"
-  s3_use_path_style           = true
-  secret_key                  = "mock_secret_key"
-  skip_credentials_validation = true
-  skip_metadata_api_check     = true
-  skip_requesting_account_id  = true
-
-  endpoints {
-    apigateway     = "http://localhost:4566"
-    cloudformation = "http://localhost:4566"
-    cloudwatch     = "http://localhost:4566"
-    dynamodb       = "http://localhost:4566"
-    es             = "http://localhost:4566"
-    firehose       = "http://localhost:4566"
-    iam            = "http://localhost:4566"
-    kinesis        = "http://localhost:4566"
-    lambda         = "http://localhost:4566"
-    route53        = "http://localhost:4566"
-    redshift       = "http://localhost:4566"
-    s3             = "http://localhost:4566"
-    secretsmanager = "http://localhost:4566"
-    ses            = "http://localhost:4566"
-    sns            = "http://localhost:4566"
-    sqs            = "http://localhost:4566"
-    ssm            = "http://localhost:4566"
-    stepfunctions  = "http://localhost:4566"
-    sts            = "http://localhost:4566"
-  }
-}
-```
diff --git a/website/docs/guides/resource-tagging.html.md b/website/docs/guides/resource-tagging.html.markdown
similarity index 100%
rename from website/docs/guides/resource-tagging.html.md
rename to website/docs/guides/resource-tagging.html.markdown
diff --git a/website/docs/guides/using-aws-with-awscc-provider.html.md b/website/docs/guides/using-aws-with-awscc-provider.html.markdown
similarity index 100%
rename from website/docs/guides/using-aws-with-awscc-provider.html.md
rename to website/docs/guides/using-aws-with-awscc-provider.html.markdown
diff --git a/website/docs/guides/version-2-upgrade.html.md b/website/docs/guides/version-2-upgrade.html.markdown
similarity index 100%
rename from website/docs/guides/version-2-upgrade.html.md
rename to website/docs/guides/version-2-upgrade.html.markdown
diff --git a/website/docs/guides/version-3-upgrade.html.markdown b/website/docs/guides/version-3-upgrade.html.markdown
new file mode 100644
index 00000000000..093a585531f
--- /dev/null
+++ b/website/docs/guides/version-3-upgrade.html.markdown
@@ -0,0 +1,1476 @@
+---
+subcategory: ""
+layout: "aws"
+page_title: "Terraform AWS Provider Version 3 Upgrade Guide"
+description: |-
+  Terraform AWS Provider Version 3 Upgrade Guide
+---
+
+# Terraform AWS Provider Version 3 Upgrade Guide
+
+Version 3.0.0 of the AWS provider for Terraform is a major release and includes some changes that you will need to consider when upgrading. This guide is intended to help with that process and focuses only on changes from version 2.X to version 3.0.0. See the [Version 2 Upgrade Guide](/docs/providers/aws/guides/version-2-upgrade.html) for information about upgrading from 1.X to version 2.0.0.
+
+Most of the changes outlined in this guide have been previously marked as deprecated in the Terraform plan/apply output throughout previous provider releases. These changes, such as deprecation notices, can always be found in the [Terraform AWS Provider CHANGELOG](https://github.com/hashicorp/terraform-provider-aws/blob/main/CHANGELOG.md).
+
+~> **NOTE:** Version 3.0.0 and later of the AWS Provider can only be automatically installed on Terraform 0.12 and later.
+
+Upgrade topics:
+
+<!-- TOC depthFrom:2 depthTo:2 -->
+
+- [Provider Version Configuration](#provider-version-configuration)
+- [Provider Authentication Updates](#provider-authentication-updates)
+- [Provider Custom Service Endpoint Updates](#provider-custom-service-endpoint-updates)
+- [Data Source: aws_availability_zones](#data-source-aws_availability_zones)
+- [Data Source: aws_lambda_invocation](#data-source-aws_lambda_invocation)
+- [Data Source: aws_launch_template](#data-source-aws_launch_template)
+- [Data Source: aws_route53_resolver_rule](#data-source-aws_route53_resolver_rule)
+- [Data Source: aws_route53_zone](#data-source-aws_route53_zone)
+- [Resource: aws_acm_certificate](#resource-aws_acm_certificate)
+- [Resource: aws_api_gateway_method_settings](#resource-aws_api_gateway_method_settings)
+- [Resource: aws_autoscaling_group](#resource-aws_autoscaling_group)
+- [Resource: aws_cloudfront_distribution](#resource-aws_cloudfront_distribution)
+- [Resource: aws_cloudwatch_log_group](#resource-aws_cloudwatch_log_group)
+- [Resource: aws_codepipeline](#resource-aws_codepipeline)
+- [Resource: aws_cognito_user_pool](#resource-aws_cognito_user_pool)
+- [Resource: aws_dx_gateway](#resource-aws_dx_gateway)
+- [Resource: aws_dx_gateway_association](#resource-aws_dx_gateway_association)
+- [Resource: aws_dx_gateway_association_proposal](#resource-aws_dx_gateway_association_proposal)
+- [Resource: aws_ebs_volume](#resource-aws_ebs_volume)
+- [Resource: aws_elastic_transcoder_preset](#resource-aws_elastic_transcoder_preset)
+- [Resource: aws_emr_cluster](#resource-aws_emr_cluster)
+- [Resource: aws_glue_job](#resource-aws_glue_job)
+- [Resource: aws_iam_access_key](#resource-aws_iam_access_key)
+- [Resource: aws_iam_instance_profile](#resource-aws_iam_instance_profile)
+- [Resource: aws_iam_server_certificate](#resource-aws_iam_server_certificate)
+- [Resource: aws_instance](#resource-aws_instance)
+- [Resource: aws_lambda_alias](#resource-aws_lambda_alias)
+- [Resource: aws_launch_template](#resource-aws_launch_template)
+- [Resource: aws_lb_listener_rule](#resource-aws_lb_listener_rule)
+- [Resource: aws_msk_cluster](#resource-aws_msk_cluster)
+- [Resource: aws_rds_cluster](#resource-aws_rds_cluster)
+- [Resource: aws_route53_resolver_rule](#resource-aws_route53_resolver_rule)
+- [Resource: aws_route53_zone](#resource-aws_route53_zone)
+- [Resource: aws_s3_bucket](#resource-aws_s3_bucket)
+- [Resource: aws_s3_bucket_metric](#resource-aws_s3_bucket_metric)
+- [Resource: aws_security_group](#resource-aws_security_group)
+- [Resource: aws_sns_platform_application](#resource-aws_sns_platform_application)
+- [Resource: aws_spot_fleet_request](#resource-aws_spot_fleet_request)
+
+<!-- /TOC -->
+
+## Provider Version Configuration
+
+-> Before upgrading to version 3.0.0, it is recommended to upgrade to the most recent 2.X version of the provider and ensure that your environment successfully runs [`terraform plan`](https://www.terraform.io/docs/commands/plan.html) without unexpected changes or deprecation notices.
+
+We recommend using [version constraints when configuring Terraform providers](https://www.terraform.io/docs/configuration/providers.html#provider-versions). If you are following that recommendation, update the version constraints in your Terraform configuration and run [`terraform init`](https://www.terraform.io/docs/commands/init.html) to download the new version.
+
+For example, given this previous configuration:
+
+```terraform
+provider "aws" {
+  # ... other configuration ...
+
+  version = "~> 2.70"
+}
+```
+
+Update to latest 3.X version:
+
+```terraform
+provider "aws" {
+  # ... other configuration ...
+
+  version = "~> 3.0"
+}
+```
+
+## Provider Authentication Updates
+
+### Authentication Ordering
+
+Previously, the provider preferred credentials in the following order:
+
+- Static credentials (those defined in the Terraform configuration)
+- Environment variables (e.g., `AWS_ACCESS_KEY_ID` or `AWS_PROFILE`)
+- Shared credentials file (e.g., `~/.aws/credentials`)
+- EC2 Instance Metadata Service
+- Default AWS Go SDK handling (shared configuration, CodeBuild/ECS/EKS)
+
+The provider now prefers the following credential ordering:
+
+- Static credentials (those defined in the Terraform configuration)
+- Environment variables (e.g., `AWS_ACCESS_KEY_ID` or `AWS_PROFILE`)
+- Shared credentials and/or configuration file (e.g., `~/.aws/credentials` and `~/.aws/config`)
+- Default AWS Go SDK handling (shared configuration, CodeBuild/ECS/EKS, EC2 Instance Metadata Service)
+
+This means workarounds of disabling the EC2 Instance Metadata Service handling to enable CodeBuild/ECS/EKS credentials or to enable other credential methods such as `credential_process` in the AWS shared configuration are no longer necessary.
+
+### Shared Configuration File Automatically Enabled
+
+The `AWS_SDK_LOAD_CONFIG` environment variable is no longer necessary for the provider to automatically load the AWS shared configuration file (e.g., `~/.aws/config`).
+
+### Removal of AWS_METADATA_TIMEOUT Environment Variable Usage
+
+The provider now relies on the default AWS Go SDK timeouts for interacting with the EC2 Instance Metadata Service.
+
+## Provider Custom Service Endpoint Updates
+
+### Removal of kinesis_analytics and r53 Arguments
+
+The [custom service endpoints](custom-service-endpoints.html) for Kinesis Analytics and Route 53 now use the `kinesisanalytics` and `route53` argument names in the provider configuration.
+
+For example, given this previous configuration:
+
+```terraform
+provider "aws" {
+  # ... potentially other configuration ...
+
+  endpoints {
+    # ... potentially other configuration ...
+
+    kinesis_analytics = "https://example.com"
+    r53               = "https://example.com"
+  }
+}
+```
+
+An updated configuration:
+
+```terraform
+provider "aws" {
+  # ... potentially other configuration ...
+
+  endpoints {
+    # ... potentially other configuration ...
+
+    kinesisanalytics = "https://example.com"
+    route53          = "https://example.com"
+  }
+}
+```
+
+## Data Source: aws_availability_zones
+
+### blacklisted_names Attribute Removal
+
+Switch your Terraform configuration to the `exclude_names` attribute instead.
+
+For example, given this previous configuration:
+
+```terraform
+data "aws_availability_zones" "example" {
+  blacklisted_names = ["us-west-2d"]
+}
+```
+
+An updated configuration:
+
+```terraform
+data "aws_availability_zones" "example" {
+  exclude_names = ["us-west-2d"]
+}
+```
+
+### blacklisted_zone_ids Attribute Removal
+
+Switch your Terraform configuration to the `exclude_zone_ids` attribute instead.
+
+For example, given this previous configuration:
+
+```terraform
+data "aws_availability_zones" "example" {
+  blacklisted_zone_ids = ["usw2-az4"]
+}
+```
+
+An updated configuration:
+
+```terraform
+data "aws_availability_zones" "example" {
+  exclude_zone_ids = ["usw2-az4"]
+}
+```
+
+## Data Source: aws_lambda_invocation
+
+### result_map Attribute Removal
+
+Switch your Terraform configuration to the `result` attribute with the [`jsondecode()` function](https://www.terraform.io/docs/configuration/functions/jsondecode.html) instead.
+
+For example, given this previous configuration:
+
+```terraform
+# In Terraform 0.11 and earlier, the result_map attribute can be used
+# to convert a result JSON string to a map of string keys to string values.
+output "lambda_result" {
+  value = "${data.aws_lambda_invocation.example.result_map["key1"]}"
+}
+```
+
+An updated configuration:
+
+```terraform
+# In Terraform 0.12 and later, the jsondecode() function can be used
+# to convert a result JSON string to native Terraform types.
+output "lambda_result" {
+  value = jsondecode(data.aws_lambda_invocation.example.result)["key1"]
+}
+```
+
+## Data Source: aws_launch_template
+
+### Error raised if no matching launch template is found
+
+Previously, when a launch template matching the criteria was not found the data source would have been `null`.
+Now this could produce errors similar to the below:
+
+```
+data.aws_launch_template.current: Refreshing state...
+
+Error: error reading launch template: empty output
+```
+
+Configuration that depend on the previous behavior will need to be updated.
+
+## Data Source: aws_route53_resolver_rule
+
+### Removal of trailing period in domain_name argument
+
+Previously the data-source returned the Resolver Rule Domain Name directly from the API, which included a `.` suffix. This proves difficult when many other AWS services do not accept this trailing period (e.g., ACM Certificate). This period is now automatically removed. For example, when the attribute would previously return a Resolver Rule Domain Name such as `example.com.`, the attribute now will be returned as `example.com`.
+While the returned value will omit the trailing period, use of configurations with trailing periods will not be interrupted.
+
+## Data Source: aws_route53_zone
+
+### Removal of trailing period in name argument
+
+Previously the data-source returned the Hosted Zone Domain Name directly from the API, which included a `.` suffix. This proves difficult when many other AWS services do not accept this trailing period (e.g., ACM Certificate). This period is now automatically removed. For example, when the attribute would previously return a Hosted Zone Domain Name such as `example.com.`, the attribute now will be returned as `example.com`.
+While the returned value will omit the trailing period, use of configurations with trailing periods will not be interrupted.
+
+## Resource: aws_acm_certificate
+
+### domain_validation_options Changed from List to Set
+
+Previously, the `domain_validation_options` attribute was a list type and completely unknown until after an initial `terraform apply`. This generally required complicated configuration workarounds to properly create DNS validation records since referencing this attribute directly could produce errors similar to the below:
+
+```
+Error: Invalid for_each argument
+
+  on main.tf line 16, in resource "aws_route53_record" "existing":
+  16:   for_each = aws_acm_certificate.existing.domain_validation_options
+
+The `for_each` value depends on resource attributes that cannot be determined
+until apply, so Terraform cannot predict how many instances will be created.
+To work around this, use the -target argument to first apply only the
+resources that the for_each depends on.
+```
+
+The `domain_validation_options` attribute is now a set type and the resource will attempt to populate the information necessary during the planning phase to handle the above situation in most environments without workarounds. This change also prevents Terraform from showing unexpected differences if the API returns the results in varying order.
+
+Configuration references to this attribute will likely require updates since sets cannot be indexed (e.g., `domain_validation_options[0]` or the older `domain_validation_options.0.` syntax will return errors).
+If the `domain_validation_options` list previously contained only a single element like the two examples just shown,
+it may be possible to wrap these references using the [`tolist()` function](https://www.terraform.io/docs/configuration/functions/tolist.html)
+<!-- markdownlint-disable-next-line no-reversed-links -->
+(e.g., `tolist(aws_acm_certificate.example.domain_validation_options)[0]`) as a quick configuration update.
+However given the complexity and workarounds required with the previous `domain_validation_options` attribute implementation,
+different environments will require different configuration updates and migration steps.
+Below is a more advanced example.
+Further questions on potential update steps can be submitted to the [community forums](https://discuss.hashicorp.com/c/terraform-providers/tf-aws/33).
+
+For example, given this previous configuration using a `count` based resource approach that may have been used in certain environments:
+
+```terraform
+data "aws_route53_zone" "public_root_domain" {
+  name = var.public_root_domain
+}
+
+resource "aws_acm_certificate" "existing" {
+  domain_name = "existing.${var.public_root_domain}"
+  subject_alternative_names = [
+    "existing1.${var.public_root_domain}",
+    "existing2.${var.public_root_domain}",
+    "existing3.${var.public_root_domain}",
+  ]
+  validation_method = "DNS"
+}
+
+resource "aws_route53_record" "existing" {
+  count = length(aws_acm_certificate.existing.subject_alternative_names) + 1
+
+  allow_overwrite = true
+  name            = aws_acm_certificate.existing.domain_validation_options[count.index].resource_record_name
+  records         = [aws_acm_certificate.existing.domain_validation_options[count.index].resource_record_value]
+  ttl             = 60
+  type            = aws_acm_certificate.existing.domain_validation_options[count.index].resource_record_type
+  zone_id         = data.aws_route53_zone.public_root_domain.zone_id
+}
+
+resource "aws_acm_certificate_validation" "existing" {
+  certificate_arn         = aws_acm_certificate.existing.arn
+  validation_record_fqdns = aws_route53_record.existing[*].fqdn
+}
+```
+
+It will receive errors like the below after upgrading:
+
+```
+Error: Invalid index
+
+  on main.tf line 14, in resource "aws_route53_record" "existing":
+  14:   name    = aws_acm_certificate.existing.domain_validation_options[count.index].resource_record_name
+    |----------------
+    | aws_acm_certificate.existing.domain_validation_options is set of object with 4 elements
+    | count.index is 1
+
+This value does not have any indices.
+```
+
+Since the `domain_validation_options` attribute changed from a list to a set and sets cannot be indexed in Terraform, the recommendation is to update the configuration to use the more stable [resource `for_each` support](https://www.terraform.io/docs/configuration/meta-arguments/for_each.html) instead of [`count`](https://www.terraform.io/docs/configuration/meta-arguments/count.html). Note the slight change in the `validation_record_fqdns` syntax as well.
+
+```terraform
+resource "aws_route53_record" "existing" {
+  for_each = {
+    for dvo in aws_acm_certificate.existing.domain_validation_options : dvo.domain_name => {
+      name   = dvo.resource_record_name
+      record = dvo.resource_record_value
+      type   = dvo.resource_record_type
+    }
+  }
+
+  allow_overwrite = true
+  name            = each.value.name
+  records         = [each.value.record]
+  ttl             = 60
+  type            = each.value.type
+  zone_id         = data.aws_route53_zone.public_root_domain.zone_id
+}
+
+resource "aws_acm_certificate_validation" "existing" {
+  certificate_arn         = aws_acm_certificate.existing.arn
+  validation_record_fqdns = [for record in aws_route53_record.existing : record.fqdn]
+}
+```
+
+After the configuration has been updated, a plan should no longer error and may look like the following:
+
+```
+------------------------------------------------------------------------
+
+An execution plan has been generated and is shown below.
+Resource actions are indicated with the following symbols:
+  + create
+  - destroy
+-/+ destroy and then create replacement
+
+Terraform will perform the following actions:
+
+  # aws_acm_certificate_validation.existing must be replaced
+-/+ resource "aws_acm_certificate_validation" "existing" {
+        certificate_arn         = "arn:aws:acm:us-east-2:123456789012:certificate/ccbc58e8-061d-4443-9035-d3af0512e863"
+      ~ id                      = "2020-07-16 00:01:19 +0000 UTC" -> (known after apply)
+      ~ validation_record_fqdns = [
+          - "_40b71647a8d88eb82d53fe988e8a3cc1.existing2.example.com",
+          - "_812ddf11b781af1eec1643ec58f102d2.existing.example.com",
+          - "_8dc56b6e35f699b8754afcdd79e9748d.existing3.example.com",
+          - "_d7112da809a40e848207c04399babcec.existing1.example.com",
+        ] -> (known after apply) # forces replacement
+    }
+
+  # aws_route53_record.existing will be destroyed
+  - resource "aws_route53_record" "existing" {
+      - fqdn    = "_812ddf11b781af1eec1643ec58f102d2.existing.example.com" -> null
+      - id      = "Z123456789012__812ddf11b781af1eec1643ec58f102d2.existing.example.com._CNAME" -> null
+      - name    = "_812ddf11b781af1eec1643ec58f102d2.existing.example.com" -> null
+      - records = [
+          - "_bdeba72164eec216c55a32374bcceafd.jfrzftwwjs.acm-validations.aws.",
+        ] -> null
+      - ttl     = 60 -> null
+      - type    = "CNAME" -> null
+      - zone_id = "Z123456789012" -> null
+    }
+
+  # aws_route53_record.existing[1] will be destroyed
+  - resource "aws_route53_record" "existing" {
+      - fqdn    = "_40b71647a8d88eb82d53fe988e8a3cc1.existing2.example.com" -> null
+      - id      = "Z123456789012__40b71647a8d88eb82d53fe988e8a3cc1.existing2.example.com._CNAME" -> null
+      - name    = "_40b71647a8d88eb82d53fe988e8a3cc1.existing2.example.com" -> null
+      - records = [
+          - "_638532db1fa6a1b71aaf063c8ea29d52.jfrzftwwjs.acm-validations.aws.",
+        ] -> null
+      - ttl     = 60 -> null
+      - type    = "CNAME" -> null
+      - zone_id = "Z123456789012" -> null
+    }
+
+  # aws_route53_record.existing[2] will be destroyed
+  - resource "aws_route53_record" "existing" {
+      - fqdn    = "_d7112da809a40e848207c04399babcec.existing1.example.com" -> null
+      - id      = "Z123456789012__d7112da809a40e848207c04399babcec.existing1.example.com._CNAME" -> null
+      - name    = "_d7112da809a40e848207c04399babcec.existing1.example.com" -> null
+      - records = [
+          - "_6e1da5574ab46a6c782ed73438274181.jfrzftwwjs.acm-validations.aws.",
+        ] -> null
+      - ttl     = 60 -> null
+      - type    = "CNAME" -> null
+      - zone_id = "Z123456789012" -> null
+    }
+
+  # aws_route53_record.existing[3] will be destroyed
+  - resource "aws_route53_record" "existing" {
+      - fqdn    = "_8dc56b6e35f699b8754afcdd79e9748d.existing3.example.com" -> null
+      - id      = "Z123456789012__8dc56b6e35f699b8754afcdd79e9748d.existing3.example.com._CNAME" -> null
+      - name    = "_8dc56b6e35f699b8754afcdd79e9748d.existing3.example.com" -> null
+      - records = [
+          - "_a419f8410d2e0720528a96c3506f3841.jfrzftwwjs.acm-validations.aws.",
+        ] -> null
+      - ttl     = 60 -> null
+      - type    = "CNAME" -> null
+      - zone_id = "Z123456789012" -> null
+    }
+
+  # aws_route53_record.existing["existing.example.com"] will be created
+  + resource "aws_route53_record" "existing" {
+      + allow_overwrite = true
+      + fqdn            = (known after apply)
+      + id              = (known after apply)
+      + name            = "_812ddf11b781af1eec1643ec58f102d2.existing.example.com"
+      + records         = [
+          + "_bdeba72164eec216c55a32374bcceafd.jfrzftwwjs.acm-validations.aws.",
+        ]
+      + ttl             = 60
+      + type            = "CNAME"
+      + zone_id         = "Z123456789012"
+    }
+
+  # aws_route53_record.existing["existing1.example.com"] will be created
+  + resource "aws_route53_record" "existing" {
+      + allow_overwrite = true
+      + fqdn            = (known after apply)
+      + id              = (known after apply)
+      + name            = "_d7112da809a40e848207c04399babcec.existing1.example.com"
+      + records         = [
+          + "_6e1da5574ab46a6c782ed73438274181.jfrzftwwjs.acm-validations.aws.",
+        ]
+      + ttl             = 60
+      + type            = "CNAME"
+      + zone_id         = "Z123456789012"
+    }
+
+  # aws_route53_record.existing["existing2.example.com"] will be created
+  + resource "aws_route53_record" "existing" {
+      + allow_overwrite = true
+      + fqdn            = (known after apply)
+      + id              = (known after apply)
+      + name            = "_40b71647a8d88eb82d53fe988e8a3cc1.existing2.example.com"
+      + records         = [
+          + "_638532db1fa6a1b71aaf063c8ea29d52.jfrzftwwjs.acm-validations.aws.",
+        ]
+      + ttl             = 60
+      + type            = "CNAME"
+      + zone_id         = "Z123456789012"
+    }
+
+  # aws_route53_record.existing["existing3.example.com"] will be created
+  + resource "aws_route53_record" "existing" {
+      + allow_overwrite = true
+      + fqdn            = (known after apply)
+      + id              = (known after apply)
+      + name            = "_8dc56b6e35f699b8754afcdd79e9748d.existing3.example.com"
+      + records         = [
+          + "_a419f8410d2e0720528a96c3506f3841.jfrzftwwjs.acm-validations.aws.",
+        ]
+      + ttl             = 60
+      + type            = "CNAME"
+      + zone_id         = "Z123456789012"
+    }
+
+Plan: 5 to add, 0 to change, 5 to destroy.
+```
+
+Due to the type of configuration change, Terraform does not know that the previous `aws_route53_record` resources (indexed by number in the existing state) and the new resources (indexed by domain names in the updated configuration) are equivalent. Typically in this situation, the [`terraform state mv` command](https://www.terraform.io/docs/commands/state/mv.html) can be used to reduce the plan to show no changes. This is done by associating the count index (e.g., `[1]`) with the equivalent domain name index (e.g., `["existing2.example.com"]`), making one of the four commands to fix the above example: `terraform state mv 'aws_route53_record.existing[1]' 'aws_route53_record.existing["existing2.example.com"]'`. We recommend using this `terraform state mv` update process where possible to reduce chances of unexpected behaviors or changes in an environment.
+
+If using `terraform state mv` to reduce the plan to show no changes, no additional steps are required.
+
+In larger or more complex environments though, this process can be tedius to match the old resource address to the new resource address and run all the necessary `terraform state mv` commands. Instead, since the `aws_route53_record` resource implements the `allow_overwrite = true` argument, it is possible to just remove the old `aws_route53_record` resources from the Terraform state using the [`terraform state rm` command](https://www.terraform.io/docs/commands/state/rm.html). In this case, Terraform will leave the existing records in Route 53 and plan to just overwrite the existing validation records with the same exact (previous) values.
+
+-> This guide is showing the simpler `terraform state rm` option below as a potential shortcut in this specific situation, however in most other cases `terraform state mv` is required to change from `count` based resources to `for_each` based resources and properly match the existing Terraform state to the updated Terraform configuration.
+
+```console
+$ terraform state rm aws_route53_record.existing
+Removed aws_route53_record.existing[0]
+Removed aws_route53_record.existing[1]
+Removed aws_route53_record.existing[2]
+Removed aws_route53_record.existing[3]
+Successfully removed 4 resource instance(s).
+```
+
+Now the Terraform plan will show only the additions of new Route 53 records (which are exactly the same as before the upgrade) and the proposed recreation of the `aws_acm_certificate_validation` resource. The `aws_acm_certificate_validation` resource recreation will have no effect as the certificate is already validated and issued.
+
+```
+An execution plan has been generated and is shown below.
+Resource actions are indicated with the following symbols:
+  + create
+-/+ destroy and then create replacement
+
+Terraform will perform the following actions:
+
+  # aws_acm_certificate_validation.existing must be replaced
+-/+ resource "aws_acm_certificate_validation" "existing" {
+        certificate_arn         = "arn:aws:acm:us-east-2:123456789012:certificate/ccbc58e8-061d-4443-9035-d3af0512e863"
+      ~ id                      = "2020-07-16 00:01:19 +0000 UTC" -> (known after apply)
+      ~ validation_record_fqdns = [
+          - "_40b71647a8d88eb82d53fe988e8a3cc1.existing2.example.com",
+          - "_812ddf11b781af1eec1643ec58f102d2.existing.example.com",
+          - "_8dc56b6e35f699b8754afcdd79e9748d.existing3.example.com",
+          - "_d7112da809a40e848207c04399babcec.existing1.example.com",
+        ] -> (known after apply) # forces replacement
+    }
+
+  # aws_route53_record.existing["existing.example.com"] will be created
+  + resource "aws_route53_record" "existing" {
+      + allow_overwrite = true
+      + fqdn            = (known after apply)
+      + id              = (known after apply)
+      + name            = "_812ddf11b781af1eec1643ec58f102d2.existing.example.com"
+      + records         = [
+          + "_bdeba72164eec216c55a32374bcceafd.jfrzftwwjs.acm-validations.aws.",
+        ]
+      + ttl             = 60
+      + type            = "CNAME"
+      + zone_id         = "Z123456789012"
+    }
+
+  # aws_route53_record.existing["existing1.example.com"] will be created
+  + resource "aws_route53_record" "existing" {
+      + allow_overwrite = true
+      + fqdn            = (known after apply)
+      + id              = (known after apply)
+      + name            = "_d7112da809a40e848207c04399babcec.existing1.example.com"
+      + records         = [
+          + "_6e1da5574ab46a6c782ed73438274181.jfrzftwwjs.acm-validations.aws.",
+        ]
+      + ttl             = 60
+      + type            = "CNAME"
+      + zone_id         = "Z123456789012"
+    }
+
+  # aws_route53_record.existing["existing2.example.com"] will be created
+  + resource "aws_route53_record" "existing" {
+      + allow_overwrite = true
+      + fqdn            = (known after apply)
+      + id              = (known after apply)
+      + name            = "_40b71647a8d88eb82d53fe988e8a3cc1.existing2.example.com"
+      + records         = [
+          + "_638532db1fa6a1b71aaf063c8ea29d52.jfrzftwwjs.acm-validations.aws.",
+        ]
+      + ttl             = 60
+      + type            = "CNAME"
+      + zone_id         = "Z123456789012"
+    }
+
+  # aws_route53_record.existing["existing3.example.com"] will be created
+  + resource "aws_route53_record" "existing" {
+      + allow_overwrite = true
+      + fqdn            = (known after apply)
+      + id              = (known after apply)
+      + name            = "_8dc56b6e35f699b8754afcdd79e9748d.existing3.example.com"
+      + records         = [
+          + "_a419f8410d2e0720528a96c3506f3841.jfrzftwwjs.acm-validations.aws.",
+        ]
+      + ttl             = 60
+      + type            = "CNAME"
+      + zone_id         = "Z123456789012"
+    }
+
+Plan: 5 to add, 0 to change, 1 to destroy.
+```
+
+Once applied, no differences should be shown and no additional steps should be necessary.
+
+Alternatively, if you are referencing a subset of `domain_validation_options`, there is another method of upgrading from v2 to v3 without having to move state. Given the scenario below...
+
+```
+data "aws_route53_zone" "public_root_domain" {
+  name = var.public_root_domain
+}
+
+resource "aws_acm_certificate" "existing" {
+  domain_name = "existing.${var.public_root_domain}"
+  subject_alternative_names = [
+    "existing1.${var.public_root_domain}",
+    "existing2.${var.public_root_domain}",
+    "existing3.${var.public_root_domain}",
+  ]
+  validation_method = "DNS"
+}
+
+resource "aws_route53_record" "existing_1" {
+  allow_overwrite = true
+  name            = aws_acm_certificate.existing.domain_validation_options[0].resource_record_name
+  records         = [aws_acm_certificate.existing.domain_validation_options[0].resource_record_value]
+  ttl             = 60
+  type            = aws_acm_certificate.existing.domain_validation_options[0].resource_record_type
+  zone_id         = data.aws_route53_zone.public_root_domain.zone_id
+}
+
+resource "aws_acm_certificate_validation" "existing_1" {
+  certificate_arn         = aws_acm_certificate.existing.arn
+  validation_record_fqdns = aws_route53_record.existing_1.fqdn
+}
+
+resource "aws_route53_record" "existing_3" {
+  allow_overwrite = true
+  name            = aws_acm_certificate.existing.domain_validation_options[2].resource_record_name
+  records         = [aws_acm_certificate.existing.domain_validation_options[2].resource_record_value]
+  ttl             = 60
+  type            = aws_acm_certificate.existing.domain_validation_options[2].resource_record_type
+  zone_id         = data.aws_route53_zone.public_root_domain.zone_id
+}
+
+resource "aws_acm_certificate_validation" "existing_3" {
+  certificate_arn         = aws_acm_certificate.existing.arn
+  validation_record_fqdns = aws_route53_record.existing_3.fqdn
+}
+```
+
+You can perform a conversion of the new `domain_validation_options` object into a map, to allow you to perform a lookup by the domain name in place of an index number.
+
+```
+locals {
+  existing_domain_validation_options = {
+    for dvo in aws_acm_certificate.cloudfront_cert.domain_validation_options : dvo.domain_name => {
+      name   = dvo.resource_record_name
+      record = dvo.resource_record_value
+      type   = dvo.resource_record_type
+    }
+  }
+}
+
+resource "aws_route53_record" "existing_1" {
+  allow_overwrite = true
+  name            = local.existing_domain_validation_options["existing1.${var.public_root_domain}"].name
+  records         = [local.existing_domain_validation_options["existing1.${var.public_root_domain}"].record]
+  ttl             = 60
+  type            = local.existing_domain_validation_options["existing1.${var.public_root_domain}"].type
+  zone_id         = data.aws_route53_zone.public_root_domain.zone_id
+}
+
+resource "aws_acm_certificate_validation" "existing_1" {
+  certificate_arn         = aws_acm_certificate.existing.arn
+  validation_record_fqdns = aws_route53_record.existing_1.fqdn
+}
+
+resource "aws_route53_record" "existing_3" {
+  allow_overwrite = true
+  name            = local.existing_domain_validation_options["existing3.${var.public_root_domain}"].name
+  records         = [local.existing_domain_validation_options["existing3.${var.public_root_domain}"].record]
+  ttl             = 60
+  type            = local.existing_domain_validation_options["existing3.${var.public_root_domain}"].type
+  zone_id         = data.aws_route53_zone.public_root_domain.zone_id
+}
+
+resource "aws_acm_certificate_validation" "existing_3" {
+  certificate_arn         = aws_acm_certificate.existing.arn
+  validation_record_fqdns = aws_route53_record.existing_3.fqdn
+}
+```
+
+Performing a plan against these resources will not cause any change in state, since underlying resources have not changed.
+
+### subject_alternative_names Changed from List to Set
+
+Previously the `subject_alternative_names` argument was stored in the Terraform state as an ordered list while the API returned information in an unordered manner. The attribute is now configured as a set instead of a list. Certain Terraform configuration language features distinguish between these two attribute types such as not being able to index a set (e.g., `aws_acm_certificate.example.subject_alternative_names[0]` is no longer a valid reference). Depending on the implementation details of a particular configuration using `subject_alternative_names` as a reference, possible solutions include changing references to using `for`/`for_each` or using the `tolist()` function as a temporary workaround to keep the previous behavior until an appropriate configuration (properly using the unordered set) can be determined. Usage questions can be submitted to the [community forums](https://discuss.hashicorp.com/c/terraform-providers/tf-aws/33).
+
+### certificate_body, certificate_chain, and private_key Arguments No Longer Stored as Hash
+
+Previously when the `certificate_body`, `certificate_chain`, and `private_key` arguments were stored in state, they were stored as a hash of the actual value. This prevented Terraform from properly updating the resource when necessary and the hashing has been removed. The Terraform AWS Provider will show an update to these arguments on the first apply after upgrading to version 3.0.0, which is fixing the Terraform state to remove the hash. Since the `private_key` attribute is marked as sensitive, the values in the update will not be visible in the Terraform output. If the non-hashed values have not changed, then no update is occurring other than the Terraform state update. If these arguments are the only updates and they all match the hash removal, the apply will occur without submitting API calls.
+
+## Resource: aws_api_gateway_method_settings
+
+### throttling_burst_limit and throttling_rate_limit Arguments Now Default to -1
+
+Previously when the `throttling_burst_limit` or `throttling_rate_limit` argument was not configured, the resource would enable throttling and set the limit value to the AWS API Gateway default. In addition, as these arguments were marked as `Computed`, Terraform ignored any subsequent changes made to these arguments in the resource. These behaviors have been removed and, by default, the `throttling_burst_limit` and `throttling_rate_limit` arguments will be disabled in the resource with a value of `-1`.
+
+## Resource: aws_autoscaling_group
+
+### availability_zones and vpc_zone_identifier Arguments Now Report Plan-Time Conflict
+
+Specifying both the `availability_zones` and `vpc_zone_identifier` arguments previously led to confusing behavior and errors. Now this issue is reported at plan-time. Use the `null` value instead of `[]` (empty list) in conditionals to ensure this validation does not unexpectedly trigger.
+
+### Drift detection enabled for `load_balancers` and `target_group_arns` arguments
+
+If you previously set one of these arguments to an empty list to enable drift detection (e.g., when migrating an ASG from ELB to ALB), this can be updated as follows.
+
+For example, given this previous configuration:
+
+```terraform
+resource "aws_autoscaling_group" "example" {
+  # ... other configuration ...
+  load_balancers    = []
+  target_group_arns = [aws_lb_target_group.example.arn]
+}
+```
+
+An updated configuration:
+
+```terraform
+resource "aws_autoscaling_group" "example" {
+  # ... other configuration ...
+  target_group_arns = [aws_lb_target_group.example.arn]
+}
+```
+
+If `aws_autoscaling_attachment` resources reference your ASG configurations, you will need to add the [`lifecycle` configuration block](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html) with an `ignore_changes` argument to prevent Terraform non-empty plans (i.e., forcing resource update) during the next state refresh.
+
+For example, given this previous configuration:
+
+```terraform
+resource "aws_autoscaling_attachment" "example" {
+  autoscaling_group_name = aws_autoscaling_group.example.id
+  elb                    = aws_elb.example.id
+}
+
+resource "aws_autoscaling_group" "example" {
+  # ... other configuration ...
+}
+```
+
+An updated configuration:
+
+```terraform
+resource "aws_autoscaling_attachment" "example" {
+  autoscaling_group_name = aws_autoscaling_group.example.id
+  elb                    = aws_elb.example.id
+}
+
+resource "aws_autoscaling_group" "example" {
+  # ... other configuration ...
+
+  lifecycle {
+    ignore_changes = [load_balancers, target_group_arns]
+  }
+}
+```
+
+## Resource: aws_cloudfront_distribution
+
+### active_trusted_signers Attribute Name and Type Change
+
+Previously, the `active_trusted_signers` computed attribute was implemented with a Map that did not support accessing its computed `items` attribute in Terraform 0.12 correctly.
+To address this, the `active_trusted_signers` attribute has been renamed to `trusted_signers` and is now implemented as a List with a computed `items` List attribute and computed `enabled` boolean attribute.
+The nested `items` attribute includes computed `aws_account_number` and `key_pair_ids` sub-fields, with the latter implemented as a List.
+Thus, user configurations referencing the `active_trusted_signers` attribute and its sub-fields will need to be changed as follows.
+
+Given these previous references:
+
+```
+aws_cloudfront_distribution.example.active_trusted_signers.enabled
+aws_cloudfront_distribution.example.active_trusted_signers.items
+```
+
+Updated references:
+
+```
+aws_cloudfront_distribution.example.trusted_signers[0].enabled
+aws_cloudfront_distribution.example.trusted_signers[0].items
+```
+
+## Resource: aws_cloudwatch_log_group
+
+### Removal of arn Wildcard Suffix
+
+Previously, the resource returned the ARN directly from the API, which included a `:*` suffix to denote all CloudWatch Log Streams under the CloudWatch Log Group. Most other AWS resources that return ARNs and many other AWS services do not use the `:*` suffix. The suffix is now automatically removed. For example, the resource previously returned an ARN such as `arn:aws:logs:us-east-1:123456789012:log-group:/example:*` but will now return `arn:aws:logs:us-east-1:123456789012:log-group:/example`.
+
+Workarounds, such as using `replace()` as shown below, should be removed:
+
+```terraform
+resource "aws_cloudwatch_log_group" "example" {
+  name = "example"
+}
+resource "aws_datasync_task" "example" {
+  # ... other configuration ...
+  cloudwatch_log_group_arn = replace(aws_cloudwatch_log_group.example.arn, ":*", "")
+}
+```
+
+Removing the `:*` suffix is a breaking change for some configurations. Fix these configurations using string interpolations as demonstrated below. For example, this configuration is now broken:
+
+```terraform
+data "aws_iam_policy_document" "ad-log-policy" {
+  statement {
+    actions = [
+      "logs:CreateLogStream",
+      "logs:PutLogEvents"
+    ]
+    principals {
+      identifiers = ["ds.amazonaws.com"]
+      type        = "Service"
+    }
+    resources = [aws_cloudwatch_log_group.example.arn]
+    effect    = "Allow"
+  }
+}
+```
+
+An updated configuration:
+
+```terraform
+data "aws_iam_policy_document" "ad-log-policy" {
+  statement {
+    actions = [
+      "logs:CreateLogStream",
+      "logs:PutLogEvents"
+    ]
+    principals {
+      identifiers = ["ds.amazonaws.com"]
+      type        = "Service"
+    }
+    resources = ["${aws_cloudwatch_log_group.example.arn}:*"]
+    effect    = "Allow"
+  }
+}
+```
+
+## Resource: aws_codepipeline
+
+### GITHUB_TOKEN environment variable removal
+
+Switch your Terraform configuration to the `OAuthToken` element in the `action` `configuration` map instead.
+
+For example, given this previous configuration:
+
+```console
+$ GITHUB_TOKEN=<token> terraform apply
+```
+
+```terraform
+resource "aws_codepipeline" "example" {
+  # ... other configuration ...
+
+  stage {
+    name = "Source"
+
+    action {
+      name             = "Source"
+      category         = "Source"
+      owner            = "ThirdParty"
+      provider         = "GitHub"
+      version          = "1"
+      output_artifacts = ["example"]
+
+      configuration = {
+        Owner  = "lifesum-terraform"
+        Repo   = "example"
+        Branch = "main"
+      }
+    }
+  }
+}
+```
+
+The configuration could be updated as follows:
+
+```console
+$ TF_VAR_github_token=<token> terraform apply
+```
+
+```terraform
+variable "github_token" {}
+
+resource "aws_codepipeline" "example" {
+  # ... other configuration ...
+
+  stage {
+    name = "Source"
+
+    action {
+      name             = "Source"
+      category         = "Source"
+      owner            = "ThirdParty"
+      provider         = "GitHub"
+      version          = "1"
+      output_artifacts = ["example"]
+
+      configuration = {
+        Owner      = "lifesum-terraform"
+        Repo       = "example"
+        Branch     = "main"
+        OAuthToken = var.github_token
+      }
+    }
+  }
+}
+```
+
+## Resource: aws_cognito_user_pool
+
+### Removal of admin_create_user_config.unused_account_validity_days Argument
+
+The Cognito API previously deprecated the `admin_create_user_config` configuration block `unused_account_validity_days` argument in preference of the `password_policy` configuration block `temporary_password_validity_days` argument. Configurations will need to be updated to use the API supported configuration.
+
+For example, given this previous configuration:
+
+```terraform
+resource "aws_cognito_user_pool" "example" {
+  # ... other configuration ...
+
+  admin_create_user_config {
+    # ... potentially other configuration ...
+
+    unused_account_validity_days = 7
+  }
+}
+```
+
+An updated configuration:
+
+```terraform
+resource "aws_cognito_user_pool" "example" {
+  # ... other configuration ...
+
+  password_policy {
+    # ... potentially other configuration ...
+
+    temporary_password_validity_days = 7
+  }
+}
+```
+
+## Resource: aws_dx_gateway
+
+### Removal of Automatic aws_dx_gateway_association Import
+
+Previously when importing the `aws_dx_gateway` resource with the [`terraform import` command](https://www.terraform.io/docs/commands/import.html), the Terraform AWS Provider would automatically attempt to import an associated `aws_dx_gateway_association` resource(s) as well. This automatic resource import has been removed. Use the [`aws_dx_gateway_association` resource import](/docs/providers/aws/r/dx_gateway_association.html#import) to import those resources separately.
+
+## Resource: aws_dx_gateway_association
+
+### vpn_gateway_id Argument Removal
+
+Switch your Terraform configuration to the `associated_gateway_id` argument instead.
+
+For example, given this previous configuration:
+
+```terraform
+resource "aws_dx_gateway_association" "example" {
+  # ... other configuration ...
+  vpn_gateway_id = aws_vpn_gateway.example.id
+}
+```
+
+An updated configuration:
+
+```terraform
+resource "aws_dx_gateway_association" "example" {
+  # ... other configuration ...
+  associated_gateway_id = aws_vpn_gateway.example.id
+}
+```
+
+## Resource: aws_dx_gateway_association_proposal
+
+### vpn_gateway_id Argument Removal
+
+Switch your Terraform configuration to the `associated_gateway_id` argument instead.
+
+For example, given this previous configuration:
+
+```terraform
+resource "aws_dx_gateway_association_proposal" "example" {
+  # ... other configuration ...
+  vpn_gateway_id = aws_vpn_gateway.example.id
+}
+```
+
+An updated configuration:
+
+```terraform
+resource "aws_dx_gateway_association_proposal" "example" {
+  # ... other configuration ...
+  associated_gateway_id = aws_vpn_gateway.example.id
+}
+```
+
+## Resource: aws_ebs_volume
+
+### iops Argument Apply-Time Validation
+
+Previously when the `iops` argument was configured with a `type` other than `io1` (either explicitly or omitted, indicating the default type `gp2`), the Terraform AWS Provider would automatically disregard the value provided to `iops` as it is only configurable for the `io1` volume type per the AWS EC2 API. This behavior has changed such that the Terraform AWS Provider will instead return an error at apply time indicating an `iops` value is invalid for types other than `io1`.
+Exceptions to this are in cases where `iops` is set to `null` or `0` such that the Terraform AWS Provider will continue to accept the value regardless of `type`.
+
+## Resource: aws_elastic_transcoder_preset
+
+### video Configuration Block max_frame_rate Argument No Longer Uses 30 Default
+
+Previously when the `max_frame_rate` argument was not configured, the resource would default to 30. This behavior has been removed and allows for auto frame rate presets to automatically set the appropriate value.
+
+## Resource: aws_emr_cluster
+
+### core_instance_count Argument Removal
+
+Switch your Terraform configuration to the `core_instance_group` configuration block instead.
+
+For example, given this previous configuration:
+
+```terraform
+resource "aws_emr_cluster" "example" {
+  # ... other configuration ...
+
+  core_instance_count = 2
+}
+```
+
+An updated configuration:
+
+```terraform
+resource "aws_emr_cluster" "example" {
+  # ... other configuration ...
+
+  core_instance_group {
+    # ... other configuration ...
+
+    instance_count = 2
+  }
+}
+```
+
+### core_instance_type Argument Removal
+
+Switch your Terraform configuration to the `core_instance_group` configuration block instead.
+
+For example, given this previous configuration:
+
+```terraform
+resource "aws_emr_cluster" "example" {
+  # ... other configuration ...
+
+  core_instance_type = "m4.large"
+}
+```
+
+An updated configuration:
+
+```terraform
+resource "aws_emr_cluster" "example" {
+  # ... other configuration ...
+
+  core_instance_group {
+    instance_type = "m4.large"
+  }
+}
+```
+
+### instance_group Configuration Block Removal
+
+Switch your Terraform configuration to the `master_instance_group` and `core_instance_group` configuration blocks instead. For any task instance groups, use the `aws_emr_instance_group` resource.
+
+For example, given this previous configuration:
+
+```terraform
+resource "aws_emr_cluster" "example" {
+  # ... other configuration ...
+
+  instance_group {
+    instance_role = "MASTER"
+    instance_type = "m4.large"
+  }
+
+  instance_group {
+    instance_count = 1
+    instance_role  = "CORE"
+    instance_type  = "c4.large"
+  }
+
+  instance_group {
+    instance_count = 2
+    instance_role  = "TASK"
+    instance_type  = "c4.xlarge"
+  }
+}
+```
+
+An updated configuration:
+
+```terraform
+resource "aws_emr_cluster" "example" {
+  # ... other configuration ...
+
+  master_instance_group {
+    instance_type = "m4.large"
+  }
+
+  core_instance_group {
+    instance_count = 1
+    instance_type  = "c4.large"
+  }
+}
+
+resource "aws_emr_instance_group" "example" {
+  cluster_id     = aws_emr_cluster.example.id
+  instance_count = 2
+  instance_type  = "c4.xlarge"
+}
+```
+
+### master_instance_type Argument Removal
+
+Switch your Terraform configuration to the `master_instance_group` configuration block instead.
+
+For example, given this previous configuration:
+
+```terraform
+resource "aws_emr_cluster" "example" {
+  # ... other configuration ...
+
+  master_instance_type = "m4.large"
+}
+```
+
+An updated configuration:
+
+```terraform
+resource "aws_emr_cluster" "example" {
+  # ... other configuration ...
+
+  master_instance_group {
+    instance_type = "m4.large"
+  }
+}
+```
+
+## Resource: aws_glue_job
+
+### allocated_capacity Argument Removal
+
+The Glue API has deprecated the `allocated_capacity` argument. Switch your Terraform configuration to the `max_capacity` argument instead.
+
+For example, given this previous configuration:
+
+```terraform
+resource "aws_glue_job" "example" {
+  # ... other configuration ...
+
+  allocated_capacity = 2
+}
+```
+
+An updated configuration:
+
+```terraform
+resource "aws_glue_job" "example" {
+  # ... other configuration ...
+
+  max_capacity = 2
+}
+```
+
+## Resource: aws_iam_access_key
+
+### ses_smtp_password Attribute Removal
+
+In many regions today and in all regions after October 1, 2020, the [SES API will only accept version 4 signatures](https://docs.aws.amazon.com/ses/latest/DeveloperGuide/using-ses-api-authentication.html). If referencing the `ses_smtp_password` attribute, switch your Terraform configuration to the `ses_smtp_password_v4` attribute instead. Please note that this signature is based on the region of the Terraform AWS Provider. If you need the SES v4 password in multiple regions, it may require using [multiple provider instances](https://www.terraform.io/docs/configuration/providers.html#alias-multiple-provider-configurations).
+
+Depending on when the `aws_iam_access_key` resource was created, it may not have a `ses_smtp_password_v4` attribute for you to use. If this is the case you will need to [taint](/docs/commands/taint.html) the resource so that it can be recreated with the new value.
+
+Alternatively, you can stage the change by creating a new `aws_iam_access_key` resource and change any downstream dependencies to use the new `ses_smtp_password_v4` attribute. Once dependents have been updated with the new resource you can remove the old one.
+
+## Resource: aws_iam_instance_profile
+
+### roles Argument Removal
+
+Switch your Terraform configuration to the `role` argument instead.
+
+For example, given this previous configuration:
+
+```terraform
+resource "aws_iam_instance_profile" "example" {
+  # ... other configuration ...
+
+  roles = [aws_iam_role.example.id]
+}
+```
+
+An updated configuration:
+
+```terraform
+resource "aws_iam_instance_profile" "example" {
+  # ... other configuration ...
+
+  role = aws_iam_role.example.id
+}
+```
+
+## Resource: aws_iam_server_certificate
+
+### certificate_body, certificate_chain, and private_key Arguments No Longer Stored as Hash
+
+Previously when the `certificate_body`, `certificate_chain`, and `private_key` arguments were stored in state, they were stored as a hash of the actual value. This hashing has been removed for new or recreated resources to prevent lifecycle issues.
+
+## Resource: aws_instance
+
+### ebs_block_device.iops and root_block_device.iops Argument Apply-Time Validations
+
+Previously when the `iops` argument was configured in either the `ebs_block_device` or `root_block_device` configuration block, the Terraform AWS Provider would automatically disregard the value provided to `iops` if the `type` argument was also configured with a value other than `io1` (either explicitly or omitted, indicating the default type `gp2`) as `iops` are only configurable for the `io1` volume type per the AWS EC2 API. This behavior has changed such that the Terraform AWS Provider will instead return an error at apply time indicating an `iops` value is invalid for volume types other than `io1`.
+Exceptions to this are in cases where `iops` is set to `null` or `0` such that the Terraform AWS Provider will continue to accept the value regardless of `type`.
+
+## Resource: aws_lambda_alias
+
+### Import No Longer Converts Function Name to ARN
+
+Previously the resource import would always convert the `function_name` portion of the import identifier into the ARN format. Configurations using the Lambda Function name would show this as an unexpected difference after import. Now this will passthrough the given value on import whether its a Lambda Function name or ARN.
+
+## Resource: aws_launch_template
+
+### network_interfaces.delete_on_termination Argument type change
+
+The `network_interfaces.delete_on_termination` argument is now of type `string`, allowing an unspecified value for the argument since the previous `bool` type only allowed for `true/false` and defaulted to `false` when no value was set. Now to enforce `delete_on_termination` to `false`, the string `"false"` or bare `false` value must be used.
+
+For example, given this previous configuration:
+
+```terraform
+resource "aws_launch_template" "example" {
+  # ... other configuration ...
+
+  network_interfaces {
+    # ... other configuration ...
+
+    delete_on_termination = null
+  }
+}
+```
+
+An updated configuration:
+
+```terraform
+resource "aws_launch_template" "example" {
+  # ... other configuration ...
+
+  network_interfaces {
+    # ... other configuration ...
+
+    delete_on_termination = false
+  }
+}
+```
+
+## Resource: aws_lb_listener_rule
+
+### condition.field and condition.values Arguments Removal
+
+Switch your Terraform configuration to use the `host_header` or `path_pattern` configuration block instead.
+
+For example, given this previous configuration:
+
+```terraform
+resource "aws_lb_listener_rule" "example" {
+  # ... other configuration ...
+
+  condition {
+    field  = "path-pattern"
+    values = ["/static/*"]
+  }
+}
+```
+
+An updated configuration:
+
+```terraform
+resource "aws_lb_listener_rule" "example" {
+  # ... other configuration ...
+
+  condition {
+    path_pattern {
+      values = ["/static/*"]
+    }
+  }
+}
+```
+
+## Resource: aws_msk_cluster
+
+### encryption_info.encryption_in_transit.client_broker Default Updated to Match API
+
+A few weeks after general availability launch and initial release of the `aws_msk_cluster` resource, the MSK API default for client broker encryption switched from `TLS_PLAINTEXT` to `TLS`. The attribute default has now been updated to match the more secure API default, however existing Terraform configurations may show a difference if this setting is not configured.
+
+To continue using the old default when it was previously not configured, add or modify this configuration:
+
+```terraform
+resource "aws_msk_cluster" "example" {
+  # ... other configuration ...
+
+  encryption_info {
+    # ... potentially other configuration ...
+
+    encryption_in_transit {
+      # ... potentially other configuration ...
+
+      client_broker = "TLS_PLAINTEXT"
+    }
+  }
+}
+```
+
+## Resource: aws_rds_cluster
+
+### scaling_configuration.min_capacity Now Defaults to 1
+
+Previously when the `min_capacity` argument in a `scaling_configuration` block was not configured, the resource would default to 2. This behavior has been updated to align with the AWS RDS Cluster API default of 1.
+
+## Resource: aws_route53_resolver_rule
+
+### Removal of trailing period in domain_name argument
+
+Previously the resource returned the Resolver Rule Domain Name directly from the API, which included a `.` suffix. This proves difficult when many other AWS services do not accept this trailing period (e.g., ACM Certificate). This period is now automatically removed. For example, when the attribute would previously return a Resolver Rule Domain Name such as `example.com.`, the attribute now will be returned as `example.com`.
+While the returned value will omit the trailing period, use of configurations with trailing periods will not be interrupted.
+
+## Resource: aws_route53_zone
+
+### Removal of trailing period in name argument
+
+Previously the resource returned the Hosted Zone Domain Name directly from the API, which included a `.` suffix. This proves difficult when many other AWS services do not accept this trailing period (e.g., ACM Certificate). This period is now automatically removed. For example, when the attribute would previously return a Hosted Zone Domain Name such as `example.com.`, the attribute now will be returned as `example.com`.
+While the returned value will omit the trailing period, use of configurations with trailing periods will not be interrupted.
+
+## Resource: aws_s3_bucket
+
+### Removal of Automatic aws_s3_bucket_policy Import
+
+Previously when importing the `aws_s3_bucket` resource with the [`terraform import` command](https://www.terraform.io/docs/commands/import.html), the Terraform AWS Provider would automatically attempt to import an associated `aws_s3_bucket_policy` resource as well. This automatic resource import has been removed. Use the [`aws_s3_bucket_policy` resource import](/docs/providers/aws/r/s3_bucket_policy.html#import) to import that resource separately.
+
+### region Attribute Is Now Read-Only
+
+The `region` attribute is no longer configurable, but it remains as a read-only attribute. The region of the `aws_s3_bucket` resource is determined by the region of the Terraform AWS Provider, similar to all other resources.
+
+For example, given this previous configuration:
+
+```terraform
+resource "aws_s3_bucket" "example" {
+  # ... other configuration ...
+
+  region = "us-west-2"
+}
+```
+
+An updated configuration:
+
+```terraform
+resource "aws_s3_bucket" "example" {
+  # ... other configuration ...
+}
+```
+
+## Resource: aws_s3_bucket_metric
+
+### filter configuration block Plan-Time Validation Change
+
+The `filter` configuration block no longer supports the empty block `{}` and requires at least one of the `prefix` or `tags` attributes to be specified.
+
+For example, given this previous configuration:
+
+```terraform
+resource "aws_s3_bucket_metric" "example" {
+  # ... other configuration ...
+
+  filter {}
+}
+```
+
+An updated configuration:
+
+```terraform
+resource "aws_s3_bucket_metric" "example" {
+  # ... other configuration ...
+}
+```
+
+## Resource: aws_security_group
+
+### Removal of Automatic aws_security_group_rule Import
+
+Previously when importing the `aws_security_group` resource with the [`terraform import` command](https://www.terraform.io/docs/commands/import.html), the Terraform AWS Provider would automatically attempt to import an associated `aws_security_group_rule` resource(s) as well. This automatic resource import has been removed. Use the [`aws_security_group_rule` resource import](/docs/providers/aws/r/security_group_rule.html#import) to import those resources separately.
+
+## Resource: aws_sns_platform_application
+
+### platform_credential and platform_principal Arguments No Longer Stored as SHA256 Hash
+
+Previously when the `platform_credential` and `platform_principal` arguments were stored in state, they were stored as a SHA256 hash of the actual value. This prevented Terraform from properly updating the resource when necessary and the hashing has been removed. The Terraform AWS Provider will show an update to these arguments on the first apply after upgrading to version 3.0.0, which is fixing the Terraform state to remove the hash. Since the attributes are marked as sensitive, the values in the update will not be visible in the Terraform output. If the non-hashed values have not changed, then no update is occurring other than the Terraform state update. If these arguments are the only two updates and they both match the SHA256 removal, the apply will occur without submitting an actual `SetPlatformApplicationAttributes` API call.
+
+## Resource: aws_spot_fleet_request
+
+### valid_until Argument No Longer Uses 24 Hour Default
+
+Previously when the `valid_until` argument was not configured, the resource would default to a 24 hour request. This behavior has been removed and allows for non-expiring requests. To recreate the old behavior, the [`time_offset` resource](https://registry.terraform.io/providers/hashicorp/time/latest/docs/resources/offset) can potentially be used.
+
+## Resource: aws_ssm_maintenance_window_task
+
+### logging_info Configuration Block Removal
+
+Switch your Terraform configuration to the `task_invocation_parameters` configuration block `run_command_parameters` configuration block `output_s3_bucket` and `output_s3_key_prefix` arguments instead.
+
+For example, given this previous configuration:
+
+```terraform
+resource "aws_ssm_maintenance_window_task" "example" {
+  # ... other configuration ...
+
+  logging_info {
+    s3_bucket_name       = aws_s3_bucket.example.id
+    s3_bucket_key_prefix = "example"
+  }
+}
+```
+
+An updated configuration:
+
+```terraform
+resource "aws_ssm_maintenance_window_task" "example" {
+  # ... other configuration ...
+
+  task_invocation_parameters {
+    # ... potentially other configuration ...
+
+    run_command_parameters {
+      # ... potentially other configuration ...
+
+      output_s3_bucket     = aws_s3_bucket.example.id
+      output_s3_key_prefix = "example"
+    }
+  }
+}
+```
+
+### task_parameters Configuration Block Removal
+
+Switch your Terraform configuration to the `task_invocation_parameters` configuration block `run_command_parameters` configuration block `parameter` configuration blocks instead.
+
+For example, given this previous configuration:
+
+```terraform
+resource "aws_ssm_maintenance_window_task" "example" {
+  # ... other configuration ...
+
+  task_parameters {
+    name   = "commands"
+    values = ["date"]
+  }
+}
+```
+
+An updated configuration:
+
+```terraform
+resource "aws_ssm_maintenance_window_task" "example" {
+  # ... other configuration ...
+
+  task_invocation_parameters {
+    # ... potentially other configuration ...
+
+    run_command_parameters {
+      # ... potentially other configuration ...
+
+      parameter {
+        name   = "commands"
+        values = ["date"]
+      }
+    }
+  }
+}
+```
diff --git a/website/docs/guides/version-3-upgrade.html.md b/website/docs/guides/version-3-upgrade.html.md
deleted file mode 100644
index b23c10f4c12..00000000000
--- a/website/docs/guides/version-3-upgrade.html.md
+++ /dev/null
@@ -1,1476 +0,0 @@
----
-subcategory: ""
-layout: "aws"
-page_title: "Terraform AWS Provider Version 3 Upgrade Guide"
-description: |-
-  Terraform AWS Provider Version 3 Upgrade Guide
----
-
-# Terraform AWS Provider Version 3 Upgrade Guide
-
-Version 3.0.0 of the AWS provider for Terraform is a major release and includes some changes that you will need to consider when upgrading. This guide is intended to help with that process and focuses only on changes from version 2.X to version 3.0.0. See the [Version 2 Upgrade Guide](/docs/providers/aws/guides/version-2-upgrade.html) for information about upgrading from 1.X to version 2.0.0.
-
-Most of the changes outlined in this guide have been previously marked as deprecated in the Terraform plan/apply output throughout previous provider releases. These changes, such as deprecation notices, can always be found in the [Terraform AWS Provider CHANGELOG](https://github.com/hashicorp/terraform-provider-aws/blob/main/CHANGELOG.md).
-
-~> **NOTE:** Version 3.0.0 and later of the AWS Provider can only be automatically installed on Terraform 0.12 and later.
-
-Upgrade topics:
-
-<!-- TOC depthFrom:2 depthTo:2 -->
-
-- [Provider Version Configuration](#provider-version-configuration)
-- [Provider Authentication Updates](#provider-authentication-updates)
-- [Provider Custom Service Endpoint Updates](#provider-custom-service-endpoint-updates)
-- [Data Source: aws_availability_zones](#data-source-aws_availability_zones)
-- [Data Source: aws_lambda_invocation](#data-source-aws_lambda_invocation)
-- [Data Source: aws_launch_template](#data-source-aws_launch_template)
-- [Data Source: aws_route53_resolver_rule](#data-source-aws_route53_resolver_rule)
-- [Data Source: aws_route53_zone](#data-source-aws_route53_zone)
-- [Resource: aws_acm_certificate](#resource-aws_acm_certificate)
-- [Resource: aws_api_gateway_method_settings](#resource-aws_api_gateway_method_settings)
-- [Resource: aws_autoscaling_group](#resource-aws_autoscaling_group)
-- [Resource: aws_cloudfront_distribution](#resource-aws_cloudfront_distribution)
-- [Resource: aws_cloudwatch_log_group](#resource-aws_cloudwatch_log_group)
-- [Resource: aws_codepipeline](#resource-aws_codepipeline)
-- [Resource: aws_cognito_user_pool](#resource-aws_cognito_user_pool)
-- [Resource: aws_dx_gateway](#resource-aws_dx_gateway)
-- [Resource: aws_dx_gateway_association](#resource-aws_dx_gateway_association)
-- [Resource: aws_dx_gateway_association_proposal](#resource-aws_dx_gateway_association_proposal)
-- [Resource: aws_ebs_volume](#resource-aws_ebs_volume)
-- [Resource: aws_elastic_transcoder_preset](#resource-aws_elastic_transcoder_preset)
-- [Resource: aws_emr_cluster](#resource-aws_emr_cluster)
-- [Resource: aws_glue_job](#resource-aws_glue_job)
-- [Resource: aws_iam_access_key](#resource-aws_iam_access_key)
-- [Resource: aws_iam_instance_profile](#resource-aws_iam_instance_profile)
-- [Resource: aws_iam_server_certificate](#resource-aws_iam_server_certificate)
-- [Resource: aws_instance](#resource-aws_instance)
-- [Resource: aws_lambda_alias](#resource-aws_lambda_alias)
-- [Resource: aws_launch_template](#resource-aws_launch_template)
-- [Resource: aws_lb_listener_rule](#resource-aws_lb_listener_rule)
-- [Resource: aws_msk_cluster](#resource-aws_msk_cluster)
-- [Resource: aws_rds_cluster](#resource-aws_rds_cluster)
-- [Resource: aws_route53_resolver_rule](#resource-aws_route53_resolver_rule)
-- [Resource: aws_route53_zone](#resource-aws_route53_zone)
-- [Resource: aws_s3_bucket](#resource-aws_s3_bucket)
-- [Resource: aws_s3_bucket_metric](#resource-aws_s3_bucket_metric)
-- [Resource: aws_security_group](#resource-aws_security_group)
-- [Resource: aws_sns_platform_application](#resource-aws_sns_platform_application)
-- [Resource: aws_spot_fleet_request](#resource-aws_spot_fleet_request)
-
-<!-- /TOC -->
-
-## Provider Version Configuration
-
--> Before upgrading to version 3.0.0, it is recommended to upgrade to the most recent 2.X version of the provider and ensure that your environment successfully runs [`terraform plan`](https://www.terraform.io/docs/commands/plan.html) without unexpected changes or deprecation notices.
-
-We recommend using [version constraints when configuring Terraform providers](https://www.terraform.io/docs/configuration/providers.html#provider-versions). If you are following that recommendation, update the version constraints in your Terraform configuration and run [`terraform init`](https://www.terraform.io/docs/commands/init.html) to download the new version.
-
-For example, given this previous configuration:
-
-```terraform
-provider "aws" {
-  # ... other configuration ...
-
-  version = "~> 2.70"
-}
-```
-
-Update to latest 3.X version:
-
-```terraform
-provider "aws" {
-  # ... other configuration ...
-
-  version = "~> 3.0"
-}
-```
-
-## Provider Authentication Updates
-
-### Authentication Ordering
-
-Previously, the provider preferred credentials in the following order:
-
-- Static credentials (those defined in the Terraform configuration)
-- Environment variables (e.g., `AWS_ACCESS_KEY_ID` or `AWS_PROFILE`)
-- Shared credentials file (e.g., `~/.aws/credentials`)
-- EC2 Instance Metadata Service
-- Default AWS Go SDK handling (shared configuration, CodeBuild/ECS/EKS)
-
-The provider now prefers the following credential ordering:
-
-- Static credentials (those defined in the Terraform configuration)
-- Environment variables (e.g., `AWS_ACCESS_KEY_ID` or `AWS_PROFILE`)
-- Shared credentials and/or configuration file (e.g., `~/.aws/credentials` and `~/.aws/config`)
-- Default AWS Go SDK handling (shared configuration, CodeBuild/ECS/EKS, EC2 Instance Metadata Service)
-
-This means workarounds of disabling the EC2 Instance Metadata Service handling to enable CodeBuild/ECS/EKS credentials or to enable other credential methods such as `credential_process` in the AWS shared configuration are no longer necessary.
-
-### Shared Configuration File Automatically Enabled
-
-The `AWS_SDK_LOAD_CONFIG` environment variable is no longer necessary for the provider to automatically load the AWS shared configuration file (e.g., `~/.aws/config`).
-
-### Removal of AWS_METADATA_TIMEOUT Environment Variable Usage
-
-The provider now relies on the default AWS Go SDK timeouts for interacting with the EC2 Instance Metadata Service.
-
-## Provider Custom Service Endpoint Updates
-
-### Removal of kinesis_analytics and r53 Arguments
-
-The [custom service endpoints](custom-service-endpoints.html) for Kinesis Analytics and Route 53 now use the `kinesisanalytics` and `route53` argument names in the provider configuration.
-
-For example, given this previous configuration:
-
-```terraform
-provider "aws" {
-  # ... potentially other configuration ...
-
-  endpoints {
-    # ... potentially other configuration ...
-
-    kinesis_analytics = "https://example.com"
-    r53               = "https://example.com"
-  }
-}
-```
-
-An updated configuration:
-
-```terraform
-provider "aws" {
-  # ... potentially other configuration ...
-
-  endpoints {
-    # ... potentially other configuration ...
-
-    kinesisanalytics = "https://example.com"
-    route53          = "https://example.com"
-  }
-}
-```
-
-## Data Source: aws_availability_zones
-
-### blacklisted_names Attribute Removal
-
-Switch your Terraform configuration to the `exclude_names` attribute instead.
-
-For example, given this previous configuration:
-
-```terraform
-data "aws_availability_zones" "example" {
-  blacklisted_names = ["us-west-2d"]
-}
-```
-
-An updated configuration:
-
-```terraform
-data "aws_availability_zones" "example" {
-  exclude_names = ["us-west-2d"]
-}
-```
-
-### blacklisted_zone_ids Attribute Removal
-
-Switch your Terraform configuration to the `exclude_zone_ids` attribute instead.
-
-For example, given this previous configuration:
-
-```terraform
-data "aws_availability_zones" "example" {
-  blacklisted_zone_ids = ["usw2-az4"]
-}
-```
-
-An updated configuration:
-
-```terraform
-data "aws_availability_zones" "example" {
-  exclude_zone_ids = ["usw2-az4"]
-}
-```
-
-## Data Source: aws_lambda_invocation
-
-### result_map Attribute Removal
-
-Switch your Terraform configuration to the `result` attribute with the [`jsondecode()` function](https://www.terraform.io/docs/configuration/functions/jsondecode.html) instead.
-
-For example, given this previous configuration:
-
-```terraform
-# In Terraform 0.11 and earlier, the result_map attribute can be used
-# to convert a result JSON string to a map of string keys to string values.
-output "lambda_result" {
-  value = "${data.aws_lambda_invocation.example.result_map["key1"]}"
-}
-```
-
-An updated configuration:
-
-```terraform
-# In Terraform 0.12 and later, the jsondecode() function can be used
-# to convert a result JSON string to native Terraform types.
-output "lambda_result" {
-  value = jsondecode(data.aws_lambda_invocation.example.result)["key1"]
-}
-```
-
-## Data Source: aws_launch_template
-
-### Error raised if no matching launch template is found
-
-Previously, when a launch template matching the criteria was not found the data source would have been `null`.
-Now this could produce errors similar to the below:
-
-```
-data.aws_launch_template.current: Refreshing state...
-
-Error: error reading launch template: empty output
-```
-
-Configuration that depend on the previous behavior will need to be updated.
-
-## Data Source: aws_route53_resolver_rule
-
-### Removal of trailing period in domain_name argument
-
-Previously the data-source returned the Resolver Rule Domain Name directly from the API, which included a `.` suffix. This proves difficult when many other AWS services do not accept this trailing period (e.g., ACM Certificate). This period is now automatically removed. For example, when the attribute would previously return a Resolver Rule Domain Name such as `example.com.`, the attribute now will be returned as `example.com`.
-While the returned value will omit the trailing period, use of configurations with trailing periods will not be interrupted.
-
-## Data Source: aws_route53_zone
-
-### Removal of trailing period in name argument
-
-Previously the data-source returned the Hosted Zone Domain Name directly from the API, which included a `.` suffix. This proves difficult when many other AWS services do not accept this trailing period (e.g., ACM Certificate). This period is now automatically removed. For example, when the attribute would previously return a Hosted Zone Domain Name such as `example.com.`, the attribute now will be returned as `example.com`.
-While the returned value will omit the trailing period, use of configurations with trailing periods will not be interrupted.
-
-## Resource: aws_acm_certificate
-
-### domain_validation_options Changed from List to Set
-
-Previously, the `domain_validation_options` attribute was a list type and completely unknown until after an initial `terraform apply`. This generally required complicated configuration workarounds to properly create DNS validation records since referencing this attribute directly could produce errors similar to the below:
-
-```
-Error: Invalid for_each argument
-
-  on main.tf line 16, in resource "aws_route53_record" "existing":
-  16:   for_each = aws_acm_certificate.existing.domain_validation_options
-
-The `for_each` value depends on resource attributes that cannot be determined
-until apply, so Terraform cannot predict how many instances will be created.
-To work around this, use the -target argument to first apply only the
-resources that the for_each depends on.
-```
-
-The `domain_validation_options` attribute is now a set type and the resource will attempt to populate the information necessary during the planning phase to handle the above situation in most environments without workarounds. This change also prevents Terraform from showing unexpected differences if the API returns the results in varying order.
-
-Configuration references to this attribute will likely require updates since sets cannot be indexed (e.g., `domain_validation_options[0]` or the older `domain_validation_options.0.` syntax will return errors).
-If the `domain_validation_options` list previously contained only a single element like the two examples just shown,
-it may be possible to wrap these references using the [`tolist()` function](https://www.terraform.io/docs/configuration/functions/tolist.html)
-<!-- markdownlint-disable-next-line no-reversed-links -->
-(e.g., `tolist(aws_acm_certificate.example.domain_validation_options)[0]`) as a quick configuration update.
-However given the complexity and workarounds required with the previous `domain_validation_options` attribute implementation,
-different environments will require different configuration updates and migration steps.
-Below is a more advanced example.
-Further questions on potential update steps can be submitted to the [community forums](https://discuss.hashicorp.com/c/terraform-providers/tf-aws/33).
-
-For example, given this previous configuration using a `count` based resource approach that may have been used in certain environments:
-
-```terraform
-data "aws_route53_zone" "public_root_domain" {
-  name = var.public_root_domain
-}
-
-resource "aws_acm_certificate" "existing" {
-  domain_name = "existing.${var.public_root_domain}"
-  subject_alternative_names = [
-    "existing1.${var.public_root_domain}",
-    "existing2.${var.public_root_domain}",
-    "existing3.${var.public_root_domain}",
-  ]
-  validation_method = "DNS"
-}
-
-resource "aws_route53_record" "existing" {
-  count = length(aws_acm_certificate.existing.subject_alternative_names) + 1
-
-  allow_overwrite = true
-  name            = aws_acm_certificate.existing.domain_validation_options[count.index].resource_record_name
-  records         = [aws_acm_certificate.existing.domain_validation_options[count.index].resource_record_value]
-  ttl             = 60
-  type            = aws_acm_certificate.existing.domain_validation_options[count.index].resource_record_type
-  zone_id         = data.aws_route53_zone.public_root_domain.zone_id
-}
-
-resource "aws_acm_certificate_validation" "existing" {
-  certificate_arn         = aws_acm_certificate.existing.arn
-  validation_record_fqdns = aws_route53_record.existing[*].fqdn
-}
-```
-
-It will receive errors like the below after upgrading:
-
-```
-Error: Invalid index
-
-  on main.tf line 14, in resource "aws_route53_record" "existing":
-  14:   name    = aws_acm_certificate.existing.domain_validation_options[count.index].resource_record_name
-    |----------------
-    | aws_acm_certificate.existing.domain_validation_options is set of object with 4 elements
-    | count.index is 1
-
-This value does not have any indices.
-```
-
-Since the `domain_validation_options` attribute changed from a list to a set and sets cannot be indexed in Terraform, the recommendation is to update the configuration to use the more stable [resource `for_each` support](https://www.terraform.io/docs/configuration/meta-arguments/for_each.html) instead of [`count`](https://www.terraform.io/docs/configuration/meta-arguments/count.html). Note the slight change in the `validation_record_fqdns` syntax as well.
-
-```terraform
-resource "aws_route53_record" "existing" {
-  for_each = {
-    for dvo in aws_acm_certificate.existing.domain_validation_options : dvo.domain_name => {
-      name   = dvo.resource_record_name
-      record = dvo.resource_record_value
-      type   = dvo.resource_record_type
-    }
-  }
-
-  allow_overwrite = true
-  name            = each.value.name
-  records         = [each.value.record]
-  ttl             = 60
-  type            = each.value.type
-  zone_id         = data.aws_route53_zone.public_root_domain.zone_id
-}
-
-resource "aws_acm_certificate_validation" "existing" {
-  certificate_arn         = aws_acm_certificate.existing.arn
-  validation_record_fqdns = [for record in aws_route53_record.existing : record.fqdn]
-}
-```
-
-After the configuration has been updated, a plan should no longer error and may look like the following:
-
-```
-------------------------------------------------------------------------
-
-An execution plan has been generated and is shown below.
-Resource actions are indicated with the following symbols:
-  + create
-  - destroy
--/+ destroy and then create replacement
-
-Terraform will perform the following actions:
-
-  # aws_acm_certificate_validation.existing must be replaced
--/+ resource "aws_acm_certificate_validation" "existing" {
-        certificate_arn         = "arn:aws:acm:us-east-2:123456789012:certificate/ccbc58e8-061d-4443-9035-d3af0512e863"
-      ~ id                      = "2020-07-16 00:01:19 +0000 UTC" -> (known after apply)
-      ~ validation_record_fqdns = [
-          - "_40b71647a8d88eb82d53fe988e8a3cc1.existing2.example.com",
-          - "_812ddf11b781af1eec1643ec58f102d2.existing.example.com",
-          - "_8dc56b6e35f699b8754afcdd79e9748d.existing3.example.com",
-          - "_d7112da809a40e848207c04399babcec.existing1.example.com",
-        ] -> (known after apply) # forces replacement
-    }
-
-  # aws_route53_record.existing will be destroyed
-  - resource "aws_route53_record" "existing" {
-      - fqdn    = "_812ddf11b781af1eec1643ec58f102d2.existing.example.com" -> null
-      - id      = "Z123456789012__812ddf11b781af1eec1643ec58f102d2.existing.example.com._CNAME" -> null
-      - name    = "_812ddf11b781af1eec1643ec58f102d2.existing.example.com" -> null
-      - records = [
-          - "_bdeba72164eec216c55a32374bcceafd.jfrzftwwjs.acm-validations.aws.",
-        ] -> null
-      - ttl     = 60 -> null
-      - type    = "CNAME" -> null
-      - zone_id = "Z123456789012" -> null
-    }
-
-  # aws_route53_record.existing[1] will be destroyed
-  - resource "aws_route53_record" "existing" {
-      - fqdn    = "_40b71647a8d88eb82d53fe988e8a3cc1.existing2.example.com" -> null
-      - id      = "Z123456789012__40b71647a8d88eb82d53fe988e8a3cc1.existing2.example.com._CNAME" -> null
-      - name    = "_40b71647a8d88eb82d53fe988e8a3cc1.existing2.example.com" -> null
-      - records = [
-          - "_638532db1fa6a1b71aaf063c8ea29d52.jfrzftwwjs.acm-validations.aws.",
-        ] -> null
-      - ttl     = 60 -> null
-      - type    = "CNAME" -> null
-      - zone_id = "Z123456789012" -> null
-    }
-
-  # aws_route53_record.existing[2] will be destroyed
-  - resource "aws_route53_record" "existing" {
-      - fqdn    = "_d7112da809a40e848207c04399babcec.existing1.example.com" -> null
-      - id      = "Z123456789012__d7112da809a40e848207c04399babcec.existing1.example.com._CNAME" -> null
-      - name    = "_d7112da809a40e848207c04399babcec.existing1.example.com" -> null
-      - records = [
-          - "_6e1da5574ab46a6c782ed73438274181.jfrzftwwjs.acm-validations.aws.",
-        ] -> null
-      - ttl     = 60 -> null
-      - type    = "CNAME" -> null
-      - zone_id = "Z123456789012" -> null
-    }
-
-  # aws_route53_record.existing[3] will be destroyed
-  - resource "aws_route53_record" "existing" {
-      - fqdn    = "_8dc56b6e35f699b8754afcdd79e9748d.existing3.example.com" -> null
-      - id      = "Z123456789012__8dc56b6e35f699b8754afcdd79e9748d.existing3.example.com._CNAME" -> null
-      - name    = "_8dc56b6e35f699b8754afcdd79e9748d.existing3.example.com" -> null
-      - records = [
-          - "_a419f8410d2e0720528a96c3506f3841.jfrzftwwjs.acm-validations.aws.",
-        ] -> null
-      - ttl     = 60 -> null
-      - type    = "CNAME" -> null
-      - zone_id = "Z123456789012" -> null
-    }
-
-  # aws_route53_record.existing["existing.example.com"] will be created
-  + resource "aws_route53_record" "existing" {
-      + allow_overwrite = true
-      + fqdn            = (known after apply)
-      + id              = (known after apply)
-      + name            = "_812ddf11b781af1eec1643ec58f102d2.existing.example.com"
-      + records         = [
-          + "_bdeba72164eec216c55a32374bcceafd.jfrzftwwjs.acm-validations.aws.",
-        ]
-      + ttl             = 60
-      + type            = "CNAME"
-      + zone_id         = "Z123456789012"
-    }
-
-  # aws_route53_record.existing["existing1.example.com"] will be created
-  + resource "aws_route53_record" "existing" {
-      + allow_overwrite = true
-      + fqdn            = (known after apply)
-      + id              = (known after apply)
-      + name            = "_d7112da809a40e848207c04399babcec.existing1.example.com"
-      + records         = [
-          + "_6e1da5574ab46a6c782ed73438274181.jfrzftwwjs.acm-validations.aws.",
-        ]
-      + ttl             = 60
-      + type            = "CNAME"
-      + zone_id         = "Z123456789012"
-    }
-
-  # aws_route53_record.existing["existing2.example.com"] will be created
-  + resource "aws_route53_record" "existing" {
-      + allow_overwrite = true
-      + fqdn            = (known after apply)
-      + id              = (known after apply)
-      + name            = "_40b71647a8d88eb82d53fe988e8a3cc1.existing2.example.com"
-      + records         = [
-          + "_638532db1fa6a1b71aaf063c8ea29d52.jfrzftwwjs.acm-validations.aws.",
-        ]
-      + ttl             = 60
-      + type            = "CNAME"
-      + zone_id         = "Z123456789012"
-    }
-
-  # aws_route53_record.existing["existing3.example.com"] will be created
-  + resource "aws_route53_record" "existing" {
-      + allow_overwrite = true
-      + fqdn            = (known after apply)
-      + id              = (known after apply)
-      + name            = "_8dc56b6e35f699b8754afcdd79e9748d.existing3.example.com"
-      + records         = [
-          + "_a419f8410d2e0720528a96c3506f3841.jfrzftwwjs.acm-validations.aws.",
-        ]
-      + ttl             = 60
-      + type            = "CNAME"
-      + zone_id         = "Z123456789012"
-    }
-
-Plan: 5 to add, 0 to change, 5 to destroy.
-```
-
-Due to the type of configuration change, Terraform does not know that the previous `aws_route53_record` resources (indexed by number in the existing state) and the new resources (indexed by domain names in the updated configuration) are equivalent. Typically in this situation, the [`terraform state mv` command](https://www.terraform.io/docs/commands/state/mv.html) can be used to reduce the plan to show no changes. This is done by associating the count index (e.g., `[1]`) with the equivalent domain name index (e.g., `["existing2.example.com"]`), making one of the four commands to fix the above example: `terraform state mv 'aws_route53_record.existing[1]' 'aws_route53_record.existing["existing2.example.com"]'`. We recommend using this `terraform state mv` update process where possible to reduce chances of unexpected behaviors or changes in an environment.
-
-If using `terraform state mv` to reduce the plan to show no changes, no additional steps are required.
-
-In larger or more complex environments though, this process can be tedius to match the old resource address to the new resource address and run all the necessary `terraform state mv` commands. Instead, since the `aws_route53_record` resource implements the `allow_overwrite = true` argument, it is possible to just remove the old `aws_route53_record` resources from the Terraform state using the [`terraform state rm` command](https://www.terraform.io/docs/commands/state/rm.html). In this case, Terraform will leave the existing records in Route 53 and plan to just overwrite the existing validation records with the same exact (previous) values.
-
--> This guide is showing the simpler `terraform state rm` option below as a potential shortcut in this specific situation, however in most other cases `terraform state mv` is required to change from `count` based resources to `for_each` based resources and properly match the existing Terraform state to the updated Terraform configuration.
-
-```console
-$ terraform state rm aws_route53_record.existing
-Removed aws_route53_record.existing[0]
-Removed aws_route53_record.existing[1]
-Removed aws_route53_record.existing[2]
-Removed aws_route53_record.existing[3]
-Successfully removed 4 resource instance(s).
-```
-
-Now the Terraform plan will show only the additions of new Route 53 records (which are exactly the same as before the upgrade) and the proposed recreation of the `aws_acm_certificate_validation` resource. The `aws_acm_certificate_validation` resource recreation will have no effect as the certificate is already validated and issued.
-
-```
-An execution plan has been generated and is shown below.
-Resource actions are indicated with the following symbols:
-  + create
--/+ destroy and then create replacement
-
-Terraform will perform the following actions:
-
-  # aws_acm_certificate_validation.existing must be replaced
--/+ resource "aws_acm_certificate_validation" "existing" {
-        certificate_arn         = "arn:aws:acm:us-east-2:123456789012:certificate/ccbc58e8-061d-4443-9035-d3af0512e863"
-      ~ id                      = "2020-07-16 00:01:19 +0000 UTC" -> (known after apply)
-      ~ validation_record_fqdns = [
-          - "_40b71647a8d88eb82d53fe988e8a3cc1.existing2.example.com",
-          - "_812ddf11b781af1eec1643ec58f102d2.existing.example.com",
-          - "_8dc56b6e35f699b8754afcdd79e9748d.existing3.example.com",
-          - "_d7112da809a40e848207c04399babcec.existing1.example.com",
-        ] -> (known after apply) # forces replacement
-    }
-
-  # aws_route53_record.existing["existing.example.com"] will be created
-  + resource "aws_route53_record" "existing" {
-      + allow_overwrite = true
-      + fqdn            = (known after apply)
-      + id              = (known after apply)
-      + name            = "_812ddf11b781af1eec1643ec58f102d2.existing.example.com"
-      + records         = [
-          + "_bdeba72164eec216c55a32374bcceafd.jfrzftwwjs.acm-validations.aws.",
-        ]
-      + ttl             = 60
-      + type            = "CNAME"
-      + zone_id         = "Z123456789012"
-    }
-
-  # aws_route53_record.existing["existing1.example.com"] will be created
-  + resource "aws_route53_record" "existing" {
-      + allow_overwrite = true
-      + fqdn            = (known after apply)
-      + id              = (known after apply)
-      + name            = "_d7112da809a40e848207c04399babcec.existing1.example.com"
-      + records         = [
-          + "_6e1da5574ab46a6c782ed73438274181.jfrzftwwjs.acm-validations.aws.",
-        ]
-      + ttl             = 60
-      + type            = "CNAME"
-      + zone_id         = "Z123456789012"
-    }
-
-  # aws_route53_record.existing["existing2.example.com"] will be created
-  + resource "aws_route53_record" "existing" {
-      + allow_overwrite = true
-      + fqdn            = (known after apply)
-      + id              = (known after apply)
-      + name            = "_40b71647a8d88eb82d53fe988e8a3cc1.existing2.example.com"
-      + records         = [
-          + "_638532db1fa6a1b71aaf063c8ea29d52.jfrzftwwjs.acm-validations.aws.",
-        ]
-      + ttl             = 60
-      + type            = "CNAME"
-      + zone_id         = "Z123456789012"
-    }
-
-  # aws_route53_record.existing["existing3.example.com"] will be created
-  + resource "aws_route53_record" "existing" {
-      + allow_overwrite = true
-      + fqdn            = (known after apply)
-      + id              = (known after apply)
-      + name            = "_8dc56b6e35f699b8754afcdd79e9748d.existing3.example.com"
-      + records         = [
-          + "_a419f8410d2e0720528a96c3506f3841.jfrzftwwjs.acm-validations.aws.",
-        ]
-      + ttl             = 60
-      + type            = "CNAME"
-      + zone_id         = "Z123456789012"
-    }
-
-Plan: 5 to add, 0 to change, 1 to destroy.
-```
-
-Once applied, no differences should be shown and no additional steps should be necessary.
-
-Alternatively, if you are referencing a subset of `domain_validation_options`, there is another method of upgrading from v2 to v3 without having to move state. Given the scenario below...
-
-```
-data "aws_route53_zone" "public_root_domain" {
-  name = var.public_root_domain
-}
-
-resource "aws_acm_certificate" "existing" {
-  domain_name = "existing.${var.public_root_domain}"
-  subject_alternative_names = [
-    "existing1.${var.public_root_domain}",
-    "existing2.${var.public_root_domain}",
-    "existing3.${var.public_root_domain}",
-  ]
-  validation_method = "DNS"
-}
-
-resource "aws_route53_record" "existing_1" {
-  allow_overwrite = true
-  name            = aws_acm_certificate.existing.domain_validation_options[0].resource_record_name
-  records         = [aws_acm_certificate.existing.domain_validation_options[0].resource_record_value]
-  ttl             = 60
-  type            = aws_acm_certificate.existing.domain_validation_options[0].resource_record_type
-  zone_id         = data.aws_route53_zone.public_root_domain.zone_id
-}
-
-resource "aws_acm_certificate_validation" "existing_1" {
-  certificate_arn         = aws_acm_certificate.existing.arn
-  validation_record_fqdns = aws_route53_record.existing_1.fqdn
-}
-
-resource "aws_route53_record" "existing_3" {
-  allow_overwrite = true
-  name            = aws_acm_certificate.existing.domain_validation_options[2].resource_record_name
-  records         = [aws_acm_certificate.existing.domain_validation_options[2].resource_record_value]
-  ttl             = 60
-  type            = aws_acm_certificate.existing.domain_validation_options[2].resource_record_type
-  zone_id         = data.aws_route53_zone.public_root_domain.zone_id
-}
-
-resource "aws_acm_certificate_validation" "existing_3" {
-  certificate_arn         = aws_acm_certificate.existing.arn
-  validation_record_fqdns = aws_route53_record.existing_3.fqdn
-}
-```
-
-You can perform a conversion of the new `domain_validation_options` object into a map, to allow you to perform a lookup by the domain name in place of an index number.
-
-```
-locals {
-  existing_domain_validation_options = {
-    for dvo in aws_acm_certificate.cloudfront_cert.domain_validation_options : dvo.domain_name => {
-      name   = dvo.resource_record_name
-      record = dvo.resource_record_value
-      type   = dvo.resource_record_type
-    }
-  }
-}
-
-resource "aws_route53_record" "existing_1" {
-  allow_overwrite = true
-  name            = local.existing_domain_validation_options["existing1.${var.public_root_domain}"].name
-  records         = [local.existing_domain_validation_options["existing1.${var.public_root_domain}"].record]
-  ttl             = 60
-  type            = local.existing_domain_validation_options["existing1.${var.public_root_domain}"].type
-  zone_id         = data.aws_route53_zone.public_root_domain.zone_id
-}
-
-resource "aws_acm_certificate_validation" "existing_1" {
-  certificate_arn         = aws_acm_certificate.existing.arn
-  validation_record_fqdns = aws_route53_record.existing_1.fqdn
-}
-
-resource "aws_route53_record" "existing_3" {
-  allow_overwrite = true
-  name            = local.existing_domain_validation_options["existing3.${var.public_root_domain}"].name
-  records         = [local.existing_domain_validation_options["existing3.${var.public_root_domain}"].record]
-  ttl             = 60
-  type            = local.existing_domain_validation_options["existing3.${var.public_root_domain}"].type
-  zone_id         = data.aws_route53_zone.public_root_domain.zone_id
-}
-
-resource "aws_acm_certificate_validation" "existing_3" {
-  certificate_arn         = aws_acm_certificate.existing.arn
-  validation_record_fqdns = aws_route53_record.existing_3.fqdn
-}
-```
-
-Performing a plan against these resources will not cause any change in state, since underlying resources have not changed.
-
-### subject_alternative_names Changed from List to Set
-
-Previously the `subject_alternative_names` argument was stored in the Terraform state as an ordered list while the API returned information in an unordered manner. The attribute is now configured as a set instead of a list. Certain Terraform configuration language features distinguish between these two attribute types such as not being able to index a set (e.g., `aws_acm_certificate.example.subject_alternative_names[0]` is no longer a valid reference). Depending on the implementation details of a particular configuration using `subject_alternative_names` as a reference, possible solutions include changing references to using `for`/`for_each` or using the `tolist()` function as a temporary workaround to keep the previous behavior until an appropriate configuration (properly using the unordered set) can be determined. Usage questions can be submitted to the [community forums](https://discuss.hashicorp.com/c/terraform-providers/tf-aws/33).
-
-### certificate_body, certificate_chain, and private_key Arguments No Longer Stored as Hash
-
-Previously when the `certificate_body`, `certificate_chain`, and `private_key` arguments were stored in state, they were stored as a hash of the actual value. This prevented Terraform from properly updating the resource when necessary and the hashing has been removed. The Terraform AWS Provider will show an update to these arguments on the first apply after upgrading to version 3.0.0, which is fixing the Terraform state to remove the hash. Since the `private_key` attribute is marked as sensitive, the values in the update will not be visible in the Terraform output. If the non-hashed values have not changed, then no update is occurring other than the Terraform state update. If these arguments are the only updates and they all match the hash removal, the apply will occur without submitting API calls.
-
-## Resource: aws_api_gateway_method_settings
-
-### throttling_burst_limit and throttling_rate_limit Arguments Now Default to -1
-
-Previously when the `throttling_burst_limit` or `throttling_rate_limit` argument was not configured, the resource would enable throttling and set the limit value to the AWS API Gateway default. In addition, as these arguments were marked as `Computed`, Terraform ignored any subsequent changes made to these arguments in the resource. These behaviors have been removed and, by default, the `throttling_burst_limit` and `throttling_rate_limit` arguments will be disabled in the resource with a value of `-1`.
-
-## Resource: aws_autoscaling_group
-
-### availability_zones and vpc_zone_identifier Arguments Now Report Plan-Time Conflict
-
-Specifying both the `availability_zones` and `vpc_zone_identifier` arguments previously led to confusing behavior and errors. Now this issue is reported at plan-time. Use the `null` value instead of `[]` (empty list) in conditionals to ensure this validation does not unexpectedly trigger.
-
-### Drift detection enabled for `load_balancers` and `target_group_arns` arguments
-
-If you previously set one of these arguments to an empty list to enable drift detection (e.g., when migrating an ASG from ELB to ALB), this can be updated as follows.
-
-For example, given this previous configuration:
-
-```terraform
-resource "aws_autoscaling_group" "example" {
-  # ... other configuration ...
-  load_balancers    = []
-  target_group_arns = [aws_lb_target_group.example.arn]
-}
-```
-
-An updated configuration:
-
-```terraform
-resource "aws_autoscaling_group" "example" {
-  # ... other configuration ...
-  target_group_arns = [aws_lb_target_group.example.arn]
-}
-```
-
-If `aws_autoscaling_attachment` resources reference your ASG configurations, you will need to add the [`lifecycle` configuration block](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html) with an `ignore_changes` argument to prevent Terraform non-empty plans (i.e., forcing resource update) during the next state refresh.
-
-For example, given this previous configuration:
-
-```terraform
-resource "aws_autoscaling_attachment" "example" {
-  autoscaling_group_name = aws_autoscaling_group.example.id
-  elb                    = aws_elb.example.id
-}
-
-resource "aws_autoscaling_group" "example" {
-  # ... other configuration ...
-}
-```
-
-An updated configuration:
-
-```terraform
-resource "aws_autoscaling_attachment" "example" {
-  autoscaling_group_name = aws_autoscaling_group.example.id
-  elb                    = aws_elb.example.id
-}
-
-resource "aws_autoscaling_group" "example" {
-  # ... other configuration ...
-
-  lifecycle {
-    ignore_changes = [load_balancers, target_group_arns]
-  }
-}
-```
-
-## Resource: aws_cloudfront_distribution
-
-### active_trusted_signers Attribute Name and Type Change
-
-Previously, the `active_trusted_signers` computed attribute was implemented with a Map that did not support accessing its computed `items` attribute in Terraform 0.12 correctly.
-To address this, the `active_trusted_signers` attribute has been renamed to `trusted_signers` and is now implemented as a List with a computed `items` List attribute and computed `enabled` boolean attribute.
-The nested `items` attribute includes computed `aws_account_number` and `key_pair_ids` sub-fields, with the latter implemented as a List.
-Thus, user configurations referencing the `active_trusted_signers` attribute and its sub-fields will need to be changed as follows.
-
-Given these previous references:
-
-```
-aws_cloudfront_distribution.example.active_trusted_signers.enabled
-aws_cloudfront_distribution.example.active_trusted_signers.items
-```
-
-Updated references:
-
-```
-aws_cloudfront_distribution.example.trusted_signers[0].enabled
-aws_cloudfront_distribution.example.trusted_signers[0].items
-```
-
-## Resource: aws_cloudwatch_log_group
-
-### Removal of arn Wildcard Suffix
-
-Previously, the resource returned the ARN directly from the API, which included a `:*` suffix to denote all CloudWatch Log Streams under the CloudWatch Log Group. Most other AWS resources that return ARNs and many other AWS services do not use the `:*` suffix. The suffix is now automatically removed. For example, the resource previously returned an ARN such as `arn:aws:logs:us-east-1:123456789012:log-group:/example:*` but will now return `arn:aws:logs:us-east-1:123456789012:log-group:/example`.
-
-Workarounds, such as using `replace()` as shown below, should be removed:
-
-```terraform
-resource "aws_cloudwatch_log_group" "example" {
-  name = "example"
-}
-resource "aws_datasync_task" "example" {
-  # ... other configuration ...
-  cloudwatch_log_group_arn = replace(aws_cloudwatch_log_group.example.arn, ":*", "")
-}
-```
-
-Removing the `:*` suffix is a breaking change for some configurations. Fix these configurations using string interpolations as demonstrated below. For example, this configuration is now broken:
-
-```terraform
-data "aws_iam_policy_document" "ad-log-policy" {
-  statement {
-    actions = [
-      "logs:CreateLogStream",
-      "logs:PutLogEvents"
-    ]
-    principals {
-      identifiers = ["ds.amazonaws.com"]
-      type        = "Service"
-    }
-    resources = [aws_cloudwatch_log_group.example.arn]
-    effect = "Allow"
-  }
-}
-```
-
-An updated configuration:
-
-```terraform
-data "aws_iam_policy_document" "ad-log-policy" {
-  statement {
-    actions = [
-      "logs:CreateLogStream",
-      "logs:PutLogEvents"
-    ]
-    principals {
-      identifiers = ["ds.amazonaws.com"]
-      type        = "Service"
-    }
-    resources = ["${aws_cloudwatch_log_group.example.arn}:*"]
-    effect = "Allow"
-  }
-}
-```
-
-## Resource: aws_codepipeline
-
-### GITHUB_TOKEN environment variable removal
-
-Switch your Terraform configuration to the `OAuthToken` element in the `action` `configuration` map instead.
-
-For example, given this previous configuration:
-
-```console
-$ GITHUB_TOKEN=<token> terraform apply
-```
-
-```terraform
-resource "aws_codepipeline" "example" {
-  # ... other configuration ...
-
-  stage {
-    name = "Source"
-
-    action {
-      name             = "Source"
-      category         = "Source"
-      owner            = "ThirdParty"
-      provider         = "GitHub"
-      version          = "1"
-      output_artifacts = ["example"]
-
-      configuration = {
-        Owner  = "lifesum-terraform"
-        Repo   = "example"
-        Branch = "main"
-      }
-    }
-  }
-}
-```
-
-The configuration could be updated as follows:
-
-```console
-$ TF_VAR_github_token=<token> terraform apply
-```
-
-```terraform
-variable "github_token" {}
-
-resource "aws_codepipeline" "example" {
-  # ... other configuration ...
-
-  stage {
-    name = "Source"
-
-    action {
-      name             = "Source"
-      category         = "Source"
-      owner            = "ThirdParty"
-      provider         = "GitHub"
-      version          = "1"
-      output_artifacts = ["example"]
-
-      configuration = {
-        Owner      = "lifesum-terraform"
-        Repo       = "example"
-        Branch     = "main"
-        OAuthToken = var.github_token
-      }
-    }
-  }
-}
-```
-
-## Resource: aws_cognito_user_pool
-
-### Removal of admin_create_user_config.unused_account_validity_days Argument
-
-The Cognito API previously deprecated the `admin_create_user_config` configuration block `unused_account_validity_days` argument in preference of the `password_policy` configuration block `temporary_password_validity_days` argument. Configurations will need to be updated to use the API supported configuration.
-
-For example, given this previous configuration:
-
-```terraform
-resource "aws_cognito_user_pool" "example" {
-  # ... other configuration ...
-
-  admin_create_user_config {
-    # ... potentially other configuration ...
-
-    unused_account_validity_days = 7
-  }
-}
-```
-
-An updated configuration:
-
-```terraform
-resource "aws_cognito_user_pool" "example" {
-  # ... other configuration ...
-
-  password_policy {
-    # ... potentially other configuration ...
-
-    temporary_password_validity_days = 7
-  }
-}
-```
-
-## Resource: aws_dx_gateway
-
-### Removal of Automatic aws_dx_gateway_association Import
-
-Previously when importing the `aws_dx_gateway` resource with the [`terraform import` command](https://www.terraform.io/docs/commands/import.html), the Terraform AWS Provider would automatically attempt to import an associated `aws_dx_gateway_association` resource(s) as well. This automatic resource import has been removed. Use the [`aws_dx_gateway_association` resource import](/docs/providers/aws/r/dx_gateway_association.html#import) to import those resources separately.
-
-## Resource: aws_dx_gateway_association
-
-### vpn_gateway_id Argument Removal
-
-Switch your Terraform configuration to the `associated_gateway_id` argument instead.
-
-For example, given this previous configuration:
-
-```terraform
-resource "aws_dx_gateway_association" "example" {
-  # ... other configuration ...
-  vpn_gateway_id = aws_vpn_gateway.example.id
-}
-```
-
-An updated configuration:
-
-```terraform
-resource "aws_dx_gateway_association" "example" {
-  # ... other configuration ...
-  associated_gateway_id = aws_vpn_gateway.example.id
-}
-```
-
-## Resource: aws_dx_gateway_association_proposal
-
-### vpn_gateway_id Argument Removal
-
-Switch your Terraform configuration to the `associated_gateway_id` argument instead.
-
-For example, given this previous configuration:
-
-```terraform
-resource "aws_dx_gateway_association_proposal" "example" {
-  # ... other configuration ...
-  vpn_gateway_id = aws_vpn_gateway.example.id
-}
-```
-
-An updated configuration:
-
-```terraform
-resource "aws_dx_gateway_association_proposal" "example" {
-  # ... other configuration ...
-  associated_gateway_id = aws_vpn_gateway.example.id
-}
-```
-
-## Resource: aws_ebs_volume
-
-### iops Argument Apply-Time Validation
-
-Previously when the `iops` argument was configured with a `type` other than `io1` (either explicitly or omitted, indicating the default type `gp2`), the Terraform AWS Provider would automatically disregard the value provided to `iops` as it is only configurable for the `io1` volume type per the AWS EC2 API. This behavior has changed such that the Terraform AWS Provider will instead return an error at apply time indicating an `iops` value is invalid for types other than `io1`.
-Exceptions to this are in cases where `iops` is set to `null` or `0` such that the Terraform AWS Provider will continue to accept the value regardless of `type`.
-
-## Resource: aws_elastic_transcoder_preset
-
-### video Configuration Block max_frame_rate Argument No Longer Uses 30 Default
-
-Previously when the `max_frame_rate` argument was not configured, the resource would default to 30. This behavior has been removed and allows for auto frame rate presets to automatically set the appropriate value.
-
-## Resource: aws_emr_cluster
-
-### core_instance_count Argument Removal
-
-Switch your Terraform configuration to the `core_instance_group` configuration block instead.
-
-For example, given this previous configuration:
-
-```terraform
-resource "aws_emr_cluster" "example" {
-  # ... other configuration ...
-
-  core_instance_count = 2
-}
-```
-
-An updated configuration:
-
-```terraform
-resource "aws_emr_cluster" "example" {
-  # ... other configuration ...
-
-  core_instance_group {
-    # ... other configuration ...
-
-    instance_count = 2
-  }
-}
-```
-
-### core_instance_type Argument Removal
-
-Switch your Terraform configuration to the `core_instance_group` configuration block instead.
-
-For example, given this previous configuration:
-
-```terraform
-resource "aws_emr_cluster" "example" {
-  # ... other configuration ...
-
-  core_instance_type = "m4.large"
-}
-```
-
-An updated configuration:
-
-```terraform
-resource "aws_emr_cluster" "example" {
-  # ... other configuration ...
-
-  core_instance_group {
-    instance_type = "m4.large"
-  }
-}
-```
-
-### instance_group Configuration Block Removal
-
-Switch your Terraform configuration to the `master_instance_group` and `core_instance_group` configuration blocks instead. For any task instance groups, use the `aws_emr_instance_group` resource.
-
-For example, given this previous configuration:
-
-```terraform
-resource "aws_emr_cluster" "example" {
-  # ... other configuration ...
-
-  instance_group {
-    instance_role = "MASTER"
-    instance_type = "m4.large"
-  }
-
-  instance_group {
-    instance_count = 1
-    instance_role  = "CORE"
-    instance_type  = "c4.large"
-  }
-
-  instance_group {
-    instance_count = 2
-    instance_role  = "TASK"
-    instance_type  = "c4.xlarge"
-  }
-}
-```
-
-An updated configuration:
-
-```terraform
-resource "aws_emr_cluster" "example" {
-  # ... other configuration ...
-
-  master_instance_group {
-    instance_type = "m4.large"
-  }
-
-  core_instance_group {
-    instance_count = 1
-    instance_type  = "c4.large"
-  }
-}
-
-resource "aws_emr_instance_group" "example" {
-  cluster_id     = aws_emr_cluster.example.id
-  instance_count = 2
-  instance_type  = "c4.xlarge"
-}
-```
-
-### master_instance_type Argument Removal
-
-Switch your Terraform configuration to the `master_instance_group` configuration block instead.
-
-For example, given this previous configuration:
-
-```terraform
-resource "aws_emr_cluster" "example" {
-  # ... other configuration ...
-
-  master_instance_type = "m4.large"
-}
-```
-
-An updated configuration:
-
-```terraform
-resource "aws_emr_cluster" "example" {
-  # ... other configuration ...
-
-  master_instance_group {
-    instance_type = "m4.large"
-  }
-}
-```
-
-## Resource: aws_glue_job
-
-### allocated_capacity Argument Removal
-
-The Glue API has deprecated the `allocated_capacity` argument. Switch your Terraform configuration to the `max_capacity` argument instead.
-
-For example, given this previous configuration:
-
-```terraform
-resource "aws_glue_job" "example" {
-  # ... other configuration ...
-
-  allocated_capacity = 2
-}
-```
-
-An updated configuration:
-
-```terraform
-resource "aws_glue_job" "example" {
-  # ... other configuration ...
-
-  max_capacity = 2
-}
-```
-
-## Resource: aws_iam_access_key
-
-### ses_smtp_password Attribute Removal
-
-In many regions today and in all regions after October 1, 2020, the [SES API will only accept version 4 signatures](https://docs.aws.amazon.com/ses/latest/DeveloperGuide/using-ses-api-authentication.html). If referencing the `ses_smtp_password` attribute, switch your Terraform configuration to the `ses_smtp_password_v4` attribute instead. Please note that this signature is based on the region of the Terraform AWS Provider. If you need the SES v4 password in multiple regions, it may require using [multiple provider instances](https://www.terraform.io/docs/configuration/providers.html#alias-multiple-provider-configurations).
-
-Depending on when the `aws_iam_access_key` resource was created, it may not have a `ses_smtp_password_v4` attribute for you to use. If this is the case you will need to [taint](/docs/commands/taint.html) the resource so that it can be recreated with the new value.
-
-Alternatively, you can stage the change by creating a new `aws_iam_access_key` resource and change any downstream dependencies to use the new `ses_smtp_password_v4` attribute. Once dependents have been updated with the new resource you can remove the old one.
-
-## Resource: aws_iam_instance_profile
-
-### roles Argument Removal
-
-Switch your Terraform configuration to the `role` argument instead.
-
-For example, given this previous configuration:
-
-```terraform
-resource "aws_iam_instance_profile" "example" {
-  # ... other configuration ...
-
-  roles = [aws_iam_role.example.id]
-}
-```
-
-An updated configuration:
-
-```terraform
-resource "aws_iam_instance_profile" "example" {
-  # ... other configuration ...
-
-  role = aws_iam_role.example.id
-}
-```
-
-## Resource: aws_iam_server_certificate
-
-### certificate_body, certificate_chain, and private_key Arguments No Longer Stored as Hash
-
-Previously when the `certificate_body`, `certificate_chain`, and `private_key` arguments were stored in state, they were stored as a hash of the actual value. This hashing has been removed for new or recreated resources to prevent lifecycle issues.
-
-## Resource: aws_instance
-
-### ebs_block_device.iops and root_block_device.iops Argument Apply-Time Validations
-
-Previously when the `iops` argument was configured in either the `ebs_block_device` or `root_block_device` configuration block, the Terraform AWS Provider would automatically disregard the value provided to `iops` if the `type` argument was also configured with a value other than `io1` (either explicitly or omitted, indicating the default type `gp2`) as `iops` are only configurable for the `io1` volume type per the AWS EC2 API. This behavior has changed such that the Terraform AWS Provider will instead return an error at apply time indicating an `iops` value is invalid for volume types other than `io1`.
-Exceptions to this are in cases where `iops` is set to `null` or `0` such that the Terraform AWS Provider will continue to accept the value regardless of `type`.
-
-## Resource: aws_lambda_alias
-
-### Import No Longer Converts Function Name to ARN
-
-Previously the resource import would always convert the `function_name` portion of the import identifier into the ARN format. Configurations using the Lambda Function name would show this as an unexpected difference after import. Now this will passthrough the given value on import whether its a Lambda Function name or ARN.
-
-## Resource: aws_launch_template
-
-### network_interfaces.delete_on_termination Argument type change
-
-The `network_interfaces.delete_on_termination` argument is now of type `string`, allowing an unspecified value for the argument since the previous `bool` type only allowed for `true/false` and defaulted to `false` when no value was set. Now to enforce `delete_on_termination` to `false`, the string `"false"` or bare `false` value must be used.
-
-For example, given this previous configuration:
-
-```terraform
-resource "aws_launch_template" "example" {
-  # ... other configuration ...
-
-  network_interfaces {
-    # ... other configuration ...
-
-    delete_on_termination = null
-  }
-}
-```
-
-An updated configuration:
-
-```terraform
-resource "aws_launch_template" "example" {
-  # ... other configuration ...
-
-  network_interfaces {
-    # ... other configuration ...
-
-    delete_on_termination = false
-  }
-}
-```
-
-## Resource: aws_lb_listener_rule
-
-### condition.field and condition.values Arguments Removal
-
-Switch your Terraform configuration to use the `host_header` or `path_pattern` configuration block instead.
-
-For example, given this previous configuration:
-
-```terraform
-resource "aws_lb_listener_rule" "example" {
-  # ... other configuration ...
-
-  condition {
-    field  = "path-pattern"
-    values = ["/static/*"]
-  }
-}
-```
-
-An updated configuration:
-
-```terraform
-resource "aws_lb_listener_rule" "example" {
-  # ... other configuration ...
-
-  condition {
-    path_pattern {
-      values = ["/static/*"]
-    }
-  }
-}
-```
-
-## Resource: aws_msk_cluster
-
-### encryption_info.encryption_in_transit.client_broker Default Updated to Match API
-
-A few weeks after general availability launch and initial release of the `aws_msk_cluster` resource, the MSK API default for client broker encryption switched from `TLS_PLAINTEXT` to `TLS`. The attribute default has now been updated to match the more secure API default, however existing Terraform configurations may show a difference if this setting is not configured.
-
-To continue using the old default when it was previously not configured, add or modify this configuration:
-
-```terraform
-resource "aws_msk_cluster" "example" {
-  # ... other configuration ...
-
-  encryption_info {
-    # ... potentially other configuration ...
-
-    encryption_in_transit {
-      # ... potentially other configuration ...
-
-      client_broker = "TLS_PLAINTEXT"
-    }
-  }
-}
-```
-
-## Resource: aws_rds_cluster
-
-### scaling_configuration.min_capacity Now Defaults to 1
-
-Previously when the `min_capacity` argument in a `scaling_configuration` block was not configured, the resource would default to 2. This behavior has been updated to align with the AWS RDS Cluster API default of 1.
-
-## Resource: aws_route53_resolver_rule
-
-### Removal of trailing period in domain_name argument
-
-Previously the resource returned the Resolver Rule Domain Name directly from the API, which included a `.` suffix. This proves difficult when many other AWS services do not accept this trailing period (e.g., ACM Certificate). This period is now automatically removed. For example, when the attribute would previously return a Resolver Rule Domain Name such as `example.com.`, the attribute now will be returned as `example.com`.
-While the returned value will omit the trailing period, use of configurations with trailing periods will not be interrupted.
-
-## Resource: aws_route53_zone
-
-### Removal of trailing period in name argument
-
-Previously the resource returned the Hosted Zone Domain Name directly from the API, which included a `.` suffix. This proves difficult when many other AWS services do not accept this trailing period (e.g., ACM Certificate). This period is now automatically removed. For example, when the attribute would previously return a Hosted Zone Domain Name such as `example.com.`, the attribute now will be returned as `example.com`.
-While the returned value will omit the trailing period, use of configurations with trailing periods will not be interrupted.
-
-## Resource: aws_s3_bucket
-
-### Removal of Automatic aws_s3_bucket_policy Import
-
-Previously when importing the `aws_s3_bucket` resource with the [`terraform import` command](https://www.terraform.io/docs/commands/import.html), the Terraform AWS Provider would automatically attempt to import an associated `aws_s3_bucket_policy` resource as well. This automatic resource import has been removed. Use the [`aws_s3_bucket_policy` resource import](/docs/providers/aws/r/s3_bucket_policy.html#import) to import that resource separately.
-
-### region Attribute Is Now Read-Only
-
-The `region` attribute is no longer configurable, but it remains as a read-only attribute. The region of the `aws_s3_bucket` resource is determined by the region of the Terraform AWS Provider, similar to all other resources.
-
-For example, given this previous configuration:
-
-```terraform
-resource "aws_s3_bucket" "example" {
-  # ... other configuration ...
-
-  region = "us-west-2"
-}
-```
-
-An updated configuration:
-
-```terraform
-resource "aws_s3_bucket" "example" {
-  # ... other configuration ...
-}
-```
-
-## Resource: aws_s3_bucket_metric
-
-### filter configuration block Plan-Time Validation Change
-
-The `filter` configuration block no longer supports the empty block `{}` and requires at least one of the `prefix` or `tags` attributes to be specified.
-
-For example, given this previous configuration:
-
-```terraform
-resource "aws_s3_bucket_metric" "example" {
-  # ... other configuration ...
-
-  filter {}
-}
-```
-
-An updated configuration:
-
-```terraform
-resource "aws_s3_bucket_metric" "example" {
-  # ... other configuration ...
-}
-```
-
-## Resource: aws_security_group
-
-### Removal of Automatic aws_security_group_rule Import
-
-Previously when importing the `aws_security_group` resource with the [`terraform import` command](https://www.terraform.io/docs/commands/import.html), the Terraform AWS Provider would automatically attempt to import an associated `aws_security_group_rule` resource(s) as well. This automatic resource import has been removed. Use the [`aws_security_group_rule` resource import](/docs/providers/aws/r/security_group_rule.html#import) to import those resources separately.
-
-## Resource: aws_sns_platform_application
-
-### platform_credential and platform_principal Arguments No Longer Stored as SHA256 Hash
-
-Previously when the `platform_credential` and `platform_principal` arguments were stored in state, they were stored as a SHA256 hash of the actual value. This prevented Terraform from properly updating the resource when necessary and the hashing has been removed. The Terraform AWS Provider will show an update to these arguments on the first apply after upgrading to version 3.0.0, which is fixing the Terraform state to remove the hash. Since the attributes are marked as sensitive, the values in the update will not be visible in the Terraform output. If the non-hashed values have not changed, then no update is occurring other than the Terraform state update. If these arguments are the only two updates and they both match the SHA256 removal, the apply will occur without submitting an actual `SetPlatformApplicationAttributes` API call.
-
-## Resource: aws_spot_fleet_request
-
-### valid_until Argument No Longer Uses 24 Hour Default
-
-Previously when the `valid_until` argument was not configured, the resource would default to a 24 hour request. This behavior has been removed and allows for non-expiring requests. To recreate the old behavior, the [`time_offset` resource](https://registry.terraform.io/providers/hashicorp/time/latest/docs/resources/offset) can potentially be used.
-
-## Resource: aws_ssm_maintenance_window_task
-
-### logging_info Configuration Block Removal
-
-Switch your Terraform configuration to the `task_invocation_parameters` configuration block `run_command_parameters` configuration block `output_s3_bucket` and `output_s3_key_prefix` arguments instead.
-
-For example, given this previous configuration:
-
-```terraform
-resource "aws_ssm_maintenance_window_task" "example" {
-  # ... other configuration ...
-
-  logging_info {
-    s3_bucket_name       = aws_s3_bucket.example.id
-    s3_bucket_key_prefix = "example"
-  }
-}
-```
-
-An updated configuration:
-
-```terraform
-resource "aws_ssm_maintenance_window_task" "example" {
-  # ... other configuration ...
-
-  task_invocation_parameters {
-    # ... potentially other configuration ...
-
-    run_command_parameters {
-      # ... potentially other configuration ...
-
-      output_s3_bucket     = aws_s3_bucket.example.id
-      output_s3_key_prefix = "example"
-    }
-  }
-}
-```
-
-### task_parameters Configuration Block Removal
-
-Switch your Terraform configuration to the `task_invocation_parameters` configuration block `run_command_parameters` configuration block `parameter` configuration blocks instead.
-
-For example, given this previous configuration:
-
-```terraform
-resource "aws_ssm_maintenance_window_task" "example" {
-  # ... other configuration ...
-
-  task_parameters {
-    name   = "commands"
-    values = ["date"]
-  }
-}
-```
-
-An updated configuration:
-
-```terraform
-resource "aws_ssm_maintenance_window_task" "example" {
-  # ... other configuration ...
-
-  task_invocation_parameters {
-    # ... potentially other configuration ...
-
-    run_command_parameters {
-      # ... potentially other configuration ...
-
-      parameter {
-        name   = "commands"
-        values = ["date"]
-      }
-    }
-  }
-}
-```
diff --git a/website/docs/guides/version-4-upgrade.html.markdown b/website/docs/guides/version-4-upgrade.html.markdown
new file mode 100644
index 00000000000..25537992645
--- /dev/null
+++ b/website/docs/guides/version-4-upgrade.html.markdown
@@ -0,0 +1,3556 @@
+---
+subcategory: ""
+layout: "aws"
+page_title: "Terraform AWS Provider Version 4 Upgrade Guide"
+description: |-
+  Terraform AWS Provider Version 4 Upgrade Guide
+---
+
+# Terraform AWS Provider Version 4 Upgrade Guide
+
+Version 4.0.0 of the AWS provider for Terraform is a major release and includes some changes that you will need to consider when upgrading. We intend this guide to help with that process and focus only on changes from version 3.X to version 4.0.0. See the [Version 3 Upgrade Guide](/docs/providers/aws/guides/version-3-upgrade.html) for information about upgrading from 2.X to version 3.0.0.
+
+We previously marked most of the changes we outline in this guide as deprecated in the Terraform plan/apply output throughout previous provider releases. You can find these changes, including deprecation notices, in the [Terraform AWS Provider CHANGELOG](https://github.com/hashicorp/terraform-provider-aws/blob/main/CHANGELOG.md).
+
+~> **NOTE:** Versions 4.0.0 through v4.8.0 of the AWS Provider introduce significant breaking changes to the `aws_s3_bucket` resource. See [S3 Bucket Refactor](#s3-bucket-refactor) for more details.
+We recommend upgrading to v4.9.0 or later of the AWS Provider instead, where only non-breaking changes and deprecation notices are introduced to the `aws_s3_bucket`. See  [Changes to S3 Bucket Drift Detection](#changes-to-s3-bucket-drift-detection) for additional considerations when upgrading to v4.9.0 or later.
+
+~> **NOTE:** Version 4.0.0 of the AWS Provider introduces changes to the precedence of some authentication and configuration parameters.
+These changes bring the provider in line with the AWS CLI and SDKs.
+See [Changes to Authentication](#changes-to-authentication) for more details.
+
+~> **NOTE:** Version 4.0.0 of the AWS Provider will be the last major version to support [EC2-Classic resources](#ec2-classic-resource-and-data-source-support) as AWS plans to fully retire EC2-Classic Networking. See the [AWS News Blog](https://aws.amazon.com/blogs/aws/ec2-classic-is-retiring-heres-how-to-prepare/) for additional details.
+
+~> **NOTE:** Version 4.0.0 of the AWS Provider will be the last major version to support [Macie Classic resources](#macie-classic-resource-support) as AWS plans to fully retire Macie Classic. See the [Amazon Macie Classic FAQs](https://aws.amazon.com/macie/classic-faqs/) for additional details.
+
+Upgrade topics:
+
+<!-- TOC depthFrom:2 depthTo:2 -->
+
+- [Provider Version Configuration](#provider-version-configuration)
+- [Changes to Authentication](#changes-to-authentication)
+- [New Provider Arguments](#new-provider-arguments)
+- [Changes to S3 Bucket Drift Detection](#changes-to-s3-bucket-drift-detection) (**Applicable to v4.9.0 and later of the AWS Provider**)
+- [S3 Bucket Refactor](#s3-bucket-refactor) (**Only applicable to v4.0.0 through v4.8.0 of the AWS Provider**)
+    - [`acceleration_status` Argument](#acceleration_status-argument)
+    - [`acl` Argument](#acl-argument)
+    - [`cors_rule` Argument](#cors_rule-argument)
+    - [`grant` Argument](#grant-argument)
+    - [`lifecycle_rule` Argument](#lifecycle_rule-argument)
+    - [`logging` Argument](#logging-argument)
+    - [`object_lock_configuration` `rule` Argument](#object_lock_configuration-rule-argument)
+    - [`policy` Argument](#policy-argument)
+    - [`replication_configuration` Argument](#replication_configuration-argument)
+    - [`request_payer` Argument](#request_payer-argument)
+    - [`server_side_encryption_configuration` Argument](#server_side_encryption_configuration-argument)
+    - [`versioning` Argument](#versioning-argument)
+    - [`website`, `website_domain`, and `website_endpoint` Arguments](#website-website_domain-and-website_endpoint-arguments)
+- [Full Resource Lifecycle of Default Resources](#full-resource-lifecycle-of-default-resources)
+    - [Resource: aws_default_subnet](#resource-aws_default_subnet)
+    - [Resource: aws_default_vpc](#resource-aws_default_vpc)
+- [Plural Data Source Behavior](#plural-data-source-behavior)
+- [Empty Strings Not Valid For Certain Resources](#empty-strings-not-valid-for-certain-resources)
+    - [Resource: aws_cloudwatch_event_target (Empty String)](#resource-aws_cloudwatch_event_target-empty-string)
+    - [Resource: aws_customer_gateway](#resource-aws_customer_gateway)
+    - [Resource: aws_default_network_acl](#resource-aws_default_network_acl)
+    - [Resource: aws_default_route_table](#resource-aws_default_route_table)
+    - [Resource: aws_default_vpc (Empty String)](#resource-aws_default_vpc-empty-string)
+    - [Resource: aws_efs_mount_target](#resource-aws_efs_mount_target)
+    - [Resource: aws_elasticsearch_domain](#resource-aws_elasticsearch_domain)
+    - [Resource: aws_instance](#resource-aws_instance)
+    - [Resource: aws_network_acl](#resource-aws_network_acl)
+    - [Resource: aws_route](#resource-aws_route)
+    - [Resource: aws_route_table](#resource-aws_route_table)
+    - [Resource: aws_vpc](#resource-aws_vpc)
+    - [Resource: aws_vpc_ipv6_cidr_block_association](#resource-aws_vpc_ipv6_cidr_block_association)
+- [Data Source: aws_cloudwatch_log_group](#data-source-aws_cloudwatch_log_group)
+- [Data Source: aws_subnet_ids](#data-source-aws_subnet_ids)
+- [Data Source: aws_s3_bucket_object](#data-source-aws_s3_bucket_object)
+- [Data Source: aws_s3_bucket_objects](#data-source-aws_s3_bucket_objects)
+- [Resource: aws_batch_compute_environment](#resource-aws_batch_compute_environment)
+- [Resource: aws_cloudwatch_event_target](#resource-aws_cloudwatch_event_target)
+- [Resource: aws_elasticache_cluster](#resource-aws_elasticache_cluster)
+- [Resource: aws_elasticache_global_replication_group](#resource-aws_elasticache_global_replication_group)
+- [Resource: aws_fsx_ontap_storage_virtual_machine](#resource-aws_fsx_ontap_storage_virtual_machine)
+- [Resource: aws_lb_target_group](#resource-aws_lb_target_group)
+- [Resource: aws_s3_bucket_object](#resource-aws_s3_bucket_object)
+
+<!-- /TOC -->
+
+Additional Topics:
+
+<!-- TOC depthFrom:2 depthTo:2 -->
+
+- [EC2-Classic resource and data source support](#ec2-classic-resource-and-data-source-support)
+- [Macie Classic resource support](#macie-classic-resource-support)
+
+<!-- /TOC -->
+
+## Provider Version Configuration
+
+-> Before upgrading to version 4.0.0, upgrade to the most recent 3.X version of the provider and ensure that your environment successfully runs [`terraform plan`](https://www.terraform.io/docs/commands/plan.html). You should not see changes you don't expect or deprecation notices.
+
+Use [version constraints when configuring Terraform providers](https://www.terraform.io/docs/configuration/providers.html#provider-versions). If you are following that recommendation, update the version constraints in your Terraform configuration and run [`terraform init -upgrade`](https://www.terraform.io/docs/commands/init.html) to download the new version.
+
+For example, given this previous configuration:
+
+```terraform
+terraform {
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 3.74"
+    }
+  }
+}
+
+provider "aws" {
+  # Configuration options
+}
+```
+
+Update to the latest 4.X version:
+
+```terraform
+terraform {
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 4.0"
+    }
+  }
+}
+
+provider "aws" {
+  # Configuration options
+}
+```
+
+## Changes to Authentication
+
+The authentication configuration for the AWS Provider has changed in this version to match the behavior of other AWS products, including the AWS SDK and AWS CLI. _This will cause authentication failures in AWS provider configurations where you set a non-empty `profile` in the `provider` configuration but the profile does not correspond to an AWS profile with valid credentials._
+
+Precedence for authentication settings is as follows:
+
+* `provider` configuration
+* Environment variables
+* Shared credentials and configuration files (_e.g._, `~/.aws/credentials` and `~/.aws/config`)
+
+In previous versions of the provider, you could explicitly set `profile` in the `provider`, and if the profile did not correspond to valid credentials, the provider would use credentials from environment variables. Starting in v4.0, the Terraform AWS provider enforces the precedence shown above, similarly to how the AWS SDK and AWS CLI behave.
+
+In other words, when you explicitly set `profile` in `provider`, the AWS provider will not use environment variables per the precedence shown above. Before v4.0, if `profile` was configured in the `provider` configuration but did not correspond to an AWS profile or valid credentials, the provider would attempt to use environment variables. **This is no longer the case.** An explicitly set profile that does not have valid credentials will cause an authentication error.
+
+For example, with the following, the environment variables will not be used:
+
+```console
+$ export AWS_ACCESS_KEY_ID="anaccesskey"
+$ export AWS_SECRET_ACCESS_KEY="asecretkey"
+```
+
+```terraform
+provider "aws" {
+  region  = "us-west-2"
+  profile = "customprofile"
+}
+```
+
+## New Provider Arguments
+
+Version 4.x adds these new `provider` arguments:
+
+* `assume_role.duration` - Assume role duration as a string, _e.g._, `"1h"` or `"1h30s"`. Terraform AWS Provider v4.0.0 deprecates `assume_role.duration_seconds` and a future version will remove it.
+* `custom_ca_bundle` - File containing custom root and intermediate certificates. Can also be configured using the `AWS_CA_BUNDLE` environment variable. (Setting `ca_bundle` in the shared config file is not supported.)
+* `ec2_metadata_service_endpoint` - Address of the EC2 metadata service (IMDS) endpoint to use. Can also be set with the `AWS_EC2_METADATA_SERVICE_ENDPOINT` environment variable.
+* `ec2_metadata_service_endpoint_mode` - Mode to use in communicating with the metadata service. Valid values are `IPv4` and `IPv6`. Can also be set with the `AWS_EC2_METADATA_SERVICE_ENDPOINT_MODE` environment variable.
+* `s3_use_path_style` - Replaces `s3_force_path_style`, which has been deprecated in Terraform AWS Provider v4.0.0 and support will be removed in a future version.
+* `shared_config_files` - List of paths to AWS shared config files. If not set, the default is `[~/.aws/config]`. A single value can also be set with the `AWS_CONFIG_FILE` environment variable.
+* `shared_credentials_files` - List of paths to the shared credentials file. If not set, the default  is `[~/.aws/credentials]`. A single value can also be set with the `AWS_SHARED_CREDENTIALS_FILE` environment variable. Replaces `shared_credentials_file`, which has been deprecated in Terraform AWS Provider v4.0.0 and support will be removed in a future version.
+* `sts_region` - Region where AWS STS operations will take place. For example, `us-east-1` and `us-west-2`.
+* `use_dualstack_endpoint` - Force the provider to resolve endpoints with DualStack capability. Can also be set with the `AWS_USE_DUALSTACK_ENDPOINT` environment variable or in a shared config file (`use_dualstack_endpoint`).
+* `use_fips_endpoint` - Force the provider to resolve endpoints with FIPS capability. Can also be set with the `AWS_USE_FIPS_ENDPOINT` environment variable or in a shared config file (`use_fips_endpoint`).
+
+~> **NOTE:** Using the `AWS_METADATA_URL` environment variable has been deprecated in Terraform AWS Provider v4.0.0 and support will be removed in a future version. Change any scripts or environments using `AWS_METADATA_URL` to instead use `AWS_EC2_METADATA_SERVICE_ENDPOINT`.
+
+For example, in previous versions, to use FIPS endpoints, you would need to provide all the FIPS endpoints that you wanted to use in the `endpoints` configuration block:
+
+```terraform
+provider "aws" {
+  endpoints {
+    ec2 = "https://ec2-fips.us-west-2.amazonaws.com"
+    s3  = "https://s3-fips.us-west-2.amazonaws.com"
+    sts = "https://sts-fips.us-west-2.amazonaws.com"
+  }
+}
+```
+
+In v4.0.0, you can still set endpoints in the same way. However, you can instead use the `use_fips_endpoint` argument to have the provider automatically resolve FIPS endpoints for all supported services:
+
+```terraform
+provider "aws" {
+  use_fips_endpoint = true
+}
+```
+
+Note that the provider can only resolve FIPS endpoints where AWS provides FIPS support. Support depends on the service and may include `us-east-1`, `us-east-2`, `us-west-1`, `us-west-2`, `us-gov-east-1`, `us-gov-west-1`, and `ca-central-1`. For more information, see [Federal Information Processing Standard (FIPS) 140-2](https://aws.amazon.com/compliance/fips/).
+
+## Changes to S3 Bucket Drift Detection
+
+~> **NOTE:** This only applies to v4.9.0 and later of the AWS Provider.
+
+~> **NOTE:** If you are migrating from v3.75.x of the AWS Provider and you have already adopted the standalone S3 bucket resources (e.g. `aws_s3_bucket_lifecycle_configuration`),
+a [`lifecycle` configuration block to ignore changes](https://www.terraform.io/language/meta-arguments/lifecycle#ignore_changes) to the internal parameters of the source `aws_s3_bucket` resources will no longer be necessary and can be removed upon upgrade.
+
+~> **NOTE:** In the next major version, v5.0, the parameters listed below will be removed entirely from the `aws_s3_bucket` resource.
+For this reason, a deprecation notice is printed in the Terraform CLI for each of the parameters when used in a configuration.
+
+To remediate the breaking changes introduced to the `aws_s3_bucket` resource in v4.0.0 of the AWS Provider,
+v4.9.0 and later retain the same configuration parameters of the `aws_s3_bucket` resource as in v3.x and functionality of the `aws_s3_bucket` resource only differs from v3.x
+in that Terraform will only perform drift detection for each of the following parameters if a configuration value is provided:
+
+* `acceleration_status`
+* `acl`
+* `cors_rule`
+* `grant`
+* `lifecycle_rule`
+* `logging`
+* `object_lock_configuration`
+* `policy`
+* `replication_configuration`
+* `request_payer`
+* `server_side_encryption_configuration`
+* `versioning`
+* `website`
+
+Thus, if one of these parameters was once configured and then is entirely removed from an `aws_s3_bucket` resource configuration,
+Terraform will not pick up on these changes on a subsequent `terraform plan` or `terraform apply`.
+
+For example, given the following configuration with a single `cors_rule`:
+
+```terraform
+resource "aws_s3_bucket" "example" {
+  bucket = "yournamehere"
+
+  # ... other configuration ...
+  cors_rule {
+    allowed_headers = ["*"]
+    allowed_methods = ["PUT", "POST"]
+    allowed_origins = ["https://s3-website-test.hashicorp.com"]
+    expose_headers  = ["ETag"]
+    max_age_seconds = 3000
+  }
+}
+```
+
+When updated to the following configuration without a `cors_rule`:
+
+```terraform
+resource "aws_s3_bucket" "example" {
+  bucket = "yournamehere"
+
+  # ... other configuration ...
+}
+```
+
+Terraform CLI with v4.9.0 of the AWS Provider will report back:
+
+```console
+aws_s3_bucket.example: Refreshing state... [id=yournamehere]
+...
+No changes. Your infrastructure matches the configuration.
+```
+
+With that said, to manage changes to these parameters in the `aws_s3_bucket` resource, practitioners should configure each parameter's respective standalone resource
+and perform updates directly on those new configurations. The parameters are mapped to the standalone resources as follows:
+
+| `aws_s3_bucket` Parameter              | Standalone Resource                                  |
+|----------------------------------------|------------------------------------------------------|
+| `acceleration_status`                  | `aws_s3_bucket_accelerate_configuration`             |
+| `acl`                                  | `aws_s3_bucket_acl`                                  |
+| `cors_rule`                            | `aws_s3_bucket_cors_configuration`                   |
+| `grant`                                | `aws_s3_bucket_acl`                                  |
+| `lifecycle_rule`                       | `aws_s3_bucket_lifecycle_configuration`              |
+| `logging`                              | `aws_s3_bucket_logging`                              |
+| `object_lock_configuration`            | `aws_s3_bucket_object_lock_configuration`            |
+| `policy`                               | `aws_s3_bucket_policy`                               |
+| `replication_configuration`            | `aws_s3_bucket_replication_configuration`            |
+| `request_payer`                        | `aws_s3_bucket_request_payment_configuration`        |
+| `server_side_encryption_configuration` | `aws_s3_bucket_server_side_encryption_configuration` |
+| `versioning`                           | `aws_s3_bucket_versioning`                           |
+| `website`                              | `aws_s3_bucket_website_configuration`                |
+
+Going back to the earlier example, given the following configuration:
+
+```terraform
+resource "aws_s3_bucket" "example" {
+  bucket = "yournamehere"
+
+  # ... other configuration ...
+  cors_rule {
+    allowed_headers = ["*"]
+    allowed_methods = ["PUT", "POST"]
+    allowed_origins = ["https://s3-website-test.hashicorp.com"]
+    expose_headers  = ["ETag"]
+    max_age_seconds = 3000
+  }
+}
+```
+
+Practitioners can upgrade to v4.9.0 and then introduce the standalone `aws_s3_bucket_cors_configuration` resource, e.g.
+
+```terraform
+resource "aws_s3_bucket" "example" {
+  bucket = "yournamehere"
+  # ... other configuration ...
+}
+
+resource "aws_s3_bucket_cors_configuration" "example" {
+  bucket = aws_s3_bucket.example.id
+
+  cors_rule {
+    allowed_headers = ["*"]
+    allowed_methods = ["PUT", "POST"]
+    allowed_origins = ["https://s3-website-test.hashicorp.com"]
+    expose_headers  = ["ETag"]
+    max_age_seconds = 3000
+  }
+}
+```
+
+Depending on the tools available to you, the above configuration can either be directly applied with Terraform or the standalone resource
+can be imported into Terraform state. Please refer to each standalone resource's _Import_ documentation for the proper syntax.
+
+Once the standalone resources are managed by Terraform, updates and removal can be performed as needed.
+
+The following sections depict standalone resource adoption per individual parameter. Standalone resource adoption is not required to upgrade but is recommended to ensure drift is detected by Terraform.
+The examples below are by no means exhaustive. The aim is to provide important concepts when migrating to a standalone resource whose parameters may not entirely align with the corresponding parameter in the `aws_s3_bucket` resource.
+
+### Migrating to `aws_s3_bucket_accelerate_configuration`
+
+Given this previous configuration:
+
+```terraform
+resource "aws_s3_bucket" "example" {
+  bucket = "yournamehere"
+
+  # ... other configuration ...
+  acceleration_status = "Enabled"
+}
+```
+
+Update the configuration to:
+
+```terraform
+resource "aws_s3_bucket" "example" {
+  bucket = "yournamehere"
+
+  # ... other configuration ...
+}
+
+resource "aws_s3_bucket_accelerate_configuration" "example" {
+  bucket = aws_s3_bucket.example.id
+  status = "Enabled"
+}
+```
+
+### Migrating to `aws_s3_bucket_acl`
+
+#### With `acl`
+
+Given this previous configuration:
+
+```terraform
+resource "aws_s3_bucket" "example" {
+  bucket = "yournamehere"
+  acl    = "private"
+
+  # ... other configuration ...
+}
+```
+
+Update the configuration to:
+
+```terraform
+resource "aws_s3_bucket" "example" {
+  bucket = "yournamehere"
+}
+
+resource "aws_s3_bucket_acl" "example" {
+  bucket = aws_s3_bucket.example.id
+  acl    = "private"
+}
+```
+
+#### With `grant`
+
+Given this previous configuration:
+
+```terraform
+resource "aws_s3_bucket" "example" {
+  bucket = "yournamehere"
+
+  # ... other configuration ...
+  grant {
+    id          = data.aws_canonical_user_id.current_user.id
+    type        = "CanonicalUser"
+    permissions = ["FULL_CONTROL"]
+  }
+
+  grant {
+    type        = "Group"
+    permissions = ["READ_ACP", "WRITE"]
+    uri         = "http://acs.amazonaws.com/groups/s3/LogDelivery"
+  }
+}
+```
+
+Update the configuration to:
+
+```terraform
+resource "aws_s3_bucket" "example" {
+  bucket = "yournamehere"
+
+  # ... other configuration ...
+}
+
+resource "aws_s3_bucket_acl" "example" {
+  bucket = aws_s3_bucket.example.id
+
+  access_control_policy {
+    grant {
+      grantee {
+        id   = data.aws_canonical_user_id.current_user.id
+        type = "CanonicalUser"
+      }
+      permission = "FULL_CONTROL"
+    }
+
+    grant {
+      grantee {
+        type = "Group"
+        uri  = "http://acs.amazonaws.com/groups/s3/LogDelivery"
+      }
+      permission = "READ_ACP"
+    }
+
+    grant {
+      grantee {
+        type = "Group"
+        uri  = "http://acs.amazonaws.com/groups/s3/LogDelivery"
+      }
+      permission = "WRITE"
+    }
+
+    owner {
+      id = data.aws_canonical_user_id.current_user.id
+    }
+  }
+}
+```
+
+### Migrating to `aws_s3_bucket_cors_configuration`
+
+Given this previous configuration:
+
+```terraform
+resource "aws_s3_bucket" "example" {
+  bucket = "yournamehere"
+
+  # ... other configuration ...
+  cors_rule {
+    allowed_headers = ["*"]
+    allowed_methods = ["PUT", "POST"]
+    allowed_origins = ["https://s3-website-test.hashicorp.com"]
+    expose_headers  = ["ETag"]
+    max_age_seconds = 3000
+  }
+}
+```
+
+Update the configuration to:
+
+```terraform
+resource "aws_s3_bucket" "example" {
+  bucket = "yournamehere"
+
+  # ... other configuration ...
+}
+
+resource "aws_s3_bucket_cors_configuration" "example" {
+  bucket = aws_s3_bucket.example.id
+
+  cors_rule {
+    allowed_headers = ["*"]
+    allowed_methods = ["PUT", "POST"]
+    allowed_origins = ["https://s3-website-test.hashicorp.com"]
+    expose_headers  = ["ETag"]
+    max_age_seconds = 3000
+  }
+}
+```
+
+### Migrating to `aws_s3_bucket_lifecycle_configuration`
+
+~> **Note:** In version `3.x` of the provider, the `lifecycle_rule.id` argument was optional, while in version `4.x`, the `aws_s3_bucket_lifecycle_configuration.rule.id` argument required. Use the AWS CLI s3api [get-bucket-lifecycle-configuration](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/s3api/get-bucket-lifecycle-configuration.html) to get the source bucket's lifecycle configuration to determine the ID.
+
+#### For Lifecycle Rules with no `prefix` previously configured
+
+~> **Note:** When configuring the `rule.filter` configuration block in the new `aws_s3_bucket_lifecycle_configuration` resource, use the AWS CLI s3api [get-bucket-lifecycle-configuration](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/s3api/get-bucket-lifecycle-configuration.html)
+to get the source bucket's lifecycle configuration and determine if the `Filter` is configured as `"Filter" : {}` or `"Filter" : { "Prefix": "" }`.
+If AWS returns the former, configure `rule.filter` as `filter {}`. Otherwise, neither a `rule.filter` nor `rule.prefix` parameter should be configured as shown here:
+
+Given this previous configuration:
+
+```terraform
+resource "aws_s3_bucket" "example" {
+  bucket = "yournamehere"
+
+  lifecycle_rule {
+    id      = "Keep previous version 30 days, then in Glacier another 60"
+    enabled = true
+
+    noncurrent_version_transition {
+      days          = 30
+      storage_class = "GLACIER"
+    }
+
+    noncurrent_version_expiration {
+      days = 90
+    }
+  }
+
+  lifecycle_rule {
+    id                                     = "Delete old incomplete multi-part uploads"
+    enabled                                = true
+    abort_incomplete_multipart_upload_days = 7
+  }
+}
+```
+
+Update the configuration to:
+
+```terraform
+resource "aws_s3_bucket" "example" {
+  bucket = "yournamehere"
+
+  # ... other configuration ...
+}
+
+resource "aws_s3_bucket_lifecycle_configuration" "example" {
+  bucket = aws_s3_bucket.example.id
+
+  rule {
+    id     = "Keep previous version 30 days, then in Glacier another 60"
+    status = "Enabled"
+
+    noncurrent_version_transition {
+      noncurrent_days = 30
+      storage_class   = "GLACIER"
+    }
+
+    noncurrent_version_expiration {
+      noncurrent_days = 90
+    }
+  }
+
+  rule {
+    id     = "Delete old incomplete multi-part uploads"
+    status = "Enabled"
+
+    abort_incomplete_multipart_upload {
+      days_after_initiation = 7
+    }
+  }
+}
+```
+
+#### For Lifecycle Rules with `prefix` previously configured as an empty string
+
+Given this previous configuration:
+
+```terraform
+resource "aws_s3_bucket" "example" {
+  bucket = "yournamehere"
+
+  lifecycle_rule {
+    id      = "log-expiration"
+    enabled = true
+    prefix  = ""
+
+    transition {
+      days          = 30
+      storage_class = "STANDARD_IA"
+    }
+
+    transition {
+      days          = 180
+      storage_class = "GLACIER"
+    }
+  }
+}
+```
+
+Update the configuration to:
+
+```terraform
+resource "aws_s3_bucket" "example" {
+  bucket = "yournamehere"
+
+  # ... other configuration ...
+}
+
+resource "aws_s3_bucket_lifecycle_configuration" "example" {
+  bucket = aws_s3_bucket.example.id
+
+  rule {
+    id     = "log-expiration"
+    status = "Enabled"
+
+    transition {
+      days          = 30
+      storage_class = "STANDARD_IA"
+    }
+
+    transition {
+      days          = 180
+      storage_class = "GLACIER"
+    }
+  }
+}
+```
+
+#### For Lifecycle Rules with `prefix`
+
+Given this previous configuration:
+
+```terraform
+resource "aws_s3_bucket" "example" {
+  bucket = "yournamehere"
+
+  lifecycle_rule {
+    id      = "log-expiration"
+    enabled = true
+    prefix  = "foobar"
+
+    transition {
+      days          = 30
+      storage_class = "STANDARD_IA"
+    }
+
+    transition {
+      days          = 180
+      storage_class = "GLACIER"
+    }
+  }
+}
+```
+
+Update the configuration to:
+
+```terraform
+resource "aws_s3_bucket" "example" {
+  bucket = "yournamehere"
+
+  # ... other configuration ...
+}
+
+resource "aws_s3_bucket_lifecycle_configuration" "example" {
+  bucket = aws_s3_bucket.example.id
+
+  rule {
+    id     = "log-expiration"
+    status = "Enabled"
+
+    filter {
+      prefix = "foobar"
+    }
+
+    transition {
+      days          = 30
+      storage_class = "STANDARD_IA"
+    }
+
+    transition {
+      days          = 180
+      storage_class = "GLACIER"
+    }
+  }
+}
+```
+
+#### For Lifecycle Rules with `prefix` and `tags`
+
+Given this previous configuration:
+
+```terraform
+resource "aws_s3_bucket" "example" {
+  bucket = "yournamehere"
+
+  # ... other configuration ...
+  lifecycle_rule {
+    id      = "log"
+    enabled = true
+    prefix  = "log/"
+
+    tags = {
+      rule      = "log"
+      autoclean = "true"
+    }
+
+    transition {
+      days          = 30
+      storage_class = "STANDARD_IA"
+    }
+
+    transition {
+      days          = 60
+      storage_class = "GLACIER"
+    }
+
+    expiration {
+      days = 90
+    }
+  }
+
+  lifecycle_rule {
+    id      = "tmp"
+    prefix  = "tmp/"
+    enabled = true
+
+    expiration {
+      date = "2022-12-31"
+    }
+  }
+}
+```
+
+Update the configuration to:
+
+```terraform
+resource "aws_s3_bucket" "example" {
+  bucket = "yournamehere"
+
+  # ... other configuration ...
+}
+
+resource "aws_s3_bucket_lifecycle_configuration" "example" {
+  bucket = aws_s3_bucket.example.id
+
+  rule {
+    id     = "log"
+    status = "Enabled"
+
+    filter {
+      and {
+        prefix = "log/"
+
+        tags = {
+          rule      = "log"
+          autoclean = "true"
+        }
+      }
+    }
+
+    transition {
+      days          = 30
+      storage_class = "STANDARD_IA"
+    }
+
+    transition {
+      days          = 60
+      storage_class = "GLACIER"
+    }
+
+    expiration {
+      days = 90
+    }
+  }
+
+  rule {
+    id = "tmp"
+
+    filter {
+      prefix = "tmp/"
+    }
+
+    expiration {
+      date = "2022-12-31T00:00:00Z"
+    }
+
+    status = "Enabled"
+  }
+}
+```
+
+### Migrating to `aws_s3_bucket_logging`
+
+Given this previous configuration:
+
+```terraform
+resource "aws_s3_bucket" "log_bucket" {
+  # ... other configuration ...
+  bucket = "example-log-bucket"
+}
+
+resource "aws_s3_bucket" "example" {
+  bucket = "yournamehere"
+
+  # ... other configuration ...
+  logging {
+    target_bucket = aws_s3_bucket.log_bucket.id
+    target_prefix = "log/"
+  }
+}
+```
+
+Update the configuration to:
+
+```terraform
+resource "aws_s3_bucket" "log_bucket" {
+  bucket = "example-log-bucket"
+
+  # ... other configuration ...
+}
+
+resource "aws_s3_bucket" "example" {
+  bucket = "yournamehere"
+
+  # ... other configuration ...
+}
+
+resource "aws_s3_bucket_logging" "example" {
+  bucket        = aws_s3_bucket.example.id
+  target_bucket = aws_s3_bucket.log_bucket.id
+  target_prefix = "log/"
+}
+```
+
+### Migrating to `aws_s3_bucket_object_lock_configuration`
+
+Given this previous configuration:
+
+```terraform
+resource "aws_s3_bucket" "example" {
+  bucket = "yournamehere"
+
+  # ... other configuration ...
+  object_lock_configuration {
+    object_lock_enabled = "Enabled"
+
+    rule {
+      default_retention {
+        mode = "COMPLIANCE"
+        days = 3
+      }
+    }
+  }
+}
+```
+
+Update the configuration to:
+
+```terraform
+resource "aws_s3_bucket" "example" {
+  bucket = "yournamehere"
+
+  # ... other configuration ...
+  object_lock_enabled = true
+}
+
+resource "aws_s3_bucket_object_lock_configuration" "example" {
+  bucket = aws_s3_bucket.example.id
+
+  rule {
+    default_retention {
+      mode = "COMPLIANCE"
+      days = 3
+    }
+  }
+}
+```
+
+### Migrating to `aws_s3_bucket_policy`
+
+Given this previous configuration:
+
+```terraform
+resource "aws_s3_bucket" "example" {
+  bucket = "yournamehere"
+
+  # ... other configuration ...
+  policy = <<EOF
+{
+  "Id": "Policy1446577137248",
+  "Statement": [
+    {
+      "Action": "s3:PutObject",
+      "Effect": "Allow",
+      "Principal": {
+        "AWS": "${data.aws_elb_service_account.current.arn}"
+      },
+      "Resource": "arn:${data.aws_partition.current.partition}:s3:::yournamehere/*",
+      "Sid": "Stmt1446575236270"
+    }
+  ],
+  "Version": "2012-10-17"
+}
+EOF
+}
+```
+
+Update the configuration to:
+
+```terraform
+resource "aws_s3_bucket" "example" {
+  bucket = "yournamehere"
+
+  # ... other configuration ...
+}
+
+resource "aws_s3_bucket_policy" "example" {
+  bucket = aws_s3_bucket.example.id
+  policy = <<EOF
+{
+  "Id": "Policy1446577137248",
+  "Statement": [
+    {
+      "Action": "s3:PutObject",
+      "Effect": "Allow",
+      "Principal": {
+        "AWS": "${data.aws_elb_service_account.current.arn}"
+      },
+      "Resource": "${aws_s3_bucket.example.arn}/*",
+      "Sid": "Stmt1446575236270"
+    }
+  ],
+  "Version": "2012-10-17"
+}
+EOF
+}
+```
+
+### Migrating to `aws_s3_bucket_replication_configuration`
+
+Given this previous configuration:
+
+```terraform
+resource "aws_s3_bucket" "example" {
+  provider = aws.central
+  bucket   = "yournamehere"
+
+  # ... other configuration ...
+
+  replication_configuration {
+    role = aws_iam_role.replication.arn
+    rules {
+      id     = "foobar"
+      status = "Enabled"
+      filter {
+        tags = {}
+      }
+      destination {
+        bucket        = aws_s3_bucket.destination.arn
+        storage_class = "STANDARD"
+        replication_time {
+          status  = "Enabled"
+          minutes = 15
+        }
+        metrics {
+          status  = "Enabled"
+          minutes = 15
+        }
+      }
+    }
+  }
+}
+```
+
+Update the configuration to:
+
+```terraform
+resource "aws_s3_bucket" "example" {
+  provider = aws.central
+  bucket   = "yournamehere"
+
+  # ... other configuration ...
+}
+
+resource "aws_s3_bucket_replication_configuration" "example" {
+  bucket = aws_s3_bucket.source.id
+  role   = aws_iam_role.replication.arn
+
+  rule {
+    id     = "foobar"
+    status = "Enabled"
+
+    filter {}
+
+    delete_marker_replication {
+      status = "Enabled"
+    }
+
+    destination {
+      bucket        = aws_s3_bucket.destination.arn
+      storage_class = "STANDARD"
+
+      replication_time {
+        status = "Enabled"
+        time {
+          minutes = 15
+        }
+      }
+
+      metrics {
+        status = "Enabled"
+        event_threshold {
+          minutes = 15
+        }
+      }
+    }
+  }
+}
+```
+
+### Migrating to `aws_s3_bucket_request_payment_configuration`
+
+Given this previous configuration:
+
+```terraform
+resource "aws_s3_bucket" "example" {
+  bucket = "yournamehere"
+
+  # ... other configuration ...
+  request_payer = "Requester"
+}
+```
+
+Update the configuration to:
+
+```terraform
+resource "aws_s3_bucket" "example" {
+  bucket = "yournamehere"
+
+  # ... other configuration ...
+}
+
+resource "aws_s3_bucket_request_payment_configuration" "example" {
+  bucket = aws_s3_bucket.example.id
+  payer  = "Requester"
+}
+```
+
+### Migrating to `aws_s3_bucket_server_side_encryption_configuration`
+
+Given this previous configuration:
+
+```terraform
+resource "aws_s3_bucket" "example" {
+  bucket = "yournamehere"
+
+  # ... other configuration ...
+  server_side_encryption_configuration {
+    rule {
+      apply_server_side_encryption_by_default {
+        kms_master_key_id = aws_kms_key.mykey.arn
+        sse_algorithm     = "aws:kms"
+      }
+    }
+  }
+}
+```
+
+Update the configuration to:
+
+```terraform
+resource "aws_s3_bucket" "example" {
+  bucket = "yournamehere"
+
+  # ... other configuration ...
+}
+
+resource "aws_s3_bucket_server_side_encryption_configuration" "example" {
+  bucket = aws_s3_bucket.example.id
+
+  rule {
+    apply_server_side_encryption_by_default {
+      kms_master_key_id = aws_kms_key.mykey.arn
+      sse_algorithm     = "aws:kms"
+    }
+  }
+}
+```
+
+### Migrating to `aws_s3_bucket_versioning`
+
+~> **NOTE:** As `aws_s3_bucket_versioning` is a separate resource, any S3 objects for which versioning is important (_e.g._, a truststore for mutual TLS authentication) must implicitly or explicitly depend on the `aws_s3_bucket_versioning` resource. Otherwise, the S3 objects may be created before versioning has been set. [See below](#ensure-objects-depend-on-versioning) for an example. Also note that AWS recommends waiting 15 minutes after enabling versioning on a bucket before putting or deleting objects in/from the bucket.
+
+#### Buckets With Versioning Enabled
+
+Given this previous configuration:
+
+```terraform
+resource "aws_s3_bucket" "example" {
+  bucket = "yournamehere"
+
+  # ... other configuration ...
+  versioning {
+    enabled = true
+  }
+}
+```
+
+Update the configuration to:
+
+```terraform
+resource "aws_s3_bucket" "example" {
+  bucket = "yournamehere"
+
+  # ... other configuration ...
+}
+
+resource "aws_s3_bucket_versioning" "example" {
+  bucket = aws_s3_bucket.example.id
+  versioning_configuration {
+    status = "Enabled"
+  }
+}
+```
+
+#### Buckets With Versioning Disabled or Suspended
+
+Depending on the version of the Terraform AWS Provider you are migrating from, the interpretation of `versioning.enabled = false`
+in your `aws_s3_bucket` resource will differ and thus the migration to the `aws_s3_bucket_versioning` resource will also differ as follows.
+
+If you are migrating from the Terraform AWS Provider `v3.70.0` or later:
+
+* For new S3 buckets, `enabled = false` is synonymous to `Disabled`.
+* For existing S3 buckets, `enabled = false` is synonymous to `Suspended`.
+
+If you are migrating from an earlier version of the Terraform AWS Provider:
+
+* For both new and existing S3 buckets, `enabled = false` is synonymous to `Suspended`.
+
+Given this previous configuration:
+
+```terraform
+resource "aws_s3_bucket" "example" {
+  bucket = "yournamehere"
+
+  # ... other configuration ...
+  versioning {
+    enabled = false
+  }
+}
+```
+
+Update the configuration to one of the following:
+
+* If migrating from Terraform AWS Provider `v3.70.0` or later and bucket versioning was never enabled:
+
+  ```terraform
+  resource "aws_s3_bucket" "example" {
+    bucket = "yournamehere"
+  
+    # ... other configuration ...
+  }
+  
+  resource "aws_s3_bucket_versioning" "example" {
+    bucket = aws_s3_bucket.example.id
+    versioning_configuration {
+      status = "Disabled"
+    }
+  }
+  ```
+
+* If migrating from Terraform AWS Provider `v3.70.0` or later and bucket versioning was enabled at one point:
+
+  ```terraform
+  resource "aws_s3_bucket" "example" {
+    bucket = "yournamehere"
+  
+    # ... other configuration ...
+  }
+  
+  resource "aws_s3_bucket_versioning" "example" {
+    bucket = aws_s3_bucket.example.id
+    versioning_configuration {
+      status = "Suspended"
+    }
+  }
+  ```
+
+* If migrating from an earlier version of Terraform AWS Provider:
+
+  ```terraform
+  resource "aws_s3_bucket" "example" {
+    bucket = "yournamehere"
+  
+    # ... other configuration ...
+  }
+  
+  resource "aws_s3_bucket_versioning" "example" {
+    bucket = aws_s3_bucket.example.id
+    versioning_configuration {
+      status = "Suspended"
+    }
+  }
+  ```
+
+#### Ensure Objects Depend on Versioning
+
+When you create an object whose `version_id` you need and an `aws_s3_bucket_versioning` resource in the same configuration, you are more likely to have success by ensuring the `s3_object` depends either implicitly (see below) or explicitly (i.e., using `depends_on = [aws_s3_bucket_versioning.example]`) on the `aws_s3_bucket_versioning` resource.
+
+~> **NOTE:** For critical and/or production S3 objects, do not create a bucket, enable versioning, and create an object in the bucket within the same configuration. Doing so will not allow the AWS-recommended 15 minutes between enabling versioning and writing to the bucket.
+
+This example shows the `aws_s3_object.example` depending implicitly on the versioning resource through the reference to `aws_s3_bucket_versioning.example.id` to define `bucket`:
+
+```terraform
+resource "aws_s3_bucket" "example" {
+  bucket = "yotto"
+}
+
+resource "aws_s3_bucket_versioning" "example" {
+  bucket = aws_s3_bucket.example.id
+
+  versioning_configuration {
+    status = "Enabled"
+  }
+}
+
+resource "aws_s3_object" "example" {
+  bucket = aws_s3_bucket_versioning.example.id
+  key    = "droeloe"
+  source = "example.txt"
+}
+```
+
+### Migrating to `aws_s3_bucket_website_configuration`
+
+Given this previous configuration:
+
+```terraform
+resource "aws_s3_bucket" "example" {
+  bucket = "yournamehere"
+
+  # ... other configuration ...
+  website {
+    index_document = "index.html"
+    error_document = "error.html"
+  }
+}
+```
+
+Update the configuration to:
+
+```terraform
+resource "aws_s3_bucket" "example" {
+  bucket = "yournamehere"
+
+  # ... other configuration ...
+}
+
+resource "aws_s3_bucket_website_configuration" "example" {
+  bucket = aws_s3_bucket.example.id
+
+  index_document {
+    suffix = "index.html"
+  }
+
+  error_document {
+    key = "error.html"
+  }
+}
+```
+
+Given this previous configuration that uses the `aws_s3_bucket` parameter `website_domain` with `aws_route53_record`:
+
+```terraform
+resource "aws_route53_zone" "main" {
+  name = "domain.test"
+}
+
+resource "aws_s3_bucket" "website" {
+  # ... other configuration ...
+  website {
+    index_document = "index.html"
+    error_document = "error.html"
+  }
+}
+
+resource "aws_route53_record" "alias" {
+  zone_id = aws_route53_zone.main.zone_id
+  name    = "www"
+  type    = "A"
+
+  alias {
+    zone_id                = aws_s3_bucket.website.hosted_zone_id
+    name                   = aws_s3_bucket.website.website_domain
+    evaluate_target_health = true
+  }
+}
+```
+
+Update the configuration to use the `aws_s3_bucket_website_configuration` resource and its `website_domain` parameter:
+
+```terraform
+resource "aws_route53_zone" "main" {
+  name = "domain.test"
+}
+
+resource "aws_s3_bucket" "website" {
+  # ... other configuration ...
+}
+
+resource "aws_s3_bucket_website_configuration" "example" {
+  bucket = aws_s3_bucket.website.id
+
+  index_document {
+    suffix = "index.html"
+  }
+}
+
+resource "aws_route53_record" "alias" {
+  zone_id = aws_route53_zone.main.zone_id
+  name    = "www"
+  type    = "A"
+
+  alias {
+    zone_id                = aws_s3_bucket.website.hosted_zone_id
+    name                   = aws_s3_bucket_website_configuration.example.website_domain
+    evaluate_target_health = true
+  }
+}
+```
+
+## S3 Bucket Refactor
+
+~> **NOTE:** This only applies to v4.0.0 through v4.8.0 of the AWS Provider, which introduce significant breaking
+changes to the `aws_s3_bucket` resource. We recommend upgrading to v4.9.0 of the AWS Provider instead. See the section above, [Changes to S3 Bucket Drift Detection](#changes-to-s3-bucket-drift-detection), for additional upgrade considerations.
+
+To help distribute the management of S3 bucket settings via independent resources, various arguments and attributes in the `aws_s3_bucket` resource have become **read-only**.
+
+Configurations dependent on these arguments should be updated to use the corresponding `aws_s3_bucket_*` resource in order to prevent Terraform from reporting “unconfigurable attribute” errors for read-only arguments. Once updated, it is recommended to import new `aws_s3_bucket_*` resources into Terraform state.
+
+In the event practitioners do not anticipate future modifications to the S3 bucket settings associated with these read-only arguments or drift detection is not needed, these read-only arguments should be removed from `aws_s3_bucket` resource configurations in order to prevent Terraform from reporting “unconfigurable attribute” errors; the states of these arguments will be preserved but are subject to change with modifications made outside Terraform.
+
+~> **NOTE:** Each of the new `aws_s3_bucket_*` resources relies on S3 API calls that utilize a `PUT` action in order to modify the target S3 bucket. These calls follow standard HTTP methods for REST APIs, and therefore **should** handle situations where the target configuration already exists. While it is not strictly necessary to import new `aws_s3_bucket_*` resources where the updated configuration matches the configuration used in previous versions of the AWS provider, skipping this step will lead to a diff in the first plan after a configuration change indicating that any new `aws_s3_bucket_*` resources will be created, making it more difficult to determine whether the appropriate actions will be taken.
+
+### `acceleration_status` Argument
+
+Switch your Terraform configuration to the [`aws_s3_bucket_accelerate_configuration` resource](/docs/providers/aws/r/s3_bucket_accelerate_configuration.html) instead.
+
+For example, given this previous configuration:
+
+```terraform
+resource "aws_s3_bucket" "example" {
+  bucket = "yournamehere"
+
+  # ... other configuration ...
+  acceleration_status = "Enabled"
+}
+```
+
+You will get the following error after upgrading:
+
+```
+│ Error: Value for unconfigurable attribute
+│
+│   with aws_s3_bucket.example,
+│   on main.tf line 1, in resource "aws_s3_bucket" "example":
+│    1: resource "aws_s3_bucket" "example" {
+│
+│ Can't configure a value for "acceleration_status": its value will be decided automatically based on the result of applying this configuration.
+```
+
+Since `acceleration_status` is now read only, update your configuration to use the `aws_s3_bucket_accelerate_configuration`
+resource and remove `acceleration_status` in the `aws_s3_bucket` resource:
+
+```terraform
+resource "aws_s3_bucket" "example" {
+  bucket = "yournamehere"
+
+  # ... other configuration ...
+}
+
+resource "aws_s3_bucket_accelerate_configuration" "example" {
+  bucket = aws_s3_bucket.example.id
+  status = "Enabled"
+}
+```
+
+Run `terraform import` on each new resource, _e.g._,
+
+```console
+$ terraform import aws_s3_bucket_accelerate_configuration.example yournamehere
+aws_s3_bucket_accelerate_configuration.example: Importing from ID "yournamehere"...
+aws_s3_bucket_accelerate_configuration.example: Import prepared!
+  Prepared aws_s3_bucket_accelerate_configuration for import
+aws_s3_bucket_accelerate_configuration.example: Refreshing state... [id=yournamehere]
+
+Import successful!
+
+The resources that were imported are shown above. These resources are now in
+your Terraform state and will henceforth be managed by Terraform.
+```
+
+### `acl` Argument
+
+Switch your Terraform configuration to the [`aws_s3_bucket_acl` resource](/docs/providers/aws/r/s3_bucket_acl.html) instead.
+
+For example, given this previous configuration:
+
+```terraform
+resource "aws_s3_bucket" "example" {
+  bucket = "yournamehere"
+  acl    = "private"
+
+  # ... other configuration ...
+}
+```
+
+You will get the following error after upgrading:
+
+```
+│ Error: Value for unconfigurable attribute
+│
+│   with aws_s3_bucket.example,
+│   on main.tf line 1, in resource "aws_s3_bucket" "example":
+│    1: resource "aws_s3_bucket" "example" {
+│
+│ Can't configure a value for "acl": its value will be decided automatically based on the result of applying this configuration.
+```
+
+Since `acl` is now read only, update your configuration to use the `aws_s3_bucket_acl`
+resource and remove the `acl` argument in the `aws_s3_bucket` resource:
+
+```terraform
+resource "aws_s3_bucket" "example" {
+  bucket = "yournamehere"
+}
+
+resource "aws_s3_bucket_acl" "example" {
+  bucket = aws_s3_bucket.example.id
+  acl    = "private"
+}
+```
+
+~> **NOTE:** When importing into `aws_s3_bucket_acl`, make sure you use the S3 bucket name (_e.g._, `yournamehere` in the example above) as part of the ID, and _not_ the Terraform bucket configuration name (_e.g._, `example` in the example above).
+
+Run `terraform import` on each new resource, _e.g._,
+
+```console
+$ terraform import aws_s3_bucket_acl.example yournamehere,private
+aws_s3_bucket_acl.example: Importing from ID "yournamehere,private"...
+aws_s3_bucket_acl.example: Import prepared!
+  Prepared aws_s3_bucket_acl for import
+aws_s3_bucket_acl.example: Refreshing state... [id=yournamehere,private]
+
+Import successful!
+
+The resources that were imported are shown above. These resources are now in
+your Terraform state and will henceforth be managed by Terraform.
+```
+
+### `cors_rule` Argument
+
+Switch your Terraform configuration to the [`aws_s3_bucket_cors_configuration` resource](/docs/providers/aws/r/s3_bucket_cors_configuration.html) instead.
+
+For example, given this previous configuration:
+
+```terraform
+resource "aws_s3_bucket" "example" {
+  bucket = "yournamehere"
+
+  # ... other configuration ...
+  cors_rule {
+    allowed_headers = ["*"]
+    allowed_methods = ["PUT", "POST"]
+    allowed_origins = ["https://s3-website-test.hashicorp.com"]
+    expose_headers  = ["ETag"]
+    max_age_seconds = 3000
+  }
+}
+```
+
+You will get the following error after upgrading:
+
+```
+│ Error: Value for unconfigurable attribute
+│
+│   with aws_s3_bucket.example,
+│   on main.tf line 1, in resource "aws_s3_bucket" "example":
+│    1: resource "aws_s3_bucket" "example" {
+│
+│ Can't configure a value for "cors_rule": its value will be decided automatically based on the result of applying this configuration.
+```
+
+Since `cors_rule` is now read only, update your configuration to use the `aws_s3_bucket_cors_configuration`
+resource and remove `cors_rule` and its nested arguments in the `aws_s3_bucket` resource:
+
+```terraform
+resource "aws_s3_bucket" "example" {
+  bucket = "yournamehere"
+
+  # ... other configuration ...
+}
+
+resource "aws_s3_bucket_cors_configuration" "example" {
+  bucket = aws_s3_bucket.example.id
+
+  cors_rule {
+    allowed_headers = ["*"]
+    allowed_methods = ["PUT", "POST"]
+    allowed_origins = ["https://s3-website-test.hashicorp.com"]
+    expose_headers  = ["ETag"]
+    max_age_seconds = 3000
+  }
+}
+```
+
+Run `terraform import` on each new resource, _e.g._,
+
+```console
+$ terraform import aws_s3_bucket_cors_configuration.example yournamehere
+aws_s3_bucket_cors_configuration.example: Importing from ID "yournamehere"...
+aws_s3_bucket_cors_configuration.example: Import prepared!
+  Prepared aws_s3_bucket_cors_configuration for import
+aws_s3_bucket_cors_configuration.example: Refreshing state... [id=yournamehere]
+
+Import successful!
+
+The resources that were imported are shown above. These resources are now in
+your Terraform state and will henceforth be managed by Terraform.
+```
+
+### `grant` Argument
+
+Switch your Terraform configuration to the [`aws_s3_bucket_acl` resource](/docs/providers/aws/r/s3_bucket_acl.html) instead.
+
+For example, given this previous configuration:
+
+```terraform
+resource "aws_s3_bucket" "example" {
+  bucket = "yournamehere"
+
+  # ... other configuration ...
+  grant {
+    id          = data.aws_canonical_user_id.current_user.id
+    type        = "CanonicalUser"
+    permissions = ["FULL_CONTROL"]
+  }
+
+  grant {
+    type        = "Group"
+    permissions = ["READ_ACP", "WRITE"]
+    uri         = "http://acs.amazonaws.com/groups/s3/LogDelivery"
+  }
+}
+```
+
+You will get the following error after upgrading:
+
+```
+│ Error: Value for unconfigurable attribute
+│
+│   with aws_s3_bucket.example,
+│   on main.tf line 1, in resource "aws_s3_bucket" "example":
+│    1: resource "aws_s3_bucket" "example" {
+│
+│ Can't configure a value for "grant": its value will be decided automatically based on the result of applying this configuration.
+```
+
+Since `grant` is now read only, update your configuration to use the `aws_s3_bucket_acl`
+resource and remove `grant` in the `aws_s3_bucket` resource:
+
+```terraform
+resource "aws_s3_bucket" "example" {
+  bucket = "yournamehere"
+
+  # ... other configuration ...
+}
+
+resource "aws_s3_bucket_acl" "example" {
+  bucket = aws_s3_bucket.example.id
+
+  access_control_policy {
+    grant {
+      grantee {
+        id   = data.aws_canonical_user_id.current_user.id
+        type = "CanonicalUser"
+      }
+      permission = "FULL_CONTROL"
+    }
+
+    grant {
+      grantee {
+        type = "Group"
+        uri  = "http://acs.amazonaws.com/groups/s3/LogDelivery"
+      }
+      permission = "READ_ACP"
+    }
+
+    grant {
+      grantee {
+        type = "Group"
+        uri  = "http://acs.amazonaws.com/groups/s3/LogDelivery"
+      }
+      permission = "WRITE"
+    }
+
+    owner {
+      id = data.aws_canonical_user_id.current_user.id
+    }
+  }
+}
+```
+
+Run `terraform import` on each new resource, _e.g._,
+
+```console
+$ terraform import aws_s3_bucket_acl.example yournamehere
+aws_s3_bucket_acl.example: Importing from ID "yournamehere"...
+aws_s3_bucket_acl.example: Import prepared!
+  Prepared aws_s3_bucket_acl for import
+aws_s3_bucket_acl.example: Refreshing state... [id=yournamehere]
+
+Import successful!
+
+The resources that were imported are shown above. These resources are now in
+your Terraform state and will henceforth be managed by Terraform.
+```
+
+### `lifecycle_rule` Argument
+
+Switch your Terraform configuration to the [`aws_s3_bucket_lifecycle_configuration` resource](/docs/providers/aws/r/s3_bucket_lifecycle_configuration.html) instead.
+
+#### For Lifecycle Rules with no `prefix` previously configured
+
+For example, given this previous configuration:
+
+```terraform
+resource "aws_s3_bucket" "example" {
+  bucket = "yournamehere"
+
+  lifecycle_rule {
+    id      = "Keep previous version 30 days, then in Glacier another 60"
+    enabled = true
+
+    noncurrent_version_transition {
+      days          = 30
+      storage_class = "GLACIER"
+    }
+
+    noncurrent_version_expiration {
+      days = 90
+    }
+  }
+
+  lifecycle_rule {
+    id                                     = "Delete old incomplete multi-part uploads"
+    enabled                                = true
+    abort_incomplete_multipart_upload_days = 7
+  }
+}
+```
+
+You will receive the following error after upgrading:
+
+```
+│ Error: Value for unconfigurable attribute
+│
+│   with aws_s3_bucket.example,
+│   on main.tf line 1, in resource "aws_s3_bucket" "example":
+│    1: resource "aws_s3_bucket" "example" {
+│
+│ Can't configure a value for "lifecycle_rule": its value will be decided automatically based on the result of applying this configuration.
+```
+
+Since the `lifecycle_rule` argument changed to read-only, update the configuration to use the `aws_s3_bucket_lifecycle_configuration`
+resource and remove `lifecycle_rule` and its nested arguments in the `aws_s3_bucket` resource.
+
+~> **Note:** When configuring the `rule.filter` configuration block in the new `aws_s3_bucket_lifecycle_configuration` resource, use the AWS CLI s3api [get-bucket-lifecycle-configuration](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/s3api/get-bucket-lifecycle-configuration.html)
+to get the source bucket's lifecycle configuration and determine if the `Filter` is configured as `"Filter" : {}` or `"Filter" : { "Prefix": "" }`.
+If AWS returns the former, configure `rule.filter` as `filter {}`. Otherwise, neither a `rule.filter` nor `rule.prefix` parameter should be configured as shown here:
+
+```terraform
+resource "aws_s3_bucket" "example" {
+  bucket = "yournamehere"
+
+  # ... other configuration ...
+}
+
+resource "aws_s3_bucket_lifecycle_configuration" "example" {
+  bucket = aws_s3_bucket.example.id
+
+  rule {
+    id     = "Keep previous version 30 days, then in Glacier another 60"
+    status = "Enabled"
+
+    noncurrent_version_transition {
+      noncurrent_days = 30
+      storage_class   = "GLACIER"
+    }
+
+    noncurrent_version_expiration {
+      noncurrent_days = 90
+    }
+  }
+
+  rule {
+    id     = "Delete old incomplete multi-part uploads"
+    status = "Enabled"
+
+    abort_incomplete_multipart_upload {
+      days_after_initiation = 7
+    }
+  }
+}
+```
+
+Run `terraform import` on each new resource, _e.g._,
+
+```console
+$ terraform import aws_s3_bucket_lifecycle_configuration.example yournamehere
+aws_s3_bucket_lifecycle_configuration.example: Importing from ID "yournamehere"...
+aws_s3_bucket_lifecycle_configuration.example: Import prepared!
+  Prepared aws_s3_bucket_lifecycle_configuration for import
+aws_s3_bucket_lifecycle_configuration.example: Refreshing state... [id=yournamehere]
+
+Import successful!
+
+The resources that were imported are shown above. These resources are now in
+your Terraform state and will henceforth be managed by Terraform.
+```
+
+#### For Lifecycle Rules with `prefix` previously configured as an empty string
+
+For example, given this configuration:
+
+```terraform
+resource "aws_s3_bucket" "example" {
+  bucket = "yournamehere"
+
+  lifecycle_rule {
+    id      = "log-expiration"
+    enabled = true
+    prefix  = ""
+
+    transition {
+      days          = 30
+      storage_class = "STANDARD_IA"
+    }
+
+    transition {
+      days          = 180
+      storage_class = "GLACIER"
+    }
+  }
+}
+```
+
+You will receive the following error after upgrading:
+
+```
+│ Error: Value for unconfigurable attribute
+│
+│   with aws_s3_bucket.example,
+│   on main.tf line 1, in resource "aws_s3_bucket" "example":
+│    1: resource "aws_s3_bucket" "example" {
+│
+│ Can't configure a value for "lifecycle_rule": its value will be decided automatically based on the result of applying this configuration.
+```
+
+Since the `lifecycle_rule` argument changed to read-only, update the configuration to use the `aws_s3_bucket_lifecycle_configuration`
+resource and remove `lifecycle_rule` and its nested arguments in the `aws_s3_bucket` resource:
+
+```terraform
+resource "aws_s3_bucket" "example" {
+  bucket = "yournamehere"
+
+  # ... other configuration ...
+}
+
+resource "aws_s3_bucket_lifecycle_configuration" "example" {
+  bucket = aws_s3_bucket.example.id
+
+  rule {
+    id     = "log-expiration"
+    status = "Enabled"
+
+    transition {
+      days          = 30
+      storage_class = "STANDARD_IA"
+    }
+
+    transition {
+      days          = 180
+      storage_class = "GLACIER"
+    }
+  }
+}
+```
+
+Run `terraform import` on each new resource, _e.g._,
+
+```console
+$ terraform import aws_s3_bucket_lifecycle_configuration.example yournamehere
+aws_s3_bucket_lifecycle_configuration.example: Importing from ID "yournamehere"...
+aws_s3_bucket_lifecycle_configuration.example: Import prepared!
+  Prepared aws_s3_bucket_lifecycle_configuration for import
+aws_s3_bucket_lifecycle_configuration.example: Refreshing state... [id=yournamehere]
+
+Import successful!
+
+The resources that were imported are shown above. These resources are now in
+your Terraform state and will henceforth be managed by Terraform.
+```
+
+#### For Lifecycle Rules with `prefix`
+
+For example, given this configuration:
+
+```terraform
+resource "aws_s3_bucket" "example" {
+  bucket = "yournamehere"
+
+  lifecycle_rule {
+    id      = "log-expiration"
+    enabled = true
+    prefix  = "foobar"
+
+    transition {
+      days          = 30
+      storage_class = "STANDARD_IA"
+    }
+
+    transition {
+      days          = 180
+      storage_class = "GLACIER"
+    }
+  }
+}
+```
+
+You will receive the following error after upgrading:
+
+```
+│ Error: Value for unconfigurable attribute
+│
+│   with aws_s3_bucket.example,
+│   on main.tf line 1, in resource "aws_s3_bucket" "example":
+│    1: resource "aws_s3_bucket" "example" {
+│
+│ Can't configure a value for "lifecycle_rule": its value will be decided automatically based on the result of applying this configuration.
+```
+
+Since the `lifecycle_rule` argument changed to read-only, update the configuration to use the `aws_s3_bucket_lifecycle_configuration`
+resource and remove `lifecycle_rule` and its nested arguments in the `aws_s3_bucket` resource:
+
+```terraform
+resource "aws_s3_bucket" "example" {
+  bucket = "yournamehere"
+
+  # ... other configuration ...
+}
+
+resource "aws_s3_bucket_lifecycle_configuration" "example" {
+  bucket = aws_s3_bucket.example.id
+
+  rule {
+    id     = "log-expiration"
+    status = "Enabled"
+
+    filter {
+      prefix = "foobar"
+    }
+
+    transition {
+      days          = 30
+      storage_class = "STANDARD_IA"
+    }
+
+    transition {
+      days          = 180
+      storage_class = "GLACIER"
+    }
+  }
+}
+```
+
+Run `terraform import` on each new resource, _e.g._,
+
+```console
+$ terraform import aws_s3_bucket_lifecycle_configuration.example yournamehere
+aws_s3_bucket_lifecycle_configuration.example: Importing from ID "yournamehere"...
+aws_s3_bucket_lifecycle_configuration.example: Import prepared!
+  Prepared aws_s3_bucket_lifecycle_configuration for import
+aws_s3_bucket_lifecycle_configuration.example: Refreshing state... [id=yournamehere]
+
+Import successful!
+
+The resources that were imported are shown above. These resources are now in
+your Terraform state and will henceforth be managed by Terraform.
+```
+
+#### For Lifecycle Rules with `prefix` and `tags`
+
+For example, given this previous configuration:
+
+```terraform
+resource "aws_s3_bucket" "example" {
+  bucket = "yournamehere"
+
+  # ... other configuration ...
+  lifecycle_rule {
+    id      = "log"
+    enabled = true
+    prefix  = "log/"
+
+    tags = {
+      rule      = "log"
+      autoclean = "true"
+    }
+
+    transition {
+      days          = 30
+      storage_class = "STANDARD_IA"
+    }
+
+    transition {
+      days          = 60
+      storage_class = "GLACIER"
+    }
+
+    expiration {
+      days = 90
+    }
+  }
+
+  lifecycle_rule {
+    id      = "tmp"
+    prefix  = "tmp/"
+    enabled = true
+
+    expiration {
+      date = "2022-12-31"
+    }
+  }
+}
+```
+
+You will get the following error after upgrading:
+
+```
+│ Error: Value for unconfigurable attribute
+│
+│   with aws_s3_bucket.example,
+│   on main.tf line 1, in resource "aws_s3_bucket" "example":
+│    1: resource "aws_s3_bucket" "example" {
+│
+│ Can't configure a value for "lifecycle_rule": its value will be decided automatically based on the result of applying this configuration.
+```
+
+Since `lifecycle_rule` is now read only, update your configuration to use the `aws_s3_bucket_lifecycle_configuration`
+resource and remove `lifecycle_rule` and its nested arguments in the `aws_s3_bucket` resource:
+
+```terraform
+resource "aws_s3_bucket" "example" {
+  bucket = "yournamehere"
+
+  # ... other configuration ...
+}
+
+resource "aws_s3_bucket_lifecycle_configuration" "example" {
+  bucket = aws_s3_bucket.example.id
+
+  rule {
+    id     = "log"
+    status = "Enabled"
+
+    filter {
+      and {
+        prefix = "log/"
+
+        tags = {
+          rule      = "log"
+          autoclean = "true"
+        }
+      }
+    }
+
+    transition {
+      days          = 30
+      storage_class = "STANDARD_IA"
+    }
+
+    transition {
+      days          = 60
+      storage_class = "GLACIER"
+    }
+
+    expiration {
+      days = 90
+    }
+  }
+
+  rule {
+    id = "tmp"
+
+    filter {
+      prefix = "tmp/"
+    }
+
+    expiration {
+      date = "2022-12-31T00:00:00Z"
+    }
+
+    status = "Enabled"
+  }
+}
+```
+
+Run `terraform import` on each new resource, _e.g._,
+
+```console
+$ terraform import aws_s3_bucket_lifecycle_configuration.example yournamehere
+aws_s3_bucket_lifecycle_configuration.example: Importing from ID "yournamehere"...
+aws_s3_bucket_lifecycle_configuration.example: Import prepared!
+  Prepared aws_s3_bucket_lifecycle_configuration for import
+aws_s3_bucket_lifecycle_configuration.example: Refreshing state... [id=yournamehere]
+
+Import successful!
+
+The resources that were imported are shown above. These resources are now in
+your Terraform state and will henceforth be managed by Terraform.
+```
+
+### `logging` Argument
+
+Switch your Terraform configuration to the [`aws_s3_bucket_logging` resource](/docs/providers/aws/r/s3_bucket_logging.html) instead.
+
+For example, given this previous configuration:
+
+```terraform
+resource "aws_s3_bucket" "log_bucket" {
+  # ... other configuration ...
+  bucket = "example-log-bucket"
+}
+
+resource "aws_s3_bucket" "example" {
+  bucket = "yournamehere"
+
+  # ... other configuration ...
+  logging {
+    target_bucket = aws_s3_bucket.log_bucket.id
+    target_prefix = "log/"
+  }
+}
+```
+
+You will get the following error after upgrading:
+
+```
+│ Error: Value for unconfigurable attribute
+│
+│   with aws_s3_bucket.example,
+│   on main.tf line 1, in resource "aws_s3_bucket" "example":
+│    1: resource "aws_s3_bucket" "example" {
+│
+│ Can't configure a value for "logging": its value will be decided automatically based on the result of applying this configuration.
+```
+
+Since `logging` is now read only, update your configuration to use the `aws_s3_bucket_logging`
+resource and remove `logging` and its nested arguments in the `aws_s3_bucket` resource:
+
+```terraform
+resource "aws_s3_bucket" "log_bucket" {
+  bucket = "example-log-bucket"
+
+  # ... other configuration ...
+}
+
+resource "aws_s3_bucket" "example" {
+  bucket = "yournamehere"
+
+  # ... other configuration ...
+}
+
+resource "aws_s3_bucket_logging" "example" {
+  bucket        = aws_s3_bucket.example.id
+  target_bucket = aws_s3_bucket.log_bucket.id
+  target_prefix = "log/"
+}
+```
+
+Run `terraform import` on each new resource, _e.g._,
+
+```console
+$ terraform import aws_s3_bucket_logging.example yournamehere
+aws_s3_bucket_logging.example: Importing from ID "yournamehere"...
+aws_s3_bucket_logging.example: Import prepared!
+  Prepared aws_s3_bucket_logging for import
+aws_s3_bucket_logging.example: Refreshing state... [id=yournamehere]
+
+Import successful!
+
+The resources that were imported are shown above. These resources are now in
+your Terraform state and will henceforth be managed by Terraform.
+```
+
+### `object_lock_configuration` `rule` Argument
+
+Switch your Terraform configuration to the [`aws_s3_bucket_object_lock_configuration` resource](/docs/providers/aws/r/s3_bucket_object_lock_configuration.html) instead.
+
+For example, given this previous configuration:
+
+```terraform
+resource "aws_s3_bucket" "example" {
+  bucket = "yournamehere"
+
+  # ... other configuration ...
+  object_lock_configuration {
+    object_lock_enabled = "Enabled"
+
+    rule {
+      default_retention {
+        mode = "COMPLIANCE"
+        days = 3
+      }
+    }
+  }
+}
+```
+
+You will get the following error after upgrading:
+
+```
+│ Error: Value for unconfigurable attribute
+│
+│   with aws_s3_bucket.example,
+│   on main.tf line 1, in resource "aws_s3_bucket" "example":
+│    1: resource "aws_s3_bucket" "example" {
+│
+│ Can't configure a value for "object_lock_configuration.0.rule": its value will be decided automatically based on the result of applying this configuration.
+```
+
+Since the `rule` argument of the `object_lock_configuration` configuration block changed to read-only, update your configuration to use the `aws_s3_bucket_object_lock_configuration`
+resource and remove `rule` and its nested arguments in the `aws_s3_bucket` resource:
+
+```terraform
+resource "aws_s3_bucket" "example" {
+  bucket = "yournamehere"
+
+  # ... other configuration ...
+  object_lock_enabled = true
+}
+
+resource "aws_s3_bucket_object_lock_configuration" "example" {
+  bucket = aws_s3_bucket.example.id
+
+  rule {
+    default_retention {
+      mode = "COMPLIANCE"
+      days = 3
+    }
+  }
+}
+```
+
+Run `terraform import` on each new resource, _e.g._,
+
+```console
+$ terraform import aws_s3_bucket_object_lock_configuration.example yournamehere
+aws_s3_bucket_object_lock_configuration.example: Importing from ID "yournamehere"...
+aws_s3_bucket_object_lock_configuration.example: Import prepared!
+  Prepared aws_s3_bucket_object_lock_configuration for import
+aws_s3_bucket_object_lock_configuration.example: Refreshing state... [id=yournamehere]
+
+Import successful!
+
+The resources that were imported are shown above. These resources are now in
+your Terraform state and will henceforth be managed by Terraform.
+```
+
+### `policy` Argument
+
+Switch your Terraform configuration to the [`aws_s3_bucket_policy` resource](/docs/providers/aws/r/s3_bucket_policy.html) instead.
+
+For example, given this previous configuration:
+
+```terraform
+resource "aws_s3_bucket" "example" {
+  bucket = "yournamehere"
+
+  # ... other configuration ...
+  policy = <<EOF
+{
+  "Id": "Policy1446577137248",
+  "Statement": [
+    {
+      "Action": "s3:PutObject",
+      "Effect": "Allow",
+      "Principal": {
+        "AWS": "${data.aws_elb_service_account.current.arn}"
+      },
+      "Resource": "arn:${data.aws_partition.current.partition}:s3:::yournamehere/*",
+      "Sid": "Stmt1446575236270"
+    }
+  ],
+  "Version": "2012-10-17"
+}
+EOF
+}
+```
+
+You will get the following error after upgrading:
+
+```
+│ Error: Value for unconfigurable attribute
+│
+│   with aws_s3_bucket.example,
+│   on main.tf line 1, in resource "aws_s3_bucket" "example":
+│    1: resource "aws_s3_bucket" "example" {
+│
+│ Can't configure a value for "policy": its value will be decided automatically based on the result of applying this configuration.
+```
+
+Since `policy` is now read only, update your configuration to use the `aws_s3_bucket_policy`
+resource and remove `policy` in the `aws_s3_bucket` resource:
+
+```terraform
+resource "aws_s3_bucket" "example" {
+  bucket = "yournamehere"
+
+  # ... other configuration ...
+}
+
+resource "aws_s3_bucket_policy" "example" {
+  bucket = aws_s3_bucket.example.id
+  policy = <<EOF
+{
+  "Id": "Policy1446577137248",
+  "Statement": [
+    {
+      "Action": "s3:PutObject",
+      "Effect": "Allow",
+      "Principal": {
+        "AWS": "${data.aws_elb_service_account.current.arn}"
+      },
+      "Resource": "${aws_s3_bucket.example.arn}/*",
+      "Sid": "Stmt1446575236270"
+    }
+  ],
+  "Version": "2012-10-17"
+}
+EOF
+}
+```
+
+Run `terraform import` on each new resource, _e.g._,
+
+```console
+$ terraform import aws_s3_bucket_policy.example yournamehere
+aws_s3_bucket_policy.example: Importing from ID "yournamehere"...
+aws_s3_bucket_policy.example: Import prepared!
+  Prepared aws_s3_bucket_policy for import
+aws_s3_bucket_policy.example: Refreshing state... [id=yournamehere]
+
+Import successful!
+
+The resources that were imported are shown above. These resources are now in
+your Terraform state and will henceforth be managed by Terraform.
+```
+
+### `replication_configuration` Argument
+
+Switch your Terraform configuration to the [`aws_s3_bucket_replication_configuration` resource](/docs/providers/aws/r/s3_bucket_replication_configuration.html) instead.
+
+For example, given this previous configuration:
+
+```terraform
+resource "aws_s3_bucket" "example" {
+  provider = aws.central
+  bucket   = "yournamehere"
+
+  # ... other configuration ...
+
+  replication_configuration {
+    role = aws_iam_role.replication.arn
+    rules {
+      id     = "foobar"
+      status = "Enabled"
+      filter {
+        tags = {}
+      }
+      destination {
+        bucket        = aws_s3_bucket.destination.arn
+        storage_class = "STANDARD"
+        replication_time {
+          status  = "Enabled"
+          minutes = 15
+        }
+        metrics {
+          status  = "Enabled"
+          minutes = 15
+        }
+      }
+    }
+  }
+}
+```
+
+You will get the following error after upgrading:
+
+```
+│ Error: Value for unconfigurable attribute
+│
+│   with aws_s3_bucket.example,
+│   on main.tf line 1, in resource "aws_s3_bucket" "example":
+│    1: resource "aws_s3_bucket" "example" {
+│
+│ Can't configure a value for "replication_configuration": its value will be decided automatically based on the result of applying this configuration.
+```
+
+Since `replication_configuration` is now read only, update your configuration to use the `aws_s3_bucket_replication_configuration`
+resource and remove `replication_configuration` and its nested arguments in the `aws_s3_bucket` resource:
+
+```terraform
+resource "aws_s3_bucket" "example" {
+  provider = aws.central
+  bucket   = "yournamehere"
+
+  # ... other configuration ...
+}
+
+resource "aws_s3_bucket_replication_configuration" "example" {
+  bucket = aws_s3_bucket.example.id
+  role   = aws_iam_role.replication.arn
+
+  rule {
+    id     = "foobar"
+    status = "Enabled"
+
+    filter {}
+
+    delete_marker_replication {
+      status = "Enabled"
+    }
+
+    destination {
+      bucket        = aws_s3_bucket.destination.arn
+      storage_class = "STANDARD"
+
+      replication_time {
+        status = "Enabled"
+        time {
+          minutes = 15
+        }
+      }
+
+      metrics {
+        status = "Enabled"
+        event_threshold {
+          minutes = 15
+        }
+      }
+    }
+  }
+}
+```
+
+Run `terraform import` on each new resource, _e.g._,
+
+```console
+$ terraform import aws_s3_bucket_replication_configuration.example yournamehere
+aws_s3_bucket_replication_configuration.example: Importing from ID "yournamehere"...
+aws_s3_bucket_replication_configuration.example: Import prepared!
+  Prepared aws_s3_bucket_replication_configuration for import
+aws_s3_bucket_replication_configuration.example: Refreshing state... [id=yournamehere]
+
+Import successful!
+
+The resources that were imported are shown above. These resources are now in
+your Terraform state and will henceforth be managed by Terraform.
+```
+
+### `request_payer` Argument
+
+Switch your Terraform configuration to the [`aws_s3_bucket_request_payment_configuration` resource](/docs/providers/aws/r/s3_bucket_request_payment_configuration.html) instead.
+
+For example, given this previous configuration:
+
+```terraform
+resource "aws_s3_bucket" "example" {
+  bucket = "yournamehere"
+
+  # ... other configuration ...
+  request_payer = "Requester"
+}
+```
+
+You will get the following error after upgrading:
+
+```
+│ Error: Value for unconfigurable attribute
+│
+│   with aws_s3_bucket.example,
+│   on main.tf line 1, in resource "aws_s3_bucket" "example":
+│    1: resource "aws_s3_bucket" "example" {
+│
+│ Can't configure a value for "request_payer": its value will be decided automatically based on the result of applying this configuration.
+```
+
+Since `request_payer` is now read only, update your configuration to use the `aws_s3_bucket_request_payment_configuration`
+resource and remove `request_payer` in the `aws_s3_bucket` resource:
+
+```terraform
+resource "aws_s3_bucket" "example" {
+  bucket = "yournamehere"
+
+  # ... other configuration ...
+}
+
+resource "aws_s3_bucket_request_payment_configuration" "example" {
+  bucket = aws_s3_bucket.example.id
+  payer  = "Requester"
+}
+```
+
+Run `terraform import` on each new resource, _e.g._,
+
+```console
+$ terraform import aws_s3_bucket_request_payment_configuration.example yournamehere
+aws_s3_bucket_request_payment_configuration.example: Importing from ID "yournamehere"...
+aws_s3_bucket_request_payment_configuration.example: Import prepared!
+  Prepared aws_s3_bucket_request_payment_configuration for import
+aws_s3_bucket_request_payment_configuration.example: Refreshing state... [id=yournamehere]
+
+Import successful!
+
+The resources that were imported are shown above. These resources are now in
+your Terraform state and will henceforth be managed by Terraform.
+```
+
+### `server_side_encryption_configuration` Argument
+
+Switch your Terraform configuration to the [`aws_s3_bucket_server_side_encryption_configuration` resource](/docs/providers/aws/r/s3_bucket_server_side_encryption_configuration.html) instead.
+
+For example, given this previous configuration:
+
+```terraform
+resource "aws_s3_bucket" "example" {
+  bucket = "yournamehere"
+
+  # ... other configuration ...
+  server_side_encryption_configuration {
+    rule {
+      apply_server_side_encryption_by_default {
+        kms_master_key_id = aws_kms_key.mykey.arn
+        sse_algorithm     = "aws:kms"
+      }
+    }
+  }
+}
+```
+
+You will get the following error after upgrading:
+
+```
+│ Error: Value for unconfigurable attribute
+│
+│   with aws_s3_bucket.example,
+│   on main.tf line 1, in resource "aws_s3_bucket" "example":
+│    1: resource "aws_s3_bucket" "example" {
+│
+│ Can't configure a value for "server_side_encryption_configuration": its value will be decided automatically based on the result of applying this configuration.
+```
+
+Since `server_side_encryption_configuration` is now read only, update your configuration to use the `aws_s3_bucket_server_side_encryption_configuration`
+resource and remove `server_side_encryption_configuration` and its nested arguments in the `aws_s3_bucket` resource:
+
+```terraform
+resource "aws_s3_bucket" "example" {
+  bucket = "yournamehere"
+
+  # ... other configuration ...
+}
+
+resource "aws_s3_bucket_server_side_encryption_configuration" "example" {
+  bucket = aws_s3_bucket.example.id
+
+  rule {
+    apply_server_side_encryption_by_default {
+      kms_master_key_id = aws_kms_key.mykey.arn
+      sse_algorithm     = "aws:kms"
+    }
+  }
+}
+```
+
+Run `terraform import` on each new resource, _e.g._,
+
+```console
+$ terraform import aws_s3_bucket_server_side_encryption_configuration.example yournamehere
+aws_s3_bucket_server_side_encryption_configuration.example: Importing from ID "yournamehere"...
+aws_s3_bucket_server_side_encryption_configuration.example: Import prepared!
+  Prepared aws_s3_bucket_server_side_encryption_configuration for import
+aws_s3_bucket_server_side_encryption_configuration.example: Refreshing state... [id=yournamehere]
+
+Import successful!
+
+The resources that were imported are shown above. These resources are now in
+your Terraform state and will henceforth be managed by Terraform.
+```
+
+### `versioning` Argument
+
+Switch your Terraform configuration to the [`aws_s3_bucket_versioning` resource](/docs/providers/aws/r/s3_bucket_versioning.html) instead.
+
+~> **NOTE:** As `aws_s3_bucket_versioning` is a separate resource, any S3 objects for which versioning is important (_e.g._, a truststore for mutual TLS authentication) must implicitly or explicitly depend on the `aws_s3_bucket_versioning` resource. Otherwise, the S3 objects may be created before versioning has been set. [See below](#ensure-objects-depend-on-versioning) for an example. Also note that AWS recommends waiting 15 minutes after enabling versioning on a bucket before putting or deleting objects in/from the bucket.
+
+#### Buckets With Versioning Enabled
+
+Given this previous configuration:
+
+```terraform
+resource "aws_s3_bucket" "example" {
+  bucket = "yournamehere"
+
+  # ... other configuration ...
+  versioning {
+    enabled = true
+  }
+}
+```
+
+You will get the following error after upgrading:
+
+```
+│ Error: Value for unconfigurable attribute
+│
+│   with aws_s3_bucket.example,
+│   on main.tf line 1, in resource "aws_s3_bucket" "example":
+│    1: resource "aws_s3_bucket" "example" {
+│
+│ Can't configure a value for "versioning": its value will be decided automatically based on the result of applying this configuration.
+```
+
+Since `versioning` is now read only, update your configuration to use the `aws_s3_bucket_versioning`
+resource and remove `versioning` and its nested arguments in the `aws_s3_bucket` resource:
+
+```terraform
+resource "aws_s3_bucket" "example" {
+  bucket = "yournamehere"
+
+  # ... other configuration ...
+}
+
+resource "aws_s3_bucket_versioning" "example" {
+  bucket = aws_s3_bucket.example.id
+  versioning_configuration {
+    status = "Enabled"
+  }
+}
+```
+
+Run `terraform import` on each new resource, _e.g._,
+
+```console
+$ terraform import aws_s3_bucket_versioning.example yournamehere
+aws_s3_bucket_versioning.example: Importing from ID "yournamehere"...
+aws_s3_bucket_versioning.example: Import prepared!
+  Prepared aws_s3_bucket_versioning for import
+aws_s3_bucket_versioning.example: Refreshing state... [id=yournamehere]
+
+Import successful!
+
+The resources that were imported are shown above. These resources are now in
+your Terraform state and will henceforth be managed by Terraform.
+```
+
+#### Buckets With Versioning Disabled or Suspended
+
+Depending on the version of the Terraform AWS Provider you are migrating from, the interpretation of `versioning.enabled = false`
+in your `aws_s3_bucket` resource will differ and thus the migration to the `aws_s3_bucket_versioning` resource will also differ as follows.
+
+If you are migrating from the Terraform AWS Provider `v3.70.0` or later:
+
+* For new S3 buckets, `enabled = false` is synonymous to `Disabled`.
+* For existing S3 buckets, `enabled = false` is synonymous to `Suspended`.
+
+If you are migrating from an earlier version of the Terraform AWS Provider:
+
+* For both new and existing S3 buckets, `enabled = false` is synonymous to `Suspended`.
+
+Given this previous configuration :
+
+```terraform
+resource "aws_s3_bucket" "example" {
+  bucket = "yournamehere"
+
+  # ... other configuration ...
+  versioning {
+    enabled = false
+  }
+}
+```
+
+You will get the following error after upgrading:
+
+```
+│ Error: Value for unconfigurable attribute
+│
+│   with aws_s3_bucket.example,
+│   on main.tf line 1, in resource "aws_s3_bucket" "example":
+│    1: resource "aws_s3_bucket" "example" {
+│
+│ Can't configure a value for "versioning": its value will be decided automatically based on the result of applying this configuration.
+```
+
+Since `versioning` is now read only, update your configuration to use the `aws_s3_bucket_versioning`
+resource and remove `versioning` and its nested arguments in the `aws_s3_bucket` resource.
+
+* If migrating from Terraform AWS Provider `v3.70.0` or later and bucket versioning was never enabled:
+
+  ```terraform
+  resource "aws_s3_bucket" "example" {
+    bucket = "yournamehere"
+  
+    # ... other configuration ...
+  }
+  
+  resource "aws_s3_bucket_versioning" "example" {
+    bucket = aws_s3_bucket.example.id
+    versioning_configuration {
+      status = "Disabled"
+    }
+  }
+  ```
+
+* If migrating from Terraform AWS Provider `v3.70.0` or later and bucket versioning was enabled at one point:
+
+  ```terraform
+  resource "aws_s3_bucket" "example" {
+    bucket = "yournamehere"
+  
+    # ... other configuration ...
+  }
+  
+  resource "aws_s3_bucket_versioning" "example" {
+    bucket = aws_s3_bucket.example.id
+    versioning_configuration {
+      status = "Suspended"
+    }
+  }
+  ```
+
+* If migrating from an earlier version of Terraform AWS Provider:
+
+  ```terraform
+  resource "aws_s3_bucket" "example" {
+    bucket = "yournamehere"
+  
+    # ... other configuration ...
+  }
+  
+  resource "aws_s3_bucket_versioning" "example" {
+    bucket = aws_s3_bucket.example.id
+    versioning_configuration {
+      status = "Suspended"
+    }
+  }
+  ```
+
+Run `terraform import` on each new resource, _e.g._,
+
+```console
+$ terraform import aws_s3_bucket_versioning.example yournamehere
+aws_s3_bucket_versioning.example: Importing from ID "yournamehere"...
+aws_s3_bucket_versioning.example: Import prepared!
+  Prepared aws_s3_bucket_versioning for import
+aws_s3_bucket_versioning.example: Refreshing state... [id=yournamehere]
+
+Import successful!
+
+The resources that were imported are shown above. These resources are now in
+your Terraform state and will henceforth be managed by Terraform.
+```
+
+#### Ensure Objects Depend on Versioning
+
+When you create an object whose `version_id` you need and an `aws_s3_bucket_versioning` resource in the same configuration, you are more likely to have success by ensuring the `s3_object` depends either implicitly (see below) or explicitly (i.e., using `depends_on = [aws_s3_bucket_versioning.example]`) on the `aws_s3_bucket_versioning` resource.
+
+~> **NOTE:** For critical and/or production S3 objects, do not create a bucket, enable versioning, and create an object in the bucket within the same configuration. Doing so will not allow the AWS-recommended 15 minutes between enabling versioning and writing to the bucket.
+
+This example shows the `aws_s3_object.example` depending implicitly on the versioning resource through the reference to `aws_s3_bucket_versioning.example.bucket` to define `bucket`:
+
+```terraform
+resource "aws_s3_bucket" "example" {
+  bucket = "yotto"
+}
+
+resource "aws_s3_bucket_versioning" "example" {
+  bucket = aws_s3_bucket.example.id
+
+  versioning_configuration {
+    status = "Enabled"
+  }
+}
+
+resource "aws_s3_object" "example" {
+  bucket = aws_s3_bucket_versioning.example.id
+  key    = "droeloe"
+  source = "example.txt"
+}
+```
+
+### `website`, `website_domain`, and `website_endpoint` Arguments
+
+Switch your Terraform configuration to the [`aws_s3_bucket_website_configuration` resource](/docs/providers/aws/r/s3_bucket_website_configuration.html) instead.
+
+For example, given this previous configuration:
+
+```terraform
+resource "aws_s3_bucket" "example" {
+  bucket = "yournamehere"
+
+  # ... other configuration ...
+  website {
+    index_document = "index.html"
+    error_document = "error.html"
+  }
+}
+```
+
+You will get the following error after upgrading:
+
+```
+│ Error: Value for unconfigurable attribute
+│
+│   with aws_s3_bucket.example,
+│   on main.tf line 1, in resource "aws_s3_bucket" "example":
+│    1: resource "aws_s3_bucket" "example" {
+│
+│ Can't configure a value for "website": its value will be decided automatically based on the result of applying this configuration.
+```
+
+Since `website` is now read only, update your configuration to use the `aws_s3_bucket_website_configuration`
+resource and remove `website` and its nested arguments in the `aws_s3_bucket` resource:
+
+```terraform
+resource "aws_s3_bucket" "example" {
+  bucket = "yournamehere"
+
+  # ... other configuration ...
+}
+
+resource "aws_s3_bucket_website_configuration" "example" {
+  bucket = aws_s3_bucket.example.id
+
+  index_document {
+    suffix = "index.html"
+  }
+
+  error_document {
+    key = "error.html"
+  }
+}
+```
+
+Run `terraform import` on each new resource, _e.g._,
+
+```console
+$ terraform import aws_s3_bucket_website_configuration.example yournamehere
+aws_s3_bucket_website_configuration.example: Importing from ID "yournamehere"...
+aws_s3_bucket_website_configuration.example: Import prepared!
+  Prepared aws_s3_bucket_website_configuration for import
+aws_s3_bucket_website_configuration.example: Refreshing state... [id=yournamehere]
+
+Import successful!
+
+The resources that were imported are shown above. These resources are now in
+your Terraform state and will henceforth be managed by Terraform.
+```
+
+For example, if you use the `aws_s3_bucket` attribute `website_domain` with `aws_route53_record`, as shown below, you will need to update your configuration:
+
+```terraform
+resource "aws_route53_zone" "main" {
+  name = "domain.test"
+}
+
+resource "aws_s3_bucket" "website" {
+  # ... other configuration ...
+  website {
+    index_document = "index.html"
+    error_document = "error.html"
+  }
+}
+
+resource "aws_route53_record" "alias" {
+  zone_id = aws_route53_zone.main.zone_id
+  name    = "www"
+  type    = "A"
+
+  alias {
+    zone_id                = aws_s3_bucket.website.hosted_zone_id
+    name                   = aws_s3_bucket.website.website_domain
+    evaluate_target_health = true
+  }
+}
+```
+
+Instead, you will now use the `aws_s3_bucket_website_configuration` resource and its `website_domain` attribute:
+
+```terraform
+resource "aws_route53_zone" "main" {
+  name = "domain.test"
+}
+
+resource "aws_s3_bucket" "website" {
+  # ... other configuration ...
+}
+
+resource "aws_s3_bucket_website_configuration" "example" {
+  bucket = aws_s3_bucket.website.id
+
+  index_document {
+    suffix = "index.html"
+  }
+}
+
+resource "aws_route53_record" "alias" {
+  zone_id = aws_route53_zone.main.zone_id
+  name    = "www"
+  type    = "A"
+
+  alias {
+    zone_id                = aws_s3_bucket.website.hosted_zone_id
+    name                   = aws_s3_bucket_website_configuration.example.website_domain
+    evaluate_target_health = true
+  }
+}
+```
+
+## Full Resource Lifecycle of Default Resources
+
+Default subnets and vpcs can now do full resource lifecycle operations such that resource
+creation and deletion are now supported.
+
+### Resource: aws_default_subnet
+
+The `aws_default_subnet` resource behaves differently from normal resources in that if a default subnet exists in the specified Availability Zone, Terraform does not _create_ this resource, but instead "adopts" it into management.
+If no default subnet exists, Terraform creates a new default subnet.
+By default, `terraform destroy` does not delete the default subnet but does remove the resource from Terraform state.
+Set the `force_destroy` argument to `true` to delete the default subnet.
+
+For example, given this previous configuration with no existing default subnet:
+
+```terraform
+terraform {
+  required_providers {
+    aws = {
+      source = "hashicorp/aws"
+    }
+  }
+  required_version = ">= 0.13"
+}
+
+provider "aws" {
+  region = "eu-west-2"
+}
+
+resource "aws_default_subnet" "default" {}
+```
+
+The following error was thrown on `terraform apply`:
+
+```
+│ Error: Default subnet not found.
+│
+│   with aws_default_subnet.default,
+│   on main.tf line 5, in resource "aws_default_subnet" "default":
+│    5: resource "aws_default_subnet" "default" {}
+```
+
+Now after upgrading, the above configuration will apply successfully.
+
+To delete the default subnet, the above configuration should be updated as follows:
+
+```terraform
+terraform {
+  required_providers {
+    aws = {
+      source = "hashicorp/aws"
+    }
+  }
+  required_version = ">= 0.13"
+}
+
+resource "aws_default_subnet" "default" {
+  force_destroy = true
+}
+```
+
+### Resource: aws_default_vpc
+
+The `aws_default_vpc` resource behaves differently from normal resources in that if a default VPC exists, Terraform does not _create_ this resource, but instead "adopts" it into management.
+If no default VPC exists, Terraform creates a new default VPC, which leads to the implicit creation of [other resources](https://docs.aws.amazon.com/vpc/latest/userguide/default-vpc.html#default-vpc-components).
+By default, `terraform destroy` does not delete the default VPC but does remove the resource from Terraform state.
+Set the `force_destroy` argument to `true` to delete the default VPC.
+
+For example, given this previous configuration with no existing default VPC:
+
+```terraform
+terraform {
+  required_providers {
+    aws = {
+      source = "hashicorp/aws"
+    }
+  }
+  required_version = ">= 0.13"
+}
+
+resource "aws_default_vpc" "default" {}
+```
+
+The following error was thrown on `terraform apply`:
+
+```
+│ Error: No default VPC found in this region.
+│
+│   with aws_default_vpc.default,
+│   on main.tf line 5, in resource "aws_default_vpc" "default":
+│    5: resource "aws_default_vpc" "default" {}
+```
+
+Now after upgrading, the above configuration will apply successfully.
+
+To delete the default VPC, the above configuration should be updated to:
+
+```terraform
+terraform {
+  required_providers {
+    aws = {
+      source = "hashicorp/aws"
+    }
+  }
+  required_version = ">= 0.13"
+}
+
+resource "aws_default_vpc" "default" {
+  force_destroy = true
+}
+```
+
+## Plural Data Source Behavior
+
+The following plural data sources are now consistent with [Provider Design](https://hashicorp.github.io/terraform-provider-aws/provider-design/#plural-data-sources)
+such that they no longer return an error if zero results are found.
+
+* [aws_cognito_user_pools](/docs/providers/aws/d/cognito_user_pools.html)
+* [aws_db_event_categories](/docs/providers/aws/d/db_event_categories.html)
+* [aws_ebs_volumes](/docs/providers/aws/d/ebs_volumes.html)
+* [aws_ec2_coip_pools](/docs/providers/aws/d/ec2_coip_pools.html)
+* [aws_ec2_local_gateway_route_tables](/docs/providers/aws/d/ec2_local_gateway_route_tables.html)
+* [aws_ec2_local_gateway_virtual_interface_groups](/docs/providers/aws/d/ec2_local_gateway_virtual_interface_groups.html)
+* [aws_ec2_local_gateways](/docs/providers/aws/d/ec2_local_gateways.html)
+* [aws_ec2_transit_gateway_route_tables](/docs/providers/aws/d/ec2_transit_gateway_route_tables.html)
+* [aws_efs_access_points](/docs/providers/aws/d/efs_access_points.html)
+* [aws_emr_release_labels](/docs/providers/aws/d/emr_release_labels.html)
+* [aws_inspector_rules_packages](/docs/providers/aws/d/inspector_rules_packages.html)
+* [aws_ip_ranges](/docs/providers/aws/d/ip_ranges.html)
+* [aws_network_acls](/docs/providers/aws/d/network_acls.html)
+* [aws_route_tables](/docs/providers/aws/d/route_tables.html)
+* [aws_security_groups](/docs/providers/aws/d/security_groups.html)
+* [aws_ssoadmin_instances](/docs/providers/aws/d/ssoadmin_instances.html)
+* [aws_vpcs](/docs/providers/aws/d/vpcs.html)
+* [aws_vpc_peering_connections](/docs/providers/aws/d/vpc_peering_connections.html)
+
+## Empty Strings Not Valid For Certain Resources
+
+First, this is a breaking change but should affect very few configurations.
+
+Second, the motivation behind this change is that previously, you might set an argument to `""` to explicitly convey it is empty. However, with the introduction of `null` in Terraform 0.12 and to prepare for continuing enhancements that distinguish between unset arguments and those that have a value, including an empty string (`""`), we are moving away from this use of zero values. We ask practitioners to either use `null` instead or remove the arguments that are set to `""`.
+
+### Resource: aws_cloudwatch_event_target (Empty String)
+
+Previously, you could set `ecs_target.0.launch_type` to `""`. However, the value `""` is no longer valid. Now, set the argument to `null` (_e.g._, `launch_type = null`) or remove the empty-string configuration.
+
+For example, this type of configuration is now not valid:
+
+```terraform
+resource "aws_cloudwatch_event_target" "example" {
+  # ...
+  ecs_target {
+    task_count          = 1
+    task_definition_arn = aws_ecs_task_definition.task.arn
+    launch_type         = ""
+    # ...
+  }
+}
+```
+
+We fix this configuration by setting `launch_type` to `null`:
+
+```terraform
+resource "aws_cloudwatch_event_target" "example" {
+  # ...
+  ecs_target {
+    task_count          = 1
+    task_definition_arn = aws_ecs_task_definition.task.arn
+    launch_type         = null
+    # ...
+  }
+}
+```
+
+### Resource: aws_customer_gateway
+
+Previously, you could set `ip_address` to `""`, which would result in an AWS error. However, the provider now also gives an error.
+
+### Resource: aws_default_network_acl
+
+Previously, you could set `egress.*.cidr_block`, `egress.*.ipv6_cidr_block`, `ingress.*.cidr_block`, or `ingress.*.ipv6_cidr_block` to `""`. However, the value `""` is no longer valid. Now, set the argument to `null` (_e.g._, `ipv6_cidr_block = null`) or remove the empty-string configuration.
+
+For example, this type of configuration is now not valid:
+
+```terraform
+resource "aws_default_network_acl" "example" {
+  # ...
+  egress {
+    cidr_block      = "0.0.0.0/0"
+    ipv6_cidr_block = ""
+    # ...
+  }
+}
+```
+
+To fix this configuration, we remove the empty-string configuration:
+
+```terraform
+resource "aws_default_network_acl" "example" {
+  # ...
+  egress {
+    cidr_block = "0.0.0.0/0"
+    # ...
+  }
+}
+```
+
+### Resource: aws_default_route_table
+
+Previously, you could set `route.*.cidr_block` or `route.*.ipv6_cidr_block` to `""`. However, the value `""` is no longer valid. Now, set the argument to `null` (_e.g._, `ipv6_cidr_block = null`) or remove the empty-string configuration.
+
+For example, this type of configuration is now not valid:
+
+```terraform
+resource "aws_default_route_table" "example" {
+  # ...
+  route {
+    cidr_block      = local.ipv6 ? "" : local.destination
+    ipv6_cidr_block = local.ipv6 ? local.destination_ipv6 : ""
+  }
+}
+```
+
+We fix this configuration by using `null` instead of an empty string (`""`):
+
+```terraform
+resource "aws_default_route_table" "example" {
+  # ...
+  route {
+    cidr_block      = local.ipv6 ? null : local.destination
+    ipv6_cidr_block = local.ipv6 ? local.destination_ipv6 : null
+  }
+}
+```
+
+### Resource: aws_default_vpc (Empty String)
+
+Previously, you could set `ipv6_cidr_block` to `""`. However, the value `""` is no longer valid. Now, set the argument to `null` (_e.g._, `ipv6_cidr_block = null`) or remove the empty-string configuration.
+
+### Resource: aws_instance
+
+Previously, you could set `private_ip` to `""`. However, the value `""` is no longer valid. Now, set the argument to `null` (_e.g._, `private_ip = null`) or remove the empty-string configuration.
+
+For example, this type of configuration is now not valid:
+
+```terraform
+resource "aws_instance" "example" {
+  instance_type = "t2.micro"
+  private_ip    = ""
+}
+```
+
+We fix this configuration by removing the empty-string configuration:
+
+```terraform
+resource "aws_instance" "example" {
+  instance_type = "t2.micro"
+}
+```
+
+### Resource: aws_efs_mount_target
+
+Previously, you could set `ip_address` to `""`. However, the value `""` is no longer valid. Now, set the argument to `null` (_e.g._, `ip_address = null`) or remove the empty-string configuration.
+
+For example, this type of configuration is now not valid: `ip_address = ""`.
+
+### Resource: aws_elasticsearch_domain
+
+Previously, you could set `ebs_options.0.volume_type` to `""`. However, the value `""` is no longer valid. Now, set the argument to `null` (_e.g._, `volume_type = null`) or remove the empty-string configuration.
+
+For example, this type of configuration is now not valid:
+
+```terraform
+resource "aws_elasticsearch_domain" "example" {
+  # ...
+  ebs_options {
+    ebs_enabled = true
+    volume_size = var.volume_size
+    volume_type = var.volume_size > 0 ? local.volume_type : ""
+  }
+}
+```
+
+We fix this configuration by using `null` instead of `""`:
+
+```terraform
+resource "aws_elasticsearch_domain" "example" {
+  # ...
+  ebs_options {
+    ebs_enabled = true
+    volume_size = var.volume_size
+    volume_type = var.volume_size > 0 ? local.volume_type : null
+  }
+}
+```
+
+### Resource: aws_network_acl
+
+Previously, `egress.*.cidr_block`, `egress.*.ipv6_cidr_block`, `ingress.*.cidr_block`, and `ingress.*.ipv6_cidr_block` could be set to `""`. However, the value `""` is no longer valid. Now, set the argument to `null` (_e.g._, `ipv6_cidr_block = null`) or remove the empty-string configuration.
+
+For example, this type of configuration is now not valid:
+
+```terraform
+resource "aws_network_acl" "example" {
+  # ...
+  egress {
+    cidr_block      = "0.0.0.0/0"
+    ipv6_cidr_block = ""
+    # ...
+  }
+}
+```
+
+We fix this configuration by removing the empty-string configuration:
+
+```terraform
+resource "aws_network_acl" "example" {
+  # ...
+  egress {
+    cidr_block = "0.0.0.0/0"
+    # ...
+  }
+}
+```
+
+### Resource: aws_route
+
+Previously, `destination_cidr_block` and `destination_ipv6_cidr_block` could be set to `""`. However, the value `""` is no longer valid. Now, set the argument to `null` (_e.g._, `destination_ipv6_cidr_block = null`) or remove the empty-string configuration.
+
+In addition, now exactly one of `destination_cidr_block`, `destination_ipv6_cidr_block`, and `destination_prefix_list_id` can be set.
+
+For example, this type of configuration for `aws_route` is now not valid:
+
+```terraform
+resource "aws_route" "example" {
+  route_table_id = aws_route_table.example.id
+  gateway_id     = aws_internet_gateway.example.id
+
+  destination_cidr_block      = local.ipv6 ? "" : local.destination
+  destination_ipv6_cidr_block = local.ipv6 ? local.destination_ipv6 : ""
+}
+```
+
+We fix this configuration by using `null` instead of an empty-string (`""`):
+
+```terraform
+resource "aws_route" "example" {
+  route_table_id = aws_route_table.example.id
+  gateway_id     = aws_internet_gateway.example.id
+
+  destination_cidr_block      = local.ipv6 ? null : local.destination
+  destination_ipv6_cidr_block = local.ipv6 ? local.destination_ipv6 : null
+}
+```
+
+### Resource: aws_route_table
+
+Previously, `route.*.cidr_block` and `route.*.ipv6_cidr_block` could be set to `""`. However, the value `""` is no longer valid. Now, set the argument to `null` (_e.g._, `ipv6_cidr_block = null`) or remove the empty-string configuration.
+
+For example, this type of configuration is now not valid:
+
+```terraform
+resource "aws_route_table" "example" {
+  # ...
+  route {
+    cidr_block      = local.ipv6 ? "" : local.destination
+    ipv6_cidr_block = local.ipv6 ? local.destination_ipv6 : ""
+  }
+}
+```
+
+We fix this configuration by usingd `null` instead of an empty-string (`""`):
+
+```terraform
+resource "aws_route_table" "example" {
+  # ...
+  route {
+    cidr_block      = local.ipv6 ? null : local.destination
+    ipv6_cidr_block = local.ipv6 ? local.destination_ipv6 : null
+  }
+}
+```
+
+### Resource: aws_vpc
+
+Previously, `ipv6_cidr_block` could be set to `""`. However, the value `""` is no longer valid. Now, set the argument to `null` (_e.g._, `ipv6_cidr_block = null`) or remove the empty-string configuration.
+
+For example, this type of configuration is now not valid:
+
+```terraform
+resource "aws_vpc" "example" {
+  cidr_block      = "10.1.0.0/16"
+  ipv6_cidr_block = ""
+}
+```
+
+We fix this configuration by removing `ipv6_cidr_block`:
+
+```terraform
+resource "aws_vpc" "example" {
+  cidr_block = "10.1.0.0/16"
+}
+```
+
+### Resource: aws_vpc_ipv6_cidr_block_association
+
+Previously, `ipv6_cidr_block` could be set to `""`. However, the value `""` is no longer valid. Now, set the argument to `null` (_e.g._, `ipv6_cidr_block = null`) or remove the empty-string configuration.
+
+## Data Source: aws_cloudwatch_log_group
+
+### Removal of arn Wildcard Suffix
+
+Previously, the data source returned the ARN directly from the API, which included a `:*` suffix to denote all CloudWatch Log Streams under the CloudWatch Log Group. Most other AWS resources that return ARNs and many other AWS services do not use the `:*` suffix. The suffix is now automatically removed. For example, the data source previously returned an ARN such as `arn:aws:logs:us-east-1:123456789012:log-group:/example:*` but will now return `arn:aws:logs:us-east-1:123456789012:log-group:/example`.
+
+Workarounds, such as using `replace()` as shown below, should be removed:
+
+```terraform
+data "aws_cloudwatch_log_group" "example" {
+  name = "example"
+}
+resource "aws_datasync_task" "example" {
+  # ... other configuration ...
+  cloudwatch_log_group_arn = replace(data.aws_cloudwatch_log_group.example.arn, ":*", "")
+}
+```
+
+Removing the `:*` suffix is a breaking change for some configurations. Fix these configurations using string interpolations as demonstrated below. For example, this configuration is now broken:
+
+```terraform
+data "aws_iam_policy_document" "ad-log-policy" {
+  statement {
+    actions = [
+      "logs:CreateLogStream",
+      "logs:PutLogEvents"
+    ]
+    principals {
+      identifiers = ["ds.amazonaws.com"]
+      type        = "Service"
+    }
+    resources = [data.aws_cloudwatch_log_group.example.arn]
+    effect    = "Allow"
+  }
+}
+```
+
+An updated configuration:
+
+```terraform
+data "aws_iam_policy_document" "ad-log-policy" {
+  statement {
+    actions = [
+      "logs:CreateLogStream",
+      "logs:PutLogEvents"
+    ]
+    principals {
+      identifiers = ["ds.amazonaws.com"]
+      type        = "Service"
+    }
+    resources = ["${data.aws_cloudwatch_log_group.example.arn}:*"]
+    effect    = "Allow"
+  }
+}
+```
+
+## Data Source: aws_subnet_ids
+
+The `aws_subnet_ids` data source has been deprecated and will be removed in a future version. Use the `aws_subnets` data source instead.
+
+For example, change a configuration such as
+
+```hcl
+data "aws_subnet_ids" "example" {
+  vpc_id = var.vpc_id
+}
+
+data "aws_subnet" "example" {
+  for_each = data.aws_subnet_ids.example.ids
+  id       = each.value
+}
+
+output "subnet_cidr_blocks" {
+  value = [for s in data.aws_subnet.example : s.cidr_block]
+}
+```
+
+to
+
+```hcl
+data "aws_subnets" "example" {
+  filter {
+    name   = "vpc-id"
+    values = [var.vpc_id]
+  }
+}
+
+data "aws_subnet" "example" {
+  for_each = data.aws_subnets.example.ids
+  id       = each.value
+}
+
+output "subnet_cidr_blocks" {
+  value = [for s in data.aws_subnet.example : s.cidr_block]
+}
+```
+
+## Data Source: aws_s3_bucket_object
+
+Version 4.x deprecates the `aws_s3_bucket_object` data source. Maintainers will remove it in a future version. Use `aws_s3_object` instead, where new features and fixes will be added.
+
+## Data Source: aws_s3_bucket_objects
+
+Version 4.x deprecates the `aws_s3_bucket_objects` data source. Maintainers will remove it in a future version. Use `aws_s3_objects` instead, where new features and fixes will be added.
+
+## Resource: aws_batch_compute_environment
+
+You can no longer specify `compute_resources` when `type` is `UNMANAGED`.
+
+Previously, you could apply this configuration and the provider would ignore any compute resources:
+
+```hcl
+resource "aws_batch_compute_environment" "test" {
+  compute_environment_name = "test"
+
+  compute_resources {
+    instance_role = aws_iam_instance_profile.ecs_instance.arn
+    instance_type = [
+      "c4.large",
+    ]
+    max_vcpus = 16
+    min_vcpus = 0
+    security_group_ids = [
+      aws_security_group.test.id
+    ]
+    subnets = [
+      aws_subnet.test.id
+    ]
+    type = "EC2"
+  }
+
+  service_role = aws_iam_role.batch_service.arn
+  type         = "UNMANAGED"
+}
+```
+
+Now, this configuration is invalid and will result in an error during plan.
+
+To resolve this error, simply remove or comment out the `compute_resources` configuration block.
+
+```hcl
+resource "aws_batch_compute_environment" "test" {
+  compute_environment_name = "test"
+
+  service_role = aws_iam_role.batch_service.arn
+  type         = "UNMANAGED"
+}
+```
+
+## Resource: aws_cloudwatch_event_target
+
+### Removal of `ecs_target` `launch_type` default value
+
+Previously, the provider assigned `ecs_target` `launch_type` the default value of `EC2` if you did not configure a value. However, the provider no longer assigns a default value.
+
+For example, previously you could workaround the default value by using an empty string (`""`), as shown:
+
+```terraform
+resource "aws_cloudwatch_event_target" "test" {
+  arn      = aws_ecs_cluster.test.id
+  rule     = aws_cloudwatch_event_rule.test.id
+  role_arn = aws_iam_role.test.arn
+  ecs_target {
+    launch_type         = ""
+    task_count          = 1
+    task_definition_arn = aws_ecs_task_definition.task.arn
+    network_configuration {
+      subnets = [aws_subnet.subnet.id]
+    }
+  }
+}
+```
+
+This is no longer necessary. We fix the configuration by removing the empty string assignment:
+
+```terraform
+resource "aws_cloudwatch_event_target" "test" {
+  arn      = aws_ecs_cluster.test.id
+  rule     = aws_cloudwatch_event_rule.test.id
+  role_arn = aws_iam_role.test.arn
+  ecs_target {
+    task_count          = 1
+    task_definition_arn = aws_ecs_task_definition.task.arn
+    network_configuration {
+      subnets = [aws_subnet.subnet.id]
+    }
+  }
+}
+```
+
+## Resource: aws_elasticache_cluster
+
+### Error raised if neither `engine` nor `replication_group_id` is specified
+
+Previously, when you did not specify either `engine` or `replication_group_id`, Terraform would not prevent you from applying the invalid configuration.
+Now, this will produce an error similar to the one below:
+
+```
+Error: Invalid combination of arguments
+
+          with aws_elasticache_cluster.example,
+          on terraform_plugin_test.tf line 2, in resource "aws_elasticache_cluster" "example":
+           2: resource "aws_elasticache_cluster" "example" {
+
+        "replication_group_id": one of `engine,replication_group_id` must be
+        specified
+
+        Error: Invalid combination of arguments
+
+          with aws_elasticache_cluster.example,
+          on terraform_plugin_test.tf line 2, in resource "aws_elasticache_cluster" "example":
+           2: resource "aws_elasticache_cluster" "example" {
+
+        "engine": one of `engine,replication_group_id` must be specified
+```
+
+Update your configuration to supply one of `engine` or `replication_group_id`.
+
+## Resource: aws_elasticache_global_replication_group
+
+### actual_engine_version Attribute removal
+
+Switch your Terraform configuration from using `actual_engine_version` to use the `engine_version_actual` attribute instead.
+
+For example, given this previous configuration:
+
+```terraform
+output "elasticache_global_replication_group_version_result" {
+  value = aws_elasticache_global_replication_group.example.actual_engine_version
+}
+```
+
+An updated configuration:
+
+```terraform
+output "elasticache_global_replication_group_version_result" {
+  value = aws_elasticache_global_replication_group.example.engine_version_actual
+}
+```
+
+## Resource: aws_fsx_ontap_storage_virtual_machine
+
+We removed the misspelled argument `active_directory_configuration.0.self_managed_active_directory_configuration.0.organizational_unit_distinguidshed_name` that we previously deprecated. Use `active_directory_configuration.0.self_managed_active_directory_configuration.0.organizational_unit_distinguished_name` now instead. Terraform will automatically migrate the state to `active_directory_configuration.0.self_managed_active_directory_configuration.0.organizational_unit_distinguished_name` during planning.
+
+## Resource: aws_lb_target_group
+
+For `protocol = "TCP"`, you can no longer set `stickiness.type` to `lb_cookie` even when `enabled = false`. Instead, either change the `protocol` to `"HTTP"` or `"HTTPS"`, or change `stickiness.type` to `"source_ip"`.
+
+For example, this configuration is no longer valid:
+
+```terraform
+resource "aws_lb_target_group" "test" {
+  port     = 25
+  protocol = "TCP"
+  vpc_id   = aws_vpc.test.id
+
+  stickiness {
+    type    = "lb_cookie"
+    enabled = false
+  }
+}
+```
+
+To fix this, we change the `stickiness.type` to `"source_ip"`.
+
+```terraform
+resource "aws_lb_target_group" "test" {
+  port     = 25
+  protocol = "TCP"
+  vpc_id   = aws_vpc.test.id
+
+  stickiness {
+    type    = "source_ip"
+    enabled = false
+  }
+}
+```
+
+## Resource: aws_s3_bucket_object
+
+Version 4.x deprecates the `aws_s3_bucket_object` and maintainers will remove it in a future version. Use `aws_s3_object` instead, where new features and fixes will be added.
+
+When replacing `aws_s3_bucket_object` with `aws_s3_object` in your configuration, on the next apply, Terraform will recreate the object. If you prefer to not have Terraform recreate the object, import the object using `aws_s3_object`.
+
+For example, the following will import an S3 object into state, assuming the configuration exists, as `aws_s3_object.example`:
+
+```console
+% terraform import aws_s3_object.example s3://some-bucket-name/some/key.txt
+```
+
+~> **CAUTION:** We do not recommend modifying the state file manually. If you do, you can make it unusable. However, if you accept that risk, some community members have upgraded to the new resource by searching and replacing `"type": "aws_s3_bucket_object",` with `"type": "aws_s3_object",` in the state file, and then running `terraform apply -refresh-only`.
+
+## EC2-Classic Resource and Data Source Support
+
+While an upgrade to this major version will not directly impact EC2-Classic resources configured with Terraform,
+it is important to keep in the mind the following AWS Provider resources will eventually no longer
+be compatible with EC2-Classic as AWS completes their EC2-Classic networking retirement (expected around August 15, 2022).
+
+* Running or stopped [EC2 instances](/docs/providers/aws/r/instance.html)
+* Running or stopped [RDS database instances](/docs/providers/aws/r/db_instance.html)
+* [Elastic IP addresses](/docs/providers/aws/r/eip.html)
+* [Classic Load Balancers](/docs/providers/aws/r/lb.html)
+* [Redshift clusters](/docs/providers/aws/r/redshift_cluster.html)
+* [Elastic Beanstalk environments](/docs/providers/aws/r/elastic_beanstalk_environment.html)
+* [EMR clusters](/docs/providers/aws/r/emr_cluster.html)
+* [AWS Data Pipelines pipelines](/docs/providers/aws/r/datapipeline_pipeline.html)
+* [ElastiCache clusters](/docs/providers/aws/r/elasticache_cluster.html)
+* [Spot Requests](/docs/providers/aws/r/spot_instance_request.html)
+* [Capacity Reservations](/docs/providers/aws/r/ec2_capacity_reservation.html)
+
+## Macie Classic Resource Support
+
+These resources should be considered deprecated and will be removed in version 5.0.0.
+
+* Macie Member Account Association
+* Macie S3 Bucket Association
diff --git a/website/docs/guides/version-4-upgrade.html.md b/website/docs/guides/version-4-upgrade.html.md
deleted file mode 100644
index c192ef5ebb4..00000000000
--- a/website/docs/guides/version-4-upgrade.html.md
+++ /dev/null
@@ -1,3556 +0,0 @@
----
-subcategory: ""
-layout: "aws"
-page_title: "Terraform AWS Provider Version 4 Upgrade Guide"
-description: |-
-  Terraform AWS Provider Version 4 Upgrade Guide
----
-
-# Terraform AWS Provider Version 4 Upgrade Guide
-
-Version 4.0.0 of the AWS provider for Terraform is a major release and includes some changes that you will need to consider when upgrading. We intend this guide to help with that process and focus only on changes from version 3.X to version 4.0.0. See the [Version 3 Upgrade Guide](/docs/providers/aws/guides/version-3-upgrade.html) for information about upgrading from 2.X to version 3.0.0.
-
-We previously marked most of the changes we outline in this guide as deprecated in the Terraform plan/apply output throughout previous provider releases. You can find these changes, including deprecation notices, in the [Terraform AWS Provider CHANGELOG](https://github.com/hashicorp/terraform-provider-aws/blob/main/CHANGELOG.md).
-
-~> **NOTE:** Versions 4.0.0 through v4.8.0 of the AWS Provider introduce significant breaking changes to the `aws_s3_bucket` resource. See [S3 Bucket Refactor](#s3-bucket-refactor) for more details.
-We recommend upgrading to v4.9.0 or later of the AWS Provider instead, where only non-breaking changes and deprecation notices are introduced to the `aws_s3_bucket`. See  [Changes to S3 Bucket Drift Detection](#changes-to-s3-bucket-drift-detection) for additional considerations when upgrading to v4.9.0 or later.
-
-~> **NOTE:** Version 4.0.0 of the AWS Provider introduces changes to the precedence of some authentication and configuration parameters.
-These changes bring the provider in line with the AWS CLI and SDKs.
-See [Changes to Authentication](#changes-to-authentication) for more details.
-
-~> **NOTE:** Version 4.0.0 of the AWS Provider will be the last major version to support [EC2-Classic resources](#ec2-classic-resource-and-data-source-support) as AWS plans to fully retire EC2-Classic Networking. See the [AWS News Blog](https://aws.amazon.com/blogs/aws/ec2-classic-is-retiring-heres-how-to-prepare/) for additional details.
-
-~> **NOTE:** Version 4.0.0 of the AWS Provider will be the last major version to support [Macie Classic resources](#macie-classic-resource-support) as AWS plans to fully retire Macie Classic. See the [Amazon Macie Classic FAQs](https://aws.amazon.com/macie/classic-faqs/) for additional details.
-
-Upgrade topics:
-
-<!-- TOC depthFrom:2 depthTo:2 -->
-
-- [Provider Version Configuration](#provider-version-configuration)
-- [Changes to Authentication](#changes-to-authentication)
-- [New Provider Arguments](#new-provider-arguments)
-- [Changes to S3 Bucket Drift Detection](#changes-to-s3-bucket-drift-detection) (**Applicable to v4.9.0 and later of the AWS Provider**)
-- [S3 Bucket Refactor](#s3-bucket-refactor) (**Only applicable to v4.0.0 through v4.8.0 of the AWS Provider**)
-    - [`acceleration_status` Argument](#acceleration_status-argument)
-    - [`acl` Argument](#acl-argument)
-    - [`cors_rule` Argument](#cors_rule-argument)
-    - [`grant` Argument](#grant-argument)
-    - [`lifecycle_rule` Argument](#lifecycle_rule-argument)
-    - [`logging` Argument](#logging-argument)
-    - [`object_lock_configuration` `rule` Argument](#object_lock_configuration-rule-argument)
-    - [`policy` Argument](#policy-argument)
-    - [`replication_configuration` Argument](#replication_configuration-argument)
-    - [`request_payer` Argument](#request_payer-argument)
-    - [`server_side_encryption_configuration` Argument](#server_side_encryption_configuration-argument)
-    - [`versioning` Argument](#versioning-argument)
-    - [`website`, `website_domain`, and `website_endpoint` Arguments](#website-website_domain-and-website_endpoint-arguments)
-- [Full Resource Lifecycle of Default Resources](#full-resource-lifecycle-of-default-resources)
-    - [Resource: aws_default_subnet](#resource-aws_default_subnet)
-    - [Resource: aws_default_vpc](#resource-aws_default_vpc)
-- [Plural Data Source Behavior](#plural-data-source-behavior)
-- [Empty Strings Not Valid For Certain Resources](#empty-strings-not-valid-for-certain-resources)
-    - [Resource: aws_cloudwatch_event_target (Empty String)](#resource-aws_cloudwatch_event_target-empty-string)
-    - [Resource: aws_customer_gateway](#resource-aws_customer_gateway)
-    - [Resource: aws_default_network_acl](#resource-aws_default_network_acl)
-    - [Resource: aws_default_route_table](#resource-aws_default_route_table)
-    - [Resource: aws_default_vpc (Empty String)](#resource-aws_default_vpc-empty-string)
-    - [Resource: aws_efs_mount_target](#resource-aws_efs_mount_target)
-    - [Resource: aws_elasticsearch_domain](#resource-aws_elasticsearch_domain)
-    - [Resource: aws_instance](#resource-aws_instance)
-    - [Resource: aws_network_acl](#resource-aws_network_acl)
-    - [Resource: aws_route](#resource-aws_route)
-    - [Resource: aws_route_table](#resource-aws_route_table)
-    - [Resource: aws_vpc](#resource-aws_vpc)
-    - [Resource: aws_vpc_ipv6_cidr_block_association](#resource-aws_vpc_ipv6_cidr_block_association)
-- [Data Source: aws_cloudwatch_log_group](#data-source-aws_cloudwatch_log_group)
-- [Data Source: aws_subnet_ids](#data-source-aws_subnet_ids)
-- [Data Source: aws_s3_bucket_object](#data-source-aws_s3_bucket_object)
-- [Data Source: aws_s3_bucket_objects](#data-source-aws_s3_bucket_objects)
-- [Resource: aws_batch_compute_environment](#resource-aws_batch_compute_environment)
-- [Resource: aws_cloudwatch_event_target](#resource-aws_cloudwatch_event_target)
-- [Resource: aws_elasticache_cluster](#resource-aws_elasticache_cluster)
-- [Resource: aws_elasticache_global_replication_group](#resource-aws_elasticache_global_replication_group)
-- [Resource: aws_fsx_ontap_storage_virtual_machine](#resource-aws_fsx_ontap_storage_virtual_machine)
-- [Resource: aws_lb_target_group](#resource-aws_lb_target_group)
-- [Resource: aws_s3_bucket_object](#resource-aws_s3_bucket_object)
-
-<!-- /TOC -->
-
-Additional Topics:
-
-<!-- TOC depthFrom:2 depthTo:2 -->
-
-- [EC2-Classic resource and data source support](#ec2-classic-resource-and-data-source-support)
-- [Macie Classic resource support](#macie-classic-resource-support)
-
-<!-- /TOC -->
-
-## Provider Version Configuration
-
--> Before upgrading to version 4.0.0, upgrade to the most recent 3.X version of the provider and ensure that your environment successfully runs [`terraform plan`](https://www.terraform.io/docs/commands/plan.html). You should not see changes you don't expect or deprecation notices.
-
-Use [version constraints when configuring Terraform providers](https://www.terraform.io/docs/configuration/providers.html#provider-versions). If you are following that recommendation, update the version constraints in your Terraform configuration and run [`terraform init -upgrade`](https://www.terraform.io/docs/commands/init.html) to download the new version.
-
-For example, given this previous configuration:
-
-```terraform
-terraform {
-  required_providers {
-    aws = {
-      source  = "hashicorp/aws"
-      version = "~> 3.74"
-    }
-  }
-}
-
-provider "aws" {
-  # Configuration options
-}
-```
-
-Update to the latest 4.X version:
-
-```terraform
-terraform {
-  required_providers {
-    aws = {
-      source  = "hashicorp/aws"
-      version = "~> 4.0"
-    }
-  }
-}
-
-provider "aws" {
-  # Configuration options
-}
-```
-
-## Changes to Authentication
-
-The authentication configuration for the AWS Provider has changed in this version to match the behavior of other AWS products, including the AWS SDK and AWS CLI. _This will cause authentication failures in AWS provider configurations where you set a non-empty `profile` in the `provider` configuration but the profile does not correspond to an AWS profile with valid credentials._
-
-Precedence for authentication settings is as follows:
-
-* `provider` configuration
-* Environment variables
-* Shared credentials and configuration files (_e.g._, `~/.aws/credentials` and `~/.aws/config`)
-
-In previous versions of the provider, you could explicitly set `profile` in the `provider`, and if the profile did not correspond to valid credentials, the provider would use credentials from environment variables. Starting in v4.0, the Terraform AWS provider enforces the precedence shown above, similarly to how the AWS SDK and AWS CLI behave.
-
-In other words, when you explicitly set `profile` in `provider`, the AWS provider will not use environment variables per the precedence shown above. Before v4.0, if `profile` was configured in the `provider` configuration but did not correspond to an AWS profile or valid credentials, the provider would attempt to use environment variables. **This is no longer the case.** An explicitly set profile that does not have valid credentials will cause an authentication error.
-
-For example, with the following, the environment variables will not be used:
-
-```console
-$ export AWS_ACCESS_KEY_ID="anaccesskey"
-$ export AWS_SECRET_ACCESS_KEY="asecretkey"
-```
-
-```terraform
-provider "aws" {
-  region  = "us-west-2"
-  profile = "customprofile"
-}
-```
-
-## New Provider Arguments
-
-Version 4.x adds these new `provider` arguments:
-
-* `assume_role.duration` - Assume role duration as a string, _e.g._, `"1h"` or `"1h30s"`. Terraform AWS Provider v4.0.0 deprecates `assume_role.duration_seconds` and a future version will remove it.
-* `custom_ca_bundle` - File containing custom root and intermediate certificates. Can also be configured using the `AWS_CA_BUNDLE` environment variable. (Setting `ca_bundle` in the shared config file is not supported.)
-* `ec2_metadata_service_endpoint` - Address of the EC2 metadata service (IMDS) endpoint to use. Can also be set with the `AWS_EC2_METADATA_SERVICE_ENDPOINT` environment variable.
-* `ec2_metadata_service_endpoint_mode` - Mode to use in communicating with the metadata service. Valid values are `IPv4` and `IPv6`. Can also be set with the `AWS_EC2_METADATA_SERVICE_ENDPOINT_MODE` environment variable.
-* `s3_use_path_style` - Replaces `s3_force_path_style`, which has been deprecated in Terraform AWS Provider v4.0.0 and support will be removed in a future version.
-* `shared_config_files` - List of paths to AWS shared config files. If not set, the default is `[~/.aws/config]`. A single value can also be set with the `AWS_CONFIG_FILE` environment variable.
-* `shared_credentials_files` - List of paths to the shared credentials file. If not set, the default  is `[~/.aws/credentials]`. A single value can also be set with the `AWS_SHARED_CREDENTIALS_FILE` environment variable. Replaces `shared_credentials_file`, which has been deprecated in Terraform AWS Provider v4.0.0 and support will be removed in a future version.
-* `sts_region` - Region where AWS STS operations will take place. For example, `us-east-1` and `us-west-2`.
-* `use_dualstack_endpoint` - Force the provider to resolve endpoints with DualStack capability. Can also be set with the `AWS_USE_DUALSTACK_ENDPOINT` environment variable or in a shared config file (`use_dualstack_endpoint`).
-* `use_fips_endpoint` - Force the provider to resolve endpoints with FIPS capability. Can also be set with the `AWS_USE_FIPS_ENDPOINT` environment variable or in a shared config file (`use_fips_endpoint`).
-
-~> **NOTE:** Using the `AWS_METADATA_URL` environment variable has been deprecated in Terraform AWS Provider v4.0.0 and support will be removed in a future version. Change any scripts or environments using `AWS_METADATA_URL` to instead use `AWS_EC2_METADATA_SERVICE_ENDPOINT`.
-
-For example, in previous versions, to use FIPS endpoints, you would need to provide all the FIPS endpoints that you wanted to use in the `endpoints` configuration block:
-
-```terraform
-provider "aws" {
-  endpoints {
-    ec2 = "https://ec2-fips.us-west-2.amazonaws.com"
-    s3  = "https://s3-fips.us-west-2.amazonaws.com"
-    sts = "https://sts-fips.us-west-2.amazonaws.com"
-  }
-}
-```
-
-In v4.0.0, you can still set endpoints in the same way. However, you can instead use the `use_fips_endpoint` argument to have the provider automatically resolve FIPS endpoints for all supported services:
-
-```terraform
-provider "aws" {
-  use_fips_endpoint = true
-}
-```
-
-Note that the provider can only resolve FIPS endpoints where AWS provides FIPS support. Support depends on the service and may include `us-east-1`, `us-east-2`, `us-west-1`, `us-west-2`, `us-gov-east-1`, `us-gov-west-1`, and `ca-central-1`. For more information, see [Federal Information Processing Standard (FIPS) 140-2](https://aws.amazon.com/compliance/fips/).
-
-## Changes to S3 Bucket Drift Detection
-
-~> **NOTE:** This only applies to v4.9.0 and later of the AWS Provider.
-
-~> **NOTE:** If you are migrating from v3.75.x of the AWS Provider and you have already adopted the standalone S3 bucket resources (e.g. `aws_s3_bucket_lifecycle_configuration`),
-a [`lifecycle` configuration block to ignore changes](https://www.terraform.io/language/meta-arguments/lifecycle#ignore_changes) to the internal parameters of the source `aws_s3_bucket` resources will no longer be necessary and can be removed upon upgrade.
-
-~> **NOTE:** In the next major version, v5.0, the parameters listed below will be removed entirely from the `aws_s3_bucket` resource.
-For this reason, a deprecation notice is printed in the Terraform CLI for each of the parameters when used in a configuration.
-
-To remediate the breaking changes introduced to the `aws_s3_bucket` resource in v4.0.0 of the AWS Provider,
-v4.9.0 and later retain the same configuration parameters of the `aws_s3_bucket` resource as in v3.x and functionality of the `aws_s3_bucket` resource only differs from v3.x
-in that Terraform will only perform drift detection for each of the following parameters if a configuration value is provided:
-
-* `acceleration_status`
-* `acl`
-* `cors_rule`
-* `grant`
-* `lifecycle_rule`
-* `logging`
-* `object_lock_configuration`
-* `policy`
-* `replication_configuration`
-* `request_payer`
-* `server_side_encryption_configuration`
-* `versioning`
-* `website`
-
-Thus, if one of these parameters was once configured and then is entirely removed from an `aws_s3_bucket` resource configuration,
-Terraform will not pick up on these changes on a subsequent `terraform plan` or `terraform apply`.
-
-For example, given the following configuration with a single `cors_rule`:
-
-```terraform
-resource "aws_s3_bucket" "example" {
-  bucket = "yournamehere"
-
-  # ... other configuration ...
-  cors_rule {
-    allowed_headers = ["*"]
-    allowed_methods = ["PUT", "POST"]
-    allowed_origins = ["https://s3-website-test.hashicorp.com"]
-    expose_headers  = ["ETag"]
-    max_age_seconds = 3000
-  }
-}
-```
-
-When updated to the following configuration without a `cors_rule`:
-
-```terraform
-resource "aws_s3_bucket" "example" {
-  bucket = "yournamehere"
-
-  # ... other configuration ...
-}
-```
-
-Terraform CLI with v4.9.0 of the AWS Provider will report back:
-
-```shell
-aws_s3_bucket.example: Refreshing state... [id=yournamehere]
-...
-No changes. Your infrastructure matches the configuration.
-```
-
-With that said, to manage changes to these parameters in the `aws_s3_bucket` resource, practitioners should configure each parameter's respective standalone resource
-and perform updates directly on those new configurations. The parameters are mapped to the standalone resources as follows:
-
-| `aws_s3_bucket` Parameter              | Standalone Resource                                  |
-|----------------------------------------|------------------------------------------------------|
-| `acceleration_status`                  | `aws_s3_bucket_accelerate_configuration`             |
-| `acl`                                  | `aws_s3_bucket_acl`                                  |
-| `cors_rule`                            | `aws_s3_bucket_cors_configuration`                   |
-| `grant`                                | `aws_s3_bucket_acl`                                  |
-| `lifecycle_rule`                       | `aws_s3_bucket_lifecycle_configuration`              |
-| `logging`                              | `aws_s3_bucket_logging`                              |
-| `object_lock_configuration`            | `aws_s3_bucket_object_lock_configuration`            |
-| `policy`                               | `aws_s3_bucket_policy`                               |
-| `replication_configuration`            | `aws_s3_bucket_replication_configuration`            |
-| `request_payer`                        | `aws_s3_bucket_request_payment_configuration`        |
-| `server_side_encryption_configuration` | `aws_s3_bucket_server_side_encryption_configuration` |
-| `versioning`                           | `aws_s3_bucket_versioning`                           |
-| `website`                              | `aws_s3_bucket_website_configuration`                |
-
-Going back to the earlier example, given the following configuration:
-
-```terraform
-resource "aws_s3_bucket" "example" {
-  bucket = "yournamehere"
-
-  # ... other configuration ...
-  cors_rule {
-    allowed_headers = ["*"]
-    allowed_methods = ["PUT", "POST"]
-    allowed_origins = ["https://s3-website-test.hashicorp.com"]
-    expose_headers  = ["ETag"]
-    max_age_seconds = 3000
-  }
-}
-```
-
-Practitioners can upgrade to v4.9.0 and then introduce the standalone `aws_s3_bucket_cors_configuration` resource, e.g.
-
-```terraform
-resource "aws_s3_bucket" "example" {
-  bucket = "yournamehere"
-  # ... other configuration ...
-}
-
-resource "aws_s3_bucket_cors_configuration" "example" {
-  bucket = aws_s3_bucket.example.id
-  
-  cors_rule {
-    allowed_headers = ["*"]
-    allowed_methods = ["PUT", "POST"]
-    allowed_origins = ["https://s3-website-test.hashicorp.com"]
-    expose_headers  = ["ETag"]
-    max_age_seconds = 3000
-  }
-}
-```
-
-Depending on the tools available to you, the above configuration can either be directly applied with Terraform or the standalone resource
-can be imported into Terraform state. Please refer to each standalone resource's _Import_ documentation for the proper syntax.
-
-Once the standalone resources are managed by Terraform, updates and removal can be performed as needed.
-
-The following sections depict standalone resource adoption per individual parameter. Standalone resource adoption is not required to upgrade but is recommended to ensure drift is detected by Terraform.
-The examples below are by no means exhaustive. The aim is to provide important concepts when migrating to a standalone resource whose parameters may not entirely align with the corresponding parameter in the `aws_s3_bucket` resource.
-
-### Migrating to `aws_s3_bucket_accelerate_configuration`
-
-Given this previous configuration:
-
-```terraform
-resource "aws_s3_bucket" "example" {
-  bucket = "yournamehere"
-
-  # ... other configuration ...
-  acceleration_status = "Enabled"
-}
-```
-
-Update the configuration to:
-
-```terraform
-resource "aws_s3_bucket" "example" {
-  bucket = "yournamehere"
-
-  # ... other configuration ...
-}
-
-resource "aws_s3_bucket_accelerate_configuration" "example" {
-  bucket = aws_s3_bucket.example.id
-  status = "Enabled"
-}
-```
-
-### Migrating to `aws_s3_bucket_acl`
-
-#### With `acl`
-
-Given this previous configuration:
-
-```terraform
-resource "aws_s3_bucket" "example" {
-  bucket = "yournamehere"
-  acl    = "private"
-
-  # ... other configuration ...
-}
-```
-
-Update the configuration to:
-
-```terraform
-resource "aws_s3_bucket" "example" {
-  bucket = "yournamehere"
-}
-
-resource "aws_s3_bucket_acl" "example" {
-  bucket = aws_s3_bucket.example.id
-  acl    = "private"
-}
-```
-
-#### With `grant`
-
-Given this previous configuration:
-
-```terraform
-resource "aws_s3_bucket" "example" {
-  bucket = "yournamehere"
-
-  # ... other configuration ...
-  grant {
-    id          = data.aws_canonical_user_id.current_user.id
-    type        = "CanonicalUser"
-    permissions = ["FULL_CONTROL"]
-  }
-
-  grant {
-    type        = "Group"
-    permissions = ["READ_ACP", "WRITE"]
-    uri         = "http://acs.amazonaws.com/groups/s3/LogDelivery"
-  }
-}
-```
-
-Update the configuration to:
-
-```terraform
-resource "aws_s3_bucket" "example" {
-  bucket = "yournamehere"
-
-  # ... other configuration ...
-}
-
-resource "aws_s3_bucket_acl" "example" {
-  bucket = aws_s3_bucket.example.id
-
-  access_control_policy {
-    grant {
-      grantee {
-        id   = data.aws_canonical_user_id.current_user.id
-        type = "CanonicalUser"
-      }
-      permission = "FULL_CONTROL"
-    }
-
-    grant {
-      grantee {
-        type = "Group"
-        uri  = "http://acs.amazonaws.com/groups/s3/LogDelivery"
-      }
-      permission = "READ_ACP"
-    }
-
-    grant {
-      grantee {
-        type = "Group"
-        uri  = "http://acs.amazonaws.com/groups/s3/LogDelivery"
-      }
-      permission = "WRITE"
-    }
-
-    owner {
-      id = data.aws_canonical_user_id.current_user.id
-    }
-  }
-}
-```
-
-### Migrating to `aws_s3_bucket_cors_configuration`
-
-Given this previous configuration:
-
-```terraform
-resource "aws_s3_bucket" "example" {
-  bucket = "yournamehere"
-
-  # ... other configuration ...
-  cors_rule {
-    allowed_headers = ["*"]
-    allowed_methods = ["PUT", "POST"]
-    allowed_origins = ["https://s3-website-test.hashicorp.com"]
-    expose_headers  = ["ETag"]
-    max_age_seconds = 3000
-  }
-}
-```
-
-Update the configuration to:
-
-```terraform
-resource "aws_s3_bucket" "example" {
-  bucket = "yournamehere"
-
-  # ... other configuration ...
-}
-
-resource "aws_s3_bucket_cors_configuration" "example" {
-  bucket = aws_s3_bucket.example.id
-
-  cors_rule {
-    allowed_headers = ["*"]
-    allowed_methods = ["PUT", "POST"]
-    allowed_origins = ["https://s3-website-test.hashicorp.com"]
-    expose_headers  = ["ETag"]
-    max_age_seconds = 3000
-  }
-}
-```
-
-### Migrating to `aws_s3_bucket_lifecycle_configuration`
-
-~> **Note:** In version `3.x` of the provider, the `lifecycle_rule.id` argument was optional, while in version `4.x`, the `aws_s3_bucket_lifecycle_configuration.rule.id` argument required. Use the AWS CLI s3api [get-bucket-lifecycle-configuration](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/s3api/get-bucket-lifecycle-configuration.html) to get the source bucket's lifecycle configuration to determine the ID.
-
-#### For Lifecycle Rules with no `prefix` previously configured
-
-~> **Note:** When configuring the `rule.filter` configuration block in the new `aws_s3_bucket_lifecycle_configuration` resource, use the AWS CLI s3api [get-bucket-lifecycle-configuration](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/s3api/get-bucket-lifecycle-configuration.html)
-to get the source bucket's lifecycle configuration and determine if the `Filter` is configured as `"Filter" : {}` or `"Filter" : { "Prefix": "" }`.
-If AWS returns the former, configure `rule.filter` as `filter {}`. Otherwise, neither a `rule.filter` nor `rule.prefix` parameter should be configured as shown here:
-
-Given this previous configuration:
-
-```terraform
-resource "aws_s3_bucket" "example" {
-  bucket = "yournamehere"
-
-  lifecycle_rule {
-    id      = "Keep previous version 30 days, then in Glacier another 60"
-    enabled = true
-
-    noncurrent_version_transition {
-      days          = 30
-      storage_class = "GLACIER"
-    }
-
-    noncurrent_version_expiration {
-      days = 90
-    }
-  }
-
-  lifecycle_rule {
-    id                                     = "Delete old incomplete multi-part uploads"
-    enabled                                = true
-    abort_incomplete_multipart_upload_days = 7
-  }
-}
-```
-
-Update the configuration to:
-
-```terraform
-resource "aws_s3_bucket" "example" {
-  bucket = "yournamehere"
-
-  # ... other configuration ...
-}
-
-resource "aws_s3_bucket_lifecycle_configuration" "example" {
-  bucket = aws_s3_bucket.example.id
-
-  rule {
-    id     = "Keep previous version 30 days, then in Glacier another 60"
-    status = "Enabled"
-
-    noncurrent_version_transition {
-      noncurrent_days = 30
-      storage_class   = "GLACIER"
-    }
-
-    noncurrent_version_expiration {
-      noncurrent_days = 90
-    }
-  }
-
-  rule {
-    id     = "Delete old incomplete multi-part uploads"
-    status = "Enabled"
-
-    abort_incomplete_multipart_upload {
-      days_after_initiation = 7
-    }
-  }
-}
-```
-
-#### For Lifecycle Rules with `prefix` previously configured as an empty string
-
-Given this previous configuration:
-
-```terraform
-resource "aws_s3_bucket" "example" {
-  bucket = "yournamehere"
-
-  lifecycle_rule {
-    id      = "log-expiration"
-    enabled = true
-    prefix  = ""
-
-    transition {
-      days          = 30
-      storage_class = "STANDARD_IA"
-    }
-
-    transition {
-      days          = 180
-      storage_class = "GLACIER"
-    }
-  }
-}
-```
-
-Update the configuration to:
-
-```terraform
-resource "aws_s3_bucket" "example" {
-  bucket = "yournamehere"
-
-  # ... other configuration ...
-}
-
-resource "aws_s3_bucket_lifecycle_configuration" "example" {
-  bucket = aws_s3_bucket.example.id
-
-  rule {
-    id     = "log-expiration"
-    status = "Enabled"
-
-    transition {
-      days          = 30
-      storage_class = "STANDARD_IA"
-    }
-
-    transition {
-      days          = 180
-      storage_class = "GLACIER"
-    }
-  }
-}
-```
-
-#### For Lifecycle Rules with `prefix`
-
-Given this previous configuration:
-
-```terraform
-resource "aws_s3_bucket" "example" {
-  bucket = "yournamehere"
-
-  lifecycle_rule {
-    id      = "log-expiration"
-    enabled = true
-    prefix  = "foobar"
-
-    transition {
-      days          = 30
-      storage_class = "STANDARD_IA"
-    }
-
-    transition {
-      days          = 180
-      storage_class = "GLACIER"
-    }
-  }
-}
-```
-
-Update the configuration to:
-
-```terraform
-resource "aws_s3_bucket" "example" {
-  bucket = "yournamehere"
-
-  # ... other configuration ...
-}
-
-resource "aws_s3_bucket_lifecycle_configuration" "example" {
-  bucket = aws_s3_bucket.example.id
-
-  rule {
-    id     = "log-expiration"
-    status = "Enabled"
-
-    filter {
-      prefix = "foobar"
-    }
-
-    transition {
-      days          = 30
-      storage_class = "STANDARD_IA"
-    }
-
-    transition {
-      days          = 180
-      storage_class = "GLACIER"
-    }
-  }
-}
-```
-
-#### For Lifecycle Rules with `prefix` and `tags`
-
-Given this previous configuration:
-
-```terraform
-resource "aws_s3_bucket" "example" {
-  bucket = "yournamehere"
-
-  # ... other configuration ...
-  lifecycle_rule {
-    id      = "log"
-    enabled = true
-    prefix = "log/"
-
-    tags = {
-      rule      = "log"
-      autoclean = "true"
-    }
-
-    transition {
-      days          = 30
-      storage_class = "STANDARD_IA"
-    }
-
-    transition {
-      days          = 60
-      storage_class = "GLACIER"
-    }
-
-    expiration {
-      days = 90
-    }
-  }
-
-  lifecycle_rule {
-    id      = "tmp"
-    prefix  = "tmp/"
-    enabled = true
-
-    expiration {
-      date = "2022-12-31"
-    }
-  }
-}
-```
-
-Update the configuration to:
-
-```terraform
-resource "aws_s3_bucket" "example" {
-  bucket = "yournamehere"
-
-  # ... other configuration ...
-}
-
-resource "aws_s3_bucket_lifecycle_configuration" "example" {
-  bucket = aws_s3_bucket.example.id
-
-  rule {
-    id     = "log"
-    status = "Enabled"
-
-    filter {
-      and {
-        prefix = "log/"
-
-        tags = {
-          rule      = "log"
-          autoclean = "true"
-        }
-      }
-    }
-
-    transition {
-      days          = 30
-      storage_class = "STANDARD_IA"
-    }
-
-    transition {
-      days          = 60
-      storage_class = "GLACIER"
-    }
-
-    expiration {
-      days = 90
-    }
-  }
-
-  rule {
-    id = "tmp"
-
-    filter {
-      prefix  = "tmp/"
-    }
-
-    expiration {
-      date = "2022-12-31T00:00:00Z"
-    }
-
-    status = "Enabled"
-  }
-}
-```
-
-### Migrating to `aws_s3_bucket_logging`
-
-Given this previous configuration:
-
-```terraform
-resource "aws_s3_bucket" "log_bucket" {
-  # ... other configuration ...
-  bucket = "example-log-bucket"
-}
-
-resource "aws_s3_bucket" "example" {
-  bucket = "yournamehere"
-
-  # ... other configuration ...
-  logging {
-    target_bucket = aws_s3_bucket.log_bucket.id
-    target_prefix = "log/"
-  }
-}
-```
-
-Update the configuration to:
-
-```terraform
-resource "aws_s3_bucket" "log_bucket" {
-  bucket = "example-log-bucket"
-
-  # ... other configuration ...
-}
-
-resource "aws_s3_bucket" "example" {
-  bucket = "yournamehere"
-
-  # ... other configuration ...
-}
-
-resource "aws_s3_bucket_logging" "example" {
-  bucket        = aws_s3_bucket.example.id
-  target_bucket = aws_s3_bucket.log_bucket.id
-  target_prefix = "log/"
-}
-```
-
-### Migrating to `aws_s3_bucket_object_lock_configuration`
-
-Given this previous configuration:
-
-```terraform
-resource "aws_s3_bucket" "example" {
-  bucket = "yournamehere"
-
-  # ... other configuration ...
-  object_lock_configuration {
-    object_lock_enabled = "Enabled"
-
-    rule {
-      default_retention {
-        mode = "COMPLIANCE"
-        days = 3
-      }
-    }
-  }
-}
-```
-
-Update the configuration to:
-
-```terraform
-resource "aws_s3_bucket" "example" {
-  bucket = "yournamehere"
-
-  # ... other configuration ...
-  object_lock_enabled = true
-}
-
-resource "aws_s3_bucket_object_lock_configuration" "example" {
-  bucket = aws_s3_bucket.example.id
-
-  rule {
-    default_retention {
-      mode = "COMPLIANCE"
-      days = 3
-    }
-  }
-}
-```
-
-### Migrating to `aws_s3_bucket_policy`
-
-Given this previous configuration:
-
-```terraform
-resource "aws_s3_bucket" "example" {
-  bucket = "yournamehere"
-
-  # ... other configuration ...
-  policy = <<EOF
-{
-  "Id": "Policy1446577137248",
-  "Statement": [
-    {
-      "Action": "s3:PutObject",
-      "Effect": "Allow",
-      "Principal": {
-        "AWS": "${data.aws_elb_service_account.current.arn}"
-      },
-      "Resource": "arn:${data.aws_partition.current.partition}:s3:::yournamehere/*",
-      "Sid": "Stmt1446575236270"
-    }
-  ],
-  "Version": "2012-10-17"
-}
-EOF
-}
-```
-
-Update the configuration to:
-
-```terraform
-resource "aws_s3_bucket" "example" {
-  bucket = "yournamehere"
-
-  # ... other configuration ...
-}
-
-resource "aws_s3_bucket_policy" "example" {
-  bucket = aws_s3_bucket.example.id
-  policy = <<EOF
-{
-  "Id": "Policy1446577137248",
-  "Statement": [
-    {
-      "Action": "s3:PutObject",
-      "Effect": "Allow",
-      "Principal": {
-        "AWS": "${data.aws_elb_service_account.current.arn}"
-      },
-      "Resource": "${aws_s3_bucket.example.arn}/*",
-      "Sid": "Stmt1446575236270"
-    }
-  ],
-  "Version": "2012-10-17"
-}
-EOF
-}
-```
-
-### Migrating to `aws_s3_bucket_replication_configuration`
-
-Given this previous configuration:
-
-```terraform
-resource "aws_s3_bucket" "example" {
-  provider = aws.central
-  bucket   = "yournamehere"
-
-  # ... other configuration ...
-
-  replication_configuration {
-    role = aws_iam_role.replication.arn
-    rules {
-      id     = "foobar"
-      status = "Enabled"
-      filter {
-        tags = {}
-      }
-      destination {
-        bucket        = aws_s3_bucket.destination.arn
-        storage_class = "STANDARD"
-        replication_time {
-          status  = "Enabled"
-          minutes = 15
-        }
-        metrics {
-          status  = "Enabled"
-          minutes = 15
-        }
-      }
-    }
-  }
-}
-```
-
-Update the configuration to:
-
-```terraform
-resource "aws_s3_bucket" "example" {
-  provider = aws.central
-  bucket   = "yournamehere"
-
-  # ... other configuration ...
-}
-
-resource "aws_s3_bucket_replication_configuration" "example" {
-  bucket = aws_s3_bucket.source.id
-  role   = aws_iam_role.replication.arn
-
-  rule {
-    id     = "foobar"
-    status = "Enabled"
-
-    filter {}
-
-    delete_marker_replication {
-      status = "Enabled"
-    }
-
-    destination {
-      bucket        = aws_s3_bucket.destination.arn
-      storage_class = "STANDARD"
-
-      replication_time {
-        status = "Enabled"
-        time {
-          minutes = 15
-        }
-      }
-
-      metrics {
-        status = "Enabled"
-        event_threshold {
-          minutes = 15
-        }
-      }
-    }
-  }
-}
-```
-
-### Migrating to `aws_s3_bucket_request_payment_configuration`
-
-Given this previous configuration:
-
-```terraform
-resource "aws_s3_bucket" "example" {
-  bucket = "yournamehere"
-
-  # ... other configuration ...
-  request_payer = "Requester"
-}
-```
-
-Update the configuration to:
-
-```terraform
-resource "aws_s3_bucket" "example" {
-  bucket = "yournamehere"
-
-  # ... other configuration ...
-}
-
-resource "aws_s3_bucket_request_payment_configuration" "example" {
-  bucket = aws_s3_bucket.example.id
-  payer  = "Requester"
-}
-```
-
-### Migrating to `aws_s3_bucket_server_side_encryption_configuration`
-
-Given this previous configuration:
-
-```terraform
-resource "aws_s3_bucket" "example" {
-  bucket = "yournamehere"
-
-  # ... other configuration ...
-  server_side_encryption_configuration {
-    rule {
-      apply_server_side_encryption_by_default {
-        kms_master_key_id = aws_kms_key.mykey.arn
-        sse_algorithm     = "aws:kms"
-      }
-    }
-  }
-}
-```
-
-Update the configuration to:
-
-```terraform
-resource "aws_s3_bucket" "example" {
-  bucket = "yournamehere"
-
-  # ... other configuration ...
-}
-
-resource "aws_s3_bucket_server_side_encryption_configuration" "example" {
-  bucket = aws_s3_bucket.example.id
-
-  rule {
-    apply_server_side_encryption_by_default {
-      kms_master_key_id = aws_kms_key.mykey.arn
-      sse_algorithm     = "aws:kms"
-    }
-  }
-}
-```
-
-### Migrating to `aws_s3_bucket_versioning`
-
-~> **NOTE:** As `aws_s3_bucket_versioning` is a separate resource, any S3 objects for which versioning is important (_e.g._, a truststore for mutual TLS authentication) must implicitly or explicitly depend on the `aws_s3_bucket_versioning` resource. Otherwise, the S3 objects may be created before versioning has been set. [See below](#ensure-objects-depend-on-versioning) for an example. Also note that AWS recommends waiting 15 minutes after enabling versioning on a bucket before putting or deleting objects in/from the bucket.
-
-#### Buckets With Versioning Enabled
-
-Given this previous configuration:
-
-```terraform
-resource "aws_s3_bucket" "example" {
-  bucket = "yournamehere"
-
-  # ... other configuration ...
-  versioning {
-    enabled = true
-  }
-}
-```
-
-Update the configuration to:
-
-```terraform
-resource "aws_s3_bucket" "example" {
-  bucket = "yournamehere"
-
-  # ... other configuration ...
-}
-
-resource "aws_s3_bucket_versioning" "example" {
-  bucket = aws_s3_bucket.example.id
-  versioning_configuration {
-    status = "Enabled"
-  }
-}
-```
-
-#### Buckets With Versioning Disabled or Suspended
-
-Depending on the version of the Terraform AWS Provider you are migrating from, the interpretation of `versioning.enabled = false`
-in your `aws_s3_bucket` resource will differ and thus the migration to the `aws_s3_bucket_versioning` resource will also differ as follows.
-
-If you are migrating from the Terraform AWS Provider `v3.70.0` or later:
-
-* For new S3 buckets, `enabled = false` is synonymous to `Disabled`.
-* For existing S3 buckets, `enabled = false` is synonymous to `Suspended`.
-
-If you are migrating from an earlier version of the Terraform AWS Provider:
-
-* For both new and existing S3 buckets, `enabled = false` is synonymous to `Suspended`.
-
-Given this previous configuration:
-
-```terraform
-resource "aws_s3_bucket" "example" {
-  bucket = "yournamehere"
-
-  # ... other configuration ...
-  versioning {
-    enabled = false
-  }
-}
-```
-
-Update the configuration to one of the following:
-
-* If migrating from Terraform AWS Provider `v3.70.0` or later and bucket versioning was never enabled:
-
-  ```terraform
-  resource "aws_s3_bucket" "example" {
-    bucket = "yournamehere"
-  
-    # ... other configuration ...
-  }
-  
-  resource "aws_s3_bucket_versioning" "example" {
-    bucket = aws_s3_bucket.example.id
-    versioning_configuration {
-      status = "Disabled"
-    }
-  }
-  ```
-
-* If migrating from Terraform AWS Provider `v3.70.0` or later and bucket versioning was enabled at one point:
-
-  ```terraform
-  resource "aws_s3_bucket" "example" {
-    bucket = "yournamehere"
-  
-    # ... other configuration ...
-  }
-  
-  resource "aws_s3_bucket_versioning" "example" {
-    bucket = aws_s3_bucket.example.id
-    versioning_configuration {
-      status = "Suspended"
-    }
-  }
-  ```
-
-* If migrating from an earlier version of Terraform AWS Provider:
-
-  ```terraform
-  resource "aws_s3_bucket" "example" {
-    bucket = "yournamehere"
-  
-    # ... other configuration ...
-  }
-  
-  resource "aws_s3_bucket_versioning" "example" {
-    bucket = aws_s3_bucket.example.id
-    versioning_configuration {
-      status = "Suspended"
-    }
-  }
-  ```
-
-#### Ensure Objects Depend on Versioning
-
-When you create an object whose `version_id` you need and an `aws_s3_bucket_versioning` resource in the same configuration, you are more likely to have success by ensuring the `s3_object` depends either implicitly (see below) or explicitly (i.e., using `depends_on = [aws_s3_bucket_versioning.example]`) on the `aws_s3_bucket_versioning` resource.
-
-~> **NOTE:** For critical and/or production S3 objects, do not create a bucket, enable versioning, and create an object in the bucket within the same configuration. Doing so will not allow the AWS-recommended 15 minutes between enabling versioning and writing to the bucket.
-
-This example shows the `aws_s3_object.example` depending implicitly on the versioning resource through the reference to `aws_s3_bucket_versioning.example.id` to define `bucket`:
-
-```terraform
-resource "aws_s3_bucket" "example" {
-  bucket = "yotto"
-}
-
-resource "aws_s3_bucket_versioning" "example" {
-  bucket = aws_s3_bucket.example.id
-
-  versioning_configuration {
-    status = "Enabled"
-  }
-}
-
-resource "aws_s3_object" "example" {
-  bucket = aws_s3_bucket_versioning.example.id
-  key    = "droeloe"
-  source = "example.txt"
-}
-```
-
-### Migrating to `aws_s3_bucket_website_configuration`
-
-Given this previous configuration:
-
-```terraform
-resource "aws_s3_bucket" "example" {
-  bucket = "yournamehere"
-
-  # ... other configuration ...
-  website {
-    index_document = "index.html"
-    error_document = "error.html"
-  }
-}
-```
-
-Update the configuration to:
-
-```terraform
-resource "aws_s3_bucket" "example" {
-  bucket = "yournamehere"
-
-  # ... other configuration ...
-}
-
-resource "aws_s3_bucket_website_configuration" "example" {
-  bucket = aws_s3_bucket.example.id
-
-  index_document {
-    suffix = "index.html"
-  }
-
-  error_document {
-    key = "error.html"
-  }
-}
-```
-
-Given this previous configuration that uses the `aws_s3_bucket` parameter `website_domain` with `aws_route53_record`:
-
-```terraform
-resource "aws_route53_zone" "main" {
-  name = "domain.test"
-}
-
-resource "aws_s3_bucket" "website" {
-  # ... other configuration ...
-  website {
-    index_document = "index.html"
-    error_document = "error.html"
-  }
-}
-
-resource "aws_route53_record" "alias" {
-  zone_id = aws_route53_zone.main.zone_id
-  name    = "www"
-  type    = "A"
-
-  alias {
-    zone_id                = aws_s3_bucket.website.hosted_zone_id
-    name                   = aws_s3_bucket.website.website_domain
-    evaluate_target_health = true
-  }
-}
-```
-
-Update the configuration to use the `aws_s3_bucket_website_configuration` resource and its `website_domain` parameter:
-
-```terraform
-resource "aws_route53_zone" "main" {
-  name = "domain.test"
-}
-
-resource "aws_s3_bucket" "website" {
-  # ... other configuration ...
-}
-
-resource "aws_s3_bucket_website_configuration" "example" {
-  bucket = aws_s3_bucket.website.id
-
-  index_document {
-    suffix = "index.html"
-  }
-}
-
-resource "aws_route53_record" "alias" {
-  zone_id = aws_route53_zone.main.zone_id
-  name    = "www"
-  type    = "A"
-
-  alias {
-    zone_id                = aws_s3_bucket.website.hosted_zone_id
-    name                   = aws_s3_bucket_website_configuration.example.website_domain
-    evaluate_target_health = true
-  }
-}
-```
-
-## S3 Bucket Refactor
-
-~> **NOTE:** This only applies to v4.0.0 through v4.8.0 of the AWS Provider, which introduce significant breaking
-changes to the `aws_s3_bucket` resource. We recommend upgrading to v4.9.0 of the AWS Provider instead. See the section above, [Changes to S3 Bucket Drift Detection](#changes-to-s3-bucket-drift-detection), for additional upgrade considerations.
-
-To help distribute the management of S3 bucket settings via independent resources, various arguments and attributes in the `aws_s3_bucket` resource have become **read-only**.
-
-Configurations dependent on these arguments should be updated to use the corresponding `aws_s3_bucket_*` resource in order to prevent Terraform from reporting “unconfigurable attribute” errors for read-only arguments. Once updated, it is recommended to import new `aws_s3_bucket_*` resources into Terraform state.
-
-In the event practitioners do not anticipate future modifications to the S3 bucket settings associated with these read-only arguments or drift detection is not needed, these read-only arguments should be removed from `aws_s3_bucket` resource configurations in order to prevent Terraform from reporting “unconfigurable attribute” errors; the states of these arguments will be preserved but are subject to change with modifications made outside Terraform.
-
-~> **NOTE:** Each of the new `aws_s3_bucket_*` resources relies on S3 API calls that utilize a `PUT` action in order to modify the target S3 bucket. These calls follow standard HTTP methods for REST APIs, and therefore **should** handle situations where the target configuration already exists. While it is not strictly necessary to import new `aws_s3_bucket_*` resources where the updated configuration matches the configuration used in previous versions of the AWS provider, skipping this step will lead to a diff in the first plan after a configuration change indicating that any new `aws_s3_bucket_*` resources will be created, making it more difficult to determine whether the appropriate actions will be taken.
-
-### `acceleration_status` Argument
-
-Switch your Terraform configuration to the [`aws_s3_bucket_accelerate_configuration` resource](/docs/providers/aws/r/s3_bucket_accelerate_configuration.html) instead.
-
-For example, given this previous configuration:
-
-```terraform
-resource "aws_s3_bucket" "example" {
-  bucket = "yournamehere"
-
-  # ... other configuration ...
-  acceleration_status = "Enabled"
-}
-```
-
-You will get the following error after upgrading:
-
-```
-│ Error: Value for unconfigurable attribute
-│
-│   with aws_s3_bucket.example,
-│   on main.tf line 1, in resource "aws_s3_bucket" "example":
-│    1: resource "aws_s3_bucket" "example" {
-│
-│ Can't configure a value for "acceleration_status": its value will be decided automatically based on the result of applying this configuration.
-```
-
-Since `acceleration_status` is now read only, update your configuration to use the `aws_s3_bucket_accelerate_configuration`
-resource and remove `acceleration_status` in the `aws_s3_bucket` resource:
-
-```terraform
-resource "aws_s3_bucket" "example" {
-  bucket = "yournamehere"
-
-  # ... other configuration ...
-}
-
-resource "aws_s3_bucket_accelerate_configuration" "example" {
-  bucket = aws_s3_bucket.example.id
-  status = "Enabled"
-}
-```
-
-Run `terraform import` on each new resource, _e.g._,
-
-```shell
-$ terraform import aws_s3_bucket_accelerate_configuration.example yournamehere
-aws_s3_bucket_accelerate_configuration.example: Importing from ID "yournamehere"...
-aws_s3_bucket_accelerate_configuration.example: Import prepared!
-  Prepared aws_s3_bucket_accelerate_configuration for import
-aws_s3_bucket_accelerate_configuration.example: Refreshing state... [id=yournamehere]
-
-Import successful!
-
-The resources that were imported are shown above. These resources are now in
-your Terraform state and will henceforth be managed by Terraform.
-```
-
-### `acl` Argument
-
-Switch your Terraform configuration to the [`aws_s3_bucket_acl` resource](/docs/providers/aws/r/s3_bucket_acl.html) instead.
-
-For example, given this previous configuration:
-
-```terraform
-resource "aws_s3_bucket" "example" {
-  bucket = "yournamehere"
-  acl    = "private"
-
-  # ... other configuration ...
-}
-```
-
-You will get the following error after upgrading:
-
-```
-│ Error: Value for unconfigurable attribute
-│
-│   with aws_s3_bucket.example,
-│   on main.tf line 1, in resource "aws_s3_bucket" "example":
-│    1: resource "aws_s3_bucket" "example" {
-│
-│ Can't configure a value for "acl": its value will be decided automatically based on the result of applying this configuration.
-```
-
-Since `acl` is now read only, update your configuration to use the `aws_s3_bucket_acl`
-resource and remove the `acl` argument in the `aws_s3_bucket` resource:
-
-```terraform
-resource "aws_s3_bucket" "example" {
-  bucket = "yournamehere"
-}
-
-resource "aws_s3_bucket_acl" "example" {
-  bucket = aws_s3_bucket.example.id
-  acl    = "private"
-}
-```
-
-~> **NOTE:** When importing into `aws_s3_bucket_acl`, make sure you use the S3 bucket name (_e.g._, `yournamehere` in the example above) as part of the ID, and _not_ the Terraform bucket configuration name (_e.g._, `example` in the example above).
-
-Run `terraform import` on each new resource, _e.g._,
-
-```shell
-$ terraform import aws_s3_bucket_acl.example yournamehere,private
-aws_s3_bucket_acl.example: Importing from ID "yournamehere,private"...
-aws_s3_bucket_acl.example: Import prepared!
-  Prepared aws_s3_bucket_acl for import
-aws_s3_bucket_acl.example: Refreshing state... [id=yournamehere,private]
-
-Import successful!
-
-The resources that were imported are shown above. These resources are now in
-your Terraform state and will henceforth be managed by Terraform.
-```
-
-### `cors_rule` Argument
-
-Switch your Terraform configuration to the [`aws_s3_bucket_cors_configuration` resource](/docs/providers/aws/r/s3_bucket_cors_configuration.html) instead.
-
-For example, given this previous configuration:
-
-```terraform
-resource "aws_s3_bucket" "example" {
-  bucket = "yournamehere"
-
-  # ... other configuration ...
-  cors_rule {
-    allowed_headers = ["*"]
-    allowed_methods = ["PUT", "POST"]
-    allowed_origins = ["https://s3-website-test.hashicorp.com"]
-    expose_headers  = ["ETag"]
-    max_age_seconds = 3000
-  }
-}
-```
-
-You will get the following error after upgrading:
-
-```
-│ Error: Value for unconfigurable attribute
-│
-│   with aws_s3_bucket.example,
-│   on main.tf line 1, in resource "aws_s3_bucket" "example":
-│    1: resource "aws_s3_bucket" "example" {
-│
-│ Can't configure a value for "cors_rule": its value will be decided automatically based on the result of applying this configuration.
-```
-
-Since `cors_rule` is now read only, update your configuration to use the `aws_s3_bucket_cors_configuration`
-resource and remove `cors_rule` and its nested arguments in the `aws_s3_bucket` resource:
-
-```terraform
-resource "aws_s3_bucket" "example" {
-  bucket = "yournamehere"
-
-  # ... other configuration ...
-}
-
-resource "aws_s3_bucket_cors_configuration" "example" {
-  bucket = aws_s3_bucket.example.id
-
-  cors_rule {
-    allowed_headers = ["*"]
-    allowed_methods = ["PUT", "POST"]
-    allowed_origins = ["https://s3-website-test.hashicorp.com"]
-    expose_headers  = ["ETag"]
-    max_age_seconds = 3000
-  }
-}
-```
-
-Run `terraform import` on each new resource, _e.g._,
-
-```shell
-$ terraform import aws_s3_bucket_cors_configuration.example yournamehere
-aws_s3_bucket_cors_configuration.example: Importing from ID "yournamehere"...
-aws_s3_bucket_cors_configuration.example: Import prepared!
-  Prepared aws_s3_bucket_cors_configuration for import
-aws_s3_bucket_cors_configuration.example: Refreshing state... [id=yournamehere]
-
-Import successful!
-
-The resources that were imported are shown above. These resources are now in
-your Terraform state and will henceforth be managed by Terraform.
-```
-
-### `grant` Argument
-
-Switch your Terraform configuration to the [`aws_s3_bucket_acl` resource](/docs/providers/aws/r/s3_bucket_acl.html) instead.
-
-For example, given this previous configuration:
-
-```terraform
-resource "aws_s3_bucket" "example" {
-  bucket = "yournamehere"
-
-  # ... other configuration ...
-  grant {
-    id          = data.aws_canonical_user_id.current_user.id
-    type        = "CanonicalUser"
-    permissions = ["FULL_CONTROL"]
-  }
-
-  grant {
-    type        = "Group"
-    permissions = ["READ_ACP", "WRITE"]
-    uri         = "http://acs.amazonaws.com/groups/s3/LogDelivery"
-  }
-}
-```
-
-You will get the following error after upgrading:
-
-```
-│ Error: Value for unconfigurable attribute
-│
-│   with aws_s3_bucket.example,
-│   on main.tf line 1, in resource "aws_s3_bucket" "example":
-│    1: resource "aws_s3_bucket" "example" {
-│
-│ Can't configure a value for "grant": its value will be decided automatically based on the result of applying this configuration.
-```
-
-Since `grant` is now read only, update your configuration to use the `aws_s3_bucket_acl`
-resource and remove `grant` in the `aws_s3_bucket` resource:
-
-```terraform
-resource "aws_s3_bucket" "example" {
-  bucket = "yournamehere"
-
-  # ... other configuration ...
-}
-
-resource "aws_s3_bucket_acl" "example" {
-  bucket = aws_s3_bucket.example.id
-
-  access_control_policy {
-    grant {
-      grantee {
-        id   = data.aws_canonical_user_id.current_user.id
-        type = "CanonicalUser"
-      }
-      permission = "FULL_CONTROL"
-    }
-
-    grant {
-      grantee {
-        type = "Group"
-        uri  = "http://acs.amazonaws.com/groups/s3/LogDelivery"
-      }
-      permission = "READ_ACP"
-    }
-
-    grant {
-      grantee {
-        type = "Group"
-        uri  = "http://acs.amazonaws.com/groups/s3/LogDelivery"
-      }
-      permission = "WRITE"
-    }
-
-    owner {
-      id = data.aws_canonical_user_id.current_user.id
-    }
-  }
-}
-```
-
-Run `terraform import` on each new resource, _e.g._,
-
-```shell
-$ terraform import aws_s3_bucket_acl.example yournamehere
-aws_s3_bucket_acl.example: Importing from ID "yournamehere"...
-aws_s3_bucket_acl.example: Import prepared!
-  Prepared aws_s3_bucket_acl for import
-aws_s3_bucket_acl.example: Refreshing state... [id=yournamehere]
-
-Import successful!
-
-The resources that were imported are shown above. These resources are now in
-your Terraform state and will henceforth be managed by Terraform.
-```
-
-### `lifecycle_rule` Argument
-
-Switch your Terraform configuration to the [`aws_s3_bucket_lifecycle_configuration` resource](/docs/providers/aws/r/s3_bucket_lifecycle_configuration.html) instead.
-
-#### For Lifecycle Rules with no `prefix` previously configured
-
-For example, given this previous configuration:
-
-```terraform
-resource "aws_s3_bucket" "example" {
-  bucket = "yournamehere"
-
-  lifecycle_rule {
-    id      = "Keep previous version 30 days, then in Glacier another 60"
-    enabled = true
-
-    noncurrent_version_transition {
-      days          = 30
-      storage_class = "GLACIER"
-    }
-
-    noncurrent_version_expiration {
-      days = 90
-    }
-  }
-
-  lifecycle_rule {
-    id                                     = "Delete old incomplete multi-part uploads"
-    enabled                                = true
-    abort_incomplete_multipart_upload_days = 7
-  }
-}
-```
-
-You will receive the following error after upgrading:
-
-```
-│ Error: Value for unconfigurable attribute
-│
-│   with aws_s3_bucket.example,
-│   on main.tf line 1, in resource "aws_s3_bucket" "example":
-│    1: resource "aws_s3_bucket" "example" {
-│
-│ Can't configure a value for "lifecycle_rule": its value will be decided automatically based on the result of applying this configuration.
-```
-
-Since the `lifecycle_rule` argument changed to read-only, update the configuration to use the `aws_s3_bucket_lifecycle_configuration`
-resource and remove `lifecycle_rule` and its nested arguments in the `aws_s3_bucket` resource.
-
-~> **Note:** When configuring the `rule.filter` configuration block in the new `aws_s3_bucket_lifecycle_configuration` resource, use the AWS CLI s3api [get-bucket-lifecycle-configuration](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/s3api/get-bucket-lifecycle-configuration.html)
-to get the source bucket's lifecycle configuration and determine if the `Filter` is configured as `"Filter" : {}` or `"Filter" : { "Prefix": "" }`.
-If AWS returns the former, configure `rule.filter` as `filter {}`. Otherwise, neither a `rule.filter` nor `rule.prefix` parameter should be configured as shown here:
-
-```terraform
-resource "aws_s3_bucket" "example" {
-  bucket = "yournamehere"
-
-  # ... other configuration ...
-}
-
-resource "aws_s3_bucket_lifecycle_configuration" "example" {
-  bucket = aws_s3_bucket.example.id
-
-  rule {
-    id     = "Keep previous version 30 days, then in Glacier another 60"
-    status = "Enabled"
-
-    noncurrent_version_transition {
-      noncurrent_days = 30
-      storage_class   = "GLACIER"
-    }
-
-    noncurrent_version_expiration {
-      noncurrent_days = 90
-    }
-  }
-
-  rule {
-    id     = "Delete old incomplete multi-part uploads"
-    status = "Enabled"
-
-    abort_incomplete_multipart_upload {
-      days_after_initiation = 7
-    }
-  }
-}
-```
-
-Run `terraform import` on each new resource, _e.g._,
-
-```shell
-$ terraform import aws_s3_bucket_lifecycle_configuration.example yournamehere
-aws_s3_bucket_lifecycle_configuration.example: Importing from ID "yournamehere"...
-aws_s3_bucket_lifecycle_configuration.example: Import prepared!
-  Prepared aws_s3_bucket_lifecycle_configuration for import
-aws_s3_bucket_lifecycle_configuration.example: Refreshing state... [id=yournamehere]
-
-Import successful!
-
-The resources that were imported are shown above. These resources are now in
-your Terraform state and will henceforth be managed by Terraform.
-```
-
-#### For Lifecycle Rules with `prefix` previously configured as an empty string
-
-For example, given this configuration:
-
-```terraform
-resource "aws_s3_bucket" "example" {
-  bucket = "yournamehere"
-
-  lifecycle_rule {
-    id      = "log-expiration"
-    enabled = true
-    prefix  = ""
-
-    transition {
-      days          = 30
-      storage_class = "STANDARD_IA"
-    }
-
-    transition {
-      days          = 180
-      storage_class = "GLACIER"
-    }
-  }
-}
-```
-
-You will receive the following error after upgrading:
-
-```
-│ Error: Value for unconfigurable attribute
-│
-│   with aws_s3_bucket.example,
-│   on main.tf line 1, in resource "aws_s3_bucket" "example":
-│    1: resource "aws_s3_bucket" "example" {
-│
-│ Can't configure a value for "lifecycle_rule": its value will be decided automatically based on the result of applying this configuration.
-```
-
-Since the `lifecycle_rule` argument changed to read-only, update the configuration to use the `aws_s3_bucket_lifecycle_configuration`
-resource and remove `lifecycle_rule` and its nested arguments in the `aws_s3_bucket` resource:
-
-```terraform
-resource "aws_s3_bucket" "example" {
-  bucket = "yournamehere"
-
-  # ... other configuration ...
-}
-
-resource "aws_s3_bucket_lifecycle_configuration" "example" {
-  bucket = aws_s3_bucket.example.id
-
-  rule {
-    id     = "log-expiration"
-    status = "Enabled"
-
-    transition {
-      days          = 30
-      storage_class = "STANDARD_IA"
-    }
-
-    transition {
-      days          = 180
-      storage_class = "GLACIER"
-    }
-  }
-}
-```
-
-Run `terraform import` on each new resource, _e.g._,
-
-```shell
-$ terraform import aws_s3_bucket_lifecycle_configuration.example yournamehere
-aws_s3_bucket_lifecycle_configuration.example: Importing from ID "yournamehere"...
-aws_s3_bucket_lifecycle_configuration.example: Import prepared!
-  Prepared aws_s3_bucket_lifecycle_configuration for import
-aws_s3_bucket_lifecycle_configuration.example: Refreshing state... [id=yournamehere]
-
-Import successful!
-
-The resources that were imported are shown above. These resources are now in
-your Terraform state and will henceforth be managed by Terraform.
-```
-
-#### For Lifecycle Rules with `prefix`
-
-For example, given this configuration:
-
-```terraform
-resource "aws_s3_bucket" "example" {
-  bucket = "yournamehere"
-
-  lifecycle_rule {
-    id      = "log-expiration"
-    enabled = true
-    prefix  = "foobar"
-
-    transition {
-      days          = 30
-      storage_class = "STANDARD_IA"
-    }
-
-    transition {
-      days          = 180
-      storage_class = "GLACIER"
-    }
-  }
-}
-```
-
-You will receive the following error after upgrading:
-
-```
-│ Error: Value for unconfigurable attribute
-│
-│   with aws_s3_bucket.example,
-│   on main.tf line 1, in resource "aws_s3_bucket" "example":
-│    1: resource "aws_s3_bucket" "example" {
-│
-│ Can't configure a value for "lifecycle_rule": its value will be decided automatically based on the result of applying this configuration.
-```
-
-Since the `lifecycle_rule` argument changed to read-only, update the configuration to use the `aws_s3_bucket_lifecycle_configuration`
-resource and remove `lifecycle_rule` and its nested arguments in the `aws_s3_bucket` resource:
-
-```terraform
-resource "aws_s3_bucket" "example" {
-  bucket = "yournamehere"
-
-  # ... other configuration ...
-}
-
-resource "aws_s3_bucket_lifecycle_configuration" "example" {
-  bucket = aws_s3_bucket.example.id
-
-  rule {
-    id     = "log-expiration"
-    status = "Enabled"
-
-    filter {
-      prefix = "foobar"
-    }
-
-    transition {
-      days          = 30
-      storage_class = "STANDARD_IA"
-    }
-
-    transition {
-      days          = 180
-      storage_class = "GLACIER"
-    }
-  }
-}
-```
-
-Run `terraform import` on each new resource, _e.g._,
-
-```shell
-$ terraform import aws_s3_bucket_lifecycle_configuration.example yournamehere
-aws_s3_bucket_lifecycle_configuration.example: Importing from ID "yournamehere"...
-aws_s3_bucket_lifecycle_configuration.example: Import prepared!
-  Prepared aws_s3_bucket_lifecycle_configuration for import
-aws_s3_bucket_lifecycle_configuration.example: Refreshing state... [id=yournamehere]
-
-Import successful!
-
-The resources that were imported are shown above. These resources are now in
-your Terraform state and will henceforth be managed by Terraform.
-```
-
-#### For Lifecycle Rules with `prefix` and `tags`
-
-For example, given this previous configuration:
-
-```terraform
-resource "aws_s3_bucket" "example" {
-  bucket = "yournamehere"
-
-  # ... other configuration ...
-  lifecycle_rule {
-    id      = "log"
-    enabled = true
-    prefix = "log/"
-
-    tags = {
-      rule      = "log"
-      autoclean = "true"
-    }
-
-    transition {
-      days          = 30
-      storage_class = "STANDARD_IA"
-    }
-
-    transition {
-      days          = 60
-      storage_class = "GLACIER"
-    }
-
-    expiration {
-      days = 90
-    }
-  }
-
-  lifecycle_rule {
-    id      = "tmp"
-    prefix  = "tmp/"
-    enabled = true
-
-    expiration {
-      date = "2022-12-31"
-    }
-  }
-}
-```
-
-You will get the following error after upgrading:
-
-```
-│ Error: Value for unconfigurable attribute
-│
-│   with aws_s3_bucket.example,
-│   on main.tf line 1, in resource "aws_s3_bucket" "example":
-│    1: resource "aws_s3_bucket" "example" {
-│
-│ Can't configure a value for "lifecycle_rule": its value will be decided automatically based on the result of applying this configuration.
-```
-
-Since `lifecycle_rule` is now read only, update your configuration to use the `aws_s3_bucket_lifecycle_configuration`
-resource and remove `lifecycle_rule` and its nested arguments in the `aws_s3_bucket` resource:
-
-```terraform
-resource "aws_s3_bucket" "example" {
-  bucket = "yournamehere"
-
-  # ... other configuration ...
-}
-
-resource "aws_s3_bucket_lifecycle_configuration" "example" {
-  bucket = aws_s3_bucket.example.id
-
-  rule {
-    id     = "log"
-    status = "Enabled"
-
-    filter {
-      and {
-        prefix = "log/"
-
-        tags = {
-          rule      = "log"
-          autoclean = "true"
-        }
-      }
-    }
-
-    transition {
-      days          = 30
-      storage_class = "STANDARD_IA"
-    }
-
-    transition {
-      days          = 60
-      storage_class = "GLACIER"
-    }
-
-    expiration {
-      days = 90
-    }
-  }
-
-  rule {
-    id = "tmp"
-
-    filter {
-      prefix  = "tmp/"
-    }
-
-    expiration {
-      date = "2022-12-31T00:00:00Z"
-    }
-
-    status = "Enabled"
-  }
-}
-```
-
-Run `terraform import` on each new resource, _e.g._,
-
-```shell
-$ terraform import aws_s3_bucket_lifecycle_configuration.example yournamehere
-aws_s3_bucket_lifecycle_configuration.example: Importing from ID "yournamehere"...
-aws_s3_bucket_lifecycle_configuration.example: Import prepared!
-  Prepared aws_s3_bucket_lifecycle_configuration for import
-aws_s3_bucket_lifecycle_configuration.example: Refreshing state... [id=yournamehere]
-
-Import successful!
-
-The resources that were imported are shown above. These resources are now in
-your Terraform state and will henceforth be managed by Terraform.
-```
-
-### `logging` Argument
-
-Switch your Terraform configuration to the [`aws_s3_bucket_logging` resource](/docs/providers/aws/r/s3_bucket_logging.html) instead.
-
-For example, given this previous configuration:
-
-```terraform
-resource "aws_s3_bucket" "log_bucket" {
-  # ... other configuration ...
-  bucket = "example-log-bucket"
-}
-
-resource "aws_s3_bucket" "example" {
-  bucket = "yournamehere"
-
-  # ... other configuration ...
-  logging {
-    target_bucket = aws_s3_bucket.log_bucket.id
-    target_prefix = "log/"
-  }
-}
-```
-
-You will get the following error after upgrading:
-
-```
-│ Error: Value for unconfigurable attribute
-│
-│   with aws_s3_bucket.example,
-│   on main.tf line 1, in resource "aws_s3_bucket" "example":
-│    1: resource "aws_s3_bucket" "example" {
-│
-│ Can't configure a value for "logging": its value will be decided automatically based on the result of applying this configuration.
-```
-
-Since `logging` is now read only, update your configuration to use the `aws_s3_bucket_logging`
-resource and remove `logging` and its nested arguments in the `aws_s3_bucket` resource:
-
-```terraform
-resource "aws_s3_bucket" "log_bucket" {
-  bucket = "example-log-bucket"
-
-  # ... other configuration ...
-}
-
-resource "aws_s3_bucket" "example" {
-  bucket = "yournamehere"
-
-  # ... other configuration ...
-}
-
-resource "aws_s3_bucket_logging" "example" {
-  bucket        = aws_s3_bucket.example.id
-  target_bucket = aws_s3_bucket.log_bucket.id
-  target_prefix = "log/"
-}
-```
-
-Run `terraform import` on each new resource, _e.g._,
-
-```shell
-$ terraform import aws_s3_bucket_logging.example yournamehere
-aws_s3_bucket_logging.example: Importing from ID "yournamehere"...
-aws_s3_bucket_logging.example: Import prepared!
-  Prepared aws_s3_bucket_logging for import
-aws_s3_bucket_logging.example: Refreshing state... [id=yournamehere]
-
-Import successful!
-
-The resources that were imported are shown above. These resources are now in
-your Terraform state and will henceforth be managed by Terraform.
-```
-
-### `object_lock_configuration` `rule` Argument
-
-Switch your Terraform configuration to the [`aws_s3_bucket_object_lock_configuration` resource](/docs/providers/aws/r/s3_bucket_object_lock_configuration.html) instead.
-
-For example, given this previous configuration:
-
-```terraform
-resource "aws_s3_bucket" "example" {
-  bucket = "yournamehere"
-
-  # ... other configuration ...
-  object_lock_configuration {
-    object_lock_enabled = "Enabled"
-
-    rule {
-      default_retention {
-        mode = "COMPLIANCE"
-        days = 3
-      }
-    }
-  }
-}
-```
-
-You will get the following error after upgrading:
-
-```
-│ Error: Value for unconfigurable attribute
-│
-│   with aws_s3_bucket.example,
-│   on main.tf line 1, in resource "aws_s3_bucket" "example":
-│    1: resource "aws_s3_bucket" "example" {
-│
-│ Can't configure a value for "object_lock_configuration.0.rule": its value will be decided automatically based on the result of applying this configuration.
-```
-
-Since the `rule` argument of the `object_lock_configuration` configuration block changed to read-only, update your configuration to use the `aws_s3_bucket_object_lock_configuration`
-resource and remove `rule` and its nested arguments in the `aws_s3_bucket` resource:
-
-```terraform
-resource "aws_s3_bucket" "example" {
-  bucket = "yournamehere"
-
-  # ... other configuration ...
-  object_lock_enabled = true
-}
-
-resource "aws_s3_bucket_object_lock_configuration" "example" {
-  bucket = aws_s3_bucket.example.id
-
-  rule {
-    default_retention {
-      mode = "COMPLIANCE"
-      days = 3
-    }
-  }
-}
-```
-
-Run `terraform import` on each new resource, _e.g._,
-
-```shell
-$ terraform import aws_s3_bucket_object_lock_configuration.example yournamehere
-aws_s3_bucket_object_lock_configuration.example: Importing from ID "yournamehere"...
-aws_s3_bucket_object_lock_configuration.example: Import prepared!
-  Prepared aws_s3_bucket_object_lock_configuration for import
-aws_s3_bucket_object_lock_configuration.example: Refreshing state... [id=yournamehere]
-
-Import successful!
-
-The resources that were imported are shown above. These resources are now in
-your Terraform state and will henceforth be managed by Terraform.
-```
-
-### `policy` Argument
-
-Switch your Terraform configuration to the [`aws_s3_bucket_policy` resource](/docs/providers/aws/r/s3_bucket_policy.html) instead.
-
-For example, given this previous configuration:
-
-```terraform
-resource "aws_s3_bucket" "example" {
-  bucket = "yournamehere"
-
-  # ... other configuration ...
-  policy = <<EOF
-{
-  "Id": "Policy1446577137248",
-  "Statement": [
-    {
-      "Action": "s3:PutObject",
-      "Effect": "Allow",
-      "Principal": {
-        "AWS": "${data.aws_elb_service_account.current.arn}"
-      },
-      "Resource": "arn:${data.aws_partition.current.partition}:s3:::yournamehere/*",
-      "Sid": "Stmt1446575236270"
-    }
-  ],
-  "Version": "2012-10-17"
-}
-EOF
-}
-```
-
-You will get the following error after upgrading:
-
-```
-│ Error: Value for unconfigurable attribute
-│
-│   with aws_s3_bucket.example,
-│   on main.tf line 1, in resource "aws_s3_bucket" "example":
-│    1: resource "aws_s3_bucket" "example" {
-│
-│ Can't configure a value for "policy": its value will be decided automatically based on the result of applying this configuration.
-```
-
-Since `policy` is now read only, update your configuration to use the `aws_s3_bucket_policy`
-resource and remove `policy` in the `aws_s3_bucket` resource:
-
-```terraform
-resource "aws_s3_bucket" "example" {
-  bucket = "yournamehere"
-
-  # ... other configuration ...
-}
-
-resource "aws_s3_bucket_policy" "example" {
-  bucket = aws_s3_bucket.example.id
-  policy = <<EOF
-{
-  "Id": "Policy1446577137248",
-  "Statement": [
-    {
-      "Action": "s3:PutObject",
-      "Effect": "Allow",
-      "Principal": {
-        "AWS": "${data.aws_elb_service_account.current.arn}"
-      },
-      "Resource": "${aws_s3_bucket.example.arn}/*",
-      "Sid": "Stmt1446575236270"
-    }
-  ],
-  "Version": "2012-10-17"
-}
-EOF
-}
-```
-
-Run `terraform import` on each new resource, _e.g._,
-
-```shell
-$ terraform import aws_s3_bucket_policy.example yournamehere
-aws_s3_bucket_policy.example: Importing from ID "yournamehere"...
-aws_s3_bucket_policy.example: Import prepared!
-  Prepared aws_s3_bucket_policy for import
-aws_s3_bucket_policy.example: Refreshing state... [id=yournamehere]
-
-Import successful!
-
-The resources that were imported are shown above. These resources are now in
-your Terraform state and will henceforth be managed by Terraform.
-```
-
-### `replication_configuration` Argument
-
-Switch your Terraform configuration to the [`aws_s3_bucket_replication_configuration` resource](/docs/providers/aws/r/s3_bucket_replication_configuration.html) instead.
-
-For example, given this previous configuration:
-
-```terraform
-resource "aws_s3_bucket" "example" {
-  provider = aws.central
-  bucket   = "yournamehere"
-
-  # ... other configuration ...
-
-  replication_configuration {
-    role = aws_iam_role.replication.arn
-    rules {
-      id     = "foobar"
-      status = "Enabled"
-      filter {
-        tags = {}
-      }
-      destination {
-        bucket        = aws_s3_bucket.destination.arn
-        storage_class = "STANDARD"
-        replication_time {
-          status  = "Enabled"
-          minutes = 15
-        }
-        metrics {
-          status  = "Enabled"
-          minutes = 15
-        }
-      }
-    }
-  }
-}
-```
-
-You will get the following error after upgrading:
-
-```
-│ Error: Value for unconfigurable attribute
-│
-│   with aws_s3_bucket.example,
-│   on main.tf line 1, in resource "aws_s3_bucket" "example":
-│    1: resource "aws_s3_bucket" "example" {
-│
-│ Can't configure a value for "replication_configuration": its value will be decided automatically based on the result of applying this configuration.
-```
-
-Since `replication_configuration` is now read only, update your configuration to use the `aws_s3_bucket_replication_configuration`
-resource and remove `replication_configuration` and its nested arguments in the `aws_s3_bucket` resource:
-
-```terraform
-resource "aws_s3_bucket" "example" {
-  provider = aws.central
-  bucket   = "yournamehere"
-
-  # ... other configuration ...
-}
-
-resource "aws_s3_bucket_replication_configuration" "example" {
-  bucket = aws_s3_bucket.example.id
-  role   = aws_iam_role.replication.arn
-
-  rule {
-    id     = "foobar"
-    status = "Enabled"
-
-    filter {}
-
-    delete_marker_replication {
-      status = "Enabled"
-    }
-
-    destination {
-      bucket        = aws_s3_bucket.destination.arn
-      storage_class = "STANDARD"
-
-      replication_time {
-        status = "Enabled"
-        time {
-          minutes = 15
-        }
-      }
-
-      metrics {
-        status = "Enabled"
-        event_threshold {
-          minutes = 15
-        }
-      }
-    }
-  }
-}
-```
-
-Run `terraform import` on each new resource, _e.g._,
-
-```shell
-$ terraform import aws_s3_bucket_replication_configuration.example yournamehere
-aws_s3_bucket_replication_configuration.example: Importing from ID "yournamehere"...
-aws_s3_bucket_replication_configuration.example: Import prepared!
-  Prepared aws_s3_bucket_replication_configuration for import
-aws_s3_bucket_replication_configuration.example: Refreshing state... [id=yournamehere]
-
-Import successful!
-
-The resources that were imported are shown above. These resources are now in
-your Terraform state and will henceforth be managed by Terraform.
-```
-
-### `request_payer` Argument
-
-Switch your Terraform configuration to the [`aws_s3_bucket_request_payment_configuration` resource](/docs/providers/aws/r/s3_bucket_request_payment_configuration.html) instead.
-
-For example, given this previous configuration:
-
-```terraform
-resource "aws_s3_bucket" "example" {
-  bucket = "yournamehere"
-
-  # ... other configuration ...
-  request_payer = "Requester"
-}
-```
-
-You will get the following error after upgrading:
-
-```
-│ Error: Value for unconfigurable attribute
-│
-│   with aws_s3_bucket.example,
-│   on main.tf line 1, in resource "aws_s3_bucket" "example":
-│    1: resource "aws_s3_bucket" "example" {
-│
-│ Can't configure a value for "request_payer": its value will be decided automatically based on the result of applying this configuration.
-```
-
-Since `request_payer` is now read only, update your configuration to use the `aws_s3_bucket_request_payment_configuration`
-resource and remove `request_payer` in the `aws_s3_bucket` resource:
-
-```terraform
-resource "aws_s3_bucket" "example" {
-  bucket = "yournamehere"
-
-  # ... other configuration ...
-}
-
-resource "aws_s3_bucket_request_payment_configuration" "example" {
-  bucket = aws_s3_bucket.example.id
-  payer  = "Requester"
-}
-```
-
-Run `terraform import` on each new resource, _e.g._,
-
-```shell
-$ terraform import aws_s3_bucket_request_payment_configuration.example yournamehere
-aws_s3_bucket_request_payment_configuration.example: Importing from ID "yournamehere"...
-aws_s3_bucket_request_payment_configuration.example: Import prepared!
-  Prepared aws_s3_bucket_request_payment_configuration for import
-aws_s3_bucket_request_payment_configuration.example: Refreshing state... [id=yournamehere]
-
-Import successful!
-
-The resources that were imported are shown above. These resources are now in
-your Terraform state and will henceforth be managed by Terraform.
-```
-
-### `server_side_encryption_configuration` Argument
-
-Switch your Terraform configuration to the [`aws_s3_bucket_server_side_encryption_configuration` resource](/docs/providers/aws/r/s3_bucket_server_side_encryption_configuration.html) instead.
-
-For example, given this previous configuration:
-
-```terraform
-resource "aws_s3_bucket" "example" {
-  bucket = "yournamehere"
-
-  # ... other configuration ...
-  server_side_encryption_configuration {
-    rule {
-      apply_server_side_encryption_by_default {
-        kms_master_key_id = aws_kms_key.mykey.arn
-        sse_algorithm     = "aws:kms"
-      }
-    }
-  }
-}
-```
-
-You will get the following error after upgrading:
-
-```
-│ Error: Value for unconfigurable attribute
-│
-│   with aws_s3_bucket.example,
-│   on main.tf line 1, in resource "aws_s3_bucket" "example":
-│    1: resource "aws_s3_bucket" "example" {
-│
-│ Can't configure a value for "server_side_encryption_configuration": its value will be decided automatically based on the result of applying this configuration.
-```
-
-Since `server_side_encryption_configuration` is now read only, update your configuration to use the `aws_s3_bucket_server_side_encryption_configuration`
-resource and remove `server_side_encryption_configuration` and its nested arguments in the `aws_s3_bucket` resource:
-
-```terraform
-resource "aws_s3_bucket" "example" {
-  bucket = "yournamehere"
-
-  # ... other configuration ...
-}
-
-resource "aws_s3_bucket_server_side_encryption_configuration" "example" {
-  bucket = aws_s3_bucket.example.id
-
-  rule {
-    apply_server_side_encryption_by_default {
-      kms_master_key_id = aws_kms_key.mykey.arn
-      sse_algorithm     = "aws:kms"
-    }
-  }
-}
-```
-
-Run `terraform import` on each new resource, _e.g._,
-
-```shell
-$ terraform import aws_s3_bucket_server_side_encryption_configuration.example yournamehere
-aws_s3_bucket_server_side_encryption_configuration.example: Importing from ID "yournamehere"...
-aws_s3_bucket_server_side_encryption_configuration.example: Import prepared!
-  Prepared aws_s3_bucket_server_side_encryption_configuration for import
-aws_s3_bucket_server_side_encryption_configuration.example: Refreshing state... [id=yournamehere]
-
-Import successful!
-
-The resources that were imported are shown above. These resources are now in
-your Terraform state and will henceforth be managed by Terraform.
-```
-
-### `versioning` Argument
-
-Switch your Terraform configuration to the [`aws_s3_bucket_versioning` resource](/docs/providers/aws/r/s3_bucket_versioning.html) instead.
-
-~> **NOTE:** As `aws_s3_bucket_versioning` is a separate resource, any S3 objects for which versioning is important (_e.g._, a truststore for mutual TLS authentication) must implicitly or explicitly depend on the `aws_s3_bucket_versioning` resource. Otherwise, the S3 objects may be created before versioning has been set. [See below](#ensure-objects-depend-on-versioning) for an example. Also note that AWS recommends waiting 15 minutes after enabling versioning on a bucket before putting or deleting objects in/from the bucket.
-
-#### Buckets With Versioning Enabled
-
-Given this previous configuration:
-
-```terraform
-resource "aws_s3_bucket" "example" {
-  bucket = "yournamehere"
-
-  # ... other configuration ...
-  versioning {
-    enabled = true
-  }
-}
-```
-
-You will get the following error after upgrading:
-
-```
-│ Error: Value for unconfigurable attribute
-│
-│   with aws_s3_bucket.example,
-│   on main.tf line 1, in resource "aws_s3_bucket" "example":
-│    1: resource "aws_s3_bucket" "example" {
-│
-│ Can't configure a value for "versioning": its value will be decided automatically based on the result of applying this configuration.
-```
-
-Since `versioning` is now read only, update your configuration to use the `aws_s3_bucket_versioning`
-resource and remove `versioning` and its nested arguments in the `aws_s3_bucket` resource:
-
-```terraform
-resource "aws_s3_bucket" "example" {
-  bucket = "yournamehere"
-
-  # ... other configuration ...
-}
-
-resource "aws_s3_bucket_versioning" "example" {
-  bucket = aws_s3_bucket.example.id
-  versioning_configuration {
-    status = "Enabled"
-  }
-}
-```
-
-Run `terraform import` on each new resource, _e.g._,
-
-```shell
-$ terraform import aws_s3_bucket_versioning.example yournamehere
-aws_s3_bucket_versioning.example: Importing from ID "yournamehere"...
-aws_s3_bucket_versioning.example: Import prepared!
-  Prepared aws_s3_bucket_versioning for import
-aws_s3_bucket_versioning.example: Refreshing state... [id=yournamehere]
-
-Import successful!
-
-The resources that were imported are shown above. These resources are now in
-your Terraform state and will henceforth be managed by Terraform.
-```
-
-#### Buckets With Versioning Disabled or Suspended
-
-Depending on the version of the Terraform AWS Provider you are migrating from, the interpretation of `versioning.enabled = false`
-in your `aws_s3_bucket` resource will differ and thus the migration to the `aws_s3_bucket_versioning` resource will also differ as follows.
-
-If you are migrating from the Terraform AWS Provider `v3.70.0` or later:
-
-* For new S3 buckets, `enabled = false` is synonymous to `Disabled`.
-* For existing S3 buckets, `enabled = false` is synonymous to `Suspended`.
-
-If you are migrating from an earlier version of the Terraform AWS Provider:
-
-* For both new and existing S3 buckets, `enabled = false` is synonymous to `Suspended`.
-
-Given this previous configuration :
-
-```terraform
-resource "aws_s3_bucket" "example" {
-  bucket = "yournamehere"
-
-  # ... other configuration ...
-  versioning {
-    enabled = false
-  }
-}
-```
-
-You will get the following error after upgrading:
-
-```
-│ Error: Value for unconfigurable attribute
-│
-│   with aws_s3_bucket.example,
-│   on main.tf line 1, in resource "aws_s3_bucket" "example":
-│    1: resource "aws_s3_bucket" "example" {
-│
-│ Can't configure a value for "versioning": its value will be decided automatically based on the result of applying this configuration.
-```
-
-Since `versioning` is now read only, update your configuration to use the `aws_s3_bucket_versioning`
-resource and remove `versioning` and its nested arguments in the `aws_s3_bucket` resource.
-
-* If migrating from Terraform AWS Provider `v3.70.0` or later and bucket versioning was never enabled:
-
-  ```terraform
-  resource "aws_s3_bucket" "example" {
-    bucket = "yournamehere"
-  
-    # ... other configuration ...
-  }
-  
-  resource "aws_s3_bucket_versioning" "example" {
-    bucket = aws_s3_bucket.example.id
-    versioning_configuration {
-      status = "Disabled"
-    }
-  }
-  ```
-
-* If migrating from Terraform AWS Provider `v3.70.0` or later and bucket versioning was enabled at one point:
-
-  ```terraform
-  resource "aws_s3_bucket" "example" {
-    bucket = "yournamehere"
-  
-    # ... other configuration ...
-  }
-  
-  resource "aws_s3_bucket_versioning" "example" {
-    bucket = aws_s3_bucket.example.id
-    versioning_configuration {
-      status = "Suspended"
-    }
-  }
-  ```
-
-* If migrating from an earlier version of Terraform AWS Provider:
-
-  ```terraform
-  resource "aws_s3_bucket" "example" {
-    bucket = "yournamehere"
-  
-    # ... other configuration ...
-  }
-  
-  resource "aws_s3_bucket_versioning" "example" {
-    bucket = aws_s3_bucket.example.id
-    versioning_configuration {
-      status = "Suspended"
-    }
-  }
-  ```
-
-Run `terraform import` on each new resource, _e.g._,
-
-```shell
-$ terraform import aws_s3_bucket_versioning.example yournamehere
-aws_s3_bucket_versioning.example: Importing from ID "yournamehere"...
-aws_s3_bucket_versioning.example: Import prepared!
-  Prepared aws_s3_bucket_versioning for import
-aws_s3_bucket_versioning.example: Refreshing state... [id=yournamehere]
-
-Import successful!
-
-The resources that were imported are shown above. These resources are now in
-your Terraform state and will henceforth be managed by Terraform.
-```
-
-#### Ensure Objects Depend on Versioning
-
-When you create an object whose `version_id` you need and an `aws_s3_bucket_versioning` resource in the same configuration, you are more likely to have success by ensuring the `s3_object` depends either implicitly (see below) or explicitly (i.e., using `depends_on = [aws_s3_bucket_versioning.example]`) on the `aws_s3_bucket_versioning` resource.
-
-~> **NOTE:** For critical and/or production S3 objects, do not create a bucket, enable versioning, and create an object in the bucket within the same configuration. Doing so will not allow the AWS-recommended 15 minutes between enabling versioning and writing to the bucket.
-
-This example shows the `aws_s3_object.example` depending implicitly on the versioning resource through the reference to `aws_s3_bucket_versioning.example.bucket` to define `bucket`:
-
-```terraform
-resource "aws_s3_bucket" "example" {
-  bucket = "yotto"
-}
-
-resource "aws_s3_bucket_versioning" "example" {
-  bucket = aws_s3_bucket.example.id
-
-  versioning_configuration {
-    status = "Enabled"
-  }
-}
-
-resource "aws_s3_object" "example" {
-  bucket = aws_s3_bucket_versioning.example.id
-  key    = "droeloe"
-  source = "example.txt"
-}
-```
-
-### `website`, `website_domain`, and `website_endpoint` Arguments
-
-Switch your Terraform configuration to the [`aws_s3_bucket_website_configuration` resource](/docs/providers/aws/r/s3_bucket_website_configuration.html) instead.
-
-For example, given this previous configuration:
-
-```terraform
-resource "aws_s3_bucket" "example" {
-  bucket = "yournamehere"
-
-  # ... other configuration ...
-  website {
-    index_document = "index.html"
-    error_document = "error.html"
-  }
-}
-```
-
-You will get the following error after upgrading:
-
-```
-│ Error: Value for unconfigurable attribute
-│
-│   with aws_s3_bucket.example,
-│   on main.tf line 1, in resource "aws_s3_bucket" "example":
-│    1: resource "aws_s3_bucket" "example" {
-│
-│ Can't configure a value for "website": its value will be decided automatically based on the result of applying this configuration.
-```
-
-Since `website` is now read only, update your configuration to use the `aws_s3_bucket_website_configuration`
-resource and remove `website` and its nested arguments in the `aws_s3_bucket` resource:
-
-```terraform
-resource "aws_s3_bucket" "example" {
-  bucket = "yournamehere"
-
-  # ... other configuration ...
-}
-
-resource "aws_s3_bucket_website_configuration" "example" {
-  bucket = aws_s3_bucket.example.id
-
-  index_document {
-    suffix = "index.html"
-  }
-
-  error_document {
-    key = "error.html"
-  }
-}
-```
-
-Run `terraform import` on each new resource, _e.g._,
-
-```shell
-$ terraform import aws_s3_bucket_website_configuration.example yournamehere
-aws_s3_bucket_website_configuration.example: Importing from ID "yournamehere"...
-aws_s3_bucket_website_configuration.example: Import prepared!
-  Prepared aws_s3_bucket_website_configuration for import
-aws_s3_bucket_website_configuration.example: Refreshing state... [id=yournamehere]
-
-Import successful!
-
-The resources that were imported are shown above. These resources are now in
-your Terraform state and will henceforth be managed by Terraform.
-```
-
-For example, if you use the `aws_s3_bucket` attribute `website_domain` with `aws_route53_record`, as shown below, you will need to update your configuration:
-
-```terraform
-resource "aws_route53_zone" "main" {
-  name = "domain.test"
-}
-
-resource "aws_s3_bucket" "website" {
-  # ... other configuration ...
-  website {
-    index_document = "index.html"
-    error_document = "error.html"
-  }
-}
-
-resource "aws_route53_record" "alias" {
-  zone_id = aws_route53_zone.main.zone_id
-  name    = "www"
-  type    = "A"
-
-  alias {
-    zone_id                = aws_s3_bucket.website.hosted_zone_id
-    name                   = aws_s3_bucket.website.website_domain
-    evaluate_target_health = true
-  }
-}
-```
-
-Instead, you will now use the `aws_s3_bucket_website_configuration` resource and its `website_domain` attribute:
-
-```terraform
-resource "aws_route53_zone" "main" {
-  name = "domain.test"
-}
-
-resource "aws_s3_bucket" "website" {
-  # ... other configuration ...
-}
-
-resource "aws_s3_bucket_website_configuration" "example" {
-  bucket = aws_s3_bucket.website.id
-
-  index_document {
-    suffix = "index.html"
-  }
-}
-
-resource "aws_route53_record" "alias" {
-  zone_id = aws_route53_zone.main.zone_id
-  name    = "www"
-  type    = "A"
-
-  alias {
-    zone_id                = aws_s3_bucket.website.hosted_zone_id
-    name                   = aws_s3_bucket_website_configuration.example.website_domain
-    evaluate_target_health = true
-  }
-}
-```
-
-## Full Resource Lifecycle of Default Resources
-
-Default subnets and vpcs can now do full resource lifecycle operations such that resource
-creation and deletion are now supported.
-
-### Resource: aws_default_subnet
-
-The `aws_default_subnet` resource behaves differently from normal resources in that if a default subnet exists in the specified Availability Zone, Terraform does not _create_ this resource, but instead "adopts" it into management.
-If no default subnet exists, Terraform creates a new default subnet.
-By default, `terraform destroy` does not delete the default subnet but does remove the resource from Terraform state.
-Set the `force_destroy` argument to `true` to delete the default subnet.
-
-For example, given this previous configuration with no existing default subnet:
-
-```terraform
-terraform {
-  required_providers {
-    aws = {
-      source = "hashicorp/aws"
-    }
-  }
-  required_version = ">= 0.13"
-}
-
-provider "aws" {
-  region = "eu-west-2"
-}
-
-resource "aws_default_subnet" "default" {}
-```
-
-The following error was thrown on `terraform apply`:
-
-```
-│ Error: Default subnet not found.
-│
-│   with aws_default_subnet.default,
-│   on main.tf line 5, in resource "aws_default_subnet" "default":
-│    5: resource "aws_default_subnet" "default" {}
-```
-
-Now after upgrading, the above configuration will apply successfully.
-
-To delete the default subnet, the above configuration should be updated as follows:
-
-```terraform
-terraform {
-  required_providers {
-    aws = {
-      source = "hashicorp/aws"
-    }
-  }
-  required_version = ">= 0.13"
-}
-
-resource "aws_default_subnet" "default" {
-  force_destroy = true
-}
-```
-
-### Resource: aws_default_vpc
-
-The `aws_default_vpc` resource behaves differently from normal resources in that if a default VPC exists, Terraform does not _create_ this resource, but instead "adopts" it into management.
-If no default VPC exists, Terraform creates a new default VPC, which leads to the implicit creation of [other resources](https://docs.aws.amazon.com/vpc/latest/userguide/default-vpc.html#default-vpc-components).
-By default, `terraform destroy` does not delete the default VPC but does remove the resource from Terraform state.
-Set the `force_destroy` argument to `true` to delete the default VPC.
-
-For example, given this previous configuration with no existing default VPC:
-
-```terraform
-terraform {
-  required_providers {
-    aws = {
-      source = "hashicorp/aws"
-    }
-  }
-  required_version = ">= 0.13"
-}
-
-resource "aws_default_vpc" "default" {}
-```
-
-The following error was thrown on `terraform apply`:
-
-```
-│ Error: No default VPC found in this region.
-│
-│   with aws_default_vpc.default,
-│   on main.tf line 5, in resource "aws_default_vpc" "default":
-│    5: resource "aws_default_vpc" "default" {}
-```
-
-Now after upgrading, the above configuration will apply successfully.
-
-To delete the default VPC, the above configuration should be updated to:
-
-```terraform
-terraform {
-  required_providers {
-    aws = {
-      source = "hashicorp/aws"
-    }
-  }
-  required_version = ">= 0.13"
-}
-
-resource "aws_default_vpc" "default" {
-  force_destroy = true
-}
-```
-
-## Plural Data Source Behavior
-
-The following plural data sources are now consistent with [Provider Design](https://hashicorp.github.io/terraform-provider-aws/provider-design/#plural-data-sources)
-such that they no longer return an error if zero results are found.
-
-* [aws_cognito_user_pools](/docs/providers/aws/d/cognito_user_pools.html)
-* [aws_db_event_categories](/docs/providers/aws/d/db_event_categories.html)
-* [aws_ebs_volumes](/docs/providers/aws/d/ebs_volumes.html)
-* [aws_ec2_coip_pools](/docs/providers/aws/d/ec2_coip_pools.html)
-* [aws_ec2_local_gateway_route_tables](/docs/providers/aws/d/ec2_local_gateway_route_tables.html)
-* [aws_ec2_local_gateway_virtual_interface_groups](/docs/providers/aws/d/ec2_local_gateway_virtual_interface_groups.html)
-* [aws_ec2_local_gateways](/docs/providers/aws/d/ec2_local_gateways.html)
-* [aws_ec2_transit_gateway_route_tables](/docs/providers/aws/d/ec2_transit_gateway_route_tables.html)
-* [aws_efs_access_points](/docs/providers/aws/d/efs_access_points.html)
-* [aws_emr_release_labels](/docs/providers/aws/d/emr_release_labels.markdown)
-* [aws_inspector_rules_packages](/docs/providers/aws/d/inspector_rules_packages.html)
-* [aws_ip_ranges](/docs/providers/aws/d/ip_ranges.html)
-* [aws_network_acls](/docs/providers/aws/d/network_acls.html)
-* [aws_route_tables](/docs/providers/aws/d/route_tables.html)
-* [aws_security_groups](/docs/providers/aws/d/security_groups.html)
-* [aws_ssoadmin_instances](/docs/providers/aws/d/ssoadmin_instances.html)
-* [aws_vpcs](/docs/providers/aws/d/vpcs.html)
-* [aws_vpc_peering_connections](/docs/providers/aws/d/vpc_peering_connections.html)
-
-## Empty Strings Not Valid For Certain Resources
-
-First, this is a breaking change but should affect very few configurations.
-
-Second, the motivation behind this change is that previously, you might set an argument to `""` to explicitly convey it is empty. However, with the introduction of `null` in Terraform 0.12 and to prepare for continuing enhancements that distinguish between unset arguments and those that have a value, including an empty string (`""`), we are moving away from this use of zero values. We ask practitioners to either use `null` instead or remove the arguments that are set to `""`.
-
-### Resource: aws_cloudwatch_event_target (Empty String)
-
-Previously, you could set `ecs_target.0.launch_type` to `""`. However, the value `""` is no longer valid. Now, set the argument to `null` (_e.g._, `launch_type = null`) or remove the empty-string configuration.
-
-For example, this type of configuration is now not valid:
-
-```terraform
-resource "aws_cloudwatch_event_target" "example" {
-  # ...
-  ecs_target {
-    task_count          = 1
-    task_definition_arn = aws_ecs_task_definition.task.arn
-    launch_type         = ""
-    # ...
-  }
-}
-```
-
-We fix this configuration by setting `launch_type` to `null`:
-
-```terraform
-resource "aws_cloudwatch_event_target" "example" {
-  # ...
-  ecs_target {
-    task_count          = 1
-    task_definition_arn = aws_ecs_task_definition.task.arn
-    launch_type         = null
-    # ...
-  }
-}
-```
-
-### Resource: aws_customer_gateway
-
-Previously, you could set `ip_address` to `""`, which would result in an AWS error. However, the provider now also gives an error.
-
-### Resource: aws_default_network_acl
-
-Previously, you could set `egress.*.cidr_block`, `egress.*.ipv6_cidr_block`, `ingress.*.cidr_block`, or `ingress.*.ipv6_cidr_block` to `""`. However, the value `""` is no longer valid. Now, set the argument to `null` (_e.g._, `ipv6_cidr_block = null`) or remove the empty-string configuration.
-
-For example, this type of configuration is now not valid:
-
-```terraform
-resource "aws_default_network_acl" "example" {
-  # ...
-  egress {
-    cidr_block      = "0.0.0.0/0"
-    ipv6_cidr_block = ""
-    # ...
-  }
-}
-```
-
-To fix this configuration, we remove the empty-string configuration:
-
-```terraform
-resource "aws_default_network_acl" "example" {
-  # ...
-  egress {
-    cidr_block = "0.0.0.0/0"
-    # ...
-  }
-}
-```
-
-### Resource: aws_default_route_table
-
-Previously, you could set `route.*.cidr_block` or `route.*.ipv6_cidr_block` to `""`. However, the value `""` is no longer valid. Now, set the argument to `null` (_e.g._, `ipv6_cidr_block = null`) or remove the empty-string configuration.
-
-For example, this type of configuration is now not valid:
-
-```terraform
-resource "aws_default_route_table" "example" {
-  # ...
-  route {
-    cidr_block      = local.ipv6 ? "" : local.destination
-    ipv6_cidr_block = local.ipv6 ? local.destination_ipv6 : ""
-  }
-}
-```
-
-We fix this configuration by using `null` instead of an empty string (`""`):
-
-```terraform
-resource "aws_default_route_table" "example" {
-  # ...
-  route {
-    cidr_block      = local.ipv6 ? null : local.destination
-    ipv6_cidr_block = local.ipv6 ? local.destination_ipv6 : null
-  }
-}
-```
-
-### Resource: aws_default_vpc (Empty String)
-
-Previously, you could set `ipv6_cidr_block` to `""`. However, the value `""` is no longer valid. Now, set the argument to `null` (_e.g._, `ipv6_cidr_block = null`) or remove the empty-string configuration.
-
-### Resource: aws_instance
-
-Previously, you could set `private_ip` to `""`. However, the value `""` is no longer valid. Now, set the argument to `null` (_e.g._, `private_ip = null`) or remove the empty-string configuration.
-
-For example, this type of configuration is now not valid:
-
-```terraform
-resource "aws_instance" "example" {
-  instance_type = "t2.micro"
-  private_ip    = ""
-}
-```
-
-We fix this configuration by removing the empty-string configuration:
-
-```terraform
-resource "aws_instance" "example" {
-  instance_type = "t2.micro"
-}
-```
-
-### Resource: aws_efs_mount_target
-
-Previously, you could set `ip_address` to `""`. However, the value `""` is no longer valid. Now, set the argument to `null` (_e.g._, `ip_address = null`) or remove the empty-string configuration.
-
-For example, this type of configuration is now not valid: `ip_address = ""`.
-
-### Resource: aws_elasticsearch_domain
-
-Previously, you could set `ebs_options.0.volume_type` to `""`. However, the value `""` is no longer valid. Now, set the argument to `null` (_e.g._, `volume_type = null`) or remove the empty-string configuration.
-
-For example, this type of configuration is now not valid:
-
-```terraform
-resource "aws_elasticsearch_domain" "example" {
-  # ...
-  ebs_options {
-    ebs_enabled = true
-    volume_size = var.volume_size
-    volume_type = var.volume_size > 0 ? local.volume_type : ""
-  }
-}
-```
-
-We fix this configuration by using `null` instead of `""`:
-
-```terraform
-resource "aws_elasticsearch_domain" "example" {
-  # ...
-  ebs_options {
-    ebs_enabled = true
-    volume_size = var.volume_size
-    volume_type = var.volume_size > 0 ? local.volume_type : null
-  }
-}
-```
-
-### Resource: aws_network_acl
-
-Previously, `egress.*.cidr_block`, `egress.*.ipv6_cidr_block`, `ingress.*.cidr_block`, and `ingress.*.ipv6_cidr_block` could be set to `""`. However, the value `""` is no longer valid. Now, set the argument to `null` (_e.g._, `ipv6_cidr_block = null`) or remove the empty-string configuration.
-
-For example, this type of configuration is now not valid:
-
-```terraform
-resource "aws_network_acl" "example" {
-  # ...
-  egress {
-    cidr_block      = "0.0.0.0/0"
-    ipv6_cidr_block = ""
-    # ...
-  }
-}
-```
-
-We fix this configuration by removing the empty-string configuration:
-
-```terraform
-resource "aws_network_acl" "example" {
-  # ...
-  egress {
-    cidr_block = "0.0.0.0/0"
-    # ...
-  }
-}
-```
-
-### Resource: aws_route
-
-Previously, `destination_cidr_block` and `destination_ipv6_cidr_block` could be set to `""`. However, the value `""` is no longer valid. Now, set the argument to `null` (_e.g._, `destination_ipv6_cidr_block = null`) or remove the empty-string configuration.
-
-In addition, now exactly one of `destination_cidr_block`, `destination_ipv6_cidr_block`, and `destination_prefix_list_id` can be set.
-
-For example, this type of configuration for `aws_route` is now not valid:
-
-```terraform
-resource "aws_route" "example" {
-  route_table_id = aws_route_table.example.id
-  gateway_id     = aws_internet_gateway.example.id
-
-  destination_cidr_block      = local.ipv6 ? "" : local.destination
-  destination_ipv6_cidr_block = local.ipv6 ? local.destination_ipv6 : ""
-}
-```
-
-We fix this configuration by using `null` instead of an empty-string (`""`):
-
-```terraform
-resource "aws_route" "example" {
-  route_table_id = aws_route_table.example.id
-  gateway_id     = aws_internet_gateway.example.id
-
-  destination_cidr_block      = local.ipv6 ? null : local.destination
-  destination_ipv6_cidr_block = local.ipv6 ? local.destination_ipv6 : null
-}
-```
-
-### Resource: aws_route_table
-
-Previously, `route.*.cidr_block` and `route.*.ipv6_cidr_block` could be set to `""`. However, the value `""` is no longer valid. Now, set the argument to `null` (_e.g._, `ipv6_cidr_block = null`) or remove the empty-string configuration.
-
-For example, this type of configuration is now not valid:
-
-```terraform
-resource "aws_route_table" "example" {
-  # ...
-  route {
-    cidr_block      = local.ipv6 ? "" : local.destination
-    ipv6_cidr_block = local.ipv6 ? local.destination_ipv6 : ""
-  }
-}
-```
-
-We fix this configuration by usingd `null` instead of an empty-string (`""`):
-
-```terraform
-resource "aws_route_table" "example" {
-  # ...
-  route {
-    cidr_block      = local.ipv6 ? null : local.destination
-    ipv6_cidr_block = local.ipv6 ? local.destination_ipv6 : null
-  }
-}
-```
-
-### Resource: aws_vpc
-
-Previously, `ipv6_cidr_block` could be set to `""`. However, the value `""` is no longer valid. Now, set the argument to `null` (_e.g._, `ipv6_cidr_block = null`) or remove the empty-string configuration.
-
-For example, this type of configuration is now not valid:
-
-```terraform
-resource "aws_vpc" "example" {
-  cidr_block      = "10.1.0.0/16"
-  ipv6_cidr_block = ""
-}
-```
-
-We fix this configuration by removing `ipv6_cidr_block`:
-
-```terraform
-resource "aws_vpc" "example" {
-  cidr_block      = "10.1.0.0/16"
-}
-```
-
-### Resource: aws_vpc_ipv6_cidr_block_association
-
-Previously, `ipv6_cidr_block` could be set to `""`. However, the value `""` is no longer valid. Now, set the argument to `null` (_e.g._, `ipv6_cidr_block = null`) or remove the empty-string configuration.
-
-## Data Source: aws_cloudwatch_log_group
-
-### Removal of arn Wildcard Suffix
-
-Previously, the data source returned the ARN directly from the API, which included a `:*` suffix to denote all CloudWatch Log Streams under the CloudWatch Log Group. Most other AWS resources that return ARNs and many other AWS services do not use the `:*` suffix. The suffix is now automatically removed. For example, the data source previously returned an ARN such as `arn:aws:logs:us-east-1:123456789012:log-group:/example:*` but will now return `arn:aws:logs:us-east-1:123456789012:log-group:/example`.
-
-Workarounds, such as using `replace()` as shown below, should be removed:
-
-```terraform
-data "aws_cloudwatch_log_group" "example" {
-  name = "example"
-}
-resource "aws_datasync_task" "example" {
-  # ... other configuration ...
-  cloudwatch_log_group_arn = replace(data.aws_cloudwatch_log_group.example.arn, ":*", "")
-}
-```
-
-Removing the `:*` suffix is a breaking change for some configurations. Fix these configurations using string interpolations as demonstrated below. For example, this configuration is now broken:
-
-```terraform
-data "aws_iam_policy_document" "ad-log-policy" {
-  statement {
-    actions = [
-      "logs:CreateLogStream",
-      "logs:PutLogEvents"
-    ]
-    principals {
-      identifiers = ["ds.amazonaws.com"]
-      type        = "Service"
-    }
-    resources = [data.aws_cloudwatch_log_group.example.arn]
-    effect = "Allow"
-  }
-}
-```
-
-An updated configuration:
-
-```terraform
-data "aws_iam_policy_document" "ad-log-policy" {
-  statement {
-    actions = [
-      "logs:CreateLogStream",
-      "logs:PutLogEvents"
-    ]
-    principals {
-      identifiers = ["ds.amazonaws.com"]
-      type        = "Service"
-    }
-    resources = ["${data.aws_cloudwatch_log_group.example.arn}:*"]
-    effect = "Allow"
-  }
-}
-```
-
-## Data Source: aws_subnet_ids
-
-The `aws_subnet_ids` data source has been deprecated and will be removed in a future version. Use the `aws_subnets` data source instead.
-
-For example, change a configuration such as
-
-```hcl
-data "aws_subnet_ids" "example" {
-  vpc_id = var.vpc_id
-}
-
-data "aws_subnet" "example" {
-  for_each = data.aws_subnet_ids.example.ids
-  id       = each.value
-}
-
-output "subnet_cidr_blocks" {
-  value = [for s in data.aws_subnet.example : s.cidr_block]
-}
-```
-
-to
-
-```hcl
-data "aws_subnets" "example" {
-  filter {
-    name   = "vpc-id"
-    values = [var.vpc_id]
-  }
-}
-
-data "aws_subnet" "example" {
-  for_each = data.aws_subnets.example.ids
-  id       = each.value
-}
-
-output "subnet_cidr_blocks" {
-  value = [for s in data.aws_subnet.example : s.cidr_block]
-}
-```
-
-## Data Source: aws_s3_bucket_object
-
-Version 4.x deprecates the `aws_s3_bucket_object` data source. Maintainers will remove it in a future version. Use `aws_s3_object` instead, where new features and fixes will be added.
-
-## Data Source: aws_s3_bucket_objects
-
-Version 4.x deprecates the `aws_s3_bucket_objects` data source. Maintainers will remove it in a future version. Use `aws_s3_objects` instead, where new features and fixes will be added.
-
-## Resource: aws_batch_compute_environment
-
-You can no longer specify `compute_resources` when `type` is `UNMANAGED`.
-
-Previously, you could apply this configuration and the provider would ignore any compute resources:
-
-```hcl
-resource "aws_batch_compute_environment" "test" {
-  compute_environment_name = "test"
-
-  compute_resources {
-    instance_role = aws_iam_instance_profile.ecs_instance.arn
-    instance_type = [
-      "c4.large",
-    ]
-    max_vcpus = 16
-    min_vcpus = 0
-    security_group_ids = [
-      aws_security_group.test.id
-    ]
-    subnets = [
-      aws_subnet.test.id
-    ]
-    type = "EC2"
-  }
-
-  service_role = aws_iam_role.batch_service.arn
-  type         = "UNMANAGED"
-}
-```
-
-Now, this configuration is invalid and will result in an error during plan.
-
-To resolve this error, simply remove or comment out the `compute_resources` configuration block.
-
-```hcl
-resource "aws_batch_compute_environment" "test" {
-  compute_environment_name = "test"
-
-  service_role = aws_iam_role.batch_service.arn
-  type         = "UNMANAGED"
-}
-```
-
-## Resource: aws_cloudwatch_event_target
-
-### Removal of `ecs_target` `launch_type` default value
-
-Previously, the provider assigned `ecs_target` `launch_type` the default value of `EC2` if you did not configure a value. However, the provider no longer assigns a default value.
-
-For example, previously you could workaround the default value by using an empty string (`""`), as shown:
-
-```terraform
-resource "aws_cloudwatch_event_target" "test" {
-  arn      = aws_ecs_cluster.test.id
-  rule     = aws_cloudwatch_event_rule.test.id
-  role_arn = aws_iam_role.test.arn
-  ecs_target {
-    launch_type         = ""
-    task_count          = 1
-    task_definition_arn = aws_ecs_task_definition.task.arn
-    network_configuration {
-      subnets = [aws_subnet.subnet.id]
-    }
-  }
-}
-```
-
-This is no longer necessary. We fix the configuration by removing the empty string assignment:
-
-```terraform
-resource "aws_cloudwatch_event_target" "test" {
-  arn      = aws_ecs_cluster.test.id
-  rule     = aws_cloudwatch_event_rule.test.id
-  role_arn = aws_iam_role.test.arn
-  ecs_target {
-    task_count          = 1
-    task_definition_arn = aws_ecs_task_definition.task.arn
-    network_configuration {
-      subnets = [aws_subnet.subnet.id]
-    }
-  }
-}
-```
-
-## Resource: aws_elasticache_cluster
-
-### Error raised if neither `engine` nor `replication_group_id` is specified
-
-Previously, when you did not specify either `engine` or `replication_group_id`, Terraform would not prevent you from applying the invalid configuration.
-Now, this will produce an error similar to the one below:
-
-```
-Error: Invalid combination of arguments
-
-          with aws_elasticache_cluster.example,
-          on terraform_plugin_test.tf line 2, in resource "aws_elasticache_cluster" "example":
-           2: resource "aws_elasticache_cluster" "example" {
-
-        "replication_group_id": one of `engine,replication_group_id` must be
-        specified
-
-        Error: Invalid combination of arguments
-
-          with aws_elasticache_cluster.example,
-          on terraform_plugin_test.tf line 2, in resource "aws_elasticache_cluster" "example":
-           2: resource "aws_elasticache_cluster" "example" {
-
-        "engine": one of `engine,replication_group_id` must be specified
-```
-
-Update your configuration to supply one of `engine` or `replication_group_id`.
-
-## Resource: aws_elasticache_global_replication_group
-
-### actual_engine_version Attribute removal
-
-Switch your Terraform configuration from using `actual_engine_version` to use the `engine_version_actual` attribute instead.
-
-For example, given this previous configuration:
-
-```terraform
-output "elasticache_global_replication_group_version_result" {
-  value = aws_elasticache_global_replication_group.example.actual_engine_version
-}
-```
-
-An updated configuration:
-
-```terraform
-output "elasticache_global_replication_group_version_result" {
-  value = aws_elasticache_global_replication_group.example.engine_version_actual
-}
-```
-
-## Resource: aws_fsx_ontap_storage_virtual_machine
-
-We removed the misspelled argument `active_directory_configuration.0.self_managed_active_directory_configuration.0.organizational_unit_distinguidshed_name` that we previously deprecated. Use `active_directory_configuration.0.self_managed_active_directory_configuration.0.organizational_unit_distinguished_name` now instead. Terraform will automatically migrate the state to `active_directory_configuration.0.self_managed_active_directory_configuration.0.organizational_unit_distinguished_name` during planning.
-
-## Resource: aws_lb_target_group
-
-For `protocol = "TCP"`, you can no longer set `stickiness.type` to `lb_cookie` even when `enabled = false`. Instead, either change the `protocol` to `"HTTP"` or `"HTTPS"`, or change `stickiness.type` to `"source_ip"`.
-
-For example, this configuration is no longer valid:
-
-```terraform
-resource "aws_lb_target_group" "test" {
-  port        = 25
-  protocol    = "TCP"
-  vpc_id      = aws_vpc.test.id
-
-  stickiness {
-    type    = "lb_cookie"
-    enabled = false
-  }
-}
-```
-
-To fix this, we change the `stickiness.type` to `"source_ip"`.
-
-```terraform
-resource "aws_lb_target_group" "test" {
-  port        = 25
-  protocol    = "TCP"
-  vpc_id      = aws_vpc.test.id
-
-  stickiness {
-    type    = "source_ip"
-    enabled = false
-  }
-}
-```
-
-## Resource: aws_s3_bucket_object
-
-Version 4.x deprecates the `aws_s3_bucket_object` and maintainers will remove it in a future version. Use `aws_s3_object` instead, where new features and fixes will be added.
-
-When replacing `aws_s3_bucket_object` with `aws_s3_object` in your configuration, on the next apply, Terraform will recreate the object. If you prefer to not have Terraform recreate the object, import the object using `aws_s3_object`.
-
-For example, the following will import an S3 object into state, assuming the configuration exists, as `aws_s3_object.example`:
-
-```console
-% terraform import aws_s3_object.example s3://some-bucket-name/some/key.txt
-```
-
-~> **CAUTION:** We do not recommend modifying the state file manually. If you do, you can make it unusable. However, if you accept that risk, some community members have upgraded to the new resource by searching and replacing `"type": "aws_s3_bucket_object",` with `"type": "aws_s3_object",` in the state file, and then running `terraform apply -refresh-only`.
-
-## EC2-Classic Resource and Data Source Support
-
-While an upgrade to this major version will not directly impact EC2-Classic resources configured with Terraform,
-it is important to keep in the mind the following AWS Provider resources will eventually no longer
-be compatible with EC2-Classic as AWS completes their EC2-Classic networking retirement (expected around August 15, 2022).
-
-* Running or stopped [EC2 instances](/docs/providers/aws/r/instance.html)
-* Running or stopped [RDS database instances](/docs/providers/aws/r/db_instance.html)
-* [Elastic IP addresses](/docs/providers/aws/r/eip.html)
-* [Classic Load Balancers](/docs/providers/aws/r/lb.html)
-* [Redshift clusters](/docs/providers/aws/r/redshift_cluster.html)
-* [Elastic Beanstalk environments](/docs/providers/aws/r/elastic_beanstalk_environment.html)
-* [EMR clusters](/docs/providers/aws/r/emr_cluster.html)
-* [AWS Data Pipelines pipelines](/docs/providers/aws/r/datapipeline_pipeline.html)
-* [ElastiCache clusters](/docs/providers/aws/r/elasticache_cluster.html)
-* [Spot Requests](/docs/providers/aws/r/spot_instance_request.html)
-* [Capacity Reservations](/docs/providers/aws/r/ec2_capacity_reservation.html)
-
-## Macie Classic Resource Support
-
-These resources should be considered deprecated and will be removed in version 5.0.0.
-
-* [Account Associations](/docs/providers/aws/r/macie_member_account_association.html)
-* [S3 Bucket Associations](/docs/providers/aws/r/macie_s3_bucket_association.html)
diff --git a/website/docs/guides/version-5-upgrade.html.md b/website/docs/guides/version-5-upgrade.html.markdown
similarity index 100%
rename from website/docs/guides/version-5-upgrade.html.md
rename to website/docs/guides/version-5-upgrade.html.markdown
diff --git a/website/docs/index.html.markdown b/website/docs/index.html.markdown
index 43108c6aa4a..89c1db34342 100644
--- a/website/docs/index.html.markdown
+++ b/website/docs/index.html.markdown
@@ -11,7 +11,7 @@ Use the Amazon Web Services (AWS) provider to interact with the
 many resources supported by AWS. You must configure the provider
 with the proper credentials before you can use it.
 
-Use the navigation to the left to read about the available resources.
+Use the navigation to the left to read about the available resources. There are currently 1270 resources and 520 data sources available in the provider.
 
 To learn the basics of Terraform using this provider, follow the
 hands-on [get started tutorials](https://learn.hashicorp.com/tutorials/terraform/infrastructure-as-code?in=terraform/aws-get-started&utm_source=WEBSITE&utm_medium=WEB_IO&utm_offer=ARTICLE_PAGE&utm_content=DOCS). Interact with AWS services,
@@ -27,7 +27,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "~> 4.0"
+      version = "~> 5.0"
     }
   }
 }
@@ -48,7 +48,7 @@ Terraform 0.12 and earlier:
 ```terraform
 # Configure the AWS Provider
 provider "aws" {
-  version = "~> 4.0"
+  version = "~> 5.0"
   region  = "us-east-1"
 }
 
@@ -118,11 +118,11 @@ For example:
 provider "aws" {}
 ```
 
-```sh
-$ export AWS_ACCESS_KEY_ID="anaccesskey"
-$ export AWS_SECRET_ACCESS_KEY="asecretkey"
-$ export AWS_REGION="us-west-2"
-$ terraform plan
+```console
+% export AWS_ACCESS_KEY_ID="anaccesskey"
+% export AWS_SECRET_ACCESS_KEY="asecretkey"
+% export AWS_REGION="us-west-2"
+% terraform plan
 ```
 
 Other environment variables related to authorization are:
@@ -241,30 +241,33 @@ credential_process = custom-process --username jdoe
 |Retry Mode|`retry_mode`|`AWS_RETRY_MODE`|`retry_mode`|
 |Shared Config Files|`shared_config_files`|`AWS_CONFIG_FILE`|N/A|
 |Shared Credentials Files|`shared_credentials_files`|`AWS_SHARED_CREDENTIALS_FILE`|N/A|
+|S3 Use Regional Endpoint for `us-east-1`|`s3_us_east_1_regional_endpoint`|`AWS_S3_US_EAST_1_REGIONAL_ENDPOINT`|`s3_us_east_1_regional_endpoint`|
 |Use DualStack Endpoints|`use_dualstack_endpoint`|`AWS_USE_DUALSTACK_ENDPOINT`|`use_dualstack_endpoint`|
 |Use FIPS Endpoints|`use_fips_endpoint`|`AWS_USE_FIPS_ENDPOINT`|`use_fips_endpoint`|
 
+[envvars]: https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-envvars.html
+[config]: https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-files.html#cli-configure-files-settings
+
 ### Assume Role Configuration Reference
 
 Configuation for assuming an IAM role can be done using provider configuration or a named profile in shared configuration files.
 In the provider, all parameters for assuming an IAM role are set in the `assume_role` block.
 
-See the [assume role documentation](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-role.html) for more information.
+Note that environment variables are not supported for assuming IAM roles.
 
-|Setting|Provider|[Environment Variable][envvars]|[Shared Config][config]|
-|-------|--------|--------|-----------------------|
-|Role ARN|`role_arn`|`AWS_ROLE_ARN`|`role_arn`|
-|Duration|`duration` or `duration_seconds`|N/A|`duration_seconds`|
-|External ID|`external_id`|N/A|`external_id`|
-|Policy|`policy`|N/A|N/A|
-|Policy ARNs|`policy_arns`|N/A|N/A|
-|Session Name|`session_name`|`AWS_ROLE_SESSION_NAME`|`role_session_name`|
-|Source Identity|`source_identity`|N/A|N/A|
-|Tags|`tags`|N/A|N/A|
-|Transitive Tag Keys|`transitive_tag_keys`|N/A|N/A|
+See the [assume role documentation](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-role.html) for more information.
 
-[envvars]: https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-envvars.html
-[config]: https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-files.html#cli-configure-files-settings
+|Setting|Provider|[Shared Config][config]|
+|-------|--------|-----------------------|
+|Role ARN|`role_arn`|`role_arn`|
+|Duration|`duration`|`duration_seconds`|
+|External ID|`external_id`|`external_id`|
+|Policy|`policy`|N/A|
+|Policy ARNs|`policy_arns`|N/A|
+|Session Name|`session_name`|`role_session_name`|
+|Source Identity|`source_identity`|N/A|
+|Tags|`tags`|N/A|
+|Transitive Tag Keys|`transitive_tag_keys`|N/A|
 
 ### Assume Role with Web Identity Configuration Reference
 
@@ -287,8 +290,8 @@ See the assume role documentation [section on web identities](https://docs.aws.a
 
 By default, the underlying AWS client used by the Terraform AWS Provider creates requests with User-Agent headers including information about Terraform and AWS SDK for Go versions. To provide additional information in the User-Agent headers, the `TF_APPEND_USER_AGENT` environment variable can be set and its value will be directly added to HTTP requests. E.g.,
 
-```sh
-$ export TF_APPEND_USER_AGENT="JenkinsAgent/i-12345678 BuildID/1234 (Optional Extra Information)"
+```console
+% export TF_APPEND_USER_AGENT="JenkinsAgent/i-12345678 BuildID/1234 (Optional Extra Information)"
 ```
 
 ## Argument Reference
@@ -326,7 +329,13 @@ In addition to [generic `provider` arguments](https://www.terraform.io/docs/conf
 * `retry_mode` - (Optional) Specifies how retries are attempted.
   Valid values are `standard` and `adaptive`.
   Can also be configured using the `AWS_RETRY_MODE` environment variable or the shared config file parameter `retry_mode`.
-* `s3_use_path_style` - (Optional) Whether to enable the request to use path-style addressing, i.e., `https://s3.amazonaws.com/BUCKET/KEY`. By default, the S3 client will use virtual hosted bucket addressing, `https://BUCKET.s3.amazonaws.com/KEY`, when possible. Specific to the Amazon S3 service.
+* `s3_use_path_style` - (Optional) Whether to enable the request to use path-style addressing, i.e., `https://s3.amazonaws.com/BUCKET/KEY`.
+  By default, the S3 client will use virtual hosted bucket addressing, `https://BUCKET.s3.amazonaws.com/KEY`, when possible.
+  Specific to the Amazon S3 service.
+* `s3_us_east_1_regional_endpoint` - (Optional) Specifies whether S3 API calls in the `us-east-1` region use the legacy global endpoint or a regional endpoint.
+  Valid values are `legacy` or `regional`.
+  Can also be configured using the `AWS_S3_US_EAST_1_REGIONAL_ENDPOINT` environment variable or the `s3_us_east_1_regional_endpoint` shared config file parameter.
+  Specific to the Amazon S3 service.
 * `secret_key` - (Optional) AWS secret key. Can also be set with the `AWS_SECRET_ACCESS_KEY` environment variable, or via a shared configuration and credentials files if `profile` is used. See also `access_key`.
 * `shared_config_files` - (Optional) List of paths to AWS shared config files. If not set, the default is `[~/.aws/config]`. A single value can also be set with the `AWS_CONFIG_FILE` environment variable.
 * `shared_credentials_files` - (Optional) List of paths to the shared credentials file. If not set and a profile is used, the default value is `[~/.aws/credentials]`. A single value can also be set with the `AWS_SHARED_CREDENTIALS_FILE` environment variable.
@@ -458,11 +467,7 @@ In addition to [generic `provider` arguments](https://www.terraform.io/docs/conf
 
 The `assume_role` configuration block supports the following arguments:
 
-* `duration` - (Optional, Conflicts with `duration_seconds`) Duration of the assume role session.
-  You can provide a value from 15 minutes up to the maximum session duration setting for the role.
-  Represented by a string such as `1h`, `2h45m`, or `30m15s`.
-* `duration_seconds` - (Optional, **Deprecated** use `duration` instead) Number of seconds to restrict the assume role session duration.
-  You can provide a value from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
+* `duration` - (Optional) Duration of the assume role session. You can provide a value from 15 minutes up to the maximum session duration setting for the role. Represented by a string such as `1h`, `2h45m`, or `30m15s`.
 * `external_id` - (Optional) External identifier to use when assuming the role.
 * `policy` - (Optional) IAM Policy JSON describing further restricting permissions for the IAM Role being assumed.
 * `policy_arns` - (Optional) Set of Amazon Resource Names (ARNs) of IAM Policies describing further restricting permissions for the IAM Role being assumed.
diff --git a/website/docs/r/accessanalyzer_analyzer.html.markdown b/website/docs/r/accessanalyzer_analyzer.html.markdown
index d20881153ff..263d391344b 100644
--- a/website/docs/r/accessanalyzer_analyzer.html.markdown
+++ b/website/docs/r/accessanalyzer_analyzer.html.markdown
@@ -46,9 +46,9 @@ The following arguments are optional:
 * `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 * `type` - (Optional) Type of Analyzer. Valid values are `ACCOUNT` or `ORGANIZATION`. Defaults to `ACCOUNT`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the Analyzer.
 * `id` - Analyzer name.
@@ -56,8 +56,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Access Analyzer Analyzers can be imported using the `analyzer_name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Access Analyzer Analyzers using the `analyzer_name`. For example:
 
+```terraform
+import {
+  to = aws_accessanalyzer_analyzer.example
+  id = "example"
+}
 ```
-$ terraform import aws_accessanalyzer_analyzer.example example
+
+Using `terraform import`, import Access Analyzer Analyzers using the `analyzer_name`. For example:
+
+```console
+% terraform import aws_accessanalyzer_analyzer.example example
 ```
diff --git a/website/docs/r/accessanalyzer_archive_rule.html.markdown b/website/docs/r/accessanalyzer_archive_rule.html.markdown
index 28065de3031..03651b6830f 100644
--- a/website/docs/r/accessanalyzer_archive_rule.html.markdown
+++ b/website/docs/r/accessanalyzer_archive_rule.html.markdown
@@ -54,16 +54,25 @@ The following arguments are required:
 * `exists` - (Optional) Boolean comparator.
 * `neq` - (Optional) Not Equals comparator.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Resource ID in the format: `analyzer_name/rule_name`.
 
 ## Import
 
-AccessAnalyzer ArchiveRule can be imported using the `analyzer_name/rule_name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AccessAnalyzer ArchiveRule using the `analyzer_name/rule_name`. For example:
 
+```terraform
+import {
+  to = aws_accessanalyzer_archive_rule.example
+  id = "example-analyzer/example-rule"
+}
 ```
-$ terraform import aws_accessanalyzer_archive_rule.example example-analyzer/example-rule
+
+Using `terraform import`, import AccessAnalyzer ArchiveRule using the `analyzer_name/rule_name`. For example:
+
+```console
+% terraform import aws_accessanalyzer_archive_rule.example example-analyzer/example-rule
 ```
diff --git a/website/docs/r/account_alternate_contact.html.markdown b/website/docs/r/account_alternate_contact.html.markdown
index a77178122db..dcb8a239388 100644
--- a/website/docs/r/account_alternate_contact.html.markdown
+++ b/website/docs/r/account_alternate_contact.html.markdown
@@ -26,7 +26,7 @@ resource "aws_account_alternate_contact" "operations" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `account_id` - (Optional) ID of the target account when managing member accounts. Will manage current user's account by default if omitted.
 * `alternate_contact_type` - (Required) Type of the alternate contact. Allowed values are: `BILLING`, `OPERATIONS`, `SECURITY`.
@@ -35,9 +35,9 @@ The following arguments are supported:
 * `phone_number` - (Required) Phone number for the alternate contact.
 * `title` - (Required) Title for the alternate contact.
 
-## Attributes Reference
+## Attribute Reference
 
-No additional attributes are exported.
+This resource exports no additional attributes.
 
 ## Timeouts
 
@@ -49,14 +49,36 @@ No additional attributes are exported.
 
 ## Import
 
-The Alternate Contact for the current account can be imported using the `alternate_contact_type`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import the Alternate Contact for the current or another account using the `alternate_contact_type`. For example:
 
+Import the Alternate Contact for the current account:
+
+```terraform
+import {
+  to = aws_account_alternate_contact.operations
+  id = "OPERATIONS"
+}
 ```
-$ terraform import aws_account_alternate_contact.operations OPERATIONS
+
+Import the Alternate Contact for another account using the `account_id` and `alternate_contact_type` separated by a forward slash (`/`):
+
+```terraform
+import {
+  to = aws_account_alternate_contact.operations
+  id = "1234567890/OPERATIONS"
+}
 ```
 
-If you provide an account ID, the Alternate Contact can be imported using the `account_id` and `alternate_contact_type` separated by a forward slash (`/`) e.g.,
+**Using `terraform import` to import** the Alternate Contact for the current or another account using the `alternate_contact_type`. For example:
+
+Import the Alternate Contact for the current account:
 
+```console
+% terraform import aws_account_alternate_contact.operations OPERATIONS
 ```
-$ terraform import aws_account_alternate_contact.operations 1234567890/OPERATIONS
+
+Import the Alternate Contact for another account using the `account_id` and `alternate_contact_type` separated by a forward slash (`/`):
+
+```console
+% terraform import aws_account_alternate_contact.operations 1234567890/OPERATIONS
 ```
diff --git a/website/docs/r/account_primary_contact.html.markdown b/website/docs/r/account_primary_contact.html.markdown
index 3f4f4eead73..b45c0b9e1c0 100644
--- a/website/docs/r/account_primary_contact.html.markdown
+++ b/website/docs/r/account_primary_contact.html.markdown
@@ -29,7 +29,7 @@ resource "aws_account_primary_contact" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `account_id` - (Optional) The ID of the target account when managing member accounts. Will manage current user's account by default if omitted.
 * `address_line_1` - (Required) The first line of the primary contact address.
@@ -45,14 +45,23 @@ The following arguments are supported:
 * `state_or_region` - (Optional) The state or region of the primary contact address. This field is required in selected countries.
 * `website_url` - (Optional) The URL of the website associated with the primary contact information, if any.
 
-## Attributes Reference
+## Attribute Reference
 
-No additional attributes are exported.
+This resource exports no additional attributes.
 
 ## Import
 
-The Primary Contact can be imported using the `account_id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import the Primary Contact using the `account_id`. For example:
 
+```terraform
+import {
+  to = aws_account_primary_contact.test
+  id = "1234567890"
+}
 ```
-$ terraform import aws_account_primary_contact.test 1234567890
+
+Using `terraform import`, import the Primary Contact using the `account_id`. For example:
+
+```console
+% terraform import aws_account_primary_contact.test 1234567890
 ```
diff --git a/website/docs/r/acm_certificate.html.markdown b/website/docs/r/acm_certificate.html.markdown
index 79cb0376693..2c57b494e9a 100644
--- a/website/docs/r/acm_certificate.html.markdown
+++ b/website/docs/r/acm_certificate.html.markdown
@@ -138,7 +138,7 @@ resource "aws_route53_record" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * Creating an Amazon issued certificate
     * `domain_name` - (Required) Domain name for which the certificate should be issued
@@ -177,9 +177,9 @@ Supported nested arguments for the `validation_option` configuration block:
 * `domain_name` - (Required) Fully qualified domain name (FQDN) in the certificate.
 * `validation_domain` - (Required) Domain name that you want ACM to use to send you validation emails. This domain name is the suffix of the email addresses that you want ACM to use. This must be the same as the `domain_name` value or a superdomain of the `domain_name` value. For example, if you request a certificate for `"testing.example.com"`, you can specify `"example.com"` for this value.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - ARN of the certificate
 * `arn` - ARN of the certificate
@@ -213,8 +213,17 @@ Renewal summary objects export the following attributes:
 
 ## Import
 
-Certificates can be imported using their ARN, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import certificates using their ARN. For example:
 
+```terraform
+import {
+  to = aws_acm_certificate.cert
+  id = "arn:aws:acm:eu-central-1:123456789012:certificate/7e7a28d2-163f-4b8f-b9cd-822f96c08d6a"
+}
 ```
-$ terraform import aws_acm_certificate.cert arn:aws:acm:eu-central-1:123456789012:certificate/7e7a28d2-163f-4b8f-b9cd-822f96c08d6a
+
+Using `terraform import`, import certificates using their ARN. For example:
+
+```console
+% terraform import aws_acm_certificate.cert arn:aws:acm:eu-central-1:123456789012:certificate/7e7a28d2-163f-4b8f-b9cd-822f96c08d6a
 ```
diff --git a/website/docs/r/acm_certificate_validation.html.markdown b/website/docs/r/acm_certificate_validation.html.markdown
index 751c3c6d120..7c4d0a4d66b 100644
--- a/website/docs/r/acm_certificate_validation.html.markdown
+++ b/website/docs/r/acm_certificate_validation.html.markdown
@@ -127,14 +127,14 @@ resource "aws_acm_certificate_validation" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `certificate_arn` - (Required) ARN of the certificate that is being validated.
 * `validation_record_fqdns` - (Optional) List of FQDNs that implement the validation. Only valid for DNS validation method ACM certificates. If this is set, the resource can implement additional sanity checks and has an explicit dependency on the resource that is implementing the validation
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Time at which the certificate was issued
 
diff --git a/website/docs/r/acmpca_certificate.html.markdown b/website/docs/r/acmpca_certificate.html.markdown
index e3555721fb6..af2f8fa9fdf 100644
--- a/website/docs/r/acmpca_certificate.html.markdown
+++ b/website/docs/r/acmpca_certificate.html.markdown
@@ -59,7 +59,7 @@ resource "tls_cert_request" "csr" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `certificate_authority_arn` - (Required) ARN of the certificate authority.
 * `certificate_signing_request` - (Required) Certificate Signing Request in PEM format.
@@ -74,9 +74,9 @@ The following arguments are supported:
 * `type` - (Required) Determines how `value` is interpreted. Valid values: `DAYS`, `MONTHS`, `YEARS`, `ABSOLUTE`, `END_DATE`.
 * `value` - (Required) If `type` is `DAYS`, `MONTHS`, or `YEARS`, the relative time until the certificate expires. If `type` is `ABSOLUTE`, the date in seconds since the Unix epoch. If `type` is `END_DATE`, the  date in RFC 3339 format.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the certificate.
 * `certificate` - PEM-encoded certificate value.
@@ -84,8 +84,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-ACM PCA Certificates can be imported using their ARN, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import ACM PCA Certificates using their ARN. For example:
 
+```terraform
+import {
+  to = aws_acmpca_certificate.cert
+  id = "arn:aws:acm-pca:eu-west-1:675225743824:certificate-authority/08319ede-83g9-1400-8f21-c7d12b2b6edb/certificate/a4e9c2aa4bcfab625g1b9136464cd3a"
+}
 ```
-$ terraform import aws_acmpca_certificate.cert arn:aws:acm-pca:eu-west-1:675225743824:certificate-authority/08319ede-83g9-1400-8f21-c7d12b2b6edb/certificate/a4e9c2aa4bcfab625g1b9136464cd3a
+
+Using `terraform import`, import ACM PCA Certificates using their ARN. For example:
+
+```console
+% terraform import aws_acmpca_certificate.cert arn:aws:acm-pca:eu-west-1:675225743824:certificate-authority/08319ede-83g9-1400-8f21-c7d12b2b6edb/certificate/a4e9c2aa4bcfab625g1b9136464cd3a
 ```
diff --git a/website/docs/r/acmpca_certificate_authority.html.markdown b/website/docs/r/acmpca_certificate_authority.html.markdown
index c7075abb8f3..c2cdbda2379 100644
--- a/website/docs/r/acmpca_certificate_authority.html.markdown
+++ b/website/docs/r/acmpca_certificate_authority.html.markdown
@@ -51,7 +51,8 @@ resource "aws_acmpca_certificate_authority" "example" {
 
 ```terraform
 resource "aws_s3_bucket" "example" {
-  bucket = "example"
+  bucket        = "example"
+  force_destroy = true
 }
 
 data "aws_iam_policy_document" "acmpca_bucket_access" {
@@ -96,6 +97,7 @@ resource "aws_acmpca_certificate_authority" "example" {
       enabled            = true
       expiration_in_days = 7
       s3_bucket_name     = aws_s3_bucket.example.id
+      s3_object_acl      = "BUCKET_OWNER_FULL_CONTROL"
     }
   }
 
@@ -105,7 +107,7 @@ resource "aws_acmpca_certificate_authority" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `certificate_authority_configuration` - (Required) Nested argument containing algorithms and certificate subject information. Defined below.
 * `enabled` - (Optional) Whether the certificate authority is enabled or disabled. Defaults to `true`. Can only be disabled if the CA is in an `ACTIVE` state.
@@ -159,9 +161,9 @@ the custom OCSP responder endpoint. Defined below.
 * `enabled` - (Required) Boolean value that specifies whether a custom OCSP responder is enabled.
 * `ocsp_custom_cname` - (Optional) CNAME specifying a customized OCSP domain. Note: The value of the CNAME must not include a protocol prefix such as "http://" or "https://".
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - ARN of the certificate authority.
 * `arn` - ARN of the certificate authority.
@@ -181,8 +183,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_acmpca_certificate_authority` can be imported by using the certificate authority ARN, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_acmpca_certificate_authority` using the certificate authority ARN. For example:
 
+```terraform
+import {
+  to = aws_acmpca_certificate_authority.example
+  id = "arn:aws:acm-pca:us-east-1:123456789012:certificate-authority/12345678-1234-1234-1234-123456789012"
+}
 ```
-$ terraform import aws_acmpca_certificate_authority.example arn:aws:acm-pca:us-east-1:123456789012:certificate-authority/12345678-1234-1234-1234-123456789012
+
+Using `terraform import`, import `aws_acmpca_certificate_authority` using the certificate authority ARN. For example:
+
+```console
+% terraform import aws_acmpca_certificate_authority.example arn:aws:acm-pca:us-east-1:123456789012:certificate-authority/12345678-1234-1234-1234-123456789012
 ```
diff --git a/website/docs/r/acmpca_certificate_authority_certificate.html.markdown b/website/docs/r/acmpca_certificate_authority_certificate.html.markdown
index 4bd9a93fd7a..f71181c397b 100644
--- a/website/docs/r/acmpca_certificate_authority_certificate.html.markdown
+++ b/website/docs/r/acmpca_certificate_authority_certificate.html.markdown
@@ -106,12 +106,12 @@ data "aws_partition" "current" {}
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `certificate` - (Required) PEM-encoded certificate for the Certificate Authority.
 * `certificate_authority_arn` - (Required) ARN of the Certificate Authority.
 * `certificate_chain` - (Optional) PEM-encoded certificate chain that includes any intermediate certificates and chains up to root CA. Required for subordinate Certificate Authorities. Not allowed for root Certificate Authorities.
 
-## Attributes Reference
+## Attribute Reference
 
-No additional attributes are exported.
+This resource exports no additional attributes.
diff --git a/website/docs/r/acmpca_permission.html.markdown b/website/docs/r/acmpca_permission.html.markdown
index 724f6db5573..c985bd73738 100644
--- a/website/docs/r/acmpca_permission.html.markdown
+++ b/website/docs/r/acmpca_permission.html.markdown
@@ -34,15 +34,15 @@ resource "aws_acmpca_certificate_authority" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `certificate_authority_arn` - (Required) ARN of the CA that grants the permissions.
 * `actions` - (Required) Actions that the specified AWS service principal can use. These include `IssueCertificate`, `GetCertificate`, and `ListPermissions`. Note that in order for ACM to automatically rotate certificates issued by a PCA, it must be granted permission on all 3 actions, as per the example above.
 * `principal` - (Required) AWS service or identity that receives the permission. At this time, the only valid principal is `acm.amazonaws.com`.
 * `source_account` - (Optional) ID of the calling account
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `policy` - IAM policy that is associated with the permission.
diff --git a/website/docs/r/acmpca_policy.html.markdown b/website/docs/r/acmpca_policy.html.markdown
index edc4f71f620..d4731ccd77e 100644
--- a/website/docs/r/acmpca_policy.html.markdown
+++ b/website/docs/r/acmpca_policy.html.markdown
@@ -64,17 +64,28 @@ resource "aws_acmpca_policy" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `resource_arn` - (Required) ARN of the private CA to associate with the policy.
 * `policy` - (Required) JSON-formatted IAM policy to attach to the specified private CA resource.
 
-## Attributes Reference
+## Attribute Reference
 
-No additional attributes are exported.
+This resource exports no additional attributes.
 
 ## Import
 
-`aws_acmpca_policy` can be imported using the `resource_arn` value.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_acmpca_policy` using the `resource_arn` value. For example:
 
-$ terraform import aws_acmpca_policy.example arn:aws:acm-pca:us-east-1:123456789012:certificate-authority/12345678-1234-1234-1234-123456789012
+```terraform
+import {
+  to = aws_acmpca_policy.example
+  id = "arn:aws:acm-pca:us-east-1:123456789012:certificate-authority/12345678-1234-1234-1234-123456789012"
+}
+```
+
+Using `terraform import`, import `aws_acmpca_policy` using the `resource_arn` value. For example:
+
+```console
+% terraform import aws_acmpca_policy.example arn:aws:acm-pca:us-east-1:123456789012:certificate-authority/12345678-1234-1234-1234-123456789012
+```
diff --git a/website/docs/r/ami.html.markdown b/website/docs/r/ami.html.markdown
index dd1472e7c93..c7451e50a94 100644
--- a/website/docs/r/ami.html.markdown
+++ b/website/docs/r/ami.html.markdown
@@ -38,7 +38,7 @@ resource "aws_ami" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) Region-unique name for the AMI.
 * `boot_mode` - (Optional) Boot mode of the AMI. For more information, see [Boot modes](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ami-boot.html) in the Amazon Elastic Compute Cloud User Guide.
@@ -98,9 +98,9 @@ Nested `ephemeral_block_device` blocks have the following structure:
 * `virtual_name` - (Required) Name for the ephemeral device, of the form "ephemeralN" where
   *N* is a volume number starting from zero.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the AMI.
 * `id` - ID of the created AMI.
@@ -111,7 +111,6 @@ In addition to all arguments above, the following attributes are exported:
 * `image_owner_alias` - AWS account alias (for example, amazon, self) or the AWS account ID of the AMI owner.
 * `image_type` - Type of image.
 * `hypervisor` - Hypervisor type of the image.
-* `owner_id` - AWS account ID of the image owner.
 * `platform` - This value is set to windows for Windows AMIs; otherwise, it is blank.
 * `public` - Whether the image has public launch permissions.
 * `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
@@ -126,8 +125,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_ami` can be imported using the ID of the AMI, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_ami` using the ID of the AMI. For example:
 
+```terraform
+import {
+  to = aws_ami.example
+  id = "ami-12345678"
+}
 ```
-$ terraform import aws_ami.example ami-12345678
+
+Using `terraform import`, import `aws_ami` using the ID of the AMI. For example:
+
+```console
+% terraform import aws_ami.example ami-12345678
 ```
diff --git a/website/docs/r/ami_copy.html.markdown b/website/docs/r/ami_copy.html.markdown
index c849a7dd468..2daa396adbb 100644
--- a/website/docs/r/ami_copy.html.markdown
+++ b/website/docs/r/ami_copy.html.markdown
@@ -37,7 +37,7 @@ resource "aws_ami_copy" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) Region-unique name for the AMI.
 * `source_ami_id` - (Required) Id of the AMI to copy. This id must be valid in the region
@@ -52,9 +52,9 @@ The following arguments are supported:
 
 This resource also exposes the full set of arguments from the [`aws_ami`](ami.html) resource.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the AMI.
 * `id` - ID of the created AMI.
diff --git a/website/docs/r/ami_from_instance.html.markdown b/website/docs/r/ami_from_instance.html.markdown
index 000bdb98c0d..7c713d3a031 100644
--- a/website/docs/r/ami_from_instance.html.markdown
+++ b/website/docs/r/ami_from_instance.html.markdown
@@ -37,7 +37,7 @@ resource "aws_ami_from_instance" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) Region-unique name for the AMI.
 * `source_instance_id` - (Required) ID of the instance to use as the basis of the AMI.
@@ -55,9 +55,9 @@ The following arguments are supported:
 * `update` - (Default `40m`)
 * `delete` - (Default `90m`)
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the AMI.
 * `id` - ID of the created AMI.
diff --git a/website/docs/r/ami_launch_permission.html.markdown b/website/docs/r/ami_launch_permission.html.markdown
index 5464cc210e9..b2a8e002e8f 100644
--- a/website/docs/r/ami_launch_permission.html.markdown
+++ b/website/docs/r/ami_launch_permission.html.markdown
@@ -43,7 +43,7 @@ resource "aws_ami_launch_permission" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `account_id` - (Optional) AWS account ID for the launch permission.
 * `group` - (Optional) Name of the group for the launch permission. Valid values: `"all"`.
@@ -51,16 +51,25 @@ The following arguments are supported:
 * `organization_arn` - (Optional) ARN of an organization for the launch permission.
 * `organizational_unit_arn` - (Optional) ARN of an organizational unit for the launch permission.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Launch permission ID.
 
 ## Import
 
-AMI Launch Permissions can be imported using `[ACCOUNT-ID|GROUP-NAME|ORGANIZATION-ARN|ORGANIZATIONAL-UNIT-ARN]/IMAGE-ID`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AMI Launch Permissions using `[ACCOUNT-ID|GROUP-NAME|ORGANIZATION-ARN|ORGANIZATIONAL-UNIT-ARN]/IMAGE-ID`. For example:
 
-```sh
-$ terraform import aws_ami_launch_permission.example 123456789012/ami-12345678
+```terraform
+import {
+  to = aws_ami_launch_permission.example
+  id = "123456789012/ami-12345678"
+}
+```
+
+Using `terraform import`, import AMI Launch Permissions using `[ACCOUNT-ID|GROUP-NAME|ORGANIZATION-ARN|ORGANIZATIONAL-UNIT-ARN]/IMAGE-ID`. For example:
+
+```console
+% terraform import aws_ami_launch_permission.example 123456789012/ami-12345678
 ```
diff --git a/website/docs/r/amplify_app.html.markdown b/website/docs/r/amplify_app.html.markdown
index f25774141c4..f891f85cde4 100644
--- a/website/docs/r/amplify_app.html.markdown
+++ b/website/docs/r/amplify_app.html.markdown
@@ -138,7 +138,7 @@ resource "aws_amplify_app" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) Name for an Amplify app.
 * `access_token` - (Optional) Personal access token for a third-party source control system for an Amplify app. The personal access token is used to create a webhook and a read-only deploy key. The token is not stored.
@@ -179,9 +179,9 @@ A `custom_rule` block supports the following arguments:
 * `status` - (Optional) Status code for a URL rewrite or redirect rule. Valid values: `200`, `301`, `302`, `404`, `404-200`.
 * `target` - (Required) Target pattern for a URL rewrite or redirect rule.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the Amplify app.
 * `default_domain` - Default domain for the Amplify app.
@@ -198,10 +198,19 @@ A `production_branch` block supports the following attributes:
 
 ## Import
 
-Amplify App can be imported using Amplify App ID (appId), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Amplify App using Amplify App ID (appId). For example:
 
+```terraform
+import {
+  to = aws_amplify_app.example
+  id = "d2ypk4k47z8u6"
+}
 ```
-$ terraform import aws_amplify_app.example d2ypk4k47z8u6
+
+Using `terraform import`, import Amplify App using Amplify App ID (appId). For example:
+
+```console
+% terraform import aws_amplify_app.example d2ypk4k47z8u6
 ```
 
 App ID can be obtained from App ARN (e.g., `arn:aws:amplify:us-east-1:12345678:apps/d2ypk4k47z8u6`).
diff --git a/website/docs/r/amplify_backend_environment.html.markdown b/website/docs/r/amplify_backend_environment.html.markdown
index 1ac736c0d3d..3ce3305ff59 100644
--- a/website/docs/r/amplify_backend_environment.html.markdown
+++ b/website/docs/r/amplify_backend_environment.html.markdown
@@ -28,24 +28,33 @@ resource "aws_amplify_backend_environment" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `app_id` - (Required) Unique ID for an Amplify app.
 * `environment_name` - (Required) Name for the backend environment.
 * `deployment_artifacts` - (Optional) Name of deployment artifacts.
 * `stack_name` - (Optional) AWS CloudFormation stack name of a backend environment.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN for a backend environment that is part of an Amplify app.
 * `id` - Unique ID of the Amplify backend environment.
 
 ## Import
 
-Amplify backend environment can be imported using `app_id` and `environment_name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Amplify backend environment using `app_id` and `environment_name`. For example:
 
+```terraform
+import {
+  to = aws_amplify_backend_environment.example
+  id = "d2ypk4k47z8u6/example"
+}
 ```
-$ terraform import aws_amplify_backend_environment.example d2ypk4k47z8u6/example
+
+Using `terraform import`, import Amplify backend environment using `app_id` and `environment_name`. For example:
+
+```console
+% terraform import aws_amplify_backend_environment.example d2ypk4k47z8u6/example
 ```
diff --git a/website/docs/r/amplify_branch.html.markdown b/website/docs/r/amplify_branch.html.markdown
index 381d9442a4a..674dc66bdb2 100644
--- a/website/docs/r/amplify_branch.html.markdown
+++ b/website/docs/r/amplify_branch.html.markdown
@@ -153,7 +153,7 @@ resource "aws_sns_topic_subscription" "this" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `app_id` - (Required) Unique ID for an Amplify app.
 * `branch_name` - (Required) Name for the branch.
@@ -173,9 +173,9 @@ The following arguments are supported:
 * `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 * `ttl` - (Optional) Content Time To Live (TTL) for the website in seconds.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN for the branch.
 * `associated_resources` - A list of custom resources that are linked to this branch.
@@ -186,8 +186,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Amplify branch can be imported using `app_id` and `branch_name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Amplify branch using `app_id` and `branch_name`. For example:
 
+```terraform
+import {
+  to = aws_amplify_branch.master
+  id = "d2ypk4k47z8u6/master"
+}
 ```
-$ terraform import aws_amplify_branch.master d2ypk4k47z8u6/master
+
+Using `terraform import`, import Amplify branch using `app_id` and `branch_name`. For example:
+
+```console
+% terraform import aws_amplify_branch.master d2ypk4k47z8u6/master
 ```
diff --git a/website/docs/r/amplify_domain_association.html.markdown b/website/docs/r/amplify_domain_association.html.markdown
index 9a982a2419d..e2f168508bb 100644
--- a/website/docs/r/amplify_domain_association.html.markdown
+++ b/website/docs/r/amplify_domain_association.html.markdown
@@ -49,7 +49,7 @@ resource "aws_amplify_domain_association" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `app_id` - (Required) Unique ID for an Amplify app.
 * `domain_name` - (Required) Domain name for the domain association.
@@ -62,9 +62,9 @@ The `sub_domain` configuration block supports the following arguments:
 * `branch_name` - (Required) Branch name setting for the subdomain.
 * `prefix` - (Required) Prefix setting for the subdomain.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN for the domain association.
 * `certificate_verification_dns_record` - The DNS record for certificate verification.
@@ -76,8 +76,17 @@ The `sub_domain` configuration block exports the following attributes:
 
 ## Import
 
-Amplify domain association can be imported using `app_id` and `domain_name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Amplify domain association using `app_id` and `domain_name`. For example:
 
+```terraform
+import {
+  to = aws_amplify_domain_association.app
+  id = "d2ypk4k47z8u6/example.com"
+}
 ```
-$ terraform import aws_amplify_domain_association.app d2ypk4k47z8u6/example.com
+
+Using `terraform import`, import Amplify domain association using `app_id` and `domain_name`. For example:
+
+```console
+% terraform import aws_amplify_domain_association.app d2ypk4k47z8u6/example.com
 ```
diff --git a/website/docs/r/amplify_webhook.html.markdown b/website/docs/r/amplify_webhook.html.markdown
index f699c47164f..a49e5d72692 100644
--- a/website/docs/r/amplify_webhook.html.markdown
+++ b/website/docs/r/amplify_webhook.html.markdown
@@ -31,23 +31,32 @@ resource "aws_amplify_webhook" "master" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `app_id` - (Required) Unique ID for an Amplify app.
 * `branch_name` - (Required) Name for a branch that is part of the Amplify app.
 * `description` - (Optional) Description for a webhook.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN for the webhook.
 * `url` - URL of the webhook.
 
 ## Import
 
-Amplify webhook can be imported using a webhook ID, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Amplify webhook using a webhook ID. For example:
 
+```terraform
+import {
+  to = aws_amplify_webhook.master
+  id = "a26b22a0-748b-4b57-b9a0-ae7e601fe4b1"
+}
 ```
-$ terraform import aws_amplify_webhook.master a26b22a0-748b-4b57-b9a0-ae7e601fe4b1
+
+Using `terraform import`, import Amplify webhook using a webhook ID. For example:
+
+```console
+% terraform import aws_amplify_webhook.master a26b22a0-748b-4b57-b9a0-ae7e601fe4b1
 ```
diff --git a/website/docs/r/api_gateway_account.html.markdown b/website/docs/r/api_gateway_account.html.markdown
index abe0b547b1c..010b038fa65 100644
--- a/website/docs/r/api_gateway_account.html.markdown
+++ b/website/docs/r/api_gateway_account.html.markdown
@@ -63,15 +63,17 @@ resource "aws_iam_role_policy" "cloudwatch" {
 
 ## Argument Reference
 
-The following argument is supported:
+This resource supports the following arguments:
 
 * `cloudwatch_role_arn` - (Optional) ARN of an IAM role for CloudWatch (to allow logging & monitoring). See more [in AWS Docs](https://docs.aws.amazon.com/apigateway/latest/developerguide/how-to-stage-settings.html#how-to-stage-settings-console). Logging & monitoring can be enabled/disabled and otherwise tuned on the API Gateway Stage level.
 
-## Attributes Reference
+## Attribute Reference
 
-The following attribute is exported:
+This resource exports the following attributes in addition to the arguments above:
 
+* `api_key_version` - The version of the API keys used for the account.
 * `throttle_settings` - Account-Level throttle settings. See exported fields below.
+* `features` - A list of features supported for the account.
 
 `throttle_settings` block exports the following:
 
@@ -80,8 +82,17 @@ The following attribute is exported:
 
 ## Import
 
-API Gateway Accounts can be imported using the word `api-gateway-account`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import API Gateway Accounts using the word `api-gateway-account`. For example:
 
+```terraform
+import {
+  to = aws_api_gateway_account.demo
+  id = "api-gateway-account"
+}
 ```
-$ terraform import aws_api_gateway_account.demo api-gateway-account
+
+Using `terraform import`, import API Gateway Accounts using the word `api-gateway-account`. For example:
+
+```console
+% terraform import aws_api_gateway_account.demo api-gateway-account
 ```
diff --git a/website/docs/r/api_gateway_api_key.html.markdown b/website/docs/r/api_gateway_api_key.html.markdown
index 40949d86fc7..38672b55956 100644
--- a/website/docs/r/api_gateway_api_key.html.markdown
+++ b/website/docs/r/api_gateway_api_key.html.markdown
@@ -15,36 +15,45 @@ Provides an API Gateway API Key.
 ## Example Usage
 
 ```terraform
-resource "aws_api_gateway_api_key" "MyDemoApiKey" {
-  name = "demo"
+resource "aws_api_gateway_api_key" "example" {
+  name = "example"
 }
 ```
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) Name of the API key.
+* `customer_id` - (Required) An Amazon Web Services Marketplace customer identifier, when integrating with the Amazon Web Services SaaS Marketplace.
 * `description` - (Optional) API key description. Defaults to "Managed by Terraform".
 * `enabled` - (Optional) Whether the API key can be used by callers. Defaults to `true`.
 * `value` - (Optional) Value of the API key. If specified, the value must be an alphanumeric string between 20 and 128 characters. If not specified, it will be automatically generated by AWS on creation.
 * `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - ID of the API key
 * `created_date` - Creation date of the API key
 * `last_updated_date` - Last update date of the API key
-* `value` - Value of the API key
 * `arn` - ARN
 * `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
 
 ## Import
 
-API Gateway Keys can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import API Gateway Keys using the `id`. For example:
 
+```terraform
+import {
+  to = aws_api_gateway_api_key.example
+  id = "8bklk8bl1k3sB38D9B3l0enyWT8c09B30lkq0blk"
+}
 ```
-$ terraform import aws_api_gateway_api_key.my_demo_key 8bklk8bl1k3sB38D9B3l0enyWT8c09B30lkq0blk
+
+Using `terraform import`, import API Gateway Keys using the `id`. For example:
+
+```console
+% terraform import aws_api_gateway_api_key.example 8bklk8bl1k3sB38D9B3l0enyWT8c09B30lkq0blk
 ```
diff --git a/website/docs/r/api_gateway_authorizer.html.markdown b/website/docs/r/api_gateway_authorizer.html.markdown
index 684028f718e..914eb60ef62 100644
--- a/website/docs/r/api_gateway_authorizer.html.markdown
+++ b/website/docs/r/api_gateway_authorizer.html.markdown
@@ -24,13 +24,13 @@ resource "aws_api_gateway_rest_api" "demo" {
   name = "auth-demo"
 }
 
-data "aws_iam_role_policy_document" "invocation_assume_role" {
+data "aws_iam_policy_document" "invocation_assume_role" {
   statement {
     effect = "Allow"
 
     principals {
-      type       = "Service"
-      identifier = ["apigateway.amazonaws.com"]
+      type        = "Service"
+      identifiers = ["apigateway.amazonaws.com"]
     }
 
     actions = ["sts:AssumeRole"]
@@ -40,7 +40,7 @@ data "aws_iam_role_policy_document" "invocation_assume_role" {
 resource "aws_iam_role" "invocation_role" {
   name               = "api_gateway_auth_invocation"
   path               = "/"
-  assume_role_policy = data.aws_iam_role_policy_document.assume_role.json
+  assume_role_policy = data.aws_iam_policy_document.invocation_assume_role.json
 }
 
 data "aws_iam_policy_document" "invocation_policy" {
@@ -86,7 +86,7 @@ resource "aws_lambda_function" "authorizer" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `authorizer_uri` - (Optional, required for type `TOKEN`/`REQUEST`) Authorizer's Uniform Resource Identifier (URI). This must be a well-formed Lambda function URI in the form of `arn:aws:apigateway:{region}:lambda:path/{service_api}`,
  e.g., `arn:aws:apigateway:us-west-2:lambda:path/2015-03-31/functions/arn:aws:lambda:us-west-2:012345678912:function:my-function/invocations`
@@ -99,17 +99,26 @@ The following arguments are supported:
 * `identity_validation_expression` - (Optional) Validation expression for the incoming identity. For `TOKEN` type, this value should be a regular expression. The incoming token from the client is matched against this expression, and will proceed if the token matches. If the token doesn't match, the client receives a 401 Unauthorized response.
 * `provider_arns` - (Optional, required for type `COGNITO_USER_POOLS`) List of the Amazon Cognito user pool ARNs. Each element is of this format: `arn:aws:cognito-idp:{region}:{account_id}:userpool/{user_pool_id}`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the API Gateway Authorizer
 * `id` - Authorizer identifier.
 
 ## Import
 
-AWS API Gateway Authorizer can be imported using the `REST-API-ID/AUTHORIZER-ID`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AWS API Gateway Authorizer using the `REST-API-ID/AUTHORIZER-ID`. For example:
+
+```terraform
+import {
+  to = aws_api_gateway_authorizer.authorizer
+  id = "12345abcde/example"
+}
+```
+
+Using `terraform import`, import AWS API Gateway Authorizer using the `REST-API-ID/AUTHORIZER-ID`. For example:
 
-```sh
-$ terraform import aws_api_gateway_authorizer.authorizer 12345abcde/example
+```console
+% terraform import aws_api_gateway_authorizer.authorizer 12345abcde/example
 ```
diff --git a/website/docs/r/api_gateway_base_path_mapping.html.markdown b/website/docs/r/api_gateway_base_path_mapping.html.markdown
index b62d34c007a..9e58d54a42c 100644
--- a/website/docs/r/api_gateway_base_path_mapping.html.markdown
+++ b/website/docs/r/api_gateway_base_path_mapping.html.markdown
@@ -41,29 +41,49 @@ resource "aws_api_gateway_base_path_mapping" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `domain_name` - (Required) Already-registered domain name to connect the API to.
 * `api_id` - (Required) ID of the API to connect.
 * `stage_name` - (Optional) Name of a specific deployment stage to expose at the given path. If omitted, callers may select any stage by including its name as a path element after the base path.
 * `base_path` - (Optional) Path segment that must be prepended to the path when accessing the API via this mapping. If omitted, the API is exposed at the root of the given domain.
 
-## Attributes Reference
+## Attribute Reference
 
-No additional attributes are exported.
+This resource exports no additional attributes.
 
 ## Import
 
-`aws_api_gateway_base_path_mapping` can be imported by using the domain name and base path, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_api_gateway_base_path_mapping` using the domain name and base path. For example:
 
-For empty `base_path` (e.g., root path (`/`)):
+For an empty `base_path` or, in other words, a root path (`/`):
 
+```terraform
+import {
+  to = aws_api_gateway_base_path_mapping.example
+  id = "example.com/"
+}
 ```
-$ terraform import aws_api_gateway_base_path_mapping.example example.com/
+
+For a non-root `base_path`:
+
+```terraform
+import {
+  to = aws_api_gateway_base_path_mapping.example
+  id = "example.com/base-path"
+}
 ```
 
-Otherwise:
+Using `terraform import`, import `aws_api_gateway_base_path_mapping` using the domain name and base path. For example:
+
+For an empty `base_path` or, in other words, a root path (`/`):
 
+```console
+% terraform import aws_api_gateway_base_path_mapping.example example.com/
 ```
-$ terraform import aws_api_gateway_base_path_mapping.example example.com/base-path
+
+For a non-root `base_path`:
+
+```console
+% terraform import aws_api_gateway_base_path_mapping.example example.com/base-path
 ```
diff --git a/website/docs/r/api_gateway_client_certificate.html.markdown b/website/docs/r/api_gateway_client_certificate.html.markdown
index a548dd1b391..04103e71679 100644
--- a/website/docs/r/api_gateway_client_certificate.html.markdown
+++ b/website/docs/r/api_gateway_client_certificate.html.markdown
@@ -20,14 +20,14 @@ resource "aws_api_gateway_client_certificate" "demo" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `description` - (Optional) Description of the client certificate.
 * `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Identifier of the client certificate.
 * `created_date` - Date when the client certificate was created.
@@ -38,8 +38,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-API Gateway Client Certificates can be imported using the id, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import API Gateway Client Certificates using the id. For example:
 
+```terraform
+import {
+  to = aws_api_gateway_client_certificate.demo
+  id = "ab1cqe"
+}
 ```
-$ terraform import aws_api_gateway_client_certificate.demo ab1cqe
+
+Using `terraform import`, import API Gateway Client Certificates using the id. For example:
+
+```console
+% terraform import aws_api_gateway_client_certificate.demo ab1cqe
 ```
diff --git a/website/docs/r/api_gateway_deployment.html.markdown b/website/docs/r/api_gateway_deployment.html.markdown
index 89961447512..f8f64ad9ff0 100644
--- a/website/docs/r/api_gateway_deployment.html.markdown
+++ b/website/docs/r/api_gateway_deployment.html.markdown
@@ -128,7 +128,7 @@ resource "aws_api_gateway_stage" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `rest_api_id` - (Required) REST API identifier.
 * `description` - (Optional) Description of the deployment
@@ -137,9 +137,9 @@ The following arguments are supported:
 * `triggers` - (Optional) Map of arbitrary keys and values that, when changed, will trigger a redeployment. To force a redeployment without changing these keys/values, use the [`-replace` option](https://developer.hashicorp.com/terraform/cli/commands/plan#replace-address) with `terraform plan` or `terraform apply`.
 * `variables` - (Optional) Map to set on the stage managed by the `stage_name` argument.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - ID of the deployment
 * `invoke_url` - URL to invoke the API pointing to the stage,
@@ -151,10 +151,19 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_api_gateway_deployment` can be imported using `REST-API-ID/DEPLOYMENT-ID`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_api_gateway_deployment` using `REST-API-ID/DEPLOYMENT-ID`. For example:
 
+```terraform
+import {
+  to = aws_api_gateway_deployment.example
+  id = "aabbccddee/1122334"
+}
 ```
-$ terraform import aws_api_gateway_deployment.example aabbccddee/1122334
+
+Using `terraform import`, import `aws_api_gateway_deployment` using `REST-API-ID/DEPLOYMENT-ID`. For example:
+
+```console
+% terraform import aws_api_gateway_deployment.example aabbccddee/1122334
 ```
 
 The `stage_name`, `stage_description`, and `variables` arguments cannot be imported. Use the [`aws_api_gateway_stage` resource](api_gateway_stage.html) to import and manage stages.
diff --git a/website/docs/r/api_gateway_documentation_part.html.markdown b/website/docs/r/api_gateway_documentation_part.html.markdown
index 3aea00cea38..563f850d06c 100644
--- a/website/docs/r/api_gateway_documentation_part.html.markdown
+++ b/website/docs/r/api_gateway_documentation_part.html.markdown
@@ -31,7 +31,7 @@ resource "aws_api_gateway_rest_api" "example" {
 
 ## Argument Reference
 
-The following argument is supported:
+This resource supports the following arguments:
 
 * `location` - (Required) Location of the targeted API entity of the to-be-created documentation part. See below.
 * `properties` - (Required) Content map of API-specific key-value pairs describing the targeted API entity. The map must be encoded as a JSON string, e.g., "{ \"description\": \"The API does ...\" }". Only Swagger-compliant key-value pairs can be exported and, hence, published.
@@ -49,16 +49,25 @@ See supported entity types for each field in the [official docs](https://docs.aw
 * `status_code` - (Optional) HTTP status code of a response. The default value is `*` for any status code.
 * `type` - (Required) Type of API entity to which the documentation content appliesE.g., `API`, `METHOD` or `REQUEST_BODY`
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Unique ID of the Documentation Part
 
 ## Import
 
-API Gateway documentation_parts can be imported using `REST-API-ID/DOC-PART-ID`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import API Gateway documentation_parts using `REST-API-ID/DOC-PART-ID`. For example:
 
+```terraform
+import {
+  to = aws_api_gateway_documentation_part.example
+  id = "5i4e1ko720/3oyy3t"
+}
 ```
-$ terraform import aws_api_gateway_documentation_part.example 5i4e1ko720/3oyy3t
+
+Using `terraform import`, import API Gateway documentation_parts using `REST-API-ID/DOC-PART-ID`. For example:
+
+```console
+% terraform import aws_api_gateway_documentation_part.example 5i4e1ko720/3oyy3t
 ```
diff --git a/website/docs/r/api_gateway_documentation_version.html.markdown b/website/docs/r/api_gateway_documentation_version.html.markdown
index e7a21822a94..7616105133b 100644
--- a/website/docs/r/api_gateway_documentation_version.html.markdown
+++ b/website/docs/r/api_gateway_documentation_version.html.markdown
@@ -36,20 +36,29 @@ resource "aws_api_gateway_documentation_part" "example" {
 
 ## Argument Reference
 
-The following argument is supported:
+This resource supports the following arguments:
 
 * `version` - (Required) Version identifier of the API documentation snapshot.
 * `rest_api_id` - (Required) ID of the associated Rest API
 * `description` - (Optional) Description of the API documentation version.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 ## Import
 
-API Gateway documentation versions can be imported using `REST-API-ID/VERSION`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import API Gateway documentation versions using `REST-API-ID/VERSION`. For example:
 
+```terraform
+import {
+  to = aws_api_gateway_documentation_version.example
+  id = "5i4e1ko720/example-version"
+}
 ```
-$ terraform import aws_api_gateway_documentation_version.example 5i4e1ko720/example-version
+
+Using `terraform import`, import API Gateway documentation versions using `REST-API-ID/VERSION`. For example:
+
+```console
+% terraform import aws_api_gateway_documentation_version.example 5i4e1ko720/example-version
 ```
diff --git a/website/docs/r/api_gateway_domain_name.html.markdown b/website/docs/r/api_gateway_domain_name.html.markdown
index 8cf5e6ca2f7..b74e6d4721a 100644
--- a/website/docs/r/api_gateway_domain_name.html.markdown
+++ b/website/docs/r/api_gateway_domain_name.html.markdown
@@ -152,7 +152,7 @@ resource "aws_route53_record" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `domain_name` - (Required) Fully-qualified domain name to register.
 * `endpoint_configuration` - (Optional) Configuration block defining API endpoint information including type. See below.
@@ -183,9 +183,9 @@ When uploading a certificate, the following arguments are supported:
 * `truststore_uri` - (Required) Amazon S3 URL that specifies the truststore for mutual TLS authentication, for example, `s3://bucket-name/key-name`. The truststore can contain certificates from public or private certificate authorities. To update the truststore, upload a new version to S3, and then update your custom domain name to use the new version.
 * `truststore_version` - (Optional) Version of the S3 object that contains the truststore. To specify a version, you must have versioning enabled for the S3 bucket.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of domain name.
 * `certificate_upload_date` - Upload date associated with the domain certificate.
@@ -198,8 +198,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-API Gateway domain names can be imported using their `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import API Gateway domain names using their `name`. For example:
 
+```terraform
+import {
+  to = aws_api_gateway_domain_name.example
+  id = "dev.example.com"
+}
 ```
-$ terraform import aws_api_gateway_domain_name.example dev.example.com
+
+Using `terraform import`, import API Gateway domain names using their `name`. For example:
+
+```console
+% terraform import aws_api_gateway_domain_name.example dev.example.com
 ```
diff --git a/website/docs/r/api_gateway_gateway_response.html.markdown b/website/docs/r/api_gateway_gateway_response.html.markdown
new file mode 100644
index 00000000000..0516bfbc759
--- /dev/null
+++ b/website/docs/r/api_gateway_gateway_response.html.markdown
@@ -0,0 +1,64 @@
+---
+subcategory: "API Gateway"
+layout: "aws"
+page_title: "AWS: aws_api_gateway_gateway_response"
+description: |-
+  Provides an API Gateway Gateway Response for a REST API Gateway.
+---
+
+# Resource: aws_api_gateway_gateway_response
+
+Provides an API Gateway Gateway Response for a REST API Gateway.
+
+## Example Usage
+
+```terraform
+resource "aws_api_gateway_rest_api" "main" {
+  name = "MyDemoAPI"
+}
+
+resource "aws_api_gateway_gateway_response" "test" {
+  rest_api_id   = aws_api_gateway_rest_api.main.id
+  status_code   = "401"
+  response_type = "UNAUTHORIZED"
+
+  response_templates = {
+    "application/json" = "{\"message\":$context.error.messageString}"
+  }
+
+  response_parameters = {
+    "gatewayresponse.header.Authorization" = "'Basic'"
+  }
+}
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `rest_api_id` - (Required) String identifier of the associated REST API.
+* `response_type` - (Required) Response type of the associated GatewayResponse.
+* `status_code` - (Optional) HTTP status code of the Gateway Response.
+* `response_templates` - (Optional) Map of templates used to transform the response body.
+* `response_parameters` - (Optional) Map of parameters (paths, query strings and headers) of the Gateway Response.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_api_gateway_gateway_response` using `REST-API-ID/RESPONSE-TYPE`. For example:
+
+```terraform
+import {
+  to = aws_api_gateway_gateway_response.example
+  id = "12345abcde/UNAUTHORIZED"
+}
+```
+
+Using `terraform import`, import `aws_api_gateway_gateway_response` using `REST-API-ID/RESPONSE-TYPE`. For example:
+
+```console
+% terraform import aws_api_gateway_gateway_response.example 12345abcde/UNAUTHORIZED
+```
diff --git a/website/docs/r/api_gateway_gateway_response.markdown b/website/docs/r/api_gateway_gateway_response.markdown
deleted file mode 100644
index bd05432326c..00000000000
--- a/website/docs/r/api_gateway_gateway_response.markdown
+++ /dev/null
@@ -1,55 +0,0 @@
----
-subcategory: "API Gateway"
-layout: "aws"
-page_title: "AWS: aws_api_gateway_gateway_response"
-description: |-
-  Provides an API Gateway Gateway Response for a REST API Gateway.
----
-
-# Resource: aws_api_gateway_gateway_response
-
-Provides an API Gateway Gateway Response for a REST API Gateway.
-
-## Example Usage
-
-```terraform
-resource "aws_api_gateway_rest_api" "main" {
-  name = "MyDemoAPI"
-}
-
-resource "aws_api_gateway_gateway_response" "test" {
-  rest_api_id   = aws_api_gateway_rest_api.main.id
-  status_code   = "401"
-  response_type = "UNAUTHORIZED"
-
-  response_templates = {
-    "application/json" = "{\"message\":$context.error.messageString}"
-  }
-
-  response_parameters = {
-    "gatewayresponse.header.Authorization" = "'Basic'"
-  }
-}
-```
-
-## Argument Reference
-
-The following arguments are supported:
-
-* `rest_api_id` - (Required) String identifier of the associated REST API.
-* `response_type` - (Required) Response type of the associated GatewayResponse.
-* `status_code` - (Optional) HTTP status code of the Gateway Response.
-* `response_templates` - (Optional) Map of templates used to transform the response body.
-* `response_parameters` - (Optional) Map of parameters (paths, query strings and headers) of the Gateway Response.
-
-## Attributes Reference
-
-No additional attributes are exported.
-
-## Import
-
-`aws_api_gateway_gateway_response` can be imported using `REST-API-ID/RESPONSE-TYPE`, e.g.,
-
-```
-$ terraform import aws_api_gateway_gateway_response.example 12345abcde/UNAUTHORIZED
-```
diff --git a/website/docs/r/api_gateway_integration.html.markdown b/website/docs/r/api_gateway_integration.html.markdown
index 1015cc723ce..7971d235593 100644
--- a/website/docs/r/api_gateway_integration.html.markdown
+++ b/website/docs/r/api_gateway_integration.html.markdown
@@ -198,7 +198,7 @@ resource "aws_api_gateway_integration" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `rest_api_id` - (Required) ID of the associated REST API.
 * `resource_id` - (Required) API resource ID.
@@ -232,14 +232,23 @@ The `tls_config` configuration block supports the following arguments:
 
 * `insecure_skip_verification` - (Optional) Whether or not API Gateway skips verification that the certificate for an integration endpoint is issued by a [supported certificate authority](https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-supported-certificate-authorities-for-http-endpoints.html). This isn’t recommended, but it enables you to use certificates that are signed by private certificate authorities, or certificates that are self-signed. If enabled, API Gateway still performs basic certificate validation, which includes checking the certificate's expiration date, hostname, and presence of a root certificate authority. Supported only for `HTTP` and `HTTP_PROXY` integrations.
 
-## Attributes Reference
+## Attribute Reference
 
-No additional attributes are exported.
+This resource exports no additional attributes.
 
 ## Import
 
-`aws_api_gateway_integration` can be imported using `REST-API-ID/RESOURCE-ID/HTTP-METHOD`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_api_gateway_integration` using `REST-API-ID/RESOURCE-ID/HTTP-METHOD`. For example:
 
+```terraform
+import {
+  to = aws_api_gateway_integration.example
+  id = "12345abcde/67890fghij/GET"
+}
 ```
-$ terraform import aws_api_gateway_integration.example 12345abcde/67890fghij/GET
+
+Using `terraform import`, import `aws_api_gateway_integration` using `REST-API-ID/RESOURCE-ID/HTTP-METHOD`. For example:
+
+```console
+% terraform import aws_api_gateway_integration.example 12345abcde/67890fghij/GET
 ```
diff --git a/website/docs/r/api_gateway_integration_response.html.markdown b/website/docs/r/api_gateway_integration_response.html.markdown
index ef3728f7c2c..be7cd055ecf 100644
--- a/website/docs/r/api_gateway_integration_response.html.markdown
+++ b/website/docs/r/api_gateway_integration_response.html.markdown
@@ -83,14 +83,23 @@ The following arguments are optional:
 * `response_templates` - (Optional) Map of templates used to transform the integration response body.
 * `selection_pattern` - (Optional) Regular expression pattern used to choose an integration response based on the response from the backend. Omit configuring this to make the integration the default one. If the backend is an `AWS` Lambda function, the AWS Lambda function error header is matched. For all other `HTTP` and `AWS` backends, the HTTP status code is matched.
 
-## Attributes Reference
+## Attribute Reference
 
-No additional attributes are exported.
+This resource exports no additional attributes.
 
 ## Import
 
-`aws_api_gateway_integration_response` can be imported using `REST-API-ID/RESOURCE-ID/HTTP-METHOD/STATUS-CODE`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_api_gateway_integration_response` using `REST-API-ID/RESOURCE-ID/HTTP-METHOD/STATUS-CODE`. For example:
 
+```terraform
+import {
+  to = aws_api_gateway_integration_response.example
+  id = "12345abcde/67890fghij/GET/200"
+}
 ```
-$ terraform import aws_api_gateway_integration_response.example 12345abcde/67890fghij/GET/200
+
+Using `terraform import`, import `aws_api_gateway_integration_response` using `REST-API-ID/RESOURCE-ID/HTTP-METHOD/STATUS-CODE`. For example:
+
+```console
+% terraform import aws_api_gateway_integration_response.example 12345abcde/67890fghij/GET/200
 ```
diff --git a/website/docs/r/api_gateway_method.html.markdown b/website/docs/r/api_gateway_method.html.markdown
index a3c8cbdecdf..9cff6d0ea9f 100644
--- a/website/docs/r/api_gateway_method.html.markdown
+++ b/website/docs/r/api_gateway_method.html.markdown
@@ -73,7 +73,7 @@ resource "aws_api_gateway_method" "any" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `rest_api_id` - (Required) ID of the associated REST API
 * `resource_id` - (Required) API resource ID
@@ -90,14 +90,23 @@ The following arguments are supported:
 * `request_parameters` - (Optional) Map of request parameters (from the path, query string and headers) that should be passed to the integration. The boolean value indicates whether the parameter is required (`true`) or optional (`false`).
   For example: `request_parameters = {"method.request.header.X-Some-Header" = true "method.request.querystring.some-query-param" = true}` would define that the header `X-Some-Header` and the query string `some-query-param` must be provided in the request.
 
-## Attributes Reference
+## Attribute Reference
 
-No additional attributes are exported.
+This resource exports no additional attributes.
 
 ## Import
 
-`aws_api_gateway_method` can be imported using `REST-API-ID/RESOURCE-ID/HTTP-METHOD`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_api_gateway_method` using `REST-API-ID/RESOURCE-ID/HTTP-METHOD`. For example:
 
+```terraform
+import {
+  to = aws_api_gateway_method.example
+  id = "12345abcde/67890fghij/GET"
+}
 ```
-$ terraform import aws_api_gateway_method.example 12345abcde/67890fghij/GET
+
+Using `terraform import`, import `aws_api_gateway_method` using `REST-API-ID/RESOURCE-ID/HTTP-METHOD`. For example:
+
+```console
+% terraform import aws_api_gateway_method.example 12345abcde/67890fghij/GET
 ```
diff --git a/website/docs/r/api_gateway_method_response.html.markdown b/website/docs/r/api_gateway_method_response.html.markdown
index 46c660666c9..abce08f0ef2 100644
--- a/website/docs/r/api_gateway_method_response.html.markdown
+++ b/website/docs/r/api_gateway_method_response.html.markdown
@@ -48,7 +48,7 @@ resource "aws_api_gateway_method_response" "response_200" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `rest_api_id` - (Required) ID of the associated REST API
 * `resource_id` - (Required) API resource ID
@@ -59,14 +59,23 @@ The following arguments are supported:
    For example: `response_parameters = { "method.response.header.X-Some-Header" = true }`
    would define that the header `X-Some-Header` can be provided on the response.
 
-## Attributes Reference
+## Attribute Reference
 
-No additional attributes are exported.
+This resource exports no additional attributes.
 
 ## Import
 
-`aws_api_gateway_method_response` can be imported using `REST-API-ID/RESOURCE-ID/HTTP-METHOD/STATUS-CODE`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_api_gateway_method_response` using `REST-API-ID/RESOURCE-ID/HTTP-METHOD/STATUS-CODE`. For example:
 
+```terraform
+import {
+  to = aws_api_gateway_method_response.example
+  id = "12345abcde/67890fghij/GET/200"
+}
 ```
-$ terraform import aws_api_gateway_method_response.example 12345abcde/67890fghij/GET/200
+
+Using `terraform import`, import `aws_api_gateway_method_response` using `REST-API-ID/RESOURCE-ID/HTTP-METHOD/STATUS-CODE`. For example:
+
+```console
+% terraform import aws_api_gateway_method_response.example 12345abcde/67890fghij/GET/200
 ```
diff --git a/website/docs/r/api_gateway_method_settings.html.markdown b/website/docs/r/api_gateway_method_settings.html.markdown
index e7d33182fcf..4b49e794ba1 100644
--- a/website/docs/r/api_gateway_method_settings.html.markdown
+++ b/website/docs/r/api_gateway_method_settings.html.markdown
@@ -14,8 +14,12 @@ Manages API Gateway Stage Method Settings. For example, CloudWatch logging and m
 
 ## Example Usage
 
+### End-to-end
+
 An end-to-end example of a REST API configured with OpenAPI can be found in the [`/examples/api-gateway-rest-api-openapi` directory within the GitHub repository](https://github.com/hashicorp/terraform-provider-aws/tree/main/examples/api-gateway-rest-api-openapi).
 
+### Basic Usage
+
 ```terraform
 resource "aws_api_gateway_rest_api" "example" {
   body = jsonencode({
@@ -82,9 +86,75 @@ resource "aws_api_gateway_method_settings" "path_specific" {
 }
 ```
 
+### CloudWatch Logging and Tracing
+
+The AWS Console API Gateway Editor displays multiple options for CloudWatch Logs that don't directly map to the options in the AWS API and Terraform. These examples show the `settings` blocks that are equivalent to the options the AWS Console gives for CloudWatch Logs.
+
+#### Off
+
+```terraform
+resource "aws_api_gateway_method_settings" "path_specific" {
+  rest_api_id = aws_api_gateway_rest_api.example.id
+  stage_name  = aws_api_gateway_stage.example.stage_name
+  method_path = "path1/GET"
+
+  settings {
+    logging_level = "OFF"
+  }
+}
+```
+
+#### Errors Only
+
+```terraform
+resource "aws_api_gateway_method_settings" "path_specific" {
+  rest_api_id = aws_api_gateway_rest_api.example.id
+  stage_name  = aws_api_gateway_stage.example.stage_name
+  method_path = "path1/GET"
+
+  settings {
+    logging_level      = "ERROR"
+    metrics_enabled    = true
+    data_trace_enabled = false
+  }
+}
+```
+
+#### Errors and Info Logs
+
+```terraform
+resource "aws_api_gateway_method_settings" "path_specific" {
+  rest_api_id = aws_api_gateway_rest_api.example.id
+  stage_name  = aws_api_gateway_stage.example.stage_name
+  method_path = "path1/GET"
+
+  settings {
+    logging_level      = "INFO"
+    metrics_enabled    = true
+    data_trace_enabled = false
+  }
+}
+```
+
+#### Full Request and Response Logs
+
+```terraform
+resource "aws_api_gateway_method_settings" "path_specific" {
+  rest_api_id = aws_api_gateway_rest_api.example.id
+  stage_name  = aws_api_gateway_stage.example.stage_name
+  method_path = "path1/GET"
+
+  settings {
+    logging_level      = "INFO"
+    metrics_enabled    = true
+    data_trace_enabled = true
+  }
+}
+```
+
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `rest_api_id` - (Required) ID of the REST API
 * `stage_name` - (Required) Name of the stage
@@ -104,14 +174,23 @@ The following arguments are supported:
 * `require_authorization_for_cache_control` - (Optional) Whether authorization is required for a cache invalidation request.
 * `unauthorized_cache_control_header_strategy` - (Optional) How to handle unauthorized requests for cache invalidation. The available values are `FAIL_WITH_403`, `SUCCEED_WITH_RESPONSE_HEADER`, `SUCCEED_WITHOUT_RESPONSE_HEADER`.
 
-## Attributes Reference
+## Attribute Reference
 
-No additional attributes are exported.
+This resource exports no additional attributes.
 
 ## Import
 
-`aws_api_gateway_method_settings` can be imported using `REST-API-ID/STAGE-NAME/METHOD-PATH`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_api_gateway_method_settings` using `REST-API-ID/STAGE-NAME/METHOD-PATH`. For example:
 
+```terraform
+import {
+  to = aws_api_gateway_method_settings.example
+  id = "12345abcde/example/test/GET"
+}
 ```
-$ terraform import aws_api_gateway_method_settings.example 12345abcde/example/test/GET
+
+Using `terraform import`, import `aws_api_gateway_method_settings` using `REST-API-ID/STAGE-NAME/METHOD-PATH`. For example:
+
+```console
+% terraform import aws_api_gateway_method_settings.example 12345abcde/example/test/GET
 ```
diff --git a/website/docs/r/api_gateway_model.html.markdown b/website/docs/r/api_gateway_model.html.markdown
index 6b621058f37..17e2403e1f6 100644
--- a/website/docs/r/api_gateway_model.html.markdown
+++ b/website/docs/r/api_gateway_model.html.markdown
@@ -32,7 +32,7 @@ resource "aws_api_gateway_model" "MyDemoModel" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `rest_api_id` - (Required) ID of the associated REST API
 * `name` - (Required) Name of the model
@@ -40,16 +40,25 @@ The following arguments are supported:
 * `content_type` - (Required) Content type of the model
 * `schema` - (Required) Schema of the model in a JSON form
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - ID of the model
 
 ## Import
 
-`aws_api_gateway_model` can be imported using `REST-API-ID/NAME`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_api_gateway_model` using `REST-API-ID/NAME`. For example:
 
+```terraform
+import {
+  to = aws_api_gateway_model.example
+  id = "12345abcde/example"
+}
 ```
-$ terraform import aws_api_gateway_model.example 12345abcde/example
+
+Using `terraform import`, import `aws_api_gateway_model` using `REST-API-ID/NAME`. For example:
+
+```console
+% terraform import aws_api_gateway_model.example 12345abcde/example
 ```
diff --git a/website/docs/r/api_gateway_request_validator.html.markdown b/website/docs/r/api_gateway_request_validator.html.markdown
index 9ea5ec9f4a3..0c869818cda 100644
--- a/website/docs/r/api_gateway_request_validator.html.markdown
+++ b/website/docs/r/api_gateway_request_validator.html.markdown
@@ -23,23 +23,32 @@ resource "aws_api_gateway_request_validator" "example" {
 
 ## Argument Reference
 
-The following argument is supported:
+This resource supports the following arguments:
 
 * `name` - (Required) Name of the request validator
 * `rest_api_id` - (Required) ID of the associated Rest API
 * `validate_request_body` - (Optional) Boolean whether to validate request body. Defaults to `false`.
 * `validate_request_parameters` - (Optional) Boolean whether to validate request parameters. Defaults to `false`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Unique ID of the request validator
 
 ## Import
 
-`aws_api_gateway_request_validator` can be imported using `REST-API-ID/REQUEST-VALIDATOR-ID`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_api_gateway_request_validator` using `REST-API-ID/REQUEST-VALIDATOR-ID`. For example:
 
+```terraform
+import {
+  to = aws_api_gateway_request_validator.example
+  id = "12345abcde/67890fghij"
+}
 ```
-$ terraform import aws_api_gateway_request_validator.example 12345abcde/67890fghij
+
+Using `terraform import`, import `aws_api_gateway_request_validator` using `REST-API-ID/REQUEST-VALIDATOR-ID`. For example:
+
+```console
+% terraform import aws_api_gateway_request_validator.example 12345abcde/67890fghij
 ```
diff --git a/website/docs/r/api_gateway_resource.html.markdown b/website/docs/r/api_gateway_resource.html.markdown
index 70885e3e101..34602ba1ce7 100644
--- a/website/docs/r/api_gateway_resource.html.markdown
+++ b/website/docs/r/api_gateway_resource.html.markdown
@@ -27,23 +27,32 @@ resource "aws_api_gateway_resource" "MyDemoResource" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `rest_api_id` - (Required) ID of the associated REST API
 * `parent_id` - (Required) ID of the parent API resource
 * `path_part` - (Required) Last path segment of this API resource.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Resource's identifier.
 * `path` - Complete path for this API resource, including all parent paths.
 
 ## Import
 
-`aws_api_gateway_resource` can be imported using `REST-API-ID/RESOURCE-ID`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_api_gateway_resource` using `REST-API-ID/RESOURCE-ID`. For example:
 
+```terraform
+import {
+  to = aws_api_gateway_resource.example
+  id = "12345abcde/67890fghij"
+}
 ```
-$ terraform import aws_api_gateway_resource.example 12345abcde/67890fghij
+
+Using `terraform import`, import `aws_api_gateway_resource` using `REST-API-ID/RESOURCE-ID`. For example:
+
+```console
+% terraform import aws_api_gateway_resource.example 12345abcde/67890fghij
 ```
diff --git a/website/docs/r/api_gateway_rest_api.html.markdown b/website/docs/r/api_gateway_rest_api.html.markdown
index 8b27e8673c1..320a2707d4e 100644
--- a/website/docs/r/api_gateway_rest_api.html.markdown
+++ b/website/docs/r/api_gateway_rest_api.html.markdown
@@ -219,7 +219,7 @@ resource "aws_api_gateway_stage" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `api_key_source` - (Optional) Source of the API key for requests. Valid values are `HEADER` (default) and `AUTHORIZER`. If importing an OpenAPI specification via the `body` argument, this corresponds to the [`x-amazon-apigateway-api-key-source` extension](https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-swagger-extensions-api-key-source.html). If the argument value is provided and is different than the OpenAPI value, the argument value will override the OpenAPI value.
 * `binary_media_types` - (Optional) List of binary media types supported by the REST API. By default, the REST API supports only UTF-8-encoded text payloads. If importing an OpenAPI specification via the `body` argument, this corresponds to the [`x-amazon-apigateway-binary-media-types` extension](https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-swagger-extensions-binary-media-types.html). If the argument value is provided and is different than the OpenAPI value, the argument value will override the OpenAPI value.
@@ -251,9 +251,9 @@ The following arguments are supported:
 * `types` - (Required) List of endpoint types. This resource currently only supports managing a single value. Valid values: `EDGE`, `REGIONAL` or `PRIVATE`. If unspecified, defaults to `EDGE`. If set to `PRIVATE` recommend to set `put_rest_api_mode` = `merge` to not cause the endpoints and associated Route53 records to be deleted. Refer to the [documentation](https://docs.aws.amazon.com/apigateway/latest/developerguide/create-regional-api.html) for more information on the difference between edge-optimized and regional APIs.
 * `vpc_endpoint_ids` - (Optional) Set of VPC Endpoint identifiers. It is only supported for `PRIVATE` endpoint type. If importing an OpenAPI specification via the `body` argument, this corresponds to the [`x-amazon-apigateway-endpoint-configuration` extension `vpcEndpointIds` property](https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-swagger-extensions-endpoint-configuration.html). If the argument value is provided and is different than the OpenAPI value, **the argument value will override the OpenAPI value**.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN
 * `created_date` - Creation date of the REST API
@@ -266,10 +266,19 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_api_gateway_rest_api` can be imported by using the REST API ID, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_api_gateway_rest_api` using the REST API ID. For example:
 
+```terraform
+import {
+  to = aws_api_gateway_rest_api.example
+  id = "12345abcde"
+}
 ```
-$ terraform import aws_api_gateway_rest_api.example 12345abcde
+
+Using `terraform import`, import `aws_api_gateway_rest_api` using the REST API ID. For example:
+
+```console
+% terraform import aws_api_gateway_rest_api.example 12345abcde
 ```
 
 ~> **NOTE:** Resource import does not currently support the `body` attribute.
diff --git a/website/docs/r/api_gateway_rest_api_policy.html.markdown b/website/docs/r/api_gateway_rest_api_policy.html.markdown
index bd386b4bd60..ec37bb79b4a 100644
--- a/website/docs/r/api_gateway_rest_api_policy.html.markdown
+++ b/website/docs/r/api_gateway_rest_api_policy.html.markdown
@@ -48,21 +48,30 @@ resource "aws_api_gateway_rest_api_policy" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `rest_api_id` - (Required) ID of the REST API.
 * `policy` - (Required) JSON formatted policy document that controls access to the API Gateway. For more information about building AWS IAM policy documents with Terraform, see the [AWS IAM Policy Document Guide](https://learn.hashicorp.com/terraform/aws/iam-policy)
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - ID of the REST API
 
 ## Import
 
-`aws_api_gateway_rest_api_policy` can be imported by using the REST API ID, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_api_gateway_rest_api_policy` using the REST API ID. For example:
 
+```terraform
+import {
+  to = aws_api_gateway_rest_api_policy.example
+  id = "12345abcde"
+}
 ```
-$ terraform import aws_api_gateway_rest_api_policy.example 12345abcde
+
+Using `terraform import`, import `aws_api_gateway_rest_api_policy` using the REST API ID. For example:
+
+```console
+% terraform import aws_api_gateway_rest_api_policy.example 12345abcde
 ```
diff --git a/website/docs/r/api_gateway_stage.html.markdown b/website/docs/r/api_gateway_stage.html.markdown
index cb564a4da6c..a47b88546fe 100644
--- a/website/docs/r/api_gateway_stage.html.markdown
+++ b/website/docs/r/api_gateway_stage.html.markdown
@@ -71,7 +71,7 @@ resource "aws_api_gateway_method_settings" "example" {
 
 ### Managing the API Logging CloudWatch Log Group
 
-API Gateway provides the ability to [enable CloudWatch API logging](https://docs.aws.amazon.com/apigateway/latest/developerguide/set-up-logging.html). To manage the CloudWatch Log Group when this feature is enabled, the [`aws_cloudwatch_log_group` resource](/docs/providers/aws/r/cloudwatch_log_group.html) can be used where the name matches the API Gateway naming convention. If the CloudWatch Log Group previously exists, the [`aws_cloudwatch_log_group` resource can be imported into Terraform](/docs/providers/aws/r/cloudwatch_log_group.html#import) as a one time operation and recreation of the environment can occur without import.
+API Gateway provides the ability to [enable CloudWatch API logging](https://docs.aws.amazon.com/apigateway/latest/developerguide/set-up-logging.html). To manage the CloudWatch Log Group when this feature is enabled, the [`aws_cloudwatch_log_group` resource](/docs/providers/aws/r/cloudwatch_log_group.html) can be used where the name matches the API Gateway naming convention. If the CloudWatch Log Group previously exists, import the [`aws_cloudwatch_log_group` resource into Terraform](/docs/providers/aws/r/cloudwatch_log_group.html#import) as a one time operation. You can recreate the environment without import.
 
 -> The below configuration uses [`depends_on`](https://www.terraform.io/language/meta-arguments/depends_on) to prevent ordering issues with API Gateway automatically creating the log group first and a variable for naming consistency. Other ordering and naming methodologies may be more appropriate for your environment.
 
@@ -101,7 +101,7 @@ resource "aws_cloudwatch_log_group" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `rest_api_id` - (Required) ID of the associated REST API
 * `stage_name` - (Required) Name of the stage
@@ -129,9 +129,9 @@ For more information on configuring the log format rules visit the AWS [document
 * `stage_variable_overrides` - (Optional) Map of overridden stage `variables` (including new variables) for the canary deployment.
 * `use_stage_cache` - (Optional) Whether the canary deployment uses the stage cache. Defaults to false.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN
 * `id` - ID of the stage
@@ -145,8 +145,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_api_gateway_stage` can be imported using `REST-API-ID/STAGE-NAME`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_api_gateway_stage` using `REST-API-ID/STAGE-NAME`. For example:
 
+```terraform
+import {
+  to = aws_api_gateway_stage.example
+  id = "12345abcde/example"
+}
 ```
-$ terraform import aws_api_gateway_stage.example 12345abcde/example
+
+Using `terraform import`, import `aws_api_gateway_stage` using `REST-API-ID/STAGE-NAME`. For example:
+
+```console
+% terraform import aws_api_gateway_stage.example 12345abcde/example
 ```
diff --git a/website/docs/r/api_gateway_usage_plan.html.markdown b/website/docs/r/api_gateway_usage_plan.html.markdown
index e5f2c901e7a..a12d4a45f35 100644
--- a/website/docs/r/api_gateway_usage_plan.html.markdown
+++ b/website/docs/r/api_gateway_usage_plan.html.markdown
@@ -126,9 +126,9 @@ The API Gateway Usage Plan argument layout is a structure composed of several su
 * `burst_limit` (Optional) - The API request burst limit, the maximum rate limit over a time ranging from one to a few seconds, depending upon whether the underlying token bucket is at its full capacity.
 * `rate_limit` (Optional) - The API request steady-state rate limit.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - ID of the API resource
 * `name` - Name of the usage plan.
@@ -142,8 +142,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-AWS API Gateway Usage Plan can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AWS API Gateway Usage Plan using the `id`. For example:
 
-```sh
-$ terraform import aws_api_gateway_usage_plan.myusageplan <usage_plan_id>
+```terraform
+import {
+  to = aws_api_gateway_usage_plan.myusageplan
+  id = "<usage_plan_id>"
+}
+```
+
+Using `terraform import`, import AWS API Gateway Usage Plan using the `id`. For example:
+
+```console
+% terraform import aws_api_gateway_usage_plan.myusageplan <usage_plan_id>
 ```
diff --git a/website/docs/r/api_gateway_usage_plan_key.html.markdown b/website/docs/r/api_gateway_usage_plan_key.html.markdown
index 4fdeb15fd29..4087e25f570 100644
--- a/website/docs/r/api_gateway_usage_plan_key.html.markdown
+++ b/website/docs/r/api_gateway_usage_plan_key.html.markdown
@@ -41,15 +41,15 @@ resource "aws_api_gateway_usage_plan_key" "main" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `key_id` - (Required) Identifier of the API key resource.
 * `key_type` - (Required) Type of the API key resource. Currently, the valid key type is API_KEY.
 * `usage_plan_id` - (Required) Id of the usage plan resource representing to associate the key to.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - ID of a usage plan key.
 * `key_id` - Identifier of the API gateway key resource.
@@ -60,8 +60,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-AWS API Gateway Usage Plan Key can be imported using the `USAGE-PLAN-ID/USAGE-PLAN-KEY-ID`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AWS API Gateway Usage Plan Key using the `USAGE-PLAN-ID/USAGE-PLAN-KEY-ID`. For example:
 
-```sh
-$ terraform import aws_api_gateway_usage_plan_key.key 12345abcde/zzz
+```terraform
+import {
+  to = aws_api_gateway_usage_plan_key.key
+  id = "12345abcde/zzz"
+}
+```
+
+Using `terraform import`, import AWS API Gateway Usage Plan Key using the `USAGE-PLAN-ID/USAGE-PLAN-KEY-ID`. For example:
+
+```console
+% terraform import aws_api_gateway_usage_plan_key.key 12345abcde/zzz
 ```
diff --git a/website/docs/r/api_gateway_vpc_link.html.markdown b/website/docs/r/api_gateway_vpc_link.html.markdown
index b4061445f85..1720bf0339e 100644
--- a/website/docs/r/api_gateway_vpc_link.html.markdown
+++ b/website/docs/r/api_gateway_vpc_link.html.markdown
@@ -35,24 +35,33 @@ resource "aws_api_gateway_vpc_link" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) Name used to label and identify the VPC link.
 * `description` - (Optional) Description of the VPC link.
 * `target_arns` - (Required, ForceNew) List of network load balancer arns in the VPC targeted by the VPC link. Currently AWS only supports 1 target.
 * `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Identifier of the VpcLink.
 * `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
 
 ## Import
 
-API Gateway VPC Link can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import API Gateway VPC Link using the `id`. For example:
 
+```terraform
+import {
+  to = aws_api_gateway_vpc_link.example
+  id = "12345abcde"
+}
 ```
-$ terraform import aws_api_gateway_vpc_link.example 12345abcde
+
+Using `terraform import`, import API Gateway VPC Link using the `id`. For example:
+
+```console
+% terraform import aws_api_gateway_vpc_link.example 12345abcde
 ```
diff --git a/website/docs/r/apigatewayv2_api.html.markdown b/website/docs/r/apigatewayv2_api.html.markdown
index 65c44b63b90..103dadace18 100644
--- a/website/docs/r/apigatewayv2_api.html.markdown
+++ b/website/docs/r/apigatewayv2_api.html.markdown
@@ -35,7 +35,7 @@ resource "aws_apigatewayv2_api" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) Name of the API. Must be less than or equal to 128 characters in length.
 * `protocol_type` - (Required) API protocol. Valid values: `HTTP`, `WEBSOCKET`.
@@ -75,9 +75,9 @@ The `cors_configuration` object supports the following:
 * `expose_headers` - (Optional) Set of exposed HTTP headers.
 * `max_age` - (Optional) Number of seconds that the browser should cache preflight request results.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - API identifier.
 * `api_endpoint` - URI of the API, of the form `https://{api-id}.execute-api.{region}.amazonaws.com` for HTTP APIs and `wss://{api-id}.execute-api.{region}.amazonaws.com` for WebSocket APIs.
@@ -89,8 +89,17 @@ See the [Amazon API Gateway Developer Guide](https://docs.aws.amazon.com/apigate
 
 ## Import
 
-`aws_apigatewayv2_api` can be imported by using the API identifier, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_apigatewayv2_api` using the API identifier. For example:
 
+```terraform
+import {
+  to = aws_apigatewayv2_api.example
+  id = "aabbccddee"
+}
 ```
-$ terraform import aws_apigatewayv2_api.example aabbccddee
+
+Using `terraform import`, import `aws_apigatewayv2_api` using the API identifier. For example:
+
+```console
+% terraform import aws_apigatewayv2_api.example aabbccddee
 ```
diff --git a/website/docs/r/apigatewayv2_api_mapping.html.markdown b/website/docs/r/apigatewayv2_api_mapping.html.markdown
index e3733884bd0..3b5c9bac5a5 100644
--- a/website/docs/r/apigatewayv2_api_mapping.html.markdown
+++ b/website/docs/r/apigatewayv2_api_mapping.html.markdown
@@ -25,23 +25,32 @@ resource "aws_apigatewayv2_api_mapping" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `api_id` - (Required) API identifier.
 * `domain_name` - (Required) Domain name. Use the [`aws_apigatewayv2_domain_name`](/docs/providers/aws/r/apigatewayv2_domain_name.html) resource to configure a domain name.
 * `stage` - (Required) API stage. Use the [`aws_apigatewayv2_stage`](/docs/providers/aws/r/apigatewayv2_stage.html) resource to configure an API stage.
 * `api_mapping_key` - (Optional) The API mapping key. Refer to [REST API](https://docs.aws.amazon.com/apigateway/latest/developerguide/rest-api-mappings.html), [HTTP API](https://docs.aws.amazon.com/apigateway/latest/developerguide/http-api-mappings.html) or [WebSocket API](https://docs.aws.amazon.com/apigateway/latest/developerguide/websocket-api-mappings.html).
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - API mapping identifier.
 
 ## Import
 
-`aws_apigatewayv2_api_mapping` can be imported by using the API mapping identifier and domain name, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_apigatewayv2_api_mapping` using the API mapping identifier and domain name. For example:
 
+```terraform
+import {
+  to = aws_apigatewayv2_api_mapping.example
+  id = "1122334/ws-api.example.com"
+}
 ```
-$ terraform import aws_apigatewayv2_api_mapping.example 1122334/ws-api.example.com
+
+Using `terraform import`, import `aws_apigatewayv2_api_mapping` using the API mapping identifier and domain name. For example:
+
+```console
+% terraform import aws_apigatewayv2_api_mapping.example 1122334/ws-api.example.com
 ```
diff --git a/website/docs/r/apigatewayv2_authorizer.html.markdown b/website/docs/r/apigatewayv2_authorizer.html.markdown
index 825aec13967..0531e6563e5 100644
--- a/website/docs/r/apigatewayv2_authorizer.html.markdown
+++ b/website/docs/r/apigatewayv2_authorizer.html.markdown
@@ -40,7 +40,7 @@ resource "aws_apigatewayv2_authorizer" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `api_id` - (Required) API identifier.
 * `authorizer_type` - (Required) Authorizer type. Valid values: `JWT`, `REQUEST`.
@@ -70,16 +70,25 @@ The `jwt_configuration` object supports the following:
 * `audience` - (Optional) List of the intended recipients of the JWT. A valid JWT must provide an aud that matches at least one entry in this list.
 * `issuer` - (Optional) Base domain of the identity provider that issues JSON Web Tokens, such as the `endpoint` attribute of the [`aws_cognito_user_pool`](/docs/providers/aws/r/cognito_user_pool.html) resource.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Authorizer identifier.
 
 ## Import
 
-`aws_apigatewayv2_authorizer` can be imported by using the API identifier and authorizer identifier, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_apigatewayv2_authorizer` using the API identifier and authorizer identifier. For example:
 
+```terraform
+import {
+  to = aws_apigatewayv2_authorizer.example
+  id = "aabbccddee/1122334"
+}
 ```
-$ terraform import aws_apigatewayv2_authorizer.example aabbccddee/1122334
+
+Using `terraform import`, import `aws_apigatewayv2_authorizer` using the API identifier and authorizer identifier. For example:
+
+```console
+% terraform import aws_apigatewayv2_authorizer.example aabbccddee/1122334
 ```
diff --git a/website/docs/r/apigatewayv2_deployment.html.markdown b/website/docs/r/apigatewayv2_deployment.html.markdown
index a62a8e0a276..a1577d90715 100644
--- a/website/docs/r/apigatewayv2_deployment.html.markdown
+++ b/website/docs/r/apigatewayv2_deployment.html.markdown
@@ -54,25 +54,34 @@ resource "aws_apigatewayv2_deployment" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `api_id` - (Required) API identifier.
 * `description` - (Optional) Description for the deployment resource. Must be less than or equal to 1024 characters in length.
 * `triggers` - (Optional) Map of arbitrary keys and values that, when changed, will trigger a redeployment. To force a redeployment without changing these keys/values, use the [`terraform taint` command](https://www.terraform.io/docs/commands/taint.html).
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Deployment identifier.
 * `auto_deployed` - Whether the deployment was automatically released.
 
 ## Import
 
-`aws_apigatewayv2_deployment` can be imported by using the API identifier and deployment identifier, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_apigatewayv2_deployment` using the API identifier and deployment identifier. For example:
 
+```terraform
+import {
+  to = aws_apigatewayv2_deployment.example
+  id = "aabbccddee/1122334"
+}
 ```
-$ terraform import aws_apigatewayv2_deployment.example aabbccddee/1122334
+
+Using `terraform import`, import `aws_apigatewayv2_deployment` using the API identifier and deployment identifier. For example:
+
+```console
+% terraform import aws_apigatewayv2_deployment.example aabbccddee/1122334
 ```
 
 The `triggers` argument cannot be imported.
diff --git a/website/docs/r/apigatewayv2_domain_name.html.markdown b/website/docs/r/apigatewayv2_domain_name.html.markdown
index 7af1c9912d2..c6af6ac0d22 100644
--- a/website/docs/r/apigatewayv2_domain_name.html.markdown
+++ b/website/docs/r/apigatewayv2_domain_name.html.markdown
@@ -58,7 +58,7 @@ resource "aws_route53_record" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `domain_name` - (Required) Domain name. Must be between 1 and 512 characters in length.
 * `domain_name_configuration` - (Required) Domain name configuration. See below.
@@ -79,9 +79,9 @@ The following arguments are supported:
 * `truststore_uri` - (Required) Amazon S3 URL that specifies the truststore for mutual TLS authentication, for example, `s3://bucket-name/key-name`. The truststore can contain certificates from public or private certificate authorities. To update the truststore, upload a new version to S3, and then update your custom domain name to use the new version.
 * `truststore_version` - (Optional) Version of the S3 object that contains the truststore. To specify a version, you must have versioning enabled for the S3 bucket.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `api_mapping_selection_expression` - [API mapping selection expression](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-websocket-api-selection-expressions.html#apigateway-websocket-api-mapping-selection-expressions) for the domain name.
 * `arn` - ARN of the domain name.
@@ -97,8 +97,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_apigatewayv2_domain_name` can be imported by using the domain name, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_apigatewayv2_domain_name` using the domain name. For example:
 
+```terraform
+import {
+  to = aws_apigatewayv2_domain_name.example
+  id = "ws-api.example.com"
+}
 ```
-$ terraform import aws_apigatewayv2_domain_name.example ws-api.example.com
+
+Using `terraform import`, import `aws_apigatewayv2_domain_name` using the domain name. For example:
+
+```console
+% terraform import aws_apigatewayv2_domain_name.example ws-api.example.com
 ```
diff --git a/website/docs/r/apigatewayv2_integration.html.markdown b/website/docs/r/apigatewayv2_integration.html.markdown
index 43d725ca03a..80d25f42698 100644
--- a/website/docs/r/apigatewayv2_integration.html.markdown
+++ b/website/docs/r/apigatewayv2_integration.html.markdown
@@ -104,7 +104,7 @@ resource "aws_apigatewayv2_integration" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `api_id` - (Required) API identifier.
 * `integration_type` - (Required) Integration type of an integration.
@@ -143,19 +143,28 @@ The `tls_config` object supports the following:
 
 * `server_name_to_verify` - (Optional) If you specify a server name, API Gateway uses it to verify the hostname on the integration's certificate. The server name is also included in the TLS handshake to support Server Name Indication (SNI) or virtual hosting.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Integration identifier.
 * `integration_response_selection_expression` - The [integration response selection expression](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-websocket-api-selection-expressions.html#apigateway-websocket-api-integration-response-selection-expressions) for the integration.
 
 ## Import
 
-`aws_apigatewayv2_integration` can be imported by using the API identifier and integration identifier, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_apigatewayv2_integration` using the API identifier and integration identifier. For example:
 
+```terraform
+import {
+  to = aws_apigatewayv2_integration.example
+  id = "aabbccddee/1122334"
+}
 ```
-$ terraform import aws_apigatewayv2_integration.example aabbccddee/1122334
+
+Using `terraform import`, import `aws_apigatewayv2_integration` using the API identifier and integration identifier. For example:
+
+```console
+% terraform import aws_apigatewayv2_integration.example aabbccddee/1122334
 ```
 
 -> **Note:** The API Gateway managed integration created as part of [_quick_create_](https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-basic-concept.html#apigateway-definition-quick-create) cannot be imported.
diff --git a/website/docs/r/apigatewayv2_integration_response.html.markdown b/website/docs/r/apigatewayv2_integration_response.html.markdown
index 03db30c1a87..8e5359b8376 100644
--- a/website/docs/r/apigatewayv2_integration_response.html.markdown
+++ b/website/docs/r/apigatewayv2_integration_response.html.markdown
@@ -25,7 +25,7 @@ resource "aws_apigatewayv2_integration_response" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `api_id` - (Required) API identifier.
 * `integration_id` - (Required) Identifier of the [`aws_apigatewayv2_integration`](/docs/providers/aws/r/apigatewayv2_integration.html).
@@ -34,16 +34,25 @@ The following arguments are supported:
 * `response_templates` - (Optional) Map of Velocity templates that are applied on the request payload based on the value of the Content-Type header sent by the client.
 * `template_selection_expression` - (Optional) The [template selection expression](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-websocket-api-selection-expressions.html#apigateway-websocket-api-template-selection-expressions) for the integration response.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Integration response identifier.
 
 ## Import
 
-`aws_apigatewayv2_integration_response` can be imported by using the API identifier, integration identifier and integration response identifier, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_apigatewayv2_integration_response` using the API identifier, integration identifier and integration response identifier. For example:
 
+```terraform
+import {
+  to = aws_apigatewayv2_integration_response.example
+  id = "aabbccddee/1122334/998877"
+}
 ```
-$ terraform import aws_apigatewayv2_integration_response.example aabbccddee/1122334/998877
+
+Using `terraform import`, import `aws_apigatewayv2_integration_response` using the API identifier, integration identifier and integration response identifier. For example:
+
+```console
+% terraform import aws_apigatewayv2_integration_response.example aabbccddee/1122334/998877
 ```
diff --git a/website/docs/r/apigatewayv2_model.html.markdown b/website/docs/r/apigatewayv2_model.html.markdown
index 6c5cc2bfe83..41be67ca6be 100644
--- a/website/docs/r/apigatewayv2_model.html.markdown
+++ b/website/docs/r/apigatewayv2_model.html.markdown
@@ -36,7 +36,7 @@ resource "aws_apigatewayv2_model" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `api_id` - (Required) API identifier.
 * `content_type` - (Required)  The content-type for the model, for example, `application/json`. Must be between 1 and 256 characters in length.
@@ -44,16 +44,25 @@ The following arguments are supported:
 * `schema` - (Required) Schema for the model. This should be a [JSON schema draft 4](https://tools.ietf.org/html/draft-zyp-json-schema-04) model. Must be less than or equal to 32768 characters in length.
 * `description` - (Optional) Description of the model. Must be between 1 and 128 characters in length.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Model identifier.
 
 ## Import
 
-`aws_apigatewayv2_model` can be imported by using the API identifier and model identifier, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_apigatewayv2_model` using the API identifier and model identifier. For example:
 
+```terraform
+import {
+  to = aws_apigatewayv2_model.example
+  id = "aabbccddee/1122334"
+}
 ```
-$ terraform import aws_apigatewayv2_model.example aabbccddee/1122334
+
+Using `terraform import`, import `aws_apigatewayv2_model` using the API identifier and model identifier. For example:
+
+```console
+% terraform import aws_apigatewayv2_model.example aabbccddee/1122334
 ```
diff --git a/website/docs/r/apigatewayv2_route.html.markdown b/website/docs/r/apigatewayv2_route.html.markdown
index 61b0e726f4f..fe6c793b031 100644
--- a/website/docs/r/apigatewayv2_route.html.markdown
+++ b/website/docs/r/apigatewayv2_route.html.markdown
@@ -54,7 +54,7 @@ resource "aws_apigatewayv2_route" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `api_id` - (Required) API identifier.
 * `route_key` - (Required) Route key for the route. For HTTP APIs, the route key can be either `$default`, or a combination of an HTTP method and resource path, for example, `GET /pets`.
@@ -77,18 +77,27 @@ The `request_parameter` object supports the following:
 * `request_parameter_key` - (Required) Request parameter key. This is a [request data mapping parameter](https://docs.aws.amazon.com/apigateway/latest/developerguide/websocket-api-data-mapping.html#websocket-mapping-request-parameters).
 * `required` - (Required) Boolean whether or not the parameter is required.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Route identifier.
 
 ## Import
 
-`aws_apigatewayv2_route` can be imported by using the API identifier and route identifier, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_apigatewayv2_route` using the API identifier and route identifier. For example:
 
+```terraform
+import {
+  to = aws_apigatewayv2_route.example
+  id = "aabbccddee/1122334"
+}
 ```
-$ terraform import aws_apigatewayv2_route.example aabbccddee/1122334
+
+Using `terraform import`, import `aws_apigatewayv2_route` using the API identifier and route identifier. For example:
+
+```console
+% terraform import aws_apigatewayv2_route.example aabbccddee/1122334
 ```
 
 -> **Note:** The API Gateway managed route created as part of [_quick_create_](https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-basic-concept.html#apigateway-definition-quick-create) cannot be imported.
diff --git a/website/docs/r/apigatewayv2_route_response.html.markdown b/website/docs/r/apigatewayv2_route_response.html.markdown
index 8ccd6098621..e81e9850946 100644
--- a/website/docs/r/apigatewayv2_route_response.html.markdown
+++ b/website/docs/r/apigatewayv2_route_response.html.markdown
@@ -25,7 +25,7 @@ resource "aws_apigatewayv2_route_response" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `api_id` - (Required) API identifier.
 * `route_id` - (Required) Identifier of the [`aws_apigatewayv2_route`](/docs/providers/aws/r/apigatewayv2_route.html).
@@ -33,16 +33,25 @@ The following arguments are supported:
 * `model_selection_expression` - (Optional) The [model selection expression](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-websocket-api-selection-expressions.html#apigateway-websocket-api-model-selection-expressions) for the route response.
 * `response_models` - (Optional) Response models for the route response.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Route response identifier.
 
 ## Import
 
-`aws_apigatewayv2_route_response` can be imported by using the API identifier, route identifier and route response identifier, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_apigatewayv2_route_response` using the API identifier, route identifier and route response identifier. For example:
 
+```terraform
+import {
+  to = aws_apigatewayv2_route_response.example
+  id = "aabbccddee/1122334/998877"
+}
 ```
-$ terraform import aws_apigatewayv2_route_response.example aabbccddee/1122334/998877
+
+Using `terraform import`, import `aws_apigatewayv2_route_response` using the API identifier, route identifier and route response identifier. For example:
+
+```console
+% terraform import aws_apigatewayv2_route_response.example aabbccddee/1122334/998877
 ```
diff --git a/website/docs/r/apigatewayv2_stage.html.markdown b/website/docs/r/apigatewayv2_stage.html.markdown
index 164f86e2354..6b67d4bc0de 100644
--- a/website/docs/r/apigatewayv2_stage.html.markdown
+++ b/website/docs/r/apigatewayv2_stage.html.markdown
@@ -69,9 +69,9 @@ Valid values: `ERROR`, `INFO`, `OFF`. Defaults to `OFF`. Supported only for WebS
 * `throttling_burst_limit` - (Optional) Throttling burst limit for the route.
 * `throttling_rate_limit` - (Optional) Throttling rate limit for the route.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Stage identifier.
 * `arn` - ARN of the stage.
@@ -84,10 +84,19 @@ See the [Amazon API Gateway Developer Guide](https://docs.aws.amazon.com/apigate
 
 ## Import
 
-`aws_apigatewayv2_stage` can be imported by using the API identifier and stage name, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_apigatewayv2_stage` using the API identifier and stage name. For example:
 
+```terraform
+import {
+  to = aws_apigatewayv2_stage.example
+  id = "aabbccddee/example-stage"
+}
 ```
-$ terraform import aws_apigatewayv2_stage.example aabbccddee/example-stage
+
+Using `terraform import`, import `aws_apigatewayv2_stage` using the API identifier and stage name. For example:
+
+```console
+% terraform import aws_apigatewayv2_stage.example aabbccddee/example-stage
 ```
 
 -> **Note:** The API Gateway managed stage created as part of [_quick_create_](https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-basic-concept.html#apigateway-definition-quick-create) cannot be imported.
diff --git a/website/docs/r/apigatewayv2_vpc_link.html.markdown b/website/docs/r/apigatewayv2_vpc_link.html.markdown
index 38aad822420..e8d81552c03 100644
--- a/website/docs/r/apigatewayv2_vpc_link.html.markdown
+++ b/website/docs/r/apigatewayv2_vpc_link.html.markdown
@@ -29,16 +29,16 @@ resource "aws_apigatewayv2_vpc_link" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) Name of the VPC Link. Must be between 1 and 128 characters in length.
 * `security_group_ids` - (Required) Security group IDs for the VPC Link.
 * `subnet_ids` - (Required) Subnet IDs for the VPC Link.
 * `tags` - (Optional) Map of tags to assign to the VPC Link. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - VPC Link identifier.
 * `arn` - VPC Link ARN.
@@ -46,8 +46,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_apigatewayv2_vpc_link` can be imported by using the VPC Link identifier, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_apigatewayv2_vpc_link` using the VPC Link identifier. For example:
 
+```terraform
+import {
+  to = aws_apigatewayv2_vpc_link.example
+  id = "aabbccddee"
+}
 ```
-$ terraform import aws_apigatewayv2_vpc_link.example aabbccddee
+
+Using `terraform import`, import `aws_apigatewayv2_vpc_link` using the VPC Link identifier. For example:
+
+```console
+% terraform import aws_apigatewayv2_vpc_link.example aabbccddee
 ```
diff --git a/website/docs/r/app_cookie_stickiness_policy.html.markdown b/website/docs/r/app_cookie_stickiness_policy.html.markdown
index e0d3641df1e..df449ca8b51 100644
--- a/website/docs/r/app_cookie_stickiness_policy.html.markdown
+++ b/website/docs/r/app_cookie_stickiness_policy.html.markdown
@@ -35,7 +35,7 @@ resource "aws_app_cookie_stickiness_policy" "foo" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) Name of the stickiness policy.
 * `load_balancer` - (Required) Name of load balancer to which the policy
@@ -45,9 +45,9 @@ The following arguments are supported:
 balancer.
 * `cookie_name` - (Required) Application cookie whose lifetime the ELB's cookie should follow.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - ID of the policy.
 * `name` - Name of the stickiness policy.
@@ -57,8 +57,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Application cookie stickiness policies can be imported using the ELB name, port, and policy name separated by colons (`:`), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import application cookie stickiness policies using the ELB name, port, and policy name separated by colons (`:`). For example:
 
-```sh
-$ terraform import aws_app_cookie_stickiness_policy.example my-elb:80:my-policy
+```terraform
+import {
+  to = aws_app_cookie_stickiness_policy.example
+  id = "my-elb:80:my-policy"
+}
+```
+
+Using `terraform import`, import application cookie stickiness policies using the ELB name, port, and policy name separated by colons (`:`). For example:
+
+```console
+% terraform import aws_app_cookie_stickiness_policy.example my-elb:80:my-policy
 ```
diff --git a/website/docs/r/appautoscaling_policy.html.markdown b/website/docs/r/appautoscaling_policy.html.markdown
index ac28f00413c..10307ebf616 100644
--- a/website/docs/r/appautoscaling_policy.html.markdown
+++ b/website/docs/r/appautoscaling_policy.html.markdown
@@ -198,7 +198,7 @@ resource "aws_appautoscaling_policy" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) Name of the policy. Must be between 1 and 255 characters in length.
 * `policy_type` - (Optional) Policy type. Valid values are `StepScaling` and `TargetTrackingScaling`. Defaults to `StepScaling`. Certain services only support only one policy type. For more information see the [Target Tracking Scaling Policies](https://docs.aws.amazon.com/autoscaling/application/userguide/application-auto-scaling-target-tracking.html) and [Step Scaling Policies](https://docs.aws.amazon.com/autoscaling/application/userguide/application-auto-scaling-step-scaling-policies.html) documentation.
@@ -341,9 +341,9 @@ The `target_tracking_scaling_policy_configuration` `predefined_metric_specificat
 * `predefined_metric_type` - (Required) Metric type.
 * `resource_label` - (Optional) Reserved for future use if the `predefined_metric_type` is not `ALBRequestCountPerTarget`. If the `predefined_metric_type` is `ALBRequestCountPerTarget`, you must specify this argument. Documentation can be found at: [AWS Predefined Scaling Metric Specification](https://docs.aws.amazon.com/autoscaling/plans/APIReference/API_PredefinedScalingMetricSpecification.html). Must be less than or equal to 1023 characters in length.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `alarm_arns` - List of CloudWatch alarm ARNs associated with the scaling policy.
 * `arn` - ARN assigned by AWS to the scaling policy.
@@ -352,8 +352,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Application AutoScaling Policy can be imported using the `service-namespace` , `resource-id`, `scalable-dimension` and `policy-name` separated by `/`.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Application AutoScaling Policy using the `service-namespace` , `resource-id`, `scalable-dimension` and `policy-name` separated by `/`. For example:
 
+```terraform
+import {
+  to = aws_appautoscaling_policy.test-policy
+  id = "service-namespace/resource-id/scalable-dimension/policy-name"
+}
 ```
-$ terraform import aws_appautoscaling_policy.test-policy service-namespace/resource-id/scalable-dimension/policy-name
+
+Using `terraform import`, import Application AutoScaling Policy using the `service-namespace` , `resource-id`, `scalable-dimension` and `policy-name` separated by `/`. For example:
+
+```console
+% terraform import aws_appautoscaling_policy.test-policy service-namespace/resource-id/scalable-dimension/policy-name
 ```
diff --git a/website/docs/r/appautoscaling_scheduled_action.html.markdown b/website/docs/r/appautoscaling_scheduled_action.html.markdown
index 1461f7f170d..38a9f3ff45e 100644
--- a/website/docs/r/appautoscaling_scheduled_action.html.markdown
+++ b/website/docs/r/appautoscaling_scheduled_action.html.markdown
@@ -64,7 +64,7 @@ resource "aws_appautoscaling_scheduled_action" "ecs" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) Name of the scheduled action.
 * `service_namespace` - (Required) Namespace of the AWS service. Documentation can be found in the `ServiceNamespace` parameter at: [AWS Application Auto Scaling API Reference](https://docs.aws.amazon.com/autoscaling/application/APIReference/API_PutScheduledAction.html) Example: ecs
@@ -81,8 +81,8 @@ The following arguments are supported:
 * `max_capacity` - (Optional) Maximum capacity. At least one of `max_capacity` or `min_capacity` must be set.
 * `min_capacity` - (Optional) Minimum capacity. At least one of `min_capacity` or `max_capacity` must be set.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the scheduled action.
diff --git a/website/docs/r/appautoscaling_target.html.markdown b/website/docs/r/appautoscaling_target.html.markdown
index 62d4093dfd3..c8899c14fe2 100644
--- a/website/docs/r/appautoscaling_target.html.markdown
+++ b/website/docs/r/appautoscaling_target.html.markdown
@@ -84,7 +84,7 @@ resource "aws_appautoscaling_target" "ecs_target" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `max_capacity` - (Required) Max capacity of the scalable target.
 * `min_capacity` - (Required) Min capacity of the scalable target.
@@ -94,17 +94,26 @@ The following arguments are supported:
 * `service_namespace` - (Required) AWS service namespace of the scalable target. Documentation can be found in the `ServiceNamespace` parameter at: [AWS Application Auto Scaling API Reference](https://docs.aws.amazon.com/autoscaling/application/APIReference/API_RegisterScalableTarget.html#API_RegisterScalableTarget_RequestParameters)
 * `tags` - (Optional) Map of tags to assign to the scalable target. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The ARN of the scalable target.
 * `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
 
 ## Import
 
-Application AutoScaling Target can be imported using the `service-namespace` , `resource-id` and `scalable-dimension` separated by `/`.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Application AutoScaling Target using the `service-namespace` , `resource-id` and `scalable-dimension` separated by `/`. For example:
 
+```terraform
+import {
+  to = aws_appautoscaling_target.test-target
+  id = "service-namespace/resource-id/scalable-dimension"
+}
 ```
-$ terraform import aws_appautoscaling_target.test-target service-namespace/resource-id/scalable-dimension
+
+Using `terraform import`, import Application AutoScaling Target using the `service-namespace` , `resource-id` and `scalable-dimension` separated by `/`. For example:
+
+```console
+% terraform import aws_appautoscaling_target.test-target service-namespace/resource-id/scalable-dimension
 ```
diff --git a/website/docs/r/appconfig_application.html.markdown b/website/docs/r/appconfig_application.html.markdown
index ee3d8f303dc..370e539d34b 100644
--- a/website/docs/r/appconfig_application.html.markdown
+++ b/website/docs/r/appconfig_application.html.markdown
@@ -25,15 +25,15 @@ resource "aws_appconfig_application" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) Name for the application. Must be between 1 and 64 characters in length.
 * `description` - (Optional) Description of the application. Can be at most 1024 characters.
 * `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the AppConfig Application.
 * `id` - AppConfig application ID.
@@ -41,8 +41,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-AppConfig Applications can be imported using their application ID, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AppConfig Applications using their application ID. For example:
 
+```terraform
+import {
+  to = aws_appconfig_application.example
+  id = "71rxuzt"
+}
 ```
-$ terraform import aws_appconfig_application.example 71rxuzt
+
+Using `terraform import`, import AppConfig Applications using their application ID. For example:
+
+```console
+% terraform import aws_appconfig_application.example 71rxuzt
 ```
diff --git a/website/docs/r/appconfig_configuration_profile.html.markdown b/website/docs/r/appconfig_configuration_profile.html.markdown
index 6376e6b332f..10e73b09764 100644
--- a/website/docs/r/appconfig_configuration_profile.html.markdown
+++ b/website/docs/r/appconfig_configuration_profile.html.markdown
@@ -32,7 +32,7 @@ resource "aws_appconfig_configuration_profile" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `application_id` - (Required, Forces new resource) Application ID. Must be between 4 and 7 characters in length.
 * `location_uri` - (Required, Forces new resource) URI to locate the configuration. You can specify the AWS AppConfig hosted configuration store, Systems Manager (SSM) document, an SSM Parameter Store parameter, or an Amazon S3 object. For the hosted configuration store, specify `hosted`. For an SSM document, specify either the document name in the format `ssm-document://<Document_name>` or the ARN. For a parameter, specify either the parameter name in the format `ssm-parameter://<Parameter_name>` or the ARN. For an Amazon S3 object, specify the URI in the following format: `s3://<bucket>/<objectKey>`.
@@ -50,9 +50,9 @@ The `validator` block supports the following:
 * `content` - (Optional, Required when `type` is `LAMBDA`) Either the JSON Schema content or the ARN of an AWS Lambda function.
 * `type` - (Optional) Type of validator. Valid values: `JSON_SCHEMA` and `LAMBDA`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the AppConfig Configuration Profile.
 * `configuration_profile_id` - The configuration profile ID.
@@ -61,8 +61,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-AppConfig Configuration Profiles can be imported by using the configuration profile ID and application ID separated by a colon (`:`), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AppConfig Configuration Profiles using the configuration profile ID and application ID separated by a colon (`:`). For example:
 
+```terraform
+import {
+  to = aws_appconfig_configuration_profile.example
+  id = "71abcde:11xxxxx"
+}
 ```
-$ terraform import aws_appconfig_configuration_profile.example 71abcde:11xxxxx
+
+Using `terraform import`, import AppConfig Configuration Profiles using the configuration profile ID and application ID separated by a colon (`:`). For example:
+
+```console
+% terraform import aws_appconfig_configuration_profile.example 71abcde:11xxxxx
 ```
diff --git a/website/docs/r/appconfig_deployment.html.markdown b/website/docs/r/appconfig_deployment.html.markdown
index ac9da946f8f..39335bb6329 100644
--- a/website/docs/r/appconfig_deployment.html.markdown
+++ b/website/docs/r/appconfig_deployment.html.markdown
@@ -29,7 +29,7 @@ resource "aws_appconfig_deployment" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `application_id` - (Required, Forces new resource) Application ID. Must be between 4 and 7 characters in length.
 * `configuration_profile_id` - (Required, Forces new resource) Configuration profile ID. Must be between 4 and 7 characters in length.
@@ -39,9 +39,9 @@ The following arguments are supported:
 * `environment_id` - (Required, Forces new resource) Environment ID. Must be between 4 and 7 characters in length.
 * `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - AppConfig application ID, environment ID, and deployment number separated by a slash (`/`).
 * `arn` - ARN of the AppConfig Deployment.
@@ -51,8 +51,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-AppConfig Deployments can be imported by using the application ID, environment ID, and deployment number separated by a slash (`/`), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AppConfig Deployments using the application ID, environment ID, and deployment number separated by a slash (`/`). For example:
 
+```terraform
+import {
+  to = aws_appconfig_deployment.example
+  id = "71abcde/11xxxxx/1"
+}
 ```
-$ terraform import aws_appconfig_deployment.example 71abcde/11xxxxx/1
+
+Using `terraform import`, import AppConfig Deployments using the application ID, environment ID, and deployment number separated by a slash (`/`). For example:
+
+```console
+% terraform import aws_appconfig_deployment.example 71abcde/11xxxxx/1
 ```
diff --git a/website/docs/r/appconfig_deployment_strategy.html.markdown b/website/docs/r/appconfig_deployment_strategy.html.markdown
index f54c152b95e..5bce64d99d6 100644
--- a/website/docs/r/appconfig_deployment_strategy.html.markdown
+++ b/website/docs/r/appconfig_deployment_strategy.html.markdown
@@ -30,7 +30,7 @@ resource "aws_appconfig_deployment_strategy" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `deployment_duration_in_minutes` - (Required) Total amount of time for a deployment to last. Minimum value of 0, maximum value of 1440.
 * `growth_factor` - (Required) Percentage of targets to receive a deployed configuration during each interval. Minimum value of 1.0, maximum value of 100.0.
@@ -41,9 +41,9 @@ The following arguments are supported:
 * `growth_type` - (Optional) Algorithm used to define how percentage grows over time. Valid value: `LINEAR` and `EXPONENTIAL`. Defaults to `LINEAR`.
 * `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - AppConfig deployment strategy ID.
 * `arn` - ARN of the AppConfig Deployment Strategy.
@@ -51,8 +51,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-AppConfig Deployment Strategies can be imported by using their deployment strategy ID, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AppConfig Deployment Strategies using their deployment strategy ID. For example:
 
+```terraform
+import {
+  to = aws_appconfig_deployment_strategy.example
+  id = "11xxxxx"
+}
 ```
-$ terraform import aws_appconfig_deployment_strategy.example 11xxxxx
+
+Using `terraform import`, import AppConfig Deployment Strategies using their deployment strategy ID. For example:
+
+```console
+% terraform import aws_appconfig_deployment_strategy.example 11xxxxx
 ```
diff --git a/website/docs/r/appconfig_environment.html.markdown b/website/docs/r/appconfig_environment.html.markdown
index 291c3246341..b76cf1f3042 100644
--- a/website/docs/r/appconfig_environment.html.markdown
+++ b/website/docs/r/appconfig_environment.html.markdown
@@ -40,7 +40,7 @@ resource "aws_appconfig_application" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `application_id` - (Required, Forces new resource) AppConfig application ID. Must be between 4 and 7 characters in length.
 * `name` - (Required) Name for the environment. Must be between 1 and 64 characters in length.
@@ -55,9 +55,9 @@ The `monitor` block supports the following:
 * `alarm_arn` - (Required) ARN of the Amazon CloudWatch alarm.
 * `alarm_role_arn` - (Optional) ARN of an IAM role for AWS AppConfig to monitor `alarm_arn`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the AppConfig Environment.
 * `id` - (**Deprecated**) AppConfig environment ID and application ID separated by a colon (`:`).
@@ -68,8 +68,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-AppConfig Environments can be imported by using the environment ID and application ID separated by a colon (`:`), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AppConfig Environments using the environment ID and application ID separated by a colon (`:`). For example:
 
+```terraform
+import {
+  to = aws_appconfig_environment.example
+  id = "71abcde:11xxxxx"
+}
 ```
-$ terraform import aws_appconfig_environment.example 71abcde:11xxxxx
+
+Using `terraform import`, import AppConfig Environments using the environment ID and application ID separated by a colon (`:`). For example:
+
+```console
+% terraform import aws_appconfig_environment.example 71abcde:11xxxxx
 ```
diff --git a/website/docs/r/appconfig_extension.html.markdown b/website/docs/r/appconfig_extension.html.markdown
index 82eb93760c7..6bd34db2756 100644
--- a/website/docs/r/appconfig_extension.html.markdown
+++ b/website/docs/r/appconfig_extension.html.markdown
@@ -52,7 +52,7 @@ resource "aws_appconfig_extension" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) A name for the extension. Each extension name in your account must be unique. Extension versions use the same name.
 * `description` - (Optional) Information about the extension.
@@ -84,9 +84,9 @@ The `parameter` configuration block supports configuring any number of the follo
 * `required` - (Required) Determines if a parameter value must be specified in the extension association.
 * `description` - (Optional) Information about the parameter.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the AppConfig Extension.
 * `id` - AppConfig Extension ID.
@@ -94,8 +94,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-AppConfig Extensions can be imported using their extension ID, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AppConfig Extensions using their extension ID. For example:
 
+```terraform
+import {
+  to = aws_appconfig_extension.example
+  id = "71rxuzt"
+}
 ```
-$ terraform import aws_appconfig_extension.example 71rxuzt
+
+Using `terraform import`, import AppConfig Extensions using their extension ID. For example:
+
+```console
+% terraform import aws_appconfig_extension.example 71rxuzt
 ```
diff --git a/website/docs/r/appconfig_extension_association.html.markdown b/website/docs/r/appconfig_extension_association.html.markdown
index 9653af38e30..f0ca13e0386 100644
--- a/website/docs/r/appconfig_extension_association.html.markdown
+++ b/website/docs/r/appconfig_extension_association.html.markdown
@@ -61,15 +61,15 @@ resource "aws_appconfig_extension_association" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `extension_arn` - (Required) The ARN of the extension defined in the association.
 * `resource_arn` - (Optional) The ARN of the application, configuration profile, or environment to associate with the extension.
 * `parameters` - (Optional) The parameter names and values defined for the association.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the AppConfig Extension Association.
 * `id` - AppConfig Extension Association ID.
@@ -77,8 +77,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-AppConfig Extension Associations can be imported using their extension association ID, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AppConfig Extension Associations using their extension association ID. For example:
 
+```terraform
+import {
+  to = aws_appconfig_extension_association.example
+  id = "71rxuzt"
+}
 ```
-$ terraform import aws_appconfig_extension_association.example 71rxuzt
+
+Using `terraform import`, import AppConfig Extension Associations using their extension association ID. For example:
+
+```console
+% terraform import aws_appconfig_extension_association.example 71rxuzt
 ```
diff --git a/website/docs/r/appconfig_hosted_configuration_version.html.markdown b/website/docs/r/appconfig_hosted_configuration_version.html.markdown
index a0d78b9681f..f7f56fe0425 100644
--- a/website/docs/r/appconfig_hosted_configuration_version.html.markdown
+++ b/website/docs/r/appconfig_hosted_configuration_version.html.markdown
@@ -81,7 +81,7 @@ resource "aws_appconfig_hosted_configuration_version" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `application_id` - (Required, Forces new resource) Application ID.
 * `configuration_profile_id` - (Required, Forces new resource) Configuration profile ID.
@@ -89,9 +89,9 @@ The following arguments are supported:
 * `content_type` - (Required, Forces new resource) Standard MIME type describing the format of the configuration content. For more information, see [Content-Type](https://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.17).
 * `description` - (Optional, Forces new resource) Description of the configuration.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the AppConfig  hosted configuration version.
 * `id` - AppConfig application ID, configuration profile ID, and version number separated by a slash (`/`).
@@ -99,8 +99,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-AppConfig Hosted Configuration Versions can be imported by using the application ID, configuration profile ID, and version number separated by a slash (`/`), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AppConfig Hosted Configuration Versions using the application ID, configuration profile ID, and version number separated by a slash (`/`). For example:
 
+```terraform
+import {
+  to = aws_appconfig_hosted_configuration_version.example
+  id = "71abcde/11xxxxx/2"
+}
 ```
-$ terraform import aws_appconfig_hosted_configuration_version.example 71abcde/11xxxxx/2
+
+Using `terraform import`, import AppConfig Hosted Configuration Versions using the application ID, configuration profile ID, and version number separated by a slash (`/`). For example:
+
+```console
+% terraform import aws_appconfig_hosted_configuration_version.example 71abcde/11xxxxx/2
 ```
diff --git a/website/docs/r/appflow_connector_profile.html.markdown b/website/docs/r/appflow_connector_profile.html.markdown
index c0590243a56..dc4459abf4f 100644
--- a/website/docs/r/appflow_connector_profile.html.markdown
+++ b/website/docs/r/appflow_connector_profile.html.markdown
@@ -311,19 +311,28 @@ Datadog, Dynatrace, Infor Nexus, Marketo, ServiceNow, Slack, Veeva, and Zendesk
 * `stage` (Required) - Name of the Amazon S3 stage that was created while setting up an Amazon S3 stage in the Snowflake account. This is written in the following format: `<Database>.<Schema>.<Stage Name>`.
 * `warehouse` (Required) - The name of the Snowflake warehouse.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the connector profile.
 * `credentials_arn` - ARN of the connector profile credentials.
 
 ## Import
 
-AppFlow Connector Profile can be imported using the connector profile `arn`, e.g.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AppFlow Connector Profile using the connector profile `arn`. For example:
 
+```terraform
+import {
+  to = aws_appflow_connector_profile.profile
+  id = "arn:aws:appflow:us-west-2:123456789012:connectorprofile/example-profile"
+}
 ```
-$ terraform import aws_appflow_connector_profile.profile arn:aws:appflow:us-west-2:123456789012:connectorprofile/example-profile
+
+Using `terraform import`, import AppFlow Connector Profile using the connector profile `arn`. For example:
+
+```console
+% terraform import aws_appflow_connector_profile.profile arn:aws:appflow:us-west-2:123456789012:connectorprofile/example-profile
 ```
 
 [1]: https://docs.aws.amazon.com/appflow/1.0/APIReference/Welcome.html
diff --git a/website/docs/r/appflow_flow.html.markdown b/website/docs/r/appflow_flow.html.markdown
index c0886e15ed2..7b7f3f1b3dd 100644
--- a/website/docs/r/appflow_flow.html.markdown
+++ b/website/docs/r/appflow_flow.html.markdown
@@ -131,7 +131,7 @@ resource "aws_appflow_flow" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) Name of the flow.
 * `destination_flow_config` - (Required) A [Destination Flow Config](#destination-flow-config) that controls how Amazon AppFlow places data in the destination connector.
@@ -391,16 +391,25 @@ resource "aws_appflow_flow" "example" {
 }
 ```
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Flow's ARN.
 
 ## Import
 
-AppFlow flows can be imported using the `arn`, e.g.:
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AppFlow flows using the `arn`. For example:
 
+```terraform
+import {
+  to = aws_appflow_flow.example
+  id = "arn:aws:appflow:us-west-2:123456789012:flow/example-flow"
+}
 ```
-$ terraform import aws_appflow_flow.example arn:aws:appflow:us-west-2:123456789012:flow/example-flow
+
+Using `terraform import`, import AppFlow flows using the `arn`. For example:
+
+```console
+% terraform import aws_appflow_flow.example arn:aws:appflow:us-west-2:123456789012:flow/example-flow
 ```
diff --git a/website/docs/r/appintegrations_data_integration.html.markdown b/website/docs/r/appintegrations_data_integration.html.markdown
index 5f658acaf72..b96e64d5e00 100644
--- a/website/docs/r/appintegrations_data_integration.html.markdown
+++ b/website/docs/r/appintegrations_data_integration.html.markdown
@@ -33,7 +33,7 @@ resource "aws_appintegrations_data_integration" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `description` - (Optional) Specifies the description of the Data Integration.
 * `kms_key` - (Required) Specifies the KMS key Amazon Resource Name (ARN) for the Data Integration.
@@ -48,9 +48,9 @@ A `schedule_config` block supports the following arguments:
 * `object` - (Required) The name of the object to pull from the data source. Examples of objects in Salesforce include `Case`, `Account`, or `Lead`.
 * `schedule_expression` - (Required) How often the data should be pulled from data source. Examples include `rate(1 hour)`, `rate(3 hours)`, `rate(1 day)`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The Amazon Resource Name (ARN) of the Data Integration.
 * `id` - The identifier of the Data Integration.
@@ -58,8 +58,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Amazon AppIntegrations Data Integrations can be imported using the `id` e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Amazon AppIntegrations Data Integrations using the `id`. For example:
 
+```terraform
+import {
+  to = aws_appintegrations_data_integration.example
+  id = "12345678-1234-1234-1234-123456789123"
+}
 ```
-$ terraform import aws_appintegrations_data_integration.example 12345678-1234-1234-1234-123456789123
+
+Using `terraform import`, import Amazon AppIntegrations Data Integrations using the `id`. For example:
+
+```console
+% terraform import aws_appintegrations_data_integration.example 12345678-1234-1234-1234-123456789123
 ```
diff --git a/website/docs/r/appintegrations_event_integration.html.markdown b/website/docs/r/appintegrations_event_integration.html.markdown
index 82ef05b0f34..6e0c0e4822a 100644
--- a/website/docs/r/appintegrations_event_integration.html.markdown
+++ b/website/docs/r/appintegrations_event_integration.html.markdown
@@ -30,7 +30,7 @@ resource "aws_appintegrations_event_integration" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `description` - (Optional) Description of the Event Integration.
 * `eventbridge_bus` - (Required) EventBridge bus.
@@ -42,9 +42,9 @@ A `event_filter` block supports the following arguments:
 
 * `source` - (Required) Source of the events.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the Event Integration.
 * `id` - Identifier of the Event Integration which is the name of the Event Integration.
@@ -52,8 +52,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Amazon AppIntegrations Event Integrations can be imported using the `name` e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Amazon AppIntegrations Event Integrations using the `name`. For example:
 
+```terraform
+import {
+  to = aws_appintegrations_event_integration.example
+  id = "example-name"
+}
 ```
-$ terraform import aws_appintegrations_event_integration.example example-name
+
+Using `terraform import`, import Amazon AppIntegrations Event Integrations using the `name`. For example:
+
+```console
+% terraform import aws_appintegrations_event_integration.example example-name
 ```
diff --git a/website/docs/r/applicationinsights_application.html.markdown b/website/docs/r/applicationinsights_application.html.markdown
index 90113f0d410..51d16d5e4f9 100644
--- a/website/docs/r/applicationinsights_application.html.markdown
+++ b/website/docs/r/applicationinsights_application.html.markdown
@@ -55,9 +55,9 @@ The following arguments are optional:
 * `ops_item_sns_topic_arn` - (Optional) SNS topic provided to Application Insights that is associated to the created opsItem. Allows you to receive notifications for updates to the opsItem.
 * `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the Application.
 * `id` - Name of the resource group.
@@ -65,8 +65,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-ApplicationInsights Applications can be imported using the `resource_group_name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import ApplicationInsights Applications using the `resource_group_name`. For example:
 
+```terraform
+import {
+  to = aws_applicationinsights_application.some
+  id = "some-application"
+}
 ```
-$ terraform import aws_applicationinsights_application.some some-application
+
+Using `terraform import`, import ApplicationInsights Applications using the `resource_group_name`. For example:
+
+```console
+% terraform import aws_applicationinsights_application.some some-application
 ```
diff --git a/website/docs/r/appmesh_gateway_route.html.markdown b/website/docs/r/appmesh_gateway_route.html.markdown
index f96e4c5c240..b4c4a2cfb88 100644
--- a/website/docs/r/appmesh_gateway_route.html.markdown
+++ b/website/docs/r/appmesh_gateway_route.html.markdown
@@ -42,7 +42,7 @@ resource "aws_appmesh_gateway_route" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) Name to use for the gateway route. Must be between 1 and 255 characters in length.
 * `mesh_name` - (Required) Name of the service mesh in which to create the gateway route. Must be between 1 and 255 characters in length.
@@ -83,12 +83,17 @@ The `http_route` and `http2_route`'s `action` object additionally supports the f
 The `rewrite` object supports the following:
 
 * `hostname` - (Optional) Host name to rewrite.
+* `path` - (Optional) Exact path to rewrite.
 * `prefix` - (Optional) Specified beginning characters to rewrite.
 
 The `hostname` object supports the following:
 
 * `default_target_hostname` - (Required) Default target host name to write to. Valid values: `ENABLED`, `DISABLED`.
 
+The `path` object supports the following:
+
+* `exact` - (Required) Value used to replace matched path.
+
 The `prefix` object supports the following:
 
 * `default_prefix` - (Optional) Default prefix used to replace the incoming route prefix when rewritten. Valid values: `ENABLED`, `DISABLED`.
@@ -147,9 +152,9 @@ The `query_parameter`'s `match` object supports the following:
 
 * `exact` - (Optional) The exact query parameter to match on.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - ID of the gateway route.
 * `arn` - ARN of the gateway route.
@@ -160,11 +165,19 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-App Mesh gateway routes can be imported using `mesh_name` and `virtual_gateway_name` together with the gateway route's `name`,
-e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import App Mesh gateway routes using `mesh_name` and `virtual_gateway_name` together with the gateway route's `name`. For example:
 
+```terraform
+import {
+  to = aws_appmesh_gateway_route.example
+  id = "mesh/gw1/example-gateway-route"
+}
 ```
-$ terraform import aws_appmesh_gateway_route.example mesh/gw1/example-gateway-route
+
+Using `terraform import`, import App Mesh gateway routes using `mesh_name` and `virtual_gateway_name` together with the gateway route's `name`. For example:
+
+```console
+% terraform import aws_appmesh_gateway_route.example mesh/gw1/example-gateway-route
 ```
 
 [1]: /docs/providers/aws/index.html
diff --git a/website/docs/r/appmesh_mesh.html.markdown b/website/docs/r/appmesh_mesh.html.markdown
index 2b97b94ca73..236034f2e42 100644
--- a/website/docs/r/appmesh_mesh.html.markdown
+++ b/website/docs/r/appmesh_mesh.html.markdown
@@ -36,7 +36,7 @@ resource "aws_appmesh_mesh" "simple" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) Name to use for the service mesh. Must be between 1 and 255 characters in length.
 * `spec` - (Optional) Service mesh specification to apply.
@@ -51,9 +51,9 @@ The `egress_filter` object supports the following:
 * `type` - (Optional) Egress filter type. By default, the type is `DROP_ALL`.
 Valid values are `ALLOW_ALL` and `DROP_ALL`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - ID of the service mesh.
 * `arn` - ARN of the service mesh.
@@ -65,8 +65,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-App Mesh service meshes can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import App Mesh service meshes using the `name`. For example:
 
+```terraform
+import {
+  to = aws_appmesh_mesh.simple
+  id = "simpleapp"
+}
 ```
-$ terraform import aws_appmesh_mesh.simple simpleapp
+
+Using `terraform import`, import App Mesh service meshes using the `name`. For example:
+
+```console
+% terraform import aws_appmesh_mesh.simple simpleapp
 ```
diff --git a/website/docs/r/appmesh_route.html.markdown b/website/docs/r/appmesh_route.html.markdown
index 24ce6a29026..4c488538819 100644
--- a/website/docs/r/appmesh_route.html.markdown
+++ b/website/docs/r/appmesh_route.html.markdown
@@ -137,7 +137,7 @@ resource "aws_appmesh_route" "serviceb" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) Name to use for the route. Must be between 1 and 255 characters in length.
 * `mesh_name` - (Required) Name of the service mesh in which to create the route. Must be between 1 and 255 characters in length.
@@ -306,9 +306,9 @@ The `range` object supports the following:
 * `end` - (Required) End of the range.
 * `start` - (Requited) Start of the range.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - ID of the route.
 * `arn` - ARN of the route.
@@ -319,11 +319,19 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-App Mesh virtual routes can be imported using `mesh_name` and `virtual_router_name` together with the route's `name`,
-e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import App Mesh virtual routes using `mesh_name` and `virtual_router_name` together with the route's `name`. For example:
 
+```terraform
+import {
+  to = aws_appmesh_route.serviceb
+  id = "simpleapp/serviceB/serviceB-route"
+}
 ```
-$ terraform import aws_appmesh_route.serviceb simpleapp/serviceB/serviceB-route
+
+Using `terraform import`, import App Mesh virtual routes using `mesh_name` and `virtual_router_name` together with the route's `name`. For example:
+
+```console
+% terraform import aws_appmesh_route.serviceb simpleapp/serviceB/serviceB-route
 ```
 
 [1]: /docs/providers/aws/index.html
diff --git a/website/docs/r/appmesh_virtual_gateway.html.markdown b/website/docs/r/appmesh_virtual_gateway.html.markdown
index 11a1c7b98c6..e4f09c59e4c 100644
--- a/website/docs/r/appmesh_virtual_gateway.html.markdown
+++ b/website/docs/r/appmesh_virtual_gateway.html.markdown
@@ -72,7 +72,7 @@ resource "aws_appmesh_virtual_gateway" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) Name to use for the virtual gateway. Must be between 1 and 255 characters in length.
 * `mesh_name` - (Required) Name of the service mesh in which to create the virtual gateway. Must be between 1 and 255 characters in length.
@@ -261,9 +261,9 @@ The `sds` object supports the following:
 
 * `secret_name` - (Required) Name of the secret for a virtual gateway's Transport Layer Security (TLS) Secret Discovery Service validation context trust.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - ID of the virtual gateway.
 * `arn` - ARN of the virtual gateway.
@@ -274,11 +274,19 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-App Mesh virtual gateway can be imported using `mesh_name` together with the virtual gateway's `name`,
-e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import App Mesh virtual gateway using `mesh_name` together with the virtual gateway's `name`. For example:
 
+```terraform
+import {
+  to = aws_appmesh_virtual_gateway.example
+  id = "mesh/gw1"
+}
 ```
-$ terraform import aws_appmesh_virtual_gateway.example mesh/gw1
+
+Using `terraform import`, import App Mesh virtual gateway using `mesh_name` together with the virtual gateway's `name`. For example:
+
+```console
+% terraform import aws_appmesh_virtual_gateway.example mesh/gw1
 ```
 
 [1]: /docs/providers/aws/index.html
diff --git a/website/docs/r/appmesh_virtual_node.html.markdown b/website/docs/r/appmesh_virtual_node.html.markdown
index d859cf66000..c4f34cb10df 100644
--- a/website/docs/r/appmesh_virtual_node.html.markdown
+++ b/website/docs/r/appmesh_virtual_node.html.markdown
@@ -171,7 +171,7 @@ resource "aws_appmesh_virtual_node" "serviceb1" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) Name to use for the virtual node. Must be between 1 and 255 characters in length.
 * `mesh_name` - (Required) Name of the service mesh in which to create the virtual node. Must be between 1 and 255 characters in length.
@@ -445,9 +445,9 @@ The `sds` object supports the following:
 
 * `secret_name` - (Required) Name of the secret for a virtual node's Transport Layer Security (TLS) Secret Discovery Service validation context trust.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - ID of the virtual node.
 * `arn` - ARN of the virtual node.
@@ -458,11 +458,19 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-App Mesh virtual nodes can be imported using `mesh_name` together with the virtual node's `name`,
-e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import App Mesh virtual nodes using `mesh_name` together with the virtual node's `name`. For example:
 
+```terraform
+import {
+  to = aws_appmesh_virtual_node.serviceb1
+  id = "simpleapp/serviceBv1"
+}
 ```
-$ terraform import aws_appmesh_virtual_node.serviceb1 simpleapp/serviceBv1
+
+Using `terraform import`, import App Mesh virtual nodes using `mesh_name` together with the virtual node's `name`. For example:
+
+```console
+% terraform import aws_appmesh_virtual_node.serviceb1 simpleapp/serviceBv1
 ```
 
 [1]: /docs/providers/aws/index.html
diff --git a/website/docs/r/appmesh_virtual_router.html.markdown b/website/docs/r/appmesh_virtual_router.html.markdown
index 8ea21c475ac..4d617425c84 100644
--- a/website/docs/r/appmesh_virtual_router.html.markdown
+++ b/website/docs/r/appmesh_virtual_router.html.markdown
@@ -14,9 +14,7 @@ Provides an AWS App Mesh virtual router resource.
 
 Because of backward incompatible API changes (read [here](https://github.com/awslabs/aws-app-mesh-examples/issues/92) and [here](https://github.com/awslabs/aws-app-mesh-examples/issues/94)), `aws_appmesh_virtual_router` resource definitions created with provider versions earlier than v2.3.0 will need to be modified:
 
-* Remove service `service_names` from the `spec` argument.
-AWS has created a `aws_appmesh_virtual_service` resource for each of service names.
-These resource can be imported using `terraform import`.
+* Remove service `service_names` from the `spec` argument. AWS has created a `aws_appmesh_virtual_service` resource for each service name. Import these resource using `terraform import`.
 
 * Add a `listener` configuration block to the `spec` argument.
 
@@ -42,7 +40,7 @@ resource "aws_appmesh_virtual_router" "serviceb" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) Name to use for the virtual router. Must be between 1 and 255 characters in length.
 * `mesh_name` - (Required) Name of the service mesh in which to create the virtual router. Must be between 1 and 255 characters in length.
@@ -64,9 +62,9 @@ The `port_mapping` object supports the following:
 * `port` - (Required) Port used for the port mapping.
 * `protocol` - (Required) Protocol used for the port mapping. Valid values are `http`,`http2`, `tcp` and `grpc`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - ID of the virtual router.
 * `arn` - ARN of the virtual router.
@@ -77,11 +75,19 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-App Mesh virtual routers can be imported using `mesh_name` together with the virtual router's `name`,
-e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import App Mesh virtual routers using `mesh_name` together with the virtual router's `name`. For example:
 
+```terraform
+import {
+  to = aws_appmesh_virtual_router.serviceb
+  id = "simpleapp/serviceB"
+}
 ```
-$ terraform import aws_appmesh_virtual_router.serviceb simpleapp/serviceB
+
+Using `terraform import`, import App Mesh virtual routers using `mesh_name` together with the virtual router's `name`. For example:
+
+```console
+% terraform import aws_appmesh_virtual_router.serviceb simpleapp/serviceB
 ```
 
 [1]: /docs/providers/aws/index.html
diff --git a/website/docs/r/appmesh_virtual_service.html.markdown b/website/docs/r/appmesh_virtual_service.html.markdown
index 81074a31656..4667729db1f 100644
--- a/website/docs/r/appmesh_virtual_service.html.markdown
+++ b/website/docs/r/appmesh_virtual_service.html.markdown
@@ -48,7 +48,7 @@ resource "aws_appmesh_virtual_service" "servicea" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) Name to use for the virtual service. Must be between 1 and 255 characters in length.
 * `mesh_name` - (Required) Name of the service mesh in which to create the virtual service. Must be between 1 and 255 characters in length.
@@ -73,9 +73,9 @@ The `virtual_router` object supports the following:
 
 * `virtual_router_name` - (Required) Name of the virtual router that is acting as a service provider. Must be between 1 and 255 characters in length.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - ID of the virtual service.
 * `arn` - ARN of the virtual service.
@@ -86,11 +86,19 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-App Mesh virtual services can be imported using `mesh_name` together with the virtual service's `name`,
-e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import App Mesh virtual services using `mesh_name` together with the virtual service's `name`. For example:
 
+```terraform
+import {
+  to = aws_appmesh_virtual_service.servicea
+  id = "simpleapp/servicea.simpleapp.local"
+}
 ```
-$ terraform import aws_appmesh_virtual_service.servicea simpleapp/servicea.simpleapp.local
+
+Using `terraform import`, import App Mesh virtual services using `mesh_name` together with the virtual service's `name`. For example:
+
+```console
+% terraform import aws_appmesh_virtual_service.servicea simpleapp/servicea.simpleapp.local
 ```
 
 [1]: /docs/providers/aws/index.html
diff --git a/website/docs/r/apprunner_auto_scaling_configuration_version.html.markdown b/website/docs/r/apprunner_auto_scaling_configuration_version.html.markdown
index 02c1e4515da..7126216ae6c 100644
--- a/website/docs/r/apprunner_auto_scaling_configuration_version.html.markdown
+++ b/website/docs/r/apprunner_auto_scaling_configuration_version.html.markdown
@@ -36,9 +36,9 @@ The following arguments supported:
 * `min_size` - (Optional, Forces new resource) Minimal number of instances that App Runner provisions for your service.
 * `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of this auto scaling configuration version.
 * `auto_scaling_configuration_revision` - The revision of this auto scaling configuration.
@@ -48,8 +48,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-App Runner AutoScaling Configuration Versions can be imported by using the `arn`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import App Runner AutoScaling Configuration Versions using the `arn`. For example:
 
+```terraform
+import {
+  to = aws_apprunner_auto_scaling_configuration_version.example
+  id = "arn:aws:apprunner:us-east-1:1234567890:autoscalingconfiguration/example/1/69bdfe0115224b0db49398b7beb68e0f"
+}
 ```
-$ terraform import aws_apprunner_auto_scaling_configuration_version.example "arn:aws:apprunner:us-east-1:1234567890:autoscalingconfiguration/example/1/69bdfe0115224b0db49398b7beb68e0f
+
+Using `terraform import`, import App Runner AutoScaling Configuration Versions using the `arn`. For example:
+
+```console
+% terraform import aws_apprunner_auto_scaling_configuration_version.example "arn:aws:apprunner:us-east-1:1234567890:autoscalingconfiguration/example/1/69bdfe0115224b0db49398b7beb68e0f
 ```
diff --git a/website/docs/r/apprunner_connection.html.markdown b/website/docs/r/apprunner_connection.html.markdown
index 32cabf83d83..964f253a5b7 100644
--- a/website/docs/r/apprunner_connection.html.markdown
+++ b/website/docs/r/apprunner_connection.html.markdown
@@ -33,9 +33,9 @@ The following arguments supported:
 * `provider_type` - (Required) Source repository provider. Valid values: `GITHUB`.
 * `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the connection.
 * `status` - Current state of the App Runner connection. When the state is `AVAILABLE`, you can use the connection to create an [`aws_apprunner_service` resource](apprunner_service.html).
@@ -43,8 +43,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-App Runner Connections can be imported by using the `connection_name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import App Runner Connections using the `connection_name`. For example:
 
+```terraform
+import {
+  to = aws_apprunner_connection.example
+  id = "example"
+}
 ```
-$ terraform import aws_apprunner_connection.example example
+
+Using `terraform import`, import App Runner Connections using the `connection_name`. For example:
+
+```console
+% terraform import aws_apprunner_connection.example example
 ```
diff --git a/website/docs/r/apprunner_custom_domain_association.html.markdown b/website/docs/r/apprunner_custom_domain_association.html.markdown
index b9b39db3ea2..28caa27ed29 100644
--- a/website/docs/r/apprunner_custom_domain_association.html.markdown
+++ b/website/docs/r/apprunner_custom_domain_association.html.markdown
@@ -29,9 +29,9 @@ The following arguments supported:
 * `enable_www_subdomain` (Optional) Whether to associate the subdomain with the App Runner service in addition to the base domain. Defaults to `true`.
 * `service_arn` - (Required) ARN of the App Runner service.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The `domain_name` and `service_arn` separated by a comma (`,`).
 * `certificate_validation_records` - A set of certificate CNAME records used for this domain name. See [Certificate Validation Records](#certificate-validation-records) below for more details.
@@ -48,9 +48,17 @@ The configuration block consists of the following arguments:
 
 ## Import
 
-App Runner Custom Domain Associations can be imported by using the `domain_name` and `service_arn` separated by a comma (`,`), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import App Runner Custom Domain Associations using the `domain_name` and `service_arn` separated by a comma (`,`). For example:
 
+```terraform
+import {
+  to = aws_apprunner_custom_domain_association.example
+  id = "example.com,arn:aws:apprunner:us-east-1:123456789012:service/example-app/8fe1e10304f84fd2b0df550fe98a71fa"
+}
 ```
-$ terraform import aws_apprunner_custom_domain_association.example example.com,arn:aws:apprunner:us-east-1:123456789012:service/example-
-app/8fe1e10304f84fd2b0df550fe98a71fa
+
+Using `terraform import`, import App Runner Custom Domain Associations using the `domain_name` and `service_arn` separated by a comma (`,`). For example:
+
+```console
+% terraform import aws_apprunner_custom_domain_association.example example.com,arn:aws:apprunner:us-east-1:123456789012:service/example-app/8fe1e10304f84fd2b0df550fe98a71fa
 ```
diff --git a/website/docs/r/apprunner_observability_configuration.html.markdown b/website/docs/r/apprunner_observability_configuration.html.markdown
index d0764a94afb..e3757c9ea80 100644
--- a/website/docs/r/apprunner_observability_configuration.html.markdown
+++ b/website/docs/r/apprunner_observability_configuration.html.markdown
@@ -40,9 +40,9 @@ The `trace_configuration` block supports the following argument:
 
 * `vendor` - (Required) Implementation provider chosen for tracing App Runner services. Valid values: `AWSXRAY`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of this observability configuration.
 * `observability_configuration_revision` - The revision of this observability configuration.
@@ -52,8 +52,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-App Runner Observability Configuration can be imported by using the `arn`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import App Runner Observability Configuration using the `arn`. For example:
 
+```terraform
+import {
+  to = aws_apprunner_observability_configuration.example
+  id = "arn:aws:apprunner:us-east-1:1234567890:observabilityconfiguration/example/1/d75bc7ea55b71e724fe5c23452fe22a1"
+}
 ```
-$ terraform import aws_apprunner_observability_configuration.example "arn:aws:apprunner:us-east-1:1234567890:observabilityconfiguration/example/1/d75bc7ea55b71e724fe5c23452fe22a1
+
+Using `terraform import`, import App Runner Observability Configuration using the `arn`. For example:
+
+```console
+% terraform import aws_apprunner_observability_configuration.example arn:aws:apprunner:us-east-1:1234567890:observabilityconfiguration/example/1/d75bc7ea55b71e724fe5c23452fe22a1
 ```
diff --git a/website/docs/r/apprunner_service.html.markdown b/website/docs/r/apprunner_service.html.markdown
index a4afb15028b..12d68beb0d2 100644
--- a/website/docs/r/apprunner_service.html.markdown
+++ b/website/docs/r/apprunner_service.html.markdown
@@ -256,9 +256,9 @@ The `source_code_version` block supports the following arguments:
 * `type` - (Required) Type of version identifier. For a git-based repository, branches represent versions. Valid values: `BRANCH`.
 * `value`- (Required) Source code version. For a git-based repository, a branch name maps to a specific version. App Runner uses the most recent commit to the branch.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the App Runner service.
 * `service_id` - An alphanumeric ID that App Runner generated for this service. Unique within the AWS Region.
@@ -268,8 +268,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-App Runner Services can be imported by using the `arn`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import App Runner Services using the `arn`. For example:
 
+```terraform
+import {
+  to = aws_apprunner_service.example
+  id = "arn:aws:apprunner:us-east-1:1234567890:service/example/0a03292a89764e5882c41d8f991c82fe"
+}
 ```
-$ terraform import aws_apprunner_service.example arn:aws:apprunner:us-east-1:1234567890:service/example/0a03292a89764e5882c41d8f991c82fe
+
+Using `terraform import`, import App Runner Services using the `arn`. For example:
+
+```console
+% terraform import aws_apprunner_service.example arn:aws:apprunner:us-east-1:1234567890:service/example/0a03292a89764e5882c41d8f991c82fe
 ```
diff --git a/website/docs/r/apprunner_vpc_connector.html.markdown b/website/docs/r/apprunner_vpc_connector.html.markdown
index 2590ca9c2dd..8444218f266 100644
--- a/website/docs/r/apprunner_vpc_connector.html.markdown
+++ b/website/docs/r/apprunner_vpc_connector.html.markdown
@@ -29,9 +29,9 @@ The following arguments supported:
 * `security_groups` - List of IDs of security groups that App Runner should use for access to AWS resources under the specified subnets. If not specified, App Runner uses the default security group of the Amazon VPC. The default security group allows all outbound traffic.
 * `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of VPC connector.
 * `status` - Current state of the VPC connector. If the status of a connector revision is INACTIVE, it was deleted and can't be used. Inactive connector revisions are permanently removed some time after they are deleted.
@@ -40,8 +40,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-App Runner vpc connector can be imported by using the `arn`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import App Runner vpc connector using the `arn`. For example:
 
+```terraform
+import {
+  to = aws_apprunner_vpc_connector.example
+  id = "arn:aws:apprunner:us-east-1:1234567890:vpcconnector/example/1/0a03292a89764e5882c41d8f991c82fe"
+}
 ```
-$ terraform import aws_apprunner_vpc_connector.example arn:aws:apprunner:us-east-1:1234567890:vpcconnector/example/1/0a03292a89764e5882c41d8f991c82fe
+
+Using `terraform import`, import App Runner vpc connector using the `arn`. For example:
+
+```console
+% terraform import aws_apprunner_vpc_connector.example arn:aws:apprunner:us-east-1:1234567890:vpcconnector/example/1/0a03292a89764e5882c41d8f991c82fe
 ```
diff --git a/website/docs/r/apprunner_vpc_ingress_connection.html.markdown b/website/docs/r/apprunner_vpc_ingress_connection.html.markdown
index 47a347476c0..ea60b45e903 100644
--- a/website/docs/r/apprunner_vpc_ingress_connection.html.markdown
+++ b/website/docs/r/apprunner_vpc_ingress_connection.html.markdown
@@ -45,9 +45,9 @@ The `ingress_vpc_configuration` block supports the following argument:
 * `vpc_id` - (Required) The ID of the VPC that is used for the VPC endpoint.
 * `vpc_endpoint_id` - (Required) The ID of the VPC endpoint that your App Runner service connects to.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The Amazon Resource Name (ARN) of the VPC Ingress Connection.
 * `domain_name` - The domain name associated with the VPC Ingress Connection resource.
@@ -56,8 +56,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-App Runner VPC Ingress Connection can be imported by using the `arn`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import App Runner VPC Ingress Connection using the `arn`. For example:
 
+```terraform
+import {
+  to = aws_apprunner_vpc_ingress_connection.example
+  id = "arn:aws:apprunner:us-west-2:837424938642:vpcingressconnection/example/b379f86381d74825832c2e82080342fa"
+}
 ```
-$ terraform import aws_apprunner_vpc_ingress_connection.example "arn:aws:apprunner:us-west-2:837424938642:vpcingressconnection/example/b379f86381d74825832c2e82080342fa"
+
+Using `terraform import`, import App Runner VPC Ingress Connection using the `arn`. For example:
+
+```console
+% terraform import aws_apprunner_vpc_ingress_connection.example "arn:aws:apprunner:us-west-2:837424938642:vpcingressconnection/example/b379f86381d74825832c2e82080342fa"
 ```
diff --git a/website/docs/r/appstream_directory_config.html.markdown b/website/docs/r/appstream_directory_config.html.markdown
index 199216899cf..528aa6ab8a7 100644
--- a/website/docs/r/appstream_directory_config.html.markdown
+++ b/website/docs/r/appstream_directory_config.html.markdown
@@ -37,17 +37,26 @@ The following arguments are required:
 * `account_name` - (Required) User name of the account. This account must have the following privileges: create computer objects, join computers to the domain, and change/reset the password on descendant computer objects for the organizational units specified.
 * `account_password` - (Required) Password for the account.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Unique identifier (ID) of the appstream directory config.
 * `created_time` -  Date and time, in UTC and extended RFC 3339 format, when the directory config was created.
 
 ## Import
 
-`aws_appstream_directory_config` can be imported using the id, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_appstream_directory_config` using the id. For example:
 
+```terraform
+import {
+  to = aws_appstream_directory_config.example
+  id = "directoryNameExample"
+}
 ```
-$ terraform import aws_appstream_directory_config.example directoryNameExample
+
+Using `terraform import`, import `aws_appstream_directory_config` using the id. For example:
+
+```console
+% terraform import aws_appstream_directory_config.example directoryNameExample
 ```
diff --git a/website/docs/r/appstream_fleet.html.markdown b/website/docs/r/appstream_fleet.html.markdown
index dfd772c1b84..5ce739669f8 100644
--- a/website/docs/r/appstream_fleet.html.markdown
+++ b/website/docs/r/appstream_fleet.html.markdown
@@ -25,7 +25,7 @@ resource "aws_appstream_fleet" "test_fleet" {
   display_name                       = "test-fleet"
   enable_default_internet_access     = false
   fleet_type                         = "ON_DEMAND"
-  image_name                         = "Amazon-AppStream2-Sample-Image-02-04-2019"
+  image_name                         = "Amazon-AppStream2-Sample-Image-03-11-2023"
   instance_type                      = "stream.standard.large"
   max_user_duration_in_seconds       = 600
 
@@ -78,9 +78,9 @@ The following arguments are optional:
 * `security_group_ids` - Identifiers of the security groups for the fleet or image builder.
 * `subnet_ids` - Identifiers of the subnets to which a network interface is attached from the fleet instance or image builder instance.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Unique identifier (ID) of the appstream fleet.
 * `arn` - ARN of the appstream fleet.
@@ -96,8 +96,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_appstream_fleet` can be imported using the id, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_appstream_fleet` using the id. For example:
 
+```terraform
+import {
+  to = aws_appstream_fleet.example
+  id = "fleetNameExample"
+}
 ```
-$ terraform import aws_appstream_fleet.example fleetNameExample
+
+Using `terraform import`, import `aws_appstream_fleet` using the id. For example:
+
+```console
+% terraform import aws_appstream_fleet.example fleetNameExample
 ```
diff --git a/website/docs/r/appstream_fleet_stack_association.html.markdown b/website/docs/r/appstream_fleet_stack_association.html.markdown
index 8480fdbc71a..846eadb45de 100644
--- a/website/docs/r/appstream_fleet_stack_association.html.markdown
+++ b/website/docs/r/appstream_fleet_stack_association.html.markdown
@@ -15,7 +15,7 @@ Manages an AppStream Fleet Stack association.
 ```terraform
 resource "aws_appstream_fleet" "example" {
   name          = "NAME"
-  image_name    = "Amazon-AppStream2-Sample-Image-02-04-2019"
+  image_name    = "Amazon-AppStream2-Sample-Image-03-11-2023"
   instance_type = "stream.standard.small"
 
   compute_capacity {
@@ -40,16 +40,25 @@ The following arguments are required:
 * `fleet_name` - (Required) Name of the fleet.
 * `stack_name` (Required) Name of the stack.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Unique ID of the appstream stack fleet association, composed of the `fleet_name` and `stack_name` separated by a slash (`/`).
 
 ## Import
 
-AppStream Stack Fleet Association can be imported by using the `fleet_name` and `stack_name` separated by a slash (`/`), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AppStream Stack Fleet Association using the `fleet_name` and `stack_name` separated by a slash (`/`). For example:
 
+```terraform
+import {
+  to = aws_appstream_fleet_stack_association.example
+  id = "fleetName/stackName"
+}
 ```
-$ terraform import aws_appstream_fleet_stack_association.example fleetName/stackName
+
+Using `terraform import`, import AppStream Stack Fleet Association using the `fleet_name` and `stack_name` separated by a slash (`/`). For example:
+
+```console
+% terraform import aws_appstream_fleet_stack_association.example fleetName/stackName
 ```
diff --git a/website/docs/r/appstream_image_builder.html.markdown b/website/docs/r/appstream_image_builder.html.markdown
index 94e4fb1337b..730d7833e72 100644
--- a/website/docs/r/appstream_image_builder.html.markdown
+++ b/website/docs/r/appstream_image_builder.html.markdown
@@ -73,9 +73,9 @@ The `vpc_config` block supports the following arguments:
 * `security_group_ids` - (Optional) Identifiers of the security groups for the image builder or image builder.
 * `subnet_ids` - (Optional) Identifiers of the subnets to which a network interface is attached from the image builder instance or image builder instance.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the appstream image builder.
 * `created_time` -  Date and time, in UTC and extended RFC 3339 format, when the image builder was created.
@@ -85,8 +85,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_appstream_image_builder` can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_appstream_image_builder` using the `name`. For example:
 
+```terraform
+import {
+  to = aws_appstream_image_builder.example
+  id = "imageBuilderExample"
+}
 ```
-$ terraform import aws_appstream_image_builder.example imageBuilderExample
+
+Using `terraform import`, import `aws_appstream_image_builder` using the `name`. For example:
+
+```console
+% terraform import aws_appstream_image_builder.example imageBuilderExample
 ```
diff --git a/website/docs/r/appstream_stack.html.markdown b/website/docs/r/appstream_stack.html.markdown
index 04ea8782c5c..d5e499ea979 100644
--- a/website/docs/r/appstream_stack.html.markdown
+++ b/website/docs/r/appstream_stack.html.markdown
@@ -121,9 +121,9 @@ The following arguments are optional:
 * `preferred_protocol` - (Optional) The preferred protocol that you want to use while streaming your application.
   Valid values are `TCP` and `UDP`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the appstream stack.
 * `created_time` - Date and time, in UTC and extended RFC 3339 format, when the stack was created.
@@ -131,8 +131,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_appstream_stack` can be imported using the id, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_appstream_stack` using the id. For example:
 
+```terraform
+import {
+  to = aws_appstream_stack.example
+  id = "stackID"
+}
 ```
-$ terraform import aws_appstream_stack.example stackID
+
+Using `terraform import`, import `aws_appstream_stack` using the id. For example:
+
+```console
+% terraform import aws_appstream_stack.example stackID
 ```
diff --git a/website/docs/r/appstream_user.html.markdown b/website/docs/r/appstream_user.html.markdown
index ae9dcf43588..2fd5c898adc 100644
--- a/website/docs/r/appstream_user.html.markdown
+++ b/website/docs/r/appstream_user.html.markdown
@@ -35,9 +35,9 @@ The following arguments are optional:
 * `last_name` - (Optional) Last name, or surname, of the user.
 * `send_email_notification` - (Optional) Send an email notification.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the appstream user.
 * `created_time` - Date and time, in UTC and extended RFC 3339 format, when the user was created.
@@ -46,8 +46,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_appstream_user` can be imported using the `user_name` and `authentication_type` separated by a slash (`/`), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_appstream_user` using the `user_name` and `authentication_type` separated by a slash (`/`). For example:
 
+```terraform
+import {
+  to = aws_appstream_user.example
+  id = "UserName/AuthenticationType"
+}
 ```
-$ terraform import aws_appstream_user.example UserName/AuthenticationType
+
+Using `terraform import`, import `aws_appstream_user` using the `user_name` and `authentication_type` separated by a slash (`/`). For example:
+
+```console
+% terraform import aws_appstream_user.example UserName/AuthenticationType
 ```
diff --git a/website/docs/r/appstream_user_stack_association.html.markdown b/website/docs/r/appstream_user_stack_association.html.markdown
index 3025412bd43..e1dde9d91e6 100644
--- a/website/docs/r/appstream_user_stack_association.html.markdown
+++ b/website/docs/r/appstream_user_stack_association.html.markdown
@@ -41,16 +41,25 @@ The following arguments are optional:
 
 * `send_email_notification` - (Optional) Whether a welcome email is sent to a user after the user is created in the user pool.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Unique ID of the appstream User Stack association.
 
 ## Import
 
-AppStream User Stack Association can be imported by using the `user_name`, `authentication_type`, and `stack_name`, separated by a slash (`/`), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AppStream User Stack Association using the `user_name`, `authentication_type`, and `stack_name`, separated by a slash (`/`). For example:
 
+```terraform
+import {
+  to = aws_appstream_user_stack_association.example
+  id = "userName/auhtenticationType/stackName"
+}
 ```
-$ terraform import aws_appstream_user_stack_association.example userName/auhtenticationType/stackName
+
+Using `terraform import`, import AppStream User Stack Association using the `user_name`, `authentication_type`, and `stack_name`, separated by a slash (`/`). For example:
+
+```console
+% terraform import aws_appstream_user_stack_association.example userName/auhtenticationType/stackName
 ```
diff --git a/website/docs/r/appsync_api_cache.html.markdown b/website/docs/r/appsync_api_cache.html.markdown
index af2b2904dc1..0ca2ab239bf 100644
--- a/website/docs/r/appsync_api_cache.html.markdown
+++ b/website/docs/r/appsync_api_cache.html.markdown
@@ -28,7 +28,7 @@ resource "aws_appsync_api_cache" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `api_id` - (Required) GraphQL API ID.
 * `api_caching_behavior` - (Required) Caching behavior. Valid values are `FULL_REQUEST_CACHING` and `PER_RESOLVER_CACHING`.
@@ -37,16 +37,25 @@ The following arguments are supported:
 * `at_rest_encryption_enabled` - (Optional) At-rest encryption flag for cache. You cannot update this setting after creation.
 * `transit_encryption_enabled` - (Optional) Transit encryption flag when connecting to cache. You cannot update this setting after creation.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - AppSync API ID.
 
 ## Import
 
-`aws_appsync_api_cache` can be imported using the AppSync API ID, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_appsync_api_cache` using the AppSync API ID. For example:
 
+```terraform
+import {
+  to = aws_appsync_api_cache.example
+  id = "xxxxx"
+}
 ```
-$ terraform import aws_appsync_api_cache.example xxxxx
+
+Using `terraform import`, import `aws_appsync_api_cache` using the AppSync API ID. For example:
+
+```console
+% terraform import aws_appsync_api_cache.example xxxxx
 ```
diff --git a/website/docs/r/appsync_api_key.html.markdown b/website/docs/r/appsync_api_key.html.markdown
index c18c9fc301e..9f40ef5ad5d 100644
--- a/website/docs/r/appsync_api_key.html.markdown
+++ b/website/docs/r/appsync_api_key.html.markdown
@@ -26,23 +26,32 @@ resource "aws_appsync_api_key" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `api_id` - (Required) ID of the associated AppSync API
 * `description` - (Optional) API key description. Defaults to "Managed by Terraform".
 * `expires` - (Optional) RFC3339 string representation of the expiry date. Rounded down to nearest hour. By default, it is 7 days from the date of creation.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - API Key ID (Formatted as ApiId:Key)
 * `key` - API key
 
 ## Import
 
-`aws_appsync_api_key` can be imported using the AppSync API ID and key separated by `:`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_appsync_api_key` using the AppSync API ID and key separated by `:`. For example:
 
+```terraform
+import {
+  to = aws_appsync_api_key.example
+  id = "xxxxx:yyyyy"
+}
 ```
-$ terraform import aws_appsync_api_key.example xxxxx:yyyyy
+
+Using `terraform import`, import `aws_appsync_api_key` using the AppSync API ID and key separated by `:`. For example:
+
+```console
+% terraform import aws_appsync_api_key.example xxxxx:yyyyy
 ```
diff --git a/website/docs/r/appsync_datasource.html.markdown b/website/docs/r/appsync_datasource.html.markdown
index 30681a874b4..54bab278af8 100644
--- a/website/docs/r/appsync_datasource.html.markdown
+++ b/website/docs/r/appsync_datasource.html.markdown
@@ -75,86 +75,94 @@ resource "aws_appsync_datasource" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `api_id` - (Required) API ID for the GraphQL API for the data source.
 * `name` - (Required) User-supplied name for the data source.
-* `type` - (Required) Type of the Data Source. Valid values: `AWS_LAMBDA`, `AMAZON_DYNAMODB`, `AMAZON_ELASTICSEARCH`, `HTTP`, `NONE`, `RELATIONAL_DATABASE`, `AMAZON_EVENTBRIDGE`.
+* `type` - (Required) Type of the Data Source. Valid values: `AWS_LAMBDA`, `AMAZON_DYNAMODB`, `AMAZON_ELASTICSEARCH`, `HTTP`, `NONE`, `RELATIONAL_DATABASE`, `AMAZON_EVENTBRIDGE`, `AMAZON_OPENSEARCH_SERVICE`.
 * `description` - (Optional) Description of the data source.
-* `dynamodb_config` - (Optional) DynamoDB settings. See [below](#dynamodb_config)
-* `elasticsearch_config` - (Optional) Amazon Elasticsearch settings. See [below](#elasticsearch_config)
-* `event_bridge_config` - (Optional) AWS EventBridge settings. See [below](#event_bridge_config)
-* `http_config` - (Optional) HTTP settings. See [below](#http_config)
-* `lambda_config` - (Optional) AWS Lambda settings. See [below](#lambda_config)
-* `opensearchservice_config` - (Optional) Amazon OpenSearch Service settings. See [below](#opensearchservice_config)
-* `relational_database_config` (Optional) AWS RDS settings. See [Relational Database Config](#relational_database_config)
+* `dynamodb_config` - (Optional) DynamoDB settings. See [DynamoDB Config](#dynamodb-config)
+* `elasticsearch_config` - (Optional) Amazon Elasticsearch settings. See [ElasticSearch Config](#elasticsearch-config)
+* `event_bridge_config` - (Optional) AWS EventBridge settings. See [Event Bridge Config](#event-bridge-config)
+* `http_config` - (Optional) HTTP settings. See [HTTP Config](#http-config)
+* `lambda_config` - (Optional) AWS Lambda settings. See [Lambda Config](#lambda-config)
+* `opensearchservice_config` - (Optional) Amazon OpenSearch Service settings. See [OpenSearch Service Config](#opensearch-service-config)
+* `relational_database_config` (Optional) AWS RDS settings. See [Relational Database Config](#relational-database-config)
 * `service_role_arn` - (Optional) IAM service role ARN for the data source.
 
-### dynamodb_config
+### DynamoDB Config
 
-The following arguments are supported:
+This argument supports the following arguments:
 
 * `table_name` - (Required) Name of the DynamoDB table.
 * `region` - (Optional) AWS region of the DynamoDB table. Defaults to current region.
 * `use_caller_credentials` - (Optional) Set to `true` to use Amazon Cognito credentials with this data source.
+* `delta_sync_config` - (Optional) The DeltaSyncConfig for a versioned data source. See [Delta Sync Config](#delta-sync-config)
+* `versioned` - (Optional) Detects Conflict Detection and Resolution with this data source.
 
-### elasticsearch_config
+### Delta Sync Config
 
-The following arguments are supported:
+* `base_table_ttl` - (Optional) The number of minutes that an Item is stored in the data source.
+* `delta_sync_table_name` - (Required) The table name.
+* `delta_sync_table_ttl` - (Optional) The number of minutes that a Delta Sync log entry is stored in the Delta Sync table.
+
+### ElasticSearch Config
+
+This argument supports the following arguments:
 
 * `endpoint` - (Required) HTTP endpoint of the Elasticsearch domain.
 * `region` - (Optional) AWS region of Elasticsearch domain. Defaults to current region.
 
-### event_bridge_config
+### Event Bridge Config
 
-The following arguments are supported:
+This argument supports the following arguments:
 
 * `event_bus_arn` - (Required) ARN for the EventBridge bus.
 
-### http_config
+### HTTP Config
 
-The following arguments are supported:
+This argument supports the following arguments:
 
 * `endpoint` - (Required) HTTP URL.
-* `authorization_config` - (Optional) Authorization configuration in case the HTTP endpoint requires authorization. See [Authorization Config](#authorization_config).
+* `authorization_config` - (Optional) Authorization configuration in case the HTTP endpoint requires authorization. See [Authorization Config](#authorization-config).
 
-#### authorization_config
+#### Authorization Config
 
-The following arguments are supported:
+This argument supports the following arguments:
 
 * `authorization_type` - (Optional) Authorization type that the HTTP endpoint requires. Default values is `AWS_IAM`.
-* `aws_iam_config` - (Optional) Identity and Access Management (IAM) settings. See [AWS IAM Config](#aws_iam_config).
+* `aws_iam_config` - (Optional) Identity and Access Management (IAM) settings. See [AWS IAM Config](#aws-iam-config).
 
-##### aws_iam_config
+##### AWS IAM Config
 
-The following arguments are supported:
+This argument supports the following arguments:
 
 * `signing_region` - (Optional) Signing Amazon Web Services Region for IAM authorization.
 * `signing_service_name`- (Optional) Signing service name for IAM authorization.
 
-### lambda_config
+### Lambda Config
 
-The following arguments are supported:
+This argument supports the following arguments:
 
 * `function_arn` - (Required) ARN for the Lambda function.
 
-### opensearchservice_config
+### OpenSearch Service Config
 
-The following arguments are supported:
+This argument supports the following arguments:
 
 * `endpoint` - (Required) HTTP endpoint of the OpenSearch domain.
 * `region` - (Optional) AWS region of the OpenSearch domain. Defaults to current region.
 
-### relational_database_config
+### Relational Database Config
 
-The following arguments are supported:
+This argument supports the following arguments:
 
-* `http_endpoint_config` - (Required) Amazon RDS HTTP endpoint configuration. See [HTTP Endpoint Config](#http_endpoint_config).
+* `http_endpoint_config` - (Required) Amazon RDS HTTP endpoint configuration. See [HTTP Endpoint Config](#http-endpoint-config).
 * `source_type` - (Optional) Source type for the relational database. Valid values: `RDS_HTTP_ENDPOINT`.
 
-#### http_endpoint_config
+#### HTTP Endpoint Config
 
-The following arguments are supported:
+This argument supports the following arguments:
 
 * `db_cluster_identifier` - (Required) Amazon RDS cluster identifier.
 * `aws_secret_store_arn` - (Required) AWS secret store ARN for database credentials.
@@ -162,16 +170,25 @@ The following arguments are supported:
 * `region` - (Optional) AWS Region for RDS HTTP endpoint. Defaults to current region.
 * `schema` - (Optional) Logical schema name.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN
 
 ## Import
 
-`aws_appsync_datasource` can be imported with their `api_id`, a hyphen, and `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_appsync_datasource` using the `api_id`, a hyphen, and `name`. For example:
 
+```terraform
+import {
+  to = aws_appsync_datasource.example
+  id = "abcdef123456-example"
+}
 ```
-$ terraform import aws_appsync_datasource.example abcdef123456-example
+
+Using `terraform import`, import `aws_appsync_datasource` using the `api_id`, a hyphen, and `name`. For example:
+
+```console
+% terraform import aws_appsync_datasource.example abcdef123456-example
 ```
diff --git a/website/docs/r/appsync_domain_name.html.markdown b/website/docs/r/appsync_domain_name.html.markdown
index ce58bf47ba2..729ba229870 100644
--- a/website/docs/r/appsync_domain_name.html.markdown
+++ b/website/docs/r/appsync_domain_name.html.markdown
@@ -21,15 +21,15 @@ resource "aws_appsync_domain_name" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `certificate_arn` - (Required) ARN of the certificate. This can be an Certificate Manager (ACM) certificate or an Identity and Access Management (IAM) server certificate. The certifiacte must reside in us-east-1.
 * `description` - (Optional)  A description of the Domain Name.
 * `domain_name` - (Required) Domain name.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Appsync Domain Name.
 * `appsync_domain_name` - Domain name that AppSync provides.
@@ -37,8 +37,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_appsync_domain_name` can be imported using the AppSync domain name, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_appsync_domain_name` using the AppSync domain name. For example:
 
+```terraform
+import {
+  to = aws_appsync_domain_name.example
+  id = "example.com"
+}
 ```
-$ terraform import aws_appsync_domain_name.example example.com
+
+Using `terraform import`, import `aws_appsync_domain_name` using the AppSync domain name. For example:
+
+```console
+% terraform import aws_appsync_domain_name.example example.com
 ```
diff --git a/website/docs/r/appsync_domain_name_api_association.html.markdown b/website/docs/r/appsync_domain_name_api_association.html.markdown
index 5c05d5360c6..2620d97b489 100644
--- a/website/docs/r/appsync_domain_name_api_association.html.markdown
+++ b/website/docs/r/appsync_domain_name_api_association.html.markdown
@@ -21,21 +21,30 @@ resource "aws_appsync_domain_name_api_association" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `api_id` - (Required) API ID.
 * `domain_name` - (Required) Appsync domain name.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Appsync domain name.
 
 ## Import
 
-`aws_appsync_domain_name_api_association` can be imported using the AppSync domain name, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_appsync_domain_name_api_association` using the AppSync domain name. For example:
 
+```terraform
+import {
+  to = aws_appsync_domain_name_api_association.example
+  id = "example.com"
+}
 ```
-$ terraform import aws_appsync_domain_name_api_association.example example.com
+
+Using `terraform import`, import `aws_appsync_domain_name_api_association` using the AppSync domain name. For example:
+
+```console
+% terraform import aws_appsync_domain_name_api_association.example example.com
 ```
diff --git a/website/docs/r/appsync_function.html.markdown b/website/docs/r/appsync_function.html.markdown
index aef5b9722ca..04d89ef15fb 100644
--- a/website/docs/r/appsync_function.html.markdown
+++ b/website/docs/r/appsync_function.html.markdown
@@ -90,7 +90,7 @@ resource "aws_appsync_function" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `api_id` - (Required) ID of the associated AppSync API.
 * `code` - (Optional) The function code that contains the request and response functions. When code is used, the runtime is required. The runtime value must be APPSYNC_JS.
@@ -106,14 +106,14 @@ The following arguments are supported:
 
 ### Runtime
 
-The following arguments are supported:
+This argument supports the following arguments:
 
 * `name` - (Optional) The name of the runtime to use. Currently, the only allowed value is `APPSYNC_JS`.
 * `runtime_version` - (Optional) The version of the runtime to use. Currently, the only allowed version is `1.0.0`.
 
 ### Sync Config
 
-The following arguments are supported:
+This argument supports the following arguments:
 
 * `conflict_detection` - (Optional) Conflict Detection strategy to use. Valid values are `NONE` and `VERSION`.
 * `conflict_handler` - (Optional) Conflict Resolution strategy to perform in the event of a conflict. Valid values are `NONE`, `OPTIMISTIC_CONCURRENCY`, `AUTOMERGE`, and `LAMBDA`.
@@ -121,13 +121,13 @@ The following arguments are supported:
 
 #### Lambda Conflict Handler Config
 
-The following arguments are supported:
+This argument supports the following arguments:
 
 * `lambda_conflict_handler_arn` - (Optional) ARN for the Lambda function to use as the Conflict Handler.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - API Function ID (Formatted as ApiId-FunctionId)
 * `arn` - ARN of the Function object.
@@ -135,8 +135,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_appsync_function` can be imported using the AppSync API ID and Function ID separated by `-`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_appsync_function` using the AppSync API ID and Function ID separated by `-`. For example:
 
+```terraform
+import {
+  to = aws_appsync_function.example
+  id = "xxxxx-yyyyy"
+}
 ```
-$ terraform import aws_appsync_function.example xxxxx-yyyyy
+
+Using `terraform import`, import `aws_appsync_function` using the AppSync API ID and Function ID separated by `-`. For example:
+
+```console
+% terraform import aws_appsync_function.example xxxxx-yyyyy
 ```
diff --git a/website/docs/r/appsync_graphql_api.html.markdown b/website/docs/r/appsync_graphql_api.html.markdown
index 4859c2aaf7a..fa9a8db7a02 100644
--- a/website/docs/r/appsync_graphql_api.html.markdown
+++ b/website/docs/r/appsync_graphql_api.html.markdown
@@ -200,7 +200,7 @@ resource "aws_wafv2_web_acl" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `authentication_type` - (Required) Authentication type. Valid values: `API_KEY`, `AWS_IAM`, `AMAZON_COGNITO_USER_POOLS`, `OPENID_CONNECT`, `AWS_LAMBDA`
 * `name` - (Required) User-supplied name for the GraphqlApi.
@@ -216,7 +216,7 @@ The following arguments are supported:
 
 ### log_config
 
-The following arguments are supported:
+This argument supports the following arguments:
 
 * `cloudwatch_logs_role_arn` - (Required) Amazon Resource Name of the service role that AWS AppSync will assume to publish to Amazon CloudWatch logs in your account.
 * `field_log_level` - (Required) Field logging level. Valid values: `ALL`, `ERROR`, `NONE`.
@@ -224,7 +224,7 @@ The following arguments are supported:
 
 ### additional_authentication_provider
 
-The following arguments are supported:
+This argument supports the following arguments:
 
 * `authentication_type` - (Required) Authentication type. Valid values: `API_KEY`, `AWS_IAM`, `AMAZON_COGNITO_USER_POOLS`, `OPENID_CONNECT`, `AWS_LAMBDA`
 * `openid_connect_config` - (Optional) Nested argument containing OpenID Connect configuration. Defined below.
@@ -232,7 +232,7 @@ The following arguments are supported:
 
 ### openid_connect_config
 
-The following arguments are supported:
+This argument supports the following arguments:
 
 * `issuer` - (Required) Issuer for the OpenID Connect configuration. The issuer returned by discovery MUST exactly match the value of iss in the ID Token.
 * `auth_ttl` - (Optional) Number of milliseconds a token is valid after being authenticated.
@@ -241,7 +241,7 @@ The following arguments are supported:
 
 ### user_pool_config
 
-The following arguments are supported:
+This argument supports the following arguments:
 
 * `default_action` - (Required only if Cognito is used as the default auth provider) Action that you want your GraphQL API to take when a request that uses Amazon Cognito User Pool authentication doesn't match the Amazon Cognito User Pool configuration. Valid: `ALLOW` and `DENY`
 * `user_pool_id` - (Required) User pool ID.
@@ -250,15 +250,15 @@ The following arguments are supported:
 
 ### lambda_authorizer_config
 
-The following arguments are supported:
+This argument supports the following arguments:
 
 * `authorizer_uri` - (Required) ARN of the Lambda function to be called for authorization. Note: This Lambda function must have a resource-based policy assigned to it, to allow `lambda:InvokeFunction` from service principal `appsync.amazonaws.com`.
 * `authorizer_result_ttl_in_seconds` - (Optional) Number of seconds a response should be cached for. The default is 5 minutes (300 seconds). The Lambda function can override this by returning a `ttlOverride` key in its response. A value of 0 disables caching of responses. Minimum value of 0. Maximum value of 3600.
 * `identity_validation_expression` - (Optional) Regular expression for validation of tokens before the Lambda function is called.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - API ID
 * `arn` - ARN
@@ -267,8 +267,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-AppSync GraphQL API can be imported using the GraphQL API ID, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AppSync GraphQL API using the GraphQL API ID. For example:
 
+```terraform
+import {
+  to = aws_appsync_graphql_api.example
+  id = "0123456789"
+}
 ```
-$ terraform import aws_appsync_graphql_api.example 0123456789
+
+Using `terraform import`, import AppSync GraphQL API using the GraphQL API ID. For example:
+
+```console
+% terraform import aws_appsync_graphql_api.example 0123456789
 ```
diff --git a/website/docs/r/appsync_resolver.html.markdown b/website/docs/r/appsync_resolver.html.markdown
index f2a5b3041ff..d8c36cbc2c1 100644
--- a/website/docs/r/appsync_resolver.html.markdown
+++ b/website/docs/r/appsync_resolver.html.markdown
@@ -126,7 +126,7 @@ resource "aws_appsync_resolver" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `api_id` - (Required) API ID for the GraphQL API.
 * `code` - (Optional) The function code that contains the request and response functions. When code is used, the runtime is required. The runtime value must be APPSYNC_JS.
@@ -166,16 +166,25 @@ The following arguments are supported:
 * `name` - (Optional) The name of the runtime to use. Currently, the only allowed value is `APPSYNC_JS`.
 * `runtime_version` - (Optional) The version of the runtime to use. Currently, the only allowed version is `1.0.0`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN
 
 ## Import
 
-`aws_appsync_resolver` can be imported with their `api_id`, a hyphen, `type`, a hypen and `field` e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_appsync_resolver` using the `api_id`, a hyphen, `type`, a hypen and `field`. For example:
 
+```terraform
+import {
+  to = aws_appsync_resolver.example
+  id = "abcdef123456-exampleType-exampleField"
+}
 ```
-$ terraform import aws_appsync_resolver.example abcdef123456-exampleType-exampleField
+
+Using `terraform import`, import `aws_appsync_resolver` using the `api_id`, a hyphen, `type`, a hypen and `field`. For example:
+
+```console
+% terraform import aws_appsync_resolver.example abcdef123456-exampleType-exampleField
 ```
diff --git a/website/docs/r/appsync_type.html.markdown b/website/docs/r/appsync_type.html.markdown
index 4172e921379..ad32e0f9944 100644
--- a/website/docs/r/appsync_type.html.markdown
+++ b/website/docs/r/appsync_type.html.markdown
@@ -34,15 +34,15 @@ EOF
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `api_id` - (Required) GraphQL API ID.
 * `format` - (Required) The type format: `SDL` or `JSON`.
 * `definition` - (Required) The type definition.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The ARN of the type.
 * `description` - The type description.
@@ -51,8 +51,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Appsync Types can be imported using the `id` e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Appsync Types using the `id`. For example:
 
+```terraform
+import {
+  to = aws_appsync_type.example
+  id = "api-id:format:name"
+}
 ```
-$ terraform import aws_appsync_type.example api-id:format:name
+
+Using `terraform import`, import Appsync Types using the `id`. For example:
+
+```console
+% terraform import aws_appsync_type.example api-id:format:name
 ```
diff --git a/website/docs/r/athena_data_catalog.html.markdown b/website/docs/r/athena_data_catalog.html.markdown
index a03a4f06aff..5cf7a586bd7 100644
--- a/website/docs/r/athena_data_catalog.html.markdown
+++ b/website/docs/r/athena_data_catalog.html.markdown
@@ -77,7 +77,7 @@ resource "aws_athena_data_catalog" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 - `name` - (Required) Name of the data catalog. The catalog name must be unique for the AWS account and can use a maximum of 128 alphanumeric, underscore, at sign, or hyphen characters.
 - `type` - (Required) Type of data catalog: `LAMBDA` for a federated catalog, `GLUE` for AWS Glue Catalog, or `HIVE` for an external hive metastore.
@@ -85,9 +85,9 @@ The following arguments are supported:
 - `description` - (Required) Description of the data catalog.
 - `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 - `id` - Name of the data catalog.
 - `arn` - ARN of the data catalog.
@@ -95,8 +95,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Data catalogs can be imported using their `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import data catalogs using their `name`. For example:
 
+```terraform
+import {
+  to = aws_athena_data_catalog.example
+  id = "example-data-catalog"
+}
 ```
-$ terraform import aws_athena_data_catalog.example example-data-catalog
+
+Using `terraform import`, import data catalogs using their `name`. For example:
+
+```console
+% terraform import aws_athena_data_catalog.example example-data-catalog
 ```
diff --git a/website/docs/r/athena_database.html.markdown b/website/docs/r/athena_database.html.markdown
index f4f76508405..5b79979e793 100644
--- a/website/docs/r/athena_database.html.markdown
+++ b/website/docs/r/athena_database.html.markdown
@@ -25,7 +25,7 @@ resource "aws_athena_database" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `bucket` - (Required) Name of S3 bucket to save the results of the query execution.
 * `name` - (Required) Name of the database to create.
@@ -47,21 +47,30 @@ The following arguments are supported:
 * `encryption_option` - (Required) Type of key; one of `SSE_S3`, `SSE_KMS`, `CSE_KMS`
 * `kms_key` - (Optional) KMS key ARN or ID; required for key types `SSE_KMS` and `CSE_KMS`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Database name
 
 ## Import
 
-Athena Databases can be imported using their name, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Athena Databases using their name. For example:
 
+```terraform
+import {
+  to = aws_athena_database.example
+  id = "example"
+}
 ```
-$ terraform import aws_athena_database.example example
+
+Using `terraform import`, import Athena Databases using their name. For example:
+
+```console
+% terraform import aws_athena_database.example example
 ```
 
-Certain resource arguments, like `encryption_configuration` and `bucket`, do not have an API method for reading the information after creation. If the argument is set in the Terraform configuration on an imported resource, Terraform will always show a difference. To workaround this behavior, either omit the argument from the Terraform configuration or use [`ignore_changes`](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html#ignore_changes) to hide the difference, e.g.,
+Certain resource arguments, like `encryption_configuration` and `bucket`, do not have an API method for reading the information after creation. If the argument is set in the Terraform configuration on an imported resource, Terraform will always show a difference. To workaround this behavior, either omit the argument from the Terraform configuration or use [`ignore_changes`](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html#ignore_changes) to hide the difference. For example:
 
 ```terraform
 resource "aws_athena_database" "example" {
diff --git a/website/docs/r/athena_named_query.html.markdown b/website/docs/r/athena_named_query.html.markdown
index 5e6ae5fdffe..87caeb08d80 100644
--- a/website/docs/r/athena_named_query.html.markdown
+++ b/website/docs/r/athena_named_query.html.markdown
@@ -50,7 +50,7 @@ resource "aws_athena_named_query" "foo" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) Plain language name for the query. Maximum length of 128.
 * `workgroup` - (Optional) Workgroup to which the query belongs. Defaults to `primary`
@@ -58,16 +58,25 @@ The following arguments are supported:
 * `query` - (Required) Text of the query itself. In other words, all query statements. Maximum length of 262144.
 * `description` - (Optional) Brief explanation of the query. Maximum length of 1024.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Unique ID of the query.
 
 ## Import
 
-Athena Named Query can be imported using the query ID, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Athena Named Query using the query ID. For example:
 
+```terraform
+import {
+  to = aws_athena_named_query.example
+  id = "0123456789"
+}
 ```
-$ terraform import aws_athena_named_query.example 0123456789
+
+Using `terraform import`, import Athena Named Query using the query ID. For example:
+
+```console
+% terraform import aws_athena_named_query.example 0123456789
 ```
diff --git a/website/docs/r/athena_workgroup.html.markdown b/website/docs/r/athena_workgroup.html.markdown
index ef2e5b6c442..84ba101da9b 100644
--- a/website/docs/r/athena_workgroup.html.markdown
+++ b/website/docs/r/athena_workgroup.html.markdown
@@ -34,7 +34,7 @@ resource "aws_athena_workgroup" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) Name of the workgroup.
 * `configuration` - (Optional) Configuration block with various settings for the workgroup. Documented below.
@@ -73,9 +73,9 @@ The following arguments are supported:
 * `encryption_option` - (Required) Whether Amazon S3 server-side encryption with Amazon S3-managed keys (`SSE_S3`), server-side encryption with KMS-managed keys (`SSE_KMS`), or client-side encryption with KMS-managed keys (`CSE_KMS`) is used. If a query runs in a workgroup and the workgroup overrides client-side settings, then the workgroup's setting for encryption is used. It specifies whether query results must be encrypted, for all queries that run in this workgroup.
 * `kms_key_arn` - (Optional) For `SSE_KMS` and `CSE_KMS`, this is the KMS key ARN.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the workgroup
 * `configuration` - Configuration block with various settings for the workgroup
@@ -86,8 +86,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Athena Workgroups can be imported using their name, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Athena Workgroups using their name. For example:
 
+```terraform
+import {
+  to = aws_athena_workgroup.example
+  id = "example"
+}
 ```
-$ terraform import aws_athena_workgroup.example example
+
+Using `terraform import`, import Athena Workgroups using their name. For example:
+
+```console
+% terraform import aws_athena_workgroup.example example
 ```
diff --git a/website/docs/r/auditmanager_account_registration.html.markdown b/website/docs/r/auditmanager_account_registration.html.markdown
index 0dba9942901..fcce8752895 100644
--- a/website/docs/r/auditmanager_account_registration.html.markdown
+++ b/website/docs/r/auditmanager_account_registration.html.markdown
@@ -34,17 +34,26 @@ The following arguments are optional:
 * `deregister_on_destroy` - (Optional) Flag to deregister AuditManager in the account upon destruction. Defaults to `false` (ie. AuditManager will remain active in the account, even if this resource is removed).
 * `kms_key` - (Optional) KMS key identifier.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Unique identifier for the account registration. Since registration is applied per AWS region, this will be the active region name (ex. `us-east-1`).
 * `status` - Status of the account registration request.
 
 ## Import
 
-Audit Manager Account Registration resources can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Audit Manager Account Registration resources using the `id`. For example:
 
+```terraform
+import {
+  to = aws_auditmanager_account_registration.example
+  id = "us-east-1"
+}
 ```
-$ terraform import aws_auditmanager_account_registration.example us-east-1
+
+Using `terraform import`, import Audit Manager Account Registration resources using the `id`. For example:
+
+```console
+% terraform import aws_auditmanager_account_registration.example us-east-1
 ```
diff --git a/website/docs/r/auditmanager_assessment.html.markdown b/website/docs/r/auditmanager_assessment.html.markdown
index b875ba87db6..e209efd7084 100644
--- a/website/docs/r/auditmanager_assessment.html.markdown
+++ b/website/docs/r/auditmanager_assessment.html.markdown
@@ -79,9 +79,9 @@ The following arguments are optional:
 
 * `service_name` - (Required) Name of the Amazon Web Service.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name (ARN) of the assessment.
 * `id` - Unique identifier for the assessment.
@@ -90,8 +90,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Audit Manager Assessments can be imported using the assessment `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Audit Manager Assessments using the assessment `id`. For example:
 
+```terraform
+import {
+  to = aws_auditmanager_assessment.example
+  id = "abc123-de45"
+}
 ```
-$ terraform import aws_auditmanager_assessment.example abc123-de45
+
+Using `terraform import`, import Audit Manager Assessments using the assessment `id`. For example:
+
+```console
+% terraform import aws_auditmanager_assessment.example abc123-de45
 ```
diff --git a/website/docs/r/auditmanager_assessment_delegation.html.markdown b/website/docs/r/auditmanager_assessment_delegation.html.markdown
index 27596859ba1..efa6d526718 100644
--- a/website/docs/r/auditmanager_assessment_delegation.html.markdown
+++ b/website/docs/r/auditmanager_assessment_delegation.html.markdown
@@ -36,9 +36,9 @@ The following arguments are optional:
 
 * `comment` - (Optional) Comment describing the delegation request.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `delegation_id` - Unique identifier for the delegation.
 * `id` - Unique identifier for the resource. This is a comma-separated string containing `assessment_id`, `role_arn`, and `control_set_id`.
@@ -46,8 +46,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Audit Manager Assessment Delegation can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Audit Manager Assessment Delegation using the `id`. For example:
 
+```terraform
+import {
+  to = aws_auditmanager_assessment_delegation.example
+  id = "abcdef-123456,arn:aws:iam::012345678901:role/example,example"
+}
 ```
-$ terraform import aws_auditmanager_assessment_delegation.example abcdef-123456,arn:aws:iam::012345678901:role/example,example
+
+Using `terraform import`, import Audit Manager Assessment Delegation using the `id`. For example:
+
+```console
+% terraform import aws_auditmanager_assessment_delegation.example abcdef-123456,arn:aws:iam::012345678901:role/example,example
 ```
diff --git a/website/docs/r/auditmanager_assessment_report.html.markdown b/website/docs/r/auditmanager_assessment_report.html.markdown
index 02a7d8283d0..c537b5822e8 100644
--- a/website/docs/r/auditmanager_assessment_report.html.markdown
+++ b/website/docs/r/auditmanager_assessment_report.html.markdown
@@ -32,9 +32,9 @@ The following arguments are optional:
 
 * `description` - (Optional) Description of the assessment report.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `author` - Name of the user who created the assessment report.
 * `id` - Unique identifier for the assessment report.
@@ -42,8 +42,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Audit Manager Assessment Reports can be imported using the assessment report `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Audit Manager Assessment Reports using the assessment report `id`. For example:
 
+```terraform
+import {
+  to = aws_auditmanager_assessment_report.example
+  id = "abc123-de45"
+}
 ```
-$ terraform import aws_auditmanager_assessment_report.example abc123-de45
+
+Using `terraform import`, import Audit Manager Assessment Reports using the assessment report `id`. For example:
+
+```console
+% terraform import aws_auditmanager_assessment_report.example abc123-de45
 ```
diff --git a/website/docs/r/auditmanager_control.html.markdown b/website/docs/r/auditmanager_control.html.markdown
index 7c83e1f3d4e..a173781d5f0 100644
--- a/website/docs/r/auditmanager_control.html.markdown
+++ b/website/docs/r/auditmanager_control.html.markdown
@@ -63,9 +63,9 @@ The following arguments are required:
 * `keyword_input_type` - (Required) Input method for the keyword. Valid values are `SELECT_FROM_LIST`.
 * `keyword_value` - (Required) The value of the keyword that's used when mapping a control data source. For example, this can be a CloudTrail event name, a rule name for Config, a Security Hub control, or the name of an Amazon Web Services API call. See the [Audit Manager supported control data sources documentation](https://docs.aws.amazon.com/audit-manager/latest/userguide/control-data-sources.html) for more information.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name (ARN) of the control.
 * `control_mapping_sources.*.source_id` - Unique identifier for the source.
@@ -74,8 +74,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-An Audit Manager Control can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import an Audit Manager Control using the `id`. For example:
 
+```terraform
+import {
+  to = aws_auditmanager_control.example
+  id = "abc123-de45"
+}
 ```
-$ terraform import aws_auditmanager_control.example abc123-de45
+
+Using `terraform import`, import an Audit Manager Control using the `id`. For example:
+
+```console
+% terraform import aws_auditmanager_control.example abc123-de45
 ```
diff --git a/website/docs/r/auditmanager_framework.html.markdown b/website/docs/r/auditmanager_framework.html.markdown
index 0571ba8db09..78c009499c1 100644
--- a/website/docs/r/auditmanager_framework.html.markdown
+++ b/website/docs/r/auditmanager_framework.html.markdown
@@ -49,9 +49,9 @@ The following arguments are optional:
 
 * `id` - (Required) Unique identifier of the control.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name (ARN) of the framework.
 * `control_sets[*].id` - Unique identifier for the framework control set.
@@ -60,8 +60,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Audit Manager Framework can be imported using the framework `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Audit Manager Framework using the framework `id`. For example:
 
+```terraform
+import {
+  to = aws_auditmanager_framework.example
+  id = "abc123-de45"
+}
 ```
-$ terraform import aws_auditmanager_framework.example abc123-de45
+
+Using `terraform import`, import Audit Manager Framework using the framework `id`. For example:
+
+```console
+% terraform import aws_auditmanager_framework.example abc123-de45
 ```
diff --git a/website/docs/r/auditmanager_framework_share.html.markdown b/website/docs/r/auditmanager_framework_share.html.markdown
index b03f375b3cd..578419b8b3e 100644
--- a/website/docs/r/auditmanager_framework_share.html.markdown
+++ b/website/docs/r/auditmanager_framework_share.html.markdown
@@ -34,17 +34,26 @@ The following arguments are optional:
 
 * `comment` - (Optional) Comment from the sender about the share request.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Unique identifier for the share request.
 * `status` -  Status of the share request.
 
 ## Import
 
-Audit Manager Framework Share can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Audit Manager Framework Share using the `id`. For example:
 
+```terraform
+import {
+  to = aws_auditmanager_framework_share.example
+  id = "abcdef-123456"
+}
 ```
-$ terraform import aws_auditmanager_framework_share.example abcdef-123456
+
+Using `terraform import`, import Audit Manager Framework Share using the `id`. For example:
+
+```console
+% terraform import aws_auditmanager_framework_share.example abcdef-123456
 ```
diff --git a/website/docs/r/auditmanager_organization_admin_account_registration.html.markdown b/website/docs/r/auditmanager_organization_admin_account_registration.html.markdown
index 533b4d6ac0a..3d372c1b3bb 100644
--- a/website/docs/r/auditmanager_organization_admin_account_registration.html.markdown
+++ b/website/docs/r/auditmanager_organization_admin_account_registration.html.markdown
@@ -26,17 +26,26 @@ The following arguments are required:
 
 * `admin_account_id` - (Required) Identifier for the organization administrator account.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Identifier for the organization administrator account.
 * `organization_id` - Identifier for the organization.
 
 ## Import
 
-Audit Manager Organization Admin Account Registration can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Audit Manager Organization Admin Account Registration using the `id`. For example:
 
+```terraform
+import {
+  to = aws_auditmanager_organization_admin_account_registration.example
+  id = "012345678901 "
+}
 ```
-$ terraform import aws_auditmanager_organization_admin_account_registration.example 012345678901 
+
+Using `terraform import`, import Audit Manager Organization Admin Account Registration using the `id`. For example:
+
+```console
+% terraform import aws_auditmanager_organization_admin_account_registration.example 012345678901 
 ```
diff --git a/website/docs/r/autoscaling_attachment.html.markdown b/website/docs/r/autoscaling_attachment.html.markdown
index daf034cc6f2..dc6b18b4d28 100644
--- a/website/docs/r/autoscaling_attachment.html.markdown
+++ b/website/docs/r/autoscaling_attachment.html.markdown
@@ -32,12 +32,12 @@ resource "aws_autoscaling_attachment" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `autoscaling_group_name` - (Required) Name of ASG to associate with the ELB.
 * `elb` - (Optional) Name of the ELB.
 * `lb_target_group_arn` - (Optional) ARN of a load balancer target group.
 
-## Attributes Reference
+## Attribute Reference
 
-No additional attributes are exported.
+This resource exports no additional attributes.
diff --git a/website/docs/r/autoscaling_group.html.markdown b/website/docs/r/autoscaling_group.html.markdown
index 96f7e754b92..a6be59c699a 100644
--- a/website/docs/r/autoscaling_group.html.markdown
+++ b/website/docs/r/autoscaling_group.html.markdown
@@ -392,7 +392,7 @@ resource "aws_autoscaling_group" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 - `name` - (Optional) Name of the Auto Scaling Group. By default generated by Terraform. Conflicts with `name_prefix`.
 - `name_prefix` - (Optional) Creates a unique name beginning with the specified
@@ -407,7 +407,8 @@ The following arguments are supported:
 - `default_instance_warmup` - (Optional) Amount of time, in seconds, until a newly launched instance can contribute to the Amazon CloudWatch metrics. This delay lets an instance finish initializing before Amazon EC2 Auto Scaling aggregates instance metrics, resulting in more reliable usage data. Set this value equal to the amount of time that it takes for resource consumption to become stable after an instance reaches the InService state. (See [Set the default instance warmup for an Auto Scaling group](https://docs.aws.amazon.com/autoscaling/ec2/userguide/ec2-auto-scaling-default-instance-warmup.html))
 - `launch_configuration` - (Optional) Name of the launch configuration to use.
 - `launch_template` - (Optional) Nested argument with Launch template specification to use to launch instances. See [Launch Template](#launch_template) below for more details.
-- `mixed_instances_policy` (Optional) Configuration block containing settings to define launch targets for Auto Scaling groups. See [Mixed Instances Policy](#mixed_instances_policy) below for more details.
+- `mixed_instances_policy` - (Optional) Configuration block containing settings to define launch targets for Auto Scaling groups. See [Mixed Instances Policy](#mixed_instances_policy) below for more details.
+- `ignore_failed_scaling_activities` - (Optional) Whether to ignore failed [Auto Scaling scaling activities](https://docs.aws.amazon.com/autoscaling/ec2/userguide/as-verify-scaling-activity.html) while [waiting for capacity](#waiting-for-capacity). The default is `false` -- failed scaling activities cause errors to be returned.
 - `initial_lifecycle_hook` - (Optional) One or more
   [Lifecycle Hooks](http://docs.aws.amazon.com/autoscaling/latest/userguide/lifecycle-hooks.html)
   to attach to the Auto Scaling Group **before** instances are launched. The
@@ -426,19 +427,19 @@ The following arguments are supported:
   even if it's in the process of scaling a resource. Normally, Terraform
   drains all the instances before deleting the group. This bypasses that
   behavior and potentially leaves resources dangling.
-- `load_balancers` (Optional) List of elastic load balancer names to add to the autoscaling
+- `load_balancers` - (Optional) List of elastic load balancer names to add to the autoscaling
   group names. Only valid for classic load balancers. For ALBs, use `target_group_arns` instead. To remove all load balancer attachments an empty list should be specified.
-- `traffic_source` (Optional) Attaches one or more traffic sources to the specified Auto Scaling group.
-- `vpc_zone_identifier` (Optional) List of subnet IDs to launch resources in. Subnets automatically determine which availability zones the group will reside. Conflicts with `availability_zones`.
-- `target_group_arns` (Optional) Set of `aws_alb_target_group` ARNs, for use with Application or Network Load Balancing. To remove all target group attachments an empty list should be specified.
-- `termination_policies` (Optional) List of policies to decide how the instances in the Auto Scaling Group should be terminated. The allowed values are `OldestInstance`, `NewestInstance`, `OldestLaunchConfiguration`, `ClosestToNextInstanceHour`, `OldestLaunchTemplate`, `AllocationStrategy`, `Default`. Additionally, the ARN of a Lambda function can be specified for custom termination policies.
+- `traffic_source` - (Optional) Attaches one or more traffic sources to the specified Auto Scaling group.
+- `vpc_zone_identifier` - (Optional) List of subnet IDs to launch resources in. Subnets automatically determine which availability zones the group will reside. Conflicts with `availability_zones`.
+- `target_group_arns` - (Optional) Set of `aws_alb_target_group` ARNs, for use with Application or Network Load Balancing. To remove all target group attachments an empty list should be specified.
+- `termination_policies` - (Optional) List of policies to decide how the instances in the Auto Scaling Group should be terminated. The allowed values are `OldestInstance`, `NewestInstance`, `OldestLaunchConfiguration`, `ClosestToNextInstanceHour`, `OldestLaunchTemplate`, `AllocationStrategy`, `Default`. Additionally, the ARN of a Lambda function can be specified for custom termination policies.
 - `suspended_processes` - (Optional) List of processes to suspend for the Auto Scaling Group. The allowed values are `Launch`, `Terminate`, `HealthCheck`, `ReplaceUnhealthy`, `AZRebalance`, `AlarmNotification`, `ScheduledActions`, `AddToLoadBalancer`, `InstanceRefresh`.
   Note that if you suspend either the `Launch` or `Terminate` process types, it can prevent your Auto Scaling Group from functioning properly.
-- `tag` (Optional) Configuration block(s) containing resource tags. See [Tag](#tag) below for more details.
-- `placement_group` (Optional) Name of the placement group into which you'll launch your instances, if any.
+- `tag` - (Optional) Configuration block(s) containing resource tags. See [Tag](#tag) below for more details.
+- `placement_group` - (Optional) Name of the placement group into which you'll launch your instances, if any.
 - `metrics_granularity` - (Optional) Granularity to associate with the metrics to collect. The only valid value is `1Minute`. Default is `1Minute`.
 - `enabled_metrics` - (Optional) List of metrics to collect. The allowed values are defined by the [underlying AWS API](https://docs.aws.amazon.com/autoscaling/ec2/APIReference/API_EnableMetricsCollection.html).
-- `wait_for_capacity_timeout` (Default: "10m") Maximum
+- `wait_for_capacity_timeout` - (Optional, Default: "10m") Maximum
   [duration](https://golang.org/pkg/time/#ParseDuration) that Terraform should
   wait for ASG instances to be healthy before timing out. (See also [Waiting
   for Capacity](#waiting-for-capacity) below.) Setting this to "0" causes
@@ -452,13 +453,13 @@ The following arguments are supported:
   all attached load balancers on both create and update operations. (Takes
   precedence over `min_elb_capacity` behavior.)
   (See also [Waiting for Capacity](#waiting-for-capacity) below.)
-- `protect_from_scale_in` (Optional) Whether newly launched instances
+- `protect_from_scale_in` - (Optional) Whether newly launched instances
   are automatically protected from termination by Amazon EC2 Auto Scaling when
   scaling in. For more information about preventing instances from terminating
   on scale in, see [Using instance scale-in protection](https://docs.aws.amazon.com/autoscaling/ec2/userguide/ec2-auto-scaling-instance-protection.html)
   in the Amazon EC2 Auto Scaling User Guide.
-- `service_linked_role_arn` (Optional) ARN of the service-linked role that the ASG will use to call other AWS services
-- `max_instance_lifetime` (Optional) Maximum amount of time, in seconds, that an instance can be in service, values must be either equal to 0 or between 86400 and 31536000 seconds.
+- `service_linked_role_arn` - (Optional) ARN of the service-linked role that the ASG will use to call other AWS services
+- `max_instance_lifetime` - (Optional) Maximum amount of time, in seconds, that an instance can be in service, values must be either equal to 0 or between 86400 and 31536000 seconds.
 - `instance_refresh` - (Optional) If this block is configured, start an
   [Instance Refresh](https://docs.aws.amazon.com/autoscaling/ec2/userguide/asg-instance-refresh.html)
   when this Auto Scaling Group is updated. Defined [below](#instance_refresh).
@@ -656,7 +657,9 @@ This configuration block supports the following:
     - `instance_warmup` - (Optional) Number of seconds until a newly launched instance is configured and ready to use. Default behavior is to use the Auto Scaling Group's health check grace period.
     - `min_healthy_percentage` - (Optional) Amount of capacity in the Auto Scaling group that must remain healthy during an instance refresh to allow the operation to continue, as a percentage of the desired capacity of the Auto Scaling group. Defaults to `90`.
     - `skip_matching` - (Optional) Replace instances that already have your desired configuration. Defaults to `false`.
-    - `auto_rollback` - (Optional) Automatically rollback if instance refresh fails. Defaults to `false`.
+    - `auto_rollback` - (Optional) Automatically rollback if instance refresh fails. Defaults to `false`. This option may only be set to `true` when specifying a `launch_template` or `mixed_instances_policy`.
+    - `scale_in_protected_instances` - (Optional) Behavior when encountering instances protected from scale in are found. Available behaviors are `Refresh`, `Ignore`, and `Wait`. Default is `Ignore`.
+    - `standby_instances` - (Optional) Behavior when encountering instances in the `Standby` state in are found. Available behaviors are `Terminate`, `Ignore`, and `Wait`. Default is `Ignore`.
 - `triggers` - (Optional) Set of additional property names that will trigger an Instance Refresh. A refresh will always be triggered by a change in any of `launch_configuration`, `launch_template`, or `mixed_instances_policy`.
 
 ~> **NOTE:** A refresh is started when any of the following Auto Scaling Group properties change: `launch_configuration`, `launch_template`, `mixed_instances_policy`. Additional properties can be specified in the `triggers` property of `instance_refresh`.
@@ -691,9 +694,9 @@ This configuration block supports the following:
 
 - `reuse_on_scale_in` - (Optional) Whether instances in the Auto Scaling group can be returned to the warm pool on scale in.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 - `id` - Auto Scaling Group id.
 - `arn` - ARN for this Auto Scaling Group
@@ -794,8 +797,17 @@ for more information.
 
 ## Import
 
-Auto Scaling Groups can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Auto Scaling Groups using the `name`. For example:
 
+```terraform
+import {
+  to = aws_autoscaling_group.web
+  id = "web-asg"
+}
 ```
-$ terraform import aws_autoscaling_group.web web-asg
+
+Using `terraform import`, import Auto Scaling Groups using the `name`. For example:
+
+```console
+% terraform import aws_autoscaling_group.web web-asg
 ```
diff --git a/website/docs/r/autoscaling_group_tag.html.markdown b/website/docs/r/autoscaling_group_tag.html.markdown
index 89605005e83..7bf5ceeb41e 100644
--- a/website/docs/r/autoscaling_group_tag.html.markdown
+++ b/website/docs/r/autoscaling_group_tag.html.markdown
@@ -44,7 +44,7 @@ resource "aws_autoscaling_group_tag" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `autoscaling_group_name` - (Required) Name of the Autoscaling Group to apply the tag to.
 * `tag` - (Required) Tag to create. The `tag` block is documented below.
@@ -55,16 +55,25 @@ The `tag` block supports the following arguments:
 * `value` - (Required) Tag value.
 * `propagate_at_launch` - (Required) Whether to propagate the tags to instances launched by the ASG.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - ASG name and key, separated by a comma (`,`)
 
 ## Import
 
-`aws_autoscaling_group_tag` can be imported by using the ASG name and key, separated by a comma (`,`), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_autoscaling_group_tag` using the ASG name and key, separated by a comma (`,`). For example:
 
+```terraform
+import {
+  to = aws_autoscaling_group_tag.example
+  id = "asg-example,k8s.io/cluster-autoscaler/node-template/label/eks.amazonaws.com/capacityType"
+}
 ```
-$ terraform import aws_autoscaling_group_tag.example asg-example,k8s.io/cluster-autoscaler/node-template/label/eks.amazonaws.com/capacityType
+
+Using `terraform import`, import `aws_autoscaling_group_tag` using the ASG name and key, separated by a comma (`,`). For example:
+
+```console
+% terraform import aws_autoscaling_group_tag.example asg-example,k8s.io/cluster-autoscaler/node-template/label/eks.amazonaws.com/capacityType
 ```
diff --git a/website/docs/r/autoscaling_lifecycle_hook.html.markdown b/website/docs/r/autoscaling_lifecycle_hook.html.markdown
index 095494ae03c..1f6826a630e 100644
--- a/website/docs/r/autoscaling_lifecycle_hook.html.markdown
+++ b/website/docs/r/autoscaling_lifecycle_hook.html.markdown
@@ -56,7 +56,7 @@ resource "aws_autoscaling_lifecycle_hook" "foobar" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) Name of the lifecycle hook.
 * `autoscaling_group_name` - (Required) Name of the Auto Scaling group to which you want to assign the lifecycle hook
@@ -67,14 +67,23 @@ The following arguments are supported:
 * `notification_target_arn` - (Optional) ARN of the notification target that Auto Scaling will use to notify you when an instance is in the transition state for the lifecycle hook. This ARN target can be either an SQS queue or an SNS topic.
 * `role_arn` - (Optional) ARN of the IAM role that allows the Auto Scaling group to publish to the specified notification target.
 
-## Attributes Reference
+## Attribute Reference
 
-No additional attributes are exported.
+This resource exports no additional attributes.
 
 ## Import
 
-AutoScaling Lifecycle Hooks can be imported using the role autoscaling_group_name and name separated by `/`.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AutoScaling Lifecycle Hooks using the role autoscaling_group_name and name separated by `/`. For example:
 
+```terraform
+import {
+  to = aws_autoscaling_lifecycle_hook.test-lifecycle-hook
+  id = "asg-name/lifecycle-hook-name"
+}
 ```
-$ terraform import aws_autoscaling_lifecycle_hook.test-lifecycle-hook asg-name/lifecycle-hook-name
+
+Using `terraform import`, import AutoScaling Lifecycle Hooks using the role autoscaling_group_name and name separated by `/`. For example:
+
+```console
+% terraform import aws_autoscaling_lifecycle_hook.test-lifecycle-hook asg-name/lifecycle-hook-name
 ```
diff --git a/website/docs/r/autoscaling_notification.html.markdown b/website/docs/r/autoscaling_notification.html.markdown
index 7dbde31f49a..ae239a7116a 100644
--- a/website/docs/r/autoscaling_notification.html.markdown
+++ b/website/docs/r/autoscaling_notification.html.markdown
@@ -54,16 +54,16 @@ resource "aws_autoscaling_group" "foo" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `group_names` - (Required) List of AutoScaling Group Names
 * `notifications` - (Required) List of Notification Types that trigger
 notifications. Acceptable values are documented [in the AWS documentation here][1]
 * `topic_arn` - (Required) Topic ARN for notifications to be sent through
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `group_names`
 * `notifications`
diff --git a/website/docs/r/autoscaling_policy.html.markdown b/website/docs/r/autoscaling_policy.html.markdown
index 1e4445f7278..f813f80f1b5 100644
--- a/website/docs/r/autoscaling_policy.html.markdown
+++ b/website/docs/r/autoscaling_policy.html.markdown
@@ -41,7 +41,7 @@ resource "aws_autoscaling_group" "bar" {
 }
 ```
 
-### Create target tarcking scaling policy using metric math
+### Create target tracking scaling policy using metric math
 
 ```terraform
 resource "aws_autoscaling_policy" "example" {
@@ -257,14 +257,14 @@ The following fields are available in target tracking configuration:
 
 ### predefined_metric_specification
 
-The following arguments are supported:
+This argument supports the following arguments:
 
 * `predefined_metric_type` - (Required) Metric type.
 * `resource_label` - (Optional) Identifies the resource associated with the metric type.
 
 ### customized_metric_specification
 
-The following arguments are supported:
+This argument supports the following arguments:
 
 * `metric_dimension` - (Optional) Dimensions of the metric.
 * `metric_name` - (Optional) Name of the metric.
@@ -275,14 +275,14 @@ The following arguments are supported:
 
 #### metric_dimension
 
-The following arguments are supported:
+This argument supports the following arguments:
 
 * `name` - (Required) Name of the dimension.
 * `value` - (Required) Value of the dimension.
 
 #### metrics
 
-The following arguments are supported:
+This argument supports the following arguments:
 
 * `expression` - (Optional) Math expression used on the returned metric. You must specify either `expression` or `metric_stat`, but not both.
 * `id` - (Required) Short name for the metric used in target tracking scaling policy.
@@ -292,7 +292,7 @@ The following arguments are supported:
 
 ##### metric_stat
 
-The following arguments are supported:
+This argument supports the following arguments:
 
 * `metric` - (Required) Structure that defines the CloudWatch metric to return, including the metric name, namespace, and dimensions.
 * `stat` - (Required) Statistic of the metrics to return.
@@ -300,7 +300,7 @@ The following arguments are supported:
 
 ##### metric
 
-The following arguments are supported:
+This argument supports the following arguments:
 
 * `dimensions` - (Optional) Dimensions of the metric.
 * `metric_name` - (Required) Name of the metric.
@@ -308,14 +308,14 @@ The following arguments are supported:
 
 ###### dimensions
 
-The following arguments are supported:
+This argument supports the following arguments:
 
 * `name` - (Required) Name of the dimension.
 * `value` - (Required) Value of the dimension.
 
 ### predictive_scaling_configuration
 
-The following arguments are supported:
+This argument supports the following arguments:
 
 * `max_capacity_breach_behavior` - (Optional) Defines the behavior that should be applied if the forecast capacity approaches or exceeds the maximum capacity of the Auto Scaling group. Valid values are `HonorMaxCapacity` or `IncreaseMaxCapacity`. Default is `HonorMaxCapacity`.
 * `max_capacity_buffer` - (Optional) Size of the capacity buffer to use when the forecast capacity is close to or exceeds the maximum capacity. Valid range is `0` to `100`. If set to `0`, Amazon EC2 Auto Scaling may scale capacity higher than the maximum capacity to equal but not exceed forecast capacity.
@@ -325,7 +325,7 @@ The following arguments are supported:
 
 #### metric_specification
 
-The following arguments are supported:
+This argument supports the following arguments:
 
 * `customized_capacity_metric_specification` - (Optional) Customized capacity metric specification. The field is only valid when you use `customized_load_metric_specification`
 * `customized_load_metric_specification` - (Optional) Customized load metric specification.
@@ -336,46 +336,46 @@ The following arguments are supported:
 
 ##### predefined_load_metric_specification
 
-The following arguments are supported:
+This argument supports the following arguments:
 
 * `predefined_metric_type` - (Required) Metric type. Valid values are `ASGTotalCPUUtilization`, `ASGTotalNetworkIn`, `ASGTotalNetworkOut`, or `ALBTargetGroupRequestCount`.
 * `resource_label` - (Required) Label that uniquely identifies a specific Application Load Balancer target group from which to determine the request count served by your Auto Scaling group.
 
 ##### predefined_metric_pair_specification
 
-The following arguments are supported:
+This argument supports the following arguments:
 
 * `predefined_metric_type` - (Required) Which metrics to use. There are two different types of metrics for each metric type: one is a load metric and one is a scaling metric. For example, if the metric type is `ASGCPUUtilization`, the Auto Scaling group's total CPU metric is used as the load metric, and the average CPU metric is used for the scaling metric. Valid values are `ASGCPUUtilization`, `ASGNetworkIn`, `ASGNetworkOut`, or `ALBRequestCount`.
 * `resource_label` - (Required) Label that uniquely identifies a specific Application Load Balancer target group from which to determine the request count served by your Auto Scaling group.
 
 ##### predefined_scaling_metric_specification
 
-The following arguments are supported:
+This argument supports the following arguments:
 
 * `predefined_metric_type` - (Required) Describes a scaling metric for a predictive scaling policy. Valid values are `ASGAverageCPUUtilization`, `ASGAverageNetworkIn`, `ASGAverageNetworkOut`, or `ALBRequestCountPerTarget`.
 * `resource_label` - (Required) Label that uniquely identifies a specific Application Load Balancer target group from which to determine the request count served by your Auto Scaling group.
 
 ##### customized_scaling_metric_specification
 
-The following arguments are supported:
+This argument supports the following arguments:
 
 * `metric_data_queries` - (Required) List of up to 10 structures that defines custom scaling metric in predictive scaling policy
 
 ##### customized_load_metric_specification
 
-The following arguments are supported:
+This argument supports the following arguments:
 
 * `metric_data_queries` - (Required) List of up to 10 structures that defines custom load metric in predictive scaling policy
 
 ##### customized_capacity_metric_specification
 
-The following arguments are supported:
+This argument supports the following arguments:
 
 * `metric_data_queries` - (Required) List of up to 10 structures that defines custom capacity metric in predictive scaling policy
 
 ##### metric_data_queries
 
-The following arguments are supported:
+This argument supports the following arguments:
 
 * `expression` - (Optional) Math expression used on the returned metric. You must specify either `expression` or `metric_stat`, but not both.
 * `id` - (Required) Short name for the metric used in predictive scaling policy.
@@ -385,7 +385,7 @@ The following arguments are supported:
 
 ##### metric_stat
 
-The following arguments are supported:
+This argument supports the following arguments:
 
 * `metric` - (Required) Structure that defines the CloudWatch metric to return, including the metric name, namespace, and dimensions.
 * `stat` - (Required) Statistic of the metrics to return.
@@ -393,7 +393,7 @@ The following arguments are supported:
 
 ##### metric
 
-The following arguments are supported:
+This argument supports the following arguments:
 
 * `dimensions` - (Optional) Dimensions of the metric.
 * `metric_name` - (Required) Name of the metric.
@@ -401,14 +401,14 @@ The following arguments are supported:
 
 ##### dimensions
 
-The following arguments are supported:
+This argument supports the following arguments:
 
 * `name` - (Required) Name of the dimension.
 * `value` - (Required) Value of the dimension.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN assigned by AWS to the scaling policy.
 * `name` - Scaling policy's name.
@@ -418,8 +418,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-AutoScaling scaling policy can be imported using the role autoscaling_group_name and name separated by `/`.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AutoScaling scaling policy using the role autoscaling_group_name and name separated by `/`. For example:
 
+```terraform
+import {
+  to = aws_autoscaling_policy.test-policy
+  id = "asg-name/policy-name"
+}
 ```
-$ terraform import aws_autoscaling_policy.test-policy asg-name/policy-name
+
+Using `terraform import`, import AutoScaling scaling policy using the role autoscaling_group_name and name separated by `/`. For example:
+
+```console
+% terraform import aws_autoscaling_policy.test-policy asg-name/policy-name
 ```
diff --git a/website/docs/r/autoscaling_schedule.html.markdown b/website/docs/r/autoscaling_schedule.html.markdown
index f2a28456099..4eca7c270a4 100644
--- a/website/docs/r/autoscaling_schedule.html.markdown
+++ b/website/docs/r/autoscaling_schedule.html.markdown
@@ -54,16 +54,25 @@ The following arguments are optional:
 
 ~> **NOTE:** When `start_time` and `end_time` are specified with `recurrence` , they form the boundaries of when the recurring action will start and stop.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN assigned by AWS to the autoscaling schedule.
 
 ## Import
 
-AutoScaling ScheduledAction can be imported using the `auto-scaling-group-name` and `scheduled-action-name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AutoScaling ScheduledAction using the `auto-scaling-group-name` and `scheduled-action-name`. For example:
 
+```terraform
+import {
+  to = aws_autoscaling_schedule.resource-name
+  id = "auto-scaling-group-name/scheduled-action-name"
+}
 ```
-$ terraform import aws_autoscaling_schedule.resource-name auto-scaling-group-name/scheduled-action-name
+
+Using `terraform import`, import AutoScaling ScheduledAction using the `auto-scaling-group-name` and `scheduled-action-name`. For example:
+
+```console
+% terraform import aws_autoscaling_schedule.resource-name auto-scaling-group-name/scheduled-action-name
 ```
diff --git a/website/docs/r/autoscaling_traffic_source_attachment.html.markdown b/website/docs/r/autoscaling_traffic_source_attachment.html.markdown
index 33a8713d478..c3b2a84578d 100644
--- a/website/docs/r/autoscaling_traffic_source_attachment.html.markdown
+++ b/website/docs/r/autoscaling_traffic_source_attachment.html.markdown
@@ -29,7 +29,7 @@ resource "aws_autoscaling_traffic_source_attachment" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 - `autoscaling_group_name` - (Required) The name of the Auto Scaling group.
 - `traffic_source` - (Required) The unique identifiers of a traffic sources.
@@ -43,6 +43,6 @@ The following arguments are supported:
   `elbv2` if `identifier` is the ARN of an Application Load Balancer, Gateway Load Balancer, or Network Load Balancer target group.
   `vpc-lattice` if `identifier` is the ARN of a VPC Lattice target group.
 
-## Attributes Reference
+## Attribute Reference
 
-No additional attributes are exported.
+This resource exports no additional attributes.
diff --git a/website/docs/r/autoscalingplans_scaling_plan.html.markdown b/website/docs/r/autoscalingplans_scaling_plan.html.markdown
index f63357c4d57..d62ac5d407c 100644
--- a/website/docs/r/autoscalingplans_scaling_plan.html.markdown
+++ b/website/docs/r/autoscalingplans_scaling_plan.html.markdown
@@ -130,7 +130,7 @@ resource "aws_autoscalingplans_scaling_plan" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) Name of the scaling plan. Names cannot contain vertical bars, colons, or forward slashes.
 * `application_source` - (Required) CloudFormation stack or set of tags. You can create one scaling plan per application source.
@@ -208,17 +208,26 @@ The `predefined_scaling_metric_specification` object supports the following:
 * `predefined_scaling_metric_type` - (Required) Metric type. Valid values: `ALBRequestCountPerTarget`, `ASGAverageCPUUtilization`, `ASGAverageNetworkIn`, `ASGAverageNetworkOut`, `DynamoDBReadCapacityUtilization`, `DynamoDBWriteCapacityUtilization`, `ECSServiceAverageCPUUtilization`, `ECSServiceAverageMemoryUtilization`, `EC2SpotFleetRequestAverageCPUUtilization`, `EC2SpotFleetRequestAverageNetworkIn`, `EC2SpotFleetRequestAverageNetworkOut`, `RDSReaderAverageCPUUtilization`, `RDSReaderAverageDatabaseConnections`.
 * `resource_label` - (Optional) Identifies the resource associated with the metric type.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Scaling plan identifier.
 * `scaling_plan_version` - The version number of the scaling plan. This value is always 1.
 
 ## Import
 
-Auto Scaling scaling plans can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Auto Scaling scaling plans using the `name`. For example:
 
+```terraform
+import {
+  to = aws_autoscalingplans_scaling_plan.example
+  id = "MyScale1"
+}
 ```
-$ terraform import aws_autoscalingplans_scaling_plan.example MyScale1
+
+Using `terraform import`, import Auto Scaling scaling plans using the `name`. For example:
+
+```console
+% terraform import aws_autoscalingplans_scaling_plan.example MyScale1
 ```
diff --git a/website/docs/r/backup_framework.html.markdown b/website/docs/r/backup_framework.html.markdown
index adb729d38bd..4141609ebdb 100644
--- a/website/docs/r/backup_framework.html.markdown
+++ b/website/docs/r/backup_framework.html.markdown
@@ -113,7 +113,7 @@ resource "aws_backup_framework" "Example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `control` - (Required) One or more control blocks that make up the framework. Each control in the list has a name, input parameters, and scope. Detailed below.
 * `description` - (Optional) The description of the framework with a maximum of 1,024 characters
@@ -122,7 +122,7 @@ The following arguments are supported:
 
 ### Control Arguments
 
-For **control** the following attributes are supported:
+`control` has the following attributes:
 
 * `input_parameter` - (Optional) One or more input parameter blocks. An example of a control with two parameters is: "backup plan frequency is at least daily and the retention period is at least 1 year". The first parameter is daily. The second parameter is 1 year. Detailed below.
 * `name` - (Required) The name of a control. This name is between 1 and 256 characters.
@@ -130,22 +130,22 @@ For **control** the following attributes are supported:
 
 ### Input Parameter Arguments
 
-For **input_parameter** the following attributes are supported:
+`input_parameter` has the following attributes:
 
 * `name` - (Optional) The name of a parameter, for example, BackupPlanFrequency.
 * `value` - (Optional) The value of parameter, for example, hourly.
 
 ### Scope Arguments
 
-For **scope** the following attributes are supported:
+`scope` has the following attributes:
 
 * `compliance_resource_ids` - (Optional) The ID of the only AWS resource that you want your control scope to contain. Minimum number of 1 item. Maximum number of 100 items.
 * `compliance_resource_types` - (Optional) Describes whether the control scope includes one or more types of resources, such as EFS or RDS.
 * `tags` - (Optional) The tag key-value pair applied to those AWS resources that you want to trigger an evaluation for a rule. A maximum of one key-value pair can be provided.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The ARN of the backup framework.
 * `creation_time` - The date and time that a framework is created, in Unix format and Coordinated Universal Time (UTC).
@@ -164,8 +164,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Backup Framework can be imported using the `id` which corresponds to the name of the Backup Framework, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Backup Framework using the `id` which corresponds to the name of the Backup Framework. For example:
 
+```terraform
+import {
+  to = aws_backup_framework.test
+  id = "<id>"
+}
 ```
-$ terraform import aws_backup_framework.test <id>
+
+Using `terraform import`, import Backup Framework using the `id` which corresponds to the name of the Backup Framework. For example:
+
+```console
+% terraform import aws_backup_framework.test <id>
 ```
diff --git a/website/docs/r/backup_global_settings.html.markdown b/website/docs/r/backup_global_settings.html.markdown
index e6982293c07..545aaadfe03 100644
--- a/website/docs/r/backup_global_settings.html.markdown
+++ b/website/docs/r/backup_global_settings.html.markdown
@@ -22,20 +22,29 @@ resource "aws_backup_global_settings" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `global_settings` - (Required) A list of resources along with the opt-in preferences for the account.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The AWS Account ID.
 
 ## Import
 
-Backup Global Settings can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Backup Global Settings using the `id`. For example:
 
+```terraform
+import {
+  to = aws_backup_global_settings.example
+  id = "123456789012"
+}
 ```
-$ terraform import aws_backup_global_settings.example 123456789012
+
+Using `terraform import`, import Backup Global Settings using the `id`. For example:
+
+```console
+% terraform import aws_backup_global_settings.example 123456789012
 ```
diff --git a/website/docs/r/backup_plan.html.markdown b/website/docs/r/backup_plan.html.markdown
index 0f2bbc887fa..5c733efb8a5 100644
--- a/website/docs/r/backup_plan.html.markdown
+++ b/website/docs/r/backup_plan.html.markdown
@@ -37,7 +37,7 @@ resource "aws_backup_plan" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The display name of a backup plan.
 * `rule` - (Required) A rule object that specifies a scheduled task that is used to back up a selection of resources.
@@ -46,7 +46,7 @@ The following arguments are supported:
 
 ### Rule Arguments
 
-For **rule** the following attributes are supported:
+`rule` supports the following attributes:
 
 * `rule_name` - (Required) An display name for a backup rule.
 * `target_vault_name` - (Required) The name of a logical container where backups are stored.
@@ -60,28 +60,28 @@ For **rule** the following attributes are supported:
 
 ### Lifecycle Arguments
 
-For **lifecycle** the following attributes are supported:
+`lifecycle` supports the following attributes:
 
 * `cold_storage_after` - (Optional) Specifies the number of days after creation that a recovery point is moved to cold storage.
 * `delete_after` - (Optional) Specifies the number of days after creation that a recovery point is deleted. Must be 90 days greater than `cold_storage_after`.
 
 ### Copy Action Arguments
 
-For **copy_action** the following attributes are supported:
+`copy_action` supports the following attributes:
 
 * `lifecycle` - (Optional) The lifecycle defines when a protected resource is copied over to a backup vault and when it expires.  Fields documented above.
 * `destination_vault_arn` - (Required) An Amazon Resource Name (ARN) that uniquely identifies the destination backup vault for the copied backup.
 
 ### Advanced Backup Setting Arguments
 
-For `advanced_backup_setting` the following attibutes are supported:
+`advanced_backup_setting` supports the following arguments:
 
 * `backup_options` - (Required) Specifies the backup option for a selected resource. This option is only available for Windows VSS backup jobs. Set to `{ WindowsVSS = "enabled" }` to enable Windows VSS backup option and create a VSS Windows backup.
 * `resource_type` - (Required) The type of AWS resource to be backed up. For VSS Windows backups, the only supported resource type is Amazon EC2. Valid values: `EC2`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The id of the backup plan.
 * `arn` - The ARN of the backup plan.
@@ -90,8 +90,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Backup Plan can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Backup Plan using the `id`. For example:
 
+```terraform
+import {
+  to = aws_backup_plan.test
+  id = "<id>"
+}
 ```
-$ terraform import aws_backup_plan.test <id>
+
+Using `terraform import`, import Backup Plan using the `id`. For example:
+
+```console
+% terraform import aws_backup_plan.test <id>
 ```
diff --git a/website/docs/r/backup_region_settings.html.markdown b/website/docs/r/backup_region_settings.html.markdown
index e85da6b65b6..732e3ab86e5 100644
--- a/website/docs/r/backup_region_settings.html.markdown
+++ b/website/docs/r/backup_region_settings.html.markdown
@@ -37,21 +37,30 @@ resource "aws_backup_region_settings" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `resource_type_opt_in_preference` - (Required) A map of services along with the opt-in preferences for the Region.
-* `resource_type_management_preference` - (Optional) A map of services along with the management preferences for the Region.
+* `resource_type_management_preference` - (Optional) A map of services along with the management preferences for the Region. For more information, see the [AWS Documentation](https://docs.aws.amazon.com/aws-backup/latest/devguide/API_UpdateRegionSettings.html#API_UpdateRegionSettings_RequestSyntax).
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The AWS region.
 
 ## Import
 
-Backup Region Settings can be imported using the `region`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Backup Region Settings using the `region`. For example:
 
+```terraform
+import {
+  to = aws_backup_region_settings.test
+  id = "us-west-2"
+}
 ```
-$ terraform import aws_backup_region_settings.test us-west-2
+
+Using `terraform import`, import Backup Region Settings using the `region`. For example:
+
+```console
+% terraform import aws_backup_region_settings.test us-west-2
 ```
diff --git a/website/docs/r/backup_report_plan.html.markdown b/website/docs/r/backup_report_plan.html.markdown
index 5a17390dea3..a1189b4b32e 100644
--- a/website/docs/r/backup_report_plan.html.markdown
+++ b/website/docs/r/backup_report_plan.html.markdown
@@ -37,7 +37,7 @@ resource "aws_backup_report_plan" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `description` - (Optional) The description of the report plan with a maximum of 1,024 characters
 * `name` - (Required) The unique name of the report plan. The name must be between 1 and 256 characters, starting with a letter, and consisting of letters, numbers, and underscores.
@@ -47,7 +47,7 @@ The following arguments are supported:
 
 ### Report Delivery Channel Arguments
 
-For **report_delivery_channel** the following attributes are supported:
+`report_delivery_channel` supports the following arguments:
 
 * `formats` - (Optional) A list of the format of your reports: CSV, JSON, or both. If not specified, the default format is CSV.
 * `s3_bucket_name` - (Required) The unique name of the S3 bucket that receives your reports.
@@ -55,7 +55,7 @@ For **report_delivery_channel** the following attributes are supported:
 
 ### Report Setting Arguments
 
-For **report_setting** the following attributes are supported:
+`report_setting` supports the following arguments:
 
 * `accounts` - (Optional) Specifies the list of accounts a report covers.
 * `framework_arns` - (Optional) Specifies the Amazon Resource Names (ARNs) of the frameworks a report covers.
@@ -64,9 +64,9 @@ For **report_setting** the following attributes are supported:
 * `regions` - (Optional) Specifies the list of regions a report covers.
 * `report_template` - (Required) Identifies the report template for the report. Reports are built using a report template. The report templates are: `RESOURCE_COMPLIANCE_REPORT` | `CONTROL_COMPLIANCE_REPORT` | `BACKUP_JOB_REPORT` | `COPY_JOB_REPORT` | `RESTORE_JOB_REPORT`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The ARN of the backup report plan.
 * `creation_time` - The date and time that a report plan is created, in Unix format and Coordinated Universal Time (UTC).
@@ -76,8 +76,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Backup Report Plan can be imported using the `id` which corresponds to the name of the Backup Report Plan, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Backup Report Plan using the `id` which corresponds to the name of the Backup Report Plan. For example:
 
+```terraform
+import {
+  to = aws_backup_report_plan.test
+  id = "<id>"
+}
 ```
-$ terraform import aws_backup_report_plan.test <id>
+
+Using `terraform import`, import Backup Report Plan using the `id` which corresponds to the name of the Backup Report Plan. For example:
+
+```console
+% terraform import aws_backup_report_plan.test <id>
 ```
diff --git a/website/docs/r/backup_selection.html.markdown b/website/docs/r/backup_selection.html.markdown
index 653ebcd4b9b..a7e60349260 100644
--- a/website/docs/r/backup_selection.html.markdown
+++ b/website/docs/r/backup_selection.html.markdown
@@ -128,7 +128,7 @@ resource "aws_backup_selection" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The display name of a resource selection document.
 * `plan_id` - (Required) The backup plan ID to be associated with the selection of resources.
@@ -144,16 +144,25 @@ Tag conditions (`selection_tag`) support the following:
 * `key` - (Required) The key in a key-value pair.
 * `value` - (Required) The value in a key-value pair.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Backup Selection identifier
 
 ## Import
 
-Backup selection can be imported using the role plan_id and id separated by `|`.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Backup selection using the role plan_id and id separated by `|`. For example:
 
+```terraform
+import {
+  to = aws_backup_selection.example
+  id = "plan-id|selection-id"
+}
 ```
-$ terraform import aws_backup_selection.example plan-id|selection-id
+
+Using `terraform import`, import Backup selection using the role plan_id and id separated by `|`. For example:
+
+```console
+% terraform import aws_backup_selection.example plan-id|selection-id
 ```
diff --git a/website/docs/r/backup_vault.html.markdown b/website/docs/r/backup_vault.html.markdown
index fe0684b2710..8fe8ae71b98 100644
--- a/website/docs/r/backup_vault.html.markdown
+++ b/website/docs/r/backup_vault.html.markdown
@@ -21,16 +21,16 @@ resource "aws_backup_vault" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `force_destroy` - (Optional, Default: `false`) A boolean that indicates that all recovery points stored in the vault are deleted so that the vault can be destroyed without error.
 * `kms_key_arn` - (Optional) The server-side encryption key that is used to protect your backups.
 * `name` - (Required) Name of the backup vault to create.
 * `tags` - (Optional) Metadata that you can assign to help organize the resources that you create. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The name of the vault.
 * `arn` - The ARN of the vault.
@@ -45,8 +45,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Backup vault can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Backup vault using the `name`. For example:
 
+```terraform
+import {
+  to = aws_backup_vault.test-vault
+  id = "TestVault"
+}
 ```
-$ terraform import aws_backup_vault.test-vault TestVault
+
+Using `terraform import`, import Backup vault using the `name`. For example:
+
+```console
+% terraform import aws_backup_vault.test-vault TestVault
 ```
diff --git a/website/docs/r/backup_vault_lock_configuration.html.markdown b/website/docs/r/backup_vault_lock_configuration.html.markdown
index 805ec5144f6..091dfed4d74 100644
--- a/website/docs/r/backup_vault_lock_configuration.html.markdown
+++ b/website/docs/r/backup_vault_lock_configuration.html.markdown
@@ -23,24 +23,33 @@ resource "aws_backup_vault_lock_configuration" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `backup_vault_name` - (Required) Name of the backup vault to add a lock configuration for.
 * `changeable_for_days` - (Optional) The number of days before the lock date. If omitted creates a vault lock in `governance` mode, otherwise it will create a vault lock in `compliance` mode.
 * `max_retention_days` - (Optional) The maximum retention period that the vault retains its recovery points.
 * `min_retention_days` - (Optional) The minimum retention period that the vault retains its recovery points.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `backup_vault_name` - The name of the vault.
 * `backup_vault_arn` - The ARN of the vault.
 
 ## Import
 
-Backup vault lock configuration can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Backup vault lock configuration using the `name`. For example:
 
+```terraform
+import {
+  to = aws_backup_vault_lock_configuration.test
+  id = "TestVault"
+}
 ```
-$ terraform import aws_backup_vault_lock_configuration.test TestVault
+
+Using `terraform import`, import Backup vault lock configuration using the `name`. For example:
+
+```console
+% terraform import aws_backup_vault_lock_configuration.test TestVault
 ```
diff --git a/website/docs/r/backup_vault_notifications.html.markdown b/website/docs/r/backup_vault_notifications.html.markdown
index cdfa7fe790c..ff3d9e3e476 100644
--- a/website/docs/r/backup_vault_notifications.html.markdown
+++ b/website/docs/r/backup_vault_notifications.html.markdown
@@ -54,23 +54,32 @@ resource "aws_backup_vault_notifications" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `backup_vault_name` - (Required) Name of the backup vault to add notifications for.
 * `sns_topic_arn` - (Required) The Amazon Resource Name (ARN) that specifies the topic for a backup vault’s events
 * `backup_vault_events` - (Required) An array of events that indicate the status of jobs to back up resources to the backup vault.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The name of the vault.
 * `backup_vault_arn` - The ARN of the vault.
 
 ## Import
 
-Backup vault notifications can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Backup vault notifications using the `name`. For example:
 
+```terraform
+import {
+  to = aws_backup_vault_notifications.test
+  id = "TestVault"
+}
 ```
-$ terraform import aws_backup_vault_notifications.test TestVault
+
+Using `terraform import`, import Backup vault notifications using the `name`. For example:
+
+```console
+% terraform import aws_backup_vault_notifications.test TestVault
 ```
diff --git a/website/docs/r/backup_vault_policy.html.markdown b/website/docs/r/backup_vault_policy.html.markdown
index a6ac452c2ab..21d6ab9db55 100644
--- a/website/docs/r/backup_vault_policy.html.markdown
+++ b/website/docs/r/backup_vault_policy.html.markdown
@@ -49,22 +49,31 @@ resource "aws_backup_vault_policy" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `backup_vault_name` - (Required) Name of the backup vault to add policy for.
 * `policy` - (Required) The backup vault access policy document in JSON format.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The name of the vault.
 * `backup_vault_arn` - The ARN of the vault.
 
 ## Import
 
-Backup vault policy can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Backup vault policy using the `name`. For example:
 
+```terraform
+import {
+  to = aws_backup_vault_policy.test
+  id = "TestVault"
+}
 ```
-$ terraform import aws_backup_vault_policy.test TestVault
+
+Using `terraform import`, import Backup vault policy using the `name`. For example:
+
+```console
+% terraform import aws_backup_vault_policy.test TestVault
 ```
diff --git a/website/docs/r/batch_compute_environment.html.markdown b/website/docs/r/batch_compute_environment.html.markdown
index e760f901edc..263d887394d 100644
--- a/website/docs/r/batch_compute_environment.html.markdown
+++ b/website/docs/r/batch_compute_environment.html.markdown
@@ -92,6 +92,11 @@ resource "aws_subnet" "sample" {
   cidr_block = "10.1.1.0/24"
 }
 
+resource "aws_placement_group" "sample" {
+  name     = "sample"
+  strategy = "cluster"
+}
+
 resource "aws_batch_compute_environment" "sample" {
   compute_environment_name = "sample"
 
@@ -105,6 +110,8 @@ resource "aws_batch_compute_environment" "sample" {
     max_vcpus = 16
     min_vcpus = 0
 
+    placement_group = aws_placement_group.sample.name
+
     security_group_ids = [
       aws_security_group.sample.id,
     ]
@@ -172,6 +179,7 @@ resource "aws_batch_compute_environment" "sample" {
 * `launch_template` - (Optional) The launch template to use for your compute resources. See details below. This parameter isn't applicable to jobs running on Fargate resources, and shouldn't be specified.
 * `max_vcpus` - (Required) The maximum number of EC2 vCPUs that an environment can reach.
 * `min_vcpus` - (Optional) The minimum number of EC2 vCPUs that an environment should maintain. For `EC2` or `SPOT` compute environments, if the parameter is not explicitly defined, a `0` default value will be set. This parameter isn't applicable to jobs running on Fargate resources, and shouldn't be specified.
+* `placement_group` - (Optional) The Amazon EC2 placement group to associate with your compute resources.
 * `security_group_ids` - (Optional) A list of EC2 security group that are associated with instances launched in the compute environment. This parameter is required for Fargate compute environments.
 * `spot_iam_fleet_role` - (Optional) The Amazon Resource Name (ARN) of the Amazon EC2 Spot Fleet IAM role applied to a SPOT compute environment. This parameter is required for SPOT compute environments. This parameter isn't applicable to jobs running on Fargate resources, and shouldn't be specified.
 * `subnets` - (Required) A list of VPC subnets into which the compute resources are launched.
@@ -200,9 +208,9 @@ resource "aws_batch_compute_environment" "sample" {
 * `eks_cluster_arn` - (Required) The Amazon Resource Name (ARN) of the Amazon EKS cluster.
 * `kubernetes_namespace` - (Required) The namespace of the Amazon EKS cluster. AWS Batch manages pods in this namespace.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The Amazon Resource Name (ARN) of the compute environment.
 * `ecs_cluster_arn` - The Amazon Resource Name (ARN) of the underlying Amazon ECS cluster used by the compute environment.
@@ -212,10 +220,19 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-AWS Batch compute can be imported using the `compute_environment_name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AWS Batch compute using the `compute_environment_name`. For example:
 
+```terraform
+import {
+  to = aws_batch_compute_environment.sample
+  id = "sample"
+}
 ```
-$ terraform import aws_batch_compute_environment.sample sample
+
+Using `terraform import`, import AWS Batch compute using the `compute_environment_name`. For example:
+
+```console
+% terraform import aws_batch_compute_environment.sample sample
 ```
 
 [1]: http://docs.aws.amazon.com/batch/latest/userguide/what-is-batch.html
diff --git a/website/docs/r/batch_job_definition.html.markdown b/website/docs/r/batch_job_definition.html.markdown
index a90fae5609c..937dc938e8d 100644
--- a/website/docs/r/batch_job_definition.html.markdown
+++ b/website/docs/r/batch_job_definition.html.markdown
@@ -158,9 +158,9 @@ The following arguments are optional:
 
 * `attempt_duration_seconds` - (Optional) The time duration in seconds after which AWS Batch terminates your jobs if they have not finished. The minimum value for the timeout is `60` seconds.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The Amazon Resource Name of the job definition.
 * `revision` - The revision of the job definition.
@@ -168,8 +168,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Batch Job Definition can be imported using the `arn`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Batch Job Definition using the `arn`. For example:
 
+```terraform
+import {
+  to = aws_batch_job_definition.test
+  id = "arn:aws:batch:us-east-1:123456789012:job-definition/sample"
+}
 ```
-$ terraform import aws_batch_job_definition.test arn:aws:batch:us-east-1:123456789012:job-definition/sample
+
+Using `terraform import`, import Batch Job Definition using the `arn`. For example:
+
+```console
+% terraform import aws_batch_job_definition.test arn:aws:batch:us-east-1:123456789012:job-definition/sample
 ```
diff --git a/website/docs/r/batch_job_queue.html.markdown b/website/docs/r/batch_job_queue.html.markdown
index e6567d320a0..af63e39fe28 100644
--- a/website/docs/r/batch_job_queue.html.markdown
+++ b/website/docs/r/batch_job_queue.html.markdown
@@ -59,29 +59,45 @@ resource "aws_batch_job_queue" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) Specifies the name of the job queue.
-* `compute_environments` - (Required) Specifies the set of compute environments
-    mapped to a job queue and their order.  The position of the compute environments
-    in the list will dictate the order.
+* `compute_environments` - (Required) List of compute environment ARNs mapped to a job queue.
+  The position of the compute environments in the list will dictate the order.
 * `priority` - (Required) The priority of the job queue. Job queues with a higher priority
     are evaluated first when associated with the same compute environment.
 * `scheduling_policy_arn` - (Optional) The ARN of the fair share scheduling policy. If this parameter is specified, the job queue uses a fair share scheduling policy. If this parameter isn't specified, the job queue uses a first in, first out (FIFO) scheduling policy. After a job queue is created, you can replace but can't remove the fair share scheduling policy.
 * `state` - (Required) The state of the job queue. Must be one of: `ENABLED` or `DISABLED`
 * `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The Amazon Resource Name of the job queue.
 * `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
 
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `10m`)
+- `update` - (Default `10m`)
+- `delete` - (Default `10m`)
+
 ## Import
 
-Batch Job Queue can be imported using the `arn`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Batch Job Queue using the `arn`. For example:
 
+```terraform
+import {
+  to = aws_batch_job_queue.test_queue
+  id = "arn:aws:batch:us-east-1:123456789012:job-queue/sample"
+}
 ```
-$ terraform import aws_batch_job_queue.test_queue arn:aws:batch:us-east-1:123456789012:job-queue/sample
+
+Using `terraform import`, import Batch Job Queue using the `arn`. For example:
+
+```console
+% terraform import aws_batch_job_queue.test_queue arn:aws:batch:us-east-1:123456789012:job-queue/sample
 ```
diff --git a/website/docs/r/batch_scheduling_policy.html.markdown b/website/docs/r/batch_scheduling_policy.html.markdown
index ba750da5045..f6159a1c597 100644
--- a/website/docs/r/batch_scheduling_policy.html.markdown
+++ b/website/docs/r/batch_scheduling_policy.html.markdown
@@ -39,7 +39,7 @@ resource "aws_batch_scheduling_policy" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `fairshare_policy` - (Optional) A fairshare policy block specifies the `compute_reservation`, `share_delay_seconds`, and `share_distribution` of the scheduling policy. The `fairshare_policy` block is documented below.
 * `name` - (Required) Specifies the name of the scheduling policy.
@@ -56,17 +56,26 @@ A `share_distribution` block supports the following arguments:
 * `share_identifier` - (Required) A fair share identifier or fair share identifier prefix. For more information, see [ShareAttributes](https://docs.aws.amazon.com/batch/latest/APIReference/API_ShareAttributes.html).
 * `weight_factor` - (Optional) The weight factor for the fair share identifier. For more information, see [ShareAttributes](https://docs.aws.amazon.com/batch/latest/APIReference/API_ShareAttributes.html).
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The Amazon Resource Name of the scheduling policy.
 * `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
 
 ## Import
 
-Batch Scheduling Policy can be imported using the `arn`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Batch Scheduling Policy using the `arn`. For example:
 
+```terraform
+import {
+  to = aws_batch_scheduling_policy.test_policy
+  id = "arn:aws:batch:us-east-1:123456789012:scheduling-policy/sample"
+}
 ```
-$ terraform import aws_batch_scheduling_policy.test_policy arn:aws:batch:us-east-1:123456789012:scheduling-policy/sample
+
+Using `terraform import`, import Batch Scheduling Policy using the `arn`. For example:
+
+```console
+% terraform import aws_batch_scheduling_policy.test_policy arn:aws:batch:us-east-1:123456789012:scheduling-policy/sample
 ```
diff --git a/website/docs/r/budgets_budget.html.markdown b/website/docs/r/budgets_budget.html.markdown
index 4eb8da49de4..22562a4d3e6 100644
--- a/website/docs/r/budgets_budget.html.markdown
+++ b/website/docs/r/budgets_budget.html.markdown
@@ -171,7 +171,7 @@ resource "aws_budgets_budget" "cost" {
 For more detailed documentation about each argument, refer to the [AWS official
 documentation](http://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/data-type-budget.html).
 
-The following arguments are supported:
+This argument supports the following arguments:
 
 * `account_id` - (Optional) The ID of the target account for budget. Will use current user's account_id by default if omitted.
 * `auto_adjust_data` - (Optional) Object containing [AutoAdjustData] which determines the budget amount for an auto-adjusting budget.
@@ -188,9 +188,9 @@ The following arguments are supported:
 * `notification` - (Optional) Object containing [Budget Notifications](#budget-notification). Can be used multiple times to define more than one budget notification.
 * `planned_limit` - (Optional) Object containing [Planned Budget Limits](#planned-budget-limits). Can be used multiple times to plan more than one budget limit. See [PlannedBudgetLimits](https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_budgets_Budget.html#awscostmanagement-Type-budgets_Budget-PlannedBudgetLimits) documentation.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - id of resource.
 * `arn` - The ARN of the budget.
@@ -268,6 +268,17 @@ Valid keys for `planned_limit` parameter.
 
 ## Import
 
-Budgets can be imported using `AccountID:BudgetName`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import budgets using `AccountID:ActionID:BudgetName`. For example:
 
-`$ terraform import aws_budgets_budget.myBudget 123456789012:myBudget`
+```terraform
+import {
+  to = aws_budgets_budget.myBudget
+  id = "123456789012:myBudget"
+}
+```
+
+Using `terraform import`, import budgets using `AccountID:ActionID:BudgetName`. For example:
+
+```console
+% terraform import aws_budgets_budget.myBudget 123456789012:myBudget
+```
diff --git a/website/docs/r/budgets_budget_action.html.markdown b/website/docs/r/budgets_budget_action.html.markdown
index e4134c41c6b..93c07598a42 100644
--- a/website/docs/r/budgets_budget_action.html.markdown
+++ b/website/docs/r/budgets_budget_action.html.markdown
@@ -84,7 +84,7 @@ resource "aws_budgets_budget" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `account_id` - (Optional) The ID of the target account for budget. Will use current user's account_id by default if omitted.
 * `budget_name` - (Required) The name of a budget.
@@ -130,9 +130,9 @@ The following arguments are supported:
 * `instance_ids` - (Required) The EC2 and RDS instance IDs.
 * `region` - (Required) The Region to run the SSM document.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `action_id` - The id of the budget action.
 * `id` - ID of resource.
@@ -148,6 +148,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Budgets can be imported using `AccountID:ActionID:BudgetName`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import budget actions using `AccountID:ActionID:BudgetName`. For example:
 
-`$ terraform import aws_budgets_budget_action.myBudget 123456789012:some-id:myBudget`
+```terraform
+import {
+  to = aws_budgets_budget_action.myBudget
+  id = "123456789012:some-id:myBudget"
+}
+```
+
+Using `terraform import`, import budget actions using `AccountID:ActionID:BudgetName`. For example:
+
+```console
+% terraform import aws_budgets_budget_action.myBudget 123456789012:some-id:myBudget
+```
diff --git a/website/docs/r/ce_anomaly_monitor.html.markdown b/website/docs/r/ce_anomaly_monitor.html.markdown
index ce93a6f8d66..2dfad78c7cc 100644
--- a/website/docs/r/ce_anomaly_monitor.html.markdown
+++ b/website/docs/r/ce_anomaly_monitor.html.markdown
@@ -59,9 +59,9 @@ The following arguments are required:
 * `monitor_specification` - (Required, if `monitor_type` is `CUSTOM`) A valid JSON representation for the [Expression](https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_Expression.html) object.
 * `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the anomaly monitor.
 * `id` - Unique ID of the anomaly monitor. Same as `arn`.
@@ -69,8 +69,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_ce_anomaly_monitor` can be imported using the `id`, e.g.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_ce_anomaly_monitor` using the `id`. For example:
 
+```terraform
+import {
+  to = aws_ce_anomaly_monitor.example
+  id = "costAnomalyMonitorARN"
+}
 ```
-$ terraform import aws_ce_anomaly_monitor.example costAnomalyMonitorARN
+
+Using `terraform import`, import `aws_ce_anomaly_monitor` using the `id`. For example:
+
+```console
+% terraform import aws_ce_anomaly_monitor.example costAnomalyMonitorARN
 ```
diff --git a/website/docs/r/ce_anomaly_subscription.html.markdown b/website/docs/r/ce_anomaly_subscription.html.markdown
index 20483c64b6e..11c39be9ffe 100644
--- a/website/docs/r/ce_anomaly_subscription.html.markdown
+++ b/website/docs/r/ce_anomaly_subscription.html.markdown
@@ -37,7 +37,9 @@ resource "aws_ce_anomaly_subscription" "test" {
 }
 ```
 
-### Threshold Expression
+### Threshold Expression Example
+
+#### For a Specific Dimension
 
 ```terraform
 resource "aws_ce_anomaly_subscription" "test" {
@@ -63,6 +65,41 @@ resource "aws_ce_anomaly_subscription" "test" {
 }
 ```
 
+#### Using an `and` Expression
+
+```terraform
+resource "aws_ce_anomaly_subscription" "test" {
+  name      = "AWSServiceMonitor"
+  frequency = "DAILY"
+
+  monitor_arn_list = [
+    aws_ce_anomaly_monitor.test.arn,
+  ]
+
+  subscriber {
+    type    = "EMAIL"
+    address = "abc@example.com"
+  }
+
+  threshold_expression {
+    and {
+      dimension {
+        key           = "ANOMALY_TOTAL_IMPACT_ABSOLUTE"
+        match_options = ["GREATER_THAN_OR_EQUAL"]
+        values        = ["100"]
+      }
+    }
+    and {
+      dimension {
+        key           = "ANOMALY_TOTAL_IMPACT_PERCENTAGE"
+        match_options = ["GREATER_THAN_OR_EQUAL"]
+        values        = ["50"]
+      }
+    }
+  }
+}
+```
+
 ### SNS Example
 
 ```terraform
@@ -203,9 +240,9 @@ The following arguments are required:
 * `match_options` - (Optional) Match options that you can use to filter your results. MatchOptions is only applicable for actions related to cost category. The default values for MatchOptions is `EQUALS` and `CASE_SENSITIVE`. Valid values are: `EQUALS`,  `ABSENT`, `STARTS_WITH`, `ENDS_WITH`, `CONTAINS`, `CASE_SENSITIVE`, `CASE_INSENSITIVE`.
 * `values` - (Optional) Specific value of the Cost Category.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the anomaly subscription.
 * `id` - Unique ID of the anomaly subscription. Same as `arn`.
@@ -213,8 +250,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_ce_anomaly_subscription` can be imported using the `id`, e.g.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_ce_anomaly_subscription` using the `id`. For example:
 
+```terraform
+import {
+  to = aws_ce_anomaly_subscription.example
+  id = "AnomalySubscriptionARN"
+}
 ```
-$ terraform import aws_ce_anomaly_subscription.example AnomalySubscriptionARN
+
+Using `terraform import`, import `aws_ce_anomaly_subscription` using the `id`. For example:
+
+```console
+% terraform import aws_ce_anomaly_subscription.example AnomalySubscriptionARN
 ```
diff --git a/website/docs/r/ce_cost_allocation_tag.html.markdown b/website/docs/r/ce_cost_allocation_tag.html.markdown
index b0ea53feb3f..e2044d001d4 100644
--- a/website/docs/r/ce_cost_allocation_tag.html.markdown
+++ b/website/docs/r/ce_cost_allocation_tag.html.markdown
@@ -26,17 +26,26 @@ The following arguments are required:
 * `tag_key` - (Required) The key for the cost allocation tag.
 * `status` - (Required) The status of a cost allocation tag. Valid values are `Active` and `Inactive`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The key for the cost allocation tag.
 * `type` - The type of cost allocation tag.
 
 ## Import
 
-`aws_ce_cost_allocation_tag` can be imported using the `id`, e.g.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_ce_cost_allocation_tag` using the `id`. For example:
 
+```terraform
+import {
+  to = aws_ce_cost_allocation_tag.example
+  id = "key"
+}
 ```
-$ terraform import aws_ce_cost_allocation_tag.example key
+
+Using `terraform import`, import `aws_ce_cost_allocation_tag` using the `id`. For example:
+
+```console
+% terraform import aws_ce_cost_allocation_tag.example key
 ```
diff --git a/website/docs/r/ce_cost_category.html.markdown b/website/docs/r/ce_cost_category.html.markdown
index 7f7d3a9f667..8e17e703bb2 100644
--- a/website/docs/r/ce_cost_category.html.markdown
+++ b/website/docs/r/ce_cost_category.html.markdown
@@ -115,9 +115,9 @@ The following arguments are optional:
 * `type` - (Optional) Parameter type.
 * `values` - (Optional) Parameter values.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the cost category.
 * `effective_end` - Effective end data of your Cost Category.
@@ -126,8 +126,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_ce_cost_category` can be imported using the id, e.g.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_ce_cost_category` using the id. For example:
 
+```terraform
+import {
+  to = aws_ce_cost_category.example
+  id = "costCategoryARN"
+}
 ```
-$ terraform import aws_ce_cost_category.example costCategoryARN
+
+Using `terraform import`, import `aws_ce_cost_category` using the id. For example:
+
+```console
+% terraform import aws_ce_cost_category.example costCategoryARN
 ```
diff --git a/website/docs/r/chime_voice_connector.html.markdown b/website/docs/r/chime_voice_connector.html.markdown
index 42142b0e43a..22645d4fcf8 100644
--- a/website/docs/r/chime_voice_connector.html.markdown
+++ b/website/docs/r/chime_voice_connector.html.markdown
@@ -32,9 +32,9 @@ The following arguments are optional:
 * `aws_region` - (Optional) The AWS Region in which the Amazon Chime Voice Connector is created. Default value: `us-east-1`
 * `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN (Amazon Resource Name) of the Amazon Chime Voice Connector.
 * `outbound_host_name` - The outbound host name for the Amazon Chime Voice Connector.
@@ -42,8 +42,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Configuration Recorder can be imported using the name, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Configuration Recorder using the name. For example:
 
+```terraform
+import {
+  to = aws_chime_voice_connector.test
+  id = "example"
+}
 ```
-$ terraform import aws_chime_voice_connector.test example
+
+Using `terraform import`, import Configuration Recorder using the name. For example:
+
+```console
+% terraform import aws_chime_voice_connector.test example
 ```
diff --git a/website/docs/r/chime_voice_connector_group.html.markdown b/website/docs/r/chime_voice_connector_group.html.markdown
index 7c2da8d6cee..2840810212c 100644
--- a/website/docs/r/chime_voice_connector_group.html.markdown
+++ b/website/docs/r/chime_voice_connector_group.html.markdown
@@ -44,7 +44,7 @@ resource "aws_chime_voice_connector_group" "group" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The name of the Amazon Chime Voice Connector group.
 * `connector` - (Optional) The Amazon Chime Voice Connectors to route inbound calls to.
@@ -56,16 +56,25 @@ For Amazon Chime Voice Connector groups, the Amazon Chime Voice Connectors to wh
 * `voice_connector_id` - (Required) The Amazon Chime Voice Connector ID.
 * `priority` - (Required) The priority associated with the Amazon Chime Voice Connector, with 1 being the highest priority. Higher priority Amazon Chime Voice Connectors are attempted first.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Amazon Chime Voice Connector group ID.
 
 ## Import
 
-Configuration Recorder can be imported using the name, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Configuration Recorder using the name. For example:
 
+```terraform
+import {
+  to = aws_chime_voice_connector_group.default
+  id = "example"
+}
 ```
-$ terraform import aws_chime_voice_connector_group.default example
+
+Using `terraform import`, import Configuration Recorder using the name. For example:
+
+```console
+% terraform import aws_chime_voice_connector_group.default example
 ```
diff --git a/website/docs/r/chime_voice_connector_logging.html.markdown b/website/docs/r/chime_voice_connector_logging.html.markdown
index 2e68d6c2e19..1ed23ff907e 100644
--- a/website/docs/r/chime_voice_connector_logging.html.markdown
+++ b/website/docs/r/chime_voice_connector_logging.html.markdown
@@ -27,22 +27,31 @@ resource "aws_chime_voice_connector_logging" "default" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `voice_connector_id` - (Required) The Amazon Chime Voice Connector ID.
 * `enable_sip_logs` - (Optional) When true, enables SIP message logs for sending to Amazon CloudWatch Logs.
 * `enable_media_metric_logs` - (Optional) When true, enables logging of detailed media metrics for Voice Connectors to Amazon CloudWatch logs.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The Amazon Chime Voice Connector ID.
 
 ## Import
 
-Chime Voice Connector Logging can be imported using the `voice_connector_id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Chime Voice Connector Logging using the `voice_connector_id`. For example:
 
+```terraform
+import {
+  to = aws_chime_voice_connector_logging.default
+  id = "abcdef1ghij2klmno3pqr4"
+}
 ```
-$ terraform import aws_chime_voice_connector_logging.default abcdef1ghij2klmno3pqr4
+
+Using `terraform import`, import Chime Voice Connector Logging using the `voice_connector_id`. For example:
+
+```console
+% terraform import aws_chime_voice_connector_logging.default abcdef1ghij2klmno3pqr4
 ```
diff --git a/website/docs/r/chime_voice_connector_origination.html.markdown b/website/docs/r/chime_voice_connector_origination.html.markdown
index 75d4c7dd6a0..eb423a61cbe 100644
--- a/website/docs/r/chime_voice_connector_origination.html.markdown
+++ b/website/docs/r/chime_voice_connector_origination.html.markdown
@@ -42,7 +42,7 @@ resource "aws_chime_voice_connector_origination" "default" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `voice_connector_id` - (Required) The Amazon Chime Voice Connector ID.
 * `route` - (Required) Set of call distribution properties defined for your SIP hosts. See [route](#route) below for more details. Minimum of 1. Maximum of 20.
@@ -58,16 +58,25 @@ Origination routes define call distribution properties for your SIP hosts to rec
 * `protocol` - (Required) The protocol to use for the origination route. Encryption-enabled Amazon Chime Voice Connectors use TCP protocol by default.
 * `weight` - (Required) The weight associated with the host. If hosts are equal in priority, calls are redistributed among them based on their relative weight.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The Amazon Chime Voice Connector ID.
 
 ## Import
 
-Chime Voice Connector Origination can be imported using the `voice_connector_id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Chime Voice Connector Origination using the `voice_connector_id`. For example:
 
+```terraform
+import {
+  to = aws_chime_voice_connector_origination.default
+  id = "abcdef1ghij2klmno3pqr4"
+}
 ```
-$ terraform import aws_chime_voice_connector_origination.default abcdef1ghij2klmno3pqr4
+
+Using `terraform import`, import Chime Voice Connector Origination using the `voice_connector_id`. For example:
+
+```console
+% terraform import aws_chime_voice_connector_origination.default abcdef1ghij2klmno3pqr4
 ```
diff --git a/website/docs/r/chime_voice_connector_streaming.html.markdown b/website/docs/r/chime_voice_connector_streaming.html.markdown
index 6227fb2cbde..ac88fc0888c 100644
--- a/website/docs/r/chime_voice_connector_streaming.html.markdown
+++ b/website/docs/r/chime_voice_connector_streaming.html.markdown
@@ -90,7 +90,7 @@ resource "aws_kinesis_stream" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `voice_connector_id` - (Required) The Amazon Chime Voice Connector ID.
 * `data_retention`  - (Required) The retention period, in hours, for the Amazon Kinesis data.
@@ -103,16 +103,25 @@ The following arguments are supported:
 * `disabled` - (Optional) When `true`, the media insights configuration is not enabled. Defaults to `false`.
 * `configuration_arn` - (Optional) The media insights configuration that will be invoked by the Voice Connector.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The Amazon Chime Voice Connector ID.
 
 ## Import
 
-Chime Voice Connector Streaming can be imported using the `voice_connector_id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Chime Voice Connector Streaming using the `voice_connector_id`. For example:
 
+```terraform
+import {
+  to = aws_chime_voice_connector_streaming.default
+  id = "abcdef1ghij2klmno3pqr4"
+}
 ```
-$ terraform import aws_chime_voice_connector_streaming.default abcdef1ghij2klmno3pqr4
+
+Using `terraform import`, import Chime Voice Connector Streaming using the `voice_connector_id`. For example:
+
+```console
+% terraform import aws_chime_voice_connector_streaming.default abcdef1ghij2klmno3pqr4
 ```
diff --git a/website/docs/r/chime_voice_connector_termination.html.markdown b/website/docs/r/chime_voice_connector_termination.html.markdown
index c7f6e1c5e26..56111cdafd1 100644
--- a/website/docs/r/chime_voice_connector_termination.html.markdown
+++ b/website/docs/r/chime_voice_connector_termination.html.markdown
@@ -29,7 +29,7 @@ resource "aws_chime_voice_connector_termination" "default" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `voice_connector_id` - (Required) The Amazon Chime Voice Connector ID.
 * `cidr_allow_list` - (Required) The IP addresses allowed to make calls, in CIDR format.
@@ -38,16 +38,25 @@ The following arguments are supported:
 * `default_phone_number` - (Optional) The default caller ID phone number.
 * `cps_limit` - (Optional) The limit on calls per second. Max value based on account service quota. Default value of `1`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The Amazon Chime Voice Connector ID.
 
 ## Import
 
-Chime Voice Connector Termination can be imported using the `voice_connector_id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Chime Voice Connector Termination using the `voice_connector_id`. For example:
 
+```terraform
+import {
+  to = aws_chime_voice_connector_termination.default
+  id = "abcdef1ghij2klmno3pqr4"
+}
 ```
-$ terraform import aws_chime_voice_connector_termination.default abcdef1ghij2klmno3pqr4
+
+Using `terraform import`, import Chime Voice Connector Termination using the `voice_connector_id`. For example:
+
+```console
+% terraform import aws_chime_voice_connector_termination.default abcdef1ghij2klmno3pqr4
 ```
diff --git a/website/docs/r/chime_voice_connector_termination_credentials.html.markdown b/website/docs/r/chime_voice_connector_termination_credentials.html.markdown
index 9a8c578b014..289bdf63518 100644
--- a/website/docs/r/chime_voice_connector_termination_credentials.html.markdown
+++ b/website/docs/r/chime_voice_connector_termination_credentials.html.markdown
@@ -42,7 +42,7 @@ resource "aws_chime_voice_connector_termination_credentials" "default" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `voice_connector_id` - (Required) Amazon Chime Voice Connector ID.
 * `credentials` - (Required) List of termination SIP credentials.
@@ -54,16 +54,25 @@ The SIP credentials used to authenticate requests to your Amazon Chime Voice Con
 * `username` - (Required) RFC2617 compliant username associated with the SIP credentials.
 * `password` - (Required) RFC2617 compliant password associated with the SIP credentials.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Amazon Chime Voice Connector ID.
 
 ## Import
 
-Chime Voice Connector Termination Credentials can be imported using the `voice_connector_id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Chime Voice Connector Termination Credentials using the `voice_connector_id`. For example:
 
+```terraform
+import {
+  to = aws_chime_voice_connector_termination_credentials.default
+  id = "abcdef1ghij2klmno3pqr4"
+}
 ```
-$ terraform import aws_chime_voice_connector_termination_credentials.default abcdef1ghij2klmno3pqr4
+
+Using `terraform import`, import Chime Voice Connector Termination Credentials using the `voice_connector_id`. For example:
+
+```console
+% terraform import aws_chime_voice_connector_termination_credentials.default abcdef1ghij2klmno3pqr4
 ```
diff --git a/website/docs/r/chimesdkmediapipelines_media_insights_pipeline_configuration.html.markdown b/website/docs/r/chimesdkmediapipelines_media_insights_pipeline_configuration.html.markdown
index 1baaa2e1aee..33c708363d2 100644
--- a/website/docs/r/chimesdkmediapipelines_media_insights_pipeline_configuration.html.markdown
+++ b/website/docs/r/chimesdkmediapipelines_media_insights_pipeline_configuration.html.markdown
@@ -268,7 +268,7 @@ resource "aws_chimesdkmediapipelines_media_insights_pipeline_configuration" "my_
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) Configuration name.
 * `resource_access_role_arn` - (Required) ARN of IAM Role used by service to invoke processors and sinks specified by configuration elements.
@@ -340,9 +340,9 @@ The following arguments are supported:
         * `time_period` - (Optional) Analysis interval.
 * `disabled` - (Optional) Disables real time alert rules.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the Media Insights Pipeline Configuration.
 * `id` - Unique ID of the Media Insights Pipeline Configuration.
@@ -357,8 +357,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Chime SDK Media Pipelines Media Insights Pipeline Configuration can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Chime SDK Media Pipelines Media Insights Pipeline Configuration using the `id`. For example:
 
+```terraform
+import {
+  to = aws_chimesdkmediapipelines_media_insights_pipeline_configuration.example
+  id = "abcdef123456"
+}
 ```
-$ terraform import aws_chimesdkmediapipelines_media_insights_pipeline_configuration.example abcdef123456
+
+Using `terraform import`, import Chime SDK Media Pipelines Media Insights Pipeline Configuration using the `id`. For example:
+
+```console
+% terraform import aws_chimesdkmediapipelines_media_insights_pipeline_configuration.example abcdef123456
 ```
diff --git a/website/docs/r/chimesdkvoice_global_settings.html.markdown b/website/docs/r/chimesdkvoice_global_settings.html.markdown
index 86aaa45ee65..d1b231135b9 100644
--- a/website/docs/r/chimesdkvoice_global_settings.html.markdown
+++ b/website/docs/r/chimesdkvoice_global_settings.html.markdown
@@ -24,7 +24,7 @@ resource "aws_chimesdkvoice_global_settings" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `voice_connector` - (Required) The Voice Connector settings. See [voice_connector](#voice_connector).
 
@@ -34,16 +34,25 @@ The Amazon Chime SDK Voice Connector settings. Includes any Amazon S3 buckets de
 
 * `cdr_bucket` - (Optional) The S3 bucket that stores the Voice Connector's call detail records.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - AWS account ID for which the settings are applied.
 
 ## Import
 
-AWS Chime SDK Voice Global Settings can be imported using the `id` (AWS account ID), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AWS Chime SDK Voice Global Settings using the `id` (AWS account ID). For example:
 
+```terraform
+import {
+  to = aws_chimesdkvoice_global_settings.example
+  id = "123456789012"
+}
 ```
-$ terraform import aws_chimesdkvoice_global_settings.example 123456789012
+
+Using `terraform import`, import AWS Chime SDK Voice Global Settings using the `id` (AWS account ID). For example:
+
+```console
+% terraform import aws_chimesdkvoice_global_settings.example 123456789012
 ```
diff --git a/website/docs/r/chimesdkvoice_sip_media_application.html.markdown b/website/docs/r/chimesdkvoice_sip_media_application.html.markdown
index 0659c4eb77c..c15d2eeb116 100644
--- a/website/docs/r/chimesdkvoice_sip_media_application.html.markdown
+++ b/website/docs/r/chimesdkvoice_sip_media_application.html.markdown
@@ -42,9 +42,9 @@ The endpoint assigned to the SIP media application.
 
 * `lambda_arn` - (Required) Valid Amazon Resource Name (ARN) of the Lambda function, version, or alias. The function must be created in the same AWS Region as the SIP media application.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` -  ARN (Amazon Resource Name) of the AWS Chime SDK Voice Sip Media Application
 * `id` - The SIP media application ID.
@@ -52,8 +52,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-A ChimeSDKVoice SIP Media Application can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import a ChimeSDKVoice SIP Media Application using the `id`. For example:
 
+```terraform
+import {
+  to = aws_chimesdkvoice_sip_media_application.example
+  id = "abcdef123456"
+}
 ```
-$ terraform import aws_chimesdkvoice_sip_media_application.example abcdef123456
+
+Using `terraform import`, import a ChimeSDKVoice SIP Media Application using the `id`. For example:
+
+```console
+% terraform import aws_chimesdkvoice_sip_media_application.example abcdef123456
 ```
diff --git a/website/docs/r/chimesdkvoice_sip_rule.html.markdown b/website/docs/r/chimesdkvoice_sip_rule.html.markdown
index c9c8480f46d..6228264b209 100644
--- a/website/docs/r/chimesdkvoice_sip_rule.html.markdown
+++ b/website/docs/r/chimesdkvoice_sip_rule.html.markdown
@@ -47,16 +47,25 @@ List of SIP media applications with priority and AWS Region. Only one SIP applic
 * `priority` - (Required) Priority of the SIP media application in the target list.
 * `sip_media_application_id` - (Required) The SIP media application ID.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The SIP rule ID.
 
 ## Import
 
-A ChimeSDKVoice SIP Rule can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import a ChimeSDKVoice SIP Rule using the `id`. For example:
 
+```terraform
+import {
+  to = aws_chimesdkvoice_sip_rule.example
+  id = "abcdef123456"
+}
 ```
-$ terraform import aws_chimesdkvoice_sip_rule.example abcdef123456
+
+Using `terraform import`, import a ChimeSDKVoice SIP Rule using the `id`. For example:
+
+```console
+% terraform import aws_chimesdkvoice_sip_rule.example abcdef123456
 ```
diff --git a/website/docs/r/chimesdkvoice_voice_profile_domain.html.markdown b/website/docs/r/chimesdkvoice_voice_profile_domain.html.markdown
index d1190b0cfeb..a0b3ae59f0c 100644
--- a/website/docs/r/chimesdkvoice_voice_profile_domain.html.markdown
+++ b/website/docs/r/chimesdkvoice_voice_profile_domain.html.markdown
@@ -44,9 +44,9 @@ The following arguments are optional:
 
 * `description` - (Optional) Description of Voice Profile Domain.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the Voice Profile Domain.
 * `id` - ID of the Voice Profile Domain.
@@ -61,8 +61,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-AWS Chime SDK Voice Profile Domain can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AWS Chime SDK Voice Profile Domain using the `id`. For example:
 
+```terraform
+import {
+  to = aws_chimesdkvoice_voice_profile_domain.example
+  id = "abcdef123456"
+}
 ```
-$ terraform import aws_chimesdkvoice_voice_profile_domain.example abcdef123456
+
+Using `terraform import`, import AWS Chime SDK Voice Profile Domain using the `id`. For example:
+
+```console
+% terraform import aws_chimesdkvoice_voice_profile_domain.example abcdef123456
 ```
diff --git a/website/docs/r/cleanrooms_collaboration.html.markdown b/website/docs/r/cleanrooms_collaboration.html.markdown
new file mode 100644
index 00000000000..7ed192b47e4
--- /dev/null
+++ b/website/docs/r/cleanrooms_collaboration.html.markdown
@@ -0,0 +1,104 @@
+---
+subcategory: "Clean Rooms"
+layout: "aws"
+page_title: "AWS: aws_cleanrooms_collaboration"
+description: |-
+  Provides a Clean Rooms Collaboration.
+---
+
+# Resource: aws_cleanrooms_collaboration
+
+Provides a AWS Clean Rooms collaboration.  All members included in the definition will be invited to
+join the collaboration and can create memberships.
+
+## Example Usage
+
+### Collaboration with tags
+
+```terraform
+resource "aws_cleanrooms_collaboration" "test_collaboration" {
+  name                     = "terraform-example-collaboration"
+  creator_member_abilities = ["CAN_QUERY", "CAN_RECEIVE_RESULTS"]
+  creator_display_name     = "Creator "
+  description              = "I made this collaboration with terraform!"
+  query_log_status         = "DISABLED"
+
+  data_encryption_metadata {
+    allow_clear_text                            = true
+    allow_duplicates                            = true
+    allow_joins_on_columns_with_different_names = true
+    preserve_nulls                              = false
+  }
+
+  member {
+    account_id       = 123456789012
+    display_name     = "Other member"
+    member_abilities = []
+  }
+
+  tags = {
+    Project = "Terraform"
+  }
+
+}
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) - The name of the collaboration.  Collaboration names do not need to be unique.
+* `description` - (Required) - A description for a collaboration.
+* `creator_member_abilities` - (Required - Forces new resource) - The list of member abilities for the creator of the collaboration.  Valid values [may be found here](https://docs.aws.amazon.com/clean-rooms/latest/apireference/API_CreateCollaboration.html#API-CreateCollaboration-request-creatorMemberAbilities).
+* `creator_display_name` - (Required - Forces new resource) - The name for the member record for the collaboration creator.
+* `query_log_status` - (Required - Forces new resource) - Determines if members of the collaboration can enable query logs within their own.
+emberships. Valid values [may be found here](https://docs.aws.amazon.com/clean-rooms/latest/apireference/API_CreateCollaboration.html#API-CreateCollaboration-request-queryLogStatus).
+* `data_encryption_metadata` - (Required - Forces new resource) - a collection of settings which determine how the [c3r client](https://docs.aws.amazon.com/clean-rooms/latest/userguide/crypto-computing.html) will encrypt data for use within this collaboration.
+* `data_encryption_metadata.allow_clear_text` - (Required - Forces new resource) - Indicates whether encrypted tables can contain cleartext data. This is a boolea
+ field.
+* `data_encryption_metadata.allow_duplicates` - (Required - Forces new resource ) - Indicates whether Fingerprint columns can contain duplicate entries. This is a
+boolean field.
+* `data_encryption_metadata.allow_joins_on_columns_with_different_names` - (Required - Forces new resource) - Indicates whether Fingerprint columns can be joined
+n any other Fingerprint column with a different name. This is a boolean field.
+* `data_encryption_metadata.preserve_nulls` - (Required - Forces new resource) - Indicates whether NULL values are to be copied as NULL to encrypted tables (true)
+or cryptographically processed (false).
+* `member` - (Optional - Forces new resource) - Additional members of the collaboration which will be invited to join the collaboration.
+* `member.account_id` - (Required - Forces new resource) - The account id for the invited member.
+* `member.display_name` - (Required - Forces new resource) - The display name for the invited member.
+* `member.member_abilities` - (Required - Forces new resource) - The list of abilities for the invited member. Valid values [may be found here](https://docs.aws.amazon.com/clean-rooms/latest/apireference/API_CreateCollaboration.html#API-CreateCollaboration-request-creatorMemberAbilities).
+* `tags` - (Optional) - Key value pairs which tag the collaboration.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The arn of the collaboration.
+* `id` - The id of the collaboration.
+* `create_time` - The date and time the collaboration was created.
+* `member status` - For each member included in the collaboration an additional computed attribute of status is added. These values [may be found here](https://docs.aws.amazon.com/clean-rooms/latest/apireference/API_MemberSummary.html#API-Type-MemberSummary-status).
+* `updated_time` - The date and time the collaboration was last updated.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `1m`)
+- `update` - (Default `1m`)
+- `delete` - (Default `1m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_cleanrooms_collaboration` using the `id`. For example:
+
+```terraform
+import {
+  to = aws_cleanrooms_collaboration.collaboration
+  id = "1234abcd-12ab-34cd-56ef-1234567890ab"
+}
+```
+
+Using `terraform import`, import `aws_cleanrooms_collaboration` using the `id`. For example:
+
+```console
+% terraform import aws_cleanrooms_collaboration.collaboration 1234abcd-12ab-34cd-56ef-1234567890ab
+```
diff --git a/website/docs/r/cleanrooms_configured_table.html.markdown b/website/docs/r/cleanrooms_configured_table.html.markdown
new file mode 100644
index 00000000000..5aa1a65c614
--- /dev/null
+++ b/website/docs/r/cleanrooms_configured_table.html.markdown
@@ -0,0 +1,84 @@
+---
+subcategory: "Clean Rooms"
+layout: "aws"
+page_title: "AWS: aws_cleanrooms_configured_table"
+description: |-
+  Provides a Clean Rooms Configured Table.
+---
+
+# Resource: aws_cleanrooms_configured_table
+
+Provides a AWS Clean Rooms configured table. Configured tables are used to represent references to existing tables in the AWS Glue Data Catalog.
+
+## Example Usage
+
+### Configured table with tags
+
+```terraform
+resource "aws_cleanrooms_configured_table" "test_configured_table" {
+  name            = "terraform-example-table"
+  description     = "I made this table with terraform!"
+  analysis_method = "DIRECT_QUERY"
+  allowed_columns = [
+    "column1",
+    "column2",
+    "column3",
+  ]
+
+  table_reference {
+    database_name = "example_database"
+    table_name    = "example_table"
+  }
+
+  tags = {
+    Project = "Terraform"
+  }
+}
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) - The name of the configured table.
+* `description` - (Optional) - A description for the configured table.
+* `analysis_method` - (Required) - The analysis method for the configured table. The only valid value is currently `DIRECT_QUERY`.
+* `allowed_columns` - (Required - Forces new resource) - The columns of the references table which will be included in the configured table.
+* `table_reference` - (Required - Forces new resource) - A reference to the AWS Glue table which will be used to create the configured table.
+* `table_reference.database_name` - (Required - Forces new resource) - The name of the AWS Glue database which contains the table.
+* `table_reference.table_name` - (Required - Forces new resource) - The name of the AWS Glue table which will be used to create the configured table.
+* `tags` - (Optional) - Key value pairs which tag the configured table.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the configured table.
+* `id` - The ID of the configured table.
+* `create_time` - The date and time the configured table was created.
+* `update_time` - The date and time the configured table was last updated.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `1m`)
+- `update` - (Default `1m`)
+- `delete` - (Default `1m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_cleanrooms_configured_table` using the `id`. For example:
+
+```terraform
+import {
+  to = aws_cleanrooms_configured_table.table
+  id = "1234abcd-12ab-34cd-56ef-1234567890ab"
+}
+```
+
+Using `terraform import`, import `aws_cleanrooms_configured_table` using the `id`. For example:
+
+```console
+% terraform import aws_cleanrooms_configured_table.table 1234abcd-12ab-34cd-56ef-1234567890ab
+```
diff --git a/website/docs/r/cloud9_environment_ec2.html.markdown b/website/docs/r/cloud9_environment_ec2.html.markdown
index d93844c570d..406be47d2df 100644
--- a/website/docs/r/cloud9_environment_ec2.html.markdown
+++ b/website/docs/r/cloud9_environment_ec2.html.markdown
@@ -68,7 +68,7 @@ output "cloud9_public_ip" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The name of the environment.
 * `instance_type` - (Required) The type of instance to connect to the environment, e.g., `t2.micro`.
@@ -79,16 +79,19 @@ The following arguments are supported:
     * `amazonlinux-1-x86_64`
     * `amazonlinux-2-x86_64`
     * `ubuntu-18.04-x86_64`
+    * `ubuntu-22.04-x86_64`
     * `resolve:ssm:/aws/service/cloud9/amis/amazonlinux-1-x86_64`
     * `resolve:ssm:/aws/service/cloud9/amis/amazonlinux-2-x86_64`
     * `resolve:ssm:/aws/service/cloud9/amis/ubuntu-18.04-x86_64`
+    * `resolve:ssm:/aws/service/cloud9/amis/ubuntu-22.04-x86_64`
+
 * `owner_arn` - (Optional) The ARN of the environment owner. This can be ARN of any AWS IAM principal. Defaults to the environment's creator.
 * `subnet_id` - (Optional) The ID of the subnet in Amazon VPC that AWS Cloud9 will use to communicate with the Amazon EC2 instance.
 * `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the environment.
 * `arn` - The ARN of the environment.
diff --git a/website/docs/r/cloud9_environment_membership.html.markdown b/website/docs/r/cloud9_environment_membership.html.markdown
new file mode 100644
index 00000000000..273027dafda
--- /dev/null
+++ b/website/docs/r/cloud9_environment_membership.html.markdown
@@ -0,0 +1,62 @@
+---
+subcategory: "Cloud9"
+layout: "aws"
+page_title: "AWS: aws_cloud9_environment_membership"
+description: |-
+  Provides an environment member to an AWS Cloud9 development environment.
+---
+
+# Resource: aws_cloud9_environment_membership
+
+Provides an environment member to an AWS Cloud9 development environment.
+
+## Example Usage
+
+```terraform
+resource "aws_cloud9_environment_ec2" "test" {
+  instance_type = "t2.micro"
+  name          = "some-env"
+}
+
+resource "aws_iam_user" "test" {
+  name = "some-user"
+}
+
+resource "aws_cloud9_environment_membership" "test" {
+  environment_id = aws_cloud9_environment_ec2.test.id
+  permissions    = "read-only"
+  user_arn       = aws_iam_user.test.arn
+}
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `environment_id` - (Required) The ID of the environment that contains the environment member you want to add.
+* `permissions` - (Required) The type of environment member permissions you want to associate with this environment member. Allowed values are `read-only` and `read-write` .
+* `user_arn` - (Required) The Amazon Resource Name (ARN) of the environment member you want to add.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the environment membership.
+* `user_id` - he user ID in AWS Identity and Access Management (AWS IAM) of the environment member.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Cloud9 environment membership using the `environment-id#user-arn`. For example:
+
+```terraform
+import {
+  to = aws_cloud9_environment_membership.test
+  id = "environment-id#user-arn"
+}
+```
+
+Using `terraform import`, import Cloud9 environment membership using the `environment-id#user-arn`. For example:
+
+```console
+% terraform import aws_cloud9_environment_membership.test environment-id#user-arn
+```
diff --git a/website/docs/r/cloud9_environment_membership.markdown b/website/docs/r/cloud9_environment_membership.markdown
deleted file mode 100644
index 3569f24420b..00000000000
--- a/website/docs/r/cloud9_environment_membership.markdown
+++ /dev/null
@@ -1,53 +0,0 @@
----
-subcategory: "Cloud9"
-layout: "aws"
-page_title: "AWS: aws_cloud9_environment_membership"
-description: |-
-  Provides an environment member to an AWS Cloud9 development environment.
----
-
-# Resource: aws_cloud9_environment_membership
-
-Provides an environment member to an AWS Cloud9 development environment.
-
-## Example Usage
-
-```terraform
-resource "aws_cloud9_environment_ec2" "test" {
-  instance_type = "t2.micro"
-  name          = "some-env"
-}
-
-resource "aws_iam_user" "test" {
-  name = "some-user"
-}
-
-resource "aws_cloud9_environment_membership" "test" {
-  environment_id = aws_cloud9_environment_ec2.test.id
-  permissions    = "read-only"
-  user_arn       = aws_iam_user.test.arn
-}
-```
-
-## Argument Reference
-
-The following arguments are supported:
-
-* `environment_id` - (Required) The ID of the environment that contains the environment member you want to add.
-* `permissions` - (Required) The type of environment member permissions you want to associate with this environment member. Allowed values are `read-only` and `read-write` .
-* `user_arn` - (Required) The Amazon Resource Name (ARN) of the environment member you want to add.
-
-## Attributes Reference
-
-In addition to all arguments above, the following attributes are exported:
-
-* `id` - The ID of the environment membership.
-* `user_id` - he user ID in AWS Identity and Access Management (AWS IAM) of the environment member.
-
-## Import
-
-Cloud9 environment membership can be imported using the `environment-id#user-arn`, e.g.
-
-```
-$ terraform import aws_cloud9_environment_membership.test environment-id#user-arn
-```
diff --git a/website/docs/r/cloudcontrolapi_resource.html.markdown b/website/docs/r/cloudcontrolapi_resource.html.markdown
index 75636c677e4..b398b77d854 100644
--- a/website/docs/r/cloudcontrolapi_resource.html.markdown
+++ b/website/docs/r/cloudcontrolapi_resource.html.markdown
@@ -41,8 +41,8 @@ The following arguments are optional:
 * `schema` - (Optional) JSON string of the CloudFormation resource type schema which is used for plan time validation where possible. Automatically fetched if not provided. In large scale environments with multiple resources using the same `type_name`, it is recommended to fetch the schema once via the [`aws_cloudformation_type` data source](/docs/providers/aws/d/cloudformation_type.html) and use this argument to reduce `DescribeType` API operation throttling. This value is marked sensitive only to prevent large plan differences from showing.
 * `type_version_id` - (Optional) Identifier of the CloudFormation resource type version.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `properties` - JSON string matching the CloudFormation resource type schema with current configuration. Underlying attributes can be referenced via the [`jsondecode()` function](https://www.terraform.io/docs/language/functions/jsondecode.html), for example, `jsondecode(data.aws_cloudcontrolapi_resource.example.properties)["example"]`.
diff --git a/website/docs/r/cloudformation_stack.html.markdown b/website/docs/r/cloudformation_stack.html.markdown
index 059a1827a95..60441e5f342 100644
--- a/website/docs/r/cloudformation_stack.html.markdown
+++ b/website/docs/r/cloudformation_stack.html.markdown
@@ -51,7 +51,7 @@ resource "aws_cloudformation_stack" "network" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) Stack name.
 * `template_body` - (Optional) Structure containing the template body (max size: 51,200 bytes).
@@ -72,9 +72,9 @@ The following arguments are supported:
 * `iam_role_arn` - (Optional) The ARN of an IAM role that AWS CloudFormation assumes to create the stack. If you don't specify a value, AWS CloudFormation uses the role that was previously associated with the stack. If no role is available, AWS CloudFormation uses a temporary session that is generated from your user credentials.
 * `timeout_in_minutes` - (Optional) The amount of time that can pass before the stack status becomes `CREATE_FAILED`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - A unique identifier of the stack.
 * `outputs` - A map of outputs from the stack.
@@ -90,8 +90,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Cloudformation Stacks can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Cloudformation Stacks using the `name`. For example:
 
+```terraform
+import {
+  to = aws_cloudformation_stack.stack
+  id = "networking-stack"
+}
 ```
-$ terraform import aws_cloudformation_stack.stack networking-stack
+
+Using `terraform import`, import Cloudformation Stacks using the `name`. For example:
+
+```console
+% terraform import aws_cloudformation_stack.stack networking-stack
 ```
diff --git a/website/docs/r/cloudformation_stack_set.html.markdown b/website/docs/r/cloudformation_stack_set.html.markdown
index 875155af1e0..5bfbe25a82b 100644
--- a/website/docs/r/cloudformation_stack_set.html.markdown
+++ b/website/docs/r/cloudformation_stack_set.html.markdown
@@ -86,7 +86,7 @@ resource "aws_iam_role_policy" "AWSCloudFormationStackSetAdministrationRole_Exec
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `administration_role_arn` - (Optional) Amazon Resource Number (ARN) of the IAM Role in the administrator account. This must be defined when using the `SELF_MANAGED` permission model.
 * `auto_deployment` - (Optional) Configuration block containing the auto-deployment model for your StackSet. This can only be defined when using the `SERVICE_MANAGED` permission model.
@@ -117,9 +117,9 @@ The `operation_preferences` configuration block supports the following arguments
 * `region_concurrency_type` - (Optional) The concurrency type of deploying StackSets operations in Regions, could be in parallel or one Region at a time.
 * `region_order` - (Optional) The order of the Regions in where you want to perform the stack operation.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name (ARN) of the StackSet.
 * `id` - Name of the StackSet.
@@ -134,8 +134,32 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-CloudFormation StackSets can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudFormation StackSets using the `name`. For example:
 
+```terraform
+import {
+  to = aws_cloudformation_stack_set.example
+  id = "example"
+}
+```
+
+Import CloudFormation StackSets when acting a delegated administrator in a member account using the `name` and `call_as` values separated by a comma (`,`). For example:
+
+```terraform
+import {
+  to = aws_cloudformation_stack_set.example
+  id = "example,DELEGATED_ADMIN"
+}
+```
+
+Using `terraform import`, import CloudFormation StackSets using the `name`. For example:
+
+```console
+% terraform import aws_cloudformation_stack_set.example example
 ```
-$ terraform import aws_cloudformation_stack_set.example example
+
+Using `terraform import`, import CloudFormation StackSets when acting a delegated administrator in a member account using the `name` and `call_as` values separated by a comma (`,`). For example:
+
+```console
+% terraform import aws_cloudformation_stack_set.example example,DELEGATED_ADMIN
 ```
diff --git a/website/docs/r/cloudformation_stack_set_instance.html.markdown b/website/docs/r/cloudformation_stack_set_instance.html.markdown
index e1fdaf6851a..9fed412cb58 100644
--- a/website/docs/r/cloudformation_stack_set_instance.html.markdown
+++ b/website/docs/r/cloudformation_stack_set_instance.html.markdown
@@ -16,6 +16,8 @@ Manages a CloudFormation StackSet Instance. Instances are managed in the account
 
 ## Example Usage
 
+### Basic Usage
+
 ```terraform
 resource "aws_cloudformation_stack_set_instance" "example" {
   account_id     = "123456789012"
@@ -81,7 +83,7 @@ resource "aws_cloudformation_stack_set_instance" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `stack_set_name` - (Required) Name of the StackSet.
 * `account_id` - (Optional) Target AWS Account ID to create a Stack based on the StackSet. Defaults to current account.
@@ -109,13 +111,20 @@ The `operation_preferences` configuration block supports the following arguments
 * `region_concurrency_type` - (Optional) The concurrency type of deploying StackSets operations in Regions, could be in parallel or one Region at a time. Valid values are `SEQUENTIAL` and `PARALLEL`.
 * `region_order` - (Optional) The order of the Regions in where you want to perform the stack operation.
 
-## Attributes Reference
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Unique identifier for the resource. If `deployment_targets` is set, this is a comma-delimited string combining stack set name, organizational unit IDs (`/`-delimited), and region (ie. `mystack,ou-123/ou-456,us-east-1`). Otherwise, this is a comma-delimited string combining stack set name, AWS account ID, and region (ie. `mystack,123456789012,us-east-1`).
+* `organizational_unit_id` - The organization root ID or organizational unit (OU) ID in which the stack is deployed.
+* `stack_id` - Stack identifier.
+* `stack_instance_summaries` - List of stack instances created from an organizational unit deployment target. This will only be populated when `deployment_targets` is set. See [`stack_instance_summaries`](#stack_instance_summaries-attribute-reference).
 
-In addition to all arguments above, the following attributes are exported:
+### `stack_instance_summaries` Attribute Reference
 
-* `id` - StackSet name, target AWS account ID, and target AWS region separated by commas (`,`)
-* `organizational_unit_id` - The organization root ID or organizational unit (OU) IDs specified for `deployment_targets`.
-* `stack_id` - Stack identifier
+* `account_id` - AWS account ID in which the stack is deployed.
+* `organizational_unit_id` - Organizational unit ID in which the stack is deployed.
+* `stack_id` - Stack identifier.
 
 ## Timeouts
 
@@ -127,14 +136,47 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-CloudFormation StackSet Instances that target an AWS Account ID can be imported using the StackSet name, target AWS account ID, and target AWS region separated by commas (`,`) e.g.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudFormation StackSet Instances that target an AWS Account ID using the StackSet name, target AWS account ID, and target AWS Region separated by commas (`,`). For example:
 
+```terraform
+import {
+  to = aws_cloudformation_stack_set_instance.example
+  id = "example,123456789012,us-east-1"
+}
 ```
-$ terraform import aws_cloudformation_stack_set_instance.example example,123456789012,us-east-1
+
+Import CloudFormation StackSet Instances that target AWS Organizational Units using the StackSet name, a slash (`/`) separated list of organizational unit IDs, and target AWS Region separated by commas (`,`). For example:
+
+```terraform
+import {
+  to = aws_cloudformation_stack_set_instance.example
+  id = "example,ou-sdas-123123123/ou-sdas-789789789,us-east-1"
+}
 ```
 
-CloudFormation StackSet Instances that target AWS Organizational Units can be imported using the StackSet name, a slash (`/`) separated list of organizational unit IDs, and target AWS region separated by commas (`,`) e.g.
+Import CloudFormation StackSet Instances when acting a delegated administrator in a member account using the StackSet name, target AWS account ID or slash (`/`) separated list of organizational unit IDs, target AWS Region and `call_as` value separated by commas (`,`). For example:
 
+```terraform
+import {
+  to = aws_cloudformation_stack_set_instance.example
+  id = "example,ou-sdas-123123123/ou-sdas-789789789,us-east-1,DELEGATED_ADMIN"
+}
 ```
-$ terraform import aws_cloudformation_stack_set_instance.example example,ou-sdas-123123123/ou-sdas-789789789,us-east-1
+
+Using `terraform import`, import CloudFormation StackSet Instances that target an AWS Account ID using the StackSet name, target AWS account ID, and target AWS Region separated by commas (`,`). For example:
+
+```console
+% terraform import aws_cloudformation_stack_set_instance.example example,123456789012,us-east-1
+```
+
+Using `terraform import`, import CloudFormation StackSet Instances that target AWS Organizational Units using the StackSet name, a slash (`/`) separated list of organizational unit IDs, and target AWS Region separated by commas (`,`). For example:
+
+```console
+% terraform import aws_cloudformation_stack_set_instance.example example,ou-sdas-123123123/ou-sdas-789789789,us-east-1
+```
+
+Using `terraform import`, import CloudFormation StackSet Instances when acting a delegated administrator in a member account using the StackSet name, target AWS account ID or slash (`/`) separated list of organizational unit IDs, target AWS Region and `call_as` value separated by commas (`,`). For example:
+
+```console
+% terraform import aws_cloudformation_stack_set_instance.example example,ou-sdas-123123123/ou-sdas-789789789,us-east-1,DELEGATED_ADMIN
 ```
diff --git a/website/docs/r/cloudformation_type.html.markdown b/website/docs/r/cloudformation_type.html.markdown
index 31beba99843..fd6f02e365d 100644
--- a/website/docs/r/cloudformation_type.html.markdown
+++ b/website/docs/r/cloudformation_type.html.markdown
@@ -33,7 +33,7 @@ resource "aws_cloudformation_type" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `execution_role_arn` - (Optional) Amazon Resource Name (ARN) of the IAM Role for CloudFormation to assume when invoking the extension. If your extension calls AWS APIs in any of its handlers, you must create an IAM execution role that includes the necessary permissions to call those AWS APIs, and provision that execution role in your account. When CloudFormation needs to invoke the extension handler, CloudFormation assumes this execution role to create a temporary session token, which it then passes to the extension handler, thereby supplying your extension with the appropriate credentials.
 * `logging_config` - (Optional) Configuration block containing logging configuration.
@@ -43,14 +43,14 @@ The following arguments are supported:
 
 ### logging_config
 
-The following arguments are supported in the `logging_config` configuration block:
+The `logging_config` configuration block supports the following arguments:
 
 * `log_group_name` - (Required) Name of the CloudWatch Log Group where CloudFormation sends error logging information when invoking the type's handlers.
 * `log_role_arn` - (Required) Amazon Resource Name (ARN) of the IAM Role CloudFormation assumes when sending error logging information to CloudWatch Logs.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - (Optional) Amazon Resource Name (ARN) of the CloudFormation Type version. See also `type_arn`.
 * `default_version_id` - Identifier of the CloudFormation Type default version.
@@ -67,8 +67,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_cloudformation_type` can be imported with their type version Amazon Resource Name (ARN), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_cloudformation_type` using the type version Amazon Resource Name (ARN). For example:
 
+```terraform
+import {
+  to = aws_cloudformation_type.example
+  id = "arn:aws:cloudformation:us-east-1:123456789012:type/resource/ExampleCompany-ExampleService-ExampleType/1"
+}
 ```
-terraform import aws_cloudformation_type.example arn:aws:cloudformation:us-east-1:123456789012:type/resource/ExampleCompany-ExampleService-ExampleType/1
+
+Using `terraform import`, import `aws_cloudformation_type` using the type version Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_cloudformation_type.example arn:aws:cloudformation:us-east-1:123456789012:type/resource/ExampleCompany-ExampleService-ExampleType/1
 ```
diff --git a/website/docs/r/cloudfront_cache_policy.html.markdown b/website/docs/r/cloudfront_cache_policy.html.markdown
index f1a0eb8132a..74d4572cb3c 100644
--- a/website/docs/r/cloudfront_cache_policy.html.markdown
+++ b/website/docs/r/cloudfront_cache_policy.html.markdown
@@ -3,19 +3,14 @@ subcategory: "CloudFront"
 layout: "aws"
 page_title: "AWS: aws_cloudfront_cache_policy"
 description: |-
-  Provides a cache policy for a CloudFront ditribution. When it’s attached to a cache behavior,
-  the cache policy determines the values that CloudFront includes in the cache key. These
-  values can include HTTP headers, cookies, and URL query strings. CloudFront uses the cache
-  key to find an object in its cache that it can return to the viewer. It also determines the
-  default, minimum, and maximum time to live (TTL) values that you want objects to stay in the
-  CloudFront cache.
+  Use the `aws_cloudfront_cache_policy` resource to manage cache policies for CloudFront distributions. This resource allows you to attach cache policies to cache behaviors, which determine the values included in the cache key, such as HTTP headers, cookies, and URL query strings. CloudFront uses the cache key to locate cached objects and return them to viewers. Additionally, the cache policy sets the default, minimum, and maximum time to live (TTL) values for objects in the CloudFront cache.
 ---
 
 # Resource: aws_cloudfront_cache_policy
 
 ## Example Usage
 
-The following example below creates a CloudFront cache policy.
+Use the `aws_cloudfront_cache_policy` resource to create a cache policy for CloudFront.
 
 ```terraform
 resource "aws_cloudfront_cache_policy" "example" {
@@ -49,53 +44,62 @@ resource "aws_cloudfront_cache_policy" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
-* `name` - (Required) A unique name to identify the cache policy.
-* `min_ttl` - (Required) The minimum amount of time, in seconds, that you want objects to stay in the CloudFront cache before CloudFront sends another request to the origin to see if the object has been updated.
-* `max_ttl` - (Optional) The maximum amount of time, in seconds, that objects stay in the CloudFront cache before CloudFront sends another request to the origin to see if the object has been updated.
-* `default_ttl` - (Optional) The default amount of time, in seconds, that you want objects to stay in the CloudFront cache before CloudFront sends another request to the origin to see if the object has been updated.
-* `comment` - (Optional) A comment to describe the cache policy.
-* `parameters_in_cache_key_and_forwarded_to_origin` - (Required) The HTTP headers, cookies, and URL query strings to include in the cache key. See [Parameters In Cache Key And Forwarded To Origin](#parameters-in-cache-key-and-forwarded-to-origin) for more information.
+* `name` - (Required) Unique name used to identify the cache policy.
+* `min_ttl` - (Required) Minimum amount of time, in seconds, that objects should remain in the CloudFront cache before a new request is sent to the origin to check for updates.
+* `max_ttl` - (Optional) Maximum amount of time, in seconds, that objects stay in the CloudFront cache before CloudFront sends another request to the origin to see if the object has been updated.
+* `default_ttl` - (Optional) Amount of time, in seconds, that objects are allowed to remain in the CloudFront cache before CloudFront sends a new request to the origin server to check if the object has been updated.
+* `comment` - (Optional) Description for the cache policy.
+* `parameters_in_cache_key_and_forwarded_to_origin` - (Required) Configuration for including HTTP headers, cookies, and URL query strings in the cache key. For more information, refer to the [Parameters In Cache Key And Forwarded To Origin](#parameters-in-cache-key-and-forwarded-to-origin) section.
 
 ### Parameters In Cache Key And Forwarded To Origin
 
-* `cookies_config` - (Required) Object that determines whether any cookies in viewer requests (and if so, which cookies) are included in the cache key and automatically included in requests that CloudFront sends to the origin. See [Cookies Config](#cookies-config) for more information.
-* `headers_config` - (Required) Object that determines whether any HTTP headers (and if so, which headers) are included in the cache key and automatically included in requests that CloudFront sends to the origin. See [Headers Config](#headers-config) for more information.
-* `query_strings_config` - (Required) Object that determines whether any URL query strings in viewer requests (and if so, which query strings) are included in the cache key and automatically included in requests that CloudFront sends to the origin. See [Query String Config](#query-string-config) for more information.
-* `enable_accept_encoding_brotli` - (Optional) A flag that can affect whether the Accept-Encoding HTTP header is included in the cache key and included in requests that CloudFront sends to the origin.
-* `enable_accept_encoding_gzip` - (Optional) A flag that can affect whether the Accept-Encoding HTTP header is included in the cache key and included in requests that CloudFront sends to the origin.
+* `cookies_config` - (Required) Whether any cookies in viewer requests are included in the cache key and automatically included in requests that CloudFront sends to the origin. See [Cookies Config](#cookies-config) for more information.
+* `headers_config` - (Required) Whether any HTTP headers are included in the cache key and automatically included in requests that CloudFront sends to the origin. See [Headers Config](#headers-config) for more information.
+* `query_strings_config` - (Required) Whether any URL query strings in viewer requests are included in the cache key. It also automatically includes these query strings in requests that CloudFront sends to the origin. Please refer to the [Query String Config](#query-string-config) for more information.
+* `enable_accept_encoding_brotli` - (Optional) Flag determines whether the Accept-Encoding HTTP header is included in the cache key and in requests that CloudFront sends to the origin.
+* `enable_accept_encoding_gzip` - (Optional) Whether the Accept-Encoding HTTP header is included in the cache key and in requests sent to the origin by CloudFront.
 
 ### Cookies Config
 
-* `cookie_behavior` - (Required) Determines whether any cookies in viewer requests are included in the cache key and automatically included in requests that CloudFront sends to the origin. Valid values are `none`, `whitelist`, `allExcept`, `all`.
+* `cookie_behavior` - (Required) Whether any cookies in viewer requests are included in the cache key and automatically included in requests that CloudFront sends to the origin. Valid values for `cookie_behavior` are `none`, `whitelist`, `allExcept`, and `all`.
 * `cookies` - (Optional) Object that contains a list of cookie names. See [Items](#items) for more information.
 
 ### Headers Config
 
-* `header_behavior` - (Required) Determines whether any HTTP headers are included in the cache key and automatically included in requests that CloudFront sends to the origin. Valid values are `none`, `whitelist`.
-* `headers` - (Optional) Object that contains a list of header names. See [Items](#items) for more information.
+* `header_behavior` - (Required) Whether any HTTP headers are included in the cache key and automatically included in requests that CloudFront sends to the origin. Valid values for `header_behavior` are `none` and `whitelist`.
+* `headers` - (Optional) Object contains a list of header names. See [Items](#items) for more information.
 
 ### Query String Config
 
-* `query_string_behavior` - (Required) Determines whether any URL query strings in viewer requests are included in the cache key and automatically included in requests that CloudFront sends to the origin. Valid values are `none`, `whitelist`, `allExcept`, `all`.
-* `query_strings` - (Optional) Object that contains a list of query string names. See [Items](#items) for more information.
+* `query_string_behavior` - (Required) Whether URL query strings in viewer requests are included in the cache key and automatically included in requests that CloudFront sends to the origin. Valid values for `query_string_behavior` are `none`, `whitelist`, `allExcept`, and `all`.
+* `query_strings` - (Optional) Configuration parameter that contains a list of query string names. See [Items](#items) for more information.
 
 ### Items
 
-* `items` - (Required) A list of item names (cookies, headers, or query strings).
+* `items` - (Required) List of item names, such as cookies, headers, or query strings.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
-* `etag` - The current version of the cache policy.
-* `id` - The identifier for the cache policy.
+* `etag` - Current version of the cache policy.
+* `id` - Identifier for the cache policy.
 
 ## Import
 
-Cloudfront Cache Policies can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudFront cache policies using the `id` of the cache policy. For example:
 
+```terraform
+import {
+  to = aws_cloudfront_cache_policy.policy
+  id = "658327ea-f89d-4fab-a63d-7e88639e58f6"
+}
 ```
-$ terraform import aws_cloudfront_cache_policy.policy 658327ea-f89d-4fab-a63d-7e88639e58f6
+
+Using `terraform import`, import CloudFront cache policies using the `id` of the cache policy. For example:
+
+```console
+% terraform import aws_cloudfront_cache_policy.policy 658327ea-f89d-4fab-a63d-7e88639e58f6
 ```
diff --git a/website/docs/r/cloudfront_continuous_deployment_policy.html.markdown b/website/docs/r/cloudfront_continuous_deployment_policy.html.markdown
new file mode 100644
index 00000000000..a1a2ce8685e
--- /dev/null
+++ b/website/docs/r/cloudfront_continuous_deployment_policy.html.markdown
@@ -0,0 +1,153 @@
+---
+subcategory: "CloudFront"
+layout: "aws"
+page_title: "AWS: aws_cloudfront_continuous_deployment_policy"
+description: |-
+  Terraform resource for managing an AWS CloudFront Continuous Deployment Policy.
+---
+# Resource: aws_cloudfront_continuous_deployment_policy
+
+Terraform resource for managing an AWS CloudFront Continuous Deployment Policy.
+
+## Example Usage
+
+### Basic Usage
+
+```terraform
+resource "aws_cloudfront_distribution" "staging" {
+  enabled = true
+  staging = true
+
+  # ... other configuration ...
+}
+
+resource "aws_cloudfront_continuous_deployment_policy" "example" {
+  enabled = true
+
+  staging_distribution_dns_names {
+    items    = [aws_cloudfront_distribution.staging.domain_name]
+    quantity = 1
+  }
+
+  traffic_config {
+    type = "SingleWeight"
+    single_weight_config {
+      weight = "0.01"
+    }
+  }
+}
+
+resource "aws_cloudfront_distribution" "production" {
+  enabled = true
+
+  # NOTE: A continuous deployment policy cannot be associated to distribution
+  # on creation. Set this argument once the resource exists.
+  continuous_deployment_policy_id = aws_cloudfront_continuous_deployment_policy.example.id
+
+  # ... other configuration ...
+}
+```
+
+### Single Weight Config with Session Stickiness
+
+```terraform
+resource "aws_cloudfront_continuous_deployment_policy" "example" {
+  enabled = true
+
+  staging_distribution_dns_names {
+    items    = [aws_cloudfront_distribution.staging.domain_name]
+    quantity = 1
+  }
+
+  traffic_config {
+    type = "SingleWeight"
+    single_weight_config {
+      weight = "0.01"
+      session_stickiness_config {
+        idle_ttl    = 300
+        maximum_ttl = 600
+      }
+    }
+  }
+}
+```
+
+### Single Header Config
+
+```terraform
+resource "aws_cloudfront_continuous_deployment_policy" "example" {
+  enabled = true
+
+  staging_distribution_dns_names {
+    items    = [aws_cloudfront_distribution.staging.domain_name]
+    quantity = 1
+  }
+
+  traffic_config {
+    type = "SingleHeader"
+    single_header_config {
+      header = "aws-cf-cd-example"
+      value  = "example"
+    }
+  }
+}
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `enabled` - (Required) Whether this continuous deployment policy is enabled.
+* `staging_distribution_dns_names` - (Required) CloudFront domain name of the staging distribution. See [`staging_distribution_dns_names`](#staging_distribution_dns_names).
+* `traffic_config` - (Required) Parameters for routing production traffic from primary to staging distributions. See [`traffic_config`](#traffic_config).
+
+### `staging_distribution_dns_names`
+
+* `items` - (Required) A list of CloudFront domain names for the staging distribution.
+* `quantity` - (Required) Number of CloudFront domain names in the staging distribution.
+
+### `traffic_config`
+
+* `type` - (Required) Type of traffic configuration. Valid values are `SingleWeight` and `SingleHeader`.
+* `single_header_config` - (Optional) Determines which HTTP requests are sent to the staging distribution. See [`single_header_config`](#single_header_config).
+* `single_weight_config` - (Optional) Contains the percentage of traffic to send to the staging distribution. See [`single_weight_config`](#single_weight_config).
+
+### `single_header_config`
+
+* `header` - (Required) Request header name to send to the staging distribution. The header must contain the prefix `aws-cf-cd-`.
+* `value` - (Required) Request header value.
+
+### `single_weight_config`
+
+* `weight` - (Required) The percentage of traffic to send to a staging distribution, expressed as a decimal number between `0` and `.15`.
+* `session_stickiness_config` - (Optional) Session stickiness provides the ability to define multiple requests from a single viewer as a single session. This prevents the potentially inconsistent experience of sending some of a given user's requests to the staging distribution, while others are sent to the primary distribution. Define the session duration using TTL values. See [`session_stickiness_config`](#session_stickiness_config).
+
+### `session_stickiness_config`
+
+* `idle_ttl` - (Required) The amount of time in seconds after which sessions will cease if no requests are received. Valid values are `300` – `3600` (5–60 minutes). The value must be less than or equal to `maximum_ttl`.
+* `maximum_ttl` - (Required) The maximum amount of time in seconds to consider requests from the viewer as being part of the same session. Valid values are `300` – `3600` (5–60 minutes). The value must be greater than or equal to `idle_ttl`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `etag` - Current version of the continuous distribution policy.
+* `id` - Identifier of the continuous deployment policy.
+* `last_modified_time` - Date and time the continuous deployment policy was last modified.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudFront Continuous Deployment Policy using the `id`. For example:
+
+```terraform
+import {
+  to = aws_cloudfront_continuous_deployment_policy.example
+  id = "abcd-1234"
+}
+```
+
+Using `terraform import`, import CloudFront Continuous Deployment Policy using the `id`. For example:
+
+```console
+% terraform import aws_cloudfront_continuous_deployment_policy.example abcd-1234 
+```
diff --git a/website/docs/r/cloudfront_distribution.html.markdown b/website/docs/r/cloudfront_distribution.html.markdown
index 747369c03a7..1a1ad590a72 100644
--- a/website/docs/r/cloudfront_distribution.html.markdown
+++ b/website/docs/r/cloudfront_distribution.html.markdown
@@ -16,7 +16,9 @@ For information about CloudFront distributions, see the [Amazon CloudFront Devel
 
 ## Example Usage
 
-The following example below creates a CloudFront distribution with an S3 origin.
+### S3 Origin
+
+The example below creates a CloudFront distribution with an S3 origin.
 
 ```terraform
 resource "aws_s3_bucket" "b" {
@@ -139,7 +141,9 @@ resource "aws_cloudfront_distribution" "s3_distribution" {
 }
 ```
 
-The example below creates a CloudFront distribution with an origin group for failover routing:
+### With Failover Routing
+
+The example below creates a CloudFront distribution with an origin group for failover routing.
 
 ```terraform
 resource "aws_cloudfront_distribution" "s3_distribution" {
@@ -186,7 +190,9 @@ resource "aws_cloudfront_distribution" "s3_distribution" {
 }
 ```
 
-CloudFront distribution using [managed policies](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-managed-cache-policies.html) (ex: CachingDisabled):
+### With Managed Caching Policy
+
+The example below creates a CloudFront distribution with an [AWS managed caching policy](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-managed-cache-policies.html).
 
 ```terraform
 locals {
@@ -212,7 +218,6 @@ resource "aws_cloudfront_distribution" "s3_distribution" {
     # Using the CachingDisabled managed policy ID:
     cache_policy_id  = "4135ea2d-6df8-44a3-9df3-4b5a84be39ad"
     allowed_methods  = ["GET", "HEAD", "OPTIONS"]
-    path_pattern     = "/content/*"
     target_origin_id = local.s3_origin_id
   }
 
@@ -226,6 +231,7 @@ resource "aws_cloudfront_distribution" "s3_distribution" {
   viewer_certificate {
     cloudfront_default_certificate = true
   }
+
   # ... other configuration ...
 }
 ```
@@ -238,6 +244,7 @@ The CloudFront distribution argument layout is a complex structure composed of s
 
 * `aliases` (Optional) - Extra CNAMEs (alternate domain names), if any, for this distribution.
 * `comment` (Optional) - Any comments you want to include about the distribution.
+* `continuous_deployment_policy_id` (Optional) - Identifier of a continuous deployment policy. This argument should only be set on a production distribution. See the [`aws_cloudfront_continuous_deployment_policy` resource](./cloudfront_continuous_deployment_policy.html.markdown) for additional details.
 * `custom_error_response` (Optional) - One or more [custom error response](#custom-error-response-arguments) elements (multiples allowed).
 * `default_cache_behavior` (Required) - [Default cache behavior](#default-cache-behavior-arguments) for this distribution (maximum one). Requires either `cache_policy_id` (preferred) or `forwarded_values` (deprecated) be set.
 * `default_root_object` (Optional) - Object that you want CloudFront to return (for example, index.html) when an end user requests the root URL.
@@ -250,6 +257,7 @@ The CloudFront distribution argument layout is a complex structure composed of s
 * `origin_group` (Optional) - One or more [origin_group](#origin-group-arguments) for this distribution (multiples allowed).
 * `price_class` (Optional) - Price class for this distribution. One of `PriceClass_All`, `PriceClass_200`, `PriceClass_100`.
 * `restrictions` (Required) - The [restriction configuration](#restrictions-arguments) for this distribution (maximum one).
+* `staging` (Optional) - A Boolean that indicates whether this is a staging distribution. Defaults to `false`.
 * `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 * `viewer_certificate` (Required) - The [SSL configuration](#viewer-certificate-arguments) for this distribution (maximum one).
 * `web_acl_id` (Optional) - Unique identifier that specifies the AWS WAF web ACL, if any, to associate with this distribution. To specify a web ACL created using the latest version of AWS WAF (WAFv2), use the ACL ARN, for example `aws_wafv2_web_acl.example.arn`. To specify a web ACL created using AWS WAF Classic, use the ACL ID, for example `aws_waf_web_acl.example.id`. The WAF Web ACL must exist in the WAF Global (CloudFront) region and the credentials configuring this argument must have `waf:GetWebACL` permissions assigned.
@@ -378,8 +386,8 @@ argument should not be specified.
 * `origin_access_control_id` (Optional) - Unique identifier of a [CloudFront origin access control][8] for this origin.
 * `origin_id` (Required) - Unique identifier for the origin.
 * `origin_path` (Optional) - Optional element that causes CloudFront to request your content from a directory in your Amazon S3 bucket or your custom origin.
-* `origin_shield` - The [CloudFront Origin Shield](#origin-shield-arguments) configuration information. Using Origin Shield can help reduce the load on your origin. For more information, see [Using Origin Shield](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/origin-shield.html) in the Amazon CloudFront Developer Guide.
-* `s3_origin_config` - The [CloudFront S3 origin](#s3-origin-config-arguments) configuration information. If a custom origin is required, use `custom_origin_config` instead.
+* `origin_shield` - (Optional) [CloudFront Origin Shield](#origin-shield-arguments) configuration information. Using Origin Shield can help reduce the load on your origin. For more information, see [Using Origin Shield](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/origin-shield.html) in the Amazon CloudFront Developer Guide.
+* `s3_origin_config` - (Optional) [CloudFront S3 origin](#s3-origin-config-arguments) configuration information. If a custom origin is required, use `custom_origin_config` instead.
 
 ##### Custom Origin Config Arguments
 
@@ -393,7 +401,7 @@ argument should not be specified.
 ##### Origin Shield Arguments
 
 * `enabled` (Required) - Whether Origin Shield is enabled.
-* `origin_shield_region` (Required) - AWS Region for Origin Shield. To specify a region, use the region code, not the region name. For example, specify the US East (Ohio) region as us-east-2.
+* `origin_shield_region` (Optional) - AWS Region for Origin Shield. To specify a region, use the region code, not the region name. For example, specify the US East (Ohio) region as `us-east-2`.
 
 ##### S3 Origin Config Arguments
 
@@ -430,9 +438,9 @@ The arguments of `geo_restriction` are:
 * `minimum_protocol_version` - Minimum version of the SSL protocol that you want CloudFront to use for HTTPS connections. Can only be set if `cloudfront_default_certificate = false`. See all possible values in [this](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/secure-connections-supported-viewer-protocols-ciphers.html) table under "Security policy." Some examples include: `TLSv1.2_2019` and `TLSv1.2_2021`. Default: `TLSv1`. **NOTE**: If you are using a custom certificate (specified with `acm_certificate_arn` or `iam_certificate_id`), and have specified `sni-only` in `ssl_support_method`, `TLSv1` or later must be specified. If you have specified `vip` in `ssl_support_method`, only `SSLv3` or `TLSv1` can be specified. If you have specified `cloudfront_default_certificate`, `TLSv1` must be specified.
 * `ssl_support_method` - How you want CloudFront to serve HTTPS requests. One of `vip` or `sni-only`. Required if you specify `acm_certificate_arn` or `iam_certificate_id`. **NOTE:** `vip` causes CloudFront to use a dedicated IP address and may incur extra charges.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Identifier for the distribution. For example: `EDFDVBD632BHDS5`.
 * `arn` - ARN for the distribution. For example: `arn:aws:cloudfront::123456789012:distribution/EDFDVBD632BHDS5`, where `123456789012` is your AWS account ID.
@@ -466,8 +474,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-CloudFront Distributions can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudFront Distributions using the `id`. For example:
 
+```terraform
+import {
+  to = aws_cloudfront_distribution.distribution
+  id = "E74FTE3EXAMPLE"
+}
 ```
-$ terraform import aws_cloudfront_distribution.distribution E74FTE3EXAMPLE
+
+Using `terraform import`, import CloudFront Distributions using the `id`. For example:
+
+```console
+% terraform import aws_cloudfront_distribution.distribution E74FTE3EXAMPLE
 ```
diff --git a/website/docs/r/cloudfront_field_level_encryption_config.html.markdown b/website/docs/r/cloudfront_field_level_encryption_config.html.markdown
index f1941fe98d9..c0b3c1eadc3 100644
--- a/website/docs/r/cloudfront_field_level_encryption_config.html.markdown
+++ b/website/docs/r/cloudfront_field_level_encryption_config.html.markdown
@@ -42,7 +42,7 @@ resource "aws_cloudfront_field_level_encryption_config" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `comment` - (Optional) An optional comment about the Field Level Encryption Config.
 * `content_type_profile_config` - (Required) [Content Type Profile Config](#content-type-profile-config) specifies when to forward content if a content type isn't recognized and profiles to use as by default in a request if a query argument doesn't specify a profile to use.
@@ -69,9 +69,9 @@ The following arguments are supported:
 * `profile_id` - (Required) ID of profile to use for field-level encryption query argument-profile mapping
 * `query_arg` - (Required) Query argument for field-level encryption query argument-profile mapping.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `caller_reference` - Internal value used by CloudFront to allow future updates to the Field Level Encryption Config.
 * `etag` - The current version of the Field Level Encryption Config. For example: `E2QWRUHAPOMQZL`.
@@ -79,8 +79,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Cloudfront Field Level Encryption Config can be imported using the `id`, e.g.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Cloudfront Field Level Encryption Config using the `id`. For example:
 
+```terraform
+import {
+  to = aws_cloudfront_field_level_encryption_config.config
+  id = "E74FTE3AEXAMPLE"
+}
 ```
-$ terraform import aws_cloudfront_field_level_encryption_config.config E74FTE3AEXAMPLE
+
+Using `terraform import`, import Cloudfront Field Level Encryption Config using the `id`. For example:
+
+```console
+% terraform import aws_cloudfront_field_level_encryption_config.config E74FTE3AEXAMPLE
 ```
diff --git a/website/docs/r/cloudfront_field_level_encryption_profile.html.markdown b/website/docs/r/cloudfront_field_level_encryption_profile.html.markdown
index 4b5b0f7720e..fea7991f2f7 100644
--- a/website/docs/r/cloudfront_field_level_encryption_profile.html.markdown
+++ b/website/docs/r/cloudfront_field_level_encryption_profile.html.markdown
@@ -38,7 +38,7 @@ resource "aws_cloudfront_field_level_encryption_profile" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The name of the Field Level Encryption Profile.
 * `comment` - (Optional) An optional comment about the Field Level Encryption Profile.
@@ -50,9 +50,9 @@ The following arguments are supported:
 * `provider_id` - (Required) The provider associated with the public key being used for encryption.
 * `field_patterns` - (Required) Object that contains an attribute `items` that contains the list of field patterns in a field-level encryption content type profile specify the fields that you want to be encrypted.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `caller_reference` - Internal value used by CloudFront to allow future updates to the Field Level Encryption Profile.
 * `etag` - The current version of the Field Level Encryption Profile. For example: `E2QWRUHAPOMQZL`.
@@ -60,8 +60,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Cloudfront Field Level Encryption Profile can be imported using the `id`, e.g.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Cloudfront Field Level Encryption Profile using the `id`. For example:
 
+```terraform
+import {
+  to = aws_cloudfront_field_level_encryption_profile.profile
+  id = "K3D5EWEUDCCXON"
+}
 ```
-$ terraform import aws_cloudfront_field_level_encryption_profile.profile K3D5EWEUDCCXON
+
+Using `terraform import`, import Cloudfront Field Level Encryption Profile using the `id`. For example:
+
+```console
+% terraform import aws_cloudfront_field_level_encryption_profile.profile K3D5EWEUDCCXON
 ```
diff --git a/website/docs/r/cloudfront_function.html.markdown b/website/docs/r/cloudfront_function.html.markdown
index f9ec4801f23..aa6f1b1588d 100644
--- a/website/docs/r/cloudfront_function.html.markdown
+++ b/website/docs/r/cloudfront_function.html.markdown
@@ -41,9 +41,9 @@ The following arguments are optional:
 * `comment` - (Optional) Comment.
 * `publish` - (Optional) Whether to publish creation/change as Live CloudFront Function Version. Defaults to `true`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name (ARN) identifying your CloudFront Function.
 * `etag` - ETag hash of the function. This is the value for the `DEVELOPMENT` stage of the function.
@@ -52,8 +52,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-CloudFront Functions can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudFront Functions using the `name`. For example:
 
+```terraform
+import {
+  to = aws_cloudfront_function.test
+  id = "my_test_function"
+}
 ```
-$ terraform import aws_cloudfront_function.test my_test_function
+
+Using `terraform import`, import CloudFront Functions using the `name`. For example:
+
+```console
+% terraform import aws_cloudfront_function.test my_test_function
 ```
diff --git a/website/docs/r/cloudfront_key_group.html.markdown b/website/docs/r/cloudfront_key_group.html.markdown
index cec54c73abb..f5a11923be2 100644
--- a/website/docs/r/cloudfront_key_group.html.markdown
+++ b/website/docs/r/cloudfront_key_group.html.markdown
@@ -28,23 +28,32 @@ resource "aws_cloudfront_key_group" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `comment` - (Optional) A comment to describe the key group..
 * `items` - (Required) A list of the identifiers of the public keys in the key group.
 * `name` - (Required) A name to identify the key group.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `etag` - The identifier for this version of the key group.
 * `id` - The identifier for the key group.
 
 ## Import
 
-CloudFront Key Group can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudFront Key Group using the `id`. For example:
 
+```terraform
+import {
+  to = aws_cloudfront_key_group.example
+  id = "4b4f2r1c-315d-5c2e-f093-216t50jed10f"
+}
 ```
-$ terraform import aws_cloudfront_key_group.example 4b4f2r1c-315d-5c2e-f093-216t50jed10f
+
+Using `terraform import`, import CloudFront Key Group using the `id`. For example:
+
+```console
+% terraform import aws_cloudfront_key_group.example 4b4f2r1c-315d-5c2e-f093-216t50jed10f
 ```
diff --git a/website/docs/r/cloudfront_monitoring_subscription.html.markdown b/website/docs/r/cloudfront_monitoring_subscription.html.markdown
index 3f3806d7902..dfe6dadfc79 100644
--- a/website/docs/r/cloudfront_monitoring_subscription.html.markdown
+++ b/website/docs/r/cloudfront_monitoring_subscription.html.markdown
@@ -26,7 +26,7 @@ resource "aws_cloudfront_monitoring_subscription" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `distribution_id` - (Required) The ID of the distribution that you are enabling metrics for.
 * `monitoring_subscription` - (Required) A monitoring subscription. This structure contains information about whether additional CloudWatch metrics are enabled for a given CloudFront distribution.
@@ -39,16 +39,25 @@ The following arguments are supported:
 
 * `realtime_metrics_subscription_status` - (Required) A flag that indicates whether additional CloudWatch metrics are enabled for a given CloudFront distribution. Valid values are `Enabled` and `Disabled`. See below.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the CloudFront monitoring subscription, which corresponds to the `distribution_id`.
 
 ## Import
 
-CloudFront monitoring subscription can be imported using the id, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudFront monitoring subscription using the id. For example:
 
+```terraform
+import {
+  to = aws_cloudfront_monitoring_subscription.example
+  id = "E3QYSUHO4VYRGB"
+}
 ```
-$ terraform import aws_cloudfront_monitoring_subscription.example E3QYSUHO4VYRGB
+
+Using `terraform import`, import CloudFront monitoring subscription using the id. For example:
+
+```console
+% terraform import aws_cloudfront_monitoring_subscription.example E3QYSUHO4VYRGB
 ```
diff --git a/website/docs/r/cloudfront_origin_access_control.html.markdown b/website/docs/r/cloudfront_origin_access_control.html.markdown
index 7b2a3ec1710..32e24acf2f9 100644
--- a/website/docs/r/cloudfront_origin_access_control.html.markdown
+++ b/website/docs/r/cloudfront_origin_access_control.html.markdown
@@ -36,17 +36,26 @@ The following arguments are required:
 * `signing_behavior` - (Required) Specifies which requests CloudFront signs. Specify `always` for the most common use case. Allowed values: `always`, `never`, and `no-override`.
 * `signing_protocol` - (Required) Determines how CloudFront signs (authenticates) requests. The only valid value is `sigv4`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The unique identifier of this Origin Access Control.
 * `etag` - The current version of this Origin Access Control.
 
 ## Import
 
-CloudFront Origin Access Control can be imported using the `id`. For example:
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudFront Origin Access Control using the `id`. For example:
 
+```terraform
+import {
+  to = aws_cloudfront_origin_access_control.example
+  id = "E327GJI25M56DG"
+}
 ```
-$ terraform import aws_cloudfront_origin_access_control.example E327GJI25M56DG
+
+Using `terraform import`, import CloudFront Origin Access Control using the `id`. For example:
+
+```console
+% terraform import aws_cloudfront_origin_access_control.example E327GJI25M56DG
 ```
diff --git a/website/docs/r/cloudfront_origin_access_identity.html.markdown b/website/docs/r/cloudfront_origin_access_identity.html.markdown
index 8ebac062386..e7a2733916b 100644
--- a/website/docs/r/cloudfront_origin_access_identity.html.markdown
+++ b/website/docs/r/cloudfront_origin_access_identity.html.markdown
@@ -29,9 +29,9 @@ resource "aws_cloudfront_origin_access_identity" "example" {
 
 * `comment` (Optional) - An optional comment for the origin access identity.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The identifier for the distribution. For example: `EDFDVBD632BHDS5`.
 * `caller_reference` - Internal value used by CloudFront to allow future
@@ -100,8 +100,17 @@ resource "aws_s3_bucket_policy" "example" {
 
 ## Import
 
-Cloudfront Origin Access Identities can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Cloudfront Origin Access Identities using the `id`. For example:
 
+```terraform
+import {
+  to = aws_cloudfront_origin_access_identity.origin_access
+  id = "E74FTE3AEXAMPLE"
+}
 ```
-$ terraform import aws_cloudfront_origin_access_identity.origin_access E74FTE3AEXAMPLE
+
+Using `terraform import`, import Cloudfront Origin Access Identities using the `id`. For example:
+
+```console
+% terraform import aws_cloudfront_origin_access_identity.origin_access E74FTE3AEXAMPLE
 ```
diff --git a/website/docs/r/cloudfront_origin_request_policy.html.markdown b/website/docs/r/cloudfront_origin_request_policy.html.markdown
index 4410fb9300b..3e730614c16 100644
--- a/website/docs/r/cloudfront_origin_request_policy.html.markdown
+++ b/website/docs/r/cloudfront_origin_request_policy.html.markdown
@@ -40,7 +40,7 @@ resource "aws_cloudfront_origin_request_policy" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) Unique name to identify the origin request policy.
 * `comment` - (Optional) Comment to describe the origin request policy.
@@ -67,17 +67,26 @@ The following arguments are supported:
 
 `items` - (Required) List of item names (cookies, headers, or query strings).
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `etag` - The current version of the origin request policy.
 * `id` - The identifier for the origin request policy.
 
 ## Import
 
-Cloudfront Origin Request Policies can be imported using the `id`, e.g.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Cloudfront Origin Request Policies using the `id`. For example:
 
+```terraform
+import {
+  to = aws_cloudfront_origin_request_policy.policy
+  id = "ccca32ef-dce3-4df3-80df-1bd3000bc4d3"
+}
 ```
-$ terraform import aws_cloudfront_origin_request_policy.policy ccca32ef-dce3-4df3-80df-1bd3000bc4d3
+
+Using `terraform import`, import Cloudfront Origin Request Policies using the `id`. For example:
+
+```console
+% terraform import aws_cloudfront_origin_request_policy.policy ccca32ef-dce3-4df3-80df-1bd3000bc4d3
 ```
diff --git a/website/docs/r/cloudfront_public_key.html.markdown b/website/docs/r/cloudfront_public_key.html.markdown
index 99e3b474b2b..2ca3eb77783 100644
--- a/website/docs/r/cloudfront_public_key.html.markdown
+++ b/website/docs/r/cloudfront_public_key.html.markdown
@@ -22,7 +22,7 @@ resource "aws_cloudfront_public_key" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `comment` - (Optional) An optional comment about the public key.
 * `encoded_key` - (Required) The encoded public key that you want to add to CloudFront to use with features like field-level encryption.
@@ -31,9 +31,9 @@ The following arguments are supported:
 
 **NOTE:** When setting `encoded_key` value, there needs a newline at the end of string. Otherwise, multiple runs of terraform will want to recreate the `aws_cloudfront_public_key` resource.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `caller_reference` - Internal value used by CloudFront to allow future updates to the public key configuration.
 * `etag` - The current version of the public key. For example: `E2QWRUHAPOMQZL`.
@@ -41,8 +41,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-CloudFront Public Key can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudFront Public Key using the `id`. For example:
 
+```terraform
+import {
+  to = aws_cloudfront_public_key.example
+  id = "K3D5EWEUDCCXON"
+}
 ```
-$ terraform import aws_cloudfront_public_key.example K3D5EWEUDCCXON
+
+Using `terraform import`, import CloudFront Public Key using the `id`. For example:
+
+```console
+% terraform import aws_cloudfront_public_key.example K3D5EWEUDCCXON
 ```
diff --git a/website/docs/r/cloudfront_realtime_log_config.html.markdown b/website/docs/r/cloudfront_realtime_log_config.html.markdown
index 632d0859187..c7036249a8f 100644
--- a/website/docs/r/cloudfront_realtime_log_config.html.markdown
+++ b/website/docs/r/cloudfront_realtime_log_config.html.markdown
@@ -72,7 +72,7 @@ resource "aws_cloudfront_realtime_log_config" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `endpoint` - (Required) The Amazon Kinesis data streams where real-time log data is sent.
 * `fields` - (Required) The fields that are included in each real-time log record. See the [AWS documentation](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/real-time-logs.html#understand-real-time-log-config-fields) for supported values.
@@ -90,17 +90,26 @@ The `kinesis_stream_config` object supports the following:
 See the [AWS documentation](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/real-time-logs.html#understand-real-time-log-config-iam-role) for more information.
 * `stream_arn` - (Required) The ARN of the [Kinesis data stream](kinesis_stream.html).
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the CloudFront real-time log configuration.
 * `arn` - The ARN (Amazon Resource Name) of the CloudFront real-time log configuration.
 
 ## Import
 
-CloudFront real-time log configurations can be imported using the ARN, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudFront real-time log configurations using the ARN. For example:
 
+```terraform
+import {
+  to = aws_cloudfront_realtime_log_config.example
+  id = "arn:aws:cloudfront::111122223333:realtime-log-config/ExampleNameForRealtimeLogConfig"
+}
 ```
-$ terraform import aws_cloudfront_realtime_log_config.example arn:aws:cloudfront::111122223333:realtime-log-config/ExampleNameForRealtimeLogConfig
+
+Using `terraform import`, import CloudFront real-time log configurations using the ARN. For example:
+
+```console
+% terraform import aws_cloudfront_realtime_log_config.example arn:aws:cloudfront::111122223333:realtime-log-config/ExampleNameForRealtimeLogConfig
 ```
diff --git a/website/docs/r/cloudfront_response_headers_policy.html.markdown b/website/docs/r/cloudfront_response_headers_policy.html.markdown
index 4eb58acb9b4..15bd0c337f0 100644
--- a/website/docs/r/cloudfront_response_headers_policy.html.markdown
+++ b/website/docs/r/cloudfront_response_headers_policy.html.markdown
@@ -87,7 +87,7 @@ resource "aws_cloudfront_response_headers_policy" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) A unique name to identify the response headers policy.
 * `comment` - (Optional) A comment to describe the response headers policy. The comment cannot be longer than 128 characters.
@@ -154,7 +154,7 @@ The following arguments are supported:
 
 ### XSS Protection
 
-* `mode_block` - (Required) Whether CloudFront includes the `mode=block` directive in the `X-XSS-Protection` header.
+* `mode_block` - (Optional) Whether CloudFront includes the `mode=block` directive in the `X-XSS-Protection` header.
 * `override` - (Required) Whether CloudFront overrides the `X-XSS-Protection` HTTP response header received from the origin with the one specified in this response headers policy.
 * `protection` - (Required) A Boolean value that determines the value of the `X-XSS-Protection` HTTP response header. When this setting is `true`, the value of the `X-XSS-Protection` header is `1`. When this setting is `false`, the value of the `X-XSS-Protection` header is `0`.
 * `report_uri` - (Optional) A reporting URI, which CloudFront uses as the value of the report directive in the `X-XSS-Protection` header. You cannot specify a `report_uri` when `mode_block` is `true`.
@@ -164,17 +164,26 @@ The following arguments are supported:
 * `enabled` - (Required) A Whether CloudFront adds the `Server-Timing` header to HTTP responses that it sends in response to requests that match a cache behavior that's associated with this response headers policy.
 * `sampling_rate` - (Required) A number 0–100 (inclusive) that specifies the percentage of responses that you want CloudFront to add the Server-Timing header to. Valid range: Minimum value of 0.0. Maximum value of 100.0.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `etag` - The current version of the response headers policy.
 * `id` - The identifier for the response headers policy.
 
 ## Import
 
-Cloudfront Response Headers Policies can be imported using the `id`, e.g.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Cloudfront Response Headers Policies using the `id`. For example:
 
+```terraform
+import {
+  to = aws_cloudfront_response_headers_policy.policy
+  id = "658327ea-f89d-4fab-a63d-7e88639e58f9"
+}
 ```
-$ terraform import aws_cloudfront_response_headers_policy.policy 658327ea-f89d-4fab-a63d-7e88639e58f9
+
+Using `terraform import`, import Cloudfront Response Headers Policies using the `id`. For example:
+
+```console
+% terraform import aws_cloudfront_response_headers_policy.policy 658327ea-f89d-4fab-a63d-7e88639e58f9
 ```
diff --git a/website/docs/r/cloudhsm_v2_cluster.html.markdown b/website/docs/r/cloudhsm_v2_cluster.html.markdown
index 264c2efff00..474356eb477 100644
--- a/website/docs/r/cloudhsm_v2_cluster.html.markdown
+++ b/website/docs/r/cloudhsm_v2_cluster.html.markdown
@@ -62,16 +62,16 @@ resource "aws_cloudhsm_v2_cluster" "cloudhsm_v2_cluster" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `source_backup_identifier` - (Optional) ID of Cloud HSM v2 cluster backup to be restored.
 * `hsm_type` - (Required) The type of HSM module in the cluster. Currently, only `hsm1.medium` is supported.
 * `subnet_ids` - (Required) The IDs of subnets in which cluster will operate.
 * `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `cluster_id` - The id of the CloudHSM cluster.
 * `cluster_state` - The state of the CloudHSM cluster.
@@ -90,8 +90,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-CloudHSM v2 Clusters can be imported using the `cluster id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudHSM v2 Clusters using the cluster `id`. For example:
 
+```terraform
+import {
+  to = aws_cloudhsm_v2_cluster.test_cluster
+  id = "cluster-aeb282a201"
+}
 ```
-$ terraform import aws_cloudhsm_v2_cluster.test_cluster cluster-aeb282a201
+
+Using `terraform import`, import CloudHSM v2 Clusters using the cluster `id`. For example:
+
+```console
+% terraform import aws_cloudhsm_v2_cluster.test_cluster cluster-aeb282a201
 ```
diff --git a/website/docs/r/cloudhsm_v2_hsm.html.markdown b/website/docs/r/cloudhsm_v2_hsm.html.markdown
index e03caf78973..23658d91316 100644
--- a/website/docs/r/cloudhsm_v2_hsm.html.markdown
+++ b/website/docs/r/cloudhsm_v2_hsm.html.markdown
@@ -27,7 +27,7 @@ resource "aws_cloudhsm_v2_hsm" "cloudhsm_v2_hsm" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 ~> **NOTE:** Either `subnet_id` or `availability_zone` must be specified.
 
@@ -36,9 +36,9 @@ The following arguments are supported:
 * `availability_zone` - (Optional) The IDs of AZ in which HSM module will be located. Conflicts with `subnet_id`.
 * `ip_address` - (Optional) The IP address of HSM module. Must be within the CIDR of selected subnet.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `hsm_id` - The id of the HSM module.
 * `hsm_state` - The state of the HSM module.
@@ -46,8 +46,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-HSM modules can be imported using their HSM ID, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import HSM modules using their HSM ID. For example:
 
+```terraform
+import {
+  to = aws_cloudhsm_v2_hsm.bar
+  id = "hsm-quo8dahtaca"
+}
 ```
-$ terraform import aws_cloudhsm_v2_hsm.bar hsm-quo8dahtaca
+
+Using `terraform import`, import HSM modules using their HSM ID. For example:
+
+```console
+% terraform import aws_cloudhsm_v2_hsm.bar hsm-quo8dahtaca
 ```
diff --git a/website/docs/r/cloudsearch_domain.html.markdown b/website/docs/r/cloudsearch_domain.html.markdown
index 504deaaac31..c41816ef8eb 100644
--- a/website/docs/r/cloudsearch_domain.html.markdown
+++ b/website/docs/r/cloudsearch_domain.html.markdown
@@ -47,7 +47,7 @@ resource "aws_cloudsearch_domain" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `endpoint_options` - (Optional) Domain endpoint options. Documented below.
 * `index_field` - (Optional) The index fields for documents added to the domain. Documented below.
@@ -85,9 +85,9 @@ This configuration block supports the following attributes:
 * `sort` - (Optional) You can enable the property to be sortable.
 * `source_fields` - (Optional) A comma-separated list of source fields to map to the field. Specifying a source field copies data from one field to another, enabling you to use the same source data in different ways by configuring different options for the fields.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The domain's ARN.
 * `document_service_endpoint` - The service endpoint for updating documents in a search domain.
@@ -104,8 +104,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-CloudSearch Domains can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudSearch Domains using the `name`. For example:
 
+```terraform
+import {
+  to = aws_cloudsearch_domain.example
+  id = "example-domain"
+}
 ```
-$ terraform import aws_cloudsearch_domain.example example-domain
+
+Using `terraform import`, import CloudSearch Domains using the `name`. For example:
+
+```console
+% terraform import aws_cloudsearch_domain.example example-domain
 ```
diff --git a/website/docs/r/cloudsearch_domain_service_access_policy.html.markdown b/website/docs/r/cloudsearch_domain_service_access_policy.html.markdown
index d37499e2386..ad352c1cef1 100644
--- a/website/docs/r/cloudsearch_domain_service_access_policy.html.markdown
+++ b/website/docs/r/cloudsearch_domain_service_access_policy.html.markdown
@@ -52,14 +52,14 @@ resource "aws_cloudsearch_domain_service_access_policy" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `access_policy` - (Required) The access rules you want to configure. These rules replace any existing rules. See the [AWS documentation](https://docs.aws.amazon.com/cloudsearch/latest/developerguide/configuring-access.html) for details.
 * `domain_name` - (Required) The CloudSearch domain name the policy applies to.
 
-## Attributes Reference
+## Attribute Reference
 
-No additional attributes are exported.
+This resource exports no additional attributes.
 
 ## Timeouts
 
@@ -70,8 +70,17 @@ No additional attributes are exported.
 
 ## Import
 
-CloudSearch domain service access policies can be imported using the domain name, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudSearch domain service access policies using the domain name. For example:
 
+```terraform
+import {
+  to = aws_cloudsearch_domain_service_access_policy.example
+  id = "example-domain"
+}
 ```
-$ terraform import aws_cloudsearch_domain_service_access_policy.example example-domain
+
+Using `terraform import`, import CloudSearch domain service access policies using the domain name. For example:
+
+```console
+% terraform import aws_cloudsearch_domain_service_access_policy.example example-domain
 ```
diff --git a/website/docs/r/cloudtrail.html.markdown b/website/docs/r/cloudtrail.html.markdown
index b5980b819c3..828534f1643 100644
--- a/website/docs/r/cloudtrail.html.markdown
+++ b/website/docs/r/cloudtrail.html.markdown
@@ -244,7 +244,7 @@ resource "aws_cloudtrail" "example" {
       field = "resources.ARN"
 
       #The trailing slash is intentional; do not exclude it.
-      equals = [
+      starts_with = [
         "${data.aws_s3_bucket.important-bucket-1.arn}/",
         "${data.aws_s3_bucket.important-bucket-2.arn}/"
       ]
@@ -277,7 +277,6 @@ resource "aws_cloudtrail" "example" {
     field_selector {
       field = "resources.ARN"
 
-      #The trailing slash is intentional; do not exclude it.
       equals = [
         "${data.aws_s3_bucket.important-bucket-3.arn}/important-prefix"
       ]
@@ -365,9 +364,9 @@ The following arguments are optional:
 * `not_starts_with` (Optional) - A list of values that excludes events that match the first few characters of the event record field specified as the value of `field`.
 * `starts_with` (Optional) - A list of values that includes events that match the first few characters of the event record field specified as the value of `field`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the trail.
 * `home_region` - Region in which the trail was created.
@@ -376,8 +375,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Cloudtrails can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Cloudtrails using the `name`. For example:
 
+```terraform
+import {
+  to = aws_cloudtrail.sample
+  id = "my-sample-trail"
+}
 ```
-$ terraform import aws_cloudtrail.sample my-sample-trail
+
+Using `terraform import`, import Cloudtrails using the `name`. For example:
+
+```console
+% terraform import aws_cloudtrail.sample my-sample-trail
 ```
diff --git a/website/docs/r/cloudtrail_event_data_store.html.markdown b/website/docs/r/cloudtrail_event_data_store.html.markdown
index fed2dff9861..a057e81bf83 100644
--- a/website/docs/r/cloudtrail_event_data_store.html.markdown
+++ b/website/docs/r/cloudtrail_event_data_store.html.markdown
@@ -76,7 +76,7 @@ resource "aws_cloudtrail_event_data_store" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 - `name` - (Required) The name of the event data store.
 - `advanced_event_selector` - (Optional) The advanced event selectors to use to select the events for the data store. For more information about how to use advanced event selectors, see [Log events by using advanced event selectors](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.html#creating-data-event-selectors-advanced) in the CloudTrail User Guide.
@@ -89,14 +89,14 @@ The following arguments are supported:
 
 ### Advanced Event Selector Arguments
 
-For **advanced_event_selector** the following attributes are supported.
+`advanced_event_selector` supports the following arguments:
 
 - `name` (Optional) - Specifies the name of the advanced event selector.
 - `field_selector` (Required) - Specifies the selector statements in an advanced event selector. Fields documented below.
 
 #### Field Selector Arguments
 
-For **field_selector** the following attributes are supported.
+`field_selector` supports the following arguments:
 
 - `field` (Required) - Specifies a field in an event record on which to filter events to be logged. You can specify only the following values: `readOnly`, `eventSource`, `eventName`, `eventCategory`, `resources.type`, `resources.ARN`.
 - `equals` (Optional) - A list of values that includes events that match the exact value of the event record field specified as the value of `field`. This is the only valid operator that you can use with the `readOnly`, `eventCategory`, and `resources.type` fields.
@@ -106,9 +106,9 @@ For **field_selector** the following attributes are supported.
 - `ends_with` (Optional) - A list of values that includes events that match the last few characters of the event record field specified as the value of `field`.
 - `not_ends_with` (Optional) - A list of values that excludes events that match the last few characters of the event record field specified as the value of `field`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 - `arn` - ARN of the event data store.
 - `id` - Name of the event data store.
@@ -116,8 +116,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Event data stores can be imported using their `arn`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import event data stores using their `arn`. For example:
 
+```terraform
+import {
+  to = aws_cloudtrail_event_data_store.example
+  id = "arn:aws:cloudtrail:us-east-1:123456789123:eventdatastore/22333815-4414-412c-b155-dd254033gfhf"
+}
 ```
-$ terraform import aws_cloudtrail_event_data_store.example arn:aws:cloudtrail:us-east-1:123456789123:eventdatastore/22333815-4414-412c-b155-dd254033gfhf
+
+Using `terraform import`, import event data stores using their `arn`. For example:
+
+```console
+% terraform import aws_cloudtrail_event_data_store.example arn:aws:cloudtrail:us-east-1:123456789123:eventdatastore/22333815-4414-412c-b155-dd254033gfhf
 ```
diff --git a/website/docs/r/cloudwatch_composite_alarm.html.markdown b/website/docs/r/cloudwatch_composite_alarm.html.markdown
index 6b6f8464cf3..a9ad21647b6 100644
--- a/website/docs/r/cloudwatch_composite_alarm.html.markdown
+++ b/website/docs/r/cloudwatch_composite_alarm.html.markdown
@@ -26,12 +26,22 @@ resource "aws_cloudwatch_composite_alarm" "example" {
 ALARM(${aws_cloudwatch_metric_alarm.alpha.alarm_name}) OR
 ALARM(${aws_cloudwatch_metric_alarm.bravo.alarm_name})
 EOF
+
+  actions_suppressor {
+    alarm            = "suppressor-alarm"
+    extension_period = 10
+    wait_period      = 20
+  }
 }
 ```
 
 ## Argument Reference
 
 * `actions_enabled` - (Optional, Forces new resource) Indicates whether actions should be executed during any changes to the alarm state of the composite alarm. Defaults to `true`.
+* `actions_suppressor` - (Optional) Actions will be suppressed if the suppressor alarm is in the ALARM state.
+    * `alarm` - (Required) Can be an AlarmName or an Amazon Resource Name (ARN) from an existing alarm.
+    * `extension_period` - (Required) The maximum time in seconds that the composite alarm waits after suppressor alarm goes out of the `ALARM` state. After this time, the composite alarm performs its actions.
+    * `wait_period` - (Required) The maximum time in seconds that the composite alarm waits for the suppressor alarm to go into the `ALARM` state. After this time, the composite alarm performs its actions.
 * `alarm_actions` - (Optional) The set of actions to execute when this alarm transitions to the `ALARM` state from any other state. Each action is specified as an ARN. Up to 5 actions are allowed.
 * `alarm_description` - (Optional) The description for the composite alarm.
 * `alarm_name` - (Required) The name for the composite alarm. This name must be unique within the region.
@@ -40,9 +50,9 @@ EOF
 * `ok_actions` - (Optional) The set of actions to execute when this alarm transitions to an `OK` state from any other state. Each action is specified as an ARN. Up to 5 actions are allowed.
 * `tags` - (Optional) A map of tags to associate with the alarm. Up to 50 tags are allowed. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The ARN of the composite alarm.
 * `id` - The ID of the composite alarm resource, which is equivalent to its `alarm_name`.
@@ -50,8 +60,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Use the `alarm_name` to import a CloudWatch Composite Alarm. For example:
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import a CloudWatch Composite Alarm using the `alarm_name`. For example:
 
+```terraform
+import {
+  to = aws_cloudwatch_composite_alarm.test
+  id = "my-alarm"
+}
 ```
-$ terraform import aws_cloudwatch_composite_alarm.test my-alarm
+
+Using `terraform import`, import a CloudWatch Composite Alarm using the `alarm_name`. For example:
+
+```console
+% terraform import aws_cloudwatch_composite_alarm.test my-alarm
 ```
diff --git a/website/docs/r/cloudwatch_dashboard.html.markdown b/website/docs/r/cloudwatch_dashboard.html.markdown
index 9b4a57fd158..2b7ba95048d 100644
--- a/website/docs/r/cloudwatch_dashboard.html.markdown
+++ b/website/docs/r/cloudwatch_dashboard.html.markdown
@@ -58,21 +58,30 @@ resource "aws_cloudwatch_dashboard" "main" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `dashboard_name` - (Required) The name of the dashboard.
 * `dashboard_body` - (Required) The detailed information about the dashboard, including what widgets are included and their location on the dashboard. You can read more about the body structure in the [documentation](https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/CloudWatch-Dashboard-Body-Structure.html).
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `dashboard_arn` - The Amazon Resource Name (ARN) of the dashboard.
 
 ## Import
 
-CloudWatch dashboards can be imported using the `dashboard_name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudWatch dashboards using the `dashboard_name`. For example:
 
+```terraform
+import {
+  to = aws_cloudwatch_dashboard.sample
+  id = "dashboard_name"
+}
 ```
-$ terraform import aws_cloudwatch_dashboard.sample dashboard_name
+
+Using `terraform import`, import CloudWatch dashboards using the `dashboard_name`. For example:
+
+```console
+% terraform import aws_cloudwatch_dashboard.sample dashboard_name
 ```
diff --git a/website/docs/r/cloudwatch_event_api_destination.html.markdown b/website/docs/r/cloudwatch_event_api_destination.html.markdown
index 115644db65a..be0d276497d 100644
--- a/website/docs/r/cloudwatch_event_api_destination.html.markdown
+++ b/website/docs/r/cloudwatch_event_api_destination.html.markdown
@@ -27,7 +27,7 @@ resource "aws_cloudwatch_event_api_destination" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The name of the new API Destination. The name must be unique for your account. Maximum of 64 characters consisting of numbers, lower/upper case letters, .,-,_.
 * `description` - (Optional) The description of the new API Destination. Maximum of 512 characters.
@@ -36,16 +36,25 @@ The following arguments are supported:
 * `invocation_rate_limit_per_second` - (Optional) Enter the maximum number of invocations per second to allow for this destination. Enter a value greater than 0 (default 300).
 * `connection_arn` - (Required) ARN of the EventBridge Connection to use for the API Destination.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The Amazon Resource Name (ARN) of the event API Destination.
 
 ## Import
 
-EventBridge API Destinations can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EventBridge API Destinations using the `name`. For example:
+
+```terraform
+import {
+  to = aws_cloudwatch_event_api_destination.test
+  id = "api-destination"
+}
+```
+
+Using `terraform import`, import EventBridge API Destinations using the `name`. For example:
 
 ```console
-$ terraform import aws_cloudwatch_event_api_destination.test api-destination
+% terraform import aws_cloudwatch_event_api_destination.test api-destination
 ```
diff --git a/website/docs/r/cloudwatch_event_archive.html.markdown b/website/docs/r/cloudwatch_event_archive.html.markdown
index a8e4ad5a25e..032856f3985 100644
--- a/website/docs/r/cloudwatch_event_archive.html.markdown
+++ b/website/docs/r/cloudwatch_event_archive.html.markdown
@@ -45,7 +45,7 @@ resource "aws_cloudwatch_event_archive" "order" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The name of the new event archive. The archive name cannot exceed 48 characters.
 * `event_source_arn` - (Required) Event bus source ARN from where these events should be archived.
@@ -53,16 +53,25 @@ The following arguments are supported:
 * `event_pattern` - (Optional) Instructs the new event archive to only capture events matched by this pattern. By default, it attempts to archive every event received in the `event_source_arn`.
 * `retention_days` - (Optional) The maximum number of days to retain events in the new event archive. By default, it archives indefinitely.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The Amazon Resource Name (ARN) of the event archive.
 
 ## Import
 
-Event Archive can be imported using their name, for example
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import an EventBridge archive using the `name`. For example:
+
+```terraform
+import {
+  to = aws_cloudwatch_event_archive.imported_event_archive.test
+  id = "order-archive"
+}
+```
+
+Using `terraform import`, import an EventBridge archive using the `name`. For example:
 
 ```console
-$ terraform import aws_cloudwatch_event_archive.imported_event_archive order-archive
+% terraform import aws_cloudwatch_event_archive.imported_event_archive order-archive
 ```
diff --git a/website/docs/r/cloudwatch_event_bus.html.markdown b/website/docs/r/cloudwatch_event_bus.html.markdown
index 2bfaccf58c5..1fe814860a7 100644
--- a/website/docs/r/cloudwatch_event_bus.html.markdown
+++ b/website/docs/r/cloudwatch_event_bus.html.markdown
@@ -33,23 +33,32 @@ resource "aws_cloudwatch_event_bus" "examplepartner" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The name of the new event bus. The names of custom event buses can't contain the / character. To create a partner event bus, ensure the `name` matches the `event_source_name`.
 * `event_source_name` (Optional) The partner event source that the new event bus will be matched with. Must match `name`.
 * `tags` - (Optional)  A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The Amazon Resource Name (ARN) of the event bus.
 * `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
 
 ## Import
 
-EventBridge event buses can be imported using the `name` (which can also be a partner event source name), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EventBridge event buses using the `name` (which can also be a partner event source name). For example:
+
+```terraform
+import {
+  to = aws_cloudwatch_event_bus.messenger
+  id = "chat-messages"
+}
+```
+
+Using `terraform import`, import EventBridge event buses using the `name` (which can also be a partner event source name). For example:
 
 ```console
-$ terraform import aws_cloudwatch_event_bus.messenger chat-messages
+% terraform import aws_cloudwatch_event_bus.messenger chat-messages
 ```
diff --git a/website/docs/r/cloudwatch_event_bus_policy.html.markdown b/website/docs/r/cloudwatch_event_bus_policy.html.markdown
index b5a9cc0c3ac..19bc5359716 100644
--- a/website/docs/r/cloudwatch_event_bus_policy.html.markdown
+++ b/website/docs/r/cloudwatch_event_bus_policy.html.markdown
@@ -136,22 +136,31 @@ resource "aws_cloudwatch_event_bus_policy" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `policy` - (Required) The text of the policy. For more information about building AWS IAM policy documents with Terraform, see the [AWS IAM Policy Document Guide](https://learn.hashicorp.com/terraform/aws/iam-policy).
 * `event_bus_name` - (Optional) The name of the event bus to set the permissions on.
   If you omit this, the permissions are set on the `default` event bus.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The name of the EventBridge event bus.
 
 ## Import
 
-EventBridge permissions can be imported using the `event_bus_name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import an EventBridge policy using the `event_bus_name`. For example:
 
-```shell
-$ terraform import aws_cloudwatch_event_bus_policy.DevAccountAccess example-event-bus
+```terraform
+import {
+  to = aws_cloudwatch_event_bus_policy.DevAccountAccess
+  id = "example-event-bus"
+}
+```
+
+Using `terraform import`, import an EventBridge policy using the `event_bus_name`. For example:
+
+```console
+% terraform import aws_cloudwatch_event_bus_policy.DevAccountAccess example-event-bus
 ```
diff --git a/website/docs/r/cloudwatch_event_connection.html.markdown b/website/docs/r/cloudwatch_event_connection.html.markdown
index 54af6dfbcdb..81097f892ee 100644
--- a/website/docs/r/cloudwatch_event_connection.html.markdown
+++ b/website/docs/r/cloudwatch_event_connection.html.markdown
@@ -133,7 +133,7 @@ resource "aws_cloudwatch_event_connection" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The name of the new connection. Maximum of 64 characters consisting of numbers, lower/upper case letters, .,-,_.
 * `description` - (Optional) Enter a description for the connection. Maximum of 512 characters.
@@ -183,17 +183,26 @@ The following arguments are supported:
     * `value` - (Required) The value associated with the key. Created and stored in AWS Secrets Manager if is secret.
     * `is_value_secret` - (Optional) Specified whether the value is secret.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The Amazon Resource Name (ARN) of the connection.
 * `secret_arn` - The Amazon Resource Name (ARN) of the secret created from the authorization parameters specified for the connection.
 
 ## Import
 
-EventBridge Connection can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EventBridge connection using the `name`. For example:
+
+```terraform
+import {
+  to = aws_cloudwatch_event_connection.test
+  id = "ngrok-connection"
+}
+```
+
+Using `terraform import`, import EventBridge EventBridge connection using the `name`. For example:
 
 ```console
-$ terraform import aws_cloudwatch_event_connection.test ngrok-connection
+% terraform import aws_cloudwatch_event_connection.test ngrok-connection
 ```
diff --git a/website/docs/r/cloudwatch_event_endpoint.html.markdown b/website/docs/r/cloudwatch_event_endpoint.html.markdown
index 9ad024d259c..21643660c8b 100644
--- a/website/docs/r/cloudwatch_event_endpoint.html.markdown
+++ b/website/docs/r/cloudwatch_event_endpoint.html.markdown
@@ -46,7 +46,7 @@ resource "aws_cloudwatch_event_endpoint" "this" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `description` - (Optional) A description of the global endpoint.
 * `event_bus` - (Required) The event buses to use. The names of the event buses must be identical in each Region. Exactly two event buses are required. Documented below.
@@ -80,17 +80,26 @@ The following arguments are supported:
 
 * `route` - (Required) The name of the secondary Region.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The ARN of the endpoint that was created.
 * `endpoint_url` - The URL of the endpoint that was created.
 
 ## Import
 
-EventBridge Global Endpoints can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EventBridge Global Endpoints using the `name`. For example:
 
-```shell
-$ terraform import aws_cloudwatch_event_endpoint.imported_endpoint example-endpoint
+```terraform
+import {
+  to = aws_cloudwatch_event_endpoint.imported_endpoint
+  id = "example-endpoint"
+}
+```
+
+Using `terraform import`, import EventBridge Global Endpoints using the `name`. For example:
+
+```console
+% terraform import aws_cloudwatch_event_endpoint.imported_endpoint example-endpoint
 ```
diff --git a/website/docs/r/cloudwatch_event_permission.html.markdown b/website/docs/r/cloudwatch_event_permission.html.markdown
index 4d3bd3cc793..b67f81f3275 100644
--- a/website/docs/r/cloudwatch_event_permission.html.markdown
+++ b/website/docs/r/cloudwatch_event_permission.html.markdown
@@ -42,7 +42,7 @@ resource "aws_cloudwatch_event_permission" "OrganizationAccess" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `principal` - (Required) The 12-digit AWS account ID that you are permitting to put events to your default event bus. Specify `*` to permit any account to put events to your default event bus, optionally limited by `condition`.
 * `statement_id` - (Required) An identifier string for the external account that you are granting permissions to.
@@ -57,16 +57,25 @@ The following arguments are supported:
 * `type` - (Required) Type of condition. Value values: `StringEquals`.
 * `value` - (Required) Value for the key.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The statement ID of the EventBridge permission.
 
 ## Import
 
-EventBridge permissions can be imported using the `event_bus_name/statement_id` (if you omit `event_bus_name`, the `default` event bus will be used), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EventBridge permissions using the `event_bus_name/statement_id` (if you omit `event_bus_name`, the `default` event bus will be used). For example:
 
-```shell
-$ terraform import aws_cloudwatch_event_permission.DevAccountAccess example-event-bus/DevAccountAccess
+```terraform
+import {
+  to = aws_cloudwatch_event_permission.DevAccountAccess
+  id = "example-event-bus/DevAccountAccess"
+}
+```
+
+Using `terraform import`, import EventBridge permissions using the `event_bus_name/statement_id` (if you omit `event_bus_name`, the `default` event bus will be used). For example:
+
+```console
+% terraform import aws_cloudwatch_event_permission.DevAccountAccess example-event-bus/DevAccountAccess
 ```
diff --git a/website/docs/r/cloudwatch_event_rule.html.markdown b/website/docs/r/cloudwatch_event_rule.html.markdown
index ac13e34d7b0..e58fa1101b3 100644
--- a/website/docs/r/cloudwatch_event_rule.html.markdown
+++ b/website/docs/r/cloudwatch_event_rule.html.markdown
@@ -58,10 +58,10 @@ data "aws_iam_policy_document" "sns_topic_policy" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Optional) The name of the rule. If omitted, Terraform will assign a random, unique name. Conflicts with `name_prefix`.
-* `name_prefix` - (Optional) Creates a unique name beginning with the specified prefix. Conflicts with `name`.
+* `name_prefix` - (Optional) Creates a unique name beginning with the specified prefix. Conflicts with `name`. **Note**: Due to the length of the generated suffix, must be 38 characters or less.
 * `schedule_expression` - (Optional) The scheduling expression. For example, `cron(0 20 * * ? *)` or `rate(5 minutes)`. At least one of `schedule_expression` or `event_pattern` is required. Can only be used on the default event bus. For more information, refer to the AWS documentation [Schedule Expressions for Rules](https://docs.aws.amazon.com/AmazonCloudWatch/latest/events/ScheduledEvents.html).
 * `event_bus_name` - (Optional) The name or ARN of the event bus to associate with this rule.
   If you omit this, the `default` event bus is used.
@@ -71,9 +71,9 @@ The following arguments are supported:
 * `is_enabled` - (Optional) Whether the rule should be enabled (defaults to `true`).
 * `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The name of the rule.
 * `arn` - The Amazon Resource Name (ARN) of the rule.
@@ -81,8 +81,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-EventBridge Rules can be imported using the `event_bus_name/rule_name` (if you omit `event_bus_name`, the `default` event bus will be used), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EventBridge Rules using the `event_bus_name/rule_name` (if you omit `event_bus_name`, the `default` event bus will be used). For example:
 
+```terraform
+import {
+  to = aws_cloudwatch_event_rule.console
+  id = "example-event-bus/capture-console-sign-in"
+}
 ```
-$ terraform import aws_cloudwatch_event_rule.console example-event-bus/capture-console-sign-in
+
+Using `terraform import`, import EventBridge Rules using the `event_bus_name/rule_name` (if you omit `event_bus_name`, the `default` event bus will be used). For example:
+
+```console
+% terraform import aws_cloudwatch_event_rule.console example-event-bus/capture-console-sign-in
 ```
diff --git a/website/docs/r/cloudwatch_event_target.html.markdown b/website/docs/r/cloudwatch_event_target.html.markdown
index 642a87dad7b..cd466439909 100644
--- a/website/docs/r/cloudwatch_event_target.html.markdown
+++ b/website/docs/r/cloudwatch_event_target.html.markdown
@@ -453,7 +453,7 @@ resource "aws_cloudwatch_event_target" "example" {
 -> **Note:** In order to be able to have your AWS Lambda function or
    SNS topic invoked by an EventBridge rule, you must set up the right permissions
    using [`aws_lambda_permission`](/docs/providers/aws/r/lambda_permission.html)
-   or [`aws_sns_topic.policy`](/docs/providers/aws/r/sns_topic.html#policy).
+   or [`aws_sns_topic_policy`](/docs/providers/aws/r/sns_topic_policy.html).
    More info [here](https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-use-resource-based.html).
 
 The following arguments are required:
@@ -477,6 +477,7 @@ The following arguments are optional:
 * `run_command_targets` - (Optional) Parameters used when you are using the rule to invoke Amazon EC2 Run Command. Documented below. A maximum of 5 are allowed.
 * `redshift_target` - (Optional) Parameters used when you are using the rule to invoke an Amazon Redshift Statement. Documented below. A maximum of 1 are allowed.
 * `retry_policy` - (Optional)  Parameters used when you are providing retry policies. Documented below. A maximum of 1 are allowed.
+* `sagemaker_pipeline_target` - (Optional) Parameters used when you are using the rule to invoke an Amazon SageMaker Pipeline. Documented below. A maximum of 1 are allowed.
 * `sqs_target` - (Optional) Parameters used when you are using the rule to invoke an Amazon SQS Queue. Documented below. A maximum of 1 are allowed.
 * `target_id` - (Optional) The unique target assignment ID. If missing, will generate a random, unique id.
 
@@ -572,14 +573,32 @@ For more information, see [Task Networking](https://docs.aws.amazon.com/AmazonEC
 
 * `message_group_id` - (Optional) The FIFO message group ID to use as the target.
 
-## Attributes Reference
+### sagemaker_pipeline_target
 
-No additional attributes are exported.
+* `pipeline_parameter_list` - (Optional) List of Parameter names and values for SageMaker Model Building Pipeline execution.
+
+#### pipeline_parameter_list
+
+* `name` - (Required) Name of parameter to start execution of a SageMaker Model Building Pipeline.
+* `value` - (Required) Value of parameter to start execution of a SageMaker Model Building Pipeline.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
 
 ## Import
 
-EventBridge Targets can be imported using `event_bus_name/rule-name/target-id` (if you omit `event_bus_name`, the `default` event bus will be used).
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EventBridge Targets using `event_bus_name/rule-name/target-id` (if you omit `event_bus_name`, the `default` event bus will be used). For example:
+
+ ```terraform
+import {
+  to = aws_cloudwatch_event_target.test-event-target
+  id = "rule-name/target-id"
+}
+```
+
+Using `terraform import`, import EventBridge Targets using `event_bus_name/rule-name/target-id` (if you omit `event_bus_name`, the `default` event bus will be used). For example:
 
- ```
-$ terraform import aws_cloudwatch_event_target.test-event-target rule-name/target-id
+ ```console
+% terraform import aws_cloudwatch_event_target.test-event-target rule-name/target-id
 ```
diff --git a/website/docs/r/cloudwatch_log_data_protection_policy.html.markdown b/website/docs/r/cloudwatch_log_data_protection_policy.html.markdown
index 1a701c982d4..5f9a5ac90d3 100644
--- a/website/docs/r/cloudwatch_log_data_protection_policy.html.markdown
+++ b/website/docs/r/cloudwatch_log_data_protection_policy.html.markdown
@@ -60,19 +60,28 @@ resource "aws_cloudwatch_log_data_protection_policy" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `log_group_name` - (Required) The name of the log group under which the log stream is to be created.
 * `policy_document` - (Required) Specifies the data protection policy in JSON. Read more at [Data protection policy syntax](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/mask-sensitive-log-data-start.html#mask-sensitive-log-data-policysyntax).
 
-## Attributes Reference
+## Attribute Reference
 
-No additional attributes are exported.
+This resource exports no additional attributes.
 
 ## Import
 
-This resource can be imported using the `log_group_name`. For example:
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import this resource using the `log_group_name`. For example:
 
+```terraform
+import {
+  to = aws_cloudwatch_log_data_protection_policy.example
+  id = "my-log-group"
+}
 ```
-$ terraform import aws_cloudwatch_log_data_protection_policy.example my-log-group
+
+Using `terraform import`, import this resource using the `log_group_name`. For example:
+
+```console
+% terraform import aws_cloudwatch_log_data_protection_policy.example my-log-group
 ```
diff --git a/website/docs/r/cloudwatch_log_destination.html.markdown b/website/docs/r/cloudwatch_log_destination.html.markdown
index 62d930ed003..d31edbb011e 100644
--- a/website/docs/r/cloudwatch_log_destination.html.markdown
+++ b/website/docs/r/cloudwatch_log_destination.html.markdown
@@ -22,24 +22,33 @@ resource "aws_cloudwatch_log_destination" "test_destination" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) A name for the log destination.
 * `role_arn` - (Required) The ARN of an IAM role that grants Amazon CloudWatch Logs permissions to put data into the target.
 * `target_arn` - (Required) The ARN of the target Amazon Kinesis stream resource for the destination.
 * `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The Amazon Resource Name (ARN) specifying the log destination.
 * `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
 
 ## Import
 
-CloudWatch Logs destinations can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudWatch Logs destinations using the `name`. For example:
 
+```terraform
+import {
+  to = aws_cloudwatch_log_destination.test_destination
+  id = "test_destination"
+}
 ```
-$ terraform import aws_cloudwatch_log_destination.test_destination test_destination
+
+Using `terraform import`, import CloudWatch Logs destinations using the `name`. For example:
+
+```console
+% terraform import aws_cloudwatch_log_destination.test_destination test_destination
 ```
diff --git a/website/docs/r/cloudwatch_log_destination_policy.html.markdown b/website/docs/r/cloudwatch_log_destination_policy.html.markdown
index 92b21d0f14d..0b44ead3211 100644
--- a/website/docs/r/cloudwatch_log_destination_policy.html.markdown
+++ b/website/docs/r/cloudwatch_log_destination_policy.html.markdown
@@ -49,20 +49,29 @@ resource "aws_cloudwatch_log_destination_policy" "test_destination_policy" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `destination_name` - (Required) A name for the subscription filter
 * `access_policy` - (Required) The policy document. This is a JSON formatted string.
 * `force_update` - (Optional) Specify true if you are updating an existing destination policy to grant permission to an organization ID instead of granting permission to individual AWS accounts.
 
-## Attributes Reference
+## Attribute Reference
 
-No additional attributes are exported.
+This resource exports no additional attributes.
 
 ## Import
 
-CloudWatch Logs destination policies can be imported using the `destination_name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudWatch Logs destination policies using the `destination_name`. For example:
 
+```terraform
+import {
+  to = aws_cloudwatch_log_destination_policy.test_destination_policy
+  id = "test_destination"
+}
 ```
-$ terraform import aws_cloudwatch_log_destination_policy.test_destination_policy test_destination
+
+Using `terraform import`, import CloudWatch Logs destination policies using the `destination_name`. For example:
+
+```console
+% terraform import aws_cloudwatch_log_destination_policy.test_destination_policy test_destination
 ```
diff --git a/website/docs/r/cloudwatch_log_group.html.markdown b/website/docs/r/cloudwatch_log_group.html.markdown
index 52b6b67a25c..9a0ef0e5272 100644
--- a/website/docs/r/cloudwatch_log_group.html.markdown
+++ b/website/docs/r/cloudwatch_log_group.html.markdown
@@ -25,7 +25,7 @@ resource "aws_cloudwatch_log_group" "yada" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Optional, Forces new resource) The name of the log group. If omitted, Terraform will assign a random, unique name.
 * `name_prefix` - (Optional, Forces new resource) Creates a unique name beginning with the specified prefix. Conflicts with `name`.
@@ -38,17 +38,26 @@ AWS CloudWatch Logs stops encrypting newly ingested data for the log group. All
 permissions for the CMK whenever the encrypted data is requested.
 * `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The Amazon Resource Name (ARN) specifying the log group. Any `:*` suffix added by the API, denoting all CloudWatch Log Streams under the CloudWatch Log Group, is removed for greater compatibility with other AWS services that do not accept the suffix.
 * `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
 
 ## Import
 
-Cloudwatch Log Groups can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Cloudwatch Log Groups using the `name`. For example:
 
+```terraform
+import {
+  to = aws_cloudwatch_log_group.test_group
+  id = "yada"
+}
 ```
-$ terraform import aws_cloudwatch_log_group.test_group yada
+
+Using `terraform import`, import Cloudwatch Log Groups using the `name`. For example:
+
+```console
+% terraform import aws_cloudwatch_log_group.test_group yada
 ```
diff --git a/website/docs/r/cloudwatch_log_metric_filter.html.markdown b/website/docs/r/cloudwatch_log_metric_filter.html.markdown
index 6eb82644b8c..9cadc51484f 100644
--- a/website/docs/r/cloudwatch_log_metric_filter.html.markdown
+++ b/website/docs/r/cloudwatch_log_metric_filter.html.markdown
@@ -32,7 +32,7 @@ resource "aws_cloudwatch_log_group" "dada" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) A name for the metric filter.
 * `pattern` - (Required) A valid [CloudWatch Logs filter pattern](https://docs.aws.amazon.com/AmazonCloudWatch/latest/DeveloperGuide/FilterAndPatternSyntax.html)
@@ -49,16 +49,25 @@ The `metric_transformation` block supports the following arguments:
 * `dimensions` - (Optional) Map of fields to use as dimensions for the metric. Up to 3 dimensions are allowed. Conflicts with `default_value`.
 * `unit` - (Optional) The unit to assign to the metric. If you omit this, the unit is set as `None`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The name of the metric filter.
 
 ## Import
 
-CloudWatch Log Metric Filter can be imported using the `log_group_name:name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudWatch Log Metric Filter using the `log_group_name:name`. For example:
 
+```terraform
+import {
+  to = aws_cloudwatch_log_metric_filter.test
+  id = "/aws/lambda/function:test"
+}
 ```
-$ terraform import aws_cloudwatch_log_metric_filter.test /aws/lambda/function:test
+
+Using `terraform import`, import CloudWatch Log Metric Filter using the `log_group_name:name`. For example:
+
+```console
+% terraform import aws_cloudwatch_log_metric_filter.test /aws/lambda/function:test
 ```
diff --git a/website/docs/r/cloudwatch_log_resource_policy.html.markdown b/website/docs/r/cloudwatch_log_resource_policy.html.markdown
index 8fb30acb65e..9b692765ac5 100644
--- a/website/docs/r/cloudwatch_log_resource_policy.html.markdown
+++ b/website/docs/r/cloudwatch_log_resource_policy.html.markdown
@@ -65,21 +65,30 @@ resource "aws_cloudwatch_log_resource_policy" "route53-query-logging-policy" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `policy_document` - (Required) Details of the resource policy, including the identity of the principal that is enabled to put logs to this account. This is formatted as a JSON string. Maximum length of 5120 characters.
 * `policy_name` - (Required) Name of the resource policy.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The name of the CloudWatch log resource policy
 
 ## Import
 
-CloudWatch log resource policies can be imported using the policy name, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudWatch log resource policies using the policy name. For example:
 
+```terraform
+import {
+  to = aws_cloudwatch_log_resource_policy.MyPolicy
+  id = "MyPolicy"
+}
 ```
-$ terraform import aws_cloudwatch_log_resource_policy.MyPolicy MyPolicy
+
+Using `terraform import`, import CloudWatch log resource policies using the policy name. For example:
+
+```console
+% terraform import aws_cloudwatch_log_resource_policy.MyPolicy MyPolicy
 ```
diff --git a/website/docs/r/cloudwatch_log_stream.html.markdown b/website/docs/r/cloudwatch_log_stream.html.markdown
index 424ffa5ec87..3ccefbbdc72 100644
--- a/website/docs/r/cloudwatch_log_stream.html.markdown
+++ b/website/docs/r/cloudwatch_log_stream.html.markdown
@@ -25,21 +25,30 @@ resource "aws_cloudwatch_log_stream" "foo" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The name of the log stream. Must not be longer than 512 characters and must not contain `:`
 * `log_group_name` - (Required) The name of the log group under which the log stream is to be created.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The Amazon Resource Name (ARN) specifying the log stream.
 
 ## Import
 
-Cloudwatch Log Stream can be imported using the stream's `log_group_name` and `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Cloudwatch Log Stream using the stream's `log_group_name` and `name`. For example:
 
+```terraform
+import {
+  to = aws_cloudwatch_log_stream.foo
+  id = "Yada:SampleLogStream1234"
+}
 ```
-$ terraform import aws_cloudwatch_log_stream.foo Yada:SampleLogStream1234
+
+Using `terraform import`, import Cloudwatch Log Stream using the stream's `log_group_name` and `name`. For example:
+
+```console
+% terraform import aws_cloudwatch_log_stream.foo Yada:SampleLogStream1234
 ```
diff --git a/website/docs/r/cloudwatch_log_subscription_filter.html.markdown b/website/docs/r/cloudwatch_log_subscription_filter.html.markdown
index d4a26549144..809766f28fe 100644
--- a/website/docs/r/cloudwatch_log_subscription_filter.html.markdown
+++ b/website/docs/r/cloudwatch_log_subscription_filter.html.markdown
@@ -25,7 +25,7 @@ resource "aws_cloudwatch_log_subscription_filter" "test_lambdafunction_logfilter
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) A name for the subscription filter
 * `destination_arn` - (Required) The ARN of the destination to deliver matching log events to. Kinesis stream or Lambda function ARN.
@@ -34,14 +34,23 @@ The following arguments are supported:
 * `role_arn` - (Optional) The ARN of an IAM role that grants Amazon CloudWatch Logs permissions to deliver ingested log events to the destination. If you use Lambda as a destination, you should skip this argument and use `aws_lambda_permission` resource for granting access from CloudWatch logs to the destination Lambda function.
 * `distribution` - (Optional) The method used to distribute log data to the destination. By default log data is grouped by log stream, but the grouping can be set to random for a more even distribution. This property is only applicable when the destination is an Amazon Kinesis stream. Valid values are "Random" and "ByLogStream".
 
-## Attributes Reference
+## Attribute Reference
 
-No additional attributes are exported.
+This resource exports no additional attributes.
 
 ## Import
 
-CloudWatch Logs subscription filter can be imported using the log group name and subscription filter name separated by `|`.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudWatch Logs subscription filter using the log group name and subscription filter name separated by `|`. For example:
 
+```terraform
+import {
+  to = aws_cloudwatch_log_subscription_filter.test_lambdafunction_logfilter
+  id = "/aws/lambda/example_lambda_name|test_lambdafunction_logfilter"
+}
 ```
-$ terraform import aws_cloudwatch_log_subscription_filter.test_lambdafunction_logfilter /aws/lambda/example_lambda_name|test_lambdafunction_logfilter
+
+Using `terraform import`, import CloudWatch Logs subscription filter using the log group name and subscription filter name separated by `|`. For example:
+
+```console
+% terraform import aws_cloudwatch_log_subscription_filter.test_lambdafunction_logfilter /aws/lambda/example_lambda_name|test_lambdafunction_logfilter
 ```
diff --git a/website/docs/r/cloudwatch_metric_alarm.html.markdown b/website/docs/r/cloudwatch_metric_alarm.html.markdown
index df7f996bced..b468e10f65b 100644
--- a/website/docs/r/cloudwatch_metric_alarm.html.markdown
+++ b/website/docs/r/cloudwatch_metric_alarm.html.markdown
@@ -174,7 +174,7 @@ You must choose one or the other
 See [related part of AWS Docs](https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_PutMetricAlarm.html)
 for details about valid values.
 
-The following arguments are supported:
+This argument supports the following arguments:
 
 * `alarm_name` - (Required) The descriptive name for the alarm. This name must be unique within the user's AWS account
 * `comparison_operator` - (Required) The arithmetic operation to use when comparing the specified Statistic and Threshold. The specified Statistic value is used as the first operand. Either of the following is supported: `GreaterThanOrEqualToThreshold`, `GreaterThanThreshold`, `LessThanThreshold`, `LessThanOrEqualToThreshold`. Additionally, the values  `LessThanLowerOrGreaterThanUpperThreshold`, `LessThanLowerThreshold`, and `GreaterThanUpperThreshold` are used only for alarms based on anomaly detection models.
@@ -238,9 +238,9 @@ The following values are supported: `ignore`, and `evaluate`.
    See docs for [supported statistics](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Statistics-definitions.html).
 * `unit` - (Optional) The unit for this metric.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The ARN of the CloudWatch Metric Alarm.
 * `id` - The ID of the health check.
@@ -248,8 +248,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-CloudWatch Metric Alarm can be imported using the `alarm_name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudWatch Metric Alarm using the `alarm_name`. For example:
 
+```terraform
+import {
+  to = aws_cloudwatch_metric_alarm.test
+  id = "alarm-12345"
+}
 ```
-$ terraform import aws_cloudwatch_metric_alarm.test alarm-12345
+
+Using `terraform import`, import CloudWatch Metric Alarm using the `alarm_name`. For example:
+
+```console
+% terraform import aws_cloudwatch_metric_alarm.test alarm-12345
 ```
diff --git a/website/docs/r/cloudwatch_metric_stream.html.markdown b/website/docs/r/cloudwatch_metric_stream.html.markdown
index 9d4af7f6700..8a027944ffa 100644
--- a/website/docs/r/cloudwatch_metric_stream.html.markdown
+++ b/website/docs/r/cloudwatch_metric_stream.html.markdown
@@ -206,9 +206,9 @@ The following arguments are optional:
 * `metric_name` - (Required) The name of the metric.
 * `namespace` - (Required) The namespace of the metric.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the metric stream.
 * `creation_date` - Date and time in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8) that the metric stream was created.
@@ -218,8 +218,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-CloudWatch metric streams can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudWatch metric streams using the `name`. For example:
 
+```terraform
+import {
+  to = aws_cloudwatch_metric_stream.sample
+  id = "sample-stream-name"
+}
 ```
-$ terraform import aws_cloudwatch_metric_stream.sample sample-stream-name
+
+Using `terraform import`, import CloudWatch metric streams using the `name`. For example:
+
+```console
+% terraform import aws_cloudwatch_metric_stream.sample sample-stream-name
 ```
diff --git a/website/docs/r/cloudwatch_query_definition.html.markdown b/website/docs/r/cloudwatch_query_definition.html.markdown
index e931805605b..7fcf82593bb 100644
--- a/website/docs/r/cloudwatch_query_definition.html.markdown
+++ b/website/docs/r/cloudwatch_query_definition.html.markdown
@@ -31,22 +31,31 @@ EOF
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The name of the query.
 * `query_string` - (Required) The query to save. You can read more about CloudWatch Logs Query Syntax in the [documentation](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_QuerySyntax.html).
 * `log_group_names` - (Optional) Specific log groups to use with the query.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `query_definition_id` - The query definition ID.
 
 ## Import
 
-CloudWatch query definitions can be imported using the query definition ARN. The ARN can be found on the "Edit Query" page for the query in the AWS Console.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudWatch query definitions using the query definition ARN. The ARN can be found on the "Edit Query" page for the query in the AWS Console. For example:
 
+```terraform
+import {
+  to = aws_cloudwatch_query_definition.example
+  id = "arn:aws:logs:us-west-2:123456789012:query-definition:269951d7-6f75-496d-9d7b-6b7a5486bdbd"
+}
 ```
-$ terraform import aws_cloudwatch_query_definition.example arn:aws:logs:us-west-2:123456789012:query-definition:269951d7-6f75-496d-9d7b-6b7a5486bdbd
+
+Using `terraform import`, import CloudWatch query definitions using the query definition ARN. The ARN can be found on the "Edit Query" page for the query in the AWS Console. For example:
+
+```console
+% terraform import aws_cloudwatch_query_definition.example arn:aws:logs:us-west-2:123456789012:query-definition:269951d7-6f75-496d-9d7b-6b7a5486bdbd
 ```
diff --git a/website/docs/r/codeartifact_domain.html.markdown b/website/docs/r/codeartifact_domain.html.markdown
index 6e876cd38ef..4e5f41127a7 100644
--- a/website/docs/r/codeartifact_domain.html.markdown
+++ b/website/docs/r/codeartifact_domain.html.markdown
@@ -20,15 +20,15 @@ resource "aws_codeartifact_domain" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `domain` - (Required) The name of the domain to create. All domain names in an AWS Region that are in the same AWS account must be unique. The domain name is used as the prefix in DNS hostnames. Do not use sensitive information in a domain name because it is publicly discoverable.
 * `encryption_key` - (Optional) The encryption key for the domain. This is used to encrypt content stored in a domain. The KMS Key Amazon Resource Name (ARN). The default aws/codeartifact AWS KMS master key is used if this element is absent.
 * `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ARN of the Domain.
 * `arn` - The ARN of the Domain.
@@ -40,8 +40,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-CodeArtifact Domain can be imported using the CodeArtifact Domain arn, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CodeArtifact Domain using the CodeArtifact Domain arn. For example:
 
+```terraform
+import {
+  to = aws_codeartifact_domain.example
+  id = "arn:aws:codeartifact:us-west-2:012345678912:domain/tf-acc-test-8593714120730241305"
+}
 ```
-$ terraform import aws_codeartifact_domain.example arn:aws:codeartifact:us-west-2:012345678912:domain/tf-acc-test-8593714120730241305
+
+Using `terraform import`, import CodeArtifact Domain using the CodeArtifact Domain arn. For example:
+
+```console
+% terraform import aws_codeartifact_domain.example arn:aws:codeartifact:us-west-2:012345678912:domain/tf-acc-test-8593714120730241305
 ```
diff --git a/website/docs/r/codeartifact_domain_permissions_policy.html.markdown b/website/docs/r/codeartifact_domain_permissions_policy.html.markdown
index 02049c23208..ed9f4ed4ff8 100644
--- a/website/docs/r/codeartifact_domain_permissions_policy.html.markdown
+++ b/website/docs/r/codeartifact_domain_permissions_policy.html.markdown
@@ -43,24 +43,33 @@ resource "aws_codeartifact_domain_permissions_policy" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `domain` - (Required) The name of the domain on which to set the resource policy.
 * `policy_document` - (Required) A JSON policy string to be set as the access control resource policy on the provided domain.
 * `domain_owner` - (Optional) The account number of the AWS account that owns the domain.
 * `policy_revision` - (Optional) The current revision of the resource policy to be set. This revision is used for optimistic locking, which prevents others from overwriting your changes to the domain's resource policy.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The Name of Domain.
 * `resource_arn` - The ARN of the resource associated with the resource policy.
 
 ## Import
 
-CodeArtifact Domain Permissions Policies can be imported using the CodeArtifact Domain ARN, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CodeArtifact Domain Permissions Policies using the CodeArtifact Domain ARN. For example:
 
+```terraform
+import {
+  to = aws_codeartifact_domain_permissions_policy.example
+  id = "arn:aws:codeartifact:us-west-2:012345678912:domain/tf-acc-test-1928056699409417367"
+}
 ```
-$ terraform import aws_codeartifact_domain_permissions_policy.example arn:aws:codeartifact:us-west-2:012345678912:domain/tf-acc-test-1928056699409417367
+
+Using `terraform import`, import CodeArtifact Domain Permissions Policies using the CodeArtifact Domain ARN. For example:
+
+```console
+% terraform import aws_codeartifact_domain_permissions_policy.example arn:aws:codeartifact:us-west-2:012345678912:domain/tf-acc-test-1928056699409417367
 ```
diff --git a/website/docs/r/codeartifact_repository.html.markdown b/website/docs/r/codeartifact_repository.html.markdown
index a6bb7f29fd8..150243b943b 100644
--- a/website/docs/r/codeartifact_repository.html.markdown
+++ b/website/docs/r/codeartifact_repository.html.markdown
@@ -66,7 +66,7 @@ resource "aws_codeartifact_repository" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `domain` - (Required) The domain that contains the created repository.
 * `repository` - (Required) The name of the repository to create.
@@ -84,9 +84,9 @@ The following arguments are supported:
 
 * `external_connection_name` - (Required) The name of the external connection associated with a repository.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ARN of the repository.
 * `arn` - The ARN of the repository.
@@ -95,8 +95,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-CodeArtifact Repository can be imported using the CodeArtifact Repository ARN, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CodeArtifact Repository using the CodeArtifact Repository ARN. For example:
 
+```terraform
+import {
+  to = aws_codeartifact_repository.example
+  id = "arn:aws:codeartifact:us-west-2:012345678912:repository/tf-acc-test-6968272603913957763/tf-acc-test-6968272603913957763"
+}
 ```
-$ terraform import aws_codeartifact_repository.example arn:aws:codeartifact:us-west-2:012345678912:repository/tf-acc-test-6968272603913957763/tf-acc-test-6968272603913957763
+
+Using `terraform import`, import CodeArtifact Repository using the CodeArtifact Repository ARN. For example:
+
+```console
+% terraform import aws_codeartifact_repository.example arn:aws:codeartifact:us-west-2:012345678912:repository/tf-acc-test-6968272603913957763/tf-acc-test-6968272603913957763
 ```
diff --git a/website/docs/r/codeartifact_repository_permissions_policy.html.markdown b/website/docs/r/codeartifact_repository_permissions_policy.html.markdown
index 53d72d0e7e5..beb6fe5db21 100644
--- a/website/docs/r/codeartifact_repository_permissions_policy.html.markdown
+++ b/website/docs/r/codeartifact_repository_permissions_policy.html.markdown
@@ -49,7 +49,7 @@ resource "aws_codeartifact_repository_permissions_policy" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `repository` - (Required) The name of the repository to set the resource policy on.
 * `domain` - (Required) The name of the domain on which to set the resource policy.
@@ -57,17 +57,26 @@ The following arguments are supported:
 * `domain_owner` - (Optional) The account number of the AWS account that owns the domain.
 * `policy_revision` - (Optional) The current revision of the resource policy to be set. This revision is used for optimistic locking, which prevents others from overwriting your changes to the domain's resource policy.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ARN of the resource associated with the resource policy.
 * `resource_arn` - The ARN of the resource associated with the resource policy.
 
 ## Import
 
-CodeArtifact Repository Permissions Policies can be imported using the CodeArtifact Repository ARN, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CodeArtifact Repository Permissions Policies using the CodeArtifact Repository ARN. For example:
 
+```terraform
+import {
+  to = aws_codeartifact_repository_permissions_policy.example
+  id = "arn:aws:codeartifact:us-west-2:012345678912:repository/tf-acc-test-6968272603913957763/tf-acc-test-6968272603913957763"
+}
 ```
-$ terraform import aws_codeartifact_repository_permissions_policy.example arn:aws:codeartifact:us-west-2:012345678912:repository/tf-acc-test-6968272603913957763/tf-acc-test-6968272603913957763
+
+Using `terraform import`, import CodeArtifact Repository Permissions Policies using the CodeArtifact Repository ARN. For example:
+
+```console
+% terraform import aws_codeartifact_repository_permissions_policy.example arn:aws:codeartifact:us-west-2:012345678912:repository/tf-acc-test-6968272603913957763/tf-acc-test-6968272603913957763
 ```
diff --git a/website/docs/r/codebuild_project.html.markdown b/website/docs/r/codebuild_project.html.markdown
index bafcbc290a7..c4871873dff 100755
--- a/website/docs/r/codebuild_project.html.markdown
+++ b/website/docs/r/codebuild_project.html.markdown
@@ -109,7 +109,7 @@ resource "aws_iam_role_policy" "example" {
 resource "aws_codebuild_project" "example" {
   name          = "test-project"
   description   = "test_codebuild_project"
-  build_timeout = "5"
+  build_timeout = 5
   service_role  = aws_iam_role.example.arn
 
   artifacts {
@@ -185,8 +185,8 @@ resource "aws_codebuild_project" "example" {
 resource "aws_codebuild_project" "project-with-cache" {
   name           = "test-project-cache"
   description    = "test_codebuild_project_cache"
-  build_timeout  = "5"
-  queued_timeout = "5"
+  build_timeout  = 5
+  queued_timeout = 5
 
   service_role = aws_iam_role.example.arn
 
@@ -406,9 +406,9 @@ This block is only valid when the `type` is `CODECOMMIT`, `GITHUB` or `GITHUB_EN
 * `subnets` - (Required) Subnet IDs within which to run builds.
 * `vpc_id` - (Required) ID of the VPC within which to run builds.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the CodeBuild project.
 * `badge_url` - URL of the build badge when `badge_enabled` is enabled.
@@ -418,8 +418,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-CodeBuild Project can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CodeBuild Project using the `name`. For example:
 
+```terraform
+import {
+  to = aws_codebuild_project.name
+  id = "project-name"
+}
 ```
-$ terraform import aws_codebuild_project.name project-name
+
+Using `terraform import`, import CodeBuild Project using the `name`. For example:
+
+```console
+% terraform import aws_codebuild_project.name project-name
 ```
diff --git a/website/docs/r/codebuild_report_group.html.markdown b/website/docs/r/codebuild_report_group.html.markdown
index b1523198758..ebf1ce6f166 100644
--- a/website/docs/r/codebuild_report_group.html.markdown
+++ b/website/docs/r/codebuild_report_group.html.markdown
@@ -59,7 +59,7 @@ resource "aws_codebuild_report_group" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The name of a Report Group.
 * `type` - (Required) The type of the Report Group. Valid value are `TEST` and `CODE_COVERAGE`.
@@ -81,9 +81,9 @@ The following arguments are supported:
 * `packaging` - (Optional) The type of build output artifact to create. Valid values are: `NONE` (default) and `ZIP`.
 * `path` - (Optional) The path to the exported report's raw data results.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ARN of Report Group.
 * `arn` - The ARN of Report Group.
@@ -92,8 +92,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-CodeBuild Report Group can be imported using the CodeBuild Report Group arn, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CodeBuild Report Group using the CodeBuild Report Group arn. For example:
 
+```terraform
+import {
+  to = aws_codebuild_report_group.example
+  id = "arn:aws:codebuild:us-west-2:123456789:report-group/report-group-name"
+}
 ```
-$ terraform import aws_codebuild_report_group.example arn:aws:codebuild:us-west-2:123456789:report-group/report-group-name
+
+Using `terraform import`, import CodeBuild Report Group using the CodeBuild Report Group arn. For example:
+
+```console
+% terraform import aws_codebuild_report_group.example arn:aws:codebuild:us-west-2:123456789:report-group/report-group-name
 ```
diff --git a/website/docs/r/codebuild_resource_policy.html.markdown b/website/docs/r/codebuild_resource_policy.html.markdown
index 475625bfe71..659cb8c5438 100644
--- a/website/docs/r/codebuild_resource_policy.html.markdown
+++ b/website/docs/r/codebuild_resource_policy.html.markdown
@@ -51,21 +51,30 @@ resource "aws_codebuild_resource_policy" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `resource_arn` - (Required) The ARN of the Project or ReportGroup resource you want to associate with a resource policy.
 * `policy` - (Required) A JSON-formatted resource policy. For more information, see [Sharing a Projec](https://docs.aws.amazon.com/codebuild/latest/userguide/project-sharing.html#project-sharing-share) and [Sharing a Report Group](https://docs.aws.amazon.com/codebuild/latest/userguide/report-groups-sharing.html#report-groups-sharing-share).
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ARN of Resource.
 
 ## Import
 
-CodeBuild Resource Policy can be imported using the CodeBuild Resource Policy arn, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CodeBuild Resource Policy using the CodeBuild Resource Policy arn. For example:
 
+```terraform
+import {
+  to = aws_codebuild_resource_policy.example
+  id = "arn:aws:codebuild:us-west-2:123456789:report-group/report-group-name"
+}
 ```
-$ terraform import aws_codebuild_resource_policy.example arn:aws:codebuild:us-west-2:123456789:report-group/report-group-name
+
+Using `terraform import`, import CodeBuild Resource Policy using the CodeBuild Resource Policy arn. For example:
+
+```console
+% terraform import aws_codebuild_resource_policy.example arn:aws:codebuild:us-west-2:123456789:report-group/report-group-name
 ```
diff --git a/website/docs/r/codebuild_source_credential.html.markdown b/website/docs/r/codebuild_source_credential.html.markdown
index 1b96cc31cdb..2797c3f87a3 100644
--- a/website/docs/r/codebuild_source_credential.html.markdown
+++ b/website/docs/r/codebuild_source_credential.html.markdown
@@ -36,24 +36,33 @@ resource "aws_codebuild_source_credential" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `auth_type` - (Required) The type of authentication used to connect to a GitHub, GitHub Enterprise, or Bitbucket repository. An OAUTH connection is not supported by the API.
 * `server_type` - (Required) The source provider used for this project.
 * `token` - (Required) For `GitHub` or `GitHub Enterprise`, this is the personal access token. For `Bitbucket`, this is the app password.
 * `user_name` - (Optional) The Bitbucket username when the authType is `BASIC_AUTH`. This parameter is not valid for other types of source providers or connections.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ARN of Source Credential.
 * `arn` - The ARN of Source Credential.
 
 ## Import
 
-CodeBuild Source Credential can be imported using the CodeBuild Source Credential arn, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CodeBuild Source Credential using the CodeBuild Source Credential arn. For example:
 
+```terraform
+import {
+  to = aws_codebuild_source_credential.example
+  id = "arn:aws:codebuild:us-west-2:123456789:token:github"
+}
 ```
-$ terraform import aws_codebuild_source_credential.example arn:aws:codebuild:us-west-2:123456789:token:github
+
+Using `terraform import`, import CodeBuild Source Credential using the CodeBuild Source Credential arn. For example:
+
+```console
+% terraform import aws_codebuild_source_credential.example arn:aws:codebuild:us-west-2:123456789:token:github
 ```
diff --git a/website/docs/r/codebuild_webhook.html.markdown b/website/docs/r/codebuild_webhook.html.markdown
index c63a0f84ee7..be3bc0c38f2 100644
--- a/website/docs/r/codebuild_webhook.html.markdown
+++ b/website/docs/r/codebuild_webhook.html.markdown
@@ -66,7 +66,7 @@ resource "github_repository_webhook" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `project_name` - (Required) The name of the build project.
 * `build_type` - (Optional) The type of build this webhook will trigger. Valid values for this parameter are: `BUILD`, `BUILD_BATCH`.
@@ -83,9 +83,9 @@ The following arguments are supported:
 * `pattern` - (Required) For a filter that uses `EVENT` type, a comma-separated string that specifies one event: `PUSH`, `PULL_REQUEST_CREATED`, `PULL_REQUEST_UPDATED`, `PULL_REQUEST_REOPENED`. `PULL_REQUEST_MERGED` works with GitHub & GitHub Enterprise only. For a filter that uses any of the other filter types, a regular expression.
 * `exclude_matched_pattern` - (Optional) If set to `true`, the specified filter does *not* trigger a build. Defaults to `false`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The name of the build project.
 * `payload_url` - The CodeBuild endpoint where webhook events are sent.
@@ -96,8 +96,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-CodeBuild Webhooks can be imported using the CodeBuild Project name, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CodeBuild Webhooks using the CodeBuild Project name. For example:
 
+```terraform
+import {
+  to = aws_codebuild_webhook.example
+  id = "MyProjectName"
+}
 ```
-$ terraform import aws_codebuild_webhook.example MyProjectName
+
+Using `terraform import`, import CodeBuild Webhooks using the CodeBuild Project name. For example:
+
+```console
+% terraform import aws_codebuild_webhook.example MyProjectName
 ```
diff --git a/website/docs/r/codecatalyst_dev_environment.html.markdown b/website/docs/r/codecatalyst_dev_environment.html.markdown
new file mode 100644
index 00000000000..c32a35844ad
--- /dev/null
+++ b/website/docs/r/codecatalyst_dev_environment.html.markdown
@@ -0,0 +1,81 @@
+---
+subcategory: "CodeCatalyst"
+layout: "aws"
+page_title: "AWS: aws_codecatalyst_dev_environment"
+description: |-
+  Terraform resource for managing an AWS CodeCatalyst Devenvironment.
+---
+# Resource: aws_codecatalyst_dev_environment
+
+Terraform resource for managing an AWS CodeCatalyst Dev Environment.
+
+## Example Usage
+
+```terraform
+resource "aws_codecatalyst_dev_environment" "test" {
+  alias         = "devenv"
+  space_name    = "myspace"
+  project_name  = "myproject"
+  instance_type = "dev.standard1.small"
+
+  persistent_storage {
+    size = 16
+  }
+
+  ides {
+    name    = "PyCharm"
+    runtime = "public.ecr.aws/jetbrains/py"
+  }
+
+  inactivity_timeout_minutes = 40
+
+  repositories {
+    repository_name = "terraform-provider-aws"
+    branch_name     = "main"
+  }
+
+}
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `space_name` - (Required) The name of the space.
+* `project_name` - (Required) The name of the project in the space.
+* `persistent_storage` - (Required) Information about the amount of storage allocated to the Dev Environment.
+* `ides` - (Required) Information about the integrated development environment (IDE) configured for a Dev Environment.
+* `instance_type` - (Required) The Amazon EC2 instace type to use for the Dev Environment. Valid values include dev.standard1.small,dev.standard1.medium,dev.standard1.large,dev.standard1.xlarge
+
+The following arguments are optional:
+
+* `inactivity_timeout_minutes` - (Optional) The amount of time the Dev Environment will run without any activity detected before stopping, in minutes. Only whole integers are allowed. Dev Environments consume compute minutes when running.
+* `repositories` - (Optional) The source repository that contains the branch to clone into the Dev Environment.
+
+ides (`ides`) supports the following:
+
+* `name` - (Required) The name of the IDE. Valid values include Cloud9, IntelliJ, PyCharm, GoLand, and VSCode.
+* `runtime` - (Required) A link to the IDE runtime image. This parameter is not required if the name is VSCode. Values of the runtime can be for example public.ecr.aws/jetbrains/py,public.ecr.aws/jetbrains/go
+
+repositories (`repositories`) supports the following:
+
+* `repository_name` - (Required) The name of the source repository.
+* `branch_name` - (Optional) The name of the branch in a source repository.
+
+persistent storage (` persistent_storage`) supports the following:
+
+* `size` - (Required) The size of the persistent storage in gigabytes (specifically GiB). Valid values for storage are based on memory sizes in 16GB increments. Valid values are 16, 32, and 64.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Unique identifier for the Dev Environment
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `30m`)
+- `update` - (Default `10m`)
+- `delete` - (Default `10m`)
diff --git a/website/docs/r/codecatalyst_project.html.markdown b/website/docs/r/codecatalyst_project.html.markdown
new file mode 100644
index 00000000000..536abfe55eb
--- /dev/null
+++ b/website/docs/r/codecatalyst_project.html.markdown
@@ -0,0 +1,65 @@
+---
+subcategory: "CodeCatalyst"
+layout: "aws"
+page_title: "AWS: aws_codecatalyst_project"
+description: |-
+  Terraform resource for managing an AWS CodeCatalyst Project.
+---
+
+# Resource: aws_codecatalyst_project
+
+Terraform resource for managing an AWS CodeCatalyst Project.
+
+## Example Usage
+
+### Basic Usage
+
+```terraform
+resource "aws_codecatalyst_project" "test" {
+  space_name   = "myproject"
+  display_name = "MyProject"
+  description  = "My CodeCatalyst Project created using Terraform"
+}
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `space_name` - (Required) The name of the space.
+* `display_name` - (Required) The friendly name of the project that will be displayed to users.
+
+The following arguments are optional:
+
+* `description` - (Optional) The description of the project. This description will be displayed to all users of the project. We recommend providing a brief description of the project and its intended purpose.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `name` - The name of the project in the space.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `60m`)
+* `update` - (Default `180m`)
+* `delete` - (Default `90m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CodeCatalyst Project using the `example_id_arg`. For example:
+
+```terraform
+import {
+  to = aws_codecatalyst_project.example
+  id = "project-id-12345678"
+}
+```
+
+Using `terraform import`, import CodeCatalyst Project using the `example_id_arg`. For example:
+
+```console
+% terraform import aws_codecatalyst_project.example project-id-12345678
+```
diff --git a/website/docs/r/codecatalyst_source_repository.html.markdown b/website/docs/r/codecatalyst_source_repository.html.markdown
new file mode 100644
index 00000000000..bedfd76f4ec
--- /dev/null
+++ b/website/docs/r/codecatalyst_source_repository.html.markdown
@@ -0,0 +1,64 @@
+---
+subcategory: "CodeCatalyst"
+layout: "aws"
+page_title: "AWS: aws_codecatalyst_source_repository"
+description: |-
+  Terraform resource for managing an AWS CodeCatalyst Source Repository.
+---
+
+# Resource: aws_codecatalyst_source_repository
+
+Terraform resource for managing an AWS CodeCatalyst Source Repository.
+
+## Example Usage
+
+### Basic Usage
+
+```terraform
+resource "aws_codecatalyst_source_repository" "example" {
+  name         = "example-repo"
+  project_name = "example-project"
+  space_name   = "example-space"
+}
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - (Required) The name of the source repository. For more information about name requirements, see [Quotas for source repositories](https://docs.aws.amazon.com/codecatalyst/latest/userguide/source-quotas.html).
+* `space_name` - (Required) The name of the CodeCatalyst space.
+* `project_name` - (Required) The name of the project in the CodeCatalyst space.
+
+The following arguments are optional:
+
+* `description` - (Optional) The description of the project. This description will be displayed to all users of the project. We recommend providing a brief description of the project and its intended purpose.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `60m`)
+* `update` - (Default `180m`)
+* `delete` - (Default `90m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CodeCatalyst Source Repository using the `example_id_arg`. For example:
+
+```terraform
+import {
+  to = aws_codecatalyst_source_repository.example
+  id = "source_repository-id-12345678"
+}
+```
+
+Using `terraform import`, import CodeCatalyst Source Repository using the `example_id_arg`. For example:
+
+```console
+% terraform import aws_codecatalyst_source_repository.example source_repository-id-12345678
+```
diff --git a/website/docs/r/codecommit_approval_rule_template.html.markdown b/website/docs/r/codecommit_approval_rule_template.html.markdown
index 3b0d6d047b3..e16381b8315 100644
--- a/website/docs/r/codecommit_approval_rule_template.html.markdown
+++ b/website/docs/r/codecommit_approval_rule_template.html.markdown
@@ -31,15 +31,15 @@ resource "aws_codecommit_approval_rule_template" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `content` - (Required) The content of the approval rule template. Maximum of 3000 characters.
 * `name` - (Required) The name for the approval rule template. Maximum of 100 characters.
 * `description` - (Optional) The description of the approval rule template. Maximum of 1000 characters.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `approval_rule_template_id` - The ID of the approval rule template
 * `creation_date` - The date the approval rule template was created, in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8).
@@ -49,8 +49,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-CodeCommit approval rule templates can be imported using the `name`, e.g.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CodeCommit approval rule templates using the `name`. For example:
 
+```terraform
+import {
+  to = aws_codecommit_approval_rule_template.imported
+  id = "ExistingApprovalRuleTemplateName"
+}
 ```
-$ terraform import aws_codecommit_approval_rule_template.imported ExistingApprovalRuleTemplateName
+
+Using `terraform import`, import CodeCommit approval rule templates using the `name`. For example:
+
+```console
+% terraform import aws_codecommit_approval_rule_template.imported ExistingApprovalRuleTemplateName
 ```
diff --git a/website/docs/r/codecommit_approval_rule_template_association.html.markdown b/website/docs/r/codecommit_approval_rule_template_association.html.markdown
index c214976e5a2..e840d46f818 100644
--- a/website/docs/r/codecommit_approval_rule_template_association.html.markdown
+++ b/website/docs/r/codecommit_approval_rule_template_association.html.markdown
@@ -21,21 +21,30 @@ resource "aws_codecommit_approval_rule_template_association" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `approval_rule_template_name` - (Required) The name for the approval rule template.
 * `repository_name` - (Required) The name of the repository that you want to associate with the template.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The name of the approval rule template and name of the repository, separated by a comma (`,`).
 
 ## Import
 
-CodeCommit approval rule template associations can be imported using the `approval_rule_template_name` and `repository_name` separated by a comma (`,`), e.g.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CodeCommit approval rule template associations using the `approval_rule_template_name` and `repository_name` separated by a comma (`,`). For example:
 
+```terraform
+import {
+  to = aws_codecommit_approval_rule_template_association.example
+  id = "approver-rule-for-example,MyExampleRepo"
+}
 ```
-$ terraform import aws_codecommit_approval_rule_template_association.example approver-rule-for-example,MyExampleRepo
+
+Using `terraform import`, import CodeCommit approval rule template associations using the `approval_rule_template_name` and `repository_name` separated by a comma (`,`). For example:
+
+```console
+% terraform import aws_codecommit_approval_rule_template_association.example approver-rule-for-example,MyExampleRepo
 ```
diff --git a/website/docs/r/codecommit_repository.html.markdown b/website/docs/r/codecommit_repository.html.markdown
index c896d58d4f3..6b9cbde6aff 100644
--- a/website/docs/r/codecommit_repository.html.markdown
+++ b/website/docs/r/codecommit_repository.html.markdown
@@ -21,16 +21,16 @@ resource "aws_codecommit_repository" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `repository_name` - (Required) The name for the repository. This needs to be less than 100 characters.
 * `description` - (Optional) The description of the repository. This needs to be less than 1000 characters
 * `default_branch` - (Optional) The default branch of the repository. The branch specified here needs to exist.
 * `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `repository_id` - The ID of the repository
 * `arn` - The ARN of the repository
@@ -40,8 +40,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Codecommit repository can be imported using repository name, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CodeCommit repository using repository name. For example:
 
+```terraform
+import {
+  to = aws_codecommit_repository.imported
+  id = "ExistingRepo"
+}
 ```
-$ terraform import aws_codecommit_repository.imported ExistingRepo
+
+Using `terraform import`, import CodeCommit repository using repository name. For example:
+
+```console
+% terraform import aws_codecommit_repository.imported ExistingRepo
 ```
diff --git a/website/docs/r/codecommit_trigger.html.markdown b/website/docs/r/codecommit_trigger.html.markdown
index 552531c5da9..b10c461e4dd 100644
--- a/website/docs/r/codecommit_trigger.html.markdown
+++ b/website/docs/r/codecommit_trigger.html.markdown
@@ -32,7 +32,7 @@ resource "aws_codecommit_trigger" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `repository_name` - (Required) The name for the repository. This needs to be less than 100 characters.
 * `name` - (Required) The name of the trigger.
@@ -41,8 +41,8 @@ The following arguments are supported:
 * `branches` - (Optional) The branches that will be included in the trigger configuration. If no branches are specified, the trigger will apply to all branches.
 * `events` - (Required) The repository events that will cause the trigger to run actions in another service, such as sending a notification through Amazon Simple Notification Service (SNS). If no events are specified, the trigger will run for all repository events. Event types include: `all`, `updateReference`, `createReference`, `deleteReference`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `configuration_id` - System-generated unique identifier.
diff --git a/website/docs/r/codedeploy_app.html.markdown b/website/docs/r/codedeploy_app.html.markdown
index b3b436781a5..61bb541205b 100644
--- a/website/docs/r/codedeploy_app.html.markdown
+++ b/website/docs/r/codedeploy_app.html.markdown
@@ -41,15 +41,15 @@ resource "aws_codedeploy_app" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The name of the application.
 * `compute_platform` - (Optional) The compute platform can either be `ECS`, `Lambda`, or `Server`. Default is `Server`.
 * `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The ARN of the CodeDeploy application.
 * `application_id` - The application ID.
@@ -61,8 +61,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-CodeDeploy Applications can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CodeDeploy Applications using the `name`. For example:
 
+```terraform
+import {
+  to = aws_codedeploy_app.example
+  id = "my-application"
+}
 ```
-$ terraform import aws_codedeploy_app.example my-application
+
+Using `terraform import`, import CodeDeploy Applications using the `name`. For example:
+
+```console
+% terraform import aws_codedeploy_app.example my-application
 ```
diff --git a/website/docs/r/codedeploy_deployment_config.html.markdown b/website/docs/r/codedeploy_deployment_config.html.markdown
index 098f24129b1..f573af528e8 100644
--- a/website/docs/r/codedeploy_deployment_config.html.markdown
+++ b/website/docs/r/codedeploy_deployment_config.html.markdown
@@ -91,7 +91,7 @@ resource "aws_codedeploy_deployment_group" "foo" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `deployment_config_name` - (Required) The name of the deployment config.
 * `compute_platform` - (Optional) The compute platform can be `Server`, `Lambda`, or `ECS`. Default is `Server`.
@@ -122,17 +122,26 @@ The `time_based_linear` block supports the following:
 * `interval` - (Optional) The number of minutes between each incremental traffic shift of a `TimeBasedLinear` deployment.
 * `percentage` - (Optional) The percentage of traffic that is shifted at the start of each increment of a `TimeBasedLinear` deployment.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The deployment group's config name.
 * `deployment_config_id` - The AWS Assigned deployment config id
 
 ## Import
 
-CodeDeploy Deployment Configurations can be imported using the `deployment_config_name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CodeDeploy Deployment Configurations using the `deployment_config_name`. For example:
 
+```terraform
+import {
+  to = aws_codedeploy_deployment_config.example
+  id = "my-deployment-config"
+}
 ```
-$ terraform import aws_codedeploy_deployment_config.example my-deployment-config
+
+Using `terraform import`, import CodeDeploy Deployment Configurations using the `deployment_config_name`. For example:
+
+```console
+% terraform import aws_codedeploy_deployment_config.example my-deployment-config
 ```
diff --git a/website/docs/r/codedeploy_deployment_group.html.markdown b/website/docs/r/codedeploy_deployment_group.html.markdown
index b3dc41cd67f..616b5b4166f 100644
--- a/website/docs/r/codedeploy_deployment_group.html.markdown
+++ b/website/docs/r/codedeploy_deployment_group.html.markdown
@@ -80,6 +80,9 @@ resource "aws_codedeploy_deployment_group" "example" {
     alarms  = ["my-alarm-name"]
     enabled = true
   }
+
+  outdated_instances_strategy = "UPDATE"
+
 }
 ```
 
@@ -183,7 +186,7 @@ resource "aws_codedeploy_deployment_group" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `app_name` - (Required) The name of the application.
 * `deployment_group_name` - (Required) The name of the deployment group.
@@ -200,6 +203,7 @@ The following arguments are supported:
 * `load_balancer_info` - (Optional) Single configuration block of the load balancer to use in a blue/green deployment (documented below).
 * `on_premises_instance_tag_filter` - (Optional) On premise tag filters associated with the group. See the AWS docs for details.
 * `trigger_configuration` - (Optional) Configuration block(s) of the triggers for the deployment group (documented below).
+* `outdated_instances_strategy` - (Optional) Configuration block of Indicates what happens when new Amazon EC2 instances are launched mid-deployment and do not receive the deployed application revision. Valid values are `UPDATE` and `IGNORE`. Defaults to `UPDATE`.
 * `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
 ### alarm_configuration Argument Reference
@@ -219,7 +223,7 @@ _Only one `alarm_configuration` is allowed_.
 You can configure a deployment group to automatically rollback when a deployment fails or when a monitoring threshold you specify is met. In this case, the last known good version of an application revision is deployed. `auto_rollback_configuration` supports the following:
 
 * `enabled` - (Optional) Indicates whether a defined automatic rollback configuration is currently enabled for this Deployment Group. If you enable automatic rollback, you must specify at least one event type.
-* `events` - (Optional) The event type or types that trigger a rollback. Supported types are `DEPLOYMENT_FAILURE` and `DEPLOYMENT_STOP_ON_ALARM`.
+* `events` - (Optional) The event type or types that trigger a rollback. Supported types are `DEPLOYMENT_FAILURE`, `DEPLOYMENT_STOP_ON_ALARM` and `DEPLOYMENT_STOP_ON_REQUEST`.
 
 _Only one `auto_rollback_configuration` is allowed_.
 
@@ -345,9 +349,9 @@ Add triggers to a Deployment Group to receive notifications about events related
 * `trigger_name` - (Required) The name of the notification trigger.
 * `trigger_target_arn` - (Required) The ARN of the SNS topic through which notifications are sent.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The ARN of the CodeDeploy deployment group.
 * `id` - Application name and deployment group name.
@@ -357,10 +361,19 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-CodeDeploy Deployment Groups can be imported by their `app_name`, a colon, and `deployment_group_name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CodeDeploy Deployment Groups using `app_name`, a colon, and `deployment_group_name`. For example:
 
+```terraform
+import {
+  to = aws_codedeploy_deployment_group.example
+  id = "my-application:my-deployment-group"
+}
 ```
-$ terraform import aws_codedeploy_deployment_group.example my-application:my-deployment-group
+
+Using `terraform import`, import CodeDeploy Deployment Groups using `app_name`, a colon, and `deployment_group_name`. For example:
+
+```console
+% terraform import aws_codedeploy_deployment_group.example my-application:my-deployment-group
 ```
 
 [1]: http://docs.aws.amazon.com/codedeploy/latest/userguide/monitoring-sns-event-notifications-create-trigger.html
diff --git a/website/docs/r/codegurureviewer_repository_association.html.markdown b/website/docs/r/codegurureviewer_repository_association.html.markdown
index 49739561c32..a73ac74cdd1 100644
--- a/website/docs/r/codegurureviewer_repository_association.html.markdown
+++ b/website/docs/r/codegurureviewer_repository_association.html.markdown
@@ -82,9 +82,9 @@ This configuration block supports the following:
 * `encryption_option` - (Optional) The encryption option for a repository association. It is either owned by AWS Key Management Service (KMS) (`AWS_OWNED_CMK`) or customer managed (`CUSTOMER_MANAGED_CMK`).
 * `kms_key_id` - (Optional) The ID of the AWS KMS key that is associated with a repository association.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The Amazon Resource Name (ARN) identifying the repository association.
 * `association_id` - The ID of the repository association.
diff --git a/website/docs/r/codepipeline.html.markdown b/website/docs/r/codepipeline.html.markdown
new file mode 100644
index 00000000000..181da1d57d3
--- /dev/null
+++ b/website/docs/r/codepipeline.html.markdown
@@ -0,0 +1,235 @@
+---
+subcategory: "CodePipeline"
+layout: "aws"
+page_title: "AWS: aws_codepipeline"
+description: |-
+  Provides a CodePipeline
+---
+
+# Resource: aws_codepipeline
+
+Provides a CodePipeline.
+
+## Example Usage
+
+```terraform
+resource "aws_codepipeline" "codepipeline" {
+  name     = "tf-test-pipeline"
+  role_arn = aws_iam_role.codepipeline_role.arn
+
+  artifact_store {
+    location = aws_s3_bucket.codepipeline_bucket.bucket
+    type     = "S3"
+
+    encryption_key {
+      id   = data.aws_kms_alias.s3kmskey.arn
+      type = "KMS"
+    }
+  }
+
+  stage {
+    name = "Source"
+
+    action {
+      name             = "Source"
+      category         = "Source"
+      owner            = "AWS"
+      provider         = "CodeStarSourceConnection"
+      version          = "1"
+      output_artifacts = ["source_output"]
+
+      configuration = {
+        ConnectionArn    = aws_codestarconnections_connection.example.arn
+        FullRepositoryId = "my-organization/example"
+        BranchName       = "main"
+      }
+    }
+  }
+
+  stage {
+    name = "Build"
+
+    action {
+      name             = "Build"
+      category         = "Build"
+      owner            = "AWS"
+      provider         = "CodeBuild"
+      input_artifacts  = ["source_output"]
+      output_artifacts = ["build_output"]
+      version          = "1"
+
+      configuration = {
+        ProjectName = "test"
+      }
+    }
+  }
+
+  stage {
+    name = "Deploy"
+
+    action {
+      name            = "Deploy"
+      category        = "Deploy"
+      owner           = "AWS"
+      provider        = "CloudFormation"
+      input_artifacts = ["build_output"]
+      version         = "1"
+
+      configuration = {
+        ActionMode     = "REPLACE_ON_FAILURE"
+        Capabilities   = "CAPABILITY_AUTO_EXPAND,CAPABILITY_IAM"
+        OutputFileName = "CreateStackOutput.json"
+        StackName      = "MyStack"
+        TemplatePath   = "build_output::sam-templated.yaml"
+      }
+    }
+  }
+}
+
+resource "aws_codestarconnections_connection" "example" {
+  name          = "example-connection"
+  provider_type = "GitHub"
+}
+
+resource "aws_s3_bucket" "codepipeline_bucket" {
+  bucket = "test-bucket"
+}
+
+resource "aws_s3_bucket_acl" "codepipeline_bucket_acl" {
+  bucket = aws_s3_bucket.codepipeline_bucket.id
+  acl    = "private"
+}
+
+data "aws_iam_policy_document" "assume_role" {
+  statement {
+    effect = "Allow"
+
+    principals {
+      type        = "Service"
+      identifiers = ["codepipeline.amazonaws.com"]
+    }
+
+    actions = ["sts:AssumeRole"]
+  }
+}
+
+resource "aws_iam_role" "codepipeline_role" {
+  name               = "test-role"
+  assume_role_policy = data.aws_iam_policy_document.assume_role.json
+}
+
+data "aws_iam_policy_document" "codepipeline_policy" {
+  statement {
+    effect = "Allow"
+
+    actions = [
+      "s3:GetObject",
+      "s3:GetObjectVersion",
+      "s3:GetBucketVersioning",
+      "s3:PutObjectAcl",
+      "s3:PutObject",
+    ]
+
+    resources = [
+      aws_s3_bucket.codepipeline_bucket.arn,
+      "${aws_s3_bucket.codepipeline_bucket.arn}/*"
+    ]
+  }
+
+  statement {
+    effect    = "Allow"
+    actions   = ["codestar-connections:UseConnection"]
+    resources = [aws_codestarconnections_connection.example.arn]
+  }
+
+  statement {
+    effect = "Allow"
+
+    actions = [
+      "codebuild:BatchGetBuilds",
+      "codebuild:StartBuild",
+    ]
+
+    resources = ["*"]
+  }
+}
+
+resource "aws_iam_role_policy" "codepipeline_policy" {
+  name   = "codepipeline_policy"
+  role   = aws_iam_role.codepipeline_role.id
+  policy = data.aws_iam_policy_document.codepipeline_policy.json
+}
+
+data "aws_kms_alias" "s3kmskey" {
+  name = "alias/myKmsKey"
+}
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the pipeline.
+* `role_arn` - (Required) A service role Amazon Resource Name (ARN) that grants AWS CodePipeline permission to make calls to AWS services on your behalf.
+* `artifact_store` (Required) One or more artifact_store blocks. Artifact stores are documented below.
+* `stage` (Minimum of at least two `stage` blocks is required) A stage block. Stages are documented below.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+An `artifact_store` block supports the following arguments:
+
+* `location` - (Required) The location where AWS CodePipeline stores artifacts for a pipeline; currently only `S3` is supported.
+* `type` - (Required) The type of the artifact store, such as Amazon S3
+* `encryption_key` - (Optional) The encryption key block AWS CodePipeline uses to encrypt the data in the artifact store, such as an AWS Key Management Service (AWS KMS) key. If you don't specify a key, AWS CodePipeline uses the default key for Amazon Simple Storage Service (Amazon S3). An `encryption_key` block is documented below.
+* `region` - (Optional) The region where the artifact store is located. Required for a cross-region CodePipeline, do not provide for a single-region CodePipeline.
+
+An `encryption_key` block supports the following arguments:
+
+* `id` - (Required) The KMS key ARN or ID
+* `type` - (Required) The type of key; currently only `KMS` is supported
+
+A `stage` block supports the following arguments:
+
+* `name` - (Required) The name of the stage.
+* `action` - (Required) The action(s) to include in the stage. Defined as an `action` block below
+
+An `action` block supports the following arguments:
+
+* `category` - (Required) A category defines what kind of action can be taken in the stage, and constrains the provider type for the action. Possible values are `Approval`, `Build`, `Deploy`, `Invoke`, `Source` and `Test`.
+* `owner` - (Required) The creator of the action being called. Possible values are `AWS`, `Custom` and `ThirdParty`.
+* `name` - (Required) The action declaration's name.
+* `provider` - (Required) The provider of the service being called by the action. Valid providers are determined by the action category. Provider names are listed in the [Action Structure Reference](https://docs.aws.amazon.com/codepipeline/latest/userguide/action-reference.html) documentation.
+* `version` - (Required) A string that identifies the action type.
+* `configuration` - (Optional) A map of the action declaration's configuration. Configurations options for action types and providers can be found in the [Pipeline Structure Reference](http://docs.aws.amazon.com/codepipeline/latest/userguide/reference-pipeline-structure.html#action-requirements) and [Action Structure Reference](https://docs.aws.amazon.com/codepipeline/latest/userguide/action-reference.html) documentation.
+* `input_artifacts` - (Optional) A list of artifact names to be worked on.
+* `output_artifacts` - (Optional) A list of artifact names to output. Output artifact names must be unique within a pipeline.
+* `role_arn` - (Optional) The ARN of the IAM service role that will perform the declared action. This is assumed through the roleArn for the pipeline.
+* `run_order` - (Optional) The order in which actions are run.
+* `region` - (Optional) The region in which to run the action.
+* `namespace` - (Optional) The namespace all output variables will be accessed from.
+
+~> **Note:** The input artifact of an action must exactly match the output artifact declared in a preceding action, but the input artifact does not have to be the next action in strict sequence from the action that provided the output artifact. Actions in parallel can declare different output artifacts, which are in turn consumed by different following actions.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The codepipeline ID.
+* `arn` - The codepipeline ARN.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CodePipelines using the name. For example:
+
+```terraform
+import {
+  to = aws_codepipeline.foo
+  id = "example"
+}
+```
+
+Using `terraform import`, import CodePipelines using the name. For example:
+
+```console
+% terraform import aws_codepipeline.foo example
+```
diff --git a/website/docs/r/codepipeline.markdown b/website/docs/r/codepipeline.markdown
deleted file mode 100644
index f92883f6fc4..00000000000
--- a/website/docs/r/codepipeline.markdown
+++ /dev/null
@@ -1,226 +0,0 @@
----
-subcategory: "CodePipeline"
-layout: "aws"
-page_title: "AWS: aws_codepipeline"
-description: |-
-  Provides a CodePipeline
----
-
-# Resource: aws_codepipeline
-
-Provides a CodePipeline.
-
-## Example Usage
-
-```terraform
-resource "aws_codepipeline" "codepipeline" {
-  name     = "tf-test-pipeline"
-  role_arn = aws_iam_role.codepipeline_role.arn
-
-  artifact_store {
-    location = aws_s3_bucket.codepipeline_bucket.bucket
-    type     = "S3"
-
-    encryption_key {
-      id   = data.aws_kms_alias.s3kmskey.arn
-      type = "KMS"
-    }
-  }
-
-  stage {
-    name = "Source"
-
-    action {
-      name             = "Source"
-      category         = "Source"
-      owner            = "AWS"
-      provider         = "CodeStarSourceConnection"
-      version          = "1"
-      output_artifacts = ["source_output"]
-
-      configuration = {
-        ConnectionArn    = aws_codestarconnections_connection.example.arn
-        FullRepositoryId = "my-organization/example"
-        BranchName       = "main"
-      }
-    }
-  }
-
-  stage {
-    name = "Build"
-
-    action {
-      name             = "Build"
-      category         = "Build"
-      owner            = "AWS"
-      provider         = "CodeBuild"
-      input_artifacts  = ["source_output"]
-      output_artifacts = ["build_output"]
-      version          = "1"
-
-      configuration = {
-        ProjectName = "test"
-      }
-    }
-  }
-
-  stage {
-    name = "Deploy"
-
-    action {
-      name            = "Deploy"
-      category        = "Deploy"
-      owner           = "AWS"
-      provider        = "CloudFormation"
-      input_artifacts = ["build_output"]
-      version         = "1"
-
-      configuration = {
-        ActionMode     = "REPLACE_ON_FAILURE"
-        Capabilities   = "CAPABILITY_AUTO_EXPAND,CAPABILITY_IAM"
-        OutputFileName = "CreateStackOutput.json"
-        StackName      = "MyStack"
-        TemplatePath   = "build_output::sam-templated.yaml"
-      }
-    }
-  }
-}
-
-resource "aws_codestarconnections_connection" "example" {
-  name          = "example-connection"
-  provider_type = "GitHub"
-}
-
-resource "aws_s3_bucket" "codepipeline_bucket" {
-  bucket = "test-bucket"
-}
-
-resource "aws_s3_bucket_acl" "codepipeline_bucket_acl" {
-  bucket = aws_s3_bucket.codepipeline_bucket.id
-  acl    = "private"
-}
-
-data "aws_iam_policy_document" "assume_role" {
-  statement {
-    effect = "Allow"
-
-    principals {
-      type        = "Service"
-      identifiers = ["codepipeline.amazonaws.com"]
-    }
-
-    actions = ["sts:AssumeRole"]
-  }
-}
-
-resource "aws_iam_role" "codepipeline_role" {
-  name               = "test-role"
-  assume_role_policy = data.aws_iam_policy_document.assume_role.json
-}
-
-data "aws_iam_policy_document" "codepipeline_policy" {
-  statement {
-    effect = "Allow"
-
-    actions = [
-      "s3:GetObject",
-      "s3:GetObjectVersion",
-      "s3:GetBucketVersioning",
-      "s3:PutObjectAcl",
-      "s3:PutObject",
-    ]
-
-    resources = [
-      aws_s3_bucket.codepipeline_bucket.arn,
-      "${aws_s3_bucket.codepipeline_bucket.arn}/*"
-    ]
-  }
-
-  statement {
-    effect    = "Allow"
-    actions   = ["codestar-connections:UseConnection"]
-    resources = [aws_codestarconnections_connection.example.arn]
-  }
-
-  statement {
-    effect = "Allow"
-
-    actions = [
-      "codebuild:BatchGetBuilds",
-      "codebuild:StartBuild",
-    ]
-
-    resources = ["*"]
-  }
-}
-
-resource "aws_iam_role_policy" "codepipeline_policy" {
-  name   = "codepipeline_policy"
-  role   = aws_iam_role.codepipeline_role.id
-  policy = data.aws_iam_policy_document.codepipeline_policy.json
-}
-
-data "aws_kms_alias" "s3kmskey" {
-  name = "alias/myKmsKey"
-}
-```
-
-## Argument Reference
-
-The following arguments are supported:
-
-* `name` - (Required) The name of the pipeline.
-* `role_arn` - (Required) A service role Amazon Resource Name (ARN) that grants AWS CodePipeline permission to make calls to AWS services on your behalf.
-* `artifact_store` (Required) One or more artifact_store blocks. Artifact stores are documented below.
-* `stage` (Minimum of at least two `stage` blocks is required) A stage block. Stages are documented below.
-* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
-
-An `artifact_store` block supports the following arguments:
-
-* `location` - (Required) The location where AWS CodePipeline stores artifacts for a pipeline; currently only `S3` is supported.
-* `type` - (Required) The type of the artifact store, such as Amazon S3
-* `encryption_key` - (Optional) The encryption key block AWS CodePipeline uses to encrypt the data in the artifact store, such as an AWS Key Management Service (AWS KMS) key. If you don't specify a key, AWS CodePipeline uses the default key for Amazon Simple Storage Service (Amazon S3). An `encryption_key` block is documented below.
-* `region` - (Optional) The region where the artifact store is located. Required for a cross-region CodePipeline, do not provide for a single-region CodePipeline.
-
-An `encryption_key` block supports the following arguments:
-
-* `id` - (Required) The KMS key ARN or ID
-* `type` - (Required) The type of key; currently only `KMS` is supported
-
-A `stage` block supports the following arguments:
-
-* `name` - (Required) The name of the stage.
-* `action` - (Required) The action(s) to include in the stage. Defined as an `action` block below
-
-An `action` block supports the following arguments:
-
-* `category` - (Required) A category defines what kind of action can be taken in the stage, and constrains the provider type for the action. Possible values are `Approval`, `Build`, `Deploy`, `Invoke`, `Source` and `Test`.
-* `owner` - (Required) The creator of the action being called. Possible values are `AWS`, `Custom` and `ThirdParty`.
-* `name` - (Required) The action declaration's name.
-* `provider` - (Required) The provider of the service being called by the action. Valid providers are determined by the action category. Provider names are listed in the [Action Structure Reference](https://docs.aws.amazon.com/codepipeline/latest/userguide/action-reference.html) documentation.
-* `version` - (Required) A string that identifies the action type.
-* `configuration` - (Optional) A map of the action declaration's configuration. Configurations options for action types and providers can be found in the [Pipeline Structure Reference](http://docs.aws.amazon.com/codepipeline/latest/userguide/reference-pipeline-structure.html#action-requirements) and [Action Structure Reference](https://docs.aws.amazon.com/codepipeline/latest/userguide/action-reference.html) documentation.
-* `input_artifacts` - (Optional) A list of artifact names to be worked on.
-* `output_artifacts` - (Optional) A list of artifact names to output. Output artifact names must be unique within a pipeline.
-* `role_arn` - (Optional) The ARN of the IAM service role that will perform the declared action. This is assumed through the roleArn for the pipeline.
-* `run_order` - (Optional) The order in which actions are run.
-* `region` - (Optional) The region in which to run the action.
-* `namespace` - (Optional) The namespace all output variables will be accessed from.
-
-~> **Note:** The input artifact of an action must exactly match the output artifact declared in a preceding action, but the input artifact does not have to be the next action in strict sequence from the action that provided the output artifact. Actions in parallel can declare different output artifacts, which are in turn consumed by different following actions.
-
-## Attributes Reference
-
-In addition to all arguments above, the following attributes are exported:
-
-* `id` - The codepipeline ID.
-* `arn` - The codepipeline ARN.
-* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
-
-## Import
-
-CodePipelines can be imported using the name, e.g.,
-
-```
-$ terraform import aws_codepipeline.foo example
-```
diff --git a/website/docs/r/codepipeline_custom_action_type.html.markdown b/website/docs/r/codepipeline_custom_action_type.html.markdown
index 2bcaf44a102..7995cc68866 100644
--- a/website/docs/r/codepipeline_custom_action_type.html.markdown
+++ b/website/docs/r/codepipeline_custom_action_type.html.markdown
@@ -33,7 +33,7 @@ resource "aws_codepipeline_custom_action_type" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `category` - (Required) The category of the custom action. Valid values: `Source`, `Build`, `Deploy`, `Test`, `Invoke`, `Approval`
 * `configuration_property` - (Optional) The configuration properties for the custom action. Max 10 items.
@@ -75,9 +75,9 @@ The `settings` object supports the following:
 * `tags` - (Optional) Map of tags to assign to this resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 * `version` - (Required) The version identifier of the custom action.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Composed of category, provider and version. For example, `Build:terraform:1`
 * `arn` - The action ARN.
@@ -86,8 +86,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-CodeDeploy CustomActionType can be imported using the `id`, e.g.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CodeDeploy CustomActionType using the `id`. For example:
 
+```terraform
+import {
+  to = aws_codepipeline_custom_action_type.example
+  id = "Build:terraform:1"
+}
 ```
-$ terraform import aws_codepipeline_custom_action_type.example Build:terraform:1
+
+Using `terraform import`, import CodeDeploy CustomActionType using the `id`. For example:
+
+```console
+% terraform import aws_codepipeline_custom_action_type.example Build:terraform:1
 ```
diff --git a/website/docs/r/codepipeline_webhook.html.markdown b/website/docs/r/codepipeline_webhook.html.markdown
new file mode 100644
index 00000000000..02a7cfd200d
--- /dev/null
+++ b/website/docs/r/codepipeline_webhook.html.markdown
@@ -0,0 +1,154 @@
+---
+subcategory: "CodePipeline"
+layout: "aws"
+page_title: "AWS: aws_codepipeline_webhook"
+description: |-
+  Provides a CodePipeline Webhook
+---
+
+# Resource: aws_codepipeline_webhook
+
+Provides a CodePipeline Webhook.
+
+## Example Usage
+
+```terraform
+resource "aws_codepipeline" "bar" {
+  name     = "tf-test-pipeline"
+  role_arn = aws_iam_role.bar.arn
+
+  artifact_store {
+    location = aws_s3_bucket.bar.bucket
+    type     = "S3"
+
+    encryption_key {
+      id   = data.aws_kms_alias.s3kmskey.arn
+      type = "KMS"
+    }
+  }
+
+  stage {
+    name = "Source"
+
+    action {
+      name             = "Source"
+      category         = "Source"
+      owner            = "ThirdParty"
+      provider         = "GitHub"
+      version          = "1"
+      output_artifacts = ["test"]
+
+      configuration = {
+        Owner  = "my-organization"
+        Repo   = "test"
+        Branch = "master"
+      }
+    }
+  }
+
+  stage {
+    name = "Build"
+
+    action {
+      name            = "Build"
+      category        = "Build"
+      owner           = "AWS"
+      provider        = "CodeBuild"
+      input_artifacts = ["test"]
+      version         = "1"
+
+      configuration = {
+        ProjectName = "test"
+      }
+    }
+  }
+}
+
+# A shared secret between GitHub and AWS that allows AWS
+# CodePipeline to authenticate the request came from GitHub.
+# Would probably be better to pull this from the environment
+# or something like SSM Parameter Store.
+locals {
+  webhook_secret = "super-secret"
+}
+
+resource "aws_codepipeline_webhook" "bar" {
+  name            = "test-webhook-github-bar"
+  authentication  = "GITHUB_HMAC"
+  target_action   = "Source"
+  target_pipeline = aws_codepipeline.bar.name
+
+  authentication_configuration {
+    secret_token = local.webhook_secret
+  }
+
+  filter {
+    json_path    = "$.ref"
+    match_equals = "refs/heads/{Branch}"
+  }
+}
+
+# Wire the CodePipeline webhook into a GitHub repository.
+resource "github_repository_webhook" "bar" {
+  repository = github_repository.repo.name
+
+  name = "web"
+
+  configuration {
+    url          = aws_codepipeline_webhook.bar.url
+    content_type = "json"
+    insecure_ssl = true
+    secret       = local.webhook_secret
+  }
+
+  events = ["push"]
+}
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the webhook.
+* `authentication` - (Required) The type of authentication  to use. One of `IP`, `GITHUB_HMAC`, or `UNAUTHENTICATED`.
+* `authentication_configuration` - (Optional) An `auth` block. Required for `IP` and `GITHUB_HMAC`. Auth blocks are documented below.
+* `filter` (Required) One or more `filter` blocks. Filter blocks are documented below.
+* `target_action` - (Required) The name of the action in a pipeline you want to connect to the webhook. The action must be from the source (first) stage of the pipeline.
+* `target_pipeline` - (Required) The name of the pipeline.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+An `authentication_configuration` block supports the following arguments:
+
+* `secret_token` - (Optional) The shared secret for the GitHub repository webhook. Set this as `secret` in your `github_repository_webhook`'s `configuration` block. Required for `GITHUB_HMAC`.
+* `allowed_ip_range` - (Optional) A valid CIDR block for `IP` filtering. Required for `IP`.
+
+A `filter` block supports the following arguments:
+
+* `json_path` - (Required) The [JSON path](https://github.com/json-path/JsonPath) to filter on.
+* `match_equals` - (Required) The value to match on (e.g., `refs/heads/{Branch}`). See [AWS docs](https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_WebhookFilterRule.html) for details.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The CodePipeline webhook's ARN.
+* `id` - The CodePipeline webhook's ARN.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `url` - The CodePipeline webhook's URL. POST events to this endpoint to trigger the target.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CodePipeline Webhooks using their ARN. For example:
+
+```terraform
+import {
+  to = aws_codepipeline_webhook.example
+  id = "arn:aws:codepipeline:us-west-2:123456789012:webhook:example"
+}
+```
+
+Using `terraform import`, import CodePipeline Webhooks using their ARN. For example:
+
+```console
+% terraform import aws_codepipeline_webhook.example arn:aws:codepipeline:us-west-2:123456789012:webhook:example
+```
diff --git a/website/docs/r/codepipeline_webhook.markdown b/website/docs/r/codepipeline_webhook.markdown
deleted file mode 100644
index 83992ee5b1f..00000000000
--- a/website/docs/r/codepipeline_webhook.markdown
+++ /dev/null
@@ -1,145 +0,0 @@
----
-subcategory: "CodePipeline"
-layout: "aws"
-page_title: "AWS: aws_codepipeline_webhook"
-description: |-
-  Provides a CodePipeline Webhook
----
-
-# Resource: aws_codepipeline_webhook
-
-Provides a CodePipeline Webhook.
-
-## Example Usage
-
-```terraform
-resource "aws_codepipeline" "bar" {
-  name     = "tf-test-pipeline"
-  role_arn = aws_iam_role.bar.arn
-
-  artifact_store {
-    location = aws_s3_bucket.bar.bucket
-    type     = "S3"
-
-    encryption_key {
-      id   = data.aws_kms_alias.s3kmskey.arn
-      type = "KMS"
-    }
-  }
-
-  stage {
-    name = "Source"
-
-    action {
-      name             = "Source"
-      category         = "Source"
-      owner            = "ThirdParty"
-      provider         = "GitHub"
-      version          = "1"
-      output_artifacts = ["test"]
-
-      configuration = {
-        Owner  = "my-organization"
-        Repo   = "test"
-        Branch = "master"
-      }
-    }
-  }
-
-  stage {
-    name = "Build"
-
-    action {
-      name            = "Build"
-      category        = "Build"
-      owner           = "AWS"
-      provider        = "CodeBuild"
-      input_artifacts = ["test"]
-      version         = "1"
-
-      configuration = {
-        ProjectName = "test"
-      }
-    }
-  }
-}
-
-# A shared secret between GitHub and AWS that allows AWS
-# CodePipeline to authenticate the request came from GitHub.
-# Would probably be better to pull this from the environment
-# or something like SSM Parameter Store.
-locals {
-  webhook_secret = "super-secret"
-}
-
-resource "aws_codepipeline_webhook" "bar" {
-  name            = "test-webhook-github-bar"
-  authentication  = "GITHUB_HMAC"
-  target_action   = "Source"
-  target_pipeline = aws_codepipeline.bar.name
-
-  authentication_configuration {
-    secret_token = local.webhook_secret
-  }
-
-  filter {
-    json_path    = "$.ref"
-    match_equals = "refs/heads/{Branch}"
-  }
-}
-
-# Wire the CodePipeline webhook into a GitHub repository.
-resource "github_repository_webhook" "bar" {
-  repository = github_repository.repo.name
-
-  name = "web"
-
-  configuration {
-    url          = aws_codepipeline_webhook.bar.url
-    content_type = "json"
-    insecure_ssl = true
-    secret       = local.webhook_secret
-  }
-
-  events = ["push"]
-}
-```
-
-## Argument Reference
-
-The following arguments are supported:
-
-* `name` - (Required) The name of the webhook.
-* `authentication` - (Required) The type of authentication  to use. One of `IP`, `GITHUB_HMAC`, or `UNAUTHENTICATED`.
-* `authentication_configuration` - (Optional) An `auth` block. Required for `IP` and `GITHUB_HMAC`. Auth blocks are documented below.
-* `filter` (Required) One or more `filter` blocks. Filter blocks are documented below.
-* `target_action` - (Required) The name of the action in a pipeline you want to connect to the webhook. The action must be from the source (first) stage of the pipeline.
-* `target_pipeline` - (Required) The name of the pipeline.
-* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
-
-An `authentication_configuration` block supports the following arguments:
-
-* `secret_token` - (Optional) The shared secret for the GitHub repository webhook. Set this as `secret` in your `github_repository_webhook`'s `configuration` block. Required for `GITHUB_HMAC`.
-* `allowed_ip_range` - (Optional) A valid CIDR block for `IP` filtering. Required for `IP`.
-
-A `filter` block supports the following arguments:
-
-* `json_path` - (Required) The [JSON path](https://github.com/json-path/JsonPath) to filter on.
-* `match_equals` - (Required) The value to match on (e.g., `refs/heads/{Branch}`). See [AWS docs](https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_WebhookFilterRule.html) for details.
-
-## Attributes Reference
-
-In addition to all arguments above, the following attributes are exported:
-
-* `arn` - The CodePipeline webhook's ARN.
-* `id` - The CodePipeline webhook's ARN.
-* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
-* `url` - The CodePipeline webhook's URL. POST events to this endpoint to trigger the target.
-
-## Import
-
-CodePipeline Webhooks can be imported by their ARN, e.g.,
-
-```
-$ terraform import aws_codepipeline_webhook.example arn:aws:codepipeline:us-west-2:123456789012:webhook:example
-```
diff --git a/website/docs/r/codestarconnections_connection.html.markdown b/website/docs/r/codestarconnections_connection.html.markdown
new file mode 100644
index 00000000000..f649c537166
--- /dev/null
+++ b/website/docs/r/codestarconnections_connection.html.markdown
@@ -0,0 +1,97 @@
+---
+subcategory: "CodeStar Connections"
+layout: "aws"
+page_title: "AWS: aws_codestarconnections_connection"
+description: |-
+  Provides a CodeStar Connection
+---
+
+# Resource: aws_codestarconnections_connection
+
+Provides a CodeStar Connection.
+
+~> **NOTE:** The `aws_codestarconnections_connection` resource is created in the state `PENDING`. Authentication with the connection provider must be completed in the AWS Console. See the [AWS documentation](https://docs.aws.amazon.com/dtconsole/latest/userguide/connections-update.html) for details.
+
+## Example Usage
+
+```terraform
+resource "aws_codestarconnections_connection" "example" {
+  name          = "example-connection"
+  provider_type = "Bitbucket"
+}
+
+resource "aws_codepipeline" "example" {
+  name     = "tf-test-pipeline"
+  role_arn = aws_iam_role.codepipeline_role.arn
+
+  artifact_store {
+    # ...
+  }
+
+  stage {
+    name = "Source"
+    action {
+      name             = "Source"
+      category         = "Source"
+      owner            = "AWS"
+      provider         = "CodeStarSourceConnection"
+      version          = "1"
+      output_artifacts = ["source_output"]
+      configuration = {
+        ConnectionArn    = aws_codestarconnections_connection.example.arn
+        FullRepositoryId = "my-organization/test"
+        BranchName       = "main"
+      }
+    }
+  }
+
+  stage {
+    name = "Build"
+    action {
+      # ...
+    }
+  }
+
+  stage {
+    name = "Deploy"
+    action {
+      # ...
+    }
+  }
+}
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the connection to be created. The name must be unique in the calling AWS account. Changing `name` will create a new resource.
+* `provider_type` - (Optional) The name of the external provider where your third-party code repository is configured. Valid values are `Bitbucket`, `GitHub` or `GitHubEnterpriseServer`. Changing `provider_type` will create a new resource. Conflicts with `host_arn`
+* `host_arn` - (Optional) The Amazon Resource Name (ARN) of the host associated with the connection. Conflicts with `provider_type`
+* `tags` - (Optional) Map of key-value resource tags to associate with the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The codestar connection ARN.
+* `arn` - The codestar connection ARN.
+* `connection_status` - The codestar connection status. Possible values are `PENDING`, `AVAILABLE` and `ERROR`.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CodeStar connections using the ARN. For example:
+
+```terraform
+import {
+  to = aws_codestarconnections_connection.test-connection
+  id = "arn:aws:codestar-connections:us-west-1:0123456789:connection/79d4d357-a2ee-41e4-b350-2fe39ae59448"
+}
+```
+
+Using `terraform import`, import CodeStar connections using the ARN. For example:
+
+```console
+% terraform import aws_codestarconnections_connection.test-connection arn:aws:codestar-connections:us-west-1:0123456789:connection/79d4d357-a2ee-41e4-b350-2fe39ae59448
+```
diff --git a/website/docs/r/codestarconnections_connection.markdown b/website/docs/r/codestarconnections_connection.markdown
deleted file mode 100644
index 319ee77f48e..00000000000
--- a/website/docs/r/codestarconnections_connection.markdown
+++ /dev/null
@@ -1,88 +0,0 @@
----
-subcategory: "CodeStar Connections"
-layout: "aws"
-page_title: "AWS: aws_codestarconnections_connection"
-description: |-
-  Provides a CodeStar Connection
----
-
-# Resource: aws_codestarconnections_connection
-
-Provides a CodeStar Connection.
-
-~> **NOTE:** The `aws_codestarconnections_connection` resource is created in the state `PENDING`. Authentication with the connection provider must be completed in the AWS Console. See the [AWS documentation](https://docs.aws.amazon.com/dtconsole/latest/userguide/connections-update.html) for details.
-
-## Example Usage
-
-```terraform
-resource "aws_codestarconnections_connection" "example" {
-  name          = "example-connection"
-  provider_type = "Bitbucket"
-}
-
-resource "aws_codepipeline" "example" {
-  name     = "tf-test-pipeline"
-  role_arn = aws_iam_role.codepipeline_role.arn
-
-  artifact_store {
-    # ...
-  }
-
-  stage {
-    name = "Source"
-    action {
-      name             = "Source"
-      category         = "Source"
-      owner            = "AWS"
-      provider         = "CodeStarSourceConnection"
-      version          = "1"
-      output_artifacts = ["source_output"]
-      configuration = {
-        ConnectionArn    = aws_codestarconnections_connection.example.arn
-        FullRepositoryId = "my-organization/test"
-        BranchName       = "main"
-      }
-    }
-  }
-
-  stage {
-    name = "Build"
-    action {
-      # ...
-    }
-  }
-
-  stage {
-    name = "Deploy"
-    action {
-      # ...
-    }
-  }
-}
-```
-
-## Argument Reference
-
-The following arguments are supported:
-
-* `name` - (Required) The name of the connection to be created. The name must be unique in the calling AWS account. Changing `name` will create a new resource.
-* `provider_type` - (Optional) The name of the external provider where your third-party code repository is configured. Valid values are `Bitbucket`, `GitHub` or `GitHubEnterpriseServer`. Changing `provider_type` will create a new resource. Conflicts with `host_arn`
-* `host_arn` - (Optional) The Amazon Resource Name (ARN) of the host associated with the connection. Conflicts with `provider_type`
-* `tags` - (Optional) Map of key-value resource tags to associate with the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
-
-## Attributes Reference
-
-In addition to all arguments above, the following attributes are exported:
-
-* `id` - The codestar connection ARN.
-* `arn` - The codestar connection ARN.
-* `connection_status` - The codestar connection status. Possible values are `PENDING`, `AVAILABLE` and `ERROR`.
-* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
-
-## Import
-
-CodeStar connections can be imported using the ARN, e.g.,
-
-```
-$ terraform import aws_codestarconnections_connection.test-connection arn:aws:codestar-connections:us-west-1:0123456789:connection/79d4d357-a2ee-41e4-b350-2fe39ae59448
-```
diff --git a/website/docs/r/codestarconnections_host.html.markdown b/website/docs/r/codestarconnections_host.html.markdown
new file mode 100644
index 00000000000..bf81c287b97
--- /dev/null
+++ b/website/docs/r/codestarconnections_host.html.markdown
@@ -0,0 +1,64 @@
+---
+subcategory: "CodeStar Connections"
+layout: "aws"
+page_title: "AWS: aws_codestarconnections_host"
+description: |-
+  Provides a CodeStar Host
+---
+
+# Resource: aws_codestarconnections_host
+
+Provides a CodeStar Host.
+
+~> **NOTE:** The `aws_codestarconnections_host` resource is created in the state `PENDING`. Authentication with the host provider must be completed in the AWS Console. For more information visit [Set up a pending host](https://docs.aws.amazon.com/dtconsole/latest/userguide/connections-host-setup.html).
+
+## Example Usage
+
+```terraform
+resource "aws_codestarconnections_host" "example" {
+  name              = "example-host"
+  provider_endpoint = "https://example.com"
+  provider_type     = "GitHubEnterpriseServer"
+}
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the host to be created. The name must be unique in the calling AWS account.
+* `provider_endpoint` - (Required) The endpoint of the infrastructure to be represented by the host after it is created.
+* `provider_type` - (Required) The name of the external provider where your third-party code repository is configured.
+* `vpc_configuration` - (Optional) The VPC configuration to be provisioned for the host. A VPC must be configured, and the infrastructure to be represented by the host must already be connected to the VPC.
+
+A `vpc_configuration` block supports the following arguments:
+
+* `security_group_ids` - (Required) ID of the security group or security groups associated with the Amazon VPC connected to the infrastructure where your provider type is installed.
+* `subnet_ids` - (Required) The ID of the subnet or subnets associated with the Amazon VPC connected to the infrastructure where your provider type is installed.
+* `tls_certificate` - (Optional) The value of the Transport Layer Security (TLS) certificate associated with the infrastructure where your provider type is installed.
+* `vpc_id` - (Required) The ID of the Amazon VPC connected to the infrastructure where your provider type is installed.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The CodeStar Host ARN.
+* `arn` - The CodeStar Host ARN.
+* `status` - The CodeStar Host status. Possible values are `PENDING`, `AVAILABLE`, `VPC_CONFIG_DELETING`, `VPC_CONFIG_INITIALIZING`, and `VPC_CONFIG_FAILED_INITIALIZATION`.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CodeStar Host using the ARN. For example:
+
+```terraform
+import {
+  to = aws_codestarconnections_host.example-host
+  id = "arn:aws:codestar-connections:us-west-1:0123456789:host/79d4d357-a2ee-41e4-b350-2fe39ae59448"
+}
+```
+
+Using `terraform import`, import CodeStar Host using the ARN. For example:
+
+```console
+% terraform import aws_codestarconnections_host.example-host arn:aws:codestar-connections:us-west-1:0123456789:host/79d4d357-a2ee-41e4-b350-2fe39ae59448
+```
diff --git a/website/docs/r/codestarconnections_host.markdown b/website/docs/r/codestarconnections_host.markdown
deleted file mode 100644
index b094d936478..00000000000
--- a/website/docs/r/codestarconnections_host.markdown
+++ /dev/null
@@ -1,55 +0,0 @@
----
-subcategory: "CodeStar Connections"
-layout: "aws"
-page_title: "AWS: aws_codestarconnections_host"
-description: |-
-  Provides a CodeStar Host
----
-
-# Resource: aws_codestarconnections_host
-
-Provides a CodeStar Host.
-
-~> **NOTE:** The `aws_codestarconnections_host` resource is created in the state `PENDING`. Authentication with the host provider must be completed in the AWS Console. For more information visit [Set up a pending host](https://docs.aws.amazon.com/dtconsole/latest/userguide/connections-host-setup.html).
-
-## Example Usage
-
-```terraform
-resource "aws_codestarconnections_host" "example" {
-  name              = "example-host"
-  provider_endpoint = "https://example.com"
-  provider_type     = "GitHubEnterpriseServer"
-}
-```
-
-## Argument Reference
-
-The following arguments are supported:
-
-* `name` - (Required) The name of the host to be created. The name must be unique in the calling AWS account.
-* `provider_endpoint` - (Required) The endpoint of the infrastructure to be represented by the host after it is created.
-* `provider_type` - (Required) The name of the external provider where your third-party code repository is configured.
-* `vpc_configuration` - (Optional) The VPC configuration to be provisioned for the host. A VPC must be configured, and the infrastructure to be represented by the host must already be connected to the VPC.
-
-A `vpc_configuration` block supports the following arguments:
-
-* `security_group_ids` - (Required) ID of the security group or security groups associated with the Amazon VPC connected to the infrastructure where your provider type is installed.
-* `subnet_ids` - (Required) The ID of the subnet or subnets associated with the Amazon VPC connected to the infrastructure where your provider type is installed.
-* `tls_certificate` - (Optional) The value of the Transport Layer Security (TLS) certificate associated with the infrastructure where your provider type is installed.
-* `vpc_id` - (Required) The ID of the Amazon VPC connected to the infrastructure where your provider type is installed.
-
-## Attributes Reference
-
-In addition to all arguments above, the following attributes are exported:
-
-* `id` - The CodeStar Host ARN.
-* `arn` - The CodeStar Host ARN.
-* `status` - The CodeStar Host status. Possible values are `PENDING`, `AVAILABLE`, `VPC_CONFIG_DELETING`, `VPC_CONFIG_INITIALIZING`, and `VPC_CONFIG_FAILED_INITIALIZATION`.
-
-## Import
-
-CodeStar Host can be imported using the ARN, e.g.,
-
-```
-$ terraform import aws_codestarconnections_host.example-host arn:aws:codestar-connections:us-west-1:0123456789:host/79d4d357-a2ee-41e4-b350-2fe39ae59448
-```
diff --git a/website/docs/r/codestarnotifications_notification_rule.html.markdown b/website/docs/r/codestarnotifications_notification_rule.html.markdown
new file mode 100644
index 00000000000..33e329bc9ec
--- /dev/null
+++ b/website/docs/r/codestarnotifications_notification_rule.html.markdown
@@ -0,0 +1,96 @@
+---
+subcategory: "CodeStar Notifications"
+layout: "aws"
+page_title: "AWS: aws_codestarnotifications_notification_rule"
+description: |-
+  Provides a CodeStar Notifications Rule
+---
+
+# Resource: aws_codestarnotifications_notification_rule
+
+Provides a CodeStar Notifications Rule.
+
+## Example Usage
+
+```terraform
+resource "aws_codecommit_repository" "code" {
+  repository_name = "example-code-repo"
+}
+
+resource "aws_sns_topic" "notif" {
+  name = "notification"
+}
+
+data "aws_iam_policy_document" "notif_access" {
+  statement {
+    actions = ["sns:Publish"]
+
+    principals {
+      type        = "Service"
+      identifiers = ["codestar-notifications.amazonaws.com"]
+    }
+
+    resources = [aws_sns_topic.notif.arn]
+  }
+}
+
+resource "aws_sns_topic_policy" "default" {
+  arn    = aws_sns_topic.notif.arn
+  policy = data.aws_iam_policy_document.notif_access.json
+}
+
+resource "aws_codestarnotifications_notification_rule" "commits" {
+  detail_type    = "BASIC"
+  event_type_ids = ["codecommit-repository-comments-on-commits"]
+
+  name     = "example-code-repo-commits"
+  resource = aws_codecommit_repository.code.arn
+
+  target {
+    address = aws_sns_topic.notif.arn
+  }
+}
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `detail_type` - (Required) The level of detail to include in the notifications for this resource. Possible values are `BASIC` and `FULL`.
+* `event_type_ids` - (Required) A list of event types associated with this notification rule.
+  For list of allowed events see [here](https://docs.aws.amazon.com/codestar-notifications/latest/userguide/concepts.html#concepts-api).
+* `name` - (Required) The name of notification rule.
+* `resource` - (Required) The ARN of the resource to associate with the notification rule.
+* `status` - (Optional) The status of the notification rule. Possible values are `ENABLED` and `DISABLED`, default is `ENABLED`.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `target` - (Optional) Configuration blocks containing notification target information. Can be specified multiple times. At least one target must be specified on creation.
+
+An `target` block supports the following arguments:
+
+* `address` - (Required) The ARN of notification rule target. For example, a SNS Topic ARN.
+* `type` - (Optional) The type of the notification target. Default value is `SNS`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The codestar notification rule ARN.
+* `arn` - The codestar notification rule ARN.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CodeStar notification rule using the ARN. For example:
+
+```terraform
+import {
+  to = aws_codestarnotifications_notification_rule.foo
+  id = "arn:aws:codestar-notifications:us-west-1:0123456789:notificationrule/2cdc68a3-8f7c-4893-b6a5-45b362bd4f2b"
+}
+```
+
+Using `terraform import`, import CodeStar notification rule using the ARN. For example:
+
+```console
+% terraform import aws_codestarnotifications_notification_rule.foo arn:aws:codestar-notifications:us-west-1:0123456789:notificationrule/2cdc68a3-8f7c-4893-b6a5-45b362bd4f2b
+```
diff --git a/website/docs/r/codestarnotifications_notification_rule.markdown b/website/docs/r/codestarnotifications_notification_rule.markdown
deleted file mode 100644
index 5c27a9734bd..00000000000
--- a/website/docs/r/codestarnotifications_notification_rule.markdown
+++ /dev/null
@@ -1,87 +0,0 @@
----
-subcategory: "CodeStar Notifications"
-layout: "aws"
-page_title: "AWS: aws_codestarnotifications_notification_rule"
-description: |-
-  Provides a CodeStar Notifications Rule
----
-
-# Resource: aws_codestarnotifications_notification_rule
-
-Provides a CodeStar Notifications Rule.
-
-## Example Usage
-
-```terraform
-resource "aws_codecommit_repository" "code" {
-  repository_name = "example-code-repo"
-}
-
-resource "aws_sns_topic" "notif" {
-  name = "notification"
-}
-
-data "aws_iam_policy_document" "notif_access" {
-  statement {
-    actions = ["sns:Publish"]
-
-    principals {
-      type        = "Service"
-      identifiers = ["codestar-notifications.amazonaws.com"]
-    }
-
-    resources = [aws_sns_topic.notif.arn]
-  }
-}
-
-resource "aws_sns_topic_policy" "default" {
-  arn    = aws_sns_topic.notif.arn
-  policy = data.aws_iam_policy_document.notif_access.json
-}
-
-resource "aws_codestarnotifications_notification_rule" "commits" {
-  detail_type    = "BASIC"
-  event_type_ids = ["codecommit-repository-comments-on-commits"]
-
-  name     = "example-code-repo-commits"
-  resource = aws_codecommit_repository.code.arn
-
-  target {
-    address = aws_sns_topic.notif.arn
-  }
-}
-```
-
-## Argument Reference
-
-The following arguments are supported:
-
-* `detail_type` - (Required) The level of detail to include in the notifications for this resource. Possible values are `BASIC` and `FULL`.
-* `event_type_ids` - (Required) A list of event types associated with this notification rule.
-  For list of allowed events see [here](https://docs.aws.amazon.com/codestar-notifications/latest/userguide/concepts.html#concepts-api).
-* `name` - (Required) The name of notification rule.
-* `resource` - (Required) The ARN of the resource to associate with the notification rule.
-* `status` - (Optional) The status of the notification rule. Possible values are `ENABLED` and `DISABLED`, default is `ENABLED`.
-* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
-* `target` - (Optional) Configuration blocks containing notification target information. Can be specified multiple times. At least one target must be specified on creation.
-
-An `target` block supports the following arguments:
-
-* `address` - (Required) The ARN of notification rule target. For example, a SNS Topic ARN.
-* `type` - (Optional) The type of the notification target. Default value is `SNS`.
-
-## Attributes Reference
-
-In addition to all arguments above, the following attributes are exported:
-
-* `id` - The codestar notification rule ARN.
-* `arn` - The codestar notification rule ARN.
-* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
-
-## Import
-
-CodeStar notification rule can be imported using the ARN, e.g.,
-
-```
-$ terraform import aws_codestarnotifications_notification_rule.foo arn:aws:codestar-notifications:us-west-1:0123456789:notificationrule/2cdc68a3-8f7c-4893-b6a5-45b362bd4f2b
-```
diff --git a/website/docs/r/cognito_identity_pool.html.markdown b/website/docs/r/cognito_identity_pool.html.markdown
new file mode 100644
index 00000000000..03f6638f753
--- /dev/null
+++ b/website/docs/r/cognito_identity_pool.html.markdown
@@ -0,0 +1,92 @@
+---
+subcategory: "Cognito Identity"
+layout: "aws"
+page_title: "AWS: aws_cognito_identity_pool"
+description: |-
+  Provides an AWS Cognito Identity Pool.
+---
+
+# Resource: aws_cognito_identity_pool
+
+Provides an AWS Cognito Identity Pool.
+
+## Example Usage
+
+```terraform
+resource "aws_iam_saml_provider" "default" {
+  name                   = "my-saml-provider"
+  saml_metadata_document = file("saml-metadata.xml")
+}
+
+resource "aws_cognito_identity_pool" "main" {
+  identity_pool_name               = "identity pool"
+  allow_unauthenticated_identities = false
+  allow_classic_flow               = false
+
+  cognito_identity_providers {
+    client_id               = "6lhlkkfbfb4q5kpp90urffae"
+    provider_name           = "cognito-idp.us-east-1.amazonaws.com/us-east-1_Tv0493apJ"
+    server_side_token_check = false
+  }
+
+  cognito_identity_providers {
+    client_id               = "7kodkvfqfb4qfkp39eurffae"
+    provider_name           = "cognito-idp.us-east-1.amazonaws.com/eu-west-1_Zr231apJu"
+    server_side_token_check = false
+  }
+
+  supported_login_providers = {
+    "graph.facebook.com"  = "7346241598935552"
+    "accounts.google.com" = "123456789012.apps.googleusercontent.com"
+  }
+
+  saml_provider_arns           = [aws_iam_saml_provider.default.arn]
+  openid_connect_provider_arns = ["arn:aws:iam::123456789012:oidc-provider/id.example.com"]
+}
+```
+
+## Argument Reference
+
+The Cognito Identity Pool argument layout is a structure composed of several sub-resources - these resources are laid out below.
+
+* `identity_pool_name` (Required) - The Cognito Identity Pool name.
+* `allow_unauthenticated_identities` (Required) - Whether the identity pool supports unauthenticated logins or not.
+* `allow_classic_flow` (Optional) - Enables or disables the classic / basic authentication flow. Default is `false`.
+* `developer_provider_name` (Optional) - The "domain" by which Cognito will refer to your users. This name acts as a placeholder that allows your
+backend and the Cognito service to communicate about the developer provider.
+* `cognito_identity_providers` (Optional) - An array of [Amazon Cognito Identity user pools](#cognito-identity-providers) and their client IDs.
+* `openid_connect_provider_arns` (Optional) - Set of OpendID Connect provider ARNs.
+* `saml_provider_arns` (Optional) - An array of Amazon Resource Names (ARNs) of the SAML provider for your identity.
+* `supported_login_providers` (Optional) - Key-Value pairs mapping provider names to provider app IDs.
+* `tags` - (Optional) A map of tags to assign to the Identity Pool. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+#### Cognito Identity Providers
+
+* `client_id` (Optional) - The client ID for the Amazon Cognito Identity User Pool.
+* `provider_name` (Optional) - The provider name for an Amazon Cognito Identity User Pool.
+* `server_side_token_check` (Optional) - Whether server-side token validation is enabled for the identity provider’s token or not.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - An identity pool ID, e.g. `us-west-2:1a234567-8901-234b-5cde-f6789g01h2i3`.
+* `arn` - The ARN of the identity pool.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Cognito Identity Pool using its ID. For example:
+
+```terraform
+import {
+  to = aws_cognito_identity_pool.mypool
+  id = "us-west-2:1a234567-8901-234b-5cde-f6789g01h2i3"
+}
+```
+
+Using `terraform import`, import Cognito Identity Pool using its ID. For example:
+
+```console
+% terraform import aws_cognito_identity_pool.mypool us-west-2:1a234567-8901-234b-5cde-f6789g01h2i3
+```
diff --git a/website/docs/r/cognito_identity_pool.markdown b/website/docs/r/cognito_identity_pool.markdown
deleted file mode 100644
index 944a957900b..00000000000
--- a/website/docs/r/cognito_identity_pool.markdown
+++ /dev/null
@@ -1,83 +0,0 @@
----
-subcategory: "Cognito Identity"
-layout: "aws"
-page_title: "AWS: aws_cognito_identity_pool"
-description: |-
-  Provides an AWS Cognito Identity Pool.
----
-
-# Resource: aws_cognito_identity_pool
-
-Provides an AWS Cognito Identity Pool.
-
-## Example Usage
-
-```terraform
-resource "aws_iam_saml_provider" "default" {
-  name                   = "my-saml-provider"
-  saml_metadata_document = file("saml-metadata.xml")
-}
-
-resource "aws_cognito_identity_pool" "main" {
-  identity_pool_name               = "identity pool"
-  allow_unauthenticated_identities = false
-  allow_classic_flow               = false
-
-  cognito_identity_providers {
-    client_id               = "6lhlkkfbfb4q5kpp90urffae"
-    provider_name           = "cognito-idp.us-east-1.amazonaws.com/us-east-1_Tv0493apJ"
-    server_side_token_check = false
-  }
-
-  cognito_identity_providers {
-    client_id               = "7kodkvfqfb4qfkp39eurffae"
-    provider_name           = "cognito-idp.us-east-1.amazonaws.com/eu-west-1_Zr231apJu"
-    server_side_token_check = false
-  }
-
-  supported_login_providers = {
-    "graph.facebook.com"  = "7346241598935552"
-    "accounts.google.com" = "123456789012.apps.googleusercontent.com"
-  }
-
-  saml_provider_arns           = [aws_iam_saml_provider.default.arn]
-  openid_connect_provider_arns = ["arn:aws:iam::123456789012:oidc-provider/id.example.com"]
-}
-```
-
-## Argument Reference
-
-The Cognito Identity Pool argument layout is a structure composed of several sub-resources - these resources are laid out below.
-
-* `identity_pool_name` (Required) - The Cognito Identity Pool name.
-* `allow_unauthenticated_identities` (Required) - Whether the identity pool supports unauthenticated logins or not.
-* `allow_classic_flow` (Optional) - Enables or disables the classic / basic authentication flow. Default is `false`.
-* `developer_provider_name` (Optional) - The "domain" by which Cognito will refer to your users. This name acts as a placeholder that allows your
-backend and the Cognito service to communicate about the developer provider.
-* `cognito_identity_providers` (Optional) - An array of [Amazon Cognito Identity user pools](#cognito-identity-providers) and their client IDs.
-* `openid_connect_provider_arns` (Optional) - Set of OpendID Connect provider ARNs.
-* `saml_provider_arns` (Optional) - An array of Amazon Resource Names (ARNs) of the SAML provider for your identity.
-* `supported_login_providers` (Optional) - Key-Value pairs mapping provider names to provider app IDs.
-* `tags` - (Optional) A map of tags to assign to the Identity Pool. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
-
-#### Cognito Identity Providers
-
-* `client_id` (Optional) - The client ID for the Amazon Cognito Identity User Pool.
-* `provider_name` (Optional) - The provider name for an Amazon Cognito Identity User Pool.
-* `server_side_token_check` (Optional) - Whether server-side token validation is enabled for the identity provider’s token or not.
-
-## Attributes Reference
-
-In addition to all arguments above, the following attributes are exported:
-
-* `id` - An identity pool ID, e.g. `us-west-2:1a234567-8901-234b-5cde-f6789g01h2i3`.
-* `arn` - The ARN of the identity pool.
-* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
-
-## Import
-
-Cognito Identity Pool can be imported using its ID, e.g.,
-
-```
-$ terraform import aws_cognito_identity_pool.mypool us-west-2:1a234567-8901-234b-5cde-f6789g01h2i3
-```
diff --git a/website/docs/r/cognito_identity_pool_provider_principal_tag.html.markdown b/website/docs/r/cognito_identity_pool_provider_principal_tag.html.markdown
new file mode 100644
index 00000000000..faf64ec554b
--- /dev/null
+++ b/website/docs/r/cognito_identity_pool_provider_principal_tag.html.markdown
@@ -0,0 +1,77 @@
+---
+subcategory: "Cognito Identity"
+layout: "aws"
+page_title: "AWS: aws_cognito_identity_pool_provider_principal_tag"
+description: |-
+  Provides an AWS Cognito Identity Principal Mapping.
+---
+
+# Resource: aws_cognito_identity_pool_provider_principal_tag
+
+Provides an AWS Cognito Identity Principal Mapping.
+
+## Example Usage
+
+```terraform
+resource "aws_cognito_user_pool" "example" {
+  name                     = "user pool"
+  auto_verified_attributes = ["email"]
+}
+
+resource "aws_cognito_user_pool_client" "example" {
+  name         = "client"
+  user_pool_id = aws_cognito_user_pool.example.id
+  supported_identity_providers = compact([
+    "COGNITO",
+  ])
+}
+
+resource "aws_cognito_identity_pool" "example" {
+  identity_pool_name               = "identity pool"
+  allow_unauthenticated_identities = false
+  cognito_identity_providers {
+    client_id               = aws_cognito_user_pool_client.example.id
+    provider_name           = aws_cognito_user_pool.example.endpoint
+    server_side_token_check = false
+  }
+}
+
+resource "aws_cognito_identity_pool_provider_principal_tag" "example" {
+  identity_pool_id       = aws_cognito_identity_pool.example.id
+  identity_provider_name = aws_cognito_user_pool.example.endpoint
+  use_defaults           = false
+  principal_tags = {
+    test = "value"
+  }
+}
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `identity_pool_id` (Required) - An identity pool ID.
+* `identity_provider_name` (Required) - The name of the identity provider.
+* `principal_tags`: (Optional: []) - String to string map of variables.
+* `use_defaults`: (Optional: true) use default (username and clientID) attribute mappings.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Cognito Identity Pool Roles Attachment using the Identity Pool ID and provider name. For example:
+
+```terraform
+import {
+  to = aws_cognito_identity_pool_provider_principal_tag.example
+  id = "us-west-2_abc123:CorpAD"
+}
+```
+
+Using `terraform import`, import Cognito Identity Pool Roles Attachment using the Identity Pool ID and provider name. For example:
+
+```console
+% terraform import aws_cognito_identity_pool_provider_principal_tag.example us-west-2_abc123:CorpAD
+```
diff --git a/website/docs/r/cognito_identity_pool_provider_principal_tag.markdown b/website/docs/r/cognito_identity_pool_provider_principal_tag.markdown
deleted file mode 100644
index 735f27ff467..00000000000
--- a/website/docs/r/cognito_identity_pool_provider_principal_tag.markdown
+++ /dev/null
@@ -1,68 +0,0 @@
----
-subcategory: "Cognito Identity"
-layout: "aws"
-page_title: "AWS: aws_cognito_identity_pool_provider_principal_tag"
-description: |-
-  Provides an AWS Cognito Identity Principal Mapping.
----
-
-# Resource: aws_cognito_identity_pool_provider_principal_tag
-
-Provides an AWS Cognito Identity Principal Mapping.
-
-## Example Usage
-
-```terraform
-resource "aws_cognito_user_pool" "example" {
-  name                     = "user pool"
-  auto_verified_attributes = ["email"]
-}
-
-resource "aws_cognito_user_pool_client" "example" {
-  name         = "client"
-  user_pool_id = aws_cognito_user_pool.example.id
-  supported_identity_providers = compact([
-    "COGNITO",
-  ])
-}
-
-resource "aws_cognito_identity_pool" "example" {
-  identity_pool_name               = "identity pool"
-  allow_unauthenticated_identities = false
-  cognito_identity_providers {
-    client_id               = aws_cognito_user_pool_client.example.id
-    provider_name           = aws_cognito_user_pool.example.endpoint
-    server_side_token_check = false
-  }
-}
-
-resource "aws_cognito_identity_pool_provider_principal_tag" "example" {
-  identity_pool_id       = aws_cognito_identity_pool.example.id
-  identity_provider_name = aws_cognito_user_pool.example.endpoint
-  use_defaults           = false
-  principal_tags = {
-    test = "value"
-  }
-}
-```
-
-## Argument Reference
-
-The following arguments are supported:
-
-* `identity_pool_id` (Required) - An identity pool ID.
-* `identity_provider_name` (Required) - The name of the identity provider.
-* `principal_tags`: (Optional: []) - String to string map of variables.
-* `use_defaults`: (Optional: true) use default (username and clientID) attribute mappings.
-
-## Attributes Reference
-
-No additional attributes are exported.
-
-## Import
-
-Cognito Identity Pool Roles Attachment can be imported using the Identity Pool ID and provider name, e.g.,
-
-```
-$ terraform import aws_cognito_identity_pool_provider_principal_tag.example us-west-2_abc123:CorpAD
-```
diff --git a/website/docs/r/cognito_identity_pool_roles_attachment.html.markdown b/website/docs/r/cognito_identity_pool_roles_attachment.html.markdown
new file mode 100644
index 00000000000..23c0000bb68
--- /dev/null
+++ b/website/docs/r/cognito_identity_pool_roles_attachment.html.markdown
@@ -0,0 +1,140 @@
+---
+subcategory: "Cognito Identity"
+layout: "aws"
+page_title: "AWS: aws_cognito_identity_pool_roles_attachment"
+description: |-
+  Provides an AWS Cognito Identity Pool Roles Attachment.
+---
+
+# Resource: aws_cognito_identity_pool_roles_attachment
+
+Provides an AWS Cognito Identity Pool Roles Attachment.
+
+## Example Usage
+
+```terraform
+resource "aws_cognito_identity_pool" "main" {
+  identity_pool_name               = "identity pool"
+  allow_unauthenticated_identities = false
+
+  supported_login_providers = {
+    "graph.facebook.com" = "7346241598935555"
+  }
+}
+
+data "aws_iam_policy_document" "authenticated" {
+  statement {
+    effect = "Allow"
+
+    principals {
+      type        = "Federated"
+      identifiers = ["cognito-identity.amazonaws.com"]
+    }
+
+    actions = ["sts:AssumeRoleWithWebIdentity"]
+
+    condition {
+      test     = "StringEquals"
+      variable = "cognito-identity.amazonaws.com:aud"
+      values   = [aws_cognito_identity_pool.main.id]
+    }
+
+    condition {
+      test     = "ForAnyValue:StringLike"
+      variable = "cognito-identity.amazonaws.com:amr"
+      values   = ["authenticated"]
+    }
+  }
+}
+
+resource "aws_iam_role" "authenticated" {
+  name               = "cognito_authenticated"
+  assume_role_policy = data.aws_iam_policy_document.authenticated.json
+}
+
+data "aws_iam_policy_document" "authenticated_role_policy" {
+  statement {
+    effect = "Allow"
+
+    actions = [
+      "mobileanalytics:PutEvents",
+      "cognito-sync:*",
+      "cognito-identity:*",
+    ]
+
+    resources = ["*"]
+  }
+}
+
+resource "aws_iam_role_policy" "authenticated" {
+  name   = "authenticated_policy"
+  role   = aws_iam_role.authenticated.id
+  policy = data.aws_iam_policy_document.authenticated_role_policy.json
+}
+
+resource "aws_cognito_identity_pool_roles_attachment" "main" {
+  identity_pool_id = aws_cognito_identity_pool.main.id
+
+  role_mapping {
+    identity_provider         = "graph.facebook.com"
+    ambiguous_role_resolution = "AuthenticatedRole"
+    type                      = "Rules"
+
+    mapping_rule {
+      claim      = "isAdmin"
+      match_type = "Equals"
+      role_arn   = aws_iam_role.authenticated.arn
+      value      = "paid"
+    }
+  }
+
+  roles = {
+    "authenticated" = aws_iam_role.authenticated.arn
+  }
+}
+```
+
+## Argument Reference
+
+The Cognito Identity Pool Roles Attachment argument layout is a structure composed of several sub-resources - these resources are laid out below.
+
+* `identity_pool_id` (Required) - An identity pool ID in the format `REGION_GUID`.
+* `role_mapping` (Optional) - A List of [Role Mapping](#role-mappings).
+* `roles` (Required) - The map of roles associated with this pool. For a given role, the key will be either "authenticated" or "unauthenticated" and the value will be the Role ARN.
+
+#### Role Mappings
+
+* `identity_provider` (Required) - A string identifying the identity provider, for example, "graph.facebook.com" or "cognito-idp.us-east-1.amazonaws.com/us-east-1_abcdefghi:app_client_id". Depends on `cognito_identity_providers` set on `aws_cognito_identity_pool` resource or a `aws_cognito_identity_provider` resource.
+* `ambiguous_role_resolution` (Optional) - Specifies the action to be taken if either no rules match the claim value for the Rules type, or there is no cognito:preferred_role claim and there are multiple cognito:roles matches for the Token type. `Required` if you specify Token or Rules as the Type.
+* `mapping_rule` (Optional) - The [Rules Configuration](#rules-configuration) to be used for mapping users to roles. You can specify up to 25 rules per identity provider. Rules are evaluated in order. The first one to match specifies the role.
+* `type` (Required) - The role mapping type.
+
+#### Rules Configuration
+
+* `claim` (Required) - The claim name that must be present in the token, for example, "isAdmin" or "paid".
+* `match_type` (Required) - The match condition that specifies how closely the claim value in the IdP token must match Value.
+* `role_arn` (Required) - The role ARN.
+* `value` (Required) - A brief string that the claim must match, for example, "paid" or "yes".
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The identity pool ID.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Cognito Identity Pool Roles Attachment using the Identity Pool ID. For example:
+
+```terraform
+import {
+  to = aws_cognito_identity_pool_roles_attachment.example
+  id = "us-west-2:b64805ad-cb56-40ba-9ffc-f5d8207e6d42"
+}
+```
+
+Using `terraform import`, import Cognito Identity Pool Roles Attachment using the Identity Pool ID. For example:
+
+```console
+% terraform import aws_cognito_identity_pool_roles_attachment.example us-west-2:b64805ad-cb56-40ba-9ffc-f5d8207e6d42
+```
diff --git a/website/docs/r/cognito_identity_pool_roles_attachment.markdown b/website/docs/r/cognito_identity_pool_roles_attachment.markdown
deleted file mode 100644
index 52afa0cbe08..00000000000
--- a/website/docs/r/cognito_identity_pool_roles_attachment.markdown
+++ /dev/null
@@ -1,131 +0,0 @@
----
-subcategory: "Cognito Identity"
-layout: "aws"
-page_title: "AWS: aws_cognito_identity_pool_roles_attachment"
-description: |-
-  Provides an AWS Cognito Identity Pool Roles Attachment.
----
-
-# Resource: aws_cognito_identity_pool_roles_attachment
-
-Provides an AWS Cognito Identity Pool Roles Attachment.
-
-## Example Usage
-
-```terraform
-resource "aws_cognito_identity_pool" "main" {
-  identity_pool_name               = "identity pool"
-  allow_unauthenticated_identities = false
-
-  supported_login_providers = {
-    "graph.facebook.com" = "7346241598935555"
-  }
-}
-
-data "aws_iam_policy_document" "authenticated" {
-  statement {
-    effect = "Allow"
-
-    principals {
-      type        = "Federated"
-      identifiers = ["cognito-identity.amazonaws.com"]
-    }
-
-    actions = ["sts:AssumeRoleWithWebIdentity"]
-
-    condition {
-      test     = "StringEquals"
-      variable = "cognito-identity.amazonaws.com:aud"
-      values   = [aws_cognito_identity_pool.main.id]
-    }
-
-    condition {
-      test     = "ForAnyValue:StringLike"
-      variable = "cognito-identity.amazonaws.com:amr"
-      values   = ["authenticated"]
-    }
-  }
-}
-
-resource "aws_iam_role" "authenticated" {
-  name               = "cognito_authenticated"
-  assume_role_policy = data.aws_iam_policy_document.authenticated.json
-}
-
-data "aws_iam_policy_document" "authenticated_role_policy" {
-  statement {
-    effect = "Allow"
-
-    actions = [
-      "mobileanalytics:PutEvents",
-      "cognito-sync:*",
-      "cognito-identity:*",
-    ]
-
-    resources = ["*"]
-  }
-}
-
-resource "aws_iam_role_policy" "authenticated" {
-  name   = "authenticated_policy"
-  role   = aws_iam_role.authenticated.id
-  policy = data.aws_iam_policy_document.authenticated_role_policy.json
-}
-
-resource "aws_cognito_identity_pool_roles_attachment" "main" {
-  identity_pool_id = aws_cognito_identity_pool.main.id
-
-  role_mapping {
-    identity_provider         = "graph.facebook.com"
-    ambiguous_role_resolution = "AuthenticatedRole"
-    type                      = "Rules"
-
-    mapping_rule {
-      claim      = "isAdmin"
-      match_type = "Equals"
-      role_arn   = aws_iam_role.authenticated.arn
-      value      = "paid"
-    }
-  }
-
-  roles = {
-    "authenticated" = aws_iam_role.authenticated.arn
-  }
-}
-```
-
-## Argument Reference
-
-The Cognito Identity Pool Roles Attachment argument layout is a structure composed of several sub-resources - these resources are laid out below.
-
-* `identity_pool_id` (Required) - An identity pool ID in the format `REGION_GUID`.
-* `role_mapping` (Optional) - A List of [Role Mapping](#role-mappings).
-* `roles` (Required) - The map of roles associated with this pool. For a given role, the key will be either "authenticated" or "unauthenticated" and the value will be the Role ARN.
-
-#### Role Mappings
-
-* `identity_provider` (Required) - A string identifying the identity provider, for example, "graph.facebook.com" or "cognito-idp.us-east-1.amazonaws.com/us-east-1_abcdefghi:app_client_id". Depends on `cognito_identity_providers` set on `aws_cognito_identity_pool` resource or a `aws_cognito_identity_provider` resource.
-* `ambiguous_role_resolution` (Optional) - Specifies the action to be taken if either no rules match the claim value for the Rules type, or there is no cognito:preferred_role claim and there are multiple cognito:roles matches for the Token type. `Required` if you specify Token or Rules as the Type.
-* `mapping_rule` (Optional) - The [Rules Configuration](#rules-configuration) to be used for mapping users to roles. You can specify up to 25 rules per identity provider. Rules are evaluated in order. The first one to match specifies the role.
-* `type` (Required) - The role mapping type.
-
-#### Rules Configuration
-
-* `claim` (Required) - The claim name that must be present in the token, for example, "isAdmin" or "paid".
-* `match_type` (Required) - The match condition that specifies how closely the claim value in the IdP token must match Value.
-* `role_arn` (Required) - The role ARN.
-* `value` (Required) - A brief string that the claim must match, for example, "paid" or "yes".
-
-## Attributes Reference
-
-In addition to all arguments above, the following attributes are exported:
-
-* `id` - The identity pool ID.
-
-## Import
-
-Cognito Identity Pool Roles Attachment can be imported using the Identity Pool ID, e.g.,
-
-```
-$ terraform import aws_cognito_identity_pool_roles_attachment.example us-west-2:b64805ad-cb56-40ba-9ffc-f5d8207e6d42
-```
diff --git a/website/docs/r/cognito_identity_provider.html.markdown b/website/docs/r/cognito_identity_provider.html.markdown
index 257b0f9597c..ef66b6b85d2 100644
--- a/website/docs/r/cognito_identity_provider.html.markdown
+++ b/website/docs/r/cognito_identity_provider.html.markdown
@@ -39,7 +39,7 @@ resource "aws_cognito_identity_provider" "example_provider" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `user_pool_id` (Required) - The user pool id
 * `provider_name` (Required) - The provider name
@@ -48,14 +48,23 @@ The following arguments are supported:
 * `idp_identifiers` (Optional) - The list of identity providers.
 * `provider_details` (Optional) - The map of identity details, such as access token
 
-## Attributes Reference
+## Attribute Reference
 
-No additional attributes are exported.
+This resource exports no additional attributes.
 
 ## Import
 
-`aws_cognito_identity_provider` resources can be imported using their User Pool ID and Provider Name, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_cognito_identity_provider` resources using their User Pool ID and Provider Name. For example:
 
+```terraform
+import {
+  to = aws_cognito_identity_provider.example
+  id = "us-west-2_abc123:CorpAD"
+}
 ```
-$ terraform import aws_cognito_identity_provider.example us-west-2_abc123:CorpAD
+
+Using `terraform import`, import `aws_cognito_identity_provider` resources using their User Pool ID and Provider Name. For example:
+
+```console
+% terraform import aws_cognito_identity_provider.example us-west-2_abc123:CorpAD
 ```
diff --git a/website/docs/r/cognito_managed_user_pool_client.html.markdown b/website/docs/r/cognito_managed_user_pool_client.html.markdown
index 94abe7d1b99..7ae35c8daa4 100644
--- a/website/docs/r/cognito_managed_user_pool_client.html.markdown
+++ b/website/docs/r/cognito_managed_user_pool_client.html.markdown
@@ -3,21 +3,18 @@ subcategory: "Cognito IDP (Identity Provider)"
 layout: "aws"
 page_title: "AWS: aws_cognito_managed_user_pool_client"
 description: |-
-  Manages a Cognito User Pool Client resource created by another service.
+  Use the `aws_cognito_user_pool_client` resource to manage a Cognito User Pool Client. This resource is created by another service.
 ---
 
 # Resource: aws_cognito_managed_user_pool_client
 
-Manages a Cognito User Pool Client resource created by another service.
+Use the `aws_cognito_user_pool_client` resource to manage a Cognito User Pool Client.
 
-**This is an advanced resource** and has special caveats to be aware of when using it. Please read this document in its entirety before using this resource.
+**This resource is advanced** and has special caveats to consider before use. Please read this document completely before using the resource.
 
-The `aws_cognito_managed_user_pool_client` resource should only be used to manage a Cognito User Pool Client created automatically by an AWS service.
-For example, when [configuring an OpenSearch Domain to use Cognito authentication](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/cognito-auth.html),
-the OpenSearch service will create the User Pool Client on setup and delete it when no longer needed.
-Therefore, the `aws_cognito_managed_user_pool_client` resource does not _create_ or _delete_ this resource, but instead "adopts" it into management.
+Use the `aws_cognito_managed_user_pool_client` resource to manage a Cognito User Pool Client that is automatically created by an AWS service. For instance, when [configuring an OpenSearch Domain to use Cognito authentication](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/cognito-auth.html), the OpenSearch service creates the User Pool Client during setup and removes it when it is no longer required. As a result, the `aws_cognito_managed_user_pool_client` resource does not create or delete this resource, but instead assumes management of it.
 
-For normal uses of a Cognito User Pool Client, use the [`aws_cognito_managed_user_pool_client` resource](cognito_user_pool_client.html) instead.
+Use the [`aws_cognito_user_pool_client`](cognito_user_pool_client.html) resource to manage Cognito User Pool Clients for normal use cases.
 
 ## Example Usage
 
@@ -97,71 +94,72 @@ data "aws_partition" "current" {}
 
 The following arguments are required:
 
-* `user_pool_id` - (Required) User pool the client belongs to.
-* `name_pattern` - (Required, one of `name_pattern` or `name_prefix`) Regular expression that matches the name of the desired User Pool Client.
-  Must match only one User Pool Client.
-* `name_prefix` - (Required, one of `name_prefix` or `name_pattern`) String that matches the beginning of the name of the desired User Pool Client.
-  Must match only one User Pool Client.
+* `user_pool_id` - (Required) User pool that the client belongs to.
+* `name_pattern` - (Required, one of `name_pattern` or `name_prefix`) Regular expression that matches the name of the desired User Pool Client. It must only match one User Pool Client.
+* `name_prefix` - (Required, one of `name_prefix` or `name_pattern`) String that matches the beginning of the name of the desired User Pool Client. It must match only one User Pool Client.
 
 The following arguments are optional:
 
-* `access_token_validity` - (Optional) Time limit, between 5 minutes and 1 day, after which the access token is no longer valid and cannot be used.
-  By default, the unit is hours.
-  The unit can be overridden by a value in `token_validity_units.access_token`.
-* `allowed_oauth_flows_user_pool_client` - (Optional) Whether the client is allowed to follow the OAuth protocol when interacting with Cognito user pools.
-* `allowed_oauth_flows` - (Optional) List of allowed OAuth flows (code, implicit, client_credentials).
-* `allowed_oauth_scopes` - (Optional) List of allowed OAuth scopes (phone, email, openid, profile, and aws.cognito.signin.user.admin).
-* `analytics_configuration` - (Optional) Configuration block for Amazon Pinpoint analytics for collecting metrics for this user pool. [Detailed below](#analytics_configuration).
-* `auth_session_validity` - (Optional) Amazon Cognito creates a session token for each API request in an authentication flow. AuthSessionValidity is the duration, in minutes, of that session token. Your user pool native user must respond to each authentication challenge before the session expires. Valid values between `3` and `15`. Default value is `3`.
+* `access_token_validity` - (Optional) Time limit, between 5 minutes and 1 day, after which the access token is no longer valid and cannot be used. By default, the unit is hours. The unit can be overridden by a value in `token_validity_units.access_token`.
+* `allowed_oauth_flows_user_pool_client` - (Optional) Whether the client is allowed to use the OAuth protocol when interacting with Cognito user pools.
+* `allowed_oauth_flows` - (Optional) List of allowed OAuth flows, including code, implicit, and client_credentials.
+* `allowed_oauth_scopes` - (Optional) List of allowed OAuth scopes, including phone, email, openid, profile, and aws.cognito.signin.user.admin.
+* `analytics_configuration` - (Optional) Configuration block for Amazon Pinpoint analytics that collects metrics for this user pool. See [details below](#analytics_configuration).
+* `auth_session_validity` - (Optional) Duration, in minutes, of the session token created by Amazon Cognito for each API request in an authentication flow. The session token must be responded to by the native user of the user pool before it expires. Valid values for `auth_session_validity` are between `3` and `15`, with a default value of `3`.
 * `callback_urls` - (Optional) List of allowed callback URLs for the identity providers.
-* `default_redirect_uri` - (Optional) Default redirect URI. Must be in the list of callback URLs.
+* `default_redirect_uri` - (Optional) Default redirect URI and must be included in the list of callback URLs.
 * `enable_token_revocation` - (Optional) Enables or disables token revocation.
-* `enable_propagate_additional_user_context_data` - (Optional) Activates the propagation of additional user context data.
-* `explicit_auth_flows` - (Optional) List of authentication flows (ADMIN_NO_SRP_AUTH, CUSTOM_AUTH_FLOW_ONLY, USER_PASSWORD_AUTH, ALLOW_ADMIN_USER_PASSWORD_AUTH, ALLOW_CUSTOM_AUTH, ALLOW_USER_PASSWORD_AUTH, ALLOW_USER_SRP_AUTH, ALLOW_REFRESH_TOKEN_AUTH).
-* `generate_secret` - (Optional) Should an application secret be generated.
-* `id_token_validity` - (Optional) Time limit, between 5 minutes and 1 day, after which the ID token is no longer valid and cannot be used.
-  By default, the unit is hours.
-  The unit can be overridden by a value in `token_validity_units.id_token`.
+* `enable_propagate_additional_user_context_data` - (Optional) Enables the propagation of additional user context data.
+* `explicit_auth_flows` - (Optional) List of authentication flows. The available options include ADMIN_NO_SRP_AUTH, CUSTOM_AUTH_FLOW_ONLY, USER_PASSWORD_AUTH, ALLOW_ADMIN_USER_PASSWORD_AUTH, ALLOW_CUSTOM_AUTH, ALLOW_USER_PASSWORD_AUTH, ALLOW_USER_SRP_AUTH, and ALLOW_REFRESH_TOKEN_AUTH.
+* `generate_secret` - (Optional) Boolean flag indicating whether an application secret should be generated.
+* `id_token_validity` - (Optional) Time limit, between 5 minutes and 1 day, after which the ID token is no longer valid and cannot be used. By default, the unit is hours. The unit can be overridden by a value in `token_validity_units.id_token`.
 * `logout_urls` - (Optional) List of allowed logout URLs for the identity providers.
-* `prevent_user_existence_errors` - (Optional) Choose which errors and responses are returned by Cognito APIs during authentication, account confirmation, and password recovery when the user does not exist in the user pool. When set to `ENABLED` and the user does not exist, authentication returns an error indicating either the username or password was incorrect, and account confirmation and password recovery return a response indicating a code was sent to a simulated destination. When set to `LEGACY`, those APIs will return a `UserNotFoundException` exception if the user does not exist in the user pool.
-* `read_attributes` - (Optional) List of user pool attributes the application client can read from.
-* `refresh_token_validity` - (Optional) Time limit, between 60 minutes and 10 years, after which the refresh token is no longer valid and cannot be used.
-  By default, the unit is days.
-  The unit can be overridden by a value in `token_validity_units.refresh_token`.
-* `supported_identity_providers` - (Optional) List of provider names for the identity providers that are supported on this client. Uses the `provider_name` attribute of `aws_cognito_identity_provider` resource(s), or the equivalent string(s).
-* `token_validity_units` - (Optional) Configuration block for units in which the validity times are represented in. [Detailed below](#token_validity_units).
-* `write_attributes` - (Optional) List of user pool attributes the application client can write to.
+* `prevent_user_existence_errors` - (Optional) Setting determines the errors and responses returned by Cognito APIs when a user does not exist in the user pool during authentication, account confirmation, and password recovery.
+* `read_attributes` - (Optional) List of user pool attributes that the application client can read from.
+* `refresh_token_validity` - (Optional) Time limit, between 60 minutes and 10 years, after which the refresh token is no longer valid and cannot be used. By default, the unit is days. The unit can be overridden by a value in `token_validity_units.refresh_token`.
+* `supported_identity_providers` - (Optional) List of provider names for the identity providers that are supported on this client. It uses the `provider_name` attribute of the `aws_cognito_identity_provider` resource(s), or the equivalent string(s).
+* `token_validity_units` - (Optional) Configuration block for representing the validity times in units. See details below. [Detailed below](#token_validity_units).
+* `write_attributes` - (Optional) List of user pool attributes that the application client can write to.
 
 ### analytics_configuration
 
-Either `application_arn` or `application_id` is required.
+Either `application_arn` or `application_id` is required for this configuration block.
 
-* `application_arn` - (Optional) Application ARN for an Amazon Pinpoint application. Conflicts with `external_id` and `role_arn`.
-* `application_id` - (Optional) Application ID for an Amazon Pinpoint application.
-* `external_id` - (Optional) ID for the Analytics Configuration. Conflicts with `application_arn`.
-* `role_arn` - (Optional) ARN of an IAM role that authorizes Amazon Cognito to publish events to Amazon Pinpoint analytics. Conflicts with `application_arn`.
-* `user_data_shared` (Optional) If set to `true`, Amazon Cognito will include user data in the events it publishes to Amazon Pinpoint analytics.
+* `application_arn` - (Optional) Application ARN for an Amazon Pinpoint application. It conflicts with `external_id` and `role_arn`.
+* `application_id` - (Optional) Unique identifier for an Amazon Pinpoint application.
+* `external_id` - (Optional) ID for the Analytics Configuration and conflicts with `application_arn`.
+* `role_arn` - (Optional) ARN of an IAM role that authorizes Amazon Cognito to publish events to Amazon Pinpoint analytics. It conflicts with `application_arn`.
+* `user_data_shared` - (Optional) If `user_data_shared` is set to `true`, Amazon Cognito will include user data in the events it publishes to Amazon Pinpoint analytics.
 
 ### token_validity_units
 
-Valid values for the following arguments are: `seconds`, `minutes`, `hours` or `days`.
+Valid values for the following arguments are: `seconds`, `minutes`, `hours`, or `days`.
 
-* `access_token` - (Optional) Time unit in for the value in `access_token_validity`, defaults to `hours`.
-* `id_token` - (Optional) Time unit in for the value in `id_token_validity`, defaults to `hours`.
-* `refresh_token` - (Optional) Time unit in for the value in `refresh_token_validity`, defaults to `days`.
+* `access_token` - (Optional) Time unit for the value in `access_token_validity` and defaults to `hours`.
+* `id_token` - (Optional) Time unit for the value in `id_token_validity`, and it defaults to `hours`.
+* `refresh_token` - (Optional) Time unit for the value in `refresh_token_validity` and defaults to `days`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `client_secret` - Client secret of the user pool client.
-* `id` - ID of the user pool client.
+* `id` - Unique identifier for the user pool client.
 * `name` - Name of the user pool client.
 
 ## Import
 
-Cognito User Pool Clients can be imported using the `id` of the Cognito User Pool, and the `id` of the Cognito User Pool Client, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Cognito User Pool Clients using the `id` of the Cognito User Pool and the `id` of the Cognito User Pool Client. For example:
 
+```terraform
+import {
+  to = aws_cognito_managed_user_pool_client.client
+  id = "us-west-2_abc123/3ho4ek12345678909nh3fmhpko"
+}
 ```
-$ terraform import aws_cognito_managed_user_pool_client.client us-west-2_abc123/3ho4ek12345678909nh3fmhpko
+
+Using `terraform import`, import Cognito User Pool Clients using the `id` of the Cognito User Pool and the `id` of the Cognito User Pool Client. For example:
+
+```console
+% terraform import aws_cognito_managed_user_pool_client.client us-west-2_abc123/3ho4ek12345678909nh3fmhpko
 ```
diff --git a/website/docs/r/cognito_resource_server.html.markdown b/website/docs/r/cognito_resource_server.html.markdown
index 25521d3b885..130af379b5e 100644
--- a/website/docs/r/cognito_resource_server.html.markdown
+++ b/website/docs/r/cognito_resource_server.html.markdown
@@ -50,7 +50,7 @@ resource "aws_cognito_resource_server" "resource" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `identifier` - (Required) An identifier for the resource server.
 * `name` - (Required) A name for the resource server.
@@ -61,16 +61,25 @@ The following arguments are supported:
 * `scope_name` - (Required) The scope name.
 * `scope_description` - (Required) The scope description.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `scope_identifiers` - A list of all scopes configured for this resource server in the format identifier/scope_name.
 
 ## Import
 
-`aws_cognito_resource_server` can be imported using their User Pool ID and Identifier, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_cognito_resource_server` using their User Pool ID and Identifier. For example:
 
+```terraform
+import {
+  to = aws_cognito_resource_server.example
+  id = "us-west-2_abc123|https://example.com"
+}
 ```
-$ terraform import aws_cognito_resource_server.example "us-west-2_abc123|https://example.com"
+
+Using `terraform import`, import `aws_cognito_resource_server` using their User Pool ID and Identifier. For example:
+
+```console
+% terraform import aws_cognito_resource_server.example "us-west-2_abc123|https://example.com"
 ```
diff --git a/website/docs/r/cognito_risk_configuration.html.markdown b/website/docs/r/cognito_risk_configuration.html.markdown
index 95bac26a4e5..817c314b4cf 100644
--- a/website/docs/r/cognito_risk_configuration.html.markdown
+++ b/website/docs/r/cognito_risk_configuration.html.markdown
@@ -24,7 +24,7 @@ resource "aws_cognito_risk_configuration" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `user_pool_id` - (Required) The user pool ID.
 * `client_id` - (Optional) The app client ID. When the client ID is not provided, the same risk configuration is applied to all the clients in the User Pool.
@@ -81,20 +81,44 @@ The following arguments are supported:
   The IP range is in CIDR notation.
   Can contain a maximum of 200 items.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
-* `id` - The user pool ID. or The user pool ID and Client Id separated by a `:` if the configuration is client specific.
+* `id` - The user pool ID or the user pool ID and Client Id separated by a `:` if the configuration is client specific.
 
 ## Import
 
-Cognito Risk Configurations can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Cognito Risk Configurations using the user pool ID or the user pool ID and Client Id separated by a `:`. For example:
 
+Import using the user pool ID:
+
+```terraform
+import {
+  to = aws_cognito_risk_configuration.main
+  id = "example"
+}
 ```
-$ terraform import aws_cognito_risk_configuration.main example
+
+Import using the user pool ID and Client ID separated by a `:`:
+
+```terraform
+import {
+  to = aws_cognito_risk_configuration.main
+  id = "example:example"
+}
 ```
 
+**Using `terraform import` to import** Cognito Risk Configurations using the user pool ID or the user pool ID and Client Id separated by a `:`. For example:
+
+Import using the user pool ID:
+
+```console
+% terraform import aws_cognito_risk_configuration.main example
 ```
-$ terraform import aws_cognito_risk_configuration.main example:example
+
+Import using the user pool ID and Client ID separated by a `:`:
+
+```console
+% terraform import aws_cognito_risk_configuration.main example:example
 ```
diff --git a/website/docs/r/cognito_user.html.markdown b/website/docs/r/cognito_user.html.markdown
index c4063b41235..c1a608cb8ff 100644
--- a/website/docs/r/cognito_user.html.markdown
+++ b/website/docs/r/cognito_user.html.markdown
@@ -83,9 +83,9 @@ The following arguments are optional:
 
 ~> **NOTE:** Clearing `password` or `temporary_password` does not reset user's password in Cognito.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `status` - current user status.
 * `sub` - unique user id that is never reassignable to another user.
@@ -93,8 +93,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Cognito User can be imported using the `user_pool_id`/`name` attributes concatenated, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Cognito User using the `user_pool_id`/`name` attributes concatenated. For example:
 
+```terraform
+import {
+  to = aws_cognito_user.user
+  id = "us-east-1_vG78M4goG/user"
+}
 ```
-$ terraform import aws_cognito_user.user us-east-1_vG78M4goG/user
+
+Using `terraform import`, import Cognito User using the `user_pool_id`/`name` attributes concatenated. For example:
+
+```console
+% terraform import aws_cognito_user.user us-east-1_vG78M4goG/user
 ```
diff --git a/website/docs/r/cognito_user_group.html.markdown b/website/docs/r/cognito_user_group.html.markdown
index 72692560375..dab6adc4651 100644
--- a/website/docs/r/cognito_user_group.html.markdown
+++ b/website/docs/r/cognito_user_group.html.markdown
@@ -58,7 +58,7 @@ resource "aws_cognito_user_group" "main" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The name of the user group.
 * `user_pool_id` - (Required) The user pool ID.
@@ -66,14 +66,23 @@ The following arguments are supported:
 * `precedence` - (Optional) The precedence of the user group.
 * `role_arn` - (Optional) The ARN of the IAM role to be associated with the user group.
 
-## Attributes Reference
+## Attribute Reference
 
-No additional attributes are exported.
+This resource exports no additional attributes.
 
 ## Import
 
-Cognito User Groups can be imported using the `user_pool_id`/`name` attributes concatenated, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Cognito User Groups using the `user_pool_id`/`name` attributes concatenated. For example:
 
+```terraform
+import {
+  to = aws_cognito_user_group.group
+  id = "us-east-1_vG78M4goG/user-group"
+}
 ```
-$ terraform import aws_cognito_user_group.group us-east-1_vG78M4goG/user-group
+
+Using `terraform import`, import Cognito User Groups using the `user_pool_id`/`name` attributes concatenated. For example:
+
+```console
+% terraform import aws_cognito_user_group.group us-east-1_vG78M4goG/user-group
 ```
diff --git a/website/docs/r/cognito_user_in_group.html.markdown b/website/docs/r/cognito_user_in_group.html.markdown
index e4bbe6b6643..ad23116c1d2 100644
--- a/website/docs/r/cognito_user_in_group.html.markdown
+++ b/website/docs/r/cognito_user_in_group.html.markdown
@@ -50,6 +50,6 @@ The following arguments are required:
 * `group_name` - (Required) The name of the group to which the user is to be added.
 * `username` - (Required) The username of the user to be added to the group.
 
-## Attributes Reference
+## Attribute Reference
 
-No additional attributes are exported.
+This resource exports no additional attributes.
diff --git a/website/docs/r/cognito_user_pool.html.markdown b/website/docs/r/cognito_user_pool.html.markdown
new file mode 100644
index 00000000000..09e49aeb038
--- /dev/null
+++ b/website/docs/r/cognito_user_pool.html.markdown
@@ -0,0 +1,267 @@
+---
+subcategory: "Cognito IDP (Identity Provider)"
+layout: "aws"
+page_title: "AWS: aws_cognito_user_pool"
+description: |-
+  Provides a Cognito User Pool resource.
+---
+
+# Resource: aws_cognito_user_pool
+
+Provides a Cognito User Pool resource.
+
+## Example Usage
+
+### Basic configuration
+
+```terraform
+resource "aws_cognito_user_pool" "pool" {
+  name = "mypool"
+}
+```
+
+### Enabling SMS and Software Token Multi-Factor Authentication
+
+```terraform
+resource "aws_cognito_user_pool" "example" {
+  # ... other configuration ...
+
+  mfa_configuration          = "ON"
+  sms_authentication_message = "Your code is {####}"
+
+  sms_configuration {
+    external_id    = "example"
+    sns_caller_arn = aws_iam_role.example.arn
+    sns_region     = "us-east-1"
+  }
+
+  software_token_mfa_configuration {
+    enabled = true
+  }
+}
+```
+
+### Using Account Recovery Setting
+
+```terraform
+resource "aws_cognito_user_pool" "test" {
+  name = "mypool"
+
+  account_recovery_setting {
+    recovery_mechanism {
+      name     = "verified_email"
+      priority = 1
+    }
+
+    recovery_mechanism {
+      name     = "verified_phone_number"
+      priority = 2
+    }
+  }
+}
+```
+
+## Argument Reference
+
+The following argument is required:
+
+* `name` - (Required) Name of the user pool.
+
+The following arguments are optional:
+
+* `account_recovery_setting` - (Optional) Configuration block to define which verified available method a user can use to recover their forgotten password. [Detailed below](#account_recovery_setting).
+* `admin_create_user_config` - (Optional) Configuration block for creating a new user profile. [Detailed below](#admin_create_user_config).
+* `alias_attributes` - (Optional) Attributes supported as an alias for this user pool. Valid values: `phone_number`, `email`, or `preferred_username`. Conflicts with `username_attributes`.
+* `auto_verified_attributes` - (Optional) Attributes to be auto-verified. Valid values: `email`, `phone_number`.
+* `deletion_protection` - (Optional) When active, DeletionProtection prevents accidental deletion of your user pool. Before you can delete a user pool that you have protected against deletion, you must deactivate this feature. Valid values are `ACTIVE` and `INACTIVE`, Default value is `INACTIVE`.
+* `device_configuration` - (Optional) Configuration block for the user pool's device tracking. [Detailed below](#device_configuration).
+* `email_configuration` - (Optional) Configuration block for configuring email. [Detailed below](#email_configuration).
+* `email_verification_message` - (Optional) String representing the email verification message. Conflicts with `verification_message_template` configuration block `email_message` argument.
+* `email_verification_subject` - (Optional) String representing the email verification subject. Conflicts with `verification_message_template` configuration block `email_subject` argument.
+* `lambda_config` - (Optional) Configuration block for the AWS Lambda triggers associated with the user pool. [Detailed below](#lambda_config).
+* `mfa_configuration` - (Optional) Multi-Factor Authentication (MFA) configuration for the User Pool. Defaults of `OFF`. Valid values are `OFF` (MFA Tokens are not required), `ON` (MFA is required for all users to sign in; requires at least one of `sms_configuration` or `software_token_mfa_configuration` to be configured), or `OPTIONAL` (MFA Will be required only for individual users who have MFA Enabled; requires at least one of `sms_configuration` or `software_token_mfa_configuration` to be configured).
+* `password_policy` - (Optional) Configuration block for information about the user pool password policy. [Detailed below](#password_policy).
+* `schema` - (Optional) Configuration block for the schema attributes of a user pool. [Detailed below](#schema). Schema attributes from the [standard attribute set](https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-settings-attributes.html#cognito-user-pools-standard-attributes) only need to be specified if they are different from the default configuration. Attributes can be added, but not modified or removed. Maximum of 50 attributes.
+* `sms_authentication_message` - (Optional) String representing the SMS authentication message. The Message must contain the `{####}` placeholder, which will be replaced with the code.
+* `sms_configuration` - (Optional) Configuration block for Short Message Service (SMS) settings. [Detailed below](#sms_configuration). These settings apply to SMS user verification and SMS Multi-Factor Authentication (MFA). Due to Cognito API restrictions, the SMS configuration cannot be removed without recreating the Cognito User Pool. For user data safety, this resource will ignore the removal of this configuration by disabling drift detection. To force resource recreation after this configuration has been applied, see the [`taint` command](https://www.terraform.io/docs/commands/taint.html).
+* `sms_verification_message` - (Optional) String representing the SMS verification message. Conflicts with `verification_message_template` configuration block `sms_message` argument.
+* `software_token_mfa_configuration` - (Optional) Configuration block for software token Mult-Factor Authentication (MFA) settings. [Detailed below](#software_token_mfa_configuration).
+* `tags` - (Optional) Map of tags to assign to the User Pool. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `user_attribute_update_settings` - (Optional) Configuration block for user attribute update settings. [Detailed below](#user_attribute_update_settings).
+* `user_pool_add_ons` - (Optional) Configuration block for user pool add-ons to enable user pool advanced security mode features. [Detailed below](#user_pool_add_ons).
+* `username_attributes` - (Optional) Whether email addresses or phone numbers can be specified as usernames when a user signs up. Conflicts with `alias_attributes`.
+* `username_configuration` - (Optional) Configuration block for username configuration. [Detailed below](#username_configuration).
+* `verification_message_template` - (Optional) Configuration block for verification message templates. [Detailed below](#verification_message_template).
+
+### account_recovery_setting
+
+* `recovery_mechanism` - (Optional) List of Account Recovery Options of the following structure:
+    * `name` - (Required) Recovery method for a user. Can be of the following: `verified_email`, `verified_phone_number`, and `admin_only`.
+    * `priority` - (Required) Positive integer specifying priority of a method with 1 being the highest priority.
+
+### admin_create_user_config
+
+* `allow_admin_create_user_only` - (Optional) Set to True if only the administrator is allowed to create user profiles. Set to False if users can sign themselves up via an app.
+* `invite_message_template` - (Optional) Invite message template structure. [Detailed below](#invite_message_template).
+
+#### invite_message_template
+
+* `email_message` - (Optional) Message template for email messages. Must contain `{username}` and `{####}` placeholders, for username and temporary password, respectively.
+* `email_subject` - (Optional) Subject line for email messages.
+* `sms_message` - (Optional) Message template for SMS messages. Must contain `{username}` and `{####}` placeholders, for username and temporary password, respectively.
+
+### device_configuration
+
+* `challenge_required_on_new_device` - (Optional) Whether a challenge is required on a new device. Only applicable to a new device.
+* `device_only_remembered_on_user_prompt` - (Optional) Whether a device is only remembered on user prompt. `false` equates to "Always" remember, `true` is "User Opt In," and not using a `device_configuration` block is "No."
+
+### email_configuration
+
+* `configuration_set` - (Optional) Email configuration set name from SES.
+* `email_sending_account` - (Optional) Email delivery method to use. `COGNITO_DEFAULT` for the default email functionality built into Cognito or `DEVELOPER` to use your Amazon SES configuration. Required to be `DEVELOPER` if `from_email_address` is set.
+* `from_email_address` - (Optional) Sender’s email address or sender’s display name with their email address (e.g., `john@example.com`, `John Smith <john@example.com>` or `\"John Smith Ph.D.\" <john@example.com>`). Escaped double quotes are required around display names that contain certain characters as specified in [RFC 5322](https://tools.ietf.org/html/rfc5322).
+* `reply_to_email_address` - (Optional) REPLY-TO email address.
+* `source_arn` - (Optional) ARN of the SES verified email identity to use. Required if `email_sending_account` is set to `DEVELOPER`.
+
+### lambda_config
+
+* `create_auth_challenge` - (Optional) ARN of the lambda creating an authentication challenge.
+* `custom_message` - (Optional) Custom Message AWS Lambda trigger.
+* `define_auth_challenge` - (Optional) Defines the authentication challenge.
+* `post_authentication` - (Optional) Post-authentication AWS Lambda trigger.
+* `post_confirmation` - (Optional) Post-confirmation AWS Lambda trigger.
+* `pre_authentication` - (Optional) Pre-authentication AWS Lambda trigger.
+* `pre_sign_up` - (Optional) Pre-registration AWS Lambda trigger.
+* `pre_token_generation` - (Optional) Allow to customize identity token claims before token generation.
+* `user_migration` - (Optional) User migration Lambda config type.
+* `verify_auth_challenge_response` - (Optional) Verifies the authentication challenge response.
+* `kms_key_id` - (Optional) The Amazon Resource Name of Key Management Service Customer master keys. Amazon Cognito uses the key to encrypt codes and temporary passwords sent to CustomEmailSender and CustomSMSSender.
+* `custom_email_sender` - (Optional) A custom email sender AWS Lambda trigger. See [custom_email_sender](#custom_email_sender) Below.
+* `custom_sms_sender` - (Optional) A custom SMS sender AWS Lambda trigger. See [custom_sms_sender](#custom_sms_sender) Below.
+
+#### custom_email_sender
+
+* `lambda_arn` - (Required) The Lambda Amazon Resource Name of the Lambda function that Amazon Cognito triggers to send email notifications to users.
+* `lambda_version` - (Required) The Lambda version represents the signature of the "request" attribute in the "event" information Amazon Cognito passes to your custom email Lambda function. The only supported value is `V1_0`.
+
+#### custom_sms_sender
+
+* `lambda_arn` - (Required) The Lambda Amazon Resource Name of the Lambda function that Amazon Cognito triggers to send SMS notifications to users.
+* `lambda_version` - (Required) The Lambda version represents the signature of the "request" attribute in the "event" information Amazon Cognito passes to your custom SMS Lambda function. The only supported value is `V1_0`.
+
+### password_policy
+
+* `minimum_length` - (Optional) Minimum length of the password policy that you have set.
+* `require_lowercase` - (Optional) Whether you have required users to use at least one lowercase letter in their password.
+* `require_numbers` - (Optional) Whether you have required users to use at least one number in their password.
+* `require_symbols` - (Optional) Whether you have required users to use at least one symbol in their password.
+* `require_uppercase` - (Optional) Whether you have required users to use at least one uppercase letter in their password.
+* `temporary_password_validity_days` - (Optional) In the password policy you have set, refers to the number of days a temporary password is valid. If the user does not sign-in during this time, their password will need to be reset by an administrator.
+
+### schema
+
+~> **NOTE:** When defining an `attribute_data_type` of `String` or `Number`, the respective attribute constraints configuration block (e.g `string_attribute_constraints` or `number_attribute_constraints`) is **required** to prevent recreation of the Terraform resource. This requirement is true for both standard (e.g., name, email) and custom schema attributes.
+
+* `attribute_data_type` - (Required) Attribute data type. Must be one of `Boolean`, `Number`, `String`, `DateTime`.
+* `developer_only_attribute` - (Optional) Whether the attribute type is developer only.
+* `mutable` - (Optional) Whether the attribute can be changed once it has been created.
+* `name` - (Required) Name of the attribute.
+* `number_attribute_constraints` - (Required when `attribute_data_type` is `Number`) Configuration block for the constraints for an attribute of the number type. [Detailed below](#number_attribute_constraints).
+* `required` - (Optional) Whether a user pool attribute is required. If the attribute is required and the user does not provide a value, registration or sign-in will fail.
+* `string_attribute_constraints` - (Required when `attribute_data_type` is `String`) Constraints for an attribute of the string type. [Detailed below](#string_attribute_constraints).
+
+#### schema: Defaults for Standard Attributes
+
+The [standard attributes](https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-settings-attributes.html#cognito-user-pools-standard-attributes) have the following defaults. Note that attributes which match the default values are not stored in Terraform state when importing.
+
+```terraform
+resource "aws_cognito_user_pool" "example" {
+  # ... other configuration ...
+
+  schema {
+    name                     = "<name>"
+    attribute_data_type      = "<appropriate type>"
+    developer_only_attribute = false
+    mutable                  = true  # false for "sub"
+    required                 = false # true for "sub"
+    string_attribute_constraints {   # if it is a string
+      min_length = 0                 # 10 for "birthdate"
+      max_length = 2048              # 10 for "birthdate"
+    }
+  }
+}
+```
+
+#### number_attribute_constraints
+
+* `max_value` - (Optional) Maximum value of an attribute that is of the number data type.
+* `min_value` - (Optional) Minimum value of an attribute that is of the number data type.
+
+#### string_attribute_constraints
+
+* `max_length` - (Optional) Maximum length of an attribute value of the string type.
+* `min_length` - (Optional) Minimum length of an attribute value of the string type.
+
+### sms_configuration
+
+* `external_id` - (Required) External ID used in IAM role trust relationships. For more information about using external IDs, see [How to Use an External ID When Granting Access to Your AWS Resources to a Third Party](http://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user_externalid.html).
+* `sns_caller_arn` - (Required) ARN of the Amazon SNS caller. This is usually the IAM role that you've given Cognito permission to assume.
+* `sns_region` - (Optional) The AWS Region to use with Amazon SNS integration. You can choose the same Region as your user pool, or a supported Legacy Amazon SNS alternate Region. Amazon Cognito resources in the Asia Pacific (Seoul) AWS Region must use your Amazon SNS configuration in the Asia Pacific (Tokyo) Region. For more information, see [SMS message settings for Amazon Cognito user pools](https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-sms-settings.html).
+
+### software_token_mfa_configuration
+
+The following arguments are required in the `software_token_mfa_configuration` configuration block:
+
+* `enabled` - (Required) Boolean whether to enable software token Multi-Factor (MFA) tokens, such as Time-based One-Time Password (TOTP). To disable software token MFA When `sms_configuration` is not present, the `mfa_configuration` argument must be set to `OFF` and the `software_token_mfa_configuration` configuration block must be fully removed.
+
+### user_attribute_update_settings
+
+* `attributes_require_verification_before_update` - (Required) A list of attributes requiring verification before update. If set, the provided value(s) must also be set in `auto_verified_attributes`. Valid values: `email`, `phone_number`.
+
+### user_pool_add_ons
+
+* `advanced_security_mode` - (Required) Mode for advanced security, must be one of `OFF`, `AUDIT` or `ENFORCED`.
+
+### username_configuration
+
+* `case_sensitive` - (Required) Whether username case sensitivity will be applied for all users in the user pool through Cognito APIs.
+
+### verification_message_template
+
+* `default_email_option` - (Optional) Default email option. Must be either `CONFIRM_WITH_CODE` or `CONFIRM_WITH_LINK`. Defaults to `CONFIRM_WITH_CODE`.
+* `email_message` - (Optional) Email message template. Must contain the `{####}` placeholder. Conflicts with `email_verification_message` argument.
+* `email_message_by_link` - (Optional) Email message template for sending a confirmation link to the user, it must contain the `{##Click Here##}` placeholder.
+* `email_subject` - (Optional) Subject line for the email message template. Conflicts with `email_verification_subject` argument.
+* `email_subject_by_link` - (Optional) Subject line for the email message template for sending a confirmation link to the user.
+* `sms_message` - (Optional) SMS message template. Must contain the `{####}` placeholder. Conflicts with `sms_verification_message` argument.
+  
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the user pool.
+* `creation_date` - Date the user pool was created.
+* `custom_domain` - A custom domain name that you provide to Amazon Cognito. This parameter applies only if you use a custom domain to host the sign-up and sign-in pages for your application. For example: `auth.example.com`.
+* `domain` - Holds the domain prefix if the user pool has a domain associated with it.
+* `endpoint` - Endpoint name of the user pool. Example format: `cognito-idp.REGION.amazonaws.com/xxxx_yyyyy`
+* `estimated_number_of_users` - A number estimating the size of the user pool.
+* `id` - ID of the user pool.
+* `last_modified_date` - Date the user pool was last modified.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Cognito User Pools using the `id`. For example:
+
+```terraform
+import {
+  to = aws_cognito_user_pool.pool
+  id = "us-west-2_abc123"
+}
+```
+
+Using `terraform import`, import Cognito User Pools using the `id`. For example:
+
+```console
+% terraform import aws_cognito_user_pool.pool us-west-2_abc123
+```
diff --git a/website/docs/r/cognito_user_pool.markdown b/website/docs/r/cognito_user_pool.markdown
deleted file mode 100644
index f9c0c343384..00000000000
--- a/website/docs/r/cognito_user_pool.markdown
+++ /dev/null
@@ -1,258 +0,0 @@
----
-subcategory: "Cognito IDP (Identity Provider)"
-layout: "aws"
-page_title: "AWS: aws_cognito_user_pool"
-description: |-
-  Provides a Cognito User Pool resource.
----
-
-# Resource: aws_cognito_user_pool
-
-Provides a Cognito User Pool resource.
-
-## Example Usage
-
-### Basic configuration
-
-```terraform
-resource "aws_cognito_user_pool" "pool" {
-  name = "mypool"
-}
-```
-
-### Enabling SMS and Software Token Multi-Factor Authentication
-
-```terraform
-resource "aws_cognito_user_pool" "example" {
-  # ... other configuration ...
-
-  mfa_configuration          = "ON"
-  sms_authentication_message = "Your code is {####}"
-
-  sms_configuration {
-    external_id    = "example"
-    sns_caller_arn = aws_iam_role.example.arn
-    sns_region     = "us-east-1"
-  }
-
-  software_token_mfa_configuration {
-    enabled = true
-  }
-}
-```
-
-### Using Account Recovery Setting
-
-```terraform
-resource "aws_cognito_user_pool" "test" {
-  name = "mypool"
-
-  account_recovery_setting {
-    recovery_mechanism {
-      name     = "verified_email"
-      priority = 1
-    }
-
-    recovery_mechanism {
-      name     = "verified_phone_number"
-      priority = 2
-    }
-  }
-}
-```
-
-## Argument Reference
-
-The following argument is required:
-
-* `name` - (Required) Name of the user pool.
-
-The following arguments are optional:
-
-* `account_recovery_setting` - (Optional) Configuration block to define which verified available method a user can use to recover their forgotten password. [Detailed below](#account_recovery_setting).
-* `admin_create_user_config` - (Optional) Configuration block for creating a new user profile. [Detailed below](#admin_create_user_config).
-* `alias_attributes` - (Optional) Attributes supported as an alias for this user pool. Valid values: `phone_number`, `email`, or `preferred_username`. Conflicts with `username_attributes`.
-* `auto_verified_attributes` - (Optional) Attributes to be auto-verified. Valid values: `email`, `phone_number`.
-* `deletion_protection` - (Optional) When active, DeletionProtection prevents accidental deletion of your user pool. Before you can delete a user pool that you have protected against deletion, you must deactivate this feature. Valid values are `ACTIVE` and `INACTIVE`, Default value is `INACTIVE`.
-* `device_configuration` - (Optional) Configuration block for the user pool's device tracking. [Detailed below](#device_configuration).
-* `email_configuration` - (Optional) Configuration block for configuring email. [Detailed below](#email_configuration).
-* `email_verification_message` - (Optional) String representing the email verification message. Conflicts with `verification_message_template` configuration block `email_message` argument.
-* `email_verification_subject` - (Optional) String representing the email verification subject. Conflicts with `verification_message_template` configuration block `email_subject` argument.
-* `lambda_config` - (Optional) Configuration block for the AWS Lambda triggers associated with the user pool. [Detailed below](#lambda_config).
-* `mfa_configuration` - (Optional) Multi-Factor Authentication (MFA) configuration for the User Pool. Defaults of `OFF`. Valid values are `OFF` (MFA Tokens are not required), `ON` (MFA is required for all users to sign in; requires at least one of `sms_configuration` or `software_token_mfa_configuration` to be configured), or `OPTIONAL` (MFA Will be required only for individual users who have MFA Enabled; requires at least one of `sms_configuration` or `software_token_mfa_configuration` to be configured).
-* `password_policy` - (Optional) Configuration blocked for information about the user pool password policy. [Detailed below](#password_policy).
-* `schema` - (Optional) Configuration block for the schema attributes of a user pool. [Detailed below](#schema). Schema attributes from the [standard attribute set](https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-settings-attributes.html#cognito-user-pools-standard-attributes) only need to be specified if they are different from the default configuration. Attributes can be added, but not modified or removed. Maximum of 50 attributes.
-* `sms_authentication_message` - (Optional) String representing the SMS authentication message. The Message must contain the `{####}` placeholder, which will be replaced with the code.
-* `sms_configuration` - (Optional) Configuration block for Short Message Service (SMS) settings. [Detailed below](#sms_configuration). These settings apply to SMS user verification and SMS Multi-Factor Authentication (MFA). Due to Cognito API restrictions, the SMS configuration cannot be removed without recreating the Cognito User Pool. For user data safety, this resource will ignore the removal of this configuration by disabling drift detection. To force resource recreation after this configuration has been applied, see the [`taint` command](https://www.terraform.io/docs/commands/taint.html).
-* `sms_verification_message` - (Optional) String representing the SMS verification message. Conflicts with `verification_message_template` configuration block `sms_message` argument.
-* `software_token_mfa_configuration` - (Optional) Configuration block for software token Mult-Factor Authentication (MFA) settings. [Detailed below](#software_token_mfa_configuration).
-* `tags` - (Optional) Map of tags to assign to the User Pool. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
-* `user_attribute_update_settings` - (Optional) Configuration block for user attribute update settings. [Detailed below](#user_attribute_update_settings).
-* `user_pool_add_ons` - (Optional) Configuration block for user pool add-ons to enable user pool advanced security mode features. [Detailed below](#user_pool_add_ons).
-* `username_attributes` - (Optional) Whether email addresses or phone numbers can be specified as usernames when a user signs up. Conflicts with `alias_attributes`.
-* `username_configuration` - (Optional) Configuration block for username configuration. [Detailed below](#username_configuration).
-* `verification_message_template` - (Optional) Configuration block for verification message templates. [Detailed below](#verification_message_template).
-
-### account_recovery_setting
-
-* `recovery_mechanism` - (Optional) List of Account Recovery Options of the following structure:
-    * `name` - (Required) Recovery method for a user. Can be of the following: `verified_email`, `verified_phone_number`, and `admin_only`.
-    * `priority` - (Required) Positive integer specifying priority of a method with 1 being the highest priority.
-
-### admin_create_user_config
-
-* `allow_admin_create_user_only` - (Optional) Set to True if only the administrator is allowed to create user profiles. Set to False if users can sign themselves up via an app.
-* `invite_message_template` - (Optional) Invite message template structure. [Detailed below](#invite_message_template).
-
-#### invite_message_template
-
-* `email_message` - (Optional) Message template for email messages. Must contain `{username}` and `{####}` placeholders, for username and temporary password, respectively.
-* `email_subject` - (Optional) Subject line for email messages.
-* `sms_message` - (Optional) Message template for SMS messages. Must contain `{username}` and `{####}` placeholders, for username and temporary password, respectively.
-
-### device_configuration
-
-* `challenge_required_on_new_device` - (Optional) Whether a challenge is required on a new device. Only applicable to a new device.
-* `device_only_remembered_on_user_prompt` - (Optional) Whether a device is only remembered on user prompt. `false` equates to "Always" remember, `true` is "User Opt In," and not using a `device_configuration` block is "No."
-
-### email_configuration
-
-* `configuration_set` - (Optional) Email configuration set name from SES.
-* `email_sending_account` - (Optional) Email delivery method to use. `COGNITO_DEFAULT` for the default email functionality built into Cognito or `DEVELOPER` to use your Amazon SES configuration. Required to be `DEVELOPER` if `from_email_address` is set.
-* `from_email_address` - (Optional) Sender’s email address or sender’s display name with their email address (e.g., `john@example.com`, `John Smith <john@example.com>` or `\"John Smith Ph.D.\" <john@example.com>`). Escaped double quotes are required around display names that contain certain characters as specified in [RFC 5322](https://tools.ietf.org/html/rfc5322).
-* `reply_to_email_address` - (Optional) REPLY-TO email address.
-* `source_arn` - (Optional) ARN of the SES verified email identity to use. Required if `email_sending_account` is set to `DEVELOPER`.
-
-### lambda_config
-
-* `create_auth_challenge` - (Optional) ARN of the lambda creating an authentication challenge.
-* `custom_message` - (Optional) Custom Message AWS Lambda trigger.
-* `define_auth_challenge` - (Optional) Defines the authentication challenge.
-* `post_authentication` - (Optional) Post-authentication AWS Lambda trigger.
-* `post_confirmation` - (Optional) Post-confirmation AWS Lambda trigger.
-* `pre_authentication` - (Optional) Pre-authentication AWS Lambda trigger.
-* `pre_sign_up` - (Optional) Pre-registration AWS Lambda trigger.
-* `pre_token_generation` - (Optional) Allow to customize identity token claims before token generation.
-* `user_migration` - (Optional) User migration Lambda config type.
-* `verify_auth_challenge_response` - (Optional) Verifies the authentication challenge response.
-* `kms_key_id` - (Optional) The Amazon Resource Name of Key Management Service Customer master keys. Amazon Cognito uses the key to encrypt codes and temporary passwords sent to CustomEmailSender and CustomSMSSender.
-* `custom_email_sender` - (Optional) A custom email sender AWS Lambda trigger. See [custom_email_sender](#custom_email_sender) Below.
-* `custom_sms_sender` - (Optional) A custom SMS sender AWS Lambda trigger. See [custom_sms_sender](#custom_sms_sender) Below.
-
-#### custom_email_sender
-
-* `lambda_arn` - (Required) The Lambda Amazon Resource Name of the Lambda function that Amazon Cognito triggers to send email notifications to users.
-* `lambda_version` - (Required) The Lambda version represents the signature of the "request" attribute in the "event" information Amazon Cognito passes to your custom email Lambda function. The only supported value is `V1_0`.
-
-#### custom_sms_sender
-
-* `lambda_arn` - (Required) The Lambda Amazon Resource Name of the Lambda function that Amazon Cognito triggers to send SMS notifications to users.
-* `lambda_version` - (Required) The Lambda version represents the signature of the "request" attribute in the "event" information Amazon Cognito passes to your custom SMS Lambda function. The only supported value is `V1_0`.
-
-### password_policy
-
-* `minimum_length` - (Optional) Minimum length of the password policy that you have set.
-* `require_lowercase` - (Optional) Whether you have required users to use at least one lowercase letter in their password.
-* `require_numbers` - (Optional) Whether you have required users to use at least one number in their password.
-* `require_symbols` - (Optional) Whether you have required users to use at least one symbol in their password.
-* `require_uppercase` - (Optional) Whether you have required users to use at least one uppercase letter in their password.
-* `temporary_password_validity_days` - (Optional) In the password policy you have set, refers to the number of days a temporary password is valid. If the user does not sign-in during this time, their password will need to be reset by an administrator.
-
-### schema
-
-~> **NOTE:** When defining an `attribute_data_type` of `String` or `Number`, the respective attribute constraints configuration block (e.g `string_attribute_constraints` or `number_attribute_constraints`) is **required** to prevent recreation of the Terraform resource. This requirement is true for both standard (e.g., name, email) and custom schema attributes.
-
-* `attribute_data_type` - (Required) Attribute data type. Must be one of `Boolean`, `Number`, `String`, `DateTime`.
-* `developer_only_attribute` - (Optional) Whether the attribute type is developer only.
-* `mutable` - (Optional) Whether the attribute can be changed once it has been created.
-* `name` - (Required) Name of the attribute.
-* `number_attribute_constraints` - (Required when `attribute_data_type` is `Number`) Configuration block for the constraints for an attribute of the number type. [Detailed below](#number_attribute_constraints).
-* `required` - (Optional) Whether a user pool attribute is required. If the attribute is required and the user does not provide a value, registration or sign-in will fail.
-* `string_attribute_constraints` - (Required when `attribute_data_type` is `String`) Constraints for an attribute of the string type. [Detailed below](#string_attribute_constraints).
-
-#### schema: Defaults for Standard Attributes
-
-The [standard attributes](https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-settings-attributes.html#cognito-user-pools-standard-attributes) have the following defaults. Note that attributes which match the default values are not stored in Terraform state when importing.
-
-```terraform
-resource "aws_cognito_user_pool" "example" {
-  # ... other configuration ...
-
-  schema {
-    name                     = "<name>"
-    attribute_data_type      = "<appropriate type>"
-    developer_only_attribute = false
-    mutable                  = true  # false for "sub"
-    required                 = false # true for "sub"
-    string_attribute_constraints {   # if it is a string
-      min_length = 0                 # 10 for "birthdate"
-      max_length = 2048              # 10 for "birthdate"
-    }
-  }
-}
-```
-
-#### number_attribute_constraints
-
-* `max_value` - (Optional) Maximum value of an attribute that is of the number data type.
-* `min_value` - (Optional) Minimum value of an attribute that is of the number data type.
-
-#### string_attribute_constraints
-
-* `max_length` - (Optional) Maximum length of an attribute value of the string type.
-* `min_length` - (Optional) Minimum length of an attribute value of the string type.
-
-### sms_configuration
-
-* `external_id` - (Required) External ID used in IAM role trust relationships. For more information about using external IDs, see [How to Use an External ID When Granting Access to Your AWS Resources to a Third Party](http://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user_externalid.html).
-* `sns_caller_arn` - (Required) ARN of the Amazon SNS caller. This is usually the IAM role that you've given Cognito permission to assume.
-* `sns_region` - (Optional) The AWS Region to use with Amazon SNS integration. You can choose the same Region as your user pool, or a supported Legacy Amazon SNS alternate Region. Amazon Cognito resources in the Asia Pacific (Seoul) AWS Region must use your Amazon SNS configuration in the Asia Pacific (Tokyo) Region. For more information, see [SMS message settings for Amazon Cognito user pools](https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-sms-settings.html).
-
-### software_token_mfa_configuration
-
-The following arguments are required in the `software_token_mfa_configuration` configuration block:
-
-* `enabled` - (Required) Boolean whether to enable software token Multi-Factor (MFA) tokens, such as Time-based One-Time Password (TOTP). To disable software token MFA When `sms_configuration` is not present, the `mfa_configuration` argument must be set to `OFF` and the `software_token_mfa_configuration` configuration block must be fully removed.
-
-### user_attribute_update_settings
-
-* `attributes_require_verification_before_update` - (Required) A list of attributes requiring verification before update. If set, the provided value(s) must also be set in `auto_verified_attributes`. Valid values: `email`, `phone_number`.
-
-### user_pool_add_ons
-
-* `advanced_security_mode` - (Required) Mode for advanced security, must be one of `OFF`, `AUDIT` or `ENFORCED`.
-
-### username_configuration
-
-* `case_sensitive` - (Required) Whether username case sensitivity will be applied for all users in the user pool through Cognito APIs.
-
-### verification_message_template
-
-* `default_email_option` - (Optional) Default email option. Must be either `CONFIRM_WITH_CODE` or `CONFIRM_WITH_LINK`. Defaults to `CONFIRM_WITH_CODE`.
-* `email_message` - (Optional) Email message template. Must contain the `{####}` placeholder. Conflicts with `email_verification_message` argument.
-* `email_message_by_link` - (Optional) Email message template for sending a confirmation link to the user, it must contain the `{##Click Here##}` placeholder.
-* `email_subject` - (Optional) Subject line for the email message template. Conflicts with `email_verification_subject` argument.
-* `email_subject_by_link` - (Optional) Subject line for the email message template for sending a confirmation link to the user.
-* `sms_message` - (Optional) SMS message template. Must contain the `{####}` placeholder. Conflicts with `sms_verification_message` argument.
-  
-## Attributes Reference
-
-In addition to all arguments above, the following attributes are exported:
-
-* `arn` - ARN of the user pool.
-* `creation_date` - Date the user pool was created.
-* `custom_domain` - A custom domain name that you provide to Amazon Cognito. This parameter applies only if you use a custom domain to host the sign-up and sign-in pages for your application. For example: `auth.example.com`.
-* `domain` - Holds the domain prefix if the user pool has a domain associated with it.
-* `endpoint` - Endpoint name of the user pool. Example format: `cognito-idp.REGION.amazonaws.com/xxxx_yyyyy`
-* `estimated_number_of_users` - A number estimating the size of the user pool.
-* `id` - ID of the user pool.
-* `last_modified_date` - Date the user pool was last modified.
-* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
-
-## Import
-
-Cognito User Pools can be imported using the `id`, e.g.,
-
-```
-$ terraform import aws_cognito_user_pool.pool us-west-2_abc123
-```
diff --git a/website/docs/r/cognito_user_pool_client.html.markdown b/website/docs/r/cognito_user_pool_client.html.markdown
index c34bef286bb..6646a9dbb02 100644
--- a/website/docs/r/cognito_user_pool_client.html.markdown
+++ b/website/docs/r/cognito_user_pool_client.html.markdown
@@ -181,17 +181,26 @@ Valid values for the following arguments are: `seconds`, `minutes`, `hours` or `
 * `id_token` - (Optional) Time unit in for the value in `id_token_validity`, defaults to `hours`.
 * `refresh_token` - (Optional) Time unit in for the value in `refresh_token_validity`, defaults to `days`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `client_secret` - Client secret of the user pool client.
 * `id` - ID of the user pool client.
 
 ## Import
 
-Cognito User Pool Clients can be imported using the `id` of the Cognito User Pool, and the `id` of the Cognito User Pool Client, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Cognito User Pool Clients using the `id` of the Cognito User Pool, and the `id` of the Cognito User Pool Client. For example:
 
+```terraform
+import {
+  to = aws_cognito_user_pool_client.client
+  id = "us-west-2_abc123/3ho4ek12345678909nh3fmhpko"
+}
 ```
-$ terraform import aws_cognito_user_pool_client.client us-west-2_abc123/3ho4ek12345678909nh3fmhpko
+
+Using `terraform import`, import Cognito User Pool Clients using the `id` of the Cognito User Pool, and the `id` of the Cognito User Pool Client. For example:
+
+```console
+% terraform import aws_cognito_user_pool_client.client us-west-2_abc123/3ho4ek12345678909nh3fmhpko
 ```
diff --git a/website/docs/r/cognito_user_pool_domain.html.markdown b/website/docs/r/cognito_user_pool_domain.html.markdown
index 9211cb3bef6..a9e71bc58c1 100644
--- a/website/docs/r/cognito_user_pool_domain.html.markdown
+++ b/website/docs/r/cognito_user_pool_domain.html.markdown
@@ -57,15 +57,15 @@ resource "aws_route53_record" "auth-cognito-A" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `domain` - (Required) For custom domains, this is the fully-qualified domain name, such as auth.example.com. For Amazon Cognito prefix domains, this is the prefix alone, such as auth.
 * `user_pool_id` - (Required) The user pool ID.
 * `certificate_arn` - (Optional) The ARN of an ISSUED ACM certificate in us-east-1 for a custom domain.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `aws_account_id` - The AWS account ID for the user pool owner.
 * `cloudfront_distribution` - The Amazon CloudFront endpoint (e.g. `dpp0gtxikpq3y.cloudfront.net`) that you use as the target of the alias that you set up with your Domain Name Service (DNS) provider.
@@ -76,8 +76,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Cognito User Pool Domains can be imported using the `domain`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Cognito User Pool Domains using the `domain`. For example:
 
+```terraform
+import {
+  to = aws_cognito_user_pool_domain.main
+  id = "auth.example.org"
+}
 ```
-$ terraform import aws_cognito_user_pool_domain.main auth.example.org
+
+Using `terraform import`, import Cognito User Pool Domains using the `domain`. For example:
+
+```console
+% terraform import aws_cognito_user_pool_domain.main auth.example.org
 ```
diff --git a/website/docs/r/cognito_user_pool_ui_customization.html.markdown b/website/docs/r/cognito_user_pool_ui_customization.html.markdown
index 223e517da76..ec9dcbea550 100644
--- a/website/docs/r/cognito_user_pool_ui_customization.html.markdown
+++ b/website/docs/r/cognito_user_pool_ui_customization.html.markdown
@@ -67,16 +67,16 @@ resource "aws_cognito_user_pool_ui_customization" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `client_id` (Optional) The client ID for the client app. Defaults to `ALL`. If `ALL` is specified, the `css` and/or `image_file` settings will be used for every client that has no UI customization set previously.
 * `css` (Optional) - The CSS values in the UI customization, provided as a String. At least one of `css` or `image_file` is required.
 * `image_file` (Optional) - The uploaded logo image for the UI customization, provided as a base64-encoded String. Drift detection is not possible for this argument. At least one of `css` or `image_file` is required.
 * `user_pool_id` (Required) - The user pool ID for the user pool.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `creation_date` - The creation date in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8) for the UI customization.
 * `css_version` - The CSS version number.
@@ -85,8 +85,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Cognito User Pool UI Customizations can be imported using the `user_pool_id` and `client_id` separated by `,`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Cognito User Pool UI Customizations using the `user_pool_id` and `client_id` separated by `,`. For example:
 
+```terraform
+import {
+  to = aws_cognito_user_pool_ui_customization.example
+  id = "us-west-2_ZCTarbt5C,12bu4fuk3mlgqa2rtrujgp6egq"
+}
 ```
-$ terraform import aws_cognito_user_pool_ui_customization.example us-west-2_ZCTarbt5C,12bu4fuk3mlgqa2rtrujgp6egq
+
+Using `terraform import`, import Cognito User Pool UI Customizations using the `user_pool_id` and `client_id` separated by `,`. For example:
+
+```console
+% terraform import aws_cognito_user_pool_ui_customization.example us-west-2_ZCTarbt5C,12bu4fuk3mlgqa2rtrujgp6egq
 ```
diff --git a/website/docs/r/comprehend_document_classifier.html.markdown b/website/docs/r/comprehend_document_classifier.html.markdown
index 2819952527b..2292f6d971c 100644
--- a/website/docs/r/comprehend_document_classifier.html.markdown
+++ b/website/docs/r/comprehend_document_classifier.html.markdown
@@ -116,9 +116,9 @@ The following arguments are optional:
 * `security_group_ids` - (Required) List of security group IDs.
 * `subnets` - (Required) List of VPC subnets.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the Document Classifier version.
 * `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block).
@@ -133,8 +133,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Comprehend Document Classifier can be imported using the ARN, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Comprehend Document Classifier using the ARN. For example:
 
+```terraform
+import {
+  to = aws_comprehend_document_classifier.example
+  id = "arn:aws:comprehend:us-west-2:123456789012:document_classifier/example"
+}
 ```
-$ terraform import aws_comprehend_document_classifier.example arn:aws:comprehend:us-west-2:123456789012:document_classifier/example
+
+Using `terraform import`, import Comprehend Document Classifier using the ARN. For example:
+
+```console
+% terraform import aws_comprehend_document_classifier.example arn:aws:comprehend:us-west-2:123456789012:document_classifier/example
 ```
diff --git a/website/docs/r/comprehend_entity_recognizer.html.markdown b/website/docs/r/comprehend_entity_recognizer.html.markdown
index 3723aba0ed0..f79268cc524 100644
--- a/website/docs/r/comprehend_entity_recognizer.html.markdown
+++ b/website/docs/r/comprehend_entity_recognizer.html.markdown
@@ -141,9 +141,9 @@ The following arguments are optional:
 * `security_group_ids` - (Required) List of security group IDs.
 * `subnets` - (Required) List of VPC subnets.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the Entity Recognizer version.
 * `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block).
@@ -158,8 +158,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Comprehend Entity Recognizer can be imported using the ARN, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Comprehend Entity Recognizer using the ARN. For example:
 
+```terraform
+import {
+  to = aws_comprehend_entity_recognizer.example
+  id = "arn:aws:comprehend:us-west-2:123456789012:entity-recognizer/example"
+}
 ```
-$ terraform import aws_comprehend_entity_recognizer.example arn:aws:comprehend:us-west-2:123456789012:entity-recognizer/example
+
+Using `terraform import`, import Comprehend Entity Recognizer using the ARN. For example:
+
+```console
+% terraform import aws_comprehend_entity_recognizer.example arn:aws:comprehend:us-west-2:123456789012:entity-recognizer/example
 ```
diff --git a/website/docs/r/config_aggregate_authorization.html.markdown b/website/docs/r/config_aggregate_authorization.html.markdown
new file mode 100644
index 00000000000..116d19ea43f
--- /dev/null
+++ b/website/docs/r/config_aggregate_authorization.html.markdown
@@ -0,0 +1,52 @@
+---
+subcategory: "Config"
+layout: "aws"
+page_title: "AWS: aws_config_aggregate_authorization"
+description: |-
+  Manages an AWS Config Aggregate Authorization.
+---
+
+# Resource: aws_config_aggregate_authorization
+
+Manages an AWS Config Aggregate Authorization
+
+## Example Usage
+
+```terraform
+resource "aws_config_aggregate_authorization" "example" {
+  account_id = "123456789012"
+  region     = "eu-west-2"
+}
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `account_id` - (Required) Account ID
+* `region` - (Required) Region
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the authorization
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Config aggregate authorizations using `account_id:region`. For example:
+
+```terraform
+import {
+  to = aws_config_aggregate_authorization.example
+  id = "123456789012:us-east-1"
+}
+```
+
+Using `terraform import`, import Config aggregate authorizations using `account_id:region`. For example:
+
+```console
+% terraform import aws_config_aggregate_authorization.example 123456789012:us-east-1
+```
diff --git a/website/docs/r/config_aggregate_authorization.markdown b/website/docs/r/config_aggregate_authorization.markdown
deleted file mode 100644
index be20f46e123..00000000000
--- a/website/docs/r/config_aggregate_authorization.markdown
+++ /dev/null
@@ -1,43 +0,0 @@
----
-subcategory: "Config"
-layout: "aws"
-page_title: "AWS: aws_config_aggregate_authorization"
-description: |-
-  Manages an AWS Config Aggregate Authorization.
----
-
-# Resource: aws_config_aggregate_authorization
-
-Manages an AWS Config Aggregate Authorization
-
-## Example Usage
-
-```terraform
-resource "aws_config_aggregate_authorization" "example" {
-  account_id = "123456789012"
-  region     = "eu-west-2"
-}
-```
-
-## Argument Reference
-
-The following arguments are supported:
-
-* `account_id` - (Required) Account ID
-* `region` - (Required) Region
-* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
-
-## Attributes Reference
-
-In addition to all arguments above, the following attributes are exported:
-
-* `arn` - The ARN of the authorization
-* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
-
-## Import
-
-Config aggregate authorizations can be imported using `account_id:region`, e.g.,
-
-```
-$ terraform import aws_config_aggregate_authorization.example 123456789012:us-east-1
-```
diff --git a/website/docs/r/config_config_rule.html.markdown b/website/docs/r/config_config_rule.html.markdown
index 5cc405196a3..86881b6ea83 100644
--- a/website/docs/r/config_config_rule.html.markdown
+++ b/website/docs/r/config_config_rule.html.markdown
@@ -137,16 +137,21 @@ EOF
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The name of the rule
 * `description` - (Optional) Description of the rule
+* `evaluation_mode` - (Optional) The modes the Config rule can be evaluated in. See [Evaluation Mode](#evaluation-mode) for more details.
 * `input_parameters` - (Optional) A string in JSON format that is passed to the AWS Config rule Lambda function.
 * `maximum_execution_frequency` - (Optional) The maximum frequency with which AWS Config runs evaluations for a rule.
 * `scope` - (Optional) Scope defines which resources can trigger an evaluation for the rule. See [Source](#source) Below.
 * `source` - (Required) Source specifies the rule owner, the rule identifier, and the notifications that cause the function to evaluate your AWS resources. See [Scope](#scope) Below.
 * `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
+### Evaluation Mode
+
+* `mode` - (Optional) The mode of an evaluation.
+
 ### Scope
 
 Defines which resources can trigger an evaluation for the rule.
@@ -182,9 +187,9 @@ Provides the rule owner (AWS or customer), the rule identifier, and the notifica
 * `policy_runtime` - (Required) The runtime system for your Config Custom Policy rule. Guard is a policy-as-code language that allows you to write policies that are enforced by Config Custom Policy rules. For more information about Guard, see the [Guard GitHub Repository](https://github.com/aws-cloudformation/cloudformation-guard).
 * `policy_text` - (Required) The policy definition containing the logic for your Config Custom Policy rule.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The ARN of the config rule
 * `rule_id` - The ID of the config rule
@@ -192,8 +197,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Config Rule can be imported using the name, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Config Rule using the name. For example:
 
+```terraform
+import {
+  to = aws_config_config_rule.foo
+  id = "example"
+}
 ```
-$ terraform import aws_config_config_rule.foo example
+
+Using `terraform import`, import Config Rule using the name. For example:
+
+```console
+% terraform import aws_config_config_rule.foo example
 ```
diff --git a/website/docs/r/config_configuration_aggregator.html.markdown b/website/docs/r/config_configuration_aggregator.html.markdown
index 8a1f5125590..69b8b13506d 100644
--- a/website/docs/r/config_configuration_aggregator.html.markdown
+++ b/website/docs/r/config_configuration_aggregator.html.markdown
@@ -64,7 +64,7 @@ resource "aws_iam_role_policy_attachment" "organization" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The name of the configuration aggregator.
 * `account_aggregation_source` - (Optional) The account(s) to aggregate config data from as documented below.
@@ -91,17 +91,26 @@ Either `regions` or `all_regions` (as true) must be specified.
 
 Either `regions` or `all_regions` (as true) must be specified.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The ARN of the aggregator
 * `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
 
 ## Import
 
-Configuration Aggregators can be imported using the name, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Configuration Aggregators using the name. For example:
 
+```terraform
+import {
+  to = aws_config_configuration_aggregator.example
+  id = "foo"
+}
 ```
-$ terraform import aws_config_configuration_aggregator.example foo
+
+Using `terraform import`, import Configuration Aggregators using the name. For example:
+
+```console
+% terraform import aws_config_configuration_aggregator.example foo
 ```
diff --git a/website/docs/r/config_configuration_recorder.html.markdown b/website/docs/r/config_configuration_recorder.html.markdown
index b4c98a5ea63..6f28d8c7a36 100644
--- a/website/docs/r/config_configuration_recorder.html.markdown
+++ b/website/docs/r/config_configuration_recorder.html.markdown
@@ -14,6 +14,8 @@ Provides an AWS Config Configuration Recorder. Please note that this resource **
 
 ## Example Usage
 
+### Basic Usage
+
 ```terraform
 resource "aws_config_configuration_recorder" "foo" {
   name     = "example"
@@ -39,30 +41,70 @@ resource "aws_iam_role" "r" {
 }
 ```
 
+### Exclude Resources Types Usage
+
+```terraform
+resource "aws_config_configuration_recorder" "foo" {
+  name     = "example"
+  role_arn = aws_iam_role.r.arn
+
+  recording_group {
+    all_supported = false
+
+    exclusion_by_resource_types {
+      resource_types = ["AWS::EC2::Instance"]
+    }
+
+    recording_strategy {
+      use_only = "EXCLUSION_BY_RESOURCE_TYPES"
+    }
+  }
+}
+```
+
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Optional) The name of the recorder. Defaults to `default`. Changing it recreates the resource.
 * `role_arn` - (Required) Amazon Resource Name (ARN) of the IAM role. Used to make read or write requests to the delivery channel and to describe the AWS resources associated with the account. See [AWS Docs](http://docs.aws.amazon.com/config/latest/developerguide/iamrole-permissions.html) for more details.
 * `recording_group` - (Optional) Recording group - see below.
 
-### `recording_group`
+### recording_group Configuration Block
 
 * `all_supported` - (Optional) Specifies whether AWS Config records configuration changes for every supported type of regional resource (which includes any new type that will become supported in the future). Conflicts with `resource_types`. Defaults to `true`.
+* `exclusion_by_resource_types` - (Optional) An object that specifies how AWS Config excludes resource types from being recorded by the configuration recorder.To use this option, you must set the useOnly field of RecordingStrategy to `EXCLUSION_BY_RESOURCE_TYPES` Requires `all_supported = false`. Conflicts with `resource_types`.
 * `include_global_resource_types` - (Optional) Specifies whether AWS Config includes all supported types of _global resources_ with the resources that it records. Requires `all_supported = true`. Conflicts with `resource_types`.
+* `recording_strategy` - (Optional) Recording Strategy. Detailed below.
 * `resource_types` - (Optional) A list that specifies the types of AWS resources for which AWS Config records configuration changes (for example, `AWS::EC2::Instance` or `AWS::CloudTrail::Trail`). See [relevant part of AWS Docs](http://docs.aws.amazon.com/config/latest/APIReference/API_ResourceIdentifier.html#config-Type-ResourceIdentifier-resourceType) for available types. In order to use this attribute, `all_supported` must be set to false.
 
-## Attributes Reference
+#### exclusion_by_resource_types Configuration Block
+
+* `resource_types` - (Optional) A list that specifies the types of AWS resources for which AWS Config excludes records configuration changes. See [relevant part of AWS Docs](http://docs.aws.amazon.com/config/latest/APIReference/API_ResourceIdentifier.html#config-Type-ResourceIdentifier-resourceType) for available types.
+
+#### recording_strategy Configuration Block
+
+* ` use_only` - (Optional) The recording strategy for the configuration recorder.See [relevant part of AWS Docs](https://docs.aws.amazon.com/config/latest/APIReference/API_RecordingStrategy.html)
 
-In addition to all arguments above, the following attributes are exported:
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Name of the recorder
 
 ## Import
 
-Configuration Recorder can be imported using the name, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Configuration Recorder using the name. For example:
 
+```terraform
+import {
+  to = aws_config_configuration_recorder.foo
+  id = "example"
+}
 ```
-$ terraform import aws_config_configuration_recorder.foo example
+
+Using `terraform import`, import Configuration Recorder using the name. For example:
+
+```console
+% terraform import aws_config_configuration_recorder.foo example
 ```
diff --git a/website/docs/r/config_configuration_recorder_status.html.markdown b/website/docs/r/config_configuration_recorder_status.html.markdown
index 0f106fc58c7..414ab7addf4 100644
--- a/website/docs/r/config_configuration_recorder_status.html.markdown
+++ b/website/docs/r/config_configuration_recorder_status.html.markdown
@@ -78,19 +78,28 @@ resource "aws_iam_role_policy" "p" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The name of the recorder
 * `is_enabled` - (Required) Whether the configuration recorder should be enabled or disabled.
 
-## Attributes Reference
+## Attribute Reference
 
-No additional attributes are exported.
+This resource exports no additional attributes.
 
 ## Import
 
-Configuration Recorder Status can be imported using the name of the Configuration Recorder, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Configuration Recorder Status using the name of the Configuration Recorder. For example:
 
+```terraform
+import {
+  to = aws_config_configuration_recorder_status.foo
+  id = "example"
+}
 ```
-$ terraform import aws_config_configuration_recorder_status.foo example
+
+Using `terraform import`, import Configuration Recorder Status using the name of the Configuration Recorder. For example:
+
+```console
+% terraform import aws_config_configuration_recorder_status.foo example
 ```
diff --git a/website/docs/r/config_conformance_pack.html.markdown b/website/docs/r/config_conformance_pack.html.markdown
index ac10f34fd48..8fd8ba3ee0b 100644
--- a/website/docs/r/config_conformance_pack.html.markdown
+++ b/website/docs/r/config_conformance_pack.html.markdown
@@ -82,7 +82,7 @@ EOT
 
 ~> **Note:** If both `template_body` and `template_s3_uri` are specified, AWS Config uses the `template_s3_uri` and ignores the `template_body`.
 
-The following arguments are supported:
+This argument supports the following arguments:
 
 * `name` - (Required, Forces new resource) The name of the conformance pack. Must begin with a letter and contain from 1 to 256 alphanumeric characters and hyphens.
 * `delivery_s3_bucket` - (Optional) Amazon S3 bucket where AWS Config stores conformance pack templates. Maximum length of 63.
@@ -98,16 +98,25 @@ The `input_parameter` configuration block supports the following arguments:
 * `parameter_name` - (Required) The input key.
 * `parameter_value` - (Required) The input value.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name (ARN) of the conformance pack.
 
 ## Import
 
-Config Conformance Packs can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Config Conformance Packs using the `name`. For example:
 
+```terraform
+import {
+  to = aws_config_conformance_pack.example
+  id = "example"
+}
 ```
-$ terraform import aws_config_conformance_pack.example example
+
+Using `terraform import`, import Config Conformance Packs using the `name`. For example:
+
+```console
+% terraform import aws_config_conformance_pack.example example
 ```
diff --git a/website/docs/r/config_delivery_channel.html.markdown b/website/docs/r/config_delivery_channel.html.markdown
index da1c5fd8798..0f671144aa0 100644
--- a/website/docs/r/config_delivery_channel.html.markdown
+++ b/website/docs/r/config_delivery_channel.html.markdown
@@ -69,7 +69,7 @@ resource "aws_iam_role_policy" "p" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Optional) The name of the delivery channel. Defaults to `default`. Changing it recreates the resource.
 * `s3_bucket_name` - (Required) The name of the S3 bucket used to store the configuration history.
@@ -82,16 +82,25 @@ The following arguments are supported:
 
 * `delivery_frequency` - (Optional) - The frequency with which AWS Config recurringly delivers configuration snapshotsE.g., `One_Hour` or `Three_Hours`. Valid values are listed [here](https://docs.aws.amazon.com/config/latest/APIReference/API_ConfigSnapshotDeliveryProperties.html#API_ConfigSnapshotDeliveryProperties_Contents).
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The name of the delivery channel.
 
 ## Import
 
-Delivery Channel can be imported using the name, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Delivery Channel using the name. For example:
 
+```terraform
+import {
+  to = aws_config_delivery_channel.foo
+  id = "example"
+}
 ```
-$ terraform import aws_config_delivery_channel.foo example
+
+Using `terraform import`, import Delivery Channel using the name. For example:
+
+```console
+% terraform import aws_config_delivery_channel.foo example
 ```
diff --git a/website/docs/r/config_organization_conformance_pack.html.markdown b/website/docs/r/config_organization_conformance_pack.html.markdown
index 72e6be96cc3..9420366cbe2 100644
--- a/website/docs/r/config_organization_conformance_pack.html.markdown
+++ b/website/docs/r/config_organization_conformance_pack.html.markdown
@@ -85,7 +85,7 @@ EOT
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required, Forces new resource) The name of the organization conformance pack. Must begin with a letter and contain from 1 to 128 alphanumeric characters and hyphens.
 * `delivery_s3_bucket` - (Optional) Amazon S3 bucket where AWS Config stores conformance pack templates. Delivery bucket must begin with `awsconfigconforms` prefix. Maximum length of 63.
@@ -102,9 +102,9 @@ The `input_parameter` configuration block supports the following arguments:
 * `parameter_name` - (Required) The input key.
 * `parameter_value` - (Required) The input value.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name (ARN) of the organization conformance pack.
 * `id` - The name of the organization conformance pack.
@@ -119,8 +119,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Config Organization Conformance Packs can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Config Organization Conformance Packs using the `name`. For example:
 
+```terraform
+import {
+  to = aws_config_organization_conformance_pack.example
+  id = "example"
+}
 ```
-$ terraform import aws_config_organization_conformance_pack.example example
+
+Using `terraform import`, import Config Organization Conformance Packs using the `name`. For example:
+
+```console
+% terraform import aws_config_organization_conformance_pack.example example
 ```
diff --git a/website/docs/r/config_organization_custom_policy_rule.html.markdown b/website/docs/r/config_organization_custom_policy_rule.html.markdown
index d4dcccfd0fd..416105f3e39 100644
--- a/website/docs/r/config_organization_custom_policy_rule.html.markdown
+++ b/website/docs/r/config_organization_custom_policy_rule.html.markdown
@@ -62,9 +62,9 @@ The following arguments are optional:
 * `tag_key_scope` - (Optional, Required if `tag_value_scope` is configured) Tag key of AWS resources to evaluate
 * `tag_value_scope` - (Optional) Tag value of AWS resources to evaluate
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name (ARN) of the rule
 
@@ -78,8 +78,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-A Config Organization Custom Policy Rule can be imported using the `name` argument, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import a Config Organization Custom Policy Rule using the `name` argument. For example:
 
+```terraform
+import {
+  to = aws_config_organization_custom_policy_rule.example
+  id = "example_rule_name"
+}
 ```
-$ terraform import aws_config_organization_custom_policy_rule.example example_rule_name
+
+Using `terraform import`, import a Config Organization Custom Policy Rule using the `name` argument. For example:
+
+```console
+% terraform import aws_config_organization_custom_policy_rule.example example_rule_name
 ```
diff --git a/website/docs/r/config_organization_custom_rule.html.markdown b/website/docs/r/config_organization_custom_rule.html.markdown
index 98303f2b660..9ad322f6f7c 100644
--- a/website/docs/r/config_organization_custom_rule.html.markdown
+++ b/website/docs/r/config_organization_custom_rule.html.markdown
@@ -43,7 +43,7 @@ resource "aws_config_organization_custom_rule" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `lambda_function_arn` - (Required) Amazon Resource Name (ARN) of the rule Lambda Function
 * `name` - (Required) The name of the rule
@@ -57,9 +57,9 @@ The following arguments are supported:
 * `tag_key_scope` - (Optional, Required if `tag_value_scope` is configured) Tag key of AWS resources to evaluate
 * `tag_value_scope` - (Optional) Tag value of AWS resources to evaluate
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name (ARN) of the rule
 
@@ -73,8 +73,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Config Organization Custom Rules can be imported using the name, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Config Organization Custom Rules using the name. For example:
 
+```terraform
+import {
+  to = aws_config_organization_custom_rule.example
+  id = "example"
+}
 ```
-$ terraform import aws_config_organization_custom_rule.example example
+
+Using `terraform import`, import Config Organization Custom Rules using the name. For example:
+
+```console
+% terraform import aws_config_organization_custom_rule.example example
 ```
diff --git a/website/docs/r/config_organization_managed_rule.html.markdown b/website/docs/r/config_organization_managed_rule.html.markdown
index 3b097215366..b2793b16dff 100644
--- a/website/docs/r/config_organization_managed_rule.html.markdown
+++ b/website/docs/r/config_organization_managed_rule.html.markdown
@@ -32,7 +32,7 @@ resource "aws_config_organization_managed_rule" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The name of the rule
 * `rule_identifier` - (Required) Identifier of an available AWS Config Managed Rule to call. For available values, see the [List of AWS Config Managed Rules](https://docs.aws.amazon.com/config/latest/developerguide/managed-rules-by-aws-config.html) documentation
@@ -45,9 +45,9 @@ The following arguments are supported:
 * `tag_key_scope` - (Optional, Required if `tag_value_scope` is configured) Tag key of AWS resources to evaluate
 * `tag_value_scope` - (Optional) Tag value of AWS resources to evaluate
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name (ARN) of the rule
 
@@ -61,8 +61,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Config Organization Managed Rules can be imported using the name, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Config Organization Managed Rules using the name. For example:
 
+```terraform
+import {
+  to = aws_config_organization_managed_rule.example
+  id = "example"
+}
 ```
-$ terraform import aws_config_organization_managed_rule.example example
+
+Using `terraform import`, import Config Organization Managed Rules using the name. For example:
+
+```console
+% terraform import aws_config_organization_managed_rule.example example
 ```
diff --git a/website/docs/r/config_remediation_configuration.html.markdown b/website/docs/r/config_remediation_configuration.html.markdown
index 7e106f16670..ad003287ba3 100644
--- a/website/docs/r/config_remediation_configuration.html.markdown
+++ b/website/docs/r/config_remediation_configuration.html.markdown
@@ -97,16 +97,25 @@ The value is either a dynamic (resource) value or a static value. You must selec
 * `static_value` - (Optional) Value is static and does not change at run-time.
 * `static_values` - (Optional) List of static values.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the Config Remediation Configuration.
 
 ## Import
 
-Remediation Configurations can be imported using the name config_rule_name, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Remediation Configurations using the name config_rule_name. For example:
 
+```terraform
+import {
+  to = aws_config_remediation_configuration.this
+  id = "example"
+}
 ```
-$ terraform import aws_config_remediation_configuration.this example
+
+Using `terraform import`, import Remediation Configurations using the name config_rule_name. For example:
+
+```console
+% terraform import aws_config_remediation_configuration.this example
 ```
diff --git a/website/docs/r/connect_bot_association.html.markdown b/website/docs/r/connect_bot_association.html.markdown
new file mode 100644
index 00000000000..008062804b1
--- /dev/null
+++ b/website/docs/r/connect_bot_association.html.markdown
@@ -0,0 +1,115 @@
+---
+subcategory: "Connect"
+layout: "aws"
+page_title: "AWS: aws_connect_bot_association"
+description: |-
+  Associates an Amazon Connect instance to an Amazon Lex (V1) bot
+---
+
+# Resource: aws_connect_bot_association
+
+Allows the specified Amazon Connect instance to access the specified Amazon Lex (V1) bot. For more information see
+[Amazon Connect: Getting Started](https://docs.aws.amazon.com/connect/latest/adminguide/amazon-connect-get-started.html) and [Add an Amazon Lex bot](https://docs.aws.amazon.com/connect/latest/adminguide/amazon-lex.html).
+
+~> **NOTE:** This resource only currently supports Amazon Lex (V1) Associations.
+
+## Example Usage
+
+### Basic
+
+```terraform
+resource "aws_connect_bot_association" "example" {
+  instance_id = aws_connect_instance.example.id
+  lex_bot {
+    lex_region = "us-west-2"
+    name       = "Test"
+
+  }
+}
+```
+
+### Including a sample Lex bot
+
+```terraform
+data "aws_region" "current" {}
+
+resource "aws_lex_intent" "example" {
+  create_version = true
+  name           = "connect_lex_intent"
+  fulfillment_activity {
+    type = "ReturnIntent"
+  }
+  sample_utterances = [
+    "I would like to pick up flowers.",
+  ]
+}
+
+resource "aws_lex_bot" "example" {
+  abort_statement {
+    message {
+      content      = "Sorry, I am not able to assist at this time."
+      content_type = "PlainText"
+    }
+  }
+  clarification_prompt {
+    max_attempts = 2
+    message {
+      content      = "I didn't understand you, what would you like to do?"
+      content_type = "PlainText"
+    }
+  }
+  intent {
+    intent_name    = aws_lex_intent.example.name
+    intent_version = "1"
+  }
+
+  child_directed   = false
+  name             = "connect_lex_bot"
+  process_behavior = "BUILD"
+}
+
+resource "aws_connect_bot_association" "example" {
+  instance_id = aws_connect_instance.example.id
+  lex_bot {
+    lex_region = data.aws_region.current.name
+    name       = aws_lex_bot.example.name
+  }
+}
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `instance_id` - (Required) The identifier of the Amazon Connect instance. You can find the instanceId in the ARN of the instance.
+* `lex_bot` - (Required) Configuration information of an Amazon Lex (V1) bot. Detailed below.
+
+### lex_bot
+
+The `lex_bot` configuration block supports the following:
+
+* `name` - (Required) The name of the Amazon Lex (V1) bot.
+* `lex_region` - (Optional) The Region that the Amazon Lex (V1) bot was created in. Defaults to current region.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Amazon Connect instance ID, Lex (V1) bot name, and Lex (V1) bot region separated by colons (`:`).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_connect_bot_association` using the Amazon Connect instance ID, Lex (V1) bot name, and Lex (V1) bot region separated by colons (`:`). For example:
+
+```terraform
+import {
+  to = aws_connect_bot_association.example
+  id = "aaaaaaaa-bbbb-cccc-dddd-111111111111:Example:us-west-2"
+}
+```
+
+Using `terraform import`, import `aws_connect_bot_association` using the Amazon Connect instance ID, Lex (V1) bot name, and Lex (V1) bot region separated by colons (`:`). For example:
+
+```console
+% terraform import aws_connect_bot_association.example aaaaaaaa-bbbb-cccc-dddd-111111111111:Example:us-west-2
+```
diff --git a/website/docs/r/connect_bot_association.markdown b/website/docs/r/connect_bot_association.markdown
deleted file mode 100644
index 0a949818895..00000000000
--- a/website/docs/r/connect_bot_association.markdown
+++ /dev/null
@@ -1,106 +0,0 @@
----
-subcategory: "Connect"
-layout: "aws"
-page_title: "AWS: aws_connect_bot_association"
-description: |-
-  Associates an Amazon Connect instance to an Amazon Lex (V1) bot
----
-
-# Resource: aws_connect_bot_association
-
-Allows the specified Amazon Connect instance to access the specified Amazon Lex (V1) bot. For more information see
-[Amazon Connect: Getting Started](https://docs.aws.amazon.com/connect/latest/adminguide/amazon-connect-get-started.html) and [Add an Amazon Lex bot](https://docs.aws.amazon.com/connect/latest/adminguide/amazon-lex.html).
-
-~> **NOTE:** This resource only currently supports Amazon Lex (V1) Associations.
-
-## Example Usage
-
-### Basic
-
-```terraform
-resource "aws_connect_bot_association" "example" {
-  instance_id = aws_connect_instance.example.id
-  lex_bot {
-    lex_region = "us-west-2"
-    name       = "Test"
-
-  }
-}
-```
-
-### Including a sample Lex bot
-
-```terraform
-data "aws_region" "current" {}
-
-resource "aws_lex_intent" "example" {
-  create_version = true
-  name           = "connect_lex_intent"
-  fulfillment_activity {
-    type = "ReturnIntent"
-  }
-  sample_utterances = [
-    "I would like to pick up flowers.",
-  ]
-}
-
-resource "aws_lex_bot" "example" {
-  abort_statement {
-    message {
-      content      = "Sorry, I am not able to assist at this time."
-      content_type = "PlainText"
-    }
-  }
-  clarification_prompt {
-    max_attempts = 2
-    message {
-      content      = "I didn't understand you, what would you like to do?"
-      content_type = "PlainText"
-    }
-  }
-  intent {
-    intent_name    = aws_lex_intent.example.name
-    intent_version = "1"
-  }
-
-  child_directed   = false
-  name             = "connect_lex_bot"
-  process_behavior = "BUILD"
-}
-
-resource "aws_connect_bot_association" "example" {
-  instance_id = aws_connect_instance.example.id
-  lex_bot {
-    lex_region = data.aws_region.current.name
-    name       = aws_lex_bot.example.name
-  }
-}
-```
-
-## Argument Reference
-
-The following arguments are supported:
-
-* `instance_id` - (Required) The identifier of the Amazon Connect instance. You can find the instanceId in the ARN of the instance.
-* `lex_bot` - (Required) Configuration information of an Amazon Lex (V1) bot. Detailed below.
-
-### lex_bot
-
-The `lex_bot` configuration block supports the following:
-
-* `name` - (Required) The name of the Amazon Lex (V1) bot.
-* `lex_region` - (Optional) The Region that the Amazon Lex (V1) bot was created in. Defaults to current region.
-
-## Attributes Reference
-
-In addition to all arguments above, the following attributes are exported:
-
-* `id` - The Amazon Connect instance ID, Lex (V1) bot name, and Lex (V1) bot region separated by colons (`:`).
-
-## Import
-
-`aws_connect_bot_association` can be imported by using the Amazon Connect instance ID, Lex (V1) bot name, and Lex (V1) bot region separated by colons (`:`), e.g.
-
-```
-$ terraform import aws_connect_bot_association.example aaaaaaaa-bbbb-cccc-dddd-111111111111:Example:us-west-2
-```
diff --git a/website/docs/r/connect_contact_flow.html.markdown b/website/docs/r/connect_contact_flow.html.markdown
index 8e461e4e169..8a48dc63030 100644
--- a/website/docs/r/connect_contact_flow.html.markdown
+++ b/website/docs/r/connect_contact_flow.html.markdown
@@ -66,8 +66,8 @@ resource "aws_connect_contact_flow" "test" {
 
 Use the AWS CLI to extract Contact Flow Content:
 
-```shell
-$ aws connect describe-contact-flow --instance-id 1b3c5d8-1b3c-1b3c-1b3c-1b3c5d81b3c5 --contact-flow-id c1d4e5f6-1b3c-1b3c-1b3c-c1d4e5f6c1d4e5 --region us-west-2 | jq '.ContactFlow.Content | fromjson' > contact_flow.json
+```console
+% aws connect describe-contact-flow --instance-id 1b3c5d8-1b3c-1b3c-1b3c-1b3c5d81b3c5 --contact-flow-id c1d4e5f6-1b3c-1b3c-1b3c-c1d4e5f6c1d4e5 --region us-west-2 | jq '.ContactFlow.Content | fromjson' > contact_flow.json
 ```
 
 Use the generated file as input:
@@ -90,7 +90,7 @@ resource "aws_connect_contact_flow" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `content` - (Optional) Specifies the content of the Contact Flow, provided as a JSON string, written in Amazon Connect Contact Flow Language. If defined, the `filename` argument cannot be used.
 * `content_hash` - (Optional) Used to trigger updates. Must be set to a base64-encoded SHA256 hash of the Contact Flow source specified with `filename`. The usual way to set this is filebase64sha256("mycontact_flow.json") (Terraform 0.11.12 and later) or base64sha256(file("mycontact_flow.json")) (Terraform 0.11.11 and earlier), where "mycontact_flow.json" is the local filename of the Contact Flow source.
@@ -101,9 +101,9 @@ The following arguments are supported:
 * `tags` - (Optional) Tags to apply to the Contact Flow. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 * `type` - (Optional, Forces new resource) Specifies the type of the Contact Flow. Defaults to `CONTACT_FLOW`. Allowed Values are: `CONTACT_FLOW`, `CUSTOMER_QUEUE`, `CUSTOMER_HOLD`, `CUSTOMER_WHISPER`, `AGENT_HOLD`, `AGENT_WHISPER`, `OUTBOUND_WHISPER`, `AGENT_TRANSFER`, `QUEUE_TRANSFER`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The Amazon Resource Name (ARN) of the Contact Flow.
 * `id` - The identifier of the hosting Amazon Connect Instance and identifier of the Contact Flow separated by a colon (`:`).
@@ -112,8 +112,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Amazon Connect Contact Flows can be imported using the `instance_id` and `contact_flow_id` separated by a colon (`:`), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Amazon Connect Contact Flows using the `instance_id` and `contact_flow_id` separated by a colon (`:`). For example:
 
+```terraform
+import {
+  to = aws_connect_contact_flow.example
+  id = "f1288a1f-6193-445a-b47e-af739b2:c1d4e5f6-1b3c-1b3c-1b3c-c1d4e5f6c1d4e5"
+}
 ```
-$ terraform import aws_connect_contact_flow.example f1288a1f-6193-445a-b47e-af739b2:c1d4e5f6-1b3c-1b3c-1b3c-c1d4e5f6c1d4e5
+
+Using `terraform import`, import Amazon Connect Contact Flows using the `instance_id` and `contact_flow_id` separated by a colon (`:`). For example:
+
+```console
+% terraform import aws_connect_contact_flow.example f1288a1f-6193-445a-b47e-af739b2:c1d4e5f6-1b3c-1b3c-1b3c-c1d4e5f6c1d4e5
 ```
diff --git a/website/docs/r/connect_contact_flow_module.html.markdown b/website/docs/r/connect_contact_flow_module.html.markdown
index 1a330e69ad2..7a79927ba31 100644
--- a/website/docs/r/connect_contact_flow_module.html.markdown
+++ b/website/docs/r/connect_contact_flow_module.html.markdown
@@ -83,8 +83,8 @@ resource "aws_connect_contact_flow_module" "example" {
 
 Use the AWS CLI to extract Contact Flow Content:
 
-```shell
-$ aws connect describe-contact-flow-module --instance-id 1b3c5d8-1b3c-1b3c-1b3c-1b3c5d81b3c5 --contact-flow-module-id c1d4e5f6-1b3c-1b3c-1b3c-c1d4e5f6c1d4e5 --region us-west-2 | jq '.ContactFlowModule.Content | fromjson' > contact_flow_module.json
+```console
+% aws connect describe-contact-flow-module --instance-id 1b3c5d8-1b3c-1b3c-1b3c-1b3c5d81b3c5 --contact-flow-module-id c1d4e5f6-1b3c-1b3c-1b3c-c1d4e5f6c1d4e5 --region us-west-2 | jq '.ContactFlowModule.Content | fromjson' > contact_flow_module.json
 ```
 
 Use the generated file as input:
@@ -107,7 +107,7 @@ resource "aws_connect_contact_flow_module" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `content` - (Optional) Specifies the content of the Contact Flow Module, provided as a JSON string, written in Amazon Connect Contact Flow Language. If defined, the `filename` argument cannot be used.
 * `content_hash` - (Optional) Used to trigger updates. Must be set to a base64-encoded SHA256 hash of the Contact Flow Module source specified with `filename`. The usual way to set this is filebase64sha256("contact_flow_module.json") (Terraform 0.11.12 and later) or base64sha256(file("contact_flow_module.json")) (Terraform 0.11.11 and earlier), where "contact_flow_module.json" is the local filename of the Contact Flow Module source.
@@ -117,9 +117,9 @@ The following arguments are supported:
 * `name` - (Required) Specifies the name of the Contact Flow Module.
 * `tags` - (Optional) Tags to apply to the Contact Flow Module. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The Amazon Resource Name (ARN) of the Contact Flow Module.
 * `id` - The identifier of the hosting Amazon Connect Instance and identifier of the Contact Flow Module separated by a colon (`:`).
@@ -128,8 +128,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Amazon Connect Contact Flow Modules can be imported using the `instance_id` and `contact_flow_module_id` separated by a colon (`:`), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Amazon Connect Contact Flow Modules using the `instance_id` and `contact_flow_module_id` separated by a colon (`:`). For example:
 
+```terraform
+import {
+  to = aws_connect_contact_flow_module.example
+  id = "f1288a1f-6193-445a-b47e-af739b2:c1d4e5f6-1b3c-1b3c-1b3c-c1d4e5f6c1d4e5"
+}
 ```
-$ terraform import aws_connect_contact_flow_module.example f1288a1f-6193-445a-b47e-af739b2:c1d4e5f6-1b3c-1b3c-1b3c-c1d4e5f6c1d4e5
+
+Using `terraform import`, import Amazon Connect Contact Flow Modules using the `instance_id` and `contact_flow_module_id` separated by a colon (`:`). For example:
+
+```console
+% terraform import aws_connect_contact_flow_module.example f1288a1f-6193-445a-b47e-af739b2:c1d4e5f6-1b3c-1b3c-1b3c-c1d4e5f6c1d4e5
 ```
diff --git a/website/docs/r/connect_hours_of_operation.html.markdown b/website/docs/r/connect_hours_of_operation.html.markdown
index e319c57c1e1..d00de06eae2 100644
--- a/website/docs/r/connect_hours_of_operation.html.markdown
+++ b/website/docs/r/connect_hours_of_operation.html.markdown
@@ -56,7 +56,7 @@ resource "aws_connect_hours_of_operation" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `config` - (Required) One or more config blocks which define the configuration information for the hours of operation: day, start time, and end time . Config blocks are documented below.
 * `description` - (Optional) Specifies the description of the Hours of Operation.
@@ -81,9 +81,9 @@ A `start_time` block supports the following arguments:
 * `hours` - (Required) Specifies the hour of opening.
 * `minutes` - (Required) Specifies the minute of opening.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The Amazon Resource Name (ARN) of the Hours of Operation.
 * `hours_of_operation_id` - The identifier for the hours of operation.
@@ -92,8 +92,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Amazon Connect Hours of Operations can be imported using the `instance_id` and `hours_of_operation_id` separated by a colon (`:`), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Amazon Connect Hours of Operations using the `instance_id` and `hours_of_operation_id` separated by a colon (`:`). For example:
 
+```terraform
+import {
+  to = aws_connect_hours_of_operation.example
+  id = "f1288a1f-6193-445a-b47e-af739b2:c1d4e5f6-1b3c-1b3c-1b3c-c1d4e5f6c1d4e5"
+}
 ```
-$ terraform import aws_connect_hours_of_operation.example f1288a1f-6193-445a-b47e-af739b2:c1d4e5f6-1b3c-1b3c-1b3c-c1d4e5f6c1d4e5
+
+Using `terraform import`, import Amazon Connect Hours of Operations using the `instance_id` and `hours_of_operation_id` separated by a colon (`:`). For example:
+
+```console
+% terraform import aws_connect_hours_of_operation.example f1288a1f-6193-445a-b47e-af739b2:c1d4e5f6-1b3c-1b3c-1b3c-c1d4e5f6c1d4e5
 ```
diff --git a/website/docs/r/connect_instance.html.markdown b/website/docs/r/connect_instance.html.markdown
index 2186d94256a..6805753fba8 100644
--- a/website/docs/r/connect_instance.html.markdown
+++ b/website/docs/r/connect_instance.html.markdown
@@ -49,7 +49,7 @@ resource "aws_connect_instance" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `auto_resolve_best_voices_enabled` - (Optional) Specifies whether auto resolve best voices is enabled. Defaults to `true`.
 * `contact_flow_logs_enabled` - (Optional) Specifies whether contact flow logs are enabled. Defaults to `false`.
@@ -63,9 +63,9 @@ The following arguments are supported:
 * `outbound_calls_enabled` - (Required) Specifies whether outbound calls are enabled.
 <!-- * `use_custom_tts_voices` - (Optional) Whether use custom tts voices is enabled. Defaults to `false` -->
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The identifier of the instance.
 * `arn` - Amazon Resource Name (ARN) of the instance.
@@ -82,8 +82,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Connect instances can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Connect instances using the `id`. For example:
 
+```terraform
+import {
+  to = aws_connect_instance.example
+  id = "f1288a1f-6193-445a-b47e-af739b2"
+}
 ```
-$ terraform import aws_connect_instance.example f1288a1f-6193-445a-b47e-af739b2
+
+Using `terraform import`, import Connect instances using the `id`. For example:
+
+```console
+% terraform import aws_connect_instance.example f1288a1f-6193-445a-b47e-af739b2
 ```
diff --git a/website/docs/r/connect_instance_storage_config.html.markdown b/website/docs/r/connect_instance_storage_config.html.markdown
index a3e8f6ba6e2..15b61d56a25 100644
--- a/website/docs/r/connect_instance_storage_config.html.markdown
+++ b/website/docs/r/connect_instance_storage_config.html.markdown
@@ -108,10 +108,10 @@ resource "aws_connect_instance_storage_config" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `instance_id` - (Required) Specifies the identifier of the hosting Amazon Connect Instance.
-* `resource_type` - (Required) A valid resource type. Valid Values: `AGENT_EVENTS` | `ATTACHMENTS` | `CALL_RECORDINGS` | `CHAT_TRANSCRIPTS` | `CONTACT_EVALUATIONS` | `CONTACT_TRACE_RECORDS` | `MEDIA_STREAMS` | `REAL_TIME_CONTACT_ANALYSIS_SEGMENTS` | `SCHEDULED_REPORTS`.
+* `resource_type` - (Required) A valid resource type. Valid Values: `AGENT_EVENTS` | `ATTACHMENTS` | `CALL_RECORDINGS` | `CHAT_TRANSCRIPTS` | `CONTACT_EVALUATIONS` | `CONTACT_TRACE_RECORDS` | `MEDIA_STREAMS` | `REAL_TIME_CONTACT_ANALYSIS_SEGMENTS` | `SCHEDULED_REPORTS` | `SCREEN_RECORDINGS`.
 * `storage_config` - (Required) Specifies the storage configuration options for the Connect Instance. [Documented below](#storage_config).
 
 ### `storage_config`
@@ -159,17 +159,26 @@ The `encryption_config` configuration block supports the following arguments:
 * `encryption_type` - (Required) The type of encryption. Valid Values: `KMS`.
 * `key_id` - (Required) The full ARN of the encryption key. Be sure to provide the full ARN of the encryption key, not just the ID.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `association_id` - The existing association identifier that uniquely identifies the resource type and storage config for the given instance ID.
 * `id` - The identifier of the hosting Amazon Connect Instance, `association_id`, and `resource_type` separated by a colon (`:`).
 
 ## Import
 
-Amazon Connect Instance Storage Configs can be imported using the `instance_id`, `association_id`, and `resource_type` separated by a colon (`:`), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Amazon Connect Instance Storage Configs using the `instance_id`, `association_id`, and `resource_type` separated by a colon (`:`). For example:
 
+```terraform
+import {
+  to = aws_connect_instance_storage_config.example
+  id = "f1288a1f-6193-445a-b47e-af739b2:c1d4e5f6-1b3c-1b3c-1b3c-c1d4e5f6c1d4e5:CHAT_TRANSCRIPTS"
+}
 ```
-$ terraform import aws_connect_instance_storage_config.example f1288a1f-6193-445a-b47e-af739b2:c1d4e5f6-1b3c-1b3c-1b3c-c1d4e5f6c1d4e5:CHAT_TRANSCRIPTS
+
+Using `terraform import`, import Amazon Connect Instance Storage Configs using the `instance_id`, `association_id`, and `resource_type` separated by a colon (`:`). For example:
+
+```console
+% terraform import aws_connect_instance_storage_config.example f1288a1f-6193-445a-b47e-af739b2:c1d4e5f6-1b3c-1b3c-1b3c-c1d4e5f6c1d4e5:CHAT_TRANSCRIPTS
 ```
diff --git a/website/docs/r/connect_lambda_function_association.html.markdown b/website/docs/r/connect_lambda_function_association.html.markdown
new file mode 100644
index 00000000000..d682f0b90f1
--- /dev/null
+++ b/website/docs/r/connect_lambda_function_association.html.markdown
@@ -0,0 +1,51 @@
+---
+subcategory: "Connect"
+layout: "aws"
+page_title: "AWS: aws_connect_lambda_function_association"
+description: |-
+  Provides details about a specific Connect Lambda Function Association.
+---
+
+# Resource: aws_connect_lambda_function_association
+
+Provides an Amazon Connect Lambda Function Association. For more information see
+[Amazon Connect: Getting Started](https://docs.aws.amazon.com/connect/latest/adminguide/amazon-connect-get-started.html) and [Invoke AWS Lambda functions](https://docs.aws.amazon.com/connect/latest/adminguide/connect-lambda-functions.html).
+
+## Example Usage
+
+```terraform
+resource "aws_connect_lambda_function_association" "example" {
+  function_arn = aws_lambda_function.example.arn
+  instance_id  = aws_connect_instance.example.id
+}
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `function_arn` - (Required) Amazon Resource Name (ARN) of the Lambda Function, omitting any version or alias qualifier.
+* `instance_id` - (Required) The identifier of the Amazon Connect instance. You can find the instanceId in the ARN of the instance.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Amazon Connect instance ID and Lambda Function ARN separated by a comma (`,`).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_connect_lambda_function_association` using the `instance_id` and `function_arn` separated by a comma (`,`). For example:
+
+```terraform
+import {
+  to = aws_connect_lambda_function_association.example
+  id = "aaaaaaaa-bbbb-cccc-dddd-111111111111,arn:aws:lambda:us-west-2:123456789123:function:example"
+}
+```
+
+Using `terraform import`, import `aws_connect_lambda_function_association` using the `instance_id` and `function_arn` separated by a comma (`,`). For example:
+
+```console
+% terraform import aws_connect_lambda_function_association.example aaaaaaaa-bbbb-cccc-dddd-111111111111,arn:aws:lambda:us-west-2:123456789123:function:example
+```
diff --git a/website/docs/r/connect_lambda_function_association.markdown b/website/docs/r/connect_lambda_function_association.markdown
deleted file mode 100644
index 4f571a29126..00000000000
--- a/website/docs/r/connect_lambda_function_association.markdown
+++ /dev/null
@@ -1,42 +0,0 @@
----
-subcategory: "Connect"
-layout: "aws"
-page_title: "AWS: aws_connect_lambda_function_association"
-description: |-
-  Provides details about a specific Connect Lambda Function Association.
----
-
-# Resource: aws_connect_lambda_function_association
-
-Provides an Amazon Connect Lambda Function Association. For more information see
-[Amazon Connect: Getting Started](https://docs.aws.amazon.com/connect/latest/adminguide/amazon-connect-get-started.html) and [Invoke AWS Lambda functions](https://docs.aws.amazon.com/connect/latest/adminguide/connect-lambda-functions.html).
-
-## Example Usage
-
-```terraform
-resource "aws_connect_lambda_function_association" "example" {
-  function_arn = aws_lambda_function.example.arn
-  instance_id  = aws_connect_instance.example.id
-}
-```
-
-## Argument Reference
-
-The following arguments are supported:
-
-* `function_arn` - (Required) Amazon Resource Name (ARN) of the Lambda Function, omitting any version or alias qualifier.
-* `instance_id` - (Required) The identifier of the Amazon Connect instance. You can find the instanceId in the ARN of the instance.
-
-## Attributes Reference
-
-In addition to all arguments above, the following attributes are exported:
-
-* `id` - The Amazon Connect instance ID and Lambda Function ARN separated by a comma (`,`).
-
-## Import
-
-`aws_connect_lambda_function_association` can be imported using the `instance_id` and `function_arn` separated by a comma (`,`) e.g.,
-
-```
-$ terraform import aws_connect_lambda_function_association.example aaaaaaaa-bbbb-cccc-dddd-111111111111,arn:aws:lambda:us-west-2:123456789123:function:example
-```
diff --git a/website/docs/r/connect_phone_number.html.markdown b/website/docs/r/connect_phone_number.html.markdown
index 9367c9a8283..9044bb4fc05 100644
--- a/website/docs/r/connect_phone_number.html.markdown
+++ b/website/docs/r/connect_phone_number.html.markdown
@@ -51,7 +51,7 @@ resource "aws_connect_phone_number" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `country_code` - (Required, Forces new resource) The ISO country code. For a list of Valid values, refer to [PhoneNumberCountryCode](https://docs.aws.amazon.com/connect/latest/APIReference/API_SearchAvailablePhoneNumbers.html#connect-SearchAvailablePhoneNumbers-request-PhoneNumberCountryCode).
 * `description` - (Optional, Forces new resource) The description of the phone number.
@@ -60,9 +60,9 @@ The following arguments are supported:
 * `target_arn` - (Required) The Amazon Resource Name (ARN) for Amazon Connect instances that phone numbers are claimed to.
 * `type` - (Required, Forces new resource) The type of phone number. Valid Values: `TOLL_FREE` | `DID`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The ARN of the phone number.
 * `phone_number` - The phone number. Phone numbers are formatted `[+] [country code] [subscriber number including area code]`.
@@ -87,8 +87,17 @@ The `status` configuration block supports the following attributes:
 
 ## Import
 
-Amazon Connect Phone Numbers can be imported using its `id` e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Amazon Connect Phone Numbers using its `id`. For example:
 
+```terraform
+import {
+  to = aws_connect_phone_number.example
+  id = "12345678-abcd-1234-efgh-9876543210ab"
+}
 ```
-$ terraform import aws_connect_phone_number.example 12345678-abcd-1234-efgh-9876543210ab
+
+Using `terraform import`, import Amazon Connect Phone Numbers using its `id`. For example:
+
+```console
+% terraform import aws_connect_phone_number.example 12345678-abcd-1234-efgh-9876543210ab
 ```
diff --git a/website/docs/r/connect_queue.html.markdown b/website/docs/r/connect_queue.html.markdown
index 5d5c2ef39ba..749ae21c27f 100644
--- a/website/docs/r/connect_queue.html.markdown
+++ b/website/docs/r/connect_queue.html.markdown
@@ -11,8 +11,6 @@ description: |-
 Provides an Amazon Connect Queue resource. For more information see
 [Amazon Connect: Getting Started](https://docs.aws.amazon.com/connect/latest/adminguide/amazon-connect-get-started.html)
 
-~> **NOTE:** Due to The behaviour of Amazon Connect you cannot delete queues.
-
 ## Example Usage
 
 ### Basic
@@ -72,7 +70,7 @@ resource "aws_connect_queue" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `description` - (Optional) Specifies the description of the Queue.
 * `hours_of_operation_id` - (Required) Specifies the identifier of the Hours of Operation.
@@ -90,9 +88,9 @@ A `outbound_caller_config` block supports the following arguments:
 * `outbound_caller_id_number_id` - (Optional) Specifies the caller ID number.
 * `outbound_flow_id` - (Optional) Specifies outbound whisper flow to be used during an outbound call.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The Amazon Resource Name (ARN) of the Queue.
 * `queue_id` - The identifier for the Queue.
@@ -101,8 +99,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Amazon Connect Queues can be imported using the `instance_id` and `queue_id` separated by a colon (`:`), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Amazon Connect Queues using the `instance_id` and `queue_id` separated by a colon (`:`). For example:
 
+```terraform
+import {
+  to = aws_connect_queue.example
+  id = "f1288a1f-6193-445a-b47e-af739b2:c1d4e5f6-1b3c-1b3c-1b3c-c1d4e5f6c1d4e5"
+}
 ```
-$ terraform import aws_connect_queue.example f1288a1f-6193-445a-b47e-af739b2:c1d4e5f6-1b3c-1b3c-1b3c-c1d4e5f6c1d4e5
+
+Using `terraform import`, import Amazon Connect Queues using the `instance_id` and `queue_id` separated by a colon (`:`). For example:
+
+```console
+% terraform import aws_connect_queue.example f1288a1f-6193-445a-b47e-af739b2:c1d4e5f6-1b3c-1b3c-1b3c-c1d4e5f6c1d4e5
 ```
diff --git a/website/docs/r/connect_quick_connect.html.markdown b/website/docs/r/connect_quick_connect.html.markdown
index 2a7c635ccb0..da99cbce289 100644
--- a/website/docs/r/connect_quick_connect.html.markdown
+++ b/website/docs/r/connect_quick_connect.html.markdown
@@ -35,7 +35,7 @@ resource "aws_connect_quick_connect" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `description` - (Optional) Specifies the description of the Quick Connect.
 * `instance_id` - (Required) Specifies the identifier of the hosting Amazon Connect Instance.
@@ -64,9 +64,9 @@ A `user_config` block supports the following arguments:
 * `contact_flow_id` - (Required) Specifies the identifier of the contact flow.
 * `user_id` - (Required) Specifies the identifier for the user.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The Amazon Resource Name (ARN) of the Quick Connect.
 * `quick_connect_id` - The identifier for the Quick Connect.
@@ -75,8 +75,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Amazon Connect Quick Connects can be imported using the `instance_id` and `quick_connect_id` separated by a colon (`:`), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Amazon Connect Quick Connects using the `instance_id` and `quick_connect_id` separated by a colon (`:`). For example:
 
+```terraform
+import {
+  to = aws_connect_quick_connect.example
+  id = "f1288a1f-6193-445a-b47e-af739b2:c1d4e5f6-1b3c-1b3c-1b3c-c1d4e5f6c1d4e5"
+}
 ```
-$ terraform import aws_connect_quick_connect.example f1288a1f-6193-445a-b47e-af739b2:c1d4e5f6-1b3c-1b3c-1b3c-c1d4e5f6c1d4e5
+
+Using `terraform import`, import Amazon Connect Quick Connects using the `instance_id` and `quick_connect_id` separated by a colon (`:`). For example:
+
+```console
+% terraform import aws_connect_quick_connect.example f1288a1f-6193-445a-b47e-af739b2:c1d4e5f6-1b3c-1b3c-1b3c-c1d4e5f6c1d4e5
 ```
diff --git a/website/docs/r/connect_routing_profile.html.markdown b/website/docs/r/connect_routing_profile.html.markdown
index b620110f895..3b7a10dd5ff 100644
--- a/website/docs/r/connect_routing_profile.html.markdown
+++ b/website/docs/r/connect_routing_profile.html.markdown
@@ -40,7 +40,7 @@ resource "aws_connect_routing_profile" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `default_outbound_queue_id` - (Required) Specifies the default outbound queue for the Routing Profile.
 * `description` - (Required) Specifies the description of the Routing Profile.
@@ -63,9 +63,9 @@ A `queue_configs` block supports the following arguments:
 * `priority` - (Required) Specifies the order in which contacts are to be handled for the queue.
 * `queue_id` - (Required) Specifies the identifier for the queue.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The Amazon Resource Name (ARN) of the Routing Profile.
 * `id` - The identifier of the hosting Amazon Connect Instance and identifier of the Routing Profile separated by a colon (`:`).
@@ -80,8 +80,17 @@ A `queue_configs` block supports the following attributes in addition to the arg
 
 ## Import
 
-Amazon Connect Routing Profiles can be imported using the `instance_id` and `routing_profile_id` separated by a colon (`:`), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Amazon Connect Routing Profiles using the `instance_id` and `routing_profile_id` separated by a colon (`:`). For example:
 
+```terraform
+import {
+  to = aws_connect_routing_profile.example
+  id = "f1288a1f-6193-445a-b47e-af739b2:c1d4e5f6-1b3c-1b3c-1b3c-c1d4e5f6c1d4e5"
+}
 ```
-$ terraform import aws_connect_routing_profile.example f1288a1f-6193-445a-b47e-af739b2:c1d4e5f6-1b3c-1b3c-1b3c-c1d4e5f6c1d4e5
+
+Using `terraform import`, import Amazon Connect Routing Profiles using the `instance_id` and `routing_profile_id` separated by a colon (`:`). For example:
+
+```console
+% terraform import aws_connect_routing_profile.example f1288a1f-6193-445a-b47e-af739b2:c1d4e5f6-1b3c-1b3c-1b3c-c1d4e5f6c1d4e5
 ```
diff --git a/website/docs/r/connect_security_profile.html.markdown b/website/docs/r/connect_security_profile.html.markdown
index 4f4ee92f196..8b3d75c0bb2 100644
--- a/website/docs/r/connect_security_profile.html.markdown
+++ b/website/docs/r/connect_security_profile.html.markdown
@@ -32,7 +32,7 @@ resource "aws_connect_security_profile" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `description` - (Optional) Specifies the description of the Security Profile.
 * `instance_id` - (Required) Specifies the identifier of the hosting Amazon Connect Instance.
@@ -41,9 +41,9 @@ The following arguments are supported:
 * `tags` - (Optional) Tags to apply to the Security Profile. If configured with a provider
 [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The Amazon Resource Name (ARN) of the Security Profile.
 * `organization_resource_id` - The organization resource identifier for the security profile.
@@ -53,8 +53,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Amazon Connect Security Profiles can be imported using the `instance_id` and `security_profile_id` separated by a colon (`:`), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Amazon Connect Security Profiles using the `instance_id` and `security_profile_id` separated by a colon (`:`). For example:
 
+```terraform
+import {
+  to = aws_connect_security_profile.example
+  id = "f1288a1f-6193-445a-b47e-af739b2:c1d4e5f6-1b3c-1b3c-1b3c-c1d4e5f6c1d4e5"
+}
 ```
-$ terraform import aws_connect_security_profile.example f1288a1f-6193-445a-b47e-af739b2:c1d4e5f6-1b3c-1b3c-1b3c-c1d4e5f6c1d4e5
+
+Using `terraform import`, import Amazon Connect Security Profiles using the `instance_id` and `security_profile_id` separated by a colon (`:`). For example:
+
+```console
+% terraform import aws_connect_security_profile.example f1288a1f-6193-445a-b47e-af739b2:c1d4e5f6-1b3c-1b3c-1b3c-c1d4e5f6c1d4e5
 ```
diff --git a/website/docs/r/connect_user.html.markdown b/website/docs/r/connect_user.html.markdown
index 8e4dd5aca46..87f9b69bd6c 100644
--- a/website/docs/r/connect_user.html.markdown
+++ b/website/docs/r/connect_user.html.markdown
@@ -135,7 +135,7 @@ resource "aws_connect_user" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `directory_user_id` - (Optional) The identifier of the user account in the directory used for identity management. If Amazon Connect cannot access the directory, you can specify this identifier to authenticate users. If you include the identifier, we assume that Amazon Connect cannot access the directory. Otherwise, the identity information is used to authenticate users from your directory. This parameter is required if you are using an existing directory for identity management in Amazon Connect when Amazon Connect cannot access your directory to authenticate users. If you are using SAML for identity management and include this parameter, an error is returned.
 * `hierarchy_group_id` - (Optional) The identifier of the hierarchy group for the user.
@@ -162,9 +162,9 @@ A `phone_config` block supports the following arguments:
 * `desk_phone_number` - (Optional) The phone number for the user's desk phone. Required if `phone_type` is set as `DESK_PHONE`.
 * `phone_type` - (Required) The phone type. Valid values are `DESK_PHONE` and `SOFT_PHONE`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The Amazon Resource Name (ARN) of the user.
 * `id` - The identifier of the hosting Amazon Connect Instance and identifier of the user
@@ -174,8 +174,17 @@ separated by a colon (`:`).
 
 ## Import
 
-Amazon Connect Users can be imported using the `instance_id` and `user_id` separated by a colon (`:`), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Amazon Connect Users using the `instance_id` and `user_id` separated by a colon (`:`). For example:
 
+```terraform
+import {
+  to = aws_connect_user.example
+  id = "f1288a1f-6193-445a-b47e-af739b2:c1d4e5f6-1b3c-1b3c-1b3c-c1d4e5f6c1d4e5"
+}
 ```
-$ terraform import aws_connect_user.example f1288a1f-6193-445a-b47e-af739b2:c1d4e5f6-1b3c-1b3c-1b3c-c1d4e5f6c1d4e5
+
+Using `terraform import`, import Amazon Connect Users using the `instance_id` and `user_id` separated by a colon (`:`). For example:
+
+```console
+% terraform import aws_connect_user.example f1288a1f-6193-445a-b47e-af739b2:c1d4e5f6-1b3c-1b3c-1b3c-c1d4e5f6c1d4e5
 ```
diff --git a/website/docs/r/connect_user_hierarchy_group.html.markdown b/website/docs/r/connect_user_hierarchy_group.html.markdown
index 8735eaa6bc7..caa207c843a 100644
--- a/website/docs/r/connect_user_hierarchy_group.html.markdown
+++ b/website/docs/r/connect_user_hierarchy_group.html.markdown
@@ -53,7 +53,7 @@ resource "aws_connect_user_hierarchy_group" "child" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `instance_id` - (Required) Specifies the identifier of the hosting Amazon Connect Instance.
 * `name` - (Required) The name of the user hierarchy group. Must not be more than 100 characters.
@@ -61,9 +61,9 @@ The following arguments are supported:
 * `tags` - (Optional) Tags to apply to the hierarchy group. If configured with a provider
 [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The Amazon Resource Name (ARN) of the hierarchy group.
 * `hierarchy_group_id` - The identifier for the hierarchy group.
@@ -89,8 +89,17 @@ A level block supports the following attributes:
 
 ## Import
 
-Amazon Connect User Hierarchy Groups can be imported using the `instance_id` and `hierarchy_group_id` separated by a colon (`:`), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Amazon Connect User Hierarchy Groups using the `instance_id` and `hierarchy_group_id` separated by a colon (`:`). For example:
 
+```terraform
+import {
+  to = aws_connect_user_hierarchy_group.example
+  id = "f1288a1f-6193-445a-b47e-af739b2:c1d4e5f6-1b3c-1b3c-1b3c-c1d4e5f6c1d4e5"
+}
 ```
-$ terraform import aws_connect_user_hierarchy_group.example f1288a1f-6193-445a-b47e-af739b2:c1d4e5f6-1b3c-1b3c-1b3c-c1d4e5f6c1d4e5
+
+Using `terraform import`, import Amazon Connect User Hierarchy Groups using the `instance_id` and `hierarchy_group_id` separated by a colon (`:`). For example:
+
+```console
+% terraform import aws_connect_user_hierarchy_group.example f1288a1f-6193-445a-b47e-af739b2:c1d4e5f6-1b3c-1b3c-1b3c-c1d4e5f6c1d4e5
 ```
diff --git a/website/docs/r/connect_user_hierarchy_structure.html.markdown b/website/docs/r/connect_user_hierarchy_structure.html.markdown
index 3a33addd682..c1dc7e000ed 100644
--- a/website/docs/r/connect_user_hierarchy_structure.html.markdown
+++ b/website/docs/r/connect_user_hierarchy_structure.html.markdown
@@ -59,7 +59,7 @@ resource "aws_connect_user_hierarchy_structure" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `hierarchy_structure` - (Required) A block that defines the hierarchy structure's levels. The `hierarchy_structure` block is documented below.
 * `instance_id` - (Required) Specifies the identifier of the hosting Amazon Connect Instance.
@@ -76,9 +76,9 @@ Each level block supports the following arguments:
 
 * `name` - (Required) The name of the user hierarchy level. Must not be more than 50 characters.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `hierarchy_structure` - In addition to the arguments defined initially, there are attributes added to the levels created. These additional attributes are documented below.
 * `id` - The identifier of the hosting Amazon Connect Instance.
@@ -90,8 +90,17 @@ A level block supports the following additional attributes:
 
 ## Import
 
-Amazon Connect User Hierarchy Structures can be imported using the `instance_id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Amazon Connect User Hierarchy Structures using the `instance_id`. For example:
 
+```terraform
+import {
+  to = aws_connect_user_hierarchy_structure.example
+  id = "f1288a1f-6193-445a-b47e-af739b2"
+}
 ```
-$ terraform import aws_connect_user_hierarchy_structure.example f1288a1f-6193-445a-b47e-af739b2
+
+Using `terraform import`, import Amazon Connect User Hierarchy Structures using the `instance_id`. For example:
+
+```console
+% terraform import aws_connect_user_hierarchy_structure.example f1288a1f-6193-445a-b47e-af739b2
 ```
diff --git a/website/docs/r/connect_vocabulary.html.markdown b/website/docs/r/connect_vocabulary.html.markdown
index b7a5de71737..086a2139c91 100644
--- a/website/docs/r/connect_vocabulary.html.markdown
+++ b/website/docs/r/connect_vocabulary.html.markdown
@@ -27,7 +27,7 @@ resource "aws_connect_vocabulary" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `content` - (Required) The content of the custom vocabulary in plain-text format with a table of values. Each row in the table represents a word or a phrase, described with Phrase, IPA, SoundsLike, and DisplayAs fields. Separate the fields with TAB characters. For more information, see [Create a custom vocabulary using a table](https://docs.aws.amazon.com/transcribe/latest/dg/custom-vocabulary.html#create-vocabulary-table). Minimum length of `1`. Maximum length of `60000`.
 * `instance_id` - (Required) Specifies the identifier of the hosting Amazon Connect Instance.
@@ -43,9 +43,9 @@ The following arguments are supported:
 * `create` - (Default `5m`)
 * `delete` - (Default `100m`)
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The Amazon Resource Name (ARN) of the vocabulary.
 * `failure_reason` - The reason why the custom vocabulary was not created.
@@ -58,8 +58,17 @@ separated by a colon (`:`).
 
 ## Import
 
-Amazon Connect Vocabularies can be imported using the `instance_id` and `vocabulary_id` separated by a colon (`:`), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Amazon Connect Vocabularies using the `instance_id` and `vocabulary_id` separated by a colon (`:`). For example:
 
+```terraform
+import {
+  to = aws_connect_vocabulary.example
+  id = "f1288a1f-6193-445a-b47e-af739b2:c1d4e5f6-1b3c-1b3c-1b3c-c1d4e5f6c1d4e5"
+}
 ```
-$ terraform import aws_connect_vocabulary.example f1288a1f-6193-445a-b47e-af739b2:c1d4e5f6-1b3c-1b3c-1b3c-c1d4e5f6c1d4e5
+
+Using `terraform import`, import Amazon Connect Vocabularies using the `instance_id` and `vocabulary_id` separated by a colon (`:`). For example:
+
+```console
+% terraform import aws_connect_vocabulary.example f1288a1f-6193-445a-b47e-af739b2:c1d4e5f6-1b3c-1b3c-1b3c-c1d4e5f6c1d4e5
 ```
diff --git a/website/docs/r/controltower_control.html.markdown b/website/docs/r/controltower_control.html.markdown
index 63eaa43de11..fd851032a16 100644
--- a/website/docs/r/controltower_control.html.markdown
+++ b/website/docs/r/controltower_control.html.markdown
@@ -33,21 +33,30 @@ resource "aws_controltower_control" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `control_identifier` - (Required) The ARN of the control. Only Strongly recommended and Elective controls are permitted, with the exception of the Region deny guardrail.
 * `target_identifier` - (Required) The ARN of the organizational unit.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ARN of the organizational unit.
 
 ## Import
 
-Control Tower Controls can be imported using their `organizational_unit_arn/control_identifier`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Control Tower Controls using their `organizational_unit_arn/control_identifier`. For example:
 
+```terraform
+import {
+  to = aws_controltower_control.example
+  id = "arn:aws:organizations::123456789101:ou/o-qqaejywet/ou-qg5o-ufbhdtv3,arn:aws:controltower:us-east-1::control/WTDSMKDKDNLE"
+}
 ```
-$ terraform import aws_controltower_control.example arn:aws:organizations::123456789101:ou/o-qqaejywet/ou-qg5o-ufbhdtv3,arn:aws:controltower:us-east-1::control/WTDSMKDKDNLE
+
+Using `terraform import`, import Control Tower Controls using their `organizational_unit_arn/control_identifier`. For example:
+
+```console
+% terraform import aws_controltower_control.example arn:aws:organizations::123456789101:ou/o-qqaejywet/ou-qg5o-ufbhdtv3,arn:aws:controltower:us-east-1::control/WTDSMKDKDNLE
 ```
diff --git a/website/docs/r/cur_report_definition.html.markdown b/website/docs/r/cur_report_definition.html.markdown
index 66d4a13bab2..3499a69b548 100644
--- a/website/docs/r/cur_report_definition.html.markdown
+++ b/website/docs/r/cur_report_definition.html.markdown
@@ -20,7 +20,7 @@ resource "aws_cur_report_definition" "example_cur_report_definition" {
   time_unit                  = "HOURLY"
   format                     = "textORcsv"
   compression                = "GZIP"
-  additional_schema_elements = ["RESOURCES"]
+  additional_schema_elements = ["RESOURCES", "SPLIT_COST_ALLOCATION_DATA"]
   s3_bucket                  = "example-bucket-name"
   s3_region                  = "us-east-1"
   additional_artifacts       = ["REDSHIFT", "QUICKSIGHT"]
@@ -29,13 +29,13 @@ resource "aws_cur_report_definition" "example_cur_report_definition" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `report_name` - (Required) Unique name for the report. Must start with a number/letter and is case sensitive. Limited to 256 characters.
 * `time_unit` - (Required) The frequency on which report data are measured and displayed.  Valid values are: `DAILY`, `HOURLY`, `MONTHLY`.
 * `format` - (Required) Format for report. Valid values are: `textORcsv`, `Parquet`. If `Parquet` is used, then Compression must also be `Parquet`.
 * `compression` - (Required) Compression format for report. Valid values are: `GZIP`, `ZIP`, `Parquet`. If `Parquet` is used, then format must also be `Parquet`.
-* `additional_schema_elements` - (Required) A list of schema elements. Valid values are: `RESOURCES`.
+* `additional_schema_elements` - (Required) A list of schema elements. Valid values are: `RESOURCES`, `SPLIT_COST_ALLOCATION_DATA`.
 * `s3_bucket` - (Required) Name of the existing S3 bucket to hold generated reports.
 * `s3_prefix` - (Optional) Report path prefix. Limited to 256 characters.
 * `s3_region` - (Required) Region of the existing S3 bucket to hold generated reports.
@@ -43,16 +43,25 @@ The following arguments are supported:
 * `refresh_closed_reports` - (Optional) Set to true to update your reports after they have been finalized if AWS detects charges related to previous months.
 * `report_versioning` - (Optional) Overwrite the previous version of each report or to deliver the report in addition to the previous versions. Valid values are: `CREATE_NEW_REPORT` and `OVERWRITE_REPORT`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The Amazon Resource Name (ARN) specifying the cur report.
 
 ## Import
 
-Report Definitions can be imported using the `report_name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Report Definitions using the `report_name`. For example:
 
+```terraform
+import {
+  to = aws_cur_report_definition.example_cur_report_definition
+  id = "example-cur-report-definition"
+}
 ```
-$ terraform import aws_cur_report_definition.example_cur_report_definition example-cur-report-definition
+
+Using `terraform import`, import Report Definitions using the `report_name`. For example:
+
+```console
+% terraform import aws_cur_report_definition.example_cur_report_definition example-cur-report-definition
 ```
diff --git a/website/docs/r/customer_gateway.html.markdown b/website/docs/r/customer_gateway.html.markdown
index 56c9ab734bc..7ea2aa15d96 100644
--- a/website/docs/r/customer_gateway.html.markdown
+++ b/website/docs/r/customer_gateway.html.markdown
@@ -28,7 +28,7 @@ resource "aws_customer_gateway" "main" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `bgp_asn` - (Required) The gateway's Border Gateway Protocol (BGP) Autonomous System Number (ASN).
 * `certificate_arn` - (Optional) The Amazon Resource Name (ARN) for the customer gateway certificate.
@@ -38,9 +38,9 @@ The following arguments are supported:
   supports at this time is "ipsec.1".
 * `tags` - (Optional) Tags to apply to the gateway. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The amazon-assigned ID of the gateway.
 * `arn` - The ARN of the customer gateway.
@@ -48,8 +48,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Customer Gateways can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Customer Gateways using the `id`. For example:
 
+```terraform
+import {
+  to = aws_customer_gateway.main
+  id = "cgw-b4dc3961"
+}
 ```
-$ terraform import aws_customer_gateway.main cgw-b4dc3961
+
+Using `terraform import`, import Customer Gateways using the `id`. For example:
+
+```console
+% terraform import aws_customer_gateway.main cgw-b4dc3961
 ```
diff --git a/website/docs/r/dataexchange_data_set.html.markdown b/website/docs/r/dataexchange_data_set.html.markdown
index 1f23d9f4ee0..849be4add61 100644
--- a/website/docs/r/dataexchange_data_set.html.markdown
+++ b/website/docs/r/dataexchange_data_set.html.markdown
@@ -27,9 +27,9 @@ resource "aws_dataexchange_data_set" "example" {
 * `name` - (Required) The name of the data set.
 * `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The Id of the data set.
 * `arn` - The Amazon Resource Name of this data set.
@@ -37,8 +37,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-DataExchange DataSets can be imported by their arn:
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DataExchange DataSets using their ARN. For example:
 
+```terraform
+import {
+  to = aws_dataexchange_data_set.example
+  id = "arn:aws:dataexchange:us-west-2:123456789012:data-sets/4fa784c7-ccb4-4dbf-ba4f-02198320daa1"
+}
 ```
-$ terraform import aws_dataexchange_data_set.example arn:aws:dataexchange:us-west-2:123456789012:data-sets/4fa784c7-ccb4-4dbf-ba4f-02198320daa1
+
+Using `terraform import`, import DataExchange DataSets using their ARN. For example:
+
+```console
+% terraform import aws_dataexchange_data_set.example arn:aws:dataexchange:us-west-2:123456789012:data-sets/4fa784c7-ccb4-4dbf-ba4f-02198320daa1
 ```
diff --git a/website/docs/r/dataexchange_revision.html.markdown b/website/docs/r/dataexchange_revision.html.markdown
index 82c6a1e4578..7f3028acada 100644
--- a/website/docs/r/dataexchange_revision.html.markdown
+++ b/website/docs/r/dataexchange_revision.html.markdown
@@ -24,9 +24,9 @@ resource "aws_dataexchange_revision" "example" {
 * `comment` - (Required) An optional comment about the revision.
 * `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The Id of the data set.
 * `revision_id` - The Id of the revision.
@@ -35,8 +35,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-DataExchange Revisions can be imported by their `data-set-id:revision-id`:
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DataExchange Revisions using their `data-set-id:revision-id`. For example:
 
+```terraform
+import {
+  to = aws_dataexchange_revision.example
+  id = "4fa784c7-ccb4-4dbf-ba4f-02198320daa1:4fa784c7-ccb4-4dbf-ba4f-02198320daa1"
+}
 ```
-$ terraform import aws_dataexchange_revision.example 4fa784c7-ccb4-4dbf-ba4f-02198320daa1:4fa784c7-ccb4-4dbf-ba4f-02198320daa1
+
+Using `terraform import`, import DataExchange Revisions using their `data-set-id:revision-id`. For example:
+
+```console
+% terraform import aws_dataexchange_revision.example 4fa784c7-ccb4-4dbf-ba4f-02198320daa1:4fa784c7-ccb4-4dbf-ba4f-02198320daa1
 ```
diff --git a/website/docs/r/datapipeline_pipeline.html.markdown b/website/docs/r/datapipeline_pipeline.html.markdown
index 0590e2c654c..fdaeec499f0 100644
--- a/website/docs/r/datapipeline_pipeline.html.markdown
+++ b/website/docs/r/datapipeline_pipeline.html.markdown
@@ -20,23 +20,32 @@ resource "aws_datapipeline_pipeline" "default" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The name of Pipeline.
 * `description` - (Optional) The description of Pipeline.
 * `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The identifier of the client certificate.
 * `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
 
 ## Import
 
-`aws_datapipeline_pipeline` can be imported by using the id (Pipeline ID), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_datapipeline_pipeline` using the id (Pipeline ID). For example:
 
+```terraform
+import {
+  to = aws_datapipeline_pipeline.default
+  id = "df-1234567890"
+}
 ```
-$ terraform import aws_datapipeline_pipeline.default df-1234567890
+
+Using `terraform import`, import `aws_datapipeline_pipeline` using the id (Pipeline ID). For example:
+
+```console
+% terraform import aws_datapipeline_pipeline.default df-1234567890
 ```
diff --git a/website/docs/r/datapipeline_pipeline_definition.html.markdown b/website/docs/r/datapipeline_pipeline_definition.html.markdown
index d27e0b581df..0bebbaf0d6a 100644
--- a/website/docs/r/datapipeline_pipeline_definition.html.markdown
+++ b/website/docs/r/datapipeline_pipeline_definition.html.markdown
@@ -109,16 +109,25 @@ The following arguments are optional:
 * `id` - (Required) ID of the parameter value.
 * `string_value` - (Required) Field value, expressed as a String.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Unique ID of the datapipeline definition.
 
 ## Import
 
-`aws_datapipeline_pipeline_definition` can be imported using the id, e.g.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_datapipeline_pipeline_definition` using the id. For example:
 
+```terraform
+import {
+  to = aws_datapipeline_pipeline_definition.example
+  id = "df-1234567890"
+}
 ```
-$ terraform import aws_datapipeline_pipeline_definition.example df-1234567890
+
+Using `terraform import`, import `aws_datapipeline_pipeline_definition` using the id. For example:
+
+```console
+% terraform import aws_datapipeline_pipeline_definition.example df-1234567890
 ```
diff --git a/website/docs/r/datasync_agent.html.markdown b/website/docs/r/datasync_agent.html.markdown
index 9d9990e69f4..3966b344fa0 100644
--- a/website/docs/r/datasync_agent.html.markdown
+++ b/website/docs/r/datasync_agent.html.markdown
@@ -50,7 +50,7 @@ data "aws_network_interface" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) Name of the DataSync Agent.
 * `activation_key` - (Optional) DataSync Agent activation key during resource creation. Conflicts with `ip_address`. If an `ip_address` is provided instead, Terraform will retrieve the `activation_key` as part of the resource creation.
@@ -61,9 +61,9 @@ The following arguments are supported:
 * `tags` - (Optional) Key-value pairs of resource tags to assign to the DataSync Agent. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 * `vpc_endpoint_id` - (Optional) The ID of the VPC (virtual private cloud) endpoint that the agent has access to.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Amazon Resource Name (ARN) of the DataSync Agent.
 * `arn` - Amazon Resource Name (ARN) of the DataSync Agent.
@@ -77,8 +77,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_datasync_agent` can be imported by using the DataSync Agent Amazon Resource Name (ARN), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_datasync_agent` using the DataSync Agent Amazon Resource Name (ARN). For example:
 
+```terraform
+import {
+  to = aws_datasync_agent.example
+  id = "arn:aws:datasync:us-east-1:123456789012:agent/agent-12345678901234567"
+}
 ```
-$ terraform import aws_datasync_agent.example arn:aws:datasync:us-east-1:123456789012:agent/agent-12345678901234567
+
+Using `terraform import`, import `aws_datasync_agent` using the DataSync Agent Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_datasync_agent.example arn:aws:datasync:us-east-1:123456789012:agent/agent-12345678901234567
 ```
diff --git a/website/docs/r/datasync_location_azure_blob.html.markdown b/website/docs/r/datasync_location_azure_blob.html.markdown
new file mode 100644
index 00000000000..4960595020c
--- /dev/null
+++ b/website/docs/r/datasync_location_azure_blob.html.markdown
@@ -0,0 +1,68 @@
+---
+subcategory: "DataSync"
+layout: "aws"
+page_title: "AWS: aws_datasync_location_azure_blob"
+description: |-
+  Manages an AWS DataSync Microsoft Azure Blob Storage Location
+---
+
+# Resource: aws_datasync_location_azure_blob
+
+Manages a Microsoft Azure Blob Storage Location within AWS DataSync.
+
+~> **NOTE:** The DataSync Agents must be available before creating this resource.
+
+## Example Usage
+
+```terraform
+resource "aws_datasync_location_azure_blob" "example" {
+  agent_arns          = [aws_datasync_agent.example.arn]
+  authentication_type = "SAS"
+  container_url       = "https://example.com/path"
+
+  sas_configuration {
+    token = "sp=r&st=2023-12-20T14:54:52Z&se=2023-12-20T22:54:52Z&spr=https&sv=2021-06-08&sr=c&sig=aBBKDWQvyuVcTPH9EBp%2FXTI9E%2F%2Fmq171%2BZU178wcwqU%3D"
+  }
+}
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `access_tier` - (Optional) The access tier that you want your objects or files transferred into. Valid values: `HOT`, `COOL` and `ARCHIVE`. Default: `HOT`.
+* `agent_arns` - (Required) A list of DataSync Agent ARNs with which this location will be associated.
+* `authentication_type` - (Required) The authentication method DataSync uses to access your Azure Blob Storage. Valid values: `SAS`.
+* `blob_type` - (Optional) The type of blob that you want your objects or files to be when transferring them into Azure Blob Storage. Valid values: `BLOB`. Default: `BLOB`.
+* `container_url` - (Required) The URL of the Azure Blob Storage container involved in your transfer.
+* `sas_configuration` - (Optional) The SAS configuration that allows DataSync to access your Azure Blob Storage. See configuration below.
+* `subdirectory` - (Optional) Path segments if you want to limit your transfer to a virtual directory in the container.
+* `tags` - (Optional) Key-value pairs of resource tags to assign to the DataSync Location. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### sas_configuration Argument Reference
+
+* `token` - (Required) A SAS token that provides permissions to access your Azure Blob Storage.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the DataSync Location.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_datasync_location_azure_blob` using the Amazon Resource Name (ARN). For example:
+
+```terraform
+import {
+  to = aws_datasync_location_azure_blob.example
+  id = "arn:aws:datasync:us-east-1:123456789012:location/loc-12345678901234567"
+}
+```
+
+Using `terraform import`, import `aws_datasync_location_azure_blob` using the Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_datasync_location_azure_blob.example arn:aws:datasync:us-east-1:123456789012:location/loc-12345678901234567
+```
diff --git a/website/docs/r/datasync_location_efs.html.markdown b/website/docs/r/datasync_location_efs.html.markdown
index b0cac3805f4..b06f8d05ff8 100644
--- a/website/docs/r/datasync_location_efs.html.markdown
+++ b/website/docs/r/datasync_location_efs.html.markdown
@@ -29,7 +29,7 @@ resource "aws_datasync_location_efs" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `access_point_arn` - (Optional) Specifies the Amazon Resource Name (ARN) of the access point that DataSync uses to access the Amazon EFS file system.
 * `ec2_config` - (Required) Configuration block containing EC2 configurations for connecting to the EFS File System.
@@ -41,14 +41,14 @@ The following arguments are supported:
 
 ### ec2_config Argument Reference
 
-The following arguments are supported inside the `ec2_config` configuration block:
+The `ec2_config` configuration block supports the following arguments:
 
 * `security_group_arns` - (Required) List of Amazon Resource Names (ARNs) of the EC2 Security Groups that are associated with the EFS Mount Target.
 * `subnet_arn` - (Required) Amazon Resource Name (ARN) of the EC2 Subnet that is associated with the EFS Mount Target.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Amazon Resource Name (ARN) of the DataSync Location.
 * `arn` - Amazon Resource Name (ARN) of the DataSync Location.
@@ -56,8 +56,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_datasync_location_efs` can be imported by using the DataSync Task Amazon Resource Name (ARN), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_datasync_location_efs` using the DataSync Task Amazon Resource Name (ARN). For example:
 
+```terraform
+import {
+  to = aws_datasync_location_efs.example
+  id = "arn:aws:datasync:us-east-1:123456789012:location/loc-12345678901234567"
+}
 ```
-$ terraform import aws_datasync_location_efs.example arn:aws:datasync:us-east-1:123456789012:location/loc-12345678901234567
+
+Using `terraform import`, import `aws_datasync_location_efs` using the DataSync Task Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_datasync_location_efs.example arn:aws:datasync:us-east-1:123456789012:location/loc-12345678901234567
 ```
diff --git a/website/docs/r/datasync_location_fsx_lustre_file_system.html.markdown b/website/docs/r/datasync_location_fsx_lustre_file_system.html.markdown
index dec4ae7706b..1a223c5430c 100644
--- a/website/docs/r/datasync_location_fsx_lustre_file_system.html.markdown
+++ b/website/docs/r/datasync_location_fsx_lustre_file_system.html.markdown
@@ -21,16 +21,16 @@ resource "aws_datasync_location_fsx_lustre_file_system" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `fsx_filesystem_arn` - (Required) The Amazon Resource Name (ARN) for the FSx for Lustre file system.
 * `security_group_arns` - (Optional) The Amazon Resource Names (ARNs) of the security groups that are to use to configure the FSx for Lustre file system.
 * `subdirectory` - (Optional) Subdirectory to perform actions as source or destination.
 * `tags` - (Optional) Key-value pairs of resource tags to assign to the DataSync Location. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Amazon Resource Name (ARN) of the DataSync Location.
 * `arn` - Amazon Resource Name (ARN) of the DataSync Location.
@@ -40,8 +40,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_datasync_location_fsx_lustre_file_system` can be imported by using the `DataSync-ARN#FSx-Lustre-ARN`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_datasync_location_fsx_lustre_file_system` using the `DataSync-ARN#FSx-Lustre-ARN`. For example:
 
+```terraform
+import {
+  to = aws_datasync_location_fsx_lustre_file_system.example
+  id = "arn:aws:datasync:us-west-2:123456789012:location/loc-12345678901234567#arn:aws:fsx:us-west-2:476956259333:file-system/fs-08e04cd442c1bb94a"
+}
 ```
-$ terraform import aws_datasync_location_fsx_lustre_file_system.example arn:aws:datasync:us-west-2:123456789012:location/loc-12345678901234567#arn:aws:fsx:us-west-2:476956259333:file-system/fs-08e04cd442c1bb94a
+
+Using `terraform import`, import `aws_datasync_location_fsx_lustre_file_system` using the `DataSync-ARN#FSx-Lustre-ARN`. For example:
+
+```console
+% terraform import aws_datasync_location_fsx_lustre_file_system.example arn:aws:datasync:us-west-2:123456789012:location/loc-12345678901234567#arn:aws:fsx:us-west-2:476956259333:file-system/fs-08e04cd442c1bb94a
 ```
diff --git a/website/docs/r/datasync_location_fsx_ontap_file_system.html.markdown b/website/docs/r/datasync_location_fsx_ontap_file_system.html.markdown
new file mode 100644
index 00000000000..5b4c796f54a
--- /dev/null
+++ b/website/docs/r/datasync_location_fsx_ontap_file_system.html.markdown
@@ -0,0 +1,95 @@
+---
+subcategory: "DataSync"
+layout: "aws"
+page_title: "AWS: aws_datasync_location_fsx_ontap_file_system"
+description: |-
+  Terraform resource for managing an AWS DataSync Location FSx Ontap File System.
+---
+
+# Resource: aws_datasync_location_fsx_ontap_file_system
+
+Terraform resource for managing an AWS DataSync Location FSx Ontap File System.
+
+## Example Usage
+
+### Basic Usage
+
+```terraform
+resource "aws_datasync_location_fsx_ontap_file_system" "test" {
+  fsx_filesystem_arn          = aws_fsx_ontap_file_system.test.arn
+  security_group_arns         = [aws_security_group.test.arn]
+  storage_virtual_machine_arn = aws_fsx_ontap_storage_virtual_machine.test.arn
+
+  protocol {
+    nfs {
+      mount_options {
+        version = "NFS3"
+      }
+    }
+  }
+}
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `protocol` - (Required) The data transfer protocol that DataSync uses to access your Amazon FSx file system. See [Protocol](#protocol) below.
+* `security_group_arns` - (Required) The security groups that provide access to your file system's preferred subnet. The security groups must allow outbbound traffic on the following ports (depending on the protocol you use):
+    * Network File System (NFS): TCP ports 111, 635, and 2049
+    * Server Message Block (SMB): TCP port 445
+* `storage_virtual_machine_arn` - (Required) The ARN of the SVM in your file system where you want to copy data to of from.
+
+The following arguments are optional:
+
+* `subdirectory` - (Optional) Path to the file share in the SVM where you'll copy your data. You can specify a junction path (also known as a mount point), qtree path (for NFS file shares), or share name (for SMB file shares) (e.g. `/vol1`, `/vol1/tree1`, `share1`).
+* `tags` - (Optional) Key-value pairs of resource tags to assign to the DataSync Location. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Protocol
+
+* `nfs` - Network File System (NFS) protocol that DataSync uses to access your FSx ONTAP file system. See [NFS](#nfs) below.
+* `smb` - Server Message Block (SMB) protocol that DataSync uses to access your FSx ONTAP file system. See [SMB] (#smb) below.
+
+### NFS
+
+* `mount_options` - (Required) Mount options that are available for DataSync to access an NFS location. See [NFS Mount Options](#nfs-mount-options) below.
+
+### NFS Mount Options
+
+* `version` - (Optional) The specific NFS version that you want DataSync to use for mounting your NFS share. Valid values: `NFS3`. Default: `NFS3`
+
+### SMB
+
+* `domain` - Fully qualified domain name of the Microsoft Active Directory (AD) that your storage virtual machine belongs to.
+* `mount_options` - Mount options that are available for DataSync to access an SMB location. See [SMB Mount Options](#smb-mount-options) below.
+* `password` - Password of a user who has permission to access your SVM.
+* `user` - Username that can mount the location and access the files, folders, and metadata that you need in the SVM.
+
+### SMB Mount Options
+
+* `version` - (Optional) SMB version that you want DataSync to use for mounting your SMB share. Valid values: `AUTOMATIC`, `SMB3`, `SMB2` `SMB2_0`. Default: `AUTOMATIC`
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the DataSync Location for the FSx Ontap File System.
+* `fsx_filesystem_arn` - ARN of the FSx Ontap File System.
+* `uri` - URI of the FSx ONTAP file system location
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_datasync_location_fsx_ontap_file_system` using the `DataSync-ARN#FSx-ontap-svm-ARN`. For example:
+
+```terraform
+import {
+  to = aws_datasync_location_fsx_ontap_file_system.example
+  id = "arn:aws:datasync:us-west-2:123456789012:location/loc-12345678901234567#arn:aws:fsx:us-west-2:123456789012:storage-virtual-machine/svm-12345678abcdef123"
+}
+```
+
+Using `terraform import`, import `aws_datasync_location_fsx_ontap_file_system` using the `DataSync-ARN#FSx-ontap-svm-ARN`. For example:
+
+```console
+% terraform import aws_datasync_location_fsx_ontap_file_system.example arn:aws:datasync:us-west-2:123456789012:location/loc-12345678901234567#arn:aws:fsx:us-west-2:123456789012:storage-virtual-machine/svm-12345678abcdef123
+```
diff --git a/website/docs/r/datasync_location_fsx_openzfs_file_system.html.markdown b/website/docs/r/datasync_location_fsx_openzfs_file_system.html.markdown
index 40fbf7342d3..9cf7f1a37b3 100644
--- a/website/docs/r/datasync_location_fsx_openzfs_file_system.html.markdown
+++ b/website/docs/r/datasync_location_fsx_openzfs_file_system.html.markdown
@@ -29,7 +29,7 @@ resource "aws_datasync_location_fsx_openzfs_file_system" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `fsx_filesystem_arn` - (Required) The Amazon Resource Name (ARN) for the FSx for OpenZfs file system.
 * `protocol` - (Required) The type of protocol that DataSync uses to access your file system. See below.
@@ -49,9 +49,9 @@ The following arguments are supported:
 
 * `version` - (Optional) The specific NFS version that you want DataSync to use for mounting your NFS share. Valid values: `AUTOMATIC`, `NFS3`, `NFS4_0` and `NFS4_1`. Default: `AUTOMATIC`
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Amazon Resource Name (ARN) of the DataSync Location.
 * `arn` - Amazon Resource Name (ARN) of the DataSync Location.
@@ -61,8 +61,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_datasync_location_fsx_openzfs_file_system` can be imported by using the `DataSync-ARN#FSx-openzfs-ARN`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_datasync_location_fsx_openzfs_file_system` using the `DataSync-ARN#FSx-openzfs-ARN`. For example:
 
+```terraform
+import {
+  to = aws_datasync_location_fsx_openzfs_file_system.example
+  id = "arn:aws:datasync:us-west-2:123456789012:location/loc-12345678901234567#arn:aws:fsx:us-west-2:123456789012:file-system/fs-08e04cd442c1bb94a"
+}
 ```
-$ terraform import aws_datasync_location_fsx_openzfs_file_system.example arn:aws:datasync:us-west-2:123456789012:location/loc-12345678901234567#arn:aws:fsx:us-west-2:123456789012:file-system/fs-08e04cd442c1bb94a
+
+Using `terraform import`, import `aws_datasync_location_fsx_openzfs_file_system` using the `DataSync-ARN#FSx-openzfs-ARN`. For example:
+
+```console
+% terraform import aws_datasync_location_fsx_openzfs_file_system.example arn:aws:datasync:us-west-2:123456789012:location/loc-12345678901234567#arn:aws:fsx:us-west-2:123456789012:file-system/fs-08e04cd442c1bb94a
 ```
diff --git a/website/docs/r/datasync_location_fsx_windows_file_system.html.markdown b/website/docs/r/datasync_location_fsx_windows_file_system.html.markdown
index 46037abc736..c145fb8000d 100644
--- a/website/docs/r/datasync_location_fsx_windows_file_system.html.markdown
+++ b/website/docs/r/datasync_location_fsx_windows_file_system.html.markdown
@@ -23,7 +23,7 @@ resource "aws_datasync_location_fsx_windows_file_system" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `fsx_filesystem_arn` - (Required) The Amazon Resource Name (ARN) for the FSx for Windows file system.
 * `password` - (Required) The password of the user who has the permissions to access files and folders in the FSx for Windows file system.
@@ -33,9 +33,9 @@ The following arguments are supported:
 * `subdirectory` - (Optional) Subdirectory to perform actions as source or destination.
 * `tags` - (Optional) Key-value pairs of resource tags to assign to the DataSync Location. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Amazon Resource Name (ARN) of the DataSync Location.
 * `arn` - Amazon Resource Name (ARN) of the DataSync Location.
@@ -45,8 +45,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_datasync_location_fsx_windows_file_system` can be imported by using the `DataSync-ARN#FSx-Windows-ARN`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_datasync_location_fsx_windows_file_system` using the `DataSync-ARN#FSx-Windows-ARN`. For example:
 
+```terraform
+import {
+  to = aws_datasync_location_fsx_windows_file_system.example
+  id = "arn:aws:datasync:us-west-2:123456789012:location/loc-12345678901234567#arn:aws:fsx:us-west-2:476956259333:file-system/fs-08e04cd442c1bb94a"
+}
 ```
-$ terraform import aws_datasync_location_fsx_windows_file_system.example arn:aws:datasync:us-west-2:123456789012:location/loc-12345678901234567#arn:aws:fsx:us-west-2:476956259333:file-system/fs-08e04cd442c1bb94a
+
+Using `terraform import`, import `aws_datasync_location_fsx_windows_file_system` using the `DataSync-ARN#FSx-Windows-ARN`. For example:
+
+```console
+% terraform import aws_datasync_location_fsx_windows_file_system.example arn:aws:datasync:us-west-2:123456789012:location/loc-12345678901234567#arn:aws:fsx:us-west-2:476956259333:file-system/fs-08e04cd442c1bb94a
 ```
diff --git a/website/docs/r/datasync_location_hdfs.html.markdown b/website/docs/r/datasync_location_hdfs.html.markdown
index e6ff327045a..78ee108fca3 100644
--- a/website/docs/r/datasync_location_hdfs.html.markdown
+++ b/website/docs/r/datasync_location_hdfs.html.markdown
@@ -29,7 +29,7 @@ resource "aws_datasync_location_hdfs" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `agent_arns` - (Required) A list of DataSync Agent ARNs with which this location will be associated.
 * `authentication_type` - (Required) The type of authentication used to determine the identity of the user. Valid values are `SIMPLE` and `KERBEROS`.
@@ -55,17 +55,26 @@ The following arguments are supported:
 * `data_transfer_protection` - (Optional) The data transfer protection setting configured on the HDFS cluster. This setting corresponds to your dfs.data.transfer.protection setting in the hdfs-site.xml file on your Hadoop cluster. Valid values are `DISABLED`, `AUTHENTICATION`, `INTEGRITY` and `PRIVACY`.
 * `rpc_protection` - (Optional)The RPC protection setting configured on the HDFS cluster. This setting corresponds to your hadoop.rpc.protection setting in your core-site.xml file on your Hadoop cluster. Valid values are `DISABLED`, `AUTHENTICATION`, `INTEGRITY` and `PRIVACY`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name (ARN) of the DataSync Location.
 * `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
 
 ## Import
 
-`aws_datasync_location_hdfs` can be imported by using the Amazon Resource Name (ARN), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_datasync_location_hdfs` using the Amazon Resource Name (ARN). For example:
 
+```terraform
+import {
+  to = aws_datasync_location_hdfs.example
+  id = "arn:aws:datasync:us-east-1:123456789012:location/loc-12345678901234567"
+}
 ```
-$ terraform import aws_datasync_location_hdfs.example arn:aws:datasync:us-east-1:123456789012:location/loc-12345678901234567
+
+Using `terraform import`, import `aws_datasync_location_hdfs` using the Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_datasync_location_hdfs.example arn:aws:datasync:us-east-1:123456789012:location/loc-12345678901234567
 ```
diff --git a/website/docs/r/datasync_location_nfs.html.markdown b/website/docs/r/datasync_location_nfs.html.markdown
index 4d76e62c7fd..e9efdbd15ad 100644
--- a/website/docs/r/datasync_location_nfs.html.markdown
+++ b/website/docs/r/datasync_location_nfs.html.markdown
@@ -27,7 +27,7 @@ resource "aws_datasync_location_nfs" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `mount_options` - (Optional) Configuration block containing mount options used by DataSync to access the NFS Server.
 * `on_prem_config` - (Required) Configuration block containing information for connecting to the NFS File System.
@@ -37,19 +37,19 @@ The following arguments are supported:
 
 ### mount_options Argument Reference
 
-The following arguments are supported inside the `mount_options` configuration block:
+The `mount_options` configuration block supports the following arguments:
 
 * `version` - (Optional) The specific NFS version that you want DataSync to use for mounting your NFS share. Valid values: `AUTOMATIC`, `NFS3`, `NFS4_0` and `NFS4_1`. Default: `AUTOMATIC`
 
 ### on_prem_config Argument Reference
 
-The following arguments are supported inside the `on_prem_config` configuration block:
+The `on_prem_config` configuration block supports the following arguments:
 
 * `agent_arns` - (Required) List of Amazon Resource Names (ARNs) of the DataSync Agents used to connect to the NFS server.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Amazon Resource Name (ARN) of the DataSync Location.
 * `arn` - Amazon Resource Name (ARN) of the DataSync Location.
@@ -57,8 +57,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_datasync_location_nfs` can be imported by using the DataSync Task Amazon Resource Name (ARN), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_datasync_location_nfs` using the DataSync Task Amazon Resource Name (ARN). For example:
 
+```terraform
+import {
+  to = aws_datasync_location_nfs.example
+  id = "arn:aws:datasync:us-east-1:123456789012:location/loc-12345678901234567"
+}
 ```
-$ terraform import aws_datasync_location_nfs.example arn:aws:datasync:us-east-1:123456789012:location/loc-12345678901234567
+
+Using `terraform import`, import `aws_datasync_location_nfs` using the DataSync Task Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_datasync_location_nfs.example arn:aws:datasync:us-east-1:123456789012:location/loc-12345678901234567
 ```
diff --git a/website/docs/r/datasync_location_object_storage.html.markdown b/website/docs/r/datasync_location_object_storage.html.markdown
index 87a32961fea..8560013be03 100644
--- a/website/docs/r/datasync_location_object_storage.html.markdown
+++ b/website/docs/r/datasync_location_object_storage.html.markdown
@@ -24,7 +24,7 @@ resource "aws_datasync_location_object_storage" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `agent_arns` - (Required) A list of DataSync Agent ARNs with which this location will be associated.
 * `access_key` - (Optional) The access key is used if credentials are required to access the self-managed object storage server. If your object storage requires a user name and password to authenticate, use `access_key` and `secret_key` to provide the user name and password, respectively.
@@ -37,9 +37,9 @@ The following arguments are supported:
 * `subdirectory` - (Optional) A subdirectory in the HDFS cluster. This subdirectory is used to read data from or write data to the HDFS cluster. If the subdirectory isn't specified, it will default to /.
 * `tags` - (Optional) Key-value pairs of resource tags to assign to the DataSync Location. If configured with a provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name (ARN) of the DataSync Location.
 * `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block).
@@ -47,8 +47,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_datasync_location_object_storage` can be imported by using the Amazon Resource Name (ARN), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_datasync_location_object_storage` using the Amazon Resource Name (ARN). For example:
 
+```terraform
+import {
+  to = aws_datasync_location_object_storage.example
+  id = "arn:aws:datasync:us-east-1:123456789012:location/loc-12345678901234567"
+}
 ```
-$ terraform import aws_datasync_location_object_storage.example arn:aws:datasync:us-east-1:123456789012:location/loc-12345678901234567
+
+Using `terraform import`, import `aws_datasync_location_object_storage` using the Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_datasync_location_object_storage.example arn:aws:datasync:us-east-1:123456789012:location/loc-12345678901234567
 ```
diff --git a/website/docs/r/datasync_location_s3.html.markdown b/website/docs/r/datasync_location_s3.html.markdown
index b473e7db9c9..3ae4e94aa52 100644
--- a/website/docs/r/datasync_location_s3.html.markdown
+++ b/website/docs/r/datasync_location_s3.html.markdown
@@ -25,7 +25,7 @@ resource "aws_datasync_location_s3" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `agent_arns` - (Optional) A list of DataSync Agent ARNs with which this location will be associated.
 * `s3_bucket_arn` - (Required) Amazon Resource Name (ARN) of the S3 Bucket.
@@ -36,13 +36,13 @@ The following arguments are supported:
 
 ### s3_config Argument Reference
 
-The following arguments are supported inside the `s3_config` configuration block:
+The `s3_config` configuration block supports the following arguments:
 
 * `bucket_access_role_arn` - (Required) ARN of the IAM Role used to connect to the S3 Bucket.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Amazon Resource Name (ARN) of the DataSync Location.
 * `arn` - Amazon Resource Name (ARN) of the DataSync Location.
@@ -50,8 +50,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_datasync_location_s3` can be imported by using the DataSync Task Amazon Resource Name (ARN), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_datasync_location_s3` using the DataSync Task Amazon Resource Name (ARN). For example:
 
+```terraform
+import {
+  to = aws_datasync_location_s3.example
+  id = "arn:aws:datasync:us-east-1:123456789012:location/loc-12345678901234567"
+}
 ```
-$ terraform import aws_datasync_location_s3.example arn:aws:datasync:us-east-1:123456789012:location/loc-12345678901234567
+
+Using `terraform import`, import `aws_datasync_location_s3` using the DataSync Task Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_datasync_location_s3.example arn:aws:datasync:us-east-1:123456789012:location/loc-12345678901234567
 ```
diff --git a/website/docs/r/datasync_location_smb.html.markdown b/website/docs/r/datasync_location_smb.html.markdown
index b2e022fe0d7..22d0fdc0aef 100644
--- a/website/docs/r/datasync_location_smb.html.markdown
+++ b/website/docs/r/datasync_location_smb.html.markdown
@@ -28,7 +28,7 @@ resource "aws_datasync_location_smb" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `agent_arns` - (Required) A list of DataSync Agent ARNs with which this location will be associated.
 * `domain` - (Optional) The name of the Windows domain the SMB server belongs to.
@@ -41,21 +41,30 @@ The following arguments are supported:
 
 ### mount_options Argument Reference
 
-The following arguments are supported inside the `mount_options` configuration block:
+The `mount_options` configuration block supports the following arguments:
 
 * `version` - (Optional) The specific SMB version that you want DataSync to use for mounting your SMB share. Valid values: `AUTOMATIC`, `SMB2`, and `SMB3`. Default: `AUTOMATIC`
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name (ARN) of the DataSync Location.
 * `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
 
 ## Import
 
-`aws_datasync_location_smb` can be imported by using the Amazon Resource Name (ARN), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_datasync_location_smb` using the Amazon Resource Name (ARN). For example:
 
+```terraform
+import {
+  to = aws_datasync_location_smb.example
+  id = "arn:aws:datasync:us-east-1:123456789012:location/loc-12345678901234567"
+}
 ```
-$ terraform import aws_datasync_location_smb.example arn:aws:datasync:us-east-1:123456789012:location/loc-12345678901234567
+
+Using `terraform import`, import `aws_datasync_location_smb` using the Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_datasync_location_smb.example arn:aws:datasync:us-east-1:123456789012:location/loc-12345678901234567
 ```
diff --git a/website/docs/r/datasync_task.html.markdown b/website/docs/r/datasync_task.html.markdown
index 126b8c52691..179018a880b 100644
--- a/website/docs/r/datasync_task.html.markdown
+++ b/website/docs/r/datasync_task.html.markdown
@@ -60,7 +60,7 @@ resource "aws_datasync_task" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `destination_location_arn` - (Required) Amazon Resource Name (ARN) of destination DataSync Location.
 * `source_location_arn` - (Required) Amazon Resource Name (ARN) of source DataSync Location.
@@ -76,7 +76,7 @@ The following arguments are supported:
 
 ~> **NOTE:** If `atime` is set to `BEST_EFFORT`, `mtime` must be set to `PRESERVE`. If `atime` is set to `NONE`, `mtime` must be set to `NONE`.
 
-The following arguments are supported inside the `options` configuration block:
+The `options` configuration block supports the following arguments:
 
 * `atime` - (Optional) A file metadata that shows the last time a file was accessed (that is when the file was read or written to). If set to `BEST_EFFORT`, the DataSync Task attempts to preserve the original (that is, the version before sync `PREPARING` phase) `atime` attribute on all source files. Valid values: `BEST_EFFORT`, `NONE`. Default: `BEST_EFFORT`.
 * `bytes_per_second` - (Optional) Limits the bandwidth utilized. For example, to set a maximum of 1 MB, set this value to `1048576`. Value values: `-1` or greater. Default: `-1` (unlimited).
@@ -108,9 +108,9 @@ The following arguments are supported inside the `options` configuration block:
 * `filter_type` - (Optional) The type of filter rule to apply. Valid values: `SIMPLE_PATTERN`.
 * `value` - (Optional) A single filter string that consists of the patterns to include. The patterns are delimited by "|" (that is, a pipe), for example: `/folder1|/folder2`
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Amazon Resource Name (ARN) of the DataSync Task.
 * `arn` - Amazon Resource Name (ARN) of the DataSync Task.
@@ -124,8 +124,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_datasync_task` can be imported by using the DataSync Task Amazon Resource Name (ARN), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_datasync_task` using the DataSync Task Amazon Resource Name (ARN). For example:
 
+```terraform
+import {
+  to = aws_datasync_task.example
+  id = "arn:aws:datasync:us-east-1:123456789012:task/task-12345678901234567"
+}
 ```
-$ terraform import aws_datasync_task.example arn:aws:datasync:us-east-1:123456789012:task/task-12345678901234567
+
+Using `terraform import`, import `aws_datasync_task` using the DataSync Task Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_datasync_task.example arn:aws:datasync:us-east-1:123456789012:task/task-12345678901234567
 ```
diff --git a/website/docs/r/dax_cluster.html.markdown b/website/docs/r/dax_cluster.html.markdown
index c232bc823fd..42c5285211a 100644
--- a/website/docs/r/dax_cluster.html.markdown
+++ b/website/docs/r/dax_cluster.html.markdown
@@ -23,7 +23,7 @@ resource "aws_dax_cluster" "bar" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `cluster_endpoint_encryption_type` – (Optional) The type of encryption the
 cluster's endpoint should support. Valid values are: `NONE` and `TLS`.
@@ -74,9 +74,9 @@ The `server_side_encryption` object supports the following:
 
 * `enabled` - (Optional) Whether to enable encryption at rest. Defaults to `false`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The ARN of the DAX cluster
 
@@ -103,10 +103,19 @@ consisting of a DNS name and a port number
 
 ## Import
 
-DAX Clusters can be imported using the `cluster_name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DAX Clusters using the `cluster_name`. For example:
 
+```terraform
+import {
+  to = aws_dax_cluster.my_cluster
+  id = "my_cluster"
+}
 ```
-$ terraform import aws_dax_cluster.my_cluster my_cluster
+
+Using `terraform import`, import DAX Clusters using the `cluster_name`. For example:
+
+```console
+% terraform import aws_dax_cluster.my_cluster my_cluster
 ```
 
 [1]: http://docs.aws.amazon.com/amazondynamodb/latest/developerguide/DAX.concepts.cluster.html#DAX.concepts.nodes
diff --git a/website/docs/r/dax_parameter_group.html.markdown b/website/docs/r/dax_parameter_group.html.markdown
index d49268db7bb..de7c702dca4 100644
--- a/website/docs/r/dax_parameter_group.html.markdown
+++ b/website/docs/r/dax_parameter_group.html.markdown
@@ -30,7 +30,7 @@ resource "aws_dax_parameter_group" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` – (Required) The name of the parameter group.
 
@@ -45,16 +45,25 @@ The following arguments are supported:
 * `name` - (Required) The name of the parameter.
 * `value` - (Required) The value for the parameter.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The name of the parameter group.
 
 ## Import
 
-DAX Parameter Group can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DAX Parameter Group using the `name`. For example:
 
+```terraform
+import {
+  to = aws_dax_parameter_group.example
+  id = "my_dax_pg"
+}
 ```
-$ terraform import aws_dax_parameter_group.example my_dax_pg
+
+Using `terraform import`, import DAX Parameter Group using the `name`. For example:
+
+```console
+% terraform import aws_dax_parameter_group.example my_dax_pg
 ```
diff --git a/website/docs/r/dax_subnet_group.html.markdown b/website/docs/r/dax_subnet_group.html.markdown
index 58bf029b032..07558553b0a 100644
--- a/website/docs/r/dax_subnet_group.html.markdown
+++ b/website/docs/r/dax_subnet_group.html.markdown
@@ -21,23 +21,32 @@ resource "aws_dax_subnet_group" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` – (Required) The name of the subnet group.
 * `description` - (Optional) A description of the subnet group.
 * `subnet_ids` – (Required) A list of VPC subnet IDs for the subnet group.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The name of the subnet group.
 * `vpc_id` – VPC ID of the subnet group.
 
 ## Import
 
-DAX Subnet Group can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DAX Subnet Group using the `name`. For example:
 
+```terraform
+import {
+  to = aws_dax_subnet_group.example
+  id = "my_dax_sg"
+}
 ```
-$ terraform import aws_dax_subnet_group.example my_dax_sg
+
+Using `terraform import`, import DAX Subnet Group using the `name`. For example:
+
+```console
+% terraform import aws_dax_subnet_group.example my_dax_sg
 ```
diff --git a/website/docs/r/db_cluster_snapshot.html.markdown b/website/docs/r/db_cluster_snapshot.html.markdown
index 475ece347e1..c4e27d8997e 100644
--- a/website/docs/r/db_cluster_snapshot.html.markdown
+++ b/website/docs/r/db_cluster_snapshot.html.markdown
@@ -21,15 +21,15 @@ resource "aws_db_cluster_snapshot" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `db_cluster_identifier` - (Required) The DB Cluster Identifier from which to take the snapshot.
 * `db_cluster_snapshot_identifier` - (Required) The Identifier for the snapshot.
 * `tags` - (Optional) A map of tags to assign to the DB cluster. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `allocated_storage` - Allocated storage size in gigabytes (GB).
 * `availability_zones` - List of EC2 Availability Zones that instances in the DB cluster snapshot can be restored in.
@@ -53,8 +53,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_db_cluster_snapshot` can be imported by using the cluster snapshot identifier, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_db_cluster_snapshot` using the cluster snapshot identifier. For example:
 
+```terraform
+import {
+  to = aws_db_cluster_snapshot.example
+  id = "my-cluster-snapshot"
+}
 ```
-$ terraform import aws_db_cluster_snapshot.example my-cluster-snapshot
+
+Using `terraform import`, import `aws_db_cluster_snapshot` using the cluster snapshot identifier. For example:
+
+```console
+% terraform import aws_db_cluster_snapshot.example my-cluster-snapshot
 ```
diff --git a/website/docs/r/db_event_subscription.html.markdown b/website/docs/r/db_event_subscription.html.markdown
index 2f276d76ee2..65e5ba4e43d 100644
--- a/website/docs/r/db_event_subscription.html.markdown
+++ b/website/docs/r/db_event_subscription.html.markdown
@@ -53,7 +53,7 @@ resource "aws_db_event_subscription" "default" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Optional) The name of the DB event subscription. By default generated by Terraform.
 * `name_prefix` - (Optional) The name of the DB event subscription. Conflicts with `name`.
@@ -64,9 +64,9 @@ The following arguments are supported:
 * `enabled` - (Optional) A boolean flag to enable/disable the subscription. Defaults to true.
 * `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The name of the RDS event notification subscription
 * `arn` - The Amazon Resource Name of the RDS event notification subscription
@@ -83,8 +83,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-DB Event Subscriptions can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DB Event Subscriptions using the `name`. For example:
 
+```terraform
+import {
+  to = aws_db_event_subscription.default
+  id = "rds-event-sub"
+}
 ```
-$ terraform import aws_db_event_subscription.default rds-event-sub
+
+Using `terraform import`, import DB Event Subscriptions using the `name`. For example:
+
+```console
+% terraform import aws_db_event_subscription.default rds-event-sub
 ```
diff --git a/website/docs/r/db_instance.html.markdown b/website/docs/r/db_instance.html.markdown
index 0c5fd50cc91..14bfb51e37d 100644
--- a/website/docs/r/db_instance.html.markdown
+++ b/website/docs/r/db_instance.html.markdown
@@ -73,7 +73,7 @@ data "aws_rds_orderable_db_instance" "custom-oracle" {
   engine_version             = "19.c.ee.002"      # CEV engine version to be used
   license_model              = "bring-your-own-license"
   storage_type               = "gp3"
-  preferred_instance_classes = ["db.r5.24xlarge", "db.r5.16xlarge", "db.r5.12xlarge"]
+  preferred_instance_classes = ["db.r5.xlarge", "db.r5.2xlarge", "db.r5.4xlarge"]
 }
 
 # The RDS instance resource requires an ARN. Look up the ARN of the KMS key associated with the CEV.
@@ -83,7 +83,7 @@ data "aws_kms_key" "by_id" {
 
 resource "aws_db_instance" "default" {
   allocated_storage           = 50
-  auto_minor_version_upgrade  = false                         # Custom for Oracle not support minor version upgrades
+  auto_minor_version_upgrade  = false                         # Custom for Oracle does not support minor version upgrades
   custom_iam_instance_profile = "AWSRDSCustomInstanceProfile" # Instance profile is required for Custom for Oracle. See: https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/custom-setup-orcl.html#custom-setup-orcl.iam-vpc
   backup_retention_period     = 7
   db_subnet_group_name        = local.db_subnet_group_name
@@ -126,6 +126,46 @@ resource "aws_db_instance" "test-replica" {
 }
 ```
 
+### RDS Custom for SQL Server
+
+```terraform
+# Lookup the available instance classes for the custom engine for the region being operated in
+data "aws_rds_orderable_db_instance" "custom-sqlserver" {
+  engine                     = "custom-sqlserver-se" # CEV engine to be used
+  engine_version             = "15.00.4249.2.v1"     # CEV engine version to be used
+  storage_type               = "gp3"
+  preferred_instance_classes = ["db.r5.xlarge", "db.r5.2xlarge", "db.r5.4xlarge"]
+}
+
+# The RDS instance resource requires an ARN. Look up the ARN of the KMS key.
+data "aws_kms_key" "by_id" {
+  key_id = "example-ef278353ceba4a5a97de6784565b9f78" # KMS key
+}
+
+resource "aws_db_instance" "example" {
+  allocated_storage           = 500
+  auto_minor_version_upgrade  = false                               # Custom for SQL Server does not support minor version upgrades
+  custom_iam_instance_profile = "AWSRDSCustomSQLServerInstanceRole" # Instance profile is required for Custom for SQL Server. See: https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/custom-setup-sqlserver.html#custom-setup-sqlserver.iam
+  backup_retention_period     = 7
+  db_subnet_group_name        = local.db_subnet_group_name # Copy the subnet group from the RDS Console
+  engine                      = data.aws_rds_orderable_db_instance.custom-sqlserver.engine
+  engine_version              = data.aws_rds_orderable_db_instance.custom-sqlserver.engine_version
+  identifier                  = "sql-instance-demo"
+  instance_class              = data.aws_rds_orderable_db_instance.custom-sqlserver.instance_class
+  kms_key_id                  = data.aws_kms_key.by_id.arn
+  multi_az                    = false # Custom for SQL Server does support multi-az
+  password                    = "avoid-plaintext-passwords"
+  storage_encrypted           = true
+  username                    = "test"
+
+  timeouts {
+    create = "3h"
+    delete = "3h"
+    update = "3h"
+  }
+}
+```
+
 ### Storage Autoscaling
 
 To enable Storage Autoscaling with instances that support the feature, define the `max_allocated_storage` argument higher than the `allocated_storage` argument. Terraform will automatically hide differences with the `allocated_storage` argument value if autoscaling occurs.
@@ -187,7 +227,7 @@ resource "aws_db_instance" "default" {
 For more detailed documentation about each argument, refer to the [AWS official
 documentation](http://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_CreateDBInstance.html).
 
-The following arguments are supported:
+This argument supports the following arguments:
 
 * `allocated_storage` - (Required unless a `snapshot_identifier` or `replicate_source_db` is provided) The allocated storage in gibibytes. If `max_allocated_storage` is configured, this argument represents the initial storage allocation and differences from the configuration will be ignored automatically when Storage Autoscaling occurs. If `replicate_source_db` is set, the value is ignored during the creation of the instance.
 * `allow_major_version_upgrade` - (Optional) Indicates that major version
@@ -207,10 +247,11 @@ Defaults to true.
   Must be greater than `0` if the database is used as a source for a [Read Replica][instance-replication],
   uses [low-downtime updates](#low-downtime-updates),
   or will use [RDS Blue/Green deployments][blue-green].
+* `backup_target` - (Optional, Forces new resource) Specifies where automated backups and manual snapshots are stored. Possible values are `region` (default) and `outposts`. See [Working with Amazon RDS on AWS Outposts](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/rds-on-outposts.html) for more information.
 * `backup_window` - (Optional) The daily time range (in UTC) during which automated backups are created if they are enabled.
   Example: "09:46-10:16". Must not overlap with `maintenance_window`.
 * `blue_green_update` - (Optional) Enables low-downtime updates using [RDS Blue/Green deployments][blue-green].
-  See [blue_green_update](#blue_green_update) below
+  See [`blue_green_update`](#blue_green_update) below.
 * `ca_cert_identifier` - (Optional) The identifier of the CA certificate for the DB instance.
 * `character_set_name` - (Optional) The character set name to use for DB
 encoding in Oracle and Microsoft SQL instances (collation). This can't be changed. See [Oracle Character Sets
@@ -225,23 +266,21 @@ be created in the `default` VPC, or in EC2 Classic, if available. When working
 with read replicas, it should be specified only if the source database
 specifies an instance in another AWS Region. See [DBSubnetGroupName in API
 action CreateDBInstanceReadReplica](https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_CreateDBInstanceReadReplica.html)
-for additional read replica contraints.
+for additional read replica constraints.
 * `delete_automated_backups` - (Optional) Specifies whether to remove automated backups immediately after the DB instance is deleted. Default is `true`.
 * `deletion_protection` - (Optional) If the DB instance should have deletion protection enabled. The database can't be deleted when this value is set to `true`. The default is `false`.
 * `domain` - (Optional) The ID of the Directory Service Active Directory domain to create the instance in.
 * `domain_iam_role_name` - (Optional, but required if domain is provided) The name of the IAM role to be used when making API calls to the Directory Service.
 * `enabled_cloudwatch_logs_exports` - (Optional) Set of log types to enable for exporting to CloudWatch logs. If omitted, no logs will be exported. Valid values (depending on `engine`). MySQL and MariaDB: `audit`, `error`, `general`, `slowquery`. PostgreSQL: `postgresql`, `upgrade`. MSSQL: `agent` , `error`. Oracle: `alert`, `audit`, `listener`, `trace`.
 * `engine` - (Required unless a `snapshot_identifier` or `replicate_source_db` is provided) The database engine to use. For supported values, see the Engine parameter in [API action CreateDBInstance](https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_CreateDBInstance.html). Note that for Amazon Aurora instances the engine must match the [DB cluster](/docs/providers/aws/r/rds_cluster.html)'s engine'. For information on the difference between the available Aurora MySQL engines see [Comparison between Aurora MySQL 1 and Aurora MySQL 2](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/AuroraMySQL.Updates.20180206.html) in the Amazon RDS User Guide.
-* `engine_version` - (Optional) The engine version to use. If `auto_minor_version_upgrade` is enabled, you can provide a prefix of the version such as `5.7` (for `5.7.10`). The actual engine version used is returned in the attribute `engine_version_actual`, see [Attributes Reference](#attributes-reference) below. For supported values, see the EngineVersion parameter in [API action CreateDBInstance](https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_CreateDBInstance.html). Note that for Amazon Aurora instances the engine version must match the [DB cluster](/docs/providers/aws/r/rds_cluster.html)'s engine version'.
+* `engine_version` - (Optional) The engine version to use. If `auto_minor_version_upgrade` is enabled, you can provide a prefix of the version such as `5.7` (for `5.7.10`). The actual engine version used is returned in the attribute `engine_version_actual`, see [Attribute Reference](#attribute-reference) below. For supported values, see the EngineVersion parameter in [API action CreateDBInstance](https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_CreateDBInstance.html). Note that for Amazon Aurora instances the engine version must match the [DB cluster](/docs/providers/aws/r/rds_cluster.html)'s engine version'.
 * `final_snapshot_identifier` - (Optional) The name of your final DB snapshot
 when this DB instance is deleted. Must be provided if `skip_final_snapshot` is
 set to `false`. The value must begin with a letter, only contain alphanumeric characters and hyphens, and not end with a hyphen or contain two consecutive hyphens. Must not be provided when deleting a read replica.
 * `iam_database_authentication_enabled` - (Optional) Specifies whether mappings of AWS Identity and Access Management (IAM) accounts to database
 accounts is enabled.
-* `identifier` - (Optional, Forces new resource) The name of the RDS instance,
-if omitted, Terraform will assign a random, unique identifier. Required if `restore_to_point_in_time` is specified.
-* `identifier_prefix` - (Optional, Forces new resource) Creates a unique
-identifier beginning with the specified prefix. Conflicts with `identifier`.
+* `identifier` - (Optional) The name of the RDS instance, if omitted, Terraform will assign a random, unique identifier. Required if `restore_to_point_in_time` is specified.
+* `identifier_prefix` - (Optional) Creates a unique identifier beginning with the specified prefix. Conflicts with `identifier`.
 * `instance_class` - (Required) The instance type of the RDS instance.
 * `iops` - (Optional) The amount of provisioned IOPS. Setting this implies a
 storage_type of "io1". Can only be set when `storage_type` is `"io1"` or `"gp3"`.
@@ -249,8 +288,12 @@ Cannot be specified for gp3 storage if the `allocated_storage` value is below a
 See the [RDS User Guide](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_Storage.html#gp3-storage) for details.
 * `kms_key_id` - (Optional) The ARN for the KMS encryption key. If creating an
 encrypted replica, set this to the destination KMS ARN.
-* `license_model` - (Optional, but required for some DB engines, i.e., Oracle
-SE1) License model information for this DB instance.
+* `license_model` - (Optional, but required for some DB engines, i.e., Oracle SE1) License model information for this DB instance. Valid values for this field are as follows:
+    * RDS for MariaDB: `general-public-license`
+    * RDS for Microsoft SQL Server: `license-included`
+    * RDS for MySQL: `general-public-license`
+    * RDS for Oracle: `bring-your-own-license | license-included`
+    * RDS for PostgreSQL: `postgresql-license`
 * `maintenance_window` - (Optional) The window to perform maintenance in.
 Syntax: "ddd:hh24:mi-ddd:hh24:mi". Eg: "Mon:00:00-Mon:03:00". See [RDS
 Maintenance Window
@@ -368,7 +411,7 @@ resource "aws_db_instance" "db" {
 
 This will not recreate the resource if the S3 object changes in some way.  It's only used to initialize the database.
 
-## blue_green_update
+### `blue_green_update`
 
 * `enabled` - (Optional) Enables [low-downtime updates](#low-downtime-updates) when `true`.
   Default is `false`.
@@ -380,9 +423,9 @@ https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_UpgradeDBInstance.Ma
 [blue-green]:
 https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/blue-green-deployments.html
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `address` - The hostname of the RDS instance. See also `endpoint` and `port`.
 * `arn` - The ARN of the RDS instance.
@@ -407,7 +450,6 @@ in a Route 53 Alias record).
 * `maintenance_window` - The instance maintenance window.
 * `master_user_secret` - A block that specifies the master user secret. Only available when `manage_master_user_password` is set to true. [Documented below](#master_user_secret).
 * `multi_az` - If the RDS instance is multi AZ enabled.
-* `name` - The database name.
 * `port` - The database port.
 * `resource_id` - The RDS Resource ID of this instance.
 * `status` - The RDS instance status.
@@ -443,8 +485,17 @@ The `master_user_secret` configuration block supports the following attributes:
 
 ## Import
 
-DB Instances can be imported using the `identifier`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DB Instances using the `identifier`. For example:
 
+```terraform
+import {
+  to = aws_db_instance.default
+  id = "mydb-rds-instance"
+}
 ```
-$ terraform import aws_db_instance.default mydb-rds-instance
+
+Using `terraform import`, import DB Instances using the `identifier`. For example:
+
+```console
+% terraform import aws_db_instance.default mydb-rds-instance
 ```
diff --git a/website/docs/r/db_instance_automated_backups_replication.html.markdown b/website/docs/r/db_instance_automated_backups_replication.html.markdown
new file mode 100644
index 00000000000..6415579a2a5
--- /dev/null
+++ b/website/docs/r/db_instance_automated_backups_replication.html.markdown
@@ -0,0 +1,112 @@
+---
+subcategory: "RDS (Relational Database)"
+layout: "aws"
+page_title: "AWS: aws_db_instance_automated_backups_replication"
+description: |-
+  Enables replication of automated backups to a different AWS Region.
+---
+
+# Resource: aws_db_instance_automated_backups_replication
+
+Manage cross-region replication of automated backups to a different AWS Region. Documentation for cross-region automated backup replication can be found at:
+
+* [Replicating automated backups to another AWS Region](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_ReplicateBackups.html)
+
+-> **Note:** This resource has to be created in the destination region.
+
+## Example Usage
+
+```terraform
+resource "aws_db_instance_automated_backups_replication" "default" {
+  source_db_instance_arn = "arn:aws:rds:us-west-2:123456789012:db:mydatabase"
+  retention_period       = 14
+}
+```
+
+## Encrypting the automated backup with KMS
+
+```terraform
+resource "aws_db_instance_automated_backups_replication" "default" {
+  source_db_instance_arn = "arn:aws:rds:us-west-2:123456789012:db:mydatabase"
+  kms_key_id             = "arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012"
+}
+```
+
+## Example including a RDS DB instance
+
+```terraform
+provider "aws" {
+  region = "us-east-1"
+}
+
+provider "aws" {
+  region = "us-west-2"
+  alias  = "replica"
+}
+
+resource "aws_db_instance" "default" {
+  allocated_storage       = 10
+  identifier              = "mydb"
+  engine                  = "postgres"
+  engine_version          = "13.4"
+  instance_class          = "db.t3.micro"
+  db_name                 = "mydb"
+  username                = "masterusername"
+  password                = "mustbeeightcharacters"
+  backup_retention_period = 7
+  storage_encrypted       = true
+  skip_final_snapshot     = true
+}
+
+resource "aws_kms_key" "default" {
+  description = "Encryption key for automated backups"
+
+  provider = aws.replica
+}
+
+resource "aws_db_instance_automated_backups_replication" "default" {
+  source_db_instance_arn = aws_db_instance.default.arn
+  kms_key_id             = aws_kms_key.default.arn
+
+  provider = aws.replica
+}
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `kms_key_id` - (Optional, Forces new resource) The AWS KMS key identifier for encryption of the replicated automated backups. The KMS key ID is the Amazon Resource Name (ARN) for the KMS encryption key in the destination AWS Region, for example, `arn:aws:kms:us-east-1:123456789012:key/AKIAIOSFODNN7EXAMPLE`.
+* `pre_signed_url` - (Optional, Forces new resource) A URL that contains a [Signature Version 4](https://docs.aws.amazon.com/general/latest/gr/signature-version-4.html) signed request for the [`StartDBInstanceAutomatedBackupsReplication`](https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_StartDBInstanceAutomatedBackupsReplication.html) action to be called in the AWS Region of the source DB instance.
+* `retention_period` - (Optional, Forces new resource) The retention period for the replicated automated backups, defaults to `7`.
+* `source_db_instance_arn` - (Required, Forces new resource) The Amazon Resource Name (ARN) of the source DB instance for the replicated automated backups, for example, `arn:aws:rds:us-west-2:123456789012:db:mydatabase`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Amazon Resource Name (ARN) of the replicated automated backups.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `75m`)
+- `delete` - (Default `75m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import RDS instance automated backups replication using the `arn`. For example:
+
+```terraform
+import {
+  to = aws_db_instance_automated_backups_replication.default
+  id = "arn:aws:rds:us-east-1:123456789012:auto-backup:ab-faaa2mgdj1vmp4xflr7yhsrmtbtob7ltrzzz2my"
+}
+```
+
+Using `terraform import`, import RDS instance automated backups replication using the `arn`. For example:
+
+```console
+% terraform import aws_db_instance_automated_backups_replication.default arn:aws:rds:us-east-1:123456789012:auto-backup:ab-faaa2mgdj1vmp4xflr7yhsrmtbtob7ltrzzz2my
+```
diff --git a/website/docs/r/db_instance_automated_backups_replication.markdown b/website/docs/r/db_instance_automated_backups_replication.markdown
deleted file mode 100644
index 18c44197689..00000000000
--- a/website/docs/r/db_instance_automated_backups_replication.markdown
+++ /dev/null
@@ -1,103 +0,0 @@
----
-subcategory: "RDS (Relational Database)"
-layout: "aws"
-page_title: "AWS: aws_db_instance_automated_backups_replication"
-description: |-
-  Enables replication of automated backups to a different AWS Region.
----
-
-# Resource: aws_db_instance_automated_backups_replication
-
-Manage cross-region replication of automated backups to a different AWS Region. Documentation for cross-region automated backup replication can be found at:
-
-* [Replicating automated backups to another AWS Region](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_ReplicateBackups.html)
-
--> **Note:** This resource has to be created in the destination region.
-
-## Example Usage
-
-```terraform
-resource "aws_db_instance_automated_backups_replication" "default" {
-  source_db_instance_arn = "arn:aws:rds:us-west-2:123456789012:db:mydatabase"
-  retention_period       = 14
-}
-```
-
-## Encrypting the automated backup with KMS
-
-```terraform
-resource "aws_db_instance_automated_backups_replication" "default" {
-  source_db_instance_arn = "arn:aws:rds:us-west-2:123456789012:db:mydatabase"
-  kms_key_id             = "arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012"
-}
-```
-
-## Example including a RDS DB instance
-
-```terraform
-provider "aws" {
-  region = "us-east-1"
-}
-
-provider "aws" {
-  region = "us-west-2"
-  alias  = "replica"
-}
-
-resource "aws_db_instance" "default" {
-  allocated_storage       = 10
-  identifier              = "mydb"
-  engine                  = "postgres"
-  engine_version          = "13.4"
-  instance_class          = "db.t3.micro"
-  db_name                 = "mydb"
-  username                = "masterusername"
-  password                = "mustbeeightcharacters"
-  backup_retention_period = 7
-  storage_encrypted       = true
-  skip_final_snapshot     = true
-}
-
-resource "aws_kms_key" "default" {
-  description = "Encryption key for automated backups"
-
-  provider = aws.replica
-}
-
-resource "aws_db_instance_automated_backups_replication" "default" {
-  source_db_instance_arn = aws_db_instance.default.arn
-  kms_key_id             = aws_kms_key.default.arn
-
-  provider = aws.replica
-}
-```
-
-## Argument Reference
-
-The following arguments are supported:
-
-* `kms_key_id` - (Optional, Forces new resource) The AWS KMS key identifier for encryption of the replicated automated backups. The KMS key ID is the Amazon Resource Name (ARN) for the KMS encryption key in the destination AWS Region, for example, `arn:aws:kms:us-east-1:123456789012:key/AKIAIOSFODNN7EXAMPLE`.
-* `pre_signed_url` - (Optional, Forces new resource) A URL that contains a [Signature Version 4](https://docs.aws.amazon.com/general/latest/gr/signature-version-4.html) signed request for the [`StartDBInstanceAutomatedBackupsReplication`](https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_StartDBInstanceAutomatedBackupsReplication.html) action to be called in the AWS Region of the source DB instance.
-* `retention_period` - (Optional, Forces new resource) The retention period for the replicated automated backups, defaults to `7`.
-* `source_db_instance_arn` - (Required, Forces new resource) The Amazon Resource Name (ARN) of the source DB instance for the replicated automated backups, for example, `arn:aws:rds:us-west-2:123456789012:db:mydatabase`.
-
-## Attributes Reference
-
-In addition to all arguments above, the following attributes are exported:
-
-* `id` - The Amazon Resource Name (ARN) of the replicated automated backups.
-
-## Timeouts
-
-[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
-
-- `create` - (Default `75m`)
-- `delete` - (Default `75m`)
-
-## Import
-
-RDS instance automated backups replication can be imported using the `arn`, e.g.,
-
-```
-$ terraform import aws_db_instance_automated_backups_replication.default arn:aws:rds:us-east-1:123456789012:auto-backup:ab-faaa2mgdj1vmp4xflr7yhsrmtbtob7ltrzzz2my
-```
diff --git a/website/docs/r/db_instance_role_association.html.markdown b/website/docs/r/db_instance_role_association.html.markdown
index d4808ab0a41..d3217fe662f 100644
--- a/website/docs/r/db_instance_role_association.html.markdown
+++ b/website/docs/r/db_instance_role_association.html.markdown
@@ -27,22 +27,31 @@ resource "aws_db_instance_role_association" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `db_instance_identifier` - (Required) DB Instance Identifier to associate with the IAM Role.
 * `feature_name` - (Required) Name of the feature for association. This can be found in the AWS documentation relevant to the integration or a full list is available in the `SupportedFeatureNames` list returned by [AWS CLI rds describe-db-engine-versions](https://docs.aws.amazon.com/cli/latest/reference/rds/describe-db-engine-versions.html).
 * `role_arn` - (Required) Amazon Resource Name (ARN) of the IAM Role to associate with the DB Instance.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - DB Instance Identifier and IAM Role ARN separated by a comma (`,`)
 
 ## Import
 
-`aws_db_instance_role_association` can be imported using the DB Instance Identifier and IAM Role ARN separated by a comma (`,`), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_db_instance_role_association` using the DB Instance Identifier and IAM Role ARN separated by a comma (`,`). For example:
 
+```terraform
+import {
+  to = aws_db_instance_role_association.example
+  id = "my-db-instance,arn:aws:iam::123456789012:role/my-role"
+}
 ```
-$ terraform import aws_db_instance_role_association.example my-db-instance,arn:aws:iam::123456789012:role/my-role
+
+Using `terraform import`, import `aws_db_instance_role_association` using the DB Instance Identifier and IAM Role ARN separated by a comma (`,`). For example:
+
+```console
+% terraform import aws_db_instance_role_association.example my-db-instance,arn:aws:iam::123456789012:role/my-role
 ```
diff --git a/website/docs/r/db_option_group.html.markdown b/website/docs/r/db_option_group.html.markdown
index 7433c38ed72..da7ac98d8b2 100644
--- a/website/docs/r/db_option_group.html.markdown
+++ b/website/docs/r/db_option_group.html.markdown
@@ -60,37 +60,37 @@ More information about this can be found [here](https://docs.aws.amazon.com/Amaz
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
-* `name` - (Optional, Forces new resource) The name of the option group. If omitted, Terraform will assign a random, unique name. Must be lowercase, to match as it is stored in AWS.
+* `name` - (Optional, Forces new resource) Name of the option group. If omitted, Terraform will assign a random, unique name. Must be lowercase, to match as it is stored in AWS.
 * `name_prefix` - (Optional, Forces new resource) Creates a unique name beginning with the specified prefix. Conflicts with `name`. Must be lowercase, to match as it is stored in AWS.
-* `option_group_description` - (Optional) The description of the option group. Defaults to "Managed by Terraform".
+* `option_group_description` - (Optional) Description of the option group. Defaults to "Managed by Terraform".
 * `engine_name` - (Required) Specifies the name of the engine that this option group should be associated with.
 * `major_engine_version` - (Required) Specifies the major version of the engine that this option group should be associated with.
-* `option` - (Optional) A list of Options to apply.
-* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `option` - (Optional) List of options to apply.
+* `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-Option blocks support the following:
+`option` blocks support the following:
 
-* `option_name` - (Required) The Name of the Option (e.g., MEMCACHED).
-* `option_settings` - (Optional) A list of option settings to apply.
-* `port` - (Optional) The Port number when connecting to the Option (e.g., 11211).
-* `version` - (Optional) The version of the option (e.g., 13.1.0.0).
-* `db_security_group_memberships` - (Optional) A list of DB Security Groups for which the option is enabled.
-* `vpc_security_group_memberships` - (Optional) A list of VPC Security Groups for which the option is enabled.
+* `option_name` - (Required) Name of the option (e.g., MEMCACHED).
+* `option_settings` - (Optional) List of option settings to apply.
+* `port` - (Optional) Port number when connecting to the option (e.g., 11211). Leaving out or removing `port` from your configuration does not remove or clear a port from the option in AWS. AWS may assign a default port. Not including `port` in your configuration means that the AWS provider will ignore a previously set value, a value set by AWS, and any port changes.
+* `version` - (Optional) Version of the option (e.g., 13.1.0.0). Leaving out or removing `version` from your configuration does not remove or clear a version from the option in AWS. AWS may assign a default version. Not including `version` in your configuration means that the AWS provider will ignore a previously set value, a value set by AWS, and any version changes.
+* `db_security_group_memberships` - (Optional) List of DB Security Groups for which the option is enabled.
+* `vpc_security_group_memberships` - (Optional) List of VPC Security Groups for which the option is enabled.
 
-Option Settings blocks support the following:
+`option_settings` blocks support the following:
 
-* `name` - (Optional) The Name of the setting.
-* `value` - (Optional) The Value of the setting.
+* `name` - (Optional) Name of the setting.
+* `value` - (Optional) Value of the setting.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
-* `id` - The db option group name.
-* `arn` - The ARN of the db option group.
-* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `id` - DB option group name.
+* `arn` - ARN of the DB option group.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
 
 ## Timeouts
 
@@ -100,8 +100,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-DB Option groups can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DB option groups using the `name`. For example:
 
+```terraform
+import {
+  to = aws_db_option_group.example
+  id = "mysql-option-group"
+}
 ```
-$ terraform import aws_db_option_group.example mysql-option-group
+
+Using `terraform import`, import DB option groups using the `name`. For example:
+
+```console
+% terraform import aws_db_option_group.example mysql-option-group
 ```
diff --git a/website/docs/r/db_parameter_group.html.markdown b/website/docs/r/db_parameter_group.html.markdown
index 07449124480..d948a7779ab 100644
--- a/website/docs/r/db_parameter_group.html.markdown
+++ b/website/docs/r/db_parameter_group.html.markdown
@@ -77,7 +77,7 @@ resource "aws_db_instance" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Optional, Forces new resource) The name of the DB parameter group. If omitted, Terraform will assign a random, unique name.
 * `name_prefix` - (Optional, Forces new resource) Creates a unique name beginning with the specified prefix. Conflicts with `name`.
@@ -94,9 +94,9 @@ Parameter blocks support the following:
     engines can't apply some parameters without a reboot, and you will need to
     specify "pending-reboot" here.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The db parameter group name.
 * `arn` - The ARN of the db parameter group.
@@ -104,8 +104,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-DB Parameter groups can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DB Parameter groups using the `name`. For example:
 
+```terraform
+import {
+  to = aws_db_parameter_group.rds_pg
+  id = "rds-pg"
+}
 ```
-$ terraform import aws_db_parameter_group.rds_pg rds-pg
+
+Using `terraform import`, import DB Parameter groups using the `name`. For example:
+
+```console
+% terraform import aws_db_parameter_group.rds_pg rds-pg
 ```
diff --git a/website/docs/r/db_proxy.html.markdown b/website/docs/r/db_proxy.html.markdown
index 29894c1356a..06453fede09 100644
--- a/website/docs/r/db_proxy.html.markdown
+++ b/website/docs/r/db_proxy.html.markdown
@@ -39,12 +39,12 @@ resource "aws_db_proxy" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The identifier for the proxy. This name must be unique for all proxies owned by your AWS account in the specified AWS Region. An identifier must begin with a letter and must contain only ASCII letters, digits, and hyphens; it can't end with a hyphen or contain two consecutive hyphens.
 * `auth` - (Required) Configuration block(s) with authorization mechanisms to connect to the associated instances or clusters. Described below.
 * `debug_logging` - (Optional) Whether the proxy includes detailed information about SQL statements in its logs. This information helps you to debug issues involving SQL behavior or the performance and scalability of the proxy connections. The debug information includes the text of SQL statements that you submit through the proxy. Thus, only enable this setting when needed for debugging, and only when you have security measures in place to safeguard any sensitive information that appears in the logs.
-* `engine_family` - (Required, Forces new resource) The kinds of databases that the proxy can connect to. This value determines which database network protocol the proxy recognizes when it interprets network traffic to and from the database. The engine family applies to MySQL and PostgreSQL for both RDS and Aurora. Valid values are `MYSQL` and `POSTGRESQL`.
+* `engine_family` - (Required, Forces new resource) The kinds of databases that the proxy can connect to. This value determines which database network protocol the proxy recognizes when it interprets network traffic to and from the database. For Aurora MySQL, RDS for MariaDB, and RDS for MySQL databases, specify `MYSQL`. For Aurora PostgreSQL and RDS for PostgreSQL databases, specify `POSTGRESQL`. For RDS for Microsoft SQL Server, specify `SQLSERVER`. Valid values are `MYSQL`, `POSTGRESQL`, and `SQLSERVER`.
 * `idle_client_timeout` - (Optional) The number of seconds that a connection to the proxy can be inactive before the proxy disconnects it. You can set this value higher or lower than the connection timeout limit for the associated database.
 * `require_tls` - (Optional) A Boolean parameter that specifies whether Transport Layer Security (TLS) encryption is required for connections to the proxy. By enabling this setting, you can enforce encrypted TLS connections to the proxy.
 * `role_arn` - (Required) The Amazon Resource Name (ARN) of the IAM role that the proxy uses to access secrets in AWS Secrets Manager.
@@ -61,9 +61,9 @@ The following arguments are supported:
 * `secret_arn` - (Optional) The Amazon Resource Name (ARN) representing the secret that the proxy uses to authenticate to the RDS DB instance or Aurora DB cluster. These secrets are stored within Amazon Secrets Manager.
 * `username` - (Optional) The name of the database user to which the proxy connects.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The Amazon Resource Name (ARN) for the proxy.
 * `arn` - The Amazon Resource Name (ARN) for the proxy.
@@ -80,8 +80,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-DB proxies can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DB proxies using the `name`. For example:
 
+```terraform
+import {
+  to = aws_db_proxy.example
+  id = "example"
+}
 ```
-$ terraform import aws_db_proxy.example example
+
+Using `terraform import`, import DB proxies using the `name`. For example:
+
+```console
+% terraform import aws_db_proxy.example example
 ```
diff --git a/website/docs/r/db_proxy_default_target_group.html.markdown b/website/docs/r/db_proxy_default_target_group.html.markdown
index 95523763478..41aed35dfa2 100644
--- a/website/docs/r/db_proxy_default_target_group.html.markdown
+++ b/website/docs/r/db_proxy_default_target_group.html.markdown
@@ -53,7 +53,7 @@ resource "aws_db_proxy_default_target_group" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `db_proxy_name` - (Required) Name of the RDS DB Proxy.
 * `connection_pool_config` - (Optional) The settings that determine the size and behavior of the connection pool for the target group.
@@ -66,9 +66,9 @@ The following arguments are supported:
 * `max_idle_connections_percent` - (Optional) Controls how actively the proxy closes idle database connections in the connection pool. A high value enables the proxy to leave a high percentage of idle connections open. A low value causes the proxy to close idle client connections and return the underlying database connections to the connection pool. For Aurora MySQL, it is expressed as a percentage of the max_connections setting for the RDS DB instance or Aurora DB cluster used by the target group.
 * `session_pinning_filters` - (Optional) Each item in the list represents a class of SQL operations that normally cause all later statements in a session using a proxy to be pinned to the same underlying database connection. Including an item in the list exempts that class of SQL operations from the pinning behavior. Currently, the only allowed value is `EXCLUDE_VARIABLE_SETS`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Name of the RDS DB Proxy.
 * `arn` - The Amazon Resource Name (ARN) representing the target group.
@@ -83,8 +83,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-DB proxy default target groups can be imported using the `db_proxy_name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DB proxy default target groups using the `db_proxy_name`. For example:
 
+```terraform
+import {
+  to = aws_db_proxy_default_target_group.example
+  id = "example"
+}
 ```
-$ terraform import aws_db_proxy_default_target_group.example example
+
+Using `terraform import`, import DB proxy default target groups using the `db_proxy_name`. For example:
+
+```console
+% terraform import aws_db_proxy_default_target_group.example example
 ```
diff --git a/website/docs/r/db_proxy_endpoint.html.markdown b/website/docs/r/db_proxy_endpoint.html.markdown
index c49bd856c56..16357e04f3c 100644
--- a/website/docs/r/db_proxy_endpoint.html.markdown
+++ b/website/docs/r/db_proxy_endpoint.html.markdown
@@ -23,7 +23,7 @@ resource "aws_db_proxy_endpoint" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `db_proxy_endpoint_name` - (Required) The identifier for the proxy endpoint. An identifier must begin with a letter and must contain only ASCII letters, digits, and hyphens; it can't end with a hyphen or contain two consecutive hyphens.
 * `db_proxy_name` - (Required) The name of the DB proxy associated with the DB proxy endpoint that you create.
@@ -32,9 +32,9 @@ The following arguments are supported:
 * `target_role` - (Optional) Indicates whether the DB proxy endpoint can be used for read/write or read-only operations. The default is `READ_WRITE`. Valid values are `READ_WRITE` and `READ_ONLY`.
 * `tags` - (Optional) A mapping of tags to assign to the resource.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The name of the proxy and proxy endpoint separated by `/`, `DB-PROXY-NAME/DB-PROXY-ENDPOINT-NAME`.
 * `arn` - The Amazon Resource Name (ARN) for the proxy endpoint.
@@ -52,8 +52,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-DB proxy endpoints can be imported using the `DB-PROXY-NAME/DB-PROXY-ENDPOINT-NAME`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DB proxy endpoints using the `DB-PROXY-NAME/DB-PROXY-ENDPOINT-NAME`. For example:
 
+```terraform
+import {
+  to = aws_db_proxy_endpoint.example
+  id = "example/example"
+}
 ```
-$ terraform import aws_db_proxy_endpoint.example example/example
+
+Using `terraform import`, import DB proxy endpoints using the `DB-PROXY-NAME/DB-PROXY-ENDPOINT-NAME`. For example:
+
+```console
+% terraform import aws_db_proxy_endpoint.example example/example
 ```
diff --git a/website/docs/r/db_proxy_target.html.markdown b/website/docs/r/db_proxy_target.html.markdown
index 16fb4897136..726d8d780bf 100644
--- a/website/docs/r/db_proxy_target.html.markdown
+++ b/website/docs/r/db_proxy_target.html.markdown
@@ -57,7 +57,7 @@ resource "aws_db_proxy_target" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `db_proxy_name` - (Required, Forces new resource) The name of the DB proxy.
 * `target_group_name` - (Required, Forces new resource) The name of the target group.
@@ -66,9 +66,9 @@ The following arguments are supported:
 
 **NOTE:** Either `db_instance_identifier` or `db_cluster_identifier` should be specified and both should not be specified together
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `endpoint` - Hostname for the target RDS DB Instance. Only returned for `RDS_INSTANCE` type.
 * `id` - Identifier of  `db_proxy_name`, `target_group_name`, target type (e.g., `RDS_INSTANCE` or `TRACKED_CLUSTER`), and resource identifier separated by forward slashes (`/`).
@@ -80,16 +80,36 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-RDS DB Proxy Targets can be imported using the `db_proxy_name`, `target_group_name`, target type (e.g., `RDS_INSTANCE` or `TRACKED_CLUSTER`), and resource identifier separated by forward slashes (`/`), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import RDS DB Proxy Targets using the `db_proxy_name`, `target_group_name`, target type (such as `RDS_INSTANCE` or `TRACKED_CLUSTER`), and resource identifier separated by forward slashes (`/`). For example:
 
 Instances:
 
-```
-$ terraform import aws_db_proxy_target.example example-proxy/default/RDS_INSTANCE/example-instance
+```terraform
+import {
+  to = aws_db_proxy_target.example
+  id = "example-proxy/default/RDS_INSTANCE/example-instance"
+}
 ```
 
 Provisioned Clusters:
 
+```terraform
+import {
+  to = aws_db_proxy_target.example
+  id = "example-proxy/default/TRACKED_CLUSTER/example-cluster"
+}
 ```
-$ terraform import aws_db_proxy_target.example example-proxy/default/TRACKED_CLUSTER/example-cluster
+
+**Using `terraform import` to import** RDS DB Proxy Targets using the `db_proxy_name`, `target_group_name`, target type (such as `RDS_INSTANCE` or `TRACKED_CLUSTER`), and resource identifier separated by forward slashes (`/`). For example:
+
+Instances:
+
+```console
+% terraform import aws_db_proxy_target.example example-proxy/default/RDS_INSTANCE/example-instance
+```
+
+Provisioned Clusters:
+
+```console
+% terraform import aws_db_proxy_target.example example-proxy/default/TRACKED_CLUSTER/example-cluster
 ```
diff --git a/website/docs/r/db_snapshot.html.markdown b/website/docs/r/db_snapshot.html.markdown
index 6f5c1ce466e..8b6d4673f3a 100644
--- a/website/docs/r/db_snapshot.html.markdown
+++ b/website/docs/r/db_snapshot.html.markdown
@@ -35,16 +35,16 @@ resource "aws_db_snapshot" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `db_instance_identifier` - (Required) The DB Instance Identifier from which to take the snapshot.
 * `db_snapshot_identifier` - (Required) The Identifier for the snapshot.
 * `shared_accounts` - (Optional) List of AWS Account ids to share snapshot with, use `all` to make snaphot public.
 * `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `allocated_storage` - Specifies the allocated storage size in gigabytes (GB).
 * `availability_zone` - Specifies the name of the Availability Zone the DB instance was located in at the time of the DB snapshot.
@@ -71,8 +71,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_db_snapshot` can be imported by using the snapshot identifier, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_db_snapshot` using the snapshot identifier. For example:
 
+```terraform
+import {
+  to = aws_db_snapshot.example
+  id = "my-snapshot"
+}
 ```
-$ terraform import aws_db_snapshot.example my-snapshot
+
+Using `terraform import`, import `aws_db_snapshot` using the snapshot identifier. For example:
+
+```console
+% terraform import aws_db_snapshot.example my-snapshot
 ```
diff --git a/website/docs/r/db_snapshot_copy.html.markdown b/website/docs/r/db_snapshot_copy.html.markdown
index c40712601ff..d42e57928f7 100644
--- a/website/docs/r/db_snapshot_copy.html.markdown
+++ b/website/docs/r/db_snapshot_copy.html.markdown
@@ -40,7 +40,7 @@ resource "aws_db_snapshot_copy" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `copy_tags` - (Optional) Whether to copy existing tags. Defaults to `false`.
 * `destination_region` - (Optional) The Destination region to place snapshot copy.
@@ -52,9 +52,9 @@ The following arguments are supported:
 * `target_db_snapshot_identifier` - (Required) The Identifier for the snapshot.
 * `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Snapshot Identifier.
 * `allocated_storage` - Specifies the allocated storage size in gigabytes (GB).
@@ -81,8 +81,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_db_snapshot_copy` can be imported by using the snapshot identifier, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_db_snapshot_copy` using the snapshot identifier. For example:
 
+```terraform
+import {
+  to = aws_db_snapshot_copy.example
+  id = "my-snapshot"
+}
 ```
-$ terraform import aws_db_snapshot_copy.example my-snapshot
+
+Using `terraform import`, import `aws_db_snapshot_copy` using the snapshot identifier. For example:
+
+```console
+% terraform import aws_db_snapshot_copy.example my-snapshot
 ```
diff --git a/website/docs/r/db_subnet_group.html.markdown b/website/docs/r/db_subnet_group.html.markdown
index e18f37e8ddb..fe964fc3ee6 100644
--- a/website/docs/r/db_subnet_group.html.markdown
+++ b/website/docs/r/db_subnet_group.html.markdown
@@ -27,7 +27,7 @@ resource "aws_db_subnet_group" "default" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Optional, Forces new resource) The name of the DB subnet group. If omitted, Terraform will assign a random, unique name.
 * `name_prefix` - (Optional, Forces new resource) Creates a unique name beginning with the specified prefix. Conflicts with `name`.
@@ -35,9 +35,9 @@ The following arguments are supported:
 * `subnet_ids` - (Required) A list of VPC subnet IDs.
 * `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The db subnet group name.
 * `arn` - The ARN of the db subnet group.
@@ -47,8 +47,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-DB Subnet groups can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DB Subnet groups using the `name`. For example:
 
+```terraform
+import {
+  to = aws_db_subnet_group.default
+  id = "production-subnet-group"
+}
 ```
-$ terraform import aws_db_subnet_group.default production-subnet-group
+
+Using `terraform import`, import DB Subnet groups using the `name`. For example:
+
+```console
+% terraform import aws_db_subnet_group.default production-subnet-group
 ```
diff --git a/website/docs/r/default_network_acl.html.markdown b/website/docs/r/default_network_acl.html.markdown
index 3f546d84fc3..0f73bc3cc22 100644
--- a/website/docs/r/default_network_acl.html.markdown
+++ b/website/docs/r/default_network_acl.html.markdown
@@ -149,9 +149,9 @@ The following arguments are optional:
 
 -> For more information on ICMP types and codes, see [Internet Control Message Protocol (ICMP) Parameters](https://www.iana.org/assignments/icmp-parameters/icmp-parameters.xhtml).
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the Default Network ACL
 * `id` - ID of the Default Network ACL
@@ -163,8 +163,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Default Network ACLs can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Default Network ACLs using the `id`. For example:
 
+```terraform
+import {
+  to = aws_default_network_acl.sample
+  id = "acl-7aaabd18"
+}
 ```
-$ terraform import aws_default_network_acl.sample acl-7aaabd18
+
+Using `terraform import`, import Default Network ACLs using the `id`. For example:
+
+```console
+% terraform import aws_default_network_acl.sample acl-7aaabd18
 ```
diff --git a/website/docs/r/default_route_table.html.markdown b/website/docs/r/default_route_table.html.markdown
index ca044283cd8..f1f8cdaad68 100644
--- a/website/docs/r/default_route_table.html.markdown
+++ b/website/docs/r/default_route_table.html.markdown
@@ -88,9 +88,9 @@ One of the following target arguments must be supplied:
 
 Note that the default route, mapping the VPC's CIDR block to "local", is created implicitly and cannot be specified.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - ID of the route table.
 * `arn` - The ARN of the route table.
@@ -107,12 +107,19 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Default VPC route tables can be imported using the `vpc_id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Default VPC route tables using the `vpc_id`. For example:
 
+```terraform
+import {
+  to = aws_default_route_table.example
+  id = "vpc-33cc44dd"
+}
 ```
-$ terraform import aws_default_route_table.example vpc-33cc44dd
+
+Using `terraform import`, import Default VPC route tables using the `vpc_id`. For example:
+
+```console
+% terraform import aws_default_route_table.example vpc-33cc44dd
 ```
 
-[aws-route-tables]: http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Route_Tables.html#Route_Replacing_Main_Table
-[tf-route-tables]: /docs/providers/aws/r/route_table.html
 [tf-main-route-table-association]: /docs/providers/aws/r/main_route_table_association.html
diff --git a/website/docs/r/default_security_group.html.markdown b/website/docs/r/default_security_group.html.markdown
index 5dd2653afa2..b49b9c29907 100644
--- a/website/docs/r/default_security_group.html.markdown
+++ b/website/docs/r/default_security_group.html.markdown
@@ -96,9 +96,9 @@ Both `egress` and `ingress` objects have the same arguments.
 * `self` - (Optional) Whether the security group itself will be added as a source to this egress rule.
 * `to_port` - (Required) End range port (or ICMP code if protocol is `icmp`).
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the security group.
 * `description` - Description of the security group.
@@ -111,8 +111,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Security Groups can be imported using the `security group id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Security Groups using the security group `id`. For example:
 
+```terraform
+import {
+  to = aws_default_security_group.default_sg
+  id = "sg-903004f8"
+}
 ```
-$ terraform import aws_default_security_group.default_sg sg-903004f8
+
+Using `terraform import`, import Security Groups using the security group `id`. For example:
+
+```console
+% terraform import aws_default_security_group.default_sg sg-903004f8
 ```
diff --git a/website/docs/r/default_subnet.html.markdown b/website/docs/r/default_subnet.html.markdown
index e83f2b4819d..c419eb6bf2a 100644
--- a/website/docs/r/default_subnet.html.markdown
+++ b/website/docs/r/default_subnet.html.markdown
@@ -37,13 +37,13 @@ The arguments of an `aws_default_subnet` differ slightly from those of [`aws_sub
 * The `availability_zone_id`, `cidr_block` and `vpc_id` arguments become computed attributes
 * The default value for `map_public_ip_on_launch` is `true`
 
-The following additional arguments are supported:
+This resource supports the following additional arguments:
 
 * `force_destroy` - (Optional) Whether destroying the resource deletes the default subnet. Default: `false`
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `availability_zone_id` - The AZ ID of the subnet
 * `cidr_block` - The IPv4 CIDR block assigned to the subnet
@@ -51,8 +51,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Subnets can be imported using the `subnet id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import subnets using the subnet `id`. For example:
 
+```terraform
+import {
+  to = aws_default_subnet.public_subnet
+  id = "subnet-9d4a7b6c"
+}
 ```
-$ terraform import aws_default_subnet.public_subnet subnet-9d4a7b6c
+
+Using `terraform import`, import subnets using the subnet `id`. For example:
+
+```console
+% terraform import aws_default_subnet.public_subnet subnet-9d4a7b6c
 ```
diff --git a/website/docs/r/default_vpc.html.markdown b/website/docs/r/default_vpc.html.markdown
index 5acd0b443ca..c07897adac7 100644
--- a/website/docs/r/default_vpc.html.markdown
+++ b/website/docs/r/default_vpc.html.markdown
@@ -39,21 +39,30 @@ The arguments of an `aws_default_vpc` differ slightly from those of [`aws_vpc`](
 * The `cidr_block` and `instance_tenancy` arguments become computed attributes
 * The default value for `enable_dns_hostnames` is `true`
 
-The following additional arguments are supported:
+This resource supports the following additional arguments:
 
 * `force_destroy` - (Optional) Whether destroying the resource deletes the default VPC. Default: `false`
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `cidr_block` - The primary IPv4 CIDR block for the VPC
 * `instance_tenancy` - The allowed tenancy of instances launched into the VPC
 
 ## Import
 
-Default VPCs can be imported using the `vpc id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Default VPCs using the VPC `id`. For example:
 
+```terraform
+import {
+  to = aws_default_vpc.default
+  id = "vpc-a01106c2"
+}
 ```
-$ terraform import aws_default_vpc.default vpc-a01106c2
+
+Using `terraform import`, import Default VPCs using the VPC `id`. For example:
+
+```console
+% terraform import aws_default_vpc.default vpc-a01106c2
 ```
diff --git a/website/docs/r/default_vpc_dhcp_options.html.markdown b/website/docs/r/default_vpc_dhcp_options.html.markdown
index 62f2d778141..691a544bf5c 100644
--- a/website/docs/r/default_vpc_dhcp_options.html.markdown
+++ b/website/docs/r/default_vpc_dhcp_options.html.markdown
@@ -49,17 +49,26 @@ but Terraform cannot destroy it. Removing this resource from your configuration
 will remove it from your statefile and management, but will not destroy the DHCP Options Set.
 You can resume managing the DHCP Options Set via the AWS Console.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the DHCP Options Set.
 * `arn` - The ARN of the DHCP Options Set.
 
 ## Import
 
-VPC DHCP Options can be imported using the `dhcp options id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import VPC DHCP Options using the DHCP Options `id`. For example:
 
+```terraform
+import {
+  to = aws_default_vpc_dhcp_options.default_options
+  id = "dopt-d9070ebb"
+}
 ```
-$ terraform import aws_default_vpc_dhcp_options.default_options dopt-d9070ebb
+
+Using `terraform import`, import VPC DHCP Options using the DHCP Options `id`. For example:
+
+```console
+% terraform import aws_default_vpc_dhcp_options.default_options dopt-d9070ebb
 ```
diff --git a/website/docs/r/detective_graph.html.markdown b/website/docs/r/detective_graph.html.markdown
index b41d05b051e..cbfcecb2adf 100644
--- a/website/docs/r/detective_graph.html.markdown
+++ b/website/docs/r/detective_graph.html.markdown
@@ -26,9 +26,9 @@ The following arguments are optional:
 
 * `tags` -  (Optional) A map of tags to assign to the instance. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - ARN of the Detective Graph.
 * `graph_arn` - ARN of the Detective Graph.
@@ -36,8 +36,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_detective_graph` can be imported using the ARN, e.g.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_detective_graph` using the ARN. For example:
 
+```terraform
+import {
+  to = aws_detective_graph.example
+  id = "arn:aws:detective:us-east-1:123456789101:graph:231684d34gh74g4bae1dbc7bd807d02d"
+}
 ```
-$ terraform import aws_detective_graph.example arn:aws:detective:us-east-1:123456789101:graph:231684d34gh74g4bae1dbc7bd807d02d
+
+Using `terraform import`, import `aws_detective_graph` using the ARN. For example:
+
+```console
+% terraform import aws_detective_graph.example arn:aws:detective:us-east-1:123456789101:graph:231684d34gh74g4bae1dbc7bd807d02d
 ```
diff --git a/website/docs/r/detective_invitation_accepter.html.markdown b/website/docs/r/detective_invitation_accepter.html.markdown
index 93b6909e116..4bc234b7bd7 100644
--- a/website/docs/r/detective_invitation_accepter.html.markdown
+++ b/website/docs/r/detective_invitation_accepter.html.markdown
@@ -32,20 +32,29 @@ resource "aws_detective_invitation_accepter" "member" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `graph_arn` - (Required) ARN of the behavior graph that the member account is accepting the invitation for.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Unique identifier (ID) of the Detective invitation accepter.
 
 ## Import
 
-`aws_detective_invitation_accepter` can be imported using the graph ARN, e.g.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_detective_invitation_accepter` using the graph ARN. For example:
 
+```terraform
+import {
+  to = aws_detective_invitation_accepter.example
+  id = "arn:aws:detective:us-east-1:123456789101:graph:231684d34gh74g4bae1dbc7bd807d02d"
+}
 ```
-$ terraform import aws_detective_invitation_accepter.example arn:aws:detective:us-east-1:123456789101:graph:231684d34gh74g4bae1dbc7bd807d02d
+
+Using `terraform import`, import `aws_detective_invitation_accepter` using the graph ARN. For example:
+
+```console
+% terraform import aws_detective_invitation_accepter.example arn:aws:detective:us-east-1:123456789101:graph:231684d34gh74g4bae1dbc7bd807d02d
 ```
diff --git a/website/docs/r/detective_member.html.markdown b/website/docs/r/detective_member.html.markdown
index 0726b5300dc..4f0de825a20 100644
--- a/website/docs/r/detective_member.html.markdown
+++ b/website/docs/r/detective_member.html.markdown
@@ -26,7 +26,7 @@ resource "aws_detective_member" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `account_id` - (Required) AWS account ID for the account.
 * `email_address` - (Required) Email address for the account.
@@ -34,9 +34,9 @@ The following arguments are supported:
 * `message` - (Optional) A custom message to include in the invitation. Amazon Detective adds this message to the standard content that it sends for an invitation.
 * `disable_email_notification` - (Optional) If set to true, then the root user of the invited account will _not_ receive an email notification. This notification is in addition to an alert that the root user receives in AWS Personal Health Dashboard. By default, this is set to `false`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Unique identifier (ID) of the Detective.
 * `status` - Current membership status of the member account.
@@ -47,8 +47,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_detective_member` can be imported using the ARN of the graph followed by the account ID of the member account, e.g.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_detective_member` using the ARN of the graph followed by the account ID of the member account. For example:
 
+```terraform
+import {
+  to = aws_detective_member.example
+  id = "arn:aws:detective:us-east-1:123456789101:graph:231684d34gh74g4bae1dbc7bd807d02d/123456789012"
+}
 ```
-$ terraform import aws_detective_member.example arn:aws:detective:us-east-1:123456789101:graph:231684d34gh74g4bae1dbc7bd807d02d/123456789012
+
+Using `terraform import`, import `aws_detective_member` using the ARN of the graph followed by the account ID of the member account. For example:
+
+```console
+% terraform import aws_detective_member.example arn:aws:detective:us-east-1:123456789101:graph:231684d34gh74g4bae1dbc7bd807d02d/123456789012
 ```
diff --git a/website/docs/r/devicefarm_device_pool.html.markdown b/website/docs/r/devicefarm_device_pool.html.markdown
index 4175bb3ddad..9e6b937c1bf 100644
--- a/website/docs/r/devicefarm_device_pool.html.markdown
+++ b/website/docs/r/devicefarm_device_pool.html.markdown
@@ -39,17 +39,26 @@ resource "aws_devicefarm_device_pool" "example" {
 * `operator` - (Optional) Specifies how Device Farm compares the rule's attribute to the value. For the operators that are supported by each attribute. Valid values are: `EQUALS`, `NOT_IN`, `IN`, `GREATER_THAN`, `GREATER_THAN_OR_EQUALS`, `LESS_THAN`, `LESS_THAN_OR_EQUALS`, `CONTAINS`.
 * `value` - (Optional) The rule's value.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The Amazon Resource Name of this Device Pool
 * `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
 
 ## Import
 
-DeviceFarm Device Pools can be imported by their arn:
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DeviceFarm Device Pools using their ARN. For example:
 
+```terraform
+import {
+  to = aws_devicefarm_device_pool.example
+  id = "arn:aws:devicefarm:us-west-2:123456789012:devicepool:4fa784c7-ccb4-4dbf-ba4f-02198320daa1/4fa784c7-ccb4-4dbf-ba4f-02198320daa1"
+}
 ```
-$ terraform import aws_devicefarm_device_pool.example arn:aws:devicefarm:us-west-2:123456789012:devicepool:4fa784c7-ccb4-4dbf-ba4f-02198320daa1/4fa784c7-ccb4-4dbf-ba4f-02198320daa1
+
+Using `terraform import`, import DeviceFarm Device Pools using their ARN. For example:
+
+```console
+% terraform import aws_devicefarm_device_pool.example arn:aws:devicefarm:us-west-2:123456789012:devicepool:4fa784c7-ccb4-4dbf-ba4f-02198320daa1/4fa784c7-ccb4-4dbf-ba4f-02198320daa1
 ```
diff --git a/website/docs/r/devicefarm_instance_profile.html.markdown b/website/docs/r/devicefarm_instance_profile.html.markdown
index f2845f65880..c4fe3bc6374 100644
--- a/website/docs/r/devicefarm_instance_profile.html.markdown
+++ b/website/docs/r/devicefarm_instance_profile.html.markdown
@@ -29,17 +29,26 @@ resource "aws_devicefarm_instance_profile" "example" {
 * `reboot_after_use` - (Optional) When set to `true`, Device Farm reboots the instance after a test run. The default value is `true`.
 * `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The Amazon Resource Name of this instance profile.
 * `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
 
 ## Import
 
-DeviceFarm Instance Profiles can be imported by their arn:
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DeviceFarm Instance Profiles using their ARN. For example:
 
+```terraform
+import {
+  to = aws_devicefarm_instance_profile.example
+  id = "arn:aws:devicefarm:us-west-2:123456789012:instanceprofile:4fa784c7-ccb4-4dbf-ba4f-02198320daa1"
+}
 ```
-$ terraform import aws_devicefarm_instance_profile.example arn:aws:devicefarm:us-west-2:123456789012:instanceprofile:4fa784c7-ccb4-4dbf-ba4f-02198320daa1
+
+Using `terraform import`, import DeviceFarm Instance Profiles using their ARN. For example:
+
+```console
+% terraform import aws_devicefarm_instance_profile.example arn:aws:devicefarm:us-west-2:123456789012:instanceprofile:4fa784c7-ccb4-4dbf-ba4f-02198320daa1
 ```
diff --git a/website/docs/r/devicefarm_network_profile.html.markdown b/website/docs/r/devicefarm_network_profile.html.markdown
index b2ec9c6147a..8389a8bda29 100644
--- a/website/docs/r/devicefarm_network_profile.html.markdown
+++ b/website/docs/r/devicefarm_network_profile.html.markdown
@@ -41,17 +41,26 @@ resource "aws_devicefarm_network_profile" "example" {
 * `type` - (Optional) The type of network profile to create. Valid values are listed are `PRIVATE` and `CURATED`.
 * `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The Amazon Resource Name of this network profile.
 * `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
 
 ## Import
 
-DeviceFarm Network Profiles can be imported by their arn:
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DeviceFarm Network Profiles using their ARN. For example:
 
+```terraform
+import {
+  to = aws_devicefarm_network_profile.example
+  id = "arn:aws:devicefarm:us-west-2:123456789012:networkprofile:4fa784c7-ccb4-4dbf-ba4f-02198320daa1"
+}
 ```
-$ terraform import aws_devicefarm_network_profile.example arn:aws:devicefarm:us-west-2:123456789012:networkprofile:4fa784c7-ccb4-4dbf-ba4f-02198320daa1
+
+Using `terraform import`, import DeviceFarm Network Profiles using their ARN. For example:
+
+```console
+% terraform import aws_devicefarm_network_profile.example arn:aws:devicefarm:us-west-2:123456789012:networkprofile:4fa784c7-ccb4-4dbf-ba4f-02198320daa1
 ```
diff --git a/website/docs/r/devicefarm_project.html.markdown b/website/docs/r/devicefarm_project.html.markdown
index 230c14de5d4..3c2d9871274 100644
--- a/website/docs/r/devicefarm_project.html.markdown
+++ b/website/docs/r/devicefarm_project.html.markdown
@@ -29,9 +29,9 @@ resource "aws_devicefarm_project" "awesome_devices" {
 * `default_job_timeout_minutes` - (Optional) Sets the execution timeout value (in minutes) for a project. All test runs in this project use the specified execution timeout value unless overridden when scheduling a run.
 * `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The Amazon Resource Name of this project
 * `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
@@ -40,8 +40,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-DeviceFarm Projects can be imported by their arn:
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DeviceFarm Projects using their ARN. For example:
 
+```terraform
+import {
+  to = aws_devicefarm_project.example
+  id = "arn:aws:devicefarm:us-west-2:123456789012:project:4fa784c7-ccb4-4dbf-ba4f-02198320daa1"
+}
 ```
-$ terraform import aws_devicefarm_project.example arn:aws:devicefarm:us-west-2:123456789012:project:4fa784c7-ccb4-4dbf-ba4f-02198320daa1
+
+Using `terraform import`, import DeviceFarm Projects using their ARN. For example:
+
+```console
+% terraform import aws_devicefarm_project.example arn:aws:devicefarm:us-west-2:123456789012:project:4fa784c7-ccb4-4dbf-ba4f-02198320daa1
 ```
diff --git a/website/docs/r/devicefarm_test_grid_project.html.markdown b/website/docs/r/devicefarm_test_grid_project.html.markdown
index 0462c5910a3..5e27273f856 100644
--- a/website/docs/r/devicefarm_test_grid_project.html.markdown
+++ b/website/docs/r/devicefarm_test_grid_project.html.markdown
@@ -39,17 +39,26 @@ resource "aws_devicefarm_test_grid_project" "example" {
 * `subnet_ids` - (Required) A list of VPC subnet IDs in your Amazon VPC.
 * `vpc_id` - (Required) The ID of the Amazon VPC.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The Amazon Resource Name of this Test Grid Project.
 * `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
 
 ## Import
 
-DeviceFarm Test Grid Projects can be imported by their arn:
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DeviceFarm Test Grid Projects using their ARN. For example:
 
+```terraform
+import {
+  to = aws_devicefarm_test_grid_project.example
+  id = "arn:aws:devicefarm:us-west-2:123456789012:testgrid-project:4fa784c7-ccb4-4dbf-ba4f-02198320daa1"
+}
 ```
-$ terraform import aws_devicefarm_test_grid_project.example arn:aws:devicefarm:us-west-2:123456789012:testgrid-project:4fa784c7-ccb4-4dbf-ba4f-02198320daa1
+
+Using `terraform import`, import DeviceFarm Test Grid Projects using their ARN. For example:
+
+```console
+% terraform import aws_devicefarm_test_grid_project.example arn:aws:devicefarm:us-west-2:123456789012:testgrid-project:4fa784c7-ccb4-4dbf-ba4f-02198320daa1
 ```
diff --git a/website/docs/r/devicefarm_upload.html.markdown b/website/docs/r/devicefarm_upload.html.markdown
index 4d787376e9e..a6560f4d56d 100644
--- a/website/docs/r/devicefarm_upload.html.markdown
+++ b/website/docs/r/devicefarm_upload.html.markdown
@@ -33,9 +33,9 @@ resource "aws_devicefarm_upload" "example" {
 * `project_arn` - (Required) The ARN of the project for the upload.
 * `type` - (Required) The upload's upload type. See [AWS Docs](https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_CreateUpload.html#API_CreateUpload_RequestSyntax) for valid list of values.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The Amazon Resource Name of this upload.
 * `url` - The presigned Amazon S3 URL that was used to store a file using a PUT request.
@@ -44,8 +44,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-DeviceFarm Uploads can be imported by their arn:
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DeviceFarm Uploads using their ARN. For example:
 
+```terraform
+import {
+  to = aws_devicefarm_upload.example
+  id = "arn:aws:devicefarm:us-west-2:123456789012:upload:4fa784c7-ccb4-4dbf-ba4f-02198320daa1"
+}
 ```
-$ terraform import aws_devicefarm_upload.example arn:aws:devicefarm:us-west-2:123456789012:upload:4fa784c7-ccb4-4dbf-ba4f-02198320daa1
+
+Using `terraform import`, import DeviceFarm Uploads using their ARN. For example:
+
+```console
+% terraform import aws_devicefarm_upload.example arn:aws:devicefarm:us-west-2:123456789012:upload:4fa784c7-ccb4-4dbf-ba4f-02198320daa1
 ```
diff --git a/website/docs/r/directory_service_conditional_forwarder.html.markdown b/website/docs/r/directory_service_conditional_forwarder.html.markdown
index 54509b22a3d..65ce2cad443 100644
--- a/website/docs/r/directory_service_conditional_forwarder.html.markdown
+++ b/website/docs/r/directory_service_conditional_forwarder.html.markdown
@@ -26,20 +26,29 @@ resource "aws_directory_service_conditional_forwarder" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `directory_id` - (Required) ID of directory.
 * `dns_ips` - (Required) A list of forwarder IP addresses.
 * `remote_domain_name` - (Required) The fully qualified domain name of the remote domain for which forwarders will be used.
 
-## Attributes Reference
+## Attribute Reference
 
-No additional attributes are exported.
+This resource exports no additional attributes.
 
 ## Import
 
-Conditional forwarders can be imported using the directory id and remote_domain_name, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import conditional forwarders using the directory id and remote_domain_name. For example:
 
+```terraform
+import {
+  to = aws_directory_service_conditional_forwarder.example
+  id = "d-1234567890:example.com"
+}
 ```
-$ terraform import aws_directory_service_conditional_forwarder.example d-1234567890:example.com
+
+Using `terraform import`, import conditional forwarders using the directory id and remote_domain_name. For example:
+
+```console
+% terraform import aws_directory_service_conditional_forwarder.example d-1234567890:example.com
 ```
diff --git a/website/docs/r/directory_service_directory.html.markdown b/website/docs/r/directory_service_directory.html.markdown
index 441ba726361..7bf569e1b78 100644
--- a/website/docs/r/directory_service_directory.html.markdown
+++ b/website/docs/r/directory_service_directory.html.markdown
@@ -122,7 +122,7 @@ resource "aws_subnet" "bar" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The fully qualified name for the directory, such as `corp.example.com`
 * `password` - (Required) The password for the directory administrator or connector user.
@@ -150,9 +150,9 @@ The following arguments are supported:
 * `subnet_ids` - (Required) The identifiers of the subnets for the directory servers (2 subnets in 2 different AZs).
 * `vpc_id` - (Required) The identifier of the VPC that the directory is in.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The directory identifier.
 * `access_url` - The access URL for the directory, such as `http://alias.awsapps.com`.
@@ -174,8 +174,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-DirectoryService directories can be imported using the directory `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DirectoryService directories using the directory `id`. For example:
 
+```terraform
+import {
+  to = aws_directory_service_directory.sample
+  id = "d-926724cf57"
+}
 ```
-$ terraform import aws_directory_service_directory.sample d-926724cf57
+
+Using `terraform import`, import DirectoryService directories using the directory `id`. For example:
+
+```console
+% terraform import aws_directory_service_directory.sample d-926724cf57
 ```
diff --git a/website/docs/r/directory_service_log_subscription.html.markdown b/website/docs/r/directory_service_log_subscription.html.markdown
index 74ef63dead9..0312a59ba6d 100644
--- a/website/docs/r/directory_service_log_subscription.html.markdown
+++ b/website/docs/r/directory_service_log_subscription.html.markdown
@@ -49,19 +49,28 @@ resource "aws_directory_service_log_subscription" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `directory_id` - (Required) ID of directory.
 * `log_group_name` - (Required) Name of the cloudwatch log group to which the logs should be published. The log group should be already created and the directory service principal should be provided with required permission to create stream and publish logs. Changing this value would delete the current subscription and create a new one. A directory can only have one log subscription at a time.
 
-## Attributes Reference
+## Attribute Reference
 
-No additional attributes are exported.
+This resource exports no additional attributes.
 
 ## Import
 
-Directory Service Log Subscriptions can be imported using the directory id, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Directory Service Log Subscriptions using the directory id. For example:
 
+```terraform
+import {
+  to = aws_directory_service_log_subscription.msad
+  id = "d-1234567890"
+}
 ```
-$ terraform import aws_directory_service_log_subscription.msad d-1234567890
+
+Using `terraform import`, import Directory Service Log Subscriptions using the directory id. For example:
+
+```console
+% terraform import aws_directory_service_log_subscription.msad d-1234567890
 ```
diff --git a/website/docs/r/directory_service_radius_settings.html.markdown b/website/docs/r/directory_service_radius_settings.html.markdown
index 8764b237c2f..d87889cd598 100644
--- a/website/docs/r/directory_service_radius_settings.html.markdown
+++ b/website/docs/r/directory_service_radius_settings.html.markdown
@@ -28,7 +28,7 @@ resource "aws_directory_service_radius_settings" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `authentication_protocol` - (Optional) The protocol specified for your RADIUS endpoints. Valid values: `PAP`, `CHAP`, `MS-CHAPv1`, `MS-CHAPv2`.
 * `directory_id` - (Required) The identifier of the directory for which you want to manager RADIUS settings.
@@ -40,9 +40,9 @@ The following arguments are supported:
 * `shared_secret` - (Required) Required for enabling RADIUS on the directory.
 * `use_same_username` - (Optional) Not currently used.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The directory identifier.
 
@@ -55,8 +55,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-RADIUS settings can be imported using the directory ID, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import RADIUS settings using the directory ID. For example:
 
+```terraform
+import {
+  to = aws_directory_service_radius_settings.example
+  id = "d-926724cf57"
+}
 ```
-$ terraform import aws_directory_service_radius_settings.example d-926724cf57
+
+Using `terraform import`, import RADIUS settings using the directory ID. For example:
+
+```console
+% terraform import aws_directory_service_radius_settings.example d-926724cf57
 ```
diff --git a/website/docs/r/directory_service_region.html.markdown b/website/docs/r/directory_service_region.html.markdown
index b7a106a323c..ce67adffcfd 100644
--- a/website/docs/r/directory_service_region.html.markdown
+++ b/website/docs/r/directory_service_region.html.markdown
@@ -119,7 +119,7 @@ resource "aws_directory_service_region" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `desired_number_of_domain_controllers` - (Optional) The number of domain controllers desired in the replicated directory. Minimum value of `2`.
 * `directory_id` - (Required) The identifier of the directory to which you want to add Region replication.
@@ -132,9 +132,9 @@ The following arguments are supported:
 * `subnet_ids` - (Required) The identifiers of the subnets for the directory servers.
 * `vpc_id` - (Optional) The identifier of the VPC in which to create the directory.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block).
 
@@ -148,8 +148,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Replicated Regions can be imported using directory ID,Region name e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Replicated Regions using directory ID,Region name. For example:
 
+```terraform
+import {
+  to = aws_directory_service_region.example
+  id = "d-9267651497,us-east-2"
+}
 ```
-$ terraform import aws_directory_service_region.example d-9267651497,us-east-2
+
+Using `terraform import`, import Replicated Regions using directory ID,Region name. For example:
+
+```console
+% terraform import aws_directory_service_region.example d-9267651497,us-east-2
 ```
diff --git a/website/docs/r/directory_service_shared_directory.html.markdown b/website/docs/r/directory_service_shared_directory.html.markdown
index 1a1def91851..2e4cb2e6ede 100644
--- a/website/docs/r/directory_service_shared_directory.html.markdown
+++ b/website/docs/r/directory_service_shared_directory.html.markdown
@@ -52,9 +52,9 @@ The following arguments are optional:
 * `id` - (Required) Identifier of the directory consumer account.
 * `type` - (Optional) Type of identifier to be used in the `id` field. Valid value is `ACCOUNT`. Default is `ACCOUNT`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Identifier of the shared directory.
 * `shared_directory_id` - Identifier of the directory that is stored in the directory consumer account that corresponds to the shared directory in the owner account.
@@ -67,8 +67,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Directory Service Shared Directories can be imported using the owner directory ID/shared directory ID, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Directory Service Shared Directories using the owner directory ID/shared directory ID. For example:
 
+```terraform
+import {
+  to = aws_directory_service_shared_directory.example
+  id = "d-1234567890/d-9267633ece"
+}
 ```
-$ terraform import aws_directory_service_shared_directory.example d-1234567890/d-9267633ece
+
+Using `terraform import`, import Directory Service Shared Directories using the owner directory ID/shared directory ID. For example:
+
+```console
+% terraform import aws_directory_service_shared_directory.example d-1234567890/d-9267633ece
 ```
diff --git a/website/docs/r/directory_service_shared_directory_accepter.html.markdown b/website/docs/r/directory_service_shared_directory_accepter.html.markdown
index b8db6250970..45861c4355e 100644
--- a/website/docs/r/directory_service_shared_directory_accepter.html.markdown
+++ b/website/docs/r/directory_service_shared_directory_accepter.html.markdown
@@ -37,9 +37,9 @@ The following arguments are required:
 
 * `shared_directory_id` - (Required) Identifier of the directory that is stored in the directory consumer account that corresponds to the shared directory in the owner account.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Identifier of the shared directory.
 * `method` - Method used when sharing a directory (i.e., `ORGANIZATIONS` or `HANDSHAKE`).
@@ -56,8 +56,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Directory Service Shared Directories can be imported using the shared directory ID, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Directory Service Shared Directories using the shared directory ID. For example:
 
+```terraform
+import {
+  to = aws_directory_service_shared_directory_accepter.example
+  id = "d-9267633ece"
+}
 ```
-$ terraform import aws_directory_service_shared_directory_accepter.example d-9267633ece
+
+Using `terraform import`, import Directory Service Shared Directories using the shared directory ID. For example:
+
+```console
+% terraform import aws_directory_service_shared_directory_accepter.example d-9267633ece
 ```
diff --git a/website/docs/r/directory_service_trust.html.markdown b/website/docs/r/directory_service_trust.html.markdown
index c65cce97590..a6313b99798 100644
--- a/website/docs/r/directory_service_trust.html.markdown
+++ b/website/docs/r/directory_service_trust.html.markdown
@@ -92,7 +92,7 @@ resource "aws_directory_service_directory" "two" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `conditional_forwarder_ip_addrs` - (Optional) Set of IPv4 addresses for the DNS server associated with the remote Directory.
   Can contain between 1 and 4 values.
@@ -112,9 +112,9 @@ The following arguments are supported:
   Valid values are `Forest` and `External`.
   Default value is `Forest`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `created_date_time` - Date and time when the Trust was created.
 * `id` - The Trust identifier.
@@ -126,8 +126,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-The Trust relationsiop can be imported using the directory ID and remote domain name, separated by a `/`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import the Trust relationship using the directory ID and remote domain name, separated by a `/`. For example:
 
+```terraform
+import {
+  to = aws_directory_service_trust.example
+  id = "d-926724cf57/directory.example.com"
+}
 ```
-$ terraform import aws_directory_service_trust.example d-926724cf57/directory.example.com
+
+Using `terraform import`, import the Trust relationship using the directory ID and remote domain name, separated by a `/`. For example:
+
+```console
+% terraform import aws_directory_service_trust.example d-926724cf57/directory.example.com
 ```
diff --git a/website/docs/r/dlm_lifecycle_policy.html.markdown b/website/docs/r/dlm_lifecycle_policy.html.markdown
new file mode 100644
index 00000000000..6c66dd1f20e
--- /dev/null
+++ b/website/docs/r/dlm_lifecycle_policy.html.markdown
@@ -0,0 +1,362 @@
+---
+subcategory: "DLM (Data Lifecycle Manager)"
+layout: "aws"
+page_title: "AWS: aws_dlm_lifecycle_policy"
+description: |-
+  Provides a Data Lifecycle Manager (DLM) lifecycle policy for managing snapshots.
+---
+
+# Resource: aws_dlm_lifecycle_policy
+
+Provides a [Data Lifecycle Manager (DLM) lifecycle policy](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/snapshot-lifecycle.html) for managing snapshots.
+
+## Example Usage
+
+### Basic
+
+```terraform
+data "aws_iam_policy_document" "assume_role" {
+  statement {
+    effect = "Allow"
+
+    principals {
+      type        = "Service"
+      identifiers = ["dlm.amazonaws.com"]
+    }
+
+    actions = ["sts:AssumeRole"]
+  }
+}
+
+resource "aws_iam_role" "dlm_lifecycle_role" {
+  name               = "dlm-lifecycle-role"
+  assume_role_policy = data.aws_iam_policy_document.assume_role.json
+}
+
+data "aws_iam_policy_document" "dlm_lifecycle" {
+  statement {
+    effect = "Allow"
+
+    actions = [
+      "ec2:CreateSnapshot",
+      "ec2:CreateSnapshots",
+      "ec2:DeleteSnapshot",
+      "ec2:DescribeInstances",
+      "ec2:DescribeVolumes",
+      "ec2:DescribeSnapshots",
+    ]
+
+    resources = ["*"]
+  }
+
+  statement {
+    effect    = "Allow"
+    actions   = ["ec2:CreateTags"]
+    resources = ["arn:aws:ec2:*::snapshot/*"]
+  }
+}
+
+resource "aws_iam_role_policy" "dlm_lifecycle" {
+  name   = "dlm-lifecycle-policy"
+  role   = aws_iam_role.dlm_lifecycle_role.id
+  policy = data.aws_iam_policy_document.dlm_lifecycle.json
+}
+
+resource "aws_dlm_lifecycle_policy" "example" {
+  description        = "example DLM lifecycle policy"
+  execution_role_arn = aws_iam_role.dlm_lifecycle_role.arn
+  state              = "ENABLED"
+
+  policy_details {
+    resource_types = ["VOLUME"]
+
+    schedule {
+      name = "2 weeks of daily snapshots"
+
+      create_rule {
+        interval      = 24
+        interval_unit = "HOURS"
+        times         = ["23:45"]
+      }
+
+      retain_rule {
+        count = 14
+      }
+
+      tags_to_add = {
+        SnapshotCreator = "DLM"
+      }
+
+      copy_tags = false
+    }
+
+    target_tags = {
+      Snapshot = "true"
+    }
+  }
+}
+```
+
+### Example Cross-Region Snapshot Copy Usage
+
+```terraform
+# ...other configuration...
+data "aws_caller_identity" "current" {}
+
+data "aws_iam_policy_document" "key" {
+  statement {
+    sid    = "Enable IAM User Permissions"
+    effect = "Allow"
+
+    principals {
+      type        = "AWS"
+      identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
+    }
+
+    actions   = ["kms:*"]
+    resources = ["*"]
+  }
+}
+
+resource "aws_kms_key" "dlm_cross_region_copy_cmk" {
+  provider    = aws.alternate
+  description = "Example Alternate Region KMS Key"
+  policy      = data.aws_iam_policy_document.key.json
+}
+
+resource "aws_dlm_lifecycle_policy" "example" {
+  description        = "example DLM lifecycle policy"
+  execution_role_arn = aws_iam_role.dlm_lifecycle_role.arn
+  state              = "ENABLED"
+
+  policy_details {
+    resource_types = ["VOLUME"]
+
+    schedule {
+      name = "2 weeks of daily snapshots"
+
+      create_rule {
+        interval      = 24
+        interval_unit = "HOURS"
+        times         = ["23:45"]
+      }
+
+      retain_rule {
+        count = 14
+      }
+
+      tags_to_add = {
+        SnapshotCreator = "DLM"
+      }
+
+      copy_tags = false
+
+      cross_region_copy_rule {
+        target    = "us-west-2"
+        encrypted = true
+        cmk_arn   = aws_kms_key.dlm_cross_region_copy_cmk.arn
+        copy_tags = true
+        retain_rule {
+          interval      = 30
+          interval_unit = "DAYS"
+        }
+      }
+    }
+
+    target_tags = {
+      Snapshot = "true"
+    }
+  }
+}
+```
+
+### Example Event Based Policy Usage
+
+```terraform
+data "aws_caller_identity" "current" {}
+
+resource "aws_dlm_lifecycle_policy" "example" {
+  description        = "tf-acc-basic"
+  execution_role_arn = aws_iam_role.example.arn
+
+  policy_details {
+    policy_type = "EVENT_BASED_POLICY"
+
+    action {
+      name = "tf-acc-basic"
+      cross_region_copy {
+        encryption_configuration {}
+        retain_rule {
+          interval      = 15
+          interval_unit = "MONTHS"
+        }
+
+        target = "us-east-1"
+      }
+    }
+
+    event_source {
+      type = "MANAGED_CWE"
+      parameters {
+        description_regex = "^.*Created for policy: policy-1234567890abcdef0.*$"
+        event_type        = "shareSnapshot"
+        snapshot_owner    = [data.aws_caller_identity.current.account_id]
+      }
+    }
+  }
+}
+
+data "aws_iam_policy" "example" {
+  name = "AWSDataLifecycleManagerServiceRole"
+}
+
+resource "aws_iam_role_policy_attachment" "example" {
+  role       = aws_iam_role.example.id
+  policy_arn = data.aws_iam_policy.example.arn
+}
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `description` - (Required) A description for the DLM lifecycle policy.
+* `execution_role_arn` - (Required) The ARN of an IAM role that is able to be assumed by the DLM service.
+* `policy_details` - (Required) See the [`policy_details` configuration](#policy-details-arguments) block. Max of 1.
+* `state` - (Optional) Whether the lifecycle policy should be enabled or disabled. `ENABLED` or `DISABLED` are valid values. Defaults to `ENABLED`.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+#### Policy Details arguments
+
+* `action` - (Optional) The actions to be performed when the event-based policy is triggered. You can specify only one action per policy. This parameter is required for event-based policies only. If you are creating a snapshot or AMI policy, omit this parameter. See the [`action` configuration](#action-arguments) block.
+* `event_source` - (Optional) The event that triggers the event-based policy. This parameter is required for event-based policies only. If you are creating a snapshot or AMI policy, omit this parameter. See the [`event_source` configuration](#event-source-arguments) block.
+* `resource_types` - (Optional) A list of resource types that should be targeted by the lifecycle policy. Valid values are `VOLUME` and `INSTANCE`.
+* `resource_locations` - (Optional) The location of the resources to backup. If the source resources are located in an AWS Region, specify `CLOUD`. If the source resources are located on an Outpost in your account, specify `OUTPOST`. If you specify `OUTPOST`, Amazon Data Lifecycle Manager backs up all resources of the specified type with matching target tags across all of the Outposts in your account. Valid values are `CLOUD` and `OUTPOST`.
+* `policy_type` - (Optional) The valid target resource types and actions a policy can manage. Specify `EBS_SNAPSHOT_MANAGEMENT` to create a lifecycle policy that manages the lifecycle of Amazon EBS snapshots. Specify `IMAGE_MANAGEMENT` to create a lifecycle policy that manages the lifecycle of EBS-backed AMIs. Specify `EVENT_BASED_POLICY` to create an event-based policy that performs specific actions when a defined event occurs in your AWS account. Default value is `EBS_SNAPSHOT_MANAGEMENT`.
+* `parameters` - (Optional) A set of optional parameters for snapshot and AMI lifecycle policies. See the [`parameters` configuration](#parameters-arguments) block.
+* `schedule` - (Optional) See the [`schedule` configuration](#schedule-arguments) block.
+* `target_tags` (Optional) A map of tag keys and their values. Any resources that match the `resource_types` and are tagged with _any_ of these tags will be targeted.
+
+~> Note: You cannot have overlapping lifecycle policies that share the same `target_tags`. Terraform is unable to detect this at plan time but it will fail during apply.
+
+#### Action arguments
+
+* `cross_region_copy` - (Optional) The rule for copying shared snapshots across Regions. See the [`cross_region_copy` configuration](#action-cross-region-copy-rule-arguments) block.
+* `name` - (Optional) A descriptive name for the action.
+
+##### Action Cross Region Copy Rule arguments
+
+* `encryption_configuration` - (Required) The encryption settings for the copied snapshot. See the [`encryption_configuration`](#encryption-configuration-arguments) block. Max of 1 per action.
+* `retain_rule` - (Required) Specifies the retention rule for cross-Region snapshot copies. See the [`retain_rule`](#cross-region-copy-rule-retain-rule-arguments) block. Max of 1 per action.
+* `target` - (Required) The target Region or the Amazon Resource Name (ARN) of the target Outpost for the snapshot copies.
+
+###### Encryption Configuration arguments
+
+* `cmk_arn` - (Optional) The Amazon Resource Name (ARN) of the AWS KMS key to use for EBS encryption. If this parameter is not specified, the default KMS key for the account is used.
+* `encrypted` - (Required) To encrypt a copy of an unencrypted snapshot when encryption by default is not enabled, enable encryption using this parameter. Copies of encrypted snapshots are encrypted, even if this parameter is false or when encryption by default is not enabled.
+
+#### Event Source arguments
+
+* `parameters` - (Required) Information about the event. See the [`parameters` configuration](#event-source-parameters-arguments) block.
+* `type` - (Required) The source of the event. Currently only managed CloudWatch Events rules are supported. Valid values are `MANAGED_CWE`.
+
+##### Event Source Parameters arguments
+
+* `description_regex` - (Required) The snapshot description that can trigger the policy. The description pattern is specified using a regular expression. The policy runs only if a snapshot with a description that matches the specified pattern is shared with your account.
+* `event_type` - (Required) The type of event. Currently, only `shareSnapshot` events are supported.
+* `snapshot_owner` - (Required) The IDs of the AWS accounts that can trigger policy by sharing snapshots with your account. The policy only runs if one of the specified AWS accounts shares a snapshot with your account.
+
+#### Parameters arguments
+
+* `exclude_boot_volume` - (Optional) Indicates whether to exclude the root volume from snapshots created using CreateSnapshots. The default is `false`.
+* `no_reboot` - (Optional) Applies to AMI lifecycle policies only. Indicates whether targeted instances are rebooted when the lifecycle policy runs. `true` indicates that targeted instances are not rebooted when the policy runs. `false` indicates that target instances are rebooted when the policy runs. The default is `true` (instances are not rebooted).
+
+#### Schedule arguments
+
+* `copy_tags` - (Optional) Copy all user-defined tags on a source volume to snapshots of the volume created by this policy.
+* `create_rule` - (Required) See the [`create_rule`](#create-rule-arguments) block. Max of 1 per schedule.
+* `cross_region_copy_rule` (Optional) - See the [`cross_region_copy_rule`](#cross-region-copy-rule-arguments) block. Max of 3 per schedule.
+* `name` - (Required) A name for the schedule.
+* `deprecate_rule` - (Required) See the [`deprecate_rule`](#deprecate-rule-arguments) block. Max of 1 per schedule.
+* `fast_restore_rule` - (Required) See the [`fast_restore_rule`](#fast-restore-rule-arguments) block. Max of 1 per schedule.
+* `retain_rule` - (Required) See the [`retain_rule`](#retain-rule-arguments) block. Max of 1 per schedule.
+* `share_rule` - (Required) See the [`share_rule`](#share-rule-arguments) block. Max of 1 per schedule.
+* `tags_to_add` - (Optional) A map of tag keys and their values. DLM lifecycle policies will already tag the snapshot with the tags on the volume. This configuration adds extra tags on top of these.
+* `variable_tags` - (Optional) A map of tag keys and variable values, where the values are determined when the policy is executed. Only `$(instance-id)` or `$(timestamp)` are valid values. Can only be used when `resource_types` is `INSTANCE`.
+
+#### Create Rule arguments
+
+* `cron_expression` - (Optional) The schedule, as a Cron expression. The schedule interval must be between 1 hour and 1 year. Conflicts with `interval`, `interval_unit`, and `times`.
+* `interval` - (Optional) How often this lifecycle policy should be evaluated. `1`, `2`,`3`,`4`,`6`,`8`,`12` or `24` are valid values. Conflicts with `cron_expression`. If set, `interval_unit` and `times` must also be set.
+* `interval_unit` - (Optional) The unit for how often the lifecycle policy should be evaluated. `HOURS` is currently the only allowed value and also the default value. Conflicts with `cron_expression`. Must be set if `interval` is set.
+* `location` - (Optional) Specifies the destination for snapshots created by the policy. To create snapshots in the same Region as the source resource, specify `CLOUD`. To create snapshots on the same Outpost as the source resource, specify `OUTPOST_LOCAL`. If you omit this parameter, `CLOUD` is used by default. If the policy targets resources in an AWS Region, then you must create snapshots in the same Region as the source resource. If the policy targets resources on an Outpost, then you can create snapshots on the same Outpost as the source resource, or in the Region of that Outpost. Valid values are `CLOUD` and `OUTPOST_LOCAL`.
+* `times` - (Optional) A list of times in 24 hour clock format that sets when the lifecycle policy should be evaluated. Max of 1. Conflicts with `cron_expression`. Must be set if `interval` is set.
+
+#### Deprecate Rule arguments
+
+* `count` - (Optional) Specifies the number of oldest AMIs to deprecate. Must be an integer between `1` and `1000`. Conflicts with `interval` and `interval_unit`.
+* `interval` - (Optional) Specifies the period after which to deprecate AMIs created by the schedule. The maximum is 100 years. This is equivalent to 1200 months, 5200 weeks, or 36500 days. Conflicts with `count`. If set, `interval_unit` must also be set.
+* `interval_unit` - (Optional) The unit of time for time-based retention. Valid values are `DAYS`, `WEEKS`, `MONTHS`, `YEARS`. Conflicts with `count`. Must be set if `interval` is set.
+
+#### Fast Restore Rule arguments
+
+* `availability_zones` - (Required) The Availability Zones in which to enable fast snapshot restore.
+* `count` - (Optional) The number of snapshots to be enabled with fast snapshot restore. Must be an integer between `1` and `1000`. Conflicts with `interval` and `interval_unit`.
+* `interval` - (Optional) The amount of time to enable fast snapshot restore. The maximum is 100 years. This is equivalent to 1200 months, 5200 weeks, or 36500 days. Conflicts with `count`. If set, `interval_unit` must also be set.
+* `interval_unit` - (Optional) The unit of time for enabling fast snapshot restore. Valid values are `DAYS`, `WEEKS`, `MONTHS`, `YEARS`. Conflicts with `count`. Must be set if `interval` is set.
+
+#### Retain Rule arguments
+
+* `count` - (Optional) How many snapshots to keep. Must be an integer between `1` and `1000`. Conflicts with `interval` and `interval_unit`.
+* `interval` - (Optional) The amount of time to retain each snapshot. The maximum is 100 years. This is equivalent to 1200 months, 5200 weeks, or 36500 days. Conflicts with `count`. If set, `interval_unit` must also be set.
+* `interval_unit` - (Optional) The unit of time for time-based retention. Valid values are `DAYS`, `WEEKS`, `MONTHS`, `YEARS`. Conflicts with `count`. Must be set if `interval` is set.
+
+#### Share Rule arguments
+
+* `target_accounts` - (Required) The IDs of the AWS accounts with which to share the snapshots.
+* `interval` - (Optional) The period after which snapshots that are shared with other AWS accounts are automatically unshared.
+* `interval_unit` - (Optional) The unit of time for the automatic unsharing interval. Valid values are `DAYS`, `WEEKS`, `MONTHS`, `YEARS`.
+
+#### Cross Region Copy Rule arguments
+
+* `cmk_arn` - (Optional) The Amazon Resource Name (ARN) of the AWS KMS customer master key (CMK) to use for EBS encryption. If this argument is not specified, the default KMS key for the account is used.
+* `copy_tags` - (Optional) Whether to copy all user-defined tags from the source snapshot to the cross-region snapshot copy.
+* `deprecate_rule` - (Optional) The AMI deprecation rule for cross-Region AMI copies created by the rule. See the [`deprecate_rule`](#cross-region-copy-rule-deprecate-rule-arguments) block.
+* `encrypted` - (Required) To encrypt a copy of an unencrypted snapshot if encryption by default is not enabled, enable encryption using this parameter. Copies of encrypted snapshots are encrypted, even if this parameter is false or if encryption by default is not enabled.
+* `retain_rule` - (Required) The retention rule that indicates how long snapshot copies are to be retained in the destination Region. See the [`retain_rule`](#cross-region-copy-rule-retain-rule-arguments) block. Max of 1 per schedule.
+* `target` - (Required) The target Region or the Amazon Resource Name (ARN) of the target Outpost for the snapshot copies.
+
+#### Cross Region Copy Rule Deprecate Rule arguments
+
+* `interval` - (Required) The period after which to deprecate the cross-Region AMI copies. The period must be less than or equal to the cross-Region AMI copy retention period, and it can't be greater than 10 years. This is equivalent to 120 months, 520 weeks, or 3650 days.
+* `interval_unit` - (Required) The unit of time in which to measure the `interval`. Valid values: `DAYS`, `WEEKS`, `MONTHS`, or `YEARS`.
+
+#### Cross Region Copy Rule Retain Rule arguments
+
+* `interval` - (Required) The amount of time to retain each snapshot. The maximum is 100 years. This is equivalent to 1200 months, 5200 weeks, or 36500 days.
+* `interval_unit` - (Required) The unit of time for time-based retention. Valid values: `DAYS`, `WEEKS`, `MONTHS`, or `YEARS`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the DLM Lifecycle Policy.
+* `id` - Identifier of the DLM Lifecycle Policy.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DLM lifecycle policies using their policy ID. For example:
+
+```terraform
+import {
+  to = aws_dlm_lifecycle_policy.example
+  id = "policy-abcdef12345678901"
+}
+```
+
+Using `terraform import`, import DLM lifecycle policies using their policy ID. For example:
+
+```console
+% terraform import aws_dlm_lifecycle_policy.example policy-abcdef12345678901
+```
diff --git a/website/docs/r/dlm_lifecycle_policy.markdown b/website/docs/r/dlm_lifecycle_policy.markdown
deleted file mode 100644
index 524e6f6cdd2..00000000000
--- a/website/docs/r/dlm_lifecycle_policy.markdown
+++ /dev/null
@@ -1,353 +0,0 @@
----
-subcategory: "DLM (Data Lifecycle Manager)"
-layout: "aws"
-page_title: "AWS: aws_dlm_lifecycle_policy"
-description: |-
-  Provides a Data Lifecycle Manager (DLM) lifecycle policy for managing snapshots.
----
-
-# Resource: aws_dlm_lifecycle_policy
-
-Provides a [Data Lifecycle Manager (DLM) lifecycle policy](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/snapshot-lifecycle.html) for managing snapshots.
-
-## Example Usage
-
-### Basic
-
-```terraform
-data "aws_iam_policy_document" "assume_role" {
-  statement {
-    effect = "Allow"
-
-    principals {
-      type        = "Service"
-      identifiers = ["dlm.amazonaws.com"]
-    }
-
-    actions = ["sts:AssumeRole"]
-  }
-}
-
-resource "aws_iam_role" "dlm_lifecycle_role" {
-  name               = "dlm-lifecycle-role"
-  assume_role_policy = data.aws_iam_policy_document.assume_role.json
-}
-
-data "aws_iam_policy_document" "dlm_lifecycle" {
-  statement {
-    effect = "Allow"
-
-    actions = [
-      "ec2:CreateSnapshot",
-      "ec2:CreateSnapshots",
-      "ec2:DeleteSnapshot",
-      "ec2:DescribeInstances",
-      "ec2:DescribeVolumes",
-      "ec2:DescribeSnapshots",
-    ]
-
-    resources = ["*"]
-  }
-
-  statement {
-    effect    = "Allow"
-    actions   = ["ec2:CreateTags"]
-    resources = ["arn:aws:ec2:*::snapshot/*"]
-  }
-}
-
-resource "aws_iam_role_policy" "dlm_lifecycle" {
-  name   = "dlm-lifecycle-policy"
-  role   = aws_iam_role.dlm_lifecycle_role.id
-  policy = data.aws_iam_policy_document.dlm_lifecycle.json
-}
-
-resource "aws_dlm_lifecycle_policy" "example" {
-  description        = "example DLM lifecycle policy"
-  execution_role_arn = aws_iam_role.dlm_lifecycle_role.arn
-  state              = "ENABLED"
-
-  policy_details {
-    resource_types = ["VOLUME"]
-
-    schedule {
-      name = "2 weeks of daily snapshots"
-
-      create_rule {
-        interval      = 24
-        interval_unit = "HOURS"
-        times         = ["23:45"]
-      }
-
-      retain_rule {
-        count = 14
-      }
-
-      tags_to_add = {
-        SnapshotCreator = "DLM"
-      }
-
-      copy_tags = false
-    }
-
-    target_tags = {
-      Snapshot = "true"
-    }
-  }
-}
-```
-
-### Example Cross-Region Snapshot Copy Usage
-
-```terraform
-# ...other configuration...
-data "aws_caller_identity" "current" {}
-
-data "aws_iam_policy_document" "key" {
-  statement {
-    sid    = "Enable IAM User Permissions"
-    effect = "Allow"
-
-    principals {
-      type        = "AWS"
-      identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
-    }
-
-    actions   = ["kms:*"]
-    resources = ["*"]
-  }
-}
-
-resource "aws_kms_key" "dlm_cross_region_copy_cmk" {
-  provider    = aws.alternate
-  description = "Example Alternate Region KMS Key"
-  policy      = data.aws_iam_policy_document.key.json
-}
-
-resource "aws_dlm_lifecycle_policy" "example" {
-  description        = "example DLM lifecycle policy"
-  execution_role_arn = aws_iam_role.dlm_lifecycle_role.arn
-  state              = "ENABLED"
-
-  policy_details {
-    resource_types = ["VOLUME"]
-
-    schedule {
-      name = "2 weeks of daily snapshots"
-
-      create_rule {
-        interval      = 24
-        interval_unit = "HOURS"
-        times         = ["23:45"]
-      }
-
-      retain_rule {
-        count = 14
-      }
-
-      tags_to_add = {
-        SnapshotCreator = "DLM"
-      }
-
-      copy_tags = false
-
-      cross_region_copy_rule {
-        target    = "us-west-2"
-        encrypted = true
-        cmk_arn   = aws_kms_key.dlm_cross_region_copy_cmk.arn
-        copy_tags = true
-        retain_rule {
-          interval      = 30
-          interval_unit = "DAYS"
-        }
-      }
-    }
-
-    target_tags = {
-      Snapshot = "true"
-    }
-  }
-}
-```
-
-### Example Event Based Policy Usage
-
-```
-data "aws_caller_identity" "current" {}
-
-resource "aws_dlm_lifecycle_policy" "example" {
-  description        = "tf-acc-basic"
-  execution_role_arn = aws_iam_role.example.arn
-
-  policy_details {
-    policy_type = "EVENT_BASED_POLICY"
-
-    action {
-      name = "tf-acc-basic"
-      cross_region_copy {
-        encryption_configuration {}
-        retain_rule {
-          interval      = 15
-          interval_unit = "MONTHS"
-        }
-
-        target = %[1]q
-      }
-    }
-
-    event_source {
-      type = "MANAGED_CWE"
-      parameters {
-        description_regex = "^.*Created for policy: policy-1234567890abcdef0.*$"
-        event_type        = "shareSnapshot"
-        snapshot_owner    = [data.aws_caller_identity.current.account_id]
-      }
-    }
-  }
-}
-
-data "aws_iam_policy" "example" {
-  name = "AWSDataLifecycleManagerServiceRole"
-}
-
-resource "aws_iam_role_policy_attachment" "example" {
-  role       = aws_iam_role.example.id
-  policy_arn = data.aws_iam_policy.example.arn
-}
-```
-
-## Argument Reference
-
-The following arguments are supported:
-
-* `description` - (Required) A description for the DLM lifecycle policy.
-* `execution_role_arn` - (Required) The ARN of an IAM role that is able to be assumed by the DLM service.
-* `policy_details` - (Required) See the [`policy_details` configuration](#policy-details-arguments) block. Max of 1.
-* `state` - (Optional) Whether the lifecycle policy should be enabled or disabled. `ENABLED` or `DISABLED` are valid values. Defaults to `ENABLED`.
-* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
-
-#### Policy Details arguments
-
-* `action` - (Optional) The actions to be performed when the event-based policy is triggered. You can specify only one action per policy. This parameter is required for event-based policies only. If you are creating a snapshot or AMI policy, omit this parameter. See the [`action` configuration](#action-arguments) block.
-* `event_source` - (Optional) The event that triggers the event-based policy. This parameter is required for event-based policies only. If you are creating a snapshot or AMI policy, omit this parameter. See the [`event_source` configuration](#event-source-arguments) block.
-* `resource_types` - (Optional) A list of resource types that should be targeted by the lifecycle policy. Valid values are `VOLUME` and `INSTANCE`.
-* `resource_locations` - (Optional) The location of the resources to backup. If the source resources are located in an AWS Region, specify `CLOUD`. If the source resources are located on an Outpost in your account, specify `OUTPOST`. If you specify `OUTPOST`, Amazon Data Lifecycle Manager backs up all resources of the specified type with matching target tags across all of the Outposts in your account. Valid values are `CLOUD` and `OUTPOST`.
-* `policy_type` - (Optional) The valid target resource types and actions a policy can manage. Specify `EBS_SNAPSHOT_MANAGEMENT` to create a lifecycle policy that manages the lifecycle of Amazon EBS snapshots. Specify `IMAGE_MANAGEMENT` to create a lifecycle policy that manages the lifecycle of EBS-backed AMIs. Specify `EVENT_BASED_POLICY` to create an event-based policy that performs specific actions when a defined event occurs in your AWS account. Default value is `EBS_SNAPSHOT_MANAGEMENT`.
-* `parameters` - (Optional) A set of optional parameters for snapshot and AMI lifecycle policies. See the [`parameters` configuration](#parameters-arguments) block.
-* `schedule` - (Optional) See the [`schedule` configuration](#schedule-arguments) block.
-* `target_tags` (Optional) A map of tag keys and their values. Any resources that match the `resource_types` and are tagged with _any_ of these tags will be targeted.
-
-~> Note: You cannot have overlapping lifecycle policies that share the same `target_tags`. Terraform is unable to detect this at plan time but it will fail during apply.
-
-#### Action arguments
-
-* `cross_region_copy` - (Optional) The rule for copying shared snapshots across Regions. See the [`cross_region_copy` configuration](#action-cross-region-copy-rule-arguments) block.
-* `name` - (Optional) A descriptive name for the action.
-
-##### Action Cross Region Copy Rule arguments
-
-* `encryption_configuration` - (Required) The encryption settings for the copied snapshot. See the [`encryption_configuration`](#encryption-configuration-arguments) block. Max of 1 per action.
-* `retain_rule` - (Required) Specifies the retention rule for cross-Region snapshot copies. See the [`retain_rule`](#cross-region-copy-rule-retain-rule-arguments) block. Max of 1 per action.
-* `target` - (Required) The target Region or the Amazon Resource Name (ARN) of the target Outpost for the snapshot copies.
-
-###### Encryption Configuration arguments
-
-* `cmk_arn` - (Optional) The Amazon Resource Name (ARN) of the AWS KMS key to use for EBS encryption. If this parameter is not specified, the default KMS key for the account is used.
-* `encrypted` - (Required) To encrypt a copy of an unencrypted snapshot when encryption by default is not enabled, enable encryption using this parameter. Copies of encrypted snapshots are encrypted, even if this parameter is false or when encryption by default is not enabled.
-
-#### Event Source arguments
-
-* `parameters` - (Required) Information about the event. See the [`parameters` configuration](#event-source-parameters-arguments) block.
-* `type` - (Required) The source of the event. Currently only managed CloudWatch Events rules are supported. Valid values are `MANAGED_CWE`.
-
-##### Event Source Parameters arguments
-
-* `description_regex` - (Required) The snapshot description that can trigger the policy. The description pattern is specified using a regular expression. The policy runs only if a snapshot with a description that matches the specified pattern is shared with your account.
-* `event_type` - (Required) The type of event. Currently, only `shareSnapshot` events are supported.
-* `snapshot_owner` - (Required) The IDs of the AWS accounts that can trigger policy by sharing snapshots with your account. The policy only runs if one of the specified AWS accounts shares a snapshot with your account.
-
-#### Parameters arguments
-
-* `exclude_boot_volume` - (Optional) Indicates whether to exclude the root volume from snapshots created using CreateSnapshots. The default is `false`.
-* `no_reboot` - (Optional) Applies to AMI lifecycle policies only. Indicates whether targeted instances are rebooted when the lifecycle policy runs. `true` indicates that targeted instances are not rebooted when the policy runs. `false` indicates that target instances are rebooted when the policy runs. The default is `true` (instances are not rebooted).
-
-#### Schedule arguments
-
-* `copy_tags` - (Optional) Copy all user-defined tags on a source volume to snapshots of the volume created by this policy.
-* `create_rule` - (Required) See the [`create_rule`](#create-rule-arguments) block. Max of 1 per schedule.
-* `cross_region_copy_rule` (Optional) - See the [`cross_region_copy_rule`](#cross-region-copy-rule-arguments) block. Max of 3 per schedule.
-* `name` - (Required) A name for the schedule.
-* `deprecate_rule` - (Required) See the [`deprecate_rule`](#deprecate-rule-arguments) block. Max of 1 per schedule.
-* `fast_restore_rule` - (Required) See the [`fast_restore_rule`](#fast-restore-rule-arguments) block. Max of 1 per schedule.
-* `retain_rule` - (Required) See the [`retain_rule`](#retain-rule-arguments) block. Max of 1 per schedule.
-* `share_rule` - (Required) See the [`share_rule`](#share-rule-arguments) block. Max of 1 per schedule.
-* `tags_to_add` - (Optional) A map of tag keys and their values. DLM lifecycle policies will already tag the snapshot with the tags on the volume. This configuration adds extra tags on top of these.
-* `variable_tags` - (Optional) A map of tag keys and variable values, where the values are determined when the policy is executed. Only `$(instance-id)` or `$(timestamp)` are valid values. Can only be used when `resource_types` is `INSTANCE`.
-
-#### Create Rule arguments
-
-* `cron_expression` - (Optional) The schedule, as a Cron expression. The schedule interval must be between 1 hour and 1 year.
-* `interval` - (Optional) How often this lifecycle policy should be evaluated. `1`, `2`,`3`,`4`,`6`,`8`,`12` or `24` are valid values.
-* `interval_unit` - (Optional) The unit for how often the lifecycle policy should be evaluated. `HOURS` is currently the only allowed value and also the default value.
-* `location` - (Optional) Specifies the destination for snapshots created by the policy. To create snapshots in the same Region as the source resource, specify `CLOUD`. To create snapshots on the same Outpost as the source resource, specify `OUTPOST_LOCAL`. If you omit this parameter, `CLOUD` is used by default. If the policy targets resources in an AWS Region, then you must create snapshots in the same Region as the source resource. If the policy targets resources on an Outpost, then you can create snapshots on the same Outpost as the source resource, or in the Region of that Outpost. Valid values are `CLOUD` and `OUTPOST_LOCAL`.
-* `times` - (Optional) A list of times in 24 hour clock format that sets when the lifecycle policy should be evaluated. Max of 1.
-
-#### Deprecate Rule arguments
-
-* `count` - (Optional) Specifies the number of oldest AMIs to deprecate. Must be an integer between `1` and `1000`.
-* `interval` - (Optional) Specifies the period after which to deprecate AMIs created by the schedule. The maximum is 100 years. This is equivalent to 1200 months, 5200 weeks, or 36500 days.
-* `interval_unit` - (Optional) The unit of time for time-based retention. Valid values are `DAYS`, `WEEKS`, `MONTHS`, `YEARS`.
-
-#### Fast Restore Rule arguments
-
-* `availability_zones` - (Required) The Availability Zones in which to enable fast snapshot restore.
-* `count` - (Optional) The number of snapshots to be enabled with fast snapshot restore. Must be an integer between `1` and `1000`.
-* `interval` - (Optional) The amount of time to enable fast snapshot restore. The maximum is 100 years. This is equivalent to 1200 months, 5200 weeks, or 36500 days.
-* `interval_unit` - (Optional) The unit of time for enabling fast snapshot restore. Valid values are `DAYS`, `WEEKS`, `MONTHS`, `YEARS`.
-
-#### Retain Rule arguments
-
-* `count` - (Optional) How many snapshots to keep. Must be an integer between `1` and `1000`.
-* `interval` - (Optional) The amount of time to retain each snapshot. The maximum is 100 years. This is equivalent to 1200 months, 5200 weeks, or 36500 days.
-* `interval_unit` - (Optional) The unit of time for time-based retention. Valid values are `DAYS`, `WEEKS`, `MONTHS`, `YEARS`.
-
-#### Share Rule arguments
-
-* `target_accounts` - (Required) The IDs of the AWS accounts with which to share the snapshots.
-* `interval` - (Optional) The period after which snapshots that are shared with other AWS accounts are automatically unshared.
-* `interval_unit` - (Optional) The unit of time for the automatic unsharing interval. Valid values are `DAYS`, `WEEKS`, `MONTHS`, `YEARS`.
-
-#### Cross Region Copy Rule arguments
-
-* `cmk_arn` - (Optional) The Amazon Resource Name (ARN) of the AWS KMS customer master key (CMK) to use for EBS encryption. If this argument is not specified, the default KMS key for the account is used.
-* `copy_tags` - (Optional) Whether to copy all user-defined tags from the source snapshot to the cross-region snapshot copy.
-* `deprecate_rule` - (Optional) The AMI deprecation rule for cross-Region AMI copies created by the rule. See the [`deprecate_rule`](#cross-region-copy-rule-deprecate-rule-arguments) block.
-* `encrypted` - (Required) To encrypt a copy of an unencrypted snapshot if encryption by default is not enabled, enable encryption using this parameter. Copies of encrypted snapshots are encrypted, even if this parameter is false or if encryption by default is not enabled.
-* `retain_rule` - (Required) The retention rule that indicates how long snapshot copies are to be retained in the destination Region. See the [`retain_rule`](#cross-region-copy-rule-retain-rule-arguments) block. Max of 1 per schedule.
-* `target` - (Required) The target Region or the Amazon Resource Name (ARN) of the target Outpost for the snapshot copies.
-
-#### Cross Region Copy Rule Deprecate Rule arguments
-
-* `interval` - (Required) The period after which to deprecate the cross-Region AMI copies. The period must be less than or equal to the cross-Region AMI copy retention period, and it can't be greater than 10 years. This is equivalent to 120 months, 520 weeks, or 3650 days.
-* `interval_unit` - (Required) The unit of time in which to measure the `interval`. Valid values: `DAYS`, `WEEKS`, `MONTHS`, or `YEARS`.
-
-#### Cross Region Copy Rule Retain Rule arguments
-
-* `interval` - (Required) The amount of time to retain each snapshot. The maximum is 100 years. This is equivalent to 1200 months, 5200 weeks, or 36500 days.
-* `interval_unit` - (Required) The unit of time for time-based retention. Valid values: `DAYS`, `WEEKS`, `MONTHS`, or `YEARS`.
-
-## Attributes Reference
-
-In addition to all arguments above, the following attributes are exported:
-
-* `arn` - Amazon Resource Name (ARN) of the DLM Lifecycle Policy.
-* `id` - Identifier of the DLM Lifecycle Policy.
-* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
-
-## Import
-
-DLM lifecycle policies can be imported by their policy ID:
-
-```
-$ terraform import aws_dlm_lifecycle_policy.example policy-abcdef12345678901
-```
diff --git a/website/docs/r/dms_certificate.html.markdown b/website/docs/r/dms_certificate.html.markdown
index 866a8e686e3..0fb07c4129b 100644
--- a/website/docs/r/dms_certificate.html.markdown
+++ b/website/docs/r/dms_certificate.html.markdown
@@ -30,7 +30,7 @@ resource "aws_dms_certificate" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `certificate_id` - (Required) The certificate identifier.
 
@@ -40,17 +40,26 @@ The following arguments are supported:
 * `certificate_wallet` - (Optional) The contents of the Oracle Wallet certificate for use with SSL, provided as a base64-encoded String. Either `certificate_pem` or `certificate_wallet` must be set.
 * `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `certificate_arn` - The Amazon Resource Name (ARN) for the certificate.
 * `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
 
 ## Import
 
-Certificates can be imported using the `certificate_id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import certificates using the `certificate_id`. For example:
 
+```terraform
+import {
+  to = aws_dms_certificate.test
+  id = "test-dms-certificate-tf"
+}
 ```
-$ terraform import aws_dms_certificate.test test-dms-certificate-tf
+
+Using `terraform import`, import certificates using the `certificate_id`. For example:
+
+```console
+% terraform import aws_dms_certificate.test test-dms-certificate-tf
 ```
diff --git a/website/docs/r/dms_endpoint.html.markdown b/website/docs/r/dms_endpoint.html.markdown
index e08f1f45bc4..0d66bae67e4 100644
--- a/website/docs/r/dms_endpoint.html.markdown
+++ b/website/docs/r/dms_endpoint.html.markdown
@@ -45,7 +45,7 @@ The following arguments are required:
 
 * `endpoint_id` - (Required) Database endpoint identifier. Identifiers must contain from 1 to 255 alphanumeric characters or hyphens, begin with a letter, contain only ASCII letters, digits, and hyphens, not end with a hyphen, and not contain two consecutive hyphens.
 * `endpoint_type` - (Required) Type of endpoint. Valid values are `source`, `target`.
-* `engine_name` - (Required) Type of engine for the endpoint. Valid values are `aurora`, `aurora-postgresql`, `azuredb`, `azure-sql-managed-instance`, `db2`, `db2-zos`, `docdb`, `dynamodb`, `elasticsearch`, `kafka`, `kinesis`, `mariadb`, `mongodb`, `mysql`, `opensearch`, `oracle`, `postgres`, `redshift`, `s3`, `sqlserver`, `sybase`. Please note that some of engine names are available only for `target` endpoint type (e.g. `redshift`).
+* `engine_name` - (Required) Type of engine for the endpoint. Valid values are `aurora`, `aurora-postgresql`, `azuredb`, `azure-sql-managed-instance`, `babelfish`, `db2`, `db2-zos`, `docdb`, `dynamodb`, `elasticsearch`, `kafka`, `kinesis`, `mariadb`, `mongodb`, `mysql`, `opensearch`, `oracle`, `postgres`, `redshift`, `s3`, `sqlserver`, `sybase`. Please note that some of engine names are available only for `target` endpoint type (e.g. `redshift`).
 * `kms_key_arn` - (Required when `engine_name` is `mongodb`, cannot be set when `engine_name` is `s3`, optional otherwise) ARN for the KMS key that will be used to encrypt the connection parameters. If you do not specify a value for `kms_key_arn`, then AWS DMS will use your default encryption key. AWS KMS creates the default encryption key for your AWS account. Your AWS account has a different default encryption key for each AWS region. To encrypt an S3 target with a KMS Key, use the parameter `s3_settings.server_side_encryption_kms_key_id`. When `engine_name` is `redshift`, `kms_key_arn` is the KMS Key for the Redshift target and the parameter `redshift_settings.server_side_encryption_kms_key_id` encrypts the S3 intermediate storage.
 
 The following arguments are optional:
@@ -178,6 +178,7 @@ The following arguments are optional:
 * `encoding_type` - (Optional) Type of encoding to use. Value values are `rle_dictionary`, `plain`, and `plain_dictionary`. Default is `rle_dictionary`.
 * `encryption_mode` - (Optional) Server-side encryption mode that you want to encrypt your .csv or .parquet object files copied to S3. Valid values are `SSE_S3` and `SSE_KMS`. Default is `SSE_S3`.
 * `external_table_definition` - (Optional) JSON document that describes how AWS DMS should interpret the data.
+* `glue_catalog_generation` - (Optional) Whether to integrate AWS Glue Data Catalog with an Amazon S3 target. See [Using AWS Glue Data Catalog with an Amazon S3 target for AWS DMS](https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Target.S3.html#CHAP_Target.S3.GlueCatalog) for more information. Default is `false`.
 * `ignore_header_rows` - (Optional) When this value is set to `1`, DMS ignores the first row header in a .csv file. Default is `0`.
 * `include_op_for_full_load` - (Optional) Whether to enable a full load to write INSERT operations to the .csv output files only to indicate how the rows were added to the source database. Default is `false`.
 * `max_file_size` - (Optional) Maximum size (in KB) of any .csv file to be created while migrating to an S3 target during full load. Valid values are from `1` to `1048576`. Default is `1048576` (1 GB).
@@ -192,9 +193,9 @@ The following arguments are optional:
 * `use_csv_no_sup_value` - (Optional) Whether to use `csv_no_sup_value` for columns not included in the supplemental log.
 * `use_task_start_time_for_full_load_timestamp` - (Optional) When set to true, uses the task start time as the timestamp column value instead of the time data is written to target. For full load, when set to true, each row of the timestamp column contains the task start time. For CDC loads, each row of the timestamp column contains the transaction commit time. When set to false, the full load timestamp in the timestamp column increments with the time data arrives at the target. Default is `false`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `endpoint_arn` - ARN for the endpoint.
 * `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
@@ -208,8 +209,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Endpoints can be imported using the `endpoint_id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import endpoints using the `endpoint_id`. For example:
 
+```terraform
+import {
+  to = aws_dms_endpoint.test
+  id = "test-dms-endpoint-tf"
+}
 ```
-$ terraform import aws_dms_endpoint.test test-dms-endpoint-tf
+
+Using `terraform import`, import endpoints using the `endpoint_id`. For example:
+
+```console
+% terraform import aws_dms_endpoint.test test-dms-endpoint-tf
 ```
diff --git a/website/docs/r/dms_event_subscription.html.markdown b/website/docs/r/dms_event_subscription.html.markdown
index d57196cf210..6b8b401094b 100644
--- a/website/docs/r/dms_event_subscription.html.markdown
+++ b/website/docs/r/dms_event_subscription.html.markdown
@@ -29,7 +29,7 @@ resource "aws_dms_event_subscription" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) Name of event subscription.
 * `enabled` - (Optional, Default: true) Whether the event subscription should be enabled.
@@ -39,9 +39,9 @@ The following arguments are supported:
 * `sns_topic_arn` - (Required) SNS topic arn to send events on.
 * `tags` - (Optional) Map of resource tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name (ARN) of the DMS Event Subscription.
 * `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
@@ -56,8 +56,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Event subscriptions can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import event subscriptions using the `name`. For example:
 
+```terraform
+import {
+  to = aws_dms_event_subscription.test
+  id = "my-awesome-event-subscription"
+}
 ```
-$ terraform import aws_dms_event_subscription.test my-awesome-event-subscription
+
+Using `terraform import`, import event subscriptions using the `name`. For example:
+
+```console
+% terraform import aws_dms_event_subscription.test my-awesome-event-subscription
 ```
diff --git a/website/docs/r/dms_replication_config.html.markdown b/website/docs/r/dms_replication_config.html.markdown
new file mode 100644
index 00000000000..a4274564dc2
--- /dev/null
+++ b/website/docs/r/dms_replication_config.html.markdown
@@ -0,0 +1,105 @@
+---
+subcategory: "DMS (Database Migration)"
+layout: "aws"
+page_title: "AWS: aws_dms_replication_config"
+description: |-
+  Provides a DMS Serverless replication config resource.
+---
+
+# Resource: aws_dms_replication_config
+
+Provides a DMS Serverless replication config resource.
+
+~> **NOTE:** Changing most arguments will stop the replication if it is running. You can set `start_replication` to resume the replication afterwards.
+
+## Example Usage
+
+```terraform
+resource "aws_dms_replication_config" "name" {
+  replication_config_identifier = "test-dms-serverless-replication-tf"
+  resource_identifier           = "test-dms-serverless-replication-tf"
+  replication_type              = "cdc"
+  source_endpoint_arn           = aws_dms_endpoint.source.endpoint_arn
+  target_endpoint_arn           = aws_dms_endpoint.target.endpoint_arn
+  table_mappings                = <<EOF
+  {
+    "rules":[{"rule-type":"selection","rule-id":"1","rule-name":"1","object-locator":{"schema-name":"%%","table-name":"%%", "rule-action":"include"}]
+  }
+EOF
+
+  start_replication = true
+
+  compute_config {
+    replication_subnet_group_id  = aws_dms_replication_subnet_group.default.replication_subnet_group_id
+    max_capacity_units           = "64"
+    min_capacity_units           = "2"
+    preferred_maintenance_window = "sun:23:45-mon:00:30"
+  }
+}
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `compute_config` - (Required) Configuration block for provisioning an DMS Serverless replication.
+* `start_replication` - (Optional) Whether to run or stop the serverless replication, default is false.
+* `replication_config_identifier` - (Required) Unique identifier that you want to use to create the config.
+* `replication_type` - (Required) The migration type. Can be one of `full-load | cdc | full-load-and-cdc`.
+* `source_endpoint_arn` - (Required) The Amazon Resource Name (ARN) string that uniquely identifies the source endpoint.
+* `table_mappings` - (Required) An escaped JSON string that contains the table mappings. For information on table mapping see [Using Table Mapping with an AWS Database Migration Service Task to Select and Filter Data](http://docs.aws.amazon.com/dms/latest/userguide/CHAP_Tasks.CustomizingTasks.TableMapping.html)
+* `target_endpoint_arn` - (Required) The Amazon Resource Name (ARN) string that uniquely identifies the target endpoint.
+* `replication_settings` - (Optional) An escaped JSON string that are used to provision this replication configuration. For example, [Change processing tuning settings](https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Tasks.CustomizingTasks.TaskSettings.ChangeProcessingTuning.html)
+* `resource_identifier` - (Optional) Unique value or name that you set for a given resource that can be used to construct an Amazon Resource Name (ARN) for that resource. For more information, see [Fine-grained access control using resource names and tags](https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Security.html#CHAP_Security.FineGrainedAccess)
+* `supplemental_settings` - (Optional) JSON settings for specifying supplemental data. For more information see [Specifying supplemental data for task settings](https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Tasks.TaskData.html)
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+`compute_config` block support the following:
+
+* `availability_zone` - (Optional) The Availability Zone where the DMS Serverless replication using this configuration will run. The default value is a random.
+* `dns_name_servers` - (Optional) A list of custom DNS name servers supported for the DMS Serverless replication to access your source or target database.
+* `kms_key_id` - (Optional) An Key Management Service (KMS) key Amazon Resource Name (ARN) that is used to encrypt the data during DMS Serverless replication. If you don't specify a value for the KmsKeyId parameter, DMS uses your default encryption key.
+* `max_capacity_units` - (Required) Specifies the maximum value of the DMS capacity units (DCUs) for which a given DMS Serverless replication can be provisioned. A single DCU is 2GB of RAM, with 2 DCUs as the minimum value allowed. The list of valid DCU values includes 2, 4, 8, 16, 32, 64, 128, 192, 256, and 384.
+* `min_capacity_units` - (Optional) Specifies the minimum value of the DMS capacity units (DCUs) for which a given DMS Serverless replication can be provisioned. The list of valid DCU values includes 2, 4, 8, 16, 32, 64, 128, 192, 256, and 384. If this value isn't set DMS scans the current activity of available source tables to identify an optimum setting for this parameter.
+* `multi_az` - (Optional) Specifies if the replication instance is a multi-az deployment. You cannot set the `availability_zone` parameter if the `multi_az` parameter is set to `true`.
+* `preferred_maintenance_window` - (Optional) The weekly time range during which system maintenance can occur, in Universal Coordinated Time (UTC).
+
+    - Default: A 30-minute window selected at random from an 8-hour block of time per region, occurring on a random day of the week.
+    - Format: `ddd:hh24:mi-ddd:hh24:mi`
+    - Valid Days: `mon, tue, wed, thu, fri, sat, sun`
+    - Constraints: Minimum 30-minute window.
+
+* `replication_subnet_group_id` - (Optional) Specifies a subnet group identifier to associate with the DMS Serverless replication.
+* `vpc_security_group_ids` - (Optional) Specifies the virtual private cloud (VPC) security group to use with the DMS Serverless replication. The VPC security group must work with the VPC containing the replication.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) for the serverless replication config.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `60m`)
+* `update` - (Default `60m`)
+* `delete` - (Default `60m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import replication configs using the `arn`. For example:
+
+```terraform
+import {
+  to = aws_dms_replication_config.example
+  id = "arn:aws:dms:us-east-1:123456789012:replication-config:UX6OL6MHMMJKFFOXE3H7LLJCMEKBDUG4ZV7DRSI"
+}
+```
+
+Using `terraform import`, import a replication config using the `arn`. For example:
+
+```console
+% terraform import aws_dms_replication_config.example arn:aws:dms:us-east-1:123456789012:replication-config:UX6OL6MHMMJKFFOXE3H7LLJCMEKBDUG4ZV7DRSI
+```
diff --git a/website/docs/r/dms_replication_instance.html.markdown b/website/docs/r/dms_replication_instance.html.markdown
index 815aae44c3b..2364881a48b 100644
--- a/website/docs/r/dms_replication_instance.html.markdown
+++ b/website/docs/r/dms_replication_instance.html.markdown
@@ -96,7 +96,7 @@ resource "aws_dms_replication_instance" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `allocated_storage` - (Optional, Default: 50, Min: 5, Max: 6144) The amount of storage (in gigabytes) to be initially allocated for the replication instance.
 * `allow_major_version_upgrade` - (Optional, Default: false) Indicates that major version upgrades are allowed.
@@ -106,6 +106,7 @@ The following arguments are supported:
 * `engine_version` - (Optional) The engine version number of the replication instance.
 * `kms_key_arn` - (Optional) The Amazon Resource Name (ARN) for the KMS key that will be used to encrypt the connection parameters. If you do not specify a value for `kms_key_arn`, then AWS DMS will use your default encryption key. AWS KMS creates the default encryption key for your AWS account. Your AWS account has a different default encryption key for each AWS region.
 * `multi_az` - (Optional) Specifies if the replication instance is a multi-az deployment. You cannot set the `availability_zone` parameter if the `multi_az` parameter is set to `true`.
+* `network_type` - (Optional) The type of IP address protocol used by a replication instance. Valid values: `IPV4`, `DUAL`.
 * `preferred_maintenance_window` - (Optional) The weekly time range during which system maintenance can occur, in Universal Coordinated Time (UTC).
 
     - Default: A 30-minute window selected at random from an 8-hour block of time per region, occurring on a random day of the week.
@@ -126,9 +127,9 @@ The following arguments are supported:
 * `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 * `vpc_security_group_ids` - (Optional) A list of VPC security group IDs to be used with the replication instance. The VPC security groups must work with the VPC containing the replication instance.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `replication_instance_arn` - The Amazon Resource Name (ARN) of the replication instance.
 * `replication_instance_private_ips` -  A list of the private IP addresses of the replication instance.
@@ -145,8 +146,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Replication instances can be imported using the `replication_instance_id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import replication instances using the `replication_instance_id`. For example:
 
+```terraform
+import {
+  to = aws_dms_replication_instance.test
+  id = "test-dms-replication-instance-tf"
+}
 ```
-$ terraform import aws_dms_replication_instance.test test-dms-replication-instance-tf
+
+Using `terraform import`, import replication instances using the `replication_instance_id`. For example:
+
+```console
+% terraform import aws_dms_replication_instance.test test-dms-replication-instance-tf
 ```
diff --git a/website/docs/r/dms_replication_subnet_group.html.markdown b/website/docs/r/dms_replication_subnet_group.html.markdown
index 48e1b26eec8..dcb6f6f215c 100644
--- a/website/docs/r/dms_replication_subnet_group.html.markdown
+++ b/website/docs/r/dms_replication_subnet_group.html.markdown
@@ -80,16 +80,16 @@ resource "aws_dms_replication_subnet_group" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `replication_subnet_group_description` - (Required) Description for the subnet group.
 * `replication_subnet_group_id` - (Required) Name for the replication subnet group. This value is stored as a lowercase string. It must contain no more than 255 alphanumeric characters, periods, spaces, underscores, or hyphens and cannot be `default`.
 * `subnet_ids` - (Required) List of at least 2 EC2 subnet IDs for the subnet group. The subnets must cover at least 2 availability zones.
 * `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
 * `vpc_id` - The ID of the VPC the subnet group is in.
@@ -104,8 +104,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Replication subnet groups can be imported using the `replication_subnet_group_id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import replication subnet groups using the `replication_subnet_group_id`. For example:
 
+```terraform
+import {
+  to = aws_dms_replication_subnet_group.test
+  id = "test-dms-replication-subnet-group-tf"
+}
 ```
-$ terraform import aws_dms_replication_subnet_group.test test-dms-replication-subnet-group-tf
+
+Using `terraform import`, import replication subnet groups using the `replication_subnet_group_id`. For example:
+
+```console
+% terraform import aws_dms_replication_subnet_group.test test-dms-replication-subnet-group-tf
 ```
diff --git a/website/docs/r/dms_replication_task.html.markdown b/website/docs/r/dms_replication_task.html.markdown
index 35f486cbbd7..671e007105a 100644
--- a/website/docs/r/dms_replication_task.html.markdown
+++ b/website/docs/r/dms_replication_task.html.markdown
@@ -35,7 +35,7 @@ resource "aws_dms_replication_task" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `cdc_start_position` - (Optional, Conflicts with `cdc_start_time`) Indicates when you want a change data capture (CDC) operation to start. The value can be in date, checkpoint, or LSN/SCN format depending on the source engine. For more information, see [Determining a CDC native start point](https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Task.CDC.html#CHAP_Task.CDC.StartPoint.Native).
 * `cdc_start_time` - (Optional, Conflicts with `cdc_start_position`) The Unix timestamp integer for the start of the Change Data Capture (CDC) operation.
@@ -51,22 +51,31 @@ The following arguments are supported:
 * `replication_task_settings` - (Optional) An escaped JSON string that contains the task settings. For a complete list of task settings, see [Task Settings for AWS Database Migration Service Tasks](http://docs.aws.amazon.com/dms/latest/userguide/CHAP_Tasks.CustomizingTasks.TaskSettings.html).
 * `source_endpoint_arn` - (Required) The Amazon Resource Name (ARN) string that uniquely identifies the source endpoint.
 * `start_replication_task` - (Optional) Whether to run or stop the replication task.
-* `status` - Replication Task status.
 * `table_mappings` - (Required) An escaped JSON string that contains the table mappings. For information on table mapping see [Using Table Mapping with an AWS Database Migration Service Task to Select and Filter Data](http://docs.aws.amazon.com/dms/latest/userguide/CHAP_Tasks.CustomizingTasks.TableMapping.html)
 * `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 * `target_endpoint_arn` - (Required) The Amazon Resource Name (ARN) string that uniquely identifies the target endpoint.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `replication_task_arn` - The Amazon Resource Name (ARN) for the replication task.
+* `status` - Replication Task status.
 * `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
 
 ## Import
 
-Replication tasks can be imported using the `replication_task_id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import replication tasks using the `replication_task_id`. For example:
 
+```terraform
+import {
+  to = aws_dms_replication_task.test
+  id = "test-dms-replication-task-tf"
+}
 ```
-$ terraform import aws_dms_replication_task.test test-dms-replication-task-tf
+
+Using `terraform import`, import replication tasks using the `replication_task_id`. For example:
+
+```console
+% terraform import aws_dms_replication_task.test test-dms-replication-task-tf
 ```
diff --git a/website/docs/r/dms_s3_endpoint.html.markdown b/website/docs/r/dms_s3_endpoint.html.markdown
index fd1be993c78..e28e622eb2e 100644
--- a/website/docs/r/dms_s3_endpoint.html.markdown
+++ b/website/docs/r/dms_s3_endpoint.html.markdown
@@ -85,6 +85,7 @@ resource "aws_dms_s3_endpoint" "example" {
   timestamp_column_name                       = "tx_commit_time"
   use_csv_no_sup_value                        = false
   use_task_start_time_for_full_load_timestamp = true
+  glue_catalog_generation                     = true
 
   depends_on = [aws_iam_role_policy.example]
 }
@@ -129,6 +130,7 @@ The following arguments are optional:
 * `encoding_type` - (Optional) Type of encoding to use. Value values are `rle_dictionary`, `plain`, and `plain_dictionary`. (AWS default is `rle_dictionary`.)
 * `encryption_mode` - (Optional) Server-side encryption mode that you want to encrypt your .csv or .parquet object files copied to S3. Valid values are `SSE_S3` and `SSE_KMS`. (AWS default is `SSE_S3`.) (Ignored for source endpoints -- only `SSE_S3` is valid.)
 * `expected_bucket_owner` - (Optional) Bucket owner to prevent sniping. Value is an AWS account ID.
+* `glue_catalog_generation` - (Optional) Whether to integrate AWS Glue Data Catalog with an Amazon S3 target. See [Using AWS Glue Data Catalog with an Amazon S3 target for AWS DMS](https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Target.S3.html#CHAP_Target.S3.GlueCatalog) for more information. Default is `false`.
 * `ignore_header_rows` - (Optional, Force New) When this value is set to `1`, DMS ignores the first row header in a .csv file. (AWS default is `0`.)
 * `include_op_for_full_load` - (Optional) Whether to enable a full load to write INSERT operations to the .csv output files only to indicate how the rows were added to the source database. Default is `false`.
 * `kms_key_arn` - (Optional) ARN for the KMS key that will be used to encrypt the connection parameters. If you do not specify a value for `kms_key_arn`, then AWS DMS will use your default encryption key. AWS KMS creates the default encryption key for your AWS account. Your AWS account has a different default encryption key for each AWS region.
@@ -145,9 +147,9 @@ The following arguments are optional:
 * `use_csv_no_sup_value` - (Optional) Whether to use `csv_no_sup_value` for columns not included in the supplemental log. (Ignored for source endpoints.)
 * `use_task_start_time_for_full_load_timestamp` - (Optional) When set to `true`, uses the task start time as the timestamp column value instead of the time data is written to target. For full load, when set to `true`, each row of the timestamp column contains the task start time. For CDC loads, each row of the timestamp column contains the transaction commit time.When set to false, the full load timestamp in the timestamp column increments with the time data arrives at the target. Default is `false`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `endpoint_arn` - ARN for the endpoint.
 * `engine_display_name` - Expanded name for the engine name.
@@ -164,8 +166,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Endpoints can be imported using the `endpoint_id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import endpoints using the `endpoint_id`. For example:
 
+```terraform
+import {
+  to = aws_dms_s3_endpoint.example
+  id = "example-dms-endpoint-tf"
+}
 ```
-$ terraform import aws_dms_s3_endpoint.example example-dms-endpoint-tf
+
+Using `terraform import`, import endpoints using the `endpoint_id`. For example:
+
+```console
+% terraform import aws_dms_s3_endpoint.example example-dms-endpoint-tf
 ```
diff --git a/website/docs/r/docdb_cluster.html.markdown b/website/docs/r/docdb_cluster.html.markdown
index 4fae4a271d8..16d80874e73 100644
--- a/website/docs/r/docdb_cluster.html.markdown
+++ b/website/docs/r/docdb_cluster.html.markdown
@@ -40,8 +40,9 @@ resource "aws_docdb_cluster" "docdb" {
 For more detailed documentation about each argument, refer to
 the [AWS official documentation](https://docs.aws.amazon.com/cli/latest/reference/docdb/create-db-cluster.html).
 
-The following arguments are supported:
+This argument supports the following arguments:
 
+* `allow_major_version_upgrade` - (Optional) A value that indicates whether major version upgrades are allowed. Constraints: You must allow major version upgrades when specifying a value for the EngineVersion parameter that is a different major version than the DB cluster's current version.
 * `apply_immediately` - (Optional) Specifies whether any cluster modifications
      are applied immediately, or during the next maintenance window. Default is
      `false`.
@@ -76,9 +77,9 @@ Default: A 30-minute window selected at random from an 8-hour block of time per
 * `vpc_security_group_ids` - (Optional) List of VPC security groups to associate
   with the Cluster
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name (ARN) of cluster
 * `cluster_members` – List of DocumentDB Instances that are a part of this cluster
@@ -100,8 +101,17 @@ any cleanup task during the destroying process.
 
 ## Import
 
-DocumentDB Clusters can be imported using the `cluster_identifier`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DocumentDB Clusters using the `cluster_identifier`. For example:
 
+```terraform
+import {
+  to = aws_docdb_cluster.docdb_cluster
+  id = "docdb-prod-cluster"
+}
 ```
-$ terraform import aws_docdb_cluster.docdb_cluster docdb-prod-cluster
+
+Using `terraform import`, import DocumentDB Clusters using the `cluster_identifier`. For example:
+
+```console
+% terraform import aws_docdb_cluster.docdb_cluster docdb-prod-cluster
 ```
diff --git a/website/docs/r/docdb_cluster_instance.html.markdown b/website/docs/r/docdb_cluster_instance.html.markdown
index 629a59f0331..08a011e9ddc 100644
--- a/website/docs/r/docdb_cluster_instance.html.markdown
+++ b/website/docs/r/docdb_cluster_instance.html.markdown
@@ -40,13 +40,14 @@ resource "aws_docdb_cluster" "default" {
 For more detailed documentation about each argument, refer to
 the [AWS official documentation](https://docs.aws.amazon.com/cli/latest/reference/docdb/create-db-instance.html).
 
-The following arguments are supported:
+This argument supports the following arguments:
 
 * `apply_immediately` - (Optional) Specifies whether any database modifications
      are applied immediately, or during the next maintenance window. Default is`false`.
 * `auto_minor_version_upgrade` - (Optional) This parameter does not apply to Amazon DocumentDB. Amazon DocumentDB does not perform minor version upgrades regardless of the value set (see [docs](https://docs.aws.amazon.com/documentdb/latest/developerguide/API_DBInstance.html)). Default `true`.
 * `availability_zone` - (Optional, Computed) The EC2 Availability Zone that the DB instance is created in. See [docs](https://docs.aws.amazon.com/documentdb/latest/developerguide/API_CreateDBInstance.html) about the details.
 * `cluster_identifier` - (Required) The identifier of the [`aws_docdb_cluster`](/docs/providers/aws/r/docdb_cluster.html) in which to launch this instance.
+* `copy_tags_to_snapshot` – (Optional, boolean) Copy all DB instance `tags` to snapshots. Default is `false`.
 * `enable_performance_insights` - (Optional) A value that indicates whether to enable Performance Insights for the DB Instance. Default `false`. See [docs] (https://docs.aws.amazon.com/documentdb/latest/developerguide/performance-insights.html) about the details.
 * `engine` - (Optional) The name of the database engine to be used for the DocumentDB instance. Defaults to `docdb`. Valid Values: `docdb`.
 * `identifier` - (Optional, Forces new resource) The identifier for the DocumentDB instance, if omitted, Terraform will assign a random, unique identifier.
@@ -54,6 +55,13 @@ The following arguments are supported:
 * `instance_class` - (Required) The instance class to use. For details on CPU and memory, see [Scaling for DocumentDB Instances][2].
   DocumentDB currently supports the below instance classes.
   Please see [AWS Documentation][4] for complete details.
+    - db.r6g.large
+    - db.r6g.xlarge
+    - db.r6g.2xlarge
+    - db.r6g.4xlarge
+    - db.r6g.8xlarge
+    - db.r6g.12xlarge
+    - db.r6g.16xlarge
     - db.r5.large
     - db.r5.xlarge
     - db.r5.2xlarge
@@ -66,6 +74,7 @@ The following arguments are supported:
     - db.r4.4xlarge
     - db.r4.8xlarge
     - db.r4.16xlarge
+    - db.t4g.medium
     - db.t3.medium
 * `performance_insights_kms_key_id` - (Optional) The KMS key identifier is the key ARN, key ID, alias ARN, or alias name for the KMS key. If you do not specify a value for PerformanceInsightsKMSKeyId, then Amazon DocumentDB uses your default KMS key.
 * `preferred_maintenance_window` - (Optional) The window to perform maintenance in.
@@ -73,9 +82,9 @@ The following arguments are supported:
 * `promotion_tier` - (Optional) Default 0. Failover Priority setting on instance level. The reader who has lower tier has higher priority to get promoter to writer.
 * `tags` - (Optional) A map of tags to assign to the instance. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name (ARN) of cluster instance
 * `db_subnet_group_name` - The DB subnet group to associate with this DB instance.
@@ -107,8 +116,17 @@ the time required to take snapshots
 
 ## Import
 
-DocumentDB Cluster Instances can be imported using the `identifier`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DocumentDB Cluster Instances using the `identifier`. For example:
 
+```terraform
+import {
+  to = aws_docdb_cluster_instance.prod_instance_1
+  id = "aurora-cluster-instance-1"
+}
 ```
-$ terraform import aws_docdb_cluster_instance.prod_instance_1 aurora-cluster-instance-1
+
+Using `terraform import`, import DocumentDB Cluster Instances using the `identifier`. For example:
+
+```console
+% terraform import aws_docdb_cluster_instance.prod_instance_1 aurora-cluster-instance-1
 ```
diff --git a/website/docs/r/docdb_cluster_parameter_group.html.markdown b/website/docs/r/docdb_cluster_parameter_group.html.markdown
index 81914ae12cb..06367b4797c 100644
--- a/website/docs/r/docdb_cluster_parameter_group.html.markdown
+++ b/website/docs/r/docdb_cluster_parameter_group.html.markdown
@@ -27,7 +27,7 @@ resource "aws_docdb_cluster_parameter_group" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Optional, Forces new resource) The name of the DocumentDB cluster parameter group. If omitted, Terraform will assign a random, unique name.
 * `name_prefix` - (Optional, Forces new resource) Creates a unique name beginning with the specified prefix. Conflicts with `name`.
@@ -44,9 +44,9 @@ Parameter blocks support the following:
 * `value` - (Required) The value of the DocumentDB parameter.
 * `apply_method` - (Optional) Valid values are `immediate` and `pending-reboot`. Defaults to `pending-reboot`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The DocumentDB cluster parameter group name.
 * `arn` - The ARN of the DocumentDB cluster parameter group.
@@ -54,8 +54,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-DocumentDB Cluster Parameter Groups can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DocumentDB Cluster Parameter Groups using the `name`. For example:
 
+```terraform
+import {
+  to = aws_docdb_cluster_parameter_group.cluster_pg
+  id = "production-pg-1"
+}
 ```
-$ terraform import aws_docdb_cluster_parameter_group.cluster_pg production-pg-1
+
+Using `terraform import`, import DocumentDB Cluster Parameter Groups using the `name`. For example:
+
+```console
+% terraform import aws_docdb_cluster_parameter_group.cluster_pg production-pg-1
 ```
diff --git a/website/docs/r/docdb_cluster_snapshot.html.markdown b/website/docs/r/docdb_cluster_snapshot.html.markdown
index 90f915304a1..e5b3e19db73 100644
--- a/website/docs/r/docdb_cluster_snapshot.html.markdown
+++ b/website/docs/r/docdb_cluster_snapshot.html.markdown
@@ -21,14 +21,14 @@ resource "aws_docdb_cluster_snapshot" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `db_cluster_identifier` - (Required) The DocumentDB Cluster Identifier from which to take the snapshot.
 * `db_cluster_snapshot_identifier` - (Required) The Identifier for the snapshot.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `availability_zones` - List of EC2 Availability Zones that instances in the DocumentDB cluster snapshot can be restored in.
 * `db_cluster_snapshot_arn` - The Amazon Resource Name (ARN) for the DocumentDB Cluster Snapshot.
@@ -49,8 +49,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_docdb_cluster_snapshot` can be imported by using the cluster snapshot identifier, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_docdb_cluster_snapshot` using the cluster snapshot identifier. For example:
 
+```terraform
+import {
+  to = aws_docdb_cluster_snapshot.example
+  id = "my-cluster-snapshot"
+}
 ```
-$ terraform import aws_docdb_cluster_snapshot.example my-cluster-snapshot
+
+Using `terraform import`, import `aws_docdb_cluster_snapshot` using the cluster snapshot identifier. For example:
+
+```console
+% terraform import aws_docdb_cluster_snapshot.example my-cluster-snapshot
 ```
diff --git a/website/docs/r/docdb_event_subscription.html.markdown b/website/docs/r/docdb_event_subscription.html.markdown
index 35bc54b301f..26347c0f508 100644
--- a/website/docs/r/docdb_event_subscription.html.markdown
+++ b/website/docs/r/docdb_event_subscription.html.markdown
@@ -37,7 +37,7 @@ resource "aws_docdb_event_subscription" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Optional) The name of the DocumentDB event subscription. By default generated by Terraform.
 * `name_prefix` - (Optional) The name of the DocumentDB event subscription. Conflicts with `name`.
@@ -48,9 +48,9 @@ The following arguments are supported:
 * `enabled` - (Optional) A boolean flag to enable/disable the subscription. Defaults to true.
 * `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The name of the DocumentDB event notification subscription
 * `arn` - The Amazon Resource Name of the DocumentDB event notification subscription
@@ -67,8 +67,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-DocumentDB Event Subscriptions can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DocumentDB Event Subscriptions using the `name`. For example:
 
+```terraform
+import {
+  to = aws_docdb_event_subscription.example
+  id = "event-sub"
+}
 ```
-$ terraform import aws_docdb_event_subscription.example event-sub
+
+Using `terraform import`, import DocumentDB Event Subscriptions using the `name`. For example:
+
+```console
+% terraform import aws_docdb_event_subscription.example event-sub
 ```
diff --git a/website/docs/r/docdb_global_cluster.html.markdown b/website/docs/r/docdb_global_cluster.html.markdown
index 04a607264e2..c82a00922b2 100644
--- a/website/docs/r/docdb_global_cluster.html.markdown
+++ b/website/docs/r/docdb_global_cluster.html.markdown
@@ -59,6 +59,10 @@ resource "aws_docdb_cluster" "secondary" {
   cluster_identifier        = "test-secondary-cluster"
   global_cluster_identifier = aws_docdb_global_cluster.example.id
   db_subnet_group_name      = "default"
+
+  depends_on = [
+    aws_docdb_cluster.primary
+  ]
 }
 
 resource "aws_docdb_cluster_instance" "secondary" {
@@ -98,7 +102,7 @@ resource "aws_docdb_global_cluster" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `global_cluster_identifier` - (Required, Forces new resources) The global cluster identifier.
 * `database_name` - (Optional, Forces new resources) Name for an automatically created database on cluster creation.
@@ -109,9 +113,9 @@ The following arguments are supported:
 * `source_db_cluster_identifier` - (Optional) Amazon Resource Name (ARN) to use as the primary DB Cluster of the Global Cluster on creation. Terraform cannot perform drift detection of this value.
 * `storage_encrypted` - (Optional, Forces new resources) Specifies whether the DB cluster is encrypted. The default is `false` unless `source_db_cluster_identifier` is specified and encrypted. Terraform will only perform drift detection if a configuration value is provided.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Global Cluster Amazon Resource Name (ARN)
 * `global_cluster_members` - Set of objects containing Global Cluster members.
@@ -130,13 +134,22 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_docdb_global_cluster` can be imported by using the Global Cluster identifier, e.g.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_docdb_global_cluster` using the Global Cluster identifier. For example:
 
+```terraform
+import {
+  to = aws_docdb_global_cluster.example
+  id = "example"
+}
 ```
-$ terraform import aws_docdb_global_cluster.example example
+
+Using `terraform import`, import `aws_docdb_global_cluster` using the Global Cluster identifier. For example:
+
+```console
+% terraform import aws_docdb_global_cluster.example example
 ```
 
-Certain resource arguments, like `source_db_cluster_identifier`, do not have an API method for reading the information after creation. If the argument is set in the Terraform configuration on an imported resource, Terraform will always show a difference. To workaround this behavior, either omit the argument from the Terraform configuration or use [`ignore_changes`](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html#ignore_changes) to hide the difference, e.g.
+Certain resource arguments, like `source_db_cluster_identifier`, do not have an API method for reading the information after creation. If the argument is set in the Terraform configuration on an imported resource, Terraform will always show a difference. To workaround this behavior, either omit the argument from the Terraform configuration or use [`ignore_changes`](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html#ignore_changes) to hide the difference. For example:
 
 ```terraform
 resource "aws_docdb_global_cluster" "example" {
diff --git a/website/docs/r/docdb_subnet_group.html.markdown b/website/docs/r/docdb_subnet_group.html.markdown
index 84067dfe03c..318bd7ec317 100644
--- a/website/docs/r/docdb_subnet_group.html.markdown
+++ b/website/docs/r/docdb_subnet_group.html.markdown
@@ -25,7 +25,7 @@ resource "aws_docdb_subnet_group" "default" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Optional, Forces new resource) The name of the docDB subnet group. If omitted, Terraform will assign a random, unique name.
 * `name_prefix` - (Optional, Forces new resource) Creates a unique name beginning with the specified prefix. Conflicts with `name`.
@@ -33,9 +33,9 @@ The following arguments are supported:
 * `subnet_ids` - (Required) A list of VPC subnet IDs.
 * `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The docDB subnet group name.
 * `arn` - The ARN of the docDB subnet group.
@@ -43,8 +43,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-DocumentDB Subnet groups can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DocumentDB Subnet groups using the `name`. For example:
 
+```terraform
+import {
+  to = aws_docdb_subnet_group.default
+  id = "production-subnet-group"
+}
 ```
-$ terraform import aws_docdb_subnet_group.default production-subnet-group
+
+Using `terraform import`, import DocumentDB Subnet groups using the `name`. For example:
+
+```console
+% terraform import aws_docdb_subnet_group.default production-subnet-group
 ```
diff --git a/website/docs/r/dx_bgp_peer.html.markdown b/website/docs/r/dx_bgp_peer.html.markdown
index e899eee1954..be57102deaf 100644
--- a/website/docs/r/dx_bgp_peer.html.markdown
+++ b/website/docs/r/dx_bgp_peer.html.markdown
@@ -22,7 +22,7 @@ resource "aws_dx_bgp_peer" "peer" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `address_family` - (Required) The address family for the BGP peer. `ipv4 ` or `ipv6`.
 * `bgp_asn` - (Required) The autonomous system (AS) number for Border Gateway Protocol (BGP) configuration.
@@ -33,9 +33,9 @@ Required for IPv4 BGP peers on public virtual interfaces.
 * `customer_address` - (Optional) The IPv4 CIDR destination address to which Amazon should send traffic.
 Required for IPv4 BGP peers on public virtual interfaces.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the BGP peer resource.
 * `bgp_status` - The Up/Down state of the BGP peer.
diff --git a/website/docs/r/dx_connection.html.markdown b/website/docs/r/dx_connection.html.markdown
index 8fbb47cfeca..f461d048bd1 100644
--- a/website/docs/r/dx_connection.html.markdown
+++ b/website/docs/r/dx_connection.html.markdown
@@ -49,7 +49,7 @@ resource "aws_dx_connection" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `bandwidth` - (Required) The bandwidth of the connection. Valid values for dedicated connections: 1Gbps, 10Gbps. Valid values for hosted connections: 50Mbps, 100Mbps, 200Mbps, 300Mbps, 400Mbps, 500Mbps, 1Gbps, 2Gbps, 5Gbps, 10Gbps and 100Gbps. Case sensitive.
 * `encryption_mode` - (Optional) The connection MAC Security (MACsec) encryption mode. MAC Security (MACsec) is only available on dedicated connections. Valid values are `no_encrypt`, `should_encrypt`, and `must_encrypt`.
@@ -63,9 +63,9 @@ The following arguments are supported:
 * `skip_destroy` - (Optional) Set to true if you do not wish the connection to be deleted at destroy time, and instead just removed from the Terraform state.
 * `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The ARN of the connection.
 * `aws_device` - The Direct Connect endpoint on which the physical connection terminates.
@@ -81,8 +81,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Direct Connect connections can be imported using the `connection id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Direct Connect connections using the connection `id`. For example:
 
+```terraform
+import {
+  to = aws_dx_connection.test_connection
+  id = "dxcon-ffre0ec3"
+}
 ```
-$ terraform import aws_dx_connection.test_connection dxcon-ffre0ec3
+
+Using `terraform import`, import Direct Connect connections using the connection `id`. For example:
+
+```console
+% terraform import aws_dx_connection.test_connection dxcon-ffre0ec3
 ```
diff --git a/website/docs/r/dx_connection_association.html.markdown b/website/docs/r/dx_connection_association.html.markdown
index 3ffdd34fde7..f782e3c4fda 100644
--- a/website/docs/r/dx_connection_association.html.markdown
+++ b/website/docs/r/dx_connection_association.html.markdown
@@ -33,11 +33,11 @@ resource "aws_dx_connection_association" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `connection_id` - (Required) The ID of the connection.
 * `lag_id` - (Required) The ID of the LAG with which to associate the connection.
 
-## Attributes Reference
+## Attribute Reference
 
-No additional attributes are exported.
+This resource exports no additional attributes.
diff --git a/website/docs/r/dx_connection_confirmation.html.markdown b/website/docs/r/dx_connection_confirmation.html.markdown
index 56f65534122..0d41e427d14 100644
--- a/website/docs/r/dx_connection_confirmation.html.markdown
+++ b/website/docs/r/dx_connection_confirmation.html.markdown
@@ -20,7 +20,7 @@ resource "aws_dx_connection_confirmation" "confirmation" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `connection_id` - (Required) The ID of the hosted connection.
 
@@ -29,8 +29,8 @@ The following arguments are supported:
 Removing an `aws_dx_connection_confirmation` resource from your configuration will remove it
 from your statefile and management, **but will not destroy the Hosted Connection.**
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the connection.
diff --git a/website/docs/r/dx_gateway.html.markdown b/website/docs/r/dx_gateway.html.markdown
index e5525a008cc..4c9ce63b961 100644
--- a/website/docs/r/dx_gateway.html.markdown
+++ b/website/docs/r/dx_gateway.html.markdown
@@ -21,14 +21,14 @@ resource "aws_dx_gateway" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The name of the connection.
 * `amazon_side_asn` - (Required) The ASN to be configured on the Amazon side of the connection. The ASN must be in the private range of 64,512 to 65,534 or 4,200,000,000 to 4,294,967,294.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the gateway.
 * `owner_account_id` - AWS Account ID of the gateway.
@@ -42,8 +42,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Direct Connect Gateways can be imported using the `gateway id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Direct Connect Gateways using the gateway `id`. For example:
 
+```terraform
+import {
+  to = aws_dx_gateway.test
+  id = "abcd1234-dcba-5678-be23-cdef9876ab45"
+}
 ```
-$ terraform import aws_dx_gateway.test abcd1234-dcba-5678-be23-cdef9876ab45
+
+Using `terraform import`, import Direct Connect Gateways using the gateway `id`. For example:
+
+```console
+% terraform import aws_dx_gateway.test abcd1234-dcba-5678-be23-cdef9876ab45
 ```
diff --git a/website/docs/r/dx_gateway_association.html.markdown b/website/docs/r/dx_gateway_association.html.markdown
index e67258e5882..b2147204266 100644
--- a/website/docs/r/dx_gateway_association.html.markdown
+++ b/website/docs/r/dx_gateway_association.html.markdown
@@ -93,7 +93,7 @@ A full example of how to create a VPN Gateway in one AWS account, create a Direc
 
 ~> **NOTE:** `dx_gateway_id` and `associated_gateway_id` must be specified for single account Direct Connect gateway associations.
 
-The following arguments are supported:
+This argument supports the following arguments:
 
 * `dx_gateway_id` - (Required) The ID of the Direct Connect gateway.
 * `associated_gateway_id` - (Optional) The ID of the VGW or transit gateway with which to associate the Direct Connect gateway.
@@ -104,9 +104,9 @@ Used for cross-account Direct Connect gateway associations.
 Used for cross-account Direct Connect gateway associations.
 * `allowed_prefixes` - (Optional) VPC prefixes (CIDRs) to advertise to the Direct Connect gateway. Defaults to the CIDR block of the VPC associated with the Virtual Gateway. To enable drift detection, must be configured.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the Direct Connect gateway association resource.
 * `associated_gateway_type` - The type of the associated gateway, `transitGateway` or `virtualPrivateGateway`.
@@ -123,9 +123,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Direct Connect gateway associations can be imported using `dx_gateway_id` together with `associated_gateway_id`,
-e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Direct Connect gateway associations using `dx_gateway_id` together with `associated_gateway_id`. For example:
 
+```terraform
+import {
+  to = aws_dx_gateway_association.example
+  id = "345508c3-7215-4aef-9832-07c125d5bd0f/vgw-98765432"
+}
 ```
-$ terraform import aws_dx_gateway_association.example 345508c3-7215-4aef-9832-07c125d5bd0f/vgw-98765432
+
+Using `terraform import`, import Direct Connect gateway associations using `dx_gateway_id` together with `associated_gateway_id`. For example:
+
+```console
+% terraform import aws_dx_gateway_association.example 345508c3-7215-4aef-9832-07c125d5bd0f/vgw-98765432
 ```
diff --git a/website/docs/r/dx_gateway_association_proposal.html.markdown b/website/docs/r/dx_gateway_association_proposal.html.markdown
index 825e2bcb492..d56a53b6467 100644
--- a/website/docs/r/dx_gateway_association_proposal.html.markdown
+++ b/website/docs/r/dx_gateway_association_proposal.html.markdown
@@ -24,16 +24,16 @@ A full example of how to create a VPN Gateway in one AWS account, create a Direc
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `associated_gateway_id` - (Required) The ID of the VGW or transit gateway with which to associate the Direct Connect gateway.
 * `dx_gateway_id` - (Required) Direct Connect Gateway identifier.
 * `dx_gateway_owner_account_id` - (Required) AWS Account identifier of the Direct Connect Gateway's owner.
 * `allowed_prefixes` - (Optional) VPC prefixes (CIDRs) to advertise to the Direct Connect gateway. Defaults to the CIDR block of the VPC associated with the Virtual Gateway. To enable drift detection, must be configured.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Direct Connect Gateway Association Proposal identifier.
 * `associated_gateway_owner_account_id` - The ID of the AWS account that owns the VGW or transit gateway with which to associate the Direct Connect gateway.
@@ -41,18 +41,39 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Direct Connect Gateway Association Proposals can be imported using either a proposal ID or proposal ID, Direct Connect Gateway ID and associated gateway ID separated by `/`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Direct Connect Gateway Association Proposals using either a proposal ID or proposal ID, Direct Connect Gateway ID and associated gateway ID separated by `/`. For example:
 
+Using a proposal ID:
+
+```terraform
+import {
+  to = aws_dx_gateway_association_proposal.example
+  id = "ac90e981-b718-4364-872d-65478c84fafe"
+}
 ```
-$ terraform import aws_dx_gateway_association_proposal.example ac90e981-b718-4364-872d-65478c84fafe
+
+Using a proposal ID, Direct Connect Gateway ID and associated gateway ID separated by `/`:
+
+```terraform
+import {
+  to = aws_dx_gateway_association_proposal.example
+  id = "ac90e981-b718-4364-872d-65478c84fafe/abcd1234-dcba-5678-be23-cdef9876ab45/vgw-12345678"
+}
 ```
 
-or
+**With `terraform import`**, import Direct Connect Gateway Association Proposals using either a proposal ID or proposal ID, Direct Connect Gateway ID and associated gateway ID separated by `/`. For example:
+
+Using a proposal ID:
 
+```console
+% terraform import aws_dx_gateway_association_proposal.example ac90e981-b718-4364-872d-65478c84fafe
 ```
-$ terraform import aws_dx_gateway_association_proposal.example ac90e981-b718-4364-872d-65478c84fafe/abcd1234-dcba-5678-be23-cdef9876ab45/vgw-12345678
+
+Using a proposal ID, Direct Connect Gateway ID and associated gateway ID separated by `/`:
+
+```console
+% terraform import aws_dx_gateway_association_proposal.example ac90e981-b718-4364-872d-65478c84fafe/abcd1234-dcba-5678-be23-cdef9876ab45/vgw-12345678
 ```
 
 The latter case is useful when a previous proposal has been accepted and deleted by AWS.
-The `aws_dx_gateway_association_proposal` resource will then represent a pseudo-proposal for the same Direct Connect Gateway and associated gateway.
-If no previous proposal is available, use a tool like [`uuidgen`](http://manpages.ubuntu.com/manpages/bionic/man1/uuidgen.1.html) to generate a new random pseudo-proposal ID.
+The `aws_dx_gateway_association_proposal` resource will then represent a pseudo-proposal for the same Direct Connect Gateway and associated gateway. If no previous proposal is available, use a tool like [`uuidgen`](http://manpages.ubuntu.com/manpages/bionic/man1/uuidgen.1.html) to generate a new random pseudo-proposal ID.
diff --git a/website/docs/r/dx_hosted_connection.html.markdown b/website/docs/r/dx_hosted_connection.html.markdown
index de7434503d4..dcf42eea8e2 100644
--- a/website/docs/r/dx_hosted_connection.html.markdown
+++ b/website/docs/r/dx_hosted_connection.html.markdown
@@ -24,7 +24,7 @@ resource "aws_dx_hosted_connection" "hosted" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The name of the connection.
 * `bandwidth` - (Required) The bandwidth of the connection. Valid values for dedicated connections: 1Gbps, 10Gbps. Valid values for hosted connections: 50Mbps, 100Mbps, 200Mbps, 300Mbps, 400Mbps, 500Mbps, 1Gbps, 2Gbps, 5Gbps and 10Gbps. Case sensitive.
@@ -32,9 +32,9 @@ The following arguments are supported:
 * `owner_account_id` - (Required) The ID of the AWS account of the customer for the connection.
 * `vlan` - (Required) The dedicated VLAN provisioned to the hosted connection.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the connection.
 * `jumbo_frame_capable` - Boolean value representing if jumbo frames have been enabled for this connection.
diff --git a/website/docs/r/dx_hosted_private_virtual_interface.html.markdown b/website/docs/r/dx_hosted_private_virtual_interface.html.markdown
index 9af2c8215c3..9c12066dd7a 100644
--- a/website/docs/r/dx_hosted_private_virtual_interface.html.markdown
+++ b/website/docs/r/dx_hosted_private_virtual_interface.html.markdown
@@ -26,7 +26,7 @@ resource "aws_dx_hosted_private_virtual_interface" "foo" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `address_family` - (Required) The address family for the BGP peer. `ipv4 ` or `ipv6`.
 * `bgp_asn` - (Required) The autonomous system (AS) number for Border Gateway Protocol (BGP) configuration.
@@ -39,9 +39,9 @@ The following arguments are supported:
 * `bgp_auth_key` - (Optional) The authentication key for BGP configuration.
 * `customer_address` - (Optional) The IPv4 CIDR destination address to which Amazon should send traffic. Required for IPv4 BGP peers.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the virtual interface.
 * `arn` - The ARN of the virtual interface.
@@ -58,8 +58,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Direct Connect hosted private virtual interfaces can be imported using the `vif id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Direct Connect hosted private virtual interfaces using the VIF `id`. For example:
 
+```terraform
+import {
+  to = aws_dx_hosted_private_virtual_interface.test
+  id = "dxvif-33cc44dd"
+}
 ```
-$ terraform import aws_dx_hosted_private_virtual_interface.test dxvif-33cc44dd
+
+Using `terraform import`, import Direct Connect hosted private virtual interfaces using the VIF `id`. For example:
+
+```console
+% terraform import aws_dx_hosted_private_virtual_interface.test dxvif-33cc44dd
 ```
diff --git a/website/docs/r/dx_hosted_private_virtual_interface_accepter.html.markdown b/website/docs/r/dx_hosted_private_virtual_interface_accepter.html.markdown
index 3fdc6ae75bd..10c8a999c48 100644
--- a/website/docs/r/dx_hosted_private_virtual_interface_accepter.html.markdown
+++ b/website/docs/r/dx_hosted_private_virtual_interface_accepter.html.markdown
@@ -61,7 +61,7 @@ resource "aws_dx_hosted_private_virtual_interface_accepter" "accepter" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `virtual_interface_id` - (Required) The ID of the Direct Connect virtual interface to accept.
 * `dx_gateway_id` - (Optional) The ID of the Direct Connect gateway to which to connect the virtual interface.
@@ -76,9 +76,9 @@ by removing the corresponding `aws_dx_hosted_private_virtual_interface` resource
 Removing a `aws_dx_hosted_private_virtual_interface_accepter` resource from your configuration will remove it
 from your statefile and management, **but will not delete the Direct Connect virtual interface.**
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the virtual interface.
 * `arn` - The ARN of the virtual interface.
@@ -93,8 +93,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Direct Connect hosted private virtual interfaces can be imported using the `vif id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Direct Connect hosted private virtual interfaces using the VIF `id`. For example:
 
+```terraform
+import {
+  to = aws_dx_hosted_private_virtual_interface_accepter.test
+  id = "dxvif-33cc44dd"
+}
 ```
-$ terraform import aws_dx_hosted_private_virtual_interface_accepter.test dxvif-33cc44dd
+
+Using `terraform import`, import Direct Connect hosted private virtual interfaces using the VIF `id`. For example:
+
+```console
+% terraform import aws_dx_hosted_private_virtual_interface_accepter.test dxvif-33cc44dd
 ```
diff --git a/website/docs/r/dx_hosted_public_virtual_interface.html.markdown b/website/docs/r/dx_hosted_public_virtual_interface.html.markdown
index 661189c5097..8ddae451124 100644
--- a/website/docs/r/dx_hosted_public_virtual_interface.html.markdown
+++ b/website/docs/r/dx_hosted_public_virtual_interface.html.markdown
@@ -34,7 +34,7 @@ resource "aws_dx_hosted_public_virtual_interface" "foo" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `address_family` - (Required) The address family for the BGP peer. `ipv4 ` or `ipv6`.
 * `bgp_asn` - (Required) The autonomous system (AS) number for Border Gateway Protocol (BGP) configuration.
@@ -47,9 +47,9 @@ The following arguments are supported:
 * `bgp_auth_key` - (Optional) The authentication key for BGP configuration.
 * `customer_address` - (Optional) The IPv4 CIDR destination address to which Amazon should send traffic. Required for IPv4 BGP peers.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the virtual interface.
 * `arn` - The ARN of the virtual interface.
@@ -64,8 +64,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Direct Connect hosted public virtual interfaces can be imported using the `vif id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Direct Connect hosted public virtual interfaces using the VIF `id`. For example:
 
+```terraform
+import {
+  to = aws_dx_hosted_public_virtual_interface.test
+  id = "dxvif-33cc44dd"
+}
 ```
-$ terraform import aws_dx_hosted_public_virtual_interface.test dxvif-33cc44dd
+
+Using `terraform import`, import Direct Connect hosted public virtual interfaces using the VIF `id`. For example:
+
+```console
+% terraform import aws_dx_hosted_public_virtual_interface.test dxvif-33cc44dd
 ```
diff --git a/website/docs/r/dx_hosted_public_virtual_interface_accepter.html.markdown b/website/docs/r/dx_hosted_public_virtual_interface_accepter.html.markdown
index d7aee80e924..b9ca1d2cb7c 100644
--- a/website/docs/r/dx_hosted_public_virtual_interface_accepter.html.markdown
+++ b/website/docs/r/dx_hosted_public_virtual_interface_accepter.html.markdown
@@ -60,7 +60,7 @@ resource "aws_dx_hosted_public_virtual_interface_accepter" "accepter" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `virtual_interface_id` - (Required) The ID of the Direct Connect virtual interface to accept.
 * `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
@@ -73,9 +73,9 @@ by removing the corresponding `aws_dx_hosted_public_virtual_interface` resource
 Removing a `aws_dx_hosted_public_virtual_interface_accepter` resource from your configuration will remove it
 from your statefile and management, **but will not delete the Direct Connect virtual interface.**
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the virtual interface.
 * `arn` - The ARN of the virtual interface.
@@ -90,8 +90,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Direct Connect hosted public virtual interfaces can be imported using the `vif id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Direct Connect hosted public virtual interfaces using the VIF `id`. For example:
 
+```terraform
+import {
+  to = aws_dx_hosted_public_virtual_interface_accepter.test
+  id = "dxvif-33cc44dd"
+}
 ```
-$ terraform import aws_dx_hosted_public_virtual_interface_accepter.test dxvif-33cc44dd
+
+Using `terraform import`, import Direct Connect hosted public virtual interfaces using the VIF `id`. For example:
+
+```console
+% terraform import aws_dx_hosted_public_virtual_interface_accepter.test dxvif-33cc44dd
 ```
diff --git a/website/docs/r/dx_hosted_transit_virtual_interface.html.markdown b/website/docs/r/dx_hosted_transit_virtual_interface.html.markdown
index c9ff55f11ab..f6063f45cbd 100644
--- a/website/docs/r/dx_hosted_transit_virtual_interface.html.markdown
+++ b/website/docs/r/dx_hosted_transit_virtual_interface.html.markdown
@@ -27,7 +27,7 @@ resource "aws_dx_hosted_transit_virtual_interface" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `address_family` - (Required) The address family for the BGP peer. `ipv4 ` or `ipv6`.
 * `bgp_asn` - (Required) The autonomous system (AS) number for Border Gateway Protocol (BGP) configuration.
@@ -40,9 +40,9 @@ The following arguments are supported:
 * `customer_address` - (Optional) The IPv4 CIDR destination address to which Amazon should send traffic. Required for IPv4 BGP peers.
 * `mtu` - (Optional) The maximum transmission unit (MTU) is the size, in bytes, of the largest permissible packet that can be passed over the connection. The MTU of a virtual transit interface can be either `1500` or `8500` (jumbo frames). Default is `1500`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the virtual interface.
 * `arn` - The ARN of the virtual interface.
@@ -59,8 +59,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Direct Connect hosted transit virtual interfaces can be imported using the `vif id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Direct Connect hosted transit virtual interfaces using the VIF `id`. For example:
 
+```terraform
+import {
+  to = aws_dx_hosted_transit_virtual_interface.test
+  id = "dxvif-33cc44dd"
+}
 ```
-$ terraform import aws_dx_hosted_transit_virtual_interface.test dxvif-33cc44dd
+
+Using `terraform import`, import Direct Connect hosted transit virtual interfaces using the VIF `id`. For example:
+
+```console
+% terraform import aws_dx_hosted_transit_virtual_interface.test dxvif-33cc44dd
 ```
diff --git a/website/docs/r/dx_hosted_transit_virtual_interface_accepter.html.markdown b/website/docs/r/dx_hosted_transit_virtual_interface_accepter.html.markdown
index 38db072184d..e0b40f2006c 100644
--- a/website/docs/r/dx_hosted_transit_virtual_interface_accepter.html.markdown
+++ b/website/docs/r/dx_hosted_transit_virtual_interface_accepter.html.markdown
@@ -66,15 +66,15 @@ resource "aws_dx_hosted_transit_virtual_interface_accepter" "accepter" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `dx_gateway_id` - (Required) The ID of the [Direct Connect gateway](dx_gateway.html) to which to connect the virtual interface.
 * `virtual_interface_id` - (Required) The ID of the Direct Connect virtual interface to accept.
 * `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the virtual interface.
 * `arn` - The ARN of the virtual interface.
@@ -89,8 +89,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Direct Connect hosted transit virtual interfaces can be imported using the `vif id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Direct Connect hosted transit virtual interfaces using the VIF `id`. For example:
 
+```terraform
+import {
+  to = aws_dx_hosted_transit_virtual_interface_accepter.test
+  id = "dxvif-33cc44dd"
+}
 ```
-$ terraform import aws_dx_hosted_transit_virtual_interface_accepter.test dxvif-33cc44dd
+
+Using `terraform import`, import Direct Connect hosted transit virtual interfaces using the VIF `id`. For example:
+
+```console
+% terraform import aws_dx_hosted_transit_virtual_interface_accepter.test dxvif-33cc44dd
 ```
diff --git a/website/docs/r/dx_lag.html.markdown b/website/docs/r/dx_lag.html.markdown
index bde158d213e..54b9e9c60b0 100644
--- a/website/docs/r/dx_lag.html.markdown
+++ b/website/docs/r/dx_lag.html.markdown
@@ -25,7 +25,7 @@ resource "aws_dx_lag" "hoge" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The name of the LAG.
 * `connections_bandwidth` - (Required) The bandwidth of the individual physical connections bundled by the LAG. Valid values: 50Mbps, 100Mbps, 200Mbps, 300Mbps, 400Mbps, 500Mbps, 1Gbps, 2Gbps, 5Gbps, 10Gbps and 100Gbps. Case sensitive.
@@ -35,9 +35,9 @@ The following arguments are supported:
 * `provider_name` - (Optional) The name of the service provider associated with the LAG.
 * `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The ARN of the LAG.
 * `has_logical_redundancy` - Indicates whether the LAG supports a secondary BGP peer in the same address family (IPv4/IPv6).
@@ -48,8 +48,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Direct Connect LAGs can be imported using the `lag id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Direct Connect LAGs using the LAG `id`. For example:
 
+```terraform
+import {
+  to = aws_dx_lag.test_lag
+  id = "dxlag-fgnsp5rq"
+}
 ```
-$ terraform import aws_dx_lag.test_lag dxlag-fgnsp5rq
+
+Using `terraform import`, import Direct Connect LAGs using the LAG `id`. For example:
+
+```console
+% terraform import aws_dx_lag.test_lag dxlag-fgnsp5rq
 ```
diff --git a/website/docs/r/dx_macsec_key_association.html.markdown b/website/docs/r/dx_macsec_key_association.html.markdown
index c5e302bdbba..de7f2502aad 100644
--- a/website/docs/r/dx_macsec_key_association.html.markdown
+++ b/website/docs/r/dx_macsec_key_association.html.markdown
@@ -52,7 +52,7 @@ resource "aws_dx_macsec_key_association" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `cak` - (Optional) The MAC Security (MACsec) CAK to associate with the dedicated connection. The valid values are 64 hexadecimal characters (0-9, A-E). Required if using `ckn`.
 * `ckn` - (Optional) The MAC Security (MACsec) CKN to associate with the dedicated connection. The valid values are 64 hexadecimal characters (0-9, A-E). Required if using `cak`.
@@ -61,9 +61,9 @@ The following arguments are supported:
 
 ~> **Note:** `ckn` and `cak` are mutually exclusive with `secret_arn` - these arguments cannot be used together. If you use `ckn` and `cak`, you should not use `secret_arn`. If you use the `secret_arn` argument to reference an existing MAC Security (MACSec) secret key, you should not use `ckn` or `cak`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - ID of the MAC Security (MACSec) secret key resource.
 * `start_on` - The date in UTC format that the MAC Security (MACsec) secret key takes effect.
diff --git a/website/docs/r/dx_private_virtual_interface.html.markdown b/website/docs/r/dx_private_virtual_interface.html.markdown
index 80ce5d6279c..a047efa3436 100644
--- a/website/docs/r/dx_private_virtual_interface.html.markdown
+++ b/website/docs/r/dx_private_virtual_interface.html.markdown
@@ -25,7 +25,7 @@ resource "aws_dx_private_virtual_interface" "foo" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `address_family` - (Required) The address family for the BGP peer. `ipv4 ` or `ipv6`.
 * `bgp_asn` - (Required) The autonomous system (AS) number for Border Gateway Protocol (BGP) configuration.
@@ -42,9 +42,9 @@ The MTU of a virtual private interface can be either `1500` or `9001` (jumbo fra
 * `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 * `vpn_gateway_id` - (Optional) The ID of the [virtual private gateway](vpn_gateway.html) to which to connect the virtual interface.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the virtual interface.
 * `arn` - The ARN of the virtual interface.
@@ -62,8 +62,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Direct Connect private virtual interfaces can be imported using the `vif id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Direct Connect private virtual interfaces using the VIF `id`. For example:
 
+```terraform
+import {
+  to = aws_dx_private_virtual_interface.test
+  id = "dxvif-33cc44dd"
+}
 ```
-$ terraform import aws_dx_private_virtual_interface.test dxvif-33cc44dd
+
+Using `terraform import`, import Direct Connect private virtual interfaces using the VIF `id`. For example:
+
+```console
+% terraform import aws_dx_private_virtual_interface.test dxvif-33cc44dd
 ```
diff --git a/website/docs/r/dx_public_virtual_interface.html.markdown b/website/docs/r/dx_public_virtual_interface.html.markdown
index ac29439ef54..8b5c69cbc23 100644
--- a/website/docs/r/dx_public_virtual_interface.html.markdown
+++ b/website/docs/r/dx_public_virtual_interface.html.markdown
@@ -33,7 +33,7 @@ resource "aws_dx_public_virtual_interface" "foo" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `address_family` - (Required) The address family for the BGP peer. `ipv4 ` or `ipv6`.
 * `bgp_asn` - (Required) The autonomous system (AS) number for Border Gateway Protocol (BGP) configuration.
@@ -46,9 +46,9 @@ The following arguments are supported:
 * `route_filter_prefixes` - (Required) A list of routes to be advertised to the AWS network in this region.
 * `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the virtual interface.
 * `arn` - The ARN of the virtual interface.
@@ -64,8 +64,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Direct Connect public virtual interfaces can be imported using the `vif id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Direct Connect public virtual interfaces using the VIF `id`. For example:
 
+```terraform
+import {
+  to = aws_dx_public_virtual_interface.test
+  id = "dxvif-33cc44dd"
+}
 ```
-$ terraform import aws_dx_public_virtual_interface.test dxvif-33cc44dd
+
+Using `terraform import`, import Direct Connect public virtual interfaces using the VIF `id`. For example:
+
+```console
+% terraform import aws_dx_public_virtual_interface.test dxvif-33cc44dd
 ```
diff --git a/website/docs/r/dx_transit_virtual_interface.html.markdown b/website/docs/r/dx_transit_virtual_interface.html.markdown
index 56646a775ec..40b993fc129 100644
--- a/website/docs/r/dx_transit_virtual_interface.html.markdown
+++ b/website/docs/r/dx_transit_virtual_interface.html.markdown
@@ -32,7 +32,7 @@ resource "aws_dx_transit_virtual_interface" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `address_family` - (Required) The address family for the BGP peer. `ipv4 ` or `ipv6`.
 * `bgp_asn` - (Required) The autonomous system (AS) number for Border Gateway Protocol (BGP) configuration.
@@ -48,9 +48,9 @@ The MTU of a virtual transit interface can be either `1500` or `8500` (jumbo fra
 * `sitelink_enabled` - (Optional) Indicates whether to enable or disable SiteLink.
 * `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the virtual interface.
 * `arn` - The ARN of the virtual interface.
@@ -68,8 +68,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Direct Connect transit virtual interfaces can be imported using the `vif id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Direct Connect transit virtual interfaces using the VIF `id`. For example:
 
+```terraform
+import {
+  to = aws_dx_transit_virtual_interface.test
+  id = "dxvif-33cc44dd"
+}
 ```
-$ terraform import aws_dx_transit_virtual_interface.test dxvif-33cc44dd
+
+Using `terraform import`, import Direct Connect transit virtual interfaces using the VIF `id`. For example:
+
+```console
+% terraform import aws_dx_transit_virtual_interface.test dxvif-33cc44dd
 ```
diff --git a/website/docs/r/dynamodb_contributor_insights.html.markdown b/website/docs/r/dynamodb_contributor_insights.html.markdown
index 5a07ee1a666..49cd10bbb3f 100644
--- a/website/docs/r/dynamodb_contributor_insights.html.markdown
+++ b/website/docs/r/dynamodb_contributor_insights.html.markdown
@@ -20,19 +20,28 @@ resource "aws_dynamodb_contributor_insights" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `table_name` - (Required) The name of the table to enable contributor insights
 * `index_name` - (Optional) The global secondary index name
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 ## Import
 
-`aws_dynamodb_contributor_insights` can be imported using the format `name:table_name/index:index_name`, followed by the account number, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_dynamodb_contributor_insights` using the format `name:table_name/index:index_name`, followed by the account number. For example:
 
+```terraform
+import {
+  to = aws_dynamodb_contributor_insights.test
+  id = "name:ExampleTableName/index:ExampleIndexName/123456789012"
+}
 ```
-$ terraform import aws_dynamodb_contributor_insights.test name:ExampleTableName/index:ExampleIndexName/123456789012
+
+Using `terraform import`, import `aws_dynamodb_contributor_insights` using the format `name:table_name/index:index_name`, followed by the account number. For example:
+
+```console
+% terraform import aws_dynamodb_contributor_insights.test name:ExampleTableName/index:ExampleIndexName/123456789012
 ```
diff --git a/website/docs/r/dynamodb_global_table.html.markdown b/website/docs/r/dynamodb_global_table.html.markdown
index a6066fa12e2..d223088eb78 100644
--- a/website/docs/r/dynamodb_global_table.html.markdown
+++ b/website/docs/r/dynamodb_global_table.html.markdown
@@ -80,7 +80,7 @@ resource "aws_dynamodb_global_table" "myTable" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The name of the global table. Must match underlying DynamoDB Table names in all regions.
 * `replica` - (Required) Underlying DynamoDB Table. At least 1 replica must be defined. See below.
@@ -91,17 +91,26 @@ The following arguments are supported:
 
 * `region_name` - (Required) AWS region name of replica DynamoDB TableE.g., `us-east-1`
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The name of the DynamoDB Global Table
 * `arn` - The ARN of the DynamoDB Global Table
 
 ## Import
 
-DynamoDB Global Tables can be imported using the global table name, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DynamoDB Global Tables using the global table name. For example:
 
+```terraform
+import {
+  to = aws_dynamodb_global_table.MyTable
+  id = "MyTable"
+}
 ```
-$ terraform import aws_dynamodb_global_table.MyTable MyTable
+
+Using `terraform import`, import DynamoDB Global Tables using the global table name. For example:
+
+```console
+% terraform import aws_dynamodb_global_table.MyTable MyTable
 ```
diff --git a/website/docs/r/dynamodb_kinesis_streaming_destination.html.markdown b/website/docs/r/dynamodb_kinesis_streaming_destination.html.markdown
index 5a08b9e6c2b..cd2544ece85 100644
--- a/website/docs/r/dynamodb_kinesis_streaming_destination.html.markdown
+++ b/website/docs/r/dynamodb_kinesis_streaming_destination.html.markdown
@@ -36,23 +36,32 @@ resource "aws_dynamodb_kinesis_streaming_destination" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `stream_arn` - (Required) The ARN for a Kinesis data stream. This must exist in the same account and region as the DynamoDB table.
   
 * `table_name` - (Required) The name of the DynamoDB table. There
   can only be one Kinesis streaming destination for a given DynamoDB table.
   
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The `table_name` and `stream_arn` separated by a comma (`,`).
 
 ## Import
 
-DynamoDB Kinesis Streaming Destinations can be imported using the `table_name` and `stream_arn` separated by `,`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DynamoDB Kinesis Streaming Destinations using the `table_name` and `stream_arn` separated by `,`. For example:
 
+```terraform
+import {
+  to = aws_dynamodb_kinesis_streaming_destination.example
+  id = "example,arn:aws:kinesis:us-east-1:111122223333:exampleStreamName"
+}
 ```
-$ terraform import aws_dynamodb_kinesis_streaming_destination.example example,arn:aws:kinesis:us-east-1:111122223333:exampleStreamName
+
+Using `terraform import`, import DynamoDB Kinesis Streaming Destinations using the `table_name` and `stream_arn` separated by `,`. For example:
+
+```console
+% terraform import aws_dynamodb_kinesis_streaming_destination.example example,arn:aws:kinesis:us-east-1:111122223333:exampleStreamName
 ```
diff --git a/website/docs/r/dynamodb_table.html.markdown b/website/docs/r/dynamodb_table.html.markdown
index b337903eb18..9653ad11349 100644
--- a/website/docs/r/dynamodb_table.html.markdown
+++ b/website/docs/r/dynamodb_table.html.markdown
@@ -177,6 +177,7 @@ Optional arguments:
 
 * `billing_mode` - (Optional) Controls how you are charged for read and write throughput and how you manage capacity. The valid values are `PROVISIONED` and `PAY_PER_REQUEST`. Defaults to `PROVISIONED`.
 * `deletion_protection_enabled` - (Optional) Enables deletion protection for table. Defaults to `false`.
+* `import_table` - (Optional) Import Amazon S3 data into a new table. See below.
 * `global_secondary_index` - (Optional) Describe a GSI for the table; subject to the normal limits on the number of GSIs, projected attributes, etc. See below.
 * `local_secondary_index` - (Optional, Forces new resource) Describe an LSI on the table; these can only be allocated _at creation_ so you cannot change this definition after you have created the resource. See below.
 * `point_in_time_recovery` - (Optional) Enable point-in-time recovery options. See below.
@@ -201,7 +202,27 @@ Optional arguments:
 * `name` - (Required) Name of the attribute
 * `type` - (Required) Attribute type. Valid values are `S` (string), `N` (number), `B` (binary).
 
-#### `global_secondary_index`
+### `import_table`
+
+* `input_format` - (Required) The format of the source data. Valid values are `CSV`, `DYNAMODB_JSON` and `ION`.
+* `s3_bucket_source` - (Required) Values for the S3 bucket the source file is imported from. See below.
+* `client_token` - (Optional) Makes the import idempotent, meaning that multiple identical calls have the same effect as one single call (8 hours validity).
+* `input_compression_type` - (Optional) Type of compression to be used on the input coming from the imported table. Valid values are `GZIP`, `ZSTD` and `NONE`.
+* `input_format_options` - (Optional) Describe the format options for the data that was imported into the target table. There is one value, `csv`. See below.
+
+#### `input_format_options`
+
+* `csv` - (Optional) This block contains the processing options for the CSV file being imported:
+    * `delimiter` - (Optional) The delimiter used for separating items in the CSV file being imported.
+    * `header_list` - (Optional) List of the headers used to specify a common header for all source CSV files being imported.
+
+#### `s3_bucket_source`
+
+* `bucket` - (Required) The S3 bucket that is being imported from.
+* `bucket_owner`- (Optional) The account number of the S3 bucket that is being imported from.
+* `key_prefix` - (Optional) The key prefix shared by all S3 Objects that are being imported.
+
+### `global_secondary_index`
 
 * `hash_key` - (Required) Name of the hash key in the index; must be defined as an attribute in the resource.
 * `name` - (Required) Name of the index.
@@ -239,9 +260,9 @@ Optional arguments:
 * `enabled` - (Required) Whether TTL is enabled.
 * `attribute_name` - (Required) Name of the table attribute to store the TTL timestamp in.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the table
 * `id` - Name of the table
@@ -264,8 +285,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-DynamoDB tables can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DynamoDB tables using the `name`. For example:
 
+```terraform
+import {
+  to = aws_dynamodb_table.basic-dynamodb-table
+  id = "GameScores"
+}
 ```
-$ terraform import aws_dynamodb_table.basic-dynamodb-table GameScores
+
+Using `terraform import`, import DynamoDB tables using the `name`. For example:
+
+```console
+% terraform import aws_dynamodb_table.basic-dynamodb-table GameScores
 ```
diff --git a/website/docs/r/dynamodb_table_item.html.markdown b/website/docs/r/dynamodb_table_item.html.markdown
index 8478a5ce213..cedde5c7f2a 100644
--- a/website/docs/r/dynamodb_table_item.html.markdown
+++ b/website/docs/r/dynamodb_table_item.html.markdown
@@ -48,17 +48,17 @@ resource "aws_dynamodb_table" "example" {
 
 ~> **Note:** Names included in `item` are represented internally with everything but letters removed. There is the possibility of collisions if two names, once filtered, are the same. For example, the names `your-name-here` and `yournamehere` will overlap and cause an error.
 
-The following arguments are supported:
+This argument supports the following arguments:
 
 * `hash_key` - (Required) Hash key to use for lookups and identification of the item
 * `item` - (Required) JSON representation of a map of attribute name/value pairs, one for each attribute. Only the primary key attributes are required; you can optionally provide other attribute name-value pairs for the item.
 * `range_key` - (Optional) Range key to use for lookups and identification of the item. Required if there is range key defined in the table.
 * `table_name` - (Required) Name of the table to contain the item.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 ## Import
 
-DynamoDB table items cannot be imported.
+You cannot import DynamoDB table items.
diff --git a/website/docs/r/dynamodb_table_replica.html.markdown b/website/docs/r/dynamodb_table_replica.html.markdown
index b21a8a375b8..04806f976d8 100644
--- a/website/docs/r/dynamodb_table_replica.html.markdown
+++ b/website/docs/r/dynamodb_table_replica.html.markdown
@@ -71,9 +71,9 @@ Optional arguments:
 * `table_class_override` - (Optional, Forces new resource) Storage class of the table replica. Valid values are `STANDARD` and `STANDARD_INFREQUENT_ACCESS`. If not used, the table replica will use the same class as the global table.
 * `tags` - (Optional) Map of tags to populate on the created table. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the table replica.
 * `id` - Name of the table and region of the main global table joined with a semicolon (_e.g._, `TableName:us-east-1`).
@@ -89,10 +89,21 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-DynamoDB table replicas can be imported using the `table-name:main-region`, _e.g._,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DynamoDB table replicas using the `table-name:main-region`. For example:
 
 ~> **Note:** When importing, use the region where the initial or _main_ global table resides, _not_ the region of the replica.
 
+```terraform
+import {
+  to = aws_dynamodb_table_replica.example
+  id = "TestTable:us-west-2"
+}
 ```
-$ terraform import aws_dynamodb_table_replica.example TestTable:us-west-2
+
+Using `terraform import`, import DynamoDB table replicas using the `table-name:main-region`. For example:
+
+~> **Note:** When importing, use the region where the initial or _main_ global table resides, _not_ the region of the replica.
+
+```console
+% terraform import aws_dynamodb_table_replica.example TestTable:us-west-2
 ```
diff --git a/website/docs/r/dynamodb_tag.html.markdown b/website/docs/r/dynamodb_tag.html.markdown
index 02290d215a1..cd298ca4423 100644
--- a/website/docs/r/dynamodb_tag.html.markdown
+++ b/website/docs/r/dynamodb_tag.html.markdown
@@ -43,7 +43,7 @@ resource "aws_dynamodb_table" "example" {
 resource "aws_dynamodb_tag" "test" {
   provider = aws.replica
 
-  resource_arn = replace(aws_dynamodb_table.test.arn, data.aws_region.current.name, data.aws_region.replica.name)
+  resource_arn = replace(aws_dynamodb_table.example.arn, data.aws_region.current.name, data.aws_region.replica.name)
   key          = "testkey"
   value        = "testvalue"
 }
@@ -51,22 +51,31 @@ resource "aws_dynamodb_tag" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `resource_arn` - (Required) Amazon Resource Name (ARN) of the DynamoDB resource to tag.
 * `key` - (Required) Tag name.
 * `value` - (Required) Tag value.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - DynamoDB resource identifier and key, separated by a comma (`,`)
 
 ## Import
 
-`aws_dynamodb_tag` can be imported by using the DynamoDB resource identifier and key, separated by a comma (`,`), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_dynamodb_tag` using the DynamoDB resource identifier and key, separated by a comma (`,`). For example:
 
+```terraform
+import {
+  to = aws_dynamodb_tag.example
+  id = "arn:aws:dynamodb:us-east-1:123456789012:table/example,Name"
+}
 ```
-$ terraform import aws_dynamodb_tag.example arn:aws:dynamodb:us-east-1:123456789012:table/example,Name
+
+Using `terraform import`, import `aws_dynamodb_tag` using the DynamoDB resource identifier and key, separated by a comma (`,`). For example:
+
+```console
+% terraform import aws_dynamodb_tag.example arn:aws:dynamodb:us-east-1:123456789012:table/example,Name
 ```
diff --git a/website/docs/r/ebs_default_kms_key.html.markdown b/website/docs/r/ebs_default_kms_key.html.markdown
index aed7dad159d..81fd8417d64 100644
--- a/website/docs/r/ebs_default_kms_key.html.markdown
+++ b/website/docs/r/ebs_default_kms_key.html.markdown
@@ -27,18 +27,27 @@ resource "aws_ebs_default_kms_key" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `key_arn` - (Required, ForceNew) The ARN of the AWS Key Management Service (AWS KMS) customer master key (CMK) to use to encrypt the EBS volume.
 
-## Attributes Reference
+## Attribute Reference
 
-No additional attributes are exported.
+This resource exports no additional attributes.
 
 ## Import
 
-The EBS default KMS CMK can be imported with the KMS key ARN, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import the EBS default KMS CMK using the KMS key ARN. For example:
+
+```terraform
+import {
+  to = aws_ebs_default_kms_key.example
+  id = "arn:aws:kms:us-east-1:123456789012:key/abcd-1234"
+}
+```
+
+Using `terraform import`, import the EBS default KMS CMK using the KMS key ARN. For example:
 
 ```console
-$ terraform import aws_ebs_default_kms_key.example arn:aws:kms:us-east-1:123456789012:key/abcd-1234
+% terraform import aws_ebs_default_kms_key.example arn:aws:kms:us-east-1:123456789012:key/abcd-1234
 ```
diff --git a/website/docs/r/ebs_encryption_by_default.html.markdown b/website/docs/r/ebs_encryption_by_default.html.markdown
index dc9487e2ee3..e534f98f85d 100644
--- a/website/docs/r/ebs_encryption_by_default.html.markdown
+++ b/website/docs/r/ebs_encryption_by_default.html.markdown
@@ -22,18 +22,27 @@ resource "aws_ebs_encryption_by_default" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `enabled` - (Optional) Whether or not default EBS encryption is enabled. Valid values are `true` or `false`. Defaults to `true`.
 
-## Attributes Reference
+## Attribute Reference
 
-No additional attributes are exported.
+This resource exports no additional attributes.
 
 ## Import
 
-Default EBS encryption state can be imported, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import the default EBS encryption state. For example:
 
+```terraform
+import {
+  to = aws_ebs_encryption_by_default.example
+  id = "default"
+}
 ```
-$ terraform import aws_ebs_encryption_by_default.example default
+
+Using `terraform import`, import the default EBS encryption state. For example:
+
+```console
+% terraform import aws_ebs_encryption_by_default.example default
 ```
diff --git a/website/docs/r/ebs_snapshot.html.markdown b/website/docs/r/ebs_snapshot.html.markdown
index ccc1806d974..86b708406d7 100644
--- a/website/docs/r/ebs_snapshot.html.markdown
+++ b/website/docs/r/ebs_snapshot.html.markdown
@@ -33,7 +33,7 @@ resource "aws_ebs_snapshot" "example_snapshot" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `volume_id` - (Required) The Volume ID of which to make a snapshot.
 * `description` - (Optional) A description of what the snapshot is.
@@ -43,9 +43,9 @@ The following arguments are supported:
 * `temporary_restore_days` - (Optional) Specifies the number of days for which to temporarily restore an archived snapshot. Required for temporary restores only. The snapshot will be automatically re-archived after this period.
 * `tags` - (Optional) A map of tags to assign to the snapshot. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name (ARN) of the EBS Snapshot.
 * `id` - The snapshot ID (e.g., snap-59fcb34e).
@@ -66,8 +66,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-EBS Snapshot can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EBS Snapshot using the `id`. For example:
 
+```terraform
+import {
+  to = aws_ebs_snapshot.id
+  id = "snap-049df61146c4d7901"
+}
 ```
-$ terraform import aws_ebs_snapshot.id snap-049df61146c4d7901
+
+Using `terraform import`, import EBS Snapshot using the `id`. For example:
+
+```console
+% terraform import aws_ebs_snapshot.id snap-049df61146c4d7901
 ```
diff --git a/website/docs/r/ebs_snapshot_copy.html.markdown b/website/docs/r/ebs_snapshot_copy.html.markdown
index fd02f4438c8..0961d0477d3 100644
--- a/website/docs/r/ebs_snapshot_copy.html.markdown
+++ b/website/docs/r/ebs_snapshot_copy.html.markdown
@@ -42,7 +42,7 @@ resource "aws_ebs_snapshot_copy" "example_copy" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `description` - (Optional) A description of what the snapshot is.
 * `encrypted` - Whether the snapshot is encrypted.
@@ -54,9 +54,9 @@ The following arguments are supported:
 * `temporary_restore_days` - (Optional) Specifies the number of days for which to temporarily restore an archived snapshot. Required for temporary restores only. The snapshot will be automatically re-archived after this period.
 * `tags` - A map of tags for the snapshot. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name (ARN) of the EBS Snapshot.
 * `id` - The snapshot ID (e.g., snap-59fcb34e).
diff --git a/website/docs/r/ebs_snapshot_import.html.markdown b/website/docs/r/ebs_snapshot_import.html.markdown
index 023eaacf927..0cd92ae4fb6 100644
--- a/website/docs/r/ebs_snapshot_import.html.markdown
+++ b/website/docs/r/ebs_snapshot_import.html.markdown
@@ -32,7 +32,7 @@ resource "aws_ebs_snapshot_import" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `client_data` - (Optional) The client-specific data. Detailed below.
 * `description` - (Optional) The description string for the import snapshot task.
@@ -71,9 +71,9 @@ The following arguments are supported:
 - `create` - (Default `60m`)
 - `delete` - (Default `10m`)
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name (ARN) of the EBS Snapshot.
 * `id` - The snapshot ID (e.g., snap-59fcb34e).
diff --git a/website/docs/r/ebs_volume.html.markdown b/website/docs/r/ebs_volume.html.markdown
index 1b13bf2e2e3..361d2d17dff 100644
--- a/website/docs/r/ebs_volume.html.markdown
+++ b/website/docs/r/ebs_volume.html.markdown
@@ -27,7 +27,7 @@ resource "aws_ebs_volume" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `availability_zone` - (Required) The AZ where the EBS volume will exist.
 * `encrypted` - (Optional) If true, the disk will be encrypted.
@@ -44,9 +44,9 @@ The following arguments are supported:
 
 ~> **NOTE:** When changing the `size`, `iops` or `type` of an instance, there are [considerations](http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/considerations.html) to be aware of.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The volume ID (e.g., vol-59fcb34e).
 * `arn` - The volume ARN (e.g., arn:aws:ec2:us-east-1:0123456789012:volume/vol-59fcb34e).
@@ -62,8 +62,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-EBS Volumes can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EBS Volumes using the `id`. For example:
 
+```terraform
+import {
+  to = aws_ebs_volume.id
+  id = "vol-049df61146c4d7901"
+}
 ```
-$ terraform import aws_ebs_volume.id vol-049df61146c4d7901
+
+Using `terraform import`, import EBS Volumes using the `id`. For example:
+
+```console
+% terraform import aws_ebs_volume.id vol-049df61146c4d7901
 ```
diff --git a/website/docs/r/ec2_availability_zone_group.html.markdown b/website/docs/r/ec2_availability_zone_group.html.markdown
index 507c40c8b9f..cca31072fcd 100644
--- a/website/docs/r/ec2_availability_zone_group.html.markdown
+++ b/website/docs/r/ec2_availability_zone_group.html.markdown
@@ -28,16 +28,25 @@ The following arguments are required:
 * `group_name` - (Required) Name of the Availability Zone Group.
 * `opt_in_status` - (Required) Indicates whether to enable or disable Availability Zone Group. Valid values: `opted-in` or `not-opted-in`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Name of the Availability Zone Group.
 
 ## Import
 
-EC2 Availability Zone Groups can be imported using the group name, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EC2 Availability Zone Groups using the group name. For example:
 
+```terraform
+import {
+  to = aws_ec2_availability_zone_group.example
+  id = "us-west-2-lax-1"
+}
 ```
-$ terraform import aws_ec2_availability_zone_group.example us-west-2-lax-1
+
+Using `terraform import`, import EC2 Availability Zone Groups using the group name. For example:
+
+```console
+% terraform import aws_ec2_availability_zone_group.example us-west-2-lax-1
 ```
diff --git a/website/docs/r/ec2_capacity_reservation.html.markdown b/website/docs/r/ec2_capacity_reservation.html.markdown
index ccdf5d7f287..62f4afcb473 100644
--- a/website/docs/r/ec2_capacity_reservation.html.markdown
+++ b/website/docs/r/ec2_capacity_reservation.html.markdown
@@ -23,7 +23,7 @@ resource "aws_ec2_capacity_reservation" "default" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `availability_zone` - (Required) The Availability Zone in which to create the Capacity Reservation.
 * `ebs_optimized` - (Optional) Indicates whether the Capacity Reservation supports EBS-optimized instances.
@@ -39,9 +39,9 @@ The following arguments are supported:
 * `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 * `tenancy` - (Optional) Indicates the tenancy of the Capacity Reservation. Specify either `default` or `dedicated`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The Capacity Reservation ID.
 * `owner_id` - The ID of the AWS account that owns the Capacity Reservation.
@@ -50,8 +50,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Capacity Reservations can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Capacity Reservations using the `id`. For example:
 
+```terraform
+import {
+  to = aws_ec2_capacity_reservation.web
+  id = "cr-0123456789abcdef0"
+}
 ```
-$ terraform import aws_ec2_capacity_reservation.web cr-0123456789abcdef0
+
+Using `terraform import`, import Capacity Reservations using the `id`. For example:
+
+```console
+% terraform import aws_ec2_capacity_reservation.web cr-0123456789abcdef0
 ```
diff --git a/website/docs/r/ec2_carrier_gateway.html.markdown b/website/docs/r/ec2_carrier_gateway.html.markdown
index 8aa43333b07..3a2fbd8d812 100644
--- a/website/docs/r/ec2_carrier_gateway.html.markdown
+++ b/website/docs/r/ec2_carrier_gateway.html.markdown
@@ -24,14 +24,14 @@ resource "aws_ec2_carrier_gateway" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 * `vpc_id` - (Required) The ID of the VPC to associate with the carrier gateway.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The ARN of the carrier gateway.
 * `id` - The ID of the carrier gateway.
@@ -40,9 +40,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_ec2_carrier_gateway` can be imported using the carrier gateway's ID,
-e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_ec2_carrier_gateway` using the carrier gateway's ID. For example:
 
+```terraform
+import {
+  to = aws_ec2_carrier_gateway.example
+  id = "cgw-12345"
+}
 ```
-$ terraform import aws_ec2_carrier_gateway.example cgw-12345
+
+Using `terraform import`, import `aws_ec2_carrier_gateway` using the carrier gateway's ID. For example:
+
+```console
+% terraform import aws_ec2_carrier_gateway.example cgw-12345
 ```
diff --git a/website/docs/r/ec2_client_vpn_authorization_rule.html.markdown b/website/docs/r/ec2_client_vpn_authorization_rule.html.markdown
index 6a0e7bb1c45..1d1d0875678 100644
--- a/website/docs/r/ec2_client_vpn_authorization_rule.html.markdown
+++ b/website/docs/r/ec2_client_vpn_authorization_rule.html.markdown
@@ -23,7 +23,7 @@ resource "aws_ec2_client_vpn_authorization_rule" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `client_vpn_endpoint_id` - (Required) The ID of the Client VPN endpoint.
 * `target_network_cidr` - (Required) The IPv4 address range, in CIDR notation, of the network to which the authorization rule applies.
@@ -31,9 +31,9 @@ The following arguments are supported:
 * `authorize_all_groups` - (Optional) Indicates whether the authorization rule grants access to all clients. One of `access_group_id` or `authorize_all_groups` must be set.
 * `description` - (Optional) A brief description of the authorization rule.
 
-## Attributes Reference
+## Attribute Reference
 
-No additional attributes are exported.
+This resource exports no additional attributes.
 
 ## Timeouts
 
@@ -44,12 +44,36 @@ No additional attributes are exported.
 
 ## Import
 
-AWS Client VPN authorization rules can be imported using the endpoint ID and target network CIDR. If there is a specific group name that is included as well. All values are separated by a `,`.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AWS Client VPN authorization rules using the endpoint ID and target network CIDR. If there is a specific group name, include that also. All values are separated by a `,`. For example:
 
+Using the endpoint ID and target network CIDR:
+
+```terraform
+import {
+  to = aws_ec2_client_vpn_authorization_rule.example
+  id = "cvpn-endpoint-0ac3a1abbccddd666,10.1.0.0/24"
+}
 ```
-$ terraform import aws_ec2_client_vpn_authorization_rule.example cvpn-endpoint-0ac3a1abbccddd666,10.1.0.0/24
+
+Using the endpoint ID, target network CIDR, and group name:
+
+```terraform
+import {
+  to = aws_ec2_client_vpn_authorization_rule.example
+  id = "cvpn-endpoint-0ac3a1abbccddd666,10.1.0.0/24,team-a"
+}
 ```
 
+**Using `terraform import` to import** AWS Client VPN authorization rules using the endpoint ID and target network CIDR. If there is a specific group name, include that also. All values are separated by a `,`. For example:
+
+Using the endpoint ID and target network CIDR:
+
+```console
+% terraform import aws_ec2_client_vpn_authorization_rule.example cvpn-endpoint-0ac3a1abbccddd666,10.1.0.0/24
 ```
-$ terraform import aws_ec2_client_vpn_authorization_rule.example cvpn-endpoint-0ac3a1abbccddd666,10.1.0.0/24,team-a
+
+Using the endpoint ID, target network CIDR, and group name:
+
+```console
+% terraform import aws_ec2_client_vpn_authorization_rule.example cvpn-endpoint-0ac3a1abbccddd666,10.1.0.0/24,team-a
 ```
diff --git a/website/docs/r/ec2_client_vpn_endpoint.html.markdown b/website/docs/r/ec2_client_vpn_endpoint.html.markdown
index 4d1654e6cd5..901db72c413 100644
--- a/website/docs/r/ec2_client_vpn_endpoint.html.markdown
+++ b/website/docs/r/ec2_client_vpn_endpoint.html.markdown
@@ -34,7 +34,7 @@ resource "aws_ec2_client_vpn_endpoint" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `authentication_options` - (Required) Information about the authentication method to be used to authenticate clients.
 * `client_cidr_block` - (Required) The IPv4 address range, in CIDR notation, from which to assign client IP addresses. The address range cannot overlap with the local CIDR of the VPC in which the associated subnet is located, or the routes that you add manually. The address range cannot be changed after the Client VPN endpoint has been created. The CIDR block should be /22 or greater.
@@ -81,19 +81,29 @@ One of the following arguments must be supplied:
 * `cloudwatch_log_stream` - (Optional) The name of the CloudWatch Logs log stream to which the connection data is published.
 * `enabled` - (Required) Indicates whether connection logging is enabled.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The ARN of the Client VPN endpoint.
 * `dns_name` - The DNS name to be used by clients when establishing their VPN session.
 * `id` - The ID of the Client VPN endpoint.
+* `self_service_portal_url` - The URL of the self-service portal.
 * `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
 
 ## Import
 
-AWS Client VPN endpoints can be imported using the `id` value found via `aws ec2 describe-client-vpn-endpoints`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AWS Client VPN endpoints using the `id` value found via `aws ec2 describe-client-vpn-endpoints`. For example:
 
+```terraform
+import {
+  to = aws_ec2_client_vpn_endpoint.example
+  id = "cvpn-endpoint-0ac3a1abbccddd666"
+}
 ```
-$ terraform import aws_ec2_client_vpn_endpoint.example cvpn-endpoint-0ac3a1abbccddd666
+
+Using `terraform import`, import AWS Client VPN endpoints using the `id` value found via `aws ec2 describe-client-vpn-endpoints`. For example:
+
+```console
+% terraform import aws_ec2_client_vpn_endpoint.example cvpn-endpoint-0ac3a1abbccddd666
 ```
diff --git a/website/docs/r/ec2_client_vpn_network_association.html.markdown b/website/docs/r/ec2_client_vpn_network_association.html.markdown
index 1e7afcb7889..0111ecb0da5 100644
--- a/website/docs/r/ec2_client_vpn_network_association.html.markdown
+++ b/website/docs/r/ec2_client_vpn_network_association.html.markdown
@@ -22,14 +22,14 @@ resource "aws_ec2_client_vpn_network_association" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `client_vpn_endpoint_id` - (Required) The ID of the Client VPN endpoint.
 * `subnet_id` - (Required) The ID of the subnet to associate with the Client VPN endpoint.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The unique ID of the target network association.
 * `association_id` - The unique ID of the target network association.
@@ -44,8 +44,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-AWS Client VPN network associations can be imported using the endpoint ID and the association ID. Values are separated by a `,`.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AWS Client VPN network associations using the endpoint ID and the association ID. Values are separated by a `,`. For example:
 
+```terraform
+import {
+  to = aws_ec2_client_vpn_network_association.example
+  id = "cvpn-endpoint-0ac3a1abbccddd666,vpn-assoc-0b8db902465d069ad"
+}
 ```
-$ terraform import aws_ec2_client_vpn_network_association.example cvpn-endpoint-0ac3a1abbccddd666,vpn-assoc-0b8db902465d069ad
+
+Using `terraform import`, import AWS Client VPN network associations using the endpoint ID and the association ID. Values are separated by a `,`. For example:
+
+```console
+% terraform import aws_ec2_client_vpn_network_association.example cvpn-endpoint-0ac3a1abbccddd666,vpn-assoc-0b8db902465d069ad
 ```
diff --git a/website/docs/r/ec2_client_vpn_route.html.markdown b/website/docs/r/ec2_client_vpn_route.html.markdown
index 186dd084678..f243919f93b 100644
--- a/website/docs/r/ec2_client_vpn_route.html.markdown
+++ b/website/docs/r/ec2_client_vpn_route.html.markdown
@@ -43,16 +43,16 @@ resource "aws_ec2_client_vpn_endpoint" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `client_vpn_endpoint_id` - (Required) The ID of the Client VPN endpoint.
 * `destination_cidr_block` - (Required) The IPv4 address range, in CIDR notation, of the route destination.
 * `description` - (Optional) A brief description of the route.
 * `target_vpc_subnet_id` - (Required) The ID of the Subnet to route the traffic through. It must already be attached to the Client VPN.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the Client VPN endpoint.
 * `origin` - Indicates how the Client VPN route was added. Will be `add-route` for routes created by this resource.
@@ -67,8 +67,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-AWS Client VPN routes can be imported using the endpoint ID, target subnet ID, and destination CIDR block. All values are separated by a `,`.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AWS Client VPN routes using the endpoint ID, target subnet ID, and destination CIDR block. All values are separated by a `,`. For example:
 
+```terraform
+import {
+  to = aws_ec2_client_vpn_route.example
+  id = "cvpn-endpoint-1234567890abcdef,subnet-9876543210fedcba,10.1.0.0/24"
+}
 ```
-$ terraform import aws_ec2_client_vpn_route.example cvpn-endpoint-1234567890abcdef,subnet-9876543210fedcba,10.1.0.0/24
+
+Using `terraform import`, import AWS Client VPN routes using the endpoint ID, target subnet ID, and destination CIDR block. All values are separated by a `,`. For example:
+
+```console
+% terraform import aws_ec2_client_vpn_route.example cvpn-endpoint-1234567890abcdef,subnet-9876543210fedcba,10.1.0.0/24
 ```
diff --git a/website/docs/r/ec2_fleet.html.markdown b/website/docs/r/ec2_fleet.html.markdown
index fda832ae473..cd02229e1e0 100644
--- a/website/docs/r/ec2_fleet.html.markdown
+++ b/website/docs/r/ec2_fleet.html.markdown
@@ -30,7 +30,7 @@ resource "aws_ec2_fleet" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `context` - (Optional) Reserved.
 * `excess_capacity_termination_policy` - (Optional) Whether running instances should be terminated if the total target capacity of the EC2 Fleet is decreased below the current size of the EC2. Valid values: `no-termination`, `termination`. Defaults to `termination`. Supported only for fleets of type `maintain`.
@@ -199,9 +199,9 @@ This configuration block supports the following:
 
 * `total_target_capacity` - (Required) The number of units to request, filled using `default_target_capacity_type`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Fleet identifier
 * `arn` - The ARN of the fleet
@@ -225,8 +225,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_ec2_fleet` can be imported by using the Fleet identifier, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_ec2_fleet` using the Fleet identifier. For example:
 
+```terraform
+import {
+  to = aws_ec2_fleet.example
+  id = "fleet-b9b55d27-c5fc-41ac-a6f3-48fcc91f080c"
+}
 ```
-$ terraform import aws_ec2_fleet.example fleet-b9b55d27-c5fc-41ac-a6f3-48fcc91f080c
+
+Using `terraform import`, import `aws_ec2_fleet` using the Fleet identifier. For example:
+
+```console
+% terraform import aws_ec2_fleet.example fleet-b9b55d27-c5fc-41ac-a6f3-48fcc91f080c
 ```
diff --git a/website/docs/r/ec2_host.html.markdown b/website/docs/r/ec2_host.html.markdown
index fff0822f551..6a3aa7cf292 100644
--- a/website/docs/r/ec2_host.html.markdown
+++ b/website/docs/r/ec2_host.html.markdown
@@ -25,8 +25,9 @@ resource "aws_ec2_host" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
+* `asset_id` - (Optional) The ID of the Outpost hardware asset on which to allocate the Dedicated Hosts. This parameter is supported only if you specify OutpostArn. If you are allocating the Dedicated Hosts in a Region, omit this parameter.
 * `auto_placement` - (Optional) Indicates whether the host accepts any untargeted instance launches that match its instance type configuration, or if it only accepts Host tenancy instance launches that specify its unique host ID. Valid values: `on`, `off`. Default: `on`.
 * `availability_zone` - (Required) The Availability Zone in which to allocate the Dedicated Host.
 * `host_recovery` - (Optional) Indicates whether to enable or disable host recovery for the Dedicated Host. Valid values: `on`, `off`. Default: `off`.
@@ -35,9 +36,9 @@ The following arguments are supported:
 * `outpost_arn` - (Optional) The Amazon Resource Name (ARN) of the AWS Outpost on which to allocate the Dedicated Host.
 * `tags` - (Optional) Map of tags to assign to this resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the allocated Dedicated Host. This is used to launch an instance onto a specific host.
 * `arn` - The ARN of the Dedicated Host.
@@ -46,8 +47,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Hosts can be imported using the host `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import hosts using the host `id`. For example:
 
+```terraform
+import {
+  to = aws_ec2_host.example
+  id = "h-0385a99d0e4b20cbb"
+}
 ```
-$ terraform import aws_ec2_host.example h-0385a99d0e4b20cbb
+
+Using `terraform import`, import hosts using the host `id`. For example:
+
+```console
+% terraform import aws_ec2_host.example h-0385a99d0e4b20cbb
 ```
diff --git a/website/docs/r/ec2_image_block_public_access.markdown b/website/docs/r/ec2_image_block_public_access.markdown
new file mode 100644
index 00000000000..871599db420
--- /dev/null
+++ b/website/docs/r/ec2_image_block_public_access.markdown
@@ -0,0 +1,43 @@
+---
+subcategory: "EC2 (Elastic Compute Cloud)"
+layout: "aws"
+page_title: "AWS: aws_ec2_image_block_public_access"
+description: |-
+  Provides a regional public access block for AMIs. This prevents AMIs from being made publicly accessible.
+---
+
+# Resource: aws_ec2_image_block_public_access
+
+Provides a regional public access block for AMIs. This prevents AMIs from being made publicly accessible.
+If you already have public AMIs, they will remain publicly available.
+
+~> **NOTE:** Deleting this resource does not change the block public access value, the resource in simply removed from state instead.
+
+## Example Usage
+
+```terraform
+# Prevent making AMIs publicly accessible in the region and account for which the provider is configured
+resource "aws_ec2_image_block_public_access" "test" {
+  state = "block-new-sharing"
+}
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `state` - (Required) The state of block public access for AMIs at the account level in the configured AWS Region. Valid values: `unblocked` and `block-new-sharing`.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `update` - (Default `10m`)
+
+## Import
+
+You cannot import this resource.
diff --git a/website/docs/r/ec2_instance_connect_endpoint.html.markdown b/website/docs/r/ec2_instance_connect_endpoint.html.markdown
new file mode 100644
index 00000000000..eb4e9595cd0
--- /dev/null
+++ b/website/docs/r/ec2_instance_connect_endpoint.html.markdown
@@ -0,0 +1,65 @@
+---
+subcategory: "EC2 (Elastic Compute Cloud)"
+layout: "aws"
+page_title: "AWS: aws_ec2_instance_connect_endpoint"
+description: |-
+  Provides an EC2 Instance Connect Endpoint resource.
+---
+
+# Resource: aws_ec2_instance_connect_endpoint
+
+Manages an EC2 Instance Connect Endpoint.
+
+## Example Usage
+
+```terraform
+resource "aws_ec2_instance_connect_endpoint" "example" {
+  subnet_id = aws_subnet.example.id
+}
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `preserve_client_ip` - (Optional) Indicates whether your client's IP address is preserved as the source. Default: `true`.
+* `security_group_ids` - (Optional) One or more security groups to associate with the endpoint. If you don't specify a security group, the default security group for the VPC will be associated with the endpoint.
+* `subnet_id` - (Required) The ID of the subnet in which to create the EC2 Instance Connect Endpoint.
+* `tags` - (Optional) Map of tags to assign to this resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `10m`)
+- `delete` - (Default `10m`)
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the EC2 Instance Connect Endpoint.
+* `availability_zone` - The Availability Zone of the EC2 Instance Connect Endpoint.
+* `dns_name` - The DNS name of the EC2 Instance Connect Endpoint.
+* `fips_dns_name` - The DNS name of the EC2 Instance Connect FIPS Endpoint.
+* `network_interface_ids` - The IDs of the ENIs that Amazon EC2 automatically created when creating the EC2 Instance Connect Endpoint.
+* `owner_id` - The ID of the AWS account that created the EC2 Instance Connect Endpoint.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `vpc_id` - The ID of the VPC in which the EC2 Instance Connect Endpoint was created.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EC2 Instance Connect Endpoints using the `id`. For example:
+
+```terraform
+import {
+  to = aws_ec2_instance_connect_endpoint.example
+  id = "eice-012345678"
+}
+```
+
+Using `terraform import`, import EC2 Instance Connect Endpoints using the `id`. For example:
+
+```console
+% terraform import aws_ec2_instance_connect_endpoint.example eice-012345678
+```
diff --git a/website/docs/r/ec2_instance_state.html.markdown b/website/docs/r/ec2_instance_state.html.markdown
index 92a5a6e8f0b..defa772b053 100644
--- a/website/docs/r/ec2_instance_state.html.markdown
+++ b/website/docs/r/ec2_instance_state.html.markdown
@@ -57,9 +57,9 @@ The following arguments are optional:
 
 * `force` - (Optional) Whether to request a forced stop when `state` is `stopped`. Otherwise (_i.e._, `state` is `running`), ignored. When an instance is forced to stop, it does not flush file system caches or file system metadata, and you must subsequently perform file system check and repair. Not recommended for Windows instances. Defaults to `false`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - ID of the instance (matches `instance_id`).
 
@@ -73,8 +73,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_ec2_instance_state` can be imported by using the `instance_id` attribute, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_ec2_instance_state` using the `instance_id` attribute. For example:
 
+```terraform
+import {
+  to = aws_ec2_instance_state.test
+  id = "i-02cae6557dfcf2f96"
+}
 ```
-$ terraform import aws_ec2_instance_state.test i-02cae6557dfcf2f96
+
+Using `terraform import`, import `aws_ec2_instance_state` using the `instance_id` attribute. For example:
+
+```console
+% terraform import aws_ec2_instance_state.test i-02cae6557dfcf2f96
 ```
diff --git a/website/docs/r/ec2_local_gateway_route.html.markdown b/website/docs/r/ec2_local_gateway_route.html.markdown
index 5c9fbb1d7f9..cc1b93ec0ed 100644
--- a/website/docs/r/ec2_local_gateway_route.html.markdown
+++ b/website/docs/r/ec2_local_gateway_route.html.markdown
@@ -28,16 +28,25 @@ The following arguments are required:
 * `local_gateway_route_table_id` - (Required) Identifier of EC2 Local Gateway Route Table.
 * `local_gateway_virtual_interface_group_id` - (Required) Identifier of EC2 Local Gateway Virtual Interface Group.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - EC2 Local Gateway Route Table identifier and destination CIDR block separated by underscores (`_`)
 
 ## Import
 
-`aws_ec2_local_gateway_route` can be imported by using the EC2 Local Gateway Route Table identifier and destination CIDR block separated by underscores (`_`), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_ec2_local_gateway_route` using the EC2 Local Gateway Route Table identifier and destination CIDR block separated by underscores (`_`). For example:
 
+```terraform
+import {
+  to = aws_ec2_local_gateway_route.example
+  id = "lgw-rtb-12345678_172.16.0.0/16"
+}
 ```
-$ terraform import aws_ec2_local_gateway_route.example lgw-rtb-12345678_172.16.0.0/16
+
+Using `terraform import`, import `aws_ec2_local_gateway_route` using the EC2 Local Gateway Route Table identifier and destination CIDR block separated by underscores (`_`). For example:
+
+```console
+% terraform import aws_ec2_local_gateway_route.example lgw-rtb-12345678_172.16.0.0/16
 ```
diff --git a/website/docs/r/ec2_local_gateway_route_table_vpc_association.html.markdown b/website/docs/r/ec2_local_gateway_route_table_vpc_association.html.markdown
index c5e8194e152..302eed180f5 100644
--- a/website/docs/r/ec2_local_gateway_route_table_vpc_association.html.markdown
+++ b/website/docs/r/ec2_local_gateway_route_table_vpc_association.html.markdown
@@ -38,17 +38,26 @@ The following arguments are optional:
 
 * `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Identifier of EC2 Local Gateway Route Table VPC Association.
 * `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
 
 ## Import
 
-`aws_ec2_local_gateway_route_table_vpc_association` can be imported by using the Local Gateway Route Table VPC Association identifier, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_ec2_local_gateway_route_table_vpc_association` using the Local Gateway Route Table VPC Association identifier. For example:
 
+```terraform
+import {
+  to = aws_ec2_local_gateway_route_table_vpc_association.example
+  id = "lgw-vpc-assoc-1234567890abcdef"
+}
 ```
-$ terraform import aws_ec2_local_gateway_route_table_vpc_association.example lgw-vpc-assoc-1234567890abcdef
+
+Using `terraform import`, import `aws_ec2_local_gateway_route_table_vpc_association` using the Local Gateway Route Table VPC Association identifier. For example:
+
+```console
+% terraform import aws_ec2_local_gateway_route_table_vpc_association.example lgw-vpc-assoc-1234567890abcdef
 ```
diff --git a/website/docs/r/ec2_managed_prefix_list.html.markdown b/website/docs/r/ec2_managed_prefix_list.html.markdown
index 7d7f744ceb6..a26d6b1edc9 100644
--- a/website/docs/r/ec2_managed_prefix_list.html.markdown
+++ b/website/docs/r/ec2_managed_prefix_list.html.markdown
@@ -50,7 +50,7 @@ resource "aws_ec2_managed_prefix_list" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `address_family` - (Required, Forces new resource) Address family (`IPv4` or `IPv6`) of this prefix list.
 * `entry` - (Optional) Configuration block for prefix list entry. Detailed below. Different entries may have overlapping CIDR blocks, but a particular CIDR should not be duplicated.
@@ -63,9 +63,9 @@ The following arguments are supported:
 * `cidr` - (Required) CIDR block of this entry.
 * `description` - (Optional) Description of this entry. Due to API limitations, updating only the description of an existing entry requires temporarily removing and re-adding the entry.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the prefix list.
 * `id` - ID of the prefix list.
@@ -75,8 +75,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Prefix Lists can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Prefix Lists using the `id`. For example:
 
+```terraform
+import {
+  to = aws_ec2_managed_prefix_list.default
+  id = "pl-0570a1d2d725c16be"
+}
 ```
-$ terraform import aws_ec2_managed_prefix_list.default pl-0570a1d2d725c16be
+
+Using `terraform import`, import Prefix Lists using the `id`. For example:
+
+```console
+% terraform import aws_ec2_managed_prefix_list.default pl-0570a1d2d725c16be
 ```
diff --git a/website/docs/r/ec2_managed_prefix_list_entry.html.markdown b/website/docs/r/ec2_managed_prefix_list_entry.html.markdown
index 672d624fba6..8b252dde79c 100644
--- a/website/docs/r/ec2_managed_prefix_list_entry.html.markdown
+++ b/website/docs/r/ec2_managed_prefix_list_entry.html.markdown
@@ -3,28 +3,20 @@ subcategory: "VPC (Virtual Private Cloud)"
 layout: "aws"
 page_title: "AWS: aws_ec2_managed_prefix_list_entry"
 description: |-
-  Provides a managed prefix list entry resource.
+  Use the `aws_ec2_managed_prefix_list_entry` resource to manage a managed prefix list entry.
 ---
 
 # Resource: aws_ec2_managed_prefix_list_entry
 
-Provides a managed prefix list entry resource.
+Use the `aws_prefix_list_entry` resource to manage a managed prefix list entry.
 
-~> **NOTE on Managed Prefix Lists and Managed Prefix List Entries:** Terraform
-currently provides both a standalone Managed Prefix List Entry resource (a single entry),
-and a [Managed Prefix List resource](ec2_managed_prefix_list.html) with entries defined
-in-line. At this time you cannot use a Managed Prefix List with in-line rules in
-conjunction with any Managed Prefix List Entry resources. Doing so will cause a conflict
-of entries and will overwrite entries.
+~> **NOTE:** Terraform currently provides two resources for managing Managed Prefix Lists and Managed Prefix List Entries. The standalone resource, [Managed Prefix List Entry](ec2_managed_prefix_list_entry.html), is used to manage a single entry. The [Managed Prefix List resource](ec2_managed_prefix_list.html) is used to manage multiple entries defined in-line. It is important to note that you cannot use a Managed Prefix List with in-line rules in conjunction with any Managed Prefix List Entry resources. This will result in a conflict of entries and will cause the entries to be overwritten.
 
-~> **NOTE on Managed Prefix Lists with many entries:**  To improved execution times on larger
-updates, if you plan to create a prefix list with more than 100 entries, it is **recommended**
-that you use the inline `entry` block as part of the [Managed Prefix List resource](ec2_managed_prefix_list.html)
-resource instead.
+~> **NOTE:** To improve execution times on larger updates, it is recommended to use the inline `entry` block as part of the Managed Prefix List resource when creating a prefix list with more than 100 entries. You can find more information about the resource [here](ec2_managed_prefix_list.html).
 
 ## Example Usage
 
-Basic usage
+Basic usage.
 
 ```terraform
 resource "aws_ec2_managed_prefix_list" "example" {
@@ -46,22 +38,31 @@ resource "aws_ec2_managed_prefix_list_entry" "entry_1" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `cidr` - (Required) CIDR block of this entry.
-* `description` - (Optional) Description of this entry. Due to API limitations, updating only the description of an entry requires recreating the entry.
+* `description` - (Optional) Description of this entry. Please note that due to API limitations, updating only the description of an entry will require recreating the entry.
 * `prefix_list_id` - (Required) CIDR block of this entry.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - ID of the managed prefix list entry.
 
 ## Import
 
-Prefix List Entries can be imported using the `prefix_list_id` and `cidr` separated by a `,`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import prefix list entries using `prefix_list_id` and `cidr` separated by a comma (`,`). For example:
 
+```terraform
+import {
+  to = aws_ec2_managed_prefix_list_entry.default
+  id = "pl-0570a1d2d725c16be,10.0.3.0/24"
+}
 ```
-$ terraform import aws_ec2_managed_prefix_list_entry.default pl-0570a1d2d725c16be,10.0.3.0/24
+
+Using `terraform import`, import prefix list entries using `prefix_list_id` and `cidr` separated by a comma (`,`). For example:
+
+```console
+% terraform import aws_ec2_managed_prefix_list_entry.default pl-0570a1d2d725c16be,10.0.3.0/24
 ```
diff --git a/website/docs/r/ec2_network_insights_analysis.html.markdown b/website/docs/r/ec2_network_insights_analysis.html.markdown
index 97675bcec5f..bf15b94e9fd 100644
--- a/website/docs/r/ec2_network_insights_analysis.html.markdown
+++ b/website/docs/r/ec2_network_insights_analysis.html.markdown
@@ -36,9 +36,9 @@ The following arguments are optional:
 * `wait_for_completion` - (Optional) If enabled, the resource will wait for the Network Insights Analysis status to change to `succeeded` or `failed`. Setting this to `false` will skip the process. Default: `true`.
 * `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `alternate_path_hints` - Potential intermediate components of a feasible path. Described below.
 * `arn` - ARN of the Network Insights Analysis.
@@ -60,8 +60,17 @@ The `alternate_path_hints` object supports the following:
 
 ## Import
 
-Network Insights Analyses can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Network Insights Analyses using the `id`. For example:
 
+```terraform
+import {
+  to = aws_ec2_network_insights_analysis.test
+  id = "nia-0462085c957f11a55"
+}
 ```
-$ terraform import aws_ec2_network_insights_analysis.test nia-0462085c957f11a55
+
+Using `terraform import`, import Network Insights Analyses using the `id`. For example:
+
+```console
+% terraform import aws_ec2_network_insights_analysis.test nia-0462085c957f11a55
 ```
diff --git a/website/docs/r/ec2_network_insights_path.html.markdown b/website/docs/r/ec2_network_insights_path.html.markdown
index 345bc0b5369..a76f57a9557 100644
--- a/website/docs/r/ec2_network_insights_path.html.markdown
+++ b/website/docs/r/ec2_network_insights_path.html.markdown
@@ -24,8 +24,8 @@ resource "aws_ec2_network_insights_path" "test" {
 
 The following arguments are required:
 
-* `source` - (Required) ID of the resource which is the source of the path. Can be an Instance, Internet Gateway, Network Interface, Transit Gateway, VPC Endpoint, VPC Peering Connection or VPN Gateway.
-* `destination` - (Required) ID of the resource which is the source of the path. Can be an Instance, Internet Gateway, Network Interface, Transit Gateway, VPC Endpoint, VPC Peering Connection or VPN Gateway.
+* `source` - (Required) ID or ARN of the resource which is the source of the path. Can be an Instance, Internet Gateway, Network Interface, Transit Gateway, VPC Endpoint, VPC Peering Connection or VPN Gateway. If the resource is in another account, you must specify an ARN.
+* `destination` - (Required) ID or ARN of the resource which is the destination of the path. Can be an Instance, Internet Gateway, Network Interface, Transit Gateway, VPC Endpoint, VPC Peering Connection or VPN Gateway. If the resource is in another account, you must specify an ARN.
 * `protocol` - (Required) Protocol to use for analysis. Valid options are `tcp` or `udp`.
 
 The following arguments are optional:
@@ -35,18 +35,29 @@ The following arguments are optional:
 * `destination_port` - (Optional) Destination port to analyze access to.
 * `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the Network Insights Path.
+* `destination_arn` - ARN of the destination.
 * `id` - ID of the Network Insights Path.
+* `source_arn` - ARN of the source.
 * `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
 
 ## Import
 
-Network Insights Paths can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Network Insights Paths using the `id`. For example:
 
+```terraform
+import {
+  to = aws_ec2_network_insights_path.test
+  id = "nip-00edfba169923aefd"
+}
 ```
-$ terraform import aws_ec2_network_insights_path.test nip-00edfba169923aefd
+
+Using `terraform import`, import Network Insights Paths using the `id`. For example:
+
+```console
+% terraform import aws_ec2_network_insights_path.test nip-00edfba169923aefd
 ```
diff --git a/website/docs/r/ec2_serial_console_access.html.markdown b/website/docs/r/ec2_serial_console_access.html.markdown
index 523b64f039e..80104e17f9e 100644
--- a/website/docs/r/ec2_serial_console_access.html.markdown
+++ b/website/docs/r/ec2_serial_console_access.html.markdown
@@ -22,18 +22,27 @@ resource "aws_ec2_serial_console_access" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `enabled` - (Optional) Whether or not serial console access is enabled. Valid values are `true` or `false`. Defaults to `true`.
 
-## Attributes Reference
+## Attribute Reference
 
-No additional attributes are exported.
+This resource exports no additional attributes.
 
 ## Import
 
-Serial console access state can be imported, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import serial console access state. For example:
 
+```terraform
+import {
+  to = aws_ec2_serial_console_access.example
+  id = "default"
+}
 ```
-$ terraform import aws_ec2_serial_console_access.example default
+
+Using `terraform import`, import serial console access state. For example:
+
+```console
+% terraform import aws_ec2_serial_console_access.example default
 ```
diff --git a/website/docs/r/ec2_subnet_cidr_reservation.html.markdown b/website/docs/r/ec2_subnet_cidr_reservation.html.markdown
index 1bfedbbce56..edaa6ccde82 100644
--- a/website/docs/r/ec2_subnet_cidr_reservation.html.markdown
+++ b/website/docs/r/ec2_subnet_cidr_reservation.html.markdown
@@ -22,24 +22,33 @@ resource "aws_ec2_subnet_cidr_reservation" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `cidr_block` - (Required) The CIDR block for the reservation.
 * `reservation_type` - (Required) The type of reservation to create. Valid values: `explicit`, `prefix`
 * `subnet_id` - (Required) The ID of the subnet to create the reservation for.
 * `description` - (Optional) A brief description of the reservation.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - ID of the CIDR reservation.
 * `owner_id` - ID of the AWS account that owns this CIDR reservation.
 
 ## Import
 
-Existing CIDR reservations can be imported using `SUBNET_ID:RESERVATION_ID`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Existing CIDR reservations using `SUBNET_ID:RESERVATION_ID`. For example:
 
+```terraform
+import {
+  to = aws_ec2_subnet_cidr_reservation.example
+  id = "subnet-01llsxvsxabqiymcz:scr-4mnvz6wb7otksjcs9"
+}
 ```
-$ terraform import aws_ec2_subnet_cidr_reservation.example subnet-01llsxvsxabqiymcz:scr-4mnvz6wb7otksjcs9
+
+Using `terraform import`, import Existing CIDR reservations using `SUBNET_ID:RESERVATION_ID`. For example:
+
+```console
+% terraform import aws_ec2_subnet_cidr_reservation.example subnet-01llsxvsxabqiymcz:scr-4mnvz6wb7otksjcs9
 ```
diff --git a/website/docs/r/ec2_tag.html.markdown b/website/docs/r/ec2_tag.html.markdown
index 0104fe6f387..80cf7e6c140 100644
--- a/website/docs/r/ec2_tag.html.markdown
+++ b/website/docs/r/ec2_tag.html.markdown
@@ -40,22 +40,31 @@ resource "aws_ec2_tag" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `resource_id` - (Required) The ID of the EC2 resource to manage the tag for.
 * `key` - (Required) The tag name.
 * `value` - (Required) The value of the tag.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - EC2 resource identifier and key, separated by a comma (`,`)
 
 ## Import
 
-`aws_ec2_tag` can be imported by using the EC2 resource identifier and key, separated by a comma (`,`), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_ec2_tag` using the EC2 resource identifier and key, separated by a comma (`,`). For example:
 
+```terraform
+import {
+  to = aws_ec2_tag.example
+  id = "tgw-attach-1234567890abcdef,Name"
+}
 ```
-$ terraform import aws_ec2_tag.example tgw-attach-1234567890abcdef,Name
+
+Using `terraform import`, import `aws_ec2_tag` using the EC2 resource identifier and key, separated by a comma (`,`). For example:
+
+```console
+% terraform import aws_ec2_tag.example tgw-attach-1234567890abcdef,Name
 ```
diff --git a/website/docs/r/ec2_traffic_mirror_filter.html.markdown b/website/docs/r/ec2_traffic_mirror_filter.html.markdown
index 4671c867b2a..adc9478759e 100644
--- a/website/docs/r/ec2_traffic_mirror_filter.html.markdown
+++ b/website/docs/r/ec2_traffic_mirror_filter.html.markdown
@@ -24,15 +24,15 @@ resource "aws_ec2_traffic_mirror_filter" "foo" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `description` - (Optional, Forces new resource) A description of the filter.
 * `network_services` - (Optional) List of amazon network services that should be mirrored. Valid values: `amazon-dns`.
 * `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The ARN of the traffic mirror filter.
 * `id` - The name of the filter.
@@ -40,8 +40,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Traffic mirror filter can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import traffic mirror filter using the `id`. For example:
 
+```terraform
+import {
+  to = aws_ec2_traffic_mirror_filter.foo
+  id = "tmf-0fbb93ddf38198f64"
+}
 ```
-$ terraform import aws_ec2_traffic_mirror_filter.foo tmf-0fbb93ddf38198f64
+
+Using `terraform import`, import traffic mirror filter using the `id`. For example:
+
+```console
+% terraform import aws_ec2_traffic_mirror_filter.foo tmf-0fbb93ddf38198f64
 ```
diff --git a/website/docs/r/ec2_traffic_mirror_filter_rule.html.markdown b/website/docs/r/ec2_traffic_mirror_filter_rule.html.markdown
index 9232febc87a..06538dca9a4 100644
--- a/website/docs/r/ec2_traffic_mirror_filter_rule.html.markdown
+++ b/website/docs/r/ec2_traffic_mirror_filter_rule.html.markdown
@@ -55,7 +55,7 @@ resource "aws_ec2_traffic_mirror_filter_rule" "rulein" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `description` - (Optional) Description of the traffic mirror filter rule.
 * `traffic_mirror_filter_id`  - (Required) ID of the traffic mirror filter to which this rule should be added
@@ -73,17 +73,26 @@ Traffic mirror port range support following attributes:
 * `from_port` - (Optional) Starting port of the range
 * `to_port` - (Optional) Ending port of the range
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the traffic mirror filter rule.
 * `id` - Name of the traffic mirror filter rule.
 
 ## Import
 
-Traffic mirror rules can be imported using the `traffic_mirror_filter_id` and `id` separated by `:` e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import traffic mirror rules using the `traffic_mirror_filter_id` and `id` separated by `:`. For example:
 
+```terraform
+import {
+  to = aws_ec2_traffic_mirror_filter_rule.rule
+  id = "tmf-0fbb93ddf38198f64:tmfr-05a458f06445d0aee"
+}
 ```
-$ terraform import aws_ec2_traffic_mirror_filter_rule.rule tmf-0fbb93ddf38198f64:tmfr-05a458f06445d0aee
+
+Using `terraform import`, import traffic mirror rules using the `traffic_mirror_filter_id` and `id` separated by `:`. For example:
+
+```console
+% terraform import aws_ec2_traffic_mirror_filter_rule.rule tmf-0fbb93ddf38198f64:tmfr-05a458f06445d0aee
 ```
diff --git a/website/docs/r/ec2_traffic_mirror_session.html.markdown b/website/docs/r/ec2_traffic_mirror_session.html.markdown
index 975331aed3c..a3399e2e3ee 100644
--- a/website/docs/r/ec2_traffic_mirror_session.html.markdown
+++ b/website/docs/r/ec2_traffic_mirror_session.html.markdown
@@ -36,7 +36,7 @@ resource "aws_ec2_traffic_mirror_session" "session" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `description` - (Optional) A description of the traffic mirror session.
 * `network_interface_id` - (Required, Forces new) ID of the source network interface. Not all network interfaces are eligible as mirror sources. On EC2 instances only nitro based instances support mirroring.
@@ -47,9 +47,9 @@ The following arguments are supported:
 * `virtual_network_id` - (Optional) - The VXLAN ID for the Traffic Mirror session. For more information about the VXLAN protocol, see RFC 7348. If you do not specify a VirtualNetworkId, an account-wide unique id is chosen at random.
 * `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The ARN of the traffic mirror session.
 * `id` - The name of the session.
@@ -58,8 +58,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Traffic mirror sessions can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import traffic mirror sessions using the `id`. For example:
 
+```terraform
+import {
+  to = aws_ec2_traffic_mirror_session.session
+  id = "tms-0d8aa3ca35897b82e"
+}
 ```
-$ terraform import aws_ec2_traffic_mirror_session.session tms-0d8aa3ca35897b82e
+
+Using `terraform import`, import traffic mirror sessions using the `id`. For example:
+
+```console
+% terraform import aws_ec2_traffic_mirror_session.session tms-0d8aa3ca35897b82e
 ```
diff --git a/website/docs/r/ec2_traffic_mirror_target.html.markdown b/website/docs/r/ec2_traffic_mirror_target.html.markdown
index d38ac0875e8..7eb39bbb27b 100644
--- a/website/docs/r/ec2_traffic_mirror_target.html.markdown
+++ b/website/docs/r/ec2_traffic_mirror_target.html.markdown
@@ -34,7 +34,7 @@ resource "aws_ec2_traffic_mirror_target" "gwlb" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `description` - (Optional, Forces new) A description of the traffic mirror session.
 * `network_interface_id` - (Optional, Forces new) The network interface ID that is associated with the target.
@@ -44,9 +44,9 @@ The following arguments are supported:
 
 **NOTE:** Either `network_interface_id` or `network_load_balancer_arn` should be specified and both should not be specified together
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the Traffic Mirror target.
 * `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
@@ -55,8 +55,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Traffic mirror targets can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import traffic mirror targets using the `id`. For example:
 
+```terraform
+import {
+  to = aws_ec2_traffic_mirror_target.target
+  id = "tmt-0c13a005422b86606"
+}
 ```
-$ terraform import aws_ec2_traffic_mirror_target.target tmt-0c13a005422b86606
+
+Using `terraform import`, import traffic mirror targets using the `id`. For example:
+
+```console
+% terraform import aws_ec2_traffic_mirror_target.target tmt-0c13a005422b86606
 ```
diff --git a/website/docs/r/ec2_transit_gateway.html.markdown b/website/docs/r/ec2_transit_gateway.html.markdown
index 40b0e86b176..fb45e253ecc 100644
--- a/website/docs/r/ec2_transit_gateway.html.markdown
+++ b/website/docs/r/ec2_transit_gateway.html.markdown
@@ -20,7 +20,7 @@ resource "aws_ec2_transit_gateway" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `amazon_side_asn` - (Optional) Private Autonomous System Number (ASN) for the Amazon side of a BGP session. The range is `64512` to `65534` for 16-bit ASNs and `4200000000` to `4294967294` for 32-bit ASNs. Default value: `64512`.
 
@@ -36,9 +36,9 @@ The following arguments are supported:
 * `transit_gateway_cidr_blocks` - (Optional) One or more IPv4 or IPv6 CIDR blocks for the transit gateway. Must be a size /24 CIDR block or larger for IPv4, or a size /64 CIDR block or larger for IPv6.
 * `vpn_ecmp_support` - (Optional) Whether VPN Equal Cost Multipath Protocol support is enabled. Valid values: `disable`, `enable`. Default value: `enable`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - EC2 Transit Gateway Amazon Resource Name (ARN)
 * `association_default_route_table_id` - Identifier of the default association route table
@@ -57,8 +57,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_ec2_transit_gateway` can be imported by using the EC2 Transit Gateway identifier, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_ec2_transit_gateway` using the EC2 Transit Gateway identifier. For example:
 
+```terraform
+import {
+  to = aws_ec2_transit_gateway.example
+  id = "tgw-12345678"
+}
 ```
-$ terraform import aws_ec2_transit_gateway.example tgw-12345678
+
+Using `terraform import`, import `aws_ec2_transit_gateway` using the EC2 Transit Gateway identifier. For example:
+
+```console
+% terraform import aws_ec2_transit_gateway.example tgw-12345678
 ```
diff --git a/website/docs/r/ec2_transit_gateway_connect.html.markdown b/website/docs/r/ec2_transit_gateway_connect.html.markdown
index 4f08f86ed78..5c38a94a8ab 100644
--- a/website/docs/r/ec2_transit_gateway_connect.html.markdown
+++ b/website/docs/r/ec2_transit_gateway_connect.html.markdown
@@ -27,18 +27,18 @@ resource "aws_ec2_transit_gateway_connect" "attachment" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
-* `protocol` - (Optional) The tunnel protocol. Valida values: `gre`. Default is `gre`.
+* `protocol` - (Optional) The tunnel protocol. Valid values: `gre`. Default is `gre`.
 * `tags` - (Optional) Key-value tags for the EC2 Transit Gateway Connect. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 * `transit_gateway_default_route_table_association` - (Optional) Boolean whether the Connect should be associated with the EC2 Transit Gateway association default route table. This cannot be configured or perform drift detection with Resource Access Manager shared EC2 Transit Gateways. Default value: `true`.
 * `transit_gateway_default_route_table_propagation` - (Optional) Boolean whether the Connect should propagate routes with the EC2 Transit Gateway propagation default route table. This cannot be configured or perform drift detection with Resource Access Manager shared EC2 Transit Gateways. Default value: `true`.
 * `transit_gateway_id` - (Required) Identifier of EC2 Transit Gateway.
 * `transport_attachment_id` - (Required) The underlaying VPC attachment
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - EC2 Transit Gateway Attachment identifier
 * `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
@@ -53,8 +53,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_ec2_transit_gateway_connect` can be imported by using the EC2 Transit Gateway Connect identifier, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_ec2_transit_gateway_connect` using the EC2 Transit Gateway Connect identifier. For example:
 
+```terraform
+import {
+  to = aws_ec2_transit_gateway_connect.example
+  id = "tgw-attach-12345678"
+}
 ```
-$ terraform import aws_ec2_transit_gateway_connect.example tgw-attach-12345678
+
+Using `terraform import`, import `aws_ec2_transit_gateway_connect` using the EC2 Transit Gateway Connect identifier. For example:
+
+```console
+% terraform import aws_ec2_transit_gateway_connect.example tgw-attach-12345678
 ```
diff --git a/website/docs/r/ec2_transit_gateway_connect_peer.html.markdown b/website/docs/r/ec2_transit_gateway_connect_peer.html.markdown
index 484f87a40e8..6b0ef13c31d 100644
--- a/website/docs/r/ec2_transit_gateway_connect_peer.html.markdown
+++ b/website/docs/r/ec2_transit_gateway_connect_peer.html.markdown
@@ -27,7 +27,7 @@ resource "aws_ec2_transit_gateway_connect_peer" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `bgp_asn` - (Optional) The BGP ASN number assigned customer device. If not provided, it will use the same BGP ASN as is associated with Transit Gateway.
 * `inside_cidr_blocks` - (Required) The CIDR block that will be used for addressing within the tunnel. It must contain exactly one IPv4 CIDR block and up to one IPv6 CIDR block. The IPv4 CIDR block must be /29 size and must be within 169.254.0.0/16 range, with exception of: 169.254.0.0/29, 169.254.1.0/29, 169.254.2.0/29, 169.254.3.0/29, 169.254.4.0/29, 169.254.5.0/29, 169.254.169.248/29. The IPv6 CIDR block must be /125 size and must be within fd00::/8. The first IP from each CIDR block is assigned for customer gateway, the second and third is for Transit Gateway (An example: from range 169.254.100.0/29, .1 is assigned to customer gateway and .2 and .3 are assigned to Transit Gateway)
@@ -36,9 +36,9 @@ The following arguments are supported:
 * `transit_gateway_address` - (Optional) The IP address assigned to Transit Gateway, which will be used as tunnel endpoint. This address must be from associated Transit Gateway CIDR block. The address must be from the same address family as `peer_address`. If not set explicitly, it will be selected from associated Transit Gateway CIDR blocks
 * `transit_gateway_attachment_id` - (Required) The Transit Gateway Connect
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - EC2 Transit Gateway Connect Peer identifier
 * `arn` - EC2 Transit Gateway Connect Peer ARN
@@ -55,8 +55,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_ec2_transit_gateway_connect_peer` can be imported by using the EC2 Transit Gateway Connect Peer identifier, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_ec2_transit_gateway_connect_peer` using the EC2 Transit Gateway Connect Peer identifier. For example:
 
+```terraform
+import {
+  to = aws_ec2_transit_gateway_connect_peer.example
+  id = "tgw-connect-peer-12345678"
+}
 ```
-$ terraform import aws_ec2_transit_gateway_connect_peer.example tgw-connect-peer-12345678
+
+Using `terraform import`, import `aws_ec2_transit_gateway_connect_peer` using the EC2 Transit Gateway Connect Peer identifier. For example:
+
+```console
+% terraform import aws_ec2_transit_gateway_connect_peer.example tgw-connect-peer-12345678
 ```
diff --git a/website/docs/r/ec2_transit_gateway_multicast_domain.html.markdown b/website/docs/r/ec2_transit_gateway_multicast_domain.html.markdown
index f9b75d0d3b9..613b2d05733 100644
--- a/website/docs/r/ec2_transit_gateway_multicast_domain.html.markdown
+++ b/website/docs/r/ec2_transit_gateway_multicast_domain.html.markdown
@@ -145,7 +145,7 @@ resource "aws_ec2_transit_gateway_multicast_group_member" "member2" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `transit_gateway_id` - (Required) EC2 Transit Gateway identifier. The EC2 Transit Gateway must have `multicast_support` enabled.
 * `auto_accept_shared_associations` - (Optional) Whether to automatically accept cross-account subnet associations that are associated with the EC2 Transit Gateway Multicast Domain. Valid values: `disable`, `enable`. Default value: `disable`.
@@ -153,9 +153,9 @@ The following arguments are supported:
 * `static_sources_support` - (Optional) Whether to enable support for statically configuring multicast group sources for the EC2 Transit Gateway Multicast Domain. Valid values: `disable`, `enable`. Default value: `disable`.
 * `tags` - (Optional) Key-value tags for the EC2 Transit Gateway Multicast Domain. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - EC2 Transit Gateway Multicast Domain identifier.
 * `arn` - EC2 Transit Gateway Multicast Domain Amazon Resource Name (ARN).
@@ -171,8 +171,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_ec2_transit_gateway_multicast_domain` can be imported by using the EC2 Transit Gateway Multicast Domain identifier, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_ec2_transit_gateway_multicast_domain` using the EC2 Transit Gateway Multicast Domain identifier. For example:
 
+```terraform
+import {
+  to = aws_ec2_transit_gateway_multicast_domain.example
+  id = "tgw-mcast-domain-12345"
+}
 ```
-terraform import aws_ec2_transit_gateway_multicast_domain.example tgw-mcast-domain-12345
+
+Using `terraform import`, import `aws_ec2_transit_gateway_multicast_domain` using the EC2 Transit Gateway Multicast Domain identifier. For example:
+
+```console
+% terraform import aws_ec2_transit_gateway_multicast_domain.example tgw-mcast-domain-12345
 ```
diff --git a/website/docs/r/ec2_transit_gateway_multicast_domain_association.html.markdown b/website/docs/r/ec2_transit_gateway_multicast_domain_association.html.markdown
index 55ce859f125..bad4a1121a5 100644
--- a/website/docs/r/ec2_transit_gateway_multicast_domain_association.html.markdown
+++ b/website/docs/r/ec2_transit_gateway_multicast_domain_association.html.markdown
@@ -36,15 +36,15 @@ resource "aws_ec2_transit_gateway_multicast_domain_association" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `subnet_id` - (Required) The ID of the subnet to associate with the transit gateway multicast domain.
 * `transit_gateway_attachment_id` - (Required) The ID of the transit gateway attachment.
 * `transit_gateway_multicast_domain_id` - (Required) The ID of the transit gateway multicast domain.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - EC2 Transit Gateway Multicast Domain Association identifier.
 
diff --git a/website/docs/r/ec2_transit_gateway_multicast_group_member.html.markdown b/website/docs/r/ec2_transit_gateway_multicast_group_member.html.markdown
index 158f89b9d08..95e82b0b74f 100644
--- a/website/docs/r/ec2_transit_gateway_multicast_group_member.html.markdown
+++ b/website/docs/r/ec2_transit_gateway_multicast_group_member.html.markdown
@@ -23,14 +23,14 @@ resource "aws_ec2_transit_gateway_multicast_group_member" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `group_ip_address` - (Required) The IP address assigned to the transit gateway multicast group.
 * `network_interface_id` - (Required) The group members' network interface ID to register with the transit gateway multicast group.
 * `transit_gateway_multicast_domain_id` - (Required) The ID of the transit gateway multicast domain.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - EC2 Transit Gateway Multicast Group Member identifier.
diff --git a/website/docs/r/ec2_transit_gateway_multicast_group_source.html.markdown b/website/docs/r/ec2_transit_gateway_multicast_group_source.html.markdown
index 1d7721368eb..f35f7b83bf9 100644
--- a/website/docs/r/ec2_transit_gateway_multicast_group_source.html.markdown
+++ b/website/docs/r/ec2_transit_gateway_multicast_group_source.html.markdown
@@ -23,14 +23,14 @@ resource "aws_ec2_transit_gateway_multicast_group_source" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `group_ip_address` - (Required) The IP address assigned to the transit gateway multicast group.
 * `network_interface_id` - (Required) The group members' network interface ID to register with the transit gateway multicast group.
 * `transit_gateway_multicast_domain_id` - (Required) The ID of the transit gateway multicast domain.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - EC2 Transit Gateway Multicast Group Member identifier.
diff --git a/website/docs/r/ec2_transit_gateway_peering_attachment.html.markdown b/website/docs/r/ec2_transit_gateway_peering_attachment.html.markdown
index b245f4ba9e6..6710ef02c97 100644
--- a/website/docs/r/ec2_transit_gateway_peering_attachment.html.markdown
+++ b/website/docs/r/ec2_transit_gateway_peering_attachment.html.markdown
@@ -60,7 +60,7 @@ A full example of how to create a Transit Gateway in one AWS account, share it w
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `peer_account_id` - (Optional) Account ID of EC2 Transit Gateway to peer with. Defaults to the account ID the [AWS provider][1] is currently connected to.
 * `peer_region` - (Required) Region of EC2 Transit Gateway to peer with.
@@ -68,19 +68,28 @@ The following arguments are supported:
 * `tags` - (Optional) Key-value tags for the EC2 Transit Gateway Peering Attachment. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 * `transit_gateway_id` - (Required) Identifier of EC2 Transit Gateway.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - EC2 Transit Gateway Attachment identifier
 * `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
 
 ## Import
 
-`aws_ec2_transit_gateway_peering_attachment` can be imported by using the EC2 Transit Gateway Attachment identifier, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_ec2_transit_gateway_peering_attachment` using the EC2 Transit Gateway Attachment identifier. For example:
 
-```sh
-terraform import aws_ec2_transit_gateway_peering_attachment.example tgw-attach-12345678
+```terraform
+import {
+  to = aws_ec2_transit_gateway_peering_attachment.example
+  id = "tgw-attach-12345678"
+}
+```
+
+Using `terraform import`, import `aws_ec2_transit_gateway_peering_attachment` using the EC2 Transit Gateway Attachment identifier. For example:
+
+```console
+% terraform import aws_ec2_transit_gateway_peering_attachment.example tgw-attach-12345678
 ```
 
 [1]: /docs/providers/aws/index.html
diff --git a/website/docs/r/ec2_transit_gateway_peering_attachment_accepter.html.markdown b/website/docs/r/ec2_transit_gateway_peering_attachment_accepter.html.markdown
index ba3b5425048..8653262e736 100644
--- a/website/docs/r/ec2_transit_gateway_peering_attachment_accepter.html.markdown
+++ b/website/docs/r/ec2_transit_gateway_peering_attachment_accepter.html.markdown
@@ -26,14 +26,14 @@ A full example of how to create a Transit Gateway in one AWS account, share it w
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `transit_gateway_attachment_id` - (Required) The ID of the EC2 Transit Gateway Peering Attachment to manage.
 * `tags` - (Optional) Key-value tags for the EC2 Transit Gateway Peering Attachment. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - EC2 Transit Gateway Attachment identifier
 * `transit_gateway_id` - Identifier of EC2 Transit Gateway.
@@ -43,8 +43,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_ec2_transit_gateway_peering_attachment_accepter` can be imported by using the EC2 Transit Gateway Attachment identifier, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_ec2_transit_gateway_peering_attachment_accepter` using the EC2 Transit Gateway Attachment identifier. For example:
 
+```terraform
+import {
+  to = aws_ec2_transit_gateway_peering_attachment_accepter.example
+  id = "tgw-attach-12345678"
+}
 ```
-$ terraform import aws_ec2_transit_gateway_peering_attachment_accepter.example tgw-attach-12345678
+
+Using `terraform import`, import `aws_ec2_transit_gateway_peering_attachment_accepter` using the EC2 Transit Gateway Attachment identifier. For example:
+
+```console
+% terraform import aws_ec2_transit_gateway_peering_attachment_accepter.example tgw-attach-12345678
 ```
diff --git a/website/docs/r/ec2_transit_gateway_policy_table.html.markdown b/website/docs/r/ec2_transit_gateway_policy_table.html.markdown
index 5f94f7c025c..626a6af9e32 100644
--- a/website/docs/r/ec2_transit_gateway_policy_table.html.markdown
+++ b/website/docs/r/ec2_transit_gateway_policy_table.html.markdown
@@ -24,14 +24,14 @@ resource "aws_ec2_transit_gateway_policy_table" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `transit_gateway_id` - (Required) EC2 Transit Gateway identifier.
 * `tags` - (Optional) Key-value tags for the EC2 Transit Gateway Policy Table. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - EC2 Transit Gateway Policy Table Amazon Resource Name (ARN).
 * `id` - EC2 Transit Gateway Policy Table identifier.
@@ -40,8 +40,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_ec2_transit_gateway_policy_table` can be imported by using the EC2 Transit Gateway Policy Table identifier, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_ec2_transit_gateway_policy_table` using the EC2 Transit Gateway Policy Table identifier. For example:
 
+```terraform
+import {
+  to = aws_ec2_transit_gateway_policy_table.example
+  id = "tgw-rtb-12345678"
+}
 ```
-$ terraform import aws_ec2_transit_gateway_policy_table.example tgw-rtb-12345678
+
+Using `terraform import`, import `aws_ec2_transit_gateway_policy_table` using the EC2 Transit Gateway Policy Table identifier. For example:
+
+```console
+% terraform import aws_ec2_transit_gateway_policy_table.example tgw-rtb-12345678
 ```
diff --git a/website/docs/r/ec2_transit_gateway_policy_table_association.html.markdown b/website/docs/r/ec2_transit_gateway_policy_table_association.html.markdown
index 48d55d2aeba..38b5a7d3f18 100644
--- a/website/docs/r/ec2_transit_gateway_policy_table_association.html.markdown
+++ b/website/docs/r/ec2_transit_gateway_policy_table_association.html.markdown
@@ -21,14 +21,14 @@ resource "aws_ec2_transit_gateway_policy_table_association" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `transit_gateway_attachment_id` - (Required) Identifier of EC2 Transit Gateway Attachment.
 * `transit_gateway_policy_table_id` - (Required) Identifier of EC2 Transit Gateway Policy Table.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - EC2 Transit Gateway Policy Table identifier combined with EC2 Transit Gateway Attachment identifier
 * `resource_id` - Identifier of the resource
@@ -36,8 +36,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_ec2_transit_gateway_policy_table_association` can be imported by using the EC2 Transit Gateway Policy Table identifier, an underscore, and the EC2 Transit Gateway Attachment identifier, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_ec2_transit_gateway_policy_table_association` using the EC2 Transit Gateway Policy Table identifier, an underscore, and the EC2 Transit Gateway Attachment identifier. For example:
 
+```terraform
+import {
+  to = aws_ec2_transit_gateway_policy_table_association.example
+  id = "tgw-rtb-12345678_tgw-attach-87654321"
+}
 ```
-$ terraform import aws_ec2_transit_gateway_policy_table_association.example tgw-rtb-12345678_tgw-attach-87654321
+
+Using `terraform import`, import `aws_ec2_transit_gateway_policy_table_association` using the EC2 Transit Gateway Policy Table identifier, an underscore, and the EC2 Transit Gateway Attachment identifier. For example:
+
+```console
+% terraform import aws_ec2_transit_gateway_policy_table_association.example tgw-rtb-12345678_tgw-attach-87654321
 ```
diff --git a/website/docs/r/ec2_transit_gateway_prefix_list_reference.html.markdown b/website/docs/r/ec2_transit_gateway_prefix_list_reference.html.markdown
index 9cd2d5f154f..0b57dd2558c 100644
--- a/website/docs/r/ec2_transit_gateway_prefix_list_reference.html.markdown
+++ b/website/docs/r/ec2_transit_gateway_prefix_list_reference.html.markdown
@@ -44,16 +44,25 @@ The following arguments are optional:
 * `blackhole` - (Optional) Indicates whether to drop traffic that matches the Prefix List. Defaults to `false`.
 * `transit_gateway_attachment_id` - (Optional) Identifier of EC2 Transit Gateway Attachment.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - EC2 Transit Gateway Route Table identifier and EC2 Prefix List identifier, separated by an underscore (`_`)
 
 ## Import
 
-`aws_ec2_transit_gateway_prefix_list_reference` can be imported by using the EC2 Transit Gateway Route Table identifier and EC2 Prefix List identifier, separated by an underscore (`_`), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_ec2_transit_gateway_prefix_list_reference` using the EC2 Transit Gateway Route Table identifier and EC2 Prefix List identifier, separated by an underscore (`_`). For example:
+
+```terraform
+import {
+  to = aws_ec2_transit_gateway_prefix_list_reference.example
+  id = "tgw-rtb-12345678_pl-12345678"
+}
+```
+
+Using `terraform import`, import `aws_ec2_transit_gateway_prefix_list_reference` using the EC2 Transit Gateway Route Table identifier and EC2 Prefix List identifier, separated by an underscore (`_`). For example:
 
 ```console
-$ terraform import aws_ec2_transit_gateway_prefix_list_reference.example tgw-rtb-12345678_pl-12345678
+% terraform import aws_ec2_transit_gateway_prefix_list_reference.example tgw-rtb-12345678_pl-12345678
 ```
diff --git a/website/docs/r/ec2_transit_gateway_route.html.markdown b/website/docs/r/ec2_transit_gateway_route.html.markdown
index dc7bc244df5..e9176ecff37 100644
--- a/website/docs/r/ec2_transit_gateway_route.html.markdown
+++ b/website/docs/r/ec2_transit_gateway_route.html.markdown
@@ -34,23 +34,32 @@ resource "aws_ec2_transit_gateway_route" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `destination_cidr_block` - (Required) IPv4 or IPv6 RFC1924 CIDR used for destination matches. Routing decisions are based on the most specific match.
 * `transit_gateway_attachment_id` - (Optional) Identifier of EC2 Transit Gateway Attachment (required if `blackhole` is set to false).
 * `blackhole` - (Optional) Indicates whether to drop traffic that matches this route (default to `false`).
 * `transit_gateway_route_table_id` - (Required) Identifier of EC2 Transit Gateway Route Table.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - EC2 Transit Gateway Route Table identifier combined with destination
 
 ## Import
 
-`aws_ec2_transit_gateway_route` can be imported by using the EC2 Transit Gateway Route Table, an underscore, and the destination, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_ec2_transit_gateway_route` using the EC2 Transit Gateway Route Table, an underscore, and the destination. For example:
 
+```terraform
+import {
+  to = aws_ec2_transit_gateway_route.example
+  id = "tgw-rtb-12345678_0.0.0.0/0"
+}
 ```
-$ terraform import aws_ec2_transit_gateway_route.example tgw-rtb-12345678_0.0.0.0/0
+
+Using `terraform import`, import `aws_ec2_transit_gateway_route` using the EC2 Transit Gateway Route Table, an underscore, and the destination. For example:
+
+```console
+% terraform import aws_ec2_transit_gateway_route.example tgw-rtb-12345678_0.0.0.0/0
 ```
diff --git a/website/docs/r/ec2_transit_gateway_route_table.html.markdown b/website/docs/r/ec2_transit_gateway_route_table.html.markdown
index 0f8d9bc08d0..6f3250e23d2 100644
--- a/website/docs/r/ec2_transit_gateway_route_table.html.markdown
+++ b/website/docs/r/ec2_transit_gateway_route_table.html.markdown
@@ -20,14 +20,14 @@ resource "aws_ec2_transit_gateway_route_table" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `transit_gateway_id` - (Required) Identifier of EC2 Transit Gateway.
 * `tags` - (Optional) Key-value tags for the EC2 Transit Gateway Route Table. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - EC2 Transit Gateway Route Table Amazon Resource Name (ARN).
 * `default_association_route_table` - Boolean whether this is the default association route table for the EC2 Transit Gateway.
@@ -37,8 +37,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_ec2_transit_gateway_route_table` can be imported by using the EC2 Transit Gateway Route Table identifier, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_ec2_transit_gateway_route_table` using the EC2 Transit Gateway Route Table identifier. For example:
 
+```terraform
+import {
+  to = aws_ec2_transit_gateway_route_table.example
+  id = "tgw-rtb-12345678"
+}
 ```
-$ terraform import aws_ec2_transit_gateway_route_table.example tgw-rtb-12345678
+
+Using `terraform import`, import `aws_ec2_transit_gateway_route_table` using the EC2 Transit Gateway Route Table identifier. For example:
+
+```console
+% terraform import aws_ec2_transit_gateway_route_table.example tgw-rtb-12345678
 ```
diff --git a/website/docs/r/ec2_transit_gateway_route_table_association.html.markdown b/website/docs/r/ec2_transit_gateway_route_table_association.html.markdown
index 63c2f242f9b..da6a820c5a9 100644
--- a/website/docs/r/ec2_transit_gateway_route_table_association.html.markdown
+++ b/website/docs/r/ec2_transit_gateway_route_table_association.html.markdown
@@ -21,15 +21,15 @@ resource "aws_ec2_transit_gateway_route_table_association" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `transit_gateway_attachment_id` - (Required) Identifier of EC2 Transit Gateway Attachment.
 * `transit_gateway_route_table_id` - (Required) Identifier of EC2 Transit Gateway Route Table.
 * `replace_existing_association` - (Optional) Boolean whether the Gateway Attachment should remove any current Route Table association before associating with the specified Route Table. Default value: `false`. This argument is intended for use with EC2 Transit Gateways shared into the current account, otherwise the `transit_gateway_default_route_table_association` argument of the `aws_ec2_transit_gateway_vpc_attachment` resource should be used.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - EC2 Transit Gateway Route Table identifier combined with EC2 Transit Gateway Attachment identifier
 * `resource_id` - Identifier of the resource
@@ -37,8 +37,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_ec2_transit_gateway_route_table_association` can be imported by using the EC2 Transit Gateway Route Table identifier, an underscore, and the EC2 Transit Gateway Attachment identifier, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_ec2_transit_gateway_route_table_association` using the EC2 Transit Gateway Route Table identifier, an underscore, and the EC2 Transit Gateway Attachment identifier. For example:
 
+```terraform
+import {
+  to = aws_ec2_transit_gateway_route_table_association.example
+  id = "tgw-rtb-12345678_tgw-attach-87654321"
+}
 ```
-$ terraform import aws_ec2_transit_gateway_route_table_association.example tgw-rtb-12345678_tgw-attach-87654321
+
+Using `terraform import`, import `aws_ec2_transit_gateway_route_table_association` using the EC2 Transit Gateway Route Table identifier, an underscore, and the EC2 Transit Gateway Attachment identifier. For example:
+
+```console
+% terraform import aws_ec2_transit_gateway_route_table_association.example tgw-rtb-12345678_tgw-attach-87654321
 ```
diff --git a/website/docs/r/ec2_transit_gateway_route_table_propagation.html.markdown b/website/docs/r/ec2_transit_gateway_route_table_propagation.html.markdown
index f058b51472f..521aebb6e03 100644
--- a/website/docs/r/ec2_transit_gateway_route_table_propagation.html.markdown
+++ b/website/docs/r/ec2_transit_gateway_route_table_propagation.html.markdown
@@ -21,14 +21,14 @@ resource "aws_ec2_transit_gateway_route_table_propagation" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `transit_gateway_attachment_id` - (Required) Identifier of EC2 Transit Gateway Attachment.
 * `transit_gateway_route_table_id` - (Required) Identifier of EC2 Transit Gateway Route Table.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - EC2 Transit Gateway Route Table identifier combined with EC2 Transit Gateway Attachment identifier
 * `resource_id` - Identifier of the resource
@@ -36,8 +36,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_ec2_transit_gateway_route_table_propagation` can be imported by using the EC2 Transit Gateway Route Table identifier, an underscore, and the EC2 Transit Gateway Attachment identifier, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_ec2_transit_gateway_route_table_propagation` using the EC2 Transit Gateway Route Table identifier, an underscore, and the EC2 Transit Gateway Attachment identifier. For example:
 
+```terraform
+import {
+  to = aws_ec2_transit_gateway_route_table_propagation.example
+  id = "tgw-rtb-12345678_tgw-attach-87654321"
+}
 ```
-$ terraform import aws_ec2_transit_gateway_route_table_propagation.example tgw-rtb-12345678_tgw-attach-87654321
+
+Using `terraform import`, import `aws_ec2_transit_gateway_route_table_propagation` using the EC2 Transit Gateway Route Table identifier, an underscore, and the EC2 Transit Gateway Attachment identifier. For example:
+
+```console
+% terraform import aws_ec2_transit_gateway_route_table_propagation.example tgw-rtb-12345678_tgw-attach-87654321
 ```
diff --git a/website/docs/r/ec2_transit_gateway_vpc_attachment.html.markdown b/website/docs/r/ec2_transit_gateway_vpc_attachment.html.markdown
index b3d5746bcc8..be2848d3f15 100644
--- a/website/docs/r/ec2_transit_gateway_vpc_attachment.html.markdown
+++ b/website/docs/r/ec2_transit_gateway_vpc_attachment.html.markdown
@@ -24,7 +24,7 @@ A full example of how to create a Transit Gateway in one AWS account, share it w
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `subnet_ids` - (Required) Identifiers of EC2 Subnets.
 * `transit_gateway_id` - (Required) Identifier of EC2 Transit Gateway.
@@ -36,9 +36,9 @@ The following arguments are supported:
 * `transit_gateway_default_route_table_association` - (Optional) Boolean whether the VPC Attachment should be associated with the EC2 Transit Gateway association default route table. This cannot be configured or perform drift detection with Resource Access Manager shared EC2 Transit Gateways. Default value: `true`.
 * `transit_gateway_default_route_table_propagation` - (Optional) Boolean whether the VPC Attachment should propagate routes with the EC2 Transit Gateway propagation default route table. This cannot be configured or perform drift detection with Resource Access Manager shared EC2 Transit Gateways. Default value: `true`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - EC2 Transit Gateway Attachment identifier
 * `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
@@ -46,8 +46,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_ec2_transit_gateway_vpc_attachment` can be imported by using the EC2 Transit Gateway Attachment identifier, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_ec2_transit_gateway_vpc_attachment` using the EC2 Transit Gateway Attachment identifier. For example:
 
+```terraform
+import {
+  to = aws_ec2_transit_gateway_vpc_attachment.example
+  id = "tgw-attach-12345678"
+}
 ```
-$ terraform import aws_ec2_transit_gateway_vpc_attachment.example tgw-attach-12345678
+
+Using `terraform import`, import `aws_ec2_transit_gateway_vpc_attachment` using the EC2 Transit Gateway Attachment identifier. For example:
+
+```console
+% terraform import aws_ec2_transit_gateway_vpc_attachment.example tgw-attach-12345678
 ```
diff --git a/website/docs/r/ec2_transit_gateway_vpc_attachment_accepter.html.markdown b/website/docs/r/ec2_transit_gateway_vpc_attachment_accepter.html.markdown
index 68ca9a658e6..e6f96886ce1 100644
--- a/website/docs/r/ec2_transit_gateway_vpc_attachment_accepter.html.markdown
+++ b/website/docs/r/ec2_transit_gateway_vpc_attachment_accepter.html.markdown
@@ -32,16 +32,16 @@ A full example of how to create a Transit Gateway in one AWS account, share it w
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `transit_gateway_attachment_id` - (Required) The ID of the EC2 Transit Gateway Attachment to manage.
 * `transit_gateway_default_route_table_association` - (Optional) Boolean whether the VPC Attachment should be associated with the EC2 Transit Gateway association default route table. Default value: `true`.
 * `transit_gateway_default_route_table_propagation` - (Optional) Boolean whether the VPC Attachment should propagate routes with the EC2 Transit Gateway propagation default route table. Default value: `true`.
 * `tags` - (Optional) Key-value tags for the EC2 Transit Gateway VPC Attachment. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - EC2 Transit Gateway Attachment identifier
 * `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
@@ -55,8 +55,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_ec2_transit_gateway_vpc_attachment_accepter` can be imported by using the EC2 Transit Gateway Attachment identifier, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_ec2_transit_gateway_vpc_attachment_accepter` using the EC2 Transit Gateway Attachment identifier. For example:
 
+```terraform
+import {
+  to = aws_ec2_transit_gateway_vpc_attachment_accepter.example
+  id = "tgw-attach-12345678"
+}
 ```
-$ terraform import aws_ec2_transit_gateway_vpc_attachment_accepter.example tgw-attach-12345678
+
+Using `terraform import`, import `aws_ec2_transit_gateway_vpc_attachment_accepter` using the EC2 Transit Gateway Attachment identifier. For example:
+
+```console
+% terraform import aws_ec2_transit_gateway_vpc_attachment_accepter.example tgw-attach-12345678
 ```
diff --git a/website/docs/r/ecr_lifecycle_policy.html.markdown b/website/docs/r/ecr_lifecycle_policy.html.markdown
index 06122a5386f..71aa1ecfa04 100644
--- a/website/docs/r/ecr_lifecycle_policy.html.markdown
+++ b/website/docs/r/ecr_lifecycle_policy.html.markdown
@@ -82,22 +82,31 @@ EOF
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `repository` - (Required) Name of the repository to apply the policy.
 * `policy` - (Required) The policy document. This is a JSON formatted string. See more details about [Policy Parameters](http://docs.aws.amazon.com/AmazonECR/latest/userguide/LifecyclePolicies.html#lifecycle_policy_parameters) in the official AWS docs.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `repository` - The name of the repository.
 * `registry_id` - The registry ID where the repository was created.
 
 ## Import
 
-ECR Lifecycle Policy can be imported using the name of the repository, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import ECR Lifecycle Policy using the name of the repository. For example:
 
+```terraform
+import {
+  to = aws_ecr_lifecycle_policy.example
+  id = "tf-example"
+}
 ```
-$ terraform import aws_ecr_lifecycle_policy.example tf-example
+
+Using `terraform import`, import ECR Lifecycle Policy using the name of the repository. For example:
+
+```console
+% terraform import aws_ecr_lifecycle_policy.example tf-example
 ```
diff --git a/website/docs/r/ecr_pull_through_cache_rule.html.markdown b/website/docs/r/ecr_pull_through_cache_rule.html.markdown
index 2384adb8750..704ea29253a 100644
--- a/website/docs/r/ecr_pull_through_cache_rule.html.markdown
+++ b/website/docs/r/ecr_pull_through_cache_rule.html.markdown
@@ -24,21 +24,30 @@ resource "aws_ecr_pull_through_cache_rule" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `ecr_repository_prefix` - (Required, Forces new resource) The repository name prefix to use when caching images from the source registry.
 * `upstream_registry_url` - (Required, Forces new resource) The registry URL of the upstream public registry to use as the source.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `registry_id` - The registry ID where the repository was created.
 
 ## Import
 
-Use the `ecr_repository_prefix` to import a Pull Through Cache Rule. For example:
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import a pull-through cache rule using the `ecr_repository_prefix`. For example:
 
+```terraform
+import {
+  to = aws_ecr_pull_through_cache_rule.example
+  id = "ecr-public"
+}
 ```
-$ terraform import aws_ecr_pull_through_cache_rule.example ecr-public
+
+Using `terraform import`, import a pull-through cache rule using the `ecr_repository_prefix`. For example:
+
+```console
+% terraform import aws_ecr_pull_through_cache_rule.example ecr-public
 ```
diff --git a/website/docs/r/ecr_registry_policy.html.markdown b/website/docs/r/ecr_registry_policy.html.markdown
index 4817025a13b..29be6b589d6 100644
--- a/website/docs/r/ecr_registry_policy.html.markdown
+++ b/website/docs/r/ecr_registry_policy.html.markdown
@@ -43,20 +43,29 @@ resource "aws_ecr_registry_policy" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `policy` - (Required) The policy document. This is a JSON formatted string. For more information about building IAM policy documents with Terraform, see the [AWS IAM Policy Document Guide](https://learn.hashicorp.com/terraform/aws/iam-policy)
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `registry_id` - The registry ID where the registry was created.
 
 ## Import
 
-ECR Registry Policy can be imported using the registry id, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import ECR Registry Policy using the registry id. For example:
 
+```terraform
+import {
+  to = aws_ecr_registry_policy.example
+  id = "123456789012"
+}
 ```
-$ terraform import aws_ecr_registry_policy.example 123456789012
+
+Using `terraform import`, import ECR Registry Policy using the registry id. For example:
+
+```console
+% terraform import aws_ecr_registry_policy.example 123456789012
 ```
diff --git a/website/docs/r/ecr_registry_scanning_configuration.html.markdown b/website/docs/r/ecr_registry_scanning_configuration.html.markdown
index 46bf37d828d..67b498274f1 100644
--- a/website/docs/r/ecr_registry_scanning_configuration.html.markdown
+++ b/website/docs/r/ecr_registry_scanning_configuration.html.markdown
@@ -54,7 +54,7 @@ resource "aws_ecr_registry_scanning_configuration" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 - `scan_type` - (Required) the scanning type to set for the registry. Can be either `ENHANCED` or `BASIC`.
 - `rule` - (Optional) One or multiple blocks specifying scanning rules to determine which repository filters are used and at what frequency scanning will occur. See [below for schema](#rule).
@@ -64,16 +64,25 @@ The following arguments are supported:
 - `repository_filter` - (Required) One or more repository filter blocks, containing a `filter` (required string filtering repositories, see pattern regex [here](https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_ScanningRepositoryFilter.html)) and a `filter_type` (required string, currently only `WILDCARD` is supported).
 - `scan_frequency` - (Required) The frequency that scans are performed at for a private registry. Can be `SCAN_ON_PUSH`, `CONTINUOUS_SCAN`, or `MANUAL`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `registry_id` - The registry ID the scanning configuration applies to.
 
 ## Import
 
-ECR Scanning Configurations can be imported using the `registry_id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import ECR Scanning Configurations using the `registry_id`. For example:
 
+```terraform
+import {
+  to = aws_ecr_registry_scanning_configuration.example
+  id = "012345678901"
+}
 ```
-$ terraform import aws_ecr_registry_scanning_configuration.example 012345678901
+
+Using `terraform import`, import ECR Scanning Configurations using the `registry_id`. For example:
+
+```console
+% terraform import aws_ecr_registry_scanning_configuration.example 012345678901
 ```
diff --git a/website/docs/r/ecr_replication_configuration.html.markdown b/website/docs/r/ecr_replication_configuration.html.markdown
index b064b1fa4de..cbe31e952c7 100644
--- a/website/docs/r/ecr_replication_configuration.html.markdown
+++ b/website/docs/r/ecr_replication_configuration.html.markdown
@@ -79,7 +79,7 @@ resource "aws_ecr_replication_configuration" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `replication_configuration` - (Required) Replication configuration for a registry. See [Replication Configuration](#replication-configuration).
 
@@ -102,16 +102,25 @@ The following arguments are supported:
 * `filter` - (Required) The repository filter details.
 * `filter_type` - (Required) The repository filter type. The only supported value is `PREFIX_MATCH`, which is a repository name prefix specified with the filter parameter.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `registry_id` - The registry ID where the replication configuration was created.
 
 ## Import
 
-ECR Replication Configuration can be imported using the `registry_id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import ECR Replication Configuration using the `registry_id`. For example:
 
+```terraform
+import {
+  to = aws_ecr_replication_configuration.service
+  id = "012345678912"
+}
 ```
-$ terraform import aws_ecr_replication_configuration.service 012345678912
+
+Using `terraform import`, import ECR Replication Configuration using the `registry_id`. For example:
+
+```console
+% terraform import aws_ecr_replication_configuration.service 012345678912
 ```
diff --git a/website/docs/r/ecr_repository.html.markdown b/website/docs/r/ecr_repository.html.markdown
index e4a4b827bc5..a570e9a8ca2 100644
--- a/website/docs/r/ecr_repository.html.markdown
+++ b/website/docs/r/ecr_repository.html.markdown
@@ -25,7 +25,7 @@ resource "aws_ecr_repository" "foo" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) Name of the repository.
 * `encryption_configuration` - (Optional) Encryption configuration for the repository. See [below for schema](#encryption_configuration).
@@ -41,9 +41,9 @@ The following arguments are supported:
 * `encryption_type` - (Optional) The encryption type to use for the repository. Valid values are `AES256` or `KMS`. Defaults to `AES256`.
 * `kms_key` - (Optional) The ARN of the KMS key to use when `encryption_type` is `KMS`. If not specified, uses the default AWS managed key for ECR.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Full ARN of the repository.
 * `registry_id` - The registry ID where the repository was created.
@@ -58,8 +58,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-ECR Repositories can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import ECR Repositories using the `name`. For example:
 
+```terraform
+import {
+  to = aws_ecr_repository.service
+  id = "test-service"
+}
 ```
-$ terraform import aws_ecr_repository.service test-service
+
+Using `terraform import`, import ECR Repositories using the `name`. For example:
+
+```console
+% terraform import aws_ecr_repository.service test-service
 ```
diff --git a/website/docs/r/ecr_repository_policy.html.markdown b/website/docs/r/ecr_repository_policy.html.markdown
index cbf74b28c6a..a800cdbd965 100644
--- a/website/docs/r/ecr_repository_policy.html.markdown
+++ b/website/docs/r/ecr_repository_policy.html.markdown
@@ -56,22 +56,31 @@ resource "aws_ecr_repository_policy" "foopolicy" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `repository` - (Required) Name of the repository to apply the policy.
 * `policy` - (Required) The policy document. This is a JSON formatted string. For more information about building IAM policy documents with Terraform, see the [AWS IAM Policy Document Guide](https://learn.hashicorp.com/terraform/aws/iam-policy)
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `repository` - The name of the repository.
 * `registry_id` - The registry ID where the repository was created.
 
 ## Import
 
-ECR Repository Policy can be imported using the repository name, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import ECR Repository Policy using the repository name. For example:
 
+```terraform
+import {
+  to = aws_ecr_repository_policy.example
+  id = "example"
+}
 ```
-$ terraform import aws_ecr_repository_policy.example example
+
+Using `terraform import`, import ECR Repository Policy using the repository name. For example:
+
+```console
+% terraform import aws_ecr_repository_policy.example example
 ```
diff --git a/website/docs/r/ecrpublic_repository.html.markdown b/website/docs/r/ecrpublic_repository.html.markdown
index 0efbaf84b36..a6592a1a8ad 100644
--- a/website/docs/r/ecrpublic_repository.html.markdown
+++ b/website/docs/r/ecrpublic_repository.html.markdown
@@ -42,7 +42,7 @@ resource "aws_ecrpublic_repository" "foo" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `repository_name` - (Required) Name of the repository.
 * `catalog_data` - (Optional) Catalog data configuration for the repository. See [below for schema](#catalog_data).
@@ -57,9 +57,9 @@ The following arguments are supported:
 * `operating_systems` -  (Optional) The operating systems that the images in the repository are compatible with. On the Amazon ECR Public Gallery, the following supported operating systems will appear as badges on the repository and are used as search filters: `Linux`, `Windows`
 * `usage_text` -  (Optional) Detailed information on how to use the contents of the repository. It is publicly visible in the Amazon ECR Public Gallery. The usage text provides context, support information, and additional usage details for users of the repository. The text must be in markdown format.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Full ARN of the repository.
 * `id` - The repository name.
@@ -75,8 +75,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-ECR Public Repositories can be imported using the `repository_name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import ECR Public Repositories using the `repository_name`. For example:
 
+```terraform
+import {
+  to = aws_ecrpublic_repository.example
+  id = "example"
+}
 ```
-$ terraform import aws_ecrpublic_repository.example example
+
+Using `terraform import`, import ECR Public Repositories using the `repository_name`. For example:
+
+```console
+% terraform import aws_ecrpublic_repository.example example
 ```
diff --git a/website/docs/r/ecrpublic_repository_policy.html.markdown b/website/docs/r/ecrpublic_repository_policy.html.markdown
index dbfc31c6c90..7bc0fbc87c3 100644
--- a/website/docs/r/ecrpublic_repository_policy.html.markdown
+++ b/website/docs/r/ecrpublic_repository_policy.html.markdown
@@ -57,21 +57,30 @@ resource "aws_ecrpublic_repository_policy" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `repository_name` - (Required) Name of the repository to apply the policy.
 * `policy` - (Required) The policy document. This is a JSON formatted string. For more information about building IAM policy documents with Terraform, see the [AWS IAM Policy Document Guide](https://learn.hashicorp.com/terraform/aws/iam-policy)
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `registry_id` - The registry ID where the repository was created.
 
 ## Import
 
-ECR Public Repository Policy can be imported using the repository name, e.g.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import ECR Public Repository Policy using the repository name. For example:
 
+```terraform
+import {
+  to = aws_ecrpublic_repository_policy.example
+  id = "example"
+}
 ```
-$ terraform import aws_ecrpublic_repository_policy.example example
+
+Using `terraform import`, import ECR Public Repository Policy using the repository name. For example:
+
+```console
+% terraform import aws_ecrpublic_repository_policy.example example
 ```
diff --git a/website/docs/r/ecs_account_setting_default.html.markdown b/website/docs/r/ecs_account_setting_default.html.markdown
index 646f75f5f31..aa366058f99 100644
--- a/website/docs/r/ecs_account_setting_default.html.markdown
+++ b/website/docs/r/ecs_account_setting_default.html.markdown
@@ -25,22 +25,31 @@ resource "aws_ecs_account_setting_default" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) Name of the account setting to set. Valid values are `serviceLongArnFormat`, `taskLongArnFormat`, `containerInstanceLongArnFormat`, `awsvpcTrunking` and `containerInsights`.
 * `value` - (Required) State of the setting. Valid values are `enabled` and `disabled`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - ARN that identifies the account setting.
 * `prinicpal_arn` - ARN that identifies the account setting.
 
 ## Import
 
-ECS Account Setting defaults can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import ECS Account Setting defaults using the `name`. For example:
 
+```terraform
+import {
+  to = aws_ecs_account_setting_default.example
+  id = "taskLongArnFormat"
+}
 ```
-$ terraform import aws_ecs_account_setting_default.example taskLongArnFormat
+
+Using `terraform import`, import ECS Account Setting defaults using the `name`. For example:
+
+```console
+% terraform import aws_ecs_account_setting_default.example taskLongArnFormat
 ```
diff --git a/website/docs/r/ecs_capacity_provider.html.markdown b/website/docs/r/ecs_capacity_provider.html.markdown
index 8cc4caacfe3..a41463c7615 100644
--- a/website/docs/r/ecs_capacity_provider.html.markdown
+++ b/website/docs/r/ecs_capacity_provider.html.markdown
@@ -44,7 +44,7 @@ resource "aws_ecs_capacity_provider" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `auto_scaling_group_provider` - (Required) Configuration block for the provider for the ECS auto scaling group. Detailed below.
 * `name` - (Required) Name of the capacity provider.
@@ -64,9 +64,9 @@ The following arguments are supported:
 * `status` - (Optional) Whether auto scaling is managed by ECS. Valid values are `ENABLED` and `DISABLED`.
 * `target_capacity` - (Optional) Target utilization for the capacity provider. A number between 1 and 100.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN that identifies the capacity provider.
 * `id` - ARN that identifies the capacity provider.
@@ -74,8 +74,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-ECS Capacity Providers can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import ECS Capacity Providers using the `name`. For example:
 
+```terraform
+import {
+  to = aws_ecs_capacity_provider.example
+  id = "example"
+}
 ```
-$ terraform import aws_ecs_capacity_provider.example example
+
+Using `terraform import`, import ECS Capacity Providers using the `name`. For example:
+
+```console
+% terraform import aws_ecs_capacity_provider.example example
 ```
diff --git a/website/docs/r/ecs_cluster.html.markdown b/website/docs/r/ecs_cluster.html.markdown
index 096496f4f66..1fa1a01a290 100644
--- a/website/docs/r/ecs_cluster.html.markdown
+++ b/website/docs/r/ecs_cluster.html.markdown
@@ -54,7 +54,7 @@ resource "aws_ecs_cluster" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `configuration` - (Optional) The execute command configuration for the cluster. Detailed below.
 * `name` - (Required) Name of the cluster (up to 255 letters, numbers, hyphens, and underscores)
@@ -89,9 +89,9 @@ The following arguments are supported:
 
 * `namespace` - (Required) The ARN of the [`aws_service_discovery_http_namespace`](/docs/providers/aws/r/service_discovery_http_namespace.html) that's used when you create a service and don't specify a Service Connect configuration.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN that identifies the cluster.
 * `id` - ARN that identifies the cluster.
@@ -99,8 +99,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-ECS clusters can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import ECS clusters using the `name`. For example:
 
+```terraform
+import {
+  to = aws_ecs_cluster.stateless
+  id = "stateless-app"
+}
 ```
-$ terraform import aws_ecs_cluster.stateless stateless-app
+
+Using `terraform import`, import ECS clusters using the `name`. For example:
+
+```console
+% terraform import aws_ecs_cluster.stateless stateless-app
 ```
diff --git a/website/docs/r/ecs_cluster_capacity_providers.html.markdown b/website/docs/r/ecs_cluster_capacity_providers.html.markdown
index 24b8f3e8462..5c8f1bcc1e4 100644
--- a/website/docs/r/ecs_cluster_capacity_providers.html.markdown
+++ b/website/docs/r/ecs_cluster_capacity_providers.html.markdown
@@ -34,7 +34,7 @@ resource "aws_ecs_cluster_capacity_providers" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `capacity_providers` - (Optional) Set of names of one or more capacity providers to associate with the cluster. Valid values also include `FARGATE` and `FARGATE_SPOT`.
 * `cluster_name` - (Required, Forces new resource) Name of the ECS cluster to manage capacity providers for.
@@ -46,16 +46,25 @@ The following arguments are supported:
 * `weight` - (Optional) The relative percentage of the total number of launched tasks that should use the specified capacity provider. The `weight` value is taken into consideration after the `base` count of tasks has been satisfied. Defaults to `0`.
 * `base` - (Optional) The number of tasks, at a minimum, to run on the specified capacity provider. Only one capacity provider in a capacity provider strategy can have a base defined. Defaults to `0`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Same as `cluster_name`.
 
 ## Import
 
-ECS cluster capacity providers can be imported using the `cluster_name` attribute. For example:
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import ECS cluster capacity providers using the `cluster_name` attribute. For example:
 
+```terraform
+import {
+  to = aws_ecs_cluster_capacity_providers.example
+  id = "my-cluster"
+}
 ```
-$ terraform import aws_ecs_cluster_capacity_providers.example my-cluster
+
+Using `terraform import`, import ECS cluster capacity providers using the `cluster_name` attribute. For example:
+
+```console
+% terraform import aws_ecs_cluster_capacity_providers.example my-cluster
 ```
diff --git a/website/docs/r/ecs_service.html.markdown b/website/docs/r/ecs_service.html.markdown
index ce1cbf4a9a7..dd2c5b96906 100644
--- a/website/docs/r/ecs_service.html.markdown
+++ b/website/docs/r/ecs_service.html.markdown
@@ -272,9 +272,9 @@ For more information, see [Task Networking](https://docs.aws.amazon.com/AmazonEC
 * `dns_name` - (Optional) The name that you use in the applications of client tasks to connect to this service.
 * `port` - (Required) The listening port number for the Service Connect proxy. This port is available inside of all of the tasks within the same namespace.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `cluster` - Amazon Resource Name (ARN) of cluster which the service runs on.
 * `desired_count` - Number of instances of the task definition.
@@ -293,8 +293,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-ECS services can be imported using the `name` together with ecs cluster `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import ECS services using the `name` together with ecs cluster `name`. For example:
 
+```terraform
+import {
+  to = aws_ecs_service.imported
+  id = "cluster-name/service-name"
+}
 ```
-$ terraform import aws_ecs_service.imported cluster-name/service-name
+
+Using `terraform import`, import ECS services using the `name` together with ecs cluster `name`. For example:
+
+```console
+% terraform import aws_ecs_service.imported cluster-name/service-name
 ```
diff --git a/website/docs/r/ecs_tag.html.markdown b/website/docs/r/ecs_tag.html.markdown
index ba51c280472..233a317f35d 100644
--- a/website/docs/r/ecs_tag.html.markdown
+++ b/website/docs/r/ecs_tag.html.markdown
@@ -32,22 +32,31 @@ resource "aws_ecs_tag" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `resource_arn` - (Required) Amazon Resource Name (ARN) of the ECS resource to tag.
 * `key` - (Required) Tag name.
 * `value` - (Required) Tag value.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - ECS resource identifier and key, separated by a comma (`,`)
 
 ## Import
 
-`aws_ecs_tag` can be imported by using the ECS resource identifier and key, separated by a comma (`,`), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_ecs_tag` using the ECS resource identifier and key, separated by a comma (`,`). For example:
 
+```terraform
+import {
+  to = aws_ecs_tag.example
+  id = "arn:aws:ecs:us-east-1:123456789012:cluster/example,Name"
+}
 ```
-$ terraform import aws_ecs_tag.example arn:aws:ecs:us-east-1:123456789012:cluster/example,Name
+
+Using `terraform import`, import `aws_ecs_tag` using the ECS resource identifier and key, separated by a comma (`,`). For example:
+
+```console
+% terraform import aws_ecs_tag.example arn:aws:ecs:us-east-1:123456789012:cluster/example,Name
 ```
diff --git a/website/docs/r/ecs_task_definition.html.markdown b/website/docs/r/ecs_task_definition.html.markdown
index 65ca66e5fba..f87bf838dbc 100644
--- a/website/docs/r/ecs_task_definition.html.markdown
+++ b/website/docs/r/ecs_task_definition.html.markdown
@@ -325,9 +325,9 @@ For more information, see [Specifying an FSX Windows File Server volume in your
 * `device_name` - (Required) Elastic Inference accelerator device name. The deviceName must also be referenced in a container definition as a ResourceRequirement.
 * `device_type` - (Required) Elastic Inference accelerator type to use.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Full ARN of the Task Definition (including both `family` and `revision`).
 * `arn_without_revision` - ARN of the Task Definition with the trailing `revision` removed. This may be useful for situations where the latest task definition is always desired. If a revision isn't specified, the latest ACTIVE revision is used. See the [AWS documentation](https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_StartTask.html#ECS-StartTask-request-taskDefinition) for details.
@@ -336,8 +336,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-ECS Task Definitions can be imported via their Amazon Resource Name (ARN):
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import ECS Task Definitions using their ARNs. For example:
 
+```terraform
+import {
+  to = aws_ecs_task_definition.example
+  id = "arn:aws:ecs:us-east-1:012345678910:task-definition/mytaskfamily:123"
+}
 ```
-$ terraform import aws_ecs_task_definition.example arn:aws:ecs:us-east-1:012345678910:task-definition/mytaskfamily:123
+
+Using `terraform import`, import ECS Task Definitions using their ARNs. For example:
+
+```console
+% terraform import aws_ecs_task_definition.example arn:aws:ecs:us-east-1:012345678910:task-definition/mytaskfamily:123
 ```
diff --git a/website/docs/r/ecs_task_set.html.markdown b/website/docs/r/ecs_task_set.html.markdown
index ae4fb1e597d..155ced322e2 100644
--- a/website/docs/r/ecs_task_set.html.markdown
+++ b/website/docs/r/ecs_task_set.html.markdown
@@ -116,9 +116,9 @@ The `scale` configuration block supports the following:
 * `container_port` - (Optional) The port value, already specified in the task definition, to be used for your service discovery service.
 * `container_name` - (Optional) The container name value, already specified in the task definition, to be used for your service discovery service.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The `task_set_id`, `service` and `cluster` separated by commas (`,`).
 * `arn` - The Amazon Resource Name (ARN) that identifies the task set.
@@ -129,8 +129,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-ECS Task Sets can be imported via the `task_set_id`, `service`, and `cluster` separated by commas (`,`) e.g.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import ECS Task Sets using the `task_set_id`, `service`, and `cluster` separated by commas (`,`). For example:
 
+```terraform
+import {
+  to = aws_ecs_task_set.example
+  id = "ecs-svc/7177320696926227436,arn:aws:ecs:us-west-2:123456789101:service/example/example-1234567890,arn:aws:ecs:us-west-2:123456789101:cluster/example"
+}
 ```
-$ terraform import aws_ecs_task_set.example ecs-svc/7177320696926227436,arn:aws:ecs:us-west-2:123456789101:service/example/example-1234567890,arn:aws:ecs:us-west-2:123456789101:cluster/example
+
+Using `terraform import`, import ECS Task Sets using the `task_set_id`, `service`, and `cluster` separated by commas (`,`). For example:
+
+```console
+% terraform import aws_ecs_task_set.example ecs-svc/7177320696926227436,arn:aws:ecs:us-west-2:123456789101:service/example/example-1234567890,arn:aws:ecs:us-west-2:123456789101:cluster/example
 ```
diff --git a/website/docs/r/efs_access_point.html.markdown b/website/docs/r/efs_access_point.html.markdown
index ec4b28d1c35..99b49163938 100644
--- a/website/docs/r/efs_access_point.html.markdown
+++ b/website/docs/r/efs_access_point.html.markdown
@@ -20,7 +20,7 @@ resource "aws_efs_access_point" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `file_system_id` - (Required) ID of the file system for which the access point is intended.
 * `posix_user` - (Optional) Operating system user and group applied to all file system requests made using the access point. [Detailed](#posix_user) below.
@@ -48,9 +48,9 @@ If the `path` specified does not exist, EFS creates the root directory using the
 * `owner_uid` - (Required) POSIX user ID to apply to the `root_directory`.
 * `permissions` - (Required) POSIX permissions to apply to the RootDirectory, in the format of an octal number representing the file's mode bits.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the access point.
 * `file_system_arn` - ARN of the file system.
@@ -59,8 +59,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-The EFS access points can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import the EFS access points using the `id`. For example:
 
+```terraform
+import {
+  to = aws_efs_access_point.test
+  id = "fsap-52a643fb"
+}
 ```
-$ terraform import aws_efs_access_point.test fsap-52a643fb
+
+Using `terraform import`, import the EFS access points using the `id`. For example:
+
+```console
+% terraform import aws_efs_access_point.test fsap-52a643fb
 ```
diff --git a/website/docs/r/efs_backup_policy.html.markdown b/website/docs/r/efs_backup_policy.html.markdown
index a484685849c..49cc983cc90 100644
--- a/website/docs/r/efs_backup_policy.html.markdown
+++ b/website/docs/r/efs_backup_policy.html.markdown
@@ -29,27 +29,36 @@ resource "aws_efs_backup_policy" "policy" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `file_system_id` - (Required) The ID of the EFS file system.
 * `backup_policy` - (Required) A backup_policy object (documented below).
 
 ### Backup Policy Arguments
 
-For **backup_policy** the following attributes are supported:
+`backup_policy` supports the following arguments:
 
 * `status` - (Required) A status of the backup policy. Valid values: `ENABLED`, `DISABLED`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID that identifies the file system (e.g., fs-ccfc0d65).
 
 ## Import
 
-The EFS backup policies can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import the EFS backup policies using the `id`. For example:
 
+```terraform
+import {
+  to = aws_efs_backup_policy.example
+  id = "fs-6fa144c6"
+}
 ```
-$ terraform import aws_efs_backup_policy.example fs-6fa144c6
+
+Using `terraform import`, import the EFS backup policies using the `id`. For example:
+
+```console
+% terraform import aws_efs_backup_policy.example fs-6fa144c6
 ```
diff --git a/website/docs/r/efs_file_system.html.markdown b/website/docs/r/efs_file_system.html.markdown
index 6563621b30e..323a0f09536 100644
--- a/website/docs/r/efs_file_system.html.markdown
+++ b/website/docs/r/efs_file_system.html.markdown
@@ -38,7 +38,7 @@ resource "aws_efs_file_system" "foo_with_lifecyle_policy" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `availability_zone_name` - (Optional) the AWS Availability Zone in which to create the file system. Used to create a file system that uses One Zone storage classes. See [user guide](https://docs.aws.amazon.com/efs/latest/ug/storage-classes.html) for more information.
 * `creation_token` - (Optional) A unique name (a maximum of 64 characters are allowed)
@@ -55,21 +55,22 @@ user guide for more information.
 
 ### Lifecycle Policy Arguments
 
-For **lifecycle_policy** the following attributes are supported:
+`lifecycle_policy` supports the following arguments:
 
 * `transition_to_ia` - (Optional) Indicates how long it takes to transition files to the IA storage class. Valid values: `AFTER_1_DAY`, `AFTER_7_DAYS`, `AFTER_14_DAYS`, `AFTER_30_DAYS`, `AFTER_60_DAYS`, or `AFTER_90_DAYS`.
 * `transition_to_primary_storage_class` - (Optional) Describes the policy used to transition a file from infequent access storage to primary storage. Valid values: `AFTER_1_ACCESS`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name of the file system.
 * `availability_zone_id` - The identifier of the Availability Zone in which the file system's One Zone storage classes exist.
 * `id` - The ID that identifies the file system (e.g., fs-ccfc0d65).
 * `dns_name` - The DNS name for the filesystem per [documented convention](http://docs.aws.amazon.com/efs/latest/ug/mounting-fs-mount-cmd-dns-name.html).
-* `owner_id` - The AWS account that created the file system. If the file system was createdby an IAM user, the parent account to which the user belongs is the owner.
+* `name` - The value of the file system's `Name` tag.
 * `number_of_mount_targets` - The current number of mount targets that the file system has.
+* `owner_id` - The AWS account that created the file system. If the file system was createdby an IAM user, the parent account to which the user belongs is the owner.
 * `size_in_bytes` - The latest known metered size (in bytes) of data stored in the file system, the value is not the exact size that the file system was at any point in time. See [Size In Bytes](#size-in-bytes).
 * `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
 
@@ -81,8 +82,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-The EFS file systems can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import the EFS file systems using the `id`. For example:
 
+```terraform
+import {
+  to = aws_efs_file_system.foo
+  id = "fs-6fa144c6"
+}
 ```
-$ terraform import aws_efs_file_system.foo fs-6fa144c6
+
+Using `terraform import`, import the EFS file systems using the `id`. For example:
+
+```console
+% terraform import aws_efs_file_system.foo fs-6fa144c6
 ```
diff --git a/website/docs/r/efs_file_system_policy.html.markdown b/website/docs/r/efs_file_system_policy.html.markdown
index be80d75cd0a..581963c42b9 100644
--- a/website/docs/r/efs_file_system_policy.html.markdown
+++ b/website/docs/r/efs_file_system_policy.html.markdown
@@ -59,16 +59,25 @@ The following arguments are optional:
 
 * `bypass_policy_lockout_safety_check` - (Optional) A flag to indicate whether to bypass the `aws_efs_file_system_policy` lockout safety check. The policy lockout safety check determines whether the policy in the request will prevent the principal making the request will be locked out from making future `PutFileSystemPolicy` requests on the file system. Set `bypass_policy_lockout_safety_check` to `true` only when you intend to prevent the principal that is making the request from making a subsequent `PutFileSystemPolicy` request on the file system. The default value is `false`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID that identifies the file system (e.g., fs-ccfc0d65).
 
 ## Import
 
-The EFS file system policies can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import the EFS file system policies using the `id`. For example:
 
+```terraform
+import {
+  to = aws_efs_file_system_policy.foo
+  id = "fs-6fa144c6"
+}
 ```
-$ terraform import aws_efs_file_system_policy.foo fs-6fa144c6
+
+Using `terraform import`, import the EFS file system policies using the `id`. For example:
+
+```console
+% terraform import aws_efs_file_system_policy.foo fs-6fa144c6
 ```
diff --git a/website/docs/r/efs_mount_target.html.markdown b/website/docs/r/efs_mount_target.html.markdown
index 19fc8dfbae9..e62efe08e46 100644
--- a/website/docs/r/efs_mount_target.html.markdown
+++ b/website/docs/r/efs_mount_target.html.markdown
@@ -31,7 +31,7 @@ resource "aws_subnet" "alpha" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `file_system_id` - (Required) The ID of the file system for which the mount target is intended.
 * `subnet_id` - (Required) The ID of the subnet to add the mount target in.
@@ -40,13 +40,13 @@ which the file system may be mounted via the mount target.
 * `security_groups` - (Optional) A list of up to 5 VPC security group IDs (that must
 be for the same VPC as subnet specified) in effect for the mount target.
 
-## Attributes Reference
+## Attribute Reference
 
 ~> **Note:** The `dns_name` and `mount_target_dns_name` attributes are only useful if the mount target is in a VPC that has
 support for DNS hostnames enabled. See [Using DNS with Your VPC](http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/vpc-dns.html)
 and [VPC resource](/docs/providers/aws/r/vpc.html#enable_dns_hostnames) in Terraform for more information.
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the mount target.
 * `dns_name` - The DNS name for the EFS file system.
@@ -66,8 +66,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-The EFS mount targets can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import the EFS mount targets using the `id`. For example:
 
+```terraform
+import {
+  to = aws_efs_mount_target.alpha
+  id = "fsmt-52a643fb"
+}
 ```
-$ terraform import aws_efs_mount_target.alpha fsmt-52a643fb
+
+Using `terraform import`, import the EFS mount targets using the `id`. For example:
+
+```console
+% terraform import aws_efs_mount_target.alpha fsmt-52a643fb
 ```
diff --git a/website/docs/r/efs_replication_configuration.html.markdown b/website/docs/r/efs_replication_configuration.html.markdown
index e7f8c16745c..f37cf52d029 100644
--- a/website/docs/r/efs_replication_configuration.html.markdown
+++ b/website/docs/r/efs_replication_configuration.html.markdown
@@ -44,22 +44,22 @@ resource "aws_efs_replication_configuration" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `source_file_system_id` - (Required) The ID of the file system that is to be replicated.
 * `destination` - (Required) A destination configuration block (documented below).
 
 ### Destination Arguments
 
-For **destination** the following attributes are supported:
+`destination` supports the following arguments:
 
 * `availability_zone_name` - (Optional) The availability zone in which the replica should be created. If specified, the replica will be created with One Zone storage. If omitted, regional storage will be used.
 * `kms_key_id` - (Optional) The Key ID, ARN, alias, or alias ARN of the KMS key that should be used to encrypt the replica file system. If omitted, the default KMS key for EFS `/aws/elasticfilesystem` will be used.
 * `region` - (Optional) The region in which the replica should be created.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `creation_time` - When the replication configuration was created.
 * `original_source_file_system_arn` - The Amazon Resource Name (ARN) of the original source Amazon EFS file system in the replication configuration.
@@ -77,8 +77,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-EFS Replication Configurations can be imported using the file system ID of either the source or destination file system. When importing, the `availability_zone_name` and `kms_key_id` attributes must **not** be set in the configuration. The AWS API does not return these values when querying the replication configuration and their presence will therefore show as a diff in a subsequent plan.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EFS Replication Configurations using the file system ID of either the source or destination file system. When importing, the `availability_zone_name` and `kms_key_id` attributes must **not** be set in the configuration. The AWS API does not return these values when querying the replication configuration and their presence will therefore show as a diff in a subsequent plan. For example:
 
+```terraform
+import {
+  to = aws_efs_replication_configuration.example
+  id = "fs-id"
+}
 ```
-$ terraform import aws_efs_replication_configuration.example fs-id
+
+Using `terraform import`, import EFS Replication Configurations using the file system ID of either the source or destination file system. When importing, the `availability_zone_name` and `kms_key_id` attributes must **not** be set in the configuration. The AWS API does not return these values when querying the replication configuration and their presence will therefore show as a diff in a subsequent plan. For example:
+
+```console
+% terraform import aws_efs_replication_configuration.example fs-id
 ```
diff --git a/website/docs/r/egress_only_internet_gateway.html.markdown b/website/docs/r/egress_only_internet_gateway.html.markdown
index 86bd4f02a3e..5b46ded7f4f 100644
--- a/website/docs/r/egress_only_internet_gateway.html.markdown
+++ b/website/docs/r/egress_only_internet_gateway.html.markdown
@@ -32,22 +32,31 @@ resource "aws_egress_only_internet_gateway" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `vpc_id` - (Required) The VPC ID to create in.
 * `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the egress-only Internet gateway.
 * `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
 
 ## Import
 
-Egress-only Internet gateways can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Egress-only Internet gateways using the `id`. For example:
 
+```terraform
+import {
+  to = aws_egress_only_internet_gateway.example
+  id = "eigw-015e0e244e24dfe8a"
+}
 ```
-$ terraform import aws_egress_only_internet_gateway.example eigw-015e0e244e24dfe8a
+
+Using `terraform import`, import Egress-only Internet gateways using the `id`. For example:
+
+```console
+% terraform import aws_egress_only_internet_gateway.example eigw-015e0e244e24dfe8a
 ```
diff --git a/website/docs/r/eip.html.markdown b/website/docs/r/eip.html.markdown
index 50b2cdabf0f..b99c7e38ef6 100644
--- a/website/docs/r/eip.html.markdown
+++ b/website/docs/r/eip.html.markdown
@@ -95,7 +95,7 @@ resource "aws_eip" "byoip-ip" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `address` - (Optional) IP address from an EC2 BYOIP pool. This option is only available for VPC EIPs.
 * `associate_with_private_ip` - (Optional) User-specified primary or secondary private IP address to associate with the Elastic IP address. If no private IP address is specified, the Elastic IP address is associated with the primary private IP address.
@@ -115,9 +115,9 @@ The following arguments are supported:
 ~> **NOTE:** Specifying both `public_ipv4_pool` and `address` won't cause an error but `address` will be used in the
 case both options are defined as the api only requires one or the other.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `allocation_id` - ID that AWS assigns to represent the allocation of the Elastic IP address for use with instances in a VPC.
 * `association_id` - ID representing the association of the address with an instance in a VPC.
@@ -142,16 +142,19 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-EIPs in a VPC can be imported using their Allocation ID, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EIPs in a VPC using their Allocation ID. For example:
 
-```
-$ terraform import aws_eip.bar eipalloc-00a10e96
+```terraform
+import {
+  to = aws_eip.bar
+  id = "eipalloc-00a10e96"
+}
 ```
 
-EIPs in EC2-Classic can be imported using their Public IP, e.g.,
+Using `terraform import`, import EIPs in a VPC using their Allocation ID. For example:
 
-```
-$ terraform import aws_eip.bar 52.0.0.0
+```console
+% terraform import aws_eip.bar eipalloc-00a10e96
 ```
 
 [1]: https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AssociateAddress.html
diff --git a/website/docs/r/eip_association.html.markdown b/website/docs/r/eip_association.html.markdown
index 93ffac9f6ce..d627c8749b8 100644
--- a/website/docs/r/eip_association.html.markdown
+++ b/website/docs/r/eip_association.html.markdown
@@ -41,7 +41,7 @@ resource "aws_eip" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `allocation_id` - (Optional) The allocation ID. This is required for EC2-VPC.
 * `allow_reassociation` - (Optional, Boolean) Whether to allow an Elastic IP to
@@ -59,9 +59,9 @@ specified, the Elastic IP address is associated with the primary private IP
 address.
 * `public_ip` - (Optional) The Elastic IP address. This is required for EC2-Classic.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `association_id` - The ID that represents the association of the Elastic IP
 address with an instance.
@@ -73,8 +73,17 @@ address with an instance.
 
 ## Import
 
-EIP Assocations can be imported using their association ID.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EIP Assocations using their association IDs. For example:
 
+```terraform
+import {
+  to = aws_eip_association.test
+  id = "eipassoc-ab12c345"
+}
 ```
-$ terraform import aws_eip_association.test eipassoc-ab12c345
+
+Using `terraform import`, import EIP Assocations using their association IDs. For example:
+
+```console
+% terraform import aws_eip_association.test eipassoc-ab12c345
 ```
diff --git a/website/docs/r/eks_addon.html.markdown b/website/docs/r/eks_addon.html.markdown
index 03b61352d82..1641f97aa73 100644
--- a/website/docs/r/eks_addon.html.markdown
+++ b/website/docs/r/eks_addon.html.markdown
@@ -148,9 +148,9 @@ The following arguments are optional:
   for service accounts on your cluster](https://docs.aws.amazon.com/eks/latest/userguide/enable-iam-roles-for-service-accounts.html)
   in the Amazon EKS User Guide.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name (ARN) of the EKS add-on.
 * `id` - EKS Cluster name and EKS Addon name separated by a colon (`:`).
@@ -169,8 +169,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-EKS add-on can be imported using the `cluster_name` and `addon_name` separated by a colon (`:`), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EKS add-on using the `cluster_name` and `addon_name` separated by a colon (`:`). For example:
 
+```terraform
+import {
+  to = aws_eks_addon.my_eks_addon
+  id = "my_cluster_name:my_addon_name"
+}
 ```
-$ terraform import aws_eks_addon.my_eks_addon my_cluster_name:my_addon_name
+
+Using `terraform import`, import EKS add-on using the `cluster_name` and `addon_name` separated by a colon (`:`). For example:
+
+```console
+% terraform import aws_eks_addon.my_eks_addon my_cluster_name:my_addon_name
 ```
diff --git a/website/docs/r/eks_cluster.html.markdown b/website/docs/r/eks_cluster.html.markdown
index 0645882b83c..ee79fa371f0 100644
--- a/website/docs/r/eks_cluster.html.markdown
+++ b/website/docs/r/eks_cluster.html.markdown
@@ -122,7 +122,7 @@ data "tls_certificate" "example" {
 
 resource "aws_iam_openid_connect_provider" "example" {
   client_id_list  = ["sts.amazonaws.com"]
-  thumbprint_list = data.tls_certificate.example.certificates[*].sha1_fingerprint
+  thumbprint_list = [data.tls_certificate.example.certificates[0].sha1_fingerprint]
   url             = data.tls_certificate.example.url
 }
 
@@ -198,14 +198,14 @@ The following arguments are optional:
 
 ### encryption_config
 
-The following arguments are supported in the `encryption_config` configuration block:
+The `encryption_config` configuration block supports the following arguments:
 
 * `provider` - (Required) Configuration block with provider for encryption. Detailed below.
 * `resources` - (Required) List of strings with resources to be encrypted. Valid values: `secrets`.
 
 #### provider
 
-The following arguments are supported in the `provider` configuration block:
+The `provider` configuration block supports the following arguments:
 
 * `key_arn` - (Required) ARN of the Key Management Service (KMS) customer master key (CMK). The CMK must be symmetric, created in the same region as the cluster, and if the CMK was created in a different account, the user must have access to the CMK. For more information, see [Allowing Users in Other Accounts to Use a CMK in the AWS Key Management Service Developer Guide](https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-modifying-external-accounts.html).
 
@@ -219,7 +219,7 @@ The following arguments are supported in the `provider` configuration block:
 
 ### kubernetes_network_config
 
-The following arguments are supported in the `kubernetes_network_config` configuration block:
+The `kubernetes_network_config` configuration block supports the following arguments:
 
 * `service_ipv4_cidr` - (Optional) The CIDR block to assign Kubernetes pod and service IP addresses from. If you don't specify a block, Kubernetes assigns addresses from either the 10.100.0.0/16 or 172.20.0.0/16 CIDR blocks. We recommend that you specify a block that does not overlap with resources in other networks that are peered or connected to your VPC. You can only specify a custom CIDR block when you create a cluster, changing this value will force a new cluster to be created. The block must meet the following requirements:
 
@@ -232,7 +232,7 @@ The following arguments are supported in the `kubernetes_network_config` configu
 
 ### outpost_config
 
-The following arguments are supported in the `outpost_config` configuration block:
+The `outpost_config` configuration block supports the following arguments:
 
 * `control_plane_instance_type` - (Required) The Amazon EC2 instance type that you want to use for your local Amazon EKS cluster on Outposts. The instance type that you specify is used for all Kubernetes control plane instances. The instance type can't be changed after cluster creation. Choose an instance type based on the number of nodes that your cluster will have. If your cluster will have:
 
@@ -245,15 +245,15 @@ The following arguments are supported in the `outpost_config` configuration bloc
     For a list of the available Amazon EC2 instance types, see Compute and storage in AWS Outposts rack features  The control plane is not automatically scaled by Amazon EKS.
 
 * `control_plane_placement` - (Optional) An object representing the placement configuration for all the control plane instances of your local Amazon EKS cluster on AWS Outpost.
-The following arguments are supported in the `control_plane_placement` configuration block:
+The `control_plane_placement` configuration block supports the following arguments:
 
     * `group_name` - (Required) The name of the placement group for the Kubernetes control plane instances. This setting can't be changed after cluster creation.
 
 * `outpost_arns` - (Required) The ARN of the Outpost that you want to use for your local Amazon EKS cluster on Outposts. This argument is a list of arns, but only a single Outpost ARN is supported currently.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the cluster.
 * `certificate_authority` - Attribute block containing `certificate-authority-data` for your cluster. Detailed below.
@@ -296,8 +296,17 @@ Note that the `update` timeout is used separately for both `version` and `vpc_co
 
 ## Import
 
-EKS Clusters can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EKS Clusters using the `name`. For example:
 
+```terraform
+import {
+  to = aws_eks_cluster.my_cluster
+  id = "my_cluster"
+}
 ```
-$ terraform import aws_eks_cluster.my_cluster my_cluster
+
+Using `terraform import`, import EKS Clusters using the `name`. For example:
+
+```console
+% terraform import aws_eks_cluster.my_cluster my_cluster
 ```
diff --git a/website/docs/r/eks_fargate_profile.html.markdown b/website/docs/r/eks_fargate_profile.html.markdown
index 476a1cb89c5..f5d5550fcb8 100644
--- a/website/docs/r/eks_fargate_profile.html.markdown
+++ b/website/docs/r/eks_fargate_profile.html.markdown
@@ -73,9 +73,9 @@ The following arguments are optional:
 
 * `labels` - (Optional) Key-value map of Kubernetes labels for selection.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name (ARN) of the EKS Fargate Profile.
 * `id` - EKS Cluster name and EKS Fargate Profile name separated by a colon (`:`).
@@ -91,8 +91,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-EKS Fargate Profiles can be imported using the `cluster_name` and `fargate_profile_name` separated by a colon (`:`), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EKS Fargate Profiles using the `cluster_name` and `fargate_profile_name` separated by a colon (`:`). For example:
 
+```terraform
+import {
+  to = aws_eks_fargate_profile.my_fargate_profile
+  id = "my_cluster:my_fargate_profile"
+}
 ```
-$ terraform import aws_eks_fargate_profile.my_fargate_profile my_cluster:my_fargate_profile
+
+Using `terraform import`, import EKS Fargate Profiles using the `cluster_name` and `fargate_profile_name` separated by a colon (`:`). For example:
+
+```console
+% terraform import aws_eks_fargate_profile.my_fargate_profile my_cluster:my_fargate_profile
 ```
diff --git a/website/docs/r/eks_identity_provider_config.html.markdown b/website/docs/r/eks_identity_provider_config.html.markdown
index a9879e34e06..6d4b93a8feb 100644
--- a/website/docs/r/eks_identity_provider_config.html.markdown
+++ b/website/docs/r/eks_identity_provider_config.html.markdown
@@ -26,7 +26,7 @@ resource "aws_eks_identity_provider_config" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `cluster_name` – (Required) Name of the EKS Cluster.
 * `oidc` - (Required) Nested attribute containing [OpenID Connect](https://openid.net/connect/) identity provider information for the cluster. Detailed below.
@@ -43,9 +43,9 @@ The following arguments are supported:
 * `username_claim` - (Optional) The JWT claim that the provider will use as the username.
 * `username_prefix` - (Optional) A prefix that is prepended to username claims.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name (ARN) of the EKS Identity Provider Configuration.
 * `id` - EKS Cluster name and EKS Identity Provider Configuration name separated by a colon (`:`).
@@ -61,8 +61,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-EKS Identity Provider Configurations can be imported using the `cluster_name` and `identity_provider_config_name` separated by a colon (`:`), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EKS Identity Provider Configurations using the `cluster_name` and `identity_provider_config_name` separated by a colon (`:`). For example:
 
+```terraform
+import {
+  to = aws_eks_identity_provider_config.my_identity_provider_config
+  id = "my_cluster:my_identity_provider_config"
+}
 ```
-$ terraform import aws_eks_identity_provider_config.my_identity_provider_config my_cluster:my_identity_provider_config
+
+Using `terraform import`, import EKS Identity Provider Configurations using the `cluster_name` and `identity_provider_config_name` separated by a colon (`:`). For example:
+
+```console
+% terraform import aws_eks_identity_provider_config.my_identity_provider_config my_cluster:my_identity_provider_config
 ```
diff --git a/website/docs/r/eks_node_group.html.markdown b/website/docs/r/eks_node_group.html.markdown
index 86ee76a8bd8..de56f96ee50 100644
--- a/website/docs/r/eks_node_group.html.markdown
+++ b/website/docs/r/eks_node_group.html.markdown
@@ -189,9 +189,9 @@ The following arguments are mutually exclusive.
 * `max_unavailable` - (Optional) Desired max number of unavailable worker nodes during node group update.
 * `max_unavailable_percentage` - (Optional) Desired max percentage of unavailable worker nodes during node group update.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name (ARN) of the EKS Node Group.
 * `id` - EKS Cluster name and EKS Node Group name separated by a colon (`:`).
@@ -212,8 +212,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-EKS Node Groups can be imported using the `cluster_name` and `node_group_name` separated by a colon (`:`), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EKS Node Groups using the `cluster_name` and `node_group_name` separated by a colon (`:`). For example:
 
+```terraform
+import {
+  to = aws_eks_node_group.my_node_group
+  id = "my_cluster:my_node_group"
+}
 ```
-$ terraform import aws_eks_node_group.my_node_group my_cluster:my_node_group
+
+Using `terraform import`, import EKS Node Groups using the `cluster_name` and `node_group_name` separated by a colon (`:`). For example:
+
+```console
+% terraform import aws_eks_node_group.my_node_group my_cluster:my_node_group
 ```
diff --git a/website/docs/r/elastic_beanstalk_application.html.markdown b/website/docs/r/elastic_beanstalk_application.html.markdown
index b2c7995a5e1..fcd9f303cb4 100644
--- a/website/docs/r/elastic_beanstalk_application.html.markdown
+++ b/website/docs/r/elastic_beanstalk_application.html.markdown
@@ -32,7 +32,7 @@ resource "aws_elastic_beanstalk_application" "tftest" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The name of the application, must be unique within your account
 * `description` - (Optional) Short description of the application
@@ -45,17 +45,26 @@ Application version lifecycle (`appversion_lifecycle`) supports the following se
 * `max_age_in_days` - (Optional) The number of days to retain an application version ('max_age_in_days' and 'max_count' cannot be enabled simultaneously.).
 * `delete_source_from_s3` - (Optional) Set to `true` to delete a version's source bundle from S3 when the application version is deleted.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The ARN assigned by AWS for this Elastic Beanstalk Application.
 * `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
 
 ## Import
 
-Elastic Beanstalk Applications can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Elastic Beanstalk Applications using the `name`. For example:
 
+```terraform
+import {
+  to = aws_elastic_beanstalk_application.tf_test
+  id = "tf-test-name"
+}
 ```
-$ terraform import aws_elastic_beanstalk_application.tf_test tf-test-name
+
+Using `terraform import`, import Elastic Beanstalk Applications using the `name`. For example:
+
+```console
+% terraform import aws_elastic_beanstalk_application.tf_test tf-test-name
 ```
diff --git a/website/docs/r/elastic_beanstalk_application_version.html.markdown b/website/docs/r/elastic_beanstalk_application_version.html.markdown
index ccf9dd5f604..dd35f21ba38 100644
--- a/website/docs/r/elastic_beanstalk_application_version.html.markdown
+++ b/website/docs/r/elastic_beanstalk_application_version.html.markdown
@@ -62,9 +62,9 @@ The following arguments are optional:
 * `force_delete` - (Optional) On delete, force an Application Version to be deleted when it may be in use by multiple Elastic Beanstalk Environments.
 * `tags` - (Optional) Key-value map of tags for the Elastic Beanstalk Application Version. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN assigned by AWS for this Elastic Beanstalk Application.
 * `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
diff --git a/website/docs/r/elastic_beanstalk_configuration_template.html.markdown b/website/docs/r/elastic_beanstalk_configuration_template.html.markdown
index 9b885416742..c7f9ebd03a6 100644
--- a/website/docs/r/elastic_beanstalk_configuration_template.html.markdown
+++ b/website/docs/r/elastic_beanstalk_configuration_template.html.markdown
@@ -29,7 +29,7 @@ resource "aws_elastic_beanstalk_configuration_template" "tf_template" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) A unique name for this Template.
 * `application` – (Required) name of the application to associate with this configuration template
@@ -50,9 +50,9 @@ The `setting` field supports the following format:
 * `value` - value for the configuration option
 * `resource` - (Optional) resource name for [scheduled action](https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/command-options-general.html#command-options-general-autoscalingscheduledaction)
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `name`
 * `application`
diff --git a/website/docs/r/elastic_beanstalk_environment.html.markdown b/website/docs/r/elastic_beanstalk_environment.html.markdown
index 1a175964749..85f76d7a539 100644
--- a/website/docs/r/elastic_beanstalk_environment.html.markdown
+++ b/website/docs/r/elastic_beanstalk_environment.html.markdown
@@ -32,7 +32,7 @@ resource "aws_elastic_beanstalk_environment" "tfenvtest" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) A unique name for this Environment. This name is used
   in the application URL
@@ -103,9 +103,9 @@ resource "aws_elastic_beanstalk_environment" "tfenvtest" {
 }
 ```
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - ID of the Elastic Beanstalk Environment.
 * `name` - Name of the Elastic Beanstalk Environment.
@@ -132,8 +132,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Elastic Beanstalk Environments can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Elastic Beanstalk Environments using the `id`. For example:
 
+```terraform
+import {
+  to = aws_elastic_beanstalk_environment.prodenv
+  id = "e-rpqsewtp2j"
+}
 ```
-$ terraform import aws_elastic_beanstalk_environment.prodenv e-rpqsewtp2j
+
+Using `terraform import`, import Elastic Beanstalk Environments using the `id`. For example:
+
+```console
+% terraform import aws_elastic_beanstalk_environment.prodenv e-rpqsewtp2j
 ```
diff --git a/website/docs/r/elasticache_cluster.html.markdown b/website/docs/r/elasticache_cluster.html.markdown
index 120f693f8ad..cf39d8ee06b 100644
--- a/website/docs/r/elasticache_cluster.html.markdown
+++ b/website/docs/r/elasticache_cluster.html.markdown
@@ -160,7 +160,7 @@ The following arguments are optional:
   When the version is 6, the major and minor version can be set, e.g., `6.2`,
   or the minor version can be unspecified which will use the latest version at creation time, e.g., `6.x`.
   Otherwise, specify the full version desired, e.g., `5.0.6`.
-  The actual engine version used is returned in the attribute `engine_version_actual`, see [Attributes Reference](#attributes-reference) below.
+  The actual engine version used is returned in the attribute `engine_version_actual`, see [Attribute Reference](#attribute-reference) below. Cannot be provided with `replication_group_id.`
 * `final_snapshot_identifier` - (Optional, Redis only) Name of your final cluster snapshot. If omitted, no final snapshot will be made.
 * `ip_discovery` - (Optional) The IP version to advertise in the discovery protocol. Valid values are `ipv4` or `ipv6`.
 * `log_delivery_configuration` - (Optional, Redis only) Specifies the destination and format of Redis [SLOWLOG](https://redis.io/commands/slowlog) or Redis [Engine Log](https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/Log_Delivery.html#Log_contents-engine-log). See the documentation on [Amazon ElastiCache](https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/Log_Delivery.html). See [Log Delivery Configuration](#log-delivery-configuration) below for more details.
@@ -174,24 +174,14 @@ The minimum maintenance window is a 60 minute period. Example: `sun:05:00-sun:09
 * `preferred_availability_zones` - (Optional, Memcached only) List of the Availability Zones in which cache nodes are created. If you are creating your cluster in an Amazon VPC you can only locate nodes in Availability Zones that are associated with the subnets in the selected subnet group. The number of Availability Zones listed must equal the value of `num_cache_nodes`. If you want all the nodes in the same Availability Zone, use `availability_zone` instead, or repeat the Availability Zone multiple times in the list. Default: System chosen Availability Zones. Detecting drift of existing node availability zone is not currently supported. Updating this argument by itself to migrate existing node availability zones is not currently supported and will show a perpetual difference.
 * `preferred_outpost_arn` - (Optional, Required if `outpost_mode` is specified) The outpost ARN in which the cache cluster will be created.
 * `replication_group_id` - (Optional, Required if `engine` is not specified) ID of the replication group to which this cluster should belong. If this parameter is specified, the cluster is added to the specified replication group as a read replica; otherwise, the cluster is a standalone primary that is not part of any replication group.
-* `security_group_ids` – (Optional, VPC only) One or more VPC security groups associated with the cache cluster
+* `security_group_ids` – (Optional, VPC only) One or more VPC security groups associated with the cache cluster. Cannot be provided with `replication_group_id.`
 * `snapshot_arns` – (Optional, Redis only) Single-element string list containing an Amazon Resource Name (ARN) of a Redis RDB snapshot file stored in Amazon S3. The object name cannot contain any commas. Changing `snapshot_arns` forces a new resource.
 * `snapshot_name` - (Optional, Redis only) Name of a snapshot from which to restore data into the new node group. Changing `snapshot_name` forces a new resource.
 * `snapshot_retention_limit` - (Optional, Redis only) Number of days for which ElastiCache will retain automatic cache cluster snapshots before deleting them. For example, if you set SnapshotRetentionLimit to 5, then a snapshot that was taken today will be retained for 5 days before being deleted. If the value of SnapshotRetentionLimit is set to zero (0), backups are turned off. Please note that setting a `snapshot_retention_limit` is not supported on cache.t1.micro cache nodes
 * `snapshot_window` - (Optional, Redis only) Daily time range (in UTC) during which ElastiCache will begin taking a daily snapshot of your cache cluster. Example: 05:00-09:00
-* `subnet_group_name` – (Optional, VPC only) Name of the subnet group to be used for the cache cluster. Changing this value will re-create the resource.
+* `subnet_group_name` – (Optional, VPC only) Name of the subnet group to be used for the cache cluster. Changing this value will re-create the resource. Cannot be provided with `replication_group_id.`
 * `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
-
-## Attributes Reference
-
-In addition to all arguments above, the following attributes are exported:
-
-* `arn` - The ARN of the created ElastiCache Cluster.
-* `engine_version_actual` - Because ElastiCache pulls the latest minor or patch for a version, this attribute returns the running version of the cache engine.
-* `cache_nodes` - List of node objects including `id`, `address`, `port` and `availability_zone`.
-* `cluster_address` - (Memcached only) DNS name of the cache cluster without the port appended.
-* `configuration_endpoint` - (Memcached only) Configuration endpoint to allow host discovery.
-* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `transit_encryption_enabled` - (Optional) Enable encryption in-transit. Supported only with Memcached versions `1.6.12` and later, running in a VPC. See the [ElastiCache in-transit encryption](https://docs.aws.amazon.com/AmazonElastiCache/latest/mem-ug/in-transit-encryption-mc.html) documentation for more details.
 
 ### Log Delivery Configuration
 
@@ -202,6 +192,17 @@ The `log_delivery_configuration` block allows the streaming of Redis [SLOWLOG](h
 * `log_format` - Valid values are `json` or `text`
 * `log_type` - Valid values are  `slow-log` or `engine-log`. Max 1 of each.
 
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the created ElastiCache Cluster.
+* `engine_version_actual` - Because ElastiCache pulls the latest minor or patch for a version, this attribute returns the running version of the cache engine.
+* `cache_nodes` - List of node objects including `id`, `address`, `port` and `availability_zone`.
+* `cluster_address` - (Memcached only) DNS name of the cache cluster without the port appended.
+* `configuration_endpoint` - (Memcached only) Configuration endpoint to allow host discovery.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
 ## Timeouts
 
 [Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
@@ -212,8 +213,17 @@ The `log_delivery_configuration` block allows the streaming of Redis [SLOWLOG](h
 
 ## Import
 
-ElastiCache Clusters can be imported using the `cluster_id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import ElastiCache Clusters using the `cluster_id`. For example:
 
+```terraform
+import {
+  to = aws_elasticache_cluster.my_cluster
+  id = "my_cluster"
+}
 ```
-$ terraform import aws_elasticache_cluster.my_cluster my_cluster
+
+Using `terraform import`, import ElastiCache Clusters using the `cluster_id`. For example:
+
+```console
+% terraform import aws_elasticache_cluster.my_cluster my_cluster
 ```
diff --git a/website/docs/r/elasticache_global_replication_group.html.markdown b/website/docs/r/elasticache_global_replication_group.html.markdown
index 12074ac6421..bd5bf2e48a1 100644
--- a/website/docs/r/elasticache_global_replication_group.html.markdown
+++ b/website/docs/r/elasticache_global_replication_group.html.markdown
@@ -98,7 +98,7 @@ resource "aws_elasticache_replication_group" "secondary" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `automatic_failover_enabled` - (Optional) Specifies whether read-only replicas will be automatically promoted to read/write primary if the existing primary fails.
   When creating, by default the Global Replication Group inherits the automatic failover setting of the primary replication group.
@@ -113,7 +113,7 @@ The following arguments are supported:
   When the version is 7 or higher, the major and minor version should be set, e.g., `7.2`.
   When the version is 6, the major and minor version can be set, e.g., `6.2`,
   or the minor version can be unspecified which will use the latest version at creation time, e.g., `6.x`.
-  The actual engine version used is returned in the attribute `engine_version_actual`, see [Attributes Reference](#attributes-reference) below.
+  The actual engine version used is returned in the attribute `engine_version_actual`, see [Attribute Reference](#attribute-reference) below.
 * `global_replication_group_id_suffix` – (Required) The suffix name of a Global Datastore. If `global_replication_group_id_suffix` is changed, creates a new resource.
 * `primary_replication_group_id` – (Required) The ID of the primary cluster that accepts writes and will replicate updates to the secondary cluster. If `primary_replication_group_id` is changed, creates a new resource.
 * `global_replication_group_description` – (Optional) A user-created description for the global replication group.
@@ -123,9 +123,9 @@ The following arguments are supported:
   Specifying without a major version upgrade will fail.
   Note that ElastiCache creates a copy of this parameter group for each member replication group.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the ElastiCache Global Replication Group.
 * `arn` - The ARN of the ElastiCache Global Replication Group.
@@ -151,8 +151,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-ElastiCache Global Replication Groups can be imported using the `global_replication_group_id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import ElastiCache Global Replication Groups using the `global_replication_group_id`. For example:
 
+```terraform
+import {
+  to = aws_elasticache_global_replication_group.my_global_replication_group
+  id = "okuqm-global-replication-group-1"
+}
 ```
-$ terraform import aws_elasticache_global_replication_group.my_global_replication_group okuqm-global-replication-group-1
+
+Using `terraform import`, import ElastiCache Global Replication Groups using the `global_replication_group_id`. For example:
+
+```console
+% terraform import aws_elasticache_global_replication_group.my_global_replication_group okuqm-global-replication-group-1
 ```
diff --git a/website/docs/r/elasticache_parameter_group.html.markdown b/website/docs/r/elasticache_parameter_group.html.markdown
index 81608aeca6b..2da587fe5d8 100644
--- a/website/docs/r/elasticache_parameter_group.html.markdown
+++ b/website/docs/r/elasticache_parameter_group.html.markdown
@@ -33,7 +33,7 @@ resource "aws_elasticache_parameter_group" "default" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The name of the ElastiCache parameter group.
 * `family` - (Required) The family of the ElastiCache parameter group.
@@ -46,9 +46,9 @@ Parameter blocks support the following:
 * `name` - (Required) The name of the ElastiCache parameter.
 * `value` - (Required) The value of the ElastiCache parameter.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ElastiCache parameter group name.
 * `arn` - The AWS ARN associated with the parameter group.
@@ -56,8 +56,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-ElastiCache Parameter Groups can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import ElastiCache Parameter Groups using the `name`. For example:
 
+```terraform
+import {
+  to = aws_elasticache_parameter_group.default
+  id = "redis-params"
+}
 ```
-$ terraform import aws_elasticache_parameter_group.default redis-params
+
+Using `terraform import`, import ElastiCache Parameter Groups using the `name`. For example:
+
+```console
+% terraform import aws_elasticache_parameter_group.default redis-params
 ```
diff --git a/website/docs/r/elasticache_replication_group.html.markdown b/website/docs/r/elasticache_replication_group.html.markdown
index 9f740118fd1..5a17794a4ab 100644
--- a/website/docs/r/elasticache_replication_group.html.markdown
+++ b/website/docs/r/elasticache_replication_group.html.markdown
@@ -185,13 +185,15 @@ The following arguments are optional:
   If the version is 6, the major and minor version can be set, e.g., `6.2`,
   or the minor version can be unspecified which will use the latest version at creation time, e.g., `6.x`.
   Otherwise, specify the full version desired, e.g., `5.0.6`.
-  The actual engine version used is returned in the attribute `engine_version_actual`, see [Attributes Reference](#attributes-reference) below.
+  The actual engine version used is returned in the attribute `engine_version_actual`, see [Attribute Reference](#attribute-reference) below.
 * `final_snapshot_identifier` - (Optional) The name of your final node group (shard) snapshot. ElastiCache creates the snapshot from the primary node in the cluster. If omitted, no final snapshot will be made.
 * `global_replication_group_id` - (Optional) The ID of the global replication group to which this replication group should belong. If this parameter is specified, the replication group is added to the specified global replication group as a secondary replication group; otherwise, the replication group is not part of any global replication group. If `global_replication_group_id` is set, the `num_node_groups` parameter cannot be set.
+* `ip_discovery` - (Optional) The IP version to advertise in the discovery protocol. Valid values are `ipv4` or `ipv6`.
 * `kms_key_id` - (Optional) The ARN of the key that you wish to use if encrypting at rest. If not supplied, uses service managed encryption. Can be specified only if `at_rest_encryption_enabled = true`.
 * `log_delivery_configuration` - (Optional, Redis only) Specifies the destination and format of Redis [SLOWLOG](https://redis.io/commands/slowlog) or Redis [Engine Log](https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/Log_Delivery.html#Log_contents-engine-log). See the documentation on [Amazon ElastiCache](https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/Log_Delivery.html#Log_contents-engine-log). See [Log Delivery Configuration](#log-delivery-configuration) below for more details.
 * `maintenance_window` – (Optional) Specifies the weekly time range for when maintenance on the cache cluster is performed. The format is `ddd:hh24:mi-ddd:hh24:mi` (24H Clock UTC). The minimum maintenance window is a 60 minute period. Example: `sun:05:00-sun:09:00`
 * `multi_az_enabled` - (Optional) Specifies whether to enable Multi-AZ Support for the replication group. If `true`, `automatic_failover_enabled` must also be enabled. Defaults to `false`.
+* `network_type` - (Optional) The IP versions for cache cluster connections. Valid values are `ipv4`, `ipv6` or `dual_stack`.
 * `node_type` - (Optional) Instance class to be used. See AWS documentation for information on [supported node types](https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/CacheNodes.SupportedTypes.html) and [guidance on selecting node types](https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/nodes-select-size.html). Required unless `global_replication_group_id` is set. Cannot be set if `global_replication_group_id` is set.
 * `notification_topic_arn` – (Optional) ARN of an SNS topic to send ElastiCache notifications to. Example: `arn:aws:sns:us-east-1:012345678999:my_sns_topic`
 * `num_cache_clusters` - (Optional) Number of cache clusters (primary and replicas) this replication group will have. If Multi-AZ is enabled, the value of this parameter must be at least 2. Updates will occur before other modifications. Conflicts with `num_node_groups`. Defaults to `1`.
@@ -203,8 +205,8 @@ The following arguments are optional:
 * `replicas_per_node_group` - (Optional) Number of replica nodes in each node group.
   Changing this number will trigger a resizing operation before other settings modifications.
   Valid values are 0 to 5.
-* `security_group_ids` - (Optional) One or more Amazon VPC security groups associated with this replication group. Use this parameter only when you are creating a replication group in an Amazon Virtual Private Cloud
-* `security_group_names` - (Optional) List of cache security group names to associate with this replication group.
+* `security_group_ids` - (Optional) IDs of one or more Amazon VPC security groups associated with this replication group. Use this parameter only when you are creating a replication group in an Amazon Virtual Private Cloud.
+* `security_group_names` - (Optional) Names of one or more Amazon VPC security groups associated with this replication group. Use this parameter only when you are creating a replication group in an Amazon Virtual Private Cloud.
 * `snapshot_arns` – (Optional) List of ARNs that identify Redis RDB snapshot files stored in Amazon S3. The names object names cannot contain any commas.
 * `snapshot_name` - (Optional) Name of a snapshot from which to restore data into the new node group. Changing the `snapshot_name` forces a new resource.
 * `snapshot_retention_limit` - (Optional, Redis only) Number of days for which ElastiCache will retain automatic cache cluster snapshots before deleting them. For example, if you set SnapshotRetentionLimit to 5, then a snapshot that was taken today will be retained for 5 days before being deleted. If the value of `snapshot_retention_limit` is set to zero (0), backups are turned off. Please note that setting a `snapshot_retention_limit` is not supported on cache.t1.micro cache nodes
@@ -223,9 +225,9 @@ The `log_delivery_configuration` block allows the streaming of Redis [SLOWLOG](h
 * `log_format` - Valid values are `json` or `text`
 * `log_type` - Valid values are  `slow-log` or `engine-log`. Max 1 of each.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the created ElastiCache Replication Group.
 * `engine_version_actual` - Because ElastiCache pulls the latest minor or patch for a version, this attribute returns the running version of the cache engine.
@@ -247,8 +249,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-ElastiCache Replication Groups can be imported using the `replication_group_id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import ElastiCache Replication Groups using the `replication_group_id`. For example:
 
+```terraform
+import {
+  to = aws_elasticache_replication_group.my_replication_group
+  id = "replication-group-1"
+}
 ```
-$ terraform import aws_elasticache_replication_group.my_replication_group replication-group-1
+
+Using `terraform import`, import ElastiCache Replication Groups using the `replication_group_id`. For example:
+
+```console
+% terraform import aws_elasticache_replication_group.my_replication_group replication-group-1
 ```
diff --git a/website/docs/r/elasticache_subnet_group.html.markdown b/website/docs/r/elasticache_subnet_group.html.markdown
index a9ff48588ed..4a299c1b896 100644
--- a/website/docs/r/elasticache_subnet_group.html.markdown
+++ b/website/docs/r/elasticache_subnet_group.html.markdown
@@ -39,16 +39,16 @@ resource "aws_elasticache_subnet_group" "bar" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` – (Required) Name for the cache subnet group. ElastiCache converts this name to lowercase.
 * `description` – (Optional) Description for the cache subnet group. Defaults to "Managed by Terraform".
 * `subnet_ids` – (Required) List of VPC Subnet IDs for the cache subnet group
 * `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `description` - The Description of the ElastiCache Subnet Group.
 * `name` - The Name of the ElastiCache Subnet Group.
@@ -57,8 +57,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-ElastiCache Subnet Groups can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import ElastiCache Subnet Groups using the `name`. For example:
 
+```terraform
+import {
+  to = aws_elasticache_subnet_group.bar
+  id = "tf-test-cache-subnet"
+}
 ```
-$ terraform import aws_elasticache_subnet_group.bar tf-test-cache-subnet
+
+Using `terraform import`, import ElastiCache Subnet Groups using the `name`. For example:
+
+```console
+% terraform import aws_elasticache_subnet_group.bar tf-test-cache-subnet
 ```
diff --git a/website/docs/r/elasticache_user.html.markdown b/website/docs/r/elasticache_user.html.markdown
index 454e8b390ba..d1a0a818174 100644
--- a/website/docs/r/elasticache_user.html.markdown
+++ b/website/docs/r/elasticache_user.html.markdown
@@ -73,9 +73,9 @@ The following arguments are optional:
 * `passwords` - (Optional) Specifies the passwords to use for authentication if `type` is set to `password`.
 * `type` - (Required) Specifies the authentication type. Possible options are: `password`, `no-password-required` or `iam`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The ARN of the created ElastiCache User.
 
@@ -89,8 +89,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-ElastiCache users can be imported using the `user_id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import ElastiCache users using the `user_id`. For example:
 
+```terraform
+import {
+  to = aws_elasticache_user.my_user
+  id = "userId1"
+}
 ```
-$ terraform import aws_elasticache_user.my_user userId1
+
+Using `terraform import`, import ElastiCache users using the `user_id`. For example:
+
+```console
+% terraform import aws_elasticache_user.my_user userId1
 ```
diff --git a/website/docs/r/elasticache_user_group.html.markdown b/website/docs/r/elasticache_user_group.html.markdown
index ad6640cb6b9..3a94928644a 100644
--- a/website/docs/r/elasticache_user_group.html.markdown
+++ b/website/docs/r/elasticache_user_group.html.markdown
@@ -40,9 +40,9 @@ The following arguments are optional:
 * `user_ids` - (Optional) The list of user IDs that belong to the user group.
 * `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The user group identifier.
 * `arn` - The ARN that identifies the user group.
@@ -50,8 +50,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-ElastiCache user groups can be imported using the `user_group_id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import ElastiCache user groups using the `user_group_id`. For example:
 
+```terraform
+import {
+  to = aws_elasticache_user_group.my_user_group
+  id = "userGoupId1"
+}
 ```
-$ terraform import aws_elasticache_user_group.my_user_group userGoupId1
+
+Using `terraform import`, import ElastiCache user groups using the `user_group_id`. For example:
+
+```console
+% terraform import aws_elasticache_user_group.my_user_group userGoupId1
 ```
diff --git a/website/docs/r/elasticache_user_group_association.html.markdown b/website/docs/r/elasticache_user_group_association.html.markdown
index f2a1a145466..d30ac6f452d 100644
--- a/website/docs/r/elasticache_user_group_association.html.markdown
+++ b/website/docs/r/elasticache_user_group_association.html.markdown
@@ -54,14 +54,23 @@ The following arguments are required:
 * `user_group_id` - (Required) ID of the user group.
 * `user_id` - (Required) ID of the user to associated with the user group.
 
-## Attributes Reference
+## Attribute Reference
 
-No additional attributes are exported.
+This resource exports no additional attributes.
 
 ## Import
 
-ElastiCache user group associations can be imported using the `user_group_id` and `user_id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import ElastiCache user group associations using the `user_group_id` and `user_id`. For example:
 
+```terraform
+import {
+  to = aws_elasticache_user_group_association.example
+  id = "userGoupId1,userId"
+}
 ```
-$ terraform import aws_elasticache_user_group_association.example userGoupId1,userId
+
+Using `terraform import`, import ElastiCache user group associations using the `user_group_id` and `user_id`. For example:
+
+```console
+% terraform import aws_elasticache_user_group_association.example userGoupId1,userId
 ```
diff --git a/website/docs/r/elasticsearch_domain.html.markdown b/website/docs/r/elasticsearch_domain.html.markdown
index c4e81949db4..8861c2e5cae 100644
--- a/website/docs/r/elasticsearch_domain.html.markdown
+++ b/website/docs/r/elasticsearch_domain.html.markdown
@@ -335,9 +335,9 @@ AWS documentation: [VPC Support for Amazon Elasticsearch Service Domains](https:
 * `security_group_ids` - (Optional) List of VPC Security Group IDs to be applied to the Elasticsearch domain endpoints. If omitted, the default Security Group for the VPC will be used.
 * `subnet_ids` - (Required) List of VPC Subnet IDs for the Elasticsearch domain endpoints to be created in.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the domain.
 * `domain_id` - Unique identifier for the domain.
@@ -358,8 +358,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Elasticsearch domains can be imported using the `domain_name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Elasticsearch domains using the `domain_name`. For example:
 
+```terraform
+import {
+  to = aws_elasticsearch_domain.example
+  id = "domain_name"
+}
 ```
-$ terraform import aws_elasticsearch_domain.example domain_name
+
+Using `terraform import`, import Elasticsearch domains using the `domain_name`. For example:
+
+```console
+% terraform import aws_elasticsearch_domain.example domain_name
 ```
diff --git a/website/docs/r/elasticsearch_domain_policy.html.markdown b/website/docs/r/elasticsearch_domain_policy.html.markdown
index 04e0884c1ae..6251fe174d2 100644
--- a/website/docs/r/elasticsearch_domain_policy.html.markdown
+++ b/website/docs/r/elasticsearch_domain_policy.html.markdown
@@ -42,11 +42,11 @@ POLICIES
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `domain_name` - (Required) Name of the domain.
 * `access_policies` - (Optional) IAM policy document specifying the access policies for the domain
 
-## Attributes Reference
+## Attribute Reference
 
-No additional attributes are exported.
+This resource exports no additional attributes.
diff --git a/website/docs/r/elasticsearch_domain_saml_options.html.markdown b/website/docs/r/elasticsearch_domain_saml_options.html.markdown
index 8605c5bdeff..f1e1d167c66 100644
--- a/website/docs/r/elasticsearch_domain_saml_options.html.markdown
+++ b/website/docs/r/elasticsearch_domain_saml_options.html.markdown
@@ -69,16 +69,25 @@ The following arguments are optional:
 * `entity_id` - (Required) The unique Entity ID of the application in SAML Identity Provider.
 * `metadata_content` - (Required) The Metadata of the SAML application in xml format.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The name of the domain the SAML options are associated with.
 
 ## Import
 
-Elasticsearch domains can be imported using the `domain_name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Elasticsearch domains using the `domain_name`. For example:
 
+```terraform
+import {
+  to = aws_elasticsearch_domain_saml_options.example
+  id = "domain_name"
+}
 ```
-$ terraform import aws_elasticsearch_domain_saml_options.example domain_name
+
+Using `terraform import`, import Elasticsearch domains using the `domain_name`. For example:
+
+```console
+% terraform import aws_elasticsearch_domain_saml_options.example domain_name
 ```
diff --git a/website/docs/r/elasticsearch_vpc_endpoint.html.markdown b/website/docs/r/elasticsearch_vpc_endpoint.html.markdown
new file mode 100644
index 00000000000..c7e4ec759b9
--- /dev/null
+++ b/website/docs/r/elasticsearch_vpc_endpoint.html.markdown
@@ -0,0 +1,71 @@
+---
+subcategory: "Elasticsearch"
+layout: "aws"
+page_title: "AWS: aws_elasticsearch_vpc_endpoint"
+description: |-
+  Terraform resource for managing an AWS elasticsearch VPC Endpoint.
+---
+
+# Resource: aws_elasticsearch_vpc_endpoint
+
+Manages an [AWS Elasticsearch VPC Endpoint](https://docs.aws.amazon.com/elasticsearch-service/latest/APIReference/API_CreateVpcEndpoint.html). Creates an Amazon elasticsearch Service-managed VPC endpoint.
+
+## Example Usage
+
+### Basic Usage
+
+```terraform
+
+resource "aws_elasticsearch_vpc_endpoint" "foo" {
+  domain_arn = aws_elasticsearch_domain.domain_1.arn
+  vpc_options {
+    security_group_ids = [aws_security_group.test.id, aws_security_group.test2.id]
+    subnet_ids         = [aws_subnet.test.id, aws_subnet.test2.id]
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `domain_arn` - (Required, Forces new resource) Specifies the Amazon Resource Name (ARN) of the domain to create the endpoint for
+* `vpc_options` - (Required) Options to specify the subnets and security groups for the endpoint.
+
+### vpc_options
+
+* `security_group_ids` - (Optional) The list of security group IDs associated with the VPC endpoints for the domain. If you do not provide a security group ID, elasticsearch Service uses the default security group for the VPC.
+* `subnet_ids` - (Required) A list of subnet IDs associated with the VPC endpoints for the domain. If your domain uses multiple Availability Zones, you need to provide two subnet IDs, one per zone. Otherwise, provide only one.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The unique identifier of the endpoint.
+* `endpoint` - The connection endpoint ID for connecting to the domain.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `60m`)
+* `update` - (Default `60m`)
+* `delete` - (Default `90m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import elasticsearch VPC endpoint connections using the `id`. For example:
+
+```terraform
+import {
+  to = aws_elasticsearch_vpc_endpoint_connection.example
+  id = "endpoint-id"
+}
+```
+
+Using `terraform import`, import elasticsearch VPC endpoint connections using the `id`. For example:
+
+```console
+% terraform import aws_elasticsearch_vpc_endpoint_connection.example endpoint-id
+```
diff --git a/website/docs/r/elastictranscoder_pipeline.html.markdown b/website/docs/r/elastictranscoder_pipeline.html.markdown
index 8f20144fce8..d0248a13508 100644
--- a/website/docs/r/elastictranscoder_pipeline.html.markdown
+++ b/website/docs/r/elastictranscoder_pipeline.html.markdown
@@ -34,7 +34,7 @@ resource "aws_elastictranscoder_pipeline" "bar" {
 
 See ["Create Pipeline"](http://docs.aws.amazon.com/elastictranscoder/latest/developerguide/create-pipeline.html) in the AWS docs for reference.
 
-The following arguments are supported:
+This argument supports the following arguments:
 
 * `aws_kms_key_arn` - (Optional) The AWS Key Management Service (AWS KMS) key that you want to use with this pipeline.
 * `content_config` - (Optional) The ContentConfig object specifies information about the Amazon S3 bucket in which you want Elastic Transcoder to save transcoded files and playlists. (documented below)
@@ -93,17 +93,26 @@ The `thumbnail_config_permissions` object supports the following:
 * `grantee` - The AWS user or group that you want to have access to thumbnail files.
 * `grantee_type` - Specify the type of value that appears in the `thumbnail_config_permissions.grantee` object. Valid values are `Canonical`, `Email` or `Group`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the Elastictranscoder pipeline.
 * `arn` - The ARN of the Elastictranscoder pipeline.
 
 ## Import
 
-Elastic Transcoder pipelines can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Elastic Transcoder pipelines using the `id`. For example:
 
+```terraform
+import {
+  to = aws_elastictranscoder_pipeline.basic_pipeline
+  id = "1407981661351-cttk8b"
+}
 ```
-$ terraform import aws_elastictranscoder_pipeline.basic_pipeline 1407981661351-cttk8b
+
+Using `terraform import`, import Elastic Transcoder pipelines using the `id`. For example:
+
+```console
+% terraform import aws_elastictranscoder_pipeline.basic_pipeline 1407981661351-cttk8b
 ```
diff --git a/website/docs/r/elastictranscoder_preset.html.markdown b/website/docs/r/elastictranscoder_preset.html.markdown
index 3f2052700b1..018470cb85c 100644
--- a/website/docs/r/elastictranscoder_preset.html.markdown
+++ b/website/docs/r/elastictranscoder_preset.html.markdown
@@ -80,7 +80,7 @@ resource "aws_elastictranscoder_preset" "bar" {
 
 See ["Create Preset"](http://docs.aws.amazon.com/elastictranscoder/latest/developerguide/create-preset.html) in the AWS docs for reference.
 
-The following arguments are supported:
+This argument supports the following arguments:
 
 * `audio` - (Optional, Forces new resource) Audio parameters object (documented below).
 * `audio_codec_options` - (Optional, Forces new resource) Codec options for the audio parameters (documented below)
@@ -159,16 +159,25 @@ The `video_codec_options` map supports the following:
 * `ChromaSubsampling` - The sampling pattern for the chroma (color) channels of the output video. Valid values are `yuv420p` and `yuv422p`.
 * `LoopCount` - The number of times you want the output gif to loop (Gif only)
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name (ARN) of the Elastic Transcoder Preset.
 
 ## Import
 
-Elastic Transcoder presets can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Elastic Transcoder presets using the `id`. For example:
 
+```terraform
+import {
+  to = aws_elastictranscoder_preset.basic_preset
+  id = "1407981661351-cttk8b"
+}
 ```
-$ terraform import aws_elastictranscoder_preset.basic_preset 1407981661351-cttk8b
+
+Using `terraform import`, import Elastic Transcoder presets using the `id`. For example:
+
+```console
+% terraform import aws_elastictranscoder_preset.basic_preset 1407981661351-cttk8b
 ```
diff --git a/website/docs/r/elb.html.markdown b/website/docs/r/elb.html.markdown
index 09bac26ece4..883426c50a3 100644
--- a/website/docs/r/elb.html.markdown
+++ b/website/docs/r/elb.html.markdown
@@ -70,7 +70,7 @@ resource "aws_elb" "bar" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Optional) The name of the ELB. By default generated by Terraform.
 * `name_prefix` - (Optional, Forces new resource) Creates a unique name beginning with the specified
@@ -131,9 +131,9 @@ P256 and P384 curves.  Using a certificate signed by a key using a different
 curve could produce the error `ERR_SSL_VERSION_OR_CIPHER_MISMATCH` in your
 browser.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The name of the ELB
 * `arn` - The ARN of the ELB
@@ -151,8 +151,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-ELBs can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import ELBs using the `name`. For example:
 
+```terraform
+import {
+  to = aws_elb.bar
+  id = "elb-production-12345"
+}
 ```
-$ terraform import aws_elb.bar elb-production-12345
+
+Using `terraform import`, import ELBs using the `name`. For example:
+
+```console
+% terraform import aws_elb.bar elb-production-12345
 ```
diff --git a/website/docs/r/elb_attachment.html.markdown b/website/docs/r/elb_attachment.html.markdown
index b71930de115..20fdff02500 100644
--- a/website/docs/r/elb_attachment.html.markdown
+++ b/website/docs/r/elb_attachment.html.markdown
@@ -29,11 +29,11 @@ resource "aws_elb_attachment" "baz" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `elb` - (Required) The name of the ELB.
 * `instance` - (Required) Instance ID to place in the ELB pool.
 
-## Attributes Reference
+## Attribute Reference
 
-No additional attributes are exported.
+This resource exports no additional attributes.
diff --git a/website/docs/r/emr_block_public_access_configuration.html.markdown b/website/docs/r/emr_block_public_access_configuration.html.markdown
index 5702341b2b5..f146f78f921 100644
--- a/website/docs/r/emr_block_public_access_configuration.html.markdown
+++ b/website/docs/r/emr_block_public_access_configuration.html.markdown
@@ -84,14 +84,23 @@ This block is used to define a range of TCP ports that should form exceptions to
 * `min_range` - (Required) The first port in the range of TCP ports.
 * `max_range` - (Required) The final port in the range of TCP ports.
 
-## Attributes Reference
+## Attribute Reference
 
-No additional attributes are exported.
+This resource exports no additional attributes.
 
 ## Import
 
-The current EMR Block Public Access Configuration can be imported, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import the current EMR Block Public Access Configuration. For example:
 
+```terraform
+import {
+  to = aws_emr_block_public_access_configuration.example
+  id = "current"
+}
 ```
-$ terraform import aws_emr_block_public_access_configuration.example current
+
+Using `terraform import`, import the current EMR Block Public Access Configuration. For example:
+
+```console
+% terraform import aws_emr_block_public_access_configuration.example current
 ```
diff --git a/website/docs/r/emr_cluster.html.markdown b/website/docs/r/emr_cluster.html.markdown
index 7b7f258ad4b..f1fc2024cda 100644
--- a/website/docs/r/emr_cluster.html.markdown
+++ b/website/docs/r/emr_cluster.html.markdown
@@ -813,9 +813,9 @@ This argument is processed in [attribute-as-blocks mode](https://www.terraform.i
 * `instance_role` - (Required) Role of the instance in the cluster. Valid Values: `MASTER`, `CORE`, `TASK`.
 * `placement_strategy` - (Optional) EC2 Placement Group strategy associated with instance role. Valid Values: `SPREAD`, `PARTITION`, `CLUSTER`, `NONE`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `applications` - Applications installed on this cluster.
 * `arn`- ARN of the cluster.
@@ -835,13 +835,22 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-EMR clusters can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EMR clusters using the `id`. For example:
 
+```terraform
+import {
+  to = aws_emr_cluster.cluster
+  id = "j-123456ABCDEF"
+}
 ```
-$ terraform import aws_emr_cluster.cluster j-123456ABCDEF
+
+Using `terraform import`, import EMR clusters using the `id`. For example:
+
+```console
+% terraform import aws_emr_cluster.cluster j-123456ABCDEF
 ```
 
-Since the API does not return the actual values for Kerberos configurations, environments with those Terraform configurations will need to use the [`lifecycle` configuration block `ignore_changes` argument](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html#ignore_changes) available to all Terraform resources to prevent perpetual differences, e.g.,
+Since the API does not return the actual values for Kerberos configurations, environments with those Terraform configurations will need to use the [`lifecycle` configuration block `ignore_changes` argument](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html#ignore_changes) available to all Terraform resources to prevent perpetual differences. For example:
 
 ```terraform
 resource "aws_emr_cluster" "example" {
diff --git a/website/docs/r/emr_instance_fleet.html.markdown b/website/docs/r/emr_instance_fleet.html.markdown
index f6ed17d2d20..df2af3c4a6d 100644
--- a/website/docs/r/emr_instance_fleet.html.markdown
+++ b/website/docs/r/emr_instance_fleet.html.markdown
@@ -56,7 +56,7 @@ resource "aws_emr_instance_fleet" "task" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `cluster_id` - (Required) ID of the EMR Cluster to attach to. Changing this forces a new resource to be created.
 * `instance_type_configs` - (Optional) Configuration block for instance fleet
@@ -111,9 +111,9 @@ The launch specification for Spot instances in the fleet, which determines the d
 * `timeout_action` - (Required) The action to take when TargetSpotCapacity has not been fulfilled when the TimeoutDurationMinutes has expired; that is, when all Spot instances could not be provisioned within the Spot provisioning timeout. Valid values are `TERMINATE_CLUSTER` and `SWITCH_TO_ON_DEMAND`. SWITCH_TO_ON_DEMAND specifies that if no Spot instances are available, On-Demand Instances should be provisioned to fulfill any remaining Spot capacity.
 * `timeout_duration_minutes` - (Required) The spot provisioning timeout period in minutes. If Spot instances are not provisioned within this time period, the TimeOutAction is taken. Minimum value is 5 and maximum value is 1440. The timeout applies only during initial provisioning, when the cluster is first created.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The unique identifier of the instance fleet.
 
@@ -127,8 +127,17 @@ to fulfill TargetSpotCapacity. This provisioned capacity might be less than or g
 
 ## Import
 
-EMR Instance Fleet can be imported with the EMR Cluster identifier and Instance Fleet identifier separated by a forward slash (`/`), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EMR Instance Fleet using the EMR Cluster identifier and Instance Fleet identifier separated by a forward slash (`/`). For example:
+
+```terraform
+import {
+  to = aws_emr_instance_fleet.example
+  id = "j-123456ABCDEF/if-15EK4O09RZLNR"
+}
+```
+
+Using `terraform import`, import EMR Instance Fleet using the EMR Cluster identifier and Instance Fleet identifier separated by a forward slash (`/`). For example:
 
 ```console
-$ terraform import aws_emr_instance_fleet.example j-123456ABCDEF/if-15EK4O09RZLNR
+% terraform import aws_emr_instance_fleet.example j-123456ABCDEF/if-15EK4O09RZLNR
 ```
diff --git a/website/docs/r/emr_instance_group.html.markdown b/website/docs/r/emr_instance_group.html.markdown
index ee73556d97d..328055be4c0 100644
--- a/website/docs/r/emr_instance_group.html.markdown
+++ b/website/docs/r/emr_instance_group.html.markdown
@@ -28,7 +28,7 @@ resource "aws_emr_instance_group" "task" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` (Required) Human friendly name given to the instance group. Changing this forces a new resource to be created.
 * `cluster_id` (Required) ID of the EMR Cluster to attach to. Changing this forces a new resource to be created.
@@ -70,9 +70,9 @@ EOF
 * `type` - (Optional) The volume type. Valid options are 'gp2', 'io1' and 'standard'.
 * `volumes_per_instance` - (Optional) The number of EBS Volumes to attach per instance.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The EMR Instance ID
 * `running_instance_count` The number of instances currently running in this instance group.
@@ -80,8 +80,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-EMR task instance group can be imported using their EMR Cluster id and Instance Group id separated by a forward-slash `/`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EMR task instance group using their EMR Cluster id and Instance Group id separated by a forward-slash `/`. For example:
 
+```terraform
+import {
+  to = aws_emr_instance_group.task_group
+  id = "j-123456ABCDEF/ig-15EK4O09RZLNR"
+}
 ```
-$ terraform import aws_emr_instance_group.task_group j-123456ABCDEF/ig-15EK4O09RZLNR
+
+Using `terraform import`, import EMR task instance group using their EMR Cluster id and Instance Group id separated by a forward-slash `/`. For example:
+
+```console
+% terraform import aws_emr_instance_group.task_group j-123456ABCDEF/ig-15EK4O09RZLNR
 ```
diff --git a/website/docs/r/emr_managed_scaling_policy.html.markdown b/website/docs/r/emr_managed_scaling_policy.html.markdown
index eb582f84494..b0abb62cc27 100644
--- a/website/docs/r/emr_managed_scaling_policy.html.markdown
+++ b/website/docs/r/emr_managed_scaling_policy.html.markdown
@@ -41,7 +41,7 @@ resource "aws_emr_managed_scaling_policy" "samplepolicy" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `cluster_id` - (Required) ID of the EMR cluster
 * `compute_limits` - (Required) Configuration block with compute limit settings. Described below.
@@ -54,14 +54,23 @@ The following arguments are supported:
 * `maximum_ondemand_capacity_units` - (Optional) The upper boundary of On-Demand EC2 units. It is measured through VCPU cores or instances for instance groups and measured through units for instance fleets. The On-Demand units are not allowed to scale beyond this boundary. The parameter is used to split capacity allocation between On-Demand and Spot instances.
 * `maximum_core_capacity_units` - (Optional) The upper boundary of EC2 units for core node type in a cluster. It is measured through VCPU cores or instances for instance groups and measured through units for instance fleets. The core units are not allowed to scale beyond this boundary. The parameter is used to split capacity allocation between core and task nodes.
 
-## Attributes Reference
+## Attribute Reference
 
-No additional attributes are exported.
+This resource exports no additional attributes.
 
 ## Import
 
-EMR Managed Scaling Policies can be imported via the EMR Cluster identifier, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EMR Managed Scaling Policies using the EMR Cluster identifier. For example:
+
+```terraform
+import {
+  to = aws_emr_managed_scaling_policy.example
+  id = "j-123456ABCDEF"
+}
+```
+
+Using `terraform import`, import EMR Managed Scaling Policies using the EMR Cluster identifier. For example:
 
 ```console
-$ terraform import aws_emr_managed_scaling_policy.example j-123456ABCDEF
+% terraform import aws_emr_managed_scaling_policy.example j-123456ABCDEF
 ```
diff --git a/website/docs/r/emr_security_configuration.html.markdown b/website/docs/r/emr_security_configuration.html.markdown
index 3b29e985d71..98a0791c671 100644
--- a/website/docs/r/emr_security_configuration.html.markdown
+++ b/website/docs/r/emr_security_configuration.html.markdown
@@ -38,16 +38,16 @@ EOF
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Optional) The name of the EMR Security Configuration. By default generated by Terraform.
 * `name_prefix` - (Optional) Creates a unique name beginning with the specified
   prefix. Conflicts with `name`.
 * `configuration` - (Required) A JSON formatted Security Configuration
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the EMR Security Configuration (Same as the `name`)
 * `name` - The Name of the EMR Security Configuration
@@ -56,8 +56,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-EMR Security Configurations can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EMR Security Configurations using the `name`. For example:
 
+```terraform
+import {
+  to = aws_emr_security_configuration.sc
+  id = "example-sc-name"
+}
 ```
-$ terraform import aws_emr_security_configuration.sc example-sc-name
+
+Using `terraform import`, import EMR Security Configurations using the `name`. For example:
+
+```console
+% terraform import aws_emr_security_configuration.sc example-sc-name
 ```
diff --git a/website/docs/r/emr_studio.html.markdown b/website/docs/r/emr_studio.html.markdown
index 28429094b7a..653f9a39e34 100644
--- a/website/docs/r/emr_studio.html.markdown
+++ b/website/docs/r/emr_studio.html.markdown
@@ -47,17 +47,26 @@ The following arguments are optional:
 * `tags` - (Optional) list of tags to apply to the EMR Cluster. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 * `user_role` - (Optional) - The IAM user role that users and groups assume when logged in to an Amazon EMR Studio. Only specify a User Role when you use Amazon Web Services SSO authentication. The permissions attached to the User Role can be scoped down for each user or group using session policies.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn`- ARN of the studio.
 * `url` - The unique access URL of the Amazon EMR Studio.
 
 ## Import
 
-EMR studios can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EMR studios using the `id`. For example:
 
+```terraform
+import {
+  to = aws_emr_studio.studio
+  id = "es-123456ABCDEF"
+}
 ```
-$ terraform import aws_emr_studio.studio es-123456ABCDEF
+
+Using `terraform import`, import EMR studios using the `id`. For example:
+
+```console
+% terraform import aws_emr_studio.studio es-123456ABCDEF
 ```
diff --git a/website/docs/r/emr_studio_session_mapping.html.markdown b/website/docs/r/emr_studio_session_mapping.html.markdown
index 61a2c7149ea..6bf98e3af08 100644
--- a/website/docs/r/emr_studio_session_mapping.html.markdown
+++ b/website/docs/r/emr_studio_session_mapping.html.markdown
@@ -31,16 +31,25 @@ The following arguments are required:
 * `session_policy_arn` - (Required) The Amazon Resource Name (ARN) for the session policy that will be applied to the user or group. You should specify the ARN for the session policy that you want to apply, not the ARN of your user role.
 * `studio_id` - (Required) The ID of the Amazon EMR Studio to which the user or group will be mapped.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id`- The id of the Elastic MapReduce Studio Session Mapping.
 
 ## Import
 
-EMR studio session mappings can be imported using the `id`, e.g., `studio-id:identity-type:identity-id`
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EMR studio session mappings using `studio-id:identity-type:identity-id`. For example:
 
+```terraform
+import {
+  to = aws_emr_studio_session_mapping.example
+  id = "es-xxxxx:USER:xxxxx-xxx-xxx"
+}
 ```
-$ terraform import aws_emr_studio_session_mapping.example es-xxxxx:USER:xxxxx-xxx-xxx
+
+Using `terraform import`, import EMR studio session mappings using `studio-id:identity-type:identity-id`. For example:
+
+```console
+% terraform import aws_emr_studio_session_mapping.example es-xxxxx:USER:xxxxx-xxx-xxx
 ```
diff --git a/website/docs/r/emrcontainers_job_template.html.markdown b/website/docs/r/emrcontainers_job_template.html.markdown
new file mode 100644
index 00000000000..07e81450556
--- /dev/null
+++ b/website/docs/r/emrcontainers_job_template.html.markdown
@@ -0,0 +1,116 @@
+---
+subcategory: "EMR Containers"
+layout: "aws"
+page_title: "AWS: aws_emrcontainers_job_template"
+description: |-
+  Manages an EMR Containers (EMR on EKS) Job Template
+---
+
+# Resource: aws_emrcontainers_job_template
+
+Manages an EMR Containers (EMR on EKS) Job Template.
+
+## Example Usage
+
+### Basic Usage
+
+```terraform
+resource "aws_emrcontainers_job_template" "example" {
+  job_template_data {
+    execution_role_arn = aws_iam_role.example.arn
+    release_label      = "emr-6.10.0-latest"
+
+    job_driver {
+      spark_sql_job_driver {
+        entry_point = "default"
+      }
+    }
+  }
+
+  name = "example"
+}
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `job_template_data` - (Required) The job template data which holds values of StartJobRun API request.
+* `kms_key_arn` - (Optional) The KMS key ARN used to encrypt the job template.
+* `name` – (Required) The specified name of the job template.
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### job_template_data Arguments
+
+* `configuration_overrides` - (Optional) The configuration settings that are used to override defaults configuration.
+* `execution_role_arn` - (Required) The execution role ARN of the job run.
+* `job_driver` - (Required) Specify the driver that the job runs on. Exactly one of the two available job drivers is required, either sparkSqlJobDriver or sparkSubmitJobDriver.
+* `job_tags` - (Optional) The tags assigned to jobs started using the job template.
+* `release_label` - (Required) The release version of Amazon EMR.
+
+#### configuration_overrides Arguments
+
+* `application_configuration` - (Optional) The configurations for the application running by the job run.
+* `monitoring_configuration` - (Optional) The configurations for monitoring.
+
+##### application_configuration Arguments
+
+* `classification` - (Required) The classification within a configuration.
+* `configurations` - (Optional) A list of additional configurations to apply within a configuration object.
+* `properties` - (Optional) A set of properties specified within a configuration classification.
+
+##### monitoring_configuration Arguments
+
+* `cloud_watch_monitoring_configuration` - (Optional) Monitoring configurations for CloudWatch.
+* `persistent_app_ui` - (Optional)  Monitoring configurations for the persistent application UI.
+* `s3_monitoring_configuration` - (Optional) Amazon S3 configuration for monitoring log publishing.
+
+###### cloud_watch_monitoring_configuration Arguments
+
+* `log_group_name` - (Required) The name of the log group for log publishing.
+* `log_stream_name_prefix` - (Optional) The specified name prefix for log streams.
+
+###### s3_monitoring_configuration Arguments
+
+* `log_uri` - (Optional) Amazon S3 destination URI for log publishing.
+
+#### job_driver Arguments
+
+* `spark_sql_job_driver` - (Optional) The job driver for job type.
+* `spark_submit_job_driver` - (Optional) The job driver parameters specified for spark submit.
+
+##### spark_sql_job_driver Arguments
+
+* `entry_point` - (Optional) The SQL file to be executed.
+* `spark_sql_parameters` - (Optional) The Spark parameters to be included in the Spark SQL command.
+
+##### spark_submit_job_driver Arguments
+
+* `entry_point` - (Required) The entry point of job application.
+* `entry_point_arguments` - (Optional) The arguments for job application.
+* `spark_submit_parameters` - (Optional) The Spark submit parameters that are used for job runs.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the job template.
+* `id` - The ID of the job template.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EKS job templates using the `id`. For example:
+
+```terraform
+import {
+  to = aws_emrcontainers_job_template.example
+  id = "a1b2c3d4e5f6g7h8i9j10k11l"
+}
+```
+
+Using `terraform import`, import EKS job templates using the `id`. For example:
+
+```console
+% terraform import aws_emrcontainers_job_template.example a1b2c3d4e5f6g7h8i9j10k11l
+```
diff --git a/website/docs/r/emrcontainers_job_template.markdown b/website/docs/r/emrcontainers_job_template.markdown
deleted file mode 100644
index 10f8df84ba4..00000000000
--- a/website/docs/r/emrcontainers_job_template.markdown
+++ /dev/null
@@ -1,107 +0,0 @@
----
-subcategory: "EMR Containers"
-layout: "aws"
-page_title: "AWS: aws_emrcontainers_job_template"
-description: |-
-  Manages an EMR Containers (EMR on EKS) Job Template
----
-
-# Resource: aws_emrcontainers_job_template
-
-Manages an EMR Containers (EMR on EKS) Job Template.
-
-## Example Usage
-
-### Basic Usage
-
-```terraform
-resource "aws_emrcontainers_job_template" "example" {
-  job_template_data {
-    execution_role_arn = aws_iam_role.example.arn
-    release_label      = "emr-6.10.0-latest"
-
-    job_driver {
-      spark_sql_job_driver {
-        entry_point = "default"
-      }
-    }
-  }
-
-  name = "example"
-}
-```
-
-## Argument Reference
-
-The following arguments are required:
-
-* `job_template_data` - (Required) The job template data which holds values of StartJobRun API request.
-* `kms_key_arn` - (Optional) The KMS key ARN used to encrypt the job template.
-* `name` – (Required) The specified name of the job template.
-* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
-
-### job_template_data Arguments
-
-* `configuration_overrides` - (Optional) The configuration settings that are used to override defaults configuration.
-* `execution_role_arn` - (Required) The execution role ARN of the job run.
-* `job_driver` - (Required) Specify the driver that the job runs on. Exactly one of the two available job drivers is required, either sparkSqlJobDriver or sparkSubmitJobDriver.
-* `job_tags` - (Optional) The tags assigned to jobs started using the job template.
-* `release_label` - (Required) The release version of Amazon EMR.
-
-#### configuration_overrides Arguments
-
-* `application_configuration` - (Optional) The configurations for the application running by the job run.
-* `monitoring_configuration` - (Optional) The configurations for monitoring.
-
-##### application_configuration Arguments
-
-* `classification` - (Required) The classification within a configuration.
-* `configurations` - (Optional) A list of additional configurations to apply within a configuration object.
-* `properties` - (Optional) A set of properties specified within a configuration classification.
-
-##### monitoring_configuration Arguments
-
-* `cloud_watch_monitoring_configuration` - (Optional) Monitoring configurations for CloudWatch.
-* `persistent_app_ui` - (Optional)  Monitoring configurations for the persistent application UI.
-* `s3_monitoring_configuration` - (Optional) Amazon S3 configuration for monitoring log publishing.
-
-###### cloud_watch_monitoring_configuration Arguments
-
-* `log_group_name` - (Required) The name of the log group for log publishing.
-* `log_stream_name_prefix` - (Optional) The specified name prefix for log streams.
-
-###### s3_monitoring_configuration Arguments
-
-* `log_uri` - (Optional) Amazon S3 destination URI for log publishing.
-
-#### job_driver Arguments
-
-* `spark_sql_job_driver` - (Optional) The job driver for job type.
-* `spark_submit_job_driver` - (Optional) The job driver parameters specified for spark submit.
-
-##### spark_sql_job_driver Arguments
-
-* `entry_point` - (Optional) The SQL file to be executed.
-* `spark_sql_parameters` - (Optional) The Spark parameters to be included in the Spark SQL command.
-
-##### spark_submit_job_driver Arguments
-
-* `entry_point` - (Required) The entry point of job application.
-* `entry_point_arguments` - (Optional) The arguments for job application.
-* `spark_submit_parameters` - (Optional) The Spark submit parameters that are used for job runs.
-
-## Attributes Reference
-
-In addition to all arguments above, the following attributes are exported:
-
-* `arn` - ARN of the job template.
-* `id` - The ID of the job template.
-* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
-
-## Import
-
-EKS job templates can be imported using the `id`, e.g.
-
-```
-$ terraform import aws_emrcontainers_job_template.example a1b2c3d4e5f6g7h8i9j10k11l
-```
diff --git a/website/docs/r/emrcontainers_virtual_cluster.html.markdown b/website/docs/r/emrcontainers_virtual_cluster.html.markdown
new file mode 100644
index 00000000000..ca5d685907c
--- /dev/null
+++ b/website/docs/r/emrcontainers_virtual_cluster.html.markdown
@@ -0,0 +1,73 @@
+---
+subcategory: "EMR Containers"
+layout: "aws"
+page_title: "AWS: aws_emrcontainers_virtual_cluster"
+description: |-
+  Manages an EMR Containers (EMR on EKS) Virtual Cluster
+---
+
+# Resource: aws_emrcontainers_virtual_cluster
+
+Manages an EMR Containers (EMR on EKS) Virtual Cluster.
+
+## Example Usage
+
+### Basic Usage
+
+```terraform
+resource "aws_emrcontainers_virtual_cluster" "example" {
+  container_provider {
+    id   = aws_eks_cluster.example.name
+    type = "EKS"
+
+    info {
+      eks_info {
+        namespace = "default"
+      }
+    }
+  }
+
+  name = "example"
+}
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `container_provider` - (Required) Configuration block for the container provider associated with your cluster.
+* `name` – (Required) Name of the virtual cluster.
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### container_provider Arguments
+
+* `id` - The name of the container provider that is running your EMR Containers cluster
+* `info` - Nested list containing information about the configuration of the container provider
+    * `eks_info` - Nested list containing EKS-specific information about the cluster where the EMR Containers cluster is running
+        * `namespace` - The namespace where the EMR Containers cluster is running
+* `type` - The type of the container provider
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the cluster.
+* `id` - The ID of the cluster.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EKS Clusters using the `id`. For example:
+
+```terraform
+import {
+  to = aws_emrcontainers_virtual_cluster.example
+  id = "a1b2c3d4e5f6g7h8i9j10k11l"
+}
+```
+
+Using `terraform import`, import EKS Clusters using the `id`. For example:
+
+```console
+% terraform import aws_emrcontainers_virtual_cluster.example a1b2c3d4e5f6g7h8i9j10k11l
+```
diff --git a/website/docs/r/emrcontainers_virtual_cluster.markdown b/website/docs/r/emrcontainers_virtual_cluster.markdown
deleted file mode 100644
index 112c314d65a..00000000000
--- a/website/docs/r/emrcontainers_virtual_cluster.markdown
+++ /dev/null
@@ -1,64 +0,0 @@
----
-subcategory: "EMR Containers"
-layout: "aws"
-page_title: "AWS: aws_emrcontainers_virtual_cluster"
-description: |-
-  Manages an EMR Containers (EMR on EKS) Virtual Cluster
----
-
-# Resource: aws_emrcontainers_virtual_cluster
-
-Manages an EMR Containers (EMR on EKS) Virtual Cluster.
-
-## Example Usage
-
-### Basic Usage
-
-```terraform
-resource "aws_emrcontainers_virtual_cluster" "example" {
-  container_provider {
-    id   = aws_eks_cluster.example.name
-    type = "EKS"
-
-    info {
-      eks_info {
-        namespace = "default"
-      }
-    }
-  }
-
-  name = "example"
-}
-```
-
-## Argument Reference
-
-The following arguments are required:
-
-* `container_provider` - (Required) Configuration block for the container provider associated with your cluster.
-* `name` – (Required) Name of the virtual cluster.
-* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
-
-### container_provider Arguments
-
-* `id` - The name of the container provider that is running your EMR Containers cluster
-* `info` - Nested list containing information about the configuration of the container provider
-    * `eks_info` - Nested list containing EKS-specific information about the cluster where the EMR Containers cluster is running
-        * `namespace` - The namespace where the EMR Containers cluster is running
-* `type` - The type of the container provider
-
-## Attributes Reference
-
-In addition to all arguments above, the following attributes are exported:
-
-* `arn` - ARN of the cluster.
-* `id` - The ID of the cluster.
-* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
-
-## Import
-
-EKS Clusters can be imported using the `id`, e.g.
-
-```
-$ terraform import aws_emrcontainers_virtual_cluster.example a1b2c3d4e5f6g7h8i9j10k11l
-```
diff --git a/website/docs/r/emrserverless_application.html.markdown b/website/docs/r/emrserverless_application.html.markdown
new file mode 100644
index 00000000000..d6d7dc90744
--- /dev/null
+++ b/website/docs/r/emrserverless_application.html.markdown
@@ -0,0 +1,141 @@
+---
+subcategory: "EMR Serverless"
+layout: "aws"
+page_title: "AWS: aws_emrserverless_application"
+description: |-
+  Manages an EMR Serverless Application
+---
+
+# Resource: aws_emrserverless_application
+
+Manages an EMR Serverless Application.
+
+## Example Usage
+
+### Basic Usage
+
+```terraform
+resource "aws_emrserverless_application" "example" {
+  name          = "example"
+  release_label = "emr-6.6.0"
+  type          = "hive"
+}
+```
+
+### Initial Capacity Usage
+
+```terraform
+resource "aws_emrserverless_application" "example" {
+  name          = "example"
+  release_label = "emr-6.6.0"
+  type          = "hive"
+
+  initial_capacity {
+    initial_capacity_type = "HiveDriver"
+
+    initial_capacity_config {
+      worker_count = 1
+      worker_configuration {
+        cpu    = "2 vCPU"
+        memory = "10 GB"
+      }
+    }
+  }
+}
+```
+
+### Maximum Capacity Usage
+
+```terraform
+resource "aws_emrserverless_application" "example" {
+  name          = "example"
+  release_label = "emr-6.6.0"
+  type          = "hive"
+
+  maximum_capacity {
+    cpu    = "2 vCPU"
+    memory = "10 GB"
+  }
+}
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `architecture` – (Optional) The CPU architecture of an application. Valid values are `ARM64` or `X86_64`. Default value is `X86_64`.
+* `auto_start_configuration` – (Optional) The configuration for an application to automatically start on job submission.
+* `auto_stop_configuration` – (Optional) The configuration for an application to automatically stop after a certain amount of time being idle.
+* `image_configuration` – (Optional) The image configuration applied to all worker types.
+* `initial_capacity` – (Optional) The capacity to initialize when the application is created.
+* `maximum_capacity` – (Optional) The maximum capacity to allocate when the application is created. This is cumulative across all workers at any given point in time, not just when an application is created. No new resources will be created once any one of the defined limits is hit.
+* `name` – (Required) The name of the application.
+* `network_configuration` – (Optional) The network configuration for customer VPC connectivity.
+* `release_label` – (Required) The EMR release version associated with the application.
+* `type` – (Required) The type of application you want to start, such as `spark` or `hive`.
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### auto_start_configuration Arguments
+
+* `enabled` - (Optional) Enables the application to automatically start on job submission. Defaults to `true`.
+
+### auto_stop_configuration Arguments
+
+* `enabled` - (Optional) Enables the application to automatically stop after a certain amount of time being idle. Defaults to `true`.
+* `idle_timeout_minutes` - (Optional) The amount of idle time in minutes after which your application will automatically stop. Defaults to `15` minutes.
+
+### initial_capacity Arguments
+
+* `initial_capacity_config` - (Optional) The initial capacity configuration per worker.
+* `initial_capacity_type` - (Required) The worker type for an analytics framework. For Spark applications, the key can either be set to `Driver` or `Executor`. For Hive applications, it can be set to `HiveDriver` or `TezTask`.
+
+### maximum_capacity Arguments
+
+* `cpu` - (Required) The maximum allowed CPU for an application.
+* `disk` - (Optional) The maximum allowed disk for an application.
+* `memory` - (Required) The maximum allowed resources for an application.
+
+### network_configuration Arguments
+
+* `security_group_ids` - (Optional) The array of security group Ids for customer VPC connectivity.
+* `subnet_ids` - (Optional) The array of subnet Ids for customer VPC connectivity.
+
+#### image_configuration Arguments
+
+* `image_uri` - (Required) The image URI.
+
+#### initial_capacity_config Arguments
+
+* `worker_configuration` - (Optional) The resource configuration of the initial capacity configuration.
+* `worker_count` - (Required) The number of workers in the initial capacity configuration.
+
+##### worker_configuration Arguments
+
+* `cpu` - (Required) The CPU requirements for every worker instance of the worker type.
+* `disk` - (Optional) The disk requirements for every worker instance of the worker type.
+* `memory` - (Required) The memory requirements for every worker instance of the worker type.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the cluster.
+* `id` - The ID of the cluster.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EMR Severless applications using the `id`. For example:
+
+```terraform
+import {
+  to = aws_emrserverless_application.example
+  id = "id"
+}
+```
+
+Using `terraform import`, import EMR Severless applications using the `id`. For example:
+
+```console
+% terraform import aws_emrserverless_application.example id
+```
diff --git a/website/docs/r/emrserverless_application.markdown b/website/docs/r/emrserverless_application.markdown
deleted file mode 100644
index f77b516913e..00000000000
--- a/website/docs/r/emrserverless_application.markdown
+++ /dev/null
@@ -1,132 +0,0 @@
----
-subcategory: "EMR Serverless"
-layout: "aws"
-page_title: "AWS: aws_emrserverless_application"
-description: |-
-  Manages an EMR Serverless Application
----
-
-# Resource: aws_emrserverless_application
-
-Manages an EMR Serverless Application.
-
-## Example Usage
-
-### Basic Usage
-
-```terraform
-resource "aws_emrserverless_application" "example" {
-  name          = "example"
-  release_label = "emr-6.6.0"
-  type          = "hive"
-}
-```
-
-### Initial Capacity Usage
-
-```terraform
-resource "aws_emrserverless_application" "example" {
-  name          = "example"
-  release_label = "emr-6.6.0"
-  type          = "hive"
-
-  initial_capacity {
-    initial_capacity_type = "HiveDriver"
-
-    initial_capacity_config {
-      worker_count = 1
-      worker_configuration {
-        cpu    = "2 vCPU"
-        memory = "10 GB"
-      }
-    }
-  }
-}
-```
-
-### Maximum Capacity Usage
-
-```terraform
-resource "aws_emrserverless_application" "example" {
-  name          = "example"
-  release_label = "emr-6.6.0"
-  type          = "hive"
-
-  maximum_capacity {
-    cpu    = "2 vCPU"
-    memory = "10 GB"
-  }
-}
-```
-
-## Argument Reference
-
-The following arguments are required:
-
-* `architecture` – (Optional) The CPU architecture of an application. Valid values are `ARM64` or `X86_64`. Default value is `X86_64`.
-* `auto_start_configuration` – (Optional) The configuration for an application to automatically start on job submission.
-* `auto_stop_configuration` – (Optional) The configuration for an application to automatically stop after a certain amount of time being idle.
-* `image_configuration` – (Optional) The image configuration applied to all worker types.
-* `initial_capacity` – (Optional) The capacity to initialize when the application is created.
-* `maximum_capacity` – (Optional) The maximum capacity to allocate when the application is created. This is cumulative across all workers at any given point in time, not just when an application is created. No new resources will be created once any one of the defined limits is hit.
-* `name` – (Required) The name of the application.
-* `network_configuration` – (Optional) The network configuration for customer VPC connectivity.
-* `release_label` – (Required) The EMR release version associated with the application.
-* `type` – (Required) The type of application you want to start, such as `spark` or `hive`.
-* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
-
-### auto_start_configuration Arguments
-
-* `enabled` - (Optional) Enables the application to automatically start on job submission. Defaults to `true`.
-
-### auto_stop_configuration Arguments
-
-* `enabled` - (Optional) Enables the application to automatically stop after a certain amount of time being idle. Defaults to `true`.
-* `idle_timeout_minutes` - (Optional) The amount of idle time in minutes after which your application will automatically stop. Defaults to `15` minutes.
-
-### initial_capacity Arguments
-
-* `initial_capacity_config` - (Optional) The initial capacity configuration per worker.
-* `initial_capacity_type` - (Required) The worker type for an analytics framework. For Spark applications, the key can either be set to `Driver` or `Executor`. For Hive applications, it can be set to `HiveDriver` or `TezTask`.
-
-### maximum_capacity Arguments
-
-* `cpu` - (Required) The maximum allowed CPU for an application.
-* `disk` - (Optional) The maximum allowed disk for an application.
-* `memory` - (Required) The maximum allowed resources for an application.
-
-### network_configuration Arguments
-
-* `security_group_ids` - (Optional) The array of security group Ids for customer VPC connectivity.
-* `subnet_ids` - (Optional) The array of subnet Ids for customer VPC connectivity.
-
-#### image_configuration Arguments
-
-* `image_uri` - (Required) The image URI.
-
-#### initial_capacity_config Arguments
-
-* `worker_configuration` - (Optional) The resource configuration of the initial capacity configuration.
-* `worker_count` - (Required) The number of workers in the initial capacity configuration.
-
-##### worker_configuration Arguments
-
-* `cpu` - (Required) The CPU requirements for every worker instance of the worker type.
-* `disk` - (Optional) The disk requirements for every worker instance of the worker type.
-* `memory` - (Required) The memory requirements for every worker instance of the worker type.
-
-## Attributes Reference
-
-In addition to all arguments above, the following attributes are exported:
-
-* `arn` - ARN of the cluster.
-* `id` - The ID of the cluster.
-* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
-
-## Import
-
-EMR Severless applications can be imported using the `id`, e.g.
-
-```
-$ terraform import aws_emrserverless_application.example id
-```
diff --git a/website/docs/r/evidently_feature.html.markdown b/website/docs/r/evidently_feature.html.markdown
index 1e1c09a2ae5..1a7c7d02a5a 100644
--- a/website/docs/r/evidently_feature.html.markdown
+++ b/website/docs/r/evidently_feature.html.markdown
@@ -107,7 +107,7 @@ resource "aws_evidently_feature" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `default_variation` - (Optional) The name of the variation to use as the default variation. The default variation is served to users who are not allocated to any ongoing launches or experiments of this feature. This variation must also be listed in the `variations` structure. If you omit `default_variation`, the first variation listed in the `variations` structure is used as the default variation.
 * `description` - (Optional) Specifies the description of the feature.
@@ -144,9 +144,9 @@ The `value` block supports the following arguments:
 * `delete` - (Default `2m`)
 * `update` - (Default `2m`)
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The ARN of the feature.
 * `created_time` - The date and time that the feature is created.
@@ -166,8 +166,17 @@ The `evaluation_rules` block supports the following attributes:
 
 ## Import
 
-CloudWatch Evidently Feature can be imported using the feature `name` and `name` or `arn` of the hosting CloudWatch Evidently Project separated by a `:`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudWatch Evidently Feature using the feature `name` and `name` or `arn` of the hosting CloudWatch Evidently Project separated by a `:`. For example:
 
+```terraform
+import {
+  to = aws_evidently_feature.example
+  id = "exampleFeatureName:arn:aws:evidently:us-east-1:123456789012:project/example"
+}
 ```
-$ terraform import aws_evidently_feature.example exampleFeatureName:arn:aws:evidently:us-east-1:123456789012:project/example
+
+Using `terraform import`, import CloudWatch Evidently Feature using the feature `name` and `name` or `arn` of the hosting CloudWatch Evidently Project separated by a `:`. For example:
+
+```console
+% terraform import aws_evidently_feature.example exampleFeatureName:arn:aws:evidently:us-east-1:123456789012:project/example
 ```
diff --git a/website/docs/r/evidently_launch.html.markdown b/website/docs/r/evidently_launch.html.markdown
index be96f201322..344fd180fab 100644
--- a/website/docs/r/evidently_launch.html.markdown
+++ b/website/docs/r/evidently_launch.html.markdown
@@ -255,7 +255,7 @@ resource "aws_evidently_launch" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `description` - (Optional) Specifies the description of the launch.
 * `groups` - (Required) One or up to five blocks that contain the feature and variations that are to be used for the launch. [Detailed below](#groups).
@@ -319,9 +319,9 @@ The `steps` block supports the following arguments:
 * `delete` - (Default `2m`)
 * `update` - (Default `2m`)
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The ARN of the launch.
 * `created_time` - The date and time that the launch is created.
@@ -342,14 +342,36 @@ The `execution` block supports the following attributes:
 
 ## Import
 
-CloudWatch Evidently Launch can be imported using the `name` of the launch and `name` or `arn` of the hosting CloudWatch Evidently Project separated by a `:`, e.g. with the `name` of the launch and `arn` of the project,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudWatch Evidently Launch using the `name` of the launch and `name` of the project or `arn` of the hosting CloudWatch Evidently Project separated by a `:`. For example:
 
+Import using the `name` of the launch and `name` of the project separated by a `:`:
+
+```terraform
+import {
+  to = aws_evidently_launch.example
+  id = "exampleLaunchName:exampleProjectName"
+}
 ```
-$ terraform import aws_evidently_launch.example exampleLaunchName:arn:aws:evidently:us-east-1:123456789012:project/exampleProjectName
+
+Import using the `name` of the launch and `arn` of the project separated by a `:`:
+
+```terraform
+import {
+  to = aws_evidently_launch.example
+  id = "exampleLaunchName:arn:aws:evidently:us-east-1:123456789012:project/exampleProjectName"
+}
 ```
 
-e.g. with the `name` of the launch and `name` of the project,
+**Using `terraform import` to import** CloudWatch Evidently Launch using the `name` of the launch and `name` of the project or `arn` of the hosting CloudWatch Evidently Project separated by a `:`. For example:
+
+Import using the `name` of the launch and `name` of the project separated by a `:`:
 
+```console
+% terraform import aws_evidently_launch.example exampleLaunchName:exampleProjectName
 ```
-$ terraform import aws_evidently_launch.example exampleLaunchName:exampleProjectName
+
+Import using the `name` of the launch and `arn` of the project separated by a `:`:
+
+```console
+% terraform import aws_evidently_launch.example exampleLaunchName:arn:aws:evidently:us-east-1:123456789012:project/exampleProjectName
 ```
diff --git a/website/docs/r/evidently_project.html.markdown b/website/docs/r/evidently_project.html.markdown
index 439cc9dbc7d..39ea39a01d3 100644
--- a/website/docs/r/evidently_project.html.markdown
+++ b/website/docs/r/evidently_project.html.markdown
@@ -66,7 +66,7 @@ resource "aws_evidently_project" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `data_delivery` - (Optional) A block that contains information about where Evidently is to store evaluation events for longer term storage, if you choose to do so. If you choose not to store these events, Evidently deletes them after using them to produce metrics and other experiment results that you can view. See below.
 * `description` - (Optional) Specifies the description of the project.
@@ -97,9 +97,9 @@ The `s3_destination` block supports the following arguments:
 * `delete` - (Default `2m`)
 * `update` - (Default `2m`)
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `active_experiment_count` - The number of ongoing experiments currently in the project.
 * `active_launch_count` - The number of ongoing launches currently in the project.
@@ -115,8 +115,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-CloudWatch Evidently Project can be imported using the `arn`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudWatch Evidently Project using the `arn`. For example:
 
+```terraform
+import {
+  to = aws_evidently_project.example
+  id = "arn:aws:evidently:us-east-1:123456789012:segment/example"
+}
 ```
-$ terraform import aws_evidently_project.example arn:aws:evidently:us-east-1:123456789012:segment/example
+
+Using `terraform import`, import CloudWatch Evidently Project using the `arn`. For example:
+
+```console
+% terraform import aws_evidently_project.example arn:aws:evidently:us-east-1:123456789012:segment/example
 ```
diff --git a/website/docs/r/evidently_segment.html.markdown b/website/docs/r/evidently_segment.html.markdown
index b096d4b11ae..bb8f174a067 100644
--- a/website/docs/r/evidently_segment.html.markdown
+++ b/website/docs/r/evidently_segment.html.markdown
@@ -58,16 +58,16 @@ resource "aws_evidently_segment" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `description` - (Optional, Forces new resource) Specifies the description of the segment.
 * `name` - (Required, Forces new resource) A name for the segment.
 * `pattern` - (Required, Forces new resource) The pattern to use for the segment. For more information about pattern syntax, see [Segment rule pattern syntax](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-Evidently-segments.html#CloudWatch-Evidently-segments-syntax.html).
 * `tags` - (Optional) Tags to apply to the segment. If configured with a provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The ARN of the segment.
 * `created_time` - The date and time that the segment is created.
@@ -79,8 +79,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-CloudWatch Evidently Segment can be imported using the `arn`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudWatch Evidently Segment using the `arn`. For example:
 
+```terraform
+import {
+  to = aws_evidently_segment.example
+  id = "arn:aws:evidently:us-west-2:123456789012:segment/example"
+}
 ```
-$ terraform import aws_evidently_segment.example arn:aws:evidently:us-west-2:123456789012:segment/example
+
+Using `terraform import`, import CloudWatch Evidently Segment using the `arn`. For example:
+
+```console
+% terraform import aws_evidently_segment.example arn:aws:evidently:us-west-2:123456789012:segment/example
 ```
diff --git a/website/docs/r/finspace_kx_cluster.html.markdown b/website/docs/r/finspace_kx_cluster.html.markdown
index ade42519139..de7c95f5dfa 100644
--- a/website/docs/r/finspace_kx_cluster.html.markdown
+++ b/website/docs/r/finspace_kx_cluster.html.markdown
@@ -118,7 +118,9 @@ The capacity_configuration block supports the following arguments:
 The cache_storage_configuration block supports the following arguments:
 
 * `type` - (Required) Type of cache storage . The valid values are:
-    * CACHE_1000 - This type provides at least 1000 MB/s disk access throughput.
+    * CACHE_1000 - This type provides 1000 MB/s disk access throughput.
+    * CACHE_250 - This type provides 250 MB/s disk access throughput.
+    * CACHE_12 - This type provides 12 MB/s disk access throughput.
 * `size` - (Required) Size of cache in Gigabytes.
 
 ### code
@@ -134,7 +136,7 @@ The code block supports the following arguments:
 The database block supports the following arguments:
 
 * `database_name` - (Required) Name of the KX database.
-* `cache_configurations` - (Required)  Configuration details for the disk cache to increase performance reading from a KX database mounted to the cluster. See [cache_configurations](#cache_configurations).
+* `cache_configurations` - (Optional) Configuration details for the disk cache to increase performance reading from a KX database mounted to the cluster. See [cache_configurations](#cache_configurations).
 * `changeset_id` - (Optional) A unique identifier of the changeset that is associated with the cluster.
 
 #### cache_configurations
@@ -142,7 +144,7 @@ The database block supports the following arguments:
 The cache_configuration block supports the following arguments:
 
 * `cache_type` - (Required) Type of disk cache.
-* `db_paths` - (Required) Paths within the database to cache.
+* `db_paths` - (Optional) Paths within the database to cache.
 
 ### savedown_storage_configuration
 
@@ -150,7 +152,7 @@ The savedown_storage_configuration block supports the following arguments:
 
 * `type` - (Required) Type of writeable storage space for temporarily storing your savedown data. The valid values are:
     * SDS01 - This type represents 3000 IOPS and io2 ebs volume type.
-* `size` - (Required) Size of temporary storage in bytes.
+* `size` - (Required) Size of temporary storage in gigabytes. Must be between 10 and 16000.
 
 ### vpc_configuration
 
@@ -161,9 +163,9 @@ The vpc_configuration block supports the following arguments:
 * `subnet_ids `- (Required) Identifier of the subnet that the Privatelink VPC endpoint uses to connect to the cluster.
 * `ip_address_type` - (Required) IP address type for cluster network configuration parameters. The following type is available: IP_V4 - IP address version 4.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name (ARN) identifier of the KX cluster.
 * `created_timestamp` - Timestamp at which the cluster is created in FinSpace. Value determined as epoch time in seconds. For example, the value for Monday, November 1, 2021 12:00:00 PM UTC is specified as 1635768000.
@@ -175,14 +177,23 @@ In addition to all arguments above, the following attributes are exported:
 
 [Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
 
-* `create` - (Default `30m`)
+* `create` - (Default `45m`)
 * `update` - (Default `2m`)
-* `delete` - (Default `40m`)
+* `delete` - (Default `60m`)
 
 ## Import
 
-An AWS FinSpace Kx Cluster can be imported using the `id` (environment ID and cluster name, comma-delimited), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import an AWS FinSpace Kx Cluster using the `id` (environment ID and cluster name, comma-delimited). For example:
 
+```terraform
+import {
+  to = aws_finspace_kx_cluster.example
+  id = "n3ceo7wqxoxcti5tujqwzs,my-tf-kx-cluster"
+}
 ```
-$ terraform import aws_finspace_kx_cluster.example n3ceo7wqxoxcti5tujqwzs,my-tf-kx-cluster
+
+Using `terraform import`, import an AWS FinSpace Kx Cluster using the `id` (environment ID and cluster name, comma-delimited). For example:
+
+```console
+% terraform import aws_finspace_kx_cluster.example n3ceo7wqxoxcti5tujqwzs,my-tf-kx-cluster
 ```
diff --git a/website/docs/r/finspace_kx_database.html.markdown b/website/docs/r/finspace_kx_database.html.markdown
index a9458eea0e6..f223e2a7038 100644
--- a/website/docs/r/finspace_kx_database.html.markdown
+++ b/website/docs/r/finspace_kx_database.html.markdown
@@ -44,9 +44,9 @@ The following arguments are optional:
 * `description` - (Optional) Description of the KX database.
 * `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name (ARN) identifier of the KX database.
 * `created_timestamp` - Timestamp at which the databse is created in FinSpace. Value determined as epoch time in seconds. For example, the value for Monday, November 1, 2021 12:00:00 PM UTC is specified as 1635768000.
@@ -64,8 +64,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-An AWS FinSpace Kx Database can be imported using the `id` (environment ID and database name, comma-delimited), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import an AWS FinSpace Kx Database using the `id` (environment ID and database name, comma-delimited). For example:
 
+```terraform
+import {
+  to = aws_finspace_kx_database.example
+  id = "n3ceo7wqxoxcti5tujqwzs,my-tf-kx-database"
+}
 ```
-$ terraform import aws_finspace_kx_database.example n3ceo7wqxoxcti5tujqwzs,my-tf-kx-database
+
+Using `terraform import`, import an AWS FinSpace Kx Database using the `id` (environment ID and database name, comma-delimited). For example:
+
+```console
+% terraform import aws_finspace_kx_database.example n3ceo7wqxoxcti5tujqwzs,my-tf-kx-database
 ```
diff --git a/website/docs/r/finspace_kx_environment.html.markdown b/website/docs/r/finspace_kx_environment.html.markdown
index e6d5b1532ca..7e424001101 100644
--- a/website/docs/r/finspace_kx_environment.html.markdown
+++ b/website/docs/r/finspace_kx_environment.html.markdown
@@ -26,7 +26,7 @@ resource "aws_finspace_kx_environment" "example" {
 }
 ```
 
-### With Network Setup
+### With Transit Gateway Configuration
 
 ```terraform
 resource "aws_kms_key" "example" {
@@ -55,6 +55,49 @@ resource "aws_finspace_kx_environment" "example_env" {
 }
 ```
 
+### With Transit Gateway Attachment Network ACL Configuration
+
+```terraform
+resource "aws_kms_key" "example" {
+  description             = "Sample KMS Key"
+  deletion_window_in_days = 7
+}
+
+resource "aws_ec2_transit_gateway" "example" {
+  description = "example"
+}
+
+resource "aws_finspace_kx_environment" "example_env" {
+  name        = "my-tf-kx-environment"
+  description = "Environment description"
+  kms_key_id  = aws_kms_key.example.arn
+
+  transit_gateway_configuration {
+    transit_gateway_id  = aws_ec2_transit_gateway.example.id
+    routable_cidr_space = "100.64.0.0/26"
+    attachment_network_acl_configuration {
+      rule_number = 1
+      protocol    = "6"
+      rule_action = "allow"
+      cidr_block  = "0.0.0.0/0"
+      port_range {
+        from = 53
+        to   = 53
+      }
+      icmp_type_code {
+        type = -1
+        code = -1
+      }
+    }
+  }
+
+  custom_dns_configuration {
+    custom_dns_server_name = "example.finspace.amazonaws.com"
+    custom_dns_server_ip   = "10.0.0.76"
+  }
+}
+```
+
 ## Argument Reference
 
 The following arguments are required:
@@ -82,10 +125,38 @@ The transit_gateway_configuration block supports the following arguments:
 
 * `routable_cidr_space` - (Required) Routing CIDR on behalf of KX environment. It could be any “/26 range in the 100.64.0.0 CIDR space. After providing, it will be added to the customer’s transit gateway routing table so that the traffics could be routed to KX network.
 * `transit_gateway_id` - (Required) Identifier of the transit gateway created by the customer to connect outbound traffics from KX network to your internal network.
+* `attachment_network_acl_configuration` - (Optional) Rules that define how you manage outbound traffic from kdb network to your internal network. Defined below.
+
+### attachment_network_acl_configuration
+
+The network access control list (ACL) is an optional layer of security for VPCs that acts as a firewall for controlling traffic in and out of one or more subnets.
+The entry is a set of numbered ingress and egress rules that determine whether a packet should be allowed in or out of a subnet associated with the ACL.
+Entries in the ACL are processed according to the rule numbers, in ascending order. The `attachment_network_acl_configuration` block supports the following arguments:
+
+* `cidr_block` - (Required) The IPv4 network range to allow or deny, in CIDR notation. The specified CIDR block is modified to its canonical form. For example, `100.68.0.18/18` will be converted to `100.68.0.0/18`.
+* `protocol` - (Required) Protocol number. A value of `1` means all the protocols.
+* `rule_action` - (Required) Indicates whether to `allow` or `deny` the traffic that matches the rule.
+* `rule_number` - (Required) Rule number for the entry. All the network ACL entries are processed in ascending order by rule number.
+* `icmp_type_code` - (Optional) Defines the ICMP protocol that consists of the ICMP type and code. Defined below.
+* `port_range` - (Optional) Range of ports the rule applies to. Defined below.
 
-## Attributes Reference
+### port_range
 
-In addition to all arguments above, the following attributes are exported:
+The range of ports the rule applies to (between `0` and `65535`). The `port_range` block supports the following arguments:
+
+* `from` - (Required) First port in the range.
+* `to` - (Required) Last port in the range.
+
+### icmp_type_code
+
+Defines the ICMP protocol that consists of the ICMP type and code. The `icmp_type_code` block supports the following arguments:
+
+* `code` - (Required) ICMP code. A value of `-1` means all codes for the specified ICMP type.
+* `type` - (Required) ICMP type. A value of `-1` means all types.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name (ARN) identifier of the KX environment.
 * `availability_zones` - AWS Availability Zone IDs that this environment is available in. Important when selecting VPC subnets to use in cluster creation.
@@ -102,12 +173,21 @@ In addition to all arguments above, the following attributes are exported:
 
 * `create` - (Default `30m`)
 * `update` - (Default `30m`)
-* `delete` - (Default `30m`)
+* `delete` - (Default `45m`)
 
 ## Import
 
-An AWS FinSpace Kx Environment can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import an AWS FinSpace Kx Environment using the `id`. For example:
 
+```terraform
+import {
+  to = aws_finspace_kx_environment.example
+  id = "n3ceo7wqxoxcti5tujqwzs"
+}
 ```
-$ terraform import aws_finspace_kx_environment.example n3ceo7wqxoxcti5tujqwzs
+
+Using `terraform import`, import an AWS FinSpace Kx Environment using the `id`. For example:
+
+```console
+% terraform import aws_finspace_kx_environment.example n3ceo7wqxoxcti5tujqwzs
 ```
diff --git a/website/docs/r/finspace_kx_user.html.markdown b/website/docs/r/finspace_kx_user.html.markdown
index a0439092c55..a4af758d4be 100644
--- a/website/docs/r/finspace_kx_user.html.markdown
+++ b/website/docs/r/finspace_kx_user.html.markdown
@@ -62,9 +62,9 @@ The following arguments are optional:
 
 * `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name (ARN) identifier of the KX user.
 * `id` - A comma-delimited string joining environment ID and user name.
@@ -80,8 +80,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-An AWS FinSpace Kx User can be imported using the `id` (environment ID and user name, comma-delimited), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import an AWS FinSpace Kx User using the `id` (environment ID and user name, comma-delimited). For example:
 
+```terraform
+import {
+  to = aws_finspace_kx_user.example
+  id = "n3ceo7wqxoxcti5tujqwzs,my-tf-kx-user"
+}
 ```
-$ terraform import aws_finspace_kx_user.example n3ceo7wqxoxcti5tujqwzs,my-tf-kx-user
+
+Using `terraform import`, import an AWS FinSpace Kx User using the `id` (environment ID and user name, comma-delimited). For example:
+
+```console
+% terraform import aws_finspace_kx_user.example n3ceo7wqxoxcti5tujqwzs,my-tf-kx-user
 ```
diff --git a/website/docs/r/fis_experiment_template.html.markdown b/website/docs/r/fis_experiment_template.html.markdown
index b508c6442f5..5f03c0f5f38 100644
--- a/website/docs/r/fis_experiment_template.html.markdown
+++ b/website/docs/r/fis_experiment_template.html.markdown
@@ -61,6 +61,7 @@ The following arguments are optional:
 
 * `tags` - (Optional) Key-value mapping of tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 * `target` - (Optional) Target of an action. See below.
+* `log_configuration` - (Optional) The configuration for experiment logging. See below.
 
 ### `action`
 
@@ -80,7 +81,7 @@ For a list of parameters supported by each action, see [AWS FIS actions referenc
 
 #### `target` (`action.*.target`)
 
-* `key` - (Required) Target type. Valid values are `Cluster` (EKS Cluster), `Clusters` (ECS Clusters), `DBInstances` (RDS DB Instances), `Instances` (EC2 Instances), `Nodegroups` (EKS Node groups), `Roles` (IAM Roles), `SpotInstances` (EC2 Spot Instances), `Subnets` (VPC Subnets), `Volumes` (EBS Volumes).
+* `key` - (Required) Target type. Valid values are `Cluster` (EKS Cluster), `Clusters` (ECS Clusters), `DBInstances` (RDS DB Instances), `Instances` (EC2 Instances), `Nodegroups` (EKS Node groups), `Roles` (IAM Roles), `SpotInstances` (EC2 Spot Instances), `Subnets` (VPC Subnets), `Volumes` (EBS Volumes) , `Pods` (EKS Pods), `Tasks` (ECS Tasks). See the [documentation](https://docs.aws.amazon.com/fis/latest/userguide/actions.html#action-targets) for more details.
 * `value` - (Required) Target name, referencing a corresponding target.
 
 ### `stop_condition`
@@ -96,6 +97,7 @@ For a list of parameters supported by each action, see [AWS FIS actions referenc
 * `filter` - (Optional) Filter(s) for the target. Filters can be used to select resources based on specific attributes returned by the respective describe action of the resource type. For more information, see [Targets for AWS FIS](https://docs.aws.amazon.com/fis/latest/userguide/targets.html#target-filters). See below.
 * `resource_arns` - (Optional) Set of ARNs of the resources to target with an action. Conflicts with `resource_tag`.
 * `resource_tag` - (Optional) Tag(s) the resources need to have to be considered a valid target for an action. Conflicts with `resource_arns`. See below.
+* `parameters` - (Optional) The resource type parameters.
 
 ~> **NOTE:** The `target` configuration block requires either `resource_arns` or `resource_tag`.
 
@@ -111,16 +113,40 @@ For a list of parameters supported by each action, see [AWS FIS actions referenc
 * `key` - (Required) Tag key.
 * `value` - (Required) Tag value.
 
-## Attributes Reference
+### `log_configuration`
 
-In addition to all arguments above, the following attributes are exported:
+* `log_schema_version` - (Required) The schema version. See [documentation](https://docs.aws.amazon.com/fis/latest/userguide/monitoring-logging.html#experiment-log-schema) for the list of schema versions.
+* `cloudwatch_logs_configuration` - (Optional) The configuration for experiment logging to Amazon CloudWatch Logs. See below.
+* `s3_configuration` - (Optional) The configuration for experiment logging to Amazon S3. See below.
+
+#### `cloudwatch_logs_configuration`
+
+* `log_group_arn` - (Required) The Amazon Resource Name (ARN) of the destination Amazon CloudWatch Logs log group.
+
+#### `s3_configuration`
+
+* `bucket_name` - (Required) The name of the destination bucket.
+* `prefix` - (Optional) The bucket prefix.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Experiment Template ID.
 
 ## Import
 
-FIS Experiment Templates can be imported using the `id`, e.g.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import FIS Experiment Templates using the `id`. For example:
 
+```terraform
+import {
+  to = aws_fis_experiment_template.template
+  id = "EXT123AbCdEfGhIjK"
+}
 ```
-$ terraform import aws_fis_experiment_template.template EXT123AbCdEfGhIjK
+
+Using `terraform import`, import FIS Experiment Templates using the `id`. For example:
+
+```console
+% terraform import aws_fis_experiment_template.template EXT123AbCdEfGhIjK
 ```
diff --git a/website/docs/r/flow_log.html.markdown b/website/docs/r/flow_log.html.markdown
index eb7e96c86b0..c38a6fcfcd6 100644
--- a/website/docs/r/flow_log.html.markdown
+++ b/website/docs/r/flow_log.html.markdown
@@ -178,7 +178,7 @@ resource "aws_s3_bucket" "example" {
 
 ~> **NOTE:** One of `eni_id`, `subnet_id`, `transit_gateway_id`, `transit_gateway_attachment_id`, or `vpc_id` must be specified.
 
-The following arguments are supported:
+This argument supports the following arguments:
 
 * `traffic_type` - (Required) The type of traffic to capture. Valid values: `ACCEPT`,`REJECT`, `ALL`.
 * `deliver_cross_account_role` - (Optional) ARN of the IAM role that allows Amazon EC2 to publish flow logs across accounts.
@@ -207,9 +207,9 @@ Describes the destination options for a flow log.
 * `hive_compatible_partitions` - (Optional) Indicates whether to use Hive-compatible prefixes for flow logs stored in Amazon S3. Default value: `false`.
 * `per_hour_partition` - (Optional) Indicates whether to partition the flow log per hour. This reduces the cost and response time for queries. Default value: `false`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The Flow Log ID
 * `arn` - The ARN of the Flow Log.
@@ -217,8 +217,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Flow Logs can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Flow Logs using the `id`. For example:
 
+```terraform
+import {
+  to = aws_flow_log.test_flow_log
+  id = "fl-1a2b3c4d"
+}
 ```
-$ terraform import aws_flow_log.test_flow_log fl-1a2b3c4d
+
+Using `terraform import`, import Flow Logs using the `id`. For example:
+
+```console
+% terraform import aws_flow_log.test_flow_log fl-1a2b3c4d
 ```
diff --git a/website/docs/r/fms_admin_account.html.markdown b/website/docs/r/fms_admin_account.html.markdown
index 2f870391a96..4d9aec89c90 100644
--- a/website/docs/r/fms_admin_account.html.markdown
+++ b/website/docs/r/fms_admin_account.html.markdown
@@ -18,20 +18,36 @@ resource "aws_fms_admin_account" "example" {}
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `account_id` - (Optional) The AWS account ID to associate with AWS Firewall Manager as the AWS Firewall Manager administrator account. This can be an AWS Organizations master account or a member account. Defaults to the current account. Must be configured to perform drift detection.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The AWS account ID of the AWS Firewall Manager administrator account.
 
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `30m`)
+- `delete` - (Default `10m`)
+
 ## Import
 
-Firewall Manager administrator account association can be imported using the account ID, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Firewall Manager administrator account association using the account ID. For example:
 
+```terraform
+import {
+  to = aws_fms_admin_account.example
+  id = "123456789012"
+}
 ```
-$ terraform import aws_fms_admin_account.example 123456789012
+
+Using `terraform import`, import Firewall Manager administrator account association using the account ID. For example:
+
+```console
+% terraform import aws_fms_admin_account.example 123456789012
 ```
diff --git a/website/docs/r/fms_policy.html.markdown b/website/docs/r/fms_policy.html.markdown
index 415d3f54ae5..84b54e90ea4 100644
--- a/website/docs/r/fms_policy.html.markdown
+++ b/website/docs/r/fms_policy.html.markdown
@@ -10,6 +10,8 @@ description: |-
 
 Provides a resource to create an AWS Firewall Manager policy. You need to be using AWS organizations and have enabled the Firewall Manager administrator account.
 
+~> **NOTE:** Due to limitations with testing, we provide it as best effort. If you find it useful, and have the ability to help test or notice issues, consider reaching out to us on [GitHub](https://github.com/hashicorp/terraform-provider-aws).
+
 ## Example Usage
 
 ```terraform
@@ -50,7 +52,7 @@ resource "aws_wafregional_rule_group" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required, Forces new resource) The friendly name of the AWS Firewall Manager Policy.
 * `delete_all_policy_resources` - (Optional) If true, the request will also perform a clean-up process. Defaults to `true`. More information can be found here [AWS Firewall Manager delete policy](https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_DeletePolicy.html)
@@ -82,12 +84,26 @@ You can specify inclusions or exclusions, but not both. If you specify an `inclu
 
 ## `security_service_policy_data` Configuration Block
 
-* `managed_service_data` (Optional) Details about the service that are specific to the service type, in JSON format. For service type `SHIELD_ADVANCED`, this is an empty string. Examples depending on `type` can be found in the [AWS Firewall Manager SecurityServicePolicyData API Reference](https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_SecurityServicePolicyData.html).
+* `managed_service_data` - (Optional) Details about the service that are specific to the service type, in JSON format. For service type `SHIELD_ADVANCED`, this is an empty string. Examples depending on `type` can be found in the [AWS Firewall Manager SecurityServicePolicyData API Reference](https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_SecurityServicePolicyData.html).
+* `policy_option` - (Optional) Contains the Network Firewall firewall policy options to configure a centralized deployment model. Documented below.
 * `type` - (Required, Forces new resource) The service that the policy is using to protect the resources. For the current list of supported types, please refer to the [AWS Firewall Manager SecurityServicePolicyData API Type Reference](https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_SecurityServicePolicyData.html#fms-Type-SecurityServicePolicyData-Type).
 
-## Attributes Reference
+## `policy_option` Configuration Block
+
+* `network_firewall_policy` - (Optional) Defines the deployment model to use for the firewall policy. Documented below.
+* `thirdparty_firewall_policy` - (Optional) Defines the policy options for a third-party firewall policy. Documented below.
+
+## `network_firewall_policy` Configuration Block
+
+* `firewall_deployment_model` - (Optional) Defines the deployment model to use for the firewall policy. To use a distributed model, remove the `policy_option` section. Valid values are `CENTRALIZED` and `DISTRIBUTED`.
+
+## `thirdparty_firewall_policy` Configuration Block
+
+* `firewall_deployment_model` - (Optional) Defines the deployment model to use for the third-party firewall policy. Valid values are `CENTRALIZED` and `DISTRIBUTED`.
 
-In addition to all arguments above, the following attributes are exported:
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The AWS account ID of the AWS Firewall Manager administrator account.
 * `policy_update_token` - A unique identifier for each update to the policy.
@@ -95,8 +111,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Firewall Manager policies can be imported using the policy ID, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Firewall Manager policies using the policy ID. For example:
 
+```terraform
+import {
+  to = aws_fms_policy.example
+  id = "5be49585-a7e3-4c49-dde1-a179fe4a619a"
+}
 ```
-$ terraform import aws_fms_policy.example 5be49585-a7e3-4c49-dde1-a179fe4a619a
+
+Using `terraform import`, import Firewall Manager policies using the policy ID. For example:
+
+```console
+% terraform import aws_fms_policy.example 5be49585-a7e3-4c49-dde1-a179fe4a619a
 ```
diff --git a/website/docs/r/fsx_backup.html.markdown b/website/docs/r/fsx_backup.html.markdown
index 52afcd21be7..29a2fb18dd9 100644
--- a/website/docs/r/fsx_backup.html.markdown
+++ b/website/docs/r/fsx_backup.html.markdown
@@ -76,7 +76,7 @@ resource "aws_fsx_openzfs_file_system" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 Note - Only file_system_id or volume_id can be specified. file_system_id is used for Lustre and Windows, volume_id is used for ONTAP.
 
@@ -84,9 +84,9 @@ Note - Only file_system_id or volume_id can be specified. file_system_id is used
 * `tags` - (Optional) A map of tags to assign to the file system. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level. If you have set `copy_tags_to_backups` to true, and you specify one or more tags, no existing file system tags are copied from the file system to the backup.
 * `volume_id` - (Optional) The ID of the volume to back up. Required if backing up a ONTAP Volume.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name of the backup.
 * `id` - Identifier of the backup, e.g., `fs-12345678`
@@ -104,8 +104,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-FSx Backups can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import FSx Backups using the `id`. For example:
 
+```terraform
+import {
+  to = aws_fsx_backup.example
+  id = "fs-543ab12b1ca672f33"
+}
 ```
-$ terraform import aws_fsx_backup.example fs-543ab12b1ca672f33
+
+Using `terraform import`, import FSx Backups using the `id`. For example:
+
+```console
+% terraform import aws_fsx_backup.example fs-543ab12b1ca672f33
 ```
diff --git a/website/docs/r/fsx_data_repository_association.html.markdown b/website/docs/r/fsx_data_repository_association.html.markdown
index 1633f15a9fd..31538f8018f 100644
--- a/website/docs/r/fsx_data_repository_association.html.markdown
+++ b/website/docs/r/fsx_data_repository_association.html.markdown
@@ -51,7 +51,7 @@ resource "aws_fsx_data_repository_association" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `batch_import_meta_data_on_create` - (Optional) Set to true to run an import data repository task to import metadata from the data repository to the file system after the data repository association is created. Defaults to `false`.
 * `data_repository_path` - (Required) The path to the Amazon S3 data repository that will be linked to the file system. The path must be an S3 bucket s3://myBucket/myPrefix/. This path specifies where in the S3 data repository files will be imported from or exported to. The same S3 bucket cannot be linked more than once to the same file system.
@@ -72,9 +72,9 @@ The configuration for an Amazon S3 data repository linked to an Amazon FSx Lustr
 
 * `events` - (Optional) A list of file event types to automatically export to your linked S3 bucket or import from the linked S3 bucket. Valid values are `NEW`, `CHANGED`, `DELETED`. Max of 3.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name of the file system.
 * `id` - Identifier of the data repository association, e.g., `dra-12345678`
@@ -90,8 +90,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-FSx Data Repository Associations can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import FSx Data Repository Associations using the `id`. For example:
 
+```terraform
+import {
+  to = aws_fsx_data_repository_association.example
+  id = "dra-0b1cfaeca11088b10"
+}
 ```
-$ terraform import aws_fsx_data_repository_association.example dra-0b1cfaeca11088b10
+
+Using `terraform import`, import FSx Data Repository Associations using the `id`. For example:
+
+```console
+% terraform import aws_fsx_data_repository_association.example dra-0b1cfaeca11088b10
 ```
diff --git a/website/docs/r/fsx_file_cache.html.markdown b/website/docs/r/fsx_file_cache.html.markdown
index e7c50869250..beaa2b39554 100644
--- a/website/docs/r/fsx_file_cache.html.markdown
+++ b/website/docs/r/fsx_file_cache.html.markdown
@@ -65,7 +65,7 @@ A list of up to 8 configurations for data repository associations (DRAs) to be c
 
 #### Data Repository Association arguments
 
-The following arguments are supported for `data_repository_association` configuration block:
+The `data_repository_association` configuration block supports the following arguments:
 
 * `file_cache_path` - (Required) A path on the cache that points to a high-level directory (such as /ns1/) or subdirectory (such as /ns1/subdir/) that will be mapped 1-1 with DataRepositoryPath. The leading forward slash in the name is required. Two data repository associations cannot have overlapping cache paths. For example, if a data repository is associated with cache path /ns1/, then you cannot link another data repository with cache path /ns1/ns2. This path specifies where in your cache files will be exported from. This cache directory can be linked to only one data repository, and no data repository other can be linked to the directory. Note: The cache path can only be set to root (/) on an NFS DRA when DataRepositorySubdirectories is specified. If you specify root (/) as the cache path, you can create only one DRA on the cache. The cache path cannot be set to root (/) for an S3 DRA.
 * `data_repository_path` - (Optional) The path to the S3 or NFS data repository that links to the cache.
@@ -74,14 +74,14 @@ The following arguments are supported for `data_repository_association` configur
 
 #### NFS arguments
 
-The following arguments are supported for `nfs` configuration block:
+The `nfs` configuration block supports the following arguments:
 
 * `version` - (Required) - The version of the NFS (Network File System) protocol of the NFS data repository. The only supported value is NFS3, which indicates that the data repository must support the NFSv3 protocol. The only supported value is `NFS3`.
 * `dns_ips` - (Optional) - A list of up to 2 IP addresses of DNS servers used to resolve the NFS file system domain name. The provided IP addresses can either be the IP addresses of a DNS forwarder or resolver that the customer manages and runs inside the customer VPC, or the IP addresses of the on-premises DNS servers.
 
 #### Lustre Configuration arguments
 
-The following arguments are supported for `lustre_configuration` configuration block:
+The `lustre_configuration` configuration block supports the following arguments:
 
 * `deployment_type` - (Required) Specifies the cache deployment type. The only supported value is `CACHE_1`.
 * `metadata_configuration` - (Required) The configuration for a Lustre MDT (Metadata Target) storage volume. See the [`metadata_configuration`](#metadata-configuration-arguments) block.
@@ -90,13 +90,13 @@ The following arguments are supported for `lustre_configuration` configuration b
 
 #### Metadata Configuration arguments
 
-The following arguments are supported for `metadata_configuration` configuration block:
+The `metadata_configuration` configuration block supports the following arguments:
 
 * `storage_capacity` - (Required) The storage capacity of the Lustre MDT (Metadata Target) storage volume in gibibytes (GiB). The only supported value is `2400` GiB.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The Amazon Resource Name (ARN) for the resource.
 * `data_repository_association_ids` - A list of IDs of data repository associations that are associated with this cache.
@@ -116,8 +116,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Amazon File Cache cache can be imported using the resource `id`.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Amazon File Cache cache using the resource `id`. For example:
 
+```terraform
+import {
+  to = aws_fsx_file_cache.example
+  id = "fc-8012925589"
+}
 ```
-$ terraform import aws_fsx_file_cache.example fc-8012925589
+
+Using `terraform import`, import Amazon File Cache cache using the resource `id`. For example:
+
+```console
+% terraform import aws_fsx_file_cache.example fc-8012925589
 ```
diff --git a/website/docs/r/fsx_lustre_file_system.html.markdown b/website/docs/r/fsx_lustre_file_system.html.markdown
index 7fd1c6f6a65..420781b0d83 100644
--- a/website/docs/r/fsx_lustre_file_system.html.markdown
+++ b/website/docs/r/fsx_lustre_file_system.html.markdown
@@ -24,7 +24,7 @@ resource "aws_fsx_lustre_file_system" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `storage_capacity` - (Optional) The storage capacity (GiB) of the file system. Minimum of `1200`. See more details at [Allowed values for Fsx storage capacity](https://docs.aws.amazon.com/fsx/latest/APIReference/API_CreateFileSystem.html#FSx-CreateFileSystem-request-StorageCapacity). Update is allowed only for `SCRATCH_2`, `PERSISTENT_1` and `PERSISTENT_2` deployment types, See more details at [Fsx Storage Capacity Update](https://docs.aws.amazon.com/fsx/latest/APIReference/API_UpdateFileSystem.html#FSx-UpdateFileSystem-request-StorageCapacity). Required when not creating filesystem for a backup.
 * `subnet_ids` - (Required) A list of IDs for the subnets that the file system will be accessible from. File systems currently support only one subnet. The file server is also launched in that subnet's Availability Zone.
@@ -59,9 +59,9 @@ The following arguments are supported:
 * `no_squash_nids` - (Optional) When root squash is enabled, you can optionally specify an array of NIDs of clients for which root squash does not apply. A client NID is a Lustre Network Identifier used to uniquely identify a client. You can specify the NID as either a single address or a range of addresses: 1. A single address is described in standard Lustre NID format by specifying the client’s IP address followed by the Lustre network ID (for example, 10.0.1.6@tcp). 2. An address range is described using a dash to separate the range (for example, 10.0.[2-10].[1-255]@tcp).
 * `root_squash` - (Optional) You enable root squash by setting a user ID (UID) and group ID (GID) for the file system in the format UID:GID (for example, 365534:65534). The UID and GID values can range from 0 to 4294967294.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name of the file system.
 * `dns_name` - DNS name for the file system, e.g., `fs-12345678.fsx.us-west-2.amazonaws.com`
@@ -82,13 +82,22 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-FSx File Systems can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import FSx File Systems using the `id`. For example:
 
+```terraform
+import {
+  to = aws_fsx_lustre_file_system.example
+  id = "fs-543ab12b1ca672f33"
+}
 ```
-$ terraform import aws_fsx_lustre_file_system.example fs-543ab12b1ca672f33
+
+Using `terraform import`, import FSx File Systems using the `id`. For example:
+
+```console
+% terraform import aws_fsx_lustre_file_system.example fs-543ab12b1ca672f33
 ```
 
-Certain resource arguments, like `security_group_ids`, do not have a FSx API method for reading the information after creation. If the argument is set in the Terraform configuration on an imported resource, Terraform will always show a difference. To workaround this behavior, either omit the argument from the Terraform configuration or use [`ignore_changes`](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html#ignore_changes) to hide the difference, e.g.,
+Certain resource arguments, like `security_group_ids`, do not have a FSx API method for reading the information after creation. If the argument is set in the Terraform configuration on an imported resource, Terraform will always show a difference. To workaround this behavior, either omit the argument from the Terraform configuration or use [`ignore_changes`](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html#ignore_changes) to hide the difference. For example:
 
 ```terraform
 resource "aws_fsx_lustre_file_system" "example" {
diff --git a/website/docs/r/fsx_ontap_file_system.html.markdown b/website/docs/r/fsx_ontap_file_system.html.markdown
index 2cdcd187c47..c262d366b88 100644
--- a/website/docs/r/fsx_ontap_file_system.html.markdown
+++ b/website/docs/r/fsx_ontap_file_system.html.markdown
@@ -25,7 +25,7 @@ resource "aws_fsx_ontap_file_system" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `storage_capacity` - (Optional) The storage capacity (GiB) of the file system. Valid values between `1024` and `196608`.
 * `subnet_ids` - (Required) A list of IDs for the subnets that the file system will be accessible from. Upto 2 subnets can be provided.
@@ -36,7 +36,7 @@ The following arguments are supported:
 * `kms_key_id` - (Optional) ARN for the KMS Key to encrypt the file system at rest, Defaults to an AWS managed KMS Key.
 * `automatic_backup_retention_days` - (Optional) The number of days to retain automatic backups. Setting this to 0 disables automatic backups. You can retain automatic backups for a maximum of 90 days.
 * `daily_automatic_backup_start_time` - (Optional) A recurring daily time, in the format HH:MM. HH is the zero-padded hour of the day (0-23), and MM is the zero-padded minute of the hour. For example, 05:00 specifies 5 AM daily. Requires `automatic_backup_retention_days` to be set.
-* `disk_iops_configuration` - (Optional) The SSD IOPS configuration for the Amazon FSx for NetApp ONTAP file system. See [Disk Iops Configuration](#disk-iops-configuration) Below.
+* `disk_iops_configuration` - (Optional) The SSD IOPS configuration for the Amazon FSx for NetApp ONTAP file system. See [Disk Iops Configuration](#disk-iops-configuration) below.
 * `endpoint_ip_address_range` - (Optional) Specifies the IP address range in which the endpoints to access your file system will be created. By default, Amazon FSx selects an unused IP address range for you from the 198.19.* range.
 * `storage_type` - (Optional) - The filesystem storage type. defaults to `SSD`.
 * `fsx_admin_password` - (Optional) The ONTAP administrative password for the fsxadmin user that you can use to administer your file system using the ONTAP CLI and REST API.
@@ -49,9 +49,9 @@ The following arguments are supported:
 * `iops` - (Optional) - The total number of SSD IOPS provisioned for the file system.
 * `mode` - (Optional) - Specifies whether the number of IOPS for the file system is using the system. Valid values are `AUTOMATIC` and `USER_PROVISIONED`. Default value is `AUTOMATIC`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name of the file system.
 * `dns_name` - DNS name for the file system, e.g., `fs-12345678.fsx.us-west-2.amazonaws.com`
@@ -82,13 +82,22 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-FSx File Systems can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import FSx File Systems using the `id`. For example:
 
+```terraform
+import {
+  to = aws_fsx_ontap_file_system.example
+  id = "fs-543ab12b1ca672f33"
+}
 ```
-$ terraform import aws_fsx_ontap_file_system.example fs-543ab12b1ca672f33
+
+Using `terraform import`, import FSx File Systems using the `id`. For example:
+
+```console
+% terraform import aws_fsx_ontap_file_system.example fs-543ab12b1ca672f33
 ```
 
-Certain resource arguments, like `security_group_ids`, do not have a FSx API method for reading the information after creation. If the argument is set in the Terraform configuration on an imported resource, Terraform will always show a difference. To workaround this behavior, either omit the argument from the Terraform configuration or use [`ignore_changes`](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html#ignore_changes) to hide the difference, e.g.,
+Certain resource arguments, like `security_group_ids`, do not have a FSx API method for reading the information after creation. If the argument is set in the Terraform configuration on an imported resource, Terraform will always show a difference. To workaround this behavior, either omit the argument from the Terraform configuration or use [`ignore_changes`](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html#ignore_changes) to hide the difference. For example:
 
 ```terraform
 resource "aws_fsx_ontap_file_system" "example" {
diff --git a/website/docs/r/fsx_ontap_storage_virtual_machine.html.markdown b/website/docs/r/fsx_ontap_storage_virtual_machine.html.markdown
index d904168134f..5c7ae45ff16 100644
--- a/website/docs/r/fsx_ontap_storage_virtual_machine.html.markdown
+++ b/website/docs/r/fsx_ontap_storage_virtual_machine.html.markdown
@@ -45,7 +45,7 @@ resource "aws_fsx_ontap_storage_virtual_machine" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `active_directory_configuration` - (Optional) Configuration block that Amazon FSx uses to join the FSx ONTAP Storage Virtual Machine(SVM) to your Microsoft Active Directory (AD) directory. Detailed below.
 * `file_system_id` - (Required) The ID of the Amazon FSx ONTAP File System that this SVM will be created on.
@@ -55,14 +55,14 @@ The following arguments are supported:
 
 ### active_directory_configuration
 
-The following arguments are supported for `active_directory_configuration` configuration block:
+The `active_directory_configuration` configuration block supports the following arguments:
 
 * `netbios_name` - (Required) The NetBIOS name of the Active Directory computer object that will be created for your SVM. This is often the same as the SVM name but can be different. AWS limits to 15 characters because of standard NetBIOS naming limits.
 * `self_managed_active_directory` - (Optional) Configuration block that Amazon FSx uses to join the SVM to your self-managed (including on-premises) Microsoft Active Directory (AD) directory.
 
 ### self_managed_active_directory
 
-The following arguments are supported for `self_managed_active_directory` configuration block:
+The `self_managed_active_directory` configuration block supports the following arguments:
 
 * `dns_ips` - (Required) A list of up to three IP addresses of DNS servers or domain controllers in the self-managed AD directory.
 * `domain_name` - (Required) The fully qualified domain name of the self-managed AD directory. For example, `corp.example.com`.
@@ -71,9 +71,9 @@ The following arguments are supported for `self_managed_active_directory` config
 * `file_system_administrators_group` - (Optional) The name of the domain group whose members are granted administrative privileges for the SVM. The group that you specify must already exist in your domain. Defaults to `Domain Admins`.
 * `organizational_unit_distinguished_name` - (Optional) The fully qualified distinguished name of the organizational unit within your self-managed AD directory that the Windows File Server instance will join. For example, `OU=FSx,DC=yourdomain,DC=corp,DC=com`. Only accepts OU as the direct parent of the SVM. If none is provided, the SVM is created in the default location of your self-managed AD directory. To learn more, see [RFC 2253](https://tools.ietf.org/html/rfc2253).
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name of the storage virtual machine.
 * `endpoints` - The endpoints that are used to access data or to manage the storage virtual machine using the NetApp ONTAP CLI, REST API, or NetApp SnapMirror. See [Endpoints](#endpoints) below.
@@ -104,13 +104,22 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-FSx Storage Virtual Machine can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import FSx Storage Virtual Machine using the `id`. For example:
 
+```terraform
+import {
+  to = aws_fsx_ontap_storage_virtual_machine.example
+  id = "svm-12345678abcdef123"
+}
 ```
-$ terraform import aws_fsx_ontap_storage_virtual_machine.example svm-12345678abcdef123
+
+Using `terraform import`, import FSx Storage Virtual Machine using the `id`. For example:
+
+```console
+% terraform import aws_fsx_ontap_storage_virtual_machine.example svm-12345678abcdef123
 ```
 
-Certain resource arguments, like `svm_admin_password` and the `self_managed_active_directory` configuation block `password`, do not have a FSx API method for reading the information after creation. If these arguments are set in the Terraform configuration on an imported resource, Terraform will always show a difference. To workaround this behavior, either omit the argument from the Terraform configuration or use [`ignore_changes`](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html#ignore_changes) to hide the difference, e.g.,
+Certain resource arguments, like `svm_admin_password` and the `self_managed_active_directory` configuation block `password`, do not have a FSx API method for reading the information after creation. If these arguments are set in the Terraform configuration on an imported resource, Terraform will always show a difference. To workaround this behavior, either omit the argument from the Terraform configuration or use [`ignore_changes`](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html#ignore_changes) to hide the difference. For example:
 
 ```terraform
 resource "aws_fsx_ontap_storage_virtual_machine" "example" {
diff --git a/website/docs/r/fsx_ontap_volume.html.markdown b/website/docs/r/fsx_ontap_volume.html.markdown
index 61410fa873c..ab734089c3a 100644
--- a/website/docs/r/fsx_ontap_volume.html.markdown
+++ b/website/docs/r/fsx_ontap_volume.html.markdown
@@ -46,28 +46,56 @@ resource "aws_fsx_ontap_volume" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The name of the Volume. You can use a maximum of 203 alphanumeric characters, plus the underscore (_) special character.
+* `bypass_snaplock_enterprise_retention` - (Optional) Setting this to `true` allows a SnapLock administrator to delete an FSx for ONTAP SnapLock Enterprise volume with unexpired write once, read many (WORM) files. This configuration must be applied separately before attempting to delete the resource to have the desired behavior. Defaults to `false`.
+* `copy_tags_to_backups` - (Optional) A boolean flag indicating whether tags for the volume should be copied to backups. This value defaults to `false`.
 * `junction_path` - (Optional) Specifies the location in the storage virtual machine's namespace where the volume is mounted. The junction_path must have a leading forward slash, such as `/vol3`
 * `ontap_volume_type` - (Optional) Specifies the type of volume, valid values are `RW`, `DP`. Default value is `RW`. These can be set by the ONTAP CLI or API. This setting is used as part of migration and replication [Migrating to Amazon FSx for NetApp ONTAP](https://docs.aws.amazon.com/fsx/latest/ONTAPGuide/migrating-fsx-ontap.html)
 * `security_style` - (Optional) Specifies the volume security style, Valid values are `UNIX`, `NTFS`, and `MIXED`.
 * `size_in_megabytes` - (Required) Specifies the size of the volume, in megabytes (MB), that you are creating.
 * `skip_final_backup` - (Optional) When enabled, will skip the default final backup taken when the volume is deleted. This configuration must be applied separately before attempting to delete the resource to have the desired behavior. Defaults to `false`.
+* `snaplock_configuration` - (Optional) The SnapLock configuration for an FSx for ONTAP volume. See [SnapLock Configuration](#snaplock-configuration) below.
+* `snapshot_policy` - (Optional) Specifies the snapshot policy for the volume. See [snapshot policies](https://docs.aws.amazon.com/fsx/latest/ONTAPGuide/snapshots-ontap.html#snapshot-policies) in the Amazon FSx ONTAP User Guide
 * `storage_efficiency_enabled` - (Optional) Set to true to enable deduplication, compression, and compaction storage efficiency features on the volume.
 * `storage_virtual_machine_id` - (Required) Specifies the storage virtual machine in which to create the volume.
 * `tags` - (Optional) A map of tags to assign to the volume. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `tiering_policy` - (Optional) The data tiering policy for an FSx for ONTAP volume. See [Tiering Policy](#tiering-policy) below.
 
-### tiering_policy
+### SnapLock Configuration
 
-The following arguments are supported for `tiering_policy` configuration block:
+* `audit_log_volume` - (Optional) Enables or disables the audit log volume for an FSx for ONTAP SnapLock volume. The default value is `false`.
+* `autocommit_period` - (Optional) The configuration object for setting the autocommit period of files in an FSx for ONTAP SnapLock volume. See [Autocommit Period](#autocommit-period) below.
+* `privileged_delete` - (Optional) Enables, disables, or permanently disables privileged delete on an FSx for ONTAP SnapLock Enterprise volume. Valid values: `DISABLED`, `ENABLED`, `PERMANENTLY_DISABLED`. The default value is `DISABLED`.
+* `retention_period` - (Optional) The retention period of an FSx for ONTAP SnapLock volume. See [SnapLock Retention Period](#snaplock-retention-period) below.
+* `snaplock_type` - (Required) Specifies the retention mode of an FSx for ONTAP SnapLock volume. After it is set, it can't be changed. Valid values: `COMPLIANCE`, `ENTERPRISE`.
+* `volume_append_mode_enabled` - (Optional) Enables or disables volume-append mode on an FSx for ONTAP SnapLock volume. The default value is `false`.
+
+### Autocommit Period
+
+* `type` - (Required) The type of time for the autocommit period of a file in an FSx for ONTAP SnapLock volume. Setting this value to `NONE` disables autocommit. Valid values: `MINUTES`, `HOURS`, `DAYS`, `MONTHS`, `YEARS`, `NONE`.
+* `value` - (Optional) The amount of time for the autocommit period of a file in an FSx for ONTAP SnapLock volume.
+
+### SnapLock Retention Period
+
+* `default_retention` - (Required) The retention period assigned to a write once, read many (WORM) file by default if an explicit retention period is not set for an FSx for ONTAP SnapLock volume. The default retention period must be greater than or equal to the minimum retention period and less than or equal to the maximum retention period. See [Retention Period](#retention-period) below.
+* `maximum_retention` - (Required) The longest retention period that can be assigned to a WORM file on an FSx for ONTAP SnapLock volume. See [Retention Period](#retention-period) below.
+* `minimum_retention` - (Required) The shortest retention period that can be assigned to a WORM file on an FSx for ONTAP SnapLock volume. See [Retention Period](#retention-period) below.
+
+### Retention Period
+
+* `type` - (Required) The type of time for the retention period of an FSx for ONTAP SnapLock volume. Set it to one of the valid types. If you set it to `INFINITE`, the files are retained forever. If you set it to `UNSPECIFIED`, the files are retained until you set an explicit retention period. Valid values: `SECONDS`, `MINUTES`, `HOURS`, `DAYS`, `MONTHS`, `YEARS`, `INFINITE`, `UNSPECIFIED`.
+* `value` - (Optional) The amount of time for the autocommit period of a file in an FSx for ONTAP SnapLock volume.
+
+### Tiering Policy
 
 * `name` - (Required) Specifies the tiering policy for the ONTAP volume for moving data to the capacity pool storage. Valid values are `SNAPSHOT_ONLY`, `AUTO`, `ALL`, `NONE`. Default value is `SNAPSHOT_ONLY`.
 * `cooling_period` - (Optional) Specifies the number of days that user data in a volume must remain inactive before it is considered "cold" and moved to the capacity pool. Used with `AUTO` and `SNAPSHOT_ONLY` tiering policies only. Valid values are whole numbers between 2 and 183. Default values are 31 days for `AUTO` and 2 days for `SNAPSHOT_ONLY`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name of the volune.
 * `id` - Identifier of the volume, e.g., `fsvol-12345678`
@@ -87,8 +115,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-FSx ONTAP volume can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import FSx ONTAP volume using the `id`. For example:
 
+```terraform
+import {
+  to = aws_fsx_ontap_volume.example
+  id = "fsvol-12345678abcdef123"
+}
 ```
-$ terraform import aws_fsx_ontap_volume.example fsvol-12345678abcdef123
+
+Using `terraform import`, import FSx ONTAP volume using the `id`. For example:
+
+```console
+% terraform import aws_fsx_ontap_volume.example fsvol-12345678abcdef123
 ```
diff --git a/website/docs/r/fsx_openzfs_file_system.html.markdown b/website/docs/r/fsx_openzfs_file_system.html.markdown
index 09539755c47..2e2dfa8a662 100644
--- a/website/docs/r/fsx_openzfs_file_system.html.markdown
+++ b/website/docs/r/fsx_openzfs_file_system.html.markdown
@@ -24,20 +24,23 @@ resource "aws_fsx_openzfs_file_system" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
-* `deployment_type` - (Required) - The filesystem deployment type. Valid values: `SINGLE_AZ_1` and `SINGLE_AZ_2`.
+* `deployment_type` - (Required) - The filesystem deployment type. Valid values: `SINGLE_AZ_1`, `SINGLE_AZ_2` and `MULTI_AZ_1`.
 * `storage_capacity` - (Required) The storage capacity (GiB) of the file system. Valid values between `64` and `524288`.
-* `subnet_ids` - (Required) A list of IDs for the subnets that the file system will be accessible from. Exactly 1 subnet need to be provided.
+* `subnet_ids` - (Required) A list of IDs for the subnets that the file system will be accessible from.
 * `throughput_capacity` - (Required) Throughput (MB/s) of the file system. Valid values depend on `deployment_type`. Must be one of `64`, `128`, `256`, `512`, `1024`, `2048`, `3072`, `4096` for `SINGLE_AZ_1`. Must be one of `160`, `320`, `640`, `1280`, `2560`, `3840`, `5120`, `7680`, `10240` for `SINGLE_AZ_2`.
 * `automatic_backup_retention_days` - (Optional) The number of days to retain automatic backups. Setting this to 0 disables automatic backups. You can retain automatic backups for a maximum of 90 days.
 * `backup_id` - (Optional) The ID of the source backup to create the filesystem from.
 * `copy_tags_to_backups` - (Optional) A boolean flag indicating whether tags for the file system should be copied to backups. The default value is false.
 * `copy_tags_to_volumes` - (Optional) A boolean flag indicating whether tags for the file system should be copied to snapshots. The default value is false.
 * `daily_automatic_backup_start_time` - (Optional) A recurring daily time, in the format HH:MM. HH is the zero-padded hour of the day (0-23), and MM is the zero-padded minute of the hour. For example, 05:00 specifies 5 AM daily. Requires `automatic_backup_retention_days` to be set.
-* `disk_iops_configuration` - (Optional) The SSD IOPS configuration for the Amazon FSx for OpenZFS file system. See [Disk Iops Configuration](#disk-iops-configuration) Below.
+* `disk_iops_configuration` - (Optional) The SSD IOPS configuration for the Amazon FSx for OpenZFS file system. See [Disk Iops Configuration](#disk-iops-configuration) below.
+* `endpoint_ip_address_range` - (Optional) (Multi-AZ only) Specifies the IP address range in which the endpoints to access your file system will be created.
 * `kms_key_id` - (Optional) ARN for the KMS Key to encrypt the file system at rest, Defaults to an AWS managed KMS Key.
-* `root_volume_configuration` - (Optional) The configuration for the root volume of the file system. All other volumes are children or the root volume. See [Root Volume Configuration](#root-volume-configuration) Below.
+* `preferred_subnet_id` - (Optional) (Multi-AZ only) Required when `deployment_type` is set to `MULTI_AZ_1`. This specifies the subnet in which you want the preferred file server to be located.
+* `root_volume_configuration` - (Optional) The configuration for the root volume of the file system. All other volumes are children or the root volume. See [Root Volume Configuration](#root-volume-configuration) below.
+* `route_table_ids` - (Optional) (Multi-AZ only) Specifies the route tables in which Amazon FSx creates the rules for routing traffic to the correct file server. You should specify all virtual private cloud (VPC) route tables associated with the subnets in which your clients are located. By default, Amazon FSx selects your VPC's default route table.
 * `security_group_ids` - (Optional) A list of IDs for the security groups that apply to the specified network interfaces created for file system access. These security groups will apply to all network interfaces.
 * `storage_type` - (Optional) The filesystem storage type. Only `SSD` is supported.
 * `tags` - (Optional) A map of tags to assign to the file system. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
@@ -72,9 +75,9 @@ The following arguments are supported:
 * `storage_capacity_quota_gib` - (Required) - The amount of storage that the user or group can use in gibibytes (GiB). Valid values between `0` and `2147483647`
 * `type` - (Required) - A value that specifies whether the quota applies to a user or group. Valid values are `USER` or `GROUP`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name of the file system.
 * `dns_name` - DNS name for the file system, e.g., `fs-12345678.fsx.us-west-2.amazonaws.com`
@@ -95,13 +98,22 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-FSx File Systems can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import FSx File Systems using the `id`. For example:
 
+```terraform
+import {
+  to = aws_fsx_openzfs_file_system.example
+  id = "fs-543ab12b1ca672f33"
+}
 ```
-$ terraform import aws_fsx_openzfs_file_system.example fs-543ab12b1ca672f33
+
+Using `terraform import`, import FSx File Systems using the `id`. For example:
+
+```console
+% terraform import aws_fsx_openzfs_file_system.example fs-543ab12b1ca672f33
 ```
 
-Certain resource arguments, like `security_group_ids`, do not have a FSx API method for reading the information after creation. If the argument is set in the Terraform configuration on an imported resource, Terraform will always show a difference. To workaround this behavior, either omit the argument from the Terraform configuration or use [`ignore_changes`](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html#ignore_changes) to hide the difference, e.g.,
+Certain resource arguments, like `security_group_ids`, do not have a FSx API method for reading the information after creation. If the argument is set in the Terraform configuration on an imported resource, Terraform will always show a difference. To workaround this behavior, either omit the argument from the Terraform configuration or use [`ignore_changes`](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html#ignore_changes) to hide the difference. For example:
 
 ```terraform
 resource "aws_fsx_openzfs_file_system" "example" {
diff --git a/website/docs/r/fsx_openzfs_snapshot.html.markdown b/website/docs/r/fsx_openzfs_snapshot.html.markdown
index 18dbd6b8421..7dce56563d8 100644
--- a/website/docs/r/fsx_openzfs_snapshot.html.markdown
+++ b/website/docs/r/fsx_openzfs_snapshot.html.markdown
@@ -52,15 +52,15 @@ resource "aws_fsx_openzfs_file_system" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The name of the Snapshot. You can use a maximum of 203 alphanumeric characters plus either _ or -  or : or . for the name.
 * `tags` - (Optional) A map of tags to assign to the file system. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level. If you have set `copy_tags_to_backups` to true, and you specify one or more tags, no existing file system tags are copied from the file system to the backup.
 * `volume_id` - (Optional) The ID of the volume to snapshot. This can be the root volume or a child volume.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name of the snapshot.
 * `id` - Identifier of the snapshot, e.g., `fsvolsnap-12345678`
@@ -76,8 +76,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-FSx OpenZFS snapshot can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import FSx OpenZFS snapshot using the `id`. For example:
 
+```terraform
+import {
+  to = aws_fsx_openzfs_snapshot.example
+  id = "fs-543ab12b1ca672f33"
+}
 ```
-$ terraform import aws_fsx_openzfs_snapshot.example fs-543ab12b1ca672f33
+
+Using `terraform import`, import FSx OpenZFS snapshot using the `id`. For example:
+
+```console
+% terraform import aws_fsx_openzfs_snapshot.example fs-543ab12b1ca672f33
 ```
diff --git a/website/docs/r/fsx_openzfs_volume.html.markdown b/website/docs/r/fsx_openzfs_volume.html.markdown
index 122575530a3..40b7d4def58 100644
--- a/website/docs/r/fsx_openzfs_volume.html.markdown
+++ b/website/docs/r/fsx_openzfs_volume.html.markdown
@@ -22,13 +22,14 @@ resource "aws_fsx_openzfs_volume" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The name of the Volume. You can use a maximum of 203 alphanumeric characters, plus the underscore (_) special character.
 * `parent_volume_id` - (Required) The volume id of volume that will be the parent volume for the volume being created, this could be the root volume created from the `aws_fsx_openzfs_file_system` resource with the `root_volume_id` or the `id` property of another `aws_fsx_openzfs_volume`.
 * `origin_snapshot` - (Optional) The ARN of the source snapshot to create the volume from.
 * `copy_tags_to_snapshots` - (Optional) A boolean flag indicating whether tags for the file system should be copied to snapshots. The default value is false.
 * `data_compression_type` - (Optional) Method used to compress the data on the volume. Valid values are `NONE` or `ZSTD`. Child volumes that don't specify compression option will inherit from parent volume. This option on file system applies to the root volume.
+* `delete_volume_options` - (Optional) Whether to delete all child volumes and snapshots. Valid values: `DELETE_CHILD_VOLUMES_AND_SNAPSHOTS`. This configuration must be applied separately before attempting to delete the resource to have the desired behavior..
 * `nfs_exports` - (Optional) NFS export configuration for the root volume. Exactly 1 item. See [NFS Exports](#nfs-exports) Below.
 * `read_only` - (Optional) specifies whether the volume is read-only. Default is false.
 * `record_size_kib` - (Optional) The record size of an OpenZFS volume, in kibibytes (KiB). Valid values are `4`, `8`, `16`, `32`, `64`, `128`, `256`, `512`, or `1024` KiB. The default is `128` KiB.
@@ -52,9 +53,9 @@ The following arguments are supported:
 * `storage_capacity_quota_gib` - (Required) - The amount of storage that the user or group can use in gibibytes (GiB). Valid values between `0` and `2147483647`
 * `Type` - (Required) - A value that specifies whether the quota applies to a user or group. Valid values are `USER` or `GROUP`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name of the file system.
 * `id` - Identifier of the file system, e.g., `fsvol-12345678`
@@ -70,8 +71,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-FSx Volumes can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import FSx Volumes using the `id`. For example:
 
+```terraform
+import {
+  to = aws_fsx_openzfs_volume.example
+  id = "fsvol-543ab12b1ca672f33"
+}
 ```
-$ terraform import aws_fsx_openzfs_volume.example fsvol-543ab12b1ca672f33
+
+Using `terraform import`, import FSx Volumes using the `id`. For example:
+
+```console
+% terraform import aws_fsx_openzfs_volume.example fsvol-543ab12b1ca672f33
 ```
diff --git a/website/docs/r/fsx_windows_file_system.html.markdown b/website/docs/r/fsx_windows_file_system.html.markdown
index b0cfabf6a63..d8ad576f02d 100644
--- a/website/docs/r/fsx_windows_file_system.html.markdown
+++ b/website/docs/r/fsx_windows_file_system.html.markdown
@@ -59,25 +59,31 @@ The following arguments are optional:
 
 * `active_directory_id` - (Optional) The ID for an existing Microsoft Active Directory instance that the file system should join when it's created. Cannot be specified with `self_managed_active_directory`.
 * `aliases` - (Optional) An array DNS alias names that you want to associate with the Amazon FSx file system.  For more information, see [Working with DNS Aliases](https://docs.aws.amazon.com/fsx/latest/WindowsGuide/managing-dns-aliases.html)
-* `audit_log_configuration` - (Optional) The configuration that Amazon FSx for Windows File Server uses to audit and log user accesses of files, folders, and file shares on the Amazon FSx for Windows File Server file system. See below.
+* `audit_log_configuration` - (Optional) The configuration that Amazon FSx for Windows File Server uses to audit and log user accesses of files, folders, and file shares on the Amazon FSx for Windows File Server file system. See [Audit Log Configuration](#audit-log-configuration) below.
 * `automatic_backup_retention_days` - (Optional) The number of days to retain automatic backups. Minimum of `0` and maximum of `90`. Defaults to `7`. Set to `0` to disable.
 * `backup_id` - (Optional) The ID of the source backup to create the filesystem from.
 * `copy_tags_to_backups` - (Optional) A boolean flag indicating whether tags on the file system should be copied to backups. Defaults to `false`.
 * `daily_automatic_backup_start_time` - (Optional) The preferred time (in `HH:MM` format) to take daily automatic backups, in the UTC time zone.
 * `deployment_type` - (Optional) Specifies the file system deployment type, valid values are `MULTI_AZ_1`, `SINGLE_AZ_1` and `SINGLE_AZ_2`. Default value is `SINGLE_AZ_1`.
+* `disk_iops_configuration` - (Optional) The SSD IOPS configuration for the Amazon FSx for Windows File Server file system. See [Disk Iops Configuration](#disk-iops-configuration) below.
 * `kms_key_id` - (Optional) ARN for the KMS Key to encrypt the file system at rest. Defaults to an AWS managed KMS Key.
 * `preferred_subnet_id` - (Optional) Specifies the subnet in which you want the preferred file server to be located. Required for when deployment type is `MULTI_AZ_1`.
 * `security_group_ids` - (Optional) A list of IDs for the security groups that apply to the specified network interfaces created for file system access. These security groups will apply to all network interfaces.
-* `self_managed_active_directory` - (Optional) Configuration block that Amazon FSx uses to join the Windows File Server instance to your self-managed (including on-premises) Microsoft Active Directory (AD) directory. Cannot be specified with `active_directory_id`. Detailed below.
+* `self_managed_active_directory` - (Optional) Configuration block that Amazon FSx uses to join the Windows File Server instance to your self-managed (including on-premises) Microsoft Active Directory (AD) directory. Cannot be specified with `active_directory_id`. See [Self-Managed Active Directory](#self-managed-active-directory) below.
 * `skip_final_backup` - (Optional) When enabled, will skip the default final backup taken when the file system is deleted. This configuration must be applied separately before attempting to delete the resource to have the desired behavior. Defaults to `false`.
 * `tags` - (Optional) A map of tags to assign to the file system. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 * `storage_capacity` - (Optional) Storage capacity (GiB) of the file system. Minimum of 32 and maximum of 65536. If the storage type is set to `HDD` the minimum value is 2000. Required when not creating filesystem for a backup.
 * `storage_type` - (Optional) Specifies the storage type, Valid values are `SSD` and `HDD`. `HDD` is supported on `SINGLE_AZ_2` and `MULTI_AZ_1` Windows file system deployment types. Default value is `SSD`.
 * `weekly_maintenance_start_time` - (Optional) The preferred start time (in `d:HH:MM` format) to perform weekly maintenance, in the UTC time zone.
 
-### self_managed_active_directory
+### Disk Iops Configuration
 
-The following arguments are supported for `self_managed_active_directory` configuration block:
+* `iops` - (Optional) - The total number of SSD IOPS provisioned for the file system.
+* `mode` - (Optional) - Specifies whether the number of IOPS for the file system is using the system. Valid values are `AUTOMATIC` and `USER_PROVISIONED`. Default value is `AUTOMATIC`.
+
+### Self-Managed Active Directory
+
+The `self_managed_active_directory` configuration block supports the following arguments:
 
 * `dns_ips` - (Required) A list of up to two IP addresses of DNS servers or domain controllers in the self-managed AD directory. The IP addresses need to be either in the same VPC CIDR range as the file system or in the private IP version 4 (IPv4) address ranges as specified in [RFC 1918](https://tools.ietf.org/html/rfc1918).
 * `domain_name` - (Required) The fully qualified domain name of the self-managed AD directory. For example, `corp.example.com`.
@@ -86,15 +92,15 @@ The following arguments are supported for `self_managed_active_directory` config
 * `file_system_administrators_group` - (Optional) The name of the domain group whose members are granted administrative privileges for the file system. Administrative privileges include taking ownership of files and folders, and setting audit controls (audit ACLs) on files and folders. The group that you specify must already exist in your domain. Defaults to `Domain Admins`.
 * `organizational_unit_distinguished_name` - (Optional) The fully qualified distinguished name of the organizational unit within your self-managed AD directory that the Windows File Server instance will join. For example, `OU=FSx,DC=yourdomain,DC=corp,DC=com`. Only accepts OU as the direct parent of the file system. If none is provided, the FSx file system is created in the default location of your self-managed AD directory. To learn more, see [RFC 2253](https://tools.ietf.org/html/rfc2253).
 
-### audit_log_configuration
+### Audit Log Configuration
 
 * `audit_log_destination` - (Optional) The Amazon Resource Name (ARN) for the destination of the audit logs. The destination can be any Amazon CloudWatch Logs log group ARN or Amazon Kinesis Data Firehose delivery stream ARN. Can be specified when `file_access_audit_log_level` and `file_share_access_audit_log_level` are not set to `DISABLED`. The name of the Amazon CloudWatch Logs log group must begin with the `/aws/fsx` prefix. The name of the Amazon Kinesis Data Firehouse delivery stream must begin with the `aws-fsx` prefix. If you do not provide a destination in `audit_log_destionation`, Amazon FSx will create and use a log stream in the CloudWatch Logs /aws/fsx/windows log group.
 * `file_access_audit_log_level` - (Optional) Sets which attempt type is logged by Amazon FSx for file and folder accesses. Valid values are `SUCCESS_ONLY`, `FAILURE_ONLY`, `SUCCESS_AND_FAILURE`, and `DISABLED`. Default value is `DISABLED`.
 * `file_share_access_audit_log_level` - (Optional) Sets which attempt type is logged by Amazon FSx for file share accesses. Valid values are `SUCCESS_ONLY`, `FAILURE_ONLY`, `SUCCESS_AND_FAILURE`, and `DISABLED`. Default value is `DISABLED`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name of the file system.
 * `dns_name` - DNS name for the file system, e.g., `fs-12345678.corp.example.com` (domain name matching the Active Directory domain name)
@@ -116,13 +122,22 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-FSx File Systems can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import FSx File Systems using the `id`. For example:
 
+```terraform
+import {
+  to = aws_fsx_windows_file_system.example
+  id = "fs-543ab12b1ca672f33"
+}
 ```
-$ terraform import aws_fsx_windows_file_system.example fs-543ab12b1ca672f33
+
+Using `terraform import`, import FSx File Systems using the `id`. For example:
+
+```console
+% terraform import aws_fsx_windows_file_system.example fs-543ab12b1ca672f33
 ```
 
-Certain resource arguments, like `security_group_ids` and the `self_managed_active_directory` configuation block `password`, do not have a FSx API method for reading the information after creation. If these arguments are set in the Terraform configuration on an imported resource, Terraform will always show a difference. To workaround this behavior, either omit the argument from the Terraform configuration or use [`ignore_changes`](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html#ignore_changes) to hide the difference, e.g.,
+Certain resource arguments, like `security_group_ids` and the `self_managed_active_directory` configuation block `password`, do not have a FSx API method for reading the information after creation. If these arguments are set in the Terraform configuration on an imported resource, Terraform will always show a difference. To workaround this behavior, either omit the argument from the Terraform configuration or use [`ignore_changes`](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html#ignore_changes) to hide the difference. For example:
 
 ```terraform
 resource "aws_fsx_windows_file_system" "example" {
diff --git a/website/docs/r/gamelift_alias.html.markdown b/website/docs/r/gamelift_alias.html.markdown
index 3063206dfa1..53f253fdea9 100644
--- a/website/docs/r/gamelift_alias.html.markdown
+++ b/website/docs/r/gamelift_alias.html.markdown
@@ -26,7 +26,7 @@ resource "aws_gamelift_alias" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) Name of the alias.
 * `description` - (Optional) Description of the alias.
@@ -41,9 +41,9 @@ The following arguments are supported:
 * `message` - (Optional) Message text to be used with the `TERMINAL` routing strategy.
 * `type` - (Required) Type of routing strategyE.g., `SIMPLE` or `TERMINAL`
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Alias ID.
 * `arn` - Alias ARN.
@@ -51,8 +51,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-GameLift Aliases can be imported using the ID, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import GameLift Aliases using the ID. For example:
 
+```terraform
+import {
+  to = aws_gamelift_alias.example
+  id = "<alias-id>"
+}
 ```
-$ terraform import aws_gamelift_alias.example <alias-id>
+
+Using `terraform import`, import GameLift Aliases using the ID. For example:
+
+```console
+% terraform import aws_gamelift_alias.example <alias-id>
 ```
diff --git a/website/docs/r/gamelift_build.html.markdown b/website/docs/r/gamelift_build.html.markdown
index fbcdedbc82a..793455946b8 100644
--- a/website/docs/r/gamelift_build.html.markdown
+++ b/website/docs/r/gamelift_build.html.markdown
@@ -27,7 +27,7 @@ resource "aws_gamelift_build" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) Name of the build
 * `operating_system` - (Required) Operating system that the game server binaries are built to run onE.g., `WINDOWS_2012`, `AMAZON_LINUX` or `AMAZON_LINUX_2`.
@@ -44,9 +44,9 @@ The following arguments are supported:
 * `role_arn` - (Required) ARN of the access role that allows Amazon GameLift to access your S3 bucket.
 * `object_version` - (Optional) A specific version of the file. If not set, the latest version of the file is retrieved.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - GameLift Build ID.
 * `arn` - GameLift Build ARN.
@@ -54,8 +54,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-GameLift Builds can be imported using the ID, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import GameLift Builds using the ID. For example:
 
+```terraform
+import {
+  to = aws_gamelift_build.example
+  id = "<build-id>"
+}
 ```
-$ terraform import aws_gamelift_build.example <build-id>
+
+Using `terraform import`, import GameLift Builds using the ID. For example:
+
+```console
+% terraform import aws_gamelift_build.example <build-id>
 ```
diff --git a/website/docs/r/gamelift_fleet.html.markdown b/website/docs/r/gamelift_fleet.html.markdown
index aa5a6ba90ea..c40f602557a 100644
--- a/website/docs/r/gamelift_fleet.html.markdown
+++ b/website/docs/r/gamelift_fleet.html.markdown
@@ -30,7 +30,7 @@ resource "aws_gamelift_fleet" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `build_id` - (Optional) ID of the GameLift Build to be deployed on the fleet.
 * `certificate_configuration` - (Optional) Prompts GameLift to generate a TLS/SSL certificate for the fleet. See [certificate_configuration](#certificate_configuration).
@@ -77,9 +77,9 @@ The following arguments are supported:
 * `launch_path` - (Required) Location of the server executable in a game build. All game builds are installed on instances at the root : for Windows instances `C:\game`, and for Linux instances `/local/game`.
 * `parameters` - (Optional) Optional list of parameters to pass to the server executable on launch.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Fleet ID.
 * `arn` - Fleet ARN.
@@ -97,8 +97,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-GameLift Fleets can be imported using the ID, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import GameLift Fleets using the ID. For example:
 
+```terraform
+import {
+  to = aws_gamelift_fleet.example
+  id = "<fleet-id>"
+}
 ```
-$ terraform import aws_gamelift_fleet.example <fleet-id>
+
+Using `terraform import`, import GameLift Fleets using the ID. For example:
+
+```console
+% terraform import aws_gamelift_fleet.example <fleet-id>
 ```
diff --git a/website/docs/r/gamelift_game_server_group.html.markdown b/website/docs/r/gamelift_game_server_group.html.markdown
new file mode 100644
index 00000000000..657a480b82f
--- /dev/null
+++ b/website/docs/r/gamelift_game_server_group.html.markdown
@@ -0,0 +1,215 @@
+---
+subcategory: "GameLift"
+layout: "aws"
+page_title: "AWS: aws_gamelift_game_server_group"
+description: |-
+  Provides a GameLift Game Server Group resource.
+---
+
+# Resource: aws_gamelift_game_server_group
+
+Provides an GameLift Game Server Group resource.
+
+## Example Usage
+
+```terraform
+resource "aws_gamelift_game_server_group" "example" {
+  game_server_group_name = "example"
+
+  instance_definition {
+    instance_type = "c5.large"
+  }
+
+  instance_definition {
+    instance_type = "c5a.large"
+  }
+
+  launch_template {
+    id = aws_launch_template.example.id
+  }
+
+  max_size = 1
+  min_size = 1
+  role_arn = aws_iam_role.example.arn
+
+  depends_on = [
+    aws_iam_role_policy_attachment.example
+  ]
+}
+```
+
+Full usage:
+
+```terraform
+resource "aws_gamelift_game_server_group" "example" {
+  auto_scaling_policy {
+    estimated_instance_warmup = 60
+    target_tracking_configuration {
+      target_value = 75
+    }
+  }
+
+  balancing_strategy            = "SPOT_ONLY"
+  game_server_group_name        = "example"
+  game_server_protection_policy = "FULL_PROTECTION"
+
+  instance_definition {
+    instance_type     = "c5.large"
+    weighted_capacity = "1"
+  }
+
+  instance_definition {
+    instance_type     = "c5.2xlarge"
+    weighted_capacity = "2"
+  }
+
+  launch_template {
+    id      = aws_launch_template.example.id
+    version = "1"
+  }
+
+  max_size = 1
+  min_size = 1
+  role_arn = aws_iam_role.example.arn
+
+  tags = {
+    Name = "example"
+  }
+
+  vpc_subnets = [
+    "subnet-12345678",
+    "subnet-23456789"
+  ]
+
+  depends_on = [
+    aws_iam_role_policy_attachment.example
+  ]
+}
+```
+
+### Example IAM Role for GameLift Game Server Group
+
+```terraform
+data "aws_partition" "current" {}
+
+data "aws_iam_policy_document" "assume_role" {
+  statement {
+    effect = "Allow"
+
+    principals {
+      type = "Service"
+
+      identifiers = [
+        "autoscaling.amazonaws.com",
+        "gamelift.amazonaws.com",
+      ]
+    }
+
+    actions = ["sts:AssumeRole"]
+  }
+}
+
+resource "aws_iam_role" "example" {
+  assume_role_policy = data.aws_iam_policy_document.assume_role.json
+  name               = "gamelift-game-server-group-example"
+}
+
+resource "aws_iam_role_policy_attachment" "example" {
+  policy_arn = "arn:${data.aws_partition.current.partition}:iam::aws:policy/GameLiftGameServerGroupPolicy"
+  role       = aws_iam_role.example.name
+}
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `balancing_strategy` - (Optional) Indicates how GameLift FleetIQ balances the use of Spot Instances and On-Demand Instances.
+  Valid values: `SPOT_ONLY`, `SPOT_PREFERRED`, `ON_DEMAND_ONLY`. Defaults to `SPOT_PREFERRED`.
+* `game_server_group_name` - (Required) Name of the game server group.
+  This value is used to generate unique ARN identifiers for the EC2 Auto Scaling group and the GameLift FleetIQ game server group.
+* `game_server_protection_policy` - (Optional) Indicates whether instances in the game server group are protected from early termination.
+  Unprotected instances that have active game servers running might be terminated during a scale-down event,
+  causing players to be dropped from the game.
+  Protected instances cannot be terminated while there are active game servers running except in the event
+  of a forced game server group deletion.
+  Valid values: `NO_PROTECTION`, `FULL_PROTECTION`. Defaults to `NO_PROTECTION`.
+* `max_size` - (Required) The maximum number of instances allowed in the EC2 Auto Scaling group.
+  During automatic scaling events, GameLift FleetIQ and EC2 do not scale up the group above this maximum.
+* `min_size` - (Required) The minimum number of instances allowed in the EC2 Auto Scaling group.
+  During automatic scaling events, GameLift FleetIQ and EC2 do not scale down the group below this minimum.
+* `role_arn` - (Required) ARN for an IAM role that allows Amazon GameLift to access your EC2 Auto Scaling groups.
+* `tags` - (Optional) Key-value map of resource tags
+* `vpc_subnets` - (Optional) A list of VPC subnets to use with instances in the game server group.
+  By default, all GameLift FleetIQ-supported Availability Zones are used.
+
+### `auto_scaling_policy`
+
+Configuration settings to define a scaling policy for the Auto Scaling group that is optimized for game hosting.
+The scaling policy uses the metric `PercentUtilizedGameServers` to maintain a buffer of idle game servers that
+can immediately accommodate new games and players.
+
+* `estimated_instance_warmup` - (Optional) Length of time, in seconds, it takes for a new instance to start
+  new game server processes and register with GameLift FleetIQ.
+  Specifying a warm-up time can be useful, particularly with game servers that take a long time to start up,
+  because it avoids prematurely starting new instances. Defaults to `60`.
+
+#### `target_tracking_configuration`
+
+Settings for a target-based scaling policy applied to Auto Scaling group.
+These settings are used to create a target-based policy that tracks the GameLift FleetIQ metric `PercentUtilizedGameServers`
+and specifies a target value for the metric.
+
+* `target_value` - (Required) Desired value to use with a game server group target-based scaling policy.
+
+### `instance_definition`
+
+The EC2 instance types and sizes to use in the Auto Scaling group.
+The instance definitions must specify at least two different instance types that are supported by GameLift FleetIQ.
+
+* `instance_type` - (Required) An EC2 instance type.
+* `weighted_capacity` - (Optional) Instance weighting that indicates how much this instance type contributes
+  to the total capacity of a game server group.
+  Instance weights are used by GameLift FleetIQ to calculate the instance type's cost per unit hour and better identify
+  the most cost-effective options.
+
+### `launch_template`
+
+The EC2 launch template that contains configuration settings and game server code to be deployed to all instances in the game server group.
+You can specify the template using either the template name or ID.
+
+* `id` - (Optional) A unique identifier for an existing EC2 launch template.
+* `name` - (Optional) A readable identifier for an existing EC2 launch template.
+* `version` - (Optional) The version of the EC2 launch template to use. If none is set, the default is the first version created.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name of the GameLift Game Server Group.
+* `arn` - The ARN of the GameLift Game Server Group.
+* `auto_scaling_group_arn` - The ARN of the created EC2 Auto Scaling group.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `10m`)
+* `delete` - (Default `30m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import GameLift Game Server Group using the `name`. For example:
+
+```terraform
+import {
+  to = aws_gamelift_game_server_group.example
+  id = "example"
+}
+```
+
+Using `terraform import`, import GameLift Game Server Group using the `name`. For example:
+
+```console
+% terraform import aws_gamelift_game_server_group.example example
+```
diff --git a/website/docs/r/gamelift_game_server_group.markdown b/website/docs/r/gamelift_game_server_group.markdown
deleted file mode 100644
index 740da5ffe2b..00000000000
--- a/website/docs/r/gamelift_game_server_group.markdown
+++ /dev/null
@@ -1,206 +0,0 @@
----
-subcategory: "GameLift"
-layout: "aws"
-page_title: "AWS: aws_gamelift_game_server_group"
-description: |-
-  Provides a GameLift Game Server Group resource.
----
-
-# Resource: aws_gamelift_game_server_group
-
-Provides an GameLift Game Server Group resource.
-
-## Example Usage
-
-```terraform
-resource "aws_gamelift_game_server_group" "example" {
-  game_server_group_name = "example"
-
-  instance_definition {
-    instance_type = "c5.large"
-  }
-
-  instance_definition {
-    instance_type = "c5a.large"
-  }
-
-  launch_template {
-    id = aws_launch_template.example.id
-  }
-
-  max_size = 1
-  min_size = 1
-  role_arn = aws_iam_role.example.arn
-
-  depends_on = [
-    aws_iam_role_policy_attachment.example
-  ]
-}
-```
-
-Full usage:
-
-```terraform
-resource "aws_gamelift_game_server_group" "example" {
-  auto_scaling_policy {
-    estimated_instance_warmup = 60
-    target_tracking_configuration {
-      target_value = 75
-    }
-  }
-
-  balancing_strategy            = "SPOT_ONLY"
-  game_server_group_name        = "example"
-  game_server_protection_policy = "FULL_PROTECTION"
-
-  instance_definition {
-    instance_type     = "c5.large"
-    weighted_capacity = "1"
-  }
-
-  instance_definition {
-    instance_type     = "c5.2xlarge"
-    weighted_capacity = "2"
-  }
-
-  launch_template {
-    id      = aws_launch_template.example.id
-    version = "1"
-  }
-
-  max_size = 1
-  min_size = 1
-  role_arn = aws_iam_role.example.arn
-
-  tags = {
-    Name = "example"
-  }
-
-  vpc_subnets = [
-    "subnet-12345678",
-    "subnet-23456789"
-  ]
-
-  depends_on = [
-    aws_iam_role_policy_attachment.example
-  ]
-}
-```
-
-### Example IAM Role for GameLift Game Server Group
-
-```terraform
-data "aws_partition" "current" {}
-
-data "aws_iam_policy_document" "assume_role" {
-  statement {
-    effect = "Allow"
-
-    principals {
-      type = "Service"
-
-      identifiers = [
-        "autoscaling.amazonaws.com",
-        "gamelift.amazonaws.com",
-      ]
-    }
-
-    actions = ["sts:AssumeRole"]
-  }
-}
-
-resource "aws_iam_role" "example" {
-  assume_role_policy = data.aws_iam_policy_document.assume_role.json
-  name               = "gamelift-game-server-group-example"
-}
-
-resource "aws_iam_role_policy_attachment" "example" {
-  policy_arn = "arn:${data.aws_partition.current.partition}:iam::aws:policy/GameLiftGameServerGroupPolicy"
-  role       = aws_iam_role.example.name
-}
-```
-
-## Argument Reference
-
-The following arguments are supported:
-
-* `balancing_strategy` - (Optional) Indicates how GameLift FleetIQ balances the use of Spot Instances and On-Demand Instances.
-  Valid values: `SPOT_ONLY`, `SPOT_PREFERRED`, `ON_DEMAND_ONLY`. Defaults to `SPOT_PREFERRED`.
-* `game_server_group_name` - (Required) Name of the game server group.
-  This value is used to generate unique ARN identifiers for the EC2 Auto Scaling group and the GameLift FleetIQ game server group.
-* `game_server_protection_policy` - (Optional) Indicates whether instances in the game server group are protected from early termination.
-  Unprotected instances that have active game servers running might be terminated during a scale-down event,
-  causing players to be dropped from the game.
-  Protected instances cannot be terminated while there are active game servers running except in the event
-  of a forced game server group deletion.
-  Valid values: `NO_PROTECTION`, `FULL_PROTECTION`. Defaults to `NO_PROTECTION`.
-* `max_size` - (Required) The maximum number of instances allowed in the EC2 Auto Scaling group.
-  During automatic scaling events, GameLift FleetIQ and EC2 do not scale up the group above this maximum.
-* `min_size` - (Required) The minimum number of instances allowed in the EC2 Auto Scaling group.
-  During automatic scaling events, GameLift FleetIQ and EC2 do not scale down the group below this minimum.
-* `role_arn` - (Required) ARN for an IAM role that allows Amazon GameLift to access your EC2 Auto Scaling groups.
-* `tags` - (Optional) Key-value map of resource tags
-* `vpc_subnets` - (Optional) A list of VPC subnets to use with instances in the game server group.
-  By default, all GameLift FleetIQ-supported Availability Zones are used.
-
-### `auto_scaling_policy`
-
-Configuration settings to define a scaling policy for the Auto Scaling group that is optimized for game hosting.
-The scaling policy uses the metric `PercentUtilizedGameServers` to maintain a buffer of idle game servers that
-can immediately accommodate new games and players.
-
-* `estimated_instance_warmup` - (Optional) Length of time, in seconds, it takes for a new instance to start
-  new game server processes and register with GameLift FleetIQ.
-  Specifying a warm-up time can be useful, particularly with game servers that take a long time to start up,
-  because it avoids prematurely starting new instances. Defaults to `60`.
-
-#### `target_tracking_configuration`
-
-Settings for a target-based scaling policy applied to Auto Scaling group.
-These settings are used to create a target-based policy that tracks the GameLift FleetIQ metric `PercentUtilizedGameServers`
-and specifies a target value for the metric.
-
-* `target_value` - (Required) Desired value to use with a game server group target-based scaling policy.
-
-### `instance_definition`
-
-The EC2 instance types and sizes to use in the Auto Scaling group.
-The instance definitions must specify at least two different instance types that are supported by GameLift FleetIQ.
-
-* `instance_type` - (Required) An EC2 instance type.
-* `weighted_capacity` - (Optional) Instance weighting that indicates how much this instance type contributes
-  to the total capacity of a game server group.
-  Instance weights are used by GameLift FleetIQ to calculate the instance type's cost per unit hour and better identify
-  the most cost-effective options.
-
-### `launch_template`
-
-The EC2 launch template that contains configuration settings and game server code to be deployed to all instances in the game server group.
-You can specify the template using either the template name or ID.
-
-* `id` - (Optional) A unique identifier for an existing EC2 launch template.
-* `name` - (Optional) A readable identifier for an existing EC2 launch template.
-* `version` - (Optional) The version of the EC2 launch template to use. If none is set, the default is the first version created.
-
-## Attributes Reference
-
-In addition to all arguments above, the following attributes are exported:
-
-* `id` - The name of the GameLift Game Server Group.
-* `arn` - The ARN of the GameLift Game Server Group.
-* `auto_scaling_group_arn` - The ARN of the created EC2 Auto Scaling group.
-
-## Timeouts
-
-[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
-
-* `create` - (Default `10m`)
-* `delete` - (Default `30m`)
-
-## Import
-
-GameLift Game Server Group can be imported using the `name`, e.g.
-
-```
-$ terraform import aws_gamelift_game_server_group.example example
-```
diff --git a/website/docs/r/gamelift_game_session_queue.html.markdown b/website/docs/r/gamelift_game_session_queue.html.markdown
index 2e7b215a56e..21fd36f43a2 100644
--- a/website/docs/r/gamelift_game_session_queue.html.markdown
+++ b/website/docs/r/gamelift_game_session_queue.html.markdown
@@ -38,7 +38,7 @@ resource "aws_gamelift_game_session_queue" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) Name of the session queue.
 * `timeout_in_seconds` - (Required) Maximum time a game session request can remain in the queue.
@@ -55,17 +55,26 @@ The following arguments are supported:
 * `maximum_individual_player_latency_milliseconds` - (Required) Maximum latency value that is allowed for any player.
 * `policy_duration_seconds` - (Optional) Length of time that the policy is enforced while placing a new game session. Absence of value for this attribute means that the policy is enforced until the queue times out.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Game Session Queue ARN.
 * `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
 
 ## Import
 
-GameLift Game Session Queues can be imported by their `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import GameLift Game Session Queues using their `name`. For example:
 
+```terraform
+import {
+  to = aws_gamelift_game_session_queue.example
+  id = "example"
+}
 ```
-$ terraform import aws_gamelift_game_session_queue.example example
+
+Using `terraform import`, import GameLift Game Session Queues using their `name`. For example:
+
+```console
+% terraform import aws_gamelift_game_session_queue.example example
 ```
diff --git a/website/docs/r/gamelift_script.html.markdown b/website/docs/r/gamelift_script.html.markdown
index 31e36cb3e32..e0c2f39fc55 100644
--- a/website/docs/r/gamelift_script.html.markdown
+++ b/website/docs/r/gamelift_script.html.markdown
@@ -26,7 +26,7 @@ resource "aws_gamelift_script" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) Name of the script
 * `storage_location` - (Optional) Information indicating where your game script files are stored. See below.
@@ -43,9 +43,9 @@ The following arguments are supported:
 * `role_arn` - (Required) ARN of the access role that allows Amazon GameLift to access your S3 bucket.
 * `object_version` - (Optional) A specific version of the file. If not set, the latest version of the file is retrieved.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - GameLift Script ID.
 * `arn` - GameLift Script ARN.
@@ -53,8 +53,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-GameLift Scripts can be imported using the ID, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import GameLift Scripts using the ID. For example:
 
+```terraform
+import {
+  to = aws_gamelift_script.example
+  id = "<script-id>"
+}
 ```
-$ terraform import aws_gamelift_script.example <script-id>
+
+Using `terraform import`, import GameLift Scripts using the ID. For example:
+
+```console
+% terraform import aws_gamelift_script.example <script-id>
 ```
diff --git a/website/docs/r/glacier_vault.html.markdown b/website/docs/r/glacier_vault.html.markdown
index 2d52c5d34fc..6bf9921eac6 100644
--- a/website/docs/r/glacier_vault.html.markdown
+++ b/website/docs/r/glacier_vault.html.markdown
@@ -56,7 +56,7 @@ resource "aws_glacier_vault" "my_archive" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The name of the Vault. Names can be between 1 and 255 characters long and the valid characters are a-z, A-Z, 0-9, '_' (underscore), '-' (hyphen), and '.' (period).
 * `access_policy` - (Optional) The policy document. This is a JSON formatted string.
@@ -69,9 +69,9 @@ The following arguments are supported:
 * `events` - (Required) You can configure a vault to publish a notification for `ArchiveRetrievalCompleted` and `InventoryRetrievalCompleted` events.
 * `sns_topic` - (Required) The SNS Topic ARN.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `location` - The URI of the vault that was created.
 * `arn` - The ARN of the vault.
@@ -79,8 +79,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Glacier Vaults can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Glacier Vaults using the `name`. For example:
 
+```terraform
+import {
+  to = aws_glacier_vault.archive
+  id = "my_archive"
+}
 ```
-$ terraform import aws_glacier_vault.archive my_archive
+
+Using `terraform import`, import Glacier Vaults using the `name`. For example:
+
+```console
+% terraform import aws_glacier_vault.archive my_archive
 ```
diff --git a/website/docs/r/glacier_vault_lock.html.markdown b/website/docs/r/glacier_vault_lock.html.markdown
index 6a3eac3e7e5..8d355d24da5 100644
--- a/website/docs/r/glacier_vault_lock.html.markdown
+++ b/website/docs/r/glacier_vault_lock.html.markdown
@@ -56,23 +56,32 @@ resource "aws_glacier_vault_lock" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `complete_lock` - (Required) Boolean whether to permanently apply this Glacier Lock Policy. Once completed, this cannot be undone. If set to `false`, the Glacier Lock Policy remains in a testing mode for 24 hours. After that time, the Glacier Lock Policy is automatically removed by Glacier and the Terraform resource will show as needing recreation. Changing this from `false` to `true` will show as resource recreation, which is expected. Changing this from `true` to `false` is not possible unless the Glacier Vault is recreated at the same time.
 * `policy` - (Required) JSON string containing the IAM policy to apply as the Glacier Vault Lock policy.
 * `vault_name` - (Required) The name of the Glacier Vault.
 * `ignore_deletion_error` - (Optional) Allow Terraform to ignore the error returned when attempting to delete the Glacier Lock Policy. This can be used to delete or recreate the Glacier Vault via Terraform, for example, if the Glacier Vault Lock policy permits that action. This should only be used in conjunction with `complete_lock` being set to `true`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Glacier Vault name.
 
 ## Import
 
-Glacier Vault Locks can be imported using the Glacier Vault name, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Glacier Vault Locks using the Glacier Vault name. For example:
 
+```terraform
+import {
+  to = aws_glacier_vault_lock.example
+  id = "example-vault"
+}
 ```
-$ terraform import aws_glacier_vault_lock.example example-vault
+
+Using `terraform import`, import Glacier Vault Locks using the Glacier Vault name. For example:
+
+```console
+% terraform import aws_glacier_vault_lock.example example-vault
 ```
diff --git a/website/docs/r/globalaccelerator_accelerator.html.markdown b/website/docs/r/globalaccelerator_accelerator.html.markdown
index ec68eb0cd8e..5ed4ba467fd 100644
--- a/website/docs/r/globalaccelerator_accelerator.html.markdown
+++ b/website/docs/r/globalaccelerator_accelerator.html.markdown
@@ -29,7 +29,7 @@ resource "aws_globalaccelerator_accelerator" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The name of the accelerator.
 * `ip_address_type` - (Optional) The value for the address type. Defaults to `IPV4`. Valid values: `IPV4`, `DUAL_STACK`.
@@ -38,15 +38,15 @@ The following arguments are supported:
 * `attributes` - (Optional) The attributes of the accelerator. Fields documented below.
 * `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-**attributes** supports the following attributes:
+`attributes` supports the following arguments:
 
 * `flow_logs_enabled` - (Optional) Indicates whether flow logs are enabled. Defaults to `false`. Valid values: `true`, `false`.
 * `flow_logs_s3_bucket` - (Optional) The name of the Amazon S3 bucket for the flow logs. Required if `flow_logs_enabled` is `true`.
 * `flow_logs_s3_prefix` - (Optional) The prefix for the location in the Amazon S3 bucket for the flow logs. Required if `flow_logs_enabled` is `true`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The Amazon Resource Name (ARN) of the accelerator.
 * `dns_name` - The DNS name of the accelerator. For example, `a5d53ff5ee6bca4ce.awsglobalaccelerator.com`.
@@ -73,8 +73,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Global Accelerator accelerators can be imported using the `arn`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Global Accelerator accelerators using the `arn`. For example:
 
+```terraform
+import {
+  to = aws_globalaccelerator_accelerator.example
+  id = "arn:aws:globalaccelerator::111111111111:accelerator/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
+}
 ```
-$ terraform import aws_globalaccelerator_accelerator.example arn:aws:globalaccelerator::111111111111:accelerator/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
+
+Using `terraform import`, import Global Accelerator accelerators using the `arn`. For example:
+
+```console
+% terraform import aws_globalaccelerator_accelerator.example arn:aws:globalaccelerator::111111111111:accelerator/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
 ```
diff --git a/website/docs/r/globalaccelerator_custom_routing_accelerator.html.markdown b/website/docs/r/globalaccelerator_custom_routing_accelerator.html.markdown
index b58b5e75213..f2e10c19bf3 100644
--- a/website/docs/r/globalaccelerator_custom_routing_accelerator.html.markdown
+++ b/website/docs/r/globalaccelerator_custom_routing_accelerator.html.markdown
@@ -29,7 +29,7 @@ resource "aws_globalaccelerator_custom_routing_accelerator" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The name of a custom routing accelerator.
 * `ip_address_type` - (Optional) The IP address type that an accelerator supports. For a custom routing accelerator, the value must be `"IPV4"`.
@@ -38,15 +38,15 @@ The following arguments are supported:
 * `attributes` - (Optional) The attributes of the accelerator. Fields documented below.
 * `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-**attributes** supports the following attributes:
+`attributes` supports the following arguments:
 
 * `flow_logs_enabled` - (Optional) Indicates whether flow logs are enabled. Defaults to `false`. Valid values: `true`, `false`.
 * `flow_logs_s3_bucket` - (Optional) The name of the Amazon S3 bucket for the flow logs. Required if `flow_logs_enabled` is `true`.
 * `flow_logs_s3_prefix` - (Optional) The prefix for the location in the Amazon S3 bucket for the flow logs. Required if `flow_logs_enabled` is `true`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The Amazon Resource Name (ARN) of the custom accelerator.
 * `dns_name` - The DNS name of the accelerator. For example, `a5d53ff5ee6bca4ce.awsglobalaccelerator.com`.
@@ -72,8 +72,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Global Accelerator custom routing accelerators can be imported using the `arn`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Global Accelerator custom routing accelerators using the `arn`. For example:
 
+```terraform
+import {
+  to = aws_globalaccelerator_custom_routing_accelerator.example
+  id = "arn:aws:globalaccelerator::111111111111:accelerator/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
+}
 ```
-$ terraform import aws_globalaccelerator_custom_routing_accelerator.example arn:aws:globalaccelerator::111111111111:accelerator/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
+
+Using `terraform import`, import Global Accelerator custom routing accelerators using the `arn`. For example:
+
+```console
+% terraform import aws_globalaccelerator_custom_routing_accelerator.example arn:aws:globalaccelerator::111111111111:accelerator/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
 ```
diff --git a/website/docs/r/globalaccelerator_custom_routing_endpoint_group.html.markdown b/website/docs/r/globalaccelerator_custom_routing_endpoint_group.html.markdown
index 583578df5ac..dfe4084fadf 100644
--- a/website/docs/r/globalaccelerator_custom_routing_endpoint_group.html.markdown
+++ b/website/docs/r/globalaccelerator_custom_routing_endpoint_group.html.markdown
@@ -30,26 +30,26 @@ resource "aws_globalaccelerator_custom_routing_endpoint_group" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `listener_arn` - (Required) The Amazon Resource Name (ARN) of the custom routing listener.
 * `destination_configuration` - (Required) The port ranges and protocols for all endpoints in a custom routing endpoint group to accept client traffic on. Fields documented below.
 * `endpoint_configuration` - (Optional) The list of endpoint objects. Fields documented below.
 * `endpoint_group_region` (Optional) - The name of the AWS Region where the custom routing endpoint group is located.
 
-**destination_configuration** supports the following attributes:
+`destination_configuration` supports the following arguments:
 
 * `from_port` - (Required) The first port, inclusive, in the range of ports for the endpoint group that is associated with a custom routing accelerator.
 * `protocols` - (Required) The protocol for the endpoint group that is associated with a custom routing accelerator. The protocol can be either `"TCP"` or `"UDP"`.
 * `to_port` - (Required) The last port, inclusive, in the range of ports for the endpoint group that is associated with a custom routing accelerator.
 
-**endpoint_configuration** supports the following attributes:
+`endpoint_configuration` supports the following arguments:
 
 * `endpoint_id` - (Optional) An ID for the endpoint. For custom routing accelerators, this is the virtual private cloud (VPC) subnet ID.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The Amazon Resource Name (ARN) of the custom routing endpoint group.
 * `arn` - The Amazon Resource Name (ARN) of the custom routing endpoint group.
@@ -64,8 +64,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Global Accelerator custom routing endpoint groups can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Global Accelerator custom routing endpoint groups using the `id`. For example:
 
+```terraform
+import {
+  to = aws_globalaccelerator_custom_routing_endpoint_group.example
+  id = "arn:aws:globalaccelerator::111111111111:accelerator/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/listener/xxxxxxx/endpoint-group/xxxxxxxx"
+}
 ```
-$ terraform import aws_globalaccelerator_custom_routing_endpoint_group.example arn:aws:globalaccelerator::111111111111:accelerator/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/listener/xxxxxxx/endpoint-group/xxxxxxxx
+
+Using `terraform import`, import Global Accelerator custom routing endpoint groups using the `id`. For example:
+
+```console
+% terraform import aws_globalaccelerator_custom_routing_endpoint_group.example arn:aws:globalaccelerator::111111111111:accelerator/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/listener/xxxxxxx/endpoint-group/xxxxxxxx
 ```
diff --git a/website/docs/r/globalaccelerator_custom_routing_listener.html.markdown b/website/docs/r/globalaccelerator_custom_routing_listener.html.markdown
index 9da500402a0..1604e43052c 100644
--- a/website/docs/r/globalaccelerator_custom_routing_listener.html.markdown
+++ b/website/docs/r/globalaccelerator_custom_routing_listener.html.markdown
@@ -37,19 +37,19 @@ resource "aws_globalaccelerator_custom_routing_listener" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `accelerator_arn` - (Required) The Amazon Resource Name (ARN) of a custom routing accelerator.
 * `port_range` - (Optional) The list of port ranges for the connections from clients to the accelerator. Fields documented below.
 
-**port_range** supports the following attributes:
+`port_range` supports the following arguments:
 
 * `from_port` - (Optional) The first port in the range of ports, inclusive.
 * `to_port` - (Optional) The last port in the range of ports, inclusive.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The Amazon Resource Name (ARN) of the custom routing listener.
 
@@ -63,8 +63,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Global Accelerator custom routing listeners can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Global Accelerator custom routing listeners using the `id`. For example:
 
+```terraform
+import {
+  to = aws_globalaccelerator_custom_routing_listener.example
+  id = "arn:aws:globalaccelerator::111111111111:accelerator/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/listener/xxxxxxxx"
+}
 ```
-$ terraform import aws_globalaccelerator_custom_routing_listener.example arn:aws:globalaccelerator::111111111111:accelerator/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/listener/xxxxxxxx
+
+Using `terraform import`, import Global Accelerator custom routing listeners using the `id`. For example:
+
+```console
+% terraform import aws_globalaccelerator_custom_routing_listener.example arn:aws:globalaccelerator::111111111111:accelerator/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/listener/xxxxxxxx
 ```
diff --git a/website/docs/r/globalaccelerator_endpoint_group.html.markdown b/website/docs/r/globalaccelerator_endpoint_group.html.markdown
index 3f2501e8862..05ed1d67bae 100644
--- a/website/docs/r/globalaccelerator_endpoint_group.html.markdown
+++ b/website/docs/r/globalaccelerator_endpoint_group.html.markdown
@@ -25,7 +25,7 @@ resource "aws_globalaccelerator_endpoint_group" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `listener_arn` - (Required) The Amazon Resource Name (ARN) of the listener.
 * `endpoint_group_region` (Optional) - The name of the AWS Region where the endpoint group is located.
@@ -39,21 +39,21 @@ Terraform will only perform drift detection of its value when present in a confi
 * `endpoint_configuration` - (Optional) The list of endpoint objects. Fields documented below.
 * `port_override` - (Optional) Override specific listener ports used to route traffic to endpoints that are part of this endpoint group. Fields documented below.
 
-**endpoint_configuration** supports the following attributes:
+`endpoint_configuration` supports the following arguments:
 
 * `client_ip_preservation_enabled` - (Optional) Indicates whether client IP address preservation is enabled for an Application Load Balancer endpoint. See the [AWS documentation](https://docs.aws.amazon.com/global-accelerator/latest/dg/preserve-client-ip-address.html) for more details. The default value is `false`.
 **Note:** When client IP address preservation is enabled, the Global Accelerator service creates an EC2 Security Group in the VPC named `GlobalAccelerator` that must be deleted (potentially outside of Terraform) before the VPC will successfully delete. If this EC2 Security Group is not deleted, Terraform will retry the VPC deletion for a few minutes before reporting a `DependencyViolation` error. This cannot be resolved by re-running Terraform.
 * `endpoint_id` - (Optional) An ID for the endpoint. If the endpoint is a Network Load Balancer or Application Load Balancer, this is the Amazon Resource Name (ARN) of the resource. If the endpoint is an Elastic IP address, this is the Elastic IP address allocation ID.
 * `weight` - (Optional) The weight associated with the endpoint. When you add weights to endpoints, you configure AWS Global Accelerator to route traffic based on proportions that you specify.
 
-**port_override** supports the following attributes:
+`port_override` supports the following arguments:
 
 * `endpoint_port` - (Required) The endpoint port that you want a listener port to be mapped to. This is the port on the endpoint, such as the Application Load Balancer or Amazon EC2 instance.
 * `listener_port` - (Required) The listener port that you want to map to a specific endpoint port. This is the port that user traffic arrives to the Global Accelerator on.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The Amazon Resource Name (ARN) of the endpoint group.
 * `arn` - The Amazon Resource Name (ARN) of the endpoint group.
@@ -68,8 +68,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Global Accelerator endpoint groups can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Global Accelerator endpoint groups using the `id`. For example:
 
+```terraform
+import {
+  to = aws_globalaccelerator_endpoint_group.example
+  id = "arn:aws:globalaccelerator::111111111111:accelerator/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/listener/xxxxxxx/endpoint-group/xxxxxxxx"
+}
 ```
-$ terraform import aws_globalaccelerator_endpoint_group.example arn:aws:globalaccelerator::111111111111:accelerator/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/listener/xxxxxxx/endpoint-group/xxxxxxxx
+
+Using `terraform import`, import Global Accelerator endpoint groups using the `id`. For example:
+
+```console
+% terraform import aws_globalaccelerator_endpoint_group.example arn:aws:globalaccelerator::111111111111:accelerator/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/listener/xxxxxxx/endpoint-group/xxxxxxxx
 ```
diff --git a/website/docs/r/globalaccelerator_listener.html.markdown b/website/docs/r/globalaccelerator_listener.html.markdown
index b000b1b7c90..2f352f08be5 100644
--- a/website/docs/r/globalaccelerator_listener.html.markdown
+++ b/website/docs/r/globalaccelerator_listener.html.markdown
@@ -39,21 +39,21 @@ resource "aws_globalaccelerator_listener" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `accelerator_arn` - (Required) The Amazon Resource Name (ARN) of your accelerator.
 * `client_affinity` - (Optional) Direct all requests from a user to the same endpoint. Valid values are `NONE`, `SOURCE_IP`. Default: `NONE`. If `NONE`, Global Accelerator uses the "five-tuple" properties of source IP address, source port, destination IP address, destination port, and protocol to select the hash value. If `SOURCE_IP`, Global Accelerator uses the "two-tuple" properties of source (client) IP address and destination IP address to select the hash value.
 * `protocol` - (Optional) The protocol for the connections from clients to the accelerator. Valid values are `TCP`, `UDP`.
 * `port_range` - (Optional) The list of port ranges for the connections from clients to the accelerator. Fields documented below.
 
-**port_range** supports the following attributes:
+`port_range` supports the following arguments:
 
 * `from_port` - (Optional) The first port in the range of ports, inclusive.
 * `to_port` - (Optional) The last port in the range of ports, inclusive.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The Amazon Resource Name (ARN) of the listener.
 
@@ -67,8 +67,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Global Accelerator listeners can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Global Accelerator listeners using the `id`. For example:
 
+```terraform
+import {
+  to = aws_globalaccelerator_listener.example
+  id = "arn:aws:globalaccelerator::111111111111:accelerator/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/listener/xxxxxxxx"
+}
 ```
-$ terraform import aws_globalaccelerator_listener.example arn:aws:globalaccelerator::111111111111:accelerator/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/listener/xxxxxxxx
+
+Using `terraform import`, import Global Accelerator listeners using the `id`. For example:
+
+```console
+% terraform import aws_globalaccelerator_listener.example arn:aws:globalaccelerator::111111111111:accelerator/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/listener/xxxxxxxx
 ```
diff --git a/website/docs/r/glue_catalog_database.html.markdown b/website/docs/r/glue_catalog_database.html.markdown
index a8ee23a5f40..313aacfa03e 100644
--- a/website/docs/r/glue_catalog_database.html.markdown
+++ b/website/docs/r/glue_catalog_database.html.markdown
@@ -36,7 +36,7 @@ resource "aws_glue_catalog_database" "aws_glue_catalog_database" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `catalog_id` - (Optional) ID of the Glue Catalog to create the database in. If omitted, this defaults to the AWS Account ID.
 * `create_table_default_permission` - (Optional) Creates a set of default permissions on the table for principals. See [`create_table_default_permission`](#create_table_default_permission) below.
@@ -51,6 +51,7 @@ The following arguments are supported:
 
 * `catalog_id` - (Required) ID of the Data Catalog in which the database resides.
 * `database_name` - (Required) Name of the catalog database.
+* `region` - (Optional) Region of the target database.
 
 ### create_table_default_permission
 
@@ -61,9 +62,9 @@ The following arguments are supported:
 
 * `data_lake_principal_identifier` - (Optional) An identifier for the Lake Formation principal.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the Glue Catalog Database.
 * `id` - Catalog ID and name of the database.
@@ -71,8 +72,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Glue Catalog Databases can be imported using the `catalog_id:name`. If you have not set a Catalog ID specify the AWS Account ID that the database is in, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Glue Catalog Databases using the `catalog_id:name`. If you have not set a Catalog ID specify the AWS Account ID that the database is in. For example:
 
+```terraform
+import {
+  to = aws_glue_catalog_database.database
+  id = "123456789012:my_database"
+}
 ```
-$ terraform import aws_glue_catalog_database.database 123456789012:my_database
+
+Using `terraform import`, import Glue Catalog Databases using the `catalog_id:name`. If you have not set a Catalog ID specify the AWS Account ID that the database is in. For example:
+
+```console
+% terraform import aws_glue_catalog_database.database 123456789012:my_database
 ```
diff --git a/website/docs/r/glue_catalog_table.html.markdown b/website/docs/r/glue_catalog_table.html.markdown
index 93a8b26e021..7598ebf5722 100644
--- a/website/docs/r/glue_catalog_table.html.markdown
+++ b/website/docs/r/glue_catalog_table.html.markdown
@@ -92,6 +92,7 @@ The follow arguments are optional:
 * `catalog_id` - (Optional) ID of the Glue Catalog and database to create the table in. If omitted, this defaults to the AWS Account ID plus the database name.
 * `description` - (Optional) Description of the table.
 * `owner` - (Optional) Owner of the table.
+* `open_table_format_input` - (Optional) Configuration block for open table formats. See [`open_table_format_input`](#open_table_format_input) below.
 * `parameters` - (Optional) Properties associated with this table, as a list of key-value pairs.
 * `partition_index` - (Optional) Configuration block for a maximum of 3 partition indexes. See [`partition_index`](#partition_index) below.
 * `partition_keys` - (Optional) Configuration block of columns by which the table is partitioned. Only primitive types are supported as partition keys. See [`partition_keys`](#partition_keys) below.
@@ -102,6 +103,21 @@ The follow arguments are optional:
 * `view_expanded_text` - (Optional) If the table is a view, the expanded text of the view; otherwise null.
 * `view_original_text` - (Optional) If the table is a view, the original text of the view; otherwise null.
 
+### open_table_format_input
+
+~> **NOTE:** A `open_table_format_input` cannot be added to an existing `glue_catalog_table`.
+This will destroy and recreate the table, possibly resulting in data loss.
+
+* `iceberg_input` - (Required) Configuration block for iceberg table config. See [`iceberg_input`](#iceberg_input) below.
+
+### iceberg_input
+
+~> **NOTE:** A `iceberg_input` cannot be added to an existing `open_table_format_input`.
+This will destroy and recreate the table, possibly resulting in data loss.
+
+* `metadata_operation` - (Required) A required metadata operation. Can only be set to CREATE.
+* `version` - (Optional) The table version for the Iceberg table. Defaults to 2.
+
 ### partition_index
 
 ~> **NOTE:** A `partition_index` cannot be added to an existing `glue_catalog_table`.
@@ -175,17 +191,26 @@ To add an index to an existing table, see the [`glue_partition_index` resource](
 * `database_name` - (Required) Name of the catalog database that contains the target table.
 * `name` - (Required) Name of the target table.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The ARN of the Glue Table.
 * `id` - Catalog ID, Database name and of the name table.
 
 ## Import
 
-Glue Tables can be imported with their catalog ID (usually AWS account ID), database name, and table name, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Glue Tables using the catalog ID (usually AWS account ID), database name, and table name. For example:
 
+```terraform
+import {
+  to = aws_glue_catalog_table.MyTable
+  id = "123456789012:MyDatabase:MyTable"
+}
 ```
-$ terraform import aws_glue_catalog_table.MyTable 123456789012:MyDatabase:MyTable
+
+Using `terraform import`, import Glue Tables using the catalog ID (usually AWS account ID), database name, and table name. For example:
+
+```console
+% terraform import aws_glue_catalog_table.MyTable 123456789012:MyDatabase:MyTable
 ```
diff --git a/website/docs/r/glue_classifier.html.markdown b/website/docs/r/glue_classifier.html.markdown
index 691c08b1868..2179875eb54 100644
--- a/website/docs/r/glue_classifier.html.markdown
+++ b/website/docs/r/glue_classifier.html.markdown
@@ -71,7 +71,7 @@ resource "aws_glue_classifier" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `csv_classifier` - (Optional) A classifier for Csv content. Defined below.
 * `grok_classifier` – (Optional) A classifier that uses grok patterns. Defined below.
@@ -105,16 +105,25 @@ The following arguments are supported:
 * `classification` - (Required) An identifier of the data format that the classifier matches.
 * `row_tag` - (Required) The XML tag designating the element that contains each record in an XML document being parsed. Note that this cannot identify a self-closing element (closed by `/>`). An empty row element that contains only attributes can be parsed as long as it ends with a closing tag (for example, `<row item_a="A" item_b="B"></row>` is okay, but `<row item_a="A" item_b="B" />` is not).
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Name of the classifier
 
 ## Import
 
-Glue Classifiers can be imported using their name, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Glue Classifiers using their name. For example:
 
+```terraform
+import {
+  to = aws_glue_classifier.MyClassifier
+  id = "MyClassifier"
+}
 ```
-$ terraform import aws_glue_classifier.MyClassifier MyClassifier
+
+Using `terraform import`, import Glue Classifiers using their name. For example:
+
+```console
+% terraform import aws_glue_classifier.MyClassifier MyClassifier
 ```
diff --git a/website/docs/r/glue_connection.html.markdown b/website/docs/r/glue_connection.html.markdown
index 0a322e945cd..8706b798611 100644
--- a/website/docs/r/glue_connection.html.markdown
+++ b/website/docs/r/glue_connection.html.markdown
@@ -66,9 +66,52 @@ resource "aws_glue_connection" "example" {
 }
 ```
 
+### Connection using a custom connector
+
+```terraform
+# Define the custom connector using the connection_type of `CUSTOM` with the match_criteria of `template_connection`
+# Example here being a snowflake jdbc connector with a secret having user and password as keys
+
+data "aws_secretmanager_secret" "example" {
+  name = "example-secret"
+}
+
+resource "aws_glue_connection" "example_connector" {
+  connection_type = "CUSTOM"
+
+  connection_properties = {
+    CONNECTOR_CLASS_NAME = "net.snowflake.client.jdbc.SnowflakeDriver"
+    CONNECTION_TYPE      = "Jdbc"
+    CONNECTOR_URL        = "s3://example/snowflake-jdbc.jar" # S3 path to the snowflake jdbc jar
+    JDBC_CONNECTION_URL  = "[[\"default=jdbc:snowflake://example.com/?user=$${user}&password=$${password}\"],\",\"]"
+  }
+
+  name = "example_connector"
+
+  match_criteria = ["template-connection"]
+}
+
+# Reference the connector using match_criteria with the connector created above.
+
+resource "aws_glue_connection" "example_connection" {
+  connection_type = "CUSTOM"
+
+  connection_properties = {
+    CONNECTOR_CLASS_NAME = "net.snowflake.client.jdbc.SnowflakeDriver"
+    CONNECTION_TYPE      = "Jdbc"
+    CONNECTOR_URL        = "s3://example/snowflake-jdbc.jar"
+    JDBC_CONNECTION_URL  = "jdbc:snowflake://example.com/?user=$${user}&password=$${password}"
+    SECRET_ID            = data.aws_secretmanager_secret.example.name
+  }
+  name           = "example"
+  match_criteria = ["Connection", aws_glue_connection.example_connector.name]
+}
+
+```
+
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `catalog_id` – (Optional) The ID of the Data Catalog in which to create the connection. If none is supplied, the AWS account ID is used by default.
 * `connection_properties` – (Optional) A map of key-value pairs used as parameters for this connection.
@@ -85,9 +128,9 @@ The following arguments are supported:
 * `security_group_id_list` - (Optional) The security group ID list used by the connection.
 * `subnet_id` - (Optional) The subnet ID used by the connection.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Catalog ID and name of the connection
 * `arn` - The ARN of the Glue Connection.
@@ -95,8 +138,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Glue Connections can be imported using the `CATALOG-ID` (AWS account ID if not custom) and `NAME`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Glue Connections using the `CATALOG-ID` (AWS account ID if not custom) and `NAME`. For example:
 
+```terraform
+import {
+  to = aws_glue_connection.MyConnection
+  id = "123456789012:MyConnection"
+}
 ```
-$ terraform import aws_glue_connection.MyConnection 123456789012:MyConnection
+
+Using `terraform import`, import Glue Connections using the `CATALOG-ID` (AWS account ID if not custom) and `NAME`. For example:
+
+```console
+% terraform import aws_glue_connection.MyConnection 123456789012:MyConnection
 ```
diff --git a/website/docs/r/glue_crawler.html.markdown b/website/docs/r/glue_crawler.html.markdown
index 0071979db67..a86193dc728 100644
--- a/website/docs/r/glue_crawler.html.markdown
+++ b/website/docs/r/glue_crawler.html.markdown
@@ -130,7 +130,7 @@ resource "aws_glue_crawler" "events_crawler" {
 
 ~> **NOTE:** Must specify at least one of `dynamodb_target`, `jdbc_target`, `s3_target`, `mongodb_target` or `catalog_target`.
 
-The following arguments are supported:
+This argument supports the following arguments:
 
 * `database_name` (Required) Glue database where results are written.
 * `name` (Required) Name of the crawler.
@@ -141,8 +141,10 @@ The following arguments are supported:
 * `delta_target` (Optional) List of nested Delta Lake target arguments. See [Delta Target](#delta-target) below.
 * `dynamodb_target` (Optional) List of nested DynamoDB target arguments. See [Dynamodb Target](#dynamodb-target) below.
 * `jdbc_target` (Optional) List of nested JBDC target arguments. See [JDBC Target](#jdbc-target) below.
-* `s3_target` (Optional) List nested Amazon S3 target arguments. See [S3 Target](#s3-target) below.
-* `mongodb_target` (Optional) List nested MongoDB target arguments. See [MongoDB Target](#mongodb-target) below.
+* `s3_target` (Optional) List of nested Amazon S3 target arguments. See [S3 Target](#s3-target) below.
+* `mongodb_target` (Optional) List of nested MongoDB target arguments. See [MongoDB Target](#mongodb-target) below.
+* `hudi_target` (Optional) List of nested Hudi target arguments. See [Iceberg Target](#hudi-target) below.
+* `iceberg_target` (Optional) List of nested Iceberg target arguments. See [Iceberg Target](#iceberg-target) below.
 * `schedule` (Optional) A cron expression used to specify the schedule. For more information, see [Time-Based Schedules for Jobs and Crawlers](https://docs.aws.amazon.com/glue/latest/dg/monitor-data-warehouse-schedule.html). For example, to run something every day at 12:15 UTC, you would specify: `cron(15 12 * * ? *)`.
 * `schema_change_policy` (Optional) Policy for the crawler's update and deletion behavior. See [Schema Change Policy](#schema-change-policy) below.
 * `lake_formation_configuration` (Optional) Specifies Lake Formation configuration settings for the crawler. See [Lake Formation Configuration](#lake-formation-configuration) below.
@@ -192,6 +194,20 @@ The following arguments are supported:
 * `path` - (Required) The path of the Amazon DocumentDB or MongoDB target (database/collection).
 * `scan_all` - (Optional) Indicates whether to scan all the records, or to sample rows from the table. Scanning all the records can take a long time when the table is not a high throughput table. Default value is `true`.
 
+### Hudi Target
+
+* `connection_name` - (Optional) The name of the connection to use to connect to the Hudi target.
+* `paths` - (Required) One or more Amazon S3 paths that contains Hudi metadata folders as s3://bucket/prefix.
+* `exclusions` - (Optional) A list of glob patterns used to exclude from the crawl.
+* `maximum_traversal_depth` - (Required) The maximum depth of Amazon S3 paths that the crawler can traverse to discover the Hudi metadata folder in your Amazon S3 path. Used to limit the crawler run time. Valid values are between `1` and `20`.
+
+### Iceberg Target
+
+* `connection_name` - (Optional) The name of the connection to use to connect to the Iceberg target.
+* `paths` - (Required) One or more Amazon S3 paths that contains Iceberg metadata folders as s3://bucket/prefix.
+* `exclusions` - (Optional) A list of glob patterns used to exclude from the crawl.
+* `maximum_traversal_depth` - (Required) The maximum depth of Amazon S3 paths that the crawler can traverse to discover the Iceberg metadata folder in your Amazon S3 path. Used to limit the crawler run time. Valid values are between `1` and `20`.
+
 ### Delta Target
 
 * `connection_name` - (Optional) The name of the connection to use to connect to the Delta table target.
@@ -217,9 +233,9 @@ The following arguments are supported:
 
 * `recrawl_behavior` - (Optional) Specifies whether to crawl the entire dataset again, crawl only folders that were added since the last crawler run, or crawl what S3 notifies the crawler of via SQS. Valid Values are: `CRAWL_EVENT_MODE`, `CRAWL_EVERYTHING` and `CRAWL_NEW_FOLDERS_ONLY`. Default value is `CRAWL_EVERYTHING`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Crawler name
 * `arn` - The ARN of the crawler
@@ -227,8 +243,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Glue Crawlers can be imported using `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Glue Crawlers using `name`. For example:
 
+```terraform
+import {
+  to = aws_glue_crawler.MyJob
+  id = "MyJob"
+}
 ```
-$ terraform import aws_glue_crawler.MyJob MyJob
+
+Using `terraform import`, import Glue Crawlers using `name`. For example:
+
+```console
+% terraform import aws_glue_crawler.MyJob MyJob
 ```
diff --git a/website/docs/r/glue_data_catalog_encryption_settings.html.markdown b/website/docs/r/glue_data_catalog_encryption_settings.html.markdown
index 538e3640f80..d40927b9bc8 100644
--- a/website/docs/r/glue_data_catalog_encryption_settings.html.markdown
+++ b/website/docs/r/glue_data_catalog_encryption_settings.html.markdown
@@ -30,7 +30,7 @@ resource "aws_glue_data_catalog_encryption_settings" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `data_catalog_encryption_settings` – (Required) The security configuration to set. see [Data Catalog Encryption Settings](#data_catalog_encryption_settings).
 * `catalog_id` – (Optional) The ID of the Data Catalog to set the security configuration for. If none is provided, the AWS account ID is used by default.
@@ -50,16 +50,25 @@ The following arguments are supported:
 * `catalog_encryption_mode` - (Required) The encryption-at-rest mode for encrypting Data Catalog data. Valid values are `DISABLED` and `SSE-KMS`.
 * `sse_aws_kms_key_id` - (Optional) The ARN of the AWS KMS key to use for encryption at rest.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the Data Catalog to set the security configuration for.
 
 ## Import
 
-Glue Data Catalog Encryption Settings can be imported using `CATALOG-ID` (AWS account ID if not custom), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Glue Data Catalog Encryption Settings using `CATALOG-ID` (AWS account ID if not custom). For example:
 
+```terraform
+import {
+  to = aws_glue_data_catalog_encryption_settings.example
+  id = "123456789012"
+}
 ```
-$ terraform import aws_glue_data_catalog_encryption_settings.example 123456789012
+
+Using `terraform import`, import Glue Data Catalog Encryption Settings using `CATALOG-ID` (AWS account ID if not custom). For example:
+
+```console
+% terraform import aws_glue_data_catalog_encryption_settings.example 123456789012
 ```
diff --git a/website/docs/r/glue_data_quality_ruleset.html.markdown b/website/docs/r/glue_data_quality_ruleset.html.markdown
index 2be8a278cb7..028f11a66c8 100644
--- a/website/docs/r/glue_data_quality_ruleset.html.markdown
+++ b/website/docs/r/glue_data_quality_ruleset.html.markdown
@@ -60,7 +60,7 @@ resource "aws_glue_data_quality_ruleset" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `description` - (Optional) Description of the data quality ruleset.
 * `name` - (Required, Forces new resource) Name of the data quality ruleset.
@@ -74,9 +74,9 @@ The following arguments are supported:
 * `database_name` - (Required, Forces new resource) Name of the database where the AWS Glue table exists.
 * `table_name` - (Required, Forces new resource) Name of the AWS Glue table.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the Glue Data Quality Ruleset.
 * `created_on` - The time and date that this data quality ruleset was created.
@@ -86,8 +86,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Glue Data Quality Ruleset can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Glue Data Quality Ruleset using the `name`. For example:
 
+```terraform
+import {
+  to = aws_glue_data_quality_ruleset.example
+  id = "exampleName"
+}
 ```
-$ terraform import aws_glue_data_quality_ruleset.example exampleName
+
+Using `terraform import`, import Glue Data Quality Ruleset using the `name`. For example:
+
+```console
+% terraform import aws_glue_data_quality_ruleset.example exampleName
 ```
diff --git a/website/docs/r/glue_dev_endpoint.html.markdown b/website/docs/r/glue_dev_endpoint.html.markdown
new file mode 100644
index 00000000000..fdc2ed59e95
--- /dev/null
+++ b/website/docs/r/glue_dev_endpoint.html.markdown
@@ -0,0 +1,96 @@
+---
+subcategory: "Glue"
+layout: "aws"
+page_title: "AWS: aws_glue_dev_endpoint"
+description: |-
+  Provides a Glue Development Endpoint resource.
+---
+
+# Resource: aws_glue_dev_endpoint
+
+Provides a Glue Development Endpoint resource.
+
+## Example Usage
+
+Basic usage:
+
+```terraform
+resource "aws_glue_dev_endpoint" "example" {
+  name     = "foo"
+  role_arn = aws_iam_role.example.arn
+}
+
+resource "aws_iam_role" "example" {
+  name               = "AWSGlueServiceRole-foo"
+  assume_role_policy = data.aws_iam_policy_document.example.json
+}
+
+data "aws_iam_policy_document" "example" {
+  statement {
+    actions = ["sts:AssumeRole"]
+
+    principals {
+      type        = "Service"
+      identifiers = ["glue.amazonaws.com"]
+    }
+  }
+}
+
+resource "aws_iam_role_policy_attachment" "example-AWSGlueServiceRole" {
+  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSGlueServiceRole"
+  role       = aws_iam_role.example.name
+}
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `arguments` - (Optional) A map of arguments used to configure the endpoint.
+* `extra_jars_s3_path` - (Optional) Path to one or more Java Jars in an S3 bucket that should be loaded in this endpoint.
+* `extra_python_libs_s3_path` - (Optional) Path(s) to one or more Python libraries in an S3 bucket that should be loaded in this endpoint. Multiple values must be complete paths separated by a comma.
+* `glue_version` - (Optional) -  Specifies the versions of Python and Apache Spark to use. Defaults to AWS Glue version 0.9.
+* `name` - (Required) The name of this endpoint. It must be unique in your account.
+* `number_of_nodes` - (Optional) The number of AWS Glue Data Processing Units (DPUs) to allocate to this endpoint. Conflicts with `worker_type`.
+* `number_of_workers` - (Optional) The number of workers of a defined worker type that are allocated to this endpoint. This field is available only when you choose worker type G.1X or G.2X.
+* `public_key` - (Optional) The public key to be used by this endpoint for authentication.
+* `public_keys` - (Optional) A list of public keys to be used by this endpoint for authentication.
+* `role_arn` - (Required) The IAM role for this endpoint.
+* `security_configuration` - (Optional) The name of the Security Configuration structure to be used with this endpoint.
+* `security_group_ids` - (Optional) Security group IDs for the security groups to be used by this endpoint.
+* `subnet_id` - (Optional) The subnet ID for the new endpoint to use.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `worker_type` - (Optional) The type of predefined worker that is allocated to this endpoint. Accepts a value of Standard, G.1X, or G.2X.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the endpoint.
+* `name` - The name of the new endpoint.
+* `private_address` - A private IP address to access the endpoint within a VPC, if this endpoint is created within one.
+* `public_address` - The public IP address used by this endpoint. The PublicAddress field is present only when you create a non-VPC endpoint.
+* `yarn_endpoint_address` - The YARN endpoint address used by this endpoint.
+* `zeppelin_remote_spark_interpreter_port` - The Apache Zeppelin port for the remote Apache Spark interpreter.
+* `availability_zone` - The AWS availability zone where this endpoint is located.
+* `vpc_id` - he ID of the VPC used by this endpoint.
+* `status` - The current status of this endpoint.
+* `failure_reason` - The reason for a current failure in this endpoint.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import a Glue Development Endpoint using the `name`. For example:
+
+```terraform
+import {
+  to = aws_glue_dev_endpoint.example
+  id = "foo"
+}
+```
+
+Using `terraform import`, import a Glue Development Endpoint using the `name`. For example:
+
+```console
+% terraform import aws_glue_dev_endpoint.example foo
+```
diff --git a/website/docs/r/glue_dev_endpoint.markdown b/website/docs/r/glue_dev_endpoint.markdown
deleted file mode 100644
index e463c642888..00000000000
--- a/website/docs/r/glue_dev_endpoint.markdown
+++ /dev/null
@@ -1,87 +0,0 @@
----
-subcategory: "Glue"
-layout: "aws"
-page_title: "AWS: aws_glue_dev_endpoint"
-description: |-
-  Provides a Glue Development Endpoint resource.
----
-
-# Resource: aws_glue_dev_endpoint
-
-Provides a Glue Development Endpoint resource.
-
-## Example Usage
-
-Basic usage:
-
-```terraform
-resource "aws_glue_dev_endpoint" "example" {
-  name     = "foo"
-  role_arn = aws_iam_role.example.arn
-}
-
-resource "aws_iam_role" "example" {
-  name               = "AWSGlueServiceRole-foo"
-  assume_role_policy = data.aws_iam_policy_document.example.json
-}
-
-data "aws_iam_policy_document" "example" {
-  statement {
-    actions = ["sts:AssumeRole"]
-
-    principals {
-      type        = "Service"
-      identifiers = ["glue.amazonaws.com"]
-    }
-  }
-}
-
-resource "aws_iam_role_policy_attachment" "example-AWSGlueServiceRole" {
-  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSGlueServiceRole"
-  role       = aws_iam_role.example.name
-}
-```
-
-## Argument Reference
-
-The following arguments are supported:
-
-* `arguments` - (Optional) A map of arguments used to configure the endpoint.
-* `extra_jars_s3_path` - (Optional) Path to one or more Java Jars in an S3 bucket that should be loaded in this endpoint.
-* `extra_python_libs_s3_path` - (Optional) Path(s) to one or more Python libraries in an S3 bucket that should be loaded in this endpoint. Multiple values must be complete paths separated by a comma.
-* `glue_version` - (Optional) -  Specifies the versions of Python and Apache Spark to use. Defaults to AWS Glue version 0.9.
-* `name` - (Required) The name of this endpoint. It must be unique in your account.
-* `number_of_nodes` - (Optional) The number of AWS Glue Data Processing Units (DPUs) to allocate to this endpoint. Conflicts with `worker_type`.
-* `number_of_workers` - (Optional) The number of workers of a defined worker type that are allocated to this endpoint. This field is available only when you choose worker type G.1X or G.2X.
-* `public_key` - (Optional) The public key to be used by this endpoint for authentication.
-* `public_keys` - (Optional) A list of public keys to be used by this endpoint for authentication.
-* `role_arn` - (Required) The IAM role for this endpoint.
-* `security_configuration` - (Optional) The name of the Security Configuration structure to be used with this endpoint.
-* `security_group_ids` - (Optional) Security group IDs for the security groups to be used by this endpoint.
-* `subnet_id` - (Optional) The subnet ID for the new endpoint to use.
-* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
-* `worker_type` - (Optional) The type of predefined worker that is allocated to this endpoint. Accepts a value of Standard, G.1X, or G.2X.
-
-## Attributes Reference
-
-In addition to all arguments above, the following attributes are exported:
-
-* `arn` - The ARN of the endpoint.
-* `name` - The name of the new endpoint.
-* `private_address` - A private IP address to access the endpoint within a VPC, if this endpoint is created within one.
-* `public_address` - The public IP address used by this endpoint. The PublicAddress field is present only when you create a non-VPC endpoint.
-* `yarn_endpoint_address` - The YARN endpoint address used by this endpoint.
-* `zeppelin_remote_spark_interpreter_port` - The Apache Zeppelin port for the remote Apache Spark interpreter.
-* `availability_zone` - The AWS availability zone where this endpoint is located.
-* `vpc_id` - he ID of the VPC used by this endpoint.
-* `status` - The current status of this endpoint.
-* `failure_reason` - The reason for a current failure in this endpoint.
-* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
-
-## Import
-
-A Glue Development Endpoint can be imported using the `name`, e.g.,
-
-```
-$ terraform import aws_glue_dev_endpoint.example foo
-```
diff --git a/website/docs/r/glue_job.html.markdown b/website/docs/r/glue_job.html.markdown
index b5004509ff3..b6394c1c4c7 100644
--- a/website/docs/r/glue_job.html.markdown
+++ b/website/docs/r/glue_job.html.markdown
@@ -27,6 +27,24 @@ resource "aws_glue_job" "example" {
 }
 ```
 
+### Ray Job
+
+```terraform
+resource "aws_glue_job" "example" {
+  name         = "example"
+  role_arn     = aws_iam_role.example.arn
+  glue_version = "4.0"
+  worker_type  = "Z.2X"
+
+  command {
+    name            = "glueray"
+    python_version  = "3.9"
+    runtime         = "Ray2.4"
+    script_location = "s3://${aws_s3_bucket.example.bucket}/example.py"
+  }
+}
+```
+
 ### Scala Job
 
 ```terraform
@@ -81,7 +99,7 @@ resource "aws_glue_job" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `command` – (Required) The command of the job. Defined below.
 * `connections` – (Optional) The list of connections used for this job.
@@ -89,7 +107,7 @@ The following arguments are supported:
 * `non_overridable_arguments` – (Optional) Non-overridable arguments for this job, specified as name-value pairs.
 * `description` – (Optional) Description of the job.
 * `execution_property` – (Optional) Execution property of the job. Defined below.
-* `glue_version` - (Optional) The version of glue to use, for example "1.0". For information about available versions, see the [AWS Glue Release Notes](https://docs.aws.amazon.com/glue/latest/dg/release-notes.html).
+* `glue_version` - (Optional) The version of glue to use, for example "1.0". Ray jobs should set this to 4.0 or greater. For information about available versions, see the [AWS Glue Release Notes](https://docs.aws.amazon.com/glue/latest/dg/release-notes.html).
 * `execution_class` - (Optional) Indicates whether the job is run with a standard or flexible execution class. The standard execution class is ideal for time-sensitive workloads that require fast job startup and dedicated resources. Valid value: `FLEX`, `STANDARD`.
 * `max_capacity` – (Optional) The maximum number of AWS Glue data processing units (DPUs) that can be allocated when this job runs. `Required` when `pythonshell` is set, accept either `0.0625` or `1.0`. Use `number_of_workers` and `worker_type` arguments instead with `glue_version` `2.0` and above.
 * `max_retries` – (Optional) The maximum number of times to retry this job if it fails.
@@ -99,14 +117,20 @@ The following arguments are supported:
 * `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 * `timeout` – (Optional) The job timeout in minutes. The default is 2880 minutes (48 hours) for `glueetl` and `pythonshell` jobs, and null (unlimited) for `gluestreaming` jobs.
 * `security_configuration` - (Optional) The name of the Security Configuration to be associated with the job.
-* `worker_type` - (Optional) The type of predefined worker that is allocated when a job runs. Accepts a value of Standard, G.1X, or G.2X.
+* `worker_type` - (Optional) The type of predefined worker that is allocated when a job runs. Accepts a value of Standard, G.1X, G.2X, or G.025X for Spark jobs. Accepts the value Z.2X for Ray jobs.
+    * For the Standard worker type, each worker provides 4 vCPU, 16 GB of memory and a 50GB disk, and 2 executors per worker.
+    * For the G.1X worker type, each worker maps to 1 DPU (4 vCPU, 16 GB of memory, 64 GB disk), and provides 1 executor per worker. Recommended for memory-intensive jobs.
+    * For the G.2X worker type, each worker maps to 2 DPU (8 vCPU, 32 GB of memory, 128 GB disk), and provides 1 executor per worker. Recommended for memory-intensive jobs.
+    * For the G.025X worker type, each worker maps to 0.25 DPU (2 vCPU, 4GB of memory, 64 GB disk), and provides 1 executor per worker. Recommended for low volume streaming jobs. Only available for Glue version 3.0.
+    * For the Z.2X worker type, each worker maps to 2 M-DPU (8vCPU, 64 GB of m emory, 128 GB disk), and provides up to 8 Ray workers based on the autoscaler.
 * `number_of_workers` - (Optional) The number of workers of a defined workerType that are allocated when a job runs.
 
 ### command Argument Reference
 
-* `name` - (Optional) The name of the job command. Defaults to `glueetl`. Use `pythonshell` for Python Shell Job Type, or `gluestreaming` for Streaming Job Type. `max_capacity` needs to be set if `pythonshell` is chosen.
+* `name` - (Optional) The name of the job command. Defaults to `glueetl`. Use `pythonshell` for Python Shell Job Type, `glueray` for Ray Job Type, or `gluestreaming` for Streaming Job Type. `max_capacity` needs to be set if `pythonshell` is chosen.
 * `script_location` - (Required) Specifies the S3 path to a script that executes a job.
 * `python_version` - (Optional) The Python version being used to execute a Python shell job. Allowed values are 2, 3 or 3.9. Version 3 refers to Python 3.6.
+* `runtime` - (Optional) In Ray jobs, runtime is used to specify the versions of Ray, Python and additional libraries available in your environment. This field is not used in other job types. For supported runtime environment values, see [Working with Ray jobs](https://docs.aws.amazon.com/glue/latest/dg/ray-jobs-section.html#author-job-ray-runtimes) in the Glue Developer Guide.
 
 ### execution_property Argument Reference
 
@@ -116,9 +140,9 @@ The following arguments are supported:
 
 * `notify_delay_after` - (Optional) After a job run starts, the number of minutes to wait before sending a job run delay notification.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name (ARN) of Glue Job
 * `id` - Job name
@@ -126,8 +150,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Glue Jobs can be imported using `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Glue Jobs using `name`. For example:
 
+```terraform
+import {
+  to = aws_glue_job.MyJob
+  id = "MyJob"
+}
 ```
-$ terraform import aws_glue_job.MyJob MyJob
+
+Using `terraform import`, import Glue Jobs using `name`. For example:
+
+```console
+% terraform import aws_glue_job.MyJob MyJob
 ```
diff --git a/website/docs/r/glue_ml_transform.html.markdown b/website/docs/r/glue_ml_transform.html.markdown
index 3a50222f290..855ec8235f5 100644
--- a/website/docs/r/glue_ml_transform.html.markdown
+++ b/website/docs/r/glue_ml_transform.html.markdown
@@ -121,7 +121,7 @@ resource "aws_glue_catalog_table" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` – (Required) The name you assign to this ML Transform. It must be unique in your account.
 * `input_record_tables` - (Required)  A list of AWS Glue table definitions used by the transform. see [Input Record Tables](#input_record_tables).
@@ -155,9 +155,9 @@ The following arguments are supported:
 * `precision_recall_trade_off` - (Optional) The value selected when tuning your transform for a balance between precision and recall.
 * `primary_key_column_name` - (Optional) The name of a column that uniquely identifies rows in the source table.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name (ARN) of Glue ML Transform.
 * `id` - Glue ML Transform ID.
@@ -172,8 +172,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Glue ML Transforms can be imported using `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Glue ML Transforms using `id`. For example:
 
+```terraform
+import {
+  to = aws_glue_ml_transform.example
+  id = "tfm-c2cafbe83b1c575f49eaca9939220e2fcd58e2d5"
+}
 ```
-$ terraform import aws_glue_ml_transform.example tfm-c2cafbe83b1c575f49eaca9939220e2fcd58e2d5
+
+Using `terraform import`, import Glue ML Transforms using `id`. For example:
+
+```console
+% terraform import aws_glue_ml_transform.example tfm-c2cafbe83b1c575f49eaca9939220e2fcd58e2d5
 ```
diff --git a/website/docs/r/glue_partition.html.markdown b/website/docs/r/glue_partition.html.markdown
index ed0102ed164..71328d1cef3 100644
--- a/website/docs/r/glue_partition.html.markdown
+++ b/website/docs/r/glue_partition.html.markdown
@@ -22,7 +22,7 @@ resource "aws_glue_partition" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `database_name` - (Required) Name of the metadata database where the table metadata resides. For Hive compatibility, this must be all lowercase.
 * `partition_values` - (Required) The values that define the partition.
@@ -68,9 +68,9 @@ The following arguments are supported:
 * `skewed_column_value_location_maps` - (Optional) A list of values that appear so frequently as to be considered skewed.
 * `skewed_column_values` - (Optional) A map of skewed values to the columns that contain them.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - partition id.
 * `creation_time` - The time at which the partition was created.
@@ -79,8 +79,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Glue Partitions can be imported with their catalog ID (usually AWS account ID), database name, table name and partition values e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Glue Partitions using the catalog ID (usually AWS account ID), database name, table name and partition values. For example:
 
+```terraform
+import {
+  to = aws_glue_partition.part
+  id = "123456789012:MyDatabase:MyTable:val1#val2"
+}
 ```
-$ terraform import aws_glue_partition.part 123456789012:MyDatabase:MyTable:val1#val2
+
+Using `terraform import`, import Glue Partitions using the catalog ID (usually AWS account ID), database name, table name and partition values. For example:
+
+```console
+% terraform import aws_glue_partition.part 123456789012:MyDatabase:MyTable:val1#val2
 ```
diff --git a/website/docs/r/glue_partition_index.html.markdown b/website/docs/r/glue_partition_index.html.markdown
index 72139e90516..f84df400b37 100644
--- a/website/docs/r/glue_partition_index.html.markdown
+++ b/website/docs/r/glue_partition_index.html.markdown
@@ -121,9 +121,9 @@ The following arguments are required:
 * `index_name` - (Required) Name of the partition index.
 * `keys` - (Required) Keys for the partition index.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Catalog ID, Database name, table name, and index name.
 
@@ -136,8 +136,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Glue Partition Indexes can be imported with their catalog ID (usually AWS account ID), database name, table name, and index name, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Glue Partition Indexes using the catalog ID (usually AWS account ID), database name, table name, and index name. For example:
 
+```terraform
+import {
+  to = aws_glue_partition_index.example
+  id = "123456789012:MyDatabase:MyTable:index-name"
+}
 ```
-$ terraform import aws_glue_partition_index.example 123456789012:MyDatabase:MyTable:index-name
+
+Using `terraform import`, import Glue Partition Indexes using the catalog ID (usually AWS account ID), database name, table name, and index name. For example:
+
+```console
+% terraform import aws_glue_partition_index.example 123456789012:MyDatabase:MyTable:index-name
 ```
diff --git a/website/docs/r/glue_registry.html.markdown b/website/docs/r/glue_registry.html.markdown
index c7279e85421..22c78025057 100644
--- a/website/docs/r/glue_registry.html.markdown
+++ b/website/docs/r/glue_registry.html.markdown
@@ -20,15 +20,15 @@ resource "aws_glue_registry" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `registry_name` – (Required) The Name of the registry.
 * `description` – (Optional) A description of the registry.
 * `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name (ARN) of Glue Registry.
 * `id` - Amazon Resource Name (ARN) of Glue Registry.
@@ -36,8 +36,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Glue Registries can be imported using `arn`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Glue Registries using `arn`. For example:
 
+```terraform
+import {
+  to = aws_glue_registry.example
+  id = "arn:aws:glue:us-west-2:123456789012:registry/example"
+}
 ```
-$ terraform import aws_glue_registry.example arn:aws:glue:us-west-2:123456789012:registry/example
+
+Using `terraform import`, import Glue Registries using `arn`. For example:
+
+```console
+% terraform import aws_glue_registry.example arn:aws:glue:us-west-2:123456789012:registry/example
 ```
diff --git a/website/docs/r/glue_resource_policy.html.markdown b/website/docs/r/glue_resource_policy.html.markdown
index 5b9f5b48523..a29a98fff64 100644
--- a/website/docs/r/glue_resource_policy.html.markdown
+++ b/website/docs/r/glue_resource_policy.html.markdown
@@ -39,19 +39,28 @@ resource "aws_glue_resource_policy" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `policy` – (Required) The policy to be applied to the aws glue data catalog.
 * `enable_hybrid` - (Optional) Indicates that you are using both methods to grant cross-account. Valid values are `TRUE` and `FALSE`. Note the terraform will not perform drift detetction on this field as its not return on read.
 
-## Attributes Reference
+## Attribute Reference
 
-No additional attributes are exported.
+This resource exports no additional attributes.
 
 ## Import
 
-Glue Resource Policy can be imported using the account ID:
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Glue Resource Policy using the account ID. For example:
 
+```terraform
+import {
+  to = aws_glue_resource_policy.Test
+  id = "12356789012"
+}
 ```
-$ terraform import aws_glue_resource_policy.Test 12356789012
+
+Using `terraform import`, import Glue Resource Policy using the account ID. For example:
+
+```console
+% terraform import aws_glue_resource_policy.Test 12356789012
 ```
diff --git a/website/docs/r/glue_schema.html.markdown b/website/docs/r/glue_schema.html.markdown
index 795084a081e..84ba903b5db 100644
--- a/website/docs/r/glue_schema.html.markdown
+++ b/website/docs/r/glue_schema.html.markdown
@@ -24,7 +24,7 @@ resource "aws_glue_schema" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `schema_name` – (Required) The Name of the schema.
 * `registry_arn` - (Required) The ARN of the Glue Registry to create the schema in.
@@ -34,9 +34,9 @@ The following arguments are supported:
 * `description` – (Optional) A description of the schema.
 * `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name (ARN) of the schema.
 * `id` - Amazon Resource Name (ARN) of the schema.
@@ -48,8 +48,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Glue Registries can be imported using `arn`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Glue Registries using `arn`. For example:
 
+```terraform
+import {
+  to = aws_glue_schema.example
+  id = "arn:aws:glue:us-west-2:123456789012:schema/example/example"
+}
 ```
-$ terraform import aws_glue_schema.example arn:aws:glue:us-west-2:123456789012:schema/example/example
+
+Using `terraform import`, import Glue Registries using `arn`. For example:
+
+```console
+% terraform import aws_glue_schema.example arn:aws:glue:us-west-2:123456789012:schema/example/example
 ```
diff --git a/website/docs/r/glue_security_configuration.html.markdown b/website/docs/r/glue_security_configuration.html.markdown
index 05a673e0e98..a832fecfb57 100644
--- a/website/docs/r/glue_security_configuration.html.markdown
+++ b/website/docs/r/glue_security_configuration.html.markdown
@@ -35,7 +35,7 @@ resource "aws_glue_security_configuration" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `encryption_configuration` – (Required) Configuration block containing encryption configuration. Detailed below.
 * `name` – (Required) Name of the security configuration.
@@ -61,16 +61,25 @@ The following arguments are supported:
 * `s3_encryption_mode` - (Optional) Encryption mode to use for S3 data. Valid values: `DISABLED`, `SSE-KMS`, `SSE-S3`. Default value: `DISABLED`.
 * `kms_key_arn` - (Optional) Amazon Resource Name (ARN) of the KMS key to be used to encrypt the data.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Glue security configuration name
 
 ## Import
 
-Glue Security Configurations can be imported using `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Glue Security Configurations using `name`. For example:
 
+```terraform
+import {
+  to = aws_glue_security_configuration.example
+  id = "example"
+}
 ```
-$ terraform import aws_glue_security_configuration.example example
+
+Using `terraform import`, import Glue Security Configurations using `name`. For example:
+
+```console
+% terraform import aws_glue_security_configuration.example example
 ```
diff --git a/website/docs/r/glue_trigger.html.markdown b/website/docs/r/glue_trigger.html.markdown
index b1edaf5aedb..3c837cae9b0 100644
--- a/website/docs/r/glue_trigger.html.markdown
+++ b/website/docs/r/glue_trigger.html.markdown
@@ -105,7 +105,7 @@ resource "aws_glue_trigger" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `actions` – (Required) List of actions initiated by this trigger when it fires. See [Actions](#actions) Below.
 * `description` – (Optional) A description of the new trigger.
@@ -150,9 +150,9 @@ The following arguments are supported:
 * `batch_size` - (Required)Number of events that must be received from Amazon EventBridge before EventBridge  event trigger fires.
 * `batch_window` - (Optional) Window of time in seconds after which EventBridge event trigger fires. Window starts when first event is received. Default value is `900`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name (ARN) of Glue Trigger
 * `id` - Trigger name
@@ -168,8 +168,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Glue Triggers can be imported using `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Glue Triggers using `name`. For example:
 
+```terraform
+import {
+  to = aws_glue_trigger.MyTrigger
+  id = "MyTrigger"
+}
 ```
-$ terraform import aws_glue_trigger.MyTrigger MyTrigger
+
+Using `terraform import`, import Glue Triggers using `name`. For example:
+
+```console
+% terraform import aws_glue_trigger.MyTrigger MyTrigger
 ```
diff --git a/website/docs/r/glue_user_defined_function.html.markdown b/website/docs/r/glue_user_defined_function.html.markdown
index e83ce89f2b5..59f25ca9298 100644
--- a/website/docs/r/glue_user_defined_function.html.markdown
+++ b/website/docs/r/glue_user_defined_function.html.markdown
@@ -34,7 +34,7 @@ resource "aws_glue_user_defined_function" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The name of the function.
 * `catalog_id` - (Optional) ID of the Glue Catalog to create the function in. If omitted, this defaults to the AWS Account ID.
@@ -49,9 +49,9 @@ The following arguments are supported:
 * `resource_type` - (Required) The type of the resource. can be one of `JAR`, `FILE`, and `ARCHIVE`.
 * `uri` - (Required) The URI for accessing the resource.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id`- The id of the Glue User Defined Function.
 * `arn`- The ARN of the Glue User Defined Function.
@@ -59,8 +59,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Glue User Defined Functions can be imported using the `catalog_id:database_name:function_name`. If you have not set a Catalog ID specify the AWS Account ID that the database is in, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Glue User Defined Functions using the `catalog_id:database_name:function_name`. If you have not set a Catalog ID specify the AWS Account ID that the database is in. For example:
 
+```terraform
+import {
+  to = aws_glue_user_defined_function.func
+  id = "123456789012:my_database:my_func"
+}
 ```
-$ terraform import aws_glue_user_defined_function.func 123456789012:my_database:my_func
+
+Using `terraform import`, import Glue User Defined Functions using the `catalog_id:database_name:function_name`. If you have not set a Catalog ID specify the AWS Account ID that the database is in. For example:
+
+```console
+% terraform import aws_glue_user_defined_function.func 123456789012:my_database:my_func
 ```
diff --git a/website/docs/r/glue_workflow.html.markdown b/website/docs/r/glue_workflow.html.markdown
index d7b7792bdc4..bb36fb17f87 100644
--- a/website/docs/r/glue_workflow.html.markdown
+++ b/website/docs/r/glue_workflow.html.markdown
@@ -49,7 +49,7 @@ resource "aws_glue_trigger" "example-inner" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` – (Required) The name you assign to this workflow.
 * `default_run_properties` – (Optional) A map of default run properties for this workflow. These properties are passed to all jobs associated to the workflow.
@@ -57,9 +57,9 @@ The following arguments are supported:
 * `max_concurrent_runs` - (Optional) Prevents exceeding the maximum number of concurrent runs of any of the component jobs. If you leave this parameter blank, there is no limit to the number of concurrent workflow runs.
 * `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name (ARN) of Glue Workflow
 * `id` - Workflow name
@@ -67,8 +67,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Glue Workflows can be imported using `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Glue Workflows using `name`. For example:
 
+```terraform
+import {
+  to = aws_glue_workflow.MyWorkflow
+  id = "MyWorkflow"
+}
 ```
-$ terraform import aws_glue_workflow.MyWorkflow MyWorkflow
+
+Using `terraform import`, import Glue Workflows using `name`. For example:
+
+```console
+% terraform import aws_glue_workflow.MyWorkflow MyWorkflow
 ```
diff --git a/website/docs/r/grafana_license_association.html.markdown b/website/docs/r/grafana_license_association.html.markdown
index 6cf40ce4873..07f9854114a 100644
--- a/website/docs/r/grafana_license_association.html.markdown
+++ b/website/docs/r/grafana_license_association.html.markdown
@@ -52,17 +52,26 @@ The following arguments are required:
 * `license_type` - (Required) The type of license for the workspace license association. Valid values are `ENTERPRISE` and `ENTERPRISE_FREE_TRIAL`.
 * `workspace_id` - (Required) The workspace id.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `free_trial_expiration` - If `license_type` is set to `ENTERPRISE_FREE_TRIAL`, this is the expiration date of the free trial.
 * `license_expiration` - If `license_type` is set to `ENTERPRISE`, this is the expiration date of the enterprise license.
 
 ## Import
 
-Grafana workspace license association can be imported using the workspace's `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Grafana workspace license association using the workspace's `id`. For example:
 
+```terraform
+import {
+  to = aws_grafana_license_association.example
+  id = "g-2054c75a02"
+}
 ```
-$ terraform import aws_grafana_license_association.example g-2054c75a02
+
+Using `terraform import`, import Grafana workspace license association using the workspace's `id`. For example:
+
+```console
+% terraform import aws_grafana_license_association.example g-2054c75a02
 ```
diff --git a/website/docs/r/grafana_role_association.html.markdown b/website/docs/r/grafana_role_association.html.markdown
index 5b4995d6d1f..0020c977476 100644
--- a/website/docs/r/grafana_role_association.html.markdown
+++ b/website/docs/r/grafana_role_association.html.markdown
@@ -58,6 +58,6 @@ The following arguments are optional:
 * `group_ids` - (Optional) The AWS SSO group ids to be assigned the role given in `role`.
 * `user_ids` - (Optional) The AWS SSO user ids to be assigned the role given in `role`.
 
-## Attributes Reference
+## Attribute Reference
 
-No additional attributes are exported.
+This resource exports no additional attributes.
diff --git a/website/docs/r/grafana_workspace.html.markdown b/website/docs/r/grafana_workspace.html.markdown
index 448ac4c8d80..52888e5bfdc 100644
--- a/website/docs/r/grafana_workspace.html.markdown
+++ b/website/docs/r/grafana_workspace.html.markdown
@@ -53,7 +53,7 @@ The following arguments are optional:
 * `configuration` - (Optional) The configuration string for the workspace that you create. For more information about the format and configuration options available, see [Working in your Grafana workspace](https://docs.aws.amazon.com/grafana/latest/userguide/AMG-configure-workspace.html).
 * `data_sources` - (Optional) The data sources for the workspace. Valid values are `AMAZON_OPENSEARCH_SERVICE`, `ATHENA`, `CLOUDWATCH`, `PROMETHEUS`, `REDSHIFT`, `SITEWISE`, `TIMESTREAM`, `XRAY`
 * `description` - (Optional) The workspace description.
-* `grafana_version` - (Optional) Specifies the version of Grafana to support in the new workspace. Supported values are `8.4` and `9.4`. If not specified, defaults to `8.4`. Upgrading the workspace version isn't supported, however it's possible to copy content from the old version to the new one using AWS official [migration tool](https://github.com/aws-observability/amazon-managed-grafana-migrator).
+* `grafana_version` - (Optional) Specifies the version of Grafana to support in the new workspace. Supported values are `8.4` and `9.4`. If not specified, defaults to `8.4`.
 * `name` - (Optional) The Grafana workspace name.
 * `network_access_control` - (Optional) Configuration for network access to your workspace.See [Network Access Control](#network-access-control) below.
 * `notification_destinations` - (Optional) The notification destinations. If a data source is specified here, Amazon Managed Grafana will create IAM roles and permissions needed to use these destinations. Must be set to `SNS`.
@@ -74,9 +74,9 @@ The following arguments are optional:
 * `security_group_ids` - (Required) - The list of Amazon EC2 security group IDs attached to the Amazon VPC for your Grafana workspace to connect.
 * `subnet_ids` - (Required) - The list of Amazon EC2 subnet IDs created in the Amazon VPC for your Grafana workspace to connect.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The Amazon Resource Name (ARN) of the Grafana workspace.
 * `endpoint` - The endpoint of the Grafana workspace.
@@ -85,8 +85,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Grafana Workspace can be imported using the workspace's `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Grafana Workspace using the workspace's `id`. For example:
 
+```terraform
+import {
+  to = aws_grafana_workspace.example
+  id = "g-2054c75a02"
+}
 ```
-$ terraform import aws_grafana_workspace.example g-2054c75a02
+
+Using `terraform import`, import Grafana Workspace using the workspace's `id`. For example:
+
+```console
+% terraform import aws_grafana_workspace.example g-2054c75a02
 ```
diff --git a/website/docs/r/grafana_workspace_api_key.html.markdown b/website/docs/r/grafana_workspace_api_key.html.markdown
index 48db2071d92..5acd3c66cbd 100644
--- a/website/docs/r/grafana_workspace_api_key.html.markdown
+++ b/website/docs/r/grafana_workspace_api_key.html.markdown
@@ -32,8 +32,8 @@ The following arguments are required:
 - `seconds_to_live` - (Required) Specifies the time in seconds until the API key expires. Keys can be valid for up to 30 days.
 - `workspace_id` - (Required) The ID of the workspace that the API key is valid for.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `key` - The key token in JSON format. Use this value as a bearer token to authenticate HTTP requests to the workspace.
diff --git a/website/docs/r/grafana_workspace_saml_configuration.html.markdown b/website/docs/r/grafana_workspace_saml_configuration.html.markdown
index b5625b5771c..cb02c7001a4 100644
--- a/website/docs/r/grafana_workspace_saml_configuration.html.markdown
+++ b/website/docs/r/grafana_workspace_saml_configuration.html.markdown
@@ -67,16 +67,25 @@ The following arguments are optional:
 * `org_assertion` - (Optional) The org assertion.
 * `role_assertion` - (Optional) The role assertion.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `status` - The status of the SAML configuration.
 
 ## Import
 
-Grafana Workspace SAML configuration can be imported using the workspace's `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Grafana Workspace SAML configuration using the workspace's `id`. For example:
 
+```terraform
+import {
+  to = aws_grafana_workspace_saml_configuration.example
+  id = "g-2054c75a02"
+}
 ```
-$ terraform import aws_grafana_workspace_saml_configuration.example g-2054c75a02
+
+Using `terraform import`, import Grafana Workspace SAML configuration using the workspace's `id`. For example:
+
+```console
+% terraform import aws_grafana_workspace_saml_configuration.example g-2054c75a02
 ```
diff --git a/website/docs/r/guardduty_detector.html.markdown b/website/docs/r/guardduty_detector.html.markdown
index 3998ec02b72..26f20120faf 100644
--- a/website/docs/r/guardduty_detector.html.markdown
+++ b/website/docs/r/guardduty_detector.html.markdown
@@ -3,12 +3,12 @@ subcategory: "GuardDuty"
 layout: "aws"
 page_title: "AWS: aws_guardduty_detector"
 description: |-
-  Provides a resource to manage a GuardDuty detector
+  Provides a resource to manage an Amazon GuardDuty detector
 ---
 
 # Resource: aws_guardduty_detector
 
-Provides a resource to manage a GuardDuty detector.
+Provides a resource to manage an Amazon GuardDuty detector.
 
 ~> **NOTE:** Deleting this resource is equivalent to "disabling" GuardDuty for an AWS region, which removes all existing findings. You can set the `enable` attribute to `false` to instead "suspend" monitoring and feedback reporting while keeping existing data. See the [Suspending or Disabling Amazon GuardDuty documentation](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_suspend-disable.html) for more information.
 
@@ -40,11 +40,11 @@ resource "aws_guardduty_detector" "MyDetector" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `enable` - (Optional) Enable monitoring and feedback reporting. Setting to `false` is equivalent to "suspending" GuardDuty. Defaults to `true`.
 * `finding_publishing_frequency` - (Optional) Specifies the frequency of notifications sent for subsequent finding occurrences. If the detector is a GuardDuty member account, the value is determined by the GuardDuty primary account and cannot be modified, otherwise defaults to `SIX_HOURS`. For standalone and GuardDuty primary accounts, it must be configured in Terraform to enable drift detection. Valid values for standalone and primary accounts: `FIFTEEN_MINUTES`, `ONE_HOUR`, `SIX_HOURS`. See [AWS Documentation](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_findings_cloudwatch.html#guardduty_findings_cloudwatch_notification_frequency) for more information.
-* `datasources` - (Optional) Describes which data sources will be enabled for the detector. See [Data Sources](#data-sources) below for more details.
+* `datasources` - (Optional) Describes which data sources will be enabled for the detector. See [Data Sources](#data-sources) below for more details. [Deprecated](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-feature-object-api-changes-march2023.html) in favor of [`aws_guardduty_detector_feature` resources](guardduty_detector_feature.html).
 * `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
 ### Data Sources
@@ -58,6 +58,8 @@ The `datasources` block supports the following:
 * `malware_protection` - (Optional) Configures [Malware Protection](https://docs.aws.amazon.com/guardduty/latest/ug/malware-protection.html).
   See [Malware Protection](#malware-protection), [Scan EC2 instance with findings](#scan-ec2-instance-with-findings) and [EBS volumes](#ebs-volumes) below for more details.
 
+The `datasources` block is deprecated since March 2023. Use the `features` block instead and [map each `datasources` block to the corresponding `features` block](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-feature-object-api-changes-march2023.html#guardduty-feature-enablement-datasource-relation).
+
 ### S3 Logs
 
 The `s3_logs` block supports the following:
@@ -100,9 +102,9 @@ The `ebs_volumes` block supports the following:
 * `enable` - (Required) If true, enables [Malware Protection](https://docs.aws.amazon.com/guardduty/latest/ug/malware-protection.html) as data source for the detector.
   Defaults to `true`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `account_id` - The AWS account ID of the GuardDuty detector
 * `arn` - Amazon Resource Name (ARN) of the GuardDuty detector
@@ -111,10 +113,19 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-GuardDuty detectors can be imported using the detector ID, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import GuardDuty detectors using the detector ID. For example:
 
+```terraform
+import {
+  to = aws_guardduty_detector.MyDetector
+  id = "00b00fd5aecc0ab60a708659477e9617"
+}
 ```
-$ terraform import aws_guardduty_detector.MyDetector 00b00fd5aecc0ab60a708659477e9617
+
+Using `terraform import`, import GuardDuty detectors using the detector ID. For example:
+
+```console
+% terraform import aws_guardduty_detector.MyDetector 00b00fd5aecc0ab60a708659477e9617
 ```
 
 The ID of the detector can be retrieved via the [AWS CLI](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/guardduty/list-detectors.html) using `aws guardduty list-detectors`.
diff --git a/website/docs/r/guardduty_detector_feature.html.markdown b/website/docs/r/guardduty_detector_feature.html.markdown
new file mode 100644
index 00000000000..66ee1b5a648
--- /dev/null
+++ b/website/docs/r/guardduty_detector_feature.html.markdown
@@ -0,0 +1,52 @@
+---
+subcategory: "GuardDuty"
+layout: "aws"
+page_title: "AWS: aws_guardduty_detector_feature"
+description: |-
+  Provides a resource to manage an Amazon GuardDuty detector feature
+---
+
+# Resource: aws_guardduty_detector_feature
+
+Provides a resource to manage a single Amazon GuardDuty [detector feature](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-features-activation-model.html#guardduty-features).
+
+~> **NOTE:** Deleting this resource does not disable the detector feature, the resource in simply removed from state instead.
+
+## Example Usage
+
+```terraform
+resource "aws_guardduty_detector" "example" {
+  enable = true
+}
+
+resource "aws_guardduty_detector_feature" "eks_runtime_monitoring" {
+  detector_id = aws_guardduty_detector.example.id
+  name        = "EKS_RUNTIME_MONITORING"
+  status      = "ENABLED"
+
+  additional_configuration {
+    name   = "EKS_ADDON_MANAGEMENT"
+    status = "ENABLED"
+  }
+}
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `detector_id` - (Required) Amazon GuardDuty detector ID.
+* `name` - (Required) The name of the detector feature. Valid values: `S3_DATA_EVENTS`, `EKS_AUDIT_LOGS`, `EBS_MALWARE_PROTECTION`, `RDS_LOGIN_EVENTS`, `EKS_RUNTIME_MONITORING`, `LAMBDA_NETWORK_LOGS`.
+* `status` - (Required) The status of the detector feature. Valid values: `ENABLED`, `DISABLED`.
+* `additional_configuration` - (Optional) Additional feature configuration block. See [below](#additional-configuration).
+
+### Additional Configuration
+
+The `additional_configuration` block supports the following:
+
+* `name` - (Required) The name of the additional configuration. Valid values: `EKS_ADDON_MANAGEMENT`.
+* `status` - (Required) The status of the additional configuration. Valid values: `ENABLED`, `DISABLED`.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
diff --git a/website/docs/r/guardduty_filter.html.markdown b/website/docs/r/guardduty_filter.html.markdown
index 0309dd9db87..37bd6fb625c 100644
--- a/website/docs/r/guardduty_filter.html.markdown
+++ b/website/docs/r/guardduty_filter.html.markdown
@@ -46,7 +46,7 @@ resource "aws_guardduty_filter" "MyFilter" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `detector_id` - (Required) ID of a GuardDuty detector, attached to your account.
 * `name` - (Required) The name of your filter.
@@ -68,9 +68,9 @@ The `criterion` block suports the following:
 * `less_than` - (Optional) A value to be evaluated. Accepts either an integer or a date in [RFC 3339 format](https://tools.ietf.org/html/rfc3339#section-5.8).
 * `less_than_or_equal` - (Optional) A value to be evaluated. Accepts either an integer or a date in [RFC 3339 format](https://tools.ietf.org/html/rfc3339#section-5.8).
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The ARN of the GuardDuty filter.
 * `id` - A compound field, consisting of the ID of the GuardDuty detector and the name of the filter.
@@ -78,8 +78,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-GuardDuty filters can be imported using the detector ID and filter's name separated by a colon, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import GuardDuty filters using the detector ID and filter's name separated by a colon. For example:
 
+```terraform
+import {
+  to = aws_guardduty_filter.MyFilter
+  id = "00b00fd5aecc0ab60a708659477e9617:MyFilter"
+}
 ```
-$ terraform import aws_guardduty_filter.MyFilter 00b00fd5aecc0ab60a708659477e9617:MyFilter
+
+Using `terraform import`, import GuardDuty filters using the detector ID and filter's name separated by a colon. For example:
+
+```console
+% terraform import aws_guardduty_filter.MyFilter 00b00fd5aecc0ab60a708659477e9617:MyFilter
 ```
diff --git a/website/docs/r/guardduty_invite_accepter.html.markdown b/website/docs/r/guardduty_invite_accepter.html.markdown
index 829e14ea9f6..afc4a179bfe 100644
--- a/website/docs/r/guardduty_invite_accepter.html.markdown
+++ b/website/docs/r/guardduty_invite_accepter.html.markdown
@@ -48,14 +48,14 @@ resource "aws_guardduty_detector" "member" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `detector_id` - (Required) The detector ID of the member GuardDuty account.
 * `master_account_id` - (Required) AWS account ID for primary account.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - GuardDuty member detector ID
 
@@ -67,8 +67,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_guardduty_invite_accepter` can be imported using the member GuardDuty detector ID, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_guardduty_invite_accepter` using the member GuardDuty detector ID. For example:
 
+```terraform
+import {
+  to = aws_guardduty_invite_accepter.member
+  id = "00b00fd5aecc0ab60a708659477e9617"
+}
 ```
-$ terraform import aws_guardduty_invite_accepter.member 00b00fd5aecc0ab60a708659477e9617
+
+Using `terraform import`, import `aws_guardduty_invite_accepter` using the member GuardDuty detector ID. For example:
+
+```console
+% terraform import aws_guardduty_invite_accepter.member 00b00fd5aecc0ab60a708659477e9617
 ```
diff --git a/website/docs/r/guardduty_ipset.html.markdown b/website/docs/r/guardduty_ipset.html.markdown
index 19d83f9585c..6e01851730b 100644
--- a/website/docs/r/guardduty_ipset.html.markdown
+++ b/website/docs/r/guardduty_ipset.html.markdown
@@ -44,7 +44,7 @@ resource "aws_s3_object" "MyIPSet" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `activate` - (Required) Specifies whether GuardDuty is to start using the uploaded IPSet.
 * `detector_id` - (Required) The detector ID of the GuardDuty.
@@ -53,9 +53,9 @@ The following arguments are supported:
 * `name` - (Required) The friendly name to identify the IPSet.
 * `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name (ARN) of the GuardDuty IPSet.
 * `id` - The ID of the GuardDuty IPSet.
@@ -63,8 +63,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-GuardDuty IPSet can be imported using the primary GuardDuty detector ID and IPSet ID, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import GuardDuty IPSet using the primary GuardDuty detector ID and IPSet ID. For example:
 
+```terraform
+import {
+  to = aws_guardduty_ipset.MyIPSet
+  id = "00b00fd5aecc0ab60a708659477e9617:123456789012"
+}
 ```
-$ terraform import aws_guardduty_ipset.MyIPSet 00b00fd5aecc0ab60a708659477e9617:123456789012
+
+Using `terraform import`, import GuardDuty IPSet using the primary GuardDuty detector ID and IPSet ID. For example:
+
+```console
+% terraform import aws_guardduty_ipset.MyIPSet 00b00fd5aecc0ab60a708659477e9617:123456789012
 ```
diff --git a/website/docs/r/guardduty_member.html.markdown b/website/docs/r/guardduty_member.html.markdown
index 639bff5a2dc..858ebfc26a6 100644
--- a/website/docs/r/guardduty_member.html.markdown
+++ b/website/docs/r/guardduty_member.html.markdown
@@ -34,7 +34,7 @@ resource "aws_guardduty_member" "member" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `account_id` - (Required) AWS account ID for member account.
 * `detector_id` - (Required) The detector ID of the GuardDuty account where you want to create member accounts.
@@ -43,9 +43,9 @@ The following arguments are supported:
 * `invitation_message` - (Optional) Message for invitation.
 * `disable_email_notification` - (Optional) Boolean whether an email notification is sent to the accounts. Defaults to `false`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the GuardDuty member
 * `relationship_status` - The status of the relationship between the member account and its primary account. More information can be found in [Amazon GuardDuty API Reference](https://docs.aws.amazon.com/guardduty/latest/ug/get-members.html).
@@ -59,8 +59,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-GuardDuty members can be imported using the primary GuardDuty detector ID and member AWS account ID, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import GuardDuty members using the primary GuardDuty detector ID and member AWS account ID. For example:
 
+```terraform
+import {
+  to = aws_guardduty_member.MyMember
+  id = "00b00fd5aecc0ab60a708659477e9617:123456789012"
+}
 ```
-$ terraform import aws_guardduty_member.MyMember 00b00fd5aecc0ab60a708659477e9617:123456789012
+
+Using `terraform import`, import GuardDuty members using the primary GuardDuty detector ID and member AWS account ID. For example:
+
+```console
+% terraform import aws_guardduty_member.MyMember 00b00fd5aecc0ab60a708659477e9617:123456789012
 ```
diff --git a/website/docs/r/guardduty_organization_admin_account.html.markdown b/website/docs/r/guardduty_organization_admin_account.html.markdown
index 17df166478c..181bf3be031 100644
--- a/website/docs/r/guardduty_organization_admin_account.html.markdown
+++ b/website/docs/r/guardduty_organization_admin_account.html.markdown
@@ -29,20 +29,29 @@ resource "aws_guardduty_organization_admin_account" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `admin_account_id` - (Required) AWS account identifier to designate as a delegated administrator for GuardDuty.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - AWS account identifier.
 
 ## Import
 
-GuardDuty Organization Admin Account can be imported using the AWS account ID, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import GuardDuty Organization Admin Account using the AWS account ID. For example:
 
+```terraform
+import {
+  to = aws_guardduty_organization_admin_account.example
+  id = "123456789012"
+}
 ```
-$ terraform import aws_guardduty_organization_admin_account.example 123456789012
+
+Using `terraform import`, import GuardDuty Organization Admin Account using the AWS account ID. For example:
+
+```console
+% terraform import aws_guardduty_organization_admin_account.example 123456789012
 ```
diff --git a/website/docs/r/guardduty_organization_configuration.html.markdown b/website/docs/r/guardduty_organization_configuration.html.markdown
index eb5af6bca21..886e55194b3 100644
--- a/website/docs/r/guardduty_organization_configuration.html.markdown
+++ b/website/docs/r/guardduty_organization_configuration.html.markdown
@@ -48,7 +48,7 @@ resource "aws_guardduty_organization_configuration" "example" {
 
 ~> **NOTE:** One of `auto_enable` or `auto_enable_organization_members` must be specified.
 
-The following arguments are supported:
+This argument supports the following arguments:
 
 * `auto_enable` - (Optional) *Deprecated:* Use `auto_enable_organization_members` instead. When this setting is enabled, all new accounts that are created in, or added to, the organization are added as a member accounts of the organization’s GuardDuty delegated administrator and GuardDuty is enabled in that AWS Region.
 * `auto_enable_organization_members` - (Optional) Indicates the auto-enablement configuration of GuardDuty for the member accounts in the organization. Valid values are `ALL`, `NEW`, `NONE`.
@@ -102,16 +102,25 @@ The `ebs_volumes` block supports the following:
 * `auto_enable` - (Required) If true, enables [Malware Protection](https://docs.aws.amazon.com/guardduty/latest/ug/malware-protection.html) for all new accounts joining the organization.
   Defaults to `true`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Identifier of the GuardDuty Detector.
 
 ## Import
 
-GuardDuty Organization Configurations can be imported using the GuardDuty Detector ID, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import GuardDuty Organization Configurations using the GuardDuty Detector ID. For example:
 
+```terraform
+import {
+  to = aws_guardduty_organization_configuration.example
+  id = "00b00fd5aecc0ab60a708659477e9617"
+}
 ```
-$ terraform import aws_guardduty_organization_configuration.example 00b00fd5aecc0ab60a708659477e9617
+
+Using `terraform import`, import GuardDuty Organization Configurations using the GuardDuty Detector ID. For example:
+
+```console
+% terraform import aws_guardduty_organization_configuration.example 00b00fd5aecc0ab60a708659477e9617
 ```
diff --git a/website/docs/r/guardduty_organization_configuration_feature.html.markdown b/website/docs/r/guardduty_organization_configuration_feature.html.markdown
new file mode 100644
index 00000000000..c57da5cc329
--- /dev/null
+++ b/website/docs/r/guardduty_organization_configuration_feature.html.markdown
@@ -0,0 +1,52 @@
+---
+subcategory: "GuardDuty"
+layout: "aws"
+page_title: "AWS: aws_guardduty_organization_configuration_feature"
+description: |-
+  Provides a resource to manage an Amazon GuardDuty organization configuration feature
+---
+
+# Resource: aws_guardduty_organization_configuration_feature
+
+Provides a resource to manage a single Amazon GuardDuty [organization configuration feature](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-features-activation-model.html#guardduty-features).
+
+~> **NOTE:** Deleting this resource does not disable the organization configuration feature, the resource in simply removed from state instead.
+
+## Example Usage
+
+```terraform
+resource "aws_guardduty_detector" "example" {
+  enable = true
+}
+
+resource "aws_guardduty_organization_configuration_feature" "eks_runtime_monitoring" {
+  detector_id = aws_guardduty_detector.example.id
+  name        = "EKS_RUNTIME_MONITORING"
+  auto_enable = "ALL"
+
+  additional_configuration {
+    name        = "EKS_ADDON_MANAGEMENT"
+    auto_enable = "NEW"
+  }
+}
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `auto_enable` - (Required) The status of the feature that is configured for the member accounts within the organization. Valid values: `NEW`, `ALL`, `NONE`.
+* `detector_id` - (Required) The ID of the detector that configures the delegated administrator.
+* `name` - (Required) The name of the feature that will be configured for the organization. Valid values: `S3_DATA_EVENTS`, `EKS_AUDIT_LOGS`, `EBS_MALWARE_PROTECTION`, `RDS_LOGIN_EVENTS`, `EKS_RUNTIME_MONITORING`, `LAMBDA_NETWORK_LOGS`.
+* `additional_configuration` - (Optional) The additional information that will be configured for the organization See [below](#additional-configuration).
+
+### Additional Configuration
+
+The `additional_configuration` block supports the following:
+
+* `auto_enable` - (Required) The status of the additional configuration that will be configured for the organization. Valid values: `NEW`, `ALL`, `NONE`.
+* `name` - (Required) The name of the additional configuration that will be configured for the organization. Valid values: `EKS_ADDON_MANAGEMENT`.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
diff --git a/website/docs/r/guardduty_publishing_destination.html.markdown b/website/docs/r/guardduty_publishing_destination.html.markdown
index 7f3f0d8f8d5..1fc806ab409 100644
--- a/website/docs/r/guardduty_publishing_destination.html.markdown
+++ b/website/docs/r/guardduty_publishing_destination.html.markdown
@@ -126,7 +126,7 @@ resource "aws_guardduty_publishing_destination" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `detector_id` - (Required) The detector ID of the GuardDuty.
 * `destination_arn` - (Required) The bucket arn and prefix under which the findings get exported. Bucket-ARN is required, the prefix is optional and will be `AWSLogs/[Account-ID]/GuardDuty/[Region]/` if not provided
@@ -135,16 +135,25 @@ The following arguments are supported:
 
 ~> **Note:** In case of missing permissions (S3 Bucket Policy _or_ KMS Key permissions) the resource will fail to create. If the permissions are changed after resource creation, this can be asked from the AWS API via the "DescribePublishingDestination" call (https://docs.aws.amazon.com/cli/latest/reference/guardduty/describe-publishing-destination.html).
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the GuardDuty PublishingDestination and the detector ID. Format: `<DetectorID>:<PublishingDestinationID>`
 
 ## Import
 
-GuardDuty PublishingDestination can be imported using the master GuardDuty detector ID and PublishingDestinationID, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import GuardDuty PublishingDestination using the master GuardDuty detector ID and PublishingDestinationID. For example:
 
+```terraform
+import {
+  to = aws_guardduty_publishing_destination.test
+  id = "a4b86f26fa42e7e7cf0d1c333ea77777:a4b86f27a0e464e4a7e0516d242f1234"
+}
 ```
-$ terraform import aws_guardduty_publishing_destination.test a4b86f26fa42e7e7cf0d1c333ea77777:a4b86f27a0e464e4a7e0516d242f1234
+
+Using `terraform import`, import GuardDuty PublishingDestination using the master GuardDuty detector ID and PublishingDestinationID. For example:
+
+```console
+% terraform import aws_guardduty_publishing_destination.test a4b86f26fa42e7e7cf0d1c333ea77777:a4b86f27a0e464e4a7e0516d242f1234
 ```
diff --git a/website/docs/r/guardduty_threatintelset.html.markdown b/website/docs/r/guardduty_threatintelset.html.markdown
index 39e46c3bd37..928b8fdb4de 100644
--- a/website/docs/r/guardduty_threatintelset.html.markdown
+++ b/website/docs/r/guardduty_threatintelset.html.markdown
@@ -45,7 +45,7 @@ resource "aws_guardduty_threatintelset" "MyThreatIntelSet" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `activate` - (Required) Specifies whether GuardDuty is to start using the uploaded ThreatIntelSet.
 * `detector_id` - (Required) The detector ID of the GuardDuty.
@@ -54,9 +54,9 @@ The following arguments are supported:
 * `name` - (Required) The friendly name to identify the ThreatIntelSet.
 * `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name (ARN) of the GuardDuty ThreatIntelSet.
 * `id` - The ID of the GuardDuty ThreatIntelSet and the detector ID. Format: `<DetectorID>:<ThreatIntelSetID>`
@@ -64,8 +64,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-GuardDuty ThreatIntelSet can be imported using the primary GuardDuty detector ID and ThreatIntelSetID, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import GuardDuty ThreatIntelSet using the primary GuardDuty detector ID and ThreatIntelSetID. For example:
 
+```terraform
+import {
+  to = aws_guardduty_threatintelset.MyThreatIntelSet
+  id = "00b00fd5aecc0ab60a708659477e9617:123456789012"
+}
 ```
-$ terraform import aws_guardduty_threatintelset.MyThreatIntelSet 00b00fd5aecc0ab60a708659477e9617:123456789012
+
+Using `terraform import`, import GuardDuty ThreatIntelSet using the primary GuardDuty detector ID and ThreatIntelSetID. For example:
+
+```console
+% terraform import aws_guardduty_threatintelset.MyThreatIntelSet 00b00fd5aecc0ab60a708659477e9617:123456789012
 ```
diff --git a/website/docs/r/iam_access_key.html.markdown b/website/docs/r/iam_access_key.html.markdown
index 481ccbe3e28..c8117a5180d 100644
--- a/website/docs/r/iam_access_key.html.markdown
+++ b/website/docs/r/iam_access_key.html.markdown
@@ -59,15 +59,15 @@ output "aws_iam_smtp_password_v4" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `pgp_key` - (Optional) Either a base-64 encoded PGP public key, or a keybase username in the form `keybase:some_person_that_exists`, for use in the `encrypted_secret` output attribute. If providing a base-64 encoded PGP public key, make sure to provide the "raw" version and not the "armored" one (e.g. avoid passing the `-a` option to `gpg --export`).
 * `status` - (Optional) Access key status to apply. Defaults to `Active`. Valid values are `Active` and `Inactive`.
 * `user` - (Required) IAM user to associate with this access key.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `create_date` - Date and time in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8) that the access key was created.
 * `encrypted_secret` - Encrypted secret, base64 encoded, if `pgp_key` was specified. This attribute is not available for imported resources. The encrypted secret may be decrypted using the command line, for example: `terraform output -raw encrypted_secret | base64 --decode | keybase pgp decrypt`.
@@ -79,10 +79,19 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-IAM Access Keys can be imported using the identifier, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IAM Access Keys using the identifier. For example:
 
+```terraform
+import {
+  to = aws_iam_access_key.example
+  id = "AKIA1234567890"
+}
 ```
-$ terraform import aws_iam_access_key.example AKIA1234567890
+
+Using `terraform import`, import IAM Access Keys using the identifier. For example:
+
+```console
+% terraform import aws_iam_access_key.example AKIA1234567890
 ```
 
 Resource attributes such as `encrypted_secret`, `key_fingerprint`, `pgp_key`, `secret`, `ses_smtp_password_v4`, and `encrypted_ses_smtp_password_v4` are not available for imported resources as this information cannot be read from the IAM API.
diff --git a/website/docs/r/iam_account_alias.html.markdown b/website/docs/r/iam_account_alias.html.markdown
index 479022a9309..35c10e921ce 100644
--- a/website/docs/r/iam_account_alias.html.markdown
+++ b/website/docs/r/iam_account_alias.html.markdown
@@ -22,18 +22,27 @@ resource "aws_iam_account_alias" "alias" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `account_alias` - (Required) The account alias
 
-## Attributes Reference
+## Attribute Reference
 
-No additional attributes are exported.
+This resource exports no additional attributes.
 
 ## Import
 
-The current Account Alias can be imported using the `account_alias`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import the current Account Alias using the `account_alias`. For example:
 
+```terraform
+import {
+  to = aws_iam_account_alias.alias
+  id = "my-account-alias"
+}
 ```
-$ terraform import aws_iam_account_alias.alias my-account-alias
+
+Using `terraform import`, import the current Account Alias using the `account_alias`. For example:
+
+```console
+% terraform import aws_iam_account_alias.alias my-account-alias
 ```
diff --git a/website/docs/r/iam_account_password_policy.html.markdown b/website/docs/r/iam_account_password_policy.html.markdown
index 313759bcba5..22c58df4d37 100644
--- a/website/docs/r/iam_account_password_policy.html.markdown
+++ b/website/docs/r/iam_account_password_policy.html.markdown
@@ -29,7 +29,7 @@ resource "aws_iam_account_password_policy" "strict" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `allow_users_to_change_password` - (Optional) Whether to allow users to change their own password
 * `hard_expiry` - (Optional) Whether users are prevented from setting a new password after their password has expired (i.e., require administrator reset)
@@ -41,16 +41,25 @@ The following arguments are supported:
 * `require_symbols` - (Optional) Whether to require symbols for user passwords.
 * `require_uppercase_characters` - (Optional) Whether to require uppercase characters for user passwords.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `expire_passwords` - Indicates whether passwords in the account expire. Returns `true` if `max_password_age` contains a value greater than `0`. Returns `false` if it is `0` or _not present_.
 
 ## Import
 
-IAM Account Password Policy can be imported using the word `iam-account-password-policy`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IAM Account Password Policy using the word `iam-account-password-policy`. For example:
 
+```terraform
+import {
+  to = aws_iam_account_password_policy.strict
+  id = "iam-account-password-policy"
+}
 ```
-$ terraform import aws_iam_account_password_policy.strict iam-account-password-policy
+
+Using `terraform import`, import IAM Account Password Policy using the word `iam-account-password-policy`. For example:
+
+```console
+% terraform import aws_iam_account_password_policy.strict iam-account-password-policy
 ```
diff --git a/website/docs/r/iam_group.html.markdown b/website/docs/r/iam_group.html.markdown
index 0a8e35bf7a7..c471c4b7e22 100644
--- a/website/docs/r/iam_group.html.markdown
+++ b/website/docs/r/iam_group.html.markdown
@@ -23,14 +23,14 @@ resource "aws_iam_group" "developers" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The group's name. The name must consist of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: `=,.@-_.`. Group names are not distinguished by case. For example, you cannot create groups named both "ADMINS" and "admins".
 * `path` - (Optional, default "/") Path in which to create the group.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The group's ID.
 * `arn` - The ARN assigned by AWS for this group.
@@ -42,8 +42,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-IAM Groups can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IAM Groups using the `name`. For example:
 
+```terraform
+import {
+  to = aws_iam_group.developers
+  id = "developers"
+}
 ```
-$ terraform import aws_iam_group.developers developers
+
+Using `terraform import`, import IAM Groups using the `name`. For example:
+
+```console
+% terraform import aws_iam_group.developers developers
 ```
diff --git a/website/docs/r/iam_group_membership.html.markdown b/website/docs/r/iam_group_membership.html.markdown
index 371ddceac55..c520b8c645c 100644
--- a/website/docs/r/iam_group_membership.html.markdown
+++ b/website/docs/r/iam_group_membership.html.markdown
@@ -46,15 +46,15 @@ resource "aws_iam_user" "user_two" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The name to identify the Group Membership
 * `users` - (Required) A list of IAM User names to associate with the Group
 * `group` – (Required) The IAM Group name to attach the list of `users` to
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `name` - The name to identify the Group Membership
 * `users` - list of IAM User names
diff --git a/website/docs/r/iam_group_policy.html.markdown b/website/docs/r/iam_group_policy.html.markdown
index 4e6c252216e..912157cc7a4 100644
--- a/website/docs/r/iam_group_policy.html.markdown
+++ b/website/docs/r/iam_group_policy.html.markdown
@@ -41,7 +41,7 @@ resource "aws_iam_group" "my_developers" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `policy` - (Required) The policy document. This is a JSON formatted string. For more information about building IAM policy documents with Terraform, see the [AWS IAM Policy Document Guide](https://learn.hashicorp.com/terraform/aws/iam-policy)
 * `name` - (Optional) The name of the policy. If omitted, Terraform will
@@ -50,9 +50,9 @@ assign a random, unique name.
   prefix. Conflicts with `name`.
 * `group` - (Required) The IAM group to attach to the policy.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The group policy ID.
 * `group` - The group to which this policy applies.
@@ -61,8 +61,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-IAM Group Policies can be imported using the `group_name:group_policy_name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IAM Group Policies using the `group_name:group_policy_name`. For example:
 
+```terraform
+import {
+  to = aws_iam_group_policy.mypolicy
+  id = "group_of_mypolicy_name:mypolicy_name"
+}
 ```
-$ terraform import aws_iam_group_policy.mypolicy group_of_mypolicy_name:mypolicy_name
+
+Using `terraform import`, import IAM Group Policies using the `group_name:group_policy_name`. For example:
+
+```console
+% terraform import aws_iam_group_policy.mypolicy group_of_mypolicy_name:mypolicy_name
 ```
diff --git a/website/docs/r/iam_group_policy_attachment.html.markdown b/website/docs/r/iam_group_policy_attachment.html.markdown
new file mode 100644
index 00000000000..f29724c0def
--- /dev/null
+++ b/website/docs/r/iam_group_policy_attachment.html.markdown
@@ -0,0 +1,60 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_group_policy_attachment"
+description: |-
+  Attaches a Managed IAM Policy to an IAM group
+---
+
+# Resource: aws_iam_group_policy_attachment
+
+Attaches a Managed IAM Policy to an IAM group
+
+~> **NOTE:** The usage of this resource conflicts with the `aws_iam_policy_attachment` resource and will permanently show a difference if both are defined.
+
+## Example Usage
+
+```terraform
+resource "aws_iam_group" "group" {
+  name = "test-group"
+}
+
+resource "aws_iam_policy" "policy" {
+  name        = "test-policy"
+  description = "A test policy"
+  policy      = "{ ... policy JSON ... }"
+}
+
+resource "aws_iam_group_policy_attachment" "test-attach" {
+  group      = aws_iam_group.group.name
+  policy_arn = aws_iam_policy.policy.arn
+}
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `group`  (Required) - The group the policy should be applied to
+* `policy_arn`  (Required) - The ARN of the policy you want to apply
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IAM group policy attachments using the group name and policy arn separated by `/`. For example:
+
+```terraform
+import {
+  to = aws_iam_group_policy_attachment.test-attach
+  id = "test-group/arn:aws:iam::xxxxxxxxxxxx:policy/test-policy"
+}
+```
+
+Using `terraform import`, import IAM group policy attachments using the group name and policy arn separated by `/`. For example:
+
+```console
+% terraform import aws_iam_group_policy_attachment.test-attach test-group/arn:aws:iam::xxxxxxxxxxxx:policy/test-policy
+```
diff --git a/website/docs/r/iam_group_policy_attachment.markdown b/website/docs/r/iam_group_policy_attachment.markdown
deleted file mode 100644
index b060a7f3870..00000000000
--- a/website/docs/r/iam_group_policy_attachment.markdown
+++ /dev/null
@@ -1,51 +0,0 @@
----
-subcategory: "IAM (Identity & Access Management)"
-layout: "aws"
-page_title: "AWS: aws_iam_group_policy_attachment"
-description: |-
-  Attaches a Managed IAM Policy to an IAM group
----
-
-# Resource: aws_iam_group_policy_attachment
-
-Attaches a Managed IAM Policy to an IAM group
-
-~> **NOTE:** The usage of this resource conflicts with the `aws_iam_policy_attachment` resource and will permanently show a difference if both are defined.
-
-## Example Usage
-
-```terraform
-resource "aws_iam_group" "group" {
-  name = "test-group"
-}
-
-resource "aws_iam_policy" "policy" {
-  name        = "test-policy"
-  description = "A test policy"
-  policy      = "{ ... policy JSON ... }"
-}
-
-resource "aws_iam_group_policy_attachment" "test-attach" {
-  group      = aws_iam_group.group.name
-  policy_arn = aws_iam_policy.policy.arn
-}
-```
-
-## Argument Reference
-
-The following arguments are supported:
-
-* `group`  (Required) - The group the policy should be applied to
-* `policy_arn`  (Required) - The ARN of the policy you want to apply
-
-## Attributes Reference
-
-No additional attributes are exported.
-
-## Import
-
-IAM group policy attachments can be imported using the group name and policy arn separated by `/`.
-
-```
-$ terraform import aws_iam_group_policy_attachment.test-attach test-group/arn:aws:iam::xxxxxxxxxxxx:policy/test-policy
-```
diff --git a/website/docs/r/iam_instance_profile.html.markdown b/website/docs/r/iam_instance_profile.html.markdown
index 93121b8795c..5f29f0ef9dc 100644
--- a/website/docs/r/iam_instance_profile.html.markdown
+++ b/website/docs/r/iam_instance_profile.html.markdown
@@ -48,9 +48,9 @@ The following arguments are optional:
 * `role` - (Optional) Name of the role to add to the profile.
 * `tags` - (Optional) Map of resource tags for the IAM Instance Profile. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN assigned by AWS to the instance profile.
 * `create_date` - Creation timestamp of the instance profile.
@@ -62,8 +62,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Instance Profiles can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Instance Profiles using the `name`. For example:
 
+```terraform
+import {
+  to = aws_iam_instance_profile.test_profile
+  id = "app-instance-profile-1"
+}
 ```
-$ terraform import aws_iam_instance_profile.test_profile app-instance-profile-1
+
+Using `terraform import`, import Instance Profiles using the `name`. For example:
+
+```console
+% terraform import aws_iam_instance_profile.test_profile app-instance-profile-1
 ```
diff --git a/website/docs/r/iam_openid_connect_provider.html.markdown b/website/docs/r/iam_openid_connect_provider.html.markdown
index 9681c5bc0eb..e605f2f17aa 100644
--- a/website/docs/r/iam_openid_connect_provider.html.markdown
+++ b/website/docs/r/iam_openid_connect_provider.html.markdown
@@ -26,24 +26,33 @@ resource "aws_iam_openid_connect_provider" "default" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `url` - (Required) The URL of the identity provider. Corresponds to the _iss_ claim.
 * `client_id_list` - (Required) A list of client IDs (also known as audiences). When a mobile or web app registers with an OpenID Connect provider, they establish a value that identifies the application. (This is the value that's sent as the client_id parameter on OAuth requests.)
 * `thumbprint_list` - (Required) A list of server certificate thumbprints for the OpenID Connect (OIDC) identity provider's server certificate(s).
 * `tags` - (Optional) Map of resource tags for the IAM OIDC provider. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The ARN assigned by AWS for this provider.
 * `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
 
 ## Import
 
-IAM OpenID Connect Providers can be imported using the `arn`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IAM OpenID Connect Providers using the `arn`. For example:
 
+```terraform
+import {
+  to = aws_iam_openid_connect_provider.default
+  id = "arn:aws:iam::123456789012:oidc-provider/accounts.google.com"
+}
 ```
-$ terraform import aws_iam_openid_connect_provider.default arn:aws:iam::123456789012:oidc-provider/accounts.google.com
+
+Using `terraform import`, import IAM OpenID Connect Providers using the `arn`. For example:
+
+```console
+% terraform import aws_iam_openid_connect_provider.default arn:aws:iam::123456789012:oidc-provider/accounts.google.com
 ```
diff --git a/website/docs/r/iam_policy.html.markdown b/website/docs/r/iam_policy.html.markdown
index 5df224c8113..f133459c0f0 100644
--- a/website/docs/r/iam_policy.html.markdown
+++ b/website/docs/r/iam_policy.html.markdown
@@ -37,7 +37,7 @@ resource "aws_iam_policy" "policy" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `description` - (Optional, Forces new resource) Description of the IAM policy.
 * `name` - (Optional, Forces new resource) The name of the policy. If omitted, Terraform will assign a random, unique name.
@@ -47,9 +47,9 @@ The following arguments are supported:
 * `policy` - (Required) The policy document. This is a JSON formatted string. For more information about building AWS IAM policy documents with Terraform, see the [AWS IAM Policy Document Guide](https://learn.hashicorp.com/terraform/aws/iam-policy)
 * `tags` - (Optional) Map of resource tags for the IAM Policy. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ARN assigned by AWS to this policy.
 * `arn` - The ARN assigned by AWS to this policy.
@@ -62,8 +62,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-IAM Policies can be imported using the `arn`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IAM Policies using the `arn`. For example:
 
+```terraform
+import {
+  to = aws_iam_policy.administrator
+  id = "arn:aws:iam::123456789012:policy/UsersManageOwnCredentials"
+}
 ```
-$ terraform import aws_iam_policy.administrator arn:aws:iam::123456789012:policy/UsersManageOwnCredentials
+
+Using `terraform import`, import IAM Policies using the `arn`. For example:
+
+```console
+% terraform import aws_iam_policy.administrator arn:aws:iam::123456789012:policy/UsersManageOwnCredentials
 ```
diff --git a/website/docs/r/iam_policy_attachment.html.markdown b/website/docs/r/iam_policy_attachment.html.markdown
index e5414264eb1..13438de93c5 100644
--- a/website/docs/r/iam_policy_attachment.html.markdown
+++ b/website/docs/r/iam_policy_attachment.html.markdown
@@ -70,7 +70,7 @@ resource "aws_iam_policy_attachment" "test-attach" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name`    (Required) - The name of the attachment. This cannot be an empty string.
 * `users`   (Optional) - The user(s) the policy should be applied to
@@ -78,9 +78,9 @@ The following arguments are supported:
 * `groups`  (Optional) - The group(s) the policy should be applied to
 * `policy_arn`  (Required) - The ARN of the policy you want to apply
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The policy's ID.
 * `name` - The name of the attachment.
diff --git a/website/docs/r/iam_role.html.markdown b/website/docs/r/iam_role.html.markdown
index 0580c5852f0..bc37ca990ff 100644
--- a/website/docs/r/iam_role.html.markdown
+++ b/website/docs/r/iam_role.html.markdown
@@ -200,9 +200,9 @@ This configuration block supports the following:
 * `name` - (Required) Name of the role policy.
 * `policy` - (Required) Policy document as a JSON formatted string. For more information about building IAM policy documents with Terraform, see the [AWS IAM Policy Document Guide](https://learn.hashicorp.com/tutorials/terraform/aws-iam-policy).
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name (ARN) specifying the role.
 * `create_date` - Creation date of the IAM role.
@@ -213,8 +213,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-IAM Roles can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IAM Roles using the `name`. For example:
 
+```terraform
+import {
+  to = aws_iam_role.developer
+  id = "developer_name"
+}
 ```
-$ terraform import aws_iam_role.developer developer_name
+
+Using `terraform import`, import IAM Roles using the `name`. For example:
+
+```console
+% terraform import aws_iam_role.developer developer_name
 ```
diff --git a/website/docs/r/iam_role_policy.html.markdown b/website/docs/r/iam_role_policy.html.markdown
index 19de1951a26..04b7aa81856 100644
--- a/website/docs/r/iam_role_policy.html.markdown
+++ b/website/docs/r/iam_role_policy.html.markdown
@@ -56,7 +56,7 @@ resource "aws_iam_role" "test_role" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Optional) The name of the role policy. If omitted, Terraform will
 assign a random, unique name.
@@ -65,9 +65,9 @@ assign a random, unique name.
 * `policy` - (Required) The inline policy document. This is a JSON formatted string. For more information about building IAM policy documents with Terraform, see the [AWS IAM Policy Document Guide](https://learn.hashicorp.com/terraform/aws/iam-policy)
 * `role` - (Required) The name of the IAM role to attach to the policy.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The role policy ID, in the form of `role_name:role_policy_name`.
 * `name` - The name of the policy.
@@ -76,8 +76,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-IAM Role Policies can be imported using the `role_name:role_policy_name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IAM Role Policies using the `role_name:role_policy_name`. For example:
 
+```terraform
+import {
+  to = aws_iam_role_policy.mypolicy
+  id = "role_of_mypolicy_name:mypolicy_name"
+}
 ```
-$ terraform import aws_iam_role_policy.mypolicy role_of_mypolicy_name:mypolicy_name
+
+Using `terraform import`, import IAM Role Policies using the `role_name:role_policy_name`. For example:
+
+```console
+% terraform import aws_iam_role_policy.mypolicy role_of_mypolicy_name:mypolicy_name
 ```
diff --git a/website/docs/r/iam_role_policy_attachment.html.markdown b/website/docs/r/iam_role_policy_attachment.html.markdown
new file mode 100644
index 00000000000..2e900f5db31
--- /dev/null
+++ b/website/docs/r/iam_role_policy_attachment.html.markdown
@@ -0,0 +1,84 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_role_policy_attachment"
+description: |-
+  Attaches a Managed IAM Policy to an IAM role
+---
+
+# Resource: aws_iam_role_policy_attachment
+
+Attaches a Managed IAM Policy to an IAM role
+
+~> **NOTE:** The usage of this resource conflicts with the `aws_iam_policy_attachment` resource and will permanently show a difference if both are defined.
+
+~> **NOTE:** For a given role, this resource is incompatible with using the [`aws_iam_role` resource](/docs/providers/aws/r/iam_role.html) `managed_policy_arns` argument. When using that argument and this resource, both will attempt to manage the role's managed policy attachments and Terraform will show a permanent difference.
+
+## Example Usage
+
+```terraform
+data "aws_iam_policy_document" "assume_role" {
+  statement {
+    effect = "Allow"
+
+    principals {
+      type        = "Service"
+      identifiers = ["ec2.amazonaws.com"]
+    }
+
+    actions = ["sts:AssumeRole"]
+  }
+}
+
+resource "aws_iam_role" "role" {
+  name               = "test-role"
+  assume_role_policy = data.aws_iam_policy_document.assume_role.json
+}
+
+data "aws_iam_policy_document" "policy" {
+  statement {
+    effect    = "Allow"
+    actions   = ["ec2:Describe*"]
+    resources = ["*"]
+  }
+}
+
+resource "aws_iam_policy" "policy" {
+  name        = "test-policy"
+  description = "A test policy"
+  policy      = data.aws_iam_policy_document.policy.json
+}
+
+resource "aws_iam_role_policy_attachment" "test-attach" {
+  role       = aws_iam_role.role.name
+  policy_arn = aws_iam_policy.policy.arn
+}
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `role`  (Required) - The name of the IAM role to which the policy should be applied
+* `policy_arn` (Required) - The ARN of the policy you want to apply
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IAM role policy attachments using the role name and policy arn separated by `/`. For example:
+
+```terraform
+import {
+  to = aws_iam_role_policy_attachment.test-attach
+  id = "test-role/arn:aws:iam::xxxxxxxxxxxx:policy/test-policy"
+}
+```
+
+Using `terraform import`, import IAM role policy attachments using the role name and policy arn separated by `/`. For example:
+
+```console
+% terraform import aws_iam_role_policy_attachment.test-attach test-role/arn:aws:iam::xxxxxxxxxxxx:policy/test-policy
+```
diff --git a/website/docs/r/iam_role_policy_attachment.markdown b/website/docs/r/iam_role_policy_attachment.markdown
deleted file mode 100644
index c4f593f292d..00000000000
--- a/website/docs/r/iam_role_policy_attachment.markdown
+++ /dev/null
@@ -1,75 +0,0 @@
----
-subcategory: "IAM (Identity & Access Management)"
-layout: "aws"
-page_title: "AWS: aws_iam_role_policy_attachment"
-description: |-
-  Attaches a Managed IAM Policy to an IAM role
----
-
-# Resource: aws_iam_role_policy_attachment
-
-Attaches a Managed IAM Policy to an IAM role
-
-~> **NOTE:** The usage of this resource conflicts with the `aws_iam_policy_attachment` resource and will permanently show a difference if both are defined.
-
-~> **NOTE:** For a given role, this resource is incompatible with using the [`aws_iam_role` resource](/docs/providers/aws/r/iam_role.html) `managed_policy_arns` argument. When using that argument and this resource, both will attempt to manage the role's managed policy attachments and Terraform will show a permanent difference.
-
-## Example Usage
-
-```terraform
-data "aws_iam_policy_document" "assume_role" {
-  statement {
-    effect = "Allow"
-
-    principals {
-      type        = "Service"
-      identifiers = ["ec2.amazonaws.com"]
-    }
-
-    actions = ["sts:AssumeRole"]
-  }
-}
-
-resource "aws_iam_role" "role" {
-  name               = "test-role"
-  assume_role_policy = data.aws_iam_policy_document.assume_role.json
-}
-
-data "aws_iam_policy_document" "policy" {
-  statement {
-    effect    = "Allow"
-    actions   = ["ec2:Describe*"]
-    resources = ["*"]
-  }
-}
-
-resource "aws_iam_policy" "policy" {
-  name        = "test-policy"
-  description = "A test policy"
-  policy      = data.aws_iam_policy_document.policy.json
-}
-
-resource "aws_iam_role_policy_attachment" "test-attach" {
-  role       = aws_iam_role.role.name
-  policy_arn = aws_iam_policy.policy.arn
-}
-```
-
-## Argument Reference
-
-The following arguments are supported:
-
-* `role`  (Required) - The name of the IAM role to which the policy should be applied
-* `policy_arn` (Required) - The ARN of the policy you want to apply
-
-## Attributes Reference
-
-No additional attributes are exported.
-
-## Import
-
-IAM role policy attachments can be imported using the role name and policy arn separated by `/`.
-
-```
-$ terraform import aws_iam_role_policy_attachment.test-attach test-role/arn:aws:iam::xxxxxxxxxxxx:policy/test-policy
-```
diff --git a/website/docs/r/iam_saml_provider.html.markdown b/website/docs/r/iam_saml_provider.html.markdown
index 7c2e36ca222..05b06017ebd 100644
--- a/website/docs/r/iam_saml_provider.html.markdown
+++ b/website/docs/r/iam_saml_provider.html.markdown
@@ -21,15 +21,15 @@ resource "aws_iam_saml_provider" "default" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The name of the provider to create.
 * `saml_metadata_document` - (Required) An XML document generated by an identity provider that supports SAML 2.0.
 * `tags` - (Optional) Map of resource tags for the IAM SAML provider. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The ARN assigned by AWS for this provider.
 * `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
@@ -37,8 +37,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-IAM SAML Providers can be imported using the `arn`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IAM SAML Providers using the `arn`. For example:
 
+```terraform
+import {
+  to = aws_iam_saml_provider.default
+  id = "arn:aws:iam::123456789012:saml-provider/SAMLADFS"
+}
 ```
-$ terraform import aws_iam_saml_provider.default arn:aws:iam::123456789012:saml-provider/SAMLADFS
+
+Using `terraform import`, import IAM SAML Providers using the `arn`. For example:
+
+```console
+% terraform import aws_iam_saml_provider.default arn:aws:iam::123456789012:saml-provider/SAMLADFS
 ```
diff --git a/website/docs/r/iam_security_token_service_preferences.html.markdown b/website/docs/r/iam_security_token_service_preferences.html.markdown
new file mode 100644
index 00000000000..fab96082473
--- /dev/null
+++ b/website/docs/r/iam_security_token_service_preferences.html.markdown
@@ -0,0 +1,31 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_security_token_service_preferences"
+description: |-
+  Provides an IAM Security Token Service Preferences resource.
+---
+
+# Resource: aws_iam_security_token_service_preferences
+
+Provides an IAM Security Token Service Preferences resource.
+
+## Example Usage
+
+```terraform
+resource "aws_iam_security_token_service_preferences" "example" {
+  global_endpoint_token_version = "v2Token"
+}
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `global_endpoint_token_version` - (Required) The version of the STS global endpoint token. Valid values: `v1Token`, `v2Token`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The AWS Account ID.
diff --git a/website/docs/r/iam_server_certificate.html.markdown b/website/docs/r/iam_server_certificate.html.markdown
index d3ac85a4fc6..6903a92dafb 100644
--- a/website/docs/r/iam_server_certificate.html.markdown
+++ b/website/docs/r/iam_server_certificate.html.markdown
@@ -91,7 +91,7 @@ resource "aws_elb" "ourapp" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Optional) The name of the Server Certificate. Do not include the
   path in this value. If omitted, Terraform will assign a random, unique name.
@@ -111,9 +111,9 @@ The following arguments are supported:
 
 ~> **NOTE:** AWS performs behind-the-scenes modifications to some certificate files if they do not adhere to a specific format. These modifications will result in terraform forever believing that it needs to update the resources since the local and AWS file contents will not match after theses modifications occur. In order to prevent this from happening you must ensure that all your PEM-encoded files use UNIX line-breaks and that `certificate_body` contains only one certificate. All other certificates should go in `certificate_chain`. It is common for some Certificate Authorities to issue certificate files that have DOS line-breaks and that are actually multiple certificates concatenated together in order to form a full certificate chain.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The Amazon Resource Name (ARN) specifying the server certificate.
 * `expiration` - Date and time in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8) on which the certificate is set to expire.
@@ -124,10 +124,19 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-IAM Server Certificates can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IAM Server Certificates using the `name`. For example:
 
+```terraform
+import {
+  to = aws_iam_server_certificate.certificate
+  id = "example.com-certificate-until-2018"
+}
 ```
-$ terraform import aws_iam_server_certificate.certificate example.com-certificate-until-2018
+
+Using `terraform import`, import IAM Server Certificates using the `name`. For example:
+
+```console
+% terraform import aws_iam_server_certificate.certificate example.com-certificate-until-2018
 ```
 
 [1]: https://docs.aws.amazon.com/IAM/latest/UserGuide/Using_Identifiers.html
diff --git a/website/docs/r/iam_service_linked_role.html.markdown b/website/docs/r/iam_service_linked_role.html.markdown
index e25aa1036c8..d470fa01f3e 100644
--- a/website/docs/r/iam_service_linked_role.html.markdown
+++ b/website/docs/r/iam_service_linked_role.html.markdown
@@ -20,16 +20,16 @@ resource "aws_iam_service_linked_role" "elasticbeanstalk" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `aws_service_name` - (Required, Forces new resource) The AWS service to which this role is attached. You use a string similar to a URL but without the `http://` in front. For example: `elasticbeanstalk.amazonaws.com`. To find the full list of services that support service-linked roles, check [the docs](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_aws-services-that-work-with-iam.html).
 * `custom_suffix` - (Optional, forces new resource) Additional string appended to the role name. Not all AWS services support custom suffixes.
 * `description` - (Optional) The description of the role.
 * `tags` - Key-value mapping of tags for the IAM role. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The Amazon Resource Name (ARN) of the role.
 * `arn` - The Amazon Resource Name (ARN) specifying the role.
@@ -41,8 +41,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-IAM service-linked roles can be imported using role ARN, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IAM service-linked roles using role ARN. For example:
 
+```terraform
+import {
+  to = aws_iam_service_linked_role.elasticbeanstalk
+  id = "arn:aws:iam::123456789012:role/aws-service-role/elasticbeanstalk.amazonaws.com/AWSServiceRoleForElasticBeanstalk"
+}
 ```
-$ terraform import aws_iam_service_linked_role.elasticbeanstalk arn:aws:iam::123456789012:role/aws-service-role/elasticbeanstalk.amazonaws.com/AWSServiceRoleForElasticBeanstalk
+
+Using `terraform import`, import IAM service-linked roles using role ARN. For example:
+
+```console
+% terraform import aws_iam_service_linked_role.elasticbeanstalk arn:aws:iam::123456789012:role/aws-service-role/elasticbeanstalk.amazonaws.com/AWSServiceRoleForElasticBeanstalk
 ```
diff --git a/website/docs/r/iam_service_specific_credential.html.markdown b/website/docs/r/iam_service_specific_credential.html.markdown
index 8ab5ea3ba26..f91fb94d227 100644
--- a/website/docs/r/iam_service_specific_credential.html.markdown
+++ b/website/docs/r/iam_service_specific_credential.html.markdown
@@ -25,15 +25,15 @@ resource "aws_iam_service_specific_credential" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `service_name` - (Required) The name of the AWS service that is to be associated with the credentials. The service you specify here is the only service that can be accessed using these credentials.
 * `user_name` - (Required) The name of the IAM user that is to be associated with the credentials. The new service-specific credentials have the same permissions as the associated user except that they can be used only to access the specified service.
 * `status` - (Optional) The status to be assigned to the service-specific credential. Valid values are `Active` and `Inactive`. Default value is `Active`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The combination of `service_name` and `user_name` as such: `service_name:user_name:service_specific_credential_id`.
 * `service_password` - The generated password for the service-specific credential.
@@ -42,8 +42,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-IAM Service Specific Credentials can be imported using the `service_name:user_name:service_specific_credential_id`, e.g.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IAM Service Specific Credentials using the `service_name:user_name:service_specific_credential_id`. For example:
 
+```terraform
+import {
+  to = aws_iam_service_specific_credential.default
+  id = "`codecommit.amazonaws.com:example:some-id`"
+}
 ```
-$ terraform import aws_iam_service_specific_credential.default `codecommit.amazonaws.com:example:some-id`
+
+Using `terraform import`, import IAM Service Specific Credentials using the `service_name:user_name:service_specific_credential_id`. For example:
+
+```console
+% terraform import aws_iam_service_specific_credential.default `codecommit.amazonaws.com:example:some-id`
 ```
diff --git a/website/docs/r/iam_signing_certificate.html.markdown b/website/docs/r/iam_signing_certificate.html.markdown
index 9ccda90a293..5ddb9faa6ae 100644
--- a/website/docs/r/iam_signing_certificate.html.markdown
+++ b/website/docs/r/iam_signing_certificate.html.markdown
@@ -40,23 +40,32 @@ EOF
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `certificate_body` – (Required) The contents of the signing certificate in PEM-encoded format.
 * `status` – (Optional)  The status you want to assign to the certificate. `Active` means that the certificate can be used for programmatic calls to Amazon Web Services `Inactive` means that the certificate cannot be used.
 * `user_name` – (Required) The name of the user the signing certificate is for.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `certificate_id` - The ID for the signing certificate.
 * `id` - The `certificate_id:user_name`
 
 ## Import
 
-IAM Signing Certificates can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IAM Signing Certificates using the `id`. For example:
 
+```terraform
+import {
+  to = aws_iam_signing_certificate.certificate
+  id = "IDIDIDIDID:user-name"
+}
 ```
-$ terraform import aws_iam_signing_certificate.certificate IDIDIDIDID:user-name
+
+Using `terraform import`, import IAM Signing Certificates using the `id`. For example:
+
+```console
+% terraform import aws_iam_signing_certificate.certificate IDIDIDIDID:user-name
 ```
diff --git a/website/docs/r/iam_user.html.markdown b/website/docs/r/iam_user.html.markdown
index a8e3aaffa57..a151ad97e76 100644
--- a/website/docs/r/iam_user.html.markdown
+++ b/website/docs/r/iam_user.html.markdown
@@ -45,7 +45,7 @@ resource "aws_iam_user_policy" "lb_ro" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The user's name. The name must consist of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: `=,.@-_.`. User names are not distinguished by case. For example, you cannot create users named both "TESTUSER" and "testuser".
 * `path` - (Optional, default "/") Path in which to create the user.
@@ -55,9 +55,9 @@ The following arguments are supported:
   a user with non-Terraform-managed access keys and login profile will fail to be destroyed.
 * `tags` - Key-value map of tags for the IAM user. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The ARN assigned by AWS for this user.
 * `name` - The user's name.
@@ -68,8 +68,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-IAM Users can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IAM Users using the `name`. For example:
 
+```terraform
+import {
+  to = aws_iam_user.lb
+  id = "loadbalancer"
+}
 ```
-$ terraform import aws_iam_user.lb loadbalancer
+
+Using `terraform import`, import IAM Users using the `name`. For example:
+
+```console
+% terraform import aws_iam_user.lb loadbalancer
 ```
diff --git a/website/docs/r/iam_user_group_membership.html.markdown b/website/docs/r/iam_user_group_membership.html.markdown
index fade647c809..07376501acb 100644
--- a/website/docs/r/iam_user_group_membership.html.markdown
+++ b/website/docs/r/iam_user_group_membership.html.markdown
@@ -55,14 +55,14 @@ resource "aws_iam_group" "group3" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `user` - (Required) The name of the [IAM User][2] to add to groups
 * `groups` - (Required) A list of [IAM Groups][1] to add the user to
 
-## Attributes Reference
+## Attribute Reference
 
-No additional attributes are exported.
+This resource exports no additional attributes.
 
 [1]: /docs/providers/aws/r/iam_group.html
 [2]: /docs/providers/aws/r/iam_user.html
@@ -70,8 +70,17 @@ No additional attributes are exported.
 
 ## Import
 
-IAM user group membership can be imported using the user name and group names separated by `/`.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IAM user group membership using the user name and group names separated by `/`. For example:
 
+```terraform
+import {
+  to = aws_iam_user_group_membership.example1
+  id = "user1/group1/group2"
+}
 ```
-$ terraform import aws_iam_user_group_membership.example1 user1/group1/group2
+
+Using `terraform import`, import IAM user group membership using the user name and group names separated by `/`. For example:
+
+```console
+% terraform import aws_iam_user_group_membership.example1 user1/group1/group2
 ```
diff --git a/website/docs/r/iam_user_login_profile.html.markdown b/website/docs/r/iam_user_login_profile.html.markdown
index 4e4a1cfe68a..4dd63d3b9d2 100644
--- a/website/docs/r/iam_user_login_profile.html.markdown
+++ b/website/docs/r/iam_user_login_profile.html.markdown
@@ -33,16 +33,16 @@ output "password" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `user` - (Required) The IAM user's name.
 * `pgp_key` - (Optional) Either a base-64 encoded PGP public key, or a keybase username in the form `keybase:username`. Only applies on resource creation. Drift detection is not possible with this argument.
 * `password_length` - (Optional) The length of the generated password on resource creation. Only applies on resource creation. Drift detection is not possible with this argument. Default value is `20`.
 * `password_reset_required` - (Optional) Whether the user should be forced to reset the generated password on resource creation. Only applies on resource creation.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `password` - The plain text password, only available when `pgp_key` is not provided.
 * `key_fingerprint` - The fingerprint of the PGP key used to encrypt the password. Only available if password was handled on Terraform resource creation, not import.
@@ -53,13 +53,22 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-IAM User Login Profiles can be imported without password information support via the IAM User name, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IAM User Login Profiles without password information via the IAM User name. For example:
 
-```sh
-$ terraform import aws_iam_user_login_profile.example myusername
+```terraform
+import {
+  to = aws_iam_user_login_profile.example
+  id = "myusername"
+}
+```
+
+Using `terraform import`, import IAM User Login Profiles without password information via the IAM User name. For example:
+
+```console
+% terraform import aws_iam_user_login_profile.example myusername
 ```
 
-Since Terraform has no method to read the PGP or password information during import, use the [Terraform resource `lifecycle` configuration block `ignore_changes` argument](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html#ignore_changes) to ignore them unless password recreation is desiredE.g.,
+Since Terraform has no method to read the PGP or password information during import, use the [Terraform resource `lifecycle` configuration block `ignore_changes` argument](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html#ignore_changes) to ignore them (unless you want to recreate a password). For example:
 
 ```terraform
 resource "aws_iam_user_login_profile" "example" {
diff --git a/website/docs/r/iam_user_policy.html.markdown b/website/docs/r/iam_user_policy.html.markdown
index c3fa0980107..b7a3003f2b7 100644
--- a/website/docs/r/iam_user_policy.html.markdown
+++ b/website/docs/r/iam_user_policy.html.markdown
@@ -45,24 +45,33 @@ resource "aws_iam_access_key" "lb" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `policy` - (Required) The policy document. This is a JSON formatted string. For more information about building AWS IAM policy documents with Terraform, see the [AWS IAM Policy Document Guide](https://learn.hashicorp.com/terraform/aws/iam-policy).
 * `name` - (Optional) The name of the policy. If omitted, Terraform will assign a random, unique name.
 * `name_prefix` - (Optional, Forces new resource) Creates a unique name beginning with the specified prefix. Conflicts with `name`.
 * `user` - (Required) IAM user to which to attach this policy.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The user policy ID, in the form of `user_name:user_policy_name`.
 * `name` - The name of the policy (always set).
 
 ## Import
 
-IAM User Policies can be imported using the `user_name:user_policy_name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IAM User Policies using the `user_name:user_policy_name`. For example:
 
+```terraform
+import {
+  to = aws_iam_user_policy.mypolicy
+  id = "user_of_mypolicy_name:mypolicy_name"
+}
 ```
-$ terraform import aws_iam_user_policy.mypolicy user_of_mypolicy_name:mypolicy_name
+
+Using `terraform import`, import IAM User Policies using the `user_name:user_policy_name`. For example:
+
+```console
+% terraform import aws_iam_user_policy.mypolicy user_of_mypolicy_name:mypolicy_name
 ```
diff --git a/website/docs/r/iam_user_policy_attachment.html.markdown b/website/docs/r/iam_user_policy_attachment.html.markdown
new file mode 100644
index 00000000000..de974e194f3
--- /dev/null
+++ b/website/docs/r/iam_user_policy_attachment.html.markdown
@@ -0,0 +1,60 @@
+---
+subcategory: "IAM (Identity & Access Management)"
+layout: "aws"
+page_title: "AWS: aws_iam_user_policy_attachment"
+description: |-
+  Attaches a Managed IAM Policy to an IAM user
+---
+
+# Resource: aws_iam_user_policy_attachment
+
+Attaches a Managed IAM Policy to an IAM user
+
+~> **NOTE:** The usage of this resource conflicts with the `aws_iam_policy_attachment` resource and will permanently show a difference if both are defined.
+
+## Example Usage
+
+```terraform
+resource "aws_iam_user" "user" {
+  name = "test-user"
+}
+
+resource "aws_iam_policy" "policy" {
+  name        = "test-policy"
+  description = "A test policy"
+  policy      = "{ ... policy JSON ... }"
+}
+
+resource "aws_iam_user_policy_attachment" "test-attach" {
+  user       = aws_iam_user.user.name
+  policy_arn = aws_iam_policy.policy.arn
+}
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `user`        (Required) - The user the policy should be applied to
+* `policy_arn`  (Required) - The ARN of the policy you want to apply
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IAM user policy attachments using the user name and policy arn separated by `/`. For example:
+
+```terraform
+import {
+  to = aws_iam_user_policy_attachment.test-attach
+  id = "test-user/arn:aws:iam::xxxxxxxxxxxx:policy/test-policy"
+}
+```
+
+Using `terraform import`, import IAM user policy attachments using the user name and policy arn separated by `/`. For example:
+
+```console
+% terraform import aws_iam_user_policy_attachment.test-attach test-user/arn:aws:iam::xxxxxxxxxxxx:policy/test-policy
+```
diff --git a/website/docs/r/iam_user_policy_attachment.markdown b/website/docs/r/iam_user_policy_attachment.markdown
deleted file mode 100644
index b16fe51768e..00000000000
--- a/website/docs/r/iam_user_policy_attachment.markdown
+++ /dev/null
@@ -1,51 +0,0 @@
----
-subcategory: "IAM (Identity & Access Management)"
-layout: "aws"
-page_title: "AWS: aws_iam_user_policy_attachment"
-description: |-
-  Attaches a Managed IAM Policy to an IAM user
----
-
-# Resource: aws_iam_user_policy_attachment
-
-Attaches a Managed IAM Policy to an IAM user
-
-~> **NOTE:** The usage of this resource conflicts with the `aws_iam_policy_attachment` resource and will permanently show a difference if both are defined.
-
-## Example Usage
-
-```terraform
-resource "aws_iam_user" "user" {
-  name = "test-user"
-}
-
-resource "aws_iam_policy" "policy" {
-  name        = "test-policy"
-  description = "A test policy"
-  policy      = "{ ... policy JSON ... }"
-}
-
-resource "aws_iam_user_policy_attachment" "test-attach" {
-  user       = aws_iam_user.user.name
-  policy_arn = aws_iam_policy.policy.arn
-}
-```
-
-## Argument Reference
-
-The following arguments are supported:
-
-* `user`        (Required) - The user the policy should be applied to
-* `policy_arn`  (Required) - The ARN of the policy you want to apply
-
-## Attributes Reference
-
-No additional attributes are exported.
-
-## Import
-
-IAM user policy attachments can be imported using the user name and policy arn separated by `/`.
-
-```
-$ terraform import aws_iam_user_policy_attachment.test-attach test-user/arn:aws:iam::xxxxxxxxxxxx:policy/test-policy
-```
diff --git a/website/docs/r/iam_user_ssh_key.html.markdown b/website/docs/r/iam_user_ssh_key.html.markdown
index 2c9f7efd4aa..5485bdf0cdb 100644
--- a/website/docs/r/iam_user_ssh_key.html.markdown
+++ b/website/docs/r/iam_user_ssh_key.html.markdown
@@ -27,24 +27,33 @@ resource "aws_iam_user_ssh_key" "user" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `username` - (Required) The name of the IAM user to associate the SSH public key with.
 * `encoding` - (Required) Specifies the public key encoding format to use in the response. To retrieve the public key in ssh-rsa format, use `SSH`. To retrieve the public key in PEM format, use `PEM`.
 * `public_key` - (Required) The SSH public key. The public key must be encoded in ssh-rsa format or PEM format.
 * `status` - (Optional) The status to assign to the SSH public key. Active means the key can be used for authentication with an AWS CodeCommit repository. Inactive means the key cannot be used. Default is `active`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `ssh_public_key_id` - The unique identifier for the SSH public key.
 * `fingerprint` - The MD5 message digest of the SSH public key.
 
 ## Import
 
-SSH public keys can be imported using the `username`, `ssh_public_key_id`, and `encoding` e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SSH public keys using the `username`, `ssh_public_key_id`, and `encoding`. For example:
 
+```terraform
+import {
+  to = aws_iam_user_ssh_key.user
+  id = "user:APKAJNCNNJICVN7CFKCA:SSH"
+}
 ```
-$ terraform import aws_iam_user_ssh_key.user user:APKAJNCNNJICVN7CFKCA:SSH
+
+Using `terraform import`, import SSH public keys using the `username`, `ssh_public_key_id`, and `encoding`. For example:
+
+```console
+% terraform import aws_iam_user_ssh_key.user user:APKAJNCNNJICVN7CFKCA:SSH
 ```
diff --git a/website/docs/r/iam_virtual_mfa_device.html.markdown b/website/docs/r/iam_virtual_mfa_device.html.markdown
index c252a48de29..55feee73b9b 100644
--- a/website/docs/r/iam_virtual_mfa_device.html.markdown
+++ b/website/docs/r/iam_virtual_mfa_device.html.markdown
@@ -13,6 +13,10 @@ Provides an IAM Virtual MFA Device.
 ~> **Note:** All attributes will be stored in the raw state as plain-text.
 [Read more about sensitive data in state](https://www.terraform.io/docs/state/sensitive-data.html).
 
+~> **Note:** A virtual MFA device cannot be directly associated with an IAM User from Terraform.
+  To associate the virtual MFA device with a user and enable it, use the code returned in either `base_32_string_seed` or `qr_code_png` to generate TOTP authentication codes.
+  The authentication codes can then be used with the AWS CLI command [`aws iam enable-mfa-device`](https://docs.aws.amazon.com/cli/latest/reference/iam/enable-mfa-device.html) or the AWS API call [`EnableMFADevice`](https://docs.aws.amazon.com/IAM/latest/APIReference/API_EnableMFADevice.html).
+
 ## Example Usage
 
 **Using certs on file:**
@@ -25,25 +29,36 @@ resource "aws_iam_virtual_mfa_device" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `virtual_mfa_device_name` - (Required) The name of the virtual MFA device. Use with path to uniquely identify a virtual MFA device.
 * `path` – (Optional) The path for the virtual MFA device.
 * `tags` - (Optional) Map of resource tags for the virtual mfa device. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The Amazon Resource Name (ARN) specifying the virtual mfa device.
 * `base_32_string_seed` - The base32 seed defined as specified in [RFC3548](https://tools.ietf.org/html/rfc3548.txt). The `base_32_string_seed` is base64-encoded.
-* `qr_code_png` -  A QR code PNG image that encodes `otpauth://totp/$virtualMFADeviceName@$AccountName?secret=$Base32String` where `$virtualMFADeviceName` is one of the create call arguments. AccountName is the user name if set (otherwise, the account ID otherwise), and Base32String is the seed in base32 format.
+* `enable_date` - The date and time when the virtual MFA device was enabled.
+* `qr_code_png` -  A QR code PNG image that encodes `otpauth://totp/$virtualMFADeviceName@$AccountName?secret=$Base32String` where `$virtualMFADeviceName` is one of the create call arguments. AccountName is the user name if set (otherwise, the account ID), and Base32String is the seed in base32 format.
 * `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `user_name` - The associated IAM User name if the virtual MFA device is enabled.
 
 ## Import
 
-IAM Virtual MFA Devices can be imported using the `arn`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IAM Virtual MFA Devices using the `arn`. For example:
 
+```terraform
+import {
+  to = aws_iam_virtual_mfa_device.example
+  id = "arn:aws:iam::123456789012:mfa/example"
+}
 ```
-$ terraform import aws_iam_virtual_mfa_device.example arn:aws:iam::123456789012:mfa/example
+
+Using `terraform import`, import IAM Virtual MFA Devices using the `arn`. For example:
+
+```console
+% terraform import aws_iam_virtual_mfa_device.example arn:aws:iam::123456789012:mfa/example
 ```
diff --git a/website/docs/r/identitystore_group.html.markdown b/website/docs/r/identitystore_group.html.markdown
index d5d20aa7b51..03d920444bf 100644
--- a/website/docs/r/identitystore_group.html.markdown
+++ b/website/docs/r/identitystore_group.html.markdown
@@ -33,9 +33,9 @@ The following arguments are optional:
 * `display_name` - (Optional) A string containing the name of the group. This value is commonly displayed when the group is referenced.
 * `description` - (Optional) A string containing the description of the group.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `group_id` - The identifier of the newly created group in the identity store.
 * `external_ids` - A list of external IDs that contains the identifiers issued to this resource by an external identity provider. See [External IDs](#external-ids) below.
@@ -55,8 +55,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-An Identity Store Group can be imported using the combination `identity_store_id/group_id`. For example:
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import an Identity Store Group using the combination `identity_store_id/group_id`. For example:
 
+```terraform
+import {
+  to = aws_identitystore_group.example
+  id = "d-9c6705e95c/b8a1c340-8031-7071-a2fb-7dc540320c30"
+}
 ```
-$ terraform import aws_identitystore_group.example d-9c6705e95c/b8a1c340-8031-7071-a2fb-7dc540320c30
+
+Using `terraform import`, import an Identity Store Group using the combination `identity_store_id/group_id`. For example:
+
+```console
+% terraform import aws_identitystore_group.example d-9c6705e95c/b8a1c340-8031-7071-a2fb-7dc540320c30
 ```
diff --git a/website/docs/r/identitystore_group_membership.html.markdown b/website/docs/r/identitystore_group_membership.html.markdown
index 68871eb8dd6..5fd730957e5 100644
--- a/website/docs/r/identitystore_group_membership.html.markdown
+++ b/website/docs/r/identitystore_group_membership.html.markdown
@@ -41,22 +41,31 @@ resource "aws_identitystore_group_membership" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `member_id` - (Required) The identifier for a user in the Identity Store.
 * `group_id` - (Required)  The identifier for a group in the Identity Store.
 * `identity_store_id` - (Required) Identity Store ID associated with the Single Sign-On Instance.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `membership_id` - The identifier of the newly created group membership in the Identity Store.
 
 ## Import
 
-`aws_identitystore_group_membership` can be imported using the `identity_store_id/membership_id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_identitystore_group_membership` using the `identity_store_id/membership_id`. For example:
 
+```terraform
+import {
+  to = aws_identitystore_group_membership.example
+  id = "d-0000000000/00000000-0000-0000-0000-000000000000"
+}
 ```
-$ terraform import aws_identitystore_group_membership.example d-0000000000/00000000-0000-0000-0000-000000000000
+
+Using `terraform import`, import `aws_identitystore_group_membership` using the `identity_store_id/membership_id`. For example:
+
+```console
+% terraform import aws_identitystore_group_membership.example d-0000000000/00000000-0000-0000-0000-000000000000
 ```
diff --git a/website/docs/r/identitystore_user.html.markdown b/website/docs/r/identitystore_user.html.markdown
index 74eeec5536e..4d7a120b041 100644
--- a/website/docs/r/identitystore_user.html.markdown
+++ b/website/docs/r/identitystore_user.html.markdown
@@ -98,9 +98,9 @@ The following arguments are optional:
 * `type` - (Optional) The type of phone number.
 * `value` - (Optional) The user's phone number.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `external_ids` - A list of identifiers issued to this resource by an external identity provider.
     * `id` - The identifier issued to this resource by an external identity provider.
@@ -109,8 +109,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-An Identity Store User can be imported using the combination `identity_store_id/user_id`. For example:
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import an Identity Store User using the combination `identity_store_id/user_id`. For example:
 
+```terraform
+import {
+  to = aws_identitystore_user.example
+  id = "d-9c6705e95c/065212b4-9061-703b-5876-13a517ae2a7c"
+}
 ```
-$ terraform import aws_identitystore_user.example d-9c6705e95c/065212b4-9061-703b-5876-13a517ae2a7c
+
+Using `terraform import`, import an Identity Store User using the combination `identity_store_id/user_id`. For example:
+
+```console
+% terraform import aws_identitystore_user.example d-9c6705e95c/065212b4-9061-703b-5876-13a517ae2a7c
 ```
diff --git a/website/docs/r/imagebuilder_component.html.markdown b/website/docs/r/imagebuilder_component.html.markdown
index 3a29a605c46..619ff84f827 100644
--- a/website/docs/r/imagebuilder_component.html.markdown
+++ b/website/docs/r/imagebuilder_component.html.markdown
@@ -68,9 +68,9 @@ The following attributes are optional:
 
 ~> **NOTE:** Updating `data` or `uri` requires specifying a new `version`. This causes replacement of the resource. The `skip_destroy` argument can be used to retain the old version.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - (Required) Amazon Resource Name (ARN) of the component.
 * `date_created` - Date the component was created.
@@ -81,10 +81,19 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_imagebuilder_components` resources can be imported by using the Amazon Resource Name (ARN), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_imagebuilder_components` resources using the Amazon Resource Name (ARN). For example:
 
+```terraform
+import {
+  to = aws_imagebuilder_component.example
+  id = "arn:aws:imagebuilder:us-east-1:123456789012:component/example/1.0.0/1"
+}
 ```
-$ terraform import aws_imagebuilder_component.example arn:aws:imagebuilder:us-east-1:123456789012:component/example/1.0.0/1
+
+Using `terraform import`, import `aws_imagebuilder_components` resources using the Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_imagebuilder_component.example arn:aws:imagebuilder:us-east-1:123456789012:component/example/1.0.0/1
 ```
 
 Certain resource arguments, such as `uri`, cannot be read via the API and imported into Terraform. Terraform will display a difference for these arguments the first run after import if declared in the Terraform configuration for an imported resource.
diff --git a/website/docs/r/imagebuilder_container_recipe.html.markdown b/website/docs/r/imagebuilder_container_recipe.html.markdown
index db5e5f1d31e..435827c7515 100644
--- a/website/docs/r/imagebuilder_container_recipe.html.markdown
+++ b/website/docs/r/imagebuilder_container_recipe.html.markdown
@@ -119,9 +119,9 @@ The following arguments are optional:
 * `volume_size` - (Optional) Size of the volume, in GiB.
 * `volume_type` - (Optional) Type of the volume. For example, `gp2` or `io2`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - (Required) Amazon Resource Name (ARN) of the container recipe.
 * `date_created` - Date the container recipe was created.
@@ -132,8 +132,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_imagebuilder_container_recipe` resources can be imported by using the Amazon Resource Name (ARN), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_imagebuilder_container_recipe` resources using the Amazon Resource Name (ARN). For example:
 
+```terraform
+import {
+  to = aws_imagebuilder_container_recipe.example
+  id = "arn:aws:imagebuilder:us-east-1:123456789012:container-recipe/example/1.0.0"
+}
 ```
-$ terraform import aws_imagebuilder_container_recipe.example arn:aws:imagebuilder:us-east-1:123456789012:container-recipe/example/1.0.0
+
+Using `terraform import`, import `aws_imagebuilder_container_recipe` resources using the Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_imagebuilder_container_recipe.example arn:aws:imagebuilder:us-east-1:123456789012:container-recipe/example/1.0.0
 ```
diff --git a/website/docs/r/imagebuilder_distribution_configuration.html.markdown b/website/docs/r/imagebuilder_distribution_configuration.html.markdown
index 5a136e1c0bf..f6c46ee83f7 100644
--- a/website/docs/r/imagebuilder_distribution_configuration.html.markdown
+++ b/website/docs/r/imagebuilder_distribution_configuration.html.markdown
@@ -119,9 +119,9 @@ The following arguments are optional:
 * `account_id` - The account ID that this configuration applies to.
 * `launch_template_id` - (Required) The ID of the Amazon EC2 launch template to use.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - (Required) Amazon Resource Name (ARN) of the distribution configuration.
 * `date_created` - Date the distribution configuration was created.
@@ -130,8 +130,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_imagebuilder_distribution_configurations` resources can be imported by using the Amazon Resource Name (ARN), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_imagebuilder_distribution_configurations` resources using the Amazon Resource Name (ARN). For example:
 
+```terraform
+import {
+  to = aws_imagebuilder_distribution_configuration.example
+  id = "arn:aws:imagebuilder:us-east-1:123456789012:distribution-configuration/example"
+}
 ```
-$ terraform import aws_imagebuilder_distribution_configuration.example arn:aws:imagebuilder:us-east-1:123456789012:distribution-configuration/example
+
+Using `terraform import`, import `aws_imagebuilder_distribution_configurations` resources using the Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_imagebuilder_distribution_configuration.example arn:aws:imagebuilder:us-east-1:123456789012:distribution-configuration/example
 ```
diff --git a/website/docs/r/imagebuilder_image.html.markdown b/website/docs/r/imagebuilder_image.html.markdown
index 167224bcbf2..0314e4cc042 100644
--- a/website/docs/r/imagebuilder_image.html.markdown
+++ b/website/docs/r/imagebuilder_image.html.markdown
@@ -33,6 +33,7 @@ The following arguments are optional:
 * `enhanced_image_metadata_enabled` - (Optional) Whether additional information about the image being created is collected. Defaults to `true`.
 * `image_recipe_arn` - (Optional) Amazon Resource Name (ARN) of the image recipe.
 * `image_tests_configuration` - (Optional) Configuration block with image tests configuration. Detailed below.
+* `image_scanning_configuration` - (Optional) Configuration block with image scanning configuration. Detailed below.
 * `tags` - (Optional) Key-value map of resource tags for the Image Builder Image. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
 ### image_tests_configuration
@@ -42,9 +43,23 @@ The following arguments are optional:
 * `image_tests_enabled` - (Optional) Whether image tests are enabled. Defaults to `true`.
 * `timeout_minutes` - (Optional) Number of minutes before image tests time out. Valid values are between `60` and `1440`. Defaults to `720`.
 
-## Attributes Reference
+### image_scanning_configuration
 
-In addition to all arguments above, the following attributes are exported:
+The following arguments are optional:
+
+* `image_scanning_enabled` - (Optional) Indicates whether Image Builder keeps a snapshot of the vulnerability scans that Amazon Inspector runs against the build instance when you create a new image. Defaults to `false`.
+* `ecr_configuration` - (Optional) Configuration block with ECR configuration. Detailed below.
+
+### ecr_configuration
+
+The following arguments are optional:
+
+* `repository_name` - (Optional) The name of the container repository that Amazon Inspector scans to identify findings for your container images.
+* `container_tags` - (Optional) Set of tags for Image Builder to apply to the output container image that that Amazon Inspector scans.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name (ARN) of the image.
 * `date_created` - Date the image was created.
@@ -71,8 +86,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_imagebuilder_image` resources can be imported using the Amazon Resource Name (ARN), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_imagebuilder_image` resources using the Amazon Resource Name (ARN). For example:
 
+```terraform
+import {
+  to = aws_imagebuilder_image.example
+  id = "arn:aws:imagebuilder:us-east-1:123456789012:image/example/1.0.0/1"
+}
 ```
-$ terraform import aws_imagebuilder_image.example arn:aws:imagebuilder:us-east-1:123456789012:image/example/1.0.0/1
+
+Using `terraform import`, import `aws_imagebuilder_image` resources using the Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_imagebuilder_image.example arn:aws:imagebuilder:us-east-1:123456789012:image/example/1.0.0/1
 ```
diff --git a/website/docs/r/imagebuilder_image_pipeline.html.markdown b/website/docs/r/imagebuilder_image_pipeline.html.markdown
index 1d065f82311..21a064637fd 100644
--- a/website/docs/r/imagebuilder_image_pipeline.html.markdown
+++ b/website/docs/r/imagebuilder_image_pipeline.html.markdown
@@ -38,11 +38,26 @@ The following arguments are optional:
 * `distribution_configuration_arn` - (Optional) Amazon Resource Name (ARN) of the Image Builder Distribution Configuration.
 * `enhanced_image_metadata_enabled` - (Optional) Whether additional information about the image being created is collected. Defaults to `true`.
 * `image_recipe_arn` - (Optional) Amazon Resource Name (ARN) of the image recipe.
+* `image_scanning_configuration` - (Optional) Configuration block with image scanning configuration. Detailed below.
 * `image_tests_configuration` - (Optional) Configuration block with image tests configuration. Detailed below.
 * `schedule` - (Optional) Configuration block with schedule settings. Detailed below.
 * `status` - (Optional) Status of the image pipeline. Valid values are `DISABLED` and `ENABLED`. Defaults to `ENABLED`.
 * `tags` - (Optional) Key-value map of resource tags for the image pipeline. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
+### image_scanning_configuration
+
+The following arguments are optional:
+
+* `image_scanning_enabled` - (Optional) Whether image scans are enabled. Defaults to `false`.
+* `ecr_configuration` - (Optional) Configuration block with ECR configuration for image scanning. Detailed below.
+
+### ecr_configuration
+
+The following arguments are optional:
+
+* `container tags` - (Optional) list of tags to apply to scanned images
+* `repository_name` - (Optional) The name of the repository to scan
+
 ### image_tests_configuration
 
 The following arguments are optional:
@@ -62,9 +77,9 @@ The following arguments are optional:
 
 * `timezone` - (Optional) The timezone that applies to the scheduling expression. For example, "Etc/UTC", "America/Los_Angeles" in the [IANA timezone format](https://www.joda.org/joda-time/timezones.html). If not specified this defaults to UTC.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name (ARN) of the image pipeline.
 * `date_created` - Date the image pipeline was created.
@@ -76,8 +91,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_imagebuilder_image_pipeline` resources can be imported using the Amazon Resource Name (ARN), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_imagebuilder_image_pipeline` resources using the Amazon Resource Name (ARN). For example:
 
+```terraform
+import {
+  to = aws_imagebuilder_image_pipeline.example
+  id = "arn:aws:imagebuilder:us-east-1:123456789012:image-pipeline/example"
+}
 ```
-$ terraform import aws_imagebuilder_image_pipeline.example arn:aws:imagebuilder:us-east-1:123456789012:image-pipeline/example
+
+Using `terraform import`, import `aws_imagebuilder_image_pipeline` resources using the Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_imagebuilder_image_pipeline.example arn:aws:imagebuilder:us-east-1:123456789012:image-pipeline/example
 ```
diff --git a/website/docs/r/imagebuilder_image_recipe.html.markdown b/website/docs/r/imagebuilder_image_recipe.html.markdown
index 3dde600ef64..263d14f361b 100644
--- a/website/docs/r/imagebuilder_image_recipe.html.markdown
+++ b/website/docs/r/imagebuilder_image_recipe.html.markdown
@@ -104,9 +104,9 @@ The following arguments are required:
 
 * `uninstall_after_build` - Whether to remove the Systems Manager Agent after the image has been built. Defaults to `false`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - (Required) Amazon Resource Name (ARN) of the image recipe.
 * `date_created` - Date the image recipe was created.
@@ -116,8 +116,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_imagebuilder_image_recipe` resources can be imported by using the Amazon Resource Name (ARN), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_imagebuilder_image_recipe` resources using the Amazon Resource Name (ARN). For example:
 
+```terraform
+import {
+  to = aws_imagebuilder_image_recipe.example
+  id = "arn:aws:imagebuilder:us-east-1:123456789012:image-recipe/example/1.0.0"
+}
 ```
-$ terraform import aws_imagebuilder_image_recipe.example arn:aws:imagebuilder:us-east-1:123456789012:image-recipe/example/1.0.0
+
+Using `terraform import`, import `aws_imagebuilder_image_recipe` resources using the Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_imagebuilder_image_recipe.example arn:aws:imagebuilder:us-east-1:123456789012:image-recipe/example/1.0.0
 ```
diff --git a/website/docs/r/imagebuilder_infrastructure_configuration.html.markdown b/website/docs/r/imagebuilder_infrastructure_configuration.html.markdown
index 25fb00de27f..ab1c46536f7 100644
--- a/website/docs/r/imagebuilder_infrastructure_configuration.html.markdown
+++ b/website/docs/r/imagebuilder_infrastructure_configuration.html.markdown
@@ -81,9 +81,9 @@ The following arguments are optional:
 
 * `s3_key_prefix` - (Optional) Prefix to use for S3 logs. Defaults to `/`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Amazon Resource Name (ARN) of the configuration.
 * `arn` - Amazon Resource Name (ARN) of the configuration.
@@ -93,8 +93,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_imagebuilder_infrastructure_configuration` can be imported using the Amazon Resource Name (ARN), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_imagebuilder_infrastructure_configuration` using the Amazon Resource Name (ARN). For example:
 
+```terraform
+import {
+  to = aws_imagebuilder_infrastructure_configuration.example
+  id = "arn:aws:imagebuilder:us-east-1:123456789012:infrastructure-configuration/example"
+}
 ```
-$ terraform import aws_imagebuilder_infrastructure_configuration.example arn:aws:imagebuilder:us-east-1:123456789012:infrastructure-configuration/example
+
+Using `terraform import`, import `aws_imagebuilder_infrastructure_configuration` using the Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_imagebuilder_infrastructure_configuration.example arn:aws:imagebuilder:us-east-1:123456789012:infrastructure-configuration/example
 ```
diff --git a/website/docs/r/inspector2_delegated_admin_account.html.markdown b/website/docs/r/inspector2_delegated_admin_account.html.markdown
index 569ffee21df..09635dc0a7f 100644
--- a/website/docs/r/inspector2_delegated_admin_account.html.markdown
+++ b/website/docs/r/inspector2_delegated_admin_account.html.markdown
@@ -28,9 +28,9 @@ The following arguments are required:
 
 * `account_id` - (Required) Account to enable as delegated admin account.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `relationship_status` - Status of this delegated admin account.
 
@@ -43,8 +43,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Inspector Delegated Admin Account can be imported using the `account_id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Inspector Delegated Admin Account using the `account_id`. For example:
 
+```terraform
+import {
+  to = aws_inspector2_delegated_admin_account.example
+  id = "012345678901"
+}
 ```
-$ terraform import aws_inspector2_delegated_admin_account.example 012345678901
+
+Using `terraform import`, import Inspector Delegated Admin Account using the `account_id`. For example:
+
+```console
+% terraform import aws_inspector2_delegated_admin_account.example 012345678901
 ```
diff --git a/website/docs/r/inspector2_enabler.html.markdown b/website/docs/r/inspector2_enabler.html.markdown
index 64453a56642..1998810f6a3 100644
--- a/website/docs/r/inspector2_enabler.html.markdown
+++ b/website/docs/r/inspector2_enabler.html.markdown
@@ -41,12 +41,12 @@ The following arguments are required:
 * `account_ids` - (Required) Set of account IDs.
   Can contain one of: the Organization's Administrator Account, or one or more Member Accounts.
 * `resource_types` - (Required) Type of resources to scan.
-  Valid values are `EC2`, `ECR`, and `LAMBDA`.
+  Valid values are `EC2`, `ECR`, `LAMBDA` and `LAMBDA_CODE`.
   At least one item is required.
 
-## Attributes Reference
+## Attribute Reference
 
-No additional attributes are exported.
+This resource exports no additional attributes.
 
 ## Timeouts
 
diff --git a/website/docs/r/inspector2_member_association.html.markdown b/website/docs/r/inspector2_member_association.html.markdown
index a2729552d9e..3ea23bfcc08 100644
--- a/website/docs/r/inspector2_member_association.html.markdown
+++ b/website/docs/r/inspector2_member_association.html.markdown
@@ -26,9 +26,9 @@ The following argument is required:
 
 * `account_id` - (Required) ID of the account to associate
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `delegated_admin_account_id` - Account ID of the delegated administrator account
 * `relationship_status` - Status of the member relationship
@@ -36,8 +36,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Amazon Inspector Member Association can be imported using the `account_id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Amazon Inspector Member Association using the `account_id`. For example:
 
+```terraform
+import {
+  to = aws_inspector2_member_association.example
+  id = "123456789012"
+}
 ```
-$ terraform import aws_inspector2_member_association.example 123456789012
+
+Using `terraform import`, import Amazon Inspector Member Association using the `account_id`. For example:
+
+```console
+% terraform import aws_inspector2_member_association.example 123456789012
 ```
diff --git a/website/docs/r/inspector2_organization_configuration.html.markdown b/website/docs/r/inspector2_organization_configuration.html.markdown
index 276c70db923..9c321ccd193 100644
--- a/website/docs/r/inspector2_organization_configuration.html.markdown
+++ b/website/docs/r/inspector2_organization_configuration.html.markdown
@@ -40,9 +40,9 @@ The following arguments are required:
 * `ecr` - (Required) Whether Amazon ECR scans are automatically enabled for new members of your Amazon Inspector organization.
 * `lambda` - (Optional) Whether Lambda Function scans are automatically enabled for new members of your Amazon Inspector organization.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `max_account_limit_reached` - Whether your configuration reached the max account limit.
 
diff --git a/website/docs/r/inspector_assessment_target.html.markdown b/website/docs/r/inspector_assessment_target.html.markdown
index 3173377ed64..4831ce11224 100644
--- a/website/docs/r/inspector_assessment_target.html.markdown
+++ b/website/docs/r/inspector_assessment_target.html.markdown
@@ -28,21 +28,30 @@ resource "aws_inspector_assessment_target" "foo" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The name of the assessment target.
 * `resource_group_arn` (Optional) Inspector Resource Group Amazon Resource Name (ARN) stating tags for instance matching. If not specified, all EC2 instances in the current AWS account and region are included in the assessment target.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The target assessment ARN.
 
 ## Import
 
-Inspector Classic Assessment Targets can be imported via their Amazon Resource Name (ARN), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Inspector Classic Assessment Targets using their Amazon Resource Name (ARN). For example:
 
-```sh
-$ terraform import aws_inspector_assessment_target.example arn:aws:inspector:us-east-1:123456789012:target/0-xxxxxxx
+```terraform
+import {
+  to = aws_inspector_assessment_target.example
+  id = "arn:aws:inspector:us-east-1:123456789012:target/0-xxxxxxx"
+}
+```
+
+Using `terraform import`, import Inspector Classic Assessment Targets using their Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_inspector_assessment_target.example arn:aws:inspector:us-east-1:123456789012:target/0-xxxxxxx
 ```
diff --git a/website/docs/r/inspector_assessment_template.html.markdown b/website/docs/r/inspector_assessment_template.html.markdown
index 862d48babe0..6bc2bd7ebfe 100644
--- a/website/docs/r/inspector_assessment_template.html.markdown
+++ b/website/docs/r/inspector_assessment_template.html.markdown
@@ -34,7 +34,7 @@ resource "aws_inspector_assessment_template" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The name of the assessment template.
 * `target_arn` - (Required) The assessment target ARN to attach the template to.
@@ -50,17 +50,26 @@ The event subscription configuration block supports the following arguments:
 * `event` - (Required) The event for which you want to receive SNS notifications. Valid values are `ASSESSMENT_RUN_STARTED`, `ASSESSMENT_RUN_COMPLETED`, `ASSESSMENT_RUN_STATE_CHANGED`, and `FINDING_REPORTED`.
 * `topic_arn` - (Required) The ARN of the SNS topic to which notifications are sent.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The template assessment ARN.
 * `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
 
 ## Import
 
-`aws_inspector_assessment_template` can be imported by using the template assessment ARN, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_inspector_assessment_template` using the template assessment ARN. For example:
 
+```terraform
+import {
+  to = aws_inspector_assessment_template.example
+  id = "arn:aws:inspector:us-west-2:123456789012:target/0-9IaAzhGR/template/0-WEcjR8CH"
+}
 ```
-$ terraform import aws_inspector_assessment_template.example arn:aws:inspector:us-west-2:123456789012:target/0-9IaAzhGR/template/0-WEcjR8CH
+
+Using `terraform import`, import `aws_inspector_assessment_template` using the template assessment ARN. For example:
+
+```console
+% terraform import aws_inspector_assessment_template.example arn:aws:inspector:us-west-2:123456789012:target/0-9IaAzhGR/template/0-WEcjR8CH
 ```
diff --git a/website/docs/r/inspector_resource_group.html.markdown b/website/docs/r/inspector_resource_group.html.markdown
index cd22512e413..0206aa459b1 100644
--- a/website/docs/r/inspector_resource_group.html.markdown
+++ b/website/docs/r/inspector_resource_group.html.markdown
@@ -23,12 +23,12 @@ resource "aws_inspector_resource_group" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `tags` - (Required) Key-value map of tags that are used to select the EC2 instances to be included in an [Amazon Inspector assessment target](/docs/providers/aws/r/inspector_assessment_target.html).
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The resource group ARN.
diff --git a/website/docs/r/instance.html.markdown b/website/docs/r/instance.html.markdown
index 225d48799d9..eb5cb9c6509 100644
--- a/website/docs/r/instance.html.markdown
+++ b/website/docs/r/instance.html.markdown
@@ -180,7 +180,7 @@ resource "aws_instance" "this" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `ami` - (Optional) AMI to use for the instance. Required unless `launch_template` is specified and the Launch Template specifes an AMI. If an AMI is specified in the Launch Template, setting `ami` will override the AMI specified in the Launch Template.
 * `associate_public_ip_address` - (Optional) Whether to associate a public IP address with an instance in a VPC.
@@ -296,7 +296,7 @@ The `root_block_device` block supports the following:
 * `tags` - (Optional) Map of tags to assign to the device.
 * `throughput` - (Optional) Throughput to provision for a volume in mebibytes per second (MiB/s). This is only valid for `volume_type` of `gp3`.
 * `volume_size` - (Optional) Size of the volume in gibibytes (GiB).
-* `volume_type` - (Optional) Type of volume. Valid values include `standard`, `gp2`, `gp3`, `io1`, `io2`, `sc1`, or `st1`. Defaults to `gp2`.
+* `volume_type` - (Optional) Type of volume. Valid values include `standard`, `gp2`, `gp3`, `io1`, `io2`, `sc1`, or `st1`. Defaults to the volume type that the AMI uses.
 
 Modifying the `encrypted` or `kms_key_id` settings of the `root_block_device` requires resource replacement.
 
@@ -355,6 +355,7 @@ Metadata options can be applied/modified to the EC2 Instance at any time.
 The `metadata_options` block supports the following:
 
 * `http_endpoint` - (Optional) Whether the metadata service is available. Valid values include `enabled` or `disabled`. Defaults to `enabled`.
+* `http_protocol_ipv6` - (Optional) Whether the IPv6 endpoint for the instance metadata service is enabled. Defaults to `disabled`.
 * `http_put_response_hop_limit` - (Optional) Desired HTTP PUT response hop limit for instance metadata requests. The larger the number, the further instance metadata requests can travel. Valid values are integer from `1` to `64`. Defaults to `1`.
 * `http_tokens` - (Optional) Whether or not the metadata service requires session tokens, also referred to as _Instance Metadata Service Version 2 (IMDSv2)_. Valid values include `optional` or `required`. Defaults to `optional`.
 * `instance_metadata_tags` - (Optional) Enables or disables access to instance tags from the instance metadata service. Valid values include `enabled` or `disabled`. Defaults to `disabled`.
@@ -404,9 +405,9 @@ The `launch_template` block supports the following:
 * `name` - Name of the launch template. Conflicts with `id`.
 * `version` - Template version. Can be a specific version number, `$Latest` or `$Default`. The default value is `$Default`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the instance.
 * `capacity_reservation_specification` - Capacity reservation specification of the instance.
@@ -443,8 +444,17 @@ For `instance_market_options`, in addition to the arguments above, the following
 
 ## Import
 
-Instances can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import instances using the `id`. For example:
 
+```terraform
+import {
+  to = aws_instance.web
+  id = "i-12345678"
+}
 ```
-$ terraform import aws_instance.web i-12345678
+
+Using `terraform import`, import instances using the `id`. For example:
+
+```console
+% terraform import aws_instance.web i-12345678
 ```
diff --git a/website/docs/r/internet_gateway.html.markdown b/website/docs/r/internet_gateway.html.markdown
index a3f8162e21f..199778a115b 100644
--- a/website/docs/r/internet_gateway.html.markdown
+++ b/website/docs/r/internet_gateway.html.markdown
@@ -24,7 +24,7 @@ resource "aws_internet_gateway" "gw" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `vpc_id` - (Optional) The VPC ID to create in.  See the [aws_internet_gateway_attachment](internet_gateway_attachment.html) resource for an alternate way to attach an Internet Gateway to a VPC.
 * `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
@@ -43,9 +43,9 @@ resource "aws_instance" "foo" {
 }
 ```
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the Internet Gateway.
 * `arn` - The ARN of the Internet Gateway.
@@ -62,8 +62,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Internet Gateways can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Internet Gateways using the `id`. For example:
 
+```terraform
+import {
+  to = aws_internet_gateway.gw
+  id = "igw-c0a643a9"
+}
 ```
-$ terraform import aws_internet_gateway.gw igw-c0a643a9
+
+Using `terraform import`, import Internet Gateways using the `id`. For example:
+
+```console
+% terraform import aws_internet_gateway.gw igw-c0a643a9
 ```
diff --git a/website/docs/r/internet_gateway_attachment.html.markdown b/website/docs/r/internet_gateway_attachment.html.markdown
index 86f1f7664b0..b780b0f1868 100644
--- a/website/docs/r/internet_gateway_attachment.html.markdown
+++ b/website/docs/r/internet_gateway_attachment.html.markdown
@@ -27,14 +27,14 @@ resource "aws_internet_gateway" "example" {}
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `internet_gateway_id` - (Required) The ID of the internet gateway.
 * `vpc_id` - (Required) The ID of the VPC.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the VPC and Internet Gateway separated by a colon.
 
@@ -47,8 +47,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Internet Gateway Attachments can be imported using the `id`, e.g.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Internet Gateway Attachments using the `id`. For example:
 
+```terraform
+import {
+  to = aws_internet_gateway_attachment.example
+  id = "igw-c0a643a9:vpc-123456"
+}
 ```
-$ terraform import aws_internet_gateway_attachment.example igw-c0a643a9:vpc-123456
+
+Using `terraform import`, import Internet Gateway Attachments using the `id`. For example:
+
+```console
+% terraform import aws_internet_gateway_attachment.example igw-c0a643a9:vpc-123456
 ```
diff --git a/website/docs/r/internetmonitor_monitor.html.markdown b/website/docs/r/internetmonitor_monitor.html.markdown
index 2c0da1616ce..8d0acfd2368 100644
--- a/website/docs/r/internetmonitor_monitor.html.markdown
+++ b/website/docs/r/internetmonitor_monitor.html.markdown
@@ -26,16 +26,24 @@ The following arguments are required:
 
 The following arguments are optional:
 
+* `health_events_config` - (Optional) Health event thresholds. A health event threshold percentage, for performance and availability, determines when Internet Monitor creates a health event when there's an internet issue that affects your application end users. See [Health Events Config](#health-events-config) below.
 * `internet_measurements_log_delivery` - (Optional) Publish internet measurements for Internet Monitor to an Amazon S3 bucket in addition to CloudWatch Logs.
 * `max_city_networks_to_monitor` - (Optional) The maximum number of city-networks to monitor for your resources. A city-network is the location (city) where clients access your application resources from and the network or ASN, such as an internet service provider (ISP), that clients access the resources through. This limit helps control billing costs.
-* `resources` - (Optional)The resources to include in a monitor, which you provide as a set of Amazon Resource Names (ARNs).
+* `resources` - (Optional) The resources to include in a monitor, which you provide as a set of Amazon Resource Names (ARNs).
 * `status` - (Optional) The status for a monitor. The accepted values for Status with the UpdateMonitor API call are the following: `ACTIVE` and `INACTIVE`.
 * `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 * `traffic_percentage_to_monitor` - (Optional) The percentage of the internet-facing traffic for your application that you want to monitor with this monitor.
 
-## Attributes Reference
+### Health Events Config
 
-In addition to all arguments above, the following attributes are exported:
+Defines the health event threshold percentages, for performance score and availability score. Amazon CloudWatch Internet Monitor creates a health event when there's an internet issue that affects your application end users where a health score percentage is at or below a set threshold. If you don't set a health event threshold, the default value is 95%.
+
+* `availability_score_threshold` - (Optional) The health event threshold percentage set for availability scores.
+* `performance_score_threshold` - (Optional) The health event threshold percentage set for performance scores.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the Monitor.
 * `id` - Name of the monitor.
@@ -43,8 +51,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Internet Monitor Monitors can be imported using the `monitor_name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Internet Monitor Monitors using the `monitor_name`. For example:
 
+```terraform
+import {
+  to = aws_internetmonitor_monitor.some
+  id = "some-monitor"
+}
 ```
-$ terraform import aws_internetmonitor_monitor.some some-monitor
+
+Using `terraform import`, import Internet Monitor Monitors using the `monitor_name`. For example:
+
+```console
+% terraform import aws_internetmonitor_monitor.some some-monitor
 ```
diff --git a/website/docs/r/iot_authorizer.html.markdown b/website/docs/r/iot_authorizer.html.markdown
index 990b5d78a03..c129f2efe56 100644
--- a/website/docs/r/iot_authorizer.html.markdown
+++ b/website/docs/r/iot_authorizer.html.markdown
@@ -36,16 +36,25 @@ resource "aws_iot_authorizer" "example" {
 * `token_key_name` - (Optional) The name of the token key used to extract the token from the HTTP headers. This value is required if signing is enabled in your authorizer.
 * `token_signing_public_keys` - (Optional) The public keys used to verify the digital signature returned by your custom authentication service. This value is required if signing is enabled in your authorizer.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The ARN of the authorizer.
 
 ## Import
 
-IOT Authorizers can be imported using the name, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IOT Authorizers using the name. For example:
 
+```terraform
+import {
+  to = aws_iot_authorizer.example
+  id = "example"
+}
 ```
-$ terraform import aws_iot_authorizer.example example
+
+Using `terraform import`, import IOT Authorizers using the name. For example:
+
+```console
+% terraform import aws_iot_authorizer.example example
 ```
diff --git a/website/docs/r/iot_certificate.html.markdown b/website/docs/r/iot_certificate.html.markdown
index 81b6a10407d..e7f7db6f18c 100644
--- a/website/docs/r/iot_certificate.html.markdown
+++ b/website/docs/r/iot_certificate.html.markdown
@@ -53,9 +53,9 @@ resource "aws_iot_certificate" "cert" {
   for more information on registering a certificate.
 * `ca_pem` - (Optional) The CA certificate for the certificate to be registered. If this is set, the CA needs to be registered with AWS IoT beforehand.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The internal ID assigned to this certificate.
 * `arn` - The ARN of the created certificate.
diff --git a/website/docs/r/iot_domain_configuration.html.markdown b/website/docs/r/iot_domain_configuration.html.markdown
new file mode 100644
index 00000000000..bc92dbc89d1
--- /dev/null
+++ b/website/docs/r/iot_domain_configuration.html.markdown
@@ -0,0 +1,71 @@
+---
+subcategory: "IoT Core"
+layout: "aws"
+page_title: "AWS: aws_iot_domain_configuration"
+description: |-
+    Creates and manages an AWS IoT domain configuration.
+---
+
+# Resource: aws_iot_domain_configuration
+
+Creates and manages an AWS IoT domain configuration.
+
+## Example Usage
+
+```terraform
+resource "aws_iot_domain_configuration" "iot" {
+  name         = "iot-"
+  domain_name  = "iot.example.com"
+  service_type = "DATA"
+
+  server_certificate_arns = [
+    aws_acm_certificate.cert.arn
+  ]
+}
+```
+
+## Argument Reference
+
+* `authorizer_config` - (Optional) An object that specifies the authorization service for a domain. See below.
+* `domain_name` - (Optional) Fully-qualified domain name.
+* `name` - (Required) The name of the domain configuration. This value must be unique to a region.
+* `server_certificate_arns` - (Optional) The ARNs of the certificates that IoT passes to the device during the TLS handshake. Currently you can specify only one certificate ARN. This value is not required for Amazon Web Services-managed domains. When using a custom `domain_name`, the cert must include it.
+* `service_type` - (Optional) The type of service delivered by the endpoint. Note: Amazon Web Services IoT Core currently supports only the `DATA` service type.
+* `tags` - (Optional) Map of tags to assign to this resource. If configured with a provider [`default_tags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `tls_config` - (Optional) An object that specifies the TLS configuration for a domain. See below.
+* `validation_certificate_arn` - (Optional) The certificate used to validate the server certificate and prove domain name ownership. This certificate must be signed by a public certificate authority. This value is not required for Amazon Web Services-managed domains.
+
+### authorizer_config
+
+* `allow_authorizer_override` - (Optional) A Boolean that specifies whether the domain configuration's authorization service can be overridden.
+* `default_authorizer_name` - (Optional) The name of the authorization service for a domain configuration.
+
+### tls_config
+
+* `security_policy` - (Optional) The security policy for a domain configuration.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the domain configuration.
+* `domain_type` - The type of the domain.
+* `id` - The name of the created domain configuration.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IOT domain configurations using the name. For example:
+
+```terraform
+import {
+  to = aws_iot_domain_configuration.example
+  id = "example"
+}
+```
+
+Using `terraform import`, import domain configurations using the name. For example:
+
+```console
+% terraform import aws_iot_domain_configuration.example example
+```
diff --git a/website/docs/r/iot_indexing_configuration.html.markdown b/website/docs/r/iot_indexing_configuration.html.markdown
index 6e668560000..fe31d00756f 100644
--- a/website/docs/r/iot_indexing_configuration.html.markdown
+++ b/website/docs/r/iot_indexing_configuration.html.markdown
@@ -20,6 +20,10 @@ resource "aws_iot_indexing_configuration" "example" {
     device_defender_indexing_mode    = "VIOLATIONS"
     named_shadow_indexing_mode       = "ON"
 
+    filter {
+      named_shadow_names = ["thing1shadow"]
+    }
+
     custom_field {
       name = "shadow.desired.power"
       type = "Boolean"
@@ -61,6 +65,7 @@ The `thing_indexing_configuration` configuration block supports the following:
 * `device_defender_indexing_mode` - (Optional) Device Defender indexing mode. Valid values: `VIOLATIONS`, `OFF`. Default: `OFF`.
 * `managed_field` - (Optional) Contains fields that are indexed and whose types are already known by the Fleet Indexing service. See below.
 * `named_shadow_indexing_mode` - (Optional) [Named shadow](https://docs.aws.amazon.com/iot/latest/developerguide/iot-device-shadows.html) indexing mode. Valid values: `ON`, `OFF`. Default: `OFF`.
+* `filter` - (Optional) Required if `named_shadow_indexing_mode` is `ON`. Enables to add named shadows filtered by `filter` to fleet indexing configuration.
 * `thing_connectivity_indexing_mode` - (Optional) Thing connectivity indexing mode. Valid values: `STATUS`, `OFF`. Default: `OFF`.
 * `thing_indexing_mode` - (Required) Thing indexing mode. Valid values: `REGISTRY`, `REGISTRY_AND_SHADOW`, `OFF`.
 
@@ -71,6 +76,12 @@ The `custom_field` and `managed_field` configuration blocks supports the followi
 * `name` - (Optional) The name of the field.
 * `type` - (Optional) The data type of the field. Valid values: `Number`, `String`, `Boolean`.
 
-## Attributes Reference
+### filter
+
+The `filter` configuration block supports the following:
+
+* `named_shadow_names` - (Optional) List of shadow names that you select to index.
+
+## Attribute Reference
 
-No additional attributes are exported.
+This resource exports no additional attributes.
diff --git a/website/docs/r/iot_logging_options.html.markdown b/website/docs/r/iot_logging_options.html.markdown
index 8384d1874d8..ac9b0832a6d 100644
--- a/website/docs/r/iot_logging_options.html.markdown
+++ b/website/docs/r/iot_logging_options.html.markdown
@@ -25,6 +25,6 @@ resource "aws_iot_logging_options" "example" {
 * `disable_all_logs` - (Optional) If `true` all logs are disabled. The default is `false`.
 * `role_arn` - (Required) The ARN of the role that allows IoT to write to Cloudwatch logs.
 
-## Attributes Reference
+## Attribute Reference
 
-No additional attributes are exported.
+This resource exports no additional attributes.
diff --git a/website/docs/r/iot_policy.html.markdown b/website/docs/r/iot_policy.html.markdown
index d7e8f502a1f..335d23407a5 100644
--- a/website/docs/r/iot_policy.html.markdown
+++ b/website/docs/r/iot_policy.html.markdown
@@ -35,14 +35,14 @@ resource "aws_iot_policy" "pubsub" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The name of the policy.
 * `policy` - (Required) The policy document. This is a JSON formatted string. Use the [IoT Developer Guide](http://docs.aws.amazon.com/iot/latest/developerguide/iot-policies.html) for more information on IoT Policies. For more information about building AWS IAM policy documents with Terraform, see the [AWS IAM Policy Document Guide](https://learn.hashicorp.com/terraform/aws/iam-policy).
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The ARN assigned by AWS to this policy.
 * `name` - The name of this policy.
@@ -51,8 +51,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-IoT policies can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IoT policies using the `name`. For example:
 
+```terraform
+import {
+  to = aws_iot_policy.pubsub
+  id = "PubSubToAnyTopic"
+}
 ```
-$ terraform import aws_iot_policy.pubsub PubSubToAnyTopic
+
+Using `terraform import`, import IoT policies using the `name`. For example:
+
+```console
+% terraform import aws_iot_policy.pubsub PubSubToAnyTopic
 ```
diff --git a/website/docs/r/iot_policy_attachment.html.markdown b/website/docs/r/iot_policy_attachment.html.markdown
index 0b4c2f8bedc..25fe7b08396 100644
--- a/website/docs/r/iot_policy_attachment.html.markdown
+++ b/website/docs/r/iot_policy_attachment.html.markdown
@@ -39,11 +39,11 @@ resource "aws_iot_policy_attachment" "att" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `policy` - (Required) The name of the policy to attach.
 * `target` - (Required) The identity to which the policy is attached.
 
-## Attributes Reference
+## Attribute Reference
 
-No additional attributes are exported.
+This resource exports no additional attributes.
diff --git a/website/docs/r/iot_provisioning_template.html.markdown b/website/docs/r/iot_provisioning_template.html.markdown
index 09df05de83f..ece1f2a45de 100644
--- a/website/docs/r/iot_provisioning_template.html.markdown
+++ b/website/docs/r/iot_provisioning_template.html.markdown
@@ -51,6 +51,7 @@ resource "aws_iot_provisioning_template" "fleet" {
   name                  = "FleetTemplate"
   description           = "My provisioning template"
   provisioning_role_arn = aws_iam_role.iot_fleet_provisioning.arn
+  enabled               = true
 
   template_body = jsonencode({
     Parameters = {
@@ -79,7 +80,7 @@ resource "aws_iot_provisioning_template" "fleet" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The name of the fleet provisioning template.
 * `description` - (Optional) The description of the fleet provisioning template.
@@ -88,6 +89,7 @@ The following arguments are supported:
 * `provisioning_role_arn` - (Required) The role ARN for the role associated with the fleet provisioning template. This IoT role grants permission to provision a device.
 * `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 * `template_body` - (Required) The JSON formatted contents of the fleet provisioning template.
+* `type` - (Optional) The type you define in a provisioning template.
 
 ### pre_provisioning_hook
 
@@ -96,9 +98,9 @@ The `pre_provisioning_hook` configuration block supports the following:
 * `payload_version` - (Optional) The version of the payload that was sent to the target function. The only valid (and the default) payload version is `"2020-04-01"`.
 * `target_arn` - (Optional) The ARN of the target function.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The ARN that identifies the provisioning template.
 * `default_version_id` - The default version of the fleet provisioning template.
@@ -106,8 +108,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-IoT fleet provisioning templates can be imported using the `name`, e.g.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IoT fleet provisioning templates using the `name`. For example:
 
+```terraform
+import {
+  to = aws_iot_provisioning_template.fleet
+  id = "FleetProvisioningTemplate"
+}
 ```
-$ terraform import aws_iot_provisioning_template.fleet FleetProvisioningTemplate
+
+Using `terraform import`, import IoT fleet provisioning templates using the `name`. For example:
+
+```console
+% terraform import aws_iot_provisioning_template.fleet FleetProvisioningTemplate
 ```
diff --git a/website/docs/r/iot_role_alias.html.markdown b/website/docs/r/iot_role_alias.html.markdown
index 119a5f93723..4c0147eb990 100644
--- a/website/docs/r/iot_role_alias.html.markdown
+++ b/website/docs/r/iot_role_alias.html.markdown
@@ -37,22 +37,31 @@ resource "aws_iot_role_alias" "alias" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `alias` - (Required) The name of the role alias.
 * `role_arn` - (Required) The identity of the role to which the alias refers.
 * `credential_duration` - (Optional) The duration of the credential, in seconds. If you do not specify a value for this setting, the default maximum of one hour is applied. This setting can have a value from 900 seconds (15 minutes) to 43200 seconds (12 hours).
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The ARN assigned by AWS to this role alias.
 
 ## Import
 
-IOT Role Alias can be imported via the alias, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IOT Role Alias using the alias. For example:
 
-```sh
-$ terraform import aws_iot_role_alias.example myalias
+```terraform
+import {
+  to = aws_iot_role_alias.example
+  id = "myalias"
+}
+```
+
+Using `terraform import`, import IOT Role Alias using the alias. For example:
+
+```console
+% terraform import aws_iot_role_alias.example myalias
 ```
diff --git a/website/docs/r/iot_thing.html.markdown b/website/docs/r/iot_thing.html.markdown
index 6b4ca8786a6..47de1ec36d1 100644
--- a/website/docs/r/iot_thing.html.markdown
+++ b/website/docs/r/iot_thing.html.markdown
@@ -28,9 +28,9 @@ resource "aws_iot_thing" "example" {
 * `attributes` - (Optional) Map of attributes of the thing.
 * `thing_type_name` - (Optional) The thing type name.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `default_client_id` - The default client ID.
 * `version` - The current version of the thing record in the registry.
@@ -38,8 +38,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-IOT Things can be imported using the name, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IOT Things using the name. For example:
 
+```terraform
+import {
+  to = aws_iot_thing.example
+  id = "example"
+}
 ```
-$ terraform import aws_iot_thing.example example
+
+Using `terraform import`, import IOT Things using the name. For example:
+
+```console
+% terraform import aws_iot_thing.example example
 ```
diff --git a/website/docs/r/iot_thing_group.html.markdown b/website/docs/r/iot_thing_group.html.markdown
index bb420f73baa..6d39c5aa751 100644
--- a/website/docs/r/iot_thing_group.html.markdown
+++ b/website/docs/r/iot_thing_group.html.markdown
@@ -54,9 +54,9 @@ resource "aws_iot_thing_group" "example" {
 
 * `attributes` - (Optional) Key-value map.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The ARN of the Thing Group.
 * `id` - The Thing Group ID.
@@ -64,8 +64,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-IoT Things Groups can be imported using the name, e.g.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IoT Things Groups using the name. For example:
 
+```terraform
+import {
+  to = aws_iot_thing_group.example
+  id = "example"
+}
 ```
-$ terraform import aws_iot_thing_group.example example
+
+Using `terraform import`, import IoT Things Groups using the name. For example:
+
+```console
+% terraform import aws_iot_thing_group.example example
 ```
diff --git a/website/docs/r/iot_thing_group_membership.html.markdown b/website/docs/r/iot_thing_group_membership.html.markdown
index 4d00d75e31a..77d94446b7d 100644
--- a/website/docs/r/iot_thing_group_membership.html.markdown
+++ b/website/docs/r/iot_thing_group_membership.html.markdown
@@ -27,16 +27,25 @@ resource "aws_iot_thing_group_membership" "example" {
 * `thing_group_name` - (Required) The name of the group to which you are adding a thing.
 * `override_dynamic_group` - (Optional) Override dynamic thing groups with static thing groups when 10-group limit is reached. If a thing belongs to 10 thing groups, and one or more of those groups are dynamic thing groups, adding a thing to a static group removes the thing from the last dynamic group.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The membership ID.
 
 ## Import
 
-IoT Thing Group Membership can be imported using the thing group name and thing name.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IoT Thing Group Membership using the thing group name and thing name. For example:
 
+```terraform
+import {
+  to = aws_iot_thing_group_membership.example
+  id = "thing_group_name/thing_name"
+}
 ```
-$ terraform import aws_iot_thing_group_membership.example thing_group_name/thing_name
+
+Using `terraform import`, import IoT Thing Group Membership using the thing group name and thing name. For example:
+
+```console
+% terraform import aws_iot_thing_group_membership.example thing_group_name/thing_name
 ```
diff --git a/website/docs/r/iot_thing_principal_attachment.html.markdown b/website/docs/r/iot_thing_principal_attachment.html.markdown
index 3b568f0103a..d591d611721 100644
--- a/website/docs/r/iot_thing_principal_attachment.html.markdown
+++ b/website/docs/r/iot_thing_principal_attachment.html.markdown
@@ -33,6 +33,6 @@ resource "aws_iot_thing_principal_attachment" "att" {
 * `principal` - (Required) The AWS IoT Certificate ARN or Amazon Cognito Identity ID.
 * `thing` - (Required) The name of the thing.
 
-## Attributes Reference
+## Attribute Reference
 
-No additional attributes are exported.
+This resource exports no additional attributes.
diff --git a/website/docs/r/iot_thing_type.html.markdown b/website/docs/r/iot_thing_type.html.markdown
index 9d282227fe4..90bbeea229e 100644
--- a/website/docs/r/iot_thing_type.html.markdown
+++ b/website/docs/r/iot_thing_type.html.markdown
@@ -27,17 +27,26 @@ resource "aws_iot_thing_type" "foo" {
     * `searchable_attributes` - (Optional, Forces New Resource) A list of searchable thing attribute names.
 * `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The ARN of the created AWS IoT Thing Type.
 * `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
 
 ## Import
 
-IOT Thing Types can be imported using the name, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IOT Thing Types using the name. For example:
 
+```terraform
+import {
+  to = aws_iot_thing_type.example
+  id = "example"
+}
 ```
-$ terraform import aws_iot_thing_type.example example
+
+Using `terraform import`, import IOT Thing Types using the name. For example:
+
+```console
+% terraform import aws_iot_thing_type.example example
 ```
diff --git a/website/docs/r/iot_topic_rule.html.markdown b/website/docs/r/iot_topic_rule.html.markdown
index d28d5df6427..3e47e39b52e 100644
--- a/website/docs/r/iot_topic_rule.html.markdown
+++ b/website/docs/r/iot_topic_rule.html.markdown
@@ -224,9 +224,9 @@ The `timestream` object takes the following arguments:
     * `unit` - (Required) The precision of the timestamp value that results from the expression described in value. Valid values: `SECONDS`, `MILLISECONDS`, `MICROSECONDS`, `NANOSECONDS`.
     * `value` - (Required) An expression that returns a long epoch time value.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The name of the topic rule
 * `arn` - The ARN of the topic rule
@@ -234,8 +234,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-IoT Topic Rules can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IoT Topic Rules using the `name`. For example:
 
+```terraform
+import {
+  to = aws_iot_topic_rule.rule
+  id = "<name>"
+}
 ```
-$ terraform import aws_iot_topic_rule.rule <name>
+
+Using `terraform import`, import IoT Topic Rules using the `name`. For example:
+
+```console
+% terraform import aws_iot_topic_rule.rule <name>
 ```
diff --git a/website/docs/r/iot_topic_rule_destination.html.markdown b/website/docs/r/iot_topic_rule_destination.html.markdown
index a8d84ce6e18..347aadcb8e3 100644
--- a/website/docs/r/iot_topic_rule_destination.html.markdown
+++ b/website/docs/r/iot_topic_rule_destination.html.markdown
@@ -33,16 +33,25 @@ The `vpc_configuration` object takes the following arguments:
 * `subnet_ids` - (Required) The subnet IDs of the VPC destination.
 * `vpc_id` - (Required) The ID of the VPC.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The ARN of the topic rule destination
 
 ## Import
 
-IoT topic rule destinations can be imported using the `arn`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IoT topic rule destinations using the `arn`. For example:
 
+```terraform
+import {
+  to = aws_iot_topic_rule_destination.example
+  id = "arn:aws:iot:us-west-2:123456789012:ruledestination/vpc/2ce781c8-68a6-4c52-9c62-63fe489ecc60"
+}
 ```
-$ terraform import aws_iot_topic_rule_destination.example arn:aws:iot:us-west-2:123456789012:ruledestination/vpc/2ce781c8-68a6-4c52-9c62-63fe489ecc60
+
+Using `terraform import`, import IoT topic rule destinations using the `arn`. For example:
+
+```console
+% terraform import aws_iot_topic_rule_destination.example arn:aws:iot:us-west-2:123456789012:ruledestination/vpc/2ce781c8-68a6-4c52-9c62-63fe489ecc60
 ```
diff --git a/website/docs/r/ivs_channel.html.markdown b/website/docs/r/ivs_channel.html.markdown
index 08c7ec32398..7badd1cdf55 100644
--- a/website/docs/r/ivs_channel.html.markdown
+++ b/website/docs/r/ivs_channel.html.markdown
@@ -31,9 +31,9 @@ The following arguments are optional:
 * `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 * `type` - (Optional) Channel type, which determines the allowable resolution and bitrate. Valid values: `STANDARD`, `BASIC`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the Channel.
 * `ingest_endpoint` - Channel ingest endpoint, part of the definition of an ingest server, used when setting up streaming software.
@@ -50,8 +50,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-IVS (Interactive Video) Channel can be imported using the ARN, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IVS (Interactive Video) Channel using the ARN. For example:
 
+```terraform
+import {
+  to = aws_ivs_channel.example
+  id = "arn:aws:ivs:us-west-2:326937407773:channel/0Y1lcs4U7jk5"
+}
 ```
-$ terraform import aws_ivs_channel.example arn:aws:ivs:us-west-2:326937407773:channel/0Y1lcs4U7jk5
+
+Using `terraform import`, import IVS (Interactive Video) Channel using the ARN. For example:
+
+```console
+% terraform import aws_ivs_channel.example arn:aws:ivs:us-west-2:326937407773:channel/0Y1lcs4U7jk5
 ```
diff --git a/website/docs/r/ivs_playback_key_pair.html.markdown b/website/docs/r/ivs_playback_key_pair.html.markdown
index 63fbc53a5d8..6a0dd76714a 100644
--- a/website/docs/r/ivs_playback_key_pair.html.markdown
+++ b/website/docs/r/ivs_playback_key_pair.html.markdown
@@ -32,9 +32,9 @@ The following arguments are optional:
 * `name` - (Optional) Playback Key Pair name.
 * `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the Playback Key Pair.
 * `fingerprint` - Key-pair identifier.
@@ -49,8 +49,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-IVS (Interactive Video) Playback Key Pair can be imported using the ARN, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IVS (Interactive Video) Playback Key Pair using the ARN. For example:
 
+```terraform
+import {
+  to = aws_ivs_playback_key_pair.example
+  id = "arn:aws:ivs:us-west-2:326937407773:playback-key/KDJRJNQhiQzA"
+}
 ```
-$ terraform import aws_ivs_playback_key_pair.example arn:aws:ivs:us-west-2:326937407773:playback-key/KDJRJNQhiQzA
+
+Using `terraform import`, import IVS (Interactive Video) Playback Key Pair using the ARN. For example:
+
+```console
+% terraform import aws_ivs_playback_key_pair.example arn:aws:ivs:us-west-2:326937407773:playback-key/KDJRJNQhiQzA
 ```
diff --git a/website/docs/r/ivs_recording_configuration.html.markdown b/website/docs/r/ivs_recording_configuration.html.markdown
index a0fc6d1c297..4a268924164 100644
--- a/website/docs/r/ivs_recording_configuration.html.markdown
+++ b/website/docs/r/ivs_recording_configuration.html.markdown
@@ -42,9 +42,9 @@ The following arguments are optional:
     * `recording_mode` - (Optional) Thumbnail recording mode. Valid values: `DISABLED`, `INTERVAL`.
     * `target_interval_seconds` (Configurable [and required] only if `recording_mode` is `INTERVAL`) - The targeted thumbnail-generation interval in seconds.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the Recording Configuration.
 * `state` -  The current state of the Recording Configuration.
@@ -59,8 +59,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-IVS (Interactive Video) Recording Configuration can be imported using the ARN, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IVS (Interactive Video) Recording Configuration using the ARN. For example:
 
+```terraform
+import {
+  to = aws_ivs_recording_configuration.example
+  id = "arn:aws:ivs:us-west-2:326937407773:recording-configuration/KAk1sHBl2L47"
+}
 ```
-$ terraform import aws_ivs_recording_configuration.example arn:aws:ivs:us-west-2:326937407773:recording-configuration/KAk1sHBl2L47
+
+Using `terraform import`, import IVS (Interactive Video) Recording Configuration using the ARN. For example:
+
+```console
+% terraform import aws_ivs_recording_configuration.example arn:aws:ivs:us-west-2:326937407773:recording-configuration/KAk1sHBl2L47
 ```
diff --git a/website/docs/r/ivschat_logging_configuration.html.markdown b/website/docs/r/ivschat_logging_configuration.html.markdown
index fd566cff02e..d2760254d12 100644
--- a/website/docs/r/ivschat_logging_configuration.html.markdown
+++ b/website/docs/r/ivschat_logging_configuration.html.markdown
@@ -112,9 +112,9 @@ The following arguments are optional:
 * `name` - (Optional) Logging Configuration name.
 * `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the Logging Configuration.
 * `id` - ID of the Logging Configuration.
@@ -131,8 +131,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-IVS (Interactive Video) Chat Logging Configuration can be imported using the ARN, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IVS (Interactive Video) Chat Logging Configuration using the ARN. For example:
 
+```terraform
+import {
+  to = aws_ivschat_logging_configuration.example
+  id = "arn:aws:ivschat:us-west-2:326937407773:logging-configuration/MMUQc8wcqZmC"
+}
 ```
-$ terraform import aws_ivschat_logging_configuration.example arn:aws:ivschat:us-west-2:326937407773:logging-configuration/MMUQc8wcqZmC
+
+Using `terraform import`, import IVS (Interactive Video) Chat Logging Configuration using the ARN. For example:
+
+```console
+% terraform import aws_ivschat_logging_configuration.example arn:aws:ivschat:us-west-2:326937407773:logging-configuration/MMUQc8wcqZmC
 ```
diff --git a/website/docs/r/ivschat_room.html.markdown b/website/docs/r/ivschat_room.html.markdown
index 36f02f60d69..b37b4dd84ce 100644
--- a/website/docs/r/ivschat_room.html.markdown
+++ b/website/docs/r/ivschat_room.html.markdown
@@ -68,9 +68,9 @@ The following arguments are optional:
 * `name` - (Optional) Room name.
 * `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the Room.
 * `id` - Room ID
@@ -86,8 +86,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-IVS (Interactive Video) Chat Room can be imported using the ARN, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IVS (Interactive Video) Chat Room using the ARN. For example:
 
+```terraform
+import {
+  to = aws_ivschat_room.example
+  id = "arn:aws:ivschat:us-west-2:326937407773:room/GoXEXyB4VwHb"
+}
 ```
-$ terraform import aws_ivschat_room.example arn:aws:ivschat:us-west-2:326937407773:room/GoXEXyB4VwHb
+
+Using `terraform import`, import IVS (Interactive Video) Chat Room using the ARN. For example:
+
+```console
+% terraform import aws_ivschat_room.example arn:aws:ivschat:us-west-2:326937407773:room/GoXEXyB4VwHb
 ```
diff --git a/website/docs/r/kendra_data_source.html.markdown b/website/docs/r/kendra_data_source.html.markdown
index f2cf34ce1ae..569591a8ff0 100644
--- a/website/docs/r/kendra_data_source.html.markdown
+++ b/website/docs/r/kendra_data_source.html.markdown
@@ -59,10 +59,11 @@ resource "aws_kendra_data_source" "example" {
 
   configuration {
     s3_configuration {
+      bucket_name = aws_s3_bucket.example.id
+
       access_control_list_configuration {
         key_path = "s3://${aws_s3_bucket.example.id}/path-1"
       }
-      bucket_name = aws_s3_bucket.example.id
     }
   }
 }
@@ -79,12 +80,14 @@ resource "aws_kendra_data_source" "example" {
 
   configuration {
     s3_configuration {
-      bucket_name = aws_s3_bucket.example.id
-      s3_prefix   = "example"
-
+      bucket_name        = aws_s3_bucket.example.id
       exclusion_patterns = ["example"]
       inclusion_patterns = ["hello"]
       inclusion_prefixes = ["world"]
+
+      documents_metadata_configuration {
+        s3_prefix = "example"
+      }
     }
   }
 }
@@ -336,69 +339,71 @@ resource "aws_kendra_data_source" "example" {
 
 The following arguments are required:
 
-* `index_id` - (Required, Forces new resource) The identifier of the index for your Amazon Kendra data_source.
-* `name` - (Required) A name for your Data Source connector.
+* `index_id` - (Required, Forces new resource) The identifier of the index for your Amazon Kendra data source.
+* `name` - (Required) A name for your data source connector.
 * `role_arn` - (Required, Optional in one scenario) The Amazon Resource Name (ARN) of a role with permission to access the data source connector. For more information, see [IAM roles for Amazon Kendra](https://docs.aws.amazon.com/kendra/latest/dg/iam-roles.html). You can't specify the `role_arn` parameter when the `type` parameter is set to `CUSTOM`. The `role_arn` parameter is required for all other data sources.
 * `type` - (Required, Forces new resource) The type of data source repository. For an updated list of values, refer to [Valid Values for Type](https://docs.aws.amazon.com/kendra/latest/dg/API_CreateDataSource.html#Kendra-CreateDataSource-request-Type).
 
 The following arguments are optional:
 
-* `configuration` - (Optional) A block with the configuration information to connect to your Data Source repository. You can't specify the `configuration` argument when the `type` parameter is set to `CUSTOM`. [Detailed below](#configuration).
-* `custom_document_enrichment_configuration` - (Optional) A block with the configuration information for altering document metadata and content during the document ingestion process. For more information on how to create, modify and delete document metadata, or make other content alterations when you ingest documents into Amazon Kendra, see [Customizing document metadata during the ingestion process](https://docs.aws.amazon.com/kendra/latest/dg/custom-document-enrichment.html). [Detailed below](#custom_document_enrichment_configuration).
+* `configuration` - (Optional) A block with the configuration information to connect to your Data Source repository. You can't specify the `configuration` block when the `type` parameter is set to `CUSTOM`. [Detailed below](#configuration-block).
+* `custom_document_enrichment_configuration` - (Optional) A block with the configuration information for altering document metadata and content during the document ingestion process. For more information on how to create, modify and delete document metadata, or make other content alterations when you ingest documents into Amazon Kendra, see [Customizing document metadata during the ingestion process](https://docs.aws.amazon.com/kendra/latest/dg/custom-document-enrichment.html). [Detailed below](#custom_document_enrichment_configuration-block).
 * `description` - (Optional) A description for the Data Source connector.
 * `language_code` - (Optional) The code for a language. This allows you to support a language for all documents when creating the Data Source connector. English is supported by default. For more information on supported languages, including their codes, see [Adding documents in languages other than English](https://docs.aws.amazon.com/kendra/latest/dg/in-adding-languages.html).
 * `schedule` - (Optional) Sets the frequency for Amazon Kendra to check the documents in your Data Source repository and update the index. If you don't set a schedule Amazon Kendra will not periodically update the index. You can call the `StartDataSourceSyncJob` API to update the index.
 * `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://www.terraform.io/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-### `configuration`
+### configuration Block
 
 The `configuration` configuration block supports the following arguments:
 
-* `s3_configuration` - (Required if `type` is set to `S3`) A block that provides the configuration information to connect to an Amazon S3 bucket as your data source. [Detailed below](#s3_configuration).
-* `web_crawler_configuration` - (Required if `type` is set to `WEBCRAWLER`) A block that provides the configuration information required for Amazon Kendra Web Crawler. [Detailed below](#web_crawler_configuration).
+* `s3_configuration` - (Required if `type` is set to `S3`) A block that provides the configuration information to connect to an Amazon S3 bucket as your data source. [Detailed below](#s3_configuration-block).
+* `web_crawler_configuration` - (Required if `type` is set to `WEBCRAWLER`) A block that provides the configuration information required for Amazon Kendra Web Crawler. [Detailed below](#web_crawler_configuration-block).
 
-#### `s3_configuration`
+### s3_configuration Block
 
 The `s3_configuration` configuration block supports the following arguments:
 
-* `access_control_list_configuration` - (Optional) A block that provides the path to the S3 bucket that contains the user context filtering files for the data source. For the format of the file, see [Access control for S3 data sources](https://docs.aws.amazon.com/kendra/latest/dg/s3-acl.html). [Detailed below](#access_control_list_configuration).
+* `access_control_list_configuration` - (Optional) A block that provides the path to the S3 bucket that contains the user context filtering files for the data source. For the format of the file, see [Access control for S3 data sources](https://docs.aws.amazon.com/kendra/latest/dg/s3-acl.html). [Detailed below](#access_control_list_configuration-block).
 * `bucket_name` - (Required) The name of the bucket that contains the documents.
-* `documents_metadata_configuration` - (Optional) A block that defines the Document metadata files that contain information such as the document access control information, source URI, document author, and custom attributes. Each metadata file contains metadata about a single document. [Detailed below](#documents_metadata_configuration).
+* `documents_metadata_configuration` - (Optional) A block that defines the Document metadata files that contain information such as the document access control information, source URI, document author, and custom attributes. Each metadata file contains metadata about a single document. [Detailed below](#documents_metadata_configuration-block).
 * `exclusion_patterns` - (Optional) A list of glob patterns for documents that should not be indexed. If a document that matches an inclusion prefix or inclusion pattern also matches an exclusion pattern, the document is not indexed. Refer to [Exclusion Patterns for more examples](https://docs.aws.amazon.com/kendra/latest/dg/API_S3DataSourceConfiguration.html#Kendra-Type-S3DataSourceConfiguration-ExclusionPatterns).
 * `inclusion_patterns` - (Optional) A list of glob patterns for documents that should be indexed. If a document that matches an inclusion pattern also matches an exclusion pattern, the document is not indexed. Refer to [Inclusion Patterns for more examples](https://docs.aws.amazon.com/kendra/latest/dg/API_S3DataSourceConfiguration.html#Kendra-Type-S3DataSourceConfiguration-InclusionPatterns).
 * `inclusion_prefixes` - (Optional) A list of S3 prefixes for the documents that should be included in the index.
 
-##### `access_control_list_configuration`
+### access_control_list_configuration Block
 
 The `access_control_list_configuration` configuration block supports the following arguments:
 
 * `key_path` - (Optional) Path to the AWS S3 bucket that contains the ACL files.
 
-##### `documents_metadata_configuration`
+### documents_metadata_configuration Block
 
 The `documents_metadata_configuration` configuration block supports the following arguments:
 
 * `s3_prefix` - (Optional) A prefix used to filter metadata configuration files in the AWS S3 bucket. The S3 bucket might contain multiple metadata files. Use `s3_prefix` to include only the desired metadata files.
 
-#### `web_crawler_configuration`
+### web_crawler_configuration Block
 
 The `web_crawler_configuration` configuration block supports the following arguments:
 
-* `authentication_configuration` - (Optional) A block with the configuration information required to connect to websites using authentication. You can connect to websites using basic authentication of user name and password. You use a secret in AWS Secrets Manager to store your authentication credentials. You must provide the website host name and port number. For example, the host name of `https://a.example.com/page1.html` is `"a.example.com"` and the port is `443`, the standard port for HTTPS. [Detailed below](#authentication_configuration).
+* `authentication_configuration` - (Optional) A block with the configuration information required to connect to websites using authentication. You can connect to websites using basic authentication of user name and password. You use a secret in AWS Secrets Manager to store your authentication credentials. You must provide the website host name and port number. For example, the host name of `https://a.example.com/page1.html` is `"a.example.com"` and the port is `443`, the standard port for HTTPS. [Detailed below](#authentication_configuration-block).
 * `crawl_depth` - (Optional) Specifies the number of levels in a website that you want to crawl. The first level begins from the website seed or starting point URL. For example, if a website has 3 levels – index level (i.e. seed in this example), sections level, and subsections level – and you are only interested in crawling information up to the sections level (i.e. levels 0-1), you can set your depth to 1. The default crawl depth is set to `2`. Minimum value of `0`. Maximum value of `10`.
 * `max_content_size_per_page_in_mega_bytes` - (Optional) The maximum size (in MB) of a webpage or attachment to crawl. Files larger than this size (in MB) are skipped/not crawled. The default maximum size of a webpage or attachment is set to `50` MB. Minimum value of `1.0e-06`. Maximum value of `50`.
 * `max_links_per_page` - (Optional) The maximum number of URLs on a webpage to include when crawling a website. This number is per webpage. As a website’s webpages are crawled, any URLs the webpages link to are also crawled. URLs on a webpage are crawled in order of appearance. The default maximum links per page is `100`. Minimum value of `1`. Maximum value of `1000`.
 * `max_urls_per_minute_crawl_rate` - (Optional) The maximum number of URLs crawled per website host per minute. The default maximum number of URLs crawled per website host per minute is `300`. Minimum value of `1`. Maximum value of `300`.
-* `proxy_configuration` - (Optional) Configuration information required to connect to your internal websites via a web proxy. You must provide the website host name and port number. For example, the host name of `https://a.example.com/page1.html` is `"a.example.com"` and the port is `443`, the standard port for HTTPS. Web proxy credentials are optional and you can use them to connect to a web proxy server that requires basic authentication. To store web proxy credentials, you use a secret in [AWS Secrets Manager](https://docs.aws.amazon.com/secretsmanager/latest/userguide/intro.html). [Detailed below](#proxy_configuration).
+* `proxy_configuration` - (Optional) Configuration information required to connect to your internal websites via a web proxy. You must provide the website host name and port number. For example, the host name of `https://a.example.com/page1.html` is `"a.example.com"` and the port is `443`, the standard port for HTTPS. Web proxy credentials are optional and you can use them to connect to a web proxy server that requires basic authentication. To store web proxy credentials, you use a secret in [AWS Secrets Manager](https://docs.aws.amazon.com/secretsmanager/latest/userguide/intro.html). [Detailed below](#proxy_configuration-block).
 * `url_exclusion_patterns` - (Optional) A list of regular expression patterns to exclude certain URLs to crawl. URLs that match the patterns are excluded from the index. URLs that don't match the patterns are included in the index. If a URL matches both an inclusion and exclusion pattern, the exclusion pattern takes precedence and the URL file isn't included in the index. Array Members: Minimum number of `0` items. Maximum number of `100` items. Length Constraints: Minimum length of `1`. Maximum length of `150`.
 * `url_inclusion_patterns` - (Optional) A list of regular expression patterns to include certain URLs to crawl. URLs that match the patterns are included in the index. URLs that don't match the patterns are excluded from the index. If a URL matches both an inclusion and exclusion pattern, the exclusion pattern takes precedence and the URL file isn't included in the index. Array Members: Minimum number of `0` items. Maximum number of `100` items. Length Constraints: Minimum length of `1`. Maximum length of `150`.
-* `urls` - (Required) A block that specifies the seed or starting point URLs of the websites or the sitemap URLs of the websites you want to crawl. You can include website subdomains. You can list up to `100` seed URLs and up to `3` sitemap URLs. You can only crawl websites that use the secure communication protocol, Hypertext Transfer Protocol Secure (HTTPS). If you receive an error when crawling a website, it could be that the website is blocked from crawling. When selecting websites to index, you must adhere to the [Amazon Acceptable Use Policy](https://aws.amazon.com/aup/) and all other Amazon terms. Remember that you must only use Amazon Kendra Web Crawler to index your own webpages, or webpages that you have authorization to index. [Detailed below](#urls).
+* `urls` - (Required) A block that specifies the seed or starting point URLs of the websites or the sitemap URLs of the websites you want to crawl. You can include website subdomains. You can list up to `100` seed URLs and up to `3` sitemap URLs. You can only crawl websites that use the secure communication protocol, Hypertext Transfer Protocol Secure (HTTPS). If you receive an error when crawling a website, it could be that the website is blocked from crawling. When selecting websites to index, you must adhere to the [Amazon Acceptable Use Policy](https://aws.amazon.com/aup/) and all other Amazon terms. Remember that you must only use Amazon Kendra Web Crawler to index your own webpages, or webpages that you have authorization to index. [Detailed below](#urls-block).
 
-##### `authentication_configuration`
+### authentication_configuration Block
 
 The `authentication_configuration` configuration block supports the following arguments:
 
-* `basic_authentication` - (Optional) The list of configuration information that's required to connect to and crawl a website host using basic authentication credentials. The list includes the name and port number of the website host. Detailed below.
+* `basic_authentication` - (Optional) The list of configuration information that's required to connect to and crawl a website host using basic authentication credentials. The list includes the name and port number of the website host. [Detailed below](#basic_authentication-block).
+
+### basic_authentication Block
 
 The `basic_authentication` configuration block supports the following arguments:
 
@@ -406,7 +411,7 @@ The `basic_authentication` configuration block supports the following arguments:
 * `host` - (Required) The name of the website host you want to connect to using authentication credentials. For example, the host name of `https://a.example.com/page1.html` is `"a.example.com"`.
 * `port` - (Required) The port number of the website host you want to connect to using authentication credentials. For example, the port for `https://a.example.com/page1.html` is `443`, the standard port for HTTPS.
 
-##### `proxy_configuration`
+### proxy_configuration Block
 
 The `proxy_configuration` configuration block supports the following arguments:
 
@@ -414,12 +419,14 @@ The `proxy_configuration` configuration block supports the following arguments:
 * `host` - (Required) The name of the website host you want to connect to via a web proxy server. For example, the host name of `https://a.example.com/page1.html` is `"a.example.com"`.
 * `port` - (Required) The port number of the website host you want to connect to via a web proxy server. For example, the port for `https://a.example.com/page1.html` is `443`, the standard port for HTTPS.
 
-##### `urls`
+### urls Block
 
 The `urls` configuration block supports the following arguments:
 
-* `seed_url_configuration` - (Optional) A block that specifies the configuration of the seed or starting point URLs of the websites you want to crawl. You can choose to crawl only the website host names, or the website host names with subdomains, or the website host names with subdomains and other domains that the webpages link to. You can list up to `100` seed URLs. Detailed below.
-* `site_maps_configuration` - (Optional) A block that specifies the configuration of the sitemap URLs of the websites you want to crawl. Only URLs belonging to the same website host names are crawled. You can list up to `3` sitemap URLs. Detailed below.
+* `seed_url_configuration` - (Optional) A block that specifies the configuration of the seed or starting point URLs of the websites you want to crawl. You can choose to crawl only the website host names, or the website host names with subdomains, or the website host names with subdomains and other domains that the webpages link to. You can list up to `100` seed URLs. [Detailed below](#seed_url_configuration-block).
+* `site_maps_configuration` - (Optional) A block that specifies the configuration of the sitemap URLs of the websites you want to crawl. Only URLs belonging to the same website host names are crawled. You can list up to `3` sitemap URLs. [Detailed below](#site_maps_configuration-block).
+
+### seed_url_configuration Block
 
 The `seed_url_configuration` configuration block supports the following arguments:
 
@@ -429,64 +436,82 @@ The `seed_url_configuration` configuration block supports the following argument
     * `SUBDOMAINS` – crawl the website host names with subdomains. For example, if the seed URL is `"abc.example.com"`, then `"a.abc.example.com"` and `"b.abc.example.com"` are also crawled.
     * `EVERYTHING` – crawl the website host names with subdomains and other domains that the webpages link to.
 
+### site_maps_configuration Block
+
 The `site_maps_configuration` configuration block supports the following arguments:
 
 * `site_maps` - (Required) The list of sitemap URLs of the websites you want to crawl. The list can include a maximum of `3` sitemap URLs.
 
-### `custom_document_enrichment_configuration`
+### custom_document_enrichment_configuration Block
 
 The `custom_document_enrichment_configuration` configuration block supports the following arguments:
 
-* `inline_configurations` - (Optional) Configuration information to alter document attributes or metadata fields and content when ingesting documents into Amazon Kendra. Minimum number of `0` items. Maximum number of `100` items. [Detailed below](#inline_configurations).
-* `post_extraction_hook_configuration` - (Optional) A block that specifies the configuration information for invoking a Lambda function in AWS Lambda on the structured documents with their metadata and text extracted. You can use a Lambda function to apply advanced logic for creating, modifying, or deleting document metadata and content. For more information, see [Advanced data manipulation](https://docs.aws.amazon.com/kendra/latest/dg/custom-document-enrichment.html#advanced-data-manipulation). [Detailed below](#hook_configuration).
-* `pre_extraction_hook_configuration` - (Optional) Configuration information for invoking a Lambda function in AWS Lambda on the original or raw documents before extracting their metadata and text. You can use a Lambda function to apply advanced logic for creating, modifying, or deleting document metadata and content. For more information, see [Advanced data manipulation](https://docs.aws.amazon.com/kendra/latest/dg/custom-document-enrichment.html#advanced-data-manipulation). [Detailed below](#hook_configuration).
+* `inline_configurations` - (Optional) Configuration information to alter document attributes or metadata fields and content when ingesting documents into Amazon Kendra. Minimum number of `0` items. Maximum number of `100` items. [Detailed below](#inline_configurations-block).
+* `post_extraction_hook_configuration` - (Optional) A block that specifies the configuration information for invoking a Lambda function in AWS Lambda on the structured documents with their metadata and text extracted. You can use a Lambda function to apply advanced logic for creating, modifying, or deleting document metadata and content. For more information, see [Advanced data manipulation](https://docs.aws.amazon.com/kendra/latest/dg/custom-document-enrichment.html#advanced-data-manipulation). [Detailed below](#pre_extraction_hook_configuration-and-post_extraction_hook_configuration-blocks).
+* `pre_extraction_hook_configuration` - (Optional) Configuration information for invoking a Lambda function in AWS Lambda on the original or raw documents before extracting their metadata and text. You can use a Lambda function to apply advanced logic for creating, modifying, or deleting document metadata and content. For more information, see [Advanced data manipulation](https://docs.aws.amazon.com/kendra/latest/dg/custom-document-enrichment.html#advanced-data-manipulation). [Detailed below](#pre_extraction_hook_configuration-and-post_extraction_hook_configuration-blocks).
 * `role_arn` - (Optional) The Amazon Resource Name (ARN) of a role with permission to run `pre_extraction_hook_configuration` and `post_extraction_hook_configuration` for altering document metadata and content during the document ingestion process. For more information, see [IAM roles for Amazon Kendra](https://docs.aws.amazon.com/kendra/latest/dg/iam-roles.html).
 
-#### `inline_configurations`
+### inline_configurations Block
 
 The `inline_configurations` configuration block supports the following arguments:
 
-* `condition` - (Optional) Configuration of the condition used for the target document attribute or metadata field when ingesting documents into Amazon Kendra. See [Document Attribute Condition](#document-attribute-condition).
+* `condition` - (Optional) Configuration of the condition used for the target document attribute or metadata field when ingesting documents into Amazon Kendra. See [condition](#condition-block).
 * `document_content_deletion` - (Optional) `TRUE` to delete content if the condition used for the target attribute is met.
-* `target` - (Optional) Configuration of the target document attribute or metadata field when ingesting documents into Amazon Kendra. You can also include a value. [Detailed below](#target).
+* `target` - (Optional) Configuration of the target document attribute or metadata field when ingesting documents into Amazon Kendra. You can also include a value. [Detailed below](#target-block).
+
+### condition Block
+
+The `condition` configuration blocks supports the following arguments:
+
+* `condition_document_attribute_key` - (Required) The identifier of the document attribute used for the condition. For example, `_source_uri` could be an identifier for the attribute or metadata field that contains source URIs associated with the documents. Amazon Kendra currently does not support `_document_body` as an attribute key used for the condition.
+* `condition_on_value` - (Optional) The value used by the operator. For example, you can specify the value 'financial' for strings in the `_source_uri` field that partially match or contain this value. See [condition_on_value](#condition_on_value-block).
+* `operator` - (Required) The condition operator. For example, you can use `Contains` to partially match a string. Valid Values: `GreaterThan` | `GreaterThanOrEquals` | `LessThan` | `LessThanOrEquals` | `Equals` | `NotEquals` | `Contains` | `NotContains` | `Exists` | `NotExists` | `BeginsWith`.
 
-##### `target`
+### target Block
 
 The `target` configuration block supports the following arguments:
 
 * `target_document_attribute_key` - (Optional) The identifier of the target document attribute or metadata field. For example, 'Department' could be an identifier for the target attribute or metadata field that includes the department names associated with the documents.
-* `target_document_attribute_value` - (Optional) The target value you want to create for the target attribute. For example, 'Finance' could be the target value for the target attribute key 'Department'.
-See [Document Attribute Value](#document-attribute-value).
+* `target_document_attribute_value` - (Optional) The target value you want to create for the target attribute. For example, 'Finance' could be the target value for the target attribute key 'Department'. See [target_document_attribute_value](#target_document_attribute_value-block).
 * `target_document_attribute_value_deletion` - (Optional) `TRUE` to delete the existing target value for your specified target attribute key. You cannot create a target value and set this to `TRUE`. To create a target value (`TargetDocumentAttributeValue`), set this to `FALSE`.
 
-#### `hook_configuration`
+### target_document_attribute_value Block
 
-The `hook_configuration` configuration block supports the following arguments:
+The `target_document_attribute_value` configuration blocks supports the following arguments:
+
+* `date_value` - (Optional) A date expressed as an ISO 8601 string. It is important for the time zone to be included in the ISO 8601 date-time format. As of this writing only UTC is supported. For example, `2012-03-25T12:30:10+00:00`.
+* `long_value` - (Optional) A long integer value.
+* `string_list_value` - (Optional) A list of strings.
+* `string` - (Optional) A string, such as "department".
 
-* `invocation_condition` - (Optional) A block that specifies the condition used for when a Lambda function should be invoked. For example, you can specify a condition that if there are empty date-time values, then Amazon Kendra should invoke a function that inserts the current date-time. See [Document Attribute Condition](#document-attribute-condition).
+### pre_extraction_hook_configuration and post_extraction_hook_configuration Blocks
+
+The `pre_extraction_hook_configuration` and `post_extraction_hook_configuration` configuration blocks each supports the following arguments:
+
+* `invocation_condition` - (Optional) A block that specifies the condition used for when a Lambda function should be invoked. For example, you can specify a condition that if there are empty date-time values, then Amazon Kendra should invoke a function that inserts the current date-time. See [invocation_condition](#invocation_condition-block).
 * `lambda_arn` - (Required) The Amazon Resource Name (ARN) of a Lambda Function that can manipulate your document metadata fields or attributes and content.
 * `s3_bucket` - (Required) Stores the original, raw documents or the structured, parsed documents before and after altering them. For more information, see [Data contracts for Lambda functions](https://docs.aws.amazon.com/kendra/latest/dg/custom-document-enrichment.html#cde-data-contracts-lambda).
 
-#### Document Attribute Condition
+### invocation_condition Block
 
-The `condition` and `invocation_condition` configuration blocks supports the following arguments:
+The `invocation_condition` configuration blocks supports the following arguments:
 
 * `condition_document_attribute_key` - (Required) The identifier of the document attribute used for the condition. For example, `_source_uri` could be an identifier for the attribute or metadata field that contains source URIs associated with the documents. Amazon Kendra currently does not support `_document_body` as an attribute key used for the condition.
-* `condition_on_value` - (Optional) The value used by the operator. For example, you can specify the value 'financial' for strings in the `_source_uri` field that partially match or contain this value. See [Document Attribute Value](#document-attribute-value).
+* `condition_on_value` - (Optional) The value used by the operator. For example, you can specify the value 'financial' for strings in the `_source_uri` field that partially match or contain this value. See [condition_on_value](#condition_on_value-block).
 * `operator` - (Required) The condition operator. For example, you can use `Contains` to partially match a string. Valid Values: `GreaterThan` | `GreaterThanOrEquals` | `LessThan` | `LessThanOrEquals` | `Equals` | `NotEquals` | `Contains` | `NotContains` | `Exists` | `NotExists` | `BeginsWith`.
 
-#### Document Attribute Value
+### condition_on_value Block
 
-The `condition_on_value` and `target_document_attribute_value` configuration blocks supports the following arguments:
+The `condition_on_value` configuration blocks supports the following arguments:
 
 * `date_value` - (Optional) A date expressed as an ISO 8601 string. It is important for the time zone to be included in the ISO 8601 date-time format. As of this writing only UTC is supported. For example, `2012-03-25T12:30:10+00:00`.
 * `long_value` - (Optional) A long integer value.
 * `string_list_value` - (Optional) A list of strings.
 * `string` - (Optional) A string, such as "department".
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the Data Source.
 * `created_at` - The Unix timestamp of when the Data Source was created.
@@ -507,8 +532,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Kendra Data Source can be imported using the unique identifiers of the data_source and index separated by a slash (`/`) e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Kendra Data Source using the unique identifiers of the data_source and index separated by a slash (`/`). For example:
 
+```terraform
+import {
+  to = aws_kendra_data_source.example
+  id = "1045d08d-66ef-4882-b3ed-dfb7df183e90/b34dfdf7-1f2b-4704-9581-79e00296845f"
+}
 ```
-$ terraform import aws_kendra_data_source.example 1045d08d-66ef-4882-b3ed-dfb7df183e90/b34dfdf7-1f2b-4704-9581-79e00296845f
+
+Using `terraform import`, import Kendra Data Source using the unique identifiers of the data_source and index separated by a slash (`/`). For example:
+
+```console
+% terraform import aws_kendra_data_source.example 1045d08d-66ef-4882-b3ed-dfb7df183e90/b34dfdf7-1f2b-4704-9581-79e00296845f
 ```
diff --git a/website/docs/r/kendra_experience.html.markdown b/website/docs/r/kendra_experience.html.markdown
index 5597367e5bd..83aa98e4c79 100644
--- a/website/docs/r/kendra_experience.html.markdown
+++ b/website/docs/r/kendra_experience.html.markdown
@@ -71,9 +71,9 @@ The `user_identity_configuration` configuration block supports the following arg
 
 * `identity_attribute_name` - (Required) The AWS SSO field name that contains the identifiers of your users, such as their emails.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The unique identifiers of the experience and index separated by a slash (`/`).
 * `arn` - ARN of the Experience.
@@ -93,8 +93,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Kendra Experience can be imported using the unique identifiers of the experience and index separated by a slash (`/`) e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Kendra Experience using the unique identifiers of the experience and index separated by a slash (`/`). For example:
 
+```terraform
+import {
+  to = aws_kendra_experience.example
+  id = "1045d08d-66ef-4882-b3ed-dfb7df183e90/b34dfdf7-1f2b-4704-9581-79e00296845f"
+}
 ```
-$ terraform import aws_kendra_experience.example 1045d08d-66ef-4882-b3ed-dfb7df183e90/b34dfdf7-1f2b-4704-9581-79e00296845f
+
+Using `terraform import`, import Kendra Experience using the unique identifiers of the experience and index separated by a slash (`/`). For example:
+
+```console
+% terraform import aws_kendra_experience.example 1045d08d-66ef-4882-b3ed-dfb7df183e90/b34dfdf7-1f2b-4704-9581-79e00296845f
 ```
diff --git a/website/docs/r/kendra_faq.html.markdown b/website/docs/r/kendra_faq.html.markdown
index 4aed7e39705..21f8a53fe4f 100644
--- a/website/docs/r/kendra_faq.html.markdown
+++ b/website/docs/r/kendra_faq.html.markdown
@@ -84,9 +84,9 @@ The following arguments are optional:
 * `language_code` - (Optional, Forces new resource) The code for a language. This shows a supported language for the FAQ document. English is supported by default. For more information on supported languages, including their codes, see [Adding documents in languages other than English](https://docs.aws.amazon.com/kendra/latest/dg/in-adding-languages.html).
 * `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the FAQ.
 * `created_at` - The Unix datetime that the FAQ was created.
@@ -106,8 +106,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_kendra_faq` can be imported using the unique identifiers of the FAQ and index separated by a slash (`/`), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_kendra_faq` using the unique identifiers of the FAQ and index separated by a slash (`/`). For example:
 
+```terraform
+import {
+  to = aws_kendra_faq.example
+  id = "faq-123456780/idx-8012925589"
+}
 ```
-$ terraform import aws_kendra_faq.example faq-123456780/idx-8012925589
+
+Using `terraform import`, import `aws_kendra_faq` using the unique identifiers of the FAQ and index separated by a slash (`/`). For example:
+
+```console
+% terraform import aws_kendra_faq.example faq-123456780/idx-8012925589
 ```
diff --git a/website/docs/r/kendra_index.html.markdown b/website/docs/r/kendra_index.html.markdown
index ff0bac87db7..f275afb73ff 100644
--- a/website/docs/r/kendra_index.html.markdown
+++ b/website/docs/r/kendra_index.html.markdown
@@ -597,7 +597,7 @@ resource "aws_kendra_index" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `capacity_units` - (Optional) A block that sets the number of additional document storage and query capacity units that should be used by the index. [Detailed below](#capacity_units).
 * `description` - (Optional) The description of the Index.
@@ -693,9 +693,9 @@ A `jwt_token_type_configuration` block supports the following arguments:
 * `delete` - (Default `40m`)
 * `update` - (Default `40m`)
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The Amazon Resource Name (ARN) of the Index.
 * `created_at` - The Unix datetime that the index was created.
@@ -728,8 +728,17 @@ A `text_document_statistics` block supports the following attributes:
 
 ## Import
 
-Amazon Kendra Indexes can be imported using its `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Amazon Kendra Indexes using its `id`. For example:
 
+```terraform
+import {
+  to = aws_kendra_index.example
+  id = "12345678-1234-5678-9123-123456789123"
+}
 ```
-$ terraform import aws_kendra_index.example 12345678-1234-5678-9123-123456789123
+
+Using `terraform import`, import Amazon Kendra Indexes using its `id`. For example:
+
+```console
+% terraform import aws_kendra_index.example 12345678-1234-5678-9123-123456789123
 ```
diff --git a/website/docs/r/kendra_query_suggestions_block_list.html.markdown b/website/docs/r/kendra_query_suggestions_block_list.html.markdown
index 02d9c818f75..230ec46dc01 100644
--- a/website/docs/r/kendra_query_suggestions_block_list.html.markdown
+++ b/website/docs/r/kendra_query_suggestions_block_list.html.markdown
@@ -8,7 +8,7 @@ description: |-
 
 # Resource: aws_kendra_query_suggestions_block_list
 
-Terraform resource for managing an AWS Kendra block list used for query suggestions for an index.
+Use the `aws_kendra_index_block_list` resource to manage an AWS Kendra block list used for query suggestions for an index.
 
 ## Example Usage
 
@@ -35,32 +35,32 @@ resource "aws_kendra_query_suggestions_block_list" "example" {
 
 The following arguments are required:
 
-* `index_id`- (Required, Forces new resource) The identifier of the index for a block list.
-* `name` - (Required) The name for the block list.
-* `role_arn` - (Required) The IAM (Identity and Access Management) role used to access the block list text file in S3.
-* `source_s3_path` - (Required) The S3 path where your block list text file sits in S3. Detailed below.
+* `index_id` - (Required, Forces New Resource) Identifier of the index for a block list.
+* `name` - (Required) Name for the block list.
+* `role_arn` - (Required) IAM (Identity and Access Management) role used to access the block list text file in S3.
+* `source_s3_path` - (Required) S3 path where your block list text file is located. See details below.
 
 The `source_s3_path` configuration block supports the following arguments:
 
-* `bucket` - (Required) The name of the S3 bucket that contains the file.
-* `key` - (Required) The name of the file.
+* `bucket` - (Required) Name of the S3 bucket that contains the file.
+* `key` - (Required) Name of the file.
 
 The following arguments are optional:
 
-* `description` - (Optional) The description for a block list.
-* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `description` - (Optional) Description for a block list.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block), tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the block list.
-* `query_suggestions_block_list_id` - The unique indentifier of the block list.
-* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+* `query_suggestions_block_list_id` - Unique identifier of the block list.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider's [default_tags configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
 
 ## Timeouts
 
-[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+Configuration options for operation timeouts can be found [here](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts).
 
 * `create` - (Default `30m`)
 * `update` - (Default `30m`)
@@ -68,8 +68,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_kendra_query_suggestions_block_list` can be imported using the unique identifiers of the block list and index separated by a slash (`/`), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import the `aws_kendra_query_suggestions_block_list` resource using the unique identifiers of the block list and index separated by a slash (`/`). For example:
 
+```terraform
+import {
+  to = aws_kendra_query_suggestions_block_list.example
+  id = "blocklist-123456780/idx-8012925589"
+}
 ```
-$ terraform import aws_kendra_query_suggestions_block_list.example blocklist-123456780/idx-8012925589
+
+Using `terraform import`, import the `aws_kendra_query_suggestions_block_list` resource using the unique identifiers of the block list and index separated by a slash (`/`). For example:
+
+```console
+% terraform import aws_kendra_query_suggestions_block_list.example blocklist-123456780/idx-8012925589
 ```
diff --git a/website/docs/r/kendra_thesaurus.html.markdown b/website/docs/r/kendra_thesaurus.html.markdown
index 52a15da4905..0ae64351226 100644
--- a/website/docs/r/kendra_thesaurus.html.markdown
+++ b/website/docs/r/kendra_thesaurus.html.markdown
@@ -48,9 +48,9 @@ The following arguments are optional:
 * `description` - (Optional) The description for a thesaurus.
 * `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the thesaurus.
 * `id` - The unique identifiers of the thesaurus and index separated by a slash (`/`).
@@ -67,8 +67,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_kendra_thesaurus` can be imported using the unique identifiers of the thesaurus and index separated by a slash (`/`), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_kendra_thesaurus` using the unique identifiers of the thesaurus and index separated by a slash (`/`). For example:
 
+```terraform
+import {
+  to = aws_kendra_thesaurus.example
+  id = "thesaurus-123456780/idx-8012925589"
+}
 ```
-$ terraform import aws_kendra_thesaurus.example thesaurus-123456780/idx-8012925589
+
+Using `terraform import`, import `aws_kendra_thesaurus` using the unique identifiers of the thesaurus and index separated by a slash (`/`). For example:
+
+```console
+% terraform import aws_kendra_thesaurus.example thesaurus-123456780/idx-8012925589
 ```
diff --git a/website/docs/r/key_pair.html.markdown b/website/docs/r/key_pair.html.markdown
index 142eac63483..8306956a5ce 100644
--- a/website/docs/r/key_pair.html.markdown
+++ b/website/docs/r/key_pair.html.markdown
@@ -29,16 +29,16 @@ resource "aws_key_pair" "deployer" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `key_name` - (Optional) The name for the key pair. If neither `key_name` nor `key_name_prefix` is provided, Terraform will create a unique key name using the prefix `terraform-`.
 * `key_name_prefix` - (Optional) Creates a unique name beginning with the specified prefix. Conflicts with `key_name`. If neither `key_name` nor `key_name_prefix` is provided, Terraform will create a unique key name using the prefix `terraform-`.
 * `public_key` - (Required) The public key material.
 * `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The key pair name.
 * `arn` - The key pair ARN.
@@ -50,10 +50,19 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Key Pairs can be imported using the `key_name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Key Pairs using the `key_name`. For example:
 
+```terraform
+import {
+  to = aws_key_pair.deployer
+  id = "deployer-key"
+}
 ```
-$ terraform import aws_key_pair.deployer deployer-key
+
+Using `terraform import`, import Key Pairs using the `key_name`. For example:
+
+```console
+% terraform import aws_key_pair.deployer deployer-key
 ```
 
 ~> **NOTE:** The AWS API does not include the public key in the response, so `terraform apply` will attempt to replace the key pair. There is currently no supported workaround for this limitation.
diff --git a/website/docs/r/keyspaces_keyspace.html.markdown b/website/docs/r/keyspaces_keyspace.html.markdown
index a9d24fa25c0..50eb56b9da5 100644
--- a/website/docs/r/keyspaces_keyspace.html.markdown
+++ b/website/docs/r/keyspaces_keyspace.html.markdown
@@ -30,9 +30,9 @@ The following arguments are optional:
 
 * `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The name of the keyspace.
 * `arn` - The ARN of the keyspace.
@@ -47,8 +47,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Use the `name` to import a keyspace. For example:
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import a keyspace using the `name`. For example:
 
+```terraform
+import {
+  to = aws_keyspaces_keyspace.example
+  id = "my_keyspace"
+}
 ```
-$ terraform import aws_keyspaces_keyspace.example my_keyspace
+
+Using `terraform import`, import a keyspace using the `name`. For example:
+
+```console
+% terraform import aws_keyspaces_keyspace.example my_keyspace
 ```
diff --git a/website/docs/r/keyspaces_table.html.markdown b/website/docs/r/keyspaces_table.html.markdown
index 0fa5b97e1fd..9a2f681a3dc 100644
--- a/website/docs/r/keyspaces_table.html.markdown
+++ b/website/docs/r/keyspaces_table.html.markdown
@@ -42,6 +42,7 @@ The following arguments are required:
 The following arguments are optional:
 
 * `capacity_specification` - (Optional) Specifies the read/write throughput capacity mode for the table.
+* `client_side_timestamps` - (Optional) Enables client-side timestamps for the table. By default, the setting is disabled.
 * `comment` - (Optional) A description of the table.
 * `default_time_to_live` - (Optional) The default Time to Live setting in seconds for the table. More information can be found in the [Developer Guide](https://docs.aws.amazon.com/keyspaces/latest/devguide/TTL-how-it-works.html#ttl-howitworks_default_ttl).
 * `encryption_specification` - (Optional) Specifies how the encryption key for encryption at rest is managed for the table. More information can be found in the [Developer Guide](https://docs.aws.amazon.com/keyspaces/latest/devguide/EncryptionAtRest.html).
@@ -56,6 +57,10 @@ The `capacity_specification` object takes the following arguments:
 * `throughput_mode` - (Optional) The read/write throughput capacity mode for a table. Valid values: `PAY_PER_REQUEST`, `PROVISIONED`. The default value is `PAY_PER_REQUEST`.
 * `write_capacity_units` - (Optional) The throughput capacity specified for write operations defined in write capacity units (WCUs).
 
+The `client_side_timestamps` object takes the following arguments:
+
+* `status` - (Required) Shows how to enable client-side timestamps settings for the specified table. Valid values: `ENABLED`.
+
 The `comment` object takes the following arguments:
 
 * `message` - (Required) A description of the table.
@@ -98,9 +103,9 @@ The `ttl` object takes the following arguments:
 
 * `status` - (Optional) Valid values: `ENABLED`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The ARN of the table.
 * `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
@@ -115,8 +120,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Use the `keyspace_name` and `table_name` separated by `/` to import a table. For example:
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import a table using the `keyspace_name` and `table_name` separated by `/`. For example:
 
+```terraform
+import {
+  to = aws_keyspaces_table.example
+  id = "my_keyspace/my_table"
+}
 ```
-$ terraform import aws_keyspaces_table.example my_keyspace/my_table
+
+Using `terraform import`, import a table using the `keyspace_name` and `table_name` separated by `/`. For example:
+
+```console
+% terraform import aws_keyspaces_table.example my_keyspace/my_table
 ```
diff --git a/website/docs/r/kinesis_analytics_application.html.markdown b/website/docs/r/kinesis_analytics_application.html.markdown
index 71441bcaa0c..7fc515b1d5f 100644
--- a/website/docs/r/kinesis_analytics_application.html.markdown
+++ b/website/docs/r/kinesis_analytics_application.html.markdown
@@ -144,7 +144,7 @@ resource "aws_kinesis_analytics_application" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) Name of the Kinesis Analytics Application.
 * `code` - (Optional) SQL Code to transform input data, and generate output.
@@ -340,9 +340,9 @@ The `s3` blcok supports the following:
 * `file_key` - (Required) The File Key name containing reference data.
 * `role_arn` - (Required) The IAM Role ARN to read the data.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ARN of the Kinesis Analytics Application.
 * `arn` - The ARN of the Kinesis Analytics Appliation.
@@ -356,8 +356,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Kinesis Analytics Application can be imported by using ARN, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Kinesis Analytics Application using ARN. For example:
 
+```terraform
+import {
+  to = aws_kinesis_analytics_application.example
+  id = "arn:aws:kinesisanalytics:us-west-2:1234567890:application/example"
+}
 ```
-$ terraform import aws_kinesis_analytics_application.example arn:aws:kinesisanalytics:us-west-2:1234567890:application/example
+
+Using `terraform import`, import Kinesis Analytics Application using ARN. For example:
+
+```console
+% terraform import aws_kinesis_analytics_application.example arn:aws:kinesisanalytics:us-west-2:1234567890:application/example
 ```
diff --git a/website/docs/r/kinesis_firehose_delivery_stream.html.markdown b/website/docs/r/kinesis_firehose_delivery_stream.html.markdown
index 0bbfe569316..c92857eea6e 100644
--- a/website/docs/r/kinesis_firehose_delivery_stream.html.markdown
+++ b/website/docs/r/kinesis_firehose_delivery_stream.html.markdown
@@ -152,6 +152,44 @@ resource "aws_kinesis_firehose_delivery_stream" "extended_s3_stream" {
 }
 ```
 
+Multiple Dynamic Partitioning Keys (maximum of 50) can be added by comma separating the `parameter_value`.
+
+The following example adds the Dynamic Partitioning Keys: `store_id` and `customer_id` to the S3 prefix.
+
+```terraform
+resource "aws_kinesis_firehose_delivery_stream" "extended_s3_stream" {
+  name        = "terraform-kinesis-firehose-extended-s3-test-stream"
+  destination = "extended_s3"
+  extended_s3_configuration {
+    role_arn       = aws_iam_role.firehose_role.arn
+    bucket_arn     = aws_s3_bucket.bucket.arn
+    buffering_size = 64
+    # https://docs.aws.amazon.com/firehose/latest/dev/dynamic-partitioning.html
+    dynamic_partitioning_configuration {
+      enabled = "true"
+    }
+    # Example prefix using partitionKeyFromQuery, applicable to JQ processor
+    prefix              = "data/store_id=!{partitionKeyFromQuery:store_id}/customer_id=!{partitionKeyFromQuery:customer_id}/year=!{timestamp:yyyy}/month=!{timestamp:MM}/day=!{timestamp:dd}/hour=!{timestamp:HH}/"
+    error_output_prefix = "errors/year=!{timestamp:yyyy}/month=!{timestamp:MM}/day=!{timestamp:dd}/hour=!{timestamp:HH}/!{firehose:error-output-type}/"
+    processing_configuration {
+      enabled = "true"
+      # JQ processor example
+      processors {
+        type = "MetadataExtraction"
+        parameters {
+          parameter_name  = "JsonParsingEngine"
+          parameter_value = "JQ-1.6"
+        }
+        parameters {
+          parameter_name  = "MetadataExtractionQuery"
+          parameter_value = "{store_id:.store_id,customer_id:.customer_id}"
+        }
+      }
+    }
+  }
+}
+```
+
 ### Redshift Destination
 
 ```terraform
@@ -322,7 +360,7 @@ resource "aws_kinesis_firehose_delivery_stream" "test" {
 }
 ```
 
-### Opensearch Destination
+### OpenSearch Destination
 
 ```terraform
 resource "aws_opensearch_domain" "test_cluster" {
@@ -362,7 +400,7 @@ resource "aws_kinesis_firehose_delivery_stream" "test_stream" {
 }
 ```
 
-### Opensearch Destination With VPC
+### OpenSearch Destination With VPC
 
 ```terraform
 resource "aws_opensearch_domain" "test_cluster" {
@@ -448,6 +486,46 @@ resource "aws_kinesis_firehose_delivery_stream" "test" {
 }
 ```
 
+### OpenSearch Serverless Destination
+
+```terraform
+resource "aws_opensearchserverless_collection" "test_collection" {
+  name = "firehose-osserverless-test"
+}
+
+resource "aws_kinesis_firehose_delivery_stream" "test_stream" {
+  name        = "terraform-kinesis-firehose-test-stream"
+  destination = "opensearchserverless"
+
+  opensearchserverless_configuration {
+    collection_endpoint = aws_opensearchserverless_collection.test_collection.collection_endpoint
+    role_arn            = aws_iam_role.firehose_role.arn
+    index_name          = "test"
+
+    s3_configuration {
+      role_arn           = aws_iam_role.firehose_role.arn
+      bucket_arn         = aws_s3_bucket.bucket.arn
+      buffering_size     = 10
+      buffering_interval = 400
+      compression_format = "GZIP"
+    }
+
+    processing_configuration {
+      enabled = "true"
+
+      processors {
+        type = "Lambda"
+
+        parameters {
+          parameter_name  = "LambdaArn"
+          parameter_value = "${aws_lambda_function.lambda_processor.arn}:$LATEST"
+        }
+      }
+    }
+  }
+}
+```
+
 ### Splunk Destination
 
 ```terraform
@@ -516,28 +594,39 @@ resource "aws_kinesis_firehose_delivery_stream" "test_stream" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) A name to identify the stream. This is unique to the AWS account and region the Stream is created in. When using for WAF logging, name must be prefixed with `aws-waf-logs-`. See [AWS Documentation](https://docs.aws.amazon.com/waf/latest/developerguide/waf-policies.html#waf-policies-logging-config) for more details.
 * `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
-* `kinesis_source_configuration` - (Optional) Allows the ability to specify the kinesis stream that is used as the source of the firehose delivery stream.
+* `kinesis_source_configuration` - (Optional) The stream and role Amazon Resource Names (ARNs) for a Kinesis data stream used as the source for a delivery stream. More details are given below.
+* `msk_source_configuration` - (Optional) The configuration for the Amazon MSK cluster to be used as the source for a delivery stream. More details are given below.
 * `server_side_encryption` - (Optional) Encrypt at rest options.
 Server-side encryption should not be enabled when a kinesis stream is configured as the source of the firehose delivery stream.
-* `destination` – (Required) This is the destination to where the data is delivered. The only options are `s3` (Deprecated, use `extended_s3` instead), `extended_s3`, `redshift`, `elasticsearch`, `splunk`, `http_endpoint` and `opensearch`.
+* `destination` – (Required) This is the destination to where the data is delivered. The only options are `s3` (Deprecated, use `extended_s3` instead), `extended_s3`, `redshift`, `elasticsearch`, `splunk`, `http_endpoint`, `opensearch` and `opensearchserverless`.
 is redshift). More details are given below.
+* `elasticsearch_configuration` - (Optional) Configuration options when `destination` is `elasticsearch`. More details are given below.
 * `extended_s3_configuration` - (Optional, only Required when `destination` is `extended_s3`) Enhanced configuration options for the s3 destination. More details are given below.
-* `redshift_configuration` - (Optional) Configuration options if redshift is the destination.
-Using `redshift_configuration` requires the user to also specify a
-`s3_configuration` block. More details are given below.
-* `elasticsearch_configuration` - (Optional) Configuration options if elasticsearch is the destination. More details are given below.
-* `opensearch_configuration` - (Optional) Configuration options if opensearch is the destination. More details are given below.
-* `splunk_configuration` - (Optional) Configuration options if splunk is the destination. More details are given below.
-* `http_endpoint_configuration` - (Optional) Configuration options if http_endpoint is the destination. requires the user to also specify a `s3_configuration` block.  More details are given below.
+* `http_endpoint_configuration` - (Optional) Configuration options when `destination` is `http_endpoint`. Requires the user to also specify an `s3_configuration` block.  More details are given below.
+* `opensearch_configuration` - (Optional) Configuration options when `destination` is `opensearch`. More details are given below.
+* `opensearchserverless_configuration` - (Optional) Configuration options when `destination` is `opensearchserverless`. More details are given below.
+* `redshift_configuration` - (Optional) Configuration options when `destination` is `redshift`. Requires the user to also specify an `s3_configuration` block. More details are given below.
+* `splunk_configuration` - (Optional) Configuration options when `destination` is `splunk`. More details are given below.
 
 The `kinesis_source_configuration` object supports the following:
 
-* `kinesis_stream_arn` (Required) The kinesis stream used as the source of the firehose delivery stream.
-* `role_arn` (Required) The ARN of the role that provides access to the source Kinesis stream.
+* `kinesis_stream_arn` - (Required) The kinesis stream used as the source of the firehose delivery stream.
+* `role_arn` - (Required) The ARN of the role that provides access to the source Kinesis stream.
+
+The `msk_source_configuration` object supports the following:
+
+* `authentication_configuration` - (Required) The authentication configuration of the Amazon MSK cluster. More details are given below.
+* `msk_cluster_arn` - (Required) The ARN of the Amazon MSK cluster.
+* `topic_name` - (Required) The topic name within the Amazon MSK cluster.
+
+The `authentication_configuration` object supports the following:
+
+* `connectivity` - (Required) The type of connectivity used to access the Amazon MSK cluster. Valid values: `PUBLIC`, `PRIVATE`.
+* `role_arn` - (Required) The ARN of the role used to access the Amazon MSK cluster.
 
 The `server_side_encryption` object supports the following:
 
@@ -592,8 +681,8 @@ The `opensearch_configuration` object supports the following:
 * `buffering_size` - (Optional) Buffer incoming data to the specified size, in MBs between 1 to 100, before delivering it to the destination.  The default value is 5MB.
 * `domain_arn` - (Optional) The ARN of the Amazon ES domain.  The pattern needs to be `arn:.*`.  Conflicts with `cluster_endpoint`.
 * `cluster_endpoint` - (Optional) The endpoint to use when communicating with the cluster. Conflicts with `domain_arn`.
-* `index_name` - (Required) The Opensearch index name.
-* `index_rotation_period` - (Optional) The Opensearch index rotation period.  Index rotation appends a timestamp to the IndexName to facilitate expiration of old data.  Valid values are `NoRotation`, `OneHour`, `OneDay`, `OneWeek`, and `OneMonth`.  The default value is `OneDay`.
+* `index_name` - (Required) The OpenSearch index name.
+* `index_rotation_period` - (Optional) The OpenSearch index rotation period.  Index rotation appends a timestamp to the IndexName to facilitate expiration of old data.  Valid values are `NoRotation`, `OneHour`, `OneDay`, `OneWeek`, and `OneMonth`.  The default value is `OneDay`.
 * `retry_duration` - (Optional) After an initial failure to deliver to Amazon OpenSearch, the total amount of time, in seconds between 0 to 7200, during which Firehose re-attempts delivery (including the first attempt).  After this time has elapsed, the failed documents are written to Amazon S3.  The default value is 300s.  There will be no retry if the value is 0.
 * `role_arn` - (Required) The ARN of the IAM role to be assumed by Firehose for calling the Amazon ES Configuration API and for indexing documents.  The IAM role must have permission for `DescribeDomain`, `DescribeDomains`, and `DescribeDomainConfig`.  The pattern needs to be `arn:.*`.
 * `s3_configuration` - (Required) The S3 Configuration. See [s3_configuration](#s3-configuration) for more details.
@@ -603,6 +692,20 @@ The `opensearch_configuration` object supports the following:
 * `vpc_config` - (Optional) The VPC configuration for the delivery stream to connect to OpenSearch associated with the VPC. More details are given below
 * `processing_configuration` - (Optional) The data processing configuration.  More details are given below.
 
+The `opensearchserverless_configuration` object supports the following:
+
+* `buffering_interval` - (Optional) Buffer incoming data for the specified period of time, in seconds between 60 to 900, before delivering it to the destination.  The default value is 300s.
+* `buffering_size` - (Optional) Buffer incoming data to the specified size, in MBs between 1 to 100, before delivering it to the destination.  The default value is 5MB.
+* `collection_endpoint` - (Required) The endpoint to use when communicating with the collection in the Serverless offering for Amazon OpenSearch Service.
+* `index_name` - (Required) The Serverless offering for Amazon OpenSearch Service index name.
+* `retry_duration` - (Optional) After an initial failure to deliver to the Serverless offering for Amazon OpenSearch Service, the total amount of time, in seconds between 0 to 7200, during which Kinesis Data Firehose retries delivery (including the first attempt).  After this time has elapsed, the failed documents are written to Amazon S3.  The default value is 300s.  There will be no retry if the value is 0.
+* `role_arn` - (Required) The Amazon Resource Name (ARN) of the IAM role to be assumed by Kinesis Data Firehose for calling the Serverless offering for Amazon OpenSearch Service Configuration API and for indexing documents.  The pattern needs to be `arn:.*`.
+* `s3_configuration` - (Required) The S3 Configuration. See [s3_configuration](#s3-configuration) for more details.
+* `s3_backup_mode` - (Optional) Defines how documents should be delivered to Amazon S3.  Valid values are `FailedDocumentsOnly` and `AllDocuments`.  Default value is `FailedDocumentsOnly`.
+* `cloudwatch_logging_options` - (Optional) The CloudWatch Logging Options for the delivery stream. More details are given below
+* `vpc_config` - (Optional) The VPC configuration for the delivery stream to connect to OpenSearch Serverless associated with the VPC. More details are given below
+* `processing_configuration` - (Optional) The data processing configuration.  More details are given below.
+
 The `splunk_configuration` objects supports the following:
 
 * `hec_acknowledgment_timeout` - (Optional) The amount of time, in seconds between 180 and 600, that Kinesis Firehose waits to receive an acknowledgment from Splunk after it sends it data.
@@ -661,7 +764,7 @@ The `request_configuration` object supports the following:
 The `common_attributes` array objects support the following:
 
 * `name` - (Required) The name of the HTTP endpoint common attribute.
-* `value` - (Optional) The value of the HTTP endpoint common attribute.
+* `value` - (Required) The value of the HTTP endpoint common attribute.
 
 The `vpc_config` object supports the following:
 
@@ -797,9 +900,9 @@ Required when using [dynamic partitioning](https://docs.aws.amazon.com/firehose/
 
 ~> **NOTE:** You can enable dynamic partitioning only when you create a new delivery stream. Once you enable dynamic partitioning on a delivery stream, it cannot be disabled on this delivery stream. Therefore, Terraform will recreate the resource whenever dynamic partitioning is enabled or disabled.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The Amazon Resource Name (ARN) specifying the Stream
 * `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
@@ -816,10 +919,19 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Kinesis Firehose Delivery streams can be imported using the stream ARN, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Kinesis Firehose Delivery streams using the stream ARN. For example:
 
+```terraform
+import {
+  to = aws_kinesis_firehose_delivery_stream.foo
+  id = "arn:aws:firehose:us-east-1:XXX:deliverystream/example"
+}
 ```
-$ terraform import aws_kinesis_firehose_delivery_stream.foo arn:aws:firehose:us-east-1:XXX:deliverystream/example
+
+Using `terraform import`, import Kinesis Firehose Delivery streams using the stream ARN. For example:
+
+```console
+% terraform import aws_kinesis_firehose_delivery_stream.foo arn:aws:firehose:us-east-1:XXX:deliverystream/example
 ```
 
 Note: Import does not work for stream destination `s3`. Consider using `extended_s3` since `s3` destination is deprecated.
diff --git a/website/docs/r/kinesis_stream.html.markdown b/website/docs/r/kinesis_stream.html.markdown
index bd9ce4d714f..885b4de8b9b 100644
--- a/website/docs/r/kinesis_stream.html.markdown
+++ b/website/docs/r/kinesis_stream.html.markdown
@@ -38,7 +38,7 @@ resource "aws_kinesis_stream" "test_stream" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) A name to identify the stream. This is unique to the AWS account and region the Stream is created in.
 * `shard_count` – (Optional) The number of shards that the stream will use. If the `stream_mode` is `PROVISIONED`, this field is required.
@@ -55,9 +55,9 @@ Amazon has guidelines for specifying the Stream size that should be referenced w
 
 * `stream_mode` - (Required) Specifies the capacity mode of the stream. Must be either `PROVISIONED` or `ON_DEMAND`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The unique Stream id
 * `name` - The unique Stream name
@@ -75,10 +75,19 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Kinesis Streams can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Kinesis Streams using the `name`. For example:
 
+```terraform
+import {
+  to = aws_kinesis_stream.test_stream
+  id = "terraform-kinesis-test"
+}
 ```
-$ terraform import aws_kinesis_stream.test_stream terraform-kinesis-test
+
+Using `terraform import`, import Kinesis Streams using the `name`. For example:
+
+```console
+% terraform import aws_kinesis_stream.test_stream terraform-kinesis-test
 ```
 
 [1]: https://aws.amazon.com/documentation/kinesis/
diff --git a/website/docs/r/kinesis_stream_consumer.html.markdown b/website/docs/r/kinesis_stream_consumer.html.markdown
index 1f0f9f99561..ecda3637f53 100644
--- a/website/docs/r/kinesis_stream_consumer.html.markdown
+++ b/website/docs/r/kinesis_stream_consumer.html.markdown
@@ -30,14 +30,14 @@ resource "aws_kinesis_stream_consumer" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required, Forces new resource) Name of the stream consumer.
 * `stream_arn` – (Required, Forces new resource) Amazon Resource Name (ARN) of the data stream the consumer is registered with.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name (ARN) of the stream consumer.
 * `creation_timestamp` - Approximate timestamp in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8) of when the stream consumer was created.
@@ -45,10 +45,19 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Kinesis Stream Consumers can be imported using the Amazon Resource Name (ARN) e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Kinesis Stream Consumers using the Amazon Resource Name (ARN). For example:
 
+```terraform
+import {
+  to = aws_kinesis_stream_consumer.example
+  id = "arn:aws:kinesis:us-west-2:123456789012:stream/example/consumer/example:1616044553"
+}
 ```
-$ terraform import aws_kinesis_stream_consumer.example arn:aws:kinesis:us-west-2:123456789012:stream/example/consumer/example:1616044553
+
+Using `terraform import`, import Kinesis Stream Consumers using the Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_kinesis_stream_consumer.example arn:aws:kinesis:us-west-2:123456789012:stream/example/consumer/example:1616044553
 ```
 
 [1]: https://docs.aws.amazon.com/streams/latest/dev/amazon-kinesis-consumers.html
diff --git a/website/docs/r/kinesis_video_stream.html.markdown b/website/docs/r/kinesis_video_stream.html.markdown
index 2880bc81ffb..2aba1bcb81b 100644
--- a/website/docs/r/kinesis_video_stream.html.markdown
+++ b/website/docs/r/kinesis_video_stream.html.markdown
@@ -29,7 +29,7 @@ resource "aws_kinesis_video_stream" "default" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) A name to identify the stream. This is unique to the
 AWS account and region the Stream is created in.
@@ -39,9 +39,9 @@ AWS account and region the Stream is created in.
 * `media_type` - (Optional) The media type of the stream. Consumers of the stream can use this information when processing the stream. For more information about media types, see [Media Types][2]. If you choose to specify the MediaType, see [Naming Requirements][3] for guidelines.
 * `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The unique Stream id
 * `arn` - The Amazon Resource Name (ARN) specifying the Stream (same as `id`)
@@ -59,10 +59,19 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Kinesis Streams can be imported using the `arn`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Kinesis Streams using the `arn`. For example:
 
+```terraform
+import {
+  to = aws_kinesis_video_stream.test_stream
+  id = "arn:aws:kinesisvideo:us-west-2:123456789012:stream/terraform-kinesis-test/1554978910975"
+}
 ```
-$ terraform import aws_kinesis_video_stream.test_stream arn:aws:kinesisvideo:us-west-2:123456789012:stream/terraform-kinesis-test/1554978910975
+
+Using `terraform import`, import Kinesis Streams using the `arn`. For example:
+
+```console
+% terraform import aws_kinesis_video_stream.test_stream arn:aws:kinesisvideo:us-west-2:123456789012:stream/terraform-kinesis-test/1554978910975
 ```
 
 [1]: https://aws.amazon.com/documentation/kinesis/
diff --git a/website/docs/r/kinesisanalyticsv2_application.html.markdown b/website/docs/r/kinesisanalyticsv2_application.html.markdown
index 9dcd547ad5d..9ef0595c0c7 100644
--- a/website/docs/r/kinesisanalyticsv2_application.html.markdown
+++ b/website/docs/r/kinesisanalyticsv2_application.html.markdown
@@ -253,7 +253,7 @@ resource "aws_kinesisanalyticsv2_application" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The name of the application.
 * `runtime_environment` - (Required) The runtime environment for the application. Valid values: `SQL-1_0`, `FLINK-1_6`, `FLINK-1_8`, `FLINK-1_11`, `FLINK-1_13`, `FLINK-1_15`.
@@ -471,9 +471,9 @@ The `cloudwatch_logging_options` object supports the following:
 
 * `log_stream_arn` - (Required) The ARN of the CloudWatch log stream to receive application messages.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The application identifier.
 * `arn` - The ARN of the application.
@@ -493,8 +493,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_kinesisanalyticsv2_application` can be imported by using the application ARN, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_kinesisanalyticsv2_application` using the application ARN. For example:
 
+```terraform
+import {
+  to = aws_kinesisanalyticsv2_application.example
+  id = "arn:aws:kinesisanalytics:us-west-2:123456789012:application/example-sql-application"
+}
 ```
-$ terraform import aws_kinesisanalyticsv2_application.example arn:aws:kinesisanalytics:us-west-2:123456789012:application/example-sql-application
+
+Using `terraform import`, import `aws_kinesisanalyticsv2_application` using the application ARN. For example:
+
+```console
+% terraform import aws_kinesisanalyticsv2_application.example arn:aws:kinesisanalytics:us-west-2:123456789012:application/example-sql-application
 ```
diff --git a/website/docs/r/kinesisanalyticsv2_application_snapshot.html.markdown b/website/docs/r/kinesisanalyticsv2_application_snapshot.html.markdown
index 9e328eb53db..d935cc7e81a 100644
--- a/website/docs/r/kinesisanalyticsv2_application_snapshot.html.markdown
+++ b/website/docs/r/kinesisanalyticsv2_application_snapshot.html.markdown
@@ -22,14 +22,14 @@ resource "aws_kinesisanalyticsv2_application_snapshot" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `application_name` - (Required) The name of an existing  [Kinesis Analytics v2 Application](/docs/providers/aws/r/kinesisanalyticsv2_application.html). Note that the application must be running for a snapshot to be created.
 * `snapshot_name` - (Required) The name of the application snapshot.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The application snapshot identifier.
 * `application_version_id` - The current application version ID when the snapshot was created.
@@ -44,8 +44,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_kinesisanalyticsv2_application` can be imported by using `application_name` together with `snapshot_name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_kinesisanalyticsv2_application` using `application_name` together with `snapshot_name`. For example:
 
+```terraform
+import {
+  to = aws_kinesisanalyticsv2_application_snapshot.example
+  id = "example-application/example-snapshot"
+}
 ```
-$ terraform import aws_kinesisanalyticsv2_application_snapshot.example example-application/example-snapshot
+
+Using `terraform import`, import `aws_kinesisanalyticsv2_application` using `application_name` together with `snapshot_name`. For example:
+
+```console
+% terraform import aws_kinesisanalyticsv2_application_snapshot.example example-application/example-snapshot
 ```
diff --git a/website/docs/r/kms_alias.html.markdown b/website/docs/r/kms_alias.html.markdown
index ef9d28afc8d..58a17aea0b9 100644
--- a/website/docs/r/kms_alias.html.markdown
+++ b/website/docs/r/kms_alias.html.markdown
@@ -25,24 +25,33 @@ resource "aws_kms_alias" "a" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Optional) The display name of the alias. The name must start with the word "alias" followed by a forward slash (alias/)
 * `name_prefix` - (Optional) Creates an unique alias beginning with the specified prefix.
 The name must start with the word "alias" followed by a forward slash (alias/).  Conflicts with `name`.
 * `target_key_id` - (Required) Identifier for the key for which the alias is for, can be either an ARN or key_id.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The Amazon Resource Name (ARN) of the key alias.
 * `target_key_arn` - The Amazon Resource Name (ARN) of the target key identifier.
 
 ## Import
 
-KMS aliases can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import KMS aliases using the `name`. For example:
 
+```terraform
+import {
+  to = aws_kms_alias.a
+  id = "alias/my-key-alias"
+}
 ```
-$ terraform import aws_kms_alias.a alias/my-key-alias
+
+Using `terraform import`, import KMS aliases using the `name`. For example:
+
+```console
+% terraform import aws_kms_alias.a alias/my-key-alias
 ```
diff --git a/website/docs/r/kms_ciphertext.html.markdown b/website/docs/r/kms_ciphertext.html.markdown
index 242e88e5d97..1767d32c332 100644
--- a/website/docs/r/kms_ciphertext.html.markdown
+++ b/website/docs/r/kms_ciphertext.html.markdown
@@ -38,14 +38,14 @@ EOF
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `plaintext` - (Required) Data to be encrypted. Note that this may show up in logs, and it will be stored in the state file.
 * `key_id` - (Required) Globally unique key ID for the customer master key.
 * `context` - (Optional) An optional mapping that makes up the encryption context.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `ciphertext_blob` - Base64 encoded ciphertext
diff --git a/website/docs/r/kms_custom_key_store.html.markdown b/website/docs/r/kms_custom_key_store.html.markdown
index ea64cd1d0ed..767508bfa25 100644
--- a/website/docs/r/kms_custom_key_store.html.markdown
+++ b/website/docs/r/kms_custom_key_store.html.markdown
@@ -33,9 +33,9 @@ The following arguments are required:
 * `key_store_password` - (Required) Password for `kmsuser` on CloudHSM.
 * `trust_anchor_certificate` - (Required) Customer certificate used for signing on CloudHSM.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The Custom Key Store ID
 
@@ -49,8 +49,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-KMS (Key Management) Custom Key Store can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import KMS (Key Management) Custom Key Store using the `id`. For example:
 
+```terraform
+import {
+  to = aws_kms_custom_key_store.example
+  id = "cks-5ebd4ef395a96288e"
+}
 ```
-$ terraform import aws_kms_custom_key_store.example cks-5ebd4ef395a96288e
+
+Using `terraform import`, import KMS (Key Management) Custom Key Store using the `id`. For example:
+
+```console
+% terraform import aws_kms_custom_key_store.example cks-5ebd4ef395a96288e
 ```
diff --git a/website/docs/r/kms_external_key.html.markdown b/website/docs/r/kms_external_key.html.markdown
index b95270d4775..48a4e0de1bf 100644
--- a/website/docs/r/kms_external_key.html.markdown
+++ b/website/docs/r/kms_external_key.html.markdown
@@ -23,7 +23,7 @@ resource "aws_kms_external_key" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `bypass_policy_lockout_safety_check` - (Optional) Specifies whether to disable the policy lockout check performed when creating or updating the key's policy. Setting this value to `true` increases the risk that the key becomes unmanageable. For more information, refer to the scenario in the [Default Key Policy](https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default-allow-root-enable-iam) section in the AWS Key Management Service Developer Guide. Defaults to `false`.
 * `deletion_window_in_days` - (Optional) Duration in days after which the key is deleted after destruction of the resource. Must be between `7` and `30` days. Defaults to `30`.
@@ -35,9 +35,9 @@ The following arguments are supported:
 * `tags` - (Optional) A key-value map of tags to assign to the key. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 * `valid_to` - (Optional) Time at which the imported key material expires. When the key material expires, AWS KMS deletes the key material and the CMK becomes unusable. If not specified, key material does not expire. Valid values: [RFC3339 time string](https://tools.ietf.org/html/rfc3339#section-5.8) (`YYYY-MM-DDTHH:MM:SSZ`)
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The Amazon Resource Name (ARN) of the key.
 * `expiration_model` - Whether the key material expires. Empty when pending key material import, otherwise `KEY_MATERIAL_EXPIRES` or `KEY_MATERIAL_DOES_NOT_EXPIRE`.
@@ -48,8 +48,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-KMS External Keys can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import KMS External Keys using the `id`. For example:
 
+```terraform
+import {
+  to = aws_kms_external_key.a
+  id = "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
+}
 ```
-$ terraform import aws_kms_external_key.a arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab
+
+Using `terraform import`, import KMS External Keys using the `id`. For example:
+
+```console
+% terraform import aws_kms_external_key.a arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab
 ```
diff --git a/website/docs/r/kms_grant.html.markdown b/website/docs/r/kms_grant.html.markdown
index 47e7fc50dc8..7604996c9a0 100644
--- a/website/docs/r/kms_grant.html.markdown
+++ b/website/docs/r/kms_grant.html.markdown
@@ -49,7 +49,7 @@ resource "aws_kms_grant" "a" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Optional, Forces new resources) A friendly name for identifying the grant.
 * `key_id` - (Required, Forces new resources) The unique identifier for the customer master key (CMK) that the grant applies to. Specify the key ID or the Amazon Resource Name (ARN) of the CMK. To specify a CMK in a different AWS account, you must use the key ARN.
@@ -66,17 +66,26 @@ The `constraints` block supports the following arguments:
 * `encryption_context_equals` - (Optional) A list of key-value pairs that must match the encryption context in subsequent cryptographic operation requests. The grant allows the operation only when the encryption context in the request is the same as the encryption context specified in this constraint. Conflicts with `encryption_context_subset`.
 * `encryption_context_subset` - (Optional) A list of key-value pairs that must be included in the encryption context of subsequent cryptographic operation requests. The grant allows the cryptographic operation only when the encryption context in the request includes the key-value pairs specified in this constraint, although it can include additional key-value pairs. Conflicts with `encryption_context_equals`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `grant_id` - The unique identifier for the grant.
 * `grant_token` - The grant token for the created grant. For more information, see [Grant Tokens](http://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#grant_token).
 
 ## Import
 
-KMS Grants can be imported using the Key ID and Grant ID separated by a colon (`:`), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import KMS Grants using the Key ID and Grant ID separated by a colon (`:`). For example:
 
+```terraform
+import {
+  to = aws_kms_grant.test
+  id = "1234abcd-12ab-34cd-56ef-1234567890ab:abcde1237f76e4ba7987489ac329fbfba6ad343d6f7075dbd1ef191f0120514"
+}
 ```
-$ terraform import aws_kms_grant.test 1234abcd-12ab-34cd-56ef-1234567890ab:abcde1237f76e4ba7987489ac329fbfba6ad343d6f7075dbd1ef191f0120514
+
+Using `terraform import`, import KMS Grants using the Key ID and Grant ID separated by a colon (`:`). For example:
+
+```console
+% terraform import aws_kms_grant.test 1234abcd-12ab-34cd-56ef-1234567890ab:abcde1237f76e4ba7987489ac329fbfba6ad343d6f7075dbd1ef191f0120514
 ```
diff --git a/website/docs/r/kms_key.html.markdown b/website/docs/r/kms_key.html.markdown
index 4e9b9ac8cdc..303451e7776 100644
--- a/website/docs/r/kms_key.html.markdown
+++ b/website/docs/r/kms_key.html.markdown
@@ -25,7 +25,7 @@ resource "aws_kms_key" "a" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `description` - (Optional) The description of the key as viewed in AWS console.
 * `key_usage` - (Optional) Specifies the intended use of the key. Valid values: `ENCRYPT_DECRYPT`, `SIGN_VERIFY`, or `GENERATE_VERIFY_MAC`.
@@ -49,18 +49,35 @@ If the KMS key is a multi-Region primary key with replicas, the waiting period b
 * `multi_region` - (Optional) Indicates whether the KMS key is a multi-Region (`true`) or regional (`false`) key. Defaults to `false`.
 * `tags` - (Optional) A map of tags to assign to the object. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The Amazon Resource Name (ARN) of the key.
 * `key_id` - The globally unique identifier for the key.
 * `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
 
+## Timeouts
+
+~> **Note:** There are a variety of default timeouts set internally. If you set a shorter custom timeout than one of the defaults, the custom timeout will not be respected as the longer of the custom or internal default will be used.
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `2m`)
+
 ## Import
 
-KMS Keys can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import KMS Keys using the `id`. For example:
 
+```terraform
+import {
+  to = aws_kms_key.a
+  id = "1234abcd-12ab-34cd-56ef-1234567890ab"
+}
 ```
-$ terraform import aws_kms_key.a 1234abcd-12ab-34cd-56ef-1234567890ab
+
+Using `terraform import`, import KMS Keys using the `id`. For example:
+
+```console
+% terraform import aws_kms_key.a 1234abcd-12ab-34cd-56ef-1234567890ab
 ```
diff --git a/website/docs/r/kms_key_policy.html.markdown b/website/docs/r/kms_key_policy.html.markdown
index 82327772051..6dfd3e574fb 100644
--- a/website/docs/r/kms_key_policy.html.markdown
+++ b/website/docs/r/kms_key_policy.html.markdown
@@ -40,7 +40,7 @@ resource "aws_kms_key_policy" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `key_id` - (Required) The ID of the KMS Key to attach the policy.
 * `policy` - (Required) A valid policy JSON document. Although this is a key policy, not an IAM policy, an [`aws_iam_policy_document`](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document), in the form that designates a principal, can be used. For more information about building policy documents with Terraform, see the [AWS IAM Policy Document Guide](https://learn.hashicorp.com/terraform/aws/iam-policy).
@@ -51,14 +51,23 @@ The following arguments are supported:
 Setting this value to true increases the risk that the KMS key becomes unmanageable. Do not set this value to true indiscriminately. If this value is set, and the resource is destroyed, a warning will be shown, and the resource will be removed from state.
 For more information, refer to the scenario in the [Default Key Policy](https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html#key-policy-default-allow-root-enable-iam) section in the _AWS Key Management Service Developer Guide_.
 
-## Attributes Reference
+## Attribute Reference
 
-No additional attributes are exported.
+This resource exports no additional attributes.
 
 ## Import
 
-KMS Key Policies can be imported using the `key_id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import KMS Key Policies using the `key_id`. For example:
 
+```terraform
+import {
+  to = aws_kms_key_policy.a
+  id = "1234abcd-12ab-34cd-56ef-1234567890ab"
+}
 ```
-$ terraform import aws_kms_key_policy.a 1234abcd-12ab-34cd-56ef-1234567890ab
+
+Using `terraform import`, import KMS Key Policies using the `key_id`. For example:
+
+```console
+% terraform import aws_kms_key_policy.a 1234abcd-12ab-34cd-56ef-1234567890ab
 ```
diff --git a/website/docs/r/kms_replica_external_key.html.markdown b/website/docs/r/kms_replica_external_key.html.markdown
index 8fe80e761ed..c7f80bd9ee9 100644
--- a/website/docs/r/kms_replica_external_key.html.markdown
+++ b/website/docs/r/kms_replica_external_key.html.markdown
@@ -45,7 +45,7 @@ resource "aws_kms_replica_external_key" "replica" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `bypass_policy_lockout_safety_check` - (Optional) A flag to indicate whether to bypass the key policy lockout safety check.
 Setting this value to true increases the risk that the KMS key becomes unmanageable. Do not set this value to true indiscriminately.
@@ -62,9 +62,9 @@ For more information about building policy documents with Terraform, see the [AW
 * `tags` - (Optional) A map of tags to assign to the replica key. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 * `valid_to` - (Optional) Time at which the imported key material expires. When the key material expires, AWS KMS deletes the key material and the key becomes unusable. If not specified, key material does not expire. Valid values: [RFC3339 time string](https://tools.ietf.org/html/rfc3339#section-5.8) (`YYYY-MM-DDTHH:MM:SSZ`)
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The Amazon Resource Name (ARN) of the replica key. The key ARNs of related multi-Region keys differ only in the Region value.
 * `expiration_model` - Whether the key material expires. Empty when pending key material import, otherwise `KEY_MATERIAL_EXPIRES` or `KEY_MATERIAL_DOES_NOT_EXPIRE`.
@@ -75,8 +75,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-KMS multi-Region replica keys can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import KMS multi-Region replica keys using the `id`. For example:
 
+```terraform
+import {
+  to = aws_kms_replica_external_key.example
+  id = "1234abcd-12ab-34cd-56ef-1234567890ab"
+}
 ```
-$ terraform import aws_kms_replica_external_key.example 1234abcd-12ab-34cd-56ef-1234567890ab
+
+Using `terraform import`, import KMS multi-Region replica keys using the `id`. For example:
+
+```console
+% terraform import aws_kms_replica_external_key.example 1234abcd-12ab-34cd-56ef-1234567890ab
 ```
diff --git a/website/docs/r/kms_replica_key.html.markdown b/website/docs/r/kms_replica_key.html.markdown
index ee309f89d94..c5fc17a8e52 100644
--- a/website/docs/r/kms_replica_key.html.markdown
+++ b/website/docs/r/kms_replica_key.html.markdown
@@ -39,7 +39,7 @@ resource "aws_kms_replica_key" "replica" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `bypass_policy_lockout_safety_check` - (Optional) A flag to indicate whether to bypass the key policy lockout safety check.
 Setting this value to true increases the risk that the KMS key becomes unmanageable. Do not set this value to true indiscriminately.
@@ -54,9 +54,9 @@ For more information about building policy documents with Terraform, see the [AW
 * `primary_key_arn` - (Required) The ARN of the multi-Region primary key to replicate. The primary key must be in a different AWS Region of the same AWS Partition. You can create only one replica of a given primary key in each AWS Region.
 * `tags` - (Optional) A map of tags to assign to the replica key. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The Amazon Resource Name (ARN) of the replica key. The key ARNs of related multi-Region keys differ only in the Region value.
 * `key_id` - The key ID of the replica key. Related multi-Region keys have the same key ID.
@@ -67,8 +67,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-KMS multi-Region replica keys can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import KMS multi-Region replica keys using the `id`. For example:
 
+```terraform
+import {
+  to = aws_kms_replica_key.example
+  id = "1234abcd-12ab-34cd-56ef-1234567890ab"
+}
 ```
-$ terraform import aws_kms_replica_key.example 1234abcd-12ab-34cd-56ef-1234567890ab
+
+Using `terraform import`, import KMS multi-Region replica keys using the `id`. For example:
+
+```console
+% terraform import aws_kms_replica_key.example 1234abcd-12ab-34cd-56ef-1234567890ab
 ```
diff --git a/website/docs/r/lakeformation_data_lake_settings.html.markdown b/website/docs/r/lakeformation_data_lake_settings.html.markdown
index c550a776f6b..db938537c48 100644
--- a/website/docs/r/lakeformation_data_lake_settings.html.markdown
+++ b/website/docs/r/lakeformation_data_lake_settings.html.markdown
@@ -67,6 +67,7 @@ resource "aws_lakeformation_data_lake_settings" "example" {
 The following arguments are optional:
 
 * `admins` – (Optional) Set of ARNs of AWS Lake Formation principals (IAM users or roles).
+* `read_only_admins` – (Optional) Set of ARNs of AWS Lake Formation principals (IAM users or roles) with only view access to the resources.
 * `catalog_id` – (Optional) Identifier for the Data Catalog. By default, the account ID.
 * `create_database_default_permissions` - (Optional) Up to three configuration blocks of principal permissions for default create database permissions. Detailed below.
 * `create_table_default_permissions` - (Optional) Up to three configuration blocks of principal permissions for default create table permissions. Detailed below.
@@ -91,6 +92,6 @@ The following arguments are optional:
 * `permissions` - (Optional) List of permissions that are granted to the principal. Valid values may include `ALL`, `SELECT`, `ALTER`, `DROP`, `DELETE`, `INSERT`, and `DESCRIBE`. For more details, see [Lake Formation Permissions Reference](https://docs.aws.amazon.com/lake-formation/latest/dg/lf-permissions-reference.html).
 * `principal` - (Optional) Principal who is granted permissions. To enforce metadata and underlying data access control only by IAM on new databases and tables set `principal` to `IAM_ALLOWED_PRINCIPALS` and `permissions` to `["ALL"]`.
 
-## Attributes Reference
+## Attribute Reference
 
-No additional attributes are exported.
+This resource exports no additional attributes.
diff --git a/website/docs/r/lakeformation_lf_tag.html.markdown b/website/docs/r/lakeformation_lf_tag.html.markdown
index 85d0ed7ee19..3af87de93a3 100644
--- a/website/docs/r/lakeformation_lf_tag.html.markdown
+++ b/website/docs/r/lakeformation_lf_tag.html.markdown
@@ -21,22 +21,31 @@ resource "aws_lakeformation_lf_tag" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `catalog_id` - (Optional) ID of the Data Catalog to create the tag in. If omitted, this defaults to the AWS Account ID.
 * `key` - (Required) Key-name for the tag.
 * `values` - (Required) List of possible values an attribute can take.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Catalog ID and key-name of the tag
 
 ## Import
 
-Lake Formation LF-Tags can be imported using the `catalog_id:key`. If you have not set a Catalog ID specify the AWS Account ID that the database is in, e.g.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Lake Formation LF-Tags using the `catalog_id:key`. If you have not set a Catalog ID specify the AWS Account ID that the database is in. For example:
 
+```terraform
+import {
+  to = aws_lakeformation_lf_tag.example
+  id = "123456789012:some_key"
+}
 ```
-$ terraform import aws_lakeformation_lf_tag.example 123456789012:some_key
+
+Using `terraform import`, import Lake Formation LF-Tags using the `catalog_id:key`. If you have not set a Catalog ID specify the AWS Account ID that the database is in. For example:
+
+```console
+% terraform import aws_lakeformation_lf_tag.example 123456789012:some_key
 ```
diff --git a/website/docs/r/lakeformation_permissions.html.markdown b/website/docs/r/lakeformation_permissions.html.markdown
index b7dfada7233..a104147168a 100644
--- a/website/docs/r/lakeformation_permissions.html.markdown
+++ b/website/docs/r/lakeformation_permissions.html.markdown
@@ -244,6 +244,6 @@ The following arguments are optional:
 * `catalog_id` - (Optional) Identifier for the Data Catalog. By default, it is the account ID of the caller.
 * `excluded_column_names` - (Optional) Set of column names for the table to exclude. If `excluded_column_names` is included, `wildcard` must be set to `true` to avoid Terraform reporting a difference.
 
-## Attributes Reference
+## Attribute Reference
 
-No additional attributes are exported.
+This resource exports no additional attributes.
diff --git a/website/docs/r/lakeformation_resource.html.markdown b/website/docs/r/lakeformation_resource.html.markdown
index 56426f07776..f602dd9342e 100644
--- a/website/docs/r/lakeformation_resource.html.markdown
+++ b/website/docs/r/lakeformation_resource.html.markdown
@@ -31,8 +31,8 @@ resource "aws_lakeformation_resource" "example" {
 
 ~> **NOTE:** AWS does not support registering an S3 location with an IAM role and subsequently updating the S3 location registration to a service-linked role.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `last_modified` - (Optional) The date and time the resource was last modified in [RFC 3339 format](https://tools.ietf.org/html/rfc3339#section-5.8).
diff --git a/website/docs/r/lakeformation_resource_lf_tags.html.markdown b/website/docs/r/lakeformation_resource_lf_tags.html.markdown
index 432426e005c..03eccb72c1c 100644
--- a/website/docs/r/lakeformation_resource_lf_tags.html.markdown
+++ b/website/docs/r/lakeformation_resource_lf_tags.html.markdown
@@ -125,6 +125,6 @@ The following arguments are optional:
 * `catalog_id` - (Optional) Identifier for the Data Catalog. By default, it is the account ID of the caller.
 * `excluded_column_names` - (Optional) Set of column names for the table to exclude. If `excluded_column_names` is included, `wildcard` must be set to `true` to avoid Terraform reporting a difference.
 
-## Attributes Reference
+## Attribute Reference
 
-No additional attributes are exported.
+This resource exports no additional attributes.
diff --git a/website/docs/r/lambda_alias.html.markdown b/website/docs/r/lambda_alias.html.markdown
index 86ed9427750..256045a9964 100644
--- a/website/docs/r/lambda_alias.html.markdown
+++ b/website/docs/r/lambda_alias.html.markdown
@@ -38,13 +38,13 @@ resource "aws_lambda_alias" "test_lambda_alias" {
 * `function_version` - (Required) Lambda function version for which you are creating the alias. Pattern: `(\$LATEST|[0-9]+)`.
 * `routing_config` - (Optional) The Lambda alias' route configuration settings. Fields documented below
 
-For **routing_config** the following attributes are supported:
+`routing_config` supports the following arguments:
 
 * `additional_version_weights` - (Optional) A map that defines the proportion of events that should be sent to different versions of a lambda function.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The Amazon Resource Name (ARN) identifying your Lambda function alias.
 * `invoke_arn` - The ARN to be used for invoking Lambda Function from API Gateway - to be used in [`aws_api_gateway_integration`](/docs/providers/aws/r/api_gateway_integration.html)'s `uri`
@@ -55,8 +55,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Lambda Function Aliases can be imported using the `function_name/alias`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Lambda Function Aliases using the `function_name/alias`. For example:
 
+```terraform
+import {
+  to = aws_lambda_alias.test_lambda_alias
+  id = "my_test_lambda_function/my_alias"
+}
 ```
-$ terraform import aws_lambda_alias.test_lambda_alias my_test_lambda_function/my_alias
+
+Using `terraform import`, import Lambda Function Aliases using the `function_name/alias`. For example:
+
+```console
+% terraform import aws_lambda_alias.test_lambda_alias my_test_lambda_function/my_alias
 ```
diff --git a/website/docs/r/lambda_code_signing_config.html.markdown b/website/docs/r/lambda_code_signing_config.html.markdown
index b48f118334b..c83a99eb341 100644
--- a/website/docs/r/lambda_code_signing_config.html.markdown
+++ b/website/docs/r/lambda_code_signing_config.html.markdown
@@ -45,9 +45,9 @@ The `policies` block supports the following argument:
 
 * `untrusted_artifact_on_deployment` - (Required) Code signing configuration policy for deployment validation failure. If you set the policy to Enforce, Lambda blocks the deployment request if code-signing validation checks fail. If you set the policy to Warn, Lambda allows the deployment and creates a CloudWatch log. Valid values: `Warn`, `Enforce`. Default value: `Warn`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The Amazon Resource Name (ARN) of the code signing configuration.
 * `config_id` - Unique identifier for the code signing configuration.
@@ -57,8 +57,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Code Signing Configs can be imported using their ARN, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Code Signing Configs using their ARN. For example:
 
+```terraform
+import {
+  to = aws_lambda_code_signing_config.imported_csc
+  id = "arn:aws:lambda:us-west-2:123456789012:code-signing-config:csc-0f6c334abcdea4d8b"
+}
 ```
-$ terraform import aws_lambda_code_signing_config.imported_csc arn:aws:lambda:us-west-2:123456789012:code-signing-config:csc-0f6c334abcdea4d8b
+
+Using `terraform import`, import Code Signing Configs using their ARN. For example:
+
+```console
+% terraform import aws_lambda_code_signing_config.imported_csc arn:aws:lambda:us-west-2:123456789012:code-signing-config:csc-0f6c334abcdea4d8b
 ```
diff --git a/website/docs/r/lambda_event_source_mapping.html.markdown b/website/docs/r/lambda_event_source_mapping.html.markdown
index c013c6e17ae..508b5b9e23a 100644
--- a/website/docs/r/lambda_event_source_mapping.html.markdown
+++ b/website/docs/r/lambda_event_source_mapping.html.markdown
@@ -161,7 +161,7 @@ resource "aws_lambda_event_source_mapping" "example" {
 * `maximum_record_age_in_seconds`: - (Optional) The maximum age of a record that Lambda sends to a function for processing. Only available for stream sources (DynamoDB and Kinesis). Must be either -1 (forever, and the default value) or between 60 and 604800 (inclusive).
 * `maximum_retry_attempts`: - (Optional) The maximum number of times to retry when the function returns an error. Only available for stream sources (DynamoDB and Kinesis). Minimum and default of -1 (forever), maximum of 10000.
 * `parallelization_factor`: - (Optional) The number of batches to process from each shard concurrently. Only available for stream sources (DynamoDB and Kinesis). Minimum and default of 1, maximum of 10.
-* `queues` - (Optional) The name of the Amazon MQ broker destination queue to consume. Only available for MQ sources. A single queue name must be specified.
+* `queues` - (Optional) The name of the Amazon MQ broker destination queue to consume. Only available for MQ sources. The list must contain exactly one queue name.
 * `scaling_config` - (Optional) Scaling configuration of the event source. Only available for SQS queues. Detailed below.
 * `self_managed_event_source`: - (Optional) For Self Managed Kafka sources, the location of the self managed cluster. If set, configuration must also include `source_access_configuration`. Detailed below.
 * `self_managed_kafka_event_source_config` - (Optional) Additional configuration block for Self Managed Kafka sources. Incompatible with "event_source_arn" and "amazon_managed_kafka_event_source_config". Detailed below.
@@ -214,9 +214,9 @@ resource "aws_lambda_event_source_mapping" "example" {
 * `type` - (Required) The type of this configuration.  For Self Managed Kafka you will need to supply blocks for type `VPC_SUBNET` and `VPC_SECURITY_GROUP`.
 * `uri` - (Required) The URI for this configuration.  For type `VPC_SUBNET` the value should be `subnet:subnet_id` where `subnet_id` is the value you would find in an aws_subnet resource's id attribute.  For type `VPC_SECURITY_GROUP` the value should be `security_group:security_group_id` where `security_group_id` is the value you would find in an aws_security_group resource's id attribute.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `function_arn` - The the ARN of the Lambda function the event source mapping is sending events to. (Note: this is a computed value that differs from `function_name` above.)
 * `last_modified` - The date this resource was last modified.
@@ -230,8 +230,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Lambda event source mappings can be imported using the `UUID` (event source mapping identifier), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Lambda event source mappings using the `UUID` (event source mapping identifier). For example:
 
+```terraform
+import {
+  to = aws_lambda_event_source_mapping.event_source_mapping
+  id = "12345kxodurf3443"
+}
 ```
-$ terraform import aws_lambda_event_source_mapping.event_source_mapping 12345kxodurf3443
+
+Using `terraform import`, import Lambda event source mappings using the `UUID` (event source mapping identifier). For example:
+
+```console
+% terraform import aws_lambda_event_source_mapping.event_source_mapping 12345kxodurf3443
 ```
diff --git a/website/docs/r/lambda_function.html.markdown b/website/docs/r/lambda_function.html.markdown
index 1b853923ba9..c4cbcca76ad 100644
--- a/website/docs/r/lambda_function.html.markdown
+++ b/website/docs/r/lambda_function.html.markdown
@@ -59,7 +59,7 @@ resource "aws_lambda_function" "test_lambda" {
 
   source_code_hash = data.archive_file.lambda.output_base64sha256
 
-  runtime = "nodejs16.x"
+  runtime = "nodejs18.x"
 
   environment {
     variables = {
@@ -112,7 +112,7 @@ resource "aws_lambda_function" "test_lambda" {
   function_name = "lambda_function_name"
   role          = aws_iam_role.iam_for_lambda.arn
   handler       = "index.test"
-  runtime       = "nodejs14.x"
+  runtime       = "nodejs18.x"
 
   ephemeral_storage {
     size = 10240 # Min 512 MB and the Max 10240 MB
@@ -319,7 +319,7 @@ Container image configuration values that override the values in the container i
 
 ### snap_start
 
-Snap start settings for low-latency startups. This feature is currently only supported for `java11` runtimes. Remove this block to delete the associated settings (rather than setting `apply_on = "None"`).
+Snap start settings for low-latency startups. This feature is currently only supported for `java11` and `java17` runtimes. Remove this block to delete the associated settings (rather than setting `apply_on = "None"`).
 
 * `apply_on` - (Required) Conditions where snap start is enabled. Valid values are `PublishedVersions`.
 
@@ -331,14 +331,15 @@ Snap start settings for low-latency startups. This feature is currently only sup
 
 For network connectivity to AWS resources in a VPC, specify a list of security groups and subnets in the VPC. When you connect a function to a VPC, it can only access resources and the internet through that VPC. See [VPC Settings][7].
 
-~> **NOTE:** If both `subnet_ids` and `security_group_ids` are empty then `vpc_config` is considered to be empty or unset.
+~> **NOTE:** If `subnet_ids`, `security_group_ids` and `ipv6_allowed_for_dual_stack` are empty then `vpc_config` is considered to be empty or unset.
 
+* `ipv6_allowed_for_dual_stack` - (Optional) Allows outbound IPv6 traffic on VPC functions that are connected to dual-stack subnets. Default is `false`.
 * `security_group_ids` - (Required) List of security group IDs associated with the Lambda function.
 * `subnet_ids` - (Required) List of subnet IDs associated with the Lambda function.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name (ARN) identifying your Lambda Function.
 * `invoke_arn` - ARN to be used for invoking Lambda Function from API Gateway - to be used in [`aws_api_gateway_integration`](/docs/providers/aws/r/api_gateway_integration.html)'s `uri`.
@@ -375,8 +376,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Lambda Functions can be imported using the `function_name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Lambda Functions using the `function_name`. For example:
 
+```terraform
+import {
+  to = aws_lambda_function.test_lambda
+  id = "my_test_lambda_function"
+}
 ```
-$ terraform import aws_lambda_function.test_lambda my_test_lambda_function
+
+Using `terraform import`, import Lambda Functions using the `function_name`. For example:
+
+```console
+% terraform import aws_lambda_function.test_lambda my_test_lambda_function
 ```
diff --git a/website/docs/r/lambda_function_event_invoke_config.html.markdown b/website/docs/r/lambda_function_event_invoke_config.html.markdown
index b1ee47f7bc2..9d52a981e16 100644
--- a/website/docs/r/lambda_function_event_invoke_config.html.markdown
+++ b/website/docs/r/lambda_function_event_invoke_config.html.markdown
@@ -109,36 +109,74 @@ The following arguments are required:
 
 * `destination` - (Required) Amazon Resource Name (ARN) of the destination resource. See the [Lambda Developer Guide](https://docs.aws.amazon.com/lambda/latest/dg/invocation-async.html#invocation-async-destinations) for acceptable resource types and associated IAM permissions.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Fully qualified Lambda Function name or Amazon Resource Name (ARN)
 
 ## Import
 
-Lambda Function Event Invoke Configs can be imported using the fully qualified Function name or Amazon Resource Name (ARN), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Lambda Function Event Invoke Configs using the fully qualified Function name or Amazon Resource Name (ARN). For example:
 
 ARN without qualifier (all versions and aliases):
 
-```
-$ terraform import aws_lambda_function_event_invoke_config.example arn:aws:us-east-1:123456789012:function:my_function
+```terraform
+import {
+  to = aws_lambda_function_event_invoke_config.example
+  id = "arn:aws:us-east-1:123456789012:function:my_function"
+}
 ```
 
 ARN with qualifier:
 
-```
-$ terraform import aws_lambda_function_event_invoke_config.example arn:aws:us-east-1:123456789012:function:my_function:production
+```terraform
+import {
+  to = aws_lambda_function_event_invoke_config.example
+  id = "arn:aws:us-east-1:123456789012:function:my_function:production"
+}
 ```
 
 Name without qualifier (all versions and aliases):
 
-```
-$ terraform import aws_lambda_function_event_invoke_config.example my_function
+```terraform
+import {
+  to = aws_lambda_function_event_invoke_config.example
+  id = "my_function"
+}
 ```
 
 Name with qualifier:
 
+```terraform
+import {
+  to = aws_lambda_function_event_invoke_config.example
+  id = "my_function:production"
+}
 ```
-$ terraform import aws_lambda_function_event_invoke_config.example my_function:production
+
+**Using `terraform import` to import** Lambda Function Event Invoke Configs using the fully qualified Function name or Amazon Resource Name (ARN). For example:
+
+ARN without qualifier (all versions and aliases):
+
+```console
+% terraform import aws_lambda_function_event_invoke_config.example arn:aws:us-east-1:123456789012:function:my_function
+```
+
+ARN with qualifier:
+
+```console
+% terraform import aws_lambda_function_event_invoke_config.example arn:aws:us-east-1:123456789012:function:my_function:production
+```
+
+Name without qualifier (all versions and aliases):
+
+```console
+% terraform import aws_lambda_function_event_invoke_config.example my_function
+```
+
+Name with qualifier:
+
+```console
+% terraform import aws_lambda_function_event_invoke_config.example my_function:production
 ```
diff --git a/website/docs/r/lambda_function_url.html.markdown b/website/docs/r/lambda_function_url.html.markdown
index 8320eab48f8..07f242d064d 100644
--- a/website/docs/r/lambda_function_url.html.markdown
+++ b/website/docs/r/lambda_function_url.html.markdown
@@ -55,9 +55,9 @@ This configuration block supports the following attributes:
 * `expose_headers` - (Optional) The HTTP headers in your function response that you want to expose to origins that call the function URL.
 * `max_age` - (Optional) The maximum amount of time, in seconds, that web browsers can cache results of a preflight request. By default, this is set to `0`, which means that the browser doesn't cache results. The maximum value is `86400`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `function_arn` - The Amazon Resource Name (ARN) of the function.
 * `function_url` - The HTTP URL endpoint for the function in the format `https://<url_id>.lambda-url.<region>.on.aws`.
@@ -65,8 +65,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Lambda function URLs can be imported using the `function_name` or `function_name/qualifier`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Lambda function URLs using the `function_name` or `function_name/qualifier`. For example:
 
+```terraform
+import {
+  to = aws_lambda_function_url.test_lambda_url
+  id = "my_test_lambda_function"
+}
 ```
-$ terraform import aws_lambda_function_url.test_lambda_url my_test_lambda_function
+
+Using `terraform import`, import Lambda function URLs using the `function_name` or `function_name/qualifier`. For example:
+
+```console
+% terraform import aws_lambda_function_url.test_lambda_url my_test_lambda_function
 ```
diff --git a/website/docs/r/lambda_invocation.html.markdown b/website/docs/r/lambda_invocation.html.markdown
index 0ae51de64aa..c6eeceb102f 100644
--- a/website/docs/r/lambda_invocation.html.markdown
+++ b/website/docs/r/lambda_invocation.html.markdown
@@ -133,8 +133,8 @@ The following arguments are optional:
 * `terraform_key` - (Optional) The JSON key used to store lifecycle information in the input JSON payload. Defaults to `tf`. This additional key is only included when `lifecycle_scope` is set to `CRUD`.
 * `triggers` - (Optional) Map of arbitrary keys and values that, when changed, will trigger a re-invocation. To force a re-invocation without changing these keys/values, use the [`terraform taint` command](https://www.terraform.io/docs/commands/taint.html).
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `result` - String result of the lambda function invocation.
diff --git a/website/docs/r/lambda_layer_version.html.markdown b/website/docs/r/lambda_layer_version.html.markdown
index 28bdfc8e2a3..86a66c97035 100644
--- a/website/docs/r/lambda_layer_version.html.markdown
+++ b/website/docs/r/lambda_layer_version.html.markdown
@@ -55,9 +55,9 @@ The following arguments are optional:
 * `skip_destroy` - (Optional) Whether to retain the old version of a previously deployed Lambda Layer. Default is `false`. When this is not set to `true`, changing any of `compatible_architectures`, `compatible_runtimes`, `description`, `filename`, `layer_name`, `license_info`, `s3_bucket`, `s3_key`, `s3_object_version`, or `source_code_hash` forces deletion of the existing layer version and creation of a new layer version.
 * `source_code_hash` - (Optional) Used to trigger updates. Must be set to a base64-encoded SHA256 hash of the package file specified with either `filename` or `s3_key`. The usual way to set this is `${filebase64sha256("file.zip")}` (Terraform 0.11.12 or later) or `${base64sha256(file("file.zip"))}` (Terraform 0.11.11 and earlier), where "file.zip" is the local filename of the lambda layer source archive.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the Lambda Layer with version.
 * `created_date` - Date this resource was created.
@@ -74,10 +74,19 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Lambda Layers can be imported using `arn`.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Lambda Layers using `arn`. For example:
 
+```terraform
+import {
+  to = aws_lambda_layer_version.test_layer
+  id = "arn:aws:lambda:_REGION_:_ACCOUNT_ID_:layer:_LAYER_NAME_:_LAYER_VERSION_"
+}
 ```
-$ terraform import \
+
+Using `terraform import`, import Lambda Layers using `arn`. For example:
+
+```console
+% terraform import \
     aws_lambda_layer_version.test_layer \
     arn:aws:lambda:_REGION_:_ACCOUNT_ID_:layer:_LAYER_NAME_:_LAYER_VERSION_
 ```
diff --git a/website/docs/r/lambda_layer_version_permission.html.markdown b/website/docs/r/lambda_layer_version_permission.html.markdown
index f3e9f760af2..335fa014433 100644
--- a/website/docs/r/lambda_layer_version_permission.html.markdown
+++ b/website/docs/r/lambda_layer_version_permission.html.markdown
@@ -28,7 +28,7 @@ resource "aws_lambda_layer_version_permission" "lambda_layer_permission" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `action` - (Required) Action, which will be allowed. `lambda:GetLayerVersion` value is suggested by AWS documantation.
 * `layer_name` (Required) The name or ARN of the Lambda Layer, which you want to grant access to.
@@ -38,9 +38,9 @@ The following arguments are supported:
 * `version_number` (Required) Version of Lambda Layer, which you want to grant access to. Note: permissions only apply to a single version of a layer.
 * `skip_destroy` - (Optional) Whether to retain the old version of a previously deployed Lambda Layer. Default is `false`. When this is not set to `true`, changing any of `compatible_architectures`, `compatible_runtimes`, `description`, `filename`, `layer_name`, `license_info`, `s3_bucket`, `s3_key`, `s3_object_version`, or `source_code_hash` forces deletion of the existing layer version and creation of a new layer version.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The `layer_name` and `version_number`, separated by a comma (`,`).
 * `revision_id` - A unique identifier for the current revision of the policy.
@@ -48,10 +48,19 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Lambda Layer Permissions can be imported using `layer_name` and `version_number`, separated by a comma (`,`).
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Lambda Layer Permissions using `layer_name` and `version_number`, separated by a comma (`,`). For example:
 
-```sh
-$ terraform import aws_lambda_layer_version_permission.example arn:aws:lambda:us-west-2:123456654321:layer:test_layer1,1
+```terraform
+import {
+  to = aws_lambda_layer_version_permission.example
+  id = "arn:aws:lambda:us-west-2:123456654321:layer:test_layer1,1"
+}
+```
+
+Using `terraform import`, import Lambda Layer Permissions using `layer_name` and `version_number`, separated by a comma (`,`). For example:
+
+```console
+% terraform import aws_lambda_layer_version_permission.example arn:aws:lambda:us-west-2:123456654321:layer:test_layer1,1
 ```
 
 [1]: https://docs.aws.amazon.com/lambda/latest/dg/access-control-resource-based.html#permissions-resource-xaccountlayer
diff --git a/website/docs/r/lambda_permission.html.markdown b/website/docs/r/lambda_permission.html.markdown
index 859f9570d49..7988fa64269 100644
--- a/website/docs/r/lambda_permission.html.markdown
+++ b/website/docs/r/lambda_permission.html.markdown
@@ -247,16 +247,34 @@ resource "aws_lambda_permission" "logging" {
 [2]: https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-control-access-using-iam-policies-to-invoke-api.html
 [3]: https://docs.aws.amazon.com/lambda/latest/dg/urls-auth.html
 
-## Attributes Reference
+## Attribute Reference
 
-No additional attributes are exported.
+This resource exports no additional attributes.
 
 ## Import
 
-Lambda permission statements can be imported using function_name/statement_id, with an optional qualifier, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Lambda permission statements using function_name/statement_id with an optional qualifier. For example:
 
+```terraform
+import {
+  to = aws_lambda_permission.test_lambda_permission
+  id = "my_test_lambda_function/AllowExecutionFromCloudWatch"
+}
+```
+
+```terraform
+import {
+  to = aws_lambda_permission.test_lambda_permission
+  id = "my_test_lambda_function:qualifier_name/AllowExecutionFromCloudWatch"
+}
+```
+
+Using `terraform import`, import Lambda permission statements using function_name/statement_id with an optional qualifier. For example:
+
+```console
+% terraform import aws_lambda_permission.test_lambda_permission my_test_lambda_function/AllowExecutionFromCloudWatch
 ```
-$ terraform import aws_lambda_permission.test_lambda_permission my_test_lambda_function/AllowExecutionFromCloudWatch
 
-$ terraform import aws_lambda_permission.test_lambda_permission my_test_lambda_function:qualifier_name/AllowExecutionFromCloudWatch
+```console
+% terraform import aws_lambda_permission.test_lambda_permission my_test_lambda_function:qualifier_name/AllowExecutionFromCloudWatch
 ```
diff --git a/website/docs/r/lambda_provisioned_concurrency_config.html.markdown b/website/docs/r/lambda_provisioned_concurrency_config.html.markdown
index 421a2b674fe..d5bc9cdd541 100644
--- a/website/docs/r/lambda_provisioned_concurrency_config.html.markdown
+++ b/website/docs/r/lambda_provisioned_concurrency_config.html.markdown
@@ -46,9 +46,9 @@ The following arguments are optional:
 
 * `skip_destroy` - (Optional) Whether to retain the provisoned concurrency configuration upon destruction. Defaults to `false`. If set to `true`, the resource in simply removed from state instead.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Lambda Function name and qualifier separated by a comma (`,`).
 
@@ -61,8 +61,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-A Lambda Provisioned Concurrency Configuration can be imported using the `function_name` and `qualifier` separated by a comma (`,`), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import a Lambda Provisioned Concurrency Configuration using the `function_name` and `qualifier` separated by a comma (`,`). For example:
 
+```terraform
+import {
+  to = aws_lambda_provisioned_concurrency_config.example
+  id = "my_function,production"
+}
 ```
-$ terraform import aws_lambda_provisioned_concurrency_config.example my_function,production
+
+Using `terraform import`, import a Lambda Provisioned Concurrency Configuration using the `function_name` and `qualifier` separated by a comma (`,`). For example:
+
+```console
+% terraform import aws_lambda_provisioned_concurrency_config.example my_function,production
 ```
diff --git a/website/docs/r/launch_configuration.html.markdown b/website/docs/r/launch_configuration.html.markdown
index 6a5f96c9ba3..c6b7fb8d070 100644
--- a/website/docs/r/launch_configuration.html.markdown
+++ b/website/docs/r/launch_configuration.html.markdown
@@ -216,9 +216,9 @@ Modifying any of the `ebs_block_device` settings requires resource replacement.
 * `volume_size` - (Optional) The size of the volume in gigabytes.
 * `volume_type` - (Optional) The type of volume. Can be `standard`, `gp2`, `gp3`, `st1`, `sc1` or `io1`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the launch configuration.
 * `arn` - The Amazon Resource Name of the launch configuration.
@@ -230,8 +230,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Launch configurations can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import launch configurations using the `name`. For example:
 
+```terraform
+import {
+  to = aws_launch_configuration.as_conf
+  id = "terraform-lg-123456"
+}
 ```
-$ terraform import aws_launch_configuration.as_conf terraform-lg-123456
+
+Using `terraform import`, import launch configurations using the `name`. For example:
+
+```console
+% terraform import aws_launch_configuration.as_conf terraform-lg-123456
 ```
diff --git a/website/docs/r/launch_template.html.markdown b/website/docs/r/launch_template.html.markdown
index 13ae4cd081c..29b42078727 100644
--- a/website/docs/r/launch_template.html.markdown
+++ b/website/docs/r/launch_template.html.markdown
@@ -109,7 +109,7 @@ resource "aws_launch_template" "foo" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `block_device_mappings` - (Optional) Specify volumes to attach to the instance besides the volumes specified by the AMI.
   See [Block Devices](#block-devices) below for details.
@@ -263,7 +263,7 @@ to attach.
 
 The `iam_instance_profile` block supports the following:
 
-* `arn` - The Amazon Resource Name (ARN) of the instance profile.
+* `arn` - The Amazon Resource Name (ARN) of the instance profile. Conflicts with `name`.
 * `name` - The name of the instance profile.
 
 ### Instance Requirements
@@ -492,9 +492,9 @@ Each `tag_specifications` block supports the following:
 * `resource_type` - (Optional) The type of resource to tag.
 * `tags` -(Optional)  A map of tags to assign to the resource.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name (ARN) of the launch template.
 * `id` - The ID of the launch template.
@@ -503,8 +503,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Launch Templates can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Launch Templates using the `id`. For example:
 
+```terraform
+import {
+  to = aws_launch_template.web
+  id = "lt-12345678"
+}
 ```
-$ terraform import aws_launch_template.web lt-12345678
+
+Using `terraform import`, import Launch Templates using the `id`. For example:
+
+```console
+% terraform import aws_launch_template.web lt-12345678
 ```
diff --git a/website/docs/r/lb.html.markdown b/website/docs/r/lb.html.markdown
index a7f8cad2cdf..011686179ae 100644
--- a/website/docs/r/lb.html.markdown
+++ b/website/docs/r/lb.html.markdown
@@ -99,11 +99,12 @@ resource "aws_lb" "example" {
 
 ~> **NOTE:** Please note that one of either `subnets` or `subnet_mapping` is required.
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `access_logs` - (Optional) An Access Logs block. Access Logs documented below.
 * `customer_owned_ipv4_pool` - (Optional) The ID of the customer owned ipv4 pool to use for this load balancer.
 * `desync_mitigation_mode` - (Optional) Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`.
+* `dns_record_client_routing_policy` - (Optional) Indicates how traffic is distributed among the load balancer Availability Zones. Possible values are `any_availability_zone` (default), `availability_zone_affinity`, or `partial_availability_zone_affinity`. See   [Availability Zone DNS affinity](https://docs.aws.amazon.com/elasticloadbalancing/latest/network/network-load-balancers.html#zonal-dns-affinity) for additional details. Only valid for `network` type load balancers.
 * `drop_invalid_header_fields` - (Optional) Indicates whether HTTP headers with header fields that are not valid are removed by the load balancer (true) or routed to targets (false). The default is false. Elastic Load Balancing requires that message header names contain only alphanumeric characters and hyphens. Only valid for Load Balancers of type `application`.
 * `enable_cross_zone_load_balancing` - (Optional) If true, cross-zone load balancing of the load balancer will be enabled. For `network` and `gateway` type load balancers, this feature is disabled by default (`false`). For `application` load balancer this feature is always enabled (`true`) and cannot be disabled. Defaults to `false`.
 * `enable_deletion_protection` - (Optional) If true, deletion of the load balancer will be disabled via the AWS API. This will prevent Terraform from deleting the load balancer. Defaults to `false`.
@@ -119,7 +120,7 @@ The following arguments are supported:
 must contain only alphanumeric characters or hyphens, and must not begin or end with a hyphen. If not specified,
 Terraform will autogenerate a name beginning with `tf-lb`.
 * `name_prefix` - (Optional) Creates a unique name beginning with the specified prefix. Conflicts with `name`.
-* `security_groups` - (Optional) A list of security group IDs to assign to the LB. Only valid for Load Balancers of type `application`.
+* `security_groups` - (Optional) A list of security group IDs to assign to the LB. Only valid for Load Balancers of type `application` or `network`. For load balancers of type `network` security groups cannot be added if none are currently present, and cannot all be removed once added. If either of these conditions are met, this will force a recreation of the resource.
 * `preserve_host_header` - (Optional) Indicates whether the Application Load Balancer should preserve the Host header in the HTTP request and send it to the target without any change. Defaults to `false`.
 * `subnet_mapping` - (Optional) A subnet mapping block as documented below.
 * `subnets` - (Optional) A list of subnet IDs to attach to the LB. Subnets
@@ -141,9 +142,9 @@ for load balancers of type `network` will force a recreation of the resource.
 * `ipv6_address` - (Optional) The IPv6 address. You associate IPv6 CIDR blocks with your VPC and choose the subnets where you launch both internet-facing and internal Application Load Balancers or Network Load Balancers.
 * `private_ipv4_address` - (Optional) The private IPv4 address for an internal load balancer.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The ARN of the load balancer (matches `id`).
 * `arn_suffix` - The ARN suffix for use with CloudWatch Metrics.
@@ -163,8 +164,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-LBs can be imported using their ARN, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import LBs using their ARN. For example:
 
+```terraform
+import {
+  to = aws_lb.bar
+  id = "arn:aws:elasticloadbalancing:us-west-2:123456789012:loadbalancer/app/my-load-balancer/50dc6c495c0c9188"
+}
 ```
-$ terraform import aws_lb.bar arn:aws:elasticloadbalancing:us-west-2:123456789012:loadbalancer/app/my-load-balancer/50dc6c495c0c9188
+
+Using `terraform import`, import LBs using their ARN. For example:
+
+```console
+% terraform import aws_lb.bar arn:aws:elasticloadbalancing:us-west-2:123456789012:loadbalancer/app/my-load-balancer/50dc6c495c0c9188
 ```
diff --git a/website/docs/r/lb_cookie_stickiness_policy.html.markdown b/website/docs/r/lb_cookie_stickiness_policy.html.markdown
index dda8f424fff..84a1c89c58d 100644
--- a/website/docs/r/lb_cookie_stickiness_policy.html.markdown
+++ b/website/docs/r/lb_cookie_stickiness_policy.html.markdown
@@ -35,7 +35,7 @@ resource "aws_lb_cookie_stickiness_policy" "foo" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The name of the stickiness policy.
 * `load_balancer` - (Required) The load balancer to which the policy
@@ -46,9 +46,9 @@ balancer.
 * `cookie_expiration_period` - (Optional) The time period after which
   the session cookie should be considered stale, expressed in seconds.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the policy.
 * `name` - The name of the stickiness policy.
diff --git a/website/docs/r/lb_listener.html.markdown b/website/docs/r/lb_listener.html.markdown
index f72bcaad9e9..34220c6c6b6 100644
--- a/website/docs/r/lb_listener.html.markdown
+++ b/website/docs/r/lb_listener.html.markdown
@@ -350,9 +350,9 @@ The following arguments are optional:
 * `protocol` - (Optional) Protocol. Valid values are `HTTP`, `HTTPS`, or `#{protocol}`. Defaults to `#{protocol}`.
 * `query` - (Optional) Query parameters, URL-encoded when necessary, but not percent-encoded. Do not include the leading "?". Defaults to `#{query}`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the listener (matches `id`).
 * `id` - ARN of the listener (matches `arn`).
@@ -360,8 +360,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Listeners can be imported using their ARN, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import listeners using their ARN. For example:
 
+```terraform
+import {
+  to = aws_lb_listener.front_end
+  id = "arn:aws:elasticloadbalancing:us-west-2:187416307283:listener/app/front-end-alb/8e4497da625e2d8a/9ab28ade35828f96"
+}
 ```
-$ terraform import aws_lb_listener.front_end arn:aws:elasticloadbalancing:us-west-2:187416307283:listener/app/front-end-alb/8e4497da625e2d8a/9ab28ade35828f96
+
+Using `terraform import`, import listeners using their ARN. For example:
+
+```console
+% terraform import aws_lb_listener.front_end arn:aws:elasticloadbalancing:us-west-2:187416307283:listener/app/front-end-alb/8e4497da625e2d8a/9ab28ade35828f96
 ```
diff --git a/website/docs/r/lb_listener_certificate.html.markdown b/website/docs/r/lb_listener_certificate.html.markdown
index 66321085e8c..d50c637f1eb 100644
--- a/website/docs/r/lb_listener_certificate.html.markdown
+++ b/website/docs/r/lb_listener_certificate.html.markdown
@@ -37,21 +37,30 @@ resource "aws_lb_listener_certificate" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `listener_arn` - (Required, Forces New Resource) The ARN of the listener to which to attach the certificate.
 * `certificate_arn` - (Required, Forces New Resource) The ARN of the certificate to attach to the listener.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The `listener_arn` and `certificate_arn` separated by a `_`.
 
 ## Import
 
-Listener Certificates can be imported by using the listener arn and certificate arn, separated by an underscore (`_`), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Listener Certificates using the listener arn and certificate arn, separated by an underscore (`_`). For example:
 
+```terraform
+import {
+  to = aws_lb_listener_certificate.example
+  id = "arn:aws:elasticloadbalancing:us-west-2:123456789012:listener/app/test/8e4497da625e2d8a/9ab28ade35828f96/67b3d2d36dd7c26b_arn:aws:iam::123456789012:server-certificate/tf-acc-test-6453083910015726063"
+}
 ```
-$ terraform import aws_lb_listener_certificate.example arn:aws:elasticloadbalancing:us-west-2:123456789012:listener/app/test/8e4497da625e2d8a/9ab28ade35828f96/67b3d2d36dd7c26b_arn:aws:iam::123456789012:server-certificate/tf-acc-test-6453083910015726063
+
+Using `terraform import`, import Listener Certificates using the listener arn and certificate arn, separated by an underscore (`_`). For example:
+
+```console
+% terraform import aws_lb_listener_certificate.example arn:aws:elasticloadbalancing:us-west-2:123456789012:listener/app/test/8e4497da625e2d8a/9ab28ade35828f96/67b3d2d36dd7c26b_arn:aws:iam::123456789012:server-certificate/tf-acc-test-6453083910015726063
 ```
diff --git a/website/docs/r/lb_listener_rule.html.markdown b/website/docs/r/lb_listener_rule.html.markdown
index d432c88973b..f3f610075d5 100644
--- a/website/docs/r/lb_listener_rule.html.markdown
+++ b/website/docs/r/lb_listener_rule.html.markdown
@@ -206,7 +206,7 @@ resource "aws_lb_listener_rule" "oidc" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `listener_arn` - (Required, Forces New Resource) The ARN of the listener to which to attach the rule.
 * `priority` - (Optional) The priority for the rule between `1` and `50000`. Leaving it unset will automatically set the rule with next available priority after currently existing highest rule. A listener can't have multiple rules with the same priority.
@@ -321,9 +321,9 @@ Query String Value Blocks (for `query_string.values`) support the following:
 * `key` - (Optional) Query string key pattern to match.
 * `value` - (Required) Query string value pattern to match.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ARN of the rule (matches `arn`)
 * `arn` - The ARN of the rule (matches `id`)
@@ -331,8 +331,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Rules can be imported using their ARN, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import rules using their ARN. For example:
 
+```terraform
+import {
+  to = aws_lb_listener_rule.front_end
+  id = "arn:aws:elasticloadbalancing:us-west-2:187416307283:listener-rule/app/test/8e4497da625e2d8a/9ab28ade35828f96/67b3d2d36dd7c26b"
+}
 ```
-$ terraform import aws_lb_listener_rule.front_end arn:aws:elasticloadbalancing:us-west-2:187416307283:listener-rule/app/test/8e4497da625e2d8a/9ab28ade35828f96/67b3d2d36dd7c26b
+
+Using `terraform import`, import rules using their ARN. For example:
+
+```console
+% terraform import aws_lb_listener_rule.front_end arn:aws:elasticloadbalancing:us-west-2:187416307283:listener-rule/app/test/8e4497da625e2d8a/9ab28ade35828f96/67b3d2d36dd7c26b
 ```
diff --git a/website/docs/r/lb_ssl_negotiation_policy.html.markdown b/website/docs/r/lb_ssl_negotiation_policy.html.markdown
index 7b1eaeb14fe..9565d4a7c2e 100644
--- a/website/docs/r/lb_ssl_negotiation_policy.html.markdown
+++ b/website/docs/r/lb_ssl_negotiation_policy.html.markdown
@@ -70,7 +70,7 @@ resource "aws_lb_ssl_negotiation_policy" "foo" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The name of the SSL negotiation policy.
 * `load_balancer` - (Required) The load balancer to which the policy
@@ -87,9 +87,9 @@ To set your attributes, please see the [AWS Elastic Load Balancing Developer Gui
 
 ~> **NOTE:** The AWS documentation references Server Order Preference, which the AWS Elastic Load Balancing API refers to as `Server-Defined-Cipher-Order`. If you wish to set Server Order Preference, use this value instead.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the policy.
 * `name` - The name of the stickiness policy.
diff --git a/website/docs/r/lb_target_group.html.markdown b/website/docs/r/lb_target_group.html.markdown
index b34834f511a..556d6518bd3 100644
--- a/website/docs/r/lb_target_group.html.markdown
+++ b/website/docs/r/lb_target_group.html.markdown
@@ -66,9 +66,24 @@ resource "aws_lb_target_group" "alb-example" {
 }
 ```
 
+### Target group with unhealthy connection termination disabled
+
+```terraform
+resource "aws_lb_target_group" "tcp-example" {
+  name     = "tf-example-lb-nlb-tg"
+  port     = 25
+  protocol = "TCP"
+  vpc_id   = aws_vpc.main.id
+
+  target_health_state {
+    enable_unhealthy_connection_termination = false
+  }
+}
+```
+
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `connection_termination` - (Optional) Whether to terminate connections at the end of the deregistration timeout on Network Load Balancers. See [doc](https://docs.aws.amazon.com/elasticloadbalancing/latest/network/load-balancer-target-groups.html#deregistration-delay) for more information. Default is `false`.
 * `deregistration_delay` - (Optional) Amount time for Elastic Load Balancing to wait before changing the state of a deregistering target from draining to unused. The range is 0-3600 seconds. The default value is 300 seconds.
@@ -87,6 +102,7 @@ The following arguments are supported:
 * `stickiness` - (Optional, Maximum of 1) Stickiness configuration block. Detailed below.
 * `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 * `target_failover` - (Optional) Target failover block. Only applicable for Gateway Load Balancer target groups. See [target_failover](#target_failover) for more information.
+* `target_health_state` - (Optional) Target health state block. Only applicable for Network Load Balancer target groups when `protocol` is `TCP` or `TLS`. See [target_health_state](#target_health_state) for more information.
 * `target_type` - (May be required, Forces new resource) Type of target that you must specify when registering targets with this target group. See [doc](https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_CreateTargetGroup.html) for supported values. The default is `instance`.
 
   Note that you can't specify targets for a target group using both instance IDs and IP addresses.
@@ -129,9 +145,15 @@ The following arguments are supported:
 * `on_deregistration` - (Optional) Indicates how the GWLB handles existing flows when a target is deregistered. Possible values are `rebalance` and `no_rebalance`. Must match the attribute value set for `on_unhealthy`. Default: `no_rebalance`.
 * `on_unhealthy` - Indicates how the GWLB handles existing flows when a target is unhealthy. Possible values are `rebalance` and `no_rebalance`. Must match the attribute value set for `on_deregistration`. Default: `no_rebalance`.
 
-## Attributes Reference
+### target_health_state
 
-In addition to all arguments above, the following attributes are exported:
+~> **NOTE:** This block is only valid for a Network Load Balancer (NLB) target group when `protocol` is `TCP` or `TLS`.
+
+* `enable_unhealthy_connection_termination` - (Optional) Indicates whether the load balancer terminates connections to unhealthy targets. Possible values are `true` or `false`. Default: `true`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn_suffix` - ARN suffix for use with CloudWatch Metrics.
 * `arn` - ARN of the Target Group (matches `id`).
@@ -141,8 +163,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Target Groups can be imported using their ARN, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Target Groups using their ARN. For example:
 
+```terraform
+import {
+  to = aws_lb_target_group.app_front_end
+  id = "arn:aws:elasticloadbalancing:us-west-2:187416307283:targetgroup/app-front-end/20cfe21448b66314"
+}
 ```
-$ terraform import aws_lb_target_group.app_front_end arn:aws:elasticloadbalancing:us-west-2:187416307283:targetgroup/app-front-end/20cfe21448b66314
+
+Using `terraform import`, import Target Groups using their ARN. For example:
+
+```console
+% terraform import aws_lb_target_group.app_front_end arn:aws:elasticloadbalancing:us-west-2:187416307283:targetgroup/app-front-end/20cfe21448b66314
 ```
diff --git a/website/docs/r/lb_target_group_attachment.html.markdown b/website/docs/r/lb_target_group_attachment.html.markdown
index c44d4c7f678..84047ba22bd 100644
--- a/website/docs/r/lb_target_group_attachment.html.markdown
+++ b/website/docs/r/lb_target_group_attachment.html.markdown
@@ -15,6 +15,8 @@ Provides the ability to register instances and containers with an Application Lo
 
 ## Example Usage
 
+### Basic Usage
+
 ```terraform
 resource "aws_lb_target_group_attachment" "test" {
   target_group_arn = aws_lb_target_group.test.arn
@@ -31,7 +33,7 @@ resource "aws_instance" "test" {
 }
 ```
 
-## Usage with lambda
+### Lambda Target
 
 ```terraform
 resource "aws_lambda_permission" "with_lb" {
@@ -58,21 +60,50 @@ resource "aws_lb_target_group_attachment" "test" {
 }
 ```
 
+### Registering Multiple Targets
+
+```terraform
+resource "aws_instance" "example" {
+  count = 3
+  # ... other configuration ...
+}
+
+resource "aws_lb_target_group" "example" {
+  # ... other configuration ...
+}
+
+resource "aws_lb_target_group_attachment" "example" {
+  # covert a list of instance objects to a map with instance ID as the key, and an instance
+  # object as the value.
+  for_each = {
+    for k, v in aws_instance.example :
+    v.id => v
+  }
+
+  target_group_arn = aws_lb_target_group.example.arn
+  target_id        = each.value.id
+  port             = 80
+}
+```
+
 ## Argument Reference
 
-The following arguments are supported:
+The following arguments are required:
+
+* `target_group_arn` - (Required) The ARN of the target group with which to register targets.
+* `target_id` (Required) The ID of the target. This is the Instance ID for an instance, or the container ID for an ECS container. If the target type is `ip`, specify an IP address. If the target type is `lambda`, specify the Lambda function ARN. If the target type is `alb`, specify the ALB ARN.
+
+The following arguments are optional:
 
-* `target_group_arn` - (Required) The ARN of the target group with which to register targets
-* `target_id` (Required) The ID of the target. This is the Instance ID for an instance, or the container ID for an ECS container. If the target type is ip, specify an IP address. If the target type is lambda, specify the arn of lambda. If the target type is alb, specify the arn of alb.
+* `availability_zone` - (Optional) The Availability Zone where the IP address of the target is to be registered. If the private IP address is outside of the VPC scope, this value must be set to `all`.
 * `port` - (Optional) The port on which targets receive traffic.
-* `availability_zone` - (Optional) The Availability Zone where the IP address of the target is to be registered. If the private ip address is outside of the VPC scope, this value must be set to 'all'.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
-* `id` - A unique identifier for the attachment
+* `id` - A unique identifier for the attachment.
 
 ## Import
 
-Target Group Attachments cannot be imported.
+You cannot import Target Group Attachments.
diff --git a/website/docs/r/lex_bot.html.markdown b/website/docs/r/lex_bot.html.markdown
index 65425f07350..4c833253edd 100644
--- a/website/docs/r/lex_bot.html.markdown
+++ b/website/docs/r/lex_bot.html.markdown
@@ -51,7 +51,7 @@ resource "aws_lex_bot" "order_flowers_bot" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `abort_statement` - (Required) The message that Amazon Lex uses to abort a conversation. Attributes are documented under [statement](#statement).
 * `child_directed` - (Required) By specifying true, you confirm that your use of Amazon Lex is related to a website, program, or other application that is directed or targeted, in whole or in part, to children under age 13 and subject to COPPA. For more information see the [Amazon Lex FAQ](https://aws.amazon.com/lex/faqs#data-security) and the [Amazon Lex PutBot API Docs](https://docs.aws.amazon.com/lex/latest/dg/API_PutBot.html#lex-PutBot-request-childDirected).
@@ -118,9 +118,9 @@ slot values into the response card. For more information, see
 * `update` - (Default `5m`)
 * `delete` - (Default `5m`)
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `checksum` - Checksum identifying the version of the bot that was created. The checksum is not
 included as an argument because the resource will add it automatically when updating the bot.
@@ -135,8 +135,17 @@ failure_reason response element.
 
 ## Import
 
-Bots can be imported using their name.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import bots using their name. For example:
 
+```terraform
+import {
+  to = aws_lex_bot.order_flowers_bot
+  id = "OrderFlowers"
+}
 ```
-$ terraform import aws_lex_bot.order_flowers_bot OrderFlowers
+
+Using `terraform import`, import bots using their name. For example:
+
+```console
+% terraform import aws_lex_bot.order_flowers_bot OrderFlowers
 ```
diff --git a/website/docs/r/lex_bot_alias.html.markdown b/website/docs/r/lex_bot_alias.html.markdown
index aa8f71835d3..31988785002 100644
--- a/website/docs/r/lex_bot_alias.html.markdown
+++ b/website/docs/r/lex_bot_alias.html.markdown
@@ -24,7 +24,7 @@ resource "aws_lex_bot_alias" "order_flowers_prod" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `bot_name` - (Required) The name of the bot.
 * `bot_version` - (Required) The name of the bot.
@@ -49,9 +49,9 @@ The settings for conversation logs.
 * `resource_arn` - (Required) The Amazon Resource Name (ARN) of the CloudWatch Logs log group or S3 bucket where the logs are delivered. Must be less than or equal to 2048 characters in length.
 * `resource_prefix` - (Computed) The prefix of the S3 object key for `AUDIO` logs or the log stream name for `TEXT` logs.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The ARN of the bot alias.
 * `checksum` - Checksum of the bot alias.
@@ -68,8 +68,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Bot aliases can be imported using an ID with the format `bot_name:bot_alias_name`.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import bot aliases using an ID with the format `bot_name:bot_alias_name`. For example:
 
+```terraform
+import {
+  to = aws_lex_bot_alias.order_flowers_prod
+  id = "OrderFlowers:OrderFlowersProd"
+}
 ```
-$ terraform import aws_lex_bot_alias.order_flowers_prod OrderFlowers:OrderFlowersProd
+
+Using `terraform import`, import bot aliases using an ID with the format `bot_name:bot_alias_name`. For example:
+
+```console
+% terraform import aws_lex_bot_alias.order_flowers_prod OrderFlowers:OrderFlowersProd
 ```
diff --git a/website/docs/r/lex_intent.html.markdown b/website/docs/r/lex_intent.html.markdown
index f8a64fd1e7f..44c8c1d1756 100644
--- a/website/docs/r/lex_intent.html.markdown
+++ b/website/docs/r/lex_intent.html.markdown
@@ -117,7 +117,7 @@ resource "aws_lex_intent" "order_flowers_intent" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `conclusion_statement` - (Optional) The statement that you want Amazon Lex to convey to the user
 after the intent is successfully fulfilled by the Lambda function. This element is relevant only if
@@ -240,9 +240,9 @@ Attributes are documented under [message](#message). Must contain between 1 and
 slot values into the response card. For more information, see
 [Example: Using a Response Card](https://docs.aws.amazon.com/lex/latest/dg/ex-resp-card.html). Must be less than or equal to 50000 characters in length.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The ARN of the Lex intent.
 * `checksum` - Checksum identifying the version of the intent that was created. The checksum is not
@@ -261,8 +261,17 @@ included as an argument because the resource will add it automatically when upda
 
 ## Import
 
-Intents can be imported using their name.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import intents using their name. For example:
 
+```terraform
+import {
+  to = aws_lex_intent.order_flowers_intent
+  id = "OrderFlowers"
+}
 ```
-$ terraform import aws_lex_intent.order_flowers_intent OrderFlowers
+
+Using `terraform import`, import intents using their name. For example:
+
+```console
+% terraform import aws_lex_intent.order_flowers_intent OrderFlowers
 ```
diff --git a/website/docs/r/lex_slot_type.html.markdown b/website/docs/r/lex_slot_type.html.markdown
index 2d0181cc1f2..e5ca5d90ad4 100644
--- a/website/docs/r/lex_slot_type.html.markdown
+++ b/website/docs/r/lex_slot_type.html.markdown
@@ -43,7 +43,7 @@ resource "aws_lex_slot_type" "flower_types" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `enumeration_value` - (Required) A list of EnumerationValue objects that defines the values that
 the slot type can take. Each value can have a list of synonyms, which are additional values that help
@@ -78,9 +78,9 @@ pizza should have. The slot type could include the values: thick, thin, stuffed.
 * `update` - (Default `1m`)
 * `delete` - (Default `5m`)
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `checksum` - Checksum identifying the version of the slot type that was created. The checksum is
 not included as an argument because the resource will add it automatically when updating the slot type.
@@ -90,8 +90,17 @@ not included as an argument because the resource will add it automatically when
 
 ## Import
 
-Slot types can be imported using their name.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import slot types using their name. For example:
 
+```terraform
+import {
+  to = aws_lex_slot_type.flower_types
+  id = "FlowerTypes"
+}
 ```
-$ terraform import aws_lex_slot_type.flower_types FlowerTypes
+
+Using `terraform import`, import slot types using their name. For example:
+
+```console
+% terraform import aws_lex_slot_type.flower_types FlowerTypes
 ```
diff --git a/website/docs/r/lexv2models_bot.html.markdown b/website/docs/r/lexv2models_bot.html.markdown
new file mode 100644
index 00000000000..d7af1a59ae1
--- /dev/null
+++ b/website/docs/r/lexv2models_bot.html.markdown
@@ -0,0 +1,86 @@
+---
+subcategory: "Lex V2 Models"
+layout: "aws"
+page_title: "AWS: aws_lexv2models_bot"
+description: |-
+  Terraform resource for managing an AWS Lex V2 Models Bot.
+---
+
+# Resource: aws_lexv2models_bot
+
+Terraform resource for managing an AWS Lex V2 Models Bot.
+
+## Example Usage
+
+### Basic Usage
+
+```terraform
+resource "aws_lexv2models_bot" "example" {
+  name = "example"
+  data_privacy {
+    child_directed = "boolean"
+  }
+  idle_session_ttl_in_seconds = 10
+  role_arn                    = "bot_example_arn"
+}
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `name` - Name of the bot. The bot name must be unique in the account that creates the bot. Type String. Length Constraints: Minimum length of 1. Maximum length of 100.
+* `data_privacy` - Provides information on additional privacy protections Amazon Lex should use with the bot's data. See [`data_privacy`](#data-privacy)
+* `idle_session_ttl_in_seconds` - Time, in seconds, that Amazon Lex should keep information about a user's conversation with the bot. You can specify between 60 (1 minute) and 86,400 (24 hours) seconds.
+* `role_arn` - ARN of an IAM role that has permission to access the bot.
+
+The following arguments are optional:
+
+* `members` - List of bot members in a network to be created. See [`bot_members`](#bot-members).
+* `bot_tags` - List of tags to add to the bot. You can only add tags when you create a bot.
+* `bot_type` - Type of a bot to create.
+* `description` - Description of the bot. It appears in lists to help you identify a particular bot.
+* `test_bot_alias_tags` - List of tags to add to the test alias for a bot. You can only add tags when you create a bot.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Unique identifier for a particular bot.
+
+### Data Privacy
+
+* `child_directed` (Required) -  For each Amazon Lex bot created with the Amazon Lex Model Building Service, you must specify whether your use of Amazon Lex is related to a website, program, or other application that is directed or targeted, in whole or in part, to children under age 13 and subject to the Children's Online Privacy Protection Act (COPPA) by specifying true or false in the childDirected field.
+
+### Bot Members
+
+* `alias_id` (Required) - Alias ID of a bot that is a member of this network of bots.
+* `alias_name` (Required) - Alias name of a bot that is a member of this network of bots.
+* `id` (Required) - Unique ID of a bot that is a member of this network of bots.
+* `name` (Required) - Unique name of a bot that is a member of this network of bots.
+* `version` (Required) - Version of a bot that is a member of this network of bots.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `30m`)
+* `update` - (Default `30m`)
+* `delete` - (Default `30m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Lex V2 Models Bot using the `example_id_arg`. For example:
+
+```terraform
+import {
+  to = aws_lexv2models_bot.example
+  id = "bot-id-12345678"
+}
+```
+
+Using `terraform import`, import Lex V2 Models Bot using the `example_id_arg`. For example:
+
+```console
+% terraform import aws_lexv2models_bot.example bot-id-12345678
+```
diff --git a/website/docs/r/licensemanager_association.html.markdown b/website/docs/r/licensemanager_association.html.markdown
new file mode 100644
index 00000000000..fa8b8f259ac
--- /dev/null
+++ b/website/docs/r/licensemanager_association.html.markdown
@@ -0,0 +1,72 @@
+---
+subcategory: "License Manager"
+layout: "aws"
+page_title: "AWS: aws_licensemanager_association"
+description: |-
+  Provides a License Manager association resource.
+---
+
+# Resource: aws_licensemanager_association
+
+Provides a License Manager association.
+
+~> **Note:** License configurations can also be associated with launch templates by specifying the `license_specifications` block for an `aws_launch_template`.
+
+## Example Usage
+
+```terraform
+data "aws_ami" "example" {
+  most_recent = true
+  owners      = ["amazon"]
+
+  filter {
+    name   = "name"
+    values = ["amzn-ami-vpc-nat*"]
+  }
+}
+
+resource "aws_instance" "example" {
+  ami           = data.aws_ami.example.id
+  instance_type = "t2.micro"
+}
+
+resource "aws_licensemanager_license_configuration" "example" {
+  name                  = "Example"
+  license_counting_type = "Instance"
+}
+
+resource "aws_licensemanager_association" "example" {
+  license_configuration_arn = aws_licensemanager_license_configuration.example.arn
+  resource_arn              = aws_instance.example.arn
+}
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `license_configuration_arn` - (Required) ARN of the license configuration.
+* `resource_arn` - (Required) ARN of the resource associated with the license configuration.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The license configuration ARN.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import license configurations using `resource_arn,license_configuration_arn`. For example:
+
+```terraform
+import {
+  to = aws_licensemanager_association.example
+  id = "arn:aws:ec2:eu-west-1:123456789012:image/ami-123456789abcdef01,arn:aws:license-manager:eu-west-1:123456789012:license-configuration:lic-0123456789abcdef0123456789abcdef"
+}
+```
+
+Using `terraform import`, import license configurations using `resource_arn,license_configuration_arn`. For example:
+
+```console
+% terraform import aws_licensemanager_association.example arn:aws:ec2:eu-west-1:123456789012:image/ami-123456789abcdef01,arn:aws:license-manager:eu-west-1:123456789012:license-configuration:lic-0123456789abcdef0123456789abcdef
+```
diff --git a/website/docs/r/licensemanager_association.markdown b/website/docs/r/licensemanager_association.markdown
deleted file mode 100644
index a950becc4eb..00000000000
--- a/website/docs/r/licensemanager_association.markdown
+++ /dev/null
@@ -1,63 +0,0 @@
----
-subcategory: "License Manager"
-layout: "aws"
-page_title: "AWS: aws_licensemanager_association"
-description: |-
-  Provides a License Manager association resource.
----
-
-# Resource: aws_licensemanager_association
-
-Provides a License Manager association.
-
-~> **Note:** License configurations can also be associated with launch templates by specifying the `license_specifications` block for an `aws_launch_template`.
-
-## Example Usage
-
-```terraform
-data "aws_ami" "example" {
-  most_recent = true
-  owners      = ["amazon"]
-
-  filter {
-    name   = "name"
-    values = ["amzn-ami-vpc-nat*"]
-  }
-}
-
-resource "aws_instance" "example" {
-  ami           = data.aws_ami.example.id
-  instance_type = "t2.micro"
-}
-
-resource "aws_licensemanager_license_configuration" "example" {
-  name                  = "Example"
-  license_counting_type = "Instance"
-}
-
-resource "aws_licensemanager_association" "example" {
-  license_configuration_arn = aws_licensemanager_license_configuration.example.arn
-  resource_arn              = aws_instance.example.arn
-}
-```
-
-## Argument Reference
-
-The following arguments are supported:
-
-* `license_configuration_arn` - (Required) ARN of the license configuration.
-* `resource_arn` - (Required) ARN of the resource associated with the license configuration.
-
-## Attributes Reference
-
-In addition to all arguments above, the following attributes are exported:
-
-* `id` - The license configuration ARN.
-
-## Import
-
-License configurations can be imported in the form `resource_arn,license_configuration_arn`, e.g.,
-
-```
-$ terraform import aws_licensemanager_association.example arn:aws:ec2:eu-west-1:123456789012:image/ami-123456789abcdef01,arn:aws:license-manager:eu-west-1:123456789012:license-configuration:lic-0123456789abcdef0123456789abcdef
-```
diff --git a/website/docs/r/licensemanager_grant.html.markdown b/website/docs/r/licensemanager_grant.html.markdown
index 95e95b17b8c..32bfefb5851 100644
--- a/website/docs/r/licensemanager_grant.html.markdown
+++ b/website/docs/r/licensemanager_grant.html.markdown
@@ -30,7 +30,7 @@ resource "aws_licensemanager_grant" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The Name of the grant.
 * `allowed_operations` - (Required) A list of the allowed operations for the grant. This is a subset of the allowed operations on the license.
@@ -38,9 +38,9 @@ The following arguments are supported:
 * `principal` - (Required) The target account for the grant in the form of the ARN for an account principal of the root user.
 * `home_region` - (Required) The home region for the license.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The grant ARN (Same as `arn`).
 * `arn` - The grant ARN.
@@ -50,8 +50,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_licensemanager_grant` can be imported using the grant arn.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_licensemanager_grant` using the grant arn. For example:
 
-```shell
-$ terraform import aws_licensemanager_grant.test arn:aws:license-manager::123456789011:grant:g-01d313393d9e443d8664cc054db1e089
+```terraform
+import {
+  to = aws_licensemanager_grant.test
+  id = "arn:aws:license-manager::123456789011:grant:g-01d313393d9e443d8664cc054db1e089"
+}
+```
+
+Using `terraform import`, import `aws_licensemanager_grant` using the grant arn. For example:
+
+```console
+% terraform import aws_licensemanager_grant.test arn:aws:license-manager::123456789011:grant:g-01d313393d9e443d8664cc054db1e089
 ```
diff --git a/website/docs/r/licensemanager_grant_accepter.html.markdown b/website/docs/r/licensemanager_grant_accepter.html.markdown
index 6d81eea415f..c8435946eae 100644
--- a/website/docs/r/licensemanager_grant_accepter.html.markdown
+++ b/website/docs/r/licensemanager_grant_accepter.html.markdown
@@ -14,19 +14,19 @@ Accepts a License Manager grant. This allows for sharing licenses with other aws
 
 ```terraform
 resource "aws_licensemanager_grant_accepter" "test" {
-  name = "arn:aws:license-manager::123456789012:grant:g-1cf9fba4ba2f42dcab11c686c4b4d329"
+  grant_arn = "arn:aws:license-manager::123456789012:grant:g-1cf9fba4ba2f42dcab11c686c4b4d329"
 }
 ```
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `grant_arn` - (Required) The ARN of the grant to accept.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The grant ARN (Same as `arn`).
 * `arn` - The grant ARN.
@@ -41,8 +41,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_licensemanager_grant_accepter` can be imported using the grant arn.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_licensemanager_grant_accepter` using the grant arn. For example:
 
-```shell
-$ terraform import aws_licensemanager_grant_accepter.test arn:aws:license-manager::123456789012:grant:g-1cf9fba4ba2f42dcab11c686c4b4d329
+```terraform
+import {
+  to = aws_licensemanager_grant_accepter.test
+  id = "arn:aws:license-manager::123456789012:grant:g-1cf9fba4ba2f42dcab11c686c4b4d329"
+}
+```
+
+Using `terraform import`, import `aws_licensemanager_grant_accepter` using the grant arn. For example:
+
+```console
+% terraform import aws_licensemanager_grant_accepter.test arn:aws:license-manager::123456789012:grant:g-1cf9fba4ba2f42dcab11c686c4b4d329
 ```
diff --git a/website/docs/r/licensemanager_license_configuration.html.markdown b/website/docs/r/licensemanager_license_configuration.html.markdown
new file mode 100644
index 00000000000..be3d80129e7
--- /dev/null
+++ b/website/docs/r/licensemanager_license_configuration.html.markdown
@@ -0,0 +1,83 @@
+---
+subcategory: "License Manager"
+layout: "aws"
+page_title: "AWS: aws_licensemanager_license_configuration"
+description: |-
+  Provides a License Manager license configuration resource.
+---
+
+# Resource: aws_licensemanager_license_configuration
+
+Provides a License Manager license configuration resource.
+
+~> **Note:** Removing the `license_count` attribute is not supported by the License Manager API - use `terraform taint aws_licensemanager_license_configuration.<id>` to recreate the resource instead.
+
+## Example Usage
+
+```terraform
+resource "aws_licensemanager_license_configuration" "example" {
+  name                     = "Example"
+  description              = "Example"
+  license_count            = 10
+  license_count_hard_limit = true
+  license_counting_type    = "Socket"
+
+  license_rules = [
+    "#minimumSockets=2",
+  ]
+
+  tags = {
+    foo = "barr"
+  }
+}
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) Name of the license configuration.
+* `description` - (Optional) Description of the license configuration.
+* `license_count` - (Optional) Number of licenses managed by the license configuration.
+* `license_count_hard_limit` - (Optional) Sets the number of available licenses as a hard limit.
+* `license_counting_type` - (Required) Dimension to use to track license inventory. Specify either `vCPU`, `Instance`, `Core` or `Socket`.
+* `license_rules` - (Optional) Array of configured License Manager rules.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Rules
+
+License rules should be in the format of `#RuleType=RuleValue`. Supported rule types:
+
+* `minimumVcpus` - Resource must have minimum vCPU count in order to use the license. Default: 1
+* `maximumVcpus` - Resource must have maximum vCPU count in order to use the license. Default: unbounded, limit: 10000
+* `minimumCores` - Resource must have minimum core count in order to use the license. Default: 1
+* `maximumCores` - Resource must have maximum core count in order to use the license. Default: unbounded, limit: 10000
+* `minimumSockets` - Resource must have minimum socket count in order to use the license. Default: 1
+* `maximumSockets` - Resource must have maximum socket count in order to use the license. Default: unbounded, limit: 10000
+* `allowedTenancy` - Defines where the license can be used. If set, restricts license usage to selected tenancies. Specify a comma delimited list of `EC2-Default`, `EC2-DedicatedHost`, `EC2-DedicatedInstance`
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The license configuration ARN.
+* `id` - The license configuration ARN.
+* `owner_account_id` - Account ID of the owner of the license configuration.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import license configurations using the `id`. For example:
+
+```terraform
+import {
+  to = aws_licensemanager_license_configuration.example
+  id = "arn:aws:license-manager:eu-west-1:123456789012:license-configuration:lic-0123456789abcdef0123456789abcdef"
+}
+```
+
+Using `terraform import`, import license configurations using the `id`. For example:
+
+```console
+% terraform import aws_licensemanager_license_configuration.example arn:aws:license-manager:eu-west-1:123456789012:license-configuration:lic-0123456789abcdef0123456789abcdef
+```
diff --git a/website/docs/r/licensemanager_license_configuration.markdown b/website/docs/r/licensemanager_license_configuration.markdown
deleted file mode 100644
index b11282c689b..00000000000
--- a/website/docs/r/licensemanager_license_configuration.markdown
+++ /dev/null
@@ -1,74 +0,0 @@
----
-subcategory: "License Manager"
-layout: "aws"
-page_title: "AWS: aws_licensemanager_license_configuration"
-description: |-
-  Provides a License Manager license configuration resource.
----
-
-# Resource: aws_licensemanager_license_configuration
-
-Provides a License Manager license configuration resource.
-
-~> **Note:** Removing the `license_count` attribute is not supported by the License Manager API - use `terraform taint aws_licensemanager_license_configuration.<id>` to recreate the resource instead.
-
-## Example Usage
-
-```terraform
-resource "aws_licensemanager_license_configuration" "example" {
-  name                     = "Example"
-  description              = "Example"
-  license_count            = 10
-  license_count_hard_limit = true
-  license_counting_type    = "Socket"
-
-  license_rules = [
-    "#minimumSockets=2",
-  ]
-
-  tags = {
-    foo = "barr"
-  }
-}
-```
-
-## Argument Reference
-
-The following arguments are supported:
-
-* `name` - (Required) Name of the license configuration.
-* `description` - (Optional) Description of the license configuration.
-* `license_count` - (Optional) Number of licenses managed by the license configuration.
-* `license_count_hard_limit` - (Optional) Sets the number of available licenses as a hard limit.
-* `license_counting_type` - (Required) Dimension to use to track license inventory. Specify either `vCPU`, `Instance`, `Core` or `Socket`.
-* `license_rules` - (Optional) Array of configured License Manager rules.
-* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
-
-## Rules
-
-License rules should be in the format of `#RuleType=RuleValue`. Supported rule types:
-
-* `minimumVcpus` - Resource must have minimum vCPU count in order to use the license. Default: 1
-* `maximumVcpus` - Resource must have maximum vCPU count in order to use the license. Default: unbounded, limit: 10000
-* `minimumCores` - Resource must have minimum core count in order to use the license. Default: 1
-* `maximumCores` - Resource must have maximum core count in order to use the license. Default: unbounded, limit: 10000
-* `minimumSockets` - Resource must have minimum socket count in order to use the license. Default: 1
-* `maximumSockets` - Resource must have maximum socket count in order to use the license. Default: unbounded, limit: 10000
-* `allowedTenancy` - Defines where the license can be used. If set, restricts license usage to selected tenancies. Specify a comma delimited list of `EC2-Default`, `EC2-DedicatedHost`, `EC2-DedicatedInstance`
-
-## Attributes Reference
-
-In addition to all arguments above, the following attributes are exported:
-
-* `arn` - The license configuration ARN.
-* `id` - The license configuration ARN.
-* `owner_account_id` - Account ID of the owner of the license configuration.
-* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
-
-## Import
-
-License configurations can be imported using the `id`, e.g.,
-
-```
-$ terraform import aws_licensemanager_license_configuration.example arn:aws:license-manager:eu-west-1:123456789012:license-configuration:lic-0123456789abcdef0123456789abcdef
-```
diff --git a/website/docs/r/lightsail_bucket.html.markdown b/website/docs/r/lightsail_bucket.html.markdown
index 9a88212b88b..a642f0a054c 100644
--- a/website/docs/r/lightsail_bucket.html.markdown
+++ b/website/docs/r/lightsail_bucket.html.markdown
@@ -21,15 +21,16 @@ resource "aws_lightsail_bucket" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The name for the bucket.
 * `bundle_id` - (Required) - The ID of the bundle to use for the bucket. A bucket bundle specifies the monthly cost, storage space, and data transfer quota for a bucket. Use the [get-bucket-bundles](https://docs.aws.amazon.com/cli/latest/reference/lightsail/get-bucket-bundles.html) cli command to get a list of bundle IDs that you can specify.
+* `force_delete` - (Optional) - Force Delete non-empty buckets using `terraform destroy`. AWS by default will not delete an s3 bucket which is not empty, to prevent losing bucket data and affecting other resources in lightsail. If `force_delete` is set to `true` the bucket will be deleted even when not empty.
 * `tags` - (Optional) A map of tags to assign to the resource. To create a key-only tag, use an empty string as the value. If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The name used for this bucket (matches `name`).
 * `arn` - The ARN of the lightsail bucket.
@@ -41,8 +42,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_lightsail_bucket` can be imported by using the `name` attribute, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_lightsail_bucket` using the `name` attribute. For example:
 
+```terraform
+import {
+  to = aws_lightsail_bucket.test
+  id = "example-bucket"
+}
 ```
-$ terraform import aws_lightsail_bucket.test example-bucket
+
+Using `terraform import`, import `aws_lightsail_bucket` using the `name` attribute. For example:
+
+```console
+% terraform import aws_lightsail_bucket.test example-bucket
 ```
diff --git a/website/docs/r/lightsail_bucket_access_key.html.markdown b/website/docs/r/lightsail_bucket_access_key.html.markdown
index 8aed1f5b585..9758c0224a2 100644
--- a/website/docs/r/lightsail_bucket_access_key.html.markdown
+++ b/website/docs/r/lightsail_bucket_access_key.html.markdown
@@ -25,13 +25,13 @@ resource "aws_lightsail_bucket_access_key_access_key" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `bucket_name` - (Required) The name of the bucket that the new access key will belong to, and grant access to.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - A combination of attributes separated by a `,` to create a unique id: `bucket_name`,`access_key_id`
 * `access_key_id` - The ID of the access key.
@@ -41,8 +41,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_lightsail_bucket_access_key` can be imported by using the `id` attribute, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_lightsail_bucket_access_key` using the `id` attribute. For example:
 
+```terraform
+import {
+  to = aws_lightsail_bucket_access_key.test
+  id = "example-bucket,AKIA47VOQ2KPR7LLRZ6D"
+}
 ```
-$ terraform import aws_lightsail_bucket_access_key.test example-bucket,AKIA47VOQ2KPR7LLRZ6D
+
+Using `terraform import`, import `aws_lightsail_bucket_access_key` using the `id` attribute. For example:
+
+```console
+% terraform import aws_lightsail_bucket_access_key.test example-bucket,AKIA47VOQ2KPR7LLRZ6D
 ```
diff --git a/website/docs/r/lightsail_bucket_resource_access.html.markdown b/website/docs/r/lightsail_bucket_resource_access.html.markdown
index 3b30486617c..5ea7bac4dd7 100644
--- a/website/docs/r/lightsail_bucket_resource_access.html.markdown
+++ b/website/docs/r/lightsail_bucket_resource_access.html.markdown
@@ -33,21 +33,30 @@ resource "aws_lightsail_bucket_resource_access" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `bucket_name` - (Required) The name of the bucket to grant access to.
 * `resource_name` - (Required) The name of the resource to be granted bucket access.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - A combination of attributes separated by a `,` to create a unique id: `bucket_name`,`resource_name`
 
 ## Import
 
-`aws_lightsail_bucket_resource_access` can be imported by using the `id` attribute, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_lightsail_bucket_resource_access` using the `id` attribute. For example:
 
+```terraform
+import {
+  to = aws_lightsail_bucket_resource_access.test
+  id = "example-bucket,example-instance"
+}
 ```
-$ terraform import aws_lightsail_bucket_resource_access.test example-bucket,example-instance
+
+Using `terraform import`, import `aws_lightsail_bucket_resource_access` using the `id` attribute. For example:
+
+```console
+% terraform import aws_lightsail_bucket_resource_access.test example-bucket,example-instance
 ```
diff --git a/website/docs/r/lightsail_certificate.html.markdown b/website/docs/r/lightsail_certificate.html.markdown
index ae53e801903..59b97d319e3 100644
--- a/website/docs/r/lightsail_certificate.html.markdown
+++ b/website/docs/r/lightsail_certificate.html.markdown
@@ -22,16 +22,16 @@ resource "aws_lightsail_certificate" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The name of the Lightsail load balancer.
 * `domain_name` - (Required) A domain name for which the certificate should be issued.
 * `subject_alternative_names` - (Optional) Set of domains that should be SANs in the issued certificate. `domain_name` attribute is automatically added as a Subject Alternative Name.
 * `tags` - (Optional) A map of tags to assign to the resource. To create a key-only tag, use an empty string as the value. If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The name of the lightsail certificate (matches `name`).
 * `arn` - The ARN of the lightsail certificate.
@@ -41,8 +41,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_lightsail_certificate` can be imported using the certificate name, e.g.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_lightsail_certificate` using the certificate name. For example:
 
-```shell
-$ terraform import aws_lightsail_certificate.test CertificateName
+```terraform
+import {
+  to = aws_lightsail_certificate.test
+  id = "CertificateName"
+}
+```
+
+Using `terraform import`, import `aws_lightsail_certificate` using the certificate name. For example:
+
+```console
+% terraform import aws_lightsail_certificate.test CertificateName
 ```
diff --git a/website/docs/r/lightsail_container_service.html.markdown b/website/docs/r/lightsail_container_service.html.markdown
index b00193cc9c2..e89906a67e7 100644
--- a/website/docs/r/lightsail_container_service.html.markdown
+++ b/website/docs/r/lightsail_container_service.html.markdown
@@ -96,7 +96,7 @@ resource "aws_ecr_repository_policy" "default" {
 container service. For more information, see
 [Enabling and managing custom domains for your Amazon Lightsail container services](https://lightsail.aws.amazon.com/ls/docs/en_us/articles/amazon-lightsail-creating-container-services-certificates).
 
-The following arguments are supported:
+This argument supports the following arguments:
 
 * `name` - (Required) The name for the container service. Names must be of length 1 to 63, and be
   unique within each AWS Region in your Lightsail account.
@@ -129,9 +129,9 @@ The `ecr_image_puller_role` blocks supports the following arguments:
 
 * `is_active` - (Optional) A Boolean value that indicates whether to activate the role. The default is `false`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The Amazon Resource Name (ARN) of the container service.
 * `availability_zone` - The Availability Zone. Follows the format us-east-2a (case-sensitive).
@@ -160,8 +160,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Lightsail Container Service can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Lightsail Container Service using the `name`. For example:
 
-```shell
-$ terraform import aws_lightsail_container_service.my_container_service container-service-1
+```terraform
+import {
+  to = aws_lightsail_container_service.my_container_service
+  id = "container-service-1"
+}
+```
+
+Using `terraform import`, import Lightsail Container Service using the `name`. For example:
+
+```console
+% terraform import aws_lightsail_container_service.my_container_service container-service-1
 ```
diff --git a/website/docs/r/lightsail_container_service_deployment_version.html.markdown b/website/docs/r/lightsail_container_service_deployment_version.html.markdown
index 30d0d583463..fd7137d5f8f 100644
--- a/website/docs/r/lightsail_container_service_deployment_version.html.markdown
+++ b/website/docs/r/lightsail_container_service_deployment_version.html.markdown
@@ -55,7 +55,7 @@ resource "aws_lightsail_container_service_deployment_version" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `service_name` - (Required) The name for the container service.
 * `container` - (Required) A set of configuration blocks that describe the settings of the containers that will be launched on the container service. Maximum of 53. [Detailed below](#container).
@@ -90,9 +90,9 @@ The `health_check` configuration block supports the following arguments:
 * `path` - (Optional) The path on the container on which to perform the health check. Defaults to "/".
 * `success_codes` - (Optional) The HTTP codes to use when checking for a successful response from a container. You can specify values between 200 and 499. Defaults to "200-499".
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The `service_name` and `version` separation by a slash (`/`).
 * `created_at` - The timestamp when the deployment was created.
@@ -107,8 +107,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Lightsail Container Service Deployment Version can be imported using the `service_name` and `version` separated by a slash (`/`), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Lightsail Container Service Deployment Version using the `service_name` and `version` separated by a slash (`/`). For example:
 
-```shell
-$ terraform import aws_lightsail_container_service_deployment_version.example container-service-1/1
+```terraform
+import {
+  to = aws_lightsail_container_service_deployment_version.example
+  id = "container-service-1/1"
+}
+```
+
+Using `terraform import`, import Lightsail Container Service Deployment Version using the `service_name` and `version` separated by a slash (`/`). For example:
+
+```console
+% terraform import aws_lightsail_container_service_deployment_version.example container-service-1/1
 ```
diff --git a/website/docs/r/lightsail_database.html.markdown b/website/docs/r/lightsail_database.html.markdown
index 6ea016b7ec2..95e804a25fd 100644
--- a/website/docs/r/lightsail_database.html.markdown
+++ b/website/docs/r/lightsail_database.html.markdown
@@ -20,13 +20,13 @@ for more information.
 
 ```terraform
 resource "aws_lightsail_database" "test" {
-  name                 = "test"
-  availability_zone    = "us-east-1a"
-  master_database_name = "testdatabasename"
-  master_password      = "testdatabasepassword"
-  master_username      = "test"
-  blueprint_id         = "mysql_8_0"
-  bundle_id            = "micro_1_0"
+  relational_database_name = "test"
+  availability_zone        = "us-east-1a"
+  master_database_name     = "testdatabasename"
+  master_password          = "testdatabasepassword"
+  master_username          = "test"
+  blueprint_id             = "mysql_8_0"
+  bundle_id                = "micro_1_0"
 }
 ```
 
@@ -34,13 +34,13 @@ resource "aws_lightsail_database" "test" {
 
 ```terraform
 resource "aws_lightsail_database" "test" {
-  name                 = "test"
-  availability_zone    = "us-east-1a"
-  master_database_name = "testdatabasename"
-  master_password      = "testdatabasepassword"
-  master_username      = "test"
-  blueprint_id         = "postgres_12"
-  bundle_id            = "micro_1_0"
+  relational_database_name = "test"
+  availability_zone        = "us-east-1a"
+  master_database_name     = "testdatabasename"
+  master_password          = "testdatabasepassword"
+  master_username          = "test"
+  blueprint_id             = "postgres_12"
+  bundle_id                = "micro_1_0"
 }
 ```
 
@@ -50,7 +50,7 @@ Below is an example that sets a custom backup and maintenance window. Times are
 
 ```terraform
 resource "aws_lightsail_database" "test" {
-  name                         = "test"
+  relational_database_name     = "test"
   availability_zone            = "us-east-1a"
   master_database_name         = "testdatabasename"
   master_password              = "testdatabasepassword"
@@ -68,7 +68,7 @@ To enable creating a final snapshot of your database on deletion, use the `final
 
 ```terraform
 resource "aws_lightsail_database" "test" {
-  name                         = "test"
+  relational_database_name     = "test"
   availability_zone            = "us-east-1a"
   master_database_name         = "testdatabasename"
   master_password              = "testdatabasepassword"
@@ -87,22 +87,22 @@ To enable applying changes immediately instead of waiting for a maintiance windo
 
 ```terraform
 resource "aws_lightsail_database" "test" {
-  name                 = "test"
-  availability_zone    = "us-east-1a"
-  master_database_name = "testdatabasename"
-  master_password      = "testdatabasepassword"
-  master_username      = "test"
-  blueprint_id         = "postgres_12"
-  bundle_id            = "micro_1_0"
-  apply_immediately    = true
+  relational_database_name = "test"
+  availability_zone        = "us-east-1a"
+  master_database_name     = "testdatabasename"
+  master_password          = "testdatabasepassword"
+  master_username          = "test"
+  blueprint_id             = "postgres_12"
+  bundle_id                = "micro_1_0"
+  apply_immediately        = true
 }
 ```
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
-* `name` - (Required) The name to use for your new Lightsail database resource. Names be unique within each AWS Region in your Lightsail account.
+* `relational_database_name` - (Required) The name to use for your new Lightsail database resource. Names be unique within each AWS Region in your Lightsail account.
 * `availability_zone` - The Availability Zone in which to create your new database. Use the us-east-2a case-sensitive format.
 * `master_database_name` - (Required) The name of the master database created when the Lightsail database resource is created.
 * `master_password` - (Sensitive) The password for the master user of your new database. The password can include any printable ASCII character except "/", """, or "@".
@@ -165,9 +165,9 @@ A Bundle Id can have the following infix added in order to use the HA option of
 
 A Bundle ID ends with one of the following suffix: `1_0`
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ARN of the Lightsail instance (matches `arn`).
 * `arn` - The ARN of the Lightsail instance (matches `id`).
@@ -186,8 +186,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Lightsail Databases can be imported using their name, e.g.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Lightsail Databases using their name. For example:
 
+```terraform
+import {
+  to = aws_lightsail_database.foo
+  id = "bar"
+}
 ```
-$ terraform import aws_lightsail_database.foo 'bar'
+
+Using `terraform import`, import Lightsail Databases using their name. For example:
+
+```console
+% terraform import aws_lightsail_database.foo 'bar'
 ```
diff --git a/website/docs/r/lightsail_disk.html.markdown b/website/docs/r/lightsail_disk.html.markdown
index a8908b4d930..cf898d2b725 100644
--- a/website/docs/r/lightsail_disk.html.markdown
+++ b/website/docs/r/lightsail_disk.html.markdown
@@ -31,16 +31,16 @@ resource "aws_lightsail_disk" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The name of the Lightsail load balancer.
 * `size_in_gb` - (Required) The instance port the load balancer will connect.
 * `availability_zone` - (Required) The Availability Zone in which to create your disk.
 * `tags` - (Optional) A map of tags to assign to the resource. To create a key-only tag, use an empty string as the value. If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The name of the disk  (matches `name`).
 * `arn` - The ARN of the Lightsail load balancer.
@@ -50,8 +50,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_lightsail_disk` can be imported by using the name attribute, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_lightsail_disk` using the name attribute. For example:
 
-```shell
-$ terraform import aws_lightsail_disk.test test
+```terraform
+import {
+  to = aws_lightsail_disk.test
+  id = "test"
+}
+```
+
+Using `terraform import`, import `aws_lightsail_disk` using the name attribute. For example:
+
+```console
+% terraform import aws_lightsail_disk.test test
 ```
diff --git a/website/docs/r/lightsail_disk_attachment.html.markdown b/website/docs/r/lightsail_disk_attachment.html.markdown
index 31b20036c99..03c7ccaff8c 100644
--- a/website/docs/r/lightsail_disk_attachment.html.markdown
+++ b/website/docs/r/lightsail_disk_attachment.html.markdown
@@ -44,22 +44,31 @@ resource "aws_lightsail_disk_attachment" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `disk_name` - (Required) The name of the Lightsail Disk.
 * `instance_name` - (Required) The name of the Lightsail Instance to attach to.
 * `disk_path` - (Required) The disk path to expose to the instance.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - A combination of attributes to create a unique id: `disk_name`,`instance_name`
 
 ## Import
 
-`aws_lightsail_disk` can be imported by using the id attribute, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_lightsail_disk` using the id attribute. For example:
 
-```shell
-$ terraform import aws_lightsail_disk_attachment.test test-disk,test-instance
+```terraform
+import {
+  to = aws_lightsail_disk_attachment.test
+  id = "test-disk,test-instance"
+}
+```
+
+Using `terraform import`, import `aws_lightsail_disk` using the id attribute. For example:
+
+```console
+% terraform import aws_lightsail_disk_attachment.test test-disk,test-instance
 ```
diff --git a/website/docs/r/lightsail_distribution.html.markdown b/website/docs/r/lightsail_distribution.html.markdown
index d4dab56658e..b276a0fbb87 100644
--- a/website/docs/r/lightsail_distribution.html.markdown
+++ b/website/docs/r/lightsail_distribution.html.markdown
@@ -206,9 +206,9 @@ The following arguments are optional:
 * `behavior` - (Required) The cache behavior for the specified path.
 * `path` - (Required) The path to a directory or file to cached, or not cache. Use an asterisk symbol to specify wildcard directories (path/to/assets/\*), and file types (\*.html, \*jpg, \*js). Directories and file paths are case-sensitive.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `alternative_domain_names` - The alternate domain names of the distribution.
 * `arn` - The Amazon Resource Name (ARN) of the distribution.
@@ -236,8 +236,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Lightsail Distribution can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Lightsail Distribution using the `id`. For example:
 
+```terraform
+import {
+  to = aws_lightsail_distribution.example
+  id = "rft-8012925589"
+}
 ```
-$ terraform import aws_lightsail_distribution.example rft-8012925589
+
+Using `terraform import`, import Lightsail Distribution using the `id`. For example:
+
+```console
+% terraform import aws_lightsail_distribution.example rft-8012925589
 ```
diff --git a/website/docs/r/lightsail_domain.html.markdown b/website/docs/r/lightsail_domain.html.markdown
index 12753d6d68d..9dcae26f9ad 100644
--- a/website/docs/r/lightsail_domain.html.markdown
+++ b/website/docs/r/lightsail_domain.html.markdown
@@ -26,13 +26,13 @@ resource "aws_lightsail_domain" "domain_test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `domain_name` - (Required) The name of the Lightsail domain to manage
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The name used for this domain
 * `arn` - The ARN of the Lightsail domain
diff --git a/website/docs/r/lightsail_domain_entry.html.markdown b/website/docs/r/lightsail_domain_entry.html.markdown
index 39811ed6dd0..6e6c5effc08 100644
--- a/website/docs/r/lightsail_domain_entry.html.markdown
+++ b/website/docs/r/lightsail_domain_entry.html.markdown
@@ -30,7 +30,7 @@ resource "aws_lightsail_domain_entry" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `domain_name` - (Required) The name of the Lightsail domain in which to create the entry
 * `name` - (Required) Name of the entry record
@@ -38,16 +38,25 @@ The following arguments are supported:
 * `target` - (Required) Target of the domain entry
 * `is_alias` - (Optional) If the entry should be an alias Defaults to `false`
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - A combination of attributes to create a unique id: `name`,`domain_name`,`type`,`target`
 
 ## Import
 
-`aws_lightsail_domain_entry` can be imported by using the id attribute, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_lightsail_domain_entry` using the id attribute. For example:
 
+```terraform
+import {
+  to = aws_lightsail_domain_entry.example
+  id = "www,mydomain.com,A,127.0.0.1"
+}
 ```
-$ terraform import aws_lightsail_domain_entry.example www,mydomain.com,A,127.0.0.1
+
+Using `terraform import`, import `aws_lightsail_domain_entry` using the id attribute. For example:
+
+```console
+% terraform import aws_lightsail_domain_entry.example www,mydomain.com,A,127.0.0.1
 ```
diff --git a/website/docs/r/lightsail_instance.html.markdown b/website/docs/r/lightsail_instance.html.markdown
index c9b1ae4bdbc..88dfcbde8e3 100644
--- a/website/docs/r/lightsail_instance.html.markdown
+++ b/website/docs/r/lightsail_instance.html.markdown
@@ -67,7 +67,7 @@ resource "aws_lightsail_instance" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The name of the Lightsail Instance. Names be unique within each AWS Region in your Lightsail account.
 * `availability_zone` - (Required) The Availability Zone in which to create your
@@ -141,9 +141,9 @@ A Bundle ID ends with one of the following suffixes depending on Availability Zo
 - us-east-2: `2_0`
 - us-west-2: `2_0`
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ARN of the Lightsail instance (matches `arn`).
 * `arn` - The ARN of the Lightsail instance (matches `id`).
@@ -159,8 +159,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Lightsail Instances can be imported using their name, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Lightsail Instances using their name. For example:
 
+```terraform
+import {
+  to = aws_lightsail_instance.gitlab_test
+  id = "custom_gitlab"
+}
 ```
-$ terraform import aws_lightsail_instance.gitlab_test 'custom_gitlab'
+
+Using `terraform import`, import Lightsail Instances using their name. For example:
+
+```console
+% terraform import aws_lightsail_instance.gitlab_test 'custom_gitlab'
 ```
diff --git a/website/docs/r/lightsail_instance_public_ports.html.markdown b/website/docs/r/lightsail_instance_public_ports.html.markdown
index 1ca01d28c72..7ba3288bca3 100644
--- a/website/docs/r/lightsail_instance_public_ports.html.markdown
+++ b/website/docs/r/lightsail_instance_public_ports.html.markdown
@@ -55,8 +55,8 @@ The following arguments are optional:
 * `cidrs` - (Optional) Set of CIDR blocks.
 * `cidr_list_aliases` - (Optional) Set of CIDR aliases that define access for a preconfigured range of IP addresses.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - ID of the resource.
diff --git a/website/docs/r/lightsail_key_pair.html.markdown b/website/docs/r/lightsail_key_pair.html.markdown
index 936e0ebb01e..5c68edb3cb5 100644
--- a/website/docs/r/lightsail_key_pair.html.markdown
+++ b/website/docs/r/lightsail_key_pair.html.markdown
@@ -45,36 +45,27 @@ resource "aws_lightsail_key_pair" "lg_key_pair" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
-* `name` - (Optional) The name of the Lightsail Key Pair. If omitted, a unique
-name will be generated by Terraform
-* `pgp_key` – (Optional) An optional PGP key to encrypt the resulting private
-key material. Only used when creating a new key pair
-* `public_key` - (Required) The public key material. This public key will be
-imported into Lightsail
+* `name` - (Optional) The name of the Lightsail Key Pair. If omitted, a unique name will be generated by Terraform
+* `pgp_key` – (Optional) An optional PGP key to encrypt the resulting private key material. Only used when creating a new key pair
+* `public_key` - (Required) The public key material. This public key will be imported into Lightsail
+* `tags` - (Optional) A map of tags to assign to the collection. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-~> **NOTE:** a PGP key is not required, however it is strongly encouraged.
-Without a PGP key, the private key material will be stored in state unencrypted.
-`pgp_key` is ignored if `public_key` is supplied.
+~> **NOTE:** a PGP key is not required, however it is strongly encouraged. Without a PGP key, the private key material will be stored in state unencrypted.`pgp_key` is ignored if `public_key` is supplied.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
-* `id` - The name used for this key pair
-* `arn` - The ARN of the Lightsail key pair
+* `id` - The name used for this key pair.
+* `arn` - The ARN of the Lightsail key pair.
+* `encrypted_fingerprint` - The MD5 public key fingerprint for the encrypted private key.
+* `encrypted_private_key` – the private key material, base 64 encoded and encrypted with the given `pgp_key`. This is only populated when creating a new key and `pgp_key` is supplied.
 * `fingerprint` - The MD5 public key fingerprint as specified in section 4 of RFC 4716.
-* `public_key` - the public key, base64 encoded
-* `private_key` - the private key, base64 encoded. This is only populated
-when creating a new key, and when no `pgp_key` is provided
-* `encrypted_private_key` – the private key material, base 64 encoded and
-encrypted with the given `pgp_key`. This is only populated when creating a new
-key and `pgp_key` is supplied
-* `encrypted_fingerprint` - The MD5 public key fingerprint for the encrypted
-private key
+* `public_key` - the public key, base64 encoded.
+* `private_key` - the private key, base64 encoded. This is only populated when creating a new key, and when no `pgp_key` is provided.
 
 ## Import
 
-Lightsail Key Pairs cannot be imported, because the private and public key are
-only available on initial creation.
+You cannot import Lightsail Key Pairs because the private and public key are only available on initial creation.
diff --git a/website/docs/r/lightsail_lb.html.markdown b/website/docs/r/lightsail_lb.html.markdown
index 7eae87b16bd..9baa97ea2e3 100644
--- a/website/docs/r/lightsail_lb.html.markdown
+++ b/website/docs/r/lightsail_lb.html.markdown
@@ -25,16 +25,16 @@ resource "aws_lightsail_lb" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The name of the Lightsail load balancer.
 * `instance_port` - (Required) The instance port the load balancer will connect.
 * `health_check_path` - (Optional) The health check path of the load balancer. Default value "/".
 * `tags` - (Optional) A map of tags to assign to the resource. To create a key-only tag, use an empty string as the value. If configured with a provider `default_tags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The name used for this load balancer (matches `name`).
 * `arn` - The ARN of the Lightsail load balancer.
@@ -47,8 +47,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_lightsail_lb` can be imported by using the name attribute, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_lightsail_lb` using the name attribute. For example:
 
+```terraform
+import {
+  to = aws_lightsail_lb.test
+  id = "example-load-balancer"
+}
 ```
-$ terraform import aws_lightsail_lb.test example-load-balancer
+
+Using `terraform import`, import `aws_lightsail_lb` using the name attribute. For example:
+
+```console
+% terraform import aws_lightsail_lb.test example-load-balancer
 ```
diff --git a/website/docs/r/lightsail_lb_attachment.html.markdown b/website/docs/r/lightsail_lb_attachment.html.markdown
index a79348d3028..fde6b31a611 100644
--- a/website/docs/r/lightsail_lb_attachment.html.markdown
+++ b/website/docs/r/lightsail_lb_attachment.html.markdown
@@ -46,21 +46,30 @@ resource "aws_lightsail_lb_attachment" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `lb_name` - (Required) The name of the Lightsail load balancer.
 * `instance_name` - (Required) The name of the instance to attach to the load balancer.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - A combination of attributes to create a unique id: `lb_name`,`instance_name`
 
 ## Import
 
-`aws_lightsail_lb_attachment` can be imported by using the name attribute, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_lightsail_lb_attachment` using the name attribute. For example:
 
+```terraform
+import {
+  to = aws_lightsail_lb_attachment.test
+  id = "example-load-balancer,example-instance"
+}
 ```
-$ terraform import aws_lightsail_lb_attachment.test example-load-balancer,example-instance
+
+Using `terraform import`, import `aws_lightsail_lb_attachment` using the name attribute. For example:
+
+```console
+% terraform import aws_lightsail_lb_attachment.test example-load-balancer,example-instance
 ```
diff --git a/website/docs/r/lightsail_lb_certificate.html.markdown b/website/docs/r/lightsail_lb_certificate.html.markdown
index 2b8606504b7..b9fa8cc87a0 100644
--- a/website/docs/r/lightsail_lb_certificate.html.markdown
+++ b/website/docs/r/lightsail_lb_certificate.html.markdown
@@ -31,7 +31,7 @@ resource "aws_lightsail_lb_certificate" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `domain_name` - (Required) The domain name (e.g., example.com) for your SSL/TLS certificate.
 * `lb_name` - (Required) The load balancer name where you want to create the SSL/TLS certificate.
@@ -39,9 +39,9 @@ The following arguments are supported:
 * `name` - (Required) The SSL/TLS certificate name.
 * `subject_alternative_names` - (Optional) Set of domains that should be SANs in the issued certificate. `domain_name` attribute is automatically added as a Subject Alternative Name.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - A combination of attributes to create a unique id: `lb_name`,`name`
 * `arn` - The ARN of the lightsail certificate.
@@ -50,8 +50,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_lightsail_lb_certificate` can be imported by using the id attribute, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_lightsail_lb_certificate` using the id attribute. For example:
 
+```terraform
+import {
+  to = aws_lightsail_lb_certificate.test
+  id = "example-load-balancer,example-load-balancer-certificate"
+}
 ```
-$ terraform import aws_lightsail_lb_certificate.test example-load-balancer,example-load-balancer-certificate
+
+Using `terraform import`, import `aws_lightsail_lb_certificate` using the id attribute. For example:
+
+```console
+% terraform import aws_lightsail_lb_certificate.test example-load-balancer,example-load-balancer-certificate
 ```
diff --git a/website/docs/r/lightsail_lb_certificate_attachment.html.markdown b/website/docs/r/lightsail_lb_certificate_attachment.html.markdown
index 8e4826703a8..5b9212bd331 100644
--- a/website/docs/r/lightsail_lb_certificate_attachment.html.markdown
+++ b/website/docs/r/lightsail_lb_certificate_attachment.html.markdown
@@ -36,21 +36,30 @@ resource "aws_lightsail_lb_certificate_attachment" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `lb_name` - (Required) The name of the load balancer to which you want to associate the SSL/TLS certificate.
 * `certificate_name` - (Required) The name of your SSL/TLS certificate.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - A combination of attributes to create a unique id: `lb_name`,`certificate_name`
 
 ## Import
 
-`aws_lightsail_lb_certificate_attachment` can be imported by using the name attribute, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_lightsail_lb_certificate_attachment` using the name attribute. For example:
 
+```terraform
+import {
+  to = aws_lightsail_lb_certificate_attachment.test
+  id = "example-load-balancer,example-certificate"
+}
 ```
-$ terraform import aws_lightsail_lb_certificate_attachment.test example-load-balancer,example-certificate
+
+Using `terraform import`, import `aws_lightsail_lb_certificate_attachment` using the name attribute. For example:
+
+```console
+% terraform import aws_lightsail_lb_certificate_attachment.test example-load-balancer,example-certificate
 ```
diff --git a/website/docs/r/lightsail_lb_https_redirection_policy.html.markdown b/website/docs/r/lightsail_lb_https_redirection_policy.html.markdown
index cd4ad748b64..057283b574f 100644
--- a/website/docs/r/lightsail_lb_https_redirection_policy.html.markdown
+++ b/website/docs/r/lightsail_lb_https_redirection_policy.html.markdown
@@ -41,21 +41,30 @@ resource "aws_lightsail_lb_https_redirection_policy" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `lb_name` - (Required) The name of the load balancer to which you want to enable http to https redirection.
 * `enabled` - (Required) - The Https Redirection state of the load balancer. `true` to activate http to https redirection or `false` to deactivate http to https redirection.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The name used for this load balancer (matches `lb_name`).
 
 ## Import
 
-`aws_lightsail_lb_https_redirection_policy` can be imported by using the `lb_name` attribute, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_lightsail_lb_https_redirection_policy` using the `lb_name` attribute. For example:
 
+```terraform
+import {
+  to = aws_lightsail_lb_https_redirection_policy.test
+  id = "example-load-balancer"
+}
 ```
-$ terraform import aws_lightsail_lb_https_redirection_policy.test example-load-balancer
+
+Using `terraform import`, import `aws_lightsail_lb_https_redirection_policy` using the `lb_name` attribute. For example:
+
+```console
+% terraform import aws_lightsail_lb_https_redirection_policy.test example-load-balancer
 ```
diff --git a/website/docs/r/lightsail_lb_stickiness_policy.html.markdown b/website/docs/r/lightsail_lb_stickiness_policy.html.markdown
index cab28ca044d..4d1cfdce41d 100644
--- a/website/docs/r/lightsail_lb_stickiness_policy.html.markdown
+++ b/website/docs/r/lightsail_lb_stickiness_policy.html.markdown
@@ -31,22 +31,31 @@ resource "aws_lightsail_lb_stickiness_policy" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `lb_name` - (Required) The name of the load balancer to which you want to enable session stickiness.
 * `cookie_duration` - (Required) The cookie duration in seconds. This determines the length of the session stickiness.
 * `enabled` - (Required) - The Session Stickiness state of the load balancer. `true` to activate session stickiness or `false` to deactivate session stickiness.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The name used for this load balancer (matches `lb_name`).
 
 ## Import
 
-`aws_lightsail_lb_stickiness_policy` can be imported by using the `lb_name` attribute, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_lightsail_lb_stickiness_policy` using the `lb_name` attribute. For example:
 
+```terraform
+import {
+  to = aws_lightsail_lb_stickiness_policy.test
+  id = "example-load-balancer"
+}
 ```
-$ terraform import aws_lightsail_lb_stickiness_policy.test example-load-balancer
+
+Using `terraform import`, import `aws_lightsail_lb_stickiness_policy` using the `lb_name` attribute. For example:
+
+```console
+% terraform import aws_lightsail_lb_stickiness_policy.test example-load-balancer
 ```
diff --git a/website/docs/r/lightsail_static_ip.html.markdown b/website/docs/r/lightsail_static_ip.html.markdown
index b29f9ae463e..c3622d2bd1a 100644
--- a/website/docs/r/lightsail_static_ip.html.markdown
+++ b/website/docs/r/lightsail_static_ip.html.markdown
@@ -22,13 +22,13 @@ resource "aws_lightsail_static_ip" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The name for the allocated static IP
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The ARN of the Lightsail static IP
 * `ip_address` - The allocated static IP address
diff --git a/website/docs/r/lightsail_static_ip_attachment.html.markdown b/website/docs/r/lightsail_static_ip_attachment.html.markdown
index aa032456920..72801cadce9 100644
--- a/website/docs/r/lightsail_static_ip_attachment.html.markdown
+++ b/website/docs/r/lightsail_static_ip_attachment.html.markdown
@@ -35,13 +35,13 @@ resource "aws_lightsail_instance" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `static_ip_name` - (Required) The name of the allocated static IP
 * `instance_name` - (Required) The name of the Lightsail instance to attach the IP to
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `ip_address` - The allocated static IP address
diff --git a/website/docs/r/load_balancer_backend_server_policy.html.markdown b/website/docs/r/load_balancer_backend_server_policy.html.markdown
index ea41b0a7bf3..aae7ccfb6e0 100644
--- a/website/docs/r/load_balancer_backend_server_policy.html.markdown
+++ b/website/docs/r/load_balancer_backend_server_policy.html.markdown
@@ -66,15 +66,15 @@ resource "aws_load_balancer_backend_server_policy" "wu-tang-backend-auth-policie
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `load_balancer_name` - (Required) The load balancer to attach the policy to.
 * `policy_names` - (Required) List of Policy Names to apply to the backend server.
 * `instance_port` - (Required) The instance port to apply the policy to.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the policy.
 * `load_balancer_name` - The load balancer on which the policy is defined.
diff --git a/website/docs/r/load_balancer_listener_policy.html.markdown b/website/docs/r/load_balancer_listener_policy.html.markdown
index d22d77cccd2..a8ab60ad18d 100644
--- a/website/docs/r/load_balancer_listener_policy.html.markdown
+++ b/website/docs/r/load_balancer_listener_policy.html.markdown
@@ -105,16 +105,16 @@ This example shows how to add a [Predefined Security Policy for ELBs](https://do
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `load_balancer_name` - (Required) The load balancer to attach the policy to.
 * `load_balancer_port` - (Required) The load balancer listener port to apply the policy to.
 * `policy_names` - (Required) List of Policy Names to apply to the backend server.
 * `triggers` - (Optional) Map of arbitrary keys and values that, when changed, will trigger an update. To force an update without changing these keys/values, use the [`terraform taint` command](https://www.terraform.io/docs/commands/taint.html).
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the policy.
 * `load_balancer_name` - The load balancer on which the policy is defined.
diff --git a/website/docs/r/load_balancer_policy.html.markdown b/website/docs/r/load_balancer_policy.html.markdown
index 989c5fd5d19..0f857a8c01f 100644
--- a/website/docs/r/load_balancer_policy.html.markdown
+++ b/website/docs/r/load_balancer_policy.html.markdown
@@ -102,16 +102,16 @@ resource "aws_load_balancer_listener_policy" "wu-tang-listener-policies-443" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `load_balancer_name` - (Required) The load balancer on which the policy is defined.
 * `policy_name` - (Required) The name of the load balancer policy.
 * `policy_type_name` - (Required) The policy type.
 * `policy_attribute` - (Optional) Policy attribute to apply to the policy.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the policy.
 * `policy_name` - The name of the stickiness policy.
diff --git a/website/docs/r/location_geofence_collection.html.markdown b/website/docs/r/location_geofence_collection.html.markdown
index ee7dbba07a6..25a76160e8b 100644
--- a/website/docs/r/location_geofence_collection.html.markdown
+++ b/website/docs/r/location_geofence_collection.html.markdown
@@ -30,9 +30,9 @@ The following arguments are optional:
 * `kms_key_id` - (Optional) A key identifier for an AWS KMS customer managed key assigned to the Amazon Location resource.
 * `tags` - (Optional) Key-value tags for the geofence collection. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `collection_arn` - The Amazon Resource Name (ARN) for the geofence collection resource. Used when you need to specify a resource across all AWS.
 * `create_time` - The timestamp for when the geofence collection resource was created in ISO 8601 format.
@@ -48,8 +48,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Location Geofence Collection can be imported using the `collection_name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Location Geofence Collection using the `collection_name`. For example:
 
+```terraform
+import {
+  to = aws_location_geofence_collection.example
+  id = "example"
+}
 ```
-$ terraform import aws_location_geofence_collection.example example
+
+Using `terraform import`, import Location Geofence Collection using the `collection_name`. For example:
+
+```console
+% terraform import aws_location_geofence_collection.example example
 ```
diff --git a/website/docs/r/location_map.html.markdown b/website/docs/r/location_map.html.markdown
index 11689a9acb7..2191315245b 100644
--- a/website/docs/r/location_map.html.markdown
+++ b/website/docs/r/location_map.html.markdown
@@ -40,9 +40,9 @@ The following arguments are required:
 
 * `style` - (Required) Specifies the map style selected from an available data provider. Valid values can be found in the [Location Service CreateMap API Reference](https://docs.aws.amazon.com/location/latest/APIReference/API_CreateMap.html).
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `create_time` - The timestamp for when the map resource was created in ISO 8601 format.
 * `map_arn` - The Amazon Resource Name (ARN) for the map resource. Used to specify a resource across all AWS.
@@ -51,8 +51,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_location_map` resources can be imported using the map name, e.g.:
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_location_map` resources using the map name. For example:
 
+```terraform
+import {
+  to = aws_location_map.example
+  id = "example"
+}
 ```
-$ terraform import aws_location_map.example example
+
+Using `terraform import`, import `aws_location_map` resources using the map name. For example:
+
+```console
+% terraform import aws_location_map.example example
 ```
diff --git a/website/docs/r/location_place_index.html.markdown b/website/docs/r/location_place_index.html.markdown
index 71d4c5c4bc0..989170618d7 100644
--- a/website/docs/r/location_place_index.html.markdown
+++ b/website/docs/r/location_place_index.html.markdown
@@ -38,9 +38,9 @@ The following arguments are optional:
 
 * `intended_use` - (Optional) Specifies how the results of an operation will be stored by the caller. Valid values: `SingleUse`, `Storage`. Default: `SingleUse`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `create_time` - The timestamp for when the place index resource was created in ISO 8601 format.
 * `index_arn` - The Amazon Resource Name (ARN) for the place index resource. Used to specify a resource across AWS.
@@ -49,8 +49,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_location_place_index` resources can be imported using the place index name, e.g.:
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_location_place_index` resources using the place index name. For example:
 
+```terraform
+import {
+  to = aws_location_place_index.example
+  id = "example"
+}
 ```
-$ terraform import aws_location_place_index.example example
+
+Using `terraform import`, import `aws_location_place_index` resources using the place index name. For example:
+
+```console
+% terraform import aws_location_place_index.example example
 ```
diff --git a/website/docs/r/location_route_calculator.html.markdown b/website/docs/r/location_route_calculator.html.markdown
index e253b9008f6..62cd64a2ae4 100644
--- a/website/docs/r/location_route_calculator.html.markdown
+++ b/website/docs/r/location_route_calculator.html.markdown
@@ -31,9 +31,9 @@ The following arguments are optional:
 * `description` - (Optional) The optional description for the route calculator resource.
 * `tags` - (Optional) Key-value tags for the route calculator. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `calculator_arn` - The Amazon Resource Name (ARN) for the Route calculator resource. Use the ARN when you specify a resource across AWS.
 * `create_time` - The timestamp for when the route calculator resource was created in ISO 8601 format.
@@ -50,8 +50,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_location_route_calculator` can be imported using the route calculator name, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_location_route_calculator` using the route calculator name. For example:
 
+```terraform
+import {
+  to = aws_location_route_calculator.example
+  id = "example"
+}
 ```
-$ terraform import aws_location_route_calculator.example example
+
+Using `terraform import`, import `aws_location_route_calculator` using the route calculator name. For example:
+
+```console
+% terraform import aws_location_route_calculator.example example
 ```
diff --git a/website/docs/r/location_tracker.html.markdown b/website/docs/r/location_tracker.html.markdown
index e3a3f346987..fecb71dc90b 100644
--- a/website/docs/r/location_tracker.html.markdown
+++ b/website/docs/r/location_tracker.html.markdown
@@ -31,9 +31,9 @@ The following arguments are optional:
 * `position_filtering` - (Optional) The position filtering method of the tracker resource. Valid values: `TimeBased`, `DistanceBased`, `AccuracyBased`. Default: `TimeBased`.
 * `tags` - (Optional) Key-value tags for the tracker. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `create_time` - The timestamp for when the tracker resource was created in ISO 8601 format.
 * `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
@@ -42,8 +42,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_location_tracker` resources can be imported using the tracker name, e.g.:
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_location_tracker` resources using the tracker name. For example:
 
+```terraform
+import {
+  to = aws_location_tracker.example
+  id = "example"
+}
 ```
-$ terraform import aws_location_tracker.example example
+
+Using `terraform import`, import `aws_location_tracker` resources using the tracker name. For example:
+
+```console
+% terraform import aws_location_tracker.example example
 ```
diff --git a/website/docs/r/location_tracker_association.html.markdown b/website/docs/r/location_tracker_association.html.markdown
index 39299b030d5..2f95981711f 100644
--- a/website/docs/r/location_tracker_association.html.markdown
+++ b/website/docs/r/location_tracker_association.html.markdown
@@ -34,9 +34,9 @@ The following arguments are required:
 * `consumer_arn` - (Required) The Amazon Resource Name (ARN) for the geofence collection to be associated to tracker resource. Used when you need to specify a resource across all AWS.
 * `tracker_name` - (Required) The name of the tracker resource to be associated with a geofence collection.
 
-## Attributes Reference
+## Attribute Reference
 
-No additional attributes are exported.
+This resource exports no additional attributes.
 
 ## Timeouts
 
@@ -47,8 +47,17 @@ No additional attributes are exported.
 
 ## Import
 
-Location Tracker Association can be imported using the `tracker_name|consumer_arn`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Location Tracker Association using the `tracker_name|consumer_arn`. For example:
 
+```terraform
+import {
+  to = aws_location_tracker_association.example
+  id = "tracker_name|consumer_arn"
+}
 ```
-$ terraform import aws_location_tracker_association.example "tracker_name|consumer_arn"
+
+Using `terraform import`, import Location Tracker Association using the `tracker_name|consumer_arn`. For example:
+
+```console
+% terraform import aws_location_tracker_association.example "tracker_name|consumer_arn"
 ```
diff --git a/website/docs/r/macie2_account.html.markdown b/website/docs/r/macie2_account.html.markdown
index edaa68ddb48..1f2af7e6e6d 100644
--- a/website/docs/r/macie2_account.html.markdown
+++ b/website/docs/r/macie2_account.html.markdown
@@ -21,14 +21,14 @@ resource "aws_macie2_account" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `finding_publishing_frequency` -  (Optional) Specifies how often to publish updates to policy findings for the account. This includes publishing updates to AWS Security Hub and Amazon EventBridge (formerly called Amazon CloudWatch Events). Valid values are `FIFTEEN_MINUTES`, `ONE_HOUR` or `SIX_HOURS`.
 * `status` - (Optional) Specifies the status for the account. To enable Amazon Macie and start all Macie activities for the account, set this value to `ENABLED`. Valid values are `ENABLED` or `PAUSED`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The unique identifier (ID) of the macie account.
 * `service_role` - The Amazon Resource Name (ARN) of the service-linked role that allows Macie to monitor and analyze data in AWS resources for the account.
@@ -37,8 +37,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_macie2_account` can be imported using the id, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_macie2_account` using the id. For example:
 
+```terraform
+import {
+  to = aws_macie2_account.example
+  id = "abcd1"
+}
 ```
-$ terraform import aws_macie2_account.example abcd1
+
+Using `terraform import`, import `aws_macie2_account` using the id. For example:
+
+```console
+% terraform import aws_macie2_account.example abcd1
 ```
diff --git a/website/docs/r/macie2_classification_export_configuration.html.markdown b/website/docs/r/macie2_classification_export_configuration.html.markdown
index d484bb58127..597ef7f0757 100644
--- a/website/docs/r/macie2_classification_export_configuration.html.markdown
+++ b/website/docs/r/macie2_classification_export_configuration.html.markdown
@@ -29,7 +29,7 @@ resource "aws_macie2_classification_export_configuration" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `s3_destination` - (Required) Configuration block for a S3 Destination. Defined below
 
@@ -43,16 +43,25 @@ The `s3_destination` configuration block supports the following arguments:
 
 Additional information can be found in the [Storing and retaining sensitive data discovery results with Amazon Macie for AWS Macie documentation](https://docs.aws.amazon.com/macie/latest/user/discovery-results-repository-s3.html).
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The unique identifier (ID) of the configuration.
 
 ## Import
 
-`aws_macie2_classification_export_configuration` can be imported using the account ID and region, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_macie2_classification_export_configuration` using the account ID and region. For example:
 
+```terraform
+import {
+  to = aws_macie2_classification_export_configuration.example
+  id = "123456789012:us-west-2"
+}
 ```
-$ terraform import aws_macie2_classification_export_configuration.example 123456789012:us-west-2
+
+Using `terraform import`, import `aws_macie2_classification_export_configuration` using the account ID and region. For example:
+
+```console
+% terraform import aws_macie2_classification_export_configuration.example 123456789012:us-west-2
 ```
diff --git a/website/docs/r/macie2_classification_job.html.markdown b/website/docs/r/macie2_classification_job.html.markdown
index 403da9915ed..16ce757f242 100644
--- a/website/docs/r/macie2_classification_job.html.markdown
+++ b/website/docs/r/macie2_classification_job.html.markdown
@@ -30,7 +30,7 @@ resource "aws_macie2_classification_job" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `schedule_frequency` -  (Optional) The recurrence pattern for running the job. To run the job only once, don't specify a value for this property and set the value for the `job_type` property to `ONE_TIME`. (documented below)
 * `custom_data_identifier_ids` -  (Optional) The custom data identifiers to use for data analysis and classification.
@@ -124,9 +124,9 @@ The `tag_scope_term` object supports the following:
 * `key` -  (Required) The tag key to use in the condition. The only valid value is `TAG`.
 * `target` -  (Required) The type of object to apply the condition to. The only valid value is `S3_OBJECT`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The unique identifier (ID) of the macie classification job.
 * `created_at` -  The date and time, in UTC and extended RFC 3339 format, when the job was created.
@@ -134,8 +134,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_macie2_classification_job` can be imported using the id, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_macie2_classification_job` using the id. For example:
 
+```terraform
+import {
+  to = aws_macie2_classification_job.example
+  id = "abcd1"
+}
 ```
-$ terraform import aws_macie2_classification_job.example abcd1
+
+Using `terraform import`, import `aws_macie2_classification_job` using the id. For example:
+
+```console
+% terraform import aws_macie2_classification_job.example abcd1
 ```
diff --git a/website/docs/r/macie2_custom_data_identifier.html.markdown b/website/docs/r/macie2_custom_data_identifier.html.markdown
index 5a6663bfccd..35d0d23098d 100644
--- a/website/docs/r/macie2_custom_data_identifier.html.markdown
+++ b/website/docs/r/macie2_custom_data_identifier.html.markdown
@@ -29,7 +29,7 @@ resource "aws_macie2_custom_data_identifier" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `regex` - (Optional) The regular expression (regex) that defines the pattern to match. The expression can contain as many as 512 characters.
 * `keywords` -  (Optional) An array that lists specific character sequences (keywords), one of which must be within proximity (`maximum_match_distance`) of the regular expression to match. The array can contain as many as 50 keywords. Each keyword can contain 3 - 90 characters. Keywords aren't case sensitive.
@@ -40,9 +40,9 @@ The following arguments are supported:
 * `maximum_match_distance` - (Optional) The maximum number of characters that can exist between text that matches the regex pattern and the character sequences specified by the keywords array. Macie includes or excludes a result based on the proximity of a keyword to text that matches the regex pattern. The distance can be 1 - 300 characters. The default value is 50.
 * `tags` - (Optional) A map of key-value pairs that specifies the tags to associate with the custom data identifier.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The unique identifier (ID) of the macie custom data identifier.
 * `deleted` - Specifies whether the custom data identifier was deleted. If you delete a custom data identifier, Amazon Macie doesn't delete it permanently. Instead, it soft deletes the identifier.
@@ -51,8 +51,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_macie2_custom_data_identifier` can be imported using the id, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_macie2_custom_data_identifier` using the id. For example:
 
+```terraform
+import {
+  to = aws_macie2_custom_data_identifier.example
+  id = "abcd1"
+}
 ```
-$ terraform import aws_macie2_custom_data_identifier.example abcd1
+
+Using `terraform import`, import `aws_macie2_custom_data_identifier` using the id. For example:
+
+```console
+% terraform import aws_macie2_custom_data_identifier.example abcd1
 ```
diff --git a/website/docs/r/macie2_findings_filter.html.markdown b/website/docs/r/macie2_findings_filter.html.markdown
index 28fc21ebf50..2e58c9c4507 100644
--- a/website/docs/r/macie2_findings_filter.html.markdown
+++ b/website/docs/r/macie2_findings_filter.html.markdown
@@ -32,7 +32,7 @@ resource "aws_macie2_findings_filter" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `finding_criteria` - (Required) The criteria to use to filter findings.
 * `name` - (Optional) A custom name for the filter. The name must contain at least 3 characters and can contain as many as 64 characters. If omitted, Terraform will assign a random, unique name. Conflicts with `name_prefix`.
@@ -57,17 +57,26 @@ The `criterion` object supports the following:
 * `gt` - (Optional) The value for the property is greater than the specified value.
 * `gte` - (Optional) The value for the property is greater than or equal to the specified value.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The unique identifier (ID) of the macie Findings Filter.
 * `arn` - The Amazon Resource Name (ARN) of the Findings Filter.
 
 ## Import
 
-`aws_macie2_findings_filter` can be imported using the id, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_macie2_findings_filter` using the id. For example:
 
+```terraform
+import {
+  to = aws_macie2_findings_filter.example
+  id = "abcd1"
+}
 ```
-$ terraform import aws_macie2_findings_filter.example abcd1
+
+Using `terraform import`, import `aws_macie2_findings_filter` using the id. For example:
+
+```console
+% terraform import aws_macie2_findings_filter.example abcd1
 ```
diff --git a/website/docs/r/macie2_invitation_accepter.html.markdown b/website/docs/r/macie2_invitation_accepter.html.markdown
index 36067c255cb..d3f76522dd7 100644
--- a/website/docs/r/macie2_invitation_accepter.html.markdown
+++ b/website/docs/r/macie2_invitation_accepter.html.markdown
@@ -36,21 +36,30 @@ resource "aws_macie2_invitation_accepter" "member" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `administrator_account_id` - (Required) The AWS account ID for the account that sent the invitation.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The unique identifier (ID) of the macie invitation accepter.
 * `invitation_id` - The unique identifier for the invitation.
 
 ## Import
 
-`aws_macie2_invitation_accepter` can be imported using the admin account ID, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_macie2_invitation_accepter` using the admin account ID. For example:
 
+```terraform
+import {
+  to = aws_macie2_invitation_accepter.example
+  id = "123456789012"
+}
 ```
-$ terraform import aws_macie2_invitation_accepter.example 123456789012
+
+Using `terraform import`, import `aws_macie2_invitation_accepter` using the admin account ID. For example:
+
+```console
+% terraform import aws_macie2_invitation_accepter.example 123456789012
 ```
diff --git a/website/docs/r/macie2_member.html.markdown b/website/docs/r/macie2_member.html.markdown
index c7758e37a15..44c820d476b 100644
--- a/website/docs/r/macie2_member.html.markdown
+++ b/website/docs/r/macie2_member.html.markdown
@@ -27,7 +27,7 @@ resource "aws_macie2_member" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `account_id` - (Required) The AWS account ID for the account.
 * `email` - (Required) The email address for the account.
@@ -37,9 +37,9 @@ The following arguments are supported:
 * `invitation_message` - (Optional) A custom message to include in the invitation. Amazon Macie adds this message to the standard content that it sends for an invitation.
 * `invitation_disable_email_notification` - (Optional) Specifies whether to send an email notification to the root user of each account that the invitation will be sent to. This notification is in addition to an alert that the root user receives in AWS Personal Health Dashboard. To send an email notification to the root user of each account, set this value to `true`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The unique identifier (ID) of the macie Member.
 * `arn` - The Amazon Resource Name (ARN) of the account.
@@ -50,8 +50,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_macie2_member` can be imported using the account ID of the member account, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_macie2_member` using the account ID of the member account. For example:
 
+```terraform
+import {
+  to = aws_macie2_member.example
+  id = "123456789012"
+}
 ```
-$ terraform import aws_macie2_member.example 123456789012
+
+Using `terraform import`, import `aws_macie2_member` using the account ID of the member account. For example:
+
+```console
+% terraform import aws_macie2_member.example 123456789012
 ```
diff --git a/website/docs/r/macie2_organization_admin_account.html.markdown b/website/docs/r/macie2_organization_admin_account.html.markdown
index 36421f8cb53..a8df36289a2 100644
--- a/website/docs/r/macie2_organization_admin_account.html.markdown
+++ b/website/docs/r/macie2_organization_admin_account.html.markdown
@@ -23,20 +23,29 @@ resource "aws_macie2_organization_admin_account" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `admin_account_id` - (Required) The AWS account ID for the account to designate as the delegated Amazon Macie administrator account for the organization.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The unique identifier (ID) of the macie organization admin account.
 
 ## Import
 
-`aws_macie2_organization_admin_account` can be imported using the id, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_macie2_organization_admin_account` using the id. For example:
 
+```terraform
+import {
+  to = aws_macie2_organization_admin_account.example
+  id = "abcd1"
+}
 ```
-$ terraform import aws_macie2_organization_admin_account.example abcd1
+
+Using `terraform import`, import `aws_macie2_organization_admin_account` using the id. For example:
+
+```console
+% terraform import aws_macie2_organization_admin_account.example abcd1
 ```
diff --git a/website/docs/r/main_route_table_association.html.markdown b/website/docs/r/main_route_table_association.html.markdown
index 75e5ba796fc..b8447211f26 100644
--- a/website/docs/r/main_route_table_association.html.markdown
+++ b/website/docs/r/main_route_table_association.html.markdown
@@ -24,15 +24,15 @@ resource "aws_main_route_table_association" "a" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `vpc_id` - (Required) The ID of the VPC whose main route table should be set
 * `route_table_id` - (Required) The ID of the Route Table to set as the new
   main route table for the target VPC
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the Route Table Association
 * `original_route_table_id` - Used internally, see __Notes__ below
diff --git a/website/docs/r/media_convert_queue.html.markdown b/website/docs/r/media_convert_queue.html.markdown
index 686b9aec728..6ac7758275a 100644
--- a/website/docs/r/media_convert_queue.html.markdown
+++ b/website/docs/r/media_convert_queue.html.markdown
@@ -20,7 +20,7 @@ resource "aws_media_convert_queue" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) A unique identifier describing the queue
 * `description` - (Optional) A description of the queue
@@ -37,9 +37,9 @@ The following arguments are supported:
 * `renewal_type` - (Required) Specifies whether the term of your reserved queue pricing plan. Valid values are `AUTO_RENEW` or `EXPIRE`.
 * `reserved_slots` - (Required) Specifies the number of reserved transcode slots (RTS) for queue.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The same as `name`
 * `arn` - The Arn of the queue
@@ -47,8 +47,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Media Convert Queue can be imported via the queue name, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Media Convert Queue using the queue name. For example:
 
+```terraform
+import {
+  to = aws_media_convert_queue.test
+  id = "tf-test-queue"
+}
 ```
-$ terraform import aws_media_convert_queue.test tf-test-queue
+
+Using `terraform import`, import Media Convert Queue using the queue name. For example:
+
+```console
+% terraform import aws_media_convert_queue.test tf-test-queue
 ```
diff --git a/website/docs/r/media_package_channel.html.markdown b/website/docs/r/media_package_channel.html.markdown
index 0a408a46476..0b405cdc5ed 100644
--- a/website/docs/r/media_package_channel.html.markdown
+++ b/website/docs/r/media_package_channel.html.markdown
@@ -21,15 +21,15 @@ resource "aws_media_package_channel" "kittens" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `channel_id` - (Required) A unique identifier describing the channel
 * `description` - (Optional) A description of the channel
 * `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The same as `channel_id`
 * `arn` - The ARN of the channel
@@ -42,8 +42,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Media Package Channels can be imported via the channel ID, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Media Package Channels using the channel ID. For example:
 
+```terraform
+import {
+  to = aws_media_package_channel.kittens
+  id = "kittens-channel"
+}
 ```
-$ terraform import aws_media_package_channel.kittens kittens-channel
+
+Using `terraform import`, import Media Package Channels using the channel ID. For example:
+
+```console
+% terraform import aws_media_package_channel.kittens kittens-channel
 ```
diff --git a/website/docs/r/media_store_container.html.markdown b/website/docs/r/media_store_container.html.markdown
index fe83c2ed375..32769b9f149 100644
--- a/website/docs/r/media_store_container.html.markdown
+++ b/website/docs/r/media_store_container.html.markdown
@@ -20,14 +20,14 @@ resource "aws_media_store_container" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The name of the container. Must contain alphanumeric characters or underscores.
 * `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The ARN of the container.
 * `endpoint` - The DNS endpoint of the container.
@@ -35,8 +35,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-MediaStore Container can be imported using the MediaStore Container Name, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import MediaStore Container using the MediaStore Container Name. For example:
 
+```terraform
+import {
+  to = aws_media_store_container.example
+  id = "example"
+}
 ```
-$ terraform import aws_media_store_container.example example
+
+Using `terraform import`, import MediaStore Container using the MediaStore Container Name. For example:
+
+```console
+% terraform import aws_media_store_container.example example
 ```
diff --git a/website/docs/r/media_store_container_policy.html.markdown b/website/docs/r/media_store_container_policy.html.markdown
index 559155ce4ce..29477d348f9 100644
--- a/website/docs/r/media_store_container_policy.html.markdown
+++ b/website/docs/r/media_store_container_policy.html.markdown
@@ -50,19 +50,28 @@ resource "aws_media_store_container_policy" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `container_name` - (Required) The name of the container.
 * `policy` - (Required) The contents of the policy. For more information about building AWS IAM policy documents with Terraform, see the [AWS IAM Policy Document Guide](https://learn.hashicorp.com/terraform/aws/iam-policy).
 
-## Attributes Reference
+## Attribute Reference
 
-No additional attributes are exported.
+This resource exports no additional attributes.
 
 ## Import
 
-MediaStore Container Policy can be imported using the MediaStore Container Name, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import MediaStore Container Policy using the MediaStore Container Name. For example:
 
+```terraform
+import {
+  to = aws_media_store_container_policy.example
+  id = "example"
+}
 ```
-$ terraform import aws_media_store_container_policy.example example
+
+Using `terraform import`, import MediaStore Container Policy using the MediaStore Container Name. For example:
+
+```console
+% terraform import aws_media_store_container_policy.example example
 ```
diff --git a/website/docs/r/medialive_channel.html.markdown b/website/docs/r/medialive_channel.html.markdown
index 1264f82e1cc..6da154dbbdc 100644
--- a/website/docs/r/medialive_channel.html.markdown
+++ b/website/docs/r/medialive_channel.html.markdown
@@ -109,7 +109,7 @@ The following arguments are optional:
 * `role_arn` - (Optional) Concise argument description.
 * `start_channel` - (Optional) Whether to start/stop channel. Default: `false`
 * `tags` - (Optional) A map of tags to assign to the channel. If configured with a provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
-* `vpc` - (Optional) Settings for the VPC outputs.
+* `vpc` - (Optional) Settings for the VPC outputs. See [VPC](#vpc) for more details.
 
 ### CDI Input Specification
 
@@ -128,13 +128,18 @@ The following arguments are optional:
 * `output_groups` - (Required) Output groups for the channel. See [Output Groups](#output-groups) for more details.
 * `timecode_config` - (Required) Contains settings used to acquire and adjust timecode information from inputs. See [Timecode Config](#timecode-config) for more details.
 * `video_descriptions` - (Required) Video Descriptions. See [Video Descriptions](#video-descriptions) for more details.
+* `caption_descriptions` - (Optional) Caption Descriptions. See [Caption Descriptions](#caption-descriptions) for more details.
+* `global_configuration` - (Optional) Configuration settings that apply to the event as a whole. See [Global Configuration](#global-configuration) for more details.
+* `motion_graphics_configuration` - (Optional) Settings for motion graphics. See [Motion Graphics Configuration](#motion-graphics-configuration) for more details.
+* `nielsen_configuration` - (Optional) Nielsen configuration settings. See [Nielsen Configuration](#nielsen-configuration) for more details.
 * `avail_blanking` - (Optional) Settings for ad avail blanking. See [Avail Blanking](#avail-blanking) for more details.
 
 ### Input Attachments
 
 * `input_attachment_name` - (Optional) User-specified name for the attachment.
 * `input_id` - (Required) The ID of the input.
-* `input_settings` - (Optional) Settings of an input. See [Input Settings](#input-settings) for more details
+* `input_settings` - (Optional) Settings of an input. See [Input Settings](#input-settings) for more details.
+* `automatic_input_failover_settings` - (Optional) User-specified settings for defining what the conditions are for declaring the input unhealthy and failing over to a different input. See [Automatic Input Failover Settings](#automatic-input-failover-settings) for more details.
 
 ### Input Settings
 
@@ -152,11 +157,94 @@ The following arguments are optional:
 ### Audio Selectors
 
 * `name` - (Required) The name of the audio selector.
+* `selector_settings` - (Optional) The audio selector settings. See [Audio Selector Settings](#audio-selector-settings) for more details.
+
+### Audio Selector Settings
+
+* `audio_hls_rendition_selection` - (Optional) Audio HLS Rendition Selection. See [Audio HLS Rendition Selection](#audio-hls-rendition-selection) for more details.
+* `audio_language_selection` - (Optional) Audio Language Selection. See [Audio Language Selection](#audio-language-selection) for more details.
+* `audio_pid_selection` - (Optional) Audio Pid Selection. See [Audio PID Selection](#audio-pid-selection) for more details.
+* `audio_track_selection` - (Optional) Audio Track Selection. See [Audio Track Selection](#audio-track-selection) for more details.
+
+### Audio HLS Rendition Selection
+
+* `group_id` - (Required) Specifies the GROUP-ID in the #EXT-X-MEDIA tag of the target HLS audio rendition.
+* `name` - (Required) Specifies the NAME in the #EXT-X-MEDIA tag of the target HLS audio rendition.
+
+### Audio Language Selection
+
+* `language_code` - (Required) Selects a specific three-letter language code from within an audio source.
+* `language_selection_policy` - (Optional) When set to “strict”, the transport stream demux strictly identifies audio streams by their language descriptor. If a PMT update occurs such that an audio stream matching the initially selected language is no longer present then mute will be encoded until the language returns. If “loose”, then on a PMT update the demux will choose another audio stream in the program with the same stream type if it can’t find one with the same language.
+
+### Audio PID Selection
+
+* `pid` - (Required) Selects a specific PID from within a source.
+
+### Audio Track Selection
+
+* `tracks` - (Required) Selects one or more unique audio tracks from within a source. See [Audio Tracks](#audio-tracks) for more details.
+* `dolby_e_decode` - (Optional) Configure decoding options for Dolby E streams - these should be Dolby E frames carried in PCM streams tagged with SMPTE-337. See [Dolby E Decode](#dolby-e-decode) for more details.
+
+### Audio Tracks
+
+* `track` - (Required) 1-based integer value that maps to a specific audio track.
+
+### Dolby E Decode
+
+* `program_selection` - (Required) Applies only to Dolby E. Enter the program ID (according to the metadata in the audio) of the Dolby E program to extract from the specified track. One program extracted per audio selector. To select multiple programs, create multiple selectors with the same Track and different Program numbers. “All channels” means to ignore the program IDs and include all the channels in this selector; useful if metadata is known to be incorrect.
 
 ### Caption Selectors
 
 * `name` - (Optional) The name of the caption selector.
 * `language_code` - (Optional) When specified this field indicates the three letter language code of the caption track to extract from the source.
+* `selector_settings` - (Optional) Caption selector settings. See [Caption Selector Settings](#caption-selector-settings) for more details.
+
+### Caption Selector Settings
+
+* `ancillary_source_settings` - (Optional) Ancillary Source Settings. See [Ancillary Source Settings](#ancillary-source-settings) for more details.
+* `arib_source_settings` - (Optional) ARIB Source Settings.
+* `dvb_sub_source_settings` - (Optional) DVB Sub Source Settings. See [DVB Sub Source Settings](#dvb-sub-source-settings) for more details.
+* `embedded_source_settings` - (Optional) Embedded Source Settings. See [Embedded Source Settings](#embedded-source-settings) for more details.
+* `scte20_source_settings` - (Optional) SCTE20 Source Settings. See [SCTE 20 Source Settings](#scte-20-source-settings) for more details.
+* `scte27_source_settings` - (Optional) SCTE27 Source Settings. See [SCTE 27 Source Settings](#scte-27-source-settings) for more details.
+* `teletext_source_settings` - (Optional) Teletext Source Settings. See [Teletext Source Settings](#teletext-source-settings) for more details.
+
+### Ancillary Source Settings
+
+* `source_ancillary_channel_number` - (Optional) Specifies the number (1 to 4) of the captions channel you want to extract from the ancillary captions. If you plan to convert the ancillary captions to another format, complete this field. If you plan to choose Embedded as the captions destination in the output (to pass through all the channels in the ancillary captions), leave this field blank because MediaLive ignores the field.
+
+### DVB Sub Source Settings
+
+* `ocr_language` - (Optional) If you will configure a WebVTT caption description that references this caption selector, use this field to provide the language to consider when translating the image-based source to text.
+* `pid` - (Optional) When using DVB-Sub with Burn-In or SMPTE-TT, use this PID for the source content. Unused for DVB-Sub passthrough. All DVB-Sub content is passed through, regardless of selectors.
+
+### Embedded Source Settings
+
+* `convert_608_to_708` - (Optional) If upconvert, 608 data is both passed through via the “608 compatibility bytes” fields of the 708 wrapper as well as translated into 708. 708 data present in the source content will be discarded.
+* `scte20_detection` - (Optional) Set to “auto” to handle streams with intermittent and/or non-aligned SCTE-20 and Embedded captions.
+* `source_608_channel_number` - (Optional) Specifies the 608/708 channel number within the video track from which to extract captions. Unused for passthrough.
+
+### SCTE 20 Source Settings
+
+* `convert_608_to_708` – (Optional) If upconvert, 608 data is both passed through via the “608 compatibility bytes” fields of the 708 wrapper as well as translated into 708. 708 data present in the source content will be discarded.
+* `source_608_channel_number` - (Optional) Specifies the 608/708 channel number within the video track from which to extract captions. Unused for passthrough.
+
+### SCTE 27 Source Settings
+
+* `ocr_language` - (Optional) If you will configure a WebVTT caption description that references this caption selector, use this field to provide the language to consider when translating the image-based source to text.
+* `pid` - (Optional) The pid field is used in conjunction with the caption selector languageCode field as follows: - Specify PID and Language: Extracts captions from that PID; the language is "informational". - Specify PID and omit Language: Extracts the specified PID. - Omit PID and specify Language: Extracts the specified language, whichever PID that happens to be. - Omit PID and omit Language: Valid only if source is DVB-Sub that is being passed through; all languages will be passed through.
+
+### Teletext Source Settings
+
+* `output_rectangle` - (Optional) Optionally defines a region where TTML style captions will be displayed. See [Caption Rectangle](#caption-rectangle) for more details.
+* `page_number` - (Optional) Specifies the teletext page number within the data stream from which to extract captions. Range of 0x100 (256) to 0x8FF (2303). Unused for passthrough. Should be specified as a hexadecimal string with no “0x” prefix.
+
+### Caption Rectangle
+
+* `height` - (Required) See the description in left\_offset. For height, specify the entire height of the rectangle as a percentage of the underlying frame height. For example, "80" means the rectangle height is 80% of the underlying frame height. The top\_offset and rectangle\_height must add up to 100% or less. This field corresponds to tts:extent - Y in the TTML standard.
+* `left_offset` - (Required) Applies only if you plan to convert these source captions to EBU-TT-D or TTML in an output. (Make sure to leave the default if you don’t have either of these formats in the output.) You can define a display rectangle for the captions that is smaller than the underlying video frame. You define the rectangle by specifying the position of the left edge, top edge, bottom edge, and right edge of the rectangle, all within the underlying video frame. The units for the measurements are percentages. If you specify a value for one of these fields, you must specify a value for all of them. For leftOffset, specify the position of the left edge of the rectangle, as a percentage of the underlying frame width, and relative to the left edge of the frame. For example, "10" means the measurement is 10% of the underlying frame width. The rectangle left edge starts at that position from the left edge of the frame. This field corresponds to tts:origin - X in the TTML standard.
+* `top_offset` - (Required) See the description in left\_offset. For top\_offset, specify the position of the top edge of the rectangle, as a percentage of the underlying frame height, and relative to the top edge of the frame. For example, "10" means the measurement is 10% of the underlying frame height. The rectangle top edge starts at that position from the top edge of the frame. This field corresponds to tts:origin - Y in the TTML standard.
+* `width` - (Required) See the description in left\_offset. For width, specify the entire width of the rectangle as a percentage of the underlying frame width. For example, "80" means the rectangle width is 80% of the underlying frame width. The left\_offset and rectangle\_width must add up to 100% or less. This field corresponds to tts:extent - X in the TTML standard.
 
 ### Network Input Settings
 
@@ -171,6 +259,37 @@ The following arguments are optional:
 * `retry_interval` - (Optional) The number of seconds between retries when an attempt to read a manifest or segment fails.
 * `scte35_source_type` - (Optional) Identifies the source for the SCTE-35 messages that MediaLive will ingest.
 
+### Automatic Input Failover Settings
+
+* `secondary_input_id` - (Required) The input ID of the secondary input in the automatic input failover pair.
+* `error_clear_time_msec` - (Optional) This clear time defines the requirement a recovered input must meet to be considered healthy. The input must have no failover conditions for this length of time. Enter a time in milliseconds. This value is particularly important if the input\_preference for the failover pair is set to PRIMARY\_INPUT\_PREFERRED, because after this time, MediaLive will switch back to the primary input.
+* `failover_conditions` - (Optional) A list of failover conditions. If any of these conditions occur, MediaLive will perform a failover to the other input. See [Failover Conditions](#failover-conditions) for more details.
+* `input_preference` - (Optional) Input preference when deciding which input to make active when a previously failed input has recovered.
+
+### Failover Conditions
+
+* `failover_condition_settings` - (Optional) Failover condition type-specific settings. See [Failover Condition Settings](#failover-condition-settings) for more details.
+
+### Failover Condition Settings
+
+* `audio_silence_settings` - (Optional) MediaLive will perform a failover if the specified audio selector is silent for the specified period. See [Audio Silence Failover Settings](#audio-silence-failover-settings) for more details.
+* `input_loss_settings` - (Optional) MediaLive will perform a failover if content is not detected in this input for the specified period. See [Input Loss Failover Settings](#input-loss-failover-settings) for more details.
+* `video_black_settings` - (Optional) MediaLive will perform a failover if content is considered black for the specified period. See [Video Black Failover Settings](#video-black-failover-settings) for more details.
+
+### Audio Silence Failover Settings
+
+* `audio_selector_name` - (Required) The name of the audio selector in the input that MediaLive should monitor to detect silence. Select your most important rendition. If you didn't create an audio selector in this input, leave blank.
+* `audio_silence_threshold_msec` - (Optional) The amount of time (in milliseconds) that the active input must be silent before automatic input failover occurs. Silence is defined as audio loss or audio quieter than -50 dBFS.
+
+### Input Loss Failover Settings
+
+* `input_loss_threshold_msec` - (Optional) The amount of time (in milliseconds) that no input is detected. After that time, an input failover will occur.
+
+### Video Black Failover Settings
+
+* `black_detect_threshold` - (Optional) A value used in calculating the threshold below which MediaLive considers a pixel to be 'black'. For the input to be considered black, every pixel in a frame must be below this threshold. The threshold is calculated as a percentage (expressed as a decimal) of white. Therefore .1 means 10% white (or 90% black). Note how the formula works for any color depth. For example, if you set this field to 0.1 in 10-bit color depth: (10230.1=102.3), which means a pixel value of 102 or less is 'black'. If you set this field to .1 in an 8-bit color depth: (2550.1=25.5), which means a pixel value of 25 or less is 'black'. The range is 0.0 to 1.0, with any number of decimal places.
+* `video_black_threshold_msec` - (Optional) The amount of time (in milliseconds) that the active input must be black before automatic input failover occurs.
+
 ### Maintenance
 
 * `maintenance_day` - (Optional) The day of the week to use for maintenance.
@@ -244,7 +363,7 @@ The following arguments are optional:
 ### EAC3 Atmos Settings
 
 * `bitrate` - (Optional) Average bitrate in bits/second.
-* `coding_mode` - (Optional) Dolby Digital Plus with dolby Atmos coding mode.
+* `coding_mode` - (Optional) Dolby Digital Plus with Dolby Atmos coding mode.
 * `dialnorm` - (Optional) Sets the dialnorm for the output.
 * `drc_line` - (Optional) Sets the Dolby dynamic range compression profile.
 * `drc_rf` - (Optional) Sets the profile for heavy Dolby dynamic range compression.
@@ -400,7 +519,7 @@ The following arguments are optional:
 * `slices` - (Optional) Number of slices per picture.
 * `tier` - (Optional) Set the H265 tier in the output.
 * `timecode_burnin_settings` - (Optional) Apply a burned in timecode. See [H265 Timecode Burnin Settings](#h265-timecode-burnin-settings) for more details.
-* `timecode_insertion` = (Optional) Determines how timecodes should be inserted into the video elementary stream.
+* `timecode_insertion` - (Optional) Determines how timecodes should be inserted into the video elementary stream.
 
 ### H265 Color Space Settings
 
@@ -430,6 +549,121 @@ The following arguments are optional:
 * `post_filter_sharpening` - (Optional) Post filter sharpening.
 * `strength` - (Optional) Filter strength.
 
+### Caption Descriptions
+
+* `accessibility` - (Optional) Indicates whether the caption track implements accessibility features such as written descriptions of spoken dialog, music, and sounds.
+* `caption_selector_name` - (Required) Specifies which input caption selector to use as a caption source when generating output captions. This field should match a captionSelector name.
+* `destination_settings` - (Optional) Additional settings for captions destination that depend on the destination type. See [Destination Settings](#destination-settings) for more details.
+* `language_code` - (Optional) ISO 639-2 three-digit code.
+* `language_description` - (Optional) Human readable information to indicate captions available for players (eg. English, or Spanish).
+* `name` - (Required) Name of the caption description. Used to associate a caption description with an output. Names must be unique within an event.
+
+### Destination Settings
+
+* `arib_destination_settings` - (Optional) ARIB Destination Settings.
+* `burn_in_destination_settings` - (Optional) Burn In Destination Settings. See [Burn In Destination Settings](#burn-in-destination-settings) for more details.
+* `dvb_sub_destination_settings` - (Optional) DVB Sub Destination Settings. See [DVB Sub Destination Settings](#dvb-sub-destination-settings) for more details.
+* `ebu_tt_d_destination_settings` - (Optional) EBU TT D Destination Settings. See [EBU TT D Destination Settings](#ebu-tt-d-destination-settings) for more details.
+* `embedded_destination_settings` - (Optional) Embedded Destination Settings.
+* `embedded_plus_scte20_destination_settings` - (Optional) Embedded Plus SCTE20 Destination Settings.
+* `rtmp_caption_info_destination_settings` - (Optional) RTMP Caption Info Destination Settings.
+* `scte20_plus_embedded_destination_settings` - (Optional) SCTE20 Plus Embedded Destination Settings.
+* `scte27_destination_settings` – (Optional) SCTE27 Destination Settings.
+* `smpte_tt_destination_settings` – (Optional) SMPTE TT Destination Settings.
+* `teletext_destination_settings` – (Optional) Teletext Destination Settings.
+* `ttml_destination_settings` – (Optional) TTML Destination Settings. See [TTML Destination Settings](#ttml-destination-settings) for more details.
+* `webvtt_destination_settings` - (Optional) WebVTT Destination Settings. See [WebVTT Destination Settings](#webvtt-destination-settings) for more details.
+
+### Burn In Destination Settings
+
+* `alignment` – (Optional) If no explicit xPosition or yPosition is provided, setting alignment to centered will place the captions at the bottom center of the output. Similarly, setting a left alignment will align captions to the bottom left of the output. If x and y positions are given in conjunction with the alignment parameter, the font will be justified (either left or centered) relative to those coordinates. Selecting “smart” justification will left-justify live subtitles and center-justify pre-recorded subtitles. All burn-in and DVB-Sub font settings must match.
+* `background_color` – (Optional) Specifies the color of the rectangle behind the captions. All burn-in and DVB-Sub font settings must match.
+* `background_opacity` – (Optional) Specifies the opacity of the background rectangle. 255 is opaque; 0 is transparent. Leaving this parameter out is equivalent to setting it to 0 (transparent). All burn-in and DVB-Sub font settings must match.
+* `font` – (Optional) External font file used for caption burn-in. File extension must be ‘ttf’ or ‘tte’. Although the user can select output fonts for many different types of input captions, embedded, STL and teletext sources use a strict grid system. Using external fonts with these caption sources could cause unexpected display of proportional fonts. All burn-in and DVB-Sub font settings must match. See [Font](#font) for more details.
+* `font_color` – (Optional) Specifies the color of the burned-in captions. This option is not valid for source captions that are STL, 608/embedded or teletext. These source settings are already pre-defined by the caption stream. All burn-in and DVB-Sub font settings must match.
+* `font_opacity` – (Optional) Specifies the opacity of the burned-in captions. 255 is opaque; 0 is transparent. All burn-in and DVB-Sub font settings must match.
+* `font_resolution` – (Optional) Font resolution in DPI (dots per inch); default is 96 dpi. All burn-in and DVB-Sub font settings must match.
+* `font_size` – (Optional) When set to ‘auto’ fontSize will scale depending on the size of the output. Giving a positive integer will specify the exact font size in points. All burn-in and DVB-Sub font settings must match.
+* `outline_color` – (Optional) Specifies font outline color. This option is not valid for source captions that are either 608/embedded or teletext. These source settings are already pre-defined by the caption stream. All burn-in and DVB-Sub font settings must match.
+* `outline_size` – (Optional) Specifies font outline size in pixels. This option is not valid for source captions that are either 608/embedded or teletext. These source settings are already pre-defined by the caption stream. All burn-in and DVB-Sub font settings must match.
+* `shadow_color` – (Optional) Specifies the color of the shadow cast by the captions. All burn-in and DVB-Sub font settings must match.
+* `shadow_opacity` – (Optional) Specifies the opacity of the shadow. 255 is opaque; 0 is transparent. Leaving this parameter out is equivalent to setting it to 0 (transparent). All burn-in and DVB-Sub font settings must match.
+* `shadow_x_offset` – (Optional) Specifies the horizontal offset of the shadow relative to the captions in pixels. A value of -2 would result in a shadow offset 2 pixels to the left. All burn-in and DVB-Sub font settings must match.
+* `shadow_y_offset` – (Optional) Specifies the vertical offset of the shadow relative to the captions in pixels. A value of -2 would result in a shadow offset 2 pixels above the text. All burn-in and DVB-Sub font settings must match.
+* `teletext_grid_control` – (Optional) Controls whether a fixed grid size will be used to generate the output subtitles bitmap. Only applicable for Teletext inputs and DVB-Sub/Burn-in outputs.
+* `x_position` – (Optional) Specifies the horizontal position of the caption relative to the left side of the output in pixels. A value of 10 would result in the captions starting 10 pixels from the left of the output. If no explicit xPosition is provided, the horizontal caption position will be determined by the alignment parameter. All burn-in and DVB-Sub font settings must match.
+* `y_position` – (Optional) Specifies the vertical position of the caption relative to the top of the output in pixels. A value of 10 would result in the captions starting 10 pixels from the top of the output. If no explicit yPosition is provided, the caption will be positioned towards the bottom of the output. All burn-in and DVB-Sub font settings must match.
+
+### DVB Sub Destination Settings
+
+* `alignment` – (Optional) If no explicit xPosition or yPosition is provided, setting alignment to centered will place the captions at the bottom center of the output. Similarly, setting a left alignment will align captions to the bottom left of the output. If x and y positions are given in conjunction with the alignment parameter, the font will be justified (either left or centered) relative to those coordinates. Selecting “smart” justification will left-justify live subtitles and center-justify pre-recorded subtitles. This option is not valid for source captions that are STL or 608/embedded. These source settings are already pre-defined by the caption stream. All burn-in and DVB-Sub font settings must match.
+* `background_color` – (Optional) Specifies the color of the rectangle behind the captions. All burn-in and DVB-Sub font settings must match.
+* `background_opacity` – (Optional) Specifies the opacity of the background rectangle. 255 is opaque; 0 is transparent. Leaving this parameter blank is equivalent to setting it to 0 (transparent). All burn-in and DVB-Sub font settings must match.
+* `font` – (Optional) External font file used for caption burn-in. File extension must be ‘ttf’ or ‘tte’. Although the user can select output fonts for many different types of input captions, embedded, STL and teletext sources use a strict grid system. Using external fonts with these caption sources could cause unexpected display of proportional fonts. All burn-in and DVB-Sub font settings must match. See [Font](#font) for more details.
+* `font_color` – (Optional) Specifies the color of the burned-in captions. This option is not valid for source captions that are STL, 608/embedded or teletext. These source settings are already pre-defined by the caption stream. All burn-in and DVB-Sub font settings must match.
+* `font_opacity` – (Optional) Specifies the opacity of the burned-in captions. 255 is opaque; 0 is transparent. All burn-in and DVB-Sub font settings must match.
+* `font_resolution` – (Optional) Font resolution in DPI (dots per inch); default is 96 dpi. All burn-in and DVB-Sub font settings must match.
+* `font_size` – (Optional) When set to auto fontSize will scale depending on the size of the output. Giving a positive integer will specify the exact font size in points. All burn-in and DVB-Sub font settings must match.
+* `outline_color` – (Optional) Specifies font outline color. This option is not valid for source captions that are either 608/embedded or teletext. These source settings are already pre-defined by the caption stream. All burn-in and DVB-Sub font settings must match.
+* `outline_size` – (Optional) Specifies font outline size in pixels. This option is not valid for source captions that are either 608/embedded or teletext. These source settings are already pre-defined by the caption stream. All burn-in and DVB-Sub font settings must match.
+* `shadow_color` – (Optional) Specifies the color of the shadow cast by the captions. All burn-in and DVB-Sub font settings must match.
+* `shadow_opacity` – (Optional) Specifies the opacity of the shadow. 255 is opaque; 0 is transparent. Leaving this parameter blank is equivalent to setting it to 0 (transparent). All burn-in and DVB-Sub font settings must match.
+* `shadow_x_offset` – (Optional) Specifies the horizontal offset of the shadow relative to the captions in pixels. A value of -2 would result in a shadow offset 2 pixels to the left. All burn-in and DVB-Sub font settings must match.
+* `shadow_y_offset` – (Optional) Specifies the vertical offset of the shadow relative to the captions in pixels. A value of -2 would result in a shadow offset 2 pixels above the text. All burn-in and DVB-Sub font settings must match.
+* `teletext_grid_control` – (Optional) Controls whether a fixed grid size will be used to generate the output subtitles bitmap. Only applicable for Teletext inputs and DVB-Sub/Burn-in outputs.
+* `x_position` – (Optional) Specifies the horizontal position of the caption relative to the left side of the output in pixels. A value of 10 would result in the captions starting 10 pixels from the left of the output. If no explicit xPosition is provided, the horizontal caption position will be determined by the alignment parameter. This option is not valid for source captions that are STL, 608/embedded or teletext. These source settings are already pre-defined by the caption stream. All burn-in and DVB-Sub font settings must match.
+* `y_position` – (Optional) Specifies the vertical position of the caption relative to the top of the output in pixels. A value of 10 would result in the captions starting 10 pixels from the top of the output. If no explicit yPosition is provided, the caption will be positioned towards the bottom of the output. This option is not valid for source captions that are STL, 608/embedded or teletext. These source settings are already pre-defined by the caption stream. All burn-in and DVB-Sub font settings must match.
+
+### EBU TT D Destination Settings
+
+* `copyright_holder` – (Optional) Complete this field if you want to include the name of the copyright holder in the copyright tag in the captions metadata.
+* `fill_line_gap` – (Optional) Specifies how to handle the gap between the lines (in multi-line captions). - enabled: Fill with the captions background color (as specified in the input captions). - disabled: Leave the gap unfilled.
+* `font_family` – (Optional) Specifies the font family to include in the font data attached to the EBU-TT captions. Valid only if styleControl is set to include. If you leave this field empty, the font family is set to “monospaced”. (If styleControl is set to exclude, the font family is always set to “monospaced”.) You specify only the font family. All other style information (color, bold, position and so on) is copied from the input captions. The size is always set to 100% to allow the downstream player to choose the size. - Enter a list of font families, as a comma-separated list of font names, in order of preference. The name can be a font family (such as “Arial”), or a generic font family (such as “serif”), or “default” (to let the downstream player choose the font). - Leave blank to set the family to “monospace”.
+* `style_control` – (Optional) Specifies the style information (font color, font position, and so on) to include in the font data that is attached to the EBU-TT captions. - include: Take the style information (font color, font position, and so on) from the source captions and include that information in the font data attached to the EBU-TT captions. This option is valid only if the source captions are Embedded or Teletext. - exclude: In the font data attached to the EBU-TT captions, set the font family to “monospaced”. Do not include any other style information.
+
+### TTML Destination Settings
+
+* `style_control` – (Optional) This field is not currently supported and will not affect the output styling. Leave the default value.
+
+### WebVTT Destination Settings
+
+* `style_control` - (Optional) Controls whether the color and position of the source captions is passed through to the WebVTT output captions. PASSTHROUGH - Valid only if the source captions are EMBEDDED or TELETEXT. NO\_STYLE\_DATA - Don’t pass through the style. The output captions will not contain any font styling information.
+
+### Font
+
+* `password_param` – (Optional) Key used to extract the password from EC2 Parameter store.
+* `uri` – (Required) Path to a file accessible to the live stream.
+* `username` – (Optional) Username to be used.
+
+### Global Configuration
+
+* `initial_audio_gain` – (Optional) Value to set the initial audio gain for the Live Event.
+* `input_end_action` – (Optional) Indicates the action to take when the current input completes (e.g. end-of-file). When switchAndLoopInputs is configured the encoder will restart at the beginning of the first input. When “none” is configured the encoder will transcode either black, a solid color, or a user specified slate images per the “Input Loss Behavior” configuration until the next input switch occurs (which is controlled through the Channel Schedule API).
+* `input_loss_behavior` - (Optional) Settings for system actions when input is lost. See [Input Loss Behavior](#input-loss-behavior) for more details.
+* `output_locking_mode` – (Optional) Indicates how MediaLive pipelines are synchronized. PIPELINE\_LOCKING - MediaLive will attempt to synchronize the output of each pipeline to the other. EPOCH\_LOCKING - MediaLive will attempt to synchronize the output of each pipeline to the Unix epoch.
+* `output_timing_source` – (Optional) Indicates whether the rate of frames emitted by the Live encoder should be paced by its system clock (which optionally may be locked to another source via NTP) or should be locked to the clock of the source that is providing the input stream.
+* `support_low_framerate_inputs` – (Optional) Adjusts video input buffer for streams with very low video framerates. This is commonly set to enabled for music channels with less than one video frame per second.
+
+### Input Loss Behavior
+
+* `password_param` – (Optional) Key used to extract the password from EC2 Parameter store.
+* `uri` – (Required) Path to a file accessible to the live stream.
+* `username` – (Optional) Username to be used.
+
+### Motion Graphics Configuration
+
+* `motion_graphics_insertion` – (Optional) Motion Graphics Insertion.
+* `motion_graphics_settings`– (Required) Motion Graphics Settings. See [Motion Graphics Settings](#motion-graphics-settings) for more details.
+
+### Motion Graphics Settings
+
+* `html_motion_graphics_settings` – (Optional) Html Motion Graphics Settings.
+
+### Nielsen Configuration
+
+* `distributor_id` – (Optional) Enter the Distributor ID assigned to your organization by Nielsen.
+* `nielsen_pcm_to_id3_tagging` – (Optional) Enables Nielsen PCM to ID3 tagging.
+
 ### Avail Blanking
 
 * `avail_blanking_image` - (Optional) Blanking image to be used. See [Avail Blanking Image](#avail-blanking-image) for more details.
@@ -485,7 +719,7 @@ The following arguments are optional:
 * `media_package_output_settings` - (Optional) Media package output settings. This can be set as an empty block.
 * `multiplex_output_settings` - (Optional) Multiplex output settings. See [Multiplex Output Settings](#multiplex-output-settings) for more details.
 * `rtmp_output_settings` - (Optional) RTMP output settings. See [RTMP Output Settings](#rtmp-output-settings) for more details.
-* `udp_output_settings` - (Optional) UDP output settings. See [UDP Output Settings](#udp-output-settings) for more details
+* `udp_output_settings` - (Optional) UDP output settings. See [UDP Output Settings](#udp-output-settings) for more details.
 
 ### Archive Output Settings
 
@@ -506,7 +740,7 @@ The following arguments are optional:
 
 ### Container Settings
 
-* `m2ts_settings` - (Optional) M2ts Settings. See [M2ts Settings](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-medialive-channel-m2tssettings.html) for more details.
+* `m2ts_settings` - (Optional) M2TS Settings. See [M2TS Settings](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-medialive-channel-m2tssettings.html) for more details.
 * `raw_settings`- (Optional) Raw Settings. This can be set as an empty block.
 
 ### UDP Output Settings
@@ -522,9 +756,15 @@ The following arguments are optional:
 * `include_fec` - (Optional) Enables column only or column and row based FEC.
 * `row_length` - (Optional) The width of the FEC protection matrix.
 
-## Attributes Reference
+### VPC
 
-In addition to all arguments above, the following attributes are exported:
+* `subnet_ids` - (Required) A list of VPC subnet IDs from the same VPC. If STANDARD channel, subnet IDs must be mapped to two unique availability zones (AZ).
+* `public_address_allocation_ids` - (Required) List of public address allocation ids to associate with ENIs that will be created in Output VPC. Must specify one for SINGLE_PIPELINE, two for STANDARD channels.
+* `security_group_ids` - (Optional) A list of up to 5 EC2 VPC security group IDs to attach to the Output VPC network interfaces. If none are specified then the VPC default security group will be used.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the Channel.
 * `channel_id` - ID of the Channel.
@@ -539,8 +779,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-MediaLive Channel can be imported using the `channel_id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import MediaLive Channel using the `channel_id`. For example:
 
+```terraform
+import {
+  to = aws_medialive_channel.example
+  id = "1234567"
+}
 ```
-$ terraform import aws_medialive_channel.example 1234567
+
+Using `terraform import`, import MediaLive Channel using the `channel_id`. For example:
+
+```console
+% terraform import aws_medialive_channel.example 1234567
 ```
diff --git a/website/docs/r/medialive_input.html.markdown b/website/docs/r/medialive_input.html.markdown
index efcddad3e03..b3fbb8010bc 100644
--- a/website/docs/r/medialive_input.html.markdown
+++ b/website/docs/r/medialive_input.html.markdown
@@ -77,9 +77,9 @@ The following arguments are optional:
 * `subnet_ids` - A list of 2 VPC subnet IDs from the same VPC.
 * `security_group_ids` - A list of up to 5 EC2 VPC security group IDs to attach to the Input.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the Input.
 * `attached_channels` - Channels attached to Input.
@@ -97,8 +97,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-MediaLive Input can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import MediaLive Input using the `id`. For example:
 
+```terraform
+import {
+  to = aws_medialive_input.example
+  id = "12345678"
+}
 ```
-$ terraform import aws_medialive_input.example 12345678
+
+Using `terraform import`, import MediaLive Input using the `id`. For example:
+
+```console
+% terraform import aws_medialive_input.example 12345678
 ```
diff --git a/website/docs/r/medialive_input_security_group.html.markdown b/website/docs/r/medialive_input_security_group.html.markdown
index 08b09143115..ca10b199054 100644
--- a/website/docs/r/medialive_input_security_group.html.markdown
+++ b/website/docs/r/medialive_input_security_group.html.markdown
@@ -40,9 +40,9 @@ The following arguments are optional:
 
 * `cidr` (Required) - The IPv4 CIDR that's whitelisted.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - InputSecurityGroup Id.
 * `arn` - ARN of the InputSecurityGroup.
@@ -58,8 +58,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-MediaLive InputSecurityGroup can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import MediaLive InputSecurityGroup using the `id`. For example:
 
+```terraform
+import {
+  to = aws_medialive_input_security_group.example
+  id = "123456"
+}
 ```
-$ terraform import aws_medialive_input_security_group.example 123456
+
+Using `terraform import`, import MediaLive InputSecurityGroup using the `id`. For example:
+
+```console
+% terraform import aws_medialive_input_security_group.example 123456
 ```
diff --git a/website/docs/r/medialive_multiplex.html.markdown b/website/docs/r/medialive_multiplex.html.markdown
index b2108bf79ff..cb2399bfcbb 100644
--- a/website/docs/r/medialive_multiplex.html.markdown
+++ b/website/docs/r/medialive_multiplex.html.markdown
@@ -58,9 +58,9 @@ The following arguments are optional:
 * `transport_stream_reserved_bitrate` - (Optional) Transport stream reserved bit rate.
 * `maximum_video_buffer_delay_milliseconds` - (Optional) Maximum video buffer delay.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the Multiplex.
 
@@ -74,8 +74,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-MediaLive Multiplex can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import MediaLive Multiplex using the `id`. For example:
 
+```terraform
+import {
+  to = aws_medialive_multiplex.example
+  id = "12345678"
+}
 ```
-$ terraform import aws_medialive_multiplex.example 12345678
+
+Using `terraform import`, import MediaLive Multiplex using the `id`. For example:
+
+```console
+% terraform import aws_medialive_multiplex.example 12345678
 ```
diff --git a/website/docs/r/medialive_multiplex_program.html.markdown b/website/docs/r/medialive_multiplex_program.html.markdown
index b1c1691de2a..0992de2ca6e 100644
--- a/website/docs/r/medialive_multiplex_program.html.markdown
+++ b/website/docs/r/medialive_multiplex_program.html.markdown
@@ -85,17 +85,26 @@ The following arguments are optional:
 * `maximum_bitrate` - (Optional) Maximum bitrate.
 * `priority` - (Optional) Priority value.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - ID of the MultiplexProgram.
 * `example_attribute` - Concise description.
 
 ## Import
 
-MediaLive MultiplexProgram can be imported using the `id`, or a combination of "`program_name`/`multiplex_id`" e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import MediaLive MultiplexProgram using the `id`, or a combination of "`program_name`/`multiplex_id`". For example:
 
+```terraform
+import {
+  to = aws_medialive_multiplex_program.example
+  id = "example_program/1234567"
+}
 ```
-$ terraform import aws_medialive_multiplex_program.example example_program/1234567
+
+Using `terraform import`, import MediaLive MultiplexProgram using the `id`, or a combination of "`program_name`/`multiplex_id`". For example:
+
+```console
+% terraform import aws_medialive_multiplex_program.example example_program/1234567
 ```
diff --git a/website/docs/r/memorydb_acl.html.markdown b/website/docs/r/memorydb_acl.html.markdown
index 2d61a606aac..4907b332497 100644
--- a/website/docs/r/memorydb_acl.html.markdown
+++ b/website/docs/r/memorydb_acl.html.markdown
@@ -30,9 +30,9 @@ The following arguments are optional:
 * `user_names` - (Optional) Set of MemoryDB user names to be included in this ACL.
 * `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Same as `name`.
 * `arn` - The ARN of the ACL.
@@ -41,8 +41,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Use the `name` to import an ACL. For example:
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import an ACL using the `name`. For example:
 
+```terraform
+import {
+  to = aws_memorydb_acl.example
+  id = "my-acl"
+}
 ```
-$ terraform import aws_memorydb_acl.example my-acl
+
+Using `terraform import`, import an ACL using the `name`. For example:
+
+```console
+% terraform import aws_memorydb_acl.example my-acl
 ```
diff --git a/website/docs/r/memorydb_cluster.html.markdown b/website/docs/r/memorydb_cluster.html.markdown
index 55c7d217949..f7a3900a994 100644
--- a/website/docs/r/memorydb_cluster.html.markdown
+++ b/website/docs/r/memorydb_cluster.html.markdown
@@ -58,9 +58,9 @@ The following arguments are optional:
 * `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 * `tls_enabled` - (Optional, Forces new resource) A flag to enable in-transit encryption on the cluster. When set to `false`, the `acl_name` must be `open-access`. Defaults to `true`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Same as `name`.
 * `arn` - The ARN of the cluster.
@@ -91,8 +91,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Use the `name` to import a cluster. For example:
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import a cluster using the `name`. For example:
 
+```terraform
+import {
+  to = aws_memorydb_cluster.example
+  id = "my-cluster"
+}
 ```
-$ terraform import aws_memorydb_cluster.example my-cluster
+
+Using `terraform import`, import a cluster using the `name`. For example:
+
+```console
+% terraform import aws_memorydb_cluster.example my-cluster
 ```
diff --git a/website/docs/r/memorydb_parameter_group.html.markdown b/website/docs/r/memorydb_parameter_group.html.markdown
index cc97944f2d4..54bcfd3c0e1 100644
--- a/website/docs/r/memorydb_parameter_group.html.markdown
+++ b/website/docs/r/memorydb_parameter_group.html.markdown
@@ -45,9 +45,9 @@ The following arguments are optional:
 * `name` - (Required) The name of the parameter.
 * `value` - (Required) The value of the parameter.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Same as `name`.
 * `arn` - The ARN of the parameter group.
@@ -55,8 +55,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Use the `name` to import a parameter group. For example:
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import a parameter group using the `name`. For example:
 
+```terraform
+import {
+  to = aws_memorydb_parameter_group.example
+  id = "my-parameter-group"
+}
 ```
-$ terraform import aws_memorydb_parameter_group.example my-parameter-group
+
+Using `terraform import`, import a parameter group using the `name`. For example:
+
+```console
+% terraform import aws_memorydb_parameter_group.example my-parameter-group
 ```
diff --git a/website/docs/r/memorydb_snapshot.html.markdown b/website/docs/r/memorydb_snapshot.html.markdown
index 547f05cb5b7..f251f483ea3 100644
--- a/website/docs/r/memorydb_snapshot.html.markdown
+++ b/website/docs/r/memorydb_snapshot.html.markdown
@@ -23,7 +23,7 @@ resource "aws_memorydb_snapshot" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `cluster_name` - (Required, Forces new resource) Name of the MemoryDB cluster to take a snapshot of.
 * `name` - (Optional, Forces new resource) Name of the snapshot. If omitted, Terraform will assign a random, unique name. Conflicts with `name_prefix`.
@@ -31,9 +31,9 @@ The following arguments are supported:
 * `kms_key_arn` - (Optional, Forces new resource) ARN of the KMS key used to encrypt the snapshot at rest.
 * `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The name of the snapshot.
 * `arn` - The ARN of the snapshot.
@@ -63,8 +63,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Use the `name` to import a snapshot. For example:
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import a snapshot using the `name`. For example:
 
+```terraform
+import {
+  to = aws_memorydb_snapshot.example
+  id = "my-snapshot"
+}
 ```
-$ terraform import aws_memorydb_snapshot.example my-snapshot
+
+Using `terraform import`, import a snapshot using the `name`. For example:
+
+```console
+% terraform import aws_memorydb_snapshot.example my-snapshot
 ```
diff --git a/website/docs/r/memorydb_subnet_group.html.markdown b/website/docs/r/memorydb_subnet_group.html.markdown
index dd2db7873dc..79e88377a58 100644
--- a/website/docs/r/memorydb_subnet_group.html.markdown
+++ b/website/docs/r/memorydb_subnet_group.html.markdown
@@ -44,9 +44,9 @@ The following arguments are optional:
 * `description` - (Optional) Description for the subnet group. Defaults to `"Managed by Terraform"`.
 * `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The name of the subnet group.
 * `arn` - The ARN of the subnet group.
@@ -55,8 +55,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Use the `name` to import a subnet group. For example:
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import a subnet group using its `name`. For example:
 
+```terraform
+import {
+  to = aws_memorydb_subnet_group.example
+  id = "my-subnet-group"
+}
 ```
-$ terraform import aws_memorydb_subnet_group.example my-subnet-group
+
+Using `terraform import`, import a subnet group using its `name`. For example:
+
+```console
+% terraform import aws_memorydb_subnet_group.example my-subnet-group
 ```
diff --git a/website/docs/r/memorydb_user.html.markdown b/website/docs/r/memorydb_user.html.markdown
index dccef636441..c7daea2459e 100644
--- a/website/docs/r/memorydb_user.html.markdown
+++ b/website/docs/r/memorydb_user.html.markdown
@@ -50,9 +50,9 @@ The following arguments are optional:
 * `passwords` - (Required) The set of passwords used for authentication. You can create up to two passwords for each user.
 * `type` - (Required) Indicates whether the user requires a password to authenticate. Must be set to `password`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Same as `user_name`.
 * `arn` - The ARN of the user.
@@ -63,10 +63,19 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Use the `user_name` to import a user. For example:
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import a user using the `user_name`. For example:
 
+```terraform
+import {
+  to = aws_memorydb_user.example
+  id = "my-user"
+}
 ```
-$ terraform import aws_memorydb_user.example my-user
+
+Using `terraform import`, import a user using the `user_name`. For example:
+
+```console
+% terraform import aws_memorydb_user.example my-user
 ```
 
 The `passwords` are not available for imported resources, as this information cannot be read back from the MemoryDB API.
diff --git a/website/docs/r/mq_broker.html.markdown b/website/docs/r/mq_broker.html.markdown
index 970fdf40522..2e5da7fdf03 100644
--- a/website/docs/r/mq_broker.html.markdown
+++ b/website/docs/r/mq_broker.html.markdown
@@ -12,7 +12,7 @@ Provides an Amazon MQ broker resource. This resources also manages users for the
 
 -> For more information on Amazon MQ, see [Amazon MQ documentation](https://docs.aws.amazon.com/amazon-mq/latest/developer-guide/welcome.html).
 
-~> **NOTE:** Amazon MQ currently places limits on **RabbitMQ** brokers. For example, a RabbitMQ broker cannot have: instances with an associated IP address of an ENI attached to the broker, an associated LDAP server to authenticate and authorize broker connections, storage type `EFS`, audit logging, or `configuration` blocks. Although this resource allows you to create RabbitMQ users, RabbitMQ users cannot have console access or groups. Also, Amazon MQ does not return information about RabbitMQ users so drift detection is not possible.
+~> **NOTE:** Amazon MQ currently places limits on **RabbitMQ** brokers. For example, a RabbitMQ broker cannot have: instances with an associated IP address of an ENI attached to the broker, an associated LDAP server to authenticate and authorize broker connections, storage type `EFS`, or audit logging. Although this resource allows you to create RabbitMQ users, RabbitMQ users cannot have console access or groups. Also, Amazon MQ does not return information about RabbitMQ users so drift detection is not possible.
 
 ~> **NOTE:** Changes to an MQ Broker can occur when you change a parameter, such as `configuration` or `user`, and are reflected in the next maintenance window. Because of this, Terraform may report a difference in its planning phase because a modification has not yet taken place. You can use the `apply_immediately` flag to instruct the service to apply the change immediately (see documentation below). Using `apply_immediately` can result in a brief downtime as the broker reboots.
 
@@ -84,7 +84,7 @@ The following arguments are optional:
 * `apply_immediately` - (Optional) Specifies whether any broker modifications are applied immediately, or during the next maintenance window. Default is `false`.
 * `authentication_strategy` - (Optional) Authentication strategy used to secure the broker. Valid values are `simple` and `ldap`. `ldap` is not supported for `engine_type` `RabbitMQ`.
 * `auto_minor_version_upgrade` - (Optional) Whether to automatically upgrade to new minor versions of brokers as Amazon MQ makes releases available.
-* `configuration` - (Optional) Configuration block for broker configuration. Applies to `engine_type` of `ActiveMQ` only. Detailed below.
+* `configuration` - (Optional) Configuration block for broker configuration. Applies to `engine_type` of `ActiveMQ` and `RabbitMQ` only. Detailed below.
 * `deployment_mode` - (Optional) Deployment mode of the broker. Valid values are `SINGLE_INSTANCE`, `ACTIVE_STANDBY_MULTI_AZ`, and `CLUSTER_MULTI_AZ`. Default is `SINGLE_INSTANCE`.
 * `encryption_options` - (Optional) Configuration block containing encryption options. Detailed below.
 * `ldap_server_metadata` - (Optional) Configuration block for the LDAP server used to authenticate and authorize connections to the broker. Not supported for `engine_type` `RabbitMQ`. Detailed below. (Currently, AWS may not process changes to LDAP server metadata.)
@@ -146,13 +146,14 @@ The following arguments are required:
 * `console_access` - (Optional) Whether to enable access to the [ActiveMQ Web Console](http://activemq.apache.org/web-console.html) for the user. Applies to `engine_type` of `ActiveMQ` only.
 * `groups` - (Optional) List of groups (20 maximum) to which the ActiveMQ user belongs. Applies to `engine_type` of `ActiveMQ` only.
 * `password` - (Required) Password of the user. It must be 12 to 250 characters long, at least 4 unique characters, and must not contain commas.
+* `replication_user` - (Optional) Whether to set set replication user. Defaults to `false`.
 * `username` - (Required) Username of the user.
 
 ~> **NOTE:** AWS currently does not support updating RabbitMQ users. Updates to users can only be in the RabbitMQ UI.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the broker.
 * `id` - Unique ID that Amazon MQ generates for the broker.
@@ -180,8 +181,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-MQ Brokers can be imported using their broker id, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import MQ Brokers using their broker id. For example:
 
+```terraform
+import {
+  to = aws_mq_broker.example
+  id = "a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc"
+}
 ```
-$ terraform import aws_mq_broker.example a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
+
+Using `terraform import`, import MQ Brokers using their broker id. For example:
+
+```console
+% terraform import aws_mq_broker.example a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
 ```
diff --git a/website/docs/r/mq_configuration.html.markdown b/website/docs/r/mq_configuration.html.markdown
index d81440d9102..f2331b89ba9 100644
--- a/website/docs/r/mq_configuration.html.markdown
+++ b/website/docs/r/mq_configuration.html.markdown
@@ -14,6 +14,8 @@ For more information on Amazon MQ, see [Amazon MQ documentation](https://docs.aw
 
 ## Example Usage
 
+### ActiveMQ
+
 ```terraform
 resource "aws_mq_configuration" "example" {
   description    = "Example Configuration"
@@ -34,11 +36,27 @@ DATA
 }
 ```
 
+### RabbitMQ
+
+```terraform
+resource "aws_mq_configuration" "example" {
+  description    = "Example Configuration"
+  name           = "example"
+  engine_type    = "RabbitMQ"
+  engine_version = "3.11.16"
+
+  data = <<DATA
+# Default RabbitMQ delivery acknowledgement timeout is 30 minutes in milliseconds
+consumer_timeout = 1800000
+DATA
+}
+```
+
 ## Argument Reference
 
 The following arguments are required:
 
-* `data` - (Required) Broker configuration in XML format. See [official docs](https://docs.aws.amazon.com/amazon-mq/latest/developer-guide/amazon-mq-broker-configuration-parameters.html) for supported parameters and format of the XML.
+* `data` - (Required) Broker configuration in XML format for `ActiveMQ` or [Cuttlefish](https://github.com/Kyorai/cuttlefish) format for `RabbitMQ`. See [official docs](https://docs.aws.amazon.com/amazon-mq/latest/developer-guide/amazon-mq-broker-configuration-parameters.html) for supported parameters and format of the XML.
 * `engine_type` - (Required) Type of broker engine. Valid values are `ActiveMQ` and `RabbitMQ`.
 * `engine_version` - (Required) Version of the broker engine.
 * `name` - (Required) Name of the configuration.
@@ -49,9 +67,9 @@ The following arguments are optional:
 * `description` - (Optional) Description of the configuration.
 * `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the configuration.
 * `id` - Unique ID that Amazon MQ generates for the configuration.
@@ -60,8 +78,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-MQ Configurations can be imported using the configuration ID, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import MQ Configurations using the configuration ID. For example:
 
+```terraform
+import {
+  to = aws_mq_configuration.example
+  id = "c-0187d1eb-88c8-475a-9b79-16ef5a10c94f"
+}
 ```
-$ terraform import aws_mq_configuration.example c-0187d1eb-88c8-475a-9b79-16ef5a10c94f
+
+Using `terraform import`, import MQ Configurations using the configuration ID. For example:
+
+```console
+% terraform import aws_mq_configuration.example c-0187d1eb-88c8-475a-9b79-16ef5a10c94f
 ```
diff --git a/website/docs/r/msk_cluster.html.markdown b/website/docs/r/msk_cluster.html.markdown
index 7029e1e9d2b..2c35400501a 100644
--- a/website/docs/r/msk_cluster.html.markdown
+++ b/website/docs/r/msk_cluster.html.markdown
@@ -201,7 +201,7 @@ resource "aws_msk_cluster" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `broker_node_group_info` - (Required) Configuration block for the broker nodes of the Kafka cluster.
 * `cluster_name` - (Required) Name of the MSK cluster.
@@ -227,10 +227,25 @@ The following arguments are supported:
 ### broker_node_group_info connectivity_info Argument Reference
 
 * `public_access` - (Optional) Access control settings for brokers. See below.
+* `vpc_connectivity` - (Optional) VPC connectivity access control for brokers. See below.
 
 ### connectivity_info public_access Argument Reference
 
-* `type` - (Optional) Public access type. Valida values: `DISABLED`, `SERVICE_PROVIDED_EIPS`.
+* `type` - (Optional) Public access type. Valid values: `DISABLED`, `SERVICE_PROVIDED_EIPS`.
+
+### connectivity_info vpc_connectivity Argument Reference
+
+* `client_authentication` - (Optional) Includes all client authentication information for VPC connectivity. See below.
+
+### vpc_connectivity client_authentication Argument Reference
+
+* `sasl` - (Optional) SASL authentication type details for VPC connectivity. See below.
+* `tls` - (Optional) Enables TLS authentication for VPC connectivity.
+
+### vpc_connectivity client_authentication sasl Argument Reference
+
+* `iam` - (Optional) Enables SASL/IAM authentication for VPC connectivity.
+* `scram` - (Optional) Enables SASL/SCRAM authentication for VPC connectivity.
 
 ### broker_node_group_info storage_info Argument Reference
 
@@ -313,9 +328,9 @@ The following arguments are supported:
 * `bucket` - (Optional) Name of the S3 bucket to deliver logs to.
 * `prefix` - (Optional) Prefix to append to the folder name.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name (ARN) of the MSK cluster.
 * `bootstrap_brokers` - Comma separated list of one or more hostname:port pairs of kafka brokers suitable to bootstrap connectivity to the kafka cluster. Contains a value if `encryption_info.0.encryption_in_transit.0.client_broker` is set to `PLAINTEXT` or `TLS_PLAINTEXT`. The resource sorts values alphabetically. AWS may not always return all endpoints so this value is not guaranteed to be stable across applies.
@@ -325,6 +340,10 @@ In addition to all arguments above, the following attributes are exported:
 * `bootstrap_brokers_sasl_iam` - One or more DNS names (or IP addresses) and SASL IAM port pairs. For example, `b-1.exampleClusterName.abcde.c2.kafka.us-east-1.amazonaws.com:9098,b-2.exampleClusterName.abcde.c2.kafka.us-east-1.amazonaws.com:9098,b-3.exampleClusterName.abcde.c2.kafka.us-east-1.amazonaws.com:9098`. This attribute will have a value if `encryption_info.0.encryption_in_transit.0.client_broker` is set to `TLS_PLAINTEXT` or `TLS` and `client_authentication.0.sasl.0.iam` is set to `true`. The resource sorts the list alphabetically. AWS may not always return all endpoints so the values may not be stable across applies.
 * `bootstrap_brokers_sasl_scram` - One or more DNS names (or IP addresses) and SASL SCRAM port pairs. For example, `b-1.exampleClusterName.abcde.c2.kafka.us-east-1.amazonaws.com:9096,b-2.exampleClusterName.abcde.c2.kafka.us-east-1.amazonaws.com:9096,b-3.exampleClusterName.abcde.c2.kafka.us-east-1.amazonaws.com:9096`. This attribute will have a value if `encryption_info.0.encryption_in_transit.0.client_broker` is set to `TLS_PLAINTEXT` or `TLS` and `client_authentication.0.sasl.0.scram` is set to `true`. The resource sorts the list alphabetically. AWS may not always return all endpoints so the values may not be stable across applies.
 * `bootstrap_brokers_tls` - One or more DNS names (or IP addresses) and TLS port pairs. For example, `b-1.exampleClusterName.abcde.c2.kafka.us-east-1.amazonaws.com:9094,b-2.exampleClusterName.abcde.c2.kafka.us-east-1.amazonaws.com:9094,b-3.exampleClusterName.abcde.c2.kafka.us-east-1.amazonaws.com:9094`. This attribute will have a value if `encryption_info.0.encryption_in_transit.0.client_broker` is set to `TLS_PLAINTEXT` or `TLS`. The resource sorts the list alphabetically. AWS may not always return all endpoints so the values may not be stable across applies.
+* `bootstrap_brokers_vpc_connectivity_sasl_iam` - A string containing one or more DNS names (or IP addresses) and SASL IAM port pairs for VPC connectivity. AWS may not always return all endpoints so the values may not be stable across applies.
+* `bootstrap_brokers_vpc_connectivity_sasl_scram` - A string containing one or more DNS names (or IP addresses) and SASL SCRAM port pairs for VPC connectivity. AWS may not always return all endpoints so the values may not be stable across applies.
+* `bootstrap_brokers_vpc_connectivity_tls` - A string containing one or more DNS names (or IP addresses) and TLS port pairs for VPC connectivity. AWS may not always return all endpoints so the values may not be stable across applies.
+* `cluster_uuid` - UUID of the MSK cluster, for use in IAM policies.
 * `current_version` - Current version of the MSK Cluster used for updates, e.g., `K13V1IB3VIYZZH`
 * `encryption_info.0.encryption_at_rest_kms_key_arn` - The ARN of the KMS key used for encryption at rest of the broker data volumes.
 * `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
@@ -343,8 +362,17 @@ Note that the `update` timeout is used separately for `storage_info`, `instance_
 
 ## Import
 
-MSK clusters can be imported using the cluster `arn`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import MSK clusters using the cluster `arn`. For example:
 
+```terraform
+import {
+  to = aws_msk_cluster.example
+  id = "arn:aws:kafka:us-west-2:123456789012:cluster/example/279c0212-d057-4dba-9aa9-1c4e5a25bfc7-3"
+}
 ```
-$ terraform import aws_msk_cluster.example arn:aws:kafka:us-west-2:123456789012:cluster/example/279c0212-d057-4dba-9aa9-1c4e5a25bfc7-3
+
+Using `terraform import`, import MSK clusters using the cluster `arn`. For example:
+
+```console
+% terraform import aws_msk_cluster.example arn:aws:kafka:us-west-2:123456789012:cluster/example/279c0212-d057-4dba-9aa9-1c4e5a25bfc7-3
 ```
diff --git a/website/docs/r/msk_cluster_policy.html.markdown b/website/docs/r/msk_cluster_policy.html.markdown
new file mode 100644
index 00000000000..b2e6a69c836
--- /dev/null
+++ b/website/docs/r/msk_cluster_policy.html.markdown
@@ -0,0 +1,71 @@
+---
+subcategory: "Managed Streaming for Kafka"
+layout: "aws"
+page_title: "AWS: aws_msk_cluster_policy"
+description: |-
+  Terraform resource for managing an AWS Managed Streaming for Kafka Cluster Policy.
+---
+# Resource: aws_msk_cluster_policy
+
+Terraform resource for managing an AWS Managed Streaming for Kafka Cluster Policy.
+
+## Example Usage
+
+### Basic Usage
+
+```terraform
+data "aws_caller_identity" "current" {}
+data "aws_partition" "current" {}
+
+resource "aws_msk_cluster_policy" "example" {
+  cluster_arn = aws_msk_cluster.example.arn
+
+  policy = jsonencode({
+    Version = "2012-10-17",
+    Statement = [{
+      Sid    = "ExampleMskClusterPolicy"
+      Effect = "Allow"
+      Principal = {
+        "AWS" = "arn:${data.aws_partition.current.partition}:iam::${data.aws_caller_identity.current.account_id}:root"
+      }
+      Action = [
+        "kafka:Describe*",
+        "kafka:Get*",
+        "kafka:CreateVpcConnection",
+        "kafka:GetBootstrapBrokers",
+      ]
+      Resource = aws_msk_cluster.example.arn
+    }]
+  })
+}
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `cluster_arn` - (Required) The Amazon Resource Name (ARN) that uniquely identifies the cluster.
+* `policy` - (Required) Resource policy for cluster.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - Same as `cluster_arn`.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Managed Streaming for Kafka Cluster Policy using the `cluster_arn. For example:
+
+```terraform
+import {
+  to = aws_msk_cluster_policy.example
+  id = "arn:aws:kafka:us-west-2:123456789012:cluster/example/279c0212-d057-4dba-9aa9-1c4e5a25bfc7-3"
+}
+```
+
+Using `terraform import`, import Managed Streaming for Kafka Cluster Policy using the `cluster_arn`. For example:
+
+```console
+% terraform import aws_msk_cluster_policy.example arn:aws:kafka:us-west-2:123456789012:cluster/example/279c0212-d057-4dba-9aa9-1c4e5a25bfc7-3
+```
diff --git a/website/docs/r/msk_configuration.html.markdown b/website/docs/r/msk_configuration.html.markdown
index 48dc6fb10ba..17c98e2e182 100644
--- a/website/docs/r/msk_configuration.html.markdown
+++ b/website/docs/r/msk_configuration.html.markdown
@@ -26,24 +26,33 @@ PROPERTIES
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `server_properties` - (Required) Contents of the server.properties file. Supported properties are documented in the [MSK Developer Guide](https://docs.aws.amazon.com/msk/latest/developerguide/msk-configuration-properties.html).
 * `kafka_versions` - (Required) List of Apache Kafka versions which can use this configuration.
 * `name` - (Required) Name of the configuration.
 * `description` - (Optional) Description of the configuration.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name (ARN) of the configuration.
 * `latest_revision` - Latest revision of the configuration.
 
 ## Import
 
-MSK configurations can be imported using the configuration ARN, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import MSK configurations using the configuration ARN. For example:
 
+```terraform
+import {
+  to = aws_msk_configuration.example
+  id = "arn:aws:kafka:us-west-2:123456789012:configuration/example/279c0212-d057-4dba-9aa9-1c4e5a25bfc7-3"
+}
 ```
-$ terraform import aws_msk_configuration.example arn:aws:kafka:us-west-2:123456789012:configuration/example/279c0212-d057-4dba-9aa9-1c4e5a25bfc7-3
+
+Using `terraform import`, import MSK configurations using the configuration ARN. For example:
+
+```console
+% terraform import aws_msk_configuration.example arn:aws:kafka:us-west-2:123456789012:configuration/example/279c0212-d057-4dba-9aa9-1c4e5a25bfc7-3
 ```
diff --git a/website/docs/r/msk_replicator.html.markdown b/website/docs/r/msk_replicator.html.markdown
new file mode 100644
index 00000000000..f8ff06fc914
--- /dev/null
+++ b/website/docs/r/msk_replicator.html.markdown
@@ -0,0 +1,138 @@
+---
+subcategory: "Managed Streaming for Kafka"
+layout: "aws"
+page_title: "AWS: aws_msk_replicator"
+description: |-
+  Terraform resource for managing an AWS Managed Streaming for Kafka Replicator.
+---
+
+# Resource: aws_msk_replicator
+
+Terraform resource for managing an AWS Managed Streaming for Kafka Replicator.
+
+## Example Usage
+
+### Basic Usage
+
+```terraform
+resource "aws_msk_replicator" "test" {
+  replicator_name            = "test-name"
+  description                = "test-description"
+  service_execution_role_arn = aws_iam_role.source.arn
+
+  kafka_cluster {
+    amazon_msk_cluster {
+      msk_cluster_arn = aws_msk_cluster.source.arn
+    }
+
+    vpc_config {
+      subnet_ids          = aws_subnet.source[*].id
+      security_groups_ids = [aws_security_group.source.id]
+    }
+  }
+
+  kafka_cluster {
+    amazon_msk_cluster {
+      msk_cluster_arn = aws_msk_cluster.target.arn
+    }
+
+    vpc_config {
+      subnet_ids          = aws_subnet.target[*].id
+      security_groups_ids = [aws_security_group.target.id]
+    }
+  }
+
+  replication_info_list {
+    source_kafka_cluster_arn = aws_msk_cluster.source.arn
+    target_kafka_cluster_arn = aws_msk_cluster.target.arn
+    target_compression_type  = "NONE"
+
+
+    topic_replication {
+      topics_to_replicate = [".*"]
+    }
+
+    consumer_group_replication {
+      consumer_groups_to_replicate = [".*"]
+    }
+  }
+}
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `replicator_name` - (Required) The name of the replicator.
+* `kafka_cluster` - (Required) A list of Kafka clusters which are targets of the replicator.
+* `service_execution_role_arn` - (Required) The ARN of the IAM role used by the replicator to access resources in the customer's account (e.g source and target clusters).
+* `replication_info_list` - (Required) A list of replication configurations, where each configuration targets a given source cluster to target cluster replication flow.
+* `description` - (Optional) A summary description of the replicator.
+
+### kafka_cluster Argument Reference
+
+* `amazon_msk_cluster` - (Required) Details of an Amazon MSK cluster.
+* `vpc_config` - (Required) Details of an Amazon VPC which has network connectivity to the Apache Kafka cluster.
+
+### amazon_msk_cluster Argument Reference
+
+* `msk_cluster_arn` - (Required) The ARN of an Amazon MSK cluster.
+
+### vpc_config Argument Reference
+
+* `subnet_ids` - (Required) The list of subnets to connect to in the virtual private cloud (VPC). AWS creates elastic network interfaces inside these subnets to allow communication between your Kafka Cluster and the replicator.
+* `security_groups_ids` - (Required) The AWS security groups to associate with the ENIs used by the replicator. If a security group is not specified, the default security group associated with the VPC is used.
+
+### replication_info_list Argument Reference
+
+* `source_kafka_cluster_arn` - (Required) The ARN of the source Kafka cluster.
+* `target_kafka_cluster_arn` - (Required) The ARN of the target Kafka cluster.
+* `target_compression_type` - (Required) The type of compression to use writing records to target Kafka cluster.
+* `topic_replication` - (Required) Configuration relating to topic replication.
+* `consumer_group_replication` - (Required) Confguration relating to consumer group replication.
+
+### topic_replication Argument Reference
+
+* `topics_to_replicate` - (Required) List of regular expression patterns indicating the topics to copy.
+* `topics_to_exclude` - (Optional) List of regular expression patterns indicating the topics that should not be replica.
+* `detect_and_copy_new_topics` - (Optional) Whether to periodically check for new topics and partitions.
+* `copy_access_control_lists_for_topics` - (Optional) Whether to periodically configure remote topic ACLs to match their corresponding upstream topics.
+* `copy_topic_configurations` - (Optional) Whether to periodically configure remote topics to match their corresponding upstream topics.
+
+### consumer_group_replication Argument Reference
+
+* `consumer_groups_to_replicate` - (Required) List of regular expression patterns indicating the consumer groups to copy.
+* `consumer_groups_to_exclude` - (Optional) List of regular expression patterns indicating the consumer groups that should not be replicated.
+* `detect_and_copy_new_consumer_groups` - (Optional) Whether to periodically check for new consumer groups.
+* `synchronise_consumer_group_offsets` - (Optional) Whether to periodically write the translated offsets to __consumer_offsets topic in target cluster.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the Replicator. Do not begin the description with "An", "The", "Defines", "Indicates", or "Specifies," as these are verbose. In other words, "Indicates the amount of storage," can be rewritten as "Amount of storage," without losing any information.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `60m`)
+* `update` - (Default `180m`)
+* `delete` - (Default `90m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import MSK relicators using the replicator ARN. For example:
+
+```terraform
+import {
+  to = aws_msk_replicator.example
+  id = "arn:aws:kafka:us-west-2:123456789012:configuration/example/279c0212-d057-4dba-9aa9-1c4e5a25bfc7-3"
+}
+```
+
+Using `terraform import`, import MSK replicators using the replicator ARN. For example:
+
+```console
+% terraform import aws_msk_replicator.example arn:aws:kafka:us-west-2:123456789012:configuration/example/279c0212-d057-4dba-9aa9-1c4e5a25bfc7-3
+```
diff --git a/website/docs/r/msk_scram_secret_association.html.markdown b/website/docs/r/msk_scram_secret_association.html.markdown
index 2def2b48716..984e05f50ad 100644
--- a/website/docs/r/msk_scram_secret_association.html.markdown
+++ b/website/docs/r/msk_scram_secret_association.html.markdown
@@ -77,21 +77,30 @@ resource "aws_secretsmanager_secret_policy" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `cluster_arn` - (Required, Forces new resource) Amazon Resource Name (ARN) of the MSK cluster.
 * `secret_arn_list` - (Required) List of AWS Secrets Manager secret ARNs.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Amazon Resource Name (ARN) of the MSK cluster.
 
 ## Import
 
-MSK SCRAM Secret Associations can be imported using the `id` e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import MSK SCRAM Secret Associations using the `id`. For example:
 
+```terraform
+import {
+  to = aws_msk_scram_secret_association.example
+  id = "arn:aws:kafka:us-west-2:123456789012:cluster/example/279c0212-d057-4dba-9aa9-1c4e5a25bfc7-3"
+}
 ```
-$ terraform import aws_msk_scram_secret_association.example arn:aws:kafka:us-west-2:123456789012:cluster/example/279c0212-d057-4dba-9aa9-1c4e5a25bfc7-3
+
+Using `terraform import`, import MSK SCRAM Secret Associations using the `id`. For example:
+
+```console
+% terraform import aws_msk_scram_secret_association.example arn:aws:kafka:us-west-2:123456789012:cluster/example/279c0212-d057-4dba-9aa9-1c4e5a25bfc7-3
 ```
diff --git a/website/docs/r/msk_serverless_cluster.html.markdown b/website/docs/r/msk_serverless_cluster.html.markdown
index cce4230126f..e3b96231b82 100644
--- a/website/docs/r/msk_serverless_cluster.html.markdown
+++ b/website/docs/r/msk_serverless_cluster.html.markdown
@@ -35,7 +35,7 @@ resource "aws_msk_serverless_cluster" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `client_authentication` - (Required) Specifies client authentication information for the serverless cluster. See below.
 * `cluster_name` - (Required) The name of the serverless cluster.
@@ -59,11 +59,12 @@ The following arguments are supported:
 * `security_group_ids` - (Optional) Specifies up to five security groups that control inbound and outbound traffic for the serverless cluster.
 * `subnet_ids` - (Required) A list of subnets in at least two different Availability Zones that host your client applications.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The ARN of the serverless cluster.
+* `cluster_uuid` - UUID of the serverless cluster, for use in IAM policies.
 * `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
 
 ## Timeouts
@@ -75,8 +76,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-MSK serverless clusters can be imported using the cluster `arn`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import MSK serverless clusters using the cluster `arn`. For example:
 
+```terraform
+import {
+  to = aws_msk_serverless_cluster.example
+  id = "arn:aws:kafka:us-west-2:123456789012:cluster/example/279c0212-d057-4dba-9aa9-1c4e5a25bfc7-3"
+}
 ```
-$ terraform import aws_msk_serverless_cluster.example arn:aws:kafka:us-west-2:123456789012:cluster/example/279c0212-d057-4dba-9aa9-1c4e5a25bfc7-3
+
+Using `terraform import`, import MSK serverless clusters using the cluster `arn`. For example:
+
+```console
+% terraform import aws_msk_serverless_cluster.example arn:aws:kafka:us-west-2:123456789012:cluster/example/279c0212-d057-4dba-9aa9-1c4e5a25bfc7-3
 ```
diff --git a/website/docs/r/msk_vpc_connection.html.markdown b/website/docs/r/msk_vpc_connection.html.markdown
new file mode 100644
index 00000000000..473d2178823
--- /dev/null
+++ b/website/docs/r/msk_vpc_connection.html.markdown
@@ -0,0 +1,65 @@
+---
+subcategory: "Managed Streaming for Kafka"
+layout: "aws"
+page_title: "AWS: aws_msk_vpc_connection"
+description: |-
+  Terraform resource for managing an AWS Managed Streaming for Kafka VPC Connection.
+---
+# Resource: aws_msk_vpc_connection
+
+Terraform resource for managing an AWS Managed Streaming for Kafka VPC Connection.
+
+## Example Usage
+
+```terraform
+resource "aws_msk_vpc_connection" "test" {
+  authentication     = "SASL_IAM"
+  target_cluster_arn = "aws_msk_cluster.arn"
+  vpc_id             = aws_vpc.test.id
+  client_subnets     = aws_subnet.test[*].id
+  security_groups    = [aws_security_group.test.id]
+}
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `authentication` - (Required) The authentication type for the client VPC connection. Specify one of these auth type strings: SASL_IAM, SASL_SCRAM, or TLS.
+* `client_subnets` - (Required) The list of subnets in the client VPC to connect to.
+* `security_groups` - (Required) The security groups to attach to the ENIs for the broker nodes.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `target_cluster_arn` - (Required) The Amazon Resource Name (ARN) of the cluster.
+* `vpc_id` - (Required) The VPC ID of the remote client.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - Amazon Resource Name (ARN) of the VPC connection.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `60m`)
+* `update` - (Default `180m`)
+* `delete` - (Default `90m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import MSK configurations using the configuration ARN. For example:
+
+```terraform
+import {
+  to = aws_msk_vpc_connection.example
+  id = "arn:aws:kafka:eu-west-2:123456789012:vpc-connection/123456789012/example/38173259-79cd-4ee8-87f3-682ea6023f48-2"
+}
+```
+
+Using `terraform import`, import MSK configurations using the configuration ARN. For example:
+
+```console
+% terraform import aws_msk_vpc_connection.example arn:aws:kafka:eu-west-2:123456789012:vpc-connection/123456789012/example/38173259-79cd-4ee8-87f3-682ea6023f48-2
+```
diff --git a/website/docs/r/mskconnect_connector.html.markdown b/website/docs/r/mskconnect_connector.html.markdown
index e3619fae72e..7af8c023e19 100644
--- a/website/docs/r/mskconnect_connector.html.markdown
+++ b/website/docs/r/mskconnect_connector.html.markdown
@@ -74,7 +74,7 @@ resource "aws_mskconnect_connector" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `capacity` - (Required) Information about the capacity allocated to the connector. See below.
 * `connector_configuration` - (Required) A map of keys to values that represent the configuration for the connector.
@@ -177,9 +177,9 @@ The following arguments are supported:
 * `arn` - (Required) The Amazon Resource Name (ARN) of the worker configuration.
 * `revision` - (Required) The revision of the worker configuration.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The Amazon Resource Name (ARN) of the connector.
 * `version` - The current version of the connector.
@@ -194,8 +194,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-MSK Connect Connector can be imported using the connector's `arn`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import MSK Connect Connector using the connector's `arn`. For example:
 
+```terraform
+import {
+  to = aws_mskconnect_connector.example
+  id = "arn:aws:kafkaconnect:eu-central-1:123456789012:connector/example/264edee4-17a3-412e-bd76-6681cfc93805-3"
+}
 ```
-$ terraform import aws_mskconnect_connector.example 'arn:aws:kafkaconnect:eu-central-1:123456789012:connector/example/264edee4-17a3-412e-bd76-6681cfc93805-3'
+
+Using `terraform import`, import MSK Connect Connector using the connector's `arn`. For example:
+
+```console
+% terraform import aws_mskconnect_connector.example 'arn:aws:kafkaconnect:eu-central-1:123456789012:connector/example/264edee4-17a3-412e-bd76-6681cfc93805-3'
 ```
diff --git a/website/docs/r/mskconnect_custom_plugin.html.markdown b/website/docs/r/mskconnect_custom_plugin.html.markdown
index 32b6c1b2890..cb965af9f54 100644
--- a/website/docs/r/mskconnect_custom_plugin.html.markdown
+++ b/website/docs/r/mskconnect_custom_plugin.html.markdown
@@ -59,9 +59,9 @@ The following arguments are optional:
 * `file_key` - (Required) The file key for an object in an S3 bucket.
 * `object_version` - (Optional) The version of an object in an S3 bucket.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - the Amazon Resource Name (ARN) of the custom plugin.
 * `latest_revision` - an ID of the latest successfully created revision of the custom plugin.
@@ -76,8 +76,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-MSK Connect Custom Plugin can be imported using the plugin's `arn`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import MSK Connect Custom Plugin using the plugin's `arn`. For example:
 
+```terraform
+import {
+  to = aws_mskconnect_custom_plugin.example
+  id = "arn:aws:kafkaconnect:eu-central-1:123456789012:custom-plugin/debezium-example/abcdefgh-1234-5678-9abc-defghijklmno-4"
+}
 ```
-$ terraform import aws_mskconnect_custom_plugin.example 'arn:aws:kafkaconnect:eu-central-1:123456789012:custom-plugin/debezium-example/abcdefgh-1234-5678-9abc-defghijklmno-4'
+
+Using `terraform import`, import MSK Connect Custom Plugin using the plugin's `arn`. For example:
+
+```console
+% terraform import aws_mskconnect_custom_plugin.example 'arn:aws:kafkaconnect:eu-central-1:123456789012:custom-plugin/debezium-example/abcdefgh-1234-5678-9abc-defghijklmno-4'
 ```
diff --git a/website/docs/r/mskconnect_worker_configuration.html.markdown b/website/docs/r/mskconnect_worker_configuration.html.markdown
index 5b76c7499a3..3542f68d328 100644
--- a/website/docs/r/mskconnect_worker_configuration.html.markdown
+++ b/website/docs/r/mskconnect_worker_configuration.html.markdown
@@ -35,17 +35,26 @@ The following arguments are optional:
 
 * `description` - (Optional) A summary description of the worker configuration.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - the Amazon Resource Name (ARN) of the worker configuration.
 * `latest_revision` - an ID of the latest successfully created revision of the worker configuration.
 
 ## Import
 
-MSK Connect Worker Configuration can be imported using the plugin's `arn`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import MSK Connect Worker Configuration using the plugin's `arn`. For example:
 
+```terraform
+import {
+  to = aws_mskconnect_worker_configuration.example
+  id = "arn:aws:kafkaconnect:eu-central-1:123456789012:worker-configuration/example/8848493b-7fcc-478c-a646-4a52634e3378-4"
+}
 ```
-$ terraform import aws_mskconnect_worker_configuration.example 'arn:aws:kafkaconnect:eu-central-1:123456789012:worker-configuration/example/8848493b-7fcc-478c-a646-4a52634e3378-4'
+
+Using `terraform import`, import MSK Connect Worker Configuration using the plugin's `arn`. For example:
+
+```console
+% terraform import aws_mskconnect_worker_configuration.example 'arn:aws:kafkaconnect:eu-central-1:123456789012:worker-configuration/example/8848493b-7fcc-478c-a646-4a52634e3378-4'
 ```
diff --git a/website/docs/r/mwaa_environment.html.markdown b/website/docs/r/mwaa_environment.html.markdown
index c0719da0abd..bf9eeba94d8 100644
--- a/website/docs/r/mwaa_environment.html.markdown
+++ b/website/docs/r/mwaa_environment.html.markdown
@@ -124,7 +124,7 @@ resource "aws_mwaa_environment" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `airflow_configuration_options` - (Optional) The `airflow_configuration_options` parameter specifies airflow override options. Check the [Official documentation](https://docs.aws.amazon.com/mwaa/latest/userguide/configuring-env-variables.html#configuring-env-variables-reference) for all possible configuration options.
 * `airflow_version` - (Optional) Airflow version of your environment, will be set by default to the latest version that MWAA supports.
@@ -173,9 +173,9 @@ The `network_configuration` block supports the following arguments. More informa
 * `security_group_ids` - (Required) Security groups IDs for the environment. At least one of the security group needs to allow MWAA resources to talk to each other, otherwise MWAA cannot be provisioned.
 * `subnet_ids` - (Required)  The private subnet IDs in which the environment should be created. MWAA requires two subnets.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The ARN of the MWAA Environment
 * `created_at` - The Created At date of the MWAA Environment
@@ -195,8 +195,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-MWAA Environment can be imported using `Name` e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import MWAA Environment using `Name`. For example:
 
+```terraform
+import {
+  to = aws_mwaa_environment.example
+  id = "MyAirflowEnvironment"
+}
 ```
-$ terraform import aws_mwaa_environment.example MyAirflowEnvironment
+
+Using `terraform import`, import MWAA Environment using `Name`. For example:
+
+```console
+% terraform import aws_mwaa_environment.example MyAirflowEnvironment
 ```
diff --git a/website/docs/r/nat_gateway.html.markdown b/website/docs/r/nat_gateway.html.markdown
index 7fd7da8ca7f..1107162916c 100644
--- a/website/docs/r/nat_gateway.html.markdown
+++ b/website/docs/r/nat_gateway.html.markdown
@@ -29,6 +29,17 @@ resource "aws_nat_gateway" "example" {
 }
 ```
 
+### Public NAT with Secondary Private IP Addresses
+
+```terraform
+resource "aws_nat_gateway" "example" {
+  allocation_id                  = aws_eip.example.id
+  subnet_id                      = aws_subnet.example.id
+  secondary_allocation_ids       = [aws_eip.secondary.id]
+  secondary_private_ip_addresses = ["10.0.1.5"]
+}
+```
+
 ### Private NAT
 
 ```terraform
@@ -38,30 +49,60 @@ resource "aws_nat_gateway" "example" {
 }
 ```
 
+### Private NAT with Secondary Private IP Addresses
+
+```terraform
+resource "aws_nat_gateway" "example" {
+  connectivity_type                  = "private"
+  subnet_id                          = aws_subnet.example.id
+  secondary_private_ip_address_count = 7
+}
+```
+
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
-* `allocation_id` - (Optional) The Allocation ID of the Elastic IP address for the gateway. Required for `connectivity_type` of `public`.
-* `connectivity_type` - (Optional) Connectivity type for the gateway. Valid values are `private` and `public`. Defaults to `public`.
-* `private_ip` - (Optional) The private IPv4 address to assign to the NAT gateway. If you don't provide an address, a private IPv4 address will be automatically assigned.
-* `subnet_id` - (Required) The Subnet ID of the subnet in which to place the gateway.
+* `allocation_id` - (Optional) The Allocation ID of the Elastic IP address for the NAT Gateway. Required for `connectivity_type` of `public`.
+* `connectivity_type` - (Optional) Connectivity type for the NAT Gateway. Valid values are `private` and `public`. Defaults to `public`.
+* `private_ip` - (Optional) The private IPv4 address to assign to the NAT Gateway. If you don't provide an address, a private IPv4 address will be automatically assigned.
+* `subnet_id` - (Required) The Subnet ID of the subnet in which to place the NAT Gateway.
+* `secondary_allocation_ids` - (Optional) A list of secondary allocation EIP IDs for this NAT Gateway.
+* `secondary_private_ip_address_count` - (Optional) [Private NAT Gateway only] The number of secondary private IPv4 addresses you want to assign to the NAT Gateway.
+* `secondary_private_ip_addresses` - (Optional) A list of secondary private IPv4 addresses to assign to the NAT Gateway.
 * `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
-* `association_id` - The association ID of the Elastic IP address that's associated with the NAT gateway. Only available when `connectivity_type` is `public`.
+* `association_id` - The association ID of the Elastic IP address that's associated with the NAT Gateway. Only available when `connectivity_type` is `public`.
 * `id` - The ID of the NAT Gateway.
-* `network_interface_id` - The ID of the network interface associated with the NAT gateway.
-* `public_ip` - The Elastic IP address associated with the NAT gateway.
+* `network_interface_id` - The ID of the network interface associated with the NAT Gateway.
+* `public_ip` - The Elastic IP address associated with the NAT Gateway.
 * `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
 
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `10m`)
+- `update` - (Default `10m`)
+- `delete` - (Default `30m`)
+
 ## Import
 
-NAT Gateways can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import NAT Gateways using the `id`. For example:
 
+```terraform
+import {
+  to = aws_nat_gateway.private_gw
+  id = "nat-05dba92075d71c408"
+}
 ```
-$ terraform import aws_nat_gateway.private_gw nat-05dba92075d71c408
+
+Using `terraform import`, import NAT Gateways using the `id`. For example:
+
+```console
+% terraform import aws_nat_gateway.private_gw nat-05dba92075d71c408
 ```
diff --git a/website/docs/r/neptune_cluster.html.markdown b/website/docs/r/neptune_cluster.html.markdown
index 025ada759e3..8466e910434 100644
--- a/website/docs/r/neptune_cluster.html.markdown
+++ b/website/docs/r/neptune_cluster.html.markdown
@@ -37,7 +37,7 @@ See the AWS [Docs](https://docs.aws.amazon.com/neptune/latest/userguide/limits.h
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `allow_major_version_upgrade` - (Optional) Specifies whether upgrades between different major versions are allowed. You must set it to `true` when providing an `engine_version` parameter that uses a different major version than the DB cluster's current version. Default is `false`.
 * `apply_immediately` - (Optional) Specifies whether any cluster modifications are applied immediately, or during the next maintenance window. Default is `false`.
@@ -46,7 +46,7 @@ The following arguments are supported:
 * `cluster_identifier` - (Optional, Forces new resources) The cluster identifier. If omitted, Terraform will assign a random, unique identifier.
 * `cluster_identifier_prefix` - (Optional, Forces new resource) Creates a unique cluster identifier beginning with the specified prefix. Conflicts with `cluster_identifier`.
 * `copy_tags_to_snapshot` - (Optional) If set to true, tags are copied to any snapshot of the DB cluster that is created.
-* `enable_cloudwatch_logs_exports` - (Optional) A list of the log types this DB cluster is configured to export to Cloudwatch Logs. Currently only supports `audit`.
+* `enable_cloudwatch_logs_exports` - (Optional) A list of the log types this DB cluster is configured to export to Cloudwatch Logs. Currently only supports `audit` and `slowquery`.
 * `engine` - (Optional) The name of the database engine to be used for this Neptune cluster. Defaults to `neptune`.
 * `engine_version` - (Optional) The database engine version.
 * `final_snapshot_identifier` - (Optional) The name of your final Neptune snapshot when this Neptune cluster is deleted. If omitted, no final snapshot will be made.
@@ -97,9 +97,9 @@ resource "aws_neptune_cluster_instance" "example" {
 * `min_capacity`: (default: **2.5**) The minimum Neptune Capacity Units (NCUs) for this cluster. Must be greater or equal than **1**. See [AWS Documentation](https://docs.aws.amazon.com/neptune/latest/userguide/neptune-serverless-capacity-scaling.html) for more details.
 * `max_capacity`: (default: **128**) The maximum Neptune Capacity Units (NCUs) for this cluster. Must be lower or equal than **128**. See [AWS Documentation](https://docs.aws.amazon.com/neptune/latest/userguide/neptune-serverless-capacity-scaling.html) for more details.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The Neptune Cluster Amazon Resource Name (ARN)
 * `cluster_resource_id` - The Neptune Cluster Resource ID
@@ -121,8 +121,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_neptune_cluster` can be imported by using the cluster identifier, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_neptune_cluster` using the cluster identifier. For example:
 
+```terraform
+import {
+  to = aws_neptune_cluster.example
+  id = "my-cluster"
+}
 ```
-$ terraform import aws_neptune_cluster.example my-cluster
+
+Using `terraform import`, import `aws_neptune_cluster` using the cluster identifier. For example:
+
+```console
+% terraform import aws_neptune_cluster.example my-cluster
 ```
diff --git a/website/docs/r/neptune_cluster_endpoint.html.markdown b/website/docs/r/neptune_cluster_endpoint.html.markdown
index bbe549e781b..faf1e31cca7 100644
--- a/website/docs/r/neptune_cluster_endpoint.html.markdown
+++ b/website/docs/r/neptune_cluster_endpoint.html.markdown
@@ -22,7 +22,7 @@ resource "aws_neptune_cluster_endpoint" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `cluster_identifier` - (Required, Forces new resources) The DB cluster identifier of the DB cluster associated with the endpoint.
 * `cluster_endpoint_identifier` - (Required, Forces new resources) The identifier of the endpoint.
@@ -31,9 +31,9 @@ The following arguments are supported:
 * `static_members` - (Optional) List of DB instance identifiers that are part of the custom endpoint group.
 * `tags` - (Optional) A map of tags to assign to the Neptune cluster. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The Neptune Cluster Endpoint Amazon Resource Name (ARN).
 * `endpoint` - The DNS address of the endpoint.
@@ -42,8 +42,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_neptune_cluster_endpoint` can be imported by using the `cluster-identifier:endpoint-identfier`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_neptune_cluster_endpoint` using the `cluster-identifier:endpoint-identfier`. For example:
 
+```terraform
+import {
+  to = aws_neptune_cluster_endpoint.example
+  id = "my-cluster:my-endpoint"
+}
 ```
-$ terraform import aws_neptune_cluster_endpoint.example my-cluster:my-endpoint
+
+Using `terraform import`, import `aws_neptune_cluster_endpoint` using the `cluster-identifier:endpoint-identfier`. For example:
+
+```console
+% terraform import aws_neptune_cluster_endpoint.example my-cluster:my-endpoint
 ```
diff --git a/website/docs/r/neptune_cluster_instance.html.markdown b/website/docs/r/neptune_cluster_instance.html.markdown
index 13077a7089b..257f5a16036 100644
--- a/website/docs/r/neptune_cluster_instance.html.markdown
+++ b/website/docs/r/neptune_cluster_instance.html.markdown
@@ -39,7 +39,7 @@ resource "aws_neptune_cluster_instance" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `apply_immediately` - (Optional) Specifies whether any instance modifications
   are applied immediately, or during the next maintenance window. Default is`false`.
@@ -47,7 +47,7 @@ The following arguments are supported:
 * `availability_zone` - (Optional) The EC2 Availability Zone that the neptune instance is created in.
 * `cluster_identifier` - (Required) The identifier of the [`aws_neptune_cluster`](/docs/providers/aws/r/neptune_cluster.html) in which to launch this instance.
 * `engine` - (Optional) The name of the database engine to be used for the neptune instance. Defaults to `neptune`. Valid Values: `neptune`.
-* `engine_version` - (Optional) The neptune engine version.
+* `engine_version` - (Optional) The neptune engine version. Currently configuring this argumnet has no effect.
 * `identifier` - (Optional, Forces new resource) The identifier for the neptune instance, if omitted, Terraform will assign a random, unique identifier.
 * `identifier_prefix` - (Optional, Forces new resource) Creates a unique identifier beginning with the specified prefix. Conflicts with `identifier`.
 * `instance_class` - (Required) The instance class to use.
@@ -61,9 +61,9 @@ The following arguments are supported:
 * `publicly_accessible` - (Optional) Bool to control if instance is publicly accessible. Default is `false`.
 * `tags` - (Optional) A map of tags to assign to the instance. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `address` - The hostname of the instance. See also `endpoint` and `port`.
 * `arn` - Amazon Resource Name (ARN) of neptune instance
@@ -87,8 +87,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_neptune_cluster_instance` can be imported by using the instance identifier, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_neptune_cluster_instance` using the instance identifier. For example:
 
+```terraform
+import {
+  to = aws_neptune_cluster_instance.example
+  id = "my-instance"
+}
 ```
-$ terraform import aws_neptune_cluster_instance.example my-instance
+
+Using `terraform import`, import `aws_neptune_cluster_instance` using the instance identifier. For example:
+
+```console
+% terraform import aws_neptune_cluster_instance.example my-instance
 ```
diff --git a/website/docs/r/neptune_cluster_parameter_group.html.markdown b/website/docs/r/neptune_cluster_parameter_group.html.markdown
index 328c45d6d2d..4bf1ea2ba5e 100644
--- a/website/docs/r/neptune_cluster_parameter_group.html.markdown
+++ b/website/docs/r/neptune_cluster_parameter_group.html.markdown
@@ -27,7 +27,7 @@ resource "aws_neptune_cluster_parameter_group" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Optional, Forces new resource) The name of the neptune cluster parameter group. If omitted, Terraform will assign a random, unique name.
 * `name_prefix` - (Optional, Forces new resource) Creates a unique name beginning with the specified prefix. Conflicts with `name`.
@@ -42,9 +42,9 @@ Parameter blocks support the following:
 * `value` - (Required) The value of the neptune parameter.
 * `apply_method` - (Optional) Valid values are `immediate` and `pending-reboot`. Defaults to `pending-reboot`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The neptune cluster parameter group name.
 * `arn` - The ARN of the neptune cluster parameter group.
@@ -52,8 +52,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Neptune Cluster Parameter Groups can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Neptune Cluster Parameter Groups using the `name`. For example:
 
+```terraform
+import {
+  to = aws_neptune_cluster_parameter_group.cluster_pg
+  id = "production-pg-1"
+}
 ```
-$ terraform import aws_neptune_cluster_parameter_group.cluster_pg production-pg-1
+
+Using `terraform import`, import Neptune Cluster Parameter Groups using the `name`. For example:
+
+```console
+% terraform import aws_neptune_cluster_parameter_group.cluster_pg production-pg-1
 ```
diff --git a/website/docs/r/neptune_cluster_snapshot.html.markdown b/website/docs/r/neptune_cluster_snapshot.html.markdown
index 670aa024885..993fbdb37e3 100644
--- a/website/docs/r/neptune_cluster_snapshot.html.markdown
+++ b/website/docs/r/neptune_cluster_snapshot.html.markdown
@@ -21,14 +21,14 @@ resource "aws_neptune_cluster_snapshot" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `db_cluster_identifier` - (Required) The DB Cluster Identifier from which to take the snapshot.
 * `db_cluster_snapshot_identifier` - (Required) The Identifier for the snapshot.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `allocated_storage` - Specifies the allocated storage size in gigabytes (GB).
 * `availability_zones` - List of EC2 Availability Zones that instances in the DB cluster snapshot can be restored in.
@@ -51,8 +51,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_neptune_cluster_snapshot` can be imported by using the cluster snapshot identifier, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_neptune_cluster_snapshot` using the cluster snapshot identifier. For example:
 
+```terraform
+import {
+  to = aws_neptune_cluster_snapshot.example
+  id = "my-cluster-snapshot"
+}
 ```
-$ terraform import aws_neptune_cluster_snapshot.example my-cluster-snapshot
+
+Using `terraform import`, import `aws_neptune_cluster_snapshot` using the cluster snapshot identifier. For example:
+
+```console
+% terraform import aws_neptune_cluster_snapshot.example my-cluster-snapshot
 ```
diff --git a/website/docs/r/neptune_event_subscription.html.markdown b/website/docs/r/neptune_event_subscription.html.markdown
index 4040bfccf56..8262978b013 100644
--- a/website/docs/r/neptune_event_subscription.html.markdown
+++ b/website/docs/r/neptune_event_subscription.html.markdown
@@ -62,7 +62,7 @@ resource "aws_neptune_event_subscription" "default" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `enabled` - (Optional) A boolean flag to enable/disable the subscription. Defaults to true.
 * `event_categories` - (Optional) A list of event categories for a `source_type` that you want to subscribe to. Run `aws neptune describe-event-categories` to find all the event categories.
@@ -73,9 +73,9 @@ The following arguments are supported:
 * `source_type` - (Optional) The type of source that will be generating the events. Valid options are `db-instance`, `db-security-group`, `db-parameter-group`, `db-snapshot`, `db-cluster` or `db-cluster-snapshot`. If not set, all sources will be subscribed to.
 * `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The name of the Neptune event notification subscription.
 * `arn` - The Amazon Resource Name of the Neptune event notification subscription.
@@ -92,8 +92,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_neptune_event_subscription` can be imported by using the event subscription name, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_neptune_event_subscription` using the event subscription name. For example:
 
+```terraform
+import {
+  to = aws_neptune_event_subscription.example
+  id = "my-event-subscription"
+}
 ```
-$ terraform import aws_neptune_event_subscription.example my-event-subscription
+
+Using `terraform import`, import `aws_neptune_event_subscription` using the event subscription name. For example:
+
+```console
+% terraform import aws_neptune_event_subscription.example my-event-subscription
 ```
diff --git a/website/docs/r/neptune_global_cluster.html.markdown b/website/docs/r/neptune_global_cluster.html.markdown
index 79635b7e4df..733f39b9708 100644
--- a/website/docs/r/neptune_global_cluster.html.markdown
+++ b/website/docs/r/neptune_global_cluster.html.markdown
@@ -100,7 +100,7 @@ resource "aws_neptune_global_cluster" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `global_cluster_identifier` - (Required, Forces new resources) The global cluster identifier.
 * `deletion_protection` - (Optional) If the Global Cluster should have deletion protection enabled. The database can't be deleted when this value is set to `true`. The default is `false`.
@@ -118,9 +118,9 @@ The `timeouts` block allows you to specify [timeouts](https://www.terraform.io/d
 * `update` - (Defaults to 120 mins) Used when updating the Global Cluster members (time is per member)
 * `delete` - (Defaults to 5 mins) Used when deleting the Global Cluster members (time is per member)
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Global Cluster Amazon Resource Name (ARN)
 * `global_cluster_members` - Set of objects containing Global Cluster members.
@@ -131,13 +131,22 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_neptune_global_cluster` can be imported by using the Global Cluster identifier, e.g.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_neptune_global_cluster` using the Global Cluster identifier. For example:
 
+```terraform
+import {
+  to = aws_neptune_global_cluster.example
+  id = "example"
+}
 ```
-$ terraform import aws_neptune_global_cluster.example example
+
+Using `terraform import`, import `aws_neptune_global_cluster` using the Global Cluster identifier. For example:
+
+```console
+% terraform import aws_neptune_global_cluster.example example
 ```
 
-Certain resource arguments, like `source_db_cluster_identifier`, do not have an API method for reading the information after creation. If the argument is set in the Terraform configuration on an imported resource, Terraform will always show a difference. To workaround this behavior, either omit the argument from the Terraform configuration or use [`ignore_changes`](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html#ignore_changes) to hide the difference, e.g.
+Certain resource arguments, like `source_db_cluster_identifier`, do not have an API method for reading the information after creation. If the argument is set in the Terraform configuration on an imported resource, Terraform will always show a difference. To workaround this behavior, either omit the argument from the Terraform configuration or use [`ignore_changes`](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html#ignore_changes) to hide the difference. For example:
 
 ```terraform
 resource "aws_neptune_global_cluster" "example" {
diff --git a/website/docs/r/neptune_parameter_group.html.markdown b/website/docs/r/neptune_parameter_group.html.markdown
index 764bbf75e34..23eb8a7a431 100644
--- a/website/docs/r/neptune_parameter_group.html.markdown
+++ b/website/docs/r/neptune_parameter_group.html.markdown
@@ -26,7 +26,7 @@ resource "aws_neptune_parameter_group" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required, Forces new resource) The name of the Neptune parameter group.
 * `family` - (Required) The family of the Neptune parameter group.
@@ -40,9 +40,9 @@ Parameter blocks support the following:
 * `value` - (Required) The value of the Neptune parameter.
 * `apply_method` - (Optional) The apply method of the Neptune parameter. Valid values are `immediate` and `pending-reboot`. Defaults to `pending-reboot`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The Neptune parameter group name.
 * `arn` - The Neptune parameter group Amazon Resource Name (ARN).
@@ -50,8 +50,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Neptune Parameter Groups can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Neptune Parameter Groups using the `name`. For example:
 
+```terraform
+import {
+  to = aws_neptune_parameter_group.some_pg
+  id = "some-pg"
+}
 ```
-$ terraform import aws_neptune_parameter_group.some_pg some-pg
+
+Using `terraform import`, import Neptune Parameter Groups using the `name`. For example:
+
+```console
+% terraform import aws_neptune_parameter_group.some_pg some-pg
 ```
diff --git a/website/docs/r/neptune_subnet_group.html.markdown b/website/docs/r/neptune_subnet_group.html.markdown
index e6da462c2fb..ebaf32d32dc 100644
--- a/website/docs/r/neptune_subnet_group.html.markdown
+++ b/website/docs/r/neptune_subnet_group.html.markdown
@@ -25,7 +25,7 @@ resource "aws_neptune_subnet_group" "default" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Optional, Forces new resource) The name of the neptune subnet group. If omitted, Terraform will assign a random, unique name.
 * `name_prefix` - (Optional, Forces new resource) Creates a unique name beginning with the specified prefix. Conflicts with `name`.
@@ -33,9 +33,9 @@ The following arguments are supported:
 * `subnet_ids` - (Required) A list of VPC subnet IDs.
 * `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The neptune subnet group name.
 * `arn` - The ARN of the neptune subnet group.
@@ -43,8 +43,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Neptune Subnet groups can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Neptune Subnet groups using the `name`. For example:
 
+```terraform
+import {
+  to = aws_neptune_subnet_group.default
+  id = "production-subnet-group"
+}
 ```
-$ terraform import aws_neptune_subnet_group.default production-subnet-group
+
+Using `terraform import`, import Neptune Subnet groups using the `name`. For example:
+
+```console
+% terraform import aws_neptune_subnet_group.default production-subnet-group
 ```
diff --git a/website/docs/r/network_acl.html.markdown b/website/docs/r/network_acl.html.markdown
index d64bbbca8e4..640e32d5fa4 100644
--- a/website/docs/r/network_acl.html.markdown
+++ b/website/docs/r/network_acl.html.markdown
@@ -53,7 +53,7 @@ resource "aws_network_acl" "main" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `vpc_id` - (Required) The ID of the associated VPC.
 * `subnet_ids` - (Optional) A list of Subnet IDs to apply the ACL to
@@ -83,9 +83,9 @@ valid network mask.
 
 ~> Note: For more information on ICMP types and codes, see here: https://www.iana.org/assignments/icmp-parameters/icmp-parameters.xhtml
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the network ACL
 * `arn` - The ARN of the network ACL
@@ -94,8 +94,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Network ACLs can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Network ACLs using the `id`. For example:
 
+```terraform
+import {
+  to = aws_network_acl.main
+  id = "acl-7aaabd18"
+}
 ```
-$ terraform import aws_network_acl.main acl-7aaabd18
+
+Using `terraform import`, import Network ACLs using the `id`. For example:
+
+```console
+% terraform import aws_network_acl.main acl-7aaabd18
 ```
diff --git a/website/docs/r/network_acl_association.html.markdown b/website/docs/r/network_acl_association.html.markdown
index 18eb2300441..406d6e9f40d 100644
--- a/website/docs/r/network_acl_association.html.markdown
+++ b/website/docs/r/network_acl_association.html.markdown
@@ -25,13 +25,13 @@ resource "aws_network_acl_association" "main" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `network_acl_id` - (Required) The ID of the network ACL.
 * `subnet_id` - (Required) The ID of the associated Subnet.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the network ACL association
diff --git a/website/docs/r/network_acl_rule.html.markdown b/website/docs/r/network_acl_rule.html.markdown
index 38408ecf8b5..60caa015eb7 100644
--- a/website/docs/r/network_acl_rule.html.markdown
+++ b/website/docs/r/network_acl_rule.html.markdown
@@ -39,7 +39,7 @@ resource "aws_network_acl_rule" "bar" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `network_acl_id` - (Required) The ID of the network ACL.
 * `rule_number` - (Required) The rule number for the entry (for example, 100). ACL entries are processed in ascending order by rule number.
@@ -59,26 +59,46 @@ The following arguments are supported:
 
 ~> Note: For more information on ICMP types and codes, see here: https://www.iana.org/assignments/icmp-parameters/icmp-parameters.xhtml
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the network ACL Rule
 
 ## Import
 
-Individual rules can be imported using `NETWORK_ACL_ID:RULE_NUMBER:PROTOCOL:EGRESS`, where `PROTOCOL` can be a decimal (e.g., 6) or string (e.g., tcp) value.
-If importing a rule previously provisioned by Terraform, the `PROTOCOL` must be the input value used at creation time.
-For more information on protocol numbers and keywords, see here: https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import individual rules using `NETWORK_ACL_ID:RULE_NUMBER:PROTOCOL:EGRESS`, where `PROTOCOL` can be a decimal (such as "6") or string (such as "tcp") value. For example:
 
-For example, import a network ACL Rule with an argument like this:
+**NOTE:** If importing a rule previously provisioned by Terraform, the `PROTOCOL` must be the input value used at creation time. For more information on protocol numbers and keywords, see here: https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml.
+
+Using the procotol's string value:
+
+```terraform
+import {
+  to = aws_network_acl_rule.my_rule
+  id = "acl-7aaabd18:100:tcp:false"
+}
+```
+
+Using the procotol's decimal value:
+
+```terraform
+import {
+  to = aws_network_acl_rule.my_rule
+  id = "acl-7aaabd18:100:6:false"
+}
+```
+
+**Using `terraform import` to import** individual rules using `NETWORK_ACL_ID:RULE_NUMBER:PROTOCOL:EGRESS`, where `PROTOCOL` can be a decimal (such as "6") or string (such as "tcp") value. For example:
+
+Using the procotol's string value:
 
 ```console
-$ terraform import aws_network_acl_rule.my_rule acl-7aaabd18:100:tcp:false
+% terraform import aws_network_acl_rule.my_rule acl-7aaabd18:100:tcp:false
 ```
 
-Or by the procotol's decimal value:
+Using the procotol's decimal value:
 
 ```console
-$ terraform import aws_network_acl_rule.my_rule acl-7aaabd18:100:6:false
+% terraform import aws_network_acl_rule.my_rule acl-7aaabd18:100:6:false
 ```
diff --git a/website/docs/r/network_interface.html.markdown b/website/docs/r/network_interface.html.markdown
new file mode 100644
index 00000000000..6be0fbd43c6
--- /dev/null
+++ b/website/docs/r/network_interface.html.markdown
@@ -0,0 +1,105 @@
+---
+subcategory: "VPC (Virtual Private Cloud)"
+layout: "aws"
+page_title: "AWS: aws_network_interface"
+description: |-
+  Provides an Elastic network interface (ENI) resource.
+---
+
+# Resource: aws_network_interface
+
+Provides an Elastic network interface (ENI) resource.
+
+## Example Usage
+
+```terraform
+resource "aws_network_interface" "test" {
+  subnet_id       = aws_subnet.public_a.id
+  private_ips     = ["10.0.0.50"]
+  security_groups = [aws_security_group.web.id]
+
+  attachment {
+    instance     = aws_instance.test.id
+    device_index = 1
+  }
+}
+```
+
+### Example of Managing Multiple IPs on a Network Interface
+
+By default, private IPs are managed through the `private_ips` and `private_ips_count` arguments which manage IPs as a set of IPs that are configured without regard to order. For a new network interface, the same primary IP address is consistently selected from a given set of addresses, regardless of the order provided. However, modifications of the set of addresses of an existing interface will not alter the current primary IP address unless it has been removed from the set.
+
+In order to manage the private IPs as a sequentially ordered list, configure `private_ip_list_enabled` to `true` and use `private_ip_list` to manage the IPs. This will disable the `private_ips` and `private_ips_count` settings, which must be removed from the config file but are still exported. Note that changing the first address of `private_ip_list`, which is the primary, always requires a new interface.
+
+If you are managing a specific set or list of IPs, instead of just using `private_ips_count`, this is a potential workflow for also leveraging `private_ips_count` to have AWS automatically assign additional IP addresses:
+
+1. Comment out `private_ips`, `private_ip_list`, `private_ip_list_enabled` in your configuration
+2. Set the desired `private_ips_count` (count of the number of secondaries, the primary is not included)
+3. Apply to assign the extra IPs
+4. Remove `private_ips_count` and restore your settings from the first step
+5. Add the new IPs to your current settings
+6. Apply again to update the stored state
+
+This process can also be used to remove IP addresses in addition to the option of manually removing them. Adding IP addresses in a manually is more difficult because it requires knowledge of which addresses are available.
+
+## Argument Reference
+
+The following arguments are required:
+
+* `subnet_id` - (Required) Subnet ID to create the ENI in.
+
+The following arguments are optional:
+
+* `attachment` - (Optional) Configuration block to define the attachment of the ENI. See [Attachment](#attachment) below for more details!
+* `description` - (Optional) Description for the network interface.
+* `interface_type` - (Optional) Type of network interface to create. Set to `efa` for Elastic Fabric Adapter. Changing `interface_type` will cause the resource to be destroyed and re-created.
+* `ipv4_prefix_count` - (Optional) Number of IPv4 prefixes that AWS automatically assigns to the network interface.
+* `ipv4_prefixes` - (Optional) One or more IPv4 prefixes assigned to the network interface.
+* `ipv6_address_count` - (Optional) Number of IPv6 addresses to assign to a network interface. You can't use this option if specifying specific `ipv6_addresses`. If your subnet has the AssignIpv6AddressOnCreation attribute set to `true`, you can specify `0` to override this setting.
+* `ipv6_address_list_enabled` - (Optional) Whether `ipv6_address_list` is allowed and controls the IPs to assign to the ENI and `ipv6_addresses` and `ipv6_address_count` become read-only. Default false.
+* `ipv6_address_list` - (Optional) List of private IPs to assign to the ENI in sequential order.
+* `ipv6_addresses` - (Optional) One or more specific IPv6 addresses from the IPv6 CIDR block range of your subnet. Addresses are assigned without regard to order. You can't use this option if you're specifying `ipv6_address_count`.
+* `ipv6_prefix_count` - (Optional) Number of IPv6 prefixes that AWS automatically assigns to the network interface.
+* `ipv6_prefixes` - (Optional) One or more IPv6 prefixes assigned to the network interface.
+* `private_ip_list` - (Optional) List of private IPs to assign to the ENI in sequential order. Requires setting `private_ip_list_enabled` to `true`.
+* `private_ip_list_enabled` - (Optional) Whether `private_ip_list` is allowed and controls the IPs to assign to the ENI and `private_ips` and `private_ips_count` become read-only. Default false.
+* `private_ips` - (Optional) List of private IPs to assign to the ENI without regard to order.
+* `private_ips_count` - (Optional) Number of secondary private IPs to assign to the ENI. The total number of private IPs will be 1 + `private_ips_count`, as a primary private IP will be assiged to an ENI by default.
+* `security_groups` - (Optional) List of security group IDs to assign to the ENI.
+* `source_dest_check` - (Optional) Whether to enable source destination checking for the ENI. Default true.
+* `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Attachment
+
+The `attachment` block supports the following:
+
+* `instance` - (Required) ID of the instance to attach to.
+* `device_index` - (Required) Integer to define the devices index.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - ARN of the network interface.
+* `id` - ID of the network interface.
+* `mac_address` - MAC address of the network interface.
+* `owner_id` - AWS account ID of the owner of the network interface.
+* `private_dns_name` - Private DNS name of the network interface (IPv4).
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Network Interfaces using the `id`. For example:
+
+```terraform
+import {
+  to = aws_network_interface.test
+  id = "eni-e5aa89a3"
+}
+```
+
+Using `terraform import`, import Network Interfaces using the `id`. For example:
+
+```console
+% terraform import aws_network_interface.test eni-e5aa89a3
+```
diff --git a/website/docs/r/network_interface.markdown b/website/docs/r/network_interface.markdown
deleted file mode 100644
index 44a4d067761..00000000000
--- a/website/docs/r/network_interface.markdown
+++ /dev/null
@@ -1,96 +0,0 @@
----
-subcategory: "VPC (Virtual Private Cloud)"
-layout: "aws"
-page_title: "AWS: aws_network_interface"
-description: |-
-  Provides an Elastic network interface (ENI) resource.
----
-
-# Resource: aws_network_interface
-
-Provides an Elastic network interface (ENI) resource.
-
-## Example Usage
-
-```terraform
-resource "aws_network_interface" "test" {
-  subnet_id       = aws_subnet.public_a.id
-  private_ips     = ["10.0.0.50"]
-  security_groups = [aws_security_group.web.id]
-
-  attachment {
-    instance     = aws_instance.test.id
-    device_index = 1
-  }
-}
-```
-
-### Example of Managing Multiple IPs on a Network Interface
-
-By default, private IPs are managed through the `private_ips` and `private_ips_count` arguments which manage IPs as a set of IPs that are configured without regard to order. For a new network interface, the same primary IP address is consistently selected from a given set of addresses, regardless of the order provided. However, modifications of the set of addresses of an existing interface will not alter the current primary IP address unless it has been removed from the set.
-
-In order to manage the private IPs as a sequentially ordered list, configure `private_ip_list_enabled` to `true` and use `private_ip_list` to manage the IPs. This will disable the `private_ips` and `private_ips_count` settings, which must be removed from the config file but are still exported. Note that changing the first address of `private_ip_list`, which is the primary, always requires a new interface.
-
-If you are managing a specific set or list of IPs, instead of just using `private_ips_count`, this is a potential workflow for also leveraging `private_ips_count` to have AWS automatically assign additional IP addresses:
-
-1. Comment out `private_ips`, `private_ip_list`, `private_ip_list_enabled` in your configuration
-2. Set the desired `private_ips_count` (count of the number of secondaries, the primary is not included)
-3. Apply to assign the extra IPs
-4. Remove `private_ips_count` and restore your settings from the first step
-5. Add the new IPs to your current settings
-6. Apply again to update the stored state
-
-This process can also be used to remove IP addresses in addition to the option of manually removing them. Adding IP addresses in a manually is more difficult because it requires knowledge of which addresses are available.
-
-## Argument Reference
-
-The following arguments are required:
-
-* `subnet_id` - (Required) Subnet ID to create the ENI in.
-
-The following arguments are optional:
-
-* `attachment` - (Optional) Configuration block to define the attachment of the ENI. See [Attachment](#attachment) below for more details!
-* `description` - (Optional) Description for the network interface.
-* `interface_type` - (Optional) Type of network interface to create. Set to `efa` for Elastic Fabric Adapter. Changing `interface_type` will cause the resource to be destroyed and re-created.
-* `ipv4_prefix_count` - (Optional) Number of IPv4 prefixes that AWS automatically assigns to the network interface.
-* `ipv4_prefixes` - (Optional) One or more IPv4 prefixes assigned to the network interface.
-* `ipv6_address_count` - (Optional) Number of IPv6 addresses to assign to a network interface. You can't use this option if specifying specific `ipv6_addresses`. If your subnet has the AssignIpv6AddressOnCreation attribute set to `true`, you can specify `0` to override this setting.
-* `ipv6_address_list_enabled` - (Optional) Whether `ipv6_address_list` is allowed and controls the IPs to assign to the ENI and `ipv6_addresses` and `ipv6_address_count` become read-only. Default false.
-* `ipv6_address_list` - (Optional) List of private IPs to assign to the ENI in sequential order.
-* `ipv6_addresses` - (Optional) One or more specific IPv6 addresses from the IPv6 CIDR block range of your subnet. Addresses are assigned without regard to order. You can't use this option if you're specifying `ipv6_address_count`.
-* `ipv6_prefix_count` - (Optional) Number of IPv6 prefixes that AWS automatically assigns to the network interface.
-* `ipv6_prefixes` - (Optional) One or more IPv6 prefixes assigned to the network interface.
-* `private_ip_list` - (Optional) List of private IPs to assign to the ENI in sequential order. Requires setting `private_ip_list_enabled` to `true`.
-* `private_ip_list_enabled` - (Optional) Whether `private_ip_list` is allowed and controls the IPs to assign to the ENI and `private_ips` and `private_ips_count` become read-only. Default false.
-* `private_ips` - (Optional) List of private IPs to assign to the ENI without regard to order.
-* `private_ips_count` - (Optional) Number of secondary private IPs to assign to the ENI. The total number of private IPs will be 1 + `private_ips_count`, as a primary private IP will be assiged to an ENI by default.
-* `security_groups` - (Optional) List of security group IDs to assign to the ENI.
-* `source_dest_check` - (Optional) Whether to enable source destination checking for the ENI. Default true.
-* `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
-
-### Attachment
-
-The `attachment` block supports the following:
-
-* `instance` - (Required) ID of the instance to attach to.
-* `device_index` - (Required) Integer to define the devices index.
-
-## Attributes Reference
-
-In addition to all arguments above, the following attributes are exported:
-
-* `arn` - ARN of the network interface.
-* `id` - ID of the network interface.
-* `mac_address` - MAC address of the network interface.
-* `owner_id` - AWS account ID of the owner of the network interface.
-* `private_dns_name` - Private DNS name of the network interface (IPv4).
-* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
-
-## Import
-
-Network Interfaces can be imported using the `id`, e.g.,
-
-```
-$ terraform import aws_network_interface.test eni-e5aa89a3
-```
diff --git a/website/docs/r/network_interface_attachment.html.markdown b/website/docs/r/network_interface_attachment.html.markdown
index 5489704dfcd..41f50dddfa3 100644
--- a/website/docs/r/network_interface_attachment.html.markdown
+++ b/website/docs/r/network_interface_attachment.html.markdown
@@ -22,15 +22,15 @@ resource "aws_network_interface_attachment" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `instance_id` - (Required) Instance ID to attach.
 * `network_interface_id` - (Required) ENI ID to attach.
 * `device_index` - (Required) Network interface index (int).
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `instance_id` - Instance ID.
 * `network_interface_id` - Network interface ID.
@@ -39,8 +39,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Elastic network interface (ENI) Attachments can be imported using its Attachment ID e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Elastic network interface (ENI) Attachments using its Attachment ID. For example:
 
+```terraform
+import {
+  to = aws_network_interface_attachment.secondary_nic
+  id = "eni-attach-0a33842b4ec347c4c"
+}
 ```
-terraform import aws_network_interface_attachment.secondary_nic eni-attach-0a33842b4ec347c4c
+
+Using `terraform import`, import Elastic network interface (ENI) Attachments using its Attachment ID. For example:
+
+```console
+% terraform import aws_network_interface_attachment.secondary_nic eni-attach-0a33842b4ec347c4c
 ```
diff --git a/website/docs/r/network_interface_sg_attachment.html.markdown b/website/docs/r/network_interface_sg_attachment.html.markdown
index df3926b4fb1..43042fd34f0 100644
--- a/website/docs/r/network_interface_sg_attachment.html.markdown
+++ b/website/docs/r/network_interface_sg_attachment.html.markdown
@@ -89,16 +89,23 @@ resource "aws_network_interface_sg_attachment" "sg_attachment" {
 * `security_group_id` - (Required) The ID of the security group.
 * `network_interface_id` - (Required) The ID of the network interface to attach to.
 
-## Attributes Reference
+## Attribute Reference
 
-No additional attributes are exported.
+This resource exports no additional attributes.
 
 ## Import
 
-Network Interface Security Group attachments can be imported using the associated network interface ID and security group ID, separated by an underscore (`_`).
-
-For example:
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Network Interface Security Group attachments using the associated network interface ID and security group ID, separated by an underscore (`_`). For example:
 
+```terraform
+import {
+  to = aws_network_interface_sg_attachment.sg_attachment
+  id = "eni-1234567890abcdef0_sg-1234567890abcdef0"
+}
 ```
-$ terraform import aws_network_interface_sg_attachment.sg_attachment eni-1234567890abcdef0_sg-1234567890abcdef0
+
+Using `terraform import`, import Network Interface Security Group attachments using the associated network interface ID and security group ID, separated by an underscore (`_`). For example:
+
+```console
+% terraform import aws_network_interface_sg_attachment.sg_attachment eni-1234567890abcdef0_sg-1234567890abcdef0
 ```
diff --git a/website/docs/r/networkfirewall_firewall.html.markdown b/website/docs/r/networkfirewall_firewall.html.markdown
index 0faa98c428f..e27a757a012 100644
--- a/website/docs/r/networkfirewall_firewall.html.markdown
+++ b/website/docs/r/networkfirewall_firewall.html.markdown
@@ -30,7 +30,7 @@ resource "aws_networkfirewall_firewall" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `delete_protection` - (Optional) A boolean flag indicating whether it is possible to delete the firewall. Defaults to `false`.
 
@@ -66,9 +66,9 @@ The `subnet_mapping` block supports the following arguments:
 * `ip_address_type` - (Optional) The subnet's IP address type. Valida values: `"DUALSTACK"`, `"IPV4"`.
 * `subnet_id` - (Required) The unique identifier for the subnet.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The Amazon Resource Name (ARN) that identifies the firewall.
 
@@ -87,8 +87,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Network Firewall Firewalls can be imported using their `ARN`.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Network Firewall Firewalls using their `arn`. For example:
 
+```terraform
+import {
+  to = aws_networkfirewall_firewall.example
+  id = "arn:aws:network-firewall:us-west-1:123456789012:firewall/example"
+}
 ```
-$ terraform import aws_networkfirewall_firewall.example arn:aws:network-firewall:us-west-1:123456789012:firewall/example
+
+Using `terraform import`, import Network Firewall Firewalls using their `arn`. For example:
+
+```console
+% terraform import aws_networkfirewall_firewall.example arn:aws:network-firewall:us-west-1:123456789012:firewall/example
 ```
diff --git a/website/docs/r/networkfirewall_firewall_policy.html.markdown b/website/docs/r/networkfirewall_firewall_policy.html.markdown
index 7216826551d..d04d5ccc0e5 100644
--- a/website/docs/r/networkfirewall_firewall_policy.html.markdown
+++ b/website/docs/r/networkfirewall_firewall_policy.html.markdown
@@ -32,6 +32,36 @@ resource "aws_networkfirewall_firewall_policy" "example" {
 }
 ```
 
+## Policy with a HOME_NET Override
+
+```terraform
+resource "aws_networkfirewall_firewall_policy" "example" {
+  name = "example"
+
+  firewall_policy {
+    policy_variables {
+      rule_variables {
+        key = "HOME_NET"
+        ip_set {
+          definition = ["10.0.0.0/16", "10.1.0.0/24"]
+        }
+      }
+    }
+    stateless_default_actions          = ["aws:pass"]
+    stateless_fragment_default_actions = ["aws:drop"]
+    stateless_rule_group_reference {
+      priority     = 1
+      resource_arn = aws_networkfirewall_rule_group.example.arn
+    }
+  }
+
+  tags = {
+    Tag1 = "Value1"
+    Tag2 = "Value2"
+  }
+}
+```
+
 ## Policy with a Custom Action for Stateless Inspection
 
 ```terraform
@@ -58,7 +88,7 @@ resource "aws_networkfirewall_firewall_policy" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `description` - (Optional) A friendly description of the firewall policy.
 
@@ -81,6 +111,8 @@ The following arguments are supported:
 
 The `firewall_policy` block supports the following arguments:
 
+* `policy_variables` - (Optional). Contains variables that you can use to override default Suricata settings in your firewall policy. See [Rule Variables](#rule-variables) for details.
+
 * `stateful_default_actions` - (Optional) Set of actions to take on a packet if it does not match any stateful rules in the policy. This can only be specified if the policy has a `stateful_engine_options` block with a `rule_order` value of `STRICT_ORDER`. You can specify one of either or neither values of `aws:drop_strict` or `aws:drop_established`, as well as any combination of `aws:alert_strict` and `aws:alert_established`.
 
 * `stateful_engine_options` - (Optional) A configuration block that defines options on how the policy handles stateful rules. See [Stateful Engine Options](#stateful-engine-options) below for details.
@@ -97,6 +129,20 @@ In addition, you can specify custom actions that are compatible with your standa
 
 * `stateless_rule_group_reference` - (Optional) Set of configuration blocks containing references to the stateless rule groups that are used in the policy. See [Stateless Rule Group Reference](#stateless-rule-group-reference) below for details.
 
+### Rule Variables
+
+The `rule_variables` block supports the following arguments:
+
+* `key` - (Required) An alphanumeric string to identify the `ip_set`. Valid values: `HOME_NET`
+
+* `ip_set` - (Required) A configuration block that defines a set of IP addresses. See [IP Set](#ip-set) below for details.
+
+### IP Set
+
+The `ip_set` block supports the following argument:
+
+* `definition` - (Required) Set of IPv4 or IPv6 addresses in CIDR notation to use for the Suricata `HOME_NET` variable.
+
 ### Stateful Engine Options
 
 The `stateful_engine_options` block supports the following argument:
@@ -155,9 +201,9 @@ The `dimension` block supports the following argument:
 
 * `value` - (Required) The string value to use in the custom metric dimension.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The Amazon Resource Name (ARN) that identifies the firewall policy.
 
@@ -169,8 +215,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Network Firewall Policies can be imported using their `ARN`.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Network Firewall Policies using their `arn`. For example:
 
+```terraform
+import {
+  to = aws_networkfirewall_firewall_policy.example
+  id = "arn:aws:network-firewall:us-west-1:123456789012:firewall-policy/example"
+}
 ```
-$ terraform import aws_networkfirewall_firewall_policy.example arn:aws:network-firewall:us-west-1:123456789012:firewall-policy/example
+
+Using `terraform import`, import Network Firewall Policies using their `arn`. For example:
+
+```console
+% terraform import aws_networkfirewall_firewall_policy.example arn:aws:network-firewall:us-west-1:123456789012:firewall-policy/example
 ```
diff --git a/website/docs/r/networkfirewall_logging_configuration.html.markdown b/website/docs/r/networkfirewall_logging_configuration.html.markdown
index 44b5d9f4d71..7c40f9d7d71 100644
--- a/website/docs/r/networkfirewall_logging_configuration.html.markdown
+++ b/website/docs/r/networkfirewall_logging_configuration.html.markdown
@@ -66,7 +66,7 @@ resource "aws_networkfirewall_logging_configuration" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `firewall_arn` - (Required, Forces new resource) The Amazon Resource Name (ARN) of the Network Firewall firewall.
 
@@ -91,16 +91,25 @@ The `log_destination_config` block supports the following arguments:
 
 * `log_type` - (Required) The type of log to send. Valid values: `ALERT` or `FLOW`. Alert logs report traffic that matches a `StatefulRule` with an action setting that sends a log message. Flow logs are standard network traffic flow logs.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The Amazon Resource Name (ARN) of the associated firewall.
 
 ## Import
 
-Network Firewall Logging Configurations can be imported using the `firewall_arn` e.g
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Network Firewall Logging Configurations using the `firewall_arn`. For example:
 
+```terraform
+import {
+  to = aws_networkfirewall_logging_configuration.example
+  id = "arn:aws:network-firewall:us-west-1:123456789012:firewall/example"
+}
 ```
-$ terraform import aws_networkfirewall_logging_configuration.example arn:aws:network-firewall:us-west-1:123456789012:firewall/example
+
+Using `terraform import`, import Network Firewall Logging Configurations using the `firewall_arn`. For example:
+
+```console
+% terraform import aws_networkfirewall_logging_configuration.example arn:aws:network-firewall:us-west-1:123456789012:firewall/example
 ```
diff --git a/website/docs/r/networkfirewall_resource_policy.html.markdown b/website/docs/r/networkfirewall_resource_policy.html.markdown
index daccee55621..9c37a95fe8a 100644
--- a/website/docs/r/networkfirewall_resource_policy.html.markdown
+++ b/website/docs/r/networkfirewall_resource_policy.html.markdown
@@ -63,22 +63,31 @@ resource "aws_networkfirewall_resource_policy" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `policy` - (Required) JSON formatted policy document that controls access to the Network Firewall resource. The policy must be provided **without whitespaces**.  We recommend using [jsonencode](https://www.terraform.io/docs/configuration/functions/jsonencode.html) for formatting as seen in the examples above. For more details, including available policy statement Actions, see the [Policy](https://docs.aws.amazon.com/network-firewall/latest/APIReference/API_PutResourcePolicy.html#API_PutResourcePolicy_RequestSyntax) parameter in the AWS API documentation.
 
 * `resource_arn` - (Required, Forces new resource) The Amazon Resource Name (ARN) of the rule group or firewall policy.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The Amazon Resource Name (ARN) of the rule group or firewall policy associated with the resource policy.
 
 ## Import
 
-Network Firewall Resource Policies can be imported using the `resource_arn` e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Network Firewall Resource Policies using the `resource_arn`. For example:
 
+```terraform
+import {
+  to = aws_networkfirewall_resource_policy.example
+  id = "aws_networkfirewall_rule_group.example arn:aws:network-firewall:us-west-1:123456789012:stateful-rulegroup/example"
+}
 ```
-$ terraform import aws_networkfirewall_resource_policy.example aws_networkfirewall_rule_group.example arn:aws:network-firewall:us-west-1:123456789012:stateful-rulegroup/example
+
+Using `terraform import`, import Network Firewall Resource Policies using the `resource_arn`. For example:
+
+```console
+% terraform import aws_networkfirewall_resource_policy.example aws_networkfirewall_rule_group.example arn:aws:network-firewall:us-west-1:123456789012:stateful-rulegroup/example
 ```
diff --git a/website/docs/r/networkfirewall_rule_group.html.markdown b/website/docs/r/networkfirewall_rule_group.html.markdown
index 5dc9f367057..ed93d7dcf10 100644
--- a/website/docs/r/networkfirewall_rule_group.html.markdown
+++ b/website/docs/r/networkfirewall_rule_group.html.markdown
@@ -259,7 +259,7 @@ resource "aws_networkfirewall_rule_group" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `capacity` - (Required, Forces new resource) The maximum number of operating resources that this rule group can use. For a stateless rule group, the capacity required is the sum of the capacity requirements of the individual rules. For a stateful rule group, the minimum capacity required is the number of individual rules.
 
@@ -382,7 +382,7 @@ The `rules_source_list` block supports the following arguments:
 
 The `stateful_rule` block supports the following arguments:
 
-* `action` - (Required) Action to take with packets in a traffic flow when the flow matches the stateful rule criteria. For all actions, AWS Network Firewall performs the specified action and discontinues stateful inspection of the traffic flow. Valid values: `ALERT`, `DROP` or `PASS`.
+* `action` - (Required) Action to take with packets in a traffic flow when the flow matches the stateful rule criteria. For all actions, AWS Network Firewall performs the specified action and discontinues stateful inspection of the traffic flow. Valid values: `ALERT`, `DROP`, `PASS`, or `REJECT`.
 
 * `header` - (Required) A configuration block containing the stateful 5-tuple inspection criteria for the rule, used to inspect traffic flows. See [Header](#header) below for details.
 
@@ -516,9 +516,9 @@ Valid values: `FIN`, `SYN`, `RST`, `PSH`, `ACK`, `URG`, `ECE`, `CWR`.
 * `masks` - (Optional) Set of flags to consider in the inspection. To inspect all flags, leave this empty.
 Valid values: `FIN`, `SYN`, `RST`, `PSH`, `ACK`, `URG`, `ECE`, `CWR`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The Amazon Resource Name (ARN) that identifies the rule group.
 
@@ -530,8 +530,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Network Firewall Rule Groups can be imported using their `ARN`.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Network Firewall Rule Groups using their `arn`. For example:
 
+```terraform
+import {
+  to = aws_networkfirewall_rule_group.example
+  id = "arn:aws:network-firewall:us-west-1:123456789012:stateful-rulegroup/example"
+}
 ```
-$ terraform import aws_networkfirewall_rule_group.example arn:aws:network-firewall:us-west-1:123456789012:stateful-rulegroup/example
+
+Using `terraform import`, import Network Firewall Rule Groups using their `arn`. For example:
+
+```console
+% terraform import aws_networkfirewall_rule_group.example arn:aws:network-firewall:us-west-1:123456789012:stateful-rulegroup/example
 ```
diff --git a/website/docs/r/networkmanager_attachment_accepter.html.markdown b/website/docs/r/networkmanager_attachment_accepter.html.markdown
index 8b4d35bfbff..cb0da00a9c6 100644
--- a/website/docs/r/networkmanager_attachment_accepter.html.markdown
+++ b/website/docs/r/networkmanager_attachment_accepter.html.markdown
@@ -37,9 +37,9 @@ The following arguments are required:
 - `attachment_id` - (Required) The ID of the attachment.
 - `attachment_type` - (Required) The type of attachment. Valid values can be found in the [AWS Documentation](https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_ListAttachments.html#API_ListAttachments_RequestSyntax)
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 - `attachment_policy_rule_number` - The policy rule number associated with the attachment.
 - `core_network_arn` - The ARN of a core network.
diff --git a/website/docs/r/networkmanager_connect_attachment.html.markdown b/website/docs/r/networkmanager_connect_attachment.html.markdown
index e70c363c2e6..10beee0dfcd 100644
--- a/website/docs/r/networkmanager_connect_attachment.html.markdown
+++ b/website/docs/r/networkmanager_connect_attachment.html.markdown
@@ -70,15 +70,19 @@ The following arguments are required:
 - `core_network_id` - (Required) The ID of a core network where you want to create the attachment.
 - `transport_attachment_id` - (Required) The ID of the attachment between the two connections.
 - `edge_location` - (Required) The Region where the edge is located.
-- `options` - (Required) Options for creating an attachment.
+- `options` - (Required) Options block. See [options](#options) for more information.
 
 The following arguments are optional:
 
 - `tags` - (Optional) Key-value tags for the attachment. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+### options
 
-In addition to all arguments above, the following attributes are exported:
+* `protocol` - (Required) The protocol used for the attachment connection. Possible values are `GRE` and `NO_ENCAP`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
 
 - `arn` - The ARN of the attachment.
 - `attachment_policy_rule_number` - The policy rule number associated with the attachment.
@@ -95,8 +99,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_networkmanager_connect_attachment` can be imported using the attachment ID, e.g.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_networkmanager_connect_attachment` using the attachment ID. For example:
 
+```terraform
+import {
+  to = aws_networkmanager_connect_attachment.example
+  id = "attachment-0f8fa60d2238d1bd8"
+}
 ```
-$ terraform import aws_networkmanager_connect_attachment.example attachment-0f8fa60d2238d1bd8
+
+Using `terraform import`, import `aws_networkmanager_connect_attachment` using the attachment ID. For example:
+
+```console
+% terraform import aws_networkmanager_connect_attachment.example attachment-0f8fa60d2238d1bd8
 ```
diff --git a/website/docs/r/networkmanager_connect_peer.html.markdown b/website/docs/r/networkmanager_connect_peer.html.markdown
index cb95f708b67..91a942a9ff6 100644
--- a/website/docs/r/networkmanager_connect_peer.html.markdown
+++ b/website/docs/r/networkmanager_connect_peer.html.markdown
@@ -84,23 +84,52 @@ resource "aws_networkmanager_connect_peer" "example" {
 }
 ```
 
+### Usage with a Tunnel-less Connect attachment
+
+```terraform
+resource "aws_networkmanager_vpc_attachment" "example" {
+  subnet_arns     = aws_subnet.example[*].arn
+  core_network_id = awscc_networkmanager_core_network.example.id
+  vpc_arn         = aws_vpc.example.arn
+}
+
+resource "aws_networkmanager_connect_attachment" "example" {
+  core_network_id         = awscc_networkmanager_core_network.example.id
+  transport_attachment_id = aws_networkmanager_vpc_attachment.example.id
+  edge_location           = aws_networkmanager_vpc_attachment.example.edge_location
+  options {
+    protocol = "NO_ENCAP"
+  }
+}
+
+resource "aws_networkmanager_connect_peer" "example" {
+  connect_attachment_id = aws_networkmanager_connect_attachment.example.id
+  peer_address          = "127.0.0.1"
+  bgp_options {
+    peer_asn = 65000
+  }
+  subnet_arn = aws_subnet.test2.arn
+}
+```
+
 ## Argument Reference
 
 The following arguments are required:
 
 - `connect_attachment_id` - (Required) The ID of the connection attachment.
-- `inside_cidr_blocks` - (Required) The inside IP addresses used for BGP peering.
 - `peer_address` - (Required) The Connect peer address.
 
 The following arguments are optional:
 
 - `bgp_options` (Optional) The Connect peer BGP options.
 - `core_network_address` (Optional) A Connect peer core network address.
+- `inside_cidr_blocks` - (Optional) The inside IP addresses used for BGP peering. Required when the Connect attachment protocol is `GRE`. See [`aws_networkmanager_connect_attachment`](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/networkmanager_connect_attachment) for details.
+- `subnet_arn` - (Optional) The subnet ARN for the Connect peer. Required when the Connect attachment protocol is `NO_ENCAP`. See [`aws_networkmanager_connect_attachment`](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/networkmanager_connect_attachment) for details.
 - `tags` - (Optional) Key-value tags for the attachment. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 - `arn` - The ARN of the attachment.
 - `configuration` - The configuration of the Connect peer.
@@ -112,8 +141,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_networkmanager_connect_peer` can be imported using the connect peer ID, e.g.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_networkmanager_connect_peer` using the connect peer ID. For example:
 
+```terraform
+import {
+  to = aws_networkmanager_connect_peer.example
+  id = "connect-peer-061f3e96275db1acc"
+}
 ```
-$ terraform import aws_networkmanager_connect_peer.example connect-peer-061f3e96275db1acc
+
+Using `terraform import`, import `aws_networkmanager_connect_peer` using the connect peer ID. For example:
+
+```console
+% terraform import aws_networkmanager_connect_peer.example connect-peer-061f3e96275db1acc
 ```
diff --git a/website/docs/r/networkmanager_connection.html.markdown b/website/docs/r/networkmanager_connection.html.markdown
index c599dae11be..e1bb2a5d8a1 100644
--- a/website/docs/r/networkmanager_connection.html.markdown
+++ b/website/docs/r/networkmanager_connection.html.markdown
@@ -23,7 +23,7 @@ resource "aws_networkmanager_connection" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `connected_device_id` - (Required) The ID of the second device in the connection.
 * `connected_link_id` - (Optional) The ID of the link for the second device.
@@ -33,17 +33,26 @@ The following arguments are supported:
 * `link_id` - (Optional) The ID of the link for the first device.
 * `tags` - (Optional) Key-value tags for the connection. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The Amazon Resource Name (ARN) of the connection.
 * `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
 
 ## Import
 
-`aws_networkmanager_connection` can be imported using the connection ARN, e.g.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_networkmanager_connection` using the connection ARN. For example:
 
+```terraform
+import {
+  to = aws_networkmanager_connection.example
+  id = "arn:aws:networkmanager::123456789012:device/global-network-0d47f6t230mz46dy4/connection-07f6fd08867abc123"
+}
 ```
-$ terraform import aws_networkmanager_connection.example arn:aws:networkmanager::123456789012:device/global-network-0d47f6t230mz46dy4/connection-07f6fd08867abc123
+
+Using `terraform import`, import `aws_networkmanager_connection` using the connection ARN. For example:
+
+```console
+% terraform import aws_networkmanager_connection.example arn:aws:networkmanager::123456789012:device/global-network-0d47f6t230mz46dy4/connection-07f6fd08867abc123
 ```
diff --git a/website/docs/r/networkmanager_core_network.html.markdown b/website/docs/r/networkmanager_core_network.html.markdown
index f176559516f..62c2f5ea062 100644
--- a/website/docs/r/networkmanager_core_network.html.markdown
+++ b/website/docs/r/networkmanager_core_network.html.markdown
@@ -43,7 +43,78 @@ resource "aws_networkmanager_core_network" "example" {
 
 ### With VPC Attachment (Single Region)
 
-The example below illustrates the scenario where your policy document has static routes pointing to VPC attachments and you want to attach your VPCs to the core network before applying the desired policy document. Set the `create_base_policy` argument to `true` if your core network does not currently have any `LIVE` policies (e.g. this is the first `terraform apply` with the core network resource), since a `LIVE` policy is required before VPCs can be attached to the core network. Otherwise, if your core network already has a `LIVE` policy, you may exclude the `create_base_policy` argument.
+The example below illustrates the scenario where your policy document has static routes pointing to VPC attachments and you want to attach your VPCs to the core network before applying the desired policy document. Set the `create_base_policy` argument to `true` if your core network does not currently have any `LIVE` policies (e.g. this is the first `terraform apply` with the core network resource), since a `LIVE` policy is required before VPCs can be attached to the core network. Otherwise, if your core network already has a `LIVE` policy, you may exclude the `create_base_policy` argument. There are 2 options to implement this:
+
+- Option 1: Use the `base_policy_document` argument that allows the most customizations to a base policy. Use this to customize the `edge_locations` `asn`. In the example below, `us-west-2` and ASN `65500` are used in the base policy.
+- Option 2: Use the `create_base_policy` argument only. This creates a base policy in the region specified in the `provider` block.
+
+#### Option 1 - using base_policy_document
+
+If you require a custom ASN for the edge location, please use the `base_policy_document` argument to pass a specific ASN. For example:
+
+```terraform
+resource "aws_networkmanager_global_network" "example" {}
+
+data "aws_networkmanager_core_network_policy_document" "base" {
+  core_network_configuration {
+    asn_ranges = ["65022-65534"]
+
+    edge_locations {
+      location = "us-west-2"
+      asn      = "65500"
+    }
+  }
+
+  segments {
+    name = "segment"
+  }
+}
+
+resource "aws_networkmanager_core_network" "example" {
+  global_network_id    = aws_networkmanager_global_network.example.id
+  base_policy_document = data.aws_networkmanager_core_network_policy_document.base.json
+  create_base_policy   = true
+}
+
+data "aws_networkmanager_core_network_policy_document" "example" {
+  core_network_configuration {
+    asn_ranges = ["65022-65534"]
+
+    edge_locations {
+      location = "us-west-2"
+      asn      = "65500"
+    }
+  }
+
+  segments {
+    name = "segment"
+  }
+
+  segment_actions {
+    action  = "create-route"
+    segment = "segment"
+    destination_cidr_blocks = [
+      "0.0.0.0/0"
+    ]
+    destinations = [
+      aws_networkmanager_vpc_attachment.example.id,
+    ]
+  }
+}
+
+resource "aws_networkmanager_core_network_policy_attachment" "example" {
+  core_network_id = aws_networkmanager_core_network.example.id
+  policy_document = data.aws_networkmanager_core_network_policy_document.example.json
+}
+
+resource "aws_networkmanager_vpc_attachment" "example" {
+  core_network_id = aws_networkmanager_core_network.example.id
+  subnet_arns     = aws_subnet.example[*].arn
+  vpc_arn         = aws_vpc.example.arn
+}
+```
+
+#### Option 2 - create_base_policy only
 
 ```terraform
 resource "aws_networkmanager_global_network" "example" {}
@@ -92,7 +163,109 @@ resource "aws_networkmanager_vpc_attachment" "example" {
 
 ### With VPC Attachment (Multi-Region)
 
-The example below illustrates the scenario where your policy document has static routes pointing to VPC attachments and you want to attach your VPCs to the core network before applying the desired policy document. Set the `create_base_policy` argument of the [`aws_networkmanager_core_network` resource](/docs/providers/aws/r/networkmanager_core_network.html) to `true` if your core network does not currently have any `LIVE` policies (e.g. this is the first `terraform apply` with the core network resource), since a `LIVE` policy is required before VPCs can be attached to the core network. Otherwise, if your core network already has a `LIVE` policy, you may exclude the `create_base_policy` argument. For multi-region in a core network that does not yet have a `LIVE` policy, pass a list of regions to the `aws_networkmanager_core_network` `base_policy_regions` argument. In the example below, `us-west-2` and `us-east-1` are specified in the base policy.
+The example below illustrates the scenario where your policy document has static routes pointing to VPC attachments and you want to attach your VPCs to the core network before applying the desired policy document. Set the `create_base_policy` argument of the [`aws_networkmanager_core_network` resource](/docs/providers/aws/r/networkmanager_core_network.html) to `true` if your core network does not currently have any `LIVE` policies (e.g. this is the first `terraform apply` with the core network resource), since a `LIVE` policy is required before VPCs can be attached to the core network. Otherwise, if your core network already has a `LIVE` policy, you may exclude the `create_base_policy` argument. For multi-region in a core network that does not yet have a `LIVE` policy, there are 2 options:
+
+- Option 1: Use the `base_policy_document` argument that allows the most customizations to a base policy. Use this to customize the `edge_locations` `asn`. In the example below, `us-west-2`, `us-east-1` and specific ASNs are used in the base policy.
+- Option 2: Pass a list of regions to the `aws_networkmanager_core_network` `base_policy_regions` argument. In the example below, `us-west-2` and `us-east-1` are specified in the base policy.
+
+#### Option 1 - using base_policy_document
+
+```terraform
+resource "aws_networkmanager_global_network" "example" {}
+
+data "aws_networkmanager_core_network_policy_document" "base" {
+  core_network_configuration {
+    asn_ranges = ["65022-65534"]
+
+    edge_locations {
+      location = "us-west-2"
+      asn      = "65500"
+    }
+
+    edge_locations {
+      location = "us-east-1"
+      asn      = "65501"
+    }
+  }
+
+  segments {
+    name = "segment"
+  }
+}
+
+resource "aws_networkmanager_core_network" "example" {
+  global_network_id    = aws_networkmanager_global_network.example.id
+  base_policy_document = data.aws_networkmanager_core_network_policy_document.base.json
+  create_base_policy   = true
+}
+
+data "aws_networkmanager_core_network_policy_document" "example" {
+  core_network_configuration {
+    asn_ranges = ["65022-65534"]
+
+    edge_locations {
+      location = "us-west-2"
+      asn      = "65500"
+    }
+
+    edge_locations {
+      location = "us-east-1"
+      asn      = "65501"
+    }
+  }
+
+  segments {
+    name = "segment"
+  }
+
+  segments {
+    name = "segment2"
+  }
+
+  segment_actions {
+    action  = "create-route"
+    segment = "segment"
+    destination_cidr_blocks = [
+      "10.0.0.0/16"
+    ]
+    destinations = [
+      aws_networkmanager_vpc_attachment.example_us_west_2.id,
+    ]
+  }
+
+  segment_actions {
+    action  = "create-route"
+    segment = "segment"
+    destination_cidr_blocks = [
+      "10.1.0.0/16"
+    ]
+    destinations = [
+      aws_networkmanager_vpc_attachment.example_us_east_1.id,
+    ]
+  }
+}
+
+resource "aws_networkmanager_core_network_policy_attachment" "example" {
+  core_network_id = aws_networkmanager_core_network.example.id
+  policy_document = data.aws_networkmanager_core_network_policy_document.example.json
+}
+
+resource "aws_networkmanager_vpc_attachment" "example_us_west_2" {
+  core_network_id = aws_networkmanager_core_network.example.id
+  subnet_arns     = aws_subnet.example_us_west_2[*].arn
+  vpc_arn         = aws_vpc.example_us_west_2.arn
+}
+
+resource "aws_networkmanager_vpc_attachment" "example_us_east_1" {
+  provider = "alternate"
+
+  core_network_id = aws_networkmanager_core_network.example.id
+  subnet_arns     = aws_subnet.example_us_east_1[*].arn
+  vpc_arn         = aws_vpc.example_us_east_1.arn
+}
+```
+
+#### Option 2 - using base_policy_regions
 
 ```terraform
 resource "aws_networkmanager_global_network" "example" {}
@@ -169,11 +342,12 @@ resource "aws_networkmanager_vpc_attachment" "example_us_east_1" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `description` - (Optional) Description of the Core Network.
-* `base_policy_region` - (Optional, **Deprecated** use the `base_policy_regions` argument instead) The base policy created by setting the `create_base_policy` argument to `true` requires a region to be set in the `edge-locations`, `location` key. If `base_policy_region` is not specified, the region used in the base policy defaults to the region specified in the `provider` block.
-* `base_policy_regions` - (Optional) A list of regions to add to the base policy. The base policy created by setting the `create_base_policy` argument to `true` requires one or more regions to be set in the `edge-locations`, `location` key. If `base_policy_regions` is not specified, the region used in the base policy defaults to the region specified in the `provider` block.
+* `base_policy_document` - (Optional, conflicts with `base_policy_region`, `base_policy_regions`) Sets the base policy document for the core network. Refer to the [Core network policies documentation](https://docs.aws.amazon.com/network-manager/latest/cloudwan/cloudwan-policy-change-sets.html) for more information.
+* `base_policy_region` - (Optional, **Deprecated** use the `base_policy_regions` or `base_policy_document` argument instead) The base policy created by setting the `create_base_policy` argument to `true` requires a region to be set in the `edge-locations`, `location` key. If `base_policy_region` is not specified, the region used in the base policy defaults to the region specified in the `provider` block.
+* `base_policy_regions` - (Optional, conflicts with `base_policy_region`, `base_policy_document`) A list of regions to add to the base policy. The base policy created by setting the `create_base_policy` argument to `true` requires one or more regions to be set in the `edge-locations`, `location` key. If `base_policy_regions` is not specified, the region used in the base policy defaults to the region specified in the `provider` block.
 * `create_base_policy` - (Optional) Specifies whether to create a base policy when a core network is created or updated. A base policy is created and set to `LIVE` to allow attachments to the core network (e.g. VPC Attachments) before applying a policy document provided using the [`aws_networkmanager_core_network_policy_attachment` resource](/docs/providers/aws/r/networkmanager_core_network_policy_attachment.html). This base policy is needed if your core network does not have any `LIVE` policies and your policy document has static routes pointing to VPC attachments and you want to attach your VPCs to the core network before applying the desired policy document. Valid values are `true` or `false`. An example of this Terraform snippet can be found above [for VPC Attachment in a single region](#with-vpc-attachment-single-region) and [for VPC Attachment multi-region](#with-vpc-attachment-multi-region). An example base policy is shown below. This base policy is overridden with the policy that you specify in the [`aws_networkmanager_core_network_policy_attachment` resource](/docs/providers/aws/r/networkmanager_core_network_policy_attachment.html).
 
 ```json
@@ -212,9 +386,9 @@ The following arguments are supported:
 * `delete` - (Default `30m`)
 * `update` - (Default `30m`)
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Core Network Amazon Resource Name (ARN).
 * `created_at` - Timestamp when a core network was created.
@@ -242,8 +416,17 @@ The `segments` configuration block supports the following arguments:
 
 ## Import
 
-`aws_networkmanager_core_network` can be imported using the core network ID, e.g.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_networkmanager_core_network` using the core network ID. For example:
 
+```terraform
+import {
+  to = aws_networkmanager_core_network.example
+  id = "core-network-0d47f6t230mz46dy4"
+}
 ```
-$ terraform import aws_networkmanager_core_network.example core-network-0d47f6t230mz46dy4
+
+Using `terraform import`, import `aws_networkmanager_core_network` using the core network ID. For example:
+
+```console
+% terraform import aws_networkmanager_core_network.example core-network-0d47f6t230mz46dy4
 ```
diff --git a/website/docs/r/networkmanager_core_network_policy_attachment.html.markdown b/website/docs/r/networkmanager_core_network_policy_attachment.html.markdown
index 841aea6e0e0..3bafbf8a9f9 100644
--- a/website/docs/r/networkmanager_core_network_policy_attachment.html.markdown
+++ b/website/docs/r/networkmanager_core_network_policy_attachment.html.markdown
@@ -29,7 +29,76 @@ resource "aws_networkmanager_core_network_policy_attachment" "example" {
 
 ### With VPC Attachment (Single Region)
 
-The example below illustrates the scenario where your policy document has static routes pointing to VPC attachments and you want to attach your VPCs to the core network before applying the desired policy document. Set the `create_base_policy` argument of the [`aws_networkmanager_core_network` resource](/docs/providers/aws/r/networkmanager_core_network.html) to `true` if your core network does not currently have any `LIVE` policies (e.g. this is the first `terraform apply` with the core network resource), since a `LIVE` policy is required before VPCs can be attached to the core network. Otherwise, if your core network already has a `LIVE` policy, you may exclude the `create_base_policy` argument.
+The example below illustrates the scenario where your policy document has static routes pointing to VPC attachments and you want to attach your VPCs to the core network before applying the desired policy document. Set the `create_base_policy` argument of the [`aws_networkmanager_core_network` resource](/docs/providers/aws/r/networkmanager_core_network.html) to `true` if your core network does not currently have any `LIVE` policies (e.g. this is the first `terraform apply` with the core network resource), since a `LIVE` policy is required before VPCs can be attached to the core network. Otherwise, if your core network already has a `LIVE` policy, you may exclude the `create_base_policy` argument. There are 2 options to implement this:
+
+- Option 1: Use the `base_policy_document` argument in the [`aws_networkmanager_core_network` resource](/docs/providers/aws/r/networkmanager_core_network.html) that allows the most customizations to a base policy. Use this to customize the `edge_locations` `asn`. In the example below, `us-west-2` and ASN `65500` are used in the base policy.
+- Option 2: Use the `create_base_policy` argument only. This creates a base policy in the region specified in the `provider` block.
+
+#### Option 1 - using base_policy_document
+
+```terraform
+resource "aws_networkmanager_global_network" "example" {}
+
+data "aws_networkmanager_core_network_policy_document" "base" {
+  core_network_configuration {
+    asn_ranges = ["65022-65534"]
+
+    edge_locations {
+      location = "us-west-2"
+      asn      = "65500"
+    }
+  }
+
+  segments {
+    name = "segment"
+  }
+}
+
+resource "aws_networkmanager_core_network" "example" {
+  global_network_id    = aws_networkmanager_global_network.example.id
+  base_policy_document = data.aws_networkmanager_core_network_policy_document.base.json
+  create_base_policy   = true
+}
+
+data "aws_networkmanager_core_network_policy_document" "example" {
+  core_network_configuration {
+    asn_ranges = ["65022-65534"]
+
+    edge_locations {
+      location = "us-west-2"
+      asn      = "65500"
+    }
+  }
+
+  segments {
+    name = "segment"
+  }
+
+  segment_actions {
+    action  = "create-route"
+    segment = "segment"
+    destination_cidr_blocks = [
+      "0.0.0.0/0"
+    ]
+    destinations = [
+      aws_networkmanager_vpc_attachment.example.id,
+    ]
+  }
+}
+
+resource "aws_networkmanager_core_network_policy_attachment" "example" {
+  core_network_id = aws_networkmanager_core_network.example.id
+  policy_document = data.aws_networkmanager_core_network_policy_document.example.json
+}
+
+resource "aws_networkmanager_vpc_attachment" "example" {
+  core_network_id = aws_networkmanager_core_network.example.id
+  subnet_arns     = aws_subnet.example[*].arn
+  vpc_arn         = aws_vpc.example.arn
+}
+```
+
+#### Option 2 - create_base_policy only
 
 ```terraform
 resource "aws_networkmanager_global_network" "example" {}
@@ -78,7 +147,109 @@ resource "aws_networkmanager_vpc_attachment" "example" {
 
 ### With VPC Attachment (Multi-Region)
 
-The example below illustrates the scenario where your policy document has static routes pointing to VPC attachments and you want to attach your VPCs to the core network before applying the desired policy document. Set the `create_base_policy` argument of the [`aws_networkmanager_core_network` resource](/docs/providers/aws/r/networkmanager_core_network.html) to `true` if your core network does not currently have any `LIVE` policies (e.g. this is the first `terraform apply` with the core network resource), since a `LIVE` policy is required before VPCs can be attached to the core network. Otherwise, if your core network already has a `LIVE` policy, you may exclude the `create_base_policy` argument. For multi-region in a core network that does not yet have a `LIVE` policy, pass a list of regions to the `aws_networkmanager_core_network` `base_policy_regions` argument. In the example below, `us-west-2` and `us-east-1` are specified in the base policy.
+The example below illustrates the scenario where your policy document has static routes pointing to VPC attachments and you want to attach your VPCs to the core network before applying the desired policy document. Set the `create_base_policy` argument of the [`aws_networkmanager_core_network` resource](/docs/providers/aws/r/networkmanager_core_network.html) to `true` if your core network does not currently have any `LIVE` policies (e.g. this is the first `terraform apply` with the core network resource), since a `LIVE` policy is required before VPCs can be attached to the core network. Otherwise, if your core network already has a `LIVE` policy, you may exclude the `create_base_policy` argument. For multi-region in a core network that does not yet have a `LIVE` policy, there are 2 options:
+
+- Option 1: Use the `base_policy_document` argument that allows the most customizations to a base policy. Use this to customize the `edge_locations` `asn`. In the example below, `us-west-2`, `us-east-1` and specific ASNs are used in the base policy.
+- Option 2: Pass a list of regions to the [`aws_networkmanager_core_network` resource](/docs/providers/aws/r/networkmanager_core_network.html) `base_policy_regions` argument. In the example below, `us-west-2` and `us-east-1` are specified in the base policy.
+
+#### Option 1 - using base_policy_document
+
+```terraform
+resource "aws_networkmanager_global_network" "example" {}
+
+data "aws_networkmanager_core_network_policy_document" "base" {
+  core_network_configuration {
+    asn_ranges = ["65022-65534"]
+
+    edge_locations {
+      location = "us-west-2"
+      asn      = "65500"
+    }
+
+    edge_locations {
+      location = "us-east-1"
+      asn      = "65501"
+    }
+  }
+
+  segments {
+    name = "segment"
+  }
+}
+
+resource "aws_networkmanager_core_network" "example" {
+  global_network_id    = aws_networkmanager_global_network.example.id
+  base_policy_document = data.aws_networkmanager_core_network_policy_document.base.json
+  create_base_policy   = true
+}
+
+data "aws_networkmanager_core_network_policy_document" "example" {
+  core_network_configuration {
+    asn_ranges = ["65022-65534"]
+
+    edge_locations {
+      location = "us-west-2"
+      asn      = "65500"
+    }
+
+    edge_locations {
+      location = "us-east-1"
+      asn      = "65501"
+    }
+  }
+
+  segments {
+    name = "segment"
+  }
+
+  segments {
+    name = "segment2"
+  }
+
+  segment_actions {
+    action  = "create-route"
+    segment = "segment"
+    destination_cidr_blocks = [
+      "10.0.0.0/16"
+    ]
+    destinations = [
+      aws_networkmanager_vpc_attachment.example_us_west_2.id,
+    ]
+  }
+
+  segment_actions {
+    action  = "create-route"
+    segment = "segment"
+    destination_cidr_blocks = [
+      "10.1.0.0/16"
+    ]
+    destinations = [
+      aws_networkmanager_vpc_attachment.example_us_east_1.id,
+    ]
+  }
+}
+
+resource "aws_networkmanager_core_network_policy_attachment" "example" {
+  core_network_id = aws_networkmanager_core_network.example.id
+  policy_document = data.aws_networkmanager_core_network_policy_document.example.json
+}
+
+resource "aws_networkmanager_vpc_attachment" "example_us_west_2" {
+  core_network_id = aws_networkmanager_core_network.example.id
+  subnet_arns     = aws_subnet.example_us_west_2[*].arn
+  vpc_arn         = aws_vpc.example_us_west_2.arn
+}
+
+resource "aws_networkmanager_vpc_attachment" "example_us_east_1" {
+  provider = "alternate"
+
+  core_network_id = aws_networkmanager_core_network.example.id
+  subnet_arns     = aws_subnet.example_us_east_1[*].arn
+  vpc_arn         = aws_vpc.example_us_east_1.arn
+}
+```
+
+#### Option 2 - using base_policy_regions
 
 ```terraform
 resource "aws_networkmanager_global_network" "example" {}
@@ -155,7 +326,7 @@ resource "aws_networkmanager_vpc_attachment" "example_us_east_1" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `core_network_id` - (Required) The ID of the core network that a policy will be attached to and made `LIVE`.
 * `policy_document` - (Required) Policy document for creating a core network. Note that updating this argument will result in the new policy document version being set as the `LATEST` and `LIVE` policy document. Refer to the [Core network policies documentation](https://docs.aws.amazon.com/network-manager/latest/cloudwan/cloudwan-policy-change-sets.html) for more information.
@@ -166,16 +337,25 @@ The following arguments are supported:
 
 * `update` - (Default `30m`). If this is the first time attaching a policy to a core network then this timeout value is also used as the `create` timeout value.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `state` - Current state of a core network.
 
 ## Import
 
-`aws_networkmanager_core_network_policy_attachment` can be imported using the core network ID, e.g.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_networkmanager_core_network_policy_attachment` using the core network ID. For example:
 
+```terraform
+import {
+  to = aws_networkmanager_core_network_policy_attachment.example
+  id = "core-network-0d47f6t230mz46dy4"
+}
 ```
-$ terraform import aws_networkmanager_core_network_policy_attachment.example core-network-0d47f6t230mz46dy4
+
+Using `terraform import`, import `aws_networkmanager_core_network_policy_attachment` using the core network ID. For example:
+
+```console
+% terraform import aws_networkmanager_core_network_policy_attachment.example core-network-0d47f6t230mz46dy4
 ```
diff --git a/website/docs/r/networkmanager_customer_gateway_association.html.markdown b/website/docs/r/networkmanager_customer_gateway_association.html.markdown
index a3dbc642d02..1316a2c5c12 100644
--- a/website/docs/r/networkmanager_customer_gateway_association.html.markdown
+++ b/website/docs/r/networkmanager_customer_gateway_association.html.markdown
@@ -60,21 +60,30 @@ resource "aws_networkmanager_customer_gateway_association" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `customer_gateway_arn` - (Required) The Amazon Resource Name (ARN) of the customer gateway.
 * `device_id` - (Required) The ID of the device.
 * `global_network_id` - (Required) The ID of the global network.
 * `link_id` - (Optional) The ID of the link.
 
-## Attributes Reference
+## Attribute Reference
 
-No additional attributes are exported.
+This resource exports no additional attributes.
 
 ## Import
 
-`aws_networkmanager_customer_gateway_association` can be imported using the global network ID and customer gateway ARN, e.g.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_networkmanager_customer_gateway_association` using the global network ID and customer gateway ARN. For example:
 
+```terraform
+import {
+  to = aws_networkmanager_customer_gateway_association.example
+  id = "global-network-0d47f6t230mz46dy4,arn:aws:ec2:us-west-2:123456789012:customer-gateway/cgw-123abc05e04123abc"
+}
 ```
-$ terraform import aws_networkmanager_customer_gateway_association.example global-network-0d47f6t230mz46dy4,arn:aws:ec2:us-west-2:123456789012:customer-gateway/cgw-123abc05e04123abc
+
+Using `terraform import`, import `aws_networkmanager_customer_gateway_association` using the global network ID and customer gateway ARN. For example:
+
+```console
+% terraform import aws_networkmanager_customer_gateway_association.example global-network-0d47f6t230mz46dy4,arn:aws:ec2:us-west-2:123456789012:customer-gateway/cgw-123abc05e04123abc
 ```
diff --git a/website/docs/r/networkmanager_device.html.markdown b/website/docs/r/networkmanager_device.html.markdown
index 504d56d20dc..9f7f1f4bcac 100644
--- a/website/docs/r/networkmanager_device.html.markdown
+++ b/website/docs/r/networkmanager_device.html.markdown
@@ -22,7 +22,7 @@ resource "aws_networkmanager_device" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `aws_location` - (Optional) The AWS location of the device. Documented below.
 * `description` - (Optional) A description of the device.
@@ -46,17 +46,26 @@ The `location` object supports the following:
 * `latitude` - (Optional) The latitude.
 * `longitude` - (Optional) The longitude.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The Amazon Resource Name (ARN) of the device.
 * `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
 
 ## Import
 
-`aws_networkmanager_device` can be imported using the device ARN, e.g.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_networkmanager_device` using the device ARN. For example:
 
+```terraform
+import {
+  to = aws_networkmanager_device.example
+  id = "arn:aws:networkmanager::123456789012:device/global-network-0d47f6t230mz46dy4/device-07f6fd08867abc123"
+}
 ```
-$ terraform import aws_networkmanager_device.example arn:aws:networkmanager::123456789012:device/global-network-0d47f6t230mz46dy4/device-07f6fd08867abc123
+
+Using `terraform import`, import `aws_networkmanager_device` using the device ARN. For example:
+
+```console
+% terraform import aws_networkmanager_device.example arn:aws:networkmanager::123456789012:device/global-network-0d47f6t230mz46dy4/device-07f6fd08867abc123
 ```
diff --git a/website/docs/r/networkmanager_global_network.html.markdown b/website/docs/r/networkmanager_global_network.html.markdown
index 010ad4b8e16..c4e26bc5f86 100644
--- a/website/docs/r/networkmanager_global_network.html.markdown
+++ b/website/docs/r/networkmanager_global_network.html.markdown
@@ -20,22 +20,31 @@ resource "aws_networkmanager_global_network" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `description` - (Optional) Description of the Global Network.
 * `tags` - (Optional) Key-value tags for the Global Network. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Global Network Amazon Resource Name (ARN)
 * `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
 
 ## Import
 
-`aws_networkmanager_global_network` can be imported using the global network ID, e.g.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_networkmanager_global_network` using the global network ID. For example:
 
+```terraform
+import {
+  to = aws_networkmanager_global_network.example
+  id = "global-network-0d47f6t230mz46dy4"
+}
 ```
-$ terraform import aws_networkmanager_global_network.example global-network-0d47f6t230mz46dy4
+
+Using `terraform import`, import `aws_networkmanager_global_network` using the global network ID. For example:
+
+```console
+% terraform import aws_networkmanager_global_network.example global-network-0d47f6t230mz46dy4
 ```
diff --git a/website/docs/r/networkmanager_link.html.markdown b/website/docs/r/networkmanager_link.html.markdown
index e92fb4a6bdd..773e059138a 100644
--- a/website/docs/r/networkmanager_link.html.markdown
+++ b/website/docs/r/networkmanager_link.html.markdown
@@ -28,7 +28,7 @@ resource "aws_networkmanager_link" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `bandwidth` - (Required) The upload speed and download speed in Mbps. Documented below.
 * `description` - (Optional) A description of the link.
@@ -43,17 +43,26 @@ The `bandwidth` object supports the following:
 * `download_speed` - (Optional) Download speed in Mbps.
 * `upload_speed` - (Optional) Upload speed in Mbps.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Link Amazon Resource Name (ARN).
 * `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
 
 ## Import
 
-`aws_networkmanager_link` can be imported using the link ARN, e.g.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_networkmanager_link` using the link ARN. For example:
 
+```terraform
+import {
+  to = aws_networkmanager_link.example
+  id = "arn:aws:networkmanager::123456789012:link/global-network-0d47f6t230mz46dy4/link-444555aaabbb11223"
+}
 ```
-$ terraform import aws_networkmanager_link.example arn:aws:networkmanager::123456789012:link/global-network-0d47f6t230mz46dy4/link-444555aaabbb11223
+
+Using `terraform import`, import `aws_networkmanager_link` using the link ARN. For example:
+
+```console
+% terraform import aws_networkmanager_link.example arn:aws:networkmanager::123456789012:link/global-network-0d47f6t230mz46dy4/link-444555aaabbb11223
 ```
diff --git a/website/docs/r/networkmanager_link_association.html.markdown b/website/docs/r/networkmanager_link_association.html.markdown
index dfdd2db2c0c..4c5cf7b0738 100644
--- a/website/docs/r/networkmanager_link_association.html.markdown
+++ b/website/docs/r/networkmanager_link_association.html.markdown
@@ -24,20 +24,29 @@ resource "aws_networkmanager_link_association" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `device_id` - (Required) The ID of the device.
 * `global_network_id` - (Required) The ID of the global network.
 * `link_id` - (Required) The ID of the link.
 
-## Attributes Reference
+## Attribute Reference
 
-No additional attributes are exported.
+This resource exports no additional attributes.
 
 ## Import
 
-`aws_networkmanager_link_association` can be imported using the global network ID, link ID and device ID, e.g.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_networkmanager_link_association` using the global network ID, link ID and device ID. For example:
 
+```terraform
+import {
+  to = aws_networkmanager_link_association.example
+  id = "global-network-0d47f6t230mz46dy4,link-444555aaabbb11223,device-07f6fd08867abc123"
+}
 ```
-$ terraform import aws_networkmanager_link_association.example global-network-0d47f6t230mz46dy4,link-444555aaabbb11223,device-07f6fd08867abc123
+
+Using `terraform import`, import `aws_networkmanager_link_association` using the global network ID, link ID and device ID. For example:
+
+```console
+% terraform import aws_networkmanager_link_association.example global-network-0d47f6t230mz46dy4,link-444555aaabbb11223,device-07f6fd08867abc123
 ```
diff --git a/website/docs/r/networkmanager_site.html.markdown b/website/docs/r/networkmanager_site.html.markdown
index 1fbd2e1f77f..7523f840255 100644
--- a/website/docs/r/networkmanager_site.html.markdown
+++ b/website/docs/r/networkmanager_site.html.markdown
@@ -23,7 +23,7 @@ resource "aws_networkmanager_site" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `global_network_id` - (Required) The ID of the Global Network to create the site in.
 * `description` - (Optional) Description of the Site.
@@ -36,17 +36,26 @@ The `location` object supports the following:
 * `latitude` - (Optional) Latitude of the location.
 * `longitude` - (Optional) Longitude of the location.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Site Amazon Resource Name (ARN)
 * `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
 
 ## Import
 
-`aws_networkmanager_site` can be imported using the site ARN, e.g.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_networkmanager_site` using the site ARN. For example:
 
+```terraform
+import {
+  to = aws_networkmanager_site.example
+  id = "arn:aws:networkmanager::123456789012:site/global-network-0d47f6t230mz46dy4/site-444555aaabbb11223"
+}
 ```
-$ terraform import aws_networkmanager_site.example arn:aws:networkmanager::123456789012:site/global-network-0d47f6t230mz46dy4/site-444555aaabbb11223
+
+Using `terraform import`, import `aws_networkmanager_site` using the site ARN. For example:
+
+```console
+% terraform import aws_networkmanager_site.example arn:aws:networkmanager::123456789012:site/global-network-0d47f6t230mz46dy4/site-444555aaabbb11223
 ```
diff --git a/website/docs/r/networkmanager_site_to_site_vpn_attachment.html.markdown b/website/docs/r/networkmanager_site_to_site_vpn_attachment.html.markdown
index f0f3e20e409..ec030c53d8b 100644
--- a/website/docs/r/networkmanager_site_to_site_vpn_attachment.html.markdown
+++ b/website/docs/r/networkmanager_site_to_site_vpn_attachment.html.markdown
@@ -105,9 +105,9 @@ The following arguments are optional:
 
 - `tags` - (Optional) Key-value tags for the attachment. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 - `arn` - The ARN of the attachment.
 - `attachment_policy_rule_number` - The policy rule number associated with the attachment.
@@ -124,8 +124,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_networkmanager_site_to_site_vpn_attachment` can be imported using the attachment ID, e.g.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_networkmanager_site_to_site_vpn_attachment` using the attachment ID. For example:
 
+```terraform
+import {
+  to = aws_networkmanager_site_to_site_vpn_attachment.example
+  id = "attachment-0f8fa60d2238d1bd8"
+}
 ```
-$ terraform import aws_networkmanager_site_to_site_vpn_attachment.example attachment-0f8fa60d2238d1bd8
+
+Using `terraform import`, import `aws_networkmanager_site_to_site_vpn_attachment` using the attachment ID. For example:
+
+```console
+% terraform import aws_networkmanager_site_to_site_vpn_attachment.example attachment-0f8fa60d2238d1bd8
 ```
diff --git a/website/docs/r/networkmanager_transit_gateway_connect_peer_association.html.markdown b/website/docs/r/networkmanager_transit_gateway_connect_peer_association.html.markdown
index 403439f73ba..f7121cca9c2 100644
--- a/website/docs/r/networkmanager_transit_gateway_connect_peer_association.html.markdown
+++ b/website/docs/r/networkmanager_transit_gateway_connect_peer_association.html.markdown
@@ -23,21 +23,30 @@ resource "aws_networkmanager_transit_gateway_connect_peer_association" "example"
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `device_id` - (Required) The ID of the device.
 * `global_network_id` - (Required) The ID of the global network.
 * `link_id` - (Optional) The ID of the link.
 * `transit_gateway_connect_peer_arn` - (Required) The Amazon Resource Name (ARN) of the Connect peer.
 
-## Attributes Reference
+## Attribute Reference
 
-No additional attributes are exported.
+This resource exports no additional attributes.
 
 ## Import
 
-`aws_networkmanager_transit_gateway_connect_peer_association` can be imported using the global network ID and customer gateway ARN, e.g.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_networkmanager_transit_gateway_connect_peer_association` using the global network ID and customer gateway ARN. For example:
 
+```terraform
+import {
+  to = aws_networkmanager_transit_gateway_connect_peer_association.example
+  id = "global-network-0d47f6t230mz46dy4,arn:aws:ec2:us-west-2:123456789012:transit-gateway-connect-peer/tgw-connect-peer-12345678"
+}
 ```
-$ terraform import aws_networkmanager_transit_gateway_connect_peer_association.example global-network-0d47f6t230mz46dy4,arn:aws:ec2:us-west-2:123456789012:transit-gateway-connect-peer/tgw-connect-peer-12345678
+
+Using `terraform import`, import `aws_networkmanager_transit_gateway_connect_peer_association` using the global network ID and customer gateway ARN. For example:
+
+```console
+% terraform import aws_networkmanager_transit_gateway_connect_peer_association.example global-network-0d47f6t230mz46dy4,arn:aws:ec2:us-west-2:123456789012:transit-gateway-connect-peer/tgw-connect-peer-12345678
 ```
diff --git a/website/docs/r/networkmanager_transit_gateway_peering.html.markdown b/website/docs/r/networkmanager_transit_gateway_peering.html.markdown
index a0d6c3d3711..0efc2227a10 100644
--- a/website/docs/r/networkmanager_transit_gateway_peering.html.markdown
+++ b/website/docs/r/networkmanager_transit_gateway_peering.html.markdown
@@ -21,15 +21,15 @@ resource "aws_networkmanager_transit_gateway_peering" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `core_network_id` - (Required) The ID of a core network.
 * `tags` - (Optional) Key-value tags for the peering. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 * `transit_gateway_arn` - (Required) The ARN of the transit gateway for the peering request.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Peering Amazon Resource Name (ARN).
 * `core_network_arn` - The ARN of the core network.
@@ -43,8 +43,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_networkmanager_transit_gateway_peering` can be imported using the peering ID, e.g.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_networkmanager_transit_gateway_peering` using the peering ID. For example:
 
+```terraform
+import {
+  to = aws_networkmanager_transit_gateway_peering.example
+  id = "peering-444555aaabbb11223"
+}
 ```
-$ terraform import aws_networkmanager_transit_gateway_peering.example peering-444555aaabbb11223
+
+Using `terraform import`, import `aws_networkmanager_transit_gateway_peering` using the peering ID. For example:
+
+```console
+% terraform import aws_networkmanager_transit_gateway_peering.example peering-444555aaabbb11223
 ```
diff --git a/website/docs/r/networkmanager_transit_gateway_registration.html.markdown b/website/docs/r/networkmanager_transit_gateway_registration.html.markdown
index a8eed7cb2d0..75f47d41c8c 100644
--- a/website/docs/r/networkmanager_transit_gateway_registration.html.markdown
+++ b/website/docs/r/networkmanager_transit_gateway_registration.html.markdown
@@ -29,19 +29,28 @@ resource "aws_networkmanager_transit_gateway_registration" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `global_network_id` - (Required) The ID of the Global Network to register to.
 * `transit_gateway_arn` - (Required) The ARN of the Transit Gateway to register.
 
-## Attributes Reference
+## Attribute Reference
 
-No additional attributes are exported.
+This resource exports no additional attributes.
 
 ## Import
 
-`aws_networkmanager_transit_gateway_registration` can be imported using the global network ID and transit gateway ARN, e.g.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_networkmanager_transit_gateway_registration` using the global network ID and transit gateway ARN. For example:
 
+```terraform
+import {
+  to = aws_networkmanager_transit_gateway_registration.example
+  id = "global-network-0d47f6t230mz46dy4,arn:aws:ec2:us-west-2:123456789012:transit-gateway/tgw-123abc05e04123abc"
+}
 ```
-$ terraform import aws_networkmanager_transit_gateway_registration.example global-network-0d47f6t230mz46dy4,arn:aws:ec2:us-west-2:123456789012:transit-gateway/tgw-123abc05e04123abc
+
+Using `terraform import`, import `aws_networkmanager_transit_gateway_registration` using the global network ID and transit gateway ARN. For example:
+
+```console
+% terraform import aws_networkmanager_transit_gateway_registration.example global-network-0d47f6t230mz46dy4,arn:aws:ec2:us-west-2:123456789012:transit-gateway/tgw-123abc05e04123abc
 ```
diff --git a/website/docs/r/networkmanager_transit_gateway_route_table_attachment.html.markdown b/website/docs/r/networkmanager_transit_gateway_route_table_attachment.html.markdown
index 63793981464..560a1ce8427 100644
--- a/website/docs/r/networkmanager_transit_gateway_route_table_attachment.html.markdown
+++ b/website/docs/r/networkmanager_transit_gateway_route_table_attachment.html.markdown
@@ -21,15 +21,15 @@ resource "aws_networkmanager_transit_gateway_route_table_attachment" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `peering_id` - (Required) The ID of the peer for the attachment.
 * `tags` - (Optional) Key-value tags for the attachment. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 * `transit_gateway_route_table_arn` - (Required) The ARN of the transit gateway route table for the attachment.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Attachment Amazon Resource Name (ARN).
 * `attachment_policy_rule_number` - The policy rule number associated with the attachment.
@@ -46,8 +46,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_networkmanager_transit_gateway_route_table_attachment` can be imported using the attachment ID, e.g.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_networkmanager_transit_gateway_route_table_attachment` using the attachment ID. For example:
 
+```terraform
+import {
+  to = aws_networkmanager_transit_gateway_route_table_attachment.example
+  id = "attachment-0f8fa60d2238d1bd8"
+}
 ```
-$ terraform import aws_networkmanager_transit_gateway_route_table_attachment.example attachment-0f8fa60d2238d1bd8
+
+Using `terraform import`, import `aws_networkmanager_transit_gateway_route_table_attachment` using the attachment ID. For example:
+
+```console
+% terraform import aws_networkmanager_transit_gateway_route_table_attachment.example attachment-0f8fa60d2238d1bd8
 ```
diff --git a/website/docs/r/networkmanager_vpc_attachment.html.markdown b/website/docs/r/networkmanager_vpc_attachment.html.markdown
index cb53f94bb74..25448c9ff1d 100644
--- a/website/docs/r/networkmanager_vpc_attachment.html.markdown
+++ b/website/docs/r/networkmanager_vpc_attachment.html.markdown
@@ -40,9 +40,9 @@ The following arguments are optional:
 * `appliance_mode_support` - (Optional) Indicates whether appliance mode is supported. If enabled, traffic flow between a source and destination use the same Availability Zone for the VPC attachment for the lifetime of that flow.
 * `ipv6_support` - (Optional) Indicates whether IPv6 is supported.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The ARN of the attachment.
 * `attachment_policy_rule_number` - The policy rule number associated with the attachment.
@@ -58,8 +58,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_networkmanager_vpc_attachment` can be imported using the attachment ID, e.g.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_networkmanager_vpc_attachment` using the attachment ID. For example:
 
+```terraform
+import {
+  to = aws_networkmanager_vpc_attachment.example
+  id = "attachment-0f8fa60d2238d1bd8"
+}
 ```
-$ terraform import aws_networkmanager_vpc_attachment.example attachment-0f8fa60d2238d1bd8
+
+Using `terraform import`, import `aws_networkmanager_vpc_attachment` using the attachment ID. For example:
+
+```console
+% terraform import aws_networkmanager_vpc_attachment.example attachment-0f8fa60d2238d1bd8
 ```
diff --git a/website/docs/r/oam_link.html.markdown b/website/docs/r/oam_link.html.markdown
index 8486e15fd61..404a252d84f 100644
--- a/website/docs/r/oam_link.html.markdown
+++ b/website/docs/r/oam_link.html.markdown
@@ -37,9 +37,9 @@ The following arguments are optional:
 
 * `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the link.
 * `label` - Label that is assigned to this link.
@@ -56,8 +56,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-CloudWatch Observability Access Manager Link can be imported using the `arn`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudWatch Observability Access Manager Link using the `arn`. For example:
 
+```terraform
+import {
+  to = aws_oam_link.example
+  id = "arn:aws:oam:us-west-2:123456789012:link/link-id"
+}
 ```
-$ terraform import aws_oam_link.example arn:aws:oam:us-west-2:123456789012:link/link-id
+
+Using `terraform import`, import CloudWatch Observability Access Manager Link using the `arn`. For example:
+
+```console
+% terraform import aws_oam_link.example arn:aws:oam:us-west-2:123456789012:link/link-id
 ```
diff --git a/website/docs/r/oam_sink.html.markdown b/website/docs/r/oam_sink.html.markdown
index b19a0a448ea..4c0ee34e3c3 100644
--- a/website/docs/r/oam_sink.html.markdown
+++ b/website/docs/r/oam_sink.html.markdown
@@ -34,9 +34,9 @@ The following arguments are optional:
 
 * `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the Sink.
 * `sink_id` - ID string that AWS generated as part of the sink ARN.
@@ -51,8 +51,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-CloudWatch Observability Access Manager Sink can be imported using the `arn`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudWatch Observability Access Manager Sink using the `arn`. For example:
 
+```terraform
+import {
+  to = aws_oam_sink.example
+  id = "arn:aws:oam:us-west-2:123456789012:sink/sink-id"
+}
 ```
-$ terraform import aws_oam_sink.example arn:aws:oam:us-west-2:123456789012:sink/sink-id
+
+Using `terraform import`, import CloudWatch Observability Access Manager Sink using the `arn`. For example:
+
+```console
+% terraform import aws_oam_sink.example arn:aws:oam:us-west-2:123456789012:sink/sink-id
 ```
diff --git a/website/docs/r/oam_sink_policy.html.markdown b/website/docs/r/oam_sink_policy.html.markdown
index f38f6521560..da18fd94a95 100644
--- a/website/docs/r/oam_sink_policy.html.markdown
+++ b/website/docs/r/oam_sink_policy.html.markdown
@@ -49,9 +49,9 @@ The following arguments are required:
 * `sink_identifier` - (Required) ARN of the sink to attach this policy to.
 * `policy` - (Required) JSON policy to use. If you are updating an existing policy, the entire existing policy is replaced by what you specify here.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the Sink.
 * `sink_id` - ID string that AWS generated as part of the sink ARN.
@@ -65,8 +65,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-CloudWatch Observability Access Manager Sink Policy can be imported using the `sink_identifier`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudWatch Observability Access Manager Sink Policy using the `sink_identifier`. For example:
 
+```terraform
+import {
+  to = aws_oam_sink_policy.example
+  id = "arn:aws:oam:us-west-2:123456789012:sink/sink-id"
+}
 ```
-$ terraform import aws_oam_sink_policy.example arn:aws:oam:us-west-2:123456789012:sink/sink-id
+
+Using `terraform import`, import CloudWatch Observability Access Manager Sink Policy using the `sink_identifier`. For example:
+
+```console
+% terraform import aws_oam_sink_policy.example arn:aws:oam:us-west-2:123456789012:sink/sink-id
 ```
diff --git a/website/docs/r/opensearch_domain.html.markdown b/website/docs/r/opensearch_domain.html.markdown
index b8a3fd18fd1..71daeb03f7f 100644
--- a/website/docs/r/opensearch_domain.html.markdown
+++ b/website/docs/r/opensearch_domain.html.markdown
@@ -335,6 +335,7 @@ The following arguments are optional:
 * `log_publishing_options` - (Optional) Configuration block for publishing slow and application logs to CloudWatch Logs. This block can be declared multiple times, for each log_type, within the same resource. Detailed below.
 * `node_to_node_encryption` - (Optional) Configuration block for node-to-node encryption options. Detailed below.
 * `snapshot_options` - (Optional) Configuration block for snapshot related options. Detailed below. DEPRECATED. For domains running OpenSearch 5.3 and later, Amazon OpenSearch takes hourly automated snapshots, making this setting irrelevant. For domains running earlier versions, OpenSearch takes daily automated snapshots.
+* `software_update_options` - (Optional) Software update options for the domain. Detailed below.
 * `tags` - (Optional) Map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 * `vpc_options` - (Optional) Configuration block for VPC related options. Adding or removing this configuration forces a new resource ([documentation](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/vpc.html)). Detailed below.
 * `off_peak_window_options` - (Optional) Configuration to add Off Peak update options. ([documentation](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/off-peak.html)). Detailed below.
@@ -439,6 +440,10 @@ AWS documentation: [Amazon Cognito Authentication for Dashboard](https://docs.aw
 
 * `automated_snapshot_start_hour` - (Required) Hour during which the service takes an automated daily snapshot of the indices in the domain.
 
+### software_update_options
+
+* `auto_software_update_enabled` - (Optional) Whether automatic service software updates are enabled for the domain. Defaults to `false`.
+
 ### vpc_options
 
 AWS documentation: [VPC Support for Amazon OpenSearch Service Domains](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/es-vpc.html)
@@ -460,9 +465,9 @@ AWS documentation: [Off Peak Hours Support for Amazon OpenSearch Service Domains
         * `hours` - (Required) Starting hour of the 10-hour window for updates
         * `minutes` - (Required) Starting minute of the 10-hour window for updates
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the domain.
 * `domain_id` - Unique identifier for the domain.
@@ -484,8 +489,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-OpenSearch domains can be imported using the `domain_name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import OpenSearch domains using the `domain_name`. For example:
 
+```terraform
+import {
+  to = aws_opensearch_domain.example
+  id = "domain_name"
+}
 ```
-$ terraform import aws_opensearch_domain.example domain_name
+
+Using `terraform import`, import OpenSearch domains using the `domain_name`. For example:
+
+```console
+% terraform import aws_opensearch_domain.example domain_name
 ```
diff --git a/website/docs/r/opensearch_domain_policy.html.markdown b/website/docs/r/opensearch_domain_policy.html.markdown
index 6e3dfaf5f04..f0f5a98d819 100644
--- a/website/docs/r/opensearch_domain_policy.html.markdown
+++ b/website/docs/r/opensearch_domain_policy.html.markdown
@@ -19,20 +19,22 @@ resource "aws_opensearch_domain" "example" {
 }
 
 data "aws_iam_policy_document" "main" {
-  effect = "Allow"
-
-  principals {
-    type        = "*"
-    identifiers = ["*"]
-  }
-
-  actions   = ["es:*"]
-  resources = ["${aws_opensearch_domain.example.arn}/*"]
-
-  condition {
-    test     = "IpAddress"
-    variable = "aws:SourceIp"
-    values   = "127.0.0.1/32"
+  statement {
+    effect = "Allow"
+
+    principals {
+      type        = "*"
+      identifiers = ["*"]
+    }
+
+    actions   = ["es:*"]
+    resources = ["${aws_opensearch_domain.example.arn}/*"]
+
+    condition {
+      test     = "IpAddress"
+      variable = "aws:SourceIp"
+      values   = ["127.0.0.1/32"]
+    }
   }
 }
 
@@ -44,14 +46,14 @@ resource "aws_opensearch_domain_policy" "main" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `access_policies` - (Optional) IAM policy document specifying the access policies for the domain
 * `domain_name` - (Required) Name of the domain.
 
-## Attributes Reference
+## Attribute Reference
 
-No additional attributes are exported.
+This resource exports no additional attributes.
 
 ## Timeouts
 
diff --git a/website/docs/r/opensearch_domain_saml_options.html.markdown b/website/docs/r/opensearch_domain_saml_options.html.markdown
index 97ed5f5c48e..66c437567e4 100644
--- a/website/docs/r/opensearch_domain_saml_options.html.markdown
+++ b/website/docs/r/opensearch_domain_saml_options.html.markdown
@@ -69,9 +69,9 @@ The following arguments are optional:
 * `entity_id` - (Required) Unique Entity ID of the application in SAML Identity Provider.
 * `metadata_content` - (Required) Metadata of the SAML application in xml format.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Name of the domain the SAML options are associated with.
 
@@ -84,8 +84,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-OpenSearch domains can be imported using the `domain_name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import OpenSearch domains using the `domain_name`. For example:
 
+```terraform
+import {
+  to = aws_opensearch_domain_saml_options.example
+  id = "domain_name"
+}
 ```
-$ terraform import aws_opensearch_domain_saml_options.example domain_name
+
+Using `terraform import`, import OpenSearch domains using the `domain_name`. For example:
+
+```console
+% terraform import aws_opensearch_domain_saml_options.example domain_name
 ```
diff --git a/website/docs/r/opensearch_inbound_connection_accepter.html.markdown b/website/docs/r/opensearch_inbound_connection_accepter.html.markdown
index 04b72ae840e..7c642498f8a 100644
--- a/website/docs/r/opensearch_inbound_connection_accepter.html.markdown
+++ b/website/docs/r/opensearch_inbound_connection_accepter.html.markdown
@@ -40,21 +40,37 @@ resource "aws_opensearch_inbound_connection_accepter" "foo" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `connection_id` - (Required, Forces new resource) Specifies the ID of the connection to accept.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The Id of the connection to accept.
 * `connection_status` - Status of the connection request.
 
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `5m`)
+* `delete` - (Default `5m`)
+
 ## Import
 
-AWS Opensearch Inbound Connection Accepters can be imported by using the Inbound Connection ID, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AWS Opensearch Inbound Connection Accepters using the Inbound Connection ID. For example:
 
+```terraform
+import {
+  to = aws_opensearch_inbound_connection_accepter.foo
+  id = "connection-id"
+}
 ```
-$ terraform import aws_opensearch_inbound_connection_accepter.foo connection-id
+
+Using `terraform import`, import AWS Opensearch Inbound Connection Accepters using the Inbound Connection ID. For example:
+
+```console
+% terraform import aws_opensearch_inbound_connection_accepter.foo connection-id
 ```
diff --git a/website/docs/r/opensearch_outbound_connection.html.markdown b/website/docs/r/opensearch_outbound_connection.html.markdown
index dc4dda898da..ded5205d4d4 100644
--- a/website/docs/r/opensearch_outbound_connection.html.markdown
+++ b/website/docs/r/opensearch_outbound_connection.html.markdown
@@ -20,6 +20,7 @@ data "aws_region" "current" {}
 
 resource "aws_opensearch_outbound_connection" "foo" {
   connection_alias = "outbound_connection"
+  connection_mode  = "DIRECT"
   local_domain_info {
     owner_id    = data.aws_caller_identity.current.account_id
     region      = data.aws_region.current.name
@@ -36,12 +37,23 @@ resource "aws_opensearch_outbound_connection" "foo" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `connection_alias` - (Required, Forces new resource) Specifies the connection alias that will be used by the customer for this connection.
+* `connection_mode` - (Required, Forces new resource) Specifies the connection mode. Accepted values are `DIRECT` or `VPC_ENDPOINT`.
+* `accept_connection` - (Optional, Forces new resource) Accepts the connection.
+* `connection_properties` - (Optional, Forces new resource) Configuration block for the outbound connection.
 * `local_domain_info` - (Required, Forces new resource) Configuration block for the local Opensearch domain.
 * `remote_domain_info` - (Required, Forces new resource) Configuration block for the remote Opensearch domain.
 
+### connection_properties
+
+* `cross_cluster_search` - (Optional, Forces new resource) Configuration block for cross cluster search.
+
+### cross_cluster_search
+
+* `skip_unavailable` - (Optional, Forces new resource) Skips unavailable clusters and can only be used for cross-cluster searches. Accepted values are `ENABLED` or `DISABLED`.
+
 ### local_domain_info
 
 * `owner_id` - (Required, Forces new resource) The Account ID of the owner of the local domain.
@@ -54,17 +66,37 @@ The following arguments are supported:
 * `domain_name` - (Required, Forces new resource) The name of the remote domain.
 * `region` - (Required, Forces new resource) The region of the remote domain.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The Id of the connection.
 * `connection_status` - Status of the connection request.
 
+`connection_properties` block exports the following:
+
+* `endpoint` - The endpoint of the remote domain, is only set when `connection_mode` is `VPC_ENDPOINT` and `accept_connection` is `TRUE`.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `5m`)
+* `delete` - (Default `5m`)
+
 ## Import
 
-AWS Opensearch Outbound Connections can be imported by using the Outbound Connection ID, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AWS Opensearch Outbound Connections using the Outbound Connection ID. For example:
 
+```terraform
+import {
+  to = aws_opensearch_outbound_connection.foo
+  id = "connection-id"
+}
 ```
-$ terraform import aws_opensearch_outbound_connection.foo connection-id
+
+Using `terraform import`, import AWS Opensearch Outbound Connections using the Outbound Connection ID. For example:
+
+```console
+% terraform import aws_opensearch_outbound_connection.foo connection-id
 ```
diff --git a/website/docs/r/opensearch_package.html.markdown b/website/docs/r/opensearch_package.html.markdown
new file mode 100644
index 00000000000..4360da88dce
--- /dev/null
+++ b/website/docs/r/opensearch_package.html.markdown
@@ -0,0 +1,75 @@
+---
+subcategory: "OpenSearch"
+layout: "aws"
+page_title: "AWS: aws_opensearch_package"
+description: |-
+  Terraform resource for managing an AWS OpenSearch package.
+---
+
+# Resource: aws_opensearch_package
+
+Manages an AWS Opensearch Package.
+
+## Example Usage
+
+### Basic Usage
+
+```terraform
+resource "aws_s3_bucket" "my_opensearch_packages" {
+  bucket = "my-opensearch-packages"
+}
+
+resource "aws_s3_object" "example" {
+  bucket = aws_s3_bucket.my_opensearch_packages.bucket
+  key    = "example.txt"
+  source = "./example.txt"
+  etag   = filemd5("./example.txt")
+}
+
+resource "aws_opensearch_package" "example" {
+  package_name = "example-txt"
+  package_source {
+    s3_bucket_name = aws_s3_bucket.my_opensearch_packages.bucket
+    s3_key         = aws_s3_object.example.key
+  }
+  package_type = "TXT-DICTIONARY"
+}
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `package_name` - (Required, Forces new resource) Unique name for the package.
+* `package_type` - (Required, Forces new resource) The type of package.
+* `package_source` - (Required, Forces new resource) Configuration block for the package source options.
+* `package_description` - (Optional, Forces new resource) Description of the package.
+
+### package_source
+
+* `s3_bucket_name` - (Required, Forces new resource) The name of the Amazon S3 bucket containing the package.
+* `s3_key` - (Required, Forces new resource) Key (file name) of the package.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Id of the package.
+* `available_package_version` - The current version of the package.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AWS Opensearch Packages using the Package ID. For example:
+
+```terraform
+import {
+  to = aws_opensearch_package.example
+  id = "package-id"
+}
+```
+
+Using `terraform import`, import AWS Opensearch Packages using the Package ID. For example:
+
+```console
+% terraform import aws_opensearch_package.example package-id
+```
diff --git a/website/docs/r/opensearch_package_association.html.markdown b/website/docs/r/opensearch_package_association.html.markdown
new file mode 100644
index 00000000000..db6ce09f93a
--- /dev/null
+++ b/website/docs/r/opensearch_package_association.html.markdown
@@ -0,0 +1,60 @@
+---
+subcategory: "OpenSearch"
+layout: "aws"
+page_title: "AWS: aws_opensearch_package_association"
+description: |-
+  Terraform resource for managing an AWS OpenSearch package association.
+---
+
+# Resource: aws_opensearch_package_association
+
+Manages an AWS Opensearch Package Association.
+
+## Example Usage
+
+### Basic Usage
+
+```terraform
+resource "aws_opensearch_domain" "my_domain" {
+  domain_name    = "my-opensearch-domain"
+  engine_version = "Elasticsearch_7.10"
+
+  cluster_config {
+    instance_type = "r4.large.search"
+  }
+}
+
+resource "aws_opensearch_package" "example" {
+  package_name = "example-txt"
+  package_source {
+    s3_bucket_name = aws_s3_bucket.my_opensearch_packages.bucket
+    s3_key         = aws_s3_object.example.key
+  }
+  package_type = "TXT-DICTIONARY"
+}
+
+resource "aws_opensearch_package_association" "example" {
+  package_id  = aws_opensearch_package.example.id
+  domain_name = aws_opensearch_domain.my_domain.domain_name
+}
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `package_id` - (Required, Forces new resource) Internal ID of the package to associate with a domain.
+* `domain_name` - (Required, Forces new resource) Name of the domain to associate the package with.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Id of the package association.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `10m`)
+* `delete` - (Default `10m`)
diff --git a/website/docs/r/opensearch_vpc_endpoint.html.markdown b/website/docs/r/opensearch_vpc_endpoint.html.markdown
new file mode 100644
index 00000000000..2c812e3b1de
--- /dev/null
+++ b/website/docs/r/opensearch_vpc_endpoint.html.markdown
@@ -0,0 +1,71 @@
+---
+subcategory: "OpenSearch"
+layout: "aws"
+page_title: "AWS: aws_opensearch_vpc_endpoint"
+description: |-
+  Terraform resource for managing an AWS OpenSearch VPC Endpoint.
+---
+
+# Resource: aws_opensearch_vpc_endpoint
+
+Manages an [AWS Opensearch VPC Endpoint](https://docs.aws.amazon.com/opensearch-service/latest/APIReference/API_CreateVpcEndpoint.html). Creates an Amazon OpenSearch Service-managed VPC endpoint.
+
+## Example Usage
+
+### Basic Usage
+
+```terraform
+
+resource "aws_opensearch_vpc_endpoint" "foo" {
+  domain_arn = aws_opensearch_domain.domain_1.arn
+  vpc_options {
+    security_group_ids = [aws_security_group.test.id, aws_security_group.test2.id]
+    subnet_ids         = [aws_subnet.test.id, aws_subnet.test2.id]
+  }
+}
+
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `domain_arn` - (Required, Forces new resource) Specifies the Amazon Resource Name (ARN) of the domain to create the endpoint for
+* `vpc_options` - (Required) Options to specify the subnets and security groups for the endpoint.
+
+### vpc_options
+
+* `security_group_ids` - (Optional) The list of security group IDs associated with the VPC endpoints for the domain. If you do not provide a security group ID, OpenSearch Service uses the default security group for the VPC.
+* `subnet_ids` - (Required) A list of subnet IDs associated with the VPC endpoints for the domain. If your domain uses multiple Availability Zones, you need to provide two subnet IDs, one per zone. Otherwise, provide only one.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The unique identifier of the endpoint.
+* `endpoint` - The connection endpoint ID for connecting to the domain.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `60m`)
+* `update` - (Default `60m`)
+* `delete` - (Default `90m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import OpenSearch VPC endpoint connections using the `id`. For example:
+
+```terraform
+import {
+  to = aws_opensearch_vpc_endpoint_connection.example
+  id = "endpoint-id"
+}
+```
+
+Using `terraform import`, import OpenSearch VPC endpoint connections using the `id`. For example:
+
+```console
+% terraform import aws_opensearch_vpc_endpoint_connection.example endpoint-id
+```
diff --git a/website/docs/r/opensearchserverless_access_policy.html.markdown b/website/docs/r/opensearchserverless_access_policy.html.markdown
index 10e52d5e5e0..c4d9611947b 100644
--- a/website/docs/r/opensearchserverless_access_policy.html.markdown
+++ b/website/docs/r/opensearchserverless_access_policy.html.markdown
@@ -8,38 +8,121 @@ description: |-
 
 # Resource: aws_opensearchserverless_access_policy
 
-Terraform resource for managing an AWS OpenSearch Serverless Access Policy.
+Terraform resource for managing an AWS OpenSearch Serverless Access Policy. See AWS documentation for [data access policies](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/serverless-data-access.html) and [supported data access policy permissions](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/serverless-data-access.html#serverless-data-supported-permissions).
 
 ## Example Usage
 
-### Basic Usage
+### Grant all collection and index permissions
 
 ```terraform
 data "aws_caller_identity" "current" {}
-data "aws_partition" "current" {}
 
-resource "aws_opensearchserverless_access_policy" "test" {
+resource "aws_opensearchserverless_access_policy" "example" {
+  name        = "example"
+  type        = "data"
+  description = "read and write permissions"
+  policy = jsonencode([
+    {
+      Rules = [
+        {
+          ResourceType = "index",
+          Resource = [
+            "index/example-collection/*"
+          ],
+          Permission = [
+            "aoss:*"
+          ]
+        },
+        {
+          ResourceType = "collection",
+          Resource = [
+            "collection/example-collection"
+          ],
+          Permission = [
+            "aoss:*"
+          ]
+        }
+      ],
+      Principal = [
+        data.aws_caller_identity.current.arn
+      ]
+    }
+  ])
+}
+```
+
+### Grant read-only collection and index permissions
+
+```
+data "aws_caller_identity" "current" {}
+
+resource "aws_opensearchserverless_access_policy" "example" {
+  name        = "example"
+  type        = "data"
+  description = "read-only permissions"
+  policy = jsonencode([
+    {
+      Rules = [
+        {
+          ResourceType = "index",
+          Resource = [
+            "index/example-collection/*"
+          ],
+          Permission = [
+            "aoss:DescribeIndex",
+            "aoss:ReadDocument",
+          ]
+        },
+        {
+          ResourceType = "collection",
+          Resource = [
+            "collection/example-collection"
+          ],
+          Permission = [
+            "aoss:DescribeCollectionItems"
+          ]
+        }
+      ],
+      Principal = [
+        data.aws_caller_identity.current.arn
+      ]
+    }
+  ])
+}
+```
+
+### Grant SAML identity permissions
+
+```
+resource "aws_opensearchserverless_access_policy" "example" {
   name = "example"
   type = "data"
+  description = "saml permissions"
   policy = jsonencode([
     {
-      "Rules" : [
+      Rules = [
         {
-          "ResourceType" : "index",
-          "Resource" : [
-            "index/books/*"
+          ResourceType = "index",
+          Resource = [
+            "index/example-collection/*"
           ],
-          "Permission" : [
-            "aoss:CreateIndex",
-            "aoss:ReadDocument",
-            "aoss:UpdateIndex",
-            "aoss:DeleteIndex",
-            "aoss:WriteDocument"
+          Permission = [
+            "aoss:*"
+          ]
+        },
+        {
+          ResourceType = "collection",
+          Resource = [
+            "collection/example-collection"
+          ],
+          Permission = [
+            "aoss:*"
           ]
         }
       ],
-      "Principal" : [
-        "arn:${data.aws_partition.current.partition}:iam::${data.aws_caller_identity.current.account_id}:user/admin"
+      Principal = [
+        "saml/123456789012/myprovider/user/Annie",
+        "saml/123456789012/anotherprovider/group/Accounting"
       ]
     }
   ])
@@ -58,16 +141,25 @@ The following arguments are optional:
 
 * `description` - (Optional) Description of the policy. Typically used to store information about the permissions defined in the policy.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `policy_version` - Version of the policy.
 
 ## Import
 
-OpenSearchServerless Access Policy can be imported using the `name` and `type` arguments separated by a slash (`/`), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import OpenSearchServerless Access Policy using the `name` and `type` arguments separated by a slash (`/`). For example:
 
+```terraform
+import {
+  to = aws_opensearchserverless_access_policy.example
+  id = "example/data"
+}
 ```
-$ terraform import aws_opensearchserverless_access_policy.example example/data
+
+Using `terraform import`, import OpenSearchServerless Access Policy using the `name` and `type` arguments separated by a slash (`/`). For example:
+
+```console
+% terraform import aws_opensearchserverless_access_policy.example example/data
 ```
diff --git a/website/docs/r/opensearchserverless_collection.html.markdown b/website/docs/r/opensearchserverless_collection.html.markdown
index ad66ad1eb95..18f437f6cbb 100644
--- a/website/docs/r/opensearchserverless_collection.html.markdown
+++ b/website/docs/r/opensearchserverless_collection.html.markdown
@@ -10,6 +10,10 @@ description: |-
 
 Terraform resource for managing an AWS OpenSearch Serverless Collection.
 
+~> **NOTE:** An `aws_opensearchserverless_collection` cannot be created without having an applicable [encryption security policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/opensearchserverless_security_policy). Use the [`depends_on`](https://developer.hashicorp.com/terraform/language/meta-arguments/depends_on) meta-argument to define this dependency.
+
+~> **NOTE:** An `aws_opensearchserverless_collection` is not accessible without configuring an applicable [network security policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/opensearchserverless_security_policy). Data cannot be accessed without configuring an applicable [data access policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/opensearchserverless_access_policy).
+
 ## Example Usage
 
 ### Basic Usage
@@ -48,15 +52,15 @@ The following arguments are optional:
 
 * `description` - (Optional) Description of the collection.
 * `tags` - (Optional) A map of tags to assign to the collection. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
-* `type` - (Optional) Type of collection. One of `SEARCH` or `TIMESERIES`.
+* `type` - (Optional) Type of collection. One of `SEARCH`, `TIMESERIES`, or `VECTORSEARCH`. Defaults to `TIMESERIES`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name (ARN) of the collection.
 * `collection_endpoint` - Collection-specific endpoint used to submit index, search, and data upload requests to an OpenSearch Serverless collection.
-* `dashboard_endpont` - Collection-specific endpoint used to access OpenSearch Dashboards.
+* `dashboard_endpoint` - Collection-specific endpoint used to access OpenSearch Dashboards.
 * `kms_key_arn` - The ARN of the Amazon Web Services KMS key used to encrypt the collection.
 * `id` - Unique identifier for the collection.
 
@@ -69,8 +73,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-OpenSearchServerless Collection can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import OpenSearchServerless Collection using the `id`. For example:
 
+```terraform
+import {
+  to = aws_opensearchserverless_collection.example
+  id = "example"
+}
 ```
-$ terraform import aws_opensearchserverless_collection.example example
+
+Using `terraform import`, import OpenSearchServerless Collection using the `id`. For example:
+
+```console
+% terraform import aws_opensearchserverless_collection.example example
 ```
diff --git a/website/docs/r/opensearchserverless_security_config.html.markdown b/website/docs/r/opensearchserverless_security_config.html.markdown
index b9c066c2556..1a60d479f7f 100644
--- a/website/docs/r/opensearchserverless_security_config.html.markdown
+++ b/website/docs/r/opensearchserverless_security_config.html.markdown
@@ -43,13 +43,25 @@ The following arguments are optional:
 * `session_timeout` - (Optional) Session timeout, in minutes. Minimum is 5 minutes and maximum is 720 minutes (12 hours). Default is 60 minutes.
 * `user_attribute` - (Optional) User attribute for this SAML integration.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `config_version` - Version of the configuration.
 
 ## Import
 
-OpenSearchServerless Access Policy can be imported using the `name` argument prefixed with the string `saml/account_id/` e.g
-$ terraform import aws_opensearchserverless_security_config.example saml/123456789012/example
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import OpenSearchServerless Access Policy using the `name` argument prefixed with the string `saml/account_id/`. For example:
+
+```terraform
+import {
+  to = aws_opensearchserverless_security_config.example
+  id = "saml/123456789012/example"
+}
+```
+
+Using `terraform import`, import OpenSearchServerless Access Policy using the `name` argument prefixed with the string `saml/account_id/`. For example:
+
+```console
+% terraform import aws_opensearchserverless_security_config.example saml/123456789012/example
+```
diff --git a/website/docs/r/opensearchserverless_security_policy.html.markdown b/website/docs/r/opensearchserverless_security_policy.html.markdown
index 8348bbe2140..fd50273fc56 100644
--- a/website/docs/r/opensearchserverless_security_policy.html.markdown
+++ b/website/docs/r/opensearchserverless_security_policy.html.markdown
@@ -8,21 +8,24 @@ description: |-
 
 # Resource: aws_opensearchserverless_security_policy
 
-Terraform resource for managing an AWS OpenSearch Serverless Security Policy.
+Terraform resource for managing an AWS OpenSearch Serverless Security Policy. See AWS documentation for [encryption policies](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/serverless-encryption.html#serverless-encryption-policies) and [network policies](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/serverless-network.html#serverless-network-policies).
 
 ## Example Usage
 
-### Basic Usage
+### Encryption Security Policy
+
+#### Applies to a single collection
 
 ```terraform
 resource "aws_opensearchserverless_security_policy" "example" {
-  name = "example"
-  type = "encryption"
+  name        = "example"
+  type        = "encryption"
+  description = "encryption security policy for example-collection"
   policy = jsonencode({
     Rules = [
       {
         Resource = [
-          "collection/example"
+          "collection/example-collection"
         ],
         ResourceType = "collection"
       }
@@ -32,20 +35,72 @@ resource "aws_opensearchserverless_security_policy" "example" {
 }
 ```
 
-### Network
+#### Applies to multiple collections
 
 ```terraform
 resource "aws_opensearchserverless_security_policy" "example" {
-  name = "example"
-  type = "network"
+  name        = "example"
+  type        = "encryption"
+  description = "encryption security policy for collections that begin with \"example\""
+  policy = jsonencode({
+    Rules = [
+      {
+        Resource = [
+          "collection/example*"
+        ],
+        ResourceType = "collection"
+      }
+    ],
+    AWSOwnedKey = true
+  })
+}
+```
+
+#### Using a customer managed key
+
+```terraform
+resource "aws_opensearchserverless_security_policy" "example" {
+  name        = "example"
+  type        = "encryption"
+  description = "encryption security policy using customer KMS key"
+  policy = jsonencode({
+    Rules = [
+      {
+        Resource = [
+          "collection/customer-managed-key-collection"
+        ],
+        ResourceType = "collection"
+      }
+    ],
+    AWSOwnedKey = false
+    KmsARN      = "arn:aws:kms:us-east-1:123456789012:key/93fd6da4-a317-4c17-bfe9-382b5d988b36"
+  })
+}
+```
+
+### Network Security Policy
+
+#### Allow public access to the collection endpoint and the Dashboards endpoint
+
+```terraform
+resource "aws_opensearchserverless_security_policy" "example" {
+  name        = "example"
+  type        = "network"
+  description = "Public access"
   policy = jsonencode([
     {
-      Description = "Public access fo example collection",
+      Description = "Public access to collection and Dashboards endpoint for example collection",
       Rules = [
         {
           ResourceType = "collection",
           Resource = [
-            "collection/example*"
+            "collection/example-collection"
+          ]
+        },
+        {
+          ResourceType = "dashboard"
+          Resource = [
+            "collection/example-collection"
           ]
         }
       ],
@@ -55,6 +110,84 @@ resource "aws_opensearchserverless_security_policy" "example" {
 }
 ```
 
+#### Allow VPC access to the collection endpoint and the Dashboards endpoint
+
+```terraform
+resource "aws_opensearchserverless_security_policy" "example" {
+  name        = "example"
+  type        = "network"
+  description = "VPC access"
+  policy = jsonencode([
+    {
+      Description = "VPC access to collection and Dashboards endpoint for example collection",
+      Rules = [
+        {
+          ResourceType = "collection",
+          Resource = [
+            "collection/example-collection"
+          ]
+        },
+        {
+          ResourceType = "dashboard"
+          Resource = [
+            "collection/example-collection"
+          ]
+        }
+      ],
+      AllowFromPublic = false,
+      SourceVPCEs = [
+        "vpce-050f79086ee71ac05"
+      ]
+    }
+  ])
+}
+```
+
+#### Mixed access for different collections
+
+```terraform
+resource "aws_opensearchserverless_security_policy" "example" {
+  name        = "example"
+  type        = "network"
+  description = "Mixed access for marketing and sales"
+  policy = jsonencode([
+    {
+      "Description" : "Marketing access",
+      "Rules" : [
+        {
+          "ResourceType" : "collection",
+          "Resource" : [
+            "collection/marketing*"
+          ]
+        },
+        {
+          "ResourceType" : "dashboard",
+          "Resource" : [
+            "collection/marketing*"
+          ]
+        }
+      ],
+      "AllowFromPublic" : false,
+      "SourceVPCEs" : [
+        "vpce-050f79086ee71ac05"
+      ]
+    },
+    {
+      "Description" : "Sales access",
+      "Rules" : [
+        {
+          "ResourceType" : "collection",
+          "Resource" : [
+            "collection/finance"
+          ]
+        }
+      ],
+      "AllowFromPublic" : true
+    }
+  ])
+}
+```
+
 ## Argument Reference
 
 The following arguments are required:
@@ -67,16 +200,25 @@ The following arguments are optional:
 
 * `description` - (Optional) Description of the policy. Typically used to store information about the permissions defined in the policy.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `policy_version` - Version of the policy.
 
 ## Import
 
-OpenSearchServerless Security Policy can be imported using the `name` and `type` arguments separated by a slash (`/`), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import OpenSearchServerless Security Policy using the `name` and `type` arguments separated by a slash (`/`). For example:
 
+```terraform
+import {
+  to = aws_opensearchserverless_security_policy.example
+  id = "example/encryption"
+}
 ```
-$ terraform import aws_opensearchserverless_security_policy.example example/encryption
+
+Using `terraform import`, import OpenSearchServerless Security Policy using the `name` and `type` arguments separated by a slash (`/`). For example:
+
+```console
+% terraform import aws_opensearchserverless_security_policy.example example/encryption
 ```
diff --git a/website/docs/r/opensearchserverless_vpc_endpoint.html.markdown b/website/docs/r/opensearchserverless_vpc_endpoint.html.markdown
index 577be166e36..262435a1b8b 100644
--- a/website/docs/r/opensearchserverless_vpc_endpoint.html.markdown
+++ b/website/docs/r/opensearchserverless_vpc_endpoint.html.markdown
@@ -34,9 +34,9 @@ The following arguments are optional:
 
 * `security_group_ids` - (Optional) One or more security groups that define the ports, protocols, and sources for inbound traffic that you are authorizing into your endpoint. Up to 5 security groups can be provided.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Unique identified of the Vpc Endpoint.
 
@@ -50,8 +50,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-OpenSearchServerless Vpc Endpointa can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import OpenSearchServerless Vpc Endpointa using the `id`. For example:
 
+```terraform
+import {
+  to = aws_opensearchserverless_vpc_endpoint.example
+  id = "vpce-8012925589"
+}
 ```
-$ terraform import aws_opensearchserverless_vpc_endpoint.example vpce-8012925589
+
+Using `terraform import`, import OpenSearchServerless Vpc Endpointa using the `id`. For example:
+
+```console
+% terraform import aws_opensearchserverless_vpc_endpoint.example vpce-8012925589
 ```
diff --git a/website/docs/r/opsworks_application.html.markdown b/website/docs/r/opsworks_application.html.markdown
index f8cc5af20b0..098e4007884 100644
--- a/website/docs/r/opsworks_application.html.markdown
+++ b/website/docs/r/opsworks_application.html.markdown
@@ -52,7 +52,7 @@ resource "aws_opsworks_application" "foo-app" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) A human-readable name for the application.
 * `short_name` - (Required) A short, machine-readable name for the application. This can only be defined on resource creation and ignored on resource update.
@@ -93,16 +93,25 @@ A `ssl_configuration` block supports the following arguments (can only be define
 * `certificate` - (Required) The contents of the certificate's domain.crt file.
 * `chain` - (Optional)  Can be used to specify an intermediate certificate authority key or client authentication.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The id of the application.
 
 ## Import
 
-Opsworks Application can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Opsworks Application using the `id`. For example:
 
+```terraform
+import {
+  to = aws_opsworks_application.test
+  id = "<id>"
+}
 ```
-$ terraform import aws_opsworks_application.test <id>
+
+Using `terraform import`, import Opsworks Application using the `id`. For example:
+
+```console
+% terraform import aws_opsworks_application.test <id>
 ```
diff --git a/website/docs/r/opsworks_custom_layer.html.markdown b/website/docs/r/opsworks_custom_layer.html.markdown
index 3745c583f6f..f59bffe14f3 100644
--- a/website/docs/r/opsworks_custom_layer.html.markdown
+++ b/website/docs/r/opsworks_custom_layer.html.markdown
@@ -22,7 +22,7 @@ resource "aws_opsworks_custom_layer" "custlayer" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) A human-readable name for the layer.
 * `short_name` - (Required) A short, machine-readable name for the layer, which will be used to identify it in the Chef node JSON.
@@ -101,9 +101,9 @@ Though the three thresholds are optional, at least one threshold must be set whe
 * `memory_threshold` - (Optional) The memory utilization threshold, as a percent of the available memory. A value of -1 disables the threshold.
 * `thresholds_wait_time` - (Optional) The amount of time, in minutes, that the load must exceed a threshold before more instances are added or removed.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The id of the layer.
 * `arn` - The Amazon Resource Name(ARN) of the layer.
@@ -111,8 +111,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-OpsWorks Custom Layers can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import OpsWorks Custom Layers using the `id`. For example:
 
+```terraform
+import {
+  to = aws_opsworks_custom_layer.bar
+  id = "00000000-0000-0000-0000-000000000000"
+}
 ```
-$ terraform import aws_opsworks_custom_layer.bar 00000000-0000-0000-0000-000000000000
+
+Using `terraform import`, import OpsWorks Custom Layers using the `id`. For example:
+
+```console
+% terraform import aws_opsworks_custom_layer.bar 00000000-0000-0000-0000-000000000000
 ```
diff --git a/website/docs/r/opsworks_ecs_cluster_layer.html.markdown b/website/docs/r/opsworks_ecs_cluster_layer.html.markdown
index 9ae96695202..caeec5dfe49 100644
--- a/website/docs/r/opsworks_ecs_cluster_layer.html.markdown
+++ b/website/docs/r/opsworks_ecs_cluster_layer.html.markdown
@@ -21,7 +21,7 @@ resource "aws_opsworks_ecs_cluster_layer" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `stack_id` - (Required) ID of the stack the layer will belong to.
 * `ecs_cluster_arn` - (Required) The ECS Cluster ARN of the layer.
@@ -60,9 +60,9 @@ An `ebs_volume` block supports the following arguments:
 * `type` - (Optional) The type of volume to create. This may be `standard` (the default), `io1` or `gp2`.
 * `iops` - (Optional) For PIOPS volumes, the IOPS per disk.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The id of the layer.
 * `arn` - The Amazon Resource Name(ARN) of the layer.
diff --git a/website/docs/r/opsworks_ganglia_layer.html.markdown b/website/docs/r/opsworks_ganglia_layer.html.markdown
index e8e4627ad63..fd544f07d50 100644
--- a/website/docs/r/opsworks_ganglia_layer.html.markdown
+++ b/website/docs/r/opsworks_ganglia_layer.html.markdown
@@ -21,7 +21,7 @@ resource "aws_opsworks_ganglia_layer" "monitor" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `stack_id` - (Required) ID of the stack the layer will belong to.
 * `password` - (Required) The password to use for Ganglia.
@@ -62,9 +62,9 @@ An `ebs_volume` block supports the following arguments:
 * `type` - (Optional) The type of volume to create. This may be `standard` (the default), `io1` or `gp2`.
 * `iops` - (Optional) For PIOPS volumes, the IOPS per disk.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The id of the layer.
 * `arn` - The Amazon Resource Name(ARN) of the layer.
diff --git a/website/docs/r/opsworks_haproxy_layer.html.markdown b/website/docs/r/opsworks_haproxy_layer.html.markdown
index 4b623b8638c..3cc7487544e 100644
--- a/website/docs/r/opsworks_haproxy_layer.html.markdown
+++ b/website/docs/r/opsworks_haproxy_layer.html.markdown
@@ -21,7 +21,7 @@ resource "aws_opsworks_haproxy_layer" "lb" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `stack_id` - (Required) ID of the stack the layer will belong to.
 * `stats_password` - (Required) The password to use for HAProxy stats.
@@ -65,9 +65,9 @@ An `ebs_volume` block supports the following arguments:
 * `type` - (Optional) The type of volume to create. This may be `standard` (the default), `io1` or `gp2`.
 * `iops` - (Optional) For PIOPS volumes, the IOPS per disk.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The id of the layer.
 * `arn` - The Amazon Resource Name(ARN) of the layer.
diff --git a/website/docs/r/opsworks_instance.html.markdown b/website/docs/r/opsworks_instance.html.markdown
index c3a33c1dccf..216ee9f8c7d 100644
--- a/website/docs/r/opsworks_instance.html.markdown
+++ b/website/docs/r/opsworks_instance.html.markdown
@@ -105,9 +105,9 @@ resources cannot be automatically detected by Terraform. After making updates
 to block device configuration, resource recreation can be manually triggered by
 using the [`taint` command](https://www.terraform.io/docs/commands/taint.html).
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `created_at` - Time that the instance was created.
 * `ec2_instance_id` - EC2 instance ID.
@@ -139,8 +139,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Opsworks Instances can be imported using the `instance id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Opsworks Instances using the instance `id`. For example:
 
+```terraform
+import {
+  to = aws_opsworks_instance.my_instance
+  id = "4d6d1710-ded9-42a1-b08e-b043ad7af1e2"
+}
 ```
-$ terraform import aws_opsworks_instance.my_instance 4d6d1710-ded9-42a1-b08e-b043ad7af1e2
+
+Using `terraform import`, import Opsworks Instances using the instance `id`. For example:
+
+```console
+% terraform import aws_opsworks_instance.my_instance 4d6d1710-ded9-42a1-b08e-b043ad7af1e2
 ```
diff --git a/website/docs/r/opsworks_java_app_layer.html.markdown b/website/docs/r/opsworks_java_app_layer.html.markdown
index 7f55843fd83..1a9e7632237 100644
--- a/website/docs/r/opsworks_java_app_layer.html.markdown
+++ b/website/docs/r/opsworks_java_app_layer.html.markdown
@@ -20,7 +20,7 @@ resource "aws_opsworks_java_app_layer" "app" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `stack_id` - (Required) ID of the stack the layer will belong to.
 * `name` - (Optional) A human-readable name for the layer.
@@ -63,9 +63,9 @@ An `ebs_volume` block supports the following arguments:
 * `type` - (Optional) The type of volume to create. This may be `standard` (the default), `io1` or `gp2`.
 * `iops` - (Optional) For PIOPS volumes, the IOPS per disk.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The id of the layer.
 * `arn` - The Amazon Resource Name(ARN) of the layer.
diff --git a/website/docs/r/opsworks_memcached_layer.html.markdown b/website/docs/r/opsworks_memcached_layer.html.markdown
index 81d9ffc1382..20525f553ce 100644
--- a/website/docs/r/opsworks_memcached_layer.html.markdown
+++ b/website/docs/r/opsworks_memcached_layer.html.markdown
@@ -20,7 +20,7 @@ resource "aws_opsworks_memcached_layer" "cache" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `stack_id` - (Required) ID of the stack the layer will belong to.
 * `name` - (Optional) A human-readable name for the layer.
@@ -59,9 +59,9 @@ An `ebs_volume` block supports the following arguments:
 * `type` - (Optional) The type of volume to create. This may be `standard` (the default), `io1` or `gp2`.
 * `iops` - (Optional) For PIOPS volumes, the IOPS per disk.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The id of the layer.
 * `arn` - The Amazon Resource Name(ARN) of the layer.
diff --git a/website/docs/r/opsworks_mysql_layer.html.markdown b/website/docs/r/opsworks_mysql_layer.html.markdown
index e5490880976..b74760cf347 100644
--- a/website/docs/r/opsworks_mysql_layer.html.markdown
+++ b/website/docs/r/opsworks_mysql_layer.html.markdown
@@ -23,7 +23,7 @@ resource "aws_opsworks_mysql_layer" "db" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `stack_id` - (Required) ID of the stack the layer will belong to.
 * `name` - (Optional) A human-readable name for the layer.
@@ -63,9 +63,9 @@ An `ebs_volume` block supports the following arguments:
 * `type` - (Optional) The type of volume to create. This may be `standard` (the default), `io1` or `gp2`.
 * `iops` - (Optional) For PIOPS volumes, the IOPS per disk.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The id of the layer.
 * `arn` - The Amazon Resource Name(ARN) of the layer.
diff --git a/website/docs/r/opsworks_nodejs_app_layer.html.markdown b/website/docs/r/opsworks_nodejs_app_layer.html.markdown
index f9ab11856c2..a7234ee954b 100644
--- a/website/docs/r/opsworks_nodejs_app_layer.html.markdown
+++ b/website/docs/r/opsworks_nodejs_app_layer.html.markdown
@@ -20,7 +20,7 @@ resource "aws_opsworks_nodejs_app_layer" "app" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `stack_id` - (Required) ID of the stack the layer will belong to.
 * `name` - (Optional) A human-readable name for the layer.
@@ -59,9 +59,9 @@ An `ebs_volume` block supports the following arguments:
 * `type` - (Optional) The type of volume to create. This may be `standard` (the default), `io1` or `gp2`.
 * `iops` - (Optional) For PIOPS volumes, the IOPS per disk.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The id of the layer.
 * `arn` - The Amazon Resource Name(ARN) of the layer.
diff --git a/website/docs/r/opsworks_permission.html.markdown b/website/docs/r/opsworks_permission.html.markdown
index 5f25da27ef6..626cbe47d01 100644
--- a/website/docs/r/opsworks_permission.html.markdown
+++ b/website/docs/r/opsworks_permission.html.markdown
@@ -24,7 +24,7 @@ resource "aws_opsworks_permission" "my_stack_permission" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `allow_ssh` - (Optional) Whether the user is allowed to use SSH to communicate with the instance
 * `allow_sudo` - (Optional) Whether the user is allowed to use sudo to elevate privileges
@@ -32,8 +32,8 @@ The following arguments are supported:
 * `level` - (Optional) The users permission level. Mus be one of `deny`, `show`, `deploy`, `manage`, `iam_only`
 * `stack_id` - (Required) The stack to set the permissions for
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The computed id of the permission. Please note that this is only used internally to identify the permission. This value is not used in aws.
diff --git a/website/docs/r/opsworks_php_app_layer.html.markdown b/website/docs/r/opsworks_php_app_layer.html.markdown
index a07448c6a01..3f1c32a2ec8 100644
--- a/website/docs/r/opsworks_php_app_layer.html.markdown
+++ b/website/docs/r/opsworks_php_app_layer.html.markdown
@@ -20,7 +20,7 @@ resource "aws_opsworks_php_app_layer" "app" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `stack_id` - (Required) ID of the stack the layer will belong to.
 * `name` - (Optional) A human-readable name for the layer.
@@ -58,9 +58,9 @@ An `ebs_volume` block supports the following arguments:
 * `type` - (Optional) The type of volume to create. This may be `standard` (the default), `io1` or `gp2`.
 * `iops` - (Optional) For PIOPS volumes, the IOPS per disk.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The id of the layer.
 * `arn` - The Amazon Resource Name(ARN) of the layer.
@@ -68,8 +68,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-OpsWorks PHP Application Layers can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import OpsWorks PHP Application Layers using the `id`. For example:
 
+```terraform
+import {
+  to = aws_opsworks_php_app_layer.bar
+  id = "00000000-0000-0000-0000-000000000000"
+}
 ```
-$ terraform import aws_opsworks_php_app_layer.bar 00000000-0000-0000-0000-000000000000
+
+Using `terraform import`, import OpsWorks PHP Application Layers using the `id`. For example:
+
+```console
+% terraform import aws_opsworks_php_app_layer.bar 00000000-0000-0000-0000-000000000000
 ```
diff --git a/website/docs/r/opsworks_rails_app_layer.html.markdown b/website/docs/r/opsworks_rails_app_layer.html.markdown
index 94e2dfe860a..538e97d9f77 100644
--- a/website/docs/r/opsworks_rails_app_layer.html.markdown
+++ b/website/docs/r/opsworks_rails_app_layer.html.markdown
@@ -20,7 +20,7 @@ resource "aws_opsworks_rails_app_layer" "app" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `stack_id` - (Required) ID of the stack the layer will belong to.
 * `name` - (Optional) A human-readable name for the layer.
@@ -64,9 +64,9 @@ An `ebs_volume` block supports the following arguments:
 * `type` - (Optional) The type of volume to create. This may be `standard` (the default), `io1` or `gp2`.
 * `iops` - (Optional) For PIOPS volumes, the IOPS per disk.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The id of the layer.
 * `arn` - The Amazon Resource Name(ARN) of the layer.
diff --git a/website/docs/r/opsworks_rds_db_instance.html.markdown b/website/docs/r/opsworks_rds_db_instance.html.markdown
index 5f97e4681d3..a63914b5fd2 100644
--- a/website/docs/r/opsworks_rds_db_instance.html.markdown
+++ b/website/docs/r/opsworks_rds_db_instance.html.markdown
@@ -26,15 +26,15 @@ resource "aws_opsworks_rds_db_instance" "my_instance" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `stack_id` - (Required) The stack to register a db instance for. Changing this will force a new resource.
 * `rds_db_instance_arn` - (Required) The db instance to register for this stack. Changing this will force a new resource.
 * `db_user` - (Required) A db username
 * `db_password` - (Required) A db password
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The computed id. Please note that this is only used internally to identify the stack <-> instance relation. This value is not used in aws.
diff --git a/website/docs/r/opsworks_stack.html.markdown b/website/docs/r/opsworks_stack.html.markdown
index d22972eaf35..1ce61995827 100644
--- a/website/docs/r/opsworks_stack.html.markdown
+++ b/website/docs/r/opsworks_stack.html.markdown
@@ -35,7 +35,7 @@ EOT
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The name of the stack.
 * `region` - (Required) The name of the region where the stack will exist.
@@ -74,17 +74,26 @@ The `custom_cookbooks_source` block supports the following arguments:
 * `ssh_key` - (Optional) SSH key to use when authenticating to the source. Terraform cannot perform drift detection of this configuration.
 * `revision` - (Optional) For sources that are version-aware, the revision to use.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The id of the stack.
 * `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
 
 ## Import
 
-OpsWorks stacks can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import OpsWorks stacks using the `id`. For example:
 
+```terraform
+import {
+  to = aws_opsworks_stack.bar
+  id = "00000000-0000-0000-0000-000000000000"
+}
 ```
-$ terraform import aws_opsworks_stack.bar 00000000-0000-0000-0000-000000000000
+
+Using `terraform import`, import OpsWorks stacks using the `id`. For example:
+
+```console
+% terraform import aws_opsworks_stack.bar 00000000-0000-0000-0000-000000000000
 ```
diff --git a/website/docs/r/opsworks_static_web_layer.html.markdown b/website/docs/r/opsworks_static_web_layer.html.markdown
index 61fd4d54c2a..12ae6cf6c1b 100644
--- a/website/docs/r/opsworks_static_web_layer.html.markdown
+++ b/website/docs/r/opsworks_static_web_layer.html.markdown
@@ -20,7 +20,7 @@ resource "aws_opsworks_static_web_layer" "web" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `stack_id` - (Required) ID of the stack the layer will belong to.
 * `name` - (Optional) A human-readable name for the layer.
@@ -57,9 +57,9 @@ An `ebs_volume` block supports the following arguments:
 * `type` - (Optional) The type of volume to create. This may be `standard` (the default), `io1` or `gp2`.
 * `iops` - (Optional) For PIOPS volumes, the IOPS per disk.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The id of the layer.
 * `arn` - The Amazon Resource Name(ARN) of the layer.
@@ -67,8 +67,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-OpsWorks static web server Layers can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import OpsWorks static web server Layers using the `id`. For example:
 
+```terraform
+import {
+  to = aws_opsworks_static_web_layer.bar
+  id = "00000000-0000-0000-0000-000000000000"
+}
 ```
-$ terraform import aws_opsworks_static_web_layer.bar 00000000-0000-0000-0000-000000000000
+
+Using `terraform import`, import OpsWorks static web server Layers using the `id`. For example:
+
+```console
+% terraform import aws_opsworks_static_web_layer.bar 00000000-0000-0000-0000-000000000000
 ```
diff --git a/website/docs/r/opsworks_user_profile.html.markdown b/website/docs/r/opsworks_user_profile.html.markdown
index 2e8172cd04a..d0ceb2bb925 100644
--- a/website/docs/r/opsworks_user_profile.html.markdown
+++ b/website/docs/r/opsworks_user_profile.html.markdown
@@ -21,15 +21,15 @@ resource "aws_opsworks_user_profile" "my_profile" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `user_arn` - (Required) The user's IAM ARN
 * `allow_self_management` - (Optional) Whether users can specify their own SSH public key through the My Settings page
 * `ssh_username` - (Required) The ssh username, with witch this user wants to log in
 * `ssh_public_key` - (Optional) The users public key
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Same value as `user_arn`
diff --git a/website/docs/r/organizations_account.html.markdown b/website/docs/r/organizations_account.html.markdown
index 620ef2505dd..e8704b654d1 100644
--- a/website/docs/r/organizations_account.html.markdown
+++ b/website/docs/r/organizations_account.html.markdown
@@ -39,9 +39,9 @@ The following arguments are optional:
 * `role_name` - (Optional) The name of an IAM role that Organizations automatically preconfigures in the new member account. This role trusts the root account, allowing users in the root account to assume the role, as permitted by the root account administrator. The role has administrator permissions in the new member account. The Organizations API provides no method for reading this information after account creation, so Terraform cannot perform drift detection on its value and will always show a difference for a configured value after import unless [`ignore_changes`](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html#ignore_changes) is used.
 * `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The ARN for this account.
 * `govcloud_id` - ID for a GovCloud account created with the account.
@@ -50,13 +50,22 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-The AWS member account can be imported by using the `account_id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import the AWS member account using the `account_id`. For example:
 
+```terraform
+import {
+  to = aws_organizations_account.my_account
+  id = "111111111111"
+}
 ```
-$ terraform import aws_organizations_account.my_account 111111111111
+
+Using `terraform import`, import the AWS member account using the `account_id`. For example:
+
+```console
+% terraform import aws_organizations_account.my_account 111111111111
 ```
 
-Certain resource arguments, like `role_name`, do not have an Organizations API method for reading the information after account creation. If the argument is set in the Terraform configuration on an imported resource, Terraform will always show a difference. To workaround this behavior, either omit the argument from the Terraform configuration or use [`ignore_changes`](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html#ignore_changes) to hide the difference, e.g.,
+Certain resource arguments, like `role_name`, do not have an Organizations API method for reading the information after account creation. If the argument is set in the Terraform configuration on an imported resource, Terraform will always show a difference. To workaround this behavior, either omit the argument from the Terraform configuration or use [`ignore_changes`](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html#ignore_changes) to hide the difference. For example:
 
 ```terraform
 resource "aws_organizations_account" "account" {
diff --git a/website/docs/r/organizations_delegated_administrator.html.markdown b/website/docs/r/organizations_delegated_administrator.html.markdown
index 0a64579134d..80b8396caca 100644
--- a/website/docs/r/organizations_delegated_administrator.html.markdown
+++ b/website/docs/r/organizations_delegated_administrator.html.markdown
@@ -21,14 +21,14 @@ resource "aws_organizations_delegated_administrator" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `account_id` - (Required) The account ID number of the member account in the organization to register as a delegated administrator.
 * `service_principal` - (Required) The service principal of the AWS service for which you want to make the member account a delegated administrator.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The unique identifier (ID) of the delegated administrator.
 * `arn` - The Amazon Resource Name (ARN) of the delegated administrator's account.
@@ -41,8 +41,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_organizations_delegated_administrator` can be imported by using the account ID and its service principal, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_organizations_delegated_administrator` using the account ID and its service principal. For example:
 
+```terraform
+import {
+  to = aws_organizations_delegated_administrator.example
+  id = "123456789012/config.amazonaws.com"
+}
 ```
-$ terraform import aws_organizations_delegated_administrator.example 123456789012/config.amazonaws.com
+
+Using `terraform import`, import `aws_organizations_delegated_administrator` using the account ID and its service principal. For example:
+
+```console
+% terraform import aws_organizations_delegated_administrator.example 123456789012/config.amazonaws.com
 ```
diff --git a/website/docs/r/organizations_organization.html.markdown b/website/docs/r/organizations_organization.html.markdown
index 0e73240a634..a0c67b03893 100644
--- a/website/docs/r/organizations_organization.html.markdown
+++ b/website/docs/r/organizations_organization.html.markdown
@@ -29,15 +29,15 @@ resource "aws_organizations_organization" "org" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `aws_service_access_principals` - (Optional) List of AWS service principal names for which you want to enable integration with your organization. This is typically in the form of a URL, such as service-abbreviation.amazonaws.com. Organization must have `feature_set` set to `ALL`. Some services do not support enablement via this endpoint, see [warning in aws docs](https://docs.aws.amazon.com/organizations/latest/APIReference/API_EnableAWSServiceAccess.html).
 * `enabled_policy_types` - (Optional) List of Organizations policy types to enable in the Organization Root. Organization must have `feature_set` set to `ALL`. For additional information about valid policy types (e.g., `AISERVICES_OPT_OUT_POLICY`, `BACKUP_POLICY`, `SERVICE_CONTROL_POLICY`, and `TAG_POLICY`), see the [AWS Organizations API Reference](https://docs.aws.amazon.com/organizations/latest/APIReference/API_EnablePolicyType.html).
 * `feature_set` - (Optional) Specify "ALL" (default) or "CONSOLIDATED_BILLING".
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `accounts` - List of organization accounts including the master account. For a list excluding the master account, see the `non_master_accounts` attribute. All elements have these attributes:
     * `arn` - ARN of the account
@@ -66,8 +66,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-The AWS organization can be imported by using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import the AWS organization using the `id`. For example:
 
+```terraform
+import {
+  to = aws_organizations_organization.my_org
+  id = "o-1234567"
+}
 ```
-$ terraform import aws_organizations_organization.my_org o-1234567
+
+Using `terraform import`, import the AWS organization using the `id`. For example:
+
+```console
+% terraform import aws_organizations_organization.my_org o-1234567
 ```
diff --git a/website/docs/r/organizations_organizational_unit.html.markdown b/website/docs/r/organizations_organizational_unit.html.markdown
index 87b19e3f9c4..33f5d82a8eb 100644
--- a/website/docs/r/organizations_organizational_unit.html.markdown
+++ b/website/docs/r/organizations_organizational_unit.html.markdown
@@ -21,15 +21,15 @@ resource "aws_organizations_organizational_unit" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - The name for the organizational unit
 * `parent_id` - ID of the parent organizational unit, which may be the root
 * `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `accounts` - List of child accounts for this Organizational Unit. Does not return account information for child Organizational Units. All elements have these attributes:
     * `arn` - ARN of the account
@@ -42,8 +42,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-AWS Organizations Organizational Units can be imported by using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AWS Organizations Organizational Units using the `id`. For example:
 
+```terraform
+import {
+  to = aws_organizations_organizational_unit.example
+  id = "ou-1234567"
+}
 ```
-$ terraform import aws_organizations_organizational_unit.example ou-1234567
+
+Using `terraform import`, import AWS Organizations Organizational Units using the `id`. For example:
+
+```console
+% terraform import aws_organizations_organizational_unit.example ou-1234567
 ```
diff --git a/website/docs/r/organizations_policy.html.markdown b/website/docs/r/organizations_policy.html.markdown
index 46ceacf81dd..53a981354e2 100644
--- a/website/docs/r/organizations_policy.html.markdown
+++ b/website/docs/r/organizations_policy.html.markdown
@@ -29,7 +29,7 @@ resource "aws_organizations_policy" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `content` - (Required) The policy content to add to the new policy. For example, if you create a [service control policy (SCP)](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scp.html), this string must be JSON text that specifies the permissions that admins in attached accounts can delegate to their users, groups, and roles. For more information about the SCP syntax, see the [Service Control Policy Syntax documentation](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_reference_scp-syntax.html) and for more information on the Tag Policy syntax, see the [Tag Policy Syntax documentation](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_example-tag-policies.html).
 * `name` - (Required) The friendly name to assign to the policy.
@@ -38,9 +38,9 @@ The following arguments are supported:
 * `type` - (Optional) The type of policy to create. Valid values are `AISERVICES_OPT_OUT_POLICY`, `BACKUP_POLICY`, `SERVICE_CONTROL_POLICY` (SCP), and `TAG_POLICY`. Defaults to `SERVICE_CONTROL_POLICY`.
 * `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The unique identifier (ID) of the policy.
 * `arn` - Amazon Resource Name (ARN) of the policy.
@@ -48,8 +48,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_organizations_policy` can be imported by using the policy ID, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_organizations_policy` using the policy ID. For example:
 
+```terraform
+import {
+  to = aws_organizations_policy.example
+  id = "p-12345678"
+}
 ```
-$ terraform import aws_organizations_policy.example p-12345678
+
+Using `terraform import`, import `aws_organizations_policy` using the policy ID. For example:
+
+```console
+% terraform import aws_organizations_policy.example p-12345678
 ```
diff --git a/website/docs/r/organizations_policy_attachment.html.markdown b/website/docs/r/organizations_policy_attachment.html.markdown
index 4cf2e07e715..8b4ca98e8e2 100644
--- a/website/docs/r/organizations_policy_attachment.html.markdown
+++ b/website/docs/r/organizations_policy_attachment.html.markdown
@@ -41,20 +41,33 @@ resource "aws_organizations_policy_attachment" "unit" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `policy_id` - (Required) The unique identifier (ID) of the policy that you want to attach to the target.
 * `target_id` - (Required) The unique identifier (ID) of the root, organizational unit, or account number that you want to attach the policy to.
 * `skip_destroy` - (Optional) If set to `true`, destroy will **not** detach the policy and instead just remove the resource from state. This can be useful in situations where the attachment must be preserved to meet the AWS minimum requirement of 1 attached policy.
 
-## Attributes Reference
+## Attribute Reference
 
-No additional attributes are exported.
+This resource exports no additional attributes.
 
 ## Import
 
-`aws_organizations_policy_attachment` can be imported by using the target ID and policy ID, e.g., with an account target
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_organizations_policy_attachment` using the target ID and policy ID. For example:
 
+With an account target:
+
+```terraform
+import {
+  to = aws_organizations_policy_attachment.account
+  id = "123456789012:p-12345678"
+}
 ```
-$ terraform import aws_organizations_policy_attachment.account 123456789012:p-12345678
+
+Using `terraform import`, import `aws_organizations_policy_attachment` using the target ID and policy ID. For example:
+
+With an account target:
+
+```console
+% terraform import aws_organizations_policy_attachment.account 123456789012:p-12345678
 ```
diff --git a/website/docs/r/organizations_resource_policy.html.markdown b/website/docs/r/organizations_resource_policy.html.markdown
index fd0a316418b..65cceab4d3b 100644
--- a/website/docs/r/organizations_resource_policy.html.markdown
+++ b/website/docs/r/organizations_resource_policy.html.markdown
@@ -51,14 +51,14 @@ EOF
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `content` - (Required) Content for the resource policy. The text must be correctly formatted JSON that complies with the syntax for the resource policy's type. See the [_AWS Organizations User Guide_](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_delegate_examples.html) for examples.
 * `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name (ARN) of the resource policy.
 * `id` - The unique identifier (ID) of the resource policy.
@@ -66,8 +66,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_organizations_resource_policy` can be imported by using the resource policy ID, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_organizations_resource_policy` using the resource policy ID. For example:
 
+```terraform
+import {
+  to = aws_organizations_resource_policy.example
+  id = "rp-12345678"
+}
 ```
-$ terraform import aws_organizations_resource_policy.example rp-12345678
+
+Using `terraform import`, import `aws_organizations_resource_policy` using the resource policy ID. For example:
+
+```console
+% terraform import aws_organizations_resource_policy.example rp-12345678
 ```
diff --git a/website/docs/r/pinpoint_adm_channel.html.markdown b/website/docs/r/pinpoint_adm_channel.html.markdown
new file mode 100644
index 00000000000..f7f92d9447d
--- /dev/null
+++ b/website/docs/r/pinpoint_adm_channel.html.markdown
@@ -0,0 +1,57 @@
+---
+subcategory: "Pinpoint"
+layout: "aws"
+page_title: "AWS: aws_pinpoint_adm_channel"
+description: |-
+  Provides a Pinpoint ADM Channel resource.
+---
+
+# Resource: aws_pinpoint_adm_channel
+
+Provides a Pinpoint ADM (Amazon Device Messaging) Channel resource.
+
+~> **Note:** All arguments including the Client ID and Client Secret will be stored in the raw state as plain-text.
+[Read more about sensitive data in state](https://www.terraform.io/docs/state/sensitive-data.html).
+
+## Example Usage
+
+```terraform
+resource "aws_pinpoint_app" "app" {}
+
+resource "aws_pinpoint_adm_channel" "channel" {
+  application_id = aws_pinpoint_app.app.application_id
+  client_id      = ""
+  client_secret  = ""
+  enabled        = true
+}
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `application_id` - (Required) The application ID.
+* `client_id` - (Required) Client ID (part of OAuth Credentials) obtained via Amazon Developer Account.
+* `client_secret` - (Required) Client Secret (part of OAuth Credentials) obtained via Amazon Developer Account.
+* `enabled` - (Optional) Specifies whether to enable the channel. Defaults to `true`.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Pinpoint ADM Channel using the `application-id`. For example:
+
+```terraform
+import {
+  to = aws_pinpoint_adm_channel.channel
+  id = "application-id"
+}
+```
+
+Using `terraform import`, import Pinpoint ADM Channel using the `application-id`. For example:
+
+```console
+% terraform import aws_pinpoint_adm_channel.channel application-id
+```
diff --git a/website/docs/r/pinpoint_adm_channel.markdown b/website/docs/r/pinpoint_adm_channel.markdown
deleted file mode 100644
index ab8599a7379..00000000000
--- a/website/docs/r/pinpoint_adm_channel.markdown
+++ /dev/null
@@ -1,48 +0,0 @@
----
-subcategory: "Pinpoint"
-layout: "aws"
-page_title: "AWS: aws_pinpoint_adm_channel"
-description: |-
-  Provides a Pinpoint ADM Channel resource.
----
-
-# Resource: aws_pinpoint_adm_channel
-
-Provides a Pinpoint ADM (Amazon Device Messaging) Channel resource.
-
-~> **Note:** All arguments including the Client ID and Client Secret will be stored in the raw state as plain-text.
-[Read more about sensitive data in state](https://www.terraform.io/docs/state/sensitive-data.html).
-
-## Example Usage
-
-```terraform
-resource "aws_pinpoint_app" "app" {}
-
-resource "aws_pinpoint_adm_channel" "channel" {
-  application_id = aws_pinpoint_app.app.application_id
-  client_id      = ""
-  client_secret  = ""
-  enabled        = true
-}
-```
-
-## Argument Reference
-
-The following arguments are supported:
-
-* `application_id` - (Required) The application ID.
-* `client_id` - (Required) Client ID (part of OAuth Credentials) obtained via Amazon Developer Account.
-* `client_secret` - (Required) Client Secret (part of OAuth Credentials) obtained via Amazon Developer Account.
-* `enabled` - (Optional) Specifies whether to enable the channel. Defaults to `true`.
-
-## Attributes Reference
-
-No additional attributes are exported.
-
-## Import
-
-Pinpoint ADM Channel can be imported using the `application-id`, e.g.,
-
-```
-$ terraform import aws_pinpoint_adm_channel.channel application-id
-```
diff --git a/website/docs/r/pinpoint_apns_channel.html.markdown b/website/docs/r/pinpoint_apns_channel.html.markdown
new file mode 100644
index 00000000000..41e82ef8cea
--- /dev/null
+++ b/website/docs/r/pinpoint_apns_channel.html.markdown
@@ -0,0 +1,73 @@
+---
+subcategory: "Pinpoint"
+layout: "aws"
+page_title: "AWS: aws_pinpoint_apns_channel"
+description: |-
+  Provides a Pinpoint APNs Channel resource.
+---
+
+# Resource: aws_pinpoint_apns_channel
+
+Provides a Pinpoint APNs Channel resource.
+
+~> **Note:** All arguments, including certificates and tokens, will be stored in the raw state as plain-text.
+[Read more about sensitive data in state](https://www.terraform.io/docs/state/sensitive-data.html).
+
+## Example Usage
+
+```terraform
+resource "aws_pinpoint_apns_channel" "apns" {
+  application_id = aws_pinpoint_app.app.application_id
+
+  certificate = file("./certificate.pem")
+  private_key = file("./private_key.key")
+}
+
+resource "aws_pinpoint_app" "app" {}
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `application_id` - (Required) The application ID.
+* `enabled` - (Optional) Whether the channel is enabled or disabled. Defaults to `true`.
+* `default_authentication_method` - (Optional) The default authentication method used for APNs.
+  __NOTE__: Amazon Pinpoint uses this default for every APNs push notification that you send using the console.
+  You can override the default when you send a message programmatically using the Amazon Pinpoint API, the AWS CLI, or an AWS SDK.
+  If your default authentication type fails, Amazon Pinpoint doesn't attempt to use the other authentication type.
+
+One of the following sets of credentials is also required.
+
+If you choose to use __Certificate credentials__ you will have to provide:
+
+* `certificate` - (Required) The pem encoded TLS Certificate from Apple.
+* `private_key` - (Required) The Certificate Private Key file (ie. `.key` file).
+
+If you choose to use __Key credentials__ you will have to provide:
+
+* `bundle_id` - (Required) The ID assigned to your iOS app. To find this value, choose Certificates, IDs & Profiles, choose App IDs in the Identifiers section, and choose your app.
+* `team_id` - (Required) The ID assigned to your Apple developer account team. This value is provided on the Membership page.
+* `token_key` - (Required) The `.p8` file that you download from your Apple developer account when you create an authentication key.
+* `token_key_id` - (Required) The ID assigned to your signing key. To find this value, choose Certificates, IDs & Profiles, and choose your key in the Keys section.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Pinpoint APNs Channel using the `application-id`. For example:
+
+```terraform
+import {
+  to = aws_pinpoint_apns_channel.apns
+  id = "application-id"
+}
+```
+
+Using `terraform import`, import Pinpoint APNs Channel using the `application-id`. For example:
+
+```console
+% terraform import aws_pinpoint_apns_channel.apns application-id
+```
diff --git a/website/docs/r/pinpoint_apns_channel.markdown b/website/docs/r/pinpoint_apns_channel.markdown
deleted file mode 100644
index 2ab3240bdca..00000000000
--- a/website/docs/r/pinpoint_apns_channel.markdown
+++ /dev/null
@@ -1,64 +0,0 @@
----
-subcategory: "Pinpoint"
-layout: "aws"
-page_title: "AWS: aws_pinpoint_apns_channel"
-description: |-
-  Provides a Pinpoint APNs Channel resource.
----
-
-# Resource: aws_pinpoint_apns_channel
-
-Provides a Pinpoint APNs Channel resource.
-
-~> **Note:** All arguments, including certificates and tokens, will be stored in the raw state as plain-text.
-[Read more about sensitive data in state](https://www.terraform.io/docs/state/sensitive-data.html).
-
-## Example Usage
-
-```terraform
-resource "aws_pinpoint_apns_channel" "apns" {
-  application_id = aws_pinpoint_app.app.application_id
-
-  certificate = file("./certificate.pem")
-  private_key = file("./private_key.key")
-}
-
-resource "aws_pinpoint_app" "app" {}
-```
-
-## Argument Reference
-
-The following arguments are supported:
-
-* `application_id` - (Required) The application ID.
-* `enabled` - (Optional) Whether the channel is enabled or disabled. Defaults to `true`.
-* `default_authentication_method` - (Optional) The default authentication method used for APNs.
-  __NOTE__: Amazon Pinpoint uses this default for every APNs push notification that you send using the console.
-  You can override the default when you send a message programmatically using the Amazon Pinpoint API, the AWS CLI, or an AWS SDK.
-  If your default authentication type fails, Amazon Pinpoint doesn't attempt to use the other authentication type.
-
-One of the following sets of credentials is also required.
-
-If you choose to use __Certificate credentials__ you will have to provide:
-
-* `certificate` - (Required) The pem encoded TLS Certificate from Apple.
-* `private_key` - (Required) The Certificate Private Key file (ie. `.key` file).
-
-If you choose to use __Key credentials__ you will have to provide:
-
-* `bundle_id` - (Required) The ID assigned to your iOS app. To find this value, choose Certificates, IDs & Profiles, choose App IDs in the Identifiers section, and choose your app.
-* `team_id` - (Required) The ID assigned to your Apple developer account team. This value is provided on the Membership page.
-* `token_key` - (Required) The `.p8` file that you download from your Apple developer account when you create an authentication key.
-* `token_key_id` - (Required) The ID assigned to your signing key. To find this value, choose Certificates, IDs & Profiles, and choose your key in the Keys section.
-
-## Attributes Reference
-
-No additional attributes are exported.
-
-## Import
-
-Pinpoint APNs Channel can be imported using the `application-id`, e.g.,
-
-```
-$ terraform import aws_pinpoint_apns_channel.apns application-id
-```
diff --git a/website/docs/r/pinpoint_apns_sandbox_channel.html.markdown b/website/docs/r/pinpoint_apns_sandbox_channel.html.markdown
new file mode 100644
index 00000000000..ae208f993b3
--- /dev/null
+++ b/website/docs/r/pinpoint_apns_sandbox_channel.html.markdown
@@ -0,0 +1,73 @@
+---
+subcategory: "Pinpoint"
+layout: "aws"
+page_title: "AWS: aws_pinpoint_apns_sandbox_channel"
+description: |-
+  Provides a Pinpoint APNs Sandbox Channel resource.
+---
+
+# Resource: aws_pinpoint_apns_sandbox_channel
+
+Provides a Pinpoint APNs Sandbox Channel resource.
+
+~> **Note:** All arguments, including certificates and tokens, will be stored in the raw state as plain-text.
+[Read more about sensitive data in state](https://www.terraform.io/docs/state/sensitive-data.html).
+
+## Example Usage
+
+```terraform
+resource "aws_pinpoint_apns_sandbox_channel" "apns_sandbox" {
+  application_id = aws_pinpoint_app.app.application_id
+
+  certificate = file("./certificate.pem")
+  private_key = file("./private_key.key")
+}
+
+resource "aws_pinpoint_app" "app" {}
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `application_id` - (Required) The application ID.
+* `enabled` - (Optional) Whether the channel is enabled or disabled. Defaults to `true`.
+* `default_authentication_method` - (Optional) The default authentication method used for APNs Sandbox.
+  __NOTE__: Amazon Pinpoint uses this default for every APNs push notification that you send using the console.
+  You can override the default when you send a message programmatically using the Amazon Pinpoint API, the AWS CLI, or an AWS SDK.
+  If your default authentication type fails, Amazon Pinpoint doesn't attempt to use the other authentication type.
+
+One of the following sets of credentials is also required.
+
+If you choose to use __Certificate credentials__ you will have to provide:
+
+* `certificate` - (Required) The pem encoded TLS Certificate from Apple.
+* `private_key` - (Required) The Certificate Private Key file (ie. `.key` file).
+
+If you choose to use __Key credentials__ you will have to provide:
+
+* `bundle_id` - (Required) The ID assigned to your iOS app. To find this value, choose Certificates, IDs & Profiles, choose App IDs in the Identifiers section, and choose your app.
+* `team_id` - (Required) The ID assigned to your Apple developer account team. This value is provided on the Membership page.
+* `token_key` - (Required) The `.p8` file that you download from your Apple developer account when you create an authentication key.
+* `token_key_id` - (Required) The ID assigned to your signing key. To find this value, choose Certificates, IDs & Profiles, and choose your key in the Keys section.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Pinpoint APNs Sandbox Channel using the `application-id`. For example:
+
+```terraform
+import {
+  to = aws_pinpoint_apns_sandbox_channel.apns_sandbox
+  id = "application-id"
+}
+```
+
+Using `terraform import`, import Pinpoint APNs Sandbox Channel using the `application-id`. For example:
+
+```console
+% terraform import aws_pinpoint_apns_sandbox_channel.apns_sandbox application-id
+```
diff --git a/website/docs/r/pinpoint_apns_sandbox_channel.markdown b/website/docs/r/pinpoint_apns_sandbox_channel.markdown
deleted file mode 100644
index 2de80e308c8..00000000000
--- a/website/docs/r/pinpoint_apns_sandbox_channel.markdown
+++ /dev/null
@@ -1,64 +0,0 @@
----
-subcategory: "Pinpoint"
-layout: "aws"
-page_title: "AWS: aws_pinpoint_apns_sandbox_channel"
-description: |-
-  Provides a Pinpoint APNs Sandbox Channel resource.
----
-
-# Resource: aws_pinpoint_apns_sandbox_channel
-
-Provides a Pinpoint APNs Sandbox Channel resource.
-
-~> **Note:** All arguments, including certificates and tokens, will be stored in the raw state as plain-text.
-[Read more about sensitive data in state](https://www.terraform.io/docs/state/sensitive-data.html).
-
-## Example Usage
-
-```terraform
-resource "aws_pinpoint_apns_sandbox_channel" "apns_sandbox" {
-  application_id = aws_pinpoint_app.app.application_id
-
-  certificate = file("./certificate.pem")
-  private_key = file("./private_key.key")
-}
-
-resource "aws_pinpoint_app" "app" {}
-```
-
-## Argument Reference
-
-The following arguments are supported:
-
-* `application_id` - (Required) The application ID.
-* `enabled` - (Optional) Whether the channel is enabled or disabled. Defaults to `true`.
-* `default_authentication_method` - (Optional) The default authentication method used for APNs Sandbox.
-  __NOTE__: Amazon Pinpoint uses this default for every APNs push notification that you send using the console.
-  You can override the default when you send a message programmatically using the Amazon Pinpoint API, the AWS CLI, or an AWS SDK.
-  If your default authentication type fails, Amazon Pinpoint doesn't attempt to use the other authentication type.
-
-One of the following sets of credentials is also required.
-
-If you choose to use __Certificate credentials__ you will have to provide:
-
-* `certificate` - (Required) The pem encoded TLS Certificate from Apple.
-* `private_key` - (Required) The Certificate Private Key file (ie. `.key` file).
-
-If you choose to use __Key credentials__ you will have to provide:
-
-* `bundle_id` - (Required) The ID assigned to your iOS app. To find this value, choose Certificates, IDs & Profiles, choose App IDs in the Identifiers section, and choose your app.
-* `team_id` - (Required) The ID assigned to your Apple developer account team. This value is provided on the Membership page.
-* `token_key` - (Required) The `.p8` file that you download from your Apple developer account when you create an authentication key.
-* `token_key_id` - (Required) The ID assigned to your signing key. To find this value, choose Certificates, IDs & Profiles, and choose your key in the Keys section.
-
-## Attributes Reference
-
-No additional attributes are exported.
-
-## Import
-
-Pinpoint APNs Sandbox Channel can be imported using the `application-id`, e.g.,
-
-```
-$ terraform import aws_pinpoint_apns_sandbox_channel.apns_sandbox application-id
-```
diff --git a/website/docs/r/pinpoint_apns_voip_channel.html.markdown b/website/docs/r/pinpoint_apns_voip_channel.html.markdown
new file mode 100644
index 00000000000..b774ae74d51
--- /dev/null
+++ b/website/docs/r/pinpoint_apns_voip_channel.html.markdown
@@ -0,0 +1,73 @@
+---
+subcategory: "Pinpoint"
+layout: "aws"
+page_title: "AWS: aws_pinpoint_apns_voip_channel"
+description: |-
+  Provides a Pinpoint APNs VoIP Channel resource.
+---
+
+# Resource: aws_pinpoint_apns_voip_channel
+
+Provides a Pinpoint APNs VoIP Channel resource.
+
+~> **Note:** All arguments, including certificates and tokens, will be stored in the raw state as plain-text.
+[Read more about sensitive data in state](https://www.terraform.io/docs/state/sensitive-data.html).
+
+## Example Usage
+
+```terraform
+resource "aws_pinpoint_apns_voip_channel" "apns_voip" {
+  application_id = aws_pinpoint_app.app.application_id
+
+  certificate = file("./certificate.pem")
+  private_key = file("./private_key.key")
+}
+
+resource "aws_pinpoint_app" "app" {}
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `application_id` - (Required) The application ID.
+* `enabled` - (Optional) Whether the channel is enabled or disabled. Defaults to `true`.
+* `default_authentication_method` - (Optional) The default authentication method used for APNs.
+  __NOTE__: Amazon Pinpoint uses this default for every APNs push notification that you send using the console.
+  You can override the default when you send a message programmatically using the Amazon Pinpoint API, the AWS CLI, or an AWS SDK.
+  If your default authentication type fails, Amazon Pinpoint doesn't attempt to use the other authentication type.
+
+One of the following sets of credentials is also required.
+
+If you choose to use __Certificate credentials__ you will have to provide:
+
+* `certificate` - (Required) The pem encoded TLS Certificate from Apple.
+* `private_key` - (Required) The Certificate Private Key file (ie. `.key` file).
+
+If you choose to use __Key credentials__ you will have to provide:
+
+* `bundle_id` - (Required) The ID assigned to your iOS app. To find this value, choose Certificates, IDs & Profiles, choose App IDs in the Identifiers section, and choose your app.
+* `team_id` - (Required) The ID assigned to your Apple developer account team. This value is provided on the Membership page.
+* `token_key` - (Required) The `.p8` file that you download from your Apple developer account when you create an authentication key.
+* `token_key_id` - (Required) The ID assigned to your signing key. To find this value, choose Certificates, IDs & Profiles, and choose your key in the Keys section.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Pinpoint APNs VoIP Channel using the `application-id`. For example:
+
+```terraform
+import {
+  to = aws_pinpoint_apns_voip_channel.apns_voip
+  id = "application-id"
+}
+```
+
+Using `terraform import`, import Pinpoint APNs VoIP Channel using the `application-id`. For example:
+
+```console
+% terraform import aws_pinpoint_apns_voip_channel.apns_voip application-id
+```
diff --git a/website/docs/r/pinpoint_apns_voip_channel.markdown b/website/docs/r/pinpoint_apns_voip_channel.markdown
deleted file mode 100644
index 749ef6c413a..00000000000
--- a/website/docs/r/pinpoint_apns_voip_channel.markdown
+++ /dev/null
@@ -1,64 +0,0 @@
----
-subcategory: "Pinpoint"
-layout: "aws"
-page_title: "AWS: aws_pinpoint_apns_voip_channel"
-description: |-
-  Provides a Pinpoint APNs VoIP Channel resource.
----
-
-# Resource: aws_pinpoint_apns_voip_channel
-
-Provides a Pinpoint APNs VoIP Channel resource.
-
-~> **Note:** All arguments, including certificates and tokens, will be stored in the raw state as plain-text.
-[Read more about sensitive data in state](https://www.terraform.io/docs/state/sensitive-data.html).
-
-## Example Usage
-
-```terraform
-resource "aws_pinpoint_apns_voip_channel" "apns_voip" {
-  application_id = aws_pinpoint_app.app.application_id
-
-  certificate = file("./certificate.pem")
-  private_key = file("./private_key.key")
-}
-
-resource "aws_pinpoint_app" "app" {}
-```
-
-## Argument Reference
-
-The following arguments are supported:
-
-* `application_id` - (Required) The application ID.
-* `enabled` - (Optional) Whether the channel is enabled or disabled. Defaults to `true`.
-* `default_authentication_method` - (Optional) The default authentication method used for APNs.
-  __NOTE__: Amazon Pinpoint uses this default for every APNs push notification that you send using the console.
-  You can override the default when you send a message programmatically using the Amazon Pinpoint API, the AWS CLI, or an AWS SDK.
-  If your default authentication type fails, Amazon Pinpoint doesn't attempt to use the other authentication type.
-
-One of the following sets of credentials is also required.
-
-If you choose to use __Certificate credentials__ you will have to provide:
-
-* `certificate` - (Required) The pem encoded TLS Certificate from Apple.
-* `private_key` - (Required) The Certificate Private Key file (ie. `.key` file).
-
-If you choose to use __Key credentials__ you will have to provide:
-
-* `bundle_id` - (Required) The ID assigned to your iOS app. To find this value, choose Certificates, IDs & Profiles, choose App IDs in the Identifiers section, and choose your app.
-* `team_id` - (Required) The ID assigned to your Apple developer account team. This value is provided on the Membership page.
-* `token_key` - (Required) The `.p8` file that you download from your Apple developer account when you create an authentication key.
-* `token_key_id` - (Required) The ID assigned to your signing key. To find this value, choose Certificates, IDs & Profiles, and choose your key in the Keys section.
-
-## Attributes Reference
-
-No additional attributes are exported.
-
-## Import
-
-Pinpoint APNs VoIP Channel can be imported using the `application-id`, e.g.,
-
-```
-$ terraform import aws_pinpoint_apns_voip_channel.apns_voip application-id
-```
diff --git a/website/docs/r/pinpoint_apns_voip_sandbox_channel.html.markdown b/website/docs/r/pinpoint_apns_voip_sandbox_channel.html.markdown
new file mode 100644
index 00000000000..5205ff2659c
--- /dev/null
+++ b/website/docs/r/pinpoint_apns_voip_sandbox_channel.html.markdown
@@ -0,0 +1,73 @@
+---
+subcategory: "Pinpoint"
+layout: "aws"
+page_title: "AWS: aws_pinpoint_apns_voip_sandbox_channel"
+description: |-
+  Provides a Pinpoint APNs VoIP Sandbox Channel resource.
+---
+
+# Resource: aws_pinpoint_apns_voip_sandbox_channel
+
+Provides a Pinpoint APNs VoIP Sandbox Channel resource.
+
+~> **Note:** All arguments, including certificates and tokens, will be stored in the raw state as plain-text.
+[Read more about sensitive data in state](https://www.terraform.io/docs/state/sensitive-data.html).
+
+## Example Usage
+
+```terraform
+resource "aws_pinpoint_apns_voip_sandbox_channel" "apns_voip_sandbox" {
+  application_id = aws_pinpoint_app.app.application_id
+
+  certificate = file("./certificate.pem")
+  private_key = file("./private_key.key")
+}
+
+resource "aws_pinpoint_app" "app" {}
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `application_id` - (Required) The application ID.
+* `enabled` - (Optional) Whether the channel is enabled or disabled. Defaults to `true`.
+* `default_authentication_method` - (Optional) The default authentication method used for APNs.
+  __NOTE__: Amazon Pinpoint uses this default for every APNs push notification that you send using the console.
+  You can override the default when you send a message programmatically using the Amazon Pinpoint API, the AWS CLI, or an AWS SDK.
+  If your default authentication type fails, Amazon Pinpoint doesn't attempt to use the other authentication type.
+
+One of the following sets of credentials is also required.
+
+If you choose to use __Certificate credentials__ you will have to provide:
+
+* `certificate` - (Required) The pem encoded TLS Certificate from Apple.
+* `private_key` - (Required) The Certificate Private Key file (ie. `.key` file).
+
+If you choose to use __Key credentials__ you will have to provide:
+
+* `bundle_id` - (Required) The ID assigned to your iOS app. To find this value, choose Certificates, IDs & Profiles, choose App IDs in the Identifiers section, and choose your app.
+* `team_id` - (Required) The ID assigned to your Apple developer account team. This value is provided on the Membership page.
+* `token_key` - (Required) The `.p8` file that you download from your Apple developer account when you create an authentication key.
+* `token_key_id` - (Required) The ID assigned to your signing key. To find this value, choose Certificates, IDs & Profiles, and choose your key in the Keys section.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Pinpoint APNs VoIP Sandbox Channel using the `application-id`. For example:
+
+```terraform
+import {
+  to = aws_pinpoint_apns_voip_sandbox_channel.apns_voip_sandbox
+  id = "application-id"
+}
+```
+
+Using `terraform import`, import Pinpoint APNs VoIP Sandbox Channel using the `application-id`. For example:
+
+```console
+% terraform import aws_pinpoint_apns_voip_sandbox_channel.apns_voip_sandbox application-id
+```
diff --git a/website/docs/r/pinpoint_apns_voip_sandbox_channel.markdown b/website/docs/r/pinpoint_apns_voip_sandbox_channel.markdown
deleted file mode 100644
index 66f94c1bffa..00000000000
--- a/website/docs/r/pinpoint_apns_voip_sandbox_channel.markdown
+++ /dev/null
@@ -1,64 +0,0 @@
----
-subcategory: "Pinpoint"
-layout: "aws"
-page_title: "AWS: aws_pinpoint_apns_voip_sandbox_channel"
-description: |-
-  Provides a Pinpoint APNs VoIP Sandbox Channel resource.
----
-
-# Resource: aws_pinpoint_apns_voip_sandbox_channel
-
-Provides a Pinpoint APNs VoIP Sandbox Channel resource.
-
-~> **Note:** All arguments, including certificates and tokens, will be stored in the raw state as plain-text.
-[Read more about sensitive data in state](https://www.terraform.io/docs/state/sensitive-data.html).
-
-## Example Usage
-
-```terraform
-resource "aws_pinpoint_apns_voip_sandbox_channel" "apns_voip_sandbox" {
-  application_id = aws_pinpoint_app.app.application_id
-
-  certificate = file("./certificate.pem")
-  private_key = file("./private_key.key")
-}
-
-resource "aws_pinpoint_app" "app" {}
-```
-
-## Argument Reference
-
-The following arguments are supported:
-
-* `application_id` - (Required) The application ID.
-* `enabled` - (Optional) Whether the channel is enabled or disabled. Defaults to `true`.
-* `default_authentication_method` - (Optional) The default authentication method used for APNs.
-  __NOTE__: Amazon Pinpoint uses this default for every APNs push notification that you send using the console.
-  You can override the default when you send a message programmatically using the Amazon Pinpoint API, the AWS CLI, or an AWS SDK.
-  If your default authentication type fails, Amazon Pinpoint doesn't attempt to use the other authentication type.
-
-One of the following sets of credentials is also required.
-
-If you choose to use __Certificate credentials__ you will have to provide:
-
-* `certificate` - (Required) The pem encoded TLS Certificate from Apple.
-* `private_key` - (Required) The Certificate Private Key file (ie. `.key` file).
-
-If you choose to use __Key credentials__ you will have to provide:
-
-* `bundle_id` - (Required) The ID assigned to your iOS app. To find this value, choose Certificates, IDs & Profiles, choose App IDs in the Identifiers section, and choose your app.
-* `team_id` - (Required) The ID assigned to your Apple developer account team. This value is provided on the Membership page.
-* `token_key` - (Required) The `.p8` file that you download from your Apple developer account when you create an authentication key.
-* `token_key_id` - (Required) The ID assigned to your signing key. To find this value, choose Certificates, IDs & Profiles, and choose your key in the Keys section.
-
-## Attributes Reference
-
-No additional attributes are exported.
-
-## Import
-
-Pinpoint APNs VoIP Sandbox Channel can be imported using the `application-id`, e.g.,
-
-```
-$ terraform import aws_pinpoint_apns_voip_sandbox_channel.apns_voip_sandbox application-id
-```
diff --git a/website/docs/r/pinpoint_app.html.markdown b/website/docs/r/pinpoint_app.html.markdown
new file mode 100644
index 00000000000..965ff3fb9de
--- /dev/null
+++ b/website/docs/r/pinpoint_app.html.markdown
@@ -0,0 +1,82 @@
+---
+subcategory: "Pinpoint"
+layout: "aws"
+page_title: "AWS: aws_pinpoint_app"
+description: |-
+  Provides a Pinpoint App resource.
+---
+
+# Resource: aws_pinpoint_app
+
+Provides a Pinpoint App resource.
+
+## Example Usage
+
+```terraform
+resource "aws_pinpoint_app" "example" {
+  name = "test-app"
+
+  limits {
+    maximum_duration = 600
+  }
+
+  quiet_time {
+    start = "00:00"
+    end   = "06:00"
+  }
+}
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Optional) The application name. By default generated by Terraform
+* `name_prefix` - (Optional) The name of the Pinpoint application. Conflicts with `name`
+* `campaign_hook` - (Optional) Specifies settings for invoking an AWS Lambda function that customizes a segment for a campaign
+* `limits` - (Optional) The default campaign limits for the app. These limits apply to each campaign for the app, unless the campaign overrides the default with limits of its own
+* `quiet_time` - (Optional) The default quiet time for the app. Each campaign for this app sends no messages during this time unless the campaign overrides the default with a quiet time of its own
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+`campaign_hook` supports the following:
+
+* `lambda_function_name` - (Optional) Lambda function name or ARN to be called for delivery. Conflicts with `web_url`
+* `mode` - (Required if `lambda_function_name` or `web_url` are provided) What mode Lambda should be invoked in. Valid values for this parameter are `DELIVERY`, `FILTER`.  
+* `web_url` - (Optional) Web URL to call for hook. If the URL has authentication specified it will be added as authentication to the request. Conflicts with `lambda_function_name`
+
+`limits` supports the following:
+
+* `daily` - (Optional) The maximum number of messages that the campaign can send daily.
+* `maximum_duration` - (Optional) The length of time (in seconds) that the campaign can run before it ends and message deliveries stop. This duration begins at the scheduled start time for the campaign. The minimum value is 60.
+* `messages_per_second` - (Optional) The number of messages that the campaign can send per second. The minimum value is 50, and the maximum is 20000.
+* `total` - (Optional) The maximum total number of messages that the campaign can send.
+
+`quiet_time` supports the following:
+
+* `end` - (Optional) The default end time for quiet time in ISO 8601 format. Required if `start` is set
+* `start` - (Optional) The default start time for quiet time in ISO 8601 format. Required if `end` is set
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `application_id` - The Application ID of the Pinpoint App.
+* `arn` - Amazon Resource Name (ARN) of the PinPoint Application
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Pinpoint App using the `application-id`. For example:
+
+```terraform
+import {
+  to = aws_pinpoint_app.name
+  id = "application-id"
+}
+```
+
+Using `terraform import`, import Pinpoint App using the `application-id`. For example:
+
+```console
+% terraform import aws_pinpoint_app.name application-id
+```
diff --git a/website/docs/r/pinpoint_app.markdown b/website/docs/r/pinpoint_app.markdown
deleted file mode 100644
index 3f0b577a3dd..00000000000
--- a/website/docs/r/pinpoint_app.markdown
+++ /dev/null
@@ -1,73 +0,0 @@
----
-subcategory: "Pinpoint"
-layout: "aws"
-page_title: "AWS: aws_pinpoint_app"
-description: |-
-  Provides a Pinpoint App resource.
----
-
-# Resource: aws_pinpoint_app
-
-Provides a Pinpoint App resource.
-
-## Example Usage
-
-```terraform
-resource "aws_pinpoint_app" "example" {
-  name = "test-app"
-
-  limits {
-    maximum_duration = 600
-  }
-
-  quiet_time {
-    start = "00:00"
-    end   = "06:00"
-  }
-}
-```
-
-## Argument Reference
-
-The following arguments are supported:
-
-* `name` - (Optional) The application name. By default generated by Terraform
-* `name_prefix` - (Optional) The name of the Pinpoint application. Conflicts with `name`
-* `campaign_hook` - (Optional) Specifies settings for invoking an AWS Lambda function that customizes a segment for a campaign
-* `limits` - (Optional) The default campaign limits for the app. These limits apply to each campaign for the app, unless the campaign overrides the default with limits of its own
-* `quiet_time` - (Optional) The default quiet time for the app. Each campaign for this app sends no messages during this time unless the campaign overrides the default with a quiet time of its own
-* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
-
-`campaign_hook` supports the following:
-
-* `lambda_function_name` - (Optional) Lambda function name or ARN to be called for delivery. Conflicts with `web_url`
-* `mode` - (Required if `lambda_function_name` or `web_url` are provided) What mode Lambda should be invoked in. Valid values for this parameter are `DELIVERY`, `FILTER`.  
-* `web_url` - (Optional) Web URL to call for hook. If the URL has authentication specified it will be added as authentication to the request. Conflicts with `lambda_function_name`
-
-`limits` supports the following:
-
-* `daily` - (Optional) The maximum number of messages that the campaign can send daily.
-* `maximum_duration` - (Optional) The length of time (in seconds) that the campaign can run before it ends and message deliveries stop. This duration begins at the scheduled start time for the campaign. The minimum value is 60.
-* `messages_per_second` - (Optional) The number of messages that the campaign can send per second. The minimum value is 50, and the maximum is 20000.
-* `total` - (Optional) The maximum total number of messages that the campaign can send.
-
-`quiet_time` supports the following:
-
-* `end` - (Optional) The default end time for quiet time in ISO 8601 format. Required if `start` is set
-* `start` - (Optional) The default start time for quiet time in ISO 8601 format. Required if `end` is set
-
-## Attributes Reference
-
-In addition to all arguments above, the following attributes are exported:
-
-* `application_id` - The Application ID of the Pinpoint App.
-* `arn` - Amazon Resource Name (ARN) of the PinPoint Application
-* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
-
-## Import
-
-Pinpoint App can be imported using the `application-id`, e.g.,
-
-```
-$ terraform import aws_pinpoint_app.name application-id
-```
diff --git a/website/docs/r/pinpoint_baidu_channel.html.markdown b/website/docs/r/pinpoint_baidu_channel.html.markdown
new file mode 100644
index 00000000000..e30e4092c77
--- /dev/null
+++ b/website/docs/r/pinpoint_baidu_channel.html.markdown
@@ -0,0 +1,56 @@
+---
+subcategory: "Pinpoint"
+layout: "aws"
+page_title: "AWS: aws_pinpoint_baidu_channel"
+description: |-
+  Provides a Pinpoint Baidu Channel resource.
+---
+
+# Resource: aws_pinpoint_baidu_channel
+
+Provides a Pinpoint Baidu Channel resource.
+
+~> **Note:** All arguments including the Api Key and Secret Key will be stored in the raw state as plain-text.
+[Read more about sensitive data in state](https://www.terraform.io/docs/state/sensitive-data.html).
+
+## Example Usage
+
+```terraform
+resource "aws_pinpoint_app" "app" {}
+
+resource "aws_pinpoint_baidu_channel" "channel" {
+  application_id = aws_pinpoint_app.app.application_id
+  api_key        = ""
+  secret_key     = ""
+}
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `application_id` - (Required) The application ID.
+* `enabled` - (Optional) Specifies whether to enable the channel. Defaults to `true`.
+* `api_key` - (Required) Platform credential API key from Baidu.
+* `secret_key` - (Required) Platform credential Secret key from Baidu.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Pinpoint Baidu Channel using the `application-id`. For example:
+
+```terraform
+import {
+  to = aws_pinpoint_baidu_channel.channel
+  id = "application-id"
+}
+```
+
+Using `terraform import`, import Pinpoint Baidu Channel using the `application-id`. For example:
+
+```console
+% terraform import aws_pinpoint_baidu_channel.channel application-id
+```
diff --git a/website/docs/r/pinpoint_baidu_channel.markdown b/website/docs/r/pinpoint_baidu_channel.markdown
deleted file mode 100644
index 160d0533f04..00000000000
--- a/website/docs/r/pinpoint_baidu_channel.markdown
+++ /dev/null
@@ -1,47 +0,0 @@
----
-subcategory: "Pinpoint"
-layout: "aws"
-page_title: "AWS: aws_pinpoint_baidu_channel"
-description: |-
-  Provides a Pinpoint Baidu Channel resource.
----
-
-# Resource: aws_pinpoint_baidu_channel
-
-Provides a Pinpoint Baidu Channel resource.
-
-~> **Note:** All arguments including the Api Key and Secret Key will be stored in the raw state as plain-text.
-[Read more about sensitive data in state](https://www.terraform.io/docs/state/sensitive-data.html).
-
-## Example Usage
-
-```terraform
-resource "aws_pinpoint_app" "app" {}
-
-resource "aws_pinpoint_baidu_channel" "channel" {
-  application_id = aws_pinpoint_app.app.application_id
-  api_key        = ""
-  secret_key     = ""
-}
-```
-
-## Argument Reference
-
-The following arguments are supported:
-
-* `application_id` - (Required) The application ID.
-* `enabled` - (Optional) Specifies whether to enable the channel. Defaults to `true`.
-* `api_key` - (Required) Platform credential API key from Baidu.
-* `secret_key` - (Required) Platform credential Secret key from Baidu.
-
-## Attributes Reference
-
-No additional attributes are exported.
-
-## Import
-
-Pinpoint Baidu Channel can be imported using the `application-id`, e.g.,
-
-```
-$ terraform import aws_pinpoint_baidu_channel.channel application-id
-```
diff --git a/website/docs/r/pinpoint_email_channel.html.markdown b/website/docs/r/pinpoint_email_channel.html.markdown
new file mode 100644
index 00000000000..1a6269d0523
--- /dev/null
+++ b/website/docs/r/pinpoint_email_channel.html.markdown
@@ -0,0 +1,97 @@
+---
+subcategory: "Pinpoint"
+layout: "aws"
+page_title: "AWS: aws_pinpoint_email_channel"
+description: |-
+  Provides a Pinpoint Email Channel resource.
+---
+
+# Resource: aws_pinpoint_email_channel
+
+Provides a Pinpoint Email Channel resource.
+
+## Example Usage
+
+```terraform
+resource "aws_pinpoint_email_channel" "email" {
+  application_id = aws_pinpoint_app.app.application_id
+  from_address   = "user@example.com"
+  role_arn       = aws_iam_role.role.arn
+}
+
+resource "aws_pinpoint_app" "app" {}
+
+resource "aws_ses_domain_identity" "identity" {
+  domain = "example.com"
+}
+
+data "aws_iam_policy_document" "assume_role" {
+  statement {
+    effect = "Allow"
+
+    principals {
+      type        = "Service"
+      identifiers = ["pinpoint.amazonaws.com"]
+    }
+
+    actions = ["sts:AssumeRole"]
+  }
+}
+
+resource "aws_iam_role" "role" {
+  assume_role_policy = data.aws_iam_policy_document.assume_role.json
+}
+
+data "aws_iam_policy_document" "role_policy" {
+  statement {
+    effect = "Allow"
+
+    actions = [
+      "mobileanalytics:PutEvents",
+      "mobileanalytics:PutItems",
+    ]
+
+    resources = ["*"]
+  }
+}
+
+resource "aws_iam_role_policy" "role_policy" {
+  name   = "role_policy"
+  role   = aws_iam_role.role.id
+  policy = data.aws_iam_policy_document.role_policy.json
+}
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `application_id` - (Required) The application ID.
+* `enabled` - (Optional) Whether the channel is enabled or disabled. Defaults to `true`.
+* `configuration_set` - (Optional) The ARN of the Amazon SES configuration set that you want to apply to messages that you send through the channel.
+* `from_address` - (Required) The email address used to send emails from. You can use email only (`user@example.com`) or friendly address (`User <user@example.com>`). This field comply with [RFC 5322](https://www.ietf.org/rfc/rfc5322.txt).
+* `identity` - (Required) The ARN of an identity verified with SES.
+* `role_arn` - (Optional) The ARN of an IAM Role used to submit events to Mobile Analytics' event ingestion service.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `messages_per_second` - Messages per second that can be sent.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Pinpoint Email Channel using the `application-id`. For example:
+
+```terraform
+import {
+  to = aws_pinpoint_email_channel.email
+  id = "application-id"
+}
+```
+
+Using `terraform import`, import Pinpoint Email Channel using the `application-id`. For example:
+
+```console
+% terraform import aws_pinpoint_email_channel.email application-id
+```
diff --git a/website/docs/r/pinpoint_email_channel.markdown b/website/docs/r/pinpoint_email_channel.markdown
deleted file mode 100644
index b40a5973dfa..00000000000
--- a/website/docs/r/pinpoint_email_channel.markdown
+++ /dev/null
@@ -1,88 +0,0 @@
----
-subcategory: "Pinpoint"
-layout: "aws"
-page_title: "AWS: aws_pinpoint_email_channel"
-description: |-
-  Provides a Pinpoint Email Channel resource.
----
-
-# Resource: aws_pinpoint_email_channel
-
-Provides a Pinpoint Email Channel resource.
-
-## Example Usage
-
-```terraform
-resource "aws_pinpoint_email_channel" "email" {
-  application_id = aws_pinpoint_app.app.application_id
-  from_address   = "user@example.com"
-  role_arn       = aws_iam_role.role.arn
-}
-
-resource "aws_pinpoint_app" "app" {}
-
-resource "aws_ses_domain_identity" "identity" {
-  domain = "example.com"
-}
-
-data "aws_iam_policy_document" "assume_role" {
-  statement {
-    effect = "Allow"
-
-    principals {
-      type        = "Service"
-      identifiers = ["pinpoint.amazonaws.com"]
-    }
-
-    actions = ["sts:AssumeRole"]
-  }
-}
-
-resource "aws_iam_role" "role" {
-  assume_role_policy = data.aws_iam_policy_document.assume_role.json
-}
-
-data "aws_iam_policy_document" "role_policy" {
-  statement {
-    effect = "Allow"
-
-    actions = [
-      "mobileanalytics:PutEvents",
-      "mobileanalytics:PutItems",
-    ]
-
-    resources = ["*"]
-  }
-}
-
-resource "aws_iam_role_policy" "role_policy" {
-  name   = "role_policy"
-  role   = aws_iam_role.role.id
-  policy = data.aws_iam_policy_document.role_policy.json
-}
-```
-
-## Argument Reference
-
-The following arguments are supported:
-
-* `application_id` - (Required) The application ID.
-* `enabled` - (Optional) Whether the channel is enabled or disabled. Defaults to `true`.
-* `configuration_set` - (Optional) The ARN of the Amazon SES configuration set that you want to apply to messages that you send through the channel.
-* `from_address` - (Required) The email address used to send emails from. You can use email only (`user@example.com`) or friendly address (`User <user@example.com>`). This field comply with [RFC 5322](https://www.ietf.org/rfc/rfc5322.txt).
-* `identity` - (Required) The ARN of an identity verified with SES.
-* `role_arn` - (Optional) The ARN of an IAM Role used to submit events to Mobile Analytics' event ingestion service.
-
-## Attributes Reference
-
-In addition to all arguments above, the following attributes are exported:
-
-* `messages_per_second` - Messages per second that can be sent.
-
-## Import
-
-Pinpoint Email Channel can be imported using the `application-id`, e.g.,
-
-```
-$ terraform import aws_pinpoint_email_channel.email application-id
-```
diff --git a/website/docs/r/pinpoint_event_stream.html.markdown b/website/docs/r/pinpoint_event_stream.html.markdown
new file mode 100644
index 00000000000..a434ebfa7b2
--- /dev/null
+++ b/website/docs/r/pinpoint_event_stream.html.markdown
@@ -0,0 +1,92 @@
+---
+subcategory: "Pinpoint"
+layout: "aws"
+page_title: "AWS: aws_pinpoint_event_stream"
+description: |-
+  Provides a Pinpoint Event Stream resource.
+---
+
+# Resource: aws_pinpoint_event_stream
+
+Provides a Pinpoint Event Stream resource.
+
+## Example Usage
+
+```terraform
+resource "aws_pinpoint_event_stream" "stream" {
+  application_id         = aws_pinpoint_app.app.application_id
+  destination_stream_arn = aws_kinesis_stream.test_stream.arn
+  role_arn               = aws_iam_role.test_role.arn
+}
+
+resource "aws_pinpoint_app" "app" {}
+
+resource "aws_kinesis_stream" "test_stream" {
+  name        = "pinpoint-kinesis-test"
+  shard_count = 1
+}
+
+data "aws_iam_policy_document" "assume_role" {
+  statement {
+    effect = "Allow"
+
+    principals {
+      type        = "Service"
+      identifiers = ["pinpoint.us-east-1.amazonaws.com"]
+    }
+
+    actions = ["sts:AssumeRole"]
+  }
+}
+
+resource "aws_iam_role" "test_role" {
+  assume_role_policy = data.aws_iam_policy_document.assume_role.json
+}
+
+data "aws_iam_policy_document" "test_role_policy" {
+  statement {
+    effect = "Allow"
+
+    actions = [
+      "kinesis:PutRecords",
+      "kinesis:DescribeStream",
+    ]
+
+    resources = ["arn:aws:kinesis:us-east-1:*:*/*"]
+  }
+}
+resource "aws_iam_role_policy" "test_role_policy" {
+  name   = "test_policy"
+  role   = aws_iam_role.test_role.id
+  policy = data.aws_iam_policy_document.test_role_policy.json
+}
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `application_id` - (Required) The application ID.
+* `destination_stream_arn` - (Required) The Amazon Resource Name (ARN) of the Amazon Kinesis stream or Firehose delivery stream to which you want to publish events.
+* `role_arn` - (Required) The IAM role that authorizes Amazon Pinpoint to publish events to the stream in your account.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Pinpoint Event Stream using the `application-id`. For example:
+
+```terraform
+import {
+  to = aws_pinpoint_event_stream.stream
+  id = "application-id"
+}
+```
+
+Using `terraform import`, import Pinpoint Event Stream using the `application-id`. For example:
+
+```console
+% terraform import aws_pinpoint_event_stream.stream application-id
+```
diff --git a/website/docs/r/pinpoint_event_stream.markdown b/website/docs/r/pinpoint_event_stream.markdown
deleted file mode 100644
index 933972ead78..00000000000
--- a/website/docs/r/pinpoint_event_stream.markdown
+++ /dev/null
@@ -1,83 +0,0 @@
----
-subcategory: "Pinpoint"
-layout: "aws"
-page_title: "AWS: aws_pinpoint_event_stream"
-description: |-
-  Provides a Pinpoint Event Stream resource.
----
-
-# Resource: aws_pinpoint_event_stream
-
-Provides a Pinpoint Event Stream resource.
-
-## Example Usage
-
-```terraform
-resource "aws_pinpoint_event_stream" "stream" {
-  application_id         = aws_pinpoint_app.app.application_id
-  destination_stream_arn = aws_kinesis_stream.test_stream.arn
-  role_arn               = aws_iam_role.test_role.arn
-}
-
-resource "aws_pinpoint_app" "app" {}
-
-resource "aws_kinesis_stream" "test_stream" {
-  name        = "pinpoint-kinesis-test"
-  shard_count = 1
-}
-
-data "aws_iam_policy_document" "assume_role" {
-  statement {
-    effect = "Allow"
-
-    principals {
-      type        = "Service"
-      identifiers = ["pinpoint.us-east-1.amazonaws.com"]
-    }
-
-    actions = ["sts:AssumeRole"]
-  }
-}
-
-resource "aws_iam_role" "test_role" {
-  assume_role_policy = data.aws_iam_policy_document.assume_role.json
-}
-
-data "aws_iam_policy_document" "test_role_policy" {
-  statement {
-    effect = "Allow"
-
-    actions = [
-      "kinesis:PutRecords",
-      "kinesis:DescribeStream",
-    ]
-
-    resources = ["arn:aws:kinesis:us-east-1:*:*/*"]
-  }
-}
-resource "aws_iam_role_policy" "test_role_policy" {
-  name   = "test_policy"
-  role   = aws_iam_role.test_role.id
-  policy = data.aws_iam_policy_document.test_role_policy.json
-}
-```
-
-## Argument Reference
-
-The following arguments are supported:
-
-* `application_id` - (Required) The application ID.
-* `destination_stream_arn` - (Required) The Amazon Resource Name (ARN) of the Amazon Kinesis stream or Firehose delivery stream to which you want to publish events.
-* `role_arn` - (Required) The IAM role that authorizes Amazon Pinpoint to publish events to the stream in your account.
-
-## Attributes Reference
-
-No additional attributes are exported.
-
-## Import
-
-Pinpoint Event Stream can be imported using the `application-id`, e.g.,
-
-```
-$ terraform import aws_pinpoint_event_stream.stream application-id
-```
diff --git a/website/docs/r/pinpoint_gcm_channel.html.markdown b/website/docs/r/pinpoint_gcm_channel.html.markdown
new file mode 100644
index 00000000000..a68febdd23f
--- /dev/null
+++ b/website/docs/r/pinpoint_gcm_channel.html.markdown
@@ -0,0 +1,54 @@
+---
+subcategory: "Pinpoint"
+layout: "aws"
+page_title: "AWS: aws_pinpoint_gcm_channel"
+description: |-
+  Provides a Pinpoint GCM Channel resource.
+---
+
+# Resource: aws_pinpoint_gcm_channel
+
+Provides a Pinpoint GCM Channel resource.
+
+~> **Note:** Api Key argument will be stored in the raw state as plain-text.
+[Read more about sensitive data in state](https://www.terraform.io/docs/state/sensitive-data.html).
+
+## Example Usage
+
+```terraform
+resource "aws_pinpoint_gcm_channel" "gcm" {
+  application_id = aws_pinpoint_app.app.application_id
+  api_key        = "api_key"
+}
+
+resource "aws_pinpoint_app" "app" {}
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `application_id` - (Required) The application ID.
+* `api_key` - (Required) Platform credential API key from Google.
+* `enabled` - (Optional) Whether the channel is enabled or disabled. Defaults to `true`.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Pinpoint GCM Channel using the `application-id`. For example:
+
+```terraform
+import {
+  to = aws_pinpoint_gcm_channel.gcm
+  id = "application-id"
+}
+```
+
+Using `terraform import`, import Pinpoint GCM Channel using the `application-id`. For example:
+
+```console
+% terraform import aws_pinpoint_gcm_channel.gcm application-id
+```
diff --git a/website/docs/r/pinpoint_gcm_channel.markdown b/website/docs/r/pinpoint_gcm_channel.markdown
deleted file mode 100644
index 45fd897d8c4..00000000000
--- a/website/docs/r/pinpoint_gcm_channel.markdown
+++ /dev/null
@@ -1,45 +0,0 @@
----
-subcategory: "Pinpoint"
-layout: "aws"
-page_title: "AWS: aws_pinpoint_gcm_channel"
-description: |-
-  Provides a Pinpoint GCM Channel resource.
----
-
-# Resource: aws_pinpoint_gcm_channel
-
-Provides a Pinpoint GCM Channel resource.
-
-~> **Note:** Api Key argument will be stored in the raw state as plain-text.
-[Read more about sensitive data in state](https://www.terraform.io/docs/state/sensitive-data.html).
-
-## Example Usage
-
-```terraform
-resource "aws_pinpoint_gcm_channel" "gcm" {
-  application_id = aws_pinpoint_app.app.application_id
-  api_key        = "api_key"
-}
-
-resource "aws_pinpoint_app" "app" {}
-```
-
-## Argument Reference
-
-The following arguments are supported:
-
-* `application_id` - (Required) The application ID.
-* `api_key` - (Required) Platform credential API key from Google.
-* `enabled` - (Optional) Whether the channel is enabled or disabled. Defaults to `true`.
-
-## Attributes Reference
-
-No additional attributes are exported.
-
-## Import
-
-Pinpoint GCM Channel can be imported using the `application-id`, e.g.,
-
-```
-$ terraform import aws_pinpoint_gcm_channel.gcm application-id
-```
diff --git a/website/docs/r/pinpoint_sms_channel.html.markdown b/website/docs/r/pinpoint_sms_channel.html.markdown
new file mode 100644
index 00000000000..284d72aa3d3
--- /dev/null
+++ b/website/docs/r/pinpoint_sms_channel.html.markdown
@@ -0,0 +1,54 @@
+---
+subcategory: "Pinpoint"
+layout: "aws"
+page_title: "AWS: aws_pinpoint_sms_channel"
+description: |-
+  Use the `aws_pinpoint_sms_channel` resource to manage Pinpoint SMS Channels.
+---
+
+# Resource: aws_pinpoint_sms_channel
+
+Use the `aws_pinpoint_sms_channel` resource to manage Pinpoint SMS Channels.
+
+## Example Usage
+
+```terraform
+resource "aws_pinpoint_sms_channel" "sms" {
+  application_id = aws_pinpoint_app.app.application_id
+}
+
+resource "aws_pinpoint_app" "app" {}
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `application_id` - (Required) ID of the application.
+* `enabled` - (Optional) Whether the channel is enabled or disabled. By default, it is set to `true`.
+* `sender_id` - (Optional) Identifier of the sender for your messages.
+* `short_code` - (Optional) Short Code registered with the phone provider.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `promotional_messages_per_second` - Maximum number of promotional messages that can be sent per second.
+* `transactional_messages_per_second` - Maximum number of transactional messages per second that can be sent.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import the Pinpoint SMS Channel using the `application_id`. For example:
+
+```terraform
+import {
+  to = aws_pinpoint_sms_channel.sms
+  id = "application-id"
+}
+```
+
+Using `terraform import`, import the Pinpoint SMS Channel using the `application_id`. For example:
+
+```console
+% terraform import aws_pinpoint_sms_channel.sms application-id
+```
diff --git a/website/docs/r/pinpoint_sms_channel.markdown b/website/docs/r/pinpoint_sms_channel.markdown
deleted file mode 100644
index 549f4c0c27f..00000000000
--- a/website/docs/r/pinpoint_sms_channel.markdown
+++ /dev/null
@@ -1,45 +0,0 @@
----
-subcategory: "Pinpoint"
-layout: "aws"
-page_title: "AWS: aws_pinpoint_sms_channel"
-description: |-
-  Provides a Pinpoint SMS Channel resource.
----
-
-# Resource: aws_pinpoint_sms_channel
-
-Provides a Pinpoint SMS Channel resource.
-
-## Example Usage
-
-```terraform
-resource "aws_pinpoint_sms_channel" "sms" {
-  application_id = aws_pinpoint_app.app.application_id
-}
-
-resource "aws_pinpoint_app" "app" {}
-```
-
-## Argument Reference
-
-The following arguments are supported:
-
-* `application_id` - (Required) The application ID.
-* `enabled` - (Optional) Whether the channel is enabled or disabled. Defaults to `true`.
-* `sender_id` - (Optional) Sender identifier of your messages.
-* `short_code` - (Optional) The Short Code registered with the phone provider.
-
-## Attributes Reference
-
-In addition to all arguments above, the following attributes are exported:
-
-* `promotional_messages_per_second` - Promotional messages per second that can be sent.
-* `transactional_messages_per_second` - Transactional messages per second that can be sent.
-
-## Import
-
-Pinpoint SMS Channel can be imported using the `application-id`, e.g.,
-
-```
-$ terraform import aws_pinpoint_sms_channel.sms application-id
-```
diff --git a/website/docs/r/pipes_pipe.html.markdown b/website/docs/r/pipes_pipe.html.markdown
index 96426187c73..f589dbb4c76 100644
--- a/website/docs/r/pipes_pipe.html.markdown
+++ b/website/docs/r/pipes_pipe.html.markdown
@@ -12,6 +12,8 @@ Terraform resource for managing an AWS EventBridge Pipes Pipe.
 
 You can find out more about EventBridge Pipes in the [User Guide](https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-pipes.html).
 
+EventBridge Pipes are very configurable, and may require IAM permissions to work correctly. More information on the configuration options and IAM permissions can be found in the [User Guide](https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-pipes.html).
+
 ~> **Note:** EventBridge was formerly known as CloudWatch Events. The functionality is identical.
 
 ## Example Usage
@@ -21,7 +23,7 @@ You can find out more about EventBridge Pipes in the [User Guide](https://docs.a
 ```terraform
 data "aws_caller_identity" "main" {}
 
-resource "aws_iam_role" "test" {
+resource "aws_iam_role" "example" {
   assume_role_policy = jsonencode({
     Version = "2012-10-17"
     Statement = {
@@ -40,7 +42,7 @@ resource "aws_iam_role" "test" {
 }
 
 resource "aws_iam_role_policy" "source" {
-  role = aws_iam_role.test.id
+  role = aws_iam_role.example.id
   policy = jsonencode({
     Version = "2012-10-17"
     Statement = [
@@ -62,7 +64,7 @@ resource "aws_iam_role_policy" "source" {
 resource "aws_sqs_queue" "source" {}
 
 resource "aws_iam_role_policy" "target" {
-  role = aws_iam_role.test.id
+  role = aws_iam_role.example.id
   policy = jsonencode({
     Version = "2012-10-17"
     Statement = [
@@ -87,9 +89,81 @@ resource "aws_pipes_pipe" "example" {
   role_arn   = aws_iam_role.example.arn
   source     = aws_sqs_queue.source.arn
   target     = aws_sqs_queue.target.arn
+}
+```
+
+### Enrichment Usage
+
+```terraform
+resource "aws_pipes_pipe" "example" {
+  name     = "example-pipe"
+  role_arn = aws_iam_role.example.arn
+  source   = aws_sqs_queue.source.arn
+  target   = aws_sqs_queue.target.arn
+
+  enrichment = aws_cloudwatch_event_api_destination.example.arn
+
+  enrichment_parameters {
+    http_parameters {
+      path_parameter_values = ["example-path-param"]
 
-  source_parameters {}
-  target_parameters {}
+      header_parameters = {
+        "example-header"        = "example-value"
+        "second-example-header" = "second-example-value"
+      }
+
+      query_string_parameters = {
+        "example-query-string"        = "example-value"
+        "second-example-query-string" = "second-example-value"
+      }
+    }
+  }
+}
+```
+
+### Filter Usage
+
+```terraform
+resource "aws_pipes_pipe" "example" {
+  name     = "example-pipe"
+  role_arn = aws_iam_role.example.arn
+  source   = aws_sqs_queue.source.arn
+  target   = aws_sqs_queue.target.arn
+
+  source_parameters {
+    filter_criteria {
+      filter {
+        pattern = jsonencode({
+          source = ["event-source"]
+        })
+      }
+    }
+  }
+}
+```
+
+### SQS Source and Target Configuration Usage
+
+```terraform
+resource "aws_pipes_pipe" "example" {
+  name     = "example-pipe"
+  role_arn = aws_iam_role.example.arn
+  source   = aws_sqs_queue.source.arn
+  target   = aws_sqs_queue.target.arn
+
+  source_parameters {
+    sqs_queue_parameters {
+      batch_size                         = 1
+      maximum_batching_window_in_seconds = 2
+    }
+  }
+
+  target_parameters {
+    sqs_queue {
+      message_deduplication_id = "example-dedupe"
+      message_group_id         = "example-group"
+    }
+  }
 }
 ```
 
@@ -100,21 +174,44 @@ The following arguments are required:
 * `role_arn` - (Required) ARN of the role that allows the pipe to send data to the target.
 * `source` - (Required) Source resource of the pipe (typically an ARN).
 * `target` - (Required) Target resource of the pipe (typically an ARN).
-* `source_parameters` - (Required) Parameters required to set up a source for the pipe. Detailed below.
-* `target_parameters` - (Required) Parameters required to set up a target for your pipe. Detailed below.
 
 The following arguments are optional:
 
 * `description` - (Optional) A description of the pipe. At most 512 characters.
 * `desired_state` - (Optional) The state the pipe should be in. One of: `RUNNING`, `STOPPED`.
 * `enrichment` - (Optional) Enrichment resource of the pipe (typically an ARN). Read more about enrichment in the [User Guide](https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-pipes.html#pipes-enrichment).
+* `enrichment_parameters` - (Optional) Parameters to configure enrichment for your pipe. Detailed below.
 * `name` - (Optional) Name of the pipe. If omitted, Terraform will assign a random, unique name. Conflicts with `name_prefix`.
 * `name_prefix` - (Optional) Creates a unique name beginning with the specified prefix. Conflicts with `name`.
+* `source_parameters` - (Optional) Parameters to configure a source for the pipe. Detailed below.
+* `target_parameters` - (Optional) Parameters to configure a target for your pipe. Detailed below.
 * `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
+### enrichment_parameters Configuration Block
+
+You can find out more about EventBridge Pipes Enrichment in the [User Guide](https://docs.aws.amazon.com/eventbridge/latest/userguide/pipes-enrichment.html).
+
+* `input_template` - (Optional) Valid JSON text passed to the target. In this case, nothing from the event itself is passed to the target. Maximum length of 8192 characters.
+* `http_parameters` - (Optional) Contains the HTTP parameters to use when the target is a API Gateway REST endpoint or EventBridge ApiDestination. If you specify an API Gateway REST API or EventBridge ApiDestination as a target, you can use this parameter to specify headers, path parameters, and query string keys/values as part of your target invoking request. If you're using ApiDestinations, the corresponding Connection can also have these values configured. In case of any conflicting keys, values from the Connection take precedence. Detailed below.
+
+#### enrichment_parameters.http_parameters Configuration Block
+
+* `header_parameters` - (Optional) Key-value mapping of the headers that need to be sent as part of request invoking the API Gateway REST API or EventBridge ApiDestination.
+* `path_parameter_values` - (Optional) The path parameter values to be used to populate API Gateway REST API or EventBridge ApiDestination path wildcards ("*").
+* `query_string_parameters` - (Optional) Key-value mapping of the query strings that need to be sent as part of request invoking the API Gateway REST API or EventBridge ApiDestination.
+
 ### source_parameters Configuration Block
 
-* `filter_criteria` - (Optional) The collection of event patterns used to filter events. Detailed below.
+You can find out more about EventBridge Pipes Sources in the [User Guide](https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-pipes-event-source.html).
+
+* `activemq_broker_parameters` - (Optional) The parameters for using an Active MQ broker as a source. Detailed below.
+* `dynamodb_stream_parameters` - (Optional) The parameters for using a DynamoDB stream as a source.  Detailed below.
+* `filter_criteria` - (Optional) The collection of event patterns used to [filter events](https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-pipes-event-filtering.html). Detailed below.
+* `kinesis_stream_parameters` - (Optional) The parameters for using a Kinesis stream as a source. Detailed below.
+* `managed_streaming_kafka_parameters` - (Optional) The parameters for using an MSK stream as a source. Detailed below.
+* `rabbitmq_broker_parameters` - (Optional) The parameters for using a Rabbit MQ broker as a source. Detailed below.
+* `self_managed_kafka_parameters` - (Optional) The parameters for using a self-managed Apache Kafka stream as a source. Detailed below.
+* `sqs_queue_parameters` - (Optional) The parameters for using a Amazon SQS stream as a source. Detailed below.
 
 #### source_parameters.filter_criteria Configuration Block
 
@@ -124,13 +221,306 @@ The following arguments are optional:
 
 * `pattern` - (Required) The event pattern. At most 4096 characters.
 
+#### source_parameters.activemq_broker_parameters Configuration Block
+
+* `batch_size` - (Optional) The maximum number of records to include in each batch. Maximum value of 10000.
+* `credentials` - (Required) The credentials needed to access the resource. Detailed below.
+* `maximum_batching_window_in_seconds` - (Optional) The maximum length of a time to wait for events. Maximum value of 300.
+* `queue_name` - (Required) The name of the destination queue to consume. Maximum length of 1000.
+
+##### source_parameters.activemq_broker_parameters.credentials Configuration Block
+
+* `basic_auth` - (Required) The ARN of the Secrets Manager secret containing the basic auth credentials.
+
+#### source_parameters.dynamodb_stream_parameters Configuration Block
+
+* `batch_size` - (Optional) The maximum number of records to include in each batch. Maximum value of 10000.
+* `dead_letter_config` - (Optional) Define the target queue to send dead-letter queue events to. Detailed below.
+* `maximum_batching_window_in_seconds` - (Optional) The maximum length of a time to wait for events. Maximum value of 300.
+* `maximum_record_age_in_seconds` - (Optional) Discard records older than the specified age. The default value is -1, which sets the maximum age to infinite. When the value is set to infinite, EventBridge never discards old records. Maximum value of 604,800.
+* `maximum_retry_attempts` - (Optional) Discard records after the specified number of retries. The default value is -1, which sets the maximum number of retries to infinite. When MaximumRetryAttempts is infinite, EventBridge retries failed records until the record expires in the event source. Maximum value of 10,000.
+* `on_partial_batch_item_failure` - (Optional) Define how to handle item process failures. AUTOMATIC_BISECT halves each batch and retry each half until all the records are processed or there is one failed message left in the batch. Valid values: AUTOMATIC_BISECT.
+* `parallelization_factor` - (Optional)The number of batches to process concurrently from each shard. The default value is 1. Maximum value of 10.
+* `starting_position` - (Optional) The position in a stream from which to start reading. Valid values: TRIM_HORIZON, LATEST.
+
+##### source_parameters.dynamodb_stream_parameters.dead_letter_config Configuration Block
+
+* `arn` - (Optional) The ARN of the Amazon SQS queue specified as the target for the dead-letter queue.
+
+#### source_parameters.kinesis_stream_parameters Configuration Block
+
+* `batch_size` - (Optional) The maximum number of records to include in each batch. Maximum value of 10000.
+* `dead_letter_config` - (Optional) Define the target queue to send dead-letter queue events to. Detailed below.
+* `maximum_batching_window_in_seconds` - (Optional) The maximum length of a time to wait for events. Maximum value of 300.
+* `maximum_record_age_in_seconds` - (Optional) Discard records older than the specified age. The default value is -1, which sets the maximum age to infinite. When the value is set to infinite, EventBridge never discards old records. Maximum value of 604,800.
+* `maximum_retry_attempts` - (Optional) Discard records after the specified number of retries. The default value is -1, which sets the maximum number of retries to infinite. When MaximumRetryAttempts is infinite, EventBridge retries failed records until the record expires in the event source. Maximum value of 10,000.
+* `on_partial_batch_item_failure` - (Optional) Define how to handle item process failures. AUTOMATIC_BISECT halves each batch and retry each half until all the records are processed or there is one failed message left in the batch. Valid values: AUTOMATIC_BISECT.
+* `parallelization_factor` - (Optional)The number of batches to process concurrently from each shard. The default value is 1. Maximum value of 10.
+* `starting_position` - (Required) The position in a stream from which to start reading. Valid values: TRIM_HORIZON, LATEST, AT_TIMESTAMP.
+* `starting_position_timestamp` - (Optional) With StartingPosition set to AT_TIMESTAMP, the time from which to start reading, in Unix time seconds.
+
+##### source_parameters.kinesis_stream_parameters.dead_letter_config Configuration Block
+
+* `arn` - (Optional) The ARN of the Amazon SQS queue specified as the target for the dead-letter queue.
+
+#### source_parameters.managed_streaming_kafka_parameters Configuration Block
+
+* `batch_size` - (Optional) The maximum number of records to include in each batch. Maximum value of 10000.
+* `consumer_group_id` - (Optional) The name of the destination queue to consume. Maximum value of 200.
+* `credentials` - (Optional) The credentials needed to access the resource. Detailed below.
+* `maximum_batching_window_in_seconds` - (Optional) The maximum length of a time to wait for events. Maximum value of 300.
+* `starting_position` - (Optional) The position in a stream from which to start reading. Valid values: TRIM_HORIZON, LATEST.
+* `topic_name` - (Required) The name of the topic that the pipe will read from. Maximum length of 249.
+
+##### source_parameters.managed_streaming_kafka_parameters.credentials Configuration Block
+
+* `client_certificate_tls_auth` - (Optional) The ARN of the Secrets Manager secret containing the credentials.
+* `sasl_scram_512_auth` - (Optional) The ARN of the Secrets Manager secret containing the credentials.
+
+#### source_parameters.rabbitmq_broker_parameters Configuration Block
+
+* `batch_size` - (Optional) The maximum number of records to include in each batch. Maximum value of 10000.
+* `credentials` - (Required) The credentials needed to access the resource. Detailed below.
+* `maximum_batching_window_in_seconds` - (Optional) The maximum length of a time to wait for events. Maximum value of 300.
+* `queue_name` - (Required) The name of the destination queue to consume. Maximum length of 1000.
+* `virtual_host` - (Optional) The name of the virtual host associated with the source broker. Maximum length of 200.
+
+##### source_parameters.rabbitmq_broker_parameters.credentials Configuration Block
+
+* `basic_auth` - (Required) The ARN of the Secrets Manager secret containing the credentials.
+
+#### source_parameters.self_managed_kafka_parameters Configuration Block
+
+* `additional_bootstrap_servers` - (Optional) An array of server URLs. Maximum number of 2 items, each of maximum length 300.
+* `batch_size` - (Optional) The maximum number of records to include in each batch. Maximum value of 10000.
+* `consumer_group_id` - (Optional) The name of the destination queue to consume. Maximum value of 200.
+* `credentials` - (Optional) The credentials needed to access the resource. Detailed below.
+* `maximum_batching_window_in_seconds` - (Optional) The maximum length of a time to wait for events. Maximum value of 300.
+* `server_root_ca_certificate` - (Optional) The ARN of the Secrets Manager secret used for certification.
+* `starting_position` - (Optional) The position in a stream from which to start reading. Valid values: TRIM_HORIZON, LATEST.
+* `topic_name` - (Required) The name of the topic that the pipe will read from. Maximum length of 249.
+* `vpc` - (Optional) This structure specifies the VPC subnets and security groups for the stream, and whether a public IP address is to be used. Detailed below.
+
+##### source_parameters.self_managed_kafka_parameters.credentials Configuration Block
+
+* `basic_auth` - (Optional) The ARN of the Secrets Manager secret containing the credentials.
+* `client_certificate_tls_auth` - (Optional) The ARN of the Secrets Manager secret containing the credentials.
+* `sasl_scram_256_auth` - (Optional) The ARN of the Secrets Manager secret containing the credentials.
+* `sasl_scram_512_auth` - (Optional) The ARN of the Secrets Manager secret containing the credentials.
+
+##### source_parameters.self_managed_kafka_parameters.vpc Configuration Block
+
+* `security_groups` - (Optional) List of security groups associated with the stream. These security groups must all be in the same VPC. You can specify as many as five security groups. If you do not specify a security group, the default security group for the VPC is used.
+* `subnets` - (Optional) List of the subnets associated with the stream. These subnets must all be in the same VPC. You can specify as many as 16 subnets.
+
+#### source_parameters.sqs_queue_parameters Configuration Block
+
+* `batch_size` - (Optional) The maximum number of records to include in each batch. Maximum value of 10000.
+* `maximum_batching_window_in_seconds` - (Optional) The maximum length of a time to wait for events. Maximum value of 300.
+
 ### target_parameters Configuration Block
 
-* `input_template` - (Optional) Valid JSON text passed to the target. In this case, nothing from the event itself is passed to the target.
+You can find out more about EventBridge Pipes Targets in the [User Guide](https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-pipes-event-target.html).
+
+* `batch_job_parameters` - (Optional) The parameters for using an AWS Batch job as a target. Detailed below.
+* `cloudwatch_logs_parameters` - (Optional) The parameters for using an CloudWatch Logs log stream as a target. Detailed below.
+* `ecs_task_parameters` - (Optional) The parameters for using an Amazon ECS task as a target. Detailed below.
+* `eventbridge_event_bus_parameters` - (Optional) The parameters for using an EventBridge event bus as a target. Detailed below.
+* `http_parameters` - (Optional) These are custom parameter to be used when the target is an API Gateway REST APIs or EventBridge ApiDestinations. Detailed below.
+* `input_template` - (Optional) Valid JSON text passed to the target. In this case, nothing from the event itself is passed to the target. Maximum length of 8192 characters.
+* `kinesis_stream_parameters` - (Optional) The parameters for using a Kinesis stream as a source. Detailed below.
+* `lambda_function_parameters` - (Optional) The parameters for using a Lambda function as a target. Detailed below.
+* `redshift_data_parameters` - (Optional) These are custom parameters to be used when the target is a Amazon Redshift cluster to invoke the Amazon Redshift Data API BatchExecuteStatement. Detailed below.
+* `sagemaker_pipeline_parameters` - (Optional) The parameters for using a SageMaker pipeline as a target. Detailed below.
+* `sqs_queue_parameters` - (Optional) The parameters for using a Amazon SQS stream as a target. Detailed below.
+* `step_function_state_machine_parameters` - (Optional) The parameters for using a Step Functions state machine as a target. Detailed below.
 
-## Attributes Reference
+#### target_parameters.batch_job_parameters Configuration Block
 
-In addition to all arguments above, the following attributes are exported:
+* `array_properties` - (Optional) The array properties for the submitted job, such as the size of the array. The array size can be between 2 and 10,000. If you specify array properties for a job, it becomes an array job. This parameter is used only if the target is an AWS Batch job. Detailed below.
+* `container_overrides` - (Optional) The overrides that are sent to a container. Detailed below.
+* `depends_on` - (Optional) A list of dependencies for the job. A job can depend upon a maximum of 20 jobs. You can specify a SEQUENTIAL type dependency without specifying a job ID for array jobs so that each child array job completes sequentially, starting at index 0. You can also specify an N_TO_N type dependency with a job ID for array jobs. In that case, each index child of this job must wait for the corresponding index child of each dependency to complete before it can begin. Detailed below.
+* `job_definition` - (Required) The job definition used by this job. This value can be one of name, name:revision, or the Amazon Resource Name (ARN) for the job definition. If name is specified without a revision then the latest active revision is used.
+* `job_name` - (Required) The name of the job. It can be up to 128 letters long.
+* `parameters` - (Optional) Additional parameters passed to the job that replace parameter substitution placeholders that are set in the job definition. Parameters are specified as a key and value pair mapping. Parameters included here override any corresponding parameter defaults from the job definition. Detailed below.
+* `retry_strategy` - (Optional) The retry strategy to use for failed jobs. When a retry strategy is specified here, it overrides the retry strategy defined in the job definition. Detailed below.
+
+##### target_parameters.batch_job_parameters.array_properties Configuration Block
+
+* `size` - (Optional) The size of the array, if this is an array batch job. Minimum value of 2. Maximum value of 10,000.
+
+##### target_parameters.batch_job_parameters.container_overrides Configuration Block
+
+* `command` - (Optional) List of commands to send to the container that overrides the default command from the Docker image or the task definition.
+* `environment` - (Optional) The environment variables to send to the container. You can add new environment variables, which are added to the container at launch, or you can override the existing environment variables from the Docker image or the task definition. Environment variables cannot start with " AWS Batch ". This naming convention is reserved for variables that AWS Batch sets. Detailed below.
+* `instance_type` - (Optional) The instance type to use for a multi-node parallel job. This parameter isn't applicable to single-node container jobs or jobs that run on Fargate resources, and shouldn't be provided.
+* `resource_requirement` - (Optional) The type and amount of resources to assign to a container. This overrides the settings in the job definition. The supported resources include GPU, MEMORY, and VCPU. Detailed below.
+
+###### target_parameters.batch_job_parameters.container_overrides.environment Configuration Block
+
+* `name` - (Optional) The name of the key-value pair. For environment variables, this is the name of the environment variable.
+* `value` - (Optional) The value of the key-value pair. For environment variables, this is the value of the environment variable.
+
+###### target_parameters.batch_job_parameters.container_overrides.resource_requirement Configuration Block
+
+* `type` - (Optional) The type of resource to assign to a container. The supported resources include GPU, MEMORY, and VCPU.
+* `value` - (Optional) The quantity of the specified resource to reserve for the container. [The values vary based on the type specified](https://docs.aws.amazon.com/eventbridge/latest/pipes-reference/API_BatchResourceRequirement.html).
+
+##### target_parameters.batch_job_parameters.depends_on Configuration Block
+
+* `job_id` - (Optional) The job ID of the AWS Batch job that's associated with this dependency.
+* `type` - (Optional) The type of the job dependency. Valid Values: N_TO_N, SEQUENTIAL.
+
+##### target_parameters.batch_job_parameters.retry_strategy Configuration Block
+
+* `attempts` - (Optional) The number of times to move a job to the RUNNABLE status. If the value of attempts is greater than one, the job is retried on failure the same number of attempts as the value. Maximum value of 10.
+
+#### target_parameters.cloudwatch_logs_parameters Configuration Block
+
+* `log_stream_name` - (Optional) The name of the log stream.
+* `timestamp` - (Optional) The time the event occurred, expressed as the number of milliseconds after Jan 1, 1970 00:00:00 UTC. This is the JSON path to the field in the event e.g. $.detail.timestamp
+
+#### target_parameters.ecs_task_parameters Configuration Block
+
+* `capacity_provider_strategy` - (Optional) List of capacity provider strategies to use for the task. If a capacityProviderStrategy is specified, the launchType parameter must be omitted. If no capacityProviderStrategy or launchType is specified, the defaultCapacityProviderStrategy for the cluster is used. Detailed below.
+* `enable_ecs_managed_tags` - (Optional) Specifies whether to enable Amazon ECS managed tags for the task. Valid values: true, false.
+* `enable_execute_command` - (Optional) Whether or not to enable the execute command functionality for the containers in this task. If true, this enables execute command functionality on all containers in the task. Valid values: true, false.
+* `group` - (Optional) Specifies an Amazon ECS task group for the task. The maximum length is 255 characters.
+* `launch_type` - (Optional) Specifies the launch type on which your task is running. The launch type that you specify here must match one of the launch type (compatibilities) of the target task. The FARGATE value is supported only in the Regions where AWS Fargate with Amazon ECS is supported. Valid Values: EC2, FARGATE, EXTERNAL
+* `network_configuration` - (Optional) Use this structure if the Amazon ECS task uses the awsvpc network mode. This structure specifies the VPC subnets and security groups associated with the task, and whether a public IP address is to be used. This structure is required if LaunchType is FARGATE because the awsvpc mode is required for Fargate tasks. If you specify NetworkConfiguration when the target ECS task does not use the awsvpc network mode, the task fails. Detailed below.
+* `overrides` - (Optional) The overrides that are associated with a task. Detailed below.
+* `placement_constraint` - (Optional) An array of placement constraint objects to use for the task. You can specify up to 10 constraints per task (including constraints in the task definition and those specified at runtime). Detailed below.
+* `placement_strategy` - (Optional) The placement strategy objects to use for the task. You can specify a maximum of five strategy rules per task. Detailed below.
+* `platform_version` - (Optional) Specifies the platform version for the task. Specify only the numeric portion of the platform version, such as 1.1.0. This structure is used only if LaunchType is FARGATE.
+* `propagate_tags` - (Optional) Specifies whether to propagate the tags from the task definition to the task. If no value is specified, the tags are not propagated. Tags can only be propagated to the task during task creation. To add tags to a task after task creation, use the TagResource API action. Valid Values: TASK_DEFINITION
+* `reference_id` - (Optional) The reference ID to use for the task. Maximum length of 1,024.
+* `tags` - (Optional) Key-value map of tags that you apply to the task to help you categorize and organize them.
+* `task_count` - (Optional) The number of tasks to create based on TaskDefinition. The default is 1.
+* `task_definition_arn` - (Optional) The ARN of the task definition to use if the event target is an Amazon ECS task.
+
+##### target_parameters.ecs_task_parameters.capacity_provider_strategy Configuration Block
+
+* `base` - (Optional) The base value designates how many tasks, at a minimum, to run on the specified capacity provider. Only one capacity provider in a capacity provider strategy can have a base defined. If no value is specified, the default value of 0 is used. Maximum value of 100,000.
+* `capacity_provider` - (Optional) The short name of the capacity provider. Maximum value of 255.
+* `weight` - (Optional) The weight value designates the relative percentage of the total number of tasks launched that should use the specified capacity provider. The weight value is taken into consideration after the base value, if defined, is satisfied. Maximum value of 1,000.
+
+##### target_parameters.ecs_task_parameters.network_configuration Configuration Block
+
+* `aws_vpc_configuration` - (Optional) Use this structure to specify the VPC subnets and security groups for the task, and whether a public IP address is to be used. This structure is relevant only for ECS tasks that use the awsvpc network mode. Detailed below.
+
+###### target_parameters.ecs_task_parameters.network_configuration.aws_vpc_configuration Configuration Block
+
+* `assign_public_ip` - (Optional) Specifies whether the task's elastic network interface receives a public IP address. You can specify ENABLED only when LaunchType in EcsParameters is set to FARGATE. Valid Values: ENABLED, DISABLED.
+* `security_groups` - (Optional) Specifies the security groups associated with the task. These security groups must all be in the same VPC. You can specify as many as five security groups. If you do not specify a security group, the default security group for the VPC is used.
+* `subnets` - (Optional) Specifies the subnets associated with the task. These subnets must all be in the same VPC. You can specify as many as 16 subnets.
+
+##### target_parameters.ecs_task_parameters.overrides Configuration Block
+
+* `container_override` - (Optional) One or more container overrides that are sent to a task. Detailed below.
+* `cpu` - (Optional) The cpu override for the task.
+* `ephemeral_storage` - (Optional) The ephemeral storage setting override for the task.  Detailed below.
+* `execution_role_arn` - (Optional) The Amazon Resource Name (ARN) of the task execution IAM role override for the task.
+* `inference_accelerator_override` - (Optional) List of Elastic Inference accelerator overrides for the task. Detailed below.
+* `memory` - (Optional) The memory override for the task.
+* `task_role_arn` - (Optional) The Amazon Resource Name (ARN) of the IAM role that containers in this task can assume. All containers in this task are granted the permissions that are specified in this role.
+
+###### target_parameters.ecs_task_parameters.overrides.container_override Configuration Block
+
+* `command` - (Optional) List of commands to send to the container that overrides the default command from the Docker image or the task definition. You must also specify a container name.
+* `cpu` - (Optional) The number of cpu units reserved for the container, instead of the default value from the task definition. You must also specify a container name.
+* `environment` - (Optional) The environment variables to send to the container. You can add new environment variables, which are added to the container at launch, or you can override the existing environment variables from the Docker image or the task definition. You must also specify a container name. Detailed below.
+* `environment_file` - (Optional) A list of files containing the environment variables to pass to a container, instead of the value from the container definition. Detailed below.
+* `memory` - (Optional) The hard limit (in MiB) of memory to present to the container, instead of the default value from the task definition. If your container attempts to exceed the memory specified here, the container is killed. You must also specify a container name.
+* `memory_reservation` - (Optional) The soft limit (in MiB) of memory to reserve for the container, instead of the default value from the task definition. You must also specify a container name.
+* `name` - (Optional) The name of the container that receives the override. This parameter is required if any override is specified.
+* `resource_requirement` - (Optional) The type and amount of a resource to assign to a container, instead of the default value from the task definition. The only supported resource is a GPU. Detailed below.
+
+###### target_parameters.ecs_task_parameters.overrides.container_override.environment Configuration Block
+
+* `name` - (Optional) The name of the key-value pair. For environment variables, this is the name of the environment variable.
+* `value` - (Optional) The value of the key-value pair. For environment variables, this is the value of the environment variable.
+
+###### target_parameters.ecs_task_parameters.overrides.container_override.environment_file Configuration Block
+
+* `type` - (Optional) The file type to use. The only supported value is s3.
+* `value` - (Optional) The Amazon Resource Name (ARN) of the Amazon S3 object containing the environment variable file.
+
+###### target_parameters.ecs_task_parameters.overrides.container_override.resource_requirement Configuration Block
+
+* `type` - (Optional) The type of resource to assign to a container. The supported values are GPU or InferenceAccelerator.
+* `value` - (Optional) The value for the specified resource type. If the GPU type is used, the value is the number of physical GPUs the Amazon ECS container agent reserves for the container. The number of GPUs that's reserved for all containers in a task can't exceed the number of available GPUs on the container instance that the task is launched on. If the InferenceAccelerator type is used, the value matches the deviceName for an InferenceAccelerator specified in a task definition.
+
+###### target_parameters.ecs_task_parameters.overrides.ephemeral_storage Configuration Block
+
+* `size_in_gib` - (Required) The total amount, in GiB, of ephemeral storage to set for the task. The minimum supported value is 21 GiB and the maximum supported value is 200 GiB.
+
+###### target_parameters.ecs_task_parameters.overrides.inference_accelerator_override Configuration Block
+
+* `device_name` - (Optional) The Elastic Inference accelerator device name to override for the task. This parameter must match a deviceName specified in the task definition.
+* `device_type` - (Optional) The Elastic Inference accelerator type to use.
+
+##### target_parameters.ecs_task_parameters.placement_constraint Configuration Block
+
+* `expression` - (Optional) A cluster query language expression to apply to the constraint. You cannot specify an expression if the constraint type is distinctInstance. Maximum length of 2,000.
+* `type` - (Optional) The type of constraint. Use distinctInstance to ensure that each task in a particular group is running on a different container instance. Use memberOf to restrict the selection to a group of valid candidates. Valid Values: distinctInstance, memberOf.
+
+##### target_parameters.ecs_task_parameters.placement_strategy Configuration Block
+
+* `field` - (Optional) The field to apply the placement strategy against. For the spread placement strategy, valid values are instanceId (or host, which has the same effect), or any platform or custom attribute that is applied to a container instance, such as attribute:ecs.availability-zone. For the binpack placement strategy, valid values are cpu and memory. For the random placement strategy, this field is not used. Maximum length of 255.
+* `type` - (Optional) The type of placement strategy. The random placement strategy randomly places tasks on available candidates. The spread placement strategy spreads placement across available candidates evenly based on the field parameter. The binpack strategy places tasks on available candidates that have the least available amount of the resource that is specified with the field parameter. For example, if you binpack on memory, a task is placed on the instance with the least amount of remaining memory (but still enough to run the task). Valid Values: random, spread, binpack.
+
+#### target_parameters.eventbridge_event_bus_parameters Configuration Block
+
+* `detail_type` - (Optional) A free-form string, with a maximum of 128 characters, used to decide what fields to expect in the event detail.
+* `endpoint_id` - (Optional) The URL subdomain of the endpoint. For example, if the URL for Endpoint is https://abcde.veo.endpoints.event.amazonaws.com, then the EndpointId is abcde.veo.
+* `resources` - (Optional) List of AWS resources, identified by Amazon Resource Name (ARN), which the event primarily concerns. Any number, including zero, may be present.
+* `source` - (Optional) The source of the event. Maximum length of 256.
+* `time` - (Optional) The time stamp of the event, per RFC3339. If no time stamp is provided, the time stamp of the PutEvents call is used. This is the JSON path to the field in the event e.g. $.detail.timestamp
+
+#### target_parameters.http_parameters Configuration Block
+
+* `header_parameters` - (Optional) Key-value mapping of the headers that need to be sent as part of request invoking the API Gateway REST API or EventBridge ApiDestination. Detailed below.
+* `path_parameter_values` - (Optional) The path parameter values to be used to populate API Gateway REST API or EventBridge ApiDestination path wildcards ("*").
+* `query_string_parameters` - (Optional) Key-value mapping of the query strings that need to be sent as part of request invoking the API Gateway REST API or EventBridge ApiDestination. Detailed below.
+
+#### target_parameters.kinesis_stream_parameters Configuration Block
+
+* `partition_key` - (Required) Determines which shard in the stream the data record is assigned to. Partition keys are Unicode strings with a maximum length limit of 256 characters for each key. Amazon Kinesis Data Streams uses the partition key as input to a hash function that maps the partition key and associated data to a specific shard. Specifically, an MD5 hash function is used to map partition keys to 128-bit integer values and to map associated data records to shards. As a result of this hashing mechanism, all data records with the same partition key map to the same shard within the stream.
+
+#### target_parameters.lambda_function_parameters Configuration Block
+
+* `invocation_type` - (Optional) Specify whether to invoke the function synchronously or asynchronously. Valid Values: REQUEST_RESPONSE, FIRE_AND_FORGET.
+
+#### target_parameters.redshift_data_parameters Configuration Block
+
+* `database` - (Required) The name of the database. Required when authenticating using temporary credentials.
+* `db_user` - (Optional) The database user name. Required when authenticating using temporary credentials.
+* `secret_manager_arn` - (Optional) The name or ARN of the secret that enables access to the database. Required when authenticating using Secrets Manager.
+* `sqls` - (Optional) List of SQL statements text to run, each of maximum length of 100,000.
+* `statement_name` - (Optional) The name of the SQL statement. You can name the SQL statement when you create it to identify the query.
+* `with_event` - (Optional) Indicates whether to send an event back to EventBridge after the SQL statement runs.
+
+#### target_parameters.sagemaker_pipeline_parameters Configuration Block
+
+* `pipeline_parameter` - (Optional) List of Parameter names and values for SageMaker Model Building Pipeline execution. Detailed below.
+
+##### target_parameters.sagemaker_pipeline_parameters.parameters Configuration Block
+
+* `name` - (Optional) Name of parameter to start execution of a SageMaker Model Building Pipeline. Maximum length of 256.
+* `value` - (Optional) Value of parameter to start execution of a SageMaker Model Building Pipeline. Maximum length of 1024.
+
+#### target_parameters.sqs_queue_parameters Configuration Block
+
+* `message_deduplication_id` - (Optional) This parameter applies only to FIFO (first-in-first-out) queues. The token used for deduplication of sent messages.
+* `message_group_id` - (Optional) The FIFO message group ID to use as the target.
+
+#### target_parameters.step_function_state_machine_parameters Configuration Block
+
+* `invocation_type` - (Optional) Specify whether to invoke the function synchronously or asynchronously. Valid Values: REQUEST_RESPONSE, FIRE_AND_FORGET.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of this pipe.
 * `id` - Same as `name`.
@@ -146,8 +536,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Pipes can be imported using the `name`. For example:
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import pipes using the `name`. For example:
 
+```terraform
+import {
+  to = aws_pipes_pipe.example
+  id = "my-pipe"
+}
 ```
-$ terraform import aws_pipes_pipe.example my-pipe
+
+Using `terraform import`, import pipes using the `name`. For example:
+
+```console
+% terraform import aws_pipes_pipe.example my-pipe
 ```
diff --git a/website/docs/r/placement_group.html.markdown b/website/docs/r/placement_group.html.markdown
index 53b1032f485..f4fff5651b5 100644
--- a/website/docs/r/placement_group.html.markdown
+++ b/website/docs/r/placement_group.html.markdown
@@ -22,7 +22,7 @@ resource "aws_placement_group" "web" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The name of the placement group.
 * `partition_count` - (Optional) The number of partitions to create in the
@@ -33,9 +33,9 @@ The following arguments are supported:
 * `strategy` - (Required) The placement strategy. Can be `cluster`, `partition` or `spread`.
 * `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name (ARN) of the placement group.
 * `id` - The name of the placement group.
@@ -44,8 +44,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Placement groups can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import placement groups using the `name`. For example:
 
+```terraform
+import {
+  to = aws_placement_group.prod_pg
+  id = "production-placement-group"
+}
 ```
-$ terraform import aws_placement_group.prod_pg production-placement-group
+
+Using `terraform import`, import placement groups using the `name`. For example:
+
+```console
+% terraform import aws_placement_group.prod_pg production-placement-group
 ```
diff --git a/website/docs/r/prometheus_alert_manager_definition.html.markdown b/website/docs/r/prometheus_alert_manager_definition.html.markdown
index ad6a77ad1f8..34e3d2a1757 100644
--- a/website/docs/r/prometheus_alert_manager_definition.html.markdown
+++ b/website/docs/r/prometheus_alert_manager_definition.html.markdown
@@ -30,19 +30,28 @@ EOF
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `workspace_id` - (Required) ID of the prometheus workspace the alert manager definition should be linked to
 * `definition` - (Required) the alert manager definition that you want to be applied. See more [in AWS Docs](https://docs.aws.amazon.com/prometheus/latest/userguide/AMP-alert-manager.html).
 
-## Attributes Reference
+## Attribute Reference
 
-No additional attributes are exported.
+This resource exports no additional attributes.
 
 ## Import
 
-The prometheus alert manager definition can be imported using the workspace identifier, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import the prometheus alert manager definition using the workspace identifier. For example:
 
+```terraform
+import {
+  to = aws_prometheus_alert_manager_definition.demo
+  id = "ws-C6DCB907-F2D7-4D96-957B-66691F865D8B"
+}
 ```
-$ terraform import aws_prometheus_alert_manager_definition.demo ws-C6DCB907-F2D7-4D96-957B-66691F865D8B
+
+Using `terraform import`, import the prometheus alert manager definition using the workspace identifier. For example:
+
+```console
+% terraform import aws_prometheus_alert_manager_definition.demo ws-C6DCB907-F2D7-4D96-957B-66691F865D8B
 ```
diff --git a/website/docs/r/prometheus_rule_group_namespace.html.markdown b/website/docs/r/prometheus_rule_group_namespace.html.markdown
index 9e02cd3245f..de33a101ad3 100644
--- a/website/docs/r/prometheus_rule_group_namespace.html.markdown
+++ b/website/docs/r/prometheus_rule_group_namespace.html.markdown
@@ -31,20 +31,29 @@ EOF
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The name of the rule group namespace
 * `workspace_id` - (Required) ID of the prometheus workspace the rule group namespace should be linked to
 * `data` - (Required) the rule group namespace data that you want to be applied. See more [in AWS Docs](https://docs.aws.amazon.com/prometheus/latest/userguide/AMP-Ruler.html).
 
-## Attributes Reference
+## Attribute Reference
 
-No additional attributes are exported.
+This resource exports no additional attributes.
 
 ## Import
 
-The prometheus rule group namespace can be imported using the arn, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import the prometheus rule group namespace using the arn. For example:
 
+```terraform
+import {
+  to = aws_prometheus_rule_group_namespace.demo
+  id = "arn:aws:aps:us-west-2:123456789012:rulegroupsnamespace/IDstring/namespace_name"
+}
 ```
-$ terraform import aws_prometheus_rule_group_namespace.demo arn:aws:aps:us-west-2:123456789012:rulegroupsnamespace/IDstring/namespace_name
+
+Using `terraform import`, import the prometheus rule group namespace using the arn. For example:
+
+```console
+% terraform import aws_prometheus_rule_group_namespace.demo arn:aws:aps:us-west-2:123456789012:rulegroupsnamespace/IDstring/namespace_name
 ```
diff --git a/website/docs/r/prometheus_workspace.html.markdown b/website/docs/r/prometheus_workspace.html.markdown
index 94fb78754c0..fb3bf249b10 100644
--- a/website/docs/r/prometheus_workspace.html.markdown
+++ b/website/docs/r/prometheus_workspace.html.markdown
@@ -38,7 +38,7 @@ resource "aws_prometheus_workspace" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `alias` - (Optional) The alias of the prometheus workspace. See more [in AWS Docs](https://docs.aws.amazon.com/prometheus/latest/userguide/AMP-onboard-create-workspace.html).
 * `logging_configuration` - (Optional) Logging configuration for the workspace. See [Logging Configuration](#logging-configuration) below for details.
@@ -50,9 +50,9 @@ The `logging_configuration` block supports the following arguments:
 
 * `log_group_arn` - (Required) The ARN of the CloudWatch log group to which the vended log data will be published. This log group must exist.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name (ARN) of the workspace.
 * `id` - Identifier of the workspace
@@ -61,8 +61,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-AMP Workspaces can be imported using the identifier, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AMP Workspaces using the identifier. For example:
 
+```terraform
+import {
+  to = aws_prometheus_workspace.demo
+  id = "ws-C6DCB907-F2D7-4D96-957B-66691F865D8B"
+}
 ```
-$ terraform import aws_prometheus_workspace.demo ws-C6DCB907-F2D7-4D96-957B-66691F865D8B
+
+Using `terraform import`, import AMP Workspaces using the identifier. For example:
+
+```console
+% terraform import aws_prometheus_workspace.demo ws-C6DCB907-F2D7-4D96-957B-66691F865D8B
 ```
diff --git a/website/docs/r/proxy_protocol_policy.html.markdown b/website/docs/r/proxy_protocol_policy.html.markdown
index c5d061aef48..b5e8006be43 100644
--- a/website/docs/r/proxy_protocol_policy.html.markdown
+++ b/website/docs/r/proxy_protocol_policy.html.markdown
@@ -40,16 +40,16 @@ resource "aws_proxy_protocol_policy" "smtp" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `load_balancer` - (Required) The load balancer to which the policy
   should be attached.
 * `instance_ports` - (Required) List of instance ports to which the policy
   should be applied. This can be specified if the protocol is SSL or TCP.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the policy.
 * `load_balancer` - The load balancer to which the policy is attached.
diff --git a/website/docs/r/qldb_ledger.html.markdown b/website/docs/r/qldb_ledger.html.markdown
index 8b6c2e3e559..a9af88d0ec6 100644
--- a/website/docs/r/qldb_ledger.html.markdown
+++ b/website/docs/r/qldb_ledger.html.markdown
@@ -23,7 +23,7 @@ resource "aws_qldb_ledger" "sample-ledger" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `deletion_protection` - (Optional) The deletion protection for the QLDB Ledger instance. By default it is `true`. To delete this resource via Terraform, this value must be configured to `false` and applied first before attempting deletion.
 * `kms_key` - (Optional) The key in AWS Key Management Service (AWS KMS) to use for encryption of data at rest in the ledger. For more information, see the [AWS documentation](https://docs.aws.amazon.com/qldb/latest/developerguide/encryption-at-rest.html). Valid values are `"AWS_OWNED_KMS_KEY"` to use an AWS KMS key that is owned and managed by AWS on your behalf, or the ARN of a valid symmetric customer managed KMS key.
@@ -31,9 +31,9 @@ The following arguments are supported:
 * `permissions_mode` - (Required) The permissions mode for the QLDB ledger instance. Specify either `ALLOW_ALL` or `STANDARD`.
 * `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The Name of the QLDB Ledger
 * `arn` - The ARN of the QLDB Ledger
@@ -48,8 +48,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-QLDB Ledgers can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import QLDB Ledgers using the `name`. For example:
 
+```terraform
+import {
+  to = aws_qldb_ledger.sample-ledger
+  id = "sample-ledger"
+}
 ```
-$ terraform import aws_qldb_ledger.sample-ledger sample-ledger
+
+Using `terraform import`, import QLDB Ledgers using the `name`. For example:
+
+```console
+% terraform import aws_qldb_ledger.sample-ledger sample-ledger
 ```
diff --git a/website/docs/r/qldb_stream.html.markdown b/website/docs/r/qldb_stream.html.markdown
index 20a0b14280a..33615083a46 100644
--- a/website/docs/r/qldb_stream.html.markdown
+++ b/website/docs/r/qldb_stream.html.markdown
@@ -32,7 +32,7 @@ resource "aws_qldb_stream" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `exclusive_end_time` - (Optional) The exclusive date and time that specifies when the stream ends. If you don't define this parameter, the stream runs indefinitely until you cancel it. It must be in ISO 8601 date and time format and in Universal Coordinated Time (UTC). For example: `"2019-06-13T21:36:34Z"`.
 * `inclusive_start_time` - (Required) The inclusive start date and time from which to start streaming journal data. This parameter must be in ISO 8601 date and time format and in Universal Coordinated Time (UTC). For example: `"2019-06-13T21:36:34Z"`.  This cannot be in the future and must be before `exclusive_end_time`.  If you provide a value that is before the ledger's `CreationDateTime`, QLDB effectively defaults it to the ledger's `CreationDateTime`.
@@ -49,10 +49,17 @@ The `kinesis_configuration` block supports the following arguments:
 * `aggregation_enabled` - (Optional) Enables QLDB to publish multiple data records in a single Kinesis Data Streams record, increasing the number of records sent per API call. Default: `true`.
 * `stream_arn` - (Required) The Amazon Resource Name (ARN) of the Kinesis Data Streams resource.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the QLDB Stream.
 * `arn` - The ARN of the QLDB Stream.
 * `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `8m`)
+- `delete` - (Default `5m`)
diff --git a/website/docs/r/quicksight_account_subscription.html.markdown b/website/docs/r/quicksight_account_subscription.html.markdown
index d0b0e130c97..2a8c060ae77 100644
--- a/website/docs/r/quicksight_account_subscription.html.markdown
+++ b/website/docs/r/quicksight_account_subscription.html.markdown
@@ -44,9 +44,9 @@ The following arguments are optional:
 * `reader_group` - (Optional) Reader group associated with your Active Direcrtory.
 * `realm` - (Optional) Realm of the Active Directory that is associated with your Amazon QuickSight account.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `account_subscription_status` - Status of the Amazon QuickSight account's subscription.
 
@@ -59,4 +59,4 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Importing is currently not supported on this resource.
+You cannot import this resource.
diff --git a/website/docs/r/quicksight_analysis.html.markdown b/website/docs/r/quicksight_analysis.html.markdown
index 78255a274a6..2fce57c9057 100644
--- a/website/docs/r/quicksight_analysis.html.markdown
+++ b/website/docs/r/quicksight_analysis.html.markdown
@@ -138,9 +138,9 @@ The following arguments are optional:
 * `parameters_declarations` - (Optional) A list of parameter declarations for an analysis. Parameters are named variables that can transfer a value for use by an action or an object. See [AWS API Documentation for complete description](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_ParameterDeclaration.html). For more information, see [Parameters in Amazon QuickSight](https://docs.aws.amazon.com/quicksight/latest/user/parameters-in-quicksight.html) in the Amazon QuickSight User Guide.
 * `sheets` - (Optional) A list of sheet definitions for an analysis. See [AWS API Documentation for complete description](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_SheetDefinition.html).
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the analysis.
 * `created_time` - The time that the analysis was created.
@@ -159,8 +159,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-A QuickSight Analysis can be imported using the AWS account ID and analysis ID separated by a comma (`,`) e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import a QuickSight Analysis using the AWS account ID and analysis ID separated by a comma (`,`). For example:
 
+```terraform
+import {
+  to = aws_quicksight_analysis.example
+  id = "123456789012,example-id"
+}
 ```
-$ terraform import aws_quicksight_analysis.example 123456789012,example-id
+
+Using `terraform import`, import a QuickSight Analysis using the AWS account ID and analysis ID separated by a comma (`,`). For example:
+
+```console
+% terraform import aws_quicksight_analysis.example 123456789012,example-id
 ```
diff --git a/website/docs/r/quicksight_dashboard.html.markdown b/website/docs/r/quicksight_dashboard.html.markdown
index ebe1826e478..ec8ce0edcd3 100644
--- a/website/docs/r/quicksight_dashboard.html.markdown
+++ b/website/docs/r/quicksight_dashboard.html.markdown
@@ -194,9 +194,9 @@ The following arguments are optional:
 * `parameters_declarations` - (Optional) A list of parameter declarations for a dashboard. Parameters are named variables that can transfer a value for use by an action or an object. See [AWS API Documentation for complete description](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_ParameterDeclaration.html). For more information, see [Parameters in Amazon QuickSight](https://docs.aws.amazon.com/quicksight/latest/user/parameters-in-quicksight.html) in the Amazon QuickSight User Guide.
 * `sheets` - (Optional) A list of sheet definitions for a dashboard. See [AWS API Documentation for complete description](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_SheetDefinition.html).
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the dashboard.
 * `created_time` - The time that the dashboard was created.
@@ -217,8 +217,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-A QuickSight Dashboard can be imported using the AWS account ID and dashboard ID separated by a comma (`,`) e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import a QuickSight Dashboard using the AWS account ID and dashboard ID separated by a comma (`,`). For example:
 
+```terraform
+import {
+  to = aws_quicksight_dashboard.example
+  id = "123456789012,example-id"
+}
 ```
-$ terraform import aws_quicksight_dashboard.example 123456789012,example-id
+
+Using `terraform import`, import a QuickSight Dashboard using the AWS account ID and dashboard ID separated by a comma (`,`). For example:
+
+```console
+% terraform import aws_quicksight_dashboard.example 123456789012,example-id
 ```
diff --git a/website/docs/r/quicksight_data_set.html.markdown b/website/docs/r/quicksight_data_set.html.markdown
index b24adc6f6d8..0b1c871d45e 100644
--- a/website/docs/r/quicksight_data_set.html.markdown
+++ b/website/docs/r/quicksight_data_set.html.markdown
@@ -388,9 +388,9 @@ For a `physical_table_map` item to be valid, only one of `custom_sql`, `relation
 * `match_all_value` - (Optional) A string that you want to use to filter by all the values in a column in the dataset and don’t want to list the values one by one.
 * `tag_multi_value_delimiter` - (Optional) A string that you want to use to delimit the values when you pass the values at run time.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name (ARN) of the data set.
 * `id` - A comma-delimited string joining AWS account ID and data set ID.
@@ -398,8 +398,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-A QuickSight Data Set can be imported using the AWS account ID and data set ID separated by a comma (`,`) e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import a QuickSight Data Set using the AWS account ID and data set ID separated by a comma (`,`). For example:
 
+```terraform
+import {
+  to = aws_quicksight_data_set.example
+  id = "123456789012,example-id"
+}
 ```
-$ terraform import aws_quicksight_data_set.example 123456789012,example-id
+
+Using `terraform import`, import a QuickSight Data Set using the AWS account ID and data set ID separated by a comma (`,`). For example:
+
+```console
+% terraform import aws_quicksight_data_set.example 123456789012,example-id
 ```
diff --git a/website/docs/r/quicksight_data_source.html.markdown b/website/docs/r/quicksight_data_source.html.markdown
index 725477b4832..10c064b740c 100644
--- a/website/docs/r/quicksight_data_source.html.markdown
+++ b/website/docs/r/quicksight_data_source.html.markdown
@@ -208,17 +208,26 @@ To specify data source connection parameters, exactly one of the following sub-o
 * `max_rows` - (Required) The maximum number of rows to query.
 * `query` - (Required) The Twitter query to retrieve the data.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name (ARN) of the data source
 * `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
 
 ## Import
 
-A QuickSight data source can be imported using the AWS account ID, and data source ID separated by a slash (`/`) e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import a QuickSight data source using the AWS account ID, and data source ID separated by a slash (`/`). For example:
 
+```terraform
+import {
+  to = aws_quicksight_data_source.example
+  id = "123456789123/my-data-source-id"
+}
 ```
-$ terraform import aws_quicksight_data_source.example 123456789123/my-data-source-id
+
+Using `terraform import`, import a QuickSight data source using the AWS account ID, and data source ID separated by a slash (`/`). For example:
+
+```console
+% terraform import aws_quicksight_data_source.example 123456789123/my-data-source-id
 ```
diff --git a/website/docs/r/quicksight_folder.html.markdown b/website/docs/r/quicksight_folder.html.markdown
index f97da90364a..9aa35228518 100644
--- a/website/docs/r/quicksight_folder.html.markdown
+++ b/website/docs/r/quicksight_folder.html.markdown
@@ -80,9 +80,9 @@ The following arguments are optional:
 * `actions` - (Required) List of IAM actions to grant or revoke permissions on.
 * `principal` - (Required) ARN of the principal. See the [ResourcePermission documentation](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_ResourcePermission.html) for the applicable ARN values.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the folder.
 * `created_time` - The time that the folder was created.
@@ -102,8 +102,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-A QuickSight folder can be imported using the AWS account ID and folder ID name separated by a comma (`,`) e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import a QuickSight folder using the AWS account ID and folder ID name separated by a comma (`,`). For example:
 
+```terraform
+import {
+  to = aws_quicksight_folder.example
+  id = "123456789012,example-id"
+}
 ```
-$ terraform import aws_quicksight_folder.example 123456789012,example-id
+
+Using `terraform import`, import a QuickSight folder using the AWS account ID and folder ID name separated by a comma (`,`). For example:
+
+```console
+% terraform import aws_quicksight_folder.example 123456789012,example-id
 ```
diff --git a/website/docs/r/quicksight_folder_membership.html.markdown b/website/docs/r/quicksight_folder_membership.html.markdown
index 8ae137f199c..9195ed0eaa5 100644
--- a/website/docs/r/quicksight_folder_membership.html.markdown
+++ b/website/docs/r/quicksight_folder_membership.html.markdown
@@ -34,16 +34,25 @@ The following arguments are optional:
 
 * `aws_account_id` - (Optional, Forces new resource) AWS account ID.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - A comma-delimited string joining AWS account ID, folder ID, member type, and member ID.
 
 ## Import
 
-QuickSight Folder Membership can be imported using the AWS account ID, folder ID, member type, and member ID separated by commas (`,`) e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import QuickSight Folder Membership using the AWS account ID, folder ID, member type, and member ID separated by commas (`,`). For example:
 
+```terraform
+import {
+  to = aws_quicksight_folder_membership.example
+  id = "123456789012,example-folder,DATASET,example-dataset"
+}
 ```
-$ terraform import aws_quicksight_folder_membership.example 123456789012,example-folder,DATASET,example-dataset
+
+Using `terraform import`, import QuickSight Folder Membership using the AWS account ID, folder ID, member type, and member ID separated by commas (`,`). For example:
+
+```console
+% terraform import aws_quicksight_folder_membership.example 123456789012,example-folder,DATASET,example-dataset
 ```
diff --git a/website/docs/r/quicksight_group.html.markdown b/website/docs/r/quicksight_group.html.markdown
index f3b9cc8bc83..c40b665f31a 100644
--- a/website/docs/r/quicksight_group.html.markdown
+++ b/website/docs/r/quicksight_group.html.markdown
@@ -20,23 +20,32 @@ resource "aws_quicksight_group" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `group_name` - (Required) A name for the group.
 * `aws_account_id` - (Optional) The ID for the AWS account that the group is in. Currently, you use the ID for the AWS account that contains your Amazon QuickSight account.
 * `description` - (Optional) A description for the group.
 * `namespace` - (Optional) The namespace. Currently, you should set this to `default`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name (ARN) of group
 
 ## Import
 
-QuickSight Group can be imported using the aws account id, namespace and group name separated by `/`.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import QuickSight Group using the aws account id, namespace and group name separated by `/`. For example:
 
+```terraform
+import {
+  to = aws_quicksight_group.example
+  id = "123456789123/default/tf-example"
+}
 ```
-$ terraform import aws_quicksight_group.example 123456789123/default/tf-example
+
+Using `terraform import`, import QuickSight Group using the aws account id, namespace and group name separated by `/`. For example:
+
+```console
+% terraform import aws_quicksight_group.example 123456789123/default/tf-example
 ```
diff --git a/website/docs/r/quicksight_group_membership.html.markdown b/website/docs/r/quicksight_group_membership.html.markdown
index 4b43eec377f..b7c3183b74c 100644
--- a/website/docs/r/quicksight_group_membership.html.markdown
+++ b/website/docs/r/quicksight_group_membership.html.markdown
@@ -21,21 +21,30 @@ resource "aws_quicksight_group_membership" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `group_name` - (Required) The name of the group in which the member will be added.
 * `member_name` - (Required) The name of the member to add to the group.
 * `aws_account_id` - (Optional) The ID for the AWS account that the group is in. Currently, you use the ID for the AWS account that contains your Amazon QuickSight account.
-* `namespace` - (Required) The namespace. Defaults to `default`. Currently only `default` is supported.
+* `namespace` - (Required) The namespace that you want the user to be a part of. Defaults to `default`.
 
-## Attributes Reference
+## Attribute Reference
 
-No additional attributes are exported.
+This resource exports no additional attributes.
 
 ## Import
 
-QuickSight Group membership can be imported using the AWS account ID, namespace, group name and member name separated by `/`.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import QuickSight Group membership using the AWS account ID, namespace, group name and member name separated by `/`. For example:
 
+```terraform
+import {
+  to = aws_quicksight_group_membership.example
+  id = "123456789123/default/all-access-users/john_smith"
+}
 ```
-$ terraform import aws_quicksight_group_membership.example 123456789123/default/all-access-users/john_smith
+
+Using `terraform import`, import QuickSight Group membership using the AWS account ID, namespace, group name and member name separated by `/`. For example:
+
+```console
+% terraform import aws_quicksight_group_membership.example 123456789123/default/all-access-users/john_smith
 ```
diff --git a/website/docs/r/quicksight_iam_policy_assignment.html.markdown b/website/docs/r/quicksight_iam_policy_assignment.html.markdown
index 3ff83af2432..d468d74c4cb 100644
--- a/website/docs/r/quicksight_iam_policy_assignment.html.markdown
+++ b/website/docs/r/quicksight_iam_policy_assignment.html.markdown
@@ -44,17 +44,26 @@ The following arguments are optional:
 * `groups` - (Optional) Array of Quicksight group names to assign the policy to.
 * `user` - (Optional) Array of Quicksight user names to assign the policy to.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `assignment_id` - Assignment ID.
 * `id` - A comma-delimited string joining AWS account ID, namespace, and assignment name.
 
 ## Import
 
-QuickSight IAM Policy Assignment can be imported using the AWS account ID, namespace, and assignment name separated by commas (`,`) e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import QuickSight IAM Policy Assignment using the AWS account ID, namespace, and assignment name separated by commas (`,`). For example:
 
+```terraform
+import {
+  to = aws_quicksight_iam_policy_assignment.example
+  id = "123456789012,default,example"
+}
 ```
-$ terraform import aws_quicksight_iam_policy_assignment.example 123456789012,default,example
+
+Using `terraform import`, import QuickSight IAM Policy Assignment using the AWS account ID, namespace, and assignment name separated by commas (`,`). For example:
+
+```console
+% terraform import aws_quicksight_iam_policy_assignment.example 123456789012,default,example
 ```
diff --git a/website/docs/r/quicksight_ingestion.html.markdown b/website/docs/r/quicksight_ingestion.html.markdown
index 072f3ee261d..cd7dda3075a 100644
--- a/website/docs/r/quicksight_ingestion.html.markdown
+++ b/website/docs/r/quicksight_ingestion.html.markdown
@@ -34,9 +34,9 @@ The following arguments are optional:
 
 * `aws_account_id` - (Optional) AWS account ID.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the Ingestion.
 * `id` - A comma-delimited string joining AWS account ID, data set ID, and ingestion ID.
@@ -44,8 +44,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-QuickSight Ingestion can be imported using the AWS account ID, data set ID, and ingestion ID separated by commas (`,`) e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import QuickSight Ingestion using the AWS account ID, data set ID, and ingestion ID separated by commas (`,`). For example:
 
+```terraform
+import {
+  to = aws_quicksight_ingestion.example
+  id = "123456789012,example-dataset-id,example-ingestion-id"
+}
 ```
-$ terraform import aws_quicksight_ingestion.example 123456789012,example-dataset-id,example-ingestion-id
+
+Using `terraform import`, import QuickSight Ingestion using the AWS account ID, data set ID, and ingestion ID separated by commas (`,`). For example:
+
+```console
+% terraform import aws_quicksight_ingestion.example 123456789012,example-dataset-id,example-ingestion-id
 ```
diff --git a/website/docs/r/quicksight_namespace.html.markdown b/website/docs/r/quicksight_namespace.html.markdown
index 9d78523b8f6..6358e6b7f08 100644
--- a/website/docs/r/quicksight_namespace.html.markdown
+++ b/website/docs/r/quicksight_namespace.html.markdown
@@ -32,9 +32,9 @@ The following arguments are optional:
 * `identity_store` - (Optional) User identity directory type. Defaults to `QUICKSIGHT`, the only current valid value.
 * `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the Namespace.
 * `capacity_region` - Namespace AWS Region.
@@ -51,8 +51,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-QuickSight Namespace can be imported using the AWS account ID and namespace separated by commas (`,`) e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import QuickSight Namespace using the AWS account ID and namespace separated by commas (`,`). For example:
 
+```terraform
+import {
+  to = aws_quicksight_namespace.example
+  id = "123456789012,example"
+}
 ```
-$ terraform import aws_quicksight_namespace.example 123456789012,example
+
+Using `terraform import`, import QuickSight Namespace using the AWS account ID and namespace separated by commas (`,`). For example:
+
+```console
+% terraform import aws_quicksight_namespace.example 123456789012,example
 ```
diff --git a/website/docs/r/quicksight_refresh_schedule.html.markdown b/website/docs/r/quicksight_refresh_schedule.html.markdown
index c213312b276..c86f90af114 100644
--- a/website/docs/r/quicksight_refresh_schedule.html.markdown
+++ b/website/docs/r/quicksight_refresh_schedule.html.markdown
@@ -103,17 +103,26 @@ The following arguments are optional:
 * `day_of_month` - (Optional) The day of the month that you want to schedule refresh on.
 * `day_of_week` - (Optional) The day of the week that you want to schedule a refresh on. Valid values are `SUNDAY`, `MONDAY`, `TUESDAY`, `WEDNESDAY`, `THURSDAY`, `FRIDAY` and `SATURDAY`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name (ARN) of the refresh schedule.
 * `id` - A comma-delimited string joining AWS account ID, data set ID & refresh schedule ID.
 
 ## Import
 
-A QuickSight Refresh Schedule can be imported using the AWS account ID, data set ID and schedule ID separated by commas (`,`) e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import a QuickSight Refresh Schedule using the AWS account ID, data set ID and schedule ID separated by commas (`,`). For example:
 
+```terraform
+import {
+  to = aws_quicksight_refresh_schedule.example
+  id = "123456789012,dataset-id,schedule-id"
+}
 ```
-$ terraform import aws_quicksight_refresh_schedule.example 123456789012,dataset-id,schedule-id
+
+Using `terraform import`, import a QuickSight Refresh Schedule using the AWS account ID, data set ID and schedule ID separated by commas (`,`). For example:
+
+```console
+% terraform import aws_quicksight_refresh_schedule.example 123456789012,dataset-id,schedule-id
 ```
diff --git a/website/docs/r/quicksight_template.html.markdown b/website/docs/r/quicksight_template.html.markdown
index c2abd258f90..c8291ef3100 100644
--- a/website/docs/r/quicksight_template.html.markdown
+++ b/website/docs/r/quicksight_template.html.markdown
@@ -138,9 +138,9 @@ The following arguments are optional:
 * `parameters_declarations` - (Optional) A list of parameter declarations for a template. Parameters are named variables that can transfer a value for use by an action or an object. See [AWS API Documentation for complete description](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_ParameterDeclaration.html). For more information, see [Parameters in Amazon QuickSight](https://docs.aws.amazon.com/quicksight/latest/user/parameters-in-quicksight.html) in the Amazon QuickSight User Guide.
 * `sheets` - (Optional) A list of sheet definitions for a template. See [AWS API Documentation for complete description](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_SheetDefinition.html).
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the template.
 * `created_time` - The time that the template was created.
@@ -161,8 +161,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-A QuickSight Template can be imported using the AWS account ID and template ID separated by a comma (`,`) e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import a QuickSight Template using the AWS account ID and template ID separated by a comma (`,`). For example:
 
+```terraform
+import {
+  to = aws_quicksight_template.example
+  id = "123456789012,example-id"
+}
 ```
-$ terraform import aws_quicksight_template.example 123456789012,example-id
+
+Using `terraform import`, import a QuickSight Template using the AWS account ID and template ID separated by a comma (`,`). For example:
+
+```console
+% terraform import aws_quicksight_template.example 123456789012,example-id
 ```
diff --git a/website/docs/r/quicksight_template_alias.html.markdown b/website/docs/r/quicksight_template_alias.html.markdown
index 4d02de90a9f..ec68be7ddd5 100644
--- a/website/docs/r/quicksight_template_alias.html.markdown
+++ b/website/docs/r/quicksight_template_alias.html.markdown
@@ -34,17 +34,26 @@ The following arguments are optional:
 
 * `aws_account_id` - (Optional, Forces new resource) AWS account ID.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name (ARN) of the template alias.
 * `id` - A comma-delimited string joining AWS account ID, template ID, and alias name.
 
 ## Import
 
-QuickSight Template Alias can be imported using the AWS account ID, template ID, and alias name separated by a comma (`,`) e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import QuickSight Template Alias using the AWS account ID, template ID, and alias name separated by a comma (`,`). For example:
 
+```terraform
+import {
+  to = aws_quicksight_template_alias.example
+  id = "123456789012,example-id,example-alias"
+}
 ```
-$ terraform import aws_quicksight_template_alias.example 123456789012,example-id,example-alias
+
+Using `terraform import`, import QuickSight Template Alias using the AWS account ID, template ID, and alias name separated by a comma (`,`). For example:
+
+```console
+% terraform import aws_quicksight_template_alias.example 123456789012,example-id,example-alias
 ```
diff --git a/website/docs/r/quicksight_theme.html.markdown b/website/docs/r/quicksight_theme.html.markdown
index a634de07213..f06833d5267 100644
--- a/website/docs/r/quicksight_theme.html.markdown
+++ b/website/docs/r/quicksight_theme.html.markdown
@@ -132,9 +132,9 @@ The following arguments are optional:
 * `warning` - (Optional) Color (hexadecimal) that applies to warning and informational messages.
 * `warning_foreground` - (Optional) Color (hexadecimal) that applies to any text or other elements that appear over the warning color.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the theme.
 * `created_time` - The time that the theme was created.
@@ -154,8 +154,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-A QuickSight Theme can be imported using the AWS account ID and theme ID separated by a comma (`,`) e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import a QuickSight Theme using the AWS account ID and theme ID separated by a comma (`,`). For example:
 
+```terraform
+import {
+  to = aws_quicksight_theme.example
+  id = "123456789012,example-id"
+}
 ```
-$ terraform import aws_quicksight_theme.example 123456789012,example-id
+
+Using `terraform import`, import a QuickSight Theme using the AWS account ID and theme ID separated by a comma (`,`). For example:
+
+```console
+% terraform import aws_quicksight_theme.example 123456789012,example-id
 ```
diff --git a/website/docs/r/quicksight_user.html.markdown b/website/docs/r/quicksight_user.html.markdown
index e557eb30a90..07f34cb9e9f 100644
--- a/website/docs/r/quicksight_user.html.markdown
+++ b/website/docs/r/quicksight_user.html.markdown
@@ -25,7 +25,7 @@ resource "aws_quicksight_user" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `email` - (Required) The email address of the user that you want to register.
 * `identity_type` - (Required) Amazon QuickSight supports several ways of managing the identity of users. This parameter accepts either  `IAM` or `QUICKSIGHT`. If `IAM` is specified, the `iam_arn` must also be specified.
@@ -36,12 +36,12 @@ The following arguments are supported:
 * `namespace`  - (Optional) The Amazon Quicksight namespace to create the user in. Defaults to `default`.
 * `session_name` - (Optional) The name of the IAM session to use when assuming roles that can embed QuickSight dashboards. Only valid for registering users using an assumed IAM role. Additionally, if registering multiple users using the same IAM role, each user needs to have a unique session name.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name (ARN) of the user
 
 ## Import
 
-Importing is currently not supported on this resource.
+You cannot import this resource.
diff --git a/website/docs/r/quicksight_vpc_connection.html.markdown b/website/docs/r/quicksight_vpc_connection.html.markdown
index 1cdef75a3b9..882f17fbcf0 100644
--- a/website/docs/r/quicksight_vpc_connection.html.markdown
+++ b/website/docs/r/quicksight_vpc_connection.html.markdown
@@ -78,9 +78,9 @@ The following arguments are optional:
 * `dns_resolvers` - (Optional) A list of IP addresses of DNS resolver endpoints for the VPC connection.
 * `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the VPC connection.
 * `availability_status` - The availability status of the VPC connection. Valid values are `AVAILABLE`, `UNAVAILABLE` or `PARTIALLY_AVAILABLE`.
@@ -97,8 +97,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-QuickSight VPC connection can be imported using the AWS account ID and VPC connection ID separated by commas (`,`) e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import QuickSight VPC connection using the AWS account ID and VPC connection ID separated by commas (`,`). For example:
 
+```terraform
+import {
+  to = aws_quicksight_vpc_connection.example
+  id = "123456789012,example"
+}
 ```
-$ terraform import aws_quicksight_vpc_connection.example 123456789012,example
+
+Using `terraform import`, import QuickSight VPC connection using the AWS account ID and VPC connection ID separated by commas (`,`). For example:
+
+```console
+% terraform import aws_quicksight_vpc_connection.example 123456789012,example
 ```
diff --git a/website/docs/r/ram_principal_association.html.markdown b/website/docs/r/ram_principal_association.html.markdown
new file mode 100644
index 00000000000..4d2775a0085
--- /dev/null
+++ b/website/docs/r/ram_principal_association.html.markdown
@@ -0,0 +1,76 @@
+---
+subcategory: "RAM (Resource Access Manager)"
+layout: "aws"
+page_title: "AWS: aws_ram_principal_association"
+description: |-
+  Provides a Resource Access Manager (RAM) principal association.
+---
+
+# Resource: aws_ram_principal_association
+
+Provides a Resource Access Manager (RAM) principal association. Depending if [RAM Sharing with AWS Organizations is enabled](https://docs.aws.amazon.com/ram/latest/userguide/getting-started-sharing.html#getting-started-sharing-orgs), the RAM behavior with different principal types changes.
+
+When RAM Sharing with AWS Organizations is enabled:
+
+- For AWS Account ID, Organization, and Organizational Unit principals within the same AWS Organization, no resource share invitation is sent and resources become available automatically after creating the association.
+- For AWS Account ID principals outside the AWS Organization, a resource share invitation is sent and must be accepted before resources become available. See the [`aws_ram_resource_share_accepter` resource](/docs/providers/aws/r/ram_resource_share_accepter.html) to accept these invitations.
+
+When RAM Sharing with AWS Organizations is not enabled:
+
+- Organization and Organizational Unit principals cannot be used.
+- For AWS Account ID principals, a resource share invitation is sent and must be accepted before resources become available. See the [`aws_ram_resource_share_accepter` resource](/docs/providers/aws/r/ram_resource_share_accepter.html) to accept these invitations.
+
+## Example Usage
+
+### AWS Account ID
+
+```terraform
+resource "aws_ram_resource_share" "example" {
+  # ... other configuration ...
+  allow_external_principals = true
+}
+
+resource "aws_ram_principal_association" "example" {
+  principal          = "111111111111"
+  resource_share_arn = aws_ram_resource_share.example.arn
+}
+```
+
+### AWS Organization
+
+```terraform
+resource "aws_ram_principal_association" "example" {
+  principal          = aws_organizations_organization.example.arn
+  resource_share_arn = aws_ram_resource_share.example.arn
+}
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `principal` - (Required) The principal to associate with the resource share. Possible values are an AWS account ID, an AWS Organizations Organization ARN, or an AWS Organizations Organization Unit ARN.
+* `resource_share_arn` - (Required) The Amazon Resource Name (ARN) of the resource share.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The Amazon Resource Name (ARN) of the Resource Share and the principal, separated by a comma.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import RAM Principal Associations using their Resource Share ARN and the `principal` separated by a comma. For example:
+
+```terraform
+import {
+  to = aws_ram_principal_association.example
+  id = "arn:aws:ram:eu-west-1:123456789012:resource-share/73da1ab9-b94a-4ba3-8eb4-45917f7f4b12,123456789012"
+}
+```
+
+Using `terraform import`, import RAM Principal Associations using their Resource Share ARN and the `principal` separated by a comma. For example:
+
+```console
+% terraform import aws_ram_principal_association.example arn:aws:ram:eu-west-1:123456789012:resource-share/73da1ab9-b94a-4ba3-8eb4-45917f7f4b12,123456789012
+```
diff --git a/website/docs/r/ram_principal_association.markdown b/website/docs/r/ram_principal_association.markdown
deleted file mode 100644
index 960d6eb311e..00000000000
--- a/website/docs/r/ram_principal_association.markdown
+++ /dev/null
@@ -1,67 +0,0 @@
----
-subcategory: "RAM (Resource Access Manager)"
-layout: "aws"
-page_title: "AWS: aws_ram_principal_association"
-description: |-
-  Provides a Resource Access Manager (RAM) principal association.
----
-
-# Resource: aws_ram_principal_association
-
-Provides a Resource Access Manager (RAM) principal association. Depending if [RAM Sharing with AWS Organizations is enabled](https://docs.aws.amazon.com/ram/latest/userguide/getting-started-sharing.html#getting-started-sharing-orgs), the RAM behavior with different principal types changes.
-
-When RAM Sharing with AWS Organizations is enabled:
-
-- For AWS Account ID, Organization, and Organizational Unit principals within the same AWS Organization, no resource share invitation is sent and resources become available automatically after creating the association.
-- For AWS Account ID principals outside the AWS Organization, a resource share invitation is sent and must be accepted before resources become available. See the [`aws_ram_resource_share_accepter` resource](/docs/providers/aws/r/ram_resource_share_accepter.html) to accept these invitations.
-
-When RAM Sharing with AWS Organizations is not enabled:
-
-- Organization and Organizational Unit principals cannot be used.
-- For AWS Account ID principals, a resource share invitation is sent and must be accepted before resources become available. See the [`aws_ram_resource_share_accepter` resource](/docs/providers/aws/r/ram_resource_share_accepter.html) to accept these invitations.
-
-## Example Usage
-
-### AWS Account ID
-
-```terraform
-resource "aws_ram_resource_share" "example" {
-  # ... other configuration ...
-  allow_external_principals = true
-}
-
-resource "aws_ram_principal_association" "example" {
-  principal          = "111111111111"
-  resource_share_arn = aws_ram_resource_share.example.arn
-}
-```
-
-### AWS Organization
-
-```terraform
-resource "aws_ram_principal_association" "example" {
-  principal          = aws_organizations_organization.example.arn
-  resource_share_arn = aws_ram_resource_share.example.arn
-}
-```
-
-## Argument Reference
-
-The following arguments are supported:
-
-* `principal` - (Required) The principal to associate with the resource share. Possible values are an AWS account ID, an AWS Organizations Organization ARN, or an AWS Organizations Organization Unit ARN.
-* `resource_share_arn` - (Required) The Amazon Resource Name (ARN) of the resource share.
-
-## Attributes Reference
-
-In addition to all arguments above, the following attributes are exported:
-
-* `id` - The Amazon Resource Name (ARN) of the Resource Share and the principal, separated by a comma.
-
-## Import
-
-RAM Principal Associations can be imported using their Resource Share ARN and the `principal` separated by a comma, e.g.,
-
-```
-$ terraform import aws_ram_principal_association.example arn:aws:ram:eu-west-1:123456789012:resource-share/73da1ab9-b94a-4ba3-8eb4-45917f7f4b12,123456789012
-```
diff --git a/website/docs/r/ram_resource_association.html.markdown b/website/docs/r/ram_resource_association.html.markdown
index 2eec3810d4d..c009b8aa1bf 100644
--- a/website/docs/r/ram_resource_association.html.markdown
+++ b/website/docs/r/ram_resource_association.html.markdown
@@ -23,21 +23,30 @@ resource "aws_ram_resource_association" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `resource_arn` - (Required) Amazon Resource Name (ARN) of the resource to associate with the RAM Resource Share.
 * `resource_share_arn` - (Required) Amazon Resource Name (ARN) of the RAM Resource Share.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The Amazon Resource Name (ARN) of the resource share.
 
 ## Import
 
-RAM Resource Associations can be imported using their Resource Share ARN and Resource ARN separated by a comma, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import RAM Resource Associations using their Resource Share ARN and Resource ARN separated by a comma. For example:
 
+```terraform
+import {
+  to = aws_ram_resource_association.example
+  id = "arn:aws:ram:eu-west-1:123456789012:resource-share/73da1ab9-b94a-4ba3-8eb4-45917f7f4b12,arn:aws:ec2:eu-west-1:123456789012:subnet/subnet-12345678"
+}
 ```
-$ terraform import aws_ram_resource_association.example arn:aws:ram:eu-west-1:123456789012:resource-share/73da1ab9-b94a-4ba3-8eb4-45917f7f4b12,arn:aws:ec2:eu-west-1:123456789012:subnet/subnet-12345678
+
+Using `terraform import`, import RAM Resource Associations using their Resource Share ARN and Resource ARN separated by a comma. For example:
+
+```console
+% terraform import aws_ram_resource_association.example arn:aws:ram:eu-west-1:123456789012:resource-share/73da1ab9-b94a-4ba3-8eb4-45917f7f4b12,arn:aws:ec2:eu-west-1:123456789012:subnet/subnet-12345678
 ```
diff --git a/website/docs/r/ram_resource_share.html.markdown b/website/docs/r/ram_resource_share.html.markdown
new file mode 100644
index 00000000000..83c634acbe4
--- /dev/null
+++ b/website/docs/r/ram_resource_share.html.markdown
@@ -0,0 +1,58 @@
+---
+subcategory: "RAM (Resource Access Manager)"
+layout: "aws"
+page_title: "AWS: aws_ram_resource_share"
+description: |-
+  Manages a Resource Access Manager (RAM) Resource Share.
+---
+
+# Resource: aws_ram_resource_share
+
+Manages a Resource Access Manager (RAM) Resource Share. To associate principals with the share, see the [`aws_ram_principal_association` resource](/docs/providers/aws/r/ram_principal_association.html). To associate resources with the share, see the [`aws_ram_resource_association` resource](/docs/providers/aws/r/ram_resource_association.html).
+
+## Example Usage
+
+```terraform
+resource "aws_ram_resource_share" "example" {
+  name                      = "example"
+  allow_external_principals = true
+
+  tags = {
+    Environment = "Production"
+  }
+}
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) The name of the resource share.
+* `allow_external_principals` - (Optional) Indicates whether principals outside your organization can be associated with a resource share.
+* `permission_arns` - (Optional) Specifies the Amazon Resource Names (ARNs) of the RAM permission to associate with the resource share. If you do not specify an ARN for the permission, RAM automatically attaches the default version of the permission for each resource type. You can associate only one permission with each resource type included in the resource share.
+* `tags` - (Optional) A map of tags to assign to the resource share. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) of the resource share.
+* `id` - The Amazon Resource Name (ARN) of the resource share.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import resource shares using the `arn` of the resource share. For example:
+
+```terraform
+import {
+  to = aws_ram_resource_share.example
+  id = "arn:aws:ram:eu-west-1:123456789012:resource-share/73da1ab9-b94a-4ba3-8eb4-45917f7f4b12"
+}
+```
+
+Using `terraform import`, import resource shares using the `arn` of the resource share. For example:
+
+```console
+% terraform import aws_ram_resource_share.example arn:aws:ram:eu-west-1:123456789012:resource-share/73da1ab9-b94a-4ba3-8eb4-45917f7f4b12
+```
diff --git a/website/docs/r/ram_resource_share.markdown b/website/docs/r/ram_resource_share.markdown
deleted file mode 100644
index 13c2551d1e4..00000000000
--- a/website/docs/r/ram_resource_share.markdown
+++ /dev/null
@@ -1,49 +0,0 @@
----
-subcategory: "RAM (Resource Access Manager)"
-layout: "aws"
-page_title: "AWS: aws_ram_resource_share"
-description: |-
-  Manages a Resource Access Manager (RAM) Resource Share.
----
-
-# Resource: aws_ram_resource_share
-
-Manages a Resource Access Manager (RAM) Resource Share. To associate principals with the share, see the [`aws_ram_principal_association` resource](/docs/providers/aws/r/ram_principal_association.html). To associate resources with the share, see the [`aws_ram_resource_association` resource](/docs/providers/aws/r/ram_resource_association.html).
-
-## Example Usage
-
-```terraform
-resource "aws_ram_resource_share" "example" {
-  name                      = "example"
-  allow_external_principals = true
-
-  tags = {
-    Environment = "Production"
-  }
-}
-```
-
-## Argument Reference
-
-The following arguments are supported:
-
-* `name` - (Required) The name of the resource share.
-* `allow_external_principals` - (Optional) Indicates whether principals outside your organization can be associated with a resource share.
-* `permission_arns` - (Optional) Specifies the Amazon Resource Names (ARNs) of the RAM permission to associate with the resource share. If you do not specify an ARN for the permission, RAM automatically attaches the default version of the permission for each resource type. You can associate only one permission with each resource type included in the resource share.
-* `tags` - (Optional) A map of tags to assign to the resource share. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
-
-## Attributes Reference
-
-In addition to all arguments above, the following attributes are exported:
-
-* `arn` - The Amazon Resource Name (ARN) of the resource share.
-* `id` - The Amazon Resource Name (ARN) of the resource share.
-* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
-
-## Import
-
-Resource shares can be imported using the `arn` of the resource share, e.g.,
-
-```
-$ terraform import aws_ram_resource_share.example arn:aws:ram:eu-west-1:123456789012:resource-share/73da1ab9-b94a-4ba3-8eb4-45917f7f4b12
-```
diff --git a/website/docs/r/ram_resource_share_accepter.html.markdown b/website/docs/r/ram_resource_share_accepter.html.markdown
new file mode 100644
index 00000000000..aa63f0d6d69
--- /dev/null
+++ b/website/docs/r/ram_resource_share_accepter.html.markdown
@@ -0,0 +1,87 @@
+---
+subcategory: "RAM (Resource Access Manager)"
+layout: "aws"
+page_title: "AWS: aws_ram_resource_share_accepter"
+description: |-
+  Manages accepting a Resource Access Manager (RAM) Resource Share invitation.
+---
+
+# Resource: aws_ram_resource_share_accepter
+
+Manage accepting a Resource Access Manager (RAM) Resource Share invitation. From a _receiver_ AWS account, accept an invitation to share resources that were shared by a _sender_ AWS account. To create a resource share in the _sender_, see the [`aws_ram_resource_share` resource](/docs/providers/aws/r/ram_resource_share.html).
+
+~> **Note:** If both AWS accounts are in the same Organization and [RAM Sharing with AWS Organizations is enabled](https://docs.aws.amazon.com/ram/latest/userguide/getting-started-sharing.html#getting-started-sharing-orgs), this resource is not necessary as RAM Resource Share invitations are not used.
+
+## Example Usage
+
+This configuration provides an example of using multiple Terraform AWS providers to configure two different AWS accounts. In the _sender_ account, the configuration creates a `aws_ram_resource_share` and uses a data source in the _receiver_ account to create a `aws_ram_principal_association` resource with the _receiver's_ account ID. In the _receiver_ account, the configuration accepts the invitation to share resources with the `aws_ram_resource_share_accepter`.
+
+```terraform
+provider "aws" {
+  profile = "profile2"
+}
+
+provider "aws" {
+  alias   = "alternate"
+  profile = "profile1"
+}
+
+resource "aws_ram_resource_share" "sender_share" {
+  provider = aws.alternate
+
+  name                      = "tf-test-resource-share"
+  allow_external_principals = true
+
+  tags = {
+    Name = "tf-test-resource-share"
+  }
+}
+
+resource "aws_ram_principal_association" "sender_invite" {
+  provider = aws.alternate
+
+  principal          = data.aws_caller_identity.receiver.account_id
+  resource_share_arn = aws_ram_resource_share.sender_share.arn
+}
+
+data "aws_caller_identity" "receiver" {}
+
+resource "aws_ram_resource_share_accepter" "receiver_accept" {
+  share_arn = aws_ram_principal_association.sender_invite.resource_share_arn
+}
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `share_arn` - (Required) The ARN of the resource share.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `invitation_arn` - The ARN of the resource share invitation.
+* `share_id` - The ID of the resource share as displayed in the console.
+* `status` - The status of the resource share (ACTIVE, PENDING, FAILED, DELETING, DELETED).
+* `receiver_account_id` - The account ID of the receiver account which accepts the invitation.
+* `sender_account_id` - The account ID of the sender account which submits the invitation.
+* `share_name` - The name of the resource share.
+* `resources` - A list of the resource ARNs shared via the resource share.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import resource share accepters using the resource share ARN. For example:
+
+```terraform
+import {
+  to = aws_ram_resource_share_accepter.example
+  id = "arn:aws:ram:us-east-1:123456789012:resource-share/c4b56393-e8d9-89d9-6dc9-883752de4767"
+}
+```
+
+Using `terraform import`, import resource share accepters using the resource share ARN. For example:
+
+```console
+% terraform import aws_ram_resource_share_accepter.example arn:aws:ram:us-east-1:123456789012:resource-share/c4b56393-e8d9-89d9-6dc9-883752de4767
+```
diff --git a/website/docs/r/ram_resource_share_accepter.markdown b/website/docs/r/ram_resource_share_accepter.markdown
deleted file mode 100644
index b9214b5f1c0..00000000000
--- a/website/docs/r/ram_resource_share_accepter.markdown
+++ /dev/null
@@ -1,78 +0,0 @@
----
-subcategory: "RAM (Resource Access Manager)"
-layout: "aws"
-page_title: "AWS: aws_ram_resource_share_accepter"
-description: |-
-  Manages accepting a Resource Access Manager (RAM) Resource Share invitation.
----
-
-# Resource: aws_ram_resource_share_accepter
-
-Manage accepting a Resource Access Manager (RAM) Resource Share invitation. From a _receiver_ AWS account, accept an invitation to share resources that were shared by a _sender_ AWS account. To create a resource share in the _sender_, see the [`aws_ram_resource_share` resource](/docs/providers/aws/r/ram_resource_share.html).
-
-~> **Note:** If both AWS accounts are in the same Organization and [RAM Sharing with AWS Organizations is enabled](https://docs.aws.amazon.com/ram/latest/userguide/getting-started-sharing.html#getting-started-sharing-orgs), this resource is not necessary as RAM Resource Share invitations are not used.
-
-## Example Usage
-
-This configuration provides an example of using multiple Terraform AWS providers to configure two different AWS accounts. In the _sender_ account, the configuration creates a `aws_ram_resource_share` and uses a data source in the _receiver_ account to create a `aws_ram_principal_association` resource with the _receiver's_ account ID. In the _receiver_ account, the configuration accepts the invitation to share resources with the `aws_ram_resource_share_accepter`.
-
-```terraform
-provider "aws" {
-  profile = "profile2"
-}
-
-provider "aws" {
-  alias   = "alternate"
-  profile = "profile1"
-}
-
-resource "aws_ram_resource_share" "sender_share" {
-  provider = aws.alternate
-
-  name                      = "tf-test-resource-share"
-  allow_external_principals = true
-
-  tags = {
-    Name = "tf-test-resource-share"
-  }
-}
-
-resource "aws_ram_principal_association" "sender_invite" {
-  provider = aws.alternate
-
-  principal          = data.aws_caller_identity.receiver.account_id
-  resource_share_arn = aws_ram_resource_share.sender_share.arn
-}
-
-data "aws_caller_identity" "receiver" {}
-
-resource "aws_ram_resource_share_accepter" "receiver_accept" {
-  share_arn = aws_ram_principal_association.sender_invite.resource_share_arn
-}
-```
-
-## Argument Reference
-
-The following arguments are supported:
-
-* `share_arn` - (Required) The ARN of the resource share.
-
-## Attributes Reference
-
-In addition to all arguments above, the following attributes are exported:
-
-* `invitation_arn` - The ARN of the resource share invitation.
-* `share_id` - The ID of the resource share as displayed in the console.
-* `status` - The status of the resource share (ACTIVE, PENDING, FAILED, DELETING, DELETED).
-* `receiver_account_id` - The account ID of the receiver account which accepts the invitation.
-* `sender_account_id` - The account ID of the sender account which submits the invitation.
-* `share_name` - The name of the resource share.
-* `resources` - A list of the resource ARNs shared via the resource share.
-
-## Import
-
-Resource share accepters can be imported using the resource share ARN, e.g.,
-
-```
-$ terraform import aws_ram_resource_share_accepter.example arn:aws:ram:us-east-1:123456789012:resource-share/c4b56393-e8d9-89d9-6dc9-883752de4767
-```
diff --git a/website/docs/r/ram_sharing_with_organization.html.markdown b/website/docs/r/ram_sharing_with_organization.html.markdown
new file mode 100644
index 00000000000..3252fa47a2b
--- /dev/null
+++ b/website/docs/r/ram_sharing_with_organization.html.markdown
@@ -0,0 +1,46 @@
+---
+subcategory: "RAM (Resource Access Manager)"
+layout: "aws"
+page_title: "AWS: aws_ram_sharing_with_organization"
+description: |-
+  Manages Resource Access Manager (RAM) Resource Sharing with AWS Organizations.
+---
+
+# Resource: aws_ram_sharing_with_organization
+
+Manages Resource Access Manager (RAM) Resource Sharing with AWS Organizations. If you enable sharing with your organization, you can share resources without using invitations. Refer to the [AWS RAM user guide](https://docs.aws.amazon.com/ram/latest/userguide/getting-started-sharing.html#getting-started-sharing-orgs) for more details.
+
+~> **NOTE:** Use this resource to manage resource sharing within your organization, **not** the [`aws_organizations_organization`](organizations_organization.html) resource with `ram.amazonaws.com` configured in `aws_service_access_principals`.
+
+## Example Usage
+
+```terraform
+resource "aws_ram_sharing_with_organization" "example" {}
+```
+
+## Argument Reference
+
+This resource does not support any arguments.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - AWS Account ID.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import the resource using the current AWS account ID. For example:
+
+```terraform
+import {
+  to = aws_ram_sharing_with_organization.example
+  id = "123456789012"
+}
+```
+
+Using `terraform import`, import the resource using the current AWS account ID. For example:
+
+```console
+% terraform import aws_ram_sharing_with_organization.example 123456789012
+```
diff --git a/website/docs/r/rbin_rule.html.markdown b/website/docs/r/rbin_rule.html.markdown
index 84fe7f5d28e..6659f190786 100644
--- a/website/docs/r/rbin_rule.html.markdown
+++ b/website/docs/r/rbin_rule.html.markdown
@@ -78,9 +78,9 @@ The following arguments are required:
 * `unlock_delay_unit` - (Required) The unit of time in which to measure the unlock delay. Currently, the unlock delay can be measure only in days.
 * `unlock_delay_value` - (Required) The unlock delay period, measured in the unit specified for UnlockDelayUnit.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - (String) ID of the Rule.
 * `lock_end_time` - (Timestamp) The date and time at which the unlock delay is set to expire. Only returned for retention rules that have been unlocked and that are still within the unlock delay period.
@@ -89,8 +89,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-RBin Rule can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import RBin Rule using the `id`. For example:
 
+```terraform
+import {
+  to = aws_rbin_rule.example
+  id = "examplerule"
+}
 ```
-$ terraform import aws_rbin_rule.example examplerule
+
+Using `terraform import`, import RBin Rule using the `id`. For example:
+
+```console
+% terraform import aws_rbin_rule.example examplerule
 ```
diff --git a/website/docs/r/rds_cluster.html.markdown b/website/docs/r/rds_cluster.html.markdown
index 5834201ef4d..668db491bf7 100644
--- a/website/docs/r/rds_cluster.html.markdown
+++ b/website/docs/r/rds_cluster.html.markdown
@@ -218,27 +218,35 @@ the AWS official documentation :
 * [create-db-cluster](https://docs.aws.amazon.com/cli/latest/reference/rds/create-db-cluster.html)
 * [modify-db-cluster](https://docs.aws.amazon.com/cli/latest/reference/rds/modify-db-cluster.html)
 
-The following arguments are supported:
+This argument supports the following arguments:
 
-* `allocated_storage` - (Optional) (Required for Multi-AZ DB cluster) The amount of storage in gibibytes (GiB) to allocate to each DB instance in the Multi-AZ DB cluster.
+* `allocated_storage` - (Optional, Required for Multi-AZ DB cluster) The amount of storage in gibibytes (GiB) to allocate to each DB instance in the Multi-AZ DB cluster.
 * `allow_major_version_upgrade` - (Optional) Enable to allow major engine version upgrades when changing engine versions. Defaults to `false`.
 * `apply_immediately` - (Optional) Specifies whether any cluster modifications are applied immediately, or during the next maintenance window. Default is `false`. See [Amazon RDS Documentation for more information.](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.DBInstance.Modifying.html)
-* `availability_zones` - (Optional) List of EC2 Availability Zones for the DB cluster storage where DB cluster instances can be created. RDS automatically assigns 3 AZs if less than 3 AZs are configured, which will show as a difference requiring resource recreation next Terraform apply. We recommend specifying 3 AZs or using [the `lifecycle` configuration block `ignore_changes` argument](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html#ignore_changes) if necessary. A maximum of 3 AZs can be configured.
+* `availability_zones` - (Optional) List of EC2 Availability Zones for the DB cluster storage where DB cluster instances can be created.
+  RDS automatically assigns 3 AZs if less than 3 AZs are configured, which will show as a difference requiring resource recreation next Terraform apply.
+  We recommend specifying 3 AZs or using [the `lifecycle` configuration block `ignore_changes` argument](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html#ignore_changes) if necessary.
+  A maximum of 3 AZs can be configured.
 * `backtrack_window` - (Optional) Target backtrack window, in seconds. Only available for `aurora` and `aurora-mysql` engines currently. To disable backtracking, set this value to `0`. Defaults to `0`. Must be between `0` and `259200` (72 hours)
 * `backup_retention_period` - (Optional) Days to retain backups for. Default `1`
 * `cluster_identifier_prefix` - (Optional, Forces new resource) Creates a unique cluster identifier beginning with the specified prefix. Conflicts with `cluster_identifier`.
 * `cluster_identifier` - (Optional, Forces new resources) The cluster identifier. If omitted, Terraform will assign a random, unique identifier.
 * `copy_tags_to_snapshot` – (Optional, boolean) Copy all Cluster `tags` to snapshots. Default is `false`.
 * `database_name` - (Optional) Name for an automatically created database on cluster creation. There are different naming restrictions per database engine: [RDS Naming Constraints][5]
-* `db_cluster_instance_class` - (Optional) (Required for Multi-AZ DB cluster) The compute and memory capacity of each DB instance in the Multi-AZ DB cluster, for example db.m6g.xlarge. Not all DB instance classes are available in all AWS Regions, or for all database engines. For the full list of DB instance classes and availability for your engine, see [DB instance class](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Concepts.DBInstanceClass.html) in the Amazon RDS User Guide.
+* `db_cluster_instance_class` - (Optional, Required for Multi-AZ DB cluster) The compute and memory capacity of each DB instance in the Multi-AZ DB cluster, for example `db.m6g.xlarge`. Not all DB instance classes are available in all AWS Regions, or for all database engines. For the full list of DB instance classes and availability for your engine, see [DB instance class](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Concepts.DBInstanceClass.html) in the Amazon RDS User Guide.
+* `db_cluster_parameter_group_name` - (Optional) A cluster parameter group to associate with the cluster.
 * `db_instance_parameter_group_name` - (Optional) Instance parameter group to associate with all instances of the DB cluster. The `db_instance_parameter_group_name` parameter is only valid in combination with the `allow_major_version_upgrade` parameter.
-* `db_subnet_group_name` - (Optional) DB subnet group to associate with this DB instance. **NOTE:** This must match the `db_subnet_group_name` specified on every [`aws_rds_cluster_instance`](/docs/providers/aws/r/rds_cluster_instance.html) in the cluster.
-* `deletion_protection` - (Optional) If the DB instance should have deletion protection enabled. The database can't be deleted when this value is set to `true`. The default is `false`.
+* `db_subnet_group_name` - (Optional) DB subnet group to associate with this DB cluster.
+  **NOTE:** This must match the `db_subnet_group_name` specified on every [`aws_rds_cluster_instance`](/docs/providers/aws/r/rds_cluster_instance.html) in the cluster.
+* `db_system_id` - (Optional) For use with RDS Custom.
+* `deletion_protection` - (Optional) If the DB cluster should have deletion protection enabled.
+  The database can't be deleted when this value is set to `true`.
+  The default is `false`.
 * `enable_global_write_forwarding` - (Optional) Whether cluster should forward writes to an associated global cluster. Applied to secondary clusters to enable them to forward writes to an [`aws_rds_global_cluster`](/docs/providers/aws/r/rds_global_cluster.html)'s primary cluster. See the [Aurora Userguide documentation](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/aurora-global-database-write-forwarding.html) for more information.
 * `enable_http_endpoint` - (Optional) Enable HTTP endpoint (data API). Only valid when `engine_mode` is set to `serverless`.
 * `enabled_cloudwatch_logs_exports` - (Optional) Set of log types to export to cloudwatch. If omitted, no logs will be exported. The following log types are supported: `audit`, `error`, `general`, `slowquery`, `postgresql` (PostgreSQL).
 * `engine_mode` - (Optional) Database engine mode. Valid values: `global` (only valid for Aurora MySQL 1.21 and earlier), `multimaster`, `parallelquery`, `provisioned`, `serverless`. Defaults to: `provisioned`. See the [RDS User Guide](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/aurora-serverless.html) for limitations when using `serverless`.
-* `engine_version` - (Optional) Database engine version. Updating this argument results in an outage. See the [Aurora MySQL](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/AuroraMySQL.Updates.html) and [Aurora Postgres](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/AuroraPostgreSQL.Updates.html) documentation for your configured engine to determine this value, or by running `aws rds describe-db-engine-versions`. For example with Aurora MySQL 2, a potential value for this argument is `5.7.mysql_aurora.2.03.2`. The value can contain a partial version where supported by the API. The actual engine version used is returned in the attribute `engine_version_actual`, , see [Attributes Reference](#attributes-reference) below.
+* `engine_version` - (Optional) Database engine version. Updating this argument results in an outage. See the [Aurora MySQL](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/AuroraMySQL.Updates.html) and [Aurora Postgres](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/AuroraPostgreSQL.Updates.html) documentation for your configured engine to determine this value, or by running `aws rds describe-db-engine-versions`. For example with Aurora MySQL 2, a potential value for this argument is `5.7.mysql_aurora.2.03.2`. The value can contain a partial version where supported by the API. The actual engine version used is returned in the attribute `engine_version_actual`, , see [Attribute Reference](#attribute-reference) below.
 * `engine` - (Required) Name of the database engine to be used for this DB cluster. Valid Values: `aurora-mysql`, `aurora-postgresql`, `mysql`, `postgres`. (Note that `mysql` and `postgres` are Multi-AZ RDS clusters).
 * `final_snapshot_identifier` - (Optional) Name of your final DB snapshot when this DB cluster is deleted. If omitted, no final snapshot will be made.
 * `global_cluster_identifier` - (Optional) Global cluster identifier specified on [`aws_rds_global_cluster`](/docs/providers/aws/r/rds_global_cluster.html).
@@ -262,7 +270,7 @@ The following arguments are supported:
 * `snapshot_identifier` - (Optional) Specifies whether or not to create this cluster from a snapshot. You can use either the name or ARN when specifying a DB cluster snapshot, or the ARN when specifying a DB snapshot. Conflicts with `global_cluster_identifier`. Clusters cannot be restored from snapshot **and** joined to an existing global cluster in a single operation. See the [AWS documentation](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/aurora-global-database-getting-started.html#aurora-global-database.use-snapshot) or the [Global Cluster Restored From Snapshot example](#global-cluster-restored-from-snapshot) for instructions on building a global cluster starting with a snapshot.
 * `source_region` - (Optional) The source region for an encrypted replica DB cluster.
 * `storage_encrypted` - (Optional) Specifies whether the DB cluster is encrypted. The default is `false` for `provisioned` `engine_mode` and `true` for `serverless` `engine_mode`. When restoring an unencrypted `snapshot_identifier`, the `kms_key_id` argument must be provided to encrypt the restored cluster. Terraform will only perform drift detection if a configuration value is provided.
-* `storage_type` - (Optional) (Required for Multi-AZ DB clusters) (Forces new for Multi-AZ DB clusters) Specifies the storage type to be associated with the DB cluster. For Aurora DB clusters, `storage_type` modifications can be done in-place. For Multi-AZ DB Clusters, the `iops` argument must also be set. Valid values are: `""`, `aurora-iopt1` (Aurora DB Clusters); `io1` (Multi-AZ DB Clusters). Default: `""` (Aurora DB Clusters); `io1` (Multi-AZ DB Clusters).
+* `storage_type` - (Optional, Required for Multi-AZ DB cluster) (Forces new for Multi-AZ DB clusters) Specifies the storage type to be associated with the DB cluster. For Aurora DB clusters, `storage_type` modifications can be done in-place. For Multi-AZ DB Clusters, the `iops` argument must also be set. Valid values are: `""`, `aurora-iopt1` (Aurora DB Clusters); `io1` (Multi-AZ DB Clusters). Default: `""` (Aurora DB Clusters); `io1` (Multi-AZ DB Clusters).
 * `tags` - (Optional) A map of tags to assign to the DB cluster. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 * `vpc_security_group_ids` - (Optional) List of VPC security groups to associate with the Cluster
 
@@ -312,7 +320,7 @@ resource "aws_rds_cluster" "example-clone" {
 }
 ```
 
-* `source_cluster_identifier` - (Required) Identifier of the source database cluster from which to restore.
+* `source_cluster_identifier` - (Required) Identifier of the source database cluster from which to restore. When restoring from a cluster in another AWS account, the identifier is the ARN of that cluster.
 * `restore_type` - (Optional) Type of restore to be performed.
    Valid options are `full-copy` (default) and `copy-on-write`.
 * `use_latest_restorable_time` - (Optional) Set to true to restore the database cluster to the latest restorable backup time. Defaults to false. Conflicts with `restore_to_time`.
@@ -366,9 +374,9 @@ resource "aws_rds_cluster" "example" {
 * `max_capacity` - (Required) Maximum capacity for an Aurora DB cluster in `provisioned` DB engine mode. The maximum capacity must be greater than or equal to the minimum capacity. Valid capacity values are in a range of `0.5` up to `128` in steps of `0.5`.
 * `min_capacity` - (Required) Minimum capacity for an Aurora DB cluster in `provisioned` DB engine mode. The minimum capacity must be lesser than or equal to the maximum capacity. Valid capacity values are in a range of `0.5` up to `128` in steps of `0.5`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name (ARN) of cluster
 * `id` - RDS Cluster Identifier
@@ -418,8 +426,17 @@ any cleanup task during the destroying process.
 
 ## Import
 
-RDS Clusters can be imported using the `cluster_identifier`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import RDS Clusters using the `cluster_identifier`. For example:
 
+```terraform
+import {
+  to = aws_rds_cluster.aurora_cluster
+  id = "aurora-prod-cluster"
+}
 ```
-$ terraform import aws_rds_cluster.aurora_cluster aurora-prod-cluster
+
+Using `terraform import`, import RDS Clusters using the `cluster_identifier`. For example:
+
+```console
+% terraform import aws_rds_cluster.aurora_cluster aurora-prod-cluster
 ```
diff --git a/website/docs/r/rds_cluster_activity_stream.html.markdown b/website/docs/r/rds_cluster_activity_stream.html.markdown
index 37f6726de57..8a9f3928cfe 100644
--- a/website/docs/r/rds_cluster_activity_stream.html.markdown
+++ b/website/docs/r/rds_cluster_activity_stream.html.markdown
@@ -56,26 +56,35 @@ resource "aws_rds_cluster_activity_stream" "default" {
 For more detailed documentation about each argument, refer to
 the [AWS official documentation][3].
 
-The following arguments are supported:
+This argument supports the following arguments:
 
 * `resource_arn` - (Required, Forces new resources) The Amazon Resource Name (ARN) of the DB cluster.
 * `mode` - (Required, Forces new resources) Specifies the mode of the database activity stream. Database events such as a change or access generate an activity stream event. The database session can handle these events either synchronously or asynchronously. One of: `sync`, `async`.
 * `kms_key_id` - (Required, Forces new resources) The AWS KMS key identifier for encrypting messages in the database activity stream. The AWS KMS key identifier is the key ARN, key ID, alias ARN, or alias name for the KMS key.
 * `engine_native_audit_fields_included` - (Optional, Forces new resources) Specifies whether the database activity stream includes engine-native audit fields. This option only applies to an Oracle DB instance. By default, no engine-native audit fields are included. Defaults `false`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The Amazon Resource Name (ARN) of the DB cluster.
 * `kinesis_stream_name` - The name of the Amazon Kinesis data stream to be used for the database activity stream.
 
 ## Import
 
-RDS Aurora Cluster Database Activity Streams can be imported using the `resource_arn`, e.g.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import RDS Aurora Cluster Database Activity Streams using the `resource_arn`. For example:
 
+```terraform
+import {
+  to = aws_rds_cluster_activity_stream.default
+  id = "arn:aws:rds:us-west-2:123456789012:cluster:aurora-cluster-demo"
+}
 ```
-$ terraform import aws_rds_cluster_activity_stream.default arn:aws:rds:us-west-2:123456789012:cluster:aurora-cluster-demo
+
+Using `terraform import`, import RDS Aurora Cluster Database Activity Streams using the `resource_arn`. For example:
+
+```console
+% terraform import aws_rds_cluster_activity_stream.default arn:aws:rds:us-west-2:123456789012:cluster:aurora-cluster-demo
 ```
 
 [1]: https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/DBActivityStreams.html
diff --git a/website/docs/r/rds_cluster_endpoint.html.markdown b/website/docs/r/rds_cluster_endpoint.html.markdown
index ae117f6ded3..76770cdb60a 100644
--- a/website/docs/r/rds_cluster_endpoint.html.markdown
+++ b/website/docs/r/rds_cluster_endpoint.html.markdown
@@ -79,7 +79,7 @@ resource "aws_rds_cluster_endpoint" "static" {
 For more detailed documentation about each argument, refer to
 the [AWS official documentation](https://docs.aws.amazon.com/cli/latest/reference/rds/create-db-cluster-endpoint.html).
 
-The following arguments are supported:
+This argument supports the following arguments:
 
 * `cluster_identifier` - (Required, Forces new resources) The cluster identifier.
 * `cluster_endpoint_identifier` - (Required, Forces new resources) The identifier to use for the new endpoint. This parameter is stored as a lowercase string.
@@ -88,9 +88,9 @@ The following arguments are supported:
 * `excluded_members` - (Optional) List of DB instance identifiers that aren't part of the custom endpoint group. All other eligible instances are reachable through the custom endpoint. Only relevant if the list of static members is empty. Conflicts with `static_members`.
 * `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name (ARN) of cluster
 * `id` - The RDS Cluster Endpoint Identifier
@@ -99,10 +99,19 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-RDS Clusters Endpoint can be imported using the `cluster_endpoint_identifier`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import RDS Clusters Endpoint using the `cluster_endpoint_identifier`. For example:
 
+```terraform
+import {
+  to = aws_rds_cluster_endpoint.custom_reader
+  id = "aurora-prod-cluster-custom-reader"
+}
 ```
-$ terraform import aws_rds_cluster_endpoint.custom_reader aurora-prod-cluster-custom-reader
+
+Using `terraform import`, import RDS Clusters Endpoint using the `cluster_endpoint_identifier`. For example:
+
+```console
+% terraform import aws_rds_cluster_endpoint.custom_reader aurora-prod-cluster-custom-reader
 ```
 
 [1]: https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/Aurora.Overview.Endpoints.html#Aurora.Endpoints.Cluster
diff --git a/website/docs/r/rds_cluster_instance.html.markdown b/website/docs/r/rds_cluster_instance.html.markdown
index 6e0c2e6c2a5..77c0cd92feb 100644
--- a/website/docs/r/rds_cluster_instance.html.markdown
+++ b/website/docs/r/rds_cluster_instance.html.markdown
@@ -51,7 +51,7 @@ resource "aws_rds_cluster" "default" {
 For more detailed documentation about each argument, refer to
 the [AWS official documentation](https://docs.aws.amazon.com/cli/latest/reference/rds/create-db-instance.html).
 
-The following arguments are supported:
+This argument supports the following arguments:
 
 * `apply_immediately` - (Optional) Specifies whether any database modifications are applied immediately, or during the next maintenance window. Default is`false`.
 * `auto_minor_version_upgrade` - (Optional) Indicates that minor engine upgrades will be applied automatically to the DB instance during the maintenance window. Default `true`.
@@ -59,6 +59,7 @@ The following arguments are supported:
 * `ca_cert_identifier` - (Optional) Identifier of the CA certificate for the DB instance.
 * `cluster_identifier` - (Required, Forces new resource) Identifier of the [`aws_rds_cluster`](/docs/providers/aws/r/rds_cluster.html) in which to launch this instance.
 * `copy_tags_to_snapshot` – (Optional, boolean) Indicates whether to copy all of the user-defined tags from the DB instance to snapshots of the DB instance. Default `false`.
+* `custom_iam_instance_profile` - (Optional) Instance profile associated with the underlying Amazon EC2 instance of an RDS Custom DB instance.
 * `db_parameter_group_name` - (Optional) Name of the DB parameter group to associate with this instance.
 * `db_subnet_group_name` - (Required if `publicly_accessible = false`, Optional otherwise, Forces new resource) DB subnet group to associate with this DB instance. **NOTE:** This must match the `db_subnet_group_name` of the attached [`aws_rds_cluster`](/docs/providers/aws/r/rds_cluster.html).
 * `engine_version` - (Optional) Database engine version.
@@ -77,9 +78,9 @@ The following arguments are supported:
 * `publicly_accessible` - (Optional) Bool to control if instance is publicly accessible. Default `false`. See the documentation on [Creating DB Instances][6] for more details on controlling this property.
 * `tags` - (Optional) Map of tags to assign to the instance. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name (ARN) of cluster instance
 * `cluster_identifier` - RDS Cluster Identifier
@@ -116,8 +117,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-RDS Cluster Instances can be imported using the `identifier`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import RDS Cluster Instances using the `identifier`. For example:
 
+```terraform
+import {
+  to = aws_rds_cluster_instance.prod_instance_1
+  id = "aurora-cluster-instance-1"
+}
 ```
-$ terraform import aws_rds_cluster_instance.prod_instance_1 aurora-cluster-instance-1
+
+Using `terraform import`, import RDS Cluster Instances using the `identifier`. For example:
+
+```console
+% terraform import aws_rds_cluster_instance.prod_instance_1 aurora-cluster-instance-1
 ```
diff --git a/website/docs/r/rds_cluster_parameter_group.html.markdown b/website/docs/r/rds_cluster_parameter_group.html.markdown
new file mode 100644
index 00000000000..2175efeb194
--- /dev/null
+++ b/website/docs/r/rds_cluster_parameter_group.html.markdown
@@ -0,0 +1,78 @@
+---
+subcategory: "RDS (Relational Database)"
+layout: "aws"
+page_title: "AWS: aws_rds_cluster_parameter_group"
+description: |-
+  Provides an RDS DB cluster parameter group resource.
+---
+
+# Resource: aws_rds_cluster_parameter_group
+
+Provides an RDS DB cluster parameter group resource. Documentation of the available parameters for various Aurora engines can be found at:
+
+* [Aurora MySQL Parameters](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/AuroraMySQL.Reference.html)
+* [Aurora PostgreSQL Parameters](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/AuroraPostgreSQL.Reference.html)
+
+## Example Usage
+
+```terraform
+resource "aws_rds_cluster_parameter_group" "default" {
+  name        = "rds-cluster-pg"
+  family      = "aurora5.6"
+  description = "RDS default cluster parameter group"
+
+  parameter {
+    name  = "character_set_server"
+    value = "utf8"
+  }
+
+  parameter {
+    name  = "character_set_client"
+    value = "utf8"
+  }
+}
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Optional, Forces new resource) The name of the DB cluster parameter group. If omitted, Terraform will assign a random, unique name.
+* `name_prefix` - (Optional, Forces new resource) Creates a unique name beginning with the specified prefix. Conflicts with `name`.
+* `family` - (Required) The family of the DB cluster parameter group.
+* `description` - (Optional) The description of the DB cluster parameter group. Defaults to "Managed by Terraform".
+* `parameter` - (Optional) A list of DB parameters to apply. Note that parameters may differ from a family to an other. Full list of all parameters can be discovered via [`aws rds describe-db-cluster-parameters`](https://docs.aws.amazon.com/cli/latest/reference/rds/describe-db-cluster-parameters.html) after initial creation of the group.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+Parameter blocks support the following:
+
+* `name` - (Required) The name of the DB parameter.
+* `value` - (Required) The value of the DB parameter.
+* `apply_method` - (Optional) "immediate" (default), or "pending-reboot". Some
+    engines can't apply some parameters without a reboot, and you will need to
+    specify "pending-reboot" here.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The db cluster parameter group name.
+* `arn` - The ARN of the db cluster parameter group.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import RDS Cluster Parameter Groups using the `name`. For example:
+
+```terraform
+import {
+  to = aws_rds_cluster_parameter_group.cluster_pg
+  id = "production-pg-1"
+}
+```
+
+Using `terraform import`, import RDS Cluster Parameter Groups using the `name`. For example:
+
+```console
+% terraform import aws_rds_cluster_parameter_group.cluster_pg production-pg-1
+```
diff --git a/website/docs/r/rds_cluster_parameter_group.markdown b/website/docs/r/rds_cluster_parameter_group.markdown
deleted file mode 100644
index 58dff161c4b..00000000000
--- a/website/docs/r/rds_cluster_parameter_group.markdown
+++ /dev/null
@@ -1,69 +0,0 @@
----
-subcategory: "RDS (Relational Database)"
-layout: "aws"
-page_title: "AWS: aws_rds_cluster_parameter_group"
-description: |-
-  Provides an RDS DB cluster parameter group resource.
----
-
-# Resource: aws_rds_cluster_parameter_group
-
-Provides an RDS DB cluster parameter group resource. Documentation of the available parameters for various Aurora engines can be found at:
-
-* [Aurora MySQL Parameters](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/AuroraMySQL.Reference.html)
-* [Aurora PostgreSQL Parameters](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/AuroraPostgreSQL.Reference.html)
-
-## Example Usage
-
-```terraform
-resource "aws_rds_cluster_parameter_group" "default" {
-  name        = "rds-cluster-pg"
-  family      = "aurora5.6"
-  description = "RDS default cluster parameter group"
-
-  parameter {
-    name  = "character_set_server"
-    value = "utf8"
-  }
-
-  parameter {
-    name  = "character_set_client"
-    value = "utf8"
-  }
-}
-```
-
-## Argument Reference
-
-The following arguments are supported:
-
-* `name` - (Optional, Forces new resource) The name of the DB cluster parameter group. If omitted, Terraform will assign a random, unique name.
-* `name_prefix` - (Optional, Forces new resource) Creates a unique name beginning with the specified prefix. Conflicts with `name`.
-* `family` - (Required) The family of the DB cluster parameter group.
-* `description` - (Optional) The description of the DB cluster parameter group. Defaults to "Managed by Terraform".
-* `parameter` - (Optional) A list of DB parameters to apply. Note that parameters may differ from a family to an other. Full list of all parameters can be discovered via [`aws rds describe-db-cluster-parameters`](https://docs.aws.amazon.com/cli/latest/reference/rds/describe-db-cluster-parameters.html) after initial creation of the group.
-* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
-
-Parameter blocks support the following:
-
-* `name` - (Required) The name of the DB parameter.
-* `value` - (Required) The value of the DB parameter.
-* `apply_method` - (Optional) "immediate" (default), or "pending-reboot". Some
-    engines can't apply some parameters without a reboot, and you will need to
-    specify "pending-reboot" here.
-
-## Attributes Reference
-
-In addition to all arguments above, the following attributes are exported:
-
-* `id` - The db cluster parameter group name.
-* `arn` - The ARN of the db cluster parameter group.
-* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
-
-## Import
-
-RDS Cluster Parameter Groups can be imported using the `name`, e.g.,
-
-```
-$ terraform import aws_rds_cluster_parameter_group.cluster_pg production-pg-1
-```
diff --git a/website/docs/r/rds_cluster_role_association.html.markdown b/website/docs/r/rds_cluster_role_association.html.markdown
index f8794f2d504..3cf6d28a8bc 100644
--- a/website/docs/r/rds_cluster_role_association.html.markdown
+++ b/website/docs/r/rds_cluster_role_association.html.markdown
@@ -25,15 +25,15 @@ resource "aws_rds_cluster_role_association" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `db_cluster_identifier` - (Required) DB Cluster Identifier to associate with the IAM Role.
 * `feature_name` - (Required) Name of the feature for association. This can be found in the AWS documentation relevant to the integration or a full list is available in the `SupportedFeatureNames` list returned by [AWS CLI rds describe-db-engine-versions](https://docs.aws.amazon.com/cli/latest/reference/rds/describe-db-engine-versions.html).
 * `role_arn` - (Required) Amazon Resource Name (ARN) of the IAM Role to associate with the DB Cluster.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - DB Cluster Identifier and IAM Role ARN separated by a comma (`,`)
 
@@ -46,8 +46,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_rds_cluster_role_association` can be imported using the DB Cluster Identifier and IAM Role ARN separated by a comma (`,`), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_rds_cluster_role_association` using the DB Cluster Identifier and IAM Role ARN separated by a comma (`,`). For example:
 
+```terraform
+import {
+  to = aws_rds_cluster_role_association.example
+  id = "my-db-cluster,arn:aws:iam::123456789012:role/my-role"
+}
 ```
-$ terraform import aws_rds_cluster_role_association.example my-db-cluster,arn:aws:iam::123456789012:role/my-role
+
+Using `terraform import`, import `aws_rds_cluster_role_association` using the DB Cluster Identifier and IAM Role ARN separated by a comma (`,`). For example:
+
+```console
+% terraform import aws_rds_cluster_role_association.example my-db-cluster,arn:aws:iam::123456789012:role/my-role
 ```
diff --git a/website/docs/r/rds_custom_db_engine_version.markdown b/website/docs/r/rds_custom_db_engine_version.markdown
new file mode 100644
index 00000000000..4755742e54e
--- /dev/null
+++ b/website/docs/r/rds_custom_db_engine_version.markdown
@@ -0,0 +1,144 @@
+---
+subcategory: "RDS (Relational Database)"
+layout: "aws"
+page_title: "AWS: aws_rds_custom_db_engine_version"
+description: |-
+  Provides an custom engine version (CEV) resource for Amazon RDS Custom.
+---
+
+# Resource: aws_rds_custom_db_engine_version
+
+Provides an custom engine version (CEV) resource for Amazon RDS Custom. For additional information, see [Working with CEVs for RDS Custom for Oracle](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/custom-cev.html) and [Working with CEVs for RDS Custom for SQL Server](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/custom-cev-sqlserver.html) in the the [RDS User Guide](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Welcome.html).
+
+## Example Usage
+
+### RDS Custom for Oracle Usage
+
+```terraform
+resource "aws_kms_key" "example" {
+  description = "KMS symmetric key for RDS Custom for Oracle"
+}
+
+resource "aws_rds_custom_db_engine_version" "example" {
+  database_installation_files_s3_bucket_name = "DOC-EXAMPLE-BUCKET"
+  database_installation_files_s3_prefix      = "1915_GI/"
+  engine                                     = "custom-oracle-ee-cdb"
+  engine_version                             = "19.cdb_cev1"
+  kms_key_id                                 = aws_kms_key.example.arn
+  manifest                                   = <<JSON
+  {
+	"databaseInstallationFileNames":["V982063-01.zip"]
+  }
+  JSON
+
+  tags = {
+    Name = "example"
+    Key  = "value"
+  }
+}
+```
+
+### RDS Custom for Oracle External Manifest Usage
+
+```terraform
+resource "aws_kms_key" "example" {
+  description = "KMS symmetric key for RDS Custom for Oracle"
+}
+
+resource "aws_rds_custom_db_engine_version" "example" {
+  database_installation_files_s3_bucket_name = "DOC-EXAMPLE-BUCKET"
+  database_installation_files_s3_prefix      = "1915_GI/"
+  engine                                     = "custom-oracle-ee-cdb"
+  engine_version                             = "19.cdb_cev1"
+  kms_key_id                                 = aws_kms_key.example.arn
+  filename                                   = "manifest_1915_GI.json"
+  manifest_hash                              = filebase64sha256(manifest_1915_GI.json)
+
+  tags = {
+    Name = "example"
+    Key  = "value"
+  }
+}
+```
+
+### RDS Custom for SQL Server Usage
+
+```terraform
+# CEV creation requires an AMI owned by the operator
+resource "aws_rds_custom_db_engine_version" "test" {
+  engine          = "custom-sqlserver-se"
+  engine_version  = "15.00.4249.2.cev-1"
+  source_image_id = "ami-0aa12345678a12ab1"
+}
+```
+
+### RDS Custom for SQL Server Usage with AMI from another region
+
+```terraform
+resource "aws_ami_copy" "example" {
+  name              = "sqlserver-se-2019-15.00.4249.2"
+  description       = "A copy of ami-xxxxxxxx"
+  source_ami_id     = "ami-xxxxxxxx"
+  source_ami_region = "us-east-1"
+}
+# CEV creation requires an AMI owned by the operator
+resource "aws_rds_custom_db_engine_version" "test" {
+  engine          = "custom-sqlserver-se"
+  engine_version  = "15.00.4249.2.cev-1"
+  source_image_id = aws_ami_copy.example.id
+}
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `database_installation_files_s3_bucket_name` - (Required) The name of the Amazon S3 bucket that contains the database installation files.
+* `database_installation_files_s3_prefix` - (Required) The prefix for the Amazon S3 bucket that contains the database installation files.
+* `description` - (Optional) The description of the CEV.
+* `engine` - (Required) The name of the database engine. Valid values are `custom-oracle*`, `custom-sqlserver*`.
+* `engine_version` - (Required) The version of the database engine.
+* `filename` - (Optional) The name of the manifest file within the local filesystem. Conflicts with `manifest`.
+* `kms_key_id` - (Optional) The ARN of the AWS KMS key that is used to encrypt the database installation files. Required for RDS Custom for Oracle.
+* `manifest` - (Optional) The manifest file, in JSON format, that contains the list of database installation files. Conflicts with `filename`.
+* `manifest_hash` - (Optional) Used to trigger updates. Must be set to a base64-encoded SHA256 hash of the manifest source specified with `filename`. The usual way to set this is filebase64sha256("manifest.json") where "manifest.json" is the local filename of the manifest source.
+* `status` - (Optional) The status of the CEV. Valid values are `available`, `inactive`, `inactive-except-restore`.
+* `source_image_id` - (Optional) The ID of the AMI to create the CEV from. Required for RDS Custom for SQL Server. For RDS Custom for Oracle, you can specify an AMI ID that was used in a different Oracle CEV.
+* `tags` - (Optional) A mapping of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) for the custom engine version.
+* `create_time` - The date and time that the CEV was created.
+* `db_parameter_group_family` - The name of the DB parameter group family for the CEV.
+* `image_id` - The ID of the AMI that was created with the CEV.
+* `major_engine_version` - The major version of the database engine.
+* `manifest_computed` - The returned manifest file, in JSON format, service generated and often different from input `manifest`.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `240m`)
+- `update` - (Default `10m`)
+- `delete` - (Default `60m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import custom engine versions for Amazon RDS custom using the `engine` and `engine_version` separated by a colon (`:`). For example:
+
+```terraform
+import {
+  to = aws_rds_custom_db_engine_version.example
+  id = "custom-oracle-ee-cdb:19.cdb_cev1"
+}
+```
+
+Using `terraform import`, import custom engine versions for Amazon RDS custom using the `engine` and `engine_version` separated by a colon (`:`). For example:
+
+```console
+% terraform import aws_rds_custom_db_engine_version.example custom-oracle-ee-cdb:19.cdb_cev1
+```
diff --git a/website/docs/r/rds_export_task.html.markdown b/website/docs/r/rds_export_task.html.markdown
index a775e6aafd8..8f56fd0a2e9 100644
--- a/website/docs/r/rds_export_task.html.markdown
+++ b/website/docs/r/rds_export_task.html.markdown
@@ -144,9 +144,9 @@ The following arguments are optional:
 * `export_only` - (Optional) Data to be exported from the snapshot. If this parameter is not provided, all the snapshot data is exported. Valid values are documented in the [AWS StartExportTask API documentation](https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_StartExportTask.html#API_StartExportTask_RequestParameters).
 * `s3_prefix` - (Optional) Amazon S3 bucket prefix to use as the file name and path of the exported snapshot.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `failure_cause` - Reason the export failed, if it failed.
 * `id` - Unique identifier for the snapshot export task (same value as `export_task_identifier`).
@@ -160,8 +160,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-A RDS (Relational Database) Export Task can be imported using the `export_task_identifier`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import a RDS (Relational Database) Export Task using the `export_task_identifier`. For example:
 
+```terraform
+import {
+  to = aws_rds_export_task.example
+  id = "example"
+}
 ```
-$ terraform import aws_rds_export_task.example example
+
+Using `terraform import`, import a RDS (Relational Database) Export Task using the `export_task_identifier`. For example:
+
+```console
+% terraform import aws_rds_export_task.example example
 ```
diff --git a/website/docs/r/rds_global_cluster.html.markdown b/website/docs/r/rds_global_cluster.html.markdown
index aa2b2874e3d..eaf790883db 100644
--- a/website/docs/r/rds_global_cluster.html.markdown
+++ b/website/docs/r/rds_global_cluster.html.markdown
@@ -200,7 +200,7 @@ resource "aws_rds_cluster_instance" "primary" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `global_cluster_identifier` - (Required, Forces new resources) Global cluster identifier.
 * `database_name` - (Optional, Forces new resources) Name for an automatically created database on cluster creation.
@@ -211,9 +211,9 @@ The following arguments are supported:
 * `source_db_cluster_identifier` - (Optional) Amazon Resource Name (ARN) to use as the primary DB Cluster of the Global Cluster on creation. Terraform cannot perform drift detection of this value.
 * `storage_encrypted` - (Optional, Forces new resources) Specifies whether the DB cluster is encrypted. The default is `false` unless `source_db_cluster_identifier` is specified and encrypted. Terraform will only perform drift detection if a configuration value is provided.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - RDS Global Cluster Amazon Resource Name (ARN)
 * `global_cluster_members` - Set of objects containing Global Cluster members.
@@ -232,15 +232,24 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_rds_global_cluster` can be imported by using the RDS Global Cluster identifier, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_rds_global_cluster` using the RDS Global Cluster identifier. For example:
 
+```terraform
+import {
+  to = aws_rds_global_cluster.example
+  id = "example"
+}
 ```
-$ terraform import aws_rds_global_cluster.example example
+
+Using `terraform import`, import `aws_rds_global_cluster` using the RDS Global Cluster identifier. For example:
+
+```console
+% terraform import aws_rds_global_cluster.example example
 ```
 
 Certain resource arguments, like `force_destroy`, only exist within Terraform. If the argument is set in the Terraform configuration on an imported resource, Terraform will show a difference on the first plan after import to update the state value. This change is safe to apply immediately so the state matches the desired configuration.
 
-Certain resource arguments, like `source_db_cluster_identifier`, do not have an API method for reading the information after creation. If the argument is set in the Terraform configuration on an imported resource, Terraform will always show a difference. To workaround this behavior, either omit the argument from the Terraform configuration or use [`ignore_changes`](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html#ignore_changes) to hide the difference, e.g.,
+Certain resource arguments, like `source_db_cluster_identifier`, do not have an API method for reading the information after creation. If the argument is set in the Terraform configuration on an imported resource, Terraform will always show a difference. To workaround this behavior, either omit the argument from the Terraform configuration or use [`ignore_changes`](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html#ignore_changes) to hide the difference. For example:
 
 ```terraform
 resource "aws_rds_global_cluster" "example" {
diff --git a/website/docs/r/rds_reserved_instance.html.markdown b/website/docs/r/rds_reserved_instance.html.markdown
index 1890772cc48..f956fc86a7f 100644
--- a/website/docs/r/rds_reserved_instance.html.markdown
+++ b/website/docs/r/rds_reserved_instance.html.markdown
@@ -44,9 +44,9 @@ The following arguments are optional:
 * `reservation_id` - (Optional) Customer-specified identifier to track this reservation.
 * `tags` - (Optional) Map of tags to assign to the DB reservation. If configured with a provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN for the reserved DB instance.
 * `id` - Unique identifier for the reservation. same as `reservation_id`.
@@ -74,8 +74,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-RDS DB Instance Reservations can be imported using the `instance_id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import RDS DB Instance Reservations using the `instance_id`. For example:
 
+```terraform
+import {
+  to = aws_rds_reserved_instance.reservation_instance
+  id = "CustomReservationID"
+}
 ```
-$ terraform import aws_rds_reserved_instance.reservation_instance CustomReservationID
+
+Using `terraform import`, import RDS DB Instance Reservations using the `instance_id`. For example:
+
+```console
+% terraform import aws_rds_reserved_instance.reservation_instance CustomReservationID
 ```
diff --git a/website/docs/r/redshift_authentication_profile.html.markdown b/website/docs/r/redshift_authentication_profile.html.markdown
index 573542dc0b0..ba6dd7b52f6 100644
--- a/website/docs/r/redshift_authentication_profile.html.markdown
+++ b/website/docs/r/redshift_authentication_profile.html.markdown
@@ -27,21 +27,30 @@ resource "aws_redshift_authentication_profile" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `authentication_profile_name` - (Required, Forces new resource) The name of the authentication profile.
 * `authentication_profile_content` - (Required) The content of the authentication profile in JSON format. The maximum length of the JSON string is determined by a quota for your account.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The name of the authentication profile.
 
 ## Import
 
-Redshift Authentication Profiles support import by `authentication_profile_name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Redshift Authentication by `authentication_profile_name`. For example:
+
+```terraform
+import {
+  to = aws_redshift_authentication_profile.test
+  id = "example"
+}
+```
+
+Using `terraform import`, import Redshift Authentication by `authentication_profile_name`. For example:
 
 ```console
-$ terraform import aws_redshift_authentication_profile.test example
+% terraform import aws_redshift_authentication_profile.test example
 ```
diff --git a/website/docs/r/redshift_cluster.html.markdown b/website/docs/r/redshift_cluster.html.markdown
index d482e5ad3bb..65c0decab38 100644
--- a/website/docs/r/redshift_cluster.html.markdown
+++ b/website/docs/r/redshift_cluster.html.markdown
@@ -33,7 +33,7 @@ resource "aws_redshift_cluster" "example" {
 For more detailed documentation about each argument, refer to
 the [AWS official documentation](http://docs.aws.amazon.com/cli/latest/reference/redshift/index.html#cli-aws-redshift).
 
-The following arguments are supported:
+This argument supports the following arguments:
 
 * `cluster_identifier` - (Required) The Cluster Identifier. Must be a lower case string.
 * `database_name` - (Optional) The name of the first database to be created when the cluster is created.
@@ -99,9 +99,9 @@ For more information on the permissions required for the bucket, please read the
 * `retention_period` - (Optional) The number of days to retain automated snapshots in the destination region after they are copied from the source region. Defaults to `7`.
 * `grant_name` - (Optional) The name of the snapshot copy grant to use when snapshots of an AWS KMS-encrypted cluster are copied to the destination region.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name (ARN) of cluster
 * `id` - The Redshift Cluster ID.
@@ -142,8 +142,17 @@ Cluster nodes (for `cluster_nodes`) support the following attributes:
 
 ## Import
 
-Redshift Clusters can be imported using the `cluster_identifier`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Redshift Clusters using the `cluster_identifier`. For example:
 
+```terraform
+import {
+  to = aws_redshift_cluster.myprodcluster
+  id = "tf-redshift-cluster-12345"
+}
 ```
-$ terraform import aws_redshift_cluster.myprodcluster tf-redshift-cluster-12345
+
+Using `terraform import`, import Redshift Clusters using the `cluster_identifier`. For example:
+
+```console
+% terraform import aws_redshift_cluster.myprodcluster tf-redshift-cluster-12345
 ```
diff --git a/website/docs/r/redshift_cluster_iam_roles.html.markdown b/website/docs/r/redshift_cluster_iam_roles.html.markdown
index f50a08ae953..8fcbbacd091 100644
--- a/website/docs/r/redshift_cluster_iam_roles.html.markdown
+++ b/website/docs/r/redshift_cluster_iam_roles.html.markdown
@@ -23,22 +23,31 @@ resource "aws_redshift_cluster_iam_roles" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `cluster_identifier` - (Required) The name of the Redshift Cluster IAM Roles.
 * `iam_role_arns` - (Optional) A list of IAM Role ARNs to associate with the cluster. A Maximum of 10 can be associated to the cluster at any time.
 * `default_iam_role_arn` - (Optional) The Amazon Resource Name (ARN) for the IAM role that was set as default for the cluster when the cluster was created.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The Redshift Cluster ID.
 
 ## Import
 
-Redshift Cluster IAM Roless can be imported using the `cluster_identifier`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Redshift Cluster IAM Roless using the `cluster_identifier`. For example:
 
+```terraform
+import {
+  to = aws_redshift_cluster_iam_roles.examplegroup1
+  id = "example"
+}
 ```
-$ terraform import aws_redshift_cluster_iam_roles.examplegroup1 example
+
+Using `terraform import`, import Redshift Cluster IAM Roless using the `cluster_identifier`. For example:
+
+```console
+% terraform import aws_redshift_cluster_iam_roles.examplegroup1 example
 ```
diff --git a/website/docs/r/redshift_cluster_snapshot.html.markdown b/website/docs/r/redshift_cluster_snapshot.html.markdown
index 58a13452a1f..5edf1585881 100644
--- a/website/docs/r/redshift_cluster_snapshot.html.markdown
+++ b/website/docs/r/redshift_cluster_snapshot.html.markdown
@@ -27,16 +27,16 @@ resource "aws_redshift_cluster_snapshot" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `cluster_identifier` - (Required, Forces new resource) The cluster identifier for which you want a snapshot.
 * `snapshot_identifier` - (Required, Forces new resource) A unique identifier for the snapshot that you are requesting. This identifier must be unique for all snapshots within the Amazon Web Services account.
 * `manual_snapshot_retention_period` - (Optional) The number of days that a manual snapshot is retained. If the value is `-1`, the manual snapshot is retained indefinitely. Valid values are -1 and between `1` and `3653`.
 * `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name (ARN) of the snapshot.
 * `id` - A unique identifier for the snapshot that you are requesting. This identifiermust be unique for all snapshots within the Amazon Web Services account.
@@ -46,8 +46,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Redshift Cluster Snapshots support import by `snapshot_identifier`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Redshift Cluster Snapshots using `snapshot_identifier`. For example:
+
+```terraform
+import {
+  to = aws_redshift_cluster_snapshot.test
+  id = "example"
+}
+```
+
+Using `terraform import`, import Redshift Cluster Snapshots using `snapshot_identifier`. For example:
 
 ```console
-$ terraform import aws_redshift_cluster_snapshot.test example
+% terraform import aws_redshift_cluster_snapshot.test example
 ```
diff --git a/website/docs/r/redshift_endpoint_access.html.markdown b/website/docs/r/redshift_endpoint_access.html.markdown
index 15937c9015e..0ab7cfc7d36 100644
--- a/website/docs/r/redshift_endpoint_access.html.markdown
+++ b/website/docs/r/redshift_endpoint_access.html.markdown
@@ -22,7 +22,7 @@ resource "aws_redshift_endpoint_access" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `cluster_identifier` - (Required) The cluster identifier of the cluster to access.
 * `endpoint_name` - (Required) The Redshift-managed VPC endpoint name.
@@ -30,9 +30,9 @@ The following arguments are supported:
 * `subnet_group_name` - (Required) The subnet group from which Amazon Redshift chooses the subnet to deploy the endpoint.
 * `vpc_security_group_ids` - (Optional) The security group that defines the ports, protocols, and sources for inbound traffic that you are authorizing into your endpoint.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `address` - The DNS address of the endpoint.
 * `id` - The Redshift-managed VPC endpoint name.
@@ -54,8 +54,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Redshift endpoint access can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Redshift endpoint access using the `name`. For example:
 
+```terraform
+import {
+  to = aws_redshift_endpoint_access.example
+  id = "example"
+}
 ```
-$ terraform import aws_redshift_endpoint_access.example example
+
+Using `terraform import`, import Redshift endpoint access using the `name`. For example:
+
+```console
+% terraform import aws_redshift_endpoint_access.example example
 ```
diff --git a/website/docs/r/redshift_endpoint_authorization.html.markdown b/website/docs/r/redshift_endpoint_authorization.html.markdown
index 5a0144bf00f..9f0bd6863ea 100644
--- a/website/docs/r/redshift_endpoint_authorization.html.markdown
+++ b/website/docs/r/redshift_endpoint_authorization.html.markdown
@@ -21,16 +21,16 @@ resource "aws_redshift_endpoint_authorization" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `account` - (Required) The Amazon Web Services account ID to grant access to.
 * `cluster_identifier` - (Required) The cluster identifier of the cluster to grant access to.
 * `force_delete` - (Optional) Indicates whether to force the revoke action. If true, the Redshift-managed VPC endpoints associated with the endpoint authorization are also deleted. Default value is `false`.
 * `vpc_ids` - (Optional) The virtual private cloud (VPC) identifiers to grant access to. If none are specified all VPCs in shared account are allowed.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `allowed_all_vpcs` - Indicates whether all VPCs in the grantee account are allowed access to the cluster.
 * `id` - The identifier of the Redshift Endpoint Authorization, `account`, and `cluster_identifier` separated by a colon (`:`).
@@ -40,8 +40,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Redshift endpoint authorization can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Redshift endpoint authorization using the `id`. For example:
 
+```terraform
+import {
+  to = aws_redshift_endpoint_authorization.example
+  id = "01234567910:cluster-example-id"
+}
 ```
-$ terraform import aws_redshift_endpoint_authorization.example 01234567910:cluster-example-id
+
+Using `terraform import`, import Redshift endpoint authorization using the `id`. For example:
+
+```console
+% terraform import aws_redshift_endpoint_authorization.example 01234567910:cluster-example-id
 ```
diff --git a/website/docs/r/redshift_event_subscription.html.markdown b/website/docs/r/redshift_event_subscription.html.markdown
index 81737b767d6..271088cfccf 100644
--- a/website/docs/r/redshift_event_subscription.html.markdown
+++ b/website/docs/r/redshift_event_subscription.html.markdown
@@ -48,7 +48,7 @@ resource "aws_redshift_event_subscription" "default" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The name of the Redshift event subscription.
 * `sns_topic_arn` - (Required) The ARN of the SNS topic to send events to.
@@ -59,9 +59,9 @@ The following arguments are supported:
 * `enabled` - (Optional) A boolean flag to enable/disable the subscription. Defaults to `true`.
 * `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name (ARN) of the Redshift event notification subscription
 * `id` - The name of the Redshift event notification subscription
@@ -70,8 +70,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Redshift Event Subscriptions can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Redshift Event Subscriptions using the `name`. For example:
 
+```terraform
+import {
+  to = aws_redshift_event_subscription.default
+  id = "redshift-event-sub"
+}
 ```
-$ terraform import aws_redshift_event_subscription.default redshift-event-sub
+
+Using `terraform import`, import Redshift Event Subscriptions using the `name`. For example:
+
+```console
+% terraform import aws_redshift_event_subscription.default redshift-event-sub
 ```
diff --git a/website/docs/r/redshift_hsm_client_certificate.html.markdown b/website/docs/r/redshift_hsm_client_certificate.html.markdown
index aeec042c00b..8b60d6515a2 100644
--- a/website/docs/r/redshift_hsm_client_certificate.html.markdown
+++ b/website/docs/r/redshift_hsm_client_certificate.html.markdown
@@ -20,14 +20,14 @@ resource "aws_redshift_hsm_client_certificate" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `hsm_client_certificate_identifier` - (Required, Forces new resource) The identifier of the HSM client certificate.
 * `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name (ARN) of the Hsm Client Certificate.
 * `hsm_client_certificate_public_key` - The public key that the Amazon Redshift cluster will use to connect to the HSM. You must register the public key in the HSM.
@@ -35,8 +35,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Redshift Hsm Client Certificates support import by `hsm_client_certificate_identifier`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Redshift HSM Client Certificates using `hsm_client_certificate_identifier`. For example:
+
+```terraform
+import {
+  to = aws_redshift_hsm_client_certificate.test
+  id = "example"
+}
+```
+
+Using `terraform import`, import Redshift HSM Client Certificates using `hsm_client_certificate_identifier`. For example:
 
 ```console
-$ terraform import aws_redshift_hsm_client_certificate.test example
+% terraform import aws_redshift_hsm_client_certificate.test example
 ```
diff --git a/website/docs/r/redshift_hsm_configuration.html.markdown b/website/docs/r/redshift_hsm_configuration.html.markdown
index 9dad09e642d..5dd6d7e213a 100644
--- a/website/docs/r/redshift_hsm_configuration.html.markdown
+++ b/website/docs/r/redshift_hsm_configuration.html.markdown
@@ -25,7 +25,7 @@ resource "aws_redshift_hsm_configuration" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `description` - (Required, Forces new resource) A text description of the HSM configuration to be created.
 * `hsm_configuration_identifier` - (Required, Forces new resource) The identifier to be assigned to the new Amazon Redshift HSM configuration.
@@ -35,9 +35,9 @@ The following arguments are supported:
 * `hsm_server_public_certificate` - (Required, Forces new resource) The HSMs public certificate file. When using Cloud HSM, the file name is server.pem.
 * `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name (ARN) of the Hsm Client Certificate.
 * `hsm_configuration_public_key` - The public key that the Amazon Redshift cluster will use to connect to the HSM. You must register the public key in the HSM.
@@ -45,8 +45,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Redshift Hsm Client Certificates support import by `hsm_configuration_identifier`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Redshift HSM Client Certificates using `hsm_configuration_identifier`. For example:
+
+```terraform
+import {
+  to = aws_redshift_hsm_configuration.test
+  id = "example"
+}
+```
+
+Using `terraform import`, import Redshift HSM Client Certificates using `hsm_configuration_identifier`. For example:
 
 ```console
-$ terraform import aws_redshift_hsm_configuration.example example
+% terraform import aws_redshift_hsm_configuration.example example
 ```
diff --git a/website/docs/r/redshift_parameter_group.html.markdown b/website/docs/r/redshift_parameter_group.html.markdown
index bfc7169e693..236c6006d5b 100644
--- a/website/docs/r/redshift_parameter_group.html.markdown
+++ b/website/docs/r/redshift_parameter_group.html.markdown
@@ -36,7 +36,7 @@ resource "aws_redshift_parameter_group" "bar" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The name of the Redshift parameter group.
 * `family` - (Required) The family of the Redshift parameter group.
@@ -51,9 +51,9 @@ Parameter blocks support the following:
 
 You can read more about the parameters that Redshift supports in the [documentation](http://docs.aws.amazon.com/redshift/latest/mgmt/working-with-parameter-groups.html)
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name (ARN) of parameter group
 * `id` - The Redshift parameter group name.
@@ -61,8 +61,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Redshift Parameter Groups can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Redshift Parameter Groups using the `name`. For example:
 
+```terraform
+import {
+  to = aws_redshift_parameter_group.paramgroup1
+  id = "parameter-group-test-terraform"
+}
 ```
-$ terraform import aws_redshift_parameter_group.paramgroup1 parameter-group-test-terraform
+
+Using `terraform import`, import Redshift Parameter Groups using the `name`. For example:
+
+```console
+% terraform import aws_redshift_parameter_group.paramgroup1 parameter-group-test-terraform
 ```
diff --git a/website/docs/r/redshift_partner.html.markdown b/website/docs/r/redshift_partner.html.markdown
index a9f12ab1587..935ef550c64 100644
--- a/website/docs/r/redshift_partner.html.markdown
+++ b/website/docs/r/redshift_partner.html.markdown
@@ -23,16 +23,16 @@ resource "aws_redshift_partner" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `account_id` - (Required) The Amazon Web Services account ID that owns the cluster.
 * `cluster_identifier` - (Required) The cluster identifier of the cluster that receives data from the partner.
 * `database_name` - (Required) The name of the database that receives data from the partner.
 * `partner_name` - (Required) The name of the partner that is authorized to send data.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The identifier of the Redshift partner, `account_id`, `cluster_identifier`, `database_name`, `partner_name` separated by a colon (`:`).
 * `status` - (Optional) The partner integration status.
@@ -40,8 +40,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Redshift usage limits can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Redshift usage limits using the `id`. For example:
 
+```terraform
+import {
+  to = aws_redshift_partner.example
+  id = "01234567910:cluster-example-id:example:example"
+}
 ```
-$ terraform import aws_redshift_partner.example 01234567910:cluster-example-id:example:example
+
+Using `terraform import`, import Redshift usage limits using the `id`. For example:
+
+```console
+% terraform import aws_redshift_partner.example 01234567910:cluster-example-id:example:example
 ```
diff --git a/website/docs/r/redshift_scheduled_action.html.markdown b/website/docs/r/redshift_scheduled_action.html.markdown
index 493f8fe3d95..7e51ba8806a 100644
--- a/website/docs/r/redshift_scheduled_action.html.markdown
+++ b/website/docs/r/redshift_scheduled_action.html.markdown
@@ -89,7 +89,7 @@ resource "aws_redshift_scheduled_action" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The scheduled action name.
 * `description` - (Optional) The description of the scheduled action.
@@ -124,16 +124,25 @@ The following arguments are supported:
 
 * `cluster_identifier` - (Required) The identifier of the cluster to be resumed.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The Redshift Scheduled Action name.
 
 ## Import
 
-Redshift Scheduled Action can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Redshift Scheduled Action using the `name`. For example:
 
+```terraform
+import {
+  to = aws_redshift_scheduled_action.example
+  id = "tf-redshift-scheduled-action"
+}
 ```
-$ terraform import aws_redshift_scheduled_action.example tf-redshift-scheduled-action
+
+Using `terraform import`, import Redshift Scheduled Action using the `name`. For example:
+
+```console
+% terraform import aws_redshift_scheduled_action.example tf-redshift-scheduled-action
 ```
diff --git a/website/docs/r/redshift_snapshot_copy_grant.html.markdown b/website/docs/r/redshift_snapshot_copy_grant.html.markdown
index 5f814bf0a2d..8d1163afb98 100644
--- a/website/docs/r/redshift_snapshot_copy_grant.html.markdown
+++ b/website/docs/r/redshift_snapshot_copy_grant.html.markdown
@@ -30,23 +30,32 @@ resource "aws_redshift_cluster" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `snapshot_copy_grant_name` - (Required, Forces new resource) A friendly name for identifying the grant.
 * `kms_key_id` - (Optional, Forces new resource) The unique identifier for the customer master key (CMK) that the grant applies to. Specify the key ID or the Amazon Resource Name (ARN) of the CMK. To specify a CMK in a different AWS account, you must use the key ARN. If not specified, the default key is used.
 * `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name (ARN) of snapshot copy grant
 * `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
 
 ## Import
 
-Redshift Snapshot Copy Grants support import by name, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Redshift Snapshot Copy Grants by name. For example:
+
+```terraform
+import {
+  to = aws_redshift_snapshot_copy_grant.test
+  id = "my-grant"
+}
+```
+
+Using `terraform import`, import Redshift Snapshot Copy Grants by name. For example:
 
 ```console
-$ terraform import aws_redshift_snapshot_copy_grant.test my-grant
+% terraform import aws_redshift_snapshot_copy_grant.test my-grant
 ```
diff --git a/website/docs/r/redshift_snapshot_schedule.html.markdown b/website/docs/r/redshift_snapshot_schedule.html.markdown
index f952b5ecb11..3e5b16ee362 100644
--- a/website/docs/r/redshift_snapshot_schedule.html.markdown
+++ b/website/docs/r/redshift_snapshot_schedule.html.markdown
@@ -21,7 +21,7 @@ resource "aws_redshift_snapshot_schedule" "default" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `identifier` - (Optional, Forces new resource) The snapshot schedule identifier. If omitted, Terraform will assign a random, unique identifier.
 * `identifier_prefix` - (Optional, Forces new resource) Creates a unique
@@ -31,17 +31,26 @@ identifier beginning with the specified prefix. Conflicts with `identifier`.
 * `force_destroy` - (Optional) Whether to destroy all associated clusters with this snapshot schedule on deletion. Must be enabled and applied before attempting deletion.
 * `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name (ARN) of the Redshift Snapshot Schedule.
 * `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
 
 ## Import
 
-Redshift Snapshot Schedule can be imported using the `identifier`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Redshift Snapshot Schedule using the `identifier`. For example:
 
+```terraform
+import {
+  to = aws_redshift_snapshot_schedule.default
+  id = "tf-redshift-snapshot-schedule"
+}
 ```
-$ terraform import aws_redshift_snapshot_schedule.default tf-redshift-snapshot-schedule
+
+Using `terraform import`, import Redshift Snapshot Schedule using the `identifier`. For example:
+
+```console
+% terraform import aws_redshift_snapshot_schedule.default tf-redshift-snapshot-schedule
 ```
diff --git a/website/docs/r/redshift_snapshot_schedule_association.html.markdown b/website/docs/r/redshift_snapshot_schedule_association.html.markdown
index 63dbb1ce37b..880d51e13c2 100644
--- a/website/docs/r/redshift_snapshot_schedule_association.html.markdown
+++ b/website/docs/r/redshift_snapshot_schedule_association.html.markdown
@@ -35,19 +35,28 @@ resource "aws_redshift_snapshot_schedule_association" "default" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `cluster_identifier` - (Required, Forces new resource) The cluster identifier.
 * `schedule_identifier` - (Required, Forces new resource) The snapshot schedule identifier.
 
-## Attributes Reference
+## Attribute Reference
 
-No additional attributes are exported.
+This resource exports no additional attributes.
 
 ## Import
 
-Redshift Snapshot Schedule Association can be imported using the `<cluster-identifier>/<schedule-identifier>`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Redshift Snapshot Schedule Association using the `<cluster-identifier>/<schedule-identifier>`. For example:
 
+```terraform
+import {
+  to = aws_redshift_snapshot_schedule_association.default
+  id = "tf-redshift-cluster/tf-redshift-snapshot-schedule"
+}
 ```
-$ terraform import aws_redshift_snapshot_schedule_association.default tf-redshift-cluster/tf-redshift-snapshot-schedule
+
+Using `terraform import`, import Redshift Snapshot Schedule Association using the `<cluster-identifier>/<schedule-identifier>`. For example:
+
+```console
+% terraform import aws_redshift_snapshot_schedule_association.default tf-redshift-cluster/tf-redshift-snapshot-schedule
 ```
diff --git a/website/docs/r/redshift_subnet_group.html.markdown b/website/docs/r/redshift_subnet_group.html.markdown
index 04e95c387bb..6aad2495f1b 100644
--- a/website/docs/r/redshift_subnet_group.html.markdown
+++ b/website/docs/r/redshift_subnet_group.html.markdown
@@ -49,16 +49,16 @@ resource "aws_redshift_subnet_group" "foo" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The name of the Redshift Subnet group.
 * `description` - (Optional) The description of the Redshift Subnet group. Defaults to "Managed by Terraform".
 * `subnet_ids` - (Required) An array of VPC subnet IDs.
 * `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name (ARN) of the Redshift Subnet group name
 * `id` - The Redshift Subnet group ID.
@@ -66,8 +66,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Redshift subnet groups can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Redshift subnet groups using the `name`. For example:
 
+```terraform
+import {
+  to = aws_redshift_subnet_group.testgroup1
+  id = "test-cluster-subnet-group"
+}
 ```
-$ terraform import aws_redshift_subnet_group.testgroup1 test-cluster-subnet-group
+
+Using `terraform import`, import Redshift subnet groups using the `name`. For example:
+
+```console
+% terraform import aws_redshift_subnet_group.testgroup1 test-cluster-subnet-group
 ```
diff --git a/website/docs/r/redshift_usage_limit.html.markdown b/website/docs/r/redshift_usage_limit.html.markdown
index 77efb2c0af4..a3957b8f5e7 100644
--- a/website/docs/r/redshift_usage_limit.html.markdown
+++ b/website/docs/r/redshift_usage_limit.html.markdown
@@ -23,7 +23,7 @@ resource "aws_redshift_usage_limit" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `amount` - (Required) The limit amount. If time-based, this amount is in minutes. If data-based, this amount is in terabytes (TB). The value must be a positive number.
 * `breach_action` - (Optional) The action that Amazon Redshift takes when the limit is reached. The default is `log`. Valid values are `log`, `emit-metric`, and `disable`.
@@ -33,9 +33,9 @@ The following arguments are supported:
 * `period` - (Optional) The time period that the amount applies to. A weekly period begins on Sunday. The default is `monthly`. Valid values are `daily`, `weekly`, and `monthly`.
 * `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name (ARN) of the Redshift Usage Limit.
 * `id` - The Redshift Usage Limit ID.
@@ -43,8 +43,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Redshift usage limits can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Redshift usage limits using the `id`. For example:
 
+```terraform
+import {
+  to = aws_redshift_usage_limit.example
+  id = "example-id"
+}
 ```
-$ terraform import aws_redshift_usage_limit.example example-id
+
+Using `terraform import`, import Redshift usage limits using the `id`. For example:
+
+```console
+% terraform import aws_redshift_usage_limit.example example-id
 ```
diff --git a/website/docs/r/redshiftdata_statement.html.markdown b/website/docs/r/redshiftdata_statement.html.markdown
index 3c97f05b819..e16f496f327 100644
--- a/website/docs/r/redshiftdata_statement.html.markdown
+++ b/website/docs/r/redshiftdata_statement.html.markdown
@@ -49,16 +49,25 @@ The following arguments are optional:
 * `with_event` - (Optional) A value that indicates whether to send an event to the Amazon EventBridge event bus after the SQL statement runs.
 * `workgroup_name` - (Optional) The serverless workgroup name. This parameter is required when connecting to a serverless workgroup and authenticating using either Secrets Manager or temporary credentials.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The Redshift Data Statement ID.
 
 ## Import
 
-Redshift Data Statements can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Redshift Data Statements using the `id`. For example:
 
+```terraform
+import {
+  to = aws_redshiftdata_statement.example
+  id = "example"
+}
 ```
-$ terraform import aws_redshiftdata_statement.example example
+
+Using `terraform import`, import Redshift Data Statements using the `id`. For example:
+
+```console
+% terraform import aws_redshiftdata_statement.example example
 ```
diff --git a/website/docs/r/redshiftserverless_endpoint_access.html.markdown b/website/docs/r/redshiftserverless_endpoint_access.html.markdown
index cc7872bd588..fc15d45150c 100644
--- a/website/docs/r/redshiftserverless_endpoint_access.html.markdown
+++ b/website/docs/r/redshiftserverless_endpoint_access.html.markdown
@@ -21,16 +21,16 @@ resource "aws_redshiftserverless_endpoint_access" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `endpoint_name` - (Required) The name of the endpoint.
 * `subnet_ids` - (Required) An array of VPC subnet IDs to associate with the endpoint.
 * `vpc_security_group_ids` - (Optional) An array of security group IDs to associate with the workgroup.
 * `workgroup_name` - (Required) The name of the workgroup.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name (ARN) of the Redshift Serverless Endpoint Access.
 * `id` - The Redshift Endpoint Access Name.
@@ -53,8 +53,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Redshift Serverless Endpoint Access can be imported using the `endpoint_name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Redshift Serverless Endpoint Access using the `endpoint_name`. For example:
 
+```terraform
+import {
+  to = aws_redshiftserverless_endpoint_access.example
+  id = "example"
+}
 ```
-$ terraform import aws_redshiftserverless_endpoint_access.example example
+
+Using `terraform import`, import Redshift Serverless Endpoint Access using the `endpoint_name`. For example:
+
+```console
+% terraform import aws_redshiftserverless_endpoint_access.example example
 ```
diff --git a/website/docs/r/redshiftserverless_namespace.html.markdown b/website/docs/r/redshiftserverless_namespace.html.markdown
index 9e0f51b8437..e2b6e628efd 100644
--- a/website/docs/r/redshiftserverless_namespace.html.markdown
+++ b/website/docs/r/redshiftserverless_namespace.html.markdown
@@ -20,7 +20,7 @@ resource "aws_redshiftserverless_namespace" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `admin_user_password` - (Optional) The password of the administrator for the first database created in the namespace.
 * `admin_username` - (Optional) The username of the administrator for the first database created in the namespace.
@@ -32,9 +32,9 @@ The following arguments are supported:
 * `namespace_name` - (Required) The name of the namespace.
 * `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name (ARN) of the Redshift Serverless Namespace.
 * `id` - The Redshift Namespace Name.
@@ -43,8 +43,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Redshift Serverless Namespaces can be imported using the `namespace_name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Redshift Serverless Namespaces using the `namespace_name`. For example:
 
+```terraform
+import {
+  to = aws_redshiftserverless_namespace.example
+  id = "example"
+}
 ```
-$ terraform import aws_redshiftserverless_namespace.example example
+
+Using `terraform import`, import Redshift Serverless Namespaces using the `namespace_name`. For example:
+
+```console
+% terraform import aws_redshiftserverless_namespace.example example
 ```
diff --git a/website/docs/r/redshiftserverless_resource_policy.html.markdown b/website/docs/r/redshiftserverless_resource_policy.html.markdown
index 486c380e70e..fe0b6a4f9b7 100644
--- a/website/docs/r/redshiftserverless_resource_policy.html.markdown
+++ b/website/docs/r/redshiftserverless_resource_policy.html.markdown
@@ -33,21 +33,30 @@ resource "aws_redshiftserverless_resource_policy" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `resource_arn` - (Required) The Amazon Resource Name (ARN) of the account to create or update a resource policy for.
 * `policy` - (Required) The policy to create or update. For example, the following policy grants a user authorization to restore a snapshot.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The Amazon Resource Name (ARN) of the account to create or update a resource policy for.
 
 ## Import
 
-Redshift Serverless Resource Policies can be imported using the `resource_arn`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Redshift Serverless Resource Policies using the `resource_arn`. For example:
 
+```terraform
+import {
+  to = aws_redshiftserverless_resource_policy.example
+  id = "example"
+}
 ```
-$ terraform import aws_redshiftserverless_resource_policy.example example
+
+Using `terraform import`, import Redshift Serverless Resource Policies using the `resource_arn`. For example:
+
+```console
+% terraform import aws_redshiftserverless_resource_policy.example example
 ```
diff --git a/website/docs/r/redshiftserverless_snapshot.html.markdown b/website/docs/r/redshiftserverless_snapshot.html.markdown
index b0b70522a2e..1a15c121947 100644
--- a/website/docs/r/redshiftserverless_snapshot.html.markdown
+++ b/website/docs/r/redshiftserverless_snapshot.html.markdown
@@ -21,15 +21,15 @@ resource "aws_redshiftserverless_snapshot" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `namespace_name` - (Required) The namespace to create a snapshot for.
 * `snapshot_name` - (Required) The name of the snapshot.
 * `retention_period` - (Optional) How long to retain the created snapshot. Default value is `-1`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `accounts_with_provisioned_restore_access` - All of the Amazon Web Services accounts that have access to restore a snapshot to a provisioned cluster.
 * `accounts_with_restore_access` - All of the Amazon Web Services accounts that have access to restore a snapshot to a namespace.
@@ -42,8 +42,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Redshift Serverless Snapshots can be imported using the `snapshot_name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Redshift Serverless Snapshots using the `snapshot_name`. For example:
 
+```terraform
+import {
+  to = aws_redshiftserverless_snapshot.example
+  id = "example"
+}
 ```
-$ terraform import aws_redshiftserverless_snapshot.example example
+
+Using `terraform import`, import Redshift Serverless Snapshots using the `snapshot_name`. For example:
+
+```console
+% terraform import aws_redshiftserverless_snapshot.example example
 ```
diff --git a/website/docs/r/redshiftserverless_usage_limit.html.markdown b/website/docs/r/redshiftserverless_usage_limit.html.markdown
index 0a0e8b3a41c..7756314cf80 100644
--- a/website/docs/r/redshiftserverless_usage_limit.html.markdown
+++ b/website/docs/r/redshiftserverless_usage_limit.html.markdown
@@ -27,7 +27,7 @@ resource "aws_redshiftserverless_usage_limit" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `amount` - (Required) The limit amount. If time-based, this amount is in Redshift Processing Units (RPU) consumed per hour. If data-based, this amount is in terabytes (TB) of data transferred between Regions in cross-account sharing. The value must be a positive number.
 * `breach_action` - (Optional) The action that Amazon Redshift Serverless takes when the limit is reached. Valid values are `log`, `emit-metric`, and `deactivate`. The default is `log`.
@@ -35,17 +35,26 @@ The following arguments are supported:
 * `resource_arn` - (Required) The Amazon Resource Name (ARN) of the Amazon Redshift Serverless resource to create the usage limit for.
 * `usage_type` - (Required) The type of Amazon Redshift Serverless usage to create a usage limit for. Valid values are `serverless-compute` or `cross-region-datasharing`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name (ARN) of the Redshift Serverless Usage Limit.
 * `id` - The Redshift Usage Limit id.
 
 ## Import
 
-Redshift Serverless Usage Limits can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Redshift Serverless Usage Limits using the `id`. For example:
 
+```terraform
+import {
+  to = aws_redshiftserverless_usage_limit.example
+  id = "example-id"
+}
 ```
-$ terraform import aws_redshiftserverless_usage_limit.example example-id
+
+Using `terraform import`, import Redshift Serverless Usage Limits using the `id`. For example:
+
+```console
+% terraform import aws_redshiftserverless_usage_limit.example example-id
 ```
diff --git a/website/docs/r/redshiftserverless_workgroup.html.markdown b/website/docs/r/redshiftserverless_workgroup.html.markdown
index b3d25d43a49..778c09933f8 100644
--- a/website/docs/r/redshiftserverless_workgroup.html.markdown
+++ b/website/docs/r/redshiftserverless_workgroup.html.markdown
@@ -38,12 +38,12 @@ The following arguments are optional:
 
 ### Config Parameter
 
-* `parameter_key` - (Required) The key of the parameter. The options are `auto_mv`, `datestyle`, `enable_case_sensitive_identifier`, `enable_user_activity_logging`, `query_group`, `search_path` and [query monitoring metrics](https://docs.aws.amazon.com/redshift/latest/dg/cm-c-wlm-query-monitoring-rules.html#cm-c-wlm-query-monitoring-metrics-serverless) that let you define performance boundaries: `max_query_cpu_time`, `max_query_blocks_read`, `max_scan_row_count`, `max_query_execution_time`, `max_query_queue_time`, `max_query_cpu_usage_percent`, `max_query_temp_blocks_to_disk`, `max_join_row_count` and `max_nested_loop_join_row_count`.
+* `parameter_key` - (Required) The key of the parameter. The options are `auto_mv`, `datestyle`, `enable_case_sensitive_identifier`, `enable_user_activity_logging`, `query_group`, `search_path`, `require_ssl`, `use_fips_ssl`, and [query monitoring metrics](https://docs.aws.amazon.com/redshift/latest/dg/cm-c-wlm-query-monitoring-rules.html#cm-c-wlm-query-monitoring-metrics-serverless) that let you define performance boundaries: `max_query_cpu_time`, `max_query_blocks_read`, `max_scan_row_count`, `max_query_execution_time`, `max_query_queue_time`, `max_query_cpu_usage_percent`, `max_query_temp_blocks_to_disk`, `max_join_row_count` and `max_nested_loop_join_row_count`.
 * `parameter_value` - (Required) The value of the parameter to set.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name (ARN) of the Redshift Serverless Workgroup.
 * `id` - The Redshift Workgroup Name.
@@ -80,8 +80,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Redshift Serverless Workgroups can be imported using the `workgroup_name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Redshift Serverless Workgroups using the `workgroup_name`. For example:
 
+```terraform
+import {
+  to = aws_redshiftserverless_workgroup.example
+  id = "example"
+}
 ```
-$ terraform import aws_redshiftserverless_workgroup.example example
+
+Using `terraform import`, import Redshift Serverless Workgroups using the `workgroup_name`. For example:
+
+```console
+% terraform import aws_redshiftserverless_workgroup.example example
 ```
diff --git a/website/docs/r/resourceexplorer2_index.html.markdown b/website/docs/r/resourceexplorer2_index.html.markdown
index 8c22e91aecf..9ded645fd2e 100644
--- a/website/docs/r/resourceexplorer2_index.html.markdown
+++ b/website/docs/r/resourceexplorer2_index.html.markdown
@@ -20,7 +20,7 @@ resource "aws_resourceexplorer2_index" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `type` - (Required) The type of the index. Valid values: `AGGREGATOR`, `LOCAL`. To understand the difference between `LOCAL` and `AGGREGATOR`, see the [_AWS Resource Explorer User Guide_](https://docs.aws.amazon.com/resource-explorer/latest/userguide/manage-aggregator-region.html).
 * `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
@@ -33,17 +33,26 @@ The following arguments are supported:
 - `update` - (Default `2h`)
 - `delete` - (Default `10m`)
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name (ARN) of the Resource Explorer index.
 * `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
 
 ## Import
 
-Resource Explorer indexes can be imported using the `arn`, e.g.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Resource Explorer indexes using the `arn`. For example:
 
+```terraform
+import {
+  to = aws_resourceexplorer2_index.example
+  id = "arn:aws:resource-explorer-2:us-east-1:123456789012:index/6047ac4e-207e-4487-9bcf-cb53bb0ff5cc"
+}
 ```
-$ terraform import aws_resourceexplorer2_index.example arn:aws:resource-explorer-2:us-east-1:123456789012:index/6047ac4e-207e-4487-9bcf-cb53bb0ff5cc
+
+Using `terraform import`, import Resource Explorer indexes using the `arn`. For example:
+
+```console
+% terraform import aws_resourceexplorer2_index.example arn:aws:resource-explorer-2:us-east-1:123456789012:index/6047ac4e-207e-4487-9bcf-cb53bb0ff5cc
 ```
diff --git a/website/docs/r/resourceexplorer2_view.html.markdown b/website/docs/r/resourceexplorer2_view.html.markdown
index 70cba460939..5897289eec9 100644
--- a/website/docs/r/resourceexplorer2_view.html.markdown
+++ b/website/docs/r/resourceexplorer2_view.html.markdown
@@ -34,7 +34,7 @@ resource "aws_resourceexplorer2_view" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `default_view` - (Optional) Specifies whether the view is the [_default view_](https://docs.aws.amazon.com/resource-explorer/latest/userguide/manage-views-about.html#manage-views-about-default) for the AWS Region. Default: `false`.
 * `filters` - (Optional) Specifies which resources are included in the results of queries made using this view. See [Filters](#filters) below for more details.
@@ -54,17 +54,26 @@ The `included_property` block supports the following:
 
 * `name` - (Required) The name of the property that is included in this view. Valid values: `tags`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name (ARN) of the Resource Explorer view.
 * `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
 
 ## Import
 
-Resource Explorer views can be imported using the `arn`, e.g.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Resource Explorer views using the `arn`. For example:
 
+```terraform
+import {
+  to = aws_resourceexplorer2_view.example
+  id = "arn:aws:resource-explorer-2:us-west-2:123456789012:view/exampleview/e0914f6c-6c27-4b47-b5d4-6b28381a2421"
+}
 ```
-$ terraform import aws_resourceexplorer2_view.example arn:aws:resource-explorer-2:us-west-2:123456789012:view/exampleview/e0914f6c-6c27-4b47-b5d4-6b28381a2421
+
+Using `terraform import`, import Resource Explorer views using the `arn`. For example:
+
+```console
+% terraform import aws_resourceexplorer2_view.example arn:aws:resource-explorer-2:us-west-2:123456789012:view/exampleview/e0914f6c-6c27-4b47-b5d4-6b28381a2421
 ```
diff --git a/website/docs/r/resourcegroups_group.html.markdown b/website/docs/r/resourcegroups_group.html.markdown
index 7f7c3071037..0f35f84beac 100644
--- a/website/docs/r/resourcegroups_group.html.markdown
+++ b/website/docs/r/resourcegroups_group.html.markdown
@@ -36,7 +36,7 @@ JSON
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The resource group's name. A resource group name can have a maximum of 127 characters, including letters, numbers, hyphens, dots, and underscores. The name cannot start with `AWS` or `aws`.
 * `configuration` - (Optional) A configuration associates the resource group with an AWS service and specifies how the service can interact with the resources in the group. See below for details.
@@ -59,17 +59,26 @@ The `parameters` block supports the following arguments:
 * `name` - (Required) The name of the group configuration parameter.
 * `values` - (Optional) The value or values to be used for the specified parameter.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The ARN assigned by AWS for this resource group.
 * `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
 
 ## Import
 
-Resource groups can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import resource groups using the `name`. For example:
 
+```terraform
+import {
+  to = aws_resourcegroups_group.foo
+  id = "resource-group-name"
+}
 ```
-$ terraform import aws_resourcegroups_group.foo resource-group-name
+
+Using `terraform import`, import resource groups using the `name`. For example:
+
+```console
+% terraform import aws_resourcegroups_group.foo resource-group-name
 ```
diff --git a/website/docs/r/resourcegroups_resource.html.markdown b/website/docs/r/resourcegroups_resource.html.markdown
index e881d18d187..541df395673 100644
--- a/website/docs/r/resourcegroups_resource.html.markdown
+++ b/website/docs/r/resourcegroups_resource.html.markdown
@@ -43,9 +43,9 @@ The following arguments are optional:
 
 * `resource_arn` - (Required) The ARN of the resource to be added to the group.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `resource_type` - The resource type of a resource, such as `AWS::EC2::Instance`.
 
diff --git a/website/docs/r/rolesanywhere_profile.html.markdown b/website/docs/r/rolesanywhere_profile.html.markdown
index 311997b58f3..a9a723d432d 100644
--- a/website/docs/r/rolesanywhere_profile.html.markdown
+++ b/website/docs/r/rolesanywhere_profile.html.markdown
@@ -43,7 +43,7 @@ resource "aws_rolesanywhere_profile" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `duration_seconds` - (Optional) The number of seconds the vended session credentials are valid for. Defaults to 3600.
 * `enabled` - (Optional) Whether or not the Profile is enabled.
@@ -54,9 +54,9 @@ The following arguments are supported:
 * `session_policy` - (Optional) A session policy that applies to the trust boundary of the vended session credentials.
 * `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name (ARN) of the Profile
 * `id` - The Profile ID.
@@ -64,8 +64,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_rolesanywhere_profile` can be imported using its `id`, e.g.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_rolesanywhere_profile` using its `id`. For example:
 
+```terraform
+import {
+  to = aws_rolesanywhere_profile.example
+  id = "db138a85-8925-4f9f-a409-08231233cacf"
+}
 ```
-$ terraform import aws_rolesanywhere_profile.example db138a85-8925-4f9f-a409-08231233cacf
+
+Using `terraform import`, import `aws_rolesanywhere_profile` using its `id`. For example:
+
+```console
+% terraform import aws_rolesanywhere_profile.example db138a85-8925-4f9f-a409-08231233cacf
 ```
diff --git a/website/docs/r/rolesanywhere_trust_anchor.html.markdown b/website/docs/r/rolesanywhere_trust_anchor.html.markdown
index a5289b39a51..ca93f65444a 100644
--- a/website/docs/r/rolesanywhere_trust_anchor.html.markdown
+++ b/website/docs/r/rolesanywhere_trust_anchor.html.markdown
@@ -61,7 +61,7 @@ resource "aws_rolesanywhere_trust_anchor" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `enabled` - (Optional) Whether or not the Trust Anchor should be enabled.
 * `name` - (Required) The name of the Trust Anchor.
@@ -80,9 +80,9 @@ The following arguments are supported:
 * `acm_pca_arn` - (Optional, required when `source_type` is `AWS_ACM_PCA`) The ARN of an ACM Private Certificate Authority.
 * `x509_certificate_data` - (Optional, required when `source_type` is `CERTIFICATE_BUNDLE`)
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name (ARN) of the Trust Anchor
 * `id` - The Trust Anchor ID.
@@ -90,8 +90,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_rolesanywhere_trust_anchor` can be imported using its `id`, e.g.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_rolesanywhere_trust_anchor` using its `id`. For example:
 
+```terraform
+import {
+  to = aws_rolesanywhere_trust_anchor.example
+  id = "92b2fbbb-984d-41a3-a765-e3cbdb69ebb1"
+}
 ```
-$ terraform import aws_rolesanywhere_trust_anchor.example 92b2fbbb-984d-41a3-a765-e3cbdb69ebb1
+
+Using `terraform import`, import `aws_rolesanywhere_trust_anchor` using its `id`. For example:
+
+```console
+% terraform import aws_rolesanywhere_trust_anchor.example 92b2fbbb-984d-41a3-a765-e3cbdb69ebb1
 ```
diff --git a/website/docs/r/route.html.markdown b/website/docs/r/route.html.markdown
index 7dd9326d0b6..b4a52a098e1 100644
--- a/website/docs/r/route.html.markdown
+++ b/website/docs/r/route.html.markdown
@@ -46,7 +46,7 @@ resource "aws_route" "r" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `route_table_id` - (Required) The ID of the routing table.
 
@@ -71,9 +71,9 @@ One of the following target arguments must be supplied:
 
 Note that the default route, mapping the VPC's CIDR block to "local", is created implicitly and cannot be specified.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 ~> **NOTE:** Only the arguments that are configured (one of the above) will be exported as an attribute once the resource is created.
 
@@ -93,22 +93,51 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Individual routes can be imported using `ROUTETABLEID_DESTINATION`.
-[Local routes](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Route_Tables.html#RouteTables) can be imported using the VPC's IPv4 or IPv6 CIDR blocks.
-For example, import a route in route table `rtb-656C65616E6F72` with an IPv4 destination CIDR of `10.42.0.0/16` like this:
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import individual routes using `ROUTETABLEID_DESTINATION`. Import [local routes](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Route_Tables.html#RouteTables) using the VPC's IPv4 or IPv6 CIDR blocks. For example:
+
+Import a route in route table `rtb-656C65616E6F72` with an IPv4 destination CIDR of `10.42.0.0/16`:
+
+```terraform
+import {
+  to = aws_route.my_route
+  id = "rtb-656C65616E6F72_10.42.0.0/16"
+}
+```
+
+Import a route in route table `rtb-656C65616E6F72` with an IPv6 destination CIDR of `2620:0:2d0:200::8/125`:
+
+```terraform
+import {
+  to = aws_route.my_route
+  id = "rtb-656C65616E6F72_2620:0:2d0:200::8/125"
+}
+```
+
+Import a route in route table `rtb-656C65616E6F72` with a managed prefix list destination of `pl-0570a1d2d725c16be`:
+
+```terraform
+import {
+  to = aws_route.my_route
+  id = "rtb-656C65616E6F72_pl-0570a1d2d725c16be"
+}
+```
+
+**Using `terraform import` to import** individual routes using `ROUTETABLEID_DESTINATION`. Import [local routes](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Route_Tables.html#RouteTables) using the VPC's IPv4 or IPv6 CIDR blocks. For example:
+
+Import a route in route table `rtb-656C65616E6F72` with an IPv4 destination CIDR of `10.42.0.0/16`:
 
 ```console
-$ terraform import aws_route.my_route rtb-656C65616E6F72_10.42.0.0/16
+% terraform import aws_route.my_route rtb-656C65616E6F72_10.42.0.0/16
 ```
 
-Import a route in route table `rtb-656C65616E6F72` with an IPv6 destination CIDR of `2620:0:2d0:200::8/125` similarly:
+Import a route in route table `rtb-656C65616E6F72` with an IPv6 destination CIDR of `2620:0:2d0:200::8/125`:
 
 ```console
-$ terraform import aws_route.my_route rtb-656C65616E6F72_2620:0:2d0:200::8/125
+% terraform import aws_route.my_route rtb-656C65616E6F72_2620:0:2d0:200::8/125
 ```
 
-Import a route in route table `rtb-656C65616E6F72` with a managed prefix list destination of `pl-0570a1d2d725c16be` similarly:
+Import a route in route table `rtb-656C65616E6F72` with a managed prefix list destination of `pl-0570a1d2d725c16be`:
 
 ```console
-$ terraform import aws_route.my_route rtb-656C65616E6F72_pl-0570a1d2d725c16be
+% terraform import aws_route.my_route rtb-656C65616E6F72_pl-0570a1d2d725c16be
 ```
diff --git a/website/docs/r/route53_cidr_collection.html.markdown b/website/docs/r/route53_cidr_collection.html.markdown
index e7488a8efbd..4ec0f17ee8b 100644
--- a/website/docs/r/route53_cidr_collection.html.markdown
+++ b/website/docs/r/route53_cidr_collection.html.markdown
@@ -20,13 +20,13 @@ resource "aws_route53_cidr_collection" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) Unique name for the CIDR collection.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The Amazon Resource Name (ARN) of the CIDR collection.
 * `id` - The CIDR collection ID.
@@ -34,8 +34,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-CIDR collections can be imported using their ID, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CIDR collections using their ID. For example:
 
+```terraform
+import {
+  to = aws_route53_cidr_collection.example
+  id = "9ac32814-3e67-0932-6048-8d779cc6f511"
+}
 ```
-$ terraform import aws_route53_cidr_collection.example 9ac32814-3e67-0932-6048-8d779cc6f511
+
+Using `terraform import`, import CIDR collections using their ID. For example:
+
+```console
+% terraform import aws_route53_cidr_collection.example 9ac32814-3e67-0932-6048-8d779cc6f511
 ```
diff --git a/website/docs/r/route53_cidr_location.html.markdown b/website/docs/r/route53_cidr_location.html.markdown
index 70ba3493417..7ad71dde52e 100644
--- a/website/docs/r/route53_cidr_location.html.markdown
+++ b/website/docs/r/route53_cidr_location.html.markdown
@@ -26,22 +26,31 @@ resource "aws_route53_cidr_location" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `cidr_blocks` - (Required) CIDR blocks for the location.
 * `cidr_collection_id` - (Required) The ID of the CIDR collection to update.
 * `name` - (Required) Name for the CIDR location.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The CIDR location ID.
 
 ## Import
 
-CIDR locations can be imported using their the CIDR collection ID and location name, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CIDR locations using their the CIDR collection ID and location name. For example:
 
+```terraform
+import {
+  to = aws_route53_cidr_location.example
+  id = "9ac32814-3e67-0932-6048-8d779cc6f511,office"
+}
 ```
-$ terraform import aws_route53_cidr_location.example 9ac32814-3e67-0932-6048-8d779cc6f511,office
+
+Using `terraform import`, import CIDR locations using their the CIDR collection ID and location name. For example:
+
+```console
+% terraform import aws_route53_cidr_location.example 9ac32814-3e67-0932-6048-8d779cc6f511,office
 ```
diff --git a/website/docs/r/route53_delegation_set.html.markdown b/website/docs/r/route53_delegation_set.html.markdown
index 3b5a3936812..5a6d109b29c 100644
--- a/website/docs/r/route53_delegation_set.html.markdown
+++ b/website/docs/r/route53_delegation_set.html.markdown
@@ -30,14 +30,14 @@ resource "aws_route53_zone" "secondary" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `reference_name` - (Optional) This is a reference name used in Caller Reference
   (helpful for identifying single delegation set amongst others)
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The Amazon Resource Name (ARN) of the Delegation Set.
 * `id` - The delegation set ID
@@ -46,8 +46,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Route53 Delegation Sets can be imported using the `delegation set id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Route53 Delegation Sets using the delegation set `id`. For example:
 
+```terraform
+import {
+  to = aws_route53_delegation_set.set1
+  id = "N1PA6795SAMPLE"
+}
 ```
-$ terraform import aws_route53_delegation_set.set1 N1PA6795SAMPLE
+
+Using `terraform import`, import Route53 Delegation Sets using the delegation set `id`. For example:
+
+```console
+% terraform import aws_route53_delegation_set.set1 N1PA6795SAMPLE
 ```
diff --git a/website/docs/r/route53_health_check.html.markdown b/website/docs/r/route53_health_check.html.markdown
index 9d26efce621..e5e638914e5 100644
--- a/website/docs/r/route53_health_check.html.markdown
+++ b/website/docs/r/route53_health_check.html.markdown
@@ -81,7 +81,7 @@ resource "aws_route53_health_check" "foo" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 ~> **Note:** At least one of either `fqdn` or `ip_address` must be specified.
 
@@ -113,9 +113,9 @@ The following arguments are supported:
 * `routing_control_arn` - (Optional) The Amazon Resource Name (ARN) for the Route 53 Application Recovery Controller routing control. This is used when health check type is `RECOVERY_CONTROL`
 * `tags` - (Optional) A map of tags to assign to the health check. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The Amazon Resource Name (ARN) of the Health Check.
 * `id` - The id of the health check
@@ -123,8 +123,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Route53 Health Checks can be imported using the `health check id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Route53 Health Checks using the health check `id`. For example:
 
+```terraform
+import {
+  to = aws_route53_health_check.http_check
+  id = "abcdef11-2222-3333-4444-555555fedcba"
+}
 ```
-$ terraform import aws_route53_health_check.http_check abcdef11-2222-3333-4444-555555fedcba
+
+Using `terraform import`, import Route53 Health Checks using the health check `id`. For example:
+
+```console
+% terraform import aws_route53_health_check.http_check abcdef11-2222-3333-4444-555555fedcba
 ```
diff --git a/website/docs/r/route53_hosted_zone_dnssec.html.markdown b/website/docs/r/route53_hosted_zone_dnssec.html.markdown
index 7fc2b38d110..3968f0b1bed 100644
--- a/website/docs/r/route53_hosted_zone_dnssec.html.markdown
+++ b/website/docs/r/route53_hosted_zone_dnssec.html.markdown
@@ -12,6 +12,8 @@ Manages Route 53 Hosted Zone Domain Name System Security Extensions (DNSSEC). Fo
 
 !> **WARNING:** If you disable DNSSEC signing for your hosted zone before the DNS changes have propagated, your domain could become unavailable on the internet. When you remove the DS records, you must wait until the longest TTL for the DS records that you remove has expired before you complete the step to disable DNSSEC signing. Please refer to the [Route 53 Developer Guide - Disable DNSSEC](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/dns-configuring-dnssec-disable.html) for a detailed breakdown on the steps required to disable DNSSEC safely for a hosted zone.
 
+~> **Note:** Route53 hosted zones are global resources, and as such any `aws_kms_key` that you use as part of a signing key needs to be located in the `us-east-1` region. In the example below, the main AWS provider declaration is for `us-east-1`, however if you are provisioning your AWS resources in a different region, you will need to specify a provider alias and use that attached to the `aws_kms_key` resource as described in the [provider alias documentation](https://developer.hashicorp.com/terraform/language/providers/configuration#alias-multiple-provider-configurations).
+
 ## Example Usage
 
 ```terraform
@@ -83,16 +85,25 @@ The following arguments are optional:
 
 * `signing_status` - (Optional) Hosted Zone signing status. Valid values: `SIGNING`, `NOT_SIGNING`. Defaults to `SIGNING`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Route 53 Hosted Zone identifier.
 
 ## Import
 
-`aws_route53_hosted_zone_dnssec` resources can be imported by using the Route 53 Hosted Zone identifier, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_route53_hosted_zone_dnssec` resources using the Route 53 Hosted Zone identifier. For example:
 
+```terraform
+import {
+  to = aws_route53_hosted_zone_dnssec.example
+  id = "Z1D633PJN98FT9"
+}
 ```
-$ terraform import aws_route53_hosted_zone_dnssec.example Z1D633PJN98FT9
+
+Using `terraform import`, import `aws_route53_hosted_zone_dnssec` resources using the Route 53 Hosted Zone identifier. For example:
+
+```console
+% terraform import aws_route53_hosted_zone_dnssec.example Z1D633PJN98FT9
 ```
diff --git a/website/docs/r/route53_key_signing_key.html.markdown b/website/docs/r/route53_key_signing_key.html.markdown
index 7abcdde934b..c308ded5965 100644
--- a/website/docs/r/route53_key_signing_key.html.markdown
+++ b/website/docs/r/route53_key_signing_key.html.markdown
@@ -104,9 +104,9 @@ The following arguments are optional:
 
 * `status` - (Optional) Status of the key-signing key (KSK). Valid values: `ACTIVE`, `INACTIVE`. Defaults to `ACTIVE`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `digest_algorithm_mnemonic` - A string used to represent the delegation signer digest algorithm. This value must follow the guidelines provided by [RFC-8624 Section 3.3](https://tools.ietf.org/html/rfc8624#section-3.3).
 * `digest_algorithm_type` - An integer used to represent the delegation signer digest algorithm. This value must follow the guidelines provided by [RFC-8624 Section 3.3](https://tools.ietf.org/html/rfc8624#section-3.3).
@@ -122,8 +122,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_route53_key_signing_key` resources can be imported by using the Route 53 Hosted Zone identifier and KMS Key identifier, separated by a comma (`,`), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_route53_key_signing_key` resources using the Route 53 Hosted Zone identifier and KMS Key identifier, separated by a comma (`,`). For example:
 
+```terraform
+import {
+  to = aws_route53_key_signing_key.example
+  id = "Z1D633PJN98FT9,example"
+}
 ```
-$ terraform import aws_route53_key_signing_key.example Z1D633PJN98FT9,example
+
+Using `terraform import`, import `aws_route53_key_signing_key` resources using the Route 53 Hosted Zone identifier and KMS Key identifier, separated by a comma (`,`). For example:
+
+```console
+% terraform import aws_route53_key_signing_key.example Z1D633PJN98FT9,example
 ```
diff --git a/website/docs/r/route53_query_log.html.markdown b/website/docs/r/route53_query_log.html.markdown
index 85aca2f88f2..aa956f45c93 100644
--- a/website/docs/r/route53_query_log.html.markdown
+++ b/website/docs/r/route53_query_log.html.markdown
@@ -75,22 +75,31 @@ resource "aws_route53_query_log" "example_com" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `cloudwatch_log_group_arn` - (Required) CloudWatch log group ARN to send query logs.
 * `zone_id` - (Required) Route53 hosted zone ID to enable query logs.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The Amazon Resource Name (ARN) of the Query Logging Config.
 * `id` - The query logging configuration ID
 
 ## Import
 
-Route53 query logging configurations can be imported using their ID, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Route53 query logging configurations using their ID. For example:
 
+```terraform
+import {
+  to = aws_route53_query_log.example_com
+  id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
+}
 ```
-$ terraform import aws_route53_query_log.example_com xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
+
+Using `terraform import`, import Route53 query logging configurations using their ID. For example:
+
+```console
+% terraform import aws_route53_query_log.example_com xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
 ```
diff --git a/website/docs/r/route53_record.html.markdown b/website/docs/r/route53_record.html.markdown
index 98697a6f623..d2ca93da0d1 100644
--- a/website/docs/r/route53_record.html.markdown
+++ b/website/docs/r/route53_record.html.markdown
@@ -119,7 +119,7 @@ resource "aws_route53_record" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `zone_id` - (Required) The ID of the hosted zone to contain this record.
 * `name` - (Required) The name of the record.
@@ -181,23 +181,45 @@ Weighted routing policies support the following:
 
 * `weight` - (Required) A numeric value indicating the relative weight of the record. See http://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-policy.html#routing-policy-weighted.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `name` - The name of the record.
 * `fqdn` - [FQDN](https://en.wikipedia.org/wiki/Fully_qualified_domain_name) built using the zone domain and `name`.
 
 ## Import
 
-Route53 Records can be imported using ID of the record, which is the zone identifier, record name, and record type, separated by underscores (`_`)E.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Route53 Records using the ID of the record, record name, record type, and set identifier. For example:
 
+Using the ID of the record, which is the zone identifier, record name, and record type, separated by underscores (`_`):
+
+```terraform
+import {
+  to = aws_route53_record.myrecord
+  id = "Z4KAPRWWNC7JR_dev.example.com_NS"
+}
 ```
-$ terraform import aws_route53_record.myrecord Z4KAPRWWNC7JR_dev.example.com_NS
+
+If the record also contains a set identifier, append it:
+
+```terraform
+import {
+  to = aws_route53_record.myrecord
+  id = "Z4KAPRWWNC7JR_dev.example.com_NS_dev"
+}
 ```
 
-If the record also contains a set identifier, it should be appended:
+**Using `terraform import` to import** Route53 Records using the ID of the record, record name, record type, and set identifier. For example:
+
+Using the ID of the record, which is the zone identifier, record name, and record type, separated by underscores (`_`):
 
+```console
+% terraform import aws_route53_record.myrecord Z4KAPRWWNC7JR_dev.example.com_NS
 ```
-$ terraform import aws_route53_record.myrecord Z4KAPRWWNC7JR_dev.example.com_NS_dev
+
+If the record also contains a set identifier, append it:
+
+```console
+% terraform import aws_route53_record.myrecord Z4KAPRWWNC7JR_dev.example.com_NS_dev
 ```
diff --git a/website/docs/r/route53_resolver_config.html.markdown b/website/docs/r/route53_resolver_config.html.markdown
index e7ebc3fc9fd..74afb3fc16d 100644
--- a/website/docs/r/route53_resolver_config.html.markdown
+++ b/website/docs/r/route53_resolver_config.html.markdown
@@ -27,22 +27,31 @@ resource "aws_route53_resolver_config" "example" {
 
 ## Argument Reference
 
-The following argument is supported:
+This resource supports the following arguments:
 
 * `resource_id` - (Required) The ID of the VPC that the configuration is for.
 * `autodefined_reverse_flag` - (Required) Indicates whether or not the Resolver will create autodefined rules for reverse DNS lookups. Valid values: `ENABLE`, `DISABLE`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the resolver configuration.
 * `owner_id` - The AWS account ID of the owner of the VPC that this resolver configuration applies to.
 
 ## Import
 
-Route 53 Resolver configs can be imported using the Route 53 Resolver config ID, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Route 53 Resolver configs using the Route 53 Resolver config ID. For example:
 
+```terraform
+import {
+  to = aws_route53_resolver_config.example
+  id = "rslvr-rc-715aa20c73a23da7"
+}
 ```
-$ terraform import aws_route53_resolver_config.example rslvr-rc-715aa20c73a23da7
+
+Using `terraform import`, import Route 53 Resolver configs using the Route 53 Resolver config ID. For example:
+
+```console
+% terraform import aws_route53_resolver_config.example rslvr-rc-715aa20c73a23da7
 ```
diff --git a/website/docs/r/route53_resolver_dnssec_config.html.markdown b/website/docs/r/route53_resolver_dnssec_config.html.markdown
index 75b8c6bb944..27f3cdc2ca3 100644
--- a/website/docs/r/route53_resolver_dnssec_config.html.markdown
+++ b/website/docs/r/route53_resolver_dnssec_config.html.markdown
@@ -26,13 +26,13 @@ resource "aws_route53_resolver_dnssec_config" "example" {
 
 ## Argument Reference
 
-The following argument is supported:
+This resource supports the following arguments:
 
 * `resource_id` - (Required) The ID of the virtual private cloud (VPC) that you're updating the DNSSEC validation status for.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The ARN for a configuration for DNSSEC validation.
 * `id` - The ID for a configuration for DNSSEC validation.
@@ -41,8 +41,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
- Route 53 Resolver DNSSEC configs can be imported using the Route 53 Resolver DNSSEC config ID, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import  Route 53 Resolver DNSSEC configs using the Route 53 Resolver DNSSEC config ID. For example:
 
+```terraform
+import {
+  to = aws_route53_resolver_dnssec_config.example
+  id = "rdsc-be1866ecc1683e95"
+}
 ```
-$ terraform import aws_route53_resolver_dnssec_config.example rdsc-be1866ecc1683e95
+
+Using `terraform import`, import  Route 53 Resolver DNSSEC configs using the Route 53 Resolver DNSSEC config ID. For example:
+
+```console
+% terraform import aws_route53_resolver_dnssec_config.example rdsc-be1866ecc1683e95
 ```
diff --git a/website/docs/r/route53_resolver_endpoint.html.markdown b/website/docs/r/route53_resolver_endpoint.html.markdown
index 8881172e010..6b87a6b11ed 100644
--- a/website/docs/r/route53_resolver_endpoint.html.markdown
+++ b/website/docs/r/route53_resolver_endpoint.html.markdown
@@ -39,7 +39,7 @@ resource "aws_route53_resolver_endpoint" "foo" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `direction` - (Required) The direction of DNS queries to or from the Route 53 Resolver endpoint.
 Valid values are `INBOUND` (resolver forwards DNS queries to the DNS service for a VPC from your network or another VPC)
@@ -55,9 +55,9 @@ The `ip_address` object supports the following:
 * `subnet_id` - (Required) The ID of the subnet that contains the IP address.
 * `ip` - (Optional) The IP address in the subnet that you want to use for DNS queries.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the Route 53 Resolver endpoint.
 * `arn` - The ARN of the Route 53 Resolver endpoint.
@@ -74,8 +74,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
- Route 53 Resolver endpoints can be imported using the Route 53 Resolver endpoint ID, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import  Route 53 Resolver endpoints using the Route 53 Resolver endpoint ID. For example:
 
+```terraform
+import {
+  to = aws_route53_resolver_endpoint.foo
+  id = "rslvr-in-abcdef01234567890"
+}
 ```
-$ terraform import aws_route53_resolver_endpoint.foo rslvr-in-abcdef01234567890
+
+Using `terraform import`, import  Route 53 Resolver endpoints using the Route 53 Resolver endpoint ID. For example:
+
+```console
+% terraform import aws_route53_resolver_endpoint.foo rslvr-in-abcdef01234567890
 ```
diff --git a/website/docs/r/route53_resolver_firewall_config.html.markdown b/website/docs/r/route53_resolver_firewall_config.html.markdown
new file mode 100644
index 00000000000..fc1ff1d8a12
--- /dev/null
+++ b/website/docs/r/route53_resolver_firewall_config.html.markdown
@@ -0,0 +1,57 @@
+---
+subcategory: "Route 53 Resolver"
+layout: "aws"
+page_title: "AWS: aws_route53_resolver_firewall_config"
+description: |-
+  Provides a Route 53 Resolver DNS Firewall config resource.
+---
+
+# Resource: aws_route53_resolver_firewall_config
+
+Provides a Route 53 Resolver DNS Firewall config resource.
+
+## Example Usage
+
+```terraform
+resource "aws_vpc" "example" {
+  cidr_block           = "10.0.0.0/16"
+  enable_dns_support   = true
+  enable_dns_hostnames = true
+}
+
+resource "aws_route53_resolver_firewall_config" "example" {
+  resource_id        = aws_vpc.example.id
+  firewall_fail_open = "ENABLED"
+}
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `resource_id` - (Required) The ID of the VPC that the configuration is for.
+* `firewall_fail_open` - (Required) Determines how Route 53 Resolver handles queries during failures, for example when all traffic that is sent to DNS Firewall fails to receive a reply. By default, fail open is disabled, which means the failure mode is closed. This approach favors security over availability. DNS Firewall blocks queries that it is unable to evaluate properly. If you enable this option, the failure mode is open. This approach favors availability over security. DNS Firewall allows queries to proceed if it is unable to properly evaluate them. Valid values: `ENABLED`, `DISABLED`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the firewall configuration.
+* `owner_id` - The AWS account ID of the owner of the VPC that this firewall configuration applies to.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Route 53 Resolver DNS Firewall configs using the Route 53 Resolver DNS Firewall config ID. For example:
+
+```terraform
+import {
+  to = aws_route53_resolver_firewall_config.example
+  id = "rdsc-be1866ecc1683e95"
+}
+```
+
+Using `terraform import`, import Route 53 Resolver DNS Firewall configs using the Route 53 Resolver DNS Firewall config ID. For example:
+
+```console
+% terraform import aws_route53_resolver_firewall_config.example rdsc-be1866ecc1683e95
+```
diff --git a/website/docs/r/route53_resolver_firewall_config.markdown b/website/docs/r/route53_resolver_firewall_config.markdown
deleted file mode 100644
index 23e0d8766c5..00000000000
--- a/website/docs/r/route53_resolver_firewall_config.markdown
+++ /dev/null
@@ -1,48 +0,0 @@
----
-subcategory: "Route 53 Resolver"
-layout: "aws"
-page_title: "AWS: aws_route53_resolver_firewall_config"
-description: |-
-  Provides a Route 53 Resolver DNS Firewall config resource.
----
-
-# Resource: aws_route53_resolver_firewall_config
-
-Provides a Route 53 Resolver DNS Firewall config resource.
-
-## Example Usage
-
-```terraform
-resource "aws_vpc" "example" {
-  cidr_block           = "10.0.0.0/16"
-  enable_dns_support   = true
-  enable_dns_hostnames = true
-}
-
-resource "aws_route53_resolver_firewall_config" "example" {
-  resource_id        = aws_vpc.example.id
-  firewall_fail_open = "ENABLED"
-}
-```
-
-## Argument Reference
-
-The following argument is supported:
-
-* `resource_id` - (Required) The ID of the VPC that the configuration is for.
-* `firewall_fail_open` - (Required) Determines how Route 53 Resolver handles queries during failures, for example when all traffic that is sent to DNS Firewall fails to receive a reply. By default, fail open is disabled, which means the failure mode is closed. This approach favors security over availability. DNS Firewall blocks queries that it is unable to evaluate properly. If you enable this option, the failure mode is open. This approach favors availability over security. DNS Firewall allows queries to proceed if it is unable to properly evaluate them. Valid values: `ENABLED`, `DISABLED`.
-
-## Attributes Reference
-
-In addition to all arguments above, the following attributes are exported:
-
-* `id` - The ID of the firewall configuration.
-* `owner_id` - The AWS account ID of the owner of the VPC that this firewall configuration applies to.
-
-## Import
-
-Route 53 Resolver DNS Firewall configs can be imported using the Route 53 Resolver DNS Firewall config ID, e.g.,
-
-```
-$ terraform import aws_route53_resolver_firewall_config.example rdsc-be1866ecc1683e95
-```
diff --git a/website/docs/r/route53_resolver_firewall_domain_list.html.markdown b/website/docs/r/route53_resolver_firewall_domain_list.html.markdown
new file mode 100644
index 00000000000..e88e00c4777
--- /dev/null
+++ b/website/docs/r/route53_resolver_firewall_domain_list.html.markdown
@@ -0,0 +1,52 @@
+---
+subcategory: "Route 53 Resolver"
+layout: "aws"
+page_title: "AWS: aws_route53_resolver_firewall_domain_list"
+description: |-
+  Provides a Route 53 Resolver DNS Firewall domain list resource.
+---
+
+# Resource: aws_route53_resolver_firewall_domain_list
+
+Provides a Route 53 Resolver DNS Firewall domain list resource.
+
+## Example Usage
+
+```terraform
+resource "aws_route53_resolver_firewall_domain_list" "example" {
+  name = "example"
+}
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) A name that lets you identify the domain list, to manage and use it.
+* `domains` - (Optional) A array of domains for the firewall domain list.
+* `tags` - (Optional) A map of tags to assign to the resource. f configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN (Amazon Resource Name) of the domain list.
+* `id` - The ID of the domain list.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import  Route 53 Resolver DNS Firewall domain lists using the Route 53 Resolver DNS Firewall domain list ID. For example:
+
+```terraform
+import {
+  to = aws_route53_resolver_firewall_domain_list.example
+  id = "rslvr-fdl-0123456789abcdef"
+}
+```
+
+Using `terraform import`, import  Route 53 Resolver DNS Firewall domain lists using the Route 53 Resolver DNS Firewall domain list ID. For example:
+
+```console
+% terraform import aws_route53_resolver_firewall_domain_list.example rslvr-fdl-0123456789abcdef
+```
diff --git a/website/docs/r/route53_resolver_firewall_domain_list.markdown b/website/docs/r/route53_resolver_firewall_domain_list.markdown
deleted file mode 100644
index 720351304dd..00000000000
--- a/website/docs/r/route53_resolver_firewall_domain_list.markdown
+++ /dev/null
@@ -1,43 +0,0 @@
----
-subcategory: "Route 53 Resolver"
-layout: "aws"
-page_title: "AWS: aws_route53_resolver_firewall_domain_list"
-description: |-
-  Provides a Route 53 Resolver DNS Firewall domain list resource.
----
-
-# Resource: aws_route53_resolver_firewall_domain_list
-
-Provides a Route 53 Resolver DNS Firewall domain list resource.
-
-## Example Usage
-
-```terraform
-resource "aws_route53_resolver_firewall_domain_list" "example" {
-  name = "example"
-}
-```
-
-## Argument Reference
-
-The following argument is supported:
-
-* `name` - (Required) A name that lets you identify the domain list, to manage and use it.
-* `domains` - (Optional) A array of domains for the firewall domain list.
-* `tags` - (Optional) A map of tags to assign to the resource. f configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
-
-## Attributes Reference
-
-In addition to all arguments above, the following attributes are exported:
-
-* `arn` - The ARN (Amazon Resource Name) of the domain list.
-* `id` - The ID of the domain list.
-* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
-
-## Import
-
- Route 53 Resolver DNS Firewall domain lists can be imported using the Route 53 Resolver DNS Firewall domain list ID, e.g.,
-
-```
-$ terraform import aws_route53_resolver_firewall_domain_list.example rslvr-fdl-0123456789abcdef
-```
diff --git a/website/docs/r/route53_resolver_firewall_rule.html.markdown b/website/docs/r/route53_resolver_firewall_rule.html.markdown
new file mode 100644
index 00000000000..cb1c128b7e2
--- /dev/null
+++ b/website/docs/r/route53_resolver_firewall_rule.html.markdown
@@ -0,0 +1,75 @@
+---
+subcategory: "Route 53 Resolver"
+layout: "aws"
+page_title: "AWS: aws_route53_resolver_firewall_rule"
+description: |-
+  Provides a Route 53 Resolver DNS Firewall rule resource.
+---
+
+# Resource: aws_route53_resolver_firewall_rule
+
+Provides a Route 53 Resolver DNS Firewall rule resource.
+
+## Example Usage
+
+```terraform
+resource "aws_route53_resolver_firewall_domain_list" "example" {
+  name    = "example"
+  domains = ["example.com"]
+  tags    = {}
+}
+
+resource "aws_route53_resolver_firewall_rule_group" "example" {
+  name = "example"
+  tags = {}
+}
+
+resource "aws_route53_resolver_firewall_rule" "example" {
+  name                    = "example"
+  action                  = "BLOCK"
+  block_override_dns_type = "CNAME"
+  block_override_domain   = "example.com"
+  block_override_ttl      = 1
+  block_response          = "OVERRIDE"
+  firewall_domain_list_id = aws_route53_resolver_firewall_domain_list.example.id
+  firewall_rule_group_id  = aws_route53_resolver_firewall_rule_group.example.id
+  priority                = 100
+}
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) A name that lets you identify the rule, to manage and use it.
+* `action` - (Required) The action that DNS Firewall should take on a DNS query when it matches one of the domains in the rule's domain list. Valid values: `ALLOW`, `BLOCK`, `ALERT`.
+* `block_override_dns_type` - (Required if `block_response` is `OVERRIDE`) The DNS record's type. This determines the format of the record value that you provided in BlockOverrideDomain. Value values: `CNAME`.
+* `block_override_domain` - (Required if `block_response` is `OVERRIDE`) The custom DNS record to send back in response to the query.
+* `block_override_ttl` - (Required if `block_response` is `OVERRIDE`) The recommended amount of time, in seconds, for the DNS resolver or web browser to cache the provided override record. Minimum value of 0. Maximum value of 604800.
+* `block_response` - (Required if `action` is `BLOCK`) The way that you want DNS Firewall to block the request. Valid values: `NODATA`, `NXDOMAIN`, `OVERRIDE`.
+* `firewall_domain_list_id` - (Required) The ID of the domain list that you want to use in the rule.
+* `firewall_rule_group_id` - (Required) The unique identifier of the firewall rule group where you want to create the rule.
+* `priority` - (Required) The setting that determines the processing order of the rule in the rule group. DNS Firewall processes the rules in a rule group by order of priority, starting from the lowest setting.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the rule.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import  Route 53 Resolver DNS Firewall rules using the Route 53 Resolver DNS Firewall rule group ID and domain list ID separated by ':'. For example:
+
+```terraform
+import {
+  to = aws_route53_resolver_firewall_rule.example
+  id = "rslvr-frg-0123456789abcdef:rslvr-fdl-0123456789abcdef"
+}
+```
+
+Using `terraform import`, import  Route 53 Resolver DNS Firewall rules using the Route 53 Resolver DNS Firewall rule group ID and domain list ID separated by ':'. For example:
+
+```console
+% terraform import aws_route53_resolver_firewall_rule.example rslvr-frg-0123456789abcdef:rslvr-fdl-0123456789abcdef
+```
diff --git a/website/docs/r/route53_resolver_firewall_rule.markdown b/website/docs/r/route53_resolver_firewall_rule.markdown
deleted file mode 100644
index 9b82a2e5546..00000000000
--- a/website/docs/r/route53_resolver_firewall_rule.markdown
+++ /dev/null
@@ -1,66 +0,0 @@
----
-subcategory: "Route 53 Resolver"
-layout: "aws"
-page_title: "AWS: aws_route53_resolver_firewall_rule"
-description: |-
-  Provides a Route 53 Resolver DNS Firewall rule resource.
----
-
-# Resource: aws_route53_resolver_firewall_rule
-
-Provides a Route 53 Resolver DNS Firewall rule resource.
-
-## Example Usage
-
-```terraform
-resource "aws_route53_resolver_firewall_domain_list" "example" {
-  name    = "example"
-  domains = ["example.com"]
-  tags    = {}
-}
-
-resource "aws_route53_resolver_firewall_rule_group" "example" {
-  name = "example"
-  tags = {}
-}
-
-resource "aws_route53_resolver_firewall_rule" "example" {
-  name                    = "example"
-  action                  = "BLOCK"
-  block_override_dns_type = "CNAME"
-  block_override_domain   = "example.com"
-  block_override_ttl      = 1
-  block_response          = "OVERRIDE"
-  firewall_domain_list_id = aws_route53_resolver_firewall_domain_list.example.id
-  firewall_rule_group_id  = aws_route53_resolver_firewall_rule_group.example.id
-  priority                = 100
-}
-```
-
-## Argument Reference
-
-The following argument is supported:
-
-* `name` - (Required) A name that lets you identify the rule, to manage and use it.
-* `action` - (Required) The action that DNS Firewall should take on a DNS query when it matches one of the domains in the rule's domain list. Valid values: `ALLOW`, `BLOCK`, `ALERT`.
-* `block_override_dns_type` - (Required if `block_response` is `OVERRIDE`) The DNS record's type. This determines the format of the record value that you provided in BlockOverrideDomain. Value values: `CNAME`.
-* `block_override_domain` - (Required if `block_response` is `OVERRIDE`) The custom DNS record to send back in response to the query.
-* `block_override_ttl` - (Required if `block_response` is `OVERRIDE`) The recommended amount of time, in seconds, for the DNS resolver or web browser to cache the provided override record. Minimum value of 0. Maximum value of 604800.
-* `block_response` - (Required if `action` is `BLOCK`) The way that you want DNS Firewall to block the request. Valid values: `NODATA`, `NXDOMAIN`, `OVERRIDE`.
-* `firewall_domain_list_id` - (Required) The ID of the domain list that you want to use in the rule.
-* `firewall_rule_group_id` - (Required) The unique identifier of the firewall rule group where you want to create the rule.
-* `priority` - (Required) The setting that determines the processing order of the rule in the rule group. DNS Firewall processes the rules in a rule group by order of priority, starting from the lowest setting.
-
-## Attributes Reference
-
-In addition to all arguments above, the following attributes are exported:
-
-* `id` - The ID of the rule.
-
-## Import
-
- Route 53 Resolver DNS Firewall rules can be imported using the Route 53 Resolver DNS Firewall rule group ID and domain list ID separated by ':', e.g.,
-
-```
-$ terraform import aws_route53_resolver_firewall_rule.example rslvr-frg-0123456789abcdef:rslvr-fdl-0123456789abcdef
-```
diff --git a/website/docs/r/route53_resolver_firewall_rule_group.html.markdown b/website/docs/r/route53_resolver_firewall_rule_group.html.markdown
new file mode 100644
index 00000000000..c54120e7b10
--- /dev/null
+++ b/website/docs/r/route53_resolver_firewall_rule_group.html.markdown
@@ -0,0 +1,53 @@
+---
+subcategory: "Route 53 Resolver"
+layout: "aws"
+page_title: "AWS: aws_route53_resolver_firewall_rule_group"
+description: |-
+  Provides a Route 53 Resolver DNS Firewall rule group resource.
+---
+
+# Resource: aws_route53_resolver_firewall_rule_group
+
+Provides a Route 53 Resolver DNS Firewall rule group resource.
+
+## Example Usage
+
+```terraform
+resource "aws_route53_resolver_firewall_rule_group" "example" {
+  name = "example"
+}
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) A name that lets you identify the rule group, to manage and use it.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN (Amazon Resource Name) of the rule group.
+* `id` - The ID of the rule group.
+* `owner_id` - The AWS account ID for the account that created the rule group. When a rule group is shared with your account, this is the account that has shared the rule group with you.
+* `share_status` - Whether the rule group is shared with other AWS accounts, or was shared with the current account by another AWS account. Sharing is configured through AWS Resource Access Manager (AWS RAM). Valid values: `NOT_SHARED`, `SHARED_BY_ME`, `SHARED_WITH_ME`
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import  Route 53 Resolver DNS Firewall rule groups using the Route 53 Resolver DNS Firewall rule group ID. For example:
+
+```terraform
+import {
+  to = aws_route53_resolver_firewall_rule_group.example
+  id = "rslvr-frg-0123456789abcdef"
+}
+```
+
+Using `terraform import`, import  Route 53 Resolver DNS Firewall rule groups using the Route 53 Resolver DNS Firewall rule group ID. For example:
+
+```console
+% terraform import aws_route53_resolver_firewall_rule_group.example rslvr-frg-0123456789abcdef
+```
diff --git a/website/docs/r/route53_resolver_firewall_rule_group.markdown b/website/docs/r/route53_resolver_firewall_rule_group.markdown
deleted file mode 100644
index 8d6b474896f..00000000000
--- a/website/docs/r/route53_resolver_firewall_rule_group.markdown
+++ /dev/null
@@ -1,44 +0,0 @@
----
-subcategory: "Route 53 Resolver"
-layout: "aws"
-page_title: "AWS: aws_route53_resolver_firewall_rule_group"
-description: |-
-  Provides a Route 53 Resolver DNS Firewall rule group resource.
----
-
-# Resource: aws_route53_resolver_firewall_rule_group
-
-Provides a Route 53 Resolver DNS Firewall rule group resource.
-
-## Example Usage
-
-```terraform
-resource "aws_route53_resolver_firewall_rule_group" "example" {
-  name = "example"
-}
-```
-
-## Argument Reference
-
-The following argument is supported:
-
-* `name` - (Required) A name that lets you identify the rule group, to manage and use it.
-* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
-
-## Attributes Reference
-
-In addition to all arguments above, the following attributes are exported:
-
-* `arn` - The ARN (Amazon Resource Name) of the rule group.
-* `id` - The ID of the rule group.
-* `owner_id` - The AWS account ID for the account that created the rule group. When a rule group is shared with your account, this is the account that has shared the rule group with you.
-* `share_status` - Whether the rule group is shared with other AWS accounts, or was shared with the current account by another AWS account. Sharing is configured through AWS Resource Access Manager (AWS RAM). Valid values: `NOT_SHARED`, `SHARED_BY_ME`, `SHARED_WITH_ME`
-* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
-
-## Import
-
- Route 53 Resolver DNS Firewall rule groups can be imported using the Route 53 Resolver DNS Firewall rule group ID, e.g.,
-
-```
-$ terraform import aws_route53_resolver_firewall_rule_group.example rslvr-frg-0123456789abcdef
-```
diff --git a/website/docs/r/route53_resolver_firewall_rule_group_association.html.markdown b/website/docs/r/route53_resolver_firewall_rule_group_association.html.markdown
new file mode 100644
index 00000000000..69d05936fea
--- /dev/null
+++ b/website/docs/r/route53_resolver_firewall_rule_group_association.html.markdown
@@ -0,0 +1,62 @@
+---
+subcategory: "Route 53 Resolver"
+layout: "aws"
+page_title: "AWS: aws_route53_resolver_firewall_rule_group_association"
+description: |-
+  Provides a Route 53 Resolver DNS Firewall rule group association resource.
+---
+
+# Resource: aws_route53_resolver_firewall_rule_group_association
+
+Provides a Route 53 Resolver DNS Firewall rule group association resource.
+
+## Example Usage
+
+```terraform
+resource "aws_route53_resolver_firewall_rule_group" "example" {
+  name = "example"
+}
+
+resource "aws_route53_resolver_firewall_rule_group_association" "example" {
+  name                   = "example"
+  firewall_rule_group_id = aws_route53_resolver_firewall_rule_group.example.id
+  priority               = 100
+  vpc_id                 = aws_vpc.example.id
+}
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) A name that lets you identify the rule group association, to manage and use it.
+* `firewall_rule_group_id` - (Required) The unique identifier of the firewall rule group.
+* `mutation_protection` - (Optional) If enabled, this setting disallows modification or removal of the association, to help prevent against accidentally altering DNS firewall protections. Valid values: `ENABLED`, `DISABLED`.
+* `priority` - (Required) The setting that determines the processing order of the rule group among the rule groups that you associate with the specified VPC. DNS Firewall filters VPC traffic starting from the rule group with the lowest numeric priority setting.
+* `vpc_id` - (Required) The unique identifier of the VPC that you want to associate with the rule group.
+* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN (Amazon Resource Name) of the firewall rule group association.
+* `id` - The identifier for the association.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Route 53 Resolver DNS Firewall rule group associations using the Route 53 Resolver DNS Firewall rule group association ID. For example:
+
+```terraform
+import {
+  to = aws_route53_resolver_firewall_rule_group_association.example
+  id = "rslvr-frgassoc-0123456789abcdef"
+}
+```
+
+Using `terraform import`, import Route 53 Resolver DNS Firewall rule group associations using the Route 53 Resolver DNS Firewall rule group association ID. For example:
+
+```console
+% terraform import aws_route53_resolver_firewall_rule_group_association.example rslvr-frgassoc-0123456789abcdef
+```
diff --git a/website/docs/r/route53_resolver_firewall_rule_group_association.markdown b/website/docs/r/route53_resolver_firewall_rule_group_association.markdown
deleted file mode 100644
index 7c83dc8c0e3..00000000000
--- a/website/docs/r/route53_resolver_firewall_rule_group_association.markdown
+++ /dev/null
@@ -1,53 +0,0 @@
----
-subcategory: "Route 53 Resolver"
-layout: "aws"
-page_title: "AWS: aws_route53_resolver_firewall_rule_group_association"
-description: |-
-  Provides a Route 53 Resolver DNS Firewall rule group association resource.
----
-
-# Resource: aws_route53_resolver_firewall_rule_group_association
-
-Provides a Route 53 Resolver DNS Firewall rule group association resource.
-
-## Example Usage
-
-```terraform
-resource "aws_route53_resolver_firewall_rule_group" "example" {
-  name = "example"
-}
-
-resource "aws_route53_resolver_firewall_rule_group_association" "example" {
-  name                   = "example"
-  firewall_rule_group_id = aws_route53_resolver_firewall_rule_group.example.id
-  priority               = 100
-  vpc_id                 = aws_vpc.example.id
-}
-```
-
-## Argument Reference
-
-The following argument is supported:
-
-* `name` - (Required) A name that lets you identify the rule group association, to manage and use it.
-* `firewall_rule_group_id` - (Required) The unique identifier of the firewall rule group.
-* `mutation_protection` - (Optional) If enabled, this setting disallows modification or removal of the association, to help prevent against accidentally altering DNS firewall protections. Valid values: `ENABLED`, `DISABLED`.
-* `priority` - (Required) The setting that determines the processing order of the rule group among the rule groups that you associate with the specified VPC. DNS Firewall filters VPC traffic starting from the rule group with the lowest numeric priority setting.
-* `vpc_id` - (Required) The unique identifier of the VPC that you want to associate with the rule group.
-* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
-
-## Attributes Reference
-
-In addition to all arguments above, the following attributes are exported:
-
-* `arn` - The ARN (Amazon Resource Name) of the firewall rule group association.
-* `id` - The identifier for the association.
-* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
-
-## Import
-
-Route 53 Resolver DNS Firewall rule group associations can be imported using the Route 53 Resolver DNS Firewall rule group association ID, e.g.,
-
-```
-$ terraform import aws_route53_resolver_firewall_rule_group_association.example rslvr-frgassoc-0123456789abcdef
-```
diff --git a/website/docs/r/route53_resolver_query_log_config.html.markdown b/website/docs/r/route53_resolver_query_log_config.html.markdown
index a1bd5dfd11d..c083867da41 100644
--- a/website/docs/r/route53_resolver_query_log_config.html.markdown
+++ b/website/docs/r/route53_resolver_query_log_config.html.markdown
@@ -25,16 +25,16 @@ resource "aws_route53_resolver_query_log_config" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `destination_arn` - (Required) The ARN of the resource that you want Route 53 Resolver to send query logs.
 You can send query logs to an [S3 bucket](s3_bucket.html), a [CloudWatch Logs log group](cloudwatch_log_group.html), or a [Kinesis Data Firehose delivery stream](kinesis_firehose_delivery_stream.html).
 * `name` - (Required) The name of the Route 53 Resolver query logging configuration.
 * `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the Route 53 Resolver query logging configuration.
 * `arn` - The ARN (Amazon Resource Name) of the Route 53 Resolver query logging configuration.
@@ -46,8 +46,17 @@ Values are `NOT_SHARED`, `SHARED_BY_ME` or `SHARED_WITH_ME`
 
 ## Import
 
- Route 53 Resolver query logging configurations can be imported using the Route 53 Resolver query logging configuration ID, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import  Route 53 Resolver query logging configurations using the Route 53 Resolver query logging configuration ID. For example:
 
+```terraform
+import {
+  to = aws_route53_resolver_query_log_config.example
+  id = "rqlc-92edc3b1838248bf"
+}
 ```
-$ terraform import aws_route53_resolver_query_log_config.example rqlc-92edc3b1838248bf
+
+Using `terraform import`, import  Route 53 Resolver query logging configurations using the Route 53 Resolver query logging configuration ID. For example:
+
+```console
+% terraform import aws_route53_resolver_query_log_config.example rqlc-92edc3b1838248bf
 ```
diff --git a/website/docs/r/route53_resolver_query_log_config_association.html.markdown b/website/docs/r/route53_resolver_query_log_config_association.html.markdown
index ff677b01a66..09b10983359 100644
--- a/website/docs/r/route53_resolver_query_log_config_association.html.markdown
+++ b/website/docs/r/route53_resolver_query_log_config_association.html.markdown
@@ -21,21 +21,30 @@ resource "aws_route53_resolver_query_log_config_association" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `resolver_query_log_config_id` - (Required) The ID of the [Route 53 Resolver query logging configuration](route53_resolver_query_log_config.html) that you want to associate a VPC with.
 * `resource_id` - (Required) The ID of a VPC that you want this query logging configuration to log queries for.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` -The ID of the Route 53 Resolver query logging configuration association.
 
 ## Import
 
- Route 53 Resolver query logging configuration associations can be imported using the Route 53 Resolver query logging configuration association ID, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import  Route 53 Resolver query logging configuration associations using the Route 53 Resolver query logging configuration association ID. For example:
 
+```terraform
+import {
+  to = aws_route53_resolver_query_log_config_association.example
+  id = "rqlca-b320624fef3c4d70"
+}
 ```
-$ terraform import aws_route53_resolver_query_log_config_association.example rqlca-b320624fef3c4d70
+
+Using `terraform import`, import  Route 53 Resolver query logging configuration associations using the Route 53 Resolver query logging configuration association ID. For example:
+
+```console
+% terraform import aws_route53_resolver_query_log_config_association.example rqlca-b320624fef3c4d70
 ```
diff --git a/website/docs/r/route53_resolver_rule.html.markdown b/website/docs/r/route53_resolver_rule.html.markdown
index 46c77e9e2e1..7835282374f 100644
--- a/website/docs/r/route53_resolver_rule.html.markdown
+++ b/website/docs/r/route53_resolver_rule.html.markdown
@@ -42,7 +42,7 @@ resource "aws_route53_resolver_rule" "fwd" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `domain_name` - (Required) DNS queries for this domain name are forwarded to the IP addresses that are specified using `target_ip`.
 * `rule_type` - (Required) The rule type. Valid values are `FORWARD`, `SYSTEM` and `RECURSIVE`.
@@ -58,9 +58,9 @@ The `target_ip` object supports the following:
 * `ip` - (Required) One IP address that you want to forward DNS queries to. You can specify only IPv4 addresses.
 * `port` - (Optional) The port at `ip` that you want to forward DNS queries to. Default value is `53`
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the resolver rule.
 * `arn` - The ARN (Amazon Resource Name) for the resolver rule.
@@ -71,8 +71,17 @@ Values are `NOT_SHARED`, `SHARED_BY_ME` or `SHARED_WITH_ME`
 
 ## Import
 
-Route53 Resolver rules can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Route53 Resolver rules using the `id`. For example:
 
+```terraform
+import {
+  to = aws_route53_resolver_rule.sys
+  id = "rslvr-rr-0123456789abcdef0"
+}
 ```
-$ terraform import aws_route53_resolver_rule.sys rslvr-rr-0123456789abcdef0
+
+Using `terraform import`, import Route53 Resolver rules using the `id`. For example:
+
+```console
+% terraform import aws_route53_resolver_rule.sys rslvr-rr-0123456789abcdef0
 ```
diff --git a/website/docs/r/route53_resolver_rule_association.html.markdown b/website/docs/r/route53_resolver_rule_association.html.markdown
index 98346d0e9fb..4c95260bc0c 100644
--- a/website/docs/r/route53_resolver_rule_association.html.markdown
+++ b/website/docs/r/route53_resolver_rule_association.html.markdown
@@ -21,22 +21,31 @@ resource "aws_route53_resolver_rule_association" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `resolver_rule_id` - (Required) The ID of the resolver rule that you want to associate with the VPC.
 * `vpc_id` - (Required) The ID of the VPC that you want to associate the resolver rule with.
 * `name` - (Optional) A name for the association that you're creating between a resolver rule and a VPC.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the resolver rule association.
 
 ## Import
 
-Route53 Resolver rule associations can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Route53 Resolver rule associations using the `id`. For example:
 
+```terraform
+import {
+  to = aws_route53_resolver_rule_association.example
+  id = "rslvr-rrassoc-97242eaf88example"
+}
 ```
-$ terraform import aws_route53_resolver_rule_association.example rslvr-rrassoc-97242eaf88example
+
+Using `terraform import`, import Route53 Resolver rule associations using the `id`. For example:
+
+```console
+% terraform import aws_route53_resolver_rule_association.example rslvr-rrassoc-97242eaf88example
 ```
diff --git a/website/docs/r/route53_traffic_policy.html.markdown b/website/docs/r/route53_traffic_policy.html.markdown
index 841447938d7..b132071897a 100644
--- a/website/docs/r/route53_traffic_policy.html.markdown
+++ b/website/docs/r/route53_traffic_policy.html.markdown
@@ -43,9 +43,9 @@ The following arguments are optional:
 
 * `comment` - (Optional) Comment for the traffic policy.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - ID of the traffic policy
 * `type` - DNS type of the resource record sets that Amazon Route 53 creates when you use a traffic policy to create a traffic policy instance.
@@ -53,8 +53,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Route53 Traffic Policy can be imported using the `id` and `version`, e.g.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Route53 Traffic Policy using the `id` and `version`. For example:
 
+```terraform
+import {
+  to = aws_route53_traffic_policy.example
+  id = "01a52019-d16f-422a-ae72-c306d2b6df7e/1"
+}
 ```
-$ terraform import aws_route53_traffic_policy.example 01a52019-d16f-422a-ae72-c306d2b6df7e/1
+
+Using `terraform import`, import Route53 Traffic Policy using the `id` and `version`. For example:
+
+```console
+% terraform import aws_route53_traffic_policy.example 01a52019-d16f-422a-ae72-c306d2b6df7e/1
 ```
diff --git a/website/docs/r/route53_traffic_policy_instance.html.markdown b/website/docs/r/route53_traffic_policy_instance.html.markdown
index aeea59e2ce4..4a8ff220b5f 100644
--- a/website/docs/r/route53_traffic_policy_instance.html.markdown
+++ b/website/docs/r/route53_traffic_policy_instance.html.markdown
@@ -32,16 +32,25 @@ The following arguments are required:
 * `hosted_zone_id` - (Required) ID of the hosted zone that you want Amazon Route 53 to create resource record sets in by using the configuration in a traffic policy.
 * `ttl` - (Required) TTL that you want Amazon Route 53 to assign to all the resource record sets that it creates in the specified hosted zone.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - ID of traffic policy instance.
 
 ## Import
 
-Route53 traffic policy instance can be imported using its id.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Route53 traffic policy instance using its id. For example:
 
+```terraform
+import {
+  to = aws_route53_traffic_policy_instance.test
+  id = "df579d9a-6396-410e-ac22-e7ad60cf9e7e"
+}
 ```
-$ terraform import aws_route53_traffic_policy_instance.test df579d9a-6396-410e-ac22-e7ad60cf9e7e
+
+Using `terraform import`, import Route53 traffic policy instance using its id. For example:
+
+```console
+% terraform import aws_route53_traffic_policy_instance.test df579d9a-6396-410e-ac22-e7ad60cf9e7e
 ```
diff --git a/website/docs/r/route53_vpc_association_authorization.html.markdown b/website/docs/r/route53_vpc_association_authorization.html.markdown
index 6c76dcbeca3..b7627216ebb 100644
--- a/website/docs/r/route53_vpc_association_authorization.html.markdown
+++ b/website/docs/r/route53_vpc_association_authorization.html.markdown
@@ -64,22 +64,31 @@ resource "aws_route53_zone_association" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `zone_id` - (Required) The ID of the private hosted zone that you want to authorize associating a VPC with.
 * `vpc_id` - (Required) The VPC to authorize for association with the private hosted zone.
 * `vpc_region` - (Optional) The VPC's region. Defaults to the region of the AWS provider.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The calculated unique identifier for the association.
 
 ## Import
 
-Route 53 VPC Association Authorizations can be imported via the Hosted Zone ID and VPC ID, separated by a colon (`:`), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Route 53 VPC Association Authorizations using the Hosted Zone ID and VPC ID, separated by a colon (`:`). For example:
 
+```terraform
+import {
+  to = aws_route53_vpc_association_authorization.example
+  id = "Z123456ABCDEFG:vpc-12345678"
+}
 ```
-$ terraform import aws_route53_vpc_association_authorization.example Z123456ABCDEFG:vpc-12345678
+
+Using `terraform import`, import Route 53 VPC Association Authorizations using the Hosted Zone ID and VPC ID, separated by a colon (`:`). For example:
+
+```console
+% terraform import aws_route53_vpc_association_authorization.example Z123456ABCDEFG:vpc-12345678
 ```
diff --git a/website/docs/r/route53_zone.html.markdown b/website/docs/r/route53_zone.html.markdown
index f61c850e43a..c3cc66b81b0 100644
--- a/website/docs/r/route53_zone.html.markdown
+++ b/website/docs/r/route53_zone.html.markdown
@@ -66,7 +66,7 @@ resource "aws_route53_zone" "private" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) This is the name of the hosted zone.
 * `comment` - (Optional) A comment for the hosted zone. Defaults to 'Managed by Terraform'.
@@ -80,9 +80,9 @@ The following arguments are supported:
 * `vpc_id` - (Required) ID of the VPC to associate.
 * `vpc_region` - (Optional) Region of the VPC to associate. Defaults to AWS provider region.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The Amazon Resource Name (ARN) of the Hosted Zone.
 * `zone_id` - The Hosted Zone ID. This can be referenced by zone records.
@@ -93,8 +93,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Route53 Zones can be imported using the `zone id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Route53 Zones using the zone `id`. For example:
 
+```terraform
+import {
+  to = aws_route53_zone.myzone
+  id = "Z1D633PJN98FT9"
+}
 ```
-$ terraform import aws_route53_zone.myzone Z1D633PJN98FT9
+
+Using `terraform import`, import Route53 Zones using the zone `id`. For example:
+
+```console
+% terraform import aws_route53_zone.myzone Z1D633PJN98FT9
 ```
diff --git a/website/docs/r/route53_zone_association.html.markdown b/website/docs/r/route53_zone_association.html.markdown
index dee853d9c9c..7a7a093a9c0 100644
--- a/website/docs/r/route53_zone_association.html.markdown
+++ b/website/docs/r/route53_zone_association.html.markdown
@@ -54,29 +54,51 @@ resource "aws_route53_zone_association" "secondary" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `zone_id` - (Required) The private hosted zone to associate.
 * `vpc_id` - (Required) The VPC to associate with the private hosted zone.
 * `vpc_region` - (Optional) The VPC's region. Defaults to the region of the AWS provider.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The calculated unique identifier for the association.
 * `owning_account` - The account ID of the account that created the hosted zone.
 
 ## Import
 
-Route 53 Hosted Zone Associations can be imported via the Hosted Zone ID and VPC ID, separated by a colon (`:`), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Route 53 Hosted Zone Associations using the Hosted Zone ID and VPC ID, separated by a colon (`:`). For example:
 
+The VPC is in the same region where you have configured the Terraform AWS Provider:
+
+```terraform
+import {
+  to = aws_route53_zone_association.example
+  id = "Z123456ABCDEFG:vpc-12345678"
+}
 ```
-$ terraform import aws_route53_zone_association.example Z123456ABCDEFG:vpc-12345678
+
+The VPC is _not_ in the same region where you have configured the Terraform AWS Provider:
+
+```terraform
+import {
+  to = aws_route53_zone_association.example
+  id = "Z123456ABCDEFG:vpc-12345678:us-east-2"
+}
 ```
 
-If the VPC is in a different region than the Terraform AWS Provider region configuration, the VPC Region can be added to the endE.g.,
+**Using `terraform import` to import** Route 53 Hosted Zone Associations using the Hosted Zone ID and VPC ID, separated by a colon (`:`). For example:
+
+The VPC is in the same region where you have configured the Terraform AWS Provider:
 
+```console
+% terraform import aws_route53_zone_association.example Z123456ABCDEFG:vpc-12345678
 ```
-$ terraform import aws_route53_zone_association.example Z123456ABCDEFG:vpc-12345678:us-east-2
+
+The VPC is _not_ in the same region where you have configured the Terraform AWS Provider:
+
+```console
+% terraform import aws_route53_zone_association.example Z123456ABCDEFG:vpc-12345678:us-east-2
 ```
diff --git a/website/docs/r/route53domains_registered_domain.html.markdown b/website/docs/r/route53domains_registered_domain.html.markdown
index 353f67caa99..9131fd857f0 100644
--- a/website/docs/r/route53domains_registered_domain.html.markdown
+++ b/website/docs/r/route53domains_registered_domain.html.markdown
@@ -38,7 +38,7 @@ resource "aws_route53domains_registered_domain" "example" {
 
 ~> **NOTE:** You must specify the same privacy setting for `admin_privacy`, `registrant_privacy` and `tech_privacy`.
 
-The following arguments are supported:
+This argument supports the following arguments:
 
 * `admin_contact` - (Optional) Details about the domain administrative contact.
 * `admin_privacy` - (Optional) Whether domain administrative contact information is concealed from WHOIS queries. Default: `true`.
@@ -74,9 +74,9 @@ The `name_server` object supports the following:
 * `glue_ips` - (Optional) Glue IP addresses of a name server. The list can contain only one IPv4 and one IPv6 address.
 * `name` - (Required) The fully qualified host name of the name server.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The domain name.
 * `abuse_contact_email` - Email address to contact to report incorrect contact information for a domain, to report that the domain is being used to send spam, to report that someone is cybersquatting on a domain name, or report some other type of abuse.
diff --git a/website/docs/r/route53recoverycontrolconfig_cluster.html.markdown b/website/docs/r/route53recoverycontrolconfig_cluster.html.markdown
index f1737f831d8..6890776010c 100644
--- a/website/docs/r/route53recoverycontrolconfig_cluster.html.markdown
+++ b/website/docs/r/route53recoverycontrolconfig_cluster.html.markdown
@@ -24,9 +24,9 @@ The following arguments are required:
 
 * `name` - (Required) Unique name describing the cluster.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the cluster
 * `cluster_endpoints` - List of 5 endpoints in 5 regions that can be used to talk to the cluster. See below.
@@ -39,8 +39,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Route53 Recovery Control Config cluster can be imported via the cluster ARN, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Route53 Recovery Control Config cluster using the cluster ARN. For example:
 
+```terraform
+import {
+  to = aws_route53recoverycontrolconfig_cluster.mycluster
+  id = "arn:aws:route53-recovery-control::313517334327:cluster/f9ae13be-a11e-4ec7-8522-94a70468e6ea"
+}
 ```
-$ terraform import aws_route53recoverycontrolconfig_cluster.mycluster arn:aws:route53-recovery-control::313517334327:cluster/f9ae13be-a11e-4ec7-8522-94a70468e6ea
+
+Using `terraform import`, import Route53 Recovery Control Config cluster using the cluster ARN. For example:
+
+```console
+% terraform import aws_route53recoverycontrolconfig_cluster.mycluster arn:aws:route53-recovery-control::313517334327:cluster/f9ae13be-a11e-4ec7-8522-94a70468e6ea
 ```
diff --git a/website/docs/r/route53recoverycontrolconfig_control_panel.html.markdown b/website/docs/r/route53recoverycontrolconfig_control_panel.html.markdown
index 8fd0d55fb38..c4f7b7f4a35 100644
--- a/website/docs/r/route53recoverycontrolconfig_control_panel.html.markdown
+++ b/website/docs/r/route53recoverycontrolconfig_control_panel.html.markdown
@@ -26,9 +26,9 @@ The following arguments are required:
 * `cluster_arn` - (Required) ARN of the cluster in which this control panel will reside.
 * `name` - (Required) Name describing the control panel.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the control panel.
 * `default_control_panel` - Whether a control panel is default.
@@ -37,8 +37,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Route53 Recovery Control Config Control Panel can be imported via the control panel arn, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Route53 Recovery Control Config Control Panel using the control panel arn. For example:
 
+```terraform
+import {
+  to = aws_route53recoverycontrolconfig_control_panel.mypanel
+  id = "arn:aws:route53-recovery-control::313517334327:controlpanel/1bfba17df8684f5dab0467b71424f7e8"
+}
 ```
-$ terraform import aws_route53recoverycontrolconfig_control_panel.mypanel arn:aws:route53-recovery-control::313517334327:controlpanel/1bfba17df8684f5dab0467b71424f7e8
+
+Using `terraform import`, import Route53 Recovery Control Config Control Panel using the control panel arn. For example:
+
+```console
+% terraform import aws_route53recoverycontrolconfig_control_panel.mypanel arn:aws:route53-recovery-control::313517334327:controlpanel/1bfba17df8684f5dab0467b71424f7e8
 ```
diff --git a/website/docs/r/route53recoverycontrolconfig_routing_control.html.markdown b/website/docs/r/route53recoverycontrolconfig_routing_control.html.markdown
index a73a6681d4c..c9b4961b739 100644
--- a/website/docs/r/route53recoverycontrolconfig_routing_control.html.markdown
+++ b/website/docs/r/route53recoverycontrolconfig_routing_control.html.markdown
@@ -38,17 +38,26 @@ The following arguments are optional:
 
 * `control_panel_arn` - (Optional) ARN of the control panel in which this routing control will reside.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the routing control.
 * `status` - Status of routing control. `PENDING` when it is being created/updated, `PENDING_DELETION` when it is being deleted, and `DEPLOYED` otherwise.
 
 ## Import
 
-Route53 Recovery Control Config Routing Control can be imported via the routing control arn, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Route53 Recovery Control Config Routing Control using the routing control arn. For example:
 
+```terraform
+import {
+  to = aws_route53recoverycontrolconfig_routing_control.mycontrol
+  id = "arn:aws:route53-recovery-control::313517334327:controlpanel/abd5fbfc052d4844a082dbf400f61da8/routingcontrol/d5d90e587870494b"
+}
 ```
-$ terraform import aws_route53recoverycontrolconfig_routing_control.mycontrol arn:aws:route53-recovery-control::313517334327:controlpanel/abd5fbfc052d4844a082dbf400f61da8/routingcontrol/d5d90e587870494b
+
+Using `terraform import`, import Route53 Recovery Control Config Routing Control using the routing control arn. For example:
+
+```console
+% terraform import aws_route53recoverycontrolconfig_routing_control.mycontrol arn:aws:route53-recovery-control::313517334327:controlpanel/abd5fbfc052d4844a082dbf400f61da8/routingcontrol/d5d90e587870494b
 ```
diff --git a/website/docs/r/route53recoverycontrolconfig_safety_rule.html.markdown b/website/docs/r/route53recoverycontrolconfig_safety_rule.html.markdown
index 7ac2b7ddb3e..0ce22e4340d 100644
--- a/website/docs/r/route53recoverycontrolconfig_safety_rule.html.markdown
+++ b/website/docs/r/route53recoverycontrolconfig_safety_rule.html.markdown
@@ -45,7 +45,7 @@ resource "aws_route53recoverycontrolconfig_safety_rule" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `control_panel_arn` - (Required) ARN of the control panel in which this safety rule will reside.
 * `name` - (Required) Name describing the safety rule.
@@ -64,17 +64,26 @@ The following arguments are optional:
 * `threshold` - (Required) Number of controls that must be set when you specify an `ATLEAST` type rule.
 * `type` - (Required) Rule type. Valid values are `ATLEAST`, `AND`, and `OR`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the safety rule.
 * `status` - Status of the safety rule. `PENDING` when it is being created/updated, `PENDING_DELETION` when it is being deleted, and `DEPLOYED` otherwise.
 
 ## Import
 
-Route53 Recovery Control Config Safety Rule can be imported via the safety rule ARN, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Route53 Recovery Control Config Safety Rule using the safety rule ARN. For example:
 
+```terraform
+import {
+  to = aws_route53recoverycontrolconfig_safety_rule.myrule
+  id = "arn:aws:route53-recovery-control::313517334327:controlpanel/1bfba17df8684f5dab0467b71424f7e8/safetyrule/3bacc77003364c0f"
+}
 ```
-$ terraform import aws_route53recoverycontrolconfig_safety_rule.myrule arn:aws:route53-recovery-control::313517334327:controlpanel/1bfba17df8684f5dab0467b71424f7e8/safetyrule/3bacc77003364c0f
+
+Using `terraform import`, import Route53 Recovery Control Config Safety Rule using the safety rule ARN. For example:
+
+```console
+% terraform import aws_route53recoverycontrolconfig_safety_rule.myrule arn:aws:route53-recovery-control::313517334327:controlpanel/1bfba17df8684f5dab0467b71424f7e8/safetyrule/3bacc77003364c0f
 ```
diff --git a/website/docs/r/route53recoveryreadiness_cell.html.markdown b/website/docs/r/route53recoveryreadiness_cell.html.markdown
index 31e1c1dd4b5..56fdecf4274 100644
--- a/website/docs/r/route53recoveryreadiness_cell.html.markdown
+++ b/website/docs/r/route53recoveryreadiness_cell.html.markdown
@@ -29,9 +29,9 @@ The following arguments are optional:
 * `cells` - (Optional) List of cell arns to add as nested fault domains within this cell.
 * `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the cell
 * `parent_readiness_scopes` - List of readiness scopes (recovery groups or cells) that contain this cell.
@@ -45,8 +45,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Route53 Recovery Readiness cells can be imported via the cell name, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Route53 Recovery Readiness cells using the cell name. For example:
 
+```terraform
+import {
+  to = aws_route53recoveryreadiness_cell.us-west-2-failover-cell
+  id = "us-west-2-failover-cell"
+}
 ```
-$ terraform import aws_route53recoveryreadiness_cell.us-west-2-failover-cell us-west-2-failover-cell
+
+Using `terraform import`, import Route53 Recovery Readiness cells using the cell name. For example:
+
+```console
+% terraform import aws_route53recoveryreadiness_cell.us-west-2-failover-cell us-west-2-failover-cell
 ```
diff --git a/website/docs/r/route53recoveryreadiness_readiness_check.html.markdown b/website/docs/r/route53recoveryreadiness_readiness_check.html.markdown
index a2dc969561d..f272f4f8f6b 100644
--- a/website/docs/r/route53recoveryreadiness_readiness_check.html.markdown
+++ b/website/docs/r/route53recoveryreadiness_readiness_check.html.markdown
@@ -30,23 +30,32 @@ The following arguments are optional:
 
 * `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the readiness_check
 * `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
 
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `delete` - (Default `5m`)
+
 ## Import
 
-Route53 Recovery Readiness readiness checks can be imported via the readiness check name, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Route53 Recovery Readiness readiness checks using the readiness check name. For example:
 
-```
-$ terraform import aws_route53recoveryreadiness_readiness_check.my-cw-alarm-check
+```terraform
+import {
+  to = aws_route53recoveryreadiness_readiness_check.my-cw-alarm-check
+  id = "example"
+}
 ```
 
-## Timeouts
+Using `terraform import`, import Route53 Recovery Readiness readiness checks using the readiness check name. For example:
 
-[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
-
-- `delete` - (Default `5m`)
+```console
+% terraform import aws_route53recoveryreadiness_readiness_check.my-cw-alarm-check example
+```
diff --git a/website/docs/r/route53recoveryreadiness_recovery_group.html.markdown b/website/docs/r/route53recoveryreadiness_recovery_group.html.markdown
index 78a3d8343bf..94a6fe70e80 100644
--- a/website/docs/r/route53recoveryreadiness_recovery_group.html.markdown
+++ b/website/docs/r/route53recoveryreadiness_recovery_group.html.markdown
@@ -29,9 +29,9 @@ The following argument are optional:
 * `cells` - (Optional) List of cell arns to add as nested fault domains within this recovery group
 * `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the recovery group
 * `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
@@ -44,8 +44,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Route53 Recovery Readiness recovery groups can be imported via the recovery group name, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Route53 Recovery Readiness recovery groups using the recovery group name. For example:
 
+```terraform
+import {
+  to = aws_route53recoveryreadiness_recovery_group.my-high-availability-app
+  id = "my-high-availability-app"
+}
 ```
-$ terraform import aws_route53recoveryreadiness_recovery_group.my-high-availability-app my-high-availability-app
+
+Using `terraform import`, import Route53 Recovery Readiness recovery groups using the recovery group name. For example:
+
+```console
+% terraform import aws_route53recoveryreadiness_recovery_group.my-high-availability-app my-high-availability-app
 ```
diff --git a/website/docs/r/route53recoveryreadiness_resource_set.html.markdown b/website/docs/r/route53recoveryreadiness_resource_set.html.markdown
index 61e728e5f47..7eb6061c15e 100644
--- a/website/docs/r/route53recoveryreadiness_resource_set.html.markdown
+++ b/website/docs/r/route53recoveryreadiness_resource_set.html.markdown
@@ -25,7 +25,7 @@ resource "aws_route53recoveryreadiness_resource_set" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `resource_set_name` - (Required) Unique name describing the resource set.
 * `resource_set_type` - (Required) Type of the resources in the resource set.
@@ -63,24 +63,33 @@ The following arguments are optional:
 * `domain_name` - (Optional) Domain name that is targeted.
 * `record_set_id` - (Optional) Resource record set ID that is targeted.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the resource set
 * `resources.#.component_id` - Unique identified for DNS Target Resources, use for readiness checks.
 * `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
 
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `delete` - (Default `5m`)
+
 ## Import
 
-Route53 Recovery Readiness resource set name can be imported via the resource set name, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Route53 Recovery Readiness resource set name using the resource set name. For example:
 
-```
-$ terraform import aws_route53recoveryreadiness_resource_set.my-cw-alarm-set
+```terraform
+import {
+  to = aws_route53recoveryreadiness_resource_set.my-cw-alarm-set
+  id = "example"
+}
 ```
 
-## Timeouts
+Using `terraform import`, import Route53 Recovery Readiness resource set name using the resource set name. For example:
 
-[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
-
-- `delete` - (Default `5m`)
+```console
+% terraform import aws_route53recoveryreadiness_resource_set.my-cw-alarm-set example
+```
diff --git a/website/docs/r/route_table.html.markdown b/website/docs/r/route_table.html.markdown
index 000b6306ec4..546df7a7804 100644
--- a/website/docs/r/route_table.html.markdown
+++ b/website/docs/r/route_table.html.markdown
@@ -31,6 +31,8 @@ the separate resource.
 
 ## Example Usage
 
+### Basic example
+
 ```terraform
 resource "aws_route_table" "example" {
   vpc_id = aws_vpc.example.id
@@ -65,9 +67,59 @@ resource "aws_route_table" "example" {
 }
 ```
 
+### Adopting an existing local route
+
+AWS creates certain routes that the AWS provider mostly ignores. You can manage them by importing or adopting them. See [Import](#import) below for information on importing. This example shows adopting a route and then updating its target.
+
+First, adopt an existing AWS-created route:
+
+```terraform
+resource "aws_vpc" "test" {
+  cidr_block = "10.1.0.0/16"
+}
+
+resource "aws_route_table" "test" {
+  vpc_id = aws_vpc.test.id
+
+  # since this is exactly the route AWS will create, the route will be adopted
+  route {
+    cidr_block = "10.1.0.0/16"
+    gateway_id = "local"
+  }
+}
+```
+
+Next, update the target of the route:
+
+```terraform
+resource "aws_vpc" "test" {
+  cidr_block = "10.1.0.0/16"
+}
+
+resource "aws_route_table" "test" {
+  vpc_id = aws_vpc.test.id
+
+  route {
+    cidr_block           = aws_vpc.test.cidr_block
+    network_interface_id = aws_network_interface.test.id
+  }
+}
+
+resource "aws_subnet" "test" {
+  cidr_block = "10.1.1.0/24"
+  vpc_id     = aws_vpc.test.id
+}
+
+resource "aws_network_interface" "test" {
+  subnet_id = aws_subnet.test.id
+}
+```
+
+The target could then be updated again back to `local`.
+
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `vpc_id` - (Required) The VPC ID.
 * `route` - (Optional) A list of route objects. Their keys are documented below. This argument is processed in [attribute-as-blocks mode](https://www.terraform.io/docs/configuration/attr-as-blocks.html).
@@ -90,7 +142,7 @@ One of the following target arguments must be supplied:
 * `carrier_gateway_id` - (Optional) Identifier of a carrier gateway. This attribute can only be used when the VPC contains a subnet which is associated with a Wavelength Zone.
 * `core_network_arn` - (Optional) The Amazon Resource Name (ARN) of a core network.
 * `egress_only_gateway_id` - (Optional) Identifier of a VPC Egress Only Internet Gateway.
-* `gateway_id` - (Optional) Identifier of a VPC internet gateway or a virtual private gateway.
+* `gateway_id` - (Optional) Identifier of a VPC internet gateway, virtual private gateway, or `local`. `local` routes cannot be created but can be adopted or imported. See the [example](#adopting-an-existing-local-route) above.
 * `local_gateway_id` - (Optional) Identifier of a Outpost local gateway.
 * `nat_gateway_id` - (Optional) Identifier of a VPC NAT gateway.
 * `network_interface_id` - (Optional) Identifier of an EC2 network interface.
@@ -100,9 +152,9 @@ One of the following target arguments must be supplied:
 
 Note that the default route, mapping the VPC's CIDR block to "local", is created implicitly and cannot be specified.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 ~> **NOTE:** Only the target that is entered is exported as a readable
 attribute once the route resource is created.
@@ -122,9 +174,17 @@ attribute once the route resource is created.
 
 ## Import
 
-Route Tables can be imported using the route table `id`. For example, to import
-route table `rtb-4e616f6d69`, use this command:
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Route Tables using the route table `id`. For example:
 
+```terraform
+import {
+  to = aws_route_table.public_rt
+  id = "rtb-4e616f6d69"
+}
 ```
-$ terraform import aws_route_table.public_rt rtb-4e616f6d69
+
+Using `terraform import`, import Route Tables using the route table `id`. For example:
+
+```console
+% terraform import aws_route_table.public_rt rtb-4e616f6d69
 ```
diff --git a/website/docs/r/route_table_association.html.markdown b/website/docs/r/route_table_association.html.markdown
index 2c3497b20b5..ef72816b466 100644
--- a/website/docs/r/route_table_association.html.markdown
+++ b/website/docs/r/route_table_association.html.markdown
@@ -31,15 +31,15 @@ resource "aws_route_table_association" "b" {
 
 ~> **NOTE:** Please note that one of either `subnet_id` or `gateway_id` is required.
 
-The following arguments are supported:
+This argument supports the following arguments:
 
 * `subnet_id` - (Optional) The subnet ID to create an association. Conflicts with `gateway_id`.
 * `gateway_id` - (Optional) The gateway ID to create an association. Conflicts with `subnet_id`.
 * `route_table_id` - (Required) The ID of the routing table to associate with.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the association
 
@@ -53,23 +53,38 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-~> **NOTE:** Attempting to associate a route table with a subnet or gateway, where either
-is already associated, will result in an error (e.g.,
-`Resource.AlreadyAssociated: the specified association for route table
-rtb-4176657279 conflicts with an existing association`) unless you first
-import the original association.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EC2 Route Table Associations using the associated resource ID and Route Table ID separated by a forward slash (`/`). For example:
 
-EC2 Route Table Associations can be imported using the associated resource ID and Route Table ID
-separated by a forward slash (`/`).
+~> **NOTE:** Attempting to associate a route table with a subnet or gateway, where either is already associated, will result in an error (e.g., `Resource.AlreadyAssociated: the specified association for route table rtb-4176657279 conflicts with an existing association`) unless you first import the original association.
 
-For example with EC2 Subnets:
+With EC2 Subnets:
 
+```terraform
+import {
+  to = aws_route_table_association.assoc
+  id = "subnet-6777656e646f6c796e/rtb-656c65616e6f72"
+}
 ```
-$ terraform import aws_route_table_association.assoc subnet-6777656e646f6c796e/rtb-656c65616e6f72
+
+With EC2 Internet Gateways:
+
+```terraform
+import {
+  to = aws_route_table_association.assoc
+  id = "igw-01b3a60780f8d034a/rtb-656c65616e6f72"
+}
 ```
 
-For example with EC2 Internet Gateways:
+**Using `terraform import` to import** EC2 Route Table Associations using the associated resource ID and Route Table ID separated by a forward slash (`/`). For example:
+
+With EC2 Subnets:
 
+```console
+% terraform import aws_route_table_association.assoc subnet-6777656e646f6c796e/rtb-656c65616e6f72
 ```
-$ terraform import aws_route_table_association.assoc igw-01b3a60780f8d034a/rtb-656c65616e6f72
+
+With EC2 Internet Gateways:
+
+```console
+% terraform import aws_route_table_association.assoc igw-01b3a60780f8d034a/rtb-656c65616e6f72
 ```
diff --git a/website/docs/r/rum_app_monitor.html.markdown b/website/docs/r/rum_app_monitor.html.markdown
index 28a7ce2e43a..95b410755e4 100644
--- a/website/docs/r/rum_app_monitor.html.markdown
+++ b/website/docs/r/rum_app_monitor.html.markdown
@@ -21,7 +21,7 @@ resource "aws_rum_app_monitor" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The name of the log stream.
 * `domain` - (Required) The top-level internet domain name for which your application has administrative authority.
@@ -46,9 +46,9 @@ The following arguments are supported:
 
 * `status` - (Optional) Specifies whether this app monitor allows the web client to define and send custom events. The default is for custom events to be `DISABLED`. Valid values are `DISABLED` and `ENABLED`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The Amazon Resource Name (ARN) specifying the app monitor.
 * `id` - The CloudWatch RUM name as it is the identifier of a RUM.
@@ -58,8 +58,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Cloudwatch RUM App Monitor can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Cloudwatch RUM App Monitor using the `name`. For example:
 
+```terraform
+import {
+  to = aws_rum_app_monitor.example
+  id = "example"
+}
 ```
-$ terraform import aws_rum_app_monitor.example example
+
+Using `terraform import`, import Cloudwatch RUM App Monitor using the `name`. For example:
+
+```console
+% terraform import aws_rum_app_monitor.example example
 ```
diff --git a/website/docs/r/rum_metrics_destination.html.markdown b/website/docs/r/rum_metrics_destination.html.markdown
index e891b509efa..6cc2114b0b3 100644
--- a/website/docs/r/rum_metrics_destination.html.markdown
+++ b/website/docs/r/rum_metrics_destination.html.markdown
@@ -21,23 +21,32 @@ resource "aws_rum_metrics_destination" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `app_monitor_name` - (Required) The name of the CloudWatch RUM app monitor that will send the metrics.
 * `destination` - (Required)  Defines the destination to send the metrics to. Valid values are `CloudWatch` and `Evidently`. If you specify `Evidently`, you must also specify the ARN of the CloudWatchEvidently experiment that is to be the destination and an IAM role that has permission to write to the experiment.
 * `destination_arn` - (Optional) Use this parameter only if Destination is Evidently. This parameter specifies the ARN of the Evidently experiment that will receive the extended metrics.
 * `iam_role_arn` - (Optional) This parameter is required if Destination is Evidently. If Destination is CloudWatch, do not use this parameter.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The name of the CloudWatch RUM app monitor that will send the metrics.
 
 ## Import
 
-Cloudwatch RUM Metrics Destination can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Cloudwatch RUM Metrics Destination using the `id`. For example:
 
+```terraform
+import {
+  to = aws_rum_metrics_destination.example
+  id = "example"
+}
 ```
-$ terraform import aws_rum_metrics_destination.example example
+
+Using `terraform import`, import Cloudwatch RUM Metrics Destination using the `id`. For example:
+
+```console
+% terraform import aws_rum_metrics_destination.example example
 ```
diff --git a/website/docs/r/s3_access_point.html.markdown b/website/docs/r/s3_access_point.html.markdown
index 6353af11e91..da8c71d5e94 100644
--- a/website/docs/r/s3_access_point.html.markdown
+++ b/website/docs/r/s3_access_point.html.markdown
@@ -87,9 +87,9 @@ The following arguments are required:
 
 * `vpc_id` - (Required)  This access point will only allow connections from the specified VPC ID.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `alias` - Alias of the S3 Access Point.
 * `arn` - ARN of the S3 Access Point.
@@ -102,14 +102,36 @@ Note: S3 access points only support secure access by HTTPS. HTTP isn't supported
 
 ## Import
 
-For Access Points associated with an AWS Partition S3 Bucket, this resource can be imported using the `account_id` and `name` separated by a colon (`:`), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import this resource using the `account_id` and `name` separated by a colon (`:`) for Access Points associated with an AWS Partition S3 Bucket or the ARN for Access Points associated with an S3 on Outposts Bucket. For example:
 
+Import using the `account_id` and `name` separated by a colon (`:`) for Access Points associated with an AWS Partition S3 Bucket:
+
+```terraform
+import {
+  to = aws_s3_access_point.example
+  id = "123456789012:example"
+}
 ```
-$ terraform import aws_s3_access_point.example 123456789012:example
+
+Import using the ARN for Access Points associated with an S3 on Outposts Bucket:
+
+```terraform
+import {
+  to = aws_s3_access_point.example
+  id = "arn:aws:s3-outposts:us-east-1:123456789012:outpost/op-1234567890123456/accesspoint/example"
+}
 ```
 
-For Access Points associated with an S3 on Outposts Bucket, this resource can be imported using the ARN, e.g.,
+**Using `terraform import` to import.** For example:
+
+Import using the `account_id` and `name` separated by a colon (`:`) for Access Points associated with an AWS Partition S3 Bucket:
 
+```console
+% terraform import aws_s3_access_point.example 123456789012:example
 ```
-$ terraform import aws_s3_access_point.example arn:aws:s3-outposts:us-east-1:123456789012:outpost/op-1234567890123456/accesspoint/example
+
+Import using the ARN for Access Points associated with an S3 on Outposts Bucket:
+
+```console
+% terraform import aws_s3_access_point.example arn:aws:s3-outposts:us-east-1:123456789012:outpost/op-1234567890123456/accesspoint/example
 ```
diff --git a/website/docs/r/s3_account_public_access_block.html.markdown b/website/docs/r/s3_account_public_access_block.html.markdown
index 1a0b7aa020f..25a398d2b25 100644
--- a/website/docs/r/s3_account_public_access_block.html.markdown
+++ b/website/docs/r/s3_account_public_access_block.html.markdown
@@ -25,7 +25,7 @@ resource "aws_s3_account_public_access_block" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `account_id` - (Optional) AWS account ID to configure. Defaults to automatically determined account ID of the Terraform AWS provider.
 * `block_public_acls` - (Optional) Whether Amazon S3 should block public ACLs for buckets in this account. Defaults to `false`. Enabling this setting does not affect existing policies or ACLs. When set to `true` causes the following behavior:
@@ -38,16 +38,25 @@ The following arguments are supported:
 * `restrict_public_buckets` - (Optional) Whether Amazon S3 should restrict public bucket policies for buckets in this account. Defaults to `false`. Enabling this setting does not affect previously stored bucket policies, except that public and cross-account access within any public bucket policy, including non-public delegation to specific accounts, is blocked. When set to `true`:
     * Only the bucket owner and AWS Services can access buckets with public policies.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - AWS account ID
 
 ## Import
 
-`aws_s3_account_public_access_block` can be imported by using the AWS account ID, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_s3_account_public_access_block` using the AWS account ID. For example:
 
+```terraform
+import {
+  to = aws_s3_account_public_access_block.example
+  id = "123456789012"
+}
 ```
-$ terraform import aws_s3_account_public_access_block.example 123456789012
+
+Using `terraform import`, import `aws_s3_account_public_access_block` using the AWS account ID. For example:
+
+```console
+% terraform import aws_s3_account_public_access_block.example 123456789012
 ```
diff --git a/website/docs/r/s3_bucket.html.markdown b/website/docs/r/s3_bucket.html.markdown
index 3972d49f570..043c5eaad96 100644
--- a/website/docs/r/s3_bucket.html.markdown
+++ b/website/docs/r/s3_bucket.html.markdown
@@ -76,7 +76,7 @@ See [`aws_s3_bucket_acl`](s3_bucket_acl.html.markdown) for examples with ACL gra
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `bucket` - (Optional, Forces new resource) Name of the bucket. If omitted, Terraform will assign a random, unique name. Must be lowercase and less than or equal to 63 characters in length. A full list of bucket naming rules [may be found here](https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucketnamingrules.html).
 * `bucket_prefix` - (Optional, Forces new resource) Creates a unique bucket name beginning with the specified prefix. Conflicts with `bucket`. Must be lowercase and less than or equal to 37 characters in length. A full list of bucket naming rules [may be found here](https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucketnamingrules.html).
@@ -338,9 +338,9 @@ The `website` configuration block supports the following arguments:
 * `routing_rules` - (Optional) JSON array containing [routing rules](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-s3-websiteconfiguration-routingrules.html)
   describing redirect behavior and when redirects are applied.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Name of the bucket.
 * `arn` - ARN of the bucket. Will be of format `arn:aws:s3:::bucketname`.
@@ -363,8 +363,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-S3 bucket can be imported using the `bucket`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import S3 bucket using the `bucket`. For example:
 
+```terraform
+import {
+  to = aws_s3_bucket.bucket
+  id = "bucket-name"
+}
 ```
-$ terraform import aws_s3_bucket.bucket bucket-name
+
+Using `terraform import`, import S3 bucket using the `bucket`. For example:
+
+```console
+% terraform import aws_s3_bucket.bucket bucket-name
 ```
diff --git a/website/docs/r/s3_bucket_accelerate_configuration.html.markdown b/website/docs/r/s3_bucket_accelerate_configuration.html.markdown
index e9cf0c47aa1..e22baf5c8e8 100644
--- a/website/docs/r/s3_bucket_accelerate_configuration.html.markdown
+++ b/website/docs/r/s3_bucket_accelerate_configuration.html.markdown
@@ -25,32 +25,50 @@ resource "aws_s3_bucket_accelerate_configuration" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `bucket` - (Required, Forces new resource) Name of the bucket.
 * `expected_bucket_owner` - (Optional, Forces new resource) Account ID of the expected bucket owner.
 * `status` - (Required) Transfer acceleration state of the bucket. Valid values: `Enabled`, `Suspended`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The `bucket` or `bucket` and `expected_bucket_owner` separated by a comma (`,`) if the latter is provided.
 
 ## Import
 
-S3 bucket accelerate configuration can be imported in one of two ways.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import S3 bucket accelerate configuration using the `bucket` or using the `bucket` and `expected_bucket_owner` separated by a comma (`,`). For example:
 
-If the owner (account ID) of the source bucket is the same account used to configure the Terraform AWS Provider,
-the S3 bucket accelerate configuration resource should be imported using the `bucket` e.g.,
+If the owner (account ID) of the source bucket is the same account used to configure the Terraform AWS Provider, import using the `bucket`:
 
+```terraform
+import {
+  to = aws_s3_bucket_accelerate_configuration.example
+  id = "bucket-name"
+}
 ```
-$ terraform import aws_s3_bucket_accelerate_configuration.example bucket-name
+
+If the owner (account ID) of the source bucket differs from the account used to configure the Terraform AWS Provider, import using the `bucket` and `expected_bucket_owner` separated by a comma (`,`):
+
+```terraform
+import {
+  to = aws_s3_bucket_accelerate_configuration.example
+  id = "bucket-name,123456789012"
+}
 ```
 
-If the owner (account ID) of the source bucket differs from the account used to configure the Terraform AWS Provider,
-the S3 bucket accelerate configuration resource should be imported using the `bucket` and `expected_bucket_owner` separated by a comma (`,`) e.g.,
+**Using `terraform import` to import.** For example:
+
+If the owner (account ID) of the source bucket is the same account used to configure the Terraform AWS Provider, import using the `bucket`:
 
+```console
+% terraform import aws_s3_bucket_accelerate_configuration.example bucket-name
 ```
-$ terraform import aws_s3_bucket_accelerate_configuration.example bucket-name,123456789012
+
+If the owner (account ID) of the source bucket differs from the account used to configure the Terraform AWS Provider, import using the `bucket` and `expected_bucket_owner` separated by a comma (`,`):
+
+```console
+% terraform import aws_s3_bucket_accelerate_configuration.example bucket-name,123456789012
 ```
diff --git a/website/docs/r/s3_bucket_acl.html.markdown b/website/docs/r/s3_bucket_acl.html.markdown
index fd94a5e7b25..f8ee66d2a98 100644
--- a/website/docs/r/s3_bucket_acl.html.markdown
+++ b/website/docs/r/s3_bucket_acl.html.markdown
@@ -119,7 +119,7 @@ resource "aws_s3_bucket_acl" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `acl` - (Optional, Conflicts with `access_control_policy`) Canned ACL to apply to the bucket.
 * `access_control_policy` - (Optional, Conflicts with `acl`) Configuration block that sets the ACL permissions for an object per grantee. [See below](#access_control_policy).
@@ -156,42 +156,80 @@ The `grantee` configuration block supports the following arguments:
 * `type` - (Required) Type of grantee. Valid values: `CanonicalUser`, `AmazonCustomerByEmail`, `Group`.
 * `uri` - (Optional) URI of the grantee group.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The `bucket`, `expected_bucket_owner` (if configured), and `acl` (if configured) separated by commas (`,`).
 
 ## Import
 
-S3 bucket ACL can be imported in one of four ways.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import S3 bucket ACL using `bucket`, `expected_bucket_owner`, and/or `acl`, depending on your situation. For example:
 
 If the owner (account ID) of the source bucket is the _same_ account used to configure the Terraform AWS Provider, and the source bucket is **not configured** with a
-[canned ACL][1] (i.e. predefined grant), the S3 bucket ACL resource should be imported using the `bucket` e.g.,
+[canned ACL][1] (i.e. predefined grant), import using the `bucket`:
 
-```
-$ terraform import aws_s3_bucket_acl.example bucket-name
+```terraform
+import {
+  to = aws_s3_bucket_acl.example
+  id = "bucket-name"
+}
 ```
 
 If the owner (account ID) of the source bucket is the _same_ account used to configure the Terraform AWS Provider, and the source bucket is **configured** with a
-[canned ACL][1] (i.e. predefined grant), the S3 bucket ACL resource should be imported using the `bucket` and `acl` separated by a comma (`,`), e.g.
+[canned ACL][1] (i.e. predefined grant), import using the `bucket` and `acl` separated by a comma (`,`):
 
+```terraform
+import {
+  to = aws_s3_bucket_acl.example
+  id = "bucket-name,private"
+}
 ```
-$ terraform import aws_s3_bucket_acl.example bucket-name,private
+
+If the owner (account ID) of the source bucket _differs_ from the account used to configure the Terraform AWS Provider, and the source bucket is **not configured** with a [canned ACL][1] (i.e. predefined grant), imported using the `bucket` and `expected_bucket_owner` separated by a comma (`,`):
+
+```terraform
+import {
+  to = aws_s3_bucket_acl.example
+  id = "bucket-name,123456789012"
+}
+```
+
+If the owner (account ID) of the source bucket _differs_ from the account used to configure the Terraform AWS Provider, and the source bucket is **configured** with a
+[canned ACL][1] (i.e. predefined grant), imported using the `bucket`, `expected_bucket_owner`, and `acl` separated by commas (`,`):
+
+```terraform
+import {
+  to = aws_s3_bucket_acl.example
+  id = "bucket-name,123456789012,private"
+}
 ```
 
-If the owner (account ID) of the source bucket _differs_ from the account used to configure the Terraform AWS Provider, and the source bucket is **not configured** with a
-[canned ACL][1] (i.e. predefined grant), the S3 bucket ACL resource should be imported using the `bucket` and `expected_bucket_owner` separated by a comma (`,`) e.g.,
+**Using `terraform import` to import** using `bucket`, `expected_bucket_owner`, and/or `acl`, depending on your situation. For example:
+
+If the owner (account ID) of the source bucket is the _same_ account used to configure the Terraform AWS Provider, and the source bucket is **not configured** with a
+[canned ACL][1] (i.e. predefined grant), import using the `bucket`:
 
+```console
+% terraform import aws_s3_bucket_acl.example bucket-name
 ```
-$ terraform import aws_s3_bucket_acl.example bucket-name,123456789012
+
+If the owner (account ID) of the source bucket is the _same_ account used to configure the Terraform AWS Provider, and the source bucket is **configured** with a [canned ACL][1] (i.e. predefined grant), import using the `bucket` and `acl` separated by a comma (`,`):
+
+```console
+% terraform import aws_s3_bucket_acl.example bucket-name,private
 ```
 
-If the owner (account ID) of the source bucket _differs_ from the account used to configure the Terraform AWS Provider, and the source bucket is **configured** with a
-[canned ACL][1] (i.e. predefined grant), the S3 bucket ACL resource should be imported using the `bucket`, `expected_bucket_owner`, and `acl` separated by commas (`,`), e.g.,
+If the owner (account ID) of the source bucket _differs_ from the account used to configure the Terraform AWS Provider, and the source bucket is **not configured** with a [canned ACL][1] (i.e. predefined grant), imported using the `bucket` and `expected_bucket_owner` separated by a comma (`,`):
 
+```console
+% terraform import aws_s3_bucket_acl.example bucket-name,123456789012
 ```
-$ terraform import aws_s3_bucket_acl.example bucket-name,123456789012,private
+
+If the owner (account ID) of the source bucket _differs_ from the account used to configure the Terraform AWS Provider, and the source bucket is **configured** with a [canned ACL][1] (i.e. predefined grant), imported using the `bucket`, `expected_bucket_owner`, and `acl` separated by commas (`,`):
+
+```console
+% terraform import aws_s3_bucket_acl.example bucket-name,123456789012,private
 ```
 
 [1]: https://docs.aws.amazon.com/AmazonS3/latest/userguide/acl-overview.html#canned-acl
diff --git a/website/docs/r/s3_bucket_analytics_configuration.html.markdown b/website/docs/r/s3_bucket_analytics_configuration.html.markdown
index 6826a38d6aa..1a7320cd18a 100644
--- a/website/docs/r/s3_bucket_analytics_configuration.html.markdown
+++ b/website/docs/r/s3_bucket_analytics_configuration.html.markdown
@@ -63,7 +63,7 @@ resource "aws_s3_bucket" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `bucket` - (Required) Name of the bucket this analytics configuration is associated with.
 * `name` - (Required) Unique identifier of the analytics configuration for the bucket.
@@ -95,14 +95,23 @@ The `s3_bucket_destination` configuration supports the following:
 * `format` - (Optional) Output format of exported analytics data. Allowed values: `CSV`. Default value: `CSV`.
 * `prefix` - (Optional) Prefix to append to exported analytics data.
 
-## Attributes Reference
+## Attribute Reference
 
-No additional attributes are exported.
+This resource exports no additional attributes.
 
 ## Import
 
-S3 bucket analytics configurations can be imported using `bucket:analytics`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import S3 bucket analytics configurations using `bucket:analytics`. For example:
 
+```terraform
+import {
+  to = aws_s3_bucket_analytics_configuration.my-bucket-entire-bucket
+  id = "my-bucket:EntireBucket"
+}
 ```
-$ terraform import aws_s3_bucket_analytics_configuration.my-bucket-entire-bucket my-bucket:EntireBucket
+
+Using `terraform import`, import S3 bucket analytics configurations using `bucket:analytics`. For example:
+
+```console
+% terraform import aws_s3_bucket_analytics_configuration.my-bucket-entire-bucket my-bucket:EntireBucket
 ```
diff --git a/website/docs/r/s3_bucket_cors_configuration.html.markdown b/website/docs/r/s3_bucket_cors_configuration.html.markdown
index b02550d513d..8f8c05c1089 100644
--- a/website/docs/r/s3_bucket_cors_configuration.html.markdown
+++ b/website/docs/r/s3_bucket_cors_configuration.html.markdown
@@ -39,7 +39,7 @@ resource "aws_s3_bucket_cors_configuration" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `bucket` - (Required, Forces new resource) Name of the bucket.
 * `expected_bucket_owner` - (Optional, Forces new resource) Account ID of the expected bucket owner.
@@ -56,26 +56,44 @@ The `cors_rule` configuration block supports the following arguments:
 * `id` - (Optional) Unique identifier for the rule. The value cannot be longer than 255 characters.
 * `max_age_seconds` - (Optional) Time in seconds that your browser is to cache the preflight response for the specified resource.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The `bucket` or `bucket` and `expected_bucket_owner` separated by a comma (`,`) if the latter is provided.
 
 ## Import
 
-S3 bucket CORS configuration can be imported in one of two ways.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import S3 bucket CORS configuration using the `bucket` or using the `bucket` and `expected_bucket_owner` separated by a comma (`,`). For example:
 
-If the owner (account ID) of the source bucket is the same account used to configure the Terraform AWS Provider,
-the S3 bucket CORS configuration resource should be imported using the `bucket` e.g.,
+If the owner (account ID) of the source bucket is the same account used to configure the Terraform AWS Provider, import using the `bucket`:
 
+```terraform
+import {
+  to = aws_s3_bucket_cors_configuration.example
+  id = "bucket-name"
+}
 ```
-$ terraform import aws_s3_bucket_cors_configuration.example bucket-name
+
+If the owner (account ID) of the source bucket differs from the account used to configure the Terraform AWS Provider, import using the `bucket` and `expected_bucket_owner` separated by a comma (`,`):
+
+```terraform
+import {
+  to = aws_s3_bucket_cors_configuration.example
+  id = "bucket-name,123456789012"
+}
 ```
 
-If the owner (account ID) of the source bucket differs from the account used to configure the Terraform AWS Provider,
-the S3 bucket CORS configuration resource should be imported using the `bucket` and `expected_bucket_owner` separated by a comma (`,`) e.g.,
+**Using `terraform import` to import** S3 bucket CORS configuration using the `bucket` or using the `bucket` and `expected_bucket_owner` separated by a comma (`,`). For example:
+
+If the owner (account ID) of the source bucket is the same account used to configure the Terraform AWS Provider, import using the `bucket`:
 
+```console
+% terraform import aws_s3_bucket_cors_configuration.example bucket-name
 ```
-$ terraform import aws_s3_bucket_cors_configuration.example bucket-name,123456789012
+
+If the owner (account ID) of the source bucket differs from the account used to configure the Terraform AWS Provider, import using the `bucket` and `expected_bucket_owner` separated by a comma (`,`):
+
+```console
+% terraform import aws_s3_bucket_cors_configuration.example bucket-name,123456789012
 ```
diff --git a/website/docs/r/s3_bucket_intelligent_tiering_configuration.html.markdown b/website/docs/r/s3_bucket_intelligent_tiering_configuration.html.markdown
index 38b0fe0e97f..feb60c30a1f 100644
--- a/website/docs/r/s3_bucket_intelligent_tiering_configuration.html.markdown
+++ b/website/docs/r/s3_bucket_intelligent_tiering_configuration.html.markdown
@@ -65,7 +65,7 @@ resource "aws_s3_bucket" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `bucket` - (Required) Name of the bucket this intelligent tiering configuration is associated with.
 * `name` - (Required) Unique name used to identify the S3 Intelligent-Tiering configuration for the bucket.
@@ -83,14 +83,23 @@ The `tiering` configuration supports the following:
 * `access_tier` - (Required) S3 Intelligent-Tiering access tier. Valid values: `ARCHIVE_ACCESS`, `DEEP_ARCHIVE_ACCESS`.
 * `days` - (Required) Number of consecutive days of no access after which an object will be eligible to be transitioned to the corresponding tier.
 
-## Attributes Reference
+## Attribute Reference
 
-No additional attributes are exported.
+This resource exports no additional attributes.
 
 ## Import
 
-S3 bucket intelligent tiering configurations can be imported using `bucket:name`, e.g.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import S3 bucket intelligent tiering configurations using `bucket:name`. For example:
 
+```terraform
+import {
+  to = aws_s3_bucket_intelligent_tiering_configuration.my-bucket-entire-bucket
+  id = "my-bucket:EntireBucket"
+}
 ```
-$ terraform import aws_s3_bucket_intelligent_tiering_configuration.my-bucket-entire-bucket my-bucket:EntireBucket
+
+Using `terraform import`, import S3 bucket intelligent tiering configurations using `bucket:name`. For example:
+
+```console
+% terraform import aws_s3_bucket_intelligent_tiering_configuration.my-bucket-entire-bucket my-bucket:EntireBucket
 ```
diff --git a/website/docs/r/s3_bucket_inventory.html.markdown b/website/docs/r/s3_bucket_inventory.html.markdown
index 12fe86f50b9..219c12e7ea3 100644
--- a/website/docs/r/s3_bucket_inventory.html.markdown
+++ b/website/docs/r/s3_bucket_inventory.html.markdown
@@ -79,7 +79,7 @@ resource "aws_s3_bucket_inventory" "test-prefix" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `bucket` - (Required) Name of the source bucket that inventory lists the objects for.
 * `name` - (Required) Unique identifier of the inventory configuration for the bucket.
@@ -119,14 +119,23 @@ The `sse_kms` configuration supports the following:
 
 * `key_id` - (Required) ARN of the KMS customer master key (CMK) used to encrypt the inventory file.
 
-## Attributes Reference
+## Attribute Reference
 
-No additional attributes are exported.
+This resource exports no additional attributes.
 
 ## Import
 
-S3 bucket inventory configurations can be imported using `bucket:inventory`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import S3 bucket inventory configurations using `bucket:inventory`. For example:
 
-```sh
-$ terraform import aws_s3_bucket_inventory.my-bucket-entire-bucket my-bucket:EntireBucket
+```terraform
+import {
+  to = aws_s3_bucket_inventory.my-bucket-entire-bucket
+  id = "my-bucket:EntireBucket"
+}
+```
+
+Using `terraform import`, import S3 bucket inventory configurations using `bucket:inventory`. For example:
+
+```console
+% terraform import aws_s3_bucket_inventory.my-bucket-entire-bucket my-bucket:EntireBucket
 ```
diff --git a/website/docs/r/s3_bucket_lifecycle_configuration.html.markdown b/website/docs/r/s3_bucket_lifecycle_configuration.html.markdown
index e051b6ca88e..2ef75b3fffc 100644
--- a/website/docs/r/s3_bucket_lifecycle_configuration.html.markdown
+++ b/website/docs/r/s3_bucket_lifecycle_configuration.html.markdown
@@ -20,6 +20,10 @@ For more information see the Amazon S3 User Guide on [`Lifecycle Configuration E
 
 ~> **NOTE:** S3 Buckets only support a single lifecycle configuration. Declaring multiple `aws_s3_bucket_lifecycle_configuration` resources to the same S3 Bucket will cause a perpetual difference in configuration.
 
+~> **NOTE:** Lifecycle configurations may take some time to fully propagate to all AWS S3 systems.
+Running Terraform operations shortly after creating a lifecycle configuration may result in changes that affect configuration idempotence.
+See the Amazon S3 User Guide on [setting lifecycle configuration on a bucket](https://docs.aws.amazon.com/AmazonS3/latest/userguide/how-to-set-lifecycle-configuration-intro.html).
+
 ## Example Usage
 
 ### With neither a filter nor prefix specified
@@ -356,7 +360,7 @@ resource "aws_s3_bucket_lifecycle_configuration" "versioning-bucket-config" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `bucket` - (Required) Name of the source S3 bucket you want Amazon S3 to monitor.
 * `expected_bucket_owner` - (Optional) Account ID of the expected bucket owner. If the bucket is owned by a different account, the request will fail with an HTTP 403 (Access Denied) error.
@@ -393,7 +397,7 @@ The `abort_incomplete_multipart_upload` configuration block supports the followi
 
 The `expiration` configuration block supports the following arguments:
 
-* `date` - (Optional) Date the object is to be moved or deleted. Should be in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8).
+* `date` - (Optional) Date the object is to be moved or deleted. The date value must be in [RFC3339 full-date format](https://datatracker.ietf.org/doc/html/rfc3339#section-5.6) e.g. `2023-08-22`.
 * `days` - (Optional) Lifetime, in days, of the objects that are subject to the rule. The value must be a non-zero positive integer.
 * `expired_object_delete_marker` - (Optional, Conflicts with `date` and `days`) Indicates whether Amazon S3 will remove a delete marker with no noncurrent versions. If set to `true`, the delete marker will be expired; if set to `false` the policy takes no action.
 
@@ -430,7 +434,7 @@ The `transition` configuration block supports the following arguments:
 
 ~> **Note:** Only one of `date` or `days` should be specified. If neither are specified, the `transition` will default to 0 `days`.
 
-* `date` - (Optional, Conflicts with `days`) Date objects are transitioned to the specified storage class. The date value must be in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8) and set to midnight UTC e.g. `2023-01-13T00:00:00Z`.
+* `date` - (Optional, Conflicts with `days`) Date objects are transitioned to the specified storage class. The date value must be in [RFC3339 full-date format](https://datatracker.ietf.org/doc/html/rfc3339#section-5.6) e.g. `2023-08-22`.
 * `days` - (Optional, Conflicts with `date`) Number of days after creation when objects are transitioned to the specified storage class. The value must be a positive integer. If both `days` and `date` are not specified, defaults to `0`. Valid values depend on `storage_class`, see [Transition objects using Amazon S3 Lifecycle](https://docs.aws.amazon.com/AmazonS3/latest/userguide/lifecycle-transition-general-considerations.html) for more details.
 * `storage_class` - Class of storage used to store the object. Valid Values: `GLACIER`, `STANDARD_IA`, `ONEZONE_IA`, `INTELLIGENT_TIERING`, `DEEP_ARCHIVE`, `GLACIER_IR`.
 
@@ -450,26 +454,44 @@ The `tag` configuration block supports the following arguments:
 * `key` - (Required) Name of the object key.
 * `value` - (Required) Value of the tag.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The `bucket` or `bucket` and `expected_bucket_owner` separated by a comma (`,`) if the latter is provided.
 
 ## Import
 
-S3 bucket lifecycle configuration can be imported in one of two ways.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import S3 bucket lifecycle configuration using the `bucket` or using the `bucket` and `expected_bucket_owner` separated by a comma (`,`). For example:
 
-If the owner (account ID) of the source bucket is the same account used to configure the Terraform AWS Provider,
-the S3 bucket lifecycle configuration resource should be imported using the `bucket` e.g.,
+If the owner (account ID) of the source bucket is the same account used to configure the Terraform AWS Provider, import using the `bucket`:
 
-```sh
-$ terraform import aws_s3_bucket_lifecycle_configuration.example bucket-name
+```terraform
+import {
+  to = aws_s3_bucket_lifecycle_configuration.example
+  id = "bucket-name"
+}
 ```
 
-If the owner (account ID) of the source bucket differs from the account used to configure the Terraform AWS Provider,
-the S3 bucket lifecycle configuration resource should be imported using the `bucket` and `expected_bucket_owner` separated by a comma (`,`) e.g.,
+If the owner (account ID) of the source bucket differs from the account used to configure the Terraform AWS Provider, import using the `bucket` and `expected_bucket_owner` separated by a comma (`,`):
 
+```terraform
+import {
+  to = aws_s3_bucket_lifecycle_configuration.example
+  id = "bucket-name,123456789012"
+}
 ```
-$ terraform import aws_s3_bucket_lifecycle_configuration.example bucket-name,123456789012
+
+**Using `terraform import` to import** S3 bucket lifecycle configuration using the `bucket` or using the `bucket` and `expected_bucket_owner` separated by a comma (`,`). For example:
+
+If the owner (account ID) of the source bucket is the same account used to configure the Terraform AWS Provider, import using the `bucket`:
+
+```console
+% terraform import aws_s3_bucket_lifecycle_configuration.example bucket-name
+```
+
+If the owner (account ID) of the source bucket differs from the account used to configure the Terraform AWS Provider, import using the `bucket` and `expected_bucket_owner` separated by a comma (`,`):
+
+```console
+% terraform import aws_s3_bucket_lifecycle_configuration.example bucket-name,123456789012
 ```
diff --git a/website/docs/r/s3_bucket_logging.html.markdown b/website/docs/r/s3_bucket_logging.html.markdown
index 0e22ed9f5b3..995ae8fae92 100644
--- a/website/docs/r/s3_bucket_logging.html.markdown
+++ b/website/docs/r/s3_bucket_logging.html.markdown
@@ -45,7 +45,7 @@ resource "aws_s3_bucket_logging" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `bucket` - (Required, Forces new resource) Name of the bucket.
 * `expected_bucket_owner` - (Optional, Forces new resource) Account ID of the expected bucket owner.
@@ -69,26 +69,44 @@ The `grantee` configuration block supports the following arguments:
 * `type` - (Required) Type of grantee. Valid values: `CanonicalUser`, `AmazonCustomerByEmail`, `Group`.
 * `uri` - (Optional) URI of the grantee group.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The `bucket` or `bucket` and `expected_bucket_owner` separated by a comma (`,`) if the latter is provided.
 
 ## Import
 
-S3 bucket logging can be imported in one of two ways.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import S3 bucket logging using the `bucket` or using the `bucket` and `expected_bucket_owner` separated by a comma (`,`). For example:
 
-If the owner (account ID) of the source bucket is the same account used to configure the Terraform AWS Provider,
-the S3 bucket logging resource should be imported using the `bucket` e.g.,
+If the owner (account ID) of the source bucket is the same account used to configure the Terraform AWS Provider, import using the `bucket`:
 
+```terraform
+import {
+  to = aws_s3_bucket_logging.example
+  id = "bucket-name"
+}
 ```
-$ terraform import aws_s3_bucket_logging.example bucket-name
+
+If the owner (account ID) of the source bucket differs from the account used to configure the Terraform AWS Provider, import using the `bucket` and `expected_bucket_owner` separated by a comma (`,`):
+
+```terraform
+import {
+  to = aws_s3_bucket_logging.example
+  id = "bucket-name,123456789012"
+}
 ```
 
-If the owner (account ID) of the source bucket differs from the account used to configure the Terraform AWS Provider,
-the S3 bucket logging resource should be imported using the `bucket` and `expected_bucket_owner` separated by a comma (`,`) e.g.,
+**Using `terraform import` to import** S3 bucket logging using the `bucket` or using the `bucket` and `expected_bucket_owner` separated by a comma (`,`). For example:
+
+If the owner (account ID) of the source bucket is the same account used to configure the Terraform AWS Provider, import using the `bucket`:
 
+```console
+% terraform import aws_s3_bucket_logging.example bucket-name
 ```
-$ terraform import aws_s3_bucket_logging.example bucket-name,123456789012
+
+If the owner (account ID) of the source bucket differs from the account used to configure the Terraform AWS Provider, import using the `bucket` and `expected_bucket_owner` separated by a comma (`,`):
+
+```console
+% terraform import aws_s3_bucket_logging.example bucket-name,123456789012
 ```
diff --git a/website/docs/r/s3_bucket_metric.html.markdown b/website/docs/r/s3_bucket_metric.html.markdown
index 1b0b17796c3..5775d8c1694 100644
--- a/website/docs/r/s3_bucket_metric.html.markdown
+++ b/website/docs/r/s3_bucket_metric.html.markdown
@@ -49,7 +49,7 @@ resource "aws_s3_bucket_metric" "example-filtered" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `bucket` - (Required) Name of the bucket to put metric configuration.
 * `name` - (Required) Unique identifier of the metrics configuration for the bucket. Must be less than or equal to 64 characters in length.
@@ -62,14 +62,23 @@ The `filter` metric configuration supports the following:
 * `prefix` - (Optional) Object prefix for filtering (singular).
 * `tags` - (Optional) Object tags for filtering (up to 10).
 
-## Attributes Reference
+## Attribute Reference
 
-No additional attributes are exported.
+This resource exports no additional attributes.
 
 ## Import
 
-S3 bucket metric configurations can be imported using `bucket:metric`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import S3 bucket metric configurations using `bucket:metric`. For example:
 
+```terraform
+import {
+  to = aws_s3_bucket_metric.my-bucket-entire-bucket
+  id = "my-bucket:EntireBucket"
+}
 ```
-$ terraform import aws_s3_bucket_metric.my-bucket-entire-bucket my-bucket:EntireBucket
+
+Using `terraform import`, import S3 bucket metric configurations using `bucket:metric`. For example:
+
+```console
+% terraform import aws_s3_bucket_metric.my-bucket-entire-bucket my-bucket:EntireBucket
 ```
diff --git a/website/docs/r/s3_bucket_notification.html.markdown b/website/docs/r/s3_bucket_notification.html.markdown
index f9922dc169a..c4bb1b596c0 100644
--- a/website/docs/r/s3_bucket_notification.html.markdown
+++ b/website/docs/r/s3_bucket_notification.html.markdown
@@ -355,14 +355,23 @@ The following arguments are optional:
 * `id` - (Optional) Unique identifier for each of the notification configurations.
 * `topic_arn` - (Required) SNS topic ARN.
 
-## Attributes Reference
+## Attribute Reference
 
-No additional attributes are exported.
+This resource exports no additional attributes.
 
 ## Import
 
-S3 bucket notification can be imported using the `bucket`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import S3 bucket notification using the `bucket`. For example:
 
+```terraform
+import {
+  to = aws_s3_bucket_notification.bucket_notification
+  id = "bucket-name"
+}
 ```
-$ terraform import aws_s3_bucket_notification.bucket_notification bucket-name
+
+Using `terraform import`, import S3 bucket notification using the `bucket`. For example:
+
+```console
+% terraform import aws_s3_bucket_notification.bucket_notification bucket-name
 ```
diff --git a/website/docs/r/s3_bucket_object.html.markdown b/website/docs/r/s3_bucket_object.html.markdown
index 22c91343255..dd18f3e4469 100644
--- a/website/docs/r/s3_bucket_object.html.markdown
+++ b/website/docs/r/s3_bucket_object.html.markdown
@@ -169,9 +169,9 @@ If no content is provided through `source`, `content` or `content_base64`, then
 
 -> **Note:** Terraform ignores all leading `/`s in the object's `key` and treats multiple `/`s in the rest of the object's `key` as a single `/`, so values of `/index.html` and `index.html` correspond to the same S3 object as do `first//second///third//` and `first/second/third/`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `etag` - ETag generated for the object (an MD5 sum of the object content). For plaintext objects or objects encrypted with an AWS-managed key, the hash is an MD5 digest of the object data. For objects encrypted with a KMS key or objects created by either the Multipart Upload or Part Copy operation, the hash is not an MD5 digest, regardless of the method of encryption. More information on possible values can be found on [Common Response Headers](https://docs.aws.amazon.com/AmazonS3/latest/API/RESTCommonResponseHeaders.html).
 * `id` - `key` of the resource supplied above
@@ -180,14 +180,36 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Objects can be imported using the `id`. The `id` is the bucket name and the key together e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import objects using the `id` or S3 URL. For example:
 
+Import using the `id`, which is the bucket name and the key together:
+
+```terraform
+import {
+  to = aws_s3_bucket_object.example
+  id = "some-bucket-name/some/key.txt"
+}
 ```
-$ terraform import aws_s3_bucket_object.object some-bucket-name/some/key.txt
+
+Import using S3 URL syntax:
+
+```terraform
+import {
+  to = aws_s3_bucket_object.example
+  id = "s3://some-bucket-name/some/key.txt"
+}
 ```
 
-Additionally, s3 url syntax can be used, e.g.,
+**Using `terraform import` to import** objects using the `id` or S3 URL. For example:
+
+Import using the `id`, which is the bucket name and the key together:
 
+```console
+% terraform import aws_s3_bucket_object.example some-bucket-name/some/key.txt
 ```
-$ terraform import aws_s3_bucket_object.object s3://some-bucket-name/some/key.txt
+
+Import using S3 URL syntax:
+
+```console
+% terraform import aws_s3_bucket_object.example s3://some-bucket-name/some/key.txt
 ```
diff --git a/website/docs/r/s3_bucket_object_lock_configuration.html.markdown b/website/docs/r/s3_bucket_object_lock_configuration.html.markdown
index c8acbc6d860..5d0ef168df6 100644
--- a/website/docs/r/s3_bucket_object_lock_configuration.html.markdown
+++ b/website/docs/r/s3_bucket_object_lock_configuration.html.markdown
@@ -82,7 +82,7 @@ resource "aws_s3_bucket_object_lock_configuration" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `bucket` - (Required, Forces new resource) Name of the bucket.
 * `expected_bucket_owner` - (Optional, Forces new resource) Account ID of the expected bucket owner.
@@ -105,26 +105,42 @@ The `default_retention` configuration block supports the following arguments:
 * `mode` - (Required) Default Object Lock retention mode you want to apply to new objects placed in the specified bucket. Valid values: `COMPLIANCE`, `GOVERNANCE`.
 * `years` - (Optional, Required if `days` is not specified) Number of years that you want to specify for the default retention period.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The `bucket` or `bucket` and `expected_bucket_owner` separated by a comma (`,`) if the latter is provided.
 
 ## Import
 
-S3 bucket Object Lock configuration can be imported in one of two ways.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import S3 bucket Object Lock configuration using the `bucket` or using the `bucket` and `expected_bucket_owner` separated by a comma (`,`). For example:
 
-If the owner (account ID) of the source bucket is the same account used to configure the Terraform AWS Provider,
-the S3 bucket Object Lock configuration resource should be imported using the `bucket` e.g.,
+If the owner (account ID) of the source bucket is the same account used to configure the Terraform AWS Provider, import using the `bucket`:
 
-```
-$ terraform import aws_s3_bucket_object_lock_configuration.example bucket-name
+```terraform
+import {
+  to = aws_s3_bucket_object_lock_configuration.example
+  id = "bucket-name"
+}
 ```
 
-If the owner (account ID) of the source bucket differs from the account used to configure the Terraform AWS Provider,
-the S3 bucket Object Lock configuration resource should be imported using the `bucket` and `expected_bucket_owner` separated by a comma (`,`) e.g.,
+If the owner (account ID) of the source bucket differs from the account used to configure the Terraform AWS Provider, import using the `bucket` and `expected_bucket_owner` separated by a comma (`,`):
+
+import {
+  to = aws_s3_bucket_object_lock_configuration.example
+  id = "bucket-name,123456789012"
+}
 
+**Using `terraform import` to import** S3 bucket Object Lock configuration using the `bucket` or using the `bucket` and `expected_bucket_owner` separated by a comma (`,`). For example:
+
+If the owner (account ID) of the source bucket is the same account used to configure the Terraform AWS Provider, import using the `bucket`:
+
+```console
+% terraform import aws_s3_bucket_object_lock_configuration.example bucket-name
 ```
-$ terraform import aws_s3_bucket_object_lock_configuration.example bucket-name,123456789012
+
+If the owner (account ID) of the source bucket differs from the account used to configure the Terraform AWS Provider, import using the `bucket` and `expected_bucket_owner` separated by a comma (`,`):
+
+```console
+% terraform import aws_s3_bucket_object_lock_configuration.example bucket-name,123456789012
 ```
diff --git a/website/docs/r/s3_bucket_ownership_controls.html.markdown b/website/docs/r/s3_bucket_ownership_controls.html.markdown
index e5b8c97de62..042e8e50836 100644
--- a/website/docs/r/s3_bucket_ownership_controls.html.markdown
+++ b/website/docs/r/s3_bucket_ownership_controls.html.markdown
@@ -42,16 +42,25 @@ The following arguments are required:
     * `ObjectWriter` - Uploading account will own the object if the object is uploaded with the `bucket-owner-full-control` canned ACL.
     * `BucketOwnerEnforced` - Bucket owner automatically owns and has full control over every object in the bucket. ACLs no longer affect permissions to data in the S3 bucket.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - S3 Bucket name.
 
 ## Import
 
-S3 Bucket Ownership Controls can be imported using S3 Bucket name, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import S3 Bucket Ownership Controls using S3 Bucket name. For example:
 
+```terraform
+import {
+  to = aws_s3_bucket_ownership_controls.example
+  id = "my-bucket"
+}
 ```
-$ terraform import aws_s3_bucket_ownership_controls.example my-bucket
+
+Using `terraform import`, import S3 Bucket Ownership Controls using S3 Bucket name. For example:
+
+```console
+% terraform import aws_s3_bucket_ownership_controls.example my-bucket
 ```
diff --git a/website/docs/r/s3_bucket_policy.html.markdown b/website/docs/r/s3_bucket_policy.html.markdown
index c8a7a23726c..e9fcffd7d0a 100644
--- a/website/docs/r/s3_bucket_policy.html.markdown
+++ b/website/docs/r/s3_bucket_policy.html.markdown
@@ -46,19 +46,28 @@ data "aws_iam_policy_document" "allow_access_from_another_account" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `bucket` - (Required) Name of the bucket to which to apply the policy.
 * `policy` - (Required) Text of the policy. Although this is a bucket policy rather than an IAM policy, the [`aws_iam_policy_document`](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) data source may be used, so long as it specifies a principal. For more information about building AWS IAM policy documents with Terraform, see the [AWS IAM Policy Document Guide](https://learn.hashicorp.com/terraform/aws/iam-policy). Note: Bucket policies are limited to 20 KB in size.
 
-## Attributes Reference
+## Attribute Reference
 
-No additional attributes are exported.
+This resource exports no additional attributes.
 
 ## Import
 
-S3 bucket policies can be imported using the bucket name, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import S3 bucket policies using the bucket name. For example:
 
+```terraform
+import {
+  to = aws_s3_bucket_policy.allow_access_from_another_account
+  id = "my-tf-test-bucket"
+}
 ```
-$ terraform import aws_s3_bucket_policy.allow_access_from_another_account my-tf-test-bucket
+
+Using `terraform import`, import S3 bucket policies using the bucket name. For example:
+
+```console
+% terraform import aws_s3_bucket_policy.allow_access_from_another_account my-tf-test-bucket
 ```
diff --git a/website/docs/r/s3_bucket_public_access_block.html.markdown b/website/docs/r/s3_bucket_public_access_block.html.markdown
index 035e2cb2c7d..e8a4087fbdf 100644
--- a/website/docs/r/s3_bucket_public_access_block.html.markdown
+++ b/website/docs/r/s3_bucket_public_access_block.html.markdown
@@ -29,7 +29,7 @@ resource "aws_s3_bucket_public_access_block" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `bucket` - (Required) S3 Bucket to which this Public Access Block configuration should be applied.
 * `block_public_acls` - (Optional) Whether Amazon S3 should block public ACLs for this bucket. Defaults to `false`. Enabling this setting does not affect existing policies or ACLs. When set to `true` causes the following behavior:
@@ -42,16 +42,25 @@ The following arguments are supported:
 * `restrict_public_buckets` - (Optional) Whether Amazon S3 should restrict public bucket policies for this bucket. Defaults to `false`. Enabling this setting does not affect the previously stored bucket policy, except that public and cross-account access within the public bucket policy, including non-public delegation to specific accounts, is blocked. When set to `true`:
     * Only the bucket owner and AWS Services can access this buckets if it has a public policy.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Name of the S3 bucket the configuration is attached to
 
 ## Import
 
-`aws_s3_bucket_public_access_block` can be imported by using the bucket name, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_s3_bucket_public_access_block` using the bucket name. For example:
 
+```terraform
+import {
+  to = aws_s3_bucket_public_access_block.example
+  id = "my-bucket"
+}
 ```
-$ terraform import aws_s3_bucket_public_access_block.example my-bucket
+
+Using `terraform import`, import `aws_s3_bucket_public_access_block` using the bucket name. For example:
+
+```console
+% terraform import aws_s3_bucket_public_access_block.example my-bucket
 ```
diff --git a/website/docs/r/s3_bucket_replication_configuration.html.markdown b/website/docs/r/s3_bucket_replication_configuration.html.markdown
index a98ef7f1a4b..de41dc3ef42 100644
--- a/website/docs/r/s3_bucket_replication_configuration.html.markdown
+++ b/website/docs/r/s3_bucket_replication_configuration.html.markdown
@@ -228,7 +228,7 @@ resource "aws_s3_bucket_replication_configuration" "west_to_east" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `bucket` - (Required) Name of the source S3 bucket you want Amazon S3 to monitor.
 * `role` - (Required) ARN of the IAM role for Amazon S3 to assume when replicating the objects.
@@ -421,16 +421,25 @@ The `sse_kms_encrypted_objects` configuration block supports the following argum
 
 * `status` - (Required) Whether the existing objects should be replicated. Either `"Enabled"` or `"Disabled"`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - S3 source bucket name.
 
 ## Import
 
-S3 bucket replication configuration can be imported using the `bucket`, e.g.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import S3 bucket replication configuration using the `bucket`. For example:
 
-```sh
-$ terraform import aws_s3_bucket_replication_configuration.replication bucket-name
+```terraform
+import {
+  to = aws_s3_bucket_replication_configuration.replication
+  id = "bucket-name"
+}
+```
+
+Using `terraform import`, import S3 bucket replication configuration using the `bucket`. For example:
+
+```console
+% terraform import aws_s3_bucket_replication_configuration.replication bucket-name
 ```
diff --git a/website/docs/r/s3_bucket_request_payment_configuration.html.markdown b/website/docs/r/s3_bucket_request_payment_configuration.html.markdown
index de2eb88ecd0..d49b95ef4f2 100644
--- a/website/docs/r/s3_bucket_request_payment_configuration.html.markdown
+++ b/website/docs/r/s3_bucket_request_payment_configuration.html.markdown
@@ -23,32 +23,50 @@ resource "aws_s3_bucket_request_payment_configuration" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `bucket` - (Required, Forces new resource) Name of the bucket.
 * `expected_bucket_owner` - (Optional, Forces new resource) Account ID of the expected bucket owner.
 * `payer` - (Required) Specifies who pays for the download and request fees. Valid values: `BucketOwner`, `Requester`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The `bucket` or `bucket` and `expected_bucket_owner` separated by a comma (`,`) if the latter is provided.
 
 ## Import
 
-S3 bucket request payment configuration can be imported in one of two ways.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import S3 bucket request payment configuration using the `bucket` or using the `bucket` and `expected_bucket_owner` separated by a comma (`,`). For example:
 
-If the owner (account ID) of the source bucket is the same account used to configure the Terraform AWS Provider,
-the S3 bucket request payment configuration resource should be imported using the `bucket` e.g.,
+If the owner (account ID) of the source bucket is the same account used to configure the Terraform AWS Provider, import using the `bucket`:
 
+```terraform
+import {
+  to = aws_s3_bucket_request_payment_configuration.example
+  id = "bucket-name"
+}
 ```
-$ terraform import aws_s3_bucket_request_payment_configuration.example bucket-name
+
+If the owner (account ID) of the source bucket differs from the account used to configure the Terraform AWS Provider, import using the `bucket` and `expected_bucket_owner` separated by a comma (`,`):
+
+```terraform
+import {
+  to = aws_s3_bucket_request_payment_configuration.example
+  id = "bucket-name,123456789012"
+}
 ```
 
-If the owner (account ID) of the source bucket differs from the account used to configure the Terraform AWS Provider,
-the S3 bucket request payment configuration resource should be imported using the `bucket` and `expected_bucket_owner` separated by a comma (`,`) e.g.,
+**Using `terraform import` to import** S3 bucket request payment configuration using the `bucket` or using the `bucket` and `expected_bucket_owner` separated by a comma (`,`). For example:
+
+If the owner (account ID) of the source bucket is the same account used to configure the Terraform AWS Provider, import using the `bucket`:
 
+```console
+% terraform import aws_s3_bucket_request_payment_configuration.example bucket-name
 ```
-$ terraform import aws_s3_bucket_request_payment_configuration.example bucket-name,123456789012
+
+If the owner (account ID) of the source bucket differs from the account used to configure the Terraform AWS Provider, import using the `bucket` and `expected_bucket_owner` separated by a comma (`,`):
+
+```console
+% terraform import aws_s3_bucket_request_payment_configuration.example bucket-name,123456789012
 ```
diff --git a/website/docs/r/s3_bucket_server_side_encryption_configuration.html.markdown b/website/docs/r/s3_bucket_server_side_encryption_configuration.html.markdown
index 0d5ad6d6f95..c42192abc19 100644
--- a/website/docs/r/s3_bucket_server_side_encryption_configuration.html.markdown
+++ b/website/docs/r/s3_bucket_server_side_encryption_configuration.html.markdown
@@ -10,6 +10,8 @@ description: |-
 
 Provides a S3 bucket server-side encryption configuration resource.
 
+~> **NOTE:** Destroying an `aws_s3_bucket_server_side_encryption_configuration` resource resets the bucket to [Amazon S3 bucket default encryption](https://docs.aws.amazon.com/AmazonS3/latest/userguide/default-encryption-faq.html).
+
 ## Example Usage
 
 ```terraform
@@ -36,7 +38,7 @@ resource "aws_s3_bucket_server_side_encryption_configuration" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `bucket` - (Required, Forces new resource) ID (name) of the bucket.
 * `expected_bucket_owner` - (Optional, Forces new resource) Account ID of the expected bucket owner.
@@ -53,29 +55,47 @@ The `rule` configuration block supports the following arguments:
 
 The `apply_server_side_encryption_by_default` configuration block supports the following arguments:
 
-* `sse_algorithm` - (Required) Server-side encryption algorithm to use. Valid values are `AES256` and `aws:kms`
+* `sse_algorithm` - (Required) Server-side encryption algorithm to use. Valid values are `AES256`, `aws:kms`, and `aws:kms:dsse`
 * `kms_master_key_id` - (Optional) AWS KMS master key ID used for the SSE-KMS encryption. This can only be used when you set the value of `sse_algorithm` as `aws:kms`. The default `aws/s3` AWS KMS master key is used if this element is absent while the `sse_algorithm` is `aws:kms`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The `bucket` or `bucket` and `expected_bucket_owner` separated by a comma (`,`) if the latter is provided.
 
 ## Import
 
-S3 bucket server-side encryption configuration can be imported in one of two ways.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import S3 bucket server-side encryption configuration using the `bucket` or using the `bucket` and `expected_bucket_owner` separated by a comma (`,`). For example:
 
-If the owner (account ID) of the source bucket is the same account used to configure the Terraform AWS Provider,
-the S3 server-side encryption configuration resource should be imported using the `bucket` e.g.,
+If the owner (account ID) of the source bucket is the same account used to configure the Terraform AWS Provider, import using the `bucket`:
 
+```terraform
+import {
+  to = aws_s3_bucket_server_side_encryption_configuration.example
+  id = "bucket-name"
+}
 ```
-$ terraform import aws_s3_bucket_server_side_encryption_configuration.example bucket-name
+
+If the owner (account ID) of the source bucket differs from the account used to configure the Terraform AWS Provider, import using the `bucket` and `expected_bucket_owner` separated by a comma (`,`):
+
+```terraform
+import {
+  to = aws_s3_bucket_server_side_encryption_configuration.example
+  id = "bucket-name,123456789012"
+}
 ```
 
-If the owner (account ID) of the source bucket differs from the account used to configure the Terraform AWS Provider,
-the S3 bucket server-side encryption configuration resource should be imported using the `bucket` and `expected_bucket_owner` separated by a comma (`,`) e.g.,
+**Using `terraform import` to import** S3 bucket server-side encryption configuration using the `bucket` or using the `bucket` and `expected_bucket_owner` separated by a comma (`,`). For example:
+
+If the owner (account ID) of the source bucket is the same account used to configure the Terraform AWS Provider, import using the `bucket`:
 
+```console
+% terraform import aws_s3_bucket_server_side_encryption_configuration.example bucket-name
 ```
-$ terraform import aws_s3_bucket_server_side_encryption_configuration.example bucket-name,123456789012
+
+If the owner (account ID) of the source bucket differs from the account used to configure the Terraform AWS Provider, import using the `bucket` and `expected_bucket_owner` separated by a comma (`,`):
+
+```console
+% terraform import aws_s3_bucket_server_side_encryption_configuration.example bucket-name,123456789012
 ```
diff --git a/website/docs/r/s3_bucket_versioning.html.markdown b/website/docs/r/s3_bucket_versioning.html.markdown
index b2f43f171c1..dff0f5a199a 100644
--- a/website/docs/r/s3_bucket_versioning.html.markdown
+++ b/website/docs/r/s3_bucket_versioning.html.markdown
@@ -88,7 +88,7 @@ resource "aws_s3_object" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `bucket` - (Required, Forces new resource) Name of the S3 bucket.
 * `versioning_configuration` - (Required) Configuration block for the versioning parameters. [See below](#versioning_configuration).
@@ -105,26 +105,44 @@ The `versioning_configuration` configuration block supports the following argume
 * `status` - (Required) Versioning state of the bucket. Valid values: `Enabled`, `Suspended`, or `Disabled`. `Disabled` should only be used when creating or importing resources that correspond to unversioned S3 buckets.
 * `mfa_delete` - (Optional) Specifies whether MFA delete is enabled in the bucket versioning configuration. Valid values: `Enabled` or `Disabled`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The `bucket` or `bucket` and `expected_bucket_owner` separated by a comma (`,`) if the latter is provided.
 
 ## Import
 
-S3 bucket versioning can be imported in one of two ways.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import S3 bucket versioning using the `bucket` or using the `bucket` and `expected_bucket_owner` separated by a comma (`,`). For example:
 
-If the owner (account ID) of the source bucket is the same account used to configure the Terraform AWS Provider,
-the S3 bucket versioning resource should be imported using the `bucket` e.g.,
+If the owner (account ID) of the source bucket is the same account used to configure the Terraform AWS Provider, import using the `bucket`:
 
+```terraform
+import {
+  to = aws_s3_bucket_versioning.example
+  id = "bucket-name"
+}
 ```
-$ terraform import aws_s3_bucket_versioning.example bucket-name
+
+If the owner (account ID) of the source bucket differs from the account used to configure the Terraform AWS Provider, import using the `bucket` and `expected_bucket_owner` separated by a comma (`,`):
+
+```terraform
+import {
+  to = aws_s3_bucket_versioning.example
+  id = "bucket-name,123456789012"
+}
 ```
 
-If the owner (account ID) of the source bucket differs from the account used to configure the Terraform AWS Provider,
-the S3 bucket versioning resource should be imported using the `bucket` and `expected_bucket_owner` separated by a comma (`,`) e.g.,
+**Using `terraform import` to import** S3 bucket versioning using the `bucket` or using the `bucket` and `expected_bucket_owner` separated by a comma (`,`). For example:
+
+If the owner (account ID) of the source bucket is the same account used to configure the Terraform AWS Provider, import using the `bucket`:
 
+```console
+% terraform import aws_s3_bucket_versioning.example bucket-name
 ```
-$ terraform import aws_s3_bucket_versioning.example bucket-name,123456789012
+
+If the owner (account ID) of the source bucket differs from the account used to configure the Terraform AWS Provider, import using the `bucket` and `expected_bucket_owner` separated by a comma (`,`):
+
+```console
+% terraform import aws_s3_bucket_versioning.example bucket-name,123456789012
 ```
diff --git a/website/docs/r/s3_bucket_website_configuration.html.markdown b/website/docs/r/s3_bucket_website_configuration.html.markdown
index 022a97ee8e6..31580d55077 100644
--- a/website/docs/r/s3_bucket_website_configuration.html.markdown
+++ b/website/docs/r/s3_bucket_website_configuration.html.markdown
@@ -66,7 +66,7 @@ EOF
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `bucket` - (Required, Forces new resource) Name of the bucket.
 * `error_document` - (Optional, Conflicts with `redirect_all_requests_to`) Name of the error document for the website. [See below](#error_document).
@@ -122,9 +122,9 @@ The `redirect` configuration block supports the following arguments:
 * `replace_key_prefix_with` - (Optional, Conflicts with `replace_key_with`) Object key prefix to use in the redirect request. For example, to redirect requests for all pages with prefix `docs/` (objects in the `docs/` folder) to `documents/`, you can set a `condition` block with `key_prefix_equals` set to `docs/` and in the `redirect` set `replace_key_prefix_with` to `/documents`.
 * `replace_key_with` - (Optional, Conflicts with `replace_key_prefix_with`) Specific object key to use in the redirect request. For example, redirect request to `error.html`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The `bucket` or `bucket` and `expected_bucket_owner` separated by a comma (`,`) if the latter is provided.
 * `website_domain` - Domain of the website endpoint. This is used to create Route 53 alias records.
@@ -132,18 +132,36 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-S3 bucket website configuration can be imported in one of two ways.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import S3 bucket website configuration using the `bucket` or using the `bucket` and `expected_bucket_owner` separated by a comma (`,`). For example:
 
-If the owner (account ID) of the source bucket is the same account used to configure the Terraform AWS Provider,
-the S3 bucket website configuration resource should be imported using the `bucket` e.g.,
+If the owner (account ID) of the source bucket is the same account used to configure the Terraform AWS Provider, import using the `bucket`:
 
+```terraform
+import {
+  to = aws_s3_bucket_website_configuration.example
+  id = "bucket-name"
+}
 ```
-$ terraform import aws_s3_bucket_website_configuration.example bucket-name
+
+If the owner (account ID) of the source bucket differs from the account used to configure the Terraform AWS Provider, import using the `bucket` and `expected_bucket_owner` separated by a comma (`,`):
+
+```terraform
+import {
+  to = aws_s3_bucket_website_configuration.example
+  id = "bucket-name,123456789012"
+}
 ```
 
-If the owner (account ID) of the source bucket differs from the account used to configure the Terraform AWS Provider,
-the S3 bucket website configuration resource should be imported using the `bucket` and `expected_bucket_owner` separated by a comma (`,`) e.g.,
+**Using `terraform import` to import** S3 bucket website configuration using the `bucket` or using the `bucket` and `expected_bucket_owner` separated by a comma (`,`). For example:
+
+If the owner (account ID) of the source bucket is the same account used to configure the Terraform AWS Provider, import using the `bucket`:
 
+```console
+% terraform import aws_s3_bucket_website_configuration.example bucket-name
 ```
-$ terraform import aws_s3_bucket_website_configuration.example bucket-name,123456789012
+
+If the owner (account ID) of the source bucket differs from the account used to configure the Terraform AWS Provider, import using the `bucket` and `expected_bucket_owner` separated by a comma (`,`):
+
+```console
+% terraform import aws_s3_bucket_website_configuration.example bucket-name,123456789012
 ```
diff --git a/website/docs/r/s3_object.html.markdown b/website/docs/r/s3_object.html.markdown
index 39fa32c6815..9bb45d8f794 100644
--- a/website/docs/r/s3_object.html.markdown
+++ b/website/docs/r/s3_object.html.markdown
@@ -143,6 +143,7 @@ The following arguments are optional:
 * `acl` - (Optional) [Canned ACL](https://docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html#canned-acl) to apply. Valid values are `private`, `public-read`, `public-read-write`, `aws-exec-read`, `authenticated-read`, `bucket-owner-read`, and `bucket-owner-full-control`.
 * `bucket_key_enabled` - (Optional) Whether or not to use [Amazon S3 Bucket Keys](https://docs.aws.amazon.com/AmazonS3/latest/dev/bucket-key.html) for SSE-KMS.
 * `cache_control` - (Optional) Caching behavior along the request/reply chain Read [w3c cache_control](http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.9) for further details.
+* `checksum_algorithm` - (Optional) Indicates the algorithm used to create the checksum for the object. If a value is specified and the object is encrypted with KMS, you must have permission to use the `kms:Decrypt` action. Valid values: `CRC32`, `CRC32C`, `SHA1`, `SHA256`.
 * `content_base64` - (Optional, conflicts with `source` and `content`) Base64-encoded data that will be decoded and uploaded as raw bytes for the object content. This allows safely uploading non-UTF8 binary data, but is recommended only for small content such as the result of the `gzipbase64` function with small text strings. For larger objects, use `source` to stream the content from a disk file.
 * `content_disposition` - (Optional) Presentational information for the object. Read [w3c content_disposition](http://www.w3.org/Protocols/rfc2616/rfc2616-sec19.html#sec19.5.1) for further information.
 * `content_encoding` - (Optional) Content encodings that have been applied to the object and thus what decoding mechanisms must be applied to obtain the media-type referenced by the Content-Type header field. Read [w3c content encoding](http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.11) for further information.
@@ -167,10 +168,14 @@ If no content is provided through `source`, `content` or `content_base64`, then
 
 -> **Note:** Terraform ignores all leading `/`s in the object's `key` and treats multiple `/`s in the rest of the object's `key` as a single `/`, so values of `/index.html` and `index.html` correspond to the same S3 object as do `first//second///third//` and `first/second/third/`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
+* `checksum_crc32` - The base64-encoded, 32-bit CRC32 checksum of the object.
+* `checksum_crc32c` - The base64-encoded, 32-bit CRC32C checksum of the object.
+* `checksum_sha1` - The base64-encoded, 160-bit SHA-1 digest of the object.
+* `checksum_sha256` - The base64-encoded, 256-bit SHA-256 digest of the object.
 * `etag` - ETag generated for the object (an MD5 sum of the object content). For plaintext objects or objects encrypted with an AWS-managed key, the hash is an MD5 digest of the object data. For objects encrypted with a KMS key or objects created by either the Multipart Upload or Part Copy operation, the hash is not an MD5 digest, regardless of the method of encryption. More information on possible values can be found on [Common Response Headers](https://docs.aws.amazon.com/AmazonS3/latest/API/RESTCommonResponseHeaders.html).
 * `id` - `key` of the resource supplied above
 * `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
@@ -178,14 +183,36 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Objects can be imported using the `id`. The `id` is the bucket name and the key together e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import objects using the `id` or S3 URL. For example:
 
+Import using the `id`, which is the bucket name and the key together:
+
+```terraform
+import {
+  to = aws_s3_object.example
+  id = "some-bucket-name/some/key.txt"
+}
 ```
-$ terraform import aws_s3_object.object some-bucket-name/some/key.txt
+
+Import using S3 URL syntax:
+
+```terraform
+import {
+  to = aws_s3_object.example
+  id = "s3://some-bucket-name/some/key.txt"
+}
 ```
 
-Additionally, s3 url syntax can be used, e.g.,
+**Using `terraform import` to import** objects using the `id` or S3 URL. For example:
+
+Import using the `id`, which is the bucket name and the key together:
 
+```console
+% terraform import aws_s3_object.example some-bucket-name/some/key.txt
 ```
-$ terraform import aws_s3_object.object s3://some-bucket-name/some/key.txt
+
+Import using S3 URL syntax:
+
+```console
+% terraform import aws_s3_object.example s3://some-bucket-name/some/key.txt
 ```
diff --git a/website/docs/r/s3_object_copy.html.markdown b/website/docs/r/s3_object_copy.html.markdown
index 74f6ebe2867..bb89f797585 100644
--- a/website/docs/r/s3_object_copy.html.markdown
+++ b/website/docs/r/s3_object_copy.html.markdown
@@ -38,6 +38,7 @@ The following arguments are optional:
 
 * `acl` - (Optional) [Canned ACL](https://docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html#canned-acl) to apply. Valid values are `private`, `public-read`, `public-read-write`, `authenticated-read`, `aws-exec-read`, `bucket-owner-read`, and `bucket-owner-full-control`. Conflicts with `grant`.
 * `cache_control` - (Optional) Specifies caching behavior along the request/reply chain Read [w3c cache_control](http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.9) for further details.
+* `checksum_algorithm` - (Optional) Indicates the algorithm used to create the checksum for the object. If a value is specified and the object is encrypted with KMS, you must have permission to use the `kms:Decrypt` action. Valid values: `CRC32`, `CRC32C`, `SHA1`, `SHA256`.
 * `content_disposition` - (Optional) Specifies presentational information for the object. Read [w3c content_disposition](http://www.w3.org/Protocols/rfc2616/rfc2616-sec19.html#sec19.5.1) for further information.
 * `content_encoding` - (Optional) Specifies what content encodings have been applied to the object and thus what decoding mechanisms must be applied to obtain the media-type referenced by the Content-Type header field. Read [w3c content encoding](http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.11) for further information.
 * `content_language` - (Optional) Language the content is in e.g., en-US or en-GB.
@@ -88,10 +89,14 @@ This configuration block has the following optional arguments (one of the three
 
 -> **Note:** Terraform ignores all leading `/`s in the object's `key` and treats multiple `/`s in the rest of the object's `key` as a single `/`, so values of `/index.html` and `index.html` correspond to the same S3 object as do `first//second///third//` and `first/second/third/`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
+* `checksum_crc32` - The base64-encoded, 32-bit CRC32 checksum of the object.
+* `checksum_crc32c` - The base64-encoded, 32-bit CRC32C checksum of the object.
+* `checksum_sha1` - The base64-encoded, 160-bit SHA-1 digest of the object.
+* `checksum_sha256` - The base64-encoded, 256-bit SHA-256 digest of the object.
 * `etag` - ETag generated for the object (an MD5 sum of the object content). For plaintext objects or objects encrypted with an AWS-managed key, the hash is an MD5 digest of the object data. For objects encrypted with a KMS key or objects created by either the Multipart Upload or Part Copy operation, the hash is not an MD5 digest, regardless of the method of encryption. More information on possible values can be found on [Common Response Headers](https://docs.aws.amazon.com/AmazonS3/latest/API/RESTCommonResponseHeaders.html).
 * `expiration` - If the object expiration is configured, this attribute will be set.
 * `id` - The `key` of the resource supplied above.
diff --git a/website/docs/r/s3control_access_point_policy.html.markdown b/website/docs/r/s3control_access_point_policy.html.markdown
index f921b22f6ef..825b4be6bd4 100644
--- a/website/docs/r/s3control_access_point_policy.html.markdown
+++ b/website/docs/r/s3control_access_point_policy.html.markdown
@@ -54,22 +54,31 @@ resource "aws_s3control_access_point_policy" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `access_point_arn` - (Required) The ARN of the access point that you want to associate with the specified policy.
 * `policy` - (Required) The policy that you want to apply to the specified access point.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `has_public_access_policy` - Indicates whether this access point currently has a policy that allows public access.
 * `id` - The AWS account ID and access point name separated by a colon (`:`).
 
 ## Import
 
-Access Point policies can be imported using the `access_point_arn`, e.g.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Access Point policies using the `access_point_arn`. For example:
 
+```terraform
+import {
+  to = aws_s3control_access_point_policy.example
+  id = "arn:aws:s3:us-west-2:123456789012:accesspoint/example"
+}
 ```
-$ terraform import aws_s3control_access_point_policy.example arn:aws:s3:us-west-2:123456789012:accesspoint/example
+
+Using `terraform import`, import Access Point policies using the `access_point_arn`. For example:
+
+```console
+% terraform import aws_s3control_access_point_policy.example arn:aws:s3:us-west-2:123456789012:accesspoint/example
 ```
diff --git a/website/docs/r/s3control_bucket.html.markdown b/website/docs/r/s3control_bucket.html.markdown
index c73b4dc7f6a..91932a2a036 100644
--- a/website/docs/r/s3control_bucket.html.markdown
+++ b/website/docs/r/s3control_bucket.html.markdown
@@ -29,9 +29,9 @@ The following arguments are required:
 * `outpost_id` - (Required) Identifier of the Outpost to contain this bucket.
 * `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name (ARN) of the bucket.
 * `creation_date` - UTC creation date in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8).
@@ -41,8 +41,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-S3 Control Buckets can be imported using Amazon Resource Name (ARN), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import S3 Control Buckets using Amazon Resource Name (ARN). For example:
 
+```terraform
+import {
+  to = aws_s3control_bucket.example
+  id = "arn:aws:s3-outposts:us-east-1:123456789012:outpost/op-12345678/bucket/example"
+}
 ```
-$ terraform import aws_s3control_bucket.example arn:aws:s3-outposts:us-east-1:123456789012:outpost/op-12345678/bucket/example
+
+Using `terraform import`, import S3 Control Buckets using Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_s3control_bucket.example arn:aws:s3-outposts:us-east-1:123456789012:outpost/op-12345678/bucket/example
 ```
diff --git a/website/docs/r/s3control_bucket_lifecycle_configuration.html.markdown b/website/docs/r/s3control_bucket_lifecycle_configuration.html.markdown
index 23be7c5e719..65234b73d83 100644
--- a/website/docs/r/s3control_bucket_lifecycle_configuration.html.markdown
+++ b/website/docs/r/s3control_bucket_lifecycle_configuration.html.markdown
@@ -64,16 +64,25 @@ The following arguments are required:
     * `id` - (Required) Unique identifier for the rule.
     * `status` - (Optional) Status of the rule. Valid values: `Enabled` and `Disabled`. Defaults to `Enabled`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Amazon Resource Name (ARN) of the bucket.
 
 ## Import
 
-S3 Control Bucket Lifecycle Configurations can be imported using the Amazon Resource Name (ARN), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import S3 Control Bucket Lifecycle Configurations using the Amazon Resource Name (ARN). For example:
 
+```terraform
+import {
+  to = aws_s3control_bucket_lifecycle_configuration.example
+  id = "arn:aws:s3-outposts:us-east-1:123456789012:outpost/op-12345678/bucket/example"
+}
 ```
-$ terraform import aws_s3control_bucket_lifecycle_configuration.example arn:aws:s3-outposts:us-east-1:123456789012:outpost/op-12345678/bucket/example
+
+Using `terraform import`, import S3 Control Bucket Lifecycle Configurations using the Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_s3control_bucket_lifecycle_configuration.example arn:aws:s3-outposts:us-east-1:123456789012:outpost/op-12345678/bucket/example
 ```
diff --git a/website/docs/r/s3control_bucket_policy.html.markdown b/website/docs/r/s3control_bucket_policy.html.markdown
index e55044ef307..5aef955284f 100644
--- a/website/docs/r/s3control_bucket_policy.html.markdown
+++ b/website/docs/r/s3control_bucket_policy.html.markdown
@@ -42,16 +42,25 @@ The following arguments are required:
 * `bucket` - (Required) Amazon Resource Name (ARN) of the bucket.
 * `policy` - (Required) JSON string of the resource policy. For more information about building AWS IAM policy documents with Terraform, see the [AWS IAM Policy Document Guide](https://learn.hashicorp.com/terraform/aws/iam-policy).
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Amazon Resource Name (ARN) of the bucket.
 
 ## Import
 
-S3 Control Bucket Policies can be imported using the Amazon Resource Name (ARN), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import S3 Control Bucket Policies using the Amazon Resource Name (ARN). For example:
 
+```terraform
+import {
+  to = aws_s3control_bucket_policy.example
+  id = "arn:aws:s3-outposts:us-east-1:123456789012:outpost/op-12345678/bucket/example"
+}
 ```
-$ terraform import aws_s3control_bucket_policy.example arn:aws:s3-outposts:us-east-1:123456789012:outpost/op-12345678/bucket/example
+
+Using `terraform import`, import S3 Control Bucket Policies using the Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_s3control_bucket_policy.example arn:aws:s3-outposts:us-east-1:123456789012:outpost/op-12345678/bucket/example
 ```
diff --git a/website/docs/r/s3control_multi_region_access_point.html.markdown b/website/docs/r/s3control_multi_region_access_point.html.markdown
index 0df25fcdfd2..3d0563b4c6c 100644
--- a/website/docs/r/s3control_multi_region_access_point.html.markdown
+++ b/website/docs/r/s3control_multi_region_access_point.html.markdown
@@ -54,7 +54,7 @@ resource "aws_s3control_multi_region_access_point" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `account_id` - (Optional) The AWS account ID for the owner of the buckets for which you want to create a Multi-Region Access Point. Defaults to automatically determined account ID of the Terraform AWS provider.
 * `details` - (Required) A configuration block containing details about the Multi-Region Access Point. See [Details Configuration Block](#details-configuration) below for more details
@@ -96,10 +96,11 @@ The `public_access_block` block supports the following:
 The `region` block supports the following:
 
 * `bucket` - (Required) The name of the associated bucket for the Region.
+* `bucket_account_id` - (Optional) The AWS account ID that owns the Amazon S3 bucket that's associated with this Multi-Region Access Point.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `alias` - The alias for the Multi-Region Access Point.
 * `arn` - Amazon Resource Name (ARN) of the Multi-Region Access Point.
@@ -109,8 +110,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Multi-Region Access Points can be imported using the `account_id` and `name` of the Multi-Region Access Point separated by a colon (`:`), e.g.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Multi-Region Access Points using the `account_id` and `name` of the Multi-Region Access Point separated by a colon (`:`). For example:
 
+```terraform
+import {
+  to = aws_s3control_multi_region_access_point.example
+  id = "123456789012:example"
+}
 ```
-$ terraform import aws_s3control_multi_region_access_point.example 123456789012:example
+
+Using `terraform import`, import Multi-Region Access Points using the `account_id` and `name` of the Multi-Region Access Point separated by a colon (`:`). For example:
+
+```console
+% terraform import aws_s3control_multi_region_access_point.example 123456789012:example
 ```
diff --git a/website/docs/r/s3control_multi_region_access_point_policy.html.markdown b/website/docs/r/s3control_multi_region_access_point_policy.html.markdown
index 7c0422e1341..7b89d2a2a25 100644
--- a/website/docs/r/s3control_multi_region_access_point_policy.html.markdown
+++ b/website/docs/r/s3control_multi_region_access_point_policy.html.markdown
@@ -55,7 +55,7 @@ resource "aws_s3control_multi_region_access_point_policy" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `account_id` - (Optional) The AWS account ID for the owner of the Multi-Region Access Point. Defaults to automatically determined account ID of the Terraform AWS provider.
 * `details` - (Required) A configuration block containing details about the policy for the Multi-Region Access Point. See [Details Configuration Block](#details-configuration) below for more details
@@ -69,9 +69,9 @@ The `details` block supports the following:
 
 -> **NOTE:** When you update the `policy`, the update is first listed as the proposed policy. After the update is finished and all Regions have been updated, the proposed policy is listed as the established policy. If both policies have the same version number, the proposed policy is the established policy.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `established` - The last established policy for the Multi-Region Access Point.
 * `id` - The AWS account ID and access point name separated by a colon (`:`).
@@ -86,8 +86,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Multi-Region Access Point Policies can be imported using the `account_id` and `name` of the Multi-Region Access Point separated by a colon (`:`), e.g.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Multi-Region Access Point Policies using the `account_id` and `name` of the Multi-Region Access Point separated by a colon (`:`). For example:
 
+```terraform
+import {
+  to = aws_s3control_multi_region_access_point_policy.example
+  id = "123456789012:example"
+}
 ```
-$ terraform import aws_s3control_multi_region_access_point_policy.example 123456789012:example
+
+Using `terraform import`, import Multi-Region Access Point Policies using the `account_id` and `name` of the Multi-Region Access Point separated by a colon (`:`). For example:
+
+```console
+% terraform import aws_s3control_multi_region_access_point_policy.example 123456789012:example
 ```
diff --git a/website/docs/r/s3control_object_lambda_access_point.html.markdown b/website/docs/r/s3control_object_lambda_access_point.html.markdown
index c1e069d45e1..17f96a0793a 100644
--- a/website/docs/r/s3control_object_lambda_access_point.html.markdown
+++ b/website/docs/r/s3control_object_lambda_access_point.html.markdown
@@ -44,7 +44,7 @@ resource "aws_s3control_object_lambda_access_point" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `account_id` - (Optional) The AWS account ID for the owner of the bucket for which you want to create an Object Lambda Access Point. Defaults to automatically determined account ID of the Terraform AWS provider.
 * `configuration` - (Required) A configuration block containing details about the Object Lambda Access Point. See [Configuration](#configuration) below for more details.
@@ -79,17 +79,27 @@ The `aws_lambda` block supports the following:
 * `function_arn` - (Required) The Amazon Resource Name (ARN) of the AWS Lambda function.
 * `function_payload` - (Optional) Additional JSON that provides supplemental data to the Lambda function used to transform objects.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
+* `alias` - Alias for the S3 Object Lambda Access Point.
 * `arn` - Amazon Resource Name (ARN) of the Object Lambda Access Point.
 * `id` - The AWS account ID and access point name separated by a colon (`:`).
 
 ## Import
 
-Object Lambda Access Points can be imported using the `account_id` and `name`, separated by a colon (`:`), e.g.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Object Lambda Access Points using the `account_id` and `name`, separated by a colon (`:`). For example:
 
+```terraform
+import {
+  to = aws_s3control_object_lambda_access_point.example
+  id = "123456789012:example"
+}
 ```
-$ terraform import aws_s3control_object_lambda_access_point.example 123456789012:example
+
+Using `terraform import`, import Object Lambda Access Points using the `account_id` and `name`, separated by a colon (`:`). For example:
+
+```console
+% terraform import aws_s3control_object_lambda_access_point.example 123456789012:example
 ```
diff --git a/website/docs/r/s3control_object_lambda_access_point_policy.html.markdown b/website/docs/r/s3control_object_lambda_access_point_policy.html.markdown
index ba8e5214ba9..c5629bf2993 100644
--- a/website/docs/r/s3control_object_lambda_access_point_policy.html.markdown
+++ b/website/docs/r/s3control_object_lambda_access_point_policy.html.markdown
@@ -59,23 +59,32 @@ resource "aws_s3control_object_lambda_access_point_policy" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `account_id` - (Optional) The AWS account ID for the account that owns the Object Lambda Access Point. Defaults to automatically determined account ID of the Terraform AWS provider.
 * `name` - (Required) The name of the Object Lambda Access Point.
 * `policy` - (Required) The Object Lambda Access Point resource policy document.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `has_public_access_policy` - Indicates whether this access point currently has a policy that allows public access.
 * `id` - The AWS account ID and access point name separated by a colon (`:`).
 
 ## Import
 
-Object Lambda Access Point policies can be imported using the `account_id` and `name`, separated by a colon (`:`), e.g.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Object Lambda Access Point policies using the `account_id` and `name`, separated by a colon (`:`). For example:
 
+```terraform
+import {
+  to = aws_s3control_object_lambda_access_point_policy.example
+  id = "123456789012:example"
+}
 ```
-$ terraform import aws_s3control_object_lambda_access_point_policy.example 123456789012:example
+
+Using `terraform import`, import Object Lambda Access Point policies using the `account_id` and `name`, separated by a colon (`:`). For example:
+
+```console
+% terraform import aws_s3control_object_lambda_access_point_policy.example 123456789012:example
 ```
diff --git a/website/docs/r/s3control_storage_lens_configuration.html.markdown b/website/docs/r/s3control_storage_lens_configuration.html.markdown
index 9326512212a..e5a68dc9d60 100644
--- a/website/docs/r/s3control_storage_lens_configuration.html.markdown
+++ b/website/docs/r/s3control_storage_lens_configuration.html.markdown
@@ -60,7 +60,7 @@ resource "aws_s3control_storage_lens_configuration" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `account_id` - (Optional) The AWS account ID for the S3 Storage Lens configuration. Defaults to automatically determined account ID of the Terraform AWS provider.
 * `config_id` - (Required) The ID of the S3 Storage Lens configuration.
@@ -200,17 +200,26 @@ The `include` block supports the following:
 * `buckets` (Optional) List of S3 bucket ARNs.
 * `regions` (Optional) List of AWS Regions.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name (ARN) of the S3 Storage Lens configuration.
 * `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
 
 ## Import
 
-S3 Storage Lens configurations can be imported using the `account_id` and `config_id`, separated by a colon (`:`), e.g.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import S3 Storage Lens configurations using the `account_id` and `config_id`, separated by a colon (`:`). For example:
 
+```terraform
+import {
+  to = aws_s3control_storage_lens_configuration.example
+  id = "123456789012:example-1"
+}
 ```
-$ terraform import aws_s3control_storage_lens_configuration.example 123456789012:example-1
+
+Using `terraform import`, import S3 Storage Lens configurations using the `account_id` and `config_id`, separated by a colon (`:`). For example:
+
+```console
+% terraform import aws_s3control_storage_lens_configuration.example 123456789012:example-1
 ```
diff --git a/website/docs/r/s3outposts_endpoint.html.markdown b/website/docs/r/s3outposts_endpoint.html.markdown
index 561335de77c..847e08efc37 100644
--- a/website/docs/r/s3outposts_endpoint.html.markdown
+++ b/website/docs/r/s3outposts_endpoint.html.markdown
@@ -22,7 +22,7 @@ resource "aws_s3outposts_endpoint" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `outpost_id` - (Required) Identifier of the Outpost to contain this endpoint.
 * `security_group_id` - (Required) Identifier of the EC2 Security Group.
@@ -30,9 +30,9 @@ The following arguments are supported:
 * `access_type` - (Optional) Type of access for the network connectivity. Valid values are `Private` or `CustomerOwnedIp`.
 * `customer_owned_ipv4_pool` - (Optional) The ID of a Customer Owned IP Pool. For more on customer owned IP addresses see the [User Guide](https://docs.aws.amazon.com/outposts/latest/userguide/local-rack.html#local-gateway-subnet).
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name (ARN) of the endpoint.
 * `cidr_block` - VPC CIDR block of the endpoint.
@@ -43,8 +43,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-S3 Outposts Endpoints can be imported using Amazon Resource Name (ARN), EC2 Security Group identifier, and EC2 Subnet identifier, separated by commas (`,`) e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import S3 Outposts Endpoints using Amazon Resource Name (ARN), EC2 Security Group identifier, and EC2 Subnet identifier, separated by commas (`,`). For example:
 
+```terraform
+import {
+  to = aws_s3outposts_endpoint.example
+  id = "arn:aws:s3-outposts:us-east-1:123456789012:outpost/op-12345678/endpoint/0123456789abcdef,sg-12345678,subnet-12345678"
+}
 ```
-$ terraform import aws_s3outposts_endpoint.example arn:aws:s3-outposts:us-east-1:123456789012:outpost/op-12345678/endpoint/0123456789abcdef,sg-12345678,subnet-12345678
+
+Using `terraform import`, import S3 Outposts Endpoints using Amazon Resource Name (ARN), EC2 Security Group identifier, and EC2 Subnet identifier, separated by commas (`,`). For example:
+
+```console
+% terraform import aws_s3outposts_endpoint.example arn:aws:s3-outposts:us-east-1:123456789012:outpost/op-12345678/endpoint/0123456789abcdef,sg-12345678,subnet-12345678
 ```
diff --git a/website/docs/r/sagemaker_app.html.markdown b/website/docs/r/sagemaker_app.html.markdown
index 76bc6b0f1f8..4d95009f675 100644
--- a/website/docs/r/sagemaker_app.html.markdown
+++ b/website/docs/r/sagemaker_app.html.markdown
@@ -25,7 +25,7 @@ resource "aws_sagemaker_app" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `app_name` - (Required) The name of the app.
 * `app_type` - (Required) The type of app. Valid values are `JupyterServer`, `KernelGateway`, `RStudioServerPro`, `RSessionGateway` and `TensorBoard`.
@@ -42,9 +42,9 @@ The following arguments are supported:
 * `sagemaker_image_arn` - (Optional) The ARN of the SageMaker image that the image version belongs to.
 * `sagemaker_image_version_arn` - (Optional) The ARN of the image version created on the instance.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The Amazon Resource Name (ARN) of the app.
 * `arn` - The Amazon Resource Name (ARN) of the app.
@@ -52,8 +52,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-SageMaker Apps can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SageMaker Apps using the `id`. For example:
 
+```terraform
+import {
+  to = aws_sagemaker_app.example
+  id = "arn:aws:sagemaker:us-west-2:012345678912:app/domain-id/user-profile-name/app-type/app-name"
+}
 ```
-$ terraform import aws_sagemaker_app.example arn:aws:sagemaker:us-west-2:012345678912:app/domain-id/user-profile-name/app-type/app-name
+
+Using `terraform import`, import SageMaker Apps using the `id`. For example:
+
+```console
+% terraform import aws_sagemaker_app.example arn:aws:sagemaker:us-west-2:012345678912:app/domain-id/user-profile-name/app-type/app-name
 ```
diff --git a/website/docs/r/sagemaker_app_image_config.html.markdown b/website/docs/r/sagemaker_app_image_config.html.markdown
index 0efe11635ef..ca14e819de4 100644
--- a/website/docs/r/sagemaker_app_image_config.html.markdown
+++ b/website/docs/r/sagemaker_app_image_config.html.markdown
@@ -44,7 +44,7 @@ resource "aws_sagemaker_app_image_config" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `app_image_config_name` - (Required) The name of the App Image Config.
 * `kernel_gateway_image_config` - (Optional) The configuration for the file system and kernels in a SageMaker image running as a KernelGateway app. See [Kernel Gateway Image Config](#kernel-gateway-image-config) details below.
@@ -68,9 +68,9 @@ The following arguments are supported:
 * `name` - (Required) The name of the kernel.
 * `display_name` - (Optional) The display name of the kernel.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The name of the App Image Config.
 * `arn` - The Amazon Resource Name (ARN) assigned by AWS to this App Image Config.
@@ -78,8 +78,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-SageMaker App Image Configs can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SageMaker App Image Configs using the `name`. For example:
 
+```terraform
+import {
+  to = aws_sagemaker_app_image_config.example
+  id = "example"
+}
 ```
-$ terraform import aws_sagemaker_app_image_config.example example
+
+Using `terraform import`, import SageMaker App Image Configs using the `name`. For example:
+
+```console
+% terraform import aws_sagemaker_app_image_config.example example
 ```
diff --git a/website/docs/r/sagemaker_code_repository.html.markdown b/website/docs/r/sagemaker_code_repository.html.markdown
index 990730ca5fa..3e6a758d215 100644
--- a/website/docs/r/sagemaker_code_repository.html.markdown
+++ b/website/docs/r/sagemaker_code_repository.html.markdown
@@ -50,7 +50,7 @@ resource "aws_sagemaker_code_repository" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `code_repository_name` - (Required) The name of the Code Repository (must be unique).
 * `git_config` - (Required) Specifies details about the repository. see [Git Config](#git-config) details below.
@@ -62,9 +62,9 @@ The following arguments are supported:
 * `branch` - (Optional) The default branch for the Git repository.
 * `secret_arn` - (Optional) The Amazon Resource Name (ARN) of the AWS Secrets Manager secret that contains the credentials used to access the git repository. The secret must have a staging label of AWSCURRENT and must be in the following format: `{"username": UserName, "password": Password}`
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The name of the Code Repository.
 * `arn` - The Amazon Resource Name (ARN) assigned by AWS to this Code Repository.
@@ -72,8 +72,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-SageMaker Code Repositories can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SageMaker Code Repositories using the `name`. For example:
 
+```terraform
+import {
+  to = aws_sagemaker_code_repository.test_code_repository
+  id = "my-code-repo"
+}
 ```
-$ terraform import aws_sagemaker_code_repository.test_code_repository my-code-repo
+
+Using `terraform import`, import SageMaker Code Repositories using the `name`. For example:
+
+```console
+% terraform import aws_sagemaker_code_repository.test_code_repository my-code-repo
 ```
diff --git a/website/docs/r/sagemaker_data_quality_job_definition.html.markdown b/website/docs/r/sagemaker_data_quality_job_definition.html.markdown
index 2c57223ab01..624f018a254 100644
--- a/website/docs/r/sagemaker_data_quality_job_definition.html.markdown
+++ b/website/docs/r/sagemaker_data_quality_job_definition.html.markdown
@@ -46,7 +46,7 @@ resource "aws_sagemaker_data_quality_job_definition" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `data_quality_app_specification` - (Required) Specifies the container that runs the monitoring job. Fields are documented below.
 * `data_quality_baseline_config` - (Optional) Configures the constraints and baselines for the monitoring job. Fields are documented below.
@@ -153,9 +153,9 @@ The following arguments are supported:
 
 * `max_runtime_in_seconds` - (Required) The maximum runtime allowed in seconds.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The Amazon Resource Name (ARN) assigned by AWS to this data quality job definition.
 * `name` - The name of the data quality job definition.
@@ -163,8 +163,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Data quality job definitions can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import data quality job definitions using the `name`. For example:
 
+```terraform
+import {
+  to = aws_sagemaker_data_quality_job_definition.test_data_quality_job_definition
+  id = "data-quality-job-definition-foo"
+}
 ```
-$ terraform import aws_sagemaker_data_quality_job_definition.test_data_quality_job_definition data-quality-job-definition-foo
+
+Using `terraform import`, import data quality job definitions using the `name`. For example:
+
+```console
+% terraform import aws_sagemaker_data_quality_job_definition.test_data_quality_job_definition data-quality-job-definition-foo
 ```
diff --git a/website/docs/r/sagemaker_device.html.markdown b/website/docs/r/sagemaker_device.html.markdown
index ee8be3ce8ec..2cfac1e9632 100644
--- a/website/docs/r/sagemaker_device.html.markdown
+++ b/website/docs/r/sagemaker_device.html.markdown
@@ -26,7 +26,7 @@ resource "aws_sagemaker_device" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `device_fleet_name` - (Required) The name of the Device Fleet.
 * `device` - (Required) The device to register with SageMaker Edge Manager. See [Device](#device) details below.
@@ -37,17 +37,26 @@ The following arguments are supported:
 * `device_name` - (Optional) The name of the device.
 * `iot_thing_name` - (Optional) Amazon Web Services Internet of Things (IoT) object name.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The id is constructed from `device-fleet-name/device-name`.
 * `arn` - The Amazon Resource Name (ARN) assigned by AWS to this Device.
 
 ## Import
 
-SageMaker Devices can be imported using the `device-fleet-name/device-name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SageMaker Devices using the `device-fleet-name/device-name`. For example:
 
+```terraform
+import {
+  to = aws_sagemaker_device.example
+  id = "my-fleet/my-device"
+}
 ```
-$ terraform import aws_sagemaker_device.example my-fleet/my-device
+
+Using `terraform import`, import SageMaker Devices using the `device-fleet-name/device-name`. For example:
+
+```console
+% terraform import aws_sagemaker_device.example my-fleet/my-device
 ```
diff --git a/website/docs/r/sagemaker_device_fleet.html.markdown b/website/docs/r/sagemaker_device_fleet.html.markdown
index e1691e45fbd..543bf04266f 100644
--- a/website/docs/r/sagemaker_device_fleet.html.markdown
+++ b/website/docs/r/sagemaker_device_fleet.html.markdown
@@ -27,7 +27,7 @@ resource "aws_sagemaker_device_fleet" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `device_fleet_name` - (Required) The name of the Device Fleet (must be unique).
 * `role_arn` - (Required) The Amazon Resource Name (ARN) that has access to AWS Internet of Things (IoT).
@@ -41,9 +41,9 @@ The following arguments are supported:
 * `s3_output_location` - (Required) The Amazon Simple Storage (S3) bucker URI.
 * `kms_key_id` - (Optional) The AWS Key Management Service (AWS KMS) key that Amazon SageMaker uses to encrypt data on the storage volume after compilation job. If you don't provide a KMS key ID, Amazon SageMaker uses the default KMS key for Amazon S3 for your role's account.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The name of the Device Fleet.
 * `arn` - The Amazon Resource Name (ARN) assigned by AWS to this Device Fleet.
@@ -51,8 +51,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-SageMaker Device Fleets can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SageMaker Device Fleets using the `name`. For example:
 
+```terraform
+import {
+  to = aws_sagemaker_device_fleet.example
+  id = "my-fleet"
+}
 ```
-$ terraform import aws_sagemaker_device_fleet.example my-fleet
+
+Using `terraform import`, import SageMaker Device Fleets using the `name`. For example:
+
+```console
+% terraform import aws_sagemaker_device_fleet.example my-fleet
 ```
diff --git a/website/docs/r/sagemaker_domain.html.markdown b/website/docs/r/sagemaker_domain.html.markdown
index 3261de3fbd5..a9745b1cf12 100644
--- a/website/docs/r/sagemaker_domain.html.markdown
+++ b/website/docs/r/sagemaker_domain.html.markdown
@@ -134,17 +134,23 @@ The following arguments are optional:
 
 * `model_register_settings` - (Optional) The model registry settings for the SageMaker Canvas application. See [Model Register Settings](#model_register_settings) below.
 * `time_series_forecasting_settings` - (Optional) Time series forecast settings for the Canvas app. See [Time Series Forecasting Settings](#time_series_forecasting_settings) below.
+* `workspace_settings` - (Optional) The workspace settings for the SageMaker Canvas application. See [Workspace Settings](#workspace_settings) below.
 
 ##### model_register_settings
 
 * `cross_account_model_register_role_arn` - (Optional) The Amazon Resource Name (ARN) of the SageMaker model registry account. Required only to register model versions created by a different SageMaker Canvas AWS account than the AWS account in which SageMaker model registry is set up.
-* `status` - (Optional) Describes whether the integration to the model registry is enabled or disabled in the Canvas application.. Valid values are `ENABLED` and `DISABLED`.
+* `status` - (Optional) Describes whether the integration to the model registry is enabled or disabled in the Canvas application. Valid values are `ENABLED` and `DISABLED`.
 
 ##### time_series_forecasting_settings
 
 * `amazon_forecast_role_arn` - (Optional) The IAM role that Canvas passes to Amazon Forecast for time series forecasting. By default, Canvas uses the execution role specified in the UserProfile that launches the Canvas app. If an execution role is not specified in the UserProfile, Canvas uses the execution role specified in the Domain that owns the UserProfile. To allow time series forecasting, this IAM role should have the [AmazonSageMakerCanvasForecastAccess](https://docs.aws.amazon.com/sagemaker/latest/dg/security-iam-awsmanpol-canvas.html#security-iam-awsmanpol-AmazonSageMakerCanvasForecastAccess) policy attached and forecast.amazonaws.com added in the trust relationship as a service principal.
 * `status` - (Optional) Describes whether time series forecasting is enabled or disabled in the Canvas app. Valid values are `ENABLED` and `DISABLED`.
 
+##### workspace_settings
+
+* `s3_artifact_path` - (Optional) The Amazon S3 bucket used to store artifacts generated by Canvas. Updating the Amazon S3 location impacts existing configuration settings, and Canvas users no longer have access to their artifacts. Canvas users must log out and log back in to apply the new location.
+* `s3_kms_key_id` - (Optional) The Amazon Web Services Key Management Service (KMS) encryption key ID that is used to encrypt artifacts generated by Canvas in the Amazon S3 bucket.
+
 #### sharing_settings
 
 * `notebook_output_option` - (Optional) Whether to include the notebook cell output when sharing the notebook. The default is `Disabled`. Valid values are `Allowed` and `Disabled`.
@@ -206,9 +212,9 @@ The following arguments are optional:
 
 * `home_efs_file_system` - (Optional) The retention policy for data stored on an Amazon Elastic File System (EFS) volume. Valid values are `Retain` or `Delete`.  Default value is `Retain`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the Domain.
 * `arn` - The Amazon Resource Name (ARN) assigned by AWS to this Domain.
@@ -220,8 +226,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-SageMaker Domains can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SageMaker Domains using the `id`. For example:
 
+```terraform
+import {
+  to = aws_sagemaker_domain.test_domain
+  id = "d-8jgsjtilstu8"
+}
 ```
-$ terraform import aws_sagemaker_domain.test_domain d-8jgsjtilstu8
+
+Using `terraform import`, import SageMaker Domains using the `id`. For example:
+
+```console
+% terraform import aws_sagemaker_domain.test_domain d-8jgsjtilstu8
 ```
diff --git a/website/docs/r/sagemaker_endpoint.html.markdown b/website/docs/r/sagemaker_endpoint.html.markdown
index 3ef65bfd406..44d26753d36 100644
--- a/website/docs/r/sagemaker_endpoint.html.markdown
+++ b/website/docs/r/sagemaker_endpoint.html.markdown
@@ -27,7 +27,7 @@ resource "aws_sagemaker_endpoint" "e" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `endpoint_config_name` - (Required) The name of the endpoint configuration to use.
 * `deployment_config` - (Optional) The deployment configuration for an endpoint, which contains the desired deployment strategy and rollback configurations. See [Deployment Config](#deployment-config).
@@ -36,8 +36,9 @@ The following arguments are supported:
 
 ### Deployment Config
 
-* `blue_green_update_policy` - (Required) Update policy for a blue/green deployment. If this update policy is specified, SageMaker creates a new fleet during the deployment while maintaining the old fleet. See [Blue Green Update Config](#blue-green-update-config).
+* `blue_green_update_policy` - (Optional) Update policy for a blue/green deployment. If this update policy is specified, SageMaker creates a new fleet during the deployment while maintaining the old fleet. SageMaker flips traffic to the new fleet according to the specified traffic routing configuration. Only one update policy should be used in the deployment configuration. If no update policy is specified, SageMaker uses a blue/green deployment strategy with all at once traffic shifting by default. See [Blue Green Update Config](#blue-green-update-config).
 * `auto_rollback_configuration` - (Optional) Automatic rollback configuration for handling endpoint deployment failures and recovery. See [Auto Rollback Configuration](#auto-rollback-configuration).
+* `rolling_update_policy` - (Optional) Specifies a rolling deployment strategy for updating a SageMaker endpoint. See [Rolling Update Policy](#rolling-update-policy).
 
 #### Blue Green Update Config
 
@@ -45,6 +46,13 @@ The following arguments are supported:
 * `maximum_execution_timeout_in_seconds` - (Optional) Maximum execution timeout for the deployment. Note that the timeout value should be larger than the total waiting time specified in `termination_wait_in_seconds` and `wait_interval_in_seconds`. Valid values are between `600` and `14400`.
 * `termination_wait_in_seconds` - (Optional) Additional waiting time in seconds after the completion of an endpoint deployment before terminating the old endpoint fleet. Default is `0`. Valid values are between `0` and `3600`.
 
+#### Rolling Update Policy
+
+* `maximum_batch_size` - (Required) Batch size for each rolling step to provision capacity and turn on traffic on the new endpoint fleet, and terminate capacity on the old endpoint fleet. Value must be between 5% to 50% of the variant's total instance count. See [Maximum Batch Size](#maximum-batch-size).
+* `maximum_execution_timeout_in_seconds` - (Optional) The time limit for the total deployment. Exceeding this limit causes a timeout. Valid values are between `600` and `14400`.
+* `rollback_maximum_batch_size` - (Optional) Batch size for rollback to the old endpoint fleet. Each rolling step to provision capacity and turn on traffic on the old endpoint fleet, and terminate capacity on the new endpoint fleet. If this field is absent, the default value will be set to 100% of total capacity which means to bring up the whole capacity of the old fleet at once during rollback. See [Rollback Maximum Batch Size](#rollback-maximum-batch-size).
+* `wait_interval_in_seconds` - (Required) The length of the baking period, during which SageMaker monitors alarms for each batch on the new fleet. Valid values are between `0` and `3600`.
+
 ##### Traffic Routing Configuration
 
 * `type` - (Required) Traffic routing strategy type. Valid values are: `ALL_AT_ONCE`, `CANARY`, and `LINEAR`.
@@ -52,6 +60,16 @@ The following arguments are supported:
 * `canary_size` - (Optional) Batch size for the first step to turn on traffic on the new endpoint fleet. Value must be less than or equal to 50% of the variant's total instance count. See [Canary Size](#canary-size).
 * `linear_step_size` - (Optional) Batch size for each step to turn on traffic on the new endpoint fleet. Value must be 10-50% of the variant's total instance count. See [Linear Step Size](#linear-step-size).
 
+###### Maximum Batch Size
+
+* `type` - (Required) Specifies the endpoint capacity type. Valid values are: `INSTANCE_COUNT`, or `CAPACITY_PERCENT`.
+* `value` - (Required) Defines the capacity size, either as a number of instances or a capacity percentage.
+
+###### Rollback Maximum Batch Size
+
+* `type` - (Required) Specifies the endpoint capacity type. Valid values are: `INSTANCE_COUNT`, or `CAPACITY_PERCENT`.
+* `value` - (Required) Defines the capacity size, either as a number of instances or a capacity percentage.
+
 ###### Canary Size
 
 * `type` - (Required) Specifies the endpoint capacity type. Valid values are: `INSTANCE_COUNT`, or `CAPACITY_PERCENT`.
@@ -70,9 +88,9 @@ The following arguments are supported:
 
 * `alarm_name` - (Required) The name of a CloudWatch alarm in your account.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The Amazon Resource Name (ARN) assigned by AWS to this endpoint.
 * `name` - The name of the endpoint.
@@ -80,8 +98,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Endpoints can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import endpoints using the `name`. For example:
 
+```terraform
+import {
+  to = aws_sagemaker_endpoint.test_endpoint
+  id = "my-endpoint"
+}
 ```
-$ terraform import aws_sagemaker_endpoint.test_endpoint my-endpoint
+
+Using `terraform import`, import endpoints using the `name`. For example:
+
+```console
+% terraform import aws_sagemaker_endpoint.test_endpoint my-endpoint
 ```
diff --git a/website/docs/r/sagemaker_endpoint_configuration.html.markdown b/website/docs/r/sagemaker_endpoint_configuration.html.markdown
index c7d8f17433e..34903dcc179 100644
--- a/website/docs/r/sagemaker_endpoint_configuration.html.markdown
+++ b/website/docs/r/sagemaker_endpoint_configuration.html.markdown
@@ -33,7 +33,7 @@ resource "aws_sagemaker_endpoint_configuration" "ec" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `production_variants` - (Required) An list of ProductionVariant objects, one for each model that you want to host at this endpoint. Fields are documented below.
 * `kms_key_arn` - (Optional) Amazon Resource Name (ARN) of a AWS Key Management Service key that Amazon SageMaker uses to encrypt data on the storage volume attached to the ML compute instance that hosts the endpoint.
@@ -110,9 +110,9 @@ The following arguments are supported:
 * `error_topic` - (Optional) Amazon SNS topic to post a notification to when inference fails. If no topic is provided, no notification is sent on failure.
 * `success_topic` - (Optional) Amazon SNS topic to post a notification to when inference completes successfully. If no topic is provided, no notification is sent on success.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The Amazon Resource Name (ARN) assigned by AWS to this endpoint configuration.
 * `name` - The name of the endpoint configuration.
@@ -120,8 +120,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Endpoint configurations can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import endpoint configurations using the `name`. For example:
 
+```terraform
+import {
+  to = aws_sagemaker_endpoint_configuration.test_endpoint_config
+  id = "endpoint-config-foo"
+}
 ```
-$ terraform import aws_sagemaker_endpoint_configuration.test_endpoint_config endpoint-config-foo
+
+Using `terraform import`, import endpoint configurations using the `name`. For example:
+
+```console
+% terraform import aws_sagemaker_endpoint_configuration.test_endpoint_config endpoint-config-foo
 ```
diff --git a/website/docs/r/sagemaker_feature_group.html.markdown b/website/docs/r/sagemaker_feature_group.html.markdown
index f9e89393bfb..edcd5affa14 100644
--- a/website/docs/r/sagemaker_feature_group.html.markdown
+++ b/website/docs/r/sagemaker_feature_group.html.markdown
@@ -34,7 +34,7 @@ resource "aws_sagemaker_feature_group" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `feature_group_name` - (Required) The name of the Feature Group. The name must be unique within an AWS Region in an AWS account.
 * `record_identifier_feature_name` - (Required) The name of the Feature whose value uniquely identifies a Record defined in the Feature Store. Only the latest record per identifier value will be stored in the Online Store.
@@ -78,9 +78,9 @@ The following arguments are supported:
 
 * `kms_key_id` - (Optional) The ID of the AWS Key Management Service (AWS KMS) key that SageMaker Feature Store uses to encrypt the Amazon S3 objects at rest using Amazon S3 server-side encryption.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `name` - The name of the Feature Group.
 * `arn` - The Amazon Resource Name (ARN) assigned by AWS to this feature_group.
@@ -88,8 +88,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Feature Groups can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Feature Groups using the `name`. For example:
 
+```terraform
+import {
+  to = aws_sagemaker_feature_group.test_feature_group
+  id = "feature_group-foo"
+}
 ```
-$ terraform import aws_sagemaker_feature_group.test_feature_group feature_group-foo
+
+Using `terraform import`, import Feature Groups using the `name`. For example:
+
+```console
+% terraform import aws_sagemaker_feature_group.test_feature_group feature_group-foo
 ```
diff --git a/website/docs/r/sagemaker_flow_definition.html.markdown b/website/docs/r/sagemaker_flow_definition.html.markdown
index 3eab3bbf476..5c8bc7fc12f 100644
--- a/website/docs/r/sagemaker_flow_definition.html.markdown
+++ b/website/docs/r/sagemaker_flow_definition.html.markdown
@@ -108,7 +108,7 @@ resource "aws_sagemaker_flow_definition" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `flow_definition_name` - (Required) The name of your flow definition.
 * `human_loop_config` - (Required)  An object containing information about the tasks the human reviewers will perform. See [Human Loop Config](#human-loop-config) details below.
@@ -157,9 +157,9 @@ The following arguments are supported:
 * `s3_output_path` - (Required) The Amazon S3 path where the object containing human output will be made available.
 * `kms_key_id` - (Optional) The Amazon Key Management Service (KMS) key ARN for server-side encryption.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The Amazon Resource Name (ARN) assigned by AWS to this Flow Definition.
 * `id` - The name of the Flow Definition.
@@ -167,8 +167,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-SageMaker Flow Definitions can be imported using the `flow_definition_name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SageMaker Flow Definitions using the `flow_definition_name`. For example:
 
+```terraform
+import {
+  to = aws_sagemaker_flow_definition.example
+  id = "example"
+}
 ```
-$ terraform import aws_sagemaker_flow_definition.example example
+
+Using `terraform import`, import SageMaker Flow Definitions using the `flow_definition_name`. For example:
+
+```console
+% terraform import aws_sagemaker_flow_definition.example example
 ```
diff --git a/website/docs/r/sagemaker_human_task_ui.html.markdown b/website/docs/r/sagemaker_human_task_ui.html.markdown
index 22a51d7fa56..49c60c8ea35 100644
--- a/website/docs/r/sagemaker_human_task_ui.html.markdown
+++ b/website/docs/r/sagemaker_human_task_ui.html.markdown
@@ -24,7 +24,7 @@ resource "aws_sagemaker_human_task_ui" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `human_task_ui_name` - (Required) The name of the Human Task UI.
 * `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
@@ -34,9 +34,9 @@ The following arguments are supported:
 
 * `content` - (Required) The content of the Liquid template for the worker user interface.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The Amazon Resource Name (ARN) assigned by AWS to this Human Task UI.
 * `id` - The name of the Human Task UI.
@@ -50,8 +50,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-SageMaker Human Task UIs can be imported using the `human_task_ui_name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SageMaker Human Task UIs using the `human_task_ui_name`. For example:
 
+```terraform
+import {
+  to = aws_sagemaker_human_task_ui.example
+  id = "example"
+}
 ```
-$ terraform import aws_sagemaker_human_task_ui.example example
+
+Using `terraform import`, import SageMaker Human Task UIs using the `human_task_ui_name`. For example:
+
+```console
+% terraform import aws_sagemaker_human_task_ui.example example
 ```
diff --git a/website/docs/r/sagemaker_image.html.markdown b/website/docs/r/sagemaker_image.html.markdown
index 829fee79396..a488e77ee4e 100644
--- a/website/docs/r/sagemaker_image.html.markdown
+++ b/website/docs/r/sagemaker_image.html.markdown
@@ -23,7 +23,7 @@ resource "aws_sagemaker_image" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `image_name` - (Required) The name of the image. Must be unique to your account.
 * `role_arn` - (Required) The Amazon Resource Name (ARN) of an IAM role that enables Amazon SageMaker to perform tasks on your behalf.
@@ -31,9 +31,9 @@ The following arguments are supported:
 * `description` - (Optional) The description of the image.
 * `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The name of the Image.
 * `arn` - The Amazon Resource Name (ARN) assigned by AWS to this Image.
@@ -41,8 +41,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-SageMaker Code Images can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SageMaker Code Images using the `name`. For example:
 
+```terraform
+import {
+  to = aws_sagemaker_image.test_image
+  id = "my-code-repo"
+}
 ```
-$ terraform import aws_sagemaker_image.test_image my-code-repo
+
+Using `terraform import`, import SageMaker Code Images using the `name`. For example:
+
+```console
+% terraform import aws_sagemaker_image.test_image my-code-repo
 ```
diff --git a/website/docs/r/sagemaker_image_version.html.markdown b/website/docs/r/sagemaker_image_version.html.markdown
index a2fc84e3857..f9fa4a750d8 100644
--- a/website/docs/r/sagemaker_image_version.html.markdown
+++ b/website/docs/r/sagemaker_image_version.html.markdown
@@ -23,14 +23,14 @@ resource "aws_sagemaker_image_version" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `image_name` - (Required) The name of the image. Must be unique to your account.
 * `base_image` - (Required) The registry path of the container image on which this image version is based.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The name of the Image.
 * `arn` - The Amazon Resource Name (ARN) assigned by AWS to this Image Version.
@@ -39,8 +39,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-SageMaker Image Versions can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SageMaker Image Versions using the `name`. For example:
 
+```terraform
+import {
+  to = aws_sagemaker_image_version.test_image
+  id = "my-code-repo"
+}
 ```
-$ terraform import aws_sagemaker_image_version.test_image my-code-repo
+
+Using `terraform import`, import SageMaker Image Versions using the `name`. For example:
+
+```console
+% terraform import aws_sagemaker_image_version.test_image my-code-repo
 ```
diff --git a/website/docs/r/sagemaker_model.html.markdown b/website/docs/r/sagemaker_model.html.markdown
index 1889ac38b0f..62333e0a6bf 100644
--- a/website/docs/r/sagemaker_model.html.markdown
+++ b/website/docs/r/sagemaker_model.html.markdown
@@ -46,7 +46,7 @@ data "aws_sagemaker_prebuilt_ecr_image" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Optional) The name of the model (must be unique). If omitted, Terraform will assign a random, unique name.
 * `primary_container` - (Optional) The primary docker image containing inference code that is used when the model is deployed for predictions.  If not specified, the `container` argument is required. Fields are documented below.
@@ -81,9 +81,9 @@ The `primary_container` and `container` block both support:
 
 * `mode` - (Required) How containers in a multi-container are run. The following values are valid `Serial` and `Direct`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `name` - The name of the model.
 * `arn` - The Amazon Resource Name (ARN) assigned by AWS to this model.
@@ -91,8 +91,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Models can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import models using the `name`. For example:
 
+```terraform
+import {
+  to = aws_sagemaker_model.test_model
+  id = "model-foo"
+}
 ```
-$ terraform import aws_sagemaker_model.test_model model-foo
+
+Using `terraform import`, import models using the `name`. For example:
+
+```console
+% terraform import aws_sagemaker_model.test_model model-foo
 ```
diff --git a/website/docs/r/sagemaker_model_package_group.html.markdown b/website/docs/r/sagemaker_model_package_group.html.markdown
index bafaf95e294..454e918342b 100644
--- a/website/docs/r/sagemaker_model_package_group.html.markdown
+++ b/website/docs/r/sagemaker_model_package_group.html.markdown
@@ -22,15 +22,15 @@ resource "aws_sagemaker_model_package_group" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `model_package_group_name` - (Required) The name of the model group.
 * `model_package_group_description` - (Optional) A description for the model group.
 * `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The name of the Model Package Group.
 * `arn` - The Amazon Resource Name (ARN) assigned by AWS to this Model Package Group.
@@ -38,8 +38,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-SageMaker Model Package Groups can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SageMaker Model Package Groups using the `name`. For example:
 
+```terraform
+import {
+  to = aws_sagemaker_model_package_group.test_model_package_group
+  id = "my-code-repo"
+}
 ```
-$ terraform import aws_sagemaker_model_package_group.test_model_package_group my-code-repo
+
+Using `terraform import`, import SageMaker Model Package Groups using the `name`. For example:
+
+```console
+% terraform import aws_sagemaker_model_package_group.test_model_package_group my-code-repo
 ```
diff --git a/website/docs/r/sagemaker_model_package_group_policy.html.markdown b/website/docs/r/sagemaker_model_package_group_policy.html.markdown
index fb1537e4f6d..8c9a1a92f18 100644
--- a/website/docs/r/sagemaker_model_package_group_policy.html.markdown
+++ b/website/docs/r/sagemaker_model_package_group_policy.html.markdown
@@ -41,20 +41,29 @@ resource "aws_sagemaker_model_package_group_policy" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `model_package_group_name` - (Required) The name of the model package group.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The name of the Model Package Package Group.
 
 ## Import
 
-SageMaker Model Package Groups can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SageMaker Model Package Groups using the `name`. For example:
 
+```terraform
+import {
+  to = aws_sagemaker_model_package_group_policy.example
+  id = "example"
+}
 ```
-$ terraform import aws_sagemaker_model_package_group_policy.example example
+
+Using `terraform import`, import SageMaker Model Package Groups using the `name`. For example:
+
+```console
+% terraform import aws_sagemaker_model_package_group_policy.example example
 ```
diff --git a/website/docs/r/sagemaker_monitoring_schedule.html.markdown b/website/docs/r/sagemaker_monitoring_schedule.html.markdown
index 175c53155c9..dbb956fdab8 100644
--- a/website/docs/r/sagemaker_monitoring_schedule.html.markdown
+++ b/website/docs/r/sagemaker_monitoring_schedule.html.markdown
@@ -27,7 +27,7 @@ resource "aws_sagemaker_monitoring_schedule" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `monitoring_schedule_config` - (Required) The configuration object that specifies the monitoring schedule and defines the monitoring job. Fields are documented below.
 * `name` - (Optional) The name of the monitoring schedule. The name must be unique within an AWS Region within an AWS account. If omitted, Terraform will assign a random, unique name.
@@ -43,9 +43,9 @@ The following arguments are supported:
 
 * `schedule_expression` - (Required) A cron expression that describes details about the monitoring schedule. For example, and hourly schedule would be `cron(0 * ? * * *)`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The Amazon Resource Name (ARN) assigned by AWS to this monitoring schedule.
 * `name` - The name of the monitoring schedule.
@@ -53,8 +53,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Monitoring schedules can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import monitoring schedules using the `name`. For example:
 
+```terraform
+import {
+  to = aws_sagemaker_monitoring_schedule.test_monitoring_schedule
+  id = "monitoring-schedule-foo"
+}
 ```
-$ terraform import aws_sagemaker_monitoring_schedule.test_monitoring_schedule monitoring-schedule-foo
+
+Using `terraform import`, import monitoring schedules using the `name`. For example:
+
+```console
+% terraform import aws_sagemaker_monitoring_schedule.test_monitoring_schedule monitoring-schedule-foo
 ```
diff --git a/website/docs/r/sagemaker_notebook_instance.html.markdown b/website/docs/r/sagemaker_notebook_instance.html.markdown
index 00ae4ac2978..803d2b3ae42 100644
--- a/website/docs/r/sagemaker_notebook_instance.html.markdown
+++ b/website/docs/r/sagemaker_notebook_instance.html.markdown
@@ -51,7 +51,7 @@ resource "aws_sagemaker_notebook_instance" "ni" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The name of the notebook instance (must be unique).
 * `role_arn` - (Required) The ARN of the IAM role to be used by the notebook instance which allows SageMaker to call other services on your behalf.
@@ -75,9 +75,9 @@ The following arguments are supported:
 
 * `minimum_instance_metadata_service_version` - (Optional) Indicates the minimum IMDS version that the notebook instance supports. When passed "1" is passed. This means that both IMDSv1 and IMDSv2 are supported. Valid values are `1` and `2`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The name of the notebook instance.
 * `arn` - The Amazon Resource Name (ARN) assigned by AWS to this notebook instance.
@@ -87,8 +87,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-SageMaker Notebook Instances can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SageMaker Notebook Instances using the `name`. For example:
 
+```terraform
+import {
+  to = aws_sagemaker_notebook_instance.test_notebook_instance
+  id = "my-notebook-instance"
+}
 ```
-$ terraform import aws_sagemaker_notebook_instance.test_notebook_instance my-notebook-instance
+
+Using `terraform import`, import SageMaker Notebook Instances using the `name`. For example:
+
+```console
+% terraform import aws_sagemaker_notebook_instance.test_notebook_instance my-notebook-instance
 ```
diff --git a/website/docs/r/sagemaker_notebook_instance_lifecycle_configuration.html.markdown b/website/docs/r/sagemaker_notebook_instance_lifecycle_configuration.html.markdown
index 5a3898eba25..f32510ac340 100644
--- a/website/docs/r/sagemaker_notebook_instance_lifecycle_configuration.html.markdown
+++ b/website/docs/r/sagemaker_notebook_instance_lifecycle_configuration.html.markdown
@@ -24,22 +24,31 @@ resource "aws_sagemaker_notebook_instance_lifecycle_configuration" "lc" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Optional) The name of the lifecycle configuration (must be unique). If omitted, Terraform will assign a random, unique name.
 * `on_create` - (Optional) A shell script (base64-encoded) that runs only once when the SageMaker Notebook Instance is created.
 * `on_start` - (Optional) A shell script (base64-encoded) that runs every time the SageMaker Notebook Instance is started including the time it's created.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The Amazon Resource Name (ARN) assigned by AWS to this lifecycle configuration.
 
 ## Import
 
-Models can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import models using the `name`. For example:
 
+```terraform
+import {
+  to = aws_sagemaker_notebook_instance_lifecycle_configuration.lc
+  id = "foo"
+}
 ```
-$ terraform import aws_sagemaker_notebook_instance_lifecycle_configuration.lc foo
+
+Using `terraform import`, import models using the `name`. For example:
+
+```console
+% terraform import aws_sagemaker_notebook_instance_lifecycle_configuration.lc foo
 ```
diff --git a/website/docs/r/sagemaker_pipeline.html.markdown b/website/docs/r/sagemaker_pipeline.html.markdown
new file mode 100644
index 00000000000..8085aa5ba18
--- /dev/null
+++ b/website/docs/r/sagemaker_pipeline.html.markdown
@@ -0,0 +1,82 @@
+---
+subcategory: "SageMaker"
+layout: "aws"
+page_title: "AWS: aws_sagemaker_pipeline"
+description: |-
+  Provides a SageMaker Pipeline resource.
+---
+
+# Resource: aws_sagemaker_pipeline
+
+Provides a SageMaker Pipeline resource.
+
+## Example Usage
+
+### Basic usage
+
+```terraform
+resource "aws_sagemaker_pipeline" "example" {
+  pipeline_name         = "example"
+  pipeline_display_name = "example"
+  role_arn              = aws_iam_role.example.arn
+
+  pipeline_definition = jsonencode({
+    Version = "2020-12-01"
+    Steps = [{
+      Name = "Test"
+      Type = "Fail"
+      Arguments = {
+        ErrorMessage = "test"
+      }
+    }]
+  })
+}
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `pipeline_name` - (Required) The name of the pipeline.
+* `pipeline_description` - (Optional) A description of the pipeline.
+* `pipeline_display_name` - (Required) The display name of the pipeline.
+* `pipeline_definition` - (Optional) The [JSON pipeline definition](https://aws-sagemaker-mlops.github.io/sagemaker-model-building-pipeline-definition-JSON-schema/) of the pipeline.
+* `pipeline_definition_s3_location` - (Optional) The location of the pipeline definition stored in Amazon S3. If specified, SageMaker will retrieve the pipeline definition from this location. see [Pipeline Definition S3 Location](#pipeline-definition-s3-location) details below.
+* `role_arn` - (Required) The name of the Pipeline (must be unique).
+* `parallelism_configuration` - (Optional) This is the configuration that controls the parallelism of the pipeline. If specified, it applies to all runs of this pipeline by default. see [Parallelism Configuration](#parallelism-configuration) details below.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### Parallelism Configuration
+
+* `max_parallel_execution_steps` - (Required) The max number of steps that can be executed in parallel.
+
+### Pipeline Definition S3 Location
+
+* `bucket` - (Required) Name of the S3 bucket.
+* `object_key` - (Required) The object key (or key name) uniquely identifies the object in an S3 bucket.
+* `version_id` - (Optional) Version Id of the pipeline definition file. If not specified, Amazon SageMaker will retrieve the latest version.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The name of the Pipeline.
+* `arn` - The Amazon Resource Name (ARN) assigned by AWS to this Pipeline.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import pipelines using the `pipeline_name`. For example:
+
+```terraform
+import {
+  to = aws_sagemaker_pipeline.test_pipeline
+  id = "pipeline"
+}
+```
+
+Using `terraform import`, import pipelines using the `pipeline_name`. For example:
+
+```console
+% terraform import aws_sagemaker_pipeline.test_pipeline pipeline
+```
diff --git a/website/docs/r/sagemaker_project.html.markdown b/website/docs/r/sagemaker_project.html.markdown
index 4a196bb4179..bd6bc5935cc 100644
--- a/website/docs/r/sagemaker_project.html.markdown
+++ b/website/docs/r/sagemaker_project.html.markdown
@@ -26,7 +26,7 @@ resource "aws_sagemaker_project" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `project_name` - (Required) The name of the Project.
 * `project_description` - (Optional) A description for the project.
@@ -45,9 +45,9 @@ The following arguments are supported:
 * `key` - (Required) The key that identifies a provisioning parameter.
 * `value` - (Optional) The value of the provisioning parameter.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The Amazon Resource Name (ARN) assigned by AWS to this Project.
 * `id` - The name of the Project.
@@ -56,8 +56,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-SageMaker Projects can be imported using the `project_name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SageMaker Projects using the `project_name`. For example:
 
+```terraform
+import {
+  to = aws_sagemaker_project.example
+  id = "example"
+}
 ```
-$ terraform import aws_sagemaker_project.example example
+
+Using `terraform import`, import SageMaker Projects using the `project_name`. For example:
+
+```console
+% terraform import aws_sagemaker_project.example example
 ```
diff --git a/website/docs/r/sagemaker_servicecatalog_portfolio_status.html.markdown b/website/docs/r/sagemaker_servicecatalog_portfolio_status.html.markdown
index 9b28cf075cb..c42ec891937 100644
--- a/website/docs/r/sagemaker_servicecatalog_portfolio_status.html.markdown
+++ b/website/docs/r/sagemaker_servicecatalog_portfolio_status.html.markdown
@@ -22,20 +22,29 @@ resource "aws_sagemaker_servicecatalog_portfolio_status" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `status` - (Required) Whether Service Catalog is enabled or disabled in SageMaker. Valid values are `Enabled` and `Disabled`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The AWS Region the Servicecatalog portfolio status resides in.
 
 ## Import
 
-Models can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import models using the `id`. For example:
 
+```terraform
+import {
+  to = aws_sagemaker_servicecatalog_portfolio_status.example
+  id = "us-east-1"
+}
 ```
-$ terraform import aws_sagemaker_servicecatalog_portfolio_status.example us-east-1
+
+Using `terraform import`, import models using the `id`. For example:
+
+```console
+% terraform import aws_sagemaker_servicecatalog_portfolio_status.example us-east-1
 ```
diff --git a/website/docs/r/sagemaker_space.html.markdown b/website/docs/r/sagemaker_space.html.markdown
index 306652b6812..b56429be864 100644
--- a/website/docs/r/sagemaker_space.html.markdown
+++ b/website/docs/r/sagemaker_space.html.markdown
@@ -23,7 +23,7 @@ resource "aws_sagemaker_space" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `space_name` - (Required) The name of the space.
 * `domain_id` - (Required) The ID of the associated Domain.
@@ -64,9 +64,9 @@ The following arguments are supported:
 * `image_name` - (Required) The name of the Custom Image.
 * `image_version_number` - (Optional) The version number of the Custom Image.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The space's Amazon Resource Name (ARN).
 * `arn` - The space's Amazon Resource Name (ARN).
@@ -75,8 +75,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-SageMaker Spaces can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SageMaker Spaces using the `id`. For example:
 
+```terraform
+import {
+  to = aws_sagemaker_space.test_space
+  id = "arn:aws:sagemaker:us-west-2:123456789012:space/domain-id/space-name"
+}
 ```
-$ terraform import aws_sagemaker_space.test_space arn:aws:sagemaker:us-west-2:123456789012:space/domain-id/space-name
+
+Using `terraform import`, import SageMaker Spaces using the `id`. For example:
+
+```console
+% terraform import aws_sagemaker_space.test_space arn:aws:sagemaker:us-west-2:123456789012:space/domain-id/space-name
 ```
diff --git a/website/docs/r/sagemaker_studio_lifecycle_config.html.markdown b/website/docs/r/sagemaker_studio_lifecycle_config.html.markdown
index 07f61e6aeee..ea54cbf4046 100644
--- a/website/docs/r/sagemaker_studio_lifecycle_config.html.markdown
+++ b/website/docs/r/sagemaker_studio_lifecycle_config.html.markdown
@@ -24,16 +24,16 @@ resource "aws_sagemaker_studio_lifecycle_config" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `studio_lifecycle_config_name` - (Required) The name of the Studio Lifecycle Configuration to create.
 * `studio_lifecycle_config_app_type` - (Required) The App type that the Lifecycle Configuration is attached to. Valid values are `JupyterServer` and `KernelGateway`.
 * `studio_lifecycle_config_content` - (Required) The content of your Studio Lifecycle Configuration script. This content must be base64 encoded.
 * `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The name of the Studio Lifecycle Config.
 * `arn` - The Amazon Resource Name (ARN) assigned by AWS to this Studio Lifecycle Config.
@@ -41,8 +41,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-SageMaker Studio Lifecycle Configs can be imported using the `studio_lifecycle_config_name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SageMaker Studio Lifecycle Configs using the `studio_lifecycle_config_name`. For example:
 
+```terraform
+import {
+  to = aws_sagemaker_studio_lifecycle_config.example
+  id = "example"
+}
 ```
-$ terraform import aws_sagemaker_studio_lifecycle_config.example example
+
+Using `terraform import`, import SageMaker Studio Lifecycle Configs using the `studio_lifecycle_config_name`. For example:
+
+```console
+% terraform import aws_sagemaker_studio_lifecycle_config.example example
 ```
diff --git a/website/docs/r/sagemaker_user_profile.html.markdown b/website/docs/r/sagemaker_user_profile.html.markdown
index a1556cee0e6..2e088477696 100644
--- a/website/docs/r/sagemaker_user_profile.html.markdown
+++ b/website/docs/r/sagemaker_user_profile.html.markdown
@@ -23,7 +23,7 @@ resource "aws_sagemaker_user_profile" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `user_profile_name` - (Required) The name for the User Profile.
 * `domain_id` - (Required) The ID of the associated Domain.
@@ -48,6 +48,7 @@ The following arguments are supported:
 
 * `model_register_settings` - (Optional) The model registry settings for the SageMaker Canvas application. See [Model Register Settings](#model-register-settings) below.
 * `time_series_forecasting_settings` - (Optional) Time series forecast settings for the Canvas app. see [Time Series Forecasting Settings](#time-series-forecasting-settings) below.
+* `workspace_settings` - (Optional) The workspace settings for the SageMaker Canvas application. See [Workspace Settings](#workspace-settings) below.
 
 #### Sharing Settings
 
@@ -106,11 +107,16 @@ The following arguments are supported:
 ##### Model Register Settings
 
 * `cross_account_model_register_role_arn` - (Optional) The Amazon Resource Name (ARN) of the SageMaker model registry account. Required only to register model versions created by a different SageMaker Canvas AWS account than the AWS account in which SageMaker model registry is set up.
-* `status` - (Optional) Describes whether the integration to the model registry is enabled or disabled in the Canvas application.. Valid values are `ENABLED` and `DISABLED`.
+* `status` - (Optional) Describes whether the integration to the model registry is enabled or disabled in the Canvas application. Valid values are `ENABLED` and `DISABLED`.
 
-## Attributes Reference
+##### Workspace Settings
 
-In addition to all arguments above, the following attributes are exported:
+* `s3_artifact_path` - (Optional) The Amazon S3 bucket used to store artifacts generated by Canvas. Updating the Amazon S3 location impacts existing configuration settings, and Canvas users no longer have access to their artifacts. Canvas users must log out and log back in to apply the new location.
+* `s3_kms_key_id` - (Optional) The Amazon Web Services Key Management Service (KMS) encryption key ID that is used to encrypt artifacts generated by Canvas in the Amazon S3 bucket.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The user profile Amazon Resource Name (ARN).
 * `arn` - The user profile Amazon Resource Name (ARN).
@@ -119,8 +125,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-SageMaker User Profiles can be imported using the `arn`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SageMaker User Profiles using the `arn`. For example:
 
+```terraform
+import {
+  to = aws_sagemaker_user_profile.test_user_profile
+  id = "arn:aws:sagemaker:us-west-2:123456789012:user-profile/domain-id/profile-name"
+}
 ```
-$ terraform import aws_sagemaker_user_profile.test_user_profile arn:aws:sagemaker:us-west-2:123456789012:user-profile/domain-id/profile-name
+
+Using `terraform import`, import SageMaker User Profiles using the `arn`. For example:
+
+```console
+% terraform import aws_sagemaker_user_profile.test_user_profile arn:aws:sagemaker:us-west-2:123456789012:user-profile/domain-id/profile-name
 ```
diff --git a/website/docs/r/sagemaker_workforce.html.markdown b/website/docs/r/sagemaker_workforce.html.markdown
index 4965f99defa..aa809c8e765 100644
--- a/website/docs/r/sagemaker_workforce.html.markdown
+++ b/website/docs/r/sagemaker_workforce.html.markdown
@@ -61,7 +61,7 @@ resource "aws_sagemaker_workforce" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `workforce_name` - (Required) The name of the Workforce (must be unique).
 * `cognito_config` - (Optional) Use this parameter to configure an Amazon Cognito private workforce. A single Cognito workforce is created using and corresponds to a single Amazon Cognito user pool. Conflicts with `oidc_config`. see [Cognito Config](#cognito-config) details below.
@@ -95,9 +95,9 @@ The following arguments are supported:
 * `subnets` - (Optional) The ID of the subnets in the VPC that you want to connect.
 * `vpc_id` - (Optional) The ID of the VPC that the workforce uses for communication.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The Amazon Resource Name (ARN) assigned by AWS to this Workforce.
 * `id` - The name of the Workforce.
@@ -106,8 +106,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-SageMaker Workforces can be imported using the `workforce_name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SageMaker Workforces using the `workforce_name`. For example:
 
+```terraform
+import {
+  to = aws_sagemaker_workforce.example
+  id = "example"
+}
 ```
-$ terraform import aws_sagemaker_workforce.example example
+
+Using `terraform import`, import SageMaker Workforces using the `workforce_name`. For example:
+
+```console
+% terraform import aws_sagemaker_workforce.example example
 ```
diff --git a/website/docs/r/sagemaker_workteam.html.markdown b/website/docs/r/sagemaker_workteam.html.markdown
index f178e2293ea..ee9d9fb4747 100644
--- a/website/docs/r/sagemaker_workteam.html.markdown
+++ b/website/docs/r/sagemaker_workteam.html.markdown
@@ -48,7 +48,7 @@ resource "aws_sagemaker_workteam" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `description` - (Required) A description of the work team.
 * `workforce_name` - (Required) The name of the Workteam (must be unique).
@@ -76,9 +76,9 @@ The following arguments are supported:
 
 * `notification_topic_arn` - (Required) The ARN for the SNS topic to which notifications should be published.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The Amazon Resource Name (ARN) assigned by AWS to this Workteam.
 * `id` - The name of the Workteam.
@@ -87,8 +87,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-SageMaker Workteams can be imported using the `workteam_name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SageMaker Workteams using the `workteam_name`. For example:
 
+```terraform
+import {
+  to = aws_sagemaker_workteam.example
+  id = "example"
+}
 ```
-$ terraform import aws_sagemaker_workteam.example example
+
+Using `terraform import`, import SageMaker Workteams using the `workteam_name`. For example:
+
+```console
+% terraform import aws_sagemaker_workteam.example example
 ```
diff --git a/website/docs/r/scheduler_schedule.html.markdown b/website/docs/r/scheduler_schedule.html.markdown
index c6fc073d8aa..b137e1e5188 100644
--- a/website/docs/r/scheduler_schedule.html.markdown
+++ b/website/docs/r/scheduler_schedule.html.markdown
@@ -180,17 +180,26 @@ The following arguments are optional:
 
 * `message_group_id` - (Optional) FIFO message group ID to use as the target.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Name of the schedule.
 * `arn` - ARN of the schedule.
 
 ## Import
 
-Schedules can be imported using the combination `group_name/name`. For example:
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import schedules using the combination `group_name/name`. For example:
 
+```terraform
+import {
+  to = aws_scheduler_schedule.example
+  id = "my-schedule-group/my-schedule"
+}
 ```
-$ terraform import aws_scheduler_schedule.example my-schedule-group/my-schedule
+
+Using `terraform import`, import schedules using the combination `group_name/name`. For example:
+
+```console
+% terraform import aws_scheduler_schedule.example my-schedule-group/my-schedule
 ```
diff --git a/website/docs/r/scheduler_schedule_group.html.markdown b/website/docs/r/scheduler_schedule_group.html.markdown
index 9ce99b6cdd1..52b6309187d 100644
--- a/website/docs/r/scheduler_schedule_group.html.markdown
+++ b/website/docs/r/scheduler_schedule_group.html.markdown
@@ -30,9 +30,9 @@ The following arguments are optional:
 * `name_prefix` - (Optional, Forces new resource) Creates a unique name beginning with the specified prefix. Conflicts with `name`.
 * `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Name of the schedule group.
 * `arn` - ARN of the schedule group.
@@ -50,8 +50,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Schedule groups can be imported using the `name`. For example:
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import schedule groups using the `name`. For example:
 
+```terraform
+import {
+  to = aws_scheduler_schedule_group.example
+  id = "my-schedule-group"
+}
 ```
-$ terraform import aws_scheduler_schedule_group.example my-schedule-group
+
+Using `terraform import`, import schedule groups using the `name`. For example:
+
+```console
+% terraform import aws_scheduler_schedule_group.example my-schedule-group
 ```
diff --git a/website/docs/r/schemas_discoverer.html.markdown b/website/docs/r/schemas_discoverer.html.markdown
index 4c1a3f3a53b..e8bc7816c77 100644
--- a/website/docs/r/schemas_discoverer.html.markdown
+++ b/website/docs/r/schemas_discoverer.html.markdown
@@ -27,15 +27,15 @@ resource "aws_schemas_discoverer" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `source_arn` - (Required) The ARN of the event bus to discover event schemas on.
 * `description` - (Optional) The description of the discoverer. Maximum of 256 characters.
 * `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The Amazon Resource Name (ARN) of the discoverer.
 * `id` - The ID of the discoverer.
@@ -43,8 +43,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-EventBridge discoverers can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EventBridge discoverers using the `id`. For example:
+
+```terraform
+import {
+  to = aws_schemas_discoverer.test
+  id = "123"
+}
+```
+
+Using `terraform import`, import EventBridge discoverers using the `id`. For example:
 
 ```console
-$ terraform import aws_schemas_discoverer.test 123
+% terraform import aws_schemas_discoverer.test 123
 ```
diff --git a/website/docs/r/schemas_registry.html.markdown b/website/docs/r/schemas_registry.html.markdown
index ff3ad82242d..85188231449 100644
--- a/website/docs/r/schemas_registry.html.markdown
+++ b/website/docs/r/schemas_registry.html.markdown
@@ -23,23 +23,32 @@ resource "aws_schemas_registry" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The name of the custom event schema registry. Maximum of 64 characters consisting of lower case letters, upper case letters, 0-9, ., -, _.
 * `description` - (Optional) The description of the discoverer. Maximum of 256 characters.
 * `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The Amazon Resource Name (ARN) of the discoverer.
 * `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
 
 ## Import
 
-EventBridge schema registries can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EventBridge schema registries using the `name`. For example:
+
+```terraform
+import {
+  to = aws_schemas_registry.test
+  id = "my_own_registry"
+}
+```
+
+Using `terraform import`, import EventBridge schema registries using the `name`. For example:
 
 ```console
-$ terraform import aws_schemas_registry.test my_own_registry
+% terraform import aws_schemas_registry.test my_own_registry
 ```
diff --git a/website/docs/r/schemas_registry_policy.html.markdown b/website/docs/r/schemas_registry_policy.html.markdown
index 210d04841da..7ad5acd06c4 100644
--- a/website/docs/r/schemas_registry_policy.html.markdown
+++ b/website/docs/r/schemas_registry_policy.html.markdown
@@ -46,9 +46,9 @@ The following arguments are required:
 * `registry_name` - (Required) Name of EventBridge Schema Registry
 * `policy` - (Required) Resource Policy for EventBridge Schema Registry
 
-## Attributes Reference
+## Attribute Reference
 
-No additional attributes are exported.
+This resource exports no additional attributes.
 
 ## Timeouts
 
@@ -60,8 +60,17 @@ No additional attributes are exported.
 
 ## Import
 
-EventBridge Schema Registry Policy can be imported using the `registry_name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EventBridge Schema Registry Policy using the `registry_name`. For example:
 
+```terraform
+import {
+  to = aws_schemas_registry_policy.example
+  id = "example"
+}
 ```
-$ terraform import aws_schemas_registry_policy.example example
+
+Using `terraform import`, import EventBridge Schema Registry Policy using the `registry_name`. For example:
+
+```console
+% terraform import aws_schemas_registry_policy.example example
 ```
diff --git a/website/docs/r/schemas_schema.html.markdown b/website/docs/r/schemas_schema.html.markdown
index f55f1bbba87..338aece0393 100644
--- a/website/docs/r/schemas_schema.html.markdown
+++ b/website/docs/r/schemas_schema.html.markdown
@@ -50,18 +50,18 @@ resource "aws_schemas_schema" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The name of the schema. Maximum of 385 characters consisting of lower case letters, upper case letters, ., -, _, @.
 * `content` - (Required) The schema specification. Must be a valid Open API 3.0 spec.
 * `registry_name` - (Required) The name of the registry in which this schema belongs.
-* `type` - (Required) The type of the schema. Valid values: `OpenApi3`.
+* `type` - (Required) The type of the schema. Valid values: `OpenApi3` or `JSONSchemaDraft4`.
 * `description` - (Optional) The description of the schema. Maximum of 256 characters.
 * `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The Amazon Resource Name (ARN) of the discoverer.
 * `last_modified` - The last modified date of the schema.
@@ -71,8 +71,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-EventBridge schema can be imported using the `name` and `registry_name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EventBridge schema using the `name` and `registry_name`. For example:
+
+```terraform
+import {
+  to = aws_schemas_schema.test
+  id = "name/registry"
+}
+```
+
+Using `terraform import`, import EventBridge schema using the `name` and `registry_name`. For example:
 
 ```console
-$ terraform import aws_schemas_schema.test name/registry
+% terraform import aws_schemas_schema.test name/registry
 ```
diff --git a/website/docs/r/secretsmanager_secret.html.markdown b/website/docs/r/secretsmanager_secret.html.markdown
index 82550b9583f..a120eb7e5e0 100644
--- a/website/docs/r/secretsmanager_secret.html.markdown
+++ b/website/docs/r/secretsmanager_secret.html.markdown
@@ -22,7 +22,7 @@ resource "aws_secretsmanager_secret" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `description` - (Optional) Description of the secret.
 * `kms_key_id` - (Optional) ARN or Id of the AWS KMS key to be used to encrypt the secret values in the versions stored in this secret. If you need to reference a CMK in a different account, you can use only the key ARN. If you don't specify this value, then Secrets Manager defaults to using the AWS account's default KMS key (the one named `aws/secretsmanager`). If the default KMS key with that name doesn't yet exist, then AWS Secrets Manager creates it for you automatically the first time.
@@ -39,9 +39,9 @@ The following arguments are supported:
 * `kms_key_id` - (Optional) ARN, Key ID, or Alias of the AWS KMS key within the region secret is replicated to. If one is not specified, then Secrets Manager defaults to using the AWS account's default KMS key (`aws/secretsmanager`) in the region or creates one for use if non-existent.
 * `region` - (Required) Region for replicating the secret.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - ARN of the secret.
 * `arn` - ARN of the secret.
@@ -56,8 +56,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_secretsmanager_secret` can be imported by using the secret Amazon Resource Name (ARN), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_secretsmanager_secret` using the secret Amazon Resource Name (ARN). For example:
 
+```terraform
+import {
+  to = aws_secretsmanager_secret.example
+  id = "arn:aws:secretsmanager:us-east-1:123456789012:secret:example-123456"
+}
 ```
-$ terraform import aws_secretsmanager_secret.example arn:aws:secretsmanager:us-east-1:123456789012:secret:example-123456
+
+Using `terraform import`, import `aws_secretsmanager_secret` using the secret Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_secretsmanager_secret.example arn:aws:secretsmanager:us-east-1:123456789012:secret:example-123456
 ```
diff --git a/website/docs/r/secretsmanager_secret_policy.html.markdown b/website/docs/r/secretsmanager_secret_policy.html.markdown
index 42fd6ed0a51..808096aad3e 100644
--- a/website/docs/r/secretsmanager_secret_policy.html.markdown
+++ b/website/docs/r/secretsmanager_secret_policy.html.markdown
@@ -51,16 +51,25 @@ The following arguments are optional:
 
 * `block_public_policy` - (Optional) Makes an optional API call to Zelkova to validate the Resource Policy to prevent broad access to your secret.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Amazon Resource Name (ARN) of the secret.
 
 ## Import
 
-`aws_secretsmanager_secret_policy` can be imported by using the secret Amazon Resource Name (ARN), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_secretsmanager_secret_policy` using the secret Amazon Resource Name (ARN). For example:
 
+```terraform
+import {
+  to = aws_secretsmanager_secret_policy.example
+  id = "arn:aws:secretsmanager:us-east-1:123456789012:secret:example-123456"
+}
 ```
-$ terraform import aws_secretsmanager_secret_policy.example arn:aws:secretsmanager:us-east-1:123456789012:secret:example-123456
+
+Using `terraform import`, import `aws_secretsmanager_secret_policy` using the secret Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_secretsmanager_secret_policy.example arn:aws:secretsmanager:us-east-1:123456789012:secret:example-123456
 ```
diff --git a/website/docs/r/secretsmanager_secret_rotation.html.markdown b/website/docs/r/secretsmanager_secret_rotation.html.markdown
index 4eed9b49753..0f101d7c11d 100644
--- a/website/docs/r/secretsmanager_secret_rotation.html.markdown
+++ b/website/docs/r/secretsmanager_secret_rotation.html.markdown
@@ -35,7 +35,7 @@ To enable automatic secret rotation, the Secrets Manager service requires usage
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `secret_id` - (Required) Specifies the secret to which you want to add a new version. You can specify either the Amazon Resource Name (ARN) or the friendly name of the secret. The secret must already exist.
 * `rotation_lambda_arn` - (Required) Specifies the ARN of the Lambda function that can rotate the secret.
@@ -47,9 +47,9 @@ The following arguments are supported:
 * `duration` - (Optional) - The length of the rotation window in hours. For example, `3h` for a three hour window.
 * `schedule_expression` - (Optional) A `cron()` or `rate()` expression that defines the schedule for rotating your secret. Either `automatically_after_days` or `schedule_expression` must be specified.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Amazon Resource Name (ARN) of the secret.
 * `arn` - Amazon Resource Name (ARN) of the secret.
@@ -57,8 +57,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_secretsmanager_secret_rotation` can be imported by using the secret Amazon Resource Name (ARN), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_secretsmanager_secret_rotation` using the secret Amazon Resource Name (ARN). For example:
 
+```terraform
+import {
+  to = aws_secretsmanager_secret_rotation.example
+  id = "arn:aws:secretsmanager:us-east-1:123456789012:secret:example-123456"
+}
 ```
-$ terraform import aws_secretsmanager_secret_rotation.example arn:aws:secretsmanager:us-east-1:123456789012:secret:example-123456
+
+Using `terraform import`, import `aws_secretsmanager_secret_rotation` using the secret Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_secretsmanager_secret_rotation.example arn:aws:secretsmanager:us-east-1:123456789012:secret:example-123456
 ```
diff --git a/website/docs/r/secretsmanager_secret_version.html.markdown b/website/docs/r/secretsmanager_secret_version.html.markdown
index 15390f35028..e5de391b1ec 100644
--- a/website/docs/r/secretsmanager_secret_version.html.markdown
+++ b/website/docs/r/secretsmanager_secret_version.html.markdown
@@ -57,7 +57,7 @@ output "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `secret_id` - (Required) Specifies the secret to which you want to add a new version. You can specify either the Amazon Resource Name (ARN) or the friendly name of the secret. The secret must already exist.
 * `secret_string` - (Optional) Specifies text data that you want to encrypt and store in this version of the secret. This is required if secret_binary is not set.
@@ -66,9 +66,9 @@ The following arguments are supported:
 
 ~> **NOTE:** If `version_stages` is configured, you must include the `AWSCURRENT` staging label if this secret version is the only version or if the label is currently present on this secret version, otherwise Terraform will show a perpetual difference.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The ARN of the secret.
 * `id` - A pipe delimited combination of secret ID and version ID.
@@ -76,8 +76,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_secretsmanager_secret_version` can be imported by using the secret ID and version ID, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_secretsmanager_secret_version` using the secret ID and version ID. For example:
 
+```terraform
+import {
+  to = aws_secretsmanager_secret_version.example
+  id = "arn:aws:secretsmanager:us-east-1:123456789012:secret:example-123456|xxxxx-xxxxxxx-xxxxxxx-xxxxx"
+}
 ```
-$ terraform import aws_secretsmanager_secret_version.example 'arn:aws:secretsmanager:us-east-1:123456789012:secret:example-123456|xxxxx-xxxxxxx-xxxxxxx-xxxxx'
+
+Using `terraform import`, import `aws_secretsmanager_secret_version` using the secret ID and version ID. For example:
+
+```console
+% terraform import aws_secretsmanager_secret_version.example 'arn:aws:secretsmanager:us-east-1:123456789012:secret:example-123456|xxxxx-xxxxxxx-xxxxxxx-xxxxx'
 ```
diff --git a/website/docs/r/security_group.html.markdown b/website/docs/r/security_group.html.markdown
index 4ed02d408e6..0145e33f469 100644
--- a/website/docs/r/security_group.html.markdown
+++ b/website/docs/r/security_group.html.markdown
@@ -93,6 +93,20 @@ resource "aws_vpc_endpoint" "my_endpoint" {
 
 You can also find a specific Prefix List using the `aws_prefix_list` data source.
 
+### Removing All Ingress and Egress Rules
+
+The `ingress` and `egress` arguments are processed in [attributes-as-blocks](https://developer.hashicorp.com/terraform/language/attr-as-blocks) mode. Due to this, removing these arguments from the configuration will **not** cause Terraform to destroy the managed rules. To subsequently remove all managed ingress and egress rules:
+
+```terraform
+resource "aws_security_group" "example" {
+  name   = "sg"
+  vpc_id = aws_vpc.example.id
+
+  ingress = []
+  egress  = []
+}
+```
+
 ### Recreating a Security Group
 
 A simple security group `name` change "forces new" the security group--Terraform destroys the security group and creates a new one. (Likewise, `description`, `name_prefix`, or `vpc_id` [cannot be changed](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/working-with-security-groups.html#creating-security-group).) Attempting to recreate the security group leads to a variety of complications depending on how it is used.
@@ -213,7 +227,7 @@ resource "null_resource" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `description` - (Optional, Forces new resource) Security group description. Defaults to `Managed by Terraform`. Cannot be `""`. **NOTE**: This field maps to the AWS `GroupDescription` attribute, for which there is no Update API. If you'd like to classify your security groups in a way that can be updated, use `tags`.
 * `egress` - (Optional, VPC only) Configuration block for egress rules. Can be specified multiple times for each egress rule. Each egress block supports fields documented below. This argument is processed in [attribute-as-blocks mode](https://www.terraform.io/docs/configuration/attr-as-blocks.html).
@@ -236,6 +250,8 @@ The following arguments are required:
 
 The following arguments are optional:
 
+~> **Note** Although `cidr_blocks`, `ipv6_cidr_blocks`, `prefix_list_ids`, and `security_groups` are all marked as optional, you _must_ provide one of them in order to configure the source of the traffic.
+
 * `cidr_blocks` - (Optional) List of CIDR blocks.
 * `description` - (Optional) Description of this ingress rule.
 * `ipv6_cidr_blocks` - (Optional) List of IPv6 CIDR blocks.
@@ -254,6 +270,8 @@ The following arguments are required:
 
 The following arguments are optional:
 
+~> **Note** Although `cidr_blocks`, `ipv6_cidr_blocks`, `prefix_list_ids`, and `security_groups` are all marked as optional, you _must_ provide one of them in order to configure the destination of the traffic.
+
 * `cidr_blocks` - (Optional) List of CIDR blocks.
 * `description` - (Optional) Description of this egress rule.
 * `ipv6_cidr_blocks` - (Optional) List of IPv6 CIDR blocks.
@@ -262,9 +280,9 @@ The following arguments are optional:
 * `security_groups` - (Optional) List of security groups. A group name can be used relative to the default VPC. Otherwise, group ID.
 * `self` - (Optional) Whether the security group itself will be added as a source to this egress rule.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the security group.
 * `id` - ID of the security group.
@@ -280,8 +298,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Security Groups can be imported using the `security group id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Security Groups using the security group `id`. For example:
 
+```terraform
+import {
+  to = aws_security_group.elb_sg
+  id = "sg-903004f8"
+}
 ```
-$ terraform import aws_security_group.elb_sg sg-903004f8
+
+Using `terraform import`, import Security Groups using the security group `id`. For example:
+
+```console
+% terraform import aws_security_group.elb_sg sg-903004f8
 ```
diff --git a/website/docs/r/security_group_rule.html.markdown b/website/docs/r/security_group_rule.html.markdown
index 342283ddab0..a30d3a9f715 100644
--- a/website/docs/r/security_group_rule.html.markdown
+++ b/website/docs/r/security_group_rule.html.markdown
@@ -99,6 +99,8 @@ or `egress` (outbound).
 
 The following arguments are optional:
 
+~> **Note** Although `cidr_blocks`, `ipv6_cidr_blocks`, `prefix_list_ids`, and `source_security_group_id` are all marked as optional, you _must_ provide one of them in order to configure the source of the traffic.
+
 * `cidr_blocks` - (Optional) List of CIDR blocks. Cannot be specified with `source_security_group_id` or `self`.
 * `description` - (Optional) Description of the rule.
 * `ipv6_cidr_blocks` - (Optional) List of IPv6 CIDR blocks. Cannot be specified with `source_security_group_id` or `self`.
@@ -106,9 +108,9 @@ The following arguments are optional:
 * `self` - (Optional) Whether the security group itself will be added as a source to this ingress rule. Cannot be specified with `cidr_blocks`, `ipv6_cidr_blocks`, or `source_security_group_id`.
 * `source_security_group_id` - (Optional) Security group id to allow access to/from, depending on the `type`. Cannot be specified with `cidr_blocks`, `ipv6_cidr_blocks`, or `self`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - ID of the security group rule.
 * `security_group_rule_id` - If the `aws_security_group_rule` resource has a single source or destination then this is the AWS Security Group Rule resource ID. Otherwise it is empty.
@@ -121,48 +123,115 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Security Group Rules can be imported using the `security_group_id`, `type`, `protocol`, `from_port`, `to_port`, and source(s)/destination(s) (e.g., `cidr_block`) separated by underscores (`_`). All parts are required.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Security Group Rules using the `security_group_id`, `type`, `protocol`, `from_port`, `to_port`, and source(s)/destination(s) (such as a `cidr_block`) separated by underscores (`_`). All parts are required. For example:
+
+**NOTE:** Not all rule permissions (e.g., not all of a rule's CIDR blocks) need to be imported for Terraform to manage rule permissions. However, importing some of a rule's permissions but not others, and then making changes to the rule will result in the creation of an additional rule to capture the updated permissions. Rule permissions that were not imported are left intact in the original rule.
+
+Import an ingress rule in security group `sg-6e616f6d69` for TCP port 8000 with an IPv4 destination CIDR of `10.0.3.0/24`:
+
+```terraform
+import {
+  to = aws_security_group_rule.ingress
+  id = "sg-6e616f6d69_ingress_tcp_8000_8000_10.0.3.0/24"
+}
+```
+
+Import a rule with various IPv4 and IPv6 source CIDR blocks:
+
+```terraform
+import {
+  to = aws_security_group_rule.ingress
+  id = "sg-4973616163_ingress_tcp_100_121_10.1.0.0/16_2001:db8::/48_10.2.0.0/16_2002:db8::/48"
+}
+```
+
+Import a rule, applicable to all ports, with a protocol other than TCP/UDP/ICMP/ICMPV6/ALL, e.g., Multicast Transport Protocol (MTP), using the IANA protocol number. For example: 92.
+
+```terraform
+import {
+  to = aws_security_group_rule.ingress
+  id = "sg-6777656e646f6c796e_ingress_92_0_65536_10.0.3.0/24_10.0.4.0/24"
+}
+```
+
+Import a default any/any egress rule to 0.0.0.0/0:
+
+```terraform
+import {
+  to = aws_security_group_rule.default_egress
+  id = "sg-6777656e646f6c796e_egress_all_0_0_0.0.0.0/0"
+}
+```
+
+Import an egress rule with a prefix list ID destination:
+
+```terraform
+import {
+  to = aws_security_group_rule.egress
+  id = "sg-62726f6479_egress_tcp_8000_8000_pl-6469726b"
+}
+```
+
+Import a rule applicable to all protocols and ports with a security group source:
+
+```terraform
+import {
+  to = aws_security_group_rule.ingress_rule
+  id = "sg-7472697374616e_ingress_all_0_65536_sg-6176657279"
+}
+```
+
+Import a rule that has itself and an IPv6 CIDR block as sources:
+
+```terraform
+import {
+  to = aws_security_group_rule.rule_name
+  id = "sg-656c65616e6f72_ingress_tcp_80_80_self_2001:db8::/48"
+}
+```
+
+**Using `terraform import` to import** Security Group Rules using the `security_group_id`, `type`, `protocol`, `from_port`, `to_port`, and source(s)/destination(s) (such as a `cidr_block`) separated by underscores (`_`). All parts are required. For example:
 
-Not all rule permissions (e.g., not all of a rule's CIDR blocks) need to be imported for Terraform to manage rule permissions. However, importing some of a rule's permissions but not others, and then making changes to the rule will result in the creation of an additional rule to capture the updated permissions. Rule permissions that were not imported are left intact in the original rule.
+**NOTE:** Not all rule permissions (e.g., not all of a rule's CIDR blocks) need to be imported for Terraform to manage rule permissions. However, importing some of a rule's permissions but not others, and then making changes to the rule will result in the creation of an additional rule to capture the updated permissions. Rule permissions that were not imported are left intact in the original rule.
 
 Import an ingress rule in security group `sg-6e616f6d69` for TCP port 8000 with an IPv4 destination CIDR of `10.0.3.0/24`:
 
 ```console
-$ terraform import aws_security_group_rule.ingress sg-6e616f6d69_ingress_tcp_8000_8000_10.0.3.0/24
+% terraform import aws_security_group_rule.ingress sg-6e616f6d69_ingress_tcp_8000_8000_10.0.3.0/24
 ```
 
 Import a rule with various IPv4 and IPv6 source CIDR blocks:
 
 ```console
-$ terraform import aws_security_group_rule.ingress sg-4973616163_ingress_tcp_100_121_10.1.0.0/16_2001:db8::/48_10.2.0.0/16_2002:db8::/48
+% terraform import aws_security_group_rule.ingress sg-4973616163_ingress_tcp_100_121_10.1.0.0/16_2001:db8::/48_10.2.0.0/16_2002:db8::/48
 ```
 
-Import a rule, applicable to all ports, with a protocol other than TCP/UDP/ICMP/ICMPV6/ALL, e.g., Multicast Transport Protocol (MTP), using the IANA protocol number, e.g., 92.
+Import a rule, applicable to all ports, with a protocol other than TCP/UDP/ICMP/ICMPV6/ALL, e.g., Multicast Transport Protocol (MTP), using the IANA protocol number. For example: 92.
 
 ```console
-$ terraform import aws_security_group_rule.ingress sg-6777656e646f6c796e_ingress_92_0_65536_10.0.3.0/24_10.0.4.0/24
+% terraform import aws_security_group_rule.ingress sg-6777656e646f6c796e_ingress_92_0_65536_10.0.3.0/24_10.0.4.0/24
 ```
 
 Import a default any/any egress rule to 0.0.0.0/0:
 
 ```console
-$ terraform import aws_security_group_rule.default_egress sg-6777656e646f6c796e_egress_all_0_0_0.0.0.0/0
+% terraform import aws_security_group_rule.default_egress sg-6777656e646f6c796e_egress_all_0_0_0.0.0.0/0
 ```
 
 Import an egress rule with a prefix list ID destination:
 
 ```console
-$ terraform import aws_security_group_rule.egress sg-62726f6479_egress_tcp_8000_8000_pl-6469726b
+% terraform import aws_security_group_rule.egress sg-62726f6479_egress_tcp_8000_8000_pl-6469726b
 ```
 
 Import a rule applicable to all protocols and ports with a security group source:
 
 ```console
-$ terraform import aws_security_group_rule.ingress_rule sg-7472697374616e_ingress_all_0_65536_sg-6176657279
+% terraform import aws_security_group_rule.ingress_rule sg-7472697374616e_ingress_all_0_65536_sg-6176657279
 ```
 
 Import a rule that has itself and an IPv6 CIDR block as sources:
 
 ```console
-$ terraform import aws_security_group_rule.rule_name sg-656c65616e6f72_ingress_tcp_80_80_self_2001:db8::/48
+% terraform import aws_security_group_rule.rule_name sg-656c65616e6f72_ingress_tcp_80_80_self_2001:db8::/48
 ```
diff --git a/website/docs/r/securityhub_account.html.markdown b/website/docs/r/securityhub_account.html.markdown
new file mode 100644
index 00000000000..6aae43ab6c5
--- /dev/null
+++ b/website/docs/r/securityhub_account.html.markdown
@@ -0,0 +1,49 @@
+---
+subcategory: "Security Hub"
+layout: "aws"
+page_title: "AWS: aws_securityhub_account"
+description: |-
+  Enables Security Hub for an AWS account.
+---
+
+# Resource: aws_securityhub_account
+
+Enables Security Hub for this AWS account.
+
+~> **NOTE:** Destroying this resource will disable Security Hub for this AWS account.
+
+## Example Usage
+
+```terraform
+resource "aws_securityhub_account" "example" {}
+```
+
+## Argument Reference
+
+* `enable_default_standards` - (Optional) Whether to enable the security standards that Security Hub has designated as automatically enabled including: ` AWS Foundational Security Best Practices v1.0.0` and `CIS AWS Foundations Benchmark v1.2.0`. Defaults to `true`.
+* `control_finding_generator` - (Optional) Updates whether the calling account has consolidated control findings turned on. If the value for this field is set to `SECURITY_CONTROL`, Security Hub generates a single finding for a control check even when the check applies to multiple enabled standards. If the value for this field is set to `STANDARD_CONTROL`, Security Hub generates separate findings for a control check when the check applies to multiple enabled standards. For accounts that are part of an organization, this value can only be updated in the administrator account.
+* `auto_enable_controls` - (Optional) Whether to automatically enable new controls when they are added to standards that are enabled. By default, this is set to true, and new controls are enabled automatically. To not automatically enable new controls, set this to false.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - AWS Account ID.
+* `arn` - ARN of the SecurityHub Hub created in the account.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import an existing Security Hub enabled account using the AWS account ID. For example:
+
+```terraform
+import {
+  to = aws_securityhub_account.example
+  id = "123456789012"
+}
+```
+
+Using `terraform import`, import an existing Security Hub enabled account using the AWS account ID. For example:
+
+```console
+% terraform import aws_securityhub_account.example 123456789012
+```
diff --git a/website/docs/r/securityhub_account.markdown b/website/docs/r/securityhub_account.markdown
deleted file mode 100644
index ef483136b83..00000000000
--- a/website/docs/r/securityhub_account.markdown
+++ /dev/null
@@ -1,40 +0,0 @@
----
-subcategory: "Security Hub"
-layout: "aws"
-page_title: "AWS: aws_securityhub_account"
-description: |-
-  Enables Security Hub for an AWS account.
----
-
-# Resource: aws_securityhub_account
-
-Enables Security Hub for this AWS account.
-
-~> **NOTE:** Destroying this resource will disable Security Hub for this AWS account.
-
-## Example Usage
-
-```terraform
-resource "aws_securityhub_account" "example" {}
-```
-
-## Argument Reference
-
-* `enable_default_standards` - (Optional) Whether to enable the security standards that Security Hub has designated as automatically enabled including: ` AWS Foundational Security Best Practices v1.0.0` and `CIS AWS Foundations Benchmark v1.2.0`. Defaults to `true`.
-* `control_finding_generator` - (Optional) Updates whether the calling account has consolidated control findings turned on. If the value for this field is set to `SECURITY_CONTROL`, Security Hub generates a single finding for a control check even when the check applies to multiple enabled standards. If the value for this field is set to `STANDARD_CONTROL`, Security Hub generates separate findings for a control check when the check applies to multiple enabled standards. For accounts that are part of an organization, this value can only be updated in the administrator account.
-* `auto_enable_controls` - (Optional) Whether to automatically enable new controls when they are added to standards that are enabled. By default, this is set to true, and new controls are enabled automatically. To not automatically enable new controls, set this to false.
-
-## Attributes Reference
-
-In addition to all arguments above, the following attributes are exported:
-
-* `id` - AWS Account ID.
-* `arn` - ARN of the SecurityHub Hub created in the account.
-
-## Import
-
-An existing Security Hub enabled account can be imported using the AWS account ID, e.g.,
-
-```
-$ terraform import aws_securityhub_account.example 123456789012
-```
diff --git a/website/docs/r/securityhub_action_target.html.markdown b/website/docs/r/securityhub_action_target.html.markdown
index 7ec1d022e56..d1c4efdfb47 100644
--- a/website/docs/r/securityhub_action_target.html.markdown
+++ b/website/docs/r/securityhub_action_target.html.markdown
@@ -25,22 +25,31 @@ resource "aws_securityhub_action_target" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The description for the custom action target.
 * `identifier` - (Required) The ID for the custom action target.
 * `description` - (Required) The name of the custom action target.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name (ARN) of the Security Hub custom action target.
 
 ## Import
 
-Security Hub custom action can be imported using the action target ARN e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Security Hub custom action using the action target ARN. For example:
 
-```sh
-$ terraform import aws_securityhub_action_target.example arn:aws:securityhub:eu-west-1:312940875350:action/custom/a
+```terraform
+import {
+  to = aws_securityhub_action_target.example
+  id = "arn:aws:securityhub:eu-west-1:312940875350:action/custom/a"
+}
+```
+
+Using `terraform import`, import Security Hub custom action using the action target ARN. For example:
+
+```console
+% terraform import aws_securityhub_action_target.example arn:aws:securityhub:eu-west-1:312940875350:action/custom/a
 ```
diff --git a/website/docs/r/securityhub_finding_aggregator.html.markdown b/website/docs/r/securityhub_finding_aggregator.html.markdown
new file mode 100644
index 00000000000..4384f6e0b05
--- /dev/null
+++ b/website/docs/r/securityhub_finding_aggregator.html.markdown
@@ -0,0 +1,87 @@
+---
+subcategory: "Security Hub"
+layout: "aws"
+page_title: "AWS: aws_securityhub_finding_aggregator"
+description: |-
+  Manages a Security Hub finding aggregator
+---
+
+# Resource: aws_securityhub_finding_aggregator
+
+Manages a Security Hub finding aggregator. Security Hub needs to be enabled in a region in order for the aggregator to pull through findings.
+
+## Example Usage
+
+### All Regions Usage
+
+The following example will enable the aggregator for every region.
+
+```terraform
+resource "aws_securityhub_account" "example" {}
+
+resource "aws_securityhub_finding_aggregator" "example" {
+  linking_mode = "ALL_REGIONS"
+
+  depends_on = [aws_securityhub_account.example]
+}
+```
+
+### All Regions Except Specified Regions Usage
+
+The following example will enable the aggregator for every region except those specified in `specified_regions`.
+
+```terraform
+resource "aws_securityhub_account" "example" {}
+
+resource "aws_securityhub_finding_aggregator" "example" {
+  linking_mode      = "ALL_REGIONS_EXCEPT_SPECIFIED"
+  specified_regions = ["eu-west-1", "eu-west-2"]
+
+  depends_on = [aws_securityhub_account.example]
+}
+```
+
+### Specified Regions Usage
+
+The following example will enable the aggregator for every region specified in `specified_regions`.
+
+```terraform
+resource "aws_securityhub_account" "example" {}
+
+resource "aws_securityhub_finding_aggregator" "example" {
+  linking_mode      = "SPECIFIED_REGIONS"
+  specified_regions = ["eu-west-1", "eu-west-2"]
+
+  depends_on = [aws_securityhub_account.example]
+}
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+- `linking_mode` - (Required) Indicates whether to aggregate findings from all of the available Regions or from a specified list. The options are `ALL_REGIONS`, `ALL_REGIONS_EXCEPT_SPECIFIED` or `SPECIFIED_REGIONS`. When `ALL_REGIONS` or `ALL_REGIONS_EXCEPT_SPECIFIED` are used, Security Hub will automatically aggregate findings from new Regions as Security Hub supports them and you opt into them.
+- `specified_regions` - (Optional) List of regions to include or exclude (required if `linking_mode` is set to `ALL_REGIONS_EXCEPT_SPECIFIED` or `SPECIFIED_REGIONS`)
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+- `arn` - Amazon Resource Name (ARN) of the Security Hub finding aggregator.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import an existing Security Hub finding aggregator using the `arn`. For example:
+
+```terraform
+import {
+  to = aws_securityhub_finding_aggregator.example
+  id = "arn:aws:securityhub:eu-west-1:123456789098:finding-aggregator/abcd1234-abcd-1234-1234-abcdef123456"
+}
+```
+
+Using `terraform import`, import an existing Security Hub finding aggregator using the `arn`. For example:
+
+```console
+% terraform import aws_securityhub_finding_aggregator.example arn:aws:securityhub:eu-west-1:123456789098:finding-aggregator/abcd1234-abcd-1234-1234-abcdef123456
+```
diff --git a/website/docs/r/securityhub_finding_aggregator.markdown b/website/docs/r/securityhub_finding_aggregator.markdown
deleted file mode 100644
index 51c53ded0af..00000000000
--- a/website/docs/r/securityhub_finding_aggregator.markdown
+++ /dev/null
@@ -1,78 +0,0 @@
----
-subcategory: "Security Hub"
-layout: "aws"
-page_title: "AWS: aws_securityhub_finding_aggregator"
-description: |-
-  Manages a Security Hub finding aggregator
----
-
-# Resource: aws_securityhub_finding_aggregator
-
-Manages a Security Hub finding aggregator. Security Hub needs to be enabled in a region in order for the aggregator to pull through findings.
-
-## Example Usage
-
-### All Regions Usage
-
-The following example will enable the aggregator for every region.
-
-```terraform
-resource "aws_securityhub_account" "example" {}
-
-resource "aws_securityhub_finding_aggregator" "example" {
-  linking_mode = "ALL_REGIONS"
-
-  depends_on = [aws_securityhub_account.example]
-}
-```
-
-### All Regions Except Specified Regions Usage
-
-The following example will enable the aggregator for every region except those specified in `specified_regions`.
-
-```terraform
-resource "aws_securityhub_account" "example" {}
-
-resource "aws_securityhub_finding_aggregator" "example" {
-  linking_mode      = "ALL_REGIONS_EXCEPT_SPECIFIED"
-  specified_regions = ["eu-west-1", "eu-west-2"]
-
-  depends_on = [aws_securityhub_account.example]
-}
-```
-
-### Specified Regions Usage
-
-The following example will enable the aggregator for every region specified in `specified_regions`.
-
-```terraform
-resource "aws_securityhub_account" "example" {}
-
-resource "aws_securityhub_finding_aggregator" "example" {
-  linking_mode      = "SPECIFIED_REGIONS"
-  specified_regions = ["eu-west-1", "eu-west-2"]
-
-  depends_on = [aws_securityhub_account.example]
-}
-```
-
-## Argument Reference
-
-The following arguments are supported:
-
-- `linking_mode` - (Required) Indicates whether to aggregate findings from all of the available Regions or from a specified list. The options are `ALL_REGIONS`, `ALL_REGIONS_EXCEPT_SPECIFIED` or `SPECIFIED_REGIONS`. When `ALL_REGIONS` or `ALL_REGIONS_EXCEPT_SPECIFIED` are used, Security Hub will automatically aggregate findings from new Regions as Security Hub supports them and you opt into them.
-- `specified_regions` - (Optional) List of regions to include or exclude (required if `linking_mode` is set to `ALL_REGIONS_EXCEPT_SPECIFIED` or `SPECIFIED_REGIONS`)
-
-## Attributes Reference
-
-In addition to all arguments above, the following attributes are exported:
-
-- `arn` - Amazon Resource Name (ARN) of the Security Hub finding aggregator.
-
-## Import
-
-An existing Security Hub finding aggregator can be imported using the `arn`, e.g.,
-
-```
-$ terraform import aws_securityhub_finding_aggregator.example arn:aws:securityhub:eu-west-1:123456789098:finding-aggregator/abcd1234-abcd-1234-1234-abcdef123456
-```
diff --git a/website/docs/r/securityhub_insight.html.markdown b/website/docs/r/securityhub_insight.html.markdown
index b3eee0dcc3b..0d066441f17 100644
--- a/website/docs/r/securityhub_insight.html.markdown
+++ b/website/docs/r/securityhub_insight.html.markdown
@@ -285,17 +285,26 @@ The workflow status filter configuration block supports the following arguments:
 * `comparison` - (Required) The condition to apply to a string value when querying for findings. Valid values include: `EQUALS`, `PREFIX`, `NOT_EQUALS`, `PREFIX_NOT_EQUALS`.
 * `value` - (Required) The string filter value. Valid values include: `NEW`, `NOTIFIED`, `SUPPRESSED`, and `RESOLVED`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - ARN of the insight.
 * `arn` - ARN of the insight.
 
 ## Import
 
-Security Hub insights can be imported using the ARN, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Security Hub insights using the ARN. For example:
 
+```terraform
+import {
+  to = aws_securityhub_insight.example
+  id = "arn:aws:securityhub:us-west-2:1234567890:insight/1234567890/custom/91299ed7-abd0-4e44-a858-d0b15e37141a"
+}
 ```
-$ terraform import aws_securityhub_insight.example arn:aws:securityhub:us-west-2:1234567890:insight/1234567890/custom/91299ed7-abd0-4e44-a858-d0b15e37141a
+
+Using `terraform import`, import Security Hub insights using the ARN. For example:
+
+```console
+% terraform import aws_securityhub_insight.example arn:aws:securityhub:us-west-2:1234567890:insight/1234567890/custom/91299ed7-abd0-4e44-a858-d0b15e37141a
 ```
diff --git a/website/docs/r/securityhub_invite_accepter.html.markdown b/website/docs/r/securityhub_invite_accepter.html.markdown
new file mode 100644
index 00000000000..c508726e7fd
--- /dev/null
+++ b/website/docs/r/securityhub_invite_accepter.html.markdown
@@ -0,0 +1,64 @@
+---
+subcategory: "Security Hub"
+layout: "aws"
+page_title: "AWS: aws_securityhub_invite_accepter"
+description: |-
+  Accepts a Security Hub invitation.
+---
+
+# Resource: aws_securityhub_invite_accepter
+
+-> **Note:** AWS accounts can only be associated with a single Security Hub master account. Destroying this resource will disassociate the member account from the master account.
+
+Accepts a Security Hub invitation.
+
+## Example Usage
+
+```terraform
+resource "aws_securityhub_account" "example" {}
+
+resource "aws_securityhub_member" "example" {
+  account_id = "123456789012"
+  email      = "example@example.com"
+  invite     = true
+}
+
+resource "aws_securityhub_account" "invitee" {
+  provider = "aws.invitee"
+}
+
+resource "aws_securityhub_invite_accepter" "invitee" {
+  provider   = "aws.invitee"
+  depends_on = [aws_securityhub_account.invitee]
+  master_id  = aws_securityhub_member.example.master_id
+}
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `master_id` - (Required) The account ID of the master Security Hub account whose invitation you're accepting.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `invitation_id` - The ID of the invitation.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Security Hub invite acceptance using the account ID. For example:
+
+```terraform
+import {
+  to = aws_securityhub_invite_accepter.example
+  id = "123456789012"
+}
+```
+
+Using `terraform import`, import Security Hub invite acceptance using the account ID. For example:
+
+```console
+% terraform import aws_securityhub_invite_accepter.example 123456789012
+```
diff --git a/website/docs/r/securityhub_invite_accepter.markdown b/website/docs/r/securityhub_invite_accepter.markdown
deleted file mode 100644
index 228ee155eae..00000000000
--- a/website/docs/r/securityhub_invite_accepter.markdown
+++ /dev/null
@@ -1,55 +0,0 @@
----
-subcategory: "Security Hub"
-layout: "aws"
-page_title: "AWS: aws_securityhub_invite_accepter"
-description: |-
-  Accepts a Security Hub invitation.
----
-
-# Resource: aws_securityhub_invite_accepter
-
--> **Note:** AWS accounts can only be associated with a single Security Hub master account. Destroying this resource will disassociate the member account from the master account.
-
-Accepts a Security Hub invitation.
-
-## Example Usage
-
-```terraform
-resource "aws_securityhub_account" "example" {}
-
-resource "aws_securityhub_member" "example" {
-  account_id = "123456789012"
-  email      = "example@example.com"
-  invite     = true
-}
-
-resource "aws_securityhub_account" "invitee" {
-  provider = "aws.invitee"
-}
-
-resource "aws_securityhub_invite_accepter" "invitee" {
-  provider   = "aws.invitee"
-  depends_on = [aws_securityhub_account.invitee]
-  master_id  = aws_securityhub_member.example.master_id
-}
-```
-
-## Argument Reference
-
-The following arguments are supported:
-
-* `master_id` - (Required) The account ID of the master Security Hub account whose invitation you're accepting.
-
-## Attributes Reference
-
-In addition to all arguments above, the following attributes are exported:
-
-* `invitation_id` - The ID of the invitation.
-
-## Import
-
-Security Hub invite acceptance can be imported using the account ID, e.g.,
-
-```
-$ terraform import aws_securityhub_invite_accepter.example 123456789012
-```
diff --git a/website/docs/r/securityhub_member.html.markdown b/website/docs/r/securityhub_member.html.markdown
new file mode 100644
index 00000000000..14ebd0bde44
--- /dev/null
+++ b/website/docs/r/securityhub_member.html.markdown
@@ -0,0 +1,57 @@
+---
+subcategory: "Security Hub"
+layout: "aws"
+page_title: "AWS: aws_securityhub_member"
+description: |-
+  Provides a Security Hub member resource.
+---
+
+# Resource: aws_securityhub_member
+
+Provides a Security Hub member resource.
+
+## Example Usage
+
+```terraform
+resource "aws_securityhub_account" "example" {}
+
+resource "aws_securityhub_member" "example" {
+  depends_on = [aws_securityhub_account.example]
+  account_id = "123456789012"
+  email      = "example@example.com"
+  invite     = true
+}
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `account_id` - (Required) The ID of the member AWS account.
+* `email` - (Optional) The email of the member AWS account.
+* `invite` - (Optional) Boolean whether to invite the account to Security Hub as a member. Defaults to `false`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the member AWS account (matches `account_id`).
+* `master_id` - The ID of the master Security Hub AWS account.
+* `member_status` - The status of the member account relationship.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Security Hub members using their account ID. For example:
+
+```terraform
+import {
+  to = aws_securityhub_member.example
+  id = "123456789012"
+}
+```
+
+Using `terraform import`, import Security Hub members using their account ID. For example:
+
+```console
+% terraform import aws_securityhub_member.example 123456789012
+```
diff --git a/website/docs/r/securityhub_member.markdown b/website/docs/r/securityhub_member.markdown
deleted file mode 100644
index 043422c3e55..00000000000
--- a/website/docs/r/securityhub_member.markdown
+++ /dev/null
@@ -1,48 +0,0 @@
----
-subcategory: "Security Hub"
-layout: "aws"
-page_title: "AWS: aws_securityhub_member"
-description: |-
-  Provides a Security Hub member resource.
----
-
-# Resource: aws_securityhub_member
-
-Provides a Security Hub member resource.
-
-## Example Usage
-
-```terraform
-resource "aws_securityhub_account" "example" {}
-
-resource "aws_securityhub_member" "example" {
-  depends_on = [aws_securityhub_account.example]
-  account_id = "123456789012"
-  email      = "example@example.com"
-  invite     = true
-}
-```
-
-## Argument Reference
-
-The following arguments are supported:
-
-* `account_id` - (Required) The ID of the member AWS account.
-* `email` - (Optional) The email of the member AWS account.
-* `invite` - (Optional) Boolean whether to invite the account to Security Hub as a member. Defaults to `false`.
-
-## Attributes Reference
-
-In addition to all arguments above, the following attributes are exported:
-
-* `id` - The ID of the member AWS account (matches `account_id`).
-* `master_id` - The ID of the master Security Hub AWS account.
-* `member_status` - The status of the member account relationship.
-
-## Import
-
-Security Hub members can be imported using their account ID, e.g.,
-
-```
-$ terraform import aws_securityhub_member.example 123456789012
-```
diff --git a/website/docs/r/securityhub_organization_admin_account.html.markdown b/website/docs/r/securityhub_organization_admin_account.html.markdown
index 6314a0d4f91..8d2441ad43b 100644
--- a/website/docs/r/securityhub_organization_admin_account.html.markdown
+++ b/website/docs/r/securityhub_organization_admin_account.html.markdown
@@ -34,20 +34,29 @@ resource "aws_securityhub_organization_configuration" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `admin_account_id` - (Required) The AWS account identifier of the account to designate as the Security Hub administrator account.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - AWS account identifier.
 
 ## Import
 
-Security Hub Organization Admin Accounts can be imported using the AWS account ID, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Security Hub Organization Admin Accounts using the AWS account ID. For example:
 
+```terraform
+import {
+  to = aws_securityhub_organization_admin_account.example
+  id = "123456789012"
+}
 ```
-$ terraform import aws_securityhub_organization_admin_account.example 123456789012
+
+Using `terraform import`, import Security Hub Organization Admin Accounts using the AWS account ID. For example:
+
+```console
+% terraform import aws_securityhub_organization_admin_account.example 123456789012
 ```
diff --git a/website/docs/r/securityhub_organization_configuration.html.markdown b/website/docs/r/securityhub_organization_configuration.html.markdown
new file mode 100644
index 00000000000..416038853e1
--- /dev/null
+++ b/website/docs/r/securityhub_organization_configuration.html.markdown
@@ -0,0 +1,64 @@
+---
+subcategory: "Security Hub"
+layout: "aws"
+page_title: "AWS: aws_securityhub_organization_configuration"
+description: |-
+  Manages the Security Hub Organization Configuration
+---
+
+# Resource: aws_securityhub_organization_configuration
+
+Manages the Security Hub Organization Configuration.
+
+~> **NOTE:** This resource requires an [`aws_securityhub_organization_admin_account`](/docs/providers/aws/r/securityhub_organization_admin_account.html) to be configured (not necessarily with Terraform). More information about managing Security Hub in an organization can be found in the [Managing administrator and member accounts](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-accounts.html) documentation
+
+~> **NOTE:** This is an advanced Terraform resource. Terraform will automatically assume management of the Security Hub Organization Configuration without import and perform no actions on removal from the Terraform configuration.
+
+## Example Usage
+
+```terraform
+resource "aws_organizations_organization" "example" {
+  aws_service_access_principals = ["securityhub.amazonaws.com"]
+  feature_set                   = "ALL"
+}
+
+resource "aws_securityhub_organization_admin_account" "example" {
+  depends_on = [aws_organizations_organization.example]
+
+  admin_account_id = "123456789012"
+}
+
+resource "aws_securityhub_organization_configuration" "example" {
+  auto_enable = true
+}
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `auto_enable` - (Required) Whether to automatically enable Security Hub for new accounts in the organization.
+* `auto_enable_standards` - (Optional) Whether to automatically enable Security Hub default standards for new member accounts in the organization. By default, this parameter is equal to `DEFAULT`, and new member accounts are automatically enabled with default Security Hub standards. To opt out of enabling default standards for new member accounts, set this parameter equal to `NONE`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - AWS Account ID.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import an existing Security Hub enabled account using the AWS account ID. For example:
+
+```terraform
+import {
+  to = aws_securityhub_organization_configuration.example
+  id = "123456789012"
+}
+```
+
+Using `terraform import`, import an existing Security Hub enabled account using the AWS account ID. For example:
+
+```console
+% terraform import aws_securityhub_organization_configuration.example 123456789012
+```
diff --git a/website/docs/r/securityhub_organization_configuration.markdown b/website/docs/r/securityhub_organization_configuration.markdown
deleted file mode 100644
index 936fa055e4e..00000000000
--- a/website/docs/r/securityhub_organization_configuration.markdown
+++ /dev/null
@@ -1,55 +0,0 @@
----
-subcategory: "Security Hub"
-layout: "aws"
-page_title: "AWS: aws_securityhub_organization_configuration"
-description: |-
-  Manages the Security Hub Organization Configuration
----
-
-# Resource: aws_securityhub_organization_configuration
-
-Manages the Security Hub Organization Configuration.
-
-~> **NOTE:** This resource requires an [`aws_securityhub_organization_admin_account`](/docs/providers/aws/r/securityhub_organization_admin_account.html) to be configured (not necessarily with Terraform). More information about managing Security Hub in an organization can be found in the [Managing administrator and member accounts](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-accounts.html) documentation
-
-~> **NOTE:** This is an advanced Terraform resource. Terraform will automatically assume management of the Security Hub Organization Configuration without import and perform no actions on removal from the Terraform configuration.
-
-## Example Usage
-
-```terraform
-resource "aws_organizations_organization" "example" {
-  aws_service_access_principals = ["securityhub.amazonaws.com"]
-  feature_set                   = "ALL"
-}
-
-resource "aws_securityhub_organization_admin_account" "example" {
-  depends_on = [aws_organizations_organization.example]
-
-  admin_account_id = "123456789012"
-}
-
-resource "aws_securityhub_organization_configuration" "example" {
-  auto_enable = true
-}
-```
-
-## Argument Reference
-
-The following arguments are supported:
-
-* `auto_enable` - (Required) Whether to automatically enable Security Hub for new accounts in the organization.
-* `auto_enable_standards` - (Optional) Whether to automatically enable Security Hub default standards for new member accounts in the organization. By default, this parameter is equal to `DEFAULT`, and new member accounts are automatically enabled with default Security Hub standards. To opt out of enabling default standards for new member accounts, set this parameter equal to `NONE`.
-
-## Attributes Reference
-
-In addition to all arguments above, the following attributes are exported:
-
-* `id` - AWS Account ID.
-
-## Import
-
-An existing Security Hub enabled account can be imported using the AWS account ID, e.g.,
-
-```
-$ terraform import aws_securityhub_organization_configuration.example 123456789012
-```
diff --git a/website/docs/r/securityhub_product_subscription.html.markdown b/website/docs/r/securityhub_product_subscription.html.markdown
new file mode 100644
index 00000000000..1ac3a0c1c73
--- /dev/null
+++ b/website/docs/r/securityhub_product_subscription.html.markdown
@@ -0,0 +1,91 @@
+---
+subcategory: "Security Hub"
+layout: "aws"
+page_title: "AWS: aws_securityhub_product_subscription"
+description: |-
+  Subscribes to a Security Hub product.
+---
+
+# Resource: aws_securityhub_product_subscription
+
+Subscribes to a Security Hub product.
+
+## Example Usage
+
+```terraform
+resource "aws_securityhub_account" "example" {}
+
+data "aws_region" "current" {}
+
+resource "aws_securityhub_product_subscription" "example" {
+  depends_on  = [aws_securityhub_account.example]
+  product_arn = "arn:aws:securityhub:${data.aws_region.current.name}:733251395267:product/alertlogic/althreatmanagement"
+}
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `product_arn` - (Required) The ARN of the product that generates findings that you want to import into Security Hub - see below.
+
+Amazon maintains a list of [Product integrations in AWS Security Hub](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-findings-providers.html) that changes over time. Any of the products on the linked [Available AWS service integrations](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-internal-providers.html) or [Available third-party partner product integrations](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-partner-providers.html) can be configured using `aws_securityhub_product_subscription`.
+
+Available products can also be listed by running the AWS CLI command `aws securityhub describe-products`.
+
+A subset of currently available products (remember to replace `${var.region}` as appropriate) includes:
+
+* `arn:aws:securityhub:${var.region}::product/aws/guardduty`
+* `arn:aws:securityhub:${var.region}::product/aws/inspector`
+* `arn:aws:securityhub:${var.region}::product/aws/macie`
+* `arn:aws:securityhub:${var.region}::product/alertlogic/althreatmanagement`
+* `arn:aws:securityhub:${var.region}::product/armordefense/armoranywhere`
+* `arn:aws:securityhub:${var.region}::product/barracuda/cloudsecurityguardian`
+* `arn:aws:securityhub:${var.region}::product/checkpoint/cloudguard-iaas`
+* `arn:aws:securityhub:${var.region}::product/checkpoint/dome9-arc`
+* `arn:aws:securityhub:${var.region}::product/crowdstrike/crowdstrike-falcon`
+* `arn:aws:securityhub:${var.region}::product/cyberark/cyberark-pta`
+* `arn:aws:securityhub:${var.region}::product/f5networks/f5-advanced-waf`
+* `arn:aws:securityhub:${var.region}::product/fortinet/fortigate`
+* `arn:aws:securityhub:${var.region}::product/guardicore/aws-infection-monkey`
+* `arn:aws:securityhub:${var.region}::product/guardicore/guardicore`
+* `arn:aws:securityhub:${var.region}::product/ibm/qradar-siem`
+* `arn:aws:securityhub:${var.region}::product/imperva/imperva-attack-analytics`
+* `arn:aws:securityhub:${var.region}::product/mcafee-skyhigh/mcafee-mvision-cloud-aws`
+* `arn:aws:securityhub:${var.region}::product/paloaltonetworks/redlock`
+* `arn:aws:securityhub:${var.region}::product/paloaltonetworks/vm-series`
+* `arn:aws:securityhub:${var.region}::product/qualys/qualys-pc`
+* `arn:aws:securityhub:${var.region}::product/qualys/qualys-vm`
+* `arn:aws:securityhub:${var.region}::product/rapid7/insightvm`
+* `arn:aws:securityhub:${var.region}::product/sophos/sophos-server-protection`
+* `arn:aws:securityhub:${var.region}::product/splunk/splunk-enterprise`
+* `arn:aws:securityhub:${var.region}::product/splunk/splunk-phantom`
+* `arn:aws:securityhub:${var.region}::product/sumologicinc/sumologic-mda`
+* `arn:aws:securityhub:${var.region}::product/symantec-corp/symantec-cwp`
+* `arn:aws:securityhub:${var.region}::product/tenable/tenable-io`
+* `arn:aws:securityhub:${var.region}::product/trend-micro/deep-security`
+* `arn:aws:securityhub:${var.region}::product/turbot/turbot`
+* `arn:aws:securityhub:${var.region}::product/twistlock/twistlock-enterprise`
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of a resource that represents your subscription to the product that generates the findings that you want to import into Security Hub.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Security Hub product subscriptions using `product_arn,arn`. For example:
+
+```terraform
+import {
+  to = aws_securityhub_product_subscription.example
+  id = "arn:aws:securityhub:eu-west-1:733251395267:product/alertlogic/althreatmanagement,arn:aws:securityhub:eu-west-1:123456789012:product-subscription/alertlogic/althreatmanagement"
+}
+```
+
+Using `terraform import`, import Security Hub product subscriptions using `product_arn,arn`. For example:
+
+```console
+% terraform import aws_securityhub_product_subscription.example arn:aws:securityhub:eu-west-1:733251395267:product/alertlogic/althreatmanagement,arn:aws:securityhub:eu-west-1:123456789012:product-subscription/alertlogic/althreatmanagement
+```
diff --git a/website/docs/r/securityhub_product_subscription.markdown b/website/docs/r/securityhub_product_subscription.markdown
deleted file mode 100644
index 7b23c2139d2..00000000000
--- a/website/docs/r/securityhub_product_subscription.markdown
+++ /dev/null
@@ -1,82 +0,0 @@
----
-subcategory: "Security Hub"
-layout: "aws"
-page_title: "AWS: aws_securityhub_product_subscription"
-description: |-
-  Subscribes to a Security Hub product.
----
-
-# Resource: aws_securityhub_product_subscription
-
-Subscribes to a Security Hub product.
-
-## Example Usage
-
-```terraform
-resource "aws_securityhub_account" "example" {}
-
-data "aws_region" "current" {}
-
-resource "aws_securityhub_product_subscription" "example" {
-  depends_on  = [aws_securityhub_account.example]
-  product_arn = "arn:aws:securityhub:${data.aws_region.current.name}:733251395267:product/alertlogic/althreatmanagement"
-}
-```
-
-## Argument Reference
-
-The following arguments are supported:
-
-* `product_arn` - (Required) The ARN of the product that generates findings that you want to import into Security Hub - see below.
-
-Amazon maintains a list of [Product integrations in AWS Security Hub](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-findings-providers.html) that changes over time. Any of the products on the linked [Available AWS service integrations](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-internal-providers.html) or [Available third-party partner product integrations](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-partner-providers.html) can be configured using `aws_securityhub_product_subscription`.
-
-Available products can also be listed by running the AWS CLI command `aws securityhub describe-products`.
-
-A subset of currently available products (remember to replace `${var.region}` as appropriate) includes:
-
-* `arn:aws:securityhub:${var.region}::product/aws/guardduty`
-* `arn:aws:securityhub:${var.region}::product/aws/inspector`
-* `arn:aws:securityhub:${var.region}::product/aws/macie`
-* `arn:aws:securityhub:${var.region}::product/alertlogic/althreatmanagement`
-* `arn:aws:securityhub:${var.region}::product/armordefense/armoranywhere`
-* `arn:aws:securityhub:${var.region}::product/barracuda/cloudsecurityguardian`
-* `arn:aws:securityhub:${var.region}::product/checkpoint/cloudguard-iaas`
-* `arn:aws:securityhub:${var.region}::product/checkpoint/dome9-arc`
-* `arn:aws:securityhub:${var.region}::product/crowdstrike/crowdstrike-falcon`
-* `arn:aws:securityhub:${var.region}::product/cyberark/cyberark-pta`
-* `arn:aws:securityhub:${var.region}::product/f5networks/f5-advanced-waf`
-* `arn:aws:securityhub:${var.region}::product/fortinet/fortigate`
-* `arn:aws:securityhub:${var.region}::product/guardicore/aws-infection-monkey`
-* `arn:aws:securityhub:${var.region}::product/guardicore/guardicore`
-* `arn:aws:securityhub:${var.region}::product/ibm/qradar-siem`
-* `arn:aws:securityhub:${var.region}::product/imperva/imperva-attack-analytics`
-* `arn:aws:securityhub:${var.region}::product/mcafee-skyhigh/mcafee-mvision-cloud-aws`
-* `arn:aws:securityhub:${var.region}::product/paloaltonetworks/redlock`
-* `arn:aws:securityhub:${var.region}::product/paloaltonetworks/vm-series`
-* `arn:aws:securityhub:${var.region}::product/qualys/qualys-pc`
-* `arn:aws:securityhub:${var.region}::product/qualys/qualys-vm`
-* `arn:aws:securityhub:${var.region}::product/rapid7/insightvm`
-* `arn:aws:securityhub:${var.region}::product/sophos/sophos-server-protection`
-* `arn:aws:securityhub:${var.region}::product/splunk/splunk-enterprise`
-* `arn:aws:securityhub:${var.region}::product/splunk/splunk-phantom`
-* `arn:aws:securityhub:${var.region}::product/sumologicinc/sumologic-mda`
-* `arn:aws:securityhub:${var.region}::product/symantec-corp/symantec-cwp`
-* `arn:aws:securityhub:${var.region}::product/tenable/tenable-io`
-* `arn:aws:securityhub:${var.region}::product/trend-micro/deep-security`
-* `arn:aws:securityhub:${var.region}::product/turbot/turbot`
-* `arn:aws:securityhub:${var.region}::product/twistlock/twistlock-enterprise`
-
-## Attributes Reference
-
-In addition to all arguments above, the following attributes are exported:
-
-* `arn` - The ARN of a resource that represents your subscription to the product that generates the findings that you want to import into Security Hub.
-
-## Import
-
-Security Hub product subscriptions can be imported in the form `product_arn,arn`, e.g.,
-
-```sh
-$ terraform import aws_securityhub_product_subscription.example arn:aws:securityhub:eu-west-1:733251395267:product/alertlogic/althreatmanagement,arn:aws:securityhub:eu-west-1:123456789012:product-subscription/alertlogic/althreatmanagement
-```
diff --git a/website/docs/r/securityhub_standards_control.html.markdown b/website/docs/r/securityhub_standards_control.html.markdown
new file mode 100644
index 00000000000..17c6d17c9c9
--- /dev/null
+++ b/website/docs/r/securityhub_standards_control.html.markdown
@@ -0,0 +1,55 @@
+---
+subcategory: "Security Hub"
+layout: "aws"
+page_title: "AWS: aws_securityhub_standards_control"
+description: |-
+  Enable/disable Security Hub standards controls.
+---
+
+# Resource: aws_securityhub_standards_control
+
+Disable/enable Security Hub standards control in the current region.
+
+The `aws_securityhub_standards_control` behaves differently from normal resources, in that
+Terraform does not _create_ this resource, but instead "adopts" it
+into management. When you _delete_ this resource configuration, Terraform "abandons" resource as is and just removes it from the state.
+
+## Example Usage
+
+```terraform
+resource "aws_securityhub_account" "example" {}
+
+resource "aws_securityhub_standards_subscription" "cis_aws_foundations_benchmark" {
+  standards_arn = "arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0"
+  depends_on    = [aws_securityhub_account.example]
+}
+
+resource "aws_securityhub_standards_control" "ensure_iam_password_policy_prevents_password_reuse" {
+  standards_control_arn = "arn:aws:securityhub:us-east-1:111111111111:control/cis-aws-foundations-benchmark/v/1.2.0/1.10"
+  control_status        = "DISABLED"
+  disabled_reason       = "We handle password policies within Okta"
+
+  depends_on = [aws_securityhub_standards_subscription.cis_aws_foundations_benchmark]
+}
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `standards_control_arn` - (Required) The standards control ARN. See the AWS documentation for how to list existing controls using [`get-enabled-standards`](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/securityhub/get-enabled-standards.html) and [`describe-standards-controls`](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/securityhub/describe-standards-controls.html).
+* `control_status` – (Required) The control status could be `ENABLED` or `DISABLED`. You have to specify `disabled_reason` argument for `DISABLED` control status.
+* `disabled_reason` – (Optional) A description of the reason why you are disabling a security standard control. If you specify this attribute, `control_status` will be set to `DISABLED` automatically.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The standard control ARN.
+* `control_id` – The identifier of the security standard control.
+* `control_status_updated_at` – The date and time that the status of the security standard control was most recently updated.
+* `description` – The standard control longer description. Provides information about what the control is checking for.
+* `related_requirements` – The list of requirements that are related to this control.
+* `remediation_url` – A link to remediation information for the control in the Security Hub user documentation.
+* `severity_rating` – The severity of findings generated from this security standard control.
+* `title` – The standard control title.
diff --git a/website/docs/r/securityhub_standards_control.markdown b/website/docs/r/securityhub_standards_control.markdown
deleted file mode 100644
index f4a4d9612e5..00000000000
--- a/website/docs/r/securityhub_standards_control.markdown
+++ /dev/null
@@ -1,55 +0,0 @@
----
-subcategory: "Security Hub"
-layout: "aws"
-page_title: "AWS: aws_securityhub_standards_control"
-description: |-
-  Enable/disable Security Hub standards controls.
----
-
-# Resource: aws_securityhub_standards_control
-
-Disable/enable Security Hub standards control in the current region.
-
-The `aws_securityhub_standards_control` behaves differently from normal resources, in that
-Terraform does not _create_ this resource, but instead "adopts" it
-into management. When you _delete_ this resource configuration, Terraform "abandons" resource as is and just removes it from the state.
-
-## Example Usage
-
-```terraform
-resource "aws_securityhub_account" "example" {}
-
-resource "aws_securityhub_standards_subscription" "cis_aws_foundations_benchmark" {
-  standards_arn = "arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0"
-  depends_on    = [aws_securityhub_account.example]
-}
-
-resource "aws_securityhub_standards_control" "ensure_iam_password_policy_prevents_password_reuse" {
-  standards_control_arn = "arn:aws:securityhub:us-east-1:111111111111:control/cis-aws-foundations-benchmark/v/1.2.0/1.10"
-  control_status        = "DISABLED"
-  disabled_reason       = "We handle password policies within Okta"
-
-  depends_on = [aws_securityhub_standards_subscription.cis_aws_foundations_benchmark]
-}
-```
-
-## Argument Reference
-
-The following arguments are supported:
-
-* `standards_control_arn` - (Required) The standards control ARN.
-* `control_status` – (Required) The control status could be `ENABLED` or `DISABLED`. You have to specify `disabled_reason` argument for `DISABLED` control status.
-* `disabled_reason` – (Optional) A description of the reason why you are disabling a security standard control. If you specify this attribute, `control_status` will be set to `DISABLED` automatically.
-
-## Attributes Reference
-
-In addition to all arguments above, the following attributes are exported:
-
-* `id` - The standard control ARN.
-* `control_id` – The identifier of the security standard control.
-* `control_status_updated_at` – The date and time that the status of the security standard control was most recently updated.
-* `description` – The standard control longer description. Provides information about what the control is checking for.
-* `related_requirements` – The list of requirements that are related to this control.
-* `remediation_url` – A link to remediation information for the control in the Security Hub user documentation.
-* `severity_rating` – The severity of findings generated from this security standard control.
-* `title` – The standard control title.
diff --git a/website/docs/r/securityhub_standards_subscription.html.markdown b/website/docs/r/securityhub_standards_subscription.html.markdown
new file mode 100644
index 00000000000..93173417e63
--- /dev/null
+++ b/website/docs/r/securityhub_standards_subscription.html.markdown
@@ -0,0 +1,90 @@
+---
+subcategory: "Security Hub"
+layout: "aws"
+page_title: "AWS: aws_securityhub_standards_subscription"
+description: |-
+  Subscribes to a Security Hub standard.
+---
+
+# Resource: aws_securityhub_standards_subscription
+
+Subscribes to a Security Hub standard.
+
+## Example Usage
+
+```terraform
+resource "aws_securityhub_account" "example" {}
+
+data "aws_region" "current" {}
+
+resource "aws_securityhub_standards_subscription" "cis" {
+  depends_on    = [aws_securityhub_account.example]
+  standards_arn = "arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0"
+}
+
+resource "aws_securityhub_standards_subscription" "pci_321" {
+  depends_on    = [aws_securityhub_account.example]
+  standards_arn = "arn:aws:securityhub:${data.aws_region.current.name}::standards/pci-dss/v/3.2.1"
+}
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `standards_arn` - (Required) The ARN of a standard - see below.
+
+Currently available standards (remember to replace `${var.region}` as appropriate):
+
+| Name                                     | ARN                                                                                             |
+|------------------------------------------|-------------------------------------------------------------------------------------------------|
+| AWS Foundational Security Best Practices | `arn:aws:securityhub:${var.region}::standards/aws-foundational-security-best-practices/v/1.0.0` |
+| CIS AWS Foundations Benchmark v1.2.0     | `arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0`                           |
+| CIS AWS Foundations Benchmark v1.4.0     | `arn:aws:securityhub:${var.region}::standards/cis-aws-foundations-benchmark/v/1.4.0`            |
+| NIST SP 800-53 Rev. 5                    | `arn:aws:securityhub:${var.region}::standards/nist-800-53/v/5.0.0`                              |
+| PCI DSS                                  | `arn:aws:securityhub:${var.region}::standards/pci-dss/v/3.2.1`                                  |
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ARN of a resource that represents your subscription to a supported standard.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Security Hub standards subscriptions using the standards subscription ARN. For example:
+
+```terraform
+import {
+  to = aws_securityhub_standards_subscription.cis
+  id = "arn:aws:securityhub:eu-west-1:123456789012:subscription/cis-aws-foundations-benchmark/v/1.2.0"
+}
+```
+
+```terraform
+import {
+  to = aws_securityhub_standards_subscription.pci_321
+  id = "arn:aws:securityhub:eu-west-1:123456789012:subscription/pci-dss/v/3.2.1"
+}
+```
+
+```terraform
+import {
+  to = aws_securityhub_standards_subscription.nist_800_53_rev_5
+  id = "arn:aws:securityhub:eu-west-1:123456789012:subscription/nist-800-53/v/5.0.0"
+}
+```
+
+Using `terraform import`, import Security Hub standards subscriptions using the standards subscription ARN. For example:
+
+```console
+% terraform import aws_securityhub_standards_subscription.cis arn:aws:securityhub:eu-west-1:123456789012:subscription/cis-aws-foundations-benchmark/v/1.2.0
+```
+
+```console
+% terraform import aws_securityhub_standards_subscription.pci_321 arn:aws:securityhub:eu-west-1:123456789012:subscription/pci-dss/v/3.2.1
+```
+
+```console
+% terraform import aws_securityhub_standards_subscription.nist_800_53_rev_5 arn:aws:securityhub:eu-west-1:123456789012:subscription/nist-800-53/v/5.0.0
+```
diff --git a/website/docs/r/securityhub_standards_subscription.markdown b/website/docs/r/securityhub_standards_subscription.markdown
deleted file mode 100644
index 2a1b0dd41cd..00000000000
--- a/website/docs/r/securityhub_standards_subscription.markdown
+++ /dev/null
@@ -1,61 +0,0 @@
----
-subcategory: "Security Hub"
-layout: "aws"
-page_title: "AWS: aws_securityhub_standards_subscription"
-description: |-
-  Subscribes to a Security Hub standard.
----
-
-# Resource: aws_securityhub_standards_subscription
-
-Subscribes to a Security Hub standard.
-
-## Example Usage
-
-```terraform
-resource "aws_securityhub_account" "example" {}
-
-data "aws_region" "current" {}
-
-resource "aws_securityhub_standards_subscription" "cis" {
-  depends_on    = [aws_securityhub_account.example]
-  standards_arn = "arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0"
-}
-
-resource "aws_securityhub_standards_subscription" "pci_321" {
-  depends_on    = [aws_securityhub_account.example]
-  standards_arn = "arn:aws:securityhub:${data.aws_region.current.name}::standards/pci-dss/v/3.2.1"
-}
-```
-
-## Argument Reference
-
-The following arguments are supported:
-
-* `standards_arn` - (Required) The ARN of a standard - see below.
-
-Currently available standards (remember to replace `${var.region}` as appropriate):
-
-| Name                                     | ARN                                                                                             |
-|------------------------------------------|-------------------------------------------------------------------------------------------------|
-| AWS Foundational Security Best Practices | `arn:aws:securityhub:${var.region}::standards/aws-foundational-security-best-practices/v/1.0.0` |
-| CIS AWS Foundations Benchmark v1.2.0     | `arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0`                           |
-| CIS AWS Foundations Benchmark v1.4.0     | `arn:aws:securityhub:${var.region}::standards/cis-aws-foundations-benchmark/v/1.4.0`            |
-| NIST SP 800-53 Rev. 5                    | `arn:aws:securityhub:${var.region}::standards/nist-800-53/v/5.0.0`                              |
-| PCI DSS                                  | `arn:aws:securityhub:${var.region}::standards/pci-dss/v/3.2.1`                                  |
-
-## Attributes Reference
-
-In addition to all arguments above, the following attributes are exported:
-
-* `id` - The ARN of a resource that represents your subscription to a supported standard.
-
-## Import
-
-Security Hub standards subscriptions can be imported using the standards subscription ARN, e.g.,
-
-```
-$ terraform import aws_securityhub_standards_subscription.cis arn:aws:securityhub:eu-west-1:123456789012:subscription/cis-aws-foundations-benchmark/v/1.2.0
-$ terraform import aws_securityhub_standards_subscription.pci_321 arn:aws:securityhub:eu-west-1:123456789012:subscription/pci-dss/v/3.2.1
-$ terraform import aws_securityhub_standards_subscription.nist_800_53_rev_5 arn:aws:securityhub:eu-west-1:123456789012:subscription/nist-800-53/v/5.0.0
-```
diff --git a/website/docs/r/serverlessapplicationrepository_cloudformation_stack.html.markdown b/website/docs/r/serverlessapplicationrepository_cloudformation_stack.html.markdown
index 8c1b6d4c8a1..75815d97049 100644
--- a/website/docs/r/serverlessapplicationrepository_cloudformation_stack.html.markdown
+++ b/website/docs/r/serverlessapplicationrepository_cloudformation_stack.html.markdown
@@ -32,7 +32,7 @@ data "aws_region" "current" {}
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The name of the stack to create. The resource deployed in AWS will be prefixed with `serverlessrepo-`
 * `application_id` - (Required) The ARN of the application from the Serverless Application Repository.
@@ -41,9 +41,9 @@ The following arguments are supported:
 * `semantic_version` - (Optional) The version of the application to deploy. If not supplied, deploys the latest version.
 * `tags` - (Optional) A list of tags to associate with this stack. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - A unique identifier of the stack.
 * `outputs` - A map of outputs from the stack.
@@ -51,8 +51,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Serverless Application Repository Stack can be imported using the CloudFormation Stack name (with or without the `serverlessrepo-` prefix) or the CloudFormation Stack ID, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Serverless Application Repository Stack using the CloudFormation Stack name (with or without the `serverlessrepo-` prefix) or the CloudFormation Stack ID. For example:
 
+```terraform
+import {
+  to = aws_serverlessapplicationrepository_cloudformation_stack.example
+  id = "serverlessrepo-postgres-rotator"
+}
 ```
-$ terraform import aws_serverlessapplicationrepository_cloudformation_stack.example serverlessrepo-postgres-rotator
+
+Using `terraform import`, import Serverless Application Repository Stack using the CloudFormation Stack name (with or without the `serverlessrepo-` prefix) or the CloudFormation Stack ID. For example:
+
+```console
+% terraform import aws_serverlessapplicationrepository_cloudformation_stack.example serverlessrepo-postgres-rotator
 ```
diff --git a/website/docs/r/service_discovery_http_namespace.html.markdown b/website/docs/r/service_discovery_http_namespace.html.markdown
index e791f7c51a6..79d59f638f7 100644
--- a/website/docs/r/service_discovery_http_namespace.html.markdown
+++ b/website/docs/r/service_discovery_http_namespace.html.markdown
@@ -19,15 +19,15 @@ resource "aws_service_discovery_http_namespace" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The name of the http namespace.
 * `description` - (Optional) The description that you specify for the namespace when you create it.
 * `tags` - (Optional) A map of tags to assign to the namespace. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of a namespace.
 * `arn` - The ARN that Amazon Route 53 assigns to the namespace when you create it.
@@ -36,8 +36,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Service Discovery HTTP Namespace can be imported using the namespace ID, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Service Discovery HTTP Namespace using the namespace ID. For example:
 
+```terraform
+import {
+  to = aws_service_discovery_http_namespace.example
+  id = "ns-1234567890"
+}
 ```
-$ terraform import aws_service_discovery_http_namespace.example ns-1234567890
+
+Using `terraform import`, import Service Discovery HTTP Namespace using the namespace ID. For example:
+
+```console
+% terraform import aws_service_discovery_http_namespace.example ns-1234567890
 ```
diff --git a/website/docs/r/service_discovery_instance.html.markdown b/website/docs/r/service_discovery_instance.html.markdown
index dee6cf82861..eb5e0d92a0b 100644
--- a/website/docs/r/service_discovery_instance.html.markdown
+++ b/website/docs/r/service_discovery_instance.html.markdown
@@ -78,22 +78,31 @@ resource "aws_service_discovery_instance" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `instance_id` - (Required, ForceNew) The ID of the service instance.
 * `service_id` - (Required, ForceNew) The ID of the service that you want to use to create the instance.
 * `attributes` - (Required) A map contains the attributes of the instance. Check the [doc](https://docs.aws.amazon.com/cloud-map/latest/api/API_RegisterInstance.html#API_RegisterInstance_RequestSyntax) for the supported attributes and syntax.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the instance.
 
 ## Import
 
-Service Discovery Instance can be imported using the service ID and instance ID, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Service Discovery Instance using the service ID and instance ID. For example:
 
+```terraform
+import {
+  to = aws_service_discovery_instance.example
+  id = "0123456789/i-0123"
+}
 ```
-$ terraform import aws_service_discovery_instance.example 0123456789/i-0123
+
+Using `terraform import`, import Service Discovery Instance using the service ID and instance ID. For example:
+
+```console
+% terraform import aws_service_discovery_instance.example 0123456789/i-0123
 ```
diff --git a/website/docs/r/service_discovery_private_dns_namespace.html.markdown b/website/docs/r/service_discovery_private_dns_namespace.html.markdown
index e2656d779f5..e138330771b 100644
--- a/website/docs/r/service_discovery_private_dns_namespace.html.markdown
+++ b/website/docs/r/service_discovery_private_dns_namespace.html.markdown
@@ -26,16 +26,16 @@ resource "aws_service_discovery_private_dns_namespace" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The name of the namespace.
 * `vpc` - (Required) The ID of VPC that you want to associate the namespace with.
 * `description` - (Optional) The description that you specify for the namespace when you create it.
 * `tags` - (Optional) A map of tags to assign to the namespace. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of a namespace.
 * `arn` - The ARN that Amazon Route 53 assigns to the namespace when you create it.
@@ -44,8 +44,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Service Discovery Private DNS Namespace can be imported using the namespace ID and VPC ID, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Service Discovery Private DNS Namespace using the namespace ID and VPC ID. For example:
 
+```terraform
+import {
+  to = aws_service_discovery_private_dns_namespace.example
+  id = "0123456789:vpc-123345"
+}
 ```
-$ terraform import aws_service_discovery_private_dns_namespace.example 0123456789:vpc-123345
+
+Using `terraform import`, import Service Discovery Private DNS Namespace using the namespace ID and VPC ID. For example:
+
+```console
+% terraform import aws_service_discovery_private_dns_namespace.example 0123456789:vpc-123345
 ```
diff --git a/website/docs/r/service_discovery_public_dns_namespace.html.markdown b/website/docs/r/service_discovery_public_dns_namespace.html.markdown
index 93eb016744f..1bda172f0a2 100644
--- a/website/docs/r/service_discovery_public_dns_namespace.html.markdown
+++ b/website/docs/r/service_discovery_public_dns_namespace.html.markdown
@@ -21,15 +21,15 @@ resource "aws_service_discovery_public_dns_namespace" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The name of the namespace.
 * `description` - (Optional) The description that you specify for the namespace when you create it.
 * `tags` - (Optional) A map of tags to assign to the namespace. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of a namespace.
 * `arn` - The ARN that Amazon Route 53 assigns to the namespace when you create it.
@@ -38,8 +38,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Service Discovery Public DNS Namespace can be imported using the namespace ID, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Service Discovery Public DNS Namespace using the namespace ID. For example:
 
+```terraform
+import {
+  to = aws_service_discovery_public_dns_namespace.example
+  id = "0123456789"
+}
 ```
-$ terraform import aws_service_discovery_public_dns_namespace.example 0123456789
+
+Using `terraform import`, import Service Discovery Public DNS Namespace using the namespace ID. For example:
+
+```console
+% terraform import aws_service_discovery_public_dns_namespace.example 0123456789
 ```
diff --git a/website/docs/r/service_discovery_service.html.markdown b/website/docs/r/service_discovery_service.html.markdown
index 6a5a82c4f34..b486856acdb 100644
--- a/website/docs/r/service_discovery_service.html.markdown
+++ b/website/docs/r/service_discovery_service.html.markdown
@@ -73,7 +73,7 @@ resource "aws_service_discovery_service" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required, ForceNew) The name of the service.
 * `description` - (Optional) The description of the service.
@@ -87,7 +87,7 @@ The following arguments are supported:
 
 ### dns_config
 
-The following arguments are supported:
+This argument supports the following arguments:
 
 * `namespace_id` - (Required, ForceNew) The ID of the namespace to use for DNS configuration.
 * `dns_records` - (Required) An array that contains one DnsRecord object for each resource record set.
@@ -95,14 +95,14 @@ The following arguments are supported:
 
 #### dns_records
 
-The following arguments are supported:
+This argument supports the following arguments:
 
 * `ttl` - (Required) The amount of time, in seconds, that you want DNS resolvers to cache the settings for this resource record set.
 * `type` - (Required, ForceNew) The type of the resource, which indicates the value that Amazon Route 53 returns in response to DNS queries. Valid Values: A, AAAA, SRV, CNAME
 
 ### health_check_config
 
-The following arguments are supported:
+This argument supports the following arguments:
 
 * `failure_threshold` - (Optional) The number of consecutive health checks. Maximum value of 10.
 * `resource_path` - (Optional) The path that you want Route 53 to request when performing health checks. Route 53 automatically adds the DNS name for the service. If you don't specify a value, the default value is /.
@@ -110,13 +110,13 @@ The following arguments are supported:
 
 ### health_check_custom_config
 
-The following arguments are supported:
+This argument supports the following arguments:
 
 * `failure_threshold` - (Optional, ForceNew) The number of 30-second intervals that you want service discovery to wait before it changes the health status of a service instance.  Maximum value of 10.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the service.
 * `arn` - The ARN of the service.
@@ -124,8 +124,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Service Discovery Service can be imported using the service ID, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Service Discovery Service using the service ID. For example:
 
+```terraform
+import {
+  to = aws_service_discovery_service.example
+  id = "0123456789"
+}
 ```
-$ terraform import aws_service_discovery_service.example 0123456789
+
+Using `terraform import`, import Service Discovery Service using the service ID. For example:
+
+```console
+% terraform import aws_service_discovery_service.example 0123456789
 ```
diff --git a/website/docs/r/servicecatalog_budget_resource_association.html.markdown b/website/docs/r/servicecatalog_budget_resource_association.html.markdown
index e3c9681a487..388643a218f 100644
--- a/website/docs/r/servicecatalog_budget_resource_association.html.markdown
+++ b/website/docs/r/servicecatalog_budget_resource_association.html.markdown
@@ -30,9 +30,9 @@ The following arguments are required:
 * `budget_name` - (Required) Budget name.
 * `resource_id` - (Required) Resource identifier.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Identifier of the association.
 
@@ -46,8 +46,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_servicecatalog_budget_resource_association` can be imported using the budget name and resource ID, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_servicecatalog_budget_resource_association` using the budget name and resource ID. For example:
 
+```terraform
+import {
+  to = aws_servicecatalog_budget_resource_association.example
+  id = "budget-pjtvyakdlyo3m:prod-dnigbtea24ste"
+}
 ```
-$ terraform import aws_servicecatalog_budget_resource_association.example budget-pjtvyakdlyo3m:prod-dnigbtea24ste
+
+Using `terraform import`, import `aws_servicecatalog_budget_resource_association` using the budget name and resource ID. For example:
+
+```console
+% terraform import aws_servicecatalog_budget_resource_association.example budget-pjtvyakdlyo3m:prod-dnigbtea24ste
 ```
diff --git a/website/docs/r/servicecatalog_constraint.html.markdown b/website/docs/r/servicecatalog_constraint.html.markdown
index c7bb6220fe8..e7b783fe3cc 100644
--- a/website/docs/r/servicecatalog_constraint.html.markdown
+++ b/website/docs/r/servicecatalog_constraint.html.markdown
@@ -77,9 +77,9 @@ The `type` you specify determines what must be included in the `parameters` JSON
 
 * `TEMPLATE`: Specify the Rules property. For more information, see [Template Constraint Rules](http://docs.aws.amazon.com/servicecatalog/latest/adminguide/reference-template_constraint_rules.html).
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Constraint identifier.
 * `owner` - Owner of the constraint.
@@ -95,8 +95,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_servicecatalog_constraint` can be imported using the constraint ID, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_servicecatalog_constraint` using the constraint ID. For example:
 
+```terraform
+import {
+  to = aws_servicecatalog_constraint.example
+  id = "cons-nmdkb6cgxfcrs"
+}
 ```
-$ terraform import aws_servicecatalog_constraint.example cons-nmdkb6cgxfcrs
+
+Using `terraform import`, import `aws_servicecatalog_constraint` using the constraint ID. For example:
+
+```console
+% terraform import aws_servicecatalog_constraint.example cons-nmdkb6cgxfcrs
 ```
diff --git a/website/docs/r/servicecatalog_organizations_access.html.markdown b/website/docs/r/servicecatalog_organizations_access.html.markdown
index e6385915934..172ab2c3400 100644
--- a/website/docs/r/servicecatalog_organizations_access.html.markdown
+++ b/website/docs/r/servicecatalog_organizations_access.html.markdown
@@ -28,9 +28,9 @@ The following arguments are required:
 
 * `enabled` - (Required) Whether to enable AWS Organizations access.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Account ID for the account using the resource.
 
diff --git a/website/docs/r/servicecatalog_portfolio.html.markdown b/website/docs/r/servicecatalog_portfolio.html.markdown
index 33b98fcaa16..76817ed28cf 100644
--- a/website/docs/r/servicecatalog_portfolio.html.markdown
+++ b/website/docs/r/servicecatalog_portfolio.html.markdown
@@ -22,16 +22,16 @@ resource "aws_servicecatalog_portfolio" "portfolio" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The name of the portfolio.
 * `description` - (Required) Description of the portfolio
 * `provider_name` - (Required) Name of the person or organization who owns the portfolio.
 * `tags` - (Optional) Tags to apply to the connection. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the Service Catalog Portfolio.
 * `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
@@ -47,8 +47,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Service Catalog Portfolios can be imported using the `service catalog portfolio id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Service Catalog Portfolios using the Service Catalog Portfolio `id`. For example:
 
+```terraform
+import {
+  to = aws_servicecatalog_portfolio.testfolio
+  id = "port-12344321"
+}
 ```
-$ terraform import aws_servicecatalog_portfolio.testfolio port-12344321
+
+Using `terraform import`, import Service Catalog Portfolios using the Service Catalog Portfolio `id`. For example:
+
+```console
+% terraform import aws_servicecatalog_portfolio.testfolio port-12344321
 ```
diff --git a/website/docs/r/servicecatalog_portfolio_share.html.markdown b/website/docs/r/servicecatalog_portfolio_share.html.markdown
index ef9ddb98259..17b4b044cf9 100644
--- a/website/docs/r/servicecatalog_portfolio_share.html.markdown
+++ b/website/docs/r/servicecatalog_portfolio_share.html.markdown
@@ -45,9 +45,9 @@ The following arguments are optional:
 * `share_tag_options` - (Optional) Whether to enable sharing of `aws_servicecatalog_tag_option` resources when creating the portfolio share.
 * `wait_for_acceptance` - (Optional) Whether to wait (up to the timeout) for the share to be accepted. Organizational shares are automatically accepted.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `accepted` - Whether the shared portfolio is imported by the recipient account. If the recipient is organizational, the share is automatically imported, and the field is always set to true.
 
@@ -62,8 +62,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_servicecatalog_portfolio_share` can be imported using the portfolio share ID, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_servicecatalog_portfolio_share` using the portfolio share ID. For example:
 
+```terraform
+import {
+  to = aws_servicecatalog_portfolio_share.example
+  id = "port-12344321:ACCOUNT:123456789012"
+}
 ```
-$ terraform import aws_servicecatalog_portfolio_share.example port-12344321:ACCOUNT:123456789012
+
+Using `terraform import`, import `aws_servicecatalog_portfolio_share` using the portfolio share ID. For example:
+
+```console
+% terraform import aws_servicecatalog_portfolio_share.example port-12344321:ACCOUNT:123456789012
 ```
diff --git a/website/docs/r/servicecatalog_principal_portfolio_association.html.markdown b/website/docs/r/servicecatalog_principal_portfolio_association.html.markdown
index ab968c9a68d..5f78848eccb 100644
--- a/website/docs/r/servicecatalog_principal_portfolio_association.html.markdown
+++ b/website/docs/r/servicecatalog_principal_portfolio_association.html.markdown
@@ -31,11 +31,11 @@ The following arguments are required:
 The following arguments are optional:
 
 * `accept_language` - (Optional) Language code. Valid values: `en` (English), `jp` (Japanese), `zh` (Chinese). Default value is `en`.
-* `principal_type` - (Optional) Principal type. Setting this argument empty (e.g., `principal_type = ""`) will result in an error. Valid value is `IAM`. Default is `IAM`.
+* `principal_type` - (Optional) Principal type. Setting this argument empty (e.g., `principal_type = ""`) will result in an error. Valid values are `IAM` and `IAM_PATTERN`. Default is `IAM`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Identifier of the association.
 
@@ -49,8 +49,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_servicecatalog_principal_portfolio_association` can be imported using the accept language, principal ARN, and portfolio ID, separated by a comma, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_servicecatalog_principal_portfolio_association` using `accept_language`, `principal_arn`, `portfolio_id`, and `principal_type` separated by a comma. For example:
 
+```terraform
+import {
+  to = aws_servicecatalog_principal_portfolio_association.example
+  id = "en,arn:aws:iam::123456789012:user/Eleanor,port-68656c6c6f,IAM"
+}
 ```
-$ terraform import aws_servicecatalog_principal_portfolio_association.example en,arn:aws:iam::123456789012:user/Eleanor,port-68656c6c6f
+
+Using `terraform import`, import `aws_servicecatalog_principal_portfolio_association` using `accept_language`, `principal_arn`, `portfolio_id`, and `principal_type` separated by a comma. For example:
+
+```console
+% terraform import aws_servicecatalog_principal_portfolio_association.example en,arn:aws:iam::123456789012:user/Eleanor,port-68656c6c6f,IAM
 ```
diff --git a/website/docs/r/servicecatalog_product.html.markdown b/website/docs/r/servicecatalog_product.html.markdown
index 7d0703d6e74..29d92156f33 100644
--- a/website/docs/r/servicecatalog_product.html.markdown
+++ b/website/docs/r/servicecatalog_product.html.markdown
@@ -55,7 +55,7 @@ The following arguments are optional:
 
 ### provisioning_artifact_parameters
 
-The following arguments are supported:
+This argument supports the following arguments:
 
 * `description` - (Optional) Description of the provisioning artifact (i.e., version), including how it differs from the previous provisioning artifact.
 * `disable_template_validation` - (Optional) Whether AWS Service Catalog stops validating the specified provisioning artifact template even if it is invalid.
@@ -64,9 +64,9 @@ The following arguments are supported:
 * `template_url` - (Required if `template_physical_id` is not provided) Template source as URL of the CloudFormation template in Amazon S3.
 * `type` - (Optional) Type of provisioning artifact. See [AWS Docs](https://docs.aws.amazon.com/servicecatalog/latest/dg/API_ProvisioningArtifactProperties.html) for valid list of values.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the product.
 * `created_time` - Time when the product was created.
@@ -86,8 +86,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_servicecatalog_product` can be imported using the product ID, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_servicecatalog_product` using the product ID. For example:
 
+```terraform
+import {
+  to = aws_servicecatalog_product.example
+  id = "prod-dnigbtea24ste"
+}
 ```
-$ terraform import aws_servicecatalog_product.example prod-dnigbtea24ste
+
+Using `terraform import`, import `aws_servicecatalog_product` using the product ID. For example:
+
+```console
+% terraform import aws_servicecatalog_product.example prod-dnigbtea24ste
 ```
diff --git a/website/docs/r/servicecatalog_product_portfolio_association.html.markdown b/website/docs/r/servicecatalog_product_portfolio_association.html.markdown
index 744da470522..31566da4a31 100644
--- a/website/docs/r/servicecatalog_product_portfolio_association.html.markdown
+++ b/website/docs/r/servicecatalog_product_portfolio_association.html.markdown
@@ -33,9 +33,9 @@ The following arguments are optional:
 * `accept_language` - (Optional) Language code. Valid values: `en` (English), `jp` (Japanese), `zh` (Chinese). Default value is `en`.
 * `source_portfolio_id` - (Optional) Identifier of the source portfolio.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Identifier of the association.
 
@@ -47,8 +47,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_servicecatalog_product_portfolio_association` can be imported using the accept language, portfolio ID, and product ID, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_servicecatalog_product_portfolio_association` using the accept language, portfolio ID, and product ID. For example:
 
+```terraform
+import {
+  to = aws_servicecatalog_product_portfolio_association.example
+  id = "en:port-68656c6c6f:prod-dnigbtea24ste"
+}
 ```
-$ terraform import aws_servicecatalog_product_portfolio_association.example en:port-68656c6c6f:prod-dnigbtea24ste
+
+Using `terraform import`, import `aws_servicecatalog_product_portfolio_association` using the accept language, portfolio ID, and product ID. For example:
+
+```console
+% terraform import aws_servicecatalog_product_portfolio_association.example en:port-68656c6c6f:prod-dnigbtea24ste
 ```
diff --git a/website/docs/r/servicecatalog_provisioned_product.html.markdown b/website/docs/r/servicecatalog_provisioned_product.html.markdown
index 21d438960d5..495f955957e 100644
--- a/website/docs/r/servicecatalog_provisioned_product.html.markdown
+++ b/website/docs/r/servicecatalog_provisioned_product.html.markdown
@@ -63,7 +63,7 @@ The following arguments are optional:
 
 ### provisioning_parameters
 
-The following arguments are supported:
+This argument supports the following arguments:
 
 * `key` - (Required) Parameter key.
 * `use_previous_value` - (Optional) Whether to ignore `value` and keep the previous parameter value. Ignored when initially provisioning a product.
@@ -73,7 +73,7 @@ The following arguments are supported:
 
 All of the `stack_set_provisioning_preferences` are only applicable to a `CFN_STACKSET` provisioned product type.
 
-The following arguments are supported:
+This argument supports the following arguments:
 
 * `accounts` - (Optional) One or more AWS accounts that will have access to the provisioned product. The AWS accounts specified should be within the list of accounts in the STACKSET constraint. To get the list of accounts in the STACKSET constraint, use the `aws_servicecatalog_provisioning_parameters` data source. If no values are specified, the default value is all accounts from the STACKSET constraint.
 * `failure_tolerance_count` - (Optional) Number of accounts, per region, for which this operation can fail before AWS Service Catalog stops the operation in that region. If the operation is stopped in a region, AWS Service Catalog doesn't attempt the operation in any subsequent regions. You must specify either `failure_tolerance_count` or `failure_tolerance_percentage`, but not both. The default value is 0 if no value is specified.
@@ -82,9 +82,9 @@ The following arguments are supported:
 * `max_concurrency_percentage` - (Optional) Maximum percentage of accounts in which to perform this operation at one time. When calculating the number of accounts based on the specified percentage, AWS Service Catalog rounds down to the next whole number. This is true except in cases where rounding down would result is zero. In this case, AWS Service Catalog sets the number as 1 instead. Note that this setting lets you specify the maximum for operations. For large deployments, under certain circumstances the actual number of accounts acted upon concurrently may be lower due to service throttling. You must specify either `max_concurrency_count` or `max_concurrency_percentage`, but not both.
 * `regions` - (Optional) One or more AWS Regions where the provisioned product will be available. The specified regions should be within the list of regions from the STACKSET constraint. To get the list of regions in the STACKSET constraint, use the `aws_servicecatalog_provisioning_parameters` data source. If no values are specified, the default value is all regions from the STACKSET constraint.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the provisioned product.
 * `cloudwatch_dashboard_names` - Set of CloudWatch dashboards that were created when provisioning the product.
@@ -122,8 +122,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_servicecatalog_provisioned_product` can be imported using the provisioned product ID, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_servicecatalog_provisioned_product` using the provisioned product ID. For example:
 
+```terraform
+import {
+  to = aws_servicecatalog_provisioned_product.example
+  id = "pp-dnigbtea24ste"
+}
 ```
-$ terraform import aws_servicecatalog_provisioned_product.example pp-dnigbtea24ste
+
+Using `terraform import`, import `aws_servicecatalog_provisioned_product` using the provisioned product ID. For example:
+
+```console
+% terraform import aws_servicecatalog_provisioned_product.example pp-dnigbtea24ste
 ```
diff --git a/website/docs/r/servicecatalog_provisioning_artifact.html.markdown b/website/docs/r/servicecatalog_provisioning_artifact.html.markdown
index 5e1b7899a6d..81cf3b00683 100644
--- a/website/docs/r/servicecatalog_provisioning_artifact.html.markdown
+++ b/website/docs/r/servicecatalog_provisioning_artifact.html.markdown
@@ -47,9 +47,9 @@ The following arguments are optional:
 * `name` - (Optional) Name of the provisioning artifact (for example, `v1`, `v2beta`). No spaces are allowed.
 * `type` - (Optional) Type of provisioning artifact. See [AWS Docs](https://docs.aws.amazon.com/servicecatalog/latest/dg/API_ProvisioningArtifactProperties.html) for valid list of values.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `created_time` - Time when the provisioning artifact was created.
 * `id` - Provisioning artifact identifier and product identifier separated by a colon.
@@ -67,8 +67,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_servicecatalog_provisioning_artifact` can be imported using the provisioning artifact ID and product ID separated by a colon, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_servicecatalog_provisioning_artifact` using the provisioning artifact ID and product ID separated by a colon. For example:
 
+```terraform
+import {
+  to = aws_servicecatalog_provisioning_artifact.example
+  id = "pa-ij2b6lusy6dec:prod-el3an0rma3"
+}
 ```
-$ terraform import aws_servicecatalog_provisioning_artifact.example pa-ij2b6lusy6dec:prod-el3an0rma3
+
+Using `terraform import`, import `aws_servicecatalog_provisioning_artifact` using the provisioning artifact ID and product ID separated by a colon. For example:
+
+```console
+% terraform import aws_servicecatalog_provisioning_artifact.example pa-ij2b6lusy6dec:prod-el3an0rma3
 ```
diff --git a/website/docs/r/servicecatalog_service_action.html.markdown b/website/docs/r/servicecatalog_service_action.html.markdown
index a19ca023129..e8814dd9114 100644
--- a/website/docs/r/servicecatalog_service_action.html.markdown
+++ b/website/docs/r/servicecatalog_service_action.html.markdown
@@ -47,9 +47,9 @@ The `definition` configuration block supports the following attributes:
 * `type` - (Optional) Service action definition type. Valid value is `SSM_AUTOMATION`. Default is `SSM_AUTOMATION`.
 * `version` - (Required) SSM document version. For example, `1`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Identifier of the service action.
 
@@ -64,8 +64,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_servicecatalog_service_action` can be imported using the service action ID, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_servicecatalog_service_action` using the service action ID. For example:
 
+```terraform
+import {
+  to = aws_servicecatalog_service_action.example
+  id = "act-f1w12eperfslh"
+}
 ```
-$ terraform import aws_servicecatalog_service_action.example act-f1w12eperfslh
+
+Using `terraform import`, import `aws_servicecatalog_service_action` using the service action ID. For example:
+
+```console
+% terraform import aws_servicecatalog_service_action.example act-f1w12eperfslh
 ```
diff --git a/website/docs/r/servicecatalog_tag_option.html.markdown b/website/docs/r/servicecatalog_tag_option.html.markdown
index 77b2c7b419f..1a73bf1dc33 100644
--- a/website/docs/r/servicecatalog_tag_option.html.markdown
+++ b/website/docs/r/servicecatalog_tag_option.html.markdown
@@ -32,9 +32,9 @@ The following arguments are optional:
 
 * `active` - (Optional) Whether tag option is active. Default is `true`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Identifier (e.g., `tag-pjtvagohlyo3m`).
 * `owner_id` - AWS account ID of the owner account that created the tag option.
@@ -50,8 +50,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_servicecatalog_tag_option` can be imported using the tag option ID, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_servicecatalog_tag_option` using the tag option ID. For example:
 
+```terraform
+import {
+  to = aws_servicecatalog_tag_option.example
+  id = "tag-pjtvagohlyo3m"
+}
 ```
-$ terraform import aws_servicecatalog_tag_option.example tag-pjtvagohlyo3m
+
+Using `terraform import`, import `aws_servicecatalog_tag_option` using the tag option ID. For example:
+
+```console
+% terraform import aws_servicecatalog_tag_option.example tag-pjtvagohlyo3m
 ```
diff --git a/website/docs/r/servicecatalog_tag_option_resource_association.html.markdown b/website/docs/r/servicecatalog_tag_option_resource_association.html.markdown
index bb102a9fdaa..c219926f363 100644
--- a/website/docs/r/servicecatalog_tag_option_resource_association.html.markdown
+++ b/website/docs/r/servicecatalog_tag_option_resource_association.html.markdown
@@ -30,9 +30,9 @@ The following arguments are required:
 * `resource_id` - (Required) Resource identifier.
 * `tag_option_id` - (Required) Tag Option identifier.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Identifier of the association.
 * `resource_arn` - ARN of the resource.
@@ -50,8 +50,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_servicecatalog_tag_option_resource_association` can be imported using the tag option ID and resource ID, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_servicecatalog_tag_option_resource_association` using the tag option ID and resource ID. For example:
 
+```terraform
+import {
+  to = aws_servicecatalog_tag_option_resource_association.example
+  id = "tag-pjtvyakdlyo3m:prod-dnigbtea24ste"
+}
 ```
-$ terraform import aws_servicecatalog_tag_option_resource_association.example tag-pjtvyakdlyo3m:prod-dnigbtea24ste
+
+Using `terraform import`, import `aws_servicecatalog_tag_option_resource_association` using the tag option ID and resource ID. For example:
+
+```console
+% terraform import aws_servicecatalog_tag_option_resource_association.example tag-pjtvyakdlyo3m:prod-dnigbtea24ste
 ```
diff --git a/website/docs/r/servicequotas_service_quota.html.markdown b/website/docs/r/servicequotas_service_quota.html.markdown
index fc385d50671..6cc867ae430 100644
--- a/website/docs/r/servicequotas_service_quota.html.markdown
+++ b/website/docs/r/servicequotas_service_quota.html.markdown
@@ -24,15 +24,15 @@ resource "aws_servicequotas_service_quota" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `quota_code` - (Required) Code of the service quota to track. For example: `L-F678F1CE`. Available values can be found with the [AWS CLI service-quotas list-service-quotas command](https://docs.aws.amazon.com/cli/latest/reference/service-quotas/list-service-quotas.html).
 * `service_code` - (Required) Code of the service to track. For example: `vpc`. Available values can be found with the [AWS CLI service-quotas list-services command](https://docs.aws.amazon.com/cli/latest/reference/service-quotas/list-services.html).
 * `value` - (Required) Float specifying the desired value for the service quota. If the desired value is higher than the current value, a quota increase request is submitted. When a known request is submitted and pending, the value reflects the desired value of the pending request.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `adjustable` - Whether the service quota can be increased.
 * `arn` - Amazon Resource Name (ARN) of the service quota.
@@ -52,10 +52,21 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-~> *NOTE* This resource does not require explicit import and will assume management of an existing service quota on Terraform resource creation.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_servicequotas_service_quota` using the service code and quota code, separated by a front slash (`/`). For example:
 
-`aws_servicequotas_service_quota` can be imported by using the service code and quota code, separated by a front slash (`/`), e.g.,
+~> **NOTE:** This resource does not require explicit import and will assume management of an existing service quota on Terraform resource creation.
 
+```terraform
+import {
+  to = aws_servicequotas_service_quota.example
+  id = "vpc/L-F678F1CE"
+}
 ```
-$ terraform import aws_servicequotas_service_quota.example vpc/L-F678F1CE
+
+Using `terraform import`, import `aws_servicequotas_service_quota` using the service code and quota code, separated by a front slash (`/`). For example:
+
+~> **NOTE:** This resource does not require explicit import and will assume management of an existing service quota on Terraform resource creation.
+
+```console
+% terraform import aws_servicequotas_service_quota.example vpc/L-F678F1CE
 ```
diff --git a/website/docs/r/servicequotas_template.html.markdown b/website/docs/r/servicequotas_template.html.markdown
new file mode 100644
index 00000000000..242edc85154
--- /dev/null
+++ b/website/docs/r/servicequotas_template.html.markdown
@@ -0,0 +1,61 @@
+---
+subcategory: "Service Quotas"
+layout: "aws"
+page_title: "AWS: aws_servicequotas_template"
+description: |-
+  Terraform resource for managing an AWS Service Quotas Template.
+---
+# Resource: aws_servicequotas_template
+
+Terraform resource for managing an AWS Service Quotas Template.
+
+-> Only the management account of an organization can alter Service Quota templates, and this must be done from the `us-east-1` region.
+
+## Example Usage
+
+### Basic Usage
+
+```terraform
+resource "aws_servicequotas_template" "example" {
+  region       = "us-east-1"
+  quota_code   = "L-2ACBD22F" # function and layer storage (default: 75 GB)
+  service_code = "lambda"
+  value        = "80"
+}
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `region` - (Required) AWS Region to which the template applies.
+* `quota_code` - (Required) Quota identifier. To find the quota code for a specific quota, use the [aws_servicequotas_service_quota](../d/servicequotas_service_quota.html.markdown) data source.
+* `service_code` - (Required) Service identifier. To find the service code value for an AWS service, use the [aws_servicequotas_service](../d/servicequotas_service.html.markdown) data source.
+* `value` - (Required) The new, increased value for the quota.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `global_quota` - Indicates whether the quota is global.
+* `id` - Unique identifier for the resource, which is a comma-delimited string separating `region`, `quota_code`, and `service_code`.
+* `quota_name` - Quota name.
+* `service_name` - Service name.
+* `unit` - Unit of measurement.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Service Quotas Template using the `example_id_arg`. For example:
+
+```terraform
+import {
+  to = aws_servicequotas_template.example
+  id = "us-east-1,L-2ACBD22F,lambda"
+}
+```
+
+Using `terraform import`, import Service Quotas Template using the `id`. For example:
+
+```console
+% terraform import aws_servicequotas_template.example us-east-1,L-2ACBD22F,lambda
+```
diff --git a/website/docs/r/servicequotas_template_association.html.markdown b/website/docs/r/servicequotas_template_association.html.markdown
new file mode 100644
index 00000000000..1b832a1fbba
--- /dev/null
+++ b/website/docs/r/servicequotas_template_association.html.markdown
@@ -0,0 +1,50 @@
+---
+subcategory: "Service Quotas"
+layout: "aws"
+page_title: "AWS: aws_servicequotas_template_association"
+description: |-
+  Terraform resource for managing an AWS Service Quotas Template Association.
+---
+# Resource: aws_servicequotas_template_association
+
+Terraform resource for managing an AWS Service Quotas Template Association.
+
+-> Only the management account of an organization can associate Service Quota templates, and this must be done from the `us-east-1` region.
+
+## Example Usage
+
+### Basic Usage
+
+```terraform
+resource "aws_servicequotas_template_association" "example" {}
+```
+
+## Argument Reference
+
+The following arguments are optional:
+
+* `skip_destroy` - (Optional) Skip disassociating the quota increase template upon destruction. This will remove the resource from Terraform state, but leave the remote association in place.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - AWS account ID.
+* `status` - Association status. Creating this resource will result in an `ASSOCIATED` status, and quota increase requests in the template are automatically applied to new AWS accounts in the organization.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Service Quotas Template Association using the `example_id_arg`. For example:
+
+```terraform
+import {
+  to = aws_servicequotas_template_association.example
+  id = "012345678901"
+}
+```
+
+Using `terraform import`, import Service Quotas Template Association using the `id`. For example:
+
+```console
+% terraform import aws_servicequotas_template_association.example 012345678901 
+```
diff --git a/website/docs/r/ses_active_receipt_rule_set.html.markdown b/website/docs/r/ses_active_receipt_rule_set.html.markdown
index 5b54b2ed6e2..778b39c8f9b 100644
--- a/website/docs/r/ses_active_receipt_rule_set.html.markdown
+++ b/website/docs/r/ses_active_receipt_rule_set.html.markdown
@@ -20,21 +20,30 @@ resource "aws_ses_active_receipt_rule_set" "main" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `rule_set_name` - (Required) The name of the rule set
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The SES receipt rule set name.
 * `arn` - The SES receipt rule set ARN.
 
 ## Import
 
-Active SES receipt rule sets can be imported using the rule set name.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import active SES receipt rule sets using the rule set name. For example:
 
+```terraform
+import {
+  to = aws_ses_active_receipt_rule_set.my_rule_set
+  id = "my_rule_set_name"
+}
 ```
-$ terraform import aws_ses_active_receipt_rule_set.my_rule_set my_rule_set_name
+
+Using `terraform import`, import active SES receipt rule sets using the rule set name. For example:
+
+```console
+% terraform import aws_ses_active_receipt_rule_set.my_rule_set my_rule_set_name
 ```
diff --git a/website/docs/r/ses_configuration_set.html.markdown b/website/docs/r/ses_configuration_set.html.markdown
index eaa89920a80..4ca5a3cb4cc 100644
--- a/website/docs/r/ses_configuration_set.html.markdown
+++ b/website/docs/r/ses_configuration_set.html.markdown
@@ -51,9 +51,9 @@ The following argument is optional:
 
 * `custom_redirect_domain` - (Optional) Custom subdomain that is used to redirect email recipients to the Amazon SES event tracking domain.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - SES configuration set ARN.
 * `id` - SES configuration set name.
@@ -61,8 +61,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-SES Configuration Sets can be imported using their `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SES Configuration Sets using their `name`. For example:
 
+```terraform
+import {
+  to = aws_ses_configuration_set.test
+  id = "some-configuration-set-test"
+}
 ```
-$ terraform import aws_ses_configuration_set.test some-configuration-set-test
+
+Using `terraform import`, import SES Configuration Sets using their `name`. For example:
+
+```console
+% terraform import aws_ses_configuration_set.test some-configuration-set-test
 ```
diff --git a/website/docs/r/ses_domain_dkim.html.markdown b/website/docs/r/ses_domain_dkim.html.markdown
index 67f54f8ea29..2f48d546200 100644
--- a/website/docs/r/ses_domain_dkim.html.markdown
+++ b/website/docs/r/ses_domain_dkim.html.markdown
@@ -14,13 +14,13 @@ Domain ownership needs to be confirmed first using [ses_domain_identity Resource
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `domain` - (Required) Verified domain name to generate DKIM tokens for.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `dkim_tokens` - DKIM tokens generated by SES.
   These tokens should be used to create CNAME records used to verify SES Easy DKIM.
@@ -52,8 +52,17 @@ resource "aws_route53_record" "example_amazonses_dkim_record" {
 
 ## Import
 
-DKIM tokens can be imported using the `domain` attribute, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DKIM tokens using the `domain` attribute. For example:
 
+```terraform
+import {
+  to = aws_ses_domain_dkim.example
+  id = "example.com"
+}
 ```
-$ terraform import aws_ses_domain_dkim.example example.com
+
+Using `terraform import`, import DKIM tokens using the `domain` attribute. For example:
+
+```console
+% terraform import aws_ses_domain_dkim.example example.com
 ```
diff --git a/website/docs/r/ses_domain_identity.html.markdown b/website/docs/r/ses_domain_identity.html.markdown
index fa9013792d7..12fc2c02f3e 100644
--- a/website/docs/r/ses_domain_identity.html.markdown
+++ b/website/docs/r/ses_domain_identity.html.markdown
@@ -38,13 +38,13 @@ resource "aws_route53_record" "example_amazonses_verification_record" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `domain` - (Required) The domain name to assign to SES
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The ARN of the domain identity.
 * `verification_token` - A code which when added to the domain as a TXT record
@@ -58,8 +58,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-SES domain identities can be imported using the domain name.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SES domain identities using the domain name. For example:
 
+```terraform
+import {
+  to = aws_ses_domain_identity.example
+  id = "example.com"
+}
 ```
-$ terraform import aws_ses_domain_identity.example example.com
+
+Using `terraform import`, import SES domain identities using the domain name. For example:
+
+```console
+% terraform import aws_ses_domain_identity.example example.com
 ```
diff --git a/website/docs/r/ses_domain_identity_verification.html.markdown b/website/docs/r/ses_domain_identity_verification.html.markdown
index 5c61f9d2ef6..0564c4593d2 100644
--- a/website/docs/r/ses_domain_identity_verification.html.markdown
+++ b/website/docs/r/ses_domain_identity_verification.html.markdown
@@ -40,13 +40,13 @@ resource "aws_ses_domain_identity_verification" "example_verification" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `domain` - (Required) The domain name of the SES domain identity to verify.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The domain name of the domain identity.
 * `arn` - The ARN of the domain identity.
diff --git a/website/docs/r/ses_domain_mail_from.html.markdown b/website/docs/r/ses_domain_mail_from.html.markdown
index 0434e56f463..5d9911c3d01 100644
--- a/website/docs/r/ses_domain_mail_from.html.markdown
+++ b/website/docs/r/ses_domain_mail_from.html.markdown
@@ -71,16 +71,25 @@ The following arguments are optional:
 
 * `behavior_on_mx_failure` - (Optional) The action that you want Amazon SES to take if it cannot successfully read the required MX record when you send an email. Defaults to `UseDefaultValue`. See the [SES API documentation](https://docs.aws.amazon.com/ses/latest/APIReference/API_SetIdentityMailFromDomain.html) for more information.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The domain name.
 
 ## Import
 
-MAIL FROM domain can be imported using the `domain` attribute, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import MAIL FROM domain using the `domain` attribute. For example:
 
+```terraform
+import {
+  to = aws_ses_domain_mail_from.example
+  id = "example.com"
+}
 ```
-$ terraform import aws_ses_domain_mail_from.example example.com
+
+Using `terraform import`, import MAIL FROM domain using the `domain` attribute. For example:
+
+```console
+% terraform import aws_ses_domain_mail_from.example example.com
 ```
diff --git a/website/docs/r/ses_email_identity.html.markdown b/website/docs/r/ses_email_identity.html.markdown
index 5229ee2ae7f..520dad5f335 100644
--- a/website/docs/r/ses_email_identity.html.markdown
+++ b/website/docs/r/ses_email_identity.html.markdown
@@ -12,13 +12,13 @@ Provides an SES email identity resource
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `email` - (Required) The email address to assign to SES.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The ARN of the email identity.
 
@@ -32,8 +32,17 @@ resource "aws_ses_email_identity" "example" {
 
 ## Import
 
-SES email identities can be imported using the email address.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SES email identities using the email address. For example:
 
+```terraform
+import {
+  to = aws_ses_email_identity.example
+  id = "email@example.com"
+}
 ```
-$ terraform import aws_ses_email_identity.example email@example.com
+
+Using `terraform import`, import SES email identities using the email address. For example:
+
+```console
+% terraform import aws_ses_email_identity.example email@example.com
 ```
diff --git a/website/docs/r/ses_event_destination.html.markdown b/website/docs/r/ses_event_destination.html.markdown
index a5e4b5c5b32..bc1257972b9 100644
--- a/website/docs/r/ses_event_destination.html.markdown
+++ b/website/docs/r/ses_event_destination.html.markdown
@@ -62,7 +62,7 @@ resource "aws_ses_event_destination" "sns" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The name of the event destination
 * `configuration_set_name` - (Required) The name of the configuration set
@@ -89,18 +89,26 @@ The following arguments are supported:
 
 * `topic_arn` - (Required) The ARN of the SNS topic
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The SES event destination name.
 * `arn` - The SES event destination ARN.
 
 ## Import
 
-SES event destinations can be imported using `configuration_set_name` together with the event destination's `name`,
-e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SES event destinations using `configuration_set_name` together with the event destination's `name`. For example:
 
+```terraform
+import {
+  to = aws_ses_event_destination.sns
+  id = "some-configuration-set-test/event-destination-sns"
+}
 ```
-$ terraform import aws_ses_event_destination.sns some-configuration-set-test/event-destination-sns
+
+Using `terraform import`, import SES event destinations using `configuration_set_name` together with the event destination's `name`. For example:
+
+```console
+% terraform import aws_ses_event_destination.sns some-configuration-set-test/event-destination-sns
 ```
diff --git a/website/docs/r/ses_identity_notification_topic.html.markdown b/website/docs/r/ses_identity_notification_topic.html.markdown
new file mode 100644
index 00000000000..6b8c057d7cd
--- /dev/null
+++ b/website/docs/r/ses_identity_notification_topic.html.markdown
@@ -0,0 +1,52 @@
+---
+subcategory: "SES (Simple Email)"
+layout: "aws"
+page_title: "AWS: aws_ses_identity_notification_topic"
+description: |-
+  Setting AWS SES Identity Notification Topic
+---
+
+# Resource: aws_ses_identity_notification_topic
+
+Resource for managing SES Identity Notification Topics
+
+## Example Usage
+
+```terraform
+resource "aws_ses_identity_notification_topic" "test" {
+  topic_arn                = aws_sns_topic.example.arn
+  notification_type        = "Bounce"
+  identity                 = aws_ses_domain_identity.example.domain
+  include_original_headers = true
+}
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `topic_arn` - (Optional) The Amazon Resource Name (ARN) of the Amazon SNS topic. Can be set to `""` (an empty string) to disable publishing.
+* `notification_type` - (Required) The type of notifications that will be published to the specified Amazon SNS topic. Valid Values: `Bounce`, `Complaint` or `Delivery`.
+* `identity` - (Required) The identity for which the Amazon SNS topic will be set. You can specify an identity by using its name or by using its Amazon Resource Name (ARN).
+* `include_original_headers` - (Optional) Whether SES should include original email headers in SNS notifications of this type. `false` by default.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Identity Notification Topics using the ID of the record. The ID is made up as `IDENTITY|TYPE` where `IDENTITY` is the SES Identity and `TYPE` is the Notification Type. For example:
+
+```terraform
+import {
+  to = aws_ses_identity_notification_topic.test
+  id = "example.com|Bounce"
+}
+```
+
+Using `terraform import`, import Identity Notification Topics using the ID of the record. The ID is made up as `IDENTITY|TYPE` where `IDENTITY` is the SES Identity and `TYPE` is the Notification Type. For example:
+
+```console
+% terraform import aws_ses_identity_notification_topic.test 'example.com|Bounce'
+```
diff --git a/website/docs/r/ses_identity_notification_topic.markdown b/website/docs/r/ses_identity_notification_topic.markdown
deleted file mode 100644
index dc83e67e955..00000000000
--- a/website/docs/r/ses_identity_notification_topic.markdown
+++ /dev/null
@@ -1,43 +0,0 @@
----
-subcategory: "SES (Simple Email)"
-layout: "aws"
-page_title: "AWS: aws_ses_identity_notification_topic"
-description: |-
-  Setting AWS SES Identity Notification Topic
----
-
-# Resource: aws_ses_identity_notification_topic
-
-Resource for managing SES Identity Notification Topics
-
-## Example Usage
-
-```terraform
-resource "aws_ses_identity_notification_topic" "test" {
-  topic_arn                = aws_sns_topic.example.arn
-  notification_type        = "Bounce"
-  identity                 = aws_ses_domain_identity.example.domain
-  include_original_headers = true
-}
-```
-
-## Argument Reference
-
-The following arguments are supported:
-
-* `topic_arn` - (Optional) The Amazon Resource Name (ARN) of the Amazon SNS topic. Can be set to `""` (an empty string) to disable publishing.
-* `notification_type` - (Required) The type of notifications that will be published to the specified Amazon SNS topic. Valid Values: `Bounce`, `Complaint` or `Delivery`.
-* `identity` - (Required) The identity for which the Amazon SNS topic will be set. You can specify an identity by using its name or by using its Amazon Resource Name (ARN).
-* `include_original_headers` - (Optional) Whether SES should include original email headers in SNS notifications of this type. `false` by default.
-
-## Attributes Reference
-
-No additional attributes are exported.
-
-## Import
-
-Identity Notification Topics can be imported using the ID of the record. The ID is made up as `IDENTITY|TYPE` where `IDENTITY` is the SES Identity and `TYPE` is the Notification Type.
-
-```
-$ terraform import aws_ses_identity_notification_topic.test 'example.com|Bounce'
-```
diff --git a/website/docs/r/ses_identity_policy.html.markdown b/website/docs/r/ses_identity_policy.html.markdown
index 79d241d8979..6c5af6ddd33 100644
--- a/website/docs/r/ses_identity_policy.html.markdown
+++ b/website/docs/r/ses_identity_policy.html.markdown
@@ -38,20 +38,29 @@ resource "aws_ses_identity_policy" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `identity` - (Required) Name or Amazon Resource Name (ARN) of the SES Identity.
 * `name` - (Required) Name of the policy.
 * `policy` - (Required) JSON string of the policy. For more information about building AWS IAM policy documents with Terraform, see the [AWS IAM Policy Document Guide](https://learn.hashicorp.com/terraform/aws/iam-policy).
 
-## Attributes Reference
+## Attribute Reference
 
-No additional attributes are exported.
+This resource exports no additional attributes.
 
 ## Import
 
-SES Identity Policies can be imported using the identity and policy name, separated by a pipe character (`|`), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SES Identity Policies using the identity and policy name, separated by a pipe character (`|`). For example:
 
+```terraform
+import {
+  to = aws_ses_identity_policy.example
+  id = "example.com|example"
+}
 ```
-$ terraform import aws_ses_identity_policy.example 'example.com|example'
+
+Using `terraform import`, import SES Identity Policies using the identity and policy name, separated by a pipe character (`|`). For example:
+
+```console
+% terraform import aws_ses_identity_policy.example 'example.com|example'
 ```
diff --git a/website/docs/r/ses_receipt_filter.html.markdown b/website/docs/r/ses_receipt_filter.html.markdown
index 7f96c35c787..396fa2beff3 100644
--- a/website/docs/r/ses_receipt_filter.html.markdown
+++ b/website/docs/r/ses_receipt_filter.html.markdown
@@ -22,23 +22,32 @@ resource "aws_ses_receipt_filter" "filter" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The name of the filter
 * `cidr` - (Required) The IP address or address range to filter, in CIDR notation
 * `policy` - (Required) Block or Allow
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The SES receipt filter name.
 * `arn` - The SES receipt filter ARN.
 
 ## Import
 
-SES Receipt Filter can be imported using their `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SES Receipt Filter using their `name`. For example:
 
+```terraform
+import {
+  to = aws_ses_receipt_filter.test
+  id = "some-filter"
+}
 ```
-$ terraform import aws_ses_receipt_filter.test some-filter
+
+Using `terraform import`, import SES Receipt Filter using their `name`. For example:
+
+```console
+% terraform import aws_ses_receipt_filter.test some-filter
 ```
diff --git a/website/docs/r/ses_receipt_rule.html.markdown b/website/docs/r/ses_receipt_rule.html.markdown
index bf4ce373d66..7e09747bede 100644
--- a/website/docs/r/ses_receipt_rule.html.markdown
+++ b/website/docs/r/ses_receipt_rule.html.markdown
@@ -36,7 +36,7 @@ resource "aws_ses_receipt_rule" "store" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The name of the rule
 * `rule_set_name` - (Required) The name of the rule set
@@ -101,17 +101,26 @@ WorkMail actions support the following:
 * `topic_arn` - (Optional) The ARN of an SNS topic to notify
 * `position` - (Required) The position of the action in the receipt rule
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The SES receipt rule name.
 * `arn` - The SES receipt rule ARN.
 
 ## Import
 
-SES receipt rules can be imported using the ruleset name and rule name separated by `:`.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SES receipt rules using the ruleset name and rule name separated by `:`. For example:
 
+```terraform
+import {
+  to = aws_ses_receipt_rule.my_rule
+  id = "my_rule_set:my_rule"
+}
 ```
-$ terraform import aws_ses_receipt_rule.my_rule my_rule_set:my_rule
+
+Using `terraform import`, import SES receipt rules using the ruleset name and rule name separated by `:`. For example:
+
+```console
+% terraform import aws_ses_receipt_rule.my_rule my_rule_set:my_rule
 ```
diff --git a/website/docs/r/ses_receipt_rule_set.html.markdown b/website/docs/r/ses_receipt_rule_set.html.markdown
index dcccc8ccee2..5aea2fea497 100644
--- a/website/docs/r/ses_receipt_rule_set.html.markdown
+++ b/website/docs/r/ses_receipt_rule_set.html.markdown
@@ -20,21 +20,30 @@ resource "aws_ses_receipt_rule_set" "main" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `rule_set_name` - (Required) Name of the rule set.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - SES receipt rule set ARN.
 * `id` - SES receipt rule set name.
 
 ## Import
 
-SES receipt rule sets can be imported using the rule set name.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SES receipt rule sets using the rule set name. For example:
 
+```terraform
+import {
+  to = aws_ses_receipt_rule_set.my_rule_set
+  id = "my_rule_set_name"
+}
 ```
-$ terraform import aws_ses_receipt_rule_set.my_rule_set my_rule_set_name
+
+Using `terraform import`, import SES receipt rule sets using the rule set name. For example:
+
+```console
+% terraform import aws_ses_receipt_rule_set.my_rule_set my_rule_set_name
 ```
diff --git a/website/docs/r/ses_template.html.markdown b/website/docs/r/ses_template.html.markdown
index befa2928aff..7dcbc773266 100644
--- a/website/docs/r/ses_template.html.markdown
+++ b/website/docs/r/ses_template.html.markdown
@@ -23,24 +23,33 @@ resource "aws_ses_template" "MyTemplate" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The name of the template. Cannot exceed 64 characters. You will refer to this name when you send email.
 * `html` - (Optional) The HTML body of the email. Must be less than 500KB in size, including both the text and HTML parts.
 * `subject` - (Optional) The subject line of the email.
 * `text` - (Optional) The email body that will be visible to recipients whose email clients do not display HTML. Must be less than 500KB in size, including both the text and HTML parts.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The ARN of the SES template
 * `id` - The name of the SES template
 
 ## Import
 
-SES templates can be imported using the template name, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SES templates using the template name. For example:
 
+```terraform
+import {
+  to = aws_ses_template.MyTemplate
+  id = "MyTemplate"
+}
 ```
-$ terraform import aws_ses_template.MyTemplate MyTemplate
+
+Using `terraform import`, import SES templates using the template name. For example:
+
+```console
+% terraform import aws_ses_template.MyTemplate MyTemplate
 ```
diff --git a/website/docs/r/sesv2_account_vdm_attributes.html.markdown b/website/docs/r/sesv2_account_vdm_attributes.html.markdown
new file mode 100644
index 00000000000..0c56181596e
--- /dev/null
+++ b/website/docs/r/sesv2_account_vdm_attributes.html.markdown
@@ -0,0 +1,69 @@
+---
+subcategory: "SESv2 (Simple Email V2)"
+layout: "aws"
+page_title: "AWS: aws_sesv2_account_vdm_attributes"
+description: |-
+  Terraform resource for managing an AWS SESv2 (Simple Email V2) Account VDM Attributes.
+---
+
+# Resource: aws_sesv2_account_vdm_attributes
+
+Terraform resource for managing an AWS SESv2 (Simple Email V2) Account VDM Attributes.
+
+## Example Usage
+
+### Basic Usage
+
+```terraform
+resource "aws_sesv2_account_vdm_attributes" "example" {
+  vdm_enabled = "ENABLED"
+
+  dashboard_attributes {
+    engagement_metrics = "ENABLED"
+  }
+
+  guardian_attributes {
+    optimized_shared_delivery = "ENABLED"
+  }
+}
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `vdm_enabled` - (Required) Specifies the status of your VDM configuration. Valid values: `ENABLED`, `DISABLED`.
+
+The following arguments are optional:
+
+* `dashboard_attributes` - (Optional) Specifies additional settings for your VDM configuration as applicable to the Dashboard.
+* `guardian_attributes` - (Optional) Specifies additional settings for your VDM configuration as applicable to the Guardian.
+
+### dashboard_attributes
+
+* `engagement_metrics` - (Optional) Specifies the status of your VDM engagement metrics collection. Valid values: `ENABLED`, `DISABLED`.
+
+### guardian_attributes
+
+* `optimized_shared_delivery` - (Optional) Specifies the status of your VDM optimized shared delivery. Valid values: `ENABLED`, `DISABLED`.
+
+## Attribute Reference
+
+This data source exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SESv2 (Simple Email V2) Account VDM Attributes using the word `ses-account-vdm-attributes`. For example:
+
+```terraform
+import {
+  to = aws_sesv2_account_vdm_attributes.example
+  id = "ses-account-vdm-attributes"
+}
+```
+
+Using `terraform import`, import SESv2 (Simple Email V2) Account VDM Attributes using the word `ses-account-vdm-attributes`. For example:
+
+```console
+% terraform import aws_sesv2_account_vdm_attributes.example ses-account-vdm-attributes
+```
diff --git a/website/docs/r/sesv2_configuration_set.html.markdown b/website/docs/r/sesv2_configuration_set.html.markdown
index fc8d444c87e..b796a3631ef 100644
--- a/website/docs/r/sesv2_configuration_set.html.markdown
+++ b/website/docs/r/sesv2_configuration_set.html.markdown
@@ -42,7 +42,7 @@ resource "aws_sesv2_configuration_set" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `configuration_set_name` - (Required) The name of the configuration set.
 * `delivery_options` - (Optional) An object that defines the dedicated IP pool that is used to send emails that you send using the configuration set.
@@ -55,20 +55,20 @@ The following arguments are supported:
 
 ### delivery_options
 
-The following arguments are supported:
+This argument supports the following arguments:
 
 * `sending_pool_name` - (Optional) The name of the dedicated IP pool to associate with the configuration set.
 * `tls_policy` - (Optional) Specifies whether messages that use the configuration set are required to use Transport Layer Security (TLS). Valid values: `REQUIRE`, `OPTIONAL`.
 
 ### reputation_options
 
-The following arguments are supported;
+This argument supports the following arguments:
 
 * `reputation_metrics_enabled` - (Optional) If `true`, tracking of reputation metrics is enabled for the configuration set. If `false`, tracking of reputation metrics is disabled for the configuration set.
 
 ### sending_options
 
-The following arguments are supported:
+This argument supports the following arguments:
 
 * `sending_enabled` - (Optional) If `true`, email sending is enabled for the configuration set. If `false`, email sending is disabled for the configuration set.
 
@@ -93,9 +93,9 @@ The following arguments are supported:
 
 * `optimized_shared_delivery` - (Optional) Specifies the status of your VDM optimized shared delivery. Valid values: `ENABLED`, `DISABLED`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the Configuration Set.
 * `reputation_options` - An object that defines whether or not Amazon SES collects reputation metrics for the emails that you send that use the configuration set.
@@ -103,8 +103,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-SESv2 (Simple Email V2) Configuration Set can be imported using the `configuration_set_name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SESv2 (Simple Email V2) Configuration Set using the `configuration_set_name`. For example:
 
+```terraform
+import {
+  to = aws_sesv2_configuration_set.example
+  id = "example"
+}
 ```
-$ terraform import aws_sesv2_configuration_set.example example
+
+Using `terraform import`, import SESv2 (Simple Email V2) Configuration Set using the `configuration_set_name`. For example:
+
+```console
+% terraform import aws_sesv2_configuration_set.example example
 ```
diff --git a/website/docs/r/sesv2_configuration_set_event_destination.html.markdown b/website/docs/r/sesv2_configuration_set_event_destination.html.markdown
index ad537f1ea7a..aa153e44684 100644
--- a/website/docs/r/sesv2_configuration_set_event_destination.html.markdown
+++ b/website/docs/r/sesv2_configuration_set_event_destination.html.markdown
@@ -138,7 +138,7 @@ The following arguments are required:
 The following arguments are required:
 
 * `default_dimension_value` - (Required) The default value of the dimension that is published to Amazon CloudWatch if you don't provide the value of the dimension when you send an email.
-( `dimension_name` - (Required) The name of an Amazon CloudWatch dimension associated with an email sending metric.
+* `dimension_name` - (Required) The name of an Amazon CloudWatch dimension associated with an email sending metric.
 * `dimension_value_source` - (Required) The location where the Amazon SES API v2 finds the value of a dimension to publish to Amazon CloudWatch. Valid values: `MESSAGE_TAG`, `EMAIL_HEADER`, `LINK_TAG`.
 
 ### kinesis_firehose_destination
@@ -160,16 +160,25 @@ The following arguments are required:
 
 * `topic_arn` - (Required) The Amazon Resource Name (ARN) of the Amazon SNS topic to publish email events to.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - A pipe-delimited string combining `configuration_set_name` and `event_destination_name`.
 
 ## Import
 
-SESv2 (Simple Email V2) Configuration Set Event Destination can be imported using the `id` (`configuration_set_name|event_destination_name`), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SESv2 (Simple Email V2) Configuration Set Event Destination using the `id` (`configuration_set_name|event_destination_name`). For example:
 
+```terraform
+import {
+  to = aws_sesv2_configuration_set_event_destination.example
+  id = "example_configuration_set|example_event_destination"
+}
 ```
-$ terraform import aws_sesv2_configuration_set_event_destination.example example_configuration_set|example_event_destination
+
+Using `terraform import`, import SESv2 (Simple Email V2) Configuration Set Event Destination using the `id` (`configuration_set_name|event_destination_name`). For example:
+
+```console
+% terraform import aws_sesv2_configuration_set_event_destination.example example_configuration_set|example_event_destination
 ```
diff --git a/website/docs/r/sesv2_contact_list.html.markdown b/website/docs/r/sesv2_contact_list.html.markdown
index 076d859fa4d..9a210b28a5a 100644
--- a/website/docs/r/sesv2_contact_list.html.markdown
+++ b/website/docs/r/sesv2_contact_list.html.markdown
@@ -60,17 +60,26 @@ The following arguments are optional:
 
 * `description` - (Optional) A description of what the topic is about, which the contact will see.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `created_timestamp` - A timestamp noting when the contact list was created in ISO 8601 format.
 * `last_updated_timestamp` - A timestamp noting the last time the contact list was updated in ISO 8601 format.
 
 ## Import
 
-SESv2 (Simple Email V2) Contact List can be imported using the `example_id_arg`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SESv2 (Simple Email V2) Contact List using the `example_id_arg`. For example:
 
+```terraform
+import {
+  to = aws_sesv2_contact_list.example
+  id = "example"
+}
 ```
-$ terraform import aws_sesv2_contact_list.example example
+
+Using `terraform import`, import SESv2 (Simple Email V2) Contact List using the `example_id_arg`. For example:
+
+```console
+% terraform import aws_sesv2_contact_list.example example
 ```
diff --git a/website/docs/r/sesv2_dedicated_ip_assignment.html.markdown b/website/docs/r/sesv2_dedicated_ip_assignment.html.markdown
index 6bcfe81cba5..acbf1c56b11 100644
--- a/website/docs/r/sesv2_dedicated_ip_assignment.html.markdown
+++ b/website/docs/r/sesv2_dedicated_ip_assignment.html.markdown
@@ -30,9 +30,9 @@ The following arguments are required:
 * `ip` - (Required) Dedicated IP address.
 * `destination_pool_name` - (Required) Dedicated IP address.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - A comma-separated string made up of `ip` and `destination_pool_name`.
 
@@ -45,8 +45,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-SESv2 (Simple Email V2) Dedicated IP Assignment can be imported using the `id`, which is a comma-separated string made up of `ip` and `destination_pool_name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SESv2 (Simple Email V2) Dedicated IP Assignment using the `id`, which is a comma-separated string made up of `ip` and `destination_pool_name`. For example:
 
+```terraform
+import {
+  to = aws_sesv2_dedicated_ip_assignment.example
+  id = "0.0.0.0,my-pool"
+}
 ```
-$ terraform import aws_sesv2_dedicated_ip_assignment.example "0.0.0.0,my-pool"
+
+Using `terraform import`, import SESv2 (Simple Email V2) Dedicated IP Assignment using the `id`, which is a comma-separated string made up of `ip` and `destination_pool_name`. For example:
+
+```console
+% terraform import aws_sesv2_dedicated_ip_assignment.example "0.0.0.0,my-pool"
 ```
diff --git a/website/docs/r/sesv2_dedicated_ip_pool.html.markdown b/website/docs/r/sesv2_dedicated_ip_pool.html.markdown
index 6533b079abd..74a5c7ab5d5 100644
--- a/website/docs/r/sesv2_dedicated_ip_pool.html.markdown
+++ b/website/docs/r/sesv2_dedicated_ip_pool.html.markdown
@@ -40,9 +40,9 @@ The following arguments are optional:
 * `scaling_mode` - (Optional) IP pool scaling mode. Valid values: `STANDARD`, `MANAGED`. If omitted, the AWS API will default to a standard pool.
 * `tags` - (Optional) A map of tags to assign to the pool. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the Dedicated IP Pool.
 
@@ -56,8 +56,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-SESv2 (Simple Email V2) Dedicated IP Pool can be imported using the `pool_name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SESv2 (Simple Email V2) Dedicated IP Pool using the `pool_name`. For example:
 
+```terraform
+import {
+  to = aws_sesv2_dedicated_ip_pool.example
+  id = "my-pool"
+}
 ```
-$ terraform import aws_sesv2_dedicated_ip_pool.example my-pool
+
+Using `terraform import`, import SESv2 (Simple Email V2) Dedicated IP Pool using the `pool_name`. For example:
+
+```console
+% terraform import aws_sesv2_dedicated_ip_pool.example my-pool
 ```
diff --git a/website/docs/r/sesv2_email_identity.html.markdown b/website/docs/r/sesv2_email_identity.html.markdown
index 01040212391..908e35ec9fd 100644
--- a/website/docs/r/sesv2_email_identity.html.markdown
+++ b/website/docs/r/sesv2_email_identity.html.markdown
@@ -58,28 +58,31 @@ resource "aws_sesv2_email_identity" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+The following arguments are required:
 
 * `email_identity` - (Required) The email address or domain to verify.
+
+The following arguments are optional:
+
 * `configuration_set_name` - (Optional) The configuration set to use by default when sending from this identity. Note that any configuration set defined in the email sending request takes precedence.
 * `dkim_signing_attributes` - (Optional) The configuration of the DKIM authentication settings for an email domain identity.
-* `tags` - (Optional) A map of tags to assign to the service. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
 ### dkim_signing_attributes
 
-* `domain_signing_private_key` - (Optional) [Bring Your Own DKIM] A private key that's used to generate a DKIM signature. The private key must use 1024 or 2048-bit RSA encryption, and must be encoded using base64 encoding.
+* `domain_signing_private_key` - (Optional, Sensitive) [Bring Your Own DKIM] A private key that's used to generate a DKIM signature. The private key must use 1024 or 2048-bit RSA encryption, and must be encoded using base64 encoding.
 
 -> **NOTE:** You have to delete the first and last lines ('-----BEGIN PRIVATE KEY-----' and '-----END PRIVATE KEY-----', respectively) of the generated private key. Additionally, you have to remove the line breaks in the generated private key. The resulting value is a string of characters with no spaces or line breaks.
 
 * `domain_signing_selector` - (Optional) [Bring Your Own DKIM] A string that's used to identify a public key in the DNS configuration for a domain.
 * `next_signing_key_length` - (Optional) [Easy DKIM] The key length of the future DKIM key pair to be generated. This can be changed at most once per day. Valid values: `RSA_1024_BIT`, `RSA_2048_BIT`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the Email Identity.
-* `dkim_signing_attributes` - An object that contains information about the private key and selector that you want to use to configure DKIM for the identity for Bring Your Own DKIM (BYODKIM) for the identity, or, configures the key length to be used for Easy DKIM.
+* `dkim_signing_attributes` - A list of objects that contains at most one element with information about the private key and selector that you want to use to configure DKIM for the identity for Bring Your Own DKIM (BYODKIM) for the identity, or, configures the key length to be used for Easy DKIM.
     * `current_signing_key_length` - [Easy DKIM] The key length of the DKIM key pair in use.
     * `last_key_generation_timestamp` - [Easy DKIM] The last time a key pair was generated for this identity.
     * `next_signing_key_length` - [Easy DKIM] The key length of the future DKIM key pair to be generated. This can be changed at most once per day.
@@ -87,12 +90,22 @@ In addition to all arguments above, the following attributes are exported:
     * `status` - Describes whether or not Amazon SES has successfully located the DKIM records in the DNS records for the domain. See the [AWS SES API v2 Reference](https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_DkimAttributes.html#SES-Type-DkimAttributes-Status) for supported statuses.
     * `tokens` - If you used Easy DKIM to configure DKIM authentication for the domain, then this object contains a set of unique strings that you use to create a set of CNAME records that you add to the DNS configuration for your domain. When Amazon SES detects these records in the DNS configuration for your domain, the DKIM authentication process is complete. If you configured DKIM authentication for the domain by providing your own public-private key pair, then this object contains the selector for the public key.
 * `identity_type` - The email identity type. Valid values: `EMAIL_ADDRESS`, `DOMAIN`.
+* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block).
 * `verified_for_sending_status` - Specifies whether or not the identity is verified.
 
 ## Import
 
-SESv2 (Simple Email V2) Email Identity can be imported using the `email_identity`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SESv2 (Simple Email V2) Email Identity using the `email_identity`. For example:
 
+```terraform
+import {
+  to = aws_sesv2_email_identity.example
+  id = "example.com"
+}
 ```
-$ terraform import aws_sesv2_email_identity.example example.com
+
+Using `terraform import`, import SESv2 (Simple Email V2) Email Identity using the `email_identity`. For example:
+
+```console
+% terraform import aws_sesv2_email_identity.example example.com
 ```
diff --git a/website/docs/r/sesv2_email_identity_feedback_attributes.html.markdown b/website/docs/r/sesv2_email_identity_feedback_attributes.html.markdown
index 07ba966f4f4..8ce4f1d340a 100644
--- a/website/docs/r/sesv2_email_identity_feedback_attributes.html.markdown
+++ b/website/docs/r/sesv2_email_identity_feedback_attributes.html.markdown
@@ -27,19 +27,28 @@ resource "aws_sesv2_email_identity_feedback_attributes" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `email_identity` - (Required) The email identity.
 * `email_forwarding_enabled` - (Optional) Sets the feedback forwarding configuration for the identity.
 
-## Attributes Reference
+## Attribute Reference
 
-No additional attributes are exported.
+This resource exports no additional attributes.
 
 ## Import
 
-SESv2 (Simple Email V2) Email Identity Feedback Attributes can be imported using the `email_identity`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SESv2 (Simple Email V2) Email Identity Feedback Attributes using the `email_identity`. For example:
 
+```terraform
+import {
+  to = aws_sesv2_email_identity_feedback_attributes.example
+  id = "example.com"
+}
 ```
-$ terraform import aws_sesv2_email_identity_feedback_attributes.example example.com
+
+Using `terraform import`, import SESv2 (Simple Email V2) Email Identity Feedback Attributes using the `email_identity`. For example:
+
+```console
+% terraform import aws_sesv2_email_identity_feedback_attributes.example example.com
 ```
diff --git a/website/docs/r/sesv2_email_identity_mail_from_attributes.html.markdown b/website/docs/r/sesv2_email_identity_mail_from_attributes.html.markdown
index e7b08c63d76..fb4273ccdc6 100644
--- a/website/docs/r/sesv2_email_identity_mail_from_attributes.html.markdown
+++ b/website/docs/r/sesv2_email_identity_mail_from_attributes.html.markdown
@@ -29,20 +29,29 @@ resource "aws_sesv2_email_identity_mail_from_attributes" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `email_identity` - (Required) The verified email identity.
 * `behavior_on_mx_failure` - (Optional) The action to take if the required MX record isn't found when you send an email. Valid values: `USE_DEFAULT_VALUE`, `REJECT_MESSAGE`.
 * `mail_from_domain` - (Optional) The custom MAIL FROM domain that you want the verified identity to use. Required if `behavior_on_mx_failure` is `REJECT_MESSAGE`.
 
-## Attributes Reference
+## Attribute Reference
 
-No additional attributes are exported.
+This resource exports no additional attributes.
 
 ## Import
 
-SESv2 (Simple Email V2) Email Identity Mail From Attributes can be imported using the `email_identity`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SESv2 (Simple Email V2) Email Identity Mail From Attributes using the `email_identity`. For example:
 
+```terraform
+import {
+  to = aws_sesv2_email_identity_mail_from_attributes.example
+  id = "example.com"
+}
 ```
-$ terraform import aws_sesv2_email_identity_mail_from_attributes.example example.com
+
+Using `terraform import`, import SESv2 (Simple Email V2) Email Identity Mail From Attributes using the `email_identity`. For example:
+
+```console
+% terraform import aws_sesv2_email_identity_mail_from_attributes.example example.com
 ```
diff --git a/website/docs/r/sfn_activity.html.markdown b/website/docs/r/sfn_activity.html.markdown
index f0bc3b034f1..81c6c62770b 100644
--- a/website/docs/r/sfn_activity.html.markdown
+++ b/website/docs/r/sfn_activity.html.markdown
@@ -20,14 +20,14 @@ resource "aws_sfn_activity" "sfn_activity" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The name of the activity to create.
 * `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The Amazon Resource Name (ARN) that identifies the created activity.
 * `name` - The name of the activity.
@@ -36,8 +36,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Activities can be imported using the `arn`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import activities using the `arn`. For example:
 
+```terraform
+import {
+  to = aws_sfn_activity.foo
+  id = "arn:aws:states:eu-west-1:123456789098:activity:bar"
+}
 ```
-$ terraform import aws_sfn_activity.foo arn:aws:states:eu-west-1:123456789098:activity:bar
+
+Using `terraform import`, import activities using the `arn`. For example:
+
+```console
+% terraform import aws_sfn_activity.foo arn:aws:states:eu-west-1:123456789098:activity:bar
 ```
diff --git a/website/docs/r/sfn_alias.html.markdown b/website/docs/r/sfn_alias.html.markdown
new file mode 100644
index 00000000000..14815048d8e
--- /dev/null
+++ b/website/docs/r/sfn_alias.html.markdown
@@ -0,0 +1,77 @@
+---
+subcategory: "SFN (Step Functions)"
+layout: "aws"
+page_title: "AWS: aws_sfn_alias"
+description: |-
+  Provides a Step Function State Machine Alias.
+---
+
+# Resource: aws_sfn_alias
+
+Provides a Step Function State Machine Alias.
+
+## Example Usage
+
+### Basic Usage
+
+```terraform
+resource "aws_sfn_alias" "sfn_alias" {
+  name = "my_sfn_alias"
+
+  routing_configuration {
+    state_machine_version_arn = aws_sfn_state_machine.sfn_test.state_machine_version_arn
+    weight                    = 100
+  }
+}
+
+resource "aws_sfn_alias" "my_sfn_alias" {
+  name = "my_sfn_alias"
+
+  routing_configuration {
+    state_machine_version_arn = "arn:aws:states:us-east-1:12345:stateMachine:demo:3"
+    weight                    = 50
+  }
+
+  routing_configuration {
+    state_machine_version_arn = "arn:aws:states:us-east-1:12345:stateMachine:demo:2"
+    weight                    = 50
+  }
+}
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `name` - (Required) Name for the alias you are creating.
+* `description` - (Optional) Description of the alias.
+* `routing_configuration` - (Required) The StateMachine alias' route configuration settings. Fields documented below
+
+`routing_configuration` supports the following arguments:
+
+* `state_machine_version_arn` - (Required) The Amazon Resource Name (ARN) of the state machine version.
+* `weight` - (Required) Percentage of traffic routed to the state machine version.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The Amazon Resource Name (ARN) identifying your state machine alias.
+* `creation_date` - The date the state machine alias was created.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SFN (Step Functions) Alias using the `arn`. For example:
+
+```terraform
+import {
+  to = aws_sfn_alias.foo
+  id = "arn:aws:states:us-east-1:123456789098:stateMachine:myStateMachine:foo"
+}
+```
+
+Using `terraform import`, import SFN (Step Functions) Alias using the `arn`. For example:
+
+```console
+% terraform import aws_sfn_alias.foo arn:aws:states:us-east-1:123456789098:stateMachine:myStateMachine:foo
+```
diff --git a/website/docs/r/sfn_state_machine.html.markdown b/website/docs/r/sfn_state_machine.html.markdown
index ca4d0c0722e..a7052d96a74 100644
--- a/website/docs/r/sfn_state_machine.html.markdown
+++ b/website/docs/r/sfn_state_machine.html.markdown
@@ -63,6 +63,33 @@ EOF
 }
 ```
 
+### Publish (Publish SFN version)
+
+```terraform
+# ...
+
+resource "aws_sfn_state_machine" "sfn_state_machine" {
+  name     = "my-state-machine"
+  role_arn = aws_iam_role.iam_for_sfn.arn
+  publish  = true
+  type     = "EXPRESS"
+
+  definition = <<EOF
+{
+  "Comment": "A Hello World example of the Amazon States Language using an AWS Lambda Function",
+  "StartAt": "HelloWorld",
+  "States": {
+    "HelloWorld": {
+      "Type": "Task",
+      "Resource": "${aws_lambda_function.lambda.arn}",
+      "End": true
+    }
+  }
+}
+EOF
+}
+```
+
 ### Logging
 
 ~> *NOTE:* See the [AWS Step Functions Developer Guide](https://docs.aws.amazon.com/step-functions/latest/dg/welcome.html) for more information about enabling Step Function logging.
@@ -98,12 +125,13 @@ EOF
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `definition` - (Required) The [Amazon States Language](https://docs.aws.amazon.com/step-functions/latest/dg/concepts-amazon-states-language.html) definition of the state machine.
 * `logging_configuration` - (Optional) Defines what execution history events are logged and where they are logged. The `logging_configuration` parameter is only valid when `type` is set to `EXPRESS`. Defaults to `OFF`. For more information see [Logging Express Workflows](https://docs.aws.amazon.com/step-functions/latest/dg/cw-logs.html) and [Log Levels](https://docs.aws.amazon.com/step-functions/latest/dg/cloudwatch-log-level.html) in the AWS Step Functions User Guide.
 * `name` - (Optional) The name of the state machine. The name should only contain `0`-`9`, `A`-`Z`, `a`-`z`, `-` and `_`. If omitted, Terraform will assign a random, unique name.
 * `name_prefix` - (Optional) Creates a unique name beginning with the specified prefix. Conflicts with `name`.
+* `publish` - (Optional) Set to true to publish a version of the state machine during creation. Default: false.
 * `role_arn` - (Required) The Amazon Resource Name (ARN) of the IAM role to use for this state machine.
 * `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 * `tracing_configuration` - (Optional) Selects whether AWS X-Ray tracing is enabled.
@@ -119,9 +147,9 @@ The following arguments are supported:
 
 * `enabled` - (Optional) When set to `true`, AWS X-Ray tracing is enabled. Make sure the State Machine has the correct IAM policies for logging. See the [AWS Step Functions Developer Guide](https://docs.aws.amazon.com/step-functions/latest/dg/xray-iam.html) for details.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ARN of the state machine.
 * `arn` - The ARN of the state machine.
@@ -139,8 +167,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-State Machines can be imported using the `arn`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import State Machines using the `arn`. For example:
 
+```terraform
+import {
+  to = aws_sfn_state_machine.foo
+  id = "arn:aws:states:eu-west-1:123456789098:stateMachine:bar"
+}
 ```
-$ terraform import aws_sfn_state_machine.foo arn:aws:states:eu-west-1:123456789098:stateMachine:bar
+
+Using `terraform import`, import State Machines using the `arn`. For example:
+
+```console
+% terraform import aws_sfn_state_machine.foo arn:aws:states:eu-west-1:123456789098:stateMachine:bar
 ```
diff --git a/website/docs/r/shield_application_layer_automatic_response.html.markdown b/website/docs/r/shield_application_layer_automatic_response.html.markdown
new file mode 100644
index 00000000000..ace314a84c2
--- /dev/null
+++ b/website/docs/r/shield_application_layer_automatic_response.html.markdown
@@ -0,0 +1,42 @@
+---
+subcategory: "Shield"
+layout: "aws"
+page_title: "AWS: aws_shield_application_layer_automatic_response"
+description: |-
+  Terraform resource for managing an AWS Shield Application Layer Automatic Response.
+---
+
+# Resource: aws_shield_application_layer_automatic_response
+
+Terraform resource for managing an AWS Shield Application Layer Automatic Response for automatic DDoS mitigation.
+
+## Example Usage
+
+### Basic Usage
+
+```terraform
+data "aws_region" "current" {}
+data "aws_caller_identity" "current" {}
+data "aws_partition" "current" {}
+
+var "distribution_id" {
+  type        = "string"
+  description = "The Cloudfront Distribution on which to enable the Application Layer Automatic Response."
+}
+
+resource "aws_shield_application_layer_automatic_response" "example" {
+  resource_arn = "arn:${data.aws_partition.current.partition}:cloudfront:${data.aws_caller_identity.current.account_id}:distribution/${var.distribution_id}"
+  action       = "COUNT"
+}
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `resource_arn` - (Required) ARN of the resource to protect (Cloudfront Distributions and ALBs only at this time).
+* `action` - (Required) One of `COUNT` or `BLOCK`
+
+## Attribute Reference
+
+This resource exports no additional attributes.
diff --git a/website/docs/r/shield_drt_access_log_bucket_association.html.markdown b/website/docs/r/shield_drt_access_log_bucket_association.html.markdown
new file mode 100644
index 00000000000..bc391f86ba3
--- /dev/null
+++ b/website/docs/r/shield_drt_access_log_bucket_association.html.markdown
@@ -0,0 +1,36 @@
+---
+subcategory: "Shield"
+layout: "aws"
+page_title: "AWS: aws_shield_drt_access_log_bucket_association"
+description: |-
+  Terraform resource for managing an AWS Shield DRT Access Log Bucket Association.
+---
+# Resource: aws_shield_drt_access_log_bucket_association
+
+Terraform resource for managing an AWS Shield DRT Access Log Bucket Association. Up to 10 log buckets can be associated for DRT Access sharing with the Shield Response Team (SRT).
+
+## Example Usage
+
+### Basic Usage
+
+```terraform
+resource "aws_shield_drt_access_role_arn_association" "test" {
+  role_arn = "arn:aws:iam:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:${var.shield_drt_access_role_name}"
+}
+
+resource "aws_shield_drt_access_log_bucket_association" "test" {
+  log_bucket              = var.shield_drt_access_log_bucket
+  role_arn_association_id = aws_shield_drt_access_role_arn_association.test.id
+}
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `log_bucket` - (Required) The Amazon S3 bucket that contains the logs that you want to share.
+* `role_arn_association_id` - (Required) The ID of the Role Arn association used for allowing Shield DRT Access.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
diff --git a/website/docs/r/shield_drt_access_role_arn_association.html.markdown b/website/docs/r/shield_drt_access_role_arn_association.html.markdown
new file mode 100644
index 00000000000..efdc1437e7d
--- /dev/null
+++ b/website/docs/r/shield_drt_access_role_arn_association.html.markdown
@@ -0,0 +1,52 @@
+---
+subcategory: "Shield"
+layout: "aws"
+page_title: "AWS: aws_shield_drt_access_role_arn_association"
+description: |-
+  Terraform resource for managing an AWS Shield DRT Access Role Arn Association.
+---
+# Resource: aws_shield_drt_access_role_arn_association
+
+Authorizes the Shield Response Team (SRT) using the specified role, to access your AWS account to assist with DDoS attack mitigation during potential attacks. For more information see [Configure AWS SRT Support](https://docs.aws.amazon.com/waf/latest/developerguide/authorize-srt.html)
+
+## Example Usage
+
+### Basic Usage
+
+```terraform
+resource "aws_iam_role" "test" {
+  name = var.aws_shield_drt_access_role_arn
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        "Sid" : "",
+        "Effect" : "Allow",
+        "Principal" : {
+          "Service" : "drt.shield.amazonaws.com"
+        },
+        "Action" : "sts:AssumeRole"
+      },
+    ]
+  })
+}
+
+resource "aws_iam_role_policy_attachment" "test" {
+  role       = aws_iam_role.test.name
+  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSShieldDRTAccessPolicy"
+}
+
+resource "aws_shield_drt_access_role_arn_association" "test" {
+  role_arn = aws_iam_role.test.arn
+}
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `role_arn` - (Required) The Amazon Resource Name (ARN) of the role the SRT will use to access your AWS account. Prior to making the AssociateDRTRole request, you must attach the `AWSShieldDRTAccessPolicy` managed policy to this role.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
diff --git a/website/docs/r/shield_protection.html.markdown b/website/docs/r/shield_protection.html.markdown
index 51ca843c6d4..fbbfb8bc386 100644
--- a/website/docs/r/shield_protection.html.markdown
+++ b/website/docs/r/shield_protection.html.markdown
@@ -36,15 +36,15 @@ resource "aws_shield_protection" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) A friendly name for the Protection you are creating.
 * `resource_arn` - (Required) The ARN (Amazon Resource Name) of the resource to be protected.
 * `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The unique identifier (ID) for the Protection object that is created.
 * `arn` - The ARN of the Protection.
@@ -52,8 +52,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Shield protection resources can be imported by specifying their ID e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Shield protection resources using specifying their ID. For example:
 
+```terraform
+import {
+  to = aws_shield_protection.example
+  id = "ff9592dc-22f3-4e88-afa1-7b29fde9669a"
+}
 ```
-$ terraform import aws_shield_protection.example ff9592dc-22f3-4e88-afa1-7b29fde9669a
+
+Using `terraform import`, import Shield protection resources using specifying their ID. For example:
+
+```console
+% terraform import aws_shield_protection.example ff9592dc-22f3-4e88-afa1-7b29fde9669a
 ```
diff --git a/website/docs/r/shield_protection_group.html.markdown b/website/docs/r/shield_protection_group.html.markdown
index 45acba0a9fd..016bbc70d80 100644
--- a/website/docs/r/shield_protection_group.html.markdown
+++ b/website/docs/r/shield_protection_group.html.markdown
@@ -62,7 +62,7 @@ resource "aws_shield_protection_group" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `aggregation` - (Required) Defines how AWS Shield combines resource data for the group in order to detect, mitigate, and report events.
 * `members` - (Optional) The Amazon Resource Names (ARNs) of the resources to include in the protection group. You must set this when you set `pattern` to ARBITRARY and you must not set it for any other `pattern` setting.
@@ -71,17 +71,26 @@ The following arguments are supported:
 * `resource_type` - (Optional) The resource type to include in the protection group. You must set this when you set `pattern` to BY_RESOURCE_TYPE and you must not set it for any other `pattern` setting.
 * `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `protection_group_arn` - The ARN (Amazon Resource Name) of the protection group.
 * `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
 
 ## Import
 
-Shield protection group resources can be imported by specifying their protection group id.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Shield protection group resources using their protection group id. For example:
 
+```terraform
+import {
+  to = aws_shield_protection_group.example
+  id = "example"
+}
 ```
-$ terraform import aws_shield_protection_group.example example
+
+Using `terraform import`, import Shield protection group resources using their protection group id. For example:
+
+```console
+% terraform import aws_shield_protection_group.example example
 ```
diff --git a/website/docs/r/shield_protection_health_check_association.html.markdown b/website/docs/r/shield_protection_health_check_association.html.markdown
index 776e7a94757..4f4b7e54d60 100644
--- a/website/docs/r/shield_protection_health_check_association.html.markdown
+++ b/website/docs/r/shield_protection_health_check_association.html.markdown
@@ -55,21 +55,30 @@ resource "aws_shield_protection_health_check_association" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `health_check_arn` - (Required) The ARN (Amazon Resource Name) of the Route53 Health Check resource which will be associated to the protected resource.
 * `shield_protection_id` - (Required) The ID of the protected resource.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The unique identifier (ID) for the Protection object that is created.
 
 ## Import
 
-Shield protection health check association resources can be imported by specifying the `shield_protection_id` and `health_check_arn` e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Shield protection health check association resources using the `shield_protection_id` and `health_check_arn`. For example:
 
+```terraform
+import {
+  to = aws_shield_protection_health_check_association.example
+  id = "ff9592dc-22f3-4e88-afa1-7b29fde9669a+arn:aws:route53:::healthcheck/3742b175-edb9-46bc-9359-f53e3b794b1b"
+}
 ```
-$ terraform import aws_shield_protection_health_check_association.example ff9592dc-22f3-4e88-afa1-7b29fde9669a+arn:aws:route53:::healthcheck/3742b175-edb9-46bc-9359-f53e3b794b1b
+
+Using `terraform import`, import Shield protection health check association resources using the `shield_protection_id` and `health_check_arn`. For example:
+
+```console
+% terraform import aws_shield_protection_health_check_association.example ff9592dc-22f3-4e88-afa1-7b29fde9669a+arn:aws:route53:::healthcheck/3742b175-edb9-46bc-9359-f53e3b794b1b
 ```
diff --git a/website/docs/r/signer_signing_job.html.markdown b/website/docs/r/signer_signing_job.html.markdown
index 63eecd9afa4..9d915731e2d 100644
--- a/website/docs/r/signer_signing_job.html.markdown
+++ b/website/docs/r/signer_signing_job.html.markdown
@@ -73,9 +73,9 @@ The configuration block supports the following arguments:
 * `bucket` - (Required) Name of the S3 bucket.
 * `prefix` - (Optional) An Amazon S3 object key prefix that you can use to limit signed objects keys to begin with the specified prefix.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `completed_at` - Date and time in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8) that the signing job was completed.
 * `created_at` - Date and time in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8) that the signing job was created.
@@ -94,8 +94,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Signer signing jobs can be imported using the `job_id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Signer signing jobs using the `job_id`. For example:
 
+```terraform
+import {
+  to = aws_signer_signing_job.test_signer_signing_job
+  id = "9ed7e5c3-b8d4-4da0-8459-44e0b068f7ee"
+}
 ```
-$ terraform import aws_signer_signing_job.test_signer_signing_job 9ed7e5c3-b8d4-4da0-8459-44e0b068f7ee
+
+Using `terraform import`, import Signer signing jobs using the `job_id`. For example:
+
+```console
+% terraform import aws_signer_signing_job.test_signer_signing_job 9ed7e5c3-b8d4-4da0-8459-44e0b068f7ee
 ```
diff --git a/website/docs/r/signer_signing_profile.html.markdown b/website/docs/r/signer_signing_profile.html.markdown
index fd2d8567387..faf036977a7 100644
--- a/website/docs/r/signer_signing_profile.html.markdown
+++ b/website/docs/r/signer_signing_profile.html.markdown
@@ -41,9 +41,9 @@ resource "aws_signer_signing_profile" "prod_sp" {
 * `signature_validity_period` - (Optional) The validity period for a signing job.
 * `tags` - (Optional) A list of tags associated with the signing profile. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The Amazon Resource Name (ARN) for the signing profile.
 * `name` - The name of the target signing profile.
@@ -56,8 +56,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Signer signing profiles can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Signer signing profiles using the `name`. For example:
 
+```terraform
+import {
+  to = aws_signer_signing_profile.test_signer_signing_profile
+  id = "test_sp_DdW3Mk1foYL88fajut4mTVFGpuwfd4ACO6ANL0D1uIj7lrn8adK"
+}
 ```
-$ terraform import aws_signer_signing_profile.test_signer_signing_profile test_sp_DdW3Mk1foYL88fajut4mTVFGpuwfd4ACO6ANL0D1uIj7lrn8adK
+
+Using `terraform import`, import Signer signing profiles using the `name`. For example:
+
+```console
+% terraform import aws_signer_signing_profile.test_signer_signing_profile test_sp_DdW3Mk1foYL88fajut4mTVFGpuwfd4ACO6ANL0D1uIj7lrn8adK
 ```
diff --git a/website/docs/r/signer_signing_profile_permission.html.markdown b/website/docs/r/signer_signing_profile_permission.html.markdown
index dc8653780aa..e88e96588dc 100644
--- a/website/docs/r/signer_signing_profile_permission.html.markdown
+++ b/website/docs/r/signer_signing_profile_permission.html.markdown
@@ -53,20 +53,29 @@ resource "aws_signer_signing_profile_permission" "sp_permission_3" {
 ## Argument Reference
 
 * `profile_name` - (Required) Name of the signing profile to add the cross-account permissions.
-* `action` - (Required) An AWS Signer action permitted as part of cross-account permissions. Valid values: `signer:StartSigningJob`, `signer:GetSigningProfile`, or `signer:RevokeSignature`.
+* `action` - (Required) An AWS Signer action permitted as part of cross-account permissions. Valid values: `signer:StartSigningJob`, `signer:GetSigningProfile`, `signer:RevokeSignature`, or `signer:SignPayload`.
 * `principal` - (Required) The AWS principal to be granted a cross-account permission.
 * `profile_version` - (Optional) The signing profile version that a permission applies to.
 * `statement_id` - (Optional) A unique statement identifier. By default generated by Terraform.
 * `statement_id_prefix` - (Optional) A statement identifier prefix. Terraform will generate a unique suffix. Conflicts with `statement_id`.
 
-## Attributes Reference
+## Attribute Reference
 
-No additional attributes are exported.
+This resource exports no additional attributes.
 
 ## Import
 
-Signer signing profile permission statements can be imported using profile_name/statement_id, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Signer signing profile permission statements using profile_name/statement_id. For example:
 
+```terraform
+import {
+  to = aws_signer_signing_profile_permission.test_signer_signing_profile_permission
+  id = "prod_profile_DdW3Mk1foYL88fajut4mTVFGpuwfd4ACO6ANL0D1uIj7lrn8adK/ProdAccountStartSigningJobStatementId"
+}
 ```
-$ terraform import aws_signer_signing_profile_permission.test_signer_signing_profile_permission prod_profile_DdW3Mk1foYL88fajut4mTVFGpuwfd4ACO6ANL0D1uIj7lrn8adK/ProdAccountStartSigningJobStatementId
+
+Using `terraform import`, import Signer signing profile permission statements using profile_name/statement_id. For example:
+
+```console
+% terraform import aws_signer_signing_profile_permission.test_signer_signing_profile_permission prod_profile_DdW3Mk1foYL88fajut4mTVFGpuwfd4ACO6ANL0D1uIj7lrn8adK/ProdAccountStartSigningJobStatementId
 ```
diff --git a/website/docs/r/simpledb_domain.html.markdown b/website/docs/r/simpledb_domain.html.markdown
index b3da9035751..75139723938 100644
--- a/website/docs/r/simpledb_domain.html.markdown
+++ b/website/docs/r/simpledb_domain.html.markdown
@@ -20,20 +20,29 @@ resource "aws_simpledb_domain" "users" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The name of the SimpleDB domain
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The name of the SimpleDB domain
 
 ## Import
 
-SimpleDB Domains can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SimpleDB Domains using the `name`. For example:
 
+```terraform
+import {
+  to = aws_simpledb_domain.users
+  id = "users"
+}
 ```
-$ terraform import aws_simpledb_domain.users users
+
+Using `terraform import`, import SimpleDB Domains using the `name`. For example:
+
+```console
+% terraform import aws_simpledb_domain.users users
 ```
diff --git a/website/docs/r/snapshot_create_volume_permission.html.markdown b/website/docs/r/snapshot_create_volume_permission.html.markdown
index c027453d284..c7dcc768355 100644
--- a/website/docs/r/snapshot_create_volume_permission.html.markdown
+++ b/website/docs/r/snapshot_create_volume_permission.html.markdown
@@ -30,13 +30,13 @@ resource "aws_ebs_snapshot" "example_snapshot" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `snapshot_id` - (Required) A snapshot ID
 * `account_id` - (Required) An AWS Account ID to add create volume permissions. The AWS Account cannot be the snapshot's owner
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - A combination of "`snapshot_id`-`account_id`".
diff --git a/website/docs/r/sns_platform_application.html.markdown b/website/docs/r/sns_platform_application.html.markdown
index ae55e06b8b9..6d0256ceaea 100644
--- a/website/docs/r/sns_platform_application.html.markdown
+++ b/website/docs/r/sns_platform_application.html.markdown
@@ -48,7 +48,7 @@ resource "aws_sns_platform_application" "gcm_application" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The friendly name for the SNS platform application
 * `platform` - (Required) The platform that the app is registered with. See [Platform][1] for supported platforms.
@@ -67,9 +67,9 @@ The following attributes are needed only when using APNS token credentials:
 * `apple_platform_team_id` - (Required) The identifier that's assigned to your Apple developer account team. Must be 10 alphanumeric characters.
 * `apple_platform_bundle_id` - (Required) The bundle identifier that's assigned to your iOS app. May only include alphanumeric characters, hyphens (-), and periods (.).
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ARN of the SNS platform application
 * `arn` - The ARN of the SNS platform application
@@ -79,8 +79,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-SNS platform applications can be imported using the ARN, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SNS platform applications using the ARN. For example:
 
+```terraform
+import {
+  to = aws_sns_platform_application.gcm_application
+  id = "arn:aws:sns:us-west-2:0123456789012:app/GCM/gcm_application"
+}
 ```
-$ terraform import aws_sns_platform_application.gcm_application arn:aws:sns:us-west-2:0123456789012:app/GCM/gcm_application
+
+Using `terraform import`, import SNS platform applications using the ARN. For example:
+
+```console
+% terraform import aws_sns_platform_application.gcm_application arn:aws:sns:us-west-2:0123456789012:app/GCM/gcm_application
 ```
diff --git a/website/docs/r/sns_sms_preferences.html.markdown b/website/docs/r/sns_sms_preferences.html.markdown
index 0b8ac019985..eb5b32c3cb1 100644
--- a/website/docs/r/sns_sms_preferences.html.markdown
+++ b/website/docs/r/sns_sms_preferences.html.markdown
@@ -18,7 +18,7 @@ resource "aws_sns_sms_preferences" "update_sms_prefs" {}
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `monthly_spend_limit` - (Optional) The maximum amount in USD that you are willing to spend each month to send SMS messages.
 * `delivery_status_iam_role_arn` - (Optional) The ARN of the IAM role that allows Amazon SNS to write logs about SMS deliveries in CloudWatch Logs.
@@ -27,6 +27,6 @@ The following arguments are supported:
 * `default_sms_type` - (Optional) The type of SMS message that you will send by default. Possible values are: Promotional, Transactional
 * `usage_report_s3_bucket` - (Optional) The name of the Amazon S3 bucket to receive daily SMS usage reports from Amazon SNS.
 
-## Attributes Reference
+## Attribute Reference
 
-No additional attributes are exported.
+This resource exports no additional attributes.
diff --git a/website/docs/r/sns_topic.html.markdown b/website/docs/r/sns_topic.html.markdown
index 4555a56c498..8732abdb1e2 100644
--- a/website/docs/r/sns_topic.html.markdown
+++ b/website/docs/r/sns_topic.html.markdown
@@ -70,7 +70,7 @@ The `<endpoint>_success_feedback_role_arn` and `<endpoint>_failure_feedback_role
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Optional) The name of the topic. Topic names must be made up of only uppercase and lowercase ASCII letters, numbers, underscores, and hyphens, and must be between 1 and 256 characters long. For a FIFO (first-in-first-out) topic, the name must end with the `.fifo` suffix. If omitted, Terraform will assign a random, unique name. Conflicts with `name_prefix`
 * `name_prefix` - (Optional) Creates a unique name beginning with the specified prefix. Conflicts with `name`
@@ -99,9 +99,9 @@ The following arguments are supported:
 * `firehose_failure_feedback_role_arn` - (Optional) IAM role for failure feedback
 * `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ARN of the SNS topic
 * `arn` - The ARN of the SNS topic, as a more obvious property (clone of id)
@@ -110,8 +110,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-SNS Topics can be imported using the `topic arn`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SNS Topics using the topic `arn`. For example:
 
+```terraform
+import {
+  to = aws_sns_topic.user_updates
+  id = "arn:aws:sns:us-west-2:0123456789012:my-topic"
+}
 ```
-$ terraform import aws_sns_topic.user_updates arn:aws:sns:us-west-2:0123456789012:my-topic
+
+Using `terraform import`, import SNS Topics using the topic `arn`. For example:
+
+```console
+% terraform import aws_sns_topic.user_updates arn:aws:sns:us-west-2:0123456789012:my-topic
 ```
diff --git a/website/docs/r/sns_topic_data_protection_policy.html.markdown b/website/docs/r/sns_topic_data_protection_policy.html.markdown
index d365b5364d7..091ba8600b1 100644
--- a/website/docs/r/sns_topic_data_protection_policy.html.markdown
+++ b/website/docs/r/sns_topic_data_protection_policy.html.markdown
@@ -46,19 +46,28 @@ resource "aws_sns_topic_data_protection_policy" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `arn` - (Required) The ARN of the SNS topic
 * `policy` - (Required) The fully-formed AWS policy as JSON. For more information about building AWS IAM policy documents with Terraform, see the [AWS IAM Policy Document Guide](https://learn.hashicorp.com/terraform/aws/iam-policy).
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 ## Import
 
-SNS Data Protection Topic Policy can be imported using the topic ARN, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SNS Data Protection Topic Policy using the topic ARN. For example:
 
+```terraform
+import {
+  to = aws_sns_topic_data_protection_policy.example
+  id = "arn:aws:sns:us-west-2:0123456789012:example"
+}
 ```
-$ terraform import aws_sns_topic_data_protection_policy.example arn:aws:sns:us-west-2:0123456789012:example
+
+Using `terraform import`, import SNS Data Protection Topic Policy using the topic ARN. For example:
+
+```console
+% terraform import aws_sns_topic_data_protection_policy.example arn:aws:sns:us-west-2:0123456789012:example
 ```
diff --git a/website/docs/r/sns_topic_policy.html.markdown b/website/docs/r/sns_topic_policy.html.markdown
index 48de347573c..547ed7d50b1 100644
--- a/website/docs/r/sns_topic_policy.html.markdown
+++ b/website/docs/r/sns_topic_policy.html.markdown
@@ -68,21 +68,30 @@ data "aws_iam_policy_document" "sns_topic_policy" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `arn` - (Required) The ARN of the SNS topic
 * `policy` - (Required) The fully-formed AWS policy as JSON. For more information about building AWS IAM policy documents with Terraform, see the [AWS IAM Policy Document Guide](https://learn.hashicorp.com/terraform/aws/iam-policy).
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `owner` - The AWS Account ID of the SNS topic owner
 
 ## Import
 
-SNS Topic Policy can be imported using the topic ARN, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SNS Topic Policy using the topic ARN. For example:
 
+```terraform
+import {
+  to = aws_sns_topic_policy.user_updates
+  id = "arn:aws:sns:us-west-2:0123456789012:my-topic"
+}
 ```
-$ terraform import aws_sns_topic_policy.user_updates arn:aws:sns:us-west-2:0123456789012:my-topic
+
+Using `terraform import`, import SNS Topic Policy using the topic ARN. For example:
+
+```console
+% terraform import aws_sns_topic_policy.user_updates arn:aws:sns:us-west-2:0123456789012:my-topic
 ```
diff --git a/website/docs/r/sns_topic_subscription.html.markdown b/website/docs/r/sns_topic_subscription.html.markdown
index 4470a1c1a3f..0a384031d28 100644
--- a/website/docs/r/sns_topic_subscription.html.markdown
+++ b/website/docs/r/sns_topic_subscription.html.markdown
@@ -264,9 +264,9 @@ Partially supported values for `protocol` include:
 * `http` -- Delivers JSON-encoded messages via HTTP POST. `endpoint` is a URL beginning with `http://`.
 * `https` -- Delivers JSON-encoded messages via HTTPS POST. `endpoint` is a URL beginning with `https://`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the subscription.
 * `confirmation_was_authenticated` - Whether the subscription confirmation request was authenticated.
@@ -276,8 +276,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-SNS Topic Subscriptions can be imported using the `subscription arn`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SNS Topic Subscriptions using the subscription `arn`. For example:
 
+```terraform
+import {
+  to = aws_sns_topic_subscription.user_updates_sqs_target
+  id = "arn:aws:sns:us-west-2:0123456789012:my-topic:8a21d249-4329-4871-acc6-7be709c6ea7f"
+}
 ```
-$ terraform import aws_sns_topic_subscription.user_updates_sqs_target arn:aws:sns:us-west-2:0123456789012:my-topic:8a21d249-4329-4871-acc6-7be709c6ea7f
+
+Using `terraform import`, import SNS Topic Subscriptions using the subscription `arn`. For example:
+
+```console
+% terraform import aws_sns_topic_subscription.user_updates_sqs_target arn:aws:sns:us-west-2:0123456789012:my-topic:8a21d249-4329-4871-acc6-7be709c6ea7f
 ```
diff --git a/website/docs/r/spot_datafeed_subscription.html.markdown b/website/docs/r/spot_datafeed_subscription.html.markdown
index 80beb6f5263..816ab53487b 100644
--- a/website/docs/r/spot_datafeed_subscription.html.markdown
+++ b/website/docs/r/spot_datafeed_subscription.html.markdown
@@ -31,14 +31,23 @@ resource "aws_spot_datafeed_subscription" "default" {
 * `bucket` - (Required) The Amazon S3 bucket in which to store the Spot instance data feed.
 * `prefix` - (Optional) Path of folder inside bucket to place spot pricing data.
 
-## Attributes Reference
+## Attribute Reference
 
-No additional attributes are exported.
+This resource exports no additional attributes.
 
 ## Import
 
-A Spot Datafeed Subscription can be imported using the word `spot-datafeed-subscription`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import a Spot Datafeed Subscription using the word `spot-datafeed-subscription`. For example:
 
+```terraform
+import {
+  to = aws_spot_datafeed_subscription.mysubscription
+  id = "spot-datafeed-subscription"
+}
 ```
-$ terraform import aws_spot_datafeed_subscription.mysubscription spot-datafeed-subscription
+
+Using `terraform import`, import a Spot Datafeed Subscription using the word `spot-datafeed-subscription`. For example:
+
+```console
+% terraform import aws_spot_datafeed_subscription.mysubscription spot-datafeed-subscription
 ```
diff --git a/website/docs/r/spot_fleet_request.html.markdown b/website/docs/r/spot_fleet_request.html.markdown
index 0c900df5705..5ae59a364fd 100644
--- a/website/docs/r/spot_fleet_request.html.markdown
+++ b/website/docs/r/spot_fleet_request.html.markdown
@@ -400,9 +400,9 @@ This configuration block supports the following:
     * `min` - (Optional) Minimum.
     * `max` - (Optional) Maximum.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The Spot fleet request ID
 * `spot_request_state` - The state of the Spot fleet request.
@@ -417,8 +417,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Spot Fleet Requests can be imported using `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Spot Fleet Requests using `id`. For example:
 
+```terraform
+import {
+  to = aws_spot_fleet_request.fleet
+  id = "sfr-005e9ec8-5546-4c31-b317-31a62325411e"
+}
 ```
-$ terraform import aws_spot_fleet_request.fleet sfr-005e9ec8-5546-4c31-b317-31a62325411e
+
+Using `terraform import`, import Spot Fleet Requests using `id`. For example:
+
+```console
+% terraform import aws_spot_fleet_request.fleet sfr-005e9ec8-5546-4c31-b317-31a62325411e
 ```
diff --git a/website/docs/r/spot_instance_request.html.markdown b/website/docs/r/spot_instance_request.html.markdown
index 8d5f8c8698a..1db8da80596 100644
--- a/website/docs/r/spot_instance_request.html.markdown
+++ b/website/docs/r/spot_instance_request.html.markdown
@@ -70,9 +70,9 @@ Spot Instance Requests support all the same arguments as
 * `valid_from` - (Optional) The start date and time of the request, in UTC [RFC3339](https://tools.ietf.org/html/rfc3339#section-5.8) format(for example, YYYY-MM-DDTHH:MM:SSZ). The default is to start fulfilling the request immediately.
 * `tags` - (Optional) A map of tags to assign to the Spot Instance Request. These tags are not automatically applied to the launched Instance. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The Spot Instance Request ID.
 
diff --git a/website/docs/r/sqs_queue.html.markdown b/website/docs/r/sqs_queue.html.markdown
index e1a5be11c47..755d258154d 100644
--- a/website/docs/r/sqs_queue.html.markdown
+++ b/website/docs/r/sqs_queue.html.markdown
@@ -84,7 +84,7 @@ resource "aws_sqs_queue" "terraform_queue" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Optional) The name of the queue. Queue names must be made up of only uppercase and lowercase ASCII letters, numbers, underscores, and hyphens, and must be between 1 and 80 characters long. For a FIFO (first-in-first-out) queue, the name must end with the `.fifo` suffix. If omitted, Terraform will assign a random, unique name. Conflicts with `name_prefix`
 * `name_prefix` - (Optional) Creates a unique name beginning with the specified prefix. Conflicts with `name`
@@ -105,9 +105,9 @@ The following arguments are supported:
 * `fifo_throughput_limit` - (Optional) Specifies whether the FIFO queue throughput quota applies to the entire queue or per message group. Valid values are `perQueue` (default) and `perMessageGroupId`.
 * `tags` - (Optional) A map of tags to assign to the queue. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The URL for the created Amazon SQS queue.
 * `arn` - The ARN of the SQS queue
@@ -116,8 +116,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-SQS Queues can be imported using the `queue url`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SQS Queues using the queue `url`. For example:
 
+```terraform
+import {
+  to = aws_sqs_queue.public_queue
+  id = "https://queue.amazonaws.com/80398EXAMPLE/MyQueue"
+}
 ```
-$ terraform import aws_sqs_queue.public_queue https://queue.amazonaws.com/80398EXAMPLE/MyQueue
+
+Using `terraform import`, import SQS Queues using the queue `url`. For example:
+
+```console
+% terraform import aws_sqs_queue.public_queue https://queue.amazonaws.com/80398EXAMPLE/MyQueue
 ```
diff --git a/website/docs/r/sqs_queue_policy.html.markdown b/website/docs/r/sqs_queue_policy.html.markdown
index f9410b2c82a..1e43e785031 100644
--- a/website/docs/r/sqs_queue_policy.html.markdown
+++ b/website/docs/r/sqs_queue_policy.html.markdown
@@ -47,19 +47,28 @@ resource "aws_sqs_queue_policy" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `queue_url` - (Required) The URL of the SQS Queue to which to attach the policy
 * `policy` - (Required) The JSON policy for the SQS queue. For more information about building AWS IAM policy documents with Terraform, see the [AWS IAM Policy Document Guide](https://learn.hashicorp.com/terraform/aws/iam-policy).
 
-## Attributes Reference
+## Attribute Reference
 
-No additional attributes are exported.
+This resource exports no additional attributes.
 
 ## Import
 
-SQS Queue Policies can be imported using the queue URL, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SQS Queue Policies using the queue URL. For example:
 
+```terraform
+import {
+  to = aws_sqs_queue_policy.test
+  id = "https://queue.amazonaws.com/0123456789012/myqueue"
+}
 ```
-$ terraform import aws_sqs_queue_policy.test https://queue.amazonaws.com/0123456789012/myqueue
+
+Using `terraform import`, import SQS Queue Policies using the queue URL. For example:
+
+```console
+% terraform import aws_sqs_queue_policy.test https://queue.amazonaws.com/0123456789012/myqueue
 ```
diff --git a/website/docs/r/sqs_queue_redrive_allow_policy.html.markdown b/website/docs/r/sqs_queue_redrive_allow_policy.html.markdown
index c166f7a52eb..4d228222de7 100644
--- a/website/docs/r/sqs_queue_redrive_allow_policy.html.markdown
+++ b/website/docs/r/sqs_queue_redrive_allow_policy.html.markdown
@@ -38,19 +38,28 @@ resource "aws_sqs_queue_redrive_allow_policy" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `queue_url` - (Required) The URL of the SQS Queue to which to attach the policy
 * `redrive_allow_policy` - (Required) The JSON redrive allow policy for the SQS queue. Learn more in the [Amazon SQS dead-letter queues documentation](https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-dead-letter-queues.html).
 
-## Attributes Reference
+## Attribute Reference
 
-No additional attributes are exported.
+This resource exports no additional attributes.
 
 ## Import
 
-SQS Queue Redrive Allow Policies can be imported using the queue URL, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SQS Queue Redrive Allow Policies using the queue URL. For example:
 
+```terraform
+import {
+  to = aws_sqs_queue_redrive_allow_policy.test
+  id = "https://queue.amazonaws.com/0123456789012/myqueue"
+}
 ```
-$ terraform import aws_sqs_queue_redrive_allow_policy.test https://queue.amazonaws.com/0123456789012/myqueue
+
+Using `terraform import`, import SQS Queue Redrive Allow Policies using the queue URL. For example:
+
+```console
+% terraform import aws_sqs_queue_redrive_allow_policy.test https://queue.amazonaws.com/0123456789012/myqueue
 ```
diff --git a/website/docs/r/sqs_queue_redrive_policy.html.markdown b/website/docs/r/sqs_queue_redrive_policy.html.markdown
index e274007b7f9..fc8194f26b5 100644
--- a/website/docs/r/sqs_queue_redrive_policy.html.markdown
+++ b/website/docs/r/sqs_queue_redrive_policy.html.markdown
@@ -41,19 +41,28 @@ resource "aws_sqs_queue_redrive_policy" "q" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `queue_url` - (Required) The URL of the SQS Queue to which to attach the policy
 * `redrive_policy` - (Required) The JSON redrive policy for the SQS queue. Accepts two key/val pairs: `deadLetterTargetArn` and `maxReceiveCount`. Learn more in the [Amazon SQS dead-letter queues documentation](https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-dead-letter-queues.html).
 
-## Attributes Reference
+## Attribute Reference
 
-No additional attributes are exported.
+This resource exports no additional attributes.
 
 ## Import
 
-SQS Queue Redrive Policies can be imported using the queue URL, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SQS Queue Redrive Policies using the queue URL. For example:
 
+```terraform
+import {
+  to = aws_sqs_queue_redrive_policy.test
+  id = "https://queue.amazonaws.com/0123456789012/myqueue"
+}
 ```
-$ terraform import aws_sqs_queue_redrive_policy.test https://queue.amazonaws.com/0123456789012/myqueue
+
+Using `terraform import`, import SQS Queue Redrive Policies using the queue URL. For example:
+
+```console
+% terraform import aws_sqs_queue_redrive_policy.test https://queue.amazonaws.com/0123456789012/myqueue
 ```
diff --git a/website/docs/r/ssm_activation.html.markdown b/website/docs/r/ssm_activation.html.markdown
index 4b483cb59df..cdca4e6d939 100644
--- a/website/docs/r/ssm_activation.html.markdown
+++ b/website/docs/r/ssm_activation.html.markdown
@@ -47,7 +47,7 @@ resource "aws_ssm_activation" "foo" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Optional) The default name of the registered managed instance.
 * `description` - (Optional) The description of the resource that you want to register.
@@ -56,9 +56,9 @@ The following arguments are supported:
 * `registration_limit` - (Optional) The maximum number of managed instances you want to register. The default value is 1 instance.
 * `tags` - (Optional) A map of tags to assign to the object. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The activation ID.
 * `activation_code` - The code the system generates when it processes the activation.
@@ -73,10 +73,19 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-AWS SSM Activation can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AWS SSM Activation using the `id`. For example:
 
-```sh
-$ terraform import aws_ssm_activation.example e488f2f6-e686-4afb-8a04-ef6dfEXAMPLE
+```terraform
+import {
+  to = aws_ssm_activation.example
+  id = "e488f2f6-e686-4afb-8a04-ef6dfEXAMPLE"
+}
+```
+
+Using `terraform import`, import AWS SSM Activation using the `id`. For example:
+
+```console
+% terraform import aws_ssm_activation.example e488f2f6-e686-4afb-8a04-ef6dfEXAMPLE
 ```
 
 -> **Note:** The `activation_code` attribute cannot be imported.
diff --git a/website/docs/r/ssm_association.html.markdown b/website/docs/r/ssm_association.html.markdown
index cead112886e..670d42a13e6 100644
--- a/website/docs/r/ssm_association.html.markdown
+++ b/website/docs/r/ssm_association.html.markdown
@@ -81,21 +81,22 @@ resource "aws_ssm_association" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The name of the SSM document to apply.
 * `apply_only_at_cron_interval` - (Optional) By default, when you create a new or update associations, the system runs it immediately and then according to the schedule you specified. Enable this option if you do not want an association to run immediately after you create or update it. This parameter is not supported for rate expressions. Default: `false`.
 * `association_name` - (Optional) The descriptive name for the association.
+* `automation_target_parameter_name` - (Optional) Specify the target for the association. This target is required for associations that use an `Automation` document and target resources by using rate controls. This should be set to the SSM document `parameter` that will define how your automation will branch out.
+* `compliance_severity` - (Optional) The compliance severity for the association. Can be one of the following: `UNSPECIFIED`, `LOW`, `MEDIUM`, `HIGH` or `CRITICAL`
 * `document_version` - (Optional) The document version you want to associate with the target(s). Can be a specific version or the default version.
 * `instance_id` - (Optional, **Deprecated**) The instance ID to apply an SSM document to. Use `targets` with key `InstanceIds` for document schema versions 2.0 and above. Use the `targets` attribute instead.
+* `max_concurrency` - (Optional) The maximum number of targets allowed to run the association at the same time. You can specify a number, for example 10, or a percentage of the target set, for example 10%.
+* `max_errors` - (Optional) The number of errors that are allowed before the system stops sending requests to run the association on additional targets. You can specify a number, for example 10, or a percentage of the target set, for example 10%. If you specify a threshold of 3, the stop command is sent when the fourth error is returned. If you specify a threshold of 10% for 50 associations, the stop command is sent when the sixth error is returned.
 * `output_location` - (Optional) An output location block. Output Location is documented below.
 * `parameters` - (Optional) A block of arbitrary string parameters to pass to the SSM document.
 * `schedule_expression` - (Optional) A [cron or rate expression](https://docs.aws.amazon.com/systems-manager/latest/userguide/reference-cron-and-rate-expressions.html) that specifies when the association runs.
+* `sync_compliance` - (Optional) The mode for generating association compliance. You can specify `AUTO` or `MANUAL`.
 * `targets` - (Optional) A block containing the targets of the SSM association. Targets are documented below. AWS currently supports a maximum of 5 targets.
-* `compliance_severity` - (Optional) The compliance severity for the association. Can be one of the following: `UNSPECIFIED`, `LOW`, `MEDIUM`, `HIGH` or `CRITICAL`
-* `max_concurrency` - (Optional) The maximum number of targets allowed to run the association at the same time. You can specify a number, for example 10, or a percentage of the target set, for example 10%.
-* `max_errors` - (Optional) The number of errors that are allowed before the system stops sending requests to run the association on additional targets. You can specify a number, for example 10, or a percentage of the target set, for example 10%.
-* `automation_target_parameter_name` - (Optional) Specify the target for the association. This target is required for associations that use an `Automation` document and target resources by using rate controls. This should be set to the SSM document `parameter` that will define how your automation will branch out.
 * `wait_for_success_timeout_seconds` - (Optional) The number of seconds to wait for the association status to be `Success`. If `Success` status is not reached within the given time, create opration will fail.
 
 Output Location (`output_location`) is an S3 bucket where you want to store the results of this association:
@@ -109,9 +110,9 @@ Targets specify what instance IDs or tags to apply the document to and has these
 * `key` - (Required) Either `InstanceIds` or `tag:Tag Name` to specify an EC2 tag.
 * `values` - (Required) A list of instance IDs or tag values. AWS currently limits this list size to one value.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The ARN of the SSM association
 * `association_id` - The ID of the SSM association.
@@ -121,8 +122,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-SSM associations can be imported using the `association_id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SSM associations using the `association_id`. For example:
 
+```terraform
+import {
+  to = aws_ssm_association.test-association
+  id = "10abcdef-0abc-1234-5678-90abcdef123456"
+}
 ```
-$ terraform import aws_ssm_association.test-association 10abcdef-0abc-1234-5678-90abcdef123456
+
+Using `terraform import`, import SSM associations using the `association_id`. For example:
+
+```console
+% terraform import aws_ssm_association.test-association 10abcdef-0abc-1234-5678-90abcdef123456
 ```
diff --git a/website/docs/r/ssm_default_patch_baseline.html.markdown b/website/docs/r/ssm_default_patch_baseline.html.markdown
index 8406d6f1607..65b6e0073d4 100644
--- a/website/docs/r/ssm_default_patch_baseline.html.markdown
+++ b/website/docs/r/ssm_default_patch_baseline.html.markdown
@@ -49,22 +49,57 @@ The following arguments are required:
   `UBUNTU`, and
   `WINDOWS`.
 
-## Attributes Reference
+## Attribute Reference
 
-No additional attributes are exported.
+This resource exports no additional attributes.
 
 ## Import
 
-The Systems Manager Default Patch Baseline can be imported using the patch baseline ID, patch baseline ARN, or the operating system value, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import the Systems Manager Default Patch Baseline using the patch baseline ID, patch baseline ARN, or the operating system value. For example:
 
+Using the patch baseline ID:
+
+```terraform
+import {
+  to = aws_ssm_default_patch_baseline.example
+  id = "pb-1234567890abcdef1"
+}
 ```
-$ terraform import aws_ssm_default_patch_baseline.example pb-1234567890abcdef1
+
+Using the patch baseline ARN:
+
+```terraform
+import {
+  to = aws_ssm_default_patch_baseline.example
+  id = "arn:aws:ssm:us-west-2:123456789012:patchbaseline/pb-1234567890abcdef1"
+}
 ```
 
+Using the operating system value:
+
+```terraform
+import {
+  to = aws_ssm_default_patch_baseline.example
+  id = "CENTOS"
+}
 ```
-$ terraform import aws_ssm_default_patch_baseline.example arn:aws:ssm:us-west-2:123456789012:patchbaseline/pb-1234567890abcdef1
+
+**Using `terraform import` to import** the Systems Manager Default Patch Baseline using the patch baseline ID, patch baseline ARN, or the operating system value. For example:
+
+Using the patch baseline ID:
+
+```console
+% terraform import aws_ssm_default_patch_baseline.example pb-1234567890abcdef1
 ```
 
+Using the patch baseline ARN:
+
+```console
+% terraform import aws_ssm_default_patch_baseline.example arn:aws:ssm:us-west-2:123456789012:patchbaseline/pb-1234567890abcdef1
 ```
-$ terraform import aws_ssm_default_patch_baseline.example CENTOS
+
+Using the operating system value:
+
+```console
+% terraform import aws_ssm_default_patch_baseline.example CENTOS
 ```
diff --git a/website/docs/r/ssm_document.html.markdown b/website/docs/r/ssm_document.html.markdown
index 76a0baba109..18fb3fdfaeb 100644
--- a/website/docs/r/ssm_document.html.markdown
+++ b/website/docs/r/ssm_document.html.markdown
@@ -68,7 +68,7 @@ DOC
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The name of the document.
 * `attachments_source` - (Optional) One or more configuration blocks describing attachments sources to a version of a document. Defined below.
@@ -88,9 +88,9 @@ The `attachments_source` block supports the following:
 * `values` - (Required) The value describing the location of an attachment to a document
 * `name` - (Optional) The name of the document attachment file
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `created_date` - The date the document was created.
 * `description` - The description of the document.
@@ -122,13 +122,22 @@ The permissions mapping supports the following:
 
 ## Import
 
-SSM Documents can be imported using the name, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SSM Documents using the name. For example:
 
+```terraform
+import {
+  to = aws_ssm_document.example
+  id = "example"
+}
 ```
-$ terraform import aws_ssm_document.example example
+
+Using `terraform import`, import SSM Documents using the name. For example:
+
+```console
+% terraform import aws_ssm_document.example example
 ```
 
-The `attachments_source` argument does not have an SSM API method for reading the attachment information detail after creation. If the argument is set in the Terraform configuration on an imported resource, Terraform will always show a difference. To workaround this behavior, either omit the argument from the Terraform configuration or use [`ignore_changes`](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html#ignore_changes) to hide the difference, e.g.,
+The `attachments_source` argument does not have an SSM API method for reading the attachment information detail after creation. If the argument is set in the Terraform configuration on an imported resource, Terraform will always show a difference. To workaround this behavior, either omit the argument from the Terraform configuration or use [`ignore_changes`](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html#ignore_changes) to hide the difference. For example:
 
 ```terraform
 resource "aws_ssm_document" "test" {
diff --git a/website/docs/r/ssm_maintenance_window.html.markdown b/website/docs/r/ssm_maintenance_window.html.markdown
index 812d9ac4462..4d261888d6c 100644
--- a/website/docs/r/ssm_maintenance_window.html.markdown
+++ b/website/docs/r/ssm_maintenance_window.html.markdown
@@ -23,7 +23,7 @@ resource "aws_ssm_maintenance_window" "production" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The name of the maintenance window.
 * `schedule` - (Required) The schedule of the Maintenance Window in the form of a [cron or rate expression](https://docs.aws.amazon.com/systems-manager/latest/userguide/reference-cron-and-rate-expressions.html).
@@ -38,17 +38,26 @@ The following arguments are supported:
 * `start_date` - (Optional) Timestamp in [ISO-8601 extended format](https://www.iso.org/iso-8601-date-and-time-format.html) when to begin the maintenance window.
 * `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the maintenance window.
 * `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
 
 ## Import
 
-SSM  Maintenance Windows can be imported using the `maintenance window id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SSM  Maintenance Windows using the maintenance window `id`. For example:
 
+```terraform
+import {
+  to = aws_ssm_maintenance_window.imported-window
+  id = "mw-0123456789"
+}
 ```
-$ terraform import aws_ssm_maintenance_window.imported-window mw-0123456789
+
+Using `terraform import`, import SSM  Maintenance Windows using the maintenance window `id`. For example:
+
+```console
+% terraform import aws_ssm_maintenance_window.imported-window mw-0123456789
 ```
diff --git a/website/docs/r/ssm_maintenance_window_target.html.markdown b/website/docs/r/ssm_maintenance_window_target.html.markdown
index 885b6c983ce..cbf55e4f686 100644
--- a/website/docs/r/ssm_maintenance_window_target.html.markdown
+++ b/website/docs/r/ssm_maintenance_window_target.html.markdown
@@ -60,7 +60,7 @@ resource "aws_ssm_maintenance_window_target" "target1" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `window_id` - (Required) The Id of the maintenance window to register the target with.
 * `name` - (Optional) The name of the maintenance window target.
@@ -70,16 +70,25 @@ The following arguments are supported:
  (https://docs.aws.amazon.com/systems-manager/latest/userguide/mw-cli-tutorial-targets-examples.html)
 * `owner_information` - (Optional) User-provided value that will be included in any CloudWatch events raised while running tasks for these targets in this Maintenance Window.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the maintenance window target.
 
 ## Import
 
-SSM Maintenance Window targets can be imported using `WINDOW_ID/WINDOW_TARGET_ID`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SSM Maintenance Window targets using `WINDOW_ID/WINDOW_TARGET_ID`. For example:
 
+```terraform
+import {
+  to = aws_ssm_maintenance_window_target.example
+  id = "mw-0c50858d01EXAMPLE/23639a0b-ddbc-4bca-9e72-78d96EXAMPLE"
+}
 ```
-$ terraform import aws_ssm_maintenance_window_target.example mw-0c50858d01EXAMPLE/23639a0b-ddbc-4bca-9e72-78d96EXAMPLE
+
+Using `terraform import`, import SSM Maintenance Window targets using `WINDOW_ID/WINDOW_TARGET_ID`. For example:
+
+```console
+% terraform import aws_ssm_maintenance_window_target.example mw-0c50858d01EXAMPLE/23639a0b-ddbc-4bca-9e72-78d96EXAMPLE
 ```
diff --git a/website/docs/r/ssm_maintenance_window_task.html.markdown b/website/docs/r/ssm_maintenance_window_task.html.markdown
index 0ec6413a9a2..be782f865bc 100644
--- a/website/docs/r/ssm_maintenance_window_task.html.markdown
+++ b/website/docs/r/ssm_maintenance_window_task.html.markdown
@@ -131,7 +131,7 @@ resource "aws_ssm_maintenance_window_task" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `window_id` - (Required) The Id of the maintenance window to register the task with.
 * `max_concurrency` - (Optional) The maximum number of targets this task can be run for in parallel.
@@ -198,9 +198,9 @@ The following arguments are supported:
 * `name` - (Required) The parameter name.
 * `values` - (Required) The array of strings.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The ARN of the maintenance window task.
 * `id` - The ID of the maintenance window task.
@@ -208,8 +208,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-AWS Maintenance Window Task can be imported using the `window_id` and `window_task_id` separated by `/`.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AWS Maintenance Window Task using the `window_id` and `window_task_id` separated by `/`. For example:
 
-```sh
-$ terraform import aws_ssm_maintenance_window_task.task <window_id>/<window_task_id>
+```terraform
+import {
+  to = aws_ssm_maintenance_window_task.task
+  id = "<window_id>/<window_task_id>"
+}
+```
+
+Using `terraform import`, import AWS Maintenance Window Task using the `window_id` and `window_task_id` separated by `/`. For example:
+
+```console
+% terraform import aws_ssm_maintenance_window_task.task <window_id>/<window_task_id>
 ```
diff --git a/website/docs/r/ssm_parameter.html.markdown b/website/docs/r/ssm_parameter.html.markdown
index 93e313072d1..f94f9f25d07 100644
--- a/website/docs/r/ssm_parameter.html.markdown
+++ b/website/docs/r/ssm_parameter.html.markdown
@@ -10,7 +10,7 @@ description: |-
 
 Provides an SSM Parameter resource.
 
-~> **Note:** `overwrite` also makes it possible to overwrite an existing SSM Parameter that's not created by Terraform before.
+~> **Note:** `overwrite` also makes it possible to overwrite an existing SSM Parameter that's not created by Terraform before. This argument has been deprecated and will be removed in v6.0.0 of the provider. For more information on how this affects the behavior of this resource, see [this issue comment](https://github.com/hashicorp/terraform-provider-aws/issues/25636#issuecomment-1623661159).
 
 ## Example Usage
 
@@ -69,16 +69,16 @@ The following arguments are optional:
 * `description` - (Optional) Description of the parameter.
 * `insecure_value` - (Optional, exactly one of `value` or `insecure_value` is required) Value of the parameter. **Use caution:** This value is _never_ marked as sensitive in the Terraform plan output. This argument is not valid with a `type` of `SecureString`.
 * `key_id` - (Optional) KMS key ID or ARN for encrypting a SecureString.
-* `overwrite` - (Optional, **Deprecated**) Overwrite an existing parameter. If not specified, will default to `false` if the resource has not been created by terraform to avoid overwrite of existing resource and will default to `true` otherwise (terraform lifecycle rules should then be used to manage the update behavior).
+* `overwrite` - (Optional, **Deprecated**) Overwrite an existing parameter. If not specified, defaults to `false` if the resource has not been created by Terraform to avoid overwrite of existing resource, and will default to `true` otherwise (Terraform lifecycle rules should then be used to manage the update behavior).
 * `tags` - (Optional) Map of tags to assign to the object. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 * `tier` - (Optional) Parameter tier to assign to the parameter. If not specified, will use the default parameter tier for the region. Valid tiers are `Standard`, `Advanced`, and `Intelligent-Tiering`. Downgrading an `Advanced` tier parameter to `Standard` will recreate the resource. For more information on parameter tiers, see the [AWS SSM Parameter tier comparison and guide](https://docs.aws.amazon.com/systems-manager/latest/userguide/parameter-store-advanced-parameters.html).
 * `value` - (Optional, exactly one of `value` or `insecure_value` is required) Value of the parameter. This value is always marked as sensitive in the Terraform plan output, regardless of `type`. In Terraform CLI version 0.15 and later, this may require additional configuration handling for certain scenarios. For more information, see the [Terraform v0.15 Upgrade Guide](https://www.terraform.io/upgrade-guides/0-15.html#sensitive-output-values).
 
 ~> **NOTE:** `aws:ssm:integration` data_type parameters must be of the type `SecureString` and the name must start with the prefix `/d9d01087-4a3f-49e0-b0b4-d568d7826553/ssm/integrations/webhook/`. See [here](https://docs.aws.amazon.com/systems-manager/latest/userguide/creating-integrations.html) for information on the usage of `aws:ssm:integration` parameters.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the parameter.
 * `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
@@ -86,8 +86,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-SSM Parameters can be imported using the `parameter store name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SSM Parameters using the parameter store `name`. For example:
 
+```terraform
+import {
+  to = aws_ssm_parameter.my_param
+  id = "/my_path/my_paramname"
+}
 ```
-$ terraform import aws_ssm_parameter.my_param /my_path/my_paramname
+
+Using `terraform import`, import SSM Parameters using the parameter store `name`. For example:
+
+```console
+% terraform import aws_ssm_parameter.my_param /my_path/my_paramname
 ```
diff --git a/website/docs/r/ssm_patch_baseline.html.markdown b/website/docs/r/ssm_patch_baseline.html.markdown
index 86c3d1e3151..d13826fb237 100644
--- a/website/docs/r/ssm_patch_baseline.html.markdown
+++ b/website/docs/r/ssm_patch_baseline.html.markdown
@@ -158,7 +158,7 @@ EOF
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The name of the patch baseline.
 * `description` - (Optional) The description of the patch baseline.
@@ -235,9 +235,9 @@ The `source` block supports:
 * `products` - (Required) The specific operating system versions a patch repository applies to, such as `"Ubuntu16.04"`, `"AmazonLinux2016.09"`, `"RedhatEnterpriseLinux7.2"` or `"Suse12.7"`.
   For lists of supported product values, see [PatchFilter](https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_PatchFilter.html).
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the patch baseline.
 * `arn` - The ARN of the patch baseline.
@@ -245,8 +245,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-SSM Patch Baselines can be imported by their baseline ID, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SSM Patch Baselines using their baseline ID. For example:
 
+```terraform
+import {
+  to = aws_ssm_patch_baseline.example
+  id = "pb-12345678"
+}
 ```
-$ terraform import aws_ssm_patch_baseline.example pb-12345678
+
+Using `terraform import`, import SSM Patch Baselines using their baseline ID. For example:
+
+```console
+% terraform import aws_ssm_patch_baseline.example pb-12345678
 ```
diff --git a/website/docs/r/ssm_patch_group.html.markdown b/website/docs/r/ssm_patch_group.html.markdown
index 268aca79536..2e82dd4351b 100644
--- a/website/docs/r/ssm_patch_group.html.markdown
+++ b/website/docs/r/ssm_patch_group.html.markdown
@@ -26,13 +26,13 @@ resource "aws_ssm_patch_group" "patchgroup" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `baseline_id` - (Required) The ID of the patch baseline to register the patch group with.
 * `patch_group` - (Required) The name of the patch group that should be registered with the patch baseline.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The name of the patch group and ID of the patch baseline separated by a comma (`,`).
diff --git a/website/docs/r/ssm_resource_data_sync.html.markdown b/website/docs/r/ssm_resource_data_sync.html.markdown
index ac805f40895..478cd8157f4 100644
--- a/website/docs/r/ssm_resource_data_sync.html.markdown
+++ b/website/docs/r/ssm_resource_data_sync.html.markdown
@@ -68,7 +68,7 @@ resource "aws_ssm_resource_data_sync" "foo" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) Name for the configuration.
 * `s3_destination` - (Required) Amazon S3 configuration details for the sync.
@@ -83,14 +83,23 @@ The following arguments are supported:
 * `prefix` - (Optional) Prefix for the bucket.
 * `sync_format` - (Optional) A supported sync format. Only JsonSerDe is currently supported. Defaults to JsonSerDe.
 
-## Attributes Reference
+## Attribute Reference
 
-No additional attributes are exported.
+This resource exports no additional attributes.
 
 ## Import
 
-SSM resource data sync can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SSM resource data sync using the `name`. For example:
 
-```sh
-$ terraform import aws_ssm_resource_data_sync.example example-name
+```terraform
+import {
+  to = aws_ssm_resource_data_sync.example
+  id = "example-name"
+}
+```
+
+Using `terraform import`, import SSM resource data sync using the `name`. For example:
+
+```console
+% terraform import aws_ssm_resource_data_sync.example example-name
 ```
diff --git a/website/docs/r/ssm_service_setting.html.markdown b/website/docs/r/ssm_service_setting.html.markdown
index 703c38370eb..090eb2e2fe1 100644
--- a/website/docs/r/ssm_service_setting.html.markdown
+++ b/website/docs/r/ssm_service_setting.html.markdown
@@ -21,22 +21,31 @@ resource "aws_ssm_service_setting" "test_setting" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `setting_id` - (Required) ID of the service setting.
 * `setting_value` - (Required) Value of the service setting.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the service setting.
 * `status` - Status of the service setting. Value can be `Default`, `Customized` or `PendingUpdate`.
 
 ## Import
 
-AWS SSM Service Setting can be imported using the `setting_id`, e.g.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AWS SSM Service Setting using the `setting_id`. For example:
 
-```sh
-$ terraform import aws_ssm_service_setting.example arn:aws:ssm:us-east-1:123456789012:servicesetting/ssm/parameter-store/high-throughput-enabled
+```terraform
+import {
+  to = aws_ssm_service_setting.example
+  id = "arn:aws:ssm:us-east-1:123456789012:servicesetting/ssm/parameter-store/high-throughput-enabled"
+}
+```
+
+Using `terraform import`, import AWS SSM Service Setting using the `setting_id`. For example:
+
+```console
+% terraform import aws_ssm_service_setting.example arn:aws:ssm:us-east-1:123456789012:servicesetting/ssm/parameter-store/high-throughput-enabled
 ```
diff --git a/website/docs/r/ssmcontacts_contact.html.markdown b/website/docs/r/ssmcontacts_contact.html.markdown
index cab55f11002..ddfad5fe5ae 100644
--- a/website/docs/r/ssmcontacts_contact.html.markdown
+++ b/website/docs/r/ssmcontacts_contact.html.markdown
@@ -45,20 +45,20 @@ resource "aws_ssmcontacts_contact" "example" {
 
 The following arguments are required:
 
-- `alias` - (Required) A unique and identifiable alias for the contact or escalation plan.
+- `alias` - (Required) A unique and identifiable alias for the contact or escalation plan. Must be between 1 and 255 characters, and may contain alphanumerics, underscores (`_`), and hyphens (`-`).
 
 - `type` - (Required) The type of contact engaged. A single contact is type PERSONAL and an escalation
   plan is type ESCALATION.
 
 The following arguments are optional:
 
-- `display_name` - (Optional) Full friendly name of the contact or escalation plan.
+- `display_name` - (Optional) Full friendly name of the contact or escalation plan. If set, must be between 1 and 255 characters, and may contain alphanumerics, underscores (`_`), hyphens (`-`), periods (`.`), and spaces.
 
 - `tags` - (Optional) Map of tags to assign to the resource.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 - `arn` - The Amazon Resource Name (ARN) of the contact or escalation plan.
 
@@ -66,8 +66,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Import SSM Contact using the `ARN`. For example:
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SSM Contact using the `ARN`. For example:
 
+```terraform
+import {
+  to = aws_ssmcontacts_contact.example
+  id = "{ARNValue}"
+}
 ```
-$ terraform import aws_ssmcontacts_contact.example {ARNValue}
+
+Using `terraform import`, import SSM Contact using the `ARN`. For example:
+
+```console
+% terraform import aws_ssmcontacts_contact.example {ARNValue}
 ```
diff --git a/website/docs/r/ssmcontacts_contact_channel.html.markdown b/website/docs/r/ssmcontacts_contact_channel.html.markdown
index bba36cba46d..03df5266b13 100644
--- a/website/docs/r/ssmcontacts_contact_channel.html.markdown
+++ b/website/docs/r/ssmcontacts_contact_channel.html.markdown
@@ -57,7 +57,7 @@ The following arguments are required:
 
 - `delivery_address` - (Required) Block that contains contact engagement details. See details below.
 
-- `name` - (Required) Name of the contact channel.
+- `name` - (Required) Name of the contact channel. Must be between 1 and 255 characters, and may contain alphanumerics, underscores (`_`), hyphens (`-`), periods (`.`), and spaces.
 
 - `type` - (Required) Type of the contact channel. One of `SMS`, `VOICE` or `EMAIL`.
 
@@ -65,9 +65,9 @@ The following arguments are required:
 
 - `simple_address` - (Required) Details to engage this contact channel. The expected format depends on the contact channel type and is described in the [`ContactChannelAddress` section of the SSM Contacts API Reference](https://docs.aws.amazon.com/incident-manager/latest/APIReference/API_SSMContacts_ContactChannelAddress.html).
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 - `activation_status` - Whether the contact channel is activated. The contact channel must be activated to use it to engage the contact. One of `ACTIVATED` or `NOT_ACTIVATED`.
 
@@ -75,8 +75,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Import SSM Contact Channel using the `ARN`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SSM Contact Channel using the `ARN`. For example:
 
+```terraform
+import {
+  to = aws_ssmcontacts_contact_channel.example
+  id = "arn:aws:ssm-contacts:us-west-2:123456789012:contact-channel/example"
+}
 ```
-$ terraform import aws_ssmcontacts_contact_channel.example arn:aws:ssm-contacts:us-west-2:123456789012:contact-channel/example
+
+Using `terraform import`, import SSM Contact Channel using the `ARN`. For example:
+
+```console
+% terraform import aws_ssmcontacts_contact_channel.example arn:aws:ssm-contacts:us-west-2:123456789012:contact-channel/example
 ```
diff --git a/website/docs/r/ssmcontacts_plan.html.markdown b/website/docs/r/ssmcontacts_plan.html.markdown
index dbd28e2cd21..825b3acd929 100644
--- a/website/docs/r/ssmcontacts_plan.html.markdown
+++ b/website/docs/r/ssmcontacts_plan.html.markdown
@@ -87,14 +87,23 @@ The following arguments are required:
 * `contact_id` - (Required) The Amazon Resource Name (ARN) of the contact or escalation plan.
 * `stage` - (Required) List of stages. A contact has an engagement plan with stages that contact specified contact channels. An escalation plan uses stages that contact specified contacts.
 
-## Attributes Reference
+## Attribute Reference
 
-No additional attributes are exported.
+This resource exports no additional attributes.
 
 ## Import
 
-Import SSM Contact Plan using the Contact ARN. For example:
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SSM Contact Plan using the Contact ARN. For example:
 
+```terraform
+import {
+  to = aws_ssmcontacts_plan.example
+  id = "{ARNValue}"
+}
 ```
-$ terraform import aws_ssmcontacts_plan.example {ARNValue}
+
+Using `terraform import`, import SSM Contact Plan using the Contact ARN. For example:
+
+```console
+% terraform import aws_ssmcontacts_plan.example {ARNValue}
 ```
diff --git a/website/docs/r/ssmincidents_replication_set.html.markdown b/website/docs/r/ssmincidents_replication_set.html.markdown
index 44139775374..a39d3a24527 100644
--- a/website/docs/r/ssmincidents_replication_set.html.markdown
+++ b/website/docs/r/ssmincidents_replication_set.html.markdown
@@ -97,9 +97,9 @@ The following arguments are optional:
 
 For information about the maximum allowed number of Regions and tag value constraints, see [CreateReplicationSet in the *AWS Systems Manager Incident Manager API Reference*](https://docs.aws.amazon.com/incident-manager/latest/APIReference/API_CreateReplicationSet.html).
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to the preceding arguments, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The ARN of the replication set.
 * `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
@@ -132,8 +132,17 @@ In addition to the preceding arguments, the `region` configuration block exports
 
 ## Import
 
-Use the following command to import an Incident Manager replication set:
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import an Incident Manager replication. For example:
 
+```terraform
+import {
+  to = aws_ssmincidents_replication_set.replicationSetName
+  id = "import"
+}
 ```
-$ terraform import aws_ssmincidents_replication_set.replicationSetName import
+
+Using `terraform import`, import an Incident Manager replication. For example:
+
+```console
+% terraform import aws_ssmincidents_replication_set.replicationSetName import
 ```
diff --git a/website/docs/r/ssmincidents_response_plan.html.markdown b/website/docs/r/ssmincidents_response_plan.html.markdown
index 36e62bc3486..1c067465aa7 100644
--- a/website/docs/r/ssmincidents_response_plan.html.markdown
+++ b/website/docs/r/ssmincidents_response_plan.html.markdown
@@ -147,17 +147,26 @@ The following arguments are optional:
 
 For more information about the constraints for each field, see [CreateResponsePlan](https://docs.aws.amazon.com/incident-manager/latest/APIReference/API_CreateResponsePlan.html) in the *AWS Systems Manager Incident Manager API Reference*.
   
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The ARN of the response plan.
 * `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
 
 ## Import
 
-To import an Incident Manager response plan, specify the response plan ARN. You can find the response plan ARN in the AWS Management Console. Use the following command to run the import operation:
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import an Incident Manager response plan using the response plan ARN. You can find the response plan ARN in the AWS Management Console. For example:
 
+```terraform
+import {
+  to = aws_ssmincidents_response_plan.responsePlanName
+  id = "ARNValue"
+}
 ```
-$ terraform import aws_ssmincidents_response_plan.responsePlanName ARNValue
+
+Using `terraform import`, import an Incident Manager response plan using the response plan ARN. You can find the response plan ARN in the AWS Management Console. For example:
+
+```console
+% terraform import aws_ssmincidents_response_plan.responsePlanName ARNValue
 ```
diff --git a/website/docs/r/ssoadmin_account_assignment.html.markdown b/website/docs/r/ssoadmin_account_assignment.html.markdown
index 4afd4e53ab9..663a25549ba 100644
--- a/website/docs/r/ssoadmin_account_assignment.html.markdown
+++ b/website/docs/r/ssoadmin_account_assignment.html.markdown
@@ -45,7 +45,7 @@ resource "aws_ssoadmin_account_assignment" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `instance_arn` - (Required, Forces new resource) The Amazon Resource Name (ARN) of the SSO Instance.
 * `permission_set_arn` - (Required, Forces new resource) The Amazon Resource Name (ARN) of the Permission Set that the admin wants to grant the principal access to.
@@ -54,16 +54,32 @@ The following arguments are supported:
 * `target_id` - (Required, Forces new resource) An AWS account identifier, typically a 10-12 digit string.
 * `target_type` - (Optional, Forces new resource) The entity type for which the assignment will be created. Valid values: `AWS_ACCOUNT`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The identifier of the Account Assignment i.e., `principal_id`, `principal_type`, `target_id`, `target_type`, `permission_set_arn`, `instance_arn` separated by commas (`,`).
 
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `5m`)
+- `delete` - (Default `5m`)
+
 ## Import
 
-SSO Account Assignments can be imported using the `principal_id`, `principal_type`, `target_id`, `target_type`, `permission_set_arn`, `instance_arn` separated by commas (`,`) e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SSO Account Assignments using the `principal_id`, `principal_type`, `target_id`, `target_type`, `permission_set_arn`, `instance_arn` separated by commas (`,`). For example:
 
+```terraform
+import {
+  to = aws_ssoadmin_account_assignment.example
+  id = "f81d4fae-7dec-11d0-a765-00a0c91e6bf6,GROUP,1234567890,AWS_ACCOUNT,arn:aws:sso:::permissionSet/ssoins-0123456789abcdef/ps-0123456789abcdef,arn:aws:sso:::instance/ssoins-0123456789abcdef"
+}
 ```
-$ terraform import aws_ssoadmin_account_assignment.example f81d4fae-7dec-11d0-a765-00a0c91e6bf6,GROUP,1234567890,AWS_ACCOUNT,arn:aws:sso:::permissionSet/ssoins-0123456789abcdef/ps-0123456789abcdef,arn:aws:sso:::instance/ssoins-0123456789abcdef
+
+Using `terraform import`, import SSO Account Assignments using the `principal_id`, `principal_type`, `target_id`, `target_type`, `permission_set_arn`, `instance_arn` separated by commas (`,`). For example:
+
+```console
+% terraform import aws_ssoadmin_account_assignment.example f81d4fae-7dec-11d0-a765-00a0c91e6bf6,GROUP,1234567890,AWS_ACCOUNT,arn:aws:sso:::permissionSet/ssoins-0123456789abcdef/ps-0123456789abcdef,arn:aws:sso:::instance/ssoins-0123456789abcdef
 ```
diff --git a/website/docs/r/ssoadmin_customer_managed_policy_attachment.html.markdown b/website/docs/r/ssoadmin_customer_managed_policy_attachment.html.markdown
index bcef4c19c91..52938d96791 100644
--- a/website/docs/r/ssoadmin_customer_managed_policy_attachment.html.markdown
+++ b/website/docs/r/ssoadmin_customer_managed_policy_attachment.html.markdown
@@ -51,7 +51,7 @@ resource "aws_ssoadmin_customer_managed_policy_attachment" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `instance_arn` - (Required, Forces new resource) The Amazon Resource Name (ARN) of the SSO Instance under which the operation will be executed.
 * `permission_set_arn` - (Required, Forces new resource) The Amazon Resource Name (ARN) of the Permission Set.
@@ -64,16 +64,32 @@ The `customer_managed_policy_reference` config block describes a customer manage
 * `name` - (Required, Forces new resource) Name of the customer managed IAM Policy to be attached.
 * `path` - (Optional, Forces new resource) The path to the IAM policy to be attached. The default is `/`. See [IAM Identifiers](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html#identifiers-friendly-names) for more information.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Policy Name, Policy Path, Permission Set Amazon Resource Name (ARN), and SSO Instance ARN, each separated by a comma (`,`).
 
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `10m`)
+- `delete` - (Default `10m`)
+
 ## Import
 
-SSO Managed Policy Attachments can be imported using the `name`, `path`, `permission_set_arn`, and `instance_arn` separated by a comma (`,`) e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SSO Managed Policy Attachments using the `name`, `path`, `permission_set_arn`, and `instance_arn` separated by a comma (`,`). For example:
 
+```terraform
+import {
+  to = aws_ssoadmin_customer_managed_policy_attachment.example
+  id = "TestPolicy,/,arn:aws:sso:::permissionSet/ssoins-2938j0x8920sbj72/ps-80383020jr9302rk,arn:aws:sso:::instance/ssoins-2938j0x8920sbj72"
+}
 ```
-$ terraform import aws_ssoadmin_customer_managed_policy_attachment.example TestPolicy,/,arn:aws:sso:::permissionSet/ssoins-2938j0x8920sbj72/ps-80383020jr9302rk,arn:aws:sso:::instance/ssoins-2938j0x8920sbj72
+
+Using `terraform import`, import SSO Managed Policy Attachments using the `name`, `path`, `permission_set_arn`, and `instance_arn` separated by a comma (`,`). For example:
+
+```console
+% terraform import aws_ssoadmin_customer_managed_policy_attachment.example TestPolicy,/,arn:aws:sso:::permissionSet/ssoins-2938j0x8920sbj72/ps-80383020jr9302rk,arn:aws:sso:::instance/ssoins-2938j0x8920sbj72
 ```
diff --git a/website/docs/r/ssoadmin_instance_access_control_attributes.html.markdown b/website/docs/r/ssoadmin_instance_access_control_attributes.html.markdown
index a220e4b469b..dbbd782e2a0 100644
--- a/website/docs/r/ssoadmin_instance_access_control_attributes.html.markdown
+++ b/website/docs/r/ssoadmin_instance_access_control_attributes.html.markdown
@@ -34,7 +34,7 @@ resource "aws_ssoadmin_instance_access_control_attributes" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `instance_arn` - (Required, Forces new resource) The Amazon Resource Name (ARN) of the SSO Instance.
 * `attribute` - (Required) See [AccessControlAttribute](#accesscontrolattribute) for more details.
@@ -48,16 +48,25 @@ The following arguments are supported:
 
 * `source` - (Required) The identity source to use when mapping a specified attribute to AWS SSO.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The identifier of the Instance Access Control Attribute `instance_arn`.
 
 ## Import
 
-SSO Account Assignments can be imported using the `instance_arn`
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SSO Account Assignments using the `instance_arn`. For example:
 
+```terraform
+import {
+  to = aws_ssoadmin_instance_access_control_attributes.example
+  id = "arn:aws:sso:::instance/ssoins-0123456789abcdef"
+}
 ```
-$ terraform import aws_ssoadmin_instance_access_control_attributes.example arn:aws:sso:::instance/ssoins-0123456789abcdef
+
+Using `terraform import`, import SSO Account Assignments using the `instance_arn`. For example:
+
+```console
+% terraform import aws_ssoadmin_instance_access_control_attributes.example arn:aws:sso:::instance/ssoins-0123456789abcdef
 ```
diff --git a/website/docs/r/ssoadmin_managed_policy_attachment.html.markdown b/website/docs/r/ssoadmin_managed_policy_attachment.html.markdown
index 19e55e857fa..5b8f75a6e5f 100644
--- a/website/docs/r/ssoadmin_managed_policy_attachment.html.markdown
+++ b/website/docs/r/ssoadmin_managed_policy_attachment.html.markdown
@@ -31,23 +31,39 @@ resource "aws_ssoadmin_managed_policy_attachment" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `instance_arn` - (Required, Forces new resource) The Amazon Resource Name (ARN) of the SSO Instance under which the operation will be executed.
 * `managed_policy_arn` - (Required, Forces new resource) The IAM managed policy Amazon Resource Name (ARN) to be attached to the Permission Set.
 * `permission_set_arn` - (Required, Forces new resource) The Amazon Resource Name (ARN) of the Permission Set.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The Amazon Resource Names (ARNs) of the Managed Policy, Permission Set, and SSO Instance, separated by a comma (`,`).
 * `managed_policy_name` - The name of the IAM Managed Policy.
 
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `10m`)
+- `delete` - (Default `10m`)
+
 ## Import
 
-SSO Managed Policy Attachments can be imported using the `managed_policy_arn`, `permission_set_arn`, and `instance_arn` separated by a comma (`,`) e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SSO Managed Policy Attachments using the `managed_policy_arn`, `permission_set_arn`, and `instance_arn` separated by a comma (`,`). For example:
 
+```terraform
+import {
+  to = aws_ssoadmin_managed_policy_attachment.example
+  id = "arn:aws:iam::aws:policy/AlexaForBusinessDeviceSetup,arn:aws:sso:::permissionSet/ssoins-2938j0x8920sbj72/ps-80383020jr9302rk,arn:aws:sso:::instance/ssoins-2938j0x8920sbj72"
+}
 ```
-$ terraform import aws_ssoadmin_managed_policy_attachment.example arn:aws:iam::aws:policy/AlexaForBusinessDeviceSetup,arn:aws:sso:::permissionSet/ssoins-2938j0x8920sbj72/ps-80383020jr9302rk,arn:aws:sso:::instance/ssoins-2938j0x8920sbj72
+
+Using `terraform import`, import SSO Managed Policy Attachments using the `managed_policy_arn`, `permission_set_arn`, and `instance_arn` separated by a comma (`,`). For example:
+
+```console
+% terraform import aws_ssoadmin_managed_policy_attachment.example arn:aws:iam::aws:policy/AlexaForBusinessDeviceSetup,arn:aws:sso:::permissionSet/ssoins-2938j0x8920sbj72/ps-80383020jr9302rk,arn:aws:sso:::instance/ssoins-2938j0x8920sbj72
 ```
diff --git a/website/docs/r/ssoadmin_permission_set.html.markdown b/website/docs/r/ssoadmin_permission_set.html.markdown
index 2810fa587d0..44ff66294dc 100644
--- a/website/docs/r/ssoadmin_permission_set.html.markdown
+++ b/website/docs/r/ssoadmin_permission_set.html.markdown
@@ -28,7 +28,7 @@ resource "aws_ssoadmin_permission_set" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `description` - (Optional) The description of the Permission Set.
 * `instance_arn` - (Required, Forces new resource) The Amazon Resource Name (ARN) of the SSO Instance under which the operation will be executed.
@@ -37,19 +37,34 @@ The following arguments are supported:
 * `session_duration` - (Optional) The length of time that the application user sessions are valid in the ISO-8601 standard. Default: `PT1H`.
 * `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The Amazon Resource Name (ARN) of the Permission Set.
 * `id` - The Amazon Resource Names (ARNs) of the Permission Set and SSO Instance, separated by a comma (`,`).
 * `created_date` - The date the Permission Set was created in [RFC3339 format](https://tools.ietf.org/html/rfc3339#section-5.8).
 * `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
 
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `update` - (Default `10m`)
+
 ## Import
 
-SSO Permission Sets can be imported using the `arn` and `instance_arn` separated by a comma (`,`) e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SSO Permission Sets using the `arn` and `instance_arn` separated by a comma (`,`). For example:
 
+```terraform
+import {
+  to = aws_ssoadmin_permission_set.example
+  id = "arn:aws:sso:::permissionSet/ssoins-2938j0x8920sbj72/ps-80383020jr9302rk,arn:aws:sso:::instance/ssoins-2938j0x8920sbj72"
+}
 ```
-$ terraform import aws_ssoadmin_permission_set.example arn:aws:sso:::permissionSet/ssoins-2938j0x8920sbj72/ps-80383020jr9302rk,arn:aws:sso:::instance/ssoins-2938j0x8920sbj72
+
+Using `terraform import`, import SSO Permission Sets using the `arn` and `instance_arn` separated by a comma (`,`). For example:
+
+```console
+% terraform import aws_ssoadmin_permission_set.example arn:aws:sso:::permissionSet/ssoins-2938j0x8920sbj72/ps-80383020jr9302rk,arn:aws:sso:::instance/ssoins-2938j0x8920sbj72
 ```
diff --git a/website/docs/r/ssoadmin_permission_set_inline_policy.html.markdown b/website/docs/r/ssoadmin_permission_set_inline_policy.html.markdown
index 3b347582328..b2a930d5f46 100644
--- a/website/docs/r/ssoadmin_permission_set_inline_policy.html.markdown
+++ b/website/docs/r/ssoadmin_permission_set_inline_policy.html.markdown
@@ -47,22 +47,38 @@ resource "aws_ssoadmin_permission_set_inline_policy" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `inline_policy` - (Required) The IAM inline policy to attach to a Permission Set.
 * `instance_arn` - (Required, Forces new resource) The Amazon Resource Name (ARN) of the SSO Instance under which the operation will be executed.
 * `permission_set_arn` - (Required, Forces new resource) The Amazon Resource Name (ARN) of the Permission Set.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The Amazon Resource Names (ARNs) of the Permission Set and SSO Instance, separated by a comma (`,`).
 
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `10m`)
+- `delete` - (Default `10m`)
+
 ## Import
 
-SSO Permission Set Inline Policies can be imported using the `permission_set_arn` and `instance_arn` separated by a comma (`,`) e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SSO Permission Set Inline Policies using the `permission_set_arn` and `instance_arn` separated by a comma (`,`). For example:
 
+```terraform
+import {
+  to = aws_ssoadmin_permission_set_inline_policy.example
+  id = "arn:aws:sso:::permissionSet/ssoins-2938j0x8920sbj72/ps-80383020jr9302rk,arn:aws:sso:::instance/ssoins-2938j0x8920sbj72"
+}
 ```
-$ terraform import aws_ssoadmin_permission_set_inline_policy.example arn:aws:sso:::permissionSet/ssoins-2938j0x8920sbj72/ps-80383020jr9302rk,arn:aws:sso:::instance/ssoins-2938j0x8920sbj72
+
+Using `terraform import`, import SSO Permission Set Inline Policies using the `permission_set_arn` and `instance_arn` separated by a comma (`,`). For example:
+
+```console
+% terraform import aws_ssoadmin_permission_set_inline_policy.example arn:aws:sso:::permissionSet/ssoins-2938j0x8920sbj72/ps-80383020jr9302rk,arn:aws:sso:::instance/ssoins-2938j0x8920sbj72
 ```
diff --git a/website/docs/r/ssoadmin_permissions_boundary_attachment.html.markdown b/website/docs/r/ssoadmin_permissions_boundary_attachment.html.markdown
index 20dd81f7581..539e468f7a3 100644
--- a/website/docs/r/ssoadmin_permissions_boundary_attachment.html.markdown
+++ b/website/docs/r/ssoadmin_permissions_boundary_attachment.html.markdown
@@ -87,16 +87,32 @@ The `customer_managed_policy_reference` config block describes a customer manage
 * `name` - (Required, Forces new resource) Name of the customer managed IAM Policy to be attached.
 * `path` - (Optional, Forces new resource) The path to the IAM policy to be attached. The default is `/`. See [IAM Identifiers](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html#identifiers-friendly-names) for more information.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Permission Set Amazon Resource Name (ARN) and SSO Instance ARN, separated by a comma (`,`).
 
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+- `create` - (Default `10m`)
+- `delete` - (Default `10m`)
+
 ## Import
 
-SSO Admin Permissions Boundary Attachments can be imported using the `permission_set_arn` and `instance_arn`, separated by a comma (`,`) e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SSO Admin Permissions Boundary Attachments using the `permission_set_arn` and `instance_arn`, separated by a comma (`,`). For example:
 
+```terraform
+import {
+  to = aws_ssoadmin_permissions_boundary_attachment.example
+  id = "arn:aws:sso:::permissionSet/ssoins-2938j0x8920sbj72/ps-80383020jr9302rk,arn:aws:sso:::instance/ssoins-2938j0x8920sbj72"
+}
 ```
-$ terraform import aws_ssoadmin_permissions_boundary_attachment.example arn:aws:sso:::permissionSet/ssoins-2938j0x8920sbj72/ps-80383020jr9302rk,arn:aws:sso:::instance/ssoins-2938j0x8920sbj72
+
+Using `terraform import`, import SSO Admin Permissions Boundary Attachments using the `permission_set_arn` and `instance_arn`, separated by a comma (`,`). For example:
+
+```console
+% terraform import aws_ssoadmin_permissions_boundary_attachment.example arn:aws:sso:::permissionSet/ssoins-2938j0x8920sbj72/ps-80383020jr9302rk,arn:aws:sso:::instance/ssoins-2938j0x8920sbj72
 ```
diff --git a/website/docs/r/storagegateway_cache.html.markdown b/website/docs/r/storagegateway_cache.html.markdown
index 92aad51dfe1..c3d9ba74aa5 100644
--- a/website/docs/r/storagegateway_cache.html.markdown
+++ b/website/docs/r/storagegateway_cache.html.markdown
@@ -23,21 +23,30 @@ resource "aws_storagegateway_cache" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `disk_id` - (Required) Local disk identifier. For example, `pci-0000:03:00.0-scsi-0:0:0:0`.
 * `gateway_arn` - (Required) The Amazon Resource Name (ARN) of the gateway.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Combined gateway Amazon Resource Name (ARN) and local disk identifier.
 
 ## Import
 
-`aws_storagegateway_cache` can be imported by using the gateway Amazon Resource Name (ARN) and local disk identifier separated with a colon (`:`), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_storagegateway_cache` using the gateway Amazon Resource Name (ARN) and local disk identifier separated with a colon (`:`). For example:
 
+```terraform
+import {
+  to = aws_storagegateway_cache.example
+  id = "arn:aws:storagegateway:us-east-1:123456789012:gateway/sgw-12345678:pci-0000:03:00.0-scsi-0:0:0:0"
+}
 ```
-$ terraform import aws_storagegateway_cache.example arn:aws:storagegateway:us-east-1:123456789012:gateway/sgw-12345678:pci-0000:03:00.0-scsi-0:0:0:0
+
+Using `terraform import`, import `aws_storagegateway_cache` using the gateway Amazon Resource Name (ARN) and local disk identifier separated with a colon (`:`). For example:
+
+```console
+% terraform import aws_storagegateway_cache.example arn:aws:storagegateway:us-east-1:123456789012:gateway/sgw-12345678:pci-0000:03:00.0-scsi-0:0:0:0
 ```
diff --git a/website/docs/r/storagegateway_cached_iscsi_volume.html.markdown b/website/docs/r/storagegateway_cached_iscsi_volume.html.markdown
index b2a6cfc8162..0d69381687f 100644
--- a/website/docs/r/storagegateway_cached_iscsi_volume.html.markdown
+++ b/website/docs/r/storagegateway_cached_iscsi_volume.html.markdown
@@ -55,7 +55,7 @@ resource "aws_storagegateway_cached_iscsi_volume" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `gateway_arn` - (Required) The Amazon Resource Name (ARN) of the gateway.
 * `network_interface_id` - (Required) The network interface of the gateway on which to expose the iSCSI target. Only IPv4 addresses are accepted.
@@ -67,9 +67,9 @@ The following arguments are supported:
 * `kms_key` - (Optional) The Amazon Resource Name (ARN) of the AWS KMS key used for Amazon S3 server side encryption. Is required when `kms_encrypted` is set.
 * `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Volume Amazon Resource Name (ARN), e.g., `arn:aws:storagegateway:us-east-1:123456789012:gateway/sgw-12345678/volume/vol-12345678`.
 * `chap_enabled` - Whether mutual CHAP is enabled for the iSCSI target.
@@ -83,8 +83,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_storagegateway_cached_iscsi_volume` can be imported by using the volume Amazon Resource Name (ARN), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_storagegateway_cached_iscsi_volume` using the volume Amazon Resource Name (ARN). For example:
 
+```terraform
+import {
+  to = aws_storagegateway_cached_iscsi_volume.example
+  id = "arn:aws:storagegateway:us-east-1:123456789012:gateway/sgw-12345678/volume/vol-12345678"
+}
 ```
-$ terraform import aws_storagegateway_cached_iscsi_volume.example arn:aws:storagegateway:us-east-1:123456789012:gateway/sgw-12345678/volume/vol-12345678
+
+Using `terraform import`, import `aws_storagegateway_cached_iscsi_volume` using the volume Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_storagegateway_cached_iscsi_volume.example arn:aws:storagegateway:us-east-1:123456789012:gateway/sgw-12345678/volume/vol-12345678
 ```
diff --git a/website/docs/r/storagegateway_file_system_association.html.markdown b/website/docs/r/storagegateway_file_system_association.html.markdown
index 0172b6b35fc..c989e19cc41 100644
--- a/website/docs/r/storagegateway_file_system_association.html.markdown
+++ b/website/docs/r/storagegateway_file_system_association.html.markdown
@@ -80,7 +80,7 @@ resource "aws_storagegateway_file_system_association" "fsx" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `gateway_arn` - (Required) The Amazon Resource Name (ARN) of the gateway.
 * `location_arn` - (Required) The Amazon Resource Name (ARN) of the Amazon FSx file system to associate with the FSx File Gateway.
@@ -96,9 +96,9 @@ The following arguments are supported:
  TTL is the length of time since the last refresh after which access to the directory would cause the file gateway
   to first refresh that directory's contents from the Amazon S3 bucket. Valid Values: `0` or `300` to `2592000` seconds (5 minutes to 30 days). Defaults to `0`
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Amazon Resource Name (ARN) of the FSx file system association
 * `arn` - Amazon Resource Name (ARN) of the newly created file system association.
@@ -106,8 +106,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_storagegateway_file_system_association` can be imported by using the FSx file system association Amazon Resource Name (ARN), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_storagegateway_file_system_association` using the FSx file system association Amazon Resource Name (ARN). For example:
 
+```terraform
+import {
+  to = aws_storagegateway_file_system_association.example
+  id = "arn:aws:storagegateway:us-east-1:123456789012:fs-association/fsa-0DA347732FDB40125"
+}
 ```
-$ terraform import aws_storagegateway_file_system_association.example arn:aws:storagegateway:us-east-1:123456789012:fs-association/fsa-0DA347732FDB40125
+
+Using `terraform import`, import `aws_storagegateway_file_system_association` using the FSx file system association Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_storagegateway_file_system_association.example arn:aws:storagegateway:us-east-1:123456789012:fs-association/fsa-0DA347732FDB40125
 ```
diff --git a/website/docs/r/storagegateway_gateway.html.markdown b/website/docs/r/storagegateway_gateway.html.markdown
index 632095dd28e..245719996cf 100644
--- a/website/docs/r/storagegateway_gateway.html.markdown
+++ b/website/docs/r/storagegateway_gateway.html.markdown
@@ -100,7 +100,7 @@ resource "aws_storagegateway_gateway" "example" {
 
 ~> **NOTE:** One of `activation_key` or `gateway_ip_address` must be provided for resource creation (gateway activation). Neither is required for resource import. If using `gateway_ip_address`, Terraform must be able to make an HTTP (port 80) GET request to the specified IP address from where it is running.
 
-The following arguments are supported:
+This argument supports the following arguments:
 
 * `gateway_name` - (Required) Name of the gateway.
 * `gateway_timezone` - (Required) Time zone for the gateway. The time zone is of the format "GMT", "GMT-hr:mm", or "GMT+hr:mm". For example, `GMT-4:00` indicates the time is 4 hours behind GMT. The time zone is used, for example, for scheduling snapshots and your gateway's maintenance schedule.
@@ -144,9 +144,9 @@ Information to join the gateway to an Active Directory domain for Server Message
 * `domain_controllers` - (Optional) List of IPv4 addresses, NetBIOS names, or host names of your domain server.
  If you need to specify the port number include it after the colon (“:”). For example, `mydc.mydomain.com:389`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Amazon Resource Name (ARN) of the gateway.
 * `arn` - Amazon Resource Name (ARN) of the gateway.
@@ -169,13 +169,22 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_storagegateway_gateway` can be imported by using the gateway Amazon Resource Name (ARN), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_storagegateway_gateway` using the gateway Amazon Resource Name (ARN). For example:
 
+```terraform
+import {
+  to = aws_storagegateway_gateway.example
+  id = "arn:aws:storagegateway:us-east-1:123456789012:gateway/sgw-12345678"
+}
 ```
-$ terraform import aws_storagegateway_gateway.example arn:aws:storagegateway:us-east-1:123456789012:gateway/sgw-12345678
+
+Using `terraform import`, import `aws_storagegateway_gateway` using the gateway Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_storagegateway_gateway.example arn:aws:storagegateway:us-east-1:123456789012:gateway/sgw-12345678
 ```
 
-Certain resource arguments, like `gateway_ip_address` do not have a Storage Gateway API method for reading the information after creation, either omit the argument from the Terraform configuration or use [`ignore_changes`](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html#ignore_changes) to hide the difference, e.g.,
+Certain resource arguments, like `gateway_ip_address` do not have a Storage Gateway API method for reading the information after creation, either omit the argument from the Terraform configuration or use [`ignore_changes`](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html#ignore_changes) to hide the difference. For example:
 
 ```terraform
 resource "aws_storagegateway_gateway" "example" {
diff --git a/website/docs/r/storagegateway_nfs_file_share.html.markdown b/website/docs/r/storagegateway_nfs_file_share.html.markdown
index 1f580082cbb..dbe19eed01f 100644
--- a/website/docs/r/storagegateway_nfs_file_share.html.markdown
+++ b/website/docs/r/storagegateway_nfs_file_share.html.markdown
@@ -23,7 +23,7 @@ resource "aws_storagegateway_nfs_file_share" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `client_list` - (Required) The list of clients that are allowed to access the file gateway. The list must contain either valid IP addresses or valid CIDR blocks. Set to `["0.0.0.0/0"]` to not limit access. Minimum 1 item. Maximum 100 items.
 * `gateway_arn` - (Required) Amazon Resource Name (ARN) of the file gateway.
@@ -61,9 +61,9 @@ Files and folders stored as Amazon S3 objects in S3 buckets don't, by default, h
  TTL is the length of time since the last refresh after which access to the directory would cause the file gateway
   to first refresh that directory's contents from the Amazon S3 bucket. Valid Values: 300 to 2,592,000 seconds (5 minutes to 30 days)
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Amazon Resource Name (ARN) of the NFS File Share.
 * `arn` - Amazon Resource Name (ARN) of the NFS File Share.
@@ -81,8 +81,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_storagegateway_nfs_file_share` can be imported by using the NFS File Share Amazon Resource Name (ARN), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_storagegateway_nfs_file_share` using the NFS File Share Amazon Resource Name (ARN). For example:
 
+```terraform
+import {
+  to = aws_storagegateway_nfs_file_share.example
+  id = "arn:aws:storagegateway:us-east-1:123456789012:share/share-12345678"
+}
 ```
-$ terraform import aws_storagegateway_nfs_file_share.example arn:aws:storagegateway:us-east-1:123456789012:share/share-12345678
+
+Using `terraform import`, import `aws_storagegateway_nfs_file_share` using the NFS File Share Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_storagegateway_nfs_file_share.example arn:aws:storagegateway:us-east-1:123456789012:share/share-12345678
 ```
diff --git a/website/docs/r/storagegateway_smb_file_share.html.markdown b/website/docs/r/storagegateway_smb_file_share.html.markdown
index 1c6a14b8cef..9853f16d786 100644
--- a/website/docs/r/storagegateway_smb_file_share.html.markdown
+++ b/website/docs/r/storagegateway_smb_file_share.html.markdown
@@ -40,7 +40,7 @@ resource "aws_storagegateway_smb_file_share" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `gateway_arn` - (Required) Amazon Resource Name (ARN) of the file gateway.
 * `location_arn` - (Required) The ARN of the backed storage used for storing file data.
@@ -74,9 +74,9 @@ The following arguments are supported:
  TTL is the length of time since the last refresh after which access to the directory would cause the file gateway
   to first refresh that directory's contents from the Amazon S3 bucket. Valid Values: 300 to 2,592,000 seconds (5 minutes to 30 days)
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Amazon Resource Name (ARN) of the SMB File Share.
 * `arn` - Amazon Resource Name (ARN) of the SMB File Share.
@@ -94,8 +94,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_storagegateway_smb_file_share` can be imported by using the SMB File Share Amazon Resource Name (ARN), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_storagegateway_smb_file_share` using the SMB File Share Amazon Resource Name (ARN). For example:
 
+```terraform
+import {
+  to = aws_storagegateway_smb_file_share.example
+  id = "arn:aws:storagegateway:us-east-1:123456789012:share/share-12345678"
+}
 ```
-$ terraform import aws_storagegateway_smb_file_share.example arn:aws:storagegateway:us-east-1:123456789012:share/share-12345678
+
+Using `terraform import`, import `aws_storagegateway_smb_file_share` using the SMB File Share Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_storagegateway_smb_file_share.example arn:aws:storagegateway:us-east-1:123456789012:share/share-12345678
 ```
diff --git a/website/docs/r/storagegateway_stored_iscsi_volume.html.markdown b/website/docs/r/storagegateway_stored_iscsi_volume.html.markdown
index c12b22923ba..b930d755ff6 100644
--- a/website/docs/r/storagegateway_stored_iscsi_volume.html.markdown
+++ b/website/docs/r/storagegateway_stored_iscsi_volume.html.markdown
@@ -41,7 +41,7 @@ resource "aws_storagegateway_stored_iscsi_volume" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `gateway_arn` - (Required) The Amazon Resource Name (ARN) of the gateway.
 * `network_interface_id` - (Required) The network interface of the gateway on which to expose the iSCSI target. Only IPv4 addresses are accepted.
@@ -53,9 +53,9 @@ The following arguments are supported:
 * `kms_key` - (Optional) The Amazon Resource Name (ARN) of the AWS KMS key used for Amazon S3 server side encryption. This value can only be set when `kms_encrypted` is `true`.
 * `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Volume Amazon Resource Name (ARN), e.g., `arn:aws:storagegateway:us-east-1:123456789012:gateway/sgw-12345678/volume/vol-12345678`.
 * `chap_enabled` - Whether mutual CHAP is enabled for the iSCSI target.
@@ -73,8 +73,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_storagegateway_stored_iscsi_volume` can be imported by using the volume Amazon Resource Name (ARN), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_storagegateway_stored_iscsi_volume` using the volume Amazon Resource Name (ARN). For example:
 
+```terraform
+import {
+  to = aws_storagegateway_stored_iscsi_volume.example
+  id = "arn:aws:storagegateway:us-east-1:123456789012:gateway/sgw-12345678/volume/vol-12345678"
+}
 ```
-$ terraform import aws_storagegateway_stored_iscsi_volume.example arn:aws:storagegateway:us-east-1:123456789012:gateway/sgw-12345678/volume/vol-12345678
+
+Using `terraform import`, import `aws_storagegateway_stored_iscsi_volume` using the volume Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_storagegateway_stored_iscsi_volume.example arn:aws:storagegateway:us-east-1:123456789012:gateway/sgw-12345678/volume/vol-12345678
 ```
diff --git a/website/docs/r/storagegateway_tape_pool.html.markdown b/website/docs/r/storagegateway_tape_pool.html.markdown
index 1d6cc6632c4..53945871ee8 100644
--- a/website/docs/r/storagegateway_tape_pool.html.markdown
+++ b/website/docs/r/storagegateway_tape_pool.html.markdown
@@ -21,7 +21,7 @@ resource "aws_storagegateway_tape_pool" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `pool_name` - (Required) The name of the new custom tape pool.
 * `storage_class` - (Required) The storage class that is associated with the new custom pool. When you use your backup application to eject the tape, the tape is archived directly into the storage class that corresponds to the pool. Possible values are `DEEP_ARCHIVE` or `GLACIER`.
@@ -29,17 +29,26 @@ The following arguments are supported:
 * `retention_lock_time_in_days` - (Optional) Tape retention lock time is set in days. Tape retention lock can be enabled for up to 100 years (36,500 days). Default value is 0.
 * `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Volume Amazon Resource Name (ARN), e.g., `aws_storagegateway_tape_pool.example arn:aws:storagegateway:us-east-1:123456789012:tapepool/pool-12345678`.
 * `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
 
 ## Import
 
-`aws_storagegateway_tape_pool` can be imported by using the volume Amazon Resource Name (ARN), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_storagegateway_tape_pool` using the volume Amazon Resource Name (ARN). For example:
 
+```terraform
+import {
+  to = aws_storagegateway_tape_pool.example
+  id = "arn:aws:storagegateway:us-east-1:123456789012:tapepool/pool-12345678"
+}
 ```
-$ terraform import aws_storagegateway_tape_pool.example arn:aws:storagegateway:us-east-1:123456789012:tapepool/pool-12345678
+
+Using `terraform import`, import `aws_storagegateway_tape_pool` using the volume Amazon Resource Name (ARN). For example:
+
+```console
+% terraform import aws_storagegateway_tape_pool.example arn:aws:storagegateway:us-east-1:123456789012:tapepool/pool-12345678
 ```
diff --git a/website/docs/r/storagegateway_upload_buffer.html.markdown b/website/docs/r/storagegateway_upload_buffer.html.markdown
index 61ab9ed3fdc..a9612b346e1 100644
--- a/website/docs/r/storagegateway_upload_buffer.html.markdown
+++ b/website/docs/r/storagegateway_upload_buffer.html.markdown
@@ -44,22 +44,31 @@ resource "aws_storagegateway_upload_buffer" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `disk_id` - (Optional) Local disk identifier. For example, `pci-0000:03:00.0-scsi-0:0:0:0`.
 * `disk_path` - (Optional) Local disk path. For example, `/dev/nvme1n1`.
 * `gateway_arn` - (Required) The Amazon Resource Name (ARN) of the gateway.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Combined gateway Amazon Resource Name (ARN) and local disk identifier.
 
 ## Import
 
-`aws_storagegateway_upload_buffer` can be imported by using the gateway Amazon Resource Name (ARN) and local disk identifier separated with a colon (`:`), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_storagegateway_upload_buffer` using the gateway Amazon Resource Name (ARN) and local disk identifier separated with a colon (`:`). For example:
 
+```terraform
+import {
+  to = aws_storagegateway_upload_buffer.example
+  id = "arn:aws:storagegateway:us-east-1:123456789012:gateway/sgw-12345678:pci-0000:03:00.0-scsi-0:0:0:0"
+}
 ```
-$ terraform import aws_storagegateway_upload_buffer.example arn:aws:storagegateway:us-east-1:123456789012:gateway/sgw-12345678:pci-0000:03:00.0-scsi-0:0:0:0
+
+Using `terraform import`, import `aws_storagegateway_upload_buffer` using the gateway Amazon Resource Name (ARN) and local disk identifier separated with a colon (`:`). For example:
+
+```console
+% terraform import aws_storagegateway_upload_buffer.example arn:aws:storagegateway:us-east-1:123456789012:gateway/sgw-12345678:pci-0000:03:00.0-scsi-0:0:0:0
 ```
diff --git a/website/docs/r/storagegateway_working_storage.html.markdown b/website/docs/r/storagegateway_working_storage.html.markdown
index 115bfc28aad..f29c5730743 100644
--- a/website/docs/r/storagegateway_working_storage.html.markdown
+++ b/website/docs/r/storagegateway_working_storage.html.markdown
@@ -23,21 +23,30 @@ resource "aws_storagegateway_working_storage" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `disk_id` - (Required) Local disk identifier. For example, `pci-0000:03:00.0-scsi-0:0:0:0`.
 * `gateway_arn` - (Required) The Amazon Resource Name (ARN) of the gateway.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Combined gateway Amazon Resource Name (ARN) and local disk identifier.
 
 ## Import
 
-`aws_storagegateway_working_storage` can be imported by using the gateway Amazon Resource Name (ARN) and local disk identifier separated with a colon (`:`), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_storagegateway_working_storage` using the gateway Amazon Resource Name (ARN) and local disk identifier separated with a colon (`:`). For example:
 
+```terraform
+import {
+  to = aws_storagegateway_working_storage.example
+  id = "arn:aws:storagegateway:us-east-1:123456789012:gateway/sgw-12345678:pci-0000:03:00.0-scsi-0:0:0:0"
+}
 ```
-$ terraform import aws_storagegateway_working_storage.example arn:aws:storagegateway:us-east-1:123456789012:gateway/sgw-12345678:pci-0000:03:00.0-scsi-0:0:0:0
+
+Using `terraform import`, import `aws_storagegateway_working_storage` using the gateway Amazon Resource Name (ARN) and local disk identifier separated with a colon (`:`). For example:
+
+```console
+% terraform import aws_storagegateway_working_storage.example arn:aws:storagegateway:us-east-1:123456789012:gateway/sgw-12345678:pci-0000:03:00.0-scsi-0:0:0:0
 ```
diff --git a/website/docs/r/subnet.html.markdown b/website/docs/r/subnet.html.markdown
index 1628c2b3662..396c81dc157 100644
--- a/website/docs/r/subnet.html.markdown
+++ b/website/docs/r/subnet.html.markdown
@@ -35,18 +35,18 @@ resource, it is recommended to reference that resource's `vpc_id` attribute to e
 ```terraform
 resource "aws_vpc_ipv4_cidr_block_association" "secondary_cidr" {
   vpc_id     = aws_vpc.main.id
-  cidr_block = "172.2.0.0/16"
+  cidr_block = "172.20.0.0/16"
 }
 
 resource "aws_subnet" "in_secondary_cidr" {
   vpc_id     = aws_vpc_ipv4_cidr_block_association.secondary_cidr.vpc_id
-  cidr_block = "172.2.0.0/24"
+  cidr_block = "172.20.0.0/24"
 }
 ```
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `assign_ipv6_address_on_creation` - (Optional) Specify true to indicate
     that network interfaces created in the specified subnet should be
@@ -71,9 +71,9 @@ The following arguments are supported:
 * `vpc_id` - (Required) The VPC ID.
 * `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the subnet
 * `arn` - The ARN of the subnet.
@@ -90,8 +90,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Subnets can be imported using the `subnet id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import subnets using the subnet `id`. For example:
 
+```terraform
+import {
+  to = aws_subnet.public_subnet
+  id = "subnet-9d4a7b6c"
+}
 ```
-$ terraform import aws_subnet.public_subnet subnet-9d4a7b6c
+
+Using `terraform import`, import subnets using the subnet `id`. For example:
+
+```console
+% terraform import aws_subnet.public_subnet subnet-9d4a7b6c
 ```
diff --git a/website/docs/r/swf_domain.html.markdown b/website/docs/r/swf_domain.html.markdown
index ef4bb05d71e..aca48bc1e2c 100644
--- a/website/docs/r/swf_domain.html.markdown
+++ b/website/docs/r/swf_domain.html.markdown
@@ -24,7 +24,7 @@ resource "aws_swf_domain" "foo" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Optional, Forces new resource) The name of the domain. If omitted, Terraform will assign a random, unique name.
 * `name_prefix` - (Optional, Forces new resource) Creates a unique name beginning with the specified prefix. Conflicts with `name`.
@@ -32,9 +32,9 @@ The following arguments are supported:
 * `workflow_execution_retention_period_in_days` - (Required, Forces new resource) Length of time that SWF will continue to retain information about the workflow execution after the workflow execution is complete, must be between 0 and 90 days.
 * `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The name of the domain.
 * `arn` - Amazon Resource Name (ARN)
@@ -42,8 +42,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-SWF Domains can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import SWF Domains using the `name`. For example:
 
+```terraform
+import {
+  to = aws_swf_domain.foo
+  id = "test-domain"
+}
 ```
-$ terraform import aws_swf_domain.foo test-domain
+
+Using `terraform import`, import SWF Domains using the `name`. For example:
+
+```console
+% terraform import aws_swf_domain.foo test-domain
 ```
diff --git a/website/docs/r/synthetics_canary.html.markdown b/website/docs/r/synthetics_canary.html.markdown
index 121a4d8bb79..5f3a0971d2c 100644
--- a/website/docs/r/synthetics_canary.html.markdown
+++ b/website/docs/r/synthetics_canary.html.markdown
@@ -83,9 +83,9 @@ If this canary tests an endpoint in a VPC, this structure contains information a
 * `subnet_ids` - (Required) IDs of the subnets where this canary is to run.
 * `security_group_ids` - (Required) IDs of the security groups for this canary.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name (ARN) of the Canary.
 * `engine_arn` - ARN of the Lambda function that is used as your canary's engine.
@@ -108,8 +108,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Synthetics Canaries can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Synthetics Canaries using the `name`. For example:
 
+```terraform
+import {
+  to = aws_synthetics_canary.some
+  id = "some-canary"
+}
 ```
-$ terraform import aws_synthetics_canary.some some-canary
+
+Using `terraform import`, import Synthetics Canaries using the `name`. For example:
+
+```console
+% terraform import aws_synthetics_canary.some some-canary
 ```
diff --git a/website/docs/r/synthetics_group.html.markdown b/website/docs/r/synthetics_group.html.markdown
index 1e2b57f02f9..af84576e681 100644
--- a/website/docs/r/synthetics_group.html.markdown
+++ b/website/docs/r/synthetics_group.html.markdown
@@ -30,9 +30,9 @@ The following arguments are optional:
 
 * `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the Group.
 * `group_id` - ID of the Group.
@@ -40,8 +40,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-CloudWatch Synthetics Group can be imported using the `name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudWatch Synthetics Group using the `name`. For example:
 
+```terraform
+import {
+  to = aws_synthetics_group.example
+  id = "example"
+}
 ```
-$ terraform import aws_synthetics_group.example example
+
+Using `terraform import`, import CloudWatch Synthetics Group using the `name`. For example:
+
+```console
+% terraform import aws_synthetics_group.example example
 ```
diff --git a/website/docs/r/synthetics_group_association.html.markdown b/website/docs/r/synthetics_group_association.html.markdown
index 8d14f8dc924..2030795a8a0 100644
--- a/website/docs/r/synthetics_group_association.html.markdown
+++ b/website/docs/r/synthetics_group_association.html.markdown
@@ -28,17 +28,26 @@ The following arguments are required:
 * `group_name` - (Required) Name of the group that the canary will be associated with.
 * `canary_arn` - (Required) ARN of the canary.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `group_name` - Name of the Group.
 * `group_id` - ID of the Group.
 
 ## Import
 
-CloudWatch Synthetics Group Association can be imported in the form `canary_arn,group_name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import CloudWatch Synthetics Group Association using the `canary_arn,group_name`. For example:
 
+```terraform
+import {
+  to = aws_synthetics_group_association.example
+  id = "arn:aws:synthetics:us-west-2:123456789012:canary:tf-acc-test-abcd1234,examplename"
+}
 ```
-$ terraform import aws_synthetics_group_association.example arn:aws:synthetics:us-west-2:123456789012:canary:tf-acc-test-abcd1234,examplename
+
+Using `terraform import`, import CloudWatch Synthetics Group Association using the `canary_arn,group_name`. For example:
+
+```console
+% terraform import aws_synthetics_group_association.example arn:aws:synthetics:us-west-2:123456789012:canary:tf-acc-test-abcd1234,examplename
 ```
diff --git a/website/docs/r/timestreamwrite_database.html.markdown b/website/docs/r/timestreamwrite_database.html.markdown
index 33d0878e9a7..05d1774e7e9 100644
--- a/website/docs/r/timestreamwrite_database.html.markdown
+++ b/website/docs/r/timestreamwrite_database.html.markdown
@@ -35,15 +35,15 @@ resource "aws_timestreamwrite_database" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `database_name` – (Required) The name of the Timestream database. Minimum length of 3. Maximum length of 64.
 * `kms_key_id` - (Optional) The ARN (not Alias ARN) of the KMS key to be used to encrypt the data stored in the database. If the KMS key is not specified, the database will be encrypted with a Timestream managed KMS key located in your account. Refer to [AWS managed KMS keys](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk) for more info.
 * `tags` - (Optional) Map of tags to assign to this resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The name of the Timestream database.
 * `arn` - The ARN that uniquely identifies this database.
@@ -53,8 +53,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Timestream databases can be imported using the `database_name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Timestream databases using the `database_name`. For example:
 
+```terraform
+import {
+  to = aws_timestreamwrite_database.example
+  id = "example"
+}
 ```
-$ terraform import aws_timestreamwrite_database.example example
+
+Using `terraform import`, import Timestream databases using the `database_name`. For example:
+
+```console
+% terraform import aws_timestreamwrite_database.example example
 ```
diff --git a/website/docs/r/timestreamwrite_table.html.markdown b/website/docs/r/timestreamwrite_table.html.markdown
index ce0535bba81..ac5a09673b3 100644
--- a/website/docs/r/timestreamwrite_table.html.markdown
+++ b/website/docs/r/timestreamwrite_table.html.markdown
@@ -39,13 +39,31 @@ resource "aws_timestreamwrite_table" "example" {
 }
 ```
 
+### Customer-defined Partition Key
+
+```hcl
+resource "aws_timestreamwrite_table" "example" {
+  database_name = aws_timestreamwrite_database.example.database_name
+  table_name    = "example"
+
+  schema {
+    composite_partition_key {
+      enforcement_in_record = "REQUIRED"
+      name                  = "attr1"
+      type                  = "DIMENSION"
+    }
+  }
+}
+```
+
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `database_name` – (Required) The name of the Timestream database.
 * `magnetic_store_write_properties` - (Optional) Contains properties to set on the table when enabling magnetic store writes. See [Magnetic Store Write Properties](#magnetic-store-write-properties) below for more details.
 * `retention_properties` - (Optional) The retention duration for the memory store and magnetic store. See [Retention Properties](#retention-properties) below for more details. If not provided, `magnetic_store_retention_period_in_days` default to 73000 and `memory_store_retention_period_in_hours` defaults to 6.
+* `schema` - (Optional) The schema of the table. See [Schema](#schema) below for more details.
 * `table_name` - (Required) The name of the Timestream table.
 * `tags` - (Optional) Map of tags to assign to this resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
@@ -78,9 +96,23 @@ The `retention_properties` block supports the following arguments:
 * `magnetic_store_retention_period_in_days` - (Required) The duration for which data must be stored in the magnetic store. Minimum value of 1. Maximum value of 73000.
 * `memory_store_retention_period_in_hours` - (Required) The duration for which data must be stored in the memory store. Minimum value of 1. Maximum value of 8766.
 
-## Attributes Reference
+### Schema
 
-In addition to all arguments above, the following attributes are exported:
+The `schema` block supports the following arguments:
+
+* `composite_partition_key` - (Required) A non-empty list of partition keys defining the attributes used to partition the table data. The order of the list determines the partition hierarchy. The name and type of each partition key as well as the partition key order cannot be changed after the table is created. However, the enforcement level of each partition key can be changed. See [Composite Partition Key](#composite-partition-key) below for more details.
+
+### Composite Partition Key
+
+The `composite_partition_key` block supports the following arguments:
+
+* `enforcement_in_record` - (Optional) The level of enforcement for the specification of a dimension key in ingested records. Valid values: `REQUIRED`, `OPTIONAL`.
+* `name` - (Optional) The name of the attribute used for a dimension key.
+* `type` - (Required) The type of the partition key. Valid values: `DIMENSION`, `MEASURE`.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The `table_name` and `database_name` separated by a colon (`:`).
 * `arn` - The ARN that uniquely identifies this table.
@@ -88,8 +120,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Timestream tables can be imported using the `table_name` and `database_name` separate by a colon (`:`), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Timestream tables using the `table_name` and `database_name` separate by a colon (`:`). For example:
 
+```terraform
+import {
+  to = aws_timestreamwrite_table.example
+  id = "ExampleTable:ExampleDatabase"
+}
 ```
-$ terraform import aws_timestreamwrite_table.example ExampleTable:ExampleDatabase
+
+Using `terraform import`, import Timestream tables using the `table_name` and `database_name` separate by a colon (`:`). For example:
+
+```console
+% terraform import aws_timestreamwrite_table.example ExampleTable:ExampleDatabase
 ```
diff --git a/website/docs/r/transcribe_language_model.html.markdown b/website/docs/r/transcribe_language_model.html.markdown
index aa1a2613b12..cb72b28d2f3 100644
--- a/website/docs/r/transcribe_language_model.html.markdown
+++ b/website/docs/r/transcribe_language_model.html.markdown
@@ -99,9 +99,9 @@ The following arguments are optional:
 
 * `tags` - (Optional) A map of tags to assign to the LanguageModel. If configured with a provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - LanguageModel name.
 * `arn` - ARN of the LanguageModel.
@@ -114,8 +114,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Transcribe LanguageModel can be imported using the `model_name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Transcribe LanguageModel using the `model_name`. For example:
 
+```terraform
+import {
+  to = aws_transcribe_language_model.example
+  id = "example-name"
+}
 ```
-$ terraform import aws_transcribe_language_model.example example-name
+
+Using `terraform import`, import Transcribe LanguageModel using the `model_name`. For example:
+
+```console
+% terraform import aws_transcribe_language_model.example example-name
 ```
diff --git a/website/docs/r/transcribe_medical_vocabulary.html.markdown b/website/docs/r/transcribe_medical_vocabulary.html.markdown
index e50cd3400e3..12e1150b88f 100644
--- a/website/docs/r/transcribe_medical_vocabulary.html.markdown
+++ b/website/docs/r/transcribe_medical_vocabulary.html.markdown
@@ -54,9 +54,9 @@ The following arguments are optional:
 
 * `tags` - (Optional) A map of tags to assign to the MedicalVocabulary. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Name of the MedicalVocabulary.
 * `arn` - ARN of the MedicalVocabulary.
@@ -72,8 +72,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Transcribe MedicalVocabulary can be imported using the `vocabulary_name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Transcribe MedicalVocabulary using the `vocabulary_name`. For example:
 
+```terraform
+import {
+  to = aws_transcribe_medical_vocabulary.example
+  id = "example-name"
+}
 ```
-$ terraform import aws_transcribe_medical_vocabulary.example example-name
+
+Using `terraform import`, import Transcribe MedicalVocabulary using the `vocabulary_name`. For example:
+
+```console
+% terraform import aws_transcribe_medical_vocabulary.example example-name
 ```
diff --git a/website/docs/r/transcribe_vocabulary.html.markdown b/website/docs/r/transcribe_vocabulary.html.markdown
index c91998eba5a..c76d32994da 100644
--- a/website/docs/r/transcribe_vocabulary.html.markdown
+++ b/website/docs/r/transcribe_vocabulary.html.markdown
@@ -56,9 +56,9 @@ The following arguments are optional:
 * `vocabulary_file_uri` - (Optional) The Amazon S3 location (URI) of the text file that contains your custom vocabulary. Conflicts wth `phrases`.
 * `tags` - (Optional) A map of tags to assign to the Vocabulary. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Name of the Vocabulary.
 * `arn` - ARN of the Vocabulary.
@@ -74,8 +74,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Transcribe Vocabulary can be imported using the `vocabulary_name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Transcribe Vocabulary using the `vocabulary_name`. For example:
 
+```terraform
+import {
+  to = aws_transcribe_vocabulary.example
+  id = "example-name"
+}
 ```
-$ terraform import aws_transcribe_vocabulary.example example-name
+
+Using `terraform import`, import Transcribe Vocabulary using the `vocabulary_name`. For example:
+
+```console
+% terraform import aws_transcribe_vocabulary.example example-name
 ```
diff --git a/website/docs/r/transcribe_vocabulary_filter.html.markdown b/website/docs/r/transcribe_vocabulary_filter.html.markdown
index 098fb12b834..4555653fe80 100644
--- a/website/docs/r/transcribe_vocabulary_filter.html.markdown
+++ b/website/docs/r/transcribe_vocabulary_filter.html.markdown
@@ -40,9 +40,9 @@ The following arguments are optional:
 * `tags` - (Optional) A map of tags to assign to the VocabularyFilter. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 * `words` - (Optional) - A list of terms to include in the vocabulary. Conflicts with `vocabulary_filter_file_uri` argument.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - VocabularyFilter name.
 * `arn` - ARN of the VocabularyFilter.
@@ -50,8 +50,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Transcribe VocabularyFilter can be imported using the `vocabulary_filter_name`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Transcribe VocabularyFilter using the `vocabulary_filter_name`. For example:
 
+```terraform
+import {
+  to = aws_transcribe_vocabulary_filter.example
+  id = "example-name"
+}
 ```
-$ terraform import aws_transcribe_vocabulary_filter.example example-name
+
+Using `terraform import`, import Transcribe VocabularyFilter using the `vocabulary_filter_name`. For example:
+
+```console
+% terraform import aws_transcribe_vocabulary_filter.example example-name
 ```
diff --git a/website/docs/r/transfer_access.html.markdown b/website/docs/r/transfer_access.html.markdown
index 9e995e238d3..4f1203c6b46 100644
--- a/website/docs/r/transfer_access.html.markdown
+++ b/website/docs/r/transfer_access.html.markdown
@@ -40,7 +40,7 @@ resource "aws_transfer_access" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `external_id` - (Required) The SID of a group in the directory connected to the Transfer Server (e.g., `S-1-1-12-1234567890-123456789-1234567890-1234`)
 * `server_id` - (Required) The Server ID of the Transfer Server (e.g., `s-12345678`)
@@ -62,16 +62,25 @@ The following arguments are supported:
 * `uid` - (Required) The POSIX user ID used for all EFS operations by this user.
 * `secondary_gids` - (Optional) The secondary POSIX group IDs used for all EFS operations by this user.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id`  - The ID of the resource
 
 ## Import
 
-Transfer Accesses can be imported using the `server_id` and `external_id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Transfer Accesses using the `server_id` and `external_id`. For example:
 
+```terraform
+import {
+  to = aws_transfer_access.example
+  id = "s-12345678/S-1-1-12-1234567890-123456789-1234567890-1234"
+}
 ```
-$ terraform import aws_transfer_access.example s-12345678/S-1-1-12-1234567890-123456789-1234567890-1234
+
+Using `terraform import`, import Transfer Accesses using the `server_id` and `external_id`. For example:
+
+```console
+% terraform import aws_transfer_access.example s-12345678/S-1-1-12-1234567890-123456789-1234567890-1234
 ```
diff --git a/website/docs/r/transfer_agreement.html.markdown b/website/docs/r/transfer_agreement.html.markdown
new file mode 100644
index 00000000000..18291f50514
--- /dev/null
+++ b/website/docs/r/transfer_agreement.html.markdown
@@ -0,0 +1,63 @@
+---
+subcategory: "Transfer Family"
+layout: "aws"
+page_title: "AWS: aws_transfer_agreement"
+description: |-
+  Provides a AWS Transfer AS2 Agreement Resource
+---
+
+# Resource: aws_transfer_agreement
+
+Provides a AWS Transfer AS2 Agreement resource.
+
+## Example Usage
+
+### Basic
+
+```terraform
+resource "aws_transfer_agreement" "example" {
+  access_role        = aws_iam_role.test.arn
+  base_directory     = "/DOC-EXAMPLE-BUCKET/home/mydirectory"
+  description        = "example"
+  local_profile_id   = aws_transfer_profile.local.profile_id
+  partner_profile_id = aws_transfer_profile.partner.profile_id
+  server_id          = aws_transfer_server.test.id
+}
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `access_role` - (Required) The IAM Role which provides read and write access to the parent directory of the file location mentioned in the StartFileTransfer request.
+* `base_directory` - (Required) The landing directory for the files transferred by using the AS2 protocol.
+* `description` - (Optional) The Optional description of the transdfer.
+* `local_profile_id` - (Required) The unique identifier for the AS2 local profile.
+* `partner_profile_id` - (Required) The unique identifier for the AS2 partner profile.
+* `server_id` - (Required) The unique server identifier for the server instance. This is the specific server the agreement uses.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `agreement_id`  - The unique identifier for the AS2 agreement.
+* `arn` - The ARN of the agreement.
+* `staus`  - The staus of the agreement which is either ACTIVE or INACTIVE.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Transfer AS2 Agreement using the `server_id/agreement_id`. For example:
+
+```terraform
+import {
+  to = aws_transfer_agreement.example
+  id = "s-4221a88afd5f4362a/a-4221a88afd5f4362a"
+}
+```
+
+Using `terraform import`, import Transfer AS2 Agreement using the `server_id/agreement_id`. For example:
+
+```console
+% terraform import aws_transfer_agreement.example s-4221a88afd5f4362a/a-4221a88afd5f4362a
+```
diff --git a/website/docs/r/transfer_certificate.html.markdown b/website/docs/r/transfer_certificate.html.markdown
new file mode 100644
index 00000000000..df579fe1c43
--- /dev/null
+++ b/website/docs/r/transfer_certificate.html.markdown
@@ -0,0 +1,62 @@
+---
+subcategory: "Transfer Family"
+layout: "aws"
+page_title: "AWS: aws_transfer_certificate"
+description: |-
+  Provides a AWS Transfer AS2 Certificate Resource
+---
+
+# Resource: aws_transfer_certificate
+
+Provides a AWS Transfer AS2 Certificate resource.
+
+## Example Usage
+
+### Basic
+
+```terraform
+resource "aws_transfer_certificate" "example" {
+  certificate       = file("${path.module}/example.com/example.crt")
+  certificate_chain = file("${path.module}/example.com/ca.crt")
+  private_key       = file("${path.module}/example.com/example.key")
+  description       = "example"
+  usage             = "SIGNING"
+}
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `certificate` - (Required) The valid certificate file required for the transfer.
+* `certificate_chain` - (Optional) The optional list of certificate that make up the chain for the certificate that is being imported.
+* `description` - (Optional) A short description that helps identify the certificate.
+* `private_key` - (Optional) The private key associated with the certificate being imported.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `usage` - (Required) Specifies if a certificate is being used for signing or encryption. The valid values are SIGNING and ENCRYPTION.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the certificate
+* `certificate_id` - The unique identifier for the AS2 certificate
+* `active_date` - An date when the certificate becomes active
+* `inactive_date` - An date when the certificate becomes inactive
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Transfer AS2 Certificate using the `certificate_id`. For example:
+
+```terraform
+import {
+  to = aws_transfer_certificate.example
+  id = "c-4221a88afd5f4362a"
+}
+```
+
+Using `terraform import`, import Transfer AS2 Certificate using the `certificate_id`. For example:
+
+```console
+% terraform import aws_transfer_certificate.example c-4221a88afd5f4362a
+```
diff --git a/website/docs/r/transfer_connector.html.markdown b/website/docs/r/transfer_connector.html.markdown
new file mode 100644
index 00000000000..45be9380c1f
--- /dev/null
+++ b/website/docs/r/transfer_connector.html.markdown
@@ -0,0 +1,96 @@
+---
+subcategory: "Transfer Family"
+layout: "aws"
+page_title: "AWS: aws_transfer_connector"
+description: |-
+  Provides a AWS Transfer AS2 Connector Resource
+---
+
+# Resource: aws_transfer_connector
+
+Provides a AWS Transfer AS2 Connector resource.
+
+## Example Usage
+
+### Basic
+
+```terraform
+resource "aws_transfer_connector" "example" {
+  access_role = aws_iam_role.test.arn
+  as2_config {
+    compression           = "DISABLED"
+    encryption_algorithm  = "AWS128_CBC"
+    message_subject       = "For Connector"
+    local_profile_id      = aws_transfer_profile.local.profile_id
+    mdn_response          = "NONE"
+    mdn_signing_algorithm = "NONE"
+    partner_profile_id    = aws_transfer_profile.partner.profile_id
+    signing_algorithm     = "NONE"
+  }
+  url = "http://www.test.com"
+}
+```
+
+### SFTP Connector
+
+```terraform
+resource "aws_transfer_connector" "example" {
+  access_role = aws_iam_role.test.arn
+  sftp_config {
+    trusted_host_keys = ["ssh-rsa AAAAB3NYourKeysHere"]
+    user_secret_id    = aws_secretsmanager_secret.example.id
+  }
+  url = "sftp://test.com"
+}
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `access_role` - (Required) The IAM Role which provides read and write access to the parent directory of the file location mentioned in the StartFileTransfer request.
+* `as2_config` - (Optional) Either SFTP or AS2 is configured.The parameters to configure for the connector object. Fields documented below.
+* `logging_role` - (Optional) The IAM Role which is required for allowing the connector to turn on CloudWatch logging for Amazon S3 events.
+* `sftp_config` - (Optional) Either SFTP or AS2 is configured.The parameters to configure for the connector object. Fields documented below.
+* `url` - (Required) The URL of the partners AS2 endpoint or SFTP endpoint.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+### As2Config Details
+
+* `compression` - (Required) Specifies weather AS2 file is compressed. The valud values are ZLIB and  DISABLED.
+* `encryption_algorithm` - (Required) The algorithm that is used to encrypt the file. The valid values are AES128_CBC | AES192_CBC | AES256_CBC | NONE.
+* `local_profile_id` - (Required) The unique identifier for the AS2 local profile.
+* `mdn_response` - (Required) Used for outbound requests to determine if a partner response for transfers is synchronous or asynchronous. The valid values are SYNC and NONE.
+* `mdn_signing_algorithm` - (Optional) The signing algorithm for the Mdn response. The valid values are SHA256 | SHA384 | SHA512 | SHA1 | NONE | DEFAULT.
+* `message_subject` - (Optional) Used as the subject HTTP header attribute in AS2 messages that are being sent with the connector.
+* `partner_profile_id` - (Required) The unique identifier for the AS2 partner profile.
+* `signing_algorithm` - (Required) The algorithm that is used to sign AS2 messages sent with the connector. The valid values are SHA256 | SHA384 | SHA512 | SHA1 | NONE .
+
+### SftpConfig Details
+
+* `trusted_host_keys` - (Required) A list of public portion of the host key, or keys, that are used to authenticate the user to the external server to which you are connecting.(https://docs.aws.amazon.com/transfer/latest/userguide/API_SftpConnectorConfig.html)
+* `user_secret_id` - (Required) The identifier for the secret (in AWS Secrets Manager) that contains the SFTP user's private key, password, or both. The identifier can be either the Amazon Resource Name (ARN) or the name of the secret.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the connector.
+* `connector_id`  - The unique identifier for the AS2 profile or SFTP Profile.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Transfer AS2 Connector using the `connector_id`. For example:
+
+```terraform
+import {
+  to = aws_transfer_connector.example
+  id = "c-4221a88afd5f4362a"
+}
+```
+
+Using `terraform import`, import Transfer AS2 Connector using the `connector_id`. For example:
+
+```console
+% terraform import aws_transfer_connector.example c-4221a88afd5f4362a
+```
diff --git a/website/docs/r/transfer_profile.html.markdown b/website/docs/r/transfer_profile.html.markdown
new file mode 100644
index 00000000000..bc31dcbcd27
--- /dev/null
+++ b/website/docs/r/transfer_profile.html.markdown
@@ -0,0 +1,56 @@
+---
+subcategory: "Transfer Family"
+layout: "aws"
+page_title: "AWS: aws_transfer_profile"
+description: |-
+  Provides a AWS Transfer AS2 Profile Resource
+---
+
+# Resource: aws_transfer_profile
+
+Provides a AWS Transfer AS2 Profile resource.
+
+## Example Usage
+
+### Basic
+
+```terraform
+resource "aws_transfer_profile" "example" {
+  as2_id          = "example"
+  certificate_ids = [aws_transfer_certificate.example.certificate_id]
+  usage           = "LOCAL"
+}
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `as2_id` - (Required) The As2Id is the AS2 name as defined in the RFC 4130. For inbound ttransfers this is the AS2 From Header for the AS2 messages sent from the partner. For Outbound messages this is the AS2 To Header for the AS2 messages sent to the partner. his ID cannot include spaces.
+* `certificate_ids` - (Optional) The list of certificate Ids from the imported certificate operation.
+* `profile_type` - (Required) The profile type should be LOCAL or PARTNER.
+* `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `arn` - The ARN of the profile.
+* `profile_id`  - The unique identifier for the AS2 profile.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Transfer AS2 Profile using the `profile_id`. For example:
+
+```terraform
+import {
+  to = aws_transfer_profile.example
+  id = "p-4221a88afd5f4362a"
+}
+```
+
+Using `terraform import`, import Transfer AS2 Profile using the `profile_id`. For example:
+
+```console
+% terraform import aws_transfer_profile.example p-4221a88afd5f4362a
+```
diff --git a/website/docs/r/transfer_server.html.markdown b/website/docs/r/transfer_server.html.markdown
index bf8b2b681c9..cad092fb8b2 100644
--- a/website/docs/r/transfer_server.html.markdown
+++ b/website/docs/r/transfer_server.html.markdown
@@ -85,9 +85,45 @@ resource "aws_transfer_server" "example" {
 }
 ```
 
+### Using Structured Logging Destinations
+
+```terraform
+resource "aws_cloudwatch_log_group" "transfer" {
+  name_prefix = "transfer_test_"
+}
+
+data "aws_iam_policy_document" "transfer_assume_role" {
+  statement {
+    effect = "Allow"
+
+    principals {
+      type        = "Service"
+      identifiers = ["transfer.amazonaws.com"]
+    }
+
+    actions = ["sts:AssumeRole"]
+  }
+}
+
+resource "aws_iam_role" "iam_for_transfer" {
+  name_prefix         = "iam_for_transfer_"
+  assume_role_policy  = data.aws_iam_policy_document.transfer_assume_role.json
+  managed_policy_arns = ["arn:aws:iam::aws:policy/service-role/AWSTransferLoggingAccess"]
+}
+
+resource "aws_transfer_server" "transfer" {
+  endpoint_type = "PUBLIC"
+  logging_role  = aws_iam_role.iam_for_transfer.arn
+  protocols     = ["SFTP"]
+  structured_log_destinations = [
+    "${aws_cloudwatch_log_group.transfer.arn}:*"
+  ]
+}
+```
+
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `certificate` - (Optional) The Amazon Resource Name (ARN) of the AWS Certificate Manager (ACM) certificate. This is required when `protocols` is set to `FTPS`
 * `domain` - (Optional) The domain of the storage system that is used for file transfers. Valid values are: `S3` and `EFS`. The default value is `S3`.
@@ -110,6 +146,7 @@ The following arguments are supported:
 * `pre_authentication_login_banner`- (Optional) Specify a string to display when users connect to a server. This string is displayed before the user authenticates.
 * `protocol_details`- (Optional) The protocol settings that are configured for your server.
 * `security_policy_name` - (Optional) Specifies the name of the security policy that is attached to the server. Possible values are `TransferSecurityPolicy-2018-11`, `TransferSecurityPolicy-2020-06`, `TransferSecurityPolicy-FIPS-2020-06`, `TransferSecurityPolicy-2022-03` and `TransferSecurityPolicy-2023-05`. Default value is: `TransferSecurityPolicy-2018-11`.
+* `structured_log_destinations` - (Optional) A set of ARNs of destinations that will receive structured logs from the transfer server such as CloudWatch Log Group ARNs. If provided this enables the transfer server to emit structured logs to the specified locations.
 * `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 * `workflow_details` - (Optional) Specifies the workflow details. See Workflow Details below.
 
@@ -138,9 +175,9 @@ The following arguments are supported:
 * `execution_role` - (Required) Includes the necessary permissions for S3, EFS, and Lambda operations that Transfer can assume, so that all workflow steps can operate on the required resources.
 * `workflow_id` - (Required)  A unique identifier for the workflow.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name (ARN) of Transfer Server
 * `id`  - The Server ID of the Transfer Server (e.g., `s-12345678`)
@@ -150,10 +187,19 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Transfer Servers can be imported using the `server id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Transfer Servers using the server `id`. For example:
 
+```terraform
+import {
+  to = aws_transfer_server.example
+  id = "s-12345678"
+}
 ```
-$ terraform import aws_transfer_server.example s-12345678
+
+Using `terraform import`, import Transfer Servers using the server `id`. For example:
+
+```console
+% terraform import aws_transfer_server.example s-12345678
 ```
 
 Certain resource arguments, such as `host_key`, cannot be read via the API and imported into Terraform. Terraform will display a difference for these arguments the first run after import if declared in the Terraform configuration for an imported resource.
diff --git a/website/docs/r/transfer_ssh_key.html.markdown b/website/docs/r/transfer_ssh_key.html.markdown
index ebf9cd52e95..0b9f6b1e404 100644
--- a/website/docs/r/transfer_ssh_key.html.markdown
+++ b/website/docs/r/transfer_ssh_key.html.markdown
@@ -73,20 +73,29 @@ resource "aws_iam_role_policy" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `server_id` - (Requirement) The Server ID of the Transfer Server (e.g., `s-12345678`)
 * `user_name` - (Requirement) The name of the user account that is assigned to one or more servers.
 * `body` - (Requirement) The public key portion of an SSH key pair.
 
-## Attributes Reference
+## Attribute Reference
 
-No additional attributes are exported.
+This resource exports no additional attributes.
 
 ## Import
 
-Transfer SSH Public Key can be imported using the `server_id` and `user_name` and `ssh_public_key_id` separated by `/`.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Transfer SSH Public Key using the `server_id` and `user_name` and `ssh_public_key_id` separated by `/`. For example:
 
+```terraform
+import {
+  to = aws_transfer_ssh_key.bar
+  id = "s-12345678/test-username/key-12345"
+}
 ```
-$ terraform import aws_transfer_ssh_key.bar s-12345678/test-username/key-12345
+
+Using `terraform import`, import Transfer SSH Public Key using the `server_id` and `user_name` and `ssh_public_key_id` separated by `/`. For example:
+
+```console
+% terraform import aws_transfer_ssh_key.bar s-12345678/test-username/key-12345
 ```
diff --git a/website/docs/r/transfer_tag.html.markdown b/website/docs/r/transfer_tag.html.markdown
index b634aa871a8..606ab2bab67 100644
--- a/website/docs/r/transfer_tag.html.markdown
+++ b/website/docs/r/transfer_tag.html.markdown
@@ -36,22 +36,31 @@ resource "aws_transfer_tag" "hostname" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `resource_arn` - (Required) Amazon Resource Name (ARN) of the Transfer Family resource to tag.
 * `key` - (Required) Tag name.
 * `value` - (Required) Tag value.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Transfer Family resource identifier and key, separated by a comma (`,`)
 
 ## Import
 
-`aws_transfer_tag` can be imported by using the Transfer Family resource identifier and key, separated by a comma (`,`), e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_transfer_tag` using the Transfer Family resource identifier and key, separated by a comma (`,`). For example:
 
+```terraform
+import {
+  to = aws_transfer_tag.example
+  id = "arn:aws:transfer:us-east-1:123456789012:server/s-1234567890abcdef0,Name"
+}
 ```
-$ terraform import aws_transfer_tag.example arn:aws:transfer:us-east-1:123456789012:server/s-1234567890abcdef0,Name
+
+Using `terraform import`, import `aws_transfer_tag` using the Transfer Family resource identifier and key, separated by a comma (`,`). For example:
+
+```console
+% terraform import aws_transfer_tag.example arn:aws:transfer:us-east-1:123456789012:server/s-1234567890abcdef0,Name
 ```
diff --git a/website/docs/r/transfer_user.html.markdown b/website/docs/r/transfer_user.html.markdown
index 8fbd961daba..8c40c85cc63 100644
--- a/website/docs/r/transfer_user.html.markdown
+++ b/website/docs/r/transfer_user.html.markdown
@@ -69,7 +69,7 @@ resource "aws_transfer_user" "foo" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `server_id` - (Required) The Server ID of the Transfer Server (e.g., `s-12345678`)
 * `user_name` - (Required) The name used for log in to your SFTP server.
@@ -101,9 +101,9 @@ home_directory_mappings {
 * `uid` - (Required) The POSIX user ID used for all EFS operations by this user.
 * `secondary_gids` - (Optional) The secondary POSIX group IDs used for all EFS operations by this user.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name (ARN) of Transfer User
 * `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
@@ -116,8 +116,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Transfer Users can be imported using the `server_id` and `user_name` separated by `/`.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Transfer Users using the `server_id` and `user_name` separated by `/`. For example:
 
+```terraform
+import {
+  to = aws_transfer_user.bar
+  id = "s-12345678/test-username"
+}
 ```
-$ terraform import aws_transfer_user.bar s-12345678/test-username
+
+Using `terraform import`, import Transfer Users using the `server_id` and `user_name` separated by `/`. For example:
+
+```console
+% terraform import aws_transfer_user.bar s-12345678/test-username
 ```
diff --git a/website/docs/r/transfer_workflow.html.markdown b/website/docs/r/transfer_workflow.html.markdown
index 7897549227c..9978613a272 100644
--- a/website/docs/r/transfer_workflow.html.markdown
+++ b/website/docs/r/transfer_workflow.html.markdown
@@ -56,7 +56,7 @@ resource "aws_transfer_workflow" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `description` - (Optional) A textual description for the workflow.
 * `on_exception_steps` - (Optional) Specifies the steps (actions) to take if errors are encountered during execution of the workflow. See Workflow Steps below.
@@ -125,9 +125,9 @@ The following arguments are supported:
 * `key` - (Required) The name assigned to the tag that you create.
 * `value` - (Required) The value that corresponds to the key.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The Workflow ARN.
 * `id` - The Workflow id.
@@ -135,8 +135,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Transfer Workflows can be imported using the `worflow_id`.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Transfer Workflows using the `worflow_id`. For example:
 
+```terraform
+import {
+  to = aws_transfer_workflow.example
+  id = "example"
+}
 ```
-$ terraform import aws_transfer_workflow.example example
+
+Using `terraform import`, import Transfer Workflows using the `worflow_id`. For example:
+
+```console
+% terraform import aws_transfer_workflow.example example
 ```
diff --git a/website/docs/r/verifiedaccess_group.html.markdown b/website/docs/r/verifiedaccess_group.html.markdown
new file mode 100644
index 00000000000..f974af560fe
--- /dev/null
+++ b/website/docs/r/verifiedaccess_group.html.markdown
@@ -0,0 +1,52 @@
+---
+subcategory: "Verified Access"
+layout: "aws"
+page_title: "AWS: aws_verifiedaccess_group"
+description: |-
+  Terraform resource for managing a Verified Access Group.
+---
+
+# Resource: aws_verifiedaccess_group
+
+Terraform resource for managing a Verified Access Group.
+
+## Example Usage
+
+### Basic Usage
+
+```terraform
+resource "aws_verifiedaccess_group" "example" {
+  verifiedaccess_instance_id = aws_verifiedaccess_instance.example.id
+}
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `verifiedaccess_instance_id` - (Required) The id of the verified access instance this group is associated with.
+
+The following arguments are optional:
+
+* `description` - (Optional) Description of the verified access group.
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `policy_docment` - (Optional) The policy document that is associated with this resource.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `creation_time` - Timestamp when the access group was created.
+* `deletion_time` - Timestamp when the access group was deleted.
+* `last_updated_time` - Timestamp when the access group was last updated.
+* `owner` - AWS account number owning this resource.
+* `verifiedaccess_group_arn` - ARN of this verified acess group.
+* `verifiedaccess_group_id` - ID of this verified access group.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `60m`)
+* `update` - (Default `180m`)
+* `delete` - (Default `90m`)
diff --git a/website/docs/r/verifiedaccess_instance.html.markdown b/website/docs/r/verifiedaccess_instance.html.markdown
new file mode 100644
index 00000000000..748bf9bd0b0
--- /dev/null
+++ b/website/docs/r/verifiedaccess_instance.html.markdown
@@ -0,0 +1,77 @@
+---
+subcategory: "Verified Access"
+layout: "aws"
+page_title: "AWS: aws_verifiedaccess_instance"
+description: |-
+  Terraform resource for managing a Verified Access Instance.
+---
+
+# Resource: aws_verifiedaccess_instance
+
+Terraform resource for managing a Verified Access Instance.
+
+## Example Usage
+
+### Basic
+
+```terraform
+resource "aws_verifiedaccess_instance" "example" {
+  description = "example"
+
+  tags = {
+    Name = "example"
+  }
+}
+```
+
+### With `fips_enabled`
+
+```terraform
+resource "aws_verifiedaccess_instance" "example" {
+  fips_enabled = true
+}
+```
+
+## Argument Reference
+
+The following arguments are optional:
+
+* `description` - (Optional) A description for the AWS Verified Access Instance.
+* `fips_enabled` - (Optional, Forces new resource) Enable or disable support for Federal Information Processing Standards (FIPS) on the AWS Verified Access Instance.
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `creation_time` - The time that the Verified Access Instance was created.
+* `id` - The ID of the AWS Verified Access Instance.
+* `last_updated_time` - The time that the Verified Access Instance was last updated.
+* `verified_access_trust_providers` - One or more blocks of providing information about the AWS Verified Access Trust Providers. See [verified_access_trust_providers](#verified_access_trust_providers) below for details.One or more blocks
+
+### verified_access_trust_providers
+
+Each `verified_access_trust_providers` supports the following argument:
+
+* `description` - The description of trust provider.
+* `device_trust_provider_type` - The type of device-based trust provider.
+* `trust_provider_type` - The type of trust provider (user- or device-based).
+* `user_trust_provider_type` - The type of user-based trust provider.
+* `verified_access_trust_provider_id` - The ID of the trust provider.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Verified Access Instances using the `id`. For example:
+
+```terraform
+import {
+  to = aws_verifiedaccess_instance.example
+  id = "vai-1234567890abcdef0"
+}
+```
+
+Using `terraform import`, import Verified Access Instances using the  `id`. For example:
+
+```console
+% terraform import aws_verifiedaccess_instance.example vai-1234567890abcdef0
+```
diff --git a/website/docs/r/verifiedaccess_instance_logging_configuration.html.markdown b/website/docs/r/verifiedaccess_instance_logging_configuration.html.markdown
new file mode 100644
index 00000000000..14248aa2a16
--- /dev/null
+++ b/website/docs/r/verifiedaccess_instance_logging_configuration.html.markdown
@@ -0,0 +1,161 @@
+---
+subcategory: "Verified Access"
+layout: "aws"
+page_title: "AWS: aws_verifiedaccess_instance_logging_configuration"
+description: |-
+  Terraform resource for managing a Verified Access Instance Logging Configuration.
+---
+
+# Resource: aws_verifiedaccess_instance_logging_configuration
+
+Terraform resource for managing a Verified Access Logging Configuration.
+
+## Example Usage
+
+### With CloudWatch Logging
+
+```terraform
+resource "aws_verifiedaccess_instance_logging_configuration" "example" {
+  access_logs {
+    cloudwatch_logs {
+      enabled   = true
+      log_group = aws_cloudwatch_log_group.example.id
+    }
+  }
+  verifiedaccess_instance_id = aws_verifiedaccess_instance.example.id
+}
+```
+
+### With Kinesis Data Firehose Logging
+
+```terraform
+resource "aws_verifiedaccess_instance_logging_configuration" "example" {
+  access_logs {
+    kinesis_data_firehose {
+      delivery_stream = aws_kinesis_firehose_delivery_stream.example.name
+      enabled         = true
+    }
+  }
+  verifiedaccess_instance_id = aws_verifiedaccess_instance.example.id
+}
+```
+
+### With S3 logging
+
+```terraform
+resource "aws_verifiedaccess_instance_logging_configuration" "example" {
+  access_logs {
+    s3 {
+      bucket_name = aws_s3_bucket.example.id
+      enabled     = true
+      prefix      = "example"
+    }
+  }
+  verifiedaccess_instance_id = aws_verifiedaccess_instance.example.id
+}
+```
+
+### With all three logging options
+
+```terraform
+resource "aws_verifiedaccess_instance_logging_configuration" "example" {
+  access_logs {
+    cloudwatch_logs {
+      enabled   = true
+      log_group = aws_cloudwatch_log_group.example.id
+    }
+    kinesis_data_firehose {
+      delivery_stream = aws_kinesis_firehose_delivery_stream.example.name
+      enabled         = true
+    }
+    s3 {
+      bucket_name = aws_s3_bucket.example.id
+      enabled     = true
+    }
+  }
+  verifiedaccess_instance_id = aws_verifiedaccess_instance.example.id
+}
+```
+
+### With `include_trust_context`
+
+```terraform
+resource "aws_verifiedaccess_instance_logging_configuration" "example" {
+  access_logs {
+    include_trust_context = true
+  }
+  verifiedaccess_instance_id = aws_verifiedaccess_instance.example.id
+}
+```
+
+### With `log_version`
+
+```terraform
+resource "aws_verifiedaccess_instance_logging_configuration" "example" {
+  access_logs {
+    log_version = "ocsf-1.0.0-rc.2"
+  }
+  verifiedaccess_instance_id = aws_verifiedaccess_instance.example.id
+}
+```
+
+## Argument Reference
+
+This resource supports the following arguments:
+
+* `access_logs` - (Required) A block that specifies the configuration options for Verified Access instances. [Detailed below](#access_logs).
+* `verifiedaccess_instance_id` - (Required - Forces New resource) The ID of the Verified Access instance.
+
+### access_logs
+
+A `access_logs` block supports the following arguments:
+
+* `cloudwatch_logs` - (Optional) A block that specifies configures sending Verified Access logs to CloudWatch Logs. [Detailed below](#cloudwatch_logs).
+* `include_trust_context` - (Optional) Include trust data sent by trust providers into the logs.
+* `kinesis_data_firehose` - (Optional) A block that specifies configures sending Verified Access logs to Kinesis. [Detailed below](#kinesis_data_firehose).
+* `log_version` - (Optional) The logging version to use. Refer to [VerifiedAccessLogOptions](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_VerifiedAccessLogOptions.html) for the allowed values.
+* `s3` - (Optional) A block that specifies configures sending Verified Access logs to S3. [Detailed below](#s3).
+
+#### cloudwatch_logs
+
+A `cloudwatch_logs` block supports the following arguments:
+
+* `enabled` - (Required) Indicates whether logging is enabled.
+* `log_group` - (Optional) The name of the CloudWatch Logs Log Group.
+
+#### kinesis_data_firehose
+
+A `kinesis_data_firehose` block supports the following arguments:
+
+* `delivery_stream` - (Optional) The name of the delivery stream.
+* `enabled` - (Required) Indicates whether logging is enabled.
+
+#### s3
+
+A `s3` block supports the following arguments:
+
+* `bucket_name` - (Optional) The name of S3 bucket.
+* `bucket_owner` - (Optional) The ID of the AWS account that owns the Amazon S3 bucket.
+* `enabled` - (Required) Indicates whether logging is enabled.
+* `prefix` - (Optional) The bucket prefix.
+
+## Attribute Reference
+
+This resource exports no additional attributes.
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Verified Access Logging Configuration using the Verified Access Instance `id`. For example:
+
+```terraform
+import {
+  to = aws_verifiedaccess_instance_logging_configuration.example
+  id = "vai-1234567890abcdef0"
+}
+```
+
+Using `terraform import`, import Verified Access Logging Configuration using the Verified Access Instance `id`. For example:
+
+```console
+% terraform import aws_verifiedaccess_instance_logging_configuration.example vai-1234567890abcdef0
+```
diff --git a/website/docs/r/verifiedaccess_instance_trust_provider_attachment.html.markdown b/website/docs/r/verifiedaccess_instance_trust_provider_attachment.html.markdown
new file mode 100644
index 00000000000..f2667349a8a
--- /dev/null
+++ b/website/docs/r/verifiedaccess_instance_trust_provider_attachment.html.markdown
@@ -0,0 +1,62 @@
+---
+subcategory: "Verified Access"
+layout: "aws"
+page_title: "AWS: aws_verifiedaccess_instance_trust_provider_attachment"
+description: |-
+  Terraform resource for managing a Verified Access Instance Trust Provider Attachment.
+---
+
+# Resource: aws_verifiedaccess_instance_trust_provider_attachment
+
+Terraform resource for managing a Verified Access Instance Trust Provider Attachment.
+
+## Example Usage
+
+```terraform
+resource "aws_verifiedaccess_instance" "example" {}
+
+resource "aws_verifiedaccess_trust_provider" "example" {
+  device_trust_provider_type = "jamf"
+  policy_reference_name      = "example"
+  trust_provider_type        = "device"
+
+  device_options {
+    tenant_id = "example"
+  }
+}
+
+resource "aws_verifiedaccess_instance_trust_provider_attachment" "example" {
+  verifiedaccess_instance_id       = aws_verifiedaccess_instance.example.id
+  verifiedaccess_trust_provider_id = aws_verifiedaccess_trust_provider.example.id
+}
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `verifiedaccess_instance_id` - (Required) The ID of the Verified Access instance to attach the Trust Provider to.
+* `verifiedaccess_trust_provider_id` - (Required) The ID of the Verified Access trust provider.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - A combination of attributes, separated by a `/` to create a unique id: `verifiedaccess_instance_id`,`verifiedaccess_trust_provider_id`
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Verified Access Instance Trust Provider Attachments using the `verifiedaccess_instance_id` and `verifiedaccess_trust_provider_id` separated by a forward slash (`/`). For example:
+
+```terraform
+import {
+  to = aws_verifiedaccess_instance_trust_provider_attachment.example
+  id = "vai-1234567890abcdef0/vatp-8012925589"
+}
+```
+
+Using `terraform import`, import Verified Access Instance Trust Provider Attachments using the `verifiedaccess_instance_id` and `verifiedaccess_trust_provider_id` separated by a forward slash (`/`). For example:
+
+```console
+% terraform import aws_verifiedaccess_instance_trust_provider_attachment.example vai-1234567890abcdef0/vatp-8012925589
+```
diff --git a/website/docs/r/verifiedaccess_trust_provider.html.markdown b/website/docs/r/verifiedaccess_trust_provider.html.markdown
new file mode 100644
index 00000000000..5a28d4a3871
--- /dev/null
+++ b/website/docs/r/verifiedaccess_trust_provider.html.markdown
@@ -0,0 +1,68 @@
+---
+subcategory: "Verified Access"
+layout: "aws"
+page_title: "AWS: aws_verifiedaccess_trust_provider"
+description: |-
+  Terraform resource for managing a Verified Access Trust Provider.
+---
+
+# Resource: aws_verifiedaccess_trust_provider
+
+Terraform resource for managing a Verified Access Trust Provider.
+
+## Example Usage
+
+```terraform
+resource "aws_verifiedaccess_trust_provider" "example" {
+  policy_reference_name    = "example"
+  trust_provider_type      = "user"
+  user_trust_provider_type = "iam-identity-center"
+}
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `policy_reference_name` - (Required) The identifier to be used when working with policy rules.
+* `trust_provider_type` - (Required) The type of trust provider can be either user or device-based.
+
+The following arguments are optional:
+
+* `description` - (Optional) A description for the AWS Verified Access trust provider.
+* `device_options` - (Optional) A block of options for device identity based trust providers.
+* `device_trust_provider_type` (Optional) The type of device-based trust provider.
+* `oidc_options` - (Optional) The OpenID Connect details for an oidc-type, user-identity based trust provider.
+* `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+* `user_trust_provider_type` - (Optional) The type of user-based trust provider.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The ID of the AWS Verified Access trust provider.
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `60m`)
+* `update` - (Default `180m`)
+* `delete` - (Default `90m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Transfer Workflows using the `id`. For example:
+
+```terraform
+import {
+  to = aws_verifiedaccess_trust_provider.example
+  id = "vatp-8012925589"
+}
+```
+
+Using `terraform import`, import Transfer Workflows using the  `id`. For example:
+
+```console
+% terraform import aws_verifiedaccess_trust_provider.example vatp-8012925589
+```
diff --git a/website/docs/r/volume_attachment.html.markdown b/website/docs/r/volume_attachment.html.markdown
index 6bdb1fe0ecf..c430cbc8c3c 100644
--- a/website/docs/r/volume_attachment.html.markdown
+++ b/website/docs/r/volume_attachment.html.markdown
@@ -40,7 +40,7 @@ resource "aws_ebs_volume" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `device_name` - (Required) The device name to expose to the instance (for
 example, `/dev/sdh` or `xvdh`).  See [Device Naming on Linux Instances][1] and [Device Naming on Windows Instances][2] for more information.
@@ -58,9 +58,9 @@ means attached.
 * `stop_instance_before_detaching` - (Optional, Boolean) Set this to true to ensure that the target instance is stopped
 before trying to detach the volume. Stops the instance, if it is not already stopped.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `device_name` - The device name exposed to the instance
 * `instance_id` - ID of the Instance
@@ -68,10 +68,19 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-EBS Volume Attachments can be imported using `DEVICE_NAME:VOLUME_ID:INSTANCE_ID`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import EBS Volume Attachments using `DEVICE_NAME:VOLUME_ID:INSTANCE_ID`. For example:
 
+```terraform
+import {
+  to = aws_volume_attachment.example
+  id = "/dev/sdh:vol-049df61146c4d7901:i-12345678"
+}
 ```
-$ terraform import aws_volume_attachment.example /dev/sdh:vol-049df61146c4d7901:i-12345678
+
+Using `terraform import`, import EBS Volume Attachments using `DEVICE_NAME:VOLUME_ID:INSTANCE_ID`. For example:
+
+```console
+% terraform import aws_volume_attachment.example /dev/sdh:vol-049df61146c4d7901:i-12345678
 ```
 
 [1]: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/device_naming.html#available-ec2-device-names
diff --git a/website/docs/r/vpc.html.markdown b/website/docs/r/vpc.html.markdown
index 89ef582e825..43b011ef6ea 100644
--- a/website/docs/r/vpc.html.markdown
+++ b/website/docs/r/vpc.html.markdown
@@ -52,7 +52,7 @@ resource "aws_vpc_ipam_pool" "test" {
 
 resource "aws_vpc_ipam_pool_cidr" "test" {
   ipam_pool_id = aws_vpc_ipam_pool.test.id
-  cidr         = "172.2.0.0/16"
+  cidr         = "172.20.0.0/16"
 }
 
 resource "aws_vpc" "test" {
@@ -66,7 +66,7 @@ resource "aws_vpc" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `cidr_block` - (Optional) The IPv4 CIDR block for the VPC. CIDR can be explicitly set or it can be derived from IPAM using `ipv4_netmask_length`.
 * `instance_tenancy` - (Optional) A tenancy option for instances launched into the VPC. Default is `default`, which ensures that EC2 instances launched in this VPC use the EC2 instance tenancy attribute specified when the EC2 instance is launched. The only other option is `dedicated`, which ensures that EC2 instances launched in this VPC are run on dedicated tenancy instances regardless of the tenancy attribute specified at launch. This has a dedicated per region fee of $2 per hour, plus an hourly per instance usage fee.
@@ -82,9 +82,9 @@ The following arguments are supported:
 * `assign_generated_ipv6_cidr_block` - (Optional) Requests an Amazon-provided IPv6 CIDR block with a /56 prefix length for the VPC. You cannot specify the range of IP addresses, or the size of the CIDR block. Default is `false`. Conflicts with `ipv6_ipam_pool_id`
 * `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name (ARN) of VPC
 * `id` - The ID of the VPC
@@ -105,8 +105,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-VPCs can be imported using the `vpc id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import VPCs using the VPC `id`. For example:
 
+```terraform
+import {
+  to = aws_vpc.test_vpc
+  id = "vpc-a01106c2"
+}
 ```
-$ terraform import aws_vpc.test_vpc vpc-a01106c2
+
+Using `terraform import`, import VPCs using the VPC `id`. For example:
+
+```console
+% terraform import aws_vpc.test_vpc vpc-a01106c2
 ```
diff --git a/website/docs/r/vpc_dhcp_options.html.markdown b/website/docs/r/vpc_dhcp_options.html.markdown
index 5e88139fe80..b3855011e69 100644
--- a/website/docs/r/vpc_dhcp_options.html.markdown
+++ b/website/docs/r/vpc_dhcp_options.html.markdown
@@ -38,7 +38,7 @@ resource "aws_vpc_dhcp_options" "foo" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `domain_name` - (Optional) the suffix domain name to use by default when resolving non Fully Qualified Domain Names. In other words, this is what ends up being the `search` value in the `/etc/resolv.conf` file.
 * `domain_name_servers` - (Optional) List of name servers to configure in `/etc/resolv.conf`. If you want to use the default AWS nameservers you should set this to `AmazonProvidedDNS`.
@@ -55,9 +55,9 @@ The following arguments are supported:
 * If you delete a DHCP Options Set, all VPCs using it will be associated to AWS's `default` DHCP Option Set.
 * In most cases unless you're configuring your own DNS you'll want to set `domain_name_servers` to `AmazonProvidedDNS`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the DHCP Options Set.
 * `arn` - The ARN of the DHCP Options Set.
@@ -69,8 +69,17 @@ official [AWS User Guide](https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide
 
 ## Import
 
-VPC DHCP Options can be imported using the `dhcp options id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import VPC DHCP Options using the DHCP Options `id`. For example:
 
+```terraform
+import {
+  to = aws_vpc_dhcp_options.my_options
+  id = "dopt-d9070ebb"
+}
 ```
-$ terraform import aws_vpc_dhcp_options.my_options dopt-d9070ebb
+
+Using `terraform import`, import VPC DHCP Options using the DHCP Options `id`. For example:
+
+```console
+% terraform import aws_vpc_dhcp_options.my_options dopt-d9070ebb
 ```
diff --git a/website/docs/r/vpc_dhcp_options_association.html.markdown b/website/docs/r/vpc_dhcp_options_association.html.markdown
index 0c009d85a5c..669fa5f788d 100644
--- a/website/docs/r/vpc_dhcp_options_association.html.markdown
+++ b/website/docs/r/vpc_dhcp_options_association.html.markdown
@@ -21,7 +21,7 @@ resource "aws_vpc_dhcp_options_association" "dns_resolver" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `vpc_id` - (Required) The ID of the VPC to which we would like to associate a DHCP Options Set.
 * `dhcp_options_id` - (Required) The ID of the DHCP Options Set to associate to the VPC.
@@ -31,16 +31,25 @@ The following arguments are supported:
 * You can only associate one DHCP Options Set to a given VPC ID.
 * Removing the DHCP Options Association automatically sets AWS's `default` DHCP Options Set to the VPC.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the DHCP Options Set Association.
 
 ## Import
 
-DHCP associations can be imported by providing the VPC ID associated with the options:
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import DHCP associations using the VPC ID associated with the options. For example:
 
+```terraform
+import {
+  to = aws_vpc_dhcp_options_association.imported
+  id = "vpc-0f001273ec18911b1"
+}
 ```
-$ terraform import aws_vpc_dhcp_options_association.imported vpc-0f001273ec18911b1
+
+Using `terraform import`, import DHCP associations using the VPC ID associated with the options. For example:
+
+```console
+% terraform import aws_vpc_dhcp_options_association.imported vpc-0f001273ec18911b1
 ```
diff --git a/website/docs/r/vpc_endpoint.html.markdown b/website/docs/r/vpc_endpoint.html.markdown
index 4cab5713801..23c5d3e255d 100644
--- a/website/docs/r/vpc_endpoint.html.markdown
+++ b/website/docs/r/vpc_endpoint.html.markdown
@@ -112,7 +112,7 @@ resource "aws_route53_record" "ptfe_service" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `service_name` - (Required) The service name. For AWS services the service name is usually in the form `com.amazonaws.<region>.<service>` (the SageMaker Notebook service is an exception to this rule, the service name is in the form `aws.sagemaker.<region>.notebook`).
 * `vpc_id` - (Required) The ID of the VPC in which the endpoint will be used.
@@ -132,7 +132,7 @@ If no security groups are specified, the VPC's [default security group](https://
 ### dns_options
 
 * `dns_record_ip_type` - (Optional) The DNS records created for the endpoint. Valid values are `ipv4`, `dualstack`, `service-defined`, and `ipv6`.
-* `private_dns_only_for_inbound_resolver_endpoint` - (Optional) Indicates whether to enable private DNS only for inbound endpoints. This option is available only for services that support both gateway and interface endpoints. It routes traffic that originates from the VPC to the gateway endpoint and traffic that originates from on-premises to the interface endpoint. Can only be specified if `private_dns_enabled` is `true`.
+* `private_dns_only_for_inbound_resolver_endpoint` - (Optional) Indicates whether to enable private DNS only for inbound endpoints. This option is available only for services that support both gateway and interface endpoints. It routes traffic that originates from the VPC to the gateway endpoint and traffic that originates from on-premises to the interface endpoint. Default is `false`. Can only be specified if private_dns_enabled is `true`.
 
 ## Timeouts
 
@@ -142,9 +142,9 @@ If no security groups are specified, the VPC's [default security group](https://
 - `update` - (Default `10m`)
 - `delete` - (Default `10m`)
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the VPC endpoint.
 * `arn` - The Amazon Resource Name (ARN) of the VPC endpoint.
@@ -164,8 +164,17 @@ DNS blocks (for `dns_entry`) support the following attributes:
 
 ## Import
 
-VPC Endpoints can be imported using the `vpc endpoint id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import VPC Endpoints using the VPC endpoint `id`. For example:
 
+```terraform
+import {
+  to = aws_vpc_endpoint.endpoint1
+  id = "vpce-3ecf2a57"
+}
 ```
-$ terraform import aws_vpc_endpoint.endpoint1 vpce-3ecf2a57
+
+Using `terraform import`, import VPC Endpoints using the VPC endpoint `id`. For example:
+
+```console
+% terraform import aws_vpc_endpoint.endpoint1 vpce-3ecf2a57
 ```
diff --git a/website/docs/r/vpc_endpoint_connection_accepter.html.markdown b/website/docs/r/vpc_endpoint_connection_accepter.html.markdown
index cdb0d38a32a..965e8ef93d9 100644
--- a/website/docs/r/vpc_endpoint_connection_accepter.html.markdown
+++ b/website/docs/r/vpc_endpoint_connection_accepter.html.markdown
@@ -41,22 +41,31 @@ resource "aws_vpc_endpoint_connection_accepter" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `vpc_endpoint_id` - (Required) AWS VPC Endpoint ID.
 * `vpc_endpoint_service_id` - (Required) AWS VPC Endpoint Service ID.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the VPC Endpoint Connection.
 * `vpc_endpoint_state` - State of the VPC Endpoint.
 
 ## Import
 
-VPC Endpoint Services can be imported using ID of the connection, which is the `VPC Endpoint Service ID` and `VPC Endpoint ID` separated by underscore (`_`). e.g.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import VPC Endpoint Services using ID of the connection, which is the `VPC Endpoint Service ID` and `VPC Endpoint ID` separated by underscore (`_`).. For example:
 
+```terraform
+import {
+  to = aws_vpc_endpoint_connection_accepter.foo
+  id = "vpce-svc-0f97a19d3fa8220bc_vpce-010601a6db371e263"
+}
 ```
-$ terraform import aws_vpc_endpoint_connection_accepter.foo vpce-svc-0f97a19d3fa8220bc_vpce-010601a6db371e263
+
+Using `terraform import`, import VPC Endpoint Services using ID of the connection, which is the `VPC Endpoint Service ID` and `VPC Endpoint ID` separated by underscore (`_`).. For example:
+
+```console
+% terraform import aws_vpc_endpoint_connection_accepter.foo vpce-svc-0f97a19d3fa8220bc_vpce-010601a6db371e263
 ```
diff --git a/website/docs/r/vpc_endpoint_connection_notification.html.markdown b/website/docs/r/vpc_endpoint_connection_notification.html.markdown
index 9f8838d782f..f1ffd56559c 100644
--- a/website/docs/r/vpc_endpoint_connection_notification.html.markdown
+++ b/website/docs/r/vpc_endpoint_connection_notification.html.markdown
@@ -47,7 +47,7 @@ resource "aws_vpc_endpoint_connection_notification" "foo" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `vpc_endpoint_service_id` - (Optional) The ID of the VPC Endpoint Service to receive notifications for.
 * `vpc_endpoint_id` - (Optional) The ID of the VPC Endpoint to receive notifications for.
@@ -56,9 +56,9 @@ The following arguments are supported:
 
 ~> **NOTE:** One of `vpc_endpoint_service_id` or `vpc_endpoint_id` must be specified.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the VPC connection notification.
 * `state` - The state of the notification.
@@ -66,8 +66,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-VPC Endpoint connection notifications can be imported using the `VPC endpoint connection notification id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import VPC Endpoint connection notifications using the VPC endpoint connection notification `id`. For example:
 
+```terraform
+import {
+  to = aws_vpc_endpoint_connection_notification.foo
+  id = "vpce-nfn-09e6ed3b4efba2263"
+}
 ```
-$ terraform import aws_vpc_endpoint_connection_notification.foo vpce-nfn-09e6ed3b4efba2263
+
+Using `terraform import`, import VPC Endpoint connection notifications using the VPC endpoint connection notification `id`. For example:
+
+```console
+% terraform import aws_vpc_endpoint_connection_notification.foo vpce-nfn-09e6ed3b4efba2263
 ```
diff --git a/website/docs/r/vpc_endpoint_policy.html.markdown b/website/docs/r/vpc_endpoint_policy.html.markdown
index c2737a252c4..0e8f85b435e 100644
--- a/website/docs/r/vpc_endpoint_policy.html.markdown
+++ b/website/docs/r/vpc_endpoint_policy.html.markdown
@@ -49,21 +49,30 @@ resource "aws_vpc_endpoint_policy" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `vpc_endpoint_id` - (Required) The VPC Endpoint ID.
 * `policy` - (Optional) A policy to attach to the endpoint that controls access to the service. Defaults to full access. All `Gateway` and some `Interface` endpoints support policies - see the [relevant AWS documentation](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-endpoints-access.html) for more details. For more information about building AWS IAM policy documents with Terraform, see the [AWS IAM Policy Document Guide](https://learn.hashicorp.com/terraform/aws/iam-policy).
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the VPC endpoint.
 
 ## Import
 
-VPC Endpoint Policies can be imported using the `id`, e.g.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import VPC Endpoint Policies using the `id`. For example:
 
+```terraform
+import {
+  to = aws_vpc_endpoint_policy.example
+  id = "vpce-3ecf2a57"
+}
 ```
-$ terraform import aws_vpc_endpoint_policy.example vpce-3ecf2a57
+
+Using `terraform import`, import VPC Endpoint Policies using the `id`. For example:
+
+```console
+% terraform import aws_vpc_endpoint_policy.example vpce-3ecf2a57
 ```
diff --git a/website/docs/r/vpc_endpoint_route_table_association.html.markdown b/website/docs/r/vpc_endpoint_route_table_association.html.markdown
index 5322abda9e9..103ef82c4e5 100644
--- a/website/docs/r/vpc_endpoint_route_table_association.html.markdown
+++ b/website/docs/r/vpc_endpoint_route_table_association.html.markdown
@@ -21,22 +21,30 @@ resource "aws_vpc_endpoint_route_table_association" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `route_table_id` - (Required) Identifier of the EC2 Route Table to be associated with the VPC Endpoint.
 * `vpc_endpoint_id` - (Required) Identifier of the VPC Endpoint with which the EC2 Route Table will be associated.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - A hash of the EC2 Route Table and VPC Endpoint identifiers.
 
 ## Import
 
-VPC Endpoint Route Table Associations can be imported using `vpc_endpoint_id` together with `route_table_id`,
-e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import VPC Endpoint Route Table Associations using `vpc_endpoint_id` together with `route_table_id`. For example:
 
+```terraform
+import {
+  to = aws_vpc_endpoint_route_table_association.example
+  id = "vpce-aaaaaaaa/rtb-bbbbbbbb"
+}
 ```
-$ terraform import aws_vpc_endpoint_route_table_association.example vpce-aaaaaaaa/rtb-bbbbbbbb
+
+Using `terraform import`, import VPC Endpoint Route Table Associations using `vpc_endpoint_id` together with `route_table_id`. For example:
+
+```console
+% terraform import aws_vpc_endpoint_route_table_association.example vpce-aaaaaaaa/rtb-bbbbbbbb
 ```
diff --git a/website/docs/r/vpc_endpoint_security_group_association.html.markdown b/website/docs/r/vpc_endpoint_security_group_association.html.markdown
index 8fb11abda9f..99974036e29 100644
--- a/website/docs/r/vpc_endpoint_security_group_association.html.markdown
+++ b/website/docs/r/vpc_endpoint_security_group_association.html.markdown
@@ -29,14 +29,14 @@ resource "aws_vpc_endpoint_security_group_association" "sg_ec2" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `security_group_id` - (Required) The ID of the security group to be associated with the VPC endpoint.
 * `vpc_endpoint_id` - (Required) The ID of the VPC endpoint with which the security group will be associated.
 * `replace_default_association` - (Optional) Whether this association should replace the association with the VPC's default security group that is created when no security groups are specified during VPC endpoint creation. At most 1 association per-VPC endpoint should be configured with `replace_default_association = true`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the association.
diff --git a/website/docs/r/vpc_endpoint_service.html.markdown b/website/docs/r/vpc_endpoint_service.html.markdown
index f9b548b4958..fcdf49277a8 100644
--- a/website/docs/r/vpc_endpoint_service.html.markdown
+++ b/website/docs/r/vpc_endpoint_service.html.markdown
@@ -39,7 +39,7 @@ resource "aws_vpc_endpoint_service" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `acceptance_required` - (Required) Whether or not VPC endpoint connection requests to the service must be accepted by the service owner - `true` or `false`.
 * `allowed_principals` - (Optional) The ARNs of one or more principals allowed to discover the endpoint service.
@@ -49,9 +49,9 @@ The following arguments are supported:
 * `private_dns_name` - (Optional) The private DNS name for the service.
 * `supported_ip_address_types` - (Optional) The supported IP address types. The possible values are `ipv4` and `ipv6`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the VPC endpoint service.
 * `availability_zones` - A set of Availability Zones in which the service is available.
@@ -70,8 +70,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-VPC Endpoint Services can be imported using the `VPC endpoint service id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import VPC Endpoint Services using the VPC endpoint service `id`. For example:
 
+```terraform
+import {
+  to = aws_vpc_endpoint_service.foo
+  id = "vpce-svc-0f97a19d3fa8220bc"
+}
 ```
-$ terraform import aws_vpc_endpoint_service.foo vpce-svc-0f97a19d3fa8220bc
+
+Using `terraform import`, import VPC Endpoint Services using the VPC endpoint service `id`. For example:
+
+```console
+% terraform import aws_vpc_endpoint_service.foo vpce-svc-0f97a19d3fa8220bc
 ```
diff --git a/website/docs/r/vpc_endpoint_service_allowed_principal.html.markdown b/website/docs/r/vpc_endpoint_service_allowed_principal.html.markdown
index ea120e45f3f..be6884759e6 100644
--- a/website/docs/r/vpc_endpoint_service_allowed_principal.html.markdown
+++ b/website/docs/r/vpc_endpoint_service_allowed_principal.html.markdown
@@ -31,13 +31,13 @@ resource "aws_vpc_endpoint_service_allowed_principal" "allow_me_to_foo" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `vpc_endpoint_service_id` - (Required) The ID of the VPC endpoint service to allow permission.
 * `principal_arn` - (Required) The ARN of the principal to allow permissions.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the association.
diff --git a/website/docs/r/vpc_endpoint_subnet_association.html.markdown b/website/docs/r/vpc_endpoint_subnet_association.html.markdown
index 08977614e5a..9887ba84dff 100644
--- a/website/docs/r/vpc_endpoint_subnet_association.html.markdown
+++ b/website/docs/r/vpc_endpoint_subnet_association.html.markdown
@@ -29,14 +29,14 @@ resource "aws_vpc_endpoint_subnet_association" "sn_ec2" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `vpc_endpoint_id` - (Required) The ID of the VPC endpoint with which the subnet will be associated.
 * `subnet_id` - (Required) The ID of the subnet to be associated with the VPC endpoint.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the association.
 
@@ -49,9 +49,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-VPC Endpoint Subnet Associations can be imported using `vpc_endpoint_id` together with `subnet_id`,
-e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import VPC Endpoint Subnet Associations using `vpc_endpoint_id` together with `subnet_id`. For example:
 
+```terraform
+import {
+  to = aws_vpc_endpoint_subnet_association.example
+  id = "vpce-aaaaaaaa/subnet-bbbbbbbbbbbbbbbbb"
+}
 ```
-$ terraform import aws_vpc_endpoint_subnet_association.example vpce-aaaaaaaa/subnet-bbbbbbbbbbbbbbbbb
+
+Using `terraform import`, import VPC Endpoint Subnet Associations using `vpc_endpoint_id` together with `subnet_id`. For example:
+
+```console
+% terraform import aws_vpc_endpoint_subnet_association.example vpce-aaaaaaaa/subnet-bbbbbbbbbbbbbbbbb
 ```
diff --git a/website/docs/r/vpc_ipam.html.markdown b/website/docs/r/vpc_ipam.html.markdown
index a7a19a5adb9..4dc6140282a 100644
--- a/website/docs/r/vpc_ipam.html.markdown
+++ b/website/docs/r/vpc_ipam.html.markdown
@@ -57,7 +57,7 @@ locals {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `description` - (Optional) A description for the IPAM.
 * `operating_regions` - (Required) Determines which locales can be chosen when you create pools. Locale is the Region where you want to make an IPAM pool available for allocations. You can only create pools with locales that match the operating Regions of the IPAM. You can only create VPCs from a pool whose locale matches the VPC's Region. You specify a region using the [region_name](#operating_regions) parameter. You **must** set your provider block region as an operating_region.
@@ -68,9 +68,9 @@ The following arguments are supported:
 
 * `region_name` - (Required) The name of the Region you want to add to the IPAM.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name (ARN) of IPAM
 * `id` - The ID of the IPAM
@@ -84,8 +84,17 @@ IP space. The public scope is intended for all internet-routable IP space.
 
 ## Import
 
-IPAMs can be imported using the `ipam id`, e.g.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IPAMs using the IPAM `id`. For example:
 
+```terraform
+import {
+  to = aws_vpc_ipam.example
+  id = "ipam-0178368ad2146a492"
+}
 ```
-$ terraform import aws_vpc_ipam.example ipam-0178368ad2146a492
+
+Using `terraform import`, import IPAMs using the IPAM `id`. For example:
+
+```console
+% terraform import aws_vpc_ipam.example ipam-0178368ad2146a492
 ```
diff --git a/website/docs/r/vpc_ipam_organization_admin_account.html.markdown b/website/docs/r/vpc_ipam_organization_admin_account.html.markdown
index a48b33828d6..bf52bd6e0d7 100644
--- a/website/docs/r/vpc_ipam_organization_admin_account.html.markdown
+++ b/website/docs/r/vpc_ipam_organization_admin_account.html.markdown
@@ -32,13 +32,13 @@ provider "aws" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `delegated_admin_account_id` - (Required)
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The Organizations ARN for the delegate account.
 * `id` - The Organizations member account ID that you want to enable as the IPAM account.
@@ -48,8 +48,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-IPAMs can be imported using the `delegate account id`, e.g.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IPAMs using the delegate account `id`. For example:
 
+```terraform
+import {
+  to = aws_vpc_ipam_organization_admin_account.example
+  id = "12345678901"
+}
 ```
-$ terraform import aws_vpc_ipam_organization_admin_account.example 12345678901
+
+Using `terraform import`, import IPAMs using the delegate account `id`. For example:
+
+```console
+% terraform import aws_vpc_ipam_organization_admin_account.example 12345678901
 ```
diff --git a/website/docs/r/vpc_ipam_pool.html.markdown b/website/docs/r/vpc_ipam_pool.html.markdown
index 67e4e5ae406..de0aee30aed 100644
--- a/website/docs/r/vpc_ipam_pool.html.markdown
+++ b/website/docs/r/vpc_ipam_pool.html.markdown
@@ -48,7 +48,7 @@ resource "aws_vpc_ipam_pool" "parent" {
 
 resource "aws_vpc_ipam_pool_cidr" "parent_test" {
   ipam_pool_id = aws_vpc_ipam_pool.parent.id
-  cidr         = "172.2.0.0/16"
+  cidr         = "172.20.0.0/16"
 }
 
 resource "aws_vpc_ipam_pool" "child" {
@@ -61,13 +61,13 @@ resource "aws_vpc_ipam_pool" "child" {
 
 resource "aws_vpc_ipam_pool_cidr" "child_test" {
   ipam_pool_id = aws_vpc_ipam_pool.child.id
-  cidr         = "172.2.0.0/24"
+  cidr         = "172.20.0.0/24"
 }
 ```
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `address_family` - (Optional) The IP protocol assigned to this pool. You must choose either IPv4 or IPv6 protocol for a pool.
 * `allocation_default_netmask_length` - (Optional) A default netmask length for allocations added to this pool. If, for example, the CIDR assigned to this pool is 10.0.0.0/8 and you enter 16 here, new allocations will default to 10.0.0.0/16 (unless you provide a different netmask value when you create the new allocation).
@@ -85,9 +85,9 @@ within the CIDR range in the pool.
 * `source_ipam_pool_id` - (Optional) The ID of the source IPAM pool. Use this argument to create a child pool within an existing pool.
 * `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name (ARN) of IPAM
 * `id` - The ID of the IPAM
@@ -96,8 +96,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-IPAMs can be imported using the `ipam pool id`, e.g.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IPAMs using the IPAM pool `id`. For example:
 
+```terraform
+import {
+  to = aws_vpc_ipam_pool.example
+  id = "ipam-pool-0958f95207d978e1e"
+}
 ```
-$ terraform import aws_vpc_ipam_pool.example ipam-pool-0958f95207d978e1e
+
+Using `terraform import`, import IPAMs using the IPAM pool `id`. For example:
+
+```console
+% terraform import aws_vpc_ipam_pool.example ipam-pool-0958f95207d978e1e
 ```
diff --git a/website/docs/r/vpc_ipam_pool_cidr.html.markdown b/website/docs/r/vpc_ipam_pool_cidr.html.markdown
index d6502554d20..024937fa8ef 100644
--- a/website/docs/r/vpc_ipam_pool_cidr.html.markdown
+++ b/website/docs/r/vpc_ipam_pool_cidr.html.markdown
@@ -36,7 +36,7 @@ resource "aws_vpc_ipam_pool" "example" {
 
 resource "aws_vpc_ipam_pool_cidr" "example" {
   ipam_pool_id = aws_vpc_ipam_pool.example.id
-  cidr         = "172.2.0.0/16"
+  cidr         = "172.20.0.0/16"
 }
 ```
 
@@ -56,23 +56,21 @@ resource "aws_vpc_ipam_pool" "ipv6_test_public" {
   ipam_scope_id  = aws_vpc_ipam.example.public_default_scope_id
   locale         = "us-east-1"
   description    = "public ipv6"
-  advertisable   = false
-  aws_service    = "ec2"
+
+  publicly_advertisable = false
+  public_ip_source      = "amazon"
+  aws_service           = "ec2"
 }
 
 resource "aws_vpc_ipam_pool_cidr" "ipv6_test_public" {
-  ipam_pool_id = aws_vpc_ipam_pool.ipv6_test_public.id
-  cidr         = var.ipv6_cidr
-  cidr_authorization_context {
-    message   = var.message
-    signature = var.signature
-  }
+  ipam_pool_id   = aws_vpc_ipam_pool.ipv6_test_public.id
+  netmask_length = 52
 }
 ```
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `cidr` - (Optional) The CIDR you want to assign to the pool. Conflicts with `netmask_length`.
 * `cidr_authorization_context` - (Optional) A signed document that proves that you are authorized to bring the specified IP address range to Amazon using BYOIP. This is not stored in the state file. See [cidr_authorization_context](#cidr_authorization_context) for more information.
@@ -84,17 +82,30 @@ The following arguments are supported:
 * `message` - (Optional) The plain-text authorization message for the prefix and account.
 * `signature` - (Optional) The signed authorization message for the prefix and account.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the IPAM Pool Cidr concatenated with the IPAM Pool ID.
 * `ipam_pool_cidr_id` - The unique ID generated by AWS for the pool cidr. Typically this is the resource `id` but this attribute was added to the API calls after the fact and is therefore not used as the terraform resource id.
 
 ## Import
 
-IPAMs can be imported using the `<cidr>_<ipam-pool-id>`. Please note we **DO NOT** use the ipam pool cidr id as this was introduced after the resource already existed. An import example:
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IPAMs using the `<cidr>_<ipam-pool-id>`. For example:
 
+**NOTE:** Do not use the IPAM Pool Cidr ID as this was introduced after the resource already existed.
+
+```terraform
+import {
+  to = aws_vpc_ipam_pool_cidr.example
+  id = "172.20.0.0/24_ipam-pool-0e634f5a1517cccdc"
+}
 ```
-$ terraform import aws_vpc_ipam_pool_cidr.example 172.2.0.0/24_ipam-pool-0e634f5a1517cccdc
+
+Using `terraform import`, import IPAMs using the `<cidr>_<ipam-pool-id>`. For example:
+
+**NOTE:** Do not use the IPAM Pool Cidr ID as this was introduced after the resource already existed.
+
+```console
+% terraform import aws_vpc_ipam_pool_cidr.example 172.20.0.0/24_ipam-pool-0e634f5a1517cccdc
 ```
diff --git a/website/docs/r/vpc_ipam_pool_cidr_allocation.html.markdown b/website/docs/r/vpc_ipam_pool_cidr_allocation.html.markdown
index faf92505f33..f57b56ce788 100644
--- a/website/docs/r/vpc_ipam_pool_cidr_allocation.html.markdown
+++ b/website/docs/r/vpc_ipam_pool_cidr_allocation.html.markdown
@@ -19,7 +19,7 @@ data "aws_region" "current" {}
 
 resource "aws_vpc_ipam_pool_cidr_allocation" "example" {
   ipam_pool_id = aws_vpc_ipam_pool.example.id
-  cidr         = "172.2.0.0/24"
+  cidr         = "172.20.0.0/24"
   depends_on = [
     aws_vpc_ipam_pool_cidr.example
   ]
@@ -27,7 +27,7 @@ resource "aws_vpc_ipam_pool_cidr_allocation" "example" {
 
 resource "aws_vpc_ipam_pool_cidr" "example" {
   ipam_pool_id = aws_vpc_ipam_pool.example.id
-  cidr         = "172.2.0.0/16"
+  cidr         = "172.20.0.0/16"
 }
 
 resource "aws_vpc_ipam_pool" "example" {
@@ -53,7 +53,7 @@ resource "aws_vpc_ipam_pool_cidr_allocation" "example" {
   netmask_length = 28
 
   disallowed_cidrs = [
-    "172.2.0.0/28"
+    "172.20.0.0/28"
   ]
 
   depends_on = [
@@ -63,7 +63,7 @@ resource "aws_vpc_ipam_pool_cidr_allocation" "example" {
 
 resource "aws_vpc_ipam_pool_cidr" "example" {
   ipam_pool_id = aws_vpc_ipam_pool.example.id
-  cidr         = "172.2.0.0/16"
+  cidr         = "172.20.0.0/16"
 }
 
 resource "aws_vpc_ipam_pool" "example" {
@@ -81,7 +81,7 @@ resource "aws_vpc_ipam" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `cidr` - (Optional) The CIDR you want to assign to the pool.
 * `description` - (Optional) The description for the allocation.
@@ -89,9 +89,9 @@ The following arguments are supported:
 * `ipam_pool_id` - (Required) The ID of the pool to which you want to assign a CIDR.
 * `netmask_length` - (Optional) The netmask length of the CIDR you would like to allocate to the IPAM pool. Valid Values: `0-128`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the allocation.
 * `resource_id` - The ID of the resource.
@@ -100,8 +100,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-IPAM allocations can be imported using the `allocation id` and `pool id`, separated by `_`, e.g.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IPAM allocations using the allocation `id` and `pool id`, separated by `_`. For example:
 
+```terraform
+import {
+  to = aws_vpc_ipam_pool_cidr_allocation.example
+  id = "ipam-pool-alloc-0dc6d196509c049ba8b549ff99f639736_ipam-pool-07cfb559e0921fcbe"
+}
 ```
-$ terraform import aws_vpc_ipam_pool_cidr_allocation.example ipam-pool-alloc-0dc6d196509c049ba8b549ff99f639736_ipam-pool-07cfb559e0921fcbe
+
+Using `terraform import`, import IPAM allocations using the allocation `id` and `pool id`, separated by `_`. For example:
+
+```console
+% terraform import aws_vpc_ipam_pool_cidr_allocation.example ipam-pool-alloc-0dc6d196509c049ba8b549ff99f639736_ipam-pool-07cfb559e0921fcbe
 ```
diff --git a/website/docs/r/vpc_ipam_preview_next_cidr.html.markdown b/website/docs/r/vpc_ipam_preview_next_cidr.html.markdown
index 3b71041ffb4..9a0ce5f06f6 100644
--- a/website/docs/r/vpc_ipam_preview_next_cidr.html.markdown
+++ b/website/docs/r/vpc_ipam_preview_next_cidr.html.markdown
@@ -32,7 +32,7 @@ resource "aws_vpc_ipam_preview_next_cidr" "example" {
 
 resource "aws_vpc_ipam_pool_cidr" "example" {
   ipam_pool_id = aws_vpc_ipam_pool.example.id
-  cidr         = "172.2.0.0/16"
+  cidr         = "172.20.0.0/16"
 }
 
 resource "aws_vpc_ipam_pool" "example" {
@@ -50,15 +50,15 @@ resource "aws_vpc_ipam" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `disallowed_cidrs` - (Optional) Exclude a particular CIDR range from being returned by the pool.
 * `ipam_pool_id` - (Required) The ID of the pool to which you want to assign a CIDR.
 * `netmask_length` - (Optional) The netmask length of the CIDR you would like to preview from the IPAM pool.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `cidr` - The previewed CIDR from the pool.
 * `id` - The ID of the preview.
diff --git a/website/docs/r/vpc_ipam_resource_discovery.html.markdown b/website/docs/r/vpc_ipam_resource_discovery.html.markdown
index c3b4bba9e78..4ef97253904 100644
--- a/website/docs/r/vpc_ipam_resource_discovery.html.markdown
+++ b/website/docs/r/vpc_ipam_resource_discovery.html.markdown
@@ -31,7 +31,7 @@ resource "aws_vpc_ipam_resource_discovery" "main" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `description` - (Optional) A description for the IPAM Resource Discovery.
 * `operating_regions` - (Required) Determines which regions the Resource Discovery will enable IPAM features for usage and monitoring. Locale is the Region where you want to make an IPAM pool available for allocations. You can only create pools with locales that match the operating Regions of the IPAM Resource Discovery. You can only create VPCs from a pool whose locale matches the VPC's Region. You specify a region using the [region_name](#operating_regions) parameter. **You must set your provider block region as an operating_region.**
@@ -41,9 +41,9 @@ The following arguments are supported:
 
 * `region_name` - (Required) The name of the Region you want to add to the IPAM.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name (ARN) of IPAM Resource Discovery
 * `id` - The ID of the IPAM Resource Discovery
@@ -54,8 +54,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-IPAMs can be imported using the `ipam resource discovery id`, e.g.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IPAMs using the IPAM resource discovery `id`. For example:
 
+```terraform
+import {
+  to = aws_vpc_ipam_resource_discovery.example
+  id = "ipam-res-disco-0178368ad2146a492"
+}
 ```
-$ terraform import aws_vpc_ipam_resource_discovery.example ipam-res-disco-0178368ad2146a492
+
+Using `terraform import`, import IPAMs using the IPAM resource discovery `id`. For example:
+
+```console
+% terraform import aws_vpc_ipam_resource_discovery.example ipam-res-disco-0178368ad2146a492
 ```
diff --git a/website/docs/r/vpc_ipam_resource_discovery_association.html.markdown b/website/docs/r/vpc_ipam_resource_discovery_association.html.markdown
index e8359bc2df6..2fd649b2cbc 100644
--- a/website/docs/r/vpc_ipam_resource_discovery_association.html.markdown
+++ b/website/docs/r/vpc_ipam_resource_discovery_association.html.markdown
@@ -29,15 +29,15 @@ resource "aws_vpc_ipam_resource_discovery_association" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `ipam_id` - (Required) The ID of the IPAM to associate.
 * `ipam_resource_discovery_id` - (Required) The ID of the Resource Discovery to associate.
 * `tags` - (Optional) A map of tags to add to the IPAM resource discovery association resource.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The Amazon Resource Name (ARN) of IPAM Resource Discovery Association.
 * `id` - The ID of the IPAM Resource Discovery Association.
@@ -50,8 +50,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-IPAMs can be imported using the `ipam resource discovery association id`, e.g.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IPAMs using the IPAM resource discovery association `id`. For example:
 
+```terraform
+import {
+  to = aws_vpc_ipam_resource_discovery_association.example
+  id = "ipam-res-disco-assoc-0178368ad2146a492"
+}
 ```
-$ terraform import aws_vpc_ipam_resource_discovery_association.example ipam-res-disco-assoc-0178368ad2146a492
+
+Using `terraform import`, import IPAMs using the IPAM resource discovery association `id`. For example:
+
+```console
+% terraform import aws_vpc_ipam_resource_discovery_association.example ipam-res-disco-assoc-0178368ad2146a492
 ```
diff --git a/website/docs/r/vpc_ipam_scope.html.markdown b/website/docs/r/vpc_ipam_scope.html.markdown
index f5a02d2549d..cc0f5586bf0 100644
--- a/website/docs/r/vpc_ipam_scope.html.markdown
+++ b/website/docs/r/vpc_ipam_scope.html.markdown
@@ -31,15 +31,15 @@ resource "aws_vpc_ipam_scope" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `ipam_id` - The ID of the IPAM for which you're creating this scope.
 * `description` - (Optional) A description for the scope you're creating.
 * `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The Amazon Resource Name (ARN) of the scope.
 * `id` - The ID of the IPAM Scope.
@@ -50,8 +50,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-IPAMs can be imported using the `scope_id`, e.g.
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import IPAMs using the `scope_id`. For example:
 
+```terraform
+import {
+  to = aws_vpc_ipam_scope.example
+  id = "ipam-scope-0513c69f283d11dfb"
+}
 ```
-$ terraform import aws_vpc_ipam_scope.example ipam-scope-0513c69f283d11dfb
+
+Using `terraform import`, import IPAMs using the `scope_id`. For example:
+
+```console
+% terraform import aws_vpc_ipam_scope.example ipam-scope-0513c69f283d11dfb
 ```
diff --git a/website/docs/r/vpc_ipv4_cidr_block_association.html.markdown b/website/docs/r/vpc_ipv4_cidr_block_association.html.markdown
index 5d7be3c0cf5..3a37437c271 100644
--- a/website/docs/r/vpc_ipv4_cidr_block_association.html.markdown
+++ b/website/docs/r/vpc_ipv4_cidr_block_association.html.markdown
@@ -22,22 +22,22 @@ resource "aws_vpc" "main" {
 
 resource "aws_vpc_ipv4_cidr_block_association" "secondary_cidr" {
   vpc_id     = aws_vpc.main.id
-  cidr_block = "172.2.0.0/16"
+  cidr_block = "172.20.0.0/16"
 }
 ```
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `cidr_block` - (Optional) The IPv4 CIDR block for the VPC. CIDR can be explicitly set or it can be derived from IPAM using `ipv4_netmask_length`.
 * `ipv4_ipam_pool_id` - (Optional) The ID of an IPv4 IPAM pool you want to use for allocating this VPC's CIDR. IPAM is a VPC feature that you can use to automate your IP address management workflows including assigning, tracking, troubleshooting, and auditing IP addresses across AWS Regions and accounts. Using IPAM you can monitor IP address usage throughout your AWS Organization.
 * `ipv4_netmask_length` - (Optional) The netmask length of the IPv4 CIDR you want to allocate to this VPC. Requires specifying a `ipv4_ipam_pool_id`.
 * `vpc_id` - (Required) The ID of the VPC to make the association with.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the VPC CIDR association
 
@@ -50,8 +50,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-`aws_vpc_ipv4_cidr_block_association` can be imported by using the VPC CIDR Association ID, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_vpc_ipv4_cidr_block_association` using the VPC CIDR Association ID. For example:
 
+```terraform
+import {
+  to = aws_vpc_ipv4_cidr_block_association.example
+  id = "vpc-cidr-assoc-xxxxxxxx"
+}
 ```
-$ terraform import aws_vpc_ipv4_cidr_block_association.example vpc-cidr-assoc-xxxxxxxx
+
+Using `terraform import`, import `aws_vpc_ipv4_cidr_block_association` using the VPC CIDR Association ID. For example:
+
+```console
+% terraform import aws_vpc_ipv4_cidr_block_association.example vpc-cidr-assoc-xxxxxxxx
 ```
diff --git a/website/docs/r/vpc_ipv6_cidr_block_association.html.markdown b/website/docs/r/vpc_ipv6_cidr_block_association.html.markdown
index a33589f674b..e11ebc8da37 100644
--- a/website/docs/r/vpc_ipv6_cidr_block_association.html.markdown
+++ b/website/docs/r/vpc_ipv6_cidr_block_association.html.markdown
@@ -27,9 +27,9 @@ resource "aws_vpc_ipv6_cidr_block_association" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
-* `ipv6_cidr_block` - (Optional) The IPv6 CIDR block for the VPC. CIDR can be explicitly set or it can be derived from IPAM using `ipv6_netmask_length`. This parameter is required if `ipv6_netmask_length` is not set and he IPAM pool does not have `allocation_default_netmask` set.
+* `ipv6_cidr_block` - (Optional) The IPv6 CIDR block for the VPC. CIDR can be explicitly set or it can be derived from IPAM using `ipv6_netmask_length`. This parameter is required if `ipv6_netmask_length` is not set and the IPAM pool does not have `allocation_default_netmask` set.
 * `ipv6_ipam_pool_id` - (Required) The ID of an IPv6 IPAM pool you want to use for allocating this VPC's CIDR. IPAM is a VPC feature that you can use to automate your IP address management workflows including assigning, tracking, troubleshooting, and auditing IP addresses across AWS Regions and accounts.
 * `ipv6_netmask_length` - (Optional) The netmask length of the IPv6 CIDR you want to allocate to this VPC. Requires specifying a `ipv6_ipam_pool_id`. This parameter is optional if the IPAM pool has `allocation_default_netmask` set, otherwise it or `cidr_block` are required
 * `vpc_id` - (Required) The ID of the VPC to make the association with.
@@ -41,16 +41,25 @@ The following arguments are supported:
 - `create` - (Default `10m`)
 - `delete` - (Default `10m`)
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the VPC CIDR association
 
 ## Import
 
-`aws_vpc_ipv6_cidr_block_association` can be imported by using the VPC CIDR Association ID, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_vpc_ipv6_cidr_block_association` using the VPC CIDR Association ID. For example:
 
+```terraform
+import {
+  to = aws_vpc_ipv6_cidr_block_association.example
+  id = "vpc-cidr-assoc-xxxxxxxx"
+}
 ```
-$ terraform import aws_vpc_ipv6_cidr_block_association.example vpc-cidr-assoc-xxxxxxxx
+
+Using `terraform import`, import `aws_vpc_ipv6_cidr_block_association` using the VPC CIDR Association ID. For example:
+
+```console
+% terraform import aws_vpc_ipv6_cidr_block_association.example vpc-cidr-assoc-xxxxxxxx
 ```
diff --git a/website/docs/r/vpc_network_performance_metric_subscription.html.markdown b/website/docs/r/vpc_network_performance_metric_subscription.html.markdown
index 0ca80665037..eda014fab3f 100644
--- a/website/docs/r/vpc_network_performance_metric_subscription.html.markdown
+++ b/website/docs/r/vpc_network_performance_metric_subscription.html.markdown
@@ -21,15 +21,15 @@ resource "aws_vpc_network_performance_metric_subscription" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `destination` - (Required) The target Region or Availability Zone that the metric subscription is enabled for. For example, `eu-west-1`.
 * `metric` - (Optional) The metric used for the enabled subscription. Valid values: `aggregate-latency`. Default: `aggregate-latency`.
 * `source` - (Required) The source Region or Availability Zone that the metric subscription is enabled for. For example, `us-east-1`.
 * `statistic` - (Optional) The statistic used for the enabled subscription. Valid values: `p50`. Default: `p50`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `period` - The data aggregation time for the subscription.
diff --git a/website/docs/r/vpc_peering_connection.html.markdown b/website/docs/r/vpc_peering_connection.html.markdown
index 64a0983d9a8..afc68f2505c 100644
--- a/website/docs/r/vpc_peering_connection.html.markdown
+++ b/website/docs/r/vpc_peering_connection.html.markdown
@@ -103,7 +103,7 @@ can be done using the [`auto_accept`](vpc_peering_connection.html#auto_accept) a
 Connection has to be made active manually using other means. See [notes](vpc_peering_connection.html#notes) below for
 more information.
 
-The following arguments are supported:
+This argument supports the following arguments:
 
 * `peer_owner_id` - (Optional) The AWS account ID of the owner of the peer VPC.
    Defaults to the account ID the [AWS provider][1] is currently connected to.
@@ -126,9 +126,9 @@ must have support for the DNS hostnames enabled. This can be done using the [`en
 * `allow_remote_vpc_dns_resolution` - (Optional) Allow a local VPC to resolve public DNS hostnames to
 private IP addresses when queried from instances in the peer VPC.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the VPC Peering Connection.
 * `accept_status` - The status of the VPC Peering Connection request.
@@ -150,10 +150,19 @@ or accept the connection manually using the AWS Management Console, AWS CLI, thr
 
 ## Import
 
-VPC Peering resources can be imported using the `vpc peering id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import VPC Peering resources using the VPC peering `id`. For example:
 
-```sh
-$ terraform import aws_vpc_peering_connection.test_connection pcx-111aaa111
+```terraform
+import {
+  to = aws_vpc_peering_connection.test_connection
+  id = "pcx-111aaa111"
+}
+```
+
+Using `terraform import`, import VPC Peering resources using the VPC peering `id`. For example:
+
+```console
+% terraform import aws_vpc_peering_connection.test_connection pcx-111aaa111
 ```
 
 [1]: /docs/providers/aws/index.html
diff --git a/website/docs/r/vpc_peering_connection_accepter.html.markdown b/website/docs/r/vpc_peering_connection_accepter.html.markdown
index 1b4f0671ee8..1193128c4ef 100644
--- a/website/docs/r/vpc_peering_connection_accepter.html.markdown
+++ b/website/docs/r/vpc_peering_connection_accepter.html.markdown
@@ -73,7 +73,7 @@ resource "aws_vpc_peering_connection_accepter" "peer" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `vpc_peering_connection_id` - (Required) The VPC Peering Connection ID to manage.
 * `auto_accept` - (Optional) Whether or not to accept the peering request. Defaults to `false`.
@@ -87,9 +87,9 @@ by removing the corresponding `aws_vpc_peering_connection` resource from your co
 Removing a `aws_vpc_peering_connection_accepter` resource from your configuration will remove it
 from your statefile and management, **but will not destroy the VPC Peering Connection.**
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the VPC Peering Connection.
 * `accept_status` - The status of the VPC Peering Connection request.
@@ -103,20 +103,29 @@ In addition to all arguments above, the following attributes are exported:
 (https://docs.aws.amazon.com/vpc/latest/peering/what-is-vpc-peering.html) options set for the requester VPC.
 * `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
 
-#### Accepter and Requester Attributes Reference
+#### Accepter and Requester Attribute Reference
 
 * `allow_remote_vpc_dns_resolution` - Indicates whether a local VPC can resolve public DNS hostnames to
 private IP addresses when queried from instances in a peer VPC.
 
 ## Import
 
-VPC Peering Connection Accepters can be imported by using the Peering Connection ID, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import VPC Peering Connection Accepters using the Peering Connection ID. For example:
 
-```sh
-$ terraform import aws_vpc_peering_connection_accepter.example pcx-12345678
+```terraform
+import {
+  to = aws_vpc_peering_connection_accepter.example
+  id = "pcx-12345678"
+}
+```
+
+Using `terraform import`, import VPC Peering Connection Accepters using the Peering Connection ID. For example:
+
+```console
+% terraform import aws_vpc_peering_connection_accepter.example pcx-12345678
 ```
 
-Certain resource arguments, like `auto_accept`, do not have an EC2 API method for reading the information after peering connection creation. If the argument is set in the Terraform configuration on an imported resource, Terraform will always show a difference. To workaround this behavior, either omit the argument from the Terraform configuration or use [`ignore_changes`](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html#ignore_changes) to hide the difference, e.g.,
+Certain resource arguments, like `auto_accept`, do not have an EC2 API method for reading the information after peering connection creation. If the argument is set in the Terraform configuration on an imported resource, Terraform will always show a difference. To workaround this behavior, either omit the argument from the Terraform configuration or use [`ignore_changes`](https://www.terraform.io/docs/configuration/meta-arguments/lifecycle.html#ignore_changes) to hide the difference. For example:
 
 ```terraform
 resource "aws_vpc_peering_connection_accepter" "example" {
diff --git a/website/docs/r/vpc_peering_connection_options.html.markdown b/website/docs/r/vpc_peering_connection_options.html.markdown
index 33a1a7409e1..4a48b5f959f 100644
--- a/website/docs/r/vpc_peering_connection_options.html.markdown
+++ b/website/docs/r/vpc_peering_connection_options.html.markdown
@@ -135,7 +135,7 @@ resource "aws_vpc_peering_connection_options" "accepter" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `vpc_peering_connection_id` - (Required) The ID of the requester VPC peering connection.
 * `accepter` (Optional) - An optional configuration block that allows for [VPC Peering Connection](https://docs.aws.amazon.com/vpc/latest/peering/what-is-vpc-peering.html) options to be set for the VPC that acceptsthe peering connection (a maximum of one).
@@ -147,16 +147,25 @@ The following arguments are supported:
 
 * `allow_remote_vpc_dns_resolution` - (Optional) Allow a local VPC to resolve public DNS hostnames to private IP addresses when queried from instances in the peer VPC.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the VPC Peering Connection Options.
 
 ## Import
 
-VPC Peering Connection Options can be imported using the `vpc peering id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import VPC Peering Connection Options using the VPC peering `id`. For example:
 
+```terraform
+import {
+  to = aws_vpc_peering_connection_options.foo
+  id = "pcx-111aaa111"
+}
 ```
-$ terraform import aws_vpc_peering_connection_options.foo pcx-111aaa111
+
+Using `terraform import`, import VPC Peering Connection Options using the VPC peering `id`. For example:
+
+```console
+% terraform import aws_vpc_peering_connection_options.foo pcx-111aaa111
 ```
diff --git a/website/docs/r/vpc_security_group_egress_rule.html.markdown b/website/docs/r/vpc_security_group_egress_rule.html.markdown
index f3250f0aad0..206cfecd4b4 100644
--- a/website/docs/r/vpc_security_group_egress_rule.html.markdown
+++ b/website/docs/r/vpc_security_group_egress_rule.html.markdown
@@ -26,13 +26,15 @@ resource "aws_vpc_security_group_egress_rule" "example" {
   cidr_ipv4   = "10.0.0.0/8"
   from_port   = 80
   ip_protocol = "tcp"
-  to_port     = 8080
+  to_port     = 80
 }
 ```
 
 ## Argument Reference
 
-The following arguments are supported:
+~> **Note** Although `cidr_ipv4`, `cidr_ipv6`, `prefix_list_id`, and `referenced_security_group_id` are all marked as optional, you *must* provide one of them in order to configure the destination of the traffic. The `from_port` and `to_port` arguments are required unless `ip_protocol` is set to `-1` or `icmpv6`.
+
+This argument supports the following arguments:
 
 * `cidr_ipv4` - (Optional) The destination IPv4 CIDR range.
 * `cidr_ipv6` - (Optional) The destination IPv6 CIDR range.
@@ -45,9 +47,9 @@ The following arguments are supported:
 * `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 * `to_port` - (Optional) The end of port range for the TCP and UDP protocols, or an ICMP/ICMPv6 code.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The Amazon Resource Name (ARN) of the security group rule.
 * `security_group_rule_id` - The ID of the security group rule.
@@ -55,8 +57,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Security group egress rules can be imported using the `security_group_rule_id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import security group egress rules using the `security_group_rule_id`. For example:
 
+```terraform
+import {
+  to = aws_vpc_security_group_egress_rule.example
+  id = "sgr-02108b27edd666983"
+}
 ```
-$ terraform import aws_vpc_security_group_egress_rule.example sgr-02108b27edd666983
+
+Using `terraform import`, import security group egress rules using the `security_group_rule_id`. For example:
+
+```console
+% terraform import aws_vpc_security_group_egress_rule.example sgr-02108b27edd666983
 ```
diff --git a/website/docs/r/vpc_security_group_ingress_rule.html.markdown b/website/docs/r/vpc_security_group_ingress_rule.html.markdown
index 97ae7a47603..79c94ceb53c 100644
--- a/website/docs/r/vpc_security_group_ingress_rule.html.markdown
+++ b/website/docs/r/vpc_security_group_ingress_rule.html.markdown
@@ -26,28 +26,30 @@ resource "aws_vpc_security_group_ingress_rule" "example" {
   cidr_ipv4   = "10.0.0.0/8"
   from_port   = 80
   ip_protocol = "tcp"
-  to_port     = 8080
+  to_port     = 80
 }
 ```
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
+
+~> **Note** Although `cidr_ipv4`, `cidr_ipv6`, `prefix_list_id`, and `referenced_security_group_id` are all marked as optional, you *must* provide one of them in order to configure the destination of the traffic. The `from_port` and `to_port` arguments are required unless `ip_protocol` is set to `-1` or `icmpv6`.
 
 * `cidr_ipv4` - (Optional) The source IPv4 CIDR range.
 * `cidr_ipv6` - (Optional) The source IPv6 CIDR range.
 * `description` - (Optional) The security group rule description.
 * `from_port` - (Optional) The start of port range for the TCP and UDP protocols, or an ICMP/ICMPv6 type.
-* `ip_protocol` - (Optional) The IP protocol name or number. Use `-1` to specify all protocols. Note that if `ip_protocol` is set to `-1`, it translates to all protocols, all port ranges, and `from_port` and `to_port` values should not be defined.
+* `ip_protocol` - (Required) The IP protocol name or number. Use `-1` to specify all protocols. Note that if `ip_protocol` is set to `-1`, it translates to all protocols, all port ranges, and `from_port` and `to_port` values should not be defined.
 * `prefix_list_id` - (Optional) The ID of the source prefix list.
 * `referenced_security_group_id` - (Optional) The source security group that is referenced in the rule.
 * `security_group_id` - (Required) The ID of the security group.
 * `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 * `to_port` - (Optional) The end of port range for the TCP and UDP protocols, or an ICMP/ICMPv6 code.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The Amazon Resource Name (ARN) of the security group rule.
 * `security_group_rule_id` - The ID of the security group rule.
@@ -55,8 +57,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Security group ingress rules can be imported using the `security_group_rule_id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import security group ingress rules using the `security_group_rule_id`. For example:
 
+```terraform
+import {
+  to = aws_vpc_security_group_ingress_rule.example
+  id = "sgr-02108b27edd666983"
+}
 ```
-$ terraform import aws_vpc_security_group_ingress_rule.example sgr-02108b27edd666983
+
+Using `terraform import`, import security group ingress rules using the `security_group_rule_id`. For example:
+
+```console
+% terraform import aws_vpc_security_group_ingress_rule.example sgr-02108b27edd666983
 ```
diff --git a/website/docs/r/vpclattice_access_log_subscription.html.markdown b/website/docs/r/vpclattice_access_log_subscription.html.markdown
index 3d8a189651a..6f272705101 100644
--- a/website/docs/r/vpclattice_access_log_subscription.html.markdown
+++ b/website/docs/r/vpclattice_access_log_subscription.html.markdown
@@ -28,20 +28,27 @@ The following arguments are required:
 * `destination_arn` - (Required) Amazon Resource Name (ARN) of the log destination.
 * `resource_identifier` - (Required) The ID or Amazon Resource Identifier (ARN) of the service network or service. You must use the ARN if the resources specified in the operation are in different accounts.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - ID of the access log subscription.
 * `arn` - Amazon Resource Name (ARN) of the access log subscription.
-* `resource_identifier` - ID of the service network or service.
 * `resource_arn` - Amazon Resource Name (ARN) of the service network or service.
-* `destination_arn` - Amazon Resource Name (ARN) of the log destination.
 
 ## Import
 
-VPC Lattice Access Log Subscription can be imported using the access log subscription ID, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import VPC Lattice Access Log Subscription using the access log subscription ID. For example:
 
+```terraform
+import {
+  to = aws_vpclattice_access_log_subscription.example
+  id = "rft-8012925589"
+}
 ```
-$ terraform import aws_vpclattice_access_log_subscription.example rft-8012925589
+
+Using `terraform import`, import VPC Lattice Access Log Subscription using the access log subscription ID. For example:
+
+```console
+% terraform import aws_vpclattice_access_log_subscription.example rft-8012925589
 ```
diff --git a/website/docs/r/vpclattice_auth_policy.html.markdown b/website/docs/r/vpclattice_auth_policy.html.markdown
index 5f4bfdc4104..404876fb3e8 100644
--- a/website/docs/r/vpclattice_auth_policy.html.markdown
+++ b/website/docs/r/vpclattice_auth_policy.html.markdown
@@ -49,9 +49,9 @@ The following arguments are required:
 * `resource_identifier` - (Required) The ID or Amazon Resource Name (ARN) of the service network or service for which the policy is created.
 * `policy` - (Required) The auth policy. The policy string in JSON must not contain newlines or blank lines.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `policy` - The auth policy. The policy string in JSON must not contain newlines or blank lines.
 * `state` - The state of the auth policy. The auth policy is only active when the auth type is set to AWS_IAM. If you provide a policy, then authentication and authorization decisions are made based on this policy and the client's IAM policy. If the Auth type is NONE, then, any auth policy you provide will remain inactive.
@@ -66,8 +66,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-VPC Lattice Auth Policy can be imported using the `example_id_arg`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import VPC Lattice Auth Policy using the `example_id_arg`. For example:
 
+```terraform
+import {
+  to = aws_vpclattice_auth_policy.example
+  id = "rft-8012925589"
+}
 ```
-$ terraform import aws_vpclattice_auth_policy.example rft-8012925589
+
+Using `terraform import`, import VPC Lattice Auth Policy using the `example_id_arg`. For example:
+
+```console
+% terraform import aws_vpclattice_auth_policy.example rft-8012925589
 ```
diff --git a/website/docs/r/vpclattice_listener.html.markdown b/website/docs/r/vpclattice_listener.html.markdown
index fb514c21467..43ad4772707 100644
--- a/website/docs/r/vpclattice_listener.html.markdown
+++ b/website/docs/r/vpclattice_listener.html.markdown
@@ -113,7 +113,7 @@ resource "aws_vpclattice_listener" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `default_action` - (Required) Default action block for the default listener rule. Default action blocks are defined below.
 * `name` - (Required, Forces new resource) Name of the listener. A listener name must be unique within a service. Valid characters are a-z, 0-9, and hyphens (-). You can't use a hyphen as the first or last character, or immediately after another hyphen.
@@ -153,9 +153,9 @@ Target group blocks (for `target_group`) must include the following arguments:
 * `weight` - (Optional) Determines how requests are distributed to the target group. Only required if you specify multiple target groups for a forward action. For example, if you specify two target groups, one with a
 weight of 10 and the other with a weight of 20, the target group with a weight of 20 receives twice as many requests as the other target group. See [Listener rules](https://docs.aws.amazon.com/vpc-lattice/latest/ug/listeners.html#listener-rules) in the AWS documentation for additional examples. Default: `100`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the listener.
 * `created_at` - Date and time that the listener was created, specified in ISO-8601 format.
@@ -164,8 +164,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-VPC Lattice Listener can be imported by using the `listener_id` of the listener and the `id` of the VPC Lattice service combined with a `/` character, e.g.:
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import VPC Lattice Listener using the `listener_id` of the listener and the `id` of the VPC Lattice service combined with a `/` character. For example:
 
+```terraform
+import {
+  to = aws_vpclattice_listener.example
+  id = "svc-1a2b3c4d/listener-987654321"
+}
 ```
-$ terraform import aws_vpclattice_listener.example svc-1a2b3c4d/listener-987654321
+
+Using `terraform import`, import VPC Lattice Listener using the `listener_id` of the listener and the `id` of the VPC Lattice service combined with a `/` character. For example:
+
+```console
+% terraform import aws_vpclattice_listener.example svc-1a2b3c4d/listener-987654321
 ```
diff --git a/website/docs/r/vpclattice_listener_rule.html.markdown b/website/docs/r/vpclattice_listener_rule.html.markdown
index 77b968dd699..1967132860b 100644
--- a/website/docs/r/vpclattice_listener_rule.html.markdown
+++ b/website/docs/r/vpclattice_listener_rule.html.markdown
@@ -86,7 +86,7 @@ The following arguments are required:
 
 * `service_identifier` - (Required) The ID or Amazon Resource Identifier (ARN) of the service.
 * `listener_identifier` - (Required) The ID or Amazon Resource Name (ARN) of the listener.
-* `action` - (Required) The action for the default rule.
+* `action` - (Required) The action for the listener rule.
 * `match` - (Required) The rule match.
 * `name` - (Required) The name of the rule. The name must be unique within the listener. The valid characters are a-z, 0-9, and hyphens (-). You can't use a hyphen as the first or last character, or immediately after another hyphen.
 * `priority` - (Required) The priority assigned to the rule. Each rule for a specific listener must have a unique priority. The lower the priority number the higher the priority.
@@ -142,12 +142,12 @@ path match match (`match`) supports the following:
 * `exact` - (Optional) Specifies an exact type match.
 * `prefix` - (Optional) Specifies a prefix type match. Matches the value with the prefix.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
-* `arn` - ARN of the target group.
-* `rule_id` - Unique identifier for the target group.
+* `arn` - The ARN for the listener rule.
+* `rule_id` - Unique identifier for the listener rule.
 * `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block).
 
 ## Timeouts
@@ -160,8 +160,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-VPC Lattice Listener Rule can be imported using the `example_id_arg`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import VPC Lattice Listener Rule using the `example_id_arg`. For example:
 
+```terraform
+import {
+  to = aws_vpclattice_listener_rule.example
+  id = "rft-8012925589"
+}
 ```
-$ terraform import aws_vpclattice_listener_rule.example rft-8012925589
+
+Using `terraform import`, import VPC Lattice Listener Rule using the `example_id_arg`. For example:
+
+```console
+% terraform import aws_vpclattice_listener_rule.example rft-8012925589
 ```
diff --git a/website/docs/r/vpclattice_resource_policy.html.markdown b/website/docs/r/vpclattice_resource_policy.html.markdown
index e50e9ad3161..dd7c63ba8d7 100644
--- a/website/docs/r/vpclattice_resource_policy.html.markdown
+++ b/website/docs/r/vpclattice_resource_policy.html.markdown
@@ -51,14 +51,23 @@ The following arguments are required:
 * `resource_arn` - (Required) The ID or Amazon Resource Name (ARN) of the service network or service for which the policy is created.
 * `policy` - (Required) An IAM policy. The policy string in JSON must not contain newlines or blank lines.
 
-## Attributes Reference
+## Attribute Reference
 
-No additional attributes are exported.
+This resource exports no additional attributes.
 
 ## Import
 
-VPC Lattice Resource Policy can be imported using the `resource_arn`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import VPC Lattice Resource Policy using the `resource_arn`. For example:
 
+```terraform
+import {
+  to = aws_vpclattice_resource_policy.example
+  id = "rft-8012925589"
+}
 ```
-$ terraform import aws_vpclattice_resource_policy.example rft-8012925589
+
+Using `terraform import`, import VPC Lattice Resource Policy using the `resource_arn`. For example:
+
+```console
+% terraform import aws_vpclattice_resource_policy.example rft-8012925589
 ```
diff --git a/website/docs/r/vpclattice_service.html.markdown b/website/docs/r/vpclattice_service.html.markdown
index 02c18e7d8b0..005648e7a64 100644
--- a/website/docs/r/vpclattice_service.html.markdown
+++ b/website/docs/r/vpclattice_service.html.markdown
@@ -35,9 +35,9 @@ The following arguments are optional:
 * `custom_domain_name` - (Optional) Custom domain name of the service.
 * `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the service. Do not begin the description with "An", "The", "Defines", "Indicates", or "Specifies," as these are verbose. In other words, "Indicates the amount of storage," can be rewritten as "Amount of storage," without losing any information.
 * `dns_entry` - Concise description. Do not begin the description with "An", "The", "Defines", "Indicates", or "Specifies," as these are verbose. In other words, "Indicates the amount of storage," can be rewritten as "Amount of storage," without losing any information.
@@ -54,8 +54,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-VPC Lattice Service can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import VPC Lattice Service using the `id`. For example:
 
+```terraform
+import {
+  to = aws_vpclattice_service.example
+  id = "svc-06728e2357ea55f8a"
+}
 ```
-$ terraform import aws_vpclattice_service.example svc-06728e2357ea55f8a
+
+Using `terraform import`, import VPC Lattice Service using the `id`. For example:
+
+```console
+% terraform import aws_vpclattice_service.example svc-06728e2357ea55f8a
 ```
diff --git a/website/docs/r/vpclattice_service_network.html.markdown b/website/docs/r/vpclattice_service_network.html.markdown
index 9993b1a1fd9..c13e5f7f2ae 100644
--- a/website/docs/r/vpclattice_service_network.html.markdown
+++ b/website/docs/r/vpclattice_service_network.html.markdown
@@ -32,17 +32,26 @@ The following arguments are optional:
 * `auth_type` - (Optional) Type of IAM policy. Either `NONE` or `AWS_IAM`.
 * `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the Service Network.
 * `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block).
 
 ## Import
 
-VPC Lattice Service Network can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import VPC Lattice Service Network using the `id`. For example:
 
+```terraform
+import {
+  to = aws_vpclattice_service_network.example
+  id = "sn-0158f91c1e3358dba"
+}
 ```
-$ terraform import aws_vpclattice_service_network.example sn-0158f91c1e3358dba
+
+Using `terraform import`, import VPC Lattice Service Network using the `id`. For example:
+
+```console
+% terraform import aws_vpclattice_service_network.example sn-0158f91c1e3358dba
 ```
diff --git a/website/docs/r/vpclattice_service_network_service_association.html.markdown b/website/docs/r/vpclattice_service_network_service_association.html.markdown
index 7d305bd3cd2..ca802259a56 100644
--- a/website/docs/r/vpclattice_service_network_service_association.html.markdown
+++ b/website/docs/r/vpclattice_service_network_service_association.html.markdown
@@ -31,9 +31,9 @@ The following arguments are optional:
 
 * `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The ARN of the Association.
 * `created_by` - The account that created the association.
@@ -54,8 +54,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-VPC Lattice Service Network Service Association can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import VPC Lattice Service Network Service Association using the `id`. For example:
 
+```terraform
+import {
+  to = aws_vpclattice_service_network_service_association.example
+  id = "snsa-05e2474658a88f6ba"
+}
 ```
-$ terraform import aws_vpclattice_service_network_service_association.example snsa-05e2474658a88f6ba
+
+Using `terraform import`, import VPC Lattice Service Network Service Association using the `id`. For example:
+
+```console
+% terraform import aws_vpclattice_service_network_service_association.example snsa-05e2474658a88f6ba
 ```
diff --git a/website/docs/r/vpclattice_service_network_vpc_association.html.markdown b/website/docs/r/vpclattice_service_network_vpc_association.html.markdown
index e6694797003..99ad05a86e0 100644
--- a/website/docs/r/vpclattice_service_network_vpc_association.html.markdown
+++ b/website/docs/r/vpclattice_service_network_vpc_association.html.markdown
@@ -33,9 +33,9 @@ The following arguments are optional:
 * `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 * `security_group_ids` - (Optional) The IDs of the security groups.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The ARN of the Association.
 * `created_by` - The account that created the association.
@@ -52,8 +52,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-VPC Lattice Service Network VPC Association can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import VPC Lattice Service Network VPC Association using the `id`. For example:
 
+```terraform
+import {
+  to = aws_vpclattice_service_network_vpc_association.example
+  id = "snsa-05e2474658a88f6ba"
+}
 ```
-$ terraform import aws_vpclattice_service_network_vpc_association.example snsa-05e2474658a88f6ba
+
+Using `terraform import`, import VPC Lattice Service Network VPC Association using the `id`. For example:
+
+```console
+% terraform import aws_vpclattice_service_network_vpc_association.example snsa-05e2474658a88f6ba
 ```
diff --git a/website/docs/r/vpclattice_target_group.html.markdown b/website/docs/r/vpclattice_target_group.html.markdown
index 344c13dbe55..d08e4128ee6 100644
--- a/website/docs/r/vpclattice_target_group.html.markdown
+++ b/website/docs/r/vpclattice_target_group.html.markdown
@@ -18,10 +18,12 @@ Terraform resource for managing an AWS VPC Lattice Target Group.
 resource "aws_vpclattice_target_group" "example" {
   name = "example"
   type = "INSTANCE"
+
   config {
-    port           = 443
-    protocol       = "HTTPS"
     vpc_identifier = aws_vpc.example.id
+
+    port     = 443
+    protocol = "HTTPS"
   }
 }
 ```
@@ -31,12 +33,14 @@ resource "aws_vpclattice_target_group" "example" {
 ```terraform
 resource "aws_vpclattice_target_group" "example" {
   name = "example"
-  type = "ALB"
+  type = "IP"
 
   config {
+    vpc_identifier = aws_vpc.example.id
+
+    ip_address_type  = "IPV4"
     port             = 443
     protocol         = "HTTPS"
-    vpc_identifier   = aws_vpc.example.id
     protocol_version = "HTTP1"
 
     health_check {
@@ -59,6 +63,25 @@ resource "aws_vpclattice_target_group" "example" {
 }
 ```
 
+### ALB
+
+If the type is ALB, `health_check` block is not supported.
+
+```terraform
+resource "aws_vpclattice_target_group" "example" {
+  name = "example"
+  type = "ALB"
+
+  config {
+    vpc_identifier = aws_vpc.example.id
+
+    port             = 443
+    protocol         = "HTTPS"
+    protocol_version = "HTTP1"
+  }
+}
+```
+
 ### Lambda
 
 If the type is Lambda, `config` block is not supported.
@@ -79,17 +102,18 @@ The following arguments are required:
 
 The following arguments are optional:
 
-* `config` - (Optional) The target group configuration. If type is set to `LAMBDA,` this parameter should not be specified.
+* `config` - (Optional) The target group configuration.
 * `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
 Config (`config`) supports the following:
 
 * `health_check` - (Optional) The health check configuration.
-* `ip_address_type` - (Optional) The type of IP address used for the target group. Valid values: `IPV4` | `IPV6`
-* `port` - (Required) The port on which the targets are listening.
-* `protocol` - (Required) The protocol to use for routing traffic to the targets. Valid Values are `HTTP` | `HTTPS`
+* `ip_address_type` - (Optional) The type of IP address used for the target group. Valid values: `IPV4` | `IPV6`.
+* `lambda_event_structure_version` - (Optional) The version of the event structure that the Lambda function receives. Supported only if `type` is `LAMBDA`. Valid Values are `V1` | `V2`.
+* `port` - (Optional) The port on which the targets are listening.
+* `protocol` - (Optional) The protocol to use for routing traffic to the targets. Valid Values are `HTTP` | `HTTPS`.
 * `protocol_version` - (Optional) The protocol version. Valid Values are `HTTP1` | `HTTP2` | `GRPC`. Default value is `HTTP1`.
-* `vpc_identifier` - (Required) The ID of the VPC.
+* `vpc_identifier` - (Optional) The ID of the VPC.
 
 Health Check (`health_check`) supports the following:
 
@@ -105,9 +129,9 @@ Health Check (`health_check`) supports the following:
 * `protocol_version` - (Optional) The protocol version used when performing health checks on targets. The possible protocol versions are `HTTP1` and `HTTP2`. The default is `HTTP1`.
 * `unhealthy_threshold_count` - (Optional) The number of consecutive failed health checks required before considering a target unhealthy. The range is 2–10. The default is 2.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the target group.
 * `id` - Unique identifier for the target group.
@@ -123,8 +147,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-VPC Lattice Target Group can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import VPC Lattice Target Group using the `id`. For example:
 
+```terraform
+import {
+  to = aws_vpclattice_target_group.example
+  id = "tg-0c11d4dc16ed96bdb"
+}
 ```
-$ terraform import aws_vpclattice_target_group.example tg-0c11d4dc16ed96bdb
+
+Using `terraform import`, import VPC Lattice Target Group using the `id`. For example:
+
+```console
+% terraform import aws_vpclattice_target_group.example tg-0c11d4dc16ed96bdb
 ```
diff --git a/website/docs/r/vpclattice_target_group_attachment.html.markdown b/website/docs/r/vpclattice_target_group_attachment.html.markdown
index 4f4aaf9425f..65e056a7a17 100644
--- a/website/docs/r/vpclattice_target_group_attachment.html.markdown
+++ b/website/docs/r/vpclattice_target_group_attachment.html.markdown
@@ -35,8 +35,8 @@ The following arguments are required:
 `target` supports the following:
 
 - `id` - (Required) The ID of the target. If the target type of the target group is INSTANCE, this is an instance ID. If the target type is IP , this is an IP address. If the target type is LAMBDA, this is the ARN of the Lambda function. If the target type is ALB, this is the ARN of the Application Load Balancer.
-- `port` - (Optional) The port on which the target is listening. For HTTP, the default is 80. For HTTPS, the default is 443.
+- `port` - (Optional) This port is used for routing traffic to the target, and defaults to the target group port. However, you can override the default and specify a custom port.
 
-## Attributes Reference
+## Attribute Reference
 
-No additional attributes are exported.
+This resource exports no additional attributes.
diff --git a/website/docs/r/vpn_connection.html.markdown b/website/docs/r/vpn_connection.html.markdown
index 62c6e856ee8..21bb4f15844 100644
--- a/website/docs/r/vpn_connection.html.markdown
+++ b/website/docs/r/vpn_connection.html.markdown
@@ -121,7 +121,7 @@ resource "aws_vpn_connection" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `customer_gateway_id` - (Required) The ID of the customer gateway.
 * `type` - (Required) The type of VPN connection. The only type AWS supports at this time is "ipsec.1".
@@ -192,9 +192,9 @@ The `cloudwatch_log_options` blocks supports the following arguments:
 * `log_group_arn` - (Optional) The Amazon Resource Name (ARN) of the CloudWatch log group to send logs to.
 * `log_output_format` - (Optional) Set log format. Default format is json. Possible values are: `json` and `text`. The default is `json`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name (ARN) of the VPN Connection.
 * `id` - The amazon-assigned ID of the VPN connection.
@@ -238,8 +238,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-VPN Connections can be imported using the `vpn connection id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import VPN Connections using the VPN connection `id`. For example:
 
+```terraform
+import {
+  to = aws_vpn_connection.testvpnconnection
+  id = "vpn-40f41529"
+}
 ```
-$ terraform import aws_vpn_connection.testvpnconnection vpn-40f41529
+
+Using `terraform import`, import VPN Connections using the VPN connection `id`. For example:
+
+```console
+% terraform import aws_vpn_connection.testvpnconnection vpn-40f41529
 ```
diff --git a/website/docs/r/vpn_connection_route.html.markdown b/website/docs/r/vpn_connection_route.html.markdown
index cdf78e97d05..b8ae0719180 100644
--- a/website/docs/r/vpn_connection_route.html.markdown
+++ b/website/docs/r/vpn_connection_route.html.markdown
@@ -42,14 +42,14 @@ resource "aws_vpn_connection_route" "office" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `destination_cidr_block` - (Required) The CIDR block associated with the local subnet of the customer network.
 * `vpn_connection_id` - (Required) The ID of the VPN connection.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `destination_cidr_block` - The CIDR block associated with the local subnet of the customer network.
 * `vpn_connection_id` - The ID of the VPN connection.
diff --git a/website/docs/r/vpn_gateway.html.markdown b/website/docs/r/vpn_gateway.html.markdown
index 64def9faba9..bfcb6f9e0fc 100644
--- a/website/docs/r/vpn_gateway.html.markdown
+++ b/website/docs/r/vpn_gateway.html.markdown
@@ -24,16 +24,16 @@ resource "aws_vpn_gateway" "vpn_gw" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `vpc_id` - (Optional) The VPC ID to create in.
 * `availability_zone` - (Optional) The Availability Zone for the virtual private gateway.
 * `tags` - (Optional) A map of tags to assign to the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 * `amazon_side_asn` - (Optional) The Autonomous System Number (ASN) for the Amazon side of the gateway. If you don't specify an ASN, the virtual private gateway is created with the default ASN.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name (ARN) of the VPN Gateway.
 * `id` - The ID of the VPN Gateway.
@@ -41,8 +41,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-VPN Gateways can be imported using the `vpn gateway id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import VPN Gateways using the VPN gateway `id`. For example:
 
+```terraform
+import {
+  to = aws_vpn_gateway.testvpngateway
+  id = "vgw-9a4cacf3"
+}
 ```
-$ terraform import aws_vpn_gateway.testvpngateway vgw-9a4cacf3
+
+Using `terraform import`, import VPN Gateways using the VPN gateway `id`. For example:
+
+```console
+% terraform import aws_vpn_gateway.testvpngateway vgw-9a4cacf3
 ```
diff --git a/website/docs/r/vpn_gateway_attachment.html.markdown b/website/docs/r/vpn_gateway_attachment.html.markdown
index f7306743f20..1c8f22427c4 100644
--- a/website/docs/r/vpn_gateway_attachment.html.markdown
+++ b/website/docs/r/vpn_gateway_attachment.html.markdown
@@ -40,18 +40,18 @@ guides for more information.
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `vpc_id` - (Required) The ID of the VPC.
 * `vpn_gateway_id` - (Required) The ID of the Virtual Private Gateway.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `vpc_id` - The ID of the VPC that Virtual Private Gateway is attached to.
 * `vpn_gateway_id` - The ID of the Virtual Private Gateway.
 
 ## Import
 
-This resource does not support importing.
+You cannot import this resource.
diff --git a/website/docs/r/vpn_gateway_route_propagation.html.markdown b/website/docs/r/vpn_gateway_route_propagation.html.markdown
index d1af9c9f22a..0871c71830e 100644
--- a/website/docs/r/vpn_gateway_route_propagation.html.markdown
+++ b/website/docs/r/vpn_gateway_route_propagation.html.markdown
@@ -30,9 +30,9 @@ The following arguments are required:
 * `vpn_gateway_id` - The id of the `aws_vpn_gateway` to propagate routes from.
 * `route_table_id` - The id of the `aws_route_table` to propagate routes into.
 
-## Attributes Reference
+## Attribute Reference
 
-No additional attributes are exported.
+This resource exports no additional attributes.
 
 ## Timeouts
 
diff --git a/website/docs/r/waf_byte_match_set.html.markdown b/website/docs/r/waf_byte_match_set.html.markdown
index 67d3747dc2b..7e3f0f29886 100644
--- a/website/docs/r/waf_byte_match_set.html.markdown
+++ b/website/docs/r/waf_byte_match_set.html.markdown
@@ -31,7 +31,7 @@ resource "aws_waf_byte_match_set" "byte_set" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The name or description of the Byte Match Set.
 * `byte_match_tuples` - Specifies the bytes (typically a string that corresponds
@@ -72,16 +72,25 @@ The following arguments are supported:
 
 ## Remarks
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the WAF Byte Match Set.
 
 ## Import
 
-WAF Byte Match Set can be imported using the id, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WAF Byte Match Set using the id. For example:
 
+```terraform
+import {
+  to = aws_waf_byte_match_set.byte_set
+  id = "a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc"
+}
 ```
-$ terraform import aws_waf_byte_match_set.byte_set a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
+
+Using `terraform import`, import WAF Byte Match Set using the id. For example:
+
+```console
+% terraform import aws_waf_byte_match_set.byte_set a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
 ```
diff --git a/website/docs/r/waf_geo_match_set.html.markdown b/website/docs/r/waf_geo_match_set.html.markdown
index 67f2834c30a..12e5b31c78d 100644
--- a/website/docs/r/waf_geo_match_set.html.markdown
+++ b/website/docs/r/waf_geo_match_set.html.markdown
@@ -30,7 +30,7 @@ resource "aws_waf_geo_match_set" "geo_match_set" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The name or description of the GeoMatchSet.
 * `geo_match_constraint` - (Optional) The GeoMatchConstraint objects which contain the country that you want AWS WAF to search for.
@@ -48,17 +48,26 @@ The following arguments are supported:
 
 ## Remarks
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the WAF GeoMatchSet.
 * `arn` - Amazon Resource Name (ARN)
 
 ## Import
 
-WAF Geo Match Set can be imported using their ID, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WAF Geo Match Set using their ID. For example:
 
+```terraform
+import {
+  to = aws_waf_geo_match_set.example
+  id = "a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc"
+}
 ```
-$ terraform import aws_waf_geo_match_set.example a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
+
+Using `terraform import`, import WAF Geo Match Set using their ID. For example:
+
+```console
+% terraform import aws_waf_geo_match_set.example a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
 ```
diff --git a/website/docs/r/waf_ipset.html.markdown b/website/docs/r/waf_ipset.html.markdown
index dae1593fc42..effafb6faa4 100644
--- a/website/docs/r/waf_ipset.html.markdown
+++ b/website/docs/r/waf_ipset.html.markdown
@@ -30,7 +30,7 @@ resource "aws_waf_ipset" "ipset" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The name or description of the IPSet.
 * `ip_set_descriptors` - (Optional) One or more pairs specifying the IP address type (IPV4 or IPV6) and the IP address range (in CIDR format) from which web requests originate.
@@ -44,17 +44,26 @@ The following arguments are supported:
 * `type` - (Required) Type of the IP address - `IPV4` or `IPV6`.
 * `value` - (Required) An IPv4 or IPv6 address specified via CIDR notationE.g., `192.0.2.44/32` or `1111:0000:0000:0000:0000:0000:0000:0000/64`
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the WAF IPSet.
 * `arn` - The ARN of the WAF IPSet.
 
 ## Import
 
-WAF IPSets can be imported using their ID, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WAF IPSets using their ID. For example:
 
+```terraform
+import {
+  to = aws_waf_ipset.example
+  id = "a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc"
+}
 ```
-$ terraform import aws_waf_ipset.example a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
+
+Using `terraform import`, import WAF IPSets using their ID. For example:
+
+```console
+% terraform import aws_waf_ipset.example a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
 ```
diff --git a/website/docs/r/waf_rate_based_rule.html.markdown b/website/docs/r/waf_rate_based_rule.html.markdown
index e42f757e5d2..8d0d5f13198 100644
--- a/website/docs/r/waf_rate_based_rule.html.markdown
+++ b/website/docs/r/waf_rate_based_rule.html.markdown
@@ -40,7 +40,7 @@ resource "aws_waf_rate_based_rule" "wafrule" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `metric_name` - (Required) The name or description for the Amazon CloudWatch metric of this rule.
 * `name` - (Required) The name or description of the rule.
@@ -66,9 +66,9 @@ See the [WAF Documentation](https://docs.aws.amazon.com/waf/latest/APIReference/
 
 ## Remarks
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the WAF rule.
 * `arn` - Amazon Resource Name (ARN)
@@ -76,8 +76,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-WAF Rated Based Rule can be imported using the id, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WAF Rated Based Rule using the id. For example:
 
+```terraform
+import {
+  to = aws_waf_rate_based_rule.wafrule
+  id = "a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc"
+}
 ```
-$ terraform import aws_waf_rate_based_rule.wafrule a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
+
+Using `terraform import`, import WAF Rated Based Rule using the id. For example:
+
+```console
+% terraform import aws_waf_rate_based_rule.wafrule a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
 ```
diff --git a/website/docs/r/waf_regex_match_set.html.markdown b/website/docs/r/waf_regex_match_set.html.markdown
index 5741b3e3da6..205dcf466f4 100644
--- a/website/docs/r/waf_regex_match_set.html.markdown
+++ b/website/docs/r/waf_regex_match_set.html.markdown
@@ -35,7 +35,7 @@ resource "aws_waf_regex_pattern_set" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The name or description of the Regex Match Set.
 * `regex_match_tuple` - (Required) The regular expression pattern that you want AWS WAF to search for in web requests, the location in requests that you want AWS WAF to search, and other settings. See below.
@@ -60,17 +60,26 @@ The following arguments are supported:
   See [docs](http://docs.aws.amazon.com/waf/latest/APIReference/API_FieldToMatch.html)
   for all supported values.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the WAF Regex Match Set.
 * `arn` - Amazon Resource Name (ARN)
 
 ## Import
 
-WAF Regex Match Set can be imported using their ID, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WAF Regex Match Set using their ID. For example:
 
+```terraform
+import {
+  to = aws_waf_regex_match_set.example
+  id = "a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc"
+}
 ```
-$ terraform import aws_waf_regex_match_set.example a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
+
+Using `terraform import`, import WAF Regex Match Set using their ID. For example:
+
+```console
+% terraform import aws_waf_regex_match_set.example a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
 ```
diff --git a/website/docs/r/waf_regex_pattern_set.html.markdown b/website/docs/r/waf_regex_pattern_set.html.markdown
index a21600c8d03..fdbf8782b9b 100644
--- a/website/docs/r/waf_regex_pattern_set.html.markdown
+++ b/website/docs/r/waf_regex_pattern_set.html.markdown
@@ -21,22 +21,31 @@ resource "aws_waf_regex_pattern_set" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The name or description of the Regex Pattern Set.
 * `regex_pattern_strings` - (Optional) A list of regular expression (regex) patterns that you want AWS WAF to search for, such as `B[a@]dB[o0]t`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the WAF Regex Pattern Set.
 * `arn` - Amazon Resource Name (ARN)
 
 ## Import
 
-AWS WAF Regex Pattern Set can be imported using their ID, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AWS WAF Regex Pattern Set using their ID. For example:
 
+```terraform
+import {
+  to = aws_waf_regex_pattern_set.example
+  id = "a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc"
+}
 ```
-$ terraform import aws_waf_regex_pattern_set.example a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
+
+Using `terraform import`, import AWS WAF Regex Pattern Set using their ID. For example:
+
+```console
+% terraform import aws_waf_regex_pattern_set.example a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
 ```
diff --git a/website/docs/r/waf_rule.html.markdown b/website/docs/r/waf_rule.html.markdown
index c8e361108f6..732fa6edd03 100644
--- a/website/docs/r/waf_rule.html.markdown
+++ b/website/docs/r/waf_rule.html.markdown
@@ -37,7 +37,7 @@ resource "aws_waf_rule" "wafrule" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `metric_name` - (Required) The name or description for the Amazon CloudWatch metric of this rule. The name can contain only alphanumeric characters (A-Z, a-z, 0-9); the name can't contain whitespace.
 * `name` - (Required) The name or description of the rule.
@@ -59,9 +59,9 @@ See the [WAF Documentation](https://docs.aws.amazon.com/waf/latest/APIReference/
 * `data_id` - (Required) A unique identifier for a predicate in the rule, such as Byte Match Set ID or IPSet ID.
 * `type` - (Required) The type of predicate in a rule. Valid values: `ByteMatch`, `GeoMatch`, `IPMatch`, `RegexMatch`, `SizeConstraint`, `SqlInjectionMatch`, or `XssMatch`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the WAF rule.
 * `arn` - The ARN of the WAF rule.
@@ -69,8 +69,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-WAF rules can be imported using the id, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WAF rules using the id. For example:
 
+```terraform
+import {
+  to = aws_waf_rule.example
+  id = "a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc"
+}
 ```
-$ terraform import aws_waf_rule.example a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
+
+Using `terraform import`, import WAF rules using the id. For example:
+
+```console
+% terraform import aws_waf_rule.example a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
 ```
diff --git a/website/docs/r/waf_rule_group.html.markdown b/website/docs/r/waf_rule_group.html.markdown
index 0e76fb6aef5..b23ccea70cb 100644
--- a/website/docs/r/waf_rule_group.html.markdown
+++ b/website/docs/r/waf_rule_group.html.markdown
@@ -35,9 +35,10 @@ resource "aws_waf_rule_group" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
-* `name` - (Required) A friendly name of the rule group
+* `name` - (Optional) Name of the rule group. If omitted, Terraform will assign a random, unique name. Conflicts with `name_prefix`.
+* `name_prefix` - (Optional) Creates a unique name beginning with the specified prefix. Conflicts with `name`.
 * `metric_name` - (Required) A friendly name for the metrics from the rule group
 * `activated_rule` - (Optional) A list of activated rules, see below
 * `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
@@ -54,9 +55,9 @@ The following arguments are supported:
 * `rule_id` - (Required) The ID of a [rule](/docs/providers/aws/r/waf_rule.html)
 * `type` - (Optional) The rule type, either [`REGULAR`](/docs/providers/aws/r/waf_rule.html), [`RATE_BASED`](/docs/providers/aws/r/waf_rate_based_rule.html), or `GROUP`. Defaults to `REGULAR`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the WAF rule group.
 * `arn` - The ARN of the WAF rule group.
@@ -64,8 +65,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-WAF Rule Group can be imported using the id, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WAF Rule Group using the id. For example:
 
+```terraform
+import {
+  to = aws_waf_rule_group.example
+  id = "a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc"
+}
 ```
-$ terraform import aws_waf_rule_group.example a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
+
+Using `terraform import`, import WAF Rule Group using the id. For example:
+
+```console
+% terraform import aws_waf_rule_group.example a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
 ```
diff --git a/website/docs/r/waf_size_constraint_set.html.markdown b/website/docs/r/waf_size_constraint_set.html.markdown
index 1d8541faf76..42624928990 100644
--- a/website/docs/r/waf_size_constraint_set.html.markdown
+++ b/website/docs/r/waf_size_constraint_set.html.markdown
@@ -30,7 +30,7 @@ resource "aws_waf_size_constraint_set" "size_constraint_set" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The name or description of the Size Constraint Set.
 * `size_constraints` - (Optional) Specifies the parts of web requests that you want to inspect the size of.
@@ -65,17 +65,26 @@ The following arguments are supported:
   See [docs](http://docs.aws.amazon.com/waf/latest/APIReference/API_FieldToMatch.html)
   for all supported values.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the WAF Size Constraint Set.
 * `arn` - Amazon Resource Name (ARN)
 
 ## Import
 
-AWS WAF Size Constraint Set can be imported using their ID, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AWS WAF Size Constraint Set using their ID. For example:
 
+```terraform
+import {
+  to = aws_waf_size_constraint_set.example
+  id = "a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc"
+}
 ```
-$ terraform import aws_waf_size_constraint_set.example a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
+
+Using `terraform import`, import AWS WAF Size Constraint Set using their ID. For example:
+
+```console
+% terraform import aws_waf_size_constraint_set.example a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
 ```
diff --git a/website/docs/r/waf_sql_injection_match_set.html.markdown b/website/docs/r/waf_sql_injection_match_set.html.markdown
index 0a582357690..8b710851efa 100644
--- a/website/docs/r/waf_sql_injection_match_set.html.markdown
+++ b/website/docs/r/waf_sql_injection_match_set.html.markdown
@@ -28,7 +28,7 @@ resource "aws_waf_sql_injection_match_set" "sql_injection_match_set" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The name or description of the SQL Injection Match Set.
 * `sql_injection_match_tuples` - (Optional) The parts of web requests that you want AWS WAF to inspect for malicious SQL code and, if you want AWS WAF to inspect a header, the name of the header.
@@ -57,16 +57,25 @@ The following arguments are supported:
 
 ## Remarks
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the WAF SQL Injection Match Set.
 
 ## Import
 
-AWS WAF SQL Injection Match Set can be imported using their ID, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AWS WAF SQL Injection Match Set using their ID. For example:
 
+```terraform
+import {
+  to = aws_waf_sql_injection_match_set.example
+  id = "a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc"
+}
 ```
-$ terraform import aws_waf_sql_injection_match_set.example a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
+
+Using `terraform import`, import AWS WAF SQL Injection Match Set using their ID. For example:
+
+```console
+% terraform import aws_waf_sql_injection_match_set.example a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
 ```
diff --git a/website/docs/r/waf_web_acl.html.markdown b/website/docs/r/waf_web_acl.html.markdown
index 0f615d3a97e..ba1ba8db7d0 100644
--- a/website/docs/r/waf_web_acl.html.markdown
+++ b/website/docs/r/waf_web_acl.html.markdown
@@ -86,7 +86,7 @@ resource "aws_waf_web_acl" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `default_action` - (Required) Configuration block with action that you want AWS WAF to take when a request doesn't match the criteria in any of the rules that are associated with the web ACL. Detailed below.
 * `metric_name` - (Required) The name or description for the Amazon CloudWatch metric of this web ACL.
@@ -129,9 +129,9 @@ See [docs](http://docs.aws.amazon.com/waf/latest/APIReference/API_ActivatedRule.
 * `rule_id` - (Required) ID of the associated WAF (Global) rule (e.g., [`aws_waf_rule`](/docs/providers/aws/r/waf_rule.html)). WAF (Regional) rules cannot be used.
 * `type` - (Optional) The rule type, either `REGULAR`, as defined by [Rule](http://docs.aws.amazon.com/waf/latest/APIReference/API_Rule.html), `RATE_BASED`, as defined by [RateBasedRule](http://docs.aws.amazon.com/waf/latest/APIReference/API_RateBasedRule.html), or `GROUP`, as defined by [RuleGroup](https://docs.aws.amazon.com/waf/latest/APIReference/API_RuleGroup.html). The default is REGULAR. If you add a RATE_BASED rule, you need to set `type` as `RATE_BASED`. If you add a GROUP rule, you need to set `type` as `GROUP`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the WAF WebACL.
 * `arn` - The ARN of the WAF WebACL.
@@ -139,8 +139,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-WAF Web ACL can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WAF Web ACL using the `id`. For example:
 
+```terraform
+import {
+  to = aws_waf_web_acl.main
+  id = "0c8e583e-18f3-4c13-9e2a-67c4805d2f94"
+}
 ```
-$ terraform import aws_waf_web_acl.main 0c8e583e-18f3-4c13-9e2a-67c4805d2f94
+
+Using `terraform import`, import WAF Web ACL using the `id`. For example:
+
+```console
+% terraform import aws_waf_web_acl.main 0c8e583e-18f3-4c13-9e2a-67c4805d2f94
 ```
diff --git a/website/docs/r/waf_xss_match_set.html.markdown b/website/docs/r/waf_xss_match_set.html.markdown
index b8fbe2f3543..4a901a6251e 100644
--- a/website/docs/r/waf_xss_match_set.html.markdown
+++ b/website/docs/r/waf_xss_match_set.html.markdown
@@ -36,7 +36,7 @@ resource "aws_waf_xss_match_set" "xss_match_set" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The name or description of the SizeConstraintSet.
 * `xss_match_tuples` - (Optional) The parts of web requests that you want to inspect for cross-site scripting attacks.
@@ -65,17 +65,26 @@ The following arguments are supported:
 
 ## Remarks
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the WAF XssMatchSet.
 * `arn` - Amazon Resource Name (ARN)
 
 ## Import
 
-WAF XSS Match Set can be imported using their ID, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WAF XSS Match Set using their ID. For example:
 
+```terraform
+import {
+  to = aws_waf_xss_match_set.example
+  id = "a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc"
+}
 ```
-$ terraform import aws_waf_xss_match_set.example a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
+
+Using `terraform import`, import WAF XSS Match Set using their ID. For example:
+
+```console
+% terraform import aws_waf_xss_match_set.example a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
 ```
diff --git a/website/docs/r/wafregional_byte_match_set.html.markdown b/website/docs/r/wafregional_byte_match_set.html.markdown
index 190590d714f..f664f4e4310 100644
--- a/website/docs/r/wafregional_byte_match_set.html.markdown
+++ b/website/docs/r/wafregional_byte_match_set.html.markdown
@@ -31,7 +31,7 @@ resource "aws_wafregional_byte_match_set" "byte_set" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The name or description of the ByteMatchSet.
 * `byte_match_tuples` - (Optional)Settings for the ByteMatchSet, such as the bytes (typically a string that corresponds with ASCII characters) that you want AWS WAF to search for in web requests. ByteMatchTuple documented below.
@@ -50,16 +50,25 @@ FieldToMatch(field_to_match) support following:
 
 ## Remarks
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the WAF ByteMatchSet.
 
 ## Import
 
-WAF Regional Byte Match Set can be imported using the id, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WAF Regional Byte Match Set using the id. For example:
 
+```terraform
+import {
+  to = aws_wafregional_byte_match_set.byte_set
+  id = "a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc"
+}
 ```
-$ terraform import aws_wafregional_byte_match_set.byte_set a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
+
+Using `terraform import`, import WAF Regional Byte Match Set using the id. For example:
+
+```console
+% terraform import aws_wafregional_byte_match_set.byte_set a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
 ```
diff --git a/website/docs/r/wafregional_geo_match_set.html.markdown b/website/docs/r/wafregional_geo_match_set.html.markdown
index 0d8c477103f..d98d2031468 100644
--- a/website/docs/r/wafregional_geo_match_set.html.markdown
+++ b/website/docs/r/wafregional_geo_match_set.html.markdown
@@ -30,7 +30,7 @@ resource "aws_wafregional_geo_match_set" "geo_match_set" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The name or description of the Geo Match Set.
 * `geo_match_constraint` - (Optional) The Geo Match Constraint objects which contain the country that you want AWS WAF to search for.
@@ -46,16 +46,25 @@ The following arguments are supported:
   This is the two-letter country code, e.g., `US`, `CA`, `RU`, `CN`, etc.
   See [docs](https://docs.aws.amazon.com/waf/latest/APIReference/API_GeoMatchConstraint.html) for all supported values.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the WAF Regional Geo Match Set.
 
 ## Import
 
-WAF Regional Geo Match Set can be imported using the id, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WAF Regional Geo Match Set using the id. For example:
 
+```terraform
+import {
+  to = aws_wafregional_geo_match_set.geo_match_set
+  id = "a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc"
+}
 ```
-$ terraform import aws_wafregional_geo_match_set.geo_match_set a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
+
+Using `terraform import`, import WAF Regional Geo Match Set using the id. For example:
+
+```console
+% terraform import aws_wafregional_geo_match_set.geo_match_set a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
 ```
diff --git a/website/docs/r/wafregional_ipset.html.markdown b/website/docs/r/wafregional_ipset.html.markdown
index 30405b3fd55..66c86ebb34d 100644
--- a/website/docs/r/wafregional_ipset.html.markdown
+++ b/website/docs/r/wafregional_ipset.html.markdown
@@ -30,7 +30,7 @@ resource "aws_wafregional_ipset" "ipset" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The name or description of the IPSet.
 * `ip_set_descriptor` - (Optional) One or more pairs specifying the IP address type (IPV4 or IPV6) and the IP address range (in CIDR notation) from which web requests originate.
@@ -46,17 +46,26 @@ The following arguments are supported:
 
 ## Remarks
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the WAF IPSet.
 * `arn` - The ARN of the WAF IPSet.
 
 ## Import
 
-WAF Regional IPSets can be imported using their ID, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WAF Regional IPSets using their ID. For example:
 
+```terraform
+import {
+  to = aws_wafregional_ipset.example
+  id = "a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc"
+}
 ```
-$ terraform import aws_wafregional_ipset.example a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
+
+Using `terraform import`, import WAF Regional IPSets using their ID. For example:
+
+```console
+% terraform import aws_wafregional_ipset.example a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
 ```
diff --git a/website/docs/r/wafregional_rate_based_rule.html.markdown b/website/docs/r/wafregional_rate_based_rule.html.markdown
index b58e7be9a27..f4410513d01 100644
--- a/website/docs/r/wafregional_rate_based_rule.html.markdown
+++ b/website/docs/r/wafregional_rate_based_rule.html.markdown
@@ -40,7 +40,7 @@ resource "aws_wafregional_rate_based_rule" "wafrule" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `metric_name` - (Required) The name or description for the Amazon CloudWatch metric of this rule.
 * `name` - (Required) The name or description of the rule.
@@ -64,9 +64,9 @@ See the [WAF Documentation](https://docs.aws.amazon.com/waf/latest/APIReference/
 * `data_id` - (Required) A unique identifier for a predicate in the rule, such as Byte Match Set ID or IPSet ID.
 * `type` - (Required) The type of predicate in a rule. Valid values: `ByteMatch`, `GeoMatch`, `IPMatch`, `RegexMatch`, `SizeConstraint`, `SqlInjectionMatch`, or `XssMatch`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the WAF Regional Rate Based Rule.
 * `arn` - The ARN of the WAF Regional Rate Based Rule.
@@ -74,8 +74,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-WAF Regional Rate Based Rule can be imported using the id, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WAF Regional Rate Based Rule using the id. For example:
 
+```terraform
+import {
+  to = aws_wafregional_rate_based_rule.wafrule
+  id = "a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc"
+}
 ```
-$ terraform import aws_wafregional_rate_based_rule.wafrule a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
+
+Using `terraform import`, import WAF Regional Rate Based Rule using the id. For example:
+
+```console
+% terraform import aws_wafregional_rate_based_rule.wafrule a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
 ```
diff --git a/website/docs/r/wafregional_regex_match_set.html.markdown b/website/docs/r/wafregional_regex_match_set.html.markdown
index 5e21185961f..ba804afdb13 100644
--- a/website/docs/r/wafregional_regex_match_set.html.markdown
+++ b/website/docs/r/wafregional_regex_match_set.html.markdown
@@ -35,7 +35,7 @@ resource "aws_wafregional_regex_pattern_set" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The name or description of the Regex Match Set.
 * `regex_match_tuple` - (Required) The regular expression pattern that you want AWS WAF to search for in web requests, the location in requests that you want AWS WAF to search, and other settings. See below.
@@ -60,16 +60,25 @@ The following arguments are supported:
   See [docs](http://docs.aws.amazon.com/waf/latest/APIReference/API_FieldToMatch.html)
   for all supported values.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the WAF Regional Regex Match Set.
 
 ## Import
 
-WAF Regional Regex Match Set can be imported using the id, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WAF Regional Regex Match Set using the id. For example:
 
+```terraform
+import {
+  to = aws_wafregional_regex_match_set.example
+  id = "a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc"
+}
 ```
-$ terraform import aws_wafregional_regex_match_set.example a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
+
+Using `terraform import`, import WAF Regional Regex Match Set using the id. For example:
+
+```console
+% terraform import aws_wafregional_regex_match_set.example a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
 ```
diff --git a/website/docs/r/wafregional_regex_pattern_set.html.markdown b/website/docs/r/wafregional_regex_pattern_set.html.markdown
index cd09fd30ef6..4ae168a89d9 100644
--- a/website/docs/r/wafregional_regex_pattern_set.html.markdown
+++ b/website/docs/r/wafregional_regex_pattern_set.html.markdown
@@ -21,21 +21,30 @@ resource "aws_wafregional_regex_pattern_set" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The name or description of the Regex Pattern Set.
 * `regex_pattern_strings` - (Optional) A list of regular expression (regex) patterns that you want AWS WAF to search for, such as `B[a@]dB[o0]t`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the WAF Regional Regex Pattern Set.
 
 ## Import
 
-WAF Regional Regex Pattern Set can be imported using the id, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WAF Regional Regex Pattern Set using the id. For example:
 
+```terraform
+import {
+  to = aws_wafregional_regex_pattern_set.example
+  id = "a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc"
+}
 ```
-$ terraform import aws_wafregional_regex_pattern_set.example a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
+
+Using `terraform import`, import WAF Regional Regex Pattern Set using the id. For example:
+
+```console
+% terraform import aws_wafregional_regex_pattern_set.example a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
 ```
diff --git a/website/docs/r/wafregional_rule.html.markdown b/website/docs/r/wafregional_rule.html.markdown
index 5c6a840f522..a5556705123 100644
--- a/website/docs/r/wafregional_rule.html.markdown
+++ b/website/docs/r/wafregional_rule.html.markdown
@@ -36,7 +36,7 @@ resource "aws_wafregional_rule" "wafrule" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The name or description of the rule.
 * `metric_name` - (Required) The name or description for the Amazon CloudWatch metric of this rule.
@@ -57,9 +57,9 @@ See the [WAF Documentation](https://docs.aws.amazon.com/waf/latest/APIReference/
 
 ## Remarks
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the WAF Regional Rule.
 * `arn` - The ARN of the WAF Regional Rule.
@@ -67,8 +67,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-WAF Regional Rule can be imported using the id, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WAF Regional Rule using the id. For example:
 
+```terraform
+import {
+  to = aws_wafregional_rule.wafrule
+  id = "a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc"
+}
 ```
-$ terraform import aws_wafregional_rule.wafrule a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
+
+Using `terraform import`, import WAF Regional Rule using the id. For example:
+
+```console
+% terraform import aws_wafregional_rule.wafrule a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
 ```
diff --git a/website/docs/r/wafregional_rule_group.html.markdown b/website/docs/r/wafregional_rule_group.html.markdown
index 5fb8fc82af7..20e76998147 100644
--- a/website/docs/r/wafregional_rule_group.html.markdown
+++ b/website/docs/r/wafregional_rule_group.html.markdown
@@ -35,7 +35,7 @@ resource "aws_wafregional_rule_group" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) A friendly name of the rule group
 * `metric_name` - (Required) A friendly name for the metrics from the rule group
@@ -54,9 +54,9 @@ The following arguments are supported:
 * `rule_id` - (Required) The ID of a [rule](/docs/providers/aws/r/wafregional_rule.html)
 * `type` - (Optional) The rule type, either [`REGULAR`](/docs/providers/aws/r/wafregional_rule.html), [`RATE_BASED`](/docs/providers/aws/r/wafregional_rate_based_rule.html), or `GROUP`. Defaults to `REGULAR`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the WAF Regional Rule Group.
 * `arn` - The ARN of the WAF Regional Rule Group.
@@ -64,8 +64,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-WAF Regional Rule Group can be imported using the id, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WAF Regional Rule Group using the id. For example:
 
+```terraform
+import {
+  to = aws_wafregional_rule_group.example
+  id = "a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc"
+}
 ```
-$ terraform import aws_wafregional_rule_group.example a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
+
+Using `terraform import`, import WAF Regional Rule Group using the id. For example:
+
+```console
+% terraform import aws_wafregional_rule_group.example a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
 ```
diff --git a/website/docs/r/wafregional_size_constraint_set.html.markdown b/website/docs/r/wafregional_size_constraint_set.html.markdown
index 76c70ae1f94..429f11107ac 100644
--- a/website/docs/r/wafregional_size_constraint_set.html.markdown
+++ b/website/docs/r/wafregional_size_constraint_set.html.markdown
@@ -30,7 +30,7 @@ resource "aws_wafregional_size_constraint_set" "size_constraint_set" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The name or description of the Size Constraint Set.
 * `size_constraints` - (Optional) Specifies the parts of web requests that you want to inspect the size of.
@@ -65,16 +65,25 @@ The following arguments are supported:
   See [docs](http://docs.aws.amazon.com/waf/latest/APIReference/API_FieldToMatch.html)
   for all supported values.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the WAF Size Constraint Set.
 
 ## Import
 
-WAF Size Constraint Set can be imported using the id, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WAF Size Constraint Set using the id. For example:
 
+```terraform
+import {
+  to = aws_wafregional_size_constraint_set.size_constraint_set
+  id = "a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc"
+}
 ```
-$ terraform import aws_wafregional_size_constraint_set.size_constraint_set a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
+
+Using `terraform import`, import WAF Size Constraint Set using the id. For example:
+
+```console
+% terraform import aws_wafregional_size_constraint_set.size_constraint_set a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
 ```
diff --git a/website/docs/r/wafregional_sql_injection_match_set.html.markdown b/website/docs/r/wafregional_sql_injection_match_set.html.markdown
index 767de0cd775..1135707db20 100644
--- a/website/docs/r/wafregional_sql_injection_match_set.html.markdown
+++ b/website/docs/r/wafregional_sql_injection_match_set.html.markdown
@@ -28,7 +28,7 @@ resource "aws_wafregional_sql_injection_match_set" "sql_injection_match_set" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The name or description of the SizeConstraintSet.
 * `sql_injection_match_tuple` - (Optional) The parts of web requests that you want AWS WAF to inspect for malicious SQL code and, if you want AWS WAF to inspect a header, the name of the header.
@@ -53,16 +53,25 @@ The following arguments are supported:
   See [docs](https://docs.aws.amazon.com/waf/latest/APIReference/API_regional_FieldToMatch.html)
   for all supported values.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the WAF SqlInjectionMatchSet.
 
 ## Import
 
-WAF Regional Sql Injection Match Set can be imported using the id, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WAF Regional Sql Injection Match Set using the id. For example:
 
+```terraform
+import {
+  to = aws_wafregional_sql_injection_match_set.sql_injection_match_set
+  id = "a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc"
+}
 ```
-$ terraform import aws_wafregional_sql_injection_match_set.sql_injection_match_set a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
+
+Using `terraform import`, import WAF Regional Sql Injection Match Set using the id. For example:
+
+```console
+% terraform import aws_wafregional_sql_injection_match_set.sql_injection_match_set a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
 ```
diff --git a/website/docs/r/wafregional_web_acl.html.markdown b/website/docs/r/wafregional_web_acl.html.markdown
index d573bcd99dc..8df1bf5a334 100644
--- a/website/docs/r/wafregional_web_acl.html.markdown
+++ b/website/docs/r/wafregional_web_acl.html.markdown
@@ -105,7 +105,7 @@ resource "aws_wafregional_web_acl" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `default_action` - (Required) The action that you want AWS WAF Regional to take when a request doesn't match the criteria in any of the rules that are associated with the web ACL.
 * `metric_name` - (Required) The name or description for the Amazon CloudWatch metric of this web ACL.
@@ -149,9 +149,9 @@ The following arguments are supported:
 
 * `type` - (Required) Specifies how you want AWS WAF Regional to respond to requests that match the settings in a rule. Valid values for `action` are `ALLOW`, `BLOCK` or `COUNT`. Valid values for `override_action` are `COUNT` and `NONE`.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - Amazon Resource Name (ARN) of the WAF Regional WebACL.
 * `id` - The ID of the WAF Regional WebACL.
@@ -159,8 +159,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-WAF Regional Web ACL can be imported using the id, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WAF Regional Web ACL using the id. For example:
 
+```terraform
+import {
+  to = aws_wafregional_web_acl.wafacl
+  id = "a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc"
+}
 ```
-$ terraform import aws_wafregional_web_acl.wafacl a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
+
+Using `terraform import`, import WAF Regional Web ACL using the id. For example:
+
+```console
+% terraform import aws_wafregional_web_acl.wafacl a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc
 ```
diff --git a/website/docs/r/wafregional_web_acl_association.html.markdown b/website/docs/r/wafregional_web_acl_association.html.markdown
index e3b9d2506bf..6839df3e925 100644
--- a/website/docs/r/wafregional_web_acl_association.html.markdown
+++ b/website/docs/r/wafregional_web_acl_association.html.markdown
@@ -175,21 +175,30 @@ resource "aws_wafregional_web_acl_association" "association" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `web_acl_id` - (Required) The ID of the WAF Regional WebACL to create an association.
 * `resource_arn` - (Required) ARN of the resource to associate with. For example, an Application Load Balancer or API Gateway Stage.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the association
 
 ## Import
 
-WAF Regional Web ACL Association can be imported using their `web_acl_id:resource_arn`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WAF Regional Web ACL Association using their `web_acl_id:resource_arn`. For example:
 
+```terraform
+import {
+  to = aws_wafregional_web_acl_association.foo
+  id = "web_acl_id:resource_arn"
+}
 ```
-$ terraform import aws_wafregional_web_acl_association.foo web_acl_id:resource_arn
+
+Using `terraform import`, import WAF Regional Web ACL Association using their `web_acl_id:resource_arn`. For example:
+
+```console
+% terraform import aws_wafregional_web_acl_association.foo web_acl_id:resource_arn
 ```
diff --git a/website/docs/r/wafregional_xss_match_set.html.markdown b/website/docs/r/wafregional_xss_match_set.html.markdown
index aa0a00f69b3..c0e2819de63 100644
--- a/website/docs/r/wafregional_xss_match_set.html.markdown
+++ b/website/docs/r/wafregional_xss_match_set.html.markdown
@@ -36,7 +36,7 @@ resource "aws_wafregional_xss_match_set" "xss_match_set" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The name of the set
 * `xss_match_tuple` - (Optional) The parts of web requests that you want to inspect for cross-site scripting attacks.
@@ -53,16 +53,25 @@ The following arguments are supported:
 * `data` - (Optional) When the value of `type` is `HEADER`, enter the name of the header that you want the WAF to search, for example, `User-Agent` or `Referer`. If the value of `type` is any other value, omit `data`.
 * `type` - (Required) The part of the web request that you want AWS WAF to search for a specified stringE.g., `HEADER` or `METHOD`
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the Regional WAF XSS Match Set.
 
 ## Import
 
-AWS WAF Regional XSS Match can be imported using the `id`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import AWS WAF Regional XSS Match using the `id`. For example:
 
-```sh
-$ terraform import aws_wafregional_xss_match_set.example 12345abcde
+```terraform
+import {
+  to = aws_wafregional_xss_match_set.example
+  id = "12345abcde"
+}
+```
+
+Using `terraform import`, import AWS WAF Regional XSS Match using the `id`. For example:
+
+```console
+% terraform import aws_wafregional_xss_match_set.example 12345abcde
 ```
diff --git a/website/docs/r/wafv2_ip_set.html.markdown b/website/docs/r/wafv2_ip_set.html.markdown
index 320595bd329..9d98fff6de3 100644
--- a/website/docs/r/wafv2_ip_set.html.markdown
+++ b/website/docs/r/wafv2_ip_set.html.markdown
@@ -29,18 +29,18 @@ resource "aws_wafv2_ip_set" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) A friendly name of the IP set.
 * `description` - (Optional) A friendly description of the IP set.
 * `scope` - (Required) Specifies whether this is for an AWS CloudFront distribution or for a regional application. Valid values are `CLOUDFRONT` or `REGIONAL`. To work with CloudFront, you must also specify the Region US East (N. Virginia).
 * `ip_address_version` - (Required) Specify IPV4 or IPV6. Valid values are `IPV4` or `IPV6`.
-* `addresses` - (Required) Contains an array of strings that specify one or more IP addresses or blocks of IP addresses in Classless Inter-Domain Routing (CIDR) notation. AWS WAF supports all address ranges for IP versions IPv4 and IPv6.
+* `addresses` - (Required) Contains an array of strings that specifies zero or more IP addresses or blocks of IP addresses. All addresses must be specified using Classless Inter-Domain Routing (CIDR) notation. WAF supports all IPv4 and IPv6 CIDR ranges except for `/0`.
 * `tags` - (Optional) An array of key:value pairs to associate with the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - A unique identifier for the IP set.
 * `arn` - The Amazon Resource Name (ARN) of the IP set.
@@ -48,8 +48,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-WAFv2 IP Sets can be imported using `ID/name/scope`
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WAFv2 IP Sets using `ID/name/scope`. For example:
 
+```terraform
+import {
+  to = aws_wafv2_ip_set.example
+  id = "a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc/example/REGIONAL"
+}
 ```
-$ terraform import aws_wafv2_ip_set.example a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc/example/REGIONAL
+
+Using `terraform import`, import WAFv2 IP Sets using `ID/name/scope`. For example:
+
+```console
+% terraform import aws_wafv2_ip_set.example a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc/example/REGIONAL
 ```
diff --git a/website/docs/r/wafv2_regex_pattern_set.html.markdown b/website/docs/r/wafv2_regex_pattern_set.html.markdown
index 92b0d6e9b5a..4b0ffadb6d2 100644
--- a/website/docs/r/wafv2_regex_pattern_set.html.markdown
+++ b/website/docs/r/wafv2_regex_pattern_set.html.markdown
@@ -35,21 +35,21 @@ resource "aws_wafv2_regex_pattern_set" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) A friendly name of the regular expression pattern set.
 * `description` - (Optional) A friendly description of the regular expression pattern set.
 * `scope` - (Required) Specifies whether this is for an AWS CloudFront distribution or for a regional application. Valid values are `CLOUDFRONT` or `REGIONAL`. To work with CloudFront, you must also specify the region `us-east-1` (N. Virginia) on the AWS provider.
-* `regular_expression` - (Optional) One or more blocks of regular expression patterns that you want AWS WAF to search for, such as `B[a@]dB[o0]t`. See [Regular Expression](#regular-expression) below for details.
+* `regular_expression` - (Optional) One or more blocks of regular expression patterns that you want AWS WAF to search for, such as `B[a@]dB[o0]t`. See [Regular Expression](#regular-expression) below for details. A maximum of 10 `regular_expression` blocks may be specified.
 * `tags` - (Optional) An array of key:value pairs to associate with the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
 ### Regular Expression
 
 * `regex_string` - (Required) The string representing the regular expression, see the AWS WAF [documentation](https://docs.aws.amazon.com/waf/latest/developerguide/waf-regex-pattern-set-creating.html) for more information.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - A unique identifier for the set.
 * `arn` - The Amazon Resource Name (ARN) that identifies the cluster.
@@ -57,8 +57,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-WAFv2 Regex Pattern Sets can be imported using `ID/name/scope` e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WAFv2 Regex Pattern Sets using `ID/name/scope`. For example:
 
+```terraform
+import {
+  to = aws_wafv2_regex_pattern_set.example
+  id = "a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc/example/REGIONAL"
+}
 ```
-$ terraform import aws_wafv2_regex_pattern_set.example a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc/example/REGIONAL
+
+Using `terraform import`, import WAFv2 Regex Pattern Sets using `ID/name/scope`. For example:
+
+```console
+% terraform import aws_wafv2_regex_pattern_set.example a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc/example/REGIONAL
 ```
diff --git a/website/docs/r/wafv2_rule_group.html.markdown b/website/docs/r/wafv2_rule_group.html.markdown
index b2528448808..b51565eb3c1 100644
--- a/website/docs/r/wafv2_rule_group.html.markdown
+++ b/website/docs/r/wafv2_rule_group.html.markdown
@@ -314,7 +314,7 @@ resource "aws_wafv2_rule_group" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `capacity` - (Required, Forces new resource) The web ACL capacity units (WCUs) required for this rule group. See [here](https://docs.aws.amazon.com/waf/latest/APIReference/API_CreateRuleGroup.html#API_CreateRuleGroup_RequestSyntax) for general information and [here](https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-statements-list.html) for capacity specific information.
 * `custom_response_body` - (Optional) Defines custom response bodies that can be referenced by `custom_response` actions. See [Custom Response Body](#custom-response-body) below for details.
@@ -504,10 +504,11 @@ You can't nest a `rate_based_statement`, for example for use inside a `not_state
 
 The `rate_based_statement` block supports the following arguments:
 
-* `aggregate_key_type` - (Optional) Setting that indicates how to aggregate the request counts. Valid values include: `FORWARDED_IP` or `IP`. Default: `IP`.
+* `aggregate_key_type` - (Optional) Setting that indicates how to aggregate the request counts. Valid values include: `CONSTANT`, `CUSTOM_KEYS`, `FORWARDED_IP` or `IP`. Default: `IP`.
+* `custom_key` - (Optional) Aggregate the request counts using one or more web request components as the aggregate keys. See [`custom_key`](#custom_key-block) below for details.
 * `forwarded_ip_config` - (Optional) The configuration for inspecting IP addresses in an HTTP header that you specify, instead of using the IP address that's reported by the web request origin. If `aggregate_key_type` is set to `FORWARDED_IP`, this block is required. See [Forwarded IP Config](#forwarded-ip-config) below for details.
 * `limit` - (Required) The limit on requests per 5-minute period for a single originating IP address.
-* `scope_down_statement` - (Optional) An optional nested statement that narrows the scope of the rate-based statement to matching web requests. This can be any nestable statement, and you can nest statements at any level below this scope-down statement. See [Statement](#statement) above for details.
+* `scope_down_statement` - (Optional) An optional nested statement that narrows the scope of the rate-based statement to matching web requests. This can be any nestable statement, and you can nest statements at any level below this scope-down statement. See [Statement](#statement) above for details. If `aggregate_key_type` is set to `CONSTANT`, this block is required.
 
 ### Regex Match Statement
 
@@ -686,18 +687,112 @@ The `immunity_time_property` block supports the following arguments:
 
 * `immunity_time` - (Optional) The amount of time, in seconds, that a CAPTCHA or challenge timestamp is considered valid by AWS WAF. The default setting is 300.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ID of the WAF rule group.
 * `arn` - The ARN of the WAF rule group.
 * `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
 
+### `custom_key` Block
+
+Aggregate the request counts using one or more web request components as the aggregate keys. With this option, you must specify the aggregate keys in the `custom_keys` block. To aggregate on only the IP address or only the forwarded IP address, don't use custom keys. Instead, set the `aggregate_key_type` to `IP` or `FORWARDED_IP`.
+
+The `custom_key` block supports the following arguments:
+
+* `cookie` - (Optional) Use the value of a cookie in the request as an aggregate key. See [RateLimit `cookie`](#ratelimit-cookie-block) below for details.
+* `forwarded_ip` - (Optional) Use the first IP address in an HTTP header as an aggregate key. See [`forwarded_ip`](#ratelimit-forwarded_ip-block) below for details.
+* `http_method` - (Optional) Use the request's HTTP method as an aggregate key. See [RateLimit `http_method`](#ratelimit-http_method-block) below for details.
+* `header` - (Optional) Use the value of a header in the request as an aggregate key. See [RateLimit `header`](#ratelimit-header-block) below for details.
+* `ip` - (Optional) Use the request's originating IP address as an aggregate key. See [`RateLimit ip`](#ratelimit-ip-block) below for details.
+* `label_namespace` - (Optional) Use the specified label namespace as an aggregate key. See [RateLimit `label_namespace`](#ratelimit-label_namespace-block) below for details.
+* `query_argument` - (Optional) Use the specified query argument as an aggregate key. See [RateLimit `query_argument`](#ratelimit-query_argument-block) below for details.
+* `query_string` - (Optional) Use the request's query string as an aggregate key. See [RateLimit `query_string`](#ratelimit-query_string-block) below for details.
+* `uri_path` - (Optional) Use the request's URI path as an aggregate key. See [RateLimit `uri_path`](#ratelimit-uri_path-block) below for details.
+
+### RateLimit `cookie` Block
+
+Use the value of a cookie in the request as an aggregate key. Each distinct value in the cookie contributes to the aggregation instance. If you use a single cookie as your custom key, then each value fully defines an aggregation instance.
+
+The `cookie` block supports the following arguments:
+
+* `name`: The name of the cookie to use.
+* `text_transformation`: Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection. They are used in rate-based rule statements, to transform request components before using them as custom aggregation keys. Atleast one transformation is required.  See [Text Transformation](#text-transformation) above for details.
+
+### RateLimit `forwarded_ip` Block
+
+Use the first IP address in an HTTP header as an aggregate key. Each distinct forwarded IP address contributes to the aggregation instance. When you specify an IP or forwarded IP in the custom key settings, you must also specify at least one other key to use. You can aggregate on only the forwarded IP address by specifying `FORWARDED_IP` in your rate-based statement's `aggregate_key_type`. With this option, you must specify the header to use in the rate-based rule's [Forwarded IP Config](#forwarded-ip-config) block.
+
+The `forwarded_ip` block is configured as an empty block `{}`.
+
+### RateLimit `http_method` Block
+
+Use the request's HTTP method as an aggregate key. Each distinct HTTP method contributes to the aggregation instance. If you use just the HTTP method as your custom key, then each method fully defines an aggregation instance.
+
+The `http_method` block is configured as an empty block `{}`.
+
+### RateLimit `header` Block
+
+Use the value of a header in the request as an aggregate key. Each distinct value in the header contributes to the aggregation instance. If you use a single header as your custom key, then each value fully defines an aggregation instance.
+
+The `header` block supports the following arguments:
+
+* `name`: The name of the header to use.
+* `text_transformation`: Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection. They are used in rate-based rule statements, to transform request components before using them as custom aggregation keys. Atleast one transformation is required.  See [Text Transformation](#text-transformation) above for details.
+
+### RateLimit `ip` Block
+
+Use the request's originating IP address as an aggregate key. Each distinct IP address contributes to the aggregation instance. When you specify an IP or forwarded IP in the custom key settings, you must also specify at least one other key to use. You can aggregate on only the IP address by specifying `IP` in your rate-based statement's `aggregate_key_type`.
+
+The `ip` block is configured as an empty block `{}`.
+
+### RateLimit `label_namespace` Block
+
+Use the specified label namespace as an aggregate key. Each distinct fully qualified label name that has the specified label namespace contributes to the aggregation instance. If you use just one label namespace as your custom key, then each label name fully defines an aggregation instance. This uses only labels that have been added to the request by rules that are evaluated before this rate-based rule in the web ACL. For information about label namespaces and names, see Label syntax and naming requirements (https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-label-requirements.html) in the WAF Developer Guide.
+
+The `label_namespace` block supports the following arguments:
+
+* `namespace`: The namespace to use for aggregation
+
+### RateLimit `query_argument` Block
+
+Use the specified query argument as an aggregate key. Each distinct value for the named query argument contributes to the aggregation instance. If you use a single query argument as your custom key, then each value fully defines an aggregation instance.
+
+The `query_argument` block supports the following arguments:
+
+* `name`: The name of the query argument to use.
+* `text_transformation`: Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection. They are used in rate-based rule statements, to transform request components before using them as custom aggregation keys. Atleast one transformation is required. See [Text Transformation](#text-transformation) above for details.
+
+### RateLimit `query_string` Block
+
+Use the request's query string as an aggregate key. Each distinct string contributes to the aggregation instance. If you use just the query string as your custom key, then each string fully defines an aggregation instance.
+
+The `query_string` block supports the following arguments:
+
+* `text_transformation`: Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection. They are used in rate-based rule statements, to transform request components before using them as custom aggregation keys. Atleast one transformation is required. See [Text Transformation](#text-transformation) above for details.
+
+### RateLimit `uri_path` Block
+
+Use the request's URI path as an aggregate key. Each distinct URI path contributes to the aggregation instance. If you use just the URI path as your custom key, then each URI path fully defines an aggregation instance.
+
+The `uri_path` block supports the following arguments:
+
+* `text_transformation`: Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection. They are used in rate-based rule statements, to transform request components before using them as custom aggregation keys. Atleast one transformation is required. See [Text Transformation](#text-transformation) above for details.
+
 ## Import
 
-WAFv2 Rule Group can be imported using `ID/name/scope` e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WAFv2 Rule Group using `ID/name/scope`. For example:
 
+```terraform
+import {
+  to = aws_wafv2_rule_group.example
+  id = "a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc/example/REGIONAL"
+}
 ```
-$ terraform import aws_wafv2_rule_group.example a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc/example/REGIONAL
+
+Using `terraform import`, import WAFv2 Rule Group using `ID/name/scope`. For example:
+
+```console
+% terraform import aws_wafv2_rule_group.example a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc/example/REGIONAL
 ```
diff --git a/website/docs/r/wafv2_web_acl.html.markdown b/website/docs/r/wafv2_web_acl.html.markdown
index 0e6c4892d2c..65f0ac567c5 100644
--- a/website/docs/r/wafv2_web_acl.html.markdown
+++ b/website/docs/r/wafv2_web_acl.html.markdown
@@ -10,7 +10,7 @@ description: |-
 
 Creates a WAFv2 Web ACL resource.
 
-~> **Note:** In `field_to_match` blocks, _e.g._, in `byte_match_statement`, the `body` block includes an optional argument `oversize_handling`. AWS indicates this argument will be required starting February 2023. To avoid configurations breaking when that change happens, treat the `oversize_handling` argument as **required** as soon as possible.
+~> **Note** In `field_to_match` blocks, _e.g._, in `byte_match_statement`, the `body` block includes an optional argument `oversize_handling`. AWS indicates this argument will be required starting February 2023. To avoid configurations breaking when that change happens, treat the `oversize_handling` argument as **required** as soon as possible.
 
 ## Example Usage
 
@@ -87,9 +87,81 @@ resource "aws_wafv2_web_acl" "example" {
 }
 ```
 
-### Account Takeover Protection
+### Account Creation Fraud Prevention
+
+```terraform
+resource "aws_wafv2_web_acl" "acfp-example" {
+  name        = "managed-acfp-example"
+  description = "Example of a managed ACFP rule."
+  scope       = "CLOUDFRONT"
+
+  default_action {
+    allow {}
+  }
+
+  rule {
+    name     = "acfp-rule-1"
+    priority = 1
+
+    override_action {
+      count {}
+    }
 
+    statement {
+      managed_rule_group_statement {
+        name        = "AWSManagedRulesACFPRuleSet"
+        vendor_name = "AWS"
+
+        managed_rule_group_configs {
+          aws_managed_rules_acfp_rule_set {
+            creation_path          = "/signin"
+            registration_page_path = "/register"
+
+            request_inspection {
+              email_field {
+                identifier = "/email"
+              }
+
+              password_field {
+                identifier = "/password"
+              }
+
+              payload_type = "JSON"
+
+              username_field {
+                identifier = "/username"
+              }
+            }
+
+            response_inspection {
+              status_code {
+                failure_codes = ["403"]
+                success_codes = ["200"]
+              }
+            }
+          }
+        }
+      }
+    }
+
+    visibility_config {
+      cloudwatch_metrics_enabled = false
+      metric_name                = "friendly-rule-metric-name"
+      sampled_requests_enabled   = false
+    }
+  }
+
+  visibility_config {
+    cloudwatch_metrics_enabled = false
+    metric_name                = "friendly-metric-name"
+    sampled_requests_enabled   = false
+  }
+}
 ```
+
+### Account Takeover Protection
+
+```terraform
 resource "aws_wafv2_web_acl" "atp-example" {
   name        = "managed-atp-example"
   description = "Example of a managed ATP rule."
@@ -347,204 +419,209 @@ resource "aws_wafv2_web_acl" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
-* `custom_response_body` - (Optional) Defines custom response bodies that can be referenced by `custom_response` actions. See [`custom_response_body`](#custom_response_body) below for details.
-* `default_action` - (Required) Action to perform if none of the `rules` contained in the WebACL match. See [`default_ action`](#default_action) below for details.
+* `association_config` - (Optional) Specifies custom configurations for the associations between the web ACL and protected resources. See [`association_config`](#association_config-block) below for details.
+* `custom_response_body` - (Optional) Defines custom response bodies that can be referenced by `custom_response` actions. See [`custom_response_body`](#custom_response_body-block) below for details.
+* `default_action` - (Required) Action to perform if none of the `rules` contained in the WebACL match. See [`default_action`](#default_action-block) below for details.
 * `description` - (Optional) Friendly description of the WebACL.
 * `name` - (Required) Friendly name of the WebACL.
-* `rule` - (Optional) Rule blocks used to identify the web requests that you want to `allow`, `block`, or `count`. See [`rule`](#rule) below for details.
+* `rule` - (Optional) Rule blocks used to identify the web requests that you want to `allow`, `block`, or `count`. See [`rule`](#rule-block) below for details.
 * `scope` - (Required) Specifies whether this is for an AWS CloudFront distribution or for a regional application. Valid values are `CLOUDFRONT` or `REGIONAL`. To work with CloudFront, you must also specify the region `us-east-1` (N. Virginia) on the AWS provider.
 * `tags` - (Optional) Map of key-value pairs to associate with the resource. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 * `token_domains` - (Optional) Specifies the domains that AWS WAF should accept in a web request token. This enables the use of tokens across multiple protected websites. When AWS WAF provides a token, it uses the domain of the AWS resource that the web ACL is protecting. If you don't specify a list of token domains, AWS WAF accepts tokens only for the domain of the protected resource. With a token domain list, AWS WAF accepts the resource's host domain plus all domains in the token domain list, including their prefixed subdomains.
-* `visibility_config` - (Required) Defines and enables Amazon CloudWatch metrics and web request sample collection. See [`visibility_config`](#visibility_config) below for details.
+* `visibility_config` - (Required) Defines and enables Amazon CloudWatch metrics and web request sample collection. See [`visibility_config`](#visibility_config-block) below for details.
 
-### `custom_response_body`
+### `association_config` Block
+
+The `association_config` block supports the following arguments:
+
+* `request_body` - (Optional) Customizes the request body that your protected resource forward to AWS WAF for inspection. See [`request_body`](#request_body-block) below for details.
+
+### `custom_response_body` Block
 
 Each `custom_response_body` block supports the following arguments:
 
-* `key` - (Required) Unique key identifying the custom response body. This is referenced by the `custom_response_body_key` argument in the [`custom_response`](#custom_response) block.
+* `key` - (Required) Unique key identifying the custom response body. This is referenced by the `custom_response_body_key` argument in the [`custom_response`](#custom_response-block) block.
 * `content` - (Required) Payload of the custom response.
 * `content_type` - (Required) Type of content in the payload that you are defining in the `content` argument. Valid values are `TEXT_PLAIN`, `TEXT_HTML`, or `APPLICATION_JSON`.
 
-### `default_action`
+### `default_action` Block
 
 The `default_action` block supports the following arguments:
 
-~> **NOTE:** One of `allow` or `block`, expressed as an empty configuration block `{}`, is required when specifying a `default_action`
+~> **Note** One of `allow` or `block`, expressed as an empty configuration block `{}`, is required when specifying a `default_action`
 
-* `allow` - (Optional) Specifies that AWS WAF should allow requests by default. See [`allow`](#allow) below for details.
-* `block` - (Optional) Specifies that AWS WAF should block requests by default. See [`block`](#block) below for details.
+* `allow` - (Optional) Specifies that AWS WAF should allow requests by default. See [`allow`](#allow-block) below for details.
+* `block` - (Optional) Specifies that AWS WAF should block requests by default. See [`block`](#block-block) below for details.
 
-### `rule`
+### `rule` Block
 
-~> **NOTE:** One of `action` or `override_action` is required when specifying a rule
+~> **Note** One of `action` or `override_action` is required when specifying a rule
 
 Each `rule` supports the following arguments:
 
-* `action` - (Optional) Action that AWS WAF should take on a web request when it matches the rule's statement. This is used only for rules whose **statements do not reference a rule group**. See [`action`](#action) below for details.
-* `captcha_config` - (Optional) Specifies how AWS WAF should handle CAPTCHA evaluations. See [Captcha Configuration](#captcha-configuration) below for details.
-* `name` - (Required) Friendly name of the rule. **NOTE:** The provider assumes that rules with names matching this pattern, `^ShieldMitigationRuleGroup_<account-id>_<web-acl-guid>_.*`, are AWS-added for [automatic application layer DDoS mitigation activities](https://docs.aws.amazon.com/waf/latest/developerguide/ddos-automatic-app-layer-response-rg.html). Such rules will be ignored by the provider unless you explicitly include them in your configuration (for example, by using the AWS CLI to discover their properties and creating matching configuration). However, since these rules are owned and managed by AWS, you may get permission errors.
-* `override_action` - (Optional) Override action to apply to the rules in a rule group. Used only for rule **statements that reference a rule group**, like `rule_group_reference_statement` and `managed_rule_group_statement`. See [`override_action`](#override_action) below for details.
+* `action` - (Optional) Action that AWS WAF should take on a web request when it matches the rule's statement. This is used only for rules whose **statements do not reference a rule group**. See [`action`](#action-block) for details.
+* `captcha_config` - (Optional) Specifies how AWS WAF should handle CAPTCHA evaluations. See [`captcha_config`](#captcha_config-block) below for details.
+* `name` - (Required) Friendly name of the rule. Note that the provider assumes that rules with names matching this pattern, `^ShieldMitigationRuleGroup_<account-id>_<web-acl-guid>_.*`, are AWS-added for [automatic application layer DDoS mitigation activities](https://docs.aws.amazon.com/waf/latest/developerguide/ddos-automatic-app-layer-response-rg.html). Such rules will be ignored by the provider unless you explicitly include them in your configuration (for example, by using the AWS CLI to discover their properties and creating matching configuration). However, since these rules are owned and managed by AWS, you may get permission errors.
+* `override_action` - (Optional) Override action to apply to the rules in a rule group. Used only for rule **statements that reference a rule group**, like `rule_group_reference_statement` and `managed_rule_group_statement`. See [`override_action`](#override_action-block) below for details.
 * `priority` - (Required) If you define more than one Rule in a WebACL, AWS WAF evaluates each request against the `rules` in order based on the value of `priority`. AWS WAF processes rules with lower priority first.
-* `rule_label` - (Optional) Labels to apply to web requests that match the rule match statement. See [`rule_label`](#rule_label) below for details.
-* `statement` - (Required) The AWS WAF processing statement for the rule, for example `byte_match_statement` or `geo_match_statement`. See [`statement`](#statement) below for details.
-* `visibility_config` - (Required) Defines and enables Amazon CloudWatch metrics and web request sample collection. See [`visibility_config`](#visibility_config) below for details.
+* `rule_label` - (Optional) Labels to apply to web requests that match the rule match statement. See [`rule_label`](#rule_label-block) below for details.
+* `statement` - (Required) The AWS WAF processing statement for the rule, for example `byte_match_statement` or `geo_match_statement`. See [`statement`](#statement-block) below for details.
+* `visibility_config` - (Required) Defines and enables Amazon CloudWatch metrics and web request sample collection. See [`visibility_config`](#visibility_config-block) below for details.
 
-#### `action`
+### `action` Block
 
 The `action` block supports the following arguments:
 
-~> **NOTE:** One of `allow`, `block`, or `count`, is required when specifying an `action`.
+~> **Note** One of `allow`, `block`, or `count`, is required when specifying an `action`.
 
-* `allow` - (Optional) Instructs AWS WAF to allow the web request. See [`allow`](#allow) below for details.
-* `block` - (Optional) Instructs AWS WAF to block the web request. See [`block`](#block) below for details.
-* `captcha` - (Optional) Instructs AWS WAF to run a Captcha check against the web request. See [`captcha`](#captcha) below for details.
-* `challenge` - (Optional) Instructs AWS WAF to run a check against the request to verify that the request is coming from a legitimate client session. See [`challenge`](#challenge) below for details.
-* `count` - (Optional) Instructs AWS WAF to count the web request and allow it. See [`count`](#count) below for details.
+* `allow` - (Optional) Instructs AWS WAF to allow the web request. See [`allow`](#allow-block) below for details.
+* `block` - (Optional) Instructs AWS WAF to block the web request. See [`block`](#block-block) below for details.
+* `captcha` - (Optional) Instructs AWS WAF to run a Captcha check against the web request. See [`captcha`](#captcha-block) below for details.
+* `challenge` - (Optional) Instructs AWS WAF to run a check against the request to verify that the request is coming from a legitimate client session. See [`challenge`](#challenge-block) below for details.
+* `count` - (Optional) Instructs AWS WAF to count the web request and allow it. See [`count`](#count-block) below for details.
 
-#### `override_action`
+### `override_action` Block
 
 The `override_action` block supports the following arguments:
 
-~> **NOTE:** One of `count` or `none`, expressed as an empty configuration block `{}`, is required when specifying an `override_action`
+~> **Note** One of `count` or `none`, expressed as an empty configuration block `{}`, is required when specifying an `override_action`
 
 * `count` - (Optional) Override the rule action setting to count (i.e., only count matches). Configured as an empty block `{}`.
 * `none` - (Optional) Don't override the rule action setting. Configured as an empty block `{}`.
 
-#### `allow`
+### `allow` Block
 
 The `allow` block supports the following arguments:
 
-* `custom_request_handling` - (Optional) Defines custom handling for the web request. See [`custom_request_handling`](#custom_request_handling) below for details.
+* `custom_request_handling` - (Optional) Defines custom handling for the web request. See [`custom_request_handling`](#custom_request_handling-block) below for details.
 
-#### `block`
+### `block` Block
 
 The `block` block supports the following arguments:
 
-* `custom_response` - (Optional) Defines a custom response for the web request. See [`custom_response`](#custom_response) below for details.
+* `custom_response` - (Optional) Defines a custom response for the web request. See [`custom_response`](#custom_response-block) below for details.
 
-#### `captcha`
+### `captcha` Block
 
 The `captcha` block supports the following arguments:
 
-* `custom_request_handling` - (Optional) Defines custom handling for the web request. See [`custom_request_handling`](#custom_request_handling) below for details.
+* `custom_request_handling` - (Optional) Defines custom handling for the web request. See [`custom_request_handling`](#custom_request_handling-block) below for details.
 
-#### `challenge`
+### `challenge` Block
 
 The `challenge` block supports the following arguments:
 
-* `custom_request_handling` - (Optional) Defines custom handling for the web request. See [`custom_request_handling`](#custom_request_handling) below for details.
+* `custom_request_handling` - (Optional) Defines custom handling for the web request. See [`custom_request_handling`](#custom_request_handling-block) below for details.
 
-#### `count`
+### `count` Block
 
 The `count` block supports the following arguments:
 
-* `custom_request_handling` - (Optional) Defines custom handling for the web request. See [`custom_request_handling`](#custom_request_handling) below for details.
+* `custom_request_handling` - (Optional) Defines custom handling for the web request. See [`custom_request_handling`](#custom_request_handling-block) below for details.
 
-#### `custom_request_handling`
+### `custom_request_handling` Block
 
 The `custom_request_handling` block supports the following arguments:
 
-* `insert_header` - (Required) The `insert_header` blocks used to define HTTP headers added to the request. See [`insert_header`](#insert_header) below for details.
+* `insert_header` - (Required) The `insert_header` blocks used to define HTTP headers added to the request. See [`insert_header`](#insert_header-block) below for details.
 
-#### `insert_header`
+### `insert_header` Block
 
 Each `insert_header` block supports the following arguments. Duplicate header names are not allowed:
 
 * `name` - Name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
 * `value` - Value of the custom header.
 
-#### `custom_response`
+### `custom_response` Block
 
 The `custom_response` block supports the following arguments:
 
 * `custom_response_body_key` - (Optional) References the response body that you want AWS WAF to return to the web request client. This must reference a `key` defined in a `custom_response_body` block of this resource.
 * `response_code` - (Required) The HTTP status code to return to the client.
-* `response_header` - (Optional) The `response_header` blocks used to define the HTTP response headers added to the response. See [`response_header`](#response_header) below for details.
+* `response_header` - (Optional) The `response_header` blocks used to define the HTTP response headers added to the response. See [`response_header`](#response_header-block) below for details.
 
-#### `response_header`
+### `response_header` Block
 
 Each `response_header` block supports the following arguments. Duplicate header names are not allowed:
 
 * `name` - Name of the custom header. For custom request header insertion, when AWS WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, AWS WAF inserts the header `x-amzn-waf-sample`.
 * `value` - Value of the custom header.
 
-#### `rule_label`
+### `rule_label` Block
 
 Each block supports the following arguments:
 
 * `name` - Label string.
 
-#### `statement`
+### `statement` Block
 
 The processing guidance for a Rule, used by AWS WAF to determine whether a web request matches the rule. See the [documentation](https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-statements-list.html) for more information.
 
--> **NOTE:** Although the `statement` block is recursive, currently only 3 levels are supported.
+-> **Note** Although the `statement` block is recursive, currently only 3 levels are supported.
 
 The `statement` block supports the following arguments:
 
-* `and_statement` - (Optional) Logical rule statement used to combine other rule statements with AND logic. See [`and_statement`](#and_statement) below for details.
-* `byte_match_statement` - (Optional) Rule statement that defines a string match search for AWS WAF to apply to web requests. See [`byte_match_statement`](#byte_match_statement) below for details.
-* `geo_match_statement` - (Optional) Rule statement used to identify web requests based on country of origin. See [`geo_match_statement`](#geo_match_statement) below for details.
-* `ip_set_reference_statement` - (Optional) Rule statement used to detect web requests coming from particular IP addresses or address ranges. See [IP Set Reference Statement](#ip_set_reference_statement) below for details.
-* `label_match_statement` - (Optional) Rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See [`label_match_statement`](#label_match_statement) below for details.
-* `managed_rule_group_statement` - (Optional) Rule statement used to run the rules that are defined in a managed rule group.  This statement can not be nested. See [Managed Rule Group Statement](#managed_rule_group_statement) below for details.
-* `not_statement` - (Optional) Logical rule statement used to negate the results of another rule statement. See [`not_statement`](#not_statement) below for details.
-* `or_statement` - (Optional) Logical rule statement used to combine other rule statements with OR logic. See [`or_statement`](#or_statement) below for details.
-* `rate_based_statement` - (Optional) Rate-based rule tracks the rate of requests for each originating `IP address`, and triggers the rule action when the rate exceeds a limit that you specify on the number of requests in any `5-minute` time span. This statement can not be nested. See [`rate_based_statement`](#rate_based_statement) below for details.
-* `regex_match_statement` - (Optional) Rule statement used to search web request components for a match against a single regular expression. See [`regex_match_statement`](#regex_match_statement) below for details.
-* `regex_pattern_set_reference_statement` - (Optional) Rule statement used to search web request components for matches with regular expressions. See [Regex Pattern Set Reference Statement](#regex_pattern_set_reference_statement) below for details.
-* `rule_group_reference_statement` - (Optional) Rule statement used to run the rules that are defined in an WAFv2 Rule Group. See [Rule Group Reference Statement](#rule_group_reference_statement) below for details.
-* `size_constraint_statement` - (Optional) Rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See [`size_constraint_statement`](#size_constraint_statement) below for more details.
-* `sqli_match_statement` - (Optional) An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See [`sqli_match_statement`](#sqli_match_statement) below for details.
-* `xss_match_statement` - (Optional) Rule statement that defines a cross-site scripting (XSS) match search for AWS WAF to apply to web requests. See [`xss_match_statement`](#xss_match_statement) below for details.
-
-#### `and_statement`
+* `and_statement` - (Optional) Logical rule statement used to combine other rule statements with AND logic. See [`and_statement`](#and_statement-block) below for details.
+* `byte_match_statement` - (Optional) Rule statement that defines a string match search for AWS WAF to apply to web requests. See [`byte_match_statement`](#byte_match_statement-block) below for details.
+* `geo_match_statement` - (Optional) Rule statement used to identify web requests based on country of origin. See [`geo_match_statement`](#geo_match_statement-block) below for details.
+* `ip_set_reference_statement` - (Optional) Rule statement used to detect web requests coming from particular IP addresses or address ranges. See [`ip_set_reference_statement`](#ip_set_reference_statement-block) below for details.
+* `label_match_statement` - (Optional) Rule statement that defines a string match search against labels that have been added to the web request by rules that have already run in the web ACL. See [`label_match_statement`](#label_match_statement-block) below for details.
+* `managed_rule_group_statement` - (Optional) Rule statement used to run the rules that are defined in a managed rule group.  This statement can not be nested. See [`managed_rule_group_statement`](#managed_rule_group_statement-block) below for details.
+* `not_statement` - (Optional) Logical rule statement used to negate the results of another rule statement. See [`not_statement`](#not_statement-block) below for details.
+* `or_statement` - (Optional) Logical rule statement used to combine other rule statements with OR logic. See [`or_statement`](#or_statement-block) below for details.
+* `rate_based_statement` - (Optional) Rate-based rule tracks the rate of requests for each originating `IP address`, and triggers the rule action when the rate exceeds a limit that you specify on the number of requests in any `5-minute` time span. This statement can not be nested. See [`rate_based_statement`](#rate_based_statement-block) below for details.
+* `regex_match_statement` - (Optional) Rule statement used to search web request components for a match against a single regular expression. See [`regex_match_statement`](#regex_match_statement-block) below for details.
+* `regex_pattern_set_reference_statement` - (Optional) Rule statement used to search web request components for matches with regular expressions. See [`regex_pattern_set_reference_statement`](#regex_pattern_set_reference_statement-block) below for details.
+* `rule_group_reference_statement` - (Optional) Rule statement used to run the rules that are defined in an WAFv2 Rule Group. See [`rule_group_reference_statement`](#rule_group_reference_statement-block) below for details.
+* `size_constraint_statement` - (Optional) Rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). See [`size_constraint_statement`](#size_constraint_statement-block) below for more details.
+* `sqli_match_statement` - (Optional) An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. See [`sqli_match_statement`](#sqli_match_statement-block) below for details.
+* `xss_match_statement` - (Optional) Rule statement that defines a cross-site scripting (XSS) match search for AWS WAF to apply to web requests. See [`xss_match_statement`](#xss_match_statement-block) below for details.
+
+### `and_statement` Block
 
 A logical rule statement used to combine other rule statements with `AND` logic. You provide more than one `statement` within the `and_statement`.
 
 The `and_statement` block supports the following arguments:
 
-* `statement` - (Required) Statements to combine with `AND` logic. You can use any statements that can be nested. See [`statement`](#statement) above for details.
+* `statement` - (Required) Statements to combine with `AND` logic. You can use any statements that can be nested. See [`statement`](#statement-block) above for details.
 
-#### `byte_match_statement`
+### `byte_match_statement` Block
 
 The byte match statement provides the bytes to search for, the location in requests that you want AWS WAF to search, and other settings. The bytes to search for are typically a string that corresponds with ASCII characters.
 
 The `byte_match_statement` block supports the following arguments:
 
-* `field_to_match` - (Optional) Part of a web request that you want AWS WAF to inspect. See [`field_to_match`](#field_to_match) below for details.
+* `field_to_match` - (Optional) Part of a web request that you want AWS WAF to inspect. See [`field_to_match`](#field_to_match-block) below for details.
 * `positional_constraint` - (Required) Area within the portion of a web request that you want AWS WAF to search for `search_string`. Valid values include the following: `EXACTLY`, `STARTS_WITH`, `ENDS_WITH`, `CONTAINS`, `CONTAINS_WORD`. See the AWS [documentation](https://docs.aws.amazon.com/waf/latest/APIReference/API_ByteMatchStatement.html) for more information.
 * `search_string` - (Required) String value that you want AWS WAF to search for. AWS WAF searches only in the part of web requests that you designate for inspection in `field_to_match`. The maximum length of the value is 50 bytes.
-* `text_transformation` - (Required) Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection.
-  At least one required.
-  See [`text_transformation`](#text_transformation) below for details.
+* `text_transformation` - (Required) Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection. At least one transformation is required. See [`text_transformation`](#text_transformation-block) below for details.
 
-#### `geo_match_statement`
+### `geo_match_statement` Block
 
 The `geo_match_statement` block supports the following arguments:
 
 * `country_codes` - (Required) Array of two-character country codes, for example, [ "US", "CN" ], from the alpha-2 country ISO codes of the `ISO 3166` international standard. See the [documentation](https://docs.aws.amazon.com/waf/latest/APIReference/API_GeoMatchStatement.html) for valid values.
-* `forwarded_ip_config` - (Optional) Configuration for inspecting IP addresses in an HTTP header that you specify, instead of using the IP address that's reported by the web request origin. See [`forwarded_ip_config`](#forwarded_ip_config) below for details.
+* `forwarded_ip_config` - (Optional) Configuration for inspecting IP addresses in an HTTP header that you specify, instead of using the IP address that's reported by the web request origin. See [`forwarded_ip_config`](#forwarded_ip_config-block) below for details.
 
-#### `ip_set_reference_statement`
+### `ip_set_reference_statement` Block
 
 A rule statement used to detect web requests coming from particular IP addresses or address ranges. To use this, create an `aws_wafv2_ip_set` that specifies the addresses you want to detect, then use the `ARN` of that set in this statement.
 
 The `ip_set_reference_statement` block supports the following arguments:
 
 * `arn` - (Required) The Amazon Resource Name (ARN) of the IP Set that this statement references.
-* `ip_set_forwarded_ip_config` - (Optional) Configuration for inspecting IP addresses in an HTTP header that you specify, instead of using the IP address that's reported by the web request origin. See [`ip_set_forwarded_ip_config`](#ip_set_forwarded_ip_config) below for more details.
+* `ip_set_forwarded_ip_config` - (Optional) Configuration for inspecting IP addresses in an HTTP header that you specify, instead of using the IP address that's reported by the web request origin. See [`ip_set_forwarded_ip_config`](#ip_set_forwarded_ip_config-block) below for more details.
 
-#### `label_match_statement`
+### `label_match_statement` Block
 
 The `label_match_statement` block supports the following arguments:
 
 * `scope` - (Required) Specify whether you want to match using the label name or just the namespace. Valid values are `LABEL` or `NAMESPACE`.
 * `key` - (Required) String to match against.
 
-#### `managed_rule_group_statement`
+### `managed_rule_group_statement` Block
 
 A rule statement used to run the rules that are defined in a managed rule group.
 
@@ -553,29 +630,29 @@ You can't nest a `managed_rule_group_statement`, for example for use inside a `n
 The `managed_rule_group_statement` block supports the following arguments:
 
 * `name` - (Required) Name of the managed rule group.
-* `rule_action_override` - (Optional) Action settings to use in the place of the rule actions that are configured inside the rule group. You specify one override for each rule whose action you want to change. See [`rule_action_override`](#rule_action_override) below for details.
-* `managed_rule_group_configs`- (Optional) Additional information that's used by a managed rule group. Only one rule attribute is allowed in each config. See [Managed Rule Group Configs](#managed_rule_group_configs) for more details
-* `scope_down_statement` - Narrows the scope of the statement to matching web requests. This can be any nestable statement, and you can nest statements at any level below this scope-down statement. See [`statement`](#statement) above for details.
+* `rule_action_override` - (Optional) Action settings to use in the place of the rule actions that are configured inside the rule group. You specify one override for each rule whose action you want to change. See [`rule_action_override`](#rule_action_override-block) below for details.
+* `managed_rule_group_configs`- (Optional) Additional information that's used by a managed rule group. Only one rule attribute is allowed in each config. See [`managed_rule_group_configs`](#managed_rule_group_configs-block) for more details
+* `scope_down_statement` - Narrows the scope of the statement to matching web requests. This can be any nestable statement, and you can nest statements at any level below this scope-down statement. See [`statement`](#statement-block) above for details.
 * `vendor_name` - (Required) Name of the managed rule group vendor.
 * `version` - (Optional) Version of the managed rule group. You can set `Version_1.0` or `Version_1.1` etc. If you want to use the default version, do not set anything.
 
-#### `not_statement`
+### `not_statement` Block
 
 A logical rule statement used to negate the results of another rule statement. You provide one `statement` within the `not_statement`.
 
 The `not_statement` block supports the following arguments:
 
-* `statement` - (Required) Statement to negate. You can use any statement that can be nested. See [`statement`](#statement) above for details.
+* `statement` - (Required) Statement to negate. You can use any statement that can be nested. See [`statement`](#statement-block) above for details.
 
-#### `or_statement`
+### `or_statement` Block
 
 A logical rule statement used to combine other rule statements with `OR` logic. You provide more than one `statement` within the `or_statement`.
 
 The `or_statement` block supports the following arguments:
 
-* `statement` - (Required) Statements to combine with `OR` logic. You can use any statements that can be nested. See [`statement`](#statement) above for details.
+* `statement` - (Required) Statements to combine with `OR` logic. You can use any statements that can be nested. See [`statement`](#statement-block) above for details.
 
-#### `rate_based_statement`
+### `rate_based_statement` Block
 
 A rate-based rule tracks the rate of requests for each originating IP address, and triggers the rule action when the rate exceeds a limit that you specify on the number of requests in any 5-minute time span. You can use this to put a temporary block on requests from an IP address that is sending excessive requests. See the [documentation](https://docs.aws.amazon.com/waf/latest/APIReference/API_RateBasedStatement.html) for more information.
 
@@ -583,36 +660,33 @@ You can't nest a `rate_based_statement`, for example for use inside a `not_state
 
 The `rate_based_statement` block supports the following arguments:
 
-* `aggregate_key_type` - (Optional) Setting that indicates how to aggregate the request counts. Valid values include: `FORWARDED_IP` or `IP`. Default: `IP`.
-* `forwarded_ip_config` - (Optional) Configuration for inspecting IP addresses in an HTTP header that you specify, instead of using the IP address that's reported by the web request origin. If `aggregate_key_type` is set to `FORWARDED_IP`, this block is required. See [`forwarded_ip_config`](#forwarded_ip_config) below for details.
+* `aggregate_key_type` - (Optional) Setting that indicates how to aggregate the request counts. Valid values include: `CONSTANT`, `CUSTOM_KEYS`, `FORWARDED_IP`, or `IP`. Default: `IP`.
+* `custom_key` - (Optional) Aggregate the request counts using one or more web request components as the aggregate keys. See [`custom_key`](#custom_key-block) below for details.
+* `forwarded_ip_config` - (Optional) Configuration for inspecting IP addresses in an HTTP header that you specify, instead of using the IP address that's reported by the web request origin. If `aggregate_key_type` is set to `FORWARDED_IP`, this block is required. See [`forwarded_ip_config`](#forwarded_ip_config-block) below for details.
 * `limit` - (Required) Limit on requests per 5-minute period for a single originating IP address.
-* `scope_down_statement` - (Optional) Optional nested statement that narrows the scope of the rate-based statement to matching web requests. This can be any nestable statement, and you can nest statements at any level below this scope-down statement. See [`statement`](#statement) above for details.
+* `scope_down_statement` - (Optional) Optional nested statement that narrows the scope of the rate-based statement to matching web requests. This can be any nestable statement, and you can nest statements at any level below this scope-down statement. See [`statement`](#statement-block) above for details. If `aggregate_key_type` is set to `CONSTANT`, this block is required.
 
-#### `regex_match_statement`
+### `regex_match_statement` Block
 
 A rule statement used to search web request components for a match against a single regular expression.
 
 The `regex_match_statement` block supports the following arguments:
 
 * `regex_string` - (Required) String representing the regular expression. Minimum of `1` and maximum of `512` characters.
-* `field_to_match` - (Required) The part of a web request that you want AWS WAF to inspect. See [`field_to_match`](#field_to_match) below for details.
-* `text_transformation` - (Required) Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection.
-  At least one required.
-  See [`text_transformation`](#text_transformation) below for details.
+* `field_to_match` - (Required) The part of a web request that you want AWS WAF to inspect. See [`field_to_match`](#field_to_match-block) below for details.
+* `text_transformation` - (Required) Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection. At least one transformation is required. See [`text_transformation`](#text_transformation-block) below for details.
 
-#### `regex_pattern_set_reference_statement`
+### `regex_pattern_set_reference_statement` Block
 
 A rule statement used to search web request components for matches with regular expressions. To use this, create a `aws_wafv2_regex_pattern_set` that specifies the expressions that you want to detect, then use the `ARN` of that set in this statement. A web request matches the pattern set rule statement if the request component matches any of the patterns in the set.
 
 The `regex_pattern_set_reference_statement` block supports the following arguments:
 
 * `arn` - (Required) The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references.
-* `field_to_match` - (Optional) Part of a web request that you want AWS WAF to inspect. See [`field_to_match`](#field_to_match) below for details.
-* `text_transformation` - (Required) Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection.
-  At least one required.
-  See [`text_transformation`](#text_transformation) below for details.
+* `field_to_match` - (Optional) Part of a web request that you want AWS WAF to inspect. See [`field_to_match`](#field_to_match-block) below for details.
+* `text_transformation` - (Required) Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection. At least one transformation is required. See [`text_transformation`](#text_transformation-block) below for details.
 
-#### `rule_group_reference_statement`
+### `rule_group_reference_statement` Block
 
 A rule statement used to run the rules that are defined in an WAFv2 Rule Group or `aws_wafv2_rule_group` resource.
 
@@ -621,9 +695,9 @@ You can't nest a `rule_group_reference_statement`, for example for use inside a
 The `rule_group_reference_statement` block supports the following arguments:
 
 * `arn` - (Required) The Amazon Resource Name (ARN) of the `aws_wafv2_rule_group` resource.
-* `rule_action_override` - (Optional) Action settings to use in the place of the rule actions that are configured inside the rule group. You specify one override for each rule whose action you want to change. See [`rule_action_override`](#rule_action_override) below for details.
+* `rule_action_override` - (Optional) Action settings to use in the place of the rule actions that are configured inside the rule group. You specify one override for each rule whose action you want to change. See [`rule_action_override`](#rule_action_override-block) below for details.
 
-#### `size_constraint_statement`
+### `size_constraint_statement` Block
 
 A rule statement that uses a comparison operator to compare a number of bytes against the size of a request component. AWS WAFv2 inspects up to the first 8192 bytes (8 KB) of a request body, and when inspecting the request URI Path, the slash `/` in
 the URI counts as one character.
@@ -631,137 +705,139 @@ the URI counts as one character.
 The `size_constraint_statement` block supports the following arguments:
 
 * `comparison_operator` - (Required) Operator to use to compare the request part to the size setting. Valid values include: `EQ`, `NE`, `LE`, `LT`, `GE`, or `GT`.
-* `field_to_match` - (Optional) Part of a web request that you want AWS WAF to inspect. See [`field_to_match`](#field_to_match) below for details.
+* `field_to_match` - (Optional) Part of a web request that you want AWS WAF to inspect. See [`field_to_match`](#field_to_match-block) below for details.
 * `size` - (Required) Size, in bytes, to compare to the request part, after any transformations. Valid values are integers between 0 and 21474836480, inclusive.
-* `text_transformation` - (Required) Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection.
-  At least one required.
-  See [`text_transformation`](#text_transformation) below for details.
+* `text_transformation` - (Required) Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection. At least one transformation is required. See [`text_transformation`](#text_transformation-block) below for details.
 
-#### `sqli_match_statement`
+### `sqli_match_statement` Block
 
 An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. Later in the process, when you create a web ACL, you specify whether to allow or block requests that appear to contain malicious SQL code.
 
 The `sqli_match_statement` block supports the following arguments:
 
-* `field_to_match` - (Optional) Part of a web request that you want AWS WAF to inspect. See [`field_to_match`](#field_to_match) below for details.
-* `text_transformation` - (Required) Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection.
-  At least one required.
-  See [`text_transformation`](#text_transformation) below for details.
+* `field_to_match` - (Optional) Part of a web request that you want AWS WAF to inspect. See [`field_to_match`](#field_to_match-block) below for details.
+* `text_transformation` - (Required) Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection. At least one transformation is required. See [`text_transformation`](#text_transformation-block) below for details.
 
-#### `xss_match_statement`
+### `xss_match_statement` Block
 
 The XSS match statement provides the location in requests that you want AWS WAF to search and text transformations to use on the search area before AWS WAF searches for character sequences that are likely to be malicious strings.
 
 The `xss_match_statement` block supports the following arguments:
 
-* `field_to_match` - (Optional) Part of a web request that you want AWS WAF to inspect. See [`field_to_match`](#field_to_match) below for details.
-* `text_transformation` - (Required) Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection.
-  At least one required.
-  See [`text_transformation`](#text_transformation) below for details.
+* `field_to_match` - (Optional) Part of a web request that you want AWS WAF to inspect. See [`field_to_match`](#field_to_match-block) below for details.
+* `text_transformation` - (Required) Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection. At least one transformation is required. See [`text_transformation`](#text_transformation-block) below for details.
 
-#### `rule_action_override`
+### `rule_action_override` Block
 
 The `rule_action_override` block supports the following arguments:
 
-* `action_to_use` - (Required) Override action to use, in place of the configured action of the rule in the rule group. See [`action`](#action) below for details.
+* `action_to_use` - (Required) Override action to use, in place of the configured action of the rule in the rule group. See [`action`](#action-block) for details.
 * `name` - (Required) Name of the rule to override. See the [documentation](https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-list.html) for a list of names in the appropriate rule group in use.
 
-#### `managed_rule_group_configs`
+### `managed_rule_group_configs` Block
 
 The `managed_rule_group_configs` block support the following arguments:
 
-* `aws_managed_rules_bot_control_rule_set` - (Optional) Additional configuration for using the Bot Control managed rule group. Use this to specify the inspection level that you want to use. See [`aws_managed_rules_bot_control_rule_set`](#aws_managed_rules_bot_control_rule_set) for more details
+* `aws_managed_rules_bot_control_rule_set` - (Optional) Additional configuration for using the Bot Control managed rule group. Use this to specify the inspection level that you want to use. See [`aws_managed_rules_bot_control_rule_set`](#aws_managed_rules_bot_control_rule_set-block) for more details
+* `aws_managed_rules_acfp_rule_set` - (Optional) Additional configuration for using the Account Creation Fraud Prevention managed rule group. Use this to specify information such as the registration page of your application and the type of content to accept or reject from the client.
 * `aws_managed_rules_atp_rule_set` - (Optional) Additional configuration for using the Account Takeover Protection managed rule group. Use this to specify information such as the sign-in page of your application and the type of content to accept or reject from the client.
 * `login_path` - (Optional, **Deprecated**) The path of the login endpoint for your application.
-* `password_field` - (Optional, **Deprecated**) Details about your login page password field. See [`password_field`](#password_field) for more details.
+* `password_field` - (Optional, **Deprecated**) Details about your login page password field. See [`password_field`](#password_field-block) for more details.
 * `payload_type`- (Optional, **Deprecated**) The payload type for your login endpoint, either JSON or form encoded.
-* `username_field` - (Optional, **Deprecated**) Details about your login page username field. See [`username_field`](#username_field) for more details.
+* `username_field` - (Optional, **Deprecated**) Details about your login page username field. See [`username_field`](#username_field-block) for more details.
 
-#### `aws_managed_rules_bot_control_rule_set`
+### `aws_managed_rules_bot_control_rule_set` Block
 
 * `inspection_level` - (Optional) The inspection level to use for the Bot Control rule group.
 
-#### `aws_managed_rules_atp_rule_set`
+### `aws_managed_rules_acfp_rule_set` Block
+
+* `creation_path` - (Required) The path of the account creation endpoint for your application. This is the page on your website that accepts the completed registration form for a new user. This page must accept POST requests.
+* `enable_regex_in_path` - (Optional) Whether or not to allow the use of regular expressions in the login page path.
+* `registration_page_path` - (Required) The path of the account registration endpoint for your application. This is the page on your website that presents the registration form to new users. This page must accept GET text/html requests.
+* `request_inspection` - (Optional) The criteria for inspecting login requests, used by the ATP rule group to validate credentials usage. See [`request_inspection`](#request_inspection-block) for more details.
+* `response_inspection` - (Optional) The criteria for inspecting responses to login requests, used by the ATP rule group to track login failure rates. Note that Response Inspection is available only on web ACLs that protect CloudFront distributions. See [`response_inspection`](#response_inspection-block) for more details.
 
+### `aws_managed_rules_atp_rule_set` Block
+
+* `enable_regex_in_path` - (Optional) Whether or not to allow the use of regular expressions in the login page path.
 * `login_path` - (Required) The path of the login endpoint for your application.
-* `request_inspection` - (Optional) The criteria for inspecting login requests, used by the ATP rule group to validate credentials usage. See [`request_inspection`](#request_inspection) for more details.
-* `response_inspection` - (Optional) The criteria for inspecting responses to login requests, used by the ATP rule group to track login failure rates. Note that Response Inspection is available only on web ACLs that protect CloudFront distributions. See [`response_inspection`](#response_inspection) for more details.
+* `request_inspection` - (Optional) The criteria for inspecting login requests, used by the ATP rule group to validate credentials usage. See [`request_inspection`](#request_inspection-block) for more details.
+* `response_inspection` - (Optional) The criteria for inspecting responses to login requests, used by the ATP rule group to track login failure rates. Note that Response Inspection is available only on web ACLs that protect CloudFront distributions. See [`response_inspection`](#response_inspection-block) for more details.
 
-#### `request_inspection`
+### `request_inspection` Block
 
 * `payload_type` (Required) The payload type for your login endpoint, either JSON or form encoded.
-* `username_field` (Required) Details about your login page username field. See [`username_field`](#username_field) for more details.
-* `password_field` (Required) Details about your login page password field. See [`password_field`](#password_field) for more details.
+* `username_field` (Required) Details about your login page username field. See [`username_field`](#username_field-block) for more details.
+* `password_field` (Required) Details about your login page password field. See [`password_field`](#password_field-block) for more details.
 
-#### `password_field`
+### `password_field` Block
 
 * `identifier` - (Optional) The name of the password field.
 
-#### `username_field`
+### `username_field` Block
 
 * `identifier` - (Optional) The name of the username field.
 
-#### `response_inspection`
+### `response_inspection` Block
 
-* `body_contains` (Optional) Configures inspection of the response body. See [`body_contains`](#body_contains) for more details.
-* `header` (Optional) Configures inspection of the response header.See [`header`](#header) for more details.
-* `json` (Optional) Configures inspection of the response JSON. See [`json`](#json) for more details.
-* `status_code` (Optional) Configures inspection of the response status code.See [`status_code`](#status_code) for more details.
+* `body_contains` (Optional) Configures inspection of the response body. See [`body_contains`](#body_contains-block) for more details.
+* `header` (Optional) Configures inspection of the response header.See [`header`](#header-block) for more details.
+* `json` (Optional) Configures inspection of the response JSON. See [`json`](#json-block) for more details.
+* `status_code` (Optional) Configures inspection of the response status code.See [`status_code`](#status_code-block) for more details.
 
-#### `body_contains`
+### `body_contains` Block
 
 * `success_strings` (Required) Strings in the body of the response that indicate a successful login attempt.
 * `failure_strings` (Required) Strings in the body of the response that indicate a failed login attempt.
 
-#### `header`
+### `header` Block
 
 * `name` (Required) The name of the header to match against. The name must be an exact match, including case.
 * `success_values` (Required) Values in the response header with the specified name that indicate a successful login attempt.
 * `failure_values` (Required) Values in the response header with the specified name that indicate a failed login attempt.
 
-#### `json`
+### `json` Block
 
 * `identifier` (Required) The identifier for the value to match against in the JSON.
 * `success_strings` (Required) Strings in the body of the response that indicate a successful login attempt.
 * `failure_strings` (Required) Strings in the body of the response that indicate a failed login attempt.
 
-#### `status_code`
+### `status_code` Block
 
 * `success_codes` (Required) Status codes in the response that indicate a successful login attempt.
 * `failure_codes` (Required) Status codes in the response that indicate a failed login attempt.
 
-#### `field_to_match`
+### `field_to_match` Block
 
 The part of a web request that you want AWS WAF to inspect. Include the single `field_to_match` type that you want to inspect, with additional specifications as needed, according to the type. You specify a single request component in `field_to_match` for each rule statement that requires it. To inspect more than one component of a web request, create a separate rule statement for each component. See the [documentation](https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-statement-fields.html#waf-rule-statement-request-component) for more details.
 
 The `field_to_match` block supports the following arguments:
 
-~> **NOTE:** Only one of `all_query_arguments`, `body`, `cookies`, `headers`, `json_body`, `method`, `query_string`, `single_header`, `single_query_argument`, or `uri_path` can be specified.
-An empty configuration block `{}` should be used when specifying `all_query_arguments`, `method`, or `query_string` attributes.
+~> **Note** Only one of `all_query_arguments`, `body`, `cookies`, `headers`, `ja3_fingerprint`, `json_body`, `method`, `query_string`, `single_header`, `single_query_argument`, or `uri_path` can be specified. An empty configuration block `{}` should be used when specifying `all_query_arguments`, `method`, or `query_string` attributes.
 
 * `all_query_arguments` - (Optional) Inspect all query arguments.
-* `body` - (Optional) Inspect the request body, which immediately follows the request headers. See [`body`](#body) below for details.
-* `cookies` - (Optional) Inspect the cookies in the web request. See [`cookies`](#cookies) below for details.
-* `headers` - (Optional) Inspect the request headers. See [`headers`](#headers) below for details.
-* `json_body` - (Optional) Inspect the request body as JSON. See [`json_body`](#json_body) for details.
+* `body` - (Optional) Inspect the request body, which immediately follows the request headers. See [`body`](#body-block) below for details.
+* `cookies` - (Optional) Inspect the cookies in the web request. See [`cookies`](#cookies-block) below for details.
+* `headers` - (Optional) Inspect the request headers. See [`headers`](#headers-block) below for details.
+* `ja3_fingerprint` - (Optional) Inspect the JA3 fingerprint. See [`ja3_fingerprint`](#ja3_fingerprint-block) below for details.
+* `json_body` - (Optional) Inspect the request body as JSON. See [`json_body`](#json_body-block) for details.
 * `method` - (Optional) Inspect the HTTP method. The method indicates the type of operation that the request is asking the origin to perform.
 * `query_string` - (Optional) Inspect the query string. This is the part of a URL that appears after a `?` character, if any.
-* `single_header` - (Optional) Inspect a single header. See [`single_header`](#single_header) below for details.
-* `single_query_argument` - (Optional) Inspect a single query argument. See [`single_query_argument`](#single_query_argument) below for details.
+* `single_header` - (Optional) Inspect a single header. See [`single_header`](#single_header-block) below for details.
+* `single_query_argument` - (Optional) Inspect a single query argument. See [`single_query_argument`](#single_query_argument-block) below for details.
 * `uri_path` - (Optional) Inspect the request URI path. This is the part of a web request that identifies a resource, for example, `/images/daily-ad.jpg`.
 
-#### `forwarded_ip_config`
+### `forwarded_ip_config` Block
 
-The configuration for inspecting IP addresses in an HTTP header that you specify, instead of using the IP address that's reported by the web request origin. Commonly, this is the X-Forwarded-For (XFF) header, but you can specify
-any header name. If the specified header isn't present in the request, AWS WAFv2 doesn't apply the rule to the web request at all.
-AWS WAFv2 only evaluates the first IP address found in the specified HTTP header.
+The configuration for inspecting IP addresses in an HTTP header that you specify, instead of using the IP address that's reported by the web request origin. Commonly, this is the X-Forwarded-For (XFF) header, but you can specify any header name. If the specified header isn't present in the request, AWS WAFv2 doesn't apply the rule to the web request at all. AWS WAFv2 only evaluates the first IP address found in the specified HTTP header.
 
 The `forwarded_ip_config` block supports the following arguments:
 
 * `fallback_behavior` - (Required) - Match status to assign to the web request if the request doesn't have a valid IP address in the specified position. Valid values include: `MATCH` or `NO_MATCH`.
 * `header_name` - (Required) - Name of the HTTP header to use for the IP address.
 
-#### `ip_set_forwarded_ip_config`
+### `ip_set_forwarded_ip_config` Block
 
 The configuration for inspecting IP addresses in an HTTP header that you specify, instead of using the IP address that's reported by the web request origin. Commonly, this is the X-Forwarded-For (XFF) header, but you can specify any header name.
 
@@ -771,7 +847,7 @@ The `ip_set_forwarded_ip_config` block supports the following arguments:
 * `header_name` - (Required) - Name of the HTTP header to use for the IP address.
 * `position` - (Required) - Position in the header to search for the IP address. Valid values include: `FIRST`, `LAST`, or `ANY`. If `ANY` is specified and the header contains more than 10 IP addresses, AWS WAFv2 inspects the last 10.
 
-#### `headers`
+### `headers` Block
 
 Inspect the request headers.
 
@@ -784,7 +860,13 @@ The `headers` block supports the following arguments:
 * `match_scope` - (Required) The parts of the headers to inspect with the rule inspection criteria. If you specify `All`, AWS WAF inspects both keys and values. Valid values include the following: `ALL`, `Key`, `Value`.
 * `oversize_handling` - (Required) Oversize handling tells AWS WAF what to do with a web request when the request component that the rule inspects is over the limits. Valid values include the following: `CONTINUE`, `MATCH`, `NO_MATCH`. See the AWS [documentation](https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-statement-oversize-handling.html) for more information.
 
-#### `json_body`
+### `ja3_fingerprint` Block
+
+The `ja3_fingerprint` block supports the following arguments:
+
+* `fallback_behavior` - (Required) The match status to assign to the web request if the request doesn't have a JA3 fingerprint. Valid values include: `MATCH` or `NO_MATCH`.
+
+### `json_body` Block
 
 The `json_body` block supports the following arguments:
 
@@ -793,7 +875,7 @@ The `json_body` block supports the following arguments:
 * `match_scope` - (Required) The parts of the JSON to match against using the `match_pattern`. Valid values are `ALL`, `KEY` and `VALUE`.
 * `oversize_handling` - (Optional) What to do if the body is larger than can be inspected. Valid values are `CONTINUE` (default), `MATCH` and `NO_MATCH`.
 
-#### `single_header`
+### `single_header` Block
 
 Inspect a single header. Provide the name of the header to inspect, for example, `User-Agent` or `Referer` (provided as lowercase strings).
 
@@ -801,7 +883,7 @@ The `single_header` block supports the following arguments:
 
 * `name` - (Optional) Name of the query header to inspect. This setting must be provided as lower case characters.
 
-#### `single_query_argument`
+### `single_query_argument` Block
 
 Inspect a single query argument. Provide the name of the query argument to inspect, such as `UserName` or `SalesRegion` (provided as lowercase strings).
 
@@ -809,16 +891,15 @@ The `single_query_argument` block supports the following arguments:
 
 * `name` - (Optional) Name of the query header to inspect. This setting must be provided as lower case characters.
 
-#### `body`
+### `body` Block
 
 The `body` block supports the following arguments:
 
 * `oversize_handling` - (Optional) What WAF should do if the body is larger than WAF can inspect. WAF does not support inspecting the entire contents of the body of a web request when the body exceeds 8 KB (8192 bytes). Only the first 8 KB of the request body are forwarded to WAF by the underlying host service. Valid values: `CONTINUE`, `MATCH`, `NO_MATCH`.
 
-#### `cookies`
+### `cookies` Block
 
-Inspect the cookies in the web request. You can specify the parts of the cookies to inspect and you can narrow the set of cookies to inspect by including or excluding specific keys.
-This is used to indicate the web request component to inspect, in the [FieldToMatch](https://docs.aws.amazon.com/waf/latest/APIReference/API_FieldToMatch.html) specification.
+Inspect the cookies in the web request. You can specify the parts of the cookies to inspect and you can narrow the set of cookies to inspect by including or excluding specific keys. This is used to indicate the web request component to inspect, in the [FieldToMatch](https://docs.aws.amazon.com/waf/latest/APIReference/API_FieldToMatch.html) specification.
 
 The `cookies` block supports the following arguments:
 
@@ -826,14 +907,14 @@ The `cookies` block supports the following arguments:
 * `match_scope` - (Required) The parts of the cookies to inspect with the rule inspection criteria. If you specify All, AWS WAF inspects both keys and values. Valid values: `ALL`, `KEY`, `VALUE`
 * `oversize_handling` - (Required) What AWS WAF should do if the cookies of the request are larger than AWS WAF can inspect. AWS WAF does not support inspecting the entire contents of request cookies when they exceed 8 KB (8192 bytes) or 200 total cookies. The underlying host service forwards a maximum of 200 cookies and at most 8 KB of cookie contents to AWS WAF. Valid values: `CONTINUE`, `MATCH`, `NO_MATCH`.
 
-#### `text_transformation`
+### `text_transformation` Block
 
 The `text_transformation` block supports the following arguments:
 
 * `priority` - (Required) Relative processing order for multiple transformations that are defined for a rule statement. AWS WAF processes all transformations, from lowest priority to highest, before inspecting the transformed content.
 * `type` - (Required) Transformation to apply, please refer to the Text Transformation [documentation](https://docs.aws.amazon.com/waf/latest/APIReference/API_TextTransformation.html) for more details.
 
-### `visibility_config`
+### `visibility_config` Block
 
 The `visibility_config` block supports the following arguments:
 
@@ -841,21 +922,118 @@ The `visibility_config` block supports the following arguments:
 * `metric_name` - (Required) A friendly name of the CloudWatch metric. The name can contain only alphanumeric characters (A-Z, a-z, 0-9) hyphen(-) and underscore (\_), with length from one to 128 characters. It can't contain whitespace or metric names reserved for AWS WAF, for example `All` and `Default_Action`.
 * `sampled_requests_enabled` - (Required) Whether AWS WAF should store a sampling of the web requests that match the rules. You can view the sampled requests through the AWS WAF console.
 
-### Captcha Configuration
+### `captcha_config` Block
 
 The `captcha_config` block supports the following arguments:
 
-* `immunity_time_property` - (Optional) Defines custom immunity time. See [Immunity Time Property](#immunity-time-property) below for details.
+* `immunity_time_property` - (Optional) Defines custom immunity time. See [`immunity_time_property`](#immunity_time_property-block) below for details.
 
-### Immunity Time Property
+### `immunity_time_property` Block
 
 The `immunity_time_property` block supports the following arguments:
 
 * `immunity_time` - (Optional) The amount of time, in seconds, that a CAPTCHA or challenge timestamp is considered valid by AWS WAF. The default setting is 300.
 
-## Attributes Reference
+### `request_body` Block
+
+The `request_body` block supports the following arguments:
+
+* `cloudfront` - (Optional) Customizes the request body that your protected CloudFront distributions forward to AWS WAF for inspection. See [`cloudfront`](#cloudfront-block) below for details.
+
+### `cloudfront` Block
+
+The `cloudfront` block supports the following arguments:
+
+* `default_size_inspection_limit` - (Required) Specifies the maximum size of the web request body component that an associated CloudFront distribution should send to AWS WAF for inspection. This applies to statements in the web ACL that inspect the body or JSON body. Valid values are `KB_16`, `KB_32`, `KB_48` and `KB_64`.
+
+### `custom_key` Block
+
+Aggregate the request counts using one or more web request components as the aggregate keys. With this option, you must specify the aggregate keys in the `custom_keys` block. To aggregate on only the IP address or only the forwarded IP address, don't use custom keys. Instead, set the `aggregate_key_type` to `IP` or `FORWARDED_IP`.
+
+The `custom_key` block supports the following arguments:
+
+* `cookie` - (Optional) Use the value of a cookie in the request as an aggregate key. See [RateLimit `cookie`](#ratelimit-cookie-block) below for details.
+* `forwarded_ip` - (Optional) Use the first IP address in an HTTP header as an aggregate key. See [`forwarded_ip`](#ratelimit-forwarded_ip-block) below for details.
+* `http_method` - (Optional) Use the request's HTTP method as an aggregate key. See [RateLimit `http_method`](#ratelimit-http_method-block) below for details.
+* `header` - (Optional) Use the value of a header in the request as an aggregate key. See [RateLimit `header`](#ratelimit-header-block) below for details.
+* `ip` - (Optional) Use the request's originating IP address as an aggregate key. See [`RateLimit ip`](#ratelimit-ip-block) below for details.
+* `label_namespace` - (Optional) Use the specified label namespace as an aggregate key. See [RateLimit `label_namespace`](#ratelimit-label_namespace-block) below for details.
+* `query_argument` - (Optional) Use the specified query argument as an aggregate key. See [RateLimit `query_argument`](#ratelimit-query_argument-block) below for details.
+* `query_string` - (Optional) Use the request's query string as an aggregate key. See [RateLimit `query_string`](#ratelimit-query_string-block) below for details.
+* `uri_path` - (Optional) Use the request's URI path as an aggregate key. See [RateLimit `uri_path`](#ratelimit-uri_path-block) below for details.
+
+### RateLimit `cookie` Block
+
+Use the value of a cookie in the request as an aggregate key. Each distinct value in the cookie contributes to the aggregation instance. If you use a single cookie as your custom key, then each value fully defines an aggregation instance.
+
+The `cookie` block supports the following arguments:
+
+* `name`: The name of the cookie to use.
+* `text_transformation`: Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection. They are used in rate-based rule statements, to transform request components before using them as custom aggregation keys. Atleast one transformation is required. See [`text_transformation`](#text_transformation-block) above for details.
+
+### RateLimit `forwarded_ip` Block
+
+Use the first IP address in an HTTP header as an aggregate key. Each distinct forwarded IP address contributes to the aggregation instance. When you specify an IP or forwarded IP in the custom key settings, you must also specify at least one other key to use. You can aggregate on only the forwarded IP address by specifying `FORWARDED_IP` in your rate-based statement's `aggregate_key_type`. With this option, you must specify the header to use in the rate-based rule's [`forwarded_ip_config`](#forwarded_ip_config-block) block.
+
+The `forwarded_ip` block is configured as an empty block `{}`.
+
+### RateLimit `http_method` Block
+
+Use the request's HTTP method as an aggregate key. Each distinct HTTP method contributes to the aggregation instance. If you use just the HTTP method as your custom key, then each method fully defines an aggregation instance.
 
-In addition to all arguments above, the following attributes are exported:
+The `http_method` block is configured as an empty block `{}`.
+
+### RateLimit `header` Block
+
+Use the value of a header in the request as an aggregate key. Each distinct value in the header contributes to the aggregation instance. If you use a single header as your custom key, then each value fully defines an aggregation instance.
+
+The `header` block supports the following arguments:
+
+* `name`: The name of the header to use.
+* `text_transformation`: Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection. They are used in rate-based rule statements, to transform request components before using them as custom aggregation keys. Atleast one transformation is required. See [`text_transformation`](#text_transformation-block) above for details.
+
+### RateLimit `ip` Block
+
+Use the request's originating IP address as an aggregate key. Each distinct IP address contributes to the aggregation instance. When you specify an IP or forwarded IP in the custom key settings, you must also specify at least one other key to use. You can aggregate on only the IP address by specifying `IP` in your rate-based statement's `aggregate_key_type`.
+
+The `ip` block is configured as an empty block `{}`.
+
+### RateLimit `label_namespace` Block
+
+Use the specified label namespace as an aggregate key. Each distinct fully qualified label name that has the specified label namespace contributes to the aggregation instance. If you use just one label namespace as your custom key, then each label name fully defines an aggregation instance. This uses only labels that have been added to the request by rules that are evaluated before this rate-based rule in the web ACL. For information about label namespaces and names, see Label syntax and naming requirements (https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-label-requirements.html) in the WAF Developer Guide.
+
+The `label_namespace` block supports the following arguments:
+
+* `namespace`: The namespace to use for aggregation
+
+### RateLimit `query_argument` Block
+
+Use the specified query argument as an aggregate key. Each distinct value for the named query argument contributes to the aggregation instance. If you use a single query argument as your custom key, then each value fully defines an aggregation instance.
+
+The `query_argument` block supports the following arguments:
+
+* `name`: The name of the query argument to use.
+* `text_transformation`: Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection. They are used in rate-based rule statements, to transform request components before using them as custom aggregation keys. Atleast one transformation is required. See [`text_transformation`](#text_transformation-block) above for details.
+
+### RateLimit `query_string` Block
+
+Use the request's query string as an aggregate key. Each distinct string contributes to the aggregation instance. If you use just the query string as your custom key, then each string fully defines an aggregation instance.
+
+The `query_string` block supports the following arguments:
+
+* `text_transformation`: Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection. They are used in rate-based rule statements, to transform request components before using them as custom aggregation keys. Atleast one transformation is required. See [`text_transformation`](#text_transformation-block) above for details.
+
+### RateLimit `uri_path` Block
+
+Use the request's URI path as an aggregate key. Each distinct URI path contributes to the aggregation instance. If you use just the URI path as your custom key, then each URI path fully defines an aggregation instance.
+
+The `uri_path` block supports the following arguments:
+
+* `text_transformation`: Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection. They are used in rate-based rule statements, to transform request components before using them as custom aggregation keys. Atleast one transformation is required. See [`text_transformation`](#text_transformation-block) above for details.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - The ARN of the WAF WebACL.
 * `capacity` - Web ACL capacity units (WCUs) currently being used by this web ACL.
@@ -864,8 +1042,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-WAFv2 Web ACLs can be imported using `ID/Name/Scope` e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WAFv2 Web ACLs using `ID/Name/Scope`. For example:
 
+```terraform
+import {
+  to = aws_wafv2_web_acl.example
+  id = "a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc/example/REGIONAL"
+}
 ```
-$ terraform import aws_wafv2_web_acl.example a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc/example/REGIONAL
+
+Using `terraform import`, import WAFv2 Web ACLs using `ID/Name/Scope`. For example:
+
+```console
+% terraform import aws_wafv2_web_acl.example a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc/example/REGIONAL
 ```
diff --git a/website/docs/r/wafv2_web_acl_association.html.markdown b/website/docs/r/wafv2_web_acl_association.html.markdown
index 1ff1b976d74..a6aa958045d 100644
--- a/website/docs/r/wafv2_web_acl_association.html.markdown
+++ b/website/docs/r/wafv2_web_acl_association.html.markdown
@@ -83,14 +83,14 @@ resource "aws_wafv2_web_acl_association" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
-* `resource_arn` - (Required) The Amazon Resource Name (ARN) of the resource to associate with the web ACL. This must be an ARN of an Application Load Balancer, an Amazon API Gateway stage, or an Amazon Cognito User Pool.
+* `resource_arn` - (Required) The Amazon Resource Name (ARN) of the resource to associate with the web ACL. This must be an ARN of an Application Load Balancer, an Amazon API Gateway stage, an Amazon Cognito User Pool, an Amazon AppSync GraphQL API, an Amazon App Runner service, or an Amazon Verified Access instance.
 * `web_acl_arn` - (Required) The Amazon Resource Name (ARN) of the Web ACL that you want to associate with the resource.
 
-## Attributes Reference
+## Attribute Reference
 
-No additional attributes are exported.
+This resource exports no additional attributes.
 
 ## Timeouts
 
@@ -100,8 +100,17 @@ No additional attributes are exported.
 
 ## Import
 
-WAFv2 Web ACL Association can be imported using `WEB_ACL_ARN,RESOURCE_ARN` e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WAFv2 Web ACL Association using `WEB_ACL_ARN,RESOURCE_ARN`. For example:
 
+```terraform
+import {
+  to = aws_wafv2_web_acl_association.example
+  id = "arn:aws:wafv2:...7ce849ea,arn:aws:apigateway:...ages/name"
+}
 ```
-$ terraform import aws_wafv2_web_acl_association.example arn:aws:wafv2:...7ce849ea,arn:aws:apigateway:...ages/name
+
+Using `terraform import`, import WAFv2 Web ACL Association using `WEB_ACL_ARN,RESOURCE_ARN`. For example:
+
+```console
+% terraform import aws_wafv2_web_acl_association.example arn:aws:wafv2:...7ce849ea,arn:aws:apigateway:...ages/name
 ```
diff --git a/website/docs/r/wafv2_web_acl_logging_configuration.html.markdown b/website/docs/r/wafv2_web_acl_logging_configuration.html.markdown
index 7ed6c67169b..4e9ee0fd938 100644
--- a/website/docs/r/wafv2_web_acl_logging_configuration.html.markdown
+++ b/website/docs/r/wafv2_web_acl_logging_configuration.html.markdown
@@ -3,22 +3,14 @@ subcategory: "WAF"
 layout: "aws"
 page_title: "AWS: aws_wafv2_web_acl_logging_configuration"
 description: |-
-  Creates a WAFv2 Web ACL Logging Configuration resource.
+  Create a resource for WAFv2 Web ACL Logging Configuration.
 ---
 
 # Resource: aws_wafv2_web_acl_logging_configuration
 
-Creates a WAFv2 Web ACL Logging Configuration resource.
+This resource creates a WAFv2 Web ACL Logging Configuration.
 
--> **Note:** To start logging from a WAFv2 Web ACL, an Amazon Kinesis Data Firehose (e.g., [`aws_kinesis_firehose_delivery_stream` resource](/docs/providers/aws/r/kinesis_firehose_delivery_stream.html) must also be created with a PUT source (not a stream) and in the region that you are operating.
-If you are capturing logs for Amazon CloudFront, always create the firehose in US East (N. Virginia).
-Be sure to give the data firehose, cloudwatch log group, and/or s3 bucket a name that starts with the prefix `aws-waf-logs-`.
-
--> **Note:** When logging from a WAFv2 Web ACL to a CloudWatch Log Group the WAFv2 service attempts to create/update a
-generic Log Resource Policy with a name `AWSWAF-LOGS`. If there are a large number of Web ACLs, or the account frequently
-creates and destroys Web ACLs, this policy will hit the max policy size and this resource type will fail to be
-created (more details can be found in [this issue](https://github.com/hashicorp/terraform-provider-aws/issues/25296)). To avoid this
-happening, a specific resource policy can be managed. See [CloudWatch Log Group](#with-cloudwatch-log-group-and-managed-cloudwatch-log-resource-policy) example below.
+!> **WARNING:** When logging from a WAFv2 Web ACL to a CloudWatch Log Group, the WAFv2 service tries to create or update a generic Log Resource Policy named `AWSWAF-LOGS`. However, if there are a large number of Web ACLs or if the account frequently creates and deletes Web ACLs, this policy may exceed the maximum policy size. As a result, this resource type will fail to be created. More details about this issue can be found in [this issue](https://github.com/hashicorp/terraform-provider-aws/issues/25296). To prevent this issue, you can manage a specific resource policy. Please refer to the [example](#with-cloudwatch-log-group-and-managed-cloudwatch-log-resource-policy) below for managing a CloudWatch Log Group with a managed CloudWatch Log Resource Policy.
 
 ## Example Usage
 
@@ -102,7 +94,7 @@ data "aws_iam_policy_document" "example" {
     effect = "Allow"
     principals {
       identifiers = ["delivery.logs.amazonaws.com"]
-      type        = "AWS"
+      type        = "Service"
     }
     actions   = ["logs:CreateLogStream", "logs:PutLogEvents"]
     resources = ["${aws_cloudwatch_log_group.example.arn}:*"]
@@ -126,78 +118,87 @@ data "aws_caller_identity" "current" {}
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
-* `log_destination_configs` - (Required) The Amazon Kinesis Data Firehose, Cloudwatch Log log group, or S3 bucket Amazon Resource Names (ARNs) that you want to associate with the web ACL.
-* `logging_filter` - (Optional) A configuration block that specifies which web requests are kept in the logs and which are dropped. You can filter on the rule action and on the web request labels that were applied by matching rules during web ACL evaluation. See [Logging Filter](#logging-filter) below for more details.
-* `redacted_fields` - (Optional) The parts of the request that you want to keep out of the logs. Up to 100 `redacted_fields` blocks are supported. See [Redacted Fields](#redacted-fields) below for more details.
-* `resource_arn` - (Required) The Amazon Resource Name (ARN) of the web ACL that you want to associate with `log_destination_configs`.
+* `log_destination_configs` - (Required) Configuration block that allows you to associate Amazon Kinesis Data Firehose, Cloudwatch Log log group, or S3 bucket Amazon Resource Names (ARNs) with the web ACL. **Note:** data firehose, log group, or bucket name **must** be prefixed with `aws-waf-logs-`, e.g. `aws-waf-logs-example-firehose`, `aws-waf-logs-example-log-group`, or `aws-waf-logs-example-bucket`.
+* `logging_filter` - (Optional) Configuration block that specifies which web requests are kept in the logs and which are dropped. It allows filtering based on the rule action and the web request labels applied by matching rules during web ACL evaluation. For more details, refer to the [Logging Filter](#logging-filter) section below.
+* `redacted_fields` - (Optional) Configuration for parts of the request that you want to keep out of the logs. Up to 100 `redacted_fields` blocks are supported. See [Redacted Fields](#redacted-fields) below for more details.
+* `resource_arn` - (Required) Amazon Resource Name (ARN) of the web ACL that you want to associate with `log_destination_configs`.
 
 ### Logging Filter
 
 The `logging_filter` block supports the following arguments:
 
-* `default_behavior` - (Required) Default handling for logs that don't match any of the specified filtering conditions. Valid values: `KEEP` or `DROP`.
+* `default_behavior` - (Required) Default handling for logs that don't match any of the specified filtering conditions. Valid values for `default_behavior` are `KEEP` or `DROP`.
 * `filter` - (Required) Filter(s) that you want to apply to the logs. See [Filter](#filter) below for more details.
 
 ### Filter
 
 The `filter` block supports the following arguments:
 
-* `behavior` - (Required) How to handle logs that satisfy the filter's conditions and requirement. Valid values: `KEEP` or `DROP`.
+* `behavior` - (Required) Parameter that determines how to handle logs that meet the conditions and requirements of the filter. The valid values for `behavior` are `KEEP` or `DROP`.
 * `condition` - (Required) Match condition(s) for the filter. See [Condition](#condition) below for more details.
-* `requirement` - (Required) Logic to apply to the filtering conditions. You can specify that, in order to satisfy the filter, a log must match all conditions or must match at least one condition. Valid values: `MEETS_ALL` or `MEETS_ANY`.
+* `requirement` - (Required) Logic to apply to the filtering conditions. You can specify that a log must match all conditions or at least one condition in order to satisfy the filter. Valid values for `requirement` are `MEETS_ALL` or `MEETS_ANY`.
 
 ### Condition
 
 The `condition` block supports the following arguments:
 
-~> **Note:** Either `action_condition` or `label_name_condition` must be specified.  
+~> **NOTE:** Either the `action_condition` or `label_name_condition` must be specified.
 
-* `action_condition` - (Optional) A single action condition. See [Action Condition](#action-condition) below for more details.
-* `label_name_condition` - (Optional) A single label name condition. See [Label Name Condition](#label-name-condition) below for more details.
+* `action_condition` - (Optional) Configuration for a single action condition. See [Action Condition](#action-condition) below for more details.
+* `label_name_condition` - (Optional) Condition for a single label name. See [Label Name Condition](#label-name-condition) below for more details.
 
 ### Action Condition
 
 The `action_condition` block supports the following argument:
 
-* `action` - (Required) The action setting that a log record must contain in order to meet the condition. Valid values: `ALLOW`, `BLOCK`, `COUNT`.
+* `action` - (Required) Action setting that a log record must contain in order to meet the condition. Valid values for `action` are `ALLOW`, `BLOCK`, and `COUNT`.
 
 ### Label Name Condition
 
 The `label_name_condition` block supports the following argument:
 
-* `label_name` - (Required) The label name that a log record must contain in order to meet the condition. This must be a fully qualified label name. Fully qualified labels have a prefix, optional namespaces, and label name. The prefix identifies the rule group or web ACL context of the rule that added the label.
+* `label_name` - (Required) Name of the label that a log record must contain in order to meet the condition. It must be a fully qualified label name, which includes a prefix, optional namespaces, and the label name itself. The prefix identifies the rule group or web ACL context of the rule that added the label.
 
 ### Redacted Fields
 
 The `redacted_fields` block supports the following arguments:
 
-~> **NOTE:** Only one of `method`, `query_string`, `single_header` or `uri_path` can be specified.
+~> **NOTE:** You can only specify one of the following: `method`, `query_string`, `single_header`, or `uri_path`.
 
-* `method` - (Optional) Redact the HTTP method. Must be specified as an empty configuration block `{}`. The method indicates the type of operation that the request is asking the origin to perform.
-* `query_string` - (Optional) Redact the query string. Must be specified as an empty configuration block `{}`. This is the part of a URL that appears after a `?` character, if any.
-* `single_header` - (Optional) Redact a single header. See [Single Header](#single-header) below for details.
-* `uri_path` - (Optional) Redact the request URI path. Must be specified as an empty configuration block `{}`. This is the part of a web request that identifies a resource, for example, `/images/daily-ad.jpg`.
+* `method` - (Optional) HTTP method to be redacted. It must be specified as an empty configuration block `{}`. The method indicates the type of operation that the request is asking the origin to perform.
+* `query_string` - (Optional) Whether to redact the query string. It must be specified as an empty configuration block `{}`. The query string is the part of a URL that appears after a `?` character, if any.
+* `single_header` - (Optional) "single_header" refers to the redaction of a single header. For more information, please see the details below under [Single Header](#single-header).
+* `uri_path` - (Optional) Configuration block that redacts the request URI path. It should be specified as an empty configuration block `{}`. The URI path is the part of a web request that identifies a resource, such as `/images/daily-ad.jpg`.
 
 ### Single Header
 
-Redact a single header. Provide the name of the header to redact, for example, `User-Agent` or `Referer` (provided as lowercase strings).
+To redact a single header, provide the name of the header to be redacted. For example, use `User-Agent` or `Referer` (provided as lowercase strings).
 
 The `single_header` block supports the following arguments:
 
-* `name` - (Optional) The name of the query header to redact. This setting must be provided as lower case characters.
+* `name` - (Optional) Name of the query header to redact. This setting must be provided in lowercase characters.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
-* `id` - The Amazon Resource Name (ARN) of the WAFv2 Web ACL.
+* `id` - Amazon Resource Name (ARN) of the WAFv2 Web ACL.
 
 ## Import
 
-WAFv2 Web ACL Logging Configurations can be imported using the WAFv2 Web ACL ARN e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WAFv2 Web ACL Logging Configurations using the ARN of the WAFv2 Web ACL. For example:
 
+```terraform
+import {
+  to = aws_wafv2_web_acl_logging_configuration.example
+  id = "arn:aws:wafv2:us-west-2:123456789012:regional/webacl/test-logs/a1b2c3d4-5678-90ab-cdef"
+}
 ```
-$ terraform import aws_wafv2_web_acl_logging_configuration.example arn:aws:wafv2:us-west-2:123456789012:regional/webacl/test-logs/a1b2c3d4-5678-90ab-cdef
+
+Using `terraform import`, import WAFv2 Web ACL Logging Configurations using the ARN of the WAFv2 Web ACL. For example:
+
+```console
+% terraform import aws_wafv2_web_acl_logging_configuration.example arn:aws:wafv2:us-west-2:123456789012:regional/webacl/test-logs/a1b2c3d4-5678-90ab-cdef
 ```
diff --git a/website/docs/r/worklink_fleet.html.markdown b/website/docs/r/worklink_fleet.html.markdown
index 2f4bd256af6..79956c693d0 100644
--- a/website/docs/r/worklink_fleet.html.markdown
+++ b/website/docs/r/worklink_fleet.html.markdown
@@ -47,7 +47,7 @@ resource "aws_worklink_fleet" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) A region-unique name for the AMI.
 * `audit_stream_arn` - (Optional) The ARN of the Amazon Kinesis data stream that receives the audit events. Kinesis data stream name must begin with `"AmazonWorkLink-"`.
@@ -72,9 +72,9 @@ The following arguments are supported:
 * `type` - (Required) The type of identity provider.
 * `saml_metadata` - (Required) The SAML metadata document provided by the customer’s identity provider.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ARN of the created WorkLink Fleet.
 * `arn` - The ARN of the created WorkLink Fleet.
@@ -84,8 +84,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-WorkLink can be imported using the ARN, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WorkLink using the ARN. For example:
 
+```terraform
+import {
+  to = aws_worklink_fleet.test
+  id = "arn:aws:worklink::123456789012:fleet/example"
+}
 ```
-$ terraform import aws_worklink_fleet.test arn:aws:worklink::123456789012:fleet/example
+
+Using `terraform import`, import WorkLink using the ARN. For example:
+
+```console
+% terraform import aws_worklink_fleet.test arn:aws:worklink::123456789012:fleet/example
 ```
diff --git a/website/docs/r/worklink_website_certificate_authority_association.html.markdown b/website/docs/r/worklink_website_certificate_authority_association.html.markdown
index d9873ddd7f3..0255abe1494 100644
--- a/website/docs/r/worklink_website_certificate_authority_association.html.markdown
+++ b/website/docs/r/worklink_website_certificate_authority_association.html.markdown
@@ -23,22 +23,31 @@ resource "aws_worklink_website_certificate_authority_association" "test" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `fleet_arn` - (Required, ForceNew) The ARN of the fleet.
 * `certificate` - (Required, ForceNew) The root certificate of the Certificate Authority.
 * `display_name` - (Optional, ForceNew) The certificate name to display.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `website_ca_id` - A unique identifier for the Certificate Authority.
 
 ## Import
 
-WorkLink Website Certificate Authority can be imported using `FLEET-ARN,WEBSITE-CA-ID`, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WorkLink Website Certificate Authority using `FLEET-ARN,WEBSITE-CA-ID`. For example:
 
+```terraform
+import {
+  to = aws_worklink_website_certificate_authority_association.example
+  id = "arn:aws:worklink::123456789012:fleet/example,abcdefghijk"
+}
 ```
-$ terraform import aws_worklink_website_certificate_authority_association.example arn:aws:worklink::123456789012:fleet/example,abcdefghijk
+
+Using `terraform import`, import WorkLink Website Certificate Authority using `FLEET-ARN,WEBSITE-CA-ID`. For example:
+
+```console
+% terraform import aws_worklink_website_certificate_authority_association.example arn:aws:worklink::123456789012:fleet/example,abcdefghijk
 ```
diff --git a/website/docs/r/workspaces_connection_alias.html.markdown b/website/docs/r/workspaces_connection_alias.html.markdown
new file mode 100644
index 00000000000..0bec7d0a169
--- /dev/null
+++ b/website/docs/r/workspaces_connection_alias.html.markdown
@@ -0,0 +1,62 @@
+---
+subcategory: "WorkSpaces"
+layout: "aws"
+page_title: "AWS: aws_workspaces_connection_alias"
+description: |-
+  Terraform resource for managing an AWS WorkSpaces Connection Alias.
+---
+
+# Resource: aws_workspaces_connection_alias
+
+Terraform resource for managing an AWS WorkSpaces Connection Alias.
+
+## Example Usage
+
+### Basic Usage
+
+```terraform
+resource "aws_workspaces_connection_alias" "example" {
+  connection_string = "testdomain.test"
+}
+```
+
+## Argument Reference
+
+The following arguments are required:
+
+* `connection_string` - (Required) The connection string specified for the connection alias. The connection string must be in the form of a fully qualified domain name (FQDN), such as www.example.com.
+* `tags` – (Optional) A map of tags assigned to the WorkSpaces Connection Alias. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
+
+## Attribute Reference
+
+This resource exports the following attributes in addition to the arguments above:
+
+* `id` - The identifier of the connection alias.
+* `owner_account_id` - The identifier of the Amazon Web Services account that owns the connection alias.
+* `state` - The current state of the connection alias.
+* `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
+
+## Timeouts
+
+[Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts):
+
+* `create` - (Default `60m`)
+* `update` - (Default `180m`)
+* `delete` - (Default `90m`)
+
+## Import
+
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WorkSpaces Connection Alias using the connection alias ID. For example:
+
+```terraform
+import {
+  to = aws_workspaces_connection_alias.example
+  id = "rft-8012925589"
+}
+```
+
+Using `terraform import`, import WorkSpaces Connection Alias using the connection alias ID. For example:
+
+```console
+% terraform import aws_workspaces_connection_alias.example rft-8012925589
+```
diff --git a/website/docs/r/workspaces_directory.html.markdown b/website/docs/r/workspaces_directory.html.markdown
index 36d09effb44..51cda8313e3 100644
--- a/website/docs/r/workspaces_directory.html.markdown
+++ b/website/docs/r/workspaces_directory.html.markdown
@@ -145,7 +145,7 @@ resource "aws_workspaces_ip_group" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `directory_id` - (Required) The directory identifier for registration in WorkSpaces service.
 * `subnet_ids` - (Optional) The identifiers of the subnets where the directory resides.
@@ -184,9 +184,9 @@ The following arguments are supported:
 * `enable_maintenance_mode` – (Optional) Indicates whether maintenance mode is enabled for your WorkSpaces. For more information, see [WorkSpace Maintenance](https://docs.aws.amazon.com/workspaces/latest/adminguide/workspace-maintenance.html)..
 * `user_enabled_as_local_administrator` – (Optional) Indicates whether users are local administrators of their WorkSpaces.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The WorkSpaces directory identifier.
 * `alias` - The directory alias.
@@ -202,8 +202,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Workspaces directory can be imported using the directory ID, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Workspaces directory using the directory ID. For example:
 
+```terraform
+import {
+  to = aws_workspaces_directory.main
+  id = "d-4444444444"
+}
 ```
-$ terraform import aws_workspaces_directory.main d-4444444444
+
+Using `terraform import`, import Workspaces directory using the directory ID. For example:
+
+```console
+% terraform import aws_workspaces_directory.main d-4444444444
 ```
diff --git a/website/docs/r/workspaces_ip_group.html.markdown b/website/docs/r/workspaces_ip_group.html.markdown
index 283149da8ff..785fe4310af 100644
--- a/website/docs/r/workspaces_ip_group.html.markdown
+++ b/website/docs/r/workspaces_ip_group.html.markdown
@@ -33,7 +33,7 @@ resource "aws_workspaces_ip_group" "contractors" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `name` - (Required) The name of the IP group.
 * `description` - (Optional) The description of the IP group.
@@ -49,17 +49,26 @@ The following arguments are supported:
 * `source` - (Required) The IP address range, in CIDR notation, e.g., `10.0.0.0/16`
 * `description` - (Optional) The description.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The IP group identifier.
 * `tags_all` - A map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).
 
 ## Import
 
-WorkSpaces IP groups can be imported using their GroupID, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import WorkSpaces IP groups using their GroupID. For example:
 
+```terraform
+import {
+  to = aws_workspaces_ip_group.example
+  id = "wsipg-488lrtl3k"
+}
 ```
-$ terraform import aws_workspaces_ip_group.example wsipg-488lrtl3k
+
+Using `terraform import`, import WorkSpaces IP groups using their GroupID. For example:
+
+```console
+% terraform import aws_workspaces_ip_group.example wsipg-488lrtl3k
 ```
diff --git a/website/docs/r/workspaces_workspace.html.markdown b/website/docs/r/workspaces_workspace.html.markdown
index b160827e5fd..e740cd4d803 100644
--- a/website/docs/r/workspaces_workspace.html.markdown
+++ b/website/docs/r/workspaces_workspace.html.markdown
@@ -44,7 +44,7 @@ resource "aws_workspaces_workspace" "example" {
 
 ## Argument Reference
 
-The following arguments are supported:
+This resource supports the following arguments:
 
 * `directory_id` - (Required) The ID of the directory for the WorkSpace.
 * `bundle_id` - (Required) The ID of the bundle for the WorkSpace.
@@ -63,9 +63,9 @@ The following arguments are supported:
 * `running_mode_auto_stop_timeout_in_minutes` – (Optional) The time after a user logs off when WorkSpaces are automatically stopped. Configured in 60-minute intervals.
 * `user_volume_size_gib` – (Optional) The size of the user storage.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The workspaces ID.
 * `ip_address` - The IP address of the WorkSpace.
@@ -83,8 +83,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-Workspaces can be imported using their ID, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Workspaces using their ID. For example:
 
+```terraform
+import {
+  to = aws_workspaces_workspace.example
+  id = "ws-9z9zmbkhv"
+}
 ```
-$ terraform import aws_workspaces_workspace.example ws-9z9zmbkhv
+
+Using `terraform import`, import Workspaces using their ID. For example:
+
+```console
+% terraform import aws_workspaces_workspace.example ws-9z9zmbkhv
 ```
diff --git a/website/docs/r/xray_encryption_config.html.markdown b/website/docs/r/xray_encryption_config.html.markdown
index fe76aed34f1..54fa5d8bfc5 100644
--- a/website/docs/r/xray_encryption_config.html.markdown
+++ b/website/docs/r/xray_encryption_config.html.markdown
@@ -56,16 +56,25 @@ resource "aws_xray_encryption_config" "example" {
 * `type` - (Required) The type of encryption. Set to `KMS` to use your own key for encryption. Set to `NONE` for default encryption.
 * `key_id` - (Optional) An AWS KMS customer master key (CMK) ARN.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - Region name.
 
 ## Import
 
-XRay Encryption Config can be imported using the region name, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import XRay Encryption Config using the region name. For example:
 
+```terraform
+import {
+  to = aws_xray_encryption_config.example
+  id = "us-west-2"
+}
 ```
-$ terraform import aws_xray_encryption_config.example us-west-2
+
+Using `terraform import`, import XRay Encryption Config using the region name. For example:
+
+```console
+% terraform import aws_xray_encryption_config.example us-west-2
 ```
diff --git a/website/docs/r/xray_group.html.markdown b/website/docs/r/xray_group.html.markdown
index c539bf292b9..5c550cefedd 100644
--- a/website/docs/r/xray_group.html.markdown
+++ b/website/docs/r/xray_group.html.markdown
@@ -38,9 +38,9 @@ resource "aws_xray_group" "example" {
 * `insights_enabled` - (Required) Specifies whether insights are enabled.
 * `notifications_enabled` - (Optional) Specifies whether insight notifications are enabled.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The ARN of the Group.
 * `arn` - The ARN of the Group.
@@ -48,8 +48,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-XRay Groups can be imported using the ARN, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import XRay Groups using the ARN. For example:
 
+```terraform
+import {
+  to = aws_xray_group.example
+  id = "arn:aws:xray:us-west-2:1234567890:group/example-group/TNGX7SW5U6QY36T4ZMOUA3HVLBYCZTWDIOOXY3CJAXTHSS3YCWUA"
+}
 ```
-$ terraform import aws_xray_group.example arn:aws:xray:us-west-2:1234567890:group/example-group/TNGX7SW5U6QY36T4ZMOUA3HVLBYCZTWDIOOXY3CJAXTHSS3YCWUA
+
+Using `terraform import`, import XRay Groups using the ARN. For example:
+
+```console
+% terraform import aws_xray_group.example arn:aws:xray:us-west-2:1234567890:group/example-group/TNGX7SW5U6QY36T4ZMOUA3HVLBYCZTWDIOOXY3CJAXTHSS3YCWUA
 ```
diff --git a/website/docs/r/xray_sampling_rule.html.markdown b/website/docs/r/xray_sampling_rule.html.markdown
index 7e58b9c60c7..b5a26f5ec5b 100644
--- a/website/docs/r/xray_sampling_rule.html.markdown
+++ b/website/docs/r/xray_sampling_rule.html.markdown
@@ -48,9 +48,9 @@ resource "aws_xray_sampling_rule" "example" {
 * `attributes` - (Optional) Matches attributes derived from the request.
 * `tags` - (Optional) Key-value mapping of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
 
-## Attributes Reference
+## Attribute Reference
 
-In addition to all arguments above, the following attributes are exported:
+This resource exports the following attributes in addition to the arguments above:
 
 * `id` - The name of the sampling rule.
 * `arn` - The ARN of the sampling rule.
@@ -58,8 +58,17 @@ In addition to all arguments above, the following attributes are exported:
 
 ## Import
 
-XRay Sampling Rules can be imported using the name, e.g.,
+In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import XRay Sampling Rules using the name. For example:
 
+```terraform
+import {
+  to = aws_xray_sampling_rule.example
+  id = "example"
+}
 ```
-$ terraform import aws_xray_sampling_rule.example example
+
+Using `terraform import`, import XRay Sampling Rules using the name. For example:
+
+```console
+% terraform import aws_xray_sampling_rule.example example
 ```